diff --git a/deps/v8/.gitignore b/deps/v8/.gitignore
index c7f3cba05c576f..1afbd765d3e6c2 100644
--- a/deps/v8/.gitignore
+++ b/deps/v8/.gitignore
@@ -24,6 +24,7 @@
 .#*
 .*.sw?
 .ccls-cache
+.clangd
 .cpplint-cache
 .cproject
 .gclient_entries
@@ -99,6 +100,7 @@ compile_commands.json
 gccauses
 gcsuspects
 gtags.files
+jit-*.dump
 node_modules
 tags
 turbo*.cfg
@@ -108,3 +110,7 @@ v8.ignition_dispatches_table.json
 
 !/third_party/jinja2
 !/third_party/markupsafe
+!/third_party/zlib
+/third_party/zlib/contrib/bench
+/third_party/zlib/contrib/tests
+/third_party/zlib/google/test
diff --git a/deps/v8/.ycm_extra_conf.py b/deps/v8/.ycm_extra_conf.py
index 74e605431a6653..25d01c1881797f 100644
--- a/deps/v8/.ycm_extra_conf.py
+++ b/deps/v8/.ycm_extra_conf.py
@@ -103,27 +103,16 @@ def GetClangCommandFromNinjaForFilename(v8_root, filename):
   # Header files can't be built. Instead, try to match a header file to its
   # corresponding source file.
   if filename.endswith('.h'):
-    alternates = ['.cc', '.cpp']
-    for alt_extension in alternates:
-      alt_name = filename[:-2] + alt_extension
-      if os.path.exists(alt_name):
-        filename = alt_name
+    base = filename[:-6] if filename.endswith('-inl.h') else filename[:-2]
+    for alternate in [base + e for e in ['.cc', '.cpp']]:
+      if os.path.exists(alternate):
+        filename = alternate
         break
     else:
-      if filename.endswith('-inl.h'):
-        for alt_extension in alternates:
-          alt_name = filename[:-6] + alt_extension
-          if os.path.exists(alt_name):
-            filename = alt_name
-            break;
-        else:
-          # If this is a standalone -inl.h file with no source, the best we can
-          # do is try to use the default flags.
-          return v8_flags
-      else:
-        # If this is a standalone .h file with no source, the best we can do is
-        # try to use the default flags.
-        return v8_flags
+      # If this is a standalone .h file with no source, we ask ninja for the
+      # compile flags of some generic cc file ('src/utils/utils.cc'). This
+      # should contain most/all of the interesting flags for other targets too.
+      filename = os.path.join(v8_root, 'src', 'utils', 'utils.cc')
 
   sys.path.append(os.path.join(v8_root, 'tools', 'ninja'))
   from ninja_output import GetNinjaOutputDirectory
diff --git a/deps/v8/AUTHORS b/deps/v8/AUTHORS
index 40c4f16c813964..819d147096c496 100644
--- a/deps/v8/AUTHORS
+++ b/deps/v8/AUTHORS
@@ -68,6 +68,7 @@ Bert Belder <bertbelder@gmail.com>
 Burcu Dogan <burcujdogan@gmail.com>
 Caitlin Potter <caitpotter88@gmail.com>
 Craig Schlenter <craig.schlenter@gmail.com>
+Chengzhong Wu <legendecas@gmail.com>
 Choongwoo Han <cwhan.tunz@gmail.com>
 Chris Nardi <hichris123@gmail.com>
 Christopher A. Taylor <chris@gameclosure.com>
@@ -95,6 +96,7 @@ Hannu Trey <hannu.trey@gmail.com>
 Henrique Ferreiro <henrique.ferreiro@gmail.com>
 Hirofumi Mako <mkhrfm@gmail.com>
 Honggyu Kim <honggyu.kp@gmail.com>
+Huáng Jùnliàng <jlhwung@gmail.com>
 Ingvar Stepanyan <me@rreverser.com>
 Ioseb Dzmanashvili <ioseb.dzmanashvili@gmail.com>
 Isiah Meadows <impinball@gmail.com>
@@ -196,7 +198,10 @@ Wiktor Garbacz <wiktor.garbacz@gmail.com>
 Xiaoyin Liu <xiaoyin.l@outlook.com>
 Yannic Bonenberger <contact@yannic-bonenberger.com>
 Yong Wang <ccyongwang@tencent.com>
+Youfeng Hao <ajihyf@gmail.com>
 Yu Yin <xwafish@gmail.com>
 Zac Hansen <xaxxon@gmail.com>
+Zhao Jiazhong <kyslie3100@gmail.com>
 Zhongping Wang <kewpie.w.zp@gmail.com>
 柳荣一 <admin@web-tinker.com>
+Yanbo Li <lybvinci@gmail.com>
diff --git a/deps/v8/BUILD.gn b/deps/v8/BUILD.gn
index 0a1f12b5de9cba..0ffa2b794df744 100644
--- a/deps/v8/BUILD.gn
+++ b/deps/v8/BUILD.gn
@@ -6,7 +6,6 @@ import("//build/config/android/config.gni")
 import("//build/config/arm.gni")
 import("//build/config/dcheck_always_on.gni")
 import("//build/config/host_byteorder.gni")
-import("//build/config/jumbo.gni")
 import("//build/config/mips.gni")
 import("//build/config/sanitizers/sanitizers.gni")
 import("//build_overrides/build.gni")
@@ -21,7 +20,7 @@ import("gni/v8.gni")
 # Specifies if the target build is a simulator build. Comparing target cpu
 # with v8 target cpu to not affect simulator builds for making cross-compile
 # snapshots.
-is_target_simulator = (target_cpu != v8_target_cpu && !v8_multi_arch_build) ||
+target_is_simulator = (target_cpu != v8_target_cpu && !v8_multi_arch_build) ||
                       (current_cpu != v8_current_cpu && v8_multi_arch_build)
 
 # For faster Windows builds. See https://crbug.com/v8/8475.
@@ -76,6 +75,9 @@ declare_args() {
   # Sets -dENABLE_VTUNE_JIT_INTERFACE.
   v8_enable_vtunejit = false
 
+  # Sets -dENABLE_VTUNE_TRACEMARK.
+  v8_enable_vtunetracemark = false
+
   # Sets -dENABLE_HANDLE_ZAPPING.
   v8_enable_handle_zapping = is_debug
 
@@ -88,9 +90,6 @@ declare_args() {
   # Optimize code for Torque executable, even during a debug build.
   v8_enable_fast_torque = ""
 
-  # Enable embedded builtins.
-  v8_enable_embedded_builtins = true
-
   # Enable the registration of unwinding info for Windows x64 and ARM64.
   v8_win64_unwinding_info = true
 
@@ -107,8 +106,8 @@ declare_args() {
   v8_enable_verify_csa = false
 
   # Enable pointer compression (sets -dV8_COMPRESS_POINTERS).
-  v8_enable_pointer_compression = false
-  v8_enable_31bit_smis_on_64bit_arch = false
+  v8_enable_pointer_compression = ""
+  v8_enable_31bit_smis_on_64bit_arch = true
 
   # Sets -dOBJECT_PRINT.
   v8_enable_object_print = ""
@@ -128,6 +127,9 @@ declare_args() {
   # Sets -dV8_CONCURRENT_MARKING
   v8_enable_concurrent_marking = true
 
+  # Sets -dV8_ARRAY_BUFFER_EXTENSION
+  v8_enable_array_buffer_extension = false
+
   # Enables various testing features.
   v8_enable_test_features = ""
 
@@ -154,10 +156,6 @@ declare_args() {
   # Controls the threshold for on-heap/off-heap Typed Arrays.
   v8_typed_array_max_size_in_heap = 64
 
-  # List of extra files to snapshot. They will be snapshotted in order so
-  # if files export symbols used by later files, they should go first.
-  v8_extra_library_files = []
-
   v8_enable_gdbjit =
       ((v8_current_cpu == "x86" || v8_current_cpu == "x64") &&
        (is_linux || is_mac)) || (v8_current_cpu == "ppc64" && is_linux)
@@ -172,7 +170,7 @@ declare_args() {
   # site-isolation in Chrome and on simulator builds which test code generation
   # on these platforms.
   v8_untrusted_code_mitigations =
-      v8_current_cpu != "x86" && (is_android || is_target_simulator)
+      v8_current_cpu != "x86" && (is_android || target_is_simulator)
 
   # Enable minor mark compact.
   v8_enable_minor_mc = true
@@ -189,6 +187,15 @@ declare_args() {
   # Enable lazy source positions by default.
   v8_enable_lazy_source_positions = true
 
+  # Enable third party HEAP library
+  v8_enable_third_party_heap = false
+
+  # Libaries used by third party heap
+  v8_third_party_heap_libs = []
+
+  # Source code used by third party heap
+  v8_third_party_heap_files = []
+
   # Disable write barriers when GCs are non-incremental and
   # heap has single generation.
   v8_disable_write_barriers = false
@@ -200,15 +207,10 @@ declare_args() {
   # Use token threaded dispatch for the regular expression interpreter.
   # Use switch-based dispatch if this is false
   v8_enable_regexp_interpreter_threaded_dispatch = true
-}
 
-# Toggle pointer compression for correctness fuzzing when building the
-# clang_x64_pointer_compression toolchain. We'll correctness-compare the
-# default build with the clang_x64_pointer_compression build.
-if (v8_multi_arch_build &&
-    rebase_path(get_label_info(":d8", "root_out_dir"), root_build_dir) ==
-    "clang_x64_pointer_compression") {
-  v8_enable_pointer_compression = !v8_enable_pointer_compression
+  # Enable additional targets necessary for verification of torque
+  # file generation
+  v8_verify_torque_generation_invariance = false
 }
 
 # Derived defaults.
@@ -237,8 +239,10 @@ if (v8_check_microtasks_scopes_consistency == "") {
 if (v8_enable_snapshot_native_code_counters == "") {
   v8_enable_snapshot_native_code_counters = v8_enable_debugging_features
 }
-if (v8_enable_shared_ro_heap == "") {
-  v8_enable_shared_ro_heap = !v8_enable_pointer_compression
+if (v8_enable_pointer_compression == "") {
+  # TODO(v8:v7703): temporarily enable pointer compression on arm64 and on x64
+  v8_enable_pointer_compression =
+      v8_current_cpu == "arm64" || v8_current_cpu == "x64"
 }
 if (v8_enable_fast_torque == "") {
   v8_enable_fast_torque = v8_enable_fast_mksnapshot
@@ -248,23 +252,28 @@ if (v8_enable_single_generation == "") {
   v8_enable_single_generation = v8_disable_write_barriers
 }
 
+# Toggle pointer compression for correctness fuzzing when building the
+# clang_x64_pointer_compression toolchain. We'll correctness-compare the
+# default build with the clang_x64_pointer_compression build.
+if (v8_multi_arch_build &&
+    rebase_path(get_label_info(":d8", "root_out_dir"), root_build_dir) ==
+    "clang_x64_pointer_compression") {
+  v8_enable_pointer_compression = !v8_enable_pointer_compression
+}
+if (v8_enable_shared_ro_heap == "") {
+  v8_enable_shared_ro_heap = !v8_enable_pointer_compression
+}
+
 assert(!v8_disable_write_barriers || v8_enable_single_generation,
        "Disabling write barriers works only with single generation")
 
 assert(v8_current_cpu != "x86" || !v8_untrusted_code_mitigations,
        "Untrusted code mitigations are unsupported on ia32")
 
-assert(!v8_enable_lite_mode || v8_enable_embedded_builtins,
-       "Lite mode requires embedded builtins")
-
 assert(
     !v8_enable_pointer_compression || !v8_enable_shared_ro_heap,
     "Pointer compression is not supported with shared read-only heap enabled")
 
-assert(v8_extra_library_files == [],
-       "v8_extra_library_files is no longer supported. Consider implementing " +
-           "custom API in C++ instead.")
-
 v8_random_seed = "314159265"
 v8_toolset_for_shell = "host"
 
@@ -387,9 +396,11 @@ config("features") {
   }
   defines +=
       [ "V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP=${v8_typed_array_max_size_in_heap}" ]
-  if (v8_enable_raw_heap_snapshots) {
-    defines += [ "V8_ENABLE_RAW_HEAP_SNAPSHOTS" ]
-  }
+
+  assert(
+      !v8_enable_raw_heap_snapshots,
+      "This flag is deprecated and is now available through the inspector interface as an argument to profiler's method `takeHeapSnapshot`. Consider using blink's flag `enable_additional_blink_object_names` to get better naming of internal objects.")
+
   if (v8_enable_future) {
     defines += [ "V8_ENABLE_FUTURE" ]
   }
@@ -406,6 +417,9 @@ config("features") {
   if (v8_enable_vtunejit) {
     defines += [ "ENABLE_VTUNE_JIT_INTERFACE" ]
   }
+  if (v8_enable_vtunetracemark) {
+    defines += [ "ENABLE_VTUNE_TRACEMARK" ]
+  }
   if (v8_enable_minor_mc) {
     defines += [ "ENABLE_MINOR_MC" ]
   }
@@ -447,21 +461,28 @@ config("features") {
   if (v8_disable_write_barriers) {
     defines += [ "V8_DISABLE_WRITE_BARRIERS" ]
   }
+  if (v8_enable_third_party_heap) {
+    defines += [ "V8_ENABLE_THIRD_PARTY_HEAP" ]
+  }
   if (v8_use_external_startup_data) {
     defines += [ "V8_USE_EXTERNAL_STARTUP_DATA" ]
   }
   if (v8_enable_concurrent_marking) {
     defines += [ "V8_CONCURRENT_MARKING" ]
   }
+  if (v8_enable_array_buffer_extension) {
+    defines += [ "V8_ARRAY_BUFFER_EXTENSION" ]
+  }
   if (v8_enable_lazy_source_positions) {
     defines += [ "V8_ENABLE_LAZY_SOURCE_POSITIONS" ]
   }
   if (v8_check_microtasks_scopes_consistency) {
     defines += [ "V8_CHECK_MICROTASKS_SCOPES_CONSISTENCY" ]
   }
-  if (v8_enable_embedded_builtins) {
-    defines += [ "V8_EMBEDDED_BUILTINS" ]
-  }
+
+  # TODO(v8:8519): Remove the define once all use-sites in
+  #                the code are removed/fixed
+  defines += [ "V8_EMBEDDED_BUILTINS" ]
   if (v8_use_multi_snapshots) {
     defines += [ "V8_MULTI_SNAPSHOTS" ]
   }
@@ -525,7 +546,7 @@ config("toolchain") {
   }
 
   # Mips64el/mipsel simulators.
-  if (is_target_simulator &&
+  if (target_is_simulator &&
       (v8_current_cpu == "mipsel" || v8_current_cpu == "mips64el")) {
     defines += [ "_MIPS_TARGET_SIMULATOR" ]
   }
@@ -743,6 +764,10 @@ config("toolchain") {
     ]
   }
 
+  if (!is_clang && is_win) {
+    cflags += [ "/wd4506" ]  # Benign "no definition for inline function"
+  }
+
   if (!is_clang && !is_win) {
     cflags += [
       # Disable gcc warnings for optimizations based on the assumption that
@@ -809,15 +834,9 @@ template("asm_to_inline_asm") {
     assert(emit_builtins_as_inline_asm)
 
     script = "tools/snapshot/asm_to_inline_asm.py"
-    deps = [
-      ":run_mksnapshot_" + name,
-    ]
-    sources = [
-      "$target_gen_dir/embedded${suffix}.S",
-    ]
-    outputs = [
-      "$target_gen_dir/embedded${suffix}.cc",
-    ]
+    deps = [ ":run_mksnapshot_" + name ]
+    sources = [ "$target_gen_dir/embedded${suffix}.S" ]
+    outputs = [ "$target_gen_dir/embedded${suffix}.cc" ]
     args = invoker.args
     args += [
       rebase_path("$target_gen_dir/embedded${suffix}.S", root_build_dir),
@@ -826,42 +845,12 @@ template("asm_to_inline_asm") {
   }
 }
 
-action("js2c_extras") {
-  visibility = [ ":*" ]  # Only targets in this file can depend on this.
-
-  script = "tools/js2c.py"
-
-  sources = v8_extra_library_files
-
-  outputs = [
-    "$target_gen_dir/extras-libraries.cc",
-  ]
-
-  args = [
-           rebase_path("$target_gen_dir/extras-libraries.cc", root_build_dir),
-           "EXTRAS",
-         ] + rebase_path(sources, root_build_dir)
-
-  if (v8_use_external_startup_data) {
-    outputs += [ "$target_gen_dir/libraries_extras.bin" ]
-    args += [
-      "--startup_blob",
-      rebase_path("$target_gen_dir/libraries_extras.bin", root_build_dir),
-    ]
-  }
-}
-
 if (is_android && enable_java_templates) {
   android_assets("v8_external_startup_data_assets") {
     if (v8_use_external_startup_data) {
       # We don't support side-by-side snapshots on Android within Chromium.
       assert(!v8_use_multi_snapshots)
-      deps = [
-        "//v8",
-      ]
-      sources = [
-        "$root_out_dir/natives_blob.bin",
-      ]
+      deps = [ "//v8" ]
       renaming_sources = [ "$root_out_dir/snapshot_blob.bin" ]
       if (current_cpu == "arm" || current_cpu == "x86" ||
           current_cpu == "mipsel") {
@@ -874,33 +863,6 @@ if (is_android && enable_java_templates) {
   }
 }
 
-if (v8_use_external_startup_data) {
-  action("natives_blob") {
-    visibility = [ ":*" ]  # Only targets in this file can depend on this.
-
-    deps = [
-      ":js2c_extras",
-    ]
-
-    # NOSORT
-    sources = [
-      "$target_gen_dir/libraries_extras.bin",
-    ]
-
-    outputs = [
-      "$root_out_dir/natives_blob.bin",
-    ]
-
-    data = [
-      "$root_out_dir/natives_blob.bin",
-    ]
-
-    script = "tools/concatenate-files.py"
-
-    args = rebase_path(sources + outputs, root_build_dir)
-  }
-}
-
 action("postmortem-metadata") {
   # Only targets in this file and the top-level visibility target can
   # depend on this.
@@ -972,26 +934,23 @@ action("postmortem-metadata") {
     "$target_gen_dir/torque-generated/instance-types-tq.h",
   ]
 
-  outputs = [
-    "$target_gen_dir/debug-support.cc",
-  ]
+  outputs = [ "$target_gen_dir/debug-support.cc" ]
 
   args = rebase_path(outputs, root_build_dir) +
          rebase_path(sources, root_build_dir)
 
-  deps = [
-    ":run_torque",
-  ]
+  deps = [ ":run_torque" ]
 }
 
 torque_files = [
-  "src/builtins/arguments.tq",
   "src/builtins/array-copywithin.tq",
   "src/builtins/array-every.tq",
   "src/builtins/array-filter.tq",
   "src/builtins/array-find.tq",
   "src/builtins/array-findindex.tq",
   "src/builtins/array-foreach.tq",
+  "src/builtins/array-from.tq",
+  "src/builtins/array-isarray.tq",
   "src/builtins/array-join.tq",
   "src/builtins/array-lastindexof.tq",
   "src/builtins/array-map.tq",
@@ -1008,16 +967,32 @@ torque_files = [
   "src/builtins/base.tq",
   "src/builtins/bigint.tq",
   "src/builtins/boolean.tq",
+  "src/builtins/builtins-string.tq",
   "src/builtins/collections.tq",
+  "src/builtins/cast.tq",
+  "src/builtins/convert.tq",
+  "src/builtins/console.tq",
   "src/builtins/data-view.tq",
-  "src/builtins/extras-utils.tq",
   "src/builtins/frames.tq",
+  "src/builtins/frame-arguments.tq",
   "src/builtins/growable-fixed-array.tq",
   "src/builtins/internal-coverage.tq",
   "src/builtins/iterator.tq",
   "src/builtins/math.tq",
+  "src/builtins/number.tq",
   "src/builtins/object-fromentries.tq",
   "src/builtins/object.tq",
+  "src/builtins/promise-abstract-operations.tq",
+  "src/builtins/promise-all.tq",
+  "src/builtins/promise-all-element-closure.tq",
+  "src/builtins/promise-constructor.tq",
+  "src/builtins/promise-finally.tq",
+  "src/builtins/promise-misc.tq",
+  "src/builtins/promise-race.tq",
+  "src/builtins/promise-reaction-job.tq",
+  "src/builtins/promise-resolve.tq",
+  "src/builtins/promise-then.tq",
+  "src/builtins/promise-jobs.tq",
   "src/builtins/proxy-constructor.tq",
   "src/builtins/proxy-delete-property.tq",
   "src/builtins/proxy-get-property.tq",
@@ -1040,15 +1015,17 @@ torque_files = [
   "src/builtins/regexp-split.tq",
   "src/builtins/regexp-test.tq",
   "src/builtins/regexp.tq",
-  "src/builtins/string.tq",
   "src/builtins/string-endswith.tq",
   "src/builtins/string-html.tq",
   "src/builtins/string-iterator.tq",
   "src/builtins/string-pad.tq",
   "src/builtins/string-repeat.tq",
+  "src/builtins/string-replaceall.tq",
   "src/builtins/string-slice.tq",
   "src/builtins/string-startswith.tq",
   "src/builtins/string-substring.tq",
+  "src/builtins/string-substr.tq",
+  "src/builtins/symbol.tq",
   "src/builtins/torque-internal.tq",
   "src/builtins/typed-array-createtypedarray.tq",
   "src/builtins/typed-array-every.tq",
@@ -1056,13 +1033,71 @@ torque_files = [
   "src/builtins/typed-array-find.tq",
   "src/builtins/typed-array-findindex.tq",
   "src/builtins/typed-array-foreach.tq",
+  "src/builtins/typed-array-from.tq",
+  "src/builtins/typed-array-of.tq",
   "src/builtins/typed-array-reduce.tq",
   "src/builtins/typed-array-reduceright.tq",
+  "src/builtins/typed-array-set.tq",
   "src/builtins/typed-array-slice.tq",
   "src/builtins/typed-array-some.tq",
+  "src/builtins/typed-array-sort.tq",
   "src/builtins/typed-array-subarray.tq",
   "src/builtins/typed-array.tq",
+  "src/ic/handler-configuration.tq",
+  "src/objects/allocation-site.tq",
+  "src/objects/api-callbacks.tq",
+  "src/objects/arguments.tq",
+  "src/objects/cell.tq",
+  "src/objects/code.tq",
+  "src/objects/contexts.tq",
+  "src/objects/data-handler.tq",
+  "src/objects/debug-objects.tq",
+  "src/objects/descriptor-array.tq",
+  "src/objects/embedder-data-array.tq",
+  "src/objects/feedback-cell.tq",
+  "src/objects/feedback-vector.tq",
+  "src/objects/fixed-array.tq",
+  "src/objects/foreign.tq",
+  "src/objects/free-space.tq",
+  "src/objects/heap-number.tq",
+  "src/objects/heap-object.tq",
   "src/objects/intl-objects.tq",
+  "src/objects/js-array-buffer.tq",
+  "src/objects/js-array.tq",
+  "src/objects/js-collection-iterator.tq",
+  "src/objects/js-collection.tq",
+  "src/objects/js-generator.tq",
+  "src/objects/js-objects.tq",
+  "src/objects/js-promise.tq",
+  "src/objects/js-proxy.tq",
+  "src/objects/js-regexp-string-iterator.tq",
+  "src/objects/js-regexp.tq",
+  "src/objects/js-weak-refs.tq",
+  "src/objects/literal-objects.tq",
+  "src/objects/map.tq",
+  "src/objects/microtask.tq",
+  "src/objects/module.tq",
+  "src/objects/name.tq",
+  "src/objects/oddball.tq",
+  "src/objects/ordered-hash-table.tq",
+  "src/objects/primitive-heap-object.tq",
+  "src/objects/promise.tq",
+  "src/objects/property-array.tq",
+  "src/objects/property-cell.tq",
+  "src/objects/property-descriptor-object.tq",
+  "src/objects/prototype-info.tq",
+  "src/objects/regexp-match-info.tq",
+  "src/objects/scope-info.tq",
+  "src/objects/script.tq",
+  "src/objects/shared-function-info.tq",
+  "src/objects/source-text-module.tq",
+  "src/objects/stack-frame-info.tq",
+  "src/objects/string.tq",
+  "src/objects/struct.tq",
+  "src/objects/synthetic-module.tq",
+  "src/objects/template-objects.tq",
+  "src/objects/template.tq",
+  "src/wasm/wasm-objects.tq",
   "test/torque/test-torque.tq",
   "third_party/v8/builtins/array-sort.tq",
 ]
@@ -1071,64 +1106,119 @@ if (!v8_enable_i18n_support) {
   torque_files -= [ "src/objects/intl-objects.tq" ]
 }
 
-action("run_torque") {
-  visibility = [
-    ":*",
-    "tools/debug_helper/:*",
-    "tools/gcmole/:*",
-    "test/cctest/:*",
-  ]
+# Template for running torque
+# When building with v8_verify_torque_generation_invariance=true we need
+# to be able to run torque for both 32 and 64 bits in the same build
+template("run_torque") {
+  if (target_name == "") {
+    suffix = ""
+  } else {
+    suffix = "_$target_name"
+  }
 
-  deps = [
-    ":torque($v8_generator_toolchain)",
-  ]
+  toolchain = invoker.toolchain
 
-  script = "tools/run.py"
+  action("run_torque" + suffix) {
+    visibility = [
+      ":*",
+      "tools/debug_helper/:*",
+      "tools/gcmole/:*",
+      "test/cctest/:*",
+    ]
 
-  sources = torque_files
+    deps = [ ":torque($toolchain)" ]
 
-  outputs = [
-    "$target_gen_dir/torque-generated/builtin-definitions-tq.h",
-    "$target_gen_dir/torque-generated/interface-descriptors-tq.inc",
-    "$target_gen_dir/torque-generated/field-offsets-tq.h",
-    "$target_gen_dir/torque-generated/class-verifiers-tq.cc",
-    "$target_gen_dir/torque-generated/class-verifiers-tq.h",
-    "$target_gen_dir/torque-generated/objects-printer-tq.cc",
-    "$target_gen_dir/torque-generated/class-definitions-tq.cc",
-    "$target_gen_dir/torque-generated/class-definitions-tq-inl.h",
-    "$target_gen_dir/torque-generated/class-definitions-tq.h",
-    "$target_gen_dir/torque-generated/class-debug-readers-tq.cc",
-    "$target_gen_dir/torque-generated/class-debug-readers-tq.h",
-    "$target_gen_dir/torque-generated/exported-macros-assembler-tq.cc",
-    "$target_gen_dir/torque-generated/exported-macros-assembler-tq.h",
-    "$target_gen_dir/torque-generated/csa-types-tq.h",
-    "$target_gen_dir/torque-generated/instance-types-tq.h",
-  ]
-  foreach(file, torque_files) {
-    filetq = string_replace(file, ".tq", "-tq-csa")
-    outputs += [
-      "$target_gen_dir/torque-generated/$filetq.cc",
-      "$target_gen_dir/torque-generated/$filetq.h",
+    script = "tools/run.py"
+
+    sources = torque_files
+
+    destination_folder = "$target_gen_dir/torque-generated$suffix"
+
+    files = [
+      "bit-fields-tq.h",
+      "builtin-definitions-tq.h",
+      "interface-descriptors-tq.inc",
+      "field-offsets-tq.h",
+      "class-verifiers-tq.cc",
+      "class-verifiers-tq.h",
+      "enum-verifiers-tq.cc",
+      "objects-printer-tq.cc",
+      "class-definitions-tq.cc",
+      "class-definitions-tq-inl.h",
+      "class-definitions-tq.h",
+      "class-debug-readers-tq.cc",
+      "class-debug-readers-tq.h",
+      "exported-macros-assembler-tq.cc",
+      "exported-macros-assembler-tq.h",
+      "csa-types-tq.h",
+      "instance-types-tq.h",
+      "internal-class-definitions-tq.h",
+      "internal-class-definitions-tq-inl.h",
+    ]
+
+    outputs = []
+    foreach(file, files) {
+      outputs += [ "$destination_folder/$file" ]
+    }
+
+    foreach(file, torque_files) {
+      filetq = string_replace(file, ".tq", "-tq-csa")
+      outputs += [
+        "$destination_folder/$filetq.cc",
+        "$destination_folder/$filetq.h",
+      ]
+    }
+
+    args = [
+      "./" + rebase_path(
+              get_label_info(":torque($toolchain)", "root_out_dir") + "/torque",
+              root_build_dir),
+      "-o",
+      rebase_path("$destination_folder", root_build_dir),
+      "-v8-root",
+      rebase_path(".", root_build_dir),
     ]
+    if (defined(invoker.args)) {
+      args += invoker.args
+    }
+    args += torque_files
   }
+}
 
-  args = [
-    "./" + rebase_path(get_label_info(":torque($v8_generator_toolchain)",
-                                      "root_out_dir") + "/torque",
-                       root_build_dir),
-    "-o",
-    rebase_path("$target_gen_dir/torque-generated", root_build_dir),
-    "-v8-root",
-    rebase_path(".", root_build_dir),
-  ]
-  args += torque_files
+# Default run_torque action
+run_torque("") {
+  toolchain = v8_generator_toolchain
+}
+
+if (v8_verify_torque_generation_invariance) {
+  run_torque("x86") {
+    toolchain = "//build/toolchain/linux:clang_x86"
+  }
+
+  run_torque("x64") {
+    args = [ "-m32" ]
+    toolchain = "//build/toolchain/linux:clang_x64"
+  }
+
+  action("compare_torque_runs") {
+    deps = [
+      ":run_torque_x64",
+      ":run_torque_x86",
+    ]
+    report_file = "$target_gen_dir/torque_comparison_results.txt"
+    script = "tools/compare_torque_output.py"
+    args = [
+      rebase_path("$target_gen_dir/torque-generated_x64", root_build_dir),
+      rebase_path("$target_gen_dir/torque-generated_x86", root_build_dir),
+      rebase_path(report_file, root_build_dir),
+    ]
+    outputs = [ report_file ]
+  }
 }
 
 group("v8_maybe_icu") {
   if (v8_enable_i18n_support) {
-    public_deps = [
-      "//third_party/icu",
-    ]
+    public_deps = [ "//third_party/icu" ]
   }
 }
 
@@ -1140,14 +1230,14 @@ v8_source_set("torque_generated_initializers") {
     ":run_torque",
   ]
 
-  public_deps = [
-    ":v8_maybe_icu",
-  ]
+  public_deps = [ ":v8_maybe_icu" ]
 
   sources = [
     "$target_gen_dir/torque-generated/csa-types-tq.h",
+    "$target_gen_dir/torque-generated/enum-verifiers-tq.cc",
     "$target_gen_dir/torque-generated/exported-macros-assembler-tq.cc",
     "$target_gen_dir/torque-generated/exported-macros-assembler-tq.h",
+    "src/torque/runtime-support.h",
   ]
   foreach(file, torque_files) {
     filetq = string_replace(file, ".tq", "-tq-csa")
@@ -1168,9 +1258,7 @@ v8_source_set("torque_generated_definitions") {
     ":run_torque",
   ]
 
-  public_deps = [
-    ":v8_maybe_icu",
-  ]
+  public_deps = [ ":v8_maybe_icu" ]
 
   sources = [
     "$target_gen_dir/torque-generated/class-definitions-tq.cc",
@@ -1184,12 +1272,8 @@ v8_source_set("torque_generated_definitions") {
 
 action("generate_bytecode_builtins_list") {
   script = "tools/run.py"
-  outputs = [
-    "$target_gen_dir/builtins-generated/bytecodes-builtins-list.h",
-  ]
-  deps = [
-    ":bytecode_builtins_list_generator($v8_generator_toolchain)",
-  ]
+  outputs = [ "$target_gen_dir/builtins-generated/bytecodes-builtins-list.h" ]
+  deps = [ ":bytecode_builtins_list_generator($v8_generator_toolchain)" ]
   args = [
     "./" + rebase_path(
             get_label_info(
@@ -1221,9 +1305,7 @@ template("run_mksnapshot") {
   action("run_mksnapshot_" + name) {
     visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
-    deps = [
-      ":mksnapshot($v8_snapshot_toolchain)",
-    ]
+    deps = [ ":mksnapshot($v8_snapshot_toolchain)" ]
 
     script = "tools/run.py"
 
@@ -1245,22 +1327,26 @@ template("run_mksnapshot") {
       # but the target OS is really |current_os|.
       "--target_os=$current_os",
       "--target_arch=$current_cpu",
+
+      "--embedded_src",
+      rebase_path("$target_gen_dir/embedded${suffix}.S", root_build_dir),
     ]
 
+    # This is needed to distinguish between generating code for the simulator
+    # and cross-compiling. The latter may need to run code on the host with the
+    # simulator but cannot use simulator-specific instructions.
+    if (target_is_simulator) {
+      args += [ "--target_is_simulator" ]
+    }
+
     args += invoker.args
 
-    if (v8_enable_embedded_builtins) {
-      outputs += [ "$target_gen_dir/embedded${suffix}.S" ]
+    outputs += [ "$target_gen_dir/embedded${suffix}.S" ]
+    if (invoker.embedded_variant != "") {
       args += [
-        "--embedded_src",
-        rebase_path("$target_gen_dir/embedded${suffix}.S", root_build_dir),
+        "--embedded_variant",
+        invoker.embedded_variant,
       ]
-      if (invoker.embedded_variant != "") {
-        args += [
-          "--embedded_variant",
-          invoker.embedded_variant,
-        ]
-      }
     }
 
     if (v8_random_seed != "0") {
@@ -1320,14 +1406,16 @@ template("run_mksnapshot") {
         args += [ "--no-enable-slow-asserts" ]
       }
     }
+
+    if (v8_enable_verify_heap) {
+      args += [ "--verify-heap" ]
+    }
   }
 }
 
 run_mksnapshot("default") {
   args = []
-  if (v8_enable_embedded_builtins) {
-    embedded_variant = "Default"
-  }
+  embedded_variant = "Default"
 }
 if (emit_builtins_as_inline_asm) {
   asm_to_inline_asm("default") {
@@ -1337,9 +1425,7 @@ if (emit_builtins_as_inline_asm) {
 if (v8_use_multi_snapshots) {
   run_mksnapshot("trusted") {
     args = [ "--no-untrusted-code-mitigations" ]
-    if (v8_enable_embedded_builtins) {
-      embedded_variant = "Trusted"
-    }
+    embedded_variant = "Trusted"
   }
   if (emit_builtins_as_inline_asm) {
     asm_to_inline_asm("trusted") {
@@ -1350,9 +1436,7 @@ if (v8_use_multi_snapshots) {
 
 action("v8_dump_build_config") {
   script = "tools/testrunner/utils/dump_build_config.py"
-  outputs = [
-    "$root_out_dir/v8_build_config.json",
-  ]
+  outputs = [ "$root_out_dir/v8_build_config.json" ]
   is_gcov_coverage = v8_code_coverage && !is_clang
   is_full_debug = v8_enable_debugging_features && !v8_optimized_debug
   args = [
@@ -1375,7 +1459,6 @@ action("v8_dump_build_config") {
     "v8_enable_i18n_support=$v8_enable_i18n_support",
     "v8_enable_verify_predictable=$v8_enable_verify_predictable",
     "v8_target_cpu=\"$v8_target_cpu\"",
-    "v8_enable_embedded_builtins=$v8_enable_embedded_builtins",
     "v8_enable_verify_csa=$v8_enable_verify_csa",
     "v8_enable_lite_mode=$v8_enable_lite_mode",
     "v8_enable_pointer_compression=$v8_enable_pointer_compression",
@@ -1394,131 +1477,50 @@ action("v8_dump_build_config") {
 # Source Sets (aka static libraries)
 #
 
-source_set("v8_maybe_snapshot") {
-  if (v8_use_external_startup_data) {
-    public_deps = [
-      ":v8_external_snapshot",
-    ]
-  } else {
-    public_deps = [
-      ":v8_snapshot",
-    ]
-  }
-}
-
-v8_source_set("v8_nosnapshot") {
-  visibility = [ ":*" ]  # Only targets in this file can depend on this.
-
-  deps = [
-    ":js2c_extras",
-    ":torque_generated_initializers",
-  ]
+v8_source_set("v8_snapshot") {
+  visibility = [ ":*" ]  # Targets in this file can depend on this.
 
+  deps = []
   public_deps = [
-    ":v8_maybe_icu",
-  ]
-
-  sources = [
-    "$target_gen_dir/extras-libraries.cc",
-    "src/snapshot/embedded/embedded-empty.cc",
-    "src/snapshot/snapshot-empty.cc",
+    # This should be public so downstream targets can declare the snapshot
+    # output file as their inputs.
+    ":run_mksnapshot_default",
   ]
 
-  configs = [ ":internal_config" ]
-}
-
-if (!v8_use_external_startup_data) {
-  v8_source_set("v8_snapshot") {
-    # Only targets in this file and the top-level visibility target can
-    # depend on this.
-    visibility = [
-      ":*",
-      "//:gn_visibility",
-    ]
-
-    deps = [
-      ":js2c_extras",
-    ]
-
-    public_deps = [
-      # This should be public so downstream targets can declare the snapshot
-      # output file as their inputs.
-      ":run_mksnapshot_default",
-      ":v8_maybe_icu",
-    ]
-
-    # Do not publicize any header to remove build dependency.
-    public = []
-
-    sources = [
-      "$target_gen_dir/extras-libraries.cc",
-      "$target_gen_dir/snapshot.cc",
-      "src/init/setup-isolate-deserialize.cc",
-    ]
-
-    if (v8_enable_embedded_builtins && emit_builtins_as_inline_asm) {
-      deps += [ ":asm_to_inline_asm_default" ]
-      sources += [ "$target_gen_dir/embedded.cc" ]
-    } else if (v8_enable_embedded_builtins) {
-      sources += [ "$target_gen_dir/embedded.S" ]
-    } else {
-      sources += [ "src/snapshot/embedded/embedded-empty.cc" ]
-    }
+  # Do not publicize any header to remove build dependency.
+  public = []
 
-    configs = [ ":internal_config" ]
+  sources = [ "src/init/setup-isolate-deserialize.cc" ]
+  if (emit_builtins_as_inline_asm) {
+    deps += [ ":asm_to_inline_asm_default" ]
+    sources += [ "$target_gen_dir/embedded.cc" ]
+  } else {
+    sources += [ "$target_gen_dir/embedded.S" ]
   }
-}
 
-if (v8_use_external_startup_data) {
-  v8_source_set("v8_external_snapshot") {
-    visibility = [ ":*" ]  # Only targets in this file can depend on this.
+  configs = [ ":internal_config" ]
 
-    deps = [
-      ":js2c_extras",
-      ":v8_base",
-    ]
-    public_deps = [
-      ":natives_blob",
-      ":run_mksnapshot_default",
-    ]
+  if (v8_use_external_startup_data) {
+    deps += [ ":v8_base" ]
+
+    sources += [ "src/snapshot/snapshot-external.cc" ]
 
     if (v8_use_multi_snapshots) {
       public_deps += [ ":run_mksnapshot_trusted" ]
-    }
-
-    sources = [
-      "src/init/setup-isolate-deserialize.cc",
-      "src/snapshot/natives-external.cc",
-      "src/snapshot/snapshot-external.cc",
-    ]
-
-    # Do not publicize any header to remove build dependency.
-    public = []
-
-    if (v8_enable_embedded_builtins && emit_builtins_as_inline_asm) {
-      deps += [ ":asm_to_inline_asm_default" ]
-      sources += [ "$target_gen_dir/embedded.cc" ]
-
-      if (v8_use_multi_snapshots) {
+      if (emit_builtins_as_inline_asm) {
         deps += [ ":asm_to_inline_asm_trusted" ]
         sources += [ "$target_gen_dir/embedded_trusted.cc" ]
-        jumbo_excluded_sources = [ "$target_gen_dir/embedded_trusted.cc" ]
-      }
-    } else if (v8_enable_embedded_builtins) {
-      sources += [ "$target_gen_dir/embedded.S" ]
-
-      if (v8_use_multi_snapshots) {
+      } else {
         sources += [ "$target_gen_dir/embedded_trusted.S" ]
-        jumbo_excluded_sources = [
-          # Duplicated symbols with embedded.S
-          "$target_gen_dir/embedded_trusted.S",
-        ]
       }
-    } else {
-      sources += [ "src/snapshot/embedded/embedded-empty.cc" ]
     }
+  } else {
+    # Also top-level visibility targets can depend on this.
+    visibility += [ "//:gn_visibility" ]
 
-    configs = [ ":internal_config" ]
+    public_deps += [ ":v8_maybe_icu" ]
+
+    sources += [ "$target_gen_dir/snapshot.cc" ]
   }
 }
 
@@ -1528,14 +1530,10 @@ v8_source_set("v8_initializers") {
     "test/cctest:*",
   ]
 
-  deps = [
-    ":torque_generated_initializers",
-  ]
+  deps = [ ":torque_generated_initializers" ]
 
   sources = [
     ### gcmole(all) ###
-    "src/builtins/builtins-arguments-gen.cc",
-    "src/builtins/builtins-arguments-gen.h",
     "src/builtins/builtins-array-gen.cc",
     "src/builtins/builtins-array-gen.h",
     "src/builtins/builtins-async-function-gen.cc",
@@ -1545,11 +1543,9 @@ v8_source_set("v8_initializers") {
     "src/builtins/builtins-async-iterator-gen.cc",
     "src/builtins/builtins-bigint-gen.cc",
     "src/builtins/builtins-bigint-gen.h",
-    "src/builtins/builtins-boolean-gen.cc",
     "src/builtins/builtins-call-gen.cc",
     "src/builtins/builtins-call-gen.h",
     "src/builtins/builtins-collections-gen.cc",
-    "src/builtins/builtins-console-gen.cc",
     "src/builtins/builtins-constructor-gen.cc",
     "src/builtins/builtins-constructor-gen.h",
     "src/builtins/builtins-constructor.h",
@@ -1569,8 +1565,6 @@ v8_source_set("v8_initializers") {
     "src/builtins/builtins-iterator-gen.h",
     "src/builtins/builtins-lazy-gen.cc",
     "src/builtins/builtins-lazy-gen.h",
-    "src/builtins/builtins-math-gen.cc",
-    "src/builtins/builtins-math-gen.h",
     "src/builtins/builtins-microtask-queue-gen.cc",
     "src/builtins/builtins-number-gen.cc",
     "src/builtins/builtins-object-gen.cc",
@@ -1578,13 +1572,11 @@ v8_source_set("v8_initializers") {
     "src/builtins/builtins-promise-gen.h",
     "src/builtins/builtins-proxy-gen.cc",
     "src/builtins/builtins-proxy-gen.h",
-    "src/builtins/builtins-reflect-gen.cc",
     "src/builtins/builtins-regexp-gen.cc",
     "src/builtins/builtins-regexp-gen.h",
     "src/builtins/builtins-sharedarraybuffer-gen.cc",
     "src/builtins/builtins-string-gen.cc",
     "src/builtins/builtins-string-gen.h",
-    "src/builtins/builtins-symbol-gen.cc",
     "src/builtins/builtins-typed-array-gen.cc",
     "src/builtins/builtins-typed-array-gen.h",
     "src/builtins/builtins-utils-gen.h",
@@ -1609,17 +1601,6 @@ v8_source_set("v8_initializers") {
     "src/interpreter/interpreter-intrinsics-generator.h",
   ]
 
-  jumbo_excluded_sources = [
-    # TODO(mostynb@vewd.com): don't exclude these http://crbug.com/752428
-    "src/builtins/builtins-async-iterator-gen.cc",
-    "src/builtins/builtins-async-generator-gen.cc",
-
-    # These source files take an unusually large amount of time to
-    # compile.  Build them separately to avoid bottlenecks.
-    "src/builtins/builtins-regexp-gen.cc",
-    "src/codegen/code-stub-assembler.cc",
-  ]
-
   if (v8_current_cpu == "x86") {
     sources += [
       ### gcmole(arch:ia32) ###
@@ -1672,18 +1653,14 @@ v8_source_set("v8_initializers") {
 v8_source_set("v8_init") {
   visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
-  deps = [
-    ":v8_initializers",
-  ]
+  deps = [ ":v8_initializers" ]
 
   sources = [
     ### gcmole(all) ###
     "src/init/setup-isolate-full.cc",
   ]
 
-  public_deps = [
-    ":v8_maybe_icu",
-  ]
+  public_deps = [ ":v8_maybe_icu" ]
 
   configs = [ ":internal_config" ]
 }
@@ -1720,9 +1697,7 @@ v8_header_set("v8_headers") {
     "include/v8-wasm-trap-handler-win.h",
   ]
 
-  deps = [
-    ":v8_version",
-  ]
+  deps = [ ":v8_version" ]
 }
 
 # This is split out to share basic headers with Torque.
@@ -1730,13 +1705,9 @@ v8_header_set("v8_shared_internal_headers") {
   visibility = [ ":*" ]  # Only targets in this file can depend on this.
   configs = [ ":internal_config" ]
 
-  sources = [
-    "src/common/globals.h",
-  ]
+  sources = [ "src/common/globals.h" ]
 
-  deps = [
-    ":v8_headers",
-  ]
+  deps = [ ":v8_headers" ]
 }
 
 v8_compiler_sources = [
@@ -1745,6 +1716,8 @@ v8_compiler_sources = [
   "src/compiler/access-builder.h",
   "src/compiler/access-info.cc",
   "src/compiler/access-info.h",
+  "src/compiler/add-type-assertions-reducer.cc",
+  "src/compiler/add-type-assertions-reducer.h",
   "src/compiler/all-nodes.cc",
   "src/compiler/all-nodes.h",
   "src/compiler/allocation-builder-inl.h",
@@ -1810,8 +1783,8 @@ v8_compiler_sources = [
   "src/compiler/csa-load-elimination.h",
   "src/compiler/dead-code-elimination.cc",
   "src/compiler/dead-code-elimination.h",
-  "src/compiler/decompression-elimination.cc",
-  "src/compiler/decompression-elimination.h",
+  "src/compiler/decompression-optimizer.cc",
+  "src/compiler/decompression-optimizer.h",
   "src/compiler/diamond.h",
   "src/compiler/effect-control-linearizer.cc",
   "src/compiler/effect-control-linearizer.h",
@@ -1826,6 +1799,7 @@ v8_compiler_sources = [
   "src/compiler/frame.cc",
   "src/compiler/frame.h",
   "src/compiler/functional-list.h",
+  "src/compiler/globals.h",
   "src/compiler/graph-assembler.cc",
   "src/compiler/graph-assembler.h",
   "src/compiler/graph-reducer.cc",
@@ -1931,12 +1905,15 @@ v8_compiler_sources = [
   "src/compiler/representation-change.h",
   "src/compiler/schedule.cc",
   "src/compiler/schedule.h",
+  "src/compiler/scheduled-machine-lowering.cc",
+  "src/compiler/scheduled-machine-lowering.h",
   "src/compiler/scheduler.cc",
   "src/compiler/scheduler.h",
   "src/compiler/select-lowering.cc",
   "src/compiler/select-lowering.h",
   "src/compiler/serializer-for-background-compilation.cc",
   "src/compiler/serializer-for-background-compilation.h",
+  "src/compiler/serializer-hints.h",
   "src/compiler/simd-scalar-lowering.cc",
   "src/compiler/simd-scalar-lowering.h",
   "src/compiler/simplified-lowering.cc",
@@ -1949,8 +1926,6 @@ v8_compiler_sources = [
   "src/compiler/state-values-utils.h",
   "src/compiler/store-store-elimination.cc",
   "src/compiler/store-store-elimination.h",
-  "src/compiler/add-type-assertions-reducer.cc",
-  "src/compiler/add-type-assertions-reducer.h",
   "src/compiler/type-cache.cc",
   "src/compiler/type-cache.h",
   "src/compiler/type-narrowing-reducer.cc",
@@ -2013,13 +1988,9 @@ v8_source_set("v8_compiler") {
 
 group("v8_compiler_for_mksnapshot") {
   if (is_debug && !v8_optimized_debug && v8_enable_fast_mksnapshot) {
-    deps = [
-      ":v8_compiler_opt",
-    ]
+    deps = [ ":v8_compiler_opt" ]
   } else {
-    deps = [
-      ":v8_compiler",
-    ]
+    deps = [ ":v8_compiler" ]
   }
 }
 
@@ -2039,7 +2010,6 @@ v8_source_set("v8_base_without_compiler") {
     "include/v8-internal.h",
     "include/v8-platform.h",
     "include/v8-profiler.h",
-    "include/v8-testing.h",
     "include/v8-util.h",
     "include/v8-wasm-trap-handler-posix.h",
     "include/v8.h",
@@ -2095,7 +2065,6 @@ v8_source_set("v8_base_without_compiler") {
     "src/builtins/builtins-definitions.h",
     "src/builtins/builtins-descriptors.h",
     "src/builtins/builtins-error.cc",
-    "src/builtins/builtins-extras-utils.cc",
     "src/builtins/builtins-function.cc",
     "src/builtins/builtins-global.cc",
     "src/builtins/builtins-internal.cc",
@@ -2180,6 +2149,7 @@ v8_source_set("v8_base_without_compiler") {
     "src/codegen/string-constants.h",
     "src/codegen/tick-counter.cc",
     "src/codegen/tick-counter.h",
+    "src/codegen/tnode.cc",
     "src/codegen/tnode.h",
     "src/codegen/turbo-assembler.cc",
     "src/codegen/turbo-assembler.h",
@@ -2287,8 +2257,6 @@ v8_source_set("v8_base_without_compiler") {
     "src/extensions/cputracemark-extension.h",
     "src/extensions/externalize-string-extension.cc",
     "src/extensions/externalize-string-extension.h",
-    "src/extensions/free-buffer-extension.cc",
-    "src/extensions/free-buffer-extension.h",
     "src/extensions/gc-extension.cc",
     "src/extensions/gc-extension.h",
     "src/extensions/ignition-statistics-extension.cc",
@@ -2309,6 +2277,8 @@ v8_source_set("v8_base_without_compiler") {
     "src/handles/maybe-handles.h",
     "src/heap/array-buffer-collector.cc",
     "src/heap/array-buffer-collector.h",
+    "src/heap/array-buffer-sweeper.cc",
+    "src/heap/array-buffer-sweeper.h",
     "src/heap/array-buffer-tracker-inl.h",
     "src/heap/array-buffer-tracker.cc",
     "src/heap/array-buffer-tracker.h",
@@ -2323,6 +2293,8 @@ v8_source_set("v8_base_without_compiler") {
     "src/heap/concurrent-marking.h",
     "src/heap/embedder-tracing.cc",
     "src/heap/embedder-tracing.h",
+    "src/heap/factory-base.cc",
+    "src/heap/factory-base.h",
     "src/heap/factory-inl.h",
     "src/heap/factory.cc",
     "src/heap/factory.h",
@@ -2352,8 +2324,13 @@ v8_source_set("v8_base_without_compiler") {
     "src/heap/mark-compact-inl.h",
     "src/heap/mark-compact.cc",
     "src/heap/mark-compact.h",
+    "src/heap/marking-visitor-inl.h",
+    "src/heap/marking-visitor.h",
+    "src/heap/marking-worklist.cc",
+    "src/heap/marking-worklist.h",
     "src/heap/marking.cc",
     "src/heap/marking.h",
+    "src/heap/memory-measurement-inl.h",
     "src/heap/memory-measurement.cc",
     "src/heap/memory-measurement.h",
     "src/heap/memory-reducer.cc",
@@ -2363,6 +2340,8 @@ v8_source_set("v8_base_without_compiler") {
     "src/heap/objects-visiting-inl.h",
     "src/heap/objects-visiting.cc",
     "src/heap/objects-visiting.h",
+    "src/heap/off-thread-factory.cc",
+    "src/heap/off-thread-factory.h",
     "src/heap/read-only-heap-inl.h",
     "src/heap/read-only-heap.cc",
     "src/heap/read-only-heap.h",
@@ -2574,6 +2553,9 @@ v8_source_set("v8_base_without_compiler") {
     "src/objects/js-date-time-format-inl.h",
     "src/objects/js-date-time-format.cc",
     "src/objects/js-date-time-format.h",
+    "src/objects/js-display-names-inl.h",
+    "src/objects/js-display-names.cc",
+    "src/objects/js-display-names.h",
     "src/objects/js-generator-inl.h",
     "src/objects/js-generator.h",
     "src/objects/js-list-format-inl.h",
@@ -2722,8 +2704,6 @@ v8_source_set("v8_base_without_compiler") {
     "src/objects/value-serializer.h",
     "src/objects/visitors.cc",
     "src/objects/visitors.h",
-    "src/parsing/expression-scope-reparenter.cc",
-    "src/parsing/expression-scope-reparenter.h",
     "src/parsing/expression-scope.h",
     "src/parsing/func-name-inferrer.cc",
     "src/parsing/func-name-inferrer.h",
@@ -2858,8 +2838,6 @@ v8_source_set("v8_base_without_compiler") {
     "src/snapshot/deserializer.h",
     "src/snapshot/embedded/embedded-data.cc",
     "src/snapshot/embedded/embedded-data.h",
-    "src/snapshot/natives-common.cc",
-    "src/snapshot/natives.h",
     "src/snapshot/object-deserializer.cc",
     "src/snapshot/object-deserializer.h",
     "src/snapshot/partial-deserializer.cc",
@@ -3017,8 +2995,6 @@ v8_source_set("v8_base_without_compiler") {
     "src/wasm/wasm-result.h",
     "src/wasm/wasm-serialization.cc",
     "src/wasm/wasm-serialization.h",
-    "src/wasm/wasm-text.cc",
-    "src/wasm/wasm-text.h",
     "src/wasm/wasm-tier.h",
     "src/wasm/wasm-value.h",
     "src/zone/accounting-allocator.cc",
@@ -3034,6 +3010,10 @@ v8_source_set("v8_base_without_compiler") {
     "src/zone/zone.h",
   ]
 
+  if (v8_enable_third_party_heap) {
+    sources += v8_third_party_heap_files
+  }
+
   if (v8_check_header_includes) {
     # This file will be generated by tools/generate-header-include-checks.py
     # if the "check_v8_header_includes" gclient variable is set.
@@ -3041,19 +3021,6 @@ v8_source_set("v8_base_without_compiler") {
     sources += check_header_includes_sources
   }
 
-  jumbo_excluded_sources = [
-    # TODO(mostynb@vewd.com): don't exclude these http://crbug.com/752428
-    "src/profiler/heap-snapshot-generator.cc",  # Macro clash in mman-linux.h
-
-    # These source files take an unusually large amount of time to
-    # compile.  Build them separately to avoid bottlenecks.
-    "src/api/api.cc",
-    "src/heap/heap.cc",
-    "src/objects/elements.cc",
-    "src/objects/objects.cc",
-    "src/parsing/parser.cc",
-  ]
-
   if (v8_current_cpu == "x86") {
     sources += [  ### gcmole(arch:ia32) ###
       "src/codegen/ia32/assembler-ia32-inl.h",
@@ -3086,6 +3053,7 @@ v8_source_set("v8_base_without_compiler") {
       "src/codegen/x64/assembler-x64.h",
       "src/codegen/x64/constants-x64.h",
       "src/codegen/x64/cpu-x64.cc",
+      "src/codegen/x64/fma-instr.h",
       "src/codegen/x64/interface-descriptors-x64.cc",
       "src/codegen/x64/macro-assembler-x64.cc",
       "src/codegen/x64/macro-assembler-x64.h",
@@ -3111,7 +3079,7 @@ v8_source_set("v8_base_without_compiler") {
 
     # iOS Xcode simulator builds run on an x64 target. iOS and macOS are both
     # based on Darwin and thus POSIX-compliant to a similar degree.
-    if (is_linux || is_mac || is_ios) {
+    if (is_linux || is_mac || is_ios || target_os == "freebsd") {
       sources += [
         "src/trap-handler/handler-inside-posix.cc",
         "src/trap-handler/handler-inside-posix.h",
@@ -3170,8 +3138,6 @@ v8_source_set("v8_base_without_compiler") {
       "src/codegen/arm64/instructions-arm64-constants.cc",
       "src/codegen/arm64/instructions-arm64.cc",
       "src/codegen/arm64/instructions-arm64.h",
-      "src/codegen/arm64/instrument-arm64.cc",
-      "src/codegen/arm64/instrument-arm64.h",
       "src/codegen/arm64/interface-descriptors-arm64.cc",
       "src/codegen/arm64/macro-assembler-arm64-inl.h",
       "src/codegen/arm64/macro-assembler-arm64.cc",
@@ -3207,11 +3173,6 @@ v8_source_set("v8_base_without_compiler") {
         "src/diagnostics/unwinding-info-win64.h",
       ]
     }
-    jumbo_excluded_sources += [
-      # TODO(mostynb@vewd.com): fix this code so it doesn't need
-      # to be excluded, see the comments inside.
-      "src/codegen/arm64/instructions-arm64-constants.cc",
-    ]
   } else if (v8_current_cpu == "mips" || v8_current_cpu == "mipsel") {
     sources += [  ### gcmole(arch:mipsel) ###
       "src/codegen/mips/assembler-mips-inl.h",
@@ -3282,9 +3243,12 @@ v8_source_set("v8_base_without_compiler") {
       "src/compiler/backend/ppc/instruction-codes-ppc.h",
       "src/compiler/backend/ppc/instruction-scheduler-ppc.cc",
       "src/compiler/backend/ppc/instruction-selector-ppc.cc",
+      "src/compiler/backend/ppc/unwinding-info-writer-ppc.cc",
+      "src/compiler/backend/ppc/unwinding-info-writer-ppc.h",
       "src/debug/ppc/debug-ppc.cc",
       "src/deoptimizer/ppc/deoptimizer-ppc.cc",
       "src/diagnostics/ppc/disasm-ppc.cc",
+      "src/diagnostics/ppc/eh-frame-ppc.cc",
       "src/execution/ppc/frame-constants-ppc.cc",
       "src/execution/ppc/frame-constants-ppc.h",
       "src/execution/ppc/simulator-ppc.cc",
@@ -3309,9 +3273,12 @@ v8_source_set("v8_base_without_compiler") {
       "src/compiler/backend/s390/instruction-codes-s390.h",
       "src/compiler/backend/s390/instruction-scheduler-s390.cc",
       "src/compiler/backend/s390/instruction-selector-s390.cc",
+      "src/compiler/backend/s390/unwinding-info-writer-s390.cc",
+      "src/compiler/backend/s390/unwinding-info-writer-s390.h",
       "src/debug/s390/debug-s390.cc",
       "src/deoptimizer/s390/deoptimizer-s390.cc",
       "src/diagnostics/s390/disasm-s390.cc",
+      "src/diagnostics/s390/eh-frame-s390.cc",
       "src/execution/s390/frame-constants-s390.cc",
       "src/execution/s390/frame-constants-s390.h",
       "src/execution/s390/simulator-s390.cc",
@@ -3361,6 +3328,9 @@ v8_source_set("v8_base_without_compiler") {
       "src/objects/js-date-time-format-inl.h",
       "src/objects/js-date-time-format.cc",
       "src/objects/js-date-time-format.h",
+      "src/objects/js-display-names-inl.h",
+      "src/objects/js-display-names.cc",
+      "src/objects/js-display-names.h",
       "src/objects/js-list-format-inl.h",
       "src/objects/js-list-format.cc",
       "src/objects/js-list-format.h",
@@ -3387,18 +3357,34 @@ v8_source_set("v8_base_without_compiler") {
     ]
   }
 
+  deps += [ "//third_party/zlib" ]
+
   if (v8_postmortem_support) {
     sources += [ "$target_gen_dir/debug-support.cc" ]
     deps += [ ":postmortem-metadata" ]
   }
 
+  libs = []
+
+  if (v8_enable_third_party_heap) {
+    libs += v8_third_party_heap_libs
+  }
+
   # Platforms that don't have CAS support need to link atomic library
   # to implement atomic memory access
   if (v8_current_cpu == "mips" || v8_current_cpu == "mipsel" ||
       v8_current_cpu == "mips64" || v8_current_cpu == "mips64el" ||
       v8_current_cpu == "ppc" || v8_current_cpu == "ppc64" ||
       v8_current_cpu == "s390" || v8_current_cpu == "s390x") {
-    libs = [ "atomic" ]
+    libs += [ "atomic" ]
+  }
+
+  if (v8_enable_vtunetracemark && (is_linux || is_win)) {
+    sources += [
+      "src/extensions/vtunedomain-support-extension.cc",
+      "src/extensions/vtunedomain-support-extension.h",
+    ]
+    deps += [ "src/third_party/vtune:v8_vtune_trace_mark" ]
   }
 }
 
@@ -3436,6 +3422,7 @@ v8_source_set("torque_base") {
     "src/torque/instance-type-generator.cc",
     "src/torque/instructions.cc",
     "src/torque/instructions.h",
+    "src/torque/parameter-difference.h",
     "src/torque/server-data.cc",
     "src/torque/server-data.h",
     "src/torque/source-positions.cc",
@@ -3456,13 +3443,9 @@ v8_source_set("torque_base") {
     "src/torque/utils.h",
   ]
 
-  deps = [
-    ":v8_shared_internal_headers",
-  ]
+  deps = [ ":v8_shared_internal_headers" ]
 
-  public_deps = [
-    ":v8_libbase",
-  ]
+  public_deps = [ ":v8_libbase" ]
 
   # The use of exceptions for Torque in violation of the Chromium style-guide
   # is justified by the fact that it is only used from the non-essential
@@ -3505,9 +3488,7 @@ v8_source_set("torque_ls_base") {
     "src/torque/ls/message.h",
   ]
 
-  public_deps = [
-    ":torque_base",
-  ]
+  public_deps = [ ":torque_base" ]
 
   # The use of exceptions for Torque in violation of the Chromium style-guide
   # is justified by the fact that it is only used from the non-essential
@@ -3537,10 +3518,12 @@ v8_component("v8_libbase") {
     "src/base/atomicops_internals_portable.h",
     "src/base/atomicops_internals_std.h",
     "src/base/base-export.h",
+    "src/base/bit-field.h",
     "src/base/bits.cc",
     "src/base/bits.h",
     "src/base/bounded-page-allocator.cc",
     "src/base/bounded-page-allocator.h",
+    "src/base/bounds.h",
     "src/base/build_config.h",
     "src/base/compiler-specific.h",
     "src/base/cpu.cc",
@@ -3606,9 +3589,7 @@ v8_component("v8_libbase") {
 
   public_configs = [ ":libbase_config" ]
 
-  deps = [
-    ":v8_headers",
-  ]
+  deps = [ ":v8_headers" ]
 
   public_deps = []
 
@@ -3794,9 +3775,7 @@ v8_source_set("v8_libsampler") {
 
   public_configs = [ ":libsampler_config" ]
 
-  deps = [
-    ":v8_libbase",
-  ]
+  deps = [ ":v8_libbase" ]
 }
 
 v8_source_set("fuzzer_support") {
@@ -3809,9 +3788,7 @@ v8_source_set("fuzzer_support") {
 
   configs = [ ":internal_config_base" ]
 
-  deps = [
-    ":v8",
-  ]
+  deps = [ ":v8" ]
 
   public_deps = [
     ":v8_libbase",
@@ -3849,7 +3826,7 @@ v8_static_library("wee8") {
     ":v8_libbase",
     ":v8_libplatform",
     ":v8_libsampler",
-    ":v8_maybe_snapshot",
+    ":v8_snapshot",
     "//build/win:default_exe_manifest",
   ]
 
@@ -3898,6 +3875,7 @@ if (current_toolchain == v8_snapshot_toolchain) {
     visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
     sources = [
+      "src/snapshot/embedded/embedded-empty.cc",
       "src/snapshot/embedded/embedded-file-writer.cc",
       "src/snapshot/embedded/embedded-file-writer.h",
       "src/snapshot/embedded/platform-embedded-file-writer-aix.cc",
@@ -3911,6 +3889,7 @@ if (current_toolchain == v8_snapshot_toolchain) {
       "src/snapshot/embedded/platform-embedded-file-writer-win.cc",
       "src/snapshot/embedded/platform-embedded-file-writer-win.h",
       "src/snapshot/mksnapshot.cc",
+      "src/snapshot/snapshot-empty.cc",
     ]
 
     configs = [ ":internal_config" ]
@@ -3921,7 +3900,7 @@ if (current_toolchain == v8_snapshot_toolchain) {
       ":v8_init",
       ":v8_libbase",
       ":v8_libplatform",
-      ":v8_nosnapshot",
+      ":v8_maybe_icu",
       "//build/win:default_exe_manifest",
     ]
   }
@@ -3931,9 +3910,7 @@ if (current_toolchain == v8_snapshot_toolchain) {
   v8_executable("torque") {
     visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
-    sources = [
-      "src/torque/torque.cc",
-    ]
+    sources = [ "src/torque/torque.cc" ]
 
     deps = [
       ":torque_base",
@@ -3963,9 +3940,7 @@ if (current_toolchain == v8_snapshot_toolchain) {
 v8_executable("torque-language-server") {
   visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
-  sources = [
-    "src/torque/ls/torque-language-server.cc",
-  ]
+  sources = [ "src/torque/ls/torque-language-server.cc" ]
 
   deps = [
     ":torque_base",
@@ -3997,9 +3972,7 @@ if (v8_enable_i18n_support) {
     v8_executable("gen-regexp-special-case") {
       visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
-      sources = [
-        "src/regexp/gen-regexp-special-case.cc",
-      ]
+      sources = [ "src/regexp/gen-regexp-special-case.cc" ]
 
       deps = [
         ":v8_libbase",
@@ -4016,17 +3989,11 @@ if (v8_enable_i18n_support) {
 
     script = "tools/run.py"
 
-    sources = v8_extra_library_files
-
-    deps = [
-      ":gen-regexp-special-case($v8_generator_toolchain)",
-    ]
+    deps = [ ":gen-regexp-special-case($v8_generator_toolchain)" ]
 
     output_file = "$target_gen_dir/src/regexp/special-case.cc"
 
-    outputs = [
-      output_file,
-    ]
+    outputs = [ output_file ]
 
     args = [
       "./" + rebase_path(
@@ -4072,17 +4039,13 @@ group("gn_all") {
 }
 
 group("v8_python_base") {
-  data = [
-    ".vpython",
-  ]
+  data = [ ".vpython" ]
 }
 
 group("v8_clusterfuzz") {
   testonly = true
 
-  deps = [
-    ":d8",
-  ]
+  deps = [ ":d8" ]
 
   if (v8_multi_arch_build) {
     deps += [
@@ -4098,9 +4061,7 @@ group("v8_clusterfuzz") {
 group("v8_archive") {
   testonly = true
 
-  deps = [
-    ":d8",
-  ]
+  deps = [ ":d8" ]
 
   if (!is_win) {
     # On windows, cctest doesn't link with v8_static_library.
@@ -4143,13 +4104,11 @@ group("v8_fuzzers") {
 
 if (is_component_build) {
   v8_component("v8") {
-    sources = [
-      "src/utils/v8dll-main.cc",
-    ]
+    sources = [ "src/utils/v8dll-main.cc" ]
 
     public_deps = [
       ":v8_base",
-      ":v8_maybe_snapshot",
+      ":v8_snapshot",
     ]
 
     configs = [ ":internal_config" ]
@@ -4160,9 +4119,7 @@ if (is_component_build) {
   v8_component("v8_for_testing") {
     testonly = true
 
-    sources = [
-      "src/utils/v8dll-main.cc",
-    ]
+    sources = [ "src/utils/v8dll-main.cc" ]
 
     public_deps = [
       ":torque_base",
@@ -4170,7 +4127,7 @@ if (is_component_build) {
       ":v8_base",
       ":v8_headers",
       ":v8_initializers",
-      ":v8_maybe_snapshot",
+      ":v8_snapshot",
     ]
 
     configs = [ ":internal_config" ]
@@ -4181,7 +4138,7 @@ if (is_component_build) {
   group("v8") {
     public_deps = [
       ":v8_base",
-      ":v8_maybe_snapshot",
+      ":v8_snapshot",
     ]
 
     public_configs = [ ":external_config" ]
@@ -4195,7 +4152,7 @@ if (is_component_build) {
       ":torque_ls_base",
       ":v8_base",
       ":v8_initializers",
-      ":v8_maybe_snapshot",
+      ":v8_snapshot",
     ]
 
     public_configs = [ ":external_config" ]
@@ -4251,9 +4208,7 @@ v8_executable("d8") {
 }
 
 v8_executable("v8_hello_world") {
-  sources = [
-    "samples/hello-world.cc",
-  ]
+  sources = [ "samples/hello-world.cc" ]
 
   configs = [
     # Note: don't use :internal_config here because this target will get
@@ -4271,9 +4226,7 @@ v8_executable("v8_hello_world") {
 }
 
 v8_executable("v8_sample_process") {
-  sources = [
-    "samples/process.cc",
-  ]
+  sources = [ "samples/process.cc" ]
 
   configs = [
     # Note: don't use :internal_config here because this target will get
@@ -4292,9 +4245,7 @@ v8_executable("v8_sample_process") {
 
 if (want_v8_shell) {
   v8_executable("v8_shell") {
-    sources = [
-      "samples/shell.cc",
-    ]
+    sources = [ "samples/shell.cc" ]
 
     configs = [
       # Note: don't use :internal_config here because this target will get
@@ -4321,22 +4272,16 @@ template("v8_fuzzer") {
       "//build/win:default_exe_manifest",
     ]
 
-    sources = [
-      "test/fuzzer/fuzzer.cc",
-    ]
+    sources = [ "test/fuzzer/fuzzer.cc" ]
 
     configs = [ ":external_config" ]
   }
 }
 
 v8_source_set("json_fuzzer") {
-  sources = [
-    "test/fuzzer/json.cc",
-  ]
+  sources = [ "test/fuzzer/json.cc" ]
 
-  deps = [
-    ":fuzzer_support",
-  ]
+  deps = [ ":fuzzer_support" ]
 
   configs = [
     ":external_config",
@@ -4348,13 +4293,9 @@ v8_fuzzer("json_fuzzer") {
 }
 
 v8_source_set("multi_return_fuzzer") {
-  sources = [
-    "test/fuzzer/multi-return.cc",
-  ]
+  sources = [ "test/fuzzer/multi-return.cc" ]
 
-  deps = [
-    ":fuzzer_support",
-  ]
+  deps = [ ":fuzzer_support" ]
 
   configs = [
     ":external_config",
@@ -4366,13 +4307,9 @@ v8_fuzzer("multi_return_fuzzer") {
 }
 
 v8_source_set("parser_fuzzer") {
-  sources = [
-    "test/fuzzer/parser.cc",
-  ]
+  sources = [ "test/fuzzer/parser.cc" ]
 
-  deps = [
-    ":fuzzer_support",
-  ]
+  deps = [ ":fuzzer_support" ]
 
   configs = [
     ":external_config",
@@ -4389,9 +4326,7 @@ v8_source_set("regexp_builtins_fuzzer") {
     "test/fuzzer/regexp_builtins/mjsunit.js.h",
   ]
 
-  deps = [
-    ":fuzzer_support",
-  ]
+  deps = [ ":fuzzer_support" ]
 
   configs = [
     ":external_config",
@@ -4403,13 +4338,9 @@ v8_fuzzer("regexp_builtins_fuzzer") {
 }
 
 v8_source_set("regexp_fuzzer") {
-  sources = [
-    "test/fuzzer/regexp.cc",
-  ]
+  sources = [ "test/fuzzer/regexp.cc" ]
 
-  deps = [
-    ":fuzzer_support",
-  ]
+  deps = [ ":fuzzer_support" ]
 
   configs = [
     ":external_config",
@@ -4431,9 +4362,7 @@ v8_source_set("wasm_module_runner") {
     ":run_torque",
   ]
 
-  public_deps = [
-    ":v8_maybe_icu",
-  ]
+  public_deps = [ ":v8_maybe_icu" ]
 
   configs = [
     ":external_config",
@@ -4442,9 +4371,7 @@ v8_source_set("wasm_module_runner") {
 }
 
 v8_source_set("wasm_fuzzer") {
-  sources = [
-    "test/fuzzer/wasm.cc",
-  ]
+  sources = [ "test/fuzzer/wasm.cc" ]
 
   deps = [
     ":fuzzer_support",
@@ -4462,9 +4389,7 @@ v8_fuzzer("wasm_fuzzer") {
 }
 
 v8_source_set("wasm_async_fuzzer") {
-  sources = [
-    "test/fuzzer/wasm-async.cc",
-  ]
+  sources = [ "test/fuzzer/wasm-async.cc" ]
 
   deps = [
     ":fuzzer_support",
@@ -4513,9 +4438,7 @@ v8_source_set("lib_wasm_fuzzer_common") {
     ":run_torque",
   ]
 
-  public_deps = [
-    ":v8_maybe_icu",
-  ]
+  public_deps = [ ":v8_maybe_icu" ]
 
   configs = [
     ":external_config",
@@ -4550,7 +4473,6 @@ group("v8_generated_cc_files") {
 
   deps = [
     ":generate_bytecode_builtins_list",
-    ":js2c_extras",
     ":run_torque",
     "src/inspector:v8_generated_cc_files",
   ]
@@ -4641,9 +4563,7 @@ if (!build_with_chromium && v8_use_perfetto) {
 
   # This target should be used only by the protoc compiler and by test targets.
   source_set("protobuf_full") {
-    deps = [
-      ":protobuf_lite",
-    ]
+    deps = [ ":protobuf_lite" ]
     sources = [
       "third_party/protobuf/src/google/protobuf/any.cc",
       "third_party/protobuf/src/google/protobuf/any.pb.cc",
@@ -4713,9 +4633,7 @@ if (!build_with_chromium && v8_use_perfetto) {
 
   if (current_toolchain == host_toolchain) {
     source_set("protoc_lib") {
-      deps = [
-        ":protobuf_full",
-      ]
+      deps = [ ":protobuf_full" ]
       sources = [
         "third_party/protobuf/src/google/protobuf/compiler/code_generator.cc",
         "third_party/protobuf/src/google/protobuf/compiler/command_line_interface.cc",
@@ -4754,9 +4672,7 @@ if (!build_with_chromium && v8_use_perfetto) {
         ":protoc_lib",
         "//build/win:default_exe_manifest",
       ]
-      sources = [
-        "src/protobuf/protobuf-compiler-main.cc",
-      ]
+      sources = [ "src/protobuf/protobuf-compiler-main.cc" ]
       configs -= [ "//build/config/compiler:chromium_code" ]
       configs += [ "//build/config/compiler:no_chromium_code" ]
     }
diff --git a/deps/v8/COMMON_OWNERS b/deps/v8/COMMON_OWNERS
index 542c5abd3e044b..cf53fe80e0bad7 100644
--- a/deps/v8/COMMON_OWNERS
+++ b/deps/v8/COMMON_OWNERS
@@ -7,6 +7,7 @@ cbruni@chromium.org
 clemensb@chromium.org
 danno@chromium.org
 delphick@chromium.org
+dinfuehr@chromium.org
 gdeepti@chromium.org
 gsathya@chromium.org
 hablich@chromium.org
@@ -21,13 +22,11 @@ mathias@chromium.org
 marja@chromium.org
 mlippautz@chromium.org
 mslekova@chromium.org
-mstarzinger@chromium.org
 mvstanton@chromium.org
 mythria@chromium.org
 neis@chromium.org
 petermarshall@chromium.org
 rmcilroy@chromium.org
-sergiyb@chromium.org
 sigurds@chromium.org
 solanes@chromium.org
 szuend@chromium.org
diff --git a/deps/v8/ChangeLog b/deps/v8/ChangeLog
deleted file mode 100644
index b3ca3548e865d2..00000000000000
--- a/deps/v8/ChangeLog
+++ /dev/null
@@ -1,66240 +0,0 @@
-2019-10-16: Version 7.9.317
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-16: Version 7.9.316
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-16: Version 7.9.315
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-15: Version 7.9.314
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-15: Version 7.9.313
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-15: Version 7.9.312
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-15: Version 7.9.311
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-15: Version 7.9.310
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-15: Version 7.9.309
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-15: Version 7.9.308
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-15: Version 7.9.307
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-14: Version 7.9.306
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-14: Version 7.9.305
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-14: Version 7.9.304
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-14: Version 7.9.303
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-14: Version 7.9.302
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-14: Version 7.9.301
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-14: Version 7.9.300
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-14: Version 7.9.299
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-14: Version 7.9.298
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-14: Version 7.9.297
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-13: Version 7.9.296
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-12: Version 7.9.295
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-12: Version 7.9.294
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.293
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.292
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.291
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.290
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.289
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.288
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.287
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.286
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.285
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.284
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.283
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.282
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.281
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.280
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.279
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.278
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.277
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-11: Version 7.9.276
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-10: Version 7.9.275
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-10: Version 7.9.274
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-10: Version 7.9.273
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-10: Version 7.9.272
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-10: Version 7.9.271
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-10: Version 7.9.270
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-10: Version 7.9.269
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-10: Version 7.9.268
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-10: Version 7.9.267
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-10: Version 7.9.266
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-10: Version 7.9.265
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-10: Version 7.9.264
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.263
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.262
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.261
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.260
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.259
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.258
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.257
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.256
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.255
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.254
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.253
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.252
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.251
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.250
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.249
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.248
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.247
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.246
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.245
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.244
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.243
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-09: Version 7.9.242
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-08: Version 7.9.241
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-08: Version 7.9.240
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-08: Version 7.9.239
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-08: Version 7.9.238
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-08: Version 7.9.237
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-08: Version 7.9.236
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-08: Version 7.9.235
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-08: Version 7.9.234
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-08: Version 7.9.233
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-08: Version 7.9.232
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-07: Version 7.9.231
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-07: Version 7.9.230
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-07: Version 7.9.229
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-07: Version 7.9.228
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-07: Version 7.9.227
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-07: Version 7.9.226
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-07: Version 7.9.225
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-07: Version 7.9.224
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-07: Version 7.9.223
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-07: Version 7.9.222
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-07: Version 7.9.221
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-06: Version 7.9.220
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-05: Version 7.9.219
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.218
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.217
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.216
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.215
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.214
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.213
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.212
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.211
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.210
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.209
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.208
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.207
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.206
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.205
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-04: Version 7.9.204
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-03: Version 7.9.203
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-03: Version 7.9.202
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-03: Version 7.9.201
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-03: Version 7.9.200
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-03: Version 7.9.199
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-02: Version 7.9.198
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-02: Version 7.9.197
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-02: Version 7.9.196
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-02: Version 7.9.195
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-02: Version 7.9.194
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-02: Version 7.9.193
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-02: Version 7.9.192
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-02: Version 7.9.191
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-02: Version 7.9.190
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-02: Version 7.9.189
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-02: Version 7.9.188
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.187
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.186
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.185
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.184
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.183
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.182
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.181
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.180
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.179
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.178
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.177
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.176
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.175
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.174
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.173
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.172
-
-        Performance and stability improvements on all platforms.
-
-
-2019-10-01: Version 7.9.171
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-30: Version 7.9.170
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-30: Version 7.9.169
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-30: Version 7.9.168
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-30: Version 7.9.167
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-30: Version 7.9.166
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-30: Version 7.9.165
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-30: Version 7.9.164
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-29: Version 7.9.163
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-28: Version 7.9.162
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-27: Version 7.9.161
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-27: Version 7.9.160
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-27: Version 7.9.159
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-27: Version 7.9.158
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-27: Version 7.9.157
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-27: Version 7.9.156
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-27: Version 7.9.155
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-27: Version 7.9.154
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-27: Version 7.9.153
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-27: Version 7.9.152
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.151
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.150
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.149
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.148
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.147
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.146
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.145
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.144
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.143
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.142
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.141
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.140
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.139
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.138
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.137
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.136
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.135
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.134
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.133
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-26: Version 7.9.132
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.131
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.130
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.129
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.128
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.127
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.126
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.125
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.124
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.123
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.122
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.121
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.120
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.119
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.118
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-25: Version 7.9.117
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-24: Version 7.9.116
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-24: Version 7.9.115
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-24: Version 7.9.114
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-24: Version 7.9.113
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-24: Version 7.9.112
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-24: Version 7.9.111
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-24: Version 7.9.110
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-24: Version 7.9.109
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-24: Version 7.9.108
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-24: Version 7.9.107
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-24: Version 7.9.106
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-24: Version 7.9.105
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-24: Version 7.9.104
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-23: Version 7.9.103
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-23: Version 7.9.102
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-23: Version 7.9.101
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-23: Version 7.9.100
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-23: Version 7.9.99
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-23: Version 7.9.98
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-23: Version 7.9.97
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-23: Version 7.9.96
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-23: Version 7.9.95
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-23: Version 7.9.94
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-23: Version 7.9.93
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-23: Version 7.9.92
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-23: Version 7.9.91
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-22: Version 7.9.90
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-21: Version 7.9.89
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-20: Version 7.9.88
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-20: Version 7.9.87
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-20: Version 7.9.86
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-20: Version 7.9.85
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-20: Version 7.9.84
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-20: Version 7.9.83
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-20: Version 7.9.82
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-20: Version 7.9.81
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-20: Version 7.9.80
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-20: Version 7.9.79
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-20: Version 7.9.78
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-20: Version 7.9.77
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-19: Version 7.9.76
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-19: Version 7.9.75
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-19: Version 7.9.74
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-19: Version 7.9.73
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-19: Version 7.9.72
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-19: Version 7.9.71
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-19: Version 7.9.70
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-19: Version 7.9.69
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-18: Version 7.9.68
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-18: Version 7.9.67
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-18: Version 7.9.66
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-18: Version 7.9.65
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-18: Version 7.9.64
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-18: Version 7.9.63
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-18: Version 7.9.62
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-18: Version 7.9.61
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-18: Version 7.9.60
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-18: Version 7.9.59
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-18: Version 7.9.58
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-17: Version 7.9.57
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-17: Version 7.9.56
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-16: Version 7.9.55
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-16: Version 7.9.54
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-16: Version 7.9.53
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-16: Version 7.9.52
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-16: Version 7.9.51
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-16: Version 7.9.50
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-16: Version 7.9.49
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-16: Version 7.9.48
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-16: Version 7.9.47
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-16: Version 7.9.46
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-16: Version 7.9.45
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-16: Version 7.9.44
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-14: Version 7.9.43
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-13: Version 7.9.42
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-13: Version 7.9.41
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-13: Version 7.9.40
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-13: Version 7.9.39
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-13: Version 7.9.38
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-13: Version 7.9.37
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-13: Version 7.9.36
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-13: Version 7.9.35
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.34
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.33
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.32
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.31
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.30
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.29
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.28
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.27
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.26
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.25
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.24
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.23
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.22
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.21
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.20
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-12: Version 7.9.19
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-11: Version 7.9.18
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-11: Version 7.9.17
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-11: Version 7.9.16
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-11: Version 7.9.15
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-11: Version 7.9.14
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-11: Version 7.9.13
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-11: Version 7.9.12
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-10: Version 7.9.11
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-10: Version 7.9.10
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-10: Version 7.9.9
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-09: Version 7.9.8
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-09: Version 7.9.7
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-09: Version 7.9.6
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-09: Version 7.9.5
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-09: Version 7.9.4
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-09: Version 7.9.3
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-09: Version 7.9.2
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-08: Version 7.9.1
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-05: Version 7.8.285
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.284
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.283
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.282
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.281
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.280
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.279
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.278
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.277
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.276
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.275
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.274
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.273
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.272
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.271
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-04: Version 7.8.270
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-03: Version 7.8.269
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-03: Version 7.8.268
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-03: Version 7.8.267
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-03: Version 7.8.266
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-03: Version 7.8.265
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-03: Version 7.8.264
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-03: Version 7.8.263
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-03: Version 7.8.262
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-03: Version 7.8.261
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.260
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.259
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.258
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.257
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.256
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.255
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.254
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.253
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.252
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.251
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.250
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.249
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.248
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.247
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.246
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-02: Version 7.8.245
-
-        Performance and stability improvements on all platforms.
-
-
-2019-09-01: Version 7.8.244
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-31: Version 7.8.243
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-31: Version 7.8.242
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-30: Version 7.8.241
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-30: Version 7.8.240
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-30: Version 7.8.239
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-30: Version 7.8.238
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-30: Version 7.8.237
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-30: Version 7.8.236
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-30: Version 7.8.235
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-30: Version 7.8.234
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-30: Version 7.8.233
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-30: Version 7.8.232
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-29: Version 7.8.231
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-29: Version 7.8.230
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-29: Version 7.8.229
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-29: Version 7.8.228
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-29: Version 7.8.227
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-29: Version 7.8.226
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-29: Version 7.8.225
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-29: Version 7.8.224
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-29: Version 7.8.223
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-29: Version 7.8.222
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-29: Version 7.8.221
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-28: Version 7.8.220
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-28: Version 7.8.219
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-28: Version 7.8.218
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-28: Version 7.8.217
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-28: Version 7.8.216
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-28: Version 7.8.215
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-28: Version 7.8.214
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-28: Version 7.8.213
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-28: Version 7.8.212
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-28: Version 7.8.211
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-28: Version 7.8.210
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-28: Version 7.8.209
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-28: Version 7.8.208
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-27: Version 7.8.207
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-27: Version 7.8.206
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-27: Version 7.8.205
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-27: Version 7.8.204
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-27: Version 7.8.203
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-27: Version 7.8.202
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-27: Version 7.8.201
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-26: Version 7.8.200
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-26: Version 7.8.199
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-26: Version 7.8.198
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-26: Version 7.8.197
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-26: Version 7.8.196
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-26: Version 7.8.195
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-26: Version 7.8.194
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-26: Version 7.8.193
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-26: Version 7.8.192
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-26: Version 7.8.191
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-26: Version 7.8.190
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-25: Version 7.8.189
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-23: Version 7.8.188
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-23: Version 7.8.187
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-23: Version 7.8.186
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-23: Version 7.8.185
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-23: Version 7.8.184
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-23: Version 7.8.183
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-23: Version 7.8.182
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-23: Version 7.8.181
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-23: Version 7.8.180
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-23: Version 7.8.179
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-23: Version 7.8.178
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.177
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.176
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.175
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.174
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.173
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.172
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.171
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.170
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.169
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.168
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.167
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.166
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.165
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.164
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.163
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.162
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.161
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.160
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.159
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.158
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-22: Version 7.8.157
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.156
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.155
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.154
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.153
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.152
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.151
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.150
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.149
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.148
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.147
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.146
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.145
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.144
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.143
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.142
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.141
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.140
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-21: Version 7.8.139
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.138
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.137
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.136
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.135
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.134
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.133
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.132
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.131
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.130
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.129
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.128
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.127
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.126
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.125
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.124
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.123
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.122
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.121
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-20: Version 7.8.120
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-19: Version 7.8.119
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-19: Version 7.8.118
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-19: Version 7.8.117
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-19: Version 7.8.116
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-19: Version 7.8.115
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-19: Version 7.8.114
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-16: Version 7.8.113
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-15: Version 7.8.112
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-14: Version 7.8.111
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-14: Version 7.8.110
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-14: Version 7.8.109
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-14: Version 7.8.108
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-14: Version 7.8.107
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-14: Version 7.8.106
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-13: Version 7.8.105
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-13: Version 7.8.104
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-13: Version 7.8.103
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-13: Version 7.8.102
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-13: Version 7.8.101
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-13: Version 7.8.100
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-13: Version 7.8.99
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-13: Version 7.8.98
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-13: Version 7.8.97
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-13: Version 7.8.96
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-13: Version 7.8.95
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-13: Version 7.8.94
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-13: Version 7.8.93
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.92
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.91
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.90
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.89
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.88
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.87
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.86
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.85
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.84
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.83
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.82
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.81
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.80
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.79
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-12: Version 7.8.78
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-09: Version 7.8.77
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-09: Version 7.8.76
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-09: Version 7.8.75
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-09: Version 7.8.74
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-09: Version 7.8.73
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-09: Version 7.8.72
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-08: Version 7.8.71
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-08: Version 7.8.70
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-08: Version 7.8.69
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-08: Version 7.8.68
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-07: Version 7.8.67
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-07: Version 7.8.66
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-07: Version 7.8.65
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-06: Version 7.8.64
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-06: Version 7.8.63
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-06: Version 7.8.62
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-05: Version 7.8.61
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-05: Version 7.8.60
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-04: Version 7.8.59
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-02: Version 7.8.58
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-02: Version 7.8.57
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-02: Version 7.8.56
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-02: Version 7.8.55
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-02: Version 7.8.54
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-02: Version 7.8.53
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-01: Version 7.8.52
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-01: Version 7.8.51
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-01: Version 7.8.50
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-01: Version 7.8.49
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-01: Version 7.8.48
-
-        Performance and stability improvements on all platforms.
-
-
-2019-08-01: Version 7.8.47
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-31: Version 7.8.46
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-31: Version 7.8.45
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-31: Version 7.8.44
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-31: Version 7.8.43
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-31: Version 7.8.42
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-31: Version 7.8.41
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-31: Version 7.8.40
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-31: Version 7.8.39
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-31: Version 7.8.38
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-31: Version 7.8.37
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.36
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.35
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.34
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.33
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.32
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.31
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.30
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.29
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.28
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.27
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.26
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.25
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.24
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.23
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.22
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.21
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.20
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.19
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.18
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.17
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-30: Version 7.8.16
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.15
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.14
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.13
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.12
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.11
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.10
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.9
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.8
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.7
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.6
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.5
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.4
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.3
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-29: Version 7.8.2
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-28: Version 7.8.1
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-24: Version 7.7.310
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-24: Version 7.7.309
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-24: Version 7.7.308
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-24: Version 7.7.307
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-24: Version 7.7.306
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-24: Version 7.7.305
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-24: Version 7.7.304
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-24: Version 7.7.303
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-24: Version 7.7.302
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-24: Version 7.7.301
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-24: Version 7.7.300
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-23: Version 7.7.299
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-23: Version 7.7.298
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-23: Version 7.7.297
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-23: Version 7.7.296
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-22: Version 7.7.295
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-22: Version 7.7.294
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-22: Version 7.7.293
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-22: Version 7.7.292
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-22: Version 7.7.291
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-21: Version 7.7.290
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-20: Version 7.7.289
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-20: Version 7.7.288
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-19: Version 7.7.287
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-19: Version 7.7.286
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-19: Version 7.7.285
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-19: Version 7.7.284
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-19: Version 7.7.283
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-19: Version 7.7.282
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-19: Version 7.7.281
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-19: Version 7.7.280
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-19: Version 7.7.279
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-19: Version 7.7.278
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-19: Version 7.7.277
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-18: Version 7.7.276
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-18: Version 7.7.275
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-18: Version 7.7.274
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-18: Version 7.7.273
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-18: Version 7.7.272
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-18: Version 7.7.271
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-18: Version 7.7.270
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-18: Version 7.7.269
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.268
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.267
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.266
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.265
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.264
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.263
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.262
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.261
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.260
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.259
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.258
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.257
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.256
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-17: Version 7.7.255
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-16: Version 7.7.254
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-16: Version 7.7.253
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-16: Version 7.7.252
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-16: Version 7.7.251
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-16: Version 7.7.250
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-16: Version 7.7.249
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-16: Version 7.7.248
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-16: Version 7.7.247
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-16: Version 7.7.246
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-16: Version 7.7.245
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-16: Version 7.7.244
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-16: Version 7.7.243
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-16: Version 7.7.242
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-15: Version 7.7.241
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-15: Version 7.7.240
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-15: Version 7.7.239
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-15: Version 7.7.238
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-15: Version 7.7.237
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-15: Version 7.7.236
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-15: Version 7.7.235
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-15: Version 7.7.234
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-15: Version 7.7.233
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-15: Version 7.7.232
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-15: Version 7.7.231
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-14: Version 7.7.230
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-14: Version 7.7.229
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-13: Version 7.7.228
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-13: Version 7.7.227
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-13: Version 7.7.226
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-12: Version 7.7.225
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-12: Version 7.7.224
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-12: Version 7.7.223
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-12: Version 7.7.222
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-12: Version 7.7.221
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-12: Version 7.7.220
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-12: Version 7.7.219
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-12: Version 7.7.218
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-11: Version 7.7.217
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-11: Version 7.7.216
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-11: Version 7.7.215
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-10: Version 7.7.214
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-09: Version 7.7.213
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-09: Version 7.7.212
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-09: Version 7.7.211
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-09: Version 7.7.210
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-09: Version 7.7.209
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-09: Version 7.7.208
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-09: Version 7.7.207
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-09: Version 7.7.206
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-08: Version 7.7.205
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-08: Version 7.7.204
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-08: Version 7.7.203
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-08: Version 7.7.202
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-08: Version 7.7.201
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-08: Version 7.7.200
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-08: Version 7.7.199
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-08: Version 7.7.198
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-08: Version 7.7.197
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-08: Version 7.7.196
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-08: Version 7.7.195
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-08: Version 7.7.194
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-08: Version 7.7.193
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-06: Version 7.7.192
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-06: Version 7.7.191
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-05: Version 7.7.190
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-05: Version 7.7.189
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-05: Version 7.7.188
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-05: Version 7.7.187
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-05: Version 7.7.186
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-03: Version 7.7.185
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-03: Version 7.7.184
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-03: Version 7.7.183
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-03: Version 7.7.182
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-03: Version 7.7.181
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-03: Version 7.7.180
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-02: Version 7.7.179
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-02: Version 7.7.178
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-02: Version 7.7.177
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-02: Version 7.7.176
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-02: Version 7.7.175
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-02: Version 7.7.174
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-02: Version 7.7.173
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-02: Version 7.7.172
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-01: Version 7.7.171
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-01: Version 7.7.170
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-01: Version 7.7.169
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-01: Version 7.7.168
-
-        Performance and stability improvements on all platforms.
-
-
-2019-07-01: Version 7.7.167
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-28: Version 7.7.166
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-28: Version 7.7.165
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-28: Version 7.7.164
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-27: Version 7.7.163
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-27: Version 7.7.162
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-27: Version 7.7.161
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-27: Version 7.7.160
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-27: Version 7.7.159
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-27: Version 7.7.158
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-27: Version 7.7.157
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-27: Version 7.7.156
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-27: Version 7.7.155
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-27: Version 7.7.154
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-26: Version 7.7.153
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-26: Version 7.7.152
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-26: Version 7.7.151
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-26: Version 7.7.150
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-25: Version 7.7.149
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-25: Version 7.7.148
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-25: Version 7.7.147
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-25: Version 7.7.146
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-25: Version 7.7.145
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-25: Version 7.7.144
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-25: Version 7.7.143
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-25: Version 7.7.142
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-25: Version 7.7.141
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-24: Version 7.7.140
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-24: Version 7.7.139
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-24: Version 7.7.138
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-24: Version 7.7.137
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-24: Version 7.7.136
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-23: Version 7.7.135
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-23: Version 7.7.134
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-22: Version 7.7.133
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-21: Version 7.7.132
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-21: Version 7.7.131
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-21: Version 7.7.130
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-21: Version 7.7.129
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-21: Version 7.7.128
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-21: Version 7.7.127
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-21: Version 7.7.126
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-21: Version 7.7.125
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-20: Version 7.7.124
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-20: Version 7.7.123
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-20: Version 7.7.122
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-20: Version 7.7.121
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-20: Version 7.7.120
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-19: Version 7.7.119
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-19: Version 7.7.118
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-19: Version 7.7.117
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-19: Version 7.7.116
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-19: Version 7.7.115
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-19: Version 7.7.114
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-19: Version 7.7.113
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-19: Version 7.7.112
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-19: Version 7.7.111
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-19: Version 7.7.110
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-19: Version 7.7.109
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-19: Version 7.7.108
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-19: Version 7.7.107
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-18: Version 7.7.106
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-18: Version 7.7.105
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-18: Version 7.7.104
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-18: Version 7.7.103
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-18: Version 7.7.102
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-18: Version 7.7.101
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-18: Version 7.7.100
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-18: Version 7.7.99
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-18: Version 7.7.98
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-18: Version 7.7.97
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-18: Version 7.7.96
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-18: Version 7.7.95
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-17: Version 7.7.94
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-17: Version 7.7.93
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-17: Version 7.7.92
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-17: Version 7.7.91
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-17: Version 7.7.90
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-17: Version 7.7.89
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-17: Version 7.7.88
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-17: Version 7.7.87
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-16: Version 7.7.86
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-16: Version 7.7.85
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-14: Version 7.7.84
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-14: Version 7.7.83
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-14: Version 7.7.82
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-14: Version 7.7.81
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-14: Version 7.7.80
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-14: Version 7.7.79
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-14: Version 7.7.78
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-14: Version 7.7.77
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-14: Version 7.7.76
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-14: Version 7.7.75
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-14: Version 7.7.74
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-14: Version 7.7.73
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-13: Version 7.7.72
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-13: Version 7.7.71
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-13: Version 7.7.70
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-13: Version 7.7.69
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-13: Version 7.7.68
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-13: Version 7.7.67
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-13: Version 7.7.66
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-13: Version 7.7.65
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-13: Version 7.7.64
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-13: Version 7.7.63
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-13: Version 7.7.62
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-12: Version 7.7.61
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-12: Version 7.7.60
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-12: Version 7.7.59
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-12: Version 7.7.58
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-12: Version 7.7.57
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-12: Version 7.7.56
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-12: Version 7.7.55
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-12: Version 7.7.54
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-12: Version 7.7.53
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-12: Version 7.7.52
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-12: Version 7.7.51
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-11: Version 7.7.50
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-11: Version 7.7.49
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-11: Version 7.7.48
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-11: Version 7.7.47
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-11: Version 7.7.46
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-11: Version 7.7.45
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-11: Version 7.7.44
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-11: Version 7.7.43
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-11: Version 7.7.42
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-11: Version 7.7.41
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-10: Version 7.7.40
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-10: Version 7.7.39
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-10: Version 7.7.38
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-10: Version 7.7.37
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-09: Version 7.7.36
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-09: Version 7.7.35
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-09: Version 7.7.34
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-08: Version 7.7.33
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-08: Version 7.7.32
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-08: Version 7.7.31
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-08: Version 7.7.30
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-07: Version 7.7.29
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-07: Version 7.7.28
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-07: Version 7.7.27
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-07: Version 7.7.26
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-07: Version 7.7.25
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-07: Version 7.7.24
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-05: Version 7.7.23
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-05: Version 7.7.22
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-05: Version 7.7.21
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-05: Version 7.7.20
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-05: Version 7.7.19
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-05: Version 7.7.18
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-04: Version 7.7.17
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-04: Version 7.7.16
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-04: Version 7.7.15
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-04: Version 7.7.14
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-04: Version 7.7.13
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-03: Version 7.7.12
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-03: Version 7.7.11
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-03: Version 7.7.10
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-03: Version 7.7.9
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-03: Version 7.7.8
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-03: Version 7.7.7
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-03: Version 7.7.6
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-03: Version 7.7.5
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-03: Version 7.7.4
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-03: Version 7.7.3
-
-        Performance and stability improvements on all platforms.
-
-
-2019-06-03: Version 7.7.2
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-31: Version 7.7.1
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-29: Version 7.6.311
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-29: Version 7.6.310
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-29: Version 7.6.309
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-29: Version 7.6.308
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.307
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.306
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.305
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.304
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.303
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.302
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.301
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.300
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.299
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.298
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.297
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.296
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.295
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.294
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-28: Version 7.6.293
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.292
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.291
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.290
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.289
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.288
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.287
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.286
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.285
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.284
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.283
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.282
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.281
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.280
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.279
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.278
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.277
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.276
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-27: Version 7.6.275
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-24: Version 7.6.274
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-24: Version 7.6.273
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-24: Version 7.6.272
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-24: Version 7.6.271
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-24: Version 7.6.270
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-24: Version 7.6.269
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-24: Version 7.6.268
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-23: Version 7.6.267
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-23: Version 7.6.266
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-23: Version 7.6.265
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-23: Version 7.6.264
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-23: Version 7.6.263
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-23: Version 7.6.262
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-23: Version 7.6.261
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-22: Version 7.6.260
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-22: Version 7.6.259
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-22: Version 7.6.258
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-22: Version 7.6.257
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-22: Version 7.6.256
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-22: Version 7.6.255
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-22: Version 7.6.254
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-22: Version 7.6.253
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-22: Version 7.6.252
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-22: Version 7.6.251
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-22: Version 7.6.250
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-22: Version 7.6.249
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-22: Version 7.6.248
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.247
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.246
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.245
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.244
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.243
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.242
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.241
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.240
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.239
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.238
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.237
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.236
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.235
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.234
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.233
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.232
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.231
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.230
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-21: Version 7.6.229
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.228
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.227
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.226
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.225
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.224
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.223
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.222
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.221
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.220
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.219
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.218
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.217
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.216
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.215
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.214
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.213
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.212
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-20: Version 7.6.211
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-17: Version 7.6.210
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-17: Version 7.6.209
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-17: Version 7.6.208
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-17: Version 7.6.207
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-17: Version 7.6.206
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-17: Version 7.6.205
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-16: Version 7.6.204
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-16: Version 7.6.203
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-16: Version 7.6.202
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-16: Version 7.6.201
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-16: Version 7.6.200
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-16: Version 7.6.199
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-16: Version 7.6.198
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-16: Version 7.6.197
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-16: Version 7.6.196
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-15: Version 7.6.195
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-15: Version 7.6.194
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-15: Version 7.6.193
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-15: Version 7.6.192
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-15: Version 7.6.191
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-15: Version 7.6.190
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-15: Version 7.6.189
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-15: Version 7.6.188
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-15: Version 7.6.187
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-15: Version 7.6.186
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-15: Version 7.6.185
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-14: Version 7.6.184
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-14: Version 7.6.183
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-14: Version 7.6.182
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-14: Version 7.6.181
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-14: Version 7.6.180
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-14: Version 7.6.179
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-14: Version 7.6.178
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-14: Version 7.6.177
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-14: Version 7.6.176
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-14: Version 7.6.175
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-14: Version 7.6.174
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-14: Version 7.6.173
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-14: Version 7.6.172
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-13: Version 7.6.171
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-13: Version 7.6.170
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-13: Version 7.6.169
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-13: Version 7.6.168
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-13: Version 7.6.167
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-13: Version 7.6.166
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-13: Version 7.6.165
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-13: Version 7.6.164
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-13: Version 7.6.163
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-13: Version 7.6.162
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-13: Version 7.6.161
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.160
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.159
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.158
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.157
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.156
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.155
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.154
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.153
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.152
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.151
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.150
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.149
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.148
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.147
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.146
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-10: Version 7.6.145
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-09: Version 7.6.144
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-09: Version 7.6.143
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-09: Version 7.6.142
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-09: Version 7.6.141
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-09: Version 7.6.140
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-09: Version 7.6.139
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-09: Version 7.6.138
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-09: Version 7.6.137
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-09: Version 7.6.136
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-09: Version 7.6.135
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-09: Version 7.6.134
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.133
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.132
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.131
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.130
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.129
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.128
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.127
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.126
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.125
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.124
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.123
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.122
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.121
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.120
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-08: Version 7.6.119
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-07: Version 7.6.118
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-07: Version 7.6.117
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-07: Version 7.6.116
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-07: Version 7.6.115
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-07: Version 7.6.114
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-07: Version 7.6.113
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-07: Version 7.6.112
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-07: Version 7.6.111
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-07: Version 7.6.110
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-07: Version 7.6.109
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-06: Version 7.6.108
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-06: Version 7.6.107
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-06: Version 7.6.106
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-06: Version 7.6.105
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-06: Version 7.6.104
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-06: Version 7.6.103
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-06: Version 7.6.102
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-06: Version 7.6.101
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-06: Version 7.6.100
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-06: Version 7.6.99
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-04: Version 7.6.98
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-04: Version 7.6.97
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-03: Version 7.6.96
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-03: Version 7.6.95
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-03: Version 7.6.94
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-03: Version 7.6.93
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-03: Version 7.6.92
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-03: Version 7.6.91
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-03: Version 7.6.90
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-02: Version 7.6.89
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-02: Version 7.6.88
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-02: Version 7.6.87
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-02: Version 7.6.86
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-02: Version 7.6.85
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-02: Version 7.6.84
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-02: Version 7.6.83
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-01: Version 7.6.82
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-01: Version 7.6.81
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-01: Version 7.6.80
-
-        Performance and stability improvements on all platforms.
-
-
-2019-05-01: Version 7.6.79
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-30: Version 7.6.78
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-30: Version 7.6.77
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-30: Version 7.6.76
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-30: Version 7.6.75
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-30: Version 7.6.74
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-30: Version 7.6.73
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-30: Version 7.6.72
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-30: Version 7.6.71
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-30: Version 7.6.70
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-30: Version 7.6.69
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.68
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.67
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.66
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.65
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.64
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.63
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.62
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.61
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.60
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.59
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.58
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.57
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.56
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-29: Version 7.6.55
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-28: Version 7.6.54
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-27: Version 7.6.53
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-27: Version 7.6.52
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-26: Version 7.6.51
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-26: Version 7.6.50
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-26: Version 7.6.49
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-26: Version 7.6.48
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-26: Version 7.6.47
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-26: Version 7.6.46
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-26: Version 7.6.45
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-26: Version 7.6.44
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-26: Version 7.6.43
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-26: Version 7.6.42
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-26: Version 7.6.41
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-26: Version 7.6.40
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-25: Version 7.6.39
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-25: Version 7.6.38
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-25: Version 7.6.37
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-25: Version 7.6.36
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-25: Version 7.6.35
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-25: Version 7.6.34
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-25: Version 7.6.33
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-25: Version 7.6.32
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-25: Version 7.6.31
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-25: Version 7.6.30
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-25: Version 7.6.29
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.28
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.27
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.26
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.25
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.24
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.23
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.22
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.21
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.20
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.19
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.18
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.17
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.16
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.15
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.14
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-24: Version 7.6.13
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-23: Version 7.6.12
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-23: Version 7.6.11
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-23: Version 7.6.10
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-23: Version 7.6.9
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-23: Version 7.6.8
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-23: Version 7.6.7
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-23: Version 7.6.6
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-23: Version 7.6.5
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-23: Version 7.6.4
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-23: Version 7.6.3
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-23: Version 7.6.2
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-19: Version 7.6.1
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-17: Version 7.5.289
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-17: Version 7.5.288
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-17: Version 7.5.287
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-17: Version 7.5.286
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-17: Version 7.5.285
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-16: Version 7.5.284
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-16: Version 7.5.283
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-16: Version 7.5.282
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-16: Version 7.5.281
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-16: Version 7.5.280
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-16: Version 7.5.279
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-16: Version 7.5.278
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-16: Version 7.5.277
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-16: Version 7.5.276
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-15: Version 7.5.275
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-15: Version 7.5.274
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-15: Version 7.5.273
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-15: Version 7.5.272
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-15: Version 7.5.271
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-15: Version 7.5.270
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-12: Version 7.5.269
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-12: Version 7.5.268
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-12: Version 7.5.267
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-12: Version 7.5.266
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-12: Version 7.5.265
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-12: Version 7.5.264
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-12: Version 7.5.263
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.262
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.261
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.260
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.259
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.258
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.257
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.256
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.255
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.254
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.253
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.252
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.251
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.250
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.249
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.248
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.247
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-11: Version 7.5.246
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-10: Version 7.5.245
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-10: Version 7.5.244
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-10: Version 7.5.243
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-10: Version 7.5.242
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-10: Version 7.5.241
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-10: Version 7.5.240
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-10: Version 7.5.239
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-10: Version 7.5.238
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-10: Version 7.5.237
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-10: Version 7.5.236
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-10: Version 7.5.235
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-10: Version 7.5.234
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-10: Version 7.5.233
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-09: Version 7.5.232
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-09: Version 7.5.231
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-09: Version 7.5.230
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-09: Version 7.5.229
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-09: Version 7.5.228
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-09: Version 7.5.227
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-09: Version 7.5.226
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-09: Version 7.5.225
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-09: Version 7.5.224
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-08: Version 7.5.223
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-08: Version 7.5.222
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-08: Version 7.5.221
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-08: Version 7.5.220
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-08: Version 7.5.219
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-08: Version 7.5.218
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-08: Version 7.5.217
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-08: Version 7.5.216
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-08: Version 7.5.215
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-08: Version 7.5.214
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-08: Version 7.5.213
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-07: Version 7.5.212
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-07: Version 7.5.211
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-06: Version 7.5.210
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-05: Version 7.5.209
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-05: Version 7.5.208
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-05: Version 7.5.207
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-05: Version 7.5.206
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-05: Version 7.5.205
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-05: Version 7.5.204
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-05: Version 7.5.203
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-05: Version 7.5.202
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-05: Version 7.5.201
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-05: Version 7.5.200
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-05: Version 7.5.199
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.198
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.197
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.196
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.195
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.194
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.193
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.192
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.191
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.190
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.189
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.188
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.187
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.186
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.185
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.184
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.183
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-04: Version 7.5.182
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-03: Version 7.5.181
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-03: Version 7.5.180
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-03: Version 7.5.179
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-03: Version 7.5.178
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-03: Version 7.5.177
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-03: Version 7.5.176
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-03: Version 7.5.175
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-03: Version 7.5.174
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-03: Version 7.5.173
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-03: Version 7.5.172
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-03: Version 7.5.171
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-03: Version 7.5.170
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-03: Version 7.5.169
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-02: Version 7.5.168
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-02: Version 7.5.167
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-02: Version 7.5.166
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-02: Version 7.5.165
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-02: Version 7.5.164
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-02: Version 7.5.163
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-02: Version 7.5.162
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-02: Version 7.5.161
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-02: Version 7.5.160
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-02: Version 7.5.159
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-02: Version 7.5.158
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-01: Version 7.5.157
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-01: Version 7.5.156
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-01: Version 7.5.155
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-01: Version 7.5.154
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-01: Version 7.5.153
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-01: Version 7.5.152
-
-        Performance and stability improvements on all platforms.
-
-
-2019-04-01: Version 7.5.151
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-31: Version 7.5.150
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-30: Version 7.5.149
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-30: Version 7.5.148
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-29: Version 7.5.147
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-29: Version 7.5.146
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-29: Version 7.5.145
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-29: Version 7.5.144
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-29: Version 7.5.143
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-29: Version 7.5.142
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-29: Version 7.5.141
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-28: Version 7.5.140
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-28: Version 7.5.139
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-28: Version 7.5.138
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-28: Version 7.5.137
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-28: Version 7.5.136
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-28: Version 7.5.135
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-28: Version 7.5.134
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-28: Version 7.5.133
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-28: Version 7.5.132
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-28: Version 7.5.131
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-27: Version 7.5.130
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-27: Version 7.5.129
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-27: Version 7.5.128
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-27: Version 7.5.127
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-27: Version 7.5.126
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-27: Version 7.5.125
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-27: Version 7.5.124
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-27: Version 7.5.123
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-26: Version 7.5.122
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-26: Version 7.5.121
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-26: Version 7.5.120
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-26: Version 7.5.119
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-26: Version 7.5.118
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-26: Version 7.5.117
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-26: Version 7.5.116
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-25: Version 7.5.115
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-25: Version 7.5.114
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-25: Version 7.5.113
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-25: Version 7.5.112
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-25: Version 7.5.111
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-25: Version 7.5.110
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-25: Version 7.5.109
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-25: Version 7.5.108
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-25: Version 7.5.107
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-25: Version 7.5.106
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-25: Version 7.5.105
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-25: Version 7.5.104
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-24: Version 7.5.103
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-24: Version 7.5.102
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-24: Version 7.5.101
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-22: Version 7.5.100
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-22: Version 7.5.99
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-22: Version 7.5.98
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-22: Version 7.5.97
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-22: Version 7.5.96
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-22: Version 7.5.95
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-22: Version 7.5.94
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-22: Version 7.5.93
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-22: Version 7.5.92
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-22: Version 7.5.91
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-22: Version 7.5.90
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-21: Version 7.5.89
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-21: Version 7.5.88
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-21: Version 7.5.87
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-21: Version 7.5.86
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-21: Version 7.5.85
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-20: Version 7.5.84
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-20: Version 7.5.83
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-20: Version 7.5.82
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-20: Version 7.5.81
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-20: Version 7.5.80
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-19: Version 7.5.79
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-19: Version 7.5.78
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-19: Version 7.5.77
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-19: Version 7.5.76
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-19: Version 7.5.75
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-19: Version 7.5.74
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-19: Version 7.5.73
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-19: Version 7.5.72
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-19: Version 7.5.71
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-19: Version 7.5.70
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-18: Version 7.5.69
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-18: Version 7.5.68
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-18: Version 7.5.67
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-18: Version 7.5.66
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-18: Version 7.5.65
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-18: Version 7.5.64
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-18: Version 7.5.63
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-18: Version 7.5.62
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-18: Version 7.5.61
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-18: Version 7.5.60
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-16: Version 7.5.59
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-16: Version 7.5.58
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-15: Version 7.5.57
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-15: Version 7.5.56
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-15: Version 7.5.55
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-15: Version 7.5.54
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-15: Version 7.5.53
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-15: Version 7.5.52
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-15: Version 7.5.51
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-14: Version 7.5.50
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-14: Version 7.5.49
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-14: Version 7.5.48
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-14: Version 7.5.47
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-14: Version 7.5.46
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-14: Version 7.5.45
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-14: Version 7.5.44
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-14: Version 7.5.43
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-14: Version 7.5.42
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-14: Version 7.5.41
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-14: Version 7.5.40
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-14: Version 7.5.39
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-14: Version 7.5.38
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.37
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.36
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.35
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.34
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.33
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.32
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.31
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.30
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.29
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.28
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.27
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.26
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.25
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-13: Version 7.5.24
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-12: Version 7.5.23
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-12: Version 7.5.22
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-12: Version 7.5.21
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-12: Version 7.5.20
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-12: Version 7.5.19
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-12: Version 7.5.18
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-12: Version 7.5.17
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-11: Version 7.5.16
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-11: Version 7.5.15
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-11: Version 7.5.14
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-11: Version 7.5.13
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-11: Version 7.5.12
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-11: Version 7.5.11
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-09: Version 7.5.10
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-09: Version 7.5.9
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-09: Version 7.5.8
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-08: Version 7.5.7
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-08: Version 7.5.6
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-08: Version 7.5.5
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-08: Version 7.5.4
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-08: Version 7.5.3
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-08: Version 7.5.2
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-08: Version 7.5.1
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-07: Version 7.4.301
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-07: Version 7.4.300
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-06: Version 7.4.299
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-06: Version 7.4.298
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-06: Version 7.4.297
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-06: Version 7.4.296
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-06: Version 7.4.295
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-06: Version 7.4.294
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-06: Version 7.4.293
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-06: Version 7.4.292
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-06: Version 7.4.291
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-06: Version 7.4.290
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-06: Version 7.4.289
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-05: Version 7.4.288
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-05: Version 7.4.287
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-05: Version 7.4.286
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-05: Version 7.4.285
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-05: Version 7.4.284
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-05: Version 7.4.283
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-05: Version 7.4.282
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-04: Version 7.4.281
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-04: Version 7.4.280
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-04: Version 7.4.279
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-04: Version 7.4.278
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-04: Version 7.4.277
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-04: Version 7.4.276
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-04: Version 7.4.275
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-04: Version 7.4.274
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-04: Version 7.4.273
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-04: Version 7.4.272
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-04: Version 7.4.271
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-03: Version 7.4.270
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-02: Version 7.4.269
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-01: Version 7.4.268
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-01: Version 7.4.267
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-01: Version 7.4.266
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-01: Version 7.4.265
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-01: Version 7.4.264
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-01: Version 7.4.263
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-01: Version 7.4.262
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-01: Version 7.4.261
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-01: Version 7.4.260
-
-        Performance and stability improvements on all platforms.
-
-
-2019-03-01: Version 7.4.259
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-28: Version 7.4.258
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-28: Version 7.4.257
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-28: Version 7.4.256
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-28: Version 7.4.255
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-28: Version 7.4.254
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-28: Version 7.4.253
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-28: Version 7.4.252
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-28: Version 7.4.251
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-28: Version 7.4.250
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-28: Version 7.4.249
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-28: Version 7.4.248
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-28: Version 7.4.247
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-28: Version 7.4.246
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.245
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.244
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.243
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.242
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.241
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.240
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.239
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.238
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.237
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.236
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.235
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.234
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.233
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.232
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-27: Version 7.4.231
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-26: Version 7.4.230
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-26: Version 7.4.229
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-26: Version 7.4.228
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-26: Version 7.4.227
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-26: Version 7.4.226
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-26: Version 7.4.225
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-26: Version 7.4.224
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-26: Version 7.4.223
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-26: Version 7.4.222
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-25: Version 7.4.221
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-25: Version 7.4.220
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-25: Version 7.4.219
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-25: Version 7.4.218
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-25: Version 7.4.217
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-25: Version 7.4.216
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-25: Version 7.4.215
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-25: Version 7.4.214
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-25: Version 7.4.213
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-25: Version 7.4.212
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-25: Version 7.4.211
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-23: Version 7.4.210
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-23: Version 7.4.209
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-22: Version 7.4.208
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-22: Version 7.4.207
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-22: Version 7.4.206
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-22: Version 7.4.205
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-22: Version 7.4.204
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-22: Version 7.4.203
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-22: Version 7.4.202
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-22: Version 7.4.201
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-22: Version 7.4.200
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-22: Version 7.4.199
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-22: Version 7.4.198
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-21: Version 7.4.197
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-18: Version 7.4.196
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-18: Version 7.4.195
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-18: Version 7.4.194
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-18: Version 7.4.193
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-18: Version 7.4.192
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-18: Version 7.4.191
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-18: Version 7.4.190
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-18: Version 7.4.189
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-18: Version 7.4.188
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-18: Version 7.4.187
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-15: Version 7.4.186
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-15: Version 7.4.185
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-15: Version 7.4.184
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-15: Version 7.4.183
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-15: Version 7.4.182
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-15: Version 7.4.181
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-15: Version 7.4.180
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-15: Version 7.4.179
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-15: Version 7.4.178
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-15: Version 7.4.177
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-15: Version 7.4.176
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-14: Version 7.4.175
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-14: Version 7.4.174
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-14: Version 7.4.173
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-14: Version 7.4.172
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-14: Version 7.4.171
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-14: Version 7.4.170
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-14: Version 7.4.169
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-14: Version 7.4.168
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-14: Version 7.4.167
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-13: Version 7.4.166
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-13: Version 7.4.165
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-13: Version 7.4.164
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-13: Version 7.4.163
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-13: Version 7.4.162
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-13: Version 7.4.161
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-13: Version 7.4.160
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-13: Version 7.4.159
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-13: Version 7.4.158
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-13: Version 7.4.157
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-13: Version 7.4.156
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-13: Version 7.4.155
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-13: Version 7.4.154
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-12: Version 7.4.153
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-12: Version 7.4.152
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-12: Version 7.4.151
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-12: Version 7.4.150
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-12: Version 7.4.149
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-12: Version 7.4.148
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-12: Version 7.4.147
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-12: Version 7.4.146
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-12: Version 7.4.145
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-12: Version 7.4.144
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-12: Version 7.4.143
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-12: Version 7.4.142
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-12: Version 7.4.141
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-11: Version 7.4.140
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-11: Version 7.4.139
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-11: Version 7.4.138
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-11: Version 7.4.137
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-11: Version 7.4.136
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-11: Version 7.4.135
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-11: Version 7.4.134
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-11: Version 7.4.133
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-11: Version 7.4.132
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-11: Version 7.4.131
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-09: Version 7.4.130
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-09: Version 7.4.129
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-09: Version 7.4.128
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-09: Version 7.4.127
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-09: Version 7.4.126
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-09: Version 7.4.125
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-09: Version 7.4.124
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-08: Version 7.4.123
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-08: Version 7.4.122
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-08: Version 7.4.121
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-08: Version 7.4.120
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-08: Version 7.4.119
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-08: Version 7.4.118
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-08: Version 7.4.117
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-08: Version 7.4.116
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-08: Version 7.4.115
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-08: Version 7.4.114
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-08: Version 7.4.113
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-08: Version 7.4.112
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-08: Version 7.4.111
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-07: Version 7.4.110
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-07: Version 7.4.109
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-07: Version 7.4.108
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-07: Version 7.4.107
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-07: Version 7.4.106
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-07: Version 7.4.105
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-07: Version 7.4.104
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-07: Version 7.4.103
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-07: Version 7.4.102
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-07: Version 7.4.101
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.100
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.99
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.98
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.97
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.96
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.95
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.94
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.93
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.92
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.91
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.90
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.89
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.88
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.87
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-06: Version 7.4.86
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-05: Version 7.4.85
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-05: Version 7.4.84
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-05: Version 7.4.83
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-05: Version 7.4.82
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-05: Version 7.4.81
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-05: Version 7.4.80
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-05: Version 7.4.79
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-05: Version 7.4.78
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.77
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.76
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.75
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.74
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.73
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.72
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.71
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.70
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.69
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.68
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.67
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.66
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.65
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.64
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.63
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.62
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.61
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-04: Version 7.4.60
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-03: Version 7.4.59
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-03: Version 7.4.58
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-02: Version 7.4.57
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-02: Version 7.4.56
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-01: Version 7.4.55
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-01: Version 7.4.54
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-01: Version 7.4.53
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-01: Version 7.4.52
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-01: Version 7.4.51
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-01: Version 7.4.50
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-01: Version 7.4.49
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-01: Version 7.4.48
-
-        Performance and stability improvements on all platforms.
-
-
-2019-02-01: Version 7.4.47
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-31: Version 7.4.46
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-31: Version 7.4.45
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-31: Version 7.4.44
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-31: Version 7.4.43
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-31: Version 7.4.42
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-30: Version 7.4.41
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-30: Version 7.4.40
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-30: Version 7.4.39
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-30: Version 7.4.38
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-30: Version 7.4.37
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-30: Version 7.4.36
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-30: Version 7.4.35
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-30: Version 7.4.34
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-30: Version 7.4.33
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-30: Version 7.4.32
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-30: Version 7.4.31
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.30
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.29
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.28
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.27
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.26
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.25
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.24
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.23
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.22
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.21
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.20
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.19
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.18
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.17
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.16
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.15
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.14
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-29: Version 7.4.13
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-28: Version 7.4.12
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-28: Version 7.4.11
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-28: Version 7.4.10
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-28: Version 7.4.9
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-28: Version 7.4.8
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-28: Version 7.4.7
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-28: Version 7.4.6
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-27: Version 7.4.5
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-27: Version 7.4.4
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-26: Version 7.4.3
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-26: Version 7.4.2
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-26: Version 7.4.1
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-23: Version 7.3.495
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-23: Version 7.3.494
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-23: Version 7.3.493
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-23: Version 7.3.492
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-23: Version 7.3.491
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-23: Version 7.3.490
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-23: Version 7.3.489
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-23: Version 7.3.488
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.487
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.486
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.485
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.484
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.483
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.482
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.481
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.480
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.479
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.478
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.477
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.476
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.475
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.474
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.473
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-22: Version 7.3.472
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.471
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.470
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.469
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.468
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.467
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.466
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.465
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.464
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.463
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.462
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.461
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.460
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.459
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.458
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.457
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.456
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.455
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.454
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.453
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-21: Version 7.3.452
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-18: Version 7.3.451
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-18: Version 7.3.450
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-18: Version 7.3.449
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-18: Version 7.3.448
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-18: Version 7.3.447
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-18: Version 7.3.446
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-18: Version 7.3.445
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-18: Version 7.3.444
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-18: Version 7.3.443
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-18: Version 7.3.442
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-18: Version 7.3.441
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-18: Version 7.3.440
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-18: Version 7.3.439
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-17: Version 7.3.438
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-17: Version 7.3.437
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-17: Version 7.3.436
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-17: Version 7.3.435
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-17: Version 7.3.434
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-17: Version 7.3.433
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-17: Version 7.3.432
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-17: Version 7.3.431
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-17: Version 7.3.430
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-17: Version 7.3.429
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.428
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.427
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.426
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.425
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.424
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.423
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.422
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.421
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.420
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.419
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.418
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.417
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.416
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.415
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.414
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-16: Version 7.3.413
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-15: Version 7.3.412
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-15: Version 7.3.411
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-15: Version 7.3.410
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-15: Version 7.3.409
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-15: Version 7.3.408
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-15: Version 7.3.407
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-15: Version 7.3.406
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-15: Version 7.3.405
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-15: Version 7.3.404
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-15: Version 7.3.403
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-15: Version 7.3.402
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-15: Version 7.3.401
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-15: Version 7.3.400
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.399
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.398
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.397
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.396
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.395
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.394
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.393
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.392
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.391
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.390
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.389
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.388
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.387
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.386
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.385
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.384
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.383
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-14: Version 7.3.382
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-13: Version 7.3.381
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-12: Version 7.3.380
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-12: Version 7.3.379
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-12: Version 7.3.378
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.377
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.376
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.375
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.374
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.373
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.372
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.371
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.370
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.369
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.368
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.367
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.366
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.365
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.364
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.363
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-11: Version 7.3.362
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-10: Version 7.3.361
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-10: Version 7.3.360
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-10: Version 7.3.359
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-10: Version 7.3.358
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-10: Version 7.3.357
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-10: Version 7.3.356
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-10: Version 7.3.355
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-09: Version 7.3.354
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-09: Version 7.3.353
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-09: Version 7.3.352
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-09: Version 7.3.351
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-09: Version 7.3.350
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-09: Version 7.3.349
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-08: Version 7.3.348
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-08: Version 7.3.347
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-08: Version 7.3.346
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-08: Version 7.3.345
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-08: Version 7.3.344
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-08: Version 7.3.343
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-08: Version 7.3.342
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-08: Version 7.3.341
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-08: Version 7.3.340
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-08: Version 7.3.339
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-08: Version 7.3.338
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-08: Version 7.3.337
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-08: Version 7.3.336
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.335
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.334
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.333
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.332
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.331
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.330
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.329
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.328
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.327
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.326
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.325
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.324
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.323
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.322
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.321
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.320
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.319
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.318
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.317
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.316
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.315
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.314
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.313
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.312
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.311
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.310
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.309
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.308
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.307
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.306
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-07: Version 7.3.305
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-06: Version 7.3.304
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.303
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.302
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.301
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.300
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.299
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.298
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.297
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.296
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.295
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.294
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.293
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.292
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.291
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.290
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.289
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-04: Version 7.3.288
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.287
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.286
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.285
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.284
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.283
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.282
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.281
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.280
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.279
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.278
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.277
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.276
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.275
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.274
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.273
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.272
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-03: Version 7.3.271
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-02: Version 7.3.270
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-02: Version 7.3.269
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-02: Version 7.3.268
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-02: Version 7.3.267
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-02: Version 7.3.266
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-02: Version 7.3.265
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-02: Version 7.3.264
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-02: Version 7.3.263
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-02: Version 7.3.262
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-02: Version 7.3.261
-
-        Performance and stability improvements on all platforms.
-
-
-2019-01-01: Version 7.3.260
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-31: Version 7.3.259
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-31: Version 7.3.258
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-30: Version 7.3.257
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-29: Version 7.3.256
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-28: Version 7.3.255
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-28: Version 7.3.254
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-28: Version 7.3.253
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-28: Version 7.3.252
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-27: Version 7.3.251
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-27: Version 7.3.250
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-27: Version 7.3.249
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-27: Version 7.3.248
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-27: Version 7.3.247
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-27: Version 7.3.246
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-27: Version 7.3.245
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-27: Version 7.3.244
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-24: Version 7.3.243
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-24: Version 7.3.242
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-24: Version 7.3.241
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-24: Version 7.3.240
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-24: Version 7.3.239
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-24: Version 7.3.238
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-24: Version 7.3.237
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-23: Version 7.3.236
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-22: Version 7.3.235
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-21: Version 7.3.234
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-21: Version 7.3.233
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-21: Version 7.3.232
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-21: Version 7.3.231
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-21: Version 7.3.230
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-21: Version 7.3.229
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-21: Version 7.3.228
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-21: Version 7.3.227
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-21: Version 7.3.226
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-21: Version 7.3.225
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-21: Version 7.3.224
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-21: Version 7.3.223
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-20: Version 7.3.222
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-20: Version 7.3.221
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-20: Version 7.3.220
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-20: Version 7.3.219
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-20: Version 7.3.218
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-20: Version 7.3.217
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-20: Version 7.3.216
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-20: Version 7.3.215
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-20: Version 7.3.214
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-20: Version 7.3.213
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.212
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.211
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.210
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.209
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.208
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.207
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.206
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.205
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.204
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.203
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.202
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.201
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.200
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.199
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.198
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-19: Version 7.3.197
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.196
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.195
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.194
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.193
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.192
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.191
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.190
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.189
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.188
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.187
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.186
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.185
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.184
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.183
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.182
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.181
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.180
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.179
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.178
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.177
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.176
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-18: Version 7.3.175
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.174
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.173
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.172
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.171
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.170
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.169
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.168
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.167
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.166
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.165
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.164
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.163
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.162
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.161
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.160
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.159
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-17: Version 7.3.158
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.157
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.156
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.155
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.154
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.153
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.152
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.151
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.150
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.149
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.148
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.147
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.146
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.145
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.144
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.143
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.142
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.141
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-14: Version 7.3.140
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.139
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.138
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.137
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.136
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.135
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.134
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.133
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.132
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.131
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.130
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.129
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.128
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.127
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.126
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.125
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-13: Version 7.3.124
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.123
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.122
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.121
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.120
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.119
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.118
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.117
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.116
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.115
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.114
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.113
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.112
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.111
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.110
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.109
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.108
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.107
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.106
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.105
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-12: Version 7.3.104
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.103
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.102
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.101
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.100
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.99
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.98
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.97
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.96
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.95
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.94
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.93
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.92
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.91
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.90
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.89
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.88
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.87
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.86
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.85
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-11: Version 7.3.84
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-10: Version 7.3.83
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-10: Version 7.3.82
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-10: Version 7.3.81
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-10: Version 7.3.80
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-10: Version 7.3.79
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-10: Version 7.3.78
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-10: Version 7.3.77
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-10: Version 7.3.76
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-08: Version 7.3.75
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.74
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.73
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.72
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.71
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.70
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.69
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.68
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.67
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.66
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.65
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.64
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.63
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.62
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.61
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.60
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-07: Version 7.3.59
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-06: Version 7.3.58
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-06: Version 7.3.57
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-06: Version 7.3.56
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-06: Version 7.3.55
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-06: Version 7.3.54
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-06: Version 7.3.53
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-06: Version 7.3.52
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-06: Version 7.3.51
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-06: Version 7.3.50
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-06: Version 7.3.49
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-06: Version 7.3.48
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-06: Version 7.3.47
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-06: Version 7.3.46
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.45
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.44
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.43
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.42
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.41
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.40
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.39
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.38
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.37
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.36
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.35
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.34
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.33
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.32
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.31
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.30
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.29
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-05: Version 7.3.28
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.27
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.26
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.25
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.24
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.23
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.22
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.21
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.20
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.19
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.18
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.17
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.16
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.15
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.14
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.13
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-04: Version 7.3.12
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-03: Version 7.3.11
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-03: Version 7.3.10
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-03: Version 7.3.9
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-03: Version 7.3.8
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-03: Version 7.3.7
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-03: Version 7.3.6
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-03: Version 7.3.5
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-03: Version 7.3.4
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-03: Version 7.3.3
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-03: Version 7.3.2
-
-        Performance and stability improvements on all platforms.
-
-
-2018-12-03: Version 7.3.1
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-29: Version 7.2.505
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-29: Version 7.2.504
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-29: Version 7.2.503
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-28: Version 7.2.502
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-28: Version 7.2.501
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-28: Version 7.2.500
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-28: Version 7.2.499
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-28: Version 7.2.498
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-28: Version 7.2.497
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-28: Version 7.2.496
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-28: Version 7.2.495
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-28: Version 7.2.494
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-28: Version 7.2.493
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-28: Version 7.2.492
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.491
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.490
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.489
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.488
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.487
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.486
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.485
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.484
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.483
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.482
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.481
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.480
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.479
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-27: Version 7.2.478
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-26: Version 7.2.477
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-26: Version 7.2.476
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-26: Version 7.2.475
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-26: Version 7.2.474
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-26: Version 7.2.473
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-26: Version 7.2.472
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-26: Version 7.2.471
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-26: Version 7.2.470
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-26: Version 7.2.469
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-24: Version 7.2.468
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-24: Version 7.2.467
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-24: Version 7.2.466
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-24: Version 7.2.465
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-24: Version 7.2.464
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-24: Version 7.2.463
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-23: Version 7.2.462
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-23: Version 7.2.461
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-23: Version 7.2.460
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-23: Version 7.2.459
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-23: Version 7.2.458
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.457
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.456
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.455
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.454
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.453
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.452
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.451
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.450
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.449
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.448
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.447
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.446
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.445
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.444
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.443
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.442
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.441
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.440
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.439
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.438
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.437
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.436
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.435
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.434
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.433
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.432
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.431
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.430
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.429
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.428
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.427
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.426
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-22: Version 7.2.425
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.424
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.423
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.422
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.421
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.420
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.419
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.418
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.417
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.416
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.415
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.414
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.413
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.412
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.411
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.410
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.409
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.408
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.407
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.406
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.405
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.404
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.403
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.402
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.401
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.400
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.399
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.398
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-21: Version 7.2.397
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-20: Version 7.2.396
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-20: Version 7.2.395
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-20: Version 7.2.394
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-20: Version 7.2.393
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-20: Version 7.2.392
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-20: Version 7.2.391
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-20: Version 7.2.390
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-20: Version 7.2.389
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-20: Version 7.2.388
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-19: Version 7.2.387
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-19: Version 7.2.386
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-19: Version 7.2.385
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-19: Version 7.2.384
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-19: Version 7.2.383
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-19: Version 7.2.382
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-19: Version 7.2.381
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-19: Version 7.2.380
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-19: Version 7.2.379
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-18: Version 7.2.378
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-18: Version 7.2.377
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.376
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.375
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.374
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.373
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.372
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.371
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.370
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.369
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.368
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.367
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.366
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.365
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.364
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.363
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-16: Version 7.2.362
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.361
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.360
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.359
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.358
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.357
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.356
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.355
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.354
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.353
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.352
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.351
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.350
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.349
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.348
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.347
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.346
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.345
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.344
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.343
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.342
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.341
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.340
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-15: Version 7.2.339
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.338
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.337
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.336
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.335
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.334
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.333
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.332
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.331
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.330
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.329
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.328
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.327
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.326
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.325
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.324
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.323
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-14: Version 7.2.322
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-13: Version 7.2.321
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-13: Version 7.2.320
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-13: Version 7.2.319
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-13: Version 7.2.318
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-13: Version 7.2.317
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-13: Version 7.2.316
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-13: Version 7.2.315
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-13: Version 7.2.314
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-13: Version 7.2.313
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-13: Version 7.2.312
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-13: Version 7.2.311
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-13: Version 7.2.310
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.309
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.308
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.307
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.306
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.305
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.304
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.303
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.302
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.301
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.300
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.299
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.298
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.297
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.296
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.295
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-12: Version 7.2.294
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-09: Version 7.2.293
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-09: Version 7.2.292
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-09: Version 7.2.291
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-09: Version 7.2.290
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-09: Version 7.2.289
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-09: Version 7.2.288
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-09: Version 7.2.287
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-09: Version 7.2.286
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-09: Version 7.2.285
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-09: Version 7.2.284
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-08: Version 7.2.283
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-08: Version 7.2.282
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-08: Version 7.2.281
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-08: Version 7.2.280
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-08: Version 7.2.279
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-08: Version 7.2.278
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-08: Version 7.2.277
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-08: Version 7.2.276
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-08: Version 7.2.275
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-08: Version 7.2.274
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-08: Version 7.2.273
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-07: Version 7.2.272
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-07: Version 7.2.271
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-07: Version 7.2.270
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-07: Version 7.2.269
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-07: Version 7.2.268
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-07: Version 7.2.267
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-07: Version 7.2.266
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-07: Version 7.2.265
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-07: Version 7.2.264
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-07: Version 7.2.263
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-07: Version 7.2.262
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-07: Version 7.2.261
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-07: Version 7.2.260
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.259
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.258
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.257
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.256
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.255
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.254
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.253
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.252
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.251
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.250
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.249
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.248
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.247
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.246
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.245
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.244
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-06: Version 7.2.243
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-05: Version 7.2.242
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-05: Version 7.2.241
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-05: Version 7.2.240
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-05: Version 7.2.239
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-04: Version 7.2.238
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-04: Version 7.2.237
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-03: Version 7.2.236
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-03: Version 7.2.235
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-03: Version 7.2.234
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.233
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.232
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.231
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.230
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.229
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.228
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.227
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.226
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.225
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.224
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.223
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.222
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.221
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-02: Version 7.2.220
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-01: Version 7.2.219
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-01: Version 7.2.218
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-01: Version 7.2.217
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-01: Version 7.2.216
-
-        Performance and stability improvements on all platforms.
-
-
-2018-11-01: Version 7.2.215
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.214
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.213
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.212
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.211
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.210
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.209
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.208
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.207
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.206
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.205
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.204
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.203
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.202
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.201
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.200
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.199
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.198
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.197
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-31: Version 7.2.196
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-30: Version 7.2.195
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-30: Version 7.2.194
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.193
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.192
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.191
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.190
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.189
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.188
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.187
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.186
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.185
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.184
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.183
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.182
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.181
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.180
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.179
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.178
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.177
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.176
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.175
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.174
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.173
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.172
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.171
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.170
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.169
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.168
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.167
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.166
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-29: Version 7.2.165
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-28: Version 7.2.164
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-27: Version 7.2.163
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.162
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.161
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.160
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.159
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.158
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.157
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.156
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.155
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.154
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.153
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.152
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.151
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.150
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.149
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.148
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.147
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.146
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.145
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.144
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.143
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-26: Version 7.2.142
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.141
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.140
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.139
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.138
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.137
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.136
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.135
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.134
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.133
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.132
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.131
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.130
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.129
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.128
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.127
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.126
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.125
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.124
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.123
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-25: Version 7.2.122
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.121
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.120
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.119
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.118
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.117
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.116
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.115
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.114
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.113
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.112
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.111
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.110
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.109
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.108
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.107
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.106
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.105
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.104
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.103
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.102
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.101
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.100
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.99
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.98
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.97
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.96
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-24: Version 7.2.95
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.94
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.93
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.92
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.91
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.90
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.89
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.88
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.87
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.86
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.85
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.84
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.83
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.82
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.81
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.80
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.79
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.78
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.77
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.76
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-23: Version 7.2.75
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.74
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.73
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.72
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.71
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.70
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.69
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.68
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.67
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.66
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.65
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.64
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.63
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.62
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.61
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.60
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.59
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.58
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.57
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.56
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.55
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.54
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.53
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-22: Version 7.2.52
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-20: Version 7.2.51
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-20: Version 7.2.50
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-19: Version 7.2.49
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-19: Version 7.2.48
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-19: Version 7.2.47
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-19: Version 7.2.46
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-19: Version 7.2.45
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-19: Version 7.2.44
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-19: Version 7.2.43
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-18: Version 7.2.42
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-18: Version 7.2.41
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-18: Version 7.2.40
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.39
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.38
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.37
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.36
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.35
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.34
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.33
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.32
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.31
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.30
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.29
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.28
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.27
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.26
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-17: Version 7.2.25
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-16: Version 7.2.24
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-16: Version 7.2.23
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-16: Version 7.2.22
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-16: Version 7.2.21
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-16: Version 7.2.20
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-16: Version 7.2.19
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-16: Version 7.2.18
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-16: Version 7.2.17
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-16: Version 7.2.16
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-15: Version 7.2.15
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-15: Version 7.2.14
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-15: Version 7.2.13
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-15: Version 7.2.12
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-15: Version 7.2.11
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-15: Version 7.2.10
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-15: Version 7.2.9
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-15: Version 7.2.8
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-15: Version 7.2.7
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-15: Version 7.2.6
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-15: Version 7.2.5
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-15: Version 7.2.4
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-14: Version 7.2.3
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-13: Version 7.2.2
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-13: Version 7.2.1
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-11: Version 7.1.321
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-10: Version 7.1.320
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-10: Version 7.1.319
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-10: Version 7.1.318
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-10: Version 7.1.317
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-10: Version 7.1.316
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-10: Version 7.1.315
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-10: Version 7.1.314
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-10: Version 7.1.313
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-10: Version 7.1.312
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-09: Version 7.1.311
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-09: Version 7.1.310
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-09: Version 7.1.309
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-09: Version 7.1.308
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-09: Version 7.1.307
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-09: Version 7.1.306
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-09: Version 7.1.305
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-09: Version 7.1.304
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-09: Version 7.1.303
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-09: Version 7.1.302
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-09: Version 7.1.301
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.300
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.299
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.298
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.297
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.296
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.295
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.294
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.293
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.292
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.291
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.290
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.289
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.288
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.287
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.286
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.285
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.284
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-08: Version 7.1.283
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-07: Version 7.1.282
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-07: Version 7.1.281
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-07: Version 7.1.280
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-06: Version 7.1.279
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-06: Version 7.1.278
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-06: Version 7.1.277
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-06: Version 7.1.276
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-06: Version 7.1.275
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.274
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.273
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.272
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.271
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.270
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.269
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.268
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.267
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.266
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.265
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.264
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.263
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.262
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.261
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-05: Version 7.1.260
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.259
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.258
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.257
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.256
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.255
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.254
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.253
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.252
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.251
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.250
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.249
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.248
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.247
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-04: Version 7.1.246
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-03: Version 7.1.245
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-03: Version 7.1.244
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-03: Version 7.1.243
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-03: Version 7.1.242
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-03: Version 7.1.241
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-03: Version 7.1.240
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-03: Version 7.1.239
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-03: Version 7.1.238
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-03: Version 7.1.237
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-03: Version 7.1.236
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-03: Version 7.1.235
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-02: Version 7.1.234
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-02: Version 7.1.233
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-02: Version 7.1.232
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-02: Version 7.1.231
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-02: Version 7.1.230
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-02: Version 7.1.229
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-02: Version 7.1.228
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-02: Version 7.1.227
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-01: Version 7.1.226
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-01: Version 7.1.225
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-01: Version 7.1.224
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-01: Version 7.1.223
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-01: Version 7.1.222
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-01: Version 7.1.221
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-01: Version 7.1.220
-
-        Performance and stability improvements on all platforms.
-
-
-2018-10-01: Version 7.1.219
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-30: Version 7.1.218
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-29: Version 7.1.217
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-29: Version 7.1.216
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-29: Version 7.1.215
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-28: Version 7.1.214
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-28: Version 7.1.213
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-28: Version 7.1.212
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-28: Version 7.1.211
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-28: Version 7.1.210
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-28: Version 7.1.209
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-28: Version 7.1.208
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-28: Version 7.1.207
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-28: Version 7.1.206
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-28: Version 7.1.205
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-28: Version 7.1.204
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-28: Version 7.1.203
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-28: Version 7.1.202
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.201
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.200
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.199
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.198
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.197
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.196
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.195
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.194
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.193
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.192
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.191
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.190
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.189
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.188
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.187
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-27: Version 7.1.186
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-26: Version 7.1.185
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-26: Version 7.1.184
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-26: Version 7.1.183
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-26: Version 7.1.182
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-26: Version 7.1.181
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-26: Version 7.1.180
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-26: Version 7.1.179
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-25: Version 7.1.178
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-25: Version 7.1.177
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-25: Version 7.1.176
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-25: Version 7.1.175
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-25: Version 7.1.174
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-25: Version 7.1.173
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-25: Version 7.1.172
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-24: Version 7.1.171
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-24: Version 7.1.170
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-24: Version 7.1.169
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-24: Version 7.1.168
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-24: Version 7.1.167
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-24: Version 7.1.166
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-24: Version 7.1.165
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-24: Version 7.1.164
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.163
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.162
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.161
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.160
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.159
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.158
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.157
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.156
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.155
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.154
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.153
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.152
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.151
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.150
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-21: Version 7.1.149
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-20: Version 7.1.148
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.147
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.146
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.145
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.144
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.143
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.142
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.141
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.140
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.139
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.138
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.137
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.136
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.135
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.134
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-19: Version 7.1.133
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-18: Version 7.1.132
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-18: Version 7.1.131
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-18: Version 7.1.130
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-18: Version 7.1.129
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-18: Version 7.1.128
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-18: Version 7.1.127
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-18: Version 7.1.126
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-18: Version 7.1.125
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-18: Version 7.1.124
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-18: Version 7.1.123
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-18: Version 7.1.122
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-18: Version 7.1.121
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-17: Version 7.1.120
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-17: Version 7.1.119
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-17: Version 7.1.118
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-17: Version 7.1.117
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-17: Version 7.1.116
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-17: Version 7.1.115
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-17: Version 7.1.114
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.113
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.112
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.111
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.110
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.109
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.108
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.107
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.106
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.105
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.104
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.103
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.102
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.101
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.100
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-14: Version 7.1.99
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-13: Version 7.1.98
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-13: Version 7.1.97
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-13: Version 7.1.96
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-13: Version 7.1.95
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-13: Version 7.1.94
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-13: Version 7.1.93
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-13: Version 7.1.92
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-12: Version 7.1.91
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-12: Version 7.1.90
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-12: Version 7.1.89
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-12: Version 7.1.88
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-12: Version 7.1.87
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-12: Version 7.1.86
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-11: Version 7.1.85
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-11: Version 7.1.84
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-11: Version 7.1.83
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-11: Version 7.1.82
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-11: Version 7.1.81
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-11: Version 7.1.80
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-10: Version 7.1.79
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-10: Version 7.1.78
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-10: Version 7.1.77
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-10: Version 7.1.76
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-10: Version 7.1.75
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-10: Version 7.1.74
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-10: Version 7.1.73
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-10: Version 7.1.72
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-10: Version 7.1.71
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-09: Version 7.1.70
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-08: Version 7.1.69
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-07: Version 7.1.68
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-07: Version 7.1.67
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-07: Version 7.1.66
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-07: Version 7.1.65
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-07: Version 7.1.64
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-07: Version 7.1.63
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-07: Version 7.1.62
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-07: Version 7.1.61
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-07: Version 7.1.60
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-07: Version 7.1.59
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-07: Version 7.1.58
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-07: Version 7.1.57
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-07: Version 7.1.56
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.55
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.54
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.53
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.52
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.51
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.50
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.49
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.48
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.47
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.46
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.45
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.44
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.43
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.42
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-06: Version 7.1.41
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.40
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.39
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.38
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.37
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.36
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.35
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.34
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.33
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.32
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.31
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.30
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.29
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.28
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-05: Version 7.1.27
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-04: Version 7.1.26
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-04: Version 7.1.25
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-04: Version 7.1.24
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-04: Version 7.1.23
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-04: Version 7.1.22
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-04: Version 7.1.21
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-04: Version 7.1.20
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-04: Version 7.1.19
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-04: Version 7.1.18
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-04: Version 7.1.17
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-04: Version 7.1.16
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-03: Version 7.1.15
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-03: Version 7.1.14
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-03: Version 7.1.13
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-03: Version 7.1.12
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-03: Version 7.1.11
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-03: Version 7.1.10
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-02: Version 7.1.9
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-02: Version 7.1.8
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-02: Version 7.1.7
-
-        Performance and stability improvements on all platforms.
-
-
-2018-09-01: Version 7.1.6
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-31: Version 7.1.5
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-31: Version 7.1.4
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-31: Version 7.1.3
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-31: Version 7.1.2
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-31: Version 7.1.1
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.302
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.301
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.300
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.299
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.298
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.297
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.296
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.295
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.294
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.293
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.292
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.291
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.290
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.289
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-29: Version 7.0.288
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-28: Version 7.0.287
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-28: Version 7.0.286
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-28: Version 7.0.285
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-28: Version 7.0.284
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-28: Version 7.0.283
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-28: Version 7.0.282
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-28: Version 7.0.281
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-28: Version 7.0.280
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-28: Version 7.0.279
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-28: Version 7.0.278
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-28: Version 7.0.277
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-27: Version 7.0.276
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-27: Version 7.0.275
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-26: Version 7.0.274
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-25: Version 7.0.273
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-25: Version 7.0.272
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-25: Version 7.0.271
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-25: Version 7.0.270
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-24: Version 7.0.269
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-24: Version 7.0.268
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-24: Version 7.0.267
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-24: Version 7.0.266
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-24: Version 7.0.265
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-24: Version 7.0.264
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-24: Version 7.0.263
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-24: Version 7.0.262
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-24: Version 7.0.261
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-24: Version 7.0.260
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-24: Version 7.0.259
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-23: Version 7.0.258
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-23: Version 7.0.257
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-23: Version 7.0.256
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-23: Version 7.0.255
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-23: Version 7.0.254
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-23: Version 7.0.253
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-23: Version 7.0.252
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-23: Version 7.0.251
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-23: Version 7.0.250
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-23: Version 7.0.249
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-22: Version 7.0.248
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-22: Version 7.0.247
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-21: Version 7.0.246
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-21: Version 7.0.245
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-21: Version 7.0.244
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-21: Version 7.0.243
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-17: Version 7.0.242
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-17: Version 7.0.241
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-17: Version 7.0.240
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-17: Version 7.0.239
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-17: Version 7.0.238
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-15: Version 7.0.237
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-14: Version 7.0.236
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-14: Version 7.0.235
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-14: Version 7.0.234
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-14: Version 7.0.233
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-14: Version 7.0.232
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-14: Version 7.0.231
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-12: Version 7.0.230
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-11: Version 7.0.229
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-11: Version 7.0.228
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-11: Version 7.0.227
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-11: Version 7.0.226
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-11: Version 7.0.225
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-11: Version 7.0.224
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.223
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.222
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.221
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.220
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.219
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.218
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.217
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.216
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.215
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.214
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.213
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.212
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.211
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.210
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.209
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-10: Version 7.0.208
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-09: Version 7.0.207
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-09: Version 7.0.206
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-09: Version 7.0.205
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-09: Version 7.0.204
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-09: Version 7.0.203
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-09: Version 7.0.202
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-09: Version 7.0.201
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.200
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.199
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.198
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.197
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.196
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.195
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.194
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.193
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.192
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.191
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.190
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.189
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.188
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.187
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.186
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.185
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.184
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.183
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.182
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.181
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.180
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.179
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.178
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.177
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.176
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-08: Version 7.0.175
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-07: Version 7.0.174
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-07: Version 7.0.173
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-07: Version 7.0.172
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-07: Version 7.0.171
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-06: Version 7.0.170
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-06: Version 7.0.169
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-06: Version 7.0.168
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-06: Version 7.0.167
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-06: Version 7.0.166
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-06: Version 7.0.165
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-06: Version 7.0.164
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-06: Version 7.0.163
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-06: Version 7.0.162
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-06: Version 7.0.161
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-06: Version 7.0.160
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-06: Version 7.0.159
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-03: Version 7.0.158
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-03: Version 7.0.157
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-03: Version 7.0.156
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-03: Version 7.0.155
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-03: Version 7.0.154
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-03: Version 7.0.153
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-03: Version 7.0.152
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-03: Version 7.0.151
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-03: Version 7.0.150
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-03: Version 7.0.149
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-03: Version 7.0.148
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.147
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.146
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.145
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.144
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.143
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.142
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.141
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.140
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.139
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.138
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.137
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.136
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.135
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.134
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.133
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.132
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.131
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.130
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.129
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-02: Version 7.0.128
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-01: Version 7.0.127
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-01: Version 7.0.126
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-01: Version 7.0.125
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-01: Version 7.0.124
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-01: Version 7.0.123
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-01: Version 7.0.122
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-01: Version 7.0.121
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-01: Version 7.0.120
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-01: Version 7.0.119
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-01: Version 7.0.118
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-01: Version 7.0.117
-
-        Performance and stability improvements on all platforms.
-
-
-2018-08-01: Version 7.0.116
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.115
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.114
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.113
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.112
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.111
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.110
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.109
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.108
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.107
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.106
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.105
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.104
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.103
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.102
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.101
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.100
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.99
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.98
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.97
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.96
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-31: Version 7.0.95
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-30: Version 7.0.94
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-30: Version 7.0.93
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-30: Version 7.0.92
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-30: Version 7.0.91
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-30: Version 7.0.90
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-30: Version 7.0.89
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-30: Version 7.0.88
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-30: Version 7.0.87
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-29: Version 7.0.86
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-28: Version 7.0.85
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-28: Version 7.0.84
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-28: Version 7.0.83
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-27: Version 7.0.82
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-27: Version 7.0.81
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-27: Version 7.0.80
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-27: Version 7.0.79
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-27: Version 7.0.78
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-27: Version 7.0.77
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-27: Version 7.0.76
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-27: Version 7.0.75
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-27: Version 7.0.74
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.73
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.72
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.71
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.70
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.69
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.68
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.67
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.66
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.65
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.64
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.63
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.62
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.61
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-26: Version 7.0.60
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.59
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.58
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.57
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.56
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.55
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.54
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.53
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.52
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.51
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.50
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.49
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.48
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.47
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.46
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.45
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.44
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-25: Version 7.0.43
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.42
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.41
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.40
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.39
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.38
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.37
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.36
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.35
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.34
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.33
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.32
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.31
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.30
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.29
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.28
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.27
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.26
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.25
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.24
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.23
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.22
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.21
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.20
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.19
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.18
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.17
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.16
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.15
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.14
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.13
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.12
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.11
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.10
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-24: Version 7.0.9
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-23: Version 7.0.8
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-23: Version 7.0.7
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-23: Version 7.0.6
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-23: Version 7.0.5
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-23: Version 7.0.4
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-23: Version 7.0.3
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-23: Version 7.0.2
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-20: Version 7.0.1
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-19: Version 6.9.454
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-19: Version 6.9.453
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-19: Version 6.9.452
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.451
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.450
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.449
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.448
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.447
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.446
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.445
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.444
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.443
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.442
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.441
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.440
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.439
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.438
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.437
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.436
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.435
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.434
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.433
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.432
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.431
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.430
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-18: Version 6.9.429
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.428
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.427
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.426
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.425
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.424
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.423
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.422
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.421
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.420
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.419
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.418
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.417
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.416
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.415
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.414
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-17: Version 6.9.413
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-16: Version 6.9.412
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-16: Version 6.9.411
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-16: Version 6.9.410
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-16: Version 6.9.409
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-16: Version 6.9.408
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-16: Version 6.9.407
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-16: Version 6.9.406
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-16: Version 6.9.405
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-16: Version 6.9.404
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-16: Version 6.9.403
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-16: Version 6.9.402
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-16: Version 6.9.401
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-15: Version 6.9.400
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-14: Version 6.9.399
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.398
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.397
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.396
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.395
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.394
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.393
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.392
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.391
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.390
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.389
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.388
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.387
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.386
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.385
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.384
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.383
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.382
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-13: Version 6.9.381
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.380
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.379
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.378
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.377
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.376
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.375
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.374
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.373
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.372
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.371
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.370
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.369
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.368
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.367
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.366
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.365
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.364
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.363
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.362
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.361
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.360
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.359
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.358
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.357
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.356
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-12: Version 6.9.355
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-11: Version 6.9.354
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-11: Version 6.9.353
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-11: Version 6.9.352
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-11: Version 6.9.351
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-11: Version 6.9.350
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-11: Version 6.9.349
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-11: Version 6.9.348
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-11: Version 6.9.347
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-11: Version 6.9.346
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-11: Version 6.9.345
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-10: Version 6.9.344
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-10: Version 6.9.343
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-10: Version 6.9.342
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-10: Version 6.9.341
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-10: Version 6.9.340
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-10: Version 6.9.339
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-10: Version 6.9.338
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-10: Version 6.9.337
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-10: Version 6.9.336
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-10: Version 6.9.335
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-10: Version 6.9.334
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-10: Version 6.9.333
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-10: Version 6.9.332
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-09: Version 6.9.331
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-09: Version 6.9.330
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-09: Version 6.9.329
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-09: Version 6.9.328
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-09: Version 6.9.327
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-09: Version 6.9.326
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-09: Version 6.9.325
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-08: Version 6.9.324
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-07: Version 6.9.323
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-06: Version 6.9.322
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-06: Version 6.9.321
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-06: Version 6.9.320
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-06: Version 6.9.319
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-06: Version 6.9.318
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-06: Version 6.9.317
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-06: Version 6.9.316
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-05: Version 6.9.315
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-05: Version 6.9.314
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-05: Version 6.9.313
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-05: Version 6.9.312
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-05: Version 6.9.311
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-05: Version 6.9.310
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-05: Version 6.9.309
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-05: Version 6.9.308
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-04: Version 6.9.307
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-04: Version 6.9.306
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-04: Version 6.9.305
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-04: Version 6.9.304
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-04: Version 6.9.303
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-04: Version 6.9.302
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-04: Version 6.9.301
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-04: Version 6.9.300
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-04: Version 6.9.299
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.298
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.297
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.296
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.295
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.294
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.293
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.292
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.291
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.290
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.289
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.288
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.287
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.286
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.285
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.284
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.283
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.282
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.281
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.280
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-03: Version 6.9.279
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.278
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.277
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.276
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.275
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.274
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.273
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.272
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.271
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.270
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.269
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.268
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.267
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.266
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.265
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.264
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.263
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.262
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.261
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.260
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.259
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-02: Version 6.9.258
-
-        Performance and stability improvements on all platforms.
-
-
-2018-07-01: Version 6.9.257
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-30: Version 6.9.256
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-29: Version 6.9.255
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-29: Version 6.9.254
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-29: Version 6.9.253
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-29: Version 6.9.252
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-29: Version 6.9.251
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-29: Version 6.9.250
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-29: Version 6.9.249
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-29: Version 6.9.248
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-29: Version 6.9.247
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-29: Version 6.9.246
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-28: Version 6.9.245
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-28: Version 6.9.244
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-28: Version 6.9.243
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-27: Version 6.9.242
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-27: Version 6.9.241
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-27: Version 6.9.240
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-27: Version 6.9.239
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-27: Version 6.9.238
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-27: Version 6.9.237
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-27: Version 6.9.236
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-27: Version 6.9.235
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-27: Version 6.9.234
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-27: Version 6.9.233
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-27: Version 6.9.232
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-27: Version 6.9.231
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-27: Version 6.9.230
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-26: Version 6.9.229
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-26: Version 6.9.228
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-26: Version 6.9.227
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-26: Version 6.9.226
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-26: Version 6.9.225
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-26: Version 6.9.224
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-26: Version 6.9.223
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-26: Version 6.9.222
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-26: Version 6.9.221
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-25: Version 6.9.220
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-25: Version 6.9.219
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-25: Version 6.9.218
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-25: Version 6.9.217
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-25: Version 6.9.216
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-25: Version 6.9.215
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-25: Version 6.9.214
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-25: Version 6.9.213
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-25: Version 6.9.212
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-25: Version 6.9.211
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-25: Version 6.9.210
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-25: Version 6.9.209
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-24: Version 6.9.208
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-23: Version 6.9.207
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-23: Version 6.9.206
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-22: Version 6.9.205
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-22: Version 6.9.204
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-22: Version 6.9.203
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-22: Version 6.9.202
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-22: Version 6.9.201
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-22: Version 6.9.200
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-22: Version 6.9.199
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-22: Version 6.9.198
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-21: Version 6.9.197
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-21: Version 6.9.196
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-21: Version 6.9.195
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-21: Version 6.9.194
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-21: Version 6.9.193
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-21: Version 6.9.192
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-20: Version 6.9.191
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-20: Version 6.9.190
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-20: Version 6.9.189
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-20: Version 6.9.188
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-20: Version 6.9.187
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-20: Version 6.9.186
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-20: Version 6.9.185
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-19: Version 6.9.184
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-19: Version 6.9.183
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-19: Version 6.9.182
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-19: Version 6.9.181
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-19: Version 6.9.180
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-19: Version 6.9.179
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-19: Version 6.9.178
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-19: Version 6.9.177
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-19: Version 6.9.176
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-19: Version 6.9.175
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-19: Version 6.9.174
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.173
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.172
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.171
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.170
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.169
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.168
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.167
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.166
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.165
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.164
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.163
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.162
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.161
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.160
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.159
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.158
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-18: Version 6.9.157
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-14: Version 6.9.156
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-14: Version 6.9.155
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-14: Version 6.9.154
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-14: Version 6.9.153
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-14: Version 6.9.152
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-14: Version 6.9.151
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-14: Version 6.9.150
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.149
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.148
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.147
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.146
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.145
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.144
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.143
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.142
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.141
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.140
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.139
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.138
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.137
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.136
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.135
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.134
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.133
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.132
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.131
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.130
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.129
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.128
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.127
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.126
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-13: Version 6.9.125
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-12: Version 6.9.124
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-12: Version 6.9.123
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-12: Version 6.9.122
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-12: Version 6.9.121
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-12: Version 6.9.120
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-11: Version 6.9.119
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-11: Version 6.9.118
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-11: Version 6.9.117
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-11: Version 6.9.116
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-11: Version 6.9.115
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-11: Version 6.9.114
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-11: Version 6.9.113
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-11: Version 6.9.112
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-11: Version 6.9.111
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-11: Version 6.9.110
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-11: Version 6.9.109
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-11: Version 6.9.108
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-08: Version 6.9.107
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-08: Version 6.9.106
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-08: Version 6.9.105
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-08: Version 6.9.104
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-08: Version 6.9.103
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-08: Version 6.9.102
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-07: Version 6.9.101
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-07: Version 6.9.100
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-07: Version 6.9.99
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-07: Version 6.9.98
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-07: Version 6.9.97
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-07: Version 6.9.96
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-07: Version 6.9.95
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-07: Version 6.9.94
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-07: Version 6.9.93
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-06: Version 6.9.92
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-06: Version 6.9.91
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-06: Version 6.9.90
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-06: Version 6.9.89
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-06: Version 6.9.88
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-06: Version 6.9.87
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-06: Version 6.9.86
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-06: Version 6.9.85
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-06: Version 6.9.84
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-06: Version 6.9.83
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-05: Version 6.9.82
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-05: Version 6.9.81
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-05: Version 6.9.80
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-05: Version 6.9.79
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-05: Version 6.9.78
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-05: Version 6.9.77
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-05: Version 6.9.76
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-05: Version 6.9.75
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-04: Version 6.9.74
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-04: Version 6.9.73
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-04: Version 6.9.72
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-04: Version 6.9.71
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-04: Version 6.9.70
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-04: Version 6.9.69
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-04: Version 6.9.68
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-04: Version 6.9.67
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-04: Version 6.9.66
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-04: Version 6.9.65
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-01: Version 6.9.64
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-01: Version 6.9.63
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-01: Version 6.9.62
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-01: Version 6.9.61
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-01: Version 6.9.60
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-01: Version 6.9.59
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-01: Version 6.9.58
-
-        Performance and stability improvements on all platforms.
-
-
-2018-06-01: Version 6.9.57
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-31: Version 6.9.56
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-31: Version 6.9.55
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-31: Version 6.9.54
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-31: Version 6.9.53
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-31: Version 6.9.52
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-31: Version 6.9.51
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-31: Version 6.9.50
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-31: Version 6.9.49
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-31: Version 6.9.48
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-30: Version 6.9.47
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-30: Version 6.9.46
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-30: Version 6.9.45
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-30: Version 6.9.44
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-30: Version 6.9.43
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-30: Version 6.9.42
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-30: Version 6.9.41
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-30: Version 6.9.40
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-30: Version 6.9.39
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-30: Version 6.9.38
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-30: Version 6.9.37
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.36
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.35
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.34
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.33
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.32
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.31
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.30
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.29
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.28
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.27
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.26
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.25
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.24
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.23
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.22
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.21
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.20
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.19
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.18
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.17
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.16
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.15
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.14
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-29: Version 6.9.13
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-28: Version 6.9.12
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-28: Version 6.9.11
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-28: Version 6.9.10
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-28: Version 6.9.9
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-28: Version 6.9.8
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-28: Version 6.9.7
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-28: Version 6.9.6
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-28: Version 6.9.5
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-28: Version 6.9.4
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-27: Version 6.9.3
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-26: Version 6.9.2
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-25: Version 6.9.1
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-24: Version 6.8.290
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-23: Version 6.8.289
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-23: Version 6.8.288
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-23: Version 6.8.287
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-23: Version 6.8.286
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-23: Version 6.8.285
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-23: Version 6.8.284
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-23: Version 6.8.283
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-23: Version 6.8.282
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-23: Version 6.8.281
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.280
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.279
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.278
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.277
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.276
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.275
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.274
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.273
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.272
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.271
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.270
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.269
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.268
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.267
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-22: Version 6.8.266
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-21: Version 6.8.265
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-21: Version 6.8.264
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-21: Version 6.8.263
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-21: Version 6.8.262
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-19: Version 6.8.261
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.260
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.259
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.258
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.257
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.256
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.255
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.254
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.253
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.252
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.251
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.250
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.249
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.248
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-18: Version 6.8.247
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-17: Version 6.8.246
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-17: Version 6.8.245
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-17: Version 6.8.244
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-17: Version 6.8.243
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-17: Version 6.8.242
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-16: Version 6.8.241
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-16: Version 6.8.240
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-16: Version 6.8.239
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-16: Version 6.8.238
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-16: Version 6.8.237
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-16: Version 6.8.236
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-16: Version 6.8.235
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-16: Version 6.8.234
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-16: Version 6.8.233
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-15: Version 6.8.232
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-15: Version 6.8.231
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-15: Version 6.8.230
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-15: Version 6.8.229
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-15: Version 6.8.228
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-15: Version 6.8.227
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-15: Version 6.8.226
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.225
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.224
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.223
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.222
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.221
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.220
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.219
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.218
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.217
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.216
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.215
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.214
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.213
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.212
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.211
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.210
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.209
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-14: Version 6.8.208
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-11: Version 6.8.207
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-11: Version 6.8.206
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-11: Version 6.8.205
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-11: Version 6.8.204
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-11: Version 6.8.203
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-11: Version 6.8.202
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-11: Version 6.8.201
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-11: Version 6.8.200
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-10: Version 6.8.199
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-08: Version 6.8.198
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-08: Version 6.8.197
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-08: Version 6.8.196
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-08: Version 6.8.195
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-08: Version 6.8.194
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-08: Version 6.8.193
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-08: Version 6.8.192
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-08: Version 6.8.191
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-08: Version 6.8.190
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-08: Version 6.8.189
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-07: Version 6.8.188
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-07: Version 6.8.187
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-07: Version 6.8.186
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-07: Version 6.8.185
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-07: Version 6.8.184
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-07: Version 6.8.183
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-07: Version 6.8.182
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-07: Version 6.8.181
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-07: Version 6.8.180
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-07: Version 6.8.179
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-07: Version 6.8.178
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-07: Version 6.8.177
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-05: Version 6.8.176
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-04: Version 6.8.175
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-04: Version 6.8.174
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-04: Version 6.8.173
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-04: Version 6.8.172
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-04: Version 6.8.171
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-04: Version 6.8.170
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-04: Version 6.8.169
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-04: Version 6.8.168
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-04: Version 6.8.167
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-04: Version 6.8.166
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-04: Version 6.8.165
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-04: Version 6.8.164
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-04: Version 6.8.163
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.162
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.161
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.160
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.159
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.158
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.157
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.156
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.155
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.154
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.153
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.152
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.151
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.150
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.149
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.148
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.147
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.146
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.145
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.144
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.143
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.142
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.141
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-03: Version 6.8.140
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.139
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.138
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.137
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.136
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.135
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.134
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.133
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.132
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.131
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.130
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.129
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.128
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.127
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.126
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-02: Version 6.8.125
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-01: Version 6.8.124
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-01: Version 6.8.123
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-01: Version 6.8.122
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-01: Version 6.8.121
-
-        Performance and stability improvements on all platforms.
-
-
-2018-05-01: Version 6.8.120
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-30: Version 6.8.119
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-30: Version 6.8.118
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-30: Version 6.8.117
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-30: Version 6.8.116
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-30: Version 6.8.115
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-30: Version 6.8.114
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-30: Version 6.8.113
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-30: Version 6.8.112
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-30: Version 6.8.111
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-30: Version 6.8.110
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-30: Version 6.8.109
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-30: Version 6.8.108
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-30: Version 6.8.107
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-29: Version 6.8.106
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.105
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.104
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.103
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.102
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.101
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.100
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.99
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.98
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.97
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.96
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.95
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.94
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.93
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.92
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.91
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.90
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.89
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.88
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.87
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.86
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.85
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.84
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.83
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.82
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.81
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.80
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-27: Version 6.8.79
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-26: Version 6.8.78
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-26: Version 6.8.77
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-26: Version 6.8.76
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-26: Version 6.8.75
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-25: Version 6.8.74
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-25: Version 6.8.73
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-25: Version 6.8.72
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-25: Version 6.8.71
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-25: Version 6.8.70
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-25: Version 6.8.69
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-25: Version 6.8.68
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-25: Version 6.8.67
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-24: Version 6.8.66
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-24: Version 6.8.65
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-24: Version 6.8.64
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-23: Version 6.8.63
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-23: Version 6.8.62
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-23: Version 6.8.61
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-23: Version 6.8.60
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-23: Version 6.8.59
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-23: Version 6.8.58
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-23: Version 6.8.57
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-23: Version 6.8.56
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-23: Version 6.8.55
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-23: Version 6.8.54
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-23: Version 6.8.53
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-23: Version 6.8.52
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-23: Version 6.8.51
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-20: Version 6.8.50
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-20: Version 6.8.49
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-20: Version 6.8.48
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-20: Version 6.8.47
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-20: Version 6.8.46
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-19: Version 6.8.45
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-19: Version 6.8.44
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-19: Version 6.8.43
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-19: Version 6.8.42
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-19: Version 6.8.41
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-18: Version 6.8.40
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-18: Version 6.8.39
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-18: Version 6.8.38
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-18: Version 6.8.37
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-18: Version 6.8.36
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-17: Version 6.8.35
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-17: Version 6.8.34
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-17: Version 6.8.33
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-17: Version 6.8.32
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-17: Version 6.8.31
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-17: Version 6.8.30
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-17: Version 6.8.29
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-17: Version 6.8.28
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-17: Version 6.8.27
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-17: Version 6.8.26
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-17: Version 6.8.25
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.24
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.23
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.22
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.21
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.20
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.19
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.18
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.17
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.16
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.15
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.14
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.13
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.12
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.11
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.10
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-16: Version 6.8.9
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-15: Version 6.8.8
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-15: Version 6.8.7
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-14: Version 6.8.6
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-14: Version 6.8.5
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-13: Version 6.8.4
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-13: Version 6.8.3
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-12: Version 6.8.2
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-12: Version 6.8.1
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-11: Version 6.7.290
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-11: Version 6.7.289
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-11: Version 6.7.288
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-11: Version 6.7.287
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-11: Version 6.7.286
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-11: Version 6.7.285
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-11: Version 6.7.284
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.283
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.282
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.281
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.280
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.279
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.278
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.277
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.276
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.275
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.274
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.273
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.272
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.271
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.270
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.269
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.268
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.267
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.266
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.265
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.264
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.263
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.262
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.261
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.260
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.259
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.258
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.257
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.256
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.255
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.254
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.253
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.252
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.251
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.250
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.249
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.248
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.247
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.246
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.245
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.244
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.243
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.242
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.241
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.240
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.239
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.238
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.237
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.236
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.235
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.234
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.233
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.232
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.231
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.230
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.229
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.228
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.227
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.226
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.225
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.224
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.223
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.222
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.221
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.220
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.219
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.218
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.217
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.216
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-03: Version 6.7.215
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-03: Version 6.7.214
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-30: Version 6.7.213
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-30: Version 6.7.212
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.211
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.210
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.209
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.208
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.207
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.206
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.205
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.204
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.203
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.202
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.201
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.200
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.199
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.198
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.197
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.196
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.195
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.194
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.193
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.192
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.191
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.190
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.189
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.188
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.187
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.186
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.185
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.184
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.183
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.182
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.181
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.180
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.179
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.178
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.177
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.176
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.175
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.174
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.173
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.172
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.171
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.170
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.169
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.168
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.167
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.166
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-24: Version 6.7.165
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-24: Version 6.7.164
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-24: Version 6.7.163
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.162
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.161
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.160
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.159
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.158
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.157
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.156
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.155
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.154
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.153
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.152
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.151
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.150
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.149
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.148
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.147
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.146
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.145
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.144
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.143
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.142
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.141
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.140
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.139
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.138
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.137
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.136
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.135
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.134
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.133
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.132
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.131
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.130
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.129
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.128
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.127
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.126
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.125
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.124
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.123
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.122
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.121
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.120
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.119
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.118
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.117
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.116
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.115
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.114
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.113
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.112
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.111
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.110
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.109
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.108
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.107
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.106
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.105
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.104
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.103
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-17: Version 6.7.102
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.101
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.100
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.99
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.98
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.97
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.96
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.95
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.94
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.93
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.92
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.91
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.90
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.89
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.88
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.87
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.86
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.85
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.84
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.83
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.82
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.81
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.80
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.79
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.78
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.77
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.76
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.75
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.74
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.73
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.72
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.71
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.70
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.69
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.68
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.67
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.66
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.65
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.64
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.63
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.62
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.61
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.60
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.59
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.58
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.57
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.56
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.55
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.54
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.53
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.52
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.51
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.50
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.49
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.48
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.47
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.46
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.45
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.44
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.43
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.42
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.41
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.40
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.39
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.38
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.37
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.36
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.35
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.34
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.33
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.32
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-10: Version 6.7.31
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-09: Version 6.7.30
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-09: Version 6.7.29
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-08: Version 6.7.28
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-08: Version 6.7.27
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-08: Version 6.7.26
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-07: Version 6.7.25
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-07: Version 6.7.24
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-07: Version 6.7.23
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.22
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.21
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.20
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.19
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.18
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.17
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.16
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.15
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.14
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.13
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.12
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.11
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.10
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.9
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.8
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.7
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.6
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.5
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.4
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.3
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.2
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.1
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-01: Version 6.6.356
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.355
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.354
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.353
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.352
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.351
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.350
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.349
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.348
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.347
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.346
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.345
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.344
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.343
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.342
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.341
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.340
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.339
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.338
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.337
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.336
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.335
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.334
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.333
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.332
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.331
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.330
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.329
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.328
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.327
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.326
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.325
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.324
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.323
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.322
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.321
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.320
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.319
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-25: Version 6.6.318
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-25: Version 6.6.317
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-25: Version 6.6.316
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-25: Version 6.6.315
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-24: Version 6.6.314
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-24: Version 6.6.313
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.312
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.311
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.310
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.309
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.308
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.307
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.306
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.305
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.304
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.303
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.302
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.301
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.300
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.299
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.298
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.297
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.296
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.295
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.294
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.293
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.292
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.291
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.290
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.289
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.288
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.287
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.286
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.285
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.284
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.283
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-21: Version 6.6.282
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-21: Version 6.6.281
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-21: Version 6.6.280
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.279
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.278
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.277
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.276
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.275
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.274
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.273
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.272
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.271
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.270
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.269
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.268
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.267
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-19: Version 6.6.266
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-19: Version 6.6.265
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-19: Version 6.6.264
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-19: Version 6.6.263
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-19: Version 6.6.262
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-19: Version 6.6.261
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-17: Version 6.6.260
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-17: Version 6.6.259
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-16: Version 6.6.258
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-16: Version 6.6.257
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-16: Version 6.6.256
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-16: Version 6.6.255
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-15: Version 6.6.254
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-15: Version 6.6.253
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-15: Version 6.6.252
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.251
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.250
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.249
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.248
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.247
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.246
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.245
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.244
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.243
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.242
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.241
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.240
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-13: Version 6.6.239
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-13: Version 6.6.238
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-13: Version 6.6.237
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-13: Version 6.6.236
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-13: Version 6.6.235
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-13: Version 6.6.234
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-12: Version 6.6.233
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-12: Version 6.6.232
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-12: Version 6.6.231
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-12: Version 6.6.230
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-12: Version 6.6.229
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.228
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.227
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.226
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.225
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.224
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.223
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.222
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.221
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.220
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.219
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.218
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.217
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.216
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.215
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.214
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.213
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.212
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.211
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.210
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.209
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.208
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.207
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.206
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.205
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.204
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.203
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.202
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.201
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.200
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.199
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.198
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.197
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.196
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.195
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.194
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.193
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.192
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.191
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.190
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.189
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.188
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.187
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.186
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.185
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.184
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.183
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.182
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.181
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.180
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.179
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.178
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.177
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.176
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.175
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.174
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.173
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.172
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.171
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.170
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.169
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.168
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.167
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.166
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.165
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.164
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.163
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.162
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.161
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.160
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.159
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.158
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.157
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.156
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.155
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.154
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.153
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.152
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.151
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.150
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.149
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.148
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.147
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.146
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.145
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.144
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.143
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.142
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.141
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.140
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.139
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.138
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.137
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.136
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.135
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.134
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.133
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.132
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.131
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.130
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.129
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.128
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.127
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.126
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.125
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.124
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.123
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.122
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.121
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.120
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.119
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.118
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.117
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.116
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.115
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.114
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.113
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.112
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.111
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.110
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.109
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.108
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.107
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.106
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.105
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.104
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.103
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.102
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.101
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.100
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.99
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.98
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.97
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.96
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.95
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.94
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.93
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.92
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.91
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-27: Version 6.6.90
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-27: Version 6.6.89
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-26: Version 6.6.88
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-26: Version 6.6.87
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-26: Version 6.6.86
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-26: Version 6.6.85
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-26: Version 6.6.84
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-26: Version 6.6.83
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.82
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.81
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.80
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.79
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.78
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.77
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.76
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.75
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.74
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.73
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.72
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.71
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.70
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.69
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.68
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.67
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.66
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.65
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.64
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.63
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.62
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.61
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.60
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.59
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.58
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.57
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.56
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.55
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.54
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.53
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.52
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.51
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.50
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.49
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.48
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.47
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.46
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.45
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.44
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.43
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.42
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.41
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.40
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.39
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.38
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.37
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.36
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.35
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.34
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.33
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.32
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.31
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.30
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.29
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.28
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.27
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.26
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.25
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.24
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.23
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.22
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.21
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.20
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.19
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.18
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.17
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.16
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.15
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.14
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.13
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.12
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-21: Version 6.6.11
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-20: Version 6.6.10
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-20: Version 6.6.9
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.8
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.7
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.6
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.5
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.4
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.3
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.2
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.1
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-18: Version 6.5.257
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-18: Version 6.5.256
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-18: Version 6.5.255
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.254
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.253
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.252
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.251
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.250
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.249
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.248
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.247
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.246
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.245
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.244
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.243
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.242
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.241
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.240
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.239
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.238
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.237
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.236
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.235
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.234
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.233
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.232
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.231
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.230
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.229
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.228
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.227
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.226
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.225
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.224
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.223
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.222
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.221
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.220
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.219
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.218
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.217
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.216
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.215
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.214
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.213
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.212
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.211
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.210
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.209
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.208
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.207
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.206
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.205
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.204
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.203
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.202
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.201
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.200
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.199
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-14: Version 6.5.198
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-13: Version 6.5.197
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.196
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.195
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.194
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.193
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.192
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.191
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.190
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.189
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.188
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.187
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.186
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.185
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.184
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.183
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.182
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.181
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.180
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.179
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.178
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.177
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.176
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.175
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.174
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.173
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.172
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.171
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.170
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.169
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.168
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.167
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.166
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.165
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.164
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.163
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.162
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.161
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.160
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.159
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.158
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.157
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.156
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.155
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.154
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.153
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.152
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.151
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-08: Version 6.5.150
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-08: Version 6.5.149
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-08: Version 6.5.148
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-08: Version 6.5.147
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.146
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.145
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.144
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.143
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.142
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.141
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.140
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.139
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.138
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.137
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.136
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.135
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.134
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.133
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.132
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.131
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.130
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.129
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.128
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.127
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.126
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-03: Version 6.5.125
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-03: Version 6.5.124
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.123
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.122
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.121
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.120
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.119
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.118
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.117
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-29: Version 6.5.116
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-29: Version 6.5.115
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-29: Version 6.5.114
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-29: Version 6.5.113
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-29: Version 6.5.112
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-29: Version 6.5.111
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-28: Version 6.5.110
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-28: Version 6.5.109
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-27: Version 6.5.108
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-22: Version 6.5.107
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-22: Version 6.5.106
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-22: Version 6.5.105
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-22: Version 6.5.104
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-21: Version 6.5.103
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-21: Version 6.5.102
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.101
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.100
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.99
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.98
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.97
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.96
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.95
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.94
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.93
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.92
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.91
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.90
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.89
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.88
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.87
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.86
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.85
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.84
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.83
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.82
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.81
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.80
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.79
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.78
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.77
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-18: Version 6.5.76
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-18: Version 6.5.75
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-18: Version 6.5.74
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-16: Version 6.5.73
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-15: Version 6.5.72
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-15: Version 6.5.71
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-15: Version 6.5.70
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-14: Version 6.5.69
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-14: Version 6.5.68
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-13: Version 6.5.67
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-13: Version 6.5.66
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-13: Version 6.5.65
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-12: Version 6.5.64
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-12: Version 6.5.63
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-12: Version 6.5.62
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-12: Version 6.5.61
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-12: Version 6.5.60
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-12: Version 6.5.59
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-12: Version 6.5.58
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-12: Version 6.5.57
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-12: Version 6.5.56
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-12: Version 6.5.55
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-12: Version 6.5.54
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-12: Version 6.5.53
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-11: Version 6.5.52
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-11: Version 6.5.51
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-11: Version 6.5.50
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-11: Version 6.5.49
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-11: Version 6.5.48
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-11: Version 6.5.47
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-11: Version 6.5.46
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-11: Version 6.5.45
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-11: Version 6.5.44
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-11: Version 6.5.43
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-11: Version 6.5.42
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-10: Version 6.5.41
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-10: Version 6.5.40
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-09: Version 6.5.39
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-09: Version 6.5.38
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-08: Version 6.5.37
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-08: Version 6.5.36
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-08: Version 6.5.35
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-08: Version 6.5.34
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-08: Version 6.5.33
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-08: Version 6.5.32
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-08: Version 6.5.31
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-08: Version 6.5.30
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-08: Version 6.5.29
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-08: Version 6.5.28
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-08: Version 6.5.27
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-07: Version 6.5.26
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-07: Version 6.5.25
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-07: Version 6.5.24
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-07: Version 6.5.23
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-07: Version 6.5.22
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-07: Version 6.5.21
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-07: Version 6.5.20
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-07: Version 6.5.19
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-07: Version 6.5.18
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-07: Version 6.5.17
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-07: Version 6.5.16
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-07: Version 6.5.15
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-06: Version 6.5.14
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-06: Version 6.5.13
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-05: Version 6.5.12
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-05: Version 6.5.11
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-05: Version 6.5.10
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-05: Version 6.5.9
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-05: Version 6.5.8
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-04: Version 6.5.7
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-04: Version 6.5.6
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-04: Version 6.5.5
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-04: Version 6.5.4
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-04: Version 6.5.3
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-04: Version 6.5.2
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-03: Version 6.5.1
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-30: Version 6.4.394
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-30: Version 6.4.393
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-29: Version 6.4.392
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-29: Version 6.4.391
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-29: Version 6.4.390
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-29: Version 6.4.389
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-29: Version 6.4.388
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-29: Version 6.4.387
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-29: Version 6.4.386
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-29: Version 6.4.385
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-29: Version 6.4.384
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-28: Version 6.4.383
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-28: Version 6.4.382
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-28: Version 6.4.381
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-28: Version 6.4.380
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-28: Version 6.4.379
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-28: Version 6.4.378
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-28: Version 6.4.377
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-27: Version 6.4.376
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-27: Version 6.4.375
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-27: Version 6.4.374
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-27: Version 6.4.373
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-27: Version 6.4.372
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-27: Version 6.4.371
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-24: Version 6.4.370
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-24: Version 6.4.369
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-24: Version 6.4.368
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-24: Version 6.4.367
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-24: Version 6.4.366
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-23: Version 6.4.365
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-23: Version 6.4.364
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-23: Version 6.4.363
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-23: Version 6.4.362
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-23: Version 6.4.361
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-23: Version 6.4.360
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-23: Version 6.4.359
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-22: Version 6.4.358
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-22: Version 6.4.357
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-22: Version 6.4.356
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-22: Version 6.4.355
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-22: Version 6.4.354
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-22: Version 6.4.353
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-22: Version 6.4.352
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-21: Version 6.4.351
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-21: Version 6.4.350
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-21: Version 6.4.349
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-21: Version 6.4.348
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-21: Version 6.4.347
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-21: Version 6.4.346
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-21: Version 6.4.345
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-20: Version 6.4.344
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-20: Version 6.4.343
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-20: Version 6.4.342
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-20: Version 6.4.341
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-20: Version 6.4.340
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-20: Version 6.4.339
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-20: Version 6.4.338
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-20: Version 6.4.337
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-20: Version 6.4.336
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-20: Version 6.4.335
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-20: Version 6.4.334
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-20: Version 6.4.333
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-19: Version 6.4.332
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-18: Version 6.4.331
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-17: Version 6.4.330
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-17: Version 6.4.329
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-17: Version 6.4.328
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-17: Version 6.4.327
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-17: Version 6.4.326
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-17: Version 6.4.325
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-17: Version 6.4.324
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-17: Version 6.4.323
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-17: Version 6.4.322
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-17: Version 6.4.321
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-17: Version 6.4.320
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-17: Version 6.4.319
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-16: Version 6.4.318
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-16: Version 6.4.317
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-16: Version 6.4.316
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-16: Version 6.4.315
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-16: Version 6.4.314
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-16: Version 6.4.313
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-16: Version 6.4.312
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-16: Version 6.4.311
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-16: Version 6.4.310
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-16: Version 6.4.309
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-16: Version 6.4.308
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-15: Version 6.4.307
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-15: Version 6.4.306
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-15: Version 6.4.305
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-15: Version 6.4.304
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-15: Version 6.4.303
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.302
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.301
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.300
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.299
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.298
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.297
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.296
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.295
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.294
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.293
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.292
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.291
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.290
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.289
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-14: Version 6.4.288
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-13: Version 6.4.287
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-13: Version 6.4.286
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-13: Version 6.4.285
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-13: Version 6.4.284
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-13: Version 6.4.283
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-13: Version 6.4.282
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-13: Version 6.4.281
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-13: Version 6.4.280
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-13: Version 6.4.279
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-13: Version 6.4.278
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-13: Version 6.4.277
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-13: Version 6.4.276
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-10: Version 6.4.275
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-10: Version 6.4.274
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-10: Version 6.4.273
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-10: Version 6.4.272
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-10: Version 6.4.271
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-10: Version 6.4.270
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-10: Version 6.4.269
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.268
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.267
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.266
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.265
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.264
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.263
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.262
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.261
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.260
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.259
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.258
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.257
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.256
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.255
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.254
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-09: Version 6.4.253
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-08: Version 6.4.252
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-08: Version 6.4.251
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-08: Version 6.4.250
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-08: Version 6.4.249
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-08: Version 6.4.248
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-08: Version 6.4.247
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-08: Version 6.4.246
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-08: Version 6.4.245
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-08: Version 6.4.244
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-08: Version 6.4.243
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-08: Version 6.4.242
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-08: Version 6.4.241
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.240
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.239
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.238
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.237
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.236
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.235
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.234
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.233
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.232
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.231
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.230
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.229
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.228
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.227
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.226
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.225
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-07: Version 6.4.224
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-06: Version 6.4.223
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-06: Version 6.4.222
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-06: Version 6.4.221
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-06: Version 6.4.220
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-06: Version 6.4.219
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-06: Version 6.4.218
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-06: Version 6.4.217
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-06: Version 6.4.216
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-05: Version 6.4.215
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-04: Version 6.4.214
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-04: Version 6.4.213
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-04: Version 6.4.212
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.211
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.210
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.209
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.208
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.207
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.206
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.205
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.204
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.203
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.202
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.201
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.200
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.199
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.198
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.197
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-03: Version 6.4.196
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-02: Version 6.4.195
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-02: Version 6.4.194
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-02: Version 6.4.193
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-02: Version 6.4.192
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-02: Version 6.4.191
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-02: Version 6.4.190
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-02: Version 6.4.189
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-02: Version 6.4.188
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-02: Version 6.4.187
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-02: Version 6.4.186
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-01: Version 6.4.185
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-01: Version 6.4.184
-
-        Performance and stability improvements on all platforms.
-
-
-2017-11-01: Version 6.4.183
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-31: Version 6.4.182
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-31: Version 6.4.181
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-31: Version 6.4.180
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-31: Version 6.4.179
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-31: Version 6.4.178
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-31: Version 6.4.177
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-31: Version 6.4.176
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-31: Version 6.4.175
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-31: Version 6.4.174
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-31: Version 6.4.173
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-31: Version 6.4.172
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-30: Version 6.4.171
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-30: Version 6.4.170
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-30: Version 6.4.169
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-30: Version 6.4.168
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-30: Version 6.4.167
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-30: Version 6.4.166
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-30: Version 6.4.165
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-30: Version 6.4.164
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-30: Version 6.4.163
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-30: Version 6.4.162
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-30: Version 6.4.161
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-30: Version 6.4.160
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-30: Version 6.4.159
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-27: Version 6.4.158
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-27: Version 6.4.157
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-27: Version 6.4.156
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-27: Version 6.4.155
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-27: Version 6.4.154
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-27: Version 6.4.153
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-27: Version 6.4.152
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-27: Version 6.4.151
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-27: Version 6.4.150
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-27: Version 6.4.149
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-27: Version 6.4.148
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.147
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.146
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.145
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.144
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.143
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.142
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.141
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.140
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.139
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.138
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.137
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.136
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.135
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-26: Version 6.4.134
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.133
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.132
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.131
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.130
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.129
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.128
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.127
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.126
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.125
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.124
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.123
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.122
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.121
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.120
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.119
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.118
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.117
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.116
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.115
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.114
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.113
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.112
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-25: Version 6.4.111
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.110
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.109
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.108
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.107
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.106
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.105
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.104
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.103
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.102
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.101
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.100
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.99
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.98
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-24: Version 6.4.97
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.96
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.95
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.94
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.93
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.92
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.91
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.90
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.89
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.88
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.87
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.86
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.85
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.84
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.83
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.82
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.81
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.80
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-23: Version 6.4.79
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-22: Version 6.4.78
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-21: Version 6.4.77
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-21: Version 6.4.76
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.75
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.74
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.73
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.72
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.71
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.70
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.69
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.68
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.67
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.66
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.65
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.64
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.63
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.62
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-20: Version 6.4.61
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.60
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.59
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.58
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.57
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.56
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.55
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.54
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.53
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.52
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.51
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.50
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.49
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.48
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.47
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.46
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-19: Version 6.4.45
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-18: Version 6.4.44
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-18: Version 6.4.43
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-18: Version 6.4.42
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-18: Version 6.4.41
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-18: Version 6.4.40
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-18: Version 6.4.39
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-18: Version 6.4.38
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-18: Version 6.4.37
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-18: Version 6.4.36
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-18: Version 6.4.35
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-17: Version 6.4.34
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-17: Version 6.4.33
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-17: Version 6.4.32
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-17: Version 6.4.31
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-17: Version 6.4.30
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-17: Version 6.4.29
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-17: Version 6.4.28
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-17: Version 6.4.27
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-17: Version 6.4.26
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-17: Version 6.4.25
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-17: Version 6.4.24
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-17: Version 6.4.23
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-17: Version 6.4.22
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-16: Version 6.4.21
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-16: Version 6.4.20
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-16: Version 6.4.19
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-16: Version 6.4.18
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-16: Version 6.4.17
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-16: Version 6.4.16
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-16: Version 6.4.15
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-16: Version 6.4.14
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-16: Version 6.4.13
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-16: Version 6.4.12
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-16: Version 6.4.11
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-15: Version 6.4.10
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-15: Version 6.4.9
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-14: Version 6.4.8
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-14: Version 6.4.7
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-13: Version 6.4.6
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-13: Version 6.4.5
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-13: Version 6.4.4
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-13: Version 6.4.3
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-13: Version 6.4.2
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-13: Version 6.4.1
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-12: Version 6.3.298
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-12: Version 6.3.297
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-11: Version 6.3.296
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-11: Version 6.3.295
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-11: Version 6.3.294
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-11: Version 6.3.293
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-10: Version 6.3.292
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-10: Version 6.3.291
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-10: Version 6.3.290
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-10: Version 6.3.289
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-09: Version 6.3.288
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-09: Version 6.3.287
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-09: Version 6.3.286
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-09: Version 6.3.285
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-09: Version 6.3.284
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-09: Version 6.3.283
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-09: Version 6.3.282
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-09: Version 6.3.281
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-09: Version 6.3.280
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-09: Version 6.3.279
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-09: Version 6.3.278
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-09: Version 6.3.277
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-09: Version 6.3.276
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-08: Version 6.3.275
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-07: Version 6.3.274
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-06: Version 6.3.273
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-06: Version 6.3.272
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-06: Version 6.3.271
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-06: Version 6.3.270
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-06: Version 6.3.269
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-06: Version 6.3.268
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-06: Version 6.3.267
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-05: Version 6.3.266
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-05: Version 6.3.265
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-05: Version 6.3.264
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-05: Version 6.3.263
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-05: Version 6.3.262
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-05: Version 6.3.261
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-05: Version 6.3.260
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-05: Version 6.3.259
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-05: Version 6.3.258
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-04: Version 6.3.257
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-04: Version 6.3.256
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-04: Version 6.3.255
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-04: Version 6.3.254
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-04: Version 6.3.253
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-03: Version 6.3.252
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-03: Version 6.3.251
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-03: Version 6.3.250
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-02: Version 6.3.249
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-02: Version 6.3.248
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-02: Version 6.3.247
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-02: Version 6.3.246
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-02: Version 6.3.245
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-02: Version 6.3.244
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-02: Version 6.3.243
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-02: Version 6.3.242
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-02: Version 6.3.241
-
-        Performance and stability improvements on all platforms.
-
-
-2017-10-01: Version 6.3.240
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-29: Version 6.3.239
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-29: Version 6.3.238
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-29: Version 6.3.237
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-29: Version 6.3.236
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-29: Version 6.3.235
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-29: Version 6.3.234
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-29: Version 6.3.233
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-29: Version 6.3.232
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-29: Version 6.3.231
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-29: Version 6.3.230
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-29: Version 6.3.229
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-29: Version 6.3.228
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-29: Version 6.3.227
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-28: Version 6.3.226
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-28: Version 6.3.225
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-28: Version 6.3.224
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-28: Version 6.3.223
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-28: Version 6.3.222
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-27: Version 6.3.221
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-27: Version 6.3.220
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-27: Version 6.3.219
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-27: Version 6.3.218
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-27: Version 6.3.217
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-26: Version 6.3.216
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-26: Version 6.3.215
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-26: Version 6.3.214
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-26: Version 6.3.213
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-25: Version 6.3.212
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-25: Version 6.3.211
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-25: Version 6.3.210
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-25: Version 6.3.209
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-25: Version 6.3.208
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-25: Version 6.3.207
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-25: Version 6.3.206
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-25: Version 6.3.205
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-25: Version 6.3.204
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-25: Version 6.3.203
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-25: Version 6.3.202
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-25: Version 6.3.201
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-24: Version 6.3.200
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-24: Version 6.3.199
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-22: Version 6.3.198
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-22: Version 6.3.197
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-21: Version 6.3.196
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-21: Version 6.3.195
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-21: Version 6.3.194
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-21: Version 6.3.193
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-21: Version 6.3.192
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-21: Version 6.3.191
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-21: Version 6.3.190
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-21: Version 6.3.189
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-21: Version 6.3.188
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-21: Version 6.3.187
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-21: Version 6.3.186
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-21: Version 6.3.185
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-20: Version 6.3.184
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-20: Version 6.3.183
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-20: Version 6.3.182
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-19: Version 6.3.181
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-19: Version 6.3.180
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.179
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.178
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.177
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.176
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.175
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.174
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.173
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.172
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.171
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.170
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.169
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.168
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.167
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.166
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-18: Version 6.3.165
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-17: Version 6.3.164
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-16: Version 6.3.163
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-15: Version 6.3.162
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-15: Version 6.3.161
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-15: Version 6.3.160
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-15: Version 6.3.159
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-15: Version 6.3.158
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-15: Version 6.3.157
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-15: Version 6.3.156
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-15: Version 6.3.155
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-15: Version 6.3.154
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-15: Version 6.3.153
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-15: Version 6.3.152
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-15: Version 6.3.151
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-14: Version 6.3.150
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-14: Version 6.3.149
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-14: Version 6.3.148
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-14: Version 6.3.147
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-14: Version 6.3.146
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-14: Version 6.3.145
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-14: Version 6.3.144
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-14: Version 6.3.143
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-14: Version 6.3.142
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-14: Version 6.3.141
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-14: Version 6.3.140
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-14: Version 6.3.139
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-13: Version 6.3.138
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-13: Version 6.3.137
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-13: Version 6.3.136
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-13: Version 6.3.135
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-13: Version 6.3.134
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-13: Version 6.3.133
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-13: Version 6.3.132
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-13: Version 6.3.131
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-13: Version 6.3.130
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-13: Version 6.3.129
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-13: Version 6.3.128
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-13: Version 6.3.127
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.126
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.125
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.124
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.123
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.122
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.121
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.120
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.119
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.118
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.117
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.116
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.115
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.114
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.113
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.112
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-12: Version 6.3.111
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.110
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.109
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.108
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.107
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.106
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.105
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.104
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.103
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.102
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.101
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.100
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.99
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.98
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.97
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.96
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.95
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.94
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-11: Version 6.3.93
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-10: Version 6.3.92
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-09: Version 6.3.91
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.90
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.89
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.88
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.87
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.86
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.85
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.84
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.83
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.82
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.81
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.80
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.79
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.78
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.77
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.76
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.75
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-08: Version 6.3.74
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.73
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.72
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.71
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.70
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.69
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.68
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.67
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.66
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.65
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.64
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.63
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.62
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.61
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.60
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.59
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.58
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.57
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.56
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.55
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-07: Version 6.3.54
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-06: Version 6.3.53
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-06: Version 6.3.52
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-06: Version 6.3.51
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-06: Version 6.3.50
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-06: Version 6.3.49
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-06: Version 6.3.48
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-06: Version 6.3.47
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-06: Version 6.3.46
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-06: Version 6.3.45
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-06: Version 6.3.44
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-06: Version 6.3.43
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-06: Version 6.3.42
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-05: Version 6.3.41
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-05: Version 6.3.40
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-05: Version 6.3.39
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-05: Version 6.3.38
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-05: Version 6.3.37
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-05: Version 6.3.36
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-05: Version 6.3.35
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-05: Version 6.3.34
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-05: Version 6.3.33
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-05: Version 6.3.32
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-05: Version 6.3.31
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-05: Version 6.3.30
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-05: Version 6.3.29
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.28
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.27
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.26
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.25
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.24
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.23
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.22
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.21
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.20
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.19
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.18
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.17
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.16
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.15
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.14
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.13
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.12
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.11
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.10
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.9
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.8
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.7
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.6
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-04: Version 6.3.5
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-03: Version 6.3.4
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-03: Version 6.3.3
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-01: Version 6.3.2
-
-        Performance and stability improvements on all platforms.
-
-
-2017-09-01: Version 6.3.1
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-31: Version 6.2.441
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-31: Version 6.2.440
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-31: Version 6.2.439
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.438
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.437
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.436
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.435
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.434
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.433
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.432
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.431
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.430
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.429
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.428
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.427
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.426
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.425
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.424
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.423
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.422
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.421
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.420
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.419
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-30: Version 6.2.418
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.417
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.416
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.415
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.414
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.413
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.412
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.411
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.410
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.409
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.408
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.407
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.406
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.405
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.404
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.403
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.402
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.401
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.400
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-29: Version 6.2.399
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.398
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.397
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.396
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.395
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.394
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.393
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.392
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.391
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.390
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.389
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.388
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.387
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.386
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.385
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.384
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.383
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.382
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.381
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.380
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-28: Version 6.2.379
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-27: Version 6.2.378
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.377
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.376
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.375
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.374
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.373
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.372
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.371
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.370
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.369
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.368
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.367
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.366
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.365
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-25: Version 6.2.364
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-24: Version 6.2.363
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-24: Version 6.2.362
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-24: Version 6.2.361
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-24: Version 6.2.360
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-24: Version 6.2.359
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-24: Version 6.2.358
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-24: Version 6.2.357
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-24: Version 6.2.356
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.355
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.354
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.353
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.352
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.351
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.350
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.349
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.348
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.347
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.346
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.345
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.344
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.343
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.342
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.341
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.340
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.339
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-23: Version 6.2.338
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.337
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.336
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.335
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.334
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.333
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.332
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.331
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.330
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.329
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.328
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.327
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.326
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.325
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-22: Version 6.2.324
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.323
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.322
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.321
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.320
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.319
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.318
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.317
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.316
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.315
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.314
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.313
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.312
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.311
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.310
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.309
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.308
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.307
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.306
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.305
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-21: Version 6.2.304
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-20: Version 6.2.303
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-19: Version 6.2.302
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-19: Version 6.2.301
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-19: Version 6.2.300
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-19: Version 6.2.299
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-19: Version 6.2.298
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-19: Version 6.2.297
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.296
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.295
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.294
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.293
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.292
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.291
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.290
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.289
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.288
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.287
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.286
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.285
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.284
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.283
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-18: Version 6.2.282
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-17: Version 6.2.281
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-17: Version 6.2.280
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-17: Version 6.2.279
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-17: Version 6.2.278
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-17: Version 6.2.277
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-17: Version 6.2.276
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-17: Version 6.2.275
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-17: Version 6.2.274
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-17: Version 6.2.273
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-17: Version 6.2.272
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-17: Version 6.2.271
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-17: Version 6.2.270
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.269
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.268
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.267
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.266
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.265
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.264
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.263
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.262
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.261
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.260
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.259
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.258
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.257
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.256
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.255
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.254
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.253
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.252
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.251
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.250
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-16: Version 6.2.249
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-15: Version 6.2.248
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-15: Version 6.2.247
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-15: Version 6.2.246
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-15: Version 6.2.245
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-15: Version 6.2.244
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-15: Version 6.2.243
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-15: Version 6.2.242
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.241
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.240
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.239
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.238
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.237
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.236
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.235
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.234
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.233
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.232
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.231
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.230
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.229
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.228
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.227
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.226
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.225
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.224
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.223
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.222
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-14: Version 6.2.221
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-13: Version 6.2.220
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-12: Version 6.2.219
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-12: Version 6.2.218
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-11: Version 6.2.217
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-11: Version 6.2.216
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-11: Version 6.2.215
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-11: Version 6.2.214
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-11: Version 6.2.213
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-11: Version 6.2.212
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-11: Version 6.2.211
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-11: Version 6.2.210
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-11: Version 6.2.209
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-11: Version 6.2.208
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-11: Version 6.2.207
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-11: Version 6.2.206
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.205
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.204
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.203
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.202
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.201
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.200
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.199
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.198
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.197
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.196
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.195
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.194
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.193
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.192
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.191
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-10: Version 6.2.190
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.189
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.188
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.187
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.186
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.185
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.184
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.183
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.182
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.181
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.180
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.179
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.178
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.177
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.176
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.175
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.174
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-09: Version 6.2.173
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-08: Version 6.2.172
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-08: Version 6.2.171
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-08: Version 6.2.170
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-08: Version 6.2.169
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-08: Version 6.2.168
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-08: Version 6.2.167
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-08: Version 6.2.166
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-07: Version 6.2.165
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-07: Version 6.2.164
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-07: Version 6.2.163
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-07: Version 6.2.162
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-07: Version 6.2.161
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-07: Version 6.2.160
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-07: Version 6.2.159
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-07: Version 6.2.158
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-07: Version 6.2.157
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-07: Version 6.2.156
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-07: Version 6.2.155
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-07: Version 6.2.154
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-06: Version 6.2.153
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-05: Version 6.2.152
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-04: Version 6.2.151
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-04: Version 6.2.150
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-04: Version 6.2.149
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-04: Version 6.2.148
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-04: Version 6.2.147
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-04: Version 6.2.146
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-03: Version 6.2.145
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-03: Version 6.2.144
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-03: Version 6.2.143
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-03: Version 6.2.142
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-03: Version 6.2.141
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-03: Version 6.2.140
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-03: Version 6.2.139
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-03: Version 6.2.138
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-03: Version 6.2.137
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-03: Version 6.2.136
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-03: Version 6.2.135
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-03: Version 6.2.134
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-03: Version 6.2.133
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-02: Version 6.2.132
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-02: Version 6.2.131
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-02: Version 6.2.130
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-02: Version 6.2.129
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-02: Version 6.2.128
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-02: Version 6.2.127
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-02: Version 6.2.126
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-02: Version 6.2.125
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-02: Version 6.2.124
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-02: Version 6.2.123
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-02: Version 6.2.122
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-02: Version 6.2.121
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-02: Version 6.2.120
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.119
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.118
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.117
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.116
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.115
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.114
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.113
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.112
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.111
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.110
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.109
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.108
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.107
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.106
-
-        Performance and stability improvements on all platforms.
-
-
-2017-08-01: Version 6.2.105
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.104
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.103
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.102
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.101
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.100
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.99
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.98
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.97
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.96
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.95
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.94
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.93
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.92
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.91
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.90
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.89
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.88
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.87
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.86
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-31: Version 6.2.85
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-29: Version 6.2.84
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.83
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.82
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.81
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.80
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.79
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.78
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.77
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.76
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.75
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.74
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.73
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.72
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.71
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.70
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.69
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.68
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.67
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-28: Version 6.2.66
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-27: Version 6.2.65
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-27: Version 6.2.64
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-27: Version 6.2.63
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-27: Version 6.2.62
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-27: Version 6.2.61
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-27: Version 6.2.60
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-27: Version 6.2.59
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-27: Version 6.2.58
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-27: Version 6.2.57
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-27: Version 6.2.56
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-27: Version 6.2.55
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-27: Version 6.2.54
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-27: Version 6.2.53
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-26: Version 6.2.52
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-26: Version 6.2.51
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-26: Version 6.2.50
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-26: Version 6.2.49
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-26: Version 6.2.48
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-26: Version 6.2.47
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-26: Version 6.2.46
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.45
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.44
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.43
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.42
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.41
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.40
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.39
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.38
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.37
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.36
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.35
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.34
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.33
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.32
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.31
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.30
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.29
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.28
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-25: Version 6.2.27
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.26
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.25
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.24
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.23
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.22
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.21
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.20
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.19
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.18
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.17
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.16
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.15
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.14
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.13
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.12
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.11
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.10
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.9
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.8
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.7
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-24: Version 6.2.6
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-23: Version 6.2.5
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-23: Version 6.2.4
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-22: Version 6.2.3
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-21: Version 6.2.2
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-21: Version 6.2.1
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-20: Version 6.1.561
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-20: Version 6.1.560
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-20: Version 6.1.559
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-20: Version 6.1.558
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.557
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.556
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.555
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.554
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.553
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.552
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.551
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.550
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.549
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.548
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.547
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.546
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.545
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.544
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.543
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.542
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.541
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-19: Version 6.1.540
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.539
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.538
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.537
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.536
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.535
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.534
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.533
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.532
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.531
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.530
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.529
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.528
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.527
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.526
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.525
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.524
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.523
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-18: Version 6.1.522
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.521
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.520
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.519
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.518
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.517
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.516
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.515
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.514
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.513
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.512
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.511
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.510
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.509
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.508
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.507
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.506
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.505
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.504
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.503
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.502
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.501
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.500
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.499
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-17: Version 6.1.498
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-16: Version 6.1.497
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.496
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.495
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.494
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.493
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.492
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.491
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.490
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.489
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.488
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.487
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.486
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.485
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.484
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.483
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.482
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.481
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.480
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.479
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-14: Version 6.1.478
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.477
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.476
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.475
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.474
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.473
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.472
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.471
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.470
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.469
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.468
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.467
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.466
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.465
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.464
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.463
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.462
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.461
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-13: Version 6.1.460
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.459
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.458
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.457
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.456
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.455
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.454
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.453
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.452
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.451
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.450
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.449
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.448
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.447
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.446
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.445
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.444
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.443
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.442
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.441
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.440
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.439
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.438
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-12: Version 6.1.437
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.436
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.435
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.434
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.433
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.432
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.431
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.430
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.429
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.428
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.427
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.426
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.425
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.424
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.423
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.422
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.421
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.420
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-11: Version 6.1.419
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.418
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.417
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.416
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.415
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.414
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.413
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.412
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.411
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.410
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.409
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.408
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.407
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.406
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.405
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.404
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.403
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.402
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.401
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.400
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.399
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.398
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.397
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.396
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-10: Version 6.1.395
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.394
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.393
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.392
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.391
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.390
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.389
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.388
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.387
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.386
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.385
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.384
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.383
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.382
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.381
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.380
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.379
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.378
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.377
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.376
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-06: Version 6.1.375
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-05: Version 6.1.374
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-05: Version 6.1.373
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-05: Version 6.1.372
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-05: Version 6.1.371
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-05: Version 6.1.370
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-05: Version 6.1.369
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-05: Version 6.1.368
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-05: Version 6.1.367
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-05: Version 6.1.366
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-05: Version 6.1.365
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-05: Version 6.1.364
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-05: Version 6.1.363
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-04: Version 6.1.362
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-04: Version 6.1.361
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-04: Version 6.1.360
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-04: Version 6.1.359
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-04: Version 6.1.358
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-04: Version 6.1.357
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-03: Version 6.1.356
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-03: Version 6.1.355
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-03: Version 6.1.354
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-03: Version 6.1.353
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-03: Version 6.1.352
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-03: Version 6.1.351
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-03: Version 6.1.350
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-03: Version 6.1.349
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-03: Version 6.1.348
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-03: Version 6.1.347
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-03: Version 6.1.346
-
-        Performance and stability improvements on all platforms.
-
-
-2017-07-03: Version 6.1.345
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.344
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.343
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.342
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.341
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.340
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.339
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.338
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.337
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.336
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.335
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.334
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.333
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.332
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.331
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.330
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-30: Version 6.1.329
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.328
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.327
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.326
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.325
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.324
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.323
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.322
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.321
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.320
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.319
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.318
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.317
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.316
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.315
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.314
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-29: Version 6.1.313
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-28: Version 6.1.312
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-28: Version 6.1.311
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-28: Version 6.1.310
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-28: Version 6.1.309
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-28: Version 6.1.308
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-28: Version 6.1.307
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-28: Version 6.1.306
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-28: Version 6.1.305
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-28: Version 6.1.304
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-28: Version 6.1.303
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-28: Version 6.1.302
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-28: Version 6.1.301
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-28: Version 6.1.300
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-27: Version 6.1.299
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-27: Version 6.1.298
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-27: Version 6.1.297
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-27: Version 6.1.296
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-27: Version 6.1.295
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-27: Version 6.1.294
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.293
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.292
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.291
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.290
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.289
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.288
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.287
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.286
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.285
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.284
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.283
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.282
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.281
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.280
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.279
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.278
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.277
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.276
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.275
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.274
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.273
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.272
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.271
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.270
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.269
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-26: Version 6.1.268
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-24: Version 6.1.267
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.266
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.265
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.264
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.263
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.262
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.261
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.260
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.259
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.258
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.257
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.256
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.255
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.254
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.253
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.252
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.251
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-23: Version 6.1.250
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.249
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.248
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.247
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.246
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.245
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.244
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.243
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.242
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.241
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.240
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.239
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.238
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.237
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.236
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.235
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.234
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.233
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.232
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.231
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.230
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.229
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.228
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.227
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.226
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.225
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.224
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-22: Version 6.1.223
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-21: Version 6.1.222
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-21: Version 6.1.221
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-21: Version 6.1.220
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-21: Version 6.1.219
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-21: Version 6.1.218
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-21: Version 6.1.217
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-21: Version 6.1.216
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-21: Version 6.1.215
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-20: Version 6.1.214
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-20: Version 6.1.213
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-20: Version 6.1.212
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-20: Version 6.1.211
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-20: Version 6.1.210
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-20: Version 6.1.209
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-20: Version 6.1.208
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-20: Version 6.1.207
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-20: Version 6.1.206
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-20: Version 6.1.205
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-20: Version 6.1.204
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-20: Version 6.1.203
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-20: Version 6.1.202
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.201
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.200
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.199
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.198
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.197
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.196
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.195
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.194
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.193
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.192
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.191
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.190
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.189
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-16: Version 6.1.188
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-15: Version 6.1.187
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-15: Version 6.1.186
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-15: Version 6.1.185
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-15: Version 6.1.184
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-15: Version 6.1.183
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-15: Version 6.1.182
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-15: Version 6.1.181
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-15: Version 6.1.180
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-15: Version 6.1.179
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-15: Version 6.1.178
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-14: Version 6.1.177
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-14: Version 6.1.176
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-14: Version 6.1.175
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-14: Version 6.1.174
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-14: Version 6.1.173
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-14: Version 6.1.172
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-14: Version 6.1.171
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-14: Version 6.1.170
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-14: Version 6.1.169
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-14: Version 6.1.168
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-14: Version 6.1.167
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-14: Version 6.1.166
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-14: Version 6.1.165
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.164
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.163
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.162
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.161
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.160
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.159
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.158
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.157
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.156
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.155
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.154
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.153
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.152
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.151
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.150
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-13: Version 6.1.149
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.148
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.147
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.146
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.145
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.144
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.143
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.142
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.141
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.140
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.139
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.138
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.137
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.136
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.135
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.134
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.133
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.132
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.131
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.130
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.129
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.128
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.127
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.126
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.125
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-12: Version 6.1.124
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-11: Version 6.1.123
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-11: Version 6.1.122
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-11: Version 6.1.121
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-09: Version 6.1.120
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-09: Version 6.1.119
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-09: Version 6.1.118
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-09: Version 6.1.117
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-09: Version 6.1.116
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-09: Version 6.1.115
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-09: Version 6.1.114
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-09: Version 6.1.113
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-08: Version 6.1.112
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-08: Version 6.1.111
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-08: Version 6.1.110
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-08: Version 6.1.109
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-08: Version 6.1.108
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-08: Version 6.1.107
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-08: Version 6.1.106
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-08: Version 6.1.105
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-08: Version 6.1.104
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-08: Version 6.1.103
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-08: Version 6.1.102
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.101
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.100
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.99
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.98
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.97
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.96
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.95
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.94
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.93
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.92
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.91
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.90
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.89
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.88
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.87
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.86
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-07: Version 6.1.85
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-06: Version 6.1.84
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-06: Version 6.1.83
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-06: Version 6.1.82
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-06: Version 6.1.81
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-06: Version 6.1.80
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-06: Version 6.1.79
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-06: Version 6.1.78
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-06: Version 6.1.77
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-06: Version 6.1.76
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-06: Version 6.1.75
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-06: Version 6.1.74
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-06: Version 6.1.73
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-05: Version 6.1.72
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-05: Version 6.1.71
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-05: Version 6.1.70
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-05: Version 6.1.69
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-05: Version 6.1.68
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-05: Version 6.1.67
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-05: Version 6.1.66
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-04: Version 6.1.65
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-03: Version 6.1.64
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-02: Version 6.1.63
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-02: Version 6.1.62
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-02: Version 6.1.61
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-02: Version 6.1.60
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-02: Version 6.1.59
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-02: Version 6.1.58
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-01: Version 6.1.57
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-01: Version 6.1.56
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-01: Version 6.1.55
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-01: Version 6.1.54
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-01: Version 6.1.53
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-01: Version 6.1.52
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-01: Version 6.1.51
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-01: Version 6.1.50
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-01: Version 6.1.49
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-01: Version 6.1.48
-
-        Performance and stability improvements on all platforms.
-
-
-2017-06-01: Version 6.1.47
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-31: Version 6.1.46
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-31: Version 6.1.45
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-31: Version 6.1.44
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-31: Version 6.1.43
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-31: Version 6.1.42
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-31: Version 6.1.41
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-31: Version 6.1.40
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-31: Version 6.1.39
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-31: Version 6.1.38
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-31: Version 6.1.37
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-31: Version 6.1.36
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-31: Version 6.1.35
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-31: Version 6.1.34
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-30: Version 6.1.33
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-30: Version 6.1.32
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-30: Version 6.1.31
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-30: Version 6.1.30
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-30: Version 6.1.29
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-30: Version 6.1.28
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-30: Version 6.1.27
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-30: Version 6.1.26
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-30: Version 6.1.25
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-30: Version 6.1.24
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-30: Version 6.1.23
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-30: Version 6.1.22
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-30: Version 6.1.21
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.20
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.19
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.18
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.17
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.16
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.15
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.14
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.13
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.12
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.11
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.10
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.9
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.8
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.7
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.6
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.5
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.4
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.3
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.2
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-29: Version 6.1.1
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-24: Version 6.0.318
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-24: Version 6.0.317
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-23: Version 6.0.316
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-23: Version 6.0.315
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-23: Version 6.0.314
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-23: Version 6.0.313
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-23: Version 6.0.312
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-23: Version 6.0.311
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-23: Version 6.0.310
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-23: Version 6.0.309
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-23: Version 6.0.308
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-23: Version 6.0.307
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-23: Version 6.0.306
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-23: Version 6.0.305
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-23: Version 6.0.304
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.303
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.302
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.301
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.300
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.299
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.298
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.297
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.296
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.295
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.294
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.293
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.292
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.291
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.290
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.289
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-22: Version 6.0.288
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-21: Version 6.0.287
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-20: Version 6.0.286
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.285
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.284
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.283
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.282
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.281
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.280
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.279
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.278
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.277
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.276
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.275
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.274
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.273
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.272
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-19: Version 6.0.271
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.270
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.269
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.268
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.267
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.266
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.265
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.264
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.263
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.262
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.261
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.260
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.259
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.258
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.257
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.256
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.255
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-18: Version 6.0.254
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.253
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.252
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.251
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.250
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.249
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.248
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.247
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.246
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.245
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.244
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.243
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.242
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.241
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-17: Version 6.0.240
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-16: Version 6.0.239
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-16: Version 6.0.238
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-16: Version 6.0.237
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-16: Version 6.0.236
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-16: Version 6.0.235
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-16: Version 6.0.234
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-16: Version 6.0.233
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-16: Version 6.0.232
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-16: Version 6.0.231
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-16: Version 6.0.230
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-16: Version 6.0.229
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-16: Version 6.0.228
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-16: Version 6.0.227
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.226
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.225
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.224
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.223
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.222
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.221
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.220
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.219
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.218
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.217
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.216
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.215
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.214
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.213
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.212
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.211
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.210
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.209
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.208
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-15: Version 6.0.207
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-14: Version 6.0.206
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-13: Version 6.0.205
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-12: Version 6.0.204
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-12: Version 6.0.203
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-12: Version 6.0.202
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-12: Version 6.0.201
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-12: Version 6.0.200
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-12: Version 6.0.199
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-12: Version 6.0.198
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-11: Version 6.0.197
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-11: Version 6.0.196
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-11: Version 6.0.195
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-11: Version 6.0.194
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-11: Version 6.0.193
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-10: Version 6.0.192
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-10: Version 6.0.191
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-10: Version 6.0.190
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-10: Version 6.0.189
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-10: Version 6.0.188
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-09: Version 6.0.187
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-08: Version 6.0.186
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-08: Version 6.0.185
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-08: Version 6.0.184
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-08: Version 6.0.183
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-08: Version 6.0.182
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-08: Version 6.0.181
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-08: Version 6.0.180
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-08: Version 6.0.179
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-08: Version 6.0.178
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-06: Version 6.0.177
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-06: Version 6.0.176
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-06: Version 6.0.175
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.174
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.173
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.172
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.171
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.170
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.169
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.168
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.167
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.166
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.165
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.164
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.163
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.162
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.161
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.160
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.159
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.158
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-05: Version 6.0.157
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-04: Version 6.0.156
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-04: Version 6.0.155
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-04: Version 6.0.154
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-04: Version 6.0.153
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-04: Version 6.0.152
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-04: Version 6.0.151
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-03: Version 6.0.150
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-03: Version 6.0.149
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-03: Version 6.0.148
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-03: Version 6.0.147
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-03: Version 6.0.146
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-03: Version 6.0.145
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-03: Version 6.0.144
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-03: Version 6.0.143
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-03: Version 6.0.142
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-02: Version 6.0.141
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-02: Version 6.0.140
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-02: Version 6.0.139
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-02: Version 6.0.138
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-02: Version 6.0.137
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-02: Version 6.0.136
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-02: Version 6.0.135
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-02: Version 6.0.134
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-02: Version 6.0.133
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-02: Version 6.0.132
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-02: Version 6.0.131
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-02: Version 6.0.130
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-01: Version 6.0.129
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-01: Version 6.0.128
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-01: Version 6.0.127
-
-        Performance and stability improvements on all platforms.
-
-
-2017-05-01: Version 6.0.126
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-30: Version 6.0.125
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-30: Version 6.0.124
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-29: Version 6.0.123
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-29: Version 6.0.122
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-29: Version 6.0.121
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-29: Version 6.0.120
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-29: Version 6.0.119
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-28: Version 6.0.118
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-28: Version 6.0.117
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-28: Version 6.0.116
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-28: Version 6.0.115
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-28: Version 6.0.114
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-28: Version 6.0.113
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-28: Version 6.0.112
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-28: Version 6.0.111
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-28: Version 6.0.110
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-28: Version 6.0.109
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-28: Version 6.0.108
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.107
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.106
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.105
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.104
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.103
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.102
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.101
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.100
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.99
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.98
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.97
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.96
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.95
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.94
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.93
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.92
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-27: Version 6.0.91
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-26: Version 6.0.90
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-26: Version 6.0.89
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-26: Version 6.0.88
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-26: Version 6.0.87
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-26: Version 6.0.86
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-25: Version 6.0.85
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-25: Version 6.0.84
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-25: Version 6.0.83
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-25: Version 6.0.82
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-25: Version 6.0.81
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-25: Version 6.0.80
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.79
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.78
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.77
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.76
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.75
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.74
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.73
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.72
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.71
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.70
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.69
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.68
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.67
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.66
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.65
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.64
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.63
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-24: Version 6.0.62
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-22: Version 6.0.61
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-21: Version 6.0.60
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-21: Version 6.0.59
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-21: Version 6.0.58
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-21: Version 6.0.57
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-21: Version 6.0.56
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-21: Version 6.0.55
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-21: Version 6.0.54
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-21: Version 6.0.53
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-21: Version 6.0.52
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-20: Version 6.0.51
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-20: Version 6.0.50
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-20: Version 6.0.49
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-20: Version 6.0.48
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-20: Version 6.0.47
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-20: Version 6.0.46
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-20: Version 6.0.45
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-20: Version 6.0.44
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-20: Version 6.0.43
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-20: Version 6.0.42
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.41
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.40
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.39
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.38
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.37
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.36
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.35
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.34
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.33
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.32
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.31
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.30
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.29
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.28
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.27
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.26
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.25
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-19: Version 6.0.24
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-18: Version 6.0.23
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-18: Version 6.0.22
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-18: Version 6.0.21
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-18: Version 6.0.20
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-18: Version 6.0.19
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-18: Version 6.0.18
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-18: Version 6.0.17
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-18: Version 6.0.16
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-18: Version 6.0.15
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-18: Version 6.0.14
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-18: Version 6.0.13
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-18: Version 6.0.12
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-18: Version 6.0.11
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-17: Version 6.0.10
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-17: Version 6.0.9
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-17: Version 6.0.8
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-17: Version 6.0.7
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-17: Version 6.0.6
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-17: Version 6.0.5
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-16: Version 6.0.4
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-15: Version 6.0.3
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-15: Version 6.0.2
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-14: Version 6.0.1
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-13: Version 5.9.223
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-13: Version 5.9.222
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-13: Version 5.9.221
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-12: Version 5.9.220
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-12: Version 5.9.219
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-12: Version 5.9.218
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-12: Version 5.9.217
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-12: Version 5.9.216
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-12: Version 5.9.215
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-12: Version 5.9.214
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-12: Version 5.9.213
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-11: Version 5.9.212
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-11: Version 5.9.211
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-11: Version 5.9.210
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-11: Version 5.9.209
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-11: Version 5.9.208
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-11: Version 5.9.207
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-11: Version 5.9.206
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-11: Version 5.9.205
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-11: Version 5.9.204
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-11: Version 5.9.203
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-10: Version 5.9.202
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-10: Version 5.9.201
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-10: Version 5.9.200
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-10: Version 5.9.199
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-10: Version 5.9.198
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-10: Version 5.9.197
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-09: Version 5.9.196
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-08: Version 5.9.195
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-07: Version 5.9.194
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-07: Version 5.9.193
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-07: Version 5.9.192
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-07: Version 5.9.191
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-07: Version 5.9.190
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-07: Version 5.9.189
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-07: Version 5.9.188
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-06: Version 5.9.187
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-06: Version 5.9.186
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-06: Version 5.9.185
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-06: Version 5.9.184
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-06: Version 5.9.183
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-06: Version 5.9.182
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-06: Version 5.9.181
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-06: Version 5.9.180
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-06: Version 5.9.179
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-06: Version 5.9.178
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-06: Version 5.9.177
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-05: Version 5.9.176
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-06: Version 5.9.175
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-05: Version 5.9.174
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-05: Version 5.9.173
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-05: Version 5.9.172
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-05: Version 5.9.171
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-05: Version 5.9.170
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-05: Version 5.9.169
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-05: Version 5.9.168
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-05: Version 5.9.167
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-05: Version 5.9.166
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-04: Version 5.9.165
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-04: Version 5.9.164
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-04: Version 5.9.163
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-04: Version 5.9.162
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-04: Version 5.9.161
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-03: Version 5.9.160
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-03: Version 5.9.159
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-03: Version 5.9.158
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-03: Version 5.9.157
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-03: Version 5.9.156
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-03: Version 5.9.155
-
-        Performance and stability improvements on all platforms.
-
-
-2017-04-01: Version 5.9.154
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-31: Version 5.9.153
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-31: Version 5.9.152
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-31: Version 5.9.151
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-31: Version 5.9.150
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-31: Version 5.9.149
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-31: Version 5.9.148
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-31: Version 5.9.147
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-31: Version 5.9.146
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-31: Version 5.9.145
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-31: Version 5.9.144
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-31: Version 5.9.143
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-30: Version 5.9.142
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-30: Version 5.9.141
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-30: Version 5.9.140
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-30: Version 5.9.139
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-29: Version 5.9.138
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-29: Version 5.9.137
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-29: Version 5.9.136
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-29: Version 5.9.135
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-29: Version 5.9.134
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-29: Version 5.9.133
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-29: Version 5.9.132
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-29: Version 5.9.131
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-29: Version 5.9.130
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-29: Version 5.9.129
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-29: Version 5.9.128
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.127
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.126
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.125
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.124
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.123
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.122
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.121
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.120
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.119
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.118
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.117
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.116
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.115
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.114
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.113
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.112
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.111
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-28: Version 5.9.110
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-27: Version 5.9.109
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-27: Version 5.9.108
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-27: Version 5.9.107
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-27: Version 5.9.106
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-27: Version 5.9.105
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-27: Version 5.9.104
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-27: Version 5.9.103
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-27: Version 5.9.102
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-27: Version 5.9.101
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-27: Version 5.9.100
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-27: Version 5.9.99
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-26: Version 5.9.98
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-24: Version 5.9.97
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-24: Version 5.9.96
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-24: Version 5.9.95
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-24: Version 5.9.94
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-24: Version 5.9.93
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-24: Version 5.9.92
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-24: Version 5.9.91
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-23: Version 5.9.90
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-23: Version 5.9.89
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-23: Version 5.9.88
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-23: Version 5.9.87
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-23: Version 5.9.86
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-23: Version 5.9.85
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-23: Version 5.9.84
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-23: Version 5.9.83
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-23: Version 5.9.82
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-23: Version 5.9.81
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-22: Version 5.9.80
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-22: Version 5.9.79
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-22: Version 5.9.78
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-22: Version 5.9.77
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-22: Version 5.9.76
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-22: Version 5.9.75
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-22: Version 5.9.74
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-22: Version 5.9.73
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-22: Version 5.9.72
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-22: Version 5.9.71
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-22: Version 5.9.70
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-22: Version 5.9.69
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-22: Version 5.9.68
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-21: Version 5.9.67
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-21: Version 5.9.66
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-21: Version 5.9.65
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-21: Version 5.9.64
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-21: Version 5.9.63
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-21: Version 5.9.62
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-20: Version 5.9.61
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-20: Version 5.9.60
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-20: Version 5.9.59
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-20: Version 5.9.58
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-17: Version 5.9.57
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-17: Version 5.9.56
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-17: Version 5.9.55
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-17: Version 5.9.54
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-17: Version 5.9.53
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-17: Version 5.9.52
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-16: Version 5.9.51
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-14: Version 5.9.50
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-14: Version 5.9.49
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-14: Version 5.9.48
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-14: Version 5.9.47
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-14: Version 5.9.46
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-14: Version 5.9.45
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-14: Version 5.9.44
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-14: Version 5.9.43
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-14: Version 5.9.42
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-14: Version 5.9.41
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-14: Version 5.9.40
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-13: Version 5.9.39
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-13: Version 5.9.38
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-13: Version 5.9.37
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-13: Version 5.9.36
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-10: Version 5.9.35
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-08: Version 5.9.34
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-08: Version 5.9.33
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-08: Version 5.9.32
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-08: Version 5.9.31
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-08: Version 5.9.30
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-08: Version 5.9.29
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-08: Version 5.9.28
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.27
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.26
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.25
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.24
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.23
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.22
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.21
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.20
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.19
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.18
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.17
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.16
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.15
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.14
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-07: Version 5.9.13
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-06: Version 5.9.12
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-06: Version 5.9.11
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-06: Version 5.9.10
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-06: Version 5.9.9
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-06: Version 5.9.8
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-06: Version 5.9.7
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-06: Version 5.9.6
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-05: Version 5.9.5
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-05: Version 5.9.4
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-04: Version 5.9.3
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-04: Version 5.9.2
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-03: Version 5.9.1
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-01: Version 5.8.301
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-01: Version 5.8.300
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-01: Version 5.8.299
-
-        Performance and stability improvements on all platforms.
-
-
-2017-03-01: Version 5.8.298
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-28: Version 5.8.297
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-28: Version 5.8.296
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-28: Version 5.8.295
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-28: Version 5.8.294
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-27: Version 5.8.293
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-27: Version 5.8.292
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-27: Version 5.8.291
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-27: Version 5.8.290
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-27: Version 5.8.289
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-27: Version 5.8.288
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-27: Version 5.8.287
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-27: Version 5.8.286
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-27: Version 5.8.285
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-26: Version 5.8.284
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-25: Version 5.8.283
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-24: Version 5.8.282
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-24: Version 5.8.281
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-24: Version 5.8.280
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-24: Version 5.8.279
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-24: Version 5.8.278
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-24: Version 5.8.277
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-24: Version 5.8.276
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-24: Version 5.8.275
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-24: Version 5.8.274
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-24: Version 5.8.273
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-22: Version 5.8.272
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-22: Version 5.8.271
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-22: Version 5.8.270
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-21: Version 5.8.269
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-21: Version 5.8.268
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-21: Version 5.8.267
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-21: Version 5.8.266
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-21: Version 5.8.265
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-21: Version 5.8.264
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-21: Version 5.8.263
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-21: Version 5.8.262
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-21: Version 5.8.261
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-21: Version 5.8.260
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-21: Version 5.8.259
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-21: Version 5.8.258
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-21: Version 5.8.257
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-20: Version 5.8.256
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-20: Version 5.8.255
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-20: Version 5.8.254
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-20: Version 5.8.253
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-20: Version 5.8.252
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-20: Version 5.8.251
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-20: Version 5.8.250
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-20: Version 5.8.249
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-20: Version 5.8.248
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-20: Version 5.8.247
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-20: Version 5.8.246
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-20: Version 5.8.245
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-17: Version 5.8.244
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-17: Version 5.8.243
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-17: Version 5.8.242
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-17: Version 5.8.241
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-17: Version 5.8.240
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-17: Version 5.8.239
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-17: Version 5.8.238
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-17: Version 5.8.237
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-17: Version 5.8.236
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-17: Version 5.8.235
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-17: Version 5.8.234
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-17: Version 5.8.233
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.232
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.231
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.230
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.229
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.228
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.227
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.226
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.225
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.224
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.223
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.222
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.221
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.220
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.219
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.218
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.217
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-16: Version 5.8.216
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-15: Version 5.8.215
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-15: Version 5.8.214
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-15: Version 5.8.213
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-15: Version 5.8.212
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-15: Version 5.8.211
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-15: Version 5.8.210
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-15: Version 5.8.209
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-14: Version 5.8.208
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-14: Version 5.8.207
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-14: Version 5.8.206
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-14: Version 5.8.205
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-14: Version 5.8.204
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-14: Version 5.8.203
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-14: Version 5.8.202
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-14: Version 5.8.201
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-14: Version 5.8.200
-
-        Remove SIMD.js from V8 (issues 4124, 5948).
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-13: Version 5.8.199
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-13: Version 5.8.198
-
-        Remove SIMD.js from V8 (issues 4124, 5948).
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-13: Version 5.8.197
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-13: Version 5.8.196
-
-        Remove SIMD.js from V8 (issue 4124, Chromium issue 5948).
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-13: Version 5.8.195
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-12: Version 5.8.194
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-12: Version 5.8.193
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-11: Version 5.8.192
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-11: Version 5.8.191
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-11: Version 5.8.190
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-10: Version 5.8.189
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-10: Version 5.8.188
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-10: Version 5.8.187
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-10: Version 5.8.186
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-10: Version 5.8.185
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-10: Version 5.8.184
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-10: Version 5.8.183
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-10: Version 5.8.182
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-10: Version 5.8.181
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-10: Version 5.8.180
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-10: Version 5.8.179
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-10: Version 5.8.178
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.177
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.176
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.175
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.174
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.173
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.172
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.171
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.170
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.169
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.168
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.167
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.166
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.165
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.164
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.163
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.162
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.161
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-09: Version 5.8.160
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-08: Version 5.8.159
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-08: Version 5.8.158
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-08: Version 5.8.157
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-08: Version 5.8.156
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-08: Version 5.8.155
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-08: Version 5.8.154
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-08: Version 5.8.153
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-08: Version 5.8.152
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-08: Version 5.8.151
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-08: Version 5.8.150
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-08: Version 5.8.149
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-08: Version 5.8.148
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-07: Version 5.8.147
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-07: Version 5.8.146
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-07: Version 5.8.145
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-07: Version 5.8.144
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-07: Version 5.8.143
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-07: Version 5.8.142
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-07: Version 5.8.141
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-07: Version 5.8.140
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-07: Version 5.8.139
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-07: Version 5.8.138
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-07: Version 5.8.137
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-07: Version 5.8.136
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-07: Version 5.8.135
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-06: Version 5.8.134
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-06: Version 5.8.133
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-06: Version 5.8.132
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-06: Version 5.8.131
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-06: Version 5.8.130
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-06: Version 5.8.129
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-06: Version 5.8.128
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-06: Version 5.8.127
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-06: Version 5.8.126
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-06: Version 5.8.125
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-06: Version 5.8.124
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-06: Version 5.8.123
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-05: Version 5.8.122
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-03: Version 5.8.121
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-03: Version 5.8.120
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-03: Version 5.8.119
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-03: Version 5.8.118
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-03: Version 5.8.117
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-03: Version 5.8.116
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-03: Version 5.8.115
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-03: Version 5.8.114
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-03: Version 5.8.113
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-03: Version 5.8.112
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-03: Version 5.8.111
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-02: Version 5.8.110
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-02: Version 5.8.109
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-02: Version 5.8.108
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-02: Version 5.8.107
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.106
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.105
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.104
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.103
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.102
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.101
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.100
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.99
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.98
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.97
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.96
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.95
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.94
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.93
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.92
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.91
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.90
-
-        Performance and stability improvements on all platforms.
-
-
-2017-02-01: Version 5.8.89
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-31: Version 5.8.88
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-31: Version 5.8.87
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-31: Version 5.8.86
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-31: Version 5.8.85
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-31: Version 5.8.84
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-31: Version 5.8.83
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-31: Version 5.8.82
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.81
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.80
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.79
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.78
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.77
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.76
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.75
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.74
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.73
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.72
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.71
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.70
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.69
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.68
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.67
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.66
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.65
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.64
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-30: Version 5.8.63
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-29: Version 5.8.62
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-29: Version 5.8.61
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-27: Version 5.8.60
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-27: Version 5.8.59
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-27: Version 5.8.58
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-27: Version 5.8.57
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-26: Version 5.8.56
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-26: Version 5.8.55
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-26: Version 5.8.54
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-26: Version 5.8.53
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-26: Version 5.8.52
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-26: Version 5.8.51
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-26: Version 5.8.50
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-26: Version 5.8.49
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-26: Version 5.8.48
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-26: Version 5.8.47
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-26: Version 5.8.46
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.45
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.44
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.43
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.42
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.41
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.40
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.39
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.38
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.37
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.36
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.35
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.34
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.33
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.32
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.31
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.30
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.29
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.28
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-25: Version 5.8.27
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-24: Version 5.8.26
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-24: Version 5.8.25
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-24: Version 5.8.24
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-24: Version 5.8.23
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-24: Version 5.8.22
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-24: Version 5.8.21
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-24: Version 5.8.20
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-24: Version 5.8.19
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-24: Version 5.8.18
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-24: Version 5.8.17
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-23: Version 5.8.16
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-23: Version 5.8.15
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-23: Version 5.8.14
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-23: Version 5.8.13
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-23: Version 5.8.12
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-23: Version 5.8.11
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-23: Version 5.8.10
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-23: Version 5.8.9
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-23: Version 5.8.8
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-23: Version 5.8.7
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-23: Version 5.8.6
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-23: Version 5.8.5
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-23: Version 5.8.4
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-22: Version 5.8.3
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-21: Version 5.8.2
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-20: Version 5.8.1
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.514
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.513
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.512
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.511
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.510
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.509
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.508
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.507
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.506
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.505
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.504
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.503
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.502
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.501
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.500
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.499
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.498
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.497
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-18: Version 5.7.496
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.495
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.494
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.493
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.492
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.491
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.490
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.489
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.488
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.487
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.486
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.485
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.484
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.483
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.482
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.481
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.480
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.479
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-17: Version 5.7.478
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.477
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.476
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.475
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.474
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.473
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.472
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.471
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.470
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.469
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.468
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.467
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.466
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.465
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.464
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.463
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.462
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-16: Version 5.7.461
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-15: Version 5.7.460
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-15: Version 5.7.459
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-15: Version 5.7.458
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-15: Version 5.7.457
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-14: Version 5.7.456
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-13: Version 5.7.455
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-13: Version 5.7.454
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-13: Version 5.7.453
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-13: Version 5.7.452
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-13: Version 5.7.451
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-13: Version 5.7.450
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-13: Version 5.7.449
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-13: Version 5.7.448
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-13: Version 5.7.447
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-13: Version 5.7.446
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-13: Version 5.7.445
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-13: Version 5.7.444
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-12: Version 5.7.443
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-12: Version 5.7.442
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-11: Version 5.7.441
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-11: Version 5.7.440
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-11: Version 5.7.439
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-10: Version 5.7.438
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-10: Version 5.7.437
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-10: Version 5.7.436
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-10: Version 5.7.435
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-10: Version 5.7.434
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-10: Version 5.7.433
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-10: Version 5.7.432
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-10: Version 5.7.431
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-10: Version 5.7.430
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-10: Version 5.7.429
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-10: Version 5.7.428
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.427
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.426
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.425
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.424
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.423
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.422
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.421
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.420
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.419
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.418
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.417
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.416
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.415
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.414
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.413
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.412
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-09: Version 5.7.411
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-08: Version 5.7.410
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-06: Version 5.7.409
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-06: Version 5.7.408
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-06: Version 5.7.407
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-06: Version 5.7.406
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-06: Version 5.7.405
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-06: Version 5.7.404
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-06: Version 5.7.403
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-05: Version 5.7.402
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-05: Version 5.7.401
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-05: Version 5.7.400
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-05: Version 5.7.399
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-05: Version 5.7.398
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-04: Version 5.7.397
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-04: Version 5.7.396
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-04: Version 5.7.395
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-04: Version 5.7.394
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.393
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.392
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.391
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.390
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.389
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.388
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.387
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.386
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.385
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.384
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.383
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.382
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.381
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-03: Version 5.7.380
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-02: Version 5.7.379
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-02: Version 5.7.378
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-02: Version 5.7.377
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-02: Version 5.7.376
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-02: Version 5.7.375
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-02: Version 5.7.374
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-02: Version 5.7.373
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-02: Version 5.7.372
-
-        Performance and stability improvements on all platforms.
-
-
-2017-01-02: Version 5.7.371
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-30: Version 5.7.370
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-30: Version 5.7.369
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-30: Version 5.7.368
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-30: Version 5.7.367
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-30: Version 5.7.366
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-28: Version 5.7.365
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-28: Version 5.7.364
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-28: Version 5.7.363
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-28: Version 5.7.362
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-28: Version 5.7.361
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-27: Version 5.7.360
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-27: Version 5.7.359
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-27: Version 5.7.358
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-27: Version 5.7.357
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-27: Version 5.7.356
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-27: Version 5.7.355
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-27: Version 5.7.354
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-27: Version 5.7.353
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-26: Version 5.7.352
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-24: Version 5.7.351
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-24: Version 5.7.350
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-24: Version 5.7.349
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-23: Version 5.7.348
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-23: Version 5.7.347
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-23: Version 5.7.346
-
-        [intl] Add new semantics + compat fallback to Intl constructor (issues
-        4360, 4870).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-23: Version 5.7.345
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-23: Version 5.7.344
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-23: Version 5.7.343
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-23: Version 5.7.342
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-22: Version 5.7.341
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-22: Version 5.7.340
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-22: Version 5.7.339
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-22: Version 5.7.338
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-22: Version 5.7.337
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-22: Version 5.7.336
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-22: Version 5.7.335
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-22: Version 5.7.334
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-22: Version 5.7.333
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-22: Version 5.7.332
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-22: Version 5.7.331
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-22: Version 5.7.330
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-21: Version 5.7.329
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-21: Version 5.7.328
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-21: Version 5.7.327
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-21: Version 5.7.326
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-21: Version 5.7.325
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-21: Version 5.7.324
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-21: Version 5.7.323
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-21: Version 5.7.322
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-21: Version 5.7.321
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-21: Version 5.7.320
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-21: Version 5.7.319
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.318
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.317
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.316
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.315
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.314
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.313
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.312
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.311
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.310
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.309
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.308
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.307
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.306
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.305
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.304
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.303
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.302
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.301
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.300
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-20: Version 5.7.299
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-19: Version 5.7.298
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-19: Version 5.7.297
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-19: Version 5.7.296
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-19: Version 5.7.295
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-19: Version 5.7.294
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-19: Version 5.7.293
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-19: Version 5.7.292
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-19: Version 5.7.291
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-19: Version 5.7.290
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-19: Version 5.7.289
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-19: Version 5.7.288
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-19: Version 5.7.287
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-18: Version 5.7.286
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-18: Version 5.7.285
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-17: Version 5.7.284
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-17: Version 5.7.283
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-17: Version 5.7.282
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.281
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.280
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.279
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.278
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.277
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.276
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.275
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.274
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.273
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.272
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.271
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.270
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.269
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.268
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.267
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.266
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.265
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.264
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.263
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.262
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.261
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-16: Version 5.7.260
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.259
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.258
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.257
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.256
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.255
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.254
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.253
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.252
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.251
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.250
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.249
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.248
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.247
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-15: Version 5.7.246
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.245
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.244
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.243
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.242
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.241
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.240
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.239
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.238
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.237
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.236
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.235
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.234
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.233
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.232
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.231
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-14: Version 5.7.230
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.229
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.228
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.227
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.226
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.225
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.224
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.223
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.222
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.221
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.220
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.219
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.218
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.217
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.216
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-13: Version 5.7.215
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-12: Version 5.7.214
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-12: Version 5.7.213
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-12: Version 5.7.212
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-12: Version 5.7.211
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-12: Version 5.7.210
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-12: Version 5.7.209
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-12: Version 5.7.208
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-12: Version 5.7.207
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-12: Version 5.7.206
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-12: Version 5.7.205
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-12: Version 5.7.204
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-11: Version 5.7.203
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.202
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.201
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.200
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.199
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.198
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.197
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.196
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.195
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.194
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.193
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.192
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.191
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.190
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.189
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.188
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-09: Version 5.7.187
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.186
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.185
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.184
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.183
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.182
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.181
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.180
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.179
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.178
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.177
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.176
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.175
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.174
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.173
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.172
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.171
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.170
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.169
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.168
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.167
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.166
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-08: Version 5.7.165
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.164
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.163
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.162
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.161
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.160
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.159
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.158
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.157
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.156
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.155
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.154
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.153
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.152
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.151
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.150
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.149
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.148
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-07: Version 5.7.147
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-06: Version 5.7.146
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-06: Version 5.7.145
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-06: Version 5.7.144
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-06: Version 5.7.143
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-06: Version 5.7.142
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-06: Version 5.7.141
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-06: Version 5.7.140
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-06: Version 5.7.139
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-06: Version 5.7.138
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.137
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.136
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.135
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.134
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.133
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.132
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.131
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.130
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.129
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.128
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.127
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.126
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.125
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.124
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.123
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-05: Version 5.7.122
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-02: Version 5.7.121
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-02: Version 5.7.120
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-02: Version 5.7.119
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-02: Version 5.7.118
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-02: Version 5.7.117
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-02: Version 5.7.116
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-02: Version 5.7.115
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.114
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.113
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.112
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.111
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.110
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.109
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.108
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.107
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.106
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.105
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.104
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.103
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.102
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.101
-
-        Performance and stability improvements on all platforms.
-
-
-2016-12-01: Version 5.7.100
-
-        [build] Use MSVS 2015 by default (Chromium issue 603131).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-30: Version 5.7.99
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-30: Version 5.7.98
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-30: Version 5.7.97
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-30: Version 5.7.96
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-30: Version 5.7.95
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-30: Version 5.7.94
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-30: Version 5.7.93
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-30: Version 5.7.92
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-30: Version 5.7.91
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-30: Version 5.7.90
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-30: Version 5.7.89
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-30: Version 5.7.88
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-30: Version 5.7.87
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.86
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.85
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.84
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.83
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.82
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.81
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.80
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.79
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.78
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.77
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.76
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.75
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.74
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.73
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.72
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-29: Version 5.7.71
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-28: Version 5.7.70
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-28: Version 5.7.69
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-28: Version 5.7.68
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-28: Version 5.7.67
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-28: Version 5.7.66
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-28: Version 5.7.65
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-28: Version 5.7.64
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-25: Version 5.7.63
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-25: Version 5.7.62
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-25: Version 5.7.61
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-25: Version 5.7.60
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-25: Version 5.7.59
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-25: Version 5.7.58
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-24: Version 5.7.57
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-24: Version 5.7.56
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-24: Version 5.7.55
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-24: Version 5.7.54
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-24: Version 5.7.53
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.52
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.51
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.50
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.49
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.48
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.47
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.46
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.45
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.44
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.43
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.42
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.41
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.40
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-23: Version 5.7.39
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.38
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.37
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.36
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.35
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.34
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.33
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.32
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.31
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.30
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.29
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.28
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.27
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.26
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.25
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.24
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.23
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-22: Version 5.7.22
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.21
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.20
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.19
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.18
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.17
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.16
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.15
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.14
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.13
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.12
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.11
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.10
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.9
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.8
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.7
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.6
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.5
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-21: Version 5.7.4
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-20: Version 5.7.3
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-20: Version 5.7.2
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-20: Version 5.7.1
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-17: Version 5.6.331
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-17: Version 5.6.330
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-17: Version 5.6.329
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-17: Version 5.6.328
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-16: Version 5.6.327
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-15: Version 5.6.326
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-15: Version 5.6.325
-
-        [wasm] Be more lenient on the names section (issue 5632).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-15: Version 5.6.324
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-15: Version 5.6.323
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-15: Version 5.6.322
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-15: Version 5.6.321
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-15: Version 5.6.320
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-15: Version 5.6.319
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-15: Version 5.6.318
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-15: Version 5.6.317
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-14: Version 5.6.316
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-14: Version 5.6.315
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-14: Version 5.6.314
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-14: Version 5.6.313
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-14: Version 5.6.312
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-14: Version 5.6.311
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-14: Version 5.6.310
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-14: Version 5.6.309
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-14: Version 5.6.308
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-14: Version 5.6.307
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-14: Version 5.6.306
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-14: Version 5.6.305
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-12: Version 5.6.304
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-12: Version 5.6.303
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-12: Version 5.6.302
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-11: Version 5.6.301
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-11: Version 5.6.300
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-11: Version 5.6.299
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-11: Version 5.6.298
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-11: Version 5.6.297
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-11: Version 5.6.296
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-11: Version 5.6.295
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-11: Version 5.6.294
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-11: Version 5.6.293
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-11: Version 5.6.292
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-11: Version 5.6.291
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-11: Version 5.6.290
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-11: Version 5.6.289
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.288
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.287
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.286
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.285
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.284
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.283
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.282
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.281
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.280
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.279
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.278
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.277
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.276
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.275
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.274
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.273
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.272
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.271
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.270
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.269
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-10: Version 5.6.268
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-09: Version 5.6.267
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-09: Version 5.6.266
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-09: Version 5.6.265
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-09: Version 5.6.264
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-09: Version 5.6.263
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-09: Version 5.6.262
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-09: Version 5.6.261
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-09: Version 5.6.260
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-09: Version 5.6.259
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-09: Version 5.6.258
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-09: Version 5.6.257
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-08: Version 5.6.256
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-08: Version 5.6.255
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-08: Version 5.6.254
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-08: Version 5.6.253
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-08: Version 5.6.252
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-08: Version 5.6.251
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-08: Version 5.6.250
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-08: Version 5.6.249
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-08: Version 5.6.248
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-08: Version 5.6.247
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-08: Version 5.6.246
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-08: Version 5.6.245
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-08: Version 5.6.244
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.243
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.242
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.241
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.240
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.239
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.238
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.237
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.236
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.235
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.234
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.233
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.232
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.231
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.230
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.229
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.228
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.227
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.226
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.225
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-07: Version 5.6.224
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-06: Version 5.6.223
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-05: Version 5.6.222
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.221
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.220
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.219
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.218
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.217
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.216
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.215
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.214
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.213
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.212
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.211
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.210
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.209
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.208
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-04: Version 5.6.207
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-03: Version 5.6.206
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-03: Version 5.6.205
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-03: Version 5.6.204
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-03: Version 5.6.203
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-03: Version 5.6.202
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-03: Version 5.6.201
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-03: Version 5.6.200
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-03: Version 5.6.199
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.198
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.197
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.196
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.195
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.194
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.193
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.192
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.191
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.190
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.189
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.188
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.187
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.186
-
-        Performance and stability improvements on all platforms.
-
-
-2016-11-02: Version 5.6.185
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-31: Version 5.6.184
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-31: Version 5.6.183
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-31: Version 5.6.182
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-31: Version 5.6.181
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-31: Version 5.6.180
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-31: Version 5.6.179
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-29: Version 5.6.178
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.177
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.176
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.175
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.174
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.173
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.172
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.171
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.170
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.169
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.168
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.167
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.166
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.165
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-28: Version 5.6.164
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.163
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.162
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.161
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.160
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.159
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.158
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.157
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.156
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.155
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.154
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.153
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.152
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.151
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-27: Version 5.6.150
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-26: Version 5.6.149
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-25: Version 5.6.148
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-25: Version 5.6.147
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-25: Version 5.6.146
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-25: Version 5.6.145
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-25: Version 5.6.144
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-25: Version 5.6.143
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-24: Version 5.6.142
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-24: Version 5.6.141
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-24: Version 5.6.140
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-24: Version 5.6.139
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-24: Version 5.6.138
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-24: Version 5.6.137
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-24: Version 5.6.136
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-24: Version 5.6.135
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-21: Version 5.6.134
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-21: Version 5.6.133
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-21: Version 5.6.132
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-21: Version 5.6.131
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-21: Version 5.6.130
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-21: Version 5.6.129
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-21: Version 5.6.128
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-21: Version 5.6.127
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-20: Version 5.6.126
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-20: Version 5.6.125
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-20: Version 5.6.124
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-20: Version 5.6.123
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.122
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.121
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.120
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.119
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.118
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.117
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.116
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.115
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.114
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.113
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.112
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.111
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.110
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.109
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.108
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.107
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-19: Version 5.6.106
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.105
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.104
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.103
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.102
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.101
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.100
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.99
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.98
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.97
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.96
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.95
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.94
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.93
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.92
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.91
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.90
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.89
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.88
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-18: Version 5.6.87
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.86
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.85
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.84
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.83
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.82
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.81
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.80
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.79
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.78
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.77
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.76
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.75
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.74
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.73
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.72
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.71
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-17: Version 5.6.70
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-16: Version 5.6.69
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-16: Version 5.6.68
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-15: Version 5.6.67
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-15: Version 5.6.66
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-14: Version 5.6.65
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-14: Version 5.6.64
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-14: Version 5.6.63
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-14: Version 5.6.62
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-14: Version 5.6.61
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-14: Version 5.6.60
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-14: Version 5.6.59
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-14: Version 5.6.58
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-14: Version 5.6.57
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-14: Version 5.6.56
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-14: Version 5.6.55
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-14: Version 5.6.54
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-14: Version 5.6.53
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-13: Version 5.6.52
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-13: Version 5.6.51
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-13: Version 5.6.50
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-13: Version 5.6.49
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-13: Version 5.6.48
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-13: Version 5.6.47
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-13: Version 5.6.46
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-13: Version 5.6.45
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-13: Version 5.6.44
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-13: Version 5.6.43
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-13: Version 5.6.42
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-13: Version 5.6.41
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-12: Version 5.6.40
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-12: Version 5.6.39
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-12: Version 5.6.38
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.37
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.36
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.35
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.34
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.33
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.32
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.31
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.30
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.29
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.28
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.27
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.26
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.25
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.24
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.23
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.22
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.21
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.20
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.19
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-11: Version 5.6.18
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-10: Version 5.6.17
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-10: Version 5.6.16
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-10: Version 5.6.15
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-10: Version 5.6.14
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-10: Version 5.6.13
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-09: Version 5.6.12
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-08: Version 5.6.11
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-08: Version 5.6.10
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-07: Version 5.6.9
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-07: Version 5.6.8
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-07: Version 5.6.7
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-07: Version 5.6.6
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-07: Version 5.6.5
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-07: Version 5.6.4
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-07: Version 5.6.3
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-07: Version 5.6.2
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-07: Version 5.6.1
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-06: Version 5.5.383
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-06: Version 5.5.382
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-06: Version 5.5.381
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-06: Version 5.5.380
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-06: Version 5.5.379
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-06: Version 5.5.378
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-06: Version 5.5.377
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-06: Version 5.5.376
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-05: Version 5.5.375
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-05: Version 5.5.374
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-05: Version 5.5.373
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-05: Version 5.5.372
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-05: Version 5.5.371
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-05: Version 5.5.370
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-05: Version 5.5.369
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-05: Version 5.5.368
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-05: Version 5.5.367
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.366
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.365
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.364
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.363
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.362
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.361
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.360
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.359
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.358
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.357
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.356
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.355
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.354
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.353
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-04: Version 5.5.352
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-03: Version 5.5.351
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-03: Version 5.5.350
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-03: Version 5.5.349
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-03: Version 5.5.348
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-03: Version 5.5.347
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-03: Version 5.5.346
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-02: Version 5.5.345
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-02: Version 5.5.344
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-02: Version 5.5.343
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-02: Version 5.5.342
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-01: Version 5.5.341
-
-        Performance and stability improvements on all platforms.
-
-
-2016-10-01: Version 5.5.340
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-30: Version 5.5.339
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-30: Version 5.5.338
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-30: Version 5.5.337
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-30: Version 5.5.336
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-30: Version 5.5.335
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.334
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.333
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.332
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.331
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.330
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.329
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.328
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.327
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.326
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.325
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.324
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.323
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.322
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.321
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.320
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.319
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.318
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-29: Version 5.5.317
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-28: Version 5.5.316
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-28: Version 5.5.315
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-28: Version 5.5.314
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-28: Version 5.5.313
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-28: Version 5.5.312
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-28: Version 5.5.311
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-28: Version 5.5.310
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-28: Version 5.5.309
-
-        [wasm] Master CL for Binary 0xC changes (Chromium issue 575167).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-27: Version 5.5.308
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-27: Version 5.5.307
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-27: Version 5.5.306
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-27: Version 5.5.305
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-27: Version 5.5.304
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-27: Version 5.5.303
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-27: Version 5.5.302
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-27: Version 5.5.301
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-27: Version 5.5.300
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-27: Version 5.5.299
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-27: Version 5.5.298
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-27: Version 5.5.297
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-27: Version 5.5.296
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.295
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.294
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.293
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.292
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.291
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.290
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.289
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.288
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.287
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.286
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.285
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.284
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.283
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-26: Version 5.5.282
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-24: Version 5.5.281
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-24: Version 5.5.280
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-24: Version 5.5.279
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-24: Version 5.5.278
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-23: Version 5.5.277
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-23: Version 5.5.276
-
-        [wasm] Master CL for Binary 0xC changes (Chromium issue 575167).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-23: Version 5.5.275
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.274
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.273
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.272
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.271
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.270
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.269
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.268
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.267
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.266
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.265
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.264
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.263
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.262
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.261
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.260
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.259
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-22: Version 5.5.258
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.257
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.256
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.255
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.254
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.253
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.252
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.251
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.250
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.249
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.248
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.247
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.246
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.245
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.244
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.243
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.242
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.241
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.240
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.239
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-21: Version 5.5.238
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-20: Version 5.5.237
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-20: Version 5.5.236
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-20: Version 5.5.235
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-20: Version 5.5.234
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-20: Version 5.5.233
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-20: Version 5.5.232
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-20: Version 5.5.231
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-20: Version 5.5.230
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-19: Version 5.5.229
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-19: Version 5.5.228
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-19: Version 5.5.227
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-16: Version 5.5.226
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-16: Version 5.5.225
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-16: Version 5.5.224
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-16: Version 5.5.223
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-16: Version 5.5.222
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-16: Version 5.5.221
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-16: Version 5.5.220
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-16: Version 5.5.219
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-16: Version 5.5.218
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-15: Version 5.5.217
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-15: Version 5.5.216
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-15: Version 5.5.215
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-15: Version 5.5.214
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-15: Version 5.5.213
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-15: Version 5.5.212
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-15: Version 5.5.211
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-15: Version 5.5.210
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-15: Version 5.5.209
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-15: Version 5.5.208
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-15: Version 5.5.207
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.206
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.205
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.204
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.203
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.202
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.201
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.200
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.199
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.198
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.197
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.196
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.195
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.194
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.193
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.192
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.191
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.190
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.189
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.188
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.187
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-14: Version 5.5.186
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.185
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.184
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.183
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.182
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.181
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.180
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.179
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.178
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.177
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.176
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.175
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.174
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.173
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.172
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.171
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-13: Version 5.5.170
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.169
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.168
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.167
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.166
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.165
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.164
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.163
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.162
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.161
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.160
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.159
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.158
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.157
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.156
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.155
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.154
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.153
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.152
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.151
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-12: Version 5.5.150
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-10: Version 5.5.149
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.148
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.147
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.146
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.145
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.144
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.143
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.142
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.141
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.140
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.139
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.138
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.137
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.136
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.135
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.134
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-09: Version 5.5.133
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-08: Version 5.5.132
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-08: Version 5.5.131
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-08: Version 5.5.130
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-08: Version 5.5.129
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-08: Version 5.5.128
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-08: Version 5.5.127
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-08: Version 5.5.126
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-08: Version 5.5.125
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-08: Version 5.5.124
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-08: Version 5.5.123
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-07: Version 5.5.122
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-07: Version 5.5.121
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-07: Version 5.5.120
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-07: Version 5.5.119
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-07: Version 5.5.118
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-07: Version 5.5.117
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-07: Version 5.5.116
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-07: Version 5.5.115
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-07: Version 5.5.114
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-07: Version 5.5.113
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-07: Version 5.5.112
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-07: Version 5.5.111
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-06: Version 5.5.110
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-06: Version 5.5.109
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-06: Version 5.5.108
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-06: Version 5.5.107
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-06: Version 5.5.106
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-06: Version 5.5.105
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-06: Version 5.5.104
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-06: Version 5.5.103
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-06: Version 5.5.102
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-06: Version 5.5.101
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.100
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.99
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.98
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.97
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.96
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.95
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.94
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.93
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.92
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.91
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.90
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.89
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.88
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.87
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-05: Version 5.5.86
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-04: Version 5.5.85
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-04: Version 5.5.84
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-04: Version 5.5.83
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-02: Version 5.5.82
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-02: Version 5.5.81
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-02: Version 5.5.80
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-02: Version 5.5.79
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-02: Version 5.5.78
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-02: Version 5.5.77
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-02: Version 5.5.76
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-02: Version 5.5.75
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-02: Version 5.5.74
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-02: Version 5.5.73
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-02: Version 5.5.72
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-02: Version 5.5.71
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.70
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.69
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.68
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.67
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.66
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.65
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.64
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.63
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.62
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.61
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.60
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.59
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.58
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.57
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.56
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.55
-
-        Performance and stability improvements on all platforms.
-
-
-2016-09-01: Version 5.5.54
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.53
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.52
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.51
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.50
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.49
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.48
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.47
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.46
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.45
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.44
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.43
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.42
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.41
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.40
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.39
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.38
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-31: Version 5.5.37
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.36
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.35
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.34
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.33
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.32
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.31
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.30
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.29
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.28
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.27
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.26
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.25
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.24
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.23
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-30: Version 5.5.22
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.21
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.20
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.19
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.18
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.17
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.16
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.15
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.14
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.13
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.12
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.11
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.10
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.9
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.8
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.7
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-29: Version 5.5.6
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-28: Version 5.5.5
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-28: Version 5.5.4
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-28: Version 5.5.3
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-28: Version 5.5.2
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-26: Version 5.5.1
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-25: Version 5.4.524
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-25: Version 5.4.523
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-25: Version 5.4.522
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-25: Version 5.4.521
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-25: Version 5.4.520
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-25: Version 5.4.519
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-25: Version 5.4.518
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-24: Version 5.4.517
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-24: Version 5.4.516
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-24: Version 5.4.515
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-24: Version 5.4.514
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-24: Version 5.4.513
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-24: Version 5.4.512
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-24: Version 5.4.511
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-24: Version 5.4.510
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-24: Version 5.4.509
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-24: Version 5.4.508
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-24: Version 5.4.507
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-24: Version 5.4.506
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.505
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.504
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.503
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.502
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.501
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.500
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.499
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.498
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.497
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.496
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.495
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.494
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.493
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-23: Version 5.4.492
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-22: Version 5.4.491
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-22: Version 5.4.490
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-22: Version 5.4.489
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-22: Version 5.4.488
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-22: Version 5.4.487
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-22: Version 5.4.486
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-22: Version 5.4.485
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-22: Version 5.4.484
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-22: Version 5.4.483
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-22: Version 5.4.482
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-22: Version 5.4.481
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-22: Version 5.4.480
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-22: Version 5.4.479
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-20: Version 5.4.478
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-20: Version 5.4.477
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-20: Version 5.4.476
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.475
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.474
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.473
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.472
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.471
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.470
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.469
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.468
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.467
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.466
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.465
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.464
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.463
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.462
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.461
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-19: Version 5.4.460
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-18: Version 5.4.459
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-18: Version 5.4.458
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-18: Version 5.4.457
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-18: Version 5.4.456
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-18: Version 5.4.455
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-18: Version 5.4.454
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-18: Version 5.4.453
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-18: Version 5.4.452
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-18: Version 5.4.451
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-18: Version 5.4.450
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-17: Version 5.4.449
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-17: Version 5.4.448
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-17: Version 5.4.447
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-17: Version 5.4.446
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-17: Version 5.4.445
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-17: Version 5.4.444
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-17: Version 5.4.443
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-17: Version 5.4.442
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-17: Version 5.4.441
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-17: Version 5.4.440
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-16: Version 5.4.439
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-16: Version 5.4.438
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-16: Version 5.4.437
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-16: Version 5.4.436
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-16: Version 5.4.435
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-16: Version 5.4.434
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-16: Version 5.4.433
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-16: Version 5.4.432
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-16: Version 5.4.431
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-16: Version 5.4.430
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-16: Version 5.4.429
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-16: Version 5.4.428
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-15: Version 5.4.427
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-15: Version 5.4.426
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-15: Version 5.4.425
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-15: Version 5.4.424
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-15: Version 5.4.423
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-14: Version 5.4.422
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-14: Version 5.4.421
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-13: Version 5.4.420
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-12: Version 5.4.419
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-12: Version 5.4.418
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-12: Version 5.4.417
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-12: Version 5.4.416
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-12: Version 5.4.415
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-12: Version 5.4.414
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-12: Version 5.4.413
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-12: Version 5.4.412
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-12: Version 5.4.411
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-12: Version 5.4.410
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-12: Version 5.4.409
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-12: Version 5.4.408
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-12: Version 5.4.407
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-11: Version 5.4.406
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-11: Version 5.4.405
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-11: Version 5.4.404
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-11: Version 5.4.403
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-11: Version 5.4.402
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-11: Version 5.4.401
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-11: Version 5.4.400
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-11: Version 5.4.399
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-10: Version 5.4.398
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-10: Version 5.4.397
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-10: Version 5.4.396
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-10: Version 5.4.395
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-10: Version 5.4.394
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-10: Version 5.4.393
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-10: Version 5.4.392
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.391
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.390
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.389
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.388
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.387
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.386
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.385
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.384
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.383
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.382
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.381
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.380
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.379
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-09: Version 5.4.378
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-08: Version 5.4.377
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-08: Version 5.4.376
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-08: Version 5.4.375
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-08: Version 5.4.374
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-08: Version 5.4.373
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-08: Version 5.4.372
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-08: Version 5.4.371
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-08: Version 5.4.370
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-08: Version 5.4.369
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-08: Version 5.4.368
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-08: Version 5.4.367
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-05: Version 5.4.366
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-05: Version 5.4.365
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-05: Version 5.4.364
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-05: Version 5.4.363
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-05: Version 5.4.362
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-05: Version 5.4.361
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-05: Version 5.4.360
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-05: Version 5.4.359
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-05: Version 5.4.358
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-05: Version 5.4.357
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-05: Version 5.4.356
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-04: Version 5.4.355
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-04: Version 5.4.354
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-04: Version 5.4.353
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-04: Version 5.4.352
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-04: Version 5.4.351
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-04: Version 5.4.350
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-04: Version 5.4.349
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-03: Version 5.4.348
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-03: Version 5.4.347
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-03: Version 5.4.346
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-03: Version 5.4.345
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-03: Version 5.4.344
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-03: Version 5.4.343
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-03: Version 5.4.342
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-03: Version 5.4.341
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-03: Version 5.4.340
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-03: Version 5.4.339
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-03: Version 5.4.338
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-03: Version 5.4.337
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.336
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.335
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.334
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.333
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.332
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.331
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.330
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.329
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.328
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.327
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.326
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.325
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.324
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.323
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.322
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-02: Version 5.4.321
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.320
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.319
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.318
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.317
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.316
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.315
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.314
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.313
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.312
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.311
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.310
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.309
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.308
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.307
-
-        Performance and stability improvements on all platforms.
-
-
-2016-08-01: Version 5.4.306
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-31: Version 5.4.305
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-31: Version 5.4.304
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-30: Version 5.4.303
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-30: Version 5.4.302
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.301
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.300
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.299
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.298
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.297
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.296
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.295
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.294
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.293
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.292
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.291
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.290
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.289
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-29: Version 5.4.288
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-28: Version 5.4.287
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-28: Version 5.4.286
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-28: Version 5.4.285
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-28: Version 5.4.284
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-28: Version 5.4.283
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-28: Version 5.4.282
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-28: Version 5.4.281
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.280
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.279
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.278
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.277
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.276
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.275
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.274
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.273
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.272
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.271
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.270
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.269
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.268
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-27: Version 5.4.267
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.266
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.265
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.264
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.263
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.262
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.261
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.260
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.259
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.258
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.257
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.256
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.255
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.254
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.253
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.252
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.251
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-26: Version 5.4.250
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.249
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.248
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.247
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.246
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.245
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.244
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.243
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.242
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.241
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.240
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.239
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.238
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.237
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.236
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-25: Version 5.4.235
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-24: Version 5.4.234
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-24: Version 5.4.233
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-23: Version 5.4.232
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.231
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.230
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.229
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.228
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.227
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.226
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.225
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.224
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.223
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.222
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.221
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.220
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.219
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-22: Version 5.4.218
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.217
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.216
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.215
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.214
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.213
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.212
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.211
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.210
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.209
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.208
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.207
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.206
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.205
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.204
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.203
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.202
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-21: Version 5.4.201
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-20: Version 5.4.200
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-20: Version 5.4.199
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-20: Version 5.4.198
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-20: Version 5.4.197
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-20: Version 5.4.196
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-20: Version 5.4.195
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-20: Version 5.4.194
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-20: Version 5.4.193
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-20: Version 5.4.192
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-20: Version 5.4.191
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-19: Version 5.4.190
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-19: Version 5.4.189
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.188
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.187
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.186
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.185
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.184
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.183
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.182
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.181
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.180
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.179
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.178
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.177
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.176
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-18: Version 5.4.175
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-17: Version 5.4.174
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-17: Version 5.4.173
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-17: Version 5.4.172
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-16: Version 5.4.171
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-16: Version 5.4.170
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-16: Version 5.4.169
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-15: Version 5.4.168
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-15: Version 5.4.167
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-15: Version 5.4.166
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-15: Version 5.4.165
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-15: Version 5.4.164
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-15: Version 5.4.163
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-15: Version 5.4.162
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-15: Version 5.4.161
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-15: Version 5.4.160
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-15: Version 5.4.159
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-15: Version 5.4.158
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-15: Version 5.4.157
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.156
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.155
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.154
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.153
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.152
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.151
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.150
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.149
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.148
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.147
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.146
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.145
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.144
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.143
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.142
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.141
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.140
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.139
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.138
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.137
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.136
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-14: Version 5.4.135
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.134
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.133
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.132
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.131
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.130
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.129
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.128
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.127
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.126
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.125
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.124
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.123
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.122
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.121
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.120
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.119
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.118
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.117
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.116
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.115
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.114
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.113
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.112
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-13: Version 5.4.111
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.110
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.109
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.108
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.107
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.106
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.105
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.104
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.103
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.102
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.101
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.100
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.99
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.98
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.97
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.96
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.95
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.94
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-12: Version 5.4.93
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.92
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.91
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.90
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.89
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.88
-
-        Recognize HTMLCloseComment after multiline comment (issue 5142).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.87
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.86
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.85
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.84
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.83
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.82
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.81
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.80
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.79
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.78
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.77
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.76
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.75
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.74
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.73
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.72
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-11: Version 5.4.71
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-08: Version 5.4.70
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-08: Version 5.4.69
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-08: Version 5.4.68
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-08: Version 5.4.67
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-08: Version 5.4.66
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-08: Version 5.4.65
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-08: Version 5.4.64
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-08: Version 5.4.63
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-08: Version 5.4.62
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-08: Version 5.4.61
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-08: Version 5.4.60
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.59
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.58
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.57
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.56
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.55
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.54
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.53
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.52
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.51
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.50
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.49
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.48
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.47
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-07: Version 5.4.46
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.45
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.44
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.43
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.42
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.41
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.40
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.39
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.38
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.37
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.36
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.35
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.34
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.33
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.32
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-06: Version 5.4.31
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-05: Version 5.4.30
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-05: Version 5.4.29
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-05: Version 5.4.28
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-05: Version 5.4.27
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-05: Version 5.4.26
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-05: Version 5.4.25
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-05: Version 5.4.24
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-05: Version 5.4.23
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-05: Version 5.4.22
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.21
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.20
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.19
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.18
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.17
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.16
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.15
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.14
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.13
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.12
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.11
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.10
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.9
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-04: Version 5.4.8
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-03: Version 5.4.7
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-03: Version 5.4.6
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-03: Version 5.4.5
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-03: Version 5.4.4
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-01: Version 5.4.3
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-01: Version 5.4.2
-
-        Performance and stability improvements on all platforms.
-
-
-2016-07-01: Version 5.4.1
-
-        [stubs] GetPropertyStub added (issue 4911).
-
-        [wasm] Fix receiver conversion for WASM->JS calls (Chromium issue
-        624713).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-30: Version 5.3.351
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-30: Version 5.3.350
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.349
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.348
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.347
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.346
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.345
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.344
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.343
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.342
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.341
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.340
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.339
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.338
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.337
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.336
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-29: Version 5.3.335
-
-        Allow trailing commas in function parameter lists (issue 5051).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-28: Version 5.3.334
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-28: Version 5.3.333
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-27: Version 5.3.332
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-27: Version 5.3.331
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-27: Version 5.3.330
-
-        [stubs] Implementing CodeStubAssembler::GetOwnProperty() (issue 4911).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-27: Version 5.3.329
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-27: Version 5.3.328
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-27: Version 5.3.327
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-27: Version 5.3.326
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-27: Version 5.3.325
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-26: Version 5.3.324
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-26: Version 5.3.323
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-26: Version 5.3.322
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-26: Version 5.3.321
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-24: Version 5.3.320
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-24: Version 5.3.319
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-24: Version 5.3.318
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-24: Version 5.3.317
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-24: Version 5.3.316
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-23: Version 5.3.315
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-23: Version 5.3.314
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-23: Version 5.3.313
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-23: Version 5.3.312
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.311
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.310
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.309
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.308
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.307
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.306
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.305
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.304
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.303
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.302
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.301
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.300
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.299
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.298
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.297
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.296
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.295
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.294
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.293
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-22: Version 5.3.292
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-21: Version 5.3.291
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-21: Version 5.3.290
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-21: Version 5.3.289
-
-        Reland: change most cases of variable redeclaration from TypeError to
-        SyntaxError (issue 4955).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-21: Version 5.3.288
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-21: Version 5.3.287
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-21: Version 5.3.286
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-21: Version 5.3.285
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-21: Version 5.3.284
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-21: Version 5.3.283
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-21: Version 5.3.282
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-21: Version 5.3.281
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-21: Version 5.3.280
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.279
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.278
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.277
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.276
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.275
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.274
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.273
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.272
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.271
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.270
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.269
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.268
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.267
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.266
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.265
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.264
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.263
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.262
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.261
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.260
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.259
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.258
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-20: Version 5.3.257
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-17: Version 5.3.256
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-17: Version 5.3.255
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-17: Version 5.3.254
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-17: Version 5.3.253
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-17: Version 5.3.252
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-17: Version 5.3.251
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-17: Version 5.3.250
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-16: Version 5.3.249
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-16: Version 5.3.248
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-16: Version 5.3.247
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-16: Version 5.3.246
-
-        [es8] Unstage syntactic tail calls (issue 4915).
-
-        [ic] LoadICState cleanup (Chromium issue 576312).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-16: Version 5.3.245
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-16: Version 5.3.244
-
-        [ic] Remove --new-load-global-ic switch (Chromium issue 576312).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-16: Version 5.3.243
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-16: Version 5.3.242
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-16: Version 5.3.241
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-15: Version 5.3.240
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-15: Version 5.3.239
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-15: Version 5.3.238
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-15: Version 5.3.237
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-15: Version 5.3.236
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-15: Version 5.3.235
-
-        [ic] Enable new LoadGlobalIC machinery (Chromium issue 576312).
-
-        [ic] LoadGlobalIC is now able to cache PropertyCells in the feedback
-        vector (Chromium issue 576312).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-15: Version 5.3.234
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-15: Version 5.3.233
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-15: Version 5.3.232
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-15: Version 5.3.231
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-15: Version 5.3.230
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-14: Version 5.3.229
-
-        [stubs] Ensure that StoreTransitionStub does not bailout after the
-        properties backing store is enlarged (Chromium issue 601420).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-14: Version 5.3.228
-
-        [ic] Split LoadIC into LoadGlobalIC and LoadIC (Chromium issue 576312).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-14: Version 5.3.227
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-14: Version 5.3.226
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-13: Version 5.3.225
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-13: Version 5.3.224
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-13: Version 5.3.223
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-13: Version 5.3.222
-
-        change most cases of variable redeclaration from TypeError to
-        SyntaxError (issue 4955).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-13: Version 5.3.221
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-13: Version 5.3.220
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-13: Version 5.3.219
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-13: Version 5.3.218
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-13: Version 5.3.217
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-13: Version 5.3.216
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-12: Version 5.3.215
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-12: Version 5.3.214
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-10: Version 5.3.213
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-10: Version 5.3.212
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-10: Version 5.3.211
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-10: Version 5.3.210
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-10: Version 5.3.209
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-10: Version 5.3.208
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-10: Version 5.3.207
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-10: Version 5.3.206
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-10: Version 5.3.205
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-10: Version 5.3.204
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-10: Version 5.3.203
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-10: Version 5.3.202
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-10: Version 5.3.201
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-09: Version 5.3.200
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-09: Version 5.3.199
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-09: Version 5.3.198
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-09: Version 5.3.197
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-09: Version 5.3.196
-
-        [ic] [stubs] Remove InlineCacheState field from the code flags (Chromium
-        issue 618701).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-09: Version 5.3.195
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-09: Version 5.3.194
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-09: Version 5.3.193
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-09: Version 5.3.192
-
-        [build] Use icu data file by default (Chromium issue 616033).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-09: Version 5.3.191
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-09: Version 5.3.190
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-09: Version 5.3.189
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-09: Version 5.3.188
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.187
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.186
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.185
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.184
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.183
-
-        [build] Use sysroot for linux compilation with clang (Chromium issues
-        474921, 616032).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.182
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.181
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.180
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.179
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.178
-
-        [icu] Support loading data file from default location (Chromium issue
-        616033).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.177
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.176
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.175
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.174
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.173
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.172
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-08: Version 5.3.171
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.170
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.169
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.168
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.167
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.166
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.165
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.164
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.163
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.162
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.161
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.160
-
-        [runtime] Don't use ElementsTransitionAndStoreStub for transitions that
-        involve instance rewriting (issue 5009, Chromium issue 617524).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.159
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.158
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.157
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.156
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.155
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-07: Version 5.3.154
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.153
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.152
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.151
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.150
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.149
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.148
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.147
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.146
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.145
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.144
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.143
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.142
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.141
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-06: Version 5.3.140
-
-        [build] Use sysroot for linux compilation with clang (Chromium issues
-        474921, 616032).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-05: Version 5.3.139
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-04: Version 5.3.138
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.137
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.136
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.135
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.134
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.133
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.132
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.131
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.130
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.129
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.128
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.127
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.126
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.125
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.124
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.123
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.122
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-03: Version 5.3.121
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.120
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.119
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.118
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.117
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.116
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.115
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.114
-
-        [stubs] Extend HasProperty stub with dictionary-mode, string wrapper and
-        double-elements objects support (issue 2743).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.113
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.112
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.111
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.110
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.109
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.108
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-02: Version 5.3.107
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.106
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.105
-
-        Extend HasProperty stub with dictionary-mode, string wrapper and double-
-        elements objects support (issue 2743).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.104
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.103
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.102
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.101
-
-        [runtime] Ensure that all elements kind transitions are chained to the
-        root map (issue 5009).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.100
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.99
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.98
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.97
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.96
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.95
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.94
-
-        Performance and stability improvements on all platforms.
-
-
-2016-06-01: Version 5.3.93
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-31: Version 5.3.92
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-31: Version 5.3.91
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-31: Version 5.3.90
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-31: Version 5.3.89
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-31: Version 5.3.88
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-31: Version 5.3.87
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-31: Version 5.3.86
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-31: Version 5.3.85
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-31: Version 5.3.84
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-31: Version 5.3.83
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.82
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.81
-
-        [api] Remove deprectated memory allocation callback API (issue 4813).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.80
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.79
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.78
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.77
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.76
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.75
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.74
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.73
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.72
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.71
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.70
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.69
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-30: Version 5.3.68
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-29: Version 5.3.67
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-28: Version 5.3.66
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-28: Version 5.3.65
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-27: Version 5.3.64
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-27: Version 5.3.63
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-27: Version 5.3.62
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-27: Version 5.3.61
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-27: Version 5.3.60
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-27: Version 5.3.59
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-27: Version 5.3.58
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-27: Version 5.3.57
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-26: Version 5.3.56
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-26: Version 5.3.55
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-26: Version 5.3.54
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-26: Version 5.3.53
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.52
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.51
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.50
-
-        TypedArray: Make byteOffset, byteLength, and length configurable (issue
-        4902).
-
-        Make %ThrowTypeError% function(s) strict (issue 4925).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.49
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.48
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.47
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.46
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.45
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.44
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.43
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.42
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.41
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.40
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-25: Version 5.3.39
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.38
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.37
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.36
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.35
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.34
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.33
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.32
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.31
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.30
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.29
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.28
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.27
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.26
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.25
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.24
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.23
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-24: Version 5.3.22
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-23: Version 5.3.21
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-23: Version 5.3.20
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-23: Version 5.3.19
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-23: Version 5.3.18
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-23: Version 5.3.17
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-23: Version 5.3.16
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-23: Version 5.3.15
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-23: Version 5.3.14
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-23: Version 5.3.13
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-23: Version 5.3.12
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-23: Version 5.3.11
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-23: Version 5.3.10
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-23: Version 5.3.9
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-21: Version 5.3.8
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-21: Version 5.3.7
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-21: Version 5.3.6
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-20: Version 5.3.5
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-20: Version 5.3.4
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-20: Version 5.3.3
-
-        Move case conversion with ICU to 'staged' (issues 4476, 4477).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-20: Version 5.3.2
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-20: Version 5.3.1
-
-        Move case conversion with ICU to 'staged' (issues 4476, 4477).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-19: Version 5.2.371
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-19: Version 5.2.370
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-19: Version 5.2.369
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-19: Version 5.2.368
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.367
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.366
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.365
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.364
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.363
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.362
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.361
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.360
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.359
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.358
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.357
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.356
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.355
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.354
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.353
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.352
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.351
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.350
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.349
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-18: Version 5.2.348
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.347
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.346
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.345
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.344
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.343
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.342
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.341
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.340
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.339
-
-        [wasm] remove extra nops in asm-wasm (issue 4203).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.338
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.337
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.336
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.335
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.334
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.333
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-17: Version 5.2.332
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-16: Version 5.2.331
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-16: Version 5.2.330
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-16: Version 5.2.329
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-16: Version 5.2.328
-
-        Add UseCounter for decimal with leading zero (issue 4973).
-
-        [esnext] implement frontend changes for async/await proposal (issue
-        4483).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-16: Version 5.2.327
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-15: Version 5.2.326
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-14: Version 5.2.325
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-14: Version 5.2.324
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.323
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.322
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.321
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.320
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.319
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.318
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.317
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.316
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.315
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.314
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.313
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.312
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.311
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.310
-
-        [api] Clarify expectations of ArrayBuffer::Allocator in API (Chromium
-        issue 611688).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.309
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.308
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-13: Version 5.2.307
-
-        In parallel to the strict octal check that would reject `012` in strict
-        mode, this patch collects UseCounters for `089` in strict mode. The spec
-        says this should be an error, but this patch does not report it as such
-        (issue 4973).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-12: Version 5.2.306
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-12: Version 5.2.305
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-12: Version 5.2.304
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-12: Version 5.2.303
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-12: Version 5.2.302
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-12: Version 5.2.301
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-12: Version 5.2.300
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-12: Version 5.2.299
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-12: Version 5.2.298
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-12: Version 5.2.297
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-12: Version 5.2.296
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-12: Version 5.2.295
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-11: Version 5.2.294
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-11: Version 5.2.293
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-11: Version 5.2.292
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-11: Version 5.2.291
-
-        Use ICU case conversion/transliterator for case conversion (issues 4476,
-        4477).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-11: Version 5.2.290
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-11: Version 5.2.289
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-11: Version 5.2.288
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-11: Version 5.2.287
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-11: Version 5.2.286
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-11: Version 5.2.285
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-11: Version 5.2.284
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.283
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.282
-
-        Fix Map::AsArray to properly iterate over the backing store (issue
-        4946).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.281
-
-        Remove LOG line checking from presubmit.
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.280
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.279
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.278
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.277
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.276
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.275
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.274
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.273
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.272
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.271
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.270
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.269
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.268
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-10: Version 5.2.267
-
-        Various species micro-optimizations (Chromium issue 609739).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-09: Version 5.2.266
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-09: Version 5.2.265
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-09: Version 5.2.264
-
-        Fix TypedArray Property optimizations (Chromium issue 593634).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-09: Version 5.2.263
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-09: Version 5.2.262
-
-        [V8] Add v8::Value::TypeOf to API (Chromium issue 595206).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-09: Version 5.2.261
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-09: Version 5.2.260
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-09: Version 5.2.259
-
-        Expose IsConstructor to the C++ API (issue 4993).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-09: Version 5.2.258
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-09: Version 5.2.257
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-09: Version 5.2.256
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-09: Version 5.2.255
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-09: Version 5.2.254
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-08: Version 5.2.253
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-07: Version 5.2.252
-
-        fix Set::AsArray to not leave undefined holes in output array (issue
-        4946).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-06: Version 5.2.251
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-06: Version 5.2.250
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-06: Version 5.2.249
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-06: Version 5.2.248
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-06: Version 5.2.247
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-06: Version 5.2.246
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-06: Version 5.2.245
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-06: Version 5.2.244
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-06: Version 5.2.243
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.242
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.241
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.240
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.239
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.238
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.237
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.236
-
-        S390: Add HasProperty code stub that tries simple lookups or jumps to
-        runtime otherwise (issue 2743).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.235
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.234
-
-        Make array __proto__ manipulations not disturb the species protector
-        (Chromium issue 606207).
-
-        Add v8::Object::GetOwnPropertyNames(context, filter) method (issue 3861,
-        Chromium issue 581495).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.233
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.232
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.231
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.230
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.229
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.228
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.227
-
-        MIPS64: Fix [turbofan] Length and index2 are unsigned in
-        CheckedLoad/CheckedStore (Chromium issue 599717).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.226
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.225
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.224
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.223
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.222
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.221
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.220
-
-        [wasm] Fix for 608630: allow proxies as FFI (Chromium issue 608630).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-04: Version 5.2.219
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-03: Version 5.2.218
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-03: Version 5.2.217
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-03: Version 5.2.216
-
-        [wasm] Disallow runtime calls in asm.js modules (Chromium issue 592352).
-
-        [API] remove (deprecated) hidden properties.
-
-        [wasm] Fix bug with empty input to Wasm.instantiateModuleFromAsm()
-        (Chromium issue 605488).
-
-        Add HasProperty code stub that tries simple lookups or jumps to runtime
-        otherwise (issue 2743).
-
-        Fix ExternalTwobyteStringUtf16CharacterStream::PushBack(kEndOfInput)
-        (Chromium issue 607903).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-03: Version 5.2.215
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-03: Version 5.2.214
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-03: Version 5.2.213
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-03: Version 5.2.212
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-03: Version 5.2.211
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.210
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.209
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.208
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.207
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.206
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.205
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.204
-
-        [debugger] Add JSProxy support in Runtime::GetInternalProperties
-        (Chromium issue 588705).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.203
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.202
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.201
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.200
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.199
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.198
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.197
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.196
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.195
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.194
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.193
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.192
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-02: Version 5.2.191
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-01: Version 5.2.190
-
-        Performance and stability improvements on all platforms.
-
-
-2016-05-01: Version 5.2.189
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-30: Version 5.2.188
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-30: Version 5.2.187
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-30: Version 5.2.186
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-29: Version 5.2.185
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-29: Version 5.2.184
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-29: Version 5.2.183
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-29: Version 5.2.182
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-29: Version 5.2.181
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-29: Version 5.2.180
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-29: Version 5.2.179
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-29: Version 5.2.178
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-29: Version 5.2.177
-
-        Fix overflow issue in Zone::New (Chromium issue 606115).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-29: Version 5.2.176
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-29: Version 5.2.175
-
-        [wasm] Binary 11: Bump module version to 0xB. [wasm] Binary 11: Swap the
-        order of section name / section length. [wasm] Binary 11: Shorter
-        section names. [wasm] Binary 11: Add a prefix for function type
-        declarations. [wasm] Binary 11: Function types encoded as pcount, p*,
-        rcount, r* [wasm] Fix numeric names for functions (Chromium issue
-        575167).
-
-        [wasm] Binary 11: WASM AST is now postorder. [wasm] Binary 11: br_table
-        takes a value. [wasm] Binary 11: Add implicit blocks to if arms. [wasm]
-        Binary 11: Add arities to call, return, and breaks [wasm] Binary 11: Add
-        experimental version (Chromium issue 575167).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-29: Version 5.2.174
-
-        Add checks for detached ArrayBuffers to ArrayBuffer.prototype.slice
-        (issue 4964).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-28: Version 5.2.173
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-28: Version 5.2.172
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-28: Version 5.2.171
-
-        Ship for-in initializer deprecation (issue 4942).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-28: Version 5.2.170
-
-        Add GC request to libFuzzers in attempt to avoid parasitic coverage
-        (Chromium issue 584819).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-28: Version 5.2.169
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-28: Version 5.2.168
-
-        Prevent unnecessary memory (de-)allocations in LiteralBuffer::CopyFrom
-        (issue 4947).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-28: Version 5.2.167
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-28: Version 5.2.166
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-28: Version 5.2.165
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-28: Version 5.2.164
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-27: Version 5.2.163
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-27: Version 5.2.162
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-27: Version 5.2.161
-
-        [esnext] stage --harmony-string-padding (issue 4954).
-
-        Disallow generator declarations in certain locations (issue 4824).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-27: Version 5.2.160
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-27: Version 5.2.159
-
-        [api] Expose FunctionCallbackInfo::NewTarget (issue 4261).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-27: Version 5.2.158
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-27: Version 5.2.157
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-27: Version 5.2.156
-
-        [es8] Report proper syntax error for tail call expressions in for-in and
-        for-of bodies (issue 4915).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-27: Version 5.2.155
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-27: Version 5.2.154
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-27: Version 5.2.153
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-27: Version 5.2.152
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-27: Version 5.2.151
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.150
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.149
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.148
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.147
-
-        Do not penalize performance when --harmony-species is off (Chromium
-        issue 606207).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.146
-
-        [es8] Initial set of changes to support syntactic tail calls (issue
-        4915).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.145
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.144
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.143
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.142
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.141
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.140
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.139
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.138
-
-        [es6] Fix tail call elimination in single-expression arrow functions
-        (issue 4698).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-26: Version 5.2.137
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.136
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.135
-
-        Widen --harmony-for-in flag to throw errors in PreParser (issue 4942).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.134
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.133
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.132
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.131
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.130
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.129
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.128
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.127
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.126
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.125
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.124
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.123
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-25: Version 5.2.122
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-22: Version 5.2.121
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-22: Version 5.2.120
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-22: Version 5.2.119
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-22: Version 5.2.118
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-22: Version 5.2.117
-
-        [debugger] Hide scopes that originate from desugaring (Chromium issue
-        604458).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-22: Version 5.2.116
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-22: Version 5.2.115
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-21: Version 5.2.114
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-21: Version 5.2.113
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-21: Version 5.2.112
-
-        [ic] Restore PROPERTY key tracking in keyed ICs (Chromium issue 594183).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-21: Version 5.2.111
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-21: Version 5.2.110
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-21: Version 5.2.109
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-21: Version 5.2.108
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-21: Version 5.2.107
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-21: Version 5.2.106
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-21: Version 5.2.105
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-21: Version 5.2.104
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-21: Version 5.2.103
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-21: Version 5.2.102
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.101
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.100
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.99
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.98
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.97
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.96
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.95
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.94
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.93
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.92
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.91
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.90
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.89
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.88
-
-        [turbofan] Length and index2 are unsigned in CheckedLoad/CheckedStore
-        (Chromium issue 599717).
-
-        Prevent un-parsed LiteralFunction reaching the compiler (Chromium issue
-        604044).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.87
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-20: Version 5.2.86
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.85
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.84
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.83
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.82
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.81
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.80
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.79
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.78
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.77
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.76
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.75
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.74
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.73
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.72
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.71
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.70
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.69
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.68
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.67
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-19: Version 5.2.66
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.65
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.64
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.63
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.62
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.61
-
-        [Atomics] Remove Atomics code stubs; use TF ops (issue 4614).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.60
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.59
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.58
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.57
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.56
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.55
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.54
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.53
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.52
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.51
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.50
-
-        [Atomics] Remove Atomics code stubs; use TF ops (issue 4614).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-04-18: Version 5.2.49
-
-        [api] Bring back finalizers on global handles.
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-17: Sentinel
-
-        The ChangeLog file is no longer maintained on master. This
-        sentinel should stay on top of this list.
-
-2016-02-17: Version 4.10.253
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-17: Version 4.10.252
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-17: Version 4.10.251
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-17: Version 4.10.250
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.249
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.248
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.247
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.246
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.245
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.244
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.243
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.242
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.241
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.240
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.239
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.238
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.237
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.236
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.235
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.234
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.233
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.232
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.231
-
-        Make NamedLoadHandlerCompiler::CompileLoadInterceptor behave correcly
-        with lazy accessors (Chromium issue 585764).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.230
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.229
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.228
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.227
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.226
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-16: Version 4.10.225
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.224
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.223
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.222
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.221
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.220
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.219
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.218
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.217
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.216
-
-        [wasm] Add support for a start function (Chromium issue 575167).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.215
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.214
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.213
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.212
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.211
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-15: Version 4.10.210
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-14: Version 4.10.209
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-14: Version 4.10.208
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-14: Version 4.10.207
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-13: Version 4.10.206
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-12: Version 4.10.205
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-12: Version 4.10.204
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-12: Version 4.10.203
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-12: Version 4.10.202
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-12: Version 4.10.201
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-12: Version 4.10.200
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-12: Version 4.10.199
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-12: Version 4.10.198
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-12: Version 4.10.197
-
-        Stage --harmony-function-name (issue 3699).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-12: Version 4.10.196
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-10: Version 4.10.195
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-10: Version 4.10.194
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-10: Version 4.10.193
-
-        Use a for-of loop in Array.from (issue 4739).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-09: Version 4.10.192
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-09: Version 4.10.191
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-09: Version 4.10.190
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-09: Version 4.10.189
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-09: Version 4.10.188
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-09: Version 4.10.187
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-09: Version 4.10.186
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-09: Version 4.10.185
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-09: Version 4.10.184
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-09: Version 4.10.183
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-08: Version 4.10.182
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-08: Version 4.10.181
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-08: Version 4.10.180
-
-        [wasm] Put the condition last in kExprBrIf (Chromium issue 575167).
-
-        Stage --harmony-species flag, enabling Symbol.species (issue 4093).
-
-        Extend subarray web compatibility fix to --harmony-species (issue 4665).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-08: Version 4.10.179
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-08: Version 4.10.178
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-08: Version 4.10.177
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-08: Version 4.10.176
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-08: Version 4.10.175
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-08: Version 4.10.174
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-08: Version 4.10.173
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-08: Version 4.10.172
-
-        android: Use libc++ instead of stlport (issue 4615).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-08: Version 4.10.171
-
-        [api] Make ObjectTemplate::SetNativeDataProperty() work even if the
-        ObjectTemplate does not have a constructor (Chromium issue 579009).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-05: Version 4.10.170
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-05: Version 4.10.169
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-05: Version 4.10.168
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-05: Version 4.10.167
-
-        [wasm] min/max does not return signaling NaNs anymore (Chromium issue
-        4733).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-05: Version 4.10.166
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-05: Version 4.10.165
-
-        [wasm] Put the condition last in kExprSelect (issue 4735, Chromium issue
-        575167).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-05: Version 4.10.164
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-05: Version 4.10.163
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-05: Version 4.10.162
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-05: Version 4.10.161
-
-        PPC: [generators] Implement Generator.prototype.return (issue 3566).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-04: Version 4.10.160
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-04: Version 4.10.159
-
-        [generators] Implement Generator.prototype.return (issue 3566).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-04: Version 4.10.158
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-04: Version 4.10.157
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-04: Version 4.10.156
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-04: Version 4.10.155
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-04: Version 4.10.154
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-04: Version 4.10.153
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-04: Version 4.10.152
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-04: Version 4.10.151
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-03: Version 4.10.150
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-03: Version 4.10.149
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-03: Version 4.10.148
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-03: Version 4.10.147
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-03: Version 4.10.146
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-03: Version 4.10.145
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-02: Version 4.10.144
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-02: Version 4.10.143
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-02: Version 4.10.142
-
-        [wasm] Provide backoff implementations for the Fxx rounding instructions
-        (Chromium issue 575379).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-02: Version 4.10.141
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-02: Version 4.10.140
-
-        [api] Make ObjectTemplate::SetNativeDataProperty() work even if the
-        ObjectTemplate does not have a constructor (Chromium issue 579009).
-
-        Add native callbacks to FastAccessorAssembler (Chromium issue 508898).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-02: Version 4.10.139
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-02: Version 4.10.138
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.137
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.136
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.135
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.134
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.133
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.132
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.131
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.130
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.129
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.128
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.127
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.126
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.125
-
-        Ship RegExp subclassing (issues 4305, 4343, 4344, 4345).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-02-01: Version 4.10.124
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-31: Version 4.10.123
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-31: Version 4.10.122
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-29: Version 4.10.121
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-29: Version 4.10.120
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-29: Version 4.10.119
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-29: Version 4.10.118
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-29: Version 4.10.117
-
-        Fix Unicode string normalization with null bytes (issue 4654).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-29: Version 4.10.116
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-29: Version 4.10.115
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-29: Version 4.10.114
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-29: Version 4.10.113
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-29: Version 4.10.112
-
-        [regexp] stage unicode regexps (issue 2952).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-29: Version 4.10.111
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-28: Version 4.10.110
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-28: Version 4.10.109
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-28: Version 4.10.108
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-28: Version 4.10.107
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-28: Version 4.10.106
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-28: Version 4.10.105
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-28: Version 4.10.104
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-28: Version 4.10.103
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-28: Version 4.10.102
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-28: Version 4.10.101
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-28: Version 4.10.100
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-28: Version 4.10.99
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-28: Version 4.10.98
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.97
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.96
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.95
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.94
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.93
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.92
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.91
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.90
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.89
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.88
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.87
-
-        [api] Default native data property setter to replace the setter if the
-        property is writable (Chromium issue 580584).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.86
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.85
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.84
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.83
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.82
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.81
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-27: Version 4.10.80
-
-        Stage RegExp subclassing (issues 4305, 4343, 4344, 4345).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-26: Version 4.10.79
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-26: Version 4.10.78
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-26: Version 4.10.77
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-26: Version 4.10.76
-
-        Ensure arrow functions can close over lexically-scoped variables (issue
-        4255, Chromium issue 580934).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-26: Version 4.10.75
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-26: Version 4.10.74
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-26: Version 4.10.73
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-26: Version 4.10.72
-
-        [GN] Remove CAN_USE_VFP_INSTRUCTIONS define to match GYP.
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-26: Version 4.10.71
-
-        PPC: [es6] Tail calls support (issue 4698).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-26: Version 4.10.70
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-26: Version 4.10.69
-
-        [es6] Tail calls support (issue 4698).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-26: Version 4.10.68
-
-        Support @@species in Array.prototype.concat (issue 4093).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.67
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.66
-
-        Restore per-TypedArray-class length accessors as a perf workaround
-        (Chromium issue 579905).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.65
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.64
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.63
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.62
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.61
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.60
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.59
-
-        Don't NULL-check GlobalHandle::Node::object_ (issue 3647, Chromium issue
-        580651).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.58
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.57
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.56
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.55
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.54
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.53
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.52
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-25: Version 4.10.51
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.50
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.49
-
-        Sloppy mode webcompat: allow conflicting function declarations in blocks
-        (issue 4693, Chromium issue 579395).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.48
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.47
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.46
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.45
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.44
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.43
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.42
-
-        Array length reduction should throw in strict mode if it can't delete an
-        element (issue 4267).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.41
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.40
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.39
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.38
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-22: Version 4.10.37
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-21: Version 4.10.36
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-21: Version 4.10.35
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-21: Version 4.10.34
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-21: Version 4.10.33
-
-        Array length reduction should throw in strict mode if it can't delete an
-        element (issue 4267).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-21: Version 4.10.32
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-21: Version 4.10.31
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-21: Version 4.10.30
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-21: Version 4.10.29
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-21: Version 4.10.28
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-21: Version 4.10.27
-
-        [debugger] negative conditional break points mute breaks and exceptions
-        (Chromium issue 429167).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-21: Version 4.10.26
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-21: Version 4.10.25
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.24
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.23
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.22
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.21
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.20
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.19
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.18
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.17
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.16
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.15
-
-        [wasm] Implemented F32Trunc as a turbofan graph based on int32
-        instructions (Chromium issue 575379).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.14
-
-        [wasm] Verify boundaries of data segments when decoding modules
-        (Chromium issue 575167).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.13
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.12
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.11
-
-        [runtime] Do not use the enum-cache for keys retrieval (issue 705).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.10
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-20: Version 4.10.9
-
-        Separate String.prototype.replace into RegExp.prototype[Symbol.replace]
-        (issue 4343).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-19: Version 4.10.8
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-19: Version 4.10.7
-
-        [wasm] Enable WASM JavaScript API tests (Chromium issue 575167).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-18: Version 4.10.6
-
-        [wasm] Create a wrapper function for WASM.asmCompileRun() (Chromium
-        issue 575372).
-
-        Make generators non-constructable (issues 4163, 4630).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-18: Version 4.10.5
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-18: Version 4.10.4
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-18: Version 4.10.3
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-16: Version 4.10.2
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-16: Version 4.10.1
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-15: Version 4.9.391
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-15: Version 4.9.390
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-15: Version 4.9.389
-
-        Construct instances of base class from TypedArray.prototype.subarray
-        (issue 4665).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-14: Version 4.9.388
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-14: Version 4.9.387
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-14: Version 4.9.386
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-14: Version 4.9.385
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-14: Version 4.9.384
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-14: Version 4.9.383
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-14: Version 4.9.382
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-14: Version 4.9.381
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-14: Version 4.9.380
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-14: Version 4.9.379
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-14: Version 4.9.378
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.377
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.376
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.375
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.374
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.373
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.372
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.371
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.370
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.369
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.368
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.367
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.366
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.365
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.364
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.363
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.362
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.361
-
-        Disable concurrent osr (issue 4650).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.360
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-13: Version 4.9.359
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.358
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.357
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.356
-
-        [wasm] Rename the WASM object to _WASMEXP_ (Chromium issue 575167).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.355
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.354
-
-        Reland of "[Proxies] Ship Proxies + Reflect." (issues 1543, 3931).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.353
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.352
-
-        Gracefully handle proxies in AllCanWrite() (issue 1543, Chromium issue
-        576662).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.351
-
-        [wasm] Fix double to int conversions (Chromium issue 576560).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.350
-
-        [Proxies] Ship Proxies + Reflect (issues 1543, 3931).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.349
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.348
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.347
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.346
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.345
-
-        Add @@species/better subclassing support to Promises (issue 4633,
-        Chromium issue 575314).
-
-        TypedArray and ArrayBuffer support for @@species (issue 4093).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-12: Version 4.9.344
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-11: Version 4.9.343
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-11: Version 4.9.342
-
-        Ship ES2015 sloppy-mode const semantics (issue 3305).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-11: Version 4.9.341
-
-        Partial rollback of Promise error checking (issue 4633).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-11: Version 4.9.340
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-11: Version 4.9.339
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-11: Version 4.9.338
-
-        [wasm] Fix set_local appearing in unreachable code (Chromium issue
-        575861).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-11: Version 4.9.337
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-11: Version 4.9.336
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-11: Version 4.9.335
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-11: Version 4.9.334
-
-        [wasm] Avoid crashing if parsing fails in asm -> wasm (Chromium issue
-        575369).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-11: Version 4.9.333
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-11: Version 4.9.332
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-11: Version 4.9.331
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-09: Version 4.9.330
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.329
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.328
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.327
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.326
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.325
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.324
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.323
-
-        Fix sloppy block-scoped function hoisting with nested zones (Chromium
-        issue 537816).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.322
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.321
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.320
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.319
-
-        [wasm] Fix validation error for missing return statement in asm.js
-        module (Chromium issue 575364).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.318
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.317
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.316
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.315
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-08: Version 4.9.314
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.313
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.312
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.311
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.310
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.309
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.308
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.307
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.306
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.305
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.304
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.303
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.302
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.301
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-07: Version 4.9.300
-
-        Add Array support for @@species and subclassing (issue 4093).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-06: Version 4.9.299
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-06: Version 4.9.298
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-06: Version 4.9.297
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-05: Version 4.9.296
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-05: Version 4.9.295
-
-        Ship ES2015 sloppy-mode function hoisting, let, class (issues 3305,
-        4285).
-
-        Ship destructuring assignment (issue 811).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-05: Version 4.9.294
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-05: Version 4.9.293
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-05: Version 4.9.292
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-05: Version 4.9.291
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-05: Version 4.9.290
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-05: Version 4.9.289
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-05: Version 4.9.288
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-05: Version 4.9.287
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-05: Version 4.9.286
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-05: Version 4.9.285
-
-        Accept time zones like GMT-8 in the legacy date parser (Chromium issue
-        422858).
-
-        Timezone name check fix (Chromium issue 364374).
-
-        Add a --harmony-species flag, defining @@species on constructors (issue
-        4093).
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-04: Version 4.9.284
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-04: Version 4.9.283
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-04: Version 4.9.282
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-04: Version 4.9.281
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-04: Version 4.9.280
-
-        Performance and stability improvements on all platforms.
-
-
-2016-01-01: Version 4.9.279
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-31: Version 4.9.278
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-31: Version 4.9.277
-
-        Fix 'illegal access' in Date constructor edge case (issue 4640).
-
-        Reland of Use ES2015-style TypedArray prototype chain (patchset #1 id:1
-        of https://codereview.chromium.org/1554523002/ ) (issue 4085).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-30: Version 4.9.276
-
-        Reland "Clean up promises and fix an edge case bug (patchset #4 id:60001
-        of https://codereview.chromium.org/1488783002/ )" (issue 3641).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-30: Version 4.9.275
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-30: Version 4.9.274
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-30: Version 4.9.273
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-29: Version 4.9.272
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-29: Version 4.9.271
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-29: Version 4.9.270
-
-        [crankshaft] Don't inline array resize operations if receiver's proto is
-        not a JSObject (Chromium issue 571064).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-29: Version 4.9.269
-
-        [ic] Fixed receiver_map register trashing in KeyedStoreIC megamorphic
-        (Chromium issue 571370).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-29: Version 4.9.268
-
-        Use ES2015-style TypedArray prototype chain (issue 4085).
-
-        Guard the property RegExp.prototype.unicode behind --harmony-regexp-
-        unicode (issue 4644).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-28: Version 4.9.267
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-28: Version 4.9.266
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-26: Version 4.9.265
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-26: Version 4.9.264
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-25: Version 4.9.263
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-24: Version 4.9.262
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-24: Version 4.9.261
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-23: Version 4.9.260
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-23: Version 4.9.259
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-23: Version 4.9.258
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-23: Version 4.9.257
-
-        [elements] Enable left-trimming again (issue 4606).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-23: Version 4.9.256
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-23: Version 4.9.255
-
-        Reland of Add web compat workarounds for ES2015 RegExp semantics
-        (patchset #3 id:40001 of https://codereview.chromium.org/1543723002/ )
-        (issues 4617, 4637).
-
-        Add web compat workarounds for ES2015 RegExp semantics (issues 4617,
-        4637).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-22: Version 4.9.254
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-22: Version 4.9.253
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-21: Version 4.9.252
-
-        [ES6] Stage sloppy function block scoping (issue 3305).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-21: Version 4.9.251
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-21: Version 4.9.250
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-21: Version 4.9.249
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-21: Version 4.9.248
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-21: Version 4.9.247
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-21: Version 4.9.246
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-21: Version 4.9.245
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-20: Version 4.9.244
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-20: Version 4.9.243
-
-        Mark all APIs without callers in Blink as deprecated.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-19: Version 4.9.242
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-19: Version 4.9.241
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-18: Version 4.9.240
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-18: Version 4.9.239
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-18: Version 4.9.238
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-18: Version 4.9.237
-
-        Stage Proxies and Reflect behind --harmony flag (issues 1543, 3931).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-18: Version 4.9.236
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-18: Version 4.9.235
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-18: Version 4.9.234
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-17: Version 4.9.233
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-17: Version 4.9.232
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-17: Version 4.9.231
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-17: Version 4.9.230
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-17: Version 4.9.229
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-17: Version 4.9.228
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-17: Version 4.9.227
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-17: Version 4.9.226
-
-        [IC] Fix "compatible receiver" checks hidden behind interceptors
-        (Chromium issue 497632).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-17: Version 4.9.225
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-17: Version 4.9.224
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-17: Version 4.9.223
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-17: Version 4.9.222
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-17: Version 4.9.221
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-16: Version 4.9.220
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-16: Version 4.9.219
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-16: Version 4.9.218
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-16: Version 4.9.217
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-16: Version 4.9.216
-
-        Stage destructuring assignment (issue 811).
-
-        Update DEPS entry for tracing to point at correct location.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-16: Version 4.9.215
-
-        [harmony] unstage regexp lookbehind assertions (issue 4545).
-
-        Move Object.observe back to shipping temporarily (Chromium issues
-        552100, 569417, 569647).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-14: Version 4.9.214
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-14: Version 4.9.213
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-14: Version 4.9.212
-
-        [harmony] stage regexp lookbehind assertions (issue 4545).
-
-        [es6] ship regexp sticky flag (issue 4342).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-14: Version 4.9.211
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.210
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.209
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.208
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.207
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.206
-
-        [es6] Support Function name inference in variable declarations (issue
-        3699).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.205
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.204
-
-        Disable --harmony-object-observe (Chromium issue 552100).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.203
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.202
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.201
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.200
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.199
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.198
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.197
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.196
-
-        Re-re-land FastAccessorBuilder (Chromium issue 508898).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.195
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-11: Version 4.9.194
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.193
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.192
-
-        Unstage non-standard Promise functions (issue 3237).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.191
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.190
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.189
-
-        Allow ICU to normalize time zones (Chromium issue 487322).
-
-        Fix FuncNameInferrer usage in ParseAssignmentExpression (issue 4595).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.188
-
-        Fix Function subclassing (issues 3101, 3330, 4597).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.187
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.186
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.185
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.184
-
-        Re-land FastAccessorBuilder (Chromium issue 508898).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.183
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.182
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.181
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.180
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.179
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.178
-
-        Implement FastAccessorBuilder (Chromium issue 508898).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-10: Version 4.9.177
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-09: Version 4.9.176
-
-        Updated the check for unmodfied objects to handle Smi Objects (Chromium
-        issue 553287).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-09: Version 4.9.175
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-09: Version 4.9.174
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-08: Version 4.9.173
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-08: Version 4.9.172
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-08: Version 4.9.171
-
-        Remove usage of deprecated APIs from api interceptor tests (issue 4341).
-
-        Deprecate Promise::Chain from V8 APIs (issue 3237).
-
-        Set the Gregorian changeover date to the beginning of time in Intl
-        (Chromium issue 537382).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-07: Version 4.9.170
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-07: Version 4.9.169
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-07: Version 4.9.168
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-07: Version 4.9.167
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-07: Version 4.9.166
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-07: Version 4.9.165
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-07: Version 4.9.164
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-07: Version 4.9.163
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-07: Version 4.9.162
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-07: Version 4.9.161
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-07: Version 4.9.160
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-07: Version 4.9.159
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-07: Version 4.9.158
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-06: Version 4.9.157
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-06: Version 4.9.156
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-06: Version 4.9.155
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-05: Version 4.9.154
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-05: Version 4.9.153
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-05: Version 4.9.152
-
-        Clean up promises and fix an edge case bug (issue 3641).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.151
-
-        [es6] implement destructuring assignment (issue 811).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.150
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.149
-
-        Mark deprecated debugger APIs as such.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.148
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.147
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.146
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.145
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.144
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.143
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.142
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.141
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.140
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.139
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.138
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.137
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-04: Version 4.9.136
-
-        Mark BooleanObject::New() as deprecated.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-03: Version 4.9.135
-
-        For non-prototype objects constructed using base==new.target, use the
-        cached constructor to render the name (Chromium issue 563791).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-03: Version 4.9.134
-
-        Deprecate non-standard Array methods and clarify Object::isArray.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-03: Version 4.9.133
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-03: Version 4.9.132
-
-        Fix inobject slack tracking for both subclassing and non-subclassing
-        cases (Chromium issue 563339).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-03: Version 4.9.131
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-03: Version 4.9.130
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-02: Version 4.9.129
-
-        Removed support deprecated (//@|/*@) source(URL|MappingURL)= (Chromium
-        issue 558998).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-02: Version 4.9.128
-
-        Improve rendering of callsite with non-function target (issue 3953).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-02: Version 4.9.127
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-02: Version 4.9.126
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-02: Version 4.9.125
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-02: Version 4.9.124
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-02: Version 4.9.123
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-02: Version 4.9.122
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-02: Version 4.9.121
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-01: Version 4.9.120
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-01: Version 4.9.119
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-01: Version 4.9.118
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-01: Version 4.9.117
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-01: Version 4.9.116
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-01: Version 4.9.115
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-01: Version 4.9.114
-
-        Performance and stability improvements on all platforms.
-
-
-2015-12-01: Version 4.9.113
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.112
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.111
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.110
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.109
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.108
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.107
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.106
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.105
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.104
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.103
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.102
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.101
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.100
-
-        Move RMA::Label out of the class, so it can be forward declared
-        (Chromium issue 508898).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.99
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.98
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.97
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.96
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-30: Version 4.9.95
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-29: Version 4.9.94
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-29: Version 4.9.93
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-28: Version 4.9.92
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-28: Version 4.9.91
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-27: Version 4.9.90
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-27: Version 4.9.89
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-27: Version 4.9.88
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-27: Version 4.9.87
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-27: Version 4.9.86
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-27: Version 4.9.85
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-27: Version 4.9.84
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-27: Version 4.9.83
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.82
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.81
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.80
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.79
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.78
-
-        Mark PromiseRejectMessage::GetStackTrace as deprecated.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.77
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.76
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.75
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.74
-
-        Add explicit Isolate parameter to Exception::CreateMessage() (Chromium
-        issue 495801).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.73
-
-        Allow in-object properties in JSArrayBuffer (issue 4531).
-
-        Allow in-object properties in JSTypedArray and JSDataView (issue 4531).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.72
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.71
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.70
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-26: Version 4.9.69
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-25: Version 4.9.68
-
-        Reland shipping of --harmony-destructuring-bind (issue 811).
-
-        Fix promotion of JSFunctions with in-object properties (issue 4572,
-        Chromium issue 561481).
-
-        Allow in-object properties in JSCollections, JSWeakCollections and
-        JSRegExp (issue 4531).
-
-        Fix JSFunction's in-object properties initialization (issue 4572).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-25: Version 4.9.67
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-25: Version 4.9.66
-
-        Removed support deprecated (//@|/*@) source(URL|MappingURL)= (Chromium
-        issue 558998).
-
-        PPC: Reshuffle registers in JSConstructStub to avoid trashing costructor
-        and new.target on fast path (so we don't need to push/pop them)
-        (Chromium issue 560239).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-24: Version 4.9.65
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-24: Version 4.9.64
-
-        Move --harmony-destructuring-bind to shipping (issue 811).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-24: Version 4.9.63
-
-        Reshuffle registers in JSConstructStub to avoid trashing costructor and
-        new.target on fast path (so we don't need to push/pop them) (Chromium
-        issue 560239).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-24: Version 4.9.62
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-24: Version 4.9.61
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-24: Version 4.9.60
-
-        Allow in-object properties in JSFunctions (issue 4531).
-
-        Disable non-standard Promise functions in staging (issue 3237).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-24: Version 4.9.59
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-24: Version 4.9.58
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-24: Version 4.9.57
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-23: Version 4.9.56
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-23: Version 4.9.55
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-23: Version 4.9.54
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-23: Version 4.9.53
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-23: Version 4.9.52
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-23: Version 4.9.51
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-23: Version 4.9.50
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-23: Version 4.9.49
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-23: Version 4.9.48
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-23: Version 4.9.47
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-23: Version 4.9.46
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-22: Version 4.9.45
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-22: Version 4.9.44
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-22: Version 4.9.43
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-21: Version 4.9.42
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-20: Version 4.9.41
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-20: Version 4.9.40
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-20: Version 4.9.39
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-20: Version 4.9.38
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-20: Version 4.9.37
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-20: Version 4.9.36
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-20: Version 4.9.35
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-20: Version 4.9.34
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-20: Version 4.9.33
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-20: Version 4.9.32
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-20: Version 4.9.31
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-20: Version 4.9.30
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-20: Version 4.9.29
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-19: Version 4.9.28
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-19: Version 4.9.27
-
-        [V8] Unify get function name for debugging purpose (Chromium issue
-        17356).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-19: Version 4.9.26
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-19: Version 4.9.25
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-19: Version 4.9.24
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-19: Version 4.9.23
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-19: Version 4.9.22
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-19: Version 4.9.21
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-19: Version 4.9.20
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-18: Version 4.9.19
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-18: Version 4.9.18
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-18: Version 4.9.17
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-18: Version 4.9.16
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-18: Version 4.9.15
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-18: Version 4.9.14
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-17: Version 4.9.13
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-17: Version 4.9.12
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-17: Version 4.9.11
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-17: Version 4.9.10
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-16: Version 4.9.9
-
-        Map v8::Object to v8::internal::JSReceiver.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-16: Version 4.9.8
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-16: Version 4.9.7
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-16: Version 4.9.6
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-16: Version 4.9.5
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-16: Version 4.9.4
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-15: Version 4.9.3
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-15: Version 4.9.2
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-15: Version 4.9.1
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-13: Version 4.8.294
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-13: Version 4.8.293
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.292
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.291
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.290
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.289
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.288
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.287
-
-        [JSON stringifier] Correctly load array elements (Chromium issue
-        554946).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.286
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.285
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.284
-
-        Ship --harmony-default-parameters (issue 2160).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.283
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.282
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.281
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.280
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-12: Version 4.8.279
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-11: Version 4.8.278
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-11: Version 4.8.277
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-11: Version 4.8.276
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-11: Version 4.8.275
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-11: Version 4.8.274
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-11: Version 4.8.273
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-11: Version 4.8.272
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-11: Version 4.8.271
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-11: Version 4.8.270
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-11: Version 4.8.269
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-10: Version 4.8.268
-
-        Make JSFunction::BodyDescriptor the only single place that knows how to
-        iterate JSFunction's body (issue 4531).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-10: Version 4.8.267
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-09: Version 4.8.266
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-09: Version 4.8.265
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-09: Version 4.8.264
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-09: Version 4.8.263
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-09: Version 4.8.262
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-09: Version 4.8.261
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-09: Version 4.8.260
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-09: Version 4.8.259
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-09: Version 4.8.258
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-07: Version 4.8.257
-
-        Update v8_external_startup_data_assets for
-        https://codereview.chromium.org/1422793004/ (Chromium issue 547162).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-07: Version 4.8.256
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-07: Version 4.8.255
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-06: Version 4.8.254
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-06: Version 4.8.253
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-06: Version 4.8.252
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-06: Version 4.8.251
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-06: Version 4.8.250
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-06: Version 4.8.249
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-06: Version 4.8.248
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-06: Version 4.8.247
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.246
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.245
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.244
-
-        Re-ship @@toStringTag (issue 3502).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.243
-
-        Stage --harmony-destructuring and --harmony-default-parameters (issues
-        811, 2160).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.242
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.241
-
-        Re-re-land "[es6] Implement destructuring binding in try/catch" (issue
-        811).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.240
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.239
-
-        Add v8_external_startup_data GN rule (Chromium issue 547162).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.238
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.237
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.236
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.235
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.234
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.233
-
-        Implement flag and source getters on RegExp.prototype (issues 3715,
-        4528).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.232
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-05: Version 4.8.231
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-04: Version 4.8.230
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-04: Version 4.8.229
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-04: Version 4.8.228
-
-        Ship Harmony ToLength (issue 3087).
-
-        Avoid creating indexed elements at index maxUint32 (issue 4516).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-04: Version 4.8.227
-
-        Implement flag and source getters on RegExp.prototype (issues 3715,
-        4528).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-04: Version 4.8.226
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-04: Version 4.8.225
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-04: Version 4.8.224
-
-        [es6] Implement destructuring binding in try/catch (issue 811).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-04: Version 4.8.223
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-04: Version 4.8.222
-
-        Implement flag and source getters on RegExp.prototype (issues 3715,
-        4528).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-04: Version 4.8.221
-
-        Implement flag and source getters on RegExp.prototype (issues 3715,
-        4528).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-04: Version 4.8.220
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-04: Version 4.8.219
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-04: Version 4.8.218
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-03: Version 4.8.217
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-03: Version 4.8.216
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-03: Version 4.8.215
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-03: Version 4.8.214
-
-        [es6] Fix Object built-in subclassing (issue 3886).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-03: Version 4.8.213
-
-        [es6] Fix WeakMap/Set built-ins subclasssing (issues 3101, 3330).
-
-        Reland "[es6] Fix Function and GeneratorFunction built-ins subclassing."
-        (issues 3101, 3330).
-
-        Implement flag and source getters on RegExp.prototype (issues 3715,
-        4528).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-03: Version 4.8.212
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-03: Version 4.8.211
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-03: Version 4.8.210
-
-        For now, don't assume failed-access-check callback to throw (Chromium
-        issue 548194).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-03: Version 4.8.209
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.208
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.207
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.206
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.205
-
-        Mark GetCallingContext as soon-to-be deprecated (Chromium issue 541703).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.204
-
-        Add boolean to tell if V8 zaps allocated memory (Chromium issue 546492).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.203
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.202
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.201
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.200
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.199
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.198
-
-        [es6] Fix Function and GeneratorFunction built-ins subclassing (issues
-        3101, 3330).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.197
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.196
-
-        Reland "[es6] Better support for built-ins subclassing." (issues 3101,
-        3330, 4419).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-11-02: Version 4.8.195
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-30: Version 4.8.194
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-30: Version 4.8.193
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-30: Version 4.8.192
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-30: Version 4.8.191
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-30: Version 4.8.190
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-30: Version 4.8.189
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-30: Version 4.8.188
-
-        [es6] Better support for built-ins subclassing (issues 3101, 3330).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-30: Version 4.8.187
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-30: Version 4.8.186
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-30: Version 4.8.185
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-29: Version 4.8.184
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-29: Version 4.8.183
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-29: Version 4.8.182
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-29: Version 4.8.181
-
-        Reland v8::Private and related APIs.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-29: Version 4.8.180
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-29: Version 4.8.179
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-29: Version 4.8.178
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-29: Version 4.8.177
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-29: Version 4.8.176
-
-        Stage ES2015 ToLength semantics (issues 3087, 4244).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-28: Version 4.8.175
-
-        Avoid calling %AddElement with a number out of array index range (issue
-        4516).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-28: Version 4.8.174
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-28: Version 4.8.173
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-28: Version 4.8.172
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-28: Version 4.8.171
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-28: Version 4.8.170
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-28: Version 4.8.169
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-28: Version 4.8.168
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-28: Version 4.8.167
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-28: Version 4.8.166
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-28: Version 4.8.165
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-27: Version 4.8.164
-
-        Update to ES2015 == semantics for Symbol/SIMD wrappers (issue 3593).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-27: Version 4.8.163
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-27: Version 4.8.162
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-27: Version 4.8.161
-
-        Fix deoptimization at ForInStatement::BodyId() (issue 4381).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-27: Version 4.8.160
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-27: Version 4.8.159
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-27: Version 4.8.158
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-27: Version 4.8.157
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-27: Version 4.8.156
-
-        Check that array length stays a safe integer in Array.prototype.push
-        (issue 3087).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-26: Version 4.8.155
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-26: Version 4.8.154
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-26: Version 4.8.153
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-26: Version 4.8.152
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-26: Version 4.8.151
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-26: Version 4.8.150
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-26: Version 4.8.149
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-26: Version 4.8.148
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-25: Version 4.8.147
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-25: Version 4.8.146
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-24: Version 4.8.145
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-24: Version 4.8.144
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-24: Version 4.8.143
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-24: Version 4.8.142
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-23: Version 4.8.141
-
-        Stage ES2015-style const in sloppy mode (issue 3739).
-
-        Map v8::Function to JSReceiver + IsCallable.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-23: Version 4.8.140
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-22: Version 4.8.139
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-22: Version 4.8.138
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-22: Version 4.8.137
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-22: Version 4.8.136
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-22: Version 4.8.135
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-22: Version 4.8.134
-
-        [es6] stage sticky regexps and RegExp.prototype.flags (issue 4342).
-
-        [Crankshaft] Don't do HMathFloorOfDiv optimization for kUint32 values
-        (issue 4507).
-
-        Fix user options for fractional digits in Intl.NumberFormatter (Chromium
-        issue 544122).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-22: Version 4.8.133
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-21: Version 4.8.132
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-21: Version 4.8.131
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-21: Version 4.8.130
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-21: Version 4.8.129
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-21: Version 4.8.128
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-21: Version 4.8.127
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-21: Version 4.8.126
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-21: Version 4.8.125
-
-        [es6] Handle super properly when rewriting arrow parameter initializers
-        (issue 4395).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-21: Version 4.8.124
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-21: Version 4.8.123
-
-        [es6] Fix scoping for default parameters in arrow functions (issue
-        4395).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-21: Version 4.8.122
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-21: Version 4.8.121
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-21: Version 4.8.120
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-20: Version 4.8.119
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-20: Version 4.8.118
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-20: Version 4.8.117
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-20: Version 4.8.116
-
-        Refactor array construction for map, filter (Chromium issue 544991).
-
-        [es6] Fix scoping for default parameters in arrow functions (issue
-        4395).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-20: Version 4.8.115
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-20: Version 4.8.114
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-20: Version 4.8.113
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-20: Version 4.8.112
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-20: Version 4.8.111
-
-        [es6] stage sticky regexps and RegExp.prototype.flags (issue 4342).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.110
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.109
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.108
-
-        ll_prof: Do not use the deprecated tempfile.mktemp() (issue 1306).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.107
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.106
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.105
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.104
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.103
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.102
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.101
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.100
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.99
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.98
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.97
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-19: Version 4.8.96
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-18: Version 4.8.95
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-18: Version 4.8.94
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-18: Version 4.8.93
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-17: Version 4.8.92
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-16: Version 4.8.91
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-16: Version 4.8.90
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-16: Version 4.8.89
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-16: Version 4.8.88
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-16: Version 4.8.87
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-16: Version 4.8.86
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-16: Version 4.8.85
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-16: Version 4.8.84
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-16: Version 4.8.83
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-16: Version 4.8.82
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-16: Version 4.8.81
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-16: Version 4.8.80
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.79
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.78
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.77
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.76
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.75
-
-        Make RegExp use ToLength on lastIndex when flag is turned on (issue
-        4244).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.74
-
-        Take Symbol-keyed properties into account in Object.freeze and friends
-        (Chromium issue 539875).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.73
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.72
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.71
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.70
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.69
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.68
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.67
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-15: Version 4.8.66
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-14: Version 4.8.65
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-14: Version 4.8.64
-
-        Add methods to extras' InternalPackedArray (issue 4276).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-14: Version 4.8.63
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-14: Version 4.8.62
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-14: Version 4.8.61
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-14: Version 4.8.60
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-14: Version 4.8.59
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-14: Version 4.8.58
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-14: Version 4.8.57
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-14: Version 4.8.56
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-14: Version 4.8.55
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-13: Version 4.8.54
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-13: Version 4.8.53
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-13: Version 4.8.52
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-13: Version 4.8.51
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-13: Version 4.8.50
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-13: Version 4.8.49
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-13: Version 4.8.48
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-13: Version 4.8.47
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-13: Version 4.8.46
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-13: Version 4.8.45
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-13: Version 4.8.44
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-12: Version 4.8.43
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-12: Version 4.8.42
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-12: Version 4.8.41
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-12: Version 4.8.40
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-12: Version 4.8.39
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-12: Version 4.8.38
-
-        Test for var declarations in eval which conflict with let (issue 4454).
-
-        Don't compile functions in a context the caller doesn't have access to
-        (Chromium issue 541703).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-12: Version 4.8.37
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-12: Version 4.8.36
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-12: Version 4.8.35
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-11: Version 4.8.34
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-09: Version 4.8.33
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-09: Version 4.8.32
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-09: Version 4.8.31
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-09: Version 4.8.30
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-09: Version 4.8.29
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-09: Version 4.8.28
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-09: Version 4.8.27
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-09: Version 4.8.26
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-09: Version 4.8.25
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-08: Version 4.8.24
-
-        Stage --harmony_sloppy_function (issue 4285).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-08: Version 4.8.23
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-08: Version 4.8.22
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-08: Version 4.8.21
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-08: Version 4.8.20
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-08: Version 4.8.19
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-08: Version 4.8.18
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-08: Version 4.8.17
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-08: Version 4.8.16
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-07: Version 4.8.15
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-07: Version 4.8.14
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-07: Version 4.8.13
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-07: Version 4.8.12
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-07: Version 4.8.11
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-07: Version 4.8.10
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-07: Version 4.8.9
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-07: Version 4.8.8
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-07: Version 4.8.7
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-07: Version 4.8.6
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-07: Version 4.8.5
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-07: Version 4.8.4
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-07: Version 4.8.3
-
-        Destructuring array without initializer throws an exception (issue
-        4462).
-
-        Disable VirtualAlloc randomization on 32-bit Windows hosts (Chromium
-        issue 394591).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-06: Version 4.8.2
-
-        Fix legacy const for-of/in destructuring (issue 4461).
-
-        [es6] Align Promise.resolve with the spec (issues 4161, 4341).
-
-        Prohibit let in lexical bindings (issue 4403).
-
-        Ensure scopes are backed by blocks in the body of for loops (Chromium
-        issues 536750, 536751).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-10-04: Version 4.8.1
-
-        [cross-context] create new function prototypes in the context of the
-        function (issue 4217).
-
-        Fix completion of try..finally (issue 2529).
-
-        Extend Annex B 3.3 sloppy-mode block-scoped hoisting to scripts, eval
-        (issue 4441).
-
-        [V8] Add name of function for function's closure scope (Chromium issue
-        493156).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-17: Version 4.5.2
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-16: Version 4.5.1
-
-        Test that TypedArray methods don't read length (issue 3578).
-
-        Implement %TypedArray%.{fill,find,findIndex} (issue 3578).
-
-        TypedArray.prototype.copyWithin method (issue 3578).
-
-        Provide accessor for object internal properties that doesn't require
-        debugger to be active (Chromium issue 481845).
-
-        Don't create debug context if debug listener is not set (Chromium issue
-        482290).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-13: Version 4.4.65
-
-        Deprecate Isolate::New.
-
-        Factor out core of Array.forEach and .every, for use in TypedArrays
-        (issue 3578).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-12: Version 4.4.64
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-11: Version 4.4.63
-
-        Let Runtime_GrowArrayElements accept non-Smi numbers as |key| (Chromium
-        issue 485410).
-
-        Make one copy for all TypedArray methods (issue 4085).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-09: Version 4.4.62
-
-        [turbofan] Fix handling of OsrLoopEntry in ControlReducer::ConnectNTL()
-        (Chromium issue 485908).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-08: Version 4.4.61
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-08: Version 4.4.60
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-08: Version 4.4.59
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-07: Version 4.4.58
-
-        TypedArray.prototype.every method (issue 3578).
-
-        [V8] Reland https://codereview.chromium.org/1121833003/ (Chromium issue
-        480652).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-07: Version 4.4.57
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-06: Version 4.4.56
-
-        Shard v8_base.lib on Windows to avoid 2G .lib limit (Chromium issue
-        485155).
-
-        Implement a 'trial parse' step, that will abort pre-parsing excessively
-        long and trivial functions, so that they can be eagerly compiled after
-        all. This essentially allows the parser to renege on its earlier
-        decision to lazy-parse, if additional information suggests it was a bad
-        decision (Chromium issue 470930).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-06: Version 4.4.55
-
-        Handle the case when derived constructor is [[Call]]ed with 0 args
-        (Chromium issue 474783).
-
-        freed_nodes in global-handles should be addititive (Chromium issues
-        479796, 484671).
-
-        [V8] Reland https://codereview.chromium.org/1100993003/ (Chromium issue
-        480652).
-
-        [es6] When comparing two symbols we may need to throw a TypeError (issue
-        4073).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-06: Version 4.4.54
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-05: Version 4.4.53
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-05: Version 4.4.52
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-04: Version 4.4.51
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-04: Version 4.4.50
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-01: Version 4.4.49
-
-        Performance and stability improvements on all platforms.
-
-
-2015-05-01: Version 4.4.48
-
-        [V8] Use previous token location as EOS token location (Chromium issue
-        480652).
-
-        Implement kToBeExecutedOnceCodeAge (Chromium issue 470930).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-30: Version 4.4.47
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-30: Version 4.4.46
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-29: Version 4.4.45
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-29: Version 4.4.44
-
-        Pass ArrayBuffer::Allocator via Isolate::CreateParams.
-
-        Fix unobservable constructor replacement on prototype maps (Chromium
-        issue 478522).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-29: Version 4.4.43
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-28: Version 4.4.42
-
-        MIPS: Fix FP load/store with large offsets from base register (Chromium
-        issue 481519).
-
-        Extending v8::GetHeapStatistics to return total available size (Chromium
-        issue 476013).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-28: Version 4.4.41
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-28: Version 4.4.40
-
-        Do more to avoid last-resort stop-the-world GC (Chromium issue 481433).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-27: Version 4.4.39
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-27: Version 4.4.38
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-25: Version 4.4.37
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-24: Version 4.4.36
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-24: Version 4.4.35
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-24: Version 4.4.34
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-23: Version 4.4.33
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-23: Version 4.4.32
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-23: Version 4.4.31
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-22: Version 4.4.30
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-22: Version 4.4.29
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-21: Version 4.4.28
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-21: Version 4.4.27
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-20: Version 4.4.26
-
-        Allow for accessing an ArrayBuffer contents without externalizing it.
-
-        Remove support for externally backed elements from the API (issue 3996).
-
-        Deprecate 3-args ResourceConstraints::ConfigureDefaults.
-
-        Indicate that low-memory-notificatin triggered GCs are "forced".
-
-        Adding missing V8_EXPORT flag in SpaceStatistics class in v8.h (Chromium
-        issues 466141, 476013).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-20: Version 4.4.25
-
-        Turn off SupportsFlexibleFloorAndRound for Arm64 due to a bug (Chromium
-        issue 476477).
-
-        Adding V8 api to get memory statistics of spaces in V8::Heap (Chromium
-        issues 466141, 476013).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-17: Version 4.4.24
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-17: Version 4.4.23
-
-        Don't crash when reporting an access check failure for a detached global
-        proxy (Chromium issue 475884).
-
-        Use smaller heap growing factor in idle notification to start
-        incremental marking when there is idle time >16ms (Chromium issue
-        477323).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-16: Version 4.4.22
-
-        Reduce regexp compiler stack size when not optimizing regexps (Chromium
-        issue 475705).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-15: Version 4.4.21
-
-        Remove support for specifying the number of available threads.
-
-        When converting Maybe and MaybeLocal values with a check, always check.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-15: Version 4.4.20
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-15: Version 4.4.19
-
-        Reland "Remove support for thread-based recompilation" (issue 3608).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-14: Version 4.4.18
-
-        Reland "Remove support for thread-based recompilation" (issue 3608).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-14: Version 4.4.17
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-13: Version 4.4.16
-
-        Expose ArrayBufferView::HasBuffer (issue 3996).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-13: Version 4.4.15
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-12: Version 4.4.14
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-12: Version 4.4.13
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-10: Version 4.4.12
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-10: Version 4.4.11
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-10: Version 4.4.10
-
-        Don't #define snprintf in VS2015 - it's illegal and unneeded (Chromium
-        issue 440500).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-09: Version 4.4.9
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-09: Version 4.4.8
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-08: Version 4.4.7
-
-        Make GetDebugContext a bit more robust (Chromium issue 474538).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-08: Version 4.4.6
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-08: Version 4.4.5
-
-        More robust when allocation fails during compaction (Chromium issue
-        473307).
-
-        MIPS: JSEntryTrampoline: check for stack space before pushing arguments
-        (Chromium issue 469768).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-07: Version 4.4.4
-
-        Debugger: remove debug command API.
-
-        Remove support for thread-based recompilation (issue 3608).
-
-        JSEntryTrampoline: check for stack space before pushing arguments
-        (Chromium issue 469768).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-07: Version 4.4.3
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-06: Version 4.4.2
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-06: Version 4.4.1
-
-        Support for typed arrays added to Heap::RightTrimFixedArray() (Chromium
-        issue 472513).
-
-        Expose an API on ArrayBufferView to copy out content w/o changing the
-        buffer (issue 3996).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-02: Version 4.3.66
-
-        Reland: Fix JSON parser Handle leak (previous CL 1041483004) (issue
-        3976, Chromium issue 472504).
-
-        Turn off overapproximation of the weak closure again (issue 3862).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-01: Version 4.3.65
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-01: Version 4.3.64
-
-        Performance and stability improvements on all platforms.
-
-
-2015-04-01: Version 4.3.63
-
-        [V8] Don't ignore sourceURL comment in inline scripts in .stack (issue
-        3920).
-
-        Deprecate IdleNotification().
-
-        Remove --harmony-numeric-literal flag.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-31: Version 4.3.62
-
-        Put newspace evacuation in an EvacuationScope (Chromium issue 471554).
-
-        Fix libdl dependency on Android and remove librt hack (Chromium issue
-        469973).
-
-        Ensure that GC idle notifications either make progress or stop
-        requesting more GCs (Chromium issue 470615).
-
-        Layout descriptor must be trimmed when corresponding descriptors array
-        is trimmed to stay in sync (Chromium issue 470804).
-
-        Fix JSON parser Handle leak (issue 3976).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-30: Version 4.3.61
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-28: Version 4.3.60
-
-        Reland^2 "Filter invalid slots out from the SlotsBuffer after marking."
-        (Chromium issues 454297, 470801).
-
-        This fixes missing incremental write barrier issue when double fields
-        unboxing is enabled (Chromium issue 469146).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-27: Version 4.3.59
-
-        Use a slot that is located on a heap page when removing invalid entries
-        from the SlotsBuffer (Chromium issue 470801).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-26: Version 4.3.58
-
-        Return timestamp of the last recorded interval to the caller of
-        HeapProfiler::GetHeapStats (Chromium issue 467222).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-26: Version 4.3.57
-
-        Reland [V8] Removed SourceLocationRestrict (Chromium issue 468781).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-25: Version 4.3.56
-
-        Remove v8::Isolate::ClearInterrupt.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-25: Version 4.3.55
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-24: Version 4.3.54
-
-        Do not assign positions to parser-generated desugarings (Chromium issue
-        468661).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-24: Version 4.3.53
-
-        Filter invalid slots out from the SlotsBuffer after marking (Chromium
-        issue 454297).
-
-        Fix OOM bug 3976 (issue 3976).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-24: Version 4.3.52
-
-        Remove calls to IdleNotification().
-
-        Save heap object tracking data in heap snapshot (Chromium issue 467222).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-24: Version 4.3.51
-
-        [V8] Removed SourceLocationRestrict (Chromium issue 468781).
-
-        [turbofan] Fix control reducer bug with walking non-control edges during
-        ConnectNTL phase (Chromium issue 469605).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-23: Version 4.3.50
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-23: Version 4.3.49
-
-        Ensure we don't overflow in BCE (Chromium issue 469148).
-
-        [turbofan] Fix lowering of Math.max for integral inputs (Chromium issue
-        468162).
-
-        Use libdl to get symbols for backtraces.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-19: Version 4.3.48
-
-        Clarify what APIs return Maybe and MaybeLocal values (issue 3929).
-
-        Introduce explicit constant for per Context debug data set by embedder
-        (Chromium issue 466631).
-
-        Adjust key behaviour for weak collections (issues 3970, 3971, Chromium
-        issue 460083).
-
-        Turn on overapproximation of the weak closure (issue 3862).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-18: Version 4.3.47
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-17: Version 4.3.46
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-17: Version 4.3.45
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-17: Version 4.3.44
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-16: Version 4.3.43
-
-        Bugfix in hydrogen GVN (Chromium issue 467481).
-
-        Remove obsolete TakeHeapSnapshot method from API (Chromium issue
-        465651).
-
-        Beautify syntax error for unterminated argument list (Chromium issue
-        339474).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-16: Version 4.3.42
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-15: Version 4.3.41
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-14: Version 4.3.40
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-14: Version 4.3.39
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-14: Version 4.3.38
-
-        Remove --harmony-scoping flag.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-13: Version 4.3.37
-
-        Implement TDZ in StoreIC for top-level lexicals (issue 3941).
-
-        Turn on job-based optimizing compiler (issue 3608).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-13: Version 4.3.36
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-12: Version 4.3.35
-
-        Add Cast() for Int32 and Uint32 (Chromium issue 462402).
-
-        Incorrect handling of HTransitionElementsKind in hydrogen check
-        elimination phase fixed (Chromium issue 460917).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-12: Version 4.3.34
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-12: Version 4.3.33
-
-        Fix the toolchain used to build the snapshots in GN (Chromium issues
-        395249, 465456).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-11: Version 4.3.32
-
-        Reland of Remove slots that point to unboxed doubles from the
-        StoreBuffer/SlotsBuffer (Chromium issues 454297, 465273).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-11: Version 4.3.31
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-11: Version 4.3.30
-
-        Remove uid and title from HeapSnapshot (Chromium issue 465651).
-
-        Remove deprecated CpuProfiler methods.
-
-        [turbofan] Fix --turbo-osr for OSRing into inner loop inside for-in
-        (Chromium issue 462775).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-10: Version 4.3.29
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-10: Version 4.3.28
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-10: Version 4.3.27
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-07: Version 4.3.26
-
-        Remove slots that point to unboxed doubles from the
-        StoreBuffer/SlotsBuffer (Chromium issue 454297).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-06: Version 4.3.25
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-06: Version 4.3.24
-
-        convert more things to maybe (issue 3929).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-05: Version 4.3.23
-
-        [V8] Use Function.name for stack frames in v8::StackTrace (Chromium
-        issue 17356).
-
-        Allow passing sourceMapUrl when compiling scripts (Chromium issue
-        462572).
-
-        convert compile functions to use maybe (issue 3929).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-05: Version 4.3.22
-
-        give UniquePersistent full move semantics (issue 3669).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-05: Version 4.3.21
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-04: Version 4.3.20
-
-        convert remaining object functions to maybes (issue 3929).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-04: Version 4.3.19
-
-        ARM assembler: fix undefined behaviour in fits_shifter (Chromium issues
-        444089, 463436).
-
-        Implement subclassing Arrays (issue 3930).
-
-        [es6] Fix for-const loops (issue 3983).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-04: Version 4.3.18
-
-        Implement subclassing Arrays (issue 3930).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-04: Version 4.3.17
-
-        Implement subclassing Arrays (issue 3930).
-
-        convert more object functions to return maybes (issue 3929).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-03: Version 4.3.16
-
-        check for null context on execution entry (issue 3929).
-
-        convert object::* to return maybe values (issue 3929).
-
-        Removed funky Maybe constructor and made fields private (issue 3929).
-
-        Polish Maybe API a bit, removing useless creativity and fixing some
-        signatures (issue 3929).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-02: Version 4.3.15
-
-        Performance and stability improvements on all platforms.
-
-
-2015-03-02: Version 4.3.14
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-28: Version 4.3.13
-
-        Disallow subclassing Arrays (issue 3930).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-28: Version 4.3.12
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-27: Version 4.3.11
-
-        Disallow subclassing Arrays (issue 3930).
-
-        convert Value::*Value() function to return Maybe results (issue 3929).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-27: Version 4.3.10
-
-        Convert v8::Value::To* to use MaybeLocal (issue 3929).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-26: Version 4.3.9
-
-        Add public version macros (issue 3075).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-26: Version 4.3.8
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-25: Version 4.3.7
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-25: Version 4.3.6
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-25: Version 4.3.5
-
-        Turn on job based recompilation (issue 3608).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-24: Version 4.3.4
-
-        Reland "Correctly propagate terminate exception in TryCall." (issue
-        3892).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-24: Version 4.3.3
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-24: Version 4.3.2
-
-        Update GN build files with the cpu_arch -> current_cpu change.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-23: Version 4.3.1
-
-        Limit size of first page based on serialized data (Chromium issue
-        453111).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-19: Version 4.2.77
-
-        Make generator constructors configurable (issue 3902).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-19: Version 4.2.76
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-18: Version 4.2.75
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-18: Version 4.2.74
-
-        Correctly propagate terminate exception in TryCall (issue 3892).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-17: Version 4.2.73
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-17: Version 4.2.72
-
-        [turbofan] Fix control reducer with re-reducing branches (Chromium issue
-        458876).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-16: Version 4.2.71
-
-        Implement ES6 rest parameters (issue 2159).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-13: Version 4.2.70
-
-        new classes: no longer experimental (issue 3834).
-
-        Make it possible to define arguments for CompileFunctionInContext.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-12: Version 4.2.69
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-11: Version 4.2.68
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-11: Version 4.2.67
-
-        Throw on range error when creating a string via API (issue 3853).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-11: Version 4.2.66
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-10: Version 4.2.65
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-10: Version 4.2.64
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-10: Version 4.2.63
-
-        Introduce a compile method that takes context extensions (Chromium issue
-        456192).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-09: Version 4.2.62
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-09: Version 4.2.61
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-07: Version 4.2.60
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-07: Version 4.2.59
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-07: Version 4.2.58
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-06: Version 4.2.57
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-06: Version 4.2.56
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-06: Version 4.2.55
-
-        Protect against uninitialized lexical variables at top-level (Chromium
-        issue 452510).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-05: Version 4.2.54
-
-        Fix HConstant(double, ...) constructor (issue 3865).
-
-        Add NativeWeakMap to v8.h (Chromium issue 437416).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-05: Version 4.2.53
-
-        Fix issue with multiple properties and emit store (issue 3856).
-
-        Class methods should be non enumerable (issue 3330).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-04: Version 4.2.52
-
-        Add WeakKeyMap to v8.h (Chromium issue 437416).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-04: Version 4.2.51
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-03: Version 4.2.50
-
-        Reset inlining limits due to overly long compilation times in
-        Speedometer, Dart2JS (Chromium issue 454625).
-
-        Add WeakMap to v8.h (Chromium issue 437416).
-
-        [V8] Added line, column and script symbols for SyntaxError (Chromium
-        issue 443140).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-03: Version 4.2.49
-
-        Compute the same hash for all NaN values (issue 3859).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-03: Version 4.2.48
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-02: Version 4.2.47
-
-        Check global object behind global proxy for extensibility (Chromium
-        issue 454091).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-02: Version 4.2.46
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-02: Version 4.2.45
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-01: Version 4.2.44
-
-        Performance and stability improvements on all platforms.
-
-
-2015-02-01: Version 4.2.43
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-31: Version 4.2.42
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-31: Version 4.2.41
-
-        Layout descriptor sharing issue fixed (issue 3832, Chromium issue
-        437713).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-30: Version 4.2.40
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-30: Version 4.2.38
-
-        Move object literal checking into checker classes (issue 3819).
-
-        [turbofan] Fix OSR compilations of for-in.
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-30: Version 4.2.37
-
-        Do not create unresolved variables when parsing arrow functions lazily
-        (issue 3501).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-29: Version 4.2.36
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-29: Version 4.2.35
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-28: Version 4.2.34
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-28: Version 4.2.33
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-27: Version 4.2.32
-
-        Do not generalize field representations when making elements kind or
-        observed transition (Chromium issue 448711).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-27: Version 4.2.31
-
-        [x86] Disable AVX unless the operating system explicitly claims to
-        support it (issue 3846, Chromium issue 452033).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-27: Version 4.2.30
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-26: Version 4.2.29
-
-        MIPS: Fixed Hydrogen environment handling for mul-i ARM and ARM64 (issue
-        451322).
-
-        [turbofan] Simplify reduction if IfTrue and IfFalse and fix bugs
-        (Chromium issue 451958).
-
-        Add HeapNumber fast path to v8::Value::{Uint,Int}32Value() (Chromium
-        issue 446097).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-26: Version 4.2.28
-
-        Fixed Hydrogen environment handling for mul-i on ARM and ARM64 (issue
-        451322).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-25: Version 4.2.27
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-24: Version 4.2.26
-
-        ES6 Array.prototype.toString falls back on Object.prototype.toString if
-        method "join" is not callable (issue 3793).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-23: Version 4.2.25
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-23: Version 4.2.24
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-23: Version 4.2.23
-
-        [x86] Blacklist AVX for Windows versions before 6.1 (Windows 7) (issue
-        3846).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-23: Version 4.2.22
-
-        Fix run-time ARMv6 detection (issue 3844).
-
-        Support concatenating with zero-size arrays with DICTIONARY_ELEMENTS in
-        Runtime_ArrayConcat (Chromium issue 450895).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-22: Version 4.2.21
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-22: Version 4.2.20
-
-        Add a pretty printer to improve the error message non-function calls
-        (Chromium issue 259443).
-
-        Remove implicit uint8_t to char cast in string replace (Chromium issue
-        446196).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-21: Version 4.2.19
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-20: Version 4.2.18
-
-        Fix issue with __proto__ when using ES6 object literals (issue 3818).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-20: Version 4.2.17
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-20: Version 4.2.16
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-19: Version 4.2.15
-
-        Unobscurified OFStream (Chromium issue 448102).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-19: Version 4.2.14
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-18: Version 4.2.13
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-18: Version 4.2.12
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-17: Version 4.2.11
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-16: Version 4.2.10
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-16: Version 4.2.9
-
-        MIPS: ES6 computed property names (issue 3754).
-
-        ES6 computed property names (issue 3754).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-15: Version 4.2.8
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-15: Version 4.2.7
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-15: Version 4.2.6
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-15: Version 4.2.5
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-14: Version 4.2.4
-
-        Auto-generate v8 version based on tags (Chromium issue 446166).
-
-        Remove support for signatures with arguments.
-
-        Add proper support for proxies to HType (Chromium issue 448730).
-
-        [turbofan] Fix truncation/representation sloppiness wrt. bool/bit (issue
-        3812).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-14: Version 4.2.3
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-14: Version 4.2.2
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-14: Version 4.2.1
-
-        Map -0 to integer 0 for typed array constructors (Chromium issue
-        447756).
-
-        Introduce a gyp variable to control whether or not slow dchecks are on.
-
-        Correctly setup the freelist of the coderange on Win64 (Chromium issue
-        447555).
-
-        Fast forward V8 to version 4.2.
-
-        Remove "extra checks".
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-08: Version 3.32.7
-
-        Correctly parse line ends for debugging (issue 2825).
-
-        Fixed printing during DCE (issue 3679).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-08: Version 3.32.6
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-08: Version 3.32.5
-
-        Correct handling of exceptions occured during getting of exception stack
-        trace (Chromium issue 444805).
-
-        Fix bug in Runtime_CompileOptimized resulting from stack overflow
-        (Chromium issue 446774).
-
-        Turn on job-based recompilation (issue 3608).
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-07: Version 3.32.4
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-07: Version 3.32.3
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-07: Version 3.32.2
-
-        Performance and stability improvements on all platforms.
-
-
-2015-01-07: Version 3.32.1
-
-        [turbofan] Don't crash when typing load from a Uint8ClampedArray
-        (Chromium issue 446156).
-
-        [turbofan] Truncation of Bit/Word8/16 to Word32 is a no-op (Chromium
-        issue 445859).
-
-        [x64] Rearrange code for OOB integer loads (Chromium issue 445858).
-
-        Fix %NeverOptimizeFunction() intrinsic (Chromium issue 445732).
-
-        [turbofan] Fix invalid bounds check with overflowing offset (Chromium
-        issue 445267).
-
-        [turbofan] Raise max virtual registers and call parameter limit (issue
-        3786).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-23: Version 3.31.74
-
-        [turbofan] Turn DCHECK for fixed slot index into a CHECK (Chromium issue
-        444681).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-23: Version 3.31.73
-
-        [turbofan] Fix missing ChangeUint32ToUint64 in lowering of LoadBuffer
-        (Chromium issue 444695).
-
-        Enable the embedder to specify what kind of context was disposed.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-22: Version 3.31.72
-
-        [turbofan] Correctify lowering of Uint8ClampedArray buffer access
-        (Chromium issue 444508).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-20: Version 3.31.71
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-20: Version 3.31.70
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-20: Version 3.31.69
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-19: Version 3.31.68
-
-        [turbofan] Fix unsafe out-of-bounds check for checked loads/stores
-        (Chromium issue 443744).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-19: Version 3.31.67
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-19: Version 3.31.66
-
-        Ship ES6 template literals (issue 3230).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-18: Version 3.31.65
-
-        ES6 template literals should not use legacy octal strings (issue 3736).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-18: Version 3.31.64
-
-        Fixed -fsanitize=float-cast-overflow problems (issue 3773).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-18: Version 3.31.63
-
-        ES6 computed property names (issue 3754).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-17: Version 3.31.62
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-17: Version 3.31.61
-
-        ES6: Update unscopables to match spec (issue 3632).
-
-        ES6 computed property names (issue 3754).
-
-        More -fsanitize=vptr fixes (Chromium issue 441099).
-
-        [turbofan] Cache conversions inserted during typed lowering (issue
-        3763).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-16: Version 3.31.60
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-16: Version 3.31.59
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-16: Version 3.31.58
-
-        Ship ES6 classes (issue 3330).
-
-        ES6 computed property names (issue 3754).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-12: Version 3.31.57
-
-        Consistently use only one of virtual/OVERRIDE/FINAL (issue 3753).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-12: Version 3.31.56
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-12: Version 3.31.55
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-11: Version 3.31.54
-
-        Implement Array.from() (issue 3336).
-
-        move v8_use_external_startup_data to standalone.gypi (Chromium issue
-        421063).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-11: Version 3.31.53
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-11: Version 3.31.52
-
-        Ship ES6 block scoping (issue 2198).
-
-        Optimize Object.seal and Object.preventExtensions (issue 3662, Chromium
-        issue 115960).
-
-        Add Array.prototype.includes (issue 3575).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-10: Version 3.31.51
-
-        [x64] Fix optimization for certain checked load/stores (Chromium issue
-        439743).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-09: Version 3.31.50
-
-        Temporarily restore make dependencies.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-09: Version 3.31.49
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-09: Version 3.31.48
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-09: Version 3.31.47
-
-        Temporarily restore make dependencies.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-08: Version 3.31.46
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-08: Version 3.31.45
-
-        Update all DEPS to match chromium's DEPS at edb488e.
-
-        Turn on DCHECKs and other debugging code if dcheck_always_on is 1 (issue
-        3731).
-
-        Optimize GetPrototype.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-05: Version 3.31.44
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-04: Version 3.31.43
-
-        ES6 template literals: Fix issue with template after rbrace (issue
-        3734).
-
-        Stage ES6 template literals (issue 3230).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-04: Version 3.31.42
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-04: Version 3.31.41
-
-        Simplify template literal raw string creation (issue 3710).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-03: Version 3.31.40
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-03: Version 3.31.39
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-03: Version 3.31.38
-
-        Stage ES6 classes and object literal extensions (issue 3330).
-
-        Fixed environment handling for LFlooringDivI on ARM (Chromium issue
-        437765).
-
-        Add GetIdentityHash to v8::Name object API (Chromium issue 437416).
-
-        Set V8_CC_GNU or V8_CC_MSVC for clang in gcc / cl mode (Chromium issue
-        82385).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-02: Version 3.31.37
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-02: Version 3.31.36
-
-        Set V8_CC_GNU or V8_CC_MSVC for clang in gcc / cl mode (Chromium issue
-        82385).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-02: Version 3.31.35
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-01: Version 3.31.34
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-01: Version 3.31.33
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-01: Version 3.31.32
-
-        Performance and stability improvements on all platforms.
-
-
-2014-12-01: Version 3.31.31
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-29: Version 3.31.30
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-28: Version 3.31.29
-
-        Stage @@toStringTag (--harmony-tostring).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-28: Version 3.31.28
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-28: Version 3.31.27
-
-        Ship harmony-strings.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-28: Version 3.31.26
-
-        Abort optimization in corner case (Chromium issue 436893).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-26: Version 3.31.25
-
-        Stage ES6 block scoping (issue 2198).
-
-        Introduce legacy const slots in correct context (Chromium issue 410030).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-26: Version 3.31.24
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-25: Version 3.31.23
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-25: Version 3.31.22
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-24: Version 3.31.21
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-24: Version 3.31.20
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-22: Version 3.31.19
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-21: Version 3.31.18
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-21: Version 3.31.17
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-21: Version 3.31.16
-
-        Cache template literal callSiteObj (issue 3230).
-
-        Rename String.prototype.contains to 'includes'.
-
-        Reserve code range block for evacuation (Chromium issue 430118).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-20: Version 3.31.15
-
-        Rename String.prototype.contains to 'includes'.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-19: Version 3.31.14
-
-        Remove Weak{Map,Set}.prototype.clear.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-19: Version 3.31.13
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-19: Version 3.31.12
-
-        Classes: Expand test to cover strict runtime behavior (issue 3330).
-
-        v8::String::Concat must not throw (Chromium issue 420240).
-
-        Fix disabling all break points from within the debug event callback
-        (Chromium issue 432493).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-18: Version 3.31.11
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-17: Version 3.31.10
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-17: Version 3.31.9
-
-        Expose internal properties of map/set iterators via mirrors.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-17: Version 3.31.8
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-15: Version 3.31.7
-
-        Classes: Add support for stepping through default constructors (issue
-        3674).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-14: Version 3.31.6
-
-        Fix desugaring of let bindings in for loops to handle continue properly
-        (issue 3683).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-14: Version 3.31.5
-
-        Classes: Implement correct name binding (issue 3330).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-14: Version 3.31.4
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-14: Version 3.31.3
-
-        Classes: Cleanup default constructor flag.
-
-        Soft fail for invalid cache data.
-
-        Implement .of() on typed arrays (issue 3578).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-13: Version 3.31.2
-
-        MIPS: Leaving a generator via an exception causes it to close (issue
-        3096).
-
-        MIPS: ES6: Add support for super in object literals (issue 3571).
-
-        Increase the target new space size to the max new space size (issue
-        3626).
-
-        Leaving a generator via an exception causes it to close (issue 3096).
-
-        Correctly compute line numbers in functions from the function
-        constructor (Chromium issue 109362).
-
-        Rename v8::Exception::GetMessage to CreateMessage.
-
-        Classes: Add support for arguments in default constructor (issue 3672).
-
-        ES6: Add support for super in object literals (issue 3571).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-12: Version 3.31.1
-
-        Fix has_constant_parameter_count() confusion in LReturn (Chromium issue
-        431602).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-05: Version 3.30.33
-
-        `1..isPrototypeOf.call(null)` should return false, not throw TypeError
-        (issue 3483).
-
-        Refactor ObjectGetOwnPropertyKeys to accept bitmask rather than boolean
-        (issue 3549).
-
-        Add debug mirror support for ES6 Map/Set iterators (Chromium issue
-        427868).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-04: Version 3.30.30
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-02: Version 3.30.27
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-02: Version 3.30.26
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-01: Version 3.30.25
-
-        Performance and stability improvements on all platforms.
-
-
-2014-11-01: Version 3.30.24
-
-        Ensure we don't try to inline raw access to indexed interceptor
-        receivers (Chromium issue 419220).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-31: Version 3.30.23
-
-        Introduce v8::Exception::GetMessage to find location of an error object
-        (Chromium issue 427954).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-30: Version 3.30.22
-
-        MIPS: Classes: Add super support in methods and accessors (issue 3330).
-
-        Classes: Add super support in methods and accessors (issue 3330).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-29: Version 3.30.21
-
-        MIPS: Classes: Add basic support for properties (issue 3330).
-
-        Classes: Add more tests for prototype edge cases (Chromium issue 3655).
-
-        Classes: Add test for method prototype (issue 3330).
-
-        Get stack trace for uncaught exceptions/promise rejections from the
-        simple stack when available.
-
-        Classes: Add basic support for properties (issue 3330).
-
-        Allow duplicate property names in classes (issue 3570).
-
-        Windows: use SystemTimeToTzSpecificLocalTime instead of localtime_s
-        (Chromium issue 417640).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-28: Version 3.30.20
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-27: Version 3.30.19
-
-        Check string literals with escapes in PreParserTraits::GetSymbol()
-        (issue 3606).
-
-        only define ARRAYSIZE_UNSAFE for NaCl builds (Chromium issue 405225).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-24: Version 3.30.18
-
-        Narrow cases where Sparse/Smart versions of Array methods are used
-        (issues 2615, 3612, 3621).
-
-        Shrink new space in idle notification (Chromium issue 424423).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-23: Version 3.30.17
-
-        ARM64: Fix stack manipulation (Chromium issue 425585).
-
-        Speed up creation of Objects whose prototype has dictionary elements
-        (Chromium issue 422754).
-
-        Enable libstdc++ debug mode in debug builds (issue 3638).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-22: Version 3.30.16
-
-        Remove v8stdint.h, it doesn't serve a purpose anymore.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-21: Version 3.30.15
-
-        Avoid the Marsaglia effect in 3D (Chromium issue 423311).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-20: Version 3.30.14
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-17: Version 3.30.13
-
-        Don't expose Array.prototype.values as it breaks webcompat (Chromium
-        issue 409858).
-
-        Fix break location calculation (Chromium issue 419663).
-
-        Enable libstdc++ debug mode in debug builds (issue 3638).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-17: Version 3.30.12
-
-        Implement .forEach() on typed arrays (issue 3578).
-
-        Introduce v8::Exception::GetStackTrace API method.
-
-        Remove SmartMove, bringing Array methods further into spec compliance
-        (issue 2615).
-
-        Convert argument toObject() in Object.getOwnPropertyNames/Descriptors
-        (issue 3443).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-15: Version 3.30.11
-
-        Array.prototype.{every, filter, find, findIndex, forEach, map, some}:
-        Use fresh primitive wrapper for calls (issue 3536).
-
-        Correctly expand literal buffer for surrogate pairs (Chromium issue
-        423212).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-15: Version 3.30.10
-
-        Squeeze the layout of various AST node types (Chromium issue 417697).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-14: Version 3.30.9
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-13: Version 3.30.8
-
-        AST nodes have at most one bailout/typefeedback ID now, saving lots of
-        memory (Chromium issue 417697).
-
-        Allow identifier code points from supplementary multilingual planes
-        (issue 3617).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-10: Version 3.30.7
-
-        Fix computation of UTC time from local time at DST change points (issue
-        3116, Chromium issues 415424, 417640).
-
-        Convert `obj` ToObject in Object.keys() (issue 3587).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-09: Version 3.30.6
-
-        Update unicode to 7.0.0 (issue 2892).
-
-        Classes: Add support for toString (issue 3330).
-
-        Don't enable WPO on Win64 and require Server 2003 / x64 for win64
-        (Chromium issue 421363).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-08: Version 3.30.5
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-08: Version 3.30.4
-
-        This uses a runtime function to set up the the constructor and its
-        prototype (issue 3330).
-
-        Remove PersistentBase::ClearAndLeak.
-
-        Squeeze the layout of variable proxy nodes (Chromium issue 417697).
-
-        Add MonotonicallyIncreasingTime to V8 Platform (Chromium issue 417668).
-
-        Fix representation of HLoadRoot (Chromium issue 419036).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-03: Version 3.30.3
-
-        Removed the Isolate* field from literal nodes (Chromium issue 417697).
-
-        Squeeze the layout of expression nodes a bit (Chromium issue 417697).
-
-        Merged FeedbackSlotInterface into AstNode, removing the need for a 2nd
-        vtable (Chromium issue 417697).
-
-        Extend CPU profiler with mapping ticks to source lines.
-
-        Remove support for parallel sweeping.
-
-        Introduce v8::Object::GetIsolate().
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-02: Version 3.30.2
-
-        Fix Hydrogen's BuildStore() (Chromium issue 417508).
-
-        Move unit tests to test/unittests (issue 3489).
-
-        Changes to ALLOW_UNUSED to match upcoming changes to the Chromium trunk:
-        * Eliminate usage of ALLOW_UNUSED to define COMPILE_ASSERT and just use
-        static_assert() in all cases now that all platforms build with C++11. *
-        Convert remaining uses of ALLOW_UNUSED to ALLOW_UNUSED_TYPE to match how
-        Chromium will be splitting this functionality.  (In Chromium we'll have
-        both   ALLOW_UNUSED_TYPE and ALLOW_UNUSED_LOCAL, which have different
-        syntax to   enable us to use these with MSVC.) (Chromium issue 81439).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-10-01: Version 3.30.1
-
-        Introduce PromiseRejectCallback (issue 3093).
-
-        ES6: Implement object literal property shorthand (issue 3584).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-30: Version 3.29.93
-
-        Add a getter for the address and size of the code range to the pulic API
-        (issue 3598).
-
-        Convert `obj` ToObject in Object.keys() (issue 3587).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-29: Version 3.29.92
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-26: Version 3.29.91
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-25: Version 3.29.88
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-24: Version 3.29.87
-
-        Preserve message when rethrowing exception (issue 3583).
-
-        Fix escaped index JSON parsing (Chromium issue 416449).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-23: Version 3.29.84
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-23: Version 3.29.83
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-23: Version 3.29.82
-
-        Fix escaped index JSON parsing (Chromium issue 416449).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-17: Version 3.29.70
-
-        Enable ES6 generators (issue 2355).
-
-        Fixed int vs. uintptr_t confusion (plus some cleanup on the way) (issue
-        3556).
-
-        Move configuration of ResourceConstraints to Isolate construction.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-16: Version 3.29.66
-
-        Currently, a new isolate is created in an uninitialized state, and
-        several API methods will automatically initialize it. During this
-        uninitialized state, code event handlers and function entry handlers can
-        be attached to the isolate.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-15: Version 3.29.64
-
-        ES6: String(symbol) should work like symbol.toString (issue 3554).
-
-        Arrow functions: Cleanup handling of the prototype property (issue
-        2700).
-
-        Remove V8_HOST_CAN_READ_UNALIGNED and its uses (Chromium issue 412967).
-
-        Fix Smi vs. HeapObject confusion in HConstants (Chromium issue 412215).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-12: Version 3.29.59
-
-        Do not use wide reads in CopyCharsUnsigned (Chromium issue 412967).
-
-        Fix inaccurate type condition in Hydrogen (Chromium issue 412210).
-
-        Fix crash in ScriptDebugServer::wrapCallFrames (Chromium issue 411196).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-11: Version 3.29.57
-
-        ES6: Add support for method shorthand in object literals (issue 3516).
-
-        Unbreak FreeBSD build (hopefully) (issue 3548).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-09: Version 3.29.53
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-08: Version 3.29.50
-
-        Allocate a new empty number dictionary when resetting elements (Chromium
-        issue 410332).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-05: Version 3.29.43
-
-        Enforce correct number comparisons when inlining Array.indexOf (Chromium
-        issue 407946).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-04: Version 3.29.41
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-03: Version 3.29.40
-
-        Use correct receiver for DOM accessors on the prototype chain (issue
-        3538).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-02: Version 3.29.38
-
-        Do not clear weak monomorphic IC after context disposal (Chromium issue
-        404020).
-
-        Turn on job-based sweeping (issue 3104).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-09-01: Version 3.29.35
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-29: Version 3.29.29
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-28: Version 3.29.27
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-28: Version 3.29.25
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-28: Version 3.29.24
-
-        Tweaks to generate XP-compatible .exes (Chromium issue 407517).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-28: Version 3.29.23
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-27: Version 3.29.20
-
-        Handle empty allocation list in CodeRange properly (issue 3540, Chromium
-        issue 407566).
-
-        Fixed inlining of constant values (issue 3529).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-25: Version 3.29.17
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-24: Version 3.29.16
-
-        Fix issue with numeric property names (issue 3507).
-
-        Add back the duplicate property checker (issue 3498).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-22: Version 3.29.14
-
-        Don't inline Array.shift() if receiver map is not extensible (Chromium
-        issue 405517).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-21: Version 3.29.11
-
-        Refactor ParseObjectLiteral.
-
-        Support symbol-named properties in API (issue 3394).
-
-        Suppress test262 test that tests duplicate properties.
-
-        ES6: Duplicate properties are no longer an error (issue 3498).
-
-        Expose function CheckDebugBreak in the debugger api.
-
-        Remove RegExp.$input (issue 3486).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-21: Version 3.29.10
-
-        ES6: Make sure we do not store -0 as the key in Map/Set (issue 3515).
-
-        Remove removed flags from tests.
-
-        Expose well-known Symbols to C++ API (Chromium issue 341423).
-
-        Implement ES6 Array.of() (issue 3427).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-20: Version 3.29.9
-
-        Correctly handle holes when concat()ing double arrays (Chromium issue
-        403409).
-
-        [turbofan] Refactor the InstructionSelector tests (issue 3489).
-
-        ES6: Make Map/Set constructors support iterable values (issue 3508).
-
-        WeakMap/WeakSet: Add test for non object keys (issue 3399).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-12: Version 3.28.71
-
-        ToNumber(Symbol) should throw TypeError (issue 3499).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-11: Version 3.28.69
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-09: Version 3.28.65
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-08: Version 3.28.64
-
-        ES6: Implement WeakMap and WeakSet constructor logic (issue 3399).
-
-        Enable ES6 unscopables (issue 3401).
-
-        Turn on harmony_unscopables for es_staging (issue 3401).
-
-        Remove proxies from --harmony switch for M38, because problems.
-
-        Reland "Add initial support for compiler unit tests using GTest/GMock."
-        (issue 3489).
-
-        Enable ES6 iteration by default (issue 2214).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-07: Version 3.28.62
-
-        Only escape U+0022 in argument values of `String.prototype` HTML methods
-        (issue 2217).
-
-        Update webkit test for expected own properties.
-
-        This implements unscopables (issue 3401).
-
-        Add `CheckObjectCoercible` for the `String.prototype` HTML methods
-        (issue 2218).
-
-        Add initial support for compiler unit tests using GTest/GMock (issue
-        3489).
-
-        Trigger exception debug events on Promise reject (Chromium issue
-        393913).
-
-        Refactor unit tests for the base library to use GTest (issue 3489).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-06: Version 3.28.60
-
-        Enable ES6 Map and Set by default (issue 1622).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-06: Version 3.28.59
-
-        Removed GetConstructor from the API. Instead either get the
-        "constructor" property stored in the prototype, or keep a side-table.
-
-        Enable ES6 Symbols by default (issue 2158).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-05: Version 3.28.57
-
-        Add dependencies on gtest and gmock.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-04: Version 3.28.54
-
-        Performance and stability improvements on all platforms.
-
-
-2014-08-01: Version 3.28.53
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-31: Version 3.28.52
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-31: Version 3.28.51
-
-        Drop deprecated memory related notification API (Chromium issue 397026).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-31: Version 3.28.50
-
-        Use emergency memory in the case of out of memory during evacuation
-        (Chromium issue 395314).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-30: Version 3.28.48
-
-        Fix Object.freeze with field type tracking. Keep the descriptor properly
-        intact while update the field type (issue 3458).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-29: Version 3.28.45
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-28: Version 3.28.43
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-25: Version 3.28.38
-
-        Fix issue with setters and their holders in accessors.cc (Chromium issue
-        3462).
-
-        Introduce more debug events for promises (issue 3093).
-
-        Move gc notifications from V8 to Isolate and make idle hint mandatory
-        (Chromium issue 397026).
-
-        The accessors should get the value from the holder and not from this
-        (issue 3461).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-24: Version 3.28.35
-
-        Rebaseline/update the intl tests with ICU 52 (issue 3454).
-
-        Expose the content of Sets and WeakSets through SetMirror (issue 3093).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-23: Version 3.28.32
-
-        Update ICU to 5.2 (matching chromium) (issue 3452).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-22: Version 3.28.31
-
-        Remove harmony-typeof.
-
-        Implement String.prototype.codePointAt and String.fromCodePoint (issue
-        2840).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-21: Version 3.28.30
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-21: Version 3.28.29
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-18: Version 3.28.28
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-17: Version 3.28.26
-
-        Ship ES6 Math functions (issue 2938).
-
-        Make ToPrimitive throw on symbol wrappers (issue 3442).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-16: Version 3.28.25
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-16: Version 3.28.24
-
-        Removed some copy-n-paste from StackFrame::Foo API entries (issue 3436).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-15: Version 3.28.23
-
-        Fix error message about read-only symbol properties (issue 3441).
-
-        Include symbol properties in Object.{create,defineProperties} (issue
-        3440).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-14: Version 3.28.22
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-11: Version 3.28.21
-
-        Make `let` usable as an identifier in ES6 sloppy mode (issue 2198).
-
-        Support ES6 Map and Set in heap profiler (issue 3368).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-10: Version 3.28.20
-
-        Remove deprecate counter/histogram methods.
-
-        Fixed printing of external references (Chromium issue 392068).
-
-        Fix several issues with ES6 redeclaration checks (issue 3426).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-09: Version 3.28.19
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-09: Version 3.28.18
-
-        Reland "Postpone termination exceptions in debug scope." (issue 3408).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-08: Version 3.28.17
-
-        MIPS: Fix computed properties on object literals with a double as
-        propertyname (Chromium issue 390732).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-08: Version 3.28.16
-
-        Fix computed properties on object literals with a double as propertyname
-        (Chromium issue 390732).
-
-        Avoid brittle use of .bind in Promise.all (issue 3420).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-07: Version 3.28.15
-
-        Remove a bunch of Isolate::UncheckedCurrent calls.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-07: Version 3.28.14
-
-        Use the HeapObjectIterator to scan-on-scavenge map pages (Chromium issue
-        390732).
-
-        Introduce debug events for Microtask queue (Chromium issue 272416).
-
-        Split out libplatform into a separate libary.
-
-        Add clang-format to presubmit checks.
-
-        Stack traces exposed to Javascript should omit extensions (issue 311).
-
-        Remove deprecated v8::Context::HasOutOfMemoryException.
-
-        Postpone termination exceptions in debug scope (issue 3408).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-04: Version 3.28.13
-
-        Rollback to r22134.
-
-
-2014-07-04: Version 3.28.12
-
-        Use the HeapObjectIterator to scan-on-scavenge map pages (Chromium issue
-        390732).
-
-        Introduce debug events for Microtask queue (Chromium issue 272416).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-03: Version 3.28.11
-
-        Split out libplatform into a separate libary.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-03: Version 3.28.10
-
-        Add clang-format to presubmit checks.
-
-        Stack traces exposed to Javascript should omit extensions (issue 311).
-
-        Remove deprecated v8::Context::HasOutOfMemoryException.
-
-        Postpone termination exceptions in debug scope (issue 3408).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-02: Version 3.28.9
-
-        Make freeze & friends ignore private properties (issue 3419).
-
-        Introduce a builddeps make target (issue 3418).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-07-01: Version 3.28.8
-
-        Remove static initializer from isolate.
-
-        ES6: Add missing Set.prototype.keys function (issue 3411).
-
-        Introduce debug events for promises (issue 3093).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-30: Version 3.28.7
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-30: Version 3.28.6
-
-        Unbreak "os" stuff in shared d8 builds (issue 3407).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-26: Version 3.28.4
-
-        Compile optimized code with active debugger but no break points
-        (Chromium issue 386492).
-
-        Optimize Map/Set.prototype.forEach.
-
-        Collect garbage with kReduceMemoryFootprintMask in IdleNotification
-        (Chromium issue 350720).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-26: Version 3.28.3
-
-        Grow heap slower if GC freed many global handles (Chromium issue
-        263503).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-25: Version 3.28.2
-
-        Remove bogus assertions in HCompareObjectEqAndBranch (Chromium issue
-        387636).
-
-        Do not eagerly update allow_osr_at_loop_nesting_level (Chromium issue
-        387599).
-
-        Set host_arch to ia32 on machines with a 32bit userland but a 64bit
-        kernel (Chromium issue 368384).
-
-        Map/Set: Implement constructor parameter handling (issue 3398).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-24: Version 3.28.1
-
-        Support LiveEdit on Arm64 (Chromium issue 368580).
-
-        Run JS micro tasks in the appropriate context (Chromium issue 385349).
-
-        Add a use counter API.
-
-        Set host_arch to ia32 on machines with a 32bit userland but a 64bit
-        kernel.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-23: Version 3.28.0
-
-        MIPS: Support LiveEdit (Chromium issue 368580).
-
-        Array.concat: properly go to dictionary mode when required (Chromium
-        issue 387031).
-
-        Support LiveEdit on ARM (Chromium issue 368580).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-18: Version 3.27.34
-
-        Reduce number of writes to DependentCode array when inserting dependent
-        IC (Chromium issue 305878).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-17: Version 3.27.33
-
-        Do GC if CodeRange fails to allocate a block (Chromium issue 305878).
-
-        Throw syntax error when a getter/setter has the wrong number of params
-        (issue 3371).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-17: Version 3.27.32
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-16: Version 3.27.31
-
-        Version fix.
-
-
-2014-06-16: Version 3.27.30
-
-        Fix representation of Phis for mutable-heapnumber-in-object-literal
-        properties (issue 3392).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-16: Version 3.27.29
-
-        Emulate MLS on pre-ARMv6T2. Cleaned up thumbee vs. thumb2 confusion.
-
-        X87: Fixed flooring division by a power of 2, once again.. (issue 3259).
-
-        Fixed undefined behavior in RNG (Chromium issue 377790).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-13: Version 3.27.28
-
-        Add v8::Promise::Then (Chromium issue 371288).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-12: Version 3.27.27
-
-        Fix detection of VFP3D16 on Galaxy Tab 10.1 (issue 3387).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-12: Version 3.27.26
-
-        MIPS: Fixed flooring division by a power of 2, once again.. (issue
-        3259).
-
-        Fixed flooring division by a power of 2, once again.. (issue 3259).
-
-        Fix unsigned comparisons (issue 3380).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-11: Version 3.27.25
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-11: Version 3.27.24
-
-        Fix invalid attributes when generalizing because of incompatible map
-        change (Chromium issue 382143).
-
-        Fix missing smi check in inlined indexOf/lastIndexOf (Chromium issue
-        382513).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-06: Version 3.27.23
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-06: Version 3.27.22
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-06: Version 3.27.21
-
-        Turn on harmony_collections for es_staging (issue 1622).
-
-        Do not make heap iterable eagerly (Chromium issue 379740).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-05: Version 3.27.20
-
-        Fix invalid loop condition for Array.lastIndexOf() (Chromium issue
-        380512).
-
-        Add API support for passing a C++ function as a microtask callback.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-04: Version 3.27.19
-
-        Split Put into Put and Remove.
-
-        ES6: Add support for values/keys/entries for Map and Set (issue 1793).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-03: Version 3.27.18
-
-        Remove PROHIBITS_OVERWRITING as it is subsumed by non-configurable
-        properties.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-06-02: Version 3.27.17
-
-        BuildNumberToString: Check for undefined keys in the cache (Chromium
-        issue 368114).
-
-        HRor and HSar can deoptimize (issue 3359).
-
-        Simplify, speed-up correct-context ObjectObserve calls.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-29: Version 3.27.16
-
-        Allow microtasks to throw exceptions and handle them gracefully
-        (Chromium issue 371566).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-28: Version 3.27.15
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-27: Version 3.27.14
-
-        Reland "Customized support for feedback on calls to Array." and follow-
-        up fixes (Chromium issues 377198, 377290).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-26: Version 3.27.13
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-26: Version 3.27.12
-
-        Check for cached transition to ExternalArray elements kind (issue 3337).
-
-        Support ES6 weak collections in heap profiler (Chromium issue 376196).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-23: Version 3.27.11
-
-        Add support for ES6 Symbol in heap profiler (Chromium issue 376194).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-22: Version 3.27.10
-
-        Implement Mirror object for Symbols (issue 3290).
-
-        Allow debugger to step into Map and Set forEach callbacks (issue 3341).
-
-        Fix ArrayShift hydrogen support (Chromium issue 374838).
-
-        Use SameValueZero for Map and Set (issue 1622).
-
-        Array Iterator next should check for own property.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-21: Version 3.27.9
-
-        Disable ArrayShift hydrogen support (Chromium issue 374838).
-
-        ES6 Map/Set iterators/forEach improvements (issue 1793).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-20: Version 3.27.8
-
-        Move microtask queueing logic from JavaScript to C++.
-
-        Partial revert of "Next bunch of fixes for check elimination" (Chromium
-        issue 372173).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-19: Version 3.27.7
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-19: Version 3.27.6
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-16: Version 3.27.5
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-15: Version 3.27.4
-
-        Drop thenable coercion cache (Chromium issue 372788).
-
-        Skip write barriers when updating the weak hash table (Chromium issue
-        359401).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-14: Version 3.27.3
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-13: Version 3.27.2
-
-        Harden %SetIsObserved with RUNTIME_ASSERTs (Chromium issue 371782).
-
-        Drop unused static microtask API.
-
-        Introduce an api to query the microtask autorun state of an isolate.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-12: Version 3.27.1
-
-        Object.observe: avoid accessing acceptList properties more than once
-        (issue 3315).
-
-        Array Iterator prototype should not have a constructor (issue 3293).
-
-        Fix typos in unit test for Array.prototype.fill().
-
-        Shorten autogenerated error message for functions only (issue 3019,
-        Chromium issue 331971).
-
-        Reland "Removed default Isolate." (Chromium issue 359977).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-09: Version 3.27.0
-
-        Unbreak samples and tools.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-08: Version 3.26.33
-
-        Removed default Isolate (Chromium issue 359977).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-07: Version 3.26.32
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-06: Version 3.26.31
-
-        Add a basic gn file for V8.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-05: Version 3.26.30
-
-        Introduce a microtask suppression scope and move microtask methods to
-        isolate (Chromium issue 369503).
-
-        Re-enable Object.observe and add enforcement for security invariants.
-
-        Move cache line size calculation directly into CPU::FlushICache
-        (Chromium issue 359977).
-
-        Generation of our home-grown memmove doesn't depend on serializer state
-        anymore (Chromium issue 359977).
-
-        Fix |RunMicrotasks()| leaking reference to the last context being run
-        on.
-
-        Object.defineProperty shouldn't be a hint that we're constructing a
-        dictionary (Chromium issue 362870).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-05-01: Version 3.26.29
-
-        Added a Isolate* parameter to Serializer::enabled() (Chromium issue
-        359977).
-
-        ES6: Add support for Array.prototype.fill() (issue 3273).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-29: Version 3.26.28
-
-        PromiseThen should ignore non-function parameters (Chromium issue
-        347455).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-29: Version 3.26.27
-
-        Error stack getter should not overwrite itself with a data property
-        (issue 3294).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-28: Version 3.26.26
-
-        Expose promise value through promise mirror (issue 3093).
-
-        Simplified CPU/CpuFeatures a bit (Chromium issue 359977).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-28: Version 3.26.25
-
-        Add timestamps to CPU profile samples (Chromium issue 363976).
-
-        Expose promise status through promise mirror (issue 3093).
-
-        Remove static CallCompletedCallback handlers.
-
-        Added an Isolate* field to NoTrackDoubleFieldsForSerializerScope,
-        PlatformFeatureScope and BinaryOpIC::State (Chromium issue 359977).
-
-        Trigger debug event on not yet caught exception in promises (issue
-        3093).
-
-        Unbreak vtunejit=on (issue 3288).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-25: Version 3.26.24
-
-        MIPS: CodeStubs contain their corresponding Isolate* now. (part 2)
-        (Chromium issue 359977).
-
-        MIPS: CodeStubs contain their corresponding Isolate* now. (part 1)
-        (Chromium issue 359977).
-
-        CodeStubs contain their corresponding Isolate* now. (part 2) (Chromium
-        issue 359977).
-
-        Make DescriptorArray::IsMoreGeneralThan() and DescriptorArray::Merge()
-        compatible again (Chromium issue 365172).
-
-        CodeStubs contain their corresponding Isolate* now. (part 1) (Chromium
-        issue 359977).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-24: Version 3.26.23
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-23: Version 3.26.22
-
-        Disable field type tracking by default (Chromium issue 365172).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-23: Version 3.26.21
-
-        Context-allocate all parameters in generators (issue 3280).
-
-        Simplify v8/Isolate teardown (Chromium issue 359977).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-21: Version 3.26.20
-
-        ES6: Add support for Map/Set forEach (Chromium issues 1793, 2323).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-18: Version 3.26.19
-
-        ES6: Add support for Map/Set forEach (Chromium issues 1793, 2323).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-17: Version 3.26.18
-
-        Removed Isolate::EnterDefaultIsolate (Chromium issue 359977).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-16: Version 3.26.17
-
-        Clear invalid field maps in PropertyAccessInfo (Chromium issue 363956).
-
-        ES6: Add support for Map/Set forEach (Chromium issues 1793, 2323).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-16: Version 3.26.16
-
-        Removed EnterIsolateIfNeeded and a soon-to-be-useless assertion
-        (Chromium issue 359977).
-
-        Removed GetDefaultIsolate{Debugger,ForLocking,StackGuard} (Chromium
-        issue 359977).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-15: Version 3.26.15
-
-        Fix result of LCodeGen::DoWrapReceiver for strict functions and builtins
-        (Chromium issue 362128).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-15: Version 3.26.14
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-14: Version 3.26.13
-
-        Make maps in monomorphic IC stubs weak (issue 2073).
-
-        x64: Make sure that the upper half of a 64bit register contains 0 for
-        int32 values (Chromium issue 360611).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-11: Version 3.26.12
-
-        Do not use ranges after range analysis (Chromium issue 361608).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-10: Version 3.26.11
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-10: Version 3.26.10
-
-        Allow the embedder to pass the virtual memory limit to v8.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-09: Version 3.26.9
-
-        Fix invalid local property lookup for transitions (Chromium issue
-        361025).
-
-        MIPS: Fixed flooring division by -1 (issue 3259).
-
-        Fixed flooring division by -1 on ARM (issue 3259).
-
-        Make `String.prototype.contains` throw when passing a regular expression
-        (issue 3261).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-08: Version 3.26.8
-
-        Yet another regression test for range analysis (issue 3204).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-07: Version 3.26.7
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-04: Version 3.26.6
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-03: Version 3.26.5
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-03: Version 3.26.4
-
-        Make stray 'return' an early error.
-
-        Show references from weak containers as weak in heap snapshots (Chromium
-        issue 356590).
-
-        Make invalid LHSs that are calls late errors (Chromium issue 358346).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-02: Version 3.26.3
-
-        Support typed arrays in IsMoreGeneralElementsKindTransition (Chromium
-        issue 357054).
-
-        Remove debugger_auto_break flag.
-
-        Store i18n meta data in hidden symbols instead of js accessible
-        properties (Chromium issue 354967).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-01: Version 3.26.2
-
-        Performance and stability improvements on all platforms.
-
-
-2014-04-01: Version 3.26.1
-
-        Fix Type::Intersect to skip uninhabited bitsets (Chromium issue 357330).
-
-        Fix PrepareKeyedOperand on arm (Chromium issue 358057).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-31: Version 3.26.0
-
-        Deprecate Start/StopCpuProfiling methods (issue 3213).
-
-        Don't crash if we get a timezone change notification on an uninitialized
-        isolate (Chromium issue 357362).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-28: Version 3.25.30
-
-        NativeContext::map_cache reference should be strong in heap snapshots
-        (Chromium issue 357060).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-27: Version 3.25.29
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-27: Version 3.25.28
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-26: Version 3.25.27
-
-        Promise constructor should not be enumerable (Chromium issue 352597).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-26: Version 3.25.26
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-25: Version 3.25.25
-
-        Roll ICU 239289:258359 and add support for external ICU data tables
-        (issue 3142, Chromium issue 72633).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-25: Version 3.25.24
-
-        Add support for per-isolate private symbols.
-
-        No longer OOM on invalid string length (issue 3060).
-
-        Remove Failure::OutOfMemory propagation and
-        V8::IgnoreOutOfMemoryException (issue 3060).
-
-        Tentative Windows dll build fix: Don't V8_EXPORT ScriptCompiler::Source
-        (issue 3228).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-24: Version 3.25.23
-
-        Rename A64 port to ARM64 port (Chromium issue 354405).
-
-        Fix missing access check in Runtime_SetPrototype (Chromium issue
-        354123).
-
-        Fix polymorphic hydrogen handling of SLOPPY_ARGUMENTS_ELEMENTS (Chromium
-        issue 354391).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-20: Version 3.25.22
-
-        Increase the "local variables in a function" limit (issue 3205).
-
-        Implement ES6 symbol registry and predefined symbols.
-
-        Throw exception on invalid string length instead of OOM (Chromium issue
-        349329).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-20: Version 3.25.21
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-20: Version 3.25.20
-
-        Fix polymorphic keyed loads for SLOPPY_ARGUMENTS_ELEMENTS (Chromium
-        issue 350867).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-19: Version 3.25.19
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-19: Version 3.25.18
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-19: Version 3.25.17
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-18: Version 3.25.16
-
-        Apply numeric casts correctly in typed arrays and related code (Chromium
-        issue 353004).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-18: Version 3.25.15
-
-        Don't generate keyed store ICs for global proxies (Chromium issue
-        352983).
-
-        MIPS: Make invalid LHSs a parse-time (reference) error (Chromium issue
-        351658).
-
-        Make invalid LHSs a parse-time (reference) error (Chromium issue
-        351658).
-
-        Add Promises/A+ Compliance Test Suite (Chromium issue 347095).
-
-        Split Promise API into Promise/Resolver.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-17: Version 3.25.14
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-17: Version 3.25.13
-
-        Move profiler callback interfaces from v8.h to v8-profiler.h.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-14: Version 3.25.12
-
-        PromiseCoerce should deal with an error during accessing "then"
-        (Chromium issue 347095).
-
-        Propagate updated offsets in BoundsCheckBbData (Chromium issue 350863).
-
-        Add regression test for range analysis bug (issue 3204).
-
-        Continued fix for 351257. Reusing the feedback vector is too complex
-        (Chromium issue 351257).
-
-        StopCpuProfiling should return non-const CpuProfile (issue 3213).
-
-        Allow for compiling with xcode 5.1 (which doesn't have gcc anymore).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-14: Version 3.25.11
-
-        MIPS: Remove uses of CanBeNegative() in HMod (issue 3204).
-
-        MIPS: Remove uses of RangeCanInclude() in flooring division by power of
-        2 (issue 3204).
-
-        MIPS: Fix uses of range analysis results in HChange (issue 3204).
-
-        Make translation of modulus operation '--stress-opt'-proof (Chromium
-        issue 352059).
-
-        Remove uses of CanBeNegative() in HMod (issue 3204).
-
-        Remove uses of RangeCanInclude() in flooring division by power of 2
-        (issue 3204).
-
-        Fix uses of range analysis results in HChange (issue 3204).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-14: Version 3.25.10
-
-        This version was not committed due to script failures.
-
-
-2014-03-13: Version 3.25.9
-
-        Reland "Enable Object.observe by default" again (issue 2409).
-
-        Use intrinsics for builtin ArrayBuffer property accesses (Chromium issue
-        351787).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-12: Version 3.25.8
-
-        Fix HIsSmiAndBranch::KnownSuccessorBlock() by deleting it (Chromium
-        issue 351320).
-
-        Fix handling of polymorphic array accesses with constant index (Chromium
-        issue 351319).
-
-        Fix lazy deopt after tagged binary ops (Chromium issue 350434).
-
-        MIPS: Cleanup some of the range uses in ModI/DivI (issue 3204).
-
-        Fix issue with getOwnPropertySymbols and hidden properties (Chromium
-        issue 350864).
-
-        Cleanup some of the range uses in ModI/DivI (issue 3204).
-
-        PromiseCoerce should ignore primitive values (Chromium issue 347095).
-
-        Use a per-isolate cache for the date object JS bits (Chromium issue
-        348856).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-11: Version 3.25.7
-
-        Promise.all and Promise.race should reject non-array parameter (Chromium
-        issue 347453).
-
-        Promise.all and Promise race should use "then" rather than "chain"
-        (Chromium issue 347427).
-
-        Merge the "Compute Minus Zero Checks" phase into the range analysis
-        (issue 3204).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-10: Version 3.25.6
-
-        Replace the recursion in PropagateMinusZeroChecks() with a loop and a
-        worklist (issue 3204).
-
-        Reland "Enable Object.observe by default" (issue 2409).
-
-        Enable Object.observe by default (issue 2409).
-
-        AllocationTracker now maintains a map from address range to stack trace
-        that allocated the range. When snapshot is generated the map is used to
-        find construction stack trace for an object using its address (Chromium
-        issue 277984).
-
-        Introduce Runtime_GetAllScopesDetails to get all scopes at once for a
-        frame (Chromium issue 340285).
-
-        Reduce heavy runtime calls from debug mirrors (Chromium issue 340285).
-
-        Check and clear date cache in DateCurrentTime, DateLocalTimezone and
-        getTimezoneOffset (Chromium issue 142141).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-06: Version 3.25.5
-
-        Fix HConstants with Smi-ranged HeapNumber values (Chromium issue
-        349878).
-
-        Fix issues with JSON stringify replacer array (issues 3200, 3201).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-05: Version 3.25.4
-
-        x64: Fix LMathMinMax for constant Smi right-hand operands (Chromium
-        issue 349079).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-03-04: Version 3.25.3
-
-        Clear optimized code cache in shared function info when code gets
-        deoptimized (Chromium issue 343609).
-
-        Fixed constant folding for Math.clz32 (Chromium issue 347906).
-
-        Fix JSObject::PrintTransitions (Chromium issue 347912).
-
-        Fix handling of constant global variable assignments (Chromium issue
-        347904).
-
-        Removed bogus ASSERT (Chromium issue 347542).
-
-        Mark HCompareMap as having Tagged representation (Chromium issue
-        346636).
-
-        Fix crasher in Object.getOwnPropertySymbols (Chromium issue 346141).
-
-        Fix the bit massaging code in CompleteParserRecorder::WriteNumber
-        (Chromium issue 346221).
-
-        Don't eliminate loads with incompatible types or representations
-        (Chromium issue 346343).
-
-        Check that after a weak callback, the handle is either dead or strong
-        (Chromium issue 346061).
-
-        Lazy preparsing vs. lazy parsing fix (Chromium issue 346207).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-25: Version 3.25.2
-
-        Fix the bit massaging code in CompleteParserRecorder::WriteNumber
-        (Chromium issue 346221).
-
-        Revert r19455 "Load target types and handlers before IC computation."
-        (Chromium issue 346149).
-
-        Don't eliminate loads with incompatible types or representations
-        (Chromium issue 346343).
-
-        Fix for a smi stores optimization on x64 with a regression test
-        (Chromium issue 345715).
-
-        Check that after a weak callback, the handle is either dead or strong
-        (Chromium issue 346061).
-
-        negative bounds checking on realm calls (Chromium issue 344285).
-
-        Lazy preparsing vs. lazy parsing fix (Chromium issue 346207).
-
-        Fix optimistic BCE to back off after deopt (issue 3176).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-21: Version 3.25.1
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-19: Version 3.25.0
-
-        ES6: Tighten up Object.prototype.__proto__ (issue 3064).
-
-        Fix Hydrogen bounds check elimination (Chromium issue 344186).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-19: Version 3.24.40
-
-        A64: Let the MacroAssembler resolve branches to distant targets (issue
-        3148).
-
-        Fixed and improved code for integral division. Fixed and extended tests
-        (issue 3151).
-
-        MIPS: Fix assignment of function name constant (issue 3138).
-
-        Fix assignment of function name constant (issue 3138).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-14: Version 3.24.39
-
-        Introduce --job-based-sweeping flag and use individual jobs for sweeping
-        if set (issue 3104).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-13: Version 3.24.38
-
-        Merge experimental/a64 to bleeding_edge (issue 3113).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-12: Version 3.24.37
-
-        Fix spec violations in JSON.stringify wrt replacer array (issue 3135).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-11: Version 3.24.36
-
-        Fix inconsistencies wrt whitespaces (issue 3109).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-10: Version 3.24.35
-
-        Fix inconsistencies wrt whitespaces (issue 3109).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-07: Version 3.24.34
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-06: Version 3.24.33
-
-        Allow externalizing strings in old pointer space (Chromium issue
-        268686).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-05: Version 3.24.32
-
-        Add Box object to heap profiler.
-
-        Check the offset argument of TypedArray.set for fitting into Smi
-        (Chromium issue 340125).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-04: Version 3.24.31
-
-        Fix short-circuiting logical and/or in HOptimizedGraphBuilder (Chromium
-        issue 336148).
-
-        Elements field of newly allocated JSArray could be left uninitialized in
-        some cases (fast literal case) (Chromium issue 340124).
-
-        Re-enable escape analysis.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-03: Version 3.24.30
-
-        Performance and stability improvements on all platforms.
-
-
-2014-02-01: Version 3.24.29
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-31: Version 3.24.28
-
-        Don't crash in Array.join() if the resulting string exceeds the max
-        string length (Chromium issue 336820).
-
-        Implements ES6 String.prototype.normalize method (issue 2943).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-30: Version 3.24.27
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-29: Version 3.24.26
-
-        ES6: Map and Set needs to normalize minus zero (issue 3069).
-
-        Make `String.prototype.{starts,ends}With` throw when passing a regular
-        expression (issue 3070).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-28: Version 3.24.25
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-27: Version 3.24.24
-
-        MIPS: Reduce the stack requirements of GetNoCodeAgeSequence (issue
-        3111).
-
-        Delete v8_shell target now that chrome uses d8 (Chromium issue 331585).
-
-        ARM: Reduce the stack requirements of GetNoCodeAgeSequence (issue 3111).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-24: Version 3.24.23
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-23: Version 3.24.22
-
-        Fix compilation on x64 architectures (issue 3110).
-
-        Ensure we don't overwrite transitions in SetPropertyIgnoreAttributes
-        (Chromium issue 326155).
-
-        ES6: Implement Object.setPrototypeOf (issue 2675).
-
-        Fixed floor-of-div optimization (Chromium issue 334708).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-22: Version 3.24.21
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-21: Version 3.24.20
-
-        ES6: Implement Object.setPrototypeOf (issue 2675).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-20: Version 3.24.19
-
-        Introduce a setting to control the toolset for which d8 is compiled
-        (issue 1775).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-17: Version 3.24.18
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-16: Version 3.24.17
-
-        Make cells pointing to JSObjects weak in optimized code (issue 2073).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-15: Version 3.24.16
-
-        Annotate mapped memory regions for LeakSanitizer (Chromium issue
-        328552).
-
-        Turn Runtime_MigrateInstance into Runtime_TryMigrateInstance (Chromium
-        issue 315252).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-14: Version 3.24.15
-
-        Introduce an API mirroring the gc extension.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-10: Version 3.24.14
-
-        ES6: Add Object.getOwnPropertySymbols (issue 3049).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-09: Version 3.24.13
-
-        Add Isolate parameter to HandleScope::NumberOfHandles (Chromium issue
-        324225).
-
-        Removed v8::AssertNoGCScope.
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-08: Version 3.24.12
-
-        Correctly handle instances without elements in polymorphic keyed
-        load/store (Chromium issue 331416).
-
-        Fix selection of popular pages in store buffer (Chromium issue 331444).
-
-        Prepare removal of ObjectTemplate::New without Isolate parameter
-        (Chromium issue 324225).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-07: Version 3.24.11
-
-        Remove generated makefiles on linux when running gyp_v8
-        (Chromium issue 331475)
-
-        Fix building d8 with readline support due to API changes
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-03: Version 3.24.10
-
-        Reland r18383: More API cleanup (Chromium issue 324225).
-
-        MIPS: Fix loading of global object in LWrapReceiver (Chromium issue
-        318420).
-
-        Performance and stability improvements on all platforms.
-
-
-2014-01-02: Version 3.24.9
-
-        Performance and stability improvements on all platforms.
-
-
-2013-12-30: Version 3.24.8
-
-        ARM: fix loading of global object in LWrapReceiver (Chromium issue
-        318420).
-
-        Fix a race between concurrent recompilation and OSR (Chromium issue
-        330046).
-
-        Turn off concurrent sweeping (issue 3071).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-12-23: Version 3.24.7
-
-        Fix small spec violation in String.prototype.split (issue 3026).
-
-        Correctly resolve forcibly context allocated parameters in debug-
-        evaluate (Chromium issue 325676).
-
-        Introduce Function::GetBoundFunction. 
-
-        Performance and stability improvements on all platforms.
-
-
-2013-12-20: Version 3.24.6
-
-        Performance and stability improvements on all platforms.
-
-
-2013-12-19: Version 3.24.5
-
-        Performance and stability improvements on all platforms.
-
-
-2013-12-18: Version 3.24.4
-
-        Removed all stuff marked as V8_DEPRECATED.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-12-17: Version 3.24.3
-
-        Performance and stability improvements on all platforms.
-
-
-2013-12-17: Version 3.24.2
-
-        Flush instruction cache for deserialized code objects.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-12-13: Version 3.24.1
-
-        Fix polymorphic inlined calls with migrating prototypes.
-
-        Fixed global object leak caused by overwriting the global receiver (the
-        global proxy) in the global object with the global object itself
-        (Chromium issue 324812).
-
-        Initialize Date parse cache with SMI instead of double to workaround
-        sharing mutable heap numbers in snapshot (Chromium issue 280531).
-
-        Switch armv7 setting to arm_version==7 in v8 gyp files (Chromium issue
-        234135).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-12-09: Version 3.24.0
-
-        Performance and stability improvements on all platforms.
-
-
-2013-12-04: Version 3.23.18
-
-        Performance and stability improvements on all platforms.
-
-
-2013-12-03: Version 3.23.17
-
-        Performance and stability improvements on all platforms.
-
-
-2013-12-02: Version 3.23.16
-
-        Array builtins need to be prevented from changing frozen objects, and
-        changing structure on sealed objects (Chromium issue 299979).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-29: Version 3.23.15
-
-        Fix context register allocation in LTransitionElementsKind
-        (Chromium issue 324306).
-
-        Fix bug in inlining Function.apply (Chromium issue 323942).
-
-        Ensure that length is Smi in TypedArrayFromArrayLike constructor
-        (Chromium issue 324028).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-28: Version 3.23.14
-
-        Shorten autogenerated error message (issue 3019).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-27: Version 3.23.13
-
-        Increase precision for base conversion for large integers (issue 3025).
-
-        Flatten cons string for single character substrings (Chromium issue
-        323041).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-26: Version 3.23.12
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-25: Version 3.23.11
-
-        Deprecate old versions of Isolate::SetData and GetData.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-22: Version 3.23.10
-
-        Remove preemption thread and API.
-        (issue 3004)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-21: Version 3.23.9
-
-        API: Change AdjustAmountOfExternalAllocatedMemory calls to use int64_t
-        instead of intptr_t.
-
-        Remove deprecated v8::SetResourceConstraints without Isolate parameter.
-
-        Remove deprecated v8-defaults.h and defaults.cc.
-        (Chromium issue 312241)
-
-        Make it possible to add more than one piece of embedder data to
-        isolates.
-        (Chromium issue 317398)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-20: Version 3.23.8
-
-        Fixed crashes exposed though fuzzing.
-        (Chromium issue 320948)
-
-        Deprecated v8::External::New without Isolate parameter.
-
-        Made number of available threads isolate-dependent and exposed it to
-        ResourceConstraints.
-        (issue 2991)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-19: Version 3.23.7
-
-        Bugfix: dependent code field in AllocationSite was keeping code objects
-        alive even after context death.
-        (Chromium issue 320532)
-
-        Fixed data view accessors to throw execptions on offsets bigger than
-        size_t.
-        (issue 3013)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-18: Version 3.23.6
-
-        Limit size of dehoistable array indices.
-        (Chromium issues 319835, 319860)
-
-        Limit the size for typed arrays to MaxSmi.
-        (Chromium issue 319722)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-15: Version 3.23.5
-
-        Fixed missing type feedback check for Generic*String addition.
-        (Chromium issue 318671)
-
-        Fixed duplicate check in DependentCode::Insert.
-        (Chromium issue 318454)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-14: Version 3.23.4
-
-        Fixed overflow in TypedArray initialization function.
-        (Chromium issue 319120)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-13: Version 3.23.3
-
-        Fixed compilation with GCC 4.8.
-        (issue 2767, 2149)
-
-        Added explicit Isolate parameter to External::New.
-        (Chromium issue 266838)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-12: Version 3.23.2
-
-        Fixed --extra-code flag for snapshot creation.
-        (issue 2994)
-
-        Fixed error message wording when instanceof throws.
-        (Chromium issue 82797, issue 1593)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-08: Version 3.23.1
-
-        Made HCapturedObjects non-deletable for DCE. (issue 2987)
-
-        Use a fixed random seed per default. (issue 1880, 2885)
-
-        Fixed y-umlaut to uppercase. (issue 2984)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-11-06: Version 3.23.0
-
-        Fixed loading message from an Error object.  (Chromium issue 306220)
-
-        Made Object.freeze/seal/preventExtensions observable. (issue 2975, 2941)
-
-        Made snapshots reproducible. (issue 2885)
-
-        Added missing negative dictionary lookup to NonexistentHandlerFrontend.
-        (issue 2980)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-31: Version 3.22.24
-
-        Fixed uint32-to-smi conversion in Lithium.
-        (Chromium issue 309623)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-28: Version 3.22.23
-
-        Renamed deprecated __attribute__((no_address_safety_analysis)) to
-        __attribute__((no_sanitize_address)) (Chromium issue 311283)
-
-        Defined DEBUG for v8_optimized_debug=2
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-25: Version 3.22.22
-
-        Record allocation stack traces. (Chromium issue 277984,v8:2949)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-24: Version 3.22.21
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-24: Version 3.22.20
-
-        Made Array.prototype.pop throw if the last element is not configurable.
-
-        Fixed HObjectAccess for loads from migrating prototypes.
-        (Chromium issue 305309)
-
-        Enabled preaging of code objects when --optimize-for-size.
-        (Chromium issue 280984)
-
-        Exposed v8::Function::GetDisplayName to public API.
-        (Chromium issue 17356)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-23: Version 3.22.19
-
-        Fix materialization of captured objects with field tracking.
-        (Chromium issue 298990)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-22: Version 3.22.18
-
-        Add tool to visualize machine code/lithium.
-
-        Handle misaligned loads and stores in load elimination. Do not track
-        misaligned loads and be conservative about invalidating misaligned
-        stores. (issue 2934)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-21: Version 3.22.17
-
-        Harmony: Implement Math.trunc and Math.sign. (issue 2938)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-21: Version 3.22.16
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-18: Version 3.22.15
-
-        Enabled calling the SetReference* & SetObjectGroupId functions with a
-        Persistent<SubclassOfValue>.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-17: Version 3.22.14
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-16: Version 3.22.13
-
-        Do not look up ArrayBuffer on global object in typed array constructor.
-        (issue 2931)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-15: Version 3.22.12
-
-        Added histograms to track fraction of heap spaces and percentage of
-        generated crankshaft code.
-
-        Moved v8_optimized_debug default value to standalone.gypi.
-
-        Track JS allocations as they arrive with no affection on performance
-        when tracking is switched off (Chromium issue 277984).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-14: Version 3.22.11
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-11: Version 3.22.10
-
-        Fixed timezone issues with date-time/parse-* tests.
-        (Chromium issue 2919)
-
-        Added column getter to CpuProfileNode (Chromium issue 302537)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-10: Version 3.22.9
-
-        Ensure only whitelisted stubs have sse2 versions in the snapshot.
-        (fix for chromium 304565)
-
-        Implement ArrayBuffer.isView.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-04: Version 3.22.8
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-03: Version 3.22.7
-
-        Debug: Allow stepping into on a given call frame
-        (Chromium issue 296963).
-
-        Always use timeGetTime() for TimeTicks::Now() on Windows
-        (Chromium issue 288924).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-02: Version 3.22.6
-
-        Performance and stability improvements on all platforms.
-
-
-2013-10-01: Version 3.22.5
-
-        Disabled externalization of sliced/cons strings in old pointer space
-        (Chromium issue 276357).
-
-        Turned on handle zapping for release builds
-
-        Performance and stability improvements on all platforms.
-
-
-2013-09-30: Version 3.22.4
-
-        Function::Call and Object::CallAsFunction APIs should allow v8::Value as
-        a receiver (issue 2915).
-
-        Removed unnecessary mutex (Chromium issue 291236).
-
-        Removed ArrayBufferView::BaseAddress method.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-09-27: Version 3.22.3
-
-        Added methods to enable configuration of ResourceConstraints based on
-        limits derived at runtime.
-        (Chromium issue 292928)
-
-        Added -optimize-for-size flag to optimize for memory size (will be used
-        by pre-aging CL), and removed the is_memory_constrained
-        ResourceConstraint.
-        (Chromium issue 292928)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-09-26: Version 3.22.2
-
-        Performance and stability improvements on all platforms.
-
-
-2013-09-25: Version 3.22.1
-
-        Sped up creating typed arrays from array-like objects.
-        (Chromium issue 270507)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-09-23: Version 3.22.0
-
-        LiveEdit to mark more closure functions for re-instantiation when scope
-        layout changes.
-        (issue 2872)
-
-        Made bounds check elimination iterative instead of recursive.
-        (Chromium issue 289706)
-
-        Turned on i18n support by default.
-
-        Set the proper instance-type on HAllocate in BuildFastLiteral.
-        (Chromium issue 284577)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-09-18: Version 3.21.17
-
-        Implemented local load/store elimination on basic blocks.
-
-        Added mutex when accessing concurrent recompilation output queue.
-        (Chromium issue 291236)
-
-        Don't lookup the cache for the result of Function::New.
-        (Chromium issue 272579)
-
-        Tweaked HConstant::EmitAtUses() to eliminate useless constant
-        generation.
-        (Chromium issue 2881)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-09-16: Version 3.21.16
-
-        Every place where AllocationMemento is initialized with an
-        AllocationSite is now checked to be sure a valid Site goes in. This is
-        temporary code to diagnose chromium bug 284577.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-09-13: Version 3.21.15
-
-        Non-JSObject heap objects are now handled using slow-path IC stub
-        guarded by the map.
-        (Chromium issue 280632)
-
-        i18n Javascript code added to the snapshot.
-        (V8 issue 2745)
-
-        Performance and stability improvements on all platforms.
-
-2013-09-12: Version 3.21.14
-
-        Added access check for observed objects.
-        (V8 issue 2778)
-
-        Cleaned up v8::ArrayBuffer::Allocator interface.
-        (V8 issue 2823)
-
-        Performance and stability improvements on all platforms.
-
-2013-09-11: Version 3.21.13
-
-        Added a ResourceConstraint for the embedder to specify that V8 is
-        running on a memory constrained device.
-        (Chromium issue 280984)
-
-        Removed HandleScope default ctor.
-        (Chromium issue 236173)
-
-        Enabled escape analysis for Hydrogen.
-
-        Correctly stringified mixed encoding indirect strings.
-        (Chromium issue 287476)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-09-09: Version 3.21.12
-
-        Fixed bitwise negation on x64.
-        (Chromium issue 285355)
-
-        Dropped GetCurrentThreadId() and TerminateExecution(int) from 
-	the external API.
-
-        Fixed polymorphic INTERCEPTOR StoreICs on ARM/MIPS.
-        (Chromium issue 284998)
-
-        Added check if timeout has expired after processing each sample.
-        (issue 2814,v8:2871)
-
-        Removed obsolete global V8::has_been_fooed flags.
-        (issue 2744)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-09-05: Version 3.21.11
-
-        Performance and stability improvements on all platforms.
-
-
-2013-09-04: Version 3.21.10
-
-        Fixed Eternal::IsEmpty logic (issue 2870).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-09-03: Version 3.21.9
-
-        Deprecated Persistent functions which were marked to be deprecated.
-
-        Allowed uncacheable identifiers to go generic (issue 2867).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-09-02: Version 3.21.8
-
-        Added scriptId to StackTrace frames (issue 2865).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-08-30: Version 3.21.7
-
-        Fixed casts of eternal handles.
-
-        Turned on global handle zapping.
-
-        Always visit branches during HGraph building (Chromium issue 280333).
-
-        Profiler changes: removed deprecated API, support higher sampling
-        rate on Windows.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-08-29: Version 3.21.6
-
-        Fixed inlined 'throw' statements interfering with live range
-        computation. (issue 2843)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-08-28: Version 3.21.5
-
-        Fixed compilation with recent MinGW64 versions. (issue 2300)
-
-        Added RemovePrototype to FunctionTemplate. (Chromium issue 272440)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-08-26: Version 3.21.4
-
-        Lowered kInitialMaxFastElementArray constant to 95K (issue 2790).
-
-        Use signals for cpu profiling on Mac OS X (issue 2814).
-
-        Deprecated CpuProfileNode::GetSelfSamplesCount (Chromium issue 267595).
-
-        Added support for higher CPU profiler sampling rate on posix systems
-        (issue 2814).
-
-        Worked around 'inlining failed' build error with older GCC 4.x releases.
-
-        Added source map support to tick processor.
-
-        Stability improvements on all platforms.
-
-
-2013-08-23: Version 3.21.3
-
-        Temporarily disabled optimization for StringWrappers to use native
-        valueOf. (issue 2855)
-
-        Fixed crash on function declarations in eval inside non-trivial local
-        scope. (issue 2594)
-
-        Rewrote SamplingCircularQueue. (issue 2814)
-
-        Fixed hidden properties on object with frozen prototype. (issue 2829)
-
-        Fix deoptimization bug. (Chromium issue 274164)
-
-        Stability improvements on all platforms.
-
-
-2013-08-22: Version 3.21.2
-
-        Stability improvements on all platforms.
-
-
-2013-08-21: Version 3.21.1
-
-        Promoted ArrayBuffer, DataView and typed arrays to non-experimental.
-        (Chromium issue 270527)
-
-        Replaced OS::MemCopy with memcpy in typed array initialization.
-        (Chromium issue 270642)
-
-        Moved i18n break iterator C++ code to runtime (issue 2745)
-
-        Fixed invalid out-of-bounds store in MacroAssembler::Allocate.
-        (Chromium issue 263515)
-
-        Fixed register misuse in Allocate() on ARM. (issue 2851)
-
-        Fixed empty handle dereference in Runtime_InternalNumberFormat.
-        (Chromium issue 275467)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-08-19: Version 3.21.0
-
-        Fixed GC-related crasher (Chromium issue 274438)
-
-        Reverted making Intl non-enumerable.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-08-14: Version 3.20.17
-
-        Fixed Math.round/floor that had bogus Smi representation
-        (Chromium issue 272564)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-08-13: Version 3.20.16
-
-        Fixed bug in HPhi::SimplifyConstantInput (Chromium issue 269679)
-
-        Fixed gcmole bugs in i18n code (issue 2745)
-
-        ia32: Calls to the TranscendentalCacheStub must ensure that esi is
-        set (issue 2827)
-
-        Made sure polymorphic element access creates non-replaying
-        phis. (issue 2815)
-
-        Allowed HPhis to have an invalid merge index. (issue 2815)
-
-        Fixed smi-based math floor. (Chromium issue 270268)
-
-        Deprecated self and total time getters and total sample count
-        getter on CpuProfileNode. (Chromium issue 267595)
-
-        Fixed Object.freeze, Object.observe wrt CountOperation and
-        CompoundAssignment. (issue 2774,2779)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-08-07: Version 3.20.15
-
-        Exposed eternal handle api.
-
-        Bugfix to solve issues with enabling V8 typed arrays in Blink.
-
-        Fixed Array index dehoisting.  (Chromium issue 264203)
-
-        Updated Array Iterator to use numeric indexes (issue 2818)
-
-        Return start/end profiling time in microseconds instead of milliseconds
-        (issue 2824)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-08-06: Version 3.20.14
-
-        Added new Harmony methods to Array.prototype object.
-        (issue 2776,v8:2777)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-08-01: Version 3.20.12
-
-        Removed buggy ToNumber truncation (partial fix for issue 2813)
-
-        Calling Map etc without new should throw TypeError (issue 2819)
-
-        Fixed a crash for large code objects on ARM (Chromium issue 2736)
-
-        Fixed stale unhandlified value in JSObject::SetPropertyForResult.
-        (Chromium issue 265894)
-
-        Added new Harmony methods to String.prototype object.
-        (issue 2796,v8:2797,v8:2798,v8:2799)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-07-30: Version 3.20.11
-
-        Performance and stability improvements on all platforms.
-
-
-2013-07-29: Version 3.20.10
-
-        Performance and stability improvements on all platforms.
-
-
-2013-07-26: Version 3.20.9
-
-        Check that ExternalString objects get aligned resources.
-
-        Fixed JSArray-specific length lookup in polymorphic array handling
-        (Chromium issues 263276, 263905).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-07-24: Version 3.20.8
-
-        Deprecated v8::V8::Pause/ResumeProfiler.
-
-        Fixed Chromium issues 247688, 258519 and 260203.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-07-22: Version 3.20.7
-
-        Deprecated some debugger methods.
-
-        Fixed wrong bailout id in polymorphic stores (Chromium issue 259787).
-
-        Fixed data race in SamplingCircularQueue (Chromium issue 251218).
-
-        Fixed type feedback in presence of negative lookups
-        (Chromium issue 252797).
-
-        Do not materialize context-allocated values for debug-evaluate
-        (Chromium issue 259300).
-
-        Synchronized Compare-Literal behavior in FullCodegen and Hydrogen
-        (Chromium issue 260345).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-07-17: Version 3.20.6
-
-        Try to remove invalidated stubs before falling back to checking the
-        constant state (Chromium issue 260585).
-
-        Fixed gyp_v8 to work with use_system_icu=1 (issue 2475).
-
-        Fixed sloppy-mode 'const' under Harmony flag (Chromium issue 173361).
-
-        Use internal array as API function cache  (Chromium issue 260106).
-
-        Fixed possible stack overflow in range analysis
-        (Chromium issue 259452).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-07-15: Version 3.20.5
-
-        Ensured that the length of frozen arrays is immutable
-        (issue 2711, Chromium issue 259548).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-07-10: Version 3.20.4
-
-        Fixed garbage-collection issue that causes a crash on ARM
-        (Chromium issue 254570)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-07-08: Version 3.20.3
-
-        Performance and stability improvements on all platforms.
-
-
-2013-07-05: Version 3.20.2
-
-        Remove deprecated heap profiler methods from V8 public API
-
-        Mark i18n functions as native and set proper names
-        (issue 2745)
-
-        Correctly report stack trace when current function is FunctionApply
-        builtin (Chromium issue 252097)
-
-        Enable GDBJIT interface for standalone by default.
-
-        Fix debuggersupport=off build. (issue 2754)
-
-        Introduce -m64 flag for making x64 when the default gcc compiler is for
-        X32
-
-        Performance and stability improvements on all platforms.
-
-
-2013-07-02: Version 3.20.1
-
-        Implemented WeakMap.prototype.clear function. (issue 2753)
-
-        Ensure CheckInitialized is present independent of define.
-        (Chromium issue 255779)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-06-28: Version 3.20.0
-
-        Migrated several tests from blink to V8 repository.
-
-        Allowed users of the V8 API to distinguish between unset and undefined
-        HiddenValues (issue 2746).
-
-        Deprecated old style callbacks in the V8 API.
-
-        Turned on parallel recompilation.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-06-18: Version 3.19.18
-
-	Fixed read-only attribute of Function.length in strict mode.
-	(issue 2705)
-
-	Fixed Runtime_SetProperty to properly handle OOM failures
-	(Chromium issue 249873)
-
-	Emit deprecated check for constant function transitions.
-	(Chromium issue 250609)
-	
-	Made MathFloorOfDiv optimization trigger more often
-	(Issue 2205)
-
-	Make more GCs in idle notification handler.
-	(Chromium issue 241815)
-
-	Increased default type info threshold.
-	(Issue 2730)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-06-14: Version 3.19.16
-
-        Performance and stability improvements on all platforms.
-
-
-2013-06-13: Version 3.19.15
-
-        Performance and stability improvements on all platforms.
-
-
-2013-06-13: Version 3.19.14
-
-        Fixed crashes when calling new Array(a) with a single argument that
-        could result in creating a holey array with a packed elements kind.
-        (Chromium issue 245480)
-
-        Fixed issues in parallel compilation.
-        (Chromium issue 248076)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-06-11: Version 3.19.13
-
-        Performance and stability improvements on all platforms.
-
-
-2013-06-10: Version 3.19.12
-
-        Fixed arguments array access. (Chromium issue 247303)
-
-        Fixed bug in LookupForWrite. (Chromium issue 242332)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-06-07: Version 3.19.11
-
-        Performance and stability improvements on all platforms.
-
-
-2013-06-06: Version 3.19.10
-
-        Performance and stability improvements on all platforms.
-
-
-2013-06-05: Version 3.19.9
-
-        Implemented Load IC support for loading properties from primitive
-        values to avoid perpetual soft deopts.  (Chromium issue 242512)
-
-        Implemented Freeing of PerThreadAssertData when possible to avoid
-        memory leak. (Chromium issue 246567)
-
-        Removed V8_USE_OLD_STYLE_PERSISTENT_HANDLE_VISITORS.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-06-03: Version 3.19.8
-
-        Fixed bug with inlining 'Array' function. (Chromium issue 244461)
-
-        Fixed initialization of literal objects. (Chromium issue 245424)
-
-        Fixed function name inferred inside closures. (Chromium issue 224884)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-05-31: Version 3.19.7
-
-        Added support for //# sourceURL similar to deprecated //@ sourceURL one.
-        (issue 2702)
-
-        Made sure IfBuilder::Return clears the current block.
-        (Chromium issue 243868)
-
-        Fixed two CPU profiler tests on ARM and MIPS simulators
-        (issue 2628)
-
-        Fixed idle incremental GC for large objects.
-        (Chromium issue 241815)
-
-        Disabled --optimize-constructed-arrays due to crashes
-        (Chromium issue 244461)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-05-28: Version 3.19.6
-
-        Fixed IfBuilder::Deopt to clear the current block
-        (Chromium issue 243868).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-05-27: Version 3.19.5
-
-        Reset regexp parser flag after scanning ahead for capture groups.
-        (issue 2690)
-
-        Removed flakiness in test-cpu-profiler/SampleWhenFrameIsNotSetup.
-        (issue 2628)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-05-24: Version 3.19.4
-
-        Fixed edge case in stack trace formatting. (Chromium issue 237617)
-
-        Fixed embedded new-space pointer in LCmpObjectEqAndBranch. (Chromium
-	issue 240032)
-
-        Made Object.freeze fast (issue 1858, Chromium issue 115960)
-
-        Fixed bogus deopt in BuildEmitDeepCopy for holey arrays. (Chromium issue
-        242924)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-05-22: Version 3.19.3
-
-        Performance and stability improvements on all platforms.
-
-
-2013-05-17: Version 3.19.2
-
-        Fill in one-word-fillers for the unused property fields
-        (Chromium issue 240056).
-
-        Removed use_system_v8 logic from the mainline gyp file
-        (Chromium issue 226860).
-
-        Skip CPU profiler samples where top function's stack frame is not
-        set up properly (issue 2628).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-05-14: Version 3.19.1
-
-        Fixed missing hole check for loads from Smi arrays when all uses are
-        changes (Chromium issue 233737)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-05-10: Version 3.19.0
-
-        Deprecated Context::New which returns Persistent.
-
-        Added Persistent<T>::Reset which disposes the handle and redirects it to
-        point to another object.
-
-        Deprecated WriteAscii and MayContainNonAscii.
-
-        Exposed AssertNoAllocation to API.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-04-30: Version 3.18.5
-
-        Allowed setting debugger breakpoints on CompareNilICs (issue 2660)
-
-        Fixed beyond-heap load on x64 Crankshafted StringCharFromCode
-        (Chromium issue 235311)
-
-        Change 'Parse error' to three more informative messages.
-        (Chromium issue 2636)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-04-26: Version 3.18.4
-
-        Added a preliminary API for ES6 ArrayBuffers
-
-        Replaced qsort with std::sort. (Chromium issue 2639)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-04-24: Version 3.18.3
-
-        Exposed the GC under a name that is less collision prone than window.gc.
-        (issue 2641)
-
-        Do not emit double values at their use sites. (Chromium issue 234101)
-
-        Added methods to allow resuming execution after calling
-        TerminateExecution(). (issue 2361)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-04-22: Version 3.18.2
-
-        OS::MemMove/OS::MemCopy: Don't call through to generated code when size
-        == 0 to avoid prefetching invalid memory (Chromium issue 233500)
-
-        Removed heap snapshot size limit. (Chromium issue 232305)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-04-18: Version 3.18.1
-
-        Removed SCons related files and deprecated test suite configurations.
-
-        Improved handling of unary plus (issue 2527).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-04-17: Version 3.18.0
-
-        Enabled pretenuring of fast literals in high promotion mode.
-
-        Removed preparser library; link preparser executable against full V8.
-
-        Fixed set-up of intrinsic's 'constructor' properties.
-        (Chromium issue 229445)
-
-        ES6 symbols: extended V8 API to support symbols (issue 2158).
-
-        Removed ARM support for VFP2.
-
-        Made __proto__ a real JavaScript accessor property.
-        (issue 1949 and issue 2606)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-04-04: Version 3.17.16
-
-        Stack trace API: poison stack frames below the first strict mode frame.
-        (issue 2564)
-
-        Made Isolate::GetHeapStatistics robust against half-initialized
-        isolates (Chromium issue 2591).
-
-        Finished implementation of ES6 symbols aka. private names (issue 2158).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-03-21: Version 3.17.15
-
-        Rolled back API changes to maintain compatibility with older
-        3.17.x versions of V8.
-
-        Disable zapping of global handles in release mode.
-
-        Always mark the entire valid prefix of the descriptor array.
-        (Chromium issue 196331)
-
-        Use internal memcpy for CopyWords and when copying code.
-        (Chromium issue 196330)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-03-20: Version 3.17.14
-
-        Use internal memcpy when initializing code objects.
-        (Chromium issue 196330)
-
-        Disabled weak embedded maps because of crashes.
-        (Chromium issues 172489, 217858)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-03-19: Version 3.17.13
-
-        Turned Flags into a uint32_t typedef (Chromium issue 194749).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-03-18: Version 3.17.12
-
-        Unified kMaxArguments with number of bits used to encode it.
-        (Chromium issue 211741)
-
-        Fixed detection of |handle_smi| case in
-        HOptimizedGraphBuilder::HandlePolymorphicCallNamed.
-        (Chromium issue 196583)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-03-15: Version 3.17.11
-
-        Added a version of the v8::HandleScope constructor with an v8::Isolate
-        parameter and made AdjustAmountOfExternalAllocatedMemory an instance
-        method of v8::Isolate.
-        (issue 2487)
-
-        Fixed two register allocator bugs (off-by-one error/failure
-        propagation). (issue 2576)
-
-        Fixed huge heap snapshot when a heavily shared context has many
-        variables. (Chromium issue 145687)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-03-13: Version 3.17.10
-
-        Fixed heap snapshot creation for Harmony collections. (issue 2535)
-
-        Fixed register allocation corner case. (Chromium issue 177883)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-03-08: Version 3.17.9
-
-        Restored Function()'s expected string representation. (issue 2470)
-
-        Enabled deprecatations (again). (issue 2487)
-
-        Avoid bool to Oddball conversions by being lazy. (issue 2491)
-
-        Added %p option to --logfile.
-
-        Hardened Function()'s parsing of function literals. (issue 2470)
-
-        ES6 symbols: Refine test for getOwnPropertyNames. (issue 2158)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-03-07: Version 3.17.8
-
-        Added missing license headers. (Chromium issue 98597)
-
-        Inserted missing type cast in JSON.stringify. (issue 2570)
-
-        Reverted "Send SIGPROF signals on the profiler event processor thread"
-        (issue 2571)
-
-        Fixed Array.length, String.length and Function.prototype LoadICs on x64.
-        (issue 2568)
-
-        ES6 symbols: filter symbols form for-in loops and Object.keys.
-        (issue 2158)
-
-        Properly handle misses for StoreArrayLengthStub on ia32 and x64
-        (issue 2566)
-
-        Fixed x32 handling of Atomic64. (Chromium issue chromium-os:36866)
-
-        Removed "library" variable from standalone.gypi. (Chromium issue 111541)
-
-        Fixed HCheckSmiOrInt <-> HBoundsCheck interaction wrt. representations.
-        (issue 2556)
-
-        Enabled zapping of disposed global handles in release mode.
-        (Chromium issue 176056)
-
-        Added workaround for redefinition of __proto__ property. (issue 2565)
-
-        ES6 symbols: Allow symbols as property names. (issue 2158)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-03-04: Version 3.17.7
-
-        Limited recursion in regexp compilation by a budget.
-        (Chromium issue 178790)
-
-        ES6 symbols: Implemented Symbol intrinsic and basic functionality
-        (issue 2158)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-02-28: Version 3.17.6
-
-        Fixed materialization of arguments objects with unknown values.
-        (Chromium issue 163530)
-
-        Set default number of sweeper threads to at most four.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-02-27: Version 3.17.5
-
-        Made __proto__ a foreign callback on Object.prototype.
-        (issue 621, issue 1949 and issue 2441)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-02-25: Version 3.17.4
-
-        Performance and stability improvements on all platforms.
-
-
-2013-02-21: Version 3.17.3
-
-        Performance and stability improvements on all platforms.
-
-
-2013-02-19: Version 3.17.2
-
-        Removed bogus check for TOP register in deoptimizer.
-        (Chromium issue 176943)
-
-        Made the Isolate parameter mandatory for internal HandleScopes.
-        (issue 2487)
-
-        Fixed f.apply() optimization when declared arguments are mutated.
-        (issue 2539)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-02-14: Version 3.17.1
-
-        Performance and stability improvements on all platforms.
-
-
-2013-02-13: Version 3.17.0
-
-        Enabled parallel sweeping.
-
-        Don't try to unlink instructions twice during GVN
-        (Chromium issue 175141)
-
-        Fixed code flusher disabling while marking incrementally.
-        (Chromium issue 173458, 168582)
-
-        Don't use TLS for space iterators.
-        (issue 2531)
-
-        Added new GetHeapStatistics API entry and deprecated old one.
-
-        Fixed DoubleStackSlot-to-DoubleStackSlot moves on ia32. Unified
-        platform-independent code.
-        (Chromium issue 173907)
-
-        Added --trace-array-abuse to help find OOB accesses.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-02-06: Version 3.16.14
-
-        Performance and stability improvements on all platforms.
-
-
-2013-02-04: Version 3.16.13
-
-        Tagged stubs that rely on instance types as MEGAMORPHIC.
-        (Chromium issue 173974)
-
-        Fixed clearing of dead dependent codes and verifing of weak
-        embedded maps on full GC. (Chromium issue 172488,172489)
-
-        Made the arm port build cleanly with Clang.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-01-31: Version 3.16.12
-
-        Performance and stability improvements on all platforms.
-
-
-2013-01-30: Version 3.16.11
-
-        Put making embedded maps in optimized code weak behind a flag.
-        (Chromium issue 172488,172489)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-01-25: Version 3.16.10
-
-        Avoid excessive memory usage during redundant phi elimination.
-        (issue 2510)
-
-        Fixed additional spec violations wrt RegExp.lastIndex.
-        (issue 2437)
-
-        Added Isolate parameter to Persistent class.
-        (issue 2487)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-01-24: Version 3.16.9
-
-        Made embedded maps in optimized code weak.
-        (issue 2073)
-
-        Fixed corner case when JSFunction is evicted from flusher.
-        (Chromium issue 168801)
-
-        Correctly set kCanBeDivByZero flag for HMathFloorOfDiv.
-        (Chromium issue 171641)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-01-23: Version 3.16.8
-
-        Correctly reset lastIndex in an RegExp object.
-        (Chromium issue 170856)
-
-        Added a workaround for Windows compilation problems related to V8EXPORT.
-        (issue 2507)
-
-        tools/run-tests.py: shlex.split() the value of --command-prefix
-        (Chromium issue 171553)
-
-        Fixed pattern detection for replacing shifts by rotation.
-        (Chromium issue 2499)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-01-21: Version 3.16.7
-
-        Removed <(library) usage from v8.gyp.
-        (Chromium issue 111541)
-
-        Fixed out of bounds memory access in TestJSArrayForAllocationSiteInfo.
-        (Chromium issue 169928)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-01-18: Version 3.16.6
-
-        Made the Isolate parameter mandatory in Locker and Unlocker classes.
-        (issue 2487)
-
-        Avoid pointer underflow in CopyCharsUnsigned.
-        (issue 2493)
-
-        Generate shim headers when using system v8.
-        (Chromium issue 165264)
-
-        Fixed arguments materialization for inlined apply().
-        (issue 2489)
-
-        Sync'ed laziness between BuildFunctionInfo and MakeFunctionInfo.
-        (Chromium issue 147497)
-
-        Added sanity check to CodeFlusher::AddCandidate.
-        (Chromium issue 169209)
-
-        Performance and stability improvements on all platforms.
-
-
-2013-01-15: Version 3.16.5
-
-        Removed deprecated functions from V8's external API.
-
-        Prepared API for WebKit use of Latin-1.
-
-        Fixed V8 issue 2486.
-
-        Fixed Chromium issue 169723.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-01-11: Version 3.16.4
-
-        Fixed Chromium issues 168545 and 169209.
-
-        Performance and stability improvements on all platforms.
-
-
-2013-01-09: Version 3.16.3
-
-        Improved GC performance when moving parts of a FixedArray (issue 2452).
-
-        Enabled readline on d8 while building a shared lib (issue 1781).
-
-        Fixed missing exception check in typed array constructor
-        (Chromium issue 168545).
-
-        Check for read-only-ness when preparing for array sort (issue 2419).
-
-        Performance and stability improvements on all platforms.
-
-
-2013-01-04: Version 3.16.2
-
-        Added Makefile options to build for the Raspberry Pi (armv7=0,
-        arm_fpu=vfp2).
-
-        Performance and stability improvements on all platforms.
-
-
-2012-12-27: Version 3.16.1
-
-        Fixed x64 MathMinMax for negative untagged int32 arguments.
-        (Chromium issue 164442)
-
-        Fixed FloatingPointHelper::CheckSSE2OperandIsInt32.
-        (issue 2458)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-12-21: Version 3.16.0
-
-        V8_Fatal now prints C++ stack trace in debug mode.
-
-        Added HTML-based tick processor.
-
-        Continued implementation of Object.observe (V8 issue 2409).
-
-        Fixed V8 issues 2243, 2340, 2393, 2399, 2457.
-
-        Fixed Chromium issues 125308, 165637, 166379, 166553.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-12-10: Version 3.15.11
-
-        Define CAN_USE_VFP2/3_INSTRUCTIONS based on arm_neon and arm_fpu GYP
-        flags.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-12-07: Version 3.15.10
-
-        Enabled optimisation of functions inside eval. (issue 2315)
-
-        Fixed spec violations in methods of Number.prototype. (issue 2443)
-
-        Added GCTracer metrics for a scavenger GC for DOM wrappers.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-12-06: Version 3.15.9
-
-        Fixed candidate eviction in code flusher.
-        (Chromium issue 159140)
-
-        Iterate through all arguments for side effects in Math.min/max.
-        (issue 2444)
-
-        Fixed spec violations related to regexp.lastIndex
-        (issue 2437, issue 2438)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-12-04: Version 3.15.8
-
-        Enforced stack allocation of TryCatch blocks.
-        (issue 2166,chromium:152389)
-
-        Fixed external exceptions in external try-catch handlers.
-        (issue 2166)
-
-        Activated incremental code flushing by default.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-11-30: Version 3.15.7
-
-        Activated code aging by default.
-
-        Included more information in --prof log.
-
-        Removed eager sweeping for lazy swept spaces. Try to find in
-        SlowAllocateRaw a bounded number of times a big enough memory slot.
-        (issue 2194)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-11-26: Version 3.15.6
-
-        Ensure double arrays are filled with holes when extended from
-        variations of empty arrays. (Chromium issue 162085)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-11-23: Version 3.15.5
-
-        Fixed JSON.stringify for objects with interceptor handlers.
-        (Chromium issue 161028)
-
-        Fixed corner case in x64 compare stubs. (issue 2416)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-11-16: Version 3.15.4
-
-        Fixed Array.prototype.join evaluation order. (issue 2263)
-
-        Perform CPU sampling by CPU sampling thread only iff processing thread
-        is not running. (issue 2364)
-
-        When using an Object as a set in Object.getOwnPropertyNames, null out
-        the proto. (issue 2410)
-
-        Disabled EXTRA_CHECKS in Release build.
-
-        Heap explorer: Show representation of strings.
-
-        Removed 'type' and 'arguments' properties from Error object.
-        (issue 2397)
-
-        Added atomics implementation for ThreadSanitizer v2.
-        (Chromium issue 128314)
-
-        Fixed LiveEdit crashes when object/array literal is added. (issue 2368)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-11-13: Version 3.15.3
-
-        Changed sample shell to send non-JS output (e.g. errors) to stderr
-        instead of stdout.
-
-        Correctly check for stack overflow even when interrupt is pending.
-        (issue 214)
-
-        Collect stack trace on stack overflow. (issue 2394)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-11-12: Version 3.15.2
-
-        Function::GetScriptOrigin supplies sourceURL when script name is
-        not available.  (Chromium issue 159413)
-
-        Made formatting error message side-effect-free.  (issue 2398)
-
-        Fixed length check in JSON.stringify.  (Chromium issue 160010)
-
-        ES6: Added support for Set and Map clear method (issue 2400)
-
-        Fixed slack tracking when instance prototype changes.
-        (Chromium issue 157019)
-
-        Fixed disabling of code flusher while marking.  (Chromium issue 159140)
-
-        Added a test case for object grouping in a scavenger GC (issue 2077)
-
-        Support shared library build of Android for v8.
-        (Chromium issue 158821)
-
-        ES6: Added support for size to Set and Map (issue 2395)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-11-06: Version 3.15.1
-
-        Put incremental code flushing behind a flag. (Chromium issue 159140)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-10-31: Version 3.15.0
-
-        Loosened aligned code target requirement on ARM (issue 2380)
-
-        Fixed JSON.parse to treat leading zeros correctly.
-        (Chromium issue 158185)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-10-22: Version 3.14.5
-
-        Killed off the SCons based build.
-
-        Added a faster API for creating v8::Integer objects.
-
-        Speeded up function deoptimization by avoiding quadratic pass over
-        optimized function list. (Chromium issue 155270)
-
-        Always invoke the default Array.sort functions from builtin functions.
-        (issue 2372)
-
-        Reverted recent CPU profiler changes because they broke --prof.
-        (issue 2364)
-
-        Switched code flushing to use different JSFunction field.
-        (issue 1609)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-10-15: Version 3.14.4
-
-        Allow evals for debugger even if they are prohibited in the debugee
-        context. (Chromium issue 154733)
-
-        Enabled --verify-heap in release mode (issue 2120)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-10-11: Version 3.14.3
-
-        Use native context to retrieve ErrorMessageForCodeGenerationFromStrings
-        (Chromium issue 155076).
-
-        Bumped variable limit further to 2^17 (Chromium issue 151625).
-
-        Performance and stability improvements on all platforms.
-
-
-2012-10-10: Version 3.14.2
-
-        ARM: allowed VFP3 instructions when hardfloat is enabled.
-        (Chromium issue 152506)
-
-        Fixed instance_descriptors() and PushStackTraceAndDie regressions.
-        (Chromium issue 151749)
-
-        Made GDBJIT interface compile again. (issue 1804)
-
-        Fixed Accessors::FunctionGetPrototype's proto chain traversal.
-        (Chromium issue 143967)
-
-        Made sure that names of temporaries do not clash with real variables.
-        (issue 2322)
-
-        Rejected local module declarations. (Chromium issue 150628)
-
-        Rejected uses of lexical for-loop variable on the RHS. (issue 2322)
-
-        Fixed slot recording of code target patches.
-        (Chromium issue 152615,chromium:144230)
-
-        Changed the Android makefile to use GCC 4.6 instead of GCC 4.4.3.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-10-01: Version 3.14.1
-
-        Don't set -m32 flag when compiling with Android ARM compiler.
-        (Chromium issue 143889)
-
-        Restore the descriptor array before returning allocation failure.
-        (Chromium issue 151750)
-
-        Lowered kMaxVirtualRegisters (v8 issue 2139, Chromium issues 123822 and
-        128252).
-
-        Pull more recent gyp in 'make dependencies'.
-
-        Made sure that the generic KeyedStoreIC changes length and element_kind
-        atomically (issue 2346).
-
-        Bumped number of allowed variables per scope to 65535, to address GWT.
-        (Chromium issue 151625)
-
-        Support sourceURL for dynamically inserted scripts (issue 2342).
-
-        Performance and stability improvements on all platforms.
-
-
-2012-09-20: Version 3.14.0
-
-        Fixed missing slot recording during clearing of CallICs.
-        (Chromium issue 144230)
-
-        Fixed LBoundsCheck on x64 to handle (stack slot + constant) correctly.
-        (Chromium issue 150729)
-
-        Fixed minus zero test. (Issue 2133)
-
-        Fixed setting array length to zero for slow elements.
-        (Chromium issue 146910)
-
-        Fixed lost arguments dropping in HLeaveInlined.
-        (Chromium issue 150545)
-
-        Fixed casting error for receiver of interceptors.
-        (Chromium issue 149912)
-
-        Throw a more descriptive exception when blocking 'eval' via CSP.
-        (Chromium issue 140191)
-
-        Fixed debugger's eval when close to stack overflow. (issue 2318)
-
-        Added checks to live edit. (issue 2297)
-
-        Switched on code compaction on incremental GCs.
-
-        Fixed caching of optimized code for OSR. (issue 2326)
-
-        Not mask exception thrown by toString in String::UtfValue etc.
-        (issue 2317)
-
-        Fixed API check for length of external arrays. (Chromium issue 148896)
-
-        Ensure correct enumeration indices in the dict (Chromium issue 148376)
-
-        Correctly initialize regexp global cache. (Chromium issue 148378)
-
-        Fixed arguments object materialization during deopt. (issue 2261)
-
-        Introduced new API to expose external string resource regardless of
-        encoding.
-
-        Fixed CHECK failure in LCodeGen::DoWrapReceiver when
-        --deopt-every-n-times flag is present
-        (Chromium issue 148389)
-
-        Fixed edge case of extension with NULL as source string.
-        (Chromium issue 144649)
-
-        Fixed array index dehoisting. (Chromium issue 141395)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-09-11: Version 3.13.7
-
-        Enable/disable LiveEdit using the (C++) debug API.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-09-06: Version 3.13.6
-
-        Added validity checking to API functions and calls.
-
-        Disabled accessor inlining (Chromium issue 134609).
-
-        Fixed bug in Math.min/max in optimized code (Chromium issue 145961).
-
-        Directly use %ObjectKeys in json stringify (Chromium issue 2312).
-
-        Fixed VS2005 build (issue 2313).
-
-        Activated fixed ES5 readonly semantics by default.
-
-        Added hardfp flag to the Makefile.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-08-29: Version 3.13.5
-
-        Release stack trace data after firing Error.stack accessor.
-        (issue 2308)
-
-        Added a new API V8::SetJitCodeEventHandler to push code name and
-        location to users such as profilers.
-
-        Allocate block-scoped global bindings to global context.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-08-28: Version 3.13.4
-
-        Print reason for disabling optimization. Kill --trace-bailout flag.
-
-        Provided option to disable full DEBUG build on Android.
-
-        Introduced global contexts to represent lexical global scope(s).
-
-        Fixed rounding in Uint8ClampedArray setter. (issue 2294)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-08-21: Version 3.13.3
-
-        Performance and stability improvements on all platforms.
-
-
-2012-08-20: Version 3.13.2
-
-        Performance and stability improvements on all platforms.
-
-
-2012-08-16: Version 3.13.1
-
-        Performance and stability improvements on all platforms.
-
-
-2012-08-10: Version 3.13.0
-
-        Added histograms for total allocated/live heap size, as well as
-        allocated size and percentage of total for map and cell space.
-
-        Fixed parseInt's octal parsing behavior (ECMA-262 Annex E 15.1.2.2).
-        (issue 1645)
-
-        Added checks for interceptors to negative lookup code in Crankshaft.
-        (Chromium issue 140473)
-
-        Made incremental marking clear ICs and type feedback cells.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-08-01: Version 3.12.19
-
-        Performance and stability improvements on all platforms.
-
-
-2012-07-30: Version 3.12.18
-
-        Forced using bit-pattern for signed zero double. (issue 2239)
-
-        Made sure double to int conversion is correct. (issue 2260)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-07-27: Version 3.12.17
-
-        Always set the callee's context when calling a function from optimized
-        code.
-        (Chromium issue 138887)
-
-        Fixed building with GCC 3.x
-        (issue 2016, 2017)
-
-        Improved API calls that return empty handles.
-        (issue 2245)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-07-25: Version 3.12.16
-
-        Performance and stability improvements on all platforms.
-
-
-2012-07-24: Version 3.12.15
-
-        Added PRESERVE_ASCII_NULL option to String::WriteAscii.
-        (issue 2252)
-
-        Added dependency to HLoadKeyed* instructions to prevent invalid
-        hoisting. (Chromium issue 137768)
-
-        Enabled building d8 for Android on Mac.
-
-        Interpret negative hexadecimal literals as NaN.
-        (issue 2240)
-
-        Expose counters in javascript when using --track-gc-object-stats.
-
-        Enabled building and testing V8 on Android IA.
-
-        Added --trace-parse flag to parser.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-07-18: Version 3.12.14
-
-        Deactivated optimization of packed arrays.
-        (Chromium issue 137768)
-
-        Fixed broken accessor transition.
-        (Chromium issue 137689)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-07-17: Version 3.12.13
-
-        Fixed missing tagging of stack value in finally block.
-        (Chromium issue 137496)
-
-        Added more support for heap analysis.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-07-16: Version 3.12.12
-
-        Added an option to the tickprocessor to specify the directory for lib
-        lookup.
-
-        Fixed ICs for slow objects with native accessor (Chromium issue 137002).
-
-        Fixed transcendental cache on ARM in optimized code (issue 2234).
-
-        New heap inspection tools: counters for object sizes and counts,
-        histograms for external fragmentation.
-
-        Incorporated constness into inferred interfaces (in preparation for
-        handling imports) (issue 1569).
-
-        Performance and stability improvements on all platforms.
-
-
-2012-07-12: Version 3.12.11
-
-        Renamed "mips" arch to "mipsel" in the GYP build.
-
-        Fixed computation of call targets on prototypes in Crankshaft.
-        (Chromium issue 125148)
-
-        Removed use of __lookupGetter__ when generating stack trace.
-        (issue 1591)
-
-        Turned on ES 5.2 globals semantics by default.
-        (issue 1991, Chromium issue 80591)
-
-        Synced preparser and parser wrt syntax error in switch..case.
-        (issue 2210)
-
-        Fixed reporting of octal literals in strict mode when preparsing.
-        (issue 2220)
-
-        Fixed inline constructors for Harmony Proxy prototypes.
-        (issue 2225)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-07-10: Version 3.12.10
-
-        Re-enabled and fixed issue with array bounds check elimination
-        (Chromium issue 132114).
-
-        Fixed Debug::Break crash. (Chromium issue 131642)
-
-        Added optimizing compiler support for JavaScript getters.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-07-06: Version 3.12.9
-
-        Correctly advance the scanner when scanning unicode regexp flag.
-        (Chromium issue 136084)
-
-        Fixed unhandlified code calling Harmony Proxy traps.
-        (issue 2219)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-07-05: Version 3.12.8
-
-        Implemented TypedArray.set and ArrayBuffer.slice in d8.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-07-03: Version 3.12.7
-
-        Fixed lazy compilation for strict eval scopes.
-        (Chromium issue 135066)
-
-        Made MACOSX_DEPLOYMENT_TARGET configurable in GYP.
-        (issue 2151)
-
-        Report "hidden properties" in heap profiler for properties case.
-        (issue 2212)
-
-        Activated optimization of packed arrays by default.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-06-29: Version 3.12.6
-
-        Cleaned up hardfp ABI detection for ARM (V8 issue 2140).
-
-        Extended TypedArray support in d8.
-
-
-2012-06-28: Version 3.12.5
-
-        Fixed lazy parsing heuristics to respect outer scope.
-        (Chromium issue 135008)
-
-        Allow using test-wrapper-gypbuild.py on Windows when no python
-        interpreter is registered.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-06-27: Version 3.12.4
-
-        Removed -fomit-frame-pointer flag from Release builds to make
-        the stack walkable by TCMalloc (Chromium issue 133723).
-
-        Ported r7868 (constant masking) to x64 (issue 1374).
-
-        Expose more detailed memory statistics (issue 2201).
-
-        Fixed Harmony Maps and WeakMaps for undefined values
-        (Chromium issue 132744).
-
-        Correctly throw reference error in strict mode with ICs disabled
-        (issue 2119).
-
-        Performance and stability improvements on all platforms.
-
-
-2012-06-25: Version 3.12.3
-
-        Reverted r11835 'Unify promotion and allocation limit computation' due
-        to V8 Splay performance regression on Mac.  (Chromium issue 134183)
-
-        Fixed sharing of literal boilerplates for optimized code.  (issue 2193)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-06-22: Version 3.12.2
-
-        Made near-jump check more strict in LoadNamedFieldPolymorphic on
-        ia32/x64. (Chromium issue 134055)
-
-        Fixed lazy sweeping heuristics to prevent old-space expansion.
-        (issue 2194)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-06-21: Version 3.12.1
-
-        Performance and stability improvements on all platforms.
-
-
-2012-06-20: Version 3.12.0
-
-        Fixed Chromium issues:
-        115100, 129628, 131994, 132727, 132741, 132742, 133211
-
-        Fixed V8 issues:
-        915, 1914, 2034, 2087, 2094, 2134, 2156, 2166, 2172, 2177, 2179, 2185
-
-        Added --extra-code flag to mksnapshot to load JS code into the VM
-        before creating the snapshot.
-
-        Support 'restart call frame' command in the debugger.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-06-13: Version 3.11.10
-
-        Implemented heap profiler memory usage reporting.
-
-        Preserved error message during finally block in try..finally.
-        (Chromium issue 129171)
-
-        Fixed EnsureCanContainElements to properly handle double values.
-        (issue 2170)
-
-        Improved heuristics to keep objects in fast mode with inherited
-        constructors.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-06-06: Version 3.11.9
-
-        Implemented ES5-conformant semantics for inherited setters and read-only
-        properties. Currently behind --es5_readonly flag, because it breaks
-        WebKit bindings.
-
-        Exposed last seen heap object id via v8 public api.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-05-31: Version 3.11.8
-
-        Avoid overdeep recursion in regexp where a guarded expression with a
-        minimum repetition count is inside another quantifier.
-        (Chromium issue 129926)
-
-        Fixed missing write barrier in store field stub.
-        (issues 2143, 1465, Chromium issue 129355)
-
-        Proxies: Fixed receiver for setters inherited from proxies.
-        Proxies: Fixed ToStringArray function so that it does not reject some
-        keys.
-        (issue 1543)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-05-29: Version 3.11.7
-
-        Get better function names in stack traces.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-05-24: Version 3.11.6
-
-        Fixed RegExp.prototype.toString for incompatible receivers
-        (issue 1981).
-
-        Performance and stability improvements on all platforms.
-
-
-2012-05-23: Version 3.11.5
-
-        Performance and stability improvements on all platforms.
-
-
-2012-05-22: Version 3.11.4
-
-        Some cleanup to common.gypi. This fixes some host/target combinations
-        that weren't working in the Make build on Mac.
-
-        Handle EINTR in socket functions and continue incomplete sends.
-        (issue 2098)
-
-        Fixed python deprecations.  (issue 1391)
-
-        Made socket send and receive more robust and return 0 on failure.
-        (Chromium issue 15719)
-
-        Fixed GCC 4.7 (C++11) compilation.  (issue 2136)
-
-        Set '-m32' option for host and target platforms
-
-        Performance and stability improvements on all platforms.
-
-
-2012-05-18: Version 3.11.3
-
-        Disable optimization for functions that have scopes that cannot be
-        reconstructed from the context chain. (issue 2071)
-
-        Define V8_EXPORT to nothing for clients of v8. (Chromium issue 90078)
-
-        Correctly check for native error objects.  (Chromium issue 2138)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-05-16: Version 3.11.2
-
-        Revert r11496. (Chromium issue 128146)
-
-        Implement map collection for incremental marking. (issue 1465)
-
-        Add toString method to CallSite (which describes a frame of the
-        stack trace).
-
-
-2012-05-15: Version 3.11.1
-
-        Added a readbuffer function to d8 that reads a file into an ArrayBuffer.
-
-        Fix freebsd build. (V8 issue 2126)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-05-11: Version 3.11.0
-
-        Fixed compose-discard crasher from r11524 (issue 2123).
-
-        Activated new global semantics by default. Global variables can
-        now shadow properties of the global object (ES5.1 erratum).
-
-        Properly set ElementsKind of empty FAST_DOUBLE_ELEMENTS arrays when
-        transitioning (Chromium issue 117409).
-
-        Made Error.prototype.name writable again, as required by the spec and
-        the web (Chromium issue 69187).
-
-        Implemented map collection with incremental marking (issue 1465).
-
-        Regexp: Fixed overflow in min-match-length calculation
-        (Chromium issue 126412).
-
-        MIPS: Fixed illegal instruction use on Loongson in code for
-        Math.random() (issue 2115).
-
-        Fixed crash bug in VisitChoice (Chromium issue 126272).
-
-        Fixed unsigned-Smi check in MappedArgumentsLookup
-        (Chromium issue 126414).
-
-        Fixed LiveEdit for function with no locals (issue 825).
-
-        Fixed register clobbering in LoadIC for interceptors
-        (Chromium issue 125988).
-
-        Implemented clearing of CompareICs (issue 2102).
-
-        Performance and stability improvements on all platforms.
-
-
-2012-05-03: Version 3.10.8
-
-        Enabled MIPS cross-compilation.
-
-        Ensured reload of elements pointer in StoreFastDoubleElement stub.
-        (Chromium issue 125515)
-
-        Fixed corner cases in truncation behavior when storing to
-        TypedArrays. (issue 2110)
-
-        Fixed failure to properly recognize and report out-of-memory
-        conditions when allocating code space pages. (Chromium issue
-        118625)
-
-        Fixed idle notifications to perform a round of incremental GCs
-        after context disposal. (issue 2107)
-
-        Fixed preparser for try statement. (issue 2109)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-04-30: Version 3.10.7
-
-        Performance and stability improvements on all platforms.
-
-
-2012-04-26: Version 3.10.6
-
-        Fixed some bugs in accessing details of the last regexp match.
-
-        Fixed source property of empty RegExp objects. (issue 1982)
-
-        Enabled inlining some V8 API functions.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-04-23: Version 3.10.5
-
-        Put new global var semantics behind a flag until WebKit tests are
-        cleaned up.
-
-        Enabled stepping into callback passed to builtins.
-        (Chromium issue 109564)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-04-19: Version 3.10.4
-
-        Fixed issues when stressing compaction with WeakMaps.
-
-        Fixed missing GVN flag for new-space promotion. (Chromium issue 123919)
-
-        Simplify invocation sequence at monomorphic function invocation sites.
-        (issue 2079)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-04-17: Version 3.10.3
-
-        Fixed several bugs in heap profiles (including issue 2078).
-
-        Throw syntax errors on illegal escape sequences.
-
-        Implemented rudimentary module linking (behind --harmony flag)
-
-        Implemented ES5 erratum: Global declarations should shadow
-        inherited properties.
-
-        Made handling of const more consistent when combined with 'eval'
-        and 'with'.
-
-        Fixed V8 on MinGW-x64 (issue 2026).
-
-        Performance and stability improvements on all platforms.
-
-
-2012-04-13: Version 3.10.2
-
-        Fixed native ARM build (issues 1744, 539)
-
-        Return LOOKUP variable instead of CONTEXT for non-context allocated
-        outer scope parameters (Chromium issue 119609).
-
-        Fixed regular and ElementsKind transitions interfering with each other
-        (Chromium issue 122271).
-
-        Improved performance of keyed loads/stores which have a HeapNumber
-        index (issues 1388, 1295).
-
-        Fixed WeakMap processing for evacuation candidates (issue 2060).
-
-        Bailout on possible direct eval calls (Chromium issue 122681).
-
-        Do not assume that names of function expressions are context-allocated
-        (issue 2051).
-
-        Performance and stability improvements on all platforms.
-
-
-2012-04-10: Version 3.10.1
-
-        Fixed bug with arguments object in inlined functions (issue 2045).
-
-        Fixed performance bug with lazy initialization (Chromium issue
-        118686).
-
-        Added suppport for Mac OS X 64bit builds with GYP.
-        (Patch contributed by Filipe David Manana <fdmanana@gmail.com>)
-
-        Fixed bug with hidden properties (issue 2034).
-
-        Fixed a performance bug when reloading pages (Chromium issue 117767,
-        V8 issue 1902).
-
-        Fixed bug when optimizing throw in top-level code (issue 2054).
-
-        Fixed two bugs with array literals (issue 2055, Chromium issue 121407).
-
-        Fixed bug with Math.min/Math.max with NaN inputs (issue 2056).
-
-        Fixed a bug with the new runtime profiler (Chromium issue 121147).
-
-        Fixed compilation of V8 using uClibc.
-
-        Optimized boot-up memory use.
-
-        Optimized regular expressions.
-
-
-2012-03-30: Version 3.10.0
-
-        Fixed store IC writability check in strict mode
-        (Chromium issue 120099).
-
-        Resynchronize timers if the Windows system time was changed.
-        (Chromium issue 119815)
-
-        Removed "-mfloat-abi=hard" from host compiler cflags when building for
-        hardfp ARM
-        (https://code.google.com/p/chrome-os-partner/issues/detail?id=8539)
-
-        Fixed edge case for case independent regexp character classes
-        (issue 2032).
-
-        Reset function info counters after context disposal.
-        (Chromium issue 117767, V8 issue 1902)
-
-        Fixed missing write barrier in CopyObjectToObjectElements.
-        (Chromium issue 119926)
-
-        Fixed missing bounds check in HasElementImpl.
-        (Chromium issue 119925)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-03-23: Version 3.9.24
-
-        Activated count-based profiler for ARM.
-
-        Fixed use of proxies as f.prototype properties. (issue 2021)
-
-        Enabled snapshots on MIPS.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-03-21: Version 3.9.23
-
-        Use correct arguments adaptation environment when inlining function
-        containing arguments. (Issue 2014)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-03-20: Version 3.9.22
-
-        Enabled count-based profiler by default.
-
-        Implemented a hash based look-up to speed up address checks
-        in large object space (issue 853).
-
-        Performance and stability improvements on all platforms.
-
-
-2012-03-19: Version 3.9.21
-
-        Fixed push-to-trunk script (and re-push).
-
-        Added API call that identifies strings that are guaranteed only to
-        contain ASCII characters.
-
-
-2012-03-19: Version 3.9.20
-
-        Fixed declarations escaping global strict eval. (Issue 1624)
-
-        Fixed wrapping of receiver for non-strict callbacks. (Issue 1973)
-
-        Fixed function declarations overwriting read-only global properties.
-        (Chromium issue 115452)
-
-        Fixed --use-strict flag in combination with --harmony[-scoping].
-
-        Debugger: naive implementation of "step into Function.prototype.bind".
-
-        Debugger: added ability to set script source from within OnBeforeCompile
-
-        Added flag to always call DebugBreak on abort.
-
-        Re-enabled constructor inlining and inline === comparison with boolean
-        constants. (Issue 2009)
-
-        Don't use an explicit s0 in ClampDoubleToUint8. (Issue 2004)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-03-14: Version 3.9.19
-
-        Ensure there is a smi check of the receiver for global load and call
-        ICs (Chromium issue 117794).
-
-        Performance and stability improvements on all platforms.
-
-
-2012-03-13: Version 3.9.18
-
-        Ensure consistency of Math.sqrt on Intel platforms.
-
-        Remove static initializers in v8. (issue 1859)
-
-        Add explicit dependency on v8_base in the GYP-based build.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-03-12: Version 3.9.17
-
-        Fixed VFP detection through compiler defines. (issue 1996)
-
-        Add Code-related fields to postmortem metadata.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-03-09: Version 3.9.16
-
-        Added basic interface inference for modules (behind the --harmony flag).
-
-        Added Object.is, Number.isFinite, Number.isNaN.
-
-        Updated the Unicode tables to Unicode version 6.1.0.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-03-06: Version 3.9.15
-
-        Fix the heap profiler crash caused by memory layout changes between
-        passes.
-
-        Fix Error.prototype.toString to throw TypeError. (issue 1980)
-
-        Fix double-rounding in strtod for MinGW. (issue 1062)
-
-        Fix corrupted snapshot serializaton on ia32. (Chromium issue v8/1985)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-03-01: Version 3.9.14
-
-        Performance and stability improvements on all platforms.
-
-
-2012-02-29: Version 3.9.13
-
-        Added code kind check before preparing for OSR. (issue 1900, 115073)
-
-        Fixed issue 1802: Pass zone explicitly to zone-allocation on x64 and
-        ARM.
-
-        Ported string construct stub to x64. (issue 849)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-02-28: Version 3.9.12
-
-        Fixed the negative lookup stub to handle deleted entries in a
-        dictionary. (issue 1964)
-
-        Added a new API where the host can supply a callback function. The
-        callback function can resolve the location of a return address on stack
-        to the location where a return-address rewriting profiler stashed the
-        original return address.
-
-        Fixed Chromium issue http://crbug.com/115646: When compiling for-in
-        pass correct context value to the increment instruction.
-
-        Fixed issue 1853: Update breakpoints set with partial file name after
-        compile.
-
-
-2012-02-27: Version 3.9.11
-
-        Made 'module' a context-sensitive keyword (V8 issue 1957).
-
-
-2012-02-24: Version 3.9.10
-
-        Fixed V8 issues 1322, 1772 and 1969.
-
-        Conformance improvements.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-02-23: Version 3.9.9
-
-        Supported fast case for-in in Crankshaft.
-
-        Sped up heap snapshot serialization and dominators construction.
-
-        Randomized allocation addresses on windows. (Chromium issue 115151)
-
-        Fixed compilation with MinGW-w64. (issue 1943)
-
-        Fixed incorrect value of assignments to non-extensible properties.
-
-        Fixed a crash bug in generated code on ia32.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-02-21: Version 3.9.8
-
-        Fixed memory leak and missing #include in StartupDataDecompressor
-        (issue 1960).
-
-        Renamed static methods to avoid shadowing virtual methods and fix Clang
-        C++11 compile error.
-
-        Fixed sequence of element access in array builtins (issue 1790).
-
-        Performance and stability improvements on all platforms.
-
-
-2012-02-16: Version 3.9.7
-
-        Fixed V8 issues 1322, 1878, 1942, 1945 and Chromium issue 113924.
-
-        Fixed GCC-4.7 warnings.
-
-        Added Navier-Stokes benchmark.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-02-14: Version 3.9.6
-
-        Fixed template-related linker error. (issue 1936)
-
-        Allowed inlining of functions containing object literals.  (issue 1322)
-
-        Added --call-graph-size option to tickprocessor.  (issue 1937)
-
-        Heap Snapshot maximum size limit is too low for really big apps. At the
-        moment the limit is 256MB.  (Chromium issue 113015)
-
-        Performance and stability improvements on all platforms.
-
-
-2012-02-09: Version 3.9.5
-
-        Removed unused command line flags.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-02-08: Version 3.9.4
-
-        Properly initialize element-transitioning array literals on ARM.
-        (issue 1930)
-
-        Bug fixes on all platforms.
-
-
-2012-02-07: Version 3.9.3
-
-        When rethrowing an exception, print the stack trace of its original
-        site instead of rethrow site (Chromium issue 60240).
-
-        Increased size of small stacks from 32k to 64k to avoid hitting limits
-        in Chromium (Chromium issue 112843).
-
-
-2012-02-06: Version 3.9.2
-
-        Added timestamp to --trace-gc output. (issue 1932)
-
-        Heap profiler reports implicit references.
-
-        Optionally export metadata with libv8 to enable debuggers to inspect V8
-        state.
-
-
-2012-02-02: Version 3.9.1
-
-        Fixed memory leak in NativeObjectsExplorer::FindOrAddGroupInfo
-        (Chromium issue 112315).
-
-        Fixed a crash in dev tools (Chromium issue 107996).
-
-        Added 'dependencies_traverse': 1 to v8 GYP target.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-02-01: Version 3.9.0
-
-        Reduced memory use immediately after starting V8.
-
-        Stability fixes and performance improvements on all platforms.
-
-
-2012-01-26: Version 3.8.9
-
-        Flush number string cache on GC (issue 1605).
-
-        Provide access to function inferred name with
-	v8::Function::GetInferredName in V8 public API.
-
-        Fix building with Clang (issue 1912).
-
-        Reduce the space used by the stack for the profiling thread.
-
-        Fix misleading documentation of v8::Locker (issue 542).
-
-        Introduce readbinary function in d8 to read binary files.
-
-        Performance and stability improvements on all platforms.
-
-
-2012-01-23: Version 3.8.8
-
-        Limited number of loop iterations in Heap::ReserveSpace
-        (Chromium issue 99027).
-
-        Fixed solaris build (VirtualMemory) (issue 1761).
-
-        Fixed strict vs. non-strict handling of function proxies in
-        higher-order array and string methods.
-
-        Enabled asynchronous remote debugging with d8 (issue 1691).
-
-        Stability and performance improvements on all platforms.
-
-
-2012-01-19: Version 3.8.7
-
-        Ensure that LRandom restores rsi after call to the C function on x64.
-        (Chromium issue http://crbug.com/110509)
-
-        Fixing include issues on *bsd when building with scons.
-        (issue 1897)
-
-        Provide a switch to specify -fno-strict-aliasing
-        (issue 1887)
-
-        Move WIN32 define from standalone.gypi to common.gypi
-        (issue 1760)
-
-        Fix corner-case in heap size estimation.
-        (issue 1893)
-
-        Fix and enable NEW_NON_STRICT_FAST ArgumentsAccess stub on x64.
-        (issue 1903)
-
-        Performance improvements and bug fixes.
-
-
-2012-01-16: Version 3.8.6
-
-        Add primitive WebGL array support to d8.
-
-        Improve heap size estimation (issue 1893).
-
-        Hash collision DOS workaround extended from string keys
-        to numeric keys.
-
-        Provide an API for iterating through all external strings referenced
-        from the JS heap.
-
-        Adjust position recorded for call expressions. http://crbug.com/109195
-
-        Fix GC crash related to instanceof. http://crbug.com/109448
-
-        Performance improvements and bug fixes.
-
-
-2012-01-05: Version 3.8.5
-
-        Fix broken test that assumes that no GC can clear the regexp cache (GC
-        can happen at any time due to Crankshaft).
-
-        Fix handling of bogus receivers for Harmony collections. (issue 1884)
-
-        Add netbsd support to gyp build.
-
-        Determine page size at runtime on posix platforms.
-
-        Ensure that store buffer filtering hash sets are cleared after
-        StoreBuffer::Filter.
-
-        Randomize the seed used for string hashing.  This helps guard against
-        CPU-eating DOS attacks against node.js servers.  Based on code from
-        Bert Belder.  This version only solves the issue for those that compile
-        V8 themselves or those that do not use snapshots.  A snapshot-based
-        precompiled V8 will still have predictable string hash codes.
-
-        Implement callback when script finishes running in V8 API.
-
-        Improve performance of Math.min and Math.max for the case of two
-        arguments. (issue 1325)
-
-
-2012-01-02: Version 3.8.4
-
-        Performance improvements for large Smi-only arrays.
-
-        Fixed InternalArrays construction. (issue 1878)
-
-
-2011-12-27: Version 3.8.3
-
-        Avoid embedding new space objects into code objects in the lithium gap
-        resolver. (chromium:108296)
-
-        Bug fixes and performance optimizations on all platforms.
-
-
-2011-12-21: Version 3.8.2
-
-        Add max optimization flag to v8 gyp build to ensure V8 is always built 
-        fully optimized in Chrome.
-
-        MIPS: Bring MIPS to parity with other platforms.
-
-        Optimizations and stability improvements on all platforms.
-
-
-2011-12-19: Version 3.8.1
-
-        Fixed GCC 4.7 warnings. Patch from Tobias Burnus.
-
-        Stability improvements on all platforms.
-
-
-2011-12-13: Version 3.8.0
-
-        Fixed handling of arrays in DefineOwnProperty. (issue 1756)
-
-        Sync parser and preparser on do-while and return statements. 
-        (issue 1856)
-
-        Fixed another corner case for DefineOwnProperty on arrays (issue 1756).
-
-        Stability and performance improvements on all platforms.
-
-
-2011-12-01: Version 3.7.12
-
-        Increase tick interval for the android platform.
-
-        Fix a bug in the register allocator. (chromium:105112)
-
-        Fix handling of recompiling code. (chromium:105375, v8:1782)
-
-        Start incremental marking on idle notification. (v8:1458)
-
-        Build fixes for various platforms.
-
-        Various performance improvements.
-
-
-2011-11-29: Version 3.7.11
-
-        Fixed bug when generating padding to ensure space for lazy
-        deoptimization.
-        (issue 1846)
-
-        Further reduced pause times due to GC.
-
-        Stability and performance improvements on all platforms.
-
-
-2011-11-23: Version 3.7.10
-
-        Set maximum length of FixedArray in terms of elements instead an
-        absolute number of bytes.
-        (Chromium issue 103103)
-
-        Stability and performance improvements on all platforms.
-
-
-2011-11-21: Version 3.7.9
-
-        Removed exit-time destructors.
-
-        Stability and performance improvements on all platforms.
-
-
-2011-11-17: Version 3.7.8
-
-        Removed hidden prototype from builtins, i.e., deleting an overridden
-        function on builtins will not make the original function reappear.
-
-        Added NetBSD support for scons build.
-
-        Performance improvements on all platforms.
-
-
-2011-11-14: Version 3.7.7
-
-        Fix missing fast property accessors in heap snapshots.
-        (issue 1818)
-
-
-2011-11-11: Version 3.7.6
-
-        Fixed filtering of store buffer for large object pages.
-        (issue 1817)
-
-        Fixed generated hash function on all platforms.
-        (issue 1808)
-
-        Fixed Heap::Shrink to ensure that it does not free pages that are
-        still in use.
-        (Chromium issue 100414)
-
-        Stability and performance improvements on all platforms.
-
-
-2011-11-10: Version 3.7.5
-
-        Added initial gyp infrastructure for MIPS.
-
-        Implemented performance improvements to the incremental garbage
-        collector.
-
-        Added optimizations and stability improvements on all platforms.
-
-
-2011-11-07: Version 3.7.4
-
-        Proper "libv8.so.3.7.4" SONAME for Linux shared library (issue 1786).
-
-        Fix Harmony sets and maps to allow null and undefined as keys
-        (still hidden behind --harmony flag) (issue 1622).
-
-        Implement VirtualMemory on FreeBSD to fix build (issue 1807).
-
-        Enable VFP instructions for Android.
-
-        Fix error handling in Date.prototype.toISOString (issue 1792).
-
-        Bug fixes and performance improvements for all platforms.
-
-        Not officially supported but noteworthy: Crankshaft for MIPS :-)
-
-
-2011-10-28: Version 3.7.3
-
-        Slight deoptimization as a workaround for issue with jslint: Issue
-        1789.
-
-
-2011-10-27: Version 3.7.2
-
-        Fix bug in deoptimization.  Known issue with jslint: Issue 1789.
-
-
-2011-10-26: Version 3.7.1
-
-        Achieved 33% speedup in debug-mode tests.
-
-        Removed special casing of calls to RegExp test and exec methods with no
-        argument.  Now matches new JSC behaviour.  crbug.com/75740.
-
-        Return the empty string on cyclic references in toString (ES5
-        conformance).
-
-        Fixed bug triggered by JSBeautifier.  crbug.com/100409.
-
-        Made Math.random state per-context instead of per-process (issue 864).
-
-        Fixed stack traces to skip native functions.
-
-        Make snapshots (new contexts) smaller and faster.
-
-        Fixed handling of Function.apply for non-array arguments.
-
-        Fixed evaluation order in defineProperties to match FireFox.
-
-        Fixed handling of non-object receivers for array builtins,
-        crbug.com/100702.
-
-        Multiple fixes to improve compliance with test262.
-
-        Fixed compatibility with older Android releases.
-
-        Fixed compilation with gcc-4.5.3.
-
-        Improved performance of WriteUtf8, issue 1665.
-
-        Made native syntax an early error in the preparser.
-
-        Fixed issues 793 and 893 relating to Function.prototype.bind.
-
-        Improved let, const, Set and Map support and other Harmony features
-        (behind the --harmony flag).
-
-        Changed evaluation order for > and <= to match ES5 instead of ES3.
-
-        Bug fixes and performance improvements on all platforms.
-
-
-2011-10-13: Version 3.7.0
-
-        Fixed array handling for Object.defineOwnProperty (ES5 conformance).
-
-        Fixed issue 1757 (string slices of external strings).
-
-        Fixed issue 1759 (ARM).
-
-        Added flag --noclever-optimizations to disable some things that
-        caused trouble in the past.
-
-        Added flag --stress-compaction for testing.
-
-        Added flag --harmony to activate all experimental Harmony features.
-
-
-2011-10-10: Version 3.6.6
-
-        Added a GC pause visualization tool.
-
-        Added presubmit=no and werror=no flags to Makefile.
-
-        ES5/Test262 conformance improvements.
-
-        Fixed compilation issues with GCC 4.5.x (issue 1743).
-
-        Bug fixes and performance improvements on all platforms.
-
-
-2011-10-05: Version 3.6.5
-
-        New incremental garbage collector.
-
-        Removed the hard heap size limit (soft heap size limit is still
-        700/1400Mbytes by default).
-
-        Implemented ES5 generic Array.prototype.toString (Issue 1361).
-
-        V8 now allows surrogate pair codes in decodeURIComponent (Issue 1415).
-
-        Fixed x64 RegExp start-of-string bug (Issues 1746, 1748).
-
-        Fixed propertyIsEnumerable for numeric properties (Issue 1692).
-
-        Fixed the MinGW and Windows 2000 builds.
-
-        Fixed "Prototype chain is not searched if named property handler does
-        not set a property" (Issue 1636).
-
-        Made the RegExp.prototype object be a RegExp object (Issue 1217).
-
-        Disallowed future reserved words as labels in strict mode.
-
-        Fixed string split to correctly coerce the separator to a string
-        (Issue 1711).
-
-        API: Added an optional source length field to the Extension
-        constructor.
-
-        API: Added Debug::DisableAgent to match existing Debug::EnableAgent
-        (Issue 1573).
-
-        Added "native" target to Makefile for the benefit of Linux distros.
-
-        Fixed: debugger stops stepping outside evaluate (Issue 1639).
-
-        More work on ES-Harmony proxies.  Still hidden behind a flag.
-
-        Bug fixes and performance improvements on all platforms.
-
-
-2011-09-15: Version 3.6.4
-
-        Fixed d8's broken readline history.
-
-        Removed the need for code delete events in CPU profiler (Issue 1466).
-
-        Fixed debugger stepping next with trycatch recursion (Issue 1639).
-
-        Fixing parallel execution in d8 (with -p) and some memory leaks.
-
-        Support for precise stepping in functions compiled before debugging was
-        started (step 1).
-
-
-2011-09-13: Version 3.6.3
-
-        Implemented better support of typed arrays in the d8 shell.
-
-        Bug fixes and performance improvements on all platforms.
-
-
-2011-09-08: Version 3.6.2
-
-        Added "dependencies" target to top-level Makefile.
-
-        Added ability to turn profiler on/off in d8.
-
-        Added "soname_version" parameter to common.gypi, v8.gyp, and Makefile.
-
-        Fixed several crash bugs.
-
-
-2011-09-07: Version 3.6.1
-
-        Fixed a bug in abrupt exit from with or catch inside finally.
-
-        Fixed possible crash in FixedDoubleArray::Initialize() (Chromium
-        issue 95113).
-
-        Fixed a bug in Page::GetRegionMaskForSpan (Chromium issue 94425).
-
-        Fixed a few clang warnings (which -Werror treated as errors).
-
-        Performance improvements on all platforms.
-
-
-2011-09-05: Version 3.6.0
-
-        Fixed a bug when optimizing named function expression (issue 1647).
-
-        Fixed a bug when optimizing f.call.apply (issue 1650).
-
-        Made arguments and caller always be null on native functions
-        (issues 1548 and 1643).
-
-        Fixed issue 1648 (cross-compiling x64 targeting ia32).
-
-        Fixed issue 371 (d8 printing of strings containing \0).
-
-        Fixed order of evaluation in arguments to parseInt (issue 1649).
-
-        Fixed a problem with large heap snapshots in Chrome DevTools
-        (issue 1658, chromium issue 89268).
-
-        Upped default maximum heap size from 512M to 700M.
-
-
-2011-08-31: Version 3.5.10
-
-        Added dependency of v8_base on WinSocket2 Windows library in
-        the GYP-build.
-
-        Various bugfixes.
-
-
-2011-08-29: Version 3.5.9
-
-        Made FromPropertyDescriptor not trigger inherited setters.
-
-        Fixed .gyp files to work on the ARM simulator.
-
-        Fixed shared library build warnings for MSVS.
-
-
-2011-08-24: Version 3.5.8
-
-        Added V8EXPORT attributes for v8::Array::CheckCast and
-        v8::Number::CheckCast.
-
-        Made a slight API change enabling opting out from null termination
-        in String::Write*().
-
-        Fixed arm build for gcc-4.6.
-
-
-2011-08-22: Version 3.5.7
-
-        Make scanner handle invalid unicode escapes in identifiers correctly.
-
-        Make regexp flag parsing stricter.
-
-        Fix several memory leaks.
-
-
-2011-08-17: Version 3.5.6
-
-        Fixed issue that could cause crashes when running with --heap-stats.
-
-        Fixed compilation on Linux 2.6.9 and older.
-
-        Fixed live-object-list to work with isolates.
-
-        Fixed memory leaks in zones and isolates.
-
-        Fixed a performance regression for TypedArrays on x64.
-
-        Stability improvements on all platforms.
-
-
-2011-08-15: Version 3.5.5
-
-        Fixed bugs involving negative zero and the optimizing compiler.
-
-        Fixed optimized version of Function.apply(x, arguments). (issue 1592)
-
-        Eliminated uses of deprecated ARM instructions.
-
-        Sped up Math.floor by using SSE 4.1 roundsd instruction on ia32.
-
-        Removed restriction on the size of disassembled code that is printed.
-
-
-2011-08-10: Version 3.5.4
-
-        Added a preliminary implementation of ES Harmony weak maps.  Weak
-        maps can be enabled by the flag --harmony-weakmaps.
-
-        Introduced a toplevel Makefile to support GYP-based building.  GYP
-        can be obtained from http://gyp.googlecode.com.
-
-        Fixed a bug in the length property of functions created by
-        Function.prototype.bind.
-
-        Reduced malloc heap allocation on process startup.
-
-        Several important code generation bug fixes.
-
-        Performance improvements on all platforms.
-
-
-2011-08-03: Version 3.5.3
-
-        MIPS: Port of fix to ClassOf check from ARM.
-        Patch from Paul Lind <plind44@gmail.com>.
-
-        Stopped using mprotect on Cygwin.
-        Avoided uninitialized member warning on gcc 4.3.4
-        Both patches by Bert Belder.
-
-        Bug fixes and performance improvements on all platforms.
-
-
-2011-08-01: Version 3.5.2
-
-        Performance improvements on all platforms.
-
-
-2011-07-28: Version 3.5.1
-
-        Fixed setting the readonly flag on the prototype property using the
-        API call FunctionTemplate::SetPrototypeAttributes (issue 1539).
-
-        Changed the tools/test.py script to use d8 instead of shell for
-        testing.
-
-        Fixed crash in ToBooleanStub when GC happens during invocation.
-
-        Enabled automatic unboxing of double arrays.
-
-        Performance improvements on all platforms.
-
-
-2011-07-25: Version 3.5.0
-
-        Implemented Object.prototype.{hasOwnProperty, propertyIsEnumerable} for
-        proxies.
-
-        Removed logging to memory support.
-
-        Bugfixes and performance work.
-
-
-2011-07-20: Version 3.4.14
-
-        Fix the debugger for strict-mode functions. (Chromium issue 89236)
-
-        Add GetPropertyAttribute method for Object in the API. (Patch by
-        Peter Varga)
-
-        Fix -Wunused-but-set-variable for gcc-4.6 on x64. (Issue 1291)
-
-
-2011-07-18: Version 3.4.13
-
-        Improved debugger support to allow inspection of optimized frames (issue
-        1140).
-
-        Fixed a bug in prototype transitions cache clearing introduced by r8165.
-
-        Fixed shortcutting bug in HInferRepresentation. Patch by Andy Wingo.
-
-        Fixed a memory leak in sample/shell.cc (dispose semaphores).
-
-        Simplified HClampToUint8. Patch by Andy Wingo.
-
-        Exposed APIs for detecting boxed primitives, native errors. Patch by
-        Luke Zarko.
-
-        Added map check for COW elements to crankshaft array handling code
-        (issue 1560).
-
-        Sample shell and (a light version of) D8 links against a shared library
-        now.
-
-        Fixed bug in array filter and reduce functions (issue 1559).
-
-        Avoid TLS load in AstNode constructor.
-
-        Introduced a random entropy source which can optionally be provided at
-        initialization. (Chromium issue 89462).
-
-
-2011-07-13: Version 3.4.12
-
-        Added --prof profiling option to d8 shell.
-
-        Fixed a bug where reading a directory in d8 shell hangs (issue 1533).
-
-        Fixed a potential assertion failure in const declarations.
-
-        Fixed an assertion failure in descriptor arrays (issue 1526).
-
-        Enabled fast thread-local storage by default on supported platforms.
-
-        Improved reporting of source position for global variable loads
-        (issue 1527).
-
-
-2011-07-11: Version 3.4.11
-
-        Fixed MinGW32 build.
-
-        Fixed a GC bug with RegExp code flushing.
-
-        Implemented Object.defineProperty for proxies.
-
-        Fixed a bug in for/in iteration of arguments objects (issue 1531).
-
-        Added debugger support for inspecting optimized frames (issue 1140).
-
-        Allowed JSObject::PreventExtensions to work for arguments objects.
-
-        Bugfixes and performance work.
-
-
-2011-07-06: Version 3.4.10
-
-        Fixed debugger not breaking on certain "if" statements (issue 1523).
-
-        Fixed assertion failure in runtime profiler when running on IA32
-        without snapshot (issue 1522).
-
-        Fixed ABI for API calls on IA32 (for clang compatibility).
-
-        Introduced code flushing of RegExp code to free memory used by
-        RegExps sooner.
-
-        Fixed linux-tick-processor built wrong version of v8 (issue 1532).
-
-        Fixed assertion failure in v8::TryCache::StackTrace (issue 1529).
-
-        Performance improvements on all platforms.
-
-
-2011-07-04: Version 3.4.9
-
-        Added support for debugger inspection of locals in optimized frames
-        (issue 1140).
-
-        Fixed SConstruct to pass correct defines to samples/preparser when
-        building with library=shared.
-
-        Made date parser handle ES5 Date Time Strings correctly (issue 1498).
-
-        Fixed a bug in Object.defineProperty on the arguments object.
-
-        Performance improvements on all platforms.
-
-
-2011-06-29: Version 3.4.8
-
-        Ensure 16-byte stack alignment on Solaris (issue 1505).
-
-        Fix "illegal access" when calling parseInt with a radix
-        that is not a smi. (issue 1246).
-
-
-2011-06-27: Version 3.4.7
-
-        Fixed 64-bit build on FreeBSD.
-
-        Added API to set the property attributes for the prototype
-        property on functions created from FunctionTemplates.
-
-        Bugfixes and performance work.
-
-
-2011-06-22: Version 3.4.6
-
-        Lowered limit on code space for systems with low memory supply.
-
-        Allowed compiling v8_shell with the 'host' toolset (issue 82437).
-
-        Extended setBreakpoint API to accept partial script name (issue 1418).
-
-        Made multi-line comments not count when deciding whether the '-->'
-        comment starter is first on a line. This matches Safari.
-
-        Made handling of non-array recievers in Array length setter correct
-        (issue 1491).
-
-        Added ability to heap profiler to iterate over snapshot's node
-        (issue 1481).
-
-
-2011-06-20: Version 3.4.5
-
-        Fixed issues 794, 1097, 1215(partial), 1417, 1435, 1472, 1473,
-        1476, and 1477.
-
-        Improved code generation for !0 and !1.
-
-        Reduced memory usage for regular expressions with nested qualifiers.
-        (issue 1472)
-
-        Fixed V8 to count line terminators in multi-line comments.
-        (Chromium issue 86431)
-
-        Fixed disassembler=on option for release-mode builds. (issue 1473)
-
-        Performance improvements on all platforms.
-
-
-2011-06-15: Version 3.4.4
-
-        Added snapshot compression support and --stress-opt flag to d8.
-
-        Improved performance of try/catch.
-
-        Several GYP-related changes: Added support for building Xcode project
-        files. Make the ARM simulator build with GYP again. Generate Makefiles
-        for all architectures on Linux.
-
-        Fixed Array.prototype.{reduce,reduceRight} to pass undefined as the
-        receiver for strict mode callbacks. (issue 1436)
-
-        Fixed a bug where an array load was incorrectly hoisted by GVN.
-
-        Handle 'undefined' correctly when === has been specialized for doubles.
-        (issue 1434)
-
-        Corrected the limit of local variables in an optimized function from 64
-        to 63.
-
-        Correctly set ReadOnly flag on indexed properties when using the API Set
-        method. (issue 1470)
-
-        Give the correct error message when Object.isExtensible is called on a
-        non-object. (issue 1452)
-
-        Added GetOwnPropertyNames method for Object in the API. Patch by Peter
-        Varga.
-
-        Do not redefine properties unneccesarily in seal and freeze. (issue
-        1447)
-
-        IsExecutionTerminating has an Isolate parameter now.
-
-        Distinguish keyed loads with a symbol key from fast elements loads,
-        avoiding some useless deoptimizations. (issue 1471)
-
-
-2011-06-08: Version 3.4.3
-
-        Clear the global thread table when an isolate is disposed
-        (issue 1433).
-
-        Converted time zone name to UTF8 on Windows (issue 1290).
-
-        Limited the number of arguments in a function call to 32766
-        (issue 1413).
-
-        Compress sources of JS libraries in addition to the snapshot.
-
-        Fixed a bug in Lithium environment iteration.
-
-        Performance improvements on all platforms.
-
-
-2011-06-06: Version 3.4.2
-
-        More work on ES-Harmony proxies.  Still hidden behind a flag.
-
-        Fixed some crash bugs and improved performance.
-
-        Fixed building with gdb debugging support.
-
-        Do not install SIGPROF handler until it is needed.
-
-        Added DateTimeFormat to i18n API.
-
-        Fixed compilation on OpenBSD.
-
-        Take the ulimit into account when sizing the heap.  OpenBSD users
-        may still have to increase the default ulimit to run heavy pages in
-        the browser.
-
-
-2011-06-01: Version 3.4.1
-
-        Fixed JSON stringify issue with arrays.
-
-        Changed calls to JS builtins to be passed undefined when called with
-        implicit receiver.
-
-        Implemented the set trap for Harmony proxies. Proxies still need to
-        be enabled with the --harmony-proxies flag.
-
-
-2011-05-30: Version 3.4.0
-
-        Changed calls to undefined property setters to not throw (issue 1355).
-
-        Made RegExp objects not callable.
-
-        Fixed issues on special case large JSON strings in new json parser
-        (issues http://crbug.com/83877 and http://crbug.com/84186).
-
-        Performance improvements on all platforms.
-
-
-2011-05-25: Version 3.3.10
-
-        Fixed calls of strict mode function with an implicit receiver.
-
-        Fixed fast handling of arrays to properly deal with changes to the
-        Object prototype (issue 1403).
-
-        Changed strict mode poison pill to be the same type error function
-        (issue 1387).
-
-        Fixed a debug crash in arguments object handling (issue 1227).
-
-        Fixed a bug in deoptimization on x64 (issue 1404).
-
-        Performance improvements and bug fixes on all platforms.
-
-
-2011-05-23: Version 3.3.9
-
-        Added DateTimeFormat class to experimental i18n API.
-
-        Extended preparser to give early errors for some strict mode
-        restrictions.
-
-        Removed legacy execScript function from V8.
-
-        Extended isolate API with the ability to add embedder-specific
-        data to an isolate.
-
-        Added basic support for polymorphic loads from JS and external
-        arrays.
-
-        Fixed bug in handling of switch statements in the optimizing
-        compiler.
-
-
-2011-05-18: Version 3.3.8
-
-        Added MarkIndependent to the persistent handle API.  Independent
-        handles are independent of all other persistent handles and can be
-        garbage collected more frequently.
-
-        Implemented the get trap for Harmony proxies.  Proxies are enabled
-        with the --harmony-proxies flag.
-
-        Performance improvements and bug fixes on all platforms.
-
-
-2011-05-16: Version 3.3.7
-
-        Updated MIPS infrastructure files.
-
-        Performance improvements and bug fixes on all platforms.
-
-
-2011-05-11: Version 3.3.6
-
-        Updated MIPS infrastructure files.
-
-        Added method IsCallable for Object to the API.
-        Patch by Peter Varga.
-
-
-2011-05-09: Version 3.3.5
-
-        Fixed build on FreeBSD. Patch by Akinori MUSHA.
-
-        Added check that receiver is JSObject on API calls.
-
-        Implemented CallAsConstructor method for Object in the API (Issue 1348).
-        Patch by Peter Varga.
-
-        Added CallAsFunction method to the Object class in the API (Issue 1336).
-        Patch by Peter Varga.
-
-        Added per-isolate locking and unlocking.
-
-        Fixed bug in x64 >>> operator (Issue 1359).
-
-
-2011-05-04: Version 3.3.4
-
-        Implemented API to disallow code generation from strings for a context
-        (issue 1258).
-
-        Fixed bug with whitespaces in parseInt (issue 955).
-
-        Fixed bug with == comparison of Date objects (issue 1356).
-
-        Added GYP variables for ARM code generation:
-        v8_can_use_vfp_instructions, v8_can_use_unaligned_accesses
-        and v8_use_arm_eabi_hardfloat.
-
-
-2011-05-02: Version 3.3.3
-
-        Added support for generating Visual Studio solution and project files
-        using GYP.
-
-        Implemented support for ARM EABI calling convention variation where
-        floating-point arguments are passed in registers (hardfloat).
-
-        Added Object::HasOwnProperty() to the API.
-
-        Added support for compressing startup data to reduce binary size. This
-        includes build time support and an API for the embedder to decompress
-        the startup data before initializing V8.
-
-        Reduced the profiling hooks overhead from >400% to 25% when using
-        ll_prof.
-
-        Performance improvements and bug fixes on all platforms.
-
-
-2011-04-27: Version 3.3.2
-
-        Fixed crash bug on ARM with no VFP3 hardware.
-
-        Fixed compilation of V8 without debugger support.
-
-        Improved performance on JSLint.
-
-        Added support Float64 WebGL arrays.
-
-        Fixed crash bug in regexp replace.
-
-
-2011-04-20: Version 3.3.1
-
-        Reduced V8 binary size by removing virtual functions from hydrogen.
-
-        Fixed crash bug on x64.
-
-        Performance improvements on ARM and IA32.
-
-
-2011-04-18: Version 3.3.0
-
-        Fixed bug in floating point rounding in Crankshaft on ARM
-        (issue 958)
-
-        Fixed a number of issues with running without VFPv3 support on ARM
-        (issue 1315)
-
-        Introduced v8Locale.Collator, a partial implementation of Collator
-        per last ECMAScript meeting + mailing list.
-
-        Minor performance improvements and bug fixes.
-
-
-2011-04-13: Version 3.2.10
-
-        Fixed bug in external float arrays on ARM (issue 1323).
-
-        Minor performance improvements and bug fixes.
-
-
-2011-04-11: Version 3.2.9
-
-        Removed support for ABI prior to EABI on ARM.
-
-        Fixed multiple crash bugs.
-
-        Added GCMole to the repository, a simple static analysis tool that
-        searches for GC-unsafe evaluation order dependent callsites.
-
-        Made preparser API be exported in shared libraries.
-
-        Fixed multiple issues in EcmaScript 5 strict mode implementation.
-
-        Fixed mutable __proto__ property if object is not extensible
-        (Issue 1309).
-
-        Fixed auto suspension of the sampler thread.
-
-
-2011-04-06: Version 3.2.8
-
-        Exposed WebGL typed array constructors in the shell sample.
-
-        Performance improvements on all platforms.
-
-
-2011-04-04: Version 3.2.7
-
-        Disabled the original 'classic' V8 code generator.  Crankshaft is
-        now the default on all platforms.
-
-        Changed the heap profiler to use more descriptive names.
-
-        Performance and stability improvements to isolates on all platforms.
-
-
-2011-03-30: Version 3.2.6
-
-        Fixed xcode build warning in shell.cc (out of order initialization).
-
-        Fixed null-pointer dereference in the compiler when running without
-        SSE3 support (Chromium issue 77654).
-
-        Fixed x64 compilation error due to some dead code. (Issue 1286)
-
-        Introduced scons target to build the preparser stand-alone example.
-
-        Made FreeBSD build and pass all tests.
-
-
-2011-03-28: Version 3.2.5
-
-        Fixed build with Irregexp interpreter (issue 1266).
-
-        Added Crankshaft support for external arrays.
-
-        Fixed two potential crash bugs.
-
-
-2011-03-23: Version 3.2.4
-
-        Added isolates which allows several V8 instances in the same process.
-        This is controlled through the new Isolate class in the API.
-
-        Implemented more of EcmaScript 5 strict mode.
-
-        Reduced the time it takes to make detailed heap snapshot.
-
-        Added a number of commands to the ARM simulator and enhanced the ARM
-        disassembler.
-
-
-2011-03-17: Version 3.2.3
-
-        Fixed a number of crash bugs.
-
-        Fixed Array::New(length) to return an array with a length (issue 1256).
-
-        Fixed FreeBSD build.
-
-        Changed __defineGetter__ to not throw (matching the behavior of Safari).
-
-        Implemented more of EcmaScript 5 strict mode.
-
-        Improved Crankshaft performance on all platforms.
-
-
-2011-03-14: Version 3.2.2
-
-        Fixed a number of crash and correctness bugs.
-
-        Improved Crankshaft performance on all platforms.
-
-        Fixed Crankshaft on Solaris/Illumos.
-
-
-2011-03-10: Version 3.2.1
-
-        Fixed a number of crash bugs.
-
-        Improved Crankshaft for x64 and ARM.
-
-        Implemented more of EcmaScript 5 strict mode.
-
-
-2011-03-07: Version 3.2.0
-
-        Fixed a number of crash bugs.
-
-        Turned on Crankshaft by default on x64 and ARM.
-
-        Improved Crankshaft for x64 and ARM.
-
-        Implemented more of EcmaScript 5 strict mode.
-
-
-2011-03-02: Version 3.1.8
-
-        Fixed a number of crash bugs.
-
-        Improved Crankshaft for x64 and ARM.
-
-        Implemented more of EcmaScript 5 strict mode.
-
-        Fixed issue with unaligned reads and writes on ARM.
-
-        Improved heap profiler support.
-
-
-2011-02-28: Version 3.1.7
-
-        Fixed a number of crash bugs.
-
-        Improved Crankshaft for x64 and ARM.
-
-        Fixed implementation of indexOf/lastIndexOf for sparse
-        arrays (http://crbug.com/73940).
-
-        Fixed bug in map space compaction (http://crbug.com/59688).
-
-        Added support for direct getter accessors calls on ARM.
-
-
-2011-02-24: Version 3.1.6
-
-        Fixed a number of crash bugs.
-
-        Added support for Cygwin (issue 64).
-
-        Improved Crankshaft for x64 and ARM.
-
-        Added Crankshaft support for stores to pixel arrays.
-
-        Fixed issue in CPU profiler with Crankshaft.
-
-
-2011-02-16: Version 3.1.5
-
-        Change RegExp parsing to disallow /(*)/.
-
-        Added GDB JIT support for ARM.
-
-        Fixed several crash bugs.
-
-        Performance improvements on the IA32 platform.
-
-
-2011-02-14: Version 3.1.4
-
-        Fixed incorrect compare of prototypes of the global object (issue
-        1082).
-
-        Fixed a bug in optimizing calls to global functions (issue 1106).
-
-        Made optimized Function.prototype.apply safe for non-JSObject first
-        arguments (issue 1128).
-
-        Fixed an error related to element accessors on Object.prototype and
-        parser errors (issue 1130).
-
-        Fixed a bug in sorting an array with large array indices (issue 1131).
-
-        Properly treat exceptions thrown while compiling (issue 1132).
-
-        Fixed bug in register requirements for function.apply (issue 1133).
-
-        Fixed a representation change bug in the Hydrogen graph construction
-        (issue 1134).
-
-        Fixed the semantics of delete on parameters (issue 1136).
-
-        Fixed a optimizer bug related to moving instructions with side effects
-        (issue 1138).
-
-        Added support for the global object in Object.keys (issue 1150).
-
-        Fixed incorrect value for Math.LOG10E
-        (issue http://code.google.com/p/chromium/issues/detail?id=72555)
-
-        Performance improvements on the IA32 platform.
-
-        Implement assignment to undefined reference in ES5 Strict Mode.
-
-
-2011-02-09: Version 3.1.3
-
-        Fixed a bug triggered by functions with huge numbers of declared
-        arguments.
-
-        Fixed zap value aliasing a real object - debug mode only (issue 866).
-
-        Fixed issue where Array.prototype.__proto__ had been set to null
-        (issue 1121).
-
-        Fixed stability bugs in Crankshaft for x86.
-
-
-2011-02-07: Version 3.1.2
-
-        Added better security checks when accessing properties via
-        Object.getOwnPropertyDescriptor.
-
-        Fixed bug in Object.defineProperty and related access bugs (issues
-        992, 1083 and 1092).
-
-        Added LICENSE.v8, LICENSE.strongtalk and LICENSE.valgrind to ease
-        copyright notice generation for embedders.
-
-
-2011-02-02: Version 3.1.1
-
-        Perform security checks before fetching the value in
-        Object.getOwnPropertyDescriptor.
-
-        Fixed a bug in Array.prototype.splice triggered by passing no
-        arguments.
-
-        Fixed bugs in -0 in arithmetic and in Math.pow.
-
-        Fixed bugs in the register allocator and in switching from optimized
-        to unoptimized code.
-
-
-2011-01-31: Version 3.1.0
-
-        Performance improvements on all platforms.
-
-
-2011-01-28: Version 3.0.12
-
-        Added support for strict mode parameter and object property
-        validation.
-
-        Fixed a couple of crash bugs.
-
-
-2011-01-25: Version 3.0.11
-
-        Fixed a bug in deletion of lookup slots that could cause global
-        variables to be accidentally deleted (http://crbug.com/70066).
-
-        Added support for strict mode octal literal verification.
-
-        Fixed a couple of crash bugs (issues 1070 and 1071).
-
-
-2011-01-24: Version 3.0.10
-
-        Fixed External::Wrap for 64-bit addresses (issue 1037).
-
-        Fixed incorrect .arguments variable proxy handling in the full
-        code generator (issue 1060).
-
-        Introduced partial strict mode support.
-
-        Changed formatting of recursive error messages to match Firefox and
-        Safari (issue http://crbug.com/70334).
-
-        Fixed incorrect rounding for float-to-integer conversions for external
-        array types, which implement the Typed Array spec
-        (issue http://crbug.com/50972).
-
-        Performance improvements on the IA32 platform.
-
-
-2011-01-19: Version 3.0.9
-
-        Added basic GDB JIT Interface integration.
-
-        Make invalid break/continue statements a syntax error instead of a
-        runtime error.
-
-
-2011-01-17: Version 3.0.8
-
-        Exposed heap size limit to the heap statistics gathered by
-        the GetHeapStatistics API.
-
-        Wrapped external pointers more carefully (issue 1037).
-
-        Hardened the implementation of error objects to avoid setters
-        intercepting the properties set then throwing an error.
-
-        Avoided trashing the FPSCR when calculating Math.floor on ARM.
-
-        Performance improvements on the IA32 platform.
-
-
-2011-01-10: Version 3.0.7
-
-        Stopped calling inherited setters when creating object literals
-        (issue 1015).
-
-        Changed interpretation of malformed \c? escapes in RegExp to match
-        JSC.
-
-        Enhanced the command-line debugger interface and fixed some minor
-        bugs in the debugger.
-
-        Performance improvements on the IA32 platform.
-
-
-2011-01-05: Version 3.0.6
-
-        Allowed getters and setters on JSArray elements (issue 900).
-
-        Stopped JSON objects from hitting inherited setters (part of
-        issue 1015).
-
-        Allowed numbers and strings as names of getters/setters in object
-        initializer (issue 820).
-
-        Added use_system_v8 option to gyp (off by default), to make it easier
-        for Linux distributions to ship with system-provided V8 library.
-
-        Exported external array data accessors (issue 1016).
-
-        Added labelled thread names to help with debugging (on Linux).
-
-
-2011-01-03: Version 3.0.5
-
-        Fixed a couple of cast errors for gcc-3.4.3.
-
-        Performance improvements in GC and IA32 code generator.
-
-
-2010-12-21: Version 3.0.4
-
-        Added Date::ResetCache() to the API so that the cached values in the
-        Date object can be reset to allow live DST / timezone changes.
-
-        Extended existing support for printing (while debugging) the contents
-        of objects.  Added support for printing objects from release builds.
-
-        Fixed V8 issues 989, 1006, and 1007.
-
-
-2010-12-17: Version 3.0.3
-
-        Reapplied all changes for version 3.0.1.
-
-        Improved debugger protocol for remote debugging.
-
-        Added experimental support for using gyp to generate build files
-        for V8.
-
-        Fixed implementation of String::Write in the API (issue 975).
-
-
-2010-12-15: Version 3.0.2
-
-        Revert version 3.0.1 and patch 3.0.1.1.
-
-
-2010-12-13: Version 3.0.1
-
-        Added support for an experimental internationalization API as an
-        extension.  This extension is disabled by default but can be enabled
-        when building V8.  The ECMAScript internationalization strawman is
-        at http://wiki.ecmascript.org/doku.php?id=strawman:i18n_api.
-
-        Made RegExp character class parsing stricter.  This mirrors a change
-        to RegExp parsing in WebKit.
-
-        Fixed a bug in Object.defineProperty when used to change attributes
-        of an existing property.  It incorrectly set the property value to
-        undefined (issue 965).
-
-        Fixed several different compilation failures on various platforms
-        caused by the 3.0.0 release.
-
-        Optimized Math.pow so it can work on unboxed doubles.
-
-        Sped up quoting of JSON strings by removing one traversal of the
-        string.
-
-
-2010-12-07: Version 3.0.0
-
-        Improved performance by (partially) addressing issue 957 on
-        IA-32. Still needs more work for the other architectures.
-
-
-2010-11-29: Version 2.5.9
-
-        Fixed crashes during GC caused by partially initialize heap
-        objects.
-
-        Fixed bug in process sample that caused memory leaks.
-
-        Improved performance on ARM by implementing missing stubs and
-        inlining.
-
-        Improved heap profiler support.
-
-        Added separate seeding on Windows of the random number generator
-        used internally by the compiler (issue 936).
-
-        Exposed API for getting the name of the function used to construct
-        an object.
-
-        Fixed date parser to handle one and two digit millisecond
-        values (issue 944).
-
-        Fixed number parsing to disallow space between sign and
-        digits (issue 946).
-
-
-2010-11-23: Version 2.5.8
-
-        Removed dependency on Gay's dtoa.
-
-        Improved heap profiler precision and speed.
-
-        Reduced overhead of callback invocations on ARM.
-
-
-2010-11-18: Version 2.5.7
-
-        Fixed obscure evaluation order bug (issue 931).
-
-        Split the random number state between JavaScript and the private API.
-
-        Fixed performance bug causing GCs when generating stack traces on
-        code from very large scripts.
-
-        Fixed bug in parser that allowed (foo):42 as a labelled statement
-        (issue 918).
-
-        Provide more accurate results about used heap size via
-        GetHeapStatistics.
-
-        Allow build-time customization of the max semispace size.
-
-        Made String.prototype.split honor limit when separator is empty
-        (issue 929).
-
-        Added missing failure check after expecting an identifier in
-        preparser (Chromium issue 62639).
-
-
-2010-11-10: Version 2.5.6
-
-        Added support for VFP rounding modes to the ARM simulator.
-
-        Fixed multiplication overflow bug (issue 927).
-
-        Added a limit for the amount of executable memory (issue 925).
-
-
-2010-11-08: Version 2.5.5
-
-        Added more aggressive GC of external objects in near out-of-memory
-        situations.
-
-        Fixed a bug that gave the incorrect result for String.split called
-        on the empty string (issue 924).
-
-
-2010-11-03: Version 2.5.4
-
-        Improved V8 VFPv3 runtime detection to address issue 914.
-
-
-2010-11-01: Version 2.5.3
-
-        Fixed a bug that prevents constants from overwriting function values
-        in object literals (issue 907).
-
-        Fixed a bug with reporting of impossible nested calls of DOM functions
-        (issue http://crbug.com/60753).
-
-
-2010-10-27: Version 2.5.2
-
-        Improved sampler resolution on Linux.
-
-        Allowed forcing the use of a simulator from the build script
-        independently of the host architecture.
-
-        Fixed FreeBSD port (issue 912).
-
-        Made windows-tick-processor respect D8_PATH.
-
-        Implemented --noinline-new flag fully on IA32, X64 and ARM platforms.
-
-
-2010-10-20: Version 2.5.1
-
-        Fixed bug causing spurious out of memory exceptions
-        (issue http://crbug.com/54580).
-
-        Fixed compilation error on Solaris platform (issue 901).
-
-        Fixed error in strtod (string to floating point number conversion)
-        due to glibc's use of 80-bit floats in the FPU on 32-bit linux.
-
-        Adjusted randomized allocations of executable memory to have 64k
-        granularity (issue http://crbug.com/56036).
-
-        Supported profiling using kernel perf_events on linux.  Added ll_prof
-        script to tools and --ll-prof flag to V8.
-
-
-2010-10-18: Version 2.5.0
-
-        Fixed bug in cache handling of lastIndex on global regexps
-        (issue http://crbug.com/58740).
-
-        Added USE_SIMULATOR macro that explicitly indicates that we wish to use
-        the simulator as the execution engine (by Mark Lam <mark.lam@palm.com>
-        from Hewlett-Packard Development Company, LP).
-
-        Fixed compilation error on ARM with gcc 4.4 (issue 894).
-
-
-2010-10-13: Version 2.4.9
-
-        Fixed a bug in the handling of conditional expressions in test
-        contexts in compiler for top-level code.
-
-        Added "//@ sourceURL" information to the StackTrace API.
-
-        Exposed RegExp construction through the API.
-
-
-2010-10-04: Version 2.4.8
-
-        Fixed a bug in ResumeProfilerEx causing it to not always write out the
-        whole snapshot (issue 868).
-
-        Performance improvements on all platforms.
-
-
-2010-09-30: Version 2.4.7
-
-        Changed the command-line flag --max-new-space-size to be in kB and the
-        flag --max-old-space-size to be in MB (previously they were in bytes).
-
-        Added Debug::CancelDebugBreak to the debugger API.
-
-        Fixed a bug in getters for negative numeric property names
-        (https://bugs.webkit.org/show_bug.cgi?id=46689).
-
-        Performance improvements on all platforms.
-
-
-2010-09-27: Version 2.4.6
-
-        Fixed assertion failure related to copy-on-write arrays (issue 876).
-
-        Fixed build failure of 64-bit V8 on Windows.
-
-        Fixed a bug in RegExp (issue http://crbug.com/52801).
-
-        Improved the profiler's coverage to cover more functions (issue 858).
-
-        Fixed error in shift operators on 64-bit V8
-        (issue http://crbug.com/54521).
-
-
-2010-09-22: Version 2.4.5
-
-        Changed the RegExp benchmark to exercise the regexp engine on different
-        inputs by scrambling the input strings.
-
-        Fixed a bug in keyed loads on strings.
-
-        Fixed a bug with loading global function prototypes.
-
-        Fixed a bug with profiling RegExp calls (issue http://crbug.com/55999).
-
-        Performance improvements on all platforms.
-
-
-2010-09-15: Version 2.4.4
-
-        Fixed bug with hangs on very large sparse arrays.
-
-        Now tries harder to free up memory when running out of space.
-
-        Added heap snapshots to JSON format to API.
-
-        Recalibrated benchmarks.
-
-
-2010-09-13: Version 2.4.3
-
-        Made Date.parse properly handle TZ offsets (issue 857).
-
-        Performance improvements on all platforms.
-
-
-2010-09-08: Version 2.4.2
-
-        Fixed GC crash bug.
-
-        Fixed stack corruption bug.
-
-        Fixed compilation for newer C++ compilers that found Operand(0)
-        ambiguous.
-
-
-2010-09-06: Version 2.4.1
-
-        Added the ability for an embedding application to receive a callback
-        when V8 allocates (V8::AddMemoryAllocationCallback) or deallocates
-        (V8::RemoveMemoryAllocationCallback) from the OS.
-
-        Fixed several JSON bugs (including issue 855).
-
-        Fixed memory overrun crash bug triggered during V8's tick-based
-        profiling.
-
-        Performance improvements on all platforms.
-
-
-2010-09-01: Version 2.4.0
-
-        Fixed bug in Object.freeze and Object.seal when Array.prototype or
-        Object.prototype are changed (issue 842).
-
-        Updated Array.splice to follow Safari and Firefox when called
-        with zero arguments.
-
-        Fixed a missing live register when breaking at keyed loads on ARM.
-
-        Performance improvements on all platforms.
-
-
-2010-08-25: Version 2.3.11
-
-        Fixed bug in RegExp related to copy-on-write arrays.
-
-        Refactored tools/test.py script, including the introduction of
-        VARIANT_FLAGS that allows specification of sets of flags with which
-        all tests should be run.
-
-        Fixed a bug in the handling of debug breaks in CallIC.
-
-        Performance improvements on all platforms.
-
-
-2010-08-23: Version 2.3.10
-
-        Fixed bug in bitops on ARM.
-
-        Build fixes for unusual compilers.
-
-        Track high water mark for RWX memory.
-
-        Performance improvements on all platforms.
-
-
-2010-08-18: Version 2.3.9
-
-        Fixed compilation for ARMv4 on OpenBSD/FreeBSD.
-
-        Removed specialized handling of GCC 4.4 (issue 830).
-
-        Fixed DST cache to take into account the suspension of DST in
-        Egypt during the 2010 Ramadan (issue http://crbug.com/51855).
-
-        Performance improvements on all platforms.
-
-
-2010-08-16: Version 2.3.8
-
-        Fixed build with strict aliasing on GCC 4.4 (issue 463).
-
-        Fixed issue with incorrect handling of custom valueOf methods on
-        string wrappers (issue 760).
-
-        Fixed compilation for ARMv4 (issue 590).
-
-        Improved performance.
-
-
-2010-08-11: Version 2.3.7
-
-        Reduced size of heap snapshots produced by heap profiler (issue 783).
-
-        Introduced v8::Value::IsRegExp method.
-
-        Fixed CPU profiler crash in start / stop sequence when non-existent
-        name is passed (issue http://crbug.com/51594).
-
-        Introduced new indexed property query callbacks API (issue 816). This
-        API is guarded by USE_NEW_QUERY_CALLBACK define and is disabled
-        by default.
-
-        Removed support for object literal get/set with number/string
-        property name.
-
-        Fixed handling of JSObject::elements in CalculateNetworkSize
-        (issue 822).
-
-        Allowed compiling with strict aliasing enabled on GCC 4.4 (issue 463).
-
-
-2010-08-09: Version 2.3.6
-
-        RegExp literals create a new object every time they are evaluated
-        (issue 704).
-
-        Object.seal and Object.freeze return the modified object (issue 809).
-
-        Fixed building using GCC 4.4.4.
-
-
-2010-08-04: Version 2.3.5
-
-        Added support for ES5 property names. Object initialisers and
-        dot-notation property access now allows keywords. Also allowed
-        non-identifiers after "get" or "set" in an object initialiser.
-
-        Randomized the addresses of allocated executable memory on Windows.
-
-
-2010-08-02: Version 2.3.4
-
-        Fixed problems in implementation of ES5 function.prototype.bind.
-
-        Fixed error when using apply with arguments object on ARM (issue 784).
-
-        Added setting of global flags to debugger protocol.
-
-        Fixed an error affecting cached results of sin and cos (issue 792).
-
-        Removed memory leak from a boundary case where V8 is not initialized.
-
-        Fixed issue where debugger could set breakpoints outside the body
-        of a function.
-
-        Fixed issue in debugger when using both live edit and step in features.
-
-        Added Number-letter (Nl) category to Unicode tables.  These characters
-        can now be used in identifiers.
-
-        Fixed an assert failure on X64 (issue 806).
-
-        Performance improvements on all platforms.
-
-
-2010-07-26: Version 2.3.3
-
-        Fixed error when building the d8 shell in a fresh checkout.
-
-        Implemented Function.prototype.bind (ES5 15.3.4.5).
-
-        Fixed an error in inlined stores on ia32.
-
-        Fixed an error when setting a breakpoint at the end of a function
-        that does not end with a newline character.
-
-        Performance improvements on all platforms.
-
-
-2010-07-21: Version 2.3.2
-
-        Fixed compiler warnings when building with LLVM.
-
-        Fixed a bug with for-in applied to strings (issue 785).
-
-        Performance improvements on all platforms.
-
-
-2010-07-19: Version 2.3.1
-
-        Fixed compilation and linking with V8_INTERPRETED_REGEXP flag.
-
-        Fixed bug related to code flushing while compiling a lazy
-        compilable function (issue http://crbug.com/49099).
-
-        Performance improvements on all platforms.
-
-
-2010-07-15: Version 2.3.0
-
-        Added ES5 Object.seal and Object.isSealed.
-
-        Added debugger API for scheduling debugger commands from a
-        separate thread.
-
-
-2010-07-14: Version 2.2.24
-
-        Added API for capturing stack traces for uncaught exceptions.
-
-        Fixed crash bug when preparsing from a non-external V8 string
-        (issue 775).
-
-        Fixed JSON.parse bug causing input not to be converted to string
-        (issue 764).
-
-        Added ES5 Object.freeze and Object.isFrozen.
-
-        Performance improvements on all platforms.
-
-
-2010-07-07: Version 2.2.23
-
-        API change: Convert Unicode code points outside the basic multilingual
-        plane to the replacement character.  Previous behavior was to silently
-        truncate the value to 16 bits.
-
-        Fixed crash: handle all flat string types in regexp replace.
-
-        Prevent invalid pre-parsing data passed in through the API from
-        crashing V8.
-
-        Performance improvements on all platforms.
-
-
-2010-07-05: Version 2.2.22
-
-        Added ES5 Object.isExtensible and Object.preventExtensions.
-
-        Enabled building V8 as a DLL.
-
-        Fixed a bug in date code where -0 was not interpreted as 0
-        (issue 736).
-
-        Performance improvements on all platforms.
-
-
-2010-06-30: Version 2.2.21
-
-        Fixed bug in externalizing some ASCII strings (Chromium issue 47824).
-
-        Updated JSON.stringify to floor the space parameter (issue 753).
-
-        Updated the Mozilla test expectations to the newest version.
-
-        Updated the ES5 Conformance Test expectations to the latest version.
-
-        Updated the V8 benchmark suite.
-
-        Provide actual breakpoints locations in response to setBreakpoint
-        and listBreakpoints requests.
-
-
-2010-06-28: Version 2.2.20
-
-        Fixed bug with for-in on x64 platform (issue 748).
-
-        Fixed crash bug on x64 platform (issue 756).
-
-        Fixed bug in Object.getOwnPropertyNames. (chromium issue 41243).
-
-        Fixed a bug on ARM that caused the result of 1 << x to be
-        miscalculated for some inputs.
-
-        Performance improvements on all platforms.
-
-
-2010-06-23: Version 2.2.19
-
-        Fixed bug that causes the build to break when profillingsupport=off
-        (issue 738).
-
-        Added expose-externalize-string flag for testing extensions.
-
-        Resolve linker issues with using V8 as a DLL causing a number of
-        problems with unresolved symbols.
-
-        Fixed build failure for cctests when ENABLE_DEBUGGER_SUPPORT is not
-        defined.
-
-        Performance improvements on all platforms.
-
-
-2010-06-16: Version 2.2.18
-
-        Added API functions to retrieve information on indexed properties
-        managed by the embedding layer.  Fixes bug 737.
-
-        Made ES5 Object.defineProperty support array elements.  Fixes bug 619.
-
-        Added heap profiling to the API.
-
-        Removed old named property query from the API.
-
-        Incremental performance improvements.
-
-
-2010-06-14: Version 2.2.17
-
-        Improved debugger support for stepping out of functions.
-
-        Incremental performance improvements.
-
-
-2010-06-09: Version 2.2.16
-
-        Removed the SetExternalStringDiposeCallback API. Changed the
-        disposal of external string resources to call a virtual Dispose
-        method on the resource.
-
-        Added support for more precise break points when debugging and
-        stepping.
-
-        Memory usage improvements on all platforms.
-
-
-2010-06-07: Version 2.2.15
-
-        Added an API to control the disposal of external string resources.
-
-        Added missing initialization of a couple of variables which makes
-        some compilers complaint when compiling with -Werror.
-
-        Improved performance on all platforms.
-
-
-2010-06-02: Version 2.2.14
-
-        Fixed a crash in code generated for String.charCodeAt.
-
-        Fixed a compilation issue with some GCC versions (issue 727).
-
-        Performance optimizations on x64 and ARM platforms.
-
-
-2010-05-31: Version 2.2.13
-
-        Implemented Object.getOwnPropertyDescriptor for element indices and
-        strings (issue 599).
-
-        Fixed bug for windows 64 bit C calls from generated code.
-
-        Added new scons flag unalignedaccesses for arm builds.
-
-        Performance improvements on all platforms.
-
-
-2010-05-26: Version 2.2.12
-
-        Allowed accessors to be defined on objects rather than just object
-        templates.
-
-        Changed the ScriptData API.
-
-
-2010-05-21: Version 2.2.11
-
-        Fixed crash bug in liveedit on 64 bit.
-
-        Use 'full compiler' when debugging is active.  This should increase
-        the density of possible break points, making single step more fine
-        grained.  This will only take effect for functions compiled after
-        debugging has been started, so recompilation of all functions is
-        required to get the full effect.  IA32 and x64 only for now.
-
-        Misc. fixes to the Solaris build.
-
-        Added new flags --print-cumulative-gc-stat and --trace-gc-nvp.
-
-        Added filtering of CPU profiles by security context.
-
-        Fixed crash bug on ARM when running without VFP2 or VFP3.
-
-        Incremental performance improvements in all backends.
-
-
-2010-05-17: Version 2.2.10
-
-        Performance improvements in the x64 and ARM backends.
-
-
-2010-05-10: Version 2.2.9
-
-        Allowed Object.create to be called with a function (issue 697).
-
-        Fixed bug with Date.parse returning a non-NaN value when called on a
-        non date string (issue 696).
-
-        Allowed unaligned memory accesses on ARM targets that support it (by
-        Subrato K De of CodeAurora <subratokde@codeaurora.org>).
-
-        C++ API for retrieving JavaScript stack trace information.
-
-
-2010-05-05: Version 2.2.8
-
-        Performance improvements in the x64 and ARM backends.
-
-
-2010-05-03: Version 2.2.7
-
-        Added support for ES5 date time string format to Date.parse.
-
-        Performance improvements in the x64 backend.
-
-
-2010-04-28: Version 2.2.6
-
-        Added "amd64" as recognized architecture in scons build script
-        (by Ryan Dahl <coldredlemur@gmail.com>).
-
-        Fixed bug in String search and replace with very simple RegExps.
-
-        Fixed bug in RegExp containing "\b^".
-
-        Performance improvements on all platforms.
-
-
-2010-04-26: Version 2.2.5
-
-        Various performance improvements (especially for ARM and x64)
-
-        Fixed bug in CPU profiling (http://crbug.com/42137)
-
-        Fixed a bug with the natives cache.
-
-        Fixed two bugs in the ARM code generator that can cause
-        wrong calculations.
-
-        Fixed a bug that may cause a wrong result for shift operations.
-
-
-2010-04-21: Version 2.2.4
-
-        Fixed warnings on arm on newer GCC versions.
-
-        Fixed a number of minor bugs.
-
-        Performance improvements on all platforms.
-
-
-2010-04-14: Version 2.2.3
-
-        Added stack command and mem command to ARM simulator debugger.
-
-        Fixed scons snapshot and ARM build, and Windows X64 build issues.
-
-        Performance improvements on all platforms.
-
-
-2010-04-12: Version 2.2.2
-
-        Introduced new profiler API.
-
-        Fixed random number generator to produce full 32 random bits.
-
-
-2010-04-06: Version 2.2.1
-
-        Debugger improvements.
-
-        Fixed minor bugs.
-
-
-2010-03-29: Version 2.2.0
-
-        Fixed a few minor bugs.
-
-        Performance improvements for string operations.
-
-
-2010-03-26: Version 2.1.10
-
-        Fixed scons build issues.
-
-        Fixed a couple of minor bugs.
-
-
-2010-03-25: Version 2.1.9
-
-        Added API support for reattaching a global object to a context.
-
-        Extended debugger API with access to the internal debugger context.
-
-        Fixed Chromium crashes (issues http://crbug.com/39128 and
-        http://crbug.com/39160)
-
-
-2010-03-24: Version 2.1.8
-
-        Added fine-grained garbage collection callbacks to the API.
-
-        Performance improvements on all platforms.
-
-
-2010-03-22: Version 2.1.7
-
-        Fixed issue 650.
-
-        Fixed a bug where __proto__ was sometimes enumerated (issue 646).
-
-        Performance improvements for arithmetic operations.
-
-        Performance improvements for string operations.
-
-        Print script name and line number information in stack trace.
-
-
-2010-03-17: Version 2.1.6
-
-        Performance improvements for arithmetic operations.
-
-        Performance improvements for string operations.
-
-
-2010-03-10: Version 2.1.4
-
-        Fixed code cache lookup for keyed IC's (issue http://crbug.com/37853).
-
-        Performance improvements on all platforms.
-
-
-2010-03-10: Version 2.1.3
-
-        Added API method for context-disposal notifications.
-
-        Added API method for accessing elements by integer index.
-
-        Added missing implementation of Uint32::Value and Value::IsUint32
-        API methods.
-
-        Added IsExecutionTerminating API method.
-
-        Disabled strict aliasing for GCC 4.4.
-
-        Fixed string-concatenation bug (issue 636).
-
-        Performance improvements on all platforms.
-
-
-2010-02-23: Version 2.1.2
-
-        Fixed a crash bug caused by wrong assert.
-
-        Fixed a bug with register names on 64-bit V8 (issue 615).
-
-        Performance improvements on all platforms.
-
-
-2010-02-19: Version 2.1.1
-
-        [ES5] Implemented Object.defineProperty.
-
-        Improved profiler support.
-
-        Added SetPrototype method in the public V8 API.
-
-        Added GetScriptOrigin and GetScriptLineNumber methods to Function
-        objects in the API.
-
-        Performance improvements on all platforms.
-
-
-2010-02-03: Version 2.1.0
-
-        Values are now always wrapped in objects when used as a receiver.
-        (issue 223).
-
-        [ES5] Implemented Object.getOwnPropertyNames.
-
-        [ES5] Restrict JSON.parse to only accept strings that conforms to the
-        JSON grammar.
-
-        Improvement of debugger agent (issue 549 and 554).
-
-        Fixed problem with skipped stack frame in profiles (issue 553).
-
-        Solaris support by Erich Ocean <erich.ocean@me.com> and Ryan Dahl
-        <ry@tinyclouds.org>.
-
-        Fixed a bug that Math.round() returns incorrect results for huge
-        integers.
-
-        Fixed enumeration order for objects created from some constructor
-        functions (isue http://crbug.com/3867).
-
-        Fixed arithmetic on some integer constants (issue 580).
-
-        Numerous performance improvements including porting of previous IA-32
-        optimizations to x64 and ARM architectures.
-
-
-2010-01-14: Version 2.0.6
-
-        Added ES5 Object.getPrototypeOf, GetOwnPropertyDescriptor,
-        GetOwnProperty, FromPropertyDescriptor.
-
-        Fixed Mac x64 build errors.
-
-        Improved performance of some math and string operations.
-
-        Improved performance of some regexp operations.
-
-        Improved performance of context creation.
-
-        Improved performance of hash tables.
-
-
-2009-12-18: Version 2.0.5
-
-        Extended to upper limit of map space to allow for 7 times as many map
-        to be allocated (issue 524).
-
-        Improved performance of code using closures.
-
-        Improved performance of some binary operations involving doubles.
-
-
-2009-12-16: Version 2.0.4
-
-        Added ECMAScript 5 Object.create.
-
-        Improved performance of Math.max and Math.min.
-
-        Optimized adding of strings on 64-bit platforms.
-
-        Improved handling of external strings by using a separate table
-        instead of weak handles.  This improves garbage collection
-        performance and uses less memory.
-
-        Changed code generation for object and array literals in toplevel
-        code to be more compact by doing more work in the runtime.
-
-        Fixed a crash bug triggered when garbage collection happened during
-        generation of a callback load inline cache stub.
-
-        Fixed crash bug sometimes triggered when local variables shadowed
-        parameters in functions that used the arguments object.
-
-
-2009-12-03: Version 2.0.3
-
-        Optimized handling and adding of strings, for-in and Array.join.
-
-        Heap serialization is now non-destructive.
-
-        Improved profiler support with information on time spend in C++
-        callbacks registered through the API.
-
-        Added commands to the debugger protocol for starting/stopping
-        profiling.
-
-        Enabled the non-optimizing compiler for top-level code.
-
-        Changed the API to only allow strings to be set as data objects on
-        Contexts and scripts to avoid potentially keeping global objects
-        around for too long (issue 528).
-
-        OpenBSD support patch by Peter Valchev <pvalchev@gmail.com>.
-
-        Fixed bugs.
-
-
-2009-11-24: Version 2.0.2
-
-        Improved profiler support.
-
-        Fixed bug that broke compilation of d8 with readline support.
-
-
-2009-11-20: Version 2.0.1
-
-        Fixed crash bug in String.prototype.replace.
-
-        Reverted a change which caused Chromium interactive ui test
-        failures.
-
-
-2009-11-18: Version 2.0.0
-
-        Added support for VFP on ARM.
-
-        Added TryCatch::ReThrow method to the API.
-
-        Reduced the size of snapshots and improved the snapshot load time.
-
-        Improved heap profiler support.
-
-        64-bit version now supported on Windows.
-
-        Fixed a number of debugger issues.
-
-        Fixed bugs.
-
-
-2009-10-29: Version 1.3.18
-
-        Reverted a change which caused crashes in RegExp replace.
-
-        Reverted a change which caused Chromium ui_tests failure.
-
-
-2009-10-28: Version 1.3.17
-
-        Added API method to get simple heap statistics.
-
-        Improved heap profiler support.
-
-        Fixed the implementation of the resource constraint API so it
-        works when using snapshots.
-
-        Fixed a number of issues in the Windows 64-bit version.
-
-        Optimized calls to API getters.
-
-        Added valgrind notification on code modification to the 64-bit version.
-
-        Fixed issue where we logged shared library addresses on Windows at
-        startup and never used them.
-
-
-2009-10-16: Version 1.3.16
-
-        X64: Convert smis to holding 32 bits of payload.
-
-        Introduced v8::Integer::NewFromUnsigned method.
-
-        Added missing null check in Context::GetCurrent.
-
-        Added trim, trimLeft and trimRight methods to String
-        Patch by Jan de Mooij <jandemooij@gmail.com>
-
-        Implement ES5 Array.isArray
-        Patch by Jan de Mooij <jandemooij@gmail.com>
-
-        Skip access checks for hidden properties.
-
-        Added String::Concat(Handle<String> left, Handle<String> right) to the
-        V8 API.
-
-        Fixed GYP-based builds of V8.
-
-
-2009-10-07: Version 1.3.15
-
-        Expanded the maximum size of the code space to 512MB for 64-bit mode.
-
-        Fixed a crash bug happening when starting profiling (issue
-        http://crbug.com/23768).
-
-
-2009-10-07: Version 1.3.14
-
-        Added GetRealNamedProperty to the API to lookup real properties
-        located on the object or in the prototype chain skipping any
-        interceptors.
-
-        Fixed the stack limits setting API to work correctly with threads. The
-        stack limit now needs to be set to each thread thich is used with V8.
-
-        Removed the high-priority flag from IdleNotification()
-
-        Ensure V8 is initialized before locking and unlocking threads.
-
-        Implemented a new JavaScript minifier for compressing the source of
-        the built-in JavaScript. This removes non-Open Source code from Douglas
-        Crockford from the project.
-
-        Added a missing optimization in StringCharAt.
-
-        Fixed some flaky socket tests.
-
-        Change by Alexander Botero-Lowry to fix profiler sampling on FreeBSD
-        in 64-bit mode.
-
-        Fixed memory leaks in the thread management code.
-
-        Fixed the result of assignment to a pixel array. The assigned value
-        is now the result.
-
-        Error reporting for invalid left-hand sides in for-in statements, pre-
-        and postfix count expressions, and assignments now matches the JSC
-        behavior in Safari 4.
-
-        Follow the spec in disallowing function declarations without a name.
-
-        Always allocate code objects within a 2 GB range. On x64 architecture
-        this is used to use near calls (32-bit displacement) in Code objects.
-
-        Optimized array construction ported to x64 and ARM architectures.
-
-        [ES5] Changed Object.keys to return strings for element indices.
-
-
-2009-09-23: Version 1.3.13
-
-        Fixed uninitialized memory problem.
-
-        Improved heap profiler support.
-
-
-2009-09-22: Version 1.3.12
-
-        Changed behavior of |function|.toString() on built-in functions to
-        be compatible with other implementations.  Patch by Jan de Mooij.
-
-        Added Object::IsDirty in the API.
-
-        Optimized array construction; it is now handled purely in native
-        code.
-
-        [ES5] Made properties of the arguments array enumerable.
-
-        [ES5] Added test suite adapter for the es5conform test suite.
-
-        [ES5] Added Object.keys function.
-
-
-2009-09-15: Version 1.3.11
-
-        Fixed crash in error reporting during bootstrapping.
-
-        Optimized generated IA32 math code by using SSE2 instructions when
-        available.
-
-        Implemented missing pieces of debugger infrastructure on ARM.  The
-        debugger is now fully functional on ARM.
-
-        Made 'hidden' the default visibility for gcc.
-
-
-2009-09-09: Version 1.3.10
-
-        Fixed profiler on Mac in 64-bit mode.
-
-        Optimized creation of objects from simple constructor functions on
-        ARM.
-
-        Fixed a number of debugger issues.
-
-        Reduced the amount of memory consumed by V8.
-
-
-2009-09-02: Version 1.3.9
-
-        Optimized stack guard checks on ARM.
-
-        Optimized API operations by inlining more in the API.
-
-        Optimized creation of objects from simple constructor functions.
-
-        Enabled a number of missing optimizations in the 64-bit port.
-
-        Implemented native-code support for regular expressions on ARM.
-
-        Stopped using the 'sahf' instruction on 64-bit machines that do
-        not support it.
-
-        Fixed a bug in the support for forceful termination of JavaScript
-        execution.
-
-
-2009-08-26: Version 1.3.8
-
-        Changed the handling of idle notifications to allow idle
-        notifications when V8 has not yet been initialized.
-
-        Fixed ARM simulator compilation problem on Windows.
-
-
-2009-08-25: Version 1.3.7
-
-        Reduced the size of generated code on ARM platforms by reducing
-        the size of constant pools.
-
-        Changed build files to not include the 'ENV' user environment
-        variable in the build environment.
-
-        Changed the handling of idle notifications.
-
-
-2009-08-21: Version 1.3.6
-
-        Added support for forceful termination of JavaScript execution.
-
-        Added low memory notification to the API. The embedding host can signal
-        a low memory situation to V8.
-
-        Changed the handling of global handles (persistent handles in the API
-        sense) to avoid issues regarding allocation of new global handles
-        during weak handle callbacks.
-
-        Changed the growth policy of the young space.
-
-        Fixed a GC issue introduced in version 1.3.5.
-
-
-2009-08-19: Version 1.3.5
-
-        Optimized initialization of some arrays in the builtins.
-
-        Fixed mac-nm script to support filenames with spaces.
-
-        Support for using the V8 profiler when V8 is embedded in a Windows DLL.
-
-        Changed typeof RegExp from 'object' to 'function' for compatibility.
-        Fixed bug where regexps were not callable across contexts.
-
-        Added context independent script compilation to the API.
-
-        Added API call to get the stack trace for an exception.
-
-        Added API for getting object mirrors.
-
-        Made sure that SSE3 instructions are used whenever possible even when
-        running off a snapshot generated without using SSE3 instructions.
-
-        Tweaked the handling of the initial size and growth policy of the heap.
-
-        Added native code generation for RegExp to 64-bit version.
-
-        Added JavaScript debugger support to 64-bit version.
-
-
-2009-08-13: Version 1.3.4
-
-        Added a readline() command to the d8 shell.
-
-        Fixed bug in json parsing.
-
-        Added idle notification to the API and reduced memory on idle
-        notifications.
-
-
-2009-08-12: Version 1.3.3
-
-        Fixed issue 417: incorrect %t placeholder expansion.
-
-        Added .gitignore file similar to Chromium's one.
-
-        Fixed SConstruct file to build with new logging code for Android.
-
-        API: added function to find instance of template in prototype
-        chain.  Inlined Object::IsInstanceOf.
-
-        Land change to notify valgrind when we modify code on x86.
-
-        Added api call to determine whether a string can be externalized.
-
-        Added a write() command to d8.
-
-
-2009-08-05: Version 1.3.2
-
-        Started new compiler infrastructure for two-pass compilation using a
-        control flow graph constructed from the AST.
-
-        Profiler stack sampling for X64.
-
-        Safe handling of NaN to Posix platform-dependent time functions.
-
-        Added a new profiler control API to unify controlling various aspects
-        of profiling.
-
-        Fixed issue 392.
-
-
-2009-07-30: Version 1.3.1
-
-        Speed improvements to accessors and interceptors.
-
-        Added support for capturing stack information on custom errors.
-
-        Added support for morphing an object into a pixel array where its
-        indexed properties are stored in an external byte array. Values written
-        are always clamped to the 0..255 interval.
-
-        Profiler on x64 now handles C/C++ functions from shared libraries.
-
-        Changed the debugger to avoid stepping into function.call/apply if the
-        function is a built-in.
-
-        Initial implementation of constructor heap profile for JS objects.
-
-        More fine grained control of profiling aspects through the API.
-
-        Optimized the called as constructor check for API calls.
-
-
-2009-07-27: Version 1.3.0
-
-        Allowed RegExp objects to be called as functions (issue 132).
-
-        Fixed issue where global property cells would escape after
-        detaching the global object; see http://crbug.com/16276.
-
-        Added support for stepping into setters and getters in the
-        debugger.
-
-        Changed the debugger to avoid stopping in its own JavaScript code
-        and in the code of built-in functions.
-
-        Fixed issue 345 by avoiding duplicate escaping labels.
-
-        Fixed ARM code generator crash in short-circuited boolean
-        expressions and added regression tests.
-
-        Added an external allocation limit to avoid issues where small V8
-        objects would hold on to large amounts of external memory without
-        causing garbage collections.
-
-        Finished more of the inline caching stubs for x64 targets.
-
-
-2009-07-13: Version 1.2.14
-
-        Added separate paged heap space for global property cells and
-        avoid updating the write barrier when storing into them.
-
-        Improved peep-hole optimization on ARM platforms by not emitting
-        unnecessary debug information.
-
-        Re-enabled ICs for loads and calls that skip a global object
-        during lookup through the prototype chain.
-
-        Allowed access through global proxies to use ICs.
-
-        Fixed issue 401.
-
-
-2009-07-09: Version 1.2.13
-
-        Fixed issue 397, issue 398, and issue 399.
-
-        Added support for breakpoint groups.
-
-        Fixed bugs introduced with the new global object representation.
-
-        Fixed a few bugs in the ARM code generator.
-
-
-2009-07-06: Version 1.2.12
-
-        Added stack traces collection to Error objects accessible through
-        the e.stack property.
-
-        Changed RegExp parser to use a recursive data structure instead of
-        stack-based recursion.
-
-        Optimized Date object construction and string concatenation.
-
-        Improved performance of div, mod, and mul on ARM platforms.
-
-
-2009-07-02: Version 1.2.11
-
-        Improved performance on IA-32 and ARM.
-
-        Fixed profiler sampler implementation on Mac OS X.
-
-        Changed the representation of global objects to improve
-        performance of adding a lot of new properties.
-
-
-2009-06-29: Version 1.2.10
-
-        Improved debugger support.
-
-        Fixed bug in exception message reporting (issue 390).
-
-        Improved overall performance.
-
-
-2009-06-23: Version 1.2.9
-
-        Improved math performance on ARM.
-
-        Fixed profiler name-inference bug.
-
-        Fixed handling of shared libraries in the profiler tick processor
-        scripts.
-
-        Fixed handling of tests that time out in the test scripts.
-
-        Fixed compilation on MacOS X version 10.4.
-
-        Fixed two bugs in the regular expression engine.
-
-        Fixed a bug in the string type inference.
-
-        Fixed a bug in the handling of 'constant function' properties.
-
-        Improved overall performance.
-
-
-2009-06-16: Version 1.2.8
-
-        Optimized math on ARM platforms.
-
-        Fixed two crash bugs in the handling of getters and setters.
-
-        Improved the debugger support by adding scope chain information.
-
-        Improved the profiler support by compressing log data transmitted
-        to clients.
-
-        Improved overall performance.
-
-
-2009-06-08: Version 1.2.7
-
-        Improved debugger and profiler support.
-
-        Reduced compilation time by improving the handling of deferred
-        code.
-
-        Optimized interceptor accesses where the property is on the object
-        on which the interceptors is attached.
-
-        Fixed compilation problem on GCC 4.4 by changing the stack
-        alignment to 16 bytes.
-
-        Fixed handle creation to follow stric aliasing rules.
-
-        Fixed compilation on FreeBSD.
-
-        Introduced API for forcing the deletion of a property ignoring
-        interceptors and attributes.
-
-
-2009-05-29: Version 1.2.6
-
-        Added a histogram recording hit rates at different levels of the
-        compilation cache.
-
-        Added stack overflow check for the RegExp analysis phase. Previously a
-        very long regexp graph could overflow the stack with recursive calls.
-
-        Use a dynamic buffer when collecting log events in memory.
-
-        Added start/stop events to the profiler log.
-
-        Fixed infinite loop which could happen when setting a debug break while
-        executing a RegExp compiled to native code.
-
-        Fixed handling of lastIndexOf called with negative index (issue 351).
-
-        Fixed irregular crash in profiler test (issue 358).
-
-        Fixed compilation issues with some versions of gcc.
-
-
-2009-05-26: Version 1.2.5
-
-        Fixed bug in initial boundary check for Boyer-Moore text
-        search (issue 349).
-
-        Fixed compilation issues with MinGW and gcc 4.3+ and added support
-        for armv7 and cortex-a8 architectures.  Patches by Lei Zhang and
-        Craig Schlenter.
-
-        Added a script cache to the debugger.
-
-        Optimized compilation performance by improving internal data
-        structures and avoiding expensive property load optimizations for
-        code that's infrequently executed.
-
-        Exposed the calling JavaScript context through the static API
-        function Context::GetCalling().
-
-
-2009-05-18: Version 1.2.4
-
-        Improved performance of floating point number allocation for ARM
-        platforms.
-
-        Fixed crash when using the instanceof operator on functions with
-        number values in their prototype chain (issue 341).
-
-        Optimized virtual frame operations in the code generator to speed
-        up compilation time and allocated the frames in the zone.
-
-        Made the representation of virtual frames and jump targets in the
-        code generator much more compact.
-
-        Avoided linear search for non-locals in scope code when resolving
-        variables inside with and eval scopes.
-
-        Optimized lexical scanner by dealing with whitespace as part of
-        the token scanning instead of as a separate step before it.
-
-        Changed the scavenging collector so that promoted objects do not
-        reside in the old generation while their remembered set is being
-        swept for pointers into the young generation.
-
-        Fixed numeric overflow handling when compiling count operations.
-
-
-2009-05-11: Version 1.2.3
-
-        Fixed bug in reporting of out-of-memory situations.
-
-        Introduced hidden prototypes on certain builtin prototype objects
-        such as String.prototype to emulate JSC's behavior of restoring
-        the original function when deleting functions from those prototype
-        objects.
-
-        Fixed crash bug in the register allocator.
-
-
-2009-05-04: Version 1.2.2
-
-        Fixed bug in array sorting for sparse arrays (issue 326).
-
-        Added support for adding a soname when building a shared library
-        on Linux (issue 151).
-
-        Fixed bug caused by morphing internal ASCII strings to external
-        two-byte strings.  Slices over ASCII strings have to forward ASCII
-        checks to the underlying buffer string.
-
-        Allowed API call-as-function handlers to be called as
-        constructors.
-
-        Fixed a crash bug where an external string was disposed but a
-        slice of the external string survived as a symbol.
-
-
-2009-04-27: Version 1.2.1
-
-        Added EcmaScript 5 JSON object.
-
-        Fixed bug in preemption support on ARM.
-
-
-2009-04-23: Version 1.2.0
-
-        Optimized floating-point operations on ARM.
-
-        Added a number of extensions to the debugger API.
-
-        Changed the enumeration order for unsigned integer keys to always
-        be numerical order.
-
-        Added a "read" extension to the shell sample.
-
-        Added support for Array.prototype.reduce and
-        Array.prototype.reduceRight.
-
-        Added an option to the SCons build to control Microsoft Visual C++
-        link-time code generation.
-
-        Fixed a number of bugs (in particular issue 315, issue 316,
-        issue 317 and issue 318).
-
-
-2009-04-15: Version 1.1.10
-
-        Fixed crash bug that occurred when loading a const variable in the
-        presence of eval.
-
-        Allowed using with and eval in registered extensions in debug mode
-        by fixing bogus assert.
-
-        Fixed the source position for function returns to enable the
-        debugger to break there.
-
-
-2009-04-14: Version 1.1.9
-
-        Made the stack traversal code in the profiler robust by avoiding
-        to look into the heap.
-
-        Added name inferencing for anonymous functions to facilitate
-        debugging and profiling.
-
-        Re-enabled stats timers in the developer shell (d8).
-
-        Fixed issue 303 by avoiding to shortcut cons-symbols.
-
-
-2009-04-11: Version 1.1.8
-
-        Changed test-debug/ThreadedDebugging to be non-flaky (issue 96).
-
-        Fixed step-in handling for Function.prototype.apply and call in
-        the debugger (issue 269).
-
-        Fixed v8::Object::DeleteHiddenValue to not bail out when there
-        are no hidden properties.
-
-        Added workaround for crash bug, where external symbol table
-        entries with deleted resources would lead to NPEs when looking
-        up in the symbol table.
-
-
-2009-04-07: Version 1.1.7
-
-        Added support for easily importing additional environment
-        variables into the SCons build.
-
-        Optimized strict equality checks.
-
-        Fixed crash in indexed setters on objects without a corresponding
-        getter (issue 298).
-
-        Re-enabled script compilation cache.
-
-
-2009-04-01: Version 1.1.6
-
-        Reverted an unsafe code generator change.
-
-
-2009-04-01: Version 1.1.5
-
-        Fixed bug that caused function literals to not be optimized as
-        much as other functions.
-
-        Improved profiler support.
-
-        Fixed a crash bug in connection with debugger unloading.
-
-        Fixed a crash bug in the code generator caused by losing the
-        information that a frame element was copied.
-
-        Fixed an exception propagation bug that could cause non-null
-        return values when exceptions were thrown.
-
-
-2009-03-30: Version 1.1.4
-
-        Optimized String.prototype.match.
-
-        Improved the stack information in profiles.
-
-        Fixed bug in ARM port making it possible to compile the runtime
-        system for thumb mode again.
-
-        Implemented a number of optimizations in the code generator.
-
-        Fixed a number of memory leaks in tests.
-
-        Fixed crash bug in connection with script source code and external
-        strings.
-
-
-2009-03-24: Version 1.1.3
-
-        Fixed assertion failures in compilation of loop conditions.
-
-        Removed STL dependency from developer shell (d8).
-
-        Added infrastructure for protecting the V8 heap from corruption
-        caused by memory modifications from the outside.
-
-
-2009-03-24: Version 1.1.2
-
-        Improved frame merge code generated by the code generator.
-
-        Optimized String.prototype.replace.
-
-        Implemented __defineGetter__ and __defineSetter__ for properties
-        with integer keys on non-array objects.
-
-        Improved debugger and profiler support.
-
-        Fixed a number of portability issues to allow compilation for
-        smaller ARM devices.
-
-        Exposed object cloning through the API.
-
-        Implemented hidden properties.  This is used to expose an identity
-        hash for objects through the API.
-
-        Implemented restarting of regular expressions if their input
-        string changes representation during preemption.
-
-        Fixed a code generator bug that could cause assignments in loops
-        to be ignored if using continue to break out of the loop (issue
-        284).
-
-
-2009-03-12: Version 1.1.1
-
-        Fixed an assertion in the new compiler to take stack overflow
-        exceptions into account.
-
-        Removed exception propagation code that could cause crashes.
-
-        Fixed minor bug in debugger line number computations.
-
-        8-byte align the C stack on Linux and Windows to speed up floating
-        point computations.
-
-
-2009-03-12: Version 1.1.0
-
-        Improved code generation infrastructure by doing simple register
-        allocation and constant folding and propagation.
-
-        Optimized regular expression matching by avoiding to create
-        intermediate string arrays and by flattening nested array
-        representations of RegExp data.
-
-        Traverse a few stack frames when recording profiler samples to
-        include partial call graphs in the profiling output.
-
-        Added support for using OProfile to profile generated code.
-
-        Added remote debugging support to the D8 developer shell.
-
-        Optimized creation of nested literals like JSON objects.
-
-        Fixed a bug in garbage collecting unused maps and turned it on by
-        default (--collect-maps).
-
-        Added support for running tests under Valgrind.
-
-
-2009-02-27: Version 1.0.3
-
-        Optimized double-to-integer conversions in bit operations by using
-        SSE3 instructions if available.
-
-        Optimized initialization sequences that store to multiple
-        properties of the same object.
-
-        Changed the D8 debugger frontend to use JSON messages.
-
-        Force garbage collections when disposing contexts.
-
-        Align code objects at 32-byte boundaries.
-
-
-2009-02-25: Version 1.0.2
-
-        Improved profiling support by performing simple call stack
-        sampling for ticks and by fixing a bug in the logging of code
-        addresses.
-
-        Fixed a number of debugger issues.
-
-        Optimized code that uses eval.
-
-        Fixed a couple of bugs in the regular expression engine.
-
-        Reduced the size of generated code for certain regular expressions.
-
-        Removed JSCRE completely.
-
-        Fixed issue where test could not be run if there was a dot in the
-        checkout path.
-
-
-2009-02-13: Version 1.0.1
-
-        Fixed two crash-bugs in irregexp (issue 231 and 233).
-
-        Fixed a number of minor bugs (issue 87, 227 and 228).
-
-        Added support for morphing strings to external strings on demand
-        to avoid having to create copies in the embedding code.
-
-        Removed experimental support for external symbol callbacks.
-
-
-2009-02-09: Version 1.0.0
-
-        Fixed crash-bug in the code generation for case independent 16 bit
-        backreferences.
-
-        Made shells more robust in the presence of string conversion
-        failures (issue 224).
-
-        Fixed a potential infinite loop when attempting to resolve
-        eval (issue 221).
-
-        Miscellaneous fixes to the new regular expression engine.
-
-        Reduced binary by stripping unneeded text from JavaScript library and
-        minifying some JavaScript files.
-
-
-2009-01-27: Version 0.4.9
-
-        Enabled new regular expression engine.
-
-        Made a number of changes to the debugger protocol.
-
-        Fixed a number of bugs in the preemption support.
-
-        Added -p option to the developer shell to run files in parallel
-        using preemption.
-
-        Fixed a number of minor bugs (including issues 176, 187, 189, 192,
-        193, 198 and 201).
-
-        Fixed a number of bugs in the serialization/deserialization
-        support for the ARM platform.
-
-
-2009-01-19: Version 0.4.8.1
-
-        Minor patch to debugger support.
-
-
-2009-01-16: Version 0.4.8
-
-        Fixed string length bug on ARM (issue 171).
-
-        Made most methods in the API const.
-
-        Optimized object literals by improving data locality.
-
-        Fixed bug that caused incomplete functions to be cached in case of
-        stack overflow exceptions.
-
-        Fixed bugs that caused catch variables and variables introduced by
-        eval to behave incorrectly when using accessors (issues 186, 190
-        and 191).
-
-
-2009-01-06: Version 0.4.7
-
-        Minor bugfixes and optimizations.
-
-        Added command line debugger to D8 shell.
-
-        Fixed subtle bug that caused the wrong 'this' to be used when
-        calling a caught function in a catch clause.
-
-        Inline array loads within loops directly in the code instead of
-        always calling a stub.
-
-
-2008-12-11: Version 0.4.6
-
-        Fixed exception reporting bug where certain exceptions were
-        incorrectly reported as uncaught.
-
-        Improved the memory allocation strategy used during compilation to
-        make running out of memory when compiling huge scripts less
-        likely.
-
-        Optimized String.replace by avoiding the construction of certain
-        sub strings.
-
-        Fixed bug in code generation for large switch statements on ARM.
-
-        Fixed bug that caused V8 to change the global object template
-        passed in by the user.
-
-        Changed the API for creating object groups used during garbage
-        collection.  Entire object groups are now passed to V8 instead of
-        individual members of the groups.
-
-
-2008-12-03: Version 0.4.5
-
-        Added experimental API support for allocating V8 symbols as
-        external strings.
-
-        Fixed bugs in debugging support on ARM.
-
-        Changed eval implementation to correctly detect whether or not a
-        call to eval is aliased.
-
-        Fixed bug caused by a combination of the compilation cache and
-        dictionary probing in native code.  The bug caused us to sometimes
-        call functions that had not yet been compiled.
-
-        Added platform support for FreeBSD.
-
-        Added support for building V8 on Windows with either the shared or
-        static version of MSVCRT
-
-        Added the v8::jscre namespace around the jscre functions to avoid
-        link errors (duplicate symbols) when building Google Chrome.
-
-        Added support for calling a JavaScript function with the current
-        debugger execution context as its argument to the debugger
-        interface.
-
-        Changed the type of names of counters from wchar_t to char.
-
-        Changed the Windows system call used to compute daylight savings
-        time.  The system call that we used to use became four times
-        slower on WinXP SP3.
-
-        Added support in the d8 developer shell for memory-mapped counters
-        and added a stats-viewer tool.
-
-        Fixed bug in upper/lower case mappings (issue 149).
-
-
-2008-11-17: Version 0.4.4
-
-        Reduced code size by using shorter instruction encoding when
-        possible.
-
-        Added a --help option to the shell sample and to the d8 shell.
-
-        Added visual studio project files for building the ARM simulator.
-
-        Fixed a number of ARM simulator issues.
-
-        Fixed bug in out-of-memory handling on ARM.
-
-        Implemented shell support for passing arguments to a script from
-        the command line.
-
-        Fixed bug in date code that made certain date functions return -0
-        instead of 0 for dates before the epoch.
-
-        Restricted applications of eval so it can only be used in the
-        context of the associated global object.
-
-        Treat byte-order marks as whitespace characters.
-
-
-2008-11-04: Version 0.4.3
-
-        Added support for API accessors that prohibit overwriting by
-        accessors defined in JavaScript code by using __defineGetter__ and
-        __defineSetter__.
-
-        Improved handling of conditionals in test status files.
-
-        Introduced access control in propertyIsEnumerable.
-
-        Improved performance of some string operations by caching
-        information about the type of the string between operations.
-
-        Fixed bug in fast-case code for switch statements that only have
-        integer labels.
-
-
-2008-10-30: Version 0.4.2
-
-        Improved performance of Array.prototype.concat by moving the
-        implementation to C++ (issue 123).
-
-        Fixed heap growth policy to avoid growing old space to its maximum
-        capacity before doing a garbage collection and fixed issue that
-        would lead to artificial out of memory situations (issue 129).
-
-        Fixed Date.prototype.toLocaleDateString to return the date in the
-        same format as WebKit.
-
-        Added missing initialization checks to debugger API.
-
-        Added removing of unused maps during GC.
-
-
-2008-10-28: Version 0.4.1
-
-        Added caching of RegExp data in compilation cache.
-
-        Added Visual Studio project file for d8 shell.
-
-        Fixed function call performance regression introduced in version
-        0.4.0 when splitting the global object in two parts (issue 120).
-
-        Fixed issue 131 by checking for empty handles before throwing and
-        reporting exceptions.
-
-
-2008-10-23: Version 0.4.0
-
-        Split the global object into two parts: The state holding global
-        object and the global object proxy.
-
-        Fixed bug that affected the value of an assignment to an element
-        in certain cases (issue 116).
-
-        Added GetPropertyNames functionality (issue 33) and extra Date
-        functions (issue 77) to the API.
-
-        Changed WeakReferenceCallback to take a Persistent<Value> instead
-        of a Persistent<Object> (issue 101).
-
-        Fixed issues with message reporting for exceptions in try-finally
-        blocks (issues 73 and 75).
-
-        Optimized flattening of strings and string equality checking.
-
-        Improved Boyer-Moore implementation for faster indexOf operations.
-
-        Added development shell (d8) which includes counters and
-        completion support.
-
-        Fixed problem with the receiver passed to functions called from
-        eval (issue 124).
-
-
-2008-10-16: Version 0.3.5
-
-        Improved string hash-code distribution by excluding bit-field bits
-        from the hash-code.
-
-        Changed string search algorithm used in indexOf from KMP to
-        Boyer-Moore.
-
-        Improved the generated code for the instanceof operator.
-
-        Improved performance of slow-case string equality checks by
-        specializing the code based on the string representation.
-
-        Improve the handling of out-of-memory situations (issue 70).
-
-        Improved performance of strict equality checks.
-
-        Improved profiler output to make it easier to see anonymous
-        functions.
-
-        Improved performance of slow-case keyed loads.
-
-        Improved property access performance by allocating a number of
-        properties in the front object.
-
-        Changed the toString behavior on the built-in object constructors
-        to print [native code] instead of the actual source.  Some web
-        applications do not like constructors with complex toString
-        results.
-
-
-2008-10-06: Version 0.3.4
-
-        Changed Array.prototype.sort to use quick sort.
-
-        Fixed code generation issue where leaving a finally block with
-        break or continue would accumulate elements on the expression
-        stack (issue 86).
-
-        Made sure that the name accessor on functions returns the expected
-        names for builtin JavaScript functions and C++ callback functions.
-
-        Added fast case code for extending the property storage array of
-        JavaScript objects.
-
-        Ported switch statement optimizations introduced in version 0.3.3
-        to the ARM code generator.
-
-        Allowed GCC to use strict-aliasing rules when compiling.
-
-        Improved performance of arguments object allocation by taking care
-        of arguments adaptor frames in the generated code.
-
-        Updated the V8 benchmark suite to version 2.
-
-
-2008-09-25: Version 0.3.3
-
-        Improved handling of relocation information to enable more
-        peep-hole optimizations.
-
-        Optimized switch statements where all labels are constant small
-        integers.
-
-        Optimized String.prototype.indexOf for common cases.
-
-        Fixed more build issues (issue 80).
-
-        Fixed a couple of profiler issues.
-
-        Fixed bug where the body of a function created using the Function
-        constructor was not allowed to end with a single-line comment
-        (issue 85).
-
-        Improved handling of object literals by canonicalizing object
-        literal maps.  This will allow JSON objects with the same set of
-        properties to share the same map making inline caching work better
-        for JSON objects.
-
-
-2008-09-17: Version 0.3.2
-
-        Generalized the EvalCache into a CompilationCache and enabled it
-        for scripts too.  The current strategy is to retire all entries
-        whenever a mark-sweep collection is started.
-
-        Fixed bug where switch statements containing only a default case
-        would lead to an unbalanced stack (issue 69).
-
-        Fixed bug that made access to the function in a named function
-        expression impossible in certain situations (issue 24).
-
-        Fixed even more build issues.
-
-        Optimized calling conventions on ARM.  The conventions on ARM and
-        IA-32 now match.
-
-        Removed static initializers for flags and counters.
-
-        Improved inline caching behavior for uncommon cases where lazily
-        loading Date and RegExp code could force certain code paths go
-        megamorphic.
-
-        Removed arguments adaption for builtins written in C++.  This
-        makes Array.prototype.push and Array.prototype.pop slightly
-        faster.
-
-
-2008-09-11: Version 0.3.1
-
-        Fixed a number of build issues.
-
-        Fixed problem with missing I-cache flusing on ARM.
-
-        Changed space layout in memory management by splitting up
-        code space into old data space and code space.
-
-        Added utf-8 conversion support to the API (issue 57).
-
-        Optimized repeated calls to eval with the same strings.  These
-        repeated calls are common in web applications.
-
-        Added Xcode project file.
-
-        Optimized a couple of Array operation.
-
-        Fixed parser bug by checking for end-of-string when parsing break
-        and continue (issue 35).
-
-        Fixed problem where asian characters were not categorized as
-        letters.
-
-        Fixed bug that disallowed calling functions fetched from an array
-        using a string as an array index (issue 32).
-
-        Fixed bug where the internal field count on object templates were
-        sometimes ignored (issue 54).
-
-        Added -f option to the shell sample for compatibility with other
-        engines (issue 18).
-
-        Added source info to TryCatches in the API.
-
-        Fixed problem where the seed for the random number generator was
-        clipped in a double to unsigned int conversion.
-
-        Fixed bug where cons string symbols were sometimes converted to
-        non-symbol flat strings during GC.
-
-        Fixed bug in error reporting when attempting to convert null to an
-        object.
-
-
-2008-09-04: Version 0.3.0
-
-        Added support for running tests on the ARM simulator.
-
-        Fixed bug in the 'in' operator where negative indices were not
-        treated correctly.
-
-        Fixed build issues on gcc-4.3.1.
-
-        Changed Date.prototype.toLocaleTimeString to not print the
-        timezone part of the time.
-
-        Renamed debug.h to v8-debug.h to reduce the risk of name conflicts
-        with user code.
-
-
-2008-09-02: Version 0.2.5
-
-        Renamed the top level directory 'public' to 'include'.
-
-        Added 'env' option to the SCons build scripts to support
-        overriding the ENV part of the build environment.  This is mostly
-        to support Windows builds in cases where SCons cannot find the
-        correct paths to the Windows SDK, as these paths cannot be passed
-        through shell environment variables.
-
-        Enabled "Buffer Security Check" on for the Windows SCons build and
-        added the linker option /OPT:ICF as an optimization.
-
-        Added the V8 benchmark suite to the repository.
-
-
-2008-09-01: Version 0.2.4
-
-        Included mjsunit JavaScript test suite and C++ unit tests.
-
-        Changed the shell sample to not print the result of executing a
-        script provided on the command line.
-
-        Fixed issue when building samples on Windows using a shared V8
-        library.  Added visibility option on Linux build which makes the
-        generated library 18% smaller.
-
-        Changed build system to accept multiple build modes in one build
-        and generate separate objects, libraries and executables for each
-        mode.
-
-        Removed deferred negation optimization (a * -b => -(a * b)) since
-        this visibly changes operand conversion order.
-
-        Improved parsing performance by introducing stack guard in
-        preparsing.  Without a stack guard preparsing always bails out
-        with stack overflow.
-
-        Changed shell sample to take flags directly from the command-line.
-        Added API call that implements this.
-
-        Added load, quit and version functions to the shell sample so it's
-        easier to run benchmarks and tests.
-
-        Fixed issue with building samples and cctests on 64-bit machines.
-
-        Fixed bug in the runtime system where the prototype chain was not
-        always searched for a setter when setting a property that does not
-        exist locally.
-
-
-2008-08-14: Version 0.2.3
-
-        Improved performance of garbage collection by moving the
-        function that updates pointers during compacting collection
-        into the updating visitor.  This gives the compiler a better
-        chance to inline and avoid a function call per (potential)
-        pointer.
-
-        Extended the shell sample with a --runtime-flags option.
-
-        Added Visual Studio project files for the shell.cc and
-        process.cc samples.
-
-
-2008-08-13: Version 0.2.2
-
-        Improved performance of garbage collection by changing the way
-        we use the marking stack in the event of stack overflow during
-        full garbage collection and by changing the way we mark roots.
-
-        Cleaned up ARM version by removing top of stack caching and by
-        introducing push/pop elimination.
-
-        Cleaned up the way runtime functions are called to allow
-        runtime calls with no arguments.
-
-        Changed Windows build options to make sure that exceptions are
-        disabled and that optimization flags are enabled.
-
-        Added first version of Visual Studio project files.
-
-
-2008-08-06: Version 0.2.1
-
-        Improved performance of unary addition by avoiding runtime calls.
-
-        Fixed the handling of '>' and '<=' to use right-to-left conversion
-        and left-to-right evaluation as specified by ECMA-262.
-
-        Fixed a branch elimination bug on the ARM platform where incorrect
-        code was generated because of overly aggressive branch
-        elimination.
-
-        Improved performance of code that repeatedly assigns the same
-        function to the same property of different objects with the same
-        map.
-
-        Untangled DEBUG and ENABLE_DISASSEMBLER defines.  The disassembler
-        no longer expects DEBUG to be defined.
-
-        Added platform-nullos.cc to serve as the basis for new platform
-        implementations.
-
-
-2008-07-30: Version 0.2.0
-
-        Changed all text files to have native svn:eol-style.
-
-        Added a few samples and support for building them. The samples
-        include a simple shell that can be used to benchmark and test V8.
-
-        Changed V8::GetVersion to return the version as a string.
-
-        Added source for lazily loaded scripts to snapshots and made
-        serialization non-destructive.
-
-        Improved ARM support by fixing the write barrier code to use
-        aligned loads and stores and by removing premature locals
-        optimization that relied on broken support for callee-saved
-        registers (removed).
-
-        Refactored the code for marking live objects during garbage
-        collection and the code for allocating objects in paged
-        spaces. Introduced an abstraction for the map word of a heap-
-        allocated object and changed the memory allocator to allocate
-        executable memory only for spaces that may contain code objects.
-
-        Moved StringBuilder to utils.h and ScopedLock to platform.h, where
-        they can be used by debugging and logging modules. Added
-        thread-safe message queues for dealing with debugger events.
-
-        Fixed the source code reported by toString for certain builtin
-        empty functions and made sure that the prototype property of a
-        function is enumerable.
-
-        Improved performance of converting values to condition flags in
-        generated code.
-
-        Merged disassembler-{arch} files.
-
-
-2008-07-28: Version 0.1.4
-
-        Added support for storing JavaScript stack traces in a stack
-        allocated buffer to make it visible in shallow core dumps.
-        Controlled by the --preallocate-message-memory flag which is
-        disabled by default.
-
-
-2008-07-25: Version 0.1.3
-
-        Fixed bug in JSObject::GetPropertyAttributePostInterceptor where
-        map transitions would count as properties.
-
-        Allowed aliased eval invocations by treating them as evals in the
-        global context. This may change in the future.
-
-        Added support for accessing the last entered context through the
-        API and renamed Context::Current to Context::GetCurrent and
-        Context::GetSecurityContext to Context::GetCurrentSecurityContext.
-
-        Fixed bug in the debugger that would cause the debugger scripts to
-        be recursively loaded and changed all disabling of interrupts to
-        be block-structured.
-
-        Made snapshot data read-only to allow it to be more easily shared
-        across multiple users of V8 when linked as a shared library.
-
-
-2008-07-16: Version 0.1.2
-
-        Fixed building on Mac OS X by recognizing i386 and friends as
-        IA-32 platforms.
-
-        Added propagation of stack overflow exceptions that occur while
-        compiling nested functions.
-
-        Improved debugger with support for recursive break points and
-        handling of exceptions that occur in the debugger JavaScript code.
-
-        Renamed GetInternal to GetInternalField and SetInternal to
-        SetInternalField in the API and moved InternalFieldCount and
-        SetInternalFieldCount from FunctionTemplate to ObjectTemplate.
-
-
-2008-07-09: Version 0.1.1
-
-        Fixed bug in stack overflow check code for IA-32 targets where a
-        non-tagged value in register eax was pushed to the stack.
-
-        Fixed potential quadratic behavior when converting strings to
-        numbers.
-
-        Fixed bug where the return value from Object::SetProperty could
-        end up being the property holder instead of the written value.
-
-        Improved debugger support by allowing nested break points and by
-        dealing with stack-overflows when compiling functions before
-        setting break points in them.
-
-
-2008-07-03: Version 0.1.0
-
-        Initial export.
-
-# Local Variables:
-# mode:text
-# End:
diff --git a/deps/v8/DEPS b/deps/v8/DEPS
index 0faa57e5b05c04..880ff6c4b82d59 100644
--- a/deps/v8/DEPS
+++ b/deps/v8/DEPS
@@ -2,7 +2,15 @@
 # directory and assume that the root of the checkout is in ./v8/, so
 # all paths in here must match this assumption.
 
+gclient_gn_args_file = 'v8/build/config/gclient_args.gni'
+gclient_gn_args = [
+  'checkout_aemu'
+]
+
 vars = {
+  # By Default, do not checkout AEMU, as it is too big, as is done in Chromium.
+  'checkout_aemu': False,
+
   # Fetches only the SDK boot images which match at least one of the whitelist
   # entries in a comma-separated list.
   #
@@ -19,6 +27,7 @@ vars = {
   'checkout_fuchsia_boot_images': "qemu.x64,qemu.arm64",
 
   'checkout_instrumented_libraries': False,
+  'checkout_ittapi': False,
   'chromium_url': 'https://chromium.googlesource.com',
   'android_url': 'https://android.googlesource.com',
   'download_gcmole': False,
@@ -26,19 +35,19 @@ vars = {
   'check_v8_header_includes': False,
 
   # GN CIPD package version.
-  'gn_version': 'git_revision:ad9e442d92dcd9ee73a557428cfc336b55cbd533',
+  'gn_version': 'git_revision:97cc440d84f050f99ff0161f9414bfa2ffa38f65',
 
   # luci-go CIPD package version.
-  'luci_go': 'git_revision:7d11fd9e66407c49cb6c8546a2ae45ea993a240c',
+  'luci_go': 'git_revision:37a855b64d59b7f079c9a0e5368f2757099d14d3',
 
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling android_sdk_build-tools_version
   # and whatever else without interference from each other.
-  'android_sdk_build-tools_version': '5DL7LQQjVMLClXLzLgmGysccPGsGcjJdvH9z5-uetiIC',
+  'android_sdk_build-tools_version': 'n-b1Qd7iFb8qzHlr1C_jIeu070UDgO_BwePtH42UqGcC',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling android_sdk_emulator_version
   # and whatever else without interference from each other.
-  'android_sdk_emulator_version': 'xhyuoquVvBTcJelgRjMKZeoBVSQRjB7pLVJPt5C9saIC',
+  'android_sdk_emulator_version': 'f4WdgkPvDdVCE8zBWPzcSIj4N9WFhKp3CSKDWylXuLEC',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling android_sdk_extras_version
   # and whatever else without interference from each other.
@@ -50,15 +59,15 @@ vars = {
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling android_sdk_platform-tools_version
   # and whatever else without interference from each other.
-  'android_sdk_platform-tools_version': 'MSnxgXN7IurL-MQs1RrTkSFSb8Xd1UtZjLArI8Ty1FgC',
+  'android_sdk_platform-tools_version': 'Jxtur3_L9RzY4q79K-AwIahwFW4oi5uYVD5URx9h62wC',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling android_sdk_platforms_version
   # and whatever else without interference from each other.
-  'android_sdk_platforms_version': 'Kg2t9p0YnQk8bldUv4VA3o156uPXLUfIFAmVZ-Gm5ewC',
+  'android_sdk_platforms_version': 'yb33klKQV9UzzB-lDSsq36vzhTXOUZ2aRONBvPGwvdcC',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling android_sdk_sources_version
   # and whatever else without interference from each other.
-  'android_sdk_sources_version': 'K9uEn3JvNELEVjjVK_GQD3ZQD3rqAnJSxCWxjmUmRkgC',
+  'android_sdk_sources_version': '4gxhM8E62bvZpQs7Q3d0DinQaW0RLCIefhXrQBFkNy8C',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling android_sdk_tools_version
   # and whatever else without interference from each other.
@@ -71,15 +80,15 @@ vars = {
 
 deps = {
   'v8/build':
-    Var('chromium_url') + '/chromium/src/build.git' + '@' + '082f11b29976c3be67dddd74bd75c6d1793201c7',
+    Var('chromium_url') + '/chromium/src/build.git' + '@' + '2f17606c25956e800b6c4670c294a03620e78551',
   'v8/third_party/depot_tools':
-    Var('chromium_url') + '/chromium/tools/depot_tools.git' + '@' + 'ba97f6065ed1e9336585468dd85e680cf09d5166',
+    Var('chromium_url') + '/chromium/tools/depot_tools.git' + '@' + 'ea8b58b970c0c94b4a36270b806ee307547cd77e',
   'v8/third_party/icu':
-    Var('chromium_url') + '/chromium/deps/icu.git' + '@' + '5005010d694e16571b8dfbf07d70817841f80a69',
+    Var('chromium_url') + '/chromium/deps/icu.git' + '@' + 'dbd3825b31041d782c5b504c59dcfb5ac7dda08c',
   'v8/third_party/instrumented_libraries':
-    Var('chromium_url') + '/chromium/src/third_party/instrumented_libraries.git' + '@' + 'e2897773b97b65f70b0bb15b753c73d9f6e3afdb',
+    Var('chromium_url') + '/chromium/src/third_party/instrumented_libraries.git' + '@' + 'bb3f1802c237dd19105dd0f7919f99e536a39d10',
   'v8/buildtools':
-    Var('chromium_url') + '/chromium/src/buildtools.git' + '@' + 'cf454b247c611167388742c7a31ef138a6031172',
+    Var('chromium_url') + '/chromium/src/buildtools.git' + '@' + 'afc5b798c72905e85f9991152be878714c579958',
   'v8/buildtools/clang_format/script':
     Var('chromium_url') + '/chromium/llvm-project/cfe/tools/clang-format.git' + '@' + '96636aa0e9f047f17447f2d45a094d0b59ed7917',
   'v8/buildtools/linux64': {
@@ -103,7 +112,7 @@ deps = {
     'condition': 'host_os == "mac"',
   },
   'v8/buildtools/third_party/libc++/trunk':
-    Var('chromium_url') + '/chromium/llvm-project/libcxx.git' + '@' + '5938e0582bac570a41edb3d6a2217c299adc1bc6',
+    Var('chromium_url') + '/chromium/llvm-project/libcxx.git' + '@' + '78d6a7767ed57b50122a161b91f59f19c9bd0d19',
   'v8/buildtools/third_party/libc++abi/trunk':
     Var('chromium_url') + '/chromium/llvm-project/libcxxabi.git' + '@' + '0d529660e32d77d9111912d73f2c74fc5fa2a858',
   'v8/buildtools/third_party/libunwind/trunk':
@@ -119,15 +128,19 @@ deps = {
     'condition': 'host_os == "win"',
   },
   'v8/base/trace_event/common':
-    Var('chromium_url') + '/chromium/src/base/trace_event/common.git' + '@' + '5e4fce17a9d2439c44a7b57ceecef6df9287ec2f',
+    Var('chromium_url') + '/chromium/src/base/trace_event/common.git' + '@' + 'bd79231eb1f9e7de2efb4ad79e530d9a7e70d9a5',
   'v8/third_party/android_ndk': {
-    'url': Var('chromium_url') + '/android_ndk.git' + '@' + '89e8db0cdf323af8bc24de875d7d2a43a66bf10e',
+    'url': Var('chromium_url') + '/android_ndk.git' + '@' + '27c0a8d090c666a50e40fceb4ee5b40b1a2d3f87',
+    'condition': 'checkout_android',
+  },
+  'v8/third_party/android_platform': {
+    'url': Var('chromium_url') + '/chromium/src/third_party/android_platform.git' + '@' + '2244b5ea295f8fda3179bef160c84ef8fa0ec9fc',
     'condition': 'checkout_android',
   },
   'v8/third_party/android_sdk/public': {
       'packages': [
           {
-              'package': 'chromium/third_party/android_sdk/public/build-tools',
+              'package': 'chromium/third_party/android_sdk/public/build-tools/29.0.2',
               'version': Var('android_sdk_build-tools_version'),
           },
           {
@@ -147,11 +160,11 @@ deps = {
               'version': Var('android_sdk_platform-tools_version'),
           },
           {
-              'package': 'chromium/third_party/android_sdk/public/platforms',
+              'package': 'chromium/third_party/android_sdk/public/platforms/android-29',
               'version': Var('android_sdk_platforms_version'),
           },
           {
-              'package': 'chromium/third_party/android_sdk/public/sources',
+              'package': 'chromium/third_party/android_sdk/public/sources/android-29',
               'version': Var('android_sdk_sources_version'),
           },
           {
@@ -167,7 +180,7 @@ deps = {
       'dep_type': 'cipd',
   },
   'v8/third_party/catapult': {
-    'url': Var('chromium_url') + '/catapult.git' + '@' + 'b9fad2fbcc499b984d88f4c4aec26d162297efae',
+    'url': Var('chromium_url') + '/catapult.git' + '@' + '2e0a0cb9ad546be8c835e65d7537507cb7896e03',
     'condition': 'checkout_android',
   },
   'v8/third_party/colorama/src': {
@@ -175,11 +188,11 @@ deps = {
     'condition': 'checkout_android',
   },
   'v8/third_party/fuchsia-sdk': {
-    'url': Var('chromium_url') + '/chromium/src/third_party/fuchsia-sdk.git' + '@' + '1785f0ac8e1fe81cb25e260acbe7de8f62fa3e44',
+    'url': Var('chromium_url') + '/chromium/src/third_party/fuchsia-sdk.git' + '@' + '19c8ac5e150fbd147ec5987425a41aa9e97098b2',
     'condition': 'checkout_fuchsia',
   },
   'v8/third_party/googletest/src':
-    Var('chromium_url') + '/external/github.com/google/googletest.git' + '@' + 'f2fb48c3b3d79a75a88a99fba6576b25d42ec528',
+    Var('chromium_url') + '/external/github.com/google/googletest.git' + '@' + '306f3754a71d6d1ac644681d3544d06744914228',
   'v8/third_party/jinja2':
     Var('chromium_url') + '/chromium/src/third_party/jinja2.git' + '@' + 'b41863e42637544c2941b574c7877d3e1f663e25',
   'v8/third_party/markupsafe':
@@ -191,7 +204,7 @@ deps = {
   'v8/test/mozilla/data':
     Var('chromium_url') + '/v8/deps/third_party/mozilla-tests.git' + '@' + 'f6c578a10ea707b1a8ab0b88943fe5115ce2b9be',
   'v8/test/test262/data':
-    Var('chromium_url') + '/external/github.com/tc39/test262.git' + '@' + 'd49777de27240262fa65c3b49dc014839e6897da',
+    Var('chromium_url') + '/external/github.com/tc39/test262.git' + '@' + '28b4fcca4b1b1d278dfe0cc0e69c7d9d59b31aab',
   'v8/test/test262/harness':
     Var('chromium_url') + '/external/github.com/test262-utils/test262-harness-py.git' + '@' + '4555345a943d0c99a9461182705543fb171dda4b',
   'v8/third_party/qemu-linux-x64': {
@@ -215,7 +228,7 @@ deps = {
       'dep_type': 'cipd',
   },
   'v8/tools/clang':
-    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + 'c5d85f1e9d3a01e4de2ccf4dfaa7847653ae9121',
+    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + '535dbf16a84c7fc238f7ed11b5a75381407e38f6',
   'v8/tools/luci-go': {
       'packages': [
         {
@@ -238,16 +251,24 @@ deps = {
     'packages': [
       {
         'package': 'chromium/llvm-build-tools/dsymutil',
-        'version': 'OWlhXkmj18li3yhJk59Kmjbc5KdgLh56TwCd1qBdzlIC',
+        'version': 'M56jPzDv1620Rnm__jTMYS62Zi8rxHVq7yw0qeBFEgkC',
       }
     ],
     'condition': 'checkout_mac',
     'dep_type': 'cipd',
   },
   'v8/third_party/perfetto':
-    Var('android_url') + '/platform/external/perfetto.git' + '@' + '28b633cd961b50c4c75bfb7f62eeac79e27c1a79',
+    Var('android_url') + '/platform/external/perfetto.git' + '@' + '12dc10e0278cded35205cf84f80a821348cb6c56',
   'v8/third_party/protobuf':
     Var('chromium_url') + '/external/github.com/google/protobuf'+ '@' + 'b68a347f56137b4b1a746e8c7438495a6ac1bd91',
+  'v8/third_party/zlib':
+    Var('chromium_url') + '/chromium/src/third_party/zlib.git'+ '@' + 'b9b9a5af7cca2e683e5f2aead8418e5bf9d5a7d5',
+  'v8/third_party/ittapi': {
+    # Force checkout ittapi libraries to pass v8 header includes check on
+    # bots that has check_v8_header_includes enabled.
+    'url': Var('chromium_url') + '/external/github.com/intel/ittapi' + '@' + 'b4ae0122ba749163096058b4f1bb065bf4a7de94',
+    'condition': "checkout_ittapi or check_v8_header_includes",
+  },
 }
 
 include_rules = [
@@ -255,6 +276,7 @@ include_rules = [
   '+include',
   '+unicode',
   '+third_party/fdlibm',
+  '+third_party/ittapi/include'
 ]
 
 # checkdeps.py shouldn't check for includes in these directories:
@@ -478,14 +500,16 @@ hooks = [
     'name': 'lld/mac',
     'pattern': '.',
     'condition': 'host_os == "mac" and checkout_fuchsia',
-    'action': ['python', 'v8/tools/clang/scripts/download_lld_mac.py'],
+    'action': ['python', 'v8/tools/clang/scripts/update.py',
+               '--package=lld_mac'],
   },
   {
       # Mac does not have llvm-objdump, download it for cross builds in Fuchsia.
     'name': 'llvm-objdump',
     'pattern': '.',
     'condition': 'host_os == "mac" and checkout_fuchsia',
-    'action': ['python', 'v8/tools/clang/scripts/download_objdump.py'],
+    'action': ['python', 'v8/tools/clang/scripts/update.py',
+               '--package=objdump'],
   },
   # Download and initialize "vpython" VirtualEnv environment packages.
   {
diff --git a/deps/v8/INFRA_OWNERS b/deps/v8/INFRA_OWNERS
index 4b847b21f7a9a3..253be4c96f8d97 100644
--- a/deps/v8/INFRA_OWNERS
+++ b/deps/v8/INFRA_OWNERS
@@ -1,3 +1,2 @@
 machenbach@chromium.org
-sergiyb@chromium.org
 tmrts@chromium.org
diff --git a/deps/v8/PRESUBMIT.py b/deps/v8/PRESUBMIT.py
index 67986d83031c38..9b03f631c592c9 100644
--- a/deps/v8/PRESUBMIT.py
+++ b/deps/v8/PRESUBMIT.py
@@ -285,8 +285,6 @@ def PathToGuardMacro(path):
     return []
 
 
-# TODO(mstarzinger): Similar checking should be made available as part of
-# tools/presubmit.py (note that tools/check-inline-includes.sh exists).
 def _CheckNoInlineHeaderIncludesInNormalHeaders(input_api, output_api):
   """Attempts to prevent inclusion of inline headers into normal header
   files. This tries to establish a layering where inline headers can be
@@ -393,7 +391,6 @@ def _CommonChecks(input_api, output_api):
     _CheckHeadersHaveIncludeGuards,
     _CheckNoInlineHeaderIncludesInNormalHeaders,
     _CheckJSONFiles,
-    _CheckMacroUndefs,
     _CheckNoexceptAnnotations,
     _RunTestsWithVPythonSpec,
   ]
@@ -456,68 +453,6 @@ def FilterFile(affected_file):
   return [output_api.PresubmitError(r) for r in results]
 
 
-def _CheckMacroUndefs(input_api, output_api):
-  """
-  Checks that each #define in a .cc file is eventually followed by an #undef.
-
-  TODO(clemensb): This check should eventually be enabled for all cc files via
-  tools/presubmit.py (https://crbug.com/v8/6811).
-  """
-  def FilterFile(affected_file):
-    # Skip header files, as they often define type lists which are used in
-    # other files.
-    white_list = (r'.+\.cc',r'.+\.cpp',r'.+\.c')
-    return input_api.FilterSourceFile(affected_file, white_list=white_list)
-
-  def Touches(line):
-    return line.startswith('+') or line.startswith('-')
-
-  def InvolvesMacros(text):
-    return define_pattern.match(text) or undef_pattern.match(text)
-
-  def TouchesMacros(f):
-    return any(Touches(line) and InvolvesMacros(line[1:])
-               for line in f.GenerateScmDiff().splitlines())
-
-  def CollectUndefsWithNoDef(defined_macros, errors, f, line, line_nr):
-    define_match = define_pattern.match(line)
-    if define_match:
-      name = define_match.group(1)
-      defined_macros[name] = line_nr
-    undef_match = undef_pattern.match(line)
-    if undef_match and not "// NOLINT" in line:
-      name = undef_match.group(1)
-      if name in defined_macros:
-        del defined_macros[name]
-      else:
-        errors.append('{}:{}: Macro named \'{}\' was not defined before.'
-                      .format(f.LocalPath(), line_nr, name))
-
-  define_pattern = input_api.re.compile(r'#define (\w+)')
-  undef_pattern = input_api.re.compile(r'#undef (\w+)')
-  errors = []
-  for f in input_api.AffectedFiles(
-      file_filter=FilterFile, include_deletes=False):
-    if not TouchesMacros(f):
-      continue
-
-    defined_macros = dict()
-    with open(f.LocalPath()) as fh:
-      for line_nr, line in enumerate(fh, start=1):
-        CollectUndefsWithNoDef(defined_macros, errors, f, line, line_nr)
-
-    for name, line_nr in sorted(defined_macros.items(), key=lambda e: e[1]):
-      errors.append('{}:{}: Macro missing #undef: {}'
-                    .format(f.LocalPath(), line_nr, name))
-
-  if errors:
-    return [output_api.PresubmitPromptOrNotify(
-        'Detected mismatches in #define / #undef in the file(s) where you '
-        'modified preprocessor macros.',
-        errors)]
-  return []
-
-
 def _CheckNoexceptAnnotations(input_api, output_api):
   """
   Checks that all user-defined constructors and assignment operators are marked
diff --git a/deps/v8/WATCHLISTS b/deps/v8/WATCHLISTS
index bd07d318dadd55..47470f49e42308 100644
--- a/deps/v8/WATCHLISTS
+++ b/deps/v8/WATCHLISTS
@@ -33,14 +33,21 @@
 
 {
   'WATCHLIST_DEFINITIONS': {
-    'public_api': {
-      'filepath': 'include/',
+    'api': {
+      'filepath': 'include/' \
+                  '|src/api\.(cc|h)$',
     },
     'snapshot': {
       'filepath': 'src/snapshot/',
     },
-    'debugger': {
-      'filepath': 'src/debug/',
+    'devtools': {
+      'filepath': 'src/debug/' \
+                  '|src/inspector/' \
+                  '|src/profiler/' \
+                  '|src/libsampler/' \
+                  '|src/tracing/' \
+                  '|include/js_protocol.pdl' \
+                  '|include/v8-inspector*\.h',
     },
     'interpreter': {
       'filepath': 'src/interpreter/' \
@@ -49,7 +56,7 @@
                   '|test/unittests/interpreter/',
     },
     'feature_shipping_status': {
-      'filepath': 'src/flag-definitions.h',
+      'filepath': 'src/flags/flag-definitions.h',
     },
     'gc_changes': {
       'filepath': 'src/heap/',
@@ -57,45 +64,81 @@
     'arm': {
       'filepath': '/arm/',
     },
+    'csa': {
+      'filepath': 'src/codegen/code-stub-assembler\.(cc|h)$' \
+                  '|src/builtins/.*-gen.(cc|h)$',
+    },
     'ia32': {
       'filepath': '/ia32/',
     },
     'merges': {
       'filepath': '.',
-    }
+    },
+    'wasm': {
+      'filepath': 'src/wasm/' \
+                  '|src/compiler/wasm',
+    },
+    'value_serializer': {
+      'filepath': 'src/value-serializer',
+    },
+    'parser': {
+      'filepath': 'src/ast/' \
+                  '|src/parsing/',
+    },
+    'torque': {
+      'filepath': '.*\.tq$',
+    },
+    'tracing': {
+      'filepath': 'src/tracing/',
+    },
   },
 
   'WATCHLISTS': {
-    'public_api': [
-      'phajdan.jr@chromium.org',
+    'api': [
+      'yangguo+watch@chromium.org',
+    ],
+    'csa': [
+      'jgruber+watch@chromium.org',
+    ],
+    'torque': [
+      'jgruber+watch@chromium.org',
     ],
     'snapshot': [
-      'yangguo@chromium.org',
+      'jgruber+watch@chromium.org',
     ],
-    'debugger': [
-      'yangguo@chromium.org',
+    'devtools': [
+      'devtools-reviews+v8@chromium.org',
     ],
     'interpreter': [
       'rmcilroy@chromium.org',
-      'oth@chromium.org',
     ],
     'feature_shipping_status': [
       'hablich@chromium.org',
     ],
     'gc_changes': [
       'hpayer@chromium.org',
-      'ulan@chromium.org',
     ],
     'arm': [
       'v8-mips-ports@googlegroups.com',
       'v8-ppc-ports@googlegroups.com',
     ],
-    'ia32': [
-      'v8-x87-ports@googlegroups.com',
-    ],
     'merges': [
       # Only enabled on branches created with tools/release/create_release.py
       'v8-merges@googlegroups.com',
     ],
+    'wasm': [
+      'wasm-v8@google.com',
+    ],
+    'value_serializer': [
+      'jbroman+watch@chromium.org',
+    ],
+    'parser': [
+      'marja+watch@chromium.org',
+    ],
+    'tracing': [
+      'alph+watch@chromium.org',
+      'lpy+v8tracing@chromium.org',
+      'fmeawad@chromium.org',
+    ],
   },
 }
diff --git a/deps/v8/base/trace_event/common/trace_event_common.h b/deps/v8/base/trace_event/common/trace_event_common.h
index 57ac0254d96376..3f741d816f722d 100644
--- a/deps/v8/base/trace_event/common/trace_event_common.h
+++ b/deps/v8/base/trace_event/common/trace_event_common.h
@@ -73,7 +73,7 @@
 //     }
 // The third parameter is a unique ID to match ASYNC_BEGIN/ASYNC_END pairs.
 // ASYNC_BEGIN and ASYNC_END can occur on any thread of any traced process.
-// Pointers can be used for the ID parameter, and they will be mangled
+// Pointers can be used for the ID parameter, and they will be annotated
 // internally so that the same pointer on two different processes will not
 // match. For example:
 //   class MyTracedClass {
@@ -506,27 +506,6 @@
                                    value1_name, static_cast<int>(value1_val), \
                                    value2_name, static_cast<int>(value2_val))
 
-// TRACE_EVENT_SAMPLE_* events are injected by the sampling profiler.
-#define TRACE_EVENT_SAMPLE_WITH_TID_AND_TIMESTAMP0(category_group, name,       \
-                                                   thread_id, timestamp)       \
-  INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP(                          \
-      TRACE_EVENT_PHASE_SAMPLE, category_group, name, 0, thread_id, timestamp, \
-      TRACE_EVENT_FLAG_NONE)
-
-#define TRACE_EVENT_SAMPLE_WITH_TID_AND_TIMESTAMP1(                            \
-    category_group, name, thread_id, timestamp, arg1_name, arg1_val)           \
-  INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP(                          \
-      TRACE_EVENT_PHASE_SAMPLE, category_group, name, 0, thread_id, timestamp, \
-      TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val)
-
-#define TRACE_EVENT_SAMPLE_WITH_TID_AND_TIMESTAMP2(category_group, name,       \
-                                                   thread_id, timestamp,       \
-                                                   arg1_name, arg1_val,        \
-                                                   arg2_name, arg2_val)        \
-  INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP(                          \
-      TRACE_EVENT_PHASE_SAMPLE, category_group, name, 0, thread_id, timestamp, \
-      TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val, arg2_name, arg2_val)
-
 #define TRACE_EVENT_SAMPLE_WITH_ID1(category_group, name, id, arg1_name,       \
                                     arg1_val)                                  \
   INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_SAMPLE, category_group,   \
@@ -823,6 +802,12 @@
   INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP(                          \
       TRACE_EVENT_PHASE_NESTABLE_ASYNC_BEGIN, category_group, name, id,        \
       TRACE_EVENT_API_CURRENT_THREAD_ID, timestamp, TRACE_EVENT_FLAG_NONE)
+#define TRACE_EVENT_NESTABLE_ASYNC_BEGIN_WITH_TIMESTAMP1(                  \
+    category_group, name, id, timestamp, arg1_name, arg1_val)              \
+  INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP(                      \
+      TRACE_EVENT_PHASE_NESTABLE_ASYNC_BEGIN, category_group, name, id,    \
+      TRACE_EVENT_API_CURRENT_THREAD_ID, timestamp, TRACE_EVENT_FLAG_NONE, \
+      arg1_name, arg1_val)
 #define TRACE_EVENT_NESTABLE_ASYNC_END_WITH_TIMESTAMP0(category_group, name, \
                                                        id, timestamp)        \
   INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP(                        \
@@ -834,6 +819,13 @@
       TRACE_EVENT_PHASE_NESTABLE_ASYNC_END, category_group, name, id,      \
       TRACE_EVENT_API_CURRENT_THREAD_ID, timestamp, TRACE_EVENT_FLAG_NONE, \
       arg1_name, arg1_val)
+#define TRACE_EVENT_NESTABLE_ASYNC_END_WITH_TIMESTAMP2(                    \
+    category_group, name, id, timestamp, arg1_name, arg1_val, arg2_name,   \
+    arg2_val)                                                              \
+  INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP(                      \
+      TRACE_EVENT_PHASE_NESTABLE_ASYNC_END, category_group, name, id,      \
+      TRACE_EVENT_API_CURRENT_THREAD_ID, timestamp, TRACE_EVENT_FLAG_NONE, \
+      arg1_name, arg1_val, arg2_name, arg2_val)
 #define TRACE_EVENT_NESTABLE_ASYNC_INSTANT_WITH_TIMESTAMP0(               \
     category_group, name, id, timestamp)                                  \
   INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP(                     \
@@ -849,6 +841,11 @@
   INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP(                 \
       TRACE_EVENT_PHASE_NESTABLE_ASYNC_END, category_group, name, id, \
       TRACE_EVENT_API_CURRENT_THREAD_ID, timestamp, TRACE_EVENT_FLAG_COPY)
+#define TRACE_EVENT_COPY_NESTABLE_ASYNC_END1(category_group, name, id,   \
+                                             arg1_name, arg1_val)        \
+  INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_NESTABLE_ASYNC_END, \
+                                   category_group, name, id,             \
+                                   TRACE_EVENT_FLAG_COPY, arg1_name, arg1_val)
 
 // Records a single FLOW_BEGIN event called "name" immediately, with 0, 1 or 2
 // associated arguments. If the category is not enabled, then this
@@ -1079,25 +1076,22 @@
 #define TRACE_EVENT_PHASE_CLOCK_SYNC ('c')
 #define TRACE_EVENT_PHASE_ENTER_CONTEXT ('(')
 #define TRACE_EVENT_PHASE_LEAVE_CONTEXT (')')
-#define TRACE_EVENT_PHASE_LINK_IDS ('=')
 
 // Flags for changing the behavior of TRACE_EVENT_API_ADD_TRACE_EVENT.
 #define TRACE_EVENT_FLAG_NONE (static_cast<unsigned int>(0))
 #define TRACE_EVENT_FLAG_COPY (static_cast<unsigned int>(1 << 0))
 #define TRACE_EVENT_FLAG_HAS_ID (static_cast<unsigned int>(1 << 1))
-// TODO(crbug.com/639003): Free this bit after ID mangling is deprecated.
-#define TRACE_EVENT_FLAG_MANGLE_ID (static_cast<unsigned int>(1 << 2))
-#define TRACE_EVENT_FLAG_SCOPE_OFFSET (static_cast<unsigned int>(1 << 3))
-#define TRACE_EVENT_FLAG_SCOPE_EXTRA (static_cast<unsigned int>(1 << 4))
-#define TRACE_EVENT_FLAG_EXPLICIT_TIMESTAMP (static_cast<unsigned int>(1 << 5))
-#define TRACE_EVENT_FLAG_ASYNC_TTS (static_cast<unsigned int>(1 << 6))
-#define TRACE_EVENT_FLAG_BIND_TO_ENCLOSING (static_cast<unsigned int>(1 << 7))
-#define TRACE_EVENT_FLAG_FLOW_IN (static_cast<unsigned int>(1 << 8))
-#define TRACE_EVENT_FLAG_FLOW_OUT (static_cast<unsigned int>(1 << 9))
-#define TRACE_EVENT_FLAG_HAS_CONTEXT_ID (static_cast<unsigned int>(1 << 10))
-#define TRACE_EVENT_FLAG_HAS_PROCESS_ID (static_cast<unsigned int>(1 << 11))
-#define TRACE_EVENT_FLAG_HAS_LOCAL_ID (static_cast<unsigned int>(1 << 12))
-#define TRACE_EVENT_FLAG_HAS_GLOBAL_ID (static_cast<unsigned int>(1 << 13))
+#define TRACE_EVENT_FLAG_SCOPE_OFFSET (static_cast<unsigned int>(1 << 2))
+#define TRACE_EVENT_FLAG_SCOPE_EXTRA (static_cast<unsigned int>(1 << 3))
+#define TRACE_EVENT_FLAG_EXPLICIT_TIMESTAMP (static_cast<unsigned int>(1 << 4))
+#define TRACE_EVENT_FLAG_ASYNC_TTS (static_cast<unsigned int>(1 << 5))
+#define TRACE_EVENT_FLAG_BIND_TO_ENCLOSING (static_cast<unsigned int>(1 << 6))
+#define TRACE_EVENT_FLAG_FLOW_IN (static_cast<unsigned int>(1 << 7))
+#define TRACE_EVENT_FLAG_FLOW_OUT (static_cast<unsigned int>(1 << 8))
+#define TRACE_EVENT_FLAG_HAS_CONTEXT_ID (static_cast<unsigned int>(1 << 9))
+#define TRACE_EVENT_FLAG_HAS_PROCESS_ID (static_cast<unsigned int>(1 << 10))
+#define TRACE_EVENT_FLAG_HAS_LOCAL_ID (static_cast<unsigned int>(1 << 11))
+#define TRACE_EVENT_FLAG_HAS_GLOBAL_ID (static_cast<unsigned int>(1 << 12))
 // TODO(eseckler): Remove once we have native support for typed proto events in
 // TRACE_EVENT macros.
 #define TRACE_EVENT_FLAG_TYPED_PROTO_ARGS (static_cast<unsigned int>(1 << 15))
@@ -1120,9 +1114,9 @@
 
 // Enum reflecting the scope of an INSTANT event. Must fit within
 // TRACE_EVENT_FLAG_SCOPE_MASK.
-#define TRACE_EVENT_SCOPE_GLOBAL (static_cast<unsigned char>(0 << 3))
-#define TRACE_EVENT_SCOPE_PROCESS (static_cast<unsigned char>(1 << 3))
-#define TRACE_EVENT_SCOPE_THREAD (static_cast<unsigned char>(2 << 3))
+#define TRACE_EVENT_SCOPE_GLOBAL (static_cast<unsigned char>(0 << 2))
+#define TRACE_EVENT_SCOPE_PROCESS (static_cast<unsigned char>(1 << 2))
+#define TRACE_EVENT_SCOPE_THREAD (static_cast<unsigned char>(2 << 2))
 
 #define TRACE_EVENT_SCOPE_NAME_GLOBAL ('g')
 #define TRACE_EVENT_SCOPE_NAME_PROCESS ('p')
diff --git a/deps/v8/benchmarks/OWNERS b/deps/v8/benchmarks/OWNERS
deleted file mode 100644
index 3c70cea2fd5e6a..00000000000000
--- a/deps/v8/benchmarks/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-file:../COMMON_OWNERS
diff --git a/deps/v8/benchmarks/README.txt b/deps/v8/benchmarks/README.txt
deleted file mode 100644
index 59f76ffc81d2b4..00000000000000
--- a/deps/v8/benchmarks/README.txt
+++ /dev/null
@@ -1,86 +0,0 @@
-V8 Benchmark Suite
-==================
-
-This is the V8 benchmark suite: A collection of pure JavaScript
-benchmarks that we have used to tune V8. The licenses for the
-individual benchmarks are included in the JavaScript files.
-
-In addition to the benchmarks, the suite consists of the benchmark
-framework (base.js), which must be loaded before any of the individual
-benchmark files, and two benchmark runners: An HTML version (run.html)
-and a standalone JavaScript version (run.js).
-
-
-Changes From Version 1 To Version 2
-===================================
-
-For version 2 the crypto benchmark was fixed.  Previously, the
-decryption stage was given plaintext as input, which resulted in an
-error.  Now, the decryption stage is given the output of the
-encryption stage as input.  The result is checked against the original
-plaintext.  For this to give the correct results the crypto objects
-are reset for each iteration of the benchmark.  In addition, the size
-of the plain text has been increased a little and the use of
-Math.random() and new Date() to build an RNG pool has been removed.
-
-Other benchmarks were fixed to do elementary verification of the
-results of their calculations.  This is to avoid accidentally
-obtaining scores that are the result of an incorrect JavaScript engine
-optimization.
-
-
-Changes From Version 2 To Version 3
-===================================
-
-Version 3 adds a new benchmark, RegExp.  The RegExp benchmark is
-generated by loading 50 of the most popular pages on the web and
-logging all regexp operations performed.  Each operation is given a
-weight that is calculated from an estimate of the popularity of the
-pages where it occurs and the number of times it is executed while
-loading each page.  Finally the literal letters in the data are
-encoded using ROT13 in a way that does not affect how the regexps
-match their input.
-
-
-Changes from Version 3 to Version 4
-===================================
-
-The Splay benchmark is a newcomer in version 4.  It manipulates a
-splay tree by adding and removing data nodes, thus exercising the
-memory management subsystem of the JavaScript engine.
-
-Furthermore, all the unused parts of the Prototype library were
-removed from the RayTrace benchmark. This does not affect the running
-of the benchmark.
-
-
-Changes from Version 4 to Version 5
-===================================
-
-Removed duplicate line in random seed code, and changed the name of
-the Object.prototype.inherits function in the DeltaBlue benchmark to
-inheritsFrom to avoid name clashes when running in Chromium with
-extensions enabled.
-
-
-Changes from Version 5 to Version 6
-===================================
-
-Removed dead code from the RayTrace benchmark and fixed a couple of
-typos in the DeltaBlue implementation. Changed the Splay benchmark to
-avoid converting the same numeric key to a string over and over again
-and to avoid inserting and removing the same element repeatedly thus
-increasing pressure on the memory subsystem. Changed the RegExp
-benchmark to exercise the regular expression engine on different
-input strings.
-
-Furthermore, the benchmark runner was changed to run the benchmarks
-for at least a few times to stabilize the reported numbers on slower
-machines.
-
-
-Changes from Version 6 to Version 7
-===================================
-
-Added the Navier-Stokes benchmark, a 2D differential equation solver
-that stresses arithmetic computations on double arrays.
diff --git a/deps/v8/benchmarks/base.js b/deps/v8/benchmarks/base.js
deleted file mode 100644
index f84c6d84f74e9c..00000000000000
--- a/deps/v8/benchmarks/base.js
+++ /dev/null
@@ -1,285 +0,0 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-// Simple framework for running the benchmark suites and
-// computing a score based on the timing measurements.
-
-
-// A benchmark has a name (string) and a function that will be run to
-// do the performance measurement. The optional setup and tearDown
-// arguments are functions that will be invoked before and after
-// running the benchmark, but the running time of these functions will
-// not be accounted for in the benchmark score.
-function Benchmark(name, run, setup, tearDown) {
-  this.name = name;
-  this.run = run;
-  this.Setup = setup ? setup : function() { };
-  this.TearDown = tearDown ? tearDown : function() { };
-}
-
-
-// Benchmark results hold the benchmark and the measured time used to
-// run the benchmark. The benchmark score is computed later once a
-// full benchmark suite has run to completion.
-function BenchmarkResult(benchmark, time) {
-  this.benchmark = benchmark;
-  this.time = time;
-}
-
-
-// Automatically convert results to numbers. Used by the geometric
-// mean computation.
-BenchmarkResult.prototype.valueOf = function() {
-  return this.time;
-}
-
-
-// Suites of benchmarks consist of a name and the set of benchmarks in
-// addition to the reference timing that the final score will be based
-// on. This way, all scores are relative to a reference run and higher
-// scores implies better performance.
-function BenchmarkSuite(name, reference, benchmarks) {
-  this.name = name;
-  this.reference = reference;
-  this.benchmarks = benchmarks;
-  BenchmarkSuite.suites.push(this);
-}
-
-
-// Keep track of all declared benchmark suites.
-BenchmarkSuite.suites = [];
-
-
-// Scores are not comparable across versions. Bump the version if
-// you're making changes that will affect that scores, e.g. if you add
-// a new benchmark or change an existing one.
-BenchmarkSuite.version = '7';
-
-
-// To make the benchmark results predictable, we replace Math.random
-// with a 100% deterministic alternative.
-Math.random = (function() {
-  var seed = 49734321;
-  return function() {
-    // Robert Jenkins' 32 bit integer hash function.
-    seed = seed & 0xffffffff;
-    seed = ((seed + 0x7ed55d16) + (seed << 12))  & 0xffffffff;
-    seed = ((seed ^ 0xc761c23c) ^ (seed >>> 19)) & 0xffffffff;
-    seed = ((seed + 0x165667b1) + (seed << 5))   & 0xffffffff;
-    seed = ((seed + 0xd3a2646c) ^ (seed << 9))   & 0xffffffff;
-    seed = ((seed + 0xfd7046c5) + (seed << 3))   & 0xffffffff;
-    seed = ((seed ^ 0xb55a4f09) ^ (seed >>> 16)) & 0xffffffff;
-    return (seed & 0xfffffff) / 0x10000000;
-  };
-})();
-
-
-// Runs all registered benchmark suites and optionally yields between
-// each individual benchmark to avoid running for too long in the
-// context of browsers. Once done, the final score is reported to the
-// runner.
-BenchmarkSuite.RunSuites = function(runner) {
-  var continuation = null;
-  var suites = BenchmarkSuite.suites;
-  var length = suites.length;
-  BenchmarkSuite.scores = [];
-  var index = 0;
-  function RunStep() {
-    while (continuation || index < length) {
-      if (continuation) {
-        continuation = continuation();
-      } else {
-        var suite = suites[index++];
-        if (runner.NotifyStart) runner.NotifyStart(suite.name);
-        continuation = suite.RunStep(runner);
-      }
-      if (continuation && typeof window != 'undefined' && window.setTimeout) {
-        window.setTimeout(RunStep, 25);
-        return;
-      }
-    }
-    if (runner.NotifyScore) {
-      var score = BenchmarkSuite.GeometricMean(BenchmarkSuite.scores);
-      var formatted = BenchmarkSuite.FormatScore(100 * score);
-      runner.NotifyScore(formatted);
-    }
-  }
-  RunStep();
-}
-
-
-// Counts the total number of registered benchmarks. Useful for
-// showing progress as a percentage.
-BenchmarkSuite.CountBenchmarks = function() {
-  var result = 0;
-  var suites = BenchmarkSuite.suites;
-  for (var i = 0; i < suites.length; i++) {
-    result += suites[i].benchmarks.length;
-  }
-  return result;
-}
-
-
-// Computes the geometric mean of a set of numbers.
-BenchmarkSuite.GeometricMean = function(numbers) {
-  var log = 0;
-  for (var i = 0; i < numbers.length; i++) {
-    log += Math.log(numbers[i]);
-  }
-  return Math.pow(Math.E, log / numbers.length);
-}
-
-
-// Converts a score value to a string with at least three significant
-// digits.
-BenchmarkSuite.FormatScore = function(value) {
-  if (value > 100) {
-    return value.toFixed(0);
-  } else {
-    return value.toPrecision(3);
-  }
-}
-
-// Notifies the runner that we're done running a single benchmark in
-// the benchmark suite. This can be useful to report progress.
-BenchmarkSuite.prototype.NotifyStep = function(result) {
-  this.results.push(result);
-  if (this.runner.NotifyStep) this.runner.NotifyStep(result.benchmark.name);
-}
-
-
-// Notifies the runner that we're done with running a suite and that
-// we have a result which can be reported to the user if needed.
-BenchmarkSuite.prototype.NotifyResult = function() {
-  var mean = BenchmarkSuite.GeometricMean(this.results);
-  var score = this.reference / mean;
-  BenchmarkSuite.scores.push(score);
-  if (this.runner.NotifyResult) {
-    var formatted = BenchmarkSuite.FormatScore(100 * score);
-    this.runner.NotifyResult(this.name, formatted);
-  }
-}
-
-
-// Notifies the runner that running a benchmark resulted in an error.
-BenchmarkSuite.prototype.NotifyError = function(error) {
-  if (this.runner.NotifyError) {
-    this.runner.NotifyError(this.name, error);
-  }
-  if (this.runner.NotifyStep) {
-    this.runner.NotifyStep(this.name);
-  }
-}
-
-
-// Runs a single benchmark for at least a second and computes the
-// average time it takes to run a single iteration.
-BenchmarkSuite.prototype.RunSingleBenchmark = function(benchmark, data) {
-  function Measure(data) {
-    var elapsed = 0;
-    var start = new Date();
-    for (var n = 0; elapsed < 1000; n++) {
-      benchmark.run();
-      elapsed = new Date() - start;
-    }
-    if (data != null) {
-      data.runs += n;
-      data.elapsed += elapsed;
-    }
-  }
-
-  if (data == null) {
-    // Measure the benchmark once for warm up and throw the result
-    // away. Return a fresh data object.
-    Measure(null);
-    return { runs: 0, elapsed: 0 };
-  } else {
-    Measure(data);
-    // If we've run too few iterations, we continue for another second.
-    if (data.runs < 32) return data;
-    var usec = (data.elapsed * 1000) / data.runs;
-    this.NotifyStep(new BenchmarkResult(benchmark, usec));
-    return null;
-  }
-}
-
-
-// This function starts running a suite, but stops between each
-// individual benchmark in the suite and returns a continuation
-// function which can be invoked to run the next benchmark. Once the
-// last benchmark has been executed, null is returned.
-BenchmarkSuite.prototype.RunStep = function(runner) {
-  this.results = [];
-  this.runner = runner;
-  var length = this.benchmarks.length;
-  var index = 0;
-  var suite = this;
-  var data;
-
-  // Run the setup, the actual benchmark, and the tear down in three
-  // separate steps to allow the framework to yield between any of the
-  // steps.
-
-  function RunNextSetup() {
-    if (index < length) {
-      try {
-        suite.benchmarks[index].Setup();
-      } catch (e) {
-        suite.NotifyError(e);
-        return null;
-      }
-      return RunNextBenchmark;
-    }
-    suite.NotifyResult();
-    return null;
-  }
-
-  function RunNextBenchmark() {
-    try {
-      data = suite.RunSingleBenchmark(suite.benchmarks[index], data);
-    } catch (e) {
-      suite.NotifyError(e);
-      return null;
-    }
-    // If data is null, we're done with this benchmark.
-    return (data == null) ? RunNextTearDown : RunNextBenchmark();
-  }
-
-  function RunNextTearDown() {
-    try {
-      suite.benchmarks[index++].TearDown();
-    } catch (e) {
-      suite.NotifyError(e);
-      return null;
-    }
-    return RunNextSetup;
-  }
-
-  // Start out running the setup.
-  return RunNextSetup();
-}
diff --git a/deps/v8/benchmarks/crypto.js b/deps/v8/benchmarks/crypto.js
deleted file mode 100644
index 531ad456e02749..00000000000000
--- a/deps/v8/benchmarks/crypto.js
+++ /dev/null
@@ -1,1698 +0,0 @@
-/*
- * Copyright (c) 2003-2005  Tom Wu
- * All Rights Reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
- * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
- *
- * IN NO EVENT SHALL TOM WU BE LIABLE FOR ANY SPECIAL, INCIDENTAL,
- * INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, OR ANY DAMAGES WHATSOEVER
- * RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER OR NOT ADVISED OF
- * THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF LIABILITY, ARISING OUT
- * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * In addition, the following condition applies:
- *
- * All redistributions must retain an intact copy of this copyright notice
- * and disclaimer.
- */
-
-
-// The code has been adapted for use as a benchmark by Google.
-var Crypto = new BenchmarkSuite('Crypto', 266181, [
-  new Benchmark("Encrypt", encrypt),
-  new Benchmark("Decrypt", decrypt)
-]);
-
-
-// Basic JavaScript BN library - subset useful for RSA encryption.
-
-// Bits per digit
-var dbits;
-var BI_DB;
-var BI_DM;
-var BI_DV;
-
-var BI_FP;
-var BI_FV;
-var BI_F1;
-var BI_F2;
-
-// JavaScript engine analysis
-var canary = 0xdeadbeefcafe;
-var j_lm = ((canary&0xffffff)==0xefcafe);
-
-// (public) Constructor
-function BigInteger(a,b,c) {
-  this.array = new Array();
-  if(a != null)
-    if("number" == typeof a) this.fromNumber(a,b,c);
-    else if(b == null && "string" != typeof a) this.fromString(a,256);
-    else this.fromString(a,b);
-}
-
-// return new, unset BigInteger
-function nbi() { return new BigInteger(null); }
-
-// am: Compute w_j += (x*this_i), propagate carries,
-// c is initial carry, returns final carry.
-// c < 3*dvalue, x < 2*dvalue, this_i < dvalue
-// We need to select the fastest one that works in this environment.
-
-// am1: use a single mult and divide to get the high bits,
-// max digit bits should be 26 because
-// max internal value = 2*dvalue^2-2*dvalue (< 2^53)
-function am1(i,x,w,j,c,n) {
-  var this_array = this.array;
-  var w_array    = w.array;
-  while(--n >= 0) {
-    var v = x*this_array[i++]+w_array[j]+c;
-    c = Math.floor(v/0x4000000);
-    w_array[j++] = v&0x3ffffff;
-  }
-  return c;
-}
-
-// am2 avoids a big mult-and-extract completely.
-// Max digit bits should be <= 30 because we do bitwise ops
-// on values up to 2*hdvalue^2-hdvalue-1 (< 2^31)
-function am2(i,x,w,j,c,n) {
-  var this_array = this.array;
-  var w_array    = w.array;
-  var xl = x&0x7fff, xh = x>>15;
-  while(--n >= 0) {
-    var l = this_array[i]&0x7fff;
-    var h = this_array[i++]>>15;
-    var m = xh*l+h*xl;
-    l = xl*l+((m&0x7fff)<<15)+w_array[j]+(c&0x3fffffff);
-    c = (l>>>30)+(m>>>15)+xh*h+(c>>>30);
-    w_array[j++] = l&0x3fffffff;
-  }
-  return c;
-}
-
-// Alternately, set max digit bits to 28 since some
-// browsers slow down when dealing with 32-bit numbers.
-function am3(i,x,w,j,c,n) {
-  var this_array = this.array;
-  var w_array    = w.array;
-
-  var xl = x&0x3fff, xh = x>>14;
-  while(--n >= 0) {
-    var l = this_array[i]&0x3fff;
-    var h = this_array[i++]>>14;
-    var m = xh*l+h*xl;
-    l = xl*l+((m&0x3fff)<<14)+w_array[j]+c;
-    c = (l>>28)+(m>>14)+xh*h;
-    w_array[j++] = l&0xfffffff;
-  }
-  return c;
-}
-
-// This is tailored to VMs with 2-bit tagging. It makes sure
-// that all the computations stay within the 29 bits available.
-function am4(i,x,w,j,c,n) {
-  var this_array = this.array;
-  var w_array    = w.array;
-
-  var xl = x&0x1fff, xh = x>>13;
-  while(--n >= 0) {
-    var l = this_array[i]&0x1fff;
-    var h = this_array[i++]>>13;
-    var m = xh*l+h*xl;
-    l = xl*l+((m&0x1fff)<<13)+w_array[j]+c;
-    c = (l>>26)+(m>>13)+xh*h;
-    w_array[j++] = l&0x3ffffff;
-  }
-  return c;
-}
-
-// am3/28 is best for SM, Rhino, but am4/26 is best for v8.
-// Kestrel (Opera 9.5) gets its best result with am4/26.
-// IE7 does 9% better with am3/28 than with am4/26.
-// Firefox (SM) gets 10% faster with am3/28 than with am4/26.
-
-setupEngine = function(fn, bits) {
-  BigInteger.prototype.am = fn;
-  dbits = bits;
-
-  BI_DB = dbits;
-  BI_DM = ((1<<dbits)-1);
-  BI_DV = (1<<dbits);
-
-  BI_FP = 52;
-  BI_FV = Math.pow(2,BI_FP);
-  BI_F1 = BI_FP-dbits;
-  BI_F2 = 2*dbits-BI_FP;
-}
-
-
-// Digit conversions
-var BI_RM = "0123456789abcdefghijklmnopqrstuvwxyz";
-var BI_RC = new Array();
-var rr,vv;
-rr = "0".charCodeAt(0);
-for(vv = 0; vv <= 9; ++vv) BI_RC[rr++] = vv;
-rr = "a".charCodeAt(0);
-for(vv = 10; vv < 36; ++vv) BI_RC[rr++] = vv;
-rr = "A".charCodeAt(0);
-for(vv = 10; vv < 36; ++vv) BI_RC[rr++] = vv;
-
-function int2char(n) { return BI_RM.charAt(n); }
-function intAt(s,i) {
-  var c = BI_RC[s.charCodeAt(i)];
-  return (c==null)?-1:c;
-}
-
-// (protected) copy this to r
-function bnpCopyTo(r) {
-  var this_array = this.array;
-  var r_array    = r.array;
-
-  for(var i = this.t-1; i >= 0; --i) r_array[i] = this_array[i];
-  r.t = this.t;
-  r.s = this.s;
-}
-
-// (protected) set from integer value x, -DV <= x < DV
-function bnpFromInt(x) {
-  var this_array = this.array;
-  this.t = 1;
-  this.s = (x<0)?-1:0;
-  if(x > 0) this_array[0] = x;
-  else if(x < -1) this_array[0] = x+DV;
-  else this.t = 0;
-}
-
-// return bigint initialized to value
-function nbv(i) { var r = nbi(); r.fromInt(i); return r; }
-
-// (protected) set from string and radix
-function bnpFromString(s,b) {
-  var this_array = this.array;
-  var k;
-  if(b == 16) k = 4;
-  else if(b == 8) k = 3;
-  else if(b == 256) k = 8; // byte array
-  else if(b == 2) k = 1;
-  else if(b == 32) k = 5;
-  else if(b == 4) k = 2;
-  else { this.fromRadix(s,b); return; }
-  this.t = 0;
-  this.s = 0;
-  var i = s.length, mi = false, sh = 0;
-  while(--i >= 0) {
-    var x = (k==8)?s[i]&0xff:intAt(s,i);
-    if(x < 0) {
-      if(s.charAt(i) == "-") mi = true;
-      continue;
-    }
-    mi = false;
-    if(sh == 0)
-      this_array[this.t++] = x;
-    else if(sh+k > BI_DB) {
-      this_array[this.t-1] |= (x&((1<<(BI_DB-sh))-1))<<sh;
-      this_array[this.t++] = (x>>(BI_DB-sh));
-    }
-    else
-      this_array[this.t-1] |= x<<sh;
-    sh += k;
-    if(sh >= BI_DB) sh -= BI_DB;
-  }
-  if(k == 8 && (s[0]&0x80) != 0) {
-    this.s = -1;
-    if(sh > 0) this_array[this.t-1] |= ((1<<(BI_DB-sh))-1)<<sh;
-  }
-  this.clamp();
-  if(mi) BigInteger.ZERO.subTo(this,this);
-}
-
-// (protected) clamp off excess high words
-function bnpClamp() {
-  var this_array = this.array;
-  var c = this.s&BI_DM;
-  while(this.t > 0 && this_array[this.t-1] == c) --this.t;
-}
-
-// (public) return string representation in given radix
-function bnToString(b) {
-  var this_array = this.array;
-  if(this.s < 0) return "-"+this.negate().toString(b);
-  var k;
-  if(b == 16) k = 4;
-  else if(b == 8) k = 3;
-  else if(b == 2) k = 1;
-  else if(b == 32) k = 5;
-  else if(b == 4) k = 2;
-  else return this.toRadix(b);
-  var km = (1<<k)-1, d, m = false, r = "", i = this.t;
-  var p = BI_DB-(i*BI_DB)%k;
-  if(i-- > 0) {
-    if(p < BI_DB && (d = this_array[i]>>p) > 0) { m = true; r = int2char(d); }
-    while(i >= 0) {
-      if(p < k) {
-        d = (this_array[i]&((1<<p)-1))<<(k-p);
-        d |= this_array[--i]>>(p+=BI_DB-k);
-      }
-      else {
-        d = (this_array[i]>>(p-=k))&km;
-        if(p <= 0) { p += BI_DB; --i; }
-      }
-      if(d > 0) m = true;
-      if(m) r += int2char(d);
-    }
-  }
-  return m?r:"0";
-}
-
-// (public) -this
-function bnNegate() { var r = nbi(); BigInteger.ZERO.subTo(this,r); return r; }
-
-// (public) |this|
-function bnAbs() { return (this.s<0)?this.negate():this; }
-
-// (public) return + if this > a, - if this < a, 0 if equal
-function bnCompareTo(a) {
-  var this_array = this.array;
-  var a_array = a.array;
-
-  var r = this.s-a.s;
-  if(r != 0) return r;
-  var i = this.t;
-  r = i-a.t;
-  if(r != 0) return r;
-  while(--i >= 0) if((r=this_array[i]-a_array[i]) != 0) return r;
-  return 0;
-}
-
-// returns bit length of the integer x
-function nbits(x) {
-  var r = 1, t;
-  if((t=x>>>16) != 0) { x = t; r += 16; }
-  if((t=x>>8) != 0) { x = t; r += 8; }
-  if((t=x>>4) != 0) { x = t; r += 4; }
-  if((t=x>>2) != 0) { x = t; r += 2; }
-  if((t=x>>1) != 0) { x = t; r += 1; }
-  return r;
-}
-
-// (public) return the number of bits in "this"
-function bnBitLength() {
-  var this_array = this.array;
-  if(this.t <= 0) return 0;
-  return BI_DB*(this.t-1)+nbits(this_array[this.t-1]^(this.s&BI_DM));
-}
-
-// (protected) r = this << n*DB
-function bnpDLShiftTo(n,r) {
-  var this_array = this.array;
-  var r_array = r.array;
-  var i;
-  for(i = this.t-1; i >= 0; --i) r_array[i+n] = this_array[i];
-  for(i = n-1; i >= 0; --i) r_array[i] = 0;
-  r.t = this.t+n;
-  r.s = this.s;
-}
-
-// (protected) r = this >> n*DB
-function bnpDRShiftTo(n,r) {
-  var this_array = this.array;
-  var r_array = r.array;
-  for(var i = n; i < this.t; ++i) r_array[i-n] = this_array[i];
-  r.t = Math.max(this.t-n,0);
-  r.s = this.s;
-}
-
-// (protected) r = this << n
-function bnpLShiftTo(n,r) {
-  var this_array = this.array;
-  var r_array = r.array;
-  var bs = n%BI_DB;
-  var cbs = BI_DB-bs;
-  var bm = (1<<cbs)-1;
-  var ds = Math.floor(n/BI_DB), c = (this.s<<bs)&BI_DM, i;
-  for(i = this.t-1; i >= 0; --i) {
-    r_array[i+ds+1] = (this_array[i]>>cbs)|c;
-    c = (this_array[i]&bm)<<bs;
-  }
-  for(i = ds-1; i >= 0; --i) r_array[i] = 0;
-  r_array[ds] = c;
-  r.t = this.t+ds+1;
-  r.s = this.s;
-  r.clamp();
-}
-
-// (protected) r = this >> n
-function bnpRShiftTo(n,r) {
-  var this_array = this.array;
-  var r_array = r.array;
-  r.s = this.s;
-  var ds = Math.floor(n/BI_DB);
-  if(ds >= this.t) { r.t = 0; return; }
-  var bs = n%BI_DB;
-  var cbs = BI_DB-bs;
-  var bm = (1<<bs)-1;
-  r_array[0] = this_array[ds]>>bs;
-  for(var i = ds+1; i < this.t; ++i) {
-    r_array[i-ds-1] |= (this_array[i]&bm)<<cbs;
-    r_array[i-ds] = this_array[i]>>bs;
-  }
-  if(bs > 0) r_array[this.t-ds-1] |= (this.s&bm)<<cbs;
-  r.t = this.t-ds;
-  r.clamp();
-}
-
-// (protected) r = this - a
-function bnpSubTo(a,r) {
-  var this_array = this.array;
-  var r_array = r.array;
-  var a_array = a.array;
-  var i = 0, c = 0, m = Math.min(a.t,this.t);
-  while(i < m) {
-    c += this_array[i]-a_array[i];
-    r_array[i++] = c&BI_DM;
-    c >>= BI_DB;
-  }
-  if(a.t < this.t) {
-    c -= a.s;
-    while(i < this.t) {
-      c += this_array[i];
-      r_array[i++] = c&BI_DM;
-      c >>= BI_DB;
-    }
-    c += this.s;
-  }
-  else {
-    c += this.s;
-    while(i < a.t) {
-      c -= a_array[i];
-      r_array[i++] = c&BI_DM;
-      c >>= BI_DB;
-    }
-    c -= a.s;
-  }
-  r.s = (c<0)?-1:0;
-  if(c < -1) r_array[i++] = BI_DV+c;
-  else if(c > 0) r_array[i++] = c;
-  r.t = i;
-  r.clamp();
-}
-
-// (protected) r = this * a, r != this,a (HAC 14.12)
-// "this" should be the larger one if appropriate.
-function bnpMultiplyTo(a,r) {
-  var this_array = this.array;
-  var r_array = r.array;
-  var x = this.abs(), y = a.abs();
-  var y_array = y.array;
-
-  var i = x.t;
-  r.t = i+y.t;
-  while(--i >= 0) r_array[i] = 0;
-  for(i = 0; i < y.t; ++i) r_array[i+x.t] = x.am(0,y_array[i],r,i,0,x.t);
-  r.s = 0;
-  r.clamp();
-  if(this.s != a.s) BigInteger.ZERO.subTo(r,r);
-}
-
-// (protected) r = this^2, r != this (HAC 14.16)
-function bnpSquareTo(r) {
-  var x = this.abs();
-  var x_array = x.array;
-  var r_array = r.array;
-
-  var i = r.t = 2*x.t;
-  while(--i >= 0) r_array[i] = 0;
-  for(i = 0; i < x.t-1; ++i) {
-    var c = x.am(i,x_array[i],r,2*i,0,1);
-    if((r_array[i+x.t]+=x.am(i+1,2*x_array[i],r,2*i+1,c,x.t-i-1)) >= BI_DV) {
-      r_array[i+x.t] -= BI_DV;
-      r_array[i+x.t+1] = 1;
-    }
-  }
-  if(r.t > 0) r_array[r.t-1] += x.am(i,x_array[i],r,2*i,0,1);
-  r.s = 0;
-  r.clamp();
-}
-
-// (protected) divide this by m, quotient and remainder to q, r (HAC 14.20)
-// r != q, this != m.  q or r may be null.
-function bnpDivRemTo(m,q,r) {
-  var pm = m.abs();
-  if(pm.t <= 0) return;
-  var pt = this.abs();
-  if(pt.t < pm.t) {
-    if(q != null) q.fromInt(0);
-    if(r != null) this.copyTo(r);
-    return;
-  }
-  if(r == null) r = nbi();
-  var y = nbi(), ts = this.s, ms = m.s;
-  var pm_array = pm.array;
-  var nsh = BI_DB-nbits(pm_array[pm.t-1]);	// normalize modulus
-  if(nsh > 0) { pm.lShiftTo(nsh,y); pt.lShiftTo(nsh,r); }
-  else { pm.copyTo(y); pt.copyTo(r); }
-  var ys = y.t;
-
-  var y_array = y.array;
-  var y0 = y_array[ys-1];
-  if(y0 == 0) return;
-  var yt = y0*(1<<BI_F1)+((ys>1)?y_array[ys-2]>>BI_F2:0);
-  var d1 = BI_FV/yt, d2 = (1<<BI_F1)/yt, e = 1<<BI_F2;
-  var i = r.t, j = i-ys, t = (q==null)?nbi():q;
-  y.dlShiftTo(j,t);
-
-  var r_array = r.array;
-  if(r.compareTo(t) >= 0) {
-    r_array[r.t++] = 1;
-    r.subTo(t,r);
-  }
-  BigInteger.ONE.dlShiftTo(ys,t);
-  t.subTo(y,y);	// "negative" y so we can replace sub with am later
-  while(y.t < ys) y_array[y.t++] = 0;
-  while(--j >= 0) {
-    // Estimate quotient digit
-    var qd = (r_array[--i]==y0)?BI_DM:Math.floor(r_array[i]*d1+(r_array[i-1]+e)*d2);
-    if((r_array[i]+=y.am(0,qd,r,j,0,ys)) < qd) {	// Try it out
-      y.dlShiftTo(j,t);
-      r.subTo(t,r);
-      while(r_array[i] < --qd) r.subTo(t,r);
-    }
-  }
-  if(q != null) {
-    r.drShiftTo(ys,q);
-    if(ts != ms) BigInteger.ZERO.subTo(q,q);
-  }
-  r.t = ys;
-  r.clamp();
-  if(nsh > 0) r.rShiftTo(nsh,r);	// Denormalize remainder
-  if(ts < 0) BigInteger.ZERO.subTo(r,r);
-}
-
-// (public) this mod a
-function bnMod(a) {
-  var r = nbi();
-  this.abs().divRemTo(a,null,r);
-  if(this.s < 0 && r.compareTo(BigInteger.ZERO) > 0) a.subTo(r,r);
-  return r;
-}
-
-// Modular reduction using "classic" algorithm
-function Classic(m) { this.m = m; }
-function cConvert(x) {
-  if(x.s < 0 || x.compareTo(this.m) >= 0) return x.mod(this.m);
-  else return x;
-}
-function cRevert(x) { return x; }
-function cReduce(x) { x.divRemTo(this.m,null,x); }
-function cMulTo(x,y,r) { x.multiplyTo(y,r); this.reduce(r); }
-function cSqrTo(x,r) { x.squareTo(r); this.reduce(r); }
-
-Classic.prototype.convert = cConvert;
-Classic.prototype.revert = cRevert;
-Classic.prototype.reduce = cReduce;
-Classic.prototype.mulTo = cMulTo;
-Classic.prototype.sqrTo = cSqrTo;
-
-// (protected) return "-1/this % 2^DB"; useful for Mont. reduction
-// justification:
-//         xy == 1 (mod m)
-//         xy =  1+km
-//   xy(2-xy) = (1+km)(1-km)
-// x[y(2-xy)] = 1-k^2m^2
-// x[y(2-xy)] == 1 (mod m^2)
-// if y is 1/x mod m, then y(2-xy) is 1/x mod m^2
-// should reduce x and y(2-xy) by m^2 at each step to keep size bounded.
-// JS multiply "overflows" differently from C/C++, so care is needed here.
-function bnpInvDigit() {
-  var this_array = this.array;
-  if(this.t < 1) return 0;
-  var x = this_array[0];
-  if((x&1) == 0) return 0;
-  var y = x&3;		// y == 1/x mod 2^2
-  y = (y*(2-(x&0xf)*y))&0xf;	// y == 1/x mod 2^4
-  y = (y*(2-(x&0xff)*y))&0xff;	// y == 1/x mod 2^8
-  y = (y*(2-(((x&0xffff)*y)&0xffff)))&0xffff;	// y == 1/x mod 2^16
-  // last step - calculate inverse mod DV directly;
-  // assumes 16 < DB <= 32 and assumes ability to handle 48-bit ints
-  y = (y*(2-x*y%BI_DV))%BI_DV;		// y == 1/x mod 2^dbits
-  // we really want the negative inverse, and -DV < y < DV
-  return (y>0)?BI_DV-y:-y;
-}
-
-// Montgomery reduction
-function Montgomery(m) {
-  this.m = m;
-  this.mp = m.invDigit();
-  this.mpl = this.mp&0x7fff;
-  this.mph = this.mp>>15;
-  this.um = (1<<(BI_DB-15))-1;
-  this.mt2 = 2*m.t;
-}
-
-// xR mod m
-function montConvert(x) {
-  var r = nbi();
-  x.abs().dlShiftTo(this.m.t,r);
-  r.divRemTo(this.m,null,r);
-  if(x.s < 0 && r.compareTo(BigInteger.ZERO) > 0) this.m.subTo(r,r);
-  return r;
-}
-
-// x/R mod m
-function montRevert(x) {
-  var r = nbi();
-  x.copyTo(r);
-  this.reduce(r);
-  return r;
-}
-
-// x = x/R mod m (HAC 14.32)
-function montReduce(x) {
-  var x_array = x.array;
-  while(x.t <= this.mt2)	// pad x so am has enough room later
-    x_array[x.t++] = 0;
-  for(var i = 0; i < this.m.t; ++i) {
-    // faster way of calculating u0 = x[i]*mp mod DV
-    var j = x_array[i]&0x7fff;
-    var u0 = (j*this.mpl+(((j*this.mph+(x_array[i]>>15)*this.mpl)&this.um)<<15))&BI_DM;
-    // use am to combine the multiply-shift-add into one call
-    j = i+this.m.t;
-    x_array[j] += this.m.am(0,u0,x,i,0,this.m.t);
-    // propagate carry
-    while(x_array[j] >= BI_DV) { x_array[j] -= BI_DV; x_array[++j]++; }
-  }
-  x.clamp();
-  x.drShiftTo(this.m.t,x);
-  if(x.compareTo(this.m) >= 0) x.subTo(this.m,x);
-}
-
-// r = "x^2/R mod m"; x != r
-function montSqrTo(x,r) { x.squareTo(r); this.reduce(r); }
-
-// r = "xy/R mod m"; x,y != r
-function montMulTo(x,y,r) { x.multiplyTo(y,r); this.reduce(r); }
-
-Montgomery.prototype.convert = montConvert;
-Montgomery.prototype.revert = montRevert;
-Montgomery.prototype.reduce = montReduce;
-Montgomery.prototype.mulTo = montMulTo;
-Montgomery.prototype.sqrTo = montSqrTo;
-
-// (protected) true iff this is even
-function bnpIsEven() {
-  var this_array = this.array;
-  return ((this.t>0)?(this_array[0]&1):this.s) == 0;
-}
-
-// (protected) this^e, e < 2^32, doing sqr and mul with "r" (HAC 14.79)
-function bnpExp(e,z) {
-  if(e > 0xffffffff || e < 1) return BigInteger.ONE;
-  var r = nbi(), r2 = nbi(), g = z.convert(this), i = nbits(e)-1;
-  g.copyTo(r);
-  while(--i >= 0) {
-    z.sqrTo(r,r2);
-    if((e&(1<<i)) > 0) z.mulTo(r2,g,r);
-    else { var t = r; r = r2; r2 = t; }
-  }
-  return z.revert(r);
-}
-
-// (public) this^e % m, 0 <= e < 2^32
-function bnModPowInt(e,m) {
-  var z;
-  if(e < 256 || m.isEven()) z = new Classic(m); else z = new Montgomery(m);
-  return this.exp(e,z);
-}
-
-// protected
-BigInteger.prototype.copyTo = bnpCopyTo;
-BigInteger.prototype.fromInt = bnpFromInt;
-BigInteger.prototype.fromString = bnpFromString;
-BigInteger.prototype.clamp = bnpClamp;
-BigInteger.prototype.dlShiftTo = bnpDLShiftTo;
-BigInteger.prototype.drShiftTo = bnpDRShiftTo;
-BigInteger.prototype.lShiftTo = bnpLShiftTo;
-BigInteger.prototype.rShiftTo = bnpRShiftTo;
-BigInteger.prototype.subTo = bnpSubTo;
-BigInteger.prototype.multiplyTo = bnpMultiplyTo;
-BigInteger.prototype.squareTo = bnpSquareTo;
-BigInteger.prototype.divRemTo = bnpDivRemTo;
-BigInteger.prototype.invDigit = bnpInvDigit;
-BigInteger.prototype.isEven = bnpIsEven;
-BigInteger.prototype.exp = bnpExp;
-
-// public
-BigInteger.prototype.toString = bnToString;
-BigInteger.prototype.negate = bnNegate;
-BigInteger.prototype.abs = bnAbs;
-BigInteger.prototype.compareTo = bnCompareTo;
-BigInteger.prototype.bitLength = bnBitLength;
-BigInteger.prototype.mod = bnMod;
-BigInteger.prototype.modPowInt = bnModPowInt;
-
-// "constants"
-BigInteger.ZERO = nbv(0);
-BigInteger.ONE = nbv(1);
-// Copyright (c) 2005  Tom Wu
-// All Rights Reserved.
-// See "LICENSE" for details.
-
-// Extended JavaScript BN functions, required for RSA private ops.
-
-// (public)
-function bnClone() { var r = nbi(); this.copyTo(r); return r; }
-
-// (public) return value as integer
-function bnIntValue() {
-  var this_array = this.array;
-  if(this.s < 0) {
-    if(this.t == 1) return this_array[0]-BI_DV;
-    else if(this.t == 0) return -1;
-  }
-  else if(this.t == 1) return this_array[0];
-  else if(this.t == 0) return 0;
-  // assumes 16 < DB < 32
-  return ((this_array[1]&((1<<(32-BI_DB))-1))<<BI_DB)|this_array[0];
-}
-
-// (public) return value as byte
-function bnByteValue() {
-  var this_array = this.array;
-  return (this.t==0)?this.s:(this_array[0]<<24)>>24;
-}
-
-// (public) return value as short (assumes DB>=16)
-function bnShortValue() {
-  var this_array = this.array;
-  return (this.t==0)?this.s:(this_array[0]<<16)>>16;
-}
-
-// (protected) return x s.t. r^x < DV
-function bnpChunkSize(r) { return Math.floor(Math.LN2*BI_DB/Math.log(r)); }
-
-// (public) 0 if this == 0, 1 if this > 0
-function bnSigNum() {
-  var this_array = this.array;
-  if(this.s < 0) return -1;
-  else if(this.t <= 0 || (this.t == 1 && this_array[0] <= 0)) return 0;
-  else return 1;
-}
-
-// (protected) convert to radix string
-function bnpToRadix(b) {
-  if(b == null) b = 10;
-  if(this.signum() == 0 || b < 2 || b > 36) return "0";
-  var cs = this.chunkSize(b);
-  var a = Math.pow(b,cs);
-  var d = nbv(a), y = nbi(), z = nbi(), r = "";
-  this.divRemTo(d,y,z);
-  while(y.signum() > 0) {
-    r = (a+z.intValue()).toString(b).substr(1) + r;
-    y.divRemTo(d,y,z);
-  }
-  return z.intValue().toString(b) + r;
-}
-
-// (protected) convert from radix string
-function bnpFromRadix(s,b) {
-  this.fromInt(0);
-  if(b == null) b = 10;
-  var cs = this.chunkSize(b);
-  var d = Math.pow(b,cs), mi = false, j = 0, w = 0;
-  for(var i = 0; i < s.length; ++i) {
-    var x = intAt(s,i);
-    if(x < 0) {
-      if(s.charAt(i) == "-" && this.signum() == 0) mi = true;
-      continue;
-    }
-    w = b*w+x;
-    if(++j >= cs) {
-      this.dMultiply(d);
-      this.dAddOffset(w,0);
-      j = 0;
-      w = 0;
-    }
-  }
-  if(j > 0) {
-    this.dMultiply(Math.pow(b,j));
-    this.dAddOffset(w,0);
-  }
-  if(mi) BigInteger.ZERO.subTo(this,this);
-}
-
-// (protected) alternate constructor
-function bnpFromNumber(a,b,c) {
-  if("number" == typeof b) {
-    // new BigInteger(int,int,RNG)
-    if(a < 2) this.fromInt(1);
-    else {
-      this.fromNumber(a,c);
-      if(!this.testBit(a-1))	// force MSB set
-        this.bitwiseTo(BigInteger.ONE.shiftLeft(a-1),op_or,this);
-      if(this.isEven()) this.dAddOffset(1,0); // force odd
-      while(!this.isProbablePrime(b)) {
-        this.dAddOffset(2,0);
-        if(this.bitLength() > a) this.subTo(BigInteger.ONE.shiftLeft(a-1),this);
-      }
-    }
-  }
-  else {
-    // new BigInteger(int,RNG)
-    var x = new Array(), t = a&7;
-    x.length = (a>>3)+1;
-    b.nextBytes(x);
-    if(t > 0) x[0] &= ((1<<t)-1); else x[0] = 0;
-    this.fromString(x,256);
-  }
-}
-
-// (public) convert to bigendian byte array
-function bnToByteArray() {
-  var this_array = this.array;
-  var i = this.t, r = new Array();
-  r[0] = this.s;
-  var p = BI_DB-(i*BI_DB)%8, d, k = 0;
-  if(i-- > 0) {
-    if(p < BI_DB && (d = this_array[i]>>p) != (this.s&BI_DM)>>p)
-      r[k++] = d|(this.s<<(BI_DB-p));
-    while(i >= 0) {
-      if(p < 8) {
-        d = (this_array[i]&((1<<p)-1))<<(8-p);
-        d |= this_array[--i]>>(p+=BI_DB-8);
-      }
-      else {
-        d = (this_array[i]>>(p-=8))&0xff;
-        if(p <= 0) { p += BI_DB; --i; }
-      }
-      if((d&0x80) != 0) d |= -256;
-      if(k == 0 && (this.s&0x80) != (d&0x80)) ++k;
-      if(k > 0 || d != this.s) r[k++] = d;
-    }
-  }
-  return r;
-}
-
-function bnEquals(a) { return(this.compareTo(a)==0); }
-function bnMin(a) { return(this.compareTo(a)<0)?this:a; }
-function bnMax(a) { return(this.compareTo(a)>0)?this:a; }
-
-// (protected) r = this op a (bitwise)
-function bnpBitwiseTo(a,op,r) {
-  var this_array = this.array;
-  var a_array    = a.array;
-  var r_array    = r.array;
-  var i, f, m = Math.min(a.t,this.t);
-  for(i = 0; i < m; ++i) r_array[i] = op(this_array[i],a_array[i]);
-  if(a.t < this.t) {
-    f = a.s&BI_DM;
-    for(i = m; i < this.t; ++i) r_array[i] = op(this_array[i],f);
-    r.t = this.t;
-  }
-  else {
-    f = this.s&BI_DM;
-    for(i = m; i < a.t; ++i) r_array[i] = op(f,a_array[i]);
-    r.t = a.t;
-  }
-  r.s = op(this.s,a.s);
-  r.clamp();
-}
-
-// (public) this & a
-function op_and(x,y) { return x&y; }
-function bnAnd(a) { var r = nbi(); this.bitwiseTo(a,op_and,r); return r; }
-
-// (public) this | a
-function op_or(x,y) { return x|y; }
-function bnOr(a) { var r = nbi(); this.bitwiseTo(a,op_or,r); return r; }
-
-// (public) this ^ a
-function op_xor(x,y) { return x^y; }
-function bnXor(a) { var r = nbi(); this.bitwiseTo(a,op_xor,r); return r; }
-
-// (public) this & ~a
-function op_andnot(x,y) { return x&~y; }
-function bnAndNot(a) { var r = nbi(); this.bitwiseTo(a,op_andnot,r); return r; }
-
-// (public) ~this
-function bnNot() {
-  var this_array = this.array;
-  var r = nbi();
-  var r_array = r.array;
-
-  for(var i = 0; i < this.t; ++i) r_array[i] = BI_DM&~this_array[i];
-  r.t = this.t;
-  r.s = ~this.s;
-  return r;
-}
-
-// (public) this << n
-function bnShiftLeft(n) {
-  var r = nbi();
-  if(n < 0) this.rShiftTo(-n,r); else this.lShiftTo(n,r);
-  return r;
-}
-
-// (public) this >> n
-function bnShiftRight(n) {
-  var r = nbi();
-  if(n < 0) this.lShiftTo(-n,r); else this.rShiftTo(n,r);
-  return r;
-}
-
-// return index of lowest 1-bit in x, x < 2^31
-function lbit(x) {
-  if(x == 0) return -1;
-  var r = 0;
-  if((x&0xffff) == 0) { x >>= 16; r += 16; }
-  if((x&0xff) == 0) { x >>= 8; r += 8; }
-  if((x&0xf) == 0) { x >>= 4; r += 4; }
-  if((x&3) == 0) { x >>= 2; r += 2; }
-  if((x&1) == 0) ++r;
-  return r;
-}
-
-// (public) returns index of lowest 1-bit (or -1 if none)
-function bnGetLowestSetBit() {
-  var this_array = this.array;
-  for(var i = 0; i < this.t; ++i)
-    if(this_array[i] != 0) return i*BI_DB+lbit(this_array[i]);
-  if(this.s < 0) return this.t*BI_DB;
-  return -1;
-}
-
-// return number of 1 bits in x
-function cbit(x) {
-  var r = 0;
-  while(x != 0) { x &= x-1; ++r; }
-  return r;
-}
-
-// (public) return number of set bits
-function bnBitCount() {
-  var r = 0, x = this.s&BI_DM;
-  for(var i = 0; i < this.t; ++i) r += cbit(this_array[i]^x);
-  return r;
-}
-
-// (public) true iff nth bit is set
-function bnTestBit(n) {
-  var this_array = this.array;
-  var j = Math.floor(n/BI_DB);
-  if(j >= this.t) return(this.s!=0);
-  return((this_array[j]&(1<<(n%BI_DB)))!=0);
-}
-
-// (protected) this op (1<<n)
-function bnpChangeBit(n,op) {
-  var r = BigInteger.ONE.shiftLeft(n);
-  this.bitwiseTo(r,op,r);
-  return r;
-}
-
-// (public) this | (1<<n)
-function bnSetBit(n) { return this.changeBit(n,op_or); }
-
-// (public) this & ~(1<<n)
-function bnClearBit(n) { return this.changeBit(n,op_andnot); }
-
-// (public) this ^ (1<<n)
-function bnFlipBit(n) { return this.changeBit(n,op_xor); }
-
-// (protected) r = this + a
-function bnpAddTo(a,r) {
-  var this_array = this.array;
-  var a_array = a.array;
-  var r_array = r.array;
-  var i = 0, c = 0, m = Math.min(a.t,this.t);
-  while(i < m) {
-    c += this_array[i]+a_array[i];
-    r_array[i++] = c&BI_DM;
-    c >>= BI_DB;
-  }
-  if(a.t < this.t) {
-    c += a.s;
-    while(i < this.t) {
-      c += this_array[i];
-      r_array[i++] = c&BI_DM;
-      c >>= BI_DB;
-    }
-    c += this.s;
-  }
-  else {
-    c += this.s;
-    while(i < a.t) {
-      c += a_array[i];
-      r_array[i++] = c&BI_DM;
-      c >>= BI_DB;
-    }
-    c += a.s;
-  }
-  r.s = (c<0)?-1:0;
-  if(c > 0) r_array[i++] = c;
-  else if(c < -1) r_array[i++] = BI_DV+c;
-  r.t = i;
-  r.clamp();
-}
-
-// (public) this + a
-function bnAdd(a) { var r = nbi(); this.addTo(a,r); return r; }
-
-// (public) this - a
-function bnSubtract(a) { var r = nbi(); this.subTo(a,r); return r; }
-
-// (public) this * a
-function bnMultiply(a) { var r = nbi(); this.multiplyTo(a,r); return r; }
-
-// (public) this / a
-function bnDivide(a) { var r = nbi(); this.divRemTo(a,r,null); return r; }
-
-// (public) this % a
-function bnRemainder(a) { var r = nbi(); this.divRemTo(a,null,r); return r; }
-
-// (public) [this/a,this%a]
-function bnDivideAndRemainder(a) {
-  var q = nbi(), r = nbi();
-  this.divRemTo(a,q,r);
-  return new Array(q,r);
-}
-
-// (protected) this *= n, this >= 0, 1 < n < DV
-function bnpDMultiply(n) {
-  var this_array = this.array;
-  this_array[this.t] = this.am(0,n-1,this,0,0,this.t);
-  ++this.t;
-  this.clamp();
-}
-
-// (protected) this += n << w words, this >= 0
-function bnpDAddOffset(n,w) {
-  var this_array = this.array;
-  while(this.t <= w) this_array[this.t++] = 0;
-  this_array[w] += n;
-  while(this_array[w] >= BI_DV) {
-    this_array[w] -= BI_DV;
-    if(++w >= this.t) this_array[this.t++] = 0;
-    ++this_array[w];
-  }
-}
-
-// A "null" reducer
-function NullExp() {}
-function nNop(x) { return x; }
-function nMulTo(x,y,r) { x.multiplyTo(y,r); }
-function nSqrTo(x,r) { x.squareTo(r); }
-
-NullExp.prototype.convert = nNop;
-NullExp.prototype.revert = nNop;
-NullExp.prototype.mulTo = nMulTo;
-NullExp.prototype.sqrTo = nSqrTo;
-
-// (public) this^e
-function bnPow(e) { return this.exp(e,new NullExp()); }
-
-// (protected) r = lower n words of "this * a", a.t <= n
-// "this" should be the larger one if appropriate.
-function bnpMultiplyLowerTo(a,n,r) {
-  var r_array = r.array;
-  var a_array = a.array;
-  var i = Math.min(this.t+a.t,n);
-  r.s = 0; // assumes a,this >= 0
-  r.t = i;
-  while(i > 0) r_array[--i] = 0;
-  var j;
-  for(j = r.t-this.t; i < j; ++i) r_array[i+this.t] = this.am(0,a_array[i],r,i,0,this.t);
-  for(j = Math.min(a.t,n); i < j; ++i) this.am(0,a_array[i],r,i,0,n-i);
-  r.clamp();
-}
-
-// (protected) r = "this * a" without lower n words, n > 0
-// "this" should be the larger one if appropriate.
-function bnpMultiplyUpperTo(a,n,r) {
-  var r_array = r.array;
-  var a_array = a.array;
-  --n;
-  var i = r.t = this.t+a.t-n;
-  r.s = 0; // assumes a,this >= 0
-  while(--i >= 0) r_array[i] = 0;
-  for(i = Math.max(n-this.t,0); i < a.t; ++i)
-    r_array[this.t+i-n] = this.am(n-i,a_array[i],r,0,0,this.t+i-n);
-  r.clamp();
-  r.drShiftTo(1,r);
-}
-
-// Barrett modular reduction
-function Barrett(m) {
-  // setup Barrett
-  this.r2 = nbi();
-  this.q3 = nbi();
-  BigInteger.ONE.dlShiftTo(2*m.t,this.r2);
-  this.mu = this.r2.divide(m);
-  this.m = m;
-}
-
-function barrettConvert(x) {
-  if(x.s < 0 || x.t > 2*this.m.t) return x.mod(this.m);
-  else if(x.compareTo(this.m) < 0) return x;
-  else { var r = nbi(); x.copyTo(r); this.reduce(r); return r; }
-}
-
-function barrettRevert(x) { return x; }
-
-// x = x mod m (HAC 14.42)
-function barrettReduce(x) {
-  x.drShiftTo(this.m.t-1,this.r2);
-  if(x.t > this.m.t+1) { x.t = this.m.t+1; x.clamp(); }
-  this.mu.multiplyUpperTo(this.r2,this.m.t+1,this.q3);
-  this.m.multiplyLowerTo(this.q3,this.m.t+1,this.r2);
-  while(x.compareTo(this.r2) < 0) x.dAddOffset(1,this.m.t+1);
-  x.subTo(this.r2,x);
-  while(x.compareTo(this.m) >= 0) x.subTo(this.m,x);
-}
-
-// r = x^2 mod m; x != r
-function barrettSqrTo(x,r) { x.squareTo(r); this.reduce(r); }
-
-// r = x*y mod m; x,y != r
-function barrettMulTo(x,y,r) { x.multiplyTo(y,r); this.reduce(r); }
-
-Barrett.prototype.convert = barrettConvert;
-Barrett.prototype.revert = barrettRevert;
-Barrett.prototype.reduce = barrettReduce;
-Barrett.prototype.mulTo = barrettMulTo;
-Barrett.prototype.sqrTo = barrettSqrTo;
-
-// (public) this^e % m (HAC 14.85)
-function bnModPow(e,m) {
-  var e_array = e.array;
-  var i = e.bitLength(), k, r = nbv(1), z;
-  if(i <= 0) return r;
-  else if(i < 18) k = 1;
-  else if(i < 48) k = 3;
-  else if(i < 144) k = 4;
-  else if(i < 768) k = 5;
-  else k = 6;
-  if(i < 8)
-    z = new Classic(m);
-  else if(m.isEven())
-    z = new Barrett(m);
-  else
-    z = new Montgomery(m);
-
-  // precomputation
-  var g = new Array(), n = 3, k1 = k-1, km = (1<<k)-1;
-  g[1] = z.convert(this);
-  if(k > 1) {
-    var g2 = nbi();
-    z.sqrTo(g[1],g2);
-    while(n <= km) {
-      g[n] = nbi();
-      z.mulTo(g2,g[n-2],g[n]);
-      n += 2;
-    }
-  }
-
-  var j = e.t-1, w, is1 = true, r2 = nbi(), t;
-  i = nbits(e_array[j])-1;
-  while(j >= 0) {
-    if(i >= k1) w = (e_array[j]>>(i-k1))&km;
-    else {
-      w = (e_array[j]&((1<<(i+1))-1))<<(k1-i);
-      if(j > 0) w |= e_array[j-1]>>(BI_DB+i-k1);
-    }
-
-    n = k;
-    while((w&1) == 0) { w >>= 1; --n; }
-    if((i -= n) < 0) { i += BI_DB; --j; }
-    if(is1) {	// ret == 1, don't bother squaring or multiplying it
-      g[w].copyTo(r);
-      is1 = false;
-    }
-    else {
-      while(n > 1) { z.sqrTo(r,r2); z.sqrTo(r2,r); n -= 2; }
-      if(n > 0) z.sqrTo(r,r2); else { t = r; r = r2; r2 = t; }
-      z.mulTo(r2,g[w],r);
-    }
-
-    while(j >= 0 && (e_array[j]&(1<<i)) == 0) {
-      z.sqrTo(r,r2); t = r; r = r2; r2 = t;
-      if(--i < 0) { i = BI_DB-1; --j; }
-    }
-  }
-  return z.revert(r);
-}
-
-// (public) gcd(this,a) (HAC 14.54)
-function bnGCD(a) {
-  var x = (this.s<0)?this.negate():this.clone();
-  var y = (a.s<0)?a.negate():a.clone();
-  if(x.compareTo(y) < 0) { var t = x; x = y; y = t; }
-  var i = x.getLowestSetBit(), g = y.getLowestSetBit();
-  if(g < 0) return x;
-  if(i < g) g = i;
-  if(g > 0) {
-    x.rShiftTo(g,x);
-    y.rShiftTo(g,y);
-  }
-  while(x.signum() > 0) {
-    if((i = x.getLowestSetBit()) > 0) x.rShiftTo(i,x);
-    if((i = y.getLowestSetBit()) > 0) y.rShiftTo(i,y);
-    if(x.compareTo(y) >= 0) {
-      x.subTo(y,x);
-      x.rShiftTo(1,x);
-    }
-    else {
-      y.subTo(x,y);
-      y.rShiftTo(1,y);
-    }
-  }
-  if(g > 0) y.lShiftTo(g,y);
-  return y;
-}
-
-// (protected) this % n, n < 2^26
-function bnpModInt(n) {
-  var this_array = this.array;
-  if(n <= 0) return 0;
-  var d = BI_DV%n, r = (this.s<0)?n-1:0;
-  if(this.t > 0)
-    if(d == 0) r = this_array[0]%n;
-    else for(var i = this.t-1; i >= 0; --i) r = (d*r+this_array[i])%n;
-  return r;
-}
-
-// (public) 1/this % m (HAC 14.61)
-function bnModInverse(m) {
-  var ac = m.isEven();
-  if((this.isEven() && ac) || m.signum() == 0) return BigInteger.ZERO;
-  var u = m.clone(), v = this.clone();
-  var a = nbv(1), b = nbv(0), c = nbv(0), d = nbv(1);
-  while(u.signum() != 0) {
-    while(u.isEven()) {
-      u.rShiftTo(1,u);
-      if(ac) {
-        if(!a.isEven() || !b.isEven()) { a.addTo(this,a); b.subTo(m,b); }
-        a.rShiftTo(1,a);
-      }
-      else if(!b.isEven()) b.subTo(m,b);
-      b.rShiftTo(1,b);
-    }
-    while(v.isEven()) {
-      v.rShiftTo(1,v);
-      if(ac) {
-        if(!c.isEven() || !d.isEven()) { c.addTo(this,c); d.subTo(m,d); }
-        c.rShiftTo(1,c);
-      }
-      else if(!d.isEven()) d.subTo(m,d);
-      d.rShiftTo(1,d);
-    }
-    if(u.compareTo(v) >= 0) {
-      u.subTo(v,u);
-      if(ac) a.subTo(c,a);
-      b.subTo(d,b);
-    }
-    else {
-      v.subTo(u,v);
-      if(ac) c.subTo(a,c);
-      d.subTo(b,d);
-    }
-  }
-  if(v.compareTo(BigInteger.ONE) != 0) return BigInteger.ZERO;
-  if(d.compareTo(m) >= 0) return d.subtract(m);
-  if(d.signum() < 0) d.addTo(m,d); else return d;
-  if(d.signum() < 0) return d.add(m); else return d;
-}
-
-var lowprimes = [2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,101,103,107,109,113,127,131,137,139,149,151,157,163,167,173,179,181,191,193,197,199,211,223,227,229,233,239,241,251,257,263,269,271,277,281,283,293,307,311,313,317,331,337,347,349,353,359,367,373,379,383,389,397,401,409,419,421,431,433,439,443,449,457,461,463,467,479,487,491,499,503,509];
-var lplim = (1<<26)/lowprimes[lowprimes.length-1];
-
-// (public) test primality with certainty >= 1-.5^t
-function bnIsProbablePrime(t) {
-  var i, x = this.abs();
-  var x_array = x.array;
-  if(x.t == 1 && x_array[0] <= lowprimes[lowprimes.length-1]) {
-    for(i = 0; i < lowprimes.length; ++i)
-      if(x_array[0] == lowprimes[i]) return true;
-    return false;
-  }
-  if(x.isEven()) return false;
-  i = 1;
-  while(i < lowprimes.length) {
-    var m = lowprimes[i], j = i+1;
-    while(j < lowprimes.length && m < lplim) m *= lowprimes[j++];
-    m = x.modInt(m);
-    while(i < j) if(m%lowprimes[i++] == 0) return false;
-  }
-  return x.millerRabin(t);
-}
-
-// (protected) true if probably prime (HAC 4.24, Miller-Rabin)
-function bnpMillerRabin(t) {
-  var n1 = this.subtract(BigInteger.ONE);
-  var k = n1.getLowestSetBit();
-  if(k <= 0) return false;
-  var r = n1.shiftRight(k);
-  t = (t+1)>>1;
-  if(t > lowprimes.length) t = lowprimes.length;
-  var a = nbi();
-  for(var i = 0; i < t; ++i) {
-    a.fromInt(lowprimes[i]);
-    var y = a.modPow(r,this);
-    if(y.compareTo(BigInteger.ONE) != 0 && y.compareTo(n1) != 0) {
-      var j = 1;
-      while(j++ < k && y.compareTo(n1) != 0) {
-        y = y.modPowInt(2,this);
-        if(y.compareTo(BigInteger.ONE) == 0) return false;
-      }
-      if(y.compareTo(n1) != 0) return false;
-    }
-  }
-  return true;
-}
-
-// protected
-BigInteger.prototype.chunkSize = bnpChunkSize;
-BigInteger.prototype.toRadix = bnpToRadix;
-BigInteger.prototype.fromRadix = bnpFromRadix;
-BigInteger.prototype.fromNumber = bnpFromNumber;
-BigInteger.prototype.bitwiseTo = bnpBitwiseTo;
-BigInteger.prototype.changeBit = bnpChangeBit;
-BigInteger.prototype.addTo = bnpAddTo;
-BigInteger.prototype.dMultiply = bnpDMultiply;
-BigInteger.prototype.dAddOffset = bnpDAddOffset;
-BigInteger.prototype.multiplyLowerTo = bnpMultiplyLowerTo;
-BigInteger.prototype.multiplyUpperTo = bnpMultiplyUpperTo;
-BigInteger.prototype.modInt = bnpModInt;
-BigInteger.prototype.millerRabin = bnpMillerRabin;
-
-// public
-BigInteger.prototype.clone = bnClone;
-BigInteger.prototype.intValue = bnIntValue;
-BigInteger.prototype.byteValue = bnByteValue;
-BigInteger.prototype.shortValue = bnShortValue;
-BigInteger.prototype.signum = bnSigNum;
-BigInteger.prototype.toByteArray = bnToByteArray;
-BigInteger.prototype.equals = bnEquals;
-BigInteger.prototype.min = bnMin;
-BigInteger.prototype.max = bnMax;
-BigInteger.prototype.and = bnAnd;
-BigInteger.prototype.or = bnOr;
-BigInteger.prototype.xor = bnXor;
-BigInteger.prototype.andNot = bnAndNot;
-BigInteger.prototype.not = bnNot;
-BigInteger.prototype.shiftLeft = bnShiftLeft;
-BigInteger.prototype.shiftRight = bnShiftRight;
-BigInteger.prototype.getLowestSetBit = bnGetLowestSetBit;
-BigInteger.prototype.bitCount = bnBitCount;
-BigInteger.prototype.testBit = bnTestBit;
-BigInteger.prototype.setBit = bnSetBit;
-BigInteger.prototype.clearBit = bnClearBit;
-BigInteger.prototype.flipBit = bnFlipBit;
-BigInteger.prototype.add = bnAdd;
-BigInteger.prototype.subtract = bnSubtract;
-BigInteger.prototype.multiply = bnMultiply;
-BigInteger.prototype.divide = bnDivide;
-BigInteger.prototype.remainder = bnRemainder;
-BigInteger.prototype.divideAndRemainder = bnDivideAndRemainder;
-BigInteger.prototype.modPow = bnModPow;
-BigInteger.prototype.modInverse = bnModInverse;
-BigInteger.prototype.pow = bnPow;
-BigInteger.prototype.gcd = bnGCD;
-BigInteger.prototype.isProbablePrime = bnIsProbablePrime;
-
-// BigInteger interfaces not implemented in jsbn:
-
-// BigInteger(int signum, byte[] magnitude)
-// double doubleValue()
-// float floatValue()
-// int hashCode()
-// long longValue()
-// static BigInteger valueOf(long val)
-// prng4.js - uses Arcfour as a PRNG
-
-function Arcfour() {
-  this.i = 0;
-  this.j = 0;
-  this.S = new Array();
-}
-
-// Initialize arcfour context from key, an array of ints, each from [0..255]
-function ARC4init(key) {
-  var i, j, t;
-  for(i = 0; i < 256; ++i)
-    this.S[i] = i;
-  j = 0;
-  for(i = 0; i < 256; ++i) {
-    j = (j + this.S[i] + key[i % key.length]) & 255;
-    t = this.S[i];
-    this.S[i] = this.S[j];
-    this.S[j] = t;
-  }
-  this.i = 0;
-  this.j = 0;
-}
-
-function ARC4next() {
-  var t;
-  this.i = (this.i + 1) & 255;
-  this.j = (this.j + this.S[this.i]) & 255;
-  t = this.S[this.i];
-  this.S[this.i] = this.S[this.j];
-  this.S[this.j] = t;
-  return this.S[(t + this.S[this.i]) & 255];
-}
-
-Arcfour.prototype.init = ARC4init;
-Arcfour.prototype.next = ARC4next;
-
-// Plug in your RNG constructor here
-function prng_newstate() {
-  return new Arcfour();
-}
-
-// Pool size must be a multiple of 4 and greater than 32.
-// An array of bytes the size of the pool will be passed to init()
-var rng_psize = 256;
-// Random number generator - requires a PRNG backend, e.g. prng4.js
-
-// For best results, put code like
-// <body onClick='rng_seed_time();' onKeyPress='rng_seed_time();'>
-// in your main HTML document.
-
-var rng_state;
-var rng_pool;
-var rng_pptr;
-
-// Mix in a 32-bit integer into the pool
-function rng_seed_int(x) {
-  rng_pool[rng_pptr++] ^= x & 255;
-  rng_pool[rng_pptr++] ^= (x >> 8) & 255;
-  rng_pool[rng_pptr++] ^= (x >> 16) & 255;
-  rng_pool[rng_pptr++] ^= (x >> 24) & 255;
-  if(rng_pptr >= rng_psize) rng_pptr -= rng_psize;
-}
-
-// Mix in the current time (w/milliseconds) into the pool
-function rng_seed_time() {
-  // Use pre-computed date to avoid making the benchmark
-  // results dependent on the current date.
-  rng_seed_int(1122926989487);
-}
-
-// Initialize the pool with junk if needed.
-if(rng_pool == null) {
-  rng_pool = new Array();
-  rng_pptr = 0;
-  var t;
-  while(rng_pptr < rng_psize) {  // extract some randomness from Math.random()
-    t = Math.floor(65536 * Math.random());
-    rng_pool[rng_pptr++] = t >>> 8;
-    rng_pool[rng_pptr++] = t & 255;
-  }
-  rng_pptr = 0;
-  rng_seed_time();
-  //rng_seed_int(window.screenX);
-  //rng_seed_int(window.screenY);
-}
-
-function rng_get_byte() {
-  if(rng_state == null) {
-    rng_seed_time();
-    rng_state = prng_newstate();
-    rng_state.init(rng_pool);
-    for(rng_pptr = 0; rng_pptr < rng_pool.length; ++rng_pptr)
-      rng_pool[rng_pptr] = 0;
-    rng_pptr = 0;
-    //rng_pool = null;
-  }
-  // TODO: allow reseeding after first request
-  return rng_state.next();
-}
-
-function rng_get_bytes(ba) {
-  var i;
-  for(i = 0; i < ba.length; ++i) ba[i] = rng_get_byte();
-}
-
-function SecureRandom() {}
-
-SecureRandom.prototype.nextBytes = rng_get_bytes;
-// Depends on jsbn.js and rng.js
-
-// convert a (hex) string to a bignum object
-function parseBigInt(str,r) {
-  return new BigInteger(str,r);
-}
-
-function linebrk(s,n) {
-  var ret = "";
-  var i = 0;
-  while(i + n < s.length) {
-    ret += s.substring(i,i+n) + "\n";
-    i += n;
-  }
-  return ret + s.substring(i,s.length);
-}
-
-function byte2Hex(b) {
-  if(b < 0x10)
-    return "0" + b.toString(16);
-  else
-    return b.toString(16);
-}
-
-// PKCS#1 (type 2, random) pad input string s to n bytes, and return a bigint
-function pkcs1pad2(s,n) {
-  if(n < s.length + 11) {
-    alert("Message too long for RSA");
-    return null;
-  }
-  var ba = new Array();
-  var i = s.length - 1;
-  while(i >= 0 && n > 0) ba[--n] = s.charCodeAt(i--);
-  ba[--n] = 0;
-  var rng = new SecureRandom();
-  var x = new Array();
-  while(n > 2) { // random non-zero pad
-    x[0] = 0;
-    while(x[0] == 0) rng.nextBytes(x);
-    ba[--n] = x[0];
-  }
-  ba[--n] = 2;
-  ba[--n] = 0;
-  return new BigInteger(ba);
-}
-
-// "empty" RSA key constructor
-function RSAKey() {
-  this.n = null;
-  this.e = 0;
-  this.d = null;
-  this.p = null;
-  this.q = null;
-  this.dmp1 = null;
-  this.dmq1 = null;
-  this.coeff = null;
-}
-
-// Set the public key fields N and e from hex strings
-function RSASetPublic(N,E) {
-  if(N != null && E != null && N.length > 0 && E.length > 0) {
-    this.n = parseBigInt(N,16);
-    this.e = parseInt(E,16);
-  }
-  else
-    alert("Invalid RSA public key");
-}
-
-// Perform raw public operation on "x": return x^e (mod n)
-function RSADoPublic(x) {
-  return x.modPowInt(this.e, this.n);
-}
-
-// Return the PKCS#1 RSA encryption of "text" as an even-length hex string
-function RSAEncrypt(text) {
-  var m = pkcs1pad2(text,(this.n.bitLength()+7)>>3);
-  if(m == null) return null;
-  var c = this.doPublic(m);
-  if(c == null) return null;
-  var h = c.toString(16);
-  if((h.length & 1) == 0) return h; else return "0" + h;
-}
-
-// Return the PKCS#1 RSA encryption of "text" as a Base64-encoded string
-//function RSAEncryptB64(text) {
-//  var h = this.encrypt(text);
-//  if(h) return hex2b64(h); else return null;
-//}
-
-// protected
-RSAKey.prototype.doPublic = RSADoPublic;
-
-// public
-RSAKey.prototype.setPublic = RSASetPublic;
-RSAKey.prototype.encrypt = RSAEncrypt;
-//RSAKey.prototype.encrypt_b64 = RSAEncryptB64;
-// Depends on rsa.js and jsbn2.js
-
-// Undo PKCS#1 (type 2, random) padding and, if valid, return the plaintext
-function pkcs1unpad2(d,n) {
-  var b = d.toByteArray();
-  var i = 0;
-  while(i < b.length && b[i] == 0) ++i;
-  if(b.length-i != n-1 || b[i] != 2)
-    return null;
-  ++i;
-  while(b[i] != 0)
-    if(++i >= b.length) return null;
-  var ret = "";
-  while(++i < b.length)
-    ret += String.fromCharCode(b[i]);
-  return ret;
-}
-
-// Set the private key fields N, e, and d from hex strings
-function RSASetPrivate(N,E,D) {
-  if(N != null && E != null && N.length > 0 && E.length > 0) {
-    this.n = parseBigInt(N,16);
-    this.e = parseInt(E,16);
-    this.d = parseBigInt(D,16);
-  }
-  else
-    alert("Invalid RSA private key");
-}
-
-// Set the private key fields N, e, d and CRT params from hex strings
-function RSASetPrivateEx(N,E,D,P,Q,DP,DQ,C) {
-  if(N != null && E != null && N.length > 0 && E.length > 0) {
-    this.n = parseBigInt(N,16);
-    this.e = parseInt(E,16);
-    this.d = parseBigInt(D,16);
-    this.p = parseBigInt(P,16);
-    this.q = parseBigInt(Q,16);
-    this.dmp1 = parseBigInt(DP,16);
-    this.dmq1 = parseBigInt(DQ,16);
-    this.coeff = parseBigInt(C,16);
-  }
-  else
-    alert("Invalid RSA private key");
-}
-
-// Generate a new random private key B bits long, using public expt E
-function RSAGenerate(B,E) {
-  var rng = new SecureRandom();
-  var qs = B>>1;
-  this.e = parseInt(E,16);
-  var ee = new BigInteger(E,16);
-  for(;;) {
-    for(;;) {
-      this.p = new BigInteger(B-qs,1,rng);
-      if(this.p.subtract(BigInteger.ONE).gcd(ee).compareTo(BigInteger.ONE) == 0 && this.p.isProbablePrime(10)) break;
-    }
-    for(;;) {
-      this.q = new BigInteger(qs,1,rng);
-      if(this.q.subtract(BigInteger.ONE).gcd(ee).compareTo(BigInteger.ONE) == 0 && this.q.isProbablePrime(10)) break;
-    }
-    if(this.p.compareTo(this.q) <= 0) {
-      var t = this.p;
-      this.p = this.q;
-      this.q = t;
-    }
-    var p1 = this.p.subtract(BigInteger.ONE);
-    var q1 = this.q.subtract(BigInteger.ONE);
-    var phi = p1.multiply(q1);
-    if(phi.gcd(ee).compareTo(BigInteger.ONE) == 0) {
-      this.n = this.p.multiply(this.q);
-      this.d = ee.modInverse(phi);
-      this.dmp1 = this.d.mod(p1);
-      this.dmq1 = this.d.mod(q1);
-      this.coeff = this.q.modInverse(this.p);
-      break;
-    }
-  }
-}
-
-// Perform raw private operation on "x": return x^d (mod n)
-function RSADoPrivate(x) {
-  if(this.p == null || this.q == null)
-    return x.modPow(this.d, this.n);
-
-  // TODO: re-calculate any missing CRT params
-  var xp = x.mod(this.p).modPow(this.dmp1, this.p);
-  var xq = x.mod(this.q).modPow(this.dmq1, this.q);
-
-  while(xp.compareTo(xq) < 0)
-    xp = xp.add(this.p);
-  return xp.subtract(xq).multiply(this.coeff).mod(this.p).multiply(this.q).add(xq);
-}
-
-// Return the PKCS#1 RSA decryption of "ctext".
-// "ctext" is an even-length hex string and the output is a plain string.
-function RSADecrypt(ctext) {
-  var c = parseBigInt(ctext, 16);
-  var m = this.doPrivate(c);
-  if(m == null) return null;
-  return pkcs1unpad2(m, (this.n.bitLength()+7)>>3);
-}
-
-// Return the PKCS#1 RSA decryption of "ctext".
-// "ctext" is a Base64-encoded string and the output is a plain string.
-//function RSAB64Decrypt(ctext) {
-//  var h = b64tohex(ctext);
-//  if(h) return this.decrypt(h); else return null;
-//}
-
-// protected
-RSAKey.prototype.doPrivate = RSADoPrivate;
-
-// public
-RSAKey.prototype.setPrivate = RSASetPrivate;
-RSAKey.prototype.setPrivateEx = RSASetPrivateEx;
-RSAKey.prototype.generate = RSAGenerate;
-RSAKey.prototype.decrypt = RSADecrypt;
-//RSAKey.prototype.b64_decrypt = RSAB64Decrypt;
-
-
-nValue="a5261939975948bb7a58dffe5ff54e65f0498f9175f5a09288810b8975871e99af3b5dd94057b0fc07535f5f97444504fa35169d461d0d30cf0192e307727c065168c788771c561a9400fb49175e9e6aa4e23fe11af69e9412dd23b0cb6684c4c2429bce139e848ab26d0829073351f4acd36074eafd036a5eb83359d2a698d3";
-eValue="10001";
-dValue="8e9912f6d3645894e8d38cb58c0db81ff516cf4c7e5a14c7f1eddb1459d2cded4d8d293fc97aee6aefb861859c8b6a3d1dfe710463e1f9ddc72048c09751971c4a580aa51eb523357a3cc48d31cfad1d4a165066ed92d4748fb6571211da5cb14bc11b6e2df7c1a559e6d5ac1cd5c94703a22891464fba23d0d965086277a161";
-pValue="d090ce58a92c75233a6486cb0a9209bf3583b64f540c76f5294bb97d285eed33aec220bde14b2417951178ac152ceab6da7090905b478195498b352048f15e7d";
-qValue="cab575dc652bb66df15a0359609d51d1db184750c00c6698b90ef3465c99655103edbf0d54c56aec0ce3c4d22592338092a126a0cc49f65a4a30d222b411e58f";
-dmp1Value="1a24bca8e273df2f0e47c199bbf678604e7df7215480c77c8db39f49b000ce2cf7500038acfff5433b7d582a01f1826e6f4d42e1c57f5e1fef7b12aabc59fd25";
-dmq1Value="3d06982efbbe47339e1f6d36b1216b8a741d410b0c662f54f7118b27b9a4ec9d914337eb39841d8666f3034408cf94f5b62f11c402fc994fe15a05493150d9fd";
-coeffValue="3a3e731acd8960b7ff9eb81a7ff93bd1cfa74cbd56987db58b4594fb09c09084db1734c8143f98b602b981aaa9243ca28deb69b5b280ee8dcee0fd2625e53250";
-
-setupEngine(am3, 28);
-
-var TEXT = "The quick brown fox jumped over the extremely lazy frog! " +
-    "Now is the time for all good men to come to the party.";
-var encrypted;
-
-function encrypt() {
-  var RSA = new RSAKey();
-  RSA.setPublic(nValue, eValue);
-  RSA.setPrivateEx(nValue, eValue, dValue, pValue, qValue, dmp1Value, dmq1Value, coeffValue);
-  encrypted = RSA.encrypt(TEXT);
-}
-
-function decrypt() {
-  var RSA = new RSAKey();
-  RSA.setPublic(nValue, eValue);
-  RSA.setPrivateEx(nValue, eValue, dValue, pValue, qValue, dmp1Value, dmq1Value, coeffValue);
-  var decrypted = RSA.decrypt(encrypted);
-  if (decrypted != TEXT) {
-    throw new Error("Crypto operation failed");
-  }
-}
diff --git a/deps/v8/benchmarks/deltablue.js b/deps/v8/benchmarks/deltablue.js
deleted file mode 100644
index f44973cb9f8762..00000000000000
--- a/deps/v8/benchmarks/deltablue.js
+++ /dev/null
@@ -1,880 +0,0 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
-// Copyright 1996 John Maloney and Mario Wolczko.
-
-// This program is free software; you can redistribute it and/or modify
-// it under the terms of the GNU General Public License as published by
-// the Free Software Foundation; either version 2 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License
-// along with this program; if not, write to the Free Software
-// Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-
-// This implementation of the DeltaBlue benchmark is derived
-// from the Smalltalk implementation by John Maloney and Mario
-// Wolczko. Some parts have been translated directly, whereas
-// others have been modified more aggresively to make it feel
-// more like a JavaScript program.
-
-
-var DeltaBlue = new BenchmarkSuite('DeltaBlue', 66118, [
-  new Benchmark('DeltaBlue', deltaBlue)
-]);
-
-
-/**
- * A JavaScript implementation of the DeltaBlue constraint-solving
- * algorithm, as described in:
- *
- * "The DeltaBlue Algorithm: An Incremental Constraint Hierarchy Solver"
- *   Bjorn N. Freeman-Benson and John Maloney
- *   January 1990 Communications of the ACM,
- *   also available as University of Washington TR 89-08-06.
- *
- * Beware: this benchmark is written in a grotesque style where
- * the constraint model is built by side-effects from constructors.
- * I've kept it this way to avoid deviating too much from the original
- * implementation.
- */
-
-
-/* --- O b j e c t   M o d e l --- */
-
-Object.prototype.inheritsFrom = function (shuper) {
-  function Inheriter() { }
-  Inheriter.prototype = shuper.prototype;
-  this.prototype = new Inheriter();
-  this.superConstructor = shuper;
-}
-
-function OrderedCollection() {
-  this.elms = new Array();
-}
-
-OrderedCollection.prototype.add = function (elm) {
-  this.elms.push(elm);
-}
-
-OrderedCollection.prototype.at = function (index) {
-  return this.elms[index];
-}
-
-OrderedCollection.prototype.size = function () {
-  return this.elms.length;
-}
-
-OrderedCollection.prototype.removeFirst = function () {
-  return this.elms.pop();
-}
-
-OrderedCollection.prototype.remove = function (elm) {
-  var index = 0, skipped = 0;
-  for (var i = 0; i < this.elms.length; i++) {
-    var value = this.elms[i];
-    if (value != elm) {
-      this.elms[index] = value;
-      index++;
-    } else {
-      skipped++;
-    }
-  }
-  for (var i = 0; i < skipped; i++)
-    this.elms.pop();
-}
-
-/* --- *
- * S t r e n g t h
- * --- */
-
-/**
- * Strengths are used to measure the relative importance of constraints.
- * New strengths may be inserted in the strength hierarchy without
- * disrupting current constraints.  Strengths cannot be created outside
- * this class, so pointer comparison can be used for value comparison.
- */
-function Strength(strengthValue, name) {
-  this.strengthValue = strengthValue;
-  this.name = name;
-}
-
-Strength.stronger = function (s1, s2) {
-  return s1.strengthValue < s2.strengthValue;
-}
-
-Strength.weaker = function (s1, s2) {
-  return s1.strengthValue > s2.strengthValue;
-}
-
-Strength.weakestOf = function (s1, s2) {
-  return this.weaker(s1, s2) ? s1 : s2;
-}
-
-Strength.strongest = function (s1, s2) {
-  return this.stronger(s1, s2) ? s1 : s2;
-}
-
-Strength.prototype.nextWeaker = function () {
-  switch (this.strengthValue) {
-    case 0: return Strength.STRONG_PREFERRED;
-    case 1: return Strength.PREFERRED;
-    case 2: return Strength.STRONG_DEFAULT;
-    case 3: return Strength.NORMAL;
-    case 4: return Strength.WEAK_DEFAULT;
-    case 5: return Strength.WEAKEST;
-  }
-}
-
-// Strength constants.
-Strength.REQUIRED         = new Strength(0, "required");
-Strength.STRONG_PREFERRED = new Strength(1, "strongPreferred");
-Strength.PREFERRED        = new Strength(2, "preferred");
-Strength.STRONG_DEFAULT   = new Strength(3, "strongDefault");
-Strength.NORMAL           = new Strength(4, "normal");
-Strength.WEAK_DEFAULT     = new Strength(5, "weakDefault");
-Strength.WEAKEST          = new Strength(6, "weakest");
-
-/* --- *
- * C o n s t r a i n t
- * --- */
-
-/**
- * An abstract class representing a system-maintainable relationship
- * (or "constraint") between a set of variables. A constraint supplies
- * a strength instance variable; concrete subclasses provide a means
- * of storing the constrained variables and other information required
- * to represent a constraint.
- */
-function Constraint(strength) {
-  this.strength = strength;
-}
-
-/**
- * Activate this constraint and attempt to satisfy it.
- */
-Constraint.prototype.addConstraint = function () {
-  this.addToGraph();
-  planner.incrementalAdd(this);
-}
-
-/**
- * Attempt to find a way to enforce this constraint. If successful,
- * record the solution, perhaps modifying the current dataflow
- * graph. Answer the constraint that this constraint overrides, if
- * there is one, or nil, if there isn't.
- * Assume: I am not already satisfied.
- */
-Constraint.prototype.satisfy = function (mark) {
-  this.chooseMethod(mark);
-  if (!this.isSatisfied()) {
-    if (this.strength == Strength.REQUIRED)
-      alert("Could not satisfy a required constraint!");
-    return null;
-  }
-  this.markInputs(mark);
-  var out = this.output();
-  var overridden = out.determinedBy;
-  if (overridden != null) overridden.markUnsatisfied();
-  out.determinedBy = this;
-  if (!planner.addPropagate(this, mark))
-    alert("Cycle encountered");
-  out.mark = mark;
-  return overridden;
-}
-
-Constraint.prototype.destroyConstraint = function () {
-  if (this.isSatisfied()) planner.incrementalRemove(this);
-  else this.removeFromGraph();
-}
-
-/**
- * Normal constraints are not input constraints.  An input constraint
- * is one that depends on external state, such as the mouse, the
- * keybord, a clock, or some arbitraty piece of imperative code.
- */
-Constraint.prototype.isInput = function () {
-  return false;
-}
-
-/* --- *
- * U n a r y   C o n s t r a i n t
- * --- */
-
-/**
- * Abstract superclass for constraints having a single possible output
- * variable.
- */
-function UnaryConstraint(v, strength) {
-  UnaryConstraint.superConstructor.call(this, strength);
-  this.myOutput = v;
-  this.satisfied = false;
-  this.addConstraint();
-}
-
-UnaryConstraint.inheritsFrom(Constraint);
-
-/**
- * Adds this constraint to the constraint graph
- */
-UnaryConstraint.prototype.addToGraph = function () {
-  this.myOutput.addConstraint(this);
-  this.satisfied = false;
-}
-
-/**
- * Decides if this constraint can be satisfied and records that
- * decision.
- */
-UnaryConstraint.prototype.chooseMethod = function (mark) {
-  this.satisfied = (this.myOutput.mark != mark)
-    && Strength.stronger(this.strength, this.myOutput.walkStrength);
-}
-
-/**
- * Returns true if this constraint is satisfied in the current solution.
- */
-UnaryConstraint.prototype.isSatisfied = function () {
-  return this.satisfied;
-}
-
-UnaryConstraint.prototype.markInputs = function (mark) {
-  // has no inputs
-}
-
-/**
- * Returns the current output variable.
- */
-UnaryConstraint.prototype.output = function () {
-  return this.myOutput;
-}
-
-/**
- * Calculate the walkabout strength, the stay flag, and, if it is
- * 'stay', the value for the current output of this constraint. Assume
- * this constraint is satisfied.
- */
-UnaryConstraint.prototype.recalculate = function () {
-  this.myOutput.walkStrength = this.strength;
-  this.myOutput.stay = !this.isInput();
-  if (this.myOutput.stay) this.execute(); // Stay optimization
-}
-
-/**
- * Records that this constraint is unsatisfied
- */
-UnaryConstraint.prototype.markUnsatisfied = function () {
-  this.satisfied = false;
-}
-
-UnaryConstraint.prototype.inputsKnown = function () {
-  return true;
-}
-
-UnaryConstraint.prototype.removeFromGraph = function () {
-  if (this.myOutput != null) this.myOutput.removeConstraint(this);
-  this.satisfied = false;
-}
-
-/* --- *
- * S t a y   C o n s t r a i n t
- * --- */
-
-/**
- * Variables that should, with some level of preference, stay the same.
- * Planners may exploit the fact that instances, if satisfied, will not
- * change their output during plan execution.  This is called "stay
- * optimization".
- */
-function StayConstraint(v, str) {
-  StayConstraint.superConstructor.call(this, v, str);
-}
-
-StayConstraint.inheritsFrom(UnaryConstraint);
-
-StayConstraint.prototype.execute = function () {
-  // Stay constraints do nothing
-}
-
-/* --- *
- * E d i t   C o n s t r a i n t
- * --- */
-
-/**
- * A unary input constraint used to mark a variable that the client
- * wishes to change.
- */
-function EditConstraint(v, str) {
-  EditConstraint.superConstructor.call(this, v, str);
-}
-
-EditConstraint.inheritsFrom(UnaryConstraint);
-
-/**
- * Edits indicate that a variable is to be changed by imperative code.
- */
-EditConstraint.prototype.isInput = function () {
-  return true;
-}
-
-EditConstraint.prototype.execute = function () {
-  // Edit constraints do nothing
-}
-
-/* --- *
- * B i n a r y   C o n s t r a i n t
- * --- */
-
-var Direction = new Object();
-Direction.NONE     = 0;
-Direction.FORWARD  = 1;
-Direction.BACKWARD = -1;
-
-/**
- * Abstract superclass for constraints having two possible output
- * variables.
- */
-function BinaryConstraint(var1, var2, strength) {
-  BinaryConstraint.superConstructor.call(this, strength);
-  this.v1 = var1;
-  this.v2 = var2;
-  this.direction = Direction.NONE;
-  this.addConstraint();
-}
-
-BinaryConstraint.inheritsFrom(Constraint);
-
-/**
- * Decides if this constraint can be satisfied and which way it
- * should flow based on the relative strength of the variables related,
- * and record that decision.
- */
-BinaryConstraint.prototype.chooseMethod = function (mark) {
-  if (this.v1.mark == mark) {
-    this.direction = (this.v2.mark != mark && Strength.stronger(this.strength, this.v2.walkStrength))
-      ? Direction.FORWARD
-      : Direction.NONE;
-  }
-  if (this.v2.mark == mark) {
-    this.direction = (this.v1.mark != mark && Strength.stronger(this.strength, this.v1.walkStrength))
-      ? Direction.BACKWARD
-      : Direction.NONE;
-  }
-  if (Strength.weaker(this.v1.walkStrength, this.v2.walkStrength)) {
-    this.direction = Strength.stronger(this.strength, this.v1.walkStrength)
-      ? Direction.BACKWARD
-      : Direction.NONE;
-  } else {
-    this.direction = Strength.stronger(this.strength, this.v2.walkStrength)
-      ? Direction.FORWARD
-      : Direction.BACKWARD
-  }
-}
-
-/**
- * Add this constraint to the constraint graph
- */
-BinaryConstraint.prototype.addToGraph = function () {
-  this.v1.addConstraint(this);
-  this.v2.addConstraint(this);
-  this.direction = Direction.NONE;
-}
-
-/**
- * Answer true if this constraint is satisfied in the current solution.
- */
-BinaryConstraint.prototype.isSatisfied = function () {
-  return this.direction != Direction.NONE;
-}
-
-/**
- * Mark the input variable with the given mark.
- */
-BinaryConstraint.prototype.markInputs = function (mark) {
-  this.input().mark = mark;
-}
-
-/**
- * Returns the current input variable
- */
-BinaryConstraint.prototype.input = function () {
-  return (this.direction == Direction.FORWARD) ? this.v1 : this.v2;
-}
-
-/**
- * Returns the current output variable
- */
-BinaryConstraint.prototype.output = function () {
-  return (this.direction == Direction.FORWARD) ? this.v2 : this.v1;
-}
-
-/**
- * Calculate the walkabout strength, the stay flag, and, if it is
- * 'stay', the value for the current output of this
- * constraint. Assume this constraint is satisfied.
- */
-BinaryConstraint.prototype.recalculate = function () {
-  var ihn = this.input(), out = this.output();
-  out.walkStrength = Strength.weakestOf(this.strength, ihn.walkStrength);
-  out.stay = ihn.stay;
-  if (out.stay) this.execute();
-}
-
-/**
- * Record the fact that this constraint is unsatisfied.
- */
-BinaryConstraint.prototype.markUnsatisfied = function () {
-  this.direction = Direction.NONE;
-}
-
-BinaryConstraint.prototype.inputsKnown = function (mark) {
-  var i = this.input();
-  return i.mark == mark || i.stay || i.determinedBy == null;
-}
-
-BinaryConstraint.prototype.removeFromGraph = function () {
-  if (this.v1 != null) this.v1.removeConstraint(this);
-  if (this.v2 != null) this.v2.removeConstraint(this);
-  this.direction = Direction.NONE;
-}
-
-/* --- *
- * S c a l e   C o n s t r a i n t
- * --- */
-
-/**
- * Relates two variables by the linear scaling relationship: "v2 =
- * (v1 * scale) + offset". Either v1 or v2 may be changed to maintain
- * this relationship but the scale factor and offset are considered
- * read-only.
- */
-function ScaleConstraint(src, scale, offset, dest, strength) {
-  this.direction = Direction.NONE;
-  this.scale = scale;
-  this.offset = offset;
-  ScaleConstraint.superConstructor.call(this, src, dest, strength);
-}
-
-ScaleConstraint.inheritsFrom(BinaryConstraint);
-
-/**
- * Adds this constraint to the constraint graph.
- */
-ScaleConstraint.prototype.addToGraph = function () {
-  ScaleConstraint.superConstructor.prototype.addToGraph.call(this);
-  this.scale.addConstraint(this);
-  this.offset.addConstraint(this);
-}
-
-ScaleConstraint.prototype.removeFromGraph = function () {
-  ScaleConstraint.superConstructor.prototype.removeFromGraph.call(this);
-  if (this.scale != null) this.scale.removeConstraint(this);
-  if (this.offset != null) this.offset.removeConstraint(this);
-}
-
-ScaleConstraint.prototype.markInputs = function (mark) {
-  ScaleConstraint.superConstructor.prototype.markInputs.call(this, mark);
-  this.scale.mark = this.offset.mark = mark;
-}
-
-/**
- * Enforce this constraint. Assume that it is satisfied.
- */
-ScaleConstraint.prototype.execute = function () {
-  if (this.direction == Direction.FORWARD) {
-    this.v2.value = this.v1.value * this.scale.value + this.offset.value;
-  } else {
-    this.v1.value = (this.v2.value - this.offset.value) / this.scale.value;
-  }
-}
-
-/**
- * Calculate the walkabout strength, the stay flag, and, if it is
- * 'stay', the value for the current output of this constraint. Assume
- * this constraint is satisfied.
- */
-ScaleConstraint.prototype.recalculate = function () {
-  var ihn = this.input(), out = this.output();
-  out.walkStrength = Strength.weakestOf(this.strength, ihn.walkStrength);
-  out.stay = ihn.stay && this.scale.stay && this.offset.stay;
-  if (out.stay) this.execute();
-}
-
-/* --- *
- * E q u a l i t  y   C o n s t r a i n t
- * --- */
-
-/**
- * Constrains two variables to have the same value.
- */
-function EqualityConstraint(var1, var2, strength) {
-  EqualityConstraint.superConstructor.call(this, var1, var2, strength);
-}
-
-EqualityConstraint.inheritsFrom(BinaryConstraint);
-
-/**
- * Enforce this constraint. Assume that it is satisfied.
- */
-EqualityConstraint.prototype.execute = function () {
-  this.output().value = this.input().value;
-}
-
-/* --- *
- * V a r i a b l e
- * --- */
-
-/**
- * A constrained variable. In addition to its value, it maintain the
- * structure of the constraint graph, the current dataflow graph, and
- * various parameters of interest to the DeltaBlue incremental
- * constraint solver.
- **/
-function Variable(name, initialValue) {
-  this.value = initialValue || 0;
-  this.constraints = new OrderedCollection();
-  this.determinedBy = null;
-  this.mark = 0;
-  this.walkStrength = Strength.WEAKEST;
-  this.stay = true;
-  this.name = name;
-}
-
-/**
- * Add the given constraint to the set of all constraints that refer
- * this variable.
- */
-Variable.prototype.addConstraint = function (c) {
-  this.constraints.add(c);
-}
-
-/**
- * Removes all traces of c from this variable.
- */
-Variable.prototype.removeConstraint = function (c) {
-  this.constraints.remove(c);
-  if (this.determinedBy == c) this.determinedBy = null;
-}
-
-/* --- *
- * P l a n n e r
- * --- */
-
-/**
- * The DeltaBlue planner
- */
-function Planner() {
-  this.currentMark = 0;
-}
-
-/**
- * Attempt to satisfy the given constraint and, if successful,
- * incrementally update the dataflow graph.  Details: If satifying
- * the constraint is successful, it may override a weaker constraint
- * on its output. The algorithm attempts to resatisfy that
- * constraint using some other method. This process is repeated
- * until either a) it reaches a variable that was not previously
- * determined by any constraint or b) it reaches a constraint that
- * is too weak to be satisfied using any of its methods. The
- * variables of constraints that have been processed are marked with
- * a unique mark value so that we know where we've been. This allows
- * the algorithm to avoid getting into an infinite loop even if the
- * constraint graph has an inadvertent cycle.
- */
-Planner.prototype.incrementalAdd = function (c) {
-  var mark = this.newMark();
-  var overridden = c.satisfy(mark);
-  while (overridden != null)
-    overridden = overridden.satisfy(mark);
-}
-
-/**
- * Entry point for retracting a constraint. Remove the given
- * constraint and incrementally update the dataflow graph.
- * Details: Retracting the given constraint may allow some currently
- * unsatisfiable downstream constraint to be satisfied. We therefore collect
- * a list of unsatisfied downstream constraints and attempt to
- * satisfy each one in turn. This list is traversed by constraint
- * strength, strongest first, as a heuristic for avoiding
- * unnecessarily adding and then overriding weak constraints.
- * Assume: c is satisfied.
- */
-Planner.prototype.incrementalRemove = function (c) {
-  var out = c.output();
-  c.markUnsatisfied();
-  c.removeFromGraph();
-  var unsatisfied = this.removePropagateFrom(out);
-  var strength = Strength.REQUIRED;
-  do {
-    for (var i = 0; i < unsatisfied.size(); i++) {
-      var u = unsatisfied.at(i);
-      if (u.strength == strength)
-        this.incrementalAdd(u);
-    }
-    strength = strength.nextWeaker();
-  } while (strength != Strength.WEAKEST);
-}
-
-/**
- * Select a previously unused mark value.
- */
-Planner.prototype.newMark = function () {
-  return ++this.currentMark;
-}
-
-/**
- * Extract a plan for resatisfaction starting from the given source
- * constraints, usually a set of input constraints. This method
- * assumes that stay optimization is desired; the plan will contain
- * only constraints whose output variables are not stay. Constraints
- * that do no computation, such as stay and edit constraints, are
- * not included in the plan.
- * Details: The outputs of a constraint are marked when it is added
- * to the plan under construction. A constraint may be appended to
- * the plan when all its input variables are known. A variable is
- * known if either a) the variable is marked (indicating that has
- * been computed by a constraint appearing earlier in the plan), b)
- * the variable is 'stay' (i.e. it is a constant at plan execution
- * time), or c) the variable is not determined by any
- * constraint. The last provision is for past states of history
- * variables, which are not stay but which are also not computed by
- * any constraint.
- * Assume: sources are all satisfied.
- */
-Planner.prototype.makePlan = function (sources) {
-  var mark = this.newMark();
-  var plan = new Plan();
-  var todo = sources;
-  while (todo.size() > 0) {
-    var c = todo.removeFirst();
-    if (c.output().mark != mark && c.inputsKnown(mark)) {
-      plan.addConstraint(c);
-      c.output().mark = mark;
-      this.addConstraintsConsumingTo(c.output(), todo);
-    }
-  }
-  return plan;
-}
-
-/**
- * Extract a plan for resatisfying starting from the output of the
- * given constraints, usually a set of input constraints.
- */
-Planner.prototype.extractPlanFromConstraints = function (constraints) {
-  var sources = new OrderedCollection();
-  for (var i = 0; i < constraints.size(); i++) {
-    var c = constraints.at(i);
-    if (c.isInput() && c.isSatisfied())
-      // not in plan already and eligible for inclusion
-      sources.add(c);
-  }
-  return this.makePlan(sources);
-}
-
-/**
- * Recompute the walkabout strengths and stay flags of all variables
- * downstream of the given constraint and recompute the actual
- * values of all variables whose stay flag is true. If a cycle is
- * detected, remove the given constraint and answer
- * false. Otherwise, answer true.
- * Details: Cycles are detected when a marked variable is
- * encountered downstream of the given constraint. The sender is
- * assumed to have marked the inputs of the given constraint with
- * the given mark. Thus, encountering a marked node downstream of
- * the output constraint means that there is a path from the
- * constraint's output to one of its inputs.
- */
-Planner.prototype.addPropagate = function (c, mark) {
-  var todo = new OrderedCollection();
-  todo.add(c);
-  while (todo.size() > 0) {
-    var d = todo.removeFirst();
-    if (d.output().mark == mark) {
-      this.incrementalRemove(c);
-      return false;
-    }
-    d.recalculate();
-    this.addConstraintsConsumingTo(d.output(), todo);
-  }
-  return true;
-}
-
-
-/**
- * Update the walkabout strengths and stay flags of all variables
- * downstream of the given constraint. Answer a collection of
- * unsatisfied constraints sorted in order of decreasing strength.
- */
-Planner.prototype.removePropagateFrom = function (out) {
-  out.determinedBy = null;
-  out.walkStrength = Strength.WEAKEST;
-  out.stay = true;
-  var unsatisfied = new OrderedCollection();
-  var todo = new OrderedCollection();
-  todo.add(out);
-  while (todo.size() > 0) {
-    var v = todo.removeFirst();
-    for (var i = 0; i < v.constraints.size(); i++) {
-      var c = v.constraints.at(i);
-      if (!c.isSatisfied())
-        unsatisfied.add(c);
-    }
-    var determining = v.determinedBy;
-    for (var i = 0; i < v.constraints.size(); i++) {
-      var next = v.constraints.at(i);
-      if (next != determining && next.isSatisfied()) {
-        next.recalculate();
-        todo.add(next.output());
-      }
-    }
-  }
-  return unsatisfied;
-}
-
-Planner.prototype.addConstraintsConsumingTo = function (v, coll) {
-  var determining = v.determinedBy;
-  var cc = v.constraints;
-  for (var i = 0; i < cc.size(); i++) {
-    var c = cc.at(i);
-    if (c != determining && c.isSatisfied())
-      coll.add(c);
-  }
-}
-
-/* --- *
- * P l a n
- * --- */
-
-/**
- * A Plan is an ordered list of constraints to be executed in sequence
- * to resatisfy all currently satisfiable constraints in the face of
- * one or more changing inputs.
- */
-function Plan() {
-  this.v = new OrderedCollection();
-}
-
-Plan.prototype.addConstraint = function (c) {
-  this.v.add(c);
-}
-
-Plan.prototype.size = function () {
-  return this.v.size();
-}
-
-Plan.prototype.constraintAt = function (index) {
-  return this.v.at(index);
-}
-
-Plan.prototype.execute = function () {
-  for (var i = 0; i < this.size(); i++) {
-    var c = this.constraintAt(i);
-    c.execute();
-  }
-}
-
-/* --- *
- * M a i n
- * --- */
-
-/**
- * This is the standard DeltaBlue benchmark. A long chain of equality
- * constraints is constructed with a stay constraint on one end. An
- * edit constraint is then added to the opposite end and the time is
- * measured for adding and removing this constraint, and extracting
- * and executing a constraint satisfaction plan. There are two cases.
- * In case 1, the added constraint is stronger than the stay
- * constraint and values must propagate down the entire length of the
- * chain. In case 2, the added constraint is weaker than the stay
- * constraint so it cannot be accommodated. The cost in this case is,
- * of course, very low. Typical situations lie somewhere between these
- * two extremes.
- */
-function chainTest(n) {
-  planner = new Planner();
-  var prev = null, first = null, last = null;
-
-  // Build chain of n equality constraints
-  for (var i = 0; i <= n; i++) {
-    var name = "v" + i;
-    var v = new Variable(name);
-    if (prev != null)
-      new EqualityConstraint(prev, v, Strength.REQUIRED);
-    if (i == 0) first = v;
-    if (i == n) last = v;
-    prev = v;
-  }
-
-  new StayConstraint(last, Strength.STRONG_DEFAULT);
-  var edit = new EditConstraint(first, Strength.PREFERRED);
-  var edits = new OrderedCollection();
-  edits.add(edit);
-  var plan = planner.extractPlanFromConstraints(edits);
-  for (var i = 0; i < 100; i++) {
-    first.value = i;
-    plan.execute();
-    if (last.value != i)
-      alert("Chain test failed.");
-  }
-}
-
-/**
- * This test constructs a two sets of variables related to each
- * other by a simple linear transformation (scale and offset). The
- * time is measured to change a variable on either side of the
- * mapping and to change the scale and offset factors.
- */
-function projectionTest(n) {
-  planner = new Planner();
-  var scale = new Variable("scale", 10);
-  var offset = new Variable("offset", 1000);
-  var src = null, dst = null;
-
-  var dests = new OrderedCollection();
-  for (var i = 0; i < n; i++) {
-    src = new Variable("src" + i, i);
-    dst = new Variable("dst" + i, i);
-    dests.add(dst);
-    new StayConstraint(src, Strength.NORMAL);
-    new ScaleConstraint(src, scale, offset, dst, Strength.REQUIRED);
-  }
-
-  change(src, 17);
-  if (dst.value != 1170) alert("Projection 1 failed");
-  change(dst, 1050);
-  if (src.value != 5) alert("Projection 2 failed");
-  change(scale, 5);
-  for (var i = 0; i < n - 1; i++) {
-    if (dests.at(i).value != i * 5 + 1000)
-      alert("Projection 3 failed");
-  }
-  change(offset, 2000);
-  for (var i = 0; i < n - 1; i++) {
-    if (dests.at(i).value != i * 5 + 2000)
-      alert("Projection 4 failed");
-  }
-}
-
-function change(v, newValue) {
-  var edit = new EditConstraint(v, Strength.PREFERRED);
-  var edits = new OrderedCollection();
-  edits.add(edit);
-  var plan = planner.extractPlanFromConstraints(edits);
-  for (var i = 0; i < 10; i++) {
-    v.value = newValue;
-    plan.execute();
-  }
-  edit.destroyConstraint();
-}
-
-// Global variable holding the current planner.
-var planner = null;
-
-function deltaBlue() {
-  chainTest(100);
-  projectionTest(100);
-}
diff --git a/deps/v8/benchmarks/earley-boyer.js b/deps/v8/benchmarks/earley-boyer.js
deleted file mode 100644
index b2328d6ba1d1ac..00000000000000
--- a/deps/v8/benchmarks/earley-boyer.js
+++ /dev/null
@@ -1,4684 +0,0 @@
-// This file is automatically generated by scheme2js, except for the
-// benchmark harness code at the beginning and end of the file.
-
-var EarleyBoyer = new BenchmarkSuite('EarleyBoyer', 666463, [
-  new Benchmark("Earley", function () { BgL_earleyzd2benchmarkzd2(); }),
-  new Benchmark("Boyer", function () { BgL_nboyerzd2benchmarkzd2(); })
-]);
-
-
-/************* GENERATED FILE - DO NOT EDIT *************/
-/************* GENERATED FILE - DO NOT EDIT *************/
-/************* GENERATED FILE - DO NOT EDIT *************/
-/************* GENERATED FILE - DO NOT EDIT *************/
-/************* GENERATED FILE - DO NOT EDIT *************/
-/************* GENERATED FILE - DO NOT EDIT *************/
-/************* GENERATED FILE - DO NOT EDIT *************/
-/************* GENERATED FILE - DO NOT EDIT *************/
-/*
- * To use write/prints/... the default-output port has to be set first.
- * Simply setting SC_DEFAULT_OUT and SC_ERROR_OUT to the desired values
- * should do the trick.
- * In the following example the std-out and error-port are redirected to
- * a DIV.
-function initRuntime() {
-    function escapeHTML(s) {
-	var tmp = s;
-	tmp = tmp.replace(/&/g, "&amp;");
-	tmp = tmp.replace(/</g, "&lt;");
-	tmp = tmp.replace(/>/g, "&gt;");
-	tmp = tmp.replace(/ /g, "&nbsp;");
-	tmp = tmp.replace(/\n/g, "<br />");
-	tmp = tmp.replace(/\t/g, "&nbsp;&nbsp;&nbsp;&nbsp");
-	return tmp;
-	
-    }
-
-    document.write("<div id='stdout'></div>");
-    SC_DEFAULT_OUT = new sc_GenericOutputPort(
-	function(s) {
-	    var stdout = document.getElementById('stdout');
-	    stdout.innerHTML = stdout.innerHTML + escapeHTML(s);
-	});
-    SC_ERROR_OUT = SC_DEFAULT_OUT;
-}
-*/
-
-
-function sc_print_debug() {
-    sc_print.apply(null, arguments);
-}
-/*** META ((export *js*)) */
-var sc_JS_GLOBALS = this;
-
-var __sc_LINE=-1;
-var __sc_FILE="";
-
-/*** META ((export #t)) */
-function sc_alert() {
-   var len = arguments.length;
-   var s = "";
-   var i;
-
-   for( i = 0; i < len; i++ ) {
-       s += sc_toDisplayString(arguments[ i ]);
-   }
-
-   return alert( s );
-}
-
-/*** META ((export #t)) */
-function sc_typeof( x ) {
-   return typeof x;
-}
-
-/*** META ((export #t)) */
-function sc_error() {
-    var a = [sc_jsstring2symbol("*error*")];
-    for (var i = 0; i < arguments.length; i++) {
-	a[i+1] = arguments[i];
-    }
-    throw a;
-}
-
-/*** META ((export #t)
-           (peephole (prefix "throw ")))
-*/
-function sc_raise(obj) {
-    throw obj;
-}
-
-/*** META ((export with-handler-lambda)) */
-function sc_withHandlerLambda(handler, body) {
-    try {
-	return body();
-    } catch(e) {
-	if (!e._internalException)
-	    return handler(e);
-	else
-	    throw e;
-    }
-}
-
-var sc_properties = new Object();
-
-/*** META ((export #t)) */
-function sc_putpropBang(sym, key, val) {
-    var ht = sc_properties[sym];
-    if (!ht) {
-	ht = new Object();
-	sc_properties[sym] = ht;
-    }
-    ht[key] = val;
-}
-
-/*** META ((export #t)) */
-function sc_getprop(sym, key) {
-    var ht = sc_properties[sym];
-    if (ht) {
-	if (key in ht)
-	    return ht[key];
-	else
-	    return false;
-    } else
-	return false;
-}
-
-/*** META ((export #t)) */
-function sc_rempropBang(sym, key) {
-    var ht = sc_properties[sym];
-    if (ht)
-	delete ht[key];
-}
-
-/*** META ((export #t)) */
-function sc_any2String(o) {
-    return jsstring2string(sc_toDisplayString(o));
-}
-
-/*** META ((export #t)
-           (peephole (infix 2 2 "==="))
-           (type bool))
-*/
-function sc_isEqv(o1, o2) {
-    return (o1 === o2);
-}
-
-/*** META ((export #t)
-           (peephole (infix 2 2 "==="))
-           (type bool))
-*/
-function sc_isEq(o1, o2) {
-    return (o1 === o2);
-}
-
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isNumber(n) {
-    return (typeof n === "number");
-}
-
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isComplex(n) {
-    return sc_isNumber(n);
-}
-
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isReal(n) {
-    return sc_isNumber(n);
-}
-
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isRational(n) {
-    return sc_isReal(n);
-}
-
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isInteger(n) {
-    return (parseInt(n) === n);
-}
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (postfix ", false")))
-*/
-// we don't have exact numbers...
-function sc_isExact(n) {
-    return false;
-}
-
-/*** META ((export #t)
-           (peephole (postfix ", true"))
-	   (type bool))
-*/
-function sc_isInexact(n) {
-    return true;
-}
-
-/*** META ((export = =fx =fl)
-           (type bool)
-           (peephole (infix 2 2 "===")))
-*/
-function sc_equal(x) {
-    for (var i = 1; i < arguments.length; i++)
-	if (x !== arguments[i])
-	    return false;
-    return true;
-}
-
-/*** META ((export < <fx <fl)
-           (type bool)
-           (peephole (infix 2 2 "<")))
-*/
-function sc_less(x) {
-    for (var i = 1; i < arguments.length; i++) {
-	if (x >= arguments[i])
-	    return false;
-	x = arguments[i];
-    }
-    return true;
-}
-
-/*** META ((export > >fx >fl)
-           (type bool)
-           (peephole (infix 2 2 ">")))
-*/
-function sc_greater(x, y) {
-    for (var i = 1; i < arguments.length; i++) {
-	if (x <= arguments[i])
-	    return false;
-	x = arguments[i];
-    }
-    return true;
-}
-
-/*** META ((export <= <=fx <=fl)
-           (type bool)
-           (peephole (infix 2 2 "<=")))
-*/
-function sc_lessEqual(x, y) {
-    for (var i = 1; i < arguments.length; i++) {
-	if (x > arguments[i])
-	    return false;
-	x = arguments[i];
-    }
-    return true;
-}
-
-/*** META ((export >= >=fl >=fx)
-           (type bool)
-           (peephole (infix 2 2 ">=")))
-*/
-function sc_greaterEqual(x, y) {
-    for (var i = 1; i < arguments.length; i++) {
-	if (x < arguments[i])
-	    return false;
-	x = arguments[i];
-    }
-    return true;
-}
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (postfix "=== 0")))
-*/
-function sc_isZero(x) {
-    return (x === 0);
-}
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (postfix "> 0")))
-*/
-function sc_isPositive(x) {
-    return (x > 0);
-}
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (postfix "< 0")))
-*/
-function sc_isNegative(x) {
-    return (x < 0);
-}
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (postfix "%2===1")))
-*/
-function sc_isOdd(x) {
-    return (x % 2 === 1);
-}
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (postfix "%2===0")))
-*/
-function sc_isEven(x) {
-    return (x % 2 === 0);
-}
-
-/*** META ((export #t)) */
-var sc_max = Math.max;
-/*** META ((export #t)) */
-var sc_min = Math.min;
-
-/*** META ((export + +fx +fl)
-           (peephole (infix 0 #f "+" "0")))
-*/
-function sc_plus() {
-    var sum = 0;
-    for (var i = 0; i < arguments.length; i++)
-	sum += arguments[i];
-    return sum;
-}
-
-/*** META ((export * *fx *fl)
-           (peephole (infix 0 #f "*" "1")))
-*/
-function sc_multi() {
-    var product = 1;
-    for (var i = 0; i < arguments.length; i++)
-	product *= arguments[i];
-    return product;
-}
-
-/*** META ((export - -fx -fl)
-           (peephole (minus)))
-*/
-function sc_minus(x) {
-    if (arguments.length === 1)
-	return -x;
-    else {
-	var res = x;
-	for (var i = 1; i < arguments.length; i++)
-	    res -= arguments[i];
-	return res;
-    }
-}
-
-/*** META ((export / /fl)
-           (peephole (div)))
-*/
-function sc_div(x) {
-    if (arguments.length === 1)
-	return 1/x;
-    else {
-	var res = x;
-	for (var i = 1; i < arguments.length; i++)
-	    res /= arguments[i];
-	return res;
-    }
-}
-
-/*** META ((export #t)) */
-var sc_abs = Math.abs;
-
-/*** META ((export quotient /fx)
-           (peephole (hole 2 "parseInt(" x "/" y ")")))
-*/
-function sc_quotient(x, y) {
-    return parseInt(x / y);
-}
-
-/*** META ((export #t)
-           (peephole (infix 2 2 "%")))
-*/
-function sc_remainder(x, y) {
-    return x % y;
-}
-
-/*** META ((export #t)
-           (peephole (modulo)))
-*/
-function sc_modulo(x, y) {
-    var remainder = x % y;
-    // if they don't have the same sign
-    if ((remainder * y) < 0)
-	return remainder + y;
-    else
-	return remainder;
-}
-
-function sc_euclid_gcd(a, b) {
-    var temp;
-    if (a === 0) return b;
-    if (b === 0) return a;
-    if (a < 0) {a = -a;};
-    if (b < 0) {b = -b;};
-    if (b > a) {temp = a; a = b; b = temp;};
-    while (true) {
-	a %= b;
-	if(a === 0) {return b;};
-	b %= a;
-	if(b === 0) {return a;};
-    };
-    return b;
-}
-
-/*** META ((export #t)) */
-function sc_gcd() {
-    var gcd = 0;
-    for (var i = 0; i < arguments.length; i++)
-	gcd = sc_euclid_gcd(gcd, arguments[i]);
-    return gcd;
-}
-
-/*** META ((export #t)) */
-function sc_lcm() {
-    var lcm = 1;
-    for (var i = 0; i < arguments.length; i++) {
-	var f = Math.round(arguments[i] / sc_euclid_gcd(arguments[i], lcm));
-	lcm *= Math.abs(f);
-    }
-    return lcm;
-}
-
-// LIMITATION: numerator and denominator don't make sense in floating point world.
-//var SC_MAX_DECIMALS = 1000000
-//
-// function sc_numerator(x) {
-//     var rounded = Math.round(x * SC_MAX_DECIMALS);
-//     return Math.round(rounded / sc_euclid_gcd(rounded, SC_MAX_DECIMALS));
-// }
-
-// function sc_denominator(x) {
-//     var rounded = Math.round(x * SC_MAX_DECIMALS);
-//     return Math.round(SC_MAX_DECIMALS / sc_euclid_gcd(rounded, SC_MAX_DECIMALS));
-// }
-
-/*** META ((export #t)) */
-var sc_floor = Math.floor;
-/*** META ((export #t)) */
-var sc_ceiling = Math.ceil;
-/*** META ((export #t)) */
-var sc_truncate = parseInt;
-/*** META ((export #t)) */
-var sc_round = Math.round;
-
-// LIMITATION: sc_rationalize doesn't make sense in a floating point world.
-
-/*** META ((export #t)) */
-var sc_exp = Math.exp;
-/*** META ((export #t)) */
-var sc_log = Math.log;
-/*** META ((export #t)) */
-var sc_sin = Math.sin;
-/*** META ((export #t)) */
-var sc_cos = Math.cos;
-/*** META ((export #t)) */
-var sc_tan = Math.tan;
-/*** META ((export #t)) */
-var sc_asin = Math.asin;
-/*** META ((export #t)) */
-var sc_acos = Math.acos;
-/*** META ((export #t)) */
-var sc_atan = Math.atan;
-
-/*** META ((export #t)) */
-var sc_sqrt = Math.sqrt;
-/*** META ((export #t)) */
-var sc_expt = Math.pow;
-
-// LIMITATION: we don't have complex numbers.
-// LIMITATION: the following functions are hence not implemented.
-// LIMITATION: make-rectangular, make-polar, real-part, imag-part, magnitude, angle
-// LIMITATION: 2 argument atan
-
-/*** META ((export #t)
-           (peephole (id)))
-*/
-function sc_exact2inexact(x) {
-    return x;
-}
-
-/*** META ((export #t)
-           (peephole (id)))
-*/
-function sc_inexact2exact(x) {
-    return x;
-}
-
-function sc_number2jsstring(x, radix) {
-    if (radix)
-	return x.toString(radix);
-    else
-	return x.toString();
-}
-
-function sc_jsstring2number(s, radix) {
-    if (s === "") return false;
-
-    if (radix) {
-	var t = parseInt(s, radix);
-	if (!t && t !== 0) return false;
-	// verify that each char is in range. (parseInt ignores leading
-	// white and trailing chars)
-	var allowedChars = "01234567890abcdefghijklmnopqrstuvwxyz".substring(0, radix+1);
-	if ((new RegExp("^["+allowedChars+"]*$", "i")).test(s))
-	    return t;
-	else return false;
-    } else {
-	var t = +s; // does not ignore trailing chars.
-	if (!t && t !== 0) return false;
-	// simply verify that first char is not whitespace.
-	var c = s.charAt(0);
-	// if +c is 0, but the char is not "0", then we have a whitespace.
-	if (+c === 0 && c !== "0") return false;
-	return t;
-    }
-}
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (not)))
-*/
-function sc_not(b) {
-    return b === false;
-}
-
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isBoolean(b) {
-    return (b === true) || (b === false);
-}
-
-function sc_Pair(car, cdr) {
-    this.car = car;
-    this.cdr = cdr;
-}
-
-sc_Pair.prototype.toString = function() {
-    return sc_toDisplayString(this);
-};
-sc_Pair.prototype.sc_toWriteOrDisplayString = function(writeOrDisplay) {
-    var current = this;
-
-    var res = "(";
-
-    while(true) {
-	res += writeOrDisplay(current.car);
-	if (sc_isPair(current.cdr)) {
-	    res += " ";
-	    current = current.cdr;
-	} else if (current.cdr !== null) {
-	    res += " . " + writeOrDisplay(current.cdr);
-	    break;
-	} else // current.cdr == null
-	    break;
-    }
-	
-    res += ")";
-
-    return res;
-};
-sc_Pair.prototype.sc_toDisplayString = function() {
-    return this.sc_toWriteOrDisplayString(sc_toDisplayString);
-};
-sc_Pair.prototype.sc_toWriteString = function() {
-    return this.sc_toWriteOrDisplayString(sc_toWriteString);
-};
-// sc_Pair.prototype.sc_toWriteCircleString in IO.js
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (postfix " instanceof sc_Pair")))
-*/
-function sc_isPair(p) {
-    return (p instanceof sc_Pair);
-}
-
-function sc_isPairEqual(p1, p2, comp) {
-    return (comp(p1.car, p2.car) && comp(p1.cdr, p2.cdr));
-}
-
-/*** META ((export #t)
-           (peephole (hole 2 "new sc_Pair(" car ", " cdr ")")))
-*/
-function sc_cons(car, cdr) {
-    return new sc_Pair(car, cdr);
-}
-
-/*** META ((export cons*)) */
-function sc_consStar() {
-    var res = arguments[arguments.length - 1];
-    for (var i = arguments.length-2; i >= 0; i--)
-	res = new sc_Pair(arguments[i], res);
-    return res;
-}
-
-/*** META ((export #t)
-           (peephole (postfix ".car")))
-*/
-function sc_car(p) {
-    return p.car;
-}
-
-/*** META ((export #t)
-           (peephole (postfix ".cdr")))
-*/
-function sc_cdr(p) {
-    return p.cdr;
-}
-
-/*** META ((export #t)
-           (peephole (hole 2 p ".car = " val)))
-*/
-function sc_setCarBang(p, val) {
-    p.car = val;
-}
-
-/*** META ((export #t)
-           (peephole (hole 2 p ".cdr = " val)))
-*/
-function sc_setCdrBang(p, val) {
-    p.cdr = val;
-}
-
-/*** META ((export #t)
-           (peephole (postfix ".car.car")))
-*/
-function sc_caar(p) { return p.car.car; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.car")))
-*/
-function sc_cadr(p) { return p.cdr.car; }
-/*** META ((export #t)
-           (peephole (postfix ".car.cdr")))
-*/
-function sc_cdar(p) { return p.car.cdr; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.cdr")))
-*/
-function sc_cddr(p) { return p.cdr.cdr; }
-/*** META ((export #t)
-           (peephole (postfix ".car.car.car")))
-*/
-function sc_caaar(p) { return p.car.car.car; }
-/*** META ((export #t)
-           (peephole (postfix ".car.cdr.car")))
-*/
-function sc_cadar(p) { return p.car.cdr.car; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.car.car")))
-*/
-function sc_caadr(p) { return p.cdr.car.car; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.cdr.car")))
-*/
-function sc_caddr(p) { return p.cdr.cdr.car; }
-/*** META ((export #t)
-           (peephole (postfix ".car.car.cdr")))
-*/
-function sc_cdaar(p) { return p.car.car.cdr; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.car.cdr")))
-*/
-function sc_cdadr(p) { return p.cdr.car.cdr; }
-/*** META ((export #t)
-           (peephole (postfix ".car.cdr.cdr")))
-*/
-function sc_cddar(p) { return p.car.cdr.cdr; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.cdr.cdr")))
-*/
-function sc_cdddr(p) { return p.cdr.cdr.cdr; }
-/*** META ((export #t)
-           (peephole (postfix ".car.car.car.car")))
-*/
-function sc_caaaar(p) { return p.car.car.car.car; }
-/*** META ((export #t)
-           (peephole (postfix ".car.cdr.car.car")))
-*/
-function sc_caadar(p) { return p.car.cdr.car.car; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.car.car.car")))
-*/
-function sc_caaadr(p) { return p.cdr.car.car.car; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.cdr.car.car")))
-*/
-function sc_caaddr(p) { return p.cdr.cdr.car.car; }
-/*** META ((export #t)
-           (peephole (postfix ".car.car.car.cdr")))
-*/
-function sc_cdaaar(p) { return p.car.car.car.cdr; }
-/*** META ((export #t)
-           (peephole (postfix ".car.cdr.car.cdr")))
-*/
-function sc_cdadar(p) { return p.car.cdr.car.cdr; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.car.car.cdr")))
-*/
-function sc_cdaadr(p) { return p.cdr.car.car.cdr; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.cdr.car.cdr")))
-*/
-function sc_cdaddr(p) { return p.cdr.cdr.car.cdr; }
-/*** META ((export #t)
-           (peephole (postfix ".car.car.cdr.car")))
-*/
-function sc_cadaar(p) { return p.car.car.cdr.car; }
-/*** META ((export #t)
-           (peephole (postfix ".car.cdr.cdr.car")))
-*/
-function sc_caddar(p) { return p.car.cdr.cdr.car; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.car.cdr.car")))
-*/
-function sc_cadadr(p) { return p.cdr.car.cdr.car; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.cdr.cdr.car")))
-*/
-function sc_cadddr(p) { return p.cdr.cdr.cdr.car; }
-/*** META ((export #t)
-           (peephole (postfix ".car.car.cdr.cdr")))
-*/
-function sc_cddaar(p) { return p.car.car.cdr.cdr; }
-/*** META ((export #t)
-           (peephole (postfix ".car.cdr.cdr.cdr")))
-*/
-function sc_cdddar(p) { return p.car.cdr.cdr.cdr; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.car.cdr.cdr")))
-*/
-function sc_cddadr(p) { return p.cdr.car.cdr.cdr; }
-/*** META ((export #t)
-           (peephole (postfix ".cdr.cdr.cdr.cdr")))
-*/
-function sc_cddddr(p) { return p.cdr.cdr.cdr.cdr; }
-
-/*** META ((export #t)) */
-function sc_lastPair(l) {
-    if (!sc_isPair(l)) sc_error("sc_lastPair: pair expected");
-    var res = l;
-    var cdr = l.cdr;
-    while (sc_isPair(cdr)) {
-	res = cdr;
-	cdr = res.cdr;
-    }
-    return res;
-}
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (postfix " === null")))
-*/
-function sc_isNull(o) {
-    return (o === null);
-}
-
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isList(o) {
-    var rabbit;
-    var turtle;
-
-    var rabbit = o;
-    var turtle = o;
-    while (true) {
-	if (rabbit === null ||
-	    (rabbit instanceof sc_Pair && rabbit.cdr === null))
-	    return true;  // end of list
-	else if ((rabbit instanceof sc_Pair) &&
-		 (rabbit.cdr instanceof sc_Pair)) {
-	    rabbit = rabbit.cdr.cdr;
-	    turtle = turtle.cdr;
-	    if (rabbit === turtle) return false; // cycle
-	} else
-	    return false; // not pair
-    }
-}
-
-/*** META ((export #t)) */
-function sc_list() {
-    var res = null;
-    var a = arguments;
-    for (var i = a.length-1; i >= 0; i--)
-	res = new sc_Pair(a[i], res);
-    return res;
-}
-
-/*** META ((export #t)) */
-function sc_iota(num, init) {
-   var res = null;
-   if (!init) init = 0;
-   for (var i = num - 1; i >= 0; i--)
-      res = new sc_Pair(i + init, res);
-   return res;
-}
-
-/*** META ((export #t)) */
-function sc_makeList(nbEls, fill) {
-    var res = null;
-    for (var i = 0; i < nbEls; i++)
-	res = new sc_Pair(fill, res);
-    return res;
-}
-
-/*** META ((export #t)) */
-function sc_length(l) {
-    var res = 0;
-    while (l !== null) {
-	res++;
-	l = l.cdr;
-    }
-    return res;
-}
-
-/*** META ((export #t)) */
-function sc_remq(o, l) {
-    var dummy = { cdr : null };
-    var tail = dummy;
-    while (l !== null) {
-	if (l.car !== o) {
-	    tail.cdr = sc_cons(l.car, null);
-	    tail = tail.cdr;
-	}
-	l = l.cdr;
-    }
-    return dummy.cdr;
-}
-
-/*** META ((export #t)) */
-function sc_remqBang(o, l) {
-    var dummy = { cdr : null };
-    var tail = dummy;
-    var needsAssig = true;
-    while (l !== null) {
-	if (l.car === o) {
-	    needsAssig = true;
-	} else {
-	    if (needsAssig) {
-		tail.cdr = l;
-		needsAssig = false;
-	    }
-	    tail = l;
-	}
-	l = l.cdr;
-    }
-    tail.cdr = null;
-    return dummy.cdr;
-}
-
-/*** META ((export #t)) */
-function sc_delete(o, l) {
-    var dummy = { cdr : null };
-    var tail = dummy;
-    while (l !== null) {
-	if (!sc_isEqual(l.car, o)) {
-	    tail.cdr = sc_cons(l.car, null);
-	    tail = tail.cdr;
-	}
-	l = l.cdr;
-    }
-    return dummy.cdr;
-}
-
-/*** META ((export #t)) */
-function sc_deleteBang(o, l) {
-    var dummy = { cdr : null };
-    var tail = dummy;
-    var needsAssig = true;
-    while (l !== null) {
-	if (sc_isEqual(l.car, o)) {
-	    needsAssig = true;
-	} else {
-	    if (needsAssig) {
-		tail.cdr = l;
-		needsAssig = false;
-	    }
-	    tail = l;
-	}
-	l = l.cdr;
-    }
-    tail.cdr = null;
-    return dummy.cdr;
-}
-
-function sc_reverseAppendBang(l1, l2) {
-    var res = l2;
-    while (l1 !== null) {
-	var tmp = res;
-	res = l1;
-	l1 = l1.cdr;
-	res.cdr = tmp;
-    }
-    return res;
-}
-	
-function sc_dualAppend(l1, l2) {
-    if (l1 === null) return l2;
-    if (l2 === null) return l1;
-    var rev = sc_reverse(l1);
-    return sc_reverseAppendBang(rev, l2);
-}
-
-/*** META ((export #t)) */
-function sc_append() {
-    if (arguments.length === 0)
-	return null;
-    var res = arguments[arguments.length - 1];
-    for (var i = arguments.length - 2; i >= 0; i--)
-	res = sc_dualAppend(arguments[i], res);
-    return res;
-}
-
-function sc_dualAppendBang(l1, l2) {
-    if (l1 === null) return l2;
-    if (l2 === null) return l1;
-    var tmp = l1;
-    while (tmp.cdr !== null) tmp=tmp.cdr;
-    tmp.cdr = l2;
-    return l1;
-}
-
-/*** META ((export #t)) */
-function sc_appendBang() {
-    var res = null;
-    for (var i = 0; i < arguments.length; i++)
-	res = sc_dualAppendBang(res, arguments[i]);
-    return res;
-}
-
-/*** META ((export #t)) */
-function sc_reverse(l1) {
-    var res = null;
-    while (l1 !== null) {
-	res = sc_cons(l1.car, res);
-	l1 = l1.cdr;
-    }
-    return res;
-}
-
-/*** META ((export #t)) */
-function sc_reverseBang(l) {
-    return sc_reverseAppendBang(l, null);
-}
-
-/*** META ((export #t)) */
-function sc_listTail(l, k) {
-    var res = l;
-    for (var i = 0; i < k; i++) {
-	res = res.cdr;
-    }
-    return res;
-}
-
-/*** META ((export #t)) */
-function sc_listRef(l, k) {
-    return sc_listTail(l, k).car;
-}
-
-/* // unoptimized generic versions
-function sc_memX(o, l, comp) {
-    while (l != null) {
-	if (comp(l.car, o))
-	    return l;
-	l = l.cdr;
-    }
-    return false;
-}
-function sc_memq(o, l) { return sc_memX(o, l, sc_isEq); }
-function sc_memv(o, l) { return sc_memX(o, l, sc_isEqv); }
-function sc_member(o, l) { return sc_memX(o, l, sc_isEqual); }
-*/
-
-/* optimized versions */
-/*** META ((export #t)) */
-function sc_memq(o, l) {
-    while (l !== null) {
-	if (l.car === o)
-	    return l;
-	l = l.cdr;
-    }
-    return false;
-}
-/*** META ((export #t)) */
-function sc_memv(o, l) {
-    while (l !== null) {
-	if (l.car === o)
-	    return l;
-	l = l.cdr;
-    }
-    return false;
-}
-/*** META ((export #t)) */
-function sc_member(o, l) {
-    while (l !== null) {
-	if (sc_isEqual(l.car,o))
-	    return l;
-	l = l.cdr;
-    }
-    return false;
-}
-
-/* // generic unoptimized versions
-function sc_assX(o, al, comp) {
-    while (al != null) {
-	if (comp(al.car.car, o))
-	    return al.car;
-	al = al.cdr;
-    }
-    return false;
-}
-function sc_assq(o, al) { return sc_assX(o, al, sc_isEq); }
-function sc_assv(o, al) { return sc_assX(o, al, sc_isEqv); }
-function sc_assoc(o, al) { return sc_assX(o, al, sc_isEqual); }
-*/
-// optimized versions
-/*** META ((export #t)) */
-function sc_assq(o, al) {
-    while (al !== null) {
-	if (al.car.car === o)
-	    return al.car;
-	al = al.cdr;
-    }
-    return false;
-}
-/*** META ((export #t)) */
-function sc_assv(o, al) {
-    while (al !== null) {
-	if (al.car.car === o)
-	    return al.car;
-	al = al.cdr;
-    }
-    return false;
-}
-/*** META ((export #t)) */
-function sc_assoc(o, al) {
-    while (al !== null) {
-	if (sc_isEqual(al.car.car, o))
-	    return al.car;
-	al = al.cdr;
-    }
-    return false;
-}
-
-/* can be used for mutable strings and characters */
-function sc_isCharStringEqual(cs1, cs2) { return cs1.val === cs2.val; }
-function sc_isCharStringLess(cs1, cs2) { return cs1.val < cs2.val; }
-function sc_isCharStringGreater(cs1, cs2) { return cs1.val > cs2.val; }
-function sc_isCharStringLessEqual(cs1, cs2) { return cs1.val <= cs2.val; }
-function sc_isCharStringGreaterEqual(cs1, cs2) { return cs1.val >= cs2.val; }
-function sc_isCharStringCIEqual(cs1, cs2)
-    { return cs1.val.toLowerCase() === cs2.val.toLowerCase(); }
-function sc_isCharStringCILess(cs1, cs2)
-    { return cs1.val.toLowerCase() < cs2.val.toLowerCase(); }
-function sc_isCharStringCIGreater(cs1, cs2)
-    { return cs1.val.toLowerCase() > cs2.val.toLowerCase(); }
-function sc_isCharStringCILessEqual(cs1, cs2)
-    { return cs1.val.toLowerCase() <= cs2.val.toLowerCase(); }
-function sc_isCharStringCIGreaterEqual(cs1, cs2)
-    { return cs1.val.toLowerCase() >= cs2.val.toLowerCase(); }
-
-
-
-
-function sc_Char(c) {
-    var cached = sc_Char.lazy[c];
-    if (cached)
-	return cached;
-    this.val = c;
-    sc_Char.lazy[c] = this;
-    // add return, so FF does not complain.
-    return undefined;
-}
-sc_Char.lazy = new Object();
-// thanks to Eric
-sc_Char.char2readable = {
-    "\000": "#\\null",
-    "\007": "#\\bell",
-    "\010": "#\\backspace",
-    "\011": "#\\tab",
-    "\012": "#\\newline",
-    "\014": "#\\page",
-    "\015": "#\\return",
-    "\033": "#\\escape",
-    "\040": "#\\space",
-    "\177": "#\\delete",
-
-  /* poeticless names */
-    "\001": "#\\soh",
-    "\002": "#\\stx",
-    "\003": "#\\etx",
-    "\004": "#\\eot",
-    "\005": "#\\enq",
-    "\006": "#\\ack",
-
-    "\013": "#\\vt",
-    "\016": "#\\so",
-    "\017": "#\\si",
-
-    "\020": "#\\dle",
-    "\021": "#\\dc1",
-    "\022": "#\\dc2",
-    "\023": "#\\dc3",
-    "\024": "#\\dc4",
-    "\025": "#\\nak",
-    "\026": "#\\syn",
-    "\027": "#\\etb",
-
-    "\030": "#\\can",
-    "\031": "#\\em",
-    "\032": "#\\sub",
-    "\033": "#\\esc",
-    "\034": "#\\fs",
-    "\035": "#\\gs",
-    "\036": "#\\rs",
-    "\037": "#\\us"};
-
-sc_Char.readable2char = {
-    "null": "\000",
-    "bell": "\007",
-    "backspace": "\010",
-    "tab": "\011",
-    "newline": "\012",
-    "page": "\014",
-    "return": "\015",
-    "escape": "\033",
-    "space": "\040",
-    "delete": "\000",
-    "soh": "\001",
-    "stx": "\002",
-    "etx": "\003",
-    "eot": "\004",
-    "enq": "\005",
-    "ack": "\006",
-    "bel": "\007",
-    "bs": "\010",
-    "ht": "\011",
-    "nl": "\012",
-    "vt": "\013",
-    "np": "\014",
-    "cr": "\015",
-    "so": "\016",
-    "si": "\017",
-    "dle": "\020",
-    "dc1": "\021",
-    "dc2": "\022",
-    "dc3": "\023",
-    "dc4": "\024",
-    "nak": "\025",
-    "syn": "\026",
-    "etb": "\027",
-    "can": "\030",
-    "em": "\031",
-    "sub": "\032",
-    "esc": "\033",
-    "fs": "\034",
-    "gs": "\035",
-    "rs": "\036",
-    "us": "\037",
-    "sp": "\040",
-    "del": "\177"};
-
-sc_Char.prototype.toString = function() {
-    return this.val;
-};
-// sc_toDisplayString == toString
-sc_Char.prototype.sc_toWriteString = function() {
-    var entry = sc_Char.char2readable[this.val];
-    if (entry)
-	return entry;
-    else
-	return "#\\" + this.val;
-};
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (postfix "instanceof sc_Char")))
-*/
-function sc_isChar(c) {
-    return (c instanceof sc_Char);
-}
-
-/*** META ((export char=?)
-           (type bool)
-           (peephole (hole 2 c1 ".val === " c2 ".val")))
-*/
-var sc_isCharEqual = sc_isCharStringEqual;
-/*** META ((export char<?)
-           (type bool)
-           (peephole (hole 2 c1 ".val < " c2 ".val")))
-*/
-var sc_isCharLess = sc_isCharStringLess;
-/*** META ((export char>?)
-           (type bool)
-           (peephole (hole 2 c1 ".val > " c2 ".val")))
-*/
-var sc_isCharGreater = sc_isCharStringGreater;
-/*** META ((export char<=?)
-           (type bool)
-           (peephole (hole 2 c1 ".val <= " c2 ".val")))
-*/
-var sc_isCharLessEqual = sc_isCharStringLessEqual;
-/*** META ((export char>=?)
-           (type bool)
-           (peephole (hole 2 c1 ".val >= " c2 ".val")))
-*/
-var sc_isCharGreaterEqual = sc_isCharStringGreaterEqual;
-/*** META ((export char-ci=?)
-           (type bool)
-           (peephole (hole 2 c1 ".val.toLowerCase() === " c2 ".val.toLowerCase()")))
-*/
-var sc_isCharCIEqual = sc_isCharStringCIEqual;
-/*** META ((export char-ci<?)
-           (type bool)
-           (peephole (hole 2 c1 ".val.toLowerCase() < " c2 ".val.toLowerCase()")))
-*/
-var sc_isCharCILess = sc_isCharStringCILess;
-/*** META ((export char-ci>?)
-           (type bool)
-           (peephole (hole 2 c1 ".val.toLowerCase() > " c2 ".val.toLowerCase()")))
-*/
-var sc_isCharCIGreater = sc_isCharStringCIGreater;
-/*** META ((export char-ci<=?)
-           (type bool)
-           (peephole (hole 2 c1 ".val.toLowerCase() <= " c2 ".val.toLowerCase()")))
-*/
-var sc_isCharCILessEqual = sc_isCharStringCILessEqual;
-/*** META ((export char-ci>=?)
-           (type bool)
-           (peephole (hole 2 c1 ".val.toLowerCase() >= " c2 ".val.toLowerCase()")))
-*/
-var sc_isCharCIGreaterEqual = sc_isCharStringCIGreaterEqual;
-
-var SC_NUMBER_CLASS = "0123456789";
-var SC_WHITESPACE_CLASS = ' \r\n\t\f';
-var SC_LOWER_CLASS = 'abcdefghijklmnopqrstuvwxyz';
-var SC_UPPER_CLASS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
-
-function sc_isCharOfClass(c, cl) { return (cl.indexOf(c) != -1); }
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isCharAlphabetic(c)
-    { return sc_isCharOfClass(c.val, SC_LOWER_CLASS) ||
-	  sc_isCharOfClass(c.val, SC_UPPER_CLASS); }
-/*** META ((export #t)
-           (type bool)
-           (peephole (hole 1 "SC_NUMBER_CLASS.indexOf(" c ".val) != -1")))
-*/
-function sc_isCharNumeric(c)
-    { return sc_isCharOfClass(c.val, SC_NUMBER_CLASS); }
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isCharWhitespace(c) {
-    var tmp = c.val;
-    return tmp === " " || tmp === "\r" || tmp === "\n" || tmp === "\t" || tmp === "\f";
-}
-/*** META ((export #t)
-           (type bool)
-           (peephole (hole 1 "SC_UPPER_CLASS.indexOf(" c ".val) != -1")))
-*/
-function sc_isCharUpperCase(c)
-    { return sc_isCharOfClass(c.val, SC_UPPER_CLASS); }
-/*** META ((export #t)
-           (type bool)
-           (peephole (hole 1 "SC_LOWER_CLASS.indexOf(" c ".val) != -1")))
-*/
-function sc_isCharLowerCase(c)
-    { return sc_isCharOfClass(c.val, SC_LOWER_CLASS); }
-
-/*** META ((export #t)
-           (peephole (postfix ".val.charCodeAt(0)")))
-*/
-function sc_char2integer(c)
-    { return c.val.charCodeAt(0); }
-/*** META ((export #t)
-           (peephole (hole 1 "new sc_Char(String.fromCharCode(" n "))")))
-*/
-function sc_integer2char(n)
-    { return new sc_Char(String.fromCharCode(n)); }
-
-/*** META ((export #t)
-           (peephole (hole 1 "new sc_Char(" c ".val.toUpperCase())")))
-*/
-function sc_charUpcase(c)
-    { return new sc_Char(c.val.toUpperCase()); }
-/*** META ((export #t)
-           (peephole (hole 1 "new sc_Char(" c ".val.toLowerCase())")))
-*/
-function sc_charDowncase(c)
-    { return new sc_Char(c.val.toLowerCase()); }
-
-function sc_makeJSStringOfLength(k, c) {
-    var fill;
-    if (c === undefined)
-	fill = " ";
-    else
-	fill = c;
-    var res = "";
-    var len = 1;
-    // every round doubles the size of fill.
-    while (k >= len) {
-	if (k & len)
-	    res = res.concat(fill);
-	fill = fill.concat(fill);
-	len *= 2;
-    }
-    return res;
-}
-
-function sc_makejsString(k, c) {
-    var fill;
-    if (c)
-	fill = c.val;
-    else
-	fill = " ";
-    return sc_makeJSStringOfLength(k, fill);
-}
-
-function sc_jsstring2list(s) {
-    var res = null;
-    for (var i = s.length - 1; i >= 0; i--)
-	res = sc_cons(new sc_Char(s.charAt(i)), res);
-    return res;
-}
-
-function sc_list2jsstring(l) {
-    var a = new Array();
-    while(l !== null) {
-	a.push(l.car.val);
-	l = l.cdr;
-    }
-    return "".concat.apply("", a);
-}
-
-var sc_Vector = Array;
-
-sc_Vector.prototype.sc_toWriteOrDisplayString = function(writeOrDisplay) {
-    if (this.length === 0) return "#()";
-
-    var res = "#(" + writeOrDisplay(this[0]);
-    for (var i = 1; i < this.length; i++)
-	res += " " + writeOrDisplay(this[i]);
-    res += ")";
-    return res;
-};
-sc_Vector.prototype.sc_toDisplayString = function() {
-    return this.sc_toWriteOrDisplayString(sc_toDisplayString);
-};
-sc_Vector.prototype.sc_toWriteString = function() {
-    return this.sc_toWriteOrDisplayString(sc_toWriteString);
-};
-
-/*** META ((export vector? array?)
-           (type bool)
-           (peephole (postfix " instanceof sc_Vector")))
-*/
-function sc_isVector(v) {
-    return (v instanceof sc_Vector);
-}
-
-// only applies to vectors
-function sc_isVectorEqual(v1, v2, comp) {
-    if (v1.length !== v2.length) return false;
-    for (var i = 0; i < v1.length; i++)
-	if (!comp(v1[i], v2[i])) return false;
-    return true;
-}
-
-/*** META ((export make-vector make-array)) */
-function sc_makeVector(size, fill) {
-    var a = new sc_Vector(size);
-    if (fill !== undefined)
-	sc_vectorFillBang(a, fill);
-    return a;
-}
-
-/*** META ((export vector array)
-           (peephole (vector)))
-*/
-function sc_vector() {
-    var a = new sc_Vector();
-    for (var i = 0; i < arguments.length; i++)
-	a.push(arguments[i]);
-    return a;
-}
-
-/*** META ((export vector-length array-length)
-           (peephole (postfix ".length")))
-*/
-function sc_vectorLength(v) {
-    return v.length;
-}
-
-/*** META ((export vector-ref array-ref)
-           (peephole (hole 2 v "[" pos "]")))
-*/
-function sc_vectorRef(v, pos) {
-    return v[pos];
-}
-
-/*** META ((export vector-set! array-set!)
-           (peephole (hole 3 v "[" pos "] = " val)))
-*/
-function sc_vectorSetBang(v, pos, val) {
-    v[pos] = val;
-}
-
-/*** META ((export vector->list array->list)) */
-function sc_vector2list(a) {
-    var res = null;
-    for (var i = a.length-1; i >= 0; i--)
-	res = sc_cons(a[i], res);
-    return res;
-}
-
-/*** META ((export list->vector list->array)) */
-function sc_list2vector(l) {
-    var a = new sc_Vector();
-    while(l !== null) {
-	a.push(l.car);
-	l = l.cdr;
-    }
-    return a;
-}
-
-/*** META ((export vector-fill! array-fill!)) */
-function sc_vectorFillBang(a, fill) {
-    for (var i = 0; i < a.length; i++)
-	a[i] = fill;
-}
-
-
-/*** META ((export #t)) */
-function sc_copyVector(a, len) {
-    if (len <= a.length)
-	return a.slice(0, len);
-    else {
-	var tmp = a.concat();
-	tmp.length = len;
-	return tmp;
-    }
-}
-
-/*** META ((export #t)
-           (peephole (hole 3 a ".slice(" start "," end ")")))
-*/
-function sc_vectorCopy(a, start, end) {
-    return a.slice(start, end);
-}
-
-/*** META ((export #t)) */
-function sc_vectorCopyBang(target, tstart, source, sstart, send) {
-    if (!sstart) sstart = 0;
-    if (!send) send = source.length;
-
-    // if target == source we don't want to overwrite not yet copied elements.
-    if (tstart <= sstart) {
-	for (var i = tstart, j = sstart; j < send; i++, j++) {
-	    target[i] = source[j];
-	}
-    } else {
-	var diff = send - sstart;
-	for (var i = tstart + diff - 1, j = send - 1;
-	     j >= sstart;
-	     i--, j--) {
-	    target[i] = source[j];
-	}
-    }
-    return target;
-}
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (hole 1 "typeof " o " === 'function'")))
-*/
-function sc_isProcedure(o) {
-    return (typeof o === "function");
-}
-
-/*** META ((export #t)) */
-function sc_apply(proc) {
-    var args = new Array();
-    // first part of arguments are not in list-form.
-    for (var i = 1; i < arguments.length - 1; i++)
-	args.push(arguments[i]);
-    var l = arguments[arguments.length - 1];
-    while (l !== null) {
-	args.push(l.car);
-	l = l.cdr;
-    }
-    return proc.apply(null, args);
-}
-
-/*** META ((export #t)) */
-function sc_map(proc, l1) {
-    if (l1 === undefined)
-	return null;
-    // else
-    var nbApplyArgs = arguments.length - 1;
-    var applyArgs = new Array(nbApplyArgs);
-    var revres = null;
-    while (l1 !== null) {
-	for (var i = 0; i < nbApplyArgs; i++) {
-	    applyArgs[i] = arguments[i + 1].car;
-	    arguments[i + 1] = arguments[i + 1].cdr;
-	}
-	revres = sc_cons(proc.apply(null, applyArgs), revres);
-    }
-    return sc_reverseAppendBang(revres, null);
-}
-
-/*** META ((export #t)) */
-function sc_mapBang(proc, l1) {
-    if (l1 === undefined)
-	return null;
-    // else
-    var l1_orig = l1;
-    var nbApplyArgs = arguments.length - 1;
-    var applyArgs = new Array(nbApplyArgs);
-    while (l1 !== null) {
-	var tmp = l1;
-	for (var i = 0; i < nbApplyArgs; i++) {
-	    applyArgs[i] = arguments[i + 1].car;
-	    arguments[i + 1] = arguments[i + 1].cdr;
-	}
-	tmp.car = proc.apply(null, applyArgs);
-    }
-    return l1_orig;
-}
-
-/*** META ((export #t)) */
-function sc_forEach(proc, l1) {
-    if (l1 === undefined)
-	return undefined;
-    // else
-    var nbApplyArgs = arguments.length - 1;
-    var applyArgs = new Array(nbApplyArgs);
-    while (l1 !== null) {
-	for (var i = 0; i < nbApplyArgs; i++) {
-	    applyArgs[i] = arguments[i + 1].car;
-	    arguments[i + 1] = arguments[i + 1].cdr;
-	}
-	proc.apply(null, applyArgs);
-    }
-    // add return so FF does not complain.
-    return undefined;
-}
-
-/*** META ((export #t)) */
-function sc_filter(proc, l1) {
-    var dummy = { cdr : null };
-    var tail = dummy;
-    while (l1 !== null) {
-	if (proc(l1.car) !== false) {
-	    tail.cdr = sc_cons(l1.car, null);
-	    tail = tail.cdr;
-	}
-	l1 = l1.cdr;
-    }
-    return dummy.cdr;
-}
-
-/*** META ((export #t)) */
-function sc_filterBang(proc, l1) {
-    var head = sc_cons("dummy", l1);
-    var it = head;
-    var next = l1;
-    while (next !== null) {
-        if (proc(next.car) !== false) {
-	    it.cdr = next
-	    it = next;
-	}
-	next = next.cdr;
-    }
-    it.cdr = null;
-    return head.cdr;
-}
-
-function sc_filterMap1(proc, l1) {
-    var revres = null;
-    while (l1 !== null) {
-        var tmp = proc(l1.car)
-        if (tmp !== false) revres = sc_cons(tmp, revres);
-        l1 = l1.cdr;
-    }
-    return sc_reverseAppendBang(revres, null);
-}
-function sc_filterMap2(proc, l1, l2) {
-    var revres = null;
-    while (l1 !== null) {
-        var tmp = proc(l1.car, l2.car);
-        if(tmp !== false) revres = sc_cons(tmp, revres);
-	l1 = l1.cdr;
-	l2 = l2.cdr
-    }
-    return sc_reverseAppendBang(revres, null);
-}
-
-/*** META ((export #t)) */
-function sc_filterMap(proc, l1, l2, l3) {
-    if (l2 === undefined)
-	return sc_filterMap1(proc, l1);
-    else if (l3 === undefined)
-	return sc_filterMap2(proc, l1, l2);
-    // else
-    var nbApplyArgs = arguments.length - 1;
-    var applyArgs = new Array(nbApplyArgs);
-    var revres = null;
-    while (l1 !== null) {
-	for (var i = 0; i < nbApplyArgs; i++) {
-	    applyArgs[i] = arguments[i + 1].car;
-	    arguments[i + 1] = arguments[i + 1].cdr;
-	}
-	var tmp = proc.apply(null, applyArgs);
-	if(tmp !== false) revres = sc_cons(tmp, revres);
-    }
-    return sc_reverseAppendBang(revres, null);
-}
-
-/*** META ((export #t)) */
-function sc_any(proc, l) {
-    var revres = null;
-    while (l !== null) {
-        var tmp = proc(l.car);
-        if(tmp !== false) return tmp;
-	l = l.cdr;
-    }
-    return false;
-}
-
-/*** META ((export any?)
-           (peephole (hole 2 "sc_any(" proc "," l ") !== false")))
-*/
-function sc_anyPred(proc, l) {
-    return sc_any(proc, l)!== false;
-}
-
-/*** META ((export #t)) */
-function sc_every(proc, l) {
-    var revres = null;
-    var tmp = true;
-    while (l !== null) {
-        tmp = proc(l.car);
-        if (tmp === false) return false;
-	l = l.cdr;
-    }
-    return tmp;
-}
-
-/*** META ((export every?)
-           (peephole (hole 2 "sc_every(" proc "," l ") !== false")))
-*/
-function sc_everyPred(proc, l) {
-    var tmp = sc_every(proc, l);
-    if (tmp !== false) return true;
-    return false;
-}
-
-/*** META ((export #t)
-           (peephole (postfix "()")))
-*/
-function sc_force(o) {
-    return o();
-}
-
-/*** META ((export #t)) */
-function sc_makePromise(proc) {
-    var isResultReady = false;
-    var result = undefined;
-    return function() {
-	if (!isResultReady) {
-	    var tmp = proc();
-	    if (!isResultReady) {
-		isResultReady = true;
-		result = tmp;
-	    }
-	}
-	return result;
-    };
-}
-
-function sc_Values(values) {
-    this.values = values;
-}
-
-/*** META ((export #t)
-           (peephole (values)))
-*/
-function sc_values() {
-    if (arguments.length === 1)
-	return arguments[0];
-    else
-	return new sc_Values(arguments);
-}
-
-/*** META ((export #t)) */
-function sc_callWithValues(producer, consumer) {
-    var produced = producer();
-    if (produced instanceof sc_Values)
-	return consumer.apply(null, produced.values);
-    else
-	return consumer(produced);
-}
-
-/*** META ((export #t)) */
-function sc_dynamicWind(before, thunk, after) {
-    before();
-    try {
-	var res = thunk();
-	return res;
-    } finally {
-	after();
-    }
-}
-
-
-// TODO: eval/scheme-report-environment/null-environment/interaction-environment
-
-// LIMITATION: 'load' doesn't exist without files.
-// LIMITATION: transcript-on/transcript-off doesn't exist without files.
-
-
-function sc_Struct(name) {
-    this.name = name;
-}
-sc_Struct.prototype.sc_toDisplayString = function() {
-    return "#<struct" + sc_hash(this) + ">";
-};
-sc_Struct.prototype.sc_toWriteString = sc_Struct.prototype.sc_toDisplayString;
-
-/*** META ((export #t)
-           (peephole (hole 1 "new sc_Struct(" name ")")))
-*/
-function sc_makeStruct(name) {
-    return new sc_Struct(name);
-}
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (postfix " instanceof sc_Struct")))
-*/
-function sc_isStruct(o) {
-    return (o instanceof sc_Struct);
-}
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (hole 2 "(" 1 " instanceof sc_Struct) && ( " 1 ".name === " 0 ")")))
-*/
-function sc_isStructNamed(name, s) {
-    return ((s instanceof sc_Struct) && (s.name === name));
-}
-
-/*** META ((export struct-field)
-           (peephole (hole 3 0 "[" 2 "]")))
-*/
-function sc_getStructField(s, name, field) {
-    return s[field];
-}
-
-/*** META ((export struct-field-set!)
-           (peephole (hole 4 0 "[" 2 "] = " 3)))
-*/
-function sc_setStructFieldBang(s, name, field, val) {
-    s[field] = val;
-}
-
-/*** META ((export #t)
-           (peephole (prefix "~")))
-*/
-function sc_bitNot(x) {
-    return ~x;
-}
-
-/*** META ((export #t)
-           (peephole (infix 2 2 "&")))
-*/
-function sc_bitAnd(x, y) {
-    return x & y;
-}
-
-/*** META ((export #t)
-           (peephole (infix 2 2 "|")))
-*/
-function sc_bitOr(x, y) {
-    return x | y;
-}
-
-/*** META ((export #t)
-           (peephole (infix 2 2 "^")))
-*/
-function sc_bitXor(x, y) {
-    return x ^ y;
-}
-
-/*** META ((export #t)
-           (peephole (infix 2 2 "<<")))
-*/
-function sc_bitLsh(x, y) {
-    return x << y;
-}
-
-/*** META ((export #t)
-           (peephole (infix 2 2 ">>")))
-*/
-function sc_bitRsh(x, y) {
-    return x >> y;
-}
-
-/*** META ((export #t)
-           (peephole (infix 2 2 ">>>")))
-*/
-function sc_bitUrsh(x, y) {
-    return x >>> y;
-}
-
-/*** META ((export js-field js-property)
-           (peephole (hole 2 o "[" field "]")))
-*/
-function sc_jsField(o, field) {
-    return o[field];
-}
-
-/*** META ((export js-field-set! js-property-set!)
-           (peephole (hole 3 o "[" field "] = " val)))
-*/
-function sc_setJsFieldBang(o, field, val) {
-    return o[field] = val;
-}
-
-/*** META ((export js-field-delete! js-property-delete!)
-           (peephole (hole 2 "delete" o "[" field "]")))
-*/
-function sc_deleteJsFieldBang(o, field) {
-    delete o[field];
-}
-
-/*** META ((export #t)
-           (peephole (jsCall)))
-*/
-function sc_jsCall(o, fun) {
-    var args = new Array();
-    for (var i = 2; i < arguments.length; i++)
-	args[i-2] = arguments[i];
-    return fun.apply(o, args);
-}
-
-/*** META ((export #t)
-           (peephole (jsMethodCall)))
-*/
-function sc_jsMethodCall(o, field) {
-    var args = new Array();
-    for (var i = 2; i < arguments.length; i++)
-	args[i-2] = arguments[i];
-    return o[field].apply(o, args);
-}
-
-/*** META ((export new js-new)
-           (peephole (jsNew)))
-*/
-function sc_jsNew(c) {
-    var evalStr = "new c(";
-    evalStr +=arguments.length > 1? "arguments[1]": "";
-    for (var i = 2; i < arguments.length; i++)
-	evalStr += ", arguments[" + i + "]";
-    evalStr +=")";
-    return eval(evalStr);
-}
-
-// ======================== RegExp ====================
-/*** META ((export #t)) */
-function sc_pregexp(re) {
-    return new RegExp(sc_string2jsstring(re));
-}
-
-/*** META ((export #t)) */
-function sc_pregexpMatch(re, s) {
-    var reg = (re instanceof RegExp) ? re : sc_pregexp(re);
-    var tmp = reg.exec(sc_string2jsstring(s));
-
-    if (tmp == null) return false;
-
-    var res = null;
-    for (var i = tmp.length-1; i >= 0; i--) {
-	if (tmp[i] !== null) {
-	    res = sc_cons(sc_jsstring2string(tmp[i]), res);
-	} else {
-	    res = sc_cons(false, res);
-	}
-    }
-    return res;
-}
-
-/*** META ((export #t)) */
-function sc_pregexpReplace(re, s1, s2) {
-   var reg;
-   var jss1 = sc_string2jsstring(s1);
-   var jss2 = sc_string2jsstring(s2);
-
-   if (re instanceof RegExp) {
-       if (re.global)
-	   reg = re;
-       else
-	   reg = new RegExp(re.source);
-   } else {
-       reg = new RegExp(sc_string2jsstring(re));
-   }
-
-   return jss1.replace(reg, jss2);
-}
-
-/*** META ((export pregexp-replace*)) */
-function sc_pregexpReplaceAll(re, s1, s2) {
-   var reg;
-   var jss1 = sc_string2jsstring(s1);
-   var jss2 = sc_string2jsstring(s2);
-
-   if (re instanceof RegExp) {
-      if (re.global)
-	  reg = re;
-      else
-	  reg = new RegExp(re.source, "g");
-   } else {
-       reg = new RegExp(sc_string2jsstring(re), "g");
-   }
-
-   return jss1.replace(reg, jss2);
-}
-
-/*** META ((export #t)) */
-function sc_pregexpSplit(re, s) {
-   var reg = ((re instanceof RegExp) ?
-	      re :
-	      new RegExp(sc_string2jsstring(re)));
-   var jss = sc_string2jsstring(s);
-   var tmp = jss.split(reg);
-
-   if (tmp == null) return false;
-
-   return sc_vector2list(tmp);
-}
-
-
-/* =========================================================================== */
-/* Other library stuff */
-/* =========================================================================== */
-
-/*** META ((export #t)
-           (peephole (hole 1 "Math.floor(Math.random()*" 'n ")")))
-*/
-function sc_random(n) {
-    return Math.floor(Math.random()*n);
-}
-
-/*** META ((export current-date)
-           (peephole (hole 0 "new Date()")))
-*/
-function sc_currentDate() {
-   return new Date();
-}
-
-function sc_Hashtable() {
-}
-sc_Hashtable.prototype.toString = function() {
-    return "#{%hashtable}";
-};
-// sc_toWriteString == sc_toDisplayString == toString
-
-function sc_HashtableElement(key, val) {
-    this.key = key;
-    this.val = val;
-}
-
-/*** META ((export #t)
-           (peephole (hole 0 "new sc_Hashtable()")))
-*/
-function sc_makeHashtable() {
-    return new sc_Hashtable();
-}
-
-/*** META ((export #t)) */
-function sc_hashtablePutBang(ht, key, val) {
-    var hash = sc_hash(key);
-    ht[hash] = new sc_HashtableElement(key, val);
-}
-
-/*** META ((export #t)) */
-function sc_hashtableGet(ht, key) {
-    var hash = sc_hash(key);
-    if (hash in ht)
-	return ht[hash].val;
-    else
-	return false;
-}
-
-/*** META ((export #t)) */
-function sc_hashtableForEach(ht, f) {
-    for (var v in ht) {
-	if (ht[v] instanceof sc_HashtableElement)
-	    f(ht[v].key, ht[v].val);
-    }
-}
-
-/*** META ((export hashtable-contains?)
-           (peephole (hole 2 "sc_hash(" 1 ") in " 0)))
-*/
-function sc_hashtableContains(ht, key) {
-    var hash = sc_hash(key);
-    if (hash in ht)
-	return true;
-    else
-	return false;
-}
-
-var SC_HASH_COUNTER = 0;
-
-function sc_hash(o) {
-    if (o === null)
-	return "null";
-    else if (o === undefined)
-	return "undefined";
-    else if (o === true)
-	return "true";
-    else if (o === false)
-	return "false";
-    else if (typeof o === "number")
-	return "num-" + o;
-    else if (typeof o === "string")
-	return "jsstr-" + o;
-    else if (o.sc_getHash)
-	return o.sc_getHash();
-    else
-	return sc_counterHash.call(o);
-}
-function sc_counterHash() {
-    if (!this.sc_hash) {
-	this.sc_hash = "hash-" + SC_HASH_COUNTER;
-	SC_HASH_COUNTER++;
-    }
-    return this.sc_hash;
-}
-
-function sc_Trampoline(args, maxTailCalls) {
-    this['__trampoline return__'] = true;
-    this.args = args;
-    this.MAX_TAIL_CALLs = maxTailCalls;
-}
-// TODO: call/cc stuff
-sc_Trampoline.prototype.restart = function() {
-    var o = this;
-    while (true) {
-	// set both globals.
-	SC_TAIL_OBJECT.calls = o.MAX_TAIL_CALLs-1;
-	var fun = o.args.callee;
-	var res = fun.apply(SC_TAIL_OBJECT, o.args);
-	if (res instanceof sc_Trampoline)
-	    o = res;
-	else
-	    return res;
-    }
-}
-
-/*** META ((export bind-exit-lambda)) */
-function sc_bindExitLambda(proc) {
-    var escape_obj = new sc_BindExitException();
-    var escape = function(res) {
-	escape_obj.res = res;
-	throw escape_obj;
-    };
-    try {
-	return proc(escape);
-    } catch(e) {
-	if (e === escape_obj) {
-	    return e.res;
-	}
-	throw e;
-    }
-}
-function sc_BindExitException() {
-    this._internalException = true;
-}
-
-var SC_SCM2JS_GLOBALS = new Object();
-
-// default tail-call depth.
-// normally the program should set it again. but just in case...
-var SC_TAIL_OBJECT = new Object();
-SC_SCM2JS_GLOBALS.TAIL_OBJECT = SC_TAIL_OBJECT;
-// ======================== I/O =======================
-
-/*------------------------------------------------------------------*/
-
-function sc_EOF() {
-}
-var SC_EOF_OBJECT = new sc_EOF();
-
-function sc_Port() {
-}
-
-/* --------------- Input ports -------------------------------------*/
-
-function sc_InputPort() {
-}
-sc_InputPort.prototype = new sc_Port();
-
-sc_InputPort.prototype.peekChar = function() {
-    if (!("peeked" in this))
-	this.peeked = this.getNextChar();
-    return this.peeked;
-}
-sc_InputPort.prototype.readChar = function() {
-    var tmp = this.peekChar();
-    delete this.peeked;
-    return tmp;
-}
-sc_InputPort.prototype.isCharReady = function() {
-    return true;
-}
-sc_InputPort.prototype.close = function() {
-    // do nothing
-}
-
-/* .............. String port ..........................*/
-function sc_ErrorInputPort() {
-};
-sc_ErrorInputPort.prototype = new sc_InputPort();
-sc_ErrorInputPort.prototype.getNextChar = function() {
-    throw "can't read from error-port.";
-};
-sc_ErrorInputPort.prototype.isCharReady = function() {
-    return false;
-};
-
-
-/* .............. String port ..........................*/
-
-function sc_StringInputPort(jsStr) {
-    // we are going to do some charAts on the str.
-    // instead of recreating all the time a String-object, we
-    // create one in the beginning. (not sure, if this is really an optim)
-    this.str = new String(jsStr);
-    this.pos = 0;
-}
-sc_StringInputPort.prototype = new sc_InputPort();
-sc_StringInputPort.prototype.getNextChar = function() {
-    if (this.pos >= this.str.length)
-	return SC_EOF_OBJECT;
-    return this.str.charAt(this.pos++);
-};
-
-/* ------------- Read and other lib-funs  -------------------------------*/
-function sc_Token(type, val, pos) {
-    this.type = type;
-    this.val = val;
-    this.pos = pos;
-}
-sc_Token.EOF = 0/*EOF*/;
-sc_Token.OPEN_PAR = 1/*OPEN_PAR*/;
-sc_Token.CLOSE_PAR = 2/*CLOSE_PAR*/;
-sc_Token.OPEN_BRACE = 3/*OPEN_BRACE*/;
-sc_Token.CLOSE_BRACE = 4/*CLOSE_BRACE*/;
-sc_Token.OPEN_BRACKET = 5/*OPEN_BRACKET*/;
-sc_Token.CLOSE_BRACKET = 6/*CLOSE_BRACKET*/;
-sc_Token.WHITESPACE = 7/*WHITESPACE*/;
-sc_Token.QUOTE = 8/*QUOTE*/;
-sc_Token.ID = 9/*ID*/;
-sc_Token.DOT = 10/*DOT*/;
-sc_Token.STRING = 11/*STRING*/;
-sc_Token.NUMBER = 12/*NUMBER*/;
-sc_Token.ERROR = 13/*ERROR*/;
-sc_Token.VECTOR_BEGIN = 14/*VECTOR_BEGIN*/;
-sc_Token.TRUE = 15/*TRUE*/;
-sc_Token.FALSE = 16/*FALSE*/;
-sc_Token.UNSPECIFIED = 17/*UNSPECIFIED*/;
-sc_Token.REFERENCE = 18/*REFERENCE*/;
-sc_Token.STORE = 19/*STORE*/;
-sc_Token.CHAR = 20/*CHAR*/;
-
-var SC_ID_CLASS = SC_LOWER_CLASS + SC_UPPER_CLASS + "!$%*+-./:<=>?@^_~";
-function sc_Tokenizer(port) {
-    this.port = port;
-}
-sc_Tokenizer.prototype.peekToken = function() {
-    if (this.peeked)
-	return this.peeked;
-    var newToken = this.nextToken();
-    this.peeked = newToken;
-    return newToken;
-};
-sc_Tokenizer.prototype.readToken = function() {
-    var tmp = this.peekToken();
-    delete this.peeked;
-    return tmp;
-};
-sc_Tokenizer.prototype.nextToken = function() {
-    var port = this.port;
-
-    function isNumberChar(c) {
-	return (c >= "0" && c <= "9");
-    };
-    function isIdOrNumberChar(c) {
-	return SC_ID_CLASS.indexOf(c) != -1 || // ID-char
-	    (c >= "0" && c <= "9");
-    }
-    function isWhitespace(c) {
-	return c === " " || c === "\r" || c === "\n" || c === "\t" || c === "\f";
-    };
-    function isWhitespaceOrEOF(c) {
-	return isWhitespace(c) || c === SC_EOF_OBJECT;
-    };
-
-    function readString() {
-	res = "";
-	while (true) {
-	    var c = port.readChar();
-	    switch (c) {
-	    case '"':
-		return new sc_Token(11/*STRING*/, res);
-	    case "\\":
-		var tmp = port.readChar();
-		switch (tmp) {
-		case '0': res += "\0"; break;
-		case 'a': res += "\a"; break;
-		case 'b': res += "\b"; break;
-		case 'f': res += "\f"; break;
-		case 'n': res += "\n"; break;
-		case 'r': res += "\r"; break;
-		case 't': res += "\t"; break;
-		case 'v': res += "\v"; break;
-		case '"': res += '"'; break;
-		case '\\': res += '\\'; break;
-		case 'x':
-		    /* hexa-number */
-		    var nb = 0;
-		    while (true) {
-			var hexC = port.peekChar();
-			if (hexC >= '0' && hexC <= '9') {
-			    port.readChar();
-			    nb = nb * 16 + hexC.charCodeAt(0) - '0'.charCodeAt(0);
-			} else if (hexC >= 'a' && hexC <= 'f') {
-			    port.readChar();
-			    nb = nb * 16 + hexC.charCodeAt(0) - 'a'.charCodeAt(0);
-			} else if (hexC >= 'A' && hexC <= 'F') {
-			    port.readChar();
-			    nb = nb * 16 + hexC.charCodeAt(0) - 'A'.charCodeAt(0);
-			} else {
-			    // next char isn't part of hex.
-			    res += String.fromCharCode(nb);
-			    break;
-			}
-		    }
-		    break;
-		default:
-		    if (tmp === SC_EOF_OBJECT) {
-			return new sc_Token(13/*ERROR*/, "unclosed string-literal" + res);
-		    }
-		    res += tmp;
-		}
-		break;
-	    default:
-		if (c === SC_EOF_OBJECT) {
-		    return new sc_Token(13/*ERROR*/, "unclosed string-literal" + res);
-		}
-		res += c;
-	    }
-	}
-    };
-    function readIdOrNumber(firstChar) {
-	var res = firstChar;
-	while (isIdOrNumberChar(port.peekChar()))
-	    res += port.readChar();
-	if (isNaN(res))
-	    return new sc_Token(9/*ID*/, res);
-	else
-	    return new sc_Token(12/*NUMBER*/, res - 0);
-    };
-
-    function skipWhitespaceAndComments() {
-	var done = false;
-	while (!done) {
-	    done = true;
-	    while (isWhitespace(port.peekChar()))
-		port.readChar();
-	    if (port.peekChar() === ';') {
-		port.readChar();
-		done = false;
-		while (true) {
-		    curChar = port.readChar();
-		    if (curChar === SC_EOF_OBJECT ||
-			curChar === '\n')
-			break;
-		}
-	    }
-	}
-    };
-
-    function readDot() {
-	if (isWhitespace(port.peekChar()))
-	    return new sc_Token(10/*DOT*/);
-	else
-	    return readIdOrNumber(".");
-    };
-
-    function readSharp() {
-	var c = port.readChar();
-	if (isWhitespace(c))
-	    return new sc_Token(13/*ERROR*/, "bad #-pattern0.");
-
-	// reference
-	if (isNumberChar(c)) {
-	    var nb = c - 0;
-	    while (isNumberChar(port.peekChar()))
-		nb = nb*10 + (port.readChar() - 0);
-	    switch (port.readChar()) {
-	    case '#':
-		return new sc_Token(18/*REFERENCE*/, nb);
-	    case '=':
-		return new sc_Token(19/*STORE*/, nb);
-	    default:
-		return new sc_Token(13/*ERROR*/, "bad #-pattern1." + nb);
-	    }
-	}
-
-	if (c === "(")
-	    return new sc_Token(14/*VECTOR_BEGIN*/);
-	
-	if (c === "\\") { // character
-	    var tmp = ""
-	    while (!isWhitespaceOrEOF(port.peekChar()))
-		tmp += port.readChar();
-	    switch (tmp.length) {
-	    case 0: // it's escaping a whitespace char:
-		if (sc_isEOFObject(port.peekChar))
-		    return new sc_Token(13/*ERROR*/, "bad #-pattern2.");
-		else
-		    return new sc_Token(20/*CHAR*/, port.readChar());
-	    case 1:
-		return new sc_Token(20/*CHAR*/, tmp);
-	    default:
-		var entry = sc_Char.readable2char[tmp.toLowerCase()];
-		if (entry)
-		    return new sc_Token(20/*CHAR*/, entry);
-		else
-		    return new sc_Token(13/*ERROR*/, "unknown character description: #\\" + tmp);
-	    }
-	}
-
-	// some constants (#t, #f, #unspecified)
-	var res;
-	var needing;
-	switch (c) {
-	case 't': res = new sc_Token(15/*TRUE*/, true); needing = ""; break;
-	case 'f': res = new sc_Token(16/*FALSE*/, false); needing = ""; break;
-	case 'u': res = new sc_Token(17/*UNSPECIFIED*/, undefined); needing = "nspecified"; break;
-	default:
-	    return new sc_Token(13/*ERROR*/, "bad #-pattern3: " + c);
-	}
-	while(true) {
-	    c = port.peekChar();
-	    if ((isWhitespaceOrEOF(c) || c === ')') &&
-		needing == "")
-		return res;
-	    else if (isWhitespace(c) || needing == "")
-		return new sc_Token(13/*ERROR*/, "bad #-pattern4 " + c + " " + needing);
-	    else if (needing.charAt(0) == c) {
-		port.readChar(); // consume
-		needing = needing.slice(1);
-	    } else
-		return new sc_Token(13/*ERROR*/, "bad #-pattern5");
-	}
-	
-    };
-
-    skipWhitespaceAndComments();
-    var curChar = port.readChar();
-    if (curChar === SC_EOF_OBJECT)
-	return new sc_Token(0/*EOF*/, curChar);
-    switch (curChar)
-    {
-    case " ":
-    case "\n":
-    case "\t":
-	return readWhitespace();
-    case "(":
-	return new sc_Token(1/*OPEN_PAR*/);
-    case ")":
-	return new sc_Token(2/*CLOSE_PAR*/);
-    case "{":
-	return new sc_Token(3/*OPEN_BRACE*/);
-    case "}":
-	return new sc_Token(4/*CLOSE_BRACE*/);
-    case "[":
-	return new sc_Token(5/*OPEN_BRACKET*/);
-    case "]":
-	return new sc_Token(6/*CLOSE_BRACKET*/);
-    case "'":
-	return new sc_Token(8/*QUOTE*/);
-    case "#":
-	return readSharp();
-    case ".":
-	return readDot();
-    case '"':
-	return readString();
-    default:
-	if (isIdOrNumberChar(curChar))
-	    return readIdOrNumber(curChar);
-	throw "unexpected character: " + curChar;
-    }
-};
-
-function sc_Reader(tokenizer) {
-    this.tokenizer = tokenizer;
-    this.backref = new Array();
-}
-sc_Reader.prototype.read = function() {
-    function readList(listBeginType) {
-	function matchesPeer(open, close) {
-	    return open === 1/*OPEN_PAR*/ && close === 2/*CLOSE_PAR*/
-	    	|| open === 3/*OPEN_BRACE*/ && close === 4/*CLOSE_BRACE*/
-		|| open === 5/*OPEN_BRACKET*/ && close === 6/*CLOSE_BRACKET*/;
-	};
-	var res = null;
-
-	while (true) {
-	    var token = tokenizer.peekToken();
-
-	    switch (token.type) {
-	    case 2/*CLOSE_PAR*/:
-	    case 4/*CLOSE_BRACE*/:
-	    case 6/*CLOSE_BRACKET*/:
-		if (matchesPeer(listBeginType, token.type)) {
-		    tokenizer.readToken(); // consume token
-		    return sc_reverseBang(res);
-		} else
-		    throw "closing par doesn't match: " + listBeginType
-			+ " " + listEndType;
-
-	    case 0/*EOF*/:
-		throw "unexpected end of file";
-
-	    case 10/*DOT*/:
-		tokenizer.readToken(); // consume token
-		var cdr = this.read();
-		var par = tokenizer.readToken();
-		if (!matchesPeer(listBeginType, par.type))
-		    throw "closing par doesn't match: " + listBeginType
-			+ " " + par.type;
-		else
-		    return sc_reverseAppendBang(res, cdr);
-		
-
-	    default:
-		res = sc_cons(this.read(), res);
-	    }
-	}
-    };
-    function readQuote() {
-	return sc_cons("quote", sc_cons(this.read(), null));
-    };
-    function readVector() {
-	// opening-parenthesis is already consumed
-	var a = new Array();
-	while (true) {
-	    var token = tokenizer.peekToken();
-	    switch (token.type) {
-	    case 2/*CLOSE_PAR*/:
-		tokenizer.readToken();
-		return a;
-		
-	    default:
-		a.push(this.read());
-	    }
-	}
-    };
-
-    function storeRefence(nb) {
-	var tmp = this.read();
-	this.backref[nb] = tmp;
-	return tmp;
-    };
-	
-    function readReference(nb) {
-	if (nb in this.backref)
-	    return this.backref[nb];
-	else
-	    throw "bad reference: " + nb;
-    };
-
-    var tokenizer = this.tokenizer;
-
-    var token = tokenizer.readToken();
-
-    // handle error
-    if (token.type === 13/*ERROR*/)
-	throw token.val;
-
-    switch (token.type) {
-    case 1/*OPEN_PAR*/:
-    case 3/*OPEN_BRACE*/:
-    case 5/*OPEN_BRACKET*/:
-	return readList.call(this, token.type);
-    case 8/*QUOTE*/:
-	return readQuote.call(this);
-    case 11/*STRING*/:
-	return sc_jsstring2string(token.val);
-    case 20/*CHAR*/:
-	return new sc_Char(token.val);
-    case 14/*VECTOR_BEGIN*/:
-	return readVector.call(this);
-    case 18/*REFERENCE*/:
-	return readReference.call(this, token.val);
-    case 19/*STORE*/:
-	return storeRefence.call(this, token.val);
-    case 9/*ID*/:
-	return sc_jsstring2symbol(token.val);
-    case 0/*EOF*/:
-    case 12/*NUMBER*/:
-    case 15/*TRUE*/:
-    case 16/*FALSE*/:
-    case 17/*UNSPECIFIED*/:
-	return token.val;
-    default:
-	throw "unexpected token " + token.type + " " + token.val;
-    }
-};
-
-/*** META ((export #t)) */
-function sc_read(port) {
-    if (port === undefined) // we assume the port hasn't been given.
-	port = SC_DEFAULT_IN; // THREAD: shared var...
-    var reader = new sc_Reader(new sc_Tokenizer(port));
-    return reader.read();
-}
-/*** META ((export #t)) */
-function sc_readChar(port) {
-    if (port === undefined) // we assume the port hasn't been given.
-	port = SC_DEFAULT_IN; // THREAD: shared var...
-    var t = port.readChar();
-    return t === SC_EOF_OBJECT? t: new sc_Char(t);
-}
-/*** META ((export #t)) */
-function sc_peekChar(port) {
-    if (port === undefined) // we assume the port hasn't been given.
-	port = SC_DEFAULT_IN; // THREAD: shared var...
-    var t = port.peekChar();
-    return t === SC_EOF_OBJECT? t: new sc_Char(t);
-}
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isCharReady(port) {
-    if (port === undefined) // we assume the port hasn't been given.
-	port = SC_DEFAULT_IN; // THREAD: shared var...
-    return port.isCharReady();
-}
-/*** META ((export #t)
-           (peephole (postfix ".close()")))
-*/
-function sc_closeInputPort(p) {
-    return p.close();
-}
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (postfix " instanceof sc_InputPort")))
-*/
-function sc_isInputPort(o) {
-    return (o instanceof sc_InputPort);
-}
-
-/*** META ((export eof-object?)
-           (type bool)
-           (peephole (postfix " === SC_EOF_OBJECT")))
-*/
-function sc_isEOFObject(o) {
-    return o === SC_EOF_OBJECT;
-}
-
-/*** META ((export #t)
-           (peephole (hole 0 "SC_DEFAULT_IN")))
-*/
-function sc_currentInputPort() {
-    return SC_DEFAULT_IN;
-}
-
-/* ------------ file operations are not supported -----------*/
-/*** META ((export #t)) */
-function sc_callWithInputFile(s, proc) {
-    throw "can't open " + s;
-}
-
-/*** META ((export #t)) */
-function sc_callWithOutputFile(s, proc) {
-    throw "can't open " + s;
-}
-
-/*** META ((export #t)) */
-function sc_withInputFromFile(s, thunk) {
-    throw "can't open " + s;
-}
-
-/*** META ((export #t)) */
-function sc_withOutputToFile(s, thunk) {
-    throw "can't open " + s;
-}
-
-/*** META ((export #t)) */
-function sc_openInputFile(s) {
-    throw "can't open " + s;
-}
-
-/*** META ((export #t)) */
-function sc_openOutputFile(s) {
-    throw "can't open " + s;
-}
-
-/* ----------------------------------------------------------------------------*/
-/*** META ((export #t)) */
-function sc_basename(p) {
-   var i = p.lastIndexOf('/');
-
-   if(i >= 0)
-      return p.substring(i + 1, p.length);
-   else
-      return '';
-}
-
-/*** META ((export #t)) */
-function sc_dirname(p) {
-   var i = p.lastIndexOf('/');
-
-   if(i >= 0)
-      return p.substring(0, i);
-   else
-      return '';
-}
-
-/* ----------------------------------------------------------------------------*/
-
-/*** META ((export #t)) */
-function sc_withInputFromPort(p, thunk) {
-    try {
-	var tmp = SC_DEFAULT_IN; // THREAD: shared var.
-	SC_DEFAULT_IN = p;
-	return thunk();
-    } finally {
-	SC_DEFAULT_IN = tmp;
-    }
-}
-
-/*** META ((export #t)) */
-function sc_withInputFromString(s, thunk) {
-    return sc_withInputFromPort(new sc_StringInputPort(sc_string2jsstring(s)), thunk);
-}
-
-/*** META ((export #t)) */
-function sc_withOutputToPort(p, thunk) {
-    try {
-	var tmp = SC_DEFAULT_OUT; // THREAD: shared var.
-	SC_DEFAULT_OUT = p;
-	return thunk();
-    } finally {
-	SC_DEFAULT_OUT = tmp;
-    }
-}
-
-/*** META ((export #t)) */
-function sc_withOutputToString(thunk) {
-    var p = new sc_StringOutputPort();
-    sc_withOutputToPort(p, thunk);
-    return p.close();
-}
-
-/*** META ((export #t)) */
-function sc_withOutputToProcedure(proc, thunk) {
-    var t = function(s) { proc(sc_jsstring2string(s)); };
-    return sc_withOutputToPort(new sc_GenericOutputPort(t), thunk);
-}
-
-/*** META ((export #t)
-           (peephole (hole 0 "new sc_StringOutputPort()")))
-*/
-function sc_openOutputString() {
-    return new sc_StringOutputPort();
-}
-
-/*** META ((export #t)) */
-function sc_openInputString(str) {
-    return new sc_StringInputPort(sc_string2jsstring(str));
-}
-
-/* ----------------------------------------------------------------------------*/
-
-function sc_OutputPort() {
-}
-sc_OutputPort.prototype = new sc_Port();
-sc_OutputPort.prototype.appendJSString = function(obj) {
-    /* do nothing */
-}
-sc_OutputPort.prototype.close = function() {
-    /* do nothing */
-}
-
-function sc_StringOutputPort() {
-    this.res = "";
-}
-sc_StringOutputPort.prototype = new sc_OutputPort();
-sc_StringOutputPort.prototype.appendJSString = function(s) {
-    this.res += s;
-}
-sc_StringOutputPort.prototype.close = function() {
-    return sc_jsstring2string(this.res);
-}
-
-/*** META ((export #t)) */
-function sc_getOutputString(sp) {
-    return sc_jsstring2string(sp.res);
-}
-
-
-function sc_ErrorOutputPort() {
-}
-sc_ErrorOutputPort.prototype = new sc_OutputPort();
-sc_ErrorOutputPort.prototype.appendJSString = function(s) {
-    throw "don't write on ErrorPort!";
-}
-sc_ErrorOutputPort.prototype.close = function() {
-    /* do nothing */
-}
-
-function sc_GenericOutputPort(appendJSString, close) {
-    this.appendJSString = appendJSString;
-    if (close)
-	this.close = close;
-}
-sc_GenericOutputPort.prototype = new sc_OutputPort();
-
-/*** META ((export #t)
-           (type bool)
-           (peephole (postfix " instanceof sc_OutputPort")))
-*/
-function sc_isOutputPort(o) {
-    return (o instanceof sc_OutputPort);
-}
-
-/*** META ((export #t)
-           (peephole (postfix ".close()")))
-*/
-function sc_closeOutputPort(p) {
-    return p.close();
-}
-
-/* ------------------ write ---------------------------------------------------*/
-
-/*** META ((export #t)) */
-function sc_write(o, p) {
-    if (p === undefined) // we assume not given
-	p = SC_DEFAULT_OUT;
-    p.appendJSString(sc_toWriteString(o));
-}
-
-function sc_toWriteString(o) {
-    if (o === null)
-	return "()";
-    else if (o === true)
-	return "#t";
-    else if (o === false)
-	return "#f";
-    else if (o === undefined)
-	return "#unspecified";
-    else if (typeof o === 'function')
-	return "#<procedure " + sc_hash(o) + ">";
-    else if (o.sc_toWriteString)
-	return o.sc_toWriteString();
-    else
-	return o.toString();
-}
-
-function sc_escapeWriteString(s) {
-    var res = "";
-    var j = 0;
-    for (i = 0; i < s.length; i++) {
-	switch (s.charAt(i)) {
-	case "\0": res += s.substring(j, i) + "\\0"; j = i + 1; break;
-	case "\b": res += s.substring(j, i) + "\\b"; j = i + 1; break;
-	case "\f": res += s.substring(j, i) + "\\f"; j = i + 1; break;
-	case "\n": res += s.substring(j, i) + "\\n"; j = i + 1; break;
-	case "\r": res += s.substring(j, i) + "\\r"; j = i + 1; break;
-	case "\t": res += s.substring(j, i) + "\\t"; j = i + 1; break;
-	case "\v": res += s.substring(j, i) + "\\v"; j = i + 1; break;
-	case '"': res += s.substring(j, i) + '\\"'; j = i + 1; break;
-	case "\\": res += s.substring(j, i) + "\\\\"; j = i + 1; break;
-	default:
-	    var c = s.charAt(i);
-	    if ("\a" !== "a" && c == "\a") {
-		res += s.substring(j, i) + "\\a"; j = i + 1; continue;
-	    }
-	    if ("\v" !== "v" && c == "\v") {
-		res += s.substring(j, i) + "\\v"; j = i + 1; continue;
-	    }
-	    //if (s.charAt(i) < ' ' || s.charCodeAt(i) > 127) {
-	    // CARE: Manuel is this OK with HOP?
-	    if (s.charAt(i) < ' ') {
-		/* non printable character and special chars */
-		res += s.substring(j, i) + "\\x" + s.charCodeAt(i).toString(16);
-		j = i + 1;
-	    }
-	    // else just let i increase...
-	}
-    }
-    res += s.substring(j, i);
-    return res;
-}
-
-/* ------------------ display ---------------------------------------------------*/
-
-/*** META ((export #t)) */
-function sc_display(o, p) {
-    if (p === undefined) // we assume not given
-	p = SC_DEFAULT_OUT;
-    p.appendJSString(sc_toDisplayString(o));
-}
-
-function sc_toDisplayString(o) {
-    if (o === null)
-	return "()";
-    else if (o === true)
-	return "#t";
-    else if (o === false)
-	return "#f";
-    else if (o === undefined)
-	return "#unspecified";
-    else if (typeof o === 'function')
-	return "#<procedure " + sc_hash(o) + ">";
-    else if (o.sc_toDisplayString)
-	return o.sc_toDisplayString();
-    else
-	return o.toString();
-}
-
-/* ------------------ newline ---------------------------------------------------*/
-
-/*** META ((export #t)) */
-function sc_newline(p) {
-    if (p === undefined) // we assume not given
-	p = SC_DEFAULT_OUT;
-    p.appendJSString("\n");
-}
-
-/* ------------------ write-char ---------------------------------------------------*/
-
-/*** META ((export #t)) */
-function sc_writeChar(c, p) {
-    if (p === undefined) // we assume not given
-	p = SC_DEFAULT_OUT;
-    p.appendJSString(c.val);
-}
-
-/* ------------------ write-circle ---------------------------------------------------*/
-
-/*** META ((export #t)) */
-function sc_writeCircle(o, p) {
-    if (p === undefined) // we assume not given
-	p = SC_DEFAULT_OUT;
-    p.appendJSString(sc_toWriteCircleString(o));
-}
-
-function sc_toWriteCircleString(o) {
-    var symb = sc_gensym("writeCircle");
-    var nbPointer = new Object();
-    nbPointer.nb = 0;
-    sc_prepWriteCircle(o, symb, nbPointer);
-    return sc_genToWriteCircleString(o, symb);
-}
-
-function sc_prepWriteCircle(o, symb, nbPointer) {
-    // TODO sc_Struct
-    if (o instanceof sc_Pair ||
-	o instanceof sc_Vector) {
-	if (o[symb] !== undefined) {
-	    // not the first visit.
-	    o[symb]++;
-	    // unless there is already a number, assign one.
-	    if (!o[symb + "nb"]) o[symb + "nb"] = nbPointer.nb++;
-	    return;
-	}
-	o[symb] = 0;
-	if (o instanceof sc_Pair) {
-	    sc_prepWriteCircle(o.car, symb, nbPointer);
-	    sc_prepWriteCircle(o.cdr, symb, nbPointer);
-	} else {
-	    for (var i = 0; i < o.length; i++)
-		sc_prepWriteCircle(o[i], symb, nbPointer);
-	}
-    }
-}
-
-function sc_genToWriteCircleString(o, symb) {
-    if (!(o instanceof sc_Pair ||
-	  o instanceof sc_Vector))
-	return sc_toWriteString(o);
-    return o.sc_toWriteCircleString(symb);
-}
-sc_Pair.prototype.sc_toWriteCircleString = function(symb, inList) {
-    if (this[symb + "use"]) { // use-flag is set. Just use it.
-	var nb = this[symb + "nb"];
-	if (this[symb]-- === 0) { // if we are the last use. remove all fields.
-	    delete this[symb];
-	    delete this[symb + "nb"];
-	    delete this[symb + "use"];
-	}
-	if (inList)
-	    return '. #' + nb + '#';
-	else
-	    return '#' + nb + '#';
-    }
-    if (this[symb]-- === 0) { // if we are the last use. remove all fields.
-	delete this[symb];
-	delete this[symb + "nb"];
-	delete this[symb + "use"];
-    }
-
-    var res = "";
-
-    if (this[symb] !== undefined) { // implies > 0
-	this[symb + "use"] = true;
-	if (inList)
-	    res += '. #' + this[symb + "nb"] + '=';
-	else
-	    res += '#' + this[symb + "nb"] + '=';
-	inList = false;
-    }
-
-    if (!inList)
-	res += "(";
-
-    // print car
-    res += sc_genToWriteCircleString(this.car, symb);
-
-    if (sc_isPair(this.cdr)) {
-	res += " " + this.cdr.sc_toWriteCircleString(symb, true);
-    } else if (this.cdr !== null) {
-	res += " . " + sc_genToWriteCircleString(this.cdr, symb);
-    }
-    if (!inList)
-	res += ")";
-    return res;
-};
-sc_Vector.prototype.sc_toWriteCircleString = function(symb) {
-    if (this[symb + "use"]) { // use-flag is set. Just use it.
-	var nb = this[symb + "nb"];
-	if (this[symb]-- === 0) { // if we are the last use. remove all fields.
-	    delete this[symb];
-	    delete this[symb + "nb"];
-	    delete this[symb + "use"];
-	}
-	return '#' + nb + '#';
-    }
-    if (this[symb]-- === 0) { // if we are the last use. remove all fields.
-	delete this[symb];
-	delete this[symb + "nb"];
-	delete this[symb + "use"];
-    }
-
-    var res = "";
-    if (this[symb] !== undefined) { // implies > 0
-	this[symb + "use"] = true;
-	res += '#' + this[symb + "nb"] + '=';
-    }
-    res += "#(";
-    for (var i = 0; i < this.length; i++) {
-	res += sc_genToWriteCircleString(this[i], symb);
-	if (i < this.length - 1) res += " ";
-    }
-    res += ")";
-    return res;
-};
-
-
-/* ------------------ print ---------------------------------------------------*/
-
-/*** META ((export #t)) */
-function sc_print(s) {
-    if (arguments.length === 1) {
-	sc_display(s);
-	sc_newline();
-    }
-    else {
-	for (var i = 0; i < arguments.length; i++)
-	    sc_display(arguments[i]);
-	sc_newline();
-    }
-}
-
-/* ------------------ format ---------------------------------------------------*/
-/*** META ((export #t)) */
-function sc_format(s, args) {
-   var len = s.length;
-   var p = new sc_StringOutputPort();
-   var i = 0, j = 1;
-
-   while( i < len ) {
-      var i2 = s.indexOf("~", i);
-
-      if (i2 == -1) {
-	  p.appendJSString( s.substring( i, len ) );
-	  return p.close();
-      } else {
-	 if (i2 > i) {
-	    if (i2 == (len - 1)) {
-		p.appendJSString(s.substring(i, len));
-		return p.close();
-	    } else {
-	       p.appendJSString(s.substring(i, i2));
-	       i = i2;
-	    }
-	 }
-
-	 switch(s.charCodeAt(i2 + 1)) {
-	    case 65:
-	    case 97:
-	       // a
-	       sc_display(arguments[j], p);
-	       i += 2; j++;
-	       break;
-
-	    case 83:
-	    case 115:
-	       // s
-	       sc_write(arguments[j], p);
-	       i += 2; j++;
-	       break;
-
-	    case 86:
-	    case 118:
-	       // v
-	       sc_display(arguments[j], p);
-	       p.appendJSString("\n");
-	       i += 2; j++;
-	       break;
-
-	    case 67:
-	    case 99:
-	       // c
-	       p.appendJSString(String.fromCharCode(arguments[j]));
-	       i += 2; j++;
-	       break;
-
-	    case 88:
-	    case 120:
-	       // x
-	       p.appendJSString(arguments[j].toString(6));
-	       i += 2; j++;
-	       break;
-
-	    case 79:
-	    case 111:
-	       // o
-	       p.appendJSString(arguments[j].toString(8));
-	       i += 2; j++;
-	       break;
-
-	    case 66:
-	    case 98:
-	       // b
-	       p.appendJSString(arguments[j].toString(2));
-	       i += 2; j++;
-	       break;
-
-	    case 37:
-	    case 110:
-	       // %, n
-	       p.appendJSString("\n");
-	       i += 2; break;
-
-	    case 114:
-	       // r
-	       p.appendJSString("\r");
-	       i += 2; break;
-
-	    case 126:
-	       // ~
-	       p.appendJSString("~");
-	       i += 2; break;
-
-	    default:
-	       sc_error( "format: illegal ~"
-			 + String.fromCharCode(s.charCodeAt(i2 + 1))
-			 + " sequence" );
-	       return "";
-	 }
-      }
-   }
-
-   return p.close();
-}
-
-/* ------------------ global ports ---------------------------------------------------*/
-
-var SC_DEFAULT_IN = new sc_ErrorInputPort();
-var SC_DEFAULT_OUT = new sc_ErrorOutputPort();
-var SC_ERROR_OUT = new sc_ErrorOutputPort();
-
-var sc_SYMBOL_PREFIX = "\u1E9C";
-var sc_KEYWORD_PREFIX = "\u1E9D";
-
-/*** META ((export #t)
-           (peephole (id))) */
-function sc_jsstring2string(s) {
-    return s;
-}
-
-/*** META ((export #t)
-           (peephole (prefix "'\\u1E9C' +")))
-*/
-function sc_jsstring2symbol(s) {
-    return sc_SYMBOL_PREFIX + s;
-}
-
-/*** META ((export #t)
-           (peephole (id)))
-*/
-function sc_string2jsstring(s) {
-    return s;
-}
-
-/*** META ((export #t)
-           (peephole (symbol2jsstring_immutable)))
-*/
-function sc_symbol2jsstring(s) {
-    return s.slice(1);
-}
-
-/*** META ((export #t)
-           (peephole (postfix ".slice(1)")))
-*/
-function sc_keyword2jsstring(k) {
-    return k.slice(1);
-}
-
-/*** META ((export #t)
-           (peephole (prefix "'\\u1E9D' +")))
-*/
-function sc_jsstring2keyword(s) {
-    return sc_KEYWORD_PREFIX + s;
-}
-
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isKeyword(s) {
-    return (typeof s === "string") &&
-	(s.charAt(0) === sc_KEYWORD_PREFIX);
-}
-
-
-/*** META ((export #t)) */
-var sc_gensym = function() {
-    var counter = 1000;
-    return function(sym) {
-	counter++;
-	if (!sym) sym = sc_SYMBOL_PREFIX;
-	return sym + "s" + counter + "~" + "^sC-GeNsYm ";
-    };
-}();
-
-
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isEqual(o1, o2) {
-    return ((o1 === o2) ||
-	    (sc_isPair(o1) && sc_isPair(o2)
-	     && sc_isPairEqual(o1, o2, sc_isEqual)) ||
-	    (sc_isVector(o1) && sc_isVector(o2)
-	     && sc_isVectorEqual(o1, o2, sc_isEqual)));
-}
-
-/*** META ((export number->symbol integer->symbol)) */
-function sc_number2symbol(x, radix) {
-    return sc_SYMBOL_PREFIX + sc_number2jsstring(x, radix);
-}
-
-/*** META ((export number->string integer->string)) */
-var sc_number2string = sc_number2jsstring;
-
-/*** META ((export #t)) */
-function sc_symbol2number(s, radix) {
-    return sc_jsstring2number(s.slice(1), radix);
-}
-
-/*** META ((export #t)) */
-var sc_string2number = sc_jsstring2number;
-
-/*** META ((export #t)
-           (peephole (prefix "+" s)))
-           ;; peephole will only apply if no radix is given.
-*/
-function sc_string2integer(s, radix) {
-    if (!radix) return +s;
-    return parseInt(s, radix);
-}
-
-/*** META ((export #t)
-           (peephole (prefix "+")))
-*/
-function sc_string2real(s) {
-    return +s;
-}
-
-
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isSymbol(s) {
-    return (typeof s === "string") &&
-	(s.charAt(0) === sc_SYMBOL_PREFIX);
-}
-
-/*** META ((export #t)
-           (peephole (symbol2string_immutable)))
-*/
-function sc_symbol2string(s) {
-    return s.slice(1);
-}
-
-/*** META ((export #t)
-           (peephole (prefix "'\\u1E9C' +")))
-*/
-function sc_string2symbol(s) {
-    return sc_SYMBOL_PREFIX + s;
-}
-
-/*** META ((export symbol-append)
-           (peephole (symbolAppend_immutable)))
-*/
-function sc_symbolAppend() {
-    var res = sc_SYMBOL_PREFIX;
-    for (var i = 0; i < arguments.length; i++)
-	res += arguments[i].slice(1);
-    return res;
-}
-
-/*** META ((export #t)
-           (peephole (postfix ".val")))
-*/
-function sc_char2string(c) { return c.val; }
-
-/*** META ((export #t)
-           (peephole (hole 1 "'\\u1E9C' + " c ".val")))
-*/
-function sc_char2symbol(c) { return sc_SYMBOL_PREFIX + c.val; }
-
-/*** META ((export #t)
-           (type bool))
-*/
-function sc_isString(s) {
-    return (typeof s === "string") &&
-	(s.charAt(0) !== sc_SYMBOL_PREFIX);
-}
-
-/*** META ((export #t)) */
-var sc_makeString = sc_makejsString;
-
-
-/*** META ((export #t)) */
-function sc_string() {
-    for (var i = 0; i < arguments.length; i++)
-	arguments[i] = arguments[i].val;
-    return "".concat.apply("", arguments);
-}
-
-/*** META ((export #t)
-           (peephole (postfix ".length")))
-*/
-function sc_stringLength(s) { return s.length; }
-
-/*** META ((export #t)) */
-function sc_stringRef(s, k) {
-    return new sc_Char(s.charAt(k));
-}
-
-/* there's no stringSet in the immutable version
-function sc_stringSet(s, k, c)
-*/
-
-
-/*** META ((export string=?)
-	   (type bool)
-           (peephole (hole 2 str1 " === " str2)))
-*/
-function sc_isStringEqual(s1, s2) {
-    return s1 === s2;
-}
-/*** META ((export string<?)
-	   (type bool)
-           (peephole (hole 2 str1 " < " str2)))
-*/
-function sc_isStringLess(s1, s2) {
-    return s1 < s2;
-}
-/*** META ((export string>?)
-	   (type bool)
-           (peephole (hole 2 str1 " > " str2)))
-*/
-function sc_isStringGreater(s1, s2) {
-    return s1 > s2;
-}
-/*** META ((export string<=?)
-	   (type bool)
-           (peephole (hole 2 str1 " <= " str2)))
-*/
-function sc_isStringLessEqual(s1, s2) {
-    return s1 <= s2;
-}
-/*** META ((export string>=?)
-	   (type bool)
-           (peephole (hole 2 str1 " >= " str2)))
-*/
-function sc_isStringGreaterEqual(s1, s2) {
-    return s1 >= s2;
-}
-/*** META ((export string-ci=?)
-	   (type bool)
-           (peephole (hole 2 str1 ".toLowerCase() === " str2 ".toLowerCase()")))
-*/
-function sc_isStringCIEqual(s1, s2) {
-    return s1.toLowerCase() === s2.toLowerCase();
-}
-/*** META ((export string-ci<?)
-	   (type bool)
-           (peephole (hole 2 str1 ".toLowerCase() < " str2 ".toLowerCase()")))
-*/
-function sc_isStringCILess(s1, s2) {
-    return s1.toLowerCase() < s2.toLowerCase();
-}
-/*** META ((export string-ci>?)
-	   (type bool)
-           (peephole (hole 2 str1 ".toLowerCase() > " str2 ".toLowerCase()")))
-*/
-function sc_isStringCIGreater(s1, s2) {
-    return s1.toLowerCase() > s2.toLowerCase();
-}
-/*** META ((export string-ci<=?)
-	   (type bool)
-           (peephole (hole 2 str1 ".toLowerCase() <= " str2 ".toLowerCase()")))
-*/
-function sc_isStringCILessEqual(s1, s2) {
-    return s1.toLowerCase() <= s2.toLowerCase();
-}
-/*** META ((export string-ci>=?)
-	   (type bool)
-           (peephole (hole 2 str1 ".toLowerCase() >= " str2 ".toLowerCase()")))
-*/
-function sc_isStringCIGreaterEqual(s1, s2) {
-    return s1.toLowerCase() >= s2.toLowerCase();
-}
-
-/*** META ((export #t)
-           (peephole (hole 3 s ".substring(" start ", " end ")")))
-*/
-function sc_substring(s, start, end) {
-    return s.substring(start, end);
-}
-
-/*** META ((export #t))
-*/
-function sc_isSubstring_at(s1, s2, i) {
-    return s2 == s1.substring(i, i+ s2.length);
-}
-
-/*** META ((export #t)
-           (peephole (infix 0 #f "+" "''")))
-*/
-function sc_stringAppend() {
-    return "".concat.apply("", arguments);
-}
-
-/*** META ((export #t)) */
-var sc_string2list = sc_jsstring2list;
-
-/*** META ((export #t)) */
-var sc_list2string = sc_list2jsstring;
-
-/*** META ((export #t)
-           (peephole (id)))
-*/
-function sc_stringCopy(s) {
-    return s;
-}
-
-/* there's no string-fill in the immutable version
-function sc_stringFill(s, c)
-*/
-
-/*** META ((export #t)
-           (peephole (postfix ".slice(1)")))
-*/
-function sc_keyword2string(o) {
-    return o.slice(1);
-}
-
-/*** META ((export #t)
-           (peephole (prefix "'\\u1E9D' +")))
-*/
-function sc_string2keyword(o) {
-    return sc_KEYWORD_PREFIX + o;
-}
-
-String.prototype.sc_toDisplayString = function() {
-    if (this.charAt(0) === sc_SYMBOL_PREFIX)
-	// TODO: care for symbols with spaces (escape-chars symbols).
-	return this.slice(1);
-    else if (this.charAt(0) === sc_KEYWORD_PREFIX)
-	return ":" + this.slice(1);
-    else
-	return this.toString();
-};
-
-String.prototype.sc_toWriteString = function() {
-    if (this.charAt(0) === sc_SYMBOL_PREFIX)
-	// TODO: care for symbols with spaces (escape-chars symbols).
-	return this.slice(1);
-    else if (this.charAt(0) === sc_KEYWORD_PREFIX)
-	return ":" + this.slice(1);
-    else
-	return '"' + sc_escapeWriteString(this) + '"';
-};
-/* Exported Variables */
-var BgL_testzd2boyerzd2;
-var BgL_nboyerzd2benchmarkzd2;
-var BgL_setupzd2boyerzd2;
-/* End Exports */
-
-var translate_term_nboyer;
-var translate_args_nboyer;
-var untranslate_term_nboyer;
-var BgL_sc_symbolzd2ze3symbolzd2record_1ze3_nboyer;
-var BgL_sc_za2symbolzd2recordszd2alistza2_2z00_nboyer;
-var translate_alist_nboyer;
-var apply_subst_nboyer;
-var apply_subst_lst_nboyer;
-var tautologyp_nboyer;
-var if_constructor_nboyer;
-var rewrite_count_nboyer;
-var rewrite_nboyer;
-var rewrite_args_nboyer;
-var unify_subst_nboyer;
-var one_way_unify1_nboyer;
-var false_term_nboyer;
-var true_term_nboyer;
-var trans_of_implies1_nboyer;
-var is_term_equal_nboyer;
-var is_term_member_nboyer;
-var const_nboyer;
-var sc_const_3_nboyer;
-var sc_const_4_nboyer;
-{
-    (sc_const_4_nboyer = (new sc_Pair("\u1E9Cimplies",(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cimplies",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cimplies",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cz",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cimplies",(new sc_Pair("\u1E9Cz",(new sc_Pair("\u1E9Cu",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cimplies",(new sc_Pair("\u1E9Cu",(new sc_Pair("\u1E9Cw",null)))))),null)))))),null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cimplies",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cw",null)))))),null)))))));
-    (sc_const_3_nboyer = sc_list((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ccompile",(new sc_Pair("\u1E9Cform",null)))),(new sc_Pair((new sc_Pair("\u1E9Creverse",(new sc_Pair((new sc_Pair("\u1E9Ccodegen",(new sc_Pair((new sc_Pair("\u1E9Coptimize",(new sc_Pair("\u1E9Cform",null)))),(new sc_Pair((new sc_Pair("\u1E9Cnil",null)),null)))))),null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ceqp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Cy",null)))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cgreaterp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cx",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Clesseqp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cx",null)))))),null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cgreatereqp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cboolean",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cor",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Ct",null)),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cf",null)),null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ciff",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cimplies",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cimplies",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cx",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ceven1",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Ct",null)),(new sc_Pair((new sc_Pair("\u1E9Codd",(new sc_Pair((new sc_Pair("\u1E9Csub1",(new sc_Pair("\u1E9Cx",null)))),null)))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ccountps-",(new sc_Pair("\u1E9Cl",(new sc_Pair("\u1E9Cpred",null)))))),(new sc_Pair((new sc_Pair("\u1E9Ccountps-loop",(new sc_Pair("\u1E9Cl",(new sc_Pair("\u1E9Cpred",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cfact-",(new sc_Pair("\u1E9Ci",null)))),(new sc_Pair((new sc_Pair("\u1E9Cfact-loop",(new sc_Pair("\u1E9Ci",(new sc_Pair((1),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Creverse-",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Creverse-loop",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cnil",null)),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cdivides",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair((new sc_Pair("\u1E9Cremainder",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cx",null)))))),null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cassume-true",(new sc_Pair("\u1E9Cvar",(new sc_Pair("\u1E9Calist",null)))))),(new sc_Pair((new sc_Pair("\u1E9Ccons",(new sc_Pair((new sc_Pair("\u1E9Ccons",(new sc_Pair("\u1E9Cvar",(new sc_Pair((new sc_Pair("\u1E9Ct",null)),null)))))),(new sc_Pair("\u1E9Calist",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cassume-false",(new sc_Pair("\u1E9Cvar",(new sc_Pair("\u1E9Calist",null)))))),(new sc_Pair((new sc_Pair("\u1E9Ccons",(new sc_Pair((new sc_Pair("\u1E9Ccons",(new sc_Pair("\u1E9Cvar",(new sc_Pair((new sc_Pair("\u1E9Cf",null)),null)))))),(new sc_Pair("\u1E9Calist",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ctautology-checker",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Ctautologyp",(new sc_Pair((new sc_Pair("\u1E9Cnormalize",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cnil",null)),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cfalsify",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cfalsify1",(new sc_Pair((new sc_Pair("\u1E9Cnormalize",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cnil",null)),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cprime",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cx",null)))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cadd1",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))),null)))))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cprime1",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Csub1",(new sc_Pair("\u1E9Cx",null)))),null)))))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair("\u1E9Cp",(new sc_Pair("\u1E9Cq",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair("\u1E9Cp",(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair("\u1E9Cq",(new sc_Pair((new sc_Pair("\u1E9Ct",null)),(new sc_Pair((new sc_Pair("\u1E9Cf",null)),null)))))))),(new sc_Pair((new sc_Pair("\u1E9Cf",null)),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cor",(new sc_Pair("\u1E9Cp",(new sc_Pair("\u1E9Cq",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair("\u1E9Cp",(new sc_Pair((new sc_Pair("\u1E9Ct",null)),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair("\u1E9Cq",(new sc_Pair((new sc_Pair("\u1E9Ct",null)),(new sc_Pair((new sc_Pair("\u1E9Cf",null)),null)))))))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair("\u1E9Cp",null)))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair("\u1E9Cp",(new sc_Pair((new sc_Pair("\u1E9Cf",null)),(new sc_Pair((new sc_Pair("\u1E9Ct",null)),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cimplies",(new sc_Pair("\u1E9Cp",(new sc_Pair("\u1E9Cq",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair("\u1E9Cp",(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair("\u1E9Cq",(new sc_Pair((new sc_Pair("\u1E9Ct",null)),(new sc_Pair((new sc_Pair("\u1E9Cf",null)),null)))))))),(new sc_Pair((new sc_Pair("\u1E9Ct",null)),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Cnumberp",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",(new sc_Pair("\u1E9Cc",null)))))))),(new sc_Pair("\u1E9Cd",(new sc_Pair("\u1E9Ce",null)))))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair("\u1E9Ca",(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair("\u1E9Cb",(new sc_Pair("\u1E9Cd",(new sc_Pair("\u1E9Ce",null)))))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair("\u1E9Cc",(new sc_Pair("\u1E9Cd",(new sc_Pair("\u1E9Ce",null)))))))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cor",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Cnumberp",(new sc_Pair("\u1E9Cx",null)))),null)))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair("\u1E9Cz",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cz",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Ca",null)))),(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cb",null)))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cx",null)))))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cc",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Cb",null)))),(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Cc",null)))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cx",null)))))),null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cnumberp",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cor",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))),(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cy",null)))),null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cmeaning",(new sc_Pair((new sc_Pair("\u1E9Cplus-tree",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))),(new sc_Pair("\u1E9Ca",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair((new sc_Pair("\u1E9Cmeaning",(new sc_Pair((new sc_Pair("\u1E9Cplus-tree",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair("\u1E9Ca",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cmeaning",(new sc_Pair((new sc_Pair("\u1E9Cplus-tree",(new sc_Pair("\u1E9Cy",null)))),(new sc_Pair("\u1E9Ca",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cmeaning",(new sc_Pair((new sc_Pair("\u1E9Cplus-tree",(new sc_Pair((new sc_Pair("\u1E9Cplus-fringe",(new sc_Pair("\u1E9Cx",null)))),null)))),(new sc_Pair("\u1E9Ca",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair((new sc_Pair("\u1E9Cmeaning",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Ca",null)))))),null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair("\u1E9Cz",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cz",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Creverse",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair((new sc_Pair("\u1E9Creverse",(new sc_Pair("\u1E9Cb",null)))),(new sc_Pair((new sc_Pair("\u1E9Creverse",(new sc_Pair("\u1E9Ca",null)))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cz",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cz",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair("\u1E9Cz",null)))))),(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cz",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cor",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cy",null)))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cexec",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair("\u1E9Cpds",(new sc_Pair("\u1E9Cenvrn",null)))))))),(new sc_Pair((new sc_Pair("\u1E9Cexec",(new sc_Pair("\u1E9Cy",(new sc_Pair((new sc_Pair("\u1E9Cexec",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cpds",(new sc_Pair("\u1E9Cenvrn",null)))))))),(new sc_Pair("\u1E9Cenvrn",null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cmc-flatten",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair((new sc_Pair("\u1E9Cflatten",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair("\u1E9Cy",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cmember",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cor",(new sc_Pair((new sc_Pair("\u1E9Cmember",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Ca",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cmember",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cb",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cmember",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Creverse",(new sc_Pair("\u1E9Cy",null)))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cmember",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Clength",(new sc_Pair((new sc_Pair("\u1E9Creverse",(new sc_Pair("\u1E9Cx",null)))),null)))),(new sc_Pair((new sc_Pair("\u1E9Clength",(new sc_Pair("\u1E9Cx",null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cmember",(new sc_Pair("\u1E9Ca",(new sc_Pair((new sc_Pair("\u1E9Cintersect",(new sc_Pair("\u1E9Cb",(new sc_Pair("\u1E9Cc",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cmember",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cmember",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cc",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cnth",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),(new sc_Pair("\u1E9Ci",null)))))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cexp",(new sc_Pair("\u1E9Ci",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cj",(new sc_Pair("\u1E9Ck",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair((new sc_Pair("\u1E9Cexp",(new sc_Pair("\u1E9Ci",(new sc_Pair("\u1E9Cj",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cexp",(new sc_Pair("\u1E9Ci",(new sc_Pair("\u1E9Ck",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cexp",(new sc_Pair("\u1E9Ci",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cj",(new sc_Pair("\u1E9Ck",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cexp",(new sc_Pair((new sc_Pair("\u1E9Cexp",(new sc_Pair("\u1E9Ci",(new sc_Pair("\u1E9Cj",null)))))),(new sc_Pair("\u1E9Ck",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Creverse-loop",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair((new sc_Pair("\u1E9Creverse",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair("\u1E9Cy",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Creverse-loop",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cnil",null)),null)))))),(new sc_Pair((new sc_Pair("\u1E9Creverse",(new sc_Pair("\u1E9Cx",null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ccount-list",(new sc_Pair("\u1E9Cz",(new sc_Pair((new sc_Pair("\u1E9Csort-lp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair((new sc_Pair("\u1E9Ccount-list",(new sc_Pair("\u1E9Cz",(new sc_Pair("\u1E9Cx",null)))))),(new sc_Pair((new sc_Pair("\u1E9Ccount-list",(new sc_Pair("\u1E9Cz",(new sc_Pair("\u1E9Cy",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cc",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cb",(new sc_Pair("\u1E9Cc",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair((new sc_Pair("\u1E9Cremainder",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cy",(new sc_Pair((new sc_Pair("\u1E9Cquotient",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Cx",null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cpower-eval",(new sc_Pair((new sc_Pair("\u1E9Cbig-plus1",(new sc_Pair("\u1E9Cl",(new sc_Pair("\u1E9Ci",(new sc_Pair("\u1E9Cbase",null)))))))),(new sc_Pair("\u1E9Cbase",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair((new sc_Pair("\u1E9Cpower-eval",(new sc_Pair("\u1E9Cl",(new sc_Pair("\u1E9Cbase",null)))))),(new sc_Pair("\u1E9Ci",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cpower-eval",(new sc_Pair((new sc_Pair("\u1E9Cbig-plus",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Ci",(new sc_Pair("\u1E9Cbase",null)))))))))),(new sc_Pair("\u1E9Cbase",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Ci",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair((new sc_Pair("\u1E9Cpower-eval",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cbase",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cpower-eval",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cbase",null)))))),null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cremainder",(new sc_Pair("\u1E9Cy",(new sc_Pair((1),null)))))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair((new sc_Pair("\u1E9Cremainder",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cy",null)))),null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cremainder",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cx",null)))))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair((new sc_Pair("\u1E9Cquotient",(new sc_Pair("\u1E9Ci",(new sc_Pair("\u1E9Cj",null)))))),(new sc_Pair("\u1E9Ci",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Ci",null)))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cor",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cj",null)))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cj",(new sc_Pair((1),null)))))),null)))),null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair((new sc_Pair("\u1E9Cremainder",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair("\u1E9Cx",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cy",null)))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cx",null)))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cpower-eval",(new sc_Pair((new sc_Pair("\u1E9Cpower-rep",(new sc_Pair("\u1E9Ci",(new sc_Pair("\u1E9Cbase",null)))))),(new sc_Pair("\u1E9Cbase",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Ci",null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cpower-eval",(new sc_Pair((new sc_Pair("\u1E9Cbig-plus",(new sc_Pair((new sc_Pair("\u1E9Cpower-rep",(new sc_Pair("\u1E9Ci",(new sc_Pair("\u1E9Cbase",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cpower-rep",(new sc_Pair("\u1E9Cj",(new sc_Pair("\u1E9Cbase",null)))))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),(new sc_Pair("\u1E9Cbase",null)))))))))),(new sc_Pair("\u1E9Cbase",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Ci",(new sc_Pair("\u1E9Cj",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cgcd",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cgcd",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cx",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cnth",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),(new sc_Pair("\u1E9Ci",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair((new sc_Pair("\u1E9Cnth",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Ci",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cnth",(new sc_Pair("\u1E9Cb",(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair("\u1E9Ci",(new sc_Pair((new sc_Pair("\u1E9Clength",(new sc_Pair("\u1E9Ca",null)))),null)))))),null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair("\u1E9Cx",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Cy",null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cx",null)))))),(new sc_Pair("\u1E9Cx",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Cy",null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cz",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cz",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair("\u1E9Cc",(new sc_Pair("\u1E9Cw",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cc",(new sc_Pair("\u1E9Cx",null)))))),(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cw",(new sc_Pair("\u1E9Cx",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cremainder",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cz",null)))))),(new sc_Pair("\u1E9Cz",null)))))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cb",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cc",null)))))),null)))))),(new sc_Pair("\u1E9Ca",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cb",(new sc_Pair("\u1E9Cc",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair((new sc_Pair("\u1E9Cadd1",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cz",null)))))),null)))),(new sc_Pair("\u1E9Cz",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cadd1",(new sc_Pair("\u1E9Cy",null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cz",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cz",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cz",null)))))),(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cz",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cz",null)))),null)))),(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cy",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cx",null)))),null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cgcd",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cz",null)))))),(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cz",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cz",(new sc_Pair((new sc_Pair("\u1E9Cgcd",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cvalue",(new sc_Pair((new sc_Pair("\u1E9Cnormalize",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair("\u1E9Ca",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cvalue",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Ca",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cflatten",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Ccons",(new sc_Pair("\u1E9Cy",(new sc_Pair((new sc_Pair("\u1E9Cnil",null)),null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cnlistp",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Clistp",(new sc_Pair((new sc_Pair("\u1E9Cgopher",(new sc_Pair("\u1E9Cx",null)))),null)))),(new sc_Pair((new sc_Pair("\u1E9Clistp",(new sc_Pair("\u1E9Cx",null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Csamefringe",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cflatten",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cflatten",(new sc_Pair("\u1E9Cy",null)))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cgreatest-factor",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cor",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cy",null)))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cy",(new sc_Pair((1),null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cgreatest-factor",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((1),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cx",(new sc_Pair((1),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cnumberp",(new sc_Pair((new sc_Pair("\u1E9Cgreatest-factor",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cor",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cy",null)))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cy",(new sc_Pair((1),null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Cnumberp",(new sc_Pair("\u1E9Cx",null)))),null)))),null)))))),null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ctimes-list",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))),(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair((new sc_Pair("\u1E9Ctimes-list",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Ctimes-list",(new sc_Pair("\u1E9Cy",null)))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cprime-list",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cprime-list",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cprime-list",(new sc_Pair("\u1E9Cy",null)))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cz",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cw",(new sc_Pair("\u1E9Cz",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cnumberp",(new sc_Pair("\u1E9Cz",null)))),(new sc_Pair((new sc_Pair("\u1E9Cor",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cz",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cw",(new sc_Pair((1),null)))))),null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cgreatereqp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cor",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cand",(new sc_Pair((new sc_Pair("\u1E9Cnumberp",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cy",(new sc_Pair((1),null)))))),null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cremainder",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cx",null)))))),(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),(new sc_Pair((1),null)))))),(new sc_Pair(sc_list("\u1E9Cand", (new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Ca",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))),null)))), (new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair("\u1E9Cb",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))),null)))), (new sc_Pair("\u1E9Cnumberp",(new sc_Pair("\u1E9Ca",null)))), (new sc_Pair("\u1E9Cnumberp",(new sc_Pair("\u1E9Cb",null)))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Csub1",(new sc_Pair("\u1E9Ca",null)))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Csub1",(new sc_Pair("\u1E9Cb",null)))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair((new sc_Pair("\u1E9Clength",(new sc_Pair((new sc_Pair("\u1E9Cdelete",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cl",null)))))),null)))),(new sc_Pair((new sc_Pair("\u1E9Clength",(new sc_Pair("\u1E9Cl",null)))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cmember",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cl",null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Csort2",(new sc_Pair((new sc_Pair("\u1E9Cdelete",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cl",null)))))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cdelete",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Csort2",(new sc_Pair("\u1E9Cl",null)))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cdsort",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Csort2",(new sc_Pair("\u1E9Cx",null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Clength",(new sc_Pair((new sc_Pair("\u1E9Ccons",(new sc_Pair("\u1E9Cx1",(new sc_Pair((new sc_Pair("\u1E9Ccons",(new sc_Pair("\u1E9Cx2",(new sc_Pair((new sc_Pair("\u1E9Ccons",(new sc_Pair("\u1E9Cx3",(new sc_Pair((new sc_Pair("\u1E9Ccons",(new sc_Pair("\u1E9Cx4",(new sc_Pair((new sc_Pair("\u1E9Ccons",(new sc_Pair("\u1E9Cx5",(new sc_Pair((new sc_Pair("\u1E9Ccons",(new sc_Pair("\u1E9Cx6",(new sc_Pair("\u1E9Cx7",null)))))),null)))))),null)))))),null)))))),null)))))),null)))))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair((6),(new sc_Pair((new sc_Pair("\u1E9Clength",(new sc_Pair("\u1E9Cx7",null)))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair((new sc_Pair("\u1E9Cadd1",(new sc_Pair((new sc_Pair("\u1E9Cadd1",(new sc_Pair("\u1E9Cx",null)))),null)))),(new sc_Pair((2),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Cx",null)))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cquotient",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))))),(new sc_Pair((2),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cquotient",(new sc_Pair("\u1E9Cy",(new sc_Pair((2),null)))))),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Csigma",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),(new sc_Pair("\u1E9Ci",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cquotient",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Ci",(new sc_Pair((new sc_Pair("\u1E9Cadd1",(new sc_Pair("\u1E9Ci",null)))),null)))))),(new sc_Pair((2),null)))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cadd1",(new sc_Pair("\u1E9Cy",null)))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Cnumberp",(new sc_Pair("\u1E9Cy",null)))),(new sc_Pair((new sc_Pair("\u1E9Cadd1",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cadd1",(new sc_Pair("\u1E9Cx",null)))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair("\u1E9Cz",(new sc_Pair("\u1E9Cy",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cz",null)))))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cz",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cnot",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cx",null)))))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Cz",null)))),null)))))),null)))))))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cmeaning",(new sc_Pair((new sc_Pair("\u1E9Cplus-tree",(new sc_Pair((new sc_Pair("\u1E9Cdelete",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))),(new sc_Pair("\u1E9Ca",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Cmember",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair((new sc_Pair("\u1E9Cmeaning",(new sc_Pair((new sc_Pair("\u1E9Cplus-tree",(new sc_Pair("\u1E9Cy",null)))),(new sc_Pair("\u1E9Ca",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cmeaning",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Ca",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cmeaning",(new sc_Pair((new sc_Pair("\u1E9Cplus-tree",(new sc_Pair("\u1E9Cy",null)))),(new sc_Pair("\u1E9Ca",null)))))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cadd1",(new sc_Pair("\u1E9Cy",null)))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Cnumberp",(new sc_Pair("\u1E9Cy",null)))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Cx",null)))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cnth",(new sc_Pair((new sc_Pair("\u1E9Cnil",null)),(new sc_Pair("\u1E9Ci",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Ci",null)))),(new sc_Pair((new sc_Pair("\u1E9Cnil",null)),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Clast",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Clistp",(new sc_Pair("\u1E9Cb",null)))),(new sc_Pair((new sc_Pair("\u1E9Clast",(new sc_Pair("\u1E9Cb",null)))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Clistp",(new sc_Pair("\u1E9Ca",null)))),(new sc_Pair((new sc_Pair("\u1E9Ccons",(new sc_Pair((new sc_Pair("\u1E9Ccar",(new sc_Pair((new sc_Pair("\u1E9Clast",(new sc_Pair("\u1E9Ca",null)))),null)))),(new sc_Pair("\u1E9Cb",null)))))),(new sc_Pair("\u1E9Cb",null)))))))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair("\u1E9Cz",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Clessp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ct",null)),(new sc_Pair("\u1E9Cz",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cf",null)),(new sc_Pair("\u1E9Cz",null)))))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cassignment",(new sc_Pair("\u1E9Cx",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Cassignedp",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Ca",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cassignment",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Ca",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cassignment",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cb",null)))))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Ccar",(new sc_Pair((new sc_Pair("\u1E9Cgopher",(new sc_Pair("\u1E9Cx",null)))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Clistp",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Ccar",(new sc_Pair((new sc_Pair("\u1E9Cflatten",(new sc_Pair("\u1E9Cx",null)))),null)))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cflatten",(new sc_Pair((new sc_Pair("\u1E9Ccdr",(new sc_Pair((new sc_Pair("\u1E9Cgopher",(new sc_Pair("\u1E9Cx",null)))),null)))),null)))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Clistp",(new sc_Pair("\u1E9Cx",null)))),(new sc_Pair((new sc_Pair("\u1E9Ccdr",(new sc_Pair((new sc_Pair("\u1E9Cflatten",(new sc_Pair("\u1E9Cx",null)))),null)))),(new sc_Pair((new sc_Pair("\u1E9Ccons",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),(new sc_Pair((new sc_Pair("\u1E9Cnil",null)),null)))))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cquotient",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cx",null)))))),(new sc_Pair("\u1E9Cy",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Czerop",(new sc_Pair("\u1E9Cy",null)))),(new sc_Pair((new sc_Pair("\u1E9Czero",null)),(new sc_Pair((new sc_Pair("\u1E9Cfix",(new sc_Pair("\u1E9Cx",null)))),null)))))))),null)))))), (new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cget",(new sc_Pair("\u1E9Cj",(new sc_Pair((new sc_Pair("\u1E9Cset",(new sc_Pair("\u1E9Ci",(new sc_Pair("\u1E9Cval",(new sc_Pair("\u1E9Cmem",null)))))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cif",(new sc_Pair((new sc_Pair("\u1E9Ceqp",(new sc_Pair("\u1E9Cj",(new sc_Pair("\u1E9Ci",null)))))),(new sc_Pair("\u1E9Cval",(new sc_Pair((new sc_Pair("\u1E9Cget",(new sc_Pair("\u1E9Cj",(new sc_Pair("\u1E9Cmem",null)))))),null)))))))),null))))))));
-    (const_nboyer = (new sc_Pair((new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cf",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cc",(new sc_Pair((new sc_Pair("\u1E9Czero",null)),null)))))),null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cy",(new sc_Pair("\u1E9Cf",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair((new sc_Pair("\u1E9Ctimes",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Cc",(new sc_Pair("\u1E9Cd",null)))))),null)))))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cz",(new sc_Pair("\u1E9Cf",(new sc_Pair((new sc_Pair("\u1E9Creverse",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair((new sc_Pair("\u1E9Cappend",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cnil",null)),null)))))),null)))),null)))))),(new sc_Pair((new sc_Pair("\u1E9Cu",(new sc_Pair("\u1E9Cequal",(new sc_Pair((new sc_Pair("\u1E9Cplus",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cdifference",(new sc_Pair("\u1E9Cx",(new sc_Pair("\u1E9Cy",null)))))),null)))))))),(new sc_Pair((new sc_Pair("\u1E9Cw",(new sc_Pair("\u1E9Clessp",(new sc_Pair((new sc_Pair("\u1E9Cremainder",(new sc_Pair("\u1E9Ca",(new sc_Pair("\u1E9Cb",null)))))),(new sc_Pair((new sc_Pair("\u1E9Cmember",(new sc_Pair("\u1E9Ca",(new sc_Pair((new sc_Pair("\u1E9Clength",(new sc_Pair("\u1E9Cb",null)))),null)))))),null)))))))),null)))))))))));
-    BgL_nboyerzd2benchmarkzd2 = function() {
-        var args = null;
-        for (var sc_tmp = arguments.length - 1; sc_tmp >= 0; sc_tmp--) {
-            args = sc_cons(arguments[sc_tmp], args);
-        }
-        var n;
-        return ((n = ((args === null)?(0):(args.car))), (BgL_setupzd2boyerzd2()), (BgL_runzd2benchmarkzd2(("nboyer"+(sc_number2string(n))), (1), function() {
-            return (BgL_testzd2boyerzd2(n));
-        }, function(rewrites) {
-            if ((sc_isNumber(rewrites)))
-                switch (n) {
-                case (0):
-                    return (rewrites===(95024));
-                    break;
-                case (1):
-                    return (rewrites===(591777));
-                    break;
-                case (2):
-                    return (rewrites===(1813975));
-                    break;
-                case (3):
-                    return (rewrites===(5375678));
-                    break;
-                case (4):
-                    return (rewrites===(16445406));
-                    break;
-                case (5):
-                    return (rewrites===(51507739));
-                    break;
-                default:
-                    return true;
-                    break;
-                }
-            else
-                return false;
-        })));
-    };
-    BgL_setupzd2boyerzd2 = function() {
-        return true;
-    };
-    BgL_testzd2boyerzd2 = function() {
-        return true;
-    };
-    translate_term_nboyer = function(term) {
-        var lst;
-        return (!(term instanceof sc_Pair)?term:(new sc_Pair((BgL_sc_symbolzd2ze3symbolzd2record_1ze3_nboyer((term.car))), ((lst = (term.cdr)), ((lst === null)?null:(new sc_Pair((translate_term_nboyer((lst.car))), (translate_args_nboyer((lst.cdr))))))))));
-    };
-    translate_args_nboyer = function(lst) {
-        var sc_lst_5;
-        var term;
-        return ((lst === null)?null:(new sc_Pair(((term = (lst.car)), (!(term instanceof sc_Pair)?term:(new sc_Pair((BgL_sc_symbolzd2ze3symbolzd2record_1ze3_nboyer((term.car))), (translate_args_nboyer((term.cdr))))))), ((sc_lst_5 = (lst.cdr)), ((sc_lst_5 === null)?null:(new sc_Pair((translate_term_nboyer((sc_lst_5.car))), (translate_args_nboyer((sc_lst_5.cdr))))))))));
-    };
-    untranslate_term_nboyer = function(term) {
-        var optrOpnd;
-        var tail1131;
-        var L1127;
-        var falseHead1130;
-        var symbol_record;
-        if (!(term instanceof sc_Pair))
-            return term;
-        else
-            {
-                (falseHead1130 = (new sc_Pair(null, null)));
-                (L1127 = (term.cdr));
-                (tail1131 = falseHead1130);
-                while (!(L1127 === null)) {
-                    {
-                        (tail1131.cdr = (new sc_Pair((untranslate_term_nboyer((L1127.car))), null)));
-                        (tail1131 = (tail1131.cdr));
-                        (L1127 = (L1127.cdr));
-                    }
-                }
-                (optrOpnd = (falseHead1130.cdr));
-                return (new sc_Pair(((symbol_record = (term.car)), (symbol_record[(0)])), optrOpnd));
-            }
-    };
-    BgL_sc_symbolzd2ze3symbolzd2record_1ze3_nboyer = function(sym) {
-        var r;
-        var x;
-        return ((x = (sc_assq(sym, BgL_sc_za2symbolzd2recordszd2alistza2_2z00_nboyer))), ((x!== false)?(x.cdr):((r = [sym, null]), (BgL_sc_za2symbolzd2recordszd2alistza2_2z00_nboyer = (new sc_Pair((new sc_Pair(sym, r)), BgL_sc_za2symbolzd2recordszd2alistza2_2z00_nboyer))), r)));
-    };
-    (BgL_sc_za2symbolzd2recordszd2alistza2_2z00_nboyer = null);
-    translate_alist_nboyer = function(alist) {
-        var sc_alist_6;
-        var term;
-        return ((alist === null)?null:(new sc_Pair((new sc_Pair((alist.car.car), ((term = (alist.car.cdr)), (!(term instanceof sc_Pair)?term:(new sc_Pair((BgL_sc_symbolzd2ze3symbolzd2record_1ze3_nboyer((term.car))), (translate_args_nboyer((term.cdr))))))))), ((sc_alist_6 = (alist.cdr)), ((sc_alist_6 === null)?null:(new sc_Pair((new sc_Pair((sc_alist_6.car.car), (translate_term_nboyer((sc_alist_6.car.cdr))))), (translate_alist_nboyer((sc_alist_6.cdr))))))))));
-    };
-    apply_subst_nboyer = function(alist, term) {
-        var lst;
-        var temp_temp;
-        return (!(term instanceof sc_Pair)?((temp_temp = (sc_assq(term, alist))), ((temp_temp!== false)?(temp_temp.cdr):term)):(new sc_Pair((term.car), ((lst = (term.cdr)), ((lst === null)?null:(new sc_Pair((apply_subst_nboyer(alist, (lst.car))), (apply_subst_lst_nboyer(alist, (lst.cdr))))))))));
-    };
-    apply_subst_lst_nboyer = function(alist, lst) {
-        var sc_lst_7;
-        return ((lst === null)?null:(new sc_Pair((apply_subst_nboyer(alist, (lst.car))), ((sc_lst_7 = (lst.cdr)), ((sc_lst_7 === null)?null:(new sc_Pair((apply_subst_nboyer(alist, (sc_lst_7.car))), (apply_subst_lst_nboyer(alist, (sc_lst_7.cdr))))))))));
-    };
-    tautologyp_nboyer = function(sc_x_11, true_lst, false_lst) {
-        var tmp1125;
-        var x;
-        var tmp1126;
-        var sc_x_8;
-        var sc_tmp1125_9;
-        var sc_tmp1126_10;
-        var sc_x_11;
-        var true_lst;
-        var false_lst;
-        while (true) {
-            if ((((sc_tmp1126_10 = (is_term_equal_nboyer(sc_x_11, true_term_nboyer))), ((sc_tmp1126_10!== false)?sc_tmp1126_10:(is_term_member_nboyer(sc_x_11, true_lst))))!== false))
-                return true;
-            else
-                if ((((sc_tmp1125_9 = (is_term_equal_nboyer(sc_x_11, false_term_nboyer))), ((sc_tmp1125_9!== false)?sc_tmp1125_9:(is_term_member_nboyer(sc_x_11, false_lst))))!== false))
-                    return false;
-                else
-                    if (!(sc_x_11 instanceof sc_Pair))
-                        return false;
-                    else
-                        if (((sc_x_11.car)===if_constructor_nboyer))
-                            if ((((sc_x_8 = (sc_x_11.cdr.car)), (tmp1126 = (is_term_equal_nboyer(sc_x_8, true_term_nboyer))), ((tmp1126!== false)?tmp1126:(is_term_member_nboyer(sc_x_8, true_lst))))!== false))
-                                (sc_x_11 = (sc_x_11.cdr.cdr.car));
-                            else
-                                if ((((x = (sc_x_11.cdr.car)), (tmp1125 = (is_term_equal_nboyer(x, false_term_nboyer))), ((tmp1125!== false)?tmp1125:(is_term_member_nboyer(x, false_lst))))!== false))
-                                    (sc_x_11 = (sc_x_11.cdr.cdr.cdr.car));
-                                else
-                                    if (((tautologyp_nboyer((sc_x_11.cdr.cdr.car), (new sc_Pair((sc_x_11.cdr.car), true_lst)), false_lst))!== false))
-                                        {
-                                            (false_lst = (new sc_Pair((sc_x_11.cdr.car), false_lst)));
-                                            (sc_x_11 = (sc_x_11.cdr.cdr.cdr.car));
-                                        }
-                                    else
-                                        return false;
-                        else
-                            return false;
-        }
-    };
-    (if_constructor_nboyer = "\u1E9C*");
-    (rewrite_count_nboyer = (0));
-    rewrite_nboyer = function(term) {
-        var term2;
-        var sc_term_12;
-        var lst;
-        var symbol_record;
-        var sc_lst_13;
-        {
-            (++rewrite_count_nboyer);
-            if (!(term instanceof sc_Pair))
-                return term;
-            else
-                {
-                    (sc_term_12 = (new sc_Pair((term.car), ((sc_lst_13 = (term.cdr)), ((sc_lst_13 === null)?null:(new sc_Pair((rewrite_nboyer((sc_lst_13.car))), (rewrite_args_nboyer((sc_lst_13.cdr))))))))));
-                    (lst = ((symbol_record = (term.car)), (symbol_record[(1)])));
-                    while (true) {
-                        if ((lst === null))
-                            return sc_term_12;
-                        else
-                            if ((((term2 = ((lst.car).cdr.car)), (unify_subst_nboyer = null), (one_way_unify1_nboyer(sc_term_12, term2)))!== false))
-                                return (rewrite_nboyer((apply_subst_nboyer(unify_subst_nboyer, ((lst.car).cdr.cdr.car)))));
-                            else
-                                (lst = (lst.cdr));
-                    }
-                }
-        }
-    };
-    rewrite_args_nboyer = function(lst) {
-        var sc_lst_14;
-        return ((lst === null)?null:(new sc_Pair((rewrite_nboyer((lst.car))), ((sc_lst_14 = (lst.cdr)), ((sc_lst_14 === null)?null:(new sc_Pair((rewrite_nboyer((sc_lst_14.car))), (rewrite_args_nboyer((sc_lst_14.cdr))))))))));
-    };
-    (unify_subst_nboyer = "\u1E9C*");
-    one_way_unify1_nboyer = function(term1, term2) {
-        var lst1;
-        var lst2;
-        var temp_temp;
-        if (!(term2 instanceof sc_Pair))
-            {
-                (temp_temp = (sc_assq(term2, unify_subst_nboyer)));
-                if ((temp_temp!== false))
-                    return (is_term_equal_nboyer(term1, (temp_temp.cdr)));
-                else
-                    if ((sc_isNumber(term2)))
-                        return (sc_isEqual(term1, term2));
-                    else
-                        {
-                            (unify_subst_nboyer = (new sc_Pair((new sc_Pair(term2, term1)), unify_subst_nboyer)));
-                            return true;
-                        }
-            }
-        else
-            if (!(term1 instanceof sc_Pair))
-                return false;
-            else
-                if (((term1.car)===(term2.car)))
-                    {
-                        (lst1 = (term1.cdr));
-                        (lst2 = (term2.cdr));
-                        while (true) {
-                            if ((lst1 === null))
-                                return (lst2 === null);
-                            else
-                                if ((lst2 === null))
-                                    return false;
-                                else
-                                    if (((one_way_unify1_nboyer((lst1.car), (lst2.car)))!== false))
-                                        {
-                                            (lst1 = (lst1.cdr));
-                                            (lst2 = (lst2.cdr));
-                                        }
-                                    else
-                                        return false;
-                        }
-                    }
-                else
-                    return false;
-    };
-    (false_term_nboyer = "\u1E9C*");
-    (true_term_nboyer = "\u1E9C*");
-    trans_of_implies1_nboyer = function(n) {
-        var sc_n_15;
-        return ((sc_isEqual(n, (1)))?(sc_list("\u1E9Cimplies", (0), (1))):(sc_list("\u1E9Cand", (sc_list("\u1E9Cimplies", (n-(1)), n)), ((sc_n_15 = (n-(1))), ((sc_isEqual(sc_n_15, (1)))?(sc_list("\u1E9Cimplies", (0), (1))):(sc_list("\u1E9Cand", (sc_list("\u1E9Cimplies", (sc_n_15-(1)), sc_n_15)), (trans_of_implies1_nboyer((sc_n_15-(1)))))))))));
-    };
-    is_term_equal_nboyer = function(x, y) {
-        var lst1;
-        var lst2;
-        var r2;
-        var r1;
-        if ((x instanceof sc_Pair))
-            if ((y instanceof sc_Pair))
-                if ((((r1 = (x.car)), (r2 = (y.car)), (r1===r2))!== false))
-                    {
-                        (lst1 = (x.cdr));
-                        (lst2 = (y.cdr));
-                        while (true) {
-                            if ((lst1 === null))
-                                return (lst2 === null);
-                            else
-                                if ((lst2 === null))
-                                    return false;
-                                else
-                                    if (((is_term_equal_nboyer((lst1.car), (lst2.car)))!== false))
-                                        {
-                                            (lst1 = (lst1.cdr));
-                                            (lst2 = (lst2.cdr));
-                                        }
-                                    else
-                                        return false;
-                        }
-                    }
-                else
-                    return false;
-            else
-                return false;
-        else
-            return (sc_isEqual(x, y));
-    };
-    is_term_member_nboyer = function(x, lst) {
-        var x;
-        var lst;
-        while (true) {
-            if ((lst === null))
-                return false;
-            else
-                if (((is_term_equal_nboyer(x, (lst.car)))!== false))
-                    return true;
-                else
-                    (lst = (lst.cdr));
-        }
-    };
-    BgL_setupzd2boyerzd2 = function() {
-        var symbol_record;
-        var value;
-        var BgL_sc_symbolzd2record_16zd2;
-        var sym;
-        var sc_sym_17;
-        var term;
-        var lst;
-        var sc_term_18;
-        var sc_term_19;
-        {
-            (BgL_sc_za2symbolzd2recordszd2alistza2_2z00_nboyer = null);
-            (if_constructor_nboyer = (BgL_sc_symbolzd2ze3symbolzd2record_1ze3_nboyer("\u1E9Cif")));
-            (false_term_nboyer = ((sc_term_19 = (new sc_Pair("\u1E9Cf",null))), (!(sc_term_19 instanceof sc_Pair)?sc_term_19:(new sc_Pair((BgL_sc_symbolzd2ze3symbolzd2record_1ze3_nboyer((sc_term_19.car))), (translate_args_nboyer((sc_term_19.cdr))))))));
-            (true_term_nboyer = ((sc_term_18 = (new sc_Pair("\u1E9Ct",null))), (!(sc_term_18 instanceof sc_Pair)?sc_term_18:(new sc_Pair((BgL_sc_symbolzd2ze3symbolzd2record_1ze3_nboyer((sc_term_18.car))), (translate_args_nboyer((sc_term_18.cdr))))))));
-            (lst = sc_const_3_nboyer);
-            while (!(lst === null)) {
-                {
-                    (term = (lst.car));
-                    if (((term instanceof sc_Pair)&&(((term.car)==="\u1E9Cequal")&&((term.cdr.car) instanceof sc_Pair))))
-                        {
-                            (sc_sym_17 = ((term.cdr.car).car));
-                            (value = (new sc_Pair((!(term instanceof sc_Pair)?term:(new sc_Pair((BgL_sc_symbolzd2ze3symbolzd2record_1ze3_nboyer((term.car))), (translate_args_nboyer((term.cdr)))))), ((sym = ((term.cdr.car).car)), (BgL_sc_symbolzd2record_16zd2 = (BgL_sc_symbolzd2ze3symbolzd2record_1ze3_nboyer(sym))), (BgL_sc_symbolzd2record_16zd2[(1)])))));
-                            (symbol_record = (BgL_sc_symbolzd2ze3symbolzd2record_1ze3_nboyer(sc_sym_17)));
-                            (symbol_record[(1)] = value);
-                        }
-                    else
-                        (sc_error("ADD-LEMMA did not like term:  ", term));
-                    (lst = (lst.cdr));
-                }
-            }
-            return true;
-        }
-    };
-    BgL_testzd2boyerzd2 = function(n) {
-        var optrOpnd;
-        var term;
-        var sc_n_20;
-        var answer;
-        var sc_term_21;
-        var sc_term_22;
-        {
-            (rewrite_count_nboyer = (0));
-            (term = sc_const_4_nboyer);
-            (sc_n_20 = n);
-            while (!(sc_n_20=== 0)) {
-                {
-                    (term = (sc_list("\u1E9Cor", term, (new sc_Pair("\u1E9Cf",null)))));
-                    (--sc_n_20);
-                }
-            }
-            (sc_term_22 = term);
-            if (!(sc_term_22 instanceof sc_Pair))
-                (optrOpnd = sc_term_22);
-            else
-                (optrOpnd = (new sc_Pair((BgL_sc_symbolzd2ze3symbolzd2record_1ze3_nboyer((sc_term_22.car))), (translate_args_nboyer((sc_term_22.cdr))))));
-            (sc_term_21 = (apply_subst_nboyer(((const_nboyer === null)?null:(new sc_Pair((new sc_Pair((const_nboyer.car.car), (translate_term_nboyer((const_nboyer.car.cdr))))), (translate_alist_nboyer((const_nboyer.cdr)))))), optrOpnd)));
-            (answer = (tautologyp_nboyer((rewrite_nboyer(sc_term_21)), null, null)));
-            (sc_write(rewrite_count_nboyer));
-            (sc_display(" rewrites"));
-            (sc_newline());
-            if ((answer!== false))
-                return rewrite_count_nboyer;
-            else
-                return false;
-        }
-    };
-}
-/* Exported Variables */
-var BgL_parsezd2ze3nbzd2treesze3;
-var BgL_earleyzd2benchmarkzd2;
-var BgL_parsezd2ze3parsedzf3zc2;
-var test;
-var BgL_parsezd2ze3treesz31;
-var BgL_makezd2parserzd2;
-/* End Exports */
-
-var const_earley;
-{
-    (const_earley = (new sc_Pair((new sc_Pair("\u1E9Cs",(new sc_Pair((new sc_Pair("\u1E9Ca",null)),(new sc_Pair((new sc_Pair("\u1E9Cs",(new sc_Pair("\u1E9Cs",null)))),null)))))),null)));
-    BgL_makezd2parserzd2 = function(grammar, lexer) {
-        var i;
-        var parser_descr;
-        var def_loop;
-        var nb_nts;
-        var names;
-        var steps;
-        var predictors;
-        var enders;
-        var starters;
-        var nts;
-        var sc_names_1;
-        var sc_steps_2;
-        var sc_predictors_3;
-        var sc_enders_4;
-        var sc_starters_5;
-        var nb_confs;
-        var BgL_sc_defzd2loop_6zd2;
-        var BgL_sc_nbzd2nts_7zd2;
-        var sc_nts_8;
-        var BgL_sc_defzd2loop_9zd2;
-        var ind;
-        {
-            ind = function(nt, sc_nts_10) {
-                var i;
-                {
-                    (i = ((sc_nts_10.length)-(1)));
-                    while (true) {
-                        if ((i>=(0)))
-                            if ((sc_isEqual((sc_nts_10[i]), nt)))
-                                return i;
-                            else
-                                (--i);
-                        else
-                            return false;
-                    }
-                }
-            };
-            (sc_nts_8 = ((BgL_sc_defzd2loop_9zd2 = function(defs, sc_nts_11) {
-                var rule_loop;
-                var head;
-                var def;
-                return ((defs instanceof sc_Pair)?((def = (defs.car)), (head = (def.car)), (rule_loop = function(rules, sc_nts_12) {
-                    var nt;
-                    var l;
-                    var sc_nts_13;
-                    var rule;
-                    if ((rules instanceof sc_Pair))
-                        {
-                            (rule = (rules.car));
-                            (l = rule);
-                            (sc_nts_13 = sc_nts_12);
-                            while ((l instanceof sc_Pair)) {
-                                {
-                                    (nt = (l.car));
-                                    (l = (l.cdr));
-                                    (sc_nts_13 = (((sc_member(nt, sc_nts_13))!== false)?sc_nts_13:(new sc_Pair(nt, sc_nts_13))));
-                                }
-                            }
-                            return (rule_loop((rules.cdr), sc_nts_13));
-                        }
-                    else
-                        return (BgL_sc_defzd2loop_9zd2((defs.cdr), sc_nts_12));
-                }), (rule_loop((def.cdr), (((sc_member(head, sc_nts_11))!== false)?sc_nts_11:(new sc_Pair(head, sc_nts_11)))))):(sc_list2vector((sc_reverse(sc_nts_11)))));
-            }), (BgL_sc_defzd2loop_9zd2(grammar, null))));
-            (BgL_sc_nbzd2nts_7zd2 = (sc_nts_8.length));
-            (nb_confs = (((BgL_sc_defzd2loop_6zd2 = function(defs, BgL_sc_nbzd2confs_14zd2) {
-                var rule_loop;
-                var def;
-                return ((defs instanceof sc_Pair)?((def = (defs.car)), (rule_loop = function(rules, BgL_sc_nbzd2confs_15zd2) {
-                    var l;
-                    var BgL_sc_nbzd2confs_16zd2;
-                    var rule;
-                    if ((rules instanceof sc_Pair))
-                        {
-                            (rule = (rules.car));
-                            (l = rule);
-                            (BgL_sc_nbzd2confs_16zd2 = BgL_sc_nbzd2confs_15zd2);
-                            while ((l instanceof sc_Pair)) {
-                                {
-                                    (l = (l.cdr));
-                                    (++BgL_sc_nbzd2confs_16zd2);
-                                }
-                            }
-                            return (rule_loop((rules.cdr), (BgL_sc_nbzd2confs_16zd2+(1))));
-                        }
-                    else
-                        return (BgL_sc_defzd2loop_6zd2((defs.cdr), BgL_sc_nbzd2confs_15zd2));
-                }), (rule_loop((def.cdr), BgL_sc_nbzd2confs_14zd2))):BgL_sc_nbzd2confs_14zd2);
-            }), (BgL_sc_defzd2loop_6zd2(grammar, (0))))+BgL_sc_nbzd2nts_7zd2));
-            (sc_starters_5 = (sc_makeVector(BgL_sc_nbzd2nts_7zd2, null)));
-            (sc_enders_4 = (sc_makeVector(BgL_sc_nbzd2nts_7zd2, null)));
-            (sc_predictors_3 = (sc_makeVector(BgL_sc_nbzd2nts_7zd2, null)));
-            (sc_steps_2 = (sc_makeVector(nb_confs, false)));
-            (sc_names_1 = (sc_makeVector(nb_confs, false)));
-            (nts = sc_nts_8);
-            (starters = sc_starters_5);
-            (enders = sc_enders_4);
-            (predictors = sc_predictors_3);
-            (steps = sc_steps_2);
-            (names = sc_names_1);
-            (nb_nts = (sc_nts_8.length));
-            (i = (nb_nts-(1)));
-            while ((i>=(0))) {
-                {
-                    (sc_steps_2[i] = (i-nb_nts));
-                    (sc_names_1[i] = (sc_list((sc_nts_8[i]), (0))));
-                    (sc_enders_4[i] = (sc_list(i)));
-                    (--i);
-                }
-            }
-            def_loop = function(defs, conf) {
-                var rule_loop;
-                var head;
-                var def;
-                return ((defs instanceof sc_Pair)?((def = (defs.car)), (head = (def.car)), (rule_loop = function(rules, conf, rule_num) {
-                    var i;
-                    var sc_i_17;
-                    var nt;
-                    var l;
-                    var sc_conf_18;
-                    var sc_i_19;
-                    var rule;
-                    if ((rules instanceof sc_Pair))
-                        {
-                            (rule = (rules.car));
-                            (names[conf] = (sc_list(head, rule_num)));
-                            (sc_i_19 = (ind(head, nts)));
-                            (starters[sc_i_19] = (new sc_Pair(conf, (starters[sc_i_19]))));
-                            (l = rule);
-                            (sc_conf_18 = conf);
-                            while ((l instanceof sc_Pair)) {
-                                {
-                                    (nt = (l.car));
-                                    (steps[sc_conf_18] = (ind(nt, nts)));
-                                    (sc_i_17 = (ind(nt, nts)));
-                                    (predictors[sc_i_17] = (new sc_Pair(sc_conf_18, (predictors[sc_i_17]))));
-                                    (l = (l.cdr));
-                                    (++sc_conf_18);
-                                }
-                            }
-                            (steps[sc_conf_18] = ((ind(head, nts))-nb_nts));
-                            (i = (ind(head, nts)));
-                            (enders[i] = (new sc_Pair(sc_conf_18, (enders[i]))));
-                            return (rule_loop((rules.cdr), (sc_conf_18+(1)), (rule_num+(1))));
-                        }
-                    else
-                        return (def_loop((defs.cdr), conf));
-                }), (rule_loop((def.cdr), conf, (1)))):undefined);
-            };
-            (def_loop(grammar, (sc_nts_8.length)));
-            (parser_descr = [lexer, sc_nts_8, sc_starters_5, sc_enders_4, sc_predictors_3, sc_steps_2, sc_names_1]);
-            return function(input) {
-                var optrOpnd;
-                var sc_optrOpnd_20;
-                var sc_optrOpnd_21;
-                var sc_optrOpnd_22;
-                var loop1;
-                var BgL_sc_stateza2_23za2;
-                var toks;
-                var BgL_sc_nbzd2nts_24zd2;
-                var sc_steps_25;
-                var sc_enders_26;
-                var state_num;
-                var BgL_sc_statesza2_27za2;
-                var states;
-                var i;
-                var conf;
-                var l;
-                var tok_nts;
-                var sc_i_28;
-                var sc_i_29;
-                var l1;
-                var l2;
-                var tok;
-                var tail1129;
-                var L1125;
-                var goal_enders;
-                var BgL_sc_statesza2_30za2;
-                var BgL_sc_nbzd2nts_31zd2;
-                var BgL_sc_nbzd2confs_32zd2;
-                var nb_toks;
-                var goal_starters;
-                var sc_states_33;
-                var BgL_sc_nbzd2confs_34zd2;
-                var BgL_sc_nbzd2toks_35zd2;
-                var sc_toks_36;
-                var falseHead1128;
-                var sc_names_37;
-                var sc_steps_38;
-                var sc_predictors_39;
-                var sc_enders_40;
-                var sc_starters_41;
-                var sc_nts_42;
-                var lexer;
-                var sc_ind_43;
-                var make_states;
-                var BgL_sc_confzd2setzd2getza2_44za2;
-                var conf_set_merge_new_bang;
-                var conf_set_adjoin;
-                var BgL_sc_confzd2setzd2adjoinza2_45za2;
-                var BgL_sc_confzd2setzd2adjoinza2za2_46z00;
-                var conf_set_union;
-                var forw;
-                var is_parsed;
-                var deriv_trees;
-                var BgL_sc_derivzd2treesza2_47z70;
-                var nb_deriv_trees;
-                var BgL_sc_nbzd2derivzd2treesza2_48za2;
-                {
-                    sc_ind_43 = function(nt, sc_nts_49) {
-                        var i;
-                        {
-                            (i = ((sc_nts_49.length)-(1)));
-                            while (true) {
-                                if ((i>=(0)))
-                                    if ((sc_isEqual((sc_nts_49[i]), nt)))
-                                        return i;
-                                    else
-                                        (--i);
-                                else
-                                    return false;
-                            }
-                        }
-                    };
-                    make_states = function(BgL_sc_nbzd2toks_50zd2, BgL_sc_nbzd2confs_51zd2) {
-                        var v;
-                        var i;
-                        var sc_states_52;
-                        {
-                            (sc_states_52 = (sc_makeVector((BgL_sc_nbzd2toks_50zd2+(1)), false)));
-                            (i = BgL_sc_nbzd2toks_50zd2);
-                            while ((i>=(0))) {
-                                {
-                                    (v = (sc_makeVector((BgL_sc_nbzd2confs_51zd2+(1)), false)));
-                                    (v[(0)] = (-1));
-                                    (sc_states_52[i] = v);
-                                    (--i);
-                                }
-                            }
-                            return sc_states_52;
-                        }
-                    };
-                    BgL_sc_confzd2setzd2getza2_44za2 = function(state, BgL_sc_statezd2num_53zd2, sc_conf_54) {
-                        var conf_set;
-                        var BgL_sc_confzd2set_55zd2;
-                        return ((BgL_sc_confzd2set_55zd2 = (state[(sc_conf_54+(1))])), ((BgL_sc_confzd2set_55zd2!== false)?BgL_sc_confzd2set_55zd2:((conf_set = (sc_makeVector((BgL_sc_statezd2num_53zd2+(6)), false))), (conf_set[(1)] = (-3)), (conf_set[(2)] = (-1)), (conf_set[(3)] = (-1)), (conf_set[(4)] = (-1)), (state[(sc_conf_54+(1))] = conf_set), conf_set)));
-                    };
-                    conf_set_merge_new_bang = function(conf_set) {
-                        return ((conf_set[((conf_set[(1)])+(5))] = (conf_set[(4)])), (conf_set[(1)] = (conf_set[(3)])), (conf_set[(3)] = (-1)), (conf_set[(4)] = (-1)));
-                    };
-                    conf_set_adjoin = function(state, conf_set, sc_conf_56, i) {
-                        var tail;
-                        return ((tail = (conf_set[(3)])), (conf_set[(i+(5))] = (-1)), (conf_set[(tail+(5))] = i), (conf_set[(3)] = i), ((tail<(0))?((conf_set[(0)] = (state[(0)])), (state[(0)] = sc_conf_56)):undefined));
-                    };
-                    BgL_sc_confzd2setzd2adjoinza2_45za2 = function(sc_states_57, BgL_sc_statezd2num_58zd2, l, i) {
-                        var conf_set;
-                        var sc_conf_59;
-                        var l1;
-                        var state;
-                        {
-                            (state = (sc_states_57[BgL_sc_statezd2num_58zd2]));
-                            (l1 = l);
-                            while ((l1 instanceof sc_Pair)) {
-                                {
-                                    (sc_conf_59 = (l1.car));
-                                    (conf_set = (BgL_sc_confzd2setzd2getza2_44za2(state, BgL_sc_statezd2num_58zd2, sc_conf_59)));
-                                    if (((conf_set[(i+(5))])=== false))
-                                        {
-                                            (conf_set_adjoin(state, conf_set, sc_conf_59, i));
-                                            (l1 = (l1.cdr));
-                                        }
-                                    else
-                                        (l1 = (l1.cdr));
-                                }
-                            }
-                            return undefined;
-                        }
-                    };
-                    BgL_sc_confzd2setzd2adjoinza2za2_46z00 = function(sc_states_60, BgL_sc_statesza2_61za2, BgL_sc_statezd2num_62zd2, sc_conf_63, i) {
-                        var BgL_sc_confzd2setza2_64z70;
-                        var BgL_sc_stateza2_65za2;
-                        var conf_set;
-                        var state;
-                        return ((state = (sc_states_60[BgL_sc_statezd2num_62zd2])), ((((conf_set = (state[(sc_conf_63+(1))])), ((conf_set!== false)?(conf_set[(i+(5))]):false))!== false)?((BgL_sc_stateza2_65za2 = (BgL_sc_statesza2_61za2[BgL_sc_statezd2num_62zd2])), (BgL_sc_confzd2setza2_64z70 = (BgL_sc_confzd2setzd2getza2_44za2(BgL_sc_stateza2_65za2, BgL_sc_statezd2num_62zd2, sc_conf_63))), (((BgL_sc_confzd2setza2_64z70[(i+(5))])=== false)?(conf_set_adjoin(BgL_sc_stateza2_65za2, BgL_sc_confzd2setza2_64z70, sc_conf_63, i)):undefined), true):false));
-                    };
-                    conf_set_union = function(state, conf_set, sc_conf_66, other_set) {
-                        var i;
-                        {
-                            (i = (other_set[(2)]));
-                            while ((i>=(0))) {
-                                if (((conf_set[(i+(5))])=== false))
-                                    {
-                                        (conf_set_adjoin(state, conf_set, sc_conf_66, i));
-                                        (i = (other_set[(i+(5))]));
-                                    }
-                                else
-                                    (i = (other_set[(i+(5))]));
-                            }
-                            return undefined;
-                        }
-                    };
-                    forw = function(sc_states_67, BgL_sc_statezd2num_68zd2, sc_starters_69, sc_enders_70, sc_predictors_71, sc_steps_72, sc_nts_73) {
-                        var next_set;
-                        var next;
-                        var conf_set;
-                        var ender;
-                        var l;
-                        var starter_set;
-                        var starter;
-                        var sc_l_74;
-                        var sc_loop1_75;
-                        var head;
-                        var BgL_sc_confzd2set_76zd2;
-                        var BgL_sc_statezd2num_77zd2;
-                        var state;
-                        var sc_states_78;
-                        var preds;
-                        var BgL_sc_confzd2set_79zd2;
-                        var step;
-                        var sc_conf_80;
-                        var BgL_sc_nbzd2nts_81zd2;
-                        var sc_state_82;
-                        {
-                            (sc_state_82 = (sc_states_67[BgL_sc_statezd2num_68zd2]));
-                            (BgL_sc_nbzd2nts_81zd2 = (sc_nts_73.length));
-                            while (true) {
-                                {
-                                    (sc_conf_80 = (sc_state_82[(0)]));
-                                    if ((sc_conf_80>=(0)))
-                                        {
-                                            (step = (sc_steps_72[sc_conf_80]));
-                                            (BgL_sc_confzd2set_79zd2 = (sc_state_82[(sc_conf_80+(1))]));
-                                            (head = (BgL_sc_confzd2set_79zd2[(4)]));
-                                            (sc_state_82[(0)] = (BgL_sc_confzd2set_79zd2[(0)]));
-                                            (conf_set_merge_new_bang(BgL_sc_confzd2set_79zd2));
-                                            if ((step>=(0)))
-                                                {
-                                                    (sc_l_74 = (sc_starters_69[step]));
-                                                    while ((sc_l_74 instanceof sc_Pair)) {
-                                                        {
-                                                            (starter = (sc_l_74.car));
-                                                            (starter_set = (BgL_sc_confzd2setzd2getza2_44za2(sc_state_82, BgL_sc_statezd2num_68zd2, starter)));
-                                                            if (((starter_set[(BgL_sc_statezd2num_68zd2+(5))])=== false))
-                                                                {
-                                                                    (conf_set_adjoin(sc_state_82, starter_set, starter, BgL_sc_statezd2num_68zd2));
-                                                                    (sc_l_74 = (sc_l_74.cdr));
-                                                                }
-                                                            else
-                                                                (sc_l_74 = (sc_l_74.cdr));
-                                                        }
-                                                    }
-                                                    (l = (sc_enders_70[step]));
-                                                    while ((l instanceof sc_Pair)) {
-                                                        {
-                                                            (ender = (l.car));
-                                                            if ((((conf_set = (sc_state_82[(ender+(1))])), ((conf_set!== false)?(conf_set[(BgL_sc_statezd2num_68zd2+(5))]):false))!== false))
-                                                                {
-                                                                    (next = (sc_conf_80+(1)));
-                                                                    (next_set = (BgL_sc_confzd2setzd2getza2_44za2(sc_state_82, BgL_sc_statezd2num_68zd2, next)));
-                                                                    (conf_set_union(sc_state_82, next_set, next, BgL_sc_confzd2set_79zd2));
-                                                                    (l = (l.cdr));
-                                                                }
-                                                            else
-                                                                (l = (l.cdr));
-                                                        }
-                                                    }
-                                                }
-                                            else
-                                                {
-                                                    (preds = (sc_predictors_71[(step+BgL_sc_nbzd2nts_81zd2)]));
-                                                    (sc_states_78 = sc_states_67);
-                                                    (state = sc_state_82);
-                                                    (BgL_sc_statezd2num_77zd2 = BgL_sc_statezd2num_68zd2);
-                                                    (BgL_sc_confzd2set_76zd2 = BgL_sc_confzd2set_79zd2);
-                                                    sc_loop1_75 = function(l) {
-                                                        var sc_state_83;
-                                                        var BgL_sc_nextzd2set_84zd2;
-                                                        var sc_next_85;
-                                                        var pred_set;
-                                                        var i;
-                                                        var pred;
-                                                        if ((l instanceof sc_Pair))
-                                                            {
-                                                                (pred = (l.car));
-                                                                (i = head);
-                                                                while ((i>=(0))) {
-                                                                    {
-                                                                        (pred_set = ((sc_state_83 = (sc_states_78[i])), (sc_state_83[(pred+(1))])));
-                                                                        if ((pred_set!== false))
-                                                                            {
-                                                                                (sc_next_85 = (pred+(1)));
-                                                                                (BgL_sc_nextzd2set_84zd2 = (BgL_sc_confzd2setzd2getza2_44za2(state, BgL_sc_statezd2num_77zd2, sc_next_85)));
-                                                                                (conf_set_union(state, BgL_sc_nextzd2set_84zd2, sc_next_85, pred_set));
-                                                                            }
-                                                                        (i = (BgL_sc_confzd2set_76zd2[(i+(5))]));
-                                                                    }
-                                                                }
-                                                                return (sc_loop1_75((l.cdr)));
-                                                            }
-                                                        else
-                                                            return undefined;
-                                                    };
-                                                    (sc_loop1_75(preds));
-                                                }
-                                        }
-                                    else
-                                        return undefined;
-                                }
-                            }
-                        }
-                    };
-                    is_parsed = function(nt, i, j, sc_nts_86, sc_enders_87, sc_states_88) {
-                        var conf_set;
-                        var state;
-                        var sc_conf_89;
-                        var l;
-                        var BgL_sc_ntza2_90za2;
-                        {
-                            (BgL_sc_ntza2_90za2 = (sc_ind_43(nt, sc_nts_86)));
-                            if ((BgL_sc_ntza2_90za2!== false))
-                                {
-                                    (sc_nts_86.length);
-                                    (l = (sc_enders_87[BgL_sc_ntza2_90za2]));
-                                    while (true) {
-                                        if ((l instanceof sc_Pair))
-                                            {
-                                                (sc_conf_89 = (l.car));
-                                                if ((((state = (sc_states_88[j])), (conf_set = (state[(sc_conf_89+(1))])), ((conf_set!== false)?(conf_set[(i+(5))]):false))!== false))
-                                                    return true;
-                                                else
-                                                    (l = (l.cdr));
-                                            }
-                                        else
-                                            return false;
-                                    }
-                                }
-                            else
-                                return false;
-                        }
-                    };
-                    deriv_trees = function(sc_conf_91, i, j, sc_enders_92, sc_steps_93, sc_names_94, sc_toks_95, sc_states_96, BgL_sc_nbzd2nts_97zd2) {
-                        var sc_loop1_98;
-                        var prev;
-                        var name;
-                        return ((name = (sc_names_94[sc_conf_91])), ((name!== false)?((sc_conf_91<BgL_sc_nbzd2nts_97zd2)?(sc_list((sc_list(name, ((sc_toks_95[i]).car))))):(sc_list((sc_list(name))))):((prev = (sc_conf_91-(1))), (sc_loop1_98 = function(l1, l2) {
-                            var loop2;
-                            var ender_set;
-                            var state;
-                            var ender;
-                            var l1;
-                            var l2;
-                            while (true) {
-                                if ((l1 instanceof sc_Pair))
-                                    {
-                                        (ender = (l1.car));
-                                        (ender_set = ((state = (sc_states_96[j])), (state[(ender+(1))])));
-                                        if ((ender_set!== false))
-                                            {
-                                                loop2 = function(k, l2) {
-                                                    var loop3;
-                                                    var ender_trees;
-                                                    var prev_trees;
-                                                    var conf_set;
-                                                    var sc_state_99;
-                                                    var k;
-                                                    var l2;
-                                                    while (true) {
-                                                        if ((k>=(0)))
-                                                            if (((k>=i)&&(((sc_state_99 = (sc_states_96[k])), (conf_set = (sc_state_99[(prev+(1))])), ((conf_set!== false)?(conf_set[(i+(5))]):false))!== false)))
-                                                                {
-                                                                    (prev_trees = (deriv_trees(prev, i, k, sc_enders_92, sc_steps_93, sc_names_94, sc_toks_95, sc_states_96, BgL_sc_nbzd2nts_97zd2)));
-                                                                    (ender_trees = (deriv_trees(ender, k, j, sc_enders_92, sc_steps_93, sc_names_94, sc_toks_95, sc_states_96, BgL_sc_nbzd2nts_97zd2)));
-                                                                    loop3 = function(l3, l2) {
-                                                                        var l4;
-                                                                        var sc_l2_100;
-                                                                        var ender_tree;
-                                                                        if ((l3 instanceof sc_Pair))
-                                                                            {
-                                                                                (ender_tree = (sc_list((l3.car))));
-                                                                                (l4 = prev_trees);
-                                                                                (sc_l2_100 = l2);
-                                                                                while ((l4 instanceof sc_Pair)) {
-                                                                                    {
-                                                                                        (sc_l2_100 = (new sc_Pair((sc_append((l4.car), ender_tree)), sc_l2_100)));
-                                                                                        (l4 = (l4.cdr));
-                                                                                    }
-                                                                                }
-                                                                                return (loop3((l3.cdr), sc_l2_100));
-                                                                            }
-                                                                        else
-                                                                            return (loop2((ender_set[(k+(5))]), l2));
-                                                                    };
-                                                                    return (loop3(ender_trees, l2));
-                                                                }
-                                                            else
-                                                                (k = (ender_set[(k+(5))]));
-                                                        else
-                                                            return (sc_loop1_98((l1.cdr), l2));
-                                                    }
-                                                };
-                                                return (loop2((ender_set[(2)]), l2));
-                                            }
-                                        else
-                                            (l1 = (l1.cdr));
-                                    }
-                                else
-                                    return l2;
-                            }
-                        }), (sc_loop1_98((sc_enders_92[(sc_steps_93[prev])]), null)))));
-                    };
-                    BgL_sc_derivzd2treesza2_47z70 = function(nt, i, j, sc_nts_101, sc_enders_102, sc_steps_103, sc_names_104, sc_toks_105, sc_states_106) {
-                        var conf_set;
-                        var state;
-                        var sc_conf_107;
-                        var l;
-                        var trees;
-                        var BgL_sc_nbzd2nts_108zd2;
-                        var BgL_sc_ntza2_109za2;
-                        {
-                            (BgL_sc_ntza2_109za2 = (sc_ind_43(nt, sc_nts_101)));
-                            if ((BgL_sc_ntza2_109za2!== false))
-                                {
-                                    (BgL_sc_nbzd2nts_108zd2 = (sc_nts_101.length));
-                                    (l = (sc_enders_102[BgL_sc_ntza2_109za2]));
-                                    (trees = null);
-                                    while ((l instanceof sc_Pair)) {
-                                        {
-                                            (sc_conf_107 = (l.car));
-                                            if ((((state = (sc_states_106[j])), (conf_set = (state[(sc_conf_107+(1))])), ((conf_set!== false)?(conf_set[(i+(5))]):false))!== false))
-                                                {
-                                                    (l = (l.cdr));
-                                                    (trees = (sc_append((deriv_trees(sc_conf_107, i, j, sc_enders_102, sc_steps_103, sc_names_104, sc_toks_105, sc_states_106, BgL_sc_nbzd2nts_108zd2)), trees)));
-                                                }
-                                            else
-                                                (l = (l.cdr));
-                                        }
-                                    }
-                                    return trees;
-                                }
-                            else
-                                return false;
-                        }
-                    };
-                    nb_deriv_trees = function(sc_conf_110, i, j, sc_enders_111, sc_steps_112, sc_toks_113, sc_states_114, BgL_sc_nbzd2nts_115zd2) {
-                        var sc_loop1_116;
-                        var tmp1124;
-                        var prev;
-                        return ((prev = (sc_conf_110-(1))), ((((tmp1124 = (sc_conf_110<BgL_sc_nbzd2nts_115zd2)), ((tmp1124!== false)?tmp1124:((sc_steps_112[prev])<(0))))!== false)?(1):((sc_loop1_116 = function(l, sc_n_118) {
-                            var nb_ender_trees;
-                            var nb_prev_trees;
-                            var conf_set;
-                            var state;
-                            var k;
-                            var n;
-                            var ender_set;
-                            var sc_state_117;
-                            var ender;
-                            var l;
-                            var sc_n_118;
-                            while (true) {
-                                if ((l instanceof sc_Pair))
-                                    {
-                                        (ender = (l.car));
-                                        (ender_set = ((sc_state_117 = (sc_states_114[j])), (sc_state_117[(ender+(1))])));
-                                        if ((ender_set!== false))
-                                            {
-                                                (k = (ender_set[(2)]));
-                                                (n = sc_n_118);
-                                                while ((k>=(0))) {
-                                                    if (((k>=i)&&(((state = (sc_states_114[k])), (conf_set = (state[(prev+(1))])), ((conf_set!== false)?(conf_set[(i+(5))]):false))!== false)))
-                                                        {
-                                                            (nb_prev_trees = (nb_deriv_trees(prev, i, k, sc_enders_111, sc_steps_112, sc_toks_113, sc_states_114, BgL_sc_nbzd2nts_115zd2)));
-                                                            (nb_ender_trees = (nb_deriv_trees(ender, k, j, sc_enders_111, sc_steps_112, sc_toks_113, sc_states_114, BgL_sc_nbzd2nts_115zd2)));
-                                                            (k = (ender_set[(k+(5))]));
-                                                            (n +=(nb_prev_trees*nb_ender_trees));
-                                                        }
-                                                    else
-                                                        (k = (ender_set[(k+(5))]));
-                                                }
-                                                return (sc_loop1_116((l.cdr), n));
-                                            }
-                                        else
-                                            (l = (l.cdr));
-                                    }
-                                else
-                                    return sc_n_118;
-                            }
-                        }), (sc_loop1_116((sc_enders_111[(sc_steps_112[prev])]), (0))))));
-                    };
-                    BgL_sc_nbzd2derivzd2treesza2_48za2 = function(nt, i, j, sc_nts_119, sc_enders_120, sc_steps_121, sc_toks_122, sc_states_123) {
-                        var conf_set;
-                        var state;
-                        var sc_conf_124;
-                        var l;
-                        var nb_trees;
-                        var BgL_sc_nbzd2nts_125zd2;
-                        var BgL_sc_ntza2_126za2;
-                        {
-                            (BgL_sc_ntza2_126za2 = (sc_ind_43(nt, sc_nts_119)));
-                            if ((BgL_sc_ntza2_126za2!== false))
-                                {
-                                    (BgL_sc_nbzd2nts_125zd2 = (sc_nts_119.length));
-                                    (l = (sc_enders_120[BgL_sc_ntza2_126za2]));
-                                    (nb_trees = (0));
-                                    while ((l instanceof sc_Pair)) {
-                                        {
-                                            (sc_conf_124 = (l.car));
-                                            if ((((state = (sc_states_123[j])), (conf_set = (state[(sc_conf_124+(1))])), ((conf_set!== false)?(conf_set[(i+(5))]):false))!== false))
-                                                {
-                                                    (l = (l.cdr));
-                                                    (nb_trees = ((nb_deriv_trees(sc_conf_124, i, j, sc_enders_120, sc_steps_121, sc_toks_122, sc_states_123, BgL_sc_nbzd2nts_125zd2))+nb_trees));
-                                                }
-                                            else
-                                                (l = (l.cdr));
-                                        }
-                                    }
-                                    return nb_trees;
-                                }
-                            else
-                                return false;
-                        }
-                    };
-                    (lexer = (parser_descr[(0)]));
-                    (sc_nts_42 = (parser_descr[(1)]));
-                    (sc_starters_41 = (parser_descr[(2)]));
-                    (sc_enders_40 = (parser_descr[(3)]));
-                    (sc_predictors_39 = (parser_descr[(4)]));
-                    (sc_steps_38 = (parser_descr[(5)]));
-                    (sc_names_37 = (parser_descr[(6)]));
-                    (falseHead1128 = (new sc_Pair(null, null)));
-                    (L1125 = (lexer(input)));
-                    (tail1129 = falseHead1128);
-                    while (!(L1125 === null)) {
-                        {
-                            (tok = (L1125.car));
-                            (l1 = (tok.cdr));
-                            (l2 = null);
-                            while ((l1 instanceof sc_Pair)) {
-                                {
-                                    (sc_i_29 = (sc_ind_43((l1.car), sc_nts_42)));
-                                    if ((sc_i_29!== false))
-                                        {
-                                            (l1 = (l1.cdr));
-                                            (l2 = (new sc_Pair(sc_i_29, l2)));
-                                        }
-                                    else
-                                        (l1 = (l1.cdr));
-                                }
-                            }
-                            (sc_optrOpnd_22 = (new sc_Pair((tok.car), (sc_reverse(l2)))));
-                            (sc_optrOpnd_21 = (new sc_Pair(sc_optrOpnd_22, null)));
-                            (tail1129.cdr = sc_optrOpnd_21);
-                            (tail1129 = (tail1129.cdr));
-                            (L1125 = (L1125.cdr));
-                        }
-                    }
-                    (sc_optrOpnd_20 = (falseHead1128.cdr));
-                    (sc_toks_36 = (sc_list2vector(sc_optrOpnd_20)));
-                    (BgL_sc_nbzd2toks_35zd2 = (sc_toks_36.length));
-                    (BgL_sc_nbzd2confs_34zd2 = (sc_steps_38.length));
-                    (sc_states_33 = (make_states(BgL_sc_nbzd2toks_35zd2, BgL_sc_nbzd2confs_34zd2)));
-                    (goal_starters = (sc_starters_41[(0)]));
-                    (BgL_sc_confzd2setzd2adjoinza2_45za2(sc_states_33, (0), goal_starters, (0)));
-                    (forw(sc_states_33, (0), sc_starters_41, sc_enders_40, sc_predictors_39, sc_steps_38, sc_nts_42));
-                    (sc_i_28 = (0));
-                    while ((sc_i_28<BgL_sc_nbzd2toks_35zd2)) {
-                        {
-                            (tok_nts = ((sc_toks_36[sc_i_28]).cdr));
-                            (BgL_sc_confzd2setzd2adjoinza2_45za2(sc_states_33, (sc_i_28+(1)), tok_nts, sc_i_28));
-                            (forw(sc_states_33, (sc_i_28+(1)), sc_starters_41, sc_enders_40, sc_predictors_39, sc_steps_38, sc_nts_42));
-                            (++sc_i_28);
-                        }
-                    }
-                    (nb_toks = (sc_toks_36.length));
-                    (BgL_sc_nbzd2confs_32zd2 = (sc_steps_38.length));
-                    (BgL_sc_nbzd2nts_31zd2 = (sc_nts_42.length));
-                    (BgL_sc_statesza2_30za2 = (make_states(nb_toks, BgL_sc_nbzd2confs_32zd2)));
-                    (goal_enders = (sc_enders_40[(0)]));
-                    (l = goal_enders);
-                    while ((l instanceof sc_Pair)) {
-                        {
-                            (conf = (l.car));
-                            (BgL_sc_confzd2setzd2adjoinza2za2_46z00(sc_states_33, BgL_sc_statesza2_30za2, nb_toks, conf, (0)));
-                            (l = (l.cdr));
-                        }
-                    }
-                    (i = nb_toks);
-                    while ((i>=(0))) {
-                        {
-                            (states = sc_states_33);
-                            (BgL_sc_statesza2_27za2 = BgL_sc_statesza2_30za2);
-                            (state_num = i);
-                            (sc_enders_26 = sc_enders_40);
-                            (sc_steps_25 = sc_steps_38);
-                            (BgL_sc_nbzd2nts_24zd2 = BgL_sc_nbzd2nts_31zd2);
-                            (toks = sc_toks_36);
-                            (BgL_sc_stateza2_23za2 = (BgL_sc_statesza2_30za2[i]));
-                            loop1 = function() {
-                                var sc_loop1_127;
-                                var prev;
-                                var BgL_sc_statesza2_128za2;
-                                var sc_states_129;
-                                var j;
-                                var i;
-                                var sc_i_130;
-                                var head;
-                                var conf_set;
-                                var sc_conf_131;
-                                {
-                                    (sc_conf_131 = (BgL_sc_stateza2_23za2[(0)]));
-                                    if ((sc_conf_131>=(0)))
-                                        {
-                                            (conf_set = (BgL_sc_stateza2_23za2[(sc_conf_131+(1))]));
-                                            (head = (conf_set[(4)]));
-                                            (BgL_sc_stateza2_23za2[(0)] = (conf_set[(0)]));
-                                            (conf_set_merge_new_bang(conf_set));
-                                            (sc_i_130 = head);
-                                            while ((sc_i_130>=(0))) {
-                                                {
-                                                    (i = sc_i_130);
-                                                    (j = state_num);
-                                                    (sc_states_129 = states);
-                                                    (BgL_sc_statesza2_128za2 = BgL_sc_statesza2_27za2);
-                                                    (prev = (sc_conf_131-(1)));
-                                                    if (((sc_conf_131>=BgL_sc_nbzd2nts_24zd2)&&((sc_steps_25[prev])>=(0))))
-                                                        {
-                                                            sc_loop1_127 = function(l) {
-                                                                var k;
-                                                                var ender_set;
-                                                                var state;
-                                                                var ender;
-                                                                var l;
-                                                                while (true) {
-                                                                    if ((l instanceof sc_Pair))
-                                                                        {
-                                                                            (ender = (l.car));
-                                                                            (ender_set = ((state = (sc_states_129[j])), (state[(ender+(1))])));
-                                                                            if ((ender_set!== false))
-                                                                                {
-                                                                                    (k = (ender_set[(2)]));
-                                                                                    while ((k>=(0))) {
-                                                                                        {
-                                                                                            if ((k>=i))
-                                                                                                if (((BgL_sc_confzd2setzd2adjoinza2za2_46z00(sc_states_129, BgL_sc_statesza2_128za2, k, prev, i))!== false))
-                                                                                                    (BgL_sc_confzd2setzd2adjoinza2za2_46z00(sc_states_129, BgL_sc_statesza2_128za2, j, ender, k));
-                                                                                            (k = (ender_set[(k+(5))]));
-                                                                                        }
-                                                                                    }
-                                                                                    return (sc_loop1_127((l.cdr)));
-                                                                                }
-                                                                            else
-                                                                                (l = (l.cdr));
-                                                                        }
-                                                                    else
-                                                                        return undefined;
-                                                                }
-                                                            };
-                                                            (sc_loop1_127((sc_enders_26[(sc_steps_25[prev])])));
-                                                        }
-                                                    (sc_i_130 = (conf_set[(sc_i_130+(5))]));
-                                                }
-                                            }
-                                            return (loop1());
-                                        }
-                                    else
-                                        return undefined;
-                                }
-                            };
-                            (loop1());
-                            (--i);
-                        }
-                    }
-                    (optrOpnd = BgL_sc_statesza2_30za2);
-                    return [sc_nts_42, sc_starters_41, sc_enders_40, sc_predictors_39, sc_steps_38, sc_names_37, sc_toks_36, optrOpnd, is_parsed, BgL_sc_derivzd2treesza2_47z70, BgL_sc_nbzd2derivzd2treesza2_48za2];
-                }
-            };
-        }
-    };
-    BgL_parsezd2ze3parsedzf3zc2 = function(parse, nt, i, j) {
-        var is_parsed;
-        var states;
-        var enders;
-        var nts;
-        return ((nts = (parse[(0)])), (enders = (parse[(2)])), (states = (parse[(7)])), (is_parsed = (parse[(8)])), (is_parsed(nt, i, j, nts, enders, states)));
-    };
-    BgL_parsezd2ze3treesz31 = function(parse, nt, i, j) {
-        var BgL_sc_derivzd2treesza2_132z70;
-        var states;
-        var toks;
-        var names;
-        var steps;
-        var enders;
-        var nts;
-        return ((nts = (parse[(0)])), (enders = (parse[(2)])), (steps = (parse[(4)])), (names = (parse[(5)])), (toks = (parse[(6)])), (states = (parse[(7)])), (BgL_sc_derivzd2treesza2_132z70 = (parse[(9)])), (BgL_sc_derivzd2treesza2_132z70(nt, i, j, nts, enders, steps, names, toks, states)));
-    };
-    BgL_parsezd2ze3nbzd2treesze3 = function(parse, nt, i, j) {
-        var BgL_sc_nbzd2derivzd2treesza2_133za2;
-        var states;
-        var toks;
-        var steps;
-        var enders;
-        var nts;
-        return ((nts = (parse[(0)])), (enders = (parse[(2)])), (steps = (parse[(4)])), (toks = (parse[(6)])), (states = (parse[(7)])), (BgL_sc_nbzd2derivzd2treesza2_133za2 = (parse[(10)])), (BgL_sc_nbzd2derivzd2treesza2_133za2(nt, i, j, nts, enders, steps, toks, states)));
-    };
-    test = function(k) {
-        var x;
-        var p;
-        return ((p = (BgL_makezd2parserzd2(const_earley, function(l) {
-            var sc_x_134;
-            var tail1134;
-            var L1130;
-            var falseHead1133;
-            {
-                (falseHead1133 = (new sc_Pair(null, null)));
-                (tail1134 = falseHead1133);
-                (L1130 = l);
-                while (!(L1130 === null)) {
-                    {
-                        (tail1134.cdr = (new sc_Pair(((sc_x_134 = (L1130.car)), (sc_list(sc_x_134, sc_x_134))), null)));
-                        (tail1134 = (tail1134.cdr));
-                        (L1130 = (L1130.cdr));
-                    }
-                }
-                return (falseHead1133.cdr);
-            }
-        }))), (x = (p((sc_vector2list((sc_makeVector(k, "\u1E9Ca"))))))), (sc_length((BgL_parsezd2ze3treesz31(x, "\u1E9Cs", (0), k)))));
-    };
-    BgL_earleyzd2benchmarkzd2 = function() {
-        var args = null;
-        for (var sc_tmp = arguments.length - 1; sc_tmp >= 0; sc_tmp--) {
-            args = sc_cons(arguments[sc_tmp], args);
-        }
-        var k;
-        return ((k = ((args === null)?(7):(args.car))), (BgL_runzd2benchmarkzd2("earley", (1), function() {
-            return (test(k));
-        }, function(result) {
-            return ((sc_display(result)), (sc_newline()), result == 132);
-        })));
-    };
-}
-
-
-/************* END OF GENERATED CODE *************/
-// Invoke this function to run a benchmark.
-// The first argument is a string identifying the benchmark.
-// The second argument is the number of times to run the benchmark.
-// The third argument is a function that runs the benchmark.
-// The fourth argument is a unary function that warns if the result
-// returned by the benchmark is incorrect.
-//
-// Example:
-// RunBenchmark("new Array()",
-//              1,
-//              function () { new Array(1000000); }
-//              function (v) {
-//                return (v instanceof Array) && (v.length == 1000000);
-//              });
-
-SC_DEFAULT_OUT = new sc_GenericOutputPort(function(s) {});
-SC_ERROR_OUT = SC_DEFAULT_OUT;
-
-function RunBenchmark(name, count, run, warn) {
-  for (var n = 0; n < count; ++n) {
-    result = run();
-    if (!warn(result)) {
-      throw new Error("Earley or Boyer did incorrect number of rewrites");
-    }
-  }
-}
-
-var BgL_runzd2benchmarkzd2 = RunBenchmark;
diff --git a/deps/v8/benchmarks/navier-stokes.js b/deps/v8/benchmarks/navier-stokes.js
deleted file mode 100644
index b0dc3c864570f3..00000000000000
--- a/deps/v8/benchmarks/navier-stokes.js
+++ /dev/null
@@ -1,387 +0,0 @@
-/**
- * Copyright 2012 the V8 project authors. All rights reserved.
- * Copyright 2009 Oliver Hunt <http://nerget.com>
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-var NavierStokes = new BenchmarkSuite('NavierStokes', 1484000,
-                                      [new Benchmark('NavierStokes',
-                                                     runNavierStokes,
-                                                     setupNavierStokes,
-                                                     tearDownNavierStokes)]);
-
-var solver = null;
-
-function runNavierStokes()
-{
-    solver.update();
-}
-
-function setupNavierStokes()
-{
-    solver = new FluidField(null);
-    solver.setResolution(128, 128);
-    solver.setIterations(20);
-    solver.setDisplayFunction(function(){});
-    solver.setUICallback(prepareFrame);
-    solver.reset();
-}
-
-function tearDownNavierStokes()
-{
-    solver = null;
-}
-
-function addPoints(field) {
-    var n = 64;
-    for (var i = 1; i <= n; i++) {
-        field.setVelocity(i, i, n, n);
-        field.setDensity(i, i, 5);
-        field.setVelocity(i, n - i, -n, -n);
-        field.setDensity(i, n - i, 20);
-        field.setVelocity(128 - i, n + i, -n, -n);
-        field.setDensity(128 - i, n + i, 30);
-    }
-}
-
-var framesTillAddingPoints = 0;
-var framesBetweenAddingPoints = 5;
-
-function prepareFrame(field)
-{
-    if (framesTillAddingPoints == 0) {
-        addPoints(field);
-        framesTillAddingPoints = framesBetweenAddingPoints;
-        framesBetweenAddingPoints++;
-    } else {
-        framesTillAddingPoints--;
-    }
-}
-
-// Code from Oliver Hunt (http://nerget.com/fluidSim/pressure.js) starts here.
-function FluidField(canvas) {
-    function addFields(x, s, dt)
-    {
-        for (var i=0; i<size ; i++ ) x[i] += dt*s[i];
-    }
-
-    function set_bnd(b, x)
-    {
-        if (b===1) {
-            for (var i = 1; i <= width; i++) {
-                x[i] =  x[i + rowSize];
-                x[i + (height+1) *rowSize] = x[i + height * rowSize];
-            }
-
-            for (var j = 1; i <= height; i++) {
-                x[j * rowSize] = -x[1 + j * rowSize];
-                x[(width + 1) + j * rowSize] = -x[width + j * rowSize];
-            }
-        } else if (b === 2) {
-            for (var i = 1; i <= width; i++) {
-                x[i] = -x[i + rowSize];
-                x[i + (height + 1) * rowSize] = -x[i + height * rowSize];
-            }
-
-            for (var j = 1; j <= height; j++) {
-                x[j * rowSize] =  x[1 + j * rowSize];
-                x[(width + 1) + j * rowSize] =  x[width + j * rowSize];
-            }
-        } else {
-            for (var i = 1; i <= width; i++) {
-                x[i] =  x[i + rowSize];
-                x[i + (height + 1) * rowSize] = x[i + height * rowSize];
-            }
-
-            for (var j = 1; j <= height; j++) {
-                x[j * rowSize] =  x[1 + j * rowSize];
-                x[(width + 1) + j * rowSize] =  x[width + j * rowSize];
-            }
-        }
-        var maxEdge = (height + 1) * rowSize;
-        x[0]                 = 0.5 * (x[1] + x[rowSize]);
-        x[maxEdge]           = 0.5 * (x[1 + maxEdge] + x[height * rowSize]);
-        x[(width+1)]         = 0.5 * (x[width] + x[(width + 1) + rowSize]);
-        x[(width+1)+maxEdge] = 0.5 * (x[width + maxEdge] + x[(width + 1) + height * rowSize]);
-    }
-
-    function lin_solve(b, x, x0, a, c)
-    {
-        if (a === 0 && c === 1) {
-            for (var j=1 ; j<=height; j++) {
-                var currentRow = j * rowSize;
-                ++currentRow;
-                for (var i = 0; i < width; i++) {
-                    x[currentRow] = x0[currentRow];
-                    ++currentRow;
-                }
-            }
-            set_bnd(b, x);
-        } else {
-            var invC = 1 / c;
-            for (var k=0 ; k<iterations; k++) {
-                for (var j=1 ; j<=height; j++) {
-                    var lastRow = (j - 1) * rowSize;
-                    var currentRow = j * rowSize;
-                    var nextRow = (j + 1) * rowSize;
-                    var lastX = x[currentRow];
-                    ++currentRow;
-                    for (var i=1; i<=width; i++)
-                        lastX = x[currentRow] = (x0[currentRow] + a*(lastX+x[++currentRow]+x[++lastRow]+x[++nextRow])) * invC;
-                }
-                set_bnd(b, x);
-            }
-        }
-    }
-
-    function diffuse(b, x, x0, dt)
-    {
-        var a = 0;
-        lin_solve(b, x, x0, a, 1 + 4*a);
-    }
-
-    function lin_solve2(x, x0, y, y0, a, c)
-    {
-        if (a === 0 && c === 1) {
-            for (var j=1 ; j <= height; j++) {
-                var currentRow = j * rowSize;
-                ++currentRow;
-                for (var i = 0; i < width; i++) {
-                    x[currentRow] = x0[currentRow];
-                    y[currentRow] = y0[currentRow];
-                    ++currentRow;
-                }
-            }
-            set_bnd(1, x);
-            set_bnd(2, y);
-        } else {
-            var invC = 1/c;
-            for (var k=0 ; k<iterations; k++) {
-                for (var j=1 ; j <= height; j++) {
-                    var lastRow = (j - 1) * rowSize;
-                    var currentRow = j * rowSize;
-                    var nextRow = (j + 1) * rowSize;
-                    var lastX = x[currentRow];
-                    var lastY = y[currentRow];
-                    ++currentRow;
-                    for (var i = 1; i <= width; i++) {
-                        lastX = x[currentRow] = (x0[currentRow] + a * (lastX + x[currentRow] + x[lastRow] + x[nextRow])) * invC;
-                        lastY = y[currentRow] = (y0[currentRow] + a * (lastY + y[++currentRow] + y[++lastRow] + y[++nextRow])) * invC;
-                    }
-                }
-                set_bnd(1, x);
-                set_bnd(2, y);
-            }
-        }
-    }
-
-    function diffuse2(x, x0, y, y0, dt)
-    {
-        var a = 0;
-        lin_solve2(x, x0, y, y0, a, 1 + 4 * a);
-    }
-
-    function advect(b, d, d0, u, v, dt)
-    {
-        var Wdt0 = dt * width;
-        var Hdt0 = dt * height;
-        var Wp5 = width + 0.5;
-        var Hp5 = height + 0.5;
-        for (var j = 1; j<= height; j++) {
-            var pos = j * rowSize;
-            for (var i = 1; i <= width; i++) {
-                var x = i - Wdt0 * u[++pos];
-                var y = j - Hdt0 * v[pos];
-                if (x < 0.5)
-                    x = 0.5;
-                else if (x > Wp5)
-                    x = Wp5;
-                var i0 = x | 0;
-                var i1 = i0 + 1;
-                if (y < 0.5)
-                    y = 0.5;
-                else if (y > Hp5)
-                    y = Hp5;
-                var j0 = y | 0;
-                var j1 = j0 + 1;
-                var s1 = x - i0;
-                var s0 = 1 - s1;
-                var t1 = y - j0;
-                var t0 = 1 - t1;
-                var row1 = j0 * rowSize;
-                var row2 = j1 * rowSize;
-                d[pos] = s0 * (t0 * d0[i0 + row1] + t1 * d0[i0 + row2]) + s1 * (t0 * d0[i1 + row1] + t1 * d0[i1 + row2]);
-            }
-        }
-        set_bnd(b, d);
-    }
-
-    function project(u, v, p, div)
-    {
-        var h = -0.5 / Math.sqrt(width * height);
-        for (var j = 1 ; j <= height; j++ ) {
-            var row = j * rowSize;
-            var previousRow = (j - 1) * rowSize;
-            var prevValue = row - 1;
-            var currentRow = row;
-            var nextValue = row + 1;
-            var nextRow = (j + 1) * rowSize;
-            for (var i = 1; i <= width; i++ ) {
-                div[++currentRow] = h * (u[++nextValue] - u[++prevValue] + v[++nextRow] - v[++previousRow]);
-                p[currentRow] = 0;
-            }
-        }
-        set_bnd(0, div);
-        set_bnd(0, p);
-
-        lin_solve(0, p, div, 1, 4 );
-        var wScale = 0.5 * width;
-        var hScale = 0.5 * height;
-        for (var j = 1; j<= height; j++ ) {
-            var prevPos = j * rowSize - 1;
-            var currentPos = j * rowSize;
-            var nextPos = j * rowSize + 1;
-            var prevRow = (j - 1) * rowSize;
-            var currentRow = j * rowSize;
-            var nextRow = (j + 1) * rowSize;
-
-            for (var i = 1; i<= width; i++) {
-                u[++currentPos] -= wScale * (p[++nextPos] - p[++prevPos]);
-                v[currentPos]   -= hScale * (p[++nextRow] - p[++prevRow]);
-            }
-        }
-        set_bnd(1, u);
-        set_bnd(2, v);
-    }
-
-    function dens_step(x, x0, u, v, dt)
-    {
-        addFields(x, x0, dt);
-        diffuse(0, x0, x, dt );
-        advect(0, x, x0, u, v, dt );
-    }
-
-    function vel_step(u, v, u0, v0, dt)
-    {
-        addFields(u, u0, dt );
-        addFields(v, v0, dt );
-        var temp = u0; u0 = u; u = temp;
-        var temp = v0; v0 = v; v = temp;
-        diffuse2(u,u0,v,v0, dt);
-        project(u, v, u0, v0);
-        var temp = u0; u0 = u; u = temp;
-        var temp = v0; v0 = v; v = temp;
-        advect(1, u, u0, u0, v0, dt);
-        advect(2, v, v0, u0, v0, dt);
-        project(u, v, u0, v0 );
-    }
-    var uiCallback = function(d,u,v) {};
-
-    function Field(dens, u, v) {
-        // Just exposing the fields here rather than using accessors is a measurable win during display (maybe 5%)
-        // but makes the code ugly.
-        this.setDensity = function(x, y, d) {
-             dens[(x + 1) + (y + 1) * rowSize] = d;
-        }
-        this.getDensity = function(x, y) {
-             return dens[(x + 1) + (y + 1) * rowSize];
-        }
-        this.setVelocity = function(x, y, xv, yv) {
-             u[(x + 1) + (y + 1) * rowSize] = xv;
-             v[(x + 1) + (y + 1) * rowSize] = yv;
-        }
-        this.getXVelocity = function(x, y) {
-             return u[(x + 1) + (y + 1) * rowSize];
-        }
-        this.getYVelocity = function(x, y) {
-             return v[(x + 1) + (y + 1) * rowSize];
-        }
-        this.width = function() { return width; }
-        this.height = function() { return height; }
-    }
-    function queryUI(d, u, v)
-    {
-        for (var i = 0; i < size; i++)
-            u[i] = v[i] = d[i] = 0.0;
-        uiCallback(new Field(d, u, v));
-    }
-
-    this.update = function () {
-        queryUI(dens_prev, u_prev, v_prev);
-        vel_step(u, v, u_prev, v_prev, dt);
-        dens_step(dens, dens_prev, u, v, dt);
-        displayFunc(new Field(dens, u, v));
-    }
-    this.setDisplayFunction = function(func) {
-        displayFunc = func;
-    }
-
-    this.iterations = function() { return iterations; }
-    this.setIterations = function(iters) {
-        if (iters > 0 && iters <= 100)
-           iterations = iters;
-    }
-    this.setUICallback = function(callback) {
-        uiCallback = callback;
-    }
-    var iterations = 10;
-    var visc = 0.5;
-    var dt = 0.1;
-    var dens;
-    var dens_prev;
-    var u;
-    var u_prev;
-    var v;
-    var v_prev;
-    var width;
-    var height;
-    var rowSize;
-    var size;
-    var displayFunc;
-    function reset()
-    {
-        rowSize = width + 2;
-        size = (width+2)*(height+2);
-        dens = new Array(size);
-        dens_prev = new Array(size);
-        u = new Array(size);
-        u_prev = new Array(size);
-        v = new Array(size);
-        v_prev = new Array(size);
-        for (var i = 0; i < size; i++)
-            dens_prev[i] = u_prev[i] = v_prev[i] = dens[i] = u[i] = v[i] = 0;
-    }
-    this.reset = reset;
-    this.setResolution = function (hRes, wRes)
-    {
-        var res = wRes * hRes;
-        if (res > 0 && res < 1000000 && (wRes != width || hRes != height)) {
-            width = wRes;
-            height = hRes;
-            reset();
-            return true;
-        }
-        return false;
-    }
-    this.setResolution(64, 64);
-}
diff --git a/deps/v8/benchmarks/raytrace.js b/deps/v8/benchmarks/raytrace.js
deleted file mode 100644
index 971ef7218ee6a4..00000000000000
--- a/deps/v8/benchmarks/raytrace.js
+++ /dev/null
@@ -1,904 +0,0 @@
-// The ray tracer code in this file is written by Adam Burmister. It
-// is available in its original form from:
-//
-//   http://labs.flog.nz.co/raytracer/
-//
-// It has been modified slightly by Google to work as a standalone
-// benchmark, but the all the computational code remains
-// untouched. This file also contains a copy of parts of the Prototype
-// JavaScript framework which is used by the ray tracer.
-
-var RayTrace = new BenchmarkSuite('RayTrace', 739989, [
-  new Benchmark('RayTrace', renderScene)
-]);
-
-
-// Variable used to hold a number that can be used to verify that
-// the scene was ray traced correctly.
-var checkNumber;
-
-
-// ------------------------------------------------------------------------
-// ------------------------------------------------------------------------
-
-// The following is a copy of parts of the Prototype JavaScript library:
-
-// Prototype JavaScript framework, version 1.5.0
-// (c) 2005-2007 Sam Stephenson
-//
-// Prototype is freely distributable under the terms of an MIT-style license.
-// For details, see the Prototype web site: http://prototype.conio.net/
-
-
-var Class = {
-  create: function() {
-    return function() {
-      this.initialize.apply(this, arguments);
-    }
-  }
-};
-
-
-Object.extend = function(destination, source) {
-  for (var property in source) {
-    destination[property] = source[property];
-  }
-  return destination;
-};
-
-
-// ------------------------------------------------------------------------
-// ------------------------------------------------------------------------
-
-// The rest of this file is the actual ray tracer written by Adam
-// Burmister. It's a concatenation of the following files:
-//
-//   flog/color.js
-//   flog/light.js
-//   flog/vector.js
-//   flog/ray.js
-//   flog/scene.js
-//   flog/material/basematerial.js
-//   flog/material/solid.js
-//   flog/material/chessboard.js
-//   flog/shape/baseshape.js
-//   flog/shape/sphere.js
-//   flog/shape/plane.js
-//   flog/intersectioninfo.js
-//   flog/camera.js
-//   flog/background.js
-//   flog/engine.js
-
-
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-
-Flog.RayTracer.Color = Class.create();
-
-Flog.RayTracer.Color.prototype = {
-    red : 0.0,
-    green : 0.0,
-    blue : 0.0,
-
-    initialize : function(r, g, b) {
-        if(!r) r = 0.0;
-        if(!g) g = 0.0;
-        if(!b) b = 0.0;
-
-        this.red = r;
-        this.green = g;
-        this.blue = b;
-    },
-
-    add : function(c1, c2){
-        var result = new Flog.RayTracer.Color(0,0,0);
-
-        result.red = c1.red + c2.red;
-        result.green = c1.green + c2.green;
-        result.blue = c1.blue + c2.blue;
-
-        return result;
-    },
-
-    addScalar: function(c1, s){
-        var result = new Flog.RayTracer.Color(0,0,0);
-
-        result.red = c1.red + s;
-        result.green = c1.green + s;
-        result.blue = c1.blue + s;
-
-        result.limit();
-
-        return result;
-    },
-
-    subtract: function(c1, c2){
-        var result = new Flog.RayTracer.Color(0,0,0);
-
-        result.red = c1.red - c2.red;
-        result.green = c1.green - c2.green;
-        result.blue = c1.blue - c2.blue;
-
-        return result;
-    },
-
-    multiply : function(c1, c2) {
-        var result = new Flog.RayTracer.Color(0,0,0);
-
-        result.red = c1.red * c2.red;
-        result.green = c1.green * c2.green;
-        result.blue = c1.blue * c2.blue;
-
-        return result;
-    },
-
-    multiplyScalar : function(c1, f) {
-        var result = new Flog.RayTracer.Color(0,0,0);
-
-        result.red = c1.red * f;
-        result.green = c1.green * f;
-        result.blue = c1.blue * f;
-
-        return result;
-    },
-
-    divideFactor : function(c1, f) {
-        var result = new Flog.RayTracer.Color(0,0,0);
-
-        result.red = c1.red / f;
-        result.green = c1.green / f;
-        result.blue = c1.blue / f;
-
-        return result;
-    },
-
-    limit: function(){
-        this.red = (this.red > 0.0) ? ( (this.red > 1.0) ? 1.0 : this.red ) : 0.0;
-        this.green = (this.green > 0.0) ? ( (this.green > 1.0) ? 1.0 : this.green ) : 0.0;
-        this.blue = (this.blue > 0.0) ? ( (this.blue > 1.0) ? 1.0 : this.blue ) : 0.0;
-    },
-
-    distance : function(color) {
-        var d = Math.abs(this.red - color.red) + Math.abs(this.green - color.green) + Math.abs(this.blue - color.blue);
-        return d;
-    },
-
-    blend: function(c1, c2, w){
-        var result = new Flog.RayTracer.Color(0,0,0);
-        result = Flog.RayTracer.Color.prototype.add(
-                    Flog.RayTracer.Color.prototype.multiplyScalar(c1, 1 - w),
-                    Flog.RayTracer.Color.prototype.multiplyScalar(c2, w)
-                  );
-        return result;
-    },
-
-    brightness : function() {
-        var r = Math.floor(this.red*255);
-        var g = Math.floor(this.green*255);
-        var b = Math.floor(this.blue*255);
-        return (r * 77 + g * 150 + b * 29) >> 8;
-    },
-
-    toString : function () {
-        var r = Math.floor(this.red*255);
-        var g = Math.floor(this.green*255);
-        var b = Math.floor(this.blue*255);
-
-        return "rgb("+ r +","+ g +","+ b +")";
-    }
-}
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-
-Flog.RayTracer.Light = Class.create();
-
-Flog.RayTracer.Light.prototype = {
-    position: null,
-    color: null,
-    intensity: 10.0,
-
-    initialize : function(pos, color, intensity) {
-        this.position = pos;
-        this.color = color;
-        this.intensity = (intensity ? intensity : 10.0);
-    },
-
-    toString : function () {
-        return 'Light [' + this.position.x + ',' + this.position.y + ',' + this.position.z + ']';
-    }
-}
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-
-Flog.RayTracer.Vector = Class.create();
-
-Flog.RayTracer.Vector.prototype = {
-    x : 0.0,
-    y : 0.0,
-    z : 0.0,
-
-    initialize : function(x, y, z) {
-        this.x = (x ? x : 0);
-        this.y = (y ? y : 0);
-        this.z = (z ? z : 0);
-    },
-
-    copy: function(vector){
-        this.x = vector.x;
-        this.y = vector.y;
-        this.z = vector.z;
-    },
-
-    normalize : function() {
-        var m = this.magnitude();
-        return new Flog.RayTracer.Vector(this.x / m, this.y / m, this.z / m);
-    },
-
-    magnitude : function() {
-        return Math.sqrt((this.x * this.x) + (this.y * this.y) + (this.z * this.z));
-    },
-
-    cross : function(w) {
-        return new Flog.RayTracer.Vector(
-                                            -this.z * w.y + this.y * w.z,
-                                           this.z * w.x - this.x * w.z,
-                                          -this.y * w.x + this.x * w.y);
-    },
-
-    dot : function(w) {
-        return this.x * w.x + this.y * w.y + this.z * w.z;
-    },
-
-    add : function(v, w) {
-        return new Flog.RayTracer.Vector(w.x + v.x, w.y + v.y, w.z + v.z);
-    },
-
-    subtract : function(v, w) {
-        if(!w || !v) throw 'Vectors must be defined [' + v + ',' + w + ']';
-        return new Flog.RayTracer.Vector(v.x - w.x, v.y - w.y, v.z - w.z);
-    },
-
-    multiplyVector : function(v, w) {
-        return new Flog.RayTracer.Vector(v.x * w.x, v.y * w.y, v.z * w.z);
-    },
-
-    multiplyScalar : function(v, w) {
-        return new Flog.RayTracer.Vector(v.x * w, v.y * w, v.z * w);
-    },
-
-    toString : function () {
-        return 'Vector [' + this.x + ',' + this.y + ',' + this.z + ']';
-    }
-}
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-
-Flog.RayTracer.Ray = Class.create();
-
-Flog.RayTracer.Ray.prototype = {
-    position : null,
-    direction : null,
-    initialize : function(pos, dir) {
-        this.position = pos;
-        this.direction = dir;
-    },
-
-    toString : function () {
-        return 'Ray [' + this.position + ',' + this.direction + ']';
-    }
-}
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-
-Flog.RayTracer.Scene = Class.create();
-
-Flog.RayTracer.Scene.prototype = {
-    camera : null,
-    shapes : [],
-    lights : [],
-    background : null,
-
-    initialize : function() {
-        this.camera = new Flog.RayTracer.Camera(
-            new Flog.RayTracer.Vector(0,0,-5),
-            new Flog.RayTracer.Vector(0,0,1),
-            new Flog.RayTracer.Vector(0,1,0)
-        );
-        this.shapes = new Array();
-        this.lights = new Array();
-        this.background = new Flog.RayTracer.Background(new Flog.RayTracer.Color(0,0,0.5), 0.2);
-    }
-}
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-if(typeof(Flog.RayTracer.Material) == 'undefined') Flog.RayTracer.Material = {};
-
-Flog.RayTracer.Material.BaseMaterial = Class.create();
-
-Flog.RayTracer.Material.BaseMaterial.prototype = {
-
-    gloss: 2.0,             // [0...infinity] 0 = matt
-    transparency: 0.0,      // 0=opaque
-    reflection: 0.0,        // [0...infinity] 0 = no reflection
-    refraction: 0.50,
-    hasTexture: false,
-
-    initialize : function() {
-
-    },
-
-    getColor: function(u, v){
-
-    },
-
-    wrapUp: function(t){
-        t = t % 2.0;
-        if(t < -1) t += 2.0;
-        if(t >= 1) t -= 2.0;
-        return t;
-    },
-
-    toString : function () {
-        return 'Material [gloss=' + this.gloss + ', transparency=' + this.transparency + ', hasTexture=' + this.hasTexture +']';
-    }
-}
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-
-Flog.RayTracer.Material.Solid = Class.create();
-
-Flog.RayTracer.Material.Solid.prototype = Object.extend(
-    new Flog.RayTracer.Material.BaseMaterial(), {
-        initialize : function(color, reflection, refraction, transparency, gloss) {
-            this.color = color;
-            this.reflection = reflection;
-            this.transparency = transparency;
-            this.gloss = gloss;
-            this.hasTexture = false;
-        },
-
-        getColor: function(u, v){
-            return this.color;
-        },
-
-        toString : function () {
-            return 'SolidMaterial [gloss=' + this.gloss + ', transparency=' + this.transparency + ', hasTexture=' + this.hasTexture +']';
-        }
-    }
-);
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-
-Flog.RayTracer.Material.Chessboard = Class.create();
-
-Flog.RayTracer.Material.Chessboard.prototype = Object.extend(
-    new Flog.RayTracer.Material.BaseMaterial(), {
-        colorEven: null,
-        colorOdd: null,
-        density: 0.5,
-
-        initialize : function(colorEven, colorOdd, reflection, transparency, gloss, density) {
-            this.colorEven = colorEven;
-            this.colorOdd = colorOdd;
-            this.reflection = reflection;
-            this.transparency = transparency;
-            this.gloss = gloss;
-            this.density = density;
-            this.hasTexture = true;
-        },
-
-        getColor: function(u, v){
-            var t = this.wrapUp(u * this.density) * this.wrapUp(v * this.density);
-
-            if(t < 0.0)
-                return this.colorEven;
-            else
-                return this.colorOdd;
-        },
-
-        toString : function () {
-            return 'ChessMaterial [gloss=' + this.gloss + ', transparency=' + this.transparency + ', hasTexture=' + this.hasTexture +']';
-        }
-    }
-);
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-if(typeof(Flog.RayTracer.Shape) == 'undefined') Flog.RayTracer.Shape = {};
-
-Flog.RayTracer.Shape.Sphere = Class.create();
-
-Flog.RayTracer.Shape.Sphere.prototype = {
-    initialize : function(pos, radius, material) {
-        this.radius = radius;
-        this.position = pos;
-        this.material = material;
-    },
-
-    intersect: function(ray){
-        var info = new Flog.RayTracer.IntersectionInfo();
-        info.shape = this;
-
-        var dst = Flog.RayTracer.Vector.prototype.subtract(ray.position, this.position);
-
-        var B = dst.dot(ray.direction);
-        var C = dst.dot(dst) - (this.radius * this.radius);
-        var D = (B * B) - C;
-
-        if(D > 0){ // intersection!
-            info.isHit = true;
-            info.distance = (-B) - Math.sqrt(D);
-            info.position = Flog.RayTracer.Vector.prototype.add(
-                                                ray.position,
-                                                Flog.RayTracer.Vector.prototype.multiplyScalar(
-                                                    ray.direction,
-                                                    info.distance
-                                                )
-                                            );
-            info.normal = Flog.RayTracer.Vector.prototype.subtract(
-                                            info.position,
-                                            this.position
-                                        ).normalize();
-
-            info.color = this.material.getColor(0,0);
-        } else {
-            info.isHit = false;
-        }
-        return info;
-    },
-
-    toString : function () {
-        return 'Sphere [position=' + this.position + ', radius=' + this.radius + ']';
-    }
-}
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-if(typeof(Flog.RayTracer.Shape) == 'undefined') Flog.RayTracer.Shape = {};
-
-Flog.RayTracer.Shape.Plane = Class.create();
-
-Flog.RayTracer.Shape.Plane.prototype = {
-    d: 0.0,
-
-    initialize : function(pos, d, material) {
-        this.position = pos;
-        this.d = d;
-        this.material = material;
-    },
-
-    intersect: function(ray){
-        var info = new Flog.RayTracer.IntersectionInfo();
-
-        var Vd = this.position.dot(ray.direction);
-        if(Vd == 0) return info; // no intersection
-
-        var t = -(this.position.dot(ray.position) + this.d) / Vd;
-        if(t <= 0) return info;
-
-        info.shape = this;
-        info.isHit = true;
-        info.position = Flog.RayTracer.Vector.prototype.add(
-                                            ray.position,
-                                            Flog.RayTracer.Vector.prototype.multiplyScalar(
-                                                ray.direction,
-                                                t
-                                            )
-                                        );
-        info.normal = this.position;
-        info.distance = t;
-
-        if(this.material.hasTexture){
-            var vU = new Flog.RayTracer.Vector(this.position.y, this.position.z, -this.position.x);
-            var vV = vU.cross(this.position);
-            var u = info.position.dot(vU);
-            var v = info.position.dot(vV);
-            info.color = this.material.getColor(u,v);
-        } else {
-            info.color = this.material.getColor(0,0);
-        }
-
-        return info;
-    },
-
-    toString : function () {
-        return 'Plane [' + this.position + ', d=' + this.d + ']';
-    }
-}
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-
-Flog.RayTracer.IntersectionInfo = Class.create();
-
-Flog.RayTracer.IntersectionInfo.prototype = {
-    isHit: false,
-    hitCount: 0,
-    shape: null,
-    position: null,
-    normal: null,
-    color: null,
-    distance: null,
-
-    initialize : function() {
-        this.color = new Flog.RayTracer.Color(0,0,0);
-    },
-
-    toString : function () {
-        return 'Intersection [' + this.position + ']';
-    }
-}
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-
-Flog.RayTracer.Camera = Class.create();
-
-Flog.RayTracer.Camera.prototype = {
-    position: null,
-    lookAt: null,
-    equator: null,
-    up: null,
-    screen: null,
-
-    initialize : function(pos, lookAt, up) {
-        this.position = pos;
-        this.lookAt = lookAt;
-        this.up = up;
-        this.equator = lookAt.normalize().cross(this.up);
-        this.screen = Flog.RayTracer.Vector.prototype.add(this.position, this.lookAt);
-    },
-
-    getRay: function(vx, vy){
-        var pos = Flog.RayTracer.Vector.prototype.subtract(
-            this.screen,
-            Flog.RayTracer.Vector.prototype.subtract(
-                Flog.RayTracer.Vector.prototype.multiplyScalar(this.equator, vx),
-                Flog.RayTracer.Vector.prototype.multiplyScalar(this.up, vy)
-            )
-        );
-        pos.y = pos.y * -1;
-        var dir = Flog.RayTracer.Vector.prototype.subtract(
-            pos,
-            this.position
-        );
-
-        var ray = new Flog.RayTracer.Ray(pos, dir.normalize());
-
-        return ray;
-    },
-
-    toString : function () {
-        return 'Ray []';
-    }
-}
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-
-Flog.RayTracer.Background = Class.create();
-
-Flog.RayTracer.Background.prototype = {
-    color : null,
-    ambience : 0.0,
-
-    initialize : function(color, ambience) {
-        this.color = color;
-        this.ambience = ambience;
-    }
-}
-/* Fake a Flog.* namespace */
-if(typeof(Flog) == 'undefined') var Flog = {};
-if(typeof(Flog.RayTracer) == 'undefined') Flog.RayTracer = {};
-
-Flog.RayTracer.Engine = Class.create();
-
-Flog.RayTracer.Engine.prototype = {
-    canvas: null, /* 2d context we can render to */
-
-    initialize: function(options){
-        this.options = Object.extend({
-                canvasHeight: 100,
-                canvasWidth: 100,
-                pixelWidth: 2,
-                pixelHeight: 2,
-                renderDiffuse: false,
-                renderShadows: false,
-                renderHighlights: false,
-                renderReflections: false,
-                rayDepth: 2
-            }, options || {});
-
-        this.options.canvasHeight /= this.options.pixelHeight;
-        this.options.canvasWidth /= this.options.pixelWidth;
-
-        /* TODO: dynamically include other scripts */
-    },
-
-    setPixel: function(x, y, color){
-        var pxW, pxH;
-        pxW = this.options.pixelWidth;
-        pxH = this.options.pixelHeight;
-
-        if (this.canvas) {
-          this.canvas.fillStyle = color.toString();
-          this.canvas.fillRect (x * pxW, y * pxH, pxW, pxH);
-        } else {
-          if (x ===  y) {
-            checkNumber += color.brightness();
-          }
-          // print(x * pxW, y * pxH, pxW, pxH);
-        }
-    },
-
-    renderScene: function(scene, canvas){
-        checkNumber = 0;
-        /* Get canvas */
-        if (canvas) {
-          this.canvas = canvas.getContext("2d");
-        } else {
-          this.canvas = null;
-        }
-
-        var canvasHeight = this.options.canvasHeight;
-        var canvasWidth = this.options.canvasWidth;
-
-        for(var y=0; y < canvasHeight; y++){
-            for(var x=0; x < canvasWidth; x++){
-                var yp = y * 1.0 / canvasHeight * 2 - 1;
-          		var xp = x * 1.0 / canvasWidth * 2 - 1;
-
-          		var ray = scene.camera.getRay(xp, yp);
-
-          		var color = this.getPixelColor(ray, scene);
-
-            	this.setPixel(x, y, color);
-            }
-        }
-        if (checkNumber !== 2321) {
-          throw new Error("Scene rendered incorrectly");
-        }
-    },
-
-    getPixelColor: function(ray, scene){
-        var info = this.testIntersection(ray, scene, null);
-        if(info.isHit){
-            var color = this.rayTrace(info, ray, scene, 0);
-            return color;
-        }
-        return scene.background.color;
-    },
-
-    testIntersection: function(ray, scene, exclude){
-        var hits = 0;
-        var best = new Flog.RayTracer.IntersectionInfo();
-        best.distance = 2000;
-
-        for(var i=0; i<scene.shapes.length; i++){
-            var shape = scene.shapes[i];
-
-            if(shape != exclude){
-                var info = shape.intersect(ray);
-                if(info.isHit && info.distance >= 0 && info.distance < best.distance){
-                    best = info;
-                    hits++;
-                }
-            }
-        }
-        best.hitCount = hits;
-        return best;
-    },
-
-    getReflectionRay: function(P,N,V){
-        var c1 = -N.dot(V);
-        var R1 = Flog.RayTracer.Vector.prototype.add(
-            Flog.RayTracer.Vector.prototype.multiplyScalar(N, 2*c1),
-            V
-        );
-        return new Flog.RayTracer.Ray(P, R1);
-    },
-
-    rayTrace: function(info, ray, scene, depth){
-        // Calc ambient
-        var color = Flog.RayTracer.Color.prototype.multiplyScalar(info.color, scene.background.ambience);
-        var oldColor = color;
-        var shininess = Math.pow(10, info.shape.material.gloss + 1);
-
-        for(var i=0; i<scene.lights.length; i++){
-            var light = scene.lights[i];
-
-            // Calc diffuse lighting
-            var v = Flog.RayTracer.Vector.prototype.subtract(
-                                light.position,
-                                info.position
-                            ).normalize();
-
-            if(this.options.renderDiffuse){
-                var L = v.dot(info.normal);
-                if(L > 0.0){
-                    color = Flog.RayTracer.Color.prototype.add(
-                                        color,
-                                        Flog.RayTracer.Color.prototype.multiply(
-                                            info.color,
-                                            Flog.RayTracer.Color.prototype.multiplyScalar(
-                                                light.color,
-                                                L
-                                            )
-                                        )
-                                    );
-                }
-            }
-
-            // The greater the depth the more accurate the colours, but
-            // this is exponentially (!) expensive
-            if(depth <= this.options.rayDepth){
-          // calculate reflection ray
-          if(this.options.renderReflections && info.shape.material.reflection > 0)
-          {
-              var reflectionRay = this.getReflectionRay(info.position, info.normal, ray.direction);
-              var refl = this.testIntersection(reflectionRay, scene, info.shape);
-
-              if (refl.isHit && refl.distance > 0){
-                  refl.color = this.rayTrace(refl, reflectionRay, scene, depth + 1);
-              } else {
-                  refl.color = scene.background.color;
-                        }
-
-                  color = Flog.RayTracer.Color.prototype.blend(
-                    color,
-                    refl.color,
-                    info.shape.material.reflection
-                  );
-          }
-
-                // Refraction
-                /* TODO */
-            }
-
-            /* Render shadows and highlights */
-
-            var shadowInfo = new Flog.RayTracer.IntersectionInfo();
-
-            if(this.options.renderShadows){
-                var shadowRay = new Flog.RayTracer.Ray(info.position, v);
-
-                shadowInfo = this.testIntersection(shadowRay, scene, info.shape);
-                if(shadowInfo.isHit && shadowInfo.shape != info.shape /*&& shadowInfo.shape.type != 'PLANE'*/){
-                    var vA = Flog.RayTracer.Color.prototype.multiplyScalar(color, 0.5);
-                    var dB = (0.5 * Math.pow(shadowInfo.shape.material.transparency, 0.5));
-                    color = Flog.RayTracer.Color.prototype.addScalar(vA,dB);
-                }
-            }
-
-      // Phong specular highlights
-      if(this.options.renderHighlights && !shadowInfo.isHit && info.shape.material.gloss > 0){
-        var Lv = Flog.RayTracer.Vector.prototype.subtract(
-                            info.shape.position,
-                            light.position
-                        ).normalize();
-
-        var E = Flog.RayTracer.Vector.prototype.subtract(
-                            scene.camera.position,
-                            info.shape.position
-                        ).normalize();
-
-        var H = Flog.RayTracer.Vector.prototype.subtract(
-                            E,
-                            Lv
-                        ).normalize();
-
-        var glossWeight = Math.pow(Math.max(info.normal.dot(H), 0), shininess);
-        color = Flog.RayTracer.Color.prototype.add(
-                            Flog.RayTracer.Color.prototype.multiplyScalar(light.color, glossWeight),
-                            color
-                        );
-      }
-        }
-        color.limit();
-        return color;
-    }
-};
-
-
-function renderScene(){
-    var scene = new Flog.RayTracer.Scene();
-
-    scene.camera = new Flog.RayTracer.Camera(
-                        new Flog.RayTracer.Vector(0, 0, -15),
-                        new Flog.RayTracer.Vector(-0.2, 0, 5),
-                        new Flog.RayTracer.Vector(0, 1, 0)
-                    );
-
-    scene.background = new Flog.RayTracer.Background(
-                                new Flog.RayTracer.Color(0.5, 0.5, 0.5),
-                                0.4
-                            );
-
-    var sphere = new Flog.RayTracer.Shape.Sphere(
-        new Flog.RayTracer.Vector(-1.5, 1.5, 2),
-        1.5,
-        new Flog.RayTracer.Material.Solid(
-            new Flog.RayTracer.Color(0,0.5,0.5),
-            0.3,
-            0.0,
-            0.0,
-            2.0
-        )
-    );
-
-    var sphere1 = new Flog.RayTracer.Shape.Sphere(
-        new Flog.RayTracer.Vector(1, 0.25, 1),
-        0.5,
-        new Flog.RayTracer.Material.Solid(
-            new Flog.RayTracer.Color(0.9,0.9,0.9),
-            0.1,
-            0.0,
-            0.0,
-            1.5
-        )
-    );
-
-    var plane = new Flog.RayTracer.Shape.Plane(
-                                new Flog.RayTracer.Vector(0.1, 0.9, -0.5).normalize(),
-                                1.2,
-                                new Flog.RayTracer.Material.Chessboard(
-                                    new Flog.RayTracer.Color(1,1,1),
-                                    new Flog.RayTracer.Color(0,0,0),
-                                    0.2,
-                                    0.0,
-                                    1.0,
-                                    0.7
-                                )
-                            );
-
-    scene.shapes.push(plane);
-    scene.shapes.push(sphere);
-    scene.shapes.push(sphere1);
-
-    var light = new Flog.RayTracer.Light(
-        new Flog.RayTracer.Vector(5, 10, -1),
-        new Flog.RayTracer.Color(0.8, 0.8, 0.8)
-    );
-
-    var light1 = new Flog.RayTracer.Light(
-        new Flog.RayTracer.Vector(-3, 5, -15),
-        new Flog.RayTracer.Color(0.8, 0.8, 0.8),
-        100
-    );
-
-    scene.lights.push(light);
-    scene.lights.push(light1);
-
-    var imageWidth = 100; // $F('imageWidth');
-    var imageHeight = 100; // $F('imageHeight');
-    var pixelSize = "5,5".split(','); //  $F('pixelSize').split(',');
-    var renderDiffuse = true; // $F('renderDiffuse');
-    var renderShadows = true; // $F('renderShadows');
-    var renderHighlights = true; // $F('renderHighlights');
-    var renderReflections = true; // $F('renderReflections');
-    var rayDepth = 2;//$F('rayDepth');
-
-    var raytracer = new Flog.RayTracer.Engine(
-        {
-            canvasWidth: imageWidth,
-            canvasHeight: imageHeight,
-            pixelWidth: pixelSize[0],
-            pixelHeight: pixelSize[1],
-            "renderDiffuse": renderDiffuse,
-            "renderHighlights": renderHighlights,
-            "renderShadows": renderShadows,
-            "renderReflections": renderReflections,
-            "rayDepth": rayDepth
-        }
-    );
-
-    raytracer.renderScene(scene, null, 0);
-}
diff --git a/deps/v8/benchmarks/regexp.js b/deps/v8/benchmarks/regexp.js
deleted file mode 100644
index 9c831422663e74..00000000000000
--- a/deps/v8/benchmarks/regexp.js
+++ /dev/null
@@ -1,1764 +0,0 @@
-// Copyright 2010 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Automatically generated on 2009-01-30. Manually updated on 2010-09-17.
-
-// This benchmark is generated by loading 50 of the most popular pages
-// on the web and logging all regexp operations performed.  Each
-// operation is given a weight that is calculated from an estimate of
-// the popularity of the pages where it occurs and the number of times
-// it is executed while loading each page.  Furthermore the literal
-// letters in the data are encoded using ROT13 in a way that does not
-// affect how the regexps match their input.  Finally the strings are
-// scrambled to exercise the regexp engine on different input strings.
-
-
-var RegExp = new BenchmarkSuite('RegExp', 910985, [
-  new Benchmark("RegExp", RegExpRun, RegExpSetup, RegExpTearDown)
-]);
-
-var regExpBenchmark = null;
-
-function RegExpSetup() {
-  regExpBenchmark = new RegExpBenchmark();
-  RegExpRun(); // run once to get system initialized
-}
-
-function RegExpRun() {
-  regExpBenchmark.run();
-}
-
-function RegExpTearDown() {
-  regExpBenchmark = null;
-}
-
-// Returns an array of n different variants of the input string str.
-// The variants are computed by randomly rotating one random
-// character.
-function computeInputVariants(str, n) {
-  var variants = [ str ];
-  for (var i = 1; i < n; i++) {
-    var pos = Math.floor(Math.random() * str.length);
-    var chr = String.fromCharCode((str.charCodeAt(pos) + Math.floor(Math.random() * 128)) % 128);
-    variants[i] = str.substring(0, pos) + chr + str.substring(pos + 1, str.length);
-  }
-  return variants;
-}
-
-function RegExpBenchmark() {
-  var re0 = /^ba/;
-  var re1 = /(((\w+):\/\/)([^\/:]*)(:(\d+))?)?([^#?]*)(\?([^#]*))?(#(.*))?/;
-  var re2 = /^\s*|\s*$/g;
-  var re3 = /\bQBZPbageby_cynprubyqre\b/;
-  var re4 = /,/;
-  var re5 = /\bQBZPbageby_cynprubyqre\b/g;
-  var re6 = /^[\s\xa0]+|[\s\xa0]+$/g;
-  var re7 = /(\d*)(\D*)/g;
-  var re8 = /=/;
-  var re9 = /(^|\s)lhv\-h(\s|$)/;
-  var str0 = 'Zbmvyyn/5.0 (Jvaqbjf; H; Jvaqbjf AG 5.1; ra-HF) NccyrJroXvg/528.9 (XUGZY, yvxr Trpxb) Puebzr/2.0.157.0 Fnsnev/528.9';
-  var re10 = /\#/g;
-  var re11 = /\./g;
-  var re12 = /'/g;
-  var re13 = /\?[\w\W]*(sevraqvq|punaaryvq|tebhcvq)=([^\&\?#]*)/i;
-  var str1 = 'Fubpxjnir Synfu 9.0  e115';
-  var re14 = /\s+/g;
-  var re15 = /^\s*(\S*(\s+\S+)*)\s*$/;
-  var re16 = /(-[a-z])/i;
-
-  var s0 = computeInputVariants('pyvpx', 6511);
-  var s1 = computeInputVariants('uggc://jjj.snprobbx.pbz/ybtva.cuc', 1844);
-  var s2 = computeInputVariants('QBZPbageby_cynprubyqre', 739);
-  var s3 = computeInputVariants('uggc://jjj.snprobbx.pbz/', 598);
-  var s4 = computeInputVariants('uggc://jjj.snprobbx.pbz/fepu.cuc', 454);
-  var s5 = computeInputVariants('qqqq, ZZZ q, llll', 352);
-  var s6 = computeInputVariants('vachggrkg QBZPbageby_cynprubyqre', 312);
-  var s7 = computeInputVariants('/ZlFcnprUbzrcntr/Vaqrk-FvgrUbzr,10000000', 282);
-  var s8 = computeInputVariants('vachggrkg', 177);
-  var s9 = computeInputVariants('528.9', 170);
-  var s10 = computeInputVariants('528', 170);
-  var s11 = computeInputVariants('VCPhygher=ra-HF', 156);
-  var s12 = computeInputVariants('CersreerqPhygher=ra-HF', 156);
-  var s13 = computeInputVariants('xrlcerff', 144);
-  var s14 = computeInputVariants('521', 139);
-  var s15 = computeInputVariants(str0, 139);
-  var s16 = computeInputVariants('qvi .so_zrah', 137);
-  var s17 = computeInputVariants('qvi.so_zrah', 137);
-  var s18 = computeInputVariants('uvqqra_ryrz', 117);
-  var s19 = computeInputVariants('sevraqfgre_naba=nvq%3Qn6ss9p85n868ro9s059pn854735956o3%26ers%3Q%26df%3Q%26vpgl%3QHF', 95);
-  var s20 = computeInputVariants('uggc://ubzr.zlfcnpr.pbz/vaqrk.psz', 93);
-  var s21 = computeInputVariants(str1, 92);
-  var s22 = computeInputVariants('svefg', 85);
-  var s23 = computeInputVariants('uggc://cebsvyr.zlfcnpr.pbz/vaqrk.psz', 85);
-  var s24 = computeInputVariants('ynfg', 85);
-  var s25 = computeInputVariants('qvfcynl', 85);
-
-  function runBlock0() {
-    for (var i = 0; i < 6511; i++) {
-      re0.exec(s0[i]);
-    }
-    for (var i = 0; i < 1844; i++) {
-      re1.exec(s1[i]);
-    }
-    for (var i = 0; i < 739; i++) {
-      s2[i].replace(re2, '');
-    }
-    for (var i = 0; i < 598; i++) {
-      re1.exec(s3[i]);
-    }
-    for (var i = 0; i < 454; i++) {
-      re1.exec(s4[i]);
-    }
-    for (var i = 0; i < 352; i++) {
-      /qqqq|qqq|qq|q|ZZZZ|ZZZ|ZZ|Z|llll|ll|l|uu|u|UU|U|zz|z|ff|f|gg|g|sss|ss|s|mmm|mm|m/g.exec(s5[i]);
-    }
-    for (var i = 0; i < 312; i++) {
-      re3.exec(s6[i]);
-    }
-    for (var i = 0; i < 282; i++) {
-      re4.exec(s7[i]);
-    }
-    for (var i = 0; i < 177; i++) {
-      s8[i].replace(re5, '');
-    }
-    for (var i = 0; i < 170; i++) {
-      s9[i].replace(re6, '');
-      re7.exec(s10[i]);
-    }
-    for (var i = 0; i < 156; i++) {
-      re8.exec(s11[i]);
-      re8.exec(s12[i]);
-    }
-    for (var i = 0; i < 144; i++) {
-      re0.exec(s13[i]);
-    }
-    for (var i = 0; i < 139; i++) {
-      s14[i].replace(re6, '');
-      re7.exec(s14[i]);
-      re9.exec('');
-      /JroXvg\/(\S+)/.exec(s15[i]);
-    }
-    for (var i = 0; i < 137; i++) {
-      s16[i].replace(re10, '');
-      s16[i].replace(/\[/g, '');
-      s17[i].replace(re11, '');
-    }
-    for (var i = 0; i < 117; i++) {
-      s18[i].replace(re2, '');
-    }
-    for (var i = 0; i < 95; i++) {
-      /(?:^|;)\s*sevraqfgre_ynat=([^;]*)/.exec(s19[i]);
-    }
-    for (var i = 0; i < 93; i++) {
-      s20[i].replace(re12, '');
-      re13.exec(s20[i]);
-    }
-    for (var i = 0; i < 92; i++) {
-      s21[i].replace(/([a-zA-Z]|\s)+/, '');
-    }
-    for (var i = 0; i < 85; i++) {
-      s22[i].replace(re14, '');
-      s22[i].replace(re15, '');
-      s23[i].replace(re12, '');
-      s24[i].replace(re14, '');
-      s24[i].replace(re15, '');
-      re16.exec(s25[i]);
-      re13.exec(s23[i]);
-    }
-  }
-  var re17 = /(^|[^\\])\"\\\/Qngr\((-?[0-9]+)\)\\\/\"/g;
-  var str2 = '{"anzr":"","ahzoreSbezng":{"PheeraplQrpvznyQvtvgf":2,"PheeraplQrpvznyFrcnengbe":".","VfErnqBayl":gehr,"PheeraplTebhcFvmrf":[3],"AhzoreTebhcFvmrf":[3],"CrepragTebhcFvmrf":[3],"PheeraplTebhcFrcnengbe":",","PheeraplFlzoby":"\xa4","AnAFlzoby":"AnA","PheeraplArtngvirCnggrea":0,"AhzoreArtngvirCnggrea":1,"CrepragCbfvgvirCnggrea":0,"CrepragArtngvirCnggrea":0,"ArtngvirVasvavglFlzoby":"-Vasvavgl","ArtngvirFvta":"-","AhzoreQrpvznyQvtvgf":2,"AhzoreQrpvznyFrcnengbe":".","AhzoreTebhcFrcnengbe":",","PheeraplCbfvgvirCnggrea":0,"CbfvgvirVasvavglFlzoby":"Vasvavgl","CbfvgvirFvta":"+","CrepragQrpvznyQvtvgf":2,"CrepragQrpvznyFrcnengbe":".","CrepragTebhcFrcnengbe":",","CrepragFlzoby":"%","CreZvyyrFlzoby":"\u2030","AngvirQvtvgf":["0","1","2","3","4","5","6","7","8","9"],"QvtvgFhofgvghgvba":1},"qngrGvzrSbezng":{"NZQrfvtangbe":"NZ","Pnyraqne":{"ZvaFhccbegrqQngrGvzr":"@-62135568000000@","ZnkFhccbegrqQngrGvzr":"@253402300799999@","NytbevguzGlcr":1,"PnyraqneGlcr":1,"Renf":[1],"GjbQvtvgLrneZnk":2029,"VfErnqBayl":gehr},"QngrFrcnengbe":"/","SvefgQnlBsJrrx":0,"PnyraqneJrrxEhyr":0,"ShyyQngrGvzrCnggrea":"qqqq, qq ZZZZ llll UU:zz:ff","YbatQngrCnggrea":"qqqq, qq ZZZZ llll","YbatGvzrCnggrea":"UU:zz:ff","ZbaguQnlCnggrea":"ZZZZ qq","CZQrfvtangbe":"CZ","ESP1123Cnggrea":"qqq, qq ZZZ llll UU\':\'zz\':\'ff \'TZG\'","FubegQngrCnggrea":"ZZ/qq/llll","FubegGvzrCnggrea":"UU:zz","FbegnoyrQngrGvzrCnggrea":"llll\'-\'ZZ\'-\'qq\'G\'UU\':\'zz\':\'ff","GvzrFrcnengbe":":","HavirefnyFbegnoyrQngrGvzrCnggrea":"llll\'-\'ZZ\'-\'qq UU\':\'zz\':\'ff\'M\'","LrneZbaguCnggrea":"llll ZZZZ","NooerivngrqQnlAnzrf":["Fha","Zba","Ghr","Jrq","Guh","Sev","Fng"],"FubegrfgQnlAnzrf":["Fh","Zb","Gh","Jr","Gu","Se","Fn"],"QnlAnzrf":["Fhaqnl","Zbaqnl","Ghrfqnl","Jrqarfqnl","Guhefqnl","Sevqnl","Fngheqnl"],"NooerivngrqZbaguAnzrf":["Wna","Sro","Zne","Nce","Znl","Wha","Why","Nht","Frc","Bpg","Abi","Qrp",""],"ZbaguAnzrf":["Wnahnel","Sroehnel","Znepu","Ncevy","Znl","Whar","Whyl","Nhthfg","Frcgrzore","Bpgbore","Abirzore","Qrprzore",""],"VfErnqBayl":gehr,"AngvirPnyraqneAnzr":"Tertbevna Pnyraqne","NooerivngrqZbaguTravgvirAnzrf":["Wna","Sro","Zne","Nce","Znl","Wha","Why","Nht","Frc","Bpg","Abi","Qrp",""],"ZbaguTravgvirAnzrf":["Wnahnel","Sroehnel","Znepu","Ncevy","Znl","Whar","Whyl","Nhthfg","Frcgrzore","Bpgbore","Abirzore","Qrprzore",""]}}';
-  var str3 = '{"anzr":"ra-HF","ahzoreSbezng":{"PheeraplQrpvznyQvtvgf":2,"PheeraplQrpvznyFrcnengbe":".","VfErnqBayl":snyfr,"PheeraplTebhcFvmrf":[3],"AhzoreTebhcFvmrf":[3],"CrepragTebhcFvmrf":[3],"PheeraplTebhcFrcnengbe":",","PheeraplFlzoby":"$","AnAFlzoby":"AnA","PheeraplArtngvirCnggrea":0,"AhzoreArtngvirCnggrea":1,"CrepragCbfvgvirCnggrea":0,"CrepragArtngvirCnggrea":0,"ArtngvirVasvavglFlzoby":"-Vasvavgl","ArtngvirFvta":"-","AhzoreQrpvznyQvtvgf":2,"AhzoreQrpvznyFrcnengbe":".","AhzoreTebhcFrcnengbe":",","PheeraplCbfvgvirCnggrea":0,"CbfvgvirVasvavglFlzoby":"Vasvavgl","CbfvgvirFvta":"+","CrepragQrpvznyQvtvgf":2,"CrepragQrpvznyFrcnengbe":".","CrepragTebhcFrcnengbe":",","CrepragFlzoby":"%","CreZvyyrFlzoby":"\u2030","AngvirQvtvgf":["0","1","2","3","4","5","6","7","8","9"],"QvtvgFhofgvghgvba":1},"qngrGvzrSbezng":{"NZQrfvtangbe":"NZ","Pnyraqne":{"ZvaFhccbegrqQngrGvzr":"@-62135568000000@","ZnkFhccbegrqQngrGvzr":"@253402300799999@","NytbevguzGlcr":1,"PnyraqneGlcr":1,"Renf":[1],"GjbQvtvgLrneZnk":2029,"VfErnqBayl":snyfr},"QngrFrcnengbe":"/","SvefgQnlBsJrrx":0,"PnyraqneJrrxEhyr":0,"ShyyQngrGvzrCnggrea":"qqqq, ZZZZ qq, llll u:zz:ff gg","YbatQngrCnggrea":"qqqq, ZZZZ qq, llll","YbatGvzrCnggrea":"u:zz:ff gg","ZbaguQnlCnggrea":"ZZZZ qq","CZQrfvtangbe":"CZ","ESP1123Cnggrea":"qqq, qq ZZZ llll UU\':\'zz\':\'ff \'TZG\'","FubegQngrCnggrea":"Z/q/llll","FubegGvzrCnggrea":"u:zz gg","FbegnoyrQngrGvzrCnggrea":"llll\'-\'ZZ\'-\'qq\'G\'UU\':\'zz\':\'ff","GvzrFrcnengbe":":","HavirefnyFbegnoyrQngrGvzrCnggrea":"llll\'-\'ZZ\'-\'qq UU\':\'zz\':\'ff\'M\'","LrneZbaguCnggrea":"ZZZZ, llll","NooerivngrqQnlAnzrf":["Fha","Zba","Ghr","Jrq","Guh","Sev","Fng"],"FubegrfgQnlAnzrf":["Fh","Zb","Gh","Jr","Gu","Se","Fn"],"QnlAnzrf":["Fhaqnl","Zbaqnl","Ghrfqnl","Jrqarfqnl","Guhefqnl","Sevqnl","Fngheqnl"],"NooerivngrqZbaguAnzrf":["Wna","Sro","Zne","Nce","Znl","Wha","Why","Nht","Frc","Bpg","Abi","Qrp",""],"ZbaguAnzrf":["Wnahnel","Sroehnel","Znepu","Ncevy","Znl","Whar","Whyl","Nhthfg","Frcgrzore","Bpgbore","Abirzore","Qrprzore",""],"VfErnqBayl":snyfr,"AngvirPnyraqneAnzr":"Tertbevna Pnyraqne","NooerivngrqZbaguTravgvirAnzrf":["Wna","Sro","Zne","Nce","Znl","Wha","Why","Nht","Frc","Bpg","Abi","Qrp",""],"ZbaguTravgvirAnzrf":["Wnahnel","Sroehnel","Znepu","Ncevy","Znl","Whar","Whyl","Nhthfg","Frcgrzore","Bpgbore","Abirzore","Qrprzore",""]}}';
-  var str4 = 'HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str5 = 'HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-  var re18 = /^\s+|\s+$/g;
-  var str6 = 'uggc://jjj.snprobbx.pbz/vaqrk.cuc';
-  var re19 = /(?:^|\s+)ba(?:\s+|$)/;
-  var re20 = /[+, ]/;
-  var re21 = /ybnqrq|pbzcyrgr/;
-  var str7 = ';;jvaqbj.IjPurpxZbhfrCbfvgvbaNQ_VQ=shapgvba(r){vs(!r)ine r=jvaqbj.rirag;ine c=-1;vs(d1)c=d1.EbyybssCnary;ine bo=IjTrgBow("IjCnayNQ_VQ_"+c);vs(bo&&bo.fglyr.ivfvovyvgl=="ivfvoyr"){ine fns=IjFns?8:0;ine pheK=r.pyvragK+IjBOFpe("U")+fns,pheL=r.pyvragL+IjBOFpe("I")+fns;ine y=IjBOEC(NQ_VQ,bo,"Y"),g=IjBOEC(NQ_VQ,bo,"G");ine e=y+d1.Cnaryf[c].Jvqgu,o=g+d1.Cnaryf[c].Urvtug;vs((pheK<y)||(pheK>e)||(pheL<g)||(pheL>o)){vs(jvaqbj.IjBaEbyybssNQ_VQ)IjBaEbyybssNQ_VQ(c);ryfr IjPybfrNq(NQ_VQ,c,gehr,"");}ryfr erghea;}IjPnapryZbhfrYvfgrareNQ_VQ();};;jvaqbj.IjFrgEbyybssCnaryNQ_VQ=shapgvba(c){ine z="zbhfrzbir",q=qbphzrag,s=IjPurpxZbhfrCbfvgvbaNQ_VQ;c=IjTc(NQ_VQ,c);vs(d1&&d1.EbyybssCnary>-1)IjPnapryZbhfrYvfgrareNQ_VQ();vs(d1)d1.EbyybssCnary=c;gel{vs(q.nqqRiragYvfgrare)q.nqqRiragYvfgrare(z,s,snyfr);ryfr vs(q.nggnpuRirag)q.nggnpuRirag("ba"+z,s);}pngpu(r){}};;jvaqbj.IjPnapryZbhfrYvfgrareNQ_VQ=shapgvba(){ine z="zbhfrzbir",q=qbphzrag,s=IjPurpxZbhfrCbfvgvbaNQ_VQ;vs(d1)d1.EbyybssCnary=-1;gel{vs(q.erzbirRiragYvfgrare)q.erzbirRiragYvfgrare(z,s,snyfr);ryfr vs(q.qrgnpuRirag)q.qrgnpuRirag("ba"+z,s);}pngpu(r){}};;d1.IjTc=d2(n,c){ine nq=d1;vs(vfAnA(c)){sbe(ine v=0;v<nq.Cnaryf.yratgu;v++)vs(nq.Cnaryf[v].Anzr==c)erghea v;erghea 0;}erghea c;};;d1.IjTpy=d2(n,c,p){ine cn=d1.Cnaryf[IjTc(n,c)];vs(!cn)erghea 0;vs(vfAnA(p)){sbe(ine v=0;v<cn.Pyvpxguehf.yratgu;v++)vs(cn.Pyvpxguehf[v].Anzr==p)erghea v;erghea 0;}erghea p;};;d1.IjGenpr=d2(n,f){gel{vs(jvaqbj["Ij"+"QtQ"])jvaqbj["Ij"+"QtQ"](n,1,f);}pngpu(r){}};;d1.IjYvzvg1=d2(n,f){ine nq=d1,vh=f.fcyvg("/");sbe(ine v=0,p=0;v<vh.yratgu;v++){vs(vh[v].yratgu>0){vs(nq.FzV.yratgu>0)nq.FzV+="/";nq.FzV+=vh[v];nq.FtZ[nq.FtZ.yratgu]=snyfr;}}};;d1.IjYvzvg0=d2(n,f){ine nq=d1,vh=f.fcyvg("/");sbe(ine v=0;v<vh.yratgu;v++){vs(vh[v].yratgu>0){vs(nq.OvC.yratgu>0)nq.OvC+="/";nq.OvC+=vh[v];}}};;d1.IjRVST=d2(n,c){jvaqbj["IjCnayNQ_VQ_"+c+"_Bow"]=IjTrgBow("IjCnayNQ_VQ_"+c+"_Bow");vs(jvaqbj["IjCnayNQ_VQ_"+c+"_Bow"]==ahyy)frgGvzrbhg("IjRVST(NQ_VQ,"+c+")",d1.rvsg);};;d1.IjNavzSHC=d2(n,c){ine nq=d1;vs(c>nq.Cnaryf.yratgu)erghea;ine cna=nq.Cnaryf[c],nn=gehr,on=gehr,yn=gehr,en=gehr,cn=nq.Cnaryf[0],sf=nq.ShF,j=cn.Jvqgu,u=cn.Urvtug;vs(j=="100%"){j=sf;en=snyfr;yn=snyfr;}vs(u=="100%"){u=sf;nn=snyfr;on=snyfr;}vs(cn.YnY=="Y")yn=snyfr;vs(cn.YnY=="E")en=snyfr;vs(cn.GnY=="G")nn=snyfr;vs(cn.GnY=="O")on=snyfr;ine k=0,l=0;fjvgpu(nq.NshP%8){pnfr 0:oernx;pnfr 1:vs(nn)l=-sf;oernx;pnfr 2:k=j-sf;oernx;pnfr 3:vs(en)k=j;oernx;pnfr 4:k=j-sf;l=u-sf;oernx;pnfr 5:k=j-sf;vs(on)l=u;oernx;pnfr 6:l=u-sf;oernx;pnfr 7:vs(yn)k=-sf;l=u-sf;oernx;}vs(nq.NshP++ <nq.NshG)frgGvzrbhg(("IjNavzSHC(NQ_VQ,"+c+")"),nq.NshC);ryfr{k=-1000;l=k;}cna.YrsgBssfrg=k;cna.GbcBssfrg=l;IjNhErcb(n,c);};;d1.IjTrgErnyCbfvgvba=d2(n,b,j){erghea IjBOEC.nccyl(guvf,nethzragf);};;d1.IjPnapryGvzrbhg=d2(n,c){c=IjTc(n,c);ine cay=d1.Cnaryf[c];vs(cay&&cay.UgU!=""){pyrneGvzrbhg(cay.UgU);}};;d1.IjPnapryNyyGvzrbhgf=d2(n){vs(d1.YbpxGvzrbhgPunatrf)erghea;sbe(ine c=0;c<d1.bac;c++)IjPnapryGvzrbhg(n,c);};;d1.IjFgnegGvzrbhg=d2(n,c,bG){c=IjTc(n,c);ine cay=d1.Cnaryf[c];vs(cay&&((cay.UvqrGvzrbhgInyhr>0)||(nethzragf.yratgu==3&&bG>0))){pyrneGvzrbhg(cay.UgU);cay.UgU=frgGvzrbhg(cay.UvqrNpgvba,(nethzragf.yratgu==3?bG:cay.UvqrGvzrbhgInyhr));}};;d1.IjErfrgGvzrbhg=d2(n,c,bG){c=IjTc(n,c);IjPnapryGvzrbhg(n,c);riny("IjFgnegGvzrbhg(NQ_VQ,c"+(nethzragf.yratgu==3?",bG":"")+")");};;d1.IjErfrgNyyGvzrbhgf=d2(n){sbe(ine c=0;c<d1.bac;c++)IjErfrgGvzrbhg(n,c);};;d1.IjQrgnpure=d2(n,rig,sap){gel{vs(IjQVR5)riny("jvaqbj.qrgnpuRirag(\'ba"+rig+"\',"+sap+"NQ_VQ)");ryfr vs(!IjQVRZnp)riny("jvaqbj.erzbirRiragYvfgrare(\'"+rig+"\',"+sap+"NQ_VQ,snyfr)");}pngpu(r){}};;d1.IjPyrnaHc=d2(n){IjCvat(n,"G");ine nq=d1;sbe(ine v=0;v<nq.Cnaryf.yratgu;v++){IjUvqrCnary(n,v,gehr);}gel{IjTrgBow(nq.gya).vaareUGZY="";}pngpu(r){}vs(nq.gya!=nq.gya2)gel{IjTrgBow(nq.gya2).vaareUGZY="";}pngpu(r){}gel{d1=ahyy;}pngpu(r){}gel{IjQrgnpure(n,"haybnq","IjHayNQ_VQ");}pngpu(r){}gel{jvaqbj.IjHayNQ_VQ=ahyy;}pngpu(r){}gel{IjQrgnpure(n,"fpebyy","IjFeNQ_VQ");}pngpu(r){}gel{jvaqbj.IjFeNQ_VQ=ahyy;}pngpu(r){}gel{IjQrgnpure(n,"erfvmr","IjEmNQ_VQ");}pngpu(r){}gel{jvaqbj.IjEmNQ_VQ=ahyy;}pngpu(r){}gel{IjQrgnpure(n';
-  var str8 = ';;jvaqbj.IjPurpxZbhfrCbfvgvbaNQ_VQ=shapgvba(r){vs(!r)ine r=jvaqbj.rirag;ine c=-1;vs(jvaqbj.IjNqNQ_VQ)c=jvaqbj.IjNqNQ_VQ.EbyybssCnary;ine bo=IjTrgBow("IjCnayNQ_VQ_"+c);vs(bo&&bo.fglyr.ivfvovyvgl=="ivfvoyr"){ine fns=IjFns?8:0;ine pheK=r.pyvragK+IjBOFpe("U")+fns,pheL=r.pyvragL+IjBOFpe("I")+fns;ine y=IjBOEC(NQ_VQ,bo,"Y"),g=IjBOEC(NQ_VQ,bo,"G");ine e=y+jvaqbj.IjNqNQ_VQ.Cnaryf[c].Jvqgu,o=g+jvaqbj.IjNqNQ_VQ.Cnaryf[c].Urvtug;vs((pheK<y)||(pheK>e)||(pheL<g)||(pheL>o)){vs(jvaqbj.IjBaEbyybssNQ_VQ)IjBaEbyybssNQ_VQ(c);ryfr IjPybfrNq(NQ_VQ,c,gehr,"");}ryfr erghea;}IjPnapryZbhfrYvfgrareNQ_VQ();};;jvaqbj.IjFrgEbyybssCnaryNQ_VQ=shapgvba(c){ine z="zbhfrzbir",q=qbphzrag,s=IjPurpxZbhfrCbfvgvbaNQ_VQ;c=IjTc(NQ_VQ,c);vs(jvaqbj.IjNqNQ_VQ&&jvaqbj.IjNqNQ_VQ.EbyybssCnary>-1)IjPnapryZbhfrYvfgrareNQ_VQ();vs(jvaqbj.IjNqNQ_VQ)jvaqbj.IjNqNQ_VQ.EbyybssCnary=c;gel{vs(q.nqqRiragYvfgrare)q.nqqRiragYvfgrare(z,s,snyfr);ryfr vs(q.nggnpuRirag)q.nggnpuRirag("ba"+z,s);}pngpu(r){}};;jvaqbj.IjPnapryZbhfrYvfgrareNQ_VQ=shapgvba(){ine z="zbhfrzbir",q=qbphzrag,s=IjPurpxZbhfrCbfvgvbaNQ_VQ;vs(jvaqbj.IjNqNQ_VQ)jvaqbj.IjNqNQ_VQ.EbyybssCnary=-1;gel{vs(q.erzbirRiragYvfgrare)q.erzbirRiragYvfgrare(z,s,snyfr);ryfr vs(q.qrgnpuRirag)q.qrgnpuRirag("ba"+z,s);}pngpu(r){}};;jvaqbj.IjNqNQ_VQ.IjTc=shapgvba(n,c){ine nq=jvaqbj.IjNqNQ_VQ;vs(vfAnA(c)){sbe(ine v=0;v<nq.Cnaryf.yratgu;v++)vs(nq.Cnaryf[v].Anzr==c)erghea v;erghea 0;}erghea c;};;jvaqbj.IjNqNQ_VQ.IjTpy=shapgvba(n,c,p){ine cn=jvaqbj.IjNqNQ_VQ.Cnaryf[IjTc(n,c)];vs(!cn)erghea 0;vs(vfAnA(p)){sbe(ine v=0;v<cn.Pyvpxguehf.yratgu;v++)vs(cn.Pyvpxguehf[v].Anzr==p)erghea v;erghea 0;}erghea p;};;jvaqbj.IjNqNQ_VQ.IjGenpr=shapgvba(n,f){gel{vs(jvaqbj["Ij"+"QtQ"])jvaqbj["Ij"+"QtQ"](n,1,f);}pngpu(r){}};;jvaqbj.IjNqNQ_VQ.IjYvzvg1=shapgvba(n,f){ine nq=jvaqbj.IjNqNQ_VQ,vh=f.fcyvg("/");sbe(ine v=0,p=0;v<vh.yratgu;v++){vs(vh[v].yratgu>0){vs(nq.FzV.yratgu>0)nq.FzV+="/";nq.FzV+=vh[v];nq.FtZ[nq.FtZ.yratgu]=snyfr;}}};;jvaqbj.IjNqNQ_VQ.IjYvzvg0=shapgvba(n,f){ine nq=jvaqbj.IjNqNQ_VQ,vh=f.fcyvg("/");sbe(ine v=0;v<vh.yratgu;v++){vs(vh[v].yratgu>0){vs(nq.OvC.yratgu>0)nq.OvC+="/";nq.OvC+=vh[v];}}};;jvaqbj.IjNqNQ_VQ.IjRVST=shapgvba(n,c){jvaqbj["IjCnayNQ_VQ_"+c+"_Bow"]=IjTrgBow("IjCnayNQ_VQ_"+c+"_Bow");vs(jvaqbj["IjCnayNQ_VQ_"+c+"_Bow"]==ahyy)frgGvzrbhg("IjRVST(NQ_VQ,"+c+")",jvaqbj.IjNqNQ_VQ.rvsg);};;jvaqbj.IjNqNQ_VQ.IjNavzSHC=shapgvba(n,c){ine nq=jvaqbj.IjNqNQ_VQ;vs(c>nq.Cnaryf.yratgu)erghea;ine cna=nq.Cnaryf[c],nn=gehr,on=gehr,yn=gehr,en=gehr,cn=nq.Cnaryf[0],sf=nq.ShF,j=cn.Jvqgu,u=cn.Urvtug;vs(j=="100%"){j=sf;en=snyfr;yn=snyfr;}vs(u=="100%"){u=sf;nn=snyfr;on=snyfr;}vs(cn.YnY=="Y")yn=snyfr;vs(cn.YnY=="E")en=snyfr;vs(cn.GnY=="G")nn=snyfr;vs(cn.GnY=="O")on=snyfr;ine k=0,l=0;fjvgpu(nq.NshP%8){pnfr 0:oernx;pnfr 1:vs(nn)l=-sf;oernx;pnfr 2:k=j-sf;oernx;pnfr 3:vs(en)k=j;oernx;pnfr 4:k=j-sf;l=u-sf;oernx;pnfr 5:k=j-sf;vs(on)l=u;oernx;pnfr 6:l=u-sf;oernx;pnfr 7:vs(yn)k=-sf;l=u-sf;oernx;}vs(nq.NshP++ <nq.NshG)frgGvzrbhg(("IjNavzSHC(NQ_VQ,"+c+")"),nq.NshC);ryfr{k=-1000;l=k;}cna.YrsgBssfrg=k;cna.GbcBssfrg=l;IjNhErcb(n,c);};;jvaqbj.IjNqNQ_VQ.IjTrgErnyCbfvgvba=shapgvba(n,b,j){erghea IjBOEC.nccyl(guvf,nethzragf);};;jvaqbj.IjNqNQ_VQ.IjPnapryGvzrbhg=shapgvba(n,c){c=IjTc(n,c);ine cay=jvaqbj.IjNqNQ_VQ.Cnaryf[c];vs(cay&&cay.UgU!=""){pyrneGvzrbhg(cay.UgU);}};;jvaqbj.IjNqNQ_VQ.IjPnapryNyyGvzrbhgf=shapgvba(n){vs(jvaqbj.IjNqNQ_VQ.YbpxGvzrbhgPunatrf)erghea;sbe(ine c=0;c<jvaqbj.IjNqNQ_VQ.bac;c++)IjPnapryGvzrbhg(n,c);};;jvaqbj.IjNqNQ_VQ.IjFgnegGvzrbhg=shapgvba(n,c,bG){c=IjTc(n,c);ine cay=jvaqbj.IjNqNQ_VQ.Cnaryf[c];vs(cay&&((cay.UvqrGvzrbhgInyhr>0)||(nethzragf.yratgu==3&&bG>0))){pyrneGvzrbhg(cay.UgU);cay.UgU=frgGvzrbhg(cay.UvqrNpgvba,(nethzragf.yratgu==3?bG:cay.UvqrGvzrbhgInyhr));}};;jvaqbj.IjNqNQ_VQ.IjErfrgGvzrbhg=shapgvba(n,c,bG){c=IjTc(n,c);IjPnapryGvzrbhg(n,c);riny("IjFgnegGvzrbhg(NQ_VQ,c"+(nethzragf.yratgu==3?",bG":"")+")");};;jvaqbj.IjNqNQ_VQ.IjErfrgNyyGvzrbhgf=shapgvba(n){sbe(ine c=0;c<jvaqbj.IjNqNQ_VQ.bac;c++)IjErfrgGvzrbhg(n,c);};;jvaqbj.IjNqNQ_VQ.IjQrgnpure=shapgvba(n,rig,sap){gel{vs(IjQVR5)riny("jvaqbj.qrgnpuRirag(\'ba"+rig+"\',"+sap+"NQ_VQ)");ryfr vs(!IjQVRZnp)riny("jvaqbj.erzbir';
-  var str9 = ';;jvaqbj.IjPurpxZbhfrCbfvgvbaNQ_VQ=shapgvba(r){vs(!r)ine r=jvaqbj.rirag;ine c=-1;vs(jvaqbj.IjNqNQ_VQ)c=jvaqbj.IjNqNQ_VQ.EbyybssCnary;ine bo=IjTrgBow("IjCnayNQ_VQ_"+c);vs(bo&&bo.fglyr.ivfvovyvgl=="ivfvoyr"){ine fns=IjFns?8:0;ine pheK=r.pyvragK+IjBOFpe("U")+fns,pheL=r.pyvragL+IjBOFpe("I")+fns;ine y=IjBOEC(NQ_VQ,bo,"Y"),g=IjBOEC(NQ_VQ,bo,"G");ine e=y+jvaqbj.IjNqNQ_VQ.Cnaryf[c].Jvqgu,o=g+jvaqbj.IjNqNQ_VQ.Cnaryf[c].Urvtug;vs((pheK<y)||(pheK>e)||(pheL<g)||(pheL>o)){vs(jvaqbj.IjBaEbyybssNQ_VQ)IjBaEbyybssNQ_VQ(c);ryfr IjPybfrNq(NQ_VQ,c,gehr,"");}ryfr erghea;}IjPnapryZbhfrYvfgrareNQ_VQ();};;jvaqbj.IjFrgEbyybssCnaryNQ_VQ=shapgvba(c){ine z="zbhfrzbir",q=qbphzrag,s=IjPurpxZbhfrCbfvgvbaNQ_VQ;c=IjTc(NQ_VQ,c);vs(jvaqbj.IjNqNQ_VQ&&jvaqbj.IjNqNQ_VQ.EbyybssCnary>-1)IjPnapryZbhfrYvfgrareNQ_VQ();vs(jvaqbj.IjNqNQ_VQ)jvaqbj.IjNqNQ_VQ.EbyybssCnary=c;gel{vs(q.nqqRiragYvfgrare)q.nqqRiragYvfgrare(z,s,snyfr);ryfr vs(q.nggnpuRirag)q.nggnpuRirag("ba"+z,s);}pngpu(r){}};;jvaqbj.IjPnapryZbhfrYvfgrareNQ_VQ=shapgvba(){ine z="zbhfrzbir",q=qbphzrag,s=IjPurpxZbhfrCbfvgvbaNQ_VQ;vs(jvaqbj.IjNqNQ_VQ)jvaqbj.IjNqNQ_VQ.EbyybssCnary=-1;gel{vs(q.erzbirRiragYvfgrare)q.erzbirRiragYvfgrare(z,s,snyfr);ryfr vs(q.qrgnpuRirag)q.qrgnpuRirag("ba"+z,s);}pngpu(r){}};;jvaqbj.IjNqNQ_VQ.IjTc=d2(n,c){ine nq=jvaqbj.IjNqNQ_VQ;vs(vfAnA(c)){sbe(ine v=0;v<nq.Cnaryf.yratgu;v++)vs(nq.Cnaryf[v].Anzr==c)erghea v;erghea 0;}erghea c;};;jvaqbj.IjNqNQ_VQ.IjTpy=d2(n,c,p){ine cn=jvaqbj.IjNqNQ_VQ.Cnaryf[IjTc(n,c)];vs(!cn)erghea 0;vs(vfAnA(p)){sbe(ine v=0;v<cn.Pyvpxguehf.yratgu;v++)vs(cn.Pyvpxguehf[v].Anzr==p)erghea v;erghea 0;}erghea p;};;jvaqbj.IjNqNQ_VQ.IjGenpr=d2(n,f){gel{vs(jvaqbj["Ij"+"QtQ"])jvaqbj["Ij"+"QtQ"](n,1,f);}pngpu(r){}};;jvaqbj.IjNqNQ_VQ.IjYvzvg1=d2(n,f){ine nq=jvaqbj.IjNqNQ_VQ,vh=f.fcyvg("/");sbe(ine v=0,p=0;v<vh.yratgu;v++){vs(vh[v].yratgu>0){vs(nq.FzV.yratgu>0)nq.FzV+="/";nq.FzV+=vh[v];nq.FtZ[nq.FtZ.yratgu]=snyfr;}}};;jvaqbj.IjNqNQ_VQ.IjYvzvg0=d2(n,f){ine nq=jvaqbj.IjNqNQ_VQ,vh=f.fcyvg("/");sbe(ine v=0;v<vh.yratgu;v++){vs(vh[v].yratgu>0){vs(nq.OvC.yratgu>0)nq.OvC+="/";nq.OvC+=vh[v];}}};;jvaqbj.IjNqNQ_VQ.IjRVST=d2(n,c){jvaqbj["IjCnayNQ_VQ_"+c+"_Bow"]=IjTrgBow("IjCnayNQ_VQ_"+c+"_Bow");vs(jvaqbj["IjCnayNQ_VQ_"+c+"_Bow"]==ahyy)frgGvzrbhg("IjRVST(NQ_VQ,"+c+")",jvaqbj.IjNqNQ_VQ.rvsg);};;jvaqbj.IjNqNQ_VQ.IjNavzSHC=d2(n,c){ine nq=jvaqbj.IjNqNQ_VQ;vs(c>nq.Cnaryf.yratgu)erghea;ine cna=nq.Cnaryf[c],nn=gehr,on=gehr,yn=gehr,en=gehr,cn=nq.Cnaryf[0],sf=nq.ShF,j=cn.Jvqgu,u=cn.Urvtug;vs(j=="100%"){j=sf;en=snyfr;yn=snyfr;}vs(u=="100%"){u=sf;nn=snyfr;on=snyfr;}vs(cn.YnY=="Y")yn=snyfr;vs(cn.YnY=="E")en=snyfr;vs(cn.GnY=="G")nn=snyfr;vs(cn.GnY=="O")on=snyfr;ine k=0,l=0;fjvgpu(nq.NshP%8){pnfr 0:oernx;pnfr 1:vs(nn)l=-sf;oernx;pnfr 2:k=j-sf;oernx;pnfr 3:vs(en)k=j;oernx;pnfr 4:k=j-sf;l=u-sf;oernx;pnfr 5:k=j-sf;vs(on)l=u;oernx;pnfr 6:l=u-sf;oernx;pnfr 7:vs(yn)k=-sf;l=u-sf;oernx;}vs(nq.NshP++ <nq.NshG)frgGvzrbhg(("IjNavzSHC(NQ_VQ,"+c+")"),nq.NshC);ryfr{k=-1000;l=k;}cna.YrsgBssfrg=k;cna.GbcBssfrg=l;IjNhErcb(n,c);};;jvaqbj.IjNqNQ_VQ.IjTrgErnyCbfvgvba=d2(n,b,j){erghea IjBOEC.nccyl(guvf,nethzragf);};;jvaqbj.IjNqNQ_VQ.IjPnapryGvzrbhg=d2(n,c){c=IjTc(n,c);ine cay=jvaqbj.IjNqNQ_VQ.Cnaryf[c];vs(cay&&cay.UgU!=""){pyrneGvzrbhg(cay.UgU);}};;jvaqbj.IjNqNQ_VQ.IjPnapryNyyGvzrbhgf=d2(n){vs(jvaqbj.IjNqNQ_VQ.YbpxGvzrbhgPunatrf)erghea;sbe(ine c=0;c<jvaqbj.IjNqNQ_VQ.bac;c++)IjPnapryGvzrbhg(n,c);};;jvaqbj.IjNqNQ_VQ.IjFgnegGvzrbhg=d2(n,c,bG){c=IjTc(n,c);ine cay=jvaqbj.IjNqNQ_VQ.Cnaryf[c];vs(cay&&((cay.UvqrGvzrbhgInyhr>0)||(nethzragf.yratgu==3&&bG>0))){pyrneGvzrbhg(cay.UgU);cay.UgU=frgGvzrbhg(cay.UvqrNpgvba,(nethzragf.yratgu==3?bG:cay.UvqrGvzrbhgInyhr));}};;jvaqbj.IjNqNQ_VQ.IjErfrgGvzrbhg=d2(n,c,bG){c=IjTc(n,c);IjPnapryGvzrbhg(n,c);riny("IjFgnegGvzrbhg(NQ_VQ,c"+(nethzragf.yratgu==3?",bG":"")+")");};;jvaqbj.IjNqNQ_VQ.IjErfrgNyyGvzrbhgf=d2(n){sbe(ine c=0;c<jvaqbj.IjNqNQ_VQ.bac;c++)IjErfrgGvzrbhg(n,c);};;jvaqbj.IjNqNQ_VQ.IjQrgnpure=d2(n,rig,sap){gel{vs(IjQVR5)riny("jvaqbj.qrgnpuRirag(\'ba"+rig+"\',"+sap+"NQ_VQ)");ryfr vs(!IjQVRZnp)riny("jvaqbj.erzbirRiragYvfgrare(\'"+rig+"\',"+sap+"NQ_VQ,snyfr)");}pngpu(r){}};;jvaqbj.IjNqNQ_VQ.IjPyrna';
-
-  var s26 = computeInputVariants('VC=74.125.75.1', 81);
-  var s27 = computeInputVariants('9.0  e115', 78);
-  var s28 = computeInputVariants('k',78);
-  var s29 = computeInputVariants(str2, 81);
-  var s30 = computeInputVariants(str3, 81);
-  var s31 = computeInputVariants('144631658', 78);
-  var s32 = computeInputVariants('Pbhagel=IIZ%3Q', 78);
-  var s33 = computeInputVariants('Pbhagel=IIZ=', 78);
-  var s34 = computeInputVariants('CersreerqPhygherCraqvat=', 78);
-  var s35 = computeInputVariants(str4, 78);
-  var s36 = computeInputVariants(str5, 78);
-  var s37 = computeInputVariants('__hgzp=144631658', 78);
-  var s38 = computeInputVariants('gvzrMbar=-8', 78);
-  var s39 = computeInputVariants('gvzrMbar=0', 78);
-  // var s40 = computeInputVariants(s15[i], 78);
-  var s41 = computeInputVariants('vachggrkg  QBZPbageby_cynprubyqre', 78);
-  var s42 = computeInputVariants('xrlqbja', 78);
-  var s43 = computeInputVariants('xrlhc', 78);
-  var s44 = computeInputVariants('uggc://zrffntvat.zlfcnpr.pbz/vaqrk.psz', 77);
-  var s45 = computeInputVariants('FrffvbaFgbentr=%7O%22GnoThvq%22%3N%7O%22thvq%22%3N1231367125017%7Q%7Q', 73);
-  var s46 = computeInputVariants(str6, 72);
-  var s47 = computeInputVariants('3.5.0.0', 70);
-  var s48 = computeInputVariants(str7, 70);
-  var s49 = computeInputVariants(str8, 70);
-  var s50 = computeInputVariants(str9, 70);
-  var s51 = computeInputVariants('NI%3Q1_CI%3Q1_PI%3Q1_EI%3Q1_HI%3Q1_HP%3Q1_IC%3Q0.0.0.0_IH%3Q0', 70);
-  var s52 = computeInputVariants('svz_zlfcnpr_ubzrcntr_abgybttrqva,svz_zlfcnpr_aba_HTP,svz_zlfcnpr_havgrq-fgngrf', 70);
-  var s53 = computeInputVariants('ybnqvat', 70);
-  var s54 = computeInputVariants('#', 68);
-  var s55 = computeInputVariants('ybnqrq', 68);
-  var s56 = computeInputVariants('pbybe', 49);
-  var s57 = computeInputVariants('uggc://sevraqf.zlfcnpr.pbz/vaqrk.psz', 44);
-
-  function runBlock1() {
-    for (var i = 0; i < 81; i++) {
-      re8.exec(s26[i]);
-    }
-    for (var i = 0; i < 78; i++) {
-      s27[i].replace(/(\s)+e/, '');
-      s28[i].replace(/./, '');
-      s29[i].replace(re17, '');
-      s30[i].replace(re17, '');
-      re8.exec(s31[i]);
-      re8.exec(s32[i]);
-      re8.exec(s33[i]);
-      re8.exec(s34[i]);
-      re8.exec(s35[i]);
-      re8.exec(s36[i]);
-      re8.exec(s37[i]);
-      re8.exec(s38[i]);
-      re8.exec(s39[i]);
-      /Fnsnev\/(\d+\.\d+)/.exec(s15[i]);
-      re3.exec(s41[i]);
-      re0.exec(s42[i]);
-      re0.exec(s43[i]);
-    }
-    for (var i = 0; i < 77; i++) {
-      s44[i].replace(re12, '');
-      re13.exec(s44[i]);
-    }
-    for (var i = 0; i < 73; i++) {
-      s45[i].replace(re18, '');
-    }
-    for (var i = 0; i < 72; i++) {
-      re1.exec(s46[i]);
-    }
-    for (var i = 0; i < 71; i++) {
-      re19.exec('');
-    }
-    for (var i = 0; i < 70; i++) {
-      s47[i].replace(re11, '');
-      s48[i].replace(/d1/g, '');
-      s49[i].replace(/NQ_VQ/g, '');
-      s50[i].replace(/d2/g, '');
-      s51[i].replace(/_/g, '');
-      s52[i].split(re20);
-      re21.exec(s53[i]);
-    }
-    for (var i = 0; i < 68; i++) {
-      re1.exec(s54[i]);
-      /(?:ZFVR.(\d+\.\d+))|(?:(?:Sversbk|TenaCnenqvfb|Vprjrnfry).(\d+\.\d+))|(?:Bcren.(\d+\.\d+))|(?:NccyrJroXvg.(\d+(?:\.\d+)?))/.exec(s15[i]);
-      /(Znp BF K)|(Jvaqbjf;)/.exec(s15[i]);
-      /Trpxb\/([0-9]+)/.exec(s15[i]);
-      re21.exec(s55[i]);
-    }
-    for (var i = 0; i < 49; i++) {
-      re16.exec(s56[i]);
-    }
-    for (var i = 0; i < 44; i++) {
-      s57[i].replace(re12, '');
-      re13.exec(s57[i]);
-    }
-  }
-  var re22 = /\bso_zrah\b/;
-  var re23 = /^(?:(?:[^:\/?#]+):)?(?:\/\/(?:[^\/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?/;
-  var re24 = /uggcf?:\/\/([^\/]+\.)?snprobbx\.pbz\//;
-  var re25 = /"/g;
-  var re26 = /^([^?#]+)(?:\?([^#]*))?(#.*)?/;
-  var s57a = computeInputVariants('fryrpgrq', 40);
-  var s58 = computeInputVariants('vachggrkg uvqqra_ryrz', 40);
-  var s59 = computeInputVariants('vachggrkg ', 40);
-  var s60 = computeInputVariants('vachggrkg', 40);
-  var s61 = computeInputVariants('uggc://jjj.snprobbx.pbz/', 40);
-  var s62 = computeInputVariants('uggc://jjj.snprobbx.pbz/ybtva.cuc', 40);
-  var s63 = computeInputVariants('Funer guvf tnqtrg', 40);
-  var s64 = computeInputVariants('uggc://jjj.tbbtyr.pbz/vt/qverpgbel', 40);
-  var s65 = computeInputVariants('419', 40);
-  var s66 = computeInputVariants('gvzrfgnzc', 40);
-
-  function runBlock2() {
-    for (var i = 0; i < 40; i++) {
-      s57a[i].replace(re14, '');
-      s57a[i].replace(re15, '');
-    }
-    for (var i = 0; i < 39; i++) {
-      s58[i].replace(/\buvqqra_ryrz\b/g, '');
-      re3.exec(s59[i]);
-      re3.exec(s60[i]);
-      re22.exec('HVYvaxOhggba');
-      re22.exec('HVYvaxOhggba_E');
-      re22.exec('HVYvaxOhggba_EJ');
-      re22.exec('zrah_ybtva_pbagnvare');
-      /\buvqqra_ryrz\b/.exec('vachgcnffjbeq');
-    }
-    for (var i = 0; i < 37; i++) {
-      re8.exec('111soqs57qo8o8480qo18sor2011r3n591q7s6s37r120904');
-      re8.exec('SbeprqRkcvengvba=633669315660164980');
-      re8.exec('FrffvbaQQS2=111soqs57qo8o8480qo18sor2011r3n591q7s6s37r120904');
-    }
-    for (var i = 0; i < 35; i++) {
-      'puvyq p1 svefg'.replace(re14, '');
-      'puvyq p1 svefg'.replace(re15, '');
-      'sylbhg pybfrq'.replace(re14, '');
-      'sylbhg pybfrq'.replace(re15, '');
-    }
-    for (var i = 0; i < 34; i++) {
-      re19.exec('gno2');
-      re19.exec('gno3');
-      re8.exec('44132r503660');
-      re8.exec('SbeprqRkcvengvba=633669316860113296');
-      re8.exec('AFP_zp_dfctwzs-aowb_80=44132r503660');
-      re8.exec('FrffvbaQQS2=s6r4579npn4rn2135s904r0s75pp1o5334p6s6pospo12696');
-      re8.exec('s6r4579npn4rn2135s904r0s75pp1o5334p6s6pospo12696');
-    }
-    for (var i = 0; i < 32; i++) {
-      /puebzr/i.exec(s15[i]);
-    }
-    for (var i = 0; i < 31; i++) {
-      s61[i].replace(re23, '');
-      re8.exec('SbeprqRkcvengvba=633669358527244818');
-      re8.exec('VC=66.249.85.130');
-      re8.exec('FrffvbaQQS2=s15q53p9n372sn76npr13o271n4s3p5r29p235746p908p58');
-      re8.exec('s15q53p9n372sn76npr13o271n4s3p5r29p235746p908p58');
-      re24.exec(s61[i]);
-    }
-    for (var i = 0; i < 30; i++) {
-      s65[i].replace(re6, '');
-      /(?:^|\s+)gvzrfgnzc(?:\s+|$)/.exec(s66[i]);
-      re7.exec(s65[i]);
-    }
-    for (var i = 0; i < 29; i++) {
-      s62[i].replace(re23, '');
-    }
-    for (var i = 0; i < 28; i++) {
-      s63[i].replace(re25, '');
-      s63[i].replace(re12, '');
-      re26.exec(s64[i]);
-    }
-  }
-  var re27 = /-\D/g;
-  var re28 = /\bnpgvingr\b/;
-  var re29 = /%2R/gi;
-  var re30 = /%2S/gi;
-  var re31 = /^(mu-(PA|GJ)|wn|xb)$/;
-  var re32 = /\s?;\s?/;
-  var re33 = /%\w?$/;
-  var re34 = /TNQP=([^;]*)/i;
-  var str10 = 'FrffvbaQQS2=111soqs57qo8o8480qo18sor2011r3n591q7s6s37r120904; ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669315660164980&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-  var str11 = 'FrffvbaQQS2=111soqs57qo8o8480qo18sor2011r3n591q7s6s37r120904; __hgzm=144631658.1231363570.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar); __hgzn=144631658.3426875219718084000.1231363570.1231363570.1231363570.1; __hgzo=144631658.0.10.1231363570; __hgzp=144631658; ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669315660164980&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str12 = 'uggc://tbbtyrnqf.t.qbhoyrpyvpx.arg/cntrnq/nqf?pyvrag=pn-svz_zlfcnpr_zlfcnpr-ubzrcntr_wf&qg=1231363514065&uy=ra&nqfnsr=uvtu&br=hgs8&ahz_nqf=4&bhgchg=wf&nqgrfg=bss&pbeeryngbe=1231363514065&punaary=svz_zlfcnpr_ubzrcntr_abgybttrqva%2Psvz_zlfcnpr_aba_HTP%2Psvz_zlfcnpr_havgrq-fgngrf&hey=uggc%3N%2S%2Subzr.zlfcnpr.pbz%2Svaqrk.psz&nq_glcr=grkg&rvq=6083027&rn=0&sez=0&tn_ivq=1326469221.1231363557&tn_fvq=1231363557&tn_uvq=1114636509&synfu=9.0.115&h_u=768&h_j=1024&h_nu=738&h_nj=1024&h_pq=24&h_gm=-480&h_uvf=2&h_wnin=gehr&h_acyht=7&h_azvzr=22';
-  var str13 = 'ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669315660164980&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str14 = 'ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669315660164980&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-  var re35 = /[<>]/g;
-  var str15 = 'FrffvbaQQS2=s6r4579npn4rn2135s904r0s75pp1o5334p6s6pospo12696; ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669316860113296&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=; AFP_zp_dfctwzs-aowb_80=44132r503660';
-  var str16 = 'FrffvbaQQS2=s6r4579npn4rn2135s904r0s75pp1o5334p6s6pospo12696; AFP_zp_dfctwzs-aowb_80=44132r503660; __hgzm=144631658.1231363638.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar); __hgzn=144631658.965867047679498800.1231363638.1231363638.1231363638.1; __hgzo=144631658.0.10.1231363638; __hgzp=144631658; ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669316860113296&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str17 = 'uggc://tbbtyrnqf.t.qbhoyrpyvpx.arg/cntrnq/nqf?pyvrag=pn-svz_zlfcnpr_zlfcnpr-ubzrcntr_wf&qg=1231363621014&uy=ra&nqfnsr=uvtu&br=hgs8&ahz_nqf=4&bhgchg=wf&nqgrfg=bss&pbeeryngbe=1231363621014&punaary=svz_zlfcnpr_ubzrcntr_abgybttrqva%2Psvz_zlfcnpr_aba_HTP%2Psvz_zlfcnpr_havgrq-fgngrf&hey=uggc%3N%2S%2Scebsvyr.zlfcnpr.pbz%2Svaqrk.psz&nq_glcr=grkg&rvq=6083027&rn=0&sez=0&tn_ivq=348699119.1231363624&tn_fvq=1231363624&tn_uvq=895511034&synfu=9.0.115&h_u=768&h_j=1024&h_nu=738&h_nj=1024&h_pq=24&h_gm=-480&h_uvf=2&h_wnin=gehr&h_acyht=7&h_azvzr=22';
-  var str18 = 'uggc://jjj.yrobapbva.se/yv';
-  var str19 = 'ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669316860113296&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str20 = 'ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669316860113296&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-
-  var s67 = computeInputVariants('e115', 27);
-  var s68 = computeInputVariants('qvfcynl', 27);
-  var s69 = computeInputVariants('cbfvgvba', 27);
-  var s70 = computeInputVariants('uggc://jjj.zlfcnpr.pbz/', 27);
-  var s71 = computeInputVariants('cntrivrj', 27);
-  var s72 = computeInputVariants('VC=74.125.75.3', 27);
-  var s73 = computeInputVariants('ra', 27);
-  var s74 = computeInputVariants(str10, 27);
-  var s75 = computeInputVariants(str11, 27);
-  var s76 = computeInputVariants(str12, 27);
-  var s77 = computeInputVariants(str17, 27);
-  var s78 = computeInputVariants(str18, 27);
-
-  function runBlock3() {
-    for (var i = 0; i < 27; i++) {
-      s67[i].replace(/[A-Za-z]/g, '');
-    }
-    for (var i = 0; i < 23; i++) {
-      s68[i].replace(re27, '');
-      s69[i].replace(re27, '');
-    }
-    for (var i = 0; i < 22; i++) {
-      'unaqyr'.replace(re14, '');
-      'unaqyr'.replace(re15, '');
-      'yvar'.replace(re14, '');
-      'yvar'.replace(re15, '');
-      'cnerag puebzr6 fvatyr1 gno'.replace(re14, '');
-      'cnerag puebzr6 fvatyr1 gno'.replace(re15, '');
-      'fyvqre'.replace(re14, '');
-      'fyvqre'.replace(re15, '');
-      re28.exec('');
-    }
-    for (var i = 0; i < 21; i++) {
-      s70[i].replace(re12, '');
-      re13.exec(s70[i]);
-    }
-    for (var i = 0; i < 20; i++) {
-      s71[i].replace(re29, '');
-      s71[i].replace(re30, '');
-      re19.exec('ynfg');
-      re19.exec('ba svefg');
-      re8.exec(s72[i]);
-    }
-    for (var i = 0; i < 19; i++) {
-      re31.exec(s73[i]);
-    }
-    for (var i = 0; i < 18; i++) {
-      s74[i].split(re32);
-      s75[i].split(re32);
-      s76[i].replace(re33, '');
-      re8.exec('144631658.0.10.1231363570');
-      re8.exec('144631658.1231363570.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re8.exec('144631658.3426875219718084000.1231363570.1231363570.1231363570.1');
-      re8.exec(str13);
-      re8.exec(str14);
-      re8.exec('__hgzn=144631658.3426875219718084000.1231363570.1231363570.1231363570.1');
-      re8.exec('__hgzo=144631658.0.10.1231363570');
-      re8.exec('__hgzm=144631658.1231363570.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re34.exec(s74[i]);
-      re34.exec(s75[i]);
-    }
-    for (var i = 0; i < 17; i++) {
-      s15[i].match(/zfvr/gi);
-      s15[i].match(/bcren/gi);
-      str15.split(re32);
-      str16.split(re32);
-      'ohggba'.replace(re14, '');
-      'ohggba'.replace(re15, '');
-      'puvyq p1 svefg sylbhg pybfrq'.replace(re14, '');
-      'puvyq p1 svefg sylbhg pybfrq'.replace(re15, '');
-      'pvgvrf'.replace(re14, '');
-      'pvgvrf'.replace(re15, '');
-      'pybfrq'.replace(re14, '');
-      'pybfrq'.replace(re15, '');
-      'qry'.replace(re14, '');
-      'qry'.replace(re15, '');
-      'uqy_zba'.replace(re14, '');
-      'uqy_zba'.replace(re15, '');
-      s77[i].replace(re33, '');
-      s78[i].replace(/%3P/g, '');
-      s78[i].replace(/%3R/g, '');
-      s78[i].replace(/%3q/g, '');
-      s78[i].replace(re35, '');
-      'yvaxyvfg16'.replace(re14, '');
-      'yvaxyvfg16'.replace(re15, '');
-      'zvahf'.replace(re14, '');
-      'zvahf'.replace(re15, '');
-      'bcra'.replace(re14, '');
-      'bcra'.replace(re15, '');
-      'cnerag puebzr5 fvatyr1 ps NU'.replace(re14, '');
-      'cnerag puebzr5 fvatyr1 ps NU'.replace(re15, '');
-      'cynlre'.replace(re14, '');
-      'cynlre'.replace(re15, '');
-      'cyhf'.replace(re14, '');
-      'cyhf'.replace(re15, '');
-      'cb_uqy'.replace(re14, '');
-      'cb_uqy'.replace(re15, '');
-      'hyJVzt'.replace(re14, '');
-      'hyJVzt'.replace(re15, '');
-      re8.exec('144631658.0.10.1231363638');
-      re8.exec('144631658.1231363638.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re8.exec('144631658.965867047679498800.1231363638.1231363638.1231363638.1');
-      re8.exec('4413268q3660');
-      re8.exec('4ss747o77904333q374or84qrr1s9r0nprp8r5q81534o94n');
-      re8.exec('SbeprqRkcvengvba=633669321699093060');
-      re8.exec('VC=74.125.75.20');
-      re8.exec(str19);
-      re8.exec(str20);
-      re8.exec('AFP_zp_tfwsbrg-aowb_80=4413268q3660');
-      re8.exec('FrffvbaQQS2=4ss747o77904333q374or84qrr1s9r0nprp8r5q81534o94n');
-      re8.exec('__hgzn=144631658.965867047679498800.1231363638.1231363638.1231363638.1');
-      re8.exec('__hgzo=144631658.0.10.1231363638');
-      re8.exec('__hgzm=144631658.1231363638.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re34.exec(str15);
-      re34.exec(str16);
-    }
-  }
-  var re36 = /uers|fep|fryrpgrq/;
-  var re37 = /\s*([+>~\s])\s*([a-zA-Z#.*:\[])/g;
-  var re38 = /^(\w+|\*)$/;
-  var str21 = 'FrffvbaQQS2=s15q53p9n372sn76npr13o271n4s3p5r29p235746p908p58; ZFPhygher=VC=66.249.85.130&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669358527244818&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-  var str22 = 'FrffvbaQQS2=s15q53p9n372sn76npr13o271n4s3p5r29p235746p908p58; __hgzm=144631658.1231367822.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar); __hgzn=144631658.4127520630321984500.1231367822.1231367822.1231367822.1; __hgzo=144631658.0.10.1231367822; __hgzp=144631658; ZFPhygher=VC=66.249.85.130&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669358527244818&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str23 = 'uggc://tbbtyrnqf.t.qbhoyrpyvpx.arg/cntrnq/nqf?pyvrag=pn-svz_zlfcnpr_zlfcnpr-ubzrcntr_wf&qg=1231367803797&uy=ra&nqfnsr=uvtu&br=hgs8&ahz_nqf=4&bhgchg=wf&nqgrfg=bss&pbeeryngbe=1231367803797&punaary=svz_zlfcnpr_ubzrcntr_abgybttrqva%2Psvz_zlfcnpr_aba_HTP%2Psvz_zlfcnpr_havgrq-fgngrf&hey=uggc%3N%2S%2Szrffntvat.zlfcnpr.pbz%2Svaqrk.psz&nq_glcr=grkg&rvq=6083027&rn=0&sez=0&tn_ivq=1192552091.1231367807&tn_fvq=1231367807&tn_uvq=1155446857&synfu=9.0.115&h_u=768&h_j=1024&h_nu=738&h_nj=1024&h_pq=24&h_gm=-480&h_uvf=2&h_wnin=gehr&h_acyht=7&h_azvzr=22';
-  var str24 = 'ZFPhygher=VC=66.249.85.130&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669358527244818&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str25 = 'ZFPhygher=VC=66.249.85.130&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669358527244818&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-  var str26 = 'hy.ynat-fryrpgbe';
-  var re39 = /\\/g;
-  var re40 = / /g;
-  var re41 = /\/\xc4\/t/;
-  var re42 = /\/\xd6\/t/;
-  var re43 = /\/\xdc\/t/;
-  var re44 = /\/\xdf\/t/;
-  var re45 = /\/\xe4\/t/;
-  var re46 = /\/\xf6\/t/;
-  var re47 = /\/\xfc\/t/;
-  var re48 = /\W/g;
-  var re49 = /uers|fep|fglyr/;
-  var s79 = computeInputVariants(str21, 16);
-  var s80 = computeInputVariants(str22, 16);
-  var s81 = computeInputVariants(str23, 16);
-  var s82 = computeInputVariants(str26, 16);
-
-  function runBlock4() {
-    for (var i = 0; i < 16; i++) {
-      ''.replace(/\*/g, '');
-      /\bnpgvir\b/.exec('npgvir');
-      /sversbk/i.exec(s15[i]);
-      re36.exec('glcr');
-      /zfvr/i.exec(s15[i]);
-      /bcren/i.exec(s15[i]);
-    }
-    for (var i = 0; i < 15; i++) {
-      s79[i].split(re32);
-      s80[i].split(re32);
-      'uggc://ohyyrgvaf.zlfcnpr.pbz/vaqrk.psz'.replace(re12, '');
-      s81[i].replace(re33, '');
-      'yv'.replace(re37, '');
-      'yv'.replace(re18, '');
-      re8.exec('144631658.0.10.1231367822');
-      re8.exec('144631658.1231367822.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re8.exec('144631658.4127520630321984500.1231367822.1231367822.1231367822.1');
-      re8.exec(str24);
-      re8.exec(str25);
-      re8.exec('__hgzn=144631658.4127520630321984500.1231367822.1231367822.1231367822.1');
-      re8.exec('__hgzo=144631658.0.10.1231367822');
-      re8.exec('__hgzm=144631658.1231367822.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re34.exec(s79[i]);
-      re34.exec(s80[i]);
-      /\.([\w-]+)|\[(\w+)(?:([!*^$~|]?=)["']?(.*?)["']?)?\]|:([\w-]+)(?:\(["']?(.*?)?["']?\)|$)/g.exec(s82[i]);
-      re13.exec('uggc://ohyyrgvaf.zlfcnpr.pbz/vaqrk.psz');
-      re38.exec('yv');
-    }
-    for (var i = 0; i < 14; i++) {
-      ''.replace(re18, '');
-      '9.0  e115'.replace(/(\s+e|\s+o[0-9]+)/, '');
-      'Funer guvf tnqtrg'.replace(/</g, '');
-      'Funer guvf tnqtrg'.replace(/>/g, '');
-      'Funer guvf tnqtrg'.replace(re39, '');
-      'uggc://cebsvyrrqvg.zlfcnpr.pbz/vaqrk.psz'.replace(re12, '');
-      'grnfre'.replace(re40, '');
-      'grnfre'.replace(re41, '');
-      'grnfre'.replace(re42, '');
-      'grnfre'.replace(re43, '');
-      'grnfre'.replace(re44, '');
-      'grnfre'.replace(re45, '');
-      'grnfre'.replace(re46, '');
-      'grnfre'.replace(re47, '');
-      'grnfre'.replace(re48, '');
-      re16.exec('znetva-gbc');
-      re16.exec('cbfvgvba');
-      re19.exec('gno1');
-      re9.exec('qz');
-      re9.exec('qg');
-      re9.exec('zbqobk');
-      re9.exec('zbqobkva');
-      re9.exec('zbqgvgyr');
-      re13.exec('uggc://cebsvyrrqvg.zlfcnpr.pbz/vaqrk.psz');
-      re26.exec('/vt/znvytnqtrg');
-      re49.exec('glcr');
-    }
-  }
-  var re50 = /(?:^|\s+)fryrpgrq(?:\s+|$)/;
-  var re51 = /\&/g;
-  var re52 = /\+/g;
-  var re53 = /\?/g;
-  var re54 = /\t/g;
-  var re55 = /(\$\{nqiHey\})|(\$nqiHey\b)/g;
-  var re56 = /(\$\{cngu\})|(\$cngu\b)/g;
-  function runBlock5() {
-    for (var i = 0; i < 13; i++) {
-      'purpx'.replace(re14, '');
-      'purpx'.replace(re15, '');
-      'pvgl'.replace(re14, '');
-      'pvgl'.replace(re15, '');
-      'qrpe fyvqrgrkg'.replace(re14, '');
-      'qrpe fyvqrgrkg'.replace(re15, '');
-      'svefg fryrpgrq'.replace(re14, '');
-      'svefg fryrpgrq'.replace(re15, '');
-      'uqy_rag'.replace(re14, '');
-      'uqy_rag'.replace(re15, '');
-      'vape fyvqrgrkg'.replace(re14, '');
-      'vape fyvqrgrkg'.replace(re15, '');
-      'vachggrkg QBZPbageby_cynprubyqre'.replace(re5, '');
-      'cnerag puebzr6 fvatyr1 gno fryrpgrq'.replace(re14, '');
-      'cnerag puebzr6 fvatyr1 gno fryrpgrq'.replace(re15, '');
-      'cb_guz'.replace(re14, '');
-      'cb_guz'.replace(re15, '');
-      'fhozvg'.replace(re14, '');
-      'fhozvg'.replace(re15, '');
-      re50.exec('');
-      /NccyrJroXvg\/([^\s]*)/.exec(s15[i]);
-      /XUGZY/.exec(s15[i]);
-    }
-    for (var i = 0; i < 12; i++) {
-      '${cebg}://${ubfg}${cngu}/${dz}'.replace(/(\$\{cebg\})|(\$cebg\b)/g, '');
-      '1'.replace(re40, '');
-      '1'.replace(re10, '');
-      '1'.replace(re51, '');
-      '1'.replace(re52, '');
-      '1'.replace(re53, '');
-      '1'.replace(re39, '');
-      '1'.replace(re54, '');
-      '9.0  e115'.replace(/^(.*)\..*$/, '');
-      '9.0  e115'.replace(/^.*e(.*)$/, '');
-      '<!-- ${nqiHey} -->'.replace(re55, '');
-      '<fpevcg glcr="grkg/wninfpevcg" fep="${nqiHey}"></fpevcg>'.replace(re55, '');
-      s21[i].replace(/^.*\s+(\S+\s+\S+$)/, '');
-      'tzk%2Subzrcntr%2Sfgneg%2Sqr%2S'.replace(re30, '');
-      'tzk'.replace(re30, '');
-      'uggc://${ubfg}${cngu}/${dz}'.replace(/(\$\{ubfg\})|(\$ubfg\b)/g, '');
-      'uggc://nqpyvrag.hvzfrei.arg${cngu}/${dz}'.replace(re56, '');
-      'uggc://nqpyvrag.hvzfrei.arg/wf.at/${dz}'.replace(/(\$\{dz\})|(\$dz\b)/g, '');
-      'frpgvba'.replace(re29, '');
-      'frpgvba'.replace(re30, '');
-      'fvgr'.replace(re29, '');
-      'fvgr'.replace(re30, '');
-      'fcrpvny'.replace(re29, '');
-      'fcrpvny'.replace(re30, '');
-      re36.exec('anzr');
-      /e/.exec('9.0  e115');
-    }
-  }
-  var re57 = /##yv4##/gi;
-  var re58 = /##yv16##/gi;
-  var re59 = /##yv19##/gi;
-  var str27 = '<hy pynff="nqi">##yv4##Cbjreshy Zvpebfbsg grpuabybtl urycf svtug fcnz naq vzcebir frphevgl.##yv19##Trg zber qbar gunaxf gb terngre rnfr naq fcrrq.##yv16##Ybgf bs fgbentr &#40;5 TO&#41; - zber pbby fghss ba gur jnl.##OE## ##OE## ##N##Yrnea zber##/N##</hy>';
-  var str28 = '<hy pynff="nqi"><yv vq="YvOYG4" fglyr="onpxtebhaq-vzntr:hey(uggc://vzt.jykef.pbz/~Yvir.FvgrPbagrag.VQ/~14.2.1230/~/~/~/oyg4.cat)">Cbjreshy Zvpebfbsg grpuabybtl urycf svtug fcnz naq vzcebir frphevgl.##yv19##Trg zber qbar gunaxf gb terngre rnfr naq fcrrq.##yv16##Ybgf bs fgbentr &#40;5 TO&#41; - zber pbby fghss ba gur jnl.##OE## ##OE## ##N##Yrnea zber##/N##</hy>';
-  var str29 = '<hy pynff="nqi"><yv vq="YvOYG4" fglyr="onpxtebhaq-vzntr:hey(uggc://vzt.jykef.pbz/~Yvir.FvgrPbagrag.VQ/~14.2.1230/~/~/~/oyg4.cat)">Cbjreshy Zvpebfbsg grpuabybtl urycf svtug fcnz naq vzcebir frphevgl.##yv19##Trg zber qbar gunaxf gb terngre rnfr naq fcrrq.<yv vq="YvOYG16" fglyr="onpxtebhaq-vzntr:hey(uggc://vzt.jykef.pbz/~Yvir.FvgrPbagrag.VQ/~14.2.1230/~/~/~/oyg16.cat)">Ybgf bs fgbentr &#40;5 TO&#41; - zber pbby fghss ba gur jnl.##OE## ##OE## ##N##Yrnea zber##/N##</hy>';
-  var str30 = '<hy pynff="nqi"><yv vq="YvOYG4" fglyr="onpxtebhaq-vzntr:hey(uggc://vzt.jykef.pbz/~Yvir.FvgrPbagrag.VQ/~14.2.1230/~/~/~/oyg4.cat)">Cbjreshy Zvpebfbsg grpuabybtl urycf svtug fcnz naq vzcebir frphevgl.<yv vq="YvOYG19" fglyr="onpxtebhaq-vzntr:hey(uggc://vzt.jykef.pbz/~Yvir.FvgrPbagrag.VQ/~14.2.1230/~/~/~/oyg19.cat)">Trg zber qbar gunaxf gb terngre rnfr naq fcrrq.<yv vq="YvOYG16" fglyr="onpxtebhaq-vzntr:hey(uggc://vzt.jykef.pbz/~Yvir.FvgrPbagrag.VQ/~14.2.1230/~/~/~/oyg16.cat)">Ybgf bs fgbentr &#40;5 TO&#41; - zber pbby fghss ba gur jnl.##OE## ##OE## ##N##Yrnea zber##/N##</hy>';
-  var str31 = '<hy pynff="nqi"><yv vq="YvOYG4" fglyr="onpxtebhaq-vzntr:hey(uggc://vzt.jykef.pbz/~Yvir.FvgrPbagrag.VQ/~14.2.1230/~/~/~/oyg4.cat)">Cbjreshy Zvpebfbsg grpuabybtl urycf svtug fcnz naq vzcebir frphevgl.<yv vq="YvOYG19" fglyr="onpxtebhaq-vzntr:hey(uggc://vzt.jykef.pbz/~Yvir.FvgrPbagrag.VQ/~14.2.1230/~/~/~/oyg19.cat)">Trg zber qbar gunaxf gb terngre rnfr naq fcrrq.<yv vq="YvOYG16" fglyr="onpxtebhaq-vzntr:hey(uggc://vzt.jykef.pbz/~Yvir.FvgrPbagrag.VQ/~14.2.1230/~/~/~/oyg16.cat)">Ybgf bs fgbentr &#40;5 TO&#41; - zber pbby fghss ba gur jnl.<oe> <oe> ##N##Yrnea zber##/N##</hy>';
-  var str32 = '<hy pynff="nqi"><yv vq="YvOYG4" fglyr="onpxtebhaq-vzntr:hey(uggc://vzt.jykef.pbz/~Yvir.FvgrPbagrag.VQ/~14.2.1230/~/~/~/oyg4.cat)">Cbjreshy Zvpebfbsg grpuabybtl urycf svtug fcnz naq vzcebir frphevgl.<yv vq="YvOYG19" fglyr="onpxtebhaq-vzntr:hey(uggc://vzt.jykef.pbz/~Yvir.FvgrPbagrag.VQ/~14.2.1230/~/~/~/oyg19.cat)">Trg zber qbar gunaxf gb terngre rnfr naq fcrrq.<yv vq="YvOYG16" fglyr="onpxtebhaq-vzntr:hey(uggc://vzt.jykef.pbz/~Yvir.FvgrPbagrag.VQ/~14.2.1230/~/~/~/oyg16.cat)">Ybgf bs fgbentr &#40;5 TO&#41; - zber pbby fghss ba gur jnl.<oe> <oe> <n uers="uggc://znvy.yvir.pbz/znvy/nobhg.nfck" gnetrg="_oynax">Yrnea zber##/N##</hy>';
-  var str33 = 'Bar Jvaqbjf Yvir VQ trgf lbh vagb <o>Ubgznvy</o>, <o>Zrffratre</o>, <o>Kobk YVIR</o> \u2014 naq bgure cynprf lbh frr #~#argjbexybtb#~#';
-  var re60 = /(?:^|\s+)bss(?:\s+|$)/;
-  var re61 = /^(([^:\/?#]+):)?(\/\/([^\/?#]*))?([^?#]*)(\?([^#]*))?(#(.*))?$/;
-  var re62 = /^[^<]*(<(.|\s)+>)[^>]*$|^#(\w+)$/;
-  var str34 = '${1}://${2}${3}${4}${5}';
-  var str35 = ' O=6gnyg0g4znrrn&o=3&f=gc; Q=_lyu=K3bQZGSxnT4lZzD3OS9GNmV3ZGLkAQxRpTyxNmRlZmRmAmNkAQLRqTImqNZjOUEgpTjQnJ5xMKtgoN--; SCF=qy';
-  var s83 = computeInputVariants(str27, 11);
-  var s84 = computeInputVariants(str28, 11);
-  var s85 = computeInputVariants(str29, 11);
-  var s86 = computeInputVariants(str30, 11);
-  var s87 = computeInputVariants(str31, 11);
-  var s88 = computeInputVariants(str32, 11);
-  var s89 = computeInputVariants(str33, 11);
-  var s90 = computeInputVariants(str34, 11);
-
-  function runBlock6() {
-    for (var i = 0; i < 11; i++) {
-      s83[i].replace(/##yv0##/gi, '');
-      s83[i].replace(re57, '');
-      s84[i].replace(re58, '');
-      s85[i].replace(re59, '');
-      s86[i].replace(/##\/o##/gi, '');
-      s86[i].replace(/##\/v##/gi, '');
-      s86[i].replace(/##\/h##/gi, '');
-      s86[i].replace(/##o##/gi, '');
-      s86[i].replace(/##oe##/gi, '');
-      s86[i].replace(/##v##/gi, '');
-      s86[i].replace(/##h##/gi, '');
-      s87[i].replace(/##n##/gi, '');
-      s88[i].replace(/##\/n##/gi, '');
-      s89[i].replace(/#~#argjbexybtb#~#/g, '');
-      / Zbovyr\//.exec(s15[i]);
-      /##yv1##/gi.exec(s83[i]);
-      /##yv10##/gi.exec(s84[i]);
-      /##yv11##/gi.exec(s84[i]);
-      /##yv12##/gi.exec(s84[i]);
-      /##yv13##/gi.exec(s84[i]);
-      /##yv14##/gi.exec(s84[i]);
-      /##yv15##/gi.exec(s84[i]);
-      re58.exec(s84[i]);
-      /##yv17##/gi.exec(s85[i]);
-      /##yv18##/gi.exec(s85[i]);
-      re59.exec(s85[i]);
-      /##yv2##/gi.exec(s83[i]);
-      /##yv20##/gi.exec(s86[i]);
-      /##yv21##/gi.exec(s86[i]);
-      /##yv22##/gi.exec(s86[i]);
-      /##yv23##/gi.exec(s86[i]);
-      /##yv3##/gi.exec(s83[i]);
-      re57.exec(s83[i]);
-      /##yv5##/gi.exec(s84[i]);
-      /##yv6##/gi.exec(s84[i]);
-      /##yv7##/gi.exec(s84[i]);
-      /##yv8##/gi.exec(s84[i]);
-      /##yv9##/gi.exec(s84[i]);
-      re8.exec('473qq1rs0n2r70q9qo1pq48n021s9468ron90nps048p4p29');
-      re8.exec('SbeprqRkcvengvba=633669325184628362');
-      re8.exec('FrffvbaQQS2=473qq1rs0n2r70q9qo1pq48n021s9468ron90nps048p4p29');
-      /AbxvnA[^\/]*/.exec(s15[i]);
-    }
-    for (var i = 0; i < 10; i++) {
-      ' bss'.replace(/(?:^|\s+)bss(?:\s+|$)/g, '');
-      s90[i].replace(/(\$\{0\})|(\$0\b)/g, '');
-      s90[i].replace(/(\$\{1\})|(\$1\b)/g, '');
-      s90[i].replace(/(\$\{pbzcyrgr\})|(\$pbzcyrgr\b)/g, '');
-      s90[i].replace(/(\$\{sentzrag\})|(\$sentzrag\b)/g, '');
-      s90[i].replace(/(\$\{ubfgcbeg\})|(\$ubfgcbeg\b)/g, '');
-      s90[i].replace(re56, '');
-      s90[i].replace(/(\$\{cebgbpby\})|(\$cebgbpby\b)/g, '');
-      s90[i].replace(/(\$\{dhrel\})|(\$dhrel\b)/g, '');
-      'nqfvmr'.replace(re29, '');
-      'nqfvmr'.replace(re30, '');
-      'uggc://${2}${3}${4}${5}'.replace(/(\$\{2\})|(\$2\b)/g, '');
-      'uggc://wf.hv-cbegny.qr${3}${4}${5}'.replace(/(\$\{3\})|(\$3\b)/g, '');
-      'arjf'.replace(re40, '');
-      'arjf'.replace(re41, '');
-      'arjf'.replace(re42, '');
-      'arjf'.replace(re43, '');
-      'arjf'.replace(re44, '');
-      'arjf'.replace(re45, '');
-      'arjf'.replace(re46, '');
-      'arjf'.replace(re47, '');
-      'arjf'.replace(re48, '');
-      / PC=i=(\d+)&oe=(.)/.exec(str35);
-      re60.exec(' ');
-      re60.exec(' bss');
-      re60.exec('');
-      re19.exec(' ');
-      re19.exec('svefg ba');
-      re19.exec('ynfg vtaber');
-      re19.exec('ba');
-      re9.exec('scnq so ');
-      re9.exec('zrqvgobk');
-      re9.exec('hsgy');
-      re9.exec('lhv-h');
-      /Fnsnev|Xbadhrebe|XUGZY/gi.exec(s15[i]);
-      re61.exec('uggc://wf.hv-cbegny.qr/tzk/ubzr/wf/20080602/onfr.wf');
-      re62.exec('#Ybtva_rznvy');
-    }
-  }
-  var re63 = /\{0\}/g;
-  var str36 = 'FrffvbaQQS2=4ss747o77904333q374or84qrr1s9r0nprp8r5q81534o94n; ZFPhygher=VC=74.125.75.20&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669321699093060&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=; AFP_zp_tfwsbrg-aowb_80=4413268q3660';
-  var str37 = 'FrffvbaQQS2=4ss747o77904333q374or84qrr1s9r0nprp8r5q81534o94n; AFP_zp_tfwsbrg-aowb_80=4413268q3660; __hgzm=144631658.1231364074.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar); __hgzn=144631658.2294274870215848400.1231364074.1231364074.1231364074.1; __hgzo=144631658.0.10.1231364074; __hgzp=144631658; ZFPhygher=VC=74.125.75.20&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669321699093060&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str38 = 'uggc://tbbtyrnqf.t.qbhoyrpyvpx.arg/cntrnq/nqf?pyvrag=pn-svz_zlfcnpr_zlfcnpr-ubzrcntr_wf&qg=1231364057761&uy=ra&nqfnsr=uvtu&br=hgs8&ahz_nqf=4&bhgchg=wf&nqgrfg=bss&pbeeryngbe=1231364057761&punaary=svz_zlfcnpr_ubzrcntr_abgybttrqva%2Psvz_zlfcnpr_aba_HTP%2Psvz_zlfcnpr_havgrq-fgngrf&hey=uggc%3N%2S%2Ssevraqf.zlfcnpr.pbz%2Svaqrk.psz&nq_glcr=grkg&rvq=6083027&rn=0&sez=0&tn_ivq=1667363813.1231364061&tn_fvq=1231364061&tn_uvq=1917563877&synfu=9.0.115&h_u=768&h_j=1024&h_nu=738&h_nj=1024&h_pq=24&h_gm=-480&h_uvf=2&h_wnin=gehr&h_acyht=7&h_azvzr=22';
-  var str39 = 'ZFPhygher=VC=74.125.75.20&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669321699093060&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str40 = 'ZFPhygher=VC=74.125.75.20&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669321699093060&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-  var s91 = computeInputVariants(str36, 9);
-  var s92 = computeInputVariants(str37, 9);
-  var s93 = computeInputVariants(str38, 9);
-  function runBlock7() {
-    for (var i = 0; i < 9; i++) {
-      '0'.replace(re40, '');
-      '0'.replace(re10, '');
-      '0'.replace(re51, '');
-      '0'.replace(re52, '');
-      '0'.replace(re53, '');
-      '0'.replace(re39, '');
-      '0'.replace(re54, '');
-      'Lrf'.replace(re40, '');
-      'Lrf'.replace(re10, '');
-      'Lrf'.replace(re51, '');
-      'Lrf'.replace(re52, '');
-      'Lrf'.replace(re53, '');
-      'Lrf'.replace(re39, '');
-      'Lrf'.replace(re54, '');
-    }
-    for (var i = 0; i < 8; i++) {
-      'Pybfr {0}'.replace(re63, '');
-      'Bcra {0}'.replace(re63, '');
-      s91[i].split(re32);
-      s92[i].split(re32);
-      'puvyq p1 svefg gnournqref'.replace(re14, '');
-      'puvyq p1 svefg gnournqref'.replace(re15, '');
-      'uqy_fcb'.replace(re14, '');
-      'uqy_fcb'.replace(re15, '');
-      'uvag'.replace(re14, '');
-      'uvag'.replace(re15, '');
-      s93[i].replace(re33, '');
-      'yvfg'.replace(re14, '');
-      'yvfg'.replace(re15, '');
-      'at_bhgre'.replace(re30, '');
-      'cnerag puebzr5 qbhoyr2 NU'.replace(re14, '');
-      'cnerag puebzr5 qbhoyr2 NU'.replace(re15, '');
-      'cnerag puebzr5 dhnq5 ps NU osyvax zbarl'.replace(re14, '');
-      'cnerag puebzr5 dhnq5 ps NU osyvax zbarl'.replace(re15, '');
-      'cnerag puebzr6 fvatyr1'.replace(re14, '');
-      'cnerag puebzr6 fvatyr1'.replace(re15, '');
-      'cb_qrs'.replace(re14, '');
-      'cb_qrs'.replace(re15, '');
-      'gnopbagrag'.replace(re14, '');
-      'gnopbagrag'.replace(re15, '');
-      'iv_svefg_gvzr'.replace(re30, '');
-      /(^|.)(ronl|qri-ehf3.wbg)(|fgberf|zbgbef|yvirnhpgvbaf|jvxv|rkcerff|punggre).(pbz(|.nh|.pa|.ux|.zl|.ft|.oe|.zk)|pb(.hx|.xe|.am)|pn|qr|se|vg|ay|or|ng|pu|vr|va|rf|cy|cu|fr)$/i.exec('cntrf.ronl.pbz');
-      re8.exec('144631658.0.10.1231364074');
-      re8.exec('144631658.1231364074.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re8.exec('144631658.2294274870215848400.1231364074.1231364074.1231364074.1');
-      re8.exec('4413241q3660');
-      re8.exec('SbeprqRkcvengvba=633669357391353591');
-      re8.exec(str39);
-      re8.exec(str40);
-      re8.exec('AFP_zp_kkk-gdzogv_80=4413241q3660');
-      re8.exec('FrffvbaQQS2=p98s8o9q42nr21or1r61pqorn1n002nsss569635984s6qp7');
-      re8.exec('__hgzn=144631658.2294274870215848400.1231364074.1231364074.1231364074.1');
-      re8.exec('__hgzo=144631658.0.10.1231364074');
-      re8.exec('__hgzm=144631658.1231364074.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re8.exec('p98s8o9q42nr21or1r61pqorn1n002nsss569635984s6qp7');
-      re34.exec(s91[i]);
-      re34.exec(s92[i]);
-    }
-  }
-  var re64 = /\b[a-z]/g;
-  var re65 = /^uggc:\/\//;
-  var re66 = /(?:^|\s+)qvfnoyrq(?:\s+|$)/;
-  var str41 = 'uggc://cebsvyr.zlfcnpr.pbz/Zbqhyrf/Nccyvpngvbaf/Cntrf/Pnainf.nfck';
-  function runBlock8() {
-    for (var i = 0; i < 7; i++) {
-      s21[i].match(/\d+/g);
-      'nsgre'.replace(re64, '');
-      'orsber'.replace(re64, '');
-      'obggbz'.replace(re64, '');
-      'ohvygva_jrngure.kzy'.replace(re65, '');
-      'ohggba'.replace(re37, '');
-      'ohggba'.replace(re18, '');
-      'qngrgvzr.kzy'.replace(re65, '');
-      'uggc://eff.paa.pbz/eff/paa_gbcfgbevrf.eff'.replace(re65, '');
-      'vachg'.replace(re37, '');
-      'vachg'.replace(re18, '');
-      'vafvqr'.replace(re64, '');
-      'cbvagre'.replace(re27, '');
-      'cbfvgvba'.replace(/[A-Z]/g, '');
-      'gbc'.replace(re27, '');
-      'gbc'.replace(re64, '');
-      'hy'.replace(re37, '');
-      'hy'.replace(re18, '');
-      str26.replace(re37, '');
-      str26.replace(re18, '');
-      'lbhghor_vtbbtyr/i2/lbhghor.kzy'.replace(re65, '');
-      'm-vaqrk'.replace(re27, '');
-      /#([\w-]+)/.exec(str26);
-      re16.exec('urvtug');
-      re16.exec('znetvaGbc');
-      re16.exec('jvqgu');
-      re19.exec('gno0 svefg ba');
-      re19.exec('gno0 ba');
-      re19.exec('gno4 ynfg');
-      re19.exec('gno4');
-      re19.exec('gno5');
-      re19.exec('gno6');
-      re19.exec('gno7');
-      re19.exec('gno8');
-      /NqborNVE\/([^\s]*)/.exec(s15[i]);
-      /NccyrJroXvg\/([^ ]*)/.exec(s15[i]);
-      /XUGZY/gi.exec(s15[i]);
-      /^(?:obql|ugzy)$/i.exec('YV');
-      re38.exec('ohggba');
-      re38.exec('vachg');
-      re38.exec('hy');
-      re38.exec(str26);
-      /^(\w+|\*)/.exec(str26);
-      /znp|jva|yvahk/i.exec('Jva32');
-      /eton?\([\d\s,]+\)/.exec('fgngvp');
-    }
-    for (var i = 0; i < 6; i++) {
-      ''.replace(/\r/g, '');
-      '/'.replace(re40, '');
-      '/'.replace(re10, '');
-      '/'.replace(re51, '');
-      '/'.replace(re52, '');
-      '/'.replace(re53, '');
-      '/'.replace(re39, '');
-      '/'.replace(re54, '');
-      'uggc://zfacbegny.112.2b7.arg/o/ff/zfacbegnyubzr/1/U.7-cqi-2/{0}?[NDO]&{1}&{2}&[NDR]'.replace(re63, '');
-      str41.replace(re12, '');
-      'uggc://jjj.snprobbx.pbz/fepu.cuc'.replace(re23, '');
-      'freivpr'.replace(re40, '');
-      'freivpr'.replace(re41, '');
-      'freivpr'.replace(re42, '');
-      'freivpr'.replace(re43, '');
-      'freivpr'.replace(re44, '');
-      'freivpr'.replace(re45, '');
-      'freivpr'.replace(re46, '');
-      'freivpr'.replace(re47, '');
-      'freivpr'.replace(re48, '');
-      /((ZFVR\s+([6-9]|\d\d)\.))/.exec(s15[i]);
-      re66.exec('');
-      re50.exec('fryrpgrq');
-      re8.exec('8sqq78r9n442851q565599o401385sp3s04r92rnn7o19ssn');
-      re8.exec('SbeprqRkcvengvba=633669340386893867');
-      re8.exec('VC=74.125.75.17');
-      re8.exec('FrffvbaQQS2=8sqq78r9n442851q565599o401385sp3s04r92rnn7o19ssn');
-      /Xbadhrebe|Fnsnev|XUGZY/.exec(s15[i]);
-      re13.exec(str41);
-      re49.exec('unfsbphf');
-    }
-  }
-  var re67 = /zrah_byq/g;
-  var str42 = 'FrffvbaQQS2=473qq1rs0n2r70q9qo1pq48n021s9468ron90nps048p4p29; ZFPhygher=VC=74.125.75.3&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669325184628362&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-  var str43 = 'FrffvbaQQS2=473qq1rs0n2r70q9qo1pq48n021s9468ron90nps048p4p29; __hgzm=144631658.1231364380.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar); __hgzn=144631658.3931862196947939300.1231364380.1231364380.1231364380.1; __hgzo=144631658.0.10.1231364380; __hgzp=144631658; ZFPhygher=VC=74.125.75.3&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669325184628362&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str44 = 'uggc://tbbtyrnqf.t.qbhoyrpyvpx.arg/cntrnq/nqf?pyvrag=pn-svz_zlfcnpr_vzntrf_wf&qg=1231364373088&uy=ra&nqfnsr=uvtu&br=hgs8&ahz_nqf=4&bhgchg=wf&nqgrfg=bss&pbeeryngbe=1231364373088&punaary=svz_zlfcnpr_hfre-ivrj-pbzzragf%2Psvz_zlfcnpr_havgrq-fgngrf&hey=uggc%3N%2S%2Spbzzrag.zlfcnpr.pbz%2Svaqrk.psz&nq_glcr=grkg&rvq=6083027&rn=0&sez=0&tn_ivq=1158737789.1231364375&tn_fvq=1231364375&tn_uvq=415520832&synfu=9.0.115&h_u=768&h_j=1024&h_nu=738&h_nj=1024&h_pq=24&h_gm=-480&h_uvf=2&h_wnin=gehr&h_acyht=7&h_azvzr=22';
-  var str45 = 'ZFPhygher=VC=74.125.75.3&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669325184628362&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str46 = 'ZFPhygher=VC=74.125.75.3&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669325184628362&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-  var re68 = /^([#.]?)((?:[\w\u0128-\uffff*_-]|\\.)*)/;
-  var re69 = /\{1\}/g;
-  var re70 = /\s+/;
-  var re71 = /(\$\{4\})|(\$4\b)/g;
-  var re72 = /(\$\{5\})|(\$5\b)/g;
-  var re73 = /\{2\}/g;
-  var re74 = /[^+>] [^+>]/;
-  var re75 = /\bucpyv\s*=\s*([^;]*)/i;
-  var re76 = /\bucuvqr\s*=\s*([^;]*)/i;
-  var re77 = /\bucfie\s*=\s*([^;]*)/i;
-  var re78 = /\bhfucjrn\s*=\s*([^;]*)/i;
-  var re79 = /\bmvc\s*=\s*([^;]*)/i;
-  var re80 = /^((?:[\w\u0128-\uffff*_-]|\\.)+)(#)((?:[\w\u0128-\uffff*_-]|\\.)+)/;
-  var re81 = /^([>+~])\s*(\w*)/i;
-  var re82 = /^>\s*((?:[\w\u0128-\uffff*_-]|\\.)+)/;
-  var re83 = /^[\s[]?shapgvba/;
-  var re84 = /v\/g.tvs#(.*)/i;
-  var str47 = '#Zbq-Vasb-Vasb-WninFpevcgUvag';
-  var str48 = ',n.svryqOgaPnapry';
-  var str49 = 'FrffvbaQQS2=p98s8o9q42nr21or1r61pqorn1n002nsss569635984s6qp7; ZFPhygher=VC=74.125.75.3&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669357391353591&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=; AFP_zp_kkk-gdzogv_80=4413241q3660';
-  var str50 = 'FrffvbaQQS2=p98s8o9q42nr21or1r61pqorn1n002nsss569635984s6qp7; AFP_zp_kkk-gdzogv_80=4413241q3660; AFP_zp_kkk-aowb_80=4413235p3660; __hgzm=144631658.1231367708.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar); __hgzn=144631658.2770915348920628700.1231367708.1231367708.1231367708.1; __hgzo=144631658.0.10.1231367708; __hgzp=144631658; ZFPhygher=VC=74.125.75.3&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669357391353591&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str51 = 'uggc://tbbtyrnqf.t.qbhoyrpyvpx.arg/cntrnq/nqf?pyvrag=pn-svz_zlfcnpr_zlfcnpr-ubzrcntr_wf&qg=1231367691141&uy=ra&nqfnsr=uvtu&br=hgs8&ahz_nqf=4&bhgchg=wf&nqgrfg=bss&pbeeryngbe=1231367691141&punaary=svz_zlfcnpr_ubzrcntr_abgybttrqva%2Psvz_zlfcnpr_aba_HTP%2Psvz_zlfcnpr_havgrq-fgngrf&hey=uggc%3N%2S%2Sjjj.zlfcnpr.pbz%2S&nq_glcr=grkg&rvq=6083027&rn=0&sez=0&tn_ivq=320757904.1231367694&tn_fvq=1231367694&tn_uvq=1758792003&synfu=9.0.115&h_u=768&h_j=1024&h_nu=738&h_nj=1024&h_pq=24&h_gm=-480&h_uvf=2&h_wnin=gehr&h_acyht=7&h_azvzr=22';
-  var str52 = 'uggc://zfacbegny.112.2b7.arg/o/ff/zfacbegnyubzr/1/U.7-cqi-2/f55332979829981?[NDO]&aqu=1&g=7%2S0%2S2009%2014%3N38%3N42%203%20480&af=zfacbegny&cntrAnzr=HF%20UCZFSGJ&t=uggc%3N%2S%2Sjjj.zfa.pbz%2S&f=1024k768&p=24&x=L&oj=994&ou=634&uc=A&{2}&[NDR]';
-  var str53 = 'cnerag puebzr6 fvatyr1 gno fryrpgrq ovaq qbhoyr2 ps';
-  var str54 = 'ZFPhygher=VC=74.125.75.3&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669357391353591&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str55 = 'ZFPhygher=VC=74.125.75.3&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669357391353591&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-  var str56 = 'ne;ng;nh;or;oe;pn;pu;py;pa;qr;qx;rf;sv;se;to;ux;vq;vr;va;vg;wc;xe;zk;zl;ay;ab;am;cu;cy;cg;eh;fr;ft;gu;ge;gj;mn;';
-  var str57 = 'ZP1=I=3&THVQ=6nnpr9q661804s33nnop45nosqp17q85; zu=ZFSG; PHYGHER=RA-HF; SyvtugTebhcVq=97; SyvtugVq=OnfrCntr; ucfie=Z:5|S:5|G:5|R:5|Q:oyh|J:S; ucpyv=J.U|Y.|F.|E.|H.Y|P.|U.; hfucjrn=jp:HFPN0746; ZHVQ=Q783SN9O14054831N4869R51P0SO8886&GHVQ=1';
-  var str58 = 'ZP1=I=3&THVQ=6nnpr9q661804s33nnop45nosqp17q85; zu=ZFSG; PHYGHER=RA-HF; SyvtugTebhcVq=97; SyvtugVq=OnfrCntr; ucfie=Z:5|S:5|G:5|R:5|Q:oyh|J:S; ucpyv=J.U|Y.|F.|E.|H.Y|P.|U.; hfucjrn=jp:HFPN0746; ZHVQ=Q783SN9O14054831N4869R51P0SO8886';
-  var str59 = 'ZP1=I=3&THVQ=6nnpr9q661804s33nnop45nosqp17q85; zu=ZFSG; PHYGHER=RA-HF; SyvtugTebhcVq=97; SyvtugVq=OnfrCntr; ucfie=Z:5|S:5|G:5|R:5|Q:oyh|J:S; ucpyv=J.U|Y.|F.|E.|H.Y|P.|U.; hfucjrn=jp:HFPN0746; ZHVQ=Q783SN9O14054831N4869R51P0SO8886; mvc=m:94043|yn:37.4154|yb:-122.0585|p:HF|ue:1';
-  var str60 = 'ZP1=I=3&THVQ=6nnpr9q661804s33nnop45nosqp17q85; zu=ZFSG; PHYGHER=RA-HF; SyvtugTebhcVq=97; SyvtugVq=OnfrCntr; ucfie=Z:5|S:5|G:5|R:5|Q:oyh|J:S; ucpyv=J.U|Y.|F.|E.|H.Y|P.|U.; hfucjrn=jp:HFPN0746; ZHVQ=Q783SN9O14054831N4869R51P0SO8886; mvc=m:94043|yn:37.4154|yb:-122.0585|p:HF';
-  var str61 = 'uggc://gx2.fgp.f-zfa.pbz/oe/uc/11/ra-hf/pff/v/g.tvs#uggc://gx2.fgo.f-zfa.pbz/v/29/4RQP4969777N048NPS4RRR3PO2S7S.wct';
-  var str62 = 'uggc://gx2.fgp.f-zfa.pbz/oe/uc/11/ra-hf/pff/v/g.tvs#uggc://gx2.fgo.f-zfa.pbz/v/OQ/63NP9O94NS5OQP1249Q9S1ROP7NS3.wct';
-  var str63 = 'zbmvyyn/5.0 (jvaqbjf; h; jvaqbjf ag 5.1; ra-hf) nccyrjroxvg/528.9 (xugzy, yvxr trpxb) puebzr/2.0.157.0 fnsnev/528.9';
-  var s94 = computeInputVariants(str42, 5);
-  var s95 = computeInputVariants(str43, 5);
-  var s96 = computeInputVariants(str44, 5);
-  var s97 = computeInputVariants(str47, 5);
-  var s98 = computeInputVariants(str48, 5);
-  var s99 = computeInputVariants(str49, 5);
-  var s100 = computeInputVariants(str50, 5);
-  var s101 = computeInputVariants(str51, 5);
-  var s102 = computeInputVariants(str52, 5);
-  var s103 = computeInputVariants(str53, 5);
-
-  function runBlock9() {
-    for (var i = 0; i < 5; i++) {
-      s94[i].split(re32);
-      s95[i].split(re32);
-      'svz_zlfcnpr_hfre-ivrj-pbzzragf,svz_zlfcnpr_havgrq-fgngrf'.split(re20);
-      s96[i].replace(re33, '');
-      'zrah_arj zrah_arj_gbttyr zrah_gbttyr'.replace(re67, '');
-      'zrah_byq zrah_byq_gbttyr zrah_gbttyr'.replace(re67, '');
-      re8.exec('102n9o0o9pq60132qn0337rr867p75953502q2s27s2s5r98');
-      re8.exec('144631658.0.10.1231364380');
-      re8.exec('144631658.1231364380.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re8.exec('144631658.3931862196947939300.1231364380.1231364380.1231364380.1');
-      re8.exec('441326q33660');
-      re8.exec('SbeprqRkcvengvba=633669341278771470');
-      re8.exec(str45);
-      re8.exec(str46);
-      re8.exec('AFP_zp_dfctwzssrwh-aowb_80=441326q33660');
-      re8.exec('FrffvbaQQS2=102n9o0o9pq60132qn0337rr867p75953502q2s27s2s5r98');
-      re8.exec('__hgzn=144631658.3931862196947939300.1231364380.1231364380.1231364380.1');
-      re8.exec('__hgzo=144631658.0.10.1231364380');
-      re8.exec('__hgzm=144631658.1231364380.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-    }
-    for (var i = 0; i < 4; i++) {
-      ' yvfg1'.replace(re14, '');
-      ' yvfg1'.replace(re15, '');
-      ' yvfg2'.replace(re14, '');
-      ' yvfg2'.replace(re15, '');
-      ' frneputebhc1'.replace(re14, '');
-      ' frneputebhc1'.replace(re15, '');
-      s97[i].replace(re68, '');
-      s97[i].replace(re18, '');
-      ''.replace(/&/g, '');
-      ''.replace(re35, '');
-      '(..-{0})(\|(\d+)|)'.replace(re63, '');
-      s98[i].replace(re18, '');
-      '//vzt.jro.qr/vij/FC/${cngu}/${anzr}/${inyhr}?gf=${abj}'.replace(re56, '');
-      '//vzt.jro.qr/vij/FC/tzk_uc/${anzr}/${inyhr}?gf=${abj}'.replace(/(\$\{anzr\})|(\$anzr\b)/g, '');
-      '<fcna pynff="urnq"><o>Jvaqbjf Yvir Ubgznvy</o></fcna><fcna pynff="zft">{1}</fcna>'.replace(re69, '');
-      '<fcna pynff="urnq"><o>{0}</o></fcna><fcna pynff="zft">{1}</fcna>'.replace(re63, '');
-      '<fcna pynff="fvtahc"><n uers=uggc://jjj.ubgznvy.pbz><o>{1}</o></n></fcna>'.replace(re69, '');
-      '<fcna pynff="fvtahc"><n uers={0}><o>{1}</o></n></fcna>'.replace(re63, '');
-      'Vzntrf'.replace(re15, '');
-      'ZFA'.replace(re15, '');
-      'Zncf'.replace(re15, '');
-      'Zbq-Vasb-Vasb-WninFpevcgUvag'.replace(re39, '');
-      'Arjf'.replace(re15, '');
-      s99[i].split(re32);
-      s100[i].split(re32);
-      'Ivqrb'.replace(re15, '');
-      'Jro'.replace(re15, '');
-      'n'.replace(re39, '');
-      'nwnkFgneg'.split(re70);
-      'nwnkFgbc'.split(re70);
-      'ovaq'.replace(re14, '');
-      'ovaq'.replace(re15, '');
-      'oevatf lbh zber. Zber fcnpr (5TO), zber frphevgl, fgvyy serr.'.replace(re63, '');
-      'puvyq p1 svefg qrpx'.replace(re14, '');
-      'puvyq p1 svefg qrpx'.replace(re15, '');
-      'puvyq p1 svefg qbhoyr2'.replace(re14, '');
-      'puvyq p1 svefg qbhoyr2'.replace(re15, '');
-      'puvyq p2 ynfg'.replace(re14, '');
-      'puvyq p2 ynfg'.replace(re15, '');
-      'puvyq p2'.replace(re14, '');
-      'puvyq p2'.replace(re15, '');
-      'puvyq p3'.replace(re14, '');
-      'puvyq p3'.replace(re15, '');
-      'puvyq p4 ynfg'.replace(re14, '');
-      'puvyq p4 ynfg'.replace(re15, '');
-      'pbclevtug'.replace(re14, '');
-      'pbclevtug'.replace(re15, '');
-      'qZFAZR_1'.replace(re14, '');
-      'qZFAZR_1'.replace(re15, '');
-      'qbhoyr2 ps'.replace(re14, '');
-      'qbhoyr2 ps'.replace(re15, '');
-      'qbhoyr2'.replace(re14, '');
-      'qbhoyr2'.replace(re15, '');
-      'uqy_arj'.replace(re14, '');
-      'uqy_arj'.replace(re15, '');
-      'uc_fubccvatobk'.replace(re30, '');
-      'ugzy%2Rvq'.replace(re29, '');
-      'ugzy%2Rvq'.replace(re30, '');
-      s101[i].replace(re33, '');
-      'uggc://wf.hv-cbegny.qr/tzk/ubzr/wf/20080602/cebgbglcr.wf${4}${5}'.replace(re71, '');
-      'uggc://wf.hv-cbegny.qr/tzk/ubzr/wf/20080602/cebgbglcr.wf${5}'.replace(re72, '');
-      s102[i].replace(re73, '');
-      'uggc://zfacbegny.112.2b7.arg/o/ff/zfacbegnyubzr/1/U.7-cqi-2/f55332979829981?[NDO]&{1}&{2}&[NDR]'.replace(re69, '');
-      'vztZFSG'.replace(re14, '');
-      'vztZFSG'.replace(re15, '');
-      'zfasbbg1 ps'.replace(re14, '');
-      'zfasbbg1 ps'.replace(re15, '');
-      s103[i].replace(re14, '');
-      s103[i].replace(re15, '');
-      'cnerag puebzr6 fvatyr1 gno fryrpgrq ovaq'.replace(re14, '');
-      'cnerag puebzr6 fvatyr1 gno fryrpgrq ovaq'.replace(re15, '');
-      'cevznel'.replace(re14, '');
-      'cevznel'.replace(re15, '');
-      'erpgnatyr'.replace(re30, '');
-      'frpbaqnel'.replace(re14, '');
-      'frpbaqnel'.replace(re15, '');
-      'haybnq'.split(re70);
-      '{0}{1}1'.replace(re63, '');
-      '|{1}1'.replace(re69, '');
-      /(..-HF)(\|(\d+)|)/i.exec('xb-xe,ra-va,gu-gu');
-      re4.exec('/ZlFcnprNccf/NccPnainf,45000012');
-      re8.exec('144631658.0.10.1231367708');
-      re8.exec('144631658.1231367708.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re8.exec('144631658.2770915348920628700.1231367708.1231367708.1231367708.1');
-      re8.exec('4413235p3660');
-      re8.exec('441327q73660');
-      re8.exec('9995p6rp12rrnr893334ro7nq70o7p64p69rqn844prs1473');
-      re8.exec('SbeprqRkcvengvba=633669350559478880');
-      re8.exec(str54);
-      re8.exec(str55);
-      re8.exec('AFP_zp_dfctwzs-aowb_80=441327q73660');
-      re8.exec('AFP_zp_kkk-aowb_80=4413235p3660');
-      re8.exec('FrffvbaQQS2=9995p6rp12rrnr893334ro7nq70o7p64p69rqn844prs1473');
-      re8.exec('__hgzn=144631658.2770915348920628700.1231367708.1231367708.1231367708.1');
-      re8.exec('__hgzo=144631658.0.10.1231367708');
-      re8.exec('__hgzm=144631658.1231367708.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re34.exec(s99[i]);
-      re34.exec(s100[i]);
-      /ZFVR\s+5[.]01/.exec(s15[i]);
-      /HF(?=;)/i.exec(str56);
-      re74.exec(s97[i]);
-      re28.exec('svefg npgvir svefgNpgvir');
-      re28.exec('ynfg');
-      /\bp:(..)/i.exec('m:94043|yn:37.4154|yb:-122.0585|p:HF');
-      re75.exec(str57);
-      re75.exec(str58);
-      re76.exec(str57);
-      re76.exec(str58);
-      re77.exec(str57);
-      re77.exec(str58);
-      /\bhfucce\s*=\s*([^;]*)/i.exec(str59);
-      re78.exec(str57);
-      re78.exec(str58);
-      /\bjci\s*=\s*([^;]*)/i.exec(str59);
-      re79.exec(str58);
-      re79.exec(str60);
-      re79.exec(str59);
-      /\|p:([a-z]{2})/i.exec('m:94043|yn:37.4154|yb:-122.0585|p:HF|ue:1');
-      re80.exec(s97[i]);
-      re61.exec('cebgbglcr.wf');
-      re68.exec(s97[i]);
-      re81.exec(s97[i]);
-      re82.exec(s97[i]);
-      /^Fubpxjnir Synfu (\d)/.exec(s21[i]);
-      /^Fubpxjnir Synfu (\d+)/.exec(s21[i]);
-      re83.exec('[bowrpg tybony]');
-      re62.exec(s97[i]);
-      re84.exec(str61);
-      re84.exec(str62);
-      /jroxvg/.exec(str63);
-    }
-  }
-  var re85 = /eaq_zbqobkva/;
-  var str64 = '1231365729213';
-  var str65 = '74.125.75.3-1057165600.29978900';
-  var str66 = '74.125.75.3-1057165600.29978900.1231365730214';
-  var str67 = 'Frnepu%20Zvpebfbsg.pbz';
-  var str68 = 'FrffvbaQQS2=8sqq78r9n442851q565599o401385sp3s04r92rnn7o19ssn; ZFPhygher=VC=74.125.75.17&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669340386893867&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-  var str69 = 'FrffvbaQQS2=8sqq78r9n442851q565599o401385sp3s04r92rnn7o19ssn; __hgzm=144631658.1231365779.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar); __hgzn=144631658.1877536177953918500.1231365779.1231365779.1231365779.1; __hgzo=144631658.0.10.1231365779; __hgzp=144631658; ZFPhygher=VC=74.125.75.17&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669340386893867&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str70 = 'I=3%26THVQ=757q3ss871q44o7o805n8113n5p72q52';
-  var str71 = 'I=3&THVQ=757q3ss871q44o7o805n8113n5p72q52';
-  var str72 = 'uggc://tbbtyrnqf.t.qbhoyrpyvpx.arg/cntrnq/nqf?pyvrag=pn-svz_zlfcnpr_zlfcnpr-ubzrcntr_wf&qg=1231365765292&uy=ra&nqfnsr=uvtu&br=hgs8&ahz_nqf=4&bhgchg=wf&nqgrfg=bss&pbeeryngbe=1231365765292&punaary=svz_zlfcnpr_ubzrcntr_abgybttrqva%2Psvz_zlfcnpr_aba_HTP%2Psvz_zlfcnpr_havgrq-fgngrf&hey=uggc%3N%2S%2Sohyyrgvaf.zlfcnpr.pbz%2Svaqrk.psz&nq_glcr=grkg&rvq=6083027&rn=0&sez=0&tn_ivq=1579793869.1231365768&tn_fvq=1231365768&tn_uvq=2056210897&synfu=9.0.115&h_u=768&h_j=1024&h_nu=738&h_nj=1024&h_pq=24&h_gm=-480&h_uvf=2&h_wnin=gehr&h_acyht=7&h_azvzr=22';
-  var str73 = 'frnepu.zvpebfbsg.pbz';
-  var str74 = 'frnepu.zvpebfbsg.pbz/';
-  var str75 = 'ZFPhygher=VC=74.125.75.17&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669340386893867&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str76 = 'ZFPhygher=VC=74.125.75.17&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669340386893867&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-  function runBlock10() {
-    for (var i = 0; i < 3; i++) {
-      '%3Szxg=ra-HF'.replace(re39, '');
-      '-8'.replace(re40, '');
-      '-8'.replace(re10, '');
-      '-8'.replace(re51, '');
-      '-8'.replace(re52, '');
-      '-8'.replace(re53, '');
-      '-8'.replace(re39, '');
-      '-8'.replace(re54, '');
-      '1.5'.replace(re40, '');
-      '1.5'.replace(re10, '');
-      '1.5'.replace(re51, '');
-      '1.5'.replace(re52, '');
-      '1.5'.replace(re53, '');
-      '1.5'.replace(re39, '');
-      '1.5'.replace(re54, '');
-      '1024k768'.replace(re40, '');
-      '1024k768'.replace(re10, '');
-      '1024k768'.replace(re51, '');
-      '1024k768'.replace(re52, '');
-      '1024k768'.replace(re53, '');
-      '1024k768'.replace(re39, '');
-      '1024k768'.replace(re54, '');
-      str64.replace(re40, '');
-      str64.replace(re10, '');
-      str64.replace(re51, '');
-      str64.replace(re52, '');
-      str64.replace(re53, '');
-      str64.replace(re39, '');
-      str64.replace(re54, '');
-      '14'.replace(re40, '');
-      '14'.replace(re10, '');
-      '14'.replace(re51, '');
-      '14'.replace(re52, '');
-      '14'.replace(re53, '');
-      '14'.replace(re39, '');
-      '14'.replace(re54, '');
-      '24'.replace(re40, '');
-      '24'.replace(re10, '');
-      '24'.replace(re51, '');
-      '24'.replace(re52, '');
-      '24'.replace(re53, '');
-      '24'.replace(re39, '');
-      '24'.replace(re54, '');
-      str65.replace(re40, '');
-      str65.replace(re10, '');
-      str65.replace(re51, '');
-      str65.replace(re52, '');
-      str65.replace(re53, '');
-      str65.replace(re39, '');
-      str65.replace(re54, '');
-      str66.replace(re40, '');
-      str66.replace(re10, '');
-      str66.replace(re51, '');
-      str66.replace(re52, '');
-      str66.replace(re53, '');
-      str66.replace(re39, '');
-      str66.replace(re54, '');
-      '9.0'.replace(re40, '');
-      '9.0'.replace(re10, '');
-      '9.0'.replace(re51, '');
-      '9.0'.replace(re52, '');
-      '9.0'.replace(re53, '');
-      '9.0'.replace(re39, '');
-      '9.0'.replace(re54, '');
-      '994k634'.replace(re40, '');
-      '994k634'.replace(re10, '');
-      '994k634'.replace(re51, '');
-      '994k634'.replace(re52, '');
-      '994k634'.replace(re53, '');
-      '994k634'.replace(re39, '');
-      '994k634'.replace(re54, '');
-      '?zxg=ra-HF'.replace(re40, '');
-      '?zxg=ra-HF'.replace(re10, '');
-      '?zxg=ra-HF'.replace(re51, '');
-      '?zxg=ra-HF'.replace(re52, '');
-      '?zxg=ra-HF'.replace(re53, '');
-      '?zxg=ra-HF'.replace(re54, '');
-      'PAA.pbz'.replace(re25, '');
-      'PAA.pbz'.replace(re12, '');
-      'PAA.pbz'.replace(re39, '');
-      'Qngr & Gvzr'.replace(re25, '');
-      'Qngr & Gvzr'.replace(re12, '');
-      'Qngr & Gvzr'.replace(re39, '');
-      'Frnepu Zvpebfbsg.pbz'.replace(re40, '');
-      'Frnepu Zvpebfbsg.pbz'.replace(re54, '');
-      str67.replace(re10, '');
-      str67.replace(re51, '');
-      str67.replace(re52, '');
-      str67.replace(re53, '');
-      str67.replace(re39, '');
-      str68.split(re32);
-      str69.split(re32);
-      str70.replace(re52, '');
-      str70.replace(re53, '');
-      str70.replace(re39, '');
-      str71.replace(re40, '');
-      str71.replace(re10, '');
-      str71.replace(re51, '');
-      str71.replace(re54, '');
-      'Jrngure'.replace(re25, '');
-      'Jrngure'.replace(re12, '');
-      'Jrngure'.replace(re39, '');
-      'LbhGhor'.replace(re25, '');
-      'LbhGhor'.replace(re12, '');
-      'LbhGhor'.replace(re39, '');
-      str72.replace(re33, '');
-      'erzbgr_vsenzr_1'.replace(/^erzbgr_vsenzr_/, '');
-      str73.replace(re40, '');
-      str73.replace(re10, '');
-      str73.replace(re51, '');
-      str73.replace(re52, '');
-      str73.replace(re53, '');
-      str73.replace(re39, '');
-      str73.replace(re54, '');
-      str74.replace(re40, '');
-      str74.replace(re10, '');
-      str74.replace(re51, '');
-      str74.replace(re52, '');
-      str74.replace(re53, '');
-      str74.replace(re39, '');
-      str74.replace(re54, '');
-      'lhv-h'.replace(/\-/g, '');
-      re9.exec('p');
-      re9.exec('qz p');
-      re9.exec('zbqynory');
-      re9.exec('lhv-h svefg');
-      re8.exec('144631658.0.10.1231365779');
-      re8.exec('144631658.1231365779.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re8.exec('144631658.1877536177953918500.1231365779.1231365779.1231365779.1');
-      re8.exec(str75);
-      re8.exec(str76);
-      re8.exec('__hgzn=144631658.1877536177953918500.1231365779.1231365779.1231365779.1');
-      re8.exec('__hgzo=144631658.0.10.1231365779');
-      re8.exec('__hgzm=144631658.1231365779.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re34.exec(str68);
-      re34.exec(str69);
-      /^$/.exec('');
-      re31.exec('qr');
-      /^znk\d+$/.exec('');
-      /^zva\d+$/.exec('');
-      /^erfgber$/.exec('');
-      re85.exec('zbqobkva zbqobk_abcnqqvat ');
-      re85.exec('zbqgvgyr');
-      re85.exec('eaq_zbqobkva ');
-      re85.exec('eaq_zbqgvgyr ');
-      /frpgvba\d+_pbagragf/.exec('obggbz_ani');
-    }
-  }
-  var re86 = /;\s*/;
-  var re87 = /(\$\{inyhr\})|(\$inyhr\b)/g;
-  var re88 = /(\$\{abj\})|(\$abj\b)/g;
-  var re89 = /\s+$/;
-  var re90 = /^\s+/;
-  var re91 = /(\\\"|\x00-|\x1f|\x7f-|\x9f|\u00ad|\u0600-|\u0604|\u070f|\u17b4|\u17b5|\u200c-|\u200f|\u2028-|\u202f|\u2060-|\u206f|\ufeff|\ufff0-|\uffff)/g;
-  var re92 = /^(:)([\w-]+)\("?'?(.*?(\(.*?\))?[^(]*?)"?'?\)/;
-  var re93 = /^([:.#]*)((?:[\w\u0128-\uffff*_-]|\\.)+)/;
-  var re94 = /^(\[) *@?([\w-]+) *([!*$^~=]*) *('?"?)(.*?)\4 *\]/;
-  var str77 = '#fubhgobk .pybfr';
-  var str78 = 'FrffvbaQQS2=102n9o0o9pq60132qn0337rr867p75953502q2s27s2s5r98; ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669341278771470&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=; AFP_zp_dfctwzssrwh-aowb_80=441326q33660';
-  var str79 = 'FrffvbaQQS2=102n9o0o9pq60132qn0337rr867p75953502q2s27s2s5r98; AFP_zp_dfctwzssrwh-aowb_80=441326q33660; __hgzm=144631658.1231365869.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar); __hgzn=144631658.1670816052019209000.1231365869.1231365869.1231365869.1; __hgzo=144631658.0.10.1231365869; __hgzp=144631658; ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669341278771470&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str80 = 'FrffvbaQQS2=9995p6rp12rrnr893334ro7nq70o7p64p69rqn844prs1473; ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669350559478880&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=; AFP_zp_dfctwzs-aowb_80=441327q73660';
-  var str81 = 'FrffvbaQQS2=9995p6rp12rrnr893334ro7nq70o7p64p69rqn844prs1473; AFP_zp_dfctwzs-aowb_80=441327q73660; __hgzm=144631658.1231367054.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar); __hgzn=144631658.1796080716621419500.1231367054.1231367054.1231367054.1; __hgzo=144631658.0.10.1231367054; __hgzp=144631658; ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669350559478880&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str82 = '[glcr=fhozvg]';
-  var str83 = 'n.svryqOga,n.svryqOgaPnapry';
-  var str84 = 'n.svryqOgaPnapry';
-  var str85 = 'oyvpxchaxg';
-  var str86 = 'qvi.bow-nppbeqvba qg';
-  var str87 = 'uggc://tbbtyrnqf.t.qbhoyrpyvpx.arg/cntrnq/nqf?pyvrag=pn-svz_zlfcnpr_nccf_wf&qg=1231367052227&uy=ra&nqfnsr=uvtu&br=hgs8&ahz_nqf=4&bhgchg=wf&nqgrfg=bss&pbeeryngbe=1231367052227&punaary=svz_zlfcnpr_nccf-pnainf%2Psvz_zlfcnpr_havgrq-fgngrf&hey=uggc%3N%2S%2Scebsvyr.zlfcnpr.pbz%2SZbqhyrf%2SNccyvpngvbaf%2SCntrf%2SPnainf.nfck&nq_glcr=grkg&rvq=6083027&rn=0&sez=1&tn_ivq=716357910.1231367056&tn_fvq=1231367056&tn_uvq=1387206491&synfu=9.0.115&h_u=768&h_j=1024&h_nu=738&h_nj=1024&h_pq=24&h_gm=-480&h_uvf=2&h_wnin=gehr&h_acyht=7&h_azvzr=22';
-  var str88 = 'uggc://tbbtyrnqf.t.qbhoyrpyvpx.arg/cntrnq/nqf?pyvrag=pn-svz_zlfcnpr_zlfcnpr-ubzrcntr_wf&qg=1231365851658&uy=ra&nqfnsr=uvtu&br=hgs8&ahz_nqf=4&bhgchg=wf&nqgrfg=bss&pbeeryngbe=1231365851658&punaary=svz_zlfcnpr_ubzrcntr_abgybttrqva%2Psvz_zlfcnpr_aba_HTP%2Psvz_zlfcnpr_havgrq-fgngrf&hey=uggc%3N%2S%2Scebsvyrrqvg.zlfcnpr.pbz%2Svaqrk.psz&nq_glcr=grkg&rvq=6083027&rn=0&sez=0&tn_ivq=1979828129.1231365855&tn_fvq=1231365855&tn_uvq=2085229649&synfu=9.0.115&h_u=768&h_j=1024&h_nu=738&h_nj=1024&h_pq=24&h_gm=-480&h_uvf=2&h_wnin=gehr&h_acyht=7&h_azvzr=22';
-  var str89 = 'uggc://zfacbegny.112.2b7.arg/o/ff/zfacbegnyubzr/1/U.7-cqi-2/f55023338617756?[NDO]&aqu=1&g=7%2S0%2S2009%2014%3N12%3N47%203%20480&af=zfacbegny&cntrAnzr=HF%20UCZFSGJ&t=uggc%3N%2S%2Sjjj.zfa.pbz%2S&f=0k0&p=43835816&x=A&oj=994&ou=634&uc=A&{2}&[NDR]';
-  var str90 = 'zrgn[anzr=nwnkHey]';
-  var str91 = 'anpuevpugra';
-  var str92 = 'b oS={\'oT\':1.1};x $8n(B){z(B!=o9)};x $S(B){O(!$8n(B))z A;O(B.4L)z\'T\';b S=7t B;O(S==\'2P\'&&B.p4){23(B.7f){12 1:z\'T\';12 3:z/\S/.2g(B.8M)?\'ox\':\'oh\'}}O(S==\'2P\'||S==\'x\'){23(B.nE){12 2V:z\'1O\';12 7I:z\'5a\';12 18:z\'4B\'}O(7t B.I==\'4F\'){O(B.3u)z\'pG\';O(B.8e)z\'1p\'}}z S};x $2p(){b 4E={};Z(b v=0;v<1p.I;v++){Z(b X 1o 1p[v]){b nc=1p[v][X];b 6E=4E[X];O(6E&&$S(nc)==\'2P\'&&$S(6E)==\'2P\')4E[X]=$2p(6E,nc);17 4E[X]=nc}}z 4E};b $E=7p.E=x(){b 1d=1p;O(!1d[1])1d=[p,1d[0]];Z(b X 1o 1d[1])1d[0][X]=1d[1][X];z 1d[0]};b $4D=7p.pJ=x(){Z(b v=0,y=1p.I;v<y;v++){1p[v].E=x(1J){Z(b 1I 1o 1J){O(!p.1Y[1I])p.1Y[1I]=1J[1I];O(!p[1I])p[1I]=$4D.6C(1I)}}}};$4D.6C=x(1I){z x(L){z p.1Y[1I].3H(L,2V.1Y.nV.1F(1p,1))}};$4D(7F,2V,6J,nb);b 3l=x(B){B=B||{};B.E=$E;z B};b pK=Y 3l(H);b pZ=Y 3l(C);C.6f=C.35(\'6f\')[0];x $2O(B){z!!(B||B===0)};x $5S(B,n8){z $8n(B)?B:n8};x $7K(3c,1m){z 1q.na(1q.7K()*(1m-3c+1)+3c)};x $3N(){z Y 97().os()};x $4M(1U){pv(1U);pa(1U);z 1S};H.43=!!(C.5Z);O(H.nB)H.31=H[H.7q?\'py\':\'nL\']=1r;17 O(C.9N&&!C.om&&!oy.oZ)H.pF=H.4Z=H[H.43?\'pt\':\'65\']=1r;17 O(C.po!=1S)H.7J=1r;O(7t 5B==\'o9\'){b 5B=x(){};O(H.4Z)C.nd("pW");5B.1Y=(H.4Z)?H["[[oN.1Y]]"]:{}}5B.1Y.4L=1r;O(H.nL)5s{C.oX("pp",A,1r)}4K(r){};b 18=x(1X){b 63=x(){z(1p[0]!==1S&&p.1w&&$S(p.1w)==\'x\')?p.1w.3H(p,1p):p};$E(63,p);63.1Y=1X;63.nE=18;z 63};18.1z=x(){};18.1Y={E:x(1X){b 7x=Y p(1S);Z(b X 1o 1X){b nC=7x[X];7x[X]=18.nY(nC,1X[X])}z Y 18(7x)},3d:x(){Z(b v=0,y=1p.I;v<y;v++)$E(p.1Y,1p[v])}};18.nY=x(2b,2n){O(2b&&2b!=2n){b S=$S(2n);O(S!=$S(2b))z 2n;23(S){12\'x\':b 7R=x(){p.1e=1p.8e.1e;z 2n.3H(p,1p)};7R.1e=2b;z 7R;12\'2P\':z $2p(2b,2n)}}z 2n};b 8o=Y 18({oQ:x(J){p.4w=p.4w||[];p.4w.1x(J);z p},7g:x(){O(p.4w&&p.4w.I)p.4w.9J().2x(10,p)},oP:x(){p.4w=[]}});b 2d=Y 18({1V:x(S,J){O(J!=18.1z){p.$19=p.$19||{};p.$19[S]=p.$19[S]||[];p.$19[S].5j(J)}z p},1v:x(S,1d,2x){O(p.$19&&p.$19[S]){p.$19[S].1b(x(J){J.3n({\'L\':p,\'2x\':2x,\'1p\':1d})()},p)}z p},3M:x(S,J){O(p.$19&&p.$19[S])p.$19[S].2U(J);z p}});b 4v=Y 18({2H:x(){p.P=$2p.3H(1S,[p.P].E(1p));O(!p.1V)z p;Z(b 3O 1o p.P){O($S(p.P[3O]==\'x\')&&3O.2g(/^5P[N-M]/))p.1V(3O,p.P[3O])}z p}});2V.E({7y:x(J,L){Z(b v=0,w=p.I;v<w;v++)J.1F(L,p[v],v,p)},3s:x(J,L){b 54=[];Z(b v=0,w=p.I;v<w;v++){O(J.1F(L,p[v],v,p))54.1x(p[v])}z 54},2X:x(J,L){b 54=[];Z(b v=0,w=p.I;v<w;v++)54[v]=J.1F(L,p[v],v,p);z 54},4i:x(J,L){Z(b v=0,w=p.I;v<w;v++){O(!J.1F(L,p[v],v,p))z A}z 1r},ob:x(J,L){Z(b v=0,w=p.I;v<w;v++){O(J.1F(L,p[v],v,p))z 1r}z A},3F:x(3u,15){b 3A=p.I;Z(b v=(15<0)?1q.1m(0,3A+15):15||0;v<3A;v++){O(p[v]===3u)z v}z-1},8z:x(1u,I){1u=1u||0;O(1u<0)1u=p.I+1u;I=I||(p.I-1u);b 89=[];Z(b v=0;v<I;v++)89[v]=p[1u++];z 89},2U:x(3u){b v=0;b 3A=p.I;6L(v<3A){O(p[v]===3u){p.6l(v,1);3A--}17{v++}}z p},1y:x(3u,15){z p.3F(3u,15)!=-1},oz:x(1C){b B={},I=1q.3c(p.I,1C.I);Z(b v=0;v<I;v++)B[1C[v]]=p[v];z B},E:x(1O){Z(b v=0,w=1O.I;v<w;v++)p.1x(1O[v]);z p},2p:x(1O){Z(b v=0,y=1O.I;v<y;v++)p.5j(1O[v]);z p},5j:x(3u){O(!p.1y(3u))p.1x(3u);z p},oc:x(){z p[$7K(0,p.I-1)]||A},7L:x(){z p[p.I-1]||A}});2V.1Y.1b=2V.1Y.7y;2V.1Y.2g=2V.1Y.1y;x $N(1O){z 2V.8z(1O)};x $1b(3J,J,L){O(3J&&7t 3J.I==\'4F\'&&$S(3J)!=\'2P\')2V.7y(3J,J,L);17 Z(b 1j 1o 3J)J.1F(L||3J,3J[1j],1j)};6J.E({2g:x(6b,2F){z(($S(6b)==\'2R\')?Y 7I(6b,2F):6b).2g(p)},3p:x(){z 5K(p,10)},o4:x(){z 69(p)},7A:x(){z p.3y(/-\D/t,x(2G){z 2G.7G(1).nW()})},9b:x(){z p.3y(/\w[N-M]/t,x(2G){z(2G.7G(0)+\'-\'+2G.7G(1).5O())})},8V:x(){z p.3y(/\b[n-m]/t,x(2G){z 2G.nW()})},5L:x(){z p.3y(/^\s+|\s+$/t,\'\')},7j:x(){z p.3y(/\s{2,}/t,\' \').5L()},5V:x(1O){b 1i=p.2G(/\d{1,3}/t);z(1i)?1i.5V(1O):A},5U:x(1O){b 3P=p.2G(/^#?(\w{1,2})(\w{1,2})(\w{1,2})$/);z(3P)?3P.nV(1).5U(1O):A},1y:x(2R,f){z(f)?(f+p+f).3F(f+2R+f)>-1:p.3F(2R)>-1},nX:x(){z p.3y(/([.*+?^${}()|[\]\/\\])/t,\'\\$1\')}});2V.E({5V:x(1O){O(p.I<3)z A;O(p.I==4&&p[3]==0&&!1O)z\'p5\';b 3P=[];Z(b v=0;v<3;v++){b 52=(p[v]-0).4h(16);3P.1x((52.I==1)?\'0\'+52:52)}z 1O?3P:\'#\'+3P.2u(\'\')},5U:x(1O){O(p.I!=3)z A;b 1i=[];Z(b v=0;v<3;v++){1i.1x(5K((p[v].I==1)?p[v]+p[v]:p[v],16))}z 1O?1i:\'1i(\'+1i.2u(\',\')+\')\'}});7F.E({3n:x(P){b J=p;P=$2p({\'L\':J,\'V\':A,\'1p\':1S,\'2x\':A,\'4s\':A,\'6W\':A},P);O($2O(P.1p)&&$S(P.1p)!=\'1O\')P.1p=[P.1p];z x(V){b 1d;O(P.V){V=V||H.V;1d=[(P.V===1r)?V:Y P.V(V)];O(P.1p)1d.E(P.1p)}17 1d=P.1p||1p;b 3C=x(){z J.3H($5S(P';
-  var str93 = 'hagreunyghat';
-  var str94 = 'ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669341278771470&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str95 = 'ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&Pbhagel=IIZ%3Q&SbeprqRkcvengvba=633669350559478880&gvzrMbar=-8&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R%3Q';
-  var str96 = 'ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669341278771470&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-  var str97 = 'ZFPhygher=VC=74.125.75.1&VCPhygher=ra-HF&CersreerqPhygher=ra-HF&CersreerqPhygherCraqvat=&Pbhagel=IIZ=&SbeprqRkcvengvba=633669350559478880&gvzrMbar=0&HFEYBP=DKWyLHAiMTH9AwHjWxAcqUx9GJ91oaEunJ4tIzyyqlMQo3IhqUW5D29xMG1IHlMQo3IhqUW5GzSgMG1Iozy0MJDtH3EuqTImWxEgLHAiMTH9BQN3WxkuqTy0qJEyCGZ3YwDkBGVzGT9hM2y0qJEyCF0kZwVhZQH3APMDo3A0LJkQo2EyCGx0ZQDmWyWyM2yiox5uoJH9D0R=';
-  var str98 = 'shapgvba (){Cuk.Nccyvpngvba.Frghc.Pber();Cuk.Nccyvpngvba.Frghc.Nwnk();Cuk.Nccyvpngvba.Frghc.Synfu();Cuk.Nccyvpngvba.Frghc.Zbqhyrf()}';
-  function runBlock11() {
-    for (var i = 0; i < 2; i++) {
-      ' .pybfr'.replace(re18, '');
-      ' n.svryqOgaPnapry'.replace(re18, '');
-      ' qg'.replace(re18, '');
-      str77.replace(re68, '');
-      str77.replace(re18, '');
-      ''.replace(re39, '');
-      ''.replace(/^/, '');
-      ''.split(re86);
-      '*'.replace(re39, '');
-      '*'.replace(re68, '');
-      '*'.replace(re18, '');
-      '.pybfr'.replace(re68, '');
-      '.pybfr'.replace(re18, '');
-      '//vzt.jro.qr/vij/FC/tzk_uc/fperra/${inyhr}?gf=${abj}'.replace(re87, '');
-      '//vzt.jro.qr/vij/FC/tzk_uc/fperra/1024?gf=${abj}'.replace(re88, '');
-      '//vzt.jro.qr/vij/FC/tzk_uc/jvafvmr/${inyhr}?gf=${abj}'.replace(re87, '');
-      '//vzt.jro.qr/vij/FC/tzk_uc/jvafvmr/992/608?gf=${abj}'.replace(re88, '');
-      '300k120'.replace(re30, '');
-      '300k250'.replace(re30, '');
-      '310k120'.replace(re30, '');
-      '310k170'.replace(re30, '');
-      '310k250'.replace(re30, '');
-      '9.0  e115'.replace(/^.*\.(.*)\s.*$/, '');
-      'Nppbeqvba'.replace(re2, '');
-      'Nxghryy\x0a'.replace(re89, '');
-      'Nxghryy\x0a'.replace(re90, '');
-      'Nccyvpngvba'.replace(re2, '');
-      'Oyvpxchaxg\x0a'.replace(re89, '');
-      'Oyvpxchaxg\x0a'.replace(re90, '');
-      'Svanamra\x0a'.replace(re89, '');
-      'Svanamra\x0a'.replace(re90, '');
-      'Tnzrf\x0a'.replace(re89, '');
-      'Tnzrf\x0a'.replace(re90, '');
-      'Ubebfxbc\x0a'.replace(re89, '');
-      'Ubebfxbc\x0a'.replace(re90, '');
-      'Xvab\x0a'.replace(re89, '');
-      'Xvab\x0a'.replace(re90, '');
-      'Zbqhyrf'.replace(re2, '');
-      'Zhfvx\x0a'.replace(re89, '');
-      'Zhfvx\x0a'.replace(re90, '');
-      'Anpuevpugra\x0a'.replace(re89, '');
-      'Anpuevpugra\x0a'.replace(re90, '');
-      'Cuk'.replace(re2, '');
-      'ErdhrfgSvavfu'.split(re70);
-      'ErdhrfgSvavfu.NWNK.Cuk'.split(re70);
-      'Ebhgr\x0a'.replace(re89, '');
-      'Ebhgr\x0a'.replace(re90, '');
-      str78.split(re32);
-      str79.split(re32);
-      str80.split(re32);
-      str81.split(re32);
-      'Fcbeg\x0a'.replace(re89, '');
-      'Fcbeg\x0a'.replace(re90, '');
-      'GI-Fcbg\x0a'.replace(re89, '');
-      'GI-Fcbg\x0a'.replace(re90, '');
-      'Gbhe\x0a'.replace(re89, '');
-      'Gbhe\x0a'.replace(re90, '');
-      'Hagreunyghat\x0a'.replace(re89, '');
-      'Hagreunyghat\x0a'.replace(re90, '');
-      'Ivqrb\x0a'.replace(re89, '');
-      'Ivqrb\x0a'.replace(re90, '');
-      'Jrggre\x0a'.replace(re89, '');
-      'Jrggre\x0a'.replace(re90, '');
-      str82.replace(re68, '');
-      str82.replace(re18, '');
-      str83.replace(re68, '');
-      str83.replace(re18, '');
-      str84.replace(re68, '');
-      str84.replace(re18, '');
-      'nqiFreivprObk'.replace(re30, '');
-      'nqiFubccvatObk'.replace(re30, '');
-      'nwnk'.replace(re39, '');
-      'nxghryy'.replace(re40, '');
-      'nxghryy'.replace(re41, '');
-      'nxghryy'.replace(re42, '');
-      'nxghryy'.replace(re43, '');
-      'nxghryy'.replace(re44, '');
-      'nxghryy'.replace(re45, '');
-      'nxghryy'.replace(re46, '');
-      'nxghryy'.replace(re47, '');
-      'nxghryy'.replace(re48, '');
-      str85.replace(re40, '');
-      str85.replace(re41, '');
-      str85.replace(re42, '');
-      str85.replace(re43, '');
-      str85.replace(re44, '');
-      str85.replace(re45, '');
-      str85.replace(re46, '');
-      str85.replace(re47, '');
-      str85.replace(re48, '');
-      'pngrtbel'.replace(re29, '');
-      'pngrtbel'.replace(re30, '');
-      'pybfr'.replace(re39, '');
-      'qvi'.replace(re39, '');
-      str86.replace(re68, '');
-      str86.replace(re18, '');
-      'qg'.replace(re39, '');
-      'qg'.replace(re68, '');
-      'qg'.replace(re18, '');
-      'rzorq'.replace(re39, '');
-      'rzorq'.replace(re68, '');
-      'rzorq'.replace(re18, '');
-      'svryqOga'.replace(re39, '');
-      'svryqOgaPnapry'.replace(re39, '');
-      'svz_zlfcnpr_nccf-pnainf,svz_zlfcnpr_havgrq-fgngrf'.split(re20);
-      'svanamra'.replace(re40, '');
-      'svanamra'.replace(re41, '');
-      'svanamra'.replace(re42, '');
-      'svanamra'.replace(re43, '');
-      'svanamra'.replace(re44, '');
-      'svanamra'.replace(re45, '');
-      'svanamra'.replace(re46, '');
-      'svanamra'.replace(re47, '');
-      'svanamra'.replace(re48, '');
-      'sbphf'.split(re70);
-      'sbphf.gno sbphfva.gno'.split(re70);
-      'sbphfva'.split(re70);
-      'sbez'.replace(re39, '');
-      'sbez.nwnk'.replace(re68, '');
-      'sbez.nwnk'.replace(re18, '');
-      'tnzrf'.replace(re40, '');
-      'tnzrf'.replace(re41, '');
-      'tnzrf'.replace(re42, '');
-      'tnzrf'.replace(re43, '');
-      'tnzrf'.replace(re44, '');
-      'tnzrf'.replace(re45, '');
-      'tnzrf'.replace(re46, '');
-      'tnzrf'.replace(re47, '');
-      'tnzrf'.replace(re48, '');
-      'ubzrcntr'.replace(re30, '');
-      'ubebfxbc'.replace(re40, '');
-      'ubebfxbc'.replace(re41, '');
-      'ubebfxbc'.replace(re42, '');
-      'ubebfxbc'.replace(re43, '');
-      'ubebfxbc'.replace(re44, '');
-      'ubebfxbc'.replace(re45, '');
-      'ubebfxbc'.replace(re46, '');
-      'ubebfxbc'.replace(re47, '');
-      'ubebfxbc'.replace(re48, '');
-      'uc_cebzbobk_ugzy%2Puc_cebzbobk_vzt'.replace(re30, '');
-      'uc_erpgnatyr'.replace(re30, '');
-      str87.replace(re33, '');
-      str88.replace(re33, '');
-      'uggc://wf.hv-cbegny.qr/tzk/ubzr/wf/20080602/onfr.wf${4}${5}'.replace(re71, '');
-      'uggc://wf.hv-cbegny.qr/tzk/ubzr/wf/20080602/onfr.wf${5}'.replace(re72, '');
-      'uggc://wf.hv-cbegny.qr/tzk/ubzr/wf/20080602/qlaYvo.wf${4}${5}'.replace(re71, '');
-      'uggc://wf.hv-cbegny.qr/tzk/ubzr/wf/20080602/qlaYvo.wf${5}'.replace(re72, '');
-      'uggc://wf.hv-cbegny.qr/tzk/ubzr/wf/20080602/rssrpgYvo.wf${4}${5}'.replace(re71, '');
-      'uggc://wf.hv-cbegny.qr/tzk/ubzr/wf/20080602/rssrpgYvo.wf${5}'.replace(re72, '');
-      str89.replace(re73, '');
-      'uggc://zfacbegny.112.2b7.arg/o/ff/zfacbegnyubzr/1/U.7-cqi-2/f55023338617756?[NDO]&{1}&{2}&[NDR]'.replace(re69, '');
-      str6.replace(re23, '');
-      'xvab'.replace(re40, '');
-      'xvab'.replace(re41, '');
-      'xvab'.replace(re42, '');
-      'xvab'.replace(re43, '');
-      'xvab'.replace(re44, '');
-      'xvab'.replace(re45, '');
-      'xvab'.replace(re46, '');
-      'xvab'.replace(re47, '');
-      'xvab'.replace(re48, '');
-      'ybnq'.split(re70);
-      'zrqvnzbqgno lhv-anifrg lhv-anifrg-gbc'.replace(re18, '');
-      'zrgn'.replace(re39, '');
-      str90.replace(re68, '');
-      str90.replace(re18, '');
-      'zbhfrzbir'.split(re70);
-      'zbhfrzbir.gno'.split(re70);
-      str63.replace(/^.*jroxvg\/(\d+(\.\d+)?).*$/, '');
-      'zhfvx'.replace(re40, '');
-      'zhfvx'.replace(re41, '');
-      'zhfvx'.replace(re42, '');
-      'zhfvx'.replace(re43, '');
-      'zhfvx'.replace(re44, '');
-      'zhfvx'.replace(re45, '');
-      'zhfvx'.replace(re46, '');
-      'zhfvx'.replace(re47, '');
-      'zhfvx'.replace(re48, '');
-      'zlfcnpr_nccf_pnainf'.replace(re52, '');
-      str91.replace(re40, '');
-      str91.replace(re41, '');
-      str91.replace(re42, '');
-      str91.replace(re43, '');
-      str91.replace(re44, '');
-      str91.replace(re45, '');
-      str91.replace(re46, '');
-      str91.replace(re47, '');
-      str91.replace(re48, '');
-      'anzr'.replace(re39, '');
-      str92.replace(/\b\w+\b/g, '');
-      'bow-nppbeqvba'.replace(re39, '');
-      'bowrpg'.replace(re39, '');
-      'bowrpg'.replace(re68, '');
-      'bowrpg'.replace(re18, '');
-      'cnenzf%2Rfglyrf'.replace(re29, '');
-      'cnenzf%2Rfglyrf'.replace(re30, '');
-      'cbchc'.replace(re30, '');
-      'ebhgr'.replace(re40, '');
-      'ebhgr'.replace(re41, '');
-      'ebhgr'.replace(re42, '');
-      'ebhgr'.replace(re43, '');
-      'ebhgr'.replace(re44, '');
-      'ebhgr'.replace(re45, '');
-      'ebhgr'.replace(re46, '');
-      'ebhgr'.replace(re47, '');
-      'ebhgr'.replace(re48, '');
-      'freivprobk_uc'.replace(re30, '');
-      'fubccvatobk_uc'.replace(re30, '');
-      'fubhgobk'.replace(re39, '');
-      'fcbeg'.replace(re40, '');
-      'fcbeg'.replace(re41, '');
-      'fcbeg'.replace(re42, '');
-      'fcbeg'.replace(re43, '');
-      'fcbeg'.replace(re44, '');
-      'fcbeg'.replace(re45, '');
-      'fcbeg'.replace(re46, '');
-      'fcbeg'.replace(re47, '');
-      'fcbeg'.replace(re48, '');
-      'gbhe'.replace(re40, '');
-      'gbhe'.replace(re41, '');
-      'gbhe'.replace(re42, '');
-      'gbhe'.replace(re43, '');
-      'gbhe'.replace(re44, '');
-      'gbhe'.replace(re45, '');
-      'gbhe'.replace(re46, '');
-      'gbhe'.replace(re47, '');
-      'gbhe'.replace(re48, '');
-      'gi-fcbg'.replace(re40, '');
-      'gi-fcbg'.replace(re41, '');
-      'gi-fcbg'.replace(re42, '');
-      'gi-fcbg'.replace(re43, '');
-      'gi-fcbg'.replace(re44, '');
-      'gi-fcbg'.replace(re45, '');
-      'gi-fcbg'.replace(re46, '');
-      'gi-fcbg'.replace(re47, '');
-      'gi-fcbg'.replace(re48, '');
-      'glcr'.replace(re39, '');
-      'haqrsvarq'.replace(/\//g, '');
-      str93.replace(re40, '');
-      str93.replace(re41, '');
-      str93.replace(re42, '');
-      str93.replace(re43, '');
-      str93.replace(re44, '');
-      str93.replace(re45, '');
-      str93.replace(re46, '');
-      str93.replace(re47, '');
-      str93.replace(re48, '');
-      'ivqrb'.replace(re40, '');
-      'ivqrb'.replace(re41, '');
-      'ivqrb'.replace(re42, '');
-      'ivqrb'.replace(re43, '');
-      'ivqrb'.replace(re44, '');
-      'ivqrb'.replace(re45, '');
-      'ivqrb'.replace(re46, '');
-      'ivqrb'.replace(re47, '');
-      'ivqrb'.replace(re48, '');
-      'ivfvgf=1'.split(re86);
-      'jrggre'.replace(re40, '');
-      'jrggre'.replace(re41, '');
-      'jrggre'.replace(re42, '');
-      'jrggre'.replace(re43, '');
-      'jrggre'.replace(re44, '');
-      'jrggre'.replace(re45, '');
-      'jrggre'.replace(re46, '');
-      'jrggre'.replace(re47, '');
-      'jrggre'.replace(re48, '');
-      /#[a-z0-9]+$/i.exec('uggc://jjj.fpuhryreim.arg/Qrsnhyg');
-      re66.exec('fryrpgrq');
-      /(?:^|\s+)lhv-ani(?:\s+|$)/.exec('sff lhv-ani');
-      /(?:^|\s+)lhv-anifrg(?:\s+|$)/.exec('zrqvnzbqgno lhv-anifrg');
-      /(?:^|\s+)lhv-anifrg-gbc(?:\s+|$)/.exec('zrqvnzbqgno lhv-anifrg');
-      re91.exec('GnoThvq');
-      re91.exec('thvq');
-      /(pbzcngvoyr|jroxvg)/.exec(str63);
-      /.+(?:ei|vg|en|vr)[\/: ]([\d.]+)/.exec(str63);
-      re8.exec('144631658.0.10.1231365869');
-      re8.exec('144631658.0.10.1231367054');
-      re8.exec('144631658.1231365869.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re8.exec('144631658.1231367054.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re8.exec('144631658.1670816052019209000.1231365869.1231365869.1231365869.1');
-      re8.exec('144631658.1796080716621419500.1231367054.1231367054.1231367054.1');
-      re8.exec(str94);
-      re8.exec(str95);
-      re8.exec(str96);
-      re8.exec(str97);
-      re8.exec('__hgzn=144631658.1670816052019209000.1231365869.1231365869.1231365869.1');
-      re8.exec('__hgzn=144631658.1796080716621419500.1231367054.1231367054.1231367054.1');
-      re8.exec('__hgzo=144631658.0.10.1231365869');
-      re8.exec('__hgzo=144631658.0.10.1231367054');
-      re8.exec('__hgzm=144631658.1231365869.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re8.exec('__hgzm=144631658.1231367054.1.1.hgzpfe=(qverpg)|hgzppa=(qverpg)|hgzpzq=(abar)');
-      re34.exec(str78);
-      re34.exec(str79);
-      re34.exec(str81);
-      re74.exec(str77);
-      re74.exec('*');
-      re74.exec(str82);
-      re74.exec(str83);
-      re74.exec(str86);
-      re74.exec('rzorq');
-      re74.exec('sbez.nwnk');
-      re74.exec(str90);
-      re74.exec('bowrpg');
-      /\/onfr.wf(\?.+)?$/.exec('/uggc://wf.hv-cbegny.qr/tzk/ubzr/wf/20080602/onfr.wf');
-      re28.exec('uvag ynfgUvag ynfg');
-      re75.exec('');
-      re76.exec('');
-      re77.exec('');
-      re78.exec('');
-      re80.exec(str77);
-      re80.exec('*');
-      re80.exec('.pybfr');
-      re80.exec(str82);
-      re80.exec(str83);
-      re80.exec(str84);
-      re80.exec(str86);
-      re80.exec('qg');
-      re80.exec('rzorq');
-      re80.exec('sbez.nwnk');
-      re80.exec(str90);
-      re80.exec('bowrpg');
-      re61.exec('qlaYvo.wf');
-      re61.exec('rssrpgYvo.wf');
-      re61.exec('uggc://jjj.tzk.arg/qr/?fgnghf=uvajrvf');
-      re92.exec(' .pybfr');
-      re92.exec(' n.svryqOgaPnapry');
-      re92.exec(' qg');
-      re92.exec(str48);
-      re92.exec('.nwnk');
-      re92.exec('.svryqOga,n.svryqOgaPnapry');
-      re92.exec('.svryqOgaPnapry');
-      re92.exec('.bow-nppbeqvba qg');
-      re68.exec(str77);
-      re68.exec('*');
-      re68.exec('.pybfr');
-      re68.exec(str82);
-      re68.exec(str83);
-      re68.exec(str84);
-      re68.exec(str86);
-      re68.exec('qg');
-      re68.exec('rzorq');
-      re68.exec('sbez.nwnk');
-      re68.exec(str90);
-      re68.exec('bowrpg');
-      re93.exec(' .pybfr');
-      re93.exec(' n.svryqOgaPnapry');
-      re93.exec(' qg');
-      re93.exec(str48);
-      re93.exec('.nwnk');
-      re93.exec('.svryqOga,n.svryqOgaPnapry');
-      re93.exec('.svryqOgaPnapry');
-      re93.exec('.bow-nppbeqvba qg');
-      re81.exec(str77);
-      re81.exec('*');
-      re81.exec(str48);
-      re81.exec('.pybfr');
-      re81.exec(str82);
-      re81.exec(str83);
-      re81.exec(str84);
-      re81.exec(str86);
-      re81.exec('qg');
-      re81.exec('rzorq');
-      re81.exec('sbez.nwnk');
-      re81.exec(str90);
-      re81.exec('bowrpg');
-      re94.exec(' .pybfr');
-      re94.exec(' n.svryqOgaPnapry');
-      re94.exec(' qg');
-      re94.exec(str48);
-      re94.exec('.nwnk');
-      re94.exec('.svryqOga,n.svryqOgaPnapry');
-      re94.exec('.svryqOgaPnapry');
-      re94.exec('.bow-nppbeqvba qg');
-      re94.exec('[anzr=nwnkHey]');
-      re94.exec(str82);
-      re31.exec('rf');
-      re31.exec('wn');
-      re82.exec(str77);
-      re82.exec('*');
-      re82.exec(str48);
-      re82.exec('.pybfr');
-      re82.exec(str82);
-      re82.exec(str83);
-      re82.exec(str84);
-      re82.exec(str86);
-      re82.exec('qg');
-      re82.exec('rzorq');
-      re82.exec('sbez.nwnk');
-      re82.exec(str90);
-      re82.exec('bowrpg');
-      re83.exec(str98);
-      re83.exec('shapgvba sbphf() { [angvir pbqr] }');
-      re62.exec('#Ybtva');
-      re62.exec('#Ybtva_cnffjbeq');
-      re62.exec(str77);
-      re62.exec('#fubhgobkWf');
-      re62.exec('#fubhgobkWfReebe');
-      re62.exec('#fubhgobkWfFhpprff');
-      re62.exec('*');
-      re62.exec(str82);
-      re62.exec(str83);
-      re62.exec(str86);
-      re62.exec('rzorq');
-      re62.exec('sbez.nwnk');
-      re62.exec(str90);
-      re62.exec('bowrpg');
-      re49.exec('pbagrag');
-      re24.exec(str6);
-      /xbadhrebe/.exec(str63);
-      /znp/.exec('jva32');
-      /zbmvyyn/.exec(str63);
-      /zfvr/.exec(str63);
-      /ag\s5\.1/.exec(str63);
-      /bcren/.exec(str63);
-      /fnsnev/.exec(str63);
-      /jva/.exec('jva32');
-      /jvaqbjf/.exec(str63);
-    }
-  }
-
-  function run() {
-    for (var i = 0; i < 5; i++) {
-      runBlock0();
-      runBlock1();
-      runBlock2();
-      runBlock3();
-      runBlock4();
-      runBlock5();
-      runBlock6();
-      runBlock7();
-      runBlock8();
-      runBlock9();
-      runBlock10();
-      runBlock11();
-    }
-  }
-
-  this.run = run;
-}
diff --git a/deps/v8/benchmarks/revisions.html b/deps/v8/benchmarks/revisions.html
deleted file mode 100644
index 3ce9889592f1cc..00000000000000
--- a/deps/v8/benchmarks/revisions.html
+++ /dev/null
@@ -1,104 +0,0 @@
-<html>
-<head>
-<title>V8 Benchmark Suite Revisions</title>
-<link type="text/css" rel="stylesheet" href="style.css" />
-</head>
-<body>
-<div>
-  <div class="title"><h1>V8 Benchmark Suite Revisions</h1></div>
-  <table>
-    <tr>
-      <td class="contents">
-
-<p>
-
-The V8 benchmark suite is changed from time to time as we fix bugs or
-expand the scope of the benchmarks.  Here is a list of revisions, with
-a description of the changes made.  Note that benchmark results are
-not comparable unless both results are run with the same revision of
-the benchmark suite.
-
-</p>
-<div class="subtitle"><h3>Version 7 (<a href="http://v8.googlecode.com/svn/data/benchmarks/v7/run.html">link</a>)</h3></div>
-
-<p>This version includes the new Navier-Stokes benchmark, a 2D differential
- equation solver that stresses arithmetic computations on double arrays.</p>
-
-<div class="subtitle"><h3>Version 6 (<a href="http://v8.googlecode.com/svn/data/benchmarks/v6/run.html">link</a>)</h3></div>
-
-<p>Removed dead code from the RayTrace benchmark and fixed a couple of
-typos in the DeltaBlue implementation. Changed the Splay benchmark to
-avoid converting the same numeric key to a string over and over again
-and to avoid inserting and removing the same element repeatedly thus
-increasing pressure on the memory subsystem. Changed the RegExp
-benchmark to exercise the regular expression engine on different input
-strings.</p>
-
-<p>Furthermore, the benchmark runner was changed to run the benchmarks
-for at least a few times to stabilize the reported numbers on slower
-machines.</p>
-
-<div class="subtitle"><h3>Version 5 (<a href="http://v8.googlecode.com/svn/data/benchmarks/v5/run.html">link</a>)</h3></div>
-
-<p>Removed duplicate line in random seed code, and changed the name of
-the Object.prototype.inherits function in the DeltaBlue benchmark to
-inheritsFrom to avoid name clashes when running in Chromium with
-extensions enabled.
-</p>
-
-<div class="subtitle"><h3>Version 4 (<a href="http://v8.googlecode.com/svn/data/benchmarks/v4/run.html">link</a>)</h3></div>
-
-<p>The <i>Splay</i> benchmark is a newcomer in version 4.  It
-manipulates a splay tree by adding and removing data nodes, thus
-exercising the memory management subsystem of the JavaScript engine.
-</p>
-
-<p>
-Furthermore, all the unused parts of the Prototype library were
-removed from the RayTrace benchmark. This does not affect the running
-of the benchmark.
-</p>
-
-
-<div class="subtitle"><h3>Version 3 (<a href="http://v8.googlecode.com/svn/data/benchmarks/v3/run.html">link</a>)</h3></div>
-
-<p>Version 3 adds a new benchmark, <i>RegExp</i>.  The RegExp
-benchmark is generated by loading 50 of the most popular pages on the
-web and logging all regexp operations performed.  Each operation is
-given a weight that is calculated from an estimate of the popularity
-of the pages where it occurs and the number of times it is executed
-while loading each page.  Finally the literal letters in the data are
-encoded using ROT13 in a way that does not affect how the regexps
-match their input.
-</p>
-
-
-<div class="subtitle"><h3>Version 2 (<a href="http://v8.googlecode.com/svn/data/benchmarks/v2/run.html">link</a>)</h3></div>
-
-<p>For version 2 the Crypto benchmark was fixed.  Previously, the
-decryption stage was given plaintext as input, which resulted in an
-error.  Now, the decryption stage is given the output of the
-encryption stage as input.  The result is checked against the original
-plaintext.  For this to give the correct results the crypto objects
-are reset for each iteration of the benchmark.  In addition, the size
-of the plain text has been increased a little and the use of
-Math.random() and new Date() to build an RNG pool has been
-removed. </p>
-
-<p>Other benchmarks were fixed to do elementary verification of the
-results of their calculations.  This is to avoid accidentally
-obtaining scores that are the result of an incorrect JavaScript engine
-optimization.</p>
-
-
-<div class="subtitle"><h3>Version 1 (<a href="http://v8.googlecode.com/svn/data/benchmarks/v1/run.html">link</a>)</h3></div>
-
-<p>Initial release.</p>
-
-</td><td style="text-align: center">
-</td></tr></table>
-
-</div>
-
-</body>
-</html>
diff --git a/deps/v8/benchmarks/richards.js b/deps/v8/benchmarks/richards.js
deleted file mode 100644
index 054928db16f8f2..00000000000000
--- a/deps/v8/benchmarks/richards.js
+++ /dev/null
@@ -1,539 +0,0 @@
-// Copyright 2006-2008 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-// This is a JavaScript implementation of the Richards
-// benchmark from:
-//
-//    http://www.cl.cam.ac.uk/~mr10/Bench.html
-//
-// The benchmark was originally implemented in BCPL by
-// Martin Richards.
-
-
-var Richards = new BenchmarkSuite('Richards', 35302, [
-  new Benchmark("Richards", runRichards)
-]);
-
-
-/**
- * The Richards benchmark simulates the task dispatcher of an
- * operating system.
- **/
-function runRichards() {
-  var scheduler = new Scheduler();
-  scheduler.addIdleTask(ID_IDLE, 0, null, COUNT);
-
-  var queue = new Packet(null, ID_WORKER, KIND_WORK);
-  queue = new Packet(queue,  ID_WORKER, KIND_WORK);
-  scheduler.addWorkerTask(ID_WORKER, 1000, queue);
-
-  queue = new Packet(null, ID_DEVICE_A, KIND_DEVICE);
-  queue = new Packet(queue,  ID_DEVICE_A, KIND_DEVICE);
-  queue = new Packet(queue,  ID_DEVICE_A, KIND_DEVICE);
-  scheduler.addHandlerTask(ID_HANDLER_A, 2000, queue);
-
-  queue = new Packet(null, ID_DEVICE_B, KIND_DEVICE);
-  queue = new Packet(queue,  ID_DEVICE_B, KIND_DEVICE);
-  queue = new Packet(queue,  ID_DEVICE_B, KIND_DEVICE);
-  scheduler.addHandlerTask(ID_HANDLER_B, 3000, queue);
-
-  scheduler.addDeviceTask(ID_DEVICE_A, 4000, null);
-
-  scheduler.addDeviceTask(ID_DEVICE_B, 5000, null);
-
-  scheduler.schedule();
-
-  if (scheduler.queueCount != EXPECTED_QUEUE_COUNT ||
-      scheduler.holdCount != EXPECTED_HOLD_COUNT) {
-    var msg =
-        "Error during execution: queueCount = " + scheduler.queueCount +
-        ", holdCount = " + scheduler.holdCount + ".";
-    throw new Error(msg);
-  }
-}
-
-var COUNT = 1000;
-
-/**
- * These two constants specify how many times a packet is queued and
- * how many times a task is put on hold in a correct run of richards.
- * They don't have any meaning a such but are characteristic of a
- * correct run so if the actual queue or hold count is different from
- * the expected there must be a bug in the implementation.
- **/
-var EXPECTED_QUEUE_COUNT = 2322;
-var EXPECTED_HOLD_COUNT = 928;
-
-
-/**
- * A scheduler can be used to schedule a set of tasks based on their relative
- * priorities.  Scheduling is done by maintaining a list of task control blocks
- * which holds tasks and the data queue they are processing.
- * @constructor
- */
-function Scheduler() {
-  this.queueCount = 0;
-  this.holdCount = 0;
-  this.blocks = new Array(NUMBER_OF_IDS);
-  this.list = null;
-  this.currentTcb = null;
-  this.currentId = null;
-}
-
-var ID_IDLE       = 0;
-var ID_WORKER     = 1;
-var ID_HANDLER_A  = 2;
-var ID_HANDLER_B  = 3;
-var ID_DEVICE_A   = 4;
-var ID_DEVICE_B   = 5;
-var NUMBER_OF_IDS = 6;
-
-var KIND_DEVICE   = 0;
-var KIND_WORK     = 1;
-
-/**
- * Add an idle task to this scheduler.
- * @param {int} id the identity of the task
- * @param {int} priority the task's priority
- * @param {Packet} queue the queue of work to be processed by the task
- * @param {int} count the number of times to schedule the task
- */
-Scheduler.prototype.addIdleTask = function (id, priority, queue, count) {
-  this.addRunningTask(id, priority, queue, new IdleTask(this, 1, count));
-};
-
-/**
- * Add a work task to this scheduler.
- * @param {int} id the identity of the task
- * @param {int} priority the task's priority
- * @param {Packet} queue the queue of work to be processed by the task
- */
-Scheduler.prototype.addWorkerTask = function (id, priority, queue) {
-  this.addTask(id, priority, queue, new WorkerTask(this, ID_HANDLER_A, 0));
-};
-
-/**
- * Add a handler task to this scheduler.
- * @param {int} id the identity of the task
- * @param {int} priority the task's priority
- * @param {Packet} queue the queue of work to be processed by the task
- */
-Scheduler.prototype.addHandlerTask = function (id, priority, queue) {
-  this.addTask(id, priority, queue, new HandlerTask(this));
-};
-
-/**
- * Add a handler task to this scheduler.
- * @param {int} id the identity of the task
- * @param {int} priority the task's priority
- * @param {Packet} queue the queue of work to be processed by the task
- */
-Scheduler.prototype.addDeviceTask = function (id, priority, queue) {
-  this.addTask(id, priority, queue, new DeviceTask(this))
-};
-
-/**
- * Add the specified task and mark it as running.
- * @param {int} id the identity of the task
- * @param {int} priority the task's priority
- * @param {Packet} queue the queue of work to be processed by the task
- * @param {Task} task the task to add
- */
-Scheduler.prototype.addRunningTask = function (id, priority, queue, task) {
-  this.addTask(id, priority, queue, task);
-  this.currentTcb.setRunning();
-};
-
-/**
- * Add the specified task to this scheduler.
- * @param {int} id the identity of the task
- * @param {int} priority the task's priority
- * @param {Packet} queue the queue of work to be processed by the task
- * @param {Task} task the task to add
- */
-Scheduler.prototype.addTask = function (id, priority, queue, task) {
-  this.currentTcb = new TaskControlBlock(this.list, id, priority, queue, task);
-  this.list = this.currentTcb;
-  this.blocks[id] = this.currentTcb;
-};
-
-/**
- * Execute the tasks managed by this scheduler.
- */
-Scheduler.prototype.schedule = function () {
-  this.currentTcb = this.list;
-  while (this.currentTcb != null) {
-    if (this.currentTcb.isHeldOrSuspended()) {
-      this.currentTcb = this.currentTcb.link;
-    } else {
-      this.currentId = this.currentTcb.id;
-      this.currentTcb = this.currentTcb.run();
-    }
-  }
-};
-
-/**
- * Release a task that is currently blocked and return the next block to run.
- * @param {int} id the id of the task to suspend
- */
-Scheduler.prototype.release = function (id) {
-  var tcb = this.blocks[id];
-  if (tcb == null) return tcb;
-  tcb.markAsNotHeld();
-  if (tcb.priority > this.currentTcb.priority) {
-    return tcb;
-  } else {
-    return this.currentTcb;
-  }
-};
-
-/**
- * Block the currently executing task and return the next task control block
- * to run.  The blocked task will not be made runnable until it is explicitly
- * released, even if new work is added to it.
- */
-Scheduler.prototype.holdCurrent = function () {
-  this.holdCount++;
-  this.currentTcb.markAsHeld();
-  return this.currentTcb.link;
-};
-
-/**
- * Suspend the currently executing task and return the next task control block
- * to run.  If new work is added to the suspended task it will be made runnable.
- */
-Scheduler.prototype.suspendCurrent = function () {
-  this.currentTcb.markAsSuspended();
-  return this.currentTcb;
-};
-
-/**
- * Add the specified packet to the end of the worklist used by the task
- * associated with the packet and make the task runnable if it is currently
- * suspended.
- * @param {Packet} packet the packet to add
- */
-Scheduler.prototype.queue = function (packet) {
-  var t = this.blocks[packet.id];
-  if (t == null) return t;
-  this.queueCount++;
-  packet.link = null;
-  packet.id = this.currentId;
-  return t.checkPriorityAdd(this.currentTcb, packet);
-};
-
-/**
- * A task control block manages a task and the queue of work packages associated
- * with it.
- * @param {TaskControlBlock} link the preceding block in the linked block list
- * @param {int} id the id of this block
- * @param {int} priority the priority of this block
- * @param {Packet} queue the queue of packages to be processed by the task
- * @param {Task} task the task
- * @constructor
- */
-function TaskControlBlock(link, id, priority, queue, task) {
-  this.link = link;
-  this.id = id;
-  this.priority = priority;
-  this.queue = queue;
-  this.task = task;
-  if (queue == null) {
-    this.state = STATE_SUSPENDED;
-  } else {
-    this.state = STATE_SUSPENDED_RUNNABLE;
-  }
-}
-
-/**
- * The task is running and is currently scheduled.
- */
-var STATE_RUNNING = 0;
-
-/**
- * The task has packets left to process.
- */
-var STATE_RUNNABLE = 1;
-
-/**
- * The task is not currently running.  The task is not blocked as such and may
-* be started by the scheduler.
- */
-var STATE_SUSPENDED = 2;
-
-/**
- * The task is blocked and cannot be run until it is explicitly released.
- */
-var STATE_HELD = 4;
-
-var STATE_SUSPENDED_RUNNABLE = STATE_SUSPENDED | STATE_RUNNABLE;
-var STATE_NOT_HELD = ~STATE_HELD;
-
-TaskControlBlock.prototype.setRunning = function () {
-  this.state = STATE_RUNNING;
-};
-
-TaskControlBlock.prototype.markAsNotHeld = function () {
-  this.state = this.state & STATE_NOT_HELD;
-};
-
-TaskControlBlock.prototype.markAsHeld = function () {
-  this.state = this.state | STATE_HELD;
-};
-
-TaskControlBlock.prototype.isHeldOrSuspended = function () {
-  return (this.state & STATE_HELD) != 0 || (this.state == STATE_SUSPENDED);
-};
-
-TaskControlBlock.prototype.markAsSuspended = function () {
-  this.state = this.state | STATE_SUSPENDED;
-};
-
-TaskControlBlock.prototype.markAsRunnable = function () {
-  this.state = this.state | STATE_RUNNABLE;
-};
-
-/**
- * Runs this task, if it is ready to be run, and returns the next task to run.
- */
-TaskControlBlock.prototype.run = function () {
-  var packet;
-  if (this.state == STATE_SUSPENDED_RUNNABLE) {
-    packet = this.queue;
-    this.queue = packet.link;
-    if (this.queue == null) {
-      this.state = STATE_RUNNING;
-    } else {
-      this.state = STATE_RUNNABLE;
-    }
-  } else {
-    packet = null;
-  }
-  return this.task.run(packet);
-};
-
-/**
- * Adds a packet to the worklist of this block's task, marks this as runnable if
- * necessary, and returns the next runnable object to run (the one
- * with the highest priority).
- */
-TaskControlBlock.prototype.checkPriorityAdd = function (task, packet) {
-  if (this.queue == null) {
-    this.queue = packet;
-    this.markAsRunnable();
-    if (this.priority > task.priority) return this;
-  } else {
-    this.queue = packet.addTo(this.queue);
-  }
-  return task;
-};
-
-TaskControlBlock.prototype.toString = function () {
-  return "tcb { " + this.task + "@" + this.state + " }";
-};
-
-/**
- * An idle task doesn't do any work itself but cycles control between the two
- * device tasks.
- * @param {Scheduler} scheduler the scheduler that manages this task
- * @param {int} v1 a seed value that controls how the device tasks are scheduled
- * @param {int} count the number of times this task should be scheduled
- * @constructor
- */
-function IdleTask(scheduler, v1, count) {
-  this.scheduler = scheduler;
-  this.v1 = v1;
-  this.count = count;
-}
-
-IdleTask.prototype.run = function (packet) {
-  this.count--;
-  if (this.count == 0) return this.scheduler.holdCurrent();
-  if ((this.v1 & 1) == 0) {
-    this.v1 = this.v1 >> 1;
-    return this.scheduler.release(ID_DEVICE_A);
-  } else {
-    this.v1 = (this.v1 >> 1) ^ 0xD008;
-    return this.scheduler.release(ID_DEVICE_B);
-  }
-};
-
-IdleTask.prototype.toString = function () {
-  return "IdleTask"
-};
-
-/**
- * A task that suspends itself after each time it has been run to simulate
- * waiting for data from an external device.
- * @param {Scheduler} scheduler the scheduler that manages this task
- * @constructor
- */
-function DeviceTask(scheduler) {
-  this.scheduler = scheduler;
-  this.v1 = null;
-}
-
-DeviceTask.prototype.run = function (packet) {
-  if (packet == null) {
-    if (this.v1 == null) return this.scheduler.suspendCurrent();
-    var v = this.v1;
-    this.v1 = null;
-    return this.scheduler.queue(v);
-  } else {
-    this.v1 = packet;
-    return this.scheduler.holdCurrent();
-  }
-};
-
-DeviceTask.prototype.toString = function () {
-  return "DeviceTask";
-};
-
-/**
- * A task that manipulates work packets.
- * @param {Scheduler} scheduler the scheduler that manages this task
- * @param {int} v1 a seed used to specify how work packets are manipulated
- * @param {int} v2 another seed used to specify how work packets are manipulated
- * @constructor
- */
-function WorkerTask(scheduler, v1, v2) {
-  this.scheduler = scheduler;
-  this.v1 = v1;
-  this.v2 = v2;
-}
-
-WorkerTask.prototype.run = function (packet) {
-  if (packet == null) {
-    return this.scheduler.suspendCurrent();
-  } else {
-    if (this.v1 == ID_HANDLER_A) {
-      this.v1 = ID_HANDLER_B;
-    } else {
-      this.v1 = ID_HANDLER_A;
-    }
-    packet.id = this.v1;
-    packet.a1 = 0;
-    for (var i = 0; i < DATA_SIZE; i++) {
-      this.v2++;
-      if (this.v2 > 26) this.v2 = 1;
-      packet.a2[i] = this.v2;
-    }
-    return this.scheduler.queue(packet);
-  }
-};
-
-WorkerTask.prototype.toString = function () {
-  return "WorkerTask";
-};
-
-/**
- * A task that manipulates work packets and then suspends itself.
- * @param {Scheduler} scheduler the scheduler that manages this task
- * @constructor
- */
-function HandlerTask(scheduler) {
-  this.scheduler = scheduler;
-  this.v1 = null;
-  this.v2 = null;
-}
-
-HandlerTask.prototype.run = function (packet) {
-  if (packet != null) {
-    if (packet.kind == KIND_WORK) {
-      this.v1 = packet.addTo(this.v1);
-    } else {
-      this.v2 = packet.addTo(this.v2);
-    }
-  }
-  if (this.v1 != null) {
-    var count = this.v1.a1;
-    var v;
-    if (count < DATA_SIZE) {
-      if (this.v2 != null) {
-        v = this.v2;
-        this.v2 = this.v2.link;
-        v.a1 = this.v1.a2[count];
-        this.v1.a1 = count + 1;
-        return this.scheduler.queue(v);
-      }
-    } else {
-      v = this.v1;
-      this.v1 = this.v1.link;
-      return this.scheduler.queue(v);
-    }
-  }
-  return this.scheduler.suspendCurrent();
-};
-
-HandlerTask.prototype.toString = function () {
-  return "HandlerTask";
-};
-
-/* --- *
- * P a c k e t
- * --- */
-
-var DATA_SIZE = 4;
-
-/**
- * A simple package of data that is manipulated by the tasks.  The exact layout
- * of the payload data carried by a packet is not importaint, and neither is the
- * nature of the work performed on packets by the tasks.
- *
- * Besides carrying data, packets form linked lists and are hence used both as
- * data and worklists.
- * @param {Packet} link the tail of the linked list of packets
- * @param {int} id an ID for this packet
- * @param {int} kind the type of this packet
- * @constructor
- */
-function Packet(link, id, kind) {
-  this.link = link;
-  this.id = id;
-  this.kind = kind;
-  this.a1 = 0;
-  this.a2 = new Array(DATA_SIZE);
-}
-
-/**
- * Add this packet to the end of a worklist, and return the worklist.
- * @param {Packet} queue the worklist to add this packet to
- */
-Packet.prototype.addTo = function (queue) {
-  this.link = null;
-  if (queue == null) return this;
-  var peek, next = queue;
-  while ((peek = next.link) != null)
-    next = peek;
-  next.link = this;
-  return queue;
-};
-
-Packet.prototype.toString = function () {
-  return "Packet";
-};
diff --git a/deps/v8/benchmarks/run.html b/deps/v8/benchmarks/run.html
deleted file mode 100644
index f1d14c1887b244..00000000000000
--- a/deps/v8/benchmarks/run.html
+++ /dev/null
@@ -1,143 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"
-  "http://www.w3.org/TR/html4/strict.dtd">
-<html lang="en">
-<head>
-<meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
-<meta http-equiv="Content-Script-Type" content="text/javascript">
-<meta http-equiv="Content-Style-Type" content="text/css">
-<title>V8 Benchmark Suite</title>
-<script type="text/javascript" src="base.js"></script>
-<script type="text/javascript" src="richards.js"></script>
-<script type="text/javascript" src="deltablue.js"></script>
-<script type="text/javascript" src="crypto.js"></script>
-<script type="text/javascript" src="raytrace.js"></script>
-<script type="text/javascript" src="earley-boyer.js"></script>
-<script type="text/javascript" src="regexp.js"></script>
-<script type="text/javascript" src="splay.js"></script>
-<script type="text/javascript" src="navier-stokes.js"></script>
-<link type="text/css" rel="stylesheet" href="style.css" />
-<script type="text/javascript">
-var completed = 0;
-var benchmarks = BenchmarkSuite.CountBenchmarks();
-var success = true;
-
-function ShowProgress(name) {
-  var status = document.getElementById("status");
-  var percentage = ((++completed) / benchmarks) * 100;
-  status.innerHTML = "Running: " + Math.round(percentage) + "% completed.";
-}
-
-
-function AddResult(name, result) {
-  var text = name + ': ' + result;
-  var results = document.getElementById("results");
-  results.innerHTML += (text + "<br>");
-}
-
-
-function AddError(name, error) {
-  AddResult(name, '<b>error<\/b>');
-  success = false;
-}
-
-
-function AddScore(score) {
-  var status = document.getElementById("status");
-  if (success) {
-    status.innerHTML = "Score: " + score;
-  }
-}
-
-
-function Run() {
-  BenchmarkSuite.RunSuites({ NotifyStep: ShowProgress,
-                             NotifyError: AddError,
-                             NotifyResult: AddResult,
-                             NotifyScore: AddScore });
-}
-
-function ShowWarningIfObsolete() {
-  // If anything goes wrong we will just catch the exception and no
-  // warning is shown, i.e., no harm is done.
-  try {
-    var xmlhttp;
-    var next_version = parseInt(BenchmarkSuite.version) + 1;
-    var next_version_url = "../v" + next_version + "/run.html";
-    if (window.XMLHttpRequest) {
-      xmlhttp = new window.XMLHttpRequest();
-    } else if (window.ActiveXObject) {
-      xmlhttp = new window.ActiveXObject("Microsoft.XMLHTTP");
-    }
-    xmlhttp.open('GET', next_version_url, true);
-    xmlhttp.onreadystatechange = function() {
-      if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
-        document.getElementById('obsolete').style.display="block";
-      }
-    };
-    xmlhttp.send(null);
-  } catch(e) {
-    // Ignore exception if check for next version fails.
-    // Hence no warning is displayed.
-  }
-}
-
-function Load() {
-  var version = BenchmarkSuite.version;
-  document.getElementById("version").innerHTML = version;
-  ShowWarningIfObsolete();
-  setTimeout(Run, 200);
-}
-</script>
-</head>
-<body onload="Load()">
-<div>
-  <div class="title"><h1>V8 Benchmark Suite - version <span id="version">?</span></h1></div>
-  <div class="warning" id="obsolete">
-Warning! This is not the latest version of the V8 benchmark
-suite. Consider running the
-<a href="http://v8.googlecode.com/svn/data/benchmarks/current/run.html">
-latest version</a>.
-  </div>
-  <table>
-    <tr>
-      <td class="contents">
-This page contains a suite of pure JavaScript benchmarks that we have
-used to tune V8. The final score is computed as the geometric mean of
-the individual results to make it independent of the running times of
-the individual benchmarks and of a reference system (score
-100). Scores are not comparable across benchmark suite versions and
-higher scores means better performance: <em>Bigger is better!</em>
-
-<ul>
-<li><b>Richards</b><br>OS kernel simulation benchmark, originally written in BCPL by Martin Richards (<i>539 lines</i>).</li>
-<li><b>DeltaBlue</b><br>One-way constraint solver, originally written in Smalltalk by John Maloney and Mario Wolczko (<i>880 lines</i>).</li>
-<li><b>Crypto</b><br>Encryption and decryption benchmark based on code by Tom Wu (<i>1698 lines</i>).</li>
-<li><b>RayTrace</b><br>Ray tracer benchmark based on code by <a href="http://flog.co.nz/">Adam Burmister</a> (<i>904 lines</i>).</li>
-<li><b>EarleyBoyer</b><br>Classic Scheme benchmarks, translated to JavaScript by Florian Loitsch's Scheme2Js compiler (<i>4684 lines</i>).</li>
-<li><b>RegExp</b><br>Regular expression benchmark generated by extracting regular expression operations from 50 of the most popular web pages
-(<i>1761 lines</i>).
-</li>
-<li><b>Splay</b><br>Data manipulation benchmark that deals with splay trees and exercises the automatic memory management subsystem (<i>394 lines</i>).</li>
-<li><b>NavierStokes</b><br>Solves NavierStokes equations in 2D, heavily manipulating double precision arrays. Based on Oliver Hunt's code (<i>387 lines</i>).</li>
-</ul>
-
-<p>
-Note that benchmark results are not comparable unless both results are
-run with the same revision of the benchmark suite.  We will be making
-revisions from time to time in order to fix bugs or expand the scope
-of the benchmark suite.  For previous revisions and the change log see
-the <a href="http://v8.googlecode.com/svn/data/benchmarks/current/revisions.html">revisions</a> page.
-</p>
-
-</td><td style="text-align: center">
-<div class="run">
-  <div id="status">Starting...</div>
-  <div id="results">
-  </div>
-</div>
-</td></tr></table>
-
-</div>
-
-</body>
-</html>
diff --git a/deps/v8/benchmarks/run.js b/deps/v8/benchmarks/run.js
deleted file mode 100644
index 58f62658009eac..00000000000000
--- a/deps/v8/benchmarks/run.js
+++ /dev/null
@@ -1,62 +0,0 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-load('base.js');
-load('richards.js');
-load('deltablue.js');
-load('crypto.js');
-load('raytrace.js');
-load('earley-boyer.js');
-load('regexp.js');
-load('splay.js');
-load('navier-stokes.js');
-
-var success = true;
-
-function PrintResult(name, result) {
-  print(name + ': ' + result);
-}
-
-
-function PrintError(name, error) {
-  PrintResult(name, error);
-  success = false;
-}
-
-
-function PrintScore(score) {
-  if (success) {
-    print('----');
-    print('Score (version ' + BenchmarkSuite.version + '): ' + score);
-  }
-}
-
-
-BenchmarkSuite.RunSuites({ NotifyResult: PrintResult,
-                           NotifyError: PrintError,
-                           NotifyScore: PrintScore });
diff --git a/deps/v8/benchmarks/spinning-balls/index.html b/deps/v8/benchmarks/spinning-balls/index.html
deleted file mode 100644
index d01f31f3730893..00000000000000
--- a/deps/v8/benchmarks/spinning-balls/index.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<html>
-<head>
-  <style>
-    body { text-align: center; }
-  </style>
-</head>
-<body>
-  <script type="text/javascript" src="splay-tree.js"></script>
-  <script type="text/javascript" src="v.js"></script>
-</body>
-</html>
diff --git a/deps/v8/benchmarks/spinning-balls/splay-tree.js b/deps/v8/benchmarks/spinning-balls/splay-tree.js
deleted file mode 100644
index a88e4cbce1602b..00000000000000
--- a/deps/v8/benchmarks/spinning-balls/splay-tree.js
+++ /dev/null
@@ -1,326 +0,0 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-/**
- * Constructs a Splay tree.  A splay tree is a self-balancing binary
- * search tree with the additional property that recently accessed
- * elements are quick to access again. It performs basic operations
- * such as insertion, look-up and removal in O(log(n)) amortized time.
- *
- * @constructor
- */
-function SplayTree() {
-};
-
-
-/**
- * Pointer to the root node of the tree.
- *
- * @type {SplayTree.Node}
- * @private
- */
-SplayTree.prototype.root_ = null;
-
-
-/**
- * @return {boolean} Whether the tree is empty.
- */
-SplayTree.prototype.isEmpty = function() {
-  return !this.root_;
-};
-
-
-/**
- * Inserts a node into the tree with the specified key and value if
- * the tree does not already contain a node with the specified key. If
- * the value is inserted, it becomes the root of the tree.
- *
- * @param {number} key Key to insert into the tree.
- * @param {*} value Value to insert into the tree.
- */
-SplayTree.prototype.insert = function(key, value) {
-  if (this.isEmpty()) {
-    this.root_ = new SplayTree.Node(key, value);
-    return;
-  }
-  // Splay on the key to move the last node on the search path for
-  // the key to the root of the tree.
-  this.splay_(key);
-  if (this.root_.key == key) {
-    return;
-  }
-  var node = new SplayTree.Node(key, value);
-  if (key > this.root_.key) {
-    node.left = this.root_;
-    node.right = this.root_.right;
-    this.root_.right = null;
-  } else {
-    node.right = this.root_;
-    node.left = this.root_.left;
-    this.root_.left = null;
-  }
-  this.root_ = node;
-};
-
-
-/**
- * Removes a node with the specified key from the tree if the tree
- * contains a node with this key. The removed node is returned. If the
- * key is not found, an exception is thrown.
- *
- * @param {number} key Key to find and remove from the tree.
- * @return {SplayTree.Node} The removed node.
- */
-SplayTree.prototype.remove = function(key) {
-  if (this.isEmpty()) {
-    throw Error('Key not found: ' + key);
-  }
-  this.splay_(key);
-  if (this.root_.key != key) {
-    throw Error('Key not found: ' + key);
-  }
-  var removed = this.root_;
-  if (!this.root_.left) {
-    this.root_ = this.root_.right;
-  } else {
-    var right = this.root_.right;
-    this.root_ = this.root_.left;
-    // Splay to make sure that the new root has an empty right child.
-    this.splay_(key);
-    // Insert the original right child as the right child of the new
-    // root.
-    this.root_.right = right;
-  }
-  return removed;
-};
-
-
-/**
- * Returns the node having the specified key or null if the tree doesn't contain
- * a node with the specified key.
- *
- * @param {number} key Key to find in the tree.
- * @return {SplayTree.Node} Node having the specified key.
- */
-SplayTree.prototype.find = function(key) {
-  if (this.isEmpty()) {
-    return null;
-  }
-  this.splay_(key);
-  return this.root_.key == key ? this.root_ : null;
-};
-
-
-/**
- * @return {SplayTree.Node} Node having the maximum key value.
- */
-SplayTree.prototype.findMax = function(opt_startNode) {
-  if (this.isEmpty()) {
-    return null;
-  }
-  var current = opt_startNode || this.root_;
-  while (current.right) {
-    current = current.right;
-  }
-  return current;
-};
-
-
-/**
- * @return {SplayTree.Node} Node having the maximum key value that
- *     is less than the specified key value.
- */
-SplayTree.prototype.findGreatestLessThan = function(key) {
-  if (this.isEmpty()) {
-    return null;
-  }
-  // Splay on the key to move the node with the given key or the last
-  // node on the search path to the top of the tree.
-  this.splay_(key);
-  // Now the result is either the root node or the greatest node in
-  // the left subtree.
-  if (this.root_.key < key) {
-    return this.root_;
-  } else if (this.root_.left) {
-    return this.findMax(this.root_.left);
-  } else {
-    return null;
-  }
-};
-
-
-/**
- * @return {Array<*>} An array containing all the keys of tree's nodes.
- */
-SplayTree.prototype.exportKeys = function() {
-  var result = [];
-  if (!this.isEmpty()) {
-    this.root_.traverse_(function(node) { result.push(node.key); });
-  }
-  return result;
-};
-
-
-/**
- * Perform the splay operation for the given key. Moves the node with
- * the given key to the top of the tree.  If no node has the given
- * key, the last node on the search path is moved to the top of the
- * tree. This is the simplified top-down splaying algorithm from:
- * "Self-adjusting Binary Search Trees" by Sleator and Tarjan
- *
- * @param {number} key Key to splay the tree on.
- * @private
- */
-SplayTree.prototype.splay_ = function(key) {
-  if (this.isEmpty()) {
-    return;
-  }
-  // Create a dummy node.  The use of the dummy node is a bit
-  // counter-intuitive: The right child of the dummy node will hold
-  // the L tree of the algorithm.  The left child of the dummy node
-  // will hold the R tree of the algorithm.  Using a dummy node, left
-  // and right will always be nodes and we avoid special cases.
-  var dummy, left, right;
-  dummy = left = right = new SplayTree.Node(null, null);
-  var current = this.root_;
-  while (true) {
-    if (key < current.key) {
-      if (!current.left) {
-        break;
-      }
-      if (key < current.left.key) {
-        // Rotate right.
-        var tmp = current.left;
-        current.left = tmp.right;
-        tmp.right = current;
-        current = tmp;
-        if (!current.left) {
-          break;
-        }
-      }
-      // Link right.
-      right.left = current;
-      right = current;
-      current = current.left;
-    } else if (key > current.key) {
-      if (!current.right) {
-        break;
-      }
-      if (key > current.right.key) {
-        // Rotate left.
-        var tmp = current.right;
-        current.right = tmp.left;
-        tmp.left = current;
-        current = tmp;
-        if (!current.right) {
-          break;
-        }
-      }
-      // Link left.
-      left.right = current;
-      left = current;
-      current = current.right;
-    } else {
-      break;
-    }
-  }
-  // Assemble.
-  left.right = current.left;
-  right.left = current.right;
-  current.left = dummy.right;
-  current.right = dummy.left;
-  this.root_ = current;
-};
-
-
-/**
- * Constructs a Splay tree node.
- *
- * @param {number} key Key.
- * @param {*} value Value.
- */
-SplayTree.Node = function(key, value) {
-  this.key = key;
-  this.value = value;
-};
-
-
-/**
- * @type {SplayTree.Node}
- */
-SplayTree.Node.prototype.left = null;
-
-
-/**
- * @type {SplayTree.Node}
- */
-SplayTree.Node.prototype.right = null;
-
-
-/**
- * Performs an ordered traversal of the subtree starting at
- * this SplayTree.Node.
- *
- * @param {function(SplayTree.Node)} f Visitor function.
- * @private
- */
-SplayTree.Node.prototype.traverse_ = function(f) {
-  var current = this;
-  while (current) {
-    var left = current.left;
-    if (left) left.traverse_(f);
-    f(current);
-    current = current.right;
-  }
-};
-
-SplayTree.prototype.traverseBreadthFirst = function (f) {
-  if (f(this.root_.value)) return;
-
-  var stack = [this.root_];
-  var length = 1;
-
-  while (length > 0) {
-    var new_stack = new Array(stack.length * 2);
-    var new_length = 0;
-    for (var i = 0; i < length; i++) {
-      var n = stack[i];
-      var l = n.left;
-      var r = n.right;
-      if (l) {
-        if (f(l.value)) return;
-        new_stack[new_length++] = l;
-      }
-      if (r) {
-        if (f(r.value)) return;
-        new_stack[new_length++] = r;
-      }
-    }
-    stack = new_stack;
-    length = new_length;
-  }
-};
diff --git a/deps/v8/benchmarks/spinning-balls/v.js b/deps/v8/benchmarks/spinning-balls/v.js
deleted file mode 100644
index 177ab44aecb09f..00000000000000
--- a/deps/v8/benchmarks/spinning-balls/v.js
+++ /dev/null
@@ -1,499 +0,0 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-/**
- * This function provides requestAnimationFrame in a cross browser way.
- * http://paulirish.com/2011/requestanimationframe-for-smart-animating/
- */
-if ( !window.requestAnimationFrame ) {
-  window.requestAnimationFrame = ( function() {
-    return window.webkitRequestAnimationFrame ||
-        window.mozRequestAnimationFrame ||
-        window.oRequestAnimationFrame ||
-        window.msRequestAnimationFrame ||
-        function(callback, element) {
-          window.setTimeout( callback, 1000 / 60 );
-        };
-  } )();
-}
-
-var kNPoints = 8000;
-var kNModifications = 20;
-var kNVisiblePoints = 200;
-var kDecaySpeed = 20;
-
-var kPointRadius = 4;
-var kInitialLifeForce = 100;
-
-var livePoints = void 0;
-var dyingPoints = void 0;
-var scene = void 0;
-var renderingStartTime = void 0;
-var scene = void 0;
-var pausePlot = void 0;
-var splayTree = void 0;
-var numberOfFrames = 0;
-var sumOfSquaredPauses = 0;
-var benchmarkStartTime = void 0;
-var benchmarkTimeLimit = void 0;
-var autoScale = void 0;
-var pauseDistribution = [];
-
-
-function Point(x, y, z, payload) {
-  this.x = x;
-  this.y = y;
-  this.z = z;
-
-  this.next = null;
-  this.prev = null;
-  this.payload = payload;
-  this.lifeForce = kInitialLifeForce;
-}
-
-
-Point.prototype.color = function () {
-  return "rgba(0, 0, 0, " + (this.lifeForce / kInitialLifeForce) + ")";
-};
-
-
-Point.prototype.decay = function () {
-  this.lifeForce -= kDecaySpeed;
-  return this.lifeForce <= 0;
-};
-
-
-function PointsList() {
-  this.head = null;
-  this.count = 0;
-}
-
-
-PointsList.prototype.add = function (point) {
-  if (this.head !== null) this.head.prev = point;
-  point.next = this.head;
-  this.head = point;
-  this.count++;
-}
-
-
-PointsList.prototype.remove = function (point) {
-  if (point.next !== null) {
-    point.next.prev = point.prev;
-  }
-  if (point.prev !== null) {
-    point.prev.next = point.next;
-  } else {
-    this.head = point.next;
-  }
-  this.count--;
-}
-
-
-function GeneratePayloadTree(depth, tag) {
-  if (depth == 0) {
-    return {
-      array  : [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 ],
-      string : 'String for key ' + tag + ' in leaf node'
-    };
-  } else {
-    return {
-      left:  GeneratePayloadTree(depth - 1, tag),
-      right: GeneratePayloadTree(depth - 1, tag)
-    };
-  }
-}
-
-
-// To make the benchmark results predictable, we replace Math.random
-// with a 100% deterministic alternative.
-Math.random = (function() {
-  var seed = 49734321;
-  return function() {
-    // Robert Jenkins' 32 bit integer hash function.
-    seed = seed & 0xffffffff;
-    seed = ((seed + 0x7ed55d16) + (seed << 12))  & 0xffffffff;
-    seed = ((seed ^ 0xc761c23c) ^ (seed >>> 19)) & 0xffffffff;
-    seed = ((seed + 0x165667b1) + (seed << 5))   & 0xffffffff;
-    seed = ((seed + 0xd3a2646c) ^ (seed << 9))   & 0xffffffff;
-    seed = ((seed + 0xfd7046c5) + (seed << 3))   & 0xffffffff;
-    seed = ((seed ^ 0xb55a4f09) ^ (seed >>> 16)) & 0xffffffff;
-    return (seed & 0xfffffff) / 0x10000000;
-  };
-})();
-
-
-function GenerateKey() {
-  // The benchmark framework guarantees that Math.random is
-  // deterministic; see base.js.
-  return Math.random();
-}
-
-function CreateNewPoint() {
-  // Insert new node with a unique key.
-  var key;
-  do { key = GenerateKey(); } while (splayTree.find(key) != null);
-
-  var point = new Point(Math.random() * 40 - 20,
-                        Math.random() * 40 - 20,
-                        Math.random() * 40 - 20,
-                        GeneratePayloadTree(5, "" + key));
-
-  livePoints.add(point);
-
-  splayTree.insert(key, point);
-  return key;
-}
-
-function ModifyPointsSet() {
-  if (livePoints.count < kNPoints) {
-    for (var i = 0; i < kNModifications; i++) {
-      CreateNewPoint();
-    }
-  } else if (kNModifications === 20) {
-    kNModifications = 80;
-    kDecay = 30;
-  }
-
-  for (var i = 0; i < kNModifications; i++) {
-    var key = CreateNewPoint();
-    var greatest = splayTree.findGreatestLessThan(key);
-    if (greatest == null) {
-      var point = splayTree.remove(key).value;
-    } else {
-      var point = splayTree.remove(greatest.key).value;
-    }
-    livePoints.remove(point);
-    point.payload = null;
-    dyingPoints.add(point);
-  }
-}
-
-
-function PausePlot(width, height, size, scale) {
-  var canvas = document.createElement("canvas");
-  canvas.width = this.width = width;
-  canvas.height = this.height = height;
-  document.body.appendChild(canvas);
-
-  this.ctx = canvas.getContext('2d');
-
-  if (typeof scale !== "number") {
-    this.autoScale = true;
-    this.maxPause = 0;
-  } else {
-    this.autoScale = false;
-    this.maxPause = scale;
-  }
-
-  this.size = size;
-
-  // Initialize cyclic buffer for pauses.
-  this.pauses = new Array(this.size);
-  this.start = this.size;
-  this.idx = 0;
-}
-
-
-PausePlot.prototype.addPause = function (p) {
-  if (this.idx === this.size) {
-    this.idx = 0;
-  }
-
-  if (this.idx === this.start) {
-    this.start++;
-  }
-
-  if (this.start === this.size) {
-    this.start = 0;
-  }
-
-  this.pauses[this.idx++] = p;
-};
-
-
-PausePlot.prototype.iteratePauses = function (f) {
-  if (this.start < this.idx) {
-    for (var i = this.start; i < this.idx; i++) {
-      f.call(this, i - this.start, this.pauses[i]);
-    }
-  } else {
-    for (var i = this.start; i < this.size; i++) {
-      f.call(this, i - this.start, this.pauses[i]);
-    }
-
-    var offs = this.size - this.start;
-    for (var i = 0; i < this.idx; i++) {
-      f.call(this, i + offs, this.pauses[i]);
-    }
-  }
-};
-
-
-PausePlot.prototype.draw = function () {
-  var first = null;
-
-  if (this.autoScale) {
-    this.iteratePauses(function (i, v) {
-      if (first === null) {
-        first = v;
-      }
-      this.maxPause = Math.max(v, this.maxPause);
-    });
-  }
-
-  var dx = this.width / this.size;
-  var dy = this.height / this.maxPause;
-
-  this.ctx.save();
-  this.ctx.clearRect(0, 0, this.width, this.height);
-  this.ctx.beginPath();
-  this.ctx.moveTo(1, dy * this.pauses[this.start]);
-  var p = first;
-  this.iteratePauses(function (i, v) {
-    var delta = v - p;
-    var x = 1 + dx * i;
-    var y = dy * v;
-    this.ctx.lineTo(x, y);
-    if (delta > 2 * (p / 3)) {
-      this.ctx.font = "bold 12px sans-serif";
-      this.ctx.textBaseline = "bottom";
-      this.ctx.fillText(v + "ms", x + 2, y);
-    }
-    p = v;
-  });
-  this.ctx.strokeStyle = "black";
-  this.ctx.stroke();
-  this.ctx.restore();
-}
-
-
-function Scene(width, height) {
-  var canvas = document.createElement("canvas");
-  canvas.width = width;
-  canvas.height = height;
-  document.body.appendChild(canvas);
-
-  this.ctx = canvas.getContext('2d');
-  this.width = canvas.width;
-  this.height = canvas.height;
-
-  // Projection configuration.
-  this.x0 = canvas.width / 2;
-  this.y0 = canvas.height / 2;
-  this.z0 = 100;
-  this.f  = 1000;  // Focal length.
-
-  // Camera is rotating around y-axis.
-  this.angle = 0;
-}
-
-
-Scene.prototype.drawPoint = function (x, y, z, color) {
-  // Rotate the camera around y-axis.
-  var rx = x * Math.cos(this.angle) - z * Math.sin(this.angle);
-  var ry = y;
-  var rz = x * Math.sin(this.angle) + z * Math.cos(this.angle);
-
-  // Perform perspective projection.
-  var px = (this.f * rx) / (rz - this.z0) + this.x0;
-  var py = (this.f * ry) / (rz - this.z0) + this.y0;
-
-  this.ctx.save();
-  this.ctx.fillStyle = color
-  this.ctx.beginPath();
-  this.ctx.arc(px, py, kPointRadius, 0, 2 * Math.PI, true);
-  this.ctx.fill();
-  this.ctx.restore();
-};
-
-
-Scene.prototype.drawDyingPoints = function () {
-  var point_next = null;
-  for (var point = dyingPoints.head; point !== null; point = point_next) {
-    // Rotate the scene around y-axis.
-    scene.drawPoint(point.x, point.y, point.z, point.color());
-
-    point_next = point.next;
-
-    // Decay the current point and remove it from the list
-    // if it's life-force ran out.
-    if (point.decay()) {
-      dyingPoints.remove(point);
-    }
-  }
-};
-
-
-Scene.prototype.draw = function () {
-  this.ctx.save();
-  this.ctx.clearRect(0, 0, this.width, this.height);
-  this.drawDyingPoints();
-  this.ctx.restore();
-
-  this.angle += Math.PI / 90.0;
-};
-
-
-function updateStats(pause) {
-  numberOfFrames++;
-  if (pause > 20) {
-    sumOfSquaredPauses += (pause - 20) * (pause - 20);
-  }
-  pauseDistribution[Math.floor(pause / 10)] |= 0;
-  pauseDistribution[Math.floor(pause / 10)]++;
-}
-
-
-function renderStats() {
-  var msg = document.createElement("p");
-  msg.innerHTML = "Score " +
-    Math.round(numberOfFrames * 1000 / sumOfSquaredPauses);
-  var table = document.createElement("table");
-  table.align = "center";
-  for (var i = 0; i < pauseDistribution.length; i++) {
-    if (pauseDistribution[i] > 0) {
-      var row = document.createElement("tr");
-      var time = document.createElement("td");
-      var count = document.createElement("td");
-      time.innerHTML = i*10 + "-" + (i+1)*10 + "ms";
-      count.innerHTML = " => " + pauseDistribution[i];
-      row.appendChild(time);
-      row.appendChild(count);
-      table.appendChild(row);
-    }
-  }
-  div.appendChild(msg);
-  div.appendChild(table);
-}
-
-
-function render() {
-  if (typeof renderingStartTime === 'undefined') {
-    renderingStartTime = Date.now();
-    benchmarkStartTime = renderingStartTime;
-  }
-
-  ModifyPointsSet();
-
-  scene.draw();
-
-  var renderingEndTime = Date.now();
-  var pause = renderingEndTime - renderingStartTime;
-  pausePlot.addPause(pause);
-  renderingStartTime = renderingEndTime;
-
-  pausePlot.draw();
-
-  updateStats(pause);
-
-  div.innerHTML =
-      livePoints.count + "/" + dyingPoints.count + " " +
-      pause + "(max = " + pausePlot.maxPause + ") ms " +
-      numberOfFrames + " frames";
-
-  if (renderingEndTime < benchmarkStartTime + benchmarkTimeLimit) {
-    // Schedule next frame.
-    requestAnimationFrame(render);
-  } else {
-    renderStats();
-  }
-}
-
-
-function Form() {
-  function create(tag) { return document.createElement(tag); }
-  function text(value) { return document.createTextNode(value); }
-
-  this.form = create("form");
-  this.form.setAttribute("action", "javascript:start()");
-
-  var table = create("table");
-  table.setAttribute("style", "margin-left: auto; margin-right: auto;");
-
-  function col(a) {
-    var td = create("td");
-    td.appendChild(a);
-    return td;
-  }
-
-  function row(a, b) {
-    var tr = create("tr");
-    tr.appendChild(col(a));
-    tr.appendChild(col(b));
-    return tr;
-  }
-
-  this.timelimit = create("input");
-  this.timelimit.setAttribute("value", "60");
-
-  table.appendChild(row(text("Time limit in seconds"), this.timelimit));
-
-  this.autoscale = create("input");
-  this.autoscale.setAttribute("type", "checkbox");
-  this.autoscale.setAttribute("checked", "true");
-  table.appendChild(row(text("Autoscale pauses plot"), this.autoscale));
-
-  var button = create("input");
-  button.setAttribute("type", "submit");
-  button.setAttribute("value", "Start");
-  this.form.appendChild(table);
-  this.form.appendChild(button);
-
-  document.body.appendChild(this.form);
-}
-
-
-Form.prototype.remove = function () {
-  document.body.removeChild(this.form);
-};
-
-
-function init() {
-  livePoints = new PointsList;
-  dyingPoints = new PointsList;
-
-  splayTree = new SplayTree();
-
-  scene = new Scene(640, 480);
-
-  div = document.createElement("div");
-  document.body.appendChild(div);
-
-  pausePlot = new PausePlot(480, autoScale ? 240 : 500, 160, autoScale ? void 0 : 500);
-}
-
-function start() {
-  benchmarkTimeLimit = form.timelimit.value * 1000;
-  autoScale = form.autoscale.checked;
-  form.remove();
-  init();
-  render();
-}
-
-var form = new Form();
diff --git a/deps/v8/benchmarks/splay.js b/deps/v8/benchmarks/splay.js
deleted file mode 100644
index 6b4f56d3213846..00000000000000
--- a/deps/v8/benchmarks/splay.js
+++ /dev/null
@@ -1,394 +0,0 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// This benchmark is based on a JavaScript log processing module used
-// by the V8 profiler to generate execution time profiles for runs of
-// JavaScript applications, and it effectively measures how fast the
-// JavaScript engine is at allocating nodes and reclaiming the memory
-// used for old nodes. Because of the way splay trees work, the engine
-// also has to deal with a lot of changes to the large tree object
-// graph.
-
-var Splay = new BenchmarkSuite('Splay', 81491, [
-  new Benchmark("Splay", SplayRun, SplaySetup, SplayTearDown)
-]);
-
-
-// Configuration.
-var kSplayTreeSize = 8000;
-var kSplayTreeModifications = 80;
-var kSplayTreePayloadDepth = 5;
-
-var splayTree = null;
-
-
-function GeneratePayloadTree(depth, tag) {
-  if (depth == 0) {
-    return {
-      array  : [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 ],
-      string : 'String for key ' + tag + ' in leaf node'
-    };
-  } else {
-    return {
-      left:  GeneratePayloadTree(depth - 1, tag),
-      right: GeneratePayloadTree(depth - 1, tag)
-    };
-  }
-}
-
-
-function GenerateKey() {
-  // The benchmark framework guarantees that Math.random is
-  // deterministic; see base.js.
-  return Math.random();
-}
-
-
-function InsertNewNode() {
-  // Insert new node with a unique key.
-  var key;
-  do {
-    key = GenerateKey();
-  } while (splayTree.find(key) != null);
-  var payload = GeneratePayloadTree(kSplayTreePayloadDepth, String(key));
-  splayTree.insert(key, payload);
-  return key;
-}
-
-
-
-function SplaySetup() {
-  splayTree = new SplayTree();
-  for (var i = 0; i < kSplayTreeSize; i++) InsertNewNode();
-}
-
-
-function SplayTearDown() {
-  // Allow the garbage collector to reclaim the memory
-  // used by the splay tree no matter how we exit the
-  // tear down function.
-  var keys = splayTree.exportKeys();
-  splayTree = null;
-
-  // Verify that the splay tree has the right size.
-  var length = keys.length;
-  if (length != kSplayTreeSize) {
-    throw new Error("Splay tree has wrong size");
-  }
-
-  // Verify that the splay tree has sorted, unique keys.
-  for (var i = 0; i < length - 1; i++) {
-    if (keys[i] >= keys[i + 1]) {
-      throw new Error("Splay tree not sorted");
-    }
-  }
-}
-
-
-function SplayRun() {
-  // Replace a few nodes in the splay tree.
-  for (var i = 0; i < kSplayTreeModifications; i++) {
-    var key = InsertNewNode();
-    var greatest = splayTree.findGreatestLessThan(key);
-    if (greatest == null) splayTree.remove(key);
-    else splayTree.remove(greatest.key);
-  }
-}
-
-
-/**
- * Constructs a Splay tree.  A splay tree is a self-balancing binary
- * search tree with the additional property that recently accessed
- * elements are quick to access again. It performs basic operations
- * such as insertion, look-up and removal in O(log(n)) amortized time.
- *
- * @constructor
- */
-function SplayTree() {
-};
-
-
-/**
- * Pointer to the root node of the tree.
- *
- * @type {SplayTree.Node}
- * @private
- */
-SplayTree.prototype.root_ = null;
-
-
-/**
- * @return {boolean} Whether the tree is empty.
- */
-SplayTree.prototype.isEmpty = function() {
-  return !this.root_;
-};
-
-
-/**
- * Inserts a node into the tree with the specified key and value if
- * the tree does not already contain a node with the specified key. If
- * the value is inserted, it becomes the root of the tree.
- *
- * @param {number} key Key to insert into the tree.
- * @param {*} value Value to insert into the tree.
- */
-SplayTree.prototype.insert = function(key, value) {
-  if (this.isEmpty()) {
-    this.root_ = new SplayTree.Node(key, value);
-    return;
-  }
-  // Splay on the key to move the last node on the search path for
-  // the key to the root of the tree.
-  this.splay_(key);
-  if (this.root_.key == key) {
-    return;
-  }
-  var node = new SplayTree.Node(key, value);
-  if (key > this.root_.key) {
-    node.left = this.root_;
-    node.right = this.root_.right;
-    this.root_.right = null;
-  } else {
-    node.right = this.root_;
-    node.left = this.root_.left;
-    this.root_.left = null;
-  }
-  this.root_ = node;
-};
-
-
-/**
- * Removes a node with the specified key from the tree if the tree
- * contains a node with this key. The removed node is returned. If the
- * key is not found, an exception is thrown.
- *
- * @param {number} key Key to find and remove from the tree.
- * @return {SplayTree.Node} The removed node.
- */
-SplayTree.prototype.remove = function(key) {
-  if (this.isEmpty()) {
-    throw Error('Key not found: ' + key);
-  }
-  this.splay_(key);
-  if (this.root_.key != key) {
-    throw Error('Key not found: ' + key);
-  }
-  var removed = this.root_;
-  if (!this.root_.left) {
-    this.root_ = this.root_.right;
-  } else {
-    var right = this.root_.right;
-    this.root_ = this.root_.left;
-    // Splay to make sure that the new root has an empty right child.
-    this.splay_(key);
-    // Insert the original right child as the right child of the new
-    // root.
-    this.root_.right = right;
-  }
-  return removed;
-};
-
-
-/**
- * Returns the node having the specified key or null if the tree doesn't contain
- * a node with the specified key.
- *
- * @param {number} key Key to find in the tree.
- * @return {SplayTree.Node} Node having the specified key.
- */
-SplayTree.prototype.find = function(key) {
-  if (this.isEmpty()) {
-    return null;
-  }
-  this.splay_(key);
-  return this.root_.key == key ? this.root_ : null;
-};
-
-
-/**
- * @return {SplayTree.Node} Node having the maximum key value.
- */
-SplayTree.prototype.findMax = function(opt_startNode) {
-  if (this.isEmpty()) {
-    return null;
-  }
-  var current = opt_startNode || this.root_;
-  while (current.right) {
-    current = current.right;
-  }
-  return current;
-};
-
-
-/**
- * @return {SplayTree.Node} Node having the maximum key value that
- *     is less than the specified key value.
- */
-SplayTree.prototype.findGreatestLessThan = function(key) {
-  if (this.isEmpty()) {
-    return null;
-  }
-  // Splay on the key to move the node with the given key or the last
-  // node on the search path to the top of the tree.
-  this.splay_(key);
-  // Now the result is either the root node or the greatest node in
-  // the left subtree.
-  if (this.root_.key < key) {
-    return this.root_;
-  } else if (this.root_.left) {
-    return this.findMax(this.root_.left);
-  } else {
-    return null;
-  }
-};
-
-
-/**
- * @return {Array<*>} An array containing all the keys of tree's nodes.
- */
-SplayTree.prototype.exportKeys = function() {
-  var result = [];
-  if (!this.isEmpty()) {
-    this.root_.traverse_(function(node) { result.push(node.key); });
-  }
-  return result;
-};
-
-
-/**
- * Perform the splay operation for the given key. Moves the node with
- * the given key to the top of the tree.  If no node has the given
- * key, the last node on the search path is moved to the top of the
- * tree. This is the simplified top-down splaying algorithm from:
- * "Self-adjusting Binary Search Trees" by Sleator and Tarjan
- *
- * @param {number} key Key to splay the tree on.
- * @private
- */
-SplayTree.prototype.splay_ = function(key) {
-  if (this.isEmpty()) {
-    return;
-  }
-  // Create a dummy node.  The use of the dummy node is a bit
-  // counter-intuitive: The right child of the dummy node will hold
-  // the L tree of the algorithm.  The left child of the dummy node
-  // will hold the R tree of the algorithm.  Using a dummy node, left
-  // and right will always be nodes and we avoid special cases.
-  var dummy, left, right;
-  dummy = left = right = new SplayTree.Node(null, null);
-  var current = this.root_;
-  while (true) {
-    if (key < current.key) {
-      if (!current.left) {
-        break;
-      }
-      if (key < current.left.key) {
-        // Rotate right.
-        var tmp = current.left;
-        current.left = tmp.right;
-        tmp.right = current;
-        current = tmp;
-        if (!current.left) {
-          break;
-        }
-      }
-      // Link right.
-      right.left = current;
-      right = current;
-      current = current.left;
-    } else if (key > current.key) {
-      if (!current.right) {
-        break;
-      }
-      if (key > current.right.key) {
-        // Rotate left.
-        var tmp = current.right;
-        current.right = tmp.left;
-        tmp.left = current;
-        current = tmp;
-        if (!current.right) {
-          break;
-        }
-      }
-      // Link left.
-      left.right = current;
-      left = current;
-      current = current.right;
-    } else {
-      break;
-    }
-  }
-  // Assemble.
-  left.right = current.left;
-  right.left = current.right;
-  current.left = dummy.right;
-  current.right = dummy.left;
-  this.root_ = current;
-};
-
-
-/**
- * Constructs a Splay tree node.
- *
- * @param {number} key Key.
- * @param {*} value Value.
- */
-SplayTree.Node = function(key, value) {
-  this.key = key;
-  this.value = value;
-};
-
-
-/**
- * @type {SplayTree.Node}
- */
-SplayTree.Node.prototype.left = null;
-
-
-/**
- * @type {SplayTree.Node}
- */
-SplayTree.Node.prototype.right = null;
-
-
-/**
- * Performs an ordered traversal of the subtree starting at
- * this SplayTree.Node.
- *
- * @param {function(SplayTree.Node)} f Visitor function.
- * @private
- */
-SplayTree.Node.prototype.traverse_ = function(f) {
-  var current = this;
-  while (current) {
-    var left = current.left;
-    if (left) left.traverse_(f);
-    f(current);
-    current = current.right;
-  }
-};
diff --git a/deps/v8/benchmarks/style.css b/deps/v8/benchmarks/style.css
deleted file mode 100644
index d9f4dbfc0c6b7a..00000000000000
--- a/deps/v8/benchmarks/style.css
+++ /dev/null
@@ -1,77 +0,0 @@
-hr {
-  border: 1px solid;
-  border-color: #36C;
-  margin: 1em 0;
-}
-
-h1, h2, h3, h4 {
-  margin: 0;
-  margin-bottom: 0;
-}
-
-h1 {
-  font-size: 154%;
-  height: 1.2em;
-}
-
-
-li {
-  margin: .3em 0 1em 0;
-}
-
-body {
-  font-family: Helvetica,Arial,sans-serif;
-  color: #000;
-  background-color: #fff;
-}
-
-div.title {
-  background-color: rgb(229, 236, 249);
-  border-top: 1px solid rgb(51, 102, 204);
-  text-align: center;
-  padding-top: 0.2em;
-  padding-bottom: 0.2em;
-  margin-bottom: 20px;
-}
-
-div.subtitle {
-  border-bottom: 1px solid rgb(51, 102, 204);
-  margin-top: 2em;
-}
-
-td.contents {
-  text-align: left;
-}
-
-div.run {
-  margin: 20px;
-  width: 300px;
-  height: 300px;
-  float: right;
-  background-color: rgb(229, 236, 249);
-  background-image: url(v8-logo.png);
-  background-position: center center;
-  background-repeat: no-repeat;
-  border: 1px solid rgb(51, 102, 204);
-}
-
-div.warning { 
-  background: #ffffd9;
-  border: 1px solid #d2d26a;
-  display: none;
-  margin: 1em 0 2em;
-  padding: 8px;
-  text-align: center; 
-}
-
-#status {
-  text-align: center;
-  margin-top: 50px;
-  font-size: 120%;
-  font-weight: bold;
-}
-
-#results {
-  text-align: left;
-  margin: 30px 0 0 90px;
-}
diff --git a/deps/v8/benchmarks/v8-logo.png b/deps/v8/benchmarks/v8-logo.png
deleted file mode 100644
index 91867657f7aa41..00000000000000
Binary files a/deps/v8/benchmarks/v8-logo.png and /dev/null differ
diff --git a/deps/v8/benchmarks/v8.json b/deps/v8/benchmarks/v8.json
deleted file mode 100644
index 03ea9621acaf91..00000000000000
--- a/deps/v8/benchmarks/v8.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "path": ["."],
-  "main": "run.js",
-  "run_count": 2,
-  "results_regexp": "^%s: (.+)$",
-  "tests": [
-    {"name": "Richards"},
-    {"name": "DeltaBlue"},
-    {"name": "Crypto"},
-    {"name": "RayTrace"},
-    {"name": "EarleyBoyer"},
-    {"name": "RegExp"},
-    {"name": "Splay"},
-    {"name": "NavierStokes"}
-  ]
-}
diff --git a/deps/v8/gni/split_static_library.gni b/deps/v8/gni/split_static_library.gni
new file mode 100644
index 00000000000000..c72665e245f0ee
--- /dev/null
+++ b/deps/v8/gni/split_static_library.gni
@@ -0,0 +1,78 @@
+# Copyright 2019 the V8 project authors. All rights reserved.
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//build/config/compiler/compiler.gni")
+
+template("split_static_library") {
+  assert(defined(invoker.split_count),
+         "Must define split_count for split_static_library")
+
+  # In many conditions the number of inputs will be 1 (because the
+  # count will be conditional on platform or configuration) and for
+  # some build configurations it's unnecessary to split libraries
+  # since the tooling will never create files of a problematic size.
+  if (invoker.split_count == 1 || use_lld) {
+    static_library(target_name) {
+      forward_variables_from(invoker, "*")
+    }
+  } else {
+    group_name = target_name
+
+    generated_static_libraries = []
+    current_library_index = 0
+    foreach(current_sources, split_list(invoker.sources, invoker.split_count)) {
+      current_name = "${target_name}_$current_library_index"
+      assert(
+          current_sources != [],
+          "Your values for splitting a static library generate one that has no sources.")
+      generated_static_libraries += [ ":$current_name" ]
+
+      static_library(current_name) {
+        # Generated static library shard gets everything but sources (which
+        # we're redefining) and visibility (which is set to be the group
+        # below).
+        forward_variables_from(invoker,
+                               "*",
+                               [
+                                 "check_includes",
+                                 "sources",
+                                 "visibility",
+                               ])
+        sources = current_sources
+        visibility = [ ":$group_name" ]
+
+        # When splitting a target's sources up into a series of static
+        # libraries, those targets will naturally include headers from each
+        # other arbitrarily. We could theoretically generate a web of
+        # dependencies and allow_circular_includes_from between all pairs of
+        # targets, but that's very cumbersome. Typical usage in Chrome is that
+        # only official Windows builds use split static libraries due to the
+        # Visual Studio size limits, and this means we'll still get header
+        # checking coverage for the other configurations.
+        check_includes = false
+
+        # Uniquify the output name if one is specified.
+        if (defined(invoker.output_name)) {
+          output_name = "${invoker.output_name}_$current_library_index"
+        }
+      }
+
+      current_library_index = current_library_index + 1
+    }
+
+    group(group_name) {
+      public_deps = generated_static_libraries
+      forward_variables_from(invoker,
+                             [
+                               "testonly",
+                               "visibility",
+                             ])
+    }
+  }
+}
+
+set_defaults("split_static_library") {
+  configs = default_compiler_configs
+}
diff --git a/deps/v8/gni/v8.gni b/deps/v8/gni/v8.gni
index 2644dea36bffda..eaf76a471b3395 100644
--- a/deps/v8/gni/v8.gni
+++ b/deps/v8/gni/v8.gni
@@ -2,10 +2,9 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-import("//build/config/jumbo.gni")
 import("//build/config/sanitizers/sanitizers.gni")
 import("//build/config/v8_target_cpu.gni")
-import("//build/split_static_library.gni")
+import("split_static_library.gni")
 
 declare_args() {
   # Set flags for tracking code coverage. Uses gcov with gcc and sanitizer
@@ -31,8 +30,8 @@ declare_args() {
   # Support for backtrace_symbols on linux.
   v8_enable_backtrace = ""
 
-  # Enables raw heap snapshots containing internals. Used for debugging memory
-  # on platform and embedder level.
+  # This flag is deprecated and is now available through the inspector interface
+  # as an argument to profiler's method `takeHeapSnapshot`.
   v8_enable_raw_heap_snapshots = false
 
   # Enable several snapshots side-by-side (e.g. default and for trusted code).
@@ -70,8 +69,7 @@ if (v8_use_multi_snapshots) {
   # Silently disable multi snapshots if they're incompatible with the current
   # build configuration. This allows us to set v8_use_multi_snapshots=true on
   # all bots, and e.g. no-snapshot bots will automatically do the right thing.
-  v8_use_multi_snapshots =
-      v8_use_external_startup_data && !build_with_chromium && !use_jumbo_build
+  v8_use_multi_snapshots = v8_use_external_startup_data && !build_with_chromium
 }
 
 if (v8_enable_backtrace == "") {
@@ -138,11 +136,11 @@ if (!build_with_chromium && is_clang) {
 template("v8_source_set") {
   if (defined(invoker.split_count) && invoker.split_count > 1 &&
       defined(v8_static_library) && v8_static_library && is_win) {
-    link_target_type = "jumbo_split_static_library"
+    link_target_type = "split_static_library"
   } else if (defined(v8_static_library) && v8_static_library) {
-    link_target_type = "jumbo_static_library"
+    link_target_type = "static_library"
   } else {
-    link_target_type = "jumbo_source_set"
+    link_target_type = "source_set"
   }
   target(link_target_type, target_name) {
     forward_variables_from(invoker,
@@ -161,7 +159,7 @@ template("v8_source_set") {
 }
 
 template("v8_header_set") {
-  jumbo_source_set(target_name) {
+  source_set(target_name) {
     forward_variables_from(invoker, "*", [ "configs" ])
     configs -= v8_remove_configs
     configs += v8_add_configs
diff --git a/deps/v8/include/js_protocol.pdl b/deps/v8/include/js_protocol.pdl
index 51f3c6f68a113c..28b8e610767142 100644
--- a/deps/v8/include/js_protocol.pdl
+++ b/deps/v8/include/js_protocol.pdl
@@ -224,11 +224,13 @@ domain Debugger
       # Id of the script to get source for.
       Runtime.ScriptId scriptId
     returns
-      # Script source.
+      # Script source (empty in case of Wasm bytecode).
       string scriptSource
+      # Wasm bytecode.
+      optional binary bytecode
 
-  # Returns bytecode for the WebAssembly script with given id.
-  command getWasmBytecode
+  # This command is deprecated. Use getScriptSource instead.
+  deprecated command getWasmBytecode
     parameters
       # Id of the Wasm script to get source for.
       Runtime.ScriptId scriptId
@@ -651,11 +653,14 @@ experimental domain HeapProfiler
       # If true 'reportHeapSnapshotProgress' events will be generated while snapshot is being taken
       # when the tracking is stopped.
       optional boolean reportProgress
+      optional boolean treatGlobalObjectsAsRoots
 
   command takeHeapSnapshot
     parameters
       # If true 'reportHeapSnapshotProgress' events will be generated while snapshot is being taken.
       optional boolean reportProgress
+      # If true, a raw snapshot without artifical roots will be generated
+      optional boolean treatGlobalObjectsAsRoots
 
   event addHeapSnapshotChunk
     parameters
@@ -783,6 +788,14 @@ domain Profiler
       # Type profile entries for parameters and return values of the functions in the script.
       array of TypeProfileEntry entries
 
+  # Collected counter information.
+  experimental type CounterInfo extends object
+    properties
+      # Counter name.
+      string name
+      # Counter value.
+      integer value
+
   command disable
 
   command enable
@@ -811,6 +824,9 @@ domain Profiler
       optional boolean callCount
       # Collect block-based coverage.
       optional boolean detailed
+    returns
+      # Monotonically increasing time (in seconds) when the coverage update was taken in the backend.
+      number timestamp
 
   # Enable type profile.
   experimental command startTypeProfile
@@ -833,6 +849,8 @@ domain Profiler
     returns
       # Coverage data for the current isolate.
       array of ScriptCoverage result
+      # Monotonically increasing time (in seconds) when the coverage update was taken in the backend.
+      number timestamp
 
   # Collect type profile.
   experimental command takeTypeProfile
@@ -840,6 +858,18 @@ domain Profiler
       # Type profile for all scripts since startTypeProfile() was turned on.
       array of ScriptTypeProfile result
 
+  # Enable run time call stats collection.
+  experimental command enableRuntimeCallStats
+
+  # Disable run time call stats collection.
+  experimental command disableRuntimeCallStats
+
+  # Retrieve run time call stats.
+  experimental command getRuntimeCallStats
+    returns
+      # Collected counter information.
+      array of CounterInfo result
+
   event consoleProfileFinished
     parameters
       string id
@@ -858,6 +888,19 @@ domain Profiler
       # Profile title passed as an argument to console.profile().
       optional string title
 
+  # Reports coverage delta since the last poll (either from an event like this, or from
+  # `takePreciseCoverage` for the current isolate. May only be sent if precise code
+  # coverage has been started. This event can be trigged by the embedder to, for example,
+  # trigger collection of coverage data immediatelly at a certain point in time.
+  experimental event preciseCoverageDeltaUpdate
+    parameters
+      # Monotonically increasing time (in seconds) when the coverage update was taken in the backend.
+      number timestamp
+      # Identifier for distinguishing coverage events.
+      string occassion
+      # Coverage data for the current isolate.
+      array of ScriptCoverage result
+
 # Runtime domain exposes JavaScript runtime by means of remote evaluation and mirror objects.
 # Evaluation results are returned as mirror object that expose object type, string representation
 # and unique identifier that can be used for further object reference. Original objects are
@@ -1051,7 +1094,13 @@ domain Runtime
       # Private property name.
       string name
       # The value associated with the private property.
-      RemoteObject value
+      optional RemoteObject value
+      # A function which serves as a getter for the private property,
+      # or `undefined` if there is no getter (accessor descriptors only).
+      optional RemoteObject get
+      # A function which serves as a setter for the private property,
+      # or `undefined` if there is no setter (accessor descriptors only).
+      optional RemoteObject set
 
   # Represents function call argument. Either remote object id `objectId`, primitive `value`,
   # unserializable primitive value or neither of (for undefined) them should be specified.
@@ -1257,6 +1306,8 @@ domain Runtime
       experimental optional TimeDelta timeout
       # Disable breakpoints during execution.
       experimental optional boolean disableBreaks
+      # Reserved flag for future REPL mode support. Setting this flag has currently no effect.
+      experimental optional boolean replMode
     returns
       # Evaluation result.
       RemoteObject result
diff --git a/deps/v8/include/libplatform/libplatform.h b/deps/v8/include/libplatform/libplatform.h
index 18d585d6d9e314..6051b644fb9b59 100644
--- a/deps/v8/include/libplatform/libplatform.h
+++ b/deps/v8/include/libplatform/libplatform.h
@@ -47,9 +47,11 @@ V8_PLATFORM_EXPORT std::unique_ptr<v8::Platform> NewDefaultPlatform(
  * Pumps the message loop for the given isolate.
  *
  * The caller has to make sure that this is called from the right thread.
- * Returns true if a task was executed, and false otherwise. Unless requested
- * through the |behavior| parameter, this call does not block if no task is
- * pending. The |platform| has to be created using |NewDefaultPlatform|.
+ * Returns true if a task was executed, and false otherwise. If the call to
+ * PumpMessageLoop is nested within another call to PumpMessageLoop, only
+ * nestable tasks may run. Otherwise, any task may run. Unless requested through
+ * the |behavior| parameter, this call does not block if no task is pending. The
+ * |platform| has to be created using |NewDefaultPlatform|.
  */
 V8_PLATFORM_EXPORT bool PumpMessageLoop(
     v8::Platform* platform, v8::Isolate* isolate,
diff --git a/deps/v8/include/libplatform/v8-tracing.h b/deps/v8/include/libplatform/v8-tracing.h
index df145e95bf723b..79e6f62d23e1bb 100644
--- a/deps/v8/include/libplatform/v8-tracing.h
+++ b/deps/v8/include/libplatform/v8-tracing.h
@@ -35,7 +35,7 @@ const int kTraceMaxNumArgs = 2;
 class V8_PLATFORM_EXPORT TraceObject {
  public:
   union ArgValue {
-    bool as_bool;
+    V8_DEPRECATED("use as_uint ? true : false") bool as_bool;
     uint64_t as_uint;
     int64_t as_int;
     double as_double;
diff --git a/deps/v8/include/v8-inspector.h b/deps/v8/include/v8-inspector.h
index 5f53f21d55302d..b9a48665338782 100644
--- a/deps/v8/include/v8-inspector.h
+++ b/deps/v8/include/v8-inspector.h
@@ -9,6 +9,7 @@
 #include <cctype>
 
 #include <memory>
+#include <unordered_map>
 
 #include "v8.h"  // NOLINT(build/include)
 
@@ -160,6 +161,8 @@ class V8_EXPORT V8InspectorSession {
                             v8::Local<v8::Context>*,
                             std::unique_ptr<StringBuffer>* objectGroup) = 0;
   virtual void releaseObjectGroup(const StringView&) = 0;
+  virtual void triggerPreciseCoverageDeltaUpdate(
+      const StringView& occassion) = 0;
 };
 
 class V8_EXPORT V8InspectorClient {
@@ -299,6 +302,24 @@ class V8_EXPORT V8Inspector {
   virtual std::unique_ptr<V8StackTrace> createStackTrace(
       v8::Local<v8::StackTrace>) = 0;
   virtual std::unique_ptr<V8StackTrace> captureStackTrace(bool fullStack) = 0;
+
+  // Performance counters.
+  class V8_EXPORT Counters : public std::enable_shared_from_this<Counters> {
+   public:
+    explicit Counters(v8::Isolate* isolate);
+    ~Counters();
+    const std::unordered_map<std::string, int>& getCountersMap() const {
+      return m_countersMap;
+    }
+
+   private:
+    static int* getCounterPtr(const char* name);
+
+    v8::Isolate* m_isolate;
+    std::unordered_map<std::string, int> m_countersMap;
+  };
+
+  virtual std::shared_ptr<Counters> enableCounters() = 0;
 };
 
 }  // namespace v8_inspector
diff --git a/deps/v8/include/v8-internal.h b/deps/v8/include/v8-internal.h
index 29f391b673a1b8..e4d698e6ce7e4c 100644
--- a/deps/v8/include/v8-internal.h
+++ b/deps/v8/include/v8-internal.h
@@ -146,7 +146,7 @@ class Internals {
   static const int kFixedArrayHeaderSize = 2 * kApiTaggedSize;
   static const int kEmbedderDataArrayHeaderSize = 2 * kApiTaggedSize;
   static const int kEmbedderDataSlotSize = kApiSystemPointerSize;
-  static const int kNativeContextEmbedderDataOffset = 7 * kApiTaggedSize;
+  static const int kNativeContextEmbedderDataOffset = 6 * kApiTaggedSize;
   static const int kFullStringRepresentationMask = 0x0f;
   static const int kStringEncodingMask = 0x8;
   static const int kExternalTwoByteRepresentationTag = 0x02;
@@ -308,9 +308,9 @@ class Internals {
   V8_INLINE static internal::Address ReadTaggedPointerField(
       internal::Address heap_object_ptr, int offset) {
 #ifdef V8_COMPRESS_POINTERS
-    int32_t value = ReadRawField<int32_t>(heap_object_ptr, offset);
+    uint32_t value = ReadRawField<uint32_t>(heap_object_ptr, offset);
     internal::Address root = GetRootFromOnHeapAddress(heap_object_ptr);
-    return root + static_cast<internal::Address>(static_cast<intptr_t>(value));
+    return root + static_cast<internal::Address>(static_cast<uintptr_t>(value));
 #else
     return ReadRawField<internal::Address>(heap_object_ptr, offset);
 #endif
@@ -319,8 +319,8 @@ class Internals {
   V8_INLINE static internal::Address ReadTaggedSignedField(
       internal::Address heap_object_ptr, int offset) {
 #ifdef V8_COMPRESS_POINTERS
-    int32_t value = ReadRawField<int32_t>(heap_object_ptr, offset);
-    return static_cast<internal::Address>(static_cast<intptr_t>(value));
+    uint32_t value = ReadRawField<uint32_t>(heap_object_ptr, offset);
+    return static_cast<internal::Address>(static_cast<uintptr_t>(value));
 #else
     return ReadRawField<internal::Address>(heap_object_ptr, offset);
 #endif
@@ -337,13 +337,9 @@ class Internals {
   }
 
   V8_INLINE static internal::Address DecompressTaggedAnyField(
-      internal::Address heap_object_ptr, int32_t value) {
-    internal::Address root_mask = static_cast<internal::Address>(
-        -static_cast<intptr_t>(value & kSmiTagMask));
-    internal::Address root_or_zero =
-        root_mask & GetRootFromOnHeapAddress(heap_object_ptr);
-    return root_or_zero +
-           static_cast<internal::Address>(static_cast<intptr_t>(value));
+      internal::Address heap_object_ptr, uint32_t value) {
+    internal::Address root = GetRootFromOnHeapAddress(heap_object_ptr);
+    return root + static_cast<internal::Address>(static_cast<uintptr_t>(value));
   }
 #endif  // V8_COMPRESS_POINTERS
 };
diff --git a/deps/v8/include/v8-platform.h b/deps/v8/include/v8-platform.h
index c6e78f238197df..5d23cd665ed399 100644
--- a/deps/v8/include/v8-platform.h
+++ b/deps/v8/include/v8-platform.h
@@ -326,7 +326,8 @@ class Platform {
 
   /**
    * Returns a TaskRunner which can be used to post a task on the foreground.
-   * This function should only be called from a foreground thread.
+   * The TaskRunner's NonNestableTasksEnabled() must be true. This function
+   * should only be called from a foreground thread.
    */
   virtual std::shared_ptr<v8::TaskRunner> GetForegroundTaskRunner(
       Isolate* isolate) = 0;
@@ -362,44 +363,10 @@ class Platform {
   virtual void CallDelayedOnWorkerThread(std::unique_ptr<Task> task,
                                          double delay_in_seconds) = 0;
 
-  /**
-   * Schedules a task to be invoked on a foreground thread wrt a specific
-   * |isolate|. Tasks posted for the same isolate should be execute in order of
-   * scheduling. The definition of "foreground" is opaque to V8.
-   */
-  V8_DEPRECATED("Use a taskrunner acquired by GetForegroundTaskRunner instead.")
-  virtual void CallOnForegroundThread(Isolate* isolate, Task* task) = 0;
-
-  /**
-   * Schedules a task to be invoked on a foreground thread wrt a specific
-   * |isolate| after the given number of seconds |delay_in_seconds|.
-   * Tasks posted for the same isolate should be execute in order of
-   * scheduling. The definition of "foreground" is opaque to V8.
-   */
-  V8_DEPRECATED("Use a taskrunner acquired by GetForegroundTaskRunner instead.")
-  virtual void CallDelayedOnForegroundThread(Isolate* isolate, Task* task,
-                                             double delay_in_seconds) = 0;
-
-  /**
-   * Schedules a task to be invoked on a foreground thread wrt a specific
-   * |isolate| when the embedder is idle.
-   * Requires that SupportsIdleTasks(isolate) is true.
-   * Idle tasks may be reordered relative to other task types and may be
-   * starved for an arbitrarily long time if no idle time is available.
-   * The definition of "foreground" is opaque to V8.
-   */
-  V8_DEPRECATED("Use a taskrunner acquired by GetForegroundTaskRunner instead.")
-  virtual void CallIdleOnForegroundThread(Isolate* isolate, IdleTask* task) {
-    // This must be overriden if |IdleTasksEnabled()|.
-    abort();
-  }
-
   /**
    * Returns true if idle tasks are enabled for the given |isolate|.
    */
-  virtual bool IdleTasksEnabled(Isolate* isolate) {
-    return false;
-  }
+  virtual bool IdleTasksEnabled(Isolate* isolate) { return false; }
 
   /**
    * Monotonically increasing time in seconds from an arbitrary fixed point in
diff --git a/deps/v8/include/v8-profiler.h b/deps/v8/include/v8-profiler.h
index 0e203511f55205..866d799076e9db 100644
--- a/deps/v8/include/v8-profiler.h
+++ b/deps/v8/include/v8-profiler.h
@@ -144,10 +144,6 @@ class V8_EXPORT CpuProfileNode {
     */
   unsigned GetHitCount() const;
 
-  /** Returns function entry UID. */
-  V8_DEPRECATED("Use GetScriptId, GetLineNumber, and GetColumnNumber instead.")
-  unsigned GetCallUid() const;
-
   /** Returns id of the node. The id is unique within the tree */
   unsigned GetNodeId() const;
 
@@ -848,7 +844,8 @@ class V8_EXPORT HeapProfiler {
    */
   const HeapSnapshot* TakeHeapSnapshot(
       ActivityControl* control = nullptr,
-      ObjectNameResolver* global_object_name_resolver = nullptr);
+      ObjectNameResolver* global_object_name_resolver = nullptr,
+      bool treat_global_objects_as_roots = true);
 
   /**
    * Starts tracking of heap objects population statistics. After calling
diff --git a/deps/v8/include/v8-testing.h b/deps/v8/include/v8-testing.h
deleted file mode 100644
index f67bf2530d6bd8..00000000000000
--- a/deps/v8/include/v8-testing.h
+++ /dev/null
@@ -1,48 +0,0 @@
-// Copyright 2010 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_V8_TEST_H_
-#define V8_V8_TEST_H_
-
-#include "v8.h"  // NOLINT(build/include)
-
-/**
- * Testing support for the V8 JavaScript engine.
- */
-namespace v8 {
-
-class V8_EXPORT Testing {
- public:
-  enum StressType {
-    kStressTypeOpt,
-    kStressTypeDeopt
-  };
-
-  /**
-   * Set the type of stressing to do. The default if not set is kStressTypeOpt.
-   */
-  static void SetStressRunType(StressType type);
-
-  /**
-   * Get the number of runs of a given test that is required to get the full
-   * stress coverage.
-   */
-  static int GetStressRuns();
-
-  /**
-   * Indicate the number of the run which is about to start. The value of run
-   * should be between 0 and one less than the result from GetStressRuns()
-   */
-  static void PrepareStressRun(int run);
-
-  /**
-   * Force deoptimization of all functions.
-   */
-  static void DeoptimizeAll(Isolate* isolate);
-};
-
-
-}  // namespace v8
-
-#endif  // V8_V8_TEST_H_
diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
index e11961895d7f34..c2969d817cf0f6 100644
--- a/deps/v8/include/v8-version.h
+++ b/deps/v8/include/v8-version.h
@@ -8,10 +8,10 @@
 // These macros define the version number for the current version.
 // NOTE these macros are used by some of the tool scripts and the build
 // system so their names cannot be changed without changing the scripts.
-#define V8_MAJOR_VERSION 7
-#define V8_MINOR_VERSION 9
-#define V8_BUILD_NUMBER 317
-#define V8_PATCH_LEVEL 25
+#define V8_MAJOR_VERSION 8
+#define V8_MINOR_VERSION 1
+#define V8_BUILD_NUMBER 307
+#define V8_PATCH_LEVEL 20
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/include/v8.h b/deps/v8/include/v8.h
index 0b7f331c8c00c7..d6f60c25627748 100644
--- a/deps/v8/include/v8.h
+++ b/deps/v8/include/v8.h
@@ -9,7 +9,7 @@
  * This set of documents provides reference material generated from the
  * V8 header file, include/v8.h.
  *
- * For other documentation see http://code.google.com/apis/v8/
+ * For other documentation see https://v8.dev/.
  */
 
 #ifndef INCLUDE_V8_H_
@@ -216,9 +216,13 @@ class Local {
 
   /**
    * Checks whether two handles are the same.
-   * Returns true if both are empty, or if the objects
-   * to which they refer are identical.
-   * The handles' references are not checked.
+   * Returns true if both are empty, or if the objects to which they refer
+   * are identical.
+   *
+   * If both handles refer to JS objects, this is the same as strict equality.
+   * For primitives, such as numbers or strings, a `false` return value does not
+   * indicate that the values aren't equal in the JavaScript sense.
+   * Use `Value::StrictEquals()` to check primitives for equality.
    */
   template <class S>
   V8_INLINE bool operator==(const Local<S>& that) const {
@@ -242,7 +246,11 @@ class Local {
    * Checks whether two handles are different.
    * Returns true if only one of the handles is empty, or if
    * the objects to which they refer are different.
-   * The handles' references are not checked.
+   *
+   * If both handles refer to JS objects, this is the same as strict
+   * non-equality. For primitives, such as numbers or strings, a `true` return
+   * value does not indicate that the values aren't equal in the JavaScript
+   * sense. Use `Value::StrictEquals()` to check primitives for equality.
    */
   template <class S>
   V8_INLINE bool operator!=(const Local<S>& that) const {
@@ -883,19 +891,6 @@ class TracedReferenceBase {
    */
   V8_INLINE uint16_t WrapperClassId() const;
 
-  /**
-   * Adds a finalization callback to the handle. The type of this callback is
-   * similar to WeakCallbackType::kInternalFields, i.e., it will pass the
-   * parameter and the first two internal fields of the object.
-   *
-   * The callback is then supposed to reset the handle in the callback. No
-   * further V8 API may be called in this callback. In case additional work
-   * involving V8 needs to be done, a second callback can be scheduled using
-   * WeakCallbackInfo<void>::SetSecondPassCallback.
-   */
-  V8_INLINE void SetFinalizationCallback(
-      void* parameter, WeakCallbackInfo<void>::Callback callback);
-
   template <class S>
   V8_INLINE TracedReferenceBase<S>& As() const {
     return reinterpret_cast<TracedReferenceBase<S>&>(
@@ -1033,6 +1028,19 @@ class TracedGlobal : public TracedReferenceBase<T> {
     return reinterpret_cast<TracedGlobal<S>&>(
         const_cast<TracedGlobal<T>&>(*this));
   }
+
+  /**
+   * Adds a finalization callback to the handle. The type of this callback is
+   * similar to WeakCallbackType::kInternalFields, i.e., it will pass the
+   * parameter and the first two internal fields of the object.
+   *
+   * The callback is then supposed to reset the handle in the callback. No
+   * further V8 API may be called in this callback. In case additional work
+   * involving V8 needs to be done, a second callback can be scheduled using
+   * WeakCallbackInfo<void>::SetSecondPassCallback.
+   */
+  V8_INLINE void SetFinalizationCallback(
+      void* parameter, WeakCallbackInfo<void>::Callback callback);
 };
 
 /**
@@ -1040,6 +1048,11 @@ class TracedGlobal : public TracedReferenceBase<T> {
  * to ensure that the handle is not accessed once the V8 object has been
  * reclaimed. This can happen when the handle is not passed through the
  * EmbedderHeapTracer. For more details see TracedReferenceBase.
+ *
+ * The reference assumes the embedder has precise knowledge about references at
+ * all times. In case V8 needs to separately handle on-stack references, the
+ * embedder is required to set the stack start through
+ * |EmbedderHeapTracer::SetStackStart|.
  */
 template <typename T>
 class TracedReference : public TracedReferenceBase<T> {
@@ -1142,6 +1155,20 @@ class TracedReference : public TracedReferenceBase<T> {
     return reinterpret_cast<TracedReference<S>&>(
         const_cast<TracedReference<T>&>(*this));
   }
+
+  /**
+   * Adds a finalization callback to the handle. The type of this callback is
+   * similar to WeakCallbackType::kInternalFields, i.e., it will pass the
+   * parameter and the first two internal fields of the object.
+   *
+   * The callback is then supposed to reset the handle in the callback. No
+   * further V8 API may be called in this callback. In case additional work
+   * involving V8 needs to be done, a second callback can be scheduled using
+   * WeakCallbackInfo<void>::SetSecondPassCallback.
+   */
+  V8_DEPRECATED("Use TracedGlobal<> if callbacks are required.")
+  V8_INLINE void SetFinalizationCallback(
+      void* parameter, WeakCallbackInfo<void>::Callback callback);
 };
 
  /**
@@ -1746,11 +1773,9 @@ class V8_EXPORT ScriptCompiler {
    public:
     enum Encoding { ONE_BYTE, TWO_BYTE, UTF8 };
 
-#if defined(_MSC_VER) && _MSC_VER >= 1910 /* Disable on VS2015 */
     V8_DEPRECATE_SOON(
         "This class takes ownership of source_stream, so use the constructor "
         "taking a unique_ptr to make these semantics clearer")
-#endif
     StreamedSource(ExternalSourceStream* source_stream, Encoding encoding);
     StreamedSource(std::unique_ptr<ExternalSourceStream> source_stream,
                    Encoding encoding);
@@ -2001,6 +2026,12 @@ class V8_EXPORT Message {
    */
   int GetEndPosition() const;
 
+  /**
+   * Returns the Wasm function index where the error occurred. Returns -1 if
+   * message is not from a Wasm script.
+   */
+  int GetWasmFunctionIndex() const;
+
   /**
    * Returns the error level of the message.
    */
@@ -2033,6 +2064,7 @@ class V8_EXPORT Message {
   static const int kNoLineNumberInfo = 0;
   static const int kNoColumnInfo = 0;
   static const int kNoScriptIdInfo = 0;
+  static const int kNoWasmFunctionIndexInfo = -1;
 };
 
 
@@ -2202,6 +2234,14 @@ struct UnwindState {
   MemoryRange code_range;
   MemoryRange embedded_code_range;
   JSEntryStub js_entry_stub;
+  JSEntryStub js_construct_entry_stub;
+  JSEntryStub js_run_microtasks_entry_stub;
+};
+
+struct JSEntryStubs {
+  JSEntryStub js_entry_stub;
+  JSEntryStub js_construct_entry_stub;
+  JSEntryStub js_run_microtasks_entry_stub;
 };
 
 /**
@@ -2427,7 +2467,10 @@ class V8_EXPORT ValueDeserializer {
   /**
    * Expect inline wasm in the data stream (rather than in-memory transfer)
    */
-  void SetExpectInlineWasm(bool allow_inline_wasm);
+  V8_DEPRECATED(
+      "Wasm module serialization is only supported via explicit methods, e.g. "
+      "CompiledWasmModule::Serialize()")
+  void SetExpectInlineWasm(bool allow_inline_wasm) {}
 
   /**
    * Reads the underlying wire format version. Likely mostly to be useful to
@@ -2466,12 +2509,16 @@ class V8_EXPORT Value : public Data {
   /**
    * Returns true if this value is the undefined value.  See ECMA-262
    * 4.3.10.
+   *
+   * This is equivalent to `value === undefined` in JS.
    */
   V8_INLINE bool IsUndefined() const;
 
   /**
    * Returns true if this value is the null value.  See ECMA-262
    * 4.3.11.
+   *
+   * This is equivalent to `value === null` in JS.
    */
   V8_INLINE bool IsNull() const;
 
@@ -2479,37 +2526,56 @@ class V8_EXPORT Value : public Data {
    * Returns true if this value is either the null or the undefined value.
    * See ECMA-262
    * 4.3.11. and 4.3.12
+   *
+   * This is equivalent to `value == null` in JS.
    */
   V8_INLINE bool IsNullOrUndefined() const;
 
   /**
-  * Returns true if this value is true.
-  */
+   * Returns true if this value is true.
+   *
+   * This is not the same as `BooleanValue()`. The latter performs a
+   * conversion to boolean, i.e. the result of `Boolean(value)` in JS, whereas
+   * this checks `value === true`.
+   */
   bool IsTrue() const;
 
   /**
    * Returns true if this value is false.
+   *
+   * This is not the same as `!BooleanValue()`. The latter performs a
+   * conversion to boolean, i.e. the result of `!Boolean(value)` in JS, whereas
+   * this checks `value === false`.
    */
   bool IsFalse() const;
 
   /**
    * Returns true if this value is a symbol or a string.
+   *
+   * This is equivalent to
+   * `typeof value === 'string' || typeof value === 'symbol'` in JS.
    */
   bool IsName() const;
 
   /**
    * Returns true if this value is an instance of the String type.
    * See ECMA-262 8.4.
+   *
+   * This is equivalent to `typeof value === 'string'` in JS.
    */
   V8_INLINE bool IsString() const;
 
   /**
    * Returns true if this value is a symbol.
+   *
+   * This is equivalent to `typeof value === 'symbol'` in JS.
    */
   bool IsSymbol() const;
 
   /**
    * Returns true if this value is a function.
+   *
+   * This is equivalent to `typeof value === 'function'` in JS.
    */
   bool IsFunction() const;
 
@@ -2526,21 +2592,27 @@ class V8_EXPORT Value : public Data {
 
   /**
    * Returns true if this value is a bigint.
+   *
+   * This is equivalent to `typeof value === 'bigint'` in JS.
    */
   bool IsBigInt() const;
 
   /**
    * Returns true if this value is boolean.
+   *
+   * This is equivalent to `typeof value === 'boolean'` in JS.
    */
   bool IsBoolean() const;
 
   /**
    * Returns true if this value is a number.
+   *
+   * This is equivalent to `typeof value === 'number'` in JS.
    */
   bool IsNumber() const;
 
   /**
-   * Returns true if this value is external.
+   * Returns true if this value is an `External` object.
    */
   bool IsExternal() const;
 
@@ -2726,7 +2798,6 @@ class V8_EXPORT Value : public Data {
 
   /**
    * Returns true if this value is a SharedArrayBuffer.
-   * This is an experimental feature.
    */
   bool IsSharedArrayBuffer() const;
 
@@ -2735,6 +2806,12 @@ class V8_EXPORT Value : public Data {
    */
   bool IsProxy() const;
 
+  /**
+   * Returns true if this value is a WasmModuleObject.
+   */
+  bool IsWasmModuleObject() const;
+
+  V8_DEPRECATED("Use IsWasmModuleObject")
   bool IsWebAssemblyCompiledModule() const;
 
   /**
@@ -2742,22 +2819,57 @@ class V8_EXPORT Value : public Data {
    */
   bool IsModuleNamespaceObject() const;
 
+  /**
+   * Perform the equivalent of `BigInt(value)` in JS.
+   */
   V8_WARN_UNUSED_RESULT MaybeLocal<BigInt> ToBigInt(
       Local<Context> context) const;
+  /**
+   * Perform the equivalent of `Number(value)` in JS.
+   */
   V8_WARN_UNUSED_RESULT MaybeLocal<Number> ToNumber(
       Local<Context> context) const;
+  /**
+   * Perform the equivalent of `String(value)` in JS.
+   */
   V8_WARN_UNUSED_RESULT MaybeLocal<String> ToString(
       Local<Context> context) const;
+  /**
+   * Provide a string representation of this value usable for debugging.
+   * This operation has no observable side effects and will succeed
+   * unless e.g. execution is being terminated.
+   */
   V8_WARN_UNUSED_RESULT MaybeLocal<String> ToDetailString(
       Local<Context> context) const;
+  /**
+   * Perform the equivalent of `Object(value)` in JS.
+   */
   V8_WARN_UNUSED_RESULT MaybeLocal<Object> ToObject(
       Local<Context> context) const;
+  /**
+   * Perform the equivalent of `Number(value)` in JS and convert the result
+   * to an integer. Negative values are rounded up, positive values are rounded
+   * down. NaN is converted to 0. Infinite values yield undefined results.
+   */
   V8_WARN_UNUSED_RESULT MaybeLocal<Integer> ToInteger(
       Local<Context> context) const;
+  /**
+   * Perform the equivalent of `Number(value)` in JS and convert the result
+   * to an unsigned 32-bit integer by performing the steps in
+   * https://tc39.es/ecma262/#sec-touint32.
+   */
   V8_WARN_UNUSED_RESULT MaybeLocal<Uint32> ToUint32(
       Local<Context> context) const;
+  /**
+   * Perform the equivalent of `Number(value)` in JS and convert the result
+   * to a signed 32-bit integer by performing the steps in
+   * https://tc39.es/ecma262/#sec-toint32.
+   */
   V8_WARN_UNUSED_RESULT MaybeLocal<Int32> ToInt32(Local<Context> context) const;
 
+  /**
+   * Perform the equivalent of `Boolean(value)` in JS. This can never fail.
+   */
   Local<Boolean> ToBoolean(Isolate* isolate) const;
 
   /**
@@ -2767,13 +2879,18 @@ class V8_EXPORT Value : public Data {
   V8_WARN_UNUSED_RESULT MaybeLocal<Uint32> ToArrayIndex(
       Local<Context> context) const;
 
+  /** Returns the equivalent of `ToBoolean()->Value()`. */
   bool BooleanValue(Isolate* isolate) const;
 
+  /** Returns the equivalent of `ToNumber()->Value()`. */
   V8_WARN_UNUSED_RESULT Maybe<double> NumberValue(Local<Context> context) const;
+  /** Returns the equivalent of `ToInteger()->Value()`. */
   V8_WARN_UNUSED_RESULT Maybe<int64_t> IntegerValue(
       Local<Context> context) const;
+  /** Returns the equivalent of `ToUint32()->Value()`. */
   V8_WARN_UNUSED_RESULT Maybe<uint32_t> Uint32Value(
       Local<Context> context) const;
+  /** Returns the equivalent of `ToInt32()->Value()`. */
   V8_WARN_UNUSED_RESULT Maybe<int32_t> Int32Value(Local<Context> context) const;
 
   /** JS == */
@@ -2865,9 +2982,8 @@ enum class NewStringType {
  */
 class V8_EXPORT String : public Name {
  public:
-  static constexpr int kMaxLength = internal::kApiTaggedSize == 4
-                                        ? (1 << 28) - 16
-                                        : internal::kSmiMaxValue / 2 - 24;
+  static constexpr int kMaxLength =
+      internal::kApiSystemPointerSize == 4 ? (1 << 28) - 16 : (1 << 29) - 24;
 
   enum Encoding {
     UNKNOWN_ENCODING = 0x1,
@@ -3232,30 +3348,35 @@ class V8_EXPORT String : public Name {
 class V8_EXPORT Symbol : public Name {
  public:
   /**
-   * Returns the print name string of the symbol, or undefined if none.
+   * Returns the description string of the symbol, or undefined if none.
    */
-  Local<Value> Name() const;
+  Local<Value> Description() const;
+
+  V8_DEPRECATE_SOON("Use Symbol::Description()")
+  Local<Value> Name() const { return Description(); }
 
   /**
-   * Create a symbol. If name is not empty, it will be used as the description.
+   * Create a symbol. If description is not empty, it will be used as the
+   * description.
    */
   static Local<Symbol> New(Isolate* isolate,
-                           Local<String> name = Local<String>());
+                           Local<String> description = Local<String>());
 
   /**
    * Access global symbol registry.
    * Note that symbols created this way are never collected, so
    * they should only be used for statically fixed properties.
-   * Also, there is only one global name space for the names used as keys.
+   * Also, there is only one global name space for the descriptions used as
+   * keys.
    * To minimize the potential for clashes, use qualified names as keys.
    */
-  static Local<Symbol> For(Isolate *isolate, Local<String> name);
+  static Local<Symbol> For(Isolate* isolate, Local<String> description);
 
   /**
    * Retrieve a global symbol. Similar to |For|, but using a separate
    * registry that is not accessible by (and cannot clash with) JavaScript code.
    */
-  static Local<Symbol> ForApi(Isolate *isolate, Local<String> name);
+  static Local<Symbol> ForApi(Isolate* isolate, Local<String> description);
 
   // Well-known symbols
   static Local<Symbol> GetAsyncIterator(Isolate* isolate);
@@ -4136,7 +4257,10 @@ class FunctionCallbackInfo {
  public:
   /** The number of available arguments. */
   V8_INLINE int Length() const;
-  /** Accessor for the available arguments. */
+  /**
+   * Accessor for the available arguments. Returns `undefined` if the index
+   * is out of bounds.
+   */
   V8_INLINE Local<Value> operator[](int i) const;
   /** Returns the receiver. This corresponds to the "this" value. */
   V8_INLINE Local<Object> This() const;
@@ -4646,28 +4770,6 @@ class V8_EXPORT WasmModuleObject : public Object {
  public:
   WasmModuleObject() = delete;
 
-  /**
-   * An opaque, native heap object for transferring wasm modules. It
-   * supports move semantics, and does not support copy semantics.
-   */
-  using TransferrableModule = CompiledWasmModule;
-
-  /**
-   * Get an in-memory, non-persistable, and context-independent (meaning,
-   * suitable for transfer to another Isolate and Context) representation
-   * of this wasm compiled module.
-   */
-  V8_DEPRECATED("Use GetCompiledModule")
-  TransferrableModule GetTransferrableModule();
-
-  /**
-   * Efficiently re-create a WasmModuleObject, without recompiling, from
-   * a TransferrableModule.
-   */
-  V8_DEPRECATED("Use FromCompiledModule")
-  static MaybeLocal<WasmModuleObject> FromTransferrableModule(
-      Isolate* isolate, const TransferrableModule&);
-
   /**
    * Efficiently re-create a WasmModuleObject, without recompiling, from
    * a CompiledWasmModule.
@@ -4685,9 +4787,13 @@ class V8_EXPORT WasmModuleObject : public Object {
    * If possible, deserialize the module, otherwise compile it from the provided
    * uncompiled bytes.
    */
+  V8_DEPRECATED(
+      "Use WasmStreaming for deserialization from cache or the "
+      "CompiledWasmModule to transfer between isolates")
   static MaybeLocal<WasmModuleObject> DeserializeOrCompile(
       Isolate* isolate, MemorySpan<const uint8_t> serialized_module,
       MemorySpan<const uint8_t> wire_bytes);
+
   V8_INLINE static WasmModuleObject* Cast(Value* obj);
 
  private:
@@ -4763,6 +4869,12 @@ class V8_EXPORT WasmStreaming final {
    */
   void SetClient(std::shared_ptr<Client> client);
 
+  /*
+   * Sets the UTF-8 encoded source URL for the {Script} object. This must be
+   * called before {Finish}.
+   */
+  void SetUrl(const char* url, size_t length);
+
   /**
    * Unpacks a {WasmStreaming} object wrapped in a  {Managed} for the embedder.
    * Since the embedder is on the other side of the API, it cannot unpack the
@@ -4831,6 +4943,7 @@ enum class ArrayBufferCreationMode { kInternalized, kExternalized };
 
 /**
  * A wrapper around the backing store (i.e. the raw memory) of an array buffer.
+ * See a document linked in http://crbug.com/v8/9908 for more information.
  *
  * The allocation and destruction of backing stores is generally managed by
  * V8. Clients should always use standard C++ memory ownership types (i.e.
@@ -4857,7 +4970,17 @@ class V8_EXPORT BackingStore : public v8::internal::BackingStoreBase {
    */
   size_t ByteLength() const;
 
+  /**
+   * Indicates whether the backing store was created for an ArrayBuffer or
+   * a SharedArrayBuffer.
+   */
+  bool IsShared() const;
+
  private:
+  /**
+   * See [Shared]ArrayBuffer::GetBackingStore and
+   * [Shared]ArrayBuffer::NewBackingStore.
+   */
   BackingStore();
 };
 
@@ -5000,6 +5123,9 @@ class V8_EXPORT ArrayBuffer : public Object {
    * |Allocator::Free| once all ArrayBuffers referencing it are collected by
    * the garbage collector.
    */
+  V8_DEPRECATE_SOON(
+      "Use the version that takes a BackingStore. "
+      "See http://crbug.com/v8/9908.")
   static Local<ArrayBuffer> New(
       Isolate* isolate, void* data, size_t byte_length,
       ArrayBufferCreationMode mode = ArrayBufferCreationMode::kExternalized);
@@ -5046,6 +5172,9 @@ class V8_EXPORT ArrayBuffer : public Object {
    * Returns true if ArrayBuffer is externalized, that is, does not
    * own its memory block.
    */
+  V8_DEPRECATE_SOON(
+      "With v8::BackingStore externalized ArrayBuffers are "
+      "the same as ordinary ArrayBuffers. See http://crbug.com/v8/9908.")
   bool IsExternal() const;
 
   /**
@@ -5071,6 +5200,8 @@ class V8_EXPORT ArrayBuffer : public Object {
    * deleter, which will call ArrayBuffer::Allocator::Free if the buffer
    * was allocated with ArrayBuffer::Allocator::Allocate.
    */
+  V8_DEPRECATE_SOON(
+      "Use GetBackingStore or Detach. See http://crbug.com/v8/9908.")
   Contents Externalize();
 
   /**
@@ -5080,6 +5211,7 @@ class V8_EXPORT ArrayBuffer : public Object {
    * With the new lifetime management of backing stores there is no need for
    * externalizing, so this function exists only to make the transition easier.
    */
+  V8_DEPRECATE_SOON("This will be removed together with IsExternal.")
   void Externalize(const std::shared_ptr<BackingStore>& backing_store);
 
   /**
@@ -5090,6 +5222,7 @@ class V8_EXPORT ArrayBuffer : public Object {
    * The embedder should make sure to hold a strong reference to the
    * ArrayBuffer while accessing this pointer.
    */
+  V8_DEPRECATE_SOON("Use GetBackingStore. See http://crbug.com/v8/9908.")
   Contents GetContents();
 
   /**
@@ -5178,7 +5311,9 @@ class V8_EXPORT TypedArray : public ArrayBufferView {
   /*
    * The largest typed array size that can be constructed using New.
    */
-  static constexpr size_t kMaxLength = internal::kSmiMaxValue;
+  static constexpr size_t kMaxLength = internal::kApiSystemPointerSize == 4
+                                           ? internal::kSmiMaxValue
+                                           : 0xFFFFFFFF;
 
   /**
    * Number of elements in this typed array
@@ -5397,7 +5532,6 @@ class V8_EXPORT DataView : public ArrayBufferView {
 
 /**
  * An instance of the built-in SharedArrayBuffer constructor.
- * This API is experimental and may change significantly.
  */
 class V8_EXPORT SharedArrayBuffer : public Object {
  public:
@@ -5409,8 +5543,6 @@ class V8_EXPORT SharedArrayBuffer : public Object {
    * The Data pointer of ArrayBuffer::Contents must be freed using the provided
    * deleter, which will call ArrayBuffer::Allocator::Free if the buffer
    * was allocated with ArraryBuffer::Allocator::Allocate.
-   *
-   * This API is experimental and may change significantly.
    */
   class V8_EXPORT Contents {  // NOLINT
    public:
@@ -5473,6 +5605,9 @@ class V8_EXPORT SharedArrayBuffer : public Object {
    * specified. The memory block will not be reclaimed when a created
    * SharedArrayBuffer is garbage-collected.
    */
+  V8_DEPRECATE_SOON(
+      "Use the version that takes a BackingStore. "
+      "See http://crbug.com/v8/9908.")
   static Local<SharedArrayBuffer> New(
       Isolate* isolate, void* data, size_t byte_length,
       ArrayBufferCreationMode mode = ArrayBufferCreationMode::kExternalized);
@@ -5519,7 +5654,9 @@ class V8_EXPORT SharedArrayBuffer : public Object {
    * Create a new SharedArrayBuffer over an existing memory block. Propagate
    * flags to indicate whether the underlying buffer can be grown.
    */
-  V8_DEPRECATED("Use New method with data, and byte_length instead.")
+  V8_DEPRECATED(
+      "Use the version that takes a BackingStore. "
+      "See http://crbug.com/v8/9908.")
   static Local<SharedArrayBuffer> New(
       Isolate* isolate, const SharedArrayBuffer::Contents&,
       ArrayBufferCreationMode mode = ArrayBufferCreationMode::kExternalized);
@@ -5528,6 +5665,9 @@ class V8_EXPORT SharedArrayBuffer : public Object {
    * Returns true if SharedArrayBuffer is externalized, that is, does not
    * own its memory block.
    */
+  V8_DEPRECATE_SOON(
+      "With v8::BackingStore externalized SharedArrayBuffers are the same "
+      "as ordinary SharedArrayBuffers. See http://crbug.com/v8/9908.")
   bool IsExternal() const;
 
   /**
@@ -5542,6 +5682,8 @@ class V8_EXPORT SharedArrayBuffer : public Object {
    * v8::Isolate::CreateParams::array_buffer_allocator.
    *
    */
+  V8_DEPRECATE_SOON(
+      "Use GetBackingStore or Detach. See http://crbug.com/v8/9908.")
   Contents Externalize();
 
   /**
@@ -5551,6 +5693,7 @@ class V8_EXPORT SharedArrayBuffer : public Object {
    * With the new lifetime management of backing stores there is no need for
    * externalizing, so this function exists only to make the transition easier.
    */
+  V8_DEPRECATE_SOON("This will be removed together with IsExternal.")
   void Externalize(const std::shared_ptr<BackingStore>& backing_store);
 
   /**
@@ -5565,6 +5708,7 @@ class V8_EXPORT SharedArrayBuffer : public Object {
    * by the allocator specified in
    * v8::Isolate::CreateParams::array_buffer_allocator.
    */
+  V8_DEPRECATE_SOON("Use GetBackingStore. See http://crbug.com/v8/9908.")
   Contents GetContents();
 
   /**
@@ -5722,6 +5866,29 @@ class V8_EXPORT RegExp : public Object {
                                                       Local<String> pattern,
                                                       Flags flags);
 
+  /**
+   * Like New, but additionally specifies a backtrack limit. If the number of
+   * backtracks done in one Exec call hits the limit, a match failure is
+   * immediately returned.
+   */
+  static V8_WARN_UNUSED_RESULT MaybeLocal<RegExp> NewWithBacktrackLimit(
+      Local<Context> context, Local<String> pattern, Flags flags,
+      uint32_t backtrack_limit);
+
+  /**
+   * Executes the current RegExp instance on the given subject string.
+   * Equivalent to RegExp.prototype.exec as described in
+   *
+   *   https://tc39.es/ecma262/#sec-regexp.prototype.exec
+   *
+   * On success, an Array containing the matched strings is returned. On
+   * failure, returns Null.
+   *
+   * Note: modifies global context state, accessible e.g. through RegExp.input.
+   */
+  V8_WARN_UNUSED_RESULT MaybeLocal<Object> Exec(Local<Context> context,
+                                                Local<String> subject);
+
   /**
    * Returns the value of the source property: a string representing
    * the regular expression.
@@ -6242,6 +6409,7 @@ class V8_EXPORT FunctionTemplate : public Template {
       SideEffectType side_effect_type = SideEffectType::kHasSideEffect);
 
   /** Get a template included in the snapshot by index. */
+  V8_DEPRECATED("Use v8::Isolate::GetDataFromSnapshotOnce instead")
   static MaybeLocal<FunctionTemplate> FromSnapshot(Isolate* isolate,
                                                    size_t index);
 
@@ -6533,6 +6701,7 @@ class V8_EXPORT ObjectTemplate : public Template {
       Local<FunctionTemplate> constructor = Local<FunctionTemplate>());
 
   /** Get a template included in the snapshot by index. */
+  V8_DEPRECATED("Use v8::Isolate::GetDataFromSnapshotOnce instead")
   static MaybeLocal<ObjectTemplate> FromSnapshot(Isolate* isolate,
                                                  size_t index);
 
@@ -7122,6 +7291,7 @@ class PromiseRejectMessage {
 typedef void (*PromiseRejectCallback)(PromiseRejectMessage message);
 
 // --- Microtasks Callbacks ---
+V8_DEPRECATE_SOON("Use *WithData version.")
 typedef void (*MicrotasksCompletedCallback)(Isolate*);
 typedef void (*MicrotasksCompletedCallbackWithData)(Isolate*, void*);
 typedef void (*MicrotaskCallback)(void* data);
@@ -7275,8 +7445,23 @@ typedef void (*FailedAccessCheckCallback)(Local<Object> target,
  */
 typedef bool (*AllowCodeGenerationFromStringsCallback)(Local<Context> context,
                                                        Local<String> source);
-typedef MaybeLocal<String> (*ModifyCodeGenerationFromStringsCallback)(
-    Local<Context> context, Local<Value> source);
+
+struct ModifyCodeGenerationFromStringsResult {
+  // If true, proceed with the codegen algorithm. Otherwise, block it.
+  bool codegen_allowed = false;
+  // Overwrite the original source with this string, if present.
+  // Use the original source if empty.
+  // This field is considered only if codegen_allowed is true.
+  MaybeLocal<String> modified_source;
+};
+
+/**
+ * Callback to check if codegen is allowed from a source object, and convert
+ * the source to string if necessary.See  ModifyCodeGenerationFromStrings.
+ */
+typedef ModifyCodeGenerationFromStringsResult (
+    *ModifyCodeGenerationFromStringsCallback)(Local<Context> context,
+                                              Local<Value> source);
 
 // --- WebAssembly compilation callbacks ---
 typedef bool (*ExtensionCallback)(const FunctionCallbackInfo<Value>&);
@@ -7354,10 +7539,33 @@ typedef void (*InterruptCallback)(Isolate* isolate, void* data);
 typedef size_t (*NearHeapLimitCallback)(void* data, size_t current_heap_limit,
                                         size_t initial_heap_limit);
 
+/**
+ * Collection of shared per-process V8 memory information.
+ *
+ * Instances of this class can be passed to
+ * v8::V8::GetSharedMemoryStatistics to get shared memory statistics from V8.
+ */
+class V8_EXPORT SharedMemoryStatistics {
+ public:
+  SharedMemoryStatistics();
+  size_t read_only_space_size() { return read_only_space_size_; }
+  size_t read_only_space_used_size() { return read_only_space_used_size_; }
+  size_t read_only_space_physical_size() {
+    return read_only_space_physical_size_;
+  }
+
+ private:
+  size_t read_only_space_size_;
+  size_t read_only_space_used_size_;
+  size_t read_only_space_physical_size_;
+
+  friend class V8;
+};
+
 /**
  * Collection of V8 heap information.
  *
- * Instances of this class can be passed to v8::V8::HeapStatistics to
+ * Instances of this class can be passed to v8::Isolate::GetHeapStatistics to
  * get heap statistics from V8.
  */
 class V8_EXPORT HeapStatistics {
@@ -7513,6 +7721,20 @@ struct JitCodeEvent {
     PositionType position_type;
   };
 
+  struct wasm_source_info_t {
+    // Source file name.
+    const char* filename;
+    // Length of filename.
+    size_t filename_size;
+    // Line number table, which maps offsets of JITted code to line numbers of
+    // source file.
+    const line_info_t* line_number_table;
+    // Number of entries in the line number table.
+    size_t line_number_table_size;
+  };
+
+  wasm_source_info_t* wasm_source_info;
+
   union {
     // Only valid for CODE_ADDED.
     struct name_t name;
@@ -7661,6 +7883,17 @@ class V8_EXPORT EmbedderHeapTracer {
    */
   void IterateTracedGlobalHandles(TracedGlobalHandleVisitor* visitor);
 
+  /**
+   * Called by the embedder to set the start of the stack which is e.g. used by
+   * V8 to determine whether handles are used from stack or heap.
+   */
+  void SetStackStart(void* stack_start);
+
+  /**
+   * Called by the embedder to notify V8 of an empty execution stack.
+   */
+  void NotifyEmptyEmbedderStack();
+
   /**
    * Called by v8 to register internal fields of found wrappers.
    *
@@ -7670,8 +7903,6 @@ class V8_EXPORT EmbedderHeapTracer {
   virtual void RegisterV8References(
       const std::vector<std::pair<void*, void*> >& embedder_fields) = 0;
 
-  V8_DEPRECATE_SOON("Use version taking TracedReferenceBase<v8::Data> argument")
-  void RegisterEmbedderReference(const TracedReferenceBase<v8::Value>& ref);
   void RegisterEmbedderReference(const TracedReferenceBase<v8::Data>& ref);
 
   /**
@@ -7704,8 +7935,7 @@ class V8_EXPORT EmbedderHeapTracer {
    * overriden to fill a |TraceSummary| that is used by V8 to schedule future
    * garbage collections.
    */
-  V8_DEPRECATED("Use version with parameter.") virtual void TraceEpilogue() {}
-  virtual void TraceEpilogue(TraceSummary* trace_summary);
+  virtual void TraceEpilogue(TraceSummary* trace_summary) {}
 
   /**
    * Called upon entering the final marking pause. No more incremental marking
@@ -7756,10 +7986,6 @@ class V8_EXPORT EmbedderHeapTracer {
    */
   virtual void ResetHandleInNonTracingGC(
       const v8::TracedReference<v8::Value>& handle);
-  V8_DEPRECATE_SOON(
-      "Use TracedReference version when not requiring destructors.")
-  virtual void ResetHandleInNonTracingGC(
-      const v8::TracedGlobal<v8::Value>& handle);
 
   /*
    * Called by the embedder to immediately perform a full garbage collection.
@@ -7826,8 +8052,66 @@ struct DeserializeInternalFieldsCallback {
 };
 typedef DeserializeInternalFieldsCallback DeserializeEmbedderFieldsCallback;
 
+/**
+ * Controls how the default MeasureMemoryDelegate reports the result of
+ * the memory measurement to JS. With kSummary only the total size is reported.
+ * With kDetailed the result includes the size of each native context.
+ */
 enum class MeasureMemoryMode { kSummary, kDetailed };
 
+/**
+ * Controls how promptly a memory measurement request is executed.
+ * By default the measurement is folded with the next scheduled GC which may
+ * happen after a while. The kEager starts increment GC right away and
+ * is useful for testing.
+ */
+enum class MeasureMemoryExecution { kDefault, kEager };
+
+/**
+ * The delegate is used in Isolate::MeasureMemory API.
+ *
+ * It specifies the contexts that need to be measured and gets called when
+ * the measurement is completed to report the results.
+ */
+class V8_EXPORT MeasureMemoryDelegate {
+ public:
+  virtual ~MeasureMemoryDelegate() = default;
+
+  /**
+   * Returns true if the size of the given context needs to be measured.
+   */
+  virtual bool ShouldMeasure(Local<Context> context) = 0;
+
+  /**
+   * This function is called when memory measurement finishes.
+   *
+   * \param context_sizes_in_bytes a vector of (context, size) pairs that
+   *   includes each context for which ShouldMeasure returned true and that
+   *   was not garbage collected while the memory measurement was in progress.
+   *
+   * \param unattributed_size_in_bytes total size of objects that were not
+   *   attributed to any context (i.e. are likely shared objects).
+   */
+  virtual void MeasurementComplete(
+      const std::vector<std::pair<Local<Context>, size_t>>&
+          context_sizes_in_bytes,
+      size_t unattributed_size_in_bytes) = 0;
+
+  /**
+   * Returns a default delegate that resolves the given promise when
+   * the memory measurement completes.
+   *
+   * \param isolate the current isolate
+   * \param context the current context
+   * \param promise_resolver the promise resolver that is given the
+   *   result of the memory measurement.
+   * \param mode the detail level of the result.
+   */
+  static std::unique_ptr<MeasureMemoryDelegate> Default(
+      Isolate* isolate, Local<Context> context,
+      Local<Promise::Resolver> promise_resolver, MeasureMemoryMode mode);
+};
+
 /**
  * Isolate represents an isolated instance of the V8 engine.  V8 isolates have
  * completely separate states.  Objects from one isolate must not be used in
@@ -7988,8 +8272,8 @@ class V8_EXPORT Isolate {
    */
   class V8_EXPORT SuppressMicrotaskExecutionScope {
    public:
-    explicit SuppressMicrotaskExecutionScope(Isolate* isolate);
-    explicit SuppressMicrotaskExecutionScope(MicrotaskQueue* microtask_queue);
+    explicit SuppressMicrotaskExecutionScope(
+        Isolate* isolate, MicrotaskQueue* microtask_queue = nullptr);
     ~SuppressMicrotaskExecutionScope();
 
     // Prevent copying of Scope objects.
@@ -8118,6 +8402,10 @@ class V8_EXPORT Isolate {
     kCallSiteAPIGetFunctionSloppyCall = 76,
     kCallSiteAPIGetThisSloppyCall = 77,
     kRegExpMatchAllWithNonGlobalRegExp = 78,
+    kRegExpExecCalledOnSlowRegExp = 79,
+    kRegExpReplaceCalledOnSlowRegExp = 80,
+    kDisplayNames = 81,
+    kSharedArrayBufferConstructed = 82,
 
     // If you add new values here, you'll also need to update Chromium's:
     // web_feature.mojom, use_counter_callback.cc, and enums.xml. V8 changes to
@@ -8356,15 +8644,24 @@ class V8_EXPORT Isolate {
   bool GetHeapCodeAndMetadataStatistics(HeapCodeStatistics* object_statistics);
 
   /**
-   * Enqueues a memory measurement request for the given context and mode.
    * This API is experimental and may change significantly.
    *
-   * \param mode Indicates whether the result should include per-context
-   *   memory usage or just the total memory usage.
-   * \returns a promise that will be resolved with memory usage estimate.
+   * Enqueues a memory measurement request and invokes the delegate with the
+   * results.
+   *
+   * \param delegate the delegate that defines which contexts to measure and
+   *   reports the results.
+   *
+   * \param execution promptness executing the memory measurement.
+   *   The kEager value is expected to be used only in tests.
    */
-  v8::MaybeLocal<v8::Promise> MeasureMemory(v8::Local<v8::Context> context,
-                                            MeasureMemoryMode mode);
+  bool MeasureMemory(
+      std::unique_ptr<MeasureMemoryDelegate> delegate,
+      MeasureMemoryExecution execution = MeasureMemoryExecution::kDefault);
+
+  V8_DEPRECATE_SOON("Use the version with a delegate")
+  MaybeLocal<Promise> MeasureMemory(Local<Context> context,
+                                    MeasureMemoryMode mode);
 
   /**
    * Get a call stack sample from the isolate.
@@ -8919,8 +9216,32 @@ class V8_EXPORT Isolate {
   /**
    * Returns the UnwindState necessary for use with the Unwinder API.
    */
+  // TODO(petermarshall): Remove this API.
+  V8_DEPRECATE_SOON("Use entry_stubs + code_pages version.")
   UnwindState GetUnwindState();
 
+  /**
+   * Returns the JSEntryStubs necessary for use with the Unwinder API.
+   */
+  JSEntryStubs GetJSEntryStubs();
+
+  static constexpr size_t kMinCodePagesBufferSize = 32;
+
+  /**
+   * Copies the code heap pages currently in use by V8 into |code_pages_out|.
+   * |code_pages_out| must have at least kMinCodePagesBufferSize capacity and
+   * must be empty.
+   *
+   * Signal-safe, does not allocate, does not access the V8 heap.
+   * No code on the stack can rely on pages that might be missing.
+   *
+   * Returns the number of pages available to be copied, which might be greater
+   * than |capacity|. In this case, only |capacity| pages will be copied into
+   * |code_pages_out|. The caller should provide a bigger buffer on the next
+   * call in order to get all available code pages, but this is not required.
+   */
+  size_t CopyCodePages(size_t capacity, MemoryRange* code_pages_out);
+
   /** Set the callback to invoke in case of fatal errors. */
   void SetFatalErrorHandler(FatalErrorCallback that);
 
@@ -8956,6 +9277,9 @@ class V8_EXPORT Isolate {
    * Set the callback to invoke to check if code generation from
    * strings should be allowed.
    */
+  V8_DEPRECATED(
+      "Use Isolate::SetModifyCodeGenerationFromStringsCallback instead. "
+      "See http://crbug.com/v8/10096.")
   void SetAllowCodeGenerationFromStringsCallback(
       AllowCodeGenerationFromStringsCallback callback);
   void SetModifyCodeGenerationFromStringsCallback(
@@ -9179,8 +9503,6 @@ class V8_EXPORT V8 {
    *   handled entirely on the embedders' side.
    * - The call will abort if the data is invalid.
    */
-  V8_DEPRECATED("The natives blob is deprecated (https://crbug.com/v8/7624).")
-  static void SetNativesDataBlob(StartupData* startup_blob);
   static void SetSnapshotDataBlob(StartupData* startup_blob);
 
   /** Set the callback to invoke in case of Dcheck failures. */
@@ -9265,18 +9587,14 @@ class V8_EXPORT V8 {
    * V8 needs to be given those external files during startup. There are
    * three ways to do this:
    * - InitializeExternalStartupData(const char*)
-   *   This will look in the given directory for files "natives_blob.bin"
-   *   and "snapshot_blob.bin" - which is what the default build calls them.
-   * - InitializeExternalStartupData(const char*, const char*)
-   *   As above, but will directly use the two given file names.
-   * - Call SetNativesDataBlob, SetNativesDataBlob.
-   *   This will read the blobs from the given data structures and will
+   *   This will look in the given directory for the file "snapshot_blob.bin".
+   * - InitializeExternalStartupDataFromFile(const char*)
+   *   As above, but will directly use the given file name.
+   * - Call SetSnapshotDataBlob.
+   *   This will read the blobs from the given data structure and will
    *   not perform any file IO.
    */
   static void InitializeExternalStartupData(const char* directory_path);
-  V8_DEPRECATED("The natives blob is deprecated (https://crbug.com/v8/7624).")
-  static void InitializeExternalStartupData(const char* natives_blob,
-                                            const char* snapshot_blob);
   static void InitializeExternalStartupDataFromFile(const char* snapshot_blob);
 
   /**
@@ -9337,6 +9655,11 @@ class V8_EXPORT V8 {
       UnhandledExceptionCallback unhandled_exception_callback);
 #endif
 
+  /**
+   * Get statistics about the shared memory usage.
+   */
+  static void GetSharedMemoryStatistics(SharedMemoryStatistics* statistics);
+
  private:
   V8();
 
@@ -9458,6 +9781,7 @@ class V8_EXPORT SnapshotCreator {
    * Add a template to be included in the snapshot blob.
    * \returns the index of the template in the snapshot blob.
    */
+  V8_DEPRECATED("use AddData instead")
   size_t AddTemplate(Local<Template> template_obj);
 
   /**
@@ -9680,9 +10004,17 @@ class V8_EXPORT TryCatch {
   Local<Value> Exception() const;
 
   /**
-   * Returns the .stack property of the thrown object.  If no .stack
+   * Returns the .stack property of an object.  If no .stack
    * property is present an empty handle is returned.
    */
+  V8_WARN_UNUSED_RESULT static MaybeLocal<Value> StackTrace(
+      Local<Context> context, Local<Value> exception);
+
+  /**
+   * Returns the .stack property of the thrown object.  If no .stack property is
+   * present or if this try/catch block has not caught an exception, an empty
+   * handle is returned.
+   */
   V8_WARN_UNUSED_RESULT MaybeLocal<Value> StackTrace(
       Local<Context> context) const;
 
@@ -10197,7 +10529,7 @@ class V8_EXPORT Locker {
 /**
  * Various helpers for skipping over V8 frames in a given stack.
  *
- * The unwinder API is only supported on the x64 architecture.
+ * The unwinder API is only supported on the x64, ARM64 and ARM32 architectures.
  */
 class V8_EXPORT Unwinder {
  public:
@@ -10229,10 +10561,26 @@ class V8_EXPORT Unwinder {
    *
    * \return True on success.
    */
+  // TODO(petermarshall): Remove this API
+  V8_DEPRECATE_SOON("Use entry_stubs + code_pages version.")
   static bool TryUnwindV8Frames(const UnwindState& unwind_state,
                                 RegisterState* register_state,
                                 const void* stack_base);
 
+  /**
+   * The same as above, but is available on x64, ARM64 and ARM32.
+   *
+   * \param code_pages A list of all of the ranges in which V8 has allocated
+   * executable code. The caller should obtain this list by calling
+   * Isolate::CopyCodePages() during the same interrupt/thread suspension that
+   * captures the stack.
+   */
+  static bool TryUnwindV8Frames(const JSEntryStubs& entry_stubs,
+                                size_t code_pages_length,
+                                const MemoryRange* code_pages,
+                                RegisterState* register_state,
+                                const void* stack_base);
+
   /**
    * Whether the PC is within the V8 code range represented by code_range or
    * embedded_code_range in |unwind_state|.
@@ -10241,7 +10589,16 @@ class V8_EXPORT Unwinder {
    * and unwind_state will always fail. If it returns true, then unwinding may
    * (but not necessarily) be successful.
    */
+  // TODO(petermarshall): Remove this API
+  V8_DEPRECATE_SOON("Use code_pages version.")
   static bool PCIsInV8(const UnwindState& unwind_state, void* pc);
+
+  /**
+   * The same as above, but is available on x64, ARM64 and ARM32. See the
+   * comment on TryUnwindV8Frames.
+   */
+  static bool PCIsInV8(size_t code_pages_length, const MemoryRange* code_pages,
+                       void* pc);
 };
 
 // --- Implementation ---
@@ -10484,14 +10841,9 @@ TracedGlobal<T>& TracedGlobal<T>::operator=(const TracedGlobal<S>& rhs) {
 template <class T>
 TracedGlobal<T>& TracedGlobal<T>::operator=(TracedGlobal&& rhs) {
   if (this != &rhs) {
-    this->Reset();
-    if (rhs.val_ != nullptr) {
-      this->val_ = rhs.val_;
       V8::MoveTracedGlobalReference(
           reinterpret_cast<internal::Address**>(&rhs.val_),
           reinterpret_cast<internal::Address**>(&this->val_));
-      rhs.val_ = nullptr;
-    }
   }
   return *this;
 }
@@ -10539,14 +10891,9 @@ TracedReference<T>& TracedReference<T>::operator=(
 template <class T>
 TracedReference<T>& TracedReference<T>::operator=(TracedReference&& rhs) {
   if (this != &rhs) {
-    this->Reset();
-    if (rhs.val_ != nullptr) {
-      this->val_ = rhs.val_;
-      V8::MoveTracedGlobalReference(
-          reinterpret_cast<internal::Address**>(&rhs.val_),
-          reinterpret_cast<internal::Address**>(&this->val_));
-      rhs.val_ = nullptr;
-    }
+    V8::MoveTracedGlobalReference(
+        reinterpret_cast<internal::Address**>(&rhs.val_),
+        reinterpret_cast<internal::Address**>(&this->val_));
   }
   return *this;
 }
@@ -10583,10 +10930,17 @@ uint16_t TracedReferenceBase<T>::WrapperClassId() const {
 }
 
 template <class T>
-void TracedReferenceBase<T>::SetFinalizationCallback(
+void TracedGlobal<T>::SetFinalizationCallback(
+    void* parameter, typename WeakCallbackInfo<void>::Callback callback) {
+  V8::SetFinalizationCallbackTraced(
+      reinterpret_cast<internal::Address*>(this->val_), parameter, callback);
+}
+
+template <class T>
+void TracedReference<T>::SetFinalizationCallback(
     void* parameter, typename WeakCallbackInfo<void>::Callback callback) {
-  V8::SetFinalizationCallbackTraced(reinterpret_cast<internal::Address*>(val_),
-                                    parameter, callback);
+  V8::SetFinalizationCallbackTraced(
+      reinterpret_cast<internal::Address*>(this->val_), parameter, callback);
 }
 
 template <typename T>
@@ -10901,7 +11255,7 @@ Local<Value> Object::GetInternalField(int index) {
 #ifdef V8_COMPRESS_POINTERS
     // We read the full pointer value and then decompress it in order to avoid
     // dealing with potential endiannes issues.
-    value = I::DecompressTaggedAnyField(obj, static_cast<int32_t>(value));
+    value = I::DecompressTaggedAnyField(obj, static_cast<uint32_t>(value));
 #endif
     internal::Isolate* isolate =
         internal::IsolateFromNeverReadOnlySpaceObject(obj);
@@ -11546,7 +11900,7 @@ Local<Value> Context::GetEmbedderData(int index) {
   // We read the full pointer value and then decompress it in order to avoid
   // dealing with potential endiannes issues.
   value =
-      I::DecompressTaggedAnyField(embedder_data, static_cast<int32_t>(value));
+      I::DecompressTaggedAnyField(embedder_data, static_cast<uint32_t>(value));
 #endif
   internal::Isolate* isolate = internal::IsolateFromNeverReadOnlySpaceObject(
       *reinterpret_cast<A*>(this));
diff --git a/deps/v8/include/v8config.h b/deps/v8/include/v8config.h
index 882dc8a23c60af..40d23c35c186e4 100644
--- a/deps/v8/include/v8config.h
+++ b/deps/v8/include/v8config.h
@@ -290,9 +290,9 @@
 // GCC doc: https://gcc.gnu.org/onlinedocs/gcc/Labels-as-Values.html
 # define V8_HAS_COMPUTED_GOTO 1
 
-# if __cplusplus >= 201402L
-#  define V8_CAN_HAVE_DCHECK_IN_CONSTEXPR 1
-# endif
+// Whether constexpr has full C++14 semantics, in particular that non-constexpr
+// code is allowed as long as it's not executed for any constexpr instantiation.
+# define V8_HAS_CXX14_CONSTEXPR 1
 
 #elif defined(__GNUC__)
 
@@ -311,22 +311,26 @@
 // always_inline is available in gcc 4.0 but not very reliable until 4.4.
 // Works around "sorry, unimplemented: inlining failed" build errors with
 // older compilers.
-# define V8_HAS_ATTRIBUTE_ALWAYS_INLINE (V8_GNUC_PREREQ(4, 4, 0))
-# define V8_HAS_ATTRIBUTE_NOINLINE (V8_GNUC_PREREQ(3, 4, 0))
-# define V8_HAS_ATTRIBUTE_UNUSED (V8_GNUC_PREREQ(2, 95, 0))
-# define V8_HAS_ATTRIBUTE_VISIBILITY (V8_GNUC_PREREQ(4, 3, 0))
-# define V8_HAS_ATTRIBUTE_WARN_UNUSED_RESULT \
-    (!V8_CC_INTEL && V8_GNUC_PREREQ(4, 1, 0))
-
-# define V8_HAS_BUILTIN_ASSUME_ALIGNED (V8_GNUC_PREREQ(4, 7, 0))
-# define V8_HAS_BUILTIN_CLZ (V8_GNUC_PREREQ(3, 4, 0))
-# define V8_HAS_BUILTIN_CTZ (V8_GNUC_PREREQ(3, 4, 0))
-# define V8_HAS_BUILTIN_EXPECT (V8_GNUC_PREREQ(2, 96, 0))
-# define V8_HAS_BUILTIN_FRAME_ADDRESS (V8_GNUC_PREREQ(2, 96, 0))
-# define V8_HAS_BUILTIN_POPCOUNT (V8_GNUC_PREREQ(3, 4, 0))
+# define V8_HAS_ATTRIBUTE_ALWAYS_INLINE 1
+# define V8_HAS_ATTRIBUTE_NOINLINE 1
+# define V8_HAS_ATTRIBUTE_UNUSED 1
+# define V8_HAS_ATTRIBUTE_VISIBILITY 1
+# define V8_HAS_ATTRIBUTE_WARN_UNUSED_RESULT (!V8_CC_INTEL)
+
+# define V8_HAS_BUILTIN_ASSUME_ALIGNED 1
+# define V8_HAS_BUILTIN_CLZ 1
+# define V8_HAS_BUILTIN_CTZ 1
+# define V8_HAS_BUILTIN_EXPECT 1
+# define V8_HAS_BUILTIN_FRAME_ADDRESS 1
+# define V8_HAS_BUILTIN_POPCOUNT 1
 
 // GCC doc: https://gcc.gnu.org/onlinedocs/gcc/Labels-as-Values.html
-#define V8_HAS_COMPUTED_GOTO (V8_GNUC_PREREQ(2, 0, 0))
+#define V8_HAS_COMPUTED_GOTO 1
+
+// Whether constexpr has full C++14 semantics, in particular that non-constexpr
+// code is allowed as long as it's not executed for any constexpr instantiation.
+// GCC only supports this since version 6.
+# define V8_HAS_CXX14_CONSTEXPR (V8_GNUC_PREREQ(6, 0, 0))
 
 #endif
 
@@ -374,12 +378,11 @@
 
 
 // A macro used to tell the compiler to never inline a particular function.
-// Don't bother for debug builds.
 // Use like:
 //   V8_NOINLINE int GetMinusOne() { return -1; }
-#if !defined(DEBUG) && V8_HAS_ATTRIBUTE_NOINLINE
+#if V8_HAS_ATTRIBUTE_NOINLINE
 # define V8_NOINLINE __attribute__((noinline))
-#elif !defined(DEBUG) && V8_HAS_DECLSPEC_NOINLINE
+#elif V8_HAS_DECLSPEC_NOINLINE
 # define V8_NOINLINE __declspec(noinline)
 #else
 # define V8_NOINLINE /* NOT SUPPORTED */
diff --git a/deps/v8/infra/mb/gn_isolate_map.pyl b/deps/v8/infra/mb/gn_isolate_map.pyl
index 110b36c500bbd7..6aa0de2358abf0 100644
--- a/deps/v8/infra/mb/gn_isolate_map.pyl
+++ b/deps/v8/infra/mb/gn_isolate_map.pyl
@@ -75,8 +75,12 @@
     "label": "//test/unittests:unittests",
     "type": "script",
   },
+  "fuchsia-unittests": {
+    "label": "//test/unittests:v8_unittests_fuchsia",
+    "type": "script",
+  },
   "webkit": {
     "label": "//test/webkit:v8_webkit",
     "type": "script",
   },
-}
\ No newline at end of file
+}
diff --git a/deps/v8/infra/mb/mb_config.pyl b/deps/v8/infra/mb/mb_config.pyl
index fed7fa24bfc098..95723ea0792ae0 100644
--- a/deps/v8/infra/mb/mb_config.pyl
+++ b/deps/v8/infra/mb/mb_config.pyl
@@ -51,8 +51,6 @@
       # Linux.
       'V8 Linux - builder': 'release_x86_gcmole',
       'V8 Linux - debug builder': 'debug_x86',
-      'V8 Linux - nosnap builder': 'release_x86_no_snap',
-      'V8 Linux - nosnap debug builder': 'debug_x86_no_snap',
       'V8 Linux - shared': 'release_x86_shared_verify_heap',
       'V8 Linux - noi18n - debug': 'debug_x86_no_i18n',
       'V8 Linux - verify csa': 'release_x86_verify_csa',
@@ -64,16 +62,9 @@
       'V8 Linux64 - debug - header includes': 'debug_x64_header_includes',
       'V8 Linux64 - shared': 'release_x64_shared_verify_heap',
       'V8 Linux64 - verify csa': 'release_x64_verify_csa',
-      # Jumbo.
-      'V8 Linux64 Jumbo': 'release_x64_jumbo',
-      'V8 Linux64 Jumbo - debug': 'debug_x64_jumbo',
-      'V8 Linux64 Jumbo - limited': 'release_x64_jumbo_limited',
-      'V8 Linux64 Jumbo - limited - debug': 'debug_x64_jumbo_limited',
       # Windows.
       'V8 Win32 - builder': 'release_x86_minimal_symbols',
       'V8 Win32 - debug builder': 'debug_x86_minimal_symbols',
-      'V8 Win32 - nosnap - shared':
-        'release_x86_no_snap_shared_minimal_symbols',
       # TODO(machenbach): Remove after switching to x64 on infra side.
       'V8 Win64 ASAN': 'release_x64_asan_no_lsan',
       'V8 Win64': 'release_x64_minimal_symbols',
@@ -99,8 +90,8 @@
           'release_x64_pointer_compression_without_dchecks',
       'V8 Linux64 - arm64 - sim - pointer compression - builder':
           'release_simulate_arm64_pointer_compression',
-      'V8 Fuchsia': 'release_x64_fuchsia',
-      'V8 Fuchsia - debug': 'debug_x64_fuchsia',
+      'V8 Fuchsia - builder': 'release_x64_fuchsia',
+      'V8 Fuchsia - debug builder': 'debug_x64_fuchsia',
       'V8 Linux64 - cfi': 'release_x64_cfi',
       'V8 Linux64 UBSan': 'release_x64_ubsan',
       'V8 Linux - vtunejit': 'debug_x86_vtunejit',
@@ -118,28 +109,36 @@
       'V8 Clusterfuzz Win64 ASAN - debug builder':
         'release_x64_asan_no_lsan_verify_heap_dchecks',
       'V8 Clusterfuzz Mac64 ASAN - release builder':
-          'release_x64_asan_no_lsan_edge_verify_heap',
+          'release_x64_asan_no_lsan_verify_heap',
       'V8 Clusterfuzz Mac64 ASAN - debug builder':
-          'debug_x64_asan_no_lsan_static_edge',
+          'debug_x64_asan_no_lsan_static',
       'V8 Clusterfuzz Linux64 - release builder':
           'release_x64_correctness_fuzzer',
       'V8 Clusterfuzz Linux64 - debug builder': 'debug_x64',
       'V8 Clusterfuzz Linux64 ASAN no inline - release builder':
-          'release_x64_asan_symbolized_edge_verify_heap',
-      'V8 Clusterfuzz Linux64 ASAN - debug builder': 'debug_x64_asan_edge',
+          'release_x64_asan_symbolized_verify_heap',
+      'V8 Clusterfuzz Linux64 ASAN - debug builder': 'debug_x64_asan',
       'V8 Clusterfuzz Linux64 ASAN arm64 - debug builder':
-          'debug_simulate_arm64_asan_edge',
+          'debug_simulate_arm64_asan',
       'V8 Clusterfuzz Linux ASAN arm - debug builder':
-          'debug_simulate_arm_asan_edge',
+          'debug_simulate_arm_asan',
       'V8 Clusterfuzz Linux64 CFI - release builder':
           'release_x64_cfi_clusterfuzz',
       'V8 Clusterfuzz Linux MSAN no origins':
-          'release_simulate_arm64_msan_no_origins_edge',
+          'release_simulate_arm64_msan_no_origins',
       'V8 Clusterfuzz Linux MSAN chained origins':
-          'release_simulate_arm64_msan_edge',
+          'release_simulate_arm64_msan',
       'V8 Clusterfuzz Linux64 TSAN - release builder': 'release_x64_tsan',
       'V8 Clusterfuzz Linux64 UBSan - release builder':
-          'release_x64_ubsan_recover_edge',
+          'release_x64_ubsan_recover',
+    },
+    'client.v8.perf' : {
+      'V8 Arm - builder - perf': 'official_arm',
+      'V8 Arm64 - builder - perf': 'official_arm64',
+      'V8 Android Arm - builder - perf': 'official_android_arm',
+      'V8 Android Arm64 - builder - perf': 'official_android_arm64',
+      'V8 Linux - builder - perf': 'official_x86',
+      'V8 Linux64 - builder - perf': 'official_x64',
     },
     'client.v8.ports': {
       # Arm.
@@ -156,8 +155,6 @@
       'V8 Arm64 - builder': 'release_arm64',
       'V8 Linux - arm64 - sim': 'release_simulate_arm64',
       'V8 Linux - arm64 - sim - debug': 'debug_simulate_arm64',
-      'V8 Linux - arm64 - sim - nosnap - debug':
-          'debug_simulate_arm64_no_snap',
       'V8 Linux - arm64 - sim - gc stress': 'debug_simulate_arm64',
       # Mips.
       'V8 Linux - mipsel - sim - builder': 'release_simulate_mipsel',
@@ -192,6 +189,7 @@
       'v8_android_arm_compile_rel': 'release_android_arm',
       'v8_android_arm64_compile_dbg': 'debug_android_arm64',
       'v8_android_arm64_n5x_rel_ng': 'release_android_arm64',
+      'v8_fuchsia_compile_rel': 'release_x64_fuchsia_trybot',
       'v8_fuchsia_rel_ng': 'release_x64_fuchsia_trybot',
       'v8_ios_simulator': 'release_x64_ios_simulator',
       'v8_linux_rel_ng': 'release_x86_gcmole_trybot',
@@ -202,8 +200,6 @@
       'v8_linux_noi18n_compile_dbg': 'debug_x86_no_i18n',
       'v8_linux_noi18n_rel_ng': 'release_x86_no_i18n_trybot',
       'v8_linux_gc_stress_dbg': 'debug_x86_trybot',
-      'v8_linux_nosnap_rel': 'release_x86_no_snap_trybot',
-      'v8_linux_nosnap_dbg': 'debug_x86_no_snap_trybot',
       'v8_linux_gcc_compile_rel': 'release_x86_gcc_minimal_symbols',
       'v8_linux_gcc_rel': 'release_x86_gcc_minimal_symbols',
       'v8_linux_shared_compile_rel': 'release_x86_shared_verify_heap',
@@ -226,19 +222,16 @@
       'v8_linux64_msan_rel': 'release_simulate_arm64_msan_minimal_symbols',
       'v8_linux64_sanitizer_coverage_rel':
           'release_x64_asan_minimal_symbols_coverage',
-      'v8_linux64_jumbo_compile_rel': 'release_x64_jumbo_trybot',
-      'v8_linux64_jumbo_limited_compile_rel': 'release_x64_jumbo_limited_trybot',
       'v8_linux64_tsan_rel': 'release_x64_tsan_minimal_symbols',
       'v8_linux64_tsan_isolates_rel_ng':
           'release_x64_tsan_minimal_symbols',
       'v8_linux64_ubsan_rel_ng': 'release_x64_ubsan_minimal_symbols',
       'v8_odroid_arm_rel_ng': 'release_arm',
+      'v8_linux_torque_compare': 'torque_compare',
       # TODO(machenbach): Remove after switching to x64 on infra side.
       'v8_win_dbg': 'debug_x86_trybot',
       'v8_win_compile_dbg': 'debug_x86_trybot',
       'v8_win_rel_ng': 'release_x86_trybot',
-      'v8_win_nosnap_shared_rel_ng':
-        'release_x86_no_snap_shared_minimal_symbols',
       'v8_win64_asan_rel_ng': 'release_x64_asan_no_lsan',
       'v8_win64_msvc_compile_rel': 'release_x64_msvc',
       'v8_win64_dbg': 'debug_x64_minimal_symbols',
@@ -340,17 +333,14 @@
     # Debug configs for simulators.
     'debug_simulate_arm': [
       'debug_bot', 'simulate_arm'],
-    'debug_simulate_arm_asan_edge': [
-      'debug_bot', 'simulate_arm', 'asan', 'edge'],
+    'debug_simulate_arm_asan': [
+      'debug_bot', 'simulate_arm', 'asan'],
     'debug_simulate_arm_lite': [
       'debug_bot', 'simulate_arm', 'v8_enable_lite_mode'],
     'debug_simulate_arm64': [
       'debug_bot', 'simulate_arm64'],
-    'debug_simulate_arm64_asan_edge': [
-      'debug_bot', 'simulate_arm64', 'asan', 'lsan', 'edge'],
-    'debug_simulate_arm64_no_snap': [
-      'debug', 'simulate_arm64', 'shared', 'goma', 'v8_optimized_debug',
-      'v8_snapshot_none'],
+    'debug_simulate_arm64_asan': [
+      'debug_bot', 'simulate_arm64', 'asan', 'lsan'],
 
     # Release configs for simulators.
     'release_simulate_arm': [
@@ -364,16 +354,19 @@
     'release_simulate_arm64': [
       'release_bot', 'simulate_arm64'],
     'release_simulate_arm64_pointer_compression': [
+      # TODO(v8:v7703): Make pointer compression bots testing non pointer
+      # compression mode while pointer compression is temporarily enabled
+      # on arm64
       'release_bot', 'simulate_arm64', 'dcheck_always_on',
-      'v8_enable_slow_dchecks', 'v8_enable_pointer_compression'],
+      'v8_enable_slow_dchecks', 'v8_disable_pointer_compression'],
     'release_simulate_arm64_msan': [
       'release_bot', 'simulate_arm64', 'msan'],
     'release_simulate_arm64_msan_minimal_symbols': [
       'release_bot', 'simulate_arm64', 'msan', 'minimal_symbols'],
-    'release_simulate_arm64_msan_edge': [
-      'release_bot', 'simulate_arm64', 'edge', 'msan'],
-    'release_simulate_arm64_msan_no_origins_edge': [
-      'release_bot', 'simulate_arm64', 'edge', 'msan_no_origins'],
+    'release_simulate_arm64_msan': [
+      'release_bot', 'simulate_arm64', 'msan'],
+    'release_simulate_arm64_msan_no_origins': [
+      'release_bot', 'simulate_arm64', 'msan_no_origins'],
     'release_simulate_arm64_trybot': [
       'release_trybot', 'simulate_arm64'],
     'release_simulate_mipsel': [
@@ -403,6 +396,18 @@
       'release_bot', 'arm64', 'android', 'minimal_symbols',
       'android_strip_outputs'],
 
+    # Official configs for arm
+    'official_arm': [
+      'release_bot', 'arm', 'hard_float', 'official'],
+    'official_arm64': [
+      'release_bot', 'arm64', 'hard_float', 'official'],
+    'official_android_arm': [
+      'release_bot', 'arm', 'android', 'minimal_symbols',
+      'android_strip_outputs', 'official'],
+    'official_android_arm64': [
+      'release_bot', 'arm64', 'android', 'minimal_symbols',
+      'android_strip_outputs', 'official'],
+
     # Release configs for x64.
     'release_x64': [
       'release_bot', 'x64'],
@@ -414,15 +419,15 @@
       'release_bot', 'x64', 'asan', 'bb', 'coverage', 'lsan', 'minimal_symbols'],
     'release_x64_asan_no_lsan': [
       'release_bot', 'x64', 'asan'],
-    'release_x64_asan_no_lsan_edge_verify_heap': [
-      'release_bot', 'x64', 'asan', 'edge', 'v8_verify_heap'],
+    'release_x64_asan_no_lsan_verify_heap': [
+      'release_bot', 'x64', 'asan', 'v8_verify_heap'],
     'release_x64_asan_no_lsan_verify_heap': [
       'release_bot', 'x64', 'asan', 'v8_verify_heap'],
     'release_x64_asan_no_lsan_verify_heap_dchecks': [
       'release_bot', 'x64', 'asan', 'dcheck_always_on',
       'v8_enable_slow_dchecks', 'v8_verify_heap'],
-    'release_x64_asan_symbolized_edge_verify_heap': [
-      'release_bot', 'x64', 'asan', 'edge', 'lsan', 'symbolized',
+    'release_x64_asan_symbolized_verify_heap': [
+      'release_bot', 'x64', 'asan', 'lsan', 'symbolized',
       'v8_verify_heap'],
     'release_x64_cfi': [
       'release_bot', 'x64', 'cfi'],
@@ -443,21 +448,13 @@
       'release_bot', 'x64', 'ios_simulator'],
     'release_x64_internal': [
       'release_bot', 'x64', 'v8_snapshot_internal'],
-    'release_x64_jumbo': [
-      'release_bot', 'x64', 'jumbo'],
-    'release_x64_jumbo_trybot': [
-      'release_trybot', 'x64', 'jumbo'],
-    'release_x64_jumbo_limited': [
-      'release_bot', 'x64', 'jumbo_limited'],
-    'release_x64_jumbo_limited_trybot': [
-      'release_trybot', 'x64', 'jumbo_limited'],
     'release_x64_minimal_symbols': [
       'release_bot', 'x64', 'minimal_symbols'],
     'release_x64_pointer_compression': [
       'release_bot', 'x64', 'dcheck_always_on', 'v8_enable_slow_dchecks',
-      'v8_enable_pointer_compression'],
+      'v8_disable_pointer_compression'],
     'release_x64_pointer_compression_without_dchecks': [
-      'release_bot', 'x64', 'v8_enable_pointer_compression'],
+      'release_bot', 'x64', 'v8_disable_pointer_compression'],
     'release_x64_trybot': [
       'release_trybot', 'x64'],
     'release_x64_test_features_trybot': [
@@ -470,22 +467,26 @@
       'release_bot', 'x64', 'ubsan'],
     'release_x64_ubsan_minimal_symbols': [
       'release_bot', 'x64', 'ubsan', 'minimal_symbols'],
-    'release_x64_ubsan_recover_edge': [
-      'release_bot', 'x64', 'edge', 'ubsan_recover'],
+    'release_x64_ubsan_recover': [
+      'release_bot', 'x64', 'ubsan_recover'],
     'release_x64_shared_verify_heap': [
       'release_bot', 'x64', 'shared', 'v8_verify_heap'],
     'release_x64_verify_csa': [
       'release_bot', 'x64', 'dcheck_always_on',
       'v8_enable_slow_dchecks', 'v8_verify_csa'],
 
+    # Official configs for x64.
+    'official_x64': [
+      'release_bot', 'x64', 'official'],
+
     # Debug configs for x64.
     'debug_x64': [
       'debug_bot', 'x64'],
-    'debug_x64_asan_edge': [
-      'debug_bot', 'x64', 'asan', 'lsan', 'edge'],
-    'debug_x64_asan_no_lsan_static_edge': [
+    'debug_x64_asan': [
+      'debug_bot', 'x64', 'asan', 'lsan'],
+    'debug_x64_asan_no_lsan_static': [
       'debug', 'static', 'goma', 'v8_enable_slow_dchecks', 'v8_optimized_debug',
-      'x64', 'asan', 'edge'],
+      'x64', 'asan'],
     'debug_x64_custom': [
       'debug_bot', 'x64', 'v8_snapshot_custom'],
     'debug_x64_fuchsia': [
@@ -494,10 +495,6 @@
       'debug_bot', 'x64', 'gcc', 'v8_check_header_includes'],
     'debug_x64_header_includes': [
       'debug_bot', 'x64', 'v8_check_header_includes'],
-    'debug_x64_jumbo': [
-      'debug_bot', 'x64', 'jumbo'],
-    'debug_x64_jumbo_limited': [
-      'debug_bot', 'x64', 'jumbo_limited'],
     'debug_x64_minimal_symbols': [
       'debug_bot', 'x64', 'minimal_symbols'],
     'debug_x64_perfetto': [
@@ -514,10 +511,6 @@
       'debug_bot', 'x86', 'minimal_symbols'],
     'debug_x86_no_i18n': [
       'debug_bot', 'x86', 'v8_no_i18n'],
-    'debug_x86_no_snap': [
-      'debug_bot', 'x86', 'v8_snapshot_none'],
-    'debug_x86_no_snap_trybot': [
-      'debug_trybot', 'x86', 'v8_snapshot_none'],
     'debug_x86_trybot': [
       'debug_trybot', 'x86'],
     'debug_x86_vtunejit': [
@@ -541,13 +534,6 @@
       'release_bot', 'x86', 'minimal_symbols'],
     'release_x86_no_i18n_trybot': [
       'release_trybot', 'x86', 'v8_no_i18n'],
-    'release_x86_no_snap': [
-      'release_bot', 'x86', 'v8_snapshot_none'],
-    'release_x86_no_snap_shared_minimal_symbols': [
-      'release', 'x86', 'goma', 'minimal_symbols', 'shared',
-      'v8_snapshot_none'],
-    'release_x86_no_snap_trybot': [
-      'release_trybot', 'x86', 'v8_snapshot_none'],
     'release_x86_predictable': [
       'release_bot', 'x86', 'v8_enable_verify_predictable'],
     'release_x86_shared_verify_heap': [
@@ -557,6 +543,14 @@
     'release_x86_verify_csa': [
       'release_bot', 'x86', 'dcheck_always_on',
       'v8_enable_slow_dchecks', 'v8_verify_csa'],
+
+    # Official configs for x86.
+    'official_x86': [
+        'release_bot', 'x86', 'official'],
+
+    # Torque compare test
+    'torque_compare': [
+        'release_bot', 'verify_torque']
   },
 
   'mixins': {
@@ -623,10 +617,6 @@
       'mixins': ['debug_bot', 'minimal_symbols'],
     },
 
-    'edge': {
-      'gn_args': 'sanitizer_coverage_flags="trace-pc-guard"',
-    },
-
     'fuchsia': {
       'gn_args': 'target_os="fuchsia"',
     },
@@ -651,14 +641,6 @@
       'gn_args': 'target_cpu="x64" target_os="ios"',
     },
 
-    'jumbo': {
-      'gn_args': 'use_jumbo_build=true',
-    },
-
-    'jumbo_limited': {
-      'gn_args': 'use_jumbo_build=true jumbo_file_merge_limit=50',
-    },
-
     'lsan': {
       'mixins': ['v8_enable_test_features'],
       'gn_args': 'is_lsan=true',
@@ -714,6 +696,10 @@
       'mixins': ['release_bot', 'minimal_symbols', 'dcheck_always_on'],
     },
 
+    'official': {
+      'gn_args': 'is_official_build=true',
+    },
+
     'shared': {
       'gn_args': 'is_component_build=true',
     },
@@ -788,8 +774,8 @@
       'gn_args': 'v8_enable_slow_dchecks=true',
     },
 
-    'v8_enable_pointer_compression': {
-      'gn_args': 'v8_enable_pointer_compression=true',
+    'v8_disable_pointer_compression': {
+      'gn_args': 'v8_enable_pointer_compression=false',
     },
 
     'v8_enable_test_features': {
@@ -801,7 +787,7 @@
     },
 
     'v8_enable_vtunejit': {
-      'gn_args': 'v8_enable_vtunejit=true',
+      'gn_args': 'v8_enable_vtunejit=true v8_enable_vtunetracemark=true',
     },
 
     'v8_full_debug': {
@@ -825,10 +811,6 @@
       'gn_args': 'v8_use_external_startup_data=false',
     },
 
-    # TODO(https://crbug.com/v8/8531): Remove this config and all bots, since
-    #                                  no-snapshot was deprecated and removed.
-    'v8_snapshot_none': {},
-
     'v8_verify_heap': {
       'gn_args': 'v8_enable_verify_heap=true',
     },
@@ -853,6 +835,10 @@
       'gn_args': 'target_cpu="x86"',
     },
 
+    'verify_torque': {
+      'gn_args': 'v8_verify_torque_generation_invariance=true',
+    },
+
     'sample': {
       'gn_args': 'v8_monolithic=true is_component_build=false '
                  'v8_use_external_startup_data=false use_custom_libcxx=false',
diff --git a/deps/v8/infra/testing/builders.pyl b/deps/v8/infra/testing/builders.pyl
index 1b805df9599d12..0e4ac9d875ea33 100644
--- a/deps/v8/infra/testing/builders.pyl
+++ b/deps/v8/infra/testing/builders.pyl
@@ -47,6 +47,24 @@
     ],
   },
   ##############################################################################
+  # Fuchsia
+  'v8_fuchsia_rel_ng_triggered': {
+    'swarming_dimensions' : {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'fuchsia-unittests'},
+    ],
+  },
+  'V8 Fuchsia': {
+    'swarming_dimensions' : {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'fuchsia-unittests'},
+    ],
+  },
+  ##############################################################################
   # Linux32
   'v8_linux_dbg_ng_triggered': {
     'swarming_dimensions' : {
@@ -108,22 +126,6 @@
       {'name': 'v8testing', 'variant': 'default', 'shards': 2},
     ],
   },
-  'v8_linux_nosnap_rel': {
-    'swarming_dimensions' : {
-      'os': 'Ubuntu-16.04',
-    },
-    'tests': [
-      {'name': 'v8testing', 'variant': 'default', 'shards': 6},
-    ],
-  },
-  'v8_linux_nosnap_dbg': {
-    'swarming_task_attrs': {
-      'hard_timeout': 3600,
-    },
-    'tests': [
-      {'name': 'v8testing', 'variant': 'default', 'shards': 9},
-    ],
-  },
   'v8_linux_rel_ng_triggered': {
     'swarming_dimensions' : {
       'cpu': 'x86-64-avx2',
@@ -141,7 +143,7 @@
       {'name': 'test262', 'variant': 'extra', 'shards': 3},
       {'name': 'v8testing', 'shards': 2},
       {'name': 'v8testing', 'suffix': 'isolates', 'test_args': ['--isolates'], 'shards': 2},
-      {'name': 'v8testing', 'variant': 'extra'},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
     ],
   },
   'v8_linux_optional_rel_ng_triggered': {
@@ -255,7 +257,7 @@
     'tests': [
       {'name': 'test262', 'shards': 7},
       {'name': 'v8testing', 'shards': 3},
-      {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 3},
       {'name': 'v8testing', 'variant': 'slow_path'},
     ],
   },
@@ -268,7 +270,7 @@
       {'name': 'mozilla'},
       {'name': 'optimize_for_size'},
       {'name': 'test262', 'variant': 'default'},
-      {'name': 'v8testing', 'shards': 2},
+      {'name': 'v8testing', 'shards': 3},
     ],
   },
   'v8_linux64_dbg_ng_triggered': {
@@ -285,8 +287,9 @@
       {'name': 'test262', 'variant': 'default'},
       {'name': 'test262', 'variant': 'extra', 'shards': 3},
       {'name': 'v8testing', 'shards': 3},
-      {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 3},
       {'name': 'v8testing', 'variant': 'minor_mc', 'shards': 1},
+      {'name': 'v8testing', 'variant': 'stress_instruction_scheduling'},
     ],
   },
   'v8_linux64_gc_stress_custom_snapshot_dbg_ng_triggered': {
@@ -343,6 +346,7 @@
       {'name': 'v8testing', 'shards': 2},
       {'name': 'v8testing', 'variant': 'assert_types'},
       {'name': 'v8testing', 'variant': 'extra'},
+      {'name': 'v8testing', 'variant': 'stress_instruction_scheduling'},
     ],
   },
   'v8_linux64_perfetto_dbg_ng_triggered': {
@@ -375,9 +379,10 @@
       {'name': 'test262', 'variant': 'extra', 'shards': 3},
       {'name': 'v8initializers'},
       {'name': 'v8testing', 'shards': 2},
-      {'name': 'v8testing', 'variant': 'extra'},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
       {'name': 'v8testing', 'variant': 'minor_mc'},
       {'name': 'v8testing', 'variant': 'slow_path'},
+      {'name': 'v8testing', 'variant': 'stress_instruction_scheduling'},
     ],
   },
   # TODO(machenbach): Experimental builder with incomplete configs. Should be
@@ -445,11 +450,11 @@
     },
     'tests': [
       {'name': 'mjsunit_sp_frame_access'},
-      {'name': 'mozilla', 'shards': 2},
-      {'name': 'test262', 'variant': 'default', 'shards': 2},
-      {'name': 'v8testing', 'shards': 10},
-      {'name': 'v8testing', 'variant': 'extra', 'shards': 6},
-      {'name': 'v8testing', 'variant': 'trusted', 'shards': 3},
+      {'name': 'mozilla', 'shards': 4},
+      {'name': 'test262', 'variant': 'default', 'shards': 4},
+      {'name': 'v8testing', 'shards': 12},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 8},
+      {'name': 'v8testing', 'variant': 'trusted', 'shards': 5},
     ],
   },
   'v8_linux_arm64_gc_stress_dbg': {
@@ -457,7 +462,7 @@
       'os': 'Ubuntu-16.04',
     },
     'tests': [
-      {'name': 'd8testing', 'test_args': ['--gc-stress'], 'shards': 10},
+      {'name': 'd8testing', 'test_args': ['--gc-stress'], 'shards': 12},
     ],
   },
   'v8_linux_arm64_rel_ng_triggered': {
@@ -465,12 +470,12 @@
       'os': 'Ubuntu-16.04',
     },
     'tests': [
-      {'name': 'mjsunit_sp_frame_access', 'shards': 2},
-      {'name': 'mozilla', 'shards': 2},
-      {'name': 'test262', 'variant': 'default', 'shards': 2},
+      {'name': 'mjsunit_sp_frame_access', 'shards': 4},
+      {'name': 'mozilla', 'shards': 4},
+      {'name': 'test262', 'variant': 'default', 'shards': 4},
       {'name': 'v8testing', 'shards': 12},
-      {'name': 'v8testing', 'variant': 'extra', 'shards': 8},
-      {'name': 'v8testing', 'variant': 'trusted', 'shards': 3},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 10},
+      {'name': 'v8testing', 'variant': 'trusted', 'shards': 5},
     ],
   },
   'v8_linux64_arm64_pointer_compression_rel_ng_triggered': {
@@ -511,15 +516,6 @@
       {'name': 'v8testing', 'shards': 3},
     ],
   },
-  'v8_win_nosnap_shared_rel_ng_triggered': {
-    'swarming_dimensions' : {
-      'cpu': 'x86-64',
-      'os': 'Windows-7-SP1',
-    },
-    'tests': [
-      {'name': 'v8testing', 'variant': 'default', 'shards': 4},
-    ],
-  },
   'v8_win_rel_ng_triggered': {
     'swarming_dimensions' : {
       'cpu': 'x86-64',
@@ -714,7 +710,7 @@
         'test_args': ['--isolates'],
         'shards': 4
       },
-      {'name': 'v8testing', 'variant': 'extra'},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
       # Nosse3.
       {
         'name': 'mozilla',
@@ -794,34 +790,6 @@
       {'name': 'v8testing', 'variant': 'default'},
     ],
   },
-  'V8 Linux - nosnap': {
-    'swarming_dimensions': {
-      'os': 'Ubuntu-16.04',
-    },
-    'swarming_task_attrs': {
-      'expiration': 14400,
-      'hard_timeout': 3600,
-      'priority': 35,
-    },
-    'tests': [
-      {'name': 'mozilla', 'variant': 'default'},
-      {'name': 'test262', 'variant': 'default', 'shards': 6},
-      {'name': 'v8testing', 'variant': 'default', 'shards': 3},
-    ],
-  },
-  'V8 Linux - nosnap - debug': {
-    'swarming_dimensions': {
-      'os': 'Ubuntu-16.04',
-    },
-    'swarming_task_attrs': {
-      'expiration': 14400,
-      'hard_timeout': 3600,
-      'priority': 35,
-    },
-    'tests': [
-      {'name': 'v8testing', 'variant': 'default', 'shards': 12},
-    ],
-  },
   'V8 Linux - predictable': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -882,6 +850,7 @@
       {'name': 'v8testing', 'variant': 'assert_types'},
       {'name': 'v8testing', 'variant': 'extra'},
       {'name': 'v8testing', 'variant': 'minor_mc', 'shards': 1},
+      {'name': 'v8testing', 'variant': 'stress_instruction_scheduling'},
       # Noavx.
       {
         'name': 'mozilla',
@@ -910,7 +879,7 @@
       {'name': 'mozilla'},
       {'name': 'optimize_for_size'},
       {'name': 'test262', 'variant': 'default'},
-      {'name': 'v8testing'},
+      {'name': 'v8testing', 'shards': 2},
     ],
   },
   'V8 Linux64 - custom snapshot - debug': {
@@ -936,9 +905,10 @@
       {'name': 'test262', 'shards': 5},
       {'name': 'test262', 'variant': 'extra', 'shards': 3},
       {'name': 'v8testing', 'shards': 2},
-      {'name': 'v8testing', 'variant': 'extra'},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
       {'name': 'v8testing', 'variant': 'minor_mc', 'shards': 1},
       {'name': 'v8testing', 'variant': 'slow_path', 'shards': 1},
+      {'name': 'v8testing', 'variant': 'stress_instruction_scheduling'},
       # Noavx.
       {
         'name': 'mozilla',
@@ -1045,7 +1015,7 @@
     'tests': [
       {'name': 'test262', 'shards': 5},
       {'name': 'v8testing', 'shards': 2},
-      {'name': 'v8testing', 'variant': 'extra'},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
       {'name': 'v8testing', 'variant': 'slow_path', 'shards': 1},
     ],
   },
@@ -1188,15 +1158,6 @@
       {'name': 'v8testing', 'shards': 5},
     ],
   },
-  'V8 Win32 - nosnap - shared': {
-    'swarming_dimensions': {
-      'cpu': 'x86-64',
-      'os': 'Windows-7-SP1',
-    },
-    'tests': [
-      {'name': 'v8testing', 'variant': 'default', 'shards': 2},
-    ],
-  },
   'V8 Win64': {
     'swarming_dimensions': {
       'os': 'Windows-10-15063',
@@ -1337,8 +1298,8 @@
       {'name': 'mjsunit_sp_frame_access'},
       {'name': 'mozilla'},
       {'name': 'test262', 'variant': 'default'},
-      {'name': 'v8testing', 'shards': 4},
-      {'name': 'v8testing', 'variant': 'extra'},
+      {'name': 'v8testing', 'shards': 6},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 3},
       {'name': 'v8testing', 'variant': 'trusted'},
       # Armv8-a.
       {
@@ -1374,7 +1335,7 @@
         'name': 'v8testing',
         'suffix': 'novfp3',
         'test_args': ['--novfp3'],
-        'shards': 4
+        'shards': 6
       },
     ],
   },
@@ -1383,25 +1344,25 @@
       'os': 'Ubuntu-16.04',
     },
     'tests': [
-      {'name': 'mjsunit_sp_frame_access', 'shards': 4},
-      {'name': 'mozilla', 'shards': 4},
+      {'name': 'mjsunit_sp_frame_access', 'shards': 6},
+      {'name': 'mozilla', 'shards': 6},
       {'name': 'test262', 'variant': 'default'},
-      {'name': 'v8testing', 'shards': 8},
-      {'name': 'v8testing', 'variant': 'extra', 'shards': 6},
-      {'name': 'v8testing', 'variant': 'trusted', 'shards': 2},
+      {'name': 'v8testing', 'shards': 10},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 8},
+      {'name': 'v8testing', 'variant': 'trusted', 'shards': 4},
       # Armv8-a.
       {
         'name': 'mozilla',
         'suffix': 'armv8-a',
         'test_args': ['--extra-flags', '--enable-armv8'],
-        'shards': 3,
+        'shards': 5,
       },
       {
         'name': 'test262',
         'suffix': 'armv8-a',
         'variant': 'default',
         'test_args': ['--extra-flags', '--enable-armv8'],
-        'shards': 3,
+        'shards': 5,
       },
       {
         'name': 'v8testing',
diff --git a/deps/v8/src/DEPS b/deps/v8/src/DEPS
index 1ae6a569e70e0f..3e802dac975826 100644
--- a/deps/v8/src/DEPS
+++ b/deps/v8/src/DEPS
@@ -16,6 +16,8 @@ include_rules = [
   "+src/heap/heap-inl.h",
   "+src/heap/heap-write-barrier-inl.h",
   "+src/heap/heap-write-barrier.h",
+  "+src/heap/off-thread-factory-inl.h",
+  "+src/heap/off-thread-factory.h",
   "+src/heap/read-only-heap-inl.h",
   "+src/heap/read-only-heap.h",
   "-src/inspector",
diff --git a/deps/v8/src/api/OWNERS b/deps/v8/src/api/OWNERS
index f51e220309656a..4e36be20e867ca 100644
--- a/deps/v8/src/api/OWNERS
+++ b/deps/v8/src/api/OWNERS
@@ -5,7 +5,6 @@ jkummerow@chromium.org
 leszeks@chromium.org
 mlippautz@chromium.org
 mslekova@chromium.org
-mstarzinger@chromium.org
 verwaest@chromium.org
 
 # COMPONENT: Blink>JavaScript>API
diff --git a/deps/v8/src/api/api-inl.h b/deps/v8/src/api/api-inl.h
index 1a6b512e83a651..217d21222def88 100644
--- a/deps/v8/src/api/api-inl.h
+++ b/deps/v8/src/api/api-inl.h
@@ -17,14 +17,14 @@ namespace v8 {
 template <typename T>
 inline T ToCData(v8::internal::Object obj) {
   STATIC_ASSERT(sizeof(T) == sizeof(v8::internal::Address));
-  if (obj == v8::internal::Smi::kZero) return nullptr;
+  if (obj == v8::internal::Smi::zero()) return nullptr;
   return reinterpret_cast<T>(
       v8::internal::Foreign::cast(obj).foreign_address());
 }
 
 template <>
 inline v8::internal::Address ToCData(v8::internal::Object obj) {
-  if (obj == v8::internal::Smi::kZero) return v8::internal::kNullAddress;
+  if (obj == v8::internal::Smi::zero()) return v8::internal::kNullAddress;
   return v8::internal::Foreign::cast(obj).foreign_address();
 }
 
@@ -32,7 +32,7 @@ template <typename T>
 inline v8::internal::Handle<v8::internal::Object> FromCData(
     v8::internal::Isolate* isolate, T obj) {
   STATIC_ASSERT(sizeof(T) == sizeof(v8::internal::Address));
-  if (obj == nullptr) return handle(v8::internal::Smi::kZero, isolate);
+  if (obj == nullptr) return handle(v8::internal::Smi::zero(), isolate);
   return isolate->factory()->NewForeign(
       reinterpret_cast<v8::internal::Address>(obj));
 }
@@ -41,7 +41,7 @@ template <>
 inline v8::internal::Handle<v8::internal::Object> FromCData(
     v8::internal::Isolate* isolate, v8::internal::Address obj) {
   if (obj == v8::internal::kNullAddress) {
-    return handle(v8::internal::Smi::kZero, isolate);
+    return handle(v8::internal::Smi::zero(), isolate);
   }
   return isolate->factory()->NewForeign(obj);
 }
@@ -66,6 +66,7 @@ inline Local<To> Utils::Convert(v8::internal::Handle<From> obj) {
     return Convert<v8::internal::JSTypedArray, v8::Type##Array>(obj); \
   }
 
+MAKE_TO_LOCAL(ToLocal, AccessorPair, debug::AccessorPair)
 MAKE_TO_LOCAL(ToLocal, Context, Context)
 MAKE_TO_LOCAL(ToLocal, Object, Value)
 MAKE_TO_LOCAL(ToLocal, Module, Module)
diff --git a/deps/v8/src/api/api-natives.cc b/deps/v8/src/api/api-natives.cc
index b96b6fc4f62b2e..410c37ce98d754 100644
--- a/deps/v8/src/api/api-natives.cc
+++ b/deps/v8/src/api/api-natives.cc
@@ -111,8 +111,8 @@ MaybeHandle<Object> DefineDataProperty(Isolate* isolate,
   ASSIGN_RETURN_ON_EXCEPTION(isolate, value,
                              Instantiate(isolate, prop_data, name), Object);
 
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, object, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
 
 #ifdef DEBUG
   Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
@@ -300,8 +300,8 @@ MaybeHandle<JSObject> ProbeInstantiationsCache(
       (serial_number <= TemplateInfo::kSlowTemplateInstantiationsCacheSize)) {
     SimpleNumberDictionary slow_cache =
         native_context->slow_template_instantiations_cache();
-    int entry = slow_cache.FindEntry(isolate, serial_number);
-    if (entry != SimpleNumberDictionary::kNotFound) {
+    InternalIndex entry = slow_cache.FindEntry(isolate, serial_number);
+    if (entry.is_found()) {
       return handle(JSObject::cast(slow_cache.ValueAt(entry)), isolate);
     }
   }
@@ -348,8 +348,8 @@ void UncacheTemplateInstantiation(Isolate* isolate,
               TemplateInfo::kSlowTemplateInstantiationsCacheSize)) {
     Handle<SimpleNumberDictionary> cache =
         handle(native_context->slow_template_instantiations_cache(), isolate);
-    int entry = cache->FindEntry(isolate, serial_number);
-    DCHECK_NE(SimpleNumberDictionary::kNotFound, entry);
+    InternalIndex entry = cache->FindEntry(isolate, serial_number);
+    DCHECK(entry.is_found());
     cache = SimpleNumberDictionary::DeleteEntry(isolate, cache, entry);
     native_context->set_slow_template_instantiations_cache(*cache);
   }
@@ -439,15 +439,14 @@ MaybeHandle<JSObject> InstantiateObject(Isolate* isolate,
 
 namespace {
 MaybeHandle<Object> GetInstancePrototype(Isolate* isolate,
-                                         Object function_template) {
+                                         Handle<Object> function_template) {
   // Enter a new scope.  Recursion could otherwise create a lot of handles.
   HandleScope scope(isolate);
   Handle<JSFunction> parent_instance;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, parent_instance,
       InstantiateFunction(
-          isolate,
-          handle(FunctionTemplateInfo::cast(function_template), isolate)),
+          isolate, Handle<FunctionTemplateInfo>::cast(function_template)),
       JSFunction);
   Handle<Object> instance_prototype;
   // TODO(cbruni): decide what to do here.
@@ -474,10 +473,11 @@ MaybeHandle<JSFunction> InstantiateFunction(
   }
   Handle<Object> prototype;
   if (!data->remove_prototype()) {
-    Object prototype_templ = data->GetPrototypeTemplate();
-    if (prototype_templ.IsUndefined(isolate)) {
-      Object protoype_provider_templ = data->GetPrototypeProviderTemplate();
-      if (protoype_provider_templ.IsUndefined(isolate)) {
+    Handle<Object> prototype_templ(data->GetPrototypeTemplate(), isolate);
+    if (prototype_templ->IsUndefined(isolate)) {
+      Handle<Object> protoype_provider_templ(
+          data->GetPrototypeProviderTemplate(), isolate);
+      if (protoype_provider_templ->IsUndefined(isolate)) {
         prototype = isolate->factory()->NewJSObject(isolate->object_function());
       } else {
         ASSIGN_RETURN_ON_EXCEPTION(
@@ -487,14 +487,13 @@ MaybeHandle<JSFunction> InstantiateFunction(
     } else {
       ASSIGN_RETURN_ON_EXCEPTION(
           isolate, prototype,
-          InstantiateObject(
-              isolate,
-              handle(ObjectTemplateInfo::cast(prototype_templ), isolate),
-              Handle<JSReceiver>(), true),
+          InstantiateObject(isolate,
+                            Handle<ObjectTemplateInfo>::cast(prototype_templ),
+                            Handle<JSReceiver>(), true),
           JSFunction);
     }
-    Object parent = data->GetParentTemplate();
-    if (!parent.IsUndefined(isolate)) {
+    Handle<Object> parent(data->GetParentTemplate(), isolate);
+    if (!parent->IsUndefined(isolate)) {
       Handle<Object> parent_prototype;
       ASSIGN_RETURN_ON_EXCEPTION(isolate, parent_prototype,
                                  GetInstancePrototype(isolate, parent),
diff --git a/deps/v8/src/api/api.cc b/deps/v8/src/api/api.cc
index eed4ee6d9d290a..7fe974de24e8db 100644
--- a/deps/v8/src/api/api.cc
+++ b/deps/v8/src/api/api.cc
@@ -4,15 +4,16 @@
 
 #include "src/api/api.h"
 
-#include <string.h>  // For memcpy, strlen.
-#include <cmath>     // For isnan.
+#include <algorithm>  // For min
+#include <cmath>      // For isnan.
 #include <limits>
+#include <string>
+#include <utility>  // For move
 #include <vector>
 
 #include "src/api/api-inl.h"
 
 #include "include/v8-profiler.h"
-#include "include/v8-testing.h"
 #include "include/v8-util.h"
 #include "src/api/api-natives.h"
 #include "src/base/functional.h"
@@ -91,9 +92,9 @@
 #include "src/profiler/heap-snapshot-generator-inl.h"
 #include "src/profiler/profile-generator-inl.h"
 #include "src/profiler/tick-sample.h"
+#include "src/regexp/regexp-utils.h"
 #include "src/runtime/runtime.h"
 #include "src/snapshot/code-serializer.h"
-#include "src/snapshot/natives.h"
 #include "src/snapshot/partial-serializer.h"
 #include "src/snapshot/read-only-serializer.h"
 #include "src/snapshot/snapshot.h"
@@ -111,7 +112,7 @@
 #include "src/wasm/wasm-result.h"
 #include "src/wasm/wasm-serialization.h"
 
-#if V8_OS_LINUX || V8_OS_MACOSX
+#if V8_OS_LINUX || V8_OS_MACOSX || V8_OS_FREEBSD
 #include <signal.h>
 #include "include/v8-wasm-trap-handler-posix.h"
 #include "src/trap-handler/handler-inside-posix.h"
@@ -464,7 +465,7 @@ void i::V8::FatalProcessOutOfMemory(i::Isolate* isolate, const char* location,
 }
 
 void Utils::ReportApiFailure(const char* location, const char* message) {
-  i::Isolate* isolate = i::Isolate::Current();
+  i::Isolate* isolate = i::Isolate::TryGetCurrent();
   FatalErrorCallback callback = nullptr;
   if (isolate != nullptr) {
     callback = isolate->exception_behavior();
@@ -510,10 +511,6 @@ static inline bool IsExecutionTerminatingCheck(i::Isolate* isolate) {
   return false;
 }
 
-void V8::SetNativesDataBlob(StartupData* natives_blob) {
-  i::V8::SetNativesBlob(natives_blob);
-}
-
 void V8::SetSnapshotDataBlob(StartupData* snapshot_blob) {
   i::V8::SetSnapshotBlob(snapshot_blob);
 }
@@ -1036,6 +1033,10 @@ i::Address* V8::GlobalizeTracedReference(i::Isolate* isolate, i::Address* obj,
                                          internal::Address* slot,
                                          bool has_destructor) {
   LOG_API(isolate, TracedGlobal, New);
+#ifdef DEBUG
+  Utils::ApiCheck((slot != nullptr), "v8::GlobalizeTracedReference",
+                  "the address slot must be not null");
+#endif
   i::Handle<i::Object> result =
       isolate->global_handles()->CreateTraced(*obj, slot, has_destructor);
 #ifdef VERIFY_HEAP
@@ -1349,7 +1350,7 @@ void Template::Set(v8::Local<Name> name, v8::Local<Data> value,
   auto value_obj = Utils::OpenHandle(*value);
   CHECK(!value_obj->IsJSReceiver() || value_obj->IsTemplateInfo());
   if (value_obj->IsObjectTemplateInfo()) {
-    templ->set_serial_number(i::Smi::kZero);
+    templ->set_serial_number(i::Smi::zero());
     if (templ->IsFunctionTemplateInfo()) {
       i::Handle<i::FunctionTemplateInfo>::cast(templ)->set_do_not_cache(true);
     }
@@ -1677,7 +1678,7 @@ static Local<ObjectTemplate> ObjectTemplateNew(
   obj->set_serial_number(i::Smi::FromInt(next_serial_number));
   if (!constructor.IsEmpty())
     obj->set_constructor(*Utils::OpenHandle(*constructor));
-  obj->set_data(i::Smi::kZero);
+  obj->set_data(i::Smi::zero());
   return Utils::ToLocal(obj);
 }
 
@@ -2790,12 +2791,12 @@ v8::Local<Value> v8::TryCatch::Exception() const {
   }
 }
 
-MaybeLocal<Value> v8::TryCatch::StackTrace(Local<Context> context) const {
-  if (!HasCaught()) return v8::Local<Value>();
-  i::Object raw_obj(reinterpret_cast<i::Address>(exception_));
-  if (!raw_obj.IsJSObject()) return v8::Local<Value>();
+MaybeLocal<Value> v8::TryCatch::StackTrace(Local<Context> context,
+                                           Local<Value> exception) {
+  i::Handle<i::Object> i_exception = Utils::OpenHandle(*exception);
+  if (!i_exception->IsJSObject()) return v8::Local<Value>();
   PREPARE_FOR_EXECUTION(context, TryCatch, StackTrace, Value);
-  i::Handle<i::JSObject> obj(i::JSObject::cast(raw_obj), isolate_);
+  auto obj = i::Handle<i::JSObject>::cast(i_exception);
   i::Handle<i::String> name = isolate->factory()->stack_string();
   Maybe<bool> maybe = i::JSReceiver::HasProperty(obj, name);
   has_pending_exception = maybe.IsNothing();
@@ -2808,6 +2809,11 @@ MaybeLocal<Value> v8::TryCatch::StackTrace(Local<Context> context) const {
   RETURN_ESCAPED(result);
 }
 
+MaybeLocal<Value> v8::TryCatch::StackTrace(Local<Context> context) const {
+  if (!HasCaught()) return v8::Local<Value>();
+  return StackTrace(context, Exception());
+}
+
 v8::Local<v8::Message> v8::TryCatch::Message() const {
   i::Object message(reinterpret_cast<i::Address>(message_obj_));
   DCHECK(message.IsJSMessageObject() || message.IsTheHole(isolate_));
@@ -2922,6 +2928,26 @@ int Message::GetStartColumn() const {
   return self->GetColumnNumber();
 }
 
+int Message::GetWasmFunctionIndex() const {
+  auto self = Utils::OpenHandle(this);
+  i::Isolate* isolate = self->GetIsolate();
+  ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
+  EscapableHandleScope handle_scope(reinterpret_cast<Isolate*>(isolate));
+  i::JSMessageObject::EnsureSourcePositionsAvailable(isolate, self);
+  int start_position = self->GetColumnNumber();
+  if (start_position == -1) return Message::kNoWasmFunctionIndexInfo;
+
+  i::Handle<i::Script> script(self->script(), isolate);
+
+  if (script->type() != i::Script::TYPE_WASM) {
+    return Message::kNoWasmFunctionIndexInfo;
+  }
+
+  auto debug_script = ToApiHandle<debug::Script>(script);
+  return Local<debug::WasmScript>::Cast(debug_script)
+      ->GetContainingFunction(start_position);
+}
+
 Maybe<int> Message::GetStartColumn(Local<Context> context) const {
   return Just(GetStartColumn());
 }
@@ -3284,10 +3310,6 @@ void ValueDeserializer::SetSupportsLegacyWireFormat(
   private_->supports_legacy_wire_format = supports_legacy_wire_format;
 }
 
-void ValueDeserializer::SetExpectInlineWasm(bool expect_inline_wasm) {
-  private_->deserializer.set_expect_inline_wasm(expect_inline_wasm);
-}
-
 uint32_t ValueDeserializer::GetWireFormatVersion() const {
   CHECK(!private_->has_aborted);
   return private_->deserializer.GetWireFormatVersion();
@@ -3437,6 +3459,7 @@ VALUE_IS_SPECIFIC_TYPE(SymbolObject, SymbolWrapper)
 VALUE_IS_SPECIFIC_TYPE(Date, JSDate)
 VALUE_IS_SPECIFIC_TYPE(Map, JSMap)
 VALUE_IS_SPECIFIC_TYPE(Set, JSSet)
+VALUE_IS_SPECIFIC_TYPE(WasmModuleObject, WasmModuleObject)
 VALUE_IS_SPECIFIC_TYPE(WeakMap, JSWeakMap)
 VALUE_IS_SPECIFIC_TYPE(WeakSet, JSWeakSet)
 VALUE_IS_SPECIFIC_TYPE(WebAssemblyCompiledModule, WasmModuleObject)
@@ -3634,113 +3657,114 @@ void i::Internals::CheckInitializedImpl(v8::Isolate* external_isolate) {
 
 void External::CheckCast(v8::Value* that) {
   Utils::ApiCheck(that->IsExternal(), "v8::External::Cast",
-                  "Could not convert to external");
+                  "Value is not an External");
 }
 
 void v8::Object::CheckCast(Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsJSReceiver(), "v8::Object::Cast",
-                  "Could not convert to object");
+                  "Value is not an Object");
 }
 
 void v8::Function::CheckCast(Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsCallable(), "v8::Function::Cast",
-                  "Could not convert to function");
+                  "Value is not a Function");
 }
 
 void v8::Boolean::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsBoolean(), "v8::Boolean::Cast",
-                  "Could not convert to boolean");
+                  "Value is not a Boolean");
 }
 
 void v8::Name::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
-  Utils::ApiCheck(obj->IsName(), "v8::Name::Cast", "Could not convert to name");
+  Utils::ApiCheck(obj->IsName(), "v8::Name::Cast", "Value is not a Name");
 }
 
 void v8::String::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
-  Utils::ApiCheck(obj->IsString(), "v8::String::Cast",
-                  "Could not convert to string");
+  Utils::ApiCheck(obj->IsString(), "v8::String::Cast", "Value is not a String");
 }
 
 void v8::Symbol::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
-  Utils::ApiCheck(obj->IsSymbol(), "v8::Symbol::Cast",
-                  "Could not convert to symbol");
+  Utils::ApiCheck(obj->IsSymbol(), "v8::Symbol::Cast", "Value is not a Symbol");
 }
 
 void v8::Private::CheckCast(v8::Data* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(
       obj->IsSymbol() && i::Handle<i::Symbol>::cast(obj)->is_private(),
-      "v8::Private::Cast", "Could not convert to private");
+      "v8::Private::Cast", "Value is not a Private");
 }
 
 void v8::Number::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsNumber(), "v8::Number::Cast()",
-                  "Could not convert to number");
+                  "Value is not a Number");
 }
 
 void v8::Integer::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsNumber(), "v8::Integer::Cast",
-                  "Could not convert to number");
+                  "Value is not an Integer");
 }
 
 void v8::Int32::CheckCast(v8::Value* that) {
   Utils::ApiCheck(that->IsInt32(), "v8::Int32::Cast",
-                  "Could not convert to 32-bit signed integer");
+                  "Value is not a 32-bit signed integer");
 }
 
 void v8::Uint32::CheckCast(v8::Value* that) {
   Utils::ApiCheck(that->IsUint32(), "v8::Uint32::Cast",
-                  "Could not convert to 32-bit unsigned integer");
+                  "Value is not a 32-bit unsigned integer");
 }
 
 void v8::BigInt::CheckCast(v8::Value* that) {
   Utils::ApiCheck(that->IsBigInt(), "v8::BigInt::Cast",
-                  "Could not convert to BigInt");
+                  "Value is not a BigInt");
 }
 
 void v8::Array::CheckCast(Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
-  Utils::ApiCheck(obj->IsJSArray(), "v8::Array::Cast",
-                  "Could not convert to array");
+  Utils::ApiCheck(obj->IsJSArray(), "v8::Array::Cast", "Value is not an Array");
 }
 
 void v8::Map::CheckCast(Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
-  Utils::ApiCheck(obj->IsJSMap(), "v8::Map::Cast", "Could not convert to Map");
+  Utils::ApiCheck(obj->IsJSMap(), "v8::Map::Cast", "Value is not a Map");
 }
 
 void v8::Set::CheckCast(Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
-  Utils::ApiCheck(obj->IsJSSet(), "v8_Set_Cast", "Could not convert to Set");
+  Utils::ApiCheck(obj->IsJSSet(), "v8_Set_Cast", "Value is not a Set");
 }
 
 void v8::Promise::CheckCast(Value* that) {
   Utils::ApiCheck(that->IsPromise(), "v8::Promise::Cast",
-                  "Could not convert to promise");
+                  "Value is not a Promise");
 }
 
 void v8::Promise::Resolver::CheckCast(Value* that) {
   Utils::ApiCheck(that->IsPromise(), "v8::Promise::Resolver::Cast",
-                  "Could not convert to promise resolver");
+                  "Value is not a Promise::Resolver");
 }
 
 void v8::Proxy::CheckCast(Value* that) {
-  Utils::ApiCheck(that->IsProxy(), "v8::Proxy::Cast",
-                  "Could not convert to proxy");
+  Utils::ApiCheck(that->IsProxy(), "v8::Proxy::Cast", "Value is not a Proxy");
 }
 
 void v8::WasmModuleObject::CheckCast(Value* that) {
-  Utils::ApiCheck(that->IsWebAssemblyCompiledModule(),
-                  "v8::WasmModuleObject::Cast",
-                  "Could not convert to wasm module object");
+  Utils::ApiCheck(that->IsWasmModuleObject(), "v8::WasmModuleObject::Cast",
+                  "Value is not a WasmModuleObject");
+}
+
+void v8::debug::AccessorPair::CheckCast(Value* that) {
+  i::Handle<i::Object> obj = Utils::OpenHandle(that);
+  Utils::ApiCheck(obj->IsAccessorPair(), "v8::AccessorPair::Cast",
+                  "Value is not a debug::AccessorPair");
 }
 
 v8::BackingStore::~BackingStore() {
@@ -3756,6 +3780,10 @@ size_t v8::BackingStore::ByteLength() const {
   return reinterpret_cast<const i::BackingStore*>(this)->byte_length();
 }
 
+bool v8::BackingStore::IsShared() const {
+  return reinterpret_cast<const i::BackingStore*>(this)->is_shared();
+}
+
 std::shared_ptr<v8::BackingStore> v8::ArrayBuffer::GetBackingStore() {
   i::Handle<i::JSArrayBuffer> self = Utils::OpenHandle(this);
   std::shared_ptr<i::BackingStore> backing_store = self->GetBackingStore();
@@ -3783,28 +3811,30 @@ void v8::ArrayBuffer::CheckCast(Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(
       obj->IsJSArrayBuffer() && !i::JSArrayBuffer::cast(*obj).is_shared(),
-      "v8::ArrayBuffer::Cast()", "Could not convert to ArrayBuffer");
+      "v8::ArrayBuffer::Cast()", "Value is not an ArrayBuffer");
 }
 
 void v8::ArrayBufferView::CheckCast(Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsJSArrayBufferView(), "v8::ArrayBufferView::Cast()",
-                  "Could not convert to ArrayBufferView");
+                  "Value is not an ArrayBufferView");
 }
 
+constexpr size_t v8::TypedArray::kMaxLength;
+
 void v8::TypedArray::CheckCast(Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsJSTypedArray(), "v8::TypedArray::Cast()",
-                  "Could not convert to TypedArray");
+                  "Value is not a TypedArray");
 }
 
-#define CHECK_TYPED_ARRAY_CAST(Type, typeName, TYPE, ctype)                   \
-  void v8::Type##Array::CheckCast(Value* that) {                              \
-    i::Handle<i::Object> obj = Utils::OpenHandle(that);                       \
-    Utils::ApiCheck(                                                          \
-        obj->IsJSTypedArray() &&                                              \
-            i::JSTypedArray::cast(*obj).type() == i::kExternal##Type##Array,  \
-        "v8::" #Type "Array::Cast()", "Could not convert to " #Type "Array"); \
+#define CHECK_TYPED_ARRAY_CAST(Type, typeName, TYPE, ctype)                  \
+  void v8::Type##Array::CheckCast(Value* that) {                             \
+    i::Handle<i::Object> obj = Utils::OpenHandle(that);                      \
+    Utils::ApiCheck(                                                         \
+        obj->IsJSTypedArray() &&                                             \
+            i::JSTypedArray::cast(*obj).type() == i::kExternal##Type##Array, \
+        "v8::" #Type "Array::Cast()", "Value is not a " #Type "Array");      \
   }
 
 TYPED_ARRAYS(CHECK_TYPED_ARRAY_CAST)
@@ -3814,57 +3844,55 @@ TYPED_ARRAYS(CHECK_TYPED_ARRAY_CAST)
 void v8::DataView::CheckCast(Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsJSDataView(), "v8::DataView::Cast()",
-                  "Could not convert to DataView");
+                  "Value is not a DataView");
 }
 
 void v8::SharedArrayBuffer::CheckCast(Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(
       obj->IsJSArrayBuffer() && i::JSArrayBuffer::cast(*obj).is_shared(),
-      "v8::SharedArrayBuffer::Cast()",
-      "Could not convert to SharedArrayBuffer");
+      "v8::SharedArrayBuffer::Cast()", "Value is not a SharedArrayBuffer");
 }
 
 void v8::Date::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
-  Utils::ApiCheck(obj->IsJSDate(), "v8::Date::Cast()",
-                  "Could not convert to date");
+  Utils::ApiCheck(obj->IsJSDate(), "v8::Date::Cast()", "Value is not a Date");
 }
 
 void v8::StringObject::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsStringWrapper(), "v8::StringObject::Cast()",
-                  "Could not convert to StringObject");
+                  "Value is not a StringObject");
 }
 
 void v8::SymbolObject::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsSymbolWrapper(), "v8::SymbolObject::Cast()",
-                  "Could not convert to SymbolObject");
+                  "Value is not a SymbolObject");
 }
 
 void v8::NumberObject::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsNumberWrapper(), "v8::NumberObject::Cast()",
-                  "Could not convert to NumberObject");
+                  "Value is not a NumberObject");
 }
 
 void v8::BigIntObject::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsBigIntWrapper(), "v8::BigIntObject::Cast()",
-                  "Could not convert to BigIntObject");
+                  "Value is not a BigIntObject");
 }
 
 void v8::BooleanObject::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsBooleanWrapper(), "v8::BooleanObject::Cast()",
-                  "Could not convert to BooleanObject");
+                  "Value is not a BooleanObject");
 }
 
 void v8::RegExp::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsJSRegExp(), "v8::RegExp::Cast()",
-                  "Could not convert to regular expression");
+                  "Value is not a RegExp");
 }
 
 Maybe<double> Value::NumberValue(Local<Context> context) const {
@@ -4210,7 +4238,7 @@ Maybe<bool> v8::Object::SetPrivate(Local<Context> context, Local<Private> key,
         i::Handle<i::Symbol>::cast(key_obj), &desc, Just(i::kDontThrow));
   }
   auto js_object = i::Handle<i::JSObject>::cast(self);
-  i::LookupIterator it(js_object, key_obj, js_object);
+  i::LookupIterator it(isolate, js_object, key_obj, js_object);
   has_pending_exception = i::JSObject::DefineOwnPropertyIgnoreAttributes(
                               &it, value_obj, i::DONT_ENUM)
                               .is_null();
@@ -4664,9 +4692,9 @@ MaybeLocal<Value> v8::Object::GetRealNamedPropertyInPrototypeChain(
   if (iter.IsAtEnd()) return MaybeLocal<Value>();
   i::Handle<i::JSReceiver> proto =
       i::PrototypeIterator::GetCurrent<i::JSReceiver>(iter);
-  i::LookupIterator it = i::LookupIterator::PropertyOrElement(
-      isolate, self, key_obj, proto,
-      i::LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
+  i::LookupIterator::Key lookup_key(isolate, key_obj);
+  i::LookupIterator it(isolate, self, lookup_key, proto,
+                       i::LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
   Local<Value> result;
   has_pending_exception = !ToLocal<Value>(i::Object::GetProperty(&it), &result);
   RETURN_ON_FAILED_EXECUTION(Value);
@@ -4688,9 +4716,9 @@ v8::Object::GetRealNamedPropertyAttributesInPrototypeChain(
   if (iter.IsAtEnd()) return Nothing<PropertyAttribute>();
   i::Handle<i::JSReceiver> proto =
       i::PrototypeIterator::GetCurrent<i::JSReceiver>(iter);
-  i::LookupIterator it = i::LookupIterator::PropertyOrElement(
-      isolate, self, key_obj, proto,
-      i::LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
+  i::LookupIterator::Key lookup_key(isolate, key_obj);
+  i::LookupIterator it(isolate, self, lookup_key, proto,
+                       i::LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
   Maybe<i::PropertyAttributes> result =
       i::JSReceiver::GetPropertyAttributes(&it);
   RETURN_ON_FAILED_EXECUTION_PRIMITIVE(PropertyAttribute);
@@ -4702,11 +4730,11 @@ v8::Object::GetRealNamedPropertyAttributesInPrototypeChain(
 MaybeLocal<Value> v8::Object::GetRealNamedProperty(Local<Context> context,
                                                    Local<Name> key) {
   PREPARE_FOR_EXECUTION(context, Object, GetRealNamedProperty, Value);
-  auto self = Utils::OpenHandle(this);
-  auto key_obj = Utils::OpenHandle(*key);
-  i::LookupIterator it = i::LookupIterator::PropertyOrElement(
-      isolate, self, key_obj, self,
-      i::LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
+  i::Handle<i::JSReceiver> self = Utils::OpenHandle(this);
+  i::Handle<i::Name> key_obj = Utils::OpenHandle(*key);
+  i::LookupIterator::Key lookup_key(isolate, key_obj);
+  i::LookupIterator it(isolate, self, lookup_key, self,
+                       i::LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
   Local<Value> result;
   has_pending_exception = !ToLocal<Value>(i::Object::GetProperty(&it), &result);
   RETURN_ON_FAILED_EXECUTION(Value);
@@ -4719,11 +4747,11 @@ Maybe<PropertyAttribute> v8::Object::GetRealNamedPropertyAttributes(
   auto isolate = reinterpret_cast<i::Isolate*>(context->GetIsolate());
   ENTER_V8_NO_SCRIPT(isolate, context, Object, GetRealNamedPropertyAttributes,
                      Nothing<PropertyAttribute>(), i::HandleScope);
-  auto self = Utils::OpenHandle(this);
-  auto key_obj = Utils::OpenHandle(*key);
-  i::LookupIterator it = i::LookupIterator::PropertyOrElement(
-      isolate, self, key_obj, self,
-      i::LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
+  i::Handle<i::JSReceiver> self = Utils::OpenHandle(this);
+  i::Handle<i::Name> key_obj = Utils::OpenHandle(*key);
+  i::LookupIterator::Key lookup_key(isolate, key_obj);
+  i::LookupIterator it(isolate, self, lookup_key, self,
+                       i::LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
   auto result = i::JSReceiver::GetPropertyAttributes(&it);
   RETURN_ON_FAILED_EXECUTION_PRIMITIVE(PropertyAttribute);
   if (!it.IsFound()) return Nothing<PropertyAttribute>();
@@ -5473,28 +5501,28 @@ v8::String::GetExternalOneByteStringResource() const {
   return nullptr;
 }
 
-Local<Value> Symbol::Name() const {
+Local<Value> Symbol::Description() const {
   i::Handle<i::Symbol> sym = Utils::OpenHandle(this);
 
   i::Isolate* isolate;
   if (!i::GetIsolateFromHeapObject(*sym, &isolate)) {
-    // Symbol is in RO_SPACE, which means that its name is also in RO_SPACE.
-    // Since RO_SPACE objects are immovable we can use the Handle(Address*)
-    // constructor with the address of the name field in the Symbol object
-    // without needing an isolate.
+    // Symbol is in RO_SPACE, which means that its description is also in
+    // RO_SPACE. Since RO_SPACE objects are immovable we can use the
+    // Handle(Address*) constructor with the address of the description
+    // field in the Symbol object without needing an isolate.
     DCHECK(!COMPRESS_POINTERS_BOOL);
-    i::Handle<i::HeapObject> ro_name(reinterpret_cast<i::Address*>(
-        sym->GetFieldAddress(i::Symbol::kNameOffset)));
-    return Utils::ToLocal(ro_name);
+    i::Handle<i::HeapObject> ro_description(reinterpret_cast<i::Address*>(
+        sym->GetFieldAddress(i::Symbol::kDescriptionOffset)));
+    return Utils::ToLocal(ro_description);
   }
 
-  i::Handle<i::Object> name(sym->name(), isolate);
+  i::Handle<i::Object> description(sym->description(), isolate);
 
-  return Utils::ToLocal(name);
+  return Utils::ToLocal(description);
 }
 
 Local<Value> Private::Name() const {
-  return reinterpret_cast<const Symbol*>(this)->Name();
+  return reinterpret_cast<const Symbol*>(this)->Description();
 }
 
 double Number::Value() const {
@@ -5626,9 +5654,6 @@ void v8::V8::ShutdownPlatform() { i::V8::ShutdownPlatform(); }
 
 bool v8::V8::Initialize() {
   i::V8::Initialize();
-#ifdef V8_USE_EXTERNAL_STARTUP_DATA
-  i::ReadNatives();
-#endif
   return true;
 }
 
@@ -5684,12 +5709,14 @@ void v8::V8::SetReturnAddressLocationResolver(
 
 bool v8::V8::Dispose() {
   i::V8::TearDown();
-#ifdef V8_USE_EXTERNAL_STARTUP_DATA
-  i::DisposeNatives();
-#endif
   return true;
 }
 
+SharedMemoryStatistics::SharedMemoryStatistics()
+    : read_only_space_size_(0),
+      read_only_space_used_size_(0),
+      read_only_space_physical_size_(0) {}
+
 HeapStatistics::HeapStatistics()
     : total_heap_size_(0),
       total_heap_size_executable_(0),
@@ -5735,11 +5762,6 @@ void v8::V8::InitializeExternalStartupData(const char* directory_path) {
   i::InitializeExternalStartupData(directory_path);
 }
 
-void v8::V8::InitializeExternalStartupData(const char* natives_blob,
-                                           const char* snapshot_blob) {
-  i::InitializeExternalStartupData(natives_blob, snapshot_blob);
-}
-
 // static
 void v8::V8::InitializeExternalStartupDataFromFile(const char* snapshot_blob) {
   i::InitializeExternalStartupDataFromFile(snapshot_blob);
@@ -5747,6 +5769,20 @@ void v8::V8::InitializeExternalStartupDataFromFile(const char* snapshot_blob) {
 
 const char* v8::V8::GetVersion() { return i::Version::GetVersion(); }
 
+void V8::GetSharedMemoryStatistics(SharedMemoryStatistics* statistics) {
+#ifdef V8_SHARED_RO_HEAP
+  i::ReadOnlySpace* ro_space = i::ReadOnlyHeap::Instance()->read_only_space();
+  statistics->read_only_space_size_ = ro_space->CommittedMemory();
+  statistics->read_only_space_used_size_ = ro_space->SizeOfObjects();
+  statistics->read_only_space_physical_size_ =
+      ro_space->CommittedPhysicalMemory();
+#else
+  statistics->read_only_space_size_ = 0;
+  statistics->read_only_space_used_size_ = 0;
+  statistics->read_only_space_physical_size_ = 0;
+#endif  // V8_SHARED_RO_HEAP
+}
+
 template <typename ObjectType>
 struct InvokeBootstrapper;
 
@@ -6090,25 +6126,25 @@ MaybeLocal<v8::Object> ObjectTemplate::NewInstance(Local<Context> context) {
 void v8::ObjectTemplate::CheckCast(Data* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsObjectTemplateInfo(), "v8::ObjectTemplate::Cast",
-                  "Could not convert to object template");
+                  "Value is not an ObjectTemplate");
 }
 
 void v8::FunctionTemplate::CheckCast(Data* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsFunctionTemplateInfo(), "v8::FunctionTemplate::Cast",
-                  "Could not convert to function template");
+                  "Value is not a FunctionTemplate");
 }
 
 void v8::Signature::CheckCast(Data* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsFunctionTemplateInfo(), "v8::Signature::Cast",
-                  "Could not convert to signature");
+                  "Value is not a Signature");
 }
 
 void v8::AccessorSignature::CheckCast(Data* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
   Utils::ApiCheck(obj->IsFunctionTemplateInfo(), "v8::AccessorSignature::Cast",
-                  "Could not convert to accessor signature");
+                  "Value is not an AccessorSignature");
 }
 
 MaybeLocal<v8::Function> FunctionTemplate::GetFunction(Local<Context> context) {
@@ -6465,8 +6501,8 @@ Local<v8::Object> v8::Object::New(Isolate* isolate,
     } else {
       // Internalize the {name} first.
       name = i_isolate->factory()->InternalizeName(name);
-      int const entry = properties->FindEntry(i_isolate, name);
-      if (entry == i::NameDictionary::kNotFound) {
+      i::InternalIndex const entry = properties->FindEntry(i_isolate, name);
+      if (entry.is_not_found()) {
         // Add the {name}/{value} pair as a new entry.
         properties = i::NameDictionary::Add(i_isolate, properties, name, value,
                                             i::PropertyDetails::Empty());
@@ -6628,6 +6664,21 @@ MaybeLocal<v8::RegExp> v8::RegExp::New(Local<Context> context,
   RETURN_ESCAPED(result);
 }
 
+MaybeLocal<v8::RegExp> v8::RegExp::NewWithBacktrackLimit(
+    Local<Context> context, Local<String> pattern, Flags flags,
+    uint32_t backtrack_limit) {
+  CHECK(i::Smi::IsValid(backtrack_limit));
+  CHECK_NE(backtrack_limit, i::JSRegExp::kNoBacktrackLimit);
+  PREPARE_FOR_EXECUTION(context, RegExp, New, RegExp);
+  Local<v8::RegExp> result;
+  has_pending_exception = !ToLocal<RegExp>(
+      i::JSRegExp::New(isolate, Utils::OpenHandle(*pattern),
+                       static_cast<i::JSRegExp::Flags>(flags), backtrack_limit),
+      &result);
+  RETURN_ON_FAILED_EXECUTION(RegExp);
+  RETURN_ESCAPED(result);
+}
+
 Local<v8::String> v8::RegExp::GetSource() const {
   i::Handle<i::JSRegExp> obj = Utils::OpenHandle(this);
   return Utils::ToLocal(
@@ -6651,6 +6702,27 @@ v8::RegExp::Flags v8::RegExp::GetFlags() const {
   return RegExp::Flags(static_cast<int>(obj->GetFlags()));
 }
 
+MaybeLocal<v8::Object> v8::RegExp::Exec(Local<Context> context,
+                                        Local<v8::String> subject) {
+  PREPARE_FOR_EXECUTION(context, RegExp, Exec, Object);
+
+  i::Handle<i::JSRegExp> regexp = Utils::OpenHandle(this);
+  i::Handle<i::String> subject_string = Utils::OpenHandle(*subject);
+
+  // TODO(jgruber): RegExpUtils::RegExpExec was not written with efficiency in
+  // mind. It fetches the 'exec' property and then calls it through JSEntry.
+  // Unfortunately, this is currently the only full implementation of
+  // RegExp.prototype.exec available in C++.
+  Local<v8::Object> result;
+  has_pending_exception = !ToLocal<Object>(
+      i::RegExpUtils::RegExpExec(isolate, regexp, subject_string,
+                                 isolate->factory()->undefined_value()),
+      &result);
+
+  RETURN_ON_FAILED_EXECUTION(Object);
+  RETURN_ESCAPED(result);
+}
+
 Local<v8::Array> v8::Array::New(Isolate* isolate, int length) {
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   LOG_API(i_isolate, Array, New);
@@ -7109,23 +7181,12 @@ MemorySpan<const uint8_t> CompiledWasmModule::GetWireBytesRef() {
   return {bytes_vec.begin(), bytes_vec.size()};
 }
 
-WasmModuleObject::TransferrableModule
-WasmModuleObject::GetTransferrableModule() {
-  return GetCompiledModule();
-}
-
 CompiledWasmModule WasmModuleObject::GetCompiledModule() {
   i::Handle<i::WasmModuleObject> obj =
       i::Handle<i::WasmModuleObject>::cast(Utils::OpenHandle(this));
   return Utils::Convert(obj->shared_native_module());
 }
 
-MaybeLocal<WasmModuleObject> WasmModuleObject::FromTransferrableModule(
-    Isolate* isolate,
-    const WasmModuleObject::TransferrableModule& transferrable_module) {
-  return FromCompiledModule(isolate, transferrable_module);
-}
-
 MaybeLocal<WasmModuleObject> WasmModuleObject::FromCompiledModule(
     Isolate* isolate, const CompiledWasmModule& compiled_module) {
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
@@ -7143,7 +7204,7 @@ MaybeLocal<WasmModuleObject> WasmModuleObject::Deserialize(
   i::MaybeHandle<i::WasmModuleObject> maybe_module_object =
       i::wasm::DeserializeNativeModule(
           i_isolate, {serialized_module.data(), serialized_module.size()},
-          {wire_bytes.data(), wire_bytes.size()});
+          {wire_bytes.data(), wire_bytes.size()}, {});
   i::Handle<i::WasmModuleObject> module_object;
   if (!maybe_module_object.ToHandle(&module_object)) {
     return MaybeLocal<WasmModuleObject>();
@@ -7173,7 +7234,7 @@ MaybeLocal<WasmModuleObject> WasmModuleObject::Compile(Isolate* isolate,
   i::MaybeHandle<i::JSObject> maybe_compiled;
   {
     i::wasm::ErrorThrower thrower(i_isolate, "WasmModuleObject::Compile()");
-    auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
+    auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
     maybe_compiled = i_isolate->wasm_engine()->SyncCompile(
         i_isolate, enabled_features, &thrower,
         i::wasm::ModuleWireBytes(start, start + length));
@@ -7187,38 +7248,6 @@ MaybeLocal<WasmModuleObject> WasmModuleObject::Compile(Isolate* isolate,
       Utils::ToLocal(maybe_compiled.ToHandleChecked()));
 }
 
-// Resolves the result of streaming compilation.
-// TODO(ahaas): Refactor the streaming compilation API so that this class can
-// move to wasm-js.cc.
-class AsyncCompilationResolver : public i::wasm::CompilationResultResolver {
- public:
-  AsyncCompilationResolver(Isolate* isolate, Local<Promise> promise)
-      : promise_(
-            reinterpret_cast<i::Isolate*>(isolate)->global_handles()->Create(
-                *Utils::OpenHandle(*promise))) {}
-
-  ~AsyncCompilationResolver() override {
-    i::GlobalHandles::Destroy(promise_.location());
-  }
-
-  void OnCompilationSucceeded(i::Handle<i::WasmModuleObject> result) override {
-    i::MaybeHandle<i::Object> promise_result =
-        i::JSPromise::Resolve(promise_, result);
-    CHECK_EQ(promise_result.is_null(),
-             promise_->GetIsolate()->has_pending_exception());
-  }
-
-  void OnCompilationFailed(i::Handle<i::Object> error_reason) override {
-    i::MaybeHandle<i::Object> promise_result =
-        i::JSPromise::Reject(promise_, error_reason);
-    CHECK_EQ(promise_result.is_null(),
-             promise_->GetIsolate()->has_pending_exception());
-  }
-
- private:
-  i::Handle<i::JSPromise> promise_;
-};
-
 WasmModuleObjectBuilderStreaming::WasmModuleObjectBuilderStreaming(
     Isolate* isolate) {
   USE(isolate_);
@@ -7404,8 +7433,6 @@ v8::ArrayBuffer::Contents v8::ArrayBuffer::GetContents(bool externalize) {
 void v8::ArrayBuffer::Detach() {
   i::Handle<i::JSArrayBuffer> obj = Utils::OpenHandle(this);
   i::Isolate* isolate = obj->GetIsolate();
-  Utils::ApiCheck(obj->is_external(), "v8::ArrayBuffer::Detach",
-                  "Only externalized ArrayBuffers can be detached");
   Utils::ApiCheck(obj->is_detachable(), "v8::ArrayBuffer::Detach",
                   "Only detachable ArrayBuffers can be detached");
   LOG_API(isolate, ArrayBuffer, Detach);
@@ -7461,7 +7488,6 @@ Local<ArrayBuffer> v8::ArrayBuffer::New(
     Isolate* isolate, std::shared_ptr<BackingStore> backing_store) {
   CHECK_IMPLIES(backing_store->ByteLength() != 0,
                 backing_store->Data() != nullptr);
-  CHECK_LE(backing_store->ByteLength(), i::JSArrayBuffer::kMaxByteLength);
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   LOG_API(i_isolate, ArrayBuffer, New);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
@@ -7479,6 +7505,7 @@ std::unique_ptr<v8::BackingStore> v8::ArrayBuffer::NewBackingStore(
     Isolate* isolate, size_t byte_length) {
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   LOG_API(i_isolate, ArrayBuffer, NewBackingStore);
+  CHECK_LE(byte_length, i::JSArrayBuffer::kMaxByteLength);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
   std::unique_ptr<i::BackingStoreBase> backing_store =
       i::BackingStore::Allocate(i_isolate, byte_length,
@@ -7494,6 +7521,7 @@ std::unique_ptr<v8::BackingStore> v8::ArrayBuffer::NewBackingStore(
 std::unique_ptr<v8::BackingStore> v8::ArrayBuffer::NewBackingStore(
     void* data, size_t byte_length, BackingStoreDeleterCallback deleter,
     void* deleter_data) {
+  CHECK_LE(byte_length, i::JSArrayBuffer::kMaxByteLength);
   std::unique_ptr<i::BackingStoreBase> backing_store =
       i::BackingStore::WrapAllocation(data, byte_length, deleter, deleter_data,
                                       i::SharedFlag::kNotShared);
@@ -7560,8 +7588,9 @@ size_t v8::TypedArray::Length() {
   return obj->WasDetached() ? 0 : obj->length();
 }
 
-static_assert(v8::TypedArray::kMaxLength == i::Smi::kMaxValue,
-              "v8::TypedArray::kMaxLength must match i::Smi::kMaxValue");
+static_assert(
+    v8::TypedArray::kMaxLength == i::JSTypedArray::kMaxLength,
+    "v8::TypedArray::kMaxLength must match i::JSTypedArray::kMaxLength");
 
 #define TYPED_ARRAY_NEW(Type, type, TYPE, ctype)                           \
   Local<Type##Array> Type##Array::New(Local<ArrayBuffer> array_buffer,     \
@@ -7781,7 +7810,6 @@ Local<SharedArrayBuffer> v8::SharedArrayBuffer::New(
   CHECK(i::FLAG_harmony_sharedarraybuffer);
   CHECK_IMPLIES(backing_store->ByteLength() != 0,
                 backing_store->Data() != nullptr);
-  CHECK_LE(backing_store->ByteLength(), i::JSArrayBuffer::kMaxByteLength);
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   LOG_API(i_isolate, SharedArrayBuffer, New);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
@@ -7806,6 +7834,7 @@ std::unique_ptr<v8::BackingStore> v8::SharedArrayBuffer::NewBackingStore(
     Isolate* isolate, size_t byte_length) {
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   LOG_API(i_isolate, SharedArrayBuffer, NewBackingStore);
+  CHECK_LE(byte_length, i::JSArrayBuffer::kMaxByteLength);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
   std::unique_ptr<i::BackingStoreBase> backing_store =
       i::BackingStore::Allocate(i_isolate, byte_length, i::SharedFlag::kShared,
@@ -7821,6 +7850,7 @@ std::unique_ptr<v8::BackingStore> v8::SharedArrayBuffer::NewBackingStore(
 std::unique_ptr<v8::BackingStore> v8::SharedArrayBuffer::NewBackingStore(
     void* data, size_t byte_length, BackingStoreDeleterCallback deleter,
     void* deleter_data) {
+  CHECK_LE(byte_length, i::JSArrayBuffer::kMaxByteLength);
   std::unique_ptr<i::BackingStoreBase> backing_store =
       i::BackingStore::WrapAllocation(data, byte_length, deleter, deleter_data,
                                       i::SharedFlag::kShared);
@@ -7833,7 +7863,7 @@ Local<Symbol> v8::Symbol::New(Isolate* isolate, Local<String> name) {
   LOG_API(i_isolate, Symbol, New);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
   i::Handle<i::Symbol> result = i_isolate->factory()->NewSymbol();
-  if (!name.IsEmpty()) result->set_name(*Utils::OpenHandle(*name));
+  if (!name.IsEmpty()) result->set_description(*Utils::OpenHandle(*name));
   return Utils::ToLocal(result);
 }
 
@@ -7880,7 +7910,7 @@ Local<Private> v8::Private::New(Isolate* isolate, Local<String> name) {
   LOG_API(i_isolate, Private, New);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
   i::Handle<i::Symbol> symbol = i_isolate->factory()->NewPrivateSymbol();
-  if (!name.IsEmpty()) symbol->set_name(*Utils::OpenHandle(*name));
+  if (!name.IsEmpty()) symbol->set_description(*Utils::OpenHandle(*name));
   Local<Symbol> result = Utils::ToLocal(symbol);
   return v8::Local<Private>(reinterpret_cast<Private*>(*result));
 }
@@ -8239,6 +8269,14 @@ void Isolate::Initialize(Isolate* isolate,
   }
   i_isolate->set_only_terminate_in_safe_scope(
       params.only_terminate_in_safe_scope);
+
+  if (!i::V8::GetCurrentPlatform()
+           ->GetForegroundTaskRunner(isolate)
+           ->NonNestableTasksEnabled()) {
+    FATAL(
+        "The current platform's foreground task runner does not have "
+        "non-nestable tasks enabled. The embedder must provide one.");
+  }
 }
 
 Isolate* Isolate::New(const Isolate::CreateParams& params) {
@@ -8379,9 +8417,11 @@ Isolate::AllowJavascriptExecutionScope::~AllowJavascriptExecutionScope() {
 }
 
 Isolate::SuppressMicrotaskExecutionScope::SuppressMicrotaskExecutionScope(
-    Isolate* isolate)
+    Isolate* isolate, MicrotaskQueue* microtask_queue)
     : isolate_(reinterpret_cast<i::Isolate*>(isolate)),
-      microtask_queue_(isolate_->default_microtask_queue()) {
+      microtask_queue_(microtask_queue
+                           ? static_cast<i::MicrotaskQueue*>(microtask_queue)
+                           : isolate_->default_microtask_queue()) {
   isolate_->thread_local_top()->IncrementCallDepth(this);
   microtask_queue_->IncrementMicrotasksSuppressions();
 }
@@ -8410,18 +8450,22 @@ i::Address* Isolate::GetDataFromSnapshotOnce(size_t index) {
 void Isolate::GetHeapStatistics(HeapStatistics* heap_statistics) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
   i::Heap* heap = isolate->heap();
+
+  heap_statistics->total_heap_size_ = heap->CommittedMemory();
+  heap_statistics->total_physical_size_ = heap->CommittedPhysicalMemory();
+  heap_statistics->total_available_size_ = heap->Available();
+  heap_statistics->used_heap_size_ = heap->SizeOfObjects();
+
+#ifndef V8_SHARED_RO_HEAP
   i::ReadOnlySpace* ro_space = heap->read_only_space();
+  heap_statistics->total_heap_size_ += ro_space->CommittedMemory();
+  heap_statistics->total_physical_size_ += ro_space->CommittedPhysicalMemory();
+  heap_statistics->total_available_size_ += ro_space->Available();
+  heap_statistics->used_heap_size_ += ro_space->SizeOfObjects();
+#endif  // V8_SHARED_RO_HEAP
 
-  heap_statistics->total_heap_size_ =
-      heap->CommittedMemory() + ro_space->CommittedMemory();
   heap_statistics->total_heap_size_executable_ =
       heap->CommittedMemoryExecutable();
-  heap_statistics->total_physical_size_ =
-      heap->CommittedPhysicalMemory() + ro_space->CommittedPhysicalMemory();
-  heap_statistics->total_available_size_ =
-      heap->Available() + ro_space->Available();
-  heap_statistics->used_heap_size_ =
-      heap->SizeOfObjects() + ro_space->SizeOfObjects();
   heap_statistics->heap_size_limit_ = heap->MaxReserved();
   // TODO(7424): There is no public API for the {WasmEngine} yet. Once such an
   // API becomes available we should report the malloced memory separately. For
@@ -8453,12 +8497,21 @@ bool Isolate::GetHeapSpaceStatistics(HeapSpaceStatistics* space_statistics,
   i::Heap* heap = isolate->heap();
   i::Space* space = heap->space(static_cast<int>(index));
 
-  space_statistics->space_name_ =
-      i::Heap::GetSpaceName(static_cast<i::AllocationSpace>(index));
-  space_statistics->space_size_ = space->CommittedMemory();
-  space_statistics->space_used_size_ = space->SizeOfObjects();
-  space_statistics->space_available_size_ = space->Available();
-  space_statistics->physical_space_size_ = space->CommittedPhysicalMemory();
+  i::AllocationSpace allocation_space = static_cast<i::AllocationSpace>(index);
+  space_statistics->space_name_ = i::Heap::GetSpaceName(allocation_space);
+
+  if (allocation_space == i::RO_SPACE && V8_SHARED_RO_HEAP_BOOL) {
+    // RO_SPACE memory is accounted for elsewhere when ReadOnlyHeap is shared.
+    space_statistics->space_size_ = 0;
+    space_statistics->space_used_size_ = 0;
+    space_statistics->space_available_size_ = 0;
+    space_statistics->physical_space_size_ = 0;
+  } else {
+    space_statistics->space_size_ = space->CommittedMemory();
+    space_statistics->space_used_size_ = space->SizeOfObjects();
+    space_statistics->space_available_size_ = space->Available();
+    space_statistics->physical_space_size_ = space->CommittedPhysicalMemory();
+  }
   return true;
 }
 
@@ -8512,11 +8565,25 @@ bool Isolate::GetHeapCodeAndMetadataStatistics(
 
 v8::MaybeLocal<v8::Promise> Isolate::MeasureMemory(
     v8::Local<v8::Context> context, MeasureMemoryMode mode) {
+  return v8::MaybeLocal<v8::Promise>();
+}
+
+bool Isolate::MeasureMemory(std::unique_ptr<MeasureMemoryDelegate> delegate,
+                            MeasureMemoryExecution execution) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
+  return isolate->heap()->MeasureMemory(std::move(delegate), execution);
+}
+
+std::unique_ptr<MeasureMemoryDelegate> MeasureMemoryDelegate::Default(
+    Isolate* isolate, Local<Context> context,
+    Local<Promise::Resolver> promise_resolver, MeasureMemoryMode mode) {
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   i::Handle<i::NativeContext> native_context =
-      handle(Utils::OpenHandle(*context)->native_context(), isolate);
-  return v8::Utils::PromiseToLocal(
-      isolate->heap()->MeasureMemory(native_context, mode));
+      handle(Utils::OpenHandle(*context)->native_context(), i_isolate);
+  i::Handle<i::JSPromise> js_promise =
+      i::Handle<i::JSPromise>::cast(Utils::OpenHandle(*promise_resolver));
+  return i_isolate->heap()->MeasureMemoryDelegate(native_context, js_promise,
+                                                  mode);
 }
 
 void Isolate::GetStackSample(const RegisterState& state, void** frames,
@@ -8707,15 +8774,6 @@ void Isolate::LowMemoryNotification() {
     isolate->heap()->CollectAllAvailableGarbage(
         i::GarbageCollectionReason::kLowMemoryNotification);
   }
-  {
-    i::HeapObjectIterator iterator(isolate->heap());
-    for (i::HeapObject obj = iterator.Next(); !obj.is_null();
-         obj = iterator.Next()) {
-      if (obj.IsAbstractCode()) {
-        i::AbstractCode::cast(obj).DropStackFrameCache();
-      }
-    }
-  }
 }
 
 int Isolate::ContextDisposedNotification(bool dependant_context) {
@@ -8812,14 +8870,63 @@ UnwindState Isolate::GetUnwindState() {
   unwind_state.embedded_code_range.length_in_bytes =
       isolate->embedded_blob_size();
 
-  i::Code js_entry = isolate->heap()->builtin(i::Builtins::kJSEntry);
-  unwind_state.js_entry_stub.code.start =
-      reinterpret_cast<const void*>(js_entry.InstructionStart());
-  unwind_state.js_entry_stub.code.length_in_bytes = js_entry.InstructionSize();
+  std::array<std::pair<i::Builtins::Name, JSEntryStub*>, 3> entry_stubs = {
+      {{i::Builtins::kJSEntry, &unwind_state.js_entry_stub},
+       {i::Builtins::kJSConstructEntry, &unwind_state.js_construct_entry_stub},
+       {i::Builtins::kJSRunMicrotasksEntry,
+        &unwind_state.js_run_microtasks_entry_stub}}};
+  for (auto& pair : entry_stubs) {
+    i::Code js_entry = isolate->heap()->builtin(pair.first);
+    pair.second->code.start =
+        reinterpret_cast<const void*>(js_entry.InstructionStart());
+    pair.second->code.length_in_bytes = js_entry.InstructionSize();
+  }
 
   return unwind_state;
 }
 
+JSEntryStubs Isolate::GetJSEntryStubs() {
+  JSEntryStubs entry_stubs;
+
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
+  std::array<std::pair<i::Builtins::Name, JSEntryStub*>, 3> stubs = {
+      {{i::Builtins::kJSEntry, &entry_stubs.js_entry_stub},
+       {i::Builtins::kJSConstructEntry, &entry_stubs.js_construct_entry_stub},
+       {i::Builtins::kJSRunMicrotasksEntry,
+        &entry_stubs.js_run_microtasks_entry_stub}}};
+  for (auto& pair : stubs) {
+    i::Code js_entry = isolate->heap()->builtin(pair.first);
+    pair.second->code.start =
+        reinterpret_cast<const void*>(js_entry.InstructionStart());
+    pair.second->code.length_in_bytes = js_entry.InstructionSize();
+  }
+
+  return entry_stubs;
+}
+
+size_t Isolate::CopyCodePages(size_t capacity, MemoryRange* code_pages_out) {
+#if !defined(V8_TARGET_ARCH_64_BIT) && !defined(V8_TARGET_ARCH_ARM)
+  // Not implemented on other platforms.
+  UNREACHABLE();
+#else
+
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
+  std::vector<MemoryRange>* code_pages = isolate->GetCodePages();
+
+  DCHECK_NOT_NULL(code_pages);
+
+  // Copy as many elements into the output vector as we can. If the
+  // caller-provided buffer is not big enough, we fill it, and the caller can
+  // provide a bigger one next time. We do it this way because allocation is not
+  // allowed in signal handlers.
+  size_t limit = std::min(capacity, code_pages->size());
+  for (size_t i = 0; i < limit; i++) {
+    code_pages_out[i] = code_pages->at(i);
+  }
+  return code_pages->size();
+#endif
+}
+
 #define CALLBACK_SETTER(ExternalName, Type, InternalName)      \
   void Isolate::Set##ExternalName(Type callback) {             \
     i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this); \
@@ -9158,16 +9265,91 @@ MaybeLocal<Array> debug::GetInternalProperties(Isolate* v8_isolate,
   return Utils::ToLocal(result);
 }
 
-MaybeLocal<Array> debug::GetPrivateFields(Local<Context> context,
-                                          Local<Object> value) {
-  PREPARE_FOR_EXECUTION(context, debug, GetPrivateFields, Array);
-  i::Handle<i::JSReceiver> val = Utils::OpenHandle(*value);
-  i::Handle<i::JSArray> result;
-  i::Isolate* internal_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  has_pending_exception =
-      !(internal_isolate->debug()->GetPrivateFields(val).ToHandle(&result));
-  RETURN_ON_FAILED_EXECUTION(Array);
-  RETURN_ESCAPED(Utils::ToLocal(result));
+bool debug::GetPrivateMembers(Local<Context> context, Local<Object> value,
+                              std::vector<Local<Value>>* names_out,
+                              std::vector<Local<Value>>* values_out) {
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(context->GetIsolate());
+  LOG_API(isolate, debug, GetPrivateMembers);
+  ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
+  i::Handle<i::JSReceiver> receiver = Utils::OpenHandle(*value);
+  i::Handle<i::JSArray> names;
+  i::Handle<i::FixedArray> values;
+
+  i::PropertyFilter key_filter =
+      static_cast<i::PropertyFilter>(i::PropertyFilter::PRIVATE_NAMES_ONLY);
+  i::Handle<i::FixedArray> keys;
+  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+      isolate, keys,
+      i::KeyAccumulator::GetKeys(receiver, i::KeyCollectionMode::kOwnOnly,
+                                 key_filter,
+                                 i::GetKeysConversion::kConvertToString),
+      false);
+
+  // Estimate number of private entries to return in the FixedArray.
+  int private_entries_count = 0;
+  for (int i = 0; i < keys->length(); ++i) {
+    // Exclude the private brand symbols.
+    i::Handle<i::Symbol> key(i::Symbol::cast(keys->get(i)), isolate);
+    if (key->is_private_brand()) {
+      i::Handle<i::Object> value;
+      ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+          isolate, value, i::Object::GetProperty(isolate, receiver, key),
+          false);
+
+      i::Handle<i::Context> context(i::Context::cast(*value), isolate);
+      i::Handle<i::ScopeInfo> scope_info(context->scope_info(), isolate);
+      // At least one slot contains the brand symbol so it does not count.
+      private_entries_count += (scope_info->ContextLocalCount() - 1);
+    } else {
+      private_entries_count++;
+    }
+  }
+
+  DCHECK(names_out->empty());
+  names_out->reserve(private_entries_count);
+  DCHECK(values_out->empty());
+  values_out->reserve(private_entries_count);
+  for (int i = 0; i < keys->length(); ++i) {
+    i::Handle<i::Object> obj_key(keys->get(i), isolate);
+    i::Handle<i::Symbol> key(i::Symbol::cast(*obj_key), isolate);
+    CHECK(key->is_private_name());
+    i::Handle<i::Object> value;
+    ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+        isolate, value, i::Object::GetProperty(isolate, receiver, key), false);
+
+    if (key->is_private_brand()) {
+      DCHECK(value->IsContext());
+      i::Handle<i::Context> context(i::Context::cast(*value), isolate);
+      i::Handle<i::ScopeInfo> scope_info(context->scope_info(), isolate);
+      int local_count = scope_info->ContextLocalCount();
+
+      for (int j = 0; j < local_count; ++j) {
+        i::VariableMode mode = scope_info->ContextLocalMode(j);
+        if (!i::IsPrivateMethodOrAccessorVariableMode(mode)) {
+          continue;
+        }
+
+        i::Handle<i::String> name(scope_info->ContextLocalName(j), isolate);
+        int context_index = scope_info->ContextHeaderLength() + j;
+        i::Handle<i::Object> slot_value(context->get(context_index), isolate);
+        DCHECK_IMPLIES(mode == i::VariableMode::kPrivateMethod,
+                       slot_value->IsJSFunction());
+        DCHECK_IMPLIES(mode != i::VariableMode::kPrivateMethod,
+                       slot_value->IsAccessorPair());
+        names_out->push_back(Utils::ToLocal(name));
+        values_out->push_back(Utils::ToLocal(slot_value));
+      }
+    } else {  // Private fields
+      i::Handle<i::String> name(
+          i::String::cast(i::Symbol::cast(*key).description()), isolate);
+      names_out->push_back(Utils::ToLocal(name));
+      values_out->push_back(Utils::ToLocal(value));
+    }
+  }
+
+  DCHECK_EQ(names_out->size(), values_out->size());
+  DCHECK_LE(names_out->size(), private_entries_count);
+  return true;
 }
 
 Local<Context> debug::GetCreationContext(Local<Object> value) {
@@ -9252,10 +9434,8 @@ int debug::Script::ColumnOffset() const {
 
 std::vector<int> debug::Script::LineEnds() const {
   i::Handle<i::Script> script = Utils::OpenHandle(this);
-  if (script->type() == i::Script::TYPE_WASM &&
-      this->SourceMappingURL().IsEmpty()) {
-    return std::vector<int>();
-  }
+  if (script->type() == i::Script::TYPE_WASM) return std::vector<int>();
+
   i::Isolate* isolate = script->GetIsolate();
   i::HandleScope scope(isolate);
   i::Script::InitLineEnds(script);
@@ -9344,11 +9524,10 @@ bool debug::Script::GetPossibleBreakpoints(
     std::vector<debug::BreakLocation>* locations) const {
   CHECK(!start.IsEmpty());
   i::Handle<i::Script> script = Utils::OpenHandle(this);
-  if (script->type() == i::Script::TYPE_WASM &&
-      this->SourceMappingURL().IsEmpty()) {
+  if (script->type() == i::Script::TYPE_WASM) {
     i::wasm::NativeModule* native_module = script->wasm_native_module();
-    return i::WasmModuleObject::GetPossibleBreakpoints(native_module, start,
-                                                       end, locations);
+    return i::WasmScript::GetPossibleBreakpoints(native_module, start, end,
+                                                 locations);
   }
 
   i::Script::InitLineEnds(script);
@@ -9396,12 +9575,6 @@ bool debug::Script::GetPossibleBreakpoints(
 int debug::Script::GetSourceOffset(const debug::Location& location) const {
   i::Handle<i::Script> script = Utils::OpenHandle(this);
   if (script->type() == i::Script::TYPE_WASM) {
-    if (this->SourceMappingURL().IsEmpty()) {
-      i::wasm::NativeModule* native_module = script->wasm_native_module();
-      const i::wasm::WasmModule* module = native_module->module();
-      return i::wasm::GetWasmFunctionOffset(module, location.GetLineNumber()) +
-             location.GetColumnNumber();
-    }
     DCHECK_EQ(0, location.GetLineNumber());
     return location.GetColumnNumber();
   }
@@ -9468,6 +9641,12 @@ bool debug::Script::SetBreakpointOnScriptEntry(BreakpointId* id) const {
   return false;
 }
 
+void debug::Script::RemoveWasmBreakpoint(debug::BreakpointId id) {
+  i::Handle<i::Script> script = Utils::OpenHandle(this);
+  i::Isolate* isolate = script->GetIsolate();
+  isolate->debug()->RemoveBreakpointForWasmScript(script, id);
+}
+
 void debug::RemoveBreakpoint(Isolate* v8_isolate, BreakpointId id) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
   i::HandleScope handle_scope(isolate);
@@ -9526,6 +9705,17 @@ std::pair<int, int> debug::WasmScript::GetFunctionRange(
                         static_cast<int>(func.code.end_offset()));
 }
 
+int debug::WasmScript::GetContainingFunction(int byte_offset) const {
+  i::DisallowHeapAllocation no_gc;
+  i::Handle<i::Script> script = Utils::OpenHandle(this);
+  DCHECK_EQ(i::Script::TYPE_WASM, script->type());
+  i::wasm::NativeModule* native_module = script->wasm_native_module();
+  const i::wasm::WasmModule* module = native_module->module();
+  DCHECK_LE(0, byte_offset);
+
+  return i::wasm::GetContainingWasmFunction(module, byte_offset);
+}
+
 uint32_t debug::WasmScript::GetFunctionHash(int function_index) {
   i::DisallowHeapAllocation no_gc;
   i::Handle<i::Script> script = Utils::OpenHandle(this);
@@ -9542,17 +9732,6 @@ uint32_t debug::WasmScript::GetFunctionHash(int function_index) {
                                                function_bytes.length(), 0);
 }
 
-debug::WasmDisassembly debug::WasmScript::DisassembleFunction(
-    int function_index) const {
-  i::DisallowHeapAllocation no_gc;
-  i::Handle<i::Script> script = Utils::OpenHandle(this);
-  DCHECK_EQ(i::Script::TYPE_WASM, script->type());
-  i::wasm::NativeModule* native_module = script->wasm_native_module();
-  const i::wasm::WasmModule* module = native_module->module();
-  i::wasm::ModuleWireBytes wire_bytes(native_module->wire_bytes());
-  return DisassembleWasmFunction(module, wire_bytes, function_index);
-}
-
 debug::Location::Location(int line_number, int column_number)
     : line_number_(line_number),
       column_number_(column_number),
@@ -9584,11 +9763,13 @@ void debug::GetLoadedScripts(v8::Isolate* v8_isolate,
     i::Script::Iterator iterator(isolate);
     for (i::Script script = iterator.Next(); !script.is_null();
          script = iterator.Next()) {
-      if (!script.IsUserJavaScript()) continue;
-      if (script.HasValidSource()) {
-        i::HandleScope handle_scope(isolate);
-        i::Handle<i::Script> script_handle(script, isolate);
-        scripts.Append(ToApiHandle<Script>(script_handle));
+      if (script.type() == i::Script::TYPE_NORMAL ||
+          script.type() == i::Script::TYPE_WASM) {
+        if (script.HasValidSource()) {
+          i::HandleScope handle_scope(isolate);
+          i::Handle<i::Script> script_handle(script, isolate);
+          scripts.Append(ToApiHandle<Script>(script_handle));
+        }
       }
     }
   }
@@ -9789,14 +9970,16 @@ v8::Local<debug::GeneratorObject> debug::GeneratorObject::Cast(
 
 MaybeLocal<v8::Value> debug::EvaluateGlobal(v8::Isolate* isolate,
                                             v8::Local<v8::String> source,
-                                            EvaluateGlobalMode mode) {
+                                            EvaluateGlobalMode mode,
+                                            bool repl) {
   i::Isolate* internal_isolate = reinterpret_cast<i::Isolate*>(isolate);
   PREPARE_FOR_DEBUG_INTERFACE_EXECUTION_WITH_ISOLATE(internal_isolate, Value);
+  i::REPLMode repl_mode = repl ? i::REPLMode::kYes : i::REPLMode::kNo;
   Local<Value> result;
-  has_pending_exception =
-      !ToLocal<Value>(i::DebugEvaluate::Global(
-                          internal_isolate, Utils::OpenHandle(*source), mode),
-                      &result);
+  has_pending_exception = !ToLocal<Value>(
+      i::DebugEvaluate::Global(internal_isolate, Utils::OpenHandle(*source),
+                               mode, repl_mode),
+      &result);
   RETURN_ON_FAILED_EXECUTION(Value);
   RETURN_ESCAPED(result);
 }
@@ -10039,6 +10222,38 @@ debug::WeakMap* debug::WeakMap::Cast(v8::Value* value) {
   return static_cast<debug::WeakMap*>(value);
 }
 
+Local<Value> debug::AccessorPair::getter() {
+  i::Handle<i::AccessorPair> accessors = Utils::OpenHandle(this);
+  i::Isolate* isolate = accessors->GetIsolate();
+  i::Handle<i::Object> getter(accessors->getter(), isolate);
+  return Utils::ToLocal(getter);
+}
+
+Local<Value> debug::AccessorPair::setter() {
+  i::Handle<i::AccessorPair> accessors = Utils::OpenHandle(this);
+  i::Isolate* isolate = accessors->GetIsolate();
+  i::Handle<i::Object> setter(accessors->setter(), isolate);
+  return Utils::ToLocal(setter);
+}
+
+bool debug::AccessorPair::IsAccessorPair(Local<Value> that) {
+  i::Handle<i::Object> obj = Utils::OpenHandle(*that);
+  return obj->IsAccessorPair();
+}
+
+MaybeLocal<Message> debug::GetMessageFromPromise(Local<Promise> p) {
+  i::Handle<i::JSPromise> promise = Utils::OpenHandle(*p);
+  i::Isolate* isolate = promise->GetIsolate();
+
+  i::Handle<i::Symbol> key = isolate->factory()->promise_debug_message_symbol();
+  i::Handle<i::Object> maybeMessage =
+      i::JSReceiver::GetDataProperty(promise, key);
+
+  if (!maybeMessage->IsJSMessageObject(isolate)) return MaybeLocal<Message>();
+  return ToApiHandle<Message>(
+      i::Handle<i::JSMessageObject>::cast(maybeMessage));
+}
+
 const char* CpuProfileNode::GetFunctionNameStr() const {
   const i::ProfileNode* node = reinterpret_cast<const i::ProfileNode*>(this);
   return node->entry()->name();
@@ -10097,10 +10312,6 @@ unsigned CpuProfileNode::GetHitCount() const {
   return reinterpret_cast<const i::ProfileNode*>(this)->self_ticks();
 }
 
-unsigned CpuProfileNode::GetCallUid() const {
-  return reinterpret_cast<const i::ProfileNode*>(this)->function_id();
-}
-
 unsigned CpuProfileNode::GetNodeId() const {
   return reinterpret_cast<const i::ProfileNode*>(this)->id();
 }
@@ -10157,18 +10368,17 @@ const CpuProfileNode* CpuProfile::GetSample(int index) const {
 
 int64_t CpuProfile::GetSampleTimestamp(int index) const {
   const i::CpuProfile* profile = reinterpret_cast<const i::CpuProfile*>(this);
-  return (profile->sample(index).timestamp - base::TimeTicks())
-      .InMicroseconds();
+  return profile->sample(index).timestamp.since_origin().InMicroseconds();
 }
 
 int64_t CpuProfile::GetStartTime() const {
   const i::CpuProfile* profile = reinterpret_cast<const i::CpuProfile*>(this);
-  return (profile->start_time() - base::TimeTicks()).InMicroseconds();
+  return profile->start_time().since_origin().InMicroseconds();
 }
 
 int64_t CpuProfile::GetEndTime() const {
   const i::CpuProfile* profile = reinterpret_cast<const i::CpuProfile*>(this);
-  return (profile->end_time() - base::TimeTicks()).InMicroseconds();
+  return profile->end_time().since_origin().InMicroseconds();
 }
 
 int CpuProfile::GetSamplesCount() const {
@@ -10476,10 +10686,11 @@ void HeapProfiler::ClearObjectIds() {
 }
 
 const HeapSnapshot* HeapProfiler::TakeHeapSnapshot(
-    ActivityControl* control, ObjectNameResolver* resolver) {
+    ActivityControl* control, ObjectNameResolver* resolver,
+    bool treat_global_objects_as_roots) {
   return reinterpret_cast<const HeapSnapshot*>(
-      reinterpret_cast<i::HeapProfiler*>(this)->TakeSnapshot(control,
-                                                             resolver));
+      reinterpret_cast<i::HeapProfiler*>(this)->TakeSnapshot(
+          control, resolver, treat_global_objects_as_roots));
 }
 
 void HeapProfiler::StartTrackingHeapObjects(bool track_allocations) {
@@ -10528,72 +10739,17 @@ void HeapProfiler::RemoveBuildEmbedderGraphCallback(
       callback, data);
 }
 
-v8::Testing::StressType internal::Testing::stress_type_ =
-    v8::Testing::kStressTypeOpt;
-
-void Testing::SetStressRunType(Testing::StressType type) {
-  internal::Testing::set_stress_type(type);
-}
-
-int Testing::GetStressRuns() {
-  if (internal::FLAG_stress_runs != 0) return internal::FLAG_stress_runs;
-#ifdef DEBUG
-  // In debug mode the code runs much slower so stressing will only make two
-  // runs.
-  return 2;
-#else
-  return 5;
-#endif
-}
-
-void Testing::PrepareStressRun(int run) {
-  static const char* kLazyOptimizations =
-      "--prepare-always-opt "
-      "--max-inlined-bytecode-size=999999 "
-      "--max-inlined-bytecode-size-cumulative=999999 "
-      "--noalways-opt";
-  static const char* kForcedOptimizations = "--always-opt";
-
-  // If deoptimization stressed turn on frequent deoptimization. If no value
-  // is spefified through --deopt-every-n-times use a default default value.
-  static const char* kDeoptEvery13Times = "--deopt-every-n-times=13";
-  if (internal::Testing::stress_type() == Testing::kStressTypeDeopt &&
-      internal::FLAG_deopt_every_n_times == 0) {
-    V8::SetFlagsFromString(kDeoptEvery13Times);
-  }
-
-#ifdef DEBUG
-  // As stressing in debug mode only make two runs skip the deopt stressing
-  // here.
-  if (run == GetStressRuns() - 1) {
-    V8::SetFlagsFromString(kForcedOptimizations);
-  } else {
-    V8::SetFlagsFromString(kLazyOptimizations);
-  }
-#else
-  if (run == GetStressRuns() - 1) {
-    V8::SetFlagsFromString(kForcedOptimizations);
-  } else if (run != GetStressRuns() - 2) {
-    V8::SetFlagsFromString(kLazyOptimizations);
-  }
-#endif
-}
-
-void Testing::DeoptimizeAll(Isolate* isolate) {
-  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  i::HandleScope scope(i_isolate);
-  i::Deoptimizer::DeoptimizeAll(i_isolate);
+void EmbedderHeapTracer::SetStackStart(void* stack_start) {
+  CHECK(isolate_);
+  reinterpret_cast<i::Isolate*>(isolate_)->global_handles()->SetStackStart(
+      stack_start);
 }
 
-void EmbedderHeapTracer::TraceEpilogue(TraceSummary* trace_summary) {
-#if __clang__
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wdeprecated"
-#endif
-  TraceEpilogue();
-#if __clang__
-#pragma clang diagnostic pop
-#endif
+void EmbedderHeapTracer::NotifyEmptyEmbedderStack() {
+  CHECK(isolate_);
+  reinterpret_cast<i::Isolate*>(isolate_)
+      ->global_handles()
+      ->NotifyEmptyEmbedderStack();
 }
 
 void EmbedderHeapTracer::FinalizeTracing() {
@@ -10648,15 +10804,6 @@ void EmbedderHeapTracer::RegisterEmbedderReference(
       reinterpret_cast<i::Address*>(ref.val_));
 }
 
-void EmbedderHeapTracer::RegisterEmbedderReference(
-    const TracedReferenceBase<v8::Value>& ref) {
-  if (ref.IsEmpty()) return;
-
-  i::Heap* const heap = reinterpret_cast<i::Isolate*>(isolate_)->heap();
-  heap->RegisterExternallyReferencedObject(
-      reinterpret_cast<i::Address*>(ref.val_));
-}
-
 void EmbedderHeapTracer::IterateTracedGlobalHandles(
     TracedGlobalHandleVisitor* visitor) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(isolate_);
@@ -10679,11 +10826,6 @@ void EmbedderHeapTracer::ResetHandleInNonTracingGC(
   UNREACHABLE();
 }
 
-void EmbedderHeapTracer::ResetHandleInNonTracingGC(
-    const v8::TracedGlobal<v8::Value>& handle) {
-  UNREACHABLE();
-}
-
 namespace internal {
 
 const size_t HandleScopeImplementer::kEnteredContextsOffset =
diff --git a/deps/v8/src/api/api.h b/deps/v8/src/api/api.h
index a518670c798e9b..004740099cb78e 100644
--- a/deps/v8/src/api/api.h
+++ b/deps/v8/src/api/api.h
@@ -7,7 +7,6 @@
 
 #include <memory>
 
-#include "include/v8-testing.h"
 #include "src/execution/isolate.h"
 #include "src/heap/factory.h"
 #include "src/objects/bigint.h"
@@ -30,6 +29,7 @@ class JSArrayBufferView;
 }  // namespace internal
 
 namespace debug {
+class AccessorPair;
 class GeneratorObject;
 class Script;
 class WeakMap;
@@ -127,6 +127,7 @@ class RegisteredExtension {
   V(debug::GeneratorObject, JSGeneratorObject) \
   V(debug::Script, Script)                     \
   V(debug::WeakMap, JSWeakMap)                 \
+  V(debug::AccessorPair, AccessorPair)         \
   V(Promise, JSPromise)                        \
   V(Primitive, Object)                         \
   V(PrimitiveArray, FixedArray)                \
@@ -143,6 +144,8 @@ class Utils {
   static void ReportOOMFailure(v8::internal::Isolate* isolate,
                                const char* location, bool is_heap_oom);
 
+  static inline Local<debug::AccessorPair> ToLocal(
+      v8::internal::Handle<v8::internal::AccessorPair> obj);
   static inline Local<Context> ToLocal(
       v8::internal::Handle<v8::internal::Context> obj);
   static inline Local<Value> ToLocal(
@@ -558,17 +561,6 @@ void InvokeAccessorGetterCallback(
 void InvokeFunctionCallback(const v8::FunctionCallbackInfo<v8::Value>& info,
                             v8::FunctionCallback callback);
 
-class Testing {
- public:
-  static v8::Testing::StressType stress_type() { return stress_type_; }
-  static void set_stress_type(v8::Testing::StressType stress_type) {
-    stress_type_ = stress_type;
-  }
-
- private:
-  static v8::Testing::StressType stress_type_;
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/asmjs/OWNERS b/deps/v8/src/asmjs/OWNERS
index 072ba582113ac0..16b08f3b3b743a 100644
--- a/deps/v8/src/asmjs/OWNERS
+++ b/deps/v8/src/asmjs/OWNERS
@@ -1,6 +1,5 @@
 ahaas@chromium.org
 clemensb@chromium.org
-mstarzinger@chromium.org
 titzer@chromium.org
 
 # COMPONENT: Blink>JavaScript>WebAssembly
diff --git a/deps/v8/src/asmjs/asm-js.cc b/deps/v8/src/asmjs/asm-js.cc
index 22714ac16bd41a..033efc45b3ad20 100644
--- a/deps/v8/src/asmjs/asm-js.cc
+++ b/deps/v8/src/asmjs/asm-js.cc
@@ -286,8 +286,8 @@ UnoptimizedCompilationJob::Status AsmJsCompilationJob::FinalizeJobImpl(
           ->SyncCompileTranslatedAsmJs(
               isolate, &thrower,
               wasm::ModuleWireBytes(module_->begin(), module_->end()),
-              Vector<const byte>(asm_offsets_->begin(), asm_offsets_->size()),
-              uses_bitset, shared_info->language_mode())
+              VectorOf(*asm_offsets_), uses_bitset,
+              shared_info->language_mode())
           .ToHandleChecked();
   DCHECK(!thrower.error());
   compile_time_ = compile_timer.Elapsed().InMillisecondsF();
@@ -295,7 +295,7 @@ UnoptimizedCompilationJob::Status AsmJsCompilationJob::FinalizeJobImpl(
   compilation_info()->SetAsmWasmData(result);
 
   RecordHistograms(isolate);
-  ReportCompilationSuccess(parse_info()->script(),
+  ReportCompilationSuccess(handle(Script::cast(shared_info->script()), isolate),
                            compilation_info()->literal()->position(),
                            translate_time_, compile_time_, module_->size());
   return SUCCEEDED;
@@ -361,7 +361,7 @@ MaybeHandle<Object> AsmJs::InstantiateAsmWasm(Isolate* isolate,
   Handle<WasmModuleObject> module =
       wasm_engine->FinalizeTranslatedAsmJs(isolate, wasm_data, script);
 
-  // TODO(mstarzinger): The position currently points to the module definition
+  // TODO(asmjs): The position currently points to the module definition
   // but should instead point to the instantiation site (more intuitive).
   int position = shared->StartPosition();
 
@@ -410,9 +410,9 @@ MaybeHandle<Object> AsmJs::InstantiateAsmWasm(Isolate* isolate,
   }
 
   wasm::ErrorThrower thrower(isolate, "AsmJs::Instantiate");
-  MaybeHandle<Object> maybe_module_object =
+  MaybeHandle<WasmInstanceObject> maybe_instance =
       wasm_engine->SyncInstantiate(isolate, &thrower, module, foreign, memory);
-  if (maybe_module_object.is_null()) {
+  if (maybe_instance.is_null()) {
     // An exception caused by the module start function will be set as pending
     // and bypass the {ErrorThrower}, this happens in case of a stack overflow.
     if (isolate->has_pending_exception()) isolate->clear_pending_exception();
@@ -427,7 +427,7 @@ MaybeHandle<Object> AsmJs::InstantiateAsmWasm(Isolate* isolate,
     return MaybeHandle<Object>();
   }
   DCHECK(!thrower.error());
-  Handle<Object> module_object = maybe_module_object.ToHandleChecked();
+  Handle<WasmInstanceObject> instance = maybe_instance.ToHandleChecked();
 
   ReportInstantiationSuccess(script, position,
                              instantiate_timer.Elapsed().InMillisecondsF());
@@ -435,7 +435,7 @@ MaybeHandle<Object> AsmJs::InstantiateAsmWasm(Isolate* isolate,
   Handle<Name> single_function_name(
       isolate->factory()->InternalizeUtf8String(AsmJs::kSingleFunctionName));
   MaybeHandle<Object> single_function =
-      Object::GetProperty(isolate, module_object, single_function_name);
+      Object::GetProperty(isolate, instance, single_function_name);
   if (!single_function.is_null() &&
       !single_function.ToHandleChecked()->IsUndefined(isolate)) {
     return single_function;
@@ -443,7 +443,7 @@ MaybeHandle<Object> AsmJs::InstantiateAsmWasm(Isolate* isolate,
 
   Handle<String> exports_name =
       isolate->factory()->InternalizeUtf8String("exports");
-  return Object::GetProperty(isolate, module_object, exports_name);
+  return Object::GetProperty(isolate, instance, exports_name);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/asmjs/asm-parser.cc b/deps/v8/src/asmjs/asm-parser.cc
index 33872399262e2a..652fe83a3cb890 100644
--- a/deps/v8/src/asmjs/asm-parser.cc
+++ b/deps/v8/src/asmjs/asm-parser.cc
@@ -240,7 +240,7 @@ void AsmJsParser::AddGlobalImport(Vector<const char> name, AsmType* type,
                                   ValueType vtype, bool mutable_variable,
                                   VarInfo* info) {
   // Allocate a separate variable for the import.
-  // TODO(mstarzinger): Consider using the imported global directly instead of
+  // TODO(asmjs): Consider using the imported global directly instead of
   // allocating a separate global variable for immutable (i.e. const) imports.
   DeclareGlobal(info, mutable_variable, type, vtype);
 
@@ -728,6 +728,9 @@ void AsmJsParser::ValidateFunctionTable() {
 
 // 6.4 ValidateFunction
 void AsmJsParser::ValidateFunction() {
+  // Remember position of the 'function' token as start position.
+  size_t function_start_position = scanner_.Position();
+
   EXPECT_TOKEN(TOK(function));
   if (!scanner_.IsGlobal()) {
     FAIL("Expected function name");
@@ -753,7 +756,8 @@ void AsmJsParser::ValidateFunction() {
   return_type_ = nullptr;
 
   // Record start of the function, used as position for the stack check.
-  current_function_builder_->SetAsmFunctionStartPosition(scanner_.Position());
+  current_function_builder_->SetAsmFunctionStartPosition(
+      function_start_position);
 
   CachedVector<AsmType*> params(&cached_asm_type_p_vectors_);
   ValidateFunctionParams(&params);
@@ -778,6 +782,9 @@ void AsmJsParser::ValidateFunction() {
     // clang-format on
     RECURSE(ValidateStatement());
   }
+
+  size_t function_end_position = scanner_.Position() + 1;
+
   EXPECT_TOKEN('}');
 
   if (!last_statement_is_return) {
@@ -809,6 +816,10 @@ void AsmJsParser::ValidateFunction() {
   // End function
   current_function_builder_->Emit(kExprEnd);
 
+  // Emit function end position as the last position for this function.
+  current_function_builder_->AddAsmWasmOffset(function_end_position,
+                                              function_end_position);
+
   if (current_function_builder_->GetPosition() > kV8MaxWasmFunctionSize) {
     FAIL("Size of function body exceeds internal limit");
   }
@@ -1514,17 +1525,19 @@ AsmType* AsmJsParser::AssignmentExpression() {
       if (!value->IsA(ret)) {
         FAILn("Illegal type stored to heap view");
       }
+      ret = value;
       if (heap_type->IsA(AsmType::Float32Array()) &&
           value->IsA(AsmType::DoubleQ())) {
         // Assignment to a float32 heap can be used to convert doubles.
         current_function_builder_->Emit(kExprF32ConvertF64);
+        ret = AsmType::FloatQ();
       }
       if (heap_type->IsA(AsmType::Float64Array()) &&
           value->IsA(AsmType::FloatQ())) {
         // Assignment to a float64 heap can be used to convert floats.
         current_function_builder_->Emit(kExprF64ConvertF32);
+        ret = AsmType::DoubleQ();
       }
-      ret = value;
 #define V(array_type, wasmload, wasmstore, type)                         \
   if (heap_type->IsA(AsmType::array_type())) {                           \
     current_function_builder_->Emit(kExpr##type##AsmjsStore##wasmstore); \
@@ -1579,14 +1592,17 @@ AsmType* AsmJsParser::UnaryExpression() {
   if (Check('-')) {
     uint32_t uvalue;
     if (CheckForUnsigned(&uvalue)) {
-      // TODO(bradnelson): was supposed to be 0x7FFFFFFF, check errata.
-      if (uvalue <= 0x80000000) {
+      if (uvalue == 0) {
+        current_function_builder_->EmitF64Const(-0.0);
+        ret = AsmType::Double();
+      } else if (uvalue <= 0x80000000) {
+        // TODO(bradnelson): was supposed to be 0x7FFFFFFF, check errata.
         current_function_builder_->EmitI32Const(
             base::NegateWithWraparound(static_cast<int32_t>(uvalue)));
+        ret = AsmType::Signed();
       } else {
         FAILn("Integer numeric literal out of range.");
       }
-      ret = AsmType::Signed();
     } else {
       RECURSEn(ret = UnaryExpression());
       if (ret->IsA(AsmType::Int())) {
@@ -1678,7 +1694,7 @@ AsmType* AsmJsParser::MultiplicativeExpression() {
       RECURSEn(a = UnaryExpression());
     }
   } else if (Check('-')) {
-    if (CheckForUnsignedBelow(0x100000, &uvalue)) {
+    if (!PeekForZero() && CheckForUnsignedBelow(0x100000, &uvalue)) {
       int32_t value = -static_cast<int32_t>(uvalue);
       current_function_builder_->EmitI32Const(value);
       if (Check('*')) {
@@ -1702,7 +1718,7 @@ AsmType* AsmJsParser::MultiplicativeExpression() {
     if (Check('*')) {
       uint32_t uvalue;
       if (Check('-')) {
-        if (CheckForUnsigned(&uvalue)) {
+        if (!PeekForZero() && CheckForUnsigned(&uvalue)) {
           if (uvalue >= 0x100000) {
             FAILn("Constant multiple out of range");
           }
@@ -2430,7 +2446,7 @@ void AsmJsParser::ValidateHeapAccess() {
   uint32_t offset;
   if (CheckForUnsigned(&offset)) {
     // TODO(bradnelson): Check more things.
-    // TODO(mstarzinger): Clarify and explain where this limit is coming from,
+    // TODO(asmjs): Clarify and explain where this limit is coming from,
     // as it is not mandated by the spec directly.
     if (offset > 0x7FFFFFFF ||
         static_cast<uint64_t>(offset) * static_cast<uint64_t>(size) >
diff --git a/deps/v8/src/asmjs/asm-parser.h b/deps/v8/src/asmjs/asm-parser.h
index c7bf30c29e56cb..66b213abc8563d 100644
--- a/deps/v8/src/asmjs/asm-parser.h
+++ b/deps/v8/src/asmjs/asm-parser.h
@@ -250,6 +250,10 @@ class AsmJsParser {
     return scanner_.Token() == token;
   }
 
+  inline bool PeekForZero() {
+    return (scanner_.IsUnsigned() && scanner_.AsUnsigned() == 0);
+  }
+
   inline bool Check(AsmJsScanner::token_t token) {
     if (scanner_.Token() == token) {
       scanner_.Next();
diff --git a/deps/v8/src/asmjs/asm-scanner.cc b/deps/v8/src/asmjs/asm-scanner.cc
index a9e9c2ca566374..eaff042d31cae5 100644
--- a/deps/v8/src/asmjs/asm-scanner.cc
+++ b/deps/v8/src/asmjs/asm-scanner.cc
@@ -424,7 +424,8 @@ void AsmJsScanner::ConsumeCompareOrShift(uc32 ch) {
 }
 
 bool AsmJsScanner::IsIdentifierStart(uc32 ch) {
-  return IsInRange(AsciiAlphaToLower(ch), 'a', 'z') || ch == '_' || ch == '$';
+  return base::IsInRange(AsciiAlphaToLower(ch), 'a', 'z') || ch == '_' ||
+         ch == '$';
 }
 
 bool AsmJsScanner::IsIdentifierPart(uc32 ch) { return IsAsciiIdentifier(ch); }
diff --git a/deps/v8/src/ast/OWNERS b/deps/v8/src/ast/OWNERS
index e6daa80ec97fe7..089db4c25225d2 100644
--- a/deps/v8/src/ast/OWNERS
+++ b/deps/v8/src/ast/OWNERS
@@ -1,9 +1,9 @@
 adamk@chromium.org
 bmeurer@chromium.org
 gsathya@chromium.org
+leszeks@chromium.org
 littledan@chromium.org
 marja@chromium.org
-mstarzinger@chromium.org
 neis@chromium.org
 verwaest@chromium.org
 
diff --git a/deps/v8/src/ast/ast-traversal-visitor.h b/deps/v8/src/ast/ast-traversal-visitor.h
index a52c5f946e0980..af4b49c6c3a949 100644
--- a/deps/v8/src/ast/ast-traversal-visitor.h
+++ b/deps/v8/src/ast/ast-traversal-visitor.h
@@ -395,14 +395,6 @@ void AstTraversalVisitor<Subclass>::VisitProperty(Property* expr) {
   RECURSE_EXPRESSION(Visit(expr->key()));
 }
 
-template <class Subclass>
-void AstTraversalVisitor<Subclass>::VisitResolvedProperty(
-    ResolvedProperty* expr) {
-  PROCESS_EXPRESSION(expr);
-  RECURSE_EXPRESSION(VisitVariableProxy(expr->object()));
-  RECURSE_EXPRESSION(VisitVariableProxy(expr->property()));
-}
-
 template <class Subclass>
 void AstTraversalVisitor<Subclass>::VisitCall(Call* expr) {
   PROCESS_EXPRESSION(expr);
diff --git a/deps/v8/src/ast/ast-value-factory.cc b/deps/v8/src/ast/ast-value-factory.cc
index 55415f0bddf833..fd61cd680801f2 100644
--- a/deps/v8/src/ast/ast-value-factory.cc
+++ b/deps/v8/src/ast/ast-value-factory.cc
@@ -27,6 +27,9 @@
 
 #include "src/ast/ast-value-factory.h"
 
+#include "src/common/globals.h"
+#include "src/heap/factory-inl.h"
+#include "src/heap/off-thread-factory-inl.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/objects.h"
 #include "src/strings/char-predicates-inl.h"
@@ -38,7 +41,7 @@ namespace internal {
 
 namespace {
 
-// For using StringToArrayIndex.
+// For using StringToIndex.
 class OneByteStringStream {
  public:
   explicit OneByteStringStream(Vector<const byte> lb) :
@@ -54,20 +57,42 @@ class OneByteStringStream {
 
 }  // namespace
 
-void AstRawString::Internalize(Isolate* isolate) {
+void AstRawString::Internalize(Factory* factory) {
   DCHECK(!has_string_);
   if (literal_bytes_.length() == 0) {
-    set_string(isolate->factory()->empty_string());
+    set_string(factory->empty_string());
   } else if (is_one_byte()) {
     OneByteStringKey key(hash_field_, literal_bytes_);
-    set_string(StringTable::LookupKey(isolate, &key));
+    set_string(factory->InternalizeStringWithKey(&key));
   } else {
     TwoByteStringKey key(hash_field_,
                          Vector<const uint16_t>::cast(literal_bytes_));
-    set_string(StringTable::LookupKey(isolate, &key));
+    set_string(factory->InternalizeStringWithKey(&key));
   }
 }
 
+void AstRawString::Internalize(OffThreadFactory* factory) {
+  DCHECK(!has_string_);
+  if (literal_bytes_.length() == 0) {
+    set_string(factory->empty_string());
+    return;
+  }
+
+  // For the off-thread case, we already de-duplicated the AstRawStrings during
+  // construction and don't have access to the main thread string table yet, so
+  // we just unconditionally create strings and will internalize them properly
+  // during merging.
+  OffThreadHandle<SeqString> string;
+  if (is_one_byte()) {
+    string = factory->NewOneByteInternalizedString(
+        Vector<const uint8_t>::cast(literal_bytes_), hash_field());
+  } else {
+    string = factory->NewTwoByteInternalizedString(
+        Vector<const uc16>::cast(literal_bytes_), hash_field());
+  }
+  set_string(string);
+}
+
 bool AstRawString::AsArrayIndex(uint32_t* index) const {
   // The StringHasher will set up the hash in such a way that we can use it to
   // figure out whether the string is convertible to an array index.
@@ -76,11 +101,15 @@ bool AstRawString::AsArrayIndex(uint32_t* index) const {
     *index = Name::ArrayIndexValueBits::decode(hash_field_);
   } else {
     OneByteStringStream stream(literal_bytes_);
-    CHECK(StringToArrayIndex(&stream, index));
+    CHECK(StringToIndex(&stream, index));
   }
   return true;
 }
 
+bool AstRawString::IsIntegerIndex() const {
+  return (hash_field_ & Name::kIsNotIntegerIndexMask) == 0;
+}
+
 bool AstRawString::IsOneByteEqualTo(const char* data) const {
   if (!is_one_byte()) return false;
 
@@ -130,22 +159,37 @@ bool AstRawString::Compare(void* a, void* b) {
   }
 }
 
-void AstConsString::Internalize(Isolate* isolate) {
+template <typename Factory>
+void AstConsString::Internalize(Factory* factory) {
   if (IsEmpty()) {
-    set_string(isolate->factory()->empty_string());
+    set_string(factory->empty_string());
     return;
   }
   // AstRawStrings are internalized before AstConsStrings, so
   // AstRawString::string() will just work.
-  Handle<String> tmp(segment_.string->string());
+  FactoryHandle<Factory, String> tmp(segment_.string->string().get<Factory>());
   for (AstConsString::Segment* current = segment_.next; current != nullptr;
        current = current->next) {
-    tmp = isolate->factory()
-              ->NewConsString(current->string->string(), tmp)
-              .ToHandleChecked();
+    tmp =
+        factory
+            ->NewConsString(
+                current->string->string().get<Factory>(), tmp,
+                // TODO(leszeks): This is to avoid memory regressions while this
+                // path is under development -- the off-thread factory doesn't
+                // support young allocations. Figure out a way to avoid memory
+                // regressions related to ConsStrings in the off-thread path.
+                std::is_same<Factory, OffThreadFactory>::value
+                    ? AllocationType::kOld
+                    : AllocationType::kYoung)
+            .ToHandleChecked();
   }
   set_string(tmp);
 }
+template EXPORT_TEMPLATE_DEFINE(
+    V8_EXPORT_PRIVATE) void AstConsString::Internalize<Factory>(Factory*
+                                                                    factory);
+template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE) void AstConsString::
+    Internalize<OffThreadFactory>(OffThreadFactory* factory);
 
 std::forward_list<const AstRawString*> AstConsString::ToRawStrings() const {
   std::forward_list<const AstRawString*> result;
@@ -246,24 +290,30 @@ AstConsString* AstValueFactory::NewConsString(const AstRawString* str1,
   return NewConsString()->AddString(zone_, str1)->AddString(zone_, str2);
 }
 
-void AstValueFactory::Internalize(Isolate* isolate) {
+template <typename Factory>
+void AstValueFactory::Internalize(Factory* factory) {
   // Strings need to be internalized before values, because values refer to
   // strings.
   for (AstRawString* current = strings_; current != nullptr;) {
     AstRawString* next = current->next();
-    current->Internalize(isolate);
+    current->Internalize(factory);
     current = next;
   }
 
   // AstConsStrings refer to AstRawStrings.
   for (AstConsString* current = cons_strings_; current != nullptr;) {
     AstConsString* next = current->next();
-    current->Internalize(isolate);
+    current->Internalize(factory);
     current = next;
   }
 
   ResetStrings();
 }
+template EXPORT_TEMPLATE_DEFINE(
+    V8_EXPORT_PRIVATE) void AstValueFactory::Internalize<Factory>(Factory*
+                                                                      factory);
+template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE) void AstValueFactory::
+    Internalize<OffThreadFactory>(OffThreadFactory* factory);
 
 AstRawString* AstValueFactory::GetString(uint32_t hash_field, bool is_one_byte,
                                          Vector<const byte> literal_bytes) {
diff --git a/deps/v8/src/ast/ast-value-factory.h b/deps/v8/src/ast/ast-value-factory.h
index bc732ce9948654..9c53f0a8f80462 100644
--- a/deps/v8/src/ast/ast-value-factory.h
+++ b/deps/v8/src/ast/ast-value-factory.h
@@ -34,6 +34,7 @@
 #include "src/common/globals.h"
 #include "src/execution/isolate.h"
 #include "src/heap/factory.h"
+#include "src/heap/off-thread-factory.h"
 #include "src/numbers/conversions.h"
 
 // Ast(Raw|Cons)String and AstValueFactory are for storing strings and
@@ -52,10 +53,12 @@ class AstRawString final : public ZoneObject {
                          : literal_bytes_.length() / 2;
   }
   bool AsArrayIndex(uint32_t* index) const;
+  bool IsIntegerIndex() const;
   V8_EXPORT_PRIVATE bool IsOneByteEqualTo(const char* data) const;
   uint16_t FirstCharacter() const;
 
-  void Internalize(Isolate* isolate);
+  void Internalize(Factory* factory);
+  void Internalize(OffThreadFactory* factory);
 
   // Access the physical representation:
   bool is_one_byte() const { return is_one_byte_; }
@@ -67,10 +70,9 @@ class AstRawString final : public ZoneObject {
   uint32_t Hash() const { return hash_field_ >> Name::kHashShift; }
 
   // This function can be called after internalizing.
-  V8_INLINE Handle<String> string() const {
-    DCHECK_NOT_NULL(string_);
+  V8_INLINE HandleOrOffThreadHandle<String> string() const {
     DCHECK(has_string_);
-    return Handle<String>(string_);
+    return string_;
   }
 
  private:
@@ -95,20 +97,18 @@ class AstRawString final : public ZoneObject {
     return &next_;
   }
 
-  void set_string(Handle<String> string) {
+  void set_string(HandleOrOffThreadHandle<String> string) {
     DCHECK(!string.is_null());
     DCHECK(!has_string_);
-    string_ = string.location();
+    string_ = string;
 #ifdef DEBUG
     has_string_ = true;
 #endif
   }
 
-  // {string_} is stored as Address* instead of a Handle<String> so it can be
-  // stored in a union with {next_}.
   union {
     AstRawString* next_;
-    Address* string_;
+    HandleOrOffThreadHandle<String> string_;
   };
 
   Vector<const byte> literal_bytes_;  // Memory owned by Zone.
@@ -143,11 +143,13 @@ class AstConsString final : public ZoneObject {
     return segment_.string == nullptr;
   }
 
-  void Internalize(Isolate* isolate);
+  template <typename Factory>
+  void Internalize(Factory* factory);
 
-  V8_INLINE Handle<String> string() const {
-    DCHECK_NOT_NULL(string_);
-    return Handle<String>(string_);
+  // This function can be called after internalizing.
+  V8_INLINE HandleOrOffThreadHandle<String> string() const {
+    DCHECK(has_string_);
+    return string_;
   }
 
   std::forward_list<const AstRawString*> ToRawStrings() const;
@@ -160,12 +162,20 @@ class AstConsString final : public ZoneObject {
   AstConsString* next() const { return next_; }
   AstConsString** next_location() { return &next_; }
 
+  void set_string(HandleOrOffThreadHandle<String> string) {
+    DCHECK(!string.is_null());
+    DCHECK(!has_string_);
+    string_ = string;
+#ifdef DEBUG
+    has_string_ = true;
+#endif
+  }
+
   // {string_} is stored as Address* instead of a Handle<String> so it can be
   // stored in a union with {next_}.
-  void set_string(Handle<String> string) { string_ = string.location(); }
   union {
     AstConsString* next_;
-    Address* string_;
+    HandleOrOffThreadHandle<String> string_;
   };
 
   struct Segment {
@@ -173,6 +183,13 @@ class AstConsString final : public ZoneObject {
     AstConsString::Segment* next;
   };
   Segment segment_;
+
+#ifdef DEBUG
+  // (Debug-only:) Verify the object life-cylce: Some functions may only be
+  // called after internalization (that is, after a v8::internal::String has
+  // been set); some only before.
+  bool has_string_ = false;
+#endif
 };
 
 enum class AstSymbol : uint8_t { kHomeObjectSymbol };
@@ -209,9 +226,8 @@ class AstBigInt {
   F(dot_default, ".default")                    \
   F(dot_for, ".for")                            \
   F(dot_generator_object, ".generator_object")  \
-  F(dot_iterator, ".iterator")                  \
-  F(dot_promise, ".promise")                    \
   F(dot_result, ".result")                      \
+  F(dot_repl_result, ".repl_result")            \
   F(dot_switch_tag, ".switch_tag")              \
   F(dot_catch, ".catch")                        \
   F(empty, "")                                  \
@@ -313,7 +329,8 @@ class AstValueFactory {
   V8_EXPORT_PRIVATE AstConsString* NewConsString(const AstRawString* str1,
                                                  const AstRawString* str2);
 
-  V8_EXPORT_PRIVATE void Internalize(Isolate* isolate);
+  template <typename Factory>
+  void Internalize(Factory* factory);
 
 #define F(name, str)                           \
   const AstRawString* name##_string() const {  \
@@ -368,6 +385,15 @@ class AstValueFactory {
 
   uint64_t hash_seed_;
 };
+
+extern template EXPORT_TEMPLATE_DECLARE(
+    V8_EXPORT_PRIVATE) void AstValueFactory::Internalize<Factory>(Factory*
+                                                                      factory);
+
+extern template EXPORT_TEMPLATE_DECLARE(
+    V8_EXPORT_PRIVATE) void AstValueFactory::
+    Internalize<OffThreadFactory>(OffThreadFactory* factory);
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/ast/ast.cc b/deps/v8/src/ast/ast.cc
index 130d34dffa518c..12c3aa981ff529 100644
--- a/deps/v8/src/ast/ast.cc
+++ b/deps/v8/src/ast/ast.cc
@@ -12,10 +12,13 @@
 #include "src/base/hashmap.h"
 #include "src/builtins/builtins-constructor.h"
 #include "src/builtins/builtins.h"
+#include "src/common/assert-scope.h"
 #include "src/numbers/conversions-inl.h"
 #include "src/numbers/double.h"
 #include "src/objects/contexts.h"
+#include "src/objects/elements-kind.h"
 #include "src/objects/elements.h"
+#include "src/objects/fixed-array.h"
 #include "src/objects/literal-objects-inl.h"
 #include "src/objects/literal-objects.h"
 #include "src/objects/map.h"
@@ -226,10 +229,6 @@ bool FunctionLiteral::SafeToSkipArgumentsAdaptor() const {
          scope()->rest_parameter() == nullptr;
 }
 
-Handle<String> FunctionLiteral::name(Isolate* isolate) const {
-  return raw_name_ ? raw_name_->string() : isolate->factory()->empty_string();
-}
-
 int FunctionLiteral::start_position() const {
   return scope()->start_position();
 }
@@ -520,7 +519,8 @@ void ObjectLiteral::BuildBoilerplateDescription(Isolate* isolate) {
     Handle<Object> key =
         key_literal->AsArrayIndex(&element_index)
             ? isolate->factory()->NewNumberFromUint(element_index)
-            : Handle<Object>::cast(key_literal->AsRawPropertyName()->string());
+            : Handle<Object>::cast(
+                  key_literal->AsRawPropertyName()->string().get<Factory>());
 
     Handle<Object> value = GetBoilerplateValue(property->value(), isolate);
 
@@ -550,6 +550,8 @@ int ArrayLiteral::InitDepthAndFlags() {
 
   // Fill in the literals.
   bool is_simple = first_spread_index_ < 0;
+  bool is_holey = false;
+  ElementsKind kind = FIRST_FAST_ELEMENTS_KIND;
   int depth_acc = 1;
   int array_index = 0;
   for (; array_index < constants_length; array_index++) {
@@ -562,11 +564,58 @@ int ArrayLiteral::InitDepthAndFlags() {
 
     if (!element->IsCompileTimeValue()) {
       is_simple = false;
+
+      // Don't change kind here: non-compile time values resolve to an unknown
+      // elements kind, so we allow them to be considered as any one of them.
+
+      // TODO(leszeks): It would be nice to DCHECK here that GetBoilerplateValue
+      // will return IsUninitialized, but that would require being on the main
+      // thread which we may not be.
+    } else {
+      Literal* literal = element->AsLiteral();
+
+      if (!literal) {
+        // Only arrays and objects are compile-time values but not (primitive)
+        // literals.
+        DCHECK(element->IsObjectLiteral() || element->IsArrayLiteral());
+        kind = PACKED_ELEMENTS;
+      } else {
+        switch (literal->type()) {
+          case Literal::kTheHole:
+            is_holey = true;
+            // The hole is allowed in holey double arrays (and holey Smi
+            // arrays), so ignore it as far as is_all_number is concerned.
+            break;
+          case Literal::kHeapNumber:
+            if (kind == PACKED_SMI_ELEMENTS) kind = PACKED_DOUBLE_ELEMENTS;
+            DCHECK_EQ(kind,
+                      GetMoreGeneralElementsKind(kind, PACKED_DOUBLE_ELEMENTS));
+            break;
+          case Literal::kSmi:
+            DCHECK_EQ(kind,
+                      GetMoreGeneralElementsKind(kind, PACKED_SMI_ELEMENTS));
+            break;
+          case Literal::kBigInt:
+          case Literal::kString:
+          case Literal::kSymbol:
+          case Literal::kBoolean:
+          case Literal::kUndefined:
+          case Literal::kNull:
+            kind = PACKED_ELEMENTS;
+            break;
+        }
+      }
     }
   }
 
+  if (is_holey) {
+    kind = GetHoleyElementsKind(kind);
+  }
+
   set_depth(depth_acc);
   set_is_simple(is_simple);
+  set_boilerplate_descriptor_kind(kind);
+
   // Array literals always need an initial allocation site to properly track
   // elements transitions.
   set_needs_initial_allocation_site(true);
@@ -578,55 +627,72 @@ void ArrayLiteral::BuildBoilerplateDescription(Isolate* isolate) {
 
   int constants_length =
       first_spread_index_ >= 0 ? first_spread_index_ : values()->length();
-  ElementsKind kind = FIRST_FAST_ELEMENTS_KIND;
-  Handle<FixedArray> fixed_array =
-      isolate->factory()->NewFixedArrayWithHoles(constants_length);
+  ElementsKind kind = boilerplate_descriptor_kind();
+  bool use_doubles = IsDoubleElementsKind(kind);
+
+  Handle<FixedArrayBase> elements;
+  if (use_doubles) {
+    elements = isolate->factory()->NewFixedDoubleArray(constants_length);
+  } else {
+    elements = isolate->factory()->NewFixedArrayWithHoles(constants_length);
+  }
 
   // Fill in the literals.
-  bool is_holey = false;
   int array_index = 0;
   for (; array_index < constants_length; array_index++) {
     Expression* element = values()->at(array_index);
     DCHECK(!element->IsSpread());
-    MaterializedLiteral* m_literal = element->AsMaterializedLiteral();
-    if (m_literal != nullptr) {
-      m_literal->BuildConstants(isolate);
-    }
+    if (use_doubles) {
+      Literal* literal = element->AsLiteral();
 
-    // New handle scope here, needs to be after BuildContants().
-    HandleScope scope(isolate);
-    Handle<Object> boilerplate_value = GetBoilerplateValue(element, isolate);
-    if (boilerplate_value->IsTheHole(isolate)) {
-      is_holey = true;
-      continue;
-    }
+      if (literal && literal->type() == Literal::kTheHole) {
+        DCHECK(IsHoleyElementsKind(kind));
+        DCHECK(GetBoilerplateValue(element, isolate)->IsTheHole(isolate));
+        FixedDoubleArray::cast(*elements).set_the_hole(array_index);
+        continue;
+      } else if (literal && literal->IsNumber()) {
+        FixedDoubleArray::cast(*elements).set(array_index, literal->AsNumber());
+      } else {
+        DCHECK(GetBoilerplateValue(element, isolate)->IsUninitialized(isolate));
+        FixedDoubleArray::cast(*elements).set(array_index, 0);
+      }
 
-    if (boilerplate_value->IsUninitialized(isolate)) {
-      boilerplate_value = handle(Smi::kZero, isolate);
-    }
+    } else {
+      MaterializedLiteral* m_literal = element->AsMaterializedLiteral();
+      if (m_literal != nullptr) {
+        m_literal->BuildConstants(isolate);
+      }
 
-    kind = GetMoreGeneralElementsKind(
-        kind, boilerplate_value->OptimalElementsKind(isolate));
-    fixed_array->set(array_index, *boilerplate_value);
-  }
+      // New handle scope here, needs to be after BuildContants().
+      HandleScope scope(isolate);
+
+      Object boilerplate_value = *GetBoilerplateValue(element, isolate);
+      // We shouldn't allocate after creating the boilerplate value.
+      DisallowHeapAllocation no_gc;
 
-  if (is_holey) kind = GetHoleyElementsKind(kind);
+      if (boilerplate_value.IsTheHole(isolate)) {
+        DCHECK(IsHoleyElementsKind(kind));
+        continue;
+      }
+
+      if (boilerplate_value.IsUninitialized(isolate)) {
+        boilerplate_value = Smi::zero();
+      }
+
+      DCHECK_EQ(boilerplate_descriptor_kind(),
+                GetMoreGeneralElementsKind(
+                    boilerplate_descriptor_kind(),
+                    boilerplate_value.OptimalElementsKind(isolate)));
+
+      Handle<FixedArray>::cast(elements)->set(array_index, boilerplate_value);
+    }
+  }
 
   // Simple and shallow arrays can be lazily copied, we transform the
   // elements array to a copy-on-write array.
   if (is_simple() && depth() == 1 && array_index > 0 &&
       IsSmiOrObjectElementsKind(kind)) {
-    fixed_array->set_map(ReadOnlyRoots(isolate).fixed_cow_array_map());
-  }
-
-  Handle<FixedArrayBase> elements = fixed_array;
-  if (IsDoubleElementsKind(kind)) {
-    ElementsAccessor* accessor = ElementsAccessor::ForKind(kind);
-    elements = isolate->factory()->NewFixedDoubleArray(constants_length);
-    // We are copying from non-fast-double to fast-double.
-    ElementsKind from_kind = TERMINAL_FAST_ELEMENTS_KIND;
-    accessor->CopyElements(isolate, fixed_array, from_kind, elements,
-                           constants_length);
+    elements->set_map(ReadOnlyRoots(isolate).fixed_cow_array_map());
   }
 
   boilerplate_description_ =
@@ -703,11 +769,11 @@ Handle<TemplateObjectDescription> GetTemplateObject::GetOrBuildDescription(
   bool raw_and_cooked_match = true;
   for (int i = 0; i < raw_strings->length(); ++i) {
     if (this->cooked_strings()->at(i) == nullptr ||
-        *this->raw_strings()->at(i)->string() !=
-            *this->cooked_strings()->at(i)->string()) {
+        *this->raw_strings()->at(i)->string().get<Factory>() !=
+            *this->cooked_strings()->at(i)->string().get<Factory>()) {
       raw_and_cooked_match = false;
     }
-    raw_strings->set(i, *this->raw_strings()->at(i)->string());
+    raw_strings->set(i, *this->raw_strings()->at(i)->string().get<Factory>());
   }
   Handle<FixedArray> cooked_strings = raw_strings;
   if (!raw_and_cooked_match) {
@@ -715,7 +781,8 @@ Handle<TemplateObjectDescription> GetTemplateObject::GetOrBuildDescription(
         this->cooked_strings()->length(), AllocationType::kOld);
     for (int i = 0; i < cooked_strings->length(); ++i) {
       if (this->cooked_strings()->at(i) != nullptr) {
-        cooked_strings->set(i, *this->cooked_strings()->at(i)->string());
+        cooked_strings->set(
+            i, *this->cooked_strings()->at(i)->string().get<Factory>());
       } else {
         cooked_strings->set(i, ReadOnlyRoots(isolate).undefined_value());
       }
@@ -835,22 +902,30 @@ Call::CallType Call::GetCallType() const {
   if (expression()->IsSuperCallReference()) return SUPER_CALL;
 
   Property* property = expression()->AsProperty();
+  bool is_optional_chain = false;
+  if (V8_UNLIKELY(property == nullptr && expression()->IsOptionalChain())) {
+    is_optional_chain = true;
+    property = expression()->AsOptionalChain()->expression()->AsProperty();
+  }
   if (property != nullptr) {
     if (property->IsPrivateReference()) {
       return PRIVATE_CALL;
     }
     bool is_super = property->IsSuperAccess();
+    // `super?.` is not syntactically valid, so a property load cannot be both
+    // super and an optional chain.
+    DCHECK(!is_super || !is_optional_chain);
     if (property->key()->IsPropertyName()) {
-      return is_super ? NAMED_SUPER_PROPERTY_CALL : NAMED_PROPERTY_CALL;
+      if (is_super) return NAMED_SUPER_PROPERTY_CALL;
+      if (is_optional_chain) return NAMED_OPTIONAL_CHAIN_PROPERTY_CALL;
+      return NAMED_PROPERTY_CALL;
     } else {
-      return is_super ? KEYED_SUPER_PROPERTY_CALL : KEYED_PROPERTY_CALL;
+      if (is_super) return KEYED_SUPER_PROPERTY_CALL;
+      if (is_optional_chain) return KEYED_OPTIONAL_CHAIN_PROPERTY_CALL;
+      return KEYED_PROPERTY_CALL;
     }
   }
 
-  if (expression()->IsResolvedProperty()) {
-    return RESOLVED_PROPERTY_CALL;
-  }
-
   return OTHER_CALL;
 }
 
@@ -892,7 +967,7 @@ Handle<Object> Literal::BuildValue(Isolate* isolate) const {
     case kHeapNumber:
       return isolate->factory()->NewNumber<AllocationType::kOld>(number_);
     case kString:
-      return string_->string();
+      return string_->string().get<Factory>();
     case kSymbol:
       return isolate->factory()->home_object_symbol();
     case kBoolean:
diff --git a/deps/v8/src/ast/ast.h b/deps/v8/src/ast/ast.h
index d706dbc37fbc7b..06af719d55e50f 100644
--- a/deps/v8/src/ast/ast.h
+++ b/deps/v8/src/ast/ast.h
@@ -16,6 +16,7 @@
 #include "src/common/globals.h"
 #include "src/execution/isolate.h"
 #include "src/heap/factory.h"
+#include "src/objects/elements-kind.h"
 #include "src/objects/function-syntax-kind.h"
 #include "src/objects/literal-objects.h"
 #include "src/objects/smi.h"
@@ -97,7 +98,6 @@ namespace internal {
   V(NativeFunctionLiteral)      \
   V(OptionalChain)              \
   V(Property)                   \
-  V(ResolvedProperty)           \
   V(Spread)                     \
   V(StoreInArrayLiteral)        \
   V(SuperCallReference)         \
@@ -170,7 +170,7 @@ class AstNode: public ZoneObject {
   void* operator new(size_t size);
 
   int position_;
-  using NodeTypeField = BitField<NodeType, 0, 6>;
+  using NodeTypeField = base::BitField<NodeType, 0, 6>;
 
  protected:
   uint32_t bit_field_;
@@ -259,7 +259,7 @@ class Expression : public AstNode {
 
   bool IsPattern() {
     STATIC_ASSERT(kObjectLiteral + 1 == kArrayLiteral);
-    return IsInRange(node_type(), kObjectLiteral, kArrayLiteral);
+    return base::IsInRange(node_type(), kObjectLiteral, kArrayLiteral);
   }
 
   bool is_parenthesized() const {
@@ -914,8 +914,17 @@ class TryCatchStatement final : public TryStatement {
   // (When the catch block doesn't rethrow but is guaranteed to perform an
   // ordinary throw, not clearing the old message is safe but not very
   // useful.)
+  //
+  // For scripts in repl mode there is exactly one catch block with
+  // UNCAUGHT_ASYNC_AWAIT prediction. This catch block needs to preserve
+  // the exception so it can be re-used later by the inspector.
   inline bool ShouldClearPendingException(
       HandlerTable::CatchPrediction outer_catch_prediction) const {
+    if (catch_prediction_ == HandlerTable::UNCAUGHT_ASYNC_AWAIT) {
+      DCHECK_EQ(outer_catch_prediction, HandlerTable::UNCAUGHT);
+      return false;
+    }
+
     return catch_prediction_ != HandlerTable::UNCAUGHT ||
            outer_catch_prediction != HandlerTable::UNCAUGHT;
   }
@@ -1168,7 +1177,7 @@ class MaterializedLiteral : public Expression {
 // Node for capturing a regexp literal.
 class RegExpLiteral final : public MaterializedLiteral {
  public:
-  Handle<String> pattern() const { return pattern_->string(); }
+  Handle<String> pattern() const { return pattern_->string().get<Factory>(); }
   const AstRawString* raw_pattern() const { return pattern_; }
   int flags() const { return flags_; }
 
@@ -1218,24 +1227,37 @@ class AggregateLiteral : public MaterializedLiteral {
   // constants and simple object and array literals.
   bool is_simple() const { return IsSimpleField::decode(bit_field_); }
 
+  ElementsKind boilerplate_descriptor_kind() const {
+    return BoilerplateDescriptorKindField::decode(bit_field_);
+  }
+
  private:
   int depth_ : 31;
   using NeedsInitialAllocationSiteField =
       MaterializedLiteral::NextBitField<bool, 1>;
   using IsSimpleField = NeedsInitialAllocationSiteField::Next<bool, 1>;
+  using BoilerplateDescriptorKindField =
+      IsSimpleField::Next<ElementsKind, kFastElementsKindBits>;
 
  protected:
   friend class AstNodeFactory;
   AggregateLiteral(int pos, NodeType type)
       : MaterializedLiteral(pos, type), depth_(0) {
-    bit_field_ |= NeedsInitialAllocationSiteField::encode(false) |
-                  IsSimpleField::encode(false);
+    bit_field_ |=
+        NeedsInitialAllocationSiteField::encode(false) |
+        IsSimpleField::encode(false) |
+        BoilerplateDescriptorKindField::encode(FIRST_FAST_ELEMENTS_KIND);
   }
 
   void set_is_simple(bool is_simple) {
     bit_field_ = IsSimpleField::update(bit_field_, is_simple);
   }
 
+  void set_boilerplate_descriptor_kind(ElementsKind kind) {
+    DCHECK(IsFastElementsKind(kind));
+    bit_field_ = BoilerplateDescriptorKindField::update(bit_field_, kind);
+  }
+
   void set_depth(int depth) {
     DCHECK(!is_initialized());
     depth_ = depth;
@@ -1246,7 +1268,7 @@ class AggregateLiteral : public MaterializedLiteral {
   }
 
   template <class T, int size>
-  using NextBitField = IsSimpleField::Next<T, size>;
+  using NextBitField = BoilerplateDescriptorKindField::Next<T, size>;
 };
 
 // Common supertype for ObjectLiteralProperty and ClassLiteralProperty
@@ -1485,7 +1507,7 @@ class VariableProxy final : public Expression {
  public:
   bool IsValidReferenceExpression() const { return !is_new_target(); }
 
-  Handle<String> name() const { return raw_name()->string(); }
+  Handle<String> name() const { return raw_name()->string().get<Factory>(); }
   const AstRawString* raw_name() const {
     return is_resolved() ? var_->raw_name() : raw_name_;
   }
@@ -1692,26 +1714,6 @@ class Property final : public Expression {
   Expression* key_;
 };
 
-// ResolvedProperty pairs a receiver field with a value field. It allows Call
-// to support arbitrary receivers while still taking advantage of TypeFeedback.
-class ResolvedProperty final : public Expression {
- public:
-  VariableProxy* object() const { return object_; }
-  VariableProxy* property() const { return property_; }
-
-  void set_object(VariableProxy* e) { object_ = e; }
-  void set_property(VariableProxy* e) { property_ = e; }
-
- private:
-  friend class AstNodeFactory;
-
-  ResolvedProperty(VariableProxy* obj, VariableProxy* property, int pos)
-      : Expression(pos, kResolvedProperty), object_(obj), property_(property) {}
-
-  VariableProxy* object_;
-  VariableProxy* property_;
-};
-
 class Call final : public Expression {
  public:
   Expression* expression() const { return expression_; }
@@ -1738,12 +1740,13 @@ class Call final : public Expression {
     WITH_CALL,
     NAMED_PROPERTY_CALL,
     KEYED_PROPERTY_CALL,
+    NAMED_OPTIONAL_CHAIN_PROPERTY_CALL,
+    KEYED_OPTIONAL_CHAIN_PROPERTY_CALL,
     NAMED_SUPER_PROPERTY_CALL,
     KEYED_SUPER_PROPERTY_CALL,
     PRIVATE_CALL,
     SUPER_CALL,
-    RESOLVED_PROPERTY_CALL,
-    OTHER_CALL
+    OTHER_CALL,
   };
 
   enum PossiblyEval {
@@ -2216,9 +2219,9 @@ class FunctionLiteral final : public Expression {
   // Empty handle means that the function does not have a shared name (i.e.
   // the name will be set dynamically after creation of the function closure).
   MaybeHandle<String> name() const {
-    return raw_name_ ? raw_name_->string() : MaybeHandle<String>();
+    return raw_name_ ? raw_name_->string().get<Factory>()
+                     : MaybeHandle<String>();
   }
-  Handle<String> name(Isolate* isolate) const;
   bool has_shared_name() const { return raw_name_ != nullptr; }
   const AstConsString* raw_name() const { return raw_name_; }
   void set_raw_name(const AstConsString* name) { raw_name_ = name; }
@@ -2281,7 +2284,7 @@ class FunctionLiteral final : public Expression {
       return inferred_name_;
     }
     if (raw_inferred_name_ != nullptr) {
-      return raw_inferred_name_->string();
+      return raw_inferred_name_->string().get<Factory>();
     }
     UNREACHABLE();
   }
@@ -2566,7 +2569,7 @@ class ClassLiteral final : public Expression {
 
 class NativeFunctionLiteral final : public Expression {
  public:
-  Handle<String> name() const { return name_->string(); }
+  Handle<String> name() const { return name_->string().get<Factory>(); }
   const AstRawString* raw_name() const { return name_; }
   v8::Extension* extension() const { return extension_; }
 
@@ -2950,6 +2953,14 @@ class AstNodeFactory final {
                                          HandlerTable::ASYNC_AWAIT, pos);
   }
 
+  TryCatchStatement* NewTryCatchStatementForReplAsyncAwait(Block* try_block,
+                                                           Scope* scope,
+                                                           Block* catch_block,
+                                                           int pos) {
+    return new (zone_) TryCatchStatement(
+        try_block, scope, catch_block, HandlerTable::UNCAUGHT_ASYNC_AWAIT, pos);
+  }
+
   TryFinallyStatement* NewTryFinallyStatement(Block* try_block,
                                               Block* finally_block, int pos) {
     return new (zone_) TryFinallyStatement(try_block, finally_block, pos);
@@ -3091,12 +3102,6 @@ class AstNodeFactory final {
     return new (zone_) Property(obj, key, pos, optional_chain);
   }
 
-  ResolvedProperty* NewResolvedProperty(VariableProxy* obj,
-                                        VariableProxy* property,
-                                        int pos = kNoSourcePosition) {
-    return new (zone_) ResolvedProperty(obj, property, pos);
-  }
-
   Call* NewCall(Expression* expression,
                 const ScopedPtrList<Expression>& arguments, int pos,
                 Call::PossiblyEval possibly_eval = Call::NOT_EVAL,
diff --git a/deps/v8/src/ast/modules.cc b/deps/v8/src/ast/modules.cc
index 9c122fca869c2c..533a11524c700f 100644
--- a/deps/v8/src/ast/modules.cc
+++ b/deps/v8/src/ast/modules.cc
@@ -86,9 +86,10 @@ void SourceTextModuleDescriptor::AddStarExport(
 namespace {
 Handle<PrimitiveHeapObject> ToStringOrUndefined(Isolate* isolate,
                                                 const AstRawString* s) {
-  return (s == nullptr) ? Handle<PrimitiveHeapObject>::cast(
-                              isolate->factory()->undefined_value())
-                        : Handle<PrimitiveHeapObject>::cast(s->string());
+  return (s == nullptr)
+             ? Handle<PrimitiveHeapObject>::cast(
+                   isolate->factory()->undefined_value())
+             : Handle<PrimitiveHeapObject>::cast(s->string().get<Factory>());
 }
 }  // namespace
 
@@ -126,7 +127,7 @@ Handle<FixedArray> SourceTextModuleDescriptor::SerializeRegularExports(
 
     Handle<FixedArray> export_names = isolate->factory()->NewFixedArray(count);
     data[index + SourceTextModuleInfo::kRegularExportLocalNameOffset] =
-        it->second->local_name->string();
+        it->second->local_name->string().get<Factory>();
     data[index + SourceTextModuleInfo::kRegularExportCellIndexOffset] =
         handle(Smi::FromInt(it->second->cell_index), isolate);
     data[index + SourceTextModuleInfo::kRegularExportExportNamesOffset] =
@@ -136,7 +137,7 @@ Handle<FixedArray> SourceTextModuleDescriptor::SerializeRegularExports(
     // Collect the export names.
     int i = 0;
     for (; it != next; ++it) {
-      export_names->set(i++, *it->second->export_name->string());
+      export_names->set(i++, *it->second->export_name->string().get<Factory>());
     }
     DCHECK_EQ(i, count);
 
diff --git a/deps/v8/src/ast/prettyprinter.cc b/deps/v8/src/ast/prettyprinter.cc
index 5bf9362fb8c5b7..4d8bd006c58963 100644
--- a/deps/v8/src/ast/prettyprinter.cc
+++ b/deps/v8/src/ast/prettyprinter.cc
@@ -401,8 +401,6 @@ void CallPrinter::VisitProperty(Property* node) {
   }
 }
 
-void CallPrinter::VisitResolvedProperty(ResolvedProperty* node) {}
-
 void CallPrinter::VisitCall(Call* node) {
   bool was_found = false;
   if (node->position() == position_) {
@@ -582,16 +580,16 @@ void CallPrinter::PrintLiteral(Handle<Object> value, bool quote) {
     Print(isolate_->factory()->NumberToString(value));
   } else if (value->IsSymbol()) {
     // Symbols can only occur as literals if they were inserted by the parser.
-    PrintLiteral(handle(Handle<Symbol>::cast(value)->name(), isolate_), false);
+    PrintLiteral(handle(Handle<Symbol>::cast(value)->description(), isolate_),
+                 false);
   }
 }
 
 
 void CallPrinter::PrintLiteral(const AstRawString* value, bool quote) {
-  PrintLiteral(value->string(), quote);
+  PrintLiteral(value->string().get<Factory>(), quote);
 }
 
-
 //-----------------------------------------------------------------------------
 
 
@@ -1050,6 +1048,9 @@ void AstPrinter::VisitTryCatchStatement(TryCatchStatement* node) {
     case HandlerTable::ASYNC_AWAIT:
       prediction = "ASYNC_AWAIT";
       break;
+    case HandlerTable::UNCAUGHT_ASYNC_AWAIT:
+      prediction = "UNCAUGHT_ASYNC_AWAIT";
+      break;
     case HandlerTable::PROMISE:
       // Catch prediction resulting in promise rejections aren't
       // parsed by the parser.
@@ -1271,6 +1272,9 @@ void AstPrinter::VisitVariableProxy(VariableProxy* node) {
       case VariableLocation::MODULE:
         SNPrintF(buf + pos, " module");
         break;
+      case VariableLocation::REPL_GLOBAL:
+        SNPrintF(buf + pos, " repl global[%d]", var->index());
+        break;
     }
     PrintLiteralWithModeIndented(buf.begin(), var, node->raw_name());
   }
@@ -1357,15 +1361,6 @@ void AstPrinter::VisitProperty(Property* node) {
   }
 }
 
-void AstPrinter::VisitResolvedProperty(ResolvedProperty* node) {
-  EmbeddedVector<char, 128> buf;
-  SNPrintF(buf, "RESOLVED-PROPERTY");
-  IndentedScope indent(this, buf.begin(), node->position());
-
-  PrintIndentedVisit("RECEIVER", node->object());
-  PrintIndentedVisit("PROPERTY", node->property());
-}
-
 void AstPrinter::VisitCall(Call* node) {
   EmbeddedVector<char, 128> buf;
   SNPrintF(buf, "CALL");
diff --git a/deps/v8/src/ast/scopes.cc b/deps/v8/src/ast/scopes.cc
index 3e1f8f53ae2111..b422e56c4f11ab 100644
--- a/deps/v8/src/ast/scopes.cc
+++ b/deps/v8/src/ast/scopes.cc
@@ -7,6 +7,7 @@
 #include <set>
 
 #include "src/ast/ast.h"
+#include "src/base/logging.h"
 #include "src/base/optional.h"
 #include "src/builtins/accessors.h"
 #include "src/common/message-template.h"
@@ -110,10 +111,15 @@ Scope::Scope(Zone* zone, Scope* outer_scope, ScopeType scope_type)
 }
 
 DeclarationScope::DeclarationScope(Zone* zone,
-                                   AstValueFactory* ast_value_factory)
-    : Scope(zone), function_kind_(kNormalFunction), params_(4, zone) {
+                                   AstValueFactory* ast_value_factory,
+                                   REPLMode repl_mode)
+    : Scope(zone),
+      function_kind_(repl_mode == REPLMode::kYes ? kAsyncFunction
+                                                 : kNormalFunction),
+      params_(4, zone) {
   DCHECK_EQ(scope_type_, SCRIPT_SCOPE);
   SetDefaults();
+  is_repl_mode_scope_ = repl_mode == REPLMode::kYes;
   receiver_ = DeclareDynamicGlobal(ast_value_factory->this_string(),
                                    THIS_VARIABLE, this);
 }
@@ -196,8 +202,7 @@ Scope::Scope(Zone* zone, ScopeType scope_type, Handle<ScopeInfo> scope_info)
   already_resolved_ = true;
 #endif
   set_language_mode(scope_info->language_mode());
-  num_heap_slots_ = scope_info->ContextLength();
-  DCHECK_LE(Context::MIN_CONTEXT_SLOTS, num_heap_slots_);
+  DCHECK_EQ(ContextHeaderLength(), num_heap_slots_);
   private_name_lookup_skips_outer_class_ =
       scope_info->PrivateNameLookupSkipsOuterClass();
   // We don't really need to use the preparsed scope data; this is just to
@@ -284,11 +289,6 @@ void Scope::SetDefaults() {
   start_position_ = kNoSourcePosition;
   end_position_ = kNoSourcePosition;
 
-  num_stack_slots_ = 0;
-  num_heap_slots_ = Context::MIN_CONTEXT_SLOTS;
-
-  set_language_mode(LanguageMode::kSloppy);
-
   calls_eval_ = false;
   sloppy_eval_can_extend_vars_ = false;
   scope_nonlinear_ = false;
@@ -303,6 +303,14 @@ void Scope::SetDefaults() {
   private_name_lookup_skips_outer_class_ = false;
 
   must_use_preparsed_scope_data_ = false;
+  is_repl_mode_scope_ = false;
+
+  deserialized_scope_uses_external_cache_ = false;
+
+  num_stack_slots_ = 0;
+  num_heap_slots_ = ContextHeaderLength();
+
+  set_language_mode(LanguageMode::kSloppy);
 }
 
 bool Scope::HasSimpleParameters() {
@@ -344,6 +352,7 @@ Scope* Scope::DeserializeScopeChain(Isolate* isolate, Zone* zone,
   Scope* current_scope = nullptr;
   Scope* innermost_scope = nullptr;
   Scope* outer_scope = nullptr;
+  bool cache_scope_found = false;
   while (!scope_info.is_null()) {
     if (scope_info.scope_type() == WITH_SCOPE) {
       if (scope_info.IsDebugEvaluateScope()) {
@@ -363,6 +372,7 @@ Scope* Scope::DeserializeScopeChain(Isolate* isolate, Zone* zone,
       if (deserialization_mode == DeserializationMode::kIncludingVariables) {
         script_scope->SetScriptScopeInfo(handle(scope_info, isolate));
       }
+      if (scope_info.IsReplModeScope()) script_scope->set_is_repl_mode_scope();
       DCHECK(!scope_info.HasOuterScopeInfo());
       break;
     } else if (scope_info.scope_type() == FUNCTION_SCOPE) {
@@ -403,6 +413,15 @@ Scope* Scope::DeserializeScopeChain(Isolate* isolate, Zone* zone,
     if (deserialization_mode == DeserializationMode::kScopesOnly) {
       outer_scope->scope_info_ = Handle<ScopeInfo>::null();
     }
+
+    if (cache_scope_found) {
+      outer_scope->set_deserialized_scope_uses_external_cache();
+    } else {
+      DCHECK(!cache_scope_found);
+      cache_scope_found =
+          outer_scope->is_declaration_scope() && !outer_scope->is_eval_scope();
+    }
+
     if (current_scope != nullptr) {
       outer_scope->AddInnerScope(current_scope);
     }
@@ -473,10 +492,7 @@ void DeclarationScope::HoistSloppyBlockFunctions(AstNodeFactory* factory) {
   DCHECK(parameter_scope->is_function_scope() || is_eval_scope() ||
          is_script_scope());
 
-  DeclarationScope* decl_scope = this;
-  while (decl_scope->is_eval_scope()) {
-    decl_scope = decl_scope->outer_scope()->GetDeclarationScope();
-  }
+  DeclarationScope* decl_scope = GetNonEvalDeclarationScope();
   Scope* outer_scope = decl_scope->outer_scope();
 
   // For each variable which is used as a function declaration in a sloppy
@@ -502,8 +518,11 @@ void DeclarationScope::HoistSloppyBlockFunctions(AstNodeFactory* factory) {
     // It is not sufficient to just do a Lookup on query_scope: for
     // example, that does not prevent hoisting of the function in
     // `{ let e; try {} catch (e) { function e(){} } }`
+    //
+    // Don't use a generic cache scope, as the cache scope would be the outer
+    // scope and we terminate the iteration there anyway.
     do {
-      var = query_scope->LookupInScopeOrScopeInfo(name);
+      var = query_scope->LookupInScopeOrScopeInfo(name, query_scope);
       if (var != nullptr && IsLexicalVariableMode(var->mode())) {
         should_hoist = false;
         break;
@@ -547,10 +566,8 @@ void DeclarationScope::HoistSloppyBlockFunctions(AstNodeFactory* factory) {
 
 bool DeclarationScope::Analyze(ParseInfo* info) {
   RuntimeCallTimerScope runtimeTimer(
-      info->runtime_call_stats(),
-      info->on_background_thread()
-          ? RuntimeCallCounterId::kCompileBackgroundScopeAnalysis
-          : RuntimeCallCounterId::kCompileScopeAnalysis);
+      info->runtime_call_stats(), RuntimeCallCounterId::kCompileScopeAnalysis,
+      RuntimeCallStats::kThreadSpecific);
   DCHECK_NOT_NULL(info->literal());
   DeclarationScope* scope = info->literal()->scope();
 
@@ -583,6 +600,7 @@ bool DeclarationScope::Analyze(ParseInfo* info) {
   }
 
   if (!scope->AllocateVariables(info)) return false;
+  scope->GetScriptScope()->RewriteReplGlobalVariables();
 
 #ifdef DEBUG
   if (FLAG_print_scopes) {
@@ -653,6 +671,7 @@ Variable* DeclarationScope::DeclareFunctionVar(const AstRawString* name,
   DCHECK(is_function_scope());
   DCHECK_NULL(function_);
   if (cache == nullptr) cache = this;
+  DCHECK(this->IsOuterScopeOf(cache));
   DCHECK_NULL(cache->variables_.Lookup(name));
   VariableKind kind = is_sloppy(language_mode()) ? SLOPPY_FUNCTION_NAME_VARIABLE
                                                  : NORMAL_VARIABLE;
@@ -668,7 +687,7 @@ Variable* DeclarationScope::DeclareFunctionVar(const AstRawString* name,
 
 Variable* DeclarationScope::DeclareGeneratorObjectVar(
     const AstRawString* name) {
-  DCHECK(is_function_scope() || is_module_scope());
+  DCHECK(is_function_scope() || is_module_scope() || is_repl_mode_scope());
   DCHECK_NULL(generator_object_var());
 
   Variable* result = EnsureRareData()->generator_object =
@@ -806,10 +825,17 @@ void Scope::ReplaceOuterScope(Scope* outer) {
 
 Variable* Scope::LookupInScopeInfo(const AstRawString* name, Scope* cache) {
   DCHECK(!scope_info_.is_null());
+  DCHECK(this->IsOuterScopeOf(cache));
+  DCHECK(!cache->deserialized_scope_uses_external_cache());
+  // The case where where the cache can be another scope is when the cache scope
+  // is the last scope that doesn't use an external cache.
+  DCHECK_IMPLIES(
+      cache != this,
+      cache->outer_scope()->deserialized_scope_uses_external_cache());
   DCHECK_NULL(cache->variables_.Lookup(name));
   DisallowHeapAllocation no_gc;
 
-  String name_handle = *name->string();
+  String name_handle = *name->string().get<Factory>();
   // The Scope is backed up by ScopeInfo. This means it cannot operate in a
   // heap-independent mode, and all strings must be internalized immediately. So
   // it's ok to get the Handle<String> here.
@@ -1143,11 +1169,7 @@ Declaration* DeclarationScope::CheckConflictingVarDeclarations() {
   // Var declarations in sloppy eval are hoisted to the first non-eval
   // declaration scope. Check for conflicts between the eval scope that
   // declaration scope.
-  Scope* end = this;
-  do {
-    end = end->outer_scope_->GetDeclarationScope();
-  } while (end->is_eval_scope());
-  end = end->outer_scope_;
+  Scope* end = outer_scope()->GetNonEvalDeclarationScope()->outer_scope();
 
   for (Declaration* decl : decls_) {
     if (IsLexicalVariableMode(decl->var()->mode())) continue;
@@ -1156,10 +1178,17 @@ Declaration* DeclarationScope::CheckConflictingVarDeclarations() {
     do {
       // There is a conflict if there exists a non-VAR binding up to the
       // declaration scope in which this sloppy-eval runs.
+      //
+      // Use the current scope as the cache, since the general cache would be
+      // the end scope.
       Variable* other_var =
-          current->LookupInScopeOrScopeInfo(decl->var()->raw_name());
-      if (other_var != nullptr && IsLexicalVariableMode(other_var->mode())) {
-        DCHECK(!current->is_catch_scope());
+          current->LookupInScopeOrScopeInfo(decl->var()->raw_name(), current);
+      if (other_var != nullptr && !current->is_catch_scope()) {
+        // If this is a VAR, then we know that it doesn't conflict with
+        // anything, so we can't conflict with anything either. The one
+        // exception is the binding variable in catch scopes, which is handled
+        // by the if above.
+        if (!IsLexicalVariableMode(other_var->mode())) break;
         return decl;
       }
       current = current->outer_scope();
@@ -1297,6 +1326,14 @@ DeclarationScope* Scope::GetDeclarationScope() {
   return scope->AsDeclarationScope();
 }
 
+DeclarationScope* Scope::GetNonEvalDeclarationScope() {
+  Scope* scope = this;
+  while (!scope->is_declaration_scope() || scope->is_eval_scope()) {
+    scope = scope->outer_scope();
+  }
+  return scope->AsDeclarationScope();
+}
+
 const DeclarationScope* Scope::GetClosureScope() const {
   const Scope* scope = this;
   while (!scope->is_declaration_scope() || scope->is_block_scope()) {
@@ -1336,6 +1373,14 @@ DeclarationScope* Scope::GetReceiverScope() {
   return scope->AsDeclarationScope();
 }
 
+DeclarationScope* Scope::GetScriptScope() {
+  Scope* scope = this;
+  while (!scope->is_script_scope()) {
+    scope = scope->outer_scope();
+  }
+  return scope->AsDeclarationScope();
+}
+
 Scope* Scope::GetOuterScopeWithContext() {
   Scope* scope = outer_scope_;
   while (scope && !scope->NeedsContext()) {
@@ -1372,6 +1417,15 @@ void Scope::ForEach(FunctionType callback) {
   }
 }
 
+bool Scope::IsOuterScopeOf(Scope* other) const {
+  Scope* scope = other;
+  while (scope) {
+    if (scope == this) return true;
+    scope = scope->outer_scope();
+  }
+  return false;
+}
+
 void Scope::CollectNonLocals(DeclarationScope* max_outer_scope,
                              Isolate* isolate, ParseInfo* info,
                              Handle<StringSet>* non_locals) {
@@ -1552,6 +1606,17 @@ void DeclarationScope::AnalyzePartially(Parser* parser,
   unresolved_list_ = std::move(new_unresolved_list);
 }
 
+void DeclarationScope::RewriteReplGlobalVariables() {
+  DCHECK(is_script_scope());
+  if (!is_repl_mode_scope()) return;
+
+  for (VariableMap::Entry* p = variables_.Start(); p != nullptr;
+       p = variables_.Next(p)) {
+    Variable* var = reinterpret_cast<Variable*>(p->value);
+    var->RewriteLocationForRepl();
+  }
+}
+
 #ifdef DEBUG
 namespace {
 
@@ -1601,6 +1666,9 @@ void PrintLocation(Variable* var) {
     case VariableLocation::MODULE:
       PrintF("module");
       break;
+    case VariableLocation::REPL_GLOBAL:
+      PrintF("repl global[%d]", var->index());
+      break;
   }
 }
 
@@ -1830,10 +1898,14 @@ Variable* Scope::NonLocal(const AstRawString* name, VariableMode mode) {
 // static
 template <Scope::ScopeLookupMode mode>
 Variable* Scope::Lookup(VariableProxy* proxy, Scope* scope,
-                        Scope* outer_scope_end, Scope* entry_point,
+                        Scope* outer_scope_end, Scope* cache_scope,
                         bool force_context_allocation) {
-  if (mode == kDeserializedScope) {
-    Variable* var = entry_point->variables_.Lookup(proxy->raw_name());
+  // If we have already passed the cache scope in earlier recursions, we should
+  // first quickly check if the current scope uses the cache scope before
+  // continuing.
+  if (mode == kDeserializedScope &&
+      scope->deserialized_scope_uses_external_cache()) {
+    Variable* var = cache_scope->variables_.Lookup(proxy->raw_name());
     if (var != nullptr) return var;
   }
 
@@ -1848,13 +1920,29 @@ Variable* Scope::Lookup(VariableProxy* proxy, Scope* scope,
     // the scopes in which it's evaluating.
     if (mode == kDeserializedScope &&
         V8_UNLIKELY(scope->is_debug_evaluate_scope_)) {
-      return entry_point->NonLocal(proxy->raw_name(), VariableMode::kDynamic);
+      DCHECK(scope->deserialized_scope_uses_external_cache() ||
+             scope == cache_scope);
+      return cache_scope->NonLocal(proxy->raw_name(), VariableMode::kDynamic);
     }
 
     // Try to find the variable in this scope.
-    Variable* var = mode == kParsedScope ? scope->LookupLocal(proxy->raw_name())
-                                         : scope->LookupInScopeInfo(
-                                               proxy->raw_name(), entry_point);
+    Variable* var;
+    if (mode == kParsedScope) {
+      var = scope->LookupLocal(proxy->raw_name());
+    } else {
+      DCHECK_EQ(mode, kDeserializedScope);
+      bool external_cache = scope->deserialized_scope_uses_external_cache();
+      if (!external_cache) {
+        // Check the cache on each deserialized scope, up to the main cache
+        // scope when we get to it (we may still have deserialized scopes
+        // in-between the initial and cache scopes so we can't just check the
+        // cache before the loop).
+        Variable* var = scope->variables_.Lookup(proxy->raw_name());
+        if (var != nullptr) return var;
+      }
+      var = scope->LookupInScopeInfo(proxy->raw_name(),
+                                     external_cache ? cache_scope : scope);
+    }
 
     // We found a variable and we are done. (Even if there is an 'eval' in this
     // scope which introduces the same variable again, the resulting variable
@@ -1882,21 +1970,25 @@ Variable* Scope::Lookup(VariableProxy* proxy, Scope* scope,
 
     DCHECK(!scope->is_script_scope());
     if (V8_UNLIKELY(scope->is_with_scope())) {
-      return LookupWith(proxy, scope, outer_scope_end, entry_point,
+      return LookupWith(proxy, scope, outer_scope_end, cache_scope,
                         force_context_allocation);
     }
     if (V8_UNLIKELY(
             scope->is_declaration_scope() &&
             scope->AsDeclarationScope()->sloppy_eval_can_extend_vars())) {
-      return LookupSloppyEval(proxy, scope, outer_scope_end, entry_point,
+      return LookupSloppyEval(proxy, scope, outer_scope_end, cache_scope,
                               force_context_allocation);
     }
 
     force_context_allocation |= scope->is_function_scope();
     scope = scope->outer_scope_;
+
     // TODO(verwaest): Separate through AnalyzePartially.
     if (mode == kParsedScope && !scope->scope_info_.is_null()) {
-      return Lookup<kDeserializedScope>(proxy, scope, outer_scope_end, scope);
+      DCHECK_NULL(cache_scope);
+      Scope* cache_scope = scope->GetNonEvalDeclarationScope();
+      return Lookup<kDeserializedScope>(proxy, scope, outer_scope_end,
+                                        cache_scope);
     }
   }
 
@@ -1910,18 +2002,18 @@ Variable* Scope::Lookup(VariableProxy* proxy, Scope* scope,
   // No binding has been found. Declare a variable on the global object.
   return scope->AsDeclarationScope()->DeclareDynamicGlobal(
       proxy->raw_name(), NORMAL_VARIABLE,
-      mode == kDeserializedScope ? entry_point : scope);
+      mode == kDeserializedScope ? cache_scope : scope);
 }
 
 template Variable* Scope::Lookup<Scope::kParsedScope>(
     VariableProxy* proxy, Scope* scope, Scope* outer_scope_end,
-    Scope* entry_point, bool force_context_allocation);
+    Scope* cache_scope, bool force_context_allocation);
 template Variable* Scope::Lookup<Scope::kDeserializedScope>(
     VariableProxy* proxy, Scope* scope, Scope* outer_scope_end,
-    Scope* entry_point, bool force_context_allocation);
+    Scope* cache_scope, bool force_context_allocation);
 
 Variable* Scope::LookupWith(VariableProxy* proxy, Scope* scope,
-                            Scope* outer_scope_end, Scope* entry_point,
+                            Scope* outer_scope_end, Scope* cache_scope,
                             bool force_context_allocation) {
   DCHECK(scope->is_with_scope());
 
@@ -1930,7 +2022,7 @@ Variable* Scope::LookupWith(VariableProxy* proxy, Scope* scope,
           ? Lookup<kParsedScope>(proxy, scope->outer_scope_, outer_scope_end,
                                  nullptr, force_context_allocation)
           : Lookup<kDeserializedScope>(proxy, scope->outer_scope_,
-                                       outer_scope_end, entry_point);
+                                       outer_scope_end, cache_scope);
 
   if (var == nullptr) return var;
 
@@ -1946,31 +2038,49 @@ Variable* Scope::LookupWith(VariableProxy* proxy, Scope* scope,
     var->ForceContextAllocation();
     if (proxy->is_assigned()) var->SetMaybeAssigned();
   }
-  if (entry_point != nullptr) entry_point->variables_.Remove(var);
-  Scope* target = entry_point == nullptr ? scope : entry_point;
+  Scope* target_scope;
+  if (scope->deserialized_scope_uses_external_cache()) {
+    DCHECK_NOT_NULL(cache_scope);
+    cache_scope->variables_.Remove(var);
+    target_scope = cache_scope;
+  } else {
+    target_scope = scope;
+  }
   Variable* dynamic =
-      target->NonLocal(proxy->raw_name(), VariableMode::kDynamic);
+      target_scope->NonLocal(proxy->raw_name(), VariableMode::kDynamic);
   dynamic->set_local_if_not_shadowed(var);
   return dynamic;
 }
 
 Variable* Scope::LookupSloppyEval(VariableProxy* proxy, Scope* scope,
-                                  Scope* outer_scope_end, Scope* entry_point,
+                                  Scope* outer_scope_end, Scope* cache_scope,
                                   bool force_context_allocation) {
   DCHECK(scope->is_declaration_scope() &&
          scope->AsDeclarationScope()->sloppy_eval_can_extend_vars());
 
   // If we're compiling eval, it's possible that the outer scope is the first
-  // ScopeInfo-backed scope.
-  Scope* entry = entry_point == nullptr ? scope->outer_scope_ : entry_point;
+  // ScopeInfo-backed scope. We use the next declaration scope as the cache for
+  // this case, to avoid complexity around sloppy block function hoisting and
+  // conflict detection through catch scopes in the eval.
+  Scope* entry_cache = cache_scope == nullptr
+                           ? scope->outer_scope()->GetNonEvalDeclarationScope()
+                           : cache_scope;
   Variable* var =
       scope->outer_scope_->scope_info_.is_null()
           ? Lookup<kParsedScope>(proxy, scope->outer_scope_, outer_scope_end,
                                  nullptr, force_context_allocation)
           : Lookup<kDeserializedScope>(proxy, scope->outer_scope_,
-                                       outer_scope_end, entry);
+                                       outer_scope_end, entry_cache);
   if (var == nullptr) return var;
 
+  // We may not want to use the cache scope, change it back to the given scope
+  // if necessary.
+  if (!scope->deserialized_scope_uses_external_cache()) {
+    // For a deserialized scope, we'll be replacing the cache_scope.
+    DCHECK_IMPLIES(!scope->scope_info_.is_null(), cache_scope != nullptr);
+    cache_scope = scope;
+  }
+
   // A variable binding may have been found in an outer scope, but the current
   // scope makes a sloppy 'eval' call, so the found variable may not be the
   // correct one (the 'eval' may introduce a binding with the same name). In
@@ -1979,16 +2089,16 @@ Variable* Scope::LookupSloppyEval(VariableProxy* proxy, Scope* scope,
   // here (this excludes block and catch scopes), and variable lookups at
   // script scope are always dynamic.
   if (var->IsGlobalObjectProperty()) {
-    Scope* target = entry_point == nullptr ? scope : entry_point;
+    Scope* target = cache_scope == nullptr ? scope : cache_scope;
     var = target->NonLocal(proxy->raw_name(), VariableMode::kDynamicGlobal);
   }
 
   if (var->is_dynamic()) return var;
 
   Variable* invalidated = var;
-  if (entry_point != nullptr) entry_point->variables_.Remove(invalidated);
+  if (cache_scope != nullptr) cache_scope->variables_.Remove(invalidated);
 
-  Scope* target = entry_point == nullptr ? scope : entry_point;
+  Scope* target = cache_scope == nullptr ? scope : cache_scope;
   var = target->NonLocal(proxy->raw_name(), VariableMode::kDynamicLocal);
   var->set_local_if_not_shadowed(invalidated);
 
@@ -2149,7 +2259,6 @@ bool Scope::MustAllocateInContext(Variable* var) {
   return var->has_forced_context_allocation() || inner_scope_calls_eval_;
 }
 
-
 void Scope::AllocateStackSlot(Variable* var) {
   if (is_block_scope()) {
     outer_scope()->GetDeclarationScope()->AllocateStackSlot(var);
@@ -2236,8 +2345,23 @@ void Scope::AllocateNonParameterLocal(Variable* var) {
 }
 
 void Scope::AllocateNonParameterLocalsAndDeclaredGlobals() {
-  for (Variable* local : locals_) {
-    AllocateNonParameterLocal(local);
+  if (is_declaration_scope() && AsDeclarationScope()->is_arrow_scope()) {
+    // In arrow functions, allocate non-temporaries first and then all the
+    // temporaries to make the local variable ordering stable when reparsing to
+    // collect source positions.
+    for (Variable* local : locals_) {
+      if (local->mode() != VariableMode::kTemporary)
+        AllocateNonParameterLocal(local);
+    }
+
+    for (Variable* local : locals_) {
+      if (local->mode() == VariableMode::kTemporary)
+        AllocateNonParameterLocal(local);
+    }
+  } else {
+    for (Variable* local : locals_) {
+      AllocateNonParameterLocal(local);
+    }
   }
 
   if (is_declaration_scope()) {
@@ -2285,7 +2409,7 @@ void Scope::AllocateVariablesRecursively() {
   this->ForEach([](Scope* scope) -> Iteration {
     DCHECK(!scope->already_resolved_);
     if (WasLazilyParsed(scope)) return Iteration::kContinue;
-    DCHECK_EQ(Context::MIN_CONTEXT_SLOTS, scope->num_heap_slots_);
+    DCHECK_EQ(scope->ContextHeaderLength(), scope->num_heap_slots_);
 
     // Allocate variables for this scope.
     // Parameters must be allocated first, if any.
@@ -2313,14 +2437,14 @@ void Scope::AllocateVariablesRecursively() {
 
     // If we didn't allocate any locals in the local context, then we only
     // need the minimal number of slots if we must have a context.
-    if (scope->num_heap_slots_ == Context::MIN_CONTEXT_SLOTS &&
+    if (scope->num_heap_slots_ == scope->ContextHeaderLength() &&
         !must_have_context) {
       scope->num_heap_slots_ = 0;
     }
 
     // Allocation done.
     DCHECK(scope->num_heap_slots_ == 0 ||
-           scope->num_heap_slots_ >= Context::MIN_CONTEXT_SLOTS);
+           scope->num_heap_slots_ >= scope->ContextHeaderLength());
     return Iteration::kDescend;
   });
 }
@@ -2390,7 +2514,9 @@ void DeclarationScope::RecordNeedsPrivateNameContextChainRecalc() {
 // static
 void DeclarationScope::AllocateScopeInfos(ParseInfo* info, Isolate* isolate) {
   DeclarationScope* scope = info->literal()->scope();
-  if (!scope->scope_info_.is_null()) return;  // Allocated by outer function.
+
+  // No one else should have allocated a scope info for this scope yet.
+  DCHECK(scope->scope_info_.is_null());
 
   MaybeHandle<ScopeInfo> outer_scope;
   if (scope->outer_scope_ != nullptr) {
@@ -2425,7 +2551,7 @@ int Scope::ContextLocalCount() const {
       is_function_scope() ? AsDeclarationScope()->function_var() : nullptr;
   bool is_function_var_in_context =
       function != nullptr && function->IsContextSlot();
-  return num_heap_slots() - Context::MIN_CONTEXT_SLOTS -
+  return num_heap_slots() - ContextHeaderLength() -
          (is_function_var_in_context ? 1 : 0);
 }
 
@@ -2529,7 +2655,7 @@ Variable* ClassScope::LookupPrivateNameInScopeInfo(const AstRawString* name) {
   DCHECK_NULL(LookupLocalPrivateName(name));
   DisallowHeapAllocation no_gc;
 
-  String name_handle = *name->string();
+  String name_handle = *name->string().get<Factory>();
   VariableMode mode;
   InitializationFlag init_flag;
   MaybeAssignedFlag maybe_assigned_flag;
diff --git a/deps/v8/src/ast/scopes.h b/deps/v8/src/ast/scopes.h
index 30838db28b553c..4955c5902b1d64 100644
--- a/deps/v8/src/ast/scopes.h
+++ b/deps/v8/src/ast/scopes.h
@@ -327,9 +327,7 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
     start_position_ = statement_pos;
   }
   int end_position() const { return end_position_; }
-  void set_end_position(int statement_pos) {
-    end_position_ = statement_pos;
-  }
+  void set_end_position(int statement_pos) { end_position_ = statement_pos; }
 
   // Scopes created for desugaring are hidden. I.e. not visible to the debugger.
   bool is_hidden() const { return is_hidden_; }
@@ -419,6 +417,9 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
     kDescend
   };
 
+  // Check is this scope is an outer scope of the given scope.
+  bool IsOuterScopeOf(Scope* other) const;
+
   // ---------------------------------------------------------------------------
   // Accessors.
 
@@ -454,6 +455,26 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
   int num_stack_slots() const { return num_stack_slots_; }
   int num_heap_slots() const { return num_heap_slots_; }
 
+  bool HasContextExtensionSlot() const {
+    switch (scope_type_) {
+      case MODULE_SCOPE:
+      case WITH_SCOPE:  // DebugEvaluateContext as well
+        return true;
+      default:
+        DCHECK_IMPLIES(sloppy_eval_can_extend_vars_,
+                       scope_type_ == FUNCTION_SCOPE ||
+                           scope_type_ == EVAL_SCOPE ||
+                           scope_type_ == BLOCK_SCOPE);
+        DCHECK_IMPLIES(sloppy_eval_can_extend_vars_, is_declaration_scope());
+        return sloppy_eval_can_extend_vars_;
+    }
+    UNREACHABLE();
+  }
+  int ContextHeaderLength() const {
+    return HasContextExtensionSlot() ? Context::MIN_CONTEXT_EXTENDED_SLOTS
+                                     : Context::MIN_CONTEXT_SLOTS;
+  }
+
   int ContextLocalCount() const;
 
   // Determine if we can parse a function literal in this scope lazily without
@@ -471,6 +492,14 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
   // the scope where var declarations will be hoisted to in the implementation.
   DeclarationScope* GetDeclarationScope();
 
+  // Find the first function, script, or (declaration) block scope.
+  // This is the scope where var declarations will be hoisted to in the
+  // implementation, including vars in direct sloppy eval calls.
+  //
+  // TODO(leszeks): Check how often we skip eval scopes in GetDeclarationScope,
+  // and possibly merge this with GetDeclarationScope.
+  DeclarationScope* GetNonEvalDeclarationScope();
+
   // Find the first non-block declaration scope. This should be either a script,
   // function, or eval scope. Same as DeclarationScope(), but skips declaration
   // "block" scopes. Used for differentiating associated function objects (i.e.,
@@ -483,6 +512,8 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
   // 'this' is bound, and what determines the function kind.
   DeclarationScope* GetReceiverScope();
 
+  DeclarationScope* GetScriptScope();
+
   // Find the innermost outer scope that needs a context.
   Scope* GetOuterScopeWithContext();
 
@@ -514,6 +545,17 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
   void set_is_debug_evaluate_scope() { is_debug_evaluate_scope_ = true; }
   bool is_debug_evaluate_scope() const { return is_debug_evaluate_scope_; }
   bool IsSkippableFunctionScope();
+  void set_is_repl_mode_scope() { is_repl_mode_scope_ = true; }
+  bool is_repl_mode_scope() const {
+    DCHECK_IMPLIES(is_repl_mode_scope_, is_script_scope());
+    return is_repl_mode_scope_;
+  }
+  void set_deserialized_scope_uses_external_cache() {
+    deserialized_scope_uses_external_cache_ = true;
+  }
+  bool deserialized_scope_uses_external_cache() const {
+    return deserialized_scope_uses_external_cache_;
+  }
 
   bool RemoveInnerScope(Scope* inner_scope) {
     DCHECK_NOT_NULL(inner_scope);
@@ -531,15 +573,15 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
     return false;
   }
 
-  Variable* LookupInScopeOrScopeInfo(const AstRawString* name) {
+  Variable* LookupInScopeOrScopeInfo(const AstRawString* name, Scope* cache) {
     Variable* var = variables_.Lookup(name);
     if (var != nullptr || scope_info_.is_null()) return var;
-    return LookupInScopeInfo(name, this);
+    return LookupInScopeInfo(name, cache);
   }
 
   Variable* LookupForTesting(const AstRawString* name) {
     for (Scope* scope = this; scope != nullptr; scope = scope->outer_scope()) {
-      Variable* var = scope->LookupInScopeOrScopeInfo(name);
+      Variable* var = scope->LookupInScopeOrScopeInfo(name, scope);
       if (var != nullptr) return var;
     }
     return nullptr;
@@ -593,13 +635,13 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
   // calling context of 'eval'.
   template <ScopeLookupMode mode>
   static Variable* Lookup(VariableProxy* proxy, Scope* scope,
-                          Scope* outer_scope_end, Scope* entry_point = nullptr,
+                          Scope* outer_scope_end, Scope* cache_scope = nullptr,
                           bool force_context_allocation = false);
   static Variable* LookupWith(VariableProxy* proxy, Scope* scope,
-                              Scope* outer_scope_end, Scope* entry_point,
+                              Scope* outer_scope_end, Scope* cache_scope,
                               bool force_context_allocation);
   static Variable* LookupSloppyEval(VariableProxy* proxy, Scope* scope,
-                                    Scope* outer_scope_end, Scope* entry_point,
+                                    Scope* outer_scope_end, Scope* cache_scope,
                                     bool force_context_allocation);
   static void ResolvePreparsedVariable(VariableProxy* proxy, Scope* scope,
                                        Scope* end);
@@ -730,6 +772,29 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
   bool private_name_lookup_skips_outer_class_ : 1;
 
   bool must_use_preparsed_scope_data_ : 1;
+
+  // True if this is a script scope that originated from
+  // DebugEvaluate::GlobalREPL().
+  bool is_repl_mode_scope_ : 1;
+
+  // True if this is a deserialized scope which caches its lookups on another
+  // Scope's variable map. This will be true for every scope above the first
+  // non-eval declaration scope above the compilation entry point, e.g. for
+  //
+  //     function f() {
+  //       let g; // prevent sloppy block function hoisting.
+  //       with({}) {
+  //         function g() {
+  //           try { throw 0; }
+  //           catch { eval("f"); }
+  //         }
+  //         g();
+  //       }
+  //     }
+  //
+  // the compilation of the eval will have the "with" scope as the first scope
+  // with this flag enabled.
+  bool deserialized_scope_uses_external_cache_ : 1;
 };
 
 class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
@@ -739,7 +804,8 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
   DeclarationScope(Zone* zone, ScopeType scope_type,
                    Handle<ScopeInfo> scope_info);
   // Creates a script scope.
-  DeclarationScope(Zone* zone, AstValueFactory* ast_value_factory);
+  DeclarationScope(Zone* zone, AstValueFactory* ast_value_factory,
+                   REPLMode repl_mode = REPLMode::kNo);
 
   FunctionKind function_kind() const { return function_kind_; }
 
@@ -803,6 +869,7 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
     }
 
     sloppy_eval_can_extend_vars_ = true;
+    num_heap_slots_ = Context::MIN_CONTEXT_EXTENDED_SLOTS;
   }
 
   bool sloppy_eval_can_extend_vars() const {
@@ -924,9 +991,9 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
 
   // The variable holding the JSGeneratorObject for generator, async
   // and async generator functions, and modules. Only valid for
-  // function and module scopes.
+  // function, module and REPL mode script scopes.
   Variable* generator_object_var() const {
-    DCHECK(is_function_scope() || is_module_scope());
+    DCHECK(is_function_scope() || is_module_scope() || is_repl_mode_scope());
     return GetRareVariable(RareVariable::kGeneratorObject);
   }
 
@@ -1098,6 +1165,10 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
   }
   void RecordNeedsPrivateNameContextChainRecalc();
 
+  // Re-writes the {VariableLocation} of top-level 'let' bindings from CONTEXT
+  // to REPL_GLOBAL. Should only be called on REPL scripts.
+  void RewriteReplGlobalVariables();
+
  private:
   V8_INLINE void AllocateParameter(Variable* var, int index);
 
diff --git a/deps/v8/src/ast/variables.cc b/deps/v8/src/ast/variables.cc
index 26f037ea6871d3..da2d8387f5117c 100644
--- a/deps/v8/src/ast/variables.cc
+++ b/deps/v8/src/ast/variables.cc
@@ -30,5 +30,19 @@ bool Variable::IsGlobalObjectProperty() const {
          scope_ != nullptr && scope_->is_script_scope();
 }
 
+bool Variable::IsReplGlobalLet() const {
+  return scope()->is_repl_mode_scope() && mode() == VariableMode::kLet;
+}
+
+void Variable::RewriteLocationForRepl() {
+  DCHECK(scope_->is_repl_mode_scope());
+
+  if (mode() == VariableMode::kLet) {
+    DCHECK_EQ(location(), VariableLocation::CONTEXT);
+    bit_field_ =
+        LocationField::update(bit_field_, VariableLocation::REPL_GLOBAL);
+  }
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/ast/variables.h b/deps/v8/src/ast/variables.h
index 7be99adc7c12ff..3a8ca8888fe703 100644
--- a/deps/v8/src/ast/variables.h
+++ b/deps/v8/src/ast/variables.h
@@ -33,7 +33,7 @@ class Variable final : public ZoneObject {
                    InitializationFlagField::encode(initialization_flag) |
                    VariableModeField::encode(mode) |
                    IsUsedField::encode(false) |
-                   ForceContextAllocationField::encode(false) |
+                   ForceContextAllocationBit::encode(false) |
                    ForceHoleInitializationField::encode(false) |
                    LocationField::encode(VariableLocation::UNALLOCATED) |
                    VariableKindField::encode(kind) |
@@ -57,7 +57,7 @@ class Variable final : public ZoneObject {
   // parameter initializers.
   void set_scope(Scope* scope) { scope_ = scope; }
 
-  Handle<String> name() const { return name_->string(); }
+  Handle<String> name() const { return name_->string().get<Factory>(); }
   const AstRawString* raw_name() const { return name_; }
   VariableMode mode() const { return VariableModeField::decode(bit_field_); }
   void set_mode(VariableMode mode) {
@@ -72,12 +72,12 @@ class Variable final : public ZoneObject {
   bool is_static() const { return is_static_flag() == IsStaticFlag::kStatic; }
 
   bool has_forced_context_allocation() const {
-    return ForceContextAllocationField::decode(bit_field_);
+    return ForceContextAllocationBit::decode(bit_field_);
   }
   void ForceContextAllocation() {
     DCHECK(IsUnallocated() || IsContextSlot() || IsLookupSlot() ||
            location() == VariableLocation::MODULE);
-    bit_field_ = ForceContextAllocationField::update(bit_field_, true);
+    bit_field_ = ForceContextAllocationBit::update(bit_field_, true);
   }
   bool is_used() { return IsUsedField::decode(bit_field_); }
   void set_is_used() { bit_field_ = IsUsedField::update(bit_field_, true); }
@@ -121,6 +121,9 @@ class Variable final : public ZoneObject {
   bool IsLookupSlot() const { return location() == VariableLocation::LOOKUP; }
   bool IsGlobalObjectProperty() const;
 
+  // True for 'let' variables declared in the script scope of a REPL script.
+  bool IsReplGlobalLet() const;
+
   bool is_dynamic() const { return IsDynamicVariableMode(mode()); }
 
   // Returns the InitializationFlag this Variable was created with.
@@ -235,6 +238,9 @@ class Variable final : public ZoneObject {
                                       : kNeedsInitialization;
   }
 
+  // Rewrites the VariableLocation of repl script scope 'lets' to REPL_GLOBAL.
+  void RewriteLocationForRepl();
+
   using List = base::ThreadedList<Variable>;
 
  private:
@@ -255,11 +261,11 @@ class Variable final : public ZoneObject {
     bit_field_ = MaybeAssignedFlagField::update(bit_field_, kMaybeAssigned);
   }
 
-  using VariableModeField = BitField16<VariableMode, 0, 4>;
+  using VariableModeField = base::BitField16<VariableMode, 0, 4>;
   using VariableKindField = VariableModeField::Next<VariableKind, 3>;
   using LocationField = VariableKindField::Next<VariableLocation, 3>;
-  using ForceContextAllocationField = LocationField::Next<bool, 1>;
-  using IsUsedField = ForceContextAllocationField::Next<bool, 1>;
+  using ForceContextAllocationBit = LocationField::Next<bool, 1>;
+  using IsUsedField = ForceContextAllocationBit::Next<bool, 1>;
   using InitializationFlagField = IsUsedField::Next<InitializationFlag, 1>;
   using ForceHoleInitializationField = InitializationFlagField::Next<bool, 1>;
   using MaybeAssignedFlagField =
diff --git a/deps/v8/src/base/atomic-utils.h b/deps/v8/src/base/atomic-utils.h
index 2c6fd23b712e20..7b6bd851552aa8 100644
--- a/deps/v8/src/base/atomic-utils.h
+++ b/deps/v8/src/base/atomic-utils.h
@@ -104,6 +104,16 @@ class AsAtomicImpl {
         cast_helper<T>::to_storage_type(new_value)));
   }
 
+  template <typename T>
+  static T AcquireRelease_CompareAndSwap(
+      T* addr, typename std::remove_reference<T>::type old_value,
+      typename std::remove_reference<T>::type new_value) {
+    STATIC_ASSERT(sizeof(T) <= sizeof(AtomicStorageType));
+    return cast_helper<T>::to_return_type(base::AcquireRelease_CompareAndSwap(
+        to_storage_addr(addr), cast_helper<T>::to_storage_type(old_value),
+        cast_helper<T>::to_storage_type(new_value)));
+  }
+
   // Atomically sets bits selected by the mask to the given value.
   // Returns false if the bits are already set as needed.
   template <typename T>
diff --git a/deps/v8/src/base/atomicops.h b/deps/v8/src/base/atomicops.h
index d0944c1df65791..35b27329497c14 100644
--- a/deps/v8/src/base/atomicops.h
+++ b/deps/v8/src/base/atomicops.h
@@ -97,6 +97,8 @@ Atomic32 Acquire_CompareAndSwap(volatile Atomic32* ptr,
 Atomic32 Release_CompareAndSwap(volatile Atomic32* ptr,
                                 Atomic32 old_value,
                                 Atomic32 new_value);
+Atomic32 AcquireRelease_CompareAndSwap(volatile Atomic32* ptr,
+                                       Atomic32 old_value, Atomic32 new_value);
 
 void SeqCst_MemoryFence();
 void Relaxed_Store(volatile Atomic8* ptr, Atomic8 value);
@@ -120,9 +122,10 @@ Atomic64 Barrier_AtomicIncrement(volatile Atomic64* ptr, Atomic64 increment);
 Atomic64 Acquire_CompareAndSwap(volatile Atomic64* ptr,
                                 Atomic64 old_value,
                                 Atomic64 new_value);
-Atomic64 Release_CompareAndSwap(volatile Atomic64* ptr,
-                                Atomic64 old_value,
+Atomic64 Release_CompareAndSwap(volatile Atomic64* ptr, Atomic64 old_value,
                                 Atomic64 new_value);
+Atomic64 AcquireRelease_CompareAndSwap(volatile Atomic64* ptr,
+                                       Atomic64 old_value, Atomic64 new_value);
 void Relaxed_Store(volatile Atomic64* ptr, Atomic64 value);
 void Release_Store(volatile Atomic64* ptr, Atomic64 value);
 Atomic64 Relaxed_Load(volatile const Atomic64* ptr);
diff --git a/deps/v8/src/base/atomicops_internals_atomicword_compat.h b/deps/v8/src/base/atomicops_internals_atomicword_compat.h
index 09f75bdfd2c0aa..7deacf2f45c568 100644
--- a/deps/v8/src/base/atomicops_internals_atomicword_compat.h
+++ b/deps/v8/src/base/atomicops_internals_atomicword_compat.h
@@ -62,6 +62,13 @@ inline AtomicWord Release_CompareAndSwap(volatile AtomicWord* ptr,
       reinterpret_cast<volatile Atomic32*>(ptr), old_value, new_value);
 }
 
+inline AtomicWord AcquireRelease_CompareAndSwap(volatile AtomicWord* ptr,
+                                                AtomicWord old_value,
+                                                AtomicWord new_value) {
+  return v8::base::AcquireRelease_CompareAndSwap(
+      reinterpret_cast<volatile Atomic32*>(ptr), old_value, new_value);
+}
+
 inline void Relaxed_Store(volatile AtomicWord* ptr, AtomicWord value) {
   Relaxed_Store(reinterpret_cast<volatile Atomic32*>(ptr), value);
 }
diff --git a/deps/v8/src/base/atomicops_internals_portable.h b/deps/v8/src/base/atomicops_internals_portable.h
index 2e8ee1d41b6043..068c1e87ffd453 100644
--- a/deps/v8/src/base/atomicops_internals_portable.h
+++ b/deps/v8/src/base/atomicops_internals_portable.h
@@ -101,6 +101,14 @@ inline Atomic32 Release_CompareAndSwap(volatile Atomic32* ptr,
   return old_value;
 }
 
+inline Atomic32 AcquireRelease_CompareAndSwap(volatile Atomic32* ptr,
+                                              Atomic32 old_value,
+                                              Atomic32 new_value) {
+  __atomic_compare_exchange_n(ptr, &old_value, new_value, false,
+                              __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE);
+  return old_value;
+}
+
 inline void Relaxed_Store(volatile Atomic8* ptr, Atomic8 value) {
   __atomic_store_n(ptr, value, __ATOMIC_RELAXED);
 }
@@ -171,6 +179,14 @@ inline Atomic64 Release_CompareAndSwap(volatile Atomic64* ptr,
   return old_value;
 }
 
+inline Atomic64 AcquireRelease_CompareAndSwap(volatile Atomic64* ptr,
+                                              Atomic64 old_value,
+                                              Atomic64 new_value) {
+  __atomic_compare_exchange_n(ptr, &old_value, new_value, false,
+                              __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE);
+  return old_value;
+}
+
 inline void Relaxed_Store(volatile Atomic64* ptr, Atomic64 value) {
   __atomic_store_n(ptr, value, __ATOMIC_RELAXED);
 }
diff --git a/deps/v8/src/base/atomicops_internals_std.h b/deps/v8/src/base/atomicops_internals_std.h
index 6c3d84244963c7..c04e64bb326c03 100644
--- a/deps/v8/src/base/atomicops_internals_std.h
+++ b/deps/v8/src/base/atomicops_internals_std.h
@@ -89,6 +89,15 @@ inline Atomic32 Release_CompareAndSwap(volatile Atomic32* ptr,
   return old_value;
 }
 
+inline Atomic32 AcquireRelease_CompareAndSwap(volatile Atomic32* ptr,
+                                              Atomic32 old_value,
+                                              Atomic32 new_value) {
+  atomic_compare_exchange_strong_explicit(
+      helper::to_std_atomic(ptr), &old_value, new_value,
+      std::memory_order_acq_rel, std::memory_order_acquire);
+  return old_value;
+}
+
 inline void Relaxed_Store(volatile Atomic8* ptr, Atomic8 value) {
   std::atomic_store_explicit(helper::to_std_atomic(ptr), value,
                              std::memory_order_relaxed);
@@ -175,6 +184,15 @@ inline Atomic64 Release_CompareAndSwap(volatile Atomic64* ptr,
   return old_value;
 }
 
+inline Atomic64 AcquireRelease_CompareAndSwap(volatile Atomic64* ptr,
+                                              Atomic64 old_value,
+                                              Atomic64 new_value) {
+  std::atomic_compare_exchange_strong_explicit(
+      helper::to_std_atomic(ptr), &old_value, new_value,
+      std::memory_order_acq_rel, std::memory_order_acquire);
+  return old_value;
+}
+
 inline void Relaxed_Store(volatile Atomic64* ptr, Atomic64 value) {
   std::atomic_store_explicit(helper::to_std_atomic(ptr), value,
                              std::memory_order_relaxed);
diff --git a/deps/v8/src/base/bit-field.h b/deps/v8/src/base/bit-field.h
new file mode 100644
index 00000000000000..9cebac32de49aa
--- /dev/null
+++ b/deps/v8/src/base/bit-field.h
@@ -0,0 +1,159 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_BASE_BIT_FIELD_H_
+#define V8_BASE_BIT_FIELD_H_
+
+#include <stdint.h>
+
+#include "src/base/macros.h"
+
+namespace v8 {
+namespace base {
+
+// ----------------------------------------------------------------------------
+// BitField is a help template for encoding and decode bitfield with
+// unsigned content.
+// Instantiate them via 'using', which is cheaper than deriving a new class:
+// using MyBitField = base::BitField<int, 4, 2, MyEnum>;
+// The BitField class is final to enforce this style over derivation.
+
+template <class T, int shift, int size, class U = uint32_t>
+class BitField final {
+ public:
+  STATIC_ASSERT(std::is_unsigned<U>::value);
+  STATIC_ASSERT(shift < 8 * sizeof(U));  // Otherwise shifts by {shift} are UB.
+  STATIC_ASSERT(size < 8 * sizeof(U));   // Otherwise shifts by {size} are UB.
+  STATIC_ASSERT(shift + size <= 8 * sizeof(U));
+  STATIC_ASSERT(size > 0);
+
+  using FieldType = T;
+
+  // A type U mask of bit field.  To use all bits of a type U of x bits
+  // in a bitfield without compiler warnings we have to compute 2^x
+  // without using a shift count of x in the computation.
+  static constexpr int kShift = shift;
+  static constexpr int kSize = size;
+  static constexpr U kMask = ((U{1} << kShift) << kSize) - (U{1} << kShift);
+  static constexpr int kLastUsedBit = kShift + kSize - 1;
+  static constexpr U kNumValues = U{1} << kSize;
+
+  // Value for the field with all bits set.
+  static constexpr T kMax = static_cast<T>(kNumValues - 1);
+
+  template <class T2, int size2>
+  using Next = BitField<T2, kShift + kSize, size2, U>;
+
+  // Tells whether the provided value fits into the bit field.
+  static constexpr bool is_valid(T value) {
+    return (static_cast<U>(value) & ~static_cast<U>(kMax)) == 0;
+  }
+
+  // Returns a type U with the bit field value encoded.
+  static constexpr U encode(T value) {
+#if V8_HAS_CXX14_CONSTEXPR
+    DCHECK(is_valid(value));
+#endif
+    return static_cast<U>(value) << kShift;
+  }
+
+  // Returns a type U with the bit field value updated.
+  static constexpr U update(U previous, T value) {
+    return (previous & ~kMask) | encode(value);
+  }
+
+  // Extracts the bit field from the value.
+  static constexpr T decode(U value) {
+    return static_cast<T>((value & kMask) >> kShift);
+  }
+};
+
+template <class T, int shift, int size>
+using BitField8 = BitField<T, shift, size, uint8_t>;
+
+template <class T, int shift, int size>
+using BitField16 = BitField<T, shift, size, uint16_t>;
+
+template <class T, int shift, int size>
+using BitField64 = BitField<T, shift, size, uint64_t>;
+
+// Helper macros for defining a contiguous sequence of bit fields. Example:
+// (backslashes at the ends of respective lines of this multi-line macro
+// definition are omitted here to please the compiler)
+//
+// #define MAP_BIT_FIELD1(V, _)
+//   V(IsAbcBit, bool, 1, _)
+//   V(IsBcdBit, bool, 1, _)
+//   V(CdeBits, int, 5, _)
+//   V(DefBits, MutableMode, 1, _)
+//
+// DEFINE_BIT_FIELDS(MAP_BIT_FIELD1)
+// or
+// DEFINE_BIT_FIELDS_64(MAP_BIT_FIELD1)
+//
+#define DEFINE_BIT_FIELD_RANGE_TYPE(Name, Type, Size, _) \
+  k##Name##Start, k##Name##End = k##Name##Start + Size - 1,
+
+#define DEFINE_BIT_RANGES(LIST_MACRO)                               \
+  struct LIST_MACRO##_Ranges {                                      \
+    enum { LIST_MACRO(DEFINE_BIT_FIELD_RANGE_TYPE, _) kBitsCount }; \
+  };
+
+#define DEFINE_BIT_FIELD_TYPE(Name, Type, Size, RangesName) \
+  using Name = base::BitField<Type, RangesName::k##Name##Start, Size>;
+
+#define DEFINE_BIT_FIELD_64_TYPE(Name, Type, Size, RangesName) \
+  using Name = base::BitField64<Type, RangesName::k##Name##Start, Size>;
+
+#define DEFINE_BIT_FIELDS(LIST_MACRO) \
+  DEFINE_BIT_RANGES(LIST_MACRO)       \
+  LIST_MACRO(DEFINE_BIT_FIELD_TYPE, LIST_MACRO##_Ranges)
+
+#define DEFINE_BIT_FIELDS_64(LIST_MACRO) \
+  DEFINE_BIT_RANGES(LIST_MACRO)          \
+  LIST_MACRO(DEFINE_BIT_FIELD_64_TYPE, LIST_MACRO##_Ranges)
+
+// ----------------------------------------------------------------------------
+// BitSetComputer is a help template for encoding and decoding information for
+// a variable number of items in an array.
+//
+// To encode boolean data in a smi array you would use:
+//  using BoolComputer = BitSetComputer<bool, 1, kSmiValueSize, uint32_t>;
+//
+template <class T, int kBitsPerItem, int kBitsPerWord, class U>
+class BitSetComputer {
+ public:
+  static const int kItemsPerWord = kBitsPerWord / kBitsPerItem;
+  static const int kMask = (1 << kBitsPerItem) - 1;
+
+  // The number of array elements required to embed T information for each item.
+  static int word_count(int items) {
+    if (items == 0) return 0;
+    return (items - 1) / kItemsPerWord + 1;
+  }
+
+  // The array index to look at for item.
+  static int index(int base_index, int item) {
+    return base_index + item / kItemsPerWord;
+  }
+
+  // Extract T data for a given item from data.
+  static T decode(U data, int item) {
+    return static_cast<T>((data >> shift(item)) & kMask);
+  }
+
+  // Return the encoding for a store of value for item in previous.
+  static U encode(U previous, int item, T value) {
+    int shift_value = shift(item);
+    int set_bits = (static_cast<int>(value) << shift_value);
+    return (previous & ~(kMask << shift_value)) | set_bits;
+  }
+
+  static int shift(int item) { return (item % kItemsPerWord) * kBitsPerItem; }
+};
+
+}  // namespace base
+}  // namespace v8
+
+#endif  // V8_BASE_BIT_FIELD_H_
diff --git a/deps/v8/src/base/bits.h b/deps/v8/src/base/bits.h
index ac228b8ae18d99..b74b98e1069bf9 100644
--- a/deps/v8/src/base/bits.h
+++ b/deps/v8/src/base/bits.h
@@ -27,31 +27,36 @@ constexpr inline
     typename std::enable_if<std::is_unsigned<T>::value && sizeof(T) <= 8,
                             unsigned>::type
     CountPopulation(T value) {
+  STATIC_ASSERT(sizeof(T) <= 8);
 #if V8_HAS_BUILTIN_POPCOUNT
   return sizeof(T) == 8 ? __builtin_popcountll(static_cast<uint64_t>(value))
                         : __builtin_popcount(static_cast<uint32_t>(value));
 #else
   constexpr uint64_t mask[] = {0x5555555555555555, 0x3333333333333333,
-                               0x0f0f0f0f0f0f0f0f, 0x00ff00ff00ff00ff,
-                               0x0000ffff0000ffff, 0x00000000ffffffff};
+                               0x0f0f0f0f0f0f0f0f};
+  // Start with 1 bit wide buckets of [0,1].
   value = ((value >> 1) & mask[0]) + (value & mask[0]);
+  // Having 2 bit wide buckets of [0,2] now.
   value = ((value >> 2) & mask[1]) + (value & mask[1]);
-  value = ((value >> 4) & mask[2]) + (value & mask[2]);
+  // Having 4 bit wide buckets of [0,4] now.
+  value = (value >> 4) + value;
+  // Having 4 bit wide buckets of [0,8] now.
   if (sizeof(T) > 1)
-    value = ((value >> (sizeof(T) > 1 ? 8 : 0)) & mask[3]) + (value & mask[3]);
-  if (sizeof(T) > 2)
-    value = ((value >> (sizeof(T) > 2 ? 16 : 0)) & mask[4]) + (value & mask[4]);
-  if (sizeof(T) > 4)
-    value = ((value >> (sizeof(T) > 4 ? 32 : 0)) & mask[5]) + (value & mask[5]);
-  return static_cast<unsigned>(value);
+    value = ((value >> (sizeof(T) > 1 ? 8 : 0)) & mask[2]) + (value & mask[2]);
+  // Having 8 bit wide buckets of [0,16] now.
+  if (sizeof(T) > 2) value = (value >> (sizeof(T) > 2 ? 16 : 0)) + value;
+  // Having 8 bit wide buckets of [0,32] now.
+  if (sizeof(T) > 4) value = (value >> (sizeof(T) > 4 ? 32 : 0)) + value;
+  // Having 8 bit wide buckets of [0,64] now.
+  return static_cast<unsigned>(value & 0xff);
 #endif
 }
 
 // ReverseBits(value) returns |value| in reverse bit order.
 template <typename T>
 T ReverseBits(T value) {
-  DCHECK((sizeof(value) == 1) || (sizeof(value) == 2) || (sizeof(value) == 4) ||
-         (sizeof(value) == 8));
+  STATIC_ASSERT((sizeof(value) == 1) || (sizeof(value) == 2) ||
+                (sizeof(value) == 4) || (sizeof(value) == 8));
   T result = 0;
   for (unsigned i = 0; i < (sizeof(value) * 8); i++) {
     result = (result << 1) | (value & 1);
@@ -131,6 +136,27 @@ constexpr inline bool IsPowerOfTwo(T value) {
   return value > 0 && (value & (value - 1)) == 0;
 }
 
+// Identical to {CountTrailingZeros}, but only works for powers of 2.
+template <typename T,
+          typename = typename std::enable_if<std::is_integral<T>::value>::type>
+inline constexpr int WhichPowerOfTwo(T value) {
+#if V8_HAS_CXX14_CONSTEXPR
+  DCHECK(IsPowerOfTwo(value));
+#endif
+#if V8_HAS_BUILTIN_CTZ
+  STATIC_ASSERT(sizeof(T) <= 8);
+  return sizeof(T) == 8 ? __builtin_ctzll(static_cast<uint64_t>(value))
+                        : __builtin_ctz(static_cast<uint32_t>(value));
+#else
+  // Fall back to popcount (see "Hacker's Delight" by Henry S. Warren, Jr.),
+  // chapter 5-4. On x64, since is faster than counting in a loop and faster
+  // than doing binary search.
+  using U = typename std::make_unsigned<T>::type;
+  U u = value;
+  return CountPopulation(static_cast<U>(u - 1));
+#endif
+}
+
 // RoundUpToPowerOfTwo32(value) returns the smallest power of two which is
 // greater than or equal to |value|. If you pass in a |value| that is already a
 // power of two, it is returned as is. |value| must be less than or equal to
@@ -161,30 +187,25 @@ inline uint32_t RoundDownToPowerOfTwo32(uint32_t value) {
 
 
 // Precondition: 0 <= shift < 32
-inline uint32_t RotateRight32(uint32_t value, uint32_t shift) {
-  if (shift == 0) return value;
-  return (value >> shift) | (value << (32 - shift));
+inline constexpr uint32_t RotateRight32(uint32_t value, uint32_t shift) {
+  return (value >> shift) | (value << ((32 - shift) & 31));
 }
 
 // Precondition: 0 <= shift < 32
-inline uint32_t RotateLeft32(uint32_t value, uint32_t shift) {
-  if (shift == 0) return value;
-  return (value << shift) | (value >> (32 - shift));
+inline constexpr uint32_t RotateLeft32(uint32_t value, uint32_t shift) {
+  return (value << shift) | (value >> ((32 - shift) & 31));
 }
 
 // Precondition: 0 <= shift < 64
-inline uint64_t RotateRight64(uint64_t value, uint64_t shift) {
-  if (shift == 0) return value;
-  return (value >> shift) | (value << (64 - shift));
+inline constexpr uint64_t RotateRight64(uint64_t value, uint64_t shift) {
+  return (value >> shift) | (value << ((64 - shift) & 63));
 }
 
 // Precondition: 0 <= shift < 64
-inline uint64_t RotateLeft64(uint64_t value, uint64_t shift) {
-  if (shift == 0) return value;
-  return (value << shift) | (value >> (64 - shift));
+inline constexpr uint64_t RotateLeft64(uint64_t value, uint64_t shift) {
+  return (value << shift) | (value >> ((64 - shift) & 63));
 }
 
-
 // SignedAddOverflow32(lhs,rhs,val) performs a signed summation of |lhs| and
 // |rhs| and stores the result into the variable pointed to by |val| and
 // returns true if the signed summation resulted in an overflow.
diff --git a/deps/v8/src/base/bounds.h b/deps/v8/src/base/bounds.h
new file mode 100644
index 00000000000000..236e29b7ccd945
--- /dev/null
+++ b/deps/v8/src/base/bounds.h
@@ -0,0 +1,54 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_BASE_BOUNDS_H_
+#define V8_BASE_BOUNDS_H_
+
+#include "include/v8config.h"
+#include "src/base/macros.h"
+
+namespace v8 {
+namespace base {
+
+// Checks if value is in range [lower_limit, higher_limit] using a single
+// branch.
+template <typename T, typename U>
+inline constexpr bool IsInRange(T value, U lower_limit, U higher_limit) {
+#if V8_HAS_CXX14_CONSTEXPR
+  DCHECK_LE(lower_limit, higher_limit);
+#endif
+  STATIC_ASSERT(sizeof(U) <= sizeof(T));
+  using unsigned_T = typename std::make_unsigned<T>::type;
+  // Use static_cast to support enum classes.
+  return static_cast<unsigned_T>(static_cast<unsigned_T>(value) -
+                                 static_cast<unsigned_T>(lower_limit)) <=
+         static_cast<unsigned_T>(static_cast<unsigned_T>(higher_limit) -
+                                 static_cast<unsigned_T>(lower_limit));
+}
+
+// Checks if [index, index+length) is in range [0, max). Note that this check
+// works even if {index+length} would wrap around.
+inline constexpr bool IsInBounds(size_t index, size_t length, size_t max) {
+  return length <= max && index <= (max - length);
+}
+
+// Checks if [index, index+length) is in range [0, max). If not, {length} is
+// clamped to its valid range. Note that this check works even if
+// {index+length} would wrap around.
+template <typename T>
+inline bool ClampToBounds(T index, T* length, T max) {
+  if (index > max) {
+    *length = 0;
+    return false;
+  }
+  T avail = max - index;
+  bool oob = *length > avail;
+  if (oob) *length = avail;
+  return !oob;
+}
+
+}  // namespace base
+}  // namespace v8
+
+#endif  // V8_BASE_BOUNDS_H_
diff --git a/deps/v8/src/base/enum-set.h b/deps/v8/src/base/enum-set.h
index fac7c30ae086ce..ef7f0df9bdb1d3 100644
--- a/deps/v8/src/base/enum-set.h
+++ b/deps/v8/src/base/enum-set.h
@@ -21,8 +21,10 @@ class EnumSet {
  public:
   constexpr EnumSet() = default;
 
-  EnumSet(std::initializer_list<E> init) {
-    for (E e : init) Add(e);
+  explicit constexpr EnumSet(std::initializer_list<E> init) {
+    T bits = 0;
+    for (E e : init) bits |= Mask(e);
+    bits_ = bits;
   }
 
   bool empty() const { return bits_ == 0; }
diff --git a/deps/v8/src/base/ieee754.cc b/deps/v8/src/base/ieee754.cc
index 7bdac9e67ef408..6212f21f119b12 100644
--- a/deps/v8/src/base/ieee754.cc
+++ b/deps/v8/src/base/ieee754.cc
@@ -49,118 +49,61 @@ namespace {
  * endianness at run time.
  */
 
-/*
- * A union which permits us to convert between a double and two 32 bit
- * ints.
- * TODO(jkummerow): This is undefined behavior. Use bit_cast instead.
- */
-
-#if V8_TARGET_LITTLE_ENDIAN
-
-union ieee_double_shape_type {
-  double value;
-  struct {
-    uint32_t lsw;
-    uint32_t msw;
-  } parts;
-  struct {
-    uint64_t w;
-  } xparts;
-};
-
-#else
-
-union ieee_double_shape_type {
-  double value;
-  struct {
-    uint32_t msw;
-    uint32_t lsw;
-  } parts;
-  struct {
-    uint64_t w;
-  } xparts;
-};
-
-#endif
-
 /* Get two 32 bit ints from a double.  */
 
-#define EXTRACT_WORDS(ix0, ix1, d) \
-  do {                             \
-    ieee_double_shape_type ew_u;   \
-    ew_u.value = (d);              \
-    (ix0) = ew_u.parts.msw;        \
-    (ix1) = ew_u.parts.lsw;        \
-  } while (false)
-
-/* Get a 64-bit int from a double. */
-#define EXTRACT_WORD64(ix, d)    \
-  do {                           \
-    ieee_double_shape_type ew_u; \
-    ew_u.value = (d);            \
-    (ix) = ew_u.xparts.w;        \
+#define EXTRACT_WORDS(ix0, ix1, d)         \
+  do {                                     \
+    uint64_t bits = bit_cast<uint64_t>(d); \
+    (ix0) = bits >> 32;                    \
+    (ix1) = bits & 0xFFFFFFFFu;            \
   } while (false)
 
 /* Get the more significant 32 bit int from a double.  */
 
-#define GET_HIGH_WORD(i, d)      \
-  do {                           \
-    ieee_double_shape_type gh_u; \
-    gh_u.value = (d);            \
-    (i) = gh_u.parts.msw;        \
+#define GET_HIGH_WORD(i, d)                \
+  do {                                     \
+    uint64_t bits = bit_cast<uint64_t>(d); \
+    (i) = bits >> 32;                      \
   } while (false)
 
 /* Get the less significant 32 bit int from a double.  */
 
-#define GET_LOW_WORD(i, d)       \
-  do {                           \
-    ieee_double_shape_type gl_u; \
-    gl_u.value = (d);            \
-    (i) = gl_u.parts.lsw;        \
+#define GET_LOW_WORD(i, d)                 \
+  do {                                     \
+    uint64_t bits = bit_cast<uint64_t>(d); \
+    (i) = bits & 0xFFFFFFFFu;              \
   } while (false)
 
 /* Set a double from two 32 bit ints.  */
 
-#define INSERT_WORDS(d, ix0, ix1) \
-  do {                            \
-    ieee_double_shape_type iw_u;  \
-    iw_u.parts.msw = (ix0);       \
-    iw_u.parts.lsw = (ix1);       \
-    (d) = iw_u.value;             \
-  } while (false)
-
-/* Set a double from a 64-bit int. */
-#define INSERT_WORD64(d, ix)     \
-  do {                           \
-    ieee_double_shape_type iw_u; \
-    iw_u.xparts.w = (ix);        \
-    (d) = iw_u.value;            \
+#define INSERT_WORDS(d, ix0, ix1)             \
+  do {                                        \
+    uint64_t bits = 0;                        \
+    bits |= static_cast<uint64_t>(ix0) << 32; \
+    bits |= static_cast<uint32_t>(ix1);       \
+    (d) = bit_cast<double>(bits);             \
   } while (false)
 
 /* Set the more significant 32 bits of a double from an int.  */
 
-#define SET_HIGH_WORD(d, v)      \
-  do {                           \
-    ieee_double_shape_type sh_u; \
-    sh_u.value = (d);            \
-    sh_u.parts.msw = (v);        \
-    (d) = sh_u.value;            \
+#define SET_HIGH_WORD(d, v)                          \
+  do {                                               \
+    uint64_t bits = bit_cast<uint64_t>(d);           \
+    bits &= V8_2PART_UINT64_C(0x00000000, FFFFFFFF); \
+    bits |= static_cast<uint64_t>(v) << 32;          \
+    (d) = bit_cast<double>(bits);                    \
   } while (false)
 
 /* Set the less significant 32 bits of a double from an int.  */
 
-#define SET_LOW_WORD(d, v)       \
-  do {                           \
-    ieee_double_shape_type sl_u; \
-    sl_u.value = (d);            \
-    sl_u.parts.lsw = (v);        \
-    (d) = sl_u.value;            \
+#define SET_LOW_WORD(d, v)                           \
+  do {                                               \
+    uint64_t bits = bit_cast<uint64_t>(d);           \
+    bits &= V8_2PART_UINT64_C(0xFFFFFFFF, 00000000); \
+    bits |= static_cast<uint32_t>(v);                \
+    (d) = bit_cast<double>(bits);                    \
   } while (false)
 
-/* Support macro. */
-
-#define STRICT_ASSIGN(type, lval, rval) ((lval) = (rval))
-
 int32_t __ieee754_rem_pio2(double x, double* y) V8_WARN_UNUSED_RESULT;
 double __kernel_cos(double x, double y) V8_WARN_UNUSED_RESULT;
 int __kernel_rem_pio2(double* x, double* y, int e0, int nx, int prec,
@@ -1559,7 +1502,7 @@ double exp(double x) {
       hi = x - t * ln2HI[0]; /* t*ln2HI is exact here */
       lo = t * ln2LO[0];
     }
-    STRICT_ASSIGN(double, x, hi - lo);
+    x = hi - lo;
   } else if (hx < 0x3E300000) {         /* when |x|<2**-28 */
     if (huge + x > one) return one + x; /* trigger inexact */
   } else {
@@ -1878,7 +1821,7 @@ double log1p(double x) {
   if (hx >= 0x7FF00000) return x + x;
   if (k != 0) {
     if (hx < 0x43400000) {
-      STRICT_ASSIGN(double, u, 1.0 + x);
+      u = 1.0 + x;
       GET_HIGH_WORD(hu, u);
       k = (hu >> 20) - 1023;
       c = (k > 0) ? 1.0 - (u - x) : x - (u - 1.0); /* correction term */
@@ -2326,7 +2269,7 @@ double expm1(double x) {
       hi = x - t * ln2_hi; /* t*ln2_hi is exact here */
       lo = t * ln2_lo;
     }
-    STRICT_ASSIGN(double, x, hi - lo);
+    x = hi - lo;
     c = (hi - x) - lo;
   } else if (hx < 0x3C900000) { /* when |x|<2**-54, return x */
     t = huge + x;               /* return x with inexact flags when x!=0 */
@@ -2396,10 +2339,6 @@ double cbrt(double x) {
       P4 = 0.145996192886612446982;                /* 0x3FC2B000, 0xD4E4EDD7 */
 
   int32_t hx;
-  union {
-    double value;
-    uint64_t bits;
-  } u;
   double r, s, t = 0.0, w;
   uint32_t sign;
   uint32_t high, low;
@@ -2457,9 +2396,9 @@ double cbrt(double x) {
    * 0.667; the error in the rounded t can be up to about 3 23-bit ulps
    * before the final error is larger than 0.667 ulps.
    */
-  u.value = t;
-  u.bits = (u.bits + 0x80000000) & 0xFFFFFFFFC0000000ULL;
-  t = u.value;
+  uint64_t bits = bit_cast<uint64_t>(t);
+  bits = (bits + 0x80000000) & 0xFFFFFFFFC0000000ULL;
+  t = bit_cast<double>(bits);
 
   /* one step Newton iteration to 53 bits with error < 0.667 ulps */
   s = t * t;             /* t*t is exact */
@@ -3070,14 +3009,11 @@ double tanh(double x) {
 }
 
 #undef EXTRACT_WORDS
-#undef EXTRACT_WORD64
 #undef GET_HIGH_WORD
 #undef GET_LOW_WORD
 #undef INSERT_WORDS
-#undef INSERT_WORD64
 #undef SET_HIGH_WORD
 #undef SET_LOW_WORD
-#undef STRICT_ASSIGN
 
 }  // namespace ieee754
 }  // namespace base
diff --git a/deps/v8/src/base/iterator.h b/deps/v8/src/base/iterator.h
index baaf324e2185b5..86d4b068d336f3 100644
--- a/deps/v8/src/base/iterator.h
+++ b/deps/v8/src/base/iterator.h
@@ -37,9 +37,8 @@ class iterator_range {
 
   iterator_range() : begin_(), end_() {}
   template <typename ForwardIterator1, typename ForwardIterator2>
-  iterator_range(ForwardIterator1&& begin, ForwardIterator2&& end)
-      : begin_(std::forward<ForwardIterator1>(begin)),
-        end_(std::forward<ForwardIterator2>(end)) {}
+  iterator_range(ForwardIterator1 begin, ForwardIterator2 end)
+      : begin_(begin), end_(end) {}
 
   iterator begin() { return begin_; }
   iterator end() { return end_; }
@@ -60,9 +59,8 @@ class iterator_range {
 };
 
 template <typename ForwardIterator>
-auto make_iterator_range(ForwardIterator&& begin, ForwardIterator&& end) {
-  return iterator_range<ForwardIterator>{std::forward<ForwardIterator>(begin),
-                                         std::forward<ForwardIterator>(end)};
+auto make_iterator_range(ForwardIterator begin, ForwardIterator end) {
+  return iterator_range<ForwardIterator>{begin, end};
 }
 
 // {Reversed} returns a container adapter usable in a range-based "for"
diff --git a/deps/v8/src/base/logging.cc b/deps/v8/src/base/logging.cc
index 4087eb34232385..9e1cf59f64bc42 100644
--- a/deps/v8/src/base/logging.cc
+++ b/deps/v8/src/base/logging.cc
@@ -23,11 +23,12 @@ void (*g_print_stack_trace)() = nullptr;
 
 void (*g_dcheck_function)(const char*, int, const char*) = DefaultDcheckHandler;
 
-void PrettyPrintChar(std::ostream& os, int ch) {
+std::string PrettyPrintChar(int ch) {
+  std::ostringstream oss;
   switch (ch) {
 #define CHAR_PRINT_CASE(ch) \
   case ch:                  \
-    os << #ch;              \
+    oss << #ch;             \
     break;
 
     CHAR_PRINT_CASE('\0')
@@ -43,13 +44,12 @@ void PrettyPrintChar(std::ostream& os, int ch) {
 #undef CHAR_PRINT_CASE
     default:
       if (std::isprint(ch)) {
-        os << '\'' << ch << '\'';
+        oss << '\'' << ch << '\'';
       } else {
-        auto flags = os.flags(std::ios_base::hex);
-        os << "\\x" << static_cast<unsigned int>(ch);
-        os.flags(flags);
+        oss << std::hex << "\\x" << static_cast<unsigned int>(ch);
       }
   }
+  return oss.str();
 }
 
 void DefaultDcheckHandler(const char* file, int line, const char* message) {
@@ -73,18 +73,18 @@ void SetDcheckFunction(void (*dcheck_function)(const char*, int, const char*)) {
 
 // Define specialization to pretty print characters (escaping non-printable
 // characters) and to print c strings as pointers instead of strings.
-#define DEFINE_PRINT_CHECK_OPERAND_CHAR(type)                                \
-  template <>                                                                \
-  void PrintCheckOperand<type>(std::ostream & os, type ch) {                 \
-    PrettyPrintChar(os, ch);                                                 \
-  }                                                                          \
-  template <>                                                                \
-  void PrintCheckOperand<type*>(std::ostream & os, type * cstr) {            \
-    os << static_cast<void*>(cstr);                                          \
-  }                                                                          \
-  template <>                                                                \
-  void PrintCheckOperand<const type*>(std::ostream & os, const type* cstr) { \
-    os << static_cast<const void*>(cstr);                                    \
+#define DEFINE_PRINT_CHECK_OPERAND_CHAR(type)                    \
+  template <>                                                    \
+  std::string PrintCheckOperand<type>(type ch) {                 \
+    return PrettyPrintChar(ch);                                  \
+  }                                                              \
+  template <>                                                    \
+  std::string PrintCheckOperand<type*>(type * cstr) {            \
+    return PrintCheckOperand<void*>(cstr);                       \
+  }                                                              \
+  template <>                                                    \
+  std::string PrintCheckOperand<const type*>(const type* cstr) { \
+    return PrintCheckOperand<const void*>(cstr);                 \
   }
 
 DEFINE_PRINT_CHECK_OPERAND_CHAR(char)
@@ -96,7 +96,7 @@ DEFINE_PRINT_CHECK_OPERAND_CHAR(unsigned char)
 #define DEFINE_MAKE_CHECK_OP_STRING(type)                           \
   template std::string* MakeCheckOpString<type, type>(type, type,   \
                                                       char const*); \
-  template void PrintCheckOperand<type>(std::ostream&, type);
+  template std::string PrintCheckOperand<type>(type);
 DEFINE_MAKE_CHECK_OP_STRING(int)
 DEFINE_MAKE_CHECK_OP_STRING(long)       // NOLINT(runtime/int)
 DEFINE_MAKE_CHECK_OP_STRING(long long)  // NOLINT(runtime/int)
@@ -106,21 +106,6 @@ DEFINE_MAKE_CHECK_OP_STRING(unsigned long long)  // NOLINT(runtime/int)
 DEFINE_MAKE_CHECK_OP_STRING(void const*)
 #undef DEFINE_MAKE_CHECK_OP_STRING
 
-
-// Explicit instantiations for floating point checks.
-#define DEFINE_CHECK_OP_IMPL(NAME)                                            \
-  template std::string* Check##NAME##Impl<float, float>(float lhs, float rhs, \
-                                                        char const* msg);     \
-  template std::string* Check##NAME##Impl<double, double>(                    \
-      double lhs, double rhs, char const* msg);
-DEFINE_CHECK_OP_IMPL(EQ)
-DEFINE_CHECK_OP_IMPL(NE)
-DEFINE_CHECK_OP_IMPL(LE)
-DEFINE_CHECK_OP_IMPL(LT)
-DEFINE_CHECK_OP_IMPL(GE)
-DEFINE_CHECK_OP_IMPL(GT)
-#undef DEFINE_CHECK_OP_IMPL
-
 }  // namespace base
 }  // namespace v8
 
diff --git a/deps/v8/src/base/logging.h b/deps/v8/src/base/logging.h
index f2f68725a65b45..790018c98e9889 100644
--- a/deps/v8/src/base/logging.h
+++ b/deps/v8/src/base/logging.h
@@ -138,9 +138,12 @@ V8_BASE_EXPORT void SetDcheckFunction(void (*dcheck_Function)(const char*, int,
 template <typename T>
 typename std::enable_if<
     !std::is_function<typename std::remove_pointer<T>::type>::value &&
-    has_output_operator<T>::value>::type
-PrintCheckOperand(std::ostream& os, T val) {
-  os << std::forward<T>(val);
+        has_output_operator<T>::value,
+    std::string>::type
+PrintCheckOperand(T val) {
+  std::ostringstream oss;
+  oss << std::forward<T>(val);
+  return oss.str();
 }
 
 // Provide an overload for functions and function pointers. Function pointers
@@ -150,43 +153,43 @@ PrintCheckOperand(std::ostream& os, T val) {
 // pointers, so this is a no-op for MSVC.)
 template <typename T>
 typename std::enable_if<
-    std::is_function<typename std::remove_pointer<T>::type>::value>::type
-PrintCheckOperand(std::ostream& os, T val) {
-  os << reinterpret_cast<const void*>(val);
+    std::is_function<typename std::remove_pointer<T>::type>::value,
+    std::string>::type
+PrintCheckOperand(T val) {
+  return PrintCheckOperand(reinterpret_cast<const void*>(val));
 }
 
 // Define PrintCheckOperand<T> for enums which have no operator<<.
 template <typename T>
-typename std::enable_if<std::is_enum<T>::value &&
-                        !has_output_operator<T>::value>::type
-PrintCheckOperand(std::ostream& os, T val) {
+typename std::enable_if<
+    std::is_enum<T>::value && !has_output_operator<T>::value, std::string>::type
+PrintCheckOperand(T val) {
   using underlying_t = typename std::underlying_type<T>::type;
   // 8-bit types are not printed as number, so extend them to 16 bit.
   using int_t = typename std::conditional<
       std::is_same<underlying_t, uint8_t>::value, uint16_t,
       typename std::conditional<std::is_same<underlying_t, int8_t>::value,
                                 int16_t, underlying_t>::type>::type;
-  PrintCheckOperand(os, static_cast<int_t>(static_cast<underlying_t>(val)));
+  return PrintCheckOperand(static_cast<int_t>(static_cast<underlying_t>(val)));
 }
 
 // Define default PrintCheckOperand<T> for non-printable types.
 template <typename T>
 typename std::enable_if<!has_output_operator<T>::value &&
-                        !std::is_enum<T>::value>::type
-PrintCheckOperand(std::ostream& os, T val) {
-  os << "<unprintable>";
+                            !std::is_enum<T>::value,
+                        std::string>::type
+PrintCheckOperand(T val) {
+  return "<unprintable>";
 }
 
 // Define specializations for character types, defined in logging.cc.
-#define DEFINE_PRINT_CHECK_OPERAND_CHAR(type)                              \
-  template <>                                                              \
-  V8_BASE_EXPORT void PrintCheckOperand<type>(std::ostream & os, type ch); \
-  template <>                                                              \
-  V8_BASE_EXPORT void PrintCheckOperand<type*>(std::ostream & os,          \
-                                               type * cstr);               \
-  template <>                                                              \
-  V8_BASE_EXPORT void PrintCheckOperand<const type*>(std::ostream & os,    \
-                                                     const type* cstr);
+#define DEFINE_PRINT_CHECK_OPERAND_CHAR(type)                       \
+  template <>                                                       \
+  V8_BASE_EXPORT std::string PrintCheckOperand<type>(type ch);      \
+  template <>                                                       \
+  V8_BASE_EXPORT std::string PrintCheckOperand<type*>(type * cstr); \
+  template <>                                                       \
+  V8_BASE_EXPORT std::string PrintCheckOperand<const type*>(const type* cstr);
 
 DEFINE_PRINT_CHECK_OPERAND_CHAR(char)
 DEFINE_PRINT_CHECK_OPERAND_CHAR(signed char)
@@ -198,13 +201,18 @@ DEFINE_PRINT_CHECK_OPERAND_CHAR(unsigned char)
 // be out of line, while the "Impl" code should be inline. Caller
 // takes ownership of the returned string.
 template <typename Lhs, typename Rhs>
-std::string* MakeCheckOpString(Lhs lhs, Rhs rhs, char const* msg) {
+V8_NOINLINE std::string* MakeCheckOpString(Lhs lhs, Rhs rhs, char const* msg) {
+  std::string lhs_str = PrintCheckOperand<Lhs>(lhs);
+  std::string rhs_str = PrintCheckOperand<Rhs>(rhs);
   std::ostringstream ss;
-  ss << msg << " (";
-  PrintCheckOperand<Lhs>(ss, lhs);
-  ss << " vs. ";
-  PrintCheckOperand<Rhs>(ss, rhs);
-  ss << ")";
+  ss << msg;
+  constexpr size_t kMaxInlineLength = 50;
+  if (lhs_str.size() <= kMaxInlineLength &&
+      rhs_str.size() <= kMaxInlineLength) {
+    ss << " (" << lhs_str << " vs. " << rhs_str << ")";
+  } else {
+    ss << "\n   " << lhs_str << "\n vs.\n   " << rhs_str << "\n";
+  }
   return new std::string(ss.str());
 }
 
@@ -213,8 +221,7 @@ std::string* MakeCheckOpString(Lhs lhs, Rhs rhs, char const* msg) {
 #define EXPLICIT_CHECK_OP_INSTANTIATION(type)                                \
   extern template V8_BASE_EXPORT std::string* MakeCheckOpString<type, type>( \
       type, type, char const*);                                              \
-  extern template V8_BASE_EXPORT void PrintCheckOperand<type>(std::ostream&, \
-                                                              type);
+  extern template V8_BASE_EXPORT std::string PrintCheckOperand<type>(type);
 
 EXPLICIT_CHECK_OP_INSTANTIATION(int)
 EXPLICIT_CHECK_OP_INSTANTIATION(long)       // NOLINT(runtime/int)
@@ -268,11 +275,12 @@ struct is_unsigned_vs_signed : public is_signed_vs_unsigned<Rhs, Lhs> {};
 #define MAKE_UNSIGNED(Type, value)         \
   static_cast<typename std::make_unsigned< \
       typename comparison_underlying_type<Type>::type>::type>(value)
-#define DEFINE_SIGNED_MISMATCH_COMP(CHECK, NAME, IMPL)                  \
-  template <typename Lhs, typename Rhs>                                 \
-  V8_INLINE typename std::enable_if<CHECK<Lhs, Rhs>::value, bool>::type \
-      Cmp##NAME##Impl(Lhs lhs, Rhs rhs) {                               \
-    return IMPL;                                                        \
+#define DEFINE_SIGNED_MISMATCH_COMP(CHECK, NAME, IMPL)            \
+  template <typename Lhs, typename Rhs>                           \
+  V8_INLINE constexpr                                             \
+      typename std::enable_if<CHECK<Lhs, Rhs>::value, bool>::type \
+          Cmp##NAME##Impl(Lhs lhs, Rhs rhs) {                     \
+    return IMPL;                                                  \
   }
 DEFINE_SIGNED_MISMATCH_COMP(is_signed_vs_unsigned, EQ,
                             lhs >= 0 && MAKE_UNSIGNED(Lhs, lhs) ==
@@ -302,29 +310,24 @@ DEFINE_SIGNED_MISMATCH_COMP(is_unsigned_vs_signed, GE, CmpLEImpl(rhs, lhs))
 // not integral or their signedness matches (i.e. whenever no specialization is
 // required, see above). Otherwise it is disabled by the enable_if construct,
 // and the compiler will pick a specialization from above.
-#define DEFINE_CHECK_OP_IMPL(NAME, op)                                         \
-  template <typename Lhs, typename Rhs>                                        \
-  V8_INLINE                                                                    \
-      typename std::enable_if<!is_signed_vs_unsigned<Lhs, Rhs>::value &&       \
-                                  !is_unsigned_vs_signed<Lhs, Rhs>::value,     \
-                              bool>::type Cmp##NAME##Impl(Lhs lhs, Rhs rhs) {  \
-    return lhs op rhs;                                                         \
-  }                                                                            \
-  template <typename Lhs, typename Rhs>                                        \
-  V8_INLINE std::string* Check##NAME##Impl(Lhs lhs, Rhs rhs,                   \
-                                           char const* msg) {                  \
-    using LhsPassT = typename pass_value_or_ref<Lhs>::type;                    \
-    using RhsPassT = typename pass_value_or_ref<Rhs>::type;                    \
-    bool cmp = Cmp##NAME##Impl<LhsPassT, RhsPassT>(lhs, rhs);                  \
-    return V8_LIKELY(cmp)                                                      \
-               ? nullptr                                                       \
-               : MakeCheckOpString<LhsPassT, RhsPassT>(lhs, rhs, msg);         \
-  }                                                                            \
-  extern template V8_BASE_EXPORT std::string* Check##NAME##Impl<float, float>( \
-      float lhs, float rhs, char const* msg);                                  \
-  extern template V8_BASE_EXPORT std::string*                                  \
-      Check##NAME##Impl<double, double>(double lhs, double rhs,                \
-                                        char const* msg);
+#define DEFINE_CHECK_OP_IMPL(NAME, op)                                        \
+  template <typename Lhs, typename Rhs>                                       \
+  V8_INLINE constexpr                                                         \
+      typename std::enable_if<!is_signed_vs_unsigned<Lhs, Rhs>::value &&      \
+                                  !is_unsigned_vs_signed<Lhs, Rhs>::value,    \
+                              bool>::type Cmp##NAME##Impl(Lhs lhs, Rhs rhs) { \
+    return lhs op rhs;                                                        \
+  }                                                                           \
+  template <typename Lhs, typename Rhs>                                       \
+  V8_INLINE constexpr std::string* Check##NAME##Impl(Lhs lhs, Rhs rhs,        \
+                                                     char const* msg) {       \
+    using LhsPassT = typename pass_value_or_ref<Lhs>::type;                   \
+    using RhsPassT = typename pass_value_or_ref<Rhs>::type;                   \
+    bool cmp = Cmp##NAME##Impl<LhsPassT, RhsPassT>(lhs, rhs);                 \
+    return V8_LIKELY(cmp)                                                     \
+               ? nullptr                                                      \
+               : MakeCheckOpString<LhsPassT, RhsPassT>(lhs, rhs, msg);        \
+  }
 DEFINE_CHECK_OP_IMPL(EQ, ==)
 DEFINE_CHECK_OP_IMPL(NE, !=)
 DEFINE_CHECK_OP_IMPL(LE, <=)
diff --git a/deps/v8/src/base/overflowing-math.h b/deps/v8/src/base/overflowing-math.h
index 7ca58aefec47d9..14dcfb10de1a65 100644
--- a/deps/v8/src/base/overflowing-math.h
+++ b/deps/v8/src/base/overflowing-math.h
@@ -83,6 +83,13 @@ inline float RecipSqrt(float a) {
   return -std::numeric_limits<float>::infinity();
 }
 
+template <typename T>
+inline T RoundingAverageUnsigned(T a, T b) {
+  static_assert(std::is_unsigned<T>::value, "Only for unsiged types");
+  static_assert(sizeof(T) < sizeof(uint64_t), "Must be smaller than uint64_t");
+  return (static_cast<uint64_t>(a) + static_cast<uint64_t>(b) + 1) >> 1;
+}
+
 }  // namespace base
 }  // namespace v8
 
diff --git a/deps/v8/src/base/platform/platform-linux.cc b/deps/v8/src/base/platform/platform-linux.cc
index 3c224870581e86..26efd100df1603 100644
--- a/deps/v8/src/base/platform/platform-linux.cc
+++ b/deps/v8/src/base/platform/platform-linux.cc
@@ -39,48 +39,6 @@
 namespace v8 {
 namespace base {
 
-#ifdef __arm__
-
-bool OS::ArmUsingHardFloat() {
-// GCC versions 4.6 and above define __ARM_PCS or __ARM_PCS_VFP to specify
-// the Floating Point ABI used (PCS stands for Procedure Call Standard).
-// We use these as well as a couple of other defines to statically determine
-// what FP ABI used.
-// GCC versions 4.4 and below don't support hard-fp.
-// GCC versions 4.5 may support hard-fp without defining __ARM_PCS or
-// __ARM_PCS_VFP.
-
-#define GCC_VERSION \
-  (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
-#if GCC_VERSION >= 40600 && !defined(__clang__)
-#if defined(__ARM_PCS_VFP)
-  return true;
-#else
-  return false;
-#endif
-
-#elif GCC_VERSION < 40500 && !defined(__clang__)
-  return false;
-
-#else
-#if defined(__ARM_PCS_VFP)
-  return true;
-#elif defined(__ARM_PCS) || defined(__SOFTFP__) || defined(__SOFTFP) || \
-    !defined(__VFP_FP__)
-  return false;
-#else
-#error \
-    "Your version of compiler does not report the FP ABI compiled for."     \
-       "Please report it on this issue"                                        \
-       "http://code.google.com/p/v8/issues/detail?id=2140"
-
-#endif
-#endif
-#undef GCC_VERSION
-}
-
-#endif  // def __arm__
-
 TimezoneCache* OS::CreateTimezoneCache() {
   return new PosixDefaultTimezoneCache();
 }
diff --git a/deps/v8/src/base/platform/platform-posix.cc b/deps/v8/src/base/platform/platform-posix.cc
index 99abcd55686c16..0424d4c135172b 100644
--- a/deps/v8/src/base/platform/platform-posix.cc
+++ b/deps/v8/src/base/platform/platform-posix.cc
@@ -150,6 +150,50 @@ void* Allocate(void* hint, size_t size, OS::MemoryPermission access) {
 
 }  // namespace
 
+#if V8_OS_LINUX || V8_OS_FREEBSD
+#ifdef __arm__
+
+bool OS::ArmUsingHardFloat() {
+  // GCC versions 4.6 and above define __ARM_PCS or __ARM_PCS_VFP to specify
+  // the Floating Point ABI used (PCS stands for Procedure Call Standard).
+  // We use these as well as a couple of other defines to statically determine
+  // what FP ABI used.
+  // GCC versions 4.4 and below don't support hard-fp.
+  // GCC versions 4.5 may support hard-fp without defining __ARM_PCS or
+  // __ARM_PCS_VFP.
+
+#define GCC_VERSION \
+  (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
+#if GCC_VERSION >= 40600 && !defined(__clang__)
+#if defined(__ARM_PCS_VFP)
+  return true;
+#else
+  return false;
+#endif
+
+#elif GCC_VERSION < 40500 && !defined(__clang__)
+  return false;
+
+#else
+#if defined(__ARM_PCS_VFP)
+  return true;
+#elif defined(__ARM_PCS) || defined(__SOFTFP__) || defined(__SOFTFP) || \
+    !defined(__VFP_FP__)
+  return false;
+#else
+#error \
+    "Your version of compiler does not report the FP ABI compiled for."     \
+       "Please report it on this issue"                                        \
+       "http://code.google.com/p/v8/issues/detail?id=2140"
+
+#endif
+#endif
+#undef GCC_VERSION
+}
+
+#endif  // def __arm__
+#endif
+
 void OS::Initialize(bool hard_abort, const char* const gc_fake_mmap) {
   g_hard_abort = hard_abort;
   g_gc_fake_mmap = gc_fake_mmap;
diff --git a/deps/v8/src/base/platform/time.h b/deps/v8/src/base/platform/time.h
index afe4724382fecb..5f69129ecbc4cc 100644
--- a/deps/v8/src/base/platform/time.h
+++ b/deps/v8/src/base/platform/time.h
@@ -268,6 +268,16 @@ class TimeBase : public TimeConstants {
   // provided operators.
   int64_t ToInternalValue() const { return us_; }
 
+  // The amount of time since the origin (or "zero") point. This is a syntactic
+  // convenience to aid in code readability, mainly for debugging/testing use
+  // cases.
+  //
+  // Warning: While the Time subclass has a fixed origin point, the origin for
+  // the other subclasses can vary each time the application is restarted.
+  constexpr TimeDelta since_origin() const {
+    return TimeDelta::FromMicroseconds(us_);
+  }
+
   TimeClass& operator=(TimeClass other) {
     us_ = other.us_;
     return *(static_cast<TimeClass*>(this));
diff --git a/deps/v8/src/base/template-utils.h b/deps/v8/src/base/template-utils.h
index 146f8d6e6ae4a7..8f89672e1af66e 100644
--- a/deps/v8/src/base/template-utils.h
+++ b/deps/v8/src/base/template-utils.h
@@ -6,6 +6,7 @@
 #define V8_BASE_TEMPLATE_UTILS_H_
 
 #include <array>
+#include <functional>
 #include <type_traits>
 #include <utility>
 
@@ -81,6 +82,21 @@ struct is_same<T> : public std::true_type {};
 template <typename T, typename... Ts>
 struct is_same<T, T, Ts...> : public is_same<T, Ts...> {};
 
+// Returns true, iff all values (implicitly converted to bool) are trueish.
+template <typename... Args>
+constexpr bool all(Args... rest) {
+  return fold(std::logical_and<>{}, true, rest...);
+}
+
+template <class... Ts>
+struct make_void {
+  using type = void;
+};
+// Corresponds to C++17's std::void_t.
+// Used for SFINAE based on type errors.
+template <class... Ts>
+using void_t = typename make_void<Ts...>::type;
+
 }  // namespace base
 }  // namespace v8
 
diff --git a/deps/v8/src/base/threaded-list.h b/deps/v8/src/base/threaded-list.h
index 9504a8a93dfdeb..f0eed52eded5b9 100644
--- a/deps/v8/src/base/threaded-list.h
+++ b/deps/v8/src/base/threaded-list.h
@@ -34,6 +34,8 @@ class ThreadedListBase final : public BaseClass {
     DCHECK_NULL(*TLTraits::next(v));
     *tail_ = v;
     tail_ = TLTraits::next(v);
+    // Check that only one element was added (and that hasn't created a cycle).
+    DCHECK_NULL(*tail_);
   }
 
   void AddFront(T* v) {
diff --git a/deps/v8/src/base/utils/random-number-generator.cc b/deps/v8/src/base/utils/random-number-generator.cc
index 17c2cced8a452b..61b78f1bdff20c 100644
--- a/deps/v8/src/base/utils/random-number-generator.cc
+++ b/deps/v8/src/base/utils/random-number-generator.cc
@@ -51,7 +51,7 @@ RandomNumberGenerator::RandomNumberGenerator() {
   result = rand_s(&second_half);
   DCHECK_EQ(0, result);
   SetSeed((static_cast<int64_t>(first_half) << 32) + second_half);
-#elif V8_OS_MACOSX
+#elif V8_OS_MACOSX || V8_OS_FREEBSD || V8_OS_OPENBSD
   // Despite its prefix suggests it is not RC4 algorithm anymore.
   // It always succeeds while having decent performance and
   // no file descriptor involved.
diff --git a/deps/v8/src/builtins/accessors.cc b/deps/v8/src/builtins/accessors.cc
index fa39142cb4cb3c..cc99b1e6c4bcd1 100644
--- a/deps/v8/src/builtins/accessors.cc
+++ b/deps/v8/src/builtins/accessors.cc
@@ -85,7 +85,7 @@ Accessors::ReplaceAccessorWithDataProperty(Handle<Object> receiver,
                                            Handle<JSObject> holder,
                                            Handle<Name> name,
                                            Handle<Object> value) {
-  LookupIterator it(receiver, name, holder,
+  LookupIterator it(holder->GetIsolate(), receiver, name, holder,
                     LookupIterator::OWN_SKIP_INTERCEPTOR);
   // Skip any access checks we might hit. This accessor should never hit in a
   // situation where the caller does not have access.
@@ -180,13 +180,14 @@ void Accessors::ArrayLengthSetter(
     return;
   }
 
-  if (!was_readonly && V8_UNLIKELY(JSArray::HasReadOnlyLength(array)) &&
-      length != array->length().Number()) {
+  if (!was_readonly && V8_UNLIKELY(JSArray::HasReadOnlyLength(array))) {
     // AnythingToArrayLength() may have called setter re-entrantly and modified
     // its property descriptor. Don't perform this check if "length" was
     // previously readonly, as this may have been called during
     // DefineOwnPropertyIgnoreAttributes().
-    if (info.ShouldThrowOnError()) {
+    if (length == array->length().Number()) {
+      info.GetReturnValue().Set(true);
+    } else if (info.ShouldThrowOnError()) {
       Factory* factory = isolate->factory();
       isolate->Throw(*factory->NewTypeError(
           MessageTemplate::kStrictReadOnlyProperty, Utils::OpenHandle(*name),
@@ -851,9 +852,16 @@ void Accessors::RegExpResultIndicesGetter(
   HandleScope scope(isolate);
   Handle<JSRegExpResult> regexp_result(
       Handle<JSRegExpResult>::cast(Utils::OpenHandle(*info.Holder())));
-  Handle<Object> indices(
+  MaybeHandle<JSArray> maybe_indices(
       JSRegExpResult::GetAndCacheIndices(isolate, regexp_result));
-  info.GetReturnValue().Set(Utils::ToLocal(indices));
+  Handle<JSArray> indices;
+  if (!maybe_indices.ToHandle(&indices)) {
+    isolate->OptionalRescheduleException(false);
+    Handle<Object> result = isolate->factory()->undefined_value();
+    info.GetReturnValue().Set(Utils::ToLocal(result));
+  } else {
+    info.GetReturnValue().Set(Utils::ToLocal(indices));
+  }
 }
 
 Handle<AccessorInfo> Accessors::MakeRegExpResultIndicesInfo(Isolate* isolate) {
diff --git a/deps/v8/src/builtins/accessors.h b/deps/v8/src/builtins/accessors.h
index b6a8e65446f963..faee0d9b677a64 100644
--- a/deps/v8/src/builtins/accessors.h
+++ b/deps/v8/src/builtins/accessors.h
@@ -6,6 +6,7 @@
 #define V8_BUILTINS_ACCESSORS_H_
 
 #include "include/v8.h"
+#include "src/base/bit-field.h"
 #include "src/common/globals.h"
 #include "src/objects/property-details.h"
 #include "src/utils/allocation.h"
diff --git a/deps/v8/src/builtins/arguments.tq b/deps/v8/src/builtins/arguments.tq
deleted file mode 100644
index 18d6c23b3d9a38..00000000000000
--- a/deps/v8/src/builtins/arguments.tq
+++ /dev/null
@@ -1,59 +0,0 @@
-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-struct Arguments {
-  const frame: FrameWithArguments;
-  const base: RawPtr;
-  const length: intptr;
-}
-
-extern operator '[]' macro GetArgumentValue(Arguments, intptr): JSAny;
-
-extern macro GetFrameArguments(FrameWithArguments, intptr): Arguments;
-
-namespace arguments {
-
-  struct ArgumentsInfo {
-    frame: Frame;
-    argument_count: bint;
-    formal_parameter_count: bint;
-  }
-
-  // Calculates and returns the frame pointer, argument count and formal
-  // parameter count to be used to access a function's parameters, taking
-  // argument adapter frames into account.
-  //
-  // TODO(danno):
-  // This macro is should only be used in builtins that can be called from
-  // interpreted or JITted code, not from CSA/Torque builtins (the number of
-  // returned formal parameters would be wrong).
-  // It is difficult to actually check/assert this, since interpreted or JITted
-  // frames are StandardFrames, but so are hand-written builtins. Doing that
-  // more refined check would be prohibitively expensive.
-  @export
-  macro GetArgumentsFrameAndCount(implicit context: Context)(f: JSFunction):
-      ArgumentsInfo {
-    const frame: Frame = LoadParentFramePointer();
-    assert(frame.function == f);
-
-    const shared: SharedFunctionInfo = f.shared_function_info;
-    const formalParameterCount: bint =
-        Convert<bint>(Convert<int32>(shared.formal_parameter_count));
-    const argumentCount: bint = formalParameterCount;
-
-    const adaptor: ArgumentsAdaptorFrame =
-        Cast<ArgumentsAdaptorFrame>(frame.caller)
-        otherwise return ArgumentsInfo{
-      frame,
-      argument_count: argumentCount,
-      formal_parameter_count: formalParameterCount
-    };
-
-    return ArgumentsInfo{
-      frame: adaptor,
-      argument_count: Convert<bint>(adaptor.length),
-      formal_parameter_count: formalParameterCount
-    };
-  }
-}
diff --git a/deps/v8/src/builtins/arm/builtins-arm.cc b/deps/v8/src/builtins/arm/builtins-arm.cc
index 164c09db259013..93caa8847ef54c 100644
--- a/deps/v8/src/builtins/arm/builtins-arm.cc
+++ b/deps/v8/src/builtins/arm/builtins-arm.cc
@@ -41,28 +41,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address) {
           RelocInfo::CODE_TARGET);
 }
 
-void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r0     : number of arguments
-  //  -- lr     : return address
-  //  -- sp[...]: constructor arguments
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin InternalArray functions should be maps.
-    __ ldr(r2, FieldMemOperand(r1, JSFunction::kPrototypeOrInitialMapOffset));
-    __ SmiTst(r2);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForInternalArrayFunction);
-    __ CompareObjectType(r2, r3, r4, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForInternalArrayFunction);
-  }
-
-  // Run the native code for the InternalArray function called as a normal
-  // function.
-  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
-          RelocInfo::CODE_TARGET);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -72,17 +50,14 @@ static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
   {
     FrameAndConstantPoolScope scope(masm, StackFrame::INTERNAL);
     // Push a copy of the target function and the new target.
-    __ push(r1);
-    __ push(r3);
     // Push function as parameter to the runtime call.
-    __ Push(r1);
+    __ Push(r1, r3, r1);
 
     __ CallRuntime(function_id, 1);
     __ mov(r2, r0);
 
     // Restore target function and new target.
-    __ pop(r3);
-    __ pop(r1);
+    __ Pop(r1, r3);
   }
   static_assert(kJavaScriptCallCodeStartRegister == r2, "ABI mismatch");
   __ JumpCodeObject(r2);
@@ -172,8 +147,7 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     // r0: number of arguments (untagged)
     // r1: constructor function
     // r3: new target
-    ParameterCount actual(r0);
-    __ InvokeFunction(r1, r3, actual, CALL_FUNCTION);
+    __ InvokeFunctionWithNewTarget(r1, r3, r0, CALL_FUNCTION);
 
     // Restore context from the frame.
     __ ldr(cp, MemOperand(fp, ConstructFrameConstants::kContextOffset));
@@ -319,8 +293,7 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
     __ b(ge, &loop);
 
     // Call the function.
-    ParameterCount actual(r0);
-    __ InvokeFunction(r1, r3, actual, CALL_FUNCTION);
+    __ InvokeFunctionWithNewTarget(r1, r3, r0, CALL_FUNCTION);
 
     // ----------- S t a t e -------------
     //  --                 r0: constructor result
@@ -1217,7 +1190,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
   __ push(scratch);
   __ bind(&loop_check);
   __ cmp(index, limit);
-  __ b(gt, &loop_header);
+  __ b(hi, &loop_header);
 }
 
 // static
@@ -1328,7 +1301,7 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   Label builtin_trampoline, trampoline_loaded;
   Smi interpreter_entry_return_pc_offset(
       masm->isolate()->heap()->interpreter_entry_return_pc_offset());
-  DCHECK_NE(interpreter_entry_return_pc_offset, Smi::kZero);
+  DCHECK_NE(interpreter_entry_return_pc_offset, Smi::zero());
 
   // If the SFI function_data is an InterpreterData, the function will have a
   // custom copy of the interpreter entry trampoline for profiling. If so,
@@ -1425,77 +1398,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r0 : argument count (preserved for callee)
-  //  -- r1 : new target (preserved for callee)
-  //  -- r3 : target function (preserved for callee)
-  // -----------------------------------
-  Label failed;
-  {
-    FrameScope scope(masm, StackFrame::INTERNAL);
-    // Preserve argument count for later compare.
-    __ Move(r4, r0);
-    // Push the number of arguments to the callee.
-    __ SmiTag(r0);
-    __ push(r0);
-    // Push a copy of the target function and the new target.
-    __ push(r1);
-    __ push(r3);
-
-    // The function.
-    __ push(r1);
-    // Copy arguments from caller (stdlib, foreign, heap).
-    Label args_done;
-    for (int j = 0; j < 4; ++j) {
-      Label over;
-      if (j < 3) {
-        __ cmp(r4, Operand(j));
-        __ b(ne, &over);
-      }
-      for (int i = j - 1; i >= 0; --i) {
-        __ ldr(r4, MemOperand(fp, StandardFrameConstants::kCallerSPOffset +
-                                      i * kPointerSize));
-        __ push(r4);
-      }
-      for (int i = 0; i < 3 - j; ++i) {
-        __ PushRoot(RootIndex::kUndefinedValue);
-      }
-      if (j < 3) {
-        __ jmp(&args_done);
-        __ bind(&over);
-      }
-    }
-    __ bind(&args_done);
-
-    // Call runtime, on success unwind frame, and parent frame.
-    __ CallRuntime(Runtime::kInstantiateAsmJs, 4);
-    // A smi 0 is returned on failure, an object on success.
-    __ JumpIfSmi(r0, &failed);
-
-    __ Drop(2);
-    __ pop(r4);
-    __ SmiUntag(r4);
-    scope.GenerateLeaveFrame();
-
-    __ add(r4, r4, Operand(1));
-    __ Drop(r4);
-    __ Ret();
-
-    __ bind(&failed);
-    // Restore target function and new target.
-    __ pop(r3);
-    __ pop(r1);
-    __ pop(r0);
-    __ SmiUntag(r0);
-  }
-  // On failure, tail call back to regular js by re-calling the function
-  // which has be reset to the compile lazy builtin.
-  static_assert(kJavaScriptCallCodeStartRegister == r2, "ABI mismatch");
-  __ ldr(r2, FieldMemOperand(r1, JSFunction::kCodeOffset));
-  __ JumpCodeObject(r2);
-}
-
 namespace {
 void Generate_ContinueToBuiltinHelper(MacroAssembler* masm,
                                       bool java_script_builtin,
@@ -1887,7 +1789,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
     __ JumpIfSmi(r3, &new_target_not_constructor);
     __ ldr(scratch, FieldMemOperand(r3, HeapObject::kMapOffset));
     __ ldrb(scratch, FieldMemOperand(scratch, Map::kBitFieldOffset));
-    __ tst(scratch, Operand(Map::IsConstructorBit::kMask));
+    __ tst(scratch, Operand(Map::Bits1::IsConstructorBit::kMask));
     __ b(ne, &new_target_constructor);
     __ bind(&new_target_not_constructor);
     {
@@ -1908,7 +1810,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
          Operand(StackFrame::TypeToMarker(StackFrame::ARGUMENTS_ADAPTOR)));
   __ b(eq, &arguments_adaptor);
   {
-    __ ldr(r5, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+    __ ldr(r5, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
     __ ldr(r5, FieldMemOperand(r5, JSFunction::kSharedFunctionInfoOffset));
     __ ldrh(r5, FieldMemOperand(
                     r5, SharedFunctionInfo::kFormalParameterCountOffset));
@@ -2042,9 +1944,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
 
   __ ldrh(r2,
           FieldMemOperand(r2, SharedFunctionInfo::kFormalParameterCountOffset));
-  ParameterCount actual(r0);
-  ParameterCount expected(r2);
-  __ InvokeFunctionCode(r1, no_reg, expected, actual, JUMP_FUNCTION);
+  __ InvokeFunctionCode(r1, no_reg, r2, r0, JUMP_FUNCTION);
 
   // The function is a "classConstructor", need to raise an exception.
   __ bind(&class_constructor);
@@ -2186,7 +2086,7 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
 
   // Check if target has a [[Call]] internal method.
   __ ldrb(r4, FieldMemOperand(r4, Map::kBitFieldOffset));
-  __ tst(r4, Operand(Map::IsCallableBit::kMask));
+  __ tst(r4, Operand(Map::Bits1::IsCallableBit::kMask));
   __ b(eq, &non_callable);
 
   // Check if target is a proxy and call CallProxy external builtin
@@ -2281,7 +2181,7 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   // Check if target has a [[Construct]] internal method.
   __ ldr(r4, FieldMemOperand(r1, HeapObject::kMapOffset));
   __ ldrb(r2, FieldMemOperand(r4, Map::kBitFieldOffset));
-  __ tst(r2, Operand(Map::IsConstructorBit::kMask));
+  __ tst(r2, Operand(Map::Bits1::IsConstructorBit::kMask));
   __ b(eq, &non_constructor);
 
   // Dispatch based on instance type.
@@ -2507,7 +2407,7 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
     // Save all parameter registers (see wasm-linkage.cc). They might be
     // overwritten in the runtime call below. We don't have any callee-saved
     // registers in wasm, so no need to store anything else.
-    constexpr RegList gp_regs = Register::ListOf<r0, r1, r2, r3>();
+    constexpr RegList gp_regs = Register::ListOf(r0, r1, r2, r3);
     constexpr DwVfpRegister lowest_fp_reg = d0;
     constexpr DwVfpRegister highest_fp_reg = d7;
 
@@ -2518,16 +2418,10 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
     // function.
     __ push(kWasmInstanceRegister);
     __ push(kWasmCompileLazyFuncIndexRegister);
-    // Load the correct CEntry builtin from the instance object.
-    __ ldr(r2, FieldMemOperand(kWasmInstanceRegister,
-                               WasmInstanceObject::kIsolateRootOffset));
-    auto centry_id =
-        Builtins::kCEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit;
-    __ ldr(r2, MemOperand(r2, IsolateData::builtin_slot_offset(centry_id)));
     // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ Move(cp, Smi::zero());
-    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, r2);
+    __ CallRuntime(Runtime::kWasmCompileLazy, 2);
     // The entrypoint address is the return value.
     __ mov(r8, kReturnRegister0);
 
@@ -2777,48 +2671,6 @@ void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
   __ Ret();
 }
 
-void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r0 : argc
-  //  -- r1 : constructor
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ ldr(r3, FieldMemOperand(r1, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ tst(r3, Operand(kSmiTagMask));
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CompareObjectType(r3, r3, r4, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
-
-    // Figure out the right elements kind
-    __ ldr(r3, FieldMemOperand(r1, JSFunction::kPrototypeOrInitialMapOffset));
-    // Load the map's "bit field 2" into |result|. We only need the first byte,
-    // but the following bit field extraction takes care of that anyway.
-    __ ldr(r3, FieldMemOperand(r3, Map::kBitField2Offset));
-    // Retrieve elements_kind from bit field 2.
-    __ DecodeField<Map::ElementsKindBits>(r3);
-
-    // Initial elements kind should be packed elements.
-    __ cmp(r3, Operand(PACKED_ELEMENTS));
-    __ Assert(eq, AbortReason::kInvalidElementsKindForInternalPackedArray);
-
-    // No arguments should be passed.
-    __ cmp(r0, Operand(0));
-    __ Assert(eq, AbortReason::kWrongNumberOfArgumentsForInternalPackedArray);
-  }
-
-  __ Jump(
-      BUILTIN_CODE(masm->isolate(), InternalArrayNoArgumentConstructor_Packed),
-      RelocInfo::CODE_TARGET);
-}
-
 namespace {
 
 int AddressOffset(ExternalReference ref0, ExternalReference ref1) {
diff --git a/deps/v8/src/builtins/arm64/builtins-arm64.cc b/deps/v8/src/builtins/arm64/builtins-arm64.cc
index 9edd074e3d023d..d4a4cbe0eb9d70 100644
--- a/deps/v8/src/builtins/arm64/builtins-arm64.cc
+++ b/deps/v8/src/builtins/arm64/builtins-arm64.cc
@@ -39,30 +39,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address) {
           RelocInfo::CODE_TARGET);
 }
 
-void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- x0     : number of arguments
-  //  -- lr     : return address
-  //  -- sp[...]: constructor arguments
-  // -----------------------------------
-  ASM_LOCATION("Builtins::Generate_InternalArrayConstructor");
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin InternalArray functions should be maps.
-    __ LoadTaggedPointerField(
-        x10, FieldMemOperand(x1, JSFunction::kPrototypeOrInitialMapOffset));
-    __ Tst(x10, kSmiTagMask);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForInternalArrayFunction);
-    __ CompareObjectType(x10, x11, x12, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForInternalArrayFunction);
-  }
-
-  // Run the native code for the InternalArray function called as a normal
-  // function.
-  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
-          RelocInfo::CODE_TARGET);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -207,8 +183,7 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     // -----------------------------------
 
     // Call the function.
-    ParameterCount actual(argc);
-    __ InvokeFunction(x1, x3, actual, CALL_FUNCTION);
+    __ InvokeFunctionWithNewTarget(x1, x3, argc, CALL_FUNCTION);
 
     // Restore the context from the frame.
     __ Ldr(cp, MemOperand(fp, ConstructFrameConstants::kContextOffset));
@@ -369,8 +344,7 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
 
     // Call the function.
     __ Mov(x0, x12);
-    ParameterCount actual(x0);
-    __ InvokeFunction(x1, x3, actual, CALL_FUNCTION);
+    __ InvokeFunctionWithNewTarget(x1, x3, x0, CALL_FUNCTION);
 
     // ----------- S t a t e -------------
     //  -- sp[0*kSystemPointerSize]: implicit receiver
@@ -635,24 +609,18 @@ void Generate_JSEntryVariant(MacroAssembler* masm, StackFrame::Type type,
   {
     NoRootArrayScope no_root_array(masm);
 
-    // Enable instruction instrumentation. This only works on the simulator, and
-    // will have no effect on the model or real hardware.
-    __ EnableInstrumentation();
-
 #if defined(V8_OS_WIN)
     // Windows ARM64 relies on a frame pointer (fp/x29 which are aliases to each
     // other) chain to do stack unwinding, but JSEntry breaks that by setting fp
     // to point to bad_frame_pointer below. To fix unwind information for this
     // case, JSEntry registers the offset (from current fp to the caller's fp
     // saved by PushCalleeSavedRegisters on stack) to xdata_encoder which then
-    // emits the offset value as part of result unwind data accordingly. The
-    // current offset is kFramePointerOffset which includes bad_frame_pointer
-    // saved below plus kFramePointerOffsetInPushCalleeSavedRegisters.
-    const int kFramePointerOffset =
-        kFramePointerOffsetInPushCalleeSavedRegisters + kSystemPointerSize;
+    // emits the offset value as part of result unwind data accordingly.
     win64_unwindinfo::XdataEncoder* xdata_encoder = masm->GetXdataEncoder();
     if (xdata_encoder) {
-      xdata_encoder->onFramePointerAdjustment(kFramePointerOffset);
+      xdata_encoder->onFramePointerAdjustment(
+          EntryFrameConstants::kDirectCallerFPOffset,
+          EntryFrameConstants::kDirectCallerSPOffset);
     }
 #endif
 
@@ -674,6 +642,10 @@ void Generate_JSEntryVariant(MacroAssembler* masm, StackFrame::Type type,
                                         masm->isolate()));
   __ Ldr(x10, MemOperand(x11));
 
+  // x13 (the bad frame pointer) is the first item pushed.
+  STATIC_ASSERT(EntryFrameConstants::kOffsetToCalleeSavedRegisters ==
+                1 * kSystemPointerSize);
+
   __ Push(x13, x12, xzr, x10);
   // Set up fp.
   __ Sub(fp, sp, EntryFrameConstants::kCallerFPOffset);
@@ -1197,7 +1169,6 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ bind(&not_optimized);
 
   // Increment invocation count for the function.
-  // MaybeTailCallOptimizedCodeSlot preserves feedback_vector, so safe to reuse
   __ Ldr(w10, FieldMemOperand(feedback_vector,
                               FeedbackVector::kInvocationCountOffset));
   __ Add(w10, w10, Operand(1));
@@ -1490,7 +1461,7 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   Label builtin_trampoline, trampoline_loaded;
   Smi interpreter_entry_return_pc_offset(
       masm->isolate()->heap()->interpreter_entry_return_pc_offset());
-  DCHECK_NE(interpreter_entry_return_pc_offset, Smi::kZero);
+  DCHECK_NE(interpreter_entry_return_pc_offset, Smi::zero());
 
   // If the SFI function_data is an InterpreterData, the function will have a
   // custom copy of the interpreter entry trampoline for profiling. If so,
@@ -1506,8 +1477,8 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
                        INTERPRETER_DATA_TYPE);
   __ B(ne, &builtin_trampoline);
 
-  __ Ldr(x1,
-         FieldMemOperand(x1, InterpreterData::kInterpreterTrampolineOffset));
+  __ LoadTaggedPointerField(
+      x1, FieldMemOperand(x1, InterpreterData::kInterpreterTrampolineOffset));
   __ Add(x1, x1, Operand(Code::kHeaderSize - kHeapObjectTag));
   __ B(&trampoline_loaded);
 
@@ -1585,96 +1556,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- x0 : argument count (preserved for callee)
-  //  -- x1 : new target (preserved for callee)
-  //  -- x3 : target function (preserved for callee)
-  // -----------------------------------
-  Register argc = x0;
-  Register new_target = x1;
-  Register target = x3;
-
-  Label failed;
-  {
-    FrameScope scope(masm, StackFrame::INTERNAL);
-
-    // Push argument count, a copy of the target function and the new target,
-    // together with some padding to maintain 16-byte alignment.
-    __ SmiTag(argc);
-    __ Push(argc, new_target, target, padreg);
-
-    // Push another copy of new target as a parameter to the runtime call and
-    // copy the rest of the arguments from caller (stdlib, foreign, heap).
-    Label args_done;
-    Register undef = x10;
-    Register scratch1 = x12;
-    Register scratch2 = x13;
-    Register scratch3 = x14;
-    __ LoadRoot(undef, RootIndex::kUndefinedValue);
-
-    Label at_least_one_arg;
-    Label three_args;
-    DCHECK_EQ(0, Smi::kZero.ptr());
-    __ Cbnz(argc, &at_least_one_arg);
-
-    // No arguments.
-    __ Push(new_target, undef, undef, undef);
-    __ B(&args_done);
-
-    __ Bind(&at_least_one_arg);
-    // Load two arguments, though we may only use one (for the one arg case).
-    __ Ldp(scratch2, scratch1,
-           MemOperand(fp, StandardFrameConstants::kCallerSPOffset));
-
-    // Set flags for determining the value of smi-tagged argc.
-    //  lt => 1, eq => 2, gt => 3.
-    __ CmpTagged(argc, Smi::FromInt(2));
-    __ B(gt, &three_args);
-
-    // One or two arguments.
-    // If there is one argument (flags are lt), scratch2 contains that argument,
-    // and scratch1 must be undefined.
-    __ CmovX(scratch1, scratch2, lt);
-    __ CmovX(scratch2, undef, lt);
-    __ Push(new_target, scratch1, scratch2, undef);
-    __ B(&args_done);
-
-    // Three arguments.
-    __ Bind(&three_args);
-    __ Ldr(scratch3, MemOperand(fp, StandardFrameConstants::kCallerSPOffset +
-                                        2 * kSystemPointerSize));
-    __ Push(new_target, scratch3, scratch1, scratch2);
-
-    __ Bind(&args_done);
-
-    // Call runtime, on success unwind frame, and parent frame.
-    __ CallRuntime(Runtime::kInstantiateAsmJs, 4);
-
-    // A smi 0 is returned on failure, an object on success.
-    __ JumpIfSmi(x0, &failed);
-
-    // Peek the argument count from the stack, untagging at the same time.
-    __ SmiUntag(x4, MemOperand(sp, 3 * kSystemPointerSize));
-    __ Drop(4);
-    scope.GenerateLeaveFrame();
-
-    // Drop arguments and receiver.
-    __ DropArguments(x4, TurboAssembler::kCountExcludesReceiver);
-    __ Ret();
-
-    __ Bind(&failed);
-    // Restore target function and new target.
-    __ Pop(padreg, target, new_target, argc);
-    __ SmiUntag(argc);
-  }
-  // On failure, tail call back to regular js by re-calling the function
-  // which has be reset to the compile lazy builtin.
-  __ LoadTaggedPointerField(
-      x4, FieldMemOperand(new_target, JSFunction::kCodeOffset));
-  __ JumpCodeObject(x4);
-}
-
 namespace {
 void Generate_ContinueToBuiltinHelper(MacroAssembler* masm,
                                       bool java_script_builtin,
@@ -1881,7 +1762,7 @@ void Builtins::Generate_FunctionPrototypeApply(MacroAssembler* masm) {
   __ Bind(&no_arguments);
   {
     __ Mov(x0, 0);
-    DCHECK(receiver.Is(x1));
+    DCHECK_EQ(receiver, x1);
     __ Jump(masm->isolate()->builtins()->Call(), RelocInfo::CODE_TARGET);
   }
 }
@@ -2285,7 +2166,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
     __ JumpIfSmi(x3, &new_target_not_constructor);
     __ LoadTaggedPointerField(x5, FieldMemOperand(x3, HeapObject::kMapOffset));
     __ Ldrb(x5, FieldMemOperand(x5, Map::kBitFieldOffset));
-    __ TestAndBranchIfAnySet(x5, Map::IsConstructorBit::kMask,
+    __ TestAndBranchIfAnySet(x5, Map::Bits1::IsConstructorBit::kMask,
                              &new_target_constructor);
     __ Bind(&new_target_not_constructor);
     {
@@ -2312,8 +2193,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
     __ CmpTagged(x4, StackFrame::TypeToMarker(StackFrame::ARGUMENTS_ADAPTOR));
     __ B(eq, &arguments_adaptor);
     {
-      __ Ldr(scratch,
-             MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+      __ Ldr(scratch, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
       __ LoadTaggedPointerField(
           scratch,
           FieldMemOperand(scratch, JSFunction::kSharedFunctionInfoOffset));
@@ -2448,9 +2328,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
 
   __ Ldrh(x2,
           FieldMemOperand(x2, SharedFunctionInfo::kFormalParameterCountOffset));
-  ParameterCount actual(x0);
-  ParameterCount expected(x2);
-  __ InvokeFunctionCode(x1, no_reg, expected, actual, JUMP_FUNCTION);
+  __ InvokeFunctionCode(x1, no_reg, x2, x0, JUMP_FUNCTION);
 
   // The function is a "classConstructor", need to raise an exception.
   __ Bind(&class_constructor);
@@ -2628,7 +2506,8 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
 
   // Check if target has a [[Call]] internal method.
   __ Ldrb(x4, FieldMemOperand(x4, Map::kBitFieldOffset));
-  __ TestAndBranchIfAllClear(x4, Map::IsCallableBit::kMask, &non_callable);
+  __ TestAndBranchIfAllClear(x4, Map::Bits1::IsCallableBit::kMask,
+                             &non_callable);
 
   // Check if target is a proxy and call CallProxy external builtin
   __ Cmp(x5, JS_PROXY_TYPE);
@@ -2729,7 +2608,7 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   // Check if target has a [[Construct]] internal method.
   __ LoadTaggedPointerField(x4, FieldMemOperand(x1, HeapObject::kMapOffset));
   __ Ldrb(x2, FieldMemOperand(x4, Map::kBitFieldOffset));
-  __ TestAndBranchIfAllClear(x2, Map::IsConstructorBit::kMask,
+  __ TestAndBranchIfAllClear(x2, Map::Bits1::IsConstructorBit::kMask,
                              &non_constructor);
 
   // Dispatch based on instance type.
@@ -3047,26 +2926,19 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
     // overwritten in the runtime call below. We don't have any callee-saved
     // registers in wasm, so no need to store anything else.
     constexpr RegList gp_regs =
-        Register::ListOf<x0, x1, x2, x3, x4, x5, x6, x7>();
+        Register::ListOf(x0, x1, x2, x3, x4, x5, x6, x7);
     constexpr RegList fp_regs =
-        Register::ListOf<d0, d1, d2, d3, d4, d5, d6, d7>();
+        Register::ListOf(d0, d1, d2, d3, d4, d5, d6, d7);
     __ PushXRegList(gp_regs);
     __ PushDRegList(fp_regs);
 
     // Pass instance and function index as explicit arguments to the runtime
     // function.
     __ Push(kWasmInstanceRegister, kWasmCompileLazyFuncIndexRegister);
-    // Load the correct CEntry builtin from the instance object.
-    __ Ldr(x2, FieldMemOperand(kWasmInstanceRegister,
-                               WasmInstanceObject::kIsolateRootOffset));
-    auto centry_id =
-        Builtins::kCEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit;
-    __ LoadTaggedPointerField(
-        x2, MemOperand(x2, IsolateData::builtin_slot_offset(centry_id)));
     // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ Mov(cp, Smi::zero());
-    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, x2);
+    __ CallRuntime(Runtime::kWasmCompileLazy, 2);
     // The entrypoint address is the return value.
     __ mov(x8, kReturnRegister0);
 
@@ -3349,55 +3221,6 @@ void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
   __ Ret();
 }
 
-void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- x0 : argc
-  //  -- x1 : constructor
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  Register constructor = x1;
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    Label unexpected_map, map_ok;
-    // Initial map for the builtin Array function should be a map.
-    __ LoadTaggedPointerField(
-        x10,
-        FieldMemOperand(constructor, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ JumpIfSmi(x10, &unexpected_map);
-    __ JumpIfObjectType(x10, x10, x11, MAP_TYPE, &map_ok);
-    __ Bind(&unexpected_map);
-    __ Abort(AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ Bind(&map_ok);
-
-    Register kind = w3;
-    // Figure out the right elements kind
-    __ LoadTaggedPointerField(
-        x10,
-        FieldMemOperand(constructor, JSFunction::kPrototypeOrInitialMapOffset));
-
-    // Retrieve elements_kind from map.
-    __ LoadElementsKindFromMap(kind, x10);
-
-    // Initial elements kind should be packed elements.
-    __ Cmp(kind, PACKED_ELEMENTS);
-    __ Assert(eq, AbortReason::kInvalidElementsKindForInternalPackedArray);
-
-    // No arguments should be passed.
-    __ Cmp(x0, 0);
-    __ Assert(eq, AbortReason::kWrongNumberOfArgumentsForInternalPackedArray);
-  }
-
-  __ Jump(
-      BUILTIN_CODE(masm->isolate(), InternalArrayNoArgumentConstructor_Packed),
-      RelocInfo::CODE_TARGET);
-}
-
 namespace {
 
 // The number of register that CallApiFunctionAndReturn will need to save on
@@ -3429,7 +3252,7 @@ void CallApiFunctionAndReturn(MacroAssembler* masm, Register function_address,
   const int kLevelOffset = AddressOffset(
       ExternalReference::handle_scope_level_address(isolate), next_address);
 
-  DCHECK(function_address.is(x1) || function_address.is(x2));
+  DCHECK(function_address == x1 || function_address == x2);
 
   Label profiler_enabled, end_profiler_check;
   __ Mov(x10, ExternalReference::is_profiling_address(isolate));
diff --git a/deps/v8/src/builtins/array-copywithin.tq b/deps/v8/src/builtins/array-copywithin.tq
index 574eaf9b9de4cc..cee0b1e1a48355 100644
--- a/deps/v8/src/builtins/array-copywithin.tq
+++ b/deps/v8/src/builtins/array-copywithin.tq
@@ -2,14 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_copywithin {
+namespace array {
   macro ConvertToRelativeIndex(index: Number, length: Number): Number {
     return index < 0 ? Max(index + length, 0) : Min(index, length);
   }
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.copyWithin
   transitioning javascript builtin ArrayPrototypeCopyWithin(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     // 1. Let O be ? ToObject(this value).
     const object: JSReceiver = ToObject_Inline(context, receiver);
 
@@ -17,14 +18,14 @@ namespace array_copywithin {
     const length: Number = GetLengthProperty(object);
 
     // 3. Let relativeTarget be ? ToInteger(target).
-    const relativeTarget: Number = ToInteger_Inline(context, arguments[0]);
+    const relativeTarget: Number = ToInteger_Inline(arguments[0]);
 
     // 4. If relativeTarget < 0, let to be max((len + relativeTarget), 0);
     //    else let to be min(relativeTarget, len).
     let to: Number = ConvertToRelativeIndex(relativeTarget, length);
 
     // 5. Let relativeStart be ? ToInteger(start).
-    const relativeStart: Number = ToInteger_Inline(context, arguments[1]);
+    const relativeStart: Number = ToInteger_Inline(arguments[1]);
 
     // 6. If relativeStart < 0, let from be max((len + relativeStart), 0);
     //    else let from be min(relativeStart, len).
@@ -34,7 +35,7 @@ namespace array_copywithin {
     //    else let relativeEnd be ? ToInteger(end).
     let relativeEnd: Number = length;
     if (arguments[2] != Undefined) {
-      relativeEnd = ToInteger_Inline(context, arguments[2]);
+      relativeEnd = ToInteger_Inline(arguments[2]);
     }
 
     // 8. If relativeEnd < 0, let final be max((len + relativeEnd), 0);
@@ -74,7 +75,7 @@ namespace array_copywithin {
         SetProperty(object, to, fromVal);
       } else {
         // i. Perform ? DeletePropertyOrThrow(O, toKey).
-        DeleteProperty(object, to, kStrict);
+        DeleteProperty(object, to, LanguageMode::kStrict);
       }
 
       // f. Let from be from + direction.
diff --git a/deps/v8/src/builtins/array-every.tq b/deps/v8/src/builtins/array-every.tq
index 8f4c0e1f231dca..4e5f99d40a5202 100644
--- a/deps/v8/src/builtins/array-every.tq
+++ b/deps/v8/src/builtins/array-every.tq
@@ -5,7 +5,7 @@
 namespace array {
   transitioning javascript builtin
   ArrayEveryLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
     // after the ToObject(O) call that ensures we are dealing with a
@@ -26,7 +26,7 @@ namespace array {
 
   transitioning javascript builtin
   ArrayEveryLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
       result: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
@@ -110,7 +110,7 @@ namespace array {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.every
   transitioning javascript builtin
-  ArrayEvery(js-implicit context: Context, receiver: JSAny)(...arguments):
+  ArrayEvery(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
       JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.every');
@@ -141,7 +141,7 @@ namespace array {
       }
     }
     label TypeError deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
   }
 }
diff --git a/deps/v8/src/builtins/array-filter.tq b/deps/v8/src/builtins/array-filter.tq
index 4d23144329ab47..1da1c551664675 100644
--- a/deps/v8/src/builtins/array-filter.tq
+++ b/deps/v8/src/builtins/array-filter.tq
@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_filter {
+namespace array {
   transitioning javascript builtin
   ArrayFilterLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
       length: JSAny, initialTo: JSAny): JSAny {
     // All continuation points in the optimized filter implementation are
@@ -29,7 +29,7 @@ namespace array_filter {
 
   transitioning javascript builtin
   ArrayFilterLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
       length: JSAny, valueK: JSAny, initialTo: JSAny, result: JSAny): JSAny {
     // All continuation points in the optimized filter implementation are
@@ -141,13 +141,13 @@ namespace array_filter {
     const o = Cast<FastJSArray>(receiver) otherwise Slow;
     const newMap: Map =
         LoadJSArrayElementsMap(o.map.elements_kind, LoadNativeContext(context));
-    return AllocateJSArray(PACKED_SMI_ELEMENTS, newMap, len, len);
+    return AllocateJSArray(ElementsKind::PACKED_SMI_ELEMENTS, newMap, len, len);
   }
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.filter
   transitioning javascript builtin
-  ArrayFilter(js-implicit context: Context, receiver: JSAny)(...arguments):
-      JSAny {
+  ArrayFilter(js-implicit context: NativeContext, receiver: JSAny)(
+      ...arguments): JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.filter');
 
@@ -196,7 +196,7 @@ namespace array_filter {
           o, callbackfn, thisArg, output, o, k, len, to);
     }
     label TypeError deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
   }
 }
diff --git a/deps/v8/src/builtins/array-find.tq b/deps/v8/src/builtins/array-find.tq
index ec840a4c98b09b..cd3ec45e98e7fe 100644
--- a/deps/v8/src/builtins/array-find.tq
+++ b/deps/v8/src/builtins/array-find.tq
@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_find {
+namespace array {
   transitioning javascript builtin
   ArrayFindLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized find implementation are
     // after the ToObject(O) call that ensures we are dealing with a
@@ -25,7 +25,7 @@ namespace array_find {
 
   transitioning javascript builtin
   ArrayFindLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       _callback: JSAny, _thisArg: JSAny, _initialK: JSAny, _length: JSAny,
       _result: JSAny): JSAny {
     // This deopt continuation point is never actually called, it just
@@ -39,7 +39,7 @@ namespace array_find {
   // before iteration continues.
   transitioning javascript builtin
   ArrayFindLoopAfterCallbackLazyDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
       foundValue: JSAny, isFound: JSAny): JSAny {
     // All continuation points in the optimized find implementation are
@@ -117,7 +117,7 @@ namespace array_find {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.find
   transitioning javascript builtin
-  ArrayPrototypeFind(js-implicit context: Context, receiver: JSAny)(
+  ArrayPrototypeFind(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.find');
@@ -148,7 +148,7 @@ namespace array_find {
       }
     }
     label NotCallableError deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
   }
 }
diff --git a/deps/v8/src/builtins/array-findindex.tq b/deps/v8/src/builtins/array-findindex.tq
index 6145c8146455b5..05a264064669b1 100644
--- a/deps/v8/src/builtins/array-findindex.tq
+++ b/deps/v8/src/builtins/array-findindex.tq
@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_findindex {
+namespace array {
   transitioning javascript builtin
   ArrayFindIndexLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized findIndex implementation are
     // after the ToObject(O) call that ensures we are dealing with a
@@ -25,7 +25,7 @@ namespace array_findindex {
 
   transitioning javascript builtin
   ArrayFindIndexLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       _callback: JSAny, _thisArg: JSAny, _initialK: JSAny, _length: JSAny,
       _result: JSAny): JSAny {
     // This deopt continuation point is never actually called, it just
@@ -39,7 +39,7 @@ namespace array_findindex {
   // before iteration continues.
   transitioning javascript builtin
   ArrayFindIndexLoopAfterCallbackLazyDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
       foundValue: JSAny, isFound: JSAny): JSAny {
     // All continuation points in the optimized findIndex implementation are
@@ -118,7 +118,7 @@ namespace array_findindex {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.findIndex
   transitioning javascript builtin
-  ArrayPrototypeFindIndex(js-implicit context: Context, receiver: JSAny)(
+  ArrayPrototypeFindIndex(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.findIndex');
@@ -150,7 +150,7 @@ namespace array_findindex {
       }
     }
     label NotCallableError deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
   }
 }
diff --git a/deps/v8/src/builtins/array-foreach.tq b/deps/v8/src/builtins/array-foreach.tq
index 5b6e3926016c2c..b30c8533e69f06 100644
--- a/deps/v8/src/builtins/array-foreach.tq
+++ b/deps/v8/src/builtins/array-foreach.tq
@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_foreach {
+namespace array {
   transitioning javascript builtin
   ArrayForEachLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized forEach implemntation are
     // after the ToObject(O) call that ensures we are dealing with a
@@ -22,7 +22,7 @@ namespace array_foreach {
 
   transitioning javascript builtin
   ArrayForEachLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
       _result: JSAny): JSAny {
     // All continuation points in the optimized forEach implemntation are
@@ -91,8 +91,8 @@ namespace array_foreach {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.foreach
   transitioning javascript builtin
-  ArrayForEach(js-implicit context: Context, receiver: JSAny)(...arguments):
-      JSAny {
+  ArrayForEach(js-implicit context: NativeContext, receiver: JSAny)(
+      ...arguments): JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.forEach');
 
@@ -125,7 +125,7 @@ namespace array_foreach {
           o, callbackfn, thisArg, Undefined, o, k, len, Undefined);
     }
     label TypeError deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
   }
 }
diff --git a/deps/v8/src/builtins/array-from.tq b/deps/v8/src/builtins/array-from.tq
new file mode 100644
index 00000000000000..6eb3b006935733
--- /dev/null
+++ b/deps/v8/src/builtins/array-from.tq
@@ -0,0 +1,184 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace array {
+  // Array.from( items [, mapfn [, thisArg ] ] )
+  // ES #sec-array.from
+  transitioning javascript builtin
+  ArrayFrom(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
+      JSReceiver {
+    // Use fast path if:
+    // * |items| is the only argument, and
+    // * the receiver is the Array function.
+    if (arguments.length == 1 && receiver == GetArrayFunction()) {
+      try {
+        return iterator::FastIterableToList(arguments[0]) otherwise Slow;
+      }
+      label Slow {
+        // fall through
+      }
+    }
+
+    const items = arguments[0];
+    const mapfn = arguments[1];
+    const thisArg = arguments[2];
+
+    // 1. Let C be the this value.
+    const c = receiver;
+
+    let mapping: bool;
+    // 2. If mapfn is undefined, let mapping be false.
+    if (mapfn == Undefined) {
+      mapping = false;
+    } else {
+      // a. If IsCallable(mapfn) is false, throw a TypeError exception.
+      if (!TaggedIsCallable(mapfn)) deferred {
+          ThrowTypeError(MessageTemplate::kCalledNonCallable, mapfn);
+        }
+      // b. Let mapping be true.
+      mapping = true;
+    }
+
+    // 4. Let usingIterator be ? GetMethod(items, @@iterator).
+    // 5. If usingIterator is not undefined, then
+    try {
+      const usingIterator = GetMethod(items, IteratorSymbolConstant())
+          otherwise IteratorIsUndefined, IteratorNotCallable;
+
+      let a: JSReceiver;
+      // a. If IsConstructor(C) is true, then
+      typeswitch (c) {
+        case (c: Constructor): {
+          // i. Let A be ? Construct(C).
+          a = Construct(c);
+        }
+        case (JSAny): {
+          // i. Let A be ? ArrayCreate(0).
+          a = ArrayCreate(0);
+        }
+      }
+
+      // c. Let iteratorRecord be ? GetIterator(items, sync, usingIterator).
+      const iteratorRecord = iterator::GetIterator(items, usingIterator);
+
+      const fastIteratorResultMap = GetIteratorResultMap();
+
+      // d. Let k be 0.
+      let k: Smi = 0;
+      // e. Repeat,
+      while (true) {
+        // i. If k ≥ 2^53-1, then
+        //   1. Let error be ThrowCompletion(a newly created TypeError object).
+        //   2. Return ? IteratorClose(iteratorRecord, error).
+        // The spec requires that we throw an exception if index reaches 2^53-1,
+        // but an empty loop would take >100 days to do this many iterations. To
+        // actually run for that long would require an iterator that never set
+        // done to true and a target array which somehow never ran out of
+        // memory, e.g. a proxy that discarded the values. Ignoring this case
+        // just means we would repeatedly call CreateDataProperty with index =
+        // 2^53
+        assert(k < kMaxSafeInteger);
+
+        // ii. Let Pk be ! ToString(k).
+
+        // iii. Let next be ? IteratorStep(iteratorRecord).
+        let next: JSReceiver;
+        try {
+          next = iterator::IteratorStep(iteratorRecord, fastIteratorResultMap)
+              otherwise NextIsFalse;
+        }
+        // iv. If next is false, then
+        label NextIsFalse {
+          // 1. Perform ? Set(A, "length", k, true).
+          array::SetPropertyLength(a, k);
+          // 2. Return A.
+          return a;
+        }
+
+        // v. Let nextValue be ? IteratorValue(next).
+        const nextValue = iterator::IteratorValue(next, fastIteratorResultMap);
+
+        let mappedValue: JSAny;
+        // vi. If mapping is true, then
+        if (mapping) {
+          // 1. Let mappedValue be Call(mapfn, thisArg, « nextValue, k »).
+          // 2. If mappedValue is an abrupt completion,
+          //    return ? IteratorClose(iteratorRecord, mappedValue).
+          // 3. Set mappedValue to mappedValue.[[Value]].
+          try {
+            mappedValue = Call(
+                context, UnsafeCast<Callable>(mapfn), thisArg, nextValue, k);
+          } catch (e) {
+            iterator::IteratorCloseOnException(iteratorRecord, e);
+          }
+        } else {
+          mappedValue = nextValue;
+        }
+        // viii. Let defineStatus be
+        //       CreateDataPropertyOrThrow(A, Pk, mappedValue).
+        // ix. If defineStatus is an abrupt completion,
+        //     return ? IteratorClose(iteratorRecord, defineStatus).
+        try {
+          FastCreateDataProperty(a, k, mappedValue);
+        } catch (e) deferred {
+          iterator::IteratorCloseOnException(iteratorRecord, e);
+        }
+        // x. Set k to k + 1.
+        k += 1;
+      }
+      unreachable;
+    }
+    label IteratorIsUndefined {
+      // 6. NOTE: items is not an Iterable so assume it is an array-like object.
+      // 7. Let arrayLike be ! ToObject(items).
+      const arrayLike = ToObject_Inline(context, items);
+      // 8. Let len be ? LengthOfArrayLike(arrayLike).
+      const len = GetLengthProperty(arrayLike);
+
+      let a: JSReceiver;
+      // 9. If IsConstructor(C) is true, then
+      typeswitch (c) {
+        case (c: Constructor): {
+          // a. Let A be ? Construct(C, « len »).
+          a = Construct(c, len);
+        }
+        case (JSAny): {
+          // a. Let A be ? ArrayCreate(len).
+          a = ArrayCreate(len);
+        }
+      }
+
+      // 11. Let k be 0.
+      let k: Smi = 0;
+      // 12. Repeat, while k < len
+      while (k < len) {
+        // a. Let Pk be ! ToString(k).
+        // b. Let kValue be ? Get(arrayLike, Pk).
+        const kValue = GetProperty(arrayLike, k);
+        let mappedValue: JSAny;
+        // c. If mapping is true, then
+        if (mapping) {
+          // i. Let mappedValue be ? Call(mapfn, thisArg, « kValue, k »).
+          mappedValue =
+              Call(context, UnsafeCast<Callable>(mapfn), thisArg, kValue, k);
+        } else {
+          // d. Else, let mappedValue be kValue.
+          mappedValue = kValue;
+        }
+        // e. Perform ? CreateDataPropertyOrThrow(A, Pk, mappedValue).
+        FastCreateDataProperty(a, k, mappedValue);
+        // f. Set k to k + 1.
+        k += 1;
+      }
+
+      // 13. Perform ? Set(A, "length", len, true).
+      array::SetPropertyLength(a, len);
+      // 14. Return A.
+      return a;
+    }
+    label IteratorNotCallable(_value: JSAny) deferred {
+      ThrowTypeError(MessageTemplate::kIteratorSymbolNonCallable);
+    }
+  }
+}
diff --git a/deps/v8/src/builtins/array-isarray.tq b/deps/v8/src/builtins/array-isarray.tq
new file mode 100644
index 00000000000000..48fca60339d777
--- /dev/null
+++ b/deps/v8/src/builtins/array-isarray.tq
@@ -0,0 +1,27 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace runtime {
+  extern runtime ArrayIsArray(implicit context: Context)(JSAny): JSAny;
+}  // namespace runtime
+
+namespace array {
+  // ES #sec-array.isarray
+  javascript builtin ArrayIsArray(js-implicit context:
+                                      NativeContext)(arg: JSAny): JSAny {
+    // 1. Return ? IsArray(arg).
+    typeswitch (arg) {
+      case (JSArray): {
+        return True;
+      }
+      case (JSProxy): {
+        // TODO(verwaest): Handle proxies in-place
+        return runtime::ArrayIsArray(arg);
+      }
+      case (JSAny): {
+        return False;
+      }
+    }
+  }
+}  // namespace array
diff --git a/deps/v8/src/builtins/array-join.tq b/deps/v8/src/builtins/array-join.tq
index 08b5221e099c6b..a06365f3354b13 100644
--- a/deps/v8/src/builtins/array-join.tq
+++ b/deps/v8/src/builtins/array-join.tq
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_join {
-  type LoadJoinElementFn = builtin(Context, JSReceiver, Number) => JSAny;
+namespace array {
+  type LoadJoinElementFn = builtin(Context, JSReceiver, uintptr) => JSAny;
 
   // Fast C call to write a fixed array (see Buffer.fixedArray) to a single
   // string.
@@ -11,21 +11,21 @@ namespace array_join {
   ArrayBuiltinsAssembler::CallJSArrayArrayJoinConcatToSequentialString(
       FixedArray, intptr, String, String): String;
 
-  transitioning builtin LoadJoinElement<T: type>(
-      context: Context, receiver: JSReceiver, k: Number): JSAny {
-    return GetProperty(receiver, k);
+  transitioning builtin LoadJoinElement<T : type extends ElementsKind>(
+      context: Context, receiver: JSReceiver, k: uintptr): JSAny {
+    return GetProperty(receiver, Convert<Number>(k));
   }
 
   transitioning LoadJoinElement<array::DictionaryElements>(
-      context: Context, receiver: JSReceiver, k: Number): JSAny {
+      context: Context, receiver: JSReceiver, k: uintptr): JSAny {
     const array: JSArray = UnsafeCast<JSArray>(receiver);
     const dict: NumberDictionary = UnsafeCast<NumberDictionary>(array.elements);
     try {
-      return BasicLoadNumberDictionaryElement(dict, Signed(Convert<uintptr>(k)))
+      return BasicLoadNumberDictionaryElement(dict, Signed(k))
           otherwise IfNoData, IfHole;
     }
     label IfNoData deferred {
-      return GetProperty(receiver, k);
+      return GetProperty(receiver, Convert<Number>(k));
     }
     label IfHole {
       return kEmptyString;
@@ -33,30 +33,29 @@ namespace array_join {
   }
 
   LoadJoinElement<array::FastSmiOrObjectElements>(
-      context: Context, receiver: JSReceiver, k: Number): JSAny {
+      context: Context, receiver: JSReceiver, k: uintptr): JSAny {
     const array: JSArray = UnsafeCast<JSArray>(receiver);
     const fixedArray: FixedArray = UnsafeCast<FixedArray>(array.elements);
-    const element: Object = fixedArray.objects[UnsafeCast<Smi>(k)];
+    const element: Object = fixedArray.objects[k];
     return element == TheHole ? kEmptyString : UnsafeCast<JSAny>(element);
   }
 
   LoadJoinElement<array::FastDoubleElements>(
-      context: Context, receiver: JSReceiver, k: Number): JSAny {
+      context: Context, receiver: JSReceiver, k: uintptr): JSAny {
     const array: JSArray = UnsafeCast<JSArray>(receiver);
     const fixedDoubleArray: FixedDoubleArray =
         UnsafeCast<FixedDoubleArray>(array.elements);
-    const element: float64 = LoadDoubleWithHoleCheck(
-        fixedDoubleArray, UnsafeCast<Smi>(k)) otherwise return kEmptyString;
+    const element: float64 =
+        fixedDoubleArray.floats[k].Value() otherwise return kEmptyString;
     return AllocateHeapNumberWithValue(element);
   }
 
-  builtin LoadJoinTypedElement<T: type>(
-      context: Context, receiver: JSReceiver, k: Number): JSAny {
+  builtin LoadJoinTypedElement<T : type extends ElementsKind>(
+      context: Context, receiver: JSReceiver, k: uintptr): JSAny {
     const typedArray: JSTypedArray = UnsafeCast<JSTypedArray>(receiver);
     assert(!IsDetachedBuffer(typedArray.buffer));
     return typed_array::LoadFixedTypedArrayElementAsTagged(
-        typedArray.data_ptr, UnsafeCast<Smi>(k),
-        typed_array::KindForArrayType<T>());
+        typedArray.data_ptr, k, typed_array::KindForArrayType<T>());
   }
 
   transitioning builtin ConvertToLocaleString(
@@ -75,10 +74,10 @@ namespace array_join {
       } else {
         result = Call(context, callable, element, locales, options);
       }
-      return ToString_Inline(context, result);
+      return ToString_Inline(result);
     }
     label TypeError {
-      ThrowTypeError(kCalledNonCallable, prop);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, prop);
     }
   }
 
@@ -137,7 +136,7 @@ namespace array_join {
         const newLength: intptr = CalculateNewElementsCapacity(length);
         assert(index < newLength);
         const newfixedArray: FixedArray =
-            ExtractFixedArray(fixedArray, 0, length, newLength, kFixedArrays);
+            ExtractFixedArray(fixedArray, 0, length, newLength);
         newfixedArray.objects[index] = element;
         return newfixedArray;
       }
@@ -148,7 +147,7 @@ namespace array_join {
   // The buffer is maintained and updated by Buffer.constructor, Buffer.Add(),
   // Buffer.AddSeparators().
   struct Buffer {
-    Add(implicit context: Context)(
+    macro Add(implicit context: Context)(
         str: String, nofSeparators: intptr, separatorLength: intptr) {
       // Add separators if necessary (at the beginning or more than one)
       const writeSeparators: bool = this.index == 0 | nofSeparators > 1;
@@ -162,7 +161,7 @@ namespace array_join {
           IsOneByteStringInstanceType(str.instanceType) & this.isOneByte;
     }
 
-    AddSeparators(implicit context: Context)(
+    macro AddSeparators(implicit context: Context)(
         nofSeparators: intptr, separatorLength: intptr, write: bool) {
       if (nofSeparators == 0 || separatorLength == 0) return;
 
@@ -283,7 +282,7 @@ namespace array_join {
       }
 
       // b. Let element be ? Get(O, ! ToString(k)).
-      const element: JSAny = loadFn(context, receiver, Convert<Number>(k++));
+      const element: JSAny = loadFn(context, receiver, k++);
 
       // c. If element is undefined or null, let next be the empty String;
       //    otherwise, let next be ? ToString(element).
@@ -336,11 +335,12 @@ namespace array_join {
       if (!IsPrototypeInitialArrayPrototype(map)) goto IfSlowPath;
       if (IsNoElementsProtectorCellInvalid()) goto IfSlowPath;
 
-      if (IsElementsKindLessThanOrEqual(kind, HOLEY_ELEMENTS)) {
+      if (IsElementsKindLessThanOrEqual(kind, ElementsKind::HOLEY_ELEMENTS)) {
         loadFn = LoadJoinElement<array::FastSmiOrObjectElements>;
-      } else if (IsElementsKindLessThanOrEqual(kind, HOLEY_DOUBLE_ELEMENTS)) {
+      } else if (IsElementsKindLessThanOrEqual(
+                     kind, ElementsKind::HOLEY_DOUBLE_ELEMENTS)) {
         loadFn = LoadJoinElement<array::FastDoubleElements>;
-      } else if (kind == DICTIONARY_ELEMENTS)
+      } else if (kind == ElementsKind::DICTIONARY_ELEMENTS)
         deferred {
           const dict: NumberDictionary =
               UnsafeCast<NumberDictionary>(array.elements);
@@ -377,32 +377,32 @@ namespace array_join {
     const kind: ElementsKind = map.elements_kind;
     let loadFn: LoadJoinElementFn;
 
-    if (IsElementsKindGreaterThan(kind, UINT32_ELEMENTS)) {
-      if (kind == INT32_ELEMENTS) {
+    if (IsElementsKindGreaterThan(kind, ElementsKind::UINT32_ELEMENTS)) {
+      if (kind == ElementsKind::INT32_ELEMENTS) {
         loadFn = LoadJoinTypedElement<typed_array::Int32Elements>;
-      } else if (kind == FLOAT32_ELEMENTS) {
+      } else if (kind == ElementsKind::FLOAT32_ELEMENTS) {
         loadFn = LoadJoinTypedElement<typed_array::Float32Elements>;
-      } else if (kind == FLOAT64_ELEMENTS) {
+      } else if (kind == ElementsKind::FLOAT64_ELEMENTS) {
         loadFn = LoadJoinTypedElement<typed_array::Float64Elements>;
-      } else if (kind == UINT8_CLAMPED_ELEMENTS) {
+      } else if (kind == ElementsKind::UINT8_CLAMPED_ELEMENTS) {
         loadFn = LoadJoinTypedElement<typed_array::Uint8ClampedElements>;
-      } else if (kind == BIGUINT64_ELEMENTS) {
+      } else if (kind == ElementsKind::BIGUINT64_ELEMENTS) {
         loadFn = LoadJoinTypedElement<typed_array::BigUint64Elements>;
-      } else if (kind == BIGINT64_ELEMENTS) {
+      } else if (kind == ElementsKind::BIGINT64_ELEMENTS) {
         loadFn = LoadJoinTypedElement<typed_array::BigInt64Elements>;
       } else {
         unreachable;
       }
     } else {
-      if (kind == UINT8_ELEMENTS) {
+      if (kind == ElementsKind::UINT8_ELEMENTS) {
         loadFn = LoadJoinTypedElement<typed_array::Uint8Elements>;
-      } else if (kind == INT8_ELEMENTS) {
+      } else if (kind == ElementsKind::INT8_ELEMENTS) {
         loadFn = LoadJoinTypedElement<typed_array::Int8Elements>;
-      } else if (kind == UINT16_ELEMENTS) {
+      } else if (kind == ElementsKind::UINT16_ELEMENTS) {
         loadFn = LoadJoinTypedElement<typed_array::Uint16Elements>;
-      } else if (kind == INT16_ELEMENTS) {
+      } else if (kind == ElementsKind::INT16_ELEMENTS) {
         loadFn = LoadJoinTypedElement<typed_array::Int16Elements>;
-      } else if (kind == UINT32_ELEMENTS) {
+      } else if (kind == ElementsKind::UINT32_ELEMENTS) {
         loadFn = LoadJoinTypedElement<typed_array::Uint32Elements>;
       } else {
         unreachable;
@@ -422,8 +422,8 @@ namespace array_join {
   macro LoadJoinStack(implicit context: Context)(): FixedArray
       labels IfUninitialized {
     const nativeContext: NativeContext = LoadNativeContext(context);
-    const stack: HeapObject =
-        UnsafeCast<HeapObject>(nativeContext[ARRAY_JOIN_STACK_INDEX]);
+    const stack: HeapObject = UnsafeCast<HeapObject>(
+        nativeContext[NativeContextSlot::ARRAY_JOIN_STACK_INDEX]);
     if (stack == Undefined) goto IfUninitialized;
     assert(IsFixedArray(stack));
     return UnsafeCast<FixedArray>(stack);
@@ -431,7 +431,7 @@ namespace array_join {
 
   macro SetJoinStack(implicit context: Context)(stack: FixedArray): void {
     const nativeContext: NativeContext = LoadNativeContext(context);
-    nativeContext[ARRAY_JOIN_STACK_INDEX] = stack;
+    nativeContext[NativeContextSlot::ARRAY_JOIN_STACK_INDEX] = stack;
   }
 
   // Adds a receiver to the stack. The FixedArray will automatically grow to
@@ -476,7 +476,7 @@ namespace array_join {
     }
     label IfUninitialized {
       const stack: FixedArray =
-          AllocateFixedArrayWithHoles(kMinJoinStackSize, kNone);
+          AllocateFixedArrayWithHoles(kMinJoinStackSize, AllocationFlag::kNone);
       stack.objects[0] = receiver;
       SetJoinStack(stack);
     }
@@ -493,8 +493,8 @@ namespace array_join {
         // Shrink the Join Stack if the stack will be empty and is larger than
         // the minimum size.
         if (i == 0 && len > kMinJoinStackSize) deferred {
-            const newStack: FixedArray =
-                AllocateFixedArrayWithHoles(kMinJoinStackSize, kNone);
+            const newStack: FixedArray = AllocateFixedArrayWithHoles(
+                kMinJoinStackSize, AllocationFlag::kNone);
             SetJoinStack(newStack);
           }
         else {
@@ -529,8 +529,7 @@ namespace array_join {
       sepObj: JSAny, locales: JSAny, options: JSAny): JSAny {
     // 3. If separator is undefined, let sep be the single-element String ",".
     // 4. Else, let sep be ? ToString(separator).
-    const sep: String =
-        sepObj == Undefined ? ',' : ToString_Inline(context, sepObj);
+    const sep: String = sepObj == Undefined ? ',' : ToString_Inline(sepObj);
 
     // If the receiver is not empty and not already being joined, continue with
     // the normal join algorithm.
@@ -551,7 +550,7 @@ namespace array_join {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.join
   transitioning javascript builtin
-  ArrayPrototypeJoin(js-implicit context: Context, receiver: JSAny)(
+  ArrayPrototypeJoin(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): JSAny {
     const separator: JSAny = arguments[0];
 
@@ -563,7 +562,8 @@ namespace array_join {
 
     // Only handle valid array lengths. Although the spec allows larger
     // values, this matches historical V8 behavior.
-    if (len > kMaxArrayIndex + 1) ThrowTypeError(kInvalidArrayLength);
+    if (len > kMaxArrayIndex + 1)
+      ThrowTypeError(MessageTemplate::kInvalidArrayLength);
 
     return CycleProtectedArrayJoin<JSArray>(
         false, o, len, separator, Undefined, Undefined);
@@ -571,7 +571,8 @@ namespace array_join {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.tolocalestring
   transitioning javascript builtin ArrayPrototypeToLocaleString(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const locales: JSAny = arguments[0];
     const options: JSAny = arguments[1];
 
@@ -583,7 +584,8 @@ namespace array_join {
 
     // Only handle valid array lengths. Although the spec allows larger
     // values, this matches historical V8 behavior.
-    if (len > kMaxArrayIndex + 1) ThrowTypeError(kInvalidArrayLength);
+    if (len > kMaxArrayIndex + 1)
+      ThrowTypeError(MessageTemplate::kInvalidArrayLength);
 
     return CycleProtectedArrayJoin<JSArray>(
         true, o, len, ',', locales, options);
@@ -591,7 +593,8 @@ namespace array_join {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.tostring
   transitioning javascript builtin ArrayPrototypeToString(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     // 1. Let array be ? ToObject(this value).
     const array: JSReceiver = ToObject_Inline(context, receiver);
 
@@ -612,7 +615,8 @@ namespace array_join {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.join
   transitioning javascript builtin TypedArrayPrototypeJoin(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const separator: JSAny = arguments[0];
 
     // Spec: ValidateTypedArray is applied to the this value prior to evaluating
@@ -627,7 +631,8 @@ namespace array_join {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.tolocalestring
   transitioning javascript builtin TypedArrayPrototypeToLocaleString(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const locales: JSAny = arguments[0];
     const options: JSAny = arguments[1];
 
diff --git a/deps/v8/src/builtins/array-lastindexof.tq b/deps/v8/src/builtins/array-lastindexof.tq
index 7765eff6822f34..0ba3ea4030d1ca 100644
--- a/deps/v8/src/builtins/array-lastindexof.tq
+++ b/deps/v8/src/builtins/array-lastindexof.tq
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_lastindexof {
-  macro LoadWithHoleCheck<Elements: type>(
+namespace array {
+  macro LoadWithHoleCheck<Elements : type extends FixedArrayBase>(
       elements: FixedArrayBase, index: Smi): JSAny
       labels IfHole;
 
@@ -20,12 +20,11 @@ namespace array_lastindexof {
       elements: FixedArrayBase, index: Smi): JSAny
       labels IfHole {
     const elements: FixedDoubleArray = UnsafeCast<FixedDoubleArray>(elements);
-    const element: float64 = LoadDoubleWithHoleCheck(elements, index)
-        otherwise IfHole;
+    const element: float64 = elements.floats[index].Value() otherwise IfHole;
     return AllocateHeapNumberWithValue(element);
   }
 
-  macro FastArrayLastIndexOf<Elements: type>(
+  macro FastArrayLastIndexOf<Elements : type extends FixedArrayBase>(
       context: Context, array: JSArray, from: Smi, searchElement: JSAny): Smi {
     const elements: FixedArrayBase = array.elements;
     let k: Smi = from;
@@ -64,7 +63,7 @@ namespace array_lastindexof {
     //    else let n be len - 1.
     const n: Number = arguments.length < 2 ?
         length - 1 :
-        ToInteger_Inline(context, arguments[1], kTruncateMinusZero);
+        ToInteger_Inline(arguments[1], kTruncateMinusZero);
 
     // 5. If n >= 0, then.
     let k: Number = SmiConstant(0);
@@ -131,7 +130,8 @@ namespace array_lastindexof {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.lastIndexOf
   transitioning javascript builtin ArrayPrototypeLastIndexOf(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     // 1. Let O be ? ToObject(this value).
     const object: JSReceiver = ToObject_Inline(context, receiver);
 
diff --git a/deps/v8/src/builtins/array-map.tq b/deps/v8/src/builtins/array-map.tq
index c4b0e8a358a20d..9b45341c0e2568 100644
--- a/deps/v8/src/builtins/array-map.tq
+++ b/deps/v8/src/builtins/array-map.tq
@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_map {
+namespace array {
   transitioning javascript builtin
   ArrayMapLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
       length: JSAny): JSAny {
     // All continuation points in the optimized filter implementation are
@@ -28,7 +28,7 @@ namespace array_map {
 
   transitioning javascript builtin
   ArrayMapLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
       length: JSAny, result: JSAny): JSAny {
     // All continuation points in the optimized filter implementation are
@@ -91,19 +91,19 @@ namespace array_map {
   }
 
   struct Vector {
-    ReportSkippedElement() {
+    macro ReportSkippedElement() {
       this.skippedElements = true;
     }
 
-    CreateJSArray(implicit context: Context)(validLength: Smi): JSArray {
+    macro CreateJSArray(implicit context: Context)(validLength: Smi): JSArray {
       const length: Smi = this.fixedArray.length;
       assert(validLength <= length);
-      let kind: ElementsKind = PACKED_SMI_ELEMENTS;
+      let kind: ElementsKind = ElementsKind::PACKED_SMI_ELEMENTS;
       if (!this.onlySmis) {
         if (this.onlyNumbers) {
-          kind = PACKED_DOUBLE_ELEMENTS;
+          kind = ElementsKind::PACKED_DOUBLE_ELEMENTS;
         } else {
-          kind = PACKED_ELEMENTS;
+          kind = ElementsKind::PACKED_ELEMENTS;
         }
       }
 
@@ -124,13 +124,13 @@ namespace array_map {
         // First, initialize the elements field before allocation to prevent
         // heap corruption.
         const elements: FixedDoubleArray = AllocateFixedDoubleArrayWithHoles(
-            SmiUntag(length), kAllowLargeObjectAllocation);
+            SmiUntag(length), AllocationFlag::kAllowLargeObjectAllocation);
         a = NewJSArray(map, this.fixedArray);
         for (let i: Smi = 0; i < validLength; i++) {
           typeswitch (
               UnsafeCast<(Number | TheHole)>(this.fixedArray.objects[i])) {
             case (n: Number): {
-              elements.floats[i] = Convert<float64>(n);
+              elements.floats[i] = Convert<float64_or_hole>(n);
             }
             case (TheHole): {
             }
@@ -147,7 +147,7 @@ namespace array_map {
       return a;
     }
 
-    StoreResult(implicit context: Context)(index: Smi, result: JSAny) {
+    macro StoreResult(implicit context: Context)(index: Smi, result: JSAny) {
       typeswitch (result) {
         case (s: Smi): {
           this.fixedArray.objects[index] = s;
@@ -173,7 +173,7 @@ namespace array_map {
   macro NewVector(implicit context: Context)(length: Smi): Vector {
     const fixedArray = length > 0 ?
         AllocateFixedArrayWithHoles(
-            SmiUntag(length), kAllowLargeObjectAllocation) :
+            SmiUntag(length), AllocationFlag::kAllowLargeObjectAllocation) :
         kEmptyFixedArray;
     return Vector{
       fixedArray,
@@ -224,7 +224,8 @@ namespace array_map {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.map
   transitioning javascript builtin
-  ArrayMap(js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+  ArrayMap(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
+      JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.map');
 
@@ -266,7 +267,7 @@ namespace array_map {
       return ArrayMapLoopContinuation(o, callbackfn, thisArg, array, o, k, len);
     }
     label TypeError deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
   }
 }
diff --git a/deps/v8/src/builtins/array-of.tq b/deps/v8/src/builtins/array-of.tq
index ceb9edff63c5b8..2df961b9955ec2 100644
--- a/deps/v8/src/builtins/array-of.tq
+++ b/deps/v8/src/builtins/array-of.tq
@@ -2,10 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_of {
+namespace array {
   // https://tc39.github.io/ecma262/#sec-array.of
   transitioning javascript builtin
-  ArrayOf(js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+  ArrayOf(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
+      JSAny {
     // 1. Let len be the actual number of arguments passed to this function.
     const len: Smi = Convert<Smi>(arguments.length);
 
diff --git a/deps/v8/src/builtins/array-reduce-right.tq b/deps/v8/src/builtins/array-reduce-right.tq
index ae5ca99d3d5e14..45055862723af3 100644
--- a/deps/v8/src/builtins/array-reduce-right.tq
+++ b/deps/v8/src/builtins/array-reduce-right.tq
@@ -5,7 +5,7 @@
 namespace array {
   transitioning javascript builtin
   ArrayReduceRightPreLoopEagerDeoptContinuation(
-      js-implicit context: Context,
+      js-implicit context: NativeContext,
       receiver: JSAny)(callback: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
     // after the ToObject(O) call that ensures we are dealing with a
@@ -17,17 +17,18 @@ namespace array {
     const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
     const callbackfn = Cast<Callable>(callback) otherwise unreachable;
     const numberLength = Cast<Number>(length) otherwise unreachable;
+    const initialK = numberLength - 1;
 
-    // Simulate starting the loop at 0, but ensuring that the accumulator is
-    // the hole. The continuation stub will search for the initial non-hole
-    // element, rightly throwing an exception if not found.
+    // Simulate starting the loop at {length - 1}, but ensuring that the
+    // accumulator is the hole. The continuation stub will search for the
+    // last non-hole element, rightly throwing an exception if not found.
     return ArrayReduceRightLoopContinuation(
-        jsreceiver, callbackfn, TheHole, jsreceiver, 0, numberLength);
+        jsreceiver, callbackfn, TheHole, jsreceiver, initialK, numberLength);
   }
 
   transitioning javascript builtin
   ArrayReduceRightLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, initialK: JSAny, length: JSAny,
       accumulator: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
@@ -48,7 +49,7 @@ namespace array {
 
   transitioning javascript builtin
   ArrayReduceRightLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, initialK: JSAny, length: JSAny, result: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
     // after the ToObject(O) call that ensures we are dealing with a
@@ -67,7 +68,7 @@ namespace array {
   transitioning builtin ArrayReduceRightLoopContinuation(implicit context:
                                                              Context)(
       _receiver: JSReceiver, callbackfn: Callable,
-      initialAccumulator: JSAny | TheHole, o: JSReceiver, initialK: Number,
+      initialAccumulator: JSAny|TheHole, o: JSReceiver, initialK: Number,
       _length: Number): JSAny {
     let accumulator = initialAccumulator;
 
@@ -108,7 +109,8 @@ namespace array {
     // this means kPresent is false.
     typeswitch (accumulator) {
       case (TheHole): {
-        ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduceRight');
+        ThrowTypeError(
+            MessageTemplate::kReduceNoInitial, 'Array.prototype.reduceRight');
       }
       case (accumulator: JSAny): {
         return accumulator;
@@ -118,8 +120,8 @@ namespace array {
 
   transitioning macro FastArrayReduceRight(implicit context: Context)(
       o: JSReceiver, len: Number, callbackfn: Callable,
-      initialAccumulator: JSAny | TheHole): JSAny
-      labels Bailout(Number, JSAny | TheHole) {
+      initialAccumulator: JSAny|TheHole): JSAny
+      labels Bailout(Number, JSAny|TheHole) {
     let accumulator = initialAccumulator;
     const smiLen = Cast<Smi>(len) otherwise goto Bailout(len - 1, accumulator);
     const fastO = Cast<FastJSArrayForRead>(o)
@@ -147,7 +149,8 @@ namespace array {
     }
     typeswitch (accumulator) {
       case (TheHole): {
-        ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduceRight');
+        ThrowTypeError(
+            MessageTemplate::kReduceNoInitial, 'Array.prototype.reduceRight');
       }
       case (accumulator: JSAny): {
         return accumulator;
@@ -157,8 +160,8 @@ namespace array {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.reduceRight
   transitioning javascript builtin
-  ArrayReduceRight(js-implicit context: Context, receiver: JSAny)(...arguments):
-      JSAny {
+  ArrayReduceRight(js-implicit context: NativeContext, receiver: JSAny)(
+      ...arguments): JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.reduceRight');
 
@@ -178,20 +181,20 @@ namespace array {
       // exception. (This case is handled at the end of
       // ArrayReduceRightLoopContinuation).
 
-      const initialValue: JSAny | TheHole =
+      const initialValue: JSAny|TheHole =
           arguments.length > 1 ? arguments[1] : TheHole;
 
       try {
         return FastArrayReduceRight(o, len, callbackfn, initialValue)
             otherwise Bailout;
       }
-      label Bailout(value: Number, accumulator: JSAny | TheHole) {
+      label Bailout(value: Number, accumulator: JSAny|TheHole) {
         return ArrayReduceRightLoopContinuation(
             o, callbackfn, accumulator, o, value, len);
       }
     }
     label NoCallableError deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
   }
 }
diff --git a/deps/v8/src/builtins/array-reduce.tq b/deps/v8/src/builtins/array-reduce.tq
index 1021c4864281fe..4a03776bd4e77a 100644
--- a/deps/v8/src/builtins/array-reduce.tq
+++ b/deps/v8/src/builtins/array-reduce.tq
@@ -5,7 +5,7 @@
 namespace array {
   transitioning javascript builtin
   ArrayReducePreLoopEagerDeoptContinuation(
-      js-implicit context: Context,
+      js-implicit context: NativeContext,
       receiver: JSAny)(callback: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
     // after the ToObject(O) call that ensures we are dealing with a
@@ -27,7 +27,7 @@ namespace array {
 
   transitioning javascript builtin
   ArrayReduceLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, initialK: JSAny, length: JSAny,
       accumulator: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
@@ -48,7 +48,7 @@ namespace array {
 
   transitioning javascript builtin
   ArrayReduceLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, initialK: JSAny, length: JSAny, result: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
     // after the ToObject(O) call that ensures we are dealing with a
@@ -66,7 +66,7 @@ namespace array {
 
   transitioning builtin ArrayReduceLoopContinuation(implicit context: Context)(
       _receiver: JSReceiver, callbackfn: Callable,
-      initialAccumulator: JSAny | TheHole, o: JSReceiver, initialK: Number,
+      initialAccumulator: JSAny|TheHole, o: JSReceiver, initialK: Number,
       length: Number): JSAny {
     let accumulator = initialAccumulator;
 
@@ -107,7 +107,8 @@ namespace array {
     // this means kPresent is false.
     typeswitch (accumulator) {
       case (TheHole): {
-        ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduce');
+        ThrowTypeError(
+            MessageTemplate::kReduceNoInitial, 'Array.prototype.reduce');
       }
       case (accumulator: JSAny): {
         return accumulator;
@@ -117,8 +118,8 @@ namespace array {
 
   transitioning macro FastArrayReduce(implicit context: Context)(
       o: JSReceiver, len: Number, callbackfn: Callable,
-      initialAccumulator: JSAny | TheHole): JSAny
-      labels Bailout(Number, JSAny | TheHole) {
+      initialAccumulator: JSAny|TheHole): JSAny
+      labels Bailout(Number, JSAny|TheHole) {
     const k = 0;
     let accumulator = initialAccumulator;
     Cast<Smi>(len) otherwise goto Bailout(k, accumulator);
@@ -147,7 +148,8 @@ namespace array {
     }
     typeswitch (accumulator) {
       case (TheHole): {
-        ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduce');
+        ThrowTypeError(
+            MessageTemplate::kReduceNoInitial, 'Array.prototype.reduce');
       }
       case (accumulator: JSAny): {
         return accumulator;
@@ -157,8 +159,8 @@ namespace array {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.reduce
   transitioning javascript builtin
-  ArrayReduce(js-implicit context: Context, receiver: JSAny)(...arguments):
-      JSAny {
+  ArrayReduce(js-implicit context: NativeContext, receiver: JSAny)(
+      ...arguments): JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.reduce');
 
@@ -178,20 +180,20 @@ namespace array {
       // exception. (This case is handled at the end of
       // ArrayReduceLoopContinuation).
 
-      const initialValue: JSAny | TheHole =
+      const initialValue: JSAny|TheHole =
           arguments.length > 1 ? arguments[1] : TheHole;
 
       try {
         return FastArrayReduce(o, len, callbackfn, initialValue)
             otherwise Bailout;
       }
-      label Bailout(value: Number, accumulator: JSAny | TheHole) {
+      label Bailout(value: Number, accumulator: JSAny|TheHole) {
         return ArrayReduceLoopContinuation(
             o, callbackfn, accumulator, o, value, len);
       }
     }
     label NoCallableError deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
   }
 }
diff --git a/deps/v8/src/builtins/array-reverse.tq b/deps/v8/src/builtins/array-reverse.tq
index 5e9d3a00f39d95..8c7c61f2ee94f9 100644
--- a/deps/v8/src/builtins/array-reverse.tq
+++ b/deps/v8/src/builtins/array-reverse.tq
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_reverse {
-  macro LoadElement<ElementsAccessor: type, T: type>(
+namespace array {
+  macro LoadElement<ElementsAccessor : type extends ElementsKind, T: type>(
       elements: FixedArrayBase, index: Smi): T;
 
   LoadElement<array::FastPackedSmiElements, Smi>(implicit context: Context)(
@@ -24,11 +24,10 @@ namespace array_reverse {
     const elements: FixedDoubleArray = UnsafeCast<FixedDoubleArray>(elements);
     // This macro is only used for PACKED_DOUBLE, loading the hole should
     // be impossible.
-    return LoadDoubleWithHoleCheck(elements, index)
-        otherwise unreachable;
+    return elements.floats[index].Value() otherwise unreachable;
   }
 
-  macro StoreElement<ElementsAccessor: type, T: type>(
+  macro StoreElement<ElementsAccessor : type extends ElementsKind, T: type>(
       implicit context:
           Context)(elements: FixedArrayBase, index: Smi, value: T);
 
@@ -124,10 +123,10 @@ namespace array_reverse {
         SetProperty(object, lower, upperValue);
 
         // ii. Perform ? DeletePropertyOrThrow(O, upperP).
-        DeleteProperty(object, upper, kStrict);
+        DeleteProperty(object, upper, LanguageMode::kStrict);
       } else if (lowerExists == True && upperExists == False) {
         // i. Perform ? DeletePropertyOrThrow(O, lowerP).
-        DeleteProperty(object, lower, kStrict);
+        DeleteProperty(object, lower, LanguageMode::kStrict);
 
         // ii. Perform ? Set(O, upperP, lowerValue, true).
         SetProperty(object, upper, lowerValue);
@@ -147,15 +146,15 @@ namespace array_reverse {
     const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
 
     const kind: ElementsKind = array.map.elements_kind;
-    if (kind == PACKED_SMI_ELEMENTS) {
+    if (kind == ElementsKind::PACKED_SMI_ELEMENTS) {
       array::EnsureWriteableFastElements(array);
       FastPackedArrayReverse<array::FastPackedSmiElements, Smi>(
           array.elements, array.length);
-    } else if (kind == PACKED_ELEMENTS) {
+    } else if (kind == ElementsKind::PACKED_ELEMENTS) {
       array::EnsureWriteableFastElements(array);
       FastPackedArrayReverse<array::FastPackedObjectElements, JSAny>(
           array.elements, array.length);
-    } else if (kind == PACKED_DOUBLE_ELEMENTS) {
+    } else if (kind == ElementsKind::PACKED_DOUBLE_ELEMENTS) {
       FastPackedArrayReverse<array::FastPackedDoubleElements, float64>(
           array.elements, array.length);
     } else {
@@ -165,7 +164,8 @@ namespace array_reverse {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.reverse
   transitioning javascript builtin ArrayPrototypeReverse(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     try {
       TryFastPackedArrayReverse(receiver) otherwise Baseline;
       return receiver;
diff --git a/deps/v8/src/builtins/array-shift.tq b/deps/v8/src/builtins/array-shift.tq
index 48ffe3b4875805..d32d6be32e3c72 100644
--- a/deps/v8/src/builtins/array-shift.tq
+++ b/deps/v8/src/builtins/array-shift.tq
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_shift {
+namespace array {
   extern builtin ArrayShift(Context, JSFunction, JSAny, int32): JSAny;
 
   macro TryFastArrayShift(implicit context: Context)(receiver: JSAny): JSAny
@@ -76,7 +76,7 @@ namespace array_shift {
         SetProperty(object, to, fromValue);
       } else {
         // i. Perform ? DeletePropertyOrThrow(O, to).
-        DeleteProperty(object, to, kStrict);
+        DeleteProperty(object, to, LanguageMode::kStrict);
       }
 
       // f. Increase k by 1.
@@ -84,7 +84,7 @@ namespace array_shift {
     }
 
     // 7. Perform ? DeletePropertyOrThrow(O, ! ToString(len - 1)).
-    DeleteProperty(object, length - 1, kStrict);
+    DeleteProperty(object, length - 1, LanguageMode::kStrict);
 
     // 8. Perform ? Set(O, "length", len - 1, true).
     SetProperty(object, kLengthString, length - 1);
@@ -95,7 +95,8 @@ namespace array_shift {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.shift
   transitioning javascript builtin ArrayPrototypeShift(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     try {
       return TryFastArrayShift(receiver) otherwise Slow, Runtime;
     }
diff --git a/deps/v8/src/builtins/array-slice.tq b/deps/v8/src/builtins/array-slice.tq
index 57ddc8dea1c852..b11b07e48be65d 100644
--- a/deps/v8/src/builtins/array-slice.tq
+++ b/deps/v8/src/builtins/array-slice.tq
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_slice {
+namespace array {
   macro HandleSimpleArgumentsSlice(
       context: NativeContext, args: JSArgumentsObjectWithLength, start: Smi,
       count: Smi): JSArray
@@ -15,14 +15,15 @@ namespace array_slice {
         Cast<FixedArray>(args.elements) otherwise Bailout;
     if (SmiAbove(end, sourceElements.length)) goto Bailout;
 
-    const arrayMap: Map = LoadJSArrayElementsMap(HOLEY_ELEMENTS, context);
+    const arrayMap: Map =
+        LoadJSArrayElementsMap(ElementsKind::HOLEY_ELEMENTS, context);
     const result: JSArray =
-        AllocateJSArray(HOLEY_ELEMENTS, arrayMap, count, count);
+        AllocateJSArray(ElementsKind::HOLEY_ELEMENTS, arrayMap, count, count);
     const newElements: FixedArray =
         Cast<FixedArray>(result.elements) otherwise Bailout;
     CopyElements(
-        PACKED_ELEMENTS, newElements, 0, sourceElements, Convert<intptr>(start),
-        Convert<intptr>(count));
+        ElementsKind::PACKED_ELEMENTS, newElements, 0, sourceElements,
+        Convert<intptr>(start), Convert<intptr>(count));
     return result;
   }
 
@@ -51,9 +52,10 @@ namespace array_slice {
     const argumentsContext: Context = UnsafeCast<Context>(
         sloppyElements.objects[kSloppyArgumentsContextIndex]);
 
-    const arrayMap: Map = LoadJSArrayElementsMap(HOLEY_ELEMENTS, context);
+    const arrayMap: Map =
+        LoadJSArrayElementsMap(ElementsKind::HOLEY_ELEMENTS, context);
     const result: JSArray =
-        AllocateJSArray(HOLEY_ELEMENTS, arrayMap, count, count);
+        AllocateJSArray(ElementsKind::HOLEY_ELEMENTS, arrayMap, count, count);
 
     let indexOut: Smi = 0;
     const resultElements: FixedArray = UnsafeCast<FixedArray>(result.elements);
@@ -63,7 +65,7 @@ namespace array_slice {
     for (let current: Smi = start; current < to; ++current) {
       const e: Object =
           sloppyElements.objects[current + kSloppyArgumentsParameterMapStart];
-      const newElement: JSAny = UnsafeCast<JSAny>(
+      const newElement = UnsafeCast<(JSAny | TheHole)>(
           e != TheHole ? argumentsContext[UnsafeCast<Smi>(e)] :
                          unmappedElements.objects[current]);
       // It is safe to skip the write barrier here because resultElements was
@@ -79,9 +81,9 @@ namespace array_slice {
     const unmappedFrom: Smi = SmiMin(SmiMax(parameterMapLength, start), end);
     const restCount: Smi = end - unmappedFrom;
     CopyElements(
-        PACKED_ELEMENTS, resultElements, Convert<intptr>(indexOut),
-        unmappedElements, Convert<intptr>(unmappedFrom),
-        Convert<intptr>(restCount));
+        ElementsKind::PACKED_ELEMENTS, resultElements,
+        Convert<intptr>(indexOut), unmappedElements,
+        Convert<intptr>(unmappedFrom), Convert<intptr>(restCount));
     return result;
   }
 
@@ -93,36 +95,46 @@ namespace array_slice {
     const count: Smi = Cast<Smi>(countNumber) otherwise Bailout;
     assert(start >= 0);
 
-    typeswitch (o) {
-      case (a: FastJSArrayForCopy): {
-        // It's possible to modify the array length from a valueOf
-        // callback between the original array length read and this
-        // point. That can change the length of the array backing store,
-        // in the worst case, making it smaller than the region that needs
-        // to be copied out. Therefore, re-check the length before calling
-        // the appropriate fast path. See regress-785804.js
-        if (SmiAbove(start + count, a.length)) goto Bailout;
-        return ExtractFastJSArray(context, a, start, count);
-      }
-      case (a: JSArgumentsObjectWithLength): {
-        const map: Map = a.map;
-        if (IsFastAliasedArgumentsMap(map)) {
-          return HandleFastAliasedSloppyArgumentsSlice(context, a, start, count)
-              otherwise Bailout;
-        } else if (IsStrictArgumentsMap(map) || IsSloppyArgumentsMap(map)) {
-          return HandleSimpleArgumentsSlice(context, a, start, count)
-              otherwise Bailout;
+    try {
+      typeswitch (o) {
+        case (a: FastJSArrayForCopy): {
+          // It's possible to modify the array length from a valueOf
+          // callback between the original array length read and this
+          // point. That can change the length of the array backing store,
+          // in the worst case, making it smaller than the region that needs
+          // to be copied out. Therefore, re-check the length before calling
+          // the appropriate fast path. See regress-785804.js
+          if (SmiAbove(start + count, a.length)) goto Bailout;
+          return ExtractFastJSArray(context, a, start, count);
+        }
+        case (a: JSStrictArgumentsObject): {
+          goto HandleSimpleArgumentsSlice(a);
+        }
+        case (a: JSSloppyArgumentsObject): {
+          const map: Map = a.map;
+          if (IsFastAliasedArgumentsMap(map)) {
+            return HandleFastAliasedSloppyArgumentsSlice(
+                context, a, start, count)
+                otherwise Bailout;
+          } else if (IsSloppyArgumentsMap(map)) {
+            goto HandleSimpleArgumentsSlice(a);
+          }
+          goto Bailout;
+        }
+        case (JSAny): {
+          goto Bailout;
         }
       }
-      case (JSAny): {
-      }
     }
-    goto Bailout;
+    label HandleSimpleArgumentsSlice(a: JSArgumentsObjectWithLength) {
+      return HandleSimpleArgumentsSlice(context, a, start, count)
+          otherwise Bailout;
+    }
   }
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.slice
   transitioning javascript builtin
-  ArrayPrototypeSlice(js-implicit context: Context, receiver: JSAny)(
+  ArrayPrototypeSlice(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): JSAny {
     // Handle array cloning case if the receiver is a fast array.
     if (arguments.length == 0) {
@@ -143,7 +155,7 @@ namespace array_slice {
 
     // 3. Let relativeStart be ? ToInteger(start).
     const start: JSAny = arguments[0];
-    const relativeStart: Number = ToInteger_Inline(context, start);
+    const relativeStart: Number = ToInteger_Inline(start);
 
     // 4. If relativeStart < 0, let k be max((len + relativeStart), 0);
     //    else let k be min(relativeStart, len).
@@ -153,8 +165,7 @@ namespace array_slice {
     // 5. If end is undefined, let relativeEnd be len;
     //    else let relativeEnd be ? ToInteger(end).
     const end: JSAny = arguments[1];
-    const relativeEnd: Number =
-        end == Undefined ? len : ToInteger_Inline(context, end);
+    const relativeEnd: Number = end == Undefined ? len : ToInteger_Inline(end);
 
     // 6. If relativeEnd < 0, let final be max((len + relativeEnd), 0);
     //    else let final be min(relativeEnd, len).
@@ -172,7 +183,7 @@ namespace array_slice {
     assert(count <= len);
 
     try {
-      return HandleFastSlice(UnsafeCast<NativeContext>(context), o, k, count)
+      return HandleFastSlice(context, o, k, count)
           otherwise Slow;
     }
     label Slow {}
diff --git a/deps/v8/src/builtins/array-some.tq b/deps/v8/src/builtins/array-some.tq
index 5d93dd0b726017..59b8294f74d17b 100644
--- a/deps/v8/src/builtins/array-some.tq
+++ b/deps/v8/src/builtins/array-some.tq
@@ -5,7 +5,7 @@
 namespace array {
   transitioning javascript builtin
   ArraySomeLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized some implementation are
     // after the ToObject(O) call that ensures we are dealing with a
@@ -26,7 +26,7 @@ namespace array {
 
   transitioning javascript builtin
   ArraySomeLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: JSAny)(
+      js-implicit context: NativeContext, receiver: JSAny)(
       callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
       result: JSAny): JSAny {
     // All continuation points in the optimized some implementation are
@@ -110,7 +110,7 @@ namespace array {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.some
   transitioning javascript builtin
-  ArraySome(js-implicit context: Context, receiver: JSAny)(...arguments):
+  ArraySome(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
       JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.some');
@@ -141,7 +141,7 @@ namespace array {
       }
     }
     label TypeError deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
   }
 }
diff --git a/deps/v8/src/builtins/array-splice.tq b/deps/v8/src/builtins/array-splice.tq
index 04885dbb9c481a..9d7a223d97411c 100644
--- a/deps/v8/src/builtins/array-splice.tq
+++ b/deps/v8/src/builtins/array-splice.tq
@@ -2,33 +2,34 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_splice {
+namespace array {
   // Given {elements}, we want to create a non-zero length array of type
   // FixedArrayType. Most of this behavior is outsourced to ExtractFixedArray(),
   // but the special case of wanting to have a FixedDoubleArray when given a
   // zero-length input FixedArray is handled here.
-  macro Extract<FixedArrayType: type>(
-      elements: FixedArrayBase, first: Smi, count: Smi,
-      capacity: Smi): FixedArrayType;
-
-  Extract<FixedArray>(implicit context: Context)(
-      elements: FixedArrayBase, first: Smi, count: Smi,
-      capacity: Smi): FixedArray {
-    return UnsafeCast<FixedArray>(
-        ExtractFixedArray(elements, first, count, capacity));
+  macro Extract(implicit context: Context)(
+      elements: FixedArray, first: Smi, count: Smi, capacity: Smi): FixedArray {
+    return ExtractFixedArray(
+        elements, Convert<intptr>(first), Convert<intptr>(count),
+        Convert<intptr>(capacity));
   }
 
-  Extract<FixedDoubleArray>(implicit context: Context)(
-      elements: FixedArrayBase, first: Smi, count: Smi,
-      capacity: Smi): FixedDoubleArray {
-    if (elements == kEmptyFixedArray) {
-      return AllocateZeroedFixedDoubleArray(Convert<intptr>(capacity));
+  macro Extract(implicit context: Context)(
+      elements: FixedDoubleArray|EmptyFixedArray, first: Smi, count: Smi,
+      capacity: Smi): FixedDoubleArray|EmptyFixedArray {
+    typeswitch (elements) {
+      case (EmptyFixedArray): {
+        return AllocateZeroedFixedDoubleArray(Convert<intptr>(capacity));
+      }
+      case (elements: FixedDoubleArray): {
+        return ExtractFixedDoubleArray(
+            elements, Convert<intptr>(first), Convert<intptr>(count),
+            Convert<intptr>(capacity));
+      }
     }
-    return UnsafeCast<FixedDoubleArray>(
-        ExtractFixedArray(elements, first, count, capacity));
   }
 
-  macro DoMoveElements<FixedArrayType: type>(
+  macro DoMoveElements<FixedArrayType : type extends FixedArrayBase>(
       elements: FixedArrayType, dstIndex: Smi, srcIndex: Smi,
       count: Smi): void {
     TorqueMoveElements(
@@ -36,14 +37,14 @@ namespace array_splice {
         Convert<intptr>(count));
   }
 
-  macro StoreHoles<FixedArrayType: type>(
+  macro StoreHoles<FixedArrayType : type extends FixedArrayBase>(
       elements: FixedArrayType, holeStartIndex: Smi, holeEndIndex: Smi): void {
     for (let i: Smi = holeStartIndex; i < holeEndIndex; i++) {
       array::StoreArrayHole(elements, i);
     }
   }
 
-  macro DoCopyElements<FixedArrayType: type>(
+  macro DoCopyElements<FixedArrayType : type extends FixedArrayBase>(
       dstElements: FixedArrayType, dstIndex: Smi, srcElements: FixedArrayType,
       srcIndex: Smi, count: Smi): void {
     TorqueCopyElements(
@@ -51,37 +52,38 @@ namespace array_splice {
         Convert<intptr>(srcIndex), Convert<intptr>(count));
   }
 
-  macro FastSplice<FixedArrayType: type, ElementType: type>(implicit context:
-                                                                  Context)(
+  macro
+  FastSplice<FixedArrayType : type extends FixedArrayBase, ElementType: type>(
+      implicit context: Context)(
       args: Arguments, a: JSArray, length: Smi, newLength: Smi,
       actualStart: Smi, insertCount: Smi, actualDeleteCount: Smi): void {
     // Make sure elements are writable.
     array::EnsureWriteableFastElements(a);
 
     if (insertCount != actualDeleteCount) {
-      const elements: FixedArrayBase = a.elements;
+      const elements =
+          UnsafeCast<(FixedArrayType | EmptyFixedArray)>(a.elements);
       const dstIndex: Smi = actualStart + insertCount;
       const srcIndex: Smi = actualStart + actualDeleteCount;
       const count: Smi = length - actualDeleteCount - actualStart;
       if (insertCount < actualDeleteCount) {
         // Shrink.
-        DoMoveElements<FixedArrayType>(
+        DoMoveElements(
             UnsafeCast<FixedArrayType>(elements), dstIndex, srcIndex, count);
-        StoreHoles<FixedArrayType>(
-            UnsafeCast<FixedArrayType>(elements), newLength, length);
+        StoreHoles(UnsafeCast<FixedArrayType>(elements), newLength, length);
       } else if (insertCount > actualDeleteCount) {
         // If the backing store is big enough, then moving elements is enough.
         if (newLength <= elements.length) {
-          DoMoveElements<FixedArrayType>(
+          DoMoveElements(
               UnsafeCast<FixedArrayType>(elements), dstIndex, srcIndex, count);
         } else {
           // Grow.
           const capacity: Smi = CalculateNewElementsCapacity(newLength);
-          const newElements: FixedArrayType =
-              Extract<FixedArrayType>(elements, 0, actualStart, capacity);
+          const newElements: FixedArrayType = UnsafeCast<FixedArrayType>(
+              Extract(elements, 0, actualStart, capacity));
           a.elements = newElements;
           if (elements.length > 0) {
-            DoCopyElements<FixedArrayType>(
+            DoCopyElements(
                 newElements, dstIndex, UnsafeCast<FixedArrayType>(elements),
                 srcIndex, count);
           }
@@ -239,7 +241,7 @@ namespace array_splice {
         // v. Else fromPresent is false,
       } else {
         // 1. Perform ? DeletePropertyOrThrow(O, to).
-        DeleteProperty(o, to, kStrict);
+        DeleteProperty(o, to, LanguageMode::kStrict);
       }
       // vi. Increase k by 1.
       k++;
@@ -251,7 +253,7 @@ namespace array_splice {
     // d. Repeat, while k > (len - actualDeleteCount + itemCount)
     while (k > (len - actualDeleteCount + itemCount)) {
       // i. Perform ? DeletePropertyOrThrow(O, ! ToString(k - 1)).
-      DeleteProperty(o, k - 1, kStrict);
+      DeleteProperty(o, k - 1, LanguageMode::kStrict);
       // ii. Decrease k by 1.
       k--;
     }
@@ -288,7 +290,7 @@ namespace array_splice {
         // v. Else fromPresent is false,
       } else {
         // 1. Perform ? DeletePropertyOrThrow(O, to).
-        DeleteProperty(o, to, kStrict);
+        DeleteProperty(o, to, LanguageMode::kStrict);
       }
 
       // vi. Decrease k by 1.
@@ -349,7 +351,7 @@ namespace array_splice {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.splice
   transitioning javascript builtin
-  ArrayPrototypeSplice(js-implicit context: Context, receiver: JSAny)(
+  ArrayPrototypeSplice(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): JSAny {
     // 1. Let O be ? ToObject(this value).
     const o: JSReceiver = ToObject(context, receiver);
@@ -359,7 +361,7 @@ namespace array_splice {
 
     // 3. Let relativeStart be ? ToInteger(start).
     const start: JSAny = arguments[0];
-    const relativeStart: Number = ToInteger_Inline(context, start);
+    const relativeStart: Number = ToInteger_Inline(start);
 
     // 4. If relativeStart < 0, let actualStart be max((len + relativeStart),
     // 0);
@@ -388,7 +390,7 @@ namespace array_splice {
       insertCount = Convert<Smi>(arguments.length) - 2;
       // b. Let dc be ? ToInteger(deleteCount).
       const deleteCount: JSAny = arguments[1];
-      const dc: Number = ToInteger_Inline(context, deleteCount);
+      const dc: Number = ToInteger_Inline(deleteCount);
       // c. Let actualDeleteCount be min(max(dc, 0), len - actualStart).
       actualDeleteCount = Min(Max(dc, 0), len - actualStart);
     }
@@ -397,7 +399,7 @@ namespace array_splice {
     //    Bailout exception.
     const newLength: Number = len + insertCount - actualDeleteCount;
     if (newLength > kMaxSafeInteger) {
-      ThrowTypeError(kInvalidArrayLength, start);
+      ThrowTypeError(MessageTemplate::kInvalidArrayLength, start);
     }
 
     try {
diff --git a/deps/v8/src/builtins/array-unshift.tq b/deps/v8/src/builtins/array-unshift.tq
index 422eee158de535..3b66015d3b32fd 100644
--- a/deps/v8/src/builtins/array-unshift.tq
+++ b/deps/v8/src/builtins/array-unshift.tq
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace array_unshift {
+namespace array {
   extern builtin ArrayUnshift(Context, JSFunction, JSAny, int32): JSAny;
 
   transitioning macro GenericArrayUnshift(
@@ -20,7 +20,7 @@ namespace array_unshift {
     if (argCount > 0) {
       // a. If len + argCount > 2**53 - 1, throw a TypeError exception.
       if (length + argCount > kMaxSafeInteger) {
-        ThrowTypeError(kInvalidArrayLength);
+        ThrowTypeError(MessageTemplate::kInvalidArrayLength);
       }
 
       // b. Let k be len.
@@ -46,7 +46,7 @@ namespace array_unshift {
           SetProperty(object, to, fromValue);
         } else {
           // 1. Perform ? DeletePropertyOrThrow(O, to).
-          DeleteProperty(object, to, kStrict);
+          DeleteProperty(object, to, LanguageMode::kStrict);
         }
 
         // vi. Decrease k by 1.
@@ -78,7 +78,8 @@ namespace array_unshift {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.unshift
   transitioning javascript builtin ArrayPrototypeUnshift(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     try {
       const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
       array::EnsureWriteableFastElements(array);
diff --git a/deps/v8/src/builtins/array.tq b/deps/v8/src/builtins/array.tq
index b9ae314c08a297..a5ffcfe40e90a9 100644
--- a/deps/v8/src/builtins/array.tq
+++ b/deps/v8/src/builtins/array.tq
@@ -8,13 +8,13 @@ namespace array {
   // Naming convention from elements.cc. We have a similar intent but implement
   // fastpaths using generics instead of using a class hierarchy for elements
   // kinds specific implementations.
-  type GenericElementsAccessor;
-  type FastPackedSmiElements;
-  type FastPackedObjectElements;
-  type FastPackedDoubleElements;
-  type FastSmiOrObjectElements;
-  type FastDoubleElements;
-  type DictionaryElements;
+  type GenericElementsAccessor extends ElementsKind;
+  type FastPackedSmiElements extends ElementsKind;
+  type FastPackedObjectElements extends ElementsKind;
+  type FastPackedDoubleElements extends ElementsKind;
+  type FastSmiOrObjectElements extends ElementsKind;
+  type FastDoubleElements extends ElementsKind;
+  type DictionaryElements extends ElementsKind;
 
   macro EnsureWriteableFastElements(implicit context: Context)(array: JSArray) {
     assert(IsFastElementsKind(array.map.elements_kind));
@@ -26,9 +26,10 @@ namespace array {
     // extract FixedArrays and don't have to worry about FixedDoubleArrays.
     assert(IsFastSmiOrTaggedElementsKind(array.map.elements_kind));
 
-    const length: Smi = Cast<Smi>(array.length) otherwise unreachable;
+    const length =
+        Convert<intptr>(Cast<Smi>(array.length) otherwise unreachable);
     array.elements =
-        ExtractFixedArray(elements, 0, length, length, kFixedArrays);
+        ExtractFixedArray(UnsafeCast<FixedArray>(elements), 0, length, length);
     assert(array.elements.map != kCOWMap);
   }
 
@@ -39,12 +40,12 @@ namespace array {
   }
 
   macro LoadElementOrUndefined(a: FixedDoubleArray, i: Smi): NumberOrUndefined {
-    const f: float64 = LoadDoubleWithHoleCheck(a, i) otherwise return Undefined;
+    const f: float64 = a.floats[i].Value() otherwise return Undefined;
     return AllocateHeapNumberWithValue(f);
   }
 
   macro StoreArrayHole(elements: FixedDoubleArray, k: Smi): void {
-    StoreFixedDoubleArrayHoleSmi(elements, k);
+    elements.floats[k] = kDoubleHole;
   }
 
   macro StoreArrayHole(elements: FixedArray, k: Smi): void {
@@ -52,4 +53,30 @@ namespace array {
   }
 
   extern macro SetPropertyLength(implicit context: Context)(JSAny, Number);
+
+  const kLengthDescriptorIndex:
+      constexpr int31 generates 'JSArray::kLengthDescriptorIndex';
+  const kAttributesReadOnlyMask: constexpr int31
+  generates 'PropertyDetails::kAttributesReadOnlyMask';
+
+  @export
+  macro EnsureArrayLengthWritable(implicit context: Context)(map: Map):
+      void labels Bailout {
+    // Don't support arrays in dictionary named property mode.
+    if (IsDictionaryMap(map)) {
+      goto Bailout;
+    }
+
+    // Check whether the length property is writable. The length property is the
+    // only default named property on arrays. It's nonconfigurable, hence is
+    // guaranteed to stay the first property.
+    const descriptors: DescriptorArray = map.instance_descriptors;
+    const descriptor:&DescriptorEntry =
+        & descriptors.descriptors[kLengthDescriptorIndex];
+    assert(TaggedEqual(descriptor->key, LengthStringConstant()));
+    const details: Smi = UnsafeCast<Smi>(descriptor->details);
+    if ((details & kAttributesReadOnlyMask) != 0) {
+      goto Bailout;
+    }
+  }
 }
diff --git a/deps/v8/src/builtins/base.tq b/deps/v8/src/builtins/base.tq
index 065cd08e4c3bda..3aa75c7413b88b 100644
--- a/deps/v8/src/builtins/base.tq
+++ b/deps/v8/src/builtins/base.tq
@@ -1,6 +1,6 @@
 // Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
+// Use of this source code is governed by a BSD-style license that can be:
+// Context found in the LICENSE file.
 
 #include 'src/builtins/builtins-regexp-gen.h'
 #include 'src/builtins/builtins-utils-gen.h'
@@ -20,12 +20,22 @@
 #include 'src/objects/stack-frame-info.h'
 #include 'src/objects/synthetic-module.h'
 #include 'src/objects/template-objects.h'
+#include 'src/torque/runtime-support.h'
 
 type void;
 type never;
 
-type Tagged generates 'TNode<Object>' constexpr 'ObjectPtr';
-type Smi extends Tagged generates 'TNode<Smi>' constexpr 'Smi';
+type Tagged generates 'TNode<MaybeObject>' constexpr 'MaybeObject';
+type StrongTagged extends Tagged
+    generates 'TNode<Object>' constexpr 'ObjectPtr';
+type Smi extends StrongTagged generates 'TNode<Smi>' constexpr 'Smi';
+// A possibly cleared weak pointer with a bit pattern that distinguishes it from
+// strong HeapObject pointers and Smi values.
+type WeakHeapObject extends Tagged;
+type Weak<T : type extends HeapObject> extends WeakHeapObject;
+
+type Object = Smi|HeapObject;
+type MaybeObject = Smi|HeapObject|WeakHeapObject;
 
 // A Smi that is greater than or equal to 0. See TaggedIsPositiveSmi.
 type PositiveSmi extends Smi;
@@ -36,16 +46,22 @@ type Zero extends PositiveSmi;
 // A value with the size of Tagged which may contain arbitrary data.
 type Uninitialized extends Tagged;
 
-@abstract
-extern class HeapObject extends Tagged {
-  map: Map;
-}
+extern macro MakeWeak(HeapObject): WeakHeapObject;
+extern macro GetHeapObjectAssumeWeak(WeakHeapObject):
+    HeapObject labels ClearedWeakPointer;
+extern macro IsWeakOrCleared(MaybeObject): bool;
 
-type Object = Smi | HeapObject;
+macro StrongToWeak<T: type>(x: T): Weak<T> {
+  return %RawDownCast<Weak<T>>(MakeWeak(x));
+}
+macro WeakToStrong<T: type>(x: Weak<T>): T labels ClearedWeakPointer {
+  const x = GetHeapObjectAssumeWeak(x) otherwise ClearedWeakPointer;
+  return %RawDownCast<T>(x);
+}
 
 // Defined to coincide with https://tc39.es/ecma262/#sec-ispropertykey
 // Doesn't include PrivateSymbol.
-type PropertyKey = String | PublicSymbol;
+type PropertyKey = String|PublicSymbol;
 
 // TODO(tebbi): PrivateSymbol is only exposed to JavaScript through the debugger
 // API. We should reconsider this and try not to expose it at all. Then JSAny
@@ -53,18 +69,16 @@ type PropertyKey = String | PublicSymbol;
 
 // A JavaScript primitive value as defined in
 // https://tc39.es/ecma262/#sec-primitive-value.
-type JSPrimitive = Numeric | String | Symbol | Boolean |
-    Null | Undefined;
+type JSPrimitive = Numeric|String|Symbol|Boolean|Null|Undefined;
 
 // A user-exposed JavaScript value, as opposed to V8-internal values like
 // TheHole or FixedArray.
-type JSAny = JSReceiver | JSPrimitive;
+type JSAny = JSReceiver|JSPrimitive;
 
-type JSAnyNotNumber = BigInt | String | Symbol | Boolean |
-    Null | Undefined | JSReceiver;
+type JSAnyNotNumber = BigInt|String|Symbol|Boolean|Null|Undefined|JSReceiver;
 
 // This is the intersection of JSAny and HeapObject.
-type JSAnyNotSmi = JSAnyNotNumber | HeapNumber;
+type JSAnyNotSmi = JSAnyNotNumber|HeapNumber;
 
 type int32 generates 'TNode<Int32T>' constexpr 'int32_t';
 type uint32 generates 'TNode<Uint32T>' constexpr 'uint32_t';
@@ -90,10 +104,30 @@ type bool generates 'TNode<BoolT>' constexpr 'bool';
 type bint generates 'TNode<BInt>' constexpr 'BInt';
 type string constexpr 'const char*';
 
+// WARNING: The memory representation (i.e., in class fields and arrays) of
+// float64_or_hole is just a float64 that may be the hole-representing
+// signalling NaN bit-pattern. So it's memory size is that of float64 and
+// loading and storing float64_or_hole emits special code.
+struct float64_or_hole {
+  macro Value(): float64 labels IfHole {
+    if (this.is_hole) {
+      goto IfHole;
+    }
+    return this.value;
+  }
+  macro ValueUnsafeAssumeNotHole(): float64 {
+    assert(!this.is_hole);
+    return this.value;
+  }
+
+  is_hole: bool;
+  value: float64;
+}
+const kDoubleHole: float64_or_hole = float64_or_hole{is_hole: true, value: 0};
+
 // The HashTable inheritance hierarchy doesn't actually look like this in C++
 // because it uses some class templates that we can't yet (and may never)
 // express in Torque, but this is the expected organization of instance types.
-@abstract @dirtyInstantiatedAbstractClass
 extern class HashTable extends FixedArray generates 'TNode<FixedArray>';
 extern class OrderedHashMap extends HashTable;
 extern class OrderedHashSet extends HashTable;
@@ -111,173 +145,8 @@ type RawPtr generates 'TNode<RawPtrT>' constexpr 'void*';
 extern class Code extends HeapObject;
 type BuiltinPtr extends Smi generates 'TNode<BuiltinPtr>';
 
-@abstract
-extern class Context extends HeapObject {
-  length: Smi;
-  scope_info: ScopeInfo;
-  previous: Object;
-  extension: Object;
-  native_context: Object;
-}
-extern class AwaitContext extends Context generates 'TNode<Context>';
-extern class BlockContext extends Context generates 'TNode<Context>';
-extern class CatchContext extends Context generates 'TNode<Context>';
-extern class DebugEvaluateContext extends Context
-    generates 'TNode<Context>';
-extern class EvalContext extends Context generates 'TNode<Context>';
-extern class FunctionContext extends Context generates 'TNode<Context>';
-extern class ModuleContext extends Context generates 'TNode<Context>';
-extern class NativeContext extends Context;
-extern class ScriptContext extends Context generates 'TNode<Context>';
-extern class WithContext extends Context generates 'TNode<Context>';
-
-@generateCppClass
-@abstract
-extern class PrimitiveHeapObject extends HeapObject {
-}
-
-@generateCppClass
-@apiExposedInstanceTypeValue(0x43)
-@highestInstanceTypeWithinParentClassRange
-extern class Oddball extends PrimitiveHeapObject {
-  to_number_raw: float64;
-  to_string: String;
-  to_number: Number;
-  type_of: String;
-  kind: Smi;
-}
-
-extern class HeapNumber extends PrimitiveHeapObject { value: float64; }
-type Number = Smi | HeapNumber;
-type Numeric = Number | BigInt;
-
-@abstract
-@generateCppClass
-extern class Name extends PrimitiveHeapObject {
-  hash_field: uint32;
-}
-// This is the same as Name, but with the information that there are no other
-// kinds of names.
-type AnyName = PrivateSymbol | PublicSymbol | String;
-
-@generateCppClass
-extern class Symbol extends Name {
-  flags: int32;
-  name: Object;  // The print name of a symbol, or undefined if none.
-}
-
-type PublicSymbol extends Symbol;
-type PrivateSymbol extends Symbol;
-
-@abstract
-@generateCppClass
-@reserveBitsInInstanceType(6)
-extern class String extends Name {
-  length: int32;
-}
-
-@generateCppClass
-extern class ConsString extends String {
-  first: String;
-  second: String;
-}
-
-@abstract
-extern class ExternalString extends String {
-  resource: RawPtr;
-  resource_data: RawPtr;
-}
-
-extern class ExternalOneByteString extends ExternalString {}
-extern class ExternalTwoByteString extends ExternalString {}
-
-@generateCppClass
-extern class InternalizedString extends String {
-}
-
-// TODO(v8:8983): Add declaration for variable-sized region.
-@abstract
-@generateCppClass
-extern class SeqString extends String {
-}
-@generateCppClass
-extern class SeqOneByteString extends SeqString {
-  chars[length]: char8;
-}
-@generateCppClass
-extern class SeqTwoByteString extends SeqString {
-  chars[length]: char16;
-}
-
-@generateCppClass
-extern class SlicedString extends String {
-  parent: String;
-  offset: Smi;
-}
-
-@generateCppClass
-extern class ThinString extends String {
-  actual: String;
-}
-
-// The HeapNumber value NaN
-type NaN extends HeapNumber;
-
-@abstract
-@generatePrint
-@generateCppClass
-extern class Struct extends HeapObject {
-}
-
-@abstract
-@dirtyInstantiatedAbstractClass
-@generatePrint
-@generateCppClass
-extern class Tuple2 extends Struct {
-  value1: Object;
-  value2: Object;
-}
-
-@abstract
-@dirtyInstantiatedAbstractClass
-@generatePrint
-@generateCppClass
-extern class Tuple3 extends Tuple2 {
-  value3: Object;
-}
-
-// A direct string can be accessed directly through CSA without going into the
-// C++ runtime. See also: ToDirectStringAssembler.
-type DirectString extends String;
-
-type RootIndex generates 'TNode<Int32T>' constexpr 'RootIndex';
-
-@abstract
-extern class FixedArrayBase extends HeapObject {
-  length: Smi;
-}
-
-@abstract
-@dirtyInstantiatedAbstractClass
-extern class FixedArray extends FixedArrayBase {
-  objects[length]: Object;
-}
-
-extern class FixedDoubleArray extends FixedArrayBase {
-  floats[length]: float64;
-}
-
-@abstract
-@dirtyInstantiatedAbstractClass
-extern class WeakFixedArray extends HeapObject {
-  length: Smi;
-}
-
-extern class ByteArray extends FixedArrayBase {}
-
-@hasSameInstanceTypeAsParent
-extern class ArrayList extends FixedArray {
-}
+type Number = Smi|HeapNumber;
+type Numeric = Number|BigInt;
 
 extern class ObjectBoilerplateDescription extends FixedArray;
 extern class ClosureFeedbackCellArray extends FixedArray;
@@ -289,536 +158,8 @@ extern class TransitionArray extends WeakFixedArray;
 
 type InstanceType extends uint16 constexpr 'v8::internal::InstanceType';
 
-extern class Map extends HeapObject {
-  instance_size_in_words: uint8;
-  in_object_properties_start_or_constructor_function_index: uint8;
-  used_or_unused_instance_size_in_words: uint8;
-  visitor_id: uint8;
-  instance_type: InstanceType;
-  bit_field: uint8;
-  bit_field2: uint8;
-  bit_field3: uint32;
-
-  @if(TAGGED_SIZE_8_BYTES) optional_padding: uint32;
-  @ifnot(TAGGED_SIZE_8_BYTES) optional_padding: void;
-
-  prototype: HeapObject;
-  constructor_or_back_pointer: Object;
-  instance_descriptors: DescriptorArray;
-  @if(V8_DOUBLE_FIELDS_UNBOXING) layout_descriptor: LayoutDescriptor;
-  @ifnot(V8_DOUBLE_FIELDS_UNBOXING) layout_descriptor: void;
-  dependent_code: DependentCode;
-  prototype_validity_cell: Smi | Cell;
-  // TODO(v8:9108): Misusing "weak" keyword; type should be
-  //     Map | Weak<Map> | TransitionArray | PrototypeInfo | Smi.
-  weak transitions_or_prototype_info: Map | TransitionArray |
-      PrototypeInfo | Smi;
-}
-
-@generatePrint
-@generateCppClass
-extern class EnumCache extends Struct {
-  keys: FixedArray;
-  indices: FixedArray;
-}
-
-@generatePrint
-@generateCppClass
-extern class SourcePositionTableWithFrameCache extends Struct {
-  source_position_table: ByteArray;
-  stack_frame_cache: Object;
-}
-
-// We make this class abstract because it is missing the variable-sized part,
-// which is still impossible to express in Torque.
-@abstract
-@dirtyInstantiatedAbstractClass
-extern class DescriptorArray extends HeapObject {
-  number_of_all_descriptors: uint16;
-  number_of_descriptors: uint16;
-  raw_number_of_marked_descriptors: uint16;
-  filler16_bits: uint16;
-  enum_cache: EnumCache;
-  // DescriptorEntry needs to be a struct with three fields.
-  // desriptors : DescriptorEntry[number_of_all_descriptors]
-}
-
-// These intrinsics should never be called from Torque code. They're used
-// internally by the 'new' operator and only declared here because it's simpler
-// than building the definition from C++.
-intrinsic %GetAllocationBaseSize<Class: type>(map: Map): intptr;
-intrinsic %Allocate<Class: type>(size: intptr): Class;
-intrinsic %GetStructMap(instanceKind: constexpr InstanceType): Map;
-
-intrinsic %AddIndexedFieldSizeToObjectSize<T: type>(
-    baseSize: intptr, indexSize: T, fieldSize: int32): intptr {
-  const convertedIndexSize = Convert<int32>(indexSize);
-  const variableSize: int32 =
-      TryInt32Mul(convertedIndexSize, fieldSize) otherwise unreachable;
-  const convertedVariableSize = Convert<intptr>(variableSize);
-  return TryIntPtrAdd(baseSize, convertedVariableSize) otherwise unreachable;
-}
-
-intrinsic
-%InitializeFieldsFromIterator<Container: type, Index: type, Iterator: type>(
-    c: Container, length: Index, i: Iterator) {
-  try {
-    let mutableIterator = i;
-    let current: Index = 0;
-    while (current < length) {
-      // TODO(danno): The indexed accessor on the container requires that the
-      // '[]=' operator be defined explicitly for the Container
-      // (e.g. FixedArray). We should change this to use slice references
-      // once they are implemented.
-      c[current++] = mutableIterator.Next() otherwise NoMore;
-    }
-  }
-  label NoMore deferred {
-    unreachable;
-  }
-}
-
-// JSReceiver corresponds to objects in the JS sense.
-@abstract
-@highestInstanceTypeWithinParentClassRange
-extern class JSReceiver extends HeapObject {
-  properties_or_hash: FixedArrayBase | PropertyArray | Smi;
-}
-
-type Constructor extends JSReceiver;
-
-@abstract
-@dirtyInstantiatedAbstractClass
-@generateCppClass
-@apiExposedInstanceTypeValue(0x421)
-@highestInstanceTypeWithinParentClassRange
-extern class JSObject extends JSReceiver {
-  // [elements]: The elements (properties with names that are integers).
-  //
-  // Elements can be in two general modes: fast and slow. Each mode
-  // corresponds to a set of object representations of elements that
-  // have something in common.
-  //
-  // In the fast mode elements is a FixedArray and so each element can be
-  // quickly accessed. The elements array can have one of several maps in this
-  // mode: fixed_array_map, fixed_double_array_map,
-  // sloppy_arguments_elements_map or fixed_cow_array_map (for copy-on-write
-  // arrays). In the latter case the elements array may be shared by a few
-  // objects and so before writing to any element the array must be copied. Use
-  // EnsureWritableFastElements in this case.
-  //
-  // In the slow mode the elements is either a NumberDictionary or a
-  // FixedArray parameter map for a (sloppy) arguments object.
-  elements: FixedArrayBase;
-}
-
-macro NewJSObject(implicit context: Context)(): JSObject {
-  const objectFunction: JSFunction = GetObjectFunction();
-  const map: Map = Cast<Map>(objectFunction.prototype_or_initial_map)
-      otherwise unreachable;
-  return new JSObject{
-    map,
-    properties_or_hash: kEmptyFixedArray,
-    elements: kEmptyFixedArray
-  };
-}
-
-@abstract
-@generateCppClass
-@lowestInstanceTypeWithinParentClassRange
-extern class JSCustomElementsObject extends JSObject {
-}
-
-@abstract
-@generateCppClass
-@lowestInstanceTypeWithinParentClassRange
-extern class JSSpecialObject extends JSCustomElementsObject {
-}
-
-extern macro HasPrototypeSlot(JSFunction): bool;
-
-macro GetDerivedMap(implicit context: Context)(
-    target: JSFunction, newTarget: JSReceiver): Map {
-  try {
-    const constructor = Cast<JSFunction>(newTarget) otherwise SlowPath;
-    if (!HasPrototypeSlot(constructor)) {
-      goto SlowPath;
-    }
-    assert(IsConstructor(constructor));
-    const map =
-        Cast<Map>(constructor.prototype_or_initial_map) otherwise SlowPath;
-    if (LoadConstructorOrBackPointer(map) != target) {
-      goto SlowPath;
-    }
-
-    return map;
-  }
-  label SlowPath {
-    return runtime::GetDerivedMap(context, target, newTarget);
-  }
-}
-
-macro AllocateFastOrSlowJSObjectFromMap(implicit context: Context)(map: Map):
-    JSObject {
-  let properties = kEmptyFixedArray;
-  if (IsDictionaryMap(map)) {
-    properties = AllocateNameDictionary(kNameDictionaryInitialCapacity);
-  }
-  return AllocateJSObjectFromMap(
-      map, properties, kEmptyFixedArray, kNone, kWithSlackTracking);
-}
-
-@highestInstanceTypeWithinParentClassRange
-extern class JSFunction extends JSFunctionOrBoundFunction {
-  shared_function_info: SharedFunctionInfo;
-  context: Context;
-  feedback_cell: FeedbackCell;
-  weak code: Code;
-
-  // Space for the following field may or may not be allocated.
-  @noVerifier weak prototype_or_initial_map: JSReceiver | Map;
-}
-
-@generateCppClass
-extern class JSProxy extends JSReceiver {
-  target: JSReceiver | Null;
-  handler: JSReceiver | Null;
-}
-
-// Just a starting shape for JSObject; properties can move after initialization.
-@noVerifier
-@hasSameInstanceTypeAsParent
-extern class JSProxyRevocableResult extends JSObject {
-  proxy: JSAny;
-  revoke: JSAny;
-}
-
-macro NewJSProxyRevocableResult(implicit context: Context)(
-    proxy: JSProxy, revoke: JSFunction): JSProxyRevocableResult {
-  return new JSProxyRevocableResult{
-    map: GetProxyRevocableResultMap(),
-    properties_or_hash: kEmptyFixedArray,
-    elements: kEmptyFixedArray,
-    proxy,
-    revoke
-  };
-}
-
-@generateCppClass
-extern class JSGlobalProxy extends JSSpecialObject {
-  // [native_context]: the owner native context of this global proxy object.
-  // It is null value if this object is not used by any context.
-  native_context: Object;
-}
-
-@generateCppClass
-extern class JSPrimitiveWrapper extends JSCustomElementsObject {
-  value: JSAny;
-}
-
-@generateCppClass
-extern class JSArgumentsObject extends JSObject {
-}
-
-// Just a starting shape for JSObject; properties can move after initialization.
-@noVerifier
-@hasSameInstanceTypeAsParent
-extern class JSArgumentsObjectWithLength extends JSArgumentsObject {
-  length: JSAny;
-}
-
-// Just a starting shape for JSObject; properties can move after initialization.
-@hasSameInstanceTypeAsParent
-extern class JSSloppyArgumentsObject extends JSArgumentsObjectWithLength {
-  callee: JSAny;
-}
-
-// Just a starting shape for JSObject; properties can move after initialization.
-@hasSameInstanceTypeAsParent
-@noVerifier
-extern class JSStrictArgumentsObject extends JSArgumentsObjectWithLength {
-}
-
-extern class JSArrayIterator extends JSObject {
-  iterated_object: JSReceiver;
-  next_index: Number;
-  kind: Smi;
-}
-
-extern class JSArray extends JSObject {
-  IsEmpty(): bool {
-    return this.length == 0;
-  }
-  length: Number;
-}
-
-macro NewJSArray(implicit context: Context)(
-    map: Map, elements: FixedArrayBase): JSArray {
-  return new JSArray{
-    map,
-    properties_or_hash: kEmptyFixedArray,
-    elements,
-    length: elements.length
-  };
-}
-
-macro NewJSArray(implicit context: Context)(): JSArray {
-  return new JSArray{
-    map: GetFastPackedSmiElementsJSArrayMap(),
-    properties_or_hash: kEmptyFixedArray,
-    elements: kEmptyFixedArray,
-    length: 0
-  };
-}
-
-// A HeapObject with a JSArray map, and either fast packed elements, or fast
-// holey elements when the global NoElementsProtector is not invalidated.
-transient type FastJSArray extends JSArray;
-
-// A HeapObject with a JSArray map, and either fast packed elements, or fast
-// holey elements or frozen, sealed elements when the global NoElementsProtector
-// is not invalidated.
-transient type FastJSArrayForRead extends JSArray;
-
-// A FastJSArray when the global ArraySpeciesProtector is not invalidated.
-transient type FastJSArrayForCopy extends FastJSArray;
-
-// A FastJSArray when the global ArrayIteratorProtector is not invalidated.
-transient type FastJSArrayWithNoCustomIteration extends FastJSArray;
-
-// A FastJSArrayForRead when the global ArrayIteratorProtector is not
-// invalidated.
-transient type FastJSArrayForReadWithNoCustomIteration extends
-    FastJSArrayForRead;
-
 type NoSharedNameSentinel extends Smi;
 
-@generateCppClass
-extern class CallHandlerInfo extends Struct {
-  callback: NonNullForeign | Undefined | Zero;
-  js_callback: NonNullForeign | Undefined | Zero;
-  data: Object;
-}
-
-@abstract
-extern class Module extends HeapObject {
-  exports: ObjectHashTable;
-  hash: Smi;
-  status: Smi;
-  module_namespace: JSModuleNamespace | Undefined;
-  exception: Object;
-}
-
-type SourceTextModuleInfo extends FixedArray;
-
-@generateCppClass
-extern class SourceTextModule extends Module {
-  // The code representing this module, or an abstraction thereof.
-  code: SharedFunctionInfo | JSFunction |
-      JSGeneratorObject | SourceTextModuleInfo;
-
-  // Arrays of cells corresponding to regular exports and regular imports.
-  // A cell's position in the array is determined by the cell index of the
-  // associated module entry (which coincides with the variable index of the
-  // associated variable).
-  regular_exports: FixedArray;
-  regular_imports: FixedArray;
-
-  // Modules imported or re-exported by this module.
-  // Corresponds 1-to-1 to the module specifier strings in
-  // SourceTextModuleInfo::module_requests.
-  requested_modules: FixedArray;
-
-  // Script from which the module originates.
-  script: Script;
-
-  // The value of import.meta inside of this module.
-  // Lazily initialized on first access. It's the hole before first access and
-  // a JSObject afterwards.
-  import_meta: TheHole | JSObject;
-  async_parent_modules: ArrayList;
-  top_level_capability: JSPromise | Undefined;
-  dfs_index: Smi;
-  dfs_ancestor_index: Smi;
-  pending_async_dependencies: Smi;
-  flags: Smi;
-}
-
-@generateCppClass
-extern class SyntheticModule extends Module {
-  name: String;
-  export_names: FixedArray;
-  evaluation_steps: Foreign;
-}
-
-@abstract
-@generateCppClass
-@dirtyInstantiatedAbstractClass
-extern class JSModuleNamespace extends JSSpecialObject {
-  module: Module;
-}
-
-@hasSameInstanceTypeAsParent
-@noVerifier
-extern class TemplateList extends FixedArray {
-}
-
-@abstract
-@generateCppClass
-extern class JSWeakCollection extends JSObject {
-  // The backing hash table mapping keys to values.
-  table: Object;
-}
-@generateCppClass
-extern class JSWeakSet extends JSWeakCollection {
-}
-@generateCppClass
-extern class JSWeakMap extends JSWeakCollection {
-}
-
-@generateCppClass
-@abstract
-extern class JSCollectionIterator extends JSObject {
-  // The backing hash table mapping keys to values.
-  table: Object;
-  // The index into the data table.
-  index: Object;
-}
-
-@abstract extern class JSMapIterator extends JSCollectionIterator;
-extern class JSMapKeyIterator extends JSMapIterator
-    generates 'TNode<JSMapIterator>';
-extern class JSMapKeyValueIterator extends JSMapIterator
-    generates 'TNode<JSMapIterator>';
-extern class JSMapValueIterator extends JSMapIterator
-    generates 'TNode<JSMapIterator>';
-
-@abstract extern class JSSetIterator extends JSCollectionIterator;
-extern class JSSetKeyValueIterator extends JSSetIterator
-    generates 'TNode<JSSetIterator>';
-extern class JSSetValueIterator extends JSSetIterator
-    generates 'TNode<JSSetIterator>';
-
-extern class JSMessageObject extends JSObject {
-  // Tagged fields.
-  message_type: Smi;
-  arguments: Object;
-  script: Script;
-  stack_frames: Object;
-  shared_info: SharedFunctionInfo | Undefined;
-
-  // Raw data fields.
-  // TODO(ishell): store as int32 instead of Smi.
-  bytecode_offset: Smi;
-  start_position: Smi;
-  end_position: Smi;
-  error_level: Smi;
-}
-
-extern class WeakArrayList extends HeapObject {
-  capacity: Smi;
-  length: Smi;
-  // TODO(v8:8983): declare variable-sized region for contained MaybeObject's
-  // objects[length]: MaybeObject;
-}
-
-extern class PrototypeInfo extends Struct {
-  js_module_namespace: JSModuleNamespace | Undefined;
-  prototype_users: WeakArrayList | Zero;
-  registry_slot: Smi;
-  validity_cell: Object;
-  // TODO(v8:9108): Should be Weak<Map> | Undefined.
-  @noVerifier object_create_map: Map | Undefined;
-  bit_field: Smi;
-}
-
-extern class Script extends Struct {
-  source: Object;
-  name: Object;
-  line_offset: Smi;
-  column_offset: Smi;
-  context: Object;
-  script_type: Smi;
-  line_ends: Object;
-  id: Smi;
-  eval_from_shared_or_wrapped_arguments: Object;
-  eval_from_position: Smi | Foreign;  // Smi or Managed<wasm::NativeModule>
-  shared_function_infos: Object;
-  flags: Smi;
-  source_url: Object;
-  source_mapping_url: Object;
-  host_defined_options: Object;
-}
-
-@generateCppClass
-extern class EmbedderDataArray extends HeapObject {
-  length: Smi;
-}
-
-extern class ScopeInfo extends FixedArray;
-
-@generateCppClass
-extern class PreparseData extends HeapObject {
-  // TODO(v8:8983): Add declaration for variable-sized region.
-  data_length: int32;
-  children_length: int32;
-}
-
-extern class InterpreterData extends Struct {
-  bytecode_array: BytecodeArray;
-  interpreter_trampoline: Code;
-}
-
-extern class SharedFunctionInfo extends HeapObject {
-  weak function_data: Object;
-  name_or_scope_info: String | NoSharedNameSentinel | ScopeInfo;
-  outer_scope_info_or_feedback_metadata: HeapObject;
-  script_or_debug_info: Script | DebugInfo | Undefined;
-  length: int16;
-  formal_parameter_count: uint16;
-  // Currently set to uint16, can be set to uint8 to save space.
-  expected_nof_properties: uint16;
-  function_token_offset: int16;
-  flags: int32;
-  function_literal_id: int32;
-  @if(V8_SFI_HAS_UNIQUE_ID) unique_id: int32;
-}
-
-@abstract
-@generateCppClass
-extern class UncompiledData extends HeapObject {
-  inferred_name: String;
-  start_position: int32;
-  end_position: int32;
-}
-
-@generateCppClass
-extern class UncompiledDataWithoutPreparseData extends UncompiledData {
-}
-
-@generateCppClass
-extern class UncompiledDataWithPreparseData extends UncompiledData {
-  preparse_data: PreparseData;
-}
-
-@abstract
-@generateCppClass
-@highestInstanceTypeWithinParentClassRange
-extern class JSFunctionOrBoundFunction extends JSObject {
-}
-
-@generateCppClass
-extern class JSBoundFunction extends JSFunctionOrBoundFunction {
-  // The wrapped function object.
-  bound_target_function: Callable;
-  // The value that is always passed as the this value when calling the wrapped
-  // function.
-  bound_this: JSAny | SourceTextModule;
-  // A list of values whose elements are used as the first arguments to any call
-  // to the wrapped function.
-  bound_arguments: FixedArray;
-}
-
 // Specialized types. The following three type definitions don't correspond to
 // actual C++ classes, but have Is... methods that check additional constraints.
 
@@ -831,561 +172,159 @@ type CallableApiObject extends JSObject;
 // A JSProxy with the callable bit set.
 type CallableJSProxy extends JSProxy;
 
-type Callable =
-    JSFunction | JSBoundFunction | CallableJSProxy | CallableApiObject;
-
-extern operator '.length_intptr' macro LoadAndUntagFixedArrayBaseLength(
-    FixedArrayBase): intptr;
-
-type SloppyArgumentsElements extends FixedArray;
-
-extern class FreeSpace extends HeapObject {
-  size: Smi;
-  next: FreeSpace | Uninitialized;
-}
-
-// %RawDownCast should *never* be used anywhere in Torque code except for
-// in Torque-based UnsafeCast operators preceeded by an appropriate
-// type assert()
-intrinsic %RawDownCast<To: type, From: type>(x: From): To;
-intrinsic %RawConstexprCast<To: type, From: type>(f: From): To;
-
-type NativeContextSlot generates 'TNode<IntPtrT>' constexpr 'int32_t';
-const ARRAY_BUFFER_FUN_INDEX: constexpr NativeContextSlot
-    generates 'Context::ARRAY_BUFFER_FUN_INDEX';
-const ARRAY_BUFFER_NOINIT_FUN_INDEX: constexpr NativeContextSlot
-    generates 'Context::ARRAY_BUFFER_NOINIT_FUN_INDEX';
-const ARRAY_BUFFER_MAP_INDEX: constexpr NativeContextSlot
-    generates 'Context::ARRAY_BUFFER_MAP_INDEX';
-const ARRAY_JOIN_STACK_INDEX: constexpr NativeContextSlot
-    generates 'Context::ARRAY_JOIN_STACK_INDEX';
-const OBJECT_FUNCTION_INDEX: constexpr NativeContextSlot
-    generates 'Context::OBJECT_FUNCTION_INDEX';
-const ITERATOR_RESULT_MAP_INDEX: constexpr NativeContextSlot
-    generates 'Context::ITERATOR_RESULT_MAP_INDEX';
-const JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX: constexpr NativeContextSlot
-    generates 'Context::JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX';
-const JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX: constexpr NativeContextSlot
-    generates 'Context::JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX';
-const PROXY_REVOCABLE_RESULT_MAP_INDEX: constexpr NativeContextSlot
-    generates 'Context::PROXY_REVOCABLE_RESULT_MAP_INDEX';
-const REFLECT_APPLY_INDEX: constexpr NativeContextSlot
-    generates 'Context::REFLECT_APPLY_INDEX';
-const REGEXP_FUNCTION_INDEX: constexpr NativeContextSlot
-    generates 'Context::REGEXP_FUNCTION_INDEX';
-const REGEXP_LAST_MATCH_INFO_INDEX: constexpr NativeContextSlot
-    generates 'Context::REGEXP_LAST_MATCH_INFO_INDEX';
-const INITIAL_STRING_ITERATOR_MAP_INDEX: constexpr NativeContextSlot
-    generates 'Context::INITIAL_STRING_ITERATOR_MAP_INDEX';
-extern operator '[]' macro LoadContextElement(
-    NativeContext, NativeContextSlot): Object;
-extern operator '[]=' macro StoreContextElement(
-    NativeContext, NativeContextSlot, Object): void;
-
-type ContextSlot generates 'TNode<IntPtrT>' constexpr 'int32_t';
-const PROXY_SLOT: constexpr ContextSlot
-    generates 'Context::MIN_CONTEXT_SLOTS';
-extern operator '[]' macro LoadContextElement(Context, ContextSlot): Object;
-extern operator '[]=' macro StoreContextElement(
-    Context, ContextSlot, Object): void;
-
-extern operator '[]' macro LoadContextElement(Context, intptr): Object;
-extern operator '[]' macro LoadContextElement(Context, Smi): Object;
-
-extern class JSArrayBuffer extends JSObject {
-  byte_length: uintptr;
-  backing_store: RawPtr;
-}
-
-@abstract
-extern class JSArrayBufferView extends JSObject {
-  buffer: JSArrayBuffer;
-  byte_offset: uintptr;
-  byte_length: uintptr;
-}
-
-extern class JSTypedArray extends JSArrayBufferView {
-  length: uintptr;
-  external_pointer: RawPtr;
-  base_pointer: ByteArray | Smi;
-}
-
-@abstract
-@generateCppClass
-extern class JSCollection extends JSObject {
-  // The backing hash table.
-  table: Object;
-}
-@generateCppClass
-extern class JSSet extends JSCollection {
-}
-@generateCppClass
-extern class JSMap extends JSCollection {
-}
-
-@generateCppClass
-extern class JSDate extends JSObject {
-  // If one component is NaN, all of them are, indicating a NaN time value.
-
-  // The time value.
-  value: NumberOrUndefined;
-
-  // Cached values:
-  year: Undefined | Smi | NaN;
-  month: Undefined | Smi | NaN;
-  day: Undefined | Smi | NaN;
-  weekday: Undefined | Smi | NaN;
-  hour: Undefined | Smi | NaN;
-  min: Undefined | Smi | NaN;
-  sec: Undefined | Smi | NaN;
-
-  // Sample of the date cache stamp at the moment when chached fields were
-  // cached.
-  cache_stamp: Undefined | Smi | NaN;
-}
-
-extern class JSGlobalObject extends JSSpecialObject {
-  native_context: NativeContext;
-  global_proxy: JSGlobalProxy;
-}
-
-@generateCppClass
-extern class JSAsyncFromSyncIterator extends JSObject {
-  sync_iterator: JSReceiver;
-  // The "next" method is loaded during GetIterator, and is not reloaded for
-  // subsequent "next" invocations.
-  next: Object;
-}
-
-@generateCppClass
-extern class JSStringIterator extends JSObject {
-  // The [[IteratedString]] inobject property.
-  string: String;
-  // The [[StringIteratorNextIndex]] inobject property.
-  index: Smi;
-}
-
-@abstract
-@generateCppClass
-extern class TemplateInfo extends Struct {
-  tag: Object;
-  serial_number: Object;
-  number_of_properties: Smi;
-  property_list: Object;
-  property_accessors: Object;
-}
-
-@generatePrint
-@generateCppClass
-extern class TemplateObjectDescription extends Struct {
-  raw_strings: FixedArray;
-  cooked_strings: FixedArray;
-}
-
-@generateCppClass
-extern class FunctionTemplateRareData extends Struct {
-  // See DECL_RARE_ACCESSORS in FunctionTemplateInfo.
-  prototype_template: Object;
-  prototype_provider_template: Object;
-  parent_template: Object;
-  named_property_handler: Object;
-  indexed_property_handler: Object;
-  instance_template: Object;
-  instance_call_handler: Object;
-  access_check_info: Object;
-}
-
-@generateCppClass
-extern class FunctionTemplateInfo extends TemplateInfo {
-  // Handler invoked when calling an instance of this FunctionTemplateInfo.
-  // Either CallHandlerInfo or Undefined.
-  call_code: Object;
-  class_name: Object;
-  // If the signature is a FunctionTemplateInfo it is used to check whether the
-  // receiver calling the associated JSFunction is a compatible receiver, i.e.
-  // it is an instance of the signature FunctionTemplateInfo or any of the
-  // receiver's prototypes are.
-  signature: Object;
-  // If any of the setters declared by DECL_RARE_ACCESSORS are used then a
-  // FunctionTemplateRareData will be stored here. Until then this contains
-  // undefined.
-  rare_data: HeapObject;
-  shared_function_info: Object;
-  flag: Smi;
-  length: Smi;
-  // Either the_hole or a private symbol. Used to cache the result on
-  // the receiver under the the cached_property_name when this
-  // FunctionTemplateInfo is used as a getter.
-  cached_property_name: Object;
-}
-
-@generateCppClass
-extern class ObjectTemplateInfo extends TemplateInfo {
-  constructor: Object;
-  data: Object;
-}
-
-extern class PropertyArray extends HeapObject { length_and_hash: Smi; }
-
-type DependentCode extends WeakFixedArray;
-
-extern class PropertyCell extends HeapObject {
-  name: AnyName;
-  property_details_raw: Smi;
-  value: Object;
-  dependent_code: DependentCode;
-}
-
-extern class JSDataView extends JSArrayBufferView { data_pointer: RawPtr; }
-
-type ElementsKind generates 'TNode<Int32T>' constexpr 'ElementsKind';
-type LanguageMode extends Smi constexpr 'LanguageMode';
-type ExtractFixedArrayFlags
-    generates 'TNode<Smi>'
-    constexpr 'CodeStubAssembler::ExtractFixedArrayFlags';
+type Callable = JSFunction|JSBoundFunction|CallableJSProxy|CallableApiObject;
+
 type WriteBarrierMode
     generates 'TNode<Int32T>' constexpr 'WriteBarrierMode';
 
-type MessageTemplate constexpr 'MessageTemplate';
-type PrimitiveType constexpr 'PrimitiveType';
 type ToIntegerTruncationMode
 constexpr 'CodeStubAssembler::ToIntegerTruncationMode';
-type AllocationFlags constexpr 'AllocationFlags';
-type SlackTrackingMode constexpr 'SlackTrackingMode';
-
-type UnicodeEncoding constexpr 'UnicodeEncoding';
-const UTF16:
-    constexpr UnicodeEncoding generates 'UnicodeEncoding::UTF16';
-const UTF32:
-    constexpr UnicodeEncoding generates 'UnicodeEncoding::UTF32';
-
-@apiExposedInstanceTypeValue(0x46)
-extern class Foreign extends HeapObject {
-  foreign_address: RawPtr;
-}
-
-@generateCppClass
-extern class InterceptorInfo extends Struct {
-  getter: NonNullForeign | Zero | Undefined;
-  setter: NonNullForeign | Zero | Undefined;
-  query: NonNullForeign | Zero | Undefined;
-  descriptor: NonNullForeign | Zero | Undefined;
-  deleter: NonNullForeign | Zero | Undefined;
-  enumerator: NonNullForeign | Zero | Undefined;
-  definer: NonNullForeign | Zero | Undefined;
-  data: Object;
-  flags: Smi;
-}
-
-@generateCppClass
-extern class AccessCheckInfo extends Struct {
-  callback: Foreign | Zero | Undefined;
-  named_interceptor: InterceptorInfo | Zero | Undefined;
-  indexed_interceptor: InterceptorInfo | Zero | Undefined;
-  data: Object;
-}
 
-@generateCppClass
-extern class ArrayBoilerplateDescription extends Struct {
-  flags: Smi;
-  constant_elements: FixedArrayBase;
-}
-
-@generateCppClass
-extern class AliasedArgumentsEntry extends Struct {
-  aliased_context_slot: Smi;
-}
-
-@generateCppClass
-extern class Cell extends HeapObject {
-  value: Object;
-}
-
-@abstract
-extern class DataHandler extends Struct {
-  smi_handler: Smi | Code;
-  validity_cell: Smi | Cell;
-
-  // Space for the following fields may or may not be allocated.
-  // TODO(v8:9108): Misusing "weak" keyword; should be MaybeObject.
-  @noVerifier weak data_1: Object;
-  @noVerifier weak data_2: Object;
-  @noVerifier weak data_3: Object;
-}
-
-extern class LoadHandler extends DataHandler;
-extern class StoreHandler extends DataHandler;
-
-@abstract
-@dirtyInstantiatedAbstractClass
-@generateCppClass
-extern class JSGeneratorObject extends JSObject {
-  function: JSFunction;
-  context: Context;
-  receiver: JSAny;
-
-  // For executing generators: the most recent input value.
-  // For suspended generators: debug information (bytecode offset).
-  // There is currently no need to remember the most recent input value for a
-  // suspended generator.
-  input_or_debug_pos: Object;
-
-  resume_mode: Smi;
-  continuation: Smi;
-
-  // Saved interpreter register file.
-  parameters_and_registers: FixedArray;
-}
-
-@generateCppClass
-extern class JSAsyncFunctionObject extends JSGeneratorObject {
-  promise: JSPromise;
-}
+extern enum UnicodeEncoding { UTF16, UTF32 }
 
-@generateCppClass
-extern class JSAsyncGeneratorObject extends JSGeneratorObject {
-  // Pointer to the head of a singly linked list of AsyncGeneratorRequest, or
-  // undefined.
-  queue: HeapObject;
-  is_awaiting: Smi;
-}
-
-@generateCppClass
-extern class JSPromise extends JSObject {
-  // Smi 0 terminated list of PromiseReaction objects in case the JSPromise was
-  // not settled yet, otherwise the result.
-  reactions_or_result: Object;
-  flags: Smi;
-}
-
-@abstract
-@generateCppClass
-extern class Microtask extends Struct {
-}
-
-@generateCppClass
-extern class CallbackTask extends Microtask {
-  callback: Foreign;
-  data: Foreign;
-}
-
-@generateCppClass
-extern class CallableTask extends Microtask {
-  callable: JSReceiver;
-  context: Context;
-}
-
-extern class StackFrameInfo extends Struct {
-  line_number: Smi;
-  column_number: Smi;
-  promise_all_index: Smi;
-  script_id: Smi;
-  script_name: String | Null | Undefined;
-  script_name_or_source_url: String | Null | Undefined;
-  function_name: String | Null | Undefined;
-  method_name: String | Null | Undefined;
-  type_name: String | Null | Undefined;
-  eval_origin: String | Null | Undefined;
-  wasm_module_name: String | Null | Undefined;
-  wasm_instance: WasmInstanceObject | Null | Undefined;
-  flag: Smi;
+// Promise constants
+extern enum PromiseState extends int31 constexpr 'Promise::PromiseState' {
+  kPending,
+  kFulfilled,
+  kRejected
 }
 
 type FrameArray extends FixedArray;
 
-@generateCppClass
-extern class StackTraceFrame extends Struct {
-  frame_array: FrameArray | Undefined;
-  frame_index: Smi;
-  frame_info: StackFrameInfo | Undefined;
-  id: Smi;
-}
-
-@generateCppClass
-extern class ClassPositions extends Struct {
-  start: Smi;
-  end: Smi;
-}
-
-extern class WasmInstanceObject extends JSObject;
-
-extern class WasmExportedFunctionData extends Struct {
-  wrapper_code: Code;
-  instance: WasmInstanceObject;
-  jump_table_offset: Smi;
-  function_index: Smi;
-  // The remaining fields are for fast calling from C++. The contract is
-  // that they are lazily populated, and either all will be present or none.
-  c_wrapper_code: Object;
-  wasm_call_target: Smi | Foreign;
-  packed_args_size: Smi;
-}
-
-extern class WasmJSFunctionData extends Struct {
-  callable: JSReceiver;
-  wrapper_code: Code;
-  serialized_return_count: Smi;
-  serialized_parameter_count: Smi;
-  serialized_signature: ByteArray;  // PodArray<wasm::ValueType>
-}
-
-extern class WasmCapiFunctionData extends Struct {
-  call_target: RawPtr;
-  embedder_data: Foreign;  // Managed<wasm::FuncData>
-  wrapper_code: Code;
-  serialized_signature: ByteArray;  // PodArray<wasm::ValueType>
-}
-
-extern class WasmIndirectFunctionTable extends Struct {
-  size: uint32;
-  @if(TAGGED_SIZE_8_BYTES) optional_padding: uint32;
-  @ifnot(TAGGED_SIZE_8_BYTES) optional_padding: void;
-  sig_ids: RawPtr;
-  targets: RawPtr;
-  managed_native_allocations: Foreign | Undefined;
-  refs: FixedArray;
-}
-
-extern class WasmDebugInfo extends Struct {
-  instance: WasmInstanceObject;
-  interpreter_handle: Foreign | Undefined;
-  interpreter_reference_stack: Cell;
-  locals_names: FixedArray | Undefined;
-  c_wasm_entries: FixedArray | Undefined;
-  c_wasm_entry_map: Foreign | Undefined;  // Managed<wasm::SignatureMap>
-}
-
-@generateCppClass
-extern class WasmExceptionTag extends Struct {
-  index: Smi;
-}
-
 const kTaggedSize: constexpr int31 generates 'kTaggedSize';
 const kDoubleSize: constexpr int31 generates 'kDoubleSize';
+const kVariableSizeSentinel:
+    constexpr int31 generates 'kVariableSizeSentinel';
 
 const kSmiTagSize: constexpr int31 generates 'kSmiTagSize';
+const kHeapObjectTag: constexpr int31 generates 'kHeapObjectTag';
 const V8_INFINITY: constexpr float64 generates 'V8_INFINITY';
-
-const NO_ELEMENTS: constexpr ElementsKind generates 'NO_ELEMENTS';
-
-const PACKED_SMI_ELEMENTS:
-    constexpr ElementsKind generates 'PACKED_SMI_ELEMENTS';
-const HOLEY_SMI_ELEMENTS:
-    constexpr ElementsKind generates 'HOLEY_SMI_ELEMENTS';
-const PACKED_ELEMENTS:
-    constexpr ElementsKind generates 'PACKED_ELEMENTS';
-const HOLEY_ELEMENTS: constexpr ElementsKind generates 'HOLEY_ELEMENTS';
-const PACKED_DOUBLE_ELEMENTS:
-    constexpr ElementsKind generates 'PACKED_DOUBLE_ELEMENTS';
-const HOLEY_DOUBLE_ELEMENTS:
-    constexpr ElementsKind generates 'HOLEY_DOUBLE_ELEMENTS';
-const LAST_ANY_NONEXTENSIBLE_ELEMENTS_KIND: constexpr ElementsKind
-    generates 'LAST_ANY_NONEXTENSIBLE_ELEMENTS_KIND';
-const DICTIONARY_ELEMENTS:
-    constexpr ElementsKind generates 'DICTIONARY_ELEMENTS';
-
-const UINT8_ELEMENTS: constexpr ElementsKind generates 'UINT8_ELEMENTS';
-const INT8_ELEMENTS: constexpr ElementsKind generates 'INT8_ELEMENTS';
-const UINT16_ELEMENTS:
-    constexpr ElementsKind generates 'UINT16_ELEMENTS';
-const INT16_ELEMENTS: constexpr ElementsKind generates 'INT16_ELEMENTS';
-const UINT32_ELEMENTS:
-    constexpr ElementsKind generates 'UINT32_ELEMENTS';
-const INT32_ELEMENTS: constexpr ElementsKind generates 'INT32_ELEMENTS';
-const FLOAT32_ELEMENTS:
-    constexpr ElementsKind generates 'FLOAT32_ELEMENTS';
-const FLOAT64_ELEMENTS:
-    constexpr ElementsKind generates 'FLOAT64_ELEMENTS';
-const UINT8_CLAMPED_ELEMENTS:
-    constexpr ElementsKind generates 'UINT8_CLAMPED_ELEMENTS';
-const BIGUINT64_ELEMENTS:
-    constexpr ElementsKind generates 'BIGUINT64_ELEMENTS';
-const BIGINT64_ELEMENTS:
-    constexpr ElementsKind generates 'BIGINT64_ELEMENTS';
-
-const kNone:
-    constexpr AllocationFlags generates 'CodeStubAssembler::kNone';
-const kDoubleAlignment: constexpr AllocationFlags
-    generates 'CodeStubAssembler::kDoubleAlignment';
-const kPretenured:
-    constexpr AllocationFlags generates 'CodeStubAssembler::kPretenured';
-const kAllowLargeObjectAllocation: constexpr AllocationFlags
-    generates 'CodeStubAssembler::kAllowLargeObjectAllocation';
-
-const kWithSlackTracking: constexpr SlackTrackingMode
-    generates 'CodeStubAssembler::SlackTrackingMode::kWithSlackTracking';
-const kNoSlackTracking: constexpr SlackTrackingMode
-    generates 'CodeStubAssembler::SlackTrackingMode::kNoSlackTracking';
-
-const kFixedDoubleArrays: constexpr ExtractFixedArrayFlags
-    generates 'CodeStubAssembler::ExtractFixedArrayFlag::kFixedDoubleArrays';
-const kAllFixedArrays: constexpr ExtractFixedArrayFlags
-    generates 'CodeStubAssembler::ExtractFixedArrayFlag::kAllFixedArrays';
-const kFixedArrays: constexpr ExtractFixedArrayFlags
-    generates 'CodeStubAssembler::ExtractFixedArrayFlag::kFixedArrays';
-
-const kFixedArrayMapRootIndex:
-    constexpr RootIndex generates 'RootIndex::kFixedArrayMap';
-const kFixedCOWArrayMapRootIndex:
-    constexpr RootIndex generates 'RootIndex::kFixedCOWArrayMap';
-const kEmptyByteArrayRootIndex:
-    constexpr RootIndex generates 'RootIndex::kEmptyByteArray';
-const kEmptyFixedArrayRootIndex:
-    constexpr RootIndex generates 'RootIndex::kEmptyFixedArray';
-const kTheHoleValueRootIndex:
-    constexpr RootIndex generates 'RootIndex::kTheHoleValue';
-
-const kInvalidArrayBufferLength: constexpr MessageTemplate
-    generates 'MessageTemplate::kInvalidArrayBufferLength';
-const kInvalidArrayLength: constexpr MessageTemplate
-    generates 'MessageTemplate::kInvalidArrayLength';
-const kCalledNonCallable: constexpr MessageTemplate
-    generates 'MessageTemplate::kCalledNonCallable';
-const kCalledOnNullOrUndefined: constexpr MessageTemplate
-    generates 'MessageTemplate::kCalledOnNullOrUndefined';
-const kProtoObjectOrNull: constexpr MessageTemplate
-    generates 'MessageTemplate::kProtoObjectOrNull';
-const kInvalidOffset: constexpr MessageTemplate
-    generates 'MessageTemplate::kInvalidOffset';
-const kInvalidTypedArrayLength: constexpr MessageTemplate
-    generates 'MessageTemplate::kInvalidTypedArrayLength';
-const kIteratorSymbolNonCallable: constexpr MessageTemplate
-    generates 'MessageTemplate::kIteratorSymbolNonCallable';
-const kIteratorValueNotAnObject: constexpr MessageTemplate
-    generates 'MessageTemplate::kIteratorValueNotAnObject';
-const kNotIterable: constexpr MessageTemplate
-    generates 'MessageTemplate::kNotIterable';
-const kReduceNoInitial: constexpr MessageTemplate
-    generates 'MessageTemplate::kReduceNoInitial';
-const kFirstArgumentNotRegExp: constexpr MessageTemplate
-    generates 'MessageTemplate::kFirstArgumentNotRegExp';
-const kBigIntMixedTypes: constexpr MessageTemplate
-    generates 'MessageTemplate::kBigIntMixedTypes';
-const kTypedArrayTooShort: constexpr MessageTemplate
-    generates 'MessageTemplate::kTypedArrayTooShort';
-const kInvalidCountValue: constexpr MessageTemplate
-    generates 'MessageTemplate::kInvalidCountValue';
-const kConstructorNotFunction: constexpr MessageTemplate
-    generates 'MessageTemplate::kConstructorNotFunction';
-const kSymbolToString: constexpr MessageTemplate
-    generates 'MessageTemplate::kSymbolToString';
-const kPropertyNotFunction: constexpr MessageTemplate
-    generates 'MessageTemplate::kPropertyNotFunction';
-const kBigIntMaxLength: constexpr intptr
-    generates 'BigInt::kMaxLength';
-const kBigIntTooBig: constexpr MessageTemplate
-    generates 'MessageTemplate::kBigIntTooBig';
+const MINUS_V8_INFINITY: constexpr float64 generates '-V8_INFINITY';
+
+extern enum ElementsKind extends int32 {
+  NO_ELEMENTS,
+
+  PACKED_SMI_ELEMENTS,
+  HOLEY_SMI_ELEMENTS,
+  PACKED_ELEMENTS,
+  HOLEY_ELEMENTS,
+  PACKED_DOUBLE_ELEMENTS,
+  HOLEY_DOUBLE_ELEMENTS,
+  LAST_ANY_NONEXTENSIBLE_ELEMENTS_KIND,
+  DICTIONARY_ELEMENTS,
+
+  UINT8_ELEMENTS,
+  INT8_ELEMENTS,
+  UINT16_ELEMENTS,
+  INT16_ELEMENTS,
+  UINT32_ELEMENTS,
+  INT32_ELEMENTS,
+  FLOAT32_ELEMENTS,
+  FLOAT64_ELEMENTS,
+  UINT8_CLAMPED_ELEMENTS,
+  BIGUINT64_ELEMENTS,
+  BIGINT64_ELEMENTS,
+  ...
+}
+
+extern enum AllocationFlag constexpr 'CodeStubAssembler::AllocationFlag' {
+  kNone,
+  kDoubleAlignment,
+  kPretenured,
+  kAllowLargeObjectAllocation
+}
+
+extern enum SlackTrackingMode
+constexpr 'CodeStubAssembler::SlackTrackingMode' {
+  kWithSlackTracking,
+  kNoSlackTracking
+}
+
+extern enum ExtractFixedArrayFlag
+constexpr 'CodeStubAssembler::ExtractFixedArrayFlag' {
+  kFixedDoubleArrays,
+  kAllFixedArrays,
+  kFixedArrays,
+  ...
+}
+
+const kBigIntMaxLength: constexpr intptr generates 'BigInt::kMaxLength';
+
+extern enum MessageTemplate {
+  kInvalidArrayBufferLength,
+  kInvalidArrayLength,
+  kInvalidIndex,
+  kNotConstructor,
+  kCalledNonCallable,
+  kCalledOnNullOrUndefined,
+  kProtoObjectOrNull,
+  kInvalidOffset,
+  kInvalidTypedArrayLength,
+  kIteratorSymbolNonCallable,
+  kIteratorValueNotAnObject,
+  kNotIterable,
+  kReduceNoInitial,
+  kFirstArgumentNotRegExp,
+  kBigIntMixedTypes,
+  kTypedArrayTooShort,
+  kInvalidCountValue,
+  kConstructorNotFunction,
+  kSymbolToString,
+  kPropertyNotFunction,
+  kBigIntTooBig,
+  kNotTypedArray,
+  kDetachedOperation,
+  kBadSortComparisonFunction,
+  kIncompatibleMethodReceiver,
+  kInvalidDataViewAccessorOffset,
+  kTypedArraySetOffsetOutOfBounds,
+  kInvalidArgument,
+  kInvalidRegExpExecResult,
+  kRegExpNonRegExp,
+  kRegExpNonObject,
+  kPromiseNonCallable,
+  kNotAPromise,
+  kResolverNotAFunction,
+  kTooManyElementsInPromiseAll,
+  kToRadixFormatRange,
+  kCalledOnNonObject,
+  kRegExpGlobalInvokedOnNonGlobal,
+  kProxyNonObject,
+  kProxyHandlerOrTargetRevoked,
+  kProxyRevoked,
+  kProxyTrapReturnedFalsishFor,
+  kProxyPrivate,
+  kProxyIsExtensibleInconsistent,
+  kProxyPreventExtensionsExtensible,
+  kProxyTrapReturnedFalsish,
+  kProxyGetPrototypeOfInvalid,
+  kProxyGetPrototypeOfNonExtensible,
+  kProxySetPrototypeOfNonExtensible,
+  kProxyDeletePropertyNonExtensible,
+  ...
+}
 
 const kMaxArrayIndex:
     constexpr uint32 generates 'JSArray::kMaxArrayIndex';
 const kArrayBufferMaxByteLength:
     constexpr uintptr generates 'JSArrayBuffer::kMaxByteLength';
+const kTypedArrayMaxLength:
+    constexpr uintptr generates 'JSTypedArray::kMaxLength';
 const kMaxTypedArrayInHeap:
     constexpr int31 generates 'JSTypedArray::kMaxSizeInHeap';
+// CSA does not support 64-bit types on 32-bit platforms so as a workaround the
+// kMaxSafeIntegerUint64 is defined as uintptr and allowed to be used only
+// inside if constexpr (Is64()) i.e. on 64-bit architectures.
+const kMaxSafeIntegerUint64: constexpr uintptr
+    generates 'CodeStubAssembler::MaxSafeIntegerUintPtr()';
 const kMaxSafeInteger: constexpr float64 generates 'kMaxSafeInteger';
+const kMaxUInt32Double: constexpr float64 generates 'kMaxUInt32Double';
 const kSmiMaxValue: constexpr uintptr generates 'kSmiMaxValue';
 const kSmiMax: uintptr = kSmiMaxValue;
+// TODO(v8:8996): Use uintptr version instead and drop this one.
 const kStringMaxLength: constexpr int31 generates 'String::kMaxLength';
+const kStringMaxLengthUintptr:
+    constexpr uintptr generates 'String::kMaxLength';
 const kFixedArrayMaxLength:
     constexpr int31 generates 'FixedArray::kMaxLength';
 const kObjectAlignmentMask: constexpr intptr
@@ -1410,21 +349,7 @@ const kTruncateMinusZero: constexpr ToIntegerTruncationMode
     generates 'CodeStubAssembler::ToIntegerTruncationMode::kTruncateMinusZero'
     ;
 
-const kNotTypedArray: constexpr MessageTemplate
-    generates 'MessageTemplate::kNotTypedArray';
-const kDetachedOperation: constexpr MessageTemplate
-    generates 'MessageTemplate::kDetachedOperation';
-const kBadSortComparisonFunction: constexpr MessageTemplate
-    generates 'MessageTemplate::kBadSortComparisonFunction';
-const kIncompatibleMethodReceiver: constexpr MessageTemplate
-    generates 'MessageTemplate::kIncompatibleMethodReceiver';
-const kInvalidDataViewAccessorOffset: constexpr MessageTemplate
-    generates 'MessageTemplate::kInvalidDataViewAccessorOffset';
-const kStrictReadOnlyProperty: constexpr MessageTemplate
-    generates 'MessageTemplate::kStrictReadOnlyProperty';
-
-const kString: constexpr PrimitiveType
-    generates 'PrimitiveType::kString';
+extern enum PrimitiveType { kString, kBoolean, kSymbol, kNumber }
 
 const kNameDictionaryInitialCapacity:
     constexpr int32 generates 'NameDictionary::kInitialCapacity';
@@ -1434,10 +359,11 @@ type Null extends Oddball;
 type Undefined extends Oddball;
 type True extends Oddball;
 type False extends Oddball;
+type Exception extends Oddball;
 type EmptyString extends String;
-type Boolean = True | False;
+type Boolean = True|False;
 
-type NumberOrUndefined = Number | Undefined;
+type NumberOrUndefined = Number|Undefined;
 
 extern macro TheHoleConstant(): TheHole;
 extern macro NullConstant(): Null;
@@ -1449,8 +375,9 @@ extern macro Int32FalseConstant(): bool;
 extern macro EmptyStringConstant(): EmptyString;
 extern macro LengthStringConstant(): String;
 extern macro NanConstant(): NaN;
-extern macro IteratorSymbolConstant(): Symbol;
+extern macro IteratorSymbolConstant(): PublicSymbol;
 extern macro MatchSymbolConstant(): Symbol;
+extern macro ReturnStringConstant(): String;
 
 const TheHole: TheHole = TheHoleConstant();
 const Null: Null = NullConstant();
@@ -1459,335 +386,28 @@ const True: True = TrueConstant();
 const False: False = FalseConstant();
 const kEmptyString: EmptyString = EmptyStringConstant();
 const kLengthString: String = LengthStringConstant();
+const kReturnString: String = ReturnStringConstant();
+
 const kNaN: NaN = NanConstant();
+const kZero: Zero = %RawDownCast<Zero>(SmiConstant(0));
 
 const true: constexpr bool generates 'true';
 const false: constexpr bool generates 'false';
 
-const kStrict: constexpr LanguageMode generates 'LanguageMode::kStrict';
-const kSloppy: constexpr LanguageMode generates 'LanguageMode::kSloppy';
+extern enum LanguageMode extends bool { kStrict, kSloppy }
+type LanguageModeSmi extends Smi;
 
 const SKIP_WRITE_BARRIER:
     constexpr WriteBarrierMode generates 'SKIP_WRITE_BARRIER';
 const UNSAFE_SKIP_WRITE_BARRIER:
     constexpr WriteBarrierMode generates 'UNSAFE_SKIP_WRITE_BARRIER';
 
-@generateCppClass
-extern class AsyncGeneratorRequest extends Struct {
-  next: AsyncGeneratorRequest | Undefined;
-  resume_mode: Smi;
-  value: Object;
-  promise: JSPromise;
-}
-
-@generateCppClass
-extern class SourceTextModuleInfoEntry extends Struct {
-  export_name: String | Undefined;
-  local_name: String | Undefined;
-  import_name: String | Undefined;
-  module_request: Smi;
-  cell_index: Smi;
-  beg_pos: Smi;
-  end_pos: Smi;
-}
-
-@generateCppClass
-extern class PromiseCapability extends Struct {
-  promise: JSReceiver | Undefined;
-  resolve: Object;
-  reject: Object;
-}
-
-@generateCppClass
-extern class PromiseReaction extends Struct {
-  next: PromiseReaction | Zero;
-  reject_handler: Callable | Undefined;
-  fulfill_handler: Callable | Undefined;
-  // Either a JSPromise (in case of native promises), a PromiseCapability
-  // (general case), or undefined (in case of await).
-  promise_or_capability: JSPromise | PromiseCapability | Undefined;
-}
-
-@abstract
-@generateCppClass
-extern class PromiseReactionJobTask extends Microtask {
-  argument: Object;
-  context: Context;
-  handler: Callable | Undefined;
-  // Either a JSPromise (in case of native promises), a PromiseCapability
-  // (general case), or undefined (in case of await).
-  promise_or_capability: JSPromise | PromiseCapability | Undefined;
-}
-
-@generateCppClass
-extern class PromiseFulfillReactionJobTask extends PromiseReactionJobTask {
-}
-
-@generateCppClass
-extern class PromiseRejectReactionJobTask extends PromiseReactionJobTask {
-}
-
-@generateCppClass
-extern class PromiseResolveThenableJobTask extends Microtask {
-  context: Context;
-  promise_to_resolve: JSPromise;
-  then: JSReceiver;
-  thenable: JSReceiver;
-}
-
-@generateCppClass
-extern class JSRegExp extends JSObject {
-  data: FixedArray | Undefined;
-  source: String | Undefined;
-  flags: Smi | Undefined;
-}
-
 extern transitioning macro AllocateJSIteratorResult(implicit context: Context)(
     JSAny, Boolean): JSObject;
-
-// Note: Although a condition for a FastJSRegExp is having a positive smi
-// lastIndex (see RegExpBuiltinsAssembler::BranchIfFastRegExp), it is possible
-// for this to change without transitioning the transient type. As a precaution,
-// validate the lastIndex is positive smi when used in fast paths.
-transient type FastJSRegExp extends JSRegExp;
-
-extern operator '.global' macro
-RegExpBuiltinsAssembler::FastFlagGetterGlobal(FastJSRegExp): bool;
-extern operator '.unicode' macro
-RegExpBuiltinsAssembler::FastFlagGetterUnicode(FastJSRegExp): bool;
-extern operator '.lastIndex' macro
-RegExpBuiltinsAssembler::FastLoadLastIndex(FastJSRegExp): Smi;
-extern operator '.lastIndex=' macro
-RegExpBuiltinsAssembler::FastStoreLastIndex(FastJSRegExp, Smi): void;
-
-@hasSameInstanceTypeAsParent
-extern class JSRegExpResult extends JSArray {
-  // In-object properties:
-  // The below fields are externally exposed.
-  index: JSAny;
-  input: JSAny;
-  groups: JSAny;
-
-  // The below fields are for internal use only.
-  cached_indices_or_match_info: JSRegExpResultIndices | RegExpMatchInfo;
-  names: FixedArray | Undefined;
-}
-
-@hasSameInstanceTypeAsParent
-extern class JSRegExpResultIndices extends JSArray {
-  // In-object properties:
-  // The groups field is externally exposed.
-  groups: JSAny;
-}
-
-transient type FastJSRegExpResult extends JSRegExpResult;
-
-@generateCppClass
-extern class JSRegExpStringIterator extends JSObject {
-  // The [[IteratingRegExp]] internal property.
-  iterating_reg_exp: JSReceiver;
-  // The [[IteratedString]] internal property.
-  iterated_string: String;
-  flags: Smi;
-}
-
-const kRegExpMatchInfoFirstCaptureIndex:
-    constexpr int31 generates 'RegExpMatchInfo::kFirstCaptureIndex';
-const kRegExpMatchInfoNumberOfCapturesIndex:
-    constexpr int31 generates 'RegExpMatchInfo::kNumberOfCapturesIndex';
-
-macro GetStartOfCaptureIndex(captureIndex: constexpr int31): constexpr int31 {
-  return kRegExpMatchInfoFirstCaptureIndex + (captureIndex * 2);
-}
-
-@hasSameInstanceTypeAsParent
-extern class RegExpMatchInfo extends FixedArray {
-  GetStartOfCapture(implicit context: Context)(captureIndex: constexpr int31):
-      Smi {
-    const index: constexpr int31 = GetStartOfCaptureIndex(captureIndex);
-    return UnsafeCast<Smi>(this.objects[index]);
-  }
-  GetEndOfCapture(implicit context: Context)(captureIndex: constexpr int31):
-      Smi {
-    const index: constexpr int31 = GetStartOfCaptureIndex(captureIndex) + 1;
-    return UnsafeCast<Smi>(this.objects[index]);
-  }
-  NumberOfCaptures(implicit context: Context)(): Smi {
-    return UnsafeCast<Smi>(this.objects[kRegExpMatchInfoNumberOfCapturesIndex]);
-  }
-}
-
-extern class AccessorInfo extends Struct {
-  name: Object;
-  flags: Smi;
-  expected_receiver_type: Object;
-  setter: NonNullForeign | Zero;
-  getter: NonNullForeign | Zero;
-  js_getter: NonNullForeign | Zero;
-  data: Object;
-}
-
-@generateCppClass
-extern class AccessorPair extends Struct {
-  getter: Object;
-  setter: Object;
-}
-
-@hasSameInstanceTypeAsParent
-extern class BreakPoint extends Tuple2 {
-}
-@hasSameInstanceTypeAsParent
-extern class BreakPointInfo extends Tuple2 {
-}
-type CoverageInfo extends FixedArray;
-
-@generateCppClass
-extern class DebugInfo extends Struct {
-  shared: SharedFunctionInfo;
-  debugger_hints: Smi;
-  // Script field from shared function info.
-  script: Undefined | Script;
-  // The original uninstrumented bytecode array for functions with break
-  // points - the instrumented bytecode is held in the shared function info.
-  original_bytecode_array: Undefined | BytecodeArray;
-  // The debug instrumented bytecode array for functions with break points
-  // - also pointed to by the shared function info.
-  debug_bytecode_array: Undefined | BytecodeArray;
-  // Fixed array holding status information for each active break point.
-  break_points: FixedArray;
-  flags: Smi;
-  coverage_info: CoverageInfo | Undefined;
-}
-
-extern class FeedbackVector extends HeapObject {
-  shared_function_info: SharedFunctionInfo;
-  // TODO(v8:9108): currently no support for MaybeObject in Torque
-  @noVerifier optimized_code_weak_or_smi: Object;
-  closure_feedback_cell_array: FixedArray;
-  length: int32;
-  invocation_count: int32;
-  profiler_ticks: int32;
-  // TODO(v8:9287) The padding is not necessary on platforms with 4 bytes
-  // tagged pointers, we should make it conditional; however, platform-specific
-  // interacts badly with GCMole, so we need to address that first.
-  padding: uint32;
-}
-
-@generateCppClass
-extern class FeedbackCell extends Struct {
-  value: Undefined | FeedbackVector | FixedArray;
-  interrupt_budget: int32;
-}
-
-extern class FeedbackMetadata extends HeapObject;
-
-extern class AllocationSite extends Struct;
-extern class AllocationMemento extends Struct {
-  allocation_site: AllocationSite;
-}
-
-extern class WasmModuleObject extends JSObject {
-  native_module: Foreign;
-  export_wrappers: FixedArray;
-  script: Script;
-  asm_js_offset_table: ByteArray | Undefined;
-}
-
-extern class WasmTableObject extends JSObject {
-  entries: FixedArray;
-  maximum_length: Smi | HeapNumber | Undefined;
-  dispatch_tables: FixedArray;
-  raw_type: Smi;
-}
-
-extern class WasmMemoryObject extends JSObject {
-  array_buffer: JSArrayBuffer;
-  maximum_pages: Smi;
-  instances: WeakArrayList | Undefined;
-}
-
-extern class WasmGlobalObject extends JSObject {
-  untagged_buffer: JSArrayBuffer | Undefined;
-  tagged_buffer: FixedArray | Undefined;
-  offset: Smi;
-  flags: Smi;
-}
-
-extern class WasmExceptionObject extends JSObject {
-  serialized_signature: ByteArray;  // PodArray<wasm::ValueType>
-  exception_tag: HeapObject;
-}
-
-type WasmExportedFunction extends JSFunction;
-
-extern class AsmWasmData extends Struct {
-  managed_native_module: Foreign;  // Managed<wasm::NativeModule>
-  export_wrappers: FixedArray;
-  asm_js_offset_table: ByteArray;
-  uses_bitset: HeapNumber;
-}
-
-extern class JSFinalizationGroup extends JSObject {
-  native_context: NativeContext;
-  cleanup: Object;
-  active_cells: Undefined | WeakCell;
-  cleared_cells: Undefined | WeakCell;
-  key_map: Object;
-  next: Undefined | JSFinalizationGroup;
-  flags: Smi;
-}
-
-@generateCppClass
-extern class JSFinalizationGroupCleanupIterator extends JSObject {
-  finalization_group: JSFinalizationGroup;
-}
-
-@generateCppClass
-extern class WeakCell extends HeapObject {
-  finalization_group: Undefined | JSFinalizationGroup;
-  target: Undefined | JSReceiver;
-  holdings: Object;
-
-  // For storing doubly linked lists of WeakCells in JSFinalizationGroup's
-  // "active_cells" and "cleared_cells" lists.
-  prev: Undefined | WeakCell;
-  next: Undefined | WeakCell;
-
-  // For storing doubly linked lists of WeakCells per key in
-  // JSFinalizationGroup's key-based hashmap. WeakCell also needs to know its
-  // key, so that we can remove the key from the key_map when we remove the last
-  // WeakCell associated with it.
-  key: Object;
-  key_list_prev: Undefined | WeakCell;
-  key_list_next: Undefined | WeakCell;
-}
-
-@generateCppClass
-extern class JSWeakRef extends JSObject {
-  target: Undefined | JSReceiver;
-}
-
-extern class BytecodeArray extends FixedArrayBase {
-  // TODO(v8:8983): bytecode array object sizes vary based on their contents.
-  constant_pool: FixedArray;
-  handler_table: ByteArray;
-  source_position_table: Undefined | ByteArray |
-      SourcePositionTableWithFrameCache;
-  frame_size: int32;
-  parameter_size: int32;
-  incoming_new_target_or_generator_register: int32;
-  osr_nesting_level: int8;
-  bytecode_age: int8;
-}
+extern macro AllocateSyntheticFunctionContext(
+    NativeContext, constexpr int32): Context;
 
 extern class Filler extends HeapObject generates 'TNode<HeapObject>';
-extern class CodeDataContainer extends HeapObject;
-@abstract
-extern class SmallOrderedHashTable extends HeapObject
-    generates 'TNode<HeapObject>';
-extern class SmallOrderedHashMap extends SmallOrderedHashTable;
-extern class SmallOrderedHashSet extends SmallOrderedHashTable;
-extern class SmallOrderedNameDictionary extends SmallOrderedHashTable;
 
 // Various logical subclasses of JSObject, which have their own instance types
 // but not their own class definitions:
@@ -1813,16 +433,16 @@ extern macro Comment(constexpr string);
 extern macro StaticAssert(bool);
 extern macro Print(Object);
 extern macro DebugBreak();
-extern transitioning macro ToInteger_Inline(Context, JSAny): Number;
-extern transitioning macro ToInteger_Inline(
-    Context, JSAny, constexpr ToIntegerTruncationMode): Number;
-extern transitioning macro ToLength_Inline(Context, JSAny): Number;
-extern transitioning macro ToNumber_Inline(Context, JSAny): Number;
-extern transitioning macro ToSmiIndex(implicit context: Context)(JSAny):
-    PositiveSmi labels IfRangeError;
-extern transitioning macro ToSmiLength(implicit context: Context)(JSAny):
-    PositiveSmi labels IfRangeError;
-extern transitioning macro ToString_Inline(Context, JSAny): String;
+extern transitioning macro ToInteger_Inline(implicit context: Context)(JSAny):
+    Number;
+extern transitioning macro ToInteger_Inline(implicit context: Context)(
+    JSAny, constexpr ToIntegerTruncationMode): Number;
+extern transitioning macro ToLength_Inline(implicit context: Context)(JSAny):
+    Number;
+extern transitioning macro ToNumber_Inline(implicit context: Context)(JSAny):
+    Number;
+extern transitioning macro ToString_Inline(implicit context: Context)(JSAny):
+    String;
 extern transitioning macro ToThisString(implicit context: Context)(
     JSAny, String): String;
 extern transitioning macro ToThisValue(implicit context: Context)(
@@ -1834,7 +454,7 @@ extern transitioning builtin SetProperty(implicit context: Context)(
 extern transitioning builtin SetPropertyInLiteral(implicit context: Context)(
     JSAny, JSAny, JSAny);
 extern transitioning builtin DeleteProperty(implicit context: Context)(
-    JSAny, JSAny | PrivateSymbol, LanguageMode): Boolean;
+    JSAny, JSAny | PrivateSymbol, LanguageModeSmi): Boolean;
 extern transitioning builtin HasProperty(implicit context: Context)(
     JSAny, JSAny): Boolean;
 extern transitioning macro HasProperty_Inline(implicit context: Context)(
@@ -1861,8 +481,6 @@ extern transitioning runtime ThrowTypeErrorIfStrict(implicit context: Context)(
     Smi, Object, Object): void;
 extern transitioning runtime ThrowCalledNonCallable(implicit context: Context)(
     JSAny): never;
-extern transitioning runtime ThrowSymbolIteratorInvalid(
-    implicit context: Context)(): never;
 
 extern transitioning macro ThrowIfNotJSReceiver(implicit context: Context)(
     JSAny, constexpr MessageTemplate, constexpr string): void;
@@ -1872,10 +490,10 @@ extern macro ArrayCreate(implicit context: Context)(Number): JSArray;
 extern macro BuildAppendJSArray(
     constexpr ElementsKind, FastJSArray, JSAny): void labels Bailout;
 
-extern macro EnsureArrayPushable(Map): ElementsKind
+extern macro EnsureArrayPushable(implicit context: Context)(Map): ElementsKind
     labels Bailout;
-extern macro EnsureArrayLengthWritable(Map) labels Bailout;
 // TODO: Reduce duplication once varargs are supported in macros.
+extern macro Construct(implicit context: Context)(Constructor): JSReceiver;
 extern macro Construct(implicit context: Context)(
     Constructor, JSAny): JSReceiver;
 extern macro Construct(implicit context: Context)(
@@ -1929,13 +547,14 @@ extern macro LoadBufferSmi(RawPtr, constexpr int32): Smi;
 
 extern runtime StringEqual(Context, String, String): Oddball;
 extern builtin StringLessThan(Context, String, String): Boolean;
-extern macro StringCharCodeAt(String, intptr): int32;
+extern macro StringCharCodeAt(String, uintptr): int32;
 extern runtime StringCompareSequence(Context, String, String, Number): Boolean;
 extern macro StringFromSingleCharCode(int32): String;
 
 extern macro StrictEqual(JSAny, JSAny): Boolean;
 extern macro SmiLexicographicCompare(Smi, Smi): Smi;
 extern runtime ReThrow(Context, JSAny): never;
+extern runtime Throw(implicit context: Context)(JSAny): never;
 extern runtime ThrowInvalidStringLength(Context): never;
 
 extern operator '==' macro WordEqual(RawPtr, RawPtr): bool;
@@ -1970,6 +589,9 @@ extern macro IsElementsKindLessThanOrEqual(
     ElementsKind, constexpr ElementsKind): bool;
 extern macro IsElementsKindGreaterThan(
     ElementsKind, constexpr ElementsKind): bool;
+extern macro IsElementsKindInRange(
+    ElementsKind, constexpr ElementsKind, constexpr ElementsKind): bool;
+
 extern macro IsFastElementsKind(constexpr ElementsKind): constexpr bool;
 extern macro IsDoubleElementsKind(constexpr ElementsKind): constexpr bool;
 
@@ -2001,7 +623,9 @@ extern operator '~' macro ConstexprWordNot(constexpr uintptr):
 extern operator '==' macro Float64Equal(float64, float64): bool;
 extern operator '!=' macro Float64NotEqual(float64, float64): bool;
 extern operator '>' macro Float64GreaterThan(float64, float64): bool;
+extern operator '>=' macro Float64GreaterThanOrEqual(float64, float64): bool;
 extern operator '<' macro Float64LessThan(float64, float64): bool;
+extern operator '<=' macro Float64LessThanOrEqual(float64, float64): bool;
 
 extern macro BranchIfNumberEqual(Number, Number): never
     labels Taken, NotTaken;
@@ -2036,21 +660,22 @@ macro Float64IsNaN(n: float64): bool {
 }
 
 // The type of all tagged values that can safely be compared with TaggedEqual.
-type TaggedWithIdentity =
-    JSReceiver | FixedArrayBase | Oddball | Map | EmptyString;
+type TaggedWithIdentity = JSReceiver|FixedArrayBase|Oddball|Map|EmptyString;
 
 extern operator '==' macro TaggedEqual(TaggedWithIdentity, Object): bool;
 extern operator '==' macro TaggedEqual(Object, TaggedWithIdentity): bool;
 extern operator '==' macro TaggedEqual(
     TaggedWithIdentity, TaggedWithIdentity): bool;
+extern operator '==' macro TaggedEqual(WeakHeapObject, WeakHeapObject): bool;
 extern operator '!=' macro TaggedNotEqual(TaggedWithIdentity, Object): bool;
 extern operator '!=' macro TaggedNotEqual(Object, TaggedWithIdentity): bool;
 extern operator '!=' macro TaggedNotEqual(
     TaggedWithIdentity, TaggedWithIdentity): bool;
+extern operator '!=' macro TaggedNotEqual(WeakHeapObject, WeakHeapObject): bool;
 // Do not overload == and != if it is unclear if object identity is the right
 // equality.
-extern macro TaggedEqual(Object, Object): bool;
-extern macro TaggedNotEqual(Object, Object): bool;
+extern macro TaggedEqual(MaybeObject, MaybeObject): bool;
+extern macro TaggedNotEqual(MaybeObject, MaybeObject): bool;
 
 extern operator '+' macro SmiAdd(Smi, Smi): Smi;
 extern operator '-' macro SmiSub(Smi, Smi): Smi;
@@ -2134,6 +759,8 @@ extern macro TryIntPtrAdd(intptr, intptr): intptr labels Overflow;
 extern macro TryIntPtrSub(intptr, intptr): intptr labels Overflow;
 extern macro TryInt32Mul(int32, int32): int32 labels Overflow;
 
+extern operator '<' macro ConstexprUintPtrLessThan(
+    constexpr uintptr, constexpr uintptr): constexpr bool;
 extern operator '<<' macro ConstexprUintPtrShl(
     constexpr uintptr, constexpr int31): constexpr uintptr;
 extern operator '>>>' macro ConstexprUintPtrShr(
@@ -2146,6 +773,7 @@ extern macro SmiMod(Smi, Smi): Number;
 
 extern macro IntPtrMax(intptr, intptr): intptr;
 extern macro IntPtrMin(intptr, intptr): intptr;
+extern macro UintPtrMin(uintptr, uintptr): uintptr;
 
 extern operator '!' macro ConstexprBoolNot(constexpr bool): constexpr bool;
 extern operator '!' macro Word32BinaryNot(bool): bool;
@@ -2154,7 +782,15 @@ extern operator '!' macro IsFalse(Boolean): bool;
 extern operator '.instanceType' macro LoadInstanceType(HeapObject):
     InstanceType;
 
+operator '.length_uintptr' macro LoadJSArrayLengthAsUintPtr(array: JSArray):
+    uintptr {
+  return Convert<uintptr>(array.length);
+}
+
 extern operator '.length_intptr' macro LoadStringLengthAsWord(String): intptr;
+operator '.length_uintptr' macro LoadStringLengthAsUintPtr(s: String): uintptr {
+  return Unsigned(s.length_intptr);
+}
 extern operator '.length_uint32' macro LoadStringLengthAsWord32(String): uint32;
 extern operator '.length_smi' macro LoadStringLengthAsSmi(String): Smi;
 
@@ -2165,6 +801,11 @@ operator '+' macro StringAdd(implicit context: Context)(
   return StringAdd_CheckNone(a, b);
 }
 
+operator '==' macro PromiseStateEquals(
+    s1: PromiseState, s2: PromiseState): bool {
+  return Word32Equal(s1, s2);
+}
+
 extern macro TaggedIsSmi(Object): bool;
 extern macro TaggedIsNotSmi(Object): bool;
 extern macro TaggedIsPositiveSmi(Object): bool;
@@ -2172,539 +813,6 @@ extern macro IsValidPositiveSmi(intptr): bool;
 
 extern macro IsInteger(HeapNumber): bool;
 
-extern macro HeapObjectToJSDataView(HeapObject): JSDataView
-    labels CastError;
-extern macro HeapObjectToJSProxy(HeapObject): JSProxy
-    labels CastError;
-extern macro HeapObjectToJSStringIterator(HeapObject): JSStringIterator
-    labels CastError;
-extern macro HeapObjectToJSArrayBuffer(HeapObject): JSArrayBuffer
-    labels CastError;
-extern macro TaggedToHeapObject(Object): HeapObject
-    labels CastError;
-extern macro TaggedToSmi(Object): Smi
-    labels CastError;
-extern macro TaggedToPositiveSmi(Object): PositiveSmi
-    labels CastError;
-extern macro TaggedToDirectString(Object): DirectString
-    labels CastError;
-extern macro HeapObjectToJSArray(HeapObject): JSArray
-    labels CastError;
-extern macro HeapObjectToCallable(HeapObject): Callable
-    labels CastError;
-extern macro HeapObjectToFixedArray(HeapObject): FixedArray
-    labels CastError;
-extern macro HeapObjectToFixedDoubleArray(HeapObject): FixedDoubleArray
-    labels CastError;
-extern macro HeapObjectToString(HeapObject): String
-    labels CastError;
-extern macro HeapObjectToConstructor(HeapObject): Constructor
-    labels CastError;
-extern macro HeapObjectToHeapNumber(HeapObject): HeapNumber
-    labels CastError;
-extern macro HeapObjectToSloppyArgumentsElements(HeapObject):
-    SloppyArgumentsElements
-    labels CastError;
-extern macro HeapObjectToRegExpMatchInfo(HeapObject):
-    RegExpMatchInfo labels CastError;
-extern macro TaggedToNumber(Object): Number
-    labels CastError;
-
-macro Cast<A: type>(implicit context: Context)(o: Object): A
-    labels CastError {
-  return Cast<A>(TaggedToHeapObject(o) otherwise CastError)
-      otherwise CastError;
-}
-
-Cast<Smi>(o: Object): Smi
-    labels CastError {
-  return TaggedToSmi(o) otherwise CastError;
-}
-
-Cast<PositiveSmi>(o: Object): PositiveSmi
-    labels CastError {
-  return TaggedToPositiveSmi(o) otherwise CastError;
-}
-
-Cast<Number>(o: Object): Number
-    labels CastError {
-  return TaggedToNumber(o) otherwise CastError;
-}
-
-Cast<Undefined>(o: Object): Undefined
-    labels CastError {
-  if (o != Undefined) goto CastError;
-  return %RawDownCast<Undefined>(o);
-}
-
-Cast<Numeric>(o: Object): Numeric labels CastError {
-  typeswitch (o) {
-    case (o: Number): {
-      return o;
-    }
-    case (o: BigInt): {
-      return o;
-    }
-    case (HeapObject): {
-      goto CastError;
-    }
-  }
-}
-
-Cast<TheHole>(o: Object): TheHole labels CastError {
-  if (o == TheHole) return %RawDownCast<TheHole>(o);
-  goto CastError;
-}
-
-Cast<TheHole>(o: HeapObject): TheHole labels CastError {
-  const o: Object = o;
-  return Cast<TheHole>(o) otherwise CastError;
-}
-
-Cast<True>(o: Object): True labels CastError {
-  if (o == True) return %RawDownCast<True>(o);
-  goto CastError;
-}
-
-Cast<True>(o: HeapObject): True labels CastError {
-  const o: Object = o;
-  return Cast<True>(o) otherwise CastError;
-}
-
-Cast<False>(o: Object): False labels CastError {
-  if (o == False) return %RawDownCast<False>(o);
-  goto CastError;
-}
-
-Cast<False>(o: HeapObject): False labels CastError {
-  const o: Object = o;
-  return Cast<False>(o) otherwise CastError;
-}
-
-Cast<Boolean>(o: Object): Boolean labels CastError {
-  typeswitch (o) {
-    case (o: True): {
-      return o;
-    }
-    case (o: False): {
-      return o;
-    }
-    case (Object): {
-      goto CastError;
-    }
-  }
-}
-
-Cast<Boolean>(o: HeapObject): Boolean labels CastError {
-  const o: Object = o;
-  return Cast<Boolean>(o) otherwise CastError;
-}
-
-// TODO(tebbi): These trivial casts for union types should be generated
-// automatically.
-
-Cast<JSPrimitive>(o: Object): JSPrimitive labels CastError {
-  typeswitch (o) {
-    case (o: Numeric): {
-      return o;
-    }
-    case (o: String): {
-      return o;
-    }
-    case (o: Symbol): {
-      return o;
-    }
-    case (o: Boolean): {
-      return o;
-    }
-    case (o: Undefined): {
-      return o;
-    }
-    case (o: Null): {
-      return o;
-    }
-    case (Object): {
-      goto CastError;
-    }
-  }
-}
-
-Cast<JSAny>(o: Object): JSAny labels CastError {
-  typeswitch (o) {
-    case (o: JSPrimitive): {
-      return o;
-    }
-    case (o: JSReceiver): {
-      return o;
-    }
-    case (Object): {
-      goto CastError;
-    }
-  }
-}
-
-Cast<JSAny | TheHole>(o: Object): JSAny | TheHole labels CastError {
-  typeswitch (o) {
-    case (o: JSAny): {
-      return o;
-    }
-    case (o: TheHole): {
-      return o;
-    }
-    case (Object): {
-      goto CastError;
-    }
-  }
-}
-
-Cast<Number | TheHole>(o: Object): Number | TheHole labels CastError {
-  typeswitch (o) {
-    case (o: Number): {
-      return o;
-    }
-    case (o: TheHole): {
-      return o;
-    }
-    case (Object): {
-      goto CastError;
-    }
-  }
-}
-
-macro Cast<A: type>(o: HeapObject): A
-    labels CastError;
-
-Cast<HeapObject>(o: HeapObject): HeapObject
-labels _CastError {
-  return o;
-}
-
-Cast<Null>(o: HeapObject): Null
-    labels CastError {
-  if (o != Null) goto CastError;
-  return %RawDownCast<Null>(o);
-}
-
-Cast<Undefined>(o: HeapObject): Undefined
-    labels CastError {
-  const o: Object = o;
-  return Cast<Undefined>(o) otherwise CastError;
-}
-
-Cast<FixedArray>(o: HeapObject): FixedArray
-    labels CastError {
-  return HeapObjectToFixedArray(o) otherwise CastError;
-}
-
-Cast<FixedDoubleArray>(o: HeapObject): FixedDoubleArray
-    labels CastError {
-  return HeapObjectToFixedDoubleArray(o) otherwise CastError;
-}
-
-Cast<SloppyArgumentsElements>(o: HeapObject): SloppyArgumentsElements
-    labels CastError {
-  return HeapObjectToSloppyArgumentsElements(o) otherwise CastError;
-}
-
-Cast<JSDataView>(o: HeapObject): JSDataView
-    labels CastError {
-  return HeapObjectToJSDataView(o) otherwise CastError;
-}
-
-Cast<JSProxy>(o: HeapObject): JSProxy
-    labels CastError {
-  return HeapObjectToJSProxy(o) otherwise CastError;
-}
-
-Cast<JSStringIterator>(o: HeapObject): JSStringIterator
-    labels CastError {
-  return HeapObjectToJSStringIterator(o) otherwise CastError;
-}
-
-Cast<JSRegExpStringIterator>(o: HeapObject): JSRegExpStringIterator
-    labels CastError {
-  if (IsJSRegExpStringIterator(o)) {
-    return %RawDownCast<JSRegExpStringIterator>(o);
-  }
-  goto CastError;
-}
-
-Cast<JSTypedArray>(o: HeapObject): JSTypedArray
-    labels CastError {
-  if (IsJSTypedArray(o)) return %RawDownCast<JSTypedArray>(o);
-  goto CastError;
-}
-
-Cast<JSTypedArray>(implicit context: Context)(o: Object): JSTypedArray
-    labels CastError {
-  const heapObject = Cast<HeapObject>(o) otherwise CastError;
-  return Cast<JSTypedArray>(heapObject) otherwise CastError;
-}
-
-Cast<Callable>(o: HeapObject): Callable
-    labels CastError {
-  return HeapObjectToCallable(o) otherwise CastError;
-}
-
-Cast<Undefined | Callable>(o: HeapObject): Undefined | Callable
-    labels CastError {
-  if (o == Undefined) return Undefined;
-  return HeapObjectToCallable(o) otherwise CastError;
-}
-
-Cast<JSArray>(o: HeapObject): JSArray
-    labels CastError {
-  return HeapObjectToJSArray(o) otherwise CastError;
-}
-
-Cast<JSArrayBuffer>(o: HeapObject): JSArrayBuffer
-    labels CastError {
-  return HeapObjectToJSArrayBuffer(o) otherwise CastError;
-}
-
-Cast<Context>(o: HeapObject): Context
-    labels CastError {
-  if (IsContext(o)) return %RawDownCast<Context>(o);
-  goto CastError;
-}
-
-Cast<NativeContext>(o: HeapObject): NativeContext
-    labels CastError {
-  if (IsNativeContext(o)) return %RawDownCast<NativeContext>(o);
-  goto CastError;
-}
-
-Cast<JSObject>(o: HeapObject): JSObject
-    labels CastError {
-  if (IsJSObject(o)) return %RawDownCast<JSObject>(o);
-  goto CastError;
-}
-
-Cast<NumberDictionary>(o: HeapObject): NumberDictionary
-    labels CastError {
-  if (IsNumberDictionary(o)) return %RawDownCast<NumberDictionary>(o);
-  goto CastError;
-}
-
-Cast<String>(o: HeapObject): String
-    labels CastError {
-  return HeapObjectToString(o) otherwise CastError;
-}
-
-Cast<Oddball>(o: HeapObject): Oddball
-    labels CastError {
-  if (IsOddball(o)) return %RawDownCast<Oddball>(o);
-  goto CastError;
-}
-
-Cast<Symbol>(o: HeapObject): Symbol
-    labels CastError {
-  if (IsSymbol(o)) return %RawDownCast<Symbol>(o);
-  goto CastError;
-}
-
-macro Cast<T: type>(o: Symbol): T labels CastError;
-Cast<PublicSymbol>(o: Symbol): PublicSymbol labels CastError {
-  if (IsPrivateSymbol(o)) goto CastError;
-  return %RawDownCast<PublicSymbol>(o);
-}
-Cast<PrivateSymbol>(o: Symbol): PrivateSymbol labels CastError {
-  if (IsPrivateSymbol(o)) {
-    return %RawDownCast<PrivateSymbol>(o);
-  }
-  goto CastError;
-}
-
-Cast<PublicSymbol>(o: HeapObject): PublicSymbol labels CastError {
-  const o = Cast<Symbol>(o) otherwise CastError;
-  return Cast<PublicSymbol>(o) otherwise CastError;
-}
-Cast<PrivateSymbol>(o: HeapObject): PrivateSymbol labels CastError {
-  const o = Cast<Symbol>(o) otherwise CastError;
-  return Cast<PrivateSymbol>(o) otherwise CastError;
-}
-
-Cast<DirectString>(o: HeapObject): DirectString
-    labels CastError {
-  return TaggedToDirectString(o) otherwise CastError;
-}
-
-Cast<Constructor>(o: HeapObject): Constructor
-    labels CastError {
-  return HeapObjectToConstructor(o) otherwise CastError;
-}
-
-Cast<HeapNumber>(o: HeapObject): HeapNumber
-    labels CastError {
-  if (IsHeapNumber(o)) return %RawDownCast<HeapNumber>(o);
-  goto CastError;
-}
-
-Cast<BigInt>(o: HeapObject): BigInt labels CastError {
-  if (IsBigInt(o)) return %RawDownCast<BigInt>(o);
-  goto CastError;
-}
-
-Cast<JSRegExp>(o: HeapObject): JSRegExp
-    labels CastError {
-  if (IsJSRegExp(o)) return %RawDownCast<JSRegExp>(o);
-  goto CastError;
-}
-
-Cast<FastJSRegExpResult>(implicit context: Context)(o: HeapObject):
-    FastJSRegExpResult
-    labels CastError {
-  if (regexp::IsFastRegExpResult(o)) return %RawDownCast<FastJSRegExpResult>(o);
-  goto CastError;
-}
-
-Cast<Map>(implicit context: Context)(o: HeapObject): Map
-    labels CastError {
-  if (IsMap(o)) return %RawDownCast<Map>(o);
-  goto CastError;
-}
-
-Cast<FeedbackVector>(implicit context: Context)(o: HeapObject): FeedbackVector
-    labels CastError {
-  if (IsFeedbackVector(o)) return %RawDownCast<FeedbackVector>(o);
-  goto CastError;
-}
-
-Cast<JSPrimitiveWrapper>(o: HeapObject): JSPrimitiveWrapper
-    labels CastError {
-  if (IsJSPrimitiveWrapper(o)) return %RawDownCast<JSPrimitiveWrapper>(o);
-  goto CastError;
-}
-
-Cast<JSArgumentsObjectWithLength>(implicit context: Context)(o: HeapObject):
-    JSArgumentsObjectWithLength
-    labels CastError {
-  const map: Map = o.map;
-  try {
-    if (IsFastAliasedArgumentsMap(map)) goto True;
-    if (IsSloppyArgumentsMap(map)) goto True;
-    if (IsStrictArgumentsMap(map)) goto True;
-    if (IsSlowAliasedArgumentsMap(map)) goto True;
-    goto CastError;
-  }
-  label True {
-    return %RawDownCast<JSArgumentsObjectWithLength>(o);
-  }
-}
-
-Cast<FastJSRegExp>(implicit context: Context)(o: HeapObject): FastJSRegExp
-    labels CastError {
-  // TODO(jgruber): Remove or redesign this. There is no single 'fast' regexp,
-  // the conditions to make a regexp object fast differ based on the callsite.
-  // For now, run the strict variant since replace (the only current callsite)
-  // accesses flag getters.
-  if (regexp::IsFastRegExpStrict(o)) {
-    return %RawDownCast<FastJSRegExp>(o);
-  }
-  goto CastError;
-}
-
-Cast<FastJSArray>(implicit context: Context)(o: HeapObject): FastJSArray
-    labels CastError {
-  const map: Map = o.map;
-  if (!IsJSArrayMap(map)) goto CastError;
-
-  // Bailout if receiver has slow elements.
-  const elementsKind: ElementsKind = LoadMapElementsKind(map);
-  if (!IsFastElementsKind(elementsKind)) goto CastError;
-
-  // Verify that our prototype is the initial array prototype.
-  if (!IsPrototypeInitialArrayPrototype(map)) goto CastError;
-
-  if (IsNoElementsProtectorCellInvalid()) goto CastError;
-  return %RawDownCast<FastJSArray>(o);
-}
-
-Cast<FastJSArrayForRead>(implicit context: Context)(o: HeapObject):
-    FastJSArrayForRead
-    labels CastError {
-  const map: Map = o.map;
-  if (!IsJSArrayMap(map)) goto CastError;
-
-  // Bailout if receiver has slow elements.
-  const elementsKind: ElementsKind = LoadMapElementsKind(map);
-  if (!IsElementsKindLessThanOrEqual(
-          elementsKind, LAST_ANY_NONEXTENSIBLE_ELEMENTS_KIND))
-    goto CastError;
-
-  // Verify that our prototype is the initial array prototype.
-  if (!IsPrototypeInitialArrayPrototype(map)) goto CastError;
-
-  if (IsNoElementsProtectorCellInvalid()) goto CastError;
-  return %RawDownCast<FastJSArrayForRead>(o);
-}
-
-Cast<FastJSArrayForCopy>(implicit context: Context)(o: HeapObject):
-    FastJSArrayForCopy
-    labels CastError {
-  if (IsArraySpeciesProtectorCellInvalid()) goto CastError;
-  const a = Cast<FastJSArray>(o) otherwise CastError;
-  return %RawDownCast<FastJSArrayForCopy>(a);
-}
-
-Cast<FastJSArrayWithNoCustomIteration>(implicit context: Context)(
-    o: HeapObject): FastJSArrayWithNoCustomIteration
-    labels CastError {
-  if (IsArrayIteratorProtectorCellInvalid()) goto CastError;
-  const a = Cast<FastJSArray>(o) otherwise CastError;
-  return %RawDownCast<FastJSArrayWithNoCustomIteration>(a);
-}
-
-Cast<FastJSArrayForReadWithNoCustomIteration>(implicit context: Context)(
-    o: HeapObject): FastJSArrayForReadWithNoCustomIteration
-    labels CastError {
-  if (IsArrayIteratorProtectorCellInvalid()) goto CastError;
-  const a = Cast<FastJSArrayForRead>(o) otherwise CastError;
-  return %RawDownCast<FastJSArrayForReadWithNoCustomIteration>(a);
-}
-
-Cast<JSReceiver>(o: HeapObject): JSReceiver
-    labels CastError {
-  if (IsJSReceiver(o)) return %RawDownCast<JSReceiver>(o);
-  goto CastError;
-}
-
-Cast<JSFunction>(implicit context: Context)(o: HeapObject): JSFunction
-    labels CastError {
-  if (IsJSFunction(o)) return %RawDownCast<JSFunction>(o);
-  goto CastError;
-}
-
-extern macro IsDebugInfo(HeapObject): bool;
-Cast<DebugInfo>(implicit context: Context)(o: HeapObject): DebugInfo
-    labels CastError {
-  if (IsDebugInfo(o)) return %RawDownCast<DebugInfo>(o);
-  goto CastError;
-}
-
-extern macro IsCoverageInfo(HeapObject): bool;
-Cast<CoverageInfo>(implicit context: Context)(o: HeapObject): CoverageInfo
-    labels CastError {
-  // TODO(jgruber): Assign an instance type.
-  if (IsFixedArray(o)) return %RawDownCast<CoverageInfo>(o);
-  goto CastError;
-}
-
-Cast<JSReceiver | Null>(o: HeapObject): JSReceiver | Null
-    labels CastError {
-  typeswitch (o) {
-    case (o: Null): {
-      return o;
-    }
-    case (o: JSReceiver): {
-      return o;
-    }
-    case (HeapObject): {
-      goto CastError;
-    }
-  }
-}
-
 extern macro AllocateHeapNumberWithValue(float64): HeapNumber;
 extern macro ChangeInt32ToTagged(int32): Number;
 extern macro ChangeUint32ToTagged(uint32): Number;
@@ -2729,7 +837,9 @@ extern macro SmiToInt32(Smi): int32;
 extern macro RoundIntPtrToFloat64(intptr): float64;
 extern macro ChangeFloat32ToFloat64(float32): float64;
 extern macro ChangeNumberToFloat64(Number): float64;
+extern macro ChangeFloat64ToTagged(float64): Number;
 extern macro ChangeFloat64ToUintPtr(float64): uintptr;
+extern macro ChangeFloat64ToIntPtr(float64): intptr;
 extern macro ChangeInt32ToIntPtr(int32): intptr;   // Sign-extends.
 extern macro ChangeUint32ToWord(uint32): uintptr;  // Doesn't sign-extend.
 extern macro LoadNativeContext(Context): NativeContext;
@@ -2737,8 +847,6 @@ extern macro TruncateFloat64ToFloat32(float64): float32;
 extern macro TruncateHeapNumberValueToWord32(HeapNumber): int32;
 extern macro LoadJSArrayElementsMap(constexpr ElementsKind, NativeContext): Map;
 extern macro LoadJSArrayElementsMap(ElementsKind, NativeContext): Map;
-extern macro ChangeNonnegativeNumberToUintPtr(Number): uintptr;
-extern macro TryNumberToUintPtr(Number): uintptr labels IfNegative;
 extern macro NumberConstant(constexpr float64): Number;
 extern macro NumberConstant(constexpr int32): Number;
 extern macro NumberConstant(constexpr uint32): Number;
@@ -2751,11 +859,10 @@ extern macro Float64Constant(constexpr float64): float64;
 extern macro SmiConstant(constexpr int31): Smi;
 extern macro SmiConstant(constexpr Smi): Smi;
 extern macro SmiConstant(constexpr MessageTemplate): Smi;
-extern macro SmiConstant(constexpr LanguageMode): Smi;
+extern macro SmiConstant(constexpr bool): Smi;
+extern macro SmiConstant(constexpr uint32): Smi;
 extern macro BoolConstant(constexpr bool): bool;
 extern macro StringConstant(constexpr string): String;
-extern macro Int32Constant(constexpr ElementsKind): ElementsKind;
-extern macro IntPtrConstant(constexpr NativeContextSlot): NativeContextSlot;
 extern macro IntPtrConstant(constexpr ContextSlot): ContextSlot;
 extern macro IntPtrConstant(constexpr intptr): intptr;
 extern macro PointerConstant(constexpr RawPtr): RawPtr;
@@ -2769,248 +876,39 @@ extern macro BitcastWordToTagged(uintptr): Object;
 extern macro BitcastTaggedToWord(Tagged): intptr;
 extern macro BitcastTaggedToWordForTagAndSmiBits(Tagged): intptr;
 
-intrinsic %FromConstexpr<To: type, From: type>(b: From): To;
-macro FromConstexpr<To: type, From: type>(o: From): To;
-FromConstexpr<int31, constexpr int31>(i: constexpr int31): int31 {
-  return %FromConstexpr<int31>(i);
-}
-FromConstexpr<int32, constexpr int31>(i: constexpr int31): int32 {
-  return %FromConstexpr<int32>(i);
-}
-FromConstexpr<int32, constexpr int32>(i: constexpr int32): int32 {
-  return %FromConstexpr<int32>(i);
-}
-FromConstexpr<intptr, constexpr int31>(i: constexpr int31): intptr {
-  return %FromConstexpr<intptr>(i);
-}
-FromConstexpr<intptr, constexpr int32>(i: constexpr int32): intptr {
-  return %FromConstexpr<intptr>(i);
-}
-FromConstexpr<intptr, constexpr intptr>(i: constexpr intptr): intptr {
-  return %FromConstexpr<intptr>(i);
-}
-FromConstexpr<uintptr, constexpr uintptr>(i: constexpr uintptr): uintptr {
-  return %FromConstexpr<uintptr>(i);
-}
-FromConstexpr<Smi, constexpr int31>(i: constexpr int31): Smi {
-  return %FromConstexpr<Smi>(i);
-}
-FromConstexpr<PositiveSmi, constexpr int31>(i: constexpr int31): PositiveSmi {
-  assert(i >= 0);
-  return %FromConstexpr<PositiveSmi>(i);
-}
-FromConstexpr<String, constexpr string>(s: constexpr string): String {
-  return %FromConstexpr<String>(s);
-}
-FromConstexpr<Number, constexpr uint32>(i: constexpr uint32): Number {
-  return %FromConstexpr<Number>(i);
-}
-FromConstexpr<Number, constexpr int32>(i: constexpr int32): Number {
-  return %FromConstexpr<Number>(i);
-}
-FromConstexpr<Number, constexpr float64>(f: constexpr float64): Number {
-  return %FromConstexpr<Number>(f);
-}
-FromConstexpr<Number, constexpr int31>(i: constexpr int31): Number {
-  return %FromConstexpr<Number>(i);
-}
-FromConstexpr<Number, constexpr Smi>(s: constexpr Smi): Number {
-  return SmiConstant(s);
-}
-FromConstexpr<Smi, constexpr Smi>(s: constexpr Smi): Smi {
-  return SmiConstant(s);
-}
-FromConstexpr<uint32, constexpr int31>(i: constexpr int31): uint32 {
-  return Unsigned(Int32Constant(i));
-}
-FromConstexpr<uintptr, constexpr int31>(i: constexpr int31): uintptr {
-  return ChangeUint32ToWord(i);
-}
-FromConstexpr<float64, constexpr int31>(i: constexpr int31): float64 {
-  return Float64Constant(i);
-}
-FromConstexpr<float64, constexpr float64>(i: constexpr float64): float64 {
-  return Float64Constant(i);
-}
-FromConstexpr<bool, constexpr bool>(b: constexpr bool): bool {
-  return BoolConstant(b);
-}
-FromConstexpr<LanguageMode, constexpr LanguageMode>(m: constexpr LanguageMode):
-    LanguageMode {
-  return %RawDownCast<LanguageMode>(%FromConstexpr<Smi>(m));
-}
-FromConstexpr<ElementsKind, constexpr ElementsKind>(e: constexpr ElementsKind):
-    ElementsKind {
-  return Int32Constant(e);
-}
-FromConstexpr<Object, constexpr string>(s: constexpr string): Object {
-  return StringConstant(s);
-}
-FromConstexpr<JSAny, constexpr string>(s: constexpr string): JSAny {
-  return StringConstant(s);
-}
-FromConstexpr<NativeContextSlot, constexpr NativeContextSlot>(
-    c: constexpr NativeContextSlot): NativeContextSlot {
-  return IntPtrConstant(c);
-}
-FromConstexpr<ContextSlot, constexpr ContextSlot>(c: constexpr ContextSlot):
-    ContextSlot {
-  return IntPtrConstant(c);
-}
-
-macro Convert<To: type, From: type>(i: From): To {
-  return i;
-}
-
-macro Convert<To: type, From: type>(i: From): To labels Overflow {
-  return i;
-}
-
-extern macro ConvertElementsKindToInt(ElementsKind): int32;
-Convert<int32, ElementsKind>(elementsKind: ElementsKind): int32 {
-  return ConvertElementsKindToInt(elementsKind);
-}
-Convert<Number, int32>(i: int32): Number {
-  return ChangeInt32ToTagged(i);
-}
-Convert<intptr, int32>(i: int32): intptr {
-  return ChangeInt32ToIntPtr(i);
-}
-Convert<intptr, uint32>(i: uint32): intptr {
-  return Signed(ChangeUint32ToWord(i));
-}
-Convert<Smi, int32>(i: int32): Smi {
-  return SmiFromInt32(i);
-}
-Convert<Number, uint32>(ui: uint32): Number {
-  return ChangeUint32ToTagged(ui);
-}
-Convert<Smi, uint32>(ui: uint32): Smi {
-  return SmiFromUint32(ui);
-}
-Convert<uintptr, uint32>(ui: uint32): uintptr {
-  return ChangeUint32ToWord(ui);
-}
-Convert<int32, uint8>(i: uint8): int32 {
-  return Signed(Convert<uint32>(i));
-}
-Convert<int32, uint16>(i: uint16): int32 {
-  return Signed(Convert<uint32>(i));
-}
-Convert<int32, uint31>(i: uint31): int32 {
-  return Signed(Convert<uint32>(i));
-}
-Convert<int32, intptr>(i: intptr): int32 {
-  return TruncateIntPtrToInt32(i);
-}
-Convert<Smi, intptr>(i: intptr): Smi {
-  return SmiTag(i);
-}
-Convert<uint32, uintptr>(ui: uintptr): uint32 {
-  return Unsigned(TruncateIntPtrToInt32(Signed(ui)));
-}
-Convert<intptr, Smi>(s: Smi): intptr {
-  return SmiUntag(s);
-}
-Convert<uintptr, PositiveSmi>(ps: PositiveSmi): uintptr {
-  return Unsigned(SmiUntag(ps));
-}
-Convert<intptr, uintptr>(ui: uintptr): intptr {
-  const i = Signed(ui);
-  assert(i >= 0);
-  return i;
-}
-Convert<PositiveSmi, intptr>(i: intptr): PositiveSmi {
-  assert(IsValidPositiveSmi(i));
-  return %RawDownCast<PositiveSmi>(SmiTag(i));
-}
-Convert<PositiveSmi, uintptr>(ui: uintptr): PositiveSmi labels IfOverflow {
-  if (ui > kSmiMaxValue) deferred {
-      goto IfOverflow;
-    }
-  return %RawDownCast<PositiveSmi>(SmiTag(Signed(ui)));
-}
-Convert<PositiveSmi, intptr>(i: intptr): PositiveSmi labels IfOverflow {
-  if (IsValidPositiveSmi(i)) {
-    return %RawDownCast<PositiveSmi>(SmiTag(i));
-  } else
-    deferred {
-      goto IfOverflow;
-    }
-}
-Convert<int32, Smi>(s: Smi): int32 {
-  return SmiToInt32(s);
-}
-Convert<float64, HeapNumber>(h: HeapNumber): float64 {
-  return LoadHeapNumberValue(h);
-}
-Convert<float64, Number>(n: Number): float64 {
-  return ChangeNumberToFloat64(n);
-}
-Convert<uintptr, Number>(n: Number): uintptr {
-  return ChangeNonnegativeNumberToUintPtr(n);
-}
-Convert<float64, float32>(f: float32): float64 {
-  return ChangeFloat32ToFloat64(f);
-}
-Convert<float32, float64>(f: float64): float32 {
-  return TruncateFloat64ToFloat32(f);
-}
-Convert<float32, Number>(n: Number): float32 {
-  return Convert<float32>(ChangeNumberToFloat64(n));
-}
-Convert<Number, float64>(d: float64): Number {
-  return AllocateHeapNumberWithValue(d);
-}
-Convert<float64, uintptr>(ui: uintptr): float64 {
-  return ChangeUintPtrToFloat64(ui);
-}
-Convert<Number, uintptr>(ui: uintptr): Number {
-  return ChangeUintPtrToTagged(ui);
-}
-Convert<uintptr, float64>(d: float64): uintptr {
-  return ChangeFloat64ToUintPtr(d);
-}
-Convert<uintptr, intptr>(i: intptr): uintptr {
-  return Unsigned(i);
-}
-Convert<uintptr, RawPtr>(r: RawPtr): uintptr {
-  return Unsigned(r);
-}
-Convert<intptr, RawPtr>(r: RawPtr): intptr {
-  return Signed(r);
-}
-Convert<bint, int32>(v: int32): bint {
-  return IntPtrToBInt(Convert<intptr>(v));
-}
-extern macro IntPtrToBInt(intptr): bint;
-Convert<bint, intptr>(v: intptr): bint {
-  return IntPtrToBInt(v);
-}
-extern macro SmiToBInt(Smi): bint;
-Convert<bint, Smi>(v: Smi): bint {
-  return SmiToBInt(v);
-}
-
-macro Is<A: type, B: type>(implicit context: Context)(o: B): bool {
+macro Is<A : type extends Object, B : type extends Object>(
+    implicit context: Context)(o: B): bool {
   Cast<A>(o) otherwise return false;
   return true;
 }
 
-macro UnsafeCast<A: type>(implicit context: Context)(o: Object): A {
+macro UnsafeCast<A : type extends Object>(implicit context: Context)(o: Object):
+    A {
   assert(Is<A>(o));
   return %RawDownCast<A>(o);
 }
 
 extern macro FixedArrayMapConstant(): Map;
+extern macro FixedDoubleArrayMapConstant(): Map;
 extern macro FixedCOWArrayMapConstant(): Map;
 extern macro EmptyByteArrayConstant(): ByteArray;
-extern macro EmptyFixedArrayConstant(): FixedArray;
+extern macro EmptyFixedArrayConstant(): EmptyFixedArray;
+extern macro PromiseCapabilityMapConstant(): Map;
+extern macro OneByteStringMapConstant(): Map;
+extern macro StringMapConstant(): Map;
+extern macro SloppyArgumentsElementsMapConstant(): Map;
 
 const kFixedArrayMap: Map = FixedArrayMapConstant();
+const kFixedDoubleArrayMap: Map = FixedDoubleArrayMapConstant();
 const kCOWMap: Map = FixedCOWArrayMapConstant();
 const kEmptyByteArray: ByteArray = EmptyByteArrayConstant();
-const kEmptyFixedArray: FixedArray = EmptyFixedArrayConstant();
+const kEmptyFixedArray: EmptyFixedArray = EmptyFixedArrayConstant();
+const kPromiseCapabilityMap: Map = PromiseCapabilityMapConstant();
+// The map of a non-internalized internal SeqOneByteString.
+const kOneByteStringMap: Map = OneByteStringMapConstant();
+// The map of a non-internalized internal SeqTwoByteString.
+const kStringMap: Map = StringMapConstant();
+const kSloppyArgumentsElementsMap: Map = SloppyArgumentsElementsMapConstant();
 
 extern macro IsPrototypeInitialArrayPrototype(implicit context: Context)(Map):
     bool;
@@ -3036,55 +934,7 @@ operator '.length=' macro StoreFastJSArrayLength(
   array.length = length;
 }
 
-extern operator '.objects[]' macro LoadFixedArrayElement(
-    FixedArray, intptr): Object;
-extern operator '.objects[]' macro LoadFixedArrayElement(
-    FixedArray, Smi): Object;
-extern operator '.objects[]' macro LoadFixedArrayElement(
-    FixedArray, constexpr int31): Object;
-extern operator '.objects[]=' macro StoreFixedArrayElement(
-    FixedArray, intptr, Smi): void;
-extern operator '.objects[]=' macro StoreFixedArrayElement(
-    FixedArray, Smi, Smi): void;
-extern operator '.objects[]=' macro StoreFixedArrayElement(
-    FixedArray, intptr, HeapObject): void;
-extern operator '.objects[]=' macro StoreFixedArrayElement(
-    FixedArray, intptr, Object): void;
-extern operator '.objects[]=' macro StoreFixedArrayElement(
-    FixedArray, constexpr int31, Smi): void;
-extern operator '.objects[]=' macro StoreFixedArrayElement(
-    FixedArray, constexpr int31, HeapObject): void;
-extern operator '.objects[]=' macro StoreFixedArrayElement(
-    FixedArray, Smi, Object): void;
-extern macro StoreFixedArrayElement(
-    FixedArray, Smi, Object, constexpr WriteBarrierMode): void;
-extern macro StoreFixedArrayElement(
-    FixedArray, Smi, Smi, constexpr WriteBarrierMode): void;
-extern macro StoreFixedArrayElement(
-    FixedArray, constexpr int31, Object, constexpr WriteBarrierMode): void;
-extern macro StoreFixedArrayElement(
-    FixedArray, constexpr int31, Smi, constexpr WriteBarrierMode): void;
-extern macro StoreFixedArrayElement(
-    FixedArray, intptr, Object, constexpr WriteBarrierMode): void;
-extern macro StoreFixedArrayElement(
-    FixedArray, intptr, Smi, constexpr WriteBarrierMode): void;
-extern operator '.floats[]=' macro StoreFixedDoubleArrayElement(
-    FixedDoubleArray, intptr, float64): void;
-extern operator '.floats[]=' macro StoreFixedDoubleArrayElementSmi(
-    FixedDoubleArray, Smi, float64): void;
-extern operator '.floats[]' macro LoadFixedDoubleArrayElement(
-    FixedDoubleArray, intptr): float64;
-operator '[]=' macro StoreFixedDoubleArrayDirect(
-    a: FixedDoubleArray, i: Smi, v: Number) {
-  a.floats[i] = Convert<float64>(v);
-}
-operator '[]=' macro StoreFixedArrayDirect(a: FixedArray, i: Smi, v: Object) {
-  a.objects[i] = v;
-}
-
 extern macro GetNumberDictionaryNumberOfElements(NumberDictionary): Smi;
-extern macro GetIteratorMethod(implicit context: Context)(HeapObject): JSAny
-    labels IfIteratorUndefined;
 
 extern macro LoadConstructorOrBackPointer(Map): Object;
 
@@ -3098,400 +948,113 @@ extern macro IsFastSmiElementsKind(ElementsKind): bool;
 extern macro IsHoleyFastElementsKind(ElementsKind): bool;
 
 macro FastHoleyElementsKind(kind: ElementsKind): ElementsKind {
-  if (kind == PACKED_SMI_ELEMENTS) {
-    return HOLEY_SMI_ELEMENTS;
-  } else if (kind == PACKED_DOUBLE_ELEMENTS) {
-    return HOLEY_DOUBLE_ELEMENTS;
+  if (kind == ElementsKind::PACKED_SMI_ELEMENTS) {
+    return ElementsKind::HOLEY_SMI_ELEMENTS;
+  } else if (kind == ElementsKind::PACKED_DOUBLE_ELEMENTS) {
+    return ElementsKind::HOLEY_DOUBLE_ELEMENTS;
   }
-  assert(kind == PACKED_ELEMENTS);
-  return HOLEY_ELEMENTS;
+  assert(kind == ElementsKind::PACKED_ELEMENTS);
+  return ElementsKind::HOLEY_ELEMENTS;
 }
 
 macro AllowDoubleElements(kind: ElementsKind): ElementsKind {
-  if (kind == PACKED_SMI_ELEMENTS) {
-    return PACKED_DOUBLE_ELEMENTS;
-  } else if (kind == HOLEY_SMI_ELEMENTS) {
-    return HOLEY_DOUBLE_ELEMENTS;
+  if (kind == ElementsKind::PACKED_SMI_ELEMENTS) {
+    return ElementsKind::PACKED_DOUBLE_ELEMENTS;
+  } else if (kind == ElementsKind::HOLEY_SMI_ELEMENTS) {
+    return ElementsKind::HOLEY_DOUBLE_ELEMENTS;
   }
   return kind;
 }
 
 macro AllowNonNumberElements(kind: ElementsKind): ElementsKind {
-  if (kind == PACKED_SMI_ELEMENTS) {
-    return PACKED_ELEMENTS;
-  } else if (kind == HOLEY_SMI_ELEMENTS) {
-    return HOLEY_ELEMENTS;
-  } else if (kind == PACKED_DOUBLE_ELEMENTS) {
-    return PACKED_ELEMENTS;
-  } else if (kind == HOLEY_DOUBLE_ELEMENTS) {
-    return HOLEY_ELEMENTS;
+  if (kind == ElementsKind::PACKED_SMI_ELEMENTS) {
+    return ElementsKind::PACKED_ELEMENTS;
+  } else if (kind == ElementsKind::HOLEY_SMI_ELEMENTS) {
+    return ElementsKind::HOLEY_ELEMENTS;
+  } else if (kind == ElementsKind::PACKED_DOUBLE_ELEMENTS) {
+    return ElementsKind::PACKED_ELEMENTS;
+  } else if (kind == ElementsKind::HOLEY_DOUBLE_ELEMENTS) {
+    return ElementsKind::HOLEY_ELEMENTS;
   }
   return kind;
 }
 
-extern macro AllocateZeroedFixedArray(intptr): FixedArray;
-extern macro AllocateZeroedFixedDoubleArray(intptr): FixedDoubleArray;
-extern macro CalculateNewElementsCapacity(Smi): Smi;
-extern macro CalculateNewElementsCapacity(intptr): intptr;
-
-extern macro AllocateFixedArrayWithHoles(
-    intptr, constexpr AllocationFlags): FixedArray;
-extern macro AllocateFixedDoubleArrayWithHoles(
-    intptr, constexpr AllocationFlags): FixedDoubleArray;
-extern macro CopyFixedArrayElements(
-    constexpr ElementsKind, FixedArray, constexpr ElementsKind, FixedArray,
-    intptr, intptr, intptr): void;
-extern macro CopyFixedArrayElements(
-    constexpr ElementsKind, FixedArray, constexpr ElementsKind, FixedArray, Smi,
-    Smi, Smi): void;
-
-extern macro AllocateJSArray(
-    constexpr ElementsKind, Map, intptr, Smi,
-    constexpr AllocationFlags): JSArray;
-extern macro AllocateJSArray(constexpr ElementsKind, Map, intptr, Smi): JSArray;
-extern macro AllocateJSArray(constexpr ElementsKind, Map, Smi, Smi): JSArray;
-extern macro AllocateJSArray(Map, FixedArrayBase, Smi): JSArray;
-extern macro AllocateJSObjectFromMap(Map): JSObject;
-extern macro AllocateJSObjectFromMap(
-    Map, FixedArray | PropertyArray, FixedArray, constexpr AllocationFlags,
-    constexpr SlackTrackingMode): JSObject;
-
-extern macro LoadDoubleWithHoleCheck(FixedDoubleArray, Smi): float64
-    labels IfHole;
-extern macro LoadDoubleWithHoleCheck(FixedDoubleArray, intptr): float64
-    labels IfHole;
-extern macro StoreFixedDoubleArrayHoleSmi(FixedDoubleArray, Smi): void;
-
 macro GetObjectFunction(implicit context: Context)(): JSFunction {
   return UnsafeCast<JSFunction>(
-      LoadNativeContext(context)[OBJECT_FUNCTION_INDEX]);
+      LoadNativeContext(context)[NativeContextSlot::OBJECT_FUNCTION_INDEX]);
+}
+macro GetArrayFunction(implicit context: Context)(): JSFunction {
+  return UnsafeCast<JSFunction>(
+      LoadNativeContext(context)[NativeContextSlot::ARRAY_FUNCTION_INDEX]);
 }
 macro GetArrayBufferFunction(implicit context: Context)(): Constructor {
   return UnsafeCast<Constructor>(
-      LoadNativeContext(context)[ARRAY_BUFFER_FUN_INDEX]);
+      LoadNativeContext(context)[NativeContextSlot::ARRAY_BUFFER_FUN_INDEX]);
 }
 macro GetArrayBufferNoInitFunction(implicit context: Context)(): JSFunction {
-  return UnsafeCast<JSFunction>(
-      LoadNativeContext(context)[ARRAY_BUFFER_NOINIT_FUN_INDEX]);
+  return UnsafeCast<JSFunction>(LoadNativeContext(
+      context)[NativeContextSlot::ARRAY_BUFFER_NOINIT_FUN_INDEX]);
 }
 macro GetFastPackedElementsJSArrayMap(implicit context: Context)(): Map {
-  return UnsafeCast<Map>(
-      LoadNativeContext(context)[JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX]);
+  return UnsafeCast<Map>(LoadNativeContext(
+      context)[NativeContextSlot::JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX]);
 }
 macro GetFastPackedSmiElementsJSArrayMap(implicit context: Context)(): Map {
-  return UnsafeCast<Map>(
-      LoadNativeContext(context)[JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX]);
+  return UnsafeCast<Map>(LoadNativeContext(
+      context)[NativeContextSlot::JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX]);
 }
 macro GetProxyRevocableResultMap(implicit context: Context)(): Map {
-  return UnsafeCast<Map>(
-      LoadNativeContext(context)[PROXY_REVOCABLE_RESULT_MAP_INDEX]);
+  return UnsafeCast<Map>(LoadNativeContext(
+      context)[NativeContextSlot::PROXY_REVOCABLE_RESULT_MAP_INDEX]);
 }
 macro GetIteratorResultMap(implicit context: Context)(): Map {
-  return UnsafeCast<Map>(LoadNativeContext(context)[ITERATOR_RESULT_MAP_INDEX]);
+  return UnsafeCast<Map>(
+      LoadNativeContext(context)[NativeContextSlot::ITERATOR_RESULT_MAP_INDEX]);
 }
 macro GetInitialStringIteratorMap(implicit context: Context)(): Map {
-  return UnsafeCast<Map>(
-      LoadNativeContext(context)[INITIAL_STRING_ITERATOR_MAP_INDEX]);
+  return UnsafeCast<Map>(LoadNativeContext(
+      context)[NativeContextSlot::INITIAL_STRING_ITERATOR_MAP_INDEX]);
 }
 macro GetReflectApply(implicit context: Context)(): Callable {
-  return UnsafeCast<Callable>(LoadNativeContext(context)[REFLECT_APPLY_INDEX]);
+  return UnsafeCast<Callable>(
+      LoadNativeContext(context)[NativeContextSlot::REFLECT_APPLY_INDEX]);
 }
 macro GetRegExpLastMatchInfo(implicit context: Context)(): RegExpMatchInfo {
-  return %RawDownCast<RegExpMatchInfo>(
-      LoadNativeContext(context)[REGEXP_LAST_MATCH_INFO_INDEX]);
+  return %RawDownCast<RegExpMatchInfo>(LoadNativeContext(
+      context)[NativeContextSlot::REGEXP_LAST_MATCH_INFO_INDEX]);
 }
-
-extern transitioning macro Call(Context, Callable, JSAny): JSAny;
-extern transitioning macro Call(Context, Callable, JSAny, JSAny): JSAny;
-extern transitioning macro Call(Context, Callable, JSAny, JSAny, JSAny): JSAny;
-extern transitioning macro Call(
-    Context, Callable, JSAny, JSAny, JSAny, JSAny): JSAny;
-extern transitioning macro Call(
-    Context, Callable, JSAny, JSAny, JSAny, JSAny, JSAny): JSAny;
-extern transitioning macro Call(
-    Context, Callable, JSAny, JSAny, JSAny, JSAny, JSAny, JSAny): JSAny;
-
-extern builtin CloneFastJSArray(Context, FastJSArrayForCopy): JSArray;
-extern macro ExtractFixedArray(FixedArrayBase, Smi, Smi, Smi): FixedArrayBase;
-extern macro ExtractFixedArray(
-    FixedArrayBase, Smi, Smi, Smi,
-    constexpr ExtractFixedArrayFlags): FixedArrayBase;
-
-extern macro ExtractFixedArray(
-    FixedArray, intptr, intptr, intptr,
-    constexpr ExtractFixedArrayFlags): FixedArray;
-
-extern builtin ExtractFastJSArray(Context, JSArray, Smi, Smi): JSArray;
-
-extern macro MoveElements(
-    constexpr ElementsKind, FixedArrayBase, intptr, intptr, intptr): void;
-macro TorqueMoveElementsSmi(
-    elements: FixedArray, dstIndex: intptr, srcIndex: intptr,
-    count: intptr): void {
-  MoveElements(HOLEY_SMI_ELEMENTS, elements, dstIndex, srcIndex, count);
-}
-macro TorqueMoveElements(
-    elements: FixedArray, dstIndex: intptr, srcIndex: intptr,
-    count: intptr): void {
-  MoveElements(HOLEY_ELEMENTS, elements, dstIndex, srcIndex, count);
-}
-macro TorqueMoveElements(
-    elements: FixedDoubleArray, dstIndex: intptr, srcIndex: intptr,
-    count: intptr): void {
-  MoveElements(HOLEY_DOUBLE_ELEMENTS, elements, dstIndex, srcIndex, count);
-}
-
-extern macro CopyElements(
-    constexpr ElementsKind, FixedArrayBase, intptr, FixedArrayBase, intptr,
-    intptr): void;
-macro TorqueCopyElements(
-    dstElements: FixedArray, dstIndex: intptr, srcElements: FixedArray,
-    srcIndex: intptr, count: intptr): void {
-  CopyElements(
-      HOLEY_ELEMENTS, dstElements, dstIndex, srcElements, srcIndex, count);
-}
-macro TorqueCopyElements(
-    dstElements: FixedDoubleArray, dstIndex: intptr,
-    srcElements: FixedDoubleArray, srcIndex: intptr, count: intptr): void {
-  CopyElements(
-      HOLEY_DOUBLE_ELEMENTS, dstElements, dstIndex, srcElements, srcIndex,
-      count);
-}
-
-macro LoadElementNoHole<T: type>(a: JSArray, index: Smi): JSAny
-    labels IfHole;
-
-LoadElementNoHole<FixedArray>(implicit context: Context)(
-    a: JSArray, index: Smi): JSAny
-    labels IfHole {
-  try {
-    const elements: FixedArray =
-        Cast<FixedArray>(a.elements) otherwise Unexpected;
-    const e = UnsafeCast<(JSAny | TheHole)>(elements.objects[index]);
-    typeswitch (e) {
-      case (TheHole): {
-        goto IfHole;
-      }
-      case (e: JSAny): {
-        return e;
-      }
-    }
-  }
-  label Unexpected {
-    unreachable;
-  }
+macro GetStrictArgumentsMap(implicit context: Context)(): Map {
+  return UnsafeCast<Map>(LoadNativeContext(
+      context)[NativeContextSlot::STRICT_ARGUMENTS_MAP_INDEX]);
 }
-
-LoadElementNoHole<FixedDoubleArray>(implicit context: Context)(
-    a: JSArray, index: Smi): JSAny
-    labels IfHole {
-  try {
-    const elements: FixedDoubleArray =
-        Cast<FixedDoubleArray>(a.elements) otherwise Unexpected;
-    const e: float64 =
-        LoadDoubleWithHoleCheck(elements, index) otherwise IfHole;
-    return AllocateHeapNumberWithValue(e);
-  }
-  label Unexpected {
-    unreachable;
-  }
+macro GetSloppyArgumentsMap(implicit context: Context)(): Map {
+  return UnsafeCast<Map>(LoadNativeContext(
+      context)[NativeContextSlot::SLOPPY_ARGUMENTS_MAP_INDEX]);
 }
-
-struct FastJSArrayWitness {
-  Get(): FastJSArray {
-    return this.unstable;
-  }
-
-  Recheck() labels CastError {
-    if (this.stable.map != this.map) goto CastError;
-    // We don't need to check elements kind or whether the prototype
-    // has changed away from the default JSArray prototype, because
-    // if the map remains the same then those properties hold.
-    //
-    // However, we have to make sure there are no elements in the
-    // prototype chain.
-    if (IsNoElementsProtectorCellInvalid()) goto CastError;
-    this.unstable = %RawDownCast<FastJSArray>(this.stable);
-  }
-
-  LoadElementNoHole(implicit context: Context)(k: Smi): JSAny
-      labels FoundHole {
-    if (this.hasDoubles) {
-      return LoadElementNoHole<FixedDoubleArray>(this.unstable, k)
-          otherwise FoundHole;
-    } else {
-      return LoadElementNoHole<FixedArray>(this.unstable, k)
-          otherwise FoundHole;
-    }
-  }
-
-  StoreHole(k: Smi) {
-    if (this.hasDoubles) {
-      const elements = Cast<FixedDoubleArray>(this.unstable.elements)
-          otherwise unreachable;
-      StoreFixedDoubleArrayHoleSmi(elements, k);
-    } else {
-      const elements = Cast<FixedArray>(this.unstable.elements)
-          otherwise unreachable;
-      StoreFixedArrayElement(elements, k, TheHole);
-    }
-  }
-
-  LoadElementOrUndefined(implicit context: Context)(k: Smi): JSAny {
-    try {
-      return this.LoadElementNoHole(k) otherwise FoundHole;
-    }
-    label FoundHole {
-      return Undefined;
-    }
-  }
-
-  EnsureArrayPushable(implicit context: Context)() labels Failed {
-    EnsureArrayPushable(this.map) otherwise Failed;
-    array::EnsureWriteableFastElements(this.unstable);
-    this.arrayIsPushable = true;
-  }
-
-  ChangeLength(newLength: Smi) {
-    assert(this.arrayIsPushable);
-    this.unstable.length = newLength;
-  }
-
-  Push(value: JSAny) labels Failed {
-    assert(this.arrayIsPushable);
-    if (this.hasDoubles) {
-      BuildAppendJSArray(HOLEY_DOUBLE_ELEMENTS, this.unstable, value)
-          otherwise Failed;
-    } else if (this.hasSmis) {
-      BuildAppendJSArray(HOLEY_SMI_ELEMENTS, this.unstable, value)
-          otherwise Failed;
-    } else {
-      assert(
-          this.map.elements_kind == HOLEY_ELEMENTS ||
-          this.map.elements_kind == PACKED_ELEMENTS);
-      BuildAppendJSArray(HOLEY_ELEMENTS, this.unstable, value)
-          otherwise Failed;
-    }
-  }
-
-  MoveElements(dst: intptr, src: intptr, length: intptr) {
-    assert(this.arrayIsPushable);
-    if (this.hasDoubles) {
-      const elements: FixedDoubleArray =
-          Cast<FixedDoubleArray>(this.unstable.elements)
-          otherwise unreachable;
-      TorqueMoveElements(elements, dst, src, length);
-    } else {
-      const elements: FixedArray = Cast<FixedArray>(this.unstable.elements)
-          otherwise unreachable;
-      if (this.hasSmis) {
-        TorqueMoveElementsSmi(elements, dst, src, length);
-      } else {
-        TorqueMoveElements(elements, dst, src, length);
-      }
-    }
-  }
-
-  const stable: JSArray;
-  unstable: FastJSArray;
-  const map: Map;
-  const hasDoubles: bool;
-  const hasSmis: bool;
-  arrayIsPushable: bool;
-}
-
-macro NewFastJSArrayWitness(array: FastJSArray): FastJSArrayWitness {
-  const kind = array.map.elements_kind;
-  return FastJSArrayWitness{
-    stable: array,
-    unstable: array,
-    map: array.map,
-    hasDoubles: IsDoubleElementsKind(kind),
-    hasSmis: IsElementsKindLessThanOrEqual(kind, HOLEY_SMI_ELEMENTS),
-    arrayIsPushable: false
-  };
-}
-
-struct FastJSArrayForReadWitness {
-  Get(): FastJSArrayForRead {
-    return this.unstable;
-  }
-
-  Recheck() labels CastError {
-    if (this.stable.map != this.map) goto CastError;
-    // We don't need to check elements kind or whether the prototype
-    // has changed away from the default JSArray prototype, because
-    // if the map remains the same then those properties hold.
-    //
-    // However, we have to make sure there are no elements in the
-    // prototype chain.
-    if (IsNoElementsProtectorCellInvalid()) goto CastError;
-    this.unstable = %RawDownCast<FastJSArrayForRead>(this.stable);
-  }
-
-  LoadElementNoHole(implicit context: Context)(k: Smi): JSAny
-      labels FoundHole {
-    if (this.hasDoubles) {
-      return LoadElementNoHole<FixedDoubleArray>(this.unstable, k)
-          otherwise FoundHole;
-    } else {
-      return LoadElementNoHole<FixedArray>(this.unstable, k)
-          otherwise FoundHole;
-    }
-  }
-
-  const stable: JSArray;
-  unstable: FastJSArrayForRead;
-  const map: Map;
-  const hasDoubles: bool;
+macro GetFastAliasedArgumentsMap(implicit context: Context)(): Map {
+  return UnsafeCast<Map>(LoadNativeContext(
+      context)[NativeContextSlot::FAST_ALIASED_ARGUMENTS_MAP_INDEX]);
 }
 
-macro NewFastJSArrayForReadWitness(array: FastJSArrayForRead):
-    FastJSArrayForReadWitness {
-  const kind = array.map.elements_kind;
-  return FastJSArrayForReadWitness{
-    stable: array,
-    unstable: array,
-    map: array.map,
-    hasDoubles: IsDoubleElementsKind(kind)
-  };
-}
+// Call(Context, Target, Receiver, ...Args)
+// TODO(joshualitt): Assuming the context parameter is for throwing when Target
+//                   is non-callable, then we should make it an implicit
+//                   parameter.
+extern transitioning macro Call(Context, JSAny, JSAny): JSAny;
+extern transitioning macro Call(Context, JSAny, JSAny, JSAny): JSAny;
+extern transitioning macro Call(Context, JSAny, JSAny, JSAny, JSAny): JSAny;
+extern transitioning macro Call(
+    Context, JSAny, JSAny, JSAny, JSAny, JSAny): JSAny;
+extern transitioning macro Call(
+    Context, JSAny, JSAny, JSAny, JSAny, JSAny, JSAny): JSAny;
+extern transitioning macro Call(
+    Context, JSAny, JSAny, JSAny, JSAny, JSAny, JSAny, JSAny): JSAny;
 
 extern macro TransitionElementsKind(
     JSObject, Map, constexpr ElementsKind,
     constexpr ElementsKind): void labels Bailout;
 extern macro PerformStackCheck(implicit context: Context)(): void;
 
-extern macro IsCallable(HeapObject): bool;
-extern macro IsConstructor(HeapObject): bool;
-extern macro IsFeedbackVector(HeapObject): bool;
-extern macro IsJSArray(HeapObject): bool;
-extern macro IsJSProxy(HeapObject): bool;
-extern macro IsJSRegExp(HeapObject): bool;
-extern macro IsJSRegExpStringIterator(HeapObject): bool;
-extern macro IsMap(HeapObject): bool;
-extern macro IsJSFunction(HeapObject): bool;
-extern macro IsJSObject(HeapObject): bool;
-extern macro IsJSTypedArray(HeapObject): bool;
-extern macro IsNumberDictionary(HeapObject): bool;
-extern macro IsContext(HeapObject): bool;
-extern macro IsNativeContext(HeapObject): bool;
-extern macro IsJSReceiver(HeapObject): bool;
-extern macro TaggedIsCallable(Object): bool;
-extern macro IsDetachedBuffer(JSArrayBuffer): bool;
-extern macro IsHeapNumber(HeapObject): bool;
-extern macro IsBigInt(HeapObject): bool;
-extern macro IsFixedArray(HeapObject): bool;
-extern macro IsName(HeapObject): bool;
-extern macro IsPrivateSymbol(HeapObject): bool;
-extern macro IsNumber(Object): bool;
-extern macro IsNumberNormalized(Number): bool;
-extern macro IsOddball(HeapObject): bool;
-extern macro IsSymbol(HeapObject): bool;
-extern macro IsJSArrayMap(Map): bool;
-extern macro IsExtensibleMap(Map): bool;
-extern macro IsJSPrimitiveWrapper(HeapObject): bool;
-extern macro IsCustomElementsReceiverInstanceType(int32): bool;
 extern macro Typeof(JSAny): String;
 
 // Return true iff number is NaN.
@@ -3526,7 +1089,7 @@ macro ToBoolean(obj: JSAny): bool {
 macro RequireObjectCoercible(implicit context: Context)(
     value: JSAny, name: constexpr string): JSAny {
   if (IsNullOrUndefined(value)) {
-    ThrowTypeError(kCalledOnNullOrUndefined, name);
+    ThrowTypeError(MessageTemplate::kCalledOnNullOrUndefined, name);
   }
   return value;
 }
@@ -3536,18 +1099,132 @@ macro SameValue(a: JSAny, b: JSAny): bool {
   BranchIfSameValue(a, b) otherwise return true, return false;
 }
 
-transitioning macro ToIndex(input: JSAny, context: Context): Number
-    labels RangeError {
-  if (input == Undefined) {
-    return 0;
+// Does "if (index1 + index2 > limit) goto IfOverflow" in an uintptr overflow
+// friendly way where index1 and index2 are in [0, kMaxSafeInteger] range.
+macro CheckIntegerIndexAdditionOverflow(
+    index1: uintptr, index2: uintptr, limit: uintptr) labels IfOverflow {
+  if constexpr (Is64()) {
+    assert(index1 <= kMaxSafeIntegerUint64);
+    assert(index2 <= kMaxSafeIntegerUint64);
+    // Given that both index1 and index2 are in a safe integer range the
+    // addition can't overflow.
+    if (index1 + index2 > limit) goto IfOverflow;
+  } else {
+    // Uintptr range is "smaller" than [0, kMaxSafeInteger] range, so
+    // "index1 + index2" may overflow, so we check the condition in the
+    // following way "if (index1 > limit - index2) goto IfOverflow" and check
+    // that "limit - index2" does not underflow.
+    const index1Limit = limit - index2;
+    if (index1 > index1Limit) goto IfOverflow;
+    // Handle potential index1Limit underflow.
+    if (index1Limit > limit) goto IfOverflow;
   }
+}
 
-  const value: Number = ToInteger_Inline(context, input, kTruncateMinusZero);
-  if (value < 0 || value > kMaxSafeInteger) {
-    goto RangeError;
+// TODO(tebbi): Define enum here once they appear in Torque.
+//
+// The value is a SafeInteger that fits into uintptr range, so no bounds checks
+// are necessary.
+const kModeValueIsSafeIntegerUintPtr: constexpr int31 = 0;
+// The value is a SafeInteger that may not fit into uintptr range, so only
+// uintptr bounds check is necessary.
+const kModeValueIsSafeInteger: constexpr int31 = 1;
+// The value is can be whatever non-NaN number, all checks are necessary.
+const kModeValueIsAnyNumber: constexpr int31 = 2;
+
+macro TryNumberToUintPtr(valueNumber: Number, kMode: constexpr int31):
+    uintptr labels IfLessThanZero, IfUIntPtrOverflow, IfSafeIntegerOverflow {
+  typeswitch (valueNumber) {
+    case (valueSmi: Smi): {
+      if (kMode == kModeValueIsAnyNumber) {
+        if (valueSmi < 0) goto IfLessThanZero;
+      } else {
+        assert(valueSmi >= 0);
+      }
+      const value: uintptr = Unsigned(Convert<intptr>(valueSmi));
+      // Positive Smi values definitely fit into both [0, kMaxSafeInteger] and
+      // [0, kMaxUintPtr] ranges.
+      return value;
+    }
+    case (valueHeapNumber: HeapNumber): {
+      assert(IsNumberNormalized(valueHeapNumber));
+      const valueDouble: float64 = Convert<float64>(valueHeapNumber);
+      // NaNs must be handled outside.
+      assert(!Float64IsNaN(valueDouble));
+      if (kMode == kModeValueIsAnyNumber) {
+        if (valueDouble < 0) goto IfLessThanZero;
+      } else {
+        assert(valueDouble >= 0);
+      }
+
+      if constexpr (Is64()) {
+        // On 64-bit architectures uintptr range is bigger than safe integer
+        // range.
+        if (kMode == kModeValueIsAnyNumber) {
+          if (valueDouble > kMaxSafeInteger) goto IfSafeIntegerOverflow;
+        } else {
+          assert(valueDouble <= kMaxSafeInteger);
+        }
+      } else {
+        // On 32-bit architectures uintptr range is smaller than safe integer
+        // range.
+        if (kMode == kModeValueIsAnyNumber ||
+            kMode == kModeValueIsSafeInteger) {
+          if (valueDouble > kMaxUInt32Double) goto IfUIntPtrOverflow;
+        } else {
+          assert(valueDouble <= kMaxUInt32Double);
+        }
+      }
+      return ChangeFloat64ToUintPtr(valueDouble);
+    }
   }
+}
 
-  return value;
+@export
+macro ChangeUintPtrNumberToUintPtr(value: Number): uintptr {
+  try {
+    return TryNumberToUintPtr(value, kModeValueIsSafeIntegerUintPtr)
+        otherwise InvalidValue, InvalidValue, InvalidValue;
+  }
+  label InvalidValue {
+    unreachable;
+  }
+}
+
+@export
+macro ChangeSafeIntegerNumberToUintPtr(value: Number):
+    uintptr labels IfUIntPtrOverflow {
+  try {
+    return TryNumberToUintPtr(value, kModeValueIsSafeInteger)
+        otherwise InvalidValue, IfUIntPtrOverflow, InvalidValue;
+  }
+  label InvalidValue {
+    unreachable;
+  }
+}
+
+transitioning macro ToUintPtr(implicit context: Context)(value: JSAny):
+    uintptr labels IfLessThanZero, IfUIntPtrOverflow, IfSafeIntegerOverflow {
+  if (value == Undefined) return 0;
+  const indexNumber = ToInteger_Inline(value, kTruncateMinusZero);
+  return TryNumberToUintPtr(indexNumber, kModeValueIsAnyNumber)
+      otherwise IfLessThanZero, IfUIntPtrOverflow, IfSafeIntegerOverflow;
+}
+
+// https://tc39.github.io/ecma262/#sec-toindex
+// Unlike ToIndex from the spec this implementation triggers IfRangeError if
+// the result is bigger than min(kMaxUIntPtr, kMaxSafeInteger).
+// We can do this because all callers do a range checks against uintptr length
+// anyway and throw a RangeError in case of out-of-bounds index.
+@export
+transitioning macro ToIndex(implicit context: Context)(value: JSAny):
+    uintptr labels IfRangeError {
+  if (value == Undefined) return 0;
+  const indexNumber = ToInteger_Inline(value, kTruncateMinusZero);
+  // Less than 0 case, uintptr range overflow and safe integer range overflow
+  // imply IfRangeError.
+  return TryNumberToUintPtr(indexNumber, kModeValueIsAnyNumber)
+      otherwise IfRangeError, IfRangeError, IfRangeError;
 }
 
 transitioning macro GetLengthProperty(implicit context: Context)(o: JSAny):
@@ -3557,7 +1234,10 @@ transitioning macro GetLengthProperty(implicit context: Context)(o: JSAny):
       case (a: JSArray): {
         return a.length;
       }
-      case (a: JSArgumentsObjectWithLength): {
+      case (a: JSStrictArgumentsObject): {
+        goto ToLength(a.length);
+      }
+      case (a: JSSloppyArgumentsObject): {
         goto ToLength(a.length);
       }
       case (JSAny): deferred {
@@ -3566,28 +1246,136 @@ transitioning macro GetLengthProperty(implicit context: Context)(o: JSAny):
     }
   }
   label ToLength(length: JSAny) deferred {
-    return ToLength_Inline(context, length);
+    return ToLength_Inline(length);
   }
 }
 
 transitioning macro GetMethod(implicit context: Context)(
-    o: JSAny, name: constexpr string): Callable labels IfNullOrUndefined {
+    o: JSAny, name: AnyName): Callable labels IfNullOrUndefined,
+    IfMethodNotCallable(JSAny) {
   const value = GetProperty(o, name);
+  // TODO(v8:9933): Consider checking for null/undefined after checking for
+  // callable because the latter seems to be more common.
+  if (value == Undefined || value == Null) goto IfNullOrUndefined;
+  return Cast<Callable>(value)
+      otherwise goto IfMethodNotCallable(value);
+}
+
+transitioning macro GetMethod(implicit context: Context)(
+    o: JSAny, name: String): Callable labels IfNullOrUndefined {
+  try {
+    return GetMethod(o, name) otherwise IfNullOrUndefined, IfMethodNotCallable;
+  }
+  label IfMethodNotCallable(value: JSAny) deferred {
+    ThrowTypeError(MessageTemplate::kPropertyNotFunction, value, name, o);
+  }
+}
+
+transitioning macro GetMethod(implicit context: Context)(
+    o: JSAny, name: constexpr string): Callable labels IfNullOrUndefined {
+  return GetMethod(o, StringConstant(name)) otherwise IfNullOrUndefined;
+}
+
+transitioning macro GetMethod(implicit context: Context)(
+    o: JSAny, symbol: Symbol): Callable labels IfNullOrUndefined {
+  const value = GetProperty(o, symbol);
   if (value == Undefined || value == Null) goto IfNullOrUndefined;
   return Cast<Callable>(value)
-      otherwise ThrowTypeError(kPropertyNotFunction, value, name, o);
+      otherwise ThrowTypeError(
+      MessageTemplate::kPropertyNotFunction, value, symbol, o);
 }
 
 extern macro NumberToString(Number): String;
 extern macro IsOneByteStringInstanceType(InstanceType): bool;
-extern macro AllocateSeqOneByteString(uint32): String;
-extern macro AllocateSeqTwoByteString(uint32): String;
-extern macro ConvertToRelativeIndex(implicit context: Context)(
-    JSAny, intptr): intptr;
+
+// After converting an index to an integer, calculate a relative index:
+// return index < 0 ? max(length + index, 0) : min(index, length)
+@export
+transitioning macro ConvertToRelativeIndex(implicit context: Context)(
+    index: JSAny, length: uintptr): uintptr {
+  const indexNumber: Number = ToInteger_Inline(index, kTruncateMinusZero);
+  return ConvertToRelativeIndex(indexNumber, length);
+}
+
+// Calculate a relative index:
+// return index < 0 ? max(length + index, 0) : min(index, length)
+@export
+macro ConvertToRelativeIndex(indexNumber: Number, length: uintptr): uintptr {
+  typeswitch (indexNumber) {
+    case (indexSmi: Smi): {
+      const indexIntPtr: intptr = Convert<intptr>(indexSmi);
+      // The logic is implemented using unsigned types.
+      if (indexIntPtr < 0) {
+        const relativeIndex: uintptr = Unsigned(indexIntPtr) + length;
+        return relativeIndex < length ? relativeIndex : 0;
+
+      } else {
+        const relativeIndex: uintptr = Unsigned(indexIntPtr);
+        return relativeIndex < length ? relativeIndex : length;
+      }
+    }
+    case (indexHeapNumber: HeapNumber): {
+      assert(IsNumberNormalized(indexHeapNumber));
+      const indexDouble: float64 = Convert<float64>(indexHeapNumber);
+      // NaNs must already be handled by ConvertToRelativeIndex() version
+      // above accepting JSAny indices.
+      assert(!Float64IsNaN(indexDouble));
+      const lengthDouble: float64 = Convert<float64>(length);
+      assert(lengthDouble <= kMaxSafeInteger);
+      if (indexDouble < 0) {
+        const relativeIndex: float64 = lengthDouble + indexDouble;
+        return relativeIndex > 0 ? ChangeFloat64ToUintPtr(relativeIndex) : 0;
+
+      } else {
+        return ChangeFloat64ToUintPtr(
+            indexDouble < lengthDouble ? indexDouble : lengthDouble);
+      }
+    }
+  }
+}
+
+// After converting an index to a signed integer, clamps it to the provided
+// range [0, limit]:
+// return min(max(index, 0), limit)
+@export
+transitioning macro ClampToIndexRange(implicit context: Context)(
+    index: JSAny, limit: uintptr): uintptr {
+  const indexNumber: Number = ToInteger_Inline(index, kTruncateMinusZero);
+  return ClampToIndexRange(indexNumber, limit);
+}
+
+// Clamps given signed indexNumber to the provided range [0, limit]:
+// return min(max(index, 0), limit)
+@export
+macro ClampToIndexRange(indexNumber: Number, limit: uintptr): uintptr {
+  typeswitch (indexNumber) {
+    case (indexSmi: Smi): {
+      if (indexSmi < 0) return 0;
+      const index: uintptr = Unsigned(Convert<intptr>(indexSmi));
+      if (index >= limit) return limit;
+      return index;
+    }
+    case (indexHeapNumber: HeapNumber): {
+      assert(IsNumberNormalized(indexHeapNumber));
+      const indexDouble: float64 = Convert<float64>(indexHeapNumber);
+      // NaNs must already be handled by ClampToIndexRange() version
+      // above accepting JSAny indices.
+      assert(!Float64IsNaN(indexDouble));
+      if (indexDouble <= 0) return 0;
+
+      const maxIndexDouble: float64 = Convert<float64>(limit);
+      assert(maxIndexDouble <= kMaxSafeInteger);
+      if (indexDouble >= maxIndexDouble) return limit;
+
+      return ChangeFloat64ToUintPtr(indexDouble);
+    }
+  }
+}
 
 extern builtin ObjectToString(Context, JSAny): JSAny;
 extern builtin StringRepeat(Context, String, Number): String;
 
+@export
 struct KeyValuePair {
   key: JSAny;
   value: JSAny;
@@ -3651,34 +1439,44 @@ transitioning builtin FastCreateDataProperty(implicit context: Context)(
     const array = Cast<FastJSArray>(receiver) otherwise Slow;
     const index: Smi = Cast<Smi>(key) otherwise goto Slow;
     if (index < 0 || index > array.length) goto Slow;
-    array::EnsureWriteableFastElements(array);
     const isAppend = index == array.length;
-    const kind = array.map.elements_kind;
-    // We may have to transition a.
-    // For now, if transition is required, jump away to slow.
-    if (IsFastSmiElementsKind(kind)) {
-      const smiValue = Cast<Smi>(value) otherwise Slow;
-      if (isAppend) {
-        BuildAppendJSArray(HOLEY_SMI_ELEMENTS, array, value) otherwise Slow;
+
+    if (isAppend) {
+      // Fast append only works on fast elements kind and with writable length.
+      const kind = EnsureArrayPushable(array.map) otherwise Slow;
+      array::EnsureWriteableFastElements(array);
+
+      // We may have to transition a.
+      // For now, if transition is required, jump away to slow.
+      if (IsFastSmiElementsKind(kind)) {
+        BuildAppendJSArray(ElementsKind::HOLEY_SMI_ELEMENTS, array, value)
+            otherwise Slow;
+      } else if (IsDoubleElementsKind(kind)) {
+        BuildAppendJSArray(ElementsKind::HOLEY_DOUBLE_ELEMENTS, array, value)
+            otherwise Slow;
       } else {
+        assert(IsFastSmiOrTaggedElementsKind(kind));
+        BuildAppendJSArray(ElementsKind::HOLEY_ELEMENTS, array, value)
+            otherwise Slow;
+      }
+    } else {
+      // Non-appending element store.
+      const kind = array.map.elements_kind;
+      array::EnsureWriteableFastElements(array);
+
+      // We may have to transition a.
+      // For now, if transition is required, jump away to slow.
+      if (IsFastSmiElementsKind(kind)) {
+        const smiValue = Cast<Smi>(value) otherwise Slow;
         const elements = Cast<FixedArray>(array.elements) otherwise unreachable;
         elements[index] = smiValue;
-      }
-    } else if (IsDoubleElementsKind(kind)) {
-      const numberValue = Cast<Number>(value) otherwise Slow;
-      if (isAppend) {
-        BuildAppendJSArray(HOLEY_DOUBLE_ELEMENTS, array, value)
-            otherwise Slow;
-      } else {
+      } else if (IsDoubleElementsKind(kind)) {
+        const numberValue = Cast<Number>(value) otherwise Slow;
         const doubleElements = Cast<FixedDoubleArray>(array.elements)
             otherwise unreachable;
         doubleElements[index] = numberValue;
-      }
-    } else {
-      assert(IsFastSmiOrTaggedElementsKind(kind));
-      if (isAppend) {
-        BuildAppendJSArray(HOLEY_ELEMENTS, array, value) otherwise Slow;
       } else {
+        assert(IsFastSmiOrTaggedElementsKind(kind));
         const elements = Cast<FixedArray>(array.elements) otherwise unreachable;
         elements[index] = value;
       }
@@ -3709,7 +1507,7 @@ transitioning macro ToStringImpl(context: Context, o: JSAny): String {
         continue;
       }
       case (Symbol): {
-        ThrowTypeError(kSymbolToString);
+        ThrowTypeError(MessageTemplate::kSymbolToString);
       }
       case (JSAny): {
         return ToStringRT(context, o);
@@ -3762,7 +1560,7 @@ builtin CheckNumberInRange(implicit context: Context)(
   }
 }
 
-macro ReplaceTheHoleWithUndefined(o: JSAny | TheHole): JSAny {
+macro ReplaceTheHoleWithUndefined(o: JSAny|TheHole): JSAny {
   typeswitch (o) {
     case (TheHole): {
       return Undefined;
@@ -3772,3 +1570,19 @@ macro ReplaceTheHoleWithUndefined(o: JSAny | TheHole): JSAny {
     }
   }
 }
+
+extern macro DecodeScopeInfoHasContextExtension(intptr): intptr;
+
+struct ConstantIterator<T: type> {
+  macro Empty(): bool {
+    return false;
+  }
+  macro Next(): T labels _NoMore {
+    return this.value;
+  }
+
+  value: T;
+}
+macro ConstantIterator<T: type>(value: T): ConstantIterator<T> {
+  return ConstantIterator{value};
+}
diff --git a/deps/v8/src/builtins/bigint.tq b/deps/v8/src/builtins/bigint.tq
index f0409ad23df13f..02dca7543efabd 100644
--- a/deps/v8/src/builtins/bigint.tq
+++ b/deps/v8/src/builtins/bigint.tq
@@ -6,10 +6,8 @@
 
 // TODO(nicohartmann): Discuss whether types used by multiple builtins should be
 // in global namespace
-@noVerifier
 extern class BigIntBase extends PrimitiveHeapObject
-    generates 'TNode<BigInt>' {
-}
+    generates 'TNode<BigInt>' {}
 
 type BigInt extends BigIntBase;
 
@@ -76,7 +74,7 @@ namespace bigint {
       return AllocateEmptyBigIntNoThrow(sign, length) otherwise BigIntTooBig;
     }
     label BigIntTooBig {
-      ThrowRangeError(kBigIntTooBig);
+      ThrowRangeError(MessageTemplate::kBigIntTooBig);
     }
   }
 
@@ -178,10 +176,55 @@ namespace bigint {
       return BigIntAddImpl(x, y) otherwise BigIntTooBig;
     }
     label MixedTypes {
-      ThrowTypeError(kBigIntMixedTypes);
+      ThrowTypeError(MessageTemplate::kBigIntMixedTypes);
+    }
+    label BigIntTooBig {
+      ThrowRangeError(MessageTemplate::kBigIntTooBig);
+    }
+  }
+
+  macro BigIntSubtractImpl(implicit context: Context)(x: BigInt, y: BigInt):
+      BigInt labels BigIntTooBig {
+    const xsign = ReadBigIntSign(x);
+    const ysign = ReadBigIntSign(y);
+    if (xsign != ysign) {
+      // x - (-y) == x + y
+      // (-x) - y == -(x + y)
+      return MutableBigIntAbsoluteAdd(x, y, xsign) otherwise BigIntTooBig;
+    }
+
+    // x - y == -(y - x)
+    // (-x) - (-y) == y - x == -(x - y)
+    if (MutableBigIntAbsoluteCompare(x, y) >= 0) {
+      return MutableBigIntAbsoluteSub(x, y, xsign);
+    }
+    return MutableBigIntAbsoluteSub(y, x, InvertSign(xsign));
+  }
+
+  builtin BigIntSubtractNoThrow(implicit context:
+                                    Context)(x: BigInt, y: BigInt): Numeric {
+    try {
+      return BigIntSubtractImpl(x, y) otherwise BigIntTooBig;
+    }
+    label BigIntTooBig {
+      // Smi sentinal is used to signal BigIntTooBig exception.
+      return Convert<Smi>(0);
+    }
+  }
+
+  builtin BigIntSubtract(implicit context:
+                             Context)(xNum: Numeric, yNum: Numeric): BigInt {
+    try {
+      const x = Cast<BigInt>(xNum) otherwise MixedTypes;
+      const y = Cast<BigInt>(yNum) otherwise MixedTypes;
+
+      return BigIntSubtractImpl(x, y) otherwise BigIntTooBig;
+    }
+    label MixedTypes {
+      ThrowTypeError(MessageTemplate::kBigIntMixedTypes);
     }
     label BigIntTooBig {
-      ThrowRangeError(kBigIntTooBig);
+      ThrowRangeError(MessageTemplate::kBigIntTooBig);
     }
   }
 
diff --git a/deps/v8/src/builtins/boolean.tq b/deps/v8/src/builtins/boolean.tq
index e8feaf1cf1f762..c8f0d8134ac7b3 100644
--- a/deps/v8/src/builtins/boolean.tq
+++ b/deps/v8/src/builtins/boolean.tq
@@ -3,9 +3,15 @@
 // found in the LICENSE file.
 
 namespace boolean {
+  transitioning macro ThisBooleanValue(implicit context: Context)(
+      receiver: JSAny, method: constexpr string): Boolean {
+    return UnsafeCast<Boolean>(
+        ToThisValue(receiver, PrimitiveType::kBoolean, method));
+  }
+
   javascript builtin
   BooleanConstructor(
-      js-implicit context: Context, receiver: JSAny, newTarget: JSAny,
+      js-implicit context: NativeContext, receiver: JSAny, newTarget: JSAny,
       target: JSFunction)(...arguments): JSAny {
     const value = SelectBooleanConstant(ToBoolean(arguments[0]));
 
@@ -20,4 +26,20 @@ namespace boolean {
     obj.value = value;
     return obj;
   }
+
+  // ES #sec-boolean.prototype.tostring
+  transitioning javascript builtin BooleanPrototypeToString(
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+    // 1. Let b be ? thisBooleanValue(this value).
+    const b = ThisBooleanValue(receiver, 'Boolean.prototype.toString');
+    // 2. If b is true, return "true"; else return "false".
+    return b.to_string;
+  }
+
+  // ES #sec-boolean.prototype.valueof
+  transitioning javascript builtin BooleanPrototypeValueOf(
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+    // 1. Return ? thisBooleanValue(this value).
+    return ThisBooleanValue(receiver, 'Boolean.prototype.valueOf');
+  }
 }
diff --git a/deps/v8/src/builtins/builtins-arguments-gen.cc b/deps/v8/src/builtins/builtins-arguments-gen.cc
deleted file mode 100644
index fb6169adf86b4b..00000000000000
--- a/deps/v8/src/builtins/builtins-arguments-gen.cc
+++ /dev/null
@@ -1,340 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/builtins/builtins-arguments-gen.h"
-
-#include "src/builtins/builtins-utils-gen.h"
-#include "src/builtins/builtins.h"
-#include "src/codegen/code-factory.h"
-#include "src/codegen/code-stub-assembler.h"
-#include "src/codegen/interface-descriptors.h"
-#include "src/execution/arguments.h"
-#include "src/execution/frame-constants.h"
-#include "src/objects/arguments.h"
-#include "src/objects/objects-inl.h"
-
-namespace v8 {
-namespace internal {
-
-ArgumentsBuiltinsAssembler::ArgumentsAllocationResult
-ArgumentsBuiltinsAssembler::AllocateArgumentsObject(
-    TNode<Map> map, TNode<BInt> arguments_count,
-    TNode<BInt> parameter_map_count, int base_size) {
-  // Allocate the parameter object (either a Rest parameter object, a strict
-  // argument object or a sloppy arguments object) and the elements/mapped
-  // arguments together.
-  int elements_offset = base_size;
-  TNode<BInt> element_count = arguments_count;
-  if (parameter_map_count != nullptr) {
-    base_size += FixedArray::kHeaderSize;
-    element_count = IntPtrOrSmiAdd(element_count, parameter_map_count);
-  }
-  bool empty = IsIntPtrOrSmiConstantZero(arguments_count);
-  DCHECK_IMPLIES(empty, parameter_map_count == nullptr);
-  TNode<IntPtrT> size =
-      empty ? IntPtrConstant(base_size)
-            : ElementOffsetFromIndex(element_count, PACKED_ELEMENTS,
-                                     base_size + FixedArray::kHeaderSize);
-  TNode<HeapObject> result = Allocate(size);
-  Comment("Initialize arguments object");
-  StoreMapNoWriteBarrier(result, map);
-  TNode<FixedArray> empty_fixed_array = EmptyFixedArrayConstant();
-  StoreObjectField(result, JSArray::kPropertiesOrHashOffset, empty_fixed_array);
-  TNode<Smi> smi_arguments_count = BIntToSmi(arguments_count);
-  StoreObjectFieldNoWriteBarrier(result, JSArray::kLengthOffset,
-                                 smi_arguments_count);
-  TNode<HeapObject> arguments;
-  if (!empty) {
-    arguments = InnerAllocate(result, elements_offset);
-    StoreObjectFieldNoWriteBarrier(arguments, FixedArray::kLengthOffset,
-                                   smi_arguments_count);
-    TNode<Map> fixed_array_map = FixedArrayMapConstant();
-    StoreMapNoWriteBarrier(arguments, fixed_array_map);
-  }
-  TNode<HeapObject> parameter_map;
-  if (!parameter_map_count.is_null()) {
-    TNode<IntPtrT> parameter_map_offset = ElementOffsetFromIndex(
-        arguments_count, PACKED_ELEMENTS, FixedArray::kHeaderSize);
-    parameter_map = InnerAllocate(arguments, parameter_map_offset);
-    StoreObjectFieldNoWriteBarrier(result, JSArray::kElementsOffset,
-                                   parameter_map);
-    TNode<Map> sloppy_elements_map = SloppyArgumentsElementsMapConstant();
-    StoreMapNoWriteBarrier(parameter_map, sloppy_elements_map);
-    StoreObjectFieldNoWriteBarrier(parameter_map, FixedArray::kLengthOffset,
-                                   BIntToSmi(parameter_map_count));
-  } else {
-    if (empty) {
-      StoreObjectFieldNoWriteBarrier(result, JSArray::kElementsOffset,
-                                     empty_fixed_array);
-    } else {
-      StoreObjectFieldNoWriteBarrier(result, JSArray::kElementsOffset,
-                                     arguments);
-    }
-  }
-  return {CAST(result), UncheckedCast<FixedArray>(arguments),
-          UncheckedCast<FixedArray>(parameter_map)};
-}
-
-TNode<JSObject> ArgumentsBuiltinsAssembler::ConstructParametersObjectFromArgs(
-    TNode<Map> map, TNode<RawPtrT> frame_ptr, TNode<BInt> arg_count,
-    TNode<BInt> first_arg, TNode<BInt> rest_count, int base_size) {
-  // Allocate the parameter object (either a Rest parameter object, a strict
-  // argument object or a sloppy arguments object) and the elements together and
-  // fill in the contents with the arguments above |formal_parameter_count|.
-  ArgumentsAllocationResult alloc_result =
-      AllocateArgumentsObject(map, rest_count, {}, base_size);
-  DCHECK(alloc_result.parameter_map.is_null());
-  CodeStubArguments arguments(this, arg_count, frame_ptr);
-  TVARIABLE(IntPtrT, offset,
-            IntPtrConstant(FixedArrayBase::kHeaderSize - kHeapObjectTag));
-  VariableList list({&offset}, zone());
-  arguments.ForEach(
-      list,
-      [&](TNode<Object> arg) {
-        StoreNoWriteBarrier(MachineRepresentation::kTagged,
-                            alloc_result.elements, offset.value(), arg);
-        Increment(&offset, kTaggedSize);
-      },
-      first_arg);
-  return alloc_result.arguments_object;
-}
-
-TNode<JSObject> ArgumentsBuiltinsAssembler::EmitFastNewRestParameter(
-    TNode<Context> context, TNode<JSFunction> function) {
-  ParameterMode mode = OptimalParameterMode();
-  TNode<BInt> zero = BIntConstant(0);
-
-  TorqueStructArgumentsInfo info = GetArgumentsFrameAndCount(context, function);
-
-  TVARIABLE(JSObject, result);
-  Label no_rest_parameters(this), runtime(this, Label::kDeferred),
-      done(this, &result);
-
-  TNode<BInt> rest_count =
-      IntPtrOrSmiSub(info.argument_count, info.formal_parameter_count);
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Map> const array_map =
-      LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
-  GotoIf(IntPtrOrSmiLessThanOrEqual(rest_count, zero), &no_rest_parameters);
-
-  GotoIfFixedArraySizeDoesntFitInNewSpace(
-      rest_count, &runtime, JSArray::kSize + FixedArray::kHeaderSize, mode);
-
-  // Allocate the Rest JSArray and the elements together and fill in the
-  // contents with the arguments above |formal_parameter_count|.
-  result = ConstructParametersObjectFromArgs(
-      array_map, info.frame, info.argument_count, info.formal_parameter_count,
-      rest_count, JSArray::kSize);
-  Goto(&done);
-
-  BIND(&no_rest_parameters);
-  {
-    ArgumentsAllocationResult alloc_result =
-        AllocateArgumentsObject(array_map, zero, {}, JSArray::kSize);
-    result = alloc_result.arguments_object;
-    Goto(&done);
-  }
-
-  BIND(&runtime);
-  {
-    result = CAST(CallRuntime(Runtime::kNewRestParameter, context, function));
-    Goto(&done);
-  }
-
-  BIND(&done);
-  return result.value();
-}
-
-TNode<JSObject> ArgumentsBuiltinsAssembler::EmitFastNewStrictArguments(
-    TNode<Context> context, TNode<JSFunction> function) {
-  TVARIABLE(JSObject, result);
-  Label done(this, &result), empty(this), runtime(this, Label::kDeferred);
-
-  ParameterMode mode = OptimalParameterMode();
-  TNode<BInt> zero = BIntConstant(0);
-
-  TorqueStructArgumentsInfo info = GetArgumentsFrameAndCount(context, function);
-
-  GotoIfFixedArraySizeDoesntFitInNewSpace(
-      info.argument_count, &runtime,
-      JSStrictArgumentsObject::kSize + FixedArray::kHeaderSize, mode);
-
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Map> map = CAST(
-      LoadContextElement(native_context, Context::STRICT_ARGUMENTS_MAP_INDEX));
-  GotoIf(BIntEqual(info.argument_count, zero), &empty);
-
-  result = ConstructParametersObjectFromArgs(
-      map, info.frame, info.argument_count, zero, info.argument_count,
-      JSStrictArgumentsObject::kSize);
-  Goto(&done);
-
-  BIND(&empty);
-  {
-    ArgumentsAllocationResult alloc_result =
-        AllocateArgumentsObject(map, zero, {}, JSStrictArgumentsObject::kSize);
-    result = alloc_result.arguments_object;
-    Goto(&done);
-  }
-
-  BIND(&runtime);
-  {
-    result = CAST(CallRuntime(Runtime::kNewStrictArguments, context, function));
-    Goto(&done);
-  }
-
-  BIND(&done);
-  return result.value();
-}
-
-TNode<JSObject> ArgumentsBuiltinsAssembler::EmitFastNewSloppyArguments(
-    TNode<Context> context, TNode<JSFunction> function) {
-  TVARIABLE(JSObject, result);
-
-  ParameterMode mode = OptimalParameterMode();
-  TNode<BInt> zero = BIntConstant(0);
-
-  Label done(this, &result), empty(this), no_parameters(this),
-      runtime(this, Label::kDeferred);
-
-  TorqueStructArgumentsInfo info = GetArgumentsFrameAndCount(context, function);
-
-  GotoIf(BIntEqual(info.argument_count, zero), &empty);
-
-  GotoIf(BIntEqual(info.formal_parameter_count, zero), &no_parameters);
-
-  {
-    Comment("Mapped parameter JSSloppyArgumentsObject");
-
-    TNode<BInt> mapped_count =
-        IntPtrOrSmiMin(info.argument_count, info.formal_parameter_count);
-
-    TNode<BInt> parameter_map_size =
-        IntPtrOrSmiAdd(mapped_count, BIntConstant(2));
-
-    // Verify that the overall allocation will fit in new space.
-    TNode<BInt> elements_allocated =
-        IntPtrOrSmiAdd(info.argument_count, parameter_map_size);
-    GotoIfFixedArraySizeDoesntFitInNewSpace(
-        elements_allocated, &runtime,
-        JSSloppyArgumentsObject::kSize + FixedArray::kHeaderSize * 2, mode);
-
-    TNode<NativeContext> const native_context = LoadNativeContext(context);
-    TNode<Map> const map = CAST(LoadContextElement(
-        native_context, Context::FAST_ALIASED_ARGUMENTS_MAP_INDEX));
-    ArgumentsAllocationResult alloc_result =
-        AllocateArgumentsObject(map, info.argument_count, parameter_map_size,
-                                JSSloppyArgumentsObject::kSize);
-    StoreObjectFieldNoWriteBarrier(alloc_result.arguments_object,
-                                   JSSloppyArgumentsObject::kCalleeOffset,
-                                   function);
-    StoreFixedArrayElement(alloc_result.parameter_map, 0, context,
-                           SKIP_WRITE_BARRIER);
-    StoreFixedArrayElement(alloc_result.parameter_map, 1, alloc_result.elements,
-                           SKIP_WRITE_BARRIER);
-
-    Comment("Fill in non-mapped parameters");
-    TNode<IntPtrT> argument_offset =
-        ElementOffsetFromIndex(info.argument_count, PACKED_ELEMENTS,
-                               FixedArray::kHeaderSize - kHeapObjectTag);
-    TNode<IntPtrT> mapped_offset =
-        ElementOffsetFromIndex(mapped_count, PACKED_ELEMENTS,
-                               FixedArray::kHeaderSize - kHeapObjectTag);
-    CodeStubArguments arguments(this, info.argument_count, info.frame);
-    TVARIABLE(RawPtrT, current_argument,
-              arguments.AtIndexPtr(info.argument_count));
-    VariableList var_list1({&current_argument}, zone());
-    mapped_offset = BuildFastLoop<IntPtrT>(
-        var_list1, argument_offset, mapped_offset,
-        [&](TNode<IntPtrT> offset) {
-          Increment(&current_argument, kSystemPointerSize);
-          TNode<Object> arg = LoadBufferObject(
-              ReinterpretCast<RawPtrT>(current_argument.value()), 0);
-          StoreNoWriteBarrier(MachineRepresentation::kTagged,
-                              alloc_result.elements, offset, arg);
-          return;
-        },
-        -kTaggedSize);
-
-    // Copy the parameter slots and the holes in the arguments.
-    // We need to fill in mapped_count slots. They index the context,
-    // where parameters are stored in reverse order, at
-    //   MIN_CONTEXT_SLOTS .. MIN_CONTEXT_SLOTS+argument_count-1
-    // The mapped parameter thus need to get indices
-    //   MIN_CONTEXT_SLOTS+parameter_count-1 ..
-    //       MIN_CONTEXT_SLOTS+argument_count-mapped_count
-    // We loop from right to left.
-    Comment("Fill in mapped parameters");
-    TVARIABLE(
-        BInt, context_index,
-        IntPtrOrSmiSub(IntPtrOrSmiAdd(BIntConstant(Context::MIN_CONTEXT_SLOTS),
-                                      info.formal_parameter_count),
-                       mapped_count));
-    TNode<Oddball> the_hole = TheHoleConstant();
-    VariableList var_list2({&context_index}, zone());
-    const int kParameterMapHeaderSize = FixedArray::OffsetOfElementAt(2);
-    TNode<IntPtrT> adjusted_map_array = IntPtrAdd(
-        BitcastTaggedToWord(alloc_result.parameter_map),
-        IntPtrConstant(kParameterMapHeaderSize - FixedArray::kHeaderSize));
-    TNode<IntPtrT> zero_offset = ElementOffsetFromIndex(
-        zero, PACKED_ELEMENTS, mode, FixedArray::kHeaderSize - kHeapObjectTag);
-    BuildFastLoop<IntPtrT>(
-        var_list2, mapped_offset, zero_offset,
-        [&](TNode<IntPtrT> offset) {
-          StoreNoWriteBarrier(MachineRepresentation::kTagged,
-                              alloc_result.elements, offset, the_hole);
-          StoreNoWriteBarrier(MachineRepresentation::kTagged,
-                              adjusted_map_array, offset,
-                              BIntToSmi(context_index.value()));
-          Increment(&context_index);
-        },
-        -kTaggedSize);
-
-    result = alloc_result.arguments_object;
-    Goto(&done);
-  }
-
-  BIND(&no_parameters);
-  {
-    Comment("No parameters JSSloppyArgumentsObject");
-    GotoIfFixedArraySizeDoesntFitInNewSpace(
-        info.argument_count, &runtime,
-        JSSloppyArgumentsObject::kSize + FixedArray::kHeaderSize, mode);
-    TNode<NativeContext> const native_context = LoadNativeContext(context);
-    TNode<Map> map = CAST(LoadContextElement(
-        native_context, Context::SLOPPY_ARGUMENTS_MAP_INDEX));
-    result = ConstructParametersObjectFromArgs(
-        map, info.frame, info.argument_count, zero, info.argument_count,
-        JSSloppyArgumentsObject::kSize);
-    StoreObjectFieldNoWriteBarrier(
-        result.value(), JSSloppyArgumentsObject::kCalleeOffset, function);
-    Goto(&done);
-  }
-
-  BIND(&empty);
-  {
-    Comment("Empty JSSloppyArgumentsObject");
-    TNode<NativeContext> const native_context = LoadNativeContext(context);
-    TNode<Map> const map = CAST(LoadContextElement(
-        native_context, Context::SLOPPY_ARGUMENTS_MAP_INDEX));
-    ArgumentsAllocationResult alloc_result =
-        AllocateArgumentsObject(map, zero, {}, JSSloppyArgumentsObject::kSize);
-    result = alloc_result.arguments_object;
-    StoreObjectFieldNoWriteBarrier(
-        result.value(), JSSloppyArgumentsObject::kCalleeOffset, function);
-    Goto(&done);
-  }
-
-  BIND(&runtime);
-  {
-    result = CAST(CallRuntime(Runtime::kNewSloppyArguments, context, function));
-    Goto(&done);
-  }
-
-  BIND(&done);
-  return result.value();
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-arguments-gen.h b/deps/v8/src/builtins/builtins-arguments-gen.h
deleted file mode 100644
index 2565c3e81ff910..00000000000000
--- a/deps/v8/src/builtins/builtins-arguments-gen.h
+++ /dev/null
@@ -1,57 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_BUILTINS_BUILTINS_ARGUMENTS_GEN_H_
-#define V8_BUILTINS_BUILTINS_ARGUMENTS_GEN_H_
-
-#include "src/codegen/code-stub-assembler.h"
-
-namespace v8 {
-namespace internal {
-
-// TODO(v8:9396): these declarations pollute the v8::internal scope.
-using CodeAssemblerState = compiler::CodeAssemblerState;
-using CodeAssemblerLabel = compiler::CodeAssemblerLabel;
-
-class ArgumentsBuiltinsAssembler : public CodeStubAssembler {
- public:
-  explicit ArgumentsBuiltinsAssembler(CodeAssemblerState* state)
-      : CodeStubAssembler(state) {}
-
-  TNode<JSObject> EmitFastNewStrictArguments(TNode<Context> context,
-                                             TNode<JSFunction> function);
-  TNode<JSObject> EmitFastNewSloppyArguments(TNode<Context> context,
-                                             TNode<JSFunction> function);
-  TNode<JSObject> EmitFastNewRestParameter(TNode<Context> context,
-                                           TNode<JSFunction> function);
-
- private:
-  struct ArgumentsAllocationResult {
-    TNode<JSObject> arguments_object;
-    TNode<FixedArray> elements;
-    TNode<FixedArray> parameter_map;
-  };
-  // Allocates an an arguments (either rest, strict or sloppy) together with the
-  // FixedArray elements for the arguments and a parameter map (for sloppy
-  // arguments only, or empty TNode<> otherwise).
-  ArgumentsAllocationResult AllocateArgumentsObject(
-      TNode<Map> map, TNode<BInt> arguments, TNode<BInt> mapped_arguments,
-      int base_size);
-
-  // For Rest parameters and Strict arguments, the copying of parameters from
-  // the stack into the arguments object is straight-forward and shares much of
-  // the same underlying logic, which is encapsulated by this function. It
-  // allocates an arguments-like object of size |base_size| with the map |map|,
-  // and then copies |rest_count| arguments from the stack frame pointed to by
-  // |frame_ptr| starting from |first_arg|. |arg_count| == |first_arg| +
-  // |rest_count|.
-  TNode<JSObject> ConstructParametersObjectFromArgs(
-      TNode<Map> map, TNode<RawPtrT> frame_ptr, TNode<BInt> arg_count,
-      TNode<BInt> first_arg, TNode<BInt> rest_count, int base_size);
-};
-
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_BUILTINS_BUILTINS_ARGUMENTS_GEN_H_
diff --git a/deps/v8/src/builtins/builtins-array-gen.cc b/deps/v8/src/builtins/builtins-array-gen.cc
index f176924ae5869b..1892406305be5e 100644
--- a/deps/v8/src/builtins/builtins-array-gen.cc
+++ b/deps/v8/src/builtins/builtins-array-gen.cc
@@ -32,15 +32,13 @@ ArrayBuiltinsAssembler::ArrayBuiltinsAssembler(
 void ArrayBuiltinsAssembler::TypedArrayMapResultGenerator() {
   // 6. Let A be ? TypedArraySpeciesCreate(O, len).
   TNode<JSTypedArray> original_array = CAST(o());
-  TNode<Smi> length = CAST(len_);
   const char* method_name = "%TypedArray%.prototype.map";
 
   TNode<JSTypedArray> a = TypedArraySpeciesCreateByLength(
-      context(), method_name, original_array, length);
+      context(), method_name, original_array, len());
   // In the Spec and our current implementation, the length check is already
   // performed in TypedArraySpeciesCreate.
-  CSA_ASSERT(this, UintPtrLessThanOrEqual(SmiUntag(CAST(len_)),
-                                          LoadJSTypedArrayLength(a)));
+  CSA_ASSERT(this, UintPtrLessThanOrEqual(len(), LoadJSTypedArrayLength(a)));
   fast_typed_array_target_ =
       Word32Equal(LoadElementsKind(original_array), LoadElementsKind(a));
   a_ = a;
@@ -48,11 +46,12 @@ void ArrayBuiltinsAssembler::TypedArrayMapResultGenerator() {
 
 // See tc39.github.io/ecma262/#sec-%typedarray%.prototype.map.
 TNode<Object> ArrayBuiltinsAssembler::TypedArrayMapProcessor(
-    TNode<Object> k_value, TNode<Object> k) {
+    TNode<Object> k_value, TNode<UintPtrT> k) {
   // 8. c. Let mapped_value be ? Call(callbackfn, T, « kValue, k, O »).
+  TNode<Number> k_number = ChangeUintPtrToTagged(k);
   TNode<Object> mapped_value =
       CallJS(CodeFactory::Call(isolate()), context(), callbackfn(), this_arg(),
-             k_value, k, o());
+             k_value, k_number, o());
   Label fast(this), slow(this), done(this), detached(this, Label::kDeferred);
 
   // 8. d. Perform ? Set(A, Pk, mapped_value, true).
@@ -73,14 +72,20 @@ TNode<Object> ArrayBuiltinsAssembler::TypedArrayMapProcessor(
   } else {
     num_value = ToNumber_Inline(context(), mapped_value);
   }
+
   // The only way how this can bailout is because of a detached buffer.
-  EmitElementStore(a(), k, num_value, source_elements_kind_,
+  // TODO(v8:4153): Consider checking IsDetachedBuffer() and calling
+  // TypedArrayBuiltinsAssembler::StoreJSTypedArrayElementFromNumeric() here
+  // instead to avoid converting k_number back to UintPtrT.
+  EmitElementStore(CAST(a()), k_number, num_value, source_elements_kind_,
                    KeyedAccessStoreMode::STANDARD_STORE, &detached, context());
   Goto(&done);
 
   BIND(&slow);
-  SetPropertyStrict(context(), a(), k, mapped_value);
-  Goto(&done);
+  {
+    SetPropertyStrict(context(), a(), k_number, mapped_value);
+    Goto(&done);
+  }
 
   BIND(&detached);
   // tc39.github.io/ecma262/#sec-integerindexedelementset
@@ -130,7 +135,7 @@ void ArrayBuiltinsAssembler::GenerateIteratingTypedArrayBuiltinBody(
   TNode<JSArrayBuffer> array_buffer = LoadJSArrayBufferViewBuffer(typed_array);
   ThrowIfArrayBufferIsDetached(context_, array_buffer, name_);
 
-  len_ = ChangeUintPtrToTagged(LoadJSTypedArrayLength(typed_array));
+  len_ = LoadJSTypedArrayLength(typed_array);
 
   Label throw_not_callable(this, Label::kDeferred);
   Label distinguish_types(this);
@@ -166,12 +171,6 @@ void ArrayBuiltinsAssembler::GenerateIteratingTypedArrayBuiltinBody(
 
   generator(this);
 
-  if (direction == ForEachDirection::kForward) {
-    k_ = SmiConstant(0);
-  } else {
-    k_ = NumberDec(len());
-  }
-  CSA_ASSERT(this, IsSafeInteger(k()));
   TNode<Int32T> elements_kind = LoadMapElementsKind(typed_array_map);
   Switch(elements_kind, &unexpected_instance_type, elements_kinds.data(),
          label_ptrs.data(), labels.size());
@@ -199,8 +198,8 @@ void ArrayBuiltinsAssembler::VisitAllTypedArrayElements(
     TNode<JSTypedArray> typed_array) {
   VariableList list({&a_, &k_}, zone());
 
-  TNode<Smi> start = SmiConstant(0);
-  TNode<Smi> end = CAST(len_);
+  TNode<UintPtrT> start = UintPtrConstant(0);
+  TNode<UintPtrT> end = len_;
   IndexAdvanceMode advance_mode = IndexAdvanceMode::kPost;
   int incr = 1;
   if (direction == ForEachDirection::kReverse) {
@@ -208,13 +207,14 @@ void ArrayBuiltinsAssembler::VisitAllTypedArrayElements(
     advance_mode = IndexAdvanceMode::kPre;
     incr = -1;
   }
-  BuildFastLoop<Smi>(
+  k_ = start;
+  BuildFastLoop<UintPtrT>(
       list, start, end,
-      [&](TNode<Smi> index) {
+      [&](TNode<UintPtrT> index) {
         GotoIf(IsDetachedBuffer(array_buffer), detached);
         TNode<RawPtrT> data_ptr = LoadJSTypedArrayDataPtr(typed_array);
         TNode<Numeric> value = LoadFixedTypedArrayElementAsTagged(
-            data_ptr, index, source_elements_kind_, SMI_PARAMETERS);
+            data_ptr, index, source_elements_kind_);
         k_ = index;
         a_ = processor(this, value, index);
       },
@@ -250,7 +250,7 @@ TF_BUILTIN(ArrayPrototypePop, CodeStubAssembler) {
     GotoIf(IntPtrEqual(length, IntPtrConstant(0)), &return_undefined);
 
     // 2) Ensure that the length is writable.
-    EnsureArrayLengthWritable(LoadMap(array_receiver), &runtime);
+    EnsureArrayLengthWritable(context, LoadMap(array_receiver), &runtime);
 
     // 3) Check that the elements backing store isn't copy-on-write.
     TNode<FixedArrayBase> elements = LoadElements(array_receiver);
@@ -339,7 +339,7 @@ TF_BUILTIN(ArrayPrototypePush, CodeStubAssembler) {
   {
     array_receiver = CAST(receiver);
     arg_index = IntPtrConstant(0);
-    kind = EnsureArrayPushable(LoadMap(array_receiver), &runtime);
+    kind = EnsureArrayPushable(context, LoadMap(array_receiver), &runtime);
     GotoIf(IsElementsKindGreaterThan(kind, HOLEY_SMI_ELEMENTS),
            &object_push_pre);
 
@@ -442,8 +442,8 @@ TF_BUILTIN(ExtractFastJSArray, ArrayBuiltinsAssembler) {
   ParameterMode mode = OptimalParameterMode();
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<JSArray> array = CAST(Parameter(Descriptor::kSource));
-  Node* begin = TaggedToParameter(Parameter(Descriptor::kBegin), mode);
-  Node* count = TaggedToParameter(Parameter(Descriptor::kCount), mode);
+  TNode<BInt> begin = SmiToBInt(CAST(Parameter(Descriptor::kBegin)));
+  TNode<BInt> count = SmiToBInt(CAST(Parameter(Descriptor::kCount)));
 
   CSA_ASSERT(this, Word32BinaryNot(IsNoElementsProtectorCellInvalid()));
 
@@ -459,8 +459,7 @@ TF_BUILTIN(CloneFastJSArray, ArrayBuiltinsAssembler) {
                           LoadElementsKind(array))),
                       Word32BinaryNot(IsNoElementsProtectorCellInvalid())));
 
-  ParameterMode mode = OptimalParameterMode();
-  Return(CloneFastJSArray(context, array, mode));
+  Return(CloneFastJSArray(context, array));
 }
 
 // This builtin copies the backing store of fast arrays, while converting any
@@ -479,8 +478,7 @@ TF_BUILTIN(CloneFastJSArrayFillingHoles, ArrayBuiltinsAssembler) {
                           LoadElementsKind(array))),
                       Word32BinaryNot(IsNoElementsProtectorCellInvalid())));
 
-  ParameterMode mode = OptimalParameterMode();
-  Return(CloneFastJSArray(context, array, mode, {},
+  Return(CloneFastJSArray(context, array, {},
                           HoleConversionMode::kConvertToUndefined));
 }
 
@@ -509,9 +507,9 @@ class ArrayPopulatorAssembler : public CodeStubAssembler {
       TNode<Map> array_map = CAST(LoadContextElement(
           context, Context::JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX));
 
-      array =
-          AllocateJSArray(PACKED_SMI_ELEMENTS, array_map, SmiConstant(0),
-                          SmiConstant(0), {}, ParameterMode::SMI_PARAMETERS);
+      TNode<IntPtrT> capacity = IntPtrConstant(0);
+      TNode<Smi> length = SmiConstant(0);
+      array = AllocateJSArray(PACKED_SMI_ELEMENTS, array_map, capacity, length);
       Goto(&done);
     }
 
@@ -545,218 +543,6 @@ class ArrayPopulatorAssembler : public CodeStubAssembler {
   }
 };
 
-// ES #sec-array.from
-TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Int32T> argc =
-      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
-
-  CodeStubArguments args(this, argc);
-  TNode<Object> items = args.GetOptionalArgumentValue(0);
-  TNode<Object> receiver = args.GetReceiver();
-
-  Label fast_iterate(this), normal_iterate(this);
-
-  // Use fast path if:
-  // * |items| is the only argument, and
-  // * the receiver is the Array function.
-  GotoIfNot(Word32Equal(argc, Int32Constant(1)), &normal_iterate);
-  TNode<Object> array_function = LoadContextElement(
-      LoadNativeContext(context), Context::ARRAY_FUNCTION_INDEX);
-  Branch(TaggedEqual(array_function, receiver), &fast_iterate, &normal_iterate);
-
-  BIND(&fast_iterate);
-  {
-    IteratorBuiltinsAssembler iterator_assembler(state());
-    TVARIABLE(Object, var_fast_result);
-    iterator_assembler.FastIterableToList(context, items, &var_fast_result,
-                                          &normal_iterate);
-    args.PopAndReturn(var_fast_result.value());
-  }
-
-  BIND(&normal_iterate);
-  TNode<Object> map_function = args.GetOptionalArgumentValue(1);
-
-  // If map_function is not undefined, then ensure it's callable else throw.
-  {
-    Label no_error(this), error(this);
-    GotoIf(IsUndefined(map_function), &no_error);
-    GotoIf(TaggedIsSmi(map_function), &error);
-    Branch(IsCallable(CAST(map_function)), &no_error, &error);
-
-    BIND(&error);
-    ThrowTypeError(context, MessageTemplate::kCalledNonCallable, map_function);
-
-    BIND(&no_error);
-  }
-
-  Label iterable(this), not_iterable(this), finished(this), if_exception(this);
-
-  TNode<Object> this_arg = args.GetOptionalArgumentValue(2);
-  // The spec doesn't require ToObject to be called directly on the iterable
-  // branch, but it's part of GetMethod that is in the spec.
-  TNode<JSReceiver> array_like = ToObject_Inline(context, items);
-
-  TVARIABLE(Object, array);
-  TVARIABLE(Number, length);
-
-  // Determine whether items[Symbol.iterator] is defined:
-  IteratorBuiltinsAssembler iterator_assembler(state());
-  TNode<Object> iterator_method =
-      iterator_assembler.GetIteratorMethod(context, array_like);
-  Branch(IsNullOrUndefined(iterator_method), &not_iterable, &iterable);
-
-  BIND(&iterable);
-  {
-    TVARIABLE(Number, index, SmiConstant(0));
-    TVARIABLE(Object, var_exception);
-    Label loop(this, &index), loop_done(this),
-        on_exception(this, Label::kDeferred),
-        index_overflow(this, Label::kDeferred);
-
-    // Check that the method is callable.
-    {
-      Label get_method_not_callable(this, Label::kDeferred), next(this);
-      GotoIf(TaggedIsSmi(iterator_method), &get_method_not_callable);
-      GotoIfNot(IsCallable(CAST(iterator_method)), &get_method_not_callable);
-      Goto(&next);
-
-      BIND(&get_method_not_callable);
-      ThrowTypeError(context, MessageTemplate::kCalledNonCallable,
-                     iterator_method);
-
-      BIND(&next);
-    }
-
-    // Construct the output array with empty length.
-    array = ConstructArrayLike(context, receiver);
-
-    // Actually get the iterator and throw if the iterator method does not yield
-    // one.
-    IteratorRecord iterator_record =
-        iterator_assembler.GetIterator(context, items, iterator_method);
-
-    TNode<NativeContext> native_context = LoadNativeContext(context);
-    TNode<Map> fast_iterator_result_map = CAST(
-        LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX));
-
-    Goto(&loop);
-
-    BIND(&loop);
-    {
-      // Loop while iterator is not done.
-      TNode<JSReceiver> next = iterator_assembler.IteratorStep(
-          context, iterator_record, &loop_done, fast_iterator_result_map);
-      TVARIABLE(Object, value,
-                iterator_assembler.IteratorValue(context, next,
-                                                 fast_iterator_result_map));
-
-      // If a map_function is supplied then call it (using this_arg as
-      // receiver), on the value returned from the iterator. Exceptions are
-      // caught so the iterator can be closed.
-      {
-        Label next(this);
-        GotoIf(IsUndefined(map_function), &next);
-
-        CSA_ASSERT(this, IsCallable(CAST(map_function)));
-        Node* v = CallJS(CodeFactory::Call(isolate()), context, map_function,
-                         this_arg, value.value(), index.value());
-        GotoIfException(v, &on_exception, &var_exception);
-        value = CAST(v);
-        Goto(&next);
-        BIND(&next);
-      }
-
-      // Store the result in the output object (catching any exceptions so the
-      // iterator can be closed).
-      TNode<Object> define_status =
-          CallRuntime(Runtime::kCreateDataProperty, context, array.value(),
-                      index.value(), value.value());
-      GotoIfException(define_status, &on_exception, &var_exception);
-
-      index = NumberInc(index.value());
-
-      // The spec requires that we throw an exception if index reaches 2^53-1,
-      // but an empty loop would take >100 days to do this many iterations. To
-      // actually run for that long would require an iterator that never set
-      // done to true and a target array which somehow never ran out of memory,
-      // e.g. a proxy that discarded the values. Ignoring this case just means
-      // we would repeatedly call CreateDataProperty with index = 2^53.
-      CSA_ASSERT_BRANCH(this, [&](Label* ok, Label* not_ok) {
-        BranchIfNumberRelationalComparison(Operation::kLessThan, index.value(),
-                                           NumberConstant(kMaxSafeInteger), ok,
-                                           not_ok);
-      });
-      Goto(&loop);
-    }
-
-    BIND(&loop_done);
-    {
-      length = index;
-      Goto(&finished);
-    }
-
-    BIND(&on_exception);
-    {
-      // Close the iterator, rethrowing either the passed exception or
-      // exceptions thrown during the close.
-      iterator_assembler.IteratorCloseOnException(context, iterator_record,
-                                                  var_exception.value());
-    }
-  }
-
-  BIND(&not_iterable);
-  {
-    // Treat array_like as an array and try to get its length.
-    length = ToLength_Inline(
-        context, GetProperty(context, array_like, factory()->length_string()));
-
-    // Construct an array using the receiver as constructor with the same length
-    // as the input array.
-    array = ConstructArrayLike(context, receiver, length.value());
-
-    TVARIABLE(Number, index, SmiConstant(0));
-
-    GotoIf(TaggedEqual(length.value(), SmiConstant(0)), &finished);
-
-    // Loop from 0 to length-1.
-    {
-      Label loop(this, &index);
-      Goto(&loop);
-      BIND(&loop);
-      TVARIABLE(Object, value);
-
-      value = GetProperty(context, array_like, index.value());
-
-      // If a map_function is supplied then call it (using this_arg as
-      // receiver), on the value retrieved from the array.
-      {
-        Label next(this);
-        GotoIf(IsUndefined(map_function), &next);
-
-        CSA_ASSERT(this, IsCallable(CAST(map_function)));
-        value = CallJS(CodeFactory::Call(isolate()), context, map_function,
-                       this_arg, value.value(), index.value());
-        Goto(&next);
-        BIND(&next);
-      }
-
-      // Store the result in the output object.
-      CallRuntime(Runtime::kCreateDataProperty, context, array.value(),
-                  index.value(), value.value());
-      index = NumberInc(index.value());
-      BranchIfNumberRelationalComparison(Operation::kLessThan, index.value(),
-                                         length.value(), &loop, &finished);
-    }
-  }
-
-  BIND(&finished);
-
-  // Finally set the length on the output and return it.
-  SetPropertyLength(context, array.value(), length.value());
-  args.PopAndReturn(array.value());
-}
-
 TF_BUILTIN(TypedArrayPrototypeMap, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
@@ -774,31 +560,6 @@ TF_BUILTIN(TypedArrayPrototypeMap, ArrayBuiltinsAssembler) {
       &ArrayBuiltinsAssembler::TypedArrayMapProcessor);
 }
 
-TF_BUILTIN(ArrayIsArray, CodeStubAssembler) {
-  TNode<Object> object = CAST(Parameter(Descriptor::kArg));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  Label call_runtime(this), return_true(this), return_false(this);
-
-  GotoIf(TaggedIsSmi(object), &return_false);
-  TNode<Uint16T> instance_type = LoadInstanceType(CAST(object));
-
-  GotoIf(InstanceTypeEqual(instance_type, JS_ARRAY_TYPE), &return_true);
-
-  // TODO(verwaest): Handle proxies in-place.
-  Branch(InstanceTypeEqual(instance_type, JS_PROXY_TYPE), &call_runtime,
-         &return_false);
-
-  BIND(&return_true);
-  Return(TrueConstant());
-
-  BIND(&return_false);
-  Return(FalseConstant());
-
-  BIND(&call_runtime);
-  Return(CallRuntime(Runtime::kArrayIsArray, context, object));
-}
-
 class ArrayIncludesIndexofAssembler : public CodeStubAssembler {
  public:
   explicit ArrayIncludesIndexofAssembler(compiler::CodeAssemblerState* state)
@@ -1439,12 +1200,10 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
   TNode<JSArrayIterator> iterator = CAST(maybe_iterator);
 
   // Let a be O.[[IteratedObject]].
-  TNode<JSReceiver> array =
-      CAST(LoadObjectField(iterator, JSArrayIterator::kIteratedObjectOffset));
+  TNode<JSReceiver> array = LoadJSArrayIteratorIteratedObject(iterator);
 
   // Let index be O.[[ArrayIteratorNextIndex]].
-  TNode<Number> index =
-      CAST(LoadObjectField(iterator, JSArrayIterator::kNextIndexOffset));
+  TNode<Number> index = LoadJSArrayIteratorNextIndex(iterator);
   CSA_ASSERT(this, IsNumberNonNegativeSafeInteger(index));
 
   // Dispatch based on the type of the {array}.
@@ -1465,9 +1224,8 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
     TNode<Uint32T> length32 =
         ChangeNumberToUint32(LoadJSArrayLength(CAST(array)));
     GotoIfNot(Uint32LessThan(index32, length32), &set_done);
-    StoreObjectField(
-        iterator, JSArrayIterator::kNextIndexOffset,
-        ChangeUint32ToTagged(Unsigned(Int32Add(index32, Int32Constant(1)))));
+    StoreJSArrayIteratorNextIndex(
+        iterator, ChangeUint32ToTagged(Uint32Add(index32, Uint32Constant(1))));
 
     var_done = FalseConstant();
     var_value = index;
@@ -1507,8 +1265,7 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
         CallBuiltin(Builtins::kToLength, context,
                     GetProperty(context, array, factory()->length_string())));
     GotoIfNumberGreaterThanOrEqual(index, length, &set_done);
-    StoreObjectField(iterator, JSArrayIterator::kNextIndexOffset,
-                     NumberInc(index));
+    StoreJSArrayIteratorNextIndex(iterator, NumberInc(index));
 
     var_done = FalseConstant();
     var_value = index;
@@ -1541,7 +1298,7 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
     TNode<Number> max_length =
         SelectConstant(IsJSArray(array), NumberConstant(kMaxUInt32),
                        NumberConstant(kMaxSafeInteger));
-    StoreObjectField(iterator, JSArrayIterator::kNextIndexOffset, max_length);
+    StoreJSArrayIteratorNextIndex(iterator, max_length);
     Goto(&allocate_iterator_result);
   }
 
@@ -1553,9 +1310,9 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
 
   BIND(&if_typedarray);
   {
-    // If {array} is a JSTypedArray, the {index} must always be a Smi.
-    // TODO(v8:4153): Update this and the relevant TurboFan code.
-    CSA_ASSERT(this, TaggedIsSmi(index));
+    // Overflowing uintptr range also means end of iteration.
+    TNode<UintPtrT> index_uintptr =
+        ChangeSafeIntegerNumberToUintPtr(index, &allocate_iterator_result);
 
     // Check that the {array}s buffer wasn't detached.
     ThrowIfArrayBufferViewBufferIsDetached(context, CAST(array), method_name);
@@ -1565,10 +1322,13 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
     // length cannot change anymore, so this {iterator} will never
     // produce values again anyways.
     TNode<UintPtrT> length = LoadJSTypedArrayLength(CAST(array));
-    GotoIfNot(UintPtrLessThan(SmiUntag(CAST(index)), length),
+    GotoIfNot(UintPtrLessThan(index_uintptr, length),
               &allocate_iterator_result);
-    StoreObjectFieldNoWriteBarrier(iterator, JSArrayIterator::kNextIndexOffset,
-                                   SmiInc(CAST(index)));
+    // TODO(v8:4153): Consider storing next index as uintptr. Update this and
+    // the relevant TurboFan code.
+    StoreJSArrayIteratorNextIndex(
+        iterator,
+        ChangeUintPtrToTagged(UintPtrAdd(index_uintptr, UintPtrConstant(1))));
 
     var_done = FalseConstant();
     var_value = index;
@@ -1580,7 +1340,7 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
 
     TNode<Int32T> elements_kind = LoadMapElementsKind(array_map);
     TNode<RawPtrT> data_ptr = LoadJSTypedArrayDataPtr(CAST(array));
-    var_value = LoadFixedTypedArrayElementAsTagged(data_ptr, CAST(index),
+    var_value = LoadFixedTypedArrayElementAsTagged(data_ptr, index_uintptr,
                                                    elements_kind);
     Goto(&allocate_entry_if_needed);
   }
@@ -1641,7 +1401,7 @@ class ArrayFlattenAssembler : public CodeStubAssembler {
       // b. Let exists be ? HasProperty(source, P).
       CSA_ASSERT(this,
                  SmiGreaterThanOrEqual(CAST(source_index), SmiConstant(0)));
-      TNode<Oddball> const exists =
+      const TNode<Oddball> exists =
           HasProperty(context, source, source_index, kHasProperty);
 
       // c. If exists is true, then
@@ -1683,7 +1443,7 @@ class ArrayFlattenAssembler : public CodeStubAssembler {
           CSA_ASSERT(this, IsJSArray(element));
 
           // 1. Let elementLen be ? ToLength(? Get(element, "length")).
-          TNode<Object> const element_length =
+          const TNode<Object> element_length =
               LoadObjectField(element, JSArray::kLengthOffset);
 
           // 2. Set targetIndex to ? FlattenIntoArray(target, element,
@@ -1700,7 +1460,7 @@ class ArrayFlattenAssembler : public CodeStubAssembler {
           CSA_ASSERT(this, IsJSProxy(element));
 
           // 1. Let elementLen be ? ToLength(? Get(element, "length")).
-          TNode<Number> const element_length = ToLength_Inline(
+          const TNode<Number> element_length = ToLength_Inline(
               context, GetProperty(context, element, LengthStringConstant()));
 
           // 2. Set targetIndex to ? FlattenIntoArray(target, element,
@@ -1781,18 +1541,18 @@ TF_BUILTIN(FlatMapIntoArray, ArrayFlattenAssembler) {
 
 // https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flat
 TF_BUILTIN(ArrayPrototypeFlat, CodeStubAssembler) {
-  TNode<IntPtrT> const argc =
+  const TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> const context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> const receiver = args.GetReceiver();
-  TNode<Object> const depth = args.GetOptionalArgumentValue(0);
+  const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  const TNode<Object> receiver = args.GetReceiver();
+  const TNode<Object> depth = args.GetOptionalArgumentValue(0);
 
   // 1. Let O be ? ToObject(this value).
-  TNode<JSReceiver> const o = ToObject_Inline(context, receiver);
+  const TNode<JSReceiver> o = ToObject_Inline(context, receiver);
 
   // 2. Let sourceLen be ? ToLength(? Get(O, "length")).
-  TNode<Number> const source_length =
+  const TNode<Number> source_length =
       ToLength_Inline(context, GetProperty(context, o, LengthStringConstant()));
 
   // 3. Let depthNum be 1.
@@ -1809,9 +1569,9 @@ TF_BUILTIN(ArrayPrototypeFlat, CodeStubAssembler) {
   BIND(&done);
 
   // 5. Let A be ? ArraySpeciesCreate(O, 0).
-  TNode<JSReceiver> const constructor =
+  const TNode<JSReceiver> constructor =
       CAST(CallRuntime(Runtime::kArraySpeciesConstructor, context, o));
-  TNode<JSReceiver> const a = Construct(context, constructor, SmiConstant(0));
+  const TNode<JSReceiver> a = Construct(context, constructor, SmiConstant(0));
 
   // 6. Perform ? FlattenIntoArray(A, O, sourceLen, 0, depthNum).
   CallBuiltin(Builtins::kFlattenIntoArray, context, a, o, source_length,
@@ -1823,18 +1583,18 @@ TF_BUILTIN(ArrayPrototypeFlat, CodeStubAssembler) {
 
 // https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatMap
 TF_BUILTIN(ArrayPrototypeFlatMap, CodeStubAssembler) {
-  TNode<IntPtrT> const argc =
+  const TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> const context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> const receiver = args.GetReceiver();
-  TNode<Object> const mapper_function = args.GetOptionalArgumentValue(0);
+  const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  const TNode<Object> receiver = args.GetReceiver();
+  const TNode<Object> mapper_function = args.GetOptionalArgumentValue(0);
 
   // 1. Let O be ? ToObject(this value).
-  TNode<JSReceiver> const o = ToObject_Inline(context, receiver);
+  const TNode<JSReceiver> o = ToObject_Inline(context, receiver);
 
   // 2. Let sourceLen be ? ToLength(? Get(O, "length")).
-  TNode<Number> const source_length =
+  const TNode<Number> source_length =
       ToLength_Inline(context, GetProperty(context, o, LengthStringConstant()));
 
   // 3. If IsCallable(mapperFunction) is false, throw a TypeError exception.
@@ -1843,12 +1603,12 @@ TF_BUILTIN(ArrayPrototypeFlatMap, CodeStubAssembler) {
   GotoIfNot(IsCallable(CAST(mapper_function)), &if_not_callable);
 
   // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-  TNode<Object> const t = args.GetOptionalArgumentValue(1);
+  const TNode<Object> t = args.GetOptionalArgumentValue(1);
 
   // 5. Let A be ? ArraySpeciesCreate(O, 0).
-  TNode<JSReceiver> const constructor =
+  const TNode<JSReceiver> constructor =
       CAST(CallRuntime(Runtime::kArraySpeciesConstructor, context, o));
-  TNode<JSReceiver> const a = Construct(context, constructor, SmiConstant(0));
+  const TNode<JSReceiver> a = Construct(context, constructor, SmiConstant(0));
 
   // 6. Perform ? FlattenIntoArray(A, O, sourceLen, 0, 1, mapperFunction, T).
   CallBuiltin(Builtins::kFlatMapIntoArray, context, a, o, source_length,
@@ -2093,7 +1853,7 @@ void ArrayBuiltinsAssembler::GenerateConstructor(
           IsDoubleElementsKind(elements_kind) ? kDoubleSize : kTaggedSize;
       int max_fast_elements =
           (kMaxRegularHeapObjectSize - FixedArray::kHeaderSize -
-           JSArray::kSize - AllocationMemento::kSize) /
+           JSArray::kHeaderSize - AllocationMemento::kSize) /
           element_size;
       Branch(SmiAboveOrEqual(array_size_smi, SmiConstant(max_fast_elements)),
              &call_runtime, &small_smi_size);
@@ -2104,8 +1864,7 @@ void ArrayBuiltinsAssembler::GenerateConstructor(
       TNode<JSArray> array = AllocateJSArray(
           elements_kind, array_map, array_size_smi, array_size_smi,
           mode == DONT_TRACK_ALLOCATION_SITE ? TNode<AllocationSite>()
-                                             : CAST(allocation_site),
-          CodeStubAssembler::SMI_PARAMETERS);
+                                             : CAST(allocation_site));
       Return(array);
     }
   }
@@ -2233,16 +1992,5 @@ GENERATE_ARRAY_CTOR(SingleArgument, HoleyDouble, HOLEY_DOUBLE_ELEMENTS,
 
 #undef GENERATE_ARRAY_CTOR
 
-TF_BUILTIN(InternalArrayNoArgumentConstructor_Packed, ArrayBuiltinsAssembler) {
-  using Descriptor = ArrayNoArgumentConstructorDescriptor;
-  TNode<Map> array_map =
-      CAST(LoadObjectField(Parameter(Descriptor::kFunction),
-                           JSFunction::kPrototypeOrInitialMapOffset));
-  TNode<JSArray> array = AllocateJSArray(
-      PACKED_ELEMENTS, array_map,
-      IntPtrConstant(JSArray::kPreallocatedArrayElements), SmiConstant(0));
-  Return(array);
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-array-gen.h b/deps/v8/src/builtins/builtins-array-gen.h
index a19ba1a5da1baa..088af90665da5a 100644
--- a/deps/v8/src/builtins/builtins-array-gen.h
+++ b/deps/v8/src/builtins/builtins-array-gen.h
@@ -18,12 +18,13 @@ class ArrayBuiltinsAssembler : public CodeStubAssembler {
       std::function<void(ArrayBuiltinsAssembler* masm)>;
 
   using CallResultProcessor = std::function<TNode<Object>(
-      ArrayBuiltinsAssembler* masm, TNode<Object> k_value, TNode<Object> k)>;
+      ArrayBuiltinsAssembler* masm, TNode<Object> k_value, TNode<UintPtrT> k)>;
 
   void TypedArrayMapResultGenerator();
 
   // See tc39.github.io/ecma262/#sec-%typedarray%.prototype.map.
-  TNode<Object> TypedArrayMapProcessor(TNode<Object> k_value, TNode<Object> k);
+  TNode<Object> TypedArrayMapProcessor(TNode<Object> k_value,
+                                       TNode<UintPtrT> k);
 
   TNode<String> CallJSArrayArrayJoinConcatToSequentialString(
       TNode<FixedArray> fixed_array, TNode<IntPtrT> length, TNode<String> sep,
@@ -47,10 +48,10 @@ class ArrayBuiltinsAssembler : public CodeStubAssembler {
   TNode<Object> receiver() { return receiver_; }
   TNode<IntPtrT> argc() { return argc_; }
   TNode<JSReceiver> o() { return o_; }
-  TNode<Number> len() { return len_; }
+  TNode<UintPtrT> len() { return len_; }
   TNode<Object> callbackfn() { return callbackfn_; }
   TNode<Object> this_arg() { return this_arg_; }
-  TNode<Number> k() { return k_.value(); }
+  TNode<UintPtrT> k() { return k_.value(); }
   TNode<Object> a() { return a_.value(); }
 
   void ReturnFromBuiltin(TNode<Object> value);
@@ -109,13 +110,13 @@ class ArrayBuiltinsAssembler : public CodeStubAssembler {
   TNode<Object> callbackfn_;
   TNode<JSReceiver> o_;
   TNode<Object> this_arg_;
-  TNode<Number> len_;
+  TNode<UintPtrT> len_;
   TNode<Context> context_;
   TNode<Object> receiver_;
   TNode<IntPtrT> argc_;
   TNode<BoolT> fast_typed_array_target_;
   const char* name_ = nullptr;
-  TVariable<Number> k_;
+  TVariable<UintPtrT> k_;
   TVariable<Object> a_;
   Label fully_spec_compliant_;
   ElementsKind source_elements_kind_ = ElementsKind::NO_ELEMENTS;
diff --git a/deps/v8/src/builtins/builtins-array.cc b/deps/v8/src/builtins/builtins-array.cc
index 8002c069962a10..40accae57a796a 100644
--- a/deps/v8/src/builtins/builtins-array.cc
+++ b/deps/v8/src/builtins/builtins-array.cc
@@ -336,11 +336,8 @@ V8_WARN_UNUSED_RESULT Object GenericArrayPush(Isolate* isolate,
           isolate, Object::SetElement(isolate, receiver, length, element,
                                       ShouldThrow::kThrowOnError));
     } else {
-      bool success;
-      LookupIterator it = LookupIterator::PropertyOrElement(
-          isolate, receiver, isolate->factory()->NewNumber(length), &success);
-      // Must succeed since we always pass a valid key.
-      DCHECK(success);
+      LookupIterator::Key key(isolate, length);
+      LookupIterator it(isolate, receiver, key);
       MAYBE_RETURN(Object::SetProperty(&it, element, StoreOrigin::kMaybeKeyed,
                                        Just(ShouldThrow::kThrowOnError)),
                    ReadOnlyRoots(isolate).exception());
@@ -783,10 +780,10 @@ class ArrayConcatVisitor {
     storage_ = isolate_->global_handles()->Create(storage);
   }
 
-  using FastElementsField = BitField<bool, 0, 1>;
-  using ExceedsLimitField = BitField<bool, 1, 1>;
-  using IsFixedArrayField = BitField<bool, 2, 1>;
-  using HasSimpleElementsField = BitField<bool, 3, 1>;
+  using FastElementsField = base::BitField<bool, 0, 1>;
+  using ExceedsLimitField = base::BitField<bool, 1, 1>;
+  using IsFixedArrayField = base::BitField<bool, 2, 1>;
+  using HasSimpleElementsField = base::BitField<bool, 3, 1>;
 
   bool fast_elements() const { return FastElementsField::decode(bit_field_); }
   void set_fast_elements(bool fast) {
@@ -853,9 +850,8 @@ uint32_t EstimateElementCount(Isolate* isolate, Handle<JSArray> array) {
     }
     case DICTIONARY_ELEMENTS: {
       NumberDictionary dictionary = NumberDictionary::cast(array->elements());
-      int capacity = dictionary.Capacity();
       ReadOnlyRoots roots(isolate);
-      for (int i = 0; i < capacity; i++) {
+      for (InternalIndex i : dictionary.IterateEntries()) {
         Object key = dictionary.KeyAt(i);
         if (dictionary.IsKey(roots, key)) {
           element_count++;
@@ -930,7 +926,7 @@ void CollectElementIndices(Isolate* isolate, Handle<JSObject> object,
       uint32_t capacity = dict.Capacity();
       ReadOnlyRoots roots(isolate);
       FOR_WITH_HANDLE_SCOPE(isolate, uint32_t, j = 0, j, j < capacity, j++, {
-        Object k = dict.KeyAt(j);
+        Object k = dict.KeyAt(InternalIndex(j));
         if (!dict.IsKey(roots, k)) continue;
         DCHECK(k.IsNumber());
         uint32_t index = static_cast<uint32_t>(k.Number());
@@ -945,15 +941,15 @@ void CollectElementIndices(Isolate* isolate, Handle<JSObject> object,
       TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
       {
-        // TODO(bmeurer, v8:4153): Change this to size_t later.
-        uint32_t length =
-            static_cast<uint32_t>(Handle<JSTypedArray>::cast(object)->length());
+        size_t length = Handle<JSTypedArray>::cast(object)->length();
         if (range <= length) {
           length = range;
           // We will add all indices, so we might as well clear it first
           // and avoid duplicates.
           indices->clear();
         }
+        // {range} puts a cap on {length}.
+        DCHECK_LE(length, std::numeric_limits<uint32_t>::max());
         for (uint32_t i = 0; i < length; i++) {
           indices->push_back(i);
         }
@@ -1355,7 +1351,7 @@ Object Slow_ArrayConcat(BuiltinArguments* args, Handle<Object> species,
     storage = NumberDictionary::New(isolate, estimate_nof);
   } else {
     DCHECK(species->IsConstructor());
-    Handle<Object> length(Smi::kZero, isolate);
+    Handle<Object> length(Smi::zero(), isolate);
     Handle<Object> storage_object;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, storage_object,
diff --git a/deps/v8/src/builtins/builtins-async-function-gen.cc b/deps/v8/src/builtins/builtins-async-function-gen.cc
index cfd355724e1409..aec64b9ccd3a93 100644
--- a/deps/v8/src/builtins/builtins-async-function-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-function-gen.cc
@@ -23,12 +23,12 @@ class AsyncFunctionBuiltinsAssembler : public AsyncBuiltinsAssembler {
   void AsyncFunctionAwait(const bool is_predicted_as_caught);
 
   void AsyncFunctionAwaitResumeClosure(
-      Node* const context, Node* const sent_value,
+      const TNode<Context> context, const TNode<Object> sent_value,
       JSGeneratorObject::ResumeMode resume_mode);
 };
 
 void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwaitResumeClosure(
-    Node* context, Node* sent_value,
+    TNode<Context> context, TNode<Object> sent_value,
     JSGeneratorObject::ResumeMode resume_mode) {
   DCHECK(resume_mode == JSGeneratorObject::kNext ||
          resume_mode == JSGeneratorObject::kThrow);
@@ -84,13 +84,13 @@ TF_BUILTIN(AsyncFunctionEnter, AsyncFunctionBuiltinsAssembler) {
   // Compute the number of registers and parameters.
   TNode<SharedFunctionInfo> shared = LoadObjectField<SharedFunctionInfo>(
       closure, JSFunction::kSharedFunctionInfoOffset);
-  TNode<IntPtrT> formal_parameter_count = ChangeInt32ToIntPtr(
-      LoadObjectField(shared, SharedFunctionInfo::kFormalParameterCountOffset,
-                      MachineType::Uint16()));
+  TNode<IntPtrT> formal_parameter_count =
+      ChangeInt32ToIntPtr(LoadObjectField<Uint16T>(
+          shared, SharedFunctionInfo::kFormalParameterCountOffset));
   TNode<BytecodeArray> bytecode_array =
       LoadSharedFunctionInfoBytecodeArray(shared);
-  TNode<IntPtrT> frame_size = ChangeInt32ToIntPtr(LoadObjectField(
-      bytecode_array, BytecodeArray::kFrameSizeOffset, MachineType::Int32()));
+  TNode<IntPtrT> frame_size = ChangeInt32ToIntPtr(LoadObjectField<Uint32T>(
+      bytecode_array, BytecodeArray::kFrameSizeOffset));
   TNode<IntPtrT> parameters_and_register_length =
       Signed(IntPtrAdd(WordSar(frame_size, IntPtrConstant(kTaggedSizeLog2)),
                        formal_parameter_count));
@@ -98,14 +98,14 @@ TF_BUILTIN(AsyncFunctionEnter, AsyncFunctionBuiltinsAssembler) {
   // Allocate and initialize the register file.
   TNode<FixedArrayBase> parameters_and_registers =
       AllocateFixedArray(HOLEY_ELEMENTS, parameters_and_register_length,
-                         INTPTR_PARAMETERS, kAllowLargeObjectAllocation);
+                         kAllowLargeObjectAllocation);
   FillFixedArrayWithValue(HOLEY_ELEMENTS, parameters_and_registers,
                           IntPtrConstant(0), parameters_and_register_length,
                           RootIndex::kUndefinedValue);
 
   // Allocate space for the promise, the async function object.
   TNode<IntPtrT> size = IntPtrConstant(JSPromise::kSizeWithEmbedderFields +
-                                       JSAsyncFunctionObject::kSize);
+                                       JSAsyncFunctionObject::kHeaderSize);
   TNode<HeapObject> base = AllocateInNewSpace(size);
 
   // Initialize the promise.
@@ -115,7 +115,7 @@ TF_BUILTIN(AsyncFunctionEnter, AsyncFunctionBuiltinsAssembler) {
   TNode<Map> promise_map = LoadObjectField<Map>(
       promise_function, JSFunction::kPrototypeOrInitialMapOffset);
   TNode<JSPromise> promise = UncheckedCast<JSPromise>(
-      InnerAllocate(base, JSAsyncFunctionObject::kSize));
+      InnerAllocate(base, JSAsyncFunctionObject::kHeaderSize));
   StoreMapNoWriteBarrier(promise, promise_map);
   StoreObjectFieldRoot(promise, JSPromise::kPropertiesOrHashOffset,
                        RootIndex::kEmptyFixedArray);
@@ -230,8 +230,8 @@ TF_BUILTIN(AsyncFunctionLazyDeoptContinuation, AsyncFunctionBuiltinsAssembler) {
 
 TF_BUILTIN(AsyncFunctionAwaitRejectClosure, AsyncFunctionBuiltinsAssembler) {
   CSA_ASSERT_JS_ARGC_EQ(this, 1);
-  Node* const sentError = Parameter(Descriptor::kSentError);
-  Node* const context = Parameter(Descriptor::kContext);
+  const TNode<Object> sentError = CAST(Parameter(Descriptor::kSentError));
+  const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   AsyncFunctionAwaitResumeClosure(context, sentError,
                                   JSGeneratorObject::kThrow);
@@ -240,8 +240,8 @@ TF_BUILTIN(AsyncFunctionAwaitRejectClosure, AsyncFunctionBuiltinsAssembler) {
 
 TF_BUILTIN(AsyncFunctionAwaitResolveClosure, AsyncFunctionBuiltinsAssembler) {
   CSA_ASSERT_JS_ARGC_EQ(this, 1);
-  Node* const sentValue = Parameter(Descriptor::kSentValue);
-  Node* const context = Parameter(Descriptor::kContext);
+  const TNode<Object> sentValue = CAST(Parameter(Descriptor::kSentValue));
+  const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   AsyncFunctionAwaitResumeClosure(context, sentValue, JSGeneratorObject::kNext);
   Return(UndefinedConstant());
diff --git a/deps/v8/src/builtins/builtins-async-gen.cc b/deps/v8/src/builtins/builtins-async-gen.cc
index edcb0272265cde..785408339e8ed0 100644
--- a/deps/v8/src/builtins/builtins-async-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-gen.cc
@@ -30,10 +30,10 @@ TNode<Object> AsyncBuiltinsAssembler::AwaitOld(
     TNode<IntPtrT> on_resolve_context_index,
     TNode<IntPtrT> on_reject_context_index,
     TNode<Oddball> is_predicted_as_caught) {
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
 
   static const int kWrappedPromiseOffset =
-      FixedArray::SizeFor(Context::MIN_CONTEXT_SLOTS);
+      FixedArray::SizeFor(Context::MIN_CONTEXT_EXTENDED_SLOTS);
   static const int kResolveClosureOffset =
       kWrappedPromiseOffset + JSPromise::kSizeWithEmbedderFields;
   static const int kRejectClosureOffset =
@@ -45,10 +45,13 @@ TNode<Object> AsyncBuiltinsAssembler::AwaitOld(
   TNode<Context> closure_context = UncheckedCast<Context>(base);
   {
     // Initialize the await context, storing the {generator} as extension.
-    StoreMapNoWriteBarrier(closure_context, RootIndex::kAwaitContextMap);
-    StoreObjectFieldNoWriteBarrier(closure_context, Context::kLengthOffset,
-                                   SmiConstant(Context::MIN_CONTEXT_SLOTS));
-    TNode<Object> const empty_scope_info =
+    TNode<Map> map = CAST(
+        LoadContextElement(native_context, Context::AWAIT_CONTEXT_MAP_INDEX));
+    StoreMapNoWriteBarrier(closure_context, map);
+    StoreObjectFieldNoWriteBarrier(
+        closure_context, Context::kLengthOffset,
+        SmiConstant(Context::MIN_CONTEXT_EXTENDED_SLOTS));
+    const TNode<Object> empty_scope_info =
         LoadContextElement(native_context, Context::SCOPE_INFO_INDEX);
     StoreContextElementNoWriteBarrier(
         closure_context, Context::SCOPE_INFO_INDEX, empty_scope_info);
@@ -56,15 +59,13 @@ TNode<Object> AsyncBuiltinsAssembler::AwaitOld(
                                       native_context);
     StoreContextElementNoWriteBarrier(closure_context, Context::EXTENSION_INDEX,
                                       generator);
-    StoreContextElementNoWriteBarrier(
-        closure_context, Context::NATIVE_CONTEXT_INDEX, native_context);
   }
 
   // Let promiseCapability be ! NewPromiseCapability(%Promise%).
-  TNode<JSFunction> const promise_fun =
+  const TNode<JSFunction> promise_fun =
       CAST(LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX));
   CSA_ASSERT(this, IsFunctionWithPrototypeSlotMap(LoadMap(promise_fun)));
-  TNode<Map> const promise_map = CAST(
+  const TNode<Map> promise_map = CAST(
       LoadObjectField(promise_fun, JSFunction::kPrototypeOrInitialMapOffset));
   // Assert that the JSPromise map has an instance size is
   // JSPromise::kSizeWithEmbedderFields.
@@ -72,15 +73,18 @@ TNode<Object> AsyncBuiltinsAssembler::AwaitOld(
              IntPtrEqual(LoadMapInstanceSizeInWords(promise_map),
                          IntPtrConstant(JSPromise::kSizeWithEmbedderFields /
                                         kTaggedSize)));
-  TNode<HeapObject> wrapped_value = InnerAllocate(base, kWrappedPromiseOffset);
+  TNode<JSPromise> promise;
   {
     // Initialize Promise
+    TNode<HeapObject> wrapped_value =
+        InnerAllocate(base, kWrappedPromiseOffset);
     StoreMapNoWriteBarrier(wrapped_value, promise_map);
     StoreObjectFieldRoot(wrapped_value, JSPromise::kPropertiesOrHashOffset,
                          RootIndex::kEmptyFixedArray);
     StoreObjectFieldRoot(wrapped_value, JSPromise::kElementsOffset,
                          RootIndex::kEmptyFixedArray);
-    PromiseInit(wrapped_value);
+    promise = CAST(wrapped_value);
+    PromiseInit(promise);
   }
 
   // Initialize resolve handler
@@ -102,16 +106,16 @@ TNode<Object> AsyncBuiltinsAssembler::AwaitOld(
   Branch(IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate(),
          &if_debugging, &do_resolve_promise);
   BIND(&if_debugging);
-  var_throwaway = CAST(CallRuntime(Runtime::kAwaitPromisesInitOld, context,
-                                   value, wrapped_value, outer_promise,
-                                   on_reject, is_predicted_as_caught));
+  var_throwaway =
+      CAST(CallRuntime(Runtime::kAwaitPromisesInitOld, context, value, promise,
+                       outer_promise, on_reject, is_predicted_as_caught));
   Goto(&do_resolve_promise);
   BIND(&do_resolve_promise);
 
   // Perform ! Call(promiseCapability.[[Resolve]], undefined, « promise »).
-  CallBuiltin(Builtins::kResolvePromise, context, wrapped_value, value);
+  CallBuiltin(Builtins::kResolvePromise, context, promise, value);
 
-  return CallBuiltin(Builtins::kPerformPromiseThen, context, wrapped_value,
+  return CallBuiltin(Builtins::kPerformPromiseThen, context, promise,
                      on_resolve, on_reject, var_throwaway.value());
 }
 
@@ -121,10 +125,10 @@ TNode<Object> AsyncBuiltinsAssembler::AwaitOptimized(
     TNode<IntPtrT> on_resolve_context_index,
     TNode<IntPtrT> on_reject_context_index,
     TNode<Oddball> is_predicted_as_caught) {
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
 
   static const int kResolveClosureOffset =
-      FixedArray::SizeFor(Context::MIN_CONTEXT_SLOTS);
+      FixedArray::SizeFor(Context::MIN_CONTEXT_EXTENDED_SLOTS);
   static const int kRejectClosureOffset =
       kResolveClosureOffset + JSFunction::kSizeWithoutPrototype;
   static const int kTotalSize =
@@ -138,10 +142,13 @@ TNode<Object> AsyncBuiltinsAssembler::AwaitOptimized(
   TNode<Context> closure_context = UncheckedCast<Context>(base);
   {
     // Initialize the await context, storing the {generator} as extension.
-    StoreMapNoWriteBarrier(closure_context, RootIndex::kAwaitContextMap);
-    StoreObjectFieldNoWriteBarrier(closure_context, Context::kLengthOffset,
-                                   SmiConstant(Context::MIN_CONTEXT_SLOTS));
-    TNode<Object> const empty_scope_info =
+    TNode<Map> map = CAST(
+        LoadContextElement(native_context, Context::AWAIT_CONTEXT_MAP_INDEX));
+    StoreMapNoWriteBarrier(closure_context, map);
+    StoreObjectFieldNoWriteBarrier(
+        closure_context, Context::kLengthOffset,
+        SmiConstant(Context::MIN_CONTEXT_EXTENDED_SLOTS));
+    const TNode<Object> empty_scope_info =
         LoadContextElement(native_context, Context::SCOPE_INFO_INDEX);
     StoreContextElementNoWriteBarrier(
         closure_context, Context::SCOPE_INFO_INDEX, empty_scope_info);
@@ -149,8 +156,6 @@ TNode<Object> AsyncBuiltinsAssembler::AwaitOptimized(
                                       native_context);
     StoreContextElementNoWriteBarrier(closure_context, Context::EXTENSION_INDEX,
                                       generator);
-    StoreContextElementNoWriteBarrier(
-        closure_context, Context::NATIVE_CONTEXT_INDEX, native_context);
   }
 
   // Initialize resolve handler
@@ -199,14 +204,14 @@ TNode<Object> AsyncBuiltinsAssembler::Await(
   // logic.
   GotoIf(TaggedIsSmi(value), &if_old);
   TNode<HeapObject> value_object = CAST(value);
-  TNode<Map> const value_map = LoadMap(value_object);
+  const TNode<Map> value_map = LoadMap(value_object);
   GotoIfNot(IsJSPromiseMap(value_map), &if_old);
   // We can skip the "constructor" lookup on {value} if it's [[Prototype]]
   // is the (initial) Promise.prototype and the @@species protector is
   // intact, as that guards the lookup path for "constructor" on
   // JSPromise instances which have the (initial) Promise.prototype.
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Object> const promise_prototype =
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Object> promise_prototype =
       LoadContextElement(native_context, Context::PROMISE_PROTOTYPE_INDEX);
   GotoIfNot(TaggedEqual(LoadMapPrototype(value_map), promise_prototype),
             &if_slow_constructor);
@@ -217,9 +222,9 @@ TNode<Object> AsyncBuiltinsAssembler::Await(
   // have the %Promise% as its "constructor", so we need to check that as well.
   BIND(&if_slow_constructor);
   {
-    TNode<Object> const value_constructor =
+    const TNode<Object> value_constructor =
         GetProperty(context, value, isolate()->factory()->constructor_string());
-    TNode<Object> const promise_function =
+    const TNode<Object> promise_function =
         LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
     Branch(TaggedEqual(value_constructor, promise_function), &if_new, &if_old);
   }
@@ -293,8 +298,8 @@ TNode<Context> AsyncBuiltinsAssembler::AllocateAsyncIteratorValueUnwrapContext(
     TNode<NativeContext> native_context, TNode<Oddball> done) {
   CSA_ASSERT(this, IsBoolean(done));
 
-  TNode<Context> context =
-      CreatePromiseContext(native_context, ValueUnwrapContext::kLength);
+  TNode<Context> context = AllocateSyntheticFunctionContext(
+      native_context, ValueUnwrapContext::kLength);
   StoreContextElementNoWriteBarrier(context, ValueUnwrapContext::kDoneSlot,
                                     done);
   return context;
@@ -304,11 +309,11 @@ TF_BUILTIN(AsyncIteratorValueUnwrap, AsyncBuiltinsAssembler) {
   TNode<Object> value = CAST(Parameter(Descriptor::kValue));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
-  TNode<Object> const done =
+  const TNode<Object> done =
       LoadContextElement(context, ValueUnwrapContext::kDoneSlot);
   CSA_ASSERT(this, IsBoolean(CAST(done)));
 
-  TNode<Object> const unwrapped_value =
+  const TNode<Object> unwrapped_value =
       CallBuiltin(Builtins::kCreateIterResultObject, context, value, done);
 
   Return(unwrapped_value);
diff --git a/deps/v8/src/builtins/builtins-async-generator-gen.cc b/deps/v8/src/builtins/builtins-async-generator-gen.cc
index 2ed7e8c83e0663..acc7721465b25a 100644
--- a/deps/v8/src/builtins/builtins-async-generator-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-generator-gen.cc
@@ -148,7 +148,7 @@ void AsyncGeneratorBuiltinsAssembler::AsyncGeneratorEnqueue(
   // presently executing, then this method will loop through, processing each
   // request from front to back.
   // This loop resides in AsyncGeneratorResumeNext.
-  TNode<JSPromise> promise = AllocateAndInitJSPromise(context);
+  TNode<JSPromise> promise = NewJSPromise(context);
 
   Label if_receiverisincompatible(this, Label::kDeferred);
   GotoIf(TaggedIsSmi(receiver), &if_receiverisincompatible);
@@ -498,8 +498,8 @@ TF_BUILTIN(AsyncGeneratorResolve, AsyncGeneratorBuiltinsAssembler) {
   // Let iteratorResult be CreateIterResultObject(value, done).
   const TNode<HeapObject> iter_result = Allocate(JSIteratorResult::kSize);
   {
-    TNode<Object> map = LoadContextElement(LoadNativeContext(context),
-                                           Context::ITERATOR_RESULT_MAP_INDEX);
+    TNode<Map> map = CAST(LoadContextElement(
+        LoadNativeContext(context), Context::ITERATOR_RESULT_MAP_INDEX));
     StoreMapNoWriteBarrier(iter_result, map);
     StoreObjectFieldRoot(iter_result, JSIteratorResult::kPropertiesOrHashOffset,
                          RootIndex::kEmptyFixedArray);
diff --git a/deps/v8/src/builtins/builtins-async-iterator-gen.cc b/deps/v8/src/builtins/builtins-async-iterator-gen.cc
index 39ff8c92172559..1515605649784e 100644
--- a/deps/v8/src/builtins/builtins-async-iterator-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-iterator-gen.cc
@@ -86,8 +86,8 @@ void AsyncFromSyncBuiltinsAssembler::ThrowIfNotAsyncFromSyncIterator(
 
     // Let badIteratorError be a new TypeError exception.
     TNode<HeapObject> error =
-        CAST(MakeTypeError(MessageTemplate::kIncompatibleMethodReceiver,
-                           context, StringConstant(method_name), object));
+        MakeTypeError(MessageTemplate::kIncompatibleMethodReceiver, context,
+                      StringConstant(method_name), object);
 
     // Perform ! Call(promiseCapability.[[Reject]], undefined,
     //                « badIteratorError »).
@@ -105,7 +105,7 @@ void AsyncFromSyncBuiltinsAssembler::Generate_AsyncFromSyncIteratorMethod(
     const char* operation_name, Label::Type reject_label_type,
     base::Optional<TNode<Object>> initial_exception_value) {
   const TNode<NativeContext> native_context = LoadNativeContext(context);
-  const TNode<JSPromise> promise = AllocateAndInitJSPromise(context);
+  const TNode<JSPromise> promise = NewJSPromise(context);
 
   TVARIABLE(
       Object, var_exception,
@@ -221,8 +221,8 @@ AsyncFromSyncBuiltinsAssembler::LoadIteratorResult(
   {
     // Sync iterator result is not an object --- Produce a TypeError and jump
     // to the `if_exception` path.
-    const TNode<Object> error = CAST(MakeTypeError(
-        MessageTemplate::kIteratorResultNotAnObject, context, iter_result));
+    const TNode<Object> error = MakeTypeError(
+        MessageTemplate::kIteratorResultNotAnObject, context, iter_result);
     *var_exception = error;
     Goto(if_exception);
   }
diff --git a/deps/v8/src/builtins/builtins-bigint-gen.cc b/deps/v8/src/builtins/builtins-bigint-gen.cc
index 691ec7f8cea4d9..f8fe460c451fba 100644
--- a/deps/v8/src/builtins/builtins-bigint-gen.cc
+++ b/deps/v8/src/builtins/builtins-bigint-gen.cc
@@ -25,7 +25,7 @@ TF_BUILTIN(BigIntToI64, CodeStubAssembler) {
   TVARIABLE(UintPtrT, var_high);
 
   BigIntToRawBytes(n, &var_low, &var_high);
-  ReturnRaw(var_low.value());
+  Return(var_low.value());
 }
 
 // https://tc39.github.io/proposal-bigint/#sec-to-big-int64
@@ -43,8 +43,7 @@ TF_BUILTIN(BigIntToI32Pair, CodeStubAssembler) {
   TVARIABLE(UintPtrT, var_high);
 
   BigIntToRawBytes(bigint, &var_low, &var_high);
-  Return(SloppyTNode<Object>(var_low.value()),
-         SloppyTNode<Object>(var_high.value()));
+  Return(var_low.value(), var_high.value());
 }
 
 // https://tc39.github.io/proposal-bigint/#sec-bigint-constructor-number-value
diff --git a/deps/v8/src/builtins/builtins-boolean-gen.cc b/deps/v8/src/builtins/builtins-boolean-gen.cc
deleted file mode 100644
index 74474a8918f15c..00000000000000
--- a/deps/v8/src/builtins/builtins-boolean-gen.cc
+++ /dev/null
@@ -1,39 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/builtins/builtins-utils-gen.h"
-#include "src/builtins/builtins.h"
-#include "src/codegen/code-stub-assembler.h"
-#include "src/objects/oddball.h"
-
-namespace v8 {
-namespace internal {
-
-// -----------------------------------------------------------------------------
-// ES6 section 19.3 Boolean Objects
-
-// ES6 #sec-boolean.prototype.tostring
-TF_BUILTIN(BooleanPrototypeToString, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-
-  TNode<Oddball> value =
-      CAST(ToThisValue(context, receiver, PrimitiveType::kBoolean,
-                       "Boolean.prototype.toString"));
-  TNode<String> result = CAST(LoadObjectField(value, Oddball::kToStringOffset));
-  Return(result);
-}
-
-// ES6 #sec-boolean.prototype.valueof
-TF_BUILTIN(BooleanPrototypeValueOf, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-
-  TNode<Oddball> result = CAST(ToThisValue(
-      context, receiver, PrimitiveType::kBoolean, "Boolean.prototype.valueOf"));
-  Return(result);
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-call-gen.cc b/deps/v8/src/builtins/builtins-call-gen.cc
index fd1ad5bb67c0de..cfe82594dfae8f 100644
--- a/deps/v8/src/builtins/builtins-call-gen.cc
+++ b/deps/v8/src/builtins/builtins-call-gen.cc
@@ -168,9 +168,8 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
   BIND(&if_arguments);
   {
     TNode<JSArgumentsObject> js_arguments = CAST(arguments_list);
-    // Try to extract the elements from an JSArgumentsObjectWithLength.
-    TNode<Object> length = LoadObjectField(
-        js_arguments, JSArgumentsObjectWithLength::kLengthOffset);
+    // Try to extract the elements from a JSArgumentsObject with standard map.
+    TNode<Object> length = LoadJSArgumentsObjectLength(context, js_arguments);
     TNode<FixedArrayBase> elements = LoadElements(js_arguments);
     TNode<Smi> elements_length = LoadFixedArrayBaseLength(elements);
     GotoIfNot(TaggedEqual(length, elements_length), &if_runtime);
@@ -412,8 +411,9 @@ TNode<JSReceiver> CallOrConstructBuiltinsAssembler::GetCompatibleReceiver(
       // {var_template} variable), and see if that is a HeapObject.
       // If it's a Smi then it is non-instance prototype on some
       // initial map, which cannot be the case for API instances.
-      TNode<Object> constructor = LoadObjectField(
-          var_template.value(), Map::kConstructorOrBackPointerOffset);
+      TNode<Object> constructor =
+          LoadObjectField(var_template.value(),
+                          Map::kConstructorOrBackPointerOrNativeContextOffset);
       GotoIf(TaggedIsSmi(constructor), &holder_next);
 
       // Now there are three cases for {constructor} that we care
@@ -511,9 +511,9 @@ void CallOrConstructBuiltinsAssembler::CallFunctionTemplate(
     TNode<Map> receiver_map = LoadMap(receiver);
     Label receiver_needs_access_check(this, Label::kDeferred),
         receiver_done(this);
-    GotoIfNot(
-        IsSetWord32<Map::IsAccessCheckNeededBit>(LoadMapBitField(receiver_map)),
-        &receiver_done);
+    GotoIfNot(IsSetWord32<Map::Bits1::IsAccessCheckNeededBit>(
+                  LoadMapBitField(receiver_map)),
+              &receiver_done);
     TNode<IntPtrT> function_template_info_flags = LoadAndUntagObjectField(
         function_template_info, FunctionTemplateInfo::kFlagOffset);
     Branch(IsSetWord(function_template_info_flags,
diff --git a/deps/v8/src/builtins/builtins-collections-gen.cc b/deps/v8/src/builtins/builtins-collections-gen.cc
index c0ca74a577b886..df758e0e9f6ef1 100644
--- a/deps/v8/src/builtins/builtins-collections-gen.cc
+++ b/deps/v8/src/builtins/builtins-collections-gen.cc
@@ -45,7 +45,7 @@ class BaseCollectionsAssembler : public CodeStubAssembler {
   // possible.
   void AddConstructorEntries(Variant variant, TNode<Context> context,
                              TNode<Context> native_context,
-                             TNode<Object> collection,
+                             TNode<HeapObject> collection,
                              TNode<Object> initial_entries);
 
   // Fast path for adding constructor entries.  Assumes the entries are a fast
@@ -123,7 +123,7 @@ class BaseCollectionsAssembler : public CodeStubAssembler {
   TNode<IntPtrT> EstimatedInitialSize(TNode<Object> initial_entries,
                                       TNode<BoolT> is_fast_jsarray);
 
-  void GotoIfNotJSReceiver(TNode<Object> const obj, Label* if_not_receiver);
+  void GotoIfNotJSReceiver(const TNode<Object> obj, Label* if_not_receiver);
 
   // Determines whether the collection's prototype has been modified.
   TNode<BoolT> HasInitialCollectionPrototype(Variant variant,
@@ -172,7 +172,7 @@ void BaseCollectionsAssembler::AddConstructorEntry(
 
 void BaseCollectionsAssembler::AddConstructorEntries(
     Variant variant, TNode<Context> context, TNode<Context> native_context,
-    TNode<Object> collection, TNode<Object> initial_entries) {
+    TNode<HeapObject> collection, TNode<Object> initial_entries) {
   TVARIABLE(BoolT, use_fast_loop,
             IsFastJSArrayWithNoCustomIteration(context, initial_entries));
   TNode<IntPtrT> at_least_space_for =
@@ -185,8 +185,8 @@ void BaseCollectionsAssembler::AddConstructorEntries(
     TNode<HeapObject> table = AllocateTable(variant, at_least_space_for);
     StoreObjectField(collection, GetTableOffset(variant), table);
     GotoIf(IsNullOrUndefined(initial_entries), &exit);
-    GotoIfInitialAddFunctionModified(variant, CAST(native_context),
-                                     CAST(collection), &slow_loop);
+    GotoIfInitialAddFunctionModified(variant, CAST(native_context), collection,
+                                     &slow_loop);
     Branch(use_fast_loop.value(), &fast_loop, &slow_loop);
   }
   BIND(&fast_loop);
@@ -212,7 +212,7 @@ void BaseCollectionsAssembler::AddConstructorEntries(
         // Check that add/set function has not been modified.
         Label if_not_modified(this), if_modified(this);
         GotoIfInitialAddFunctionModified(variant, CAST(native_context),
-                                         CAST(collection), &if_modified);
+                                         collection, &if_modified);
         Goto(&if_not_modified);
         BIND(&if_modified);
         Unreachable();
@@ -522,7 +522,7 @@ TNode<IntPtrT> BaseCollectionsAssembler::EstimatedInitialSize(
       [=] { return IntPtrConstant(0); });
 }
 
-void BaseCollectionsAssembler::GotoIfNotJSReceiver(TNode<Object> const obj,
+void BaseCollectionsAssembler::GotoIfNotJSReceiver(const TNode<Object> obj,
                                                    Label* if_not_receiver) {
   GotoIf(TaggedIsSmi(obj), if_not_receiver);
   GotoIfNot(IsJSReceiver(CAST(obj)), if_not_receiver);
@@ -623,11 +623,11 @@ class CollectionsBuiltinsAssembler : public BaseCollectionsAssembler {
                                                 const TNode<IntPtrT> index)>;
   template <typename TableType>
   std::pair<TNode<TableType>, TNode<IntPtrT>> Transition(
-      TNode<TableType> const table, TNode<IntPtrT> const index,
+      const TNode<TableType> table, const TNode<IntPtrT> index,
       UpdateInTransition<TableType> const& update_in_transition);
   template <typename IteratorType, typename TableType>
   std::pair<TNode<TableType>, TNode<IntPtrT>> TransitionAndUpdate(
-      TNode<IteratorType> const iterator);
+      const TNode<IteratorType> iterator);
   template <typename TableType>
   std::tuple<TNode<Object>, TNode<IntPtrT>, TNode<IntPtrT>> NextSkipHoles(
       TNode<TableType> table, TNode<IntPtrT> index, Label* if_end);
@@ -700,14 +700,14 @@ class CollectionsBuiltinsAssembler : public BaseCollectionsAssembler {
                                       Label* if_not_found);
 
   const TNode<Object> NormalizeNumberKey(const TNode<Object> key);
-  void StoreOrderedHashMapNewEntry(TNode<OrderedHashMap> const table,
+  void StoreOrderedHashMapNewEntry(const TNode<OrderedHashMap> table,
                                    const TNode<Object> key,
                                    const TNode<Object> value,
                                    const TNode<IntPtrT> hash,
                                    const TNode<IntPtrT> number_of_buckets,
                                    const TNode<IntPtrT> occupancy);
 
-  void StoreOrderedHashSetNewEntry(TNode<OrderedHashSet> const table,
+  void StoreOrderedHashSetNewEntry(const TNode<OrderedHashSet> table,
                                    const TNode<Object> key,
                                    const TNode<IntPtrT> hash,
                                    const TNode<IntPtrT> number_of_buckets,
@@ -728,7 +728,7 @@ class CollectionsBuiltinsAssembler : public BaseCollectionsAssembler {
   // |iterable| is an iterator, it will update the state of the iterator to
   // 'exhausted'.
   TNode<JSArray> SetOrSetIteratorToList(TNode<Context> context,
-                                        TNode<Object> iterable);
+                                        TNode<HeapObject> iterable);
 
   void BranchIfMapIteratorProtectorValid(Label* if_true, Label* if_false);
   void BranchIfSetIteratorProtectorValid(Label* if_true, Label* if_false);
@@ -744,25 +744,28 @@ class CollectionsBuiltinsAssembler : public BaseCollectionsAssembler {
   // of OrderedHashTable, it should be OrderedHashMap or OrderedHashSet.
   template <typename CollectionType>
   void FindOrderedHashTableEntry(
-      Node* table, Node* hash,
+      const TNode<CollectionType> table, const TNode<IntPtrT> hash,
       const std::function<void(TNode<Object>, Label*, Label*)>& key_compare,
-      Variable* entry_start_position, Label* entry_found, Label* not_found);
+      TVariable<IntPtrT>* entry_start_position, Label* entry_found,
+      Label* not_found);
+
+  TNode<Word32T> ComputeUnseededHash(TNode<IntPtrT> key);
 };
 
 template <typename CollectionType>
 void CollectionsBuiltinsAssembler::FindOrderedHashTableEntry(
-    Node* table, Node* hash,
+    const TNode<CollectionType> table, const TNode<IntPtrT> hash,
     const std::function<void(TNode<Object>, Label*, Label*)>& key_compare,
-    Variable* entry_start_position, Label* entry_found, Label* not_found) {
+    TVariable<IntPtrT>* entry_start_position, Label* entry_found,
+    Label* not_found) {
   // Get the index of the bucket.
-  TNode<IntPtrT> const number_of_buckets =
+  const TNode<IntPtrT> number_of_buckets =
       SmiUntag(CAST(UnsafeLoadFixedArrayElement(
-          CAST(table), CollectionType::NumberOfBucketsIndex())));
-  TNode<WordT> const bucket =
+          table, CollectionType::NumberOfBucketsIndex())));
+  const TNode<WordT> bucket =
       WordAnd(hash, IntPtrSub(number_of_buckets, IntPtrConstant(1)));
-  TNode<IntPtrT> const first_entry = SmiUntag(CAST(UnsafeLoadFixedArrayElement(
-      CAST(table), bucket,
-      CollectionType::HashTableStartIndex() * kTaggedSize)));
+  const TNode<IntPtrT> first_entry = SmiUntag(CAST(UnsafeLoadFixedArrayElement(
+      table, bucket, CollectionType::HashTableStartIndex() * kTaggedSize)));
 
   // Walk the bucket chain.
   TNode<IntPtrT> entry_start;
@@ -786,10 +789,9 @@ void CollectionsBuiltinsAssembler::FindOrderedHashTableEntry(
             var_entry.value(),
             SmiUntag(SmiAdd(
                 CAST(UnsafeLoadFixedArrayElement(
-                    CAST(table), CollectionType::NumberOfElementsIndex())),
+                    table, CollectionType::NumberOfElementsIndex())),
                 CAST(UnsafeLoadFixedArrayElement(
-                    CAST(table),
-                    CollectionType::NumberOfDeletedElementsIndex()))))));
+                    table, CollectionType::NumberOfDeletedElementsIndex()))))));
 
     // Compute the index of the entry relative to kHashTableStartIndex.
     entry_start =
@@ -798,8 +800,8 @@ void CollectionsBuiltinsAssembler::FindOrderedHashTableEntry(
                   number_of_buckets);
 
     // Load the key from the entry.
-    TNode<Object> const candidate_key = UnsafeLoadFixedArrayElement(
-        CAST(table), entry_start,
+    const TNode<Object> candidate_key = UnsafeLoadFixedArrayElement(
+        table, entry_start,
         CollectionType::HashTableStartIndex() * kTaggedSize);
 
     key_compare(candidate_key, &if_key_found, &continue_next_entry);
@@ -807,7 +809,7 @@ void CollectionsBuiltinsAssembler::FindOrderedHashTableEntry(
     BIND(&continue_next_entry);
     // Load the index of the next entry in the bucket chain.
     var_entry = SmiUntag(CAST(UnsafeLoadFixedArrayElement(
-        CAST(table), entry_start,
+        table, entry_start,
         (CollectionType::HashTableStartIndex() + CollectionType::kChainOffset) *
             kTaggedSize)));
 
@@ -815,20 +817,21 @@ void CollectionsBuiltinsAssembler::FindOrderedHashTableEntry(
   }
 
   BIND(&if_key_found);
-  entry_start_position->Bind(entry_start);
+  *entry_start_position = entry_start;
   Goto(entry_found);
 }
 
 template <typename IteratorType>
 TNode<HeapObject> CollectionsBuiltinsAssembler::AllocateJSCollectionIterator(
-    TNode<Context> const context, int map_index,
-    TNode<HeapObject> const collection) {
-  TNode<Object> const table =
+    const TNode<Context> context, int map_index,
+    const TNode<HeapObject> collection) {
+  const TNode<Object> table =
       LoadObjectField(collection, JSCollection::kTableOffset);
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Object> const iterator_map =
-      LoadContextElement(native_context, map_index);
-  TNode<HeapObject> const iterator = AllocateInNewSpace(IteratorType::kSize);
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Map> iterator_map =
+      CAST(LoadContextElement(native_context, map_index));
+  const TNode<HeapObject> iterator =
+      AllocateInNewSpace(IteratorType::kHeaderSize);
   StoreMapNoWriteBarrier(iterator, iterator_map);
   StoreObjectFieldRoot(iterator, IteratorType::kPropertiesOrHashOffset,
                        RootIndex::kEmptyFixedArray);
@@ -842,9 +845,11 @@ TNode<HeapObject> CollectionsBuiltinsAssembler::AllocateJSCollectionIterator(
 
 TNode<HeapObject> CollectionsBuiltinsAssembler::AllocateTable(
     Variant variant, TNode<IntPtrT> at_least_space_for) {
-  return CAST((variant == kMap || variant == kWeakMap)
-                  ? AllocateOrderedHashTable<OrderedHashMap>()
-                  : AllocateOrderedHashTable<OrderedHashSet>());
+  if (variant == kMap || variant == kWeakMap) {
+    return AllocateOrderedHashTable<OrderedHashMap>();
+  } else {
+    return AllocateOrderedHashTable<OrderedHashSet>();
+  }
 }
 
 TF_BUILTIN(MapConstructor, CollectionsBuiltinsAssembler) {
@@ -869,9 +874,9 @@ TF_BUILTIN(SetConstructor, CollectionsBuiltinsAssembler) {
 
 TNode<Smi> CollectionsBuiltinsAssembler::CallGetOrCreateHashRaw(
     const TNode<HeapObject> key) {
-  TNode<ExternalReference> const function_addr =
+  const TNode<ExternalReference> function_addr =
       ExternalConstant(ExternalReference::get_or_create_hash_raw());
-  TNode<ExternalReference> const isolate_ptr =
+  const TNode<ExternalReference> isolate_ptr =
       ExternalConstant(ExternalReference::isolate_address(isolate()));
 
   MachineType type_ptr = MachineType::Pointer();
@@ -886,9 +891,9 @@ TNode<Smi> CollectionsBuiltinsAssembler::CallGetOrCreateHashRaw(
 
 TNode<IntPtrT> CollectionsBuiltinsAssembler::CallGetHashRaw(
     const TNode<HeapObject> key) {
-  TNode<ExternalReference> const function_addr =
+  const TNode<ExternalReference> function_addr =
       ExternalConstant(ExternalReference::orderedhashmap_gethash_raw());
-  TNode<ExternalReference> const isolate_ptr =
+  const TNode<ExternalReference> isolate_ptr =
       ExternalConstant(ExternalReference::isolate_address(isolate()));
 
   MachineType type_ptr = MachineType::Pointer();
@@ -938,9 +943,9 @@ void CollectionsBuiltinsAssembler::SameValueZeroSmi(TNode<Smi> key_smi,
   // heap number with the same value.
   GotoIfNot(IsHeapNumber(CAST(candidate_key)), if_not_same);
 
-  TNode<Float64T> const candidate_key_number =
+  const TNode<Float64T> candidate_key_number =
       LoadHeapNumberValue(CAST(candidate_key));
-  TNode<Float64T> const key_number = SmiToFloat64(key_smi);
+  const TNode<Float64T> key_number = SmiToFloat64(key_smi);
 
   GotoIf(Float64Equal(candidate_key_number, key_number), if_same);
 
@@ -967,7 +972,7 @@ void CollectionsBuiltinsAssembler::
   // Check if iterator is a keys or values JSMapIterator.
   GotoIf(TaggedIsSmi(iterator), if_false);
   TNode<Map> iter_map = LoadMap(CAST(iterator));
-  TNode<Uint16T> const instance_type = LoadMapInstanceType(iter_map);
+  const TNode<Uint16T> instance_type = LoadMapInstanceType(iter_map);
   GotoIf(InstanceTypeEqual(instance_type, JS_MAP_KEY_ITERATOR_TYPE),
          &if_key_or_value_iterator);
   Branch(InstanceTypeEqual(instance_type, JS_MAP_VALUE_ITERATOR_TYPE),
@@ -975,24 +980,24 @@ void CollectionsBuiltinsAssembler::
 
   BIND(&if_key_or_value_iterator);
   // Check that the iterator is not partially consumed.
-  TNode<Object> const index =
+  const TNode<Object> index =
       LoadObjectField(CAST(iterator), JSMapIterator::kIndexOffset);
   GotoIfNot(TaggedEqual(index, SmiConstant(0)), if_false);
   BranchIfMapIteratorProtectorValid(&extra_checks, if_false);
 
   BIND(&extra_checks);
   // Check if the iterator object has the original %MapIteratorPrototype%.
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Object> const initial_map_iter_proto = LoadContextElement(
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Object> initial_map_iter_proto = LoadContextElement(
       native_context, Context::INITIAL_MAP_ITERATOR_PROTOTYPE_INDEX);
-  TNode<HeapObject> const map_iter_proto = LoadMapPrototype(iter_map);
+  const TNode<HeapObject> map_iter_proto = LoadMapPrototype(iter_map);
   GotoIfNot(TaggedEqual(map_iter_proto, initial_map_iter_proto), if_false);
 
   // Check if the original MapIterator prototype has the original
   // %IteratorPrototype%.
-  TNode<Object> const initial_iter_proto = LoadContextElement(
+  const TNode<Object> initial_iter_proto = LoadContextElement(
       native_context, Context::INITIAL_ITERATOR_PROTOTYPE_INDEX);
-  TNode<HeapObject> const iter_proto =
+  const TNode<HeapObject> iter_proto =
       LoadMapPrototype(LoadMap(map_iter_proto));
   Branch(TaggedEqual(iter_proto, initial_iter_proto), if_true, if_false);
 }
@@ -1008,7 +1013,7 @@ void BranchIfIterableWithOriginalKeyOrValueMapIterator(
 
 void CollectionsBuiltinsAssembler::BranchIfSetIteratorProtectorValid(
     Label* if_true, Label* if_false) {
-  TNode<PropertyCell> const protector_cell = SetIteratorProtectorConstant();
+  const TNode<PropertyCell> protector_cell = SetIteratorProtectorConstant();
   DCHECK(isolate()->heap()->set_iterator_protector().IsPropertyCell());
   Branch(
       TaggedEqual(LoadObjectField(protector_cell, PropertyCell::kValueOffset),
@@ -1024,7 +1029,7 @@ void CollectionsBuiltinsAssembler::BranchIfIterableWithOriginalValueSetIterator(
 
   GotoIf(TaggedIsSmi(iterable), if_false);
   TNode<Map> iterable_map = LoadMap(CAST(iterable));
-  TNode<Uint16T> const instance_type = LoadMapInstanceType(iterable_map);
+  const TNode<Uint16T> instance_type = LoadMapInstanceType(iterable_map);
 
   GotoIf(InstanceTypeEqual(instance_type, JS_SET_TYPE), &if_set);
   Branch(InstanceTypeEqual(instance_type, JS_SET_VALUE_ITERATOR_TYPE),
@@ -1032,30 +1037,30 @@ void CollectionsBuiltinsAssembler::BranchIfIterableWithOriginalValueSetIterator(
 
   BIND(&if_set);
   // Check if the set object has the original Set prototype.
-  TNode<Object> const initial_set_proto = LoadContextElement(
+  const TNode<Object> initial_set_proto = LoadContextElement(
       LoadNativeContext(context), Context::INITIAL_SET_PROTOTYPE_INDEX);
-  TNode<HeapObject> const set_proto = LoadMapPrototype(iterable_map);
+  const TNode<HeapObject> set_proto = LoadMapPrototype(iterable_map);
   GotoIfNot(TaggedEqual(set_proto, initial_set_proto), if_false);
   Goto(&check_protector);
 
   BIND(&if_value_iterator);
   // Check that the iterator is not partially consumed.
-  TNode<Object> const index =
+  const TNode<Object> index =
       LoadObjectField(CAST(iterable), JSSetIterator::kIndexOffset);
   GotoIfNot(TaggedEqual(index, SmiConstant(0)), if_false);
 
   // Check if the iterator object has the original SetIterator prototype.
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Object> const initial_set_iter_proto = LoadContextElement(
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Object> initial_set_iter_proto = LoadContextElement(
       native_context, Context::INITIAL_SET_ITERATOR_PROTOTYPE_INDEX);
-  TNode<HeapObject> const set_iter_proto = LoadMapPrototype(iterable_map);
+  const TNode<HeapObject> set_iter_proto = LoadMapPrototype(iterable_map);
   GotoIfNot(TaggedEqual(set_iter_proto, initial_set_iter_proto), if_false);
 
   // Check if the original SetIterator prototype has the original
   // %IteratorPrototype%.
-  TNode<Object> const initial_iter_proto = LoadContextElement(
+  const TNode<Object> initial_iter_proto = LoadContextElement(
       native_context, Context::INITIAL_ITERATOR_PROTOTYPE_INDEX);
-  TNode<HeapObject> const iter_proto =
+  const TNode<HeapObject> iter_proto =
       LoadMapPrototype(LoadMap(set_iter_proto));
   GotoIfNot(TaggedEqual(iter_proto, initial_iter_proto), if_false);
   Goto(&check_protector);
@@ -1088,9 +1093,8 @@ TNode<JSArray> CollectionsBuiltinsAssembler::MapIteratorToList(
   const ElementsKind kind = PACKED_ELEMENTS;
   TNode<Map> array_map =
       LoadJSArrayElementsMap(kind, LoadNativeContext(context));
-  TNode<JSArray> array =
-      AllocateJSArray(kind, array_map, size, SmiTag(size), {},
-                      INTPTR_PARAMETERS, kAllowLargeObjectAllocation);
+  TNode<JSArray> array = AllocateJSArray(kind, array_map, size, SmiTag(size),
+                                         kAllowLargeObjectAllocation);
   TNode<FixedArray> elements = CAST(LoadElements(array));
 
   const int first_element_offset = FixedArray::kHeaderSize - kHeapObjectTag;
@@ -1165,17 +1169,17 @@ TF_BUILTIN(MapIteratorToList, CollectionsBuiltinsAssembler) {
 }
 
 TNode<JSArray> CollectionsBuiltinsAssembler::SetOrSetIteratorToList(
-    TNode<Context> context, TNode<Object> iterable) {
+    TNode<Context> context, TNode<HeapObject> iterable) {
   TVARIABLE(OrderedHashSet, var_table);
   Label if_set(this), if_iterator(this), copy(this);
 
-  TNode<Uint16T> const instance_type = LoadInstanceType(CAST(iterable));
+  const TNode<Uint16T> instance_type = LoadInstanceType(iterable);
   Branch(InstanceTypeEqual(instance_type, JS_SET_TYPE), &if_set, &if_iterator);
 
   BIND(&if_set);
   {
     // {iterable} is a JSSet.
-    var_table = CAST(LoadObjectField(CAST(iterable), JSSet::kTableOffset));
+    var_table = CAST(LoadObjectField(iterable, JSSet::kTableOffset));
     Goto(&copy);
   }
 
@@ -1200,9 +1204,8 @@ TNode<JSArray> CollectionsBuiltinsAssembler::SetOrSetIteratorToList(
   const ElementsKind kind = PACKED_ELEMENTS;
   TNode<Map> array_map =
       LoadJSArrayElementsMap(kind, LoadNativeContext(context));
-  TNode<JSArray> array =
-      AllocateJSArray(kind, array_map, size, SmiTag(size), {},
-                      INTPTR_PARAMETERS, kAllowLargeObjectAllocation);
+  TNode<JSArray> array = AllocateJSArray(kind, array_map, size, SmiTag(size),
+                                         kAllowLargeObjectAllocation);
   TNode<FixedArray> elements = CAST(LoadElements(array));
 
   const int first_element_offset = FixedArray::kHeaderSize - kHeapObjectTag;
@@ -1248,16 +1251,30 @@ TNode<JSArray> CollectionsBuiltinsAssembler::SetOrSetIteratorToList(
 
 TF_BUILTIN(SetOrSetIteratorToList, CollectionsBuiltinsAssembler) {
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> object = CAST(Parameter(Descriptor::kSource));
+  TNode<HeapObject> object = CAST(Parameter(Descriptor::kSource));
   Return(SetOrSetIteratorToList(context, object));
 }
 
+TNode<Word32T> CollectionsBuiltinsAssembler::ComputeUnseededHash(
+    TNode<IntPtrT> key) {
+  // See v8::internal::ComputeUnseededHash()
+  TNode<Word32T> hash = TruncateIntPtrToInt32(key);
+  hash = Int32Add(Word32Xor(hash, Int32Constant(0xFFFFFFFF)),
+                  Word32Shl(hash, Int32Constant(15)));
+  hash = Word32Xor(hash, Word32Shr(hash, Int32Constant(12)));
+  hash = Int32Add(hash, Word32Shl(hash, Int32Constant(2)));
+  hash = Word32Xor(hash, Word32Shr(hash, Int32Constant(4)));
+  hash = Int32Mul(hash, Int32Constant(2057));
+  hash = Word32Xor(hash, Word32Shr(hash, Int32Constant(16)));
+  return Word32And(hash, Int32Constant(0x3FFFFFFF));
+}
+
 template <typename CollectionType>
 void CollectionsBuiltinsAssembler::FindOrderedHashTableEntryForSmiKey(
     TNode<CollectionType> table, TNode<Smi> smi_key, TVariable<IntPtrT>* result,
     Label* entry_found, Label* not_found) {
-  TNode<IntPtrT> const key_untagged = SmiUntag(smi_key);
-  TNode<IntPtrT> const hash =
+  const TNode<IntPtrT> key_untagged = SmiUntag(smi_key);
+  const TNode<IntPtrT> hash =
       ChangeInt32ToIntPtr(ComputeUnseededHash(key_untagged));
   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(hash, IntPtrConstant(0)));
   *result = hash;
@@ -1273,7 +1290,7 @@ template <typename CollectionType>
 void CollectionsBuiltinsAssembler::FindOrderedHashTableEntryForStringKey(
     TNode<CollectionType> table, TNode<String> key_tagged,
     TVariable<IntPtrT>* result, Label* entry_found, Label* not_found) {
-  TNode<IntPtrT> const hash = ComputeStringHash(key_tagged);
+  const TNode<IntPtrT> hash = ComputeStringHash(key_tagged);
   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(hash, IntPtrConstant(0)));
   *result = hash;
   FindOrderedHashTableEntry<CollectionType>(
@@ -1288,10 +1305,10 @@ template <typename CollectionType>
 void CollectionsBuiltinsAssembler::FindOrderedHashTableEntryForHeapNumberKey(
     TNode<CollectionType> table, TNode<HeapNumber> key_heap_number,
     TVariable<IntPtrT>* result, Label* entry_found, Label* not_found) {
-  TNode<IntPtrT> const hash = CallGetHashRaw(key_heap_number);
+  const TNode<IntPtrT> hash = CallGetHashRaw(key_heap_number);
   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(hash, IntPtrConstant(0)));
   *result = hash;
-  TNode<Float64T> const key_float = LoadHeapNumberValue(key_heap_number);
+  const TNode<Float64T> key_float = LoadHeapNumberValue(key_heap_number);
   FindOrderedHashTableEntry<CollectionType>(
       table, hash,
       [&](TNode<Object> other_key, Label* if_same, Label* if_not_same) {
@@ -1304,7 +1321,7 @@ template <typename CollectionType>
 void CollectionsBuiltinsAssembler::FindOrderedHashTableEntryForBigIntKey(
     TNode<CollectionType> table, TNode<BigInt> key_big_int,
     TVariable<IntPtrT>* result, Label* entry_found, Label* not_found) {
-  TNode<IntPtrT> const hash = CallGetHashRaw(key_big_int);
+  const TNode<IntPtrT> hash = CallGetHashRaw(key_big_int);
   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(hash, IntPtrConstant(0)));
   *result = hash;
   FindOrderedHashTableEntry<CollectionType>(
@@ -1319,7 +1336,7 @@ template <typename CollectionType>
 void CollectionsBuiltinsAssembler::FindOrderedHashTableEntryForOtherKey(
     TNode<CollectionType> table, TNode<HeapObject> key_heap_object,
     TVariable<IntPtrT>* result, Label* entry_found, Label* not_found) {
-  TNode<IntPtrT> const hash = GetHash(key_heap_object);
+  const TNode<IntPtrT> hash = GetHash(key_heap_object);
   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(hash, IntPtrConstant(0)));
   *result = hash;
   FindOrderedHashTableEntry<CollectionType>(
@@ -1335,7 +1352,7 @@ TNode<IntPtrT> CollectionsBuiltinsAssembler::ComputeStringHash(
   TVARIABLE(IntPtrT, var_result);
 
   Label hash_not_computed(this), done(this, &var_result);
-  TNode<IntPtrT> const hash =
+  const TNode<IntPtrT> hash =
       ChangeInt32ToIntPtr(LoadNameHash(string_key, &hash_not_computed));
   var_result = hash;
   Goto(&done);
@@ -1383,7 +1400,7 @@ void CollectionsBuiltinsAssembler::SameValueZeroHeapNumber(
 
   {
     // {candidate_key} is a heap number.
-    TNode<Float64T> const candidate_float =
+    const TNode<Float64T> candidate_float =
         LoadHeapNumberValue(CAST(candidate_key));
     GotoIf(Float64Equal(key_float, candidate_float), if_same);
 
@@ -1401,7 +1418,7 @@ void CollectionsBuiltinsAssembler::SameValueZeroHeapNumber(
 
   BIND(&if_smi);
   {
-    TNode<Float64T> const candidate_float = SmiToFloat64(CAST(candidate_key));
+    const TNode<Float64T> candidate_float = SmiToFloat64(CAST(candidate_key));
     Branch(Float64Equal(key_float, candidate_float), if_same, if_not_same);
   }
 }
@@ -1453,7 +1470,7 @@ TF_BUILTIN(OrderedHashTableHealIndex, CollectionsBuiltinsAssembler) {
 template <typename TableType>
 std::pair<TNode<TableType>, TNode<IntPtrT>>
 CollectionsBuiltinsAssembler::Transition(
-    TNode<TableType> const table, TNode<IntPtrT> const index,
+    const TNode<TableType> table, const TNode<IntPtrT> index,
     UpdateInTransition<TableType> const& update_in_transition) {
   TVARIABLE(IntPtrT, var_index, index);
   TVARIABLE(TableType, var_table, table);
@@ -1495,7 +1512,7 @@ CollectionsBuiltinsAssembler::Transition(
 template <typename IteratorType, typename TableType>
 std::pair<TNode<TableType>, TNode<IntPtrT>>
 CollectionsBuiltinsAssembler::TransitionAndUpdate(
-    TNode<IteratorType> const iterator) {
+    const TNode<IteratorType> iterator) {
   return Transition<TableType>(
       CAST(LoadObjectField(iterator, IteratorType::kTableOffset)),
       LoadAndUntagObjectField(iterator, IteratorType::kIndexOffset),
@@ -1553,7 +1570,7 @@ TF_BUILTIN(MapPrototypeGet, CollectionsBuiltinsAssembler) {
 
   ThrowIfNotInstanceType(context, receiver, JS_MAP_TYPE, "Map.prototype.get");
 
-  TNode<Object> const table =
+  const TNode<Object> table =
       LoadObjectField<Object>(CAST(receiver), JSMap::kTableOffset);
   TNode<Smi> index = CAST(
       CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key));
@@ -1579,7 +1596,7 @@ TF_BUILTIN(MapPrototypeHas, CollectionsBuiltinsAssembler) {
 
   ThrowIfNotInstanceType(context, receiver, JS_MAP_TYPE, "Map.prototype.has");
 
-  TNode<Object> const table =
+  const TNode<Object> table =
       LoadObjectField(CAST(receiver), JSMap::kTableOffset);
   TNode<Smi> index = CAST(
       CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key));
@@ -1602,7 +1619,7 @@ const TNode<Object> CollectionsBuiltinsAssembler::NormalizeNumberKey(
 
   GotoIf(TaggedIsSmi(key), &done);
   GotoIfNot(IsHeapNumber(CAST(key)), &done);
-  TNode<Float64T> const number = LoadHeapNumberValue(CAST(key));
+  const TNode<Float64T> number = LoadHeapNumberValue(CAST(key));
   GotoIfNot(Float64Equal(number, Float64Constant(0.0)), &done);
   // We know the value is zero, so we take the key to be Smi 0.
   // Another option would be to normalize to Smi here.
@@ -1623,7 +1640,7 @@ TF_BUILTIN(MapPrototypeSet, CollectionsBuiltinsAssembler) {
 
   key = NormalizeNumberKey(key);
 
-  TNode<OrderedHashMap> const table =
+  const TNode<OrderedHashMap> table =
       LoadObjectField<OrderedHashMap>(CAST(receiver), JSMap::kTableOffset);
 
   TVARIABLE(IntPtrT, entry_start_position_or_hash, IntPtrConstant(0));
@@ -1663,10 +1680,10 @@ TF_BUILTIN(MapPrototypeSet, CollectionsBuiltinsAssembler) {
         table, OrderedHashMap::NumberOfBucketsIndex())));
 
     STATIC_ASSERT(OrderedHashMap::kLoadFactor == 2);
-    TNode<WordT> const capacity = WordShl(number_of_buckets.value(), 1);
-    TNode<IntPtrT> const number_of_elements = SmiUntag(
+    const TNode<WordT> capacity = WordShl(number_of_buckets.value(), 1);
+    const TNode<IntPtrT> number_of_elements = SmiUntag(
         CAST(LoadObjectField(table, OrderedHashMap::NumberOfElementsOffset())));
-    TNode<IntPtrT> const number_of_deleted = SmiUntag(CAST(LoadObjectField(
+    const TNode<IntPtrT> number_of_deleted = SmiUntag(CAST(LoadObjectField(
         table, OrderedHashMap::NumberOfDeletedElementsOffset())));
     occupancy = IntPtrAdd(number_of_elements, number_of_deleted);
     GotoIf(IntPtrLessThan(occupancy.value(), capacity), &store_new_entry);
@@ -1678,9 +1695,9 @@ TF_BUILTIN(MapPrototypeSet, CollectionsBuiltinsAssembler) {
         LoadObjectField<OrderedHashMap>(CAST(receiver), JSMap::kTableOffset);
     number_of_buckets = SmiUntag(CAST(UnsafeLoadFixedArrayElement(
         table_var.value(), OrderedHashMap::NumberOfBucketsIndex())));
-    TNode<IntPtrT> const new_number_of_elements = SmiUntag(CAST(LoadObjectField(
+    const TNode<IntPtrT> new_number_of_elements = SmiUntag(CAST(LoadObjectField(
         table_var.value(), OrderedHashMap::NumberOfElementsOffset())));
-    TNode<IntPtrT> const new_number_of_deleted = SmiUntag(CAST(LoadObjectField(
+    const TNode<IntPtrT> new_number_of_deleted = SmiUntag(CAST(LoadObjectField(
         table_var.value(), OrderedHashMap::NumberOfDeletedElementsOffset())));
     occupancy = IntPtrAdd(new_number_of_elements, new_number_of_deleted);
     Goto(&store_new_entry);
@@ -1694,16 +1711,16 @@ TF_BUILTIN(MapPrototypeSet, CollectionsBuiltinsAssembler) {
 }
 
 void CollectionsBuiltinsAssembler::StoreOrderedHashMapNewEntry(
-    TNode<OrderedHashMap> const table, const TNode<Object> key,
+    const TNode<OrderedHashMap> table, const TNode<Object> key,
     const TNode<Object> value, const TNode<IntPtrT> hash,
     const TNode<IntPtrT> number_of_buckets, const TNode<IntPtrT> occupancy) {
-  TNode<IntPtrT> const bucket =
+  const TNode<IntPtrT> bucket =
       WordAnd(hash, IntPtrSub(number_of_buckets, IntPtrConstant(1)));
   TNode<Smi> bucket_entry = CAST(UnsafeLoadFixedArrayElement(
       table, bucket, OrderedHashMap::HashTableStartIndex() * kTaggedSize));
 
   // Store the entry elements.
-  TNode<IntPtrT> const entry_start = IntPtrAdd(
+  const TNode<IntPtrT> entry_start = IntPtrAdd(
       IntPtrMul(occupancy, IntPtrConstant(OrderedHashMap::kEntrySize)),
       number_of_buckets);
   UnsafeStoreFixedArrayElement(
@@ -1724,7 +1741,7 @@ void CollectionsBuiltinsAssembler::StoreOrderedHashMapNewEntry(
       OrderedHashMap::HashTableStartIndex() * kTaggedSize);
 
   // Bump the elements count.
-  TNode<Smi> const number_of_elements =
+  const TNode<Smi> number_of_elements =
       CAST(LoadObjectField(table, OrderedHashMap::NumberOfElementsOffset()));
   StoreObjectFieldNoWriteBarrier(table,
                                  OrderedHashMap::NumberOfElementsOffset(),
@@ -1739,7 +1756,7 @@ TF_BUILTIN(MapPrototypeDelete, CollectionsBuiltinsAssembler) {
   ThrowIfNotInstanceType(context, receiver, JS_MAP_TYPE,
                          "Map.prototype.delete");
 
-  TNode<OrderedHashMap> const table =
+  const TNode<OrderedHashMap> table =
       LoadObjectField<OrderedHashMap>(CAST(receiver), JSMap::kTableOffset);
 
   TVARIABLE(IntPtrT, entry_start_position_or_hash, IntPtrConstant(0));
@@ -1762,12 +1779,12 @@ TF_BUILTIN(MapPrototypeDelete, CollectionsBuiltinsAssembler) {
                                         OrderedHashMap::kValueOffset));
 
   // Decrement the number of elements, increment the number of deleted elements.
-  TNode<Smi> const number_of_elements = SmiSub(
+  const TNode<Smi> number_of_elements = SmiSub(
       CAST(LoadObjectField(table, OrderedHashMap::NumberOfElementsOffset())),
       SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(
       table, OrderedHashMap::NumberOfElementsOffset(), number_of_elements);
-  TNode<Smi> const number_of_deleted =
+  const TNode<Smi> number_of_deleted =
       SmiAdd(CAST(LoadObjectField(
                  table, OrderedHashMap::NumberOfDeletedElementsOffset())),
              SmiConstant(1));
@@ -1775,7 +1792,7 @@ TF_BUILTIN(MapPrototypeDelete, CollectionsBuiltinsAssembler) {
       table, OrderedHashMap::NumberOfDeletedElementsOffset(),
       number_of_deleted);
 
-  TNode<Smi> const number_of_buckets = CAST(
+  const TNode<Smi> number_of_buckets = CAST(
       LoadFixedArrayElement(table, OrderedHashMap::NumberOfBucketsIndex()));
 
   // If there fewer elements than #buckets / 2, shrink the table.
@@ -1799,7 +1816,7 @@ TF_BUILTIN(SetPrototypeAdd, CollectionsBuiltinsAssembler) {
 
   key = NormalizeNumberKey(key);
 
-  TNode<OrderedHashSet> const table =
+  const TNode<OrderedHashSet> table =
       LoadObjectField<OrderedHashSet>(CAST(receiver), JSMap::kTableOffset);
 
   TVARIABLE(IntPtrT, entry_start_position_or_hash, IntPtrConstant(0));
@@ -1835,10 +1852,10 @@ TF_BUILTIN(SetPrototypeAdd, CollectionsBuiltinsAssembler) {
         table, OrderedHashSet::NumberOfBucketsIndex())));
 
     STATIC_ASSERT(OrderedHashSet::kLoadFactor == 2);
-    TNode<WordT> const capacity = WordShl(number_of_buckets.value(), 1);
-    TNode<IntPtrT> const number_of_elements = SmiUntag(
+    const TNode<WordT> capacity = WordShl(number_of_buckets.value(), 1);
+    const TNode<IntPtrT> number_of_elements = SmiUntag(
         CAST(LoadObjectField(table, OrderedHashSet::NumberOfElementsOffset())));
-    TNode<IntPtrT> const number_of_deleted = SmiUntag(CAST(LoadObjectField(
+    const TNode<IntPtrT> number_of_deleted = SmiUntag(CAST(LoadObjectField(
         table, OrderedHashSet::NumberOfDeletedElementsOffset())));
     occupancy = IntPtrAdd(number_of_elements, number_of_deleted);
     GotoIf(IntPtrLessThan(occupancy.value(), capacity), &store_new_entry);
@@ -1850,9 +1867,9 @@ TF_BUILTIN(SetPrototypeAdd, CollectionsBuiltinsAssembler) {
         LoadObjectField<OrderedHashSet>(CAST(receiver), JSMap::kTableOffset);
     number_of_buckets = SmiUntag(CAST(UnsafeLoadFixedArrayElement(
         table_var.value(), OrderedHashSet::NumberOfBucketsIndex())));
-    TNode<IntPtrT> const new_number_of_elements = SmiUntag(CAST(LoadObjectField(
+    const TNode<IntPtrT> new_number_of_elements = SmiUntag(CAST(LoadObjectField(
         table_var.value(), OrderedHashSet::NumberOfElementsOffset())));
-    TNode<IntPtrT> const new_number_of_deleted = SmiUntag(CAST(LoadObjectField(
+    const TNode<IntPtrT> new_number_of_deleted = SmiUntag(CAST(LoadObjectField(
         table_var.value(), OrderedHashSet::NumberOfDeletedElementsOffset())));
     occupancy = IntPtrAdd(new_number_of_elements, new_number_of_deleted);
     Goto(&store_new_entry);
@@ -1866,16 +1883,16 @@ TF_BUILTIN(SetPrototypeAdd, CollectionsBuiltinsAssembler) {
 }
 
 void CollectionsBuiltinsAssembler::StoreOrderedHashSetNewEntry(
-    TNode<OrderedHashSet> const table, const TNode<Object> key,
+    const TNode<OrderedHashSet> table, const TNode<Object> key,
     const TNode<IntPtrT> hash, const TNode<IntPtrT> number_of_buckets,
     const TNode<IntPtrT> occupancy) {
-  TNode<IntPtrT> const bucket =
+  const TNode<IntPtrT> bucket =
       WordAnd(hash, IntPtrSub(number_of_buckets, IntPtrConstant(1)));
   TNode<Smi> bucket_entry = CAST(UnsafeLoadFixedArrayElement(
       table, bucket, OrderedHashSet::HashTableStartIndex() * kTaggedSize));
 
   // Store the entry elements.
-  TNode<IntPtrT> const entry_start = IntPtrAdd(
+  const TNode<IntPtrT> entry_start = IntPtrAdd(
       IntPtrMul(occupancy, IntPtrConstant(OrderedHashSet::kEntrySize)),
       number_of_buckets);
   UnsafeStoreFixedArrayElement(
@@ -1892,7 +1909,7 @@ void CollectionsBuiltinsAssembler::StoreOrderedHashSetNewEntry(
       OrderedHashSet::HashTableStartIndex() * kTaggedSize);
 
   // Bump the elements count.
-  TNode<Smi> const number_of_elements =
+  const TNode<Smi> number_of_elements =
       CAST(LoadObjectField(table, OrderedHashSet::NumberOfElementsOffset()));
   StoreObjectFieldNoWriteBarrier(table,
                                  OrderedHashSet::NumberOfElementsOffset(),
@@ -1907,7 +1924,7 @@ TF_BUILTIN(SetPrototypeDelete, CollectionsBuiltinsAssembler) {
   ThrowIfNotInstanceType(context, receiver, JS_SET_TYPE,
                          "Set.prototype.delete");
 
-  TNode<OrderedHashSet> const table =
+  const TNode<OrderedHashSet> table =
       LoadObjectField<OrderedHashSet>(CAST(receiver), JSMap::kTableOffset);
 
   TVARIABLE(IntPtrT, entry_start_position_or_hash, IntPtrConstant(0));
@@ -1926,12 +1943,12 @@ TF_BUILTIN(SetPrototypeDelete, CollectionsBuiltinsAssembler) {
                          kTaggedSize * OrderedHashSet::HashTableStartIndex());
 
   // Decrement the number of elements, increment the number of deleted elements.
-  TNode<Smi> const number_of_elements = SmiSub(
+  const TNode<Smi> number_of_elements = SmiSub(
       CAST(LoadObjectField(table, OrderedHashSet::NumberOfElementsOffset())),
       SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(
       table, OrderedHashSet::NumberOfElementsOffset(), number_of_elements);
-  TNode<Smi> const number_of_deleted =
+  const TNode<Smi> number_of_deleted =
       SmiAdd(CAST(LoadObjectField(
                  table, OrderedHashSet::NumberOfDeletedElementsOffset())),
              SmiConstant(1));
@@ -1939,7 +1956,7 @@ TF_BUILTIN(SetPrototypeDelete, CollectionsBuiltinsAssembler) {
       table, OrderedHashSet::NumberOfDeletedElementsOffset(),
       number_of_deleted);
 
-  TNode<Smi> const number_of_buckets = CAST(
+  const TNode<Smi> number_of_buckets = CAST(
       LoadFixedArrayElement(table, OrderedHashSet::NumberOfBucketsIndex()));
 
   // If there fewer elements than #buckets / 2, shrink the table.
@@ -1968,7 +1985,7 @@ TF_BUILTIN(MapPrototypeGetSize, CollectionsBuiltinsAssembler) {
   const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   ThrowIfNotInstanceType(context, receiver, JS_MAP_TYPE,
                          "get Map.prototype.size");
-  TNode<OrderedHashMap> const table =
+  const TNode<OrderedHashMap> table =
       LoadObjectField<OrderedHashMap>(CAST(receiver), JSMap::kTableOffset);
   Return(LoadObjectField(table, OrderedHashMap::NumberOfElementsOffset()));
 }
@@ -1979,9 +1996,9 @@ TF_BUILTIN(MapPrototypeForEach, CollectionsBuiltinsAssembler) {
       UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
   const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   CodeStubArguments args(this, argc);
-  TNode<Object> const receiver = args.GetReceiver();
-  TNode<Object> const callback = args.GetOptionalArgumentValue(0);
-  TNode<Object> const this_arg = args.GetOptionalArgumentValue(1);
+  const TNode<Object> receiver = args.GetReceiver();
+  const TNode<Object> callback = args.GetOptionalArgumentValue(0);
+  const TNode<Object> this_arg = args.GetOptionalArgumentValue(1);
 
   ThrowIfNotInstanceType(context, receiver, JS_MAP_TYPE, kMethodName);
 
@@ -2056,14 +2073,14 @@ TF_BUILTIN(MapPrototypeValues, CollectionsBuiltinsAssembler) {
 
 TF_BUILTIN(MapIteratorPrototypeNext, CollectionsBuiltinsAssembler) {
   const char* const kMethodName = "Map Iterator.prototype.next";
-  const TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
+  const TNode<Object> maybe_receiver = CAST(Parameter(Descriptor::kReceiver));
   const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
-  // Ensure that the {receiver} is actually a JSMapIterator.
+  // Ensure that {maybe_receiver} is actually a JSMapIterator.
   Label if_receiver_valid(this), if_receiver_invalid(this, Label::kDeferred);
-  GotoIf(TaggedIsSmi(receiver), &if_receiver_invalid);
-  TNode<Uint16T> const receiver_instance_type =
-      LoadInstanceType(CAST(receiver));
+  GotoIf(TaggedIsSmi(maybe_receiver), &if_receiver_invalid);
+  const TNode<Uint16T> receiver_instance_type =
+      LoadInstanceType(CAST(maybe_receiver));
   GotoIf(
       InstanceTypeEqual(receiver_instance_type, JS_MAP_KEY_VALUE_ITERATOR_TYPE),
       &if_receiver_valid);
@@ -2073,8 +2090,9 @@ TF_BUILTIN(MapIteratorPrototypeNext, CollectionsBuiltinsAssembler) {
          &if_receiver_valid, &if_receiver_invalid);
   BIND(&if_receiver_invalid);
   ThrowTypeError(context, MessageTemplate::kIncompatibleMethodReceiver,
-                 StringConstant(kMethodName), receiver);
+                 StringConstant(kMethodName), maybe_receiver);
   BIND(&if_receiver_valid);
+  TNode<JSMapIterator> receiver = CAST(maybe_receiver);
 
   // Check if the {receiver} is exhausted.
   TVARIABLE(Oddball, var_done, TrueConstant());
@@ -2086,7 +2104,7 @@ TF_BUILTIN(MapIteratorPrototypeNext, CollectionsBuiltinsAssembler) {
   TNode<OrderedHashMap> table;
   TNode<IntPtrT> index;
   std::tie(table, index) =
-      TransitionAndUpdate<JSMapIterator, OrderedHashMap>(CAST(receiver));
+      TransitionAndUpdate<JSMapIterator, OrderedHashMap>(receiver);
 
   // Read the next entry from the {table}, skipping holes.
   TNode<Object> entry_key;
@@ -2137,7 +2155,7 @@ TF_BUILTIN(SetPrototypeHas, CollectionsBuiltinsAssembler) {
 
   ThrowIfNotInstanceType(context, receiver, JS_SET_TYPE, "Set.prototype.has");
 
-  TNode<Object> const table =
+  const TNode<Object> table =
       LoadObjectField(CAST(receiver), JSMap::kTableOffset);
 
   TVARIABLE(IntPtrT, entry_start_position, IntPtrConstant(0));
@@ -2205,7 +2223,7 @@ TF_BUILTIN(SetPrototypeGetSize, CollectionsBuiltinsAssembler) {
   const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   ThrowIfNotInstanceType(context, receiver, JS_SET_TYPE,
                          "get Set.prototype.size");
-  TNode<OrderedHashSet> const table =
+  const TNode<OrderedHashSet> table =
       LoadObjectField<OrderedHashSet>(CAST(receiver), JSSet::kTableOffset);
   Return(LoadObjectField(table, OrderedHashSet::NumberOfElementsOffset()));
 }
@@ -2216,9 +2234,9 @@ TF_BUILTIN(SetPrototypeForEach, CollectionsBuiltinsAssembler) {
       UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
   const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   CodeStubArguments args(this, argc);
-  TNode<Object> const receiver = args.GetReceiver();
-  TNode<Object> const callback = args.GetOptionalArgumentValue(0);
-  TNode<Object> const this_arg = args.GetOptionalArgumentValue(1);
+  const TNode<Object> receiver = args.GetReceiver();
+  const TNode<Object> callback = args.GetOptionalArgumentValue(0);
+  const TNode<Object> this_arg = args.GetOptionalArgumentValue(1);
 
   ThrowIfNotInstanceType(context, receiver, JS_SET_TYPE, kMethodName);
 
@@ -2278,14 +2296,14 @@ TF_BUILTIN(SetPrototypeValues, CollectionsBuiltinsAssembler) {
 
 TF_BUILTIN(SetIteratorPrototypeNext, CollectionsBuiltinsAssembler) {
   const char* const kMethodName = "Set Iterator.prototype.next";
-  const TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
+  const TNode<Object> maybe_receiver = CAST(Parameter(Descriptor::kReceiver));
   const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
-  // Ensure that the {receiver} is actually a JSSetIterator.
+  // Ensure that {maybe_receiver} is actually a JSSetIterator.
   Label if_receiver_valid(this), if_receiver_invalid(this, Label::kDeferred);
-  GotoIf(TaggedIsSmi(receiver), &if_receiver_invalid);
-  TNode<Uint16T> const receiver_instance_type =
-      LoadInstanceType(CAST(receiver));
+  GotoIf(TaggedIsSmi(maybe_receiver), &if_receiver_invalid);
+  const TNode<Uint16T> receiver_instance_type =
+      LoadInstanceType(CAST(maybe_receiver));
   GotoIf(InstanceTypeEqual(receiver_instance_type, JS_SET_VALUE_ITERATOR_TYPE),
          &if_receiver_valid);
   Branch(
@@ -2293,9 +2311,11 @@ TF_BUILTIN(SetIteratorPrototypeNext, CollectionsBuiltinsAssembler) {
       &if_receiver_valid, &if_receiver_invalid);
   BIND(&if_receiver_invalid);
   ThrowTypeError(context, MessageTemplate::kIncompatibleMethodReceiver,
-                 StringConstant(kMethodName), receiver);
+                 StringConstant(kMethodName), maybe_receiver);
   BIND(&if_receiver_valid);
 
+  TNode<JSSetIterator> receiver = CAST(maybe_receiver);
+
   // Check if the {receiver} is exhausted.
   TVARIABLE(Oddball, var_done, TrueConstant());
   TVARIABLE(Object, var_value, UndefinedConstant());
@@ -2306,7 +2326,7 @@ TF_BUILTIN(SetIteratorPrototypeNext, CollectionsBuiltinsAssembler) {
   TNode<OrderedHashSet> table;
   TNode<IntPtrT> index;
   std::tie(table, index) =
-      TransitionAndUpdate<JSSetIterator, OrderedHashSet>(CAST(receiver));
+      TransitionAndUpdate<JSSetIterator, OrderedHashSet>(receiver);
 
   // Read the next entry from the {table}, skipping holes.
   TNode<Object> entry_key;
@@ -2729,8 +2749,8 @@ TF_BUILTIN(WeakMapGet, WeakCollectionsBuiltinsAssembler) {
   ThrowIfNotInstanceType(context, receiver, JS_WEAK_MAP_TYPE,
                          "WeakMap.prototype.get");
 
-  TNode<EphemeronHashTable> const table = LoadTable(CAST(receiver));
-  TNode<Smi> const index =
+  const TNode<EphemeronHashTable> table = LoadTable(CAST(receiver));
+  const TNode<Smi> index =
       CAST(CallBuiltin(Builtins::kWeakMapLookupHashIndex, context, table, key));
 
   GotoIf(TaggedEqual(index, SmiConstant(-1)), &return_undefined);
@@ -2751,8 +2771,8 @@ TF_BUILTIN(WeakMapPrototypeHas, WeakCollectionsBuiltinsAssembler) {
   ThrowIfNotInstanceType(context, receiver, JS_WEAK_MAP_TYPE,
                          "WeakMap.prototype.has");
 
-  TNode<EphemeronHashTable> const table = LoadTable(CAST(receiver));
-  TNode<Object> const index =
+  const TNode<EphemeronHashTable> table = LoadTable(CAST(receiver));
+  const TNode<Object> index =
       CallBuiltin(Builtins::kWeakMapLookupHashIndex, context, table, key);
 
   GotoIf(TaggedEqual(index, SmiConstant(-1)), &return_false);
@@ -2915,8 +2935,8 @@ TF_BUILTIN(WeakSetPrototypeHas, WeakCollectionsBuiltinsAssembler) {
   ThrowIfNotInstanceType(context, receiver, JS_WEAK_SET_TYPE,
                          "WeakSet.prototype.has");
 
-  TNode<EphemeronHashTable> const table = LoadTable(CAST(receiver));
-  TNode<Object> const index =
+  const TNode<EphemeronHashTable> table = LoadTable(CAST(receiver));
+  const TNode<Object> index =
       CallBuiltin(Builtins::kWeakMapLookupHashIndex, context, table, key);
 
   GotoIf(TaggedEqual(index, SmiConstant(-1)), &return_false);
diff --git a/deps/v8/src/builtins/builtins-console-gen.cc b/deps/v8/src/builtins/builtins-console-gen.cc
deleted file mode 100644
index 8a4c8b83da35d0..00000000000000
--- a/deps/v8/src/builtins/builtins-console-gen.cc
+++ /dev/null
@@ -1,41 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/builtins/builtins-utils-gen.h"
-#include "src/builtins/builtins.h"
-#include "src/codegen/code-stub-assembler.h"
-#include "src/codegen/macro-assembler.h"
-#include "src/execution/frame-constants.h"
-
-namespace v8 {
-namespace internal {
-
-TF_BUILTIN(FastConsoleAssert, CodeStubAssembler) {
-  Label runtime(this);
-  Label out(this);
-
-  TNode<Int32T> argc =
-      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> new_target = CAST(Parameter(Descriptor::kJSNewTarget));
-  GotoIf(Word32Equal(argc, Int32Constant(0)), &runtime);
-
-  CodeStubArguments args(this, argc);
-  BranchIfToBooleanIsTrue(args.AtIndex(0), &out, &runtime);
-  BIND(&out);
-  args.PopAndReturn(UndefinedConstant());
-
-  BIND(&runtime);
-  {
-    // We are not using Parameter(Descriptor::kJSTarget) and loading the value
-    // from the current frame here in order to reduce register pressure on the
-    // fast path.
-    TNode<JSFunction> target = LoadTargetFromFrame();
-    TailCallBuiltin(Builtins::kConsoleAssert, context, target, new_target,
-                    argc);
-  }
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-constructor-gen.cc b/deps/v8/src/builtins/builtins-constructor-gen.cc
index bc03e86f791d46..01f3db63f36704 100644
--- a/deps/v8/src/builtins/builtins-constructor-gen.cc
+++ b/deps/v8/src/builtins/builtins-constructor-gen.cc
@@ -67,7 +67,7 @@ TF_BUILTIN(FastNewClosure, ConstructorBuiltinsAssembler) {
 
   // Bump the closure counter encoded the {feedback_cell}s map.
   {
-    TNode<Map> const feedback_cell_map = LoadMap(feedback_cell);
+    const TNode<Map> feedback_cell_map = LoadMap(feedback_cell);
     Label no_closures(this), one_closure(this), cell_done(this);
 
     GotoIf(IsNoClosuresCellMap(feedback_cell_map), &no_closures);
@@ -91,7 +91,7 @@ TF_BUILTIN(FastNewClosure, ConstructorBuiltinsAssembler) {
   // SharedFunctionInfo::function_map_index().
   TNode<Uint32T> flags = LoadObjectField<Uint32T>(
       shared_function_info, SharedFunctionInfo::kFlagsOffset);
-  TNode<IntPtrT> const function_map_index = Signed(IntPtrAdd(
+  const TNode<IntPtrT> function_map_index = Signed(IntPtrAdd(
       DecodeWordFromWord32<SharedFunctionInfo::FunctionMapIndexBits>(flags),
       IntPtrConstant(Context::FIRST_FUNCTION_MAP_INDEX)));
   CSA_ASSERT(this, UintPtrLessThanOrEqual(
@@ -100,8 +100,8 @@ TF_BUILTIN(FastNewClosure, ConstructorBuiltinsAssembler) {
 
   // Get the function map in the current native context and set that
   // as the map of the allocated object.
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Map> const function_map =
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Map> function_map =
       CAST(LoadContextElement(native_context, function_map_index));
 
   // Create a new closure from the given function info in new space
@@ -180,15 +180,14 @@ TNode<JSObject> ConstructorBuiltinsAssembler::EmitFastNewObject(
     SloppyTNode<Context> context, SloppyTNode<JSFunction> target,
     SloppyTNode<JSReceiver> new_target, Label* call_runtime) {
   // Verify that the new target is a JSFunction.
-  Label fast(this), end(this);
-  GotoIf(HasInstanceType(new_target, JS_FUNCTION_TYPE), &fast);
-  Goto(call_runtime);
-
-  BIND(&fast);
+  Label end(this);
+  TNode<JSFunction> new_target_func =
+      HeapObjectToJSFunctionWithPrototypeSlot(new_target, call_runtime);
+  // Fast path.
 
   // Load the initial map and verify that it's in fact a map.
   TNode<Object> initial_map_or_proto =
-      LoadObjectField(new_target, JSFunction::kPrototypeOrInitialMapOffset);
+      LoadJSFunctionPrototypeOrInitialMap(new_target_func);
   GotoIf(TaggedIsSmi(initial_map_or_proto), call_runtime);
   GotoIf(DoesntHaveInstanceType(CAST(initial_map_or_proto), MAP_TYPE),
          call_runtime);
@@ -196,8 +195,8 @@ TNode<JSObject> ConstructorBuiltinsAssembler::EmitFastNewObject(
 
   // Fall back to runtime if the target differs from the new target's
   // initial map constructor.
-  TNode<Object> new_target_constructor =
-      LoadObjectField(initial_map, Map::kConstructorOrBackPointerOffset);
+  TNode<Object> new_target_constructor = LoadObjectField(
+      initial_map, Map::kConstructorOrBackPointerOrNativeContextOffset);
   GotoIf(TaggedNotEqual(target, new_target_constructor), call_runtime);
 
   TVARIABLE(HeapObject, properties);
@@ -215,7 +214,7 @@ TNode<JSObject> ConstructorBuiltinsAssembler::EmitFastNewObject(
   }
 
   BIND(&instantiate_map);
-  return AllocateJSObjectFromMap(initial_map, properties.value(), nullptr,
+  return AllocateJSObjectFromMap(initial_map, properties.value(), base::nullopt,
                                  kNone, kWithSlackTracking);
 }
 
@@ -230,19 +229,21 @@ TNode<Context> ConstructorBuiltinsAssembler::EmitFastNewFunctionContext(
   TNode<Context> function_context =
       UncheckedCast<Context>(AllocateInNewSpace(size));
 
-  RootIndex context_type;
+  TNode<NativeContext> native_context = LoadNativeContext(context);
+  Context::Field index;
   switch (scope_type) {
     case EVAL_SCOPE:
-      context_type = RootIndex::kEvalContextMap;
+      index = Context::EVAL_CONTEXT_MAP_INDEX;
       break;
     case FUNCTION_SCOPE:
-      context_type = RootIndex::kFunctionContextMap;
+      index = Context::FUNCTION_CONTEXT_MAP_INDEX;
       break;
     default:
       UNREACHABLE();
   }
+  TNode<Map> map = CAST(LoadContextElement(native_context, index));
   // Set up the header.
-  StoreMapNoWriteBarrier(function_context, context_type);
+  StoreMapNoWriteBarrier(function_context, map);
   TNode<IntPtrT> min_context_slots = IntPtrConstant(Context::MIN_CONTEXT_SLOTS);
   // TODO(ishell): for now, length also includes MIN_CONTEXT_SLOTS.
   TNode<IntPtrT> length = IntPtrAdd(slots_intptr, min_context_slots);
@@ -252,11 +253,6 @@ TNode<Context> ConstructorBuiltinsAssembler::EmitFastNewFunctionContext(
                                  scope_info);
   StoreObjectFieldNoWriteBarrier(function_context, Context::kPreviousOffset,
                                  context);
-  StoreObjectFieldNoWriteBarrier(function_context, Context::kExtensionOffset,
-                                 TheHoleConstant());
-  TNode<NativeContext> native_context = LoadNativeContext(context);
-  StoreObjectFieldNoWriteBarrier(function_context,
-                                 Context::kNativeContextOffset, native_context);
 
   // Initialize the varrest of the slots to undefined.
   TNode<Oddball> undefined = UndefinedConstant();
@@ -301,7 +297,8 @@ TNode<JSRegExp> ConstructorBuiltinsAssembler::EmitCreateRegExpLiteral(
   GotoIf(NotHasBoilerplate(literal_site), &call_runtime);
   {
     TNode<JSRegExp> boilerplate = CAST(literal_site);
-    int size = JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kTaggedSize;
+    int size =
+        JSRegExp::kHeaderSize + JSRegExp::kInObjectFieldCount * kTaggedSize;
     TNode<HeapObject> copy = Allocate(size);
     for (int offset = 0; offset < size; offset += kTaggedSize) {
       TNode<Object> value = LoadObjectField(boilerplate, offset);
@@ -349,11 +346,10 @@ TNode<JSArray> ConstructorBuiltinsAssembler::EmitCreateShallowArrayLiteral(
   TNode<AllocationSite> allocation_site = CAST(maybe_allocation_site);
   TNode<JSArray> boilerplate = CAST(LoadBoilerplate(allocation_site));
 
-  ParameterMode mode = OptimalParameterMode();
   if (allocation_site_mode == TRACK_ALLOCATION_SITE) {
-    return CloneFastJSArray(context, boilerplate, mode, allocation_site);
+    return CloneFastJSArray(context, boilerplate, allocation_site);
   } else {
-    return CloneFastJSArray(context, boilerplate, mode);
+    return CloneFastJSArray(context, boilerplate);
   }
 }
 
@@ -409,11 +405,12 @@ TNode<JSArray> ConstructorBuiltinsAssembler::EmitCreateEmptyArrayLiteral(
   TNode<NativeContext> native_context = LoadNativeContext(context);
   Comment("LoadJSArrayElementsMap");
   TNode<Map> array_map = LoadJSArrayElementsMap(kind, native_context);
+  TNode<IntPtrT> zero_intptr = IntPtrConstant(0);
   TNode<Smi> zero = SmiConstant(0);
   Comment("Allocate JSArray");
   TNode<JSArray> result =
-      AllocateJSArray(GetInitialFastElementsKind(), array_map, zero, zero,
-                      allocation_site.value(), ParameterMode::SMI_PARAMETERS);
+      AllocateJSArray(GetInitialFastElementsKind(), array_map, zero_intptr,
+                      zero, allocation_site.value());
 
   Goto(&done);
   BIND(&done);
@@ -446,11 +443,11 @@ TNode<HeapObject> ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
   TVARIABLE(FixedArray, var_properties);
   {
     TNode<Uint32T> bit_field_3 = LoadMapBitField3(boilerplate_map);
-    GotoIf(IsSetWord32<Map::IsDeprecatedBit>(bit_field_3), call_runtime);
+    GotoIf(IsSetWord32<Map::Bits3::IsDeprecatedBit>(bit_field_3), call_runtime);
     // Directly copy over the property store for dict-mode boilerplates.
     Label if_dictionary(this), if_fast(this), done(this);
-    Branch(IsSetWord32<Map::IsDictionaryMapBit>(bit_field_3), &if_dictionary,
-           &if_fast);
+    Branch(IsSetWord32<Map::Bits3::IsDictionaryMapBit>(bit_field_3),
+           &if_dictionary, &if_fast);
     BIND(&if_dictionary);
     {
       Comment("Copy dictionary properties");
@@ -636,8 +633,8 @@ TNode<JSObject> ConstructorBuiltinsAssembler::EmitCreateEmptyObjectLiteral(
       object_function, JSFunction::kPrototypeOrInitialMapOffset);
   // Ensure that slack tracking is disabled for the map.
   STATIC_ASSERT(Map::kNoSlackTracking == 0);
-  CSA_ASSERT(
-      this, IsClearWord32<Map::ConstructionCounterBits>(LoadMapBitField3(map)));
+  CSA_ASSERT(this, IsClearWord32<Map::Bits3::ConstructionCounterBits>(
+                       LoadMapBitField3(map)));
   TNode<FixedArray> empty_fixed_array = EmptyFixedArrayConstant();
   TNode<JSObject> result =
       AllocateJSObjectFromMap(map, empty_fixed_array, empty_fixed_array);
@@ -736,8 +733,8 @@ TF_BUILTIN(NumberConstructor, ConstructorBuiltinsAssembler) {
       // from the current frame here in order to reduce register pressure on the
       // fast path.
       TNode<JSFunction> target = LoadTargetFromFrame();
-      TNode<Object> result =
-          CallBuiltin(Builtins::kFastNewObject, context, target, new_target);
+      TNode<HeapObject> result = CAST(
+          CallBuiltin(Builtins::kFastNewObject, context, target, new_target));
       StoreObjectField(result, JSPrimitiveWrapper::kValueOffset, n_value);
       args.PopAndReturn(result);
     }
diff --git a/deps/v8/src/builtins/builtins-conversion-gen.cc b/deps/v8/src/builtins/builtins-conversion-gen.cc
index 1666cbf6acc41f..4d0fead86148a5 100644
--- a/deps/v8/src/builtins/builtins-conversion-gen.cc
+++ b/deps/v8/src/builtins/builtins-conversion-gen.cc
@@ -429,9 +429,10 @@ TF_BUILTIN(ToObject, CodeStubAssembler) {
   TNode<NativeContext> native_context = LoadNativeContext(context);
   TNode<JSFunction> constructor = CAST(LoadContextElement(
       native_context, constructor_function_index_var.value()));
-  TNode<Object> initial_map =
-      LoadObjectField(constructor, JSFunction::kPrototypeOrInitialMapOffset);
-  TNode<HeapObject> js_primitive_wrapper = Allocate(JSPrimitiveWrapper::kSize);
+  TNode<Map> initial_map = LoadObjectField<Map>(
+      constructor, JSFunction::kPrototypeOrInitialMapOffset);
+  TNode<HeapObject> js_primitive_wrapper =
+      Allocate(JSPrimitiveWrapper::kHeaderSize);
   StoreMapNoWriteBarrier(js_primitive_wrapper, initial_map);
   StoreObjectFieldRoot(js_primitive_wrapper,
                        JSPrimitiveWrapper::kPropertiesOrHashOffset,
diff --git a/deps/v8/src/builtins/builtins-dataview.cc b/deps/v8/src/builtins/builtins-dataview.cc
index cf46a9f031b0f1..01f43c7fd9a8fa 100644
--- a/deps/v8/src/builtins/builtins-dataview.cc
+++ b/deps/v8/src/builtins/builtins-dataview.cc
@@ -90,7 +90,7 @@ BUILTIN(DataViewConstructor) {
       isolate, result,
       JSObject::New(target, new_target, Handle<AllocationSite>::null()));
   for (int i = 0; i < ArrayBufferView::kEmbedderFieldCount; ++i) {
-    Handle<JSDataView>::cast(result)->SetEmbedderField(i, Smi::kZero);
+    Handle<JSDataView>::cast(result)->SetEmbedderField(i, Smi::zero());
   }
 
   // 11. Set O's [[ViewedArrayBuffer]] internal slot to buffer.
diff --git a/deps/v8/src/builtins/builtins-definitions.h b/deps/v8/src/builtins/builtins-definitions.h
index 2489538d192826..1e2cfb9a3113e2 100644
--- a/deps/v8/src/builtins/builtins-definitions.h
+++ b/deps/v8/src/builtins/builtins-definitions.h
@@ -97,8 +97,8 @@ namespace internal {
   ASM(JSEntry, Dummy)                                                          \
   ASM(JSConstructEntry, Dummy)                                                 \
   ASM(JSRunMicrotasksEntry, RunMicrotasksEntry)                                \
-  ASM(JSEntryTrampoline, Dummy)                                                \
-  ASM(JSConstructEntryTrampoline, Dummy)                                       \
+  ASM(JSEntryTrampoline, JSTrampoline)                                         \
+  ASM(JSConstructEntryTrampoline, JSTrampoline)                                \
   ASM(ResumeGeneratorTrampoline, ResumeGenerator)                              \
                                                                                \
   /* String helpers */                                                         \
@@ -116,7 +116,7 @@ namespace internal {
   TFS(OrderedHashTableHealIndex, kTable, kIndex)                               \
                                                                                \
   /* Interpreter */                                                            \
-  ASM(InterpreterEntryTrampoline, Dummy)                                       \
+  ASM(InterpreterEntryTrampoline, JSTrampoline)                                \
   ASM(InterpreterPushArgsThenCall, InterpreterPushArgsThenCall)                \
   ASM(InterpreterPushUndefinedAndArgsThenCall, InterpreterPushArgsThenCall)    \
   ASM(InterpreterPushArgsThenCallWithFinalSpread, InterpreterPushArgsThenCall) \
@@ -132,7 +132,7 @@ namespace internal {
   /* Code life-cycle */                                                        \
   TFC(CompileLazy, JSTrampoline)                                               \
   TFC(CompileLazyDeoptimizedCode, JSTrampoline)                                \
-  ASM(InstantiateAsmJs, Dummy)                                                 \
+  TFC(InstantiateAsmJs, JSTrampoline)                                          \
   ASM(NotifyDeoptimized, Dummy)                                                \
                                                                                \
   /* Trampolines called when returning from a deoptimization that expects   */ \
@@ -215,34 +215,24 @@ namespace internal {
                                                                                \
   /* Handlers */                                                               \
   TFH(KeyedLoadIC_PolymorphicName, LoadWithVector)                             \
-  TFH(KeyedLoadIC_Slow, LoadWithVector)                                        \
   TFH(KeyedStoreIC_Megamorphic, Store)                                         \
-  TFH(KeyedStoreIC_Slow, StoreWithVector)                                      \
+  TFH(LoadGlobalIC_NoFeedback, LoadGlobalNoFeedback)                           \
   TFH(LoadIC_FunctionPrototype, LoadWithVector)                                \
   TFH(LoadIC_StringLength, LoadWithVector)                                     \
   TFH(LoadIC_StringWrapperLength, LoadWithVector)                              \
-  TFH(LoadIC_NoFeedback, Load)                                                 \
+  TFH(LoadIC_NoFeedback, LoadNoFeedback)                                       \
   TFH(StoreGlobalIC_Slow, StoreWithVector)                                     \
   TFH(StoreIC_NoFeedback, Store)                                               \
-  TFH(StoreInArrayLiteralIC_Slow, StoreWithVector)                             \
   TFH(KeyedLoadIC_SloppyArguments, LoadWithVector)                             \
   TFH(LoadIndexedInterceptorIC, LoadWithVector)                                \
   TFH(KeyedStoreIC_SloppyArguments_Standard, StoreWithVector)                  \
   TFH(KeyedStoreIC_SloppyArguments_GrowNoTransitionHandleCOW, StoreWithVector) \
   TFH(KeyedStoreIC_SloppyArguments_NoTransitionIgnoreOOB, StoreWithVector)     \
   TFH(KeyedStoreIC_SloppyArguments_NoTransitionHandleCOW, StoreWithVector)     \
-  TFH(StoreInArrayLiteralIC_Slow_Standard, StoreWithVector)                    \
   TFH(StoreFastElementIC_Standard, StoreWithVector)                            \
   TFH(StoreFastElementIC_GrowNoTransitionHandleCOW, StoreWithVector)           \
   TFH(StoreFastElementIC_NoTransitionIgnoreOOB, StoreWithVector)               \
   TFH(StoreFastElementIC_NoTransitionHandleCOW, StoreWithVector)               \
-  TFH(StoreInArrayLiteralIC_Slow_GrowNoTransitionHandleCOW, StoreWithVector)   \
-  TFH(StoreInArrayLiteralIC_Slow_NoTransitionIgnoreOOB, StoreWithVector)       \
-  TFH(StoreInArrayLiteralIC_Slow_NoTransitionHandleCOW, StoreWithVector)       \
-  TFH(KeyedStoreIC_Slow_Standard, StoreWithVector)                             \
-  TFH(KeyedStoreIC_Slow_GrowNoTransitionHandleCOW, StoreWithVector)            \
-  TFH(KeyedStoreIC_Slow_NoTransitionIgnoreOOB, StoreWithVector)                \
-  TFH(KeyedStoreIC_Slow_NoTransitionHandleCOW, StoreWithVector)                \
   TFH(ElementsTransitionAndStore_Standard, StoreTransition)                    \
   TFH(ElementsTransitionAndStore_GrowNoTransitionHandleCOW, StoreTransition)   \
   TFH(ElementsTransitionAndStore_NoTransitionIgnoreOOB, StoreTransition)       \
@@ -250,7 +240,6 @@ namespace internal {
   TFH(KeyedHasIC_PolymorphicName, LoadWithVector)                              \
   TFH(KeyedHasIC_SloppyArguments, LoadWithVector)                              \
   TFH(HasIndexedInterceptorIC, LoadWithVector)                                 \
-  TFH(HasIC_Slow, LoadWithVector)                                              \
                                                                                \
   /* Microtask helpers */                                                      \
   TFS(EnqueueMicrotask, kMicrotask)                                            \
@@ -312,16 +301,9 @@ namespace internal {
   TFC(ArraySingleArgumentConstructor_HoleyDouble_DisableAllocationSites,       \
       ArraySingleArgumentConstructor)                                          \
   TFC(ArrayNArgumentsConstructor, ArrayNArgumentsConstructor)                  \
-  ASM(InternalArrayConstructor, JSTrampoline)                                  \
-  ASM(InternalArrayConstructorImpl, JSTrampoline)                              \
-  TFC(InternalArrayNoArgumentConstructor_Packed, ArrayNoArgumentConstructor)   \
   CPP(ArrayConcat)                                                             \
-  /* ES6 #sec-array.isarray */                                                 \
-  TFJ(ArrayIsArray, 1, kReceiver, kArg)                                        \
   /* ES6 #sec-array.prototype.fill */                                          \
   CPP(ArrayPrototypeFill)                                                      \
-  /* ES6 #sec-array.from */                                                    \
-  TFJ(ArrayFrom, SharedFunctionInfo::kDontAdaptArgumentsSentinel)              \
   /* ES7 #sec-array.prototype.includes */                                      \
   TFS(ArrayIncludesSmiOrObject, kElements, kSearchElement, kLength,            \
       kFromIndex)                                                              \
@@ -394,12 +376,6 @@ namespace internal {
   CPP(BigIntPrototypeToString)                                                 \
   CPP(BigIntPrototypeValueOf)                                                  \
                                                                                \
-  /* Boolean */                                                                \
-  /* ES6 #sec-boolean.prototype.tostring */                                    \
-  TFJ(BooleanPrototypeToString, 0, kReceiver)                                  \
-  /* ES6 #sec-boolean.prototype.valueof */                                     \
-  TFJ(BooleanPrototypeValueOf, 0, kReceiver)                                   \
-                                                                               \
   /* CallSite */                                                               \
   CPP(CallSitePrototypeGetColumnNumber)                                        \
   CPP(CallSitePrototypeGetEvalOrigin)                                          \
@@ -438,7 +414,6 @@ namespace internal {
   CPP(ConsoleCount)                                                            \
   CPP(ConsoleCountReset)                                                       \
   CPP(ConsoleAssert)                                                           \
-  TFJ(FastConsoleAssert, SharedFunctionInfo::kDontAdaptArgumentsSentinel)      \
   CPP(ConsoleProfile)                                                          \
   CPP(ConsoleProfileEnd)                                                       \
   CPP(ConsoleTime)                                                             \
@@ -531,18 +506,14 @@ namespace internal {
   CPP(MakeTypeError)                                                           \
   CPP(MakeURIError)                                                            \
                                                                                \
-  /* ExtrasUtils */                                                            \
-  CPP(ExtrasUtilsUncurryThis)                                                  \
-  CPP(ExtrasUtilsCallReflectApply)                                             \
-                                                                               \
   /* Function */                                                               \
   CPP(FunctionConstructor)                                                     \
-  ASM(FunctionPrototypeApply, Dummy)                                           \
+  ASM(FunctionPrototypeApply, JSTrampoline)                                    \
   CPP(FunctionPrototypeBind)                                                   \
   /* ES6 #sec-function.prototype.bind */                                       \
   TFJ(FastFunctionPrototypeBind,                                               \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
-  ASM(FunctionPrototypeCall, Dummy)                                            \
+  ASM(FunctionPrototypeCall, JSTrampoline)                                     \
   /* ES6 #sec-function.prototype-@@hasinstance */                              \
   TFJ(FunctionPrototypeHasInstance, 1, kReceiver, kV)                          \
   /* ES6 #sec-function.prototype.tostring */                                   \
@@ -642,28 +613,6 @@ namespace internal {
   TFJ(MapIteratorPrototypeNext, 0, kReceiver)                                  \
   TFS(MapIteratorToList, kSource)                                              \
                                                                                \
-  /* Math */                                                                   \
-  /* ES6 #sec-math.abs */                                                      \
-  TFJ(MathAbs, 1, kReceiver, kX)                                               \
-  /* ES6 #sec-math.ceil */                                                     \
-  TFJ(MathCeil, 1, kReceiver, kX)                                              \
-  /* ES6 #sec-math.floor */                                                    \
-  TFJ(MathFloor, 1, kReceiver, kX)                                             \
-  /* ES6 #sec-math.imul */                                                     \
-  TFJ(MathImul, 2, kReceiver, kX, kY)                                          \
-  /* ES6 #sec-math.max */                                                      \
-  TFJ(MathMax, SharedFunctionInfo::kDontAdaptArgumentsSentinel)                \
-  /* ES6 #sec-math.min */                                                      \
-  TFJ(MathMin, SharedFunctionInfo::kDontAdaptArgumentsSentinel)                \
-  /* ES6 #sec-math.pow */                                                      \
-  TFJ(MathPow, 2, kReceiver, kBase, kExponent)                                 \
-  /* ES6 #sec-math.random */                                                   \
-  TFJ(MathRandom, 0, kReceiver)                                                \
-  /* ES6 #sec-math.round */                                                    \
-  TFJ(MathRound, 1, kReceiver, kX)                                             \
-  /* ES6 #sec-math.trunc */                                                    \
-  TFJ(MathTrunc, 1, kReceiver, kX)                                             \
-                                                                               \
   /* Number */                                                                 \
   TFC(AllocateHeapNumber, AllocateHeapNumber)                                  \
   /* ES #sec-number-constructor */                                             \
@@ -685,7 +634,6 @@ namespace internal {
   CPP(NumberPrototypeToFixed)                                                  \
   CPP(NumberPrototypeToLocaleString)                                           \
   CPP(NumberPrototypeToPrecision)                                              \
-  CPP(NumberPrototypeToString)                                                 \
   /* ES6 #sec-number.prototype.valueof */                                      \
   TFJ(NumberPrototypeValueOf, 0, kReceiver)                                    \
   TFC(Add, BinaryOp)                                                           \
@@ -719,7 +667,6 @@ namespace internal {
   TFJ(ObjectAssign, SharedFunctionInfo::kDontAdaptArgumentsSentinel)           \
   /* ES #sec-object.create */                                                  \
   TFJ(ObjectCreate, SharedFunctionInfo::kDontAdaptArgumentsSentinel)           \
-  TFS(CreateObjectWithoutProperties, kPrototypeArg)                            \
   CPP(ObjectDefineGetter)                                                      \
   CPP(ObjectDefineProperties)                                                  \
   CPP(ObjectDefineProperty)                                                    \
@@ -762,70 +709,13 @@ namespace internal {
   TFS(ForInFilter, kKey, kObject)                                              \
                                                                                \
   /* Promise */                                                                \
-  /* ES #sec-fulfillpromise */                                                 \
-  TFS(FulfillPromise, kPromise, kValue)                                        \
-  /* ES #sec-rejectpromise */                                                  \
-  TFS(RejectPromise, kPromise, kReason, kDebugEvent)                           \
-  /* ES #sec-promise-resolve-functions */                                      \
-  /* Starting at step 6 of "Promise Resolve Functions" */                      \
-  TFS(ResolvePromise, kPromise, kResolution)                                   \
-  /* ES #sec-promise-reject-functions */                                       \
-  TFJ(PromiseCapabilityDefaultReject, 1, kReceiver, kReason)                   \
-  /* ES #sec-promise-resolve-functions */                                      \
-  TFJ(PromiseCapabilityDefaultResolve, 1, kReceiver, kResolution)              \
-  /* ES6 #sec-getcapabilitiesexecutor-functions */                             \
-  TFJ(PromiseGetCapabilitiesExecutor, 2, kReceiver, kResolve, kReject)         \
-  /* ES6 #sec-newpromisecapability */                                          \
-  TFS(NewPromiseCapability, kConstructor, kDebugEvent)                         \
-  TFJ(PromiseConstructorLazyDeoptContinuation, 4, kReceiver, kPromise,         \
-      kReject, kException, kResult)                                            \
-  /* ES6 #sec-promise-executor */                                              \
-  TFJ(PromiseConstructor, 1, kReceiver, kExecutor)                             \
   CPP(IsPromise)                                                               \
-  /* ES #sec-promise.prototype.then */                                         \
-  TFJ(PromisePrototypeThen, 2, kReceiver, kOnFulfilled, kOnRejected)           \
-  /* ES #sec-performpromisethen */                                             \
-  TFS(PerformPromiseThen, kPromise, kOnFulfilled, kOnRejected, kResultPromise) \
-  /* ES #sec-promise.prototype.catch */                                        \
-  TFJ(PromisePrototypeCatch, 1, kReceiver, kOnRejected)                        \
-  /* ES #sec-promisereactionjob */                                             \
-  TFS(PromiseRejectReactionJob, kReason, kHandler, kPromiseOrCapability)       \
-  TFS(PromiseFulfillReactionJob, kValue, kHandler, kPromiseOrCapability)       \
-  /* ES #sec-promiseresolvethenablejob */                                      \
-  TFS(PromiseResolveThenableJob, kPromiseToResolve, kThenable, kThen)          \
-  /* ES #sec-promise.resolve */                                                \
-  TFJ(PromiseResolveTrampoline, 1, kReceiver, kValue)                          \
-  /* ES #sec-promise-resolve */                                                \
-  TFS(PromiseResolve, kConstructor, kValue)                                    \
-  /* ES #sec-promise.reject */                                                 \
-  TFJ(PromiseReject, 1, kReceiver, kReason)                                    \
-  TFJ(PromisePrototypeFinally, 1, kReceiver, kOnFinally)                       \
-  TFJ(PromiseThenFinally, 1, kReceiver, kValue)                                \
-  TFJ(PromiseCatchFinally, 1, kReceiver, kReason)                              \
-  TFJ(PromiseValueThunkFinally, 0, kReceiver)                                  \
-  TFJ(PromiseThrowerFinally, 0, kReceiver)                                     \
-  /* ES #sec-promise.all */                                                    \
-  TFJ(PromiseAll, 1, kReceiver, kIterable)                                     \
-  TFJ(PromiseAllResolveElementClosure, 1, kReceiver, kValue)                   \
-  /* ES #sec-promise.race */                                                   \
-  TFJ(PromiseRace, 1, kReceiver, kIterable)                                    \
-  /* ES #sec-promise.allsettled */                                             \
-  TFJ(PromiseAllSettled, 1, kReceiver, kIterable)                              \
-  TFJ(PromiseAllSettledResolveElementClosure, 1, kReceiver, kValue)            \
-  TFJ(PromiseAllSettledRejectElementClosure, 1, kReceiver, kValue)             \
-  /* V8 Extras: v8.createPromise(parent) */                                    \
-  TFJ(PromiseInternalConstructor, 1, kReceiver, kParent)                       \
-  /* V8 Extras: v8.rejectPromise(promise, reason) */                           \
-  TFJ(PromiseInternalReject, 2, kReceiver, kPromise, kReason)                  \
-  /* V8 Extras: v8.resolvePromise(promise, resolution) */                      \
-  TFJ(PromiseInternalResolve, 2, kReceiver, kPromise, kResolution)             \
                                                                                \
   /* Reflect */                                                                \
-  ASM(ReflectApply, Dummy)                                                     \
-  ASM(ReflectConstruct, Dummy)                                                 \
+  ASM(ReflectApply, JSTrampoline)                                              \
+  ASM(ReflectConstruct, JSTrampoline)                                          \
   CPP(ReflectDefineProperty)                                                   \
   CPP(ReflectGetOwnPropertyDescriptor)                                         \
-  TFJ(ReflectHas, 2, kReceiver, kTarget, kKey)                                 \
   CPP(ReflectOwnKeys)                                                          \
   CPP(ReflectSet)                                                              \
                                                                                \
@@ -916,8 +806,6 @@ namespace internal {
   TFJ(StringPrototypeSearch, 1, kReceiver, kRegexp)                            \
   /* ES6 #sec-string.prototype.split */                                        \
   TFJ(StringPrototypeSplit, SharedFunctionInfo::kDontAdaptArgumentsSentinel)   \
-  /* ES6 #sec-string.prototype.substr */                                       \
-  TFJ(StringPrototypeSubstr, SharedFunctionInfo::kDontAdaptArgumentsSentinel)  \
   TFJ(StringPrototypeTrim, SharedFunctionInfo::kDontAdaptArgumentsSentinel)    \
   TFJ(StringPrototypeTrimEnd, SharedFunctionInfo::kDontAdaptArgumentsSentinel) \
   TFJ(StringPrototypeTrimStart,                                                \
@@ -932,14 +820,6 @@ namespace internal {
   CPP(SymbolFor)                                                               \
   /* ES6 #sec-symbol.keyfor */                                                 \
   CPP(SymbolKeyFor)                                                            \
-  /* ES #sec-symbol.prototype.description */                                   \
-  TFJ(SymbolPrototypeDescriptionGetter, 0, kReceiver)                          \
-  /* ES6 #sec-symbol.prototype-@@toprimitive */                                \
-  TFJ(SymbolPrototypeToPrimitive, 1, kReceiver, kHint)                         \
-  /* ES6 #sec-symbol.prototype.tostring */                                     \
-  TFJ(SymbolPrototypeToString, 0, kReceiver)                                   \
-  /* ES6 #sec-symbol.prototype.valueof */                                      \
-  TFJ(SymbolPrototypeValueOf, 0, kReceiver)                                    \
                                                                                \
   /* TypedArray */                                                             \
   /* ES #sec-typedarray-constructors */                                        \
@@ -971,32 +851,24 @@ namespace internal {
   CPP(TypedArrayPrototypeLastIndexOf)                                          \
   /* ES6 #sec-%typedarray%.prototype.reverse */                                \
   CPP(TypedArrayPrototypeReverse)                                              \
-  /* ES6 %TypedArray%.prototype.set */                                         \
-  TFJ(TypedArrayPrototypeSet, SharedFunctionInfo::kDontAdaptArgumentsSentinel) \
   /* ES6 #sec-get-%typedarray%.prototype-@@tostringtag */                      \
   TFJ(TypedArrayPrototypeToStringTag, 0, kReceiver)                            \
   /* ES6 %TypedArray%.prototype.map */                                         \
   TFJ(TypedArrayPrototypeMap, SharedFunctionInfo::kDontAdaptArgumentsSentinel) \
-  /* ES6 %TypedArray%.of */                                                    \
-  TFJ(TypedArrayOf, SharedFunctionInfo::kDontAdaptArgumentsSentinel)           \
-  /* ES6 %TypedArray%.from */                                                  \
-  TFJ(TypedArrayFrom, SharedFunctionInfo::kDontAdaptArgumentsSentinel)         \
                                                                                \
   /* Wasm */                                                                   \
   ASM(WasmCompileLazy, Dummy)                                                  \
-  TFC(WasmAllocateHeapNumber, AllocateHeapNumber)                              \
   TFC(WasmAtomicNotify, WasmAtomicNotify)                                      \
   TFC(WasmI32AtomicWait, WasmI32AtomicWait)                                    \
   TFC(WasmI64AtomicWait, WasmI64AtomicWait)                                    \
   TFC(WasmMemoryGrow, WasmMemoryGrow)                                          \
   TFC(WasmTableGet, WasmTableGet)                                              \
   TFC(WasmTableSet, WasmTableSet)                                              \
-  TFC(WasmRecordWrite, RecordWrite)                                            \
   TFC(WasmStackGuard, NoContext)                                               \
   TFC(WasmStackOverflow, NoContext)                                            \
-  TFC(WasmToNumber, TypeConversion)                                            \
   TFC(WasmThrow, WasmThrow)                                                    \
   TFC(WasmRethrow, WasmThrow)                                                  \
+  TFS(WasmTraceMemory, kMemoryTracingInfo)                                     \
   TFS(ThrowWasmTrapUnreachable)                                                \
   TFS(ThrowWasmTrapMemOutOfBounds)                                             \
   TFS(ThrowWasmTrapUnalignedAccess)                                            \
@@ -1009,10 +881,6 @@ namespace internal {
   TFS(ThrowWasmTrapDataSegmentDropped)                                         \
   TFS(ThrowWasmTrapElemSegmentDropped)                                         \
   TFS(ThrowWasmTrapTableOutOfBounds)                                           \
-  TFC(WasmI64ToBigInt, I64ToBigInt)                                            \
-  TFC(WasmI32PairToBigInt, I32PairToBigInt)                                    \
-  TFC(WasmBigIntToI64, BigIntToI64)                                            \
-  TFC(WasmBigIntToI32Pair, BigIntToI32Pair)                                    \
                                                                                \
   /* WeakMap */                                                                \
   TFJ(WeakMapConstructor, SharedFunctionInfo::kDontAdaptArgumentsSentinel)     \
@@ -1160,6 +1028,14 @@ namespace internal {
   CPP(DateTimeFormatPrototypeResolvedOptions)                          \
   /* ecma402 #sec-intl.datetimeformat.supportedlocalesof */            \
   CPP(DateTimeFormatSupportedLocalesOf)                                \
+  /* ecma402 #sec-Intl.DisplayNames */                                 \
+  CPP(DisplayNamesConstructor)                                         \
+  /* ecma402 #sec-Intl.DisplayNames.prototype.of */                    \
+  CPP(DisplayNamesPrototypeOf)                                         \
+  /* ecma402 #sec-Intl.DisplayNames.prototype.resolvedOptions */       \
+  CPP(DisplayNamesPrototypeResolvedOptions)                            \
+  /* ecma402 #sec-Intl.DisplayNames.supportedLocalesOf */              \
+  CPP(DisplayNamesSupportedLocalesOf)                                  \
   /* ecma402 #sec-intl.getcanonicallocales */                          \
   CPP(IntlGetCanonicalLocales)                                         \
   /* ecma402 #sec-intl-listformat-constructor */                       \
@@ -1300,30 +1176,6 @@ namespace internal {
   V(PromiseRace)                                     \
   V(ResolvePromise)
 
-// Convenience macro listing all wasm runtime stubs. Note that the first few
-// elements of the list coincide with {compiler::TrapId}, order matters.
-#define WASM_RUNTIME_STUB_LIST(V, VTRAP) \
-  FOREACH_WASM_TRAPREASON(VTRAP)         \
-  V(WasmCompileLazy)                     \
-  V(WasmAllocateHeapNumber)              \
-  V(WasmAtomicNotify)                    \
-  V(WasmI32AtomicWait)                   \
-  V(WasmI64AtomicWait)                   \
-  V(WasmMemoryGrow)                      \
-  V(WasmTableGet)                        \
-  V(WasmTableSet)                        \
-  V(WasmRecordWrite)                     \
-  V(WasmStackGuard)                      \
-  V(WasmStackOverflow)                   \
-  V(WasmToNumber)                        \
-  V(WasmThrow)                           \
-  V(WasmRethrow)                         \
-  V(DoubleToI)                           \
-  V(WasmI64ToBigInt)                     \
-  V(WasmI32PairToBigInt)                 \
-  V(WasmBigIntToI64)                     \
-  V(WasmBigIntToI32Pair)
-
 // The exception thrown in the following builtins are caught internally and will
 // not be propagated further or re-thrown
 #define BUILTIN_EXCEPTION_CAUGHT_PREDICTION_LIST(V) V(PromiseRejectReactionJob)
diff --git a/deps/v8/src/builtins/builtins-error.cc b/deps/v8/src/builtins/builtins-error.cc
index 3bcc7356d42c10..3634362205c6f0 100644
--- a/deps/v8/src/builtins/builtins-error.cc
+++ b/deps/v8/src/builtins/builtins-error.cc
@@ -96,11 +96,9 @@ Object MakeGenericError(Isolate* isolate, BuiltinArguments args,
 
   DCHECK(template_index->IsSmi());
 
-  RETURN_RESULT_OR_FAILURE(
-      isolate, ErrorUtils::MakeGenericError(
-                   isolate, constructor,
-                   MessageTemplateFromInt(Smi::ToInt(*template_index)), arg0,
-                   arg1, arg2, SKIP_NONE));
+  return *ErrorUtils::MakeGenericError(
+      isolate, constructor, MessageTemplateFromInt(Smi::ToInt(*template_index)),
+      arg0, arg1, arg2, SKIP_NONE);
 }
 
 }  // namespace
@@ -130,10 +128,9 @@ BUILTIN(MakeURIError) {
   Handle<JSFunction> constructor = isolate->uri_error_function();
   Handle<Object> undefined = isolate->factory()->undefined_value();
   MessageTemplate template_index = MessageTemplate::kURIMalformed;
-  RETURN_RESULT_OR_FAILURE(
-      isolate,
-      ErrorUtils::MakeGenericError(isolate, constructor, template_index,
-                                   undefined, undefined, undefined, SKIP_NONE));
+  return *ErrorUtils::MakeGenericError(isolate, constructor, template_index,
+                                       undefined, undefined, undefined,
+                                       SKIP_NONE);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-extras-utils.cc b/deps/v8/src/builtins/builtins-extras-utils.cc
deleted file mode 100644
index 10368c0484006d..00000000000000
--- a/deps/v8/src/builtins/builtins-extras-utils.cc
+++ /dev/null
@@ -1,93 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/builtins/builtins-utils-inl.h"
-#include "src/builtins/builtins.h"
-#include "src/objects/elements.h"
-
-#include "src/logging/counters.h"
-#include "src/objects/objects-inl.h"
-
-namespace v8 {
-namespace internal {
-
-namespace {
-enum UncurryThisFunctionContextSlot {
-  kFunctionSlot = Context::MIN_CONTEXT_SLOTS,
-  kFunctionContextLength,
-};
-}  // namespace
-
-// These functions are key for safe meta-programming:
-// http://wiki.ecmascript.org/doku.php?id=conventions:safe_meta_programming
-//
-// Technically they could all be derived from combinations of
-// Function.prototype.{bind,call,apply} but that introduces lots of layers of
-// indirection.
-//
-// Equivalent to:
-//
-//   function uncurryThis(func) {
-//     return function(thisArg, ...args) {
-//       return %reflect_apply(func, thisArg, args);
-//     };
-//   };
-//
-BUILTIN(ExtrasUtilsUncurryThis) {
-  HandleScope scope(isolate);
-
-  DCHECK_EQ(2, args.length());
-  Handle<JSFunction> function = args.at<JSFunction>(1);
-  Handle<NativeContext> native_context(isolate->context().native_context(),
-                                       isolate);
-  Handle<Context> context = isolate->factory()->NewBuiltinContext(
-      native_context,
-      static_cast<int>(UncurryThisFunctionContextSlot::kFunctionContextLength));
-
-  context->set(static_cast<int>(UncurryThisFunctionContextSlot::kFunctionSlot),
-               *function);
-
-  Handle<SharedFunctionInfo> info =
-      isolate->factory()->NewSharedFunctionInfoForBuiltin(
-          isolate->factory()->empty_string(),
-          Builtins::kExtrasUtilsCallReflectApply, kNormalFunction);
-  info->DontAdaptArguments();
-
-  Handle<Map> map = isolate->strict_function_without_prototype_map();
-  Handle<JSFunction> new_bound_function =
-      isolate->factory()->NewFunctionFromSharedFunctionInfo(map, info, context);
-
-  return *new_bound_function;
-}
-
-BUILTIN(ExtrasUtilsCallReflectApply) {
-  HandleScope scope(isolate);
-  Handle<Context> context(isolate->context(), isolate);
-  Handle<NativeContext> native_context(isolate->context().native_context(),
-                                       isolate);
-  Handle<JSFunction> function(
-      JSFunction::cast(context->get(
-          static_cast<int>(UncurryThisFunctionContextSlot::kFunctionSlot))),
-      isolate);
-
-  Handle<Object> this_arg = args.at(1);
-
-  int const rest_args_atart = 2;
-  Arguments argv(args.length() - rest_args_atart,
-                 args.address_of_arg_at(rest_args_atart));
-  Handle<JSArray> rest_args_array = isolate->factory()->NewJSArray(0);
-  RETURN_FAILURE_ON_EXCEPTION(
-      isolate, ArrayConstructInitializeElements(rest_args_array, &argv));
-
-  Handle<Object> reflect_apply_args[] = {function, this_arg, rest_args_array};
-  Handle<JSFunction> reflect_apply(native_context->reflect_apply(), isolate);
-  RETURN_RESULT_OR_FAILURE(
-      isolate,
-      Execution::Call(isolate, reflect_apply,
-                      isolate->factory()->undefined_value(),
-                      arraysize(reflect_apply_args), reflect_apply_args));
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-function-gen.cc b/deps/v8/src/builtins/builtins-function-gen.cc
index f0853e9bd979dc..1d48ee84d1c492 100644
--- a/deps/v8/src/builtins/builtins-function-gen.cc
+++ b/deps/v8/src/builtins/builtins-function-gen.cc
@@ -159,7 +159,7 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
   // Allocate the resulting bound function.
   Comment("Allocate the resulting bound function");
   {
-    TNode<HeapObject> bound_function = Allocate(JSBoundFunction::kSize);
+    TNode<HeapObject> bound_function = Allocate(JSBoundFunction::kHeaderSize);
     StoreMapNoWriteBarrier(bound_function, bound_function_map.value());
     StoreObjectFieldNoWriteBarrier(
         bound_function, JSBoundFunction::kBoundTargetFunctionOffset, receiver);
diff --git a/deps/v8/src/builtins/builtins-function.cc b/deps/v8/src/builtins/builtins-function.cc
index f75014d0346266..e13c670f00d5ff 100644
--- a/deps/v8/src/builtins/builtins-function.cc
+++ b/deps/v8/src/builtins/builtins-function.cc
@@ -93,17 +93,6 @@ MaybeHandle<Object> CreateDynamicFunction(Isolate* isolate,
     function->shared().set_name_should_print_as_anonymous(true);
   }
 
-  // The spec says that we have to wrap code created via the function
-  // constructor in e.g. 'function anonymous(' as above, including with extra
-  // line breaks. Ths is confusing when reporting stack traces from the eval'd
-  // code as the line number of the error is always reported with 2 extra line
-  // breaks e.g. line 1 is reported as line 3. We fix this up here by setting
-  // line_offset which is read by stack trace code.
-  Handle<Script> script(Script::cast(function->shared().script()), isolate);
-  if (script->line_offset() == 0) {
-    script->set_line_offset(-2);
-  }
-
   // If new.target is equal to target then the function created
   // is already correctly setup and nothing else should be done
   // here. But if new.target is not equal to target then we are
@@ -211,8 +200,9 @@ Object DoFunctionBind(Isolate* isolate, BuiltinArguments args) {
       isolate, function,
       isolate->factory()->NewJSBoundFunction(target, this_arg, argv));
 
-  LookupIterator length_lookup(target, isolate->factory()->length_string(),
-                               target, LookupIterator::OWN);
+  LookupIterator length_lookup(isolate, target,
+                               isolate->factory()->length_string(), target,
+                               LookupIterator::OWN);
   // Setup the "length" property based on the "length" of the {target}.
   // If the targets length is the default JSFunction accessor, we can keep the
   // accessor that's installed by default on the JSBoundFunction. It lazily
@@ -220,7 +210,7 @@ Object DoFunctionBind(Isolate* isolate, BuiltinArguments args) {
   if (!target->IsJSFunction() ||
       length_lookup.state() != LookupIterator::ACCESSOR ||
       !length_lookup.GetAccessors()->IsAccessorInfo()) {
-    Handle<Object> length(Smi::kZero, isolate);
+    Handle<Object> length(Smi::zero(), isolate);
     Maybe<PropertyAttributes> attributes =
         JSReceiver::GetPropertyAttributes(&length_lookup);
     if (attributes.IsNothing()) return ReadOnlyRoots(isolate).exception();
@@ -233,7 +223,8 @@ Object DoFunctionBind(Isolate* isolate, BuiltinArguments args) {
             0.0, DoubleToInteger(target_length->Number()) - argv.length()));
       }
     }
-    LookupIterator it(function, isolate->factory()->length_string(), function);
+    LookupIterator it(isolate, function, isolate->factory()->length_string(),
+                      function);
     DCHECK_EQ(LookupIterator::ACCESSOR, it.state());
     RETURN_FAILURE_ON_EXCEPTION(isolate,
                                 JSObject::DefineOwnPropertyIgnoreAttributes(
@@ -244,7 +235,8 @@ Object DoFunctionBind(Isolate* isolate, BuiltinArguments args) {
   // If the target's name is the default JSFunction accessor, we can keep the
   // accessor that's installed by default on the JSBoundFunction. It lazily
   // computes the value from the underlying internal name.
-  LookupIterator name_lookup(target, isolate->factory()->name_string(), target);
+  LookupIterator name_lookup(isolate, target, isolate->factory()->name_string(),
+                             target);
   if (!target->IsJSFunction() ||
       name_lookup.state() != LookupIterator::ACCESSOR ||
       !name_lookup.GetAccessors()->IsAccessorInfo() ||
diff --git a/deps/v8/src/builtins/builtins-generator-gen.cc b/deps/v8/src/builtins/builtins-generator-gen.cc
index 0a4b3b205b9503..689c7f13421e28 100644
--- a/deps/v8/src/builtins/builtins-generator-gen.cc
+++ b/deps/v8/src/builtins/builtins-generator-gen.cc
@@ -25,22 +25,24 @@ class GeneratorBuiltinsAssembler : public CodeStubAssembler {
   // the body of resume is factored out below, and shared by JSGeneratorObject
   // prototype methods as well as AsyncModuleEvaluate. The only difference
   // between AsyncModuleEvaluate and JSGeneratorObject::PrototypeNext is
-  // the expected reciever.
-  void InnerResume(CodeStubArguments* args, Node* receiver, Node* value,
-                   Node* context, JSGeneratorObject::ResumeMode resume_mode,
+  // the expected receiver.
+  void InnerResume(CodeStubArguments* args, TNode<JSGeneratorObject> receiver,
+                   TNode<Object> value, TNode<Context> context,
+                   JSGeneratorObject::ResumeMode resume_mode,
                    char const* const method_name);
-  void GeneratorPrototypeResume(CodeStubArguments* args, Node* receiver,
-                                Node* value, Node* context,
+  void GeneratorPrototypeResume(CodeStubArguments* args, TNode<Object> receiver,
+                                TNode<Object> value, TNode<Context> context,
                                 JSGeneratorObject::ResumeMode resume_mode,
                                 char const* const method_name);
 };
 
 void GeneratorBuiltinsAssembler::InnerResume(
-    CodeStubArguments* args, Node* receiver, Node* value, Node* context,
+    CodeStubArguments* args, TNode<JSGeneratorObject> receiver,
+    TNode<Object> value, TNode<Context> context,
     JSGeneratorObject::ResumeMode resume_mode, char const* const method_name) {
   // Check if the {receiver} is running or already closed.
   TNode<Smi> receiver_continuation =
-      CAST(LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset));
+      LoadObjectField<Smi>(receiver, JSGeneratorObject::kContinuationOffset);
   Label if_receiverisclosed(this, Label::kDeferred),
       if_receiverisrunning(this, Label::kDeferred);
   TNode<Smi> closed = SmiConstant(JSGeneratorObject::kGeneratorClosed);
@@ -54,7 +56,7 @@ void GeneratorBuiltinsAssembler::InnerResume(
                                  SmiConstant(resume_mode));
 
   // Resume the {receiver} using our trampoline.
-  VARIABLE(var_exception, MachineRepresentation::kTagged, UndefinedConstant());
+  TVARIABLE(Object, var_exception);
   Label if_exception(this, Label::kDeferred), if_final_return(this);
   TNode<Object> result = CallStub(CodeFactory::ResumeGenerator(isolate()),
                                   context, value, receiver);
@@ -64,7 +66,7 @@ void GeneratorBuiltinsAssembler::InnerResume(
   // If the generator is not suspended (i.e., its state is 'executing'),
   // close it and wrap the return value in IteratorResult.
   TNode<Smi> result_continuation =
-      CAST(LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset));
+      LoadObjectField<Smi>(receiver, JSGeneratorObject::kContinuationOffset);
 
   // The generator function should not close the generator by itself, let's
   // check it is indeed not closed yet.
@@ -88,7 +90,7 @@ void GeneratorBuiltinsAssembler::InnerResume(
   BIND(&if_receiverisclosed);
   {
     // The {receiver} is closed already.
-    Node* result = nullptr;
+    TNode<Object> result;
     switch (resume_mode) {
       case JSGeneratorObject::kNext:
         result = CallBuiltin(Builtins::kCreateIterResultObject, context,
@@ -118,12 +120,14 @@ void GeneratorBuiltinsAssembler::InnerResume(
 }
 
 void GeneratorBuiltinsAssembler::GeneratorPrototypeResume(
-    CodeStubArguments* args, Node* receiver, Node* value, Node* context,
-    JSGeneratorObject::ResumeMode resume_mode, char const* const method_name) {
+    CodeStubArguments* args, TNode<Object> receiver, TNode<Object> value,
+    TNode<Context> context, JSGeneratorObject::ResumeMode resume_mode,
+    char const* const method_name) {
   // Check if the {receiver} is actually a JSGeneratorObject.
   ThrowIfNotInstanceType(context, receiver, JS_GENERATOR_OBJECT_TYPE,
                          method_name);
-  InnerResume(args, receiver, value, context, resume_mode, method_name);
+  TNode<JSGeneratorObject> generator = CAST(receiver);
+  InnerResume(args, generator, value, context, resume_mode, method_name);
 }
 
 TF_BUILTIN(AsyncModuleEvaluate, GeneratorBuiltinsAssembler) {
@@ -142,7 +146,8 @@ TF_BUILTIN(AsyncModuleEvaluate, GeneratorBuiltinsAssembler) {
   char const* const method_name = "[AsyncModule].evaluate";
   ThrowIfNotInstanceType(context, receiver, JS_ASYNC_FUNCTION_OBJECT_TYPE,
                          method_name);
-  InnerResume(&args, receiver, value, context, JSGeneratorObject::kNext,
+  TNode<JSAsyncFunctionObject> async_function = CAST(receiver);
+  InnerResume(&args, async_function, value, context, JSGeneratorObject::kNext,
               method_name);
 }
 
diff --git a/deps/v8/src/builtins/builtins-global-gen.cc b/deps/v8/src/builtins/builtins-global-gen.cc
index ca29ab3cd2220a..43d30cc6b1a59f 100644
--- a/deps/v8/src/builtins/builtins-global-gen.cc
+++ b/deps/v8/src/builtins/builtins-global-gen.cc
@@ -11,39 +11,42 @@ namespace internal {
 
 // ES #sec-isfinite-number
 TF_BUILTIN(GlobalIsFinite, CodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Label return_true(this), return_false(this);
 
   // We might need to loop once for ToNumber conversion.
-  VARIABLE(var_num, MachineRepresentation::kTagged);
+  TVARIABLE(Object, var_num);
   Label loop(this, &var_num);
-  var_num.Bind(Parameter(Descriptor::kNumber));
+  var_num = CAST(Parameter(Descriptor::kNumber));
   Goto(&loop);
   BIND(&loop);
   {
-    Node* num = var_num.value();
+    TNode<Object> num = var_num.value();
 
     // Check if {num} is a Smi or a HeapObject.
     GotoIf(TaggedIsSmi(num), &return_true);
+    TNode<HeapObject> num_heap_object = CAST(num);
 
-    // Check if {num} is a HeapNumber.
+    // Check if {num_heap_object} is a HeapNumber.
     Label if_numisheapnumber(this),
         if_numisnotheapnumber(this, Label::kDeferred);
-    Branch(IsHeapNumber(num), &if_numisheapnumber, &if_numisnotheapnumber);
+    Branch(IsHeapNumber(num_heap_object), &if_numisheapnumber,
+           &if_numisnotheapnumber);
 
     BIND(&if_numisheapnumber);
     {
-      // Check if {num} contains a finite, non-NaN value.
-      TNode<Float64T> num_value = LoadHeapNumberValue(num);
+      // Check if {num_heap_object} contains a finite, non-NaN value.
+      TNode<Float64T> num_value = LoadHeapNumberValue(num_heap_object);
       BranchIfFloat64IsNaN(Float64Sub(num_value, num_value), &return_false,
                            &return_true);
     }
 
     BIND(&if_numisnotheapnumber);
     {
-      // Need to convert {num} to a Number first.
-      var_num.Bind(CallBuiltin(Builtins::kNonNumberToNumber, context, num));
+      // Need to convert {num_heap_object} to a Number first.
+      var_num =
+          CallBuiltin(Builtins::kNonNumberToNumber, context, num_heap_object);
       Goto(&loop);
     }
   }
@@ -57,38 +60,41 @@ TF_BUILTIN(GlobalIsFinite, CodeStubAssembler) {
 
 // ES6 #sec-isnan-number
 TF_BUILTIN(GlobalIsNaN, CodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Label return_true(this), return_false(this);
 
   // We might need to loop once for ToNumber conversion.
-  VARIABLE(var_num, MachineRepresentation::kTagged);
+  TVARIABLE(Object, var_num);
   Label loop(this, &var_num);
-  var_num.Bind(Parameter(Descriptor::kNumber));
+  var_num = CAST(Parameter(Descriptor::kNumber));
   Goto(&loop);
   BIND(&loop);
   {
-    Node* num = var_num.value();
+    TNode<Object> num = var_num.value();
 
     // Check if {num} is a Smi or a HeapObject.
     GotoIf(TaggedIsSmi(num), &return_false);
+    TNode<HeapObject> num_heap_object = CAST(num);
 
-    // Check if {num} is a HeapNumber.
+    // Check if {num_heap_object} is a HeapNumber.
     Label if_numisheapnumber(this),
         if_numisnotheapnumber(this, Label::kDeferred);
-    Branch(IsHeapNumber(num), &if_numisheapnumber, &if_numisnotheapnumber);
+    Branch(IsHeapNumber(num_heap_object), &if_numisheapnumber,
+           &if_numisnotheapnumber);
 
     BIND(&if_numisheapnumber);
     {
-      // Check if {num} contains a NaN.
-      TNode<Float64T> num_value = LoadHeapNumberValue(num);
+      // Check if {num_heap_object} contains a NaN.
+      TNode<Float64T> num_value = LoadHeapNumberValue(num_heap_object);
       BranchIfFloat64IsNaN(num_value, &return_true, &return_false);
     }
 
     BIND(&if_numisnotheapnumber);
     {
-      // Need to convert {num} to a Number first.
-      var_num.Bind(CallBuiltin(Builtins::kNonNumberToNumber, context, num));
+      // Need to convert {num_heap_object} to a Number first.
+      var_num =
+          CallBuiltin(Builtins::kNonNumberToNumber, context, num_heap_object);
       Goto(&loop);
     }
   }
diff --git a/deps/v8/src/builtins/builtins-handler-gen.cc b/deps/v8/src/builtins/builtins-handler-gen.cc
index ef912eabf1fcf6..48a137abc620d2 100644
--- a/deps/v8/src/builtins/builtins-handler-gen.cc
+++ b/deps/v8/src/builtins/builtins-handler-gen.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/base/optional.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/codegen/code-stub-assembler.h"
@@ -19,8 +20,6 @@ class HandlerBuiltinsAssembler : public CodeStubAssembler {
 
  protected:
   void Generate_KeyedStoreIC_SloppyArguments();
-  void Generate_KeyedStoreIC_Slow();
-  void Generate_StoreInArrayLiteralIC_Slow();
 
   // Essentially turns runtime elements kinds (TNode<Int32T>) into
   // compile-time types (int) by dispatching over the runtime type and
@@ -40,10 +39,158 @@ class HandlerBuiltinsAssembler : public CodeStubAssembler {
 
   void Generate_ElementsTransitionAndStore(KeyedAccessStoreMode store_mode);
   void Generate_StoreFastElementIC(KeyedAccessStoreMode store_mode);
+
+  enum class ArgumentsAccessMode { kLoad, kStore, kHas };
+
+  // Emits keyed sloppy arguments has. Returns whether the key is in the
+  // arguments.
+  TNode<Object> HasKeyedSloppyArguments(TNode<JSObject> receiver,
+                                        TNode<Object> key, Label* bailout) {
+    return EmitKeyedSloppyArguments(receiver, key, base::nullopt, bailout,
+                                    ArgumentsAccessMode::kHas);
+  }
+
+  // Emits keyed sloppy arguments load. Returns either the loaded value.
+  TNode<Object> LoadKeyedSloppyArguments(TNode<JSObject> receiver,
+                                         TNode<Object> key, Label* bailout) {
+    return EmitKeyedSloppyArguments(receiver, key, base::nullopt, bailout,
+                                    ArgumentsAccessMode::kLoad);
+  }
+
+  // Emits keyed sloppy arguments store.
+  void StoreKeyedSloppyArguments(TNode<JSObject> receiver, TNode<Object> key,
+                                 TNode<Object> value, Label* bailout) {
+    EmitKeyedSloppyArguments(receiver, key, value, bailout,
+                             ArgumentsAccessMode::kStore);
+  }
+
+ private:
+  // Emits keyed sloppy arguments load if the |value| is nullopt or store
+  // otherwise. Returns either the loaded value or |value|.
+  TNode<Object> EmitKeyedSloppyArguments(TNode<JSObject> receiver,
+                                         TNode<Object> key,
+                                         base::Optional<TNode<Object>> value,
+                                         Label* bailout,
+                                         ArgumentsAccessMode access_mode);
 };
 
+TNode<Object> HandlerBuiltinsAssembler::EmitKeyedSloppyArguments(
+    TNode<JSObject> receiver, TNode<Object> tagged_key,
+    base::Optional<TNode<Object>> value, Label* bailout,
+    ArgumentsAccessMode access_mode) {
+  // Mapped arguments are actual arguments. Unmapped arguments are values added
+  // to the arguments object after it was created for the call. Mapped arguments
+  // are stored in the context at indexes given by elements[key + 2]. Unmapped
+  // arguments are stored as regular indexed properties in the arguments array,
+  // held at elements[1]. See NewSloppyArguments() in runtime.cc for a detailed
+  // look at argument object construction.
+  //
+  // The sloppy arguments elements array has a special format:
+  //
+  // 0: context
+  // 1: unmapped arguments array
+  // 2: mapped_index0,
+  // 3: mapped_index1,
+  // ...
+  //
+  // length is 2 + min(number_of_actual_arguments, number_of_formal_arguments).
+  // If key + 2 >= elements.length then attempt to look in the unmapped
+  // arguments array (given by elements[1]) and return the value at key, missing
+  // to the runtime if the unmapped arguments array is not a fixed array or if
+  // key >= unmapped_arguments_array.length.
+  //
+  // Otherwise, t = elements[key + 2]. If t is the hole, then look up the value
+  // in the unmapped arguments array, as described above. Otherwise, t is a Smi
+  // index into the context array given at elements[0]. Return the value at
+  // context[t].
+
+  GotoIfNot(TaggedIsSmi(tagged_key), bailout);
+  TNode<IntPtrT> key = SmiUntag(CAST(tagged_key));
+  GotoIf(IntPtrLessThan(key, IntPtrConstant(0)), bailout);
+
+  TNode<FixedArray> elements = CAST(LoadElements(receiver));
+  TNode<IntPtrT> elements_length = LoadAndUntagFixedArrayBaseLength(elements);
+
+  TVARIABLE(Object, var_result);
+  if (access_mode == ArgumentsAccessMode::kStore) {
+    var_result = *value;
+  } else {
+    DCHECK(access_mode == ArgumentsAccessMode::kLoad ||
+           access_mode == ArgumentsAccessMode::kHas);
+  }
+  Label if_mapped(this), if_unmapped(this), end(this, &var_result);
+  TNode<IntPtrT> intptr_two = IntPtrConstant(2);
+  TNode<IntPtrT> adjusted_length = IntPtrSub(elements_length, intptr_two);
+
+  GotoIf(UintPtrGreaterThanOrEqual(key, adjusted_length), &if_unmapped);
+
+  TNode<Object> mapped_index =
+      LoadFixedArrayElement(elements, IntPtrAdd(key, intptr_two));
+  Branch(TaggedEqual(mapped_index, TheHoleConstant()), &if_unmapped,
+         &if_mapped);
+
+  BIND(&if_mapped);
+  {
+    TNode<IntPtrT> mapped_index_intptr = SmiUntag(CAST(mapped_index));
+    TNode<Context> the_context = CAST(LoadFixedArrayElement(elements, 0));
+    if (access_mode == ArgumentsAccessMode::kLoad) {
+      TNode<Object> result =
+          LoadContextElement(the_context, mapped_index_intptr);
+      CSA_ASSERT(this, TaggedNotEqual(result, TheHoleConstant()));
+      var_result = result;
+    } else if (access_mode == ArgumentsAccessMode::kHas) {
+      CSA_ASSERT(this, Word32BinaryNot(IsTheHole(LoadContextElement(
+                           the_context, mapped_index_intptr))));
+      var_result = TrueConstant();
+    } else {
+      StoreContextElement(the_context, mapped_index_intptr, *value);
+    }
+    Goto(&end);
+  }
+
+  BIND(&if_unmapped);
+  {
+    TNode<HeapObject> backing_store_ho =
+        CAST(LoadFixedArrayElement(elements, 1));
+    GotoIf(TaggedNotEqual(LoadMap(backing_store_ho), FixedArrayMapConstant()),
+           bailout);
+    TNode<FixedArray> backing_store = CAST(backing_store_ho);
+
+    TNode<IntPtrT> backing_store_length =
+        LoadAndUntagFixedArrayBaseLength(backing_store);
+    if (access_mode == ArgumentsAccessMode::kHas) {
+      Label out_of_bounds(this);
+      GotoIf(UintPtrGreaterThanOrEqual(key, backing_store_length),
+             &out_of_bounds);
+      TNode<Object> result = LoadFixedArrayElement(backing_store, key);
+      var_result =
+          SelectBooleanConstant(TaggedNotEqual(result, TheHoleConstant()));
+      Goto(&end);
+
+      BIND(&out_of_bounds);
+      var_result = FalseConstant();
+      Goto(&end);
+    } else {
+      GotoIf(UintPtrGreaterThanOrEqual(key, backing_store_length), bailout);
+
+      // The key falls into unmapped range.
+      if (access_mode == ArgumentsAccessMode::kLoad) {
+        TNode<Object> result = LoadFixedArrayElement(backing_store, key);
+        GotoIf(TaggedEqual(result, TheHoleConstant()), bailout);
+        var_result = result;
+      } else {
+        StoreFixedArrayElement(backing_store, key, *value);
+      }
+      Goto(&end);
+    }
+  }
+
+  BIND(&end);
+  return var_result.value();
+}
+
 TF_BUILTIN(LoadIC_StringLength, CodeStubAssembler) {
-  Node* string = Parameter(Descriptor::kReceiver);
+  TNode<String> string = CAST(Parameter(Descriptor::kReceiver));
   Return(LoadStringLengthAsSmi(string));
 }
 
@@ -53,14 +200,6 @@ TF_BUILTIN(LoadIC_StringWrapperLength, CodeStubAssembler) {
   Return(LoadStringLengthAsSmi(string));
 }
 
-TF_BUILTIN(KeyedLoadIC_Slow, CodeStubAssembler) {
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
-  Node* context = Parameter(Descriptor::kContext);
-
-  TailCallRuntime(Runtime::kGetProperty, context, receiver, name);
-}
-
 void Builtins::Generate_KeyedStoreIC_Megamorphic(
     compiler::CodeAssemblerState* state) {
   KeyedStoreGenericGenerator::Generate(state);
@@ -71,74 +210,6 @@ void Builtins::Generate_StoreIC_NoFeedback(
   StoreICNoFeedbackGenerator::Generate(state);
 }
 
-// TODO(mythria): Check if we can remove feedback vector and slot parameters in
-// descriptor.
-void HandlerBuiltinsAssembler::Generate_KeyedStoreIC_Slow() {
-  using Descriptor = StoreWithVectorDescriptor;
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
-  Node* value = Parameter(Descriptor::kValue);
-  Node* context = Parameter(Descriptor::kContext);
-
-  // The slow case calls into the runtime to complete the store without causing
-  // an IC miss that would otherwise cause a transition to the generic stub.
-  TailCallRuntime(Runtime::kKeyedStoreIC_Slow, context, value, receiver, name);
-}
-
-TF_BUILTIN(KeyedStoreIC_Slow, HandlerBuiltinsAssembler) {
-  Generate_KeyedStoreIC_Slow();
-}
-
-TF_BUILTIN(KeyedStoreIC_Slow_Standard, HandlerBuiltinsAssembler) {
-  Generate_KeyedStoreIC_Slow();
-}
-
-TF_BUILTIN(KeyedStoreIC_Slow_GrowNoTransitionHandleCOW,
-           HandlerBuiltinsAssembler) {
-  Generate_KeyedStoreIC_Slow();
-}
-
-TF_BUILTIN(KeyedStoreIC_Slow_NoTransitionIgnoreOOB, HandlerBuiltinsAssembler) {
-  Generate_KeyedStoreIC_Slow();
-}
-
-TF_BUILTIN(KeyedStoreIC_Slow_NoTransitionHandleCOW, HandlerBuiltinsAssembler) {
-  Generate_KeyedStoreIC_Slow();
-}
-
-void HandlerBuiltinsAssembler::Generate_StoreInArrayLiteralIC_Slow() {
-  using Descriptor = StoreWithVectorDescriptor;
-  Node* array = Parameter(Descriptor::kReceiver);
-  Node* index = Parameter(Descriptor::kName);
-  Node* value = Parameter(Descriptor::kValue);
-  Node* context = Parameter(Descriptor::kContext);
-  TailCallRuntime(Runtime::kStoreInArrayLiteralIC_Slow, context, value, array,
-                  index);
-}
-
-TF_BUILTIN(StoreInArrayLiteralIC_Slow, HandlerBuiltinsAssembler) {
-  Generate_StoreInArrayLiteralIC_Slow();
-}
-
-TF_BUILTIN(StoreInArrayLiteralIC_Slow_Standard, HandlerBuiltinsAssembler) {
-  Generate_StoreInArrayLiteralIC_Slow();
-}
-
-TF_BUILTIN(StoreInArrayLiteralIC_Slow_GrowNoTransitionHandleCOW,
-           HandlerBuiltinsAssembler) {
-  Generate_StoreInArrayLiteralIC_Slow();
-}
-
-TF_BUILTIN(StoreInArrayLiteralIC_Slow_NoTransitionIgnoreOOB,
-           HandlerBuiltinsAssembler) {
-  Generate_StoreInArrayLiteralIC_Slow();
-}
-
-TF_BUILTIN(StoreInArrayLiteralIC_Slow_NoTransitionHandleCOW,
-           HandlerBuiltinsAssembler) {
-  Generate_StoreInArrayLiteralIC_Slow();
-}
-
 // All possible fast-to-fast transitions. Transitions to dictionary mode are not
 // handled by ElementsTransitionAndStore.
 #define ELEMENTS_KIND_TRANSITIONS(V)               \
@@ -206,13 +277,13 @@ void HandlerBuiltinsAssembler::DispatchForElementsKindTransition(
 void HandlerBuiltinsAssembler::Generate_ElementsTransitionAndStore(
     KeyedAccessStoreMode store_mode) {
   using Descriptor = StoreTransitionDescriptor;
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* key = Parameter(Descriptor::kName);
-  Node* value = Parameter(Descriptor::kValue);
-  Node* map = Parameter(Descriptor::kMap);
-  Node* slot = Parameter(Descriptor::kSlot);
-  Node* vector = Parameter(Descriptor::kVector);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<JSObject> receiver = CAST(Parameter(Descriptor::kReceiver));
+  TNode<Object> key = CAST(Parameter(Descriptor::kName));
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
+  TNode<Map> map = CAST(Parameter(Descriptor::kMap));
+  TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
+  TNode<FeedbackVector> vector = CAST(Parameter(Descriptor::kVector));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Comment("ElementsTransitionAndStore: store_mode=", store_mode);
 
@@ -338,12 +409,12 @@ void HandlerBuiltinsAssembler::DispatchByElementsKind(
 void HandlerBuiltinsAssembler::Generate_StoreFastElementIC(
     KeyedAccessStoreMode store_mode) {
   using Descriptor = StoreWithVectorDescriptor;
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* key = Parameter(Descriptor::kName);
-  Node* value = Parameter(Descriptor::kValue);
-  Node* slot = Parameter(Descriptor::kSlot);
-  Node* vector = Parameter(Descriptor::kVector);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<JSObject> receiver = CAST(Parameter(Descriptor::kReceiver));
+  TNode<Object> key = CAST(Parameter(Descriptor::kName));
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
+  TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Comment("StoreFastElementStub: store_mode=", store_mode);
 
@@ -354,8 +425,7 @@ void HandlerBuiltinsAssembler::Generate_StoreFastElementIC(
   // For typed arrays maybe_converted_value contains the value obtained after
   // calling ToNumber. We should pass the converted value to the runtime to
   // avoid doing the user visible conversion again.
-  VARIABLE(maybe_converted_value, MachineRepresentation::kTagged, value);
-  maybe_converted_value.Bind(value);
+  TVARIABLE(Object, maybe_converted_value, value);
   // TODO(v8:8481): Pass elements_kind in feedback vector slots.
   DispatchByElementsKind(
       LoadElementsKind(receiver),
@@ -389,26 +459,26 @@ TF_BUILTIN(StoreFastElementIC_NoTransitionHandleCOW, HandlerBuiltinsAssembler) {
 }
 
 TF_BUILTIN(LoadIC_FunctionPrototype, CodeStubAssembler) {
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
-  Node* slot = Parameter(Descriptor::kSlot);
-  Node* vector = Parameter(Descriptor::kVector);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<JSFunction> receiver = CAST(Parameter(Descriptor::kReceiver));
+  TNode<Name> name = CAST(Parameter(Descriptor::kName));
+  TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
+  TNode<FeedbackVector> vector = CAST(Parameter(Descriptor::kVector));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Label miss(this, Label::kDeferred);
-  Return(LoadJSFunctionPrototype(CAST(receiver), &miss));
+  Return(LoadJSFunctionPrototype(receiver, &miss));
 
   BIND(&miss);
   TailCallRuntime(Runtime::kLoadIC_Miss, context, receiver, name, slot, vector);
 }
 
 TF_BUILTIN(StoreGlobalIC_Slow, CodeStubAssembler) {
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
-  Node* value = Parameter(Descriptor::kValue);
-  Node* slot = Parameter(Descriptor::kSlot);
-  Node* vector = Parameter(Descriptor::kVector);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
+  TNode<Name> name = CAST(Parameter(Descriptor::kName));
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
+  TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
+  TNode<FeedbackVector> vector = CAST(Parameter(Descriptor::kVector));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   // The slow case calls into the runtime to complete the store without causing
   // an IC miss that would otherwise cause a transition to the generic stub.
@@ -416,16 +486,16 @@ TF_BUILTIN(StoreGlobalIC_Slow, CodeStubAssembler) {
                   receiver, name);
 }
 
-TF_BUILTIN(KeyedLoadIC_SloppyArguments, CodeStubAssembler) {
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* key = Parameter(Descriptor::kName);
-  Node* slot = Parameter(Descriptor::kSlot);
-  Node* vector = Parameter(Descriptor::kVector);
-  Node* context = Parameter(Descriptor::kContext);
+TF_BUILTIN(KeyedLoadIC_SloppyArguments, HandlerBuiltinsAssembler) {
+  TNode<JSObject> receiver = CAST(Parameter(Descriptor::kReceiver));
+  TNode<Object> key = CAST(Parameter(Descriptor::kName));
+  TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Label miss(this);
 
-  Node* result = LoadKeyedSloppyArguments(receiver, key, &miss);
+  TNode<Object> result = LoadKeyedSloppyArguments(receiver, key, &miss);
   Return(result);
 
   BIND(&miss);
@@ -438,12 +508,12 @@ TF_BUILTIN(KeyedLoadIC_SloppyArguments, CodeStubAssembler) {
 
 void HandlerBuiltinsAssembler::Generate_KeyedStoreIC_SloppyArguments() {
   using Descriptor = StoreWithVectorDescriptor;
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* key = Parameter(Descriptor::kName);
-  Node* value = Parameter(Descriptor::kValue);
-  Node* slot = Parameter(Descriptor::kSlot);
-  Node* vector = Parameter(Descriptor::kVector);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<JSObject> receiver = CAST(Parameter(Descriptor::kReceiver));
+  TNode<Object> key = CAST(Parameter(Descriptor::kName));
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
+  TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Label miss(this);
 
@@ -475,11 +545,11 @@ TF_BUILTIN(KeyedStoreIC_SloppyArguments_NoTransitionHandleCOW,
 }
 
 TF_BUILTIN(LoadIndexedInterceptorIC, CodeStubAssembler) {
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* key = Parameter(Descriptor::kName);
-  Node* slot = Parameter(Descriptor::kSlot);
-  Node* vector = Parameter(Descriptor::kVector);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<JSObject> receiver = CAST(Parameter(Descriptor::kReceiver));
+  TNode<Object> key = CAST(Parameter(Descriptor::kName));
+  TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Label if_keyispositivesmi(this), if_keyisinvalid(this);
   Branch(TaggedIsPositiveSmi(key), &if_keyispositivesmi, &if_keyisinvalid);
@@ -491,16 +561,16 @@ TF_BUILTIN(LoadIndexedInterceptorIC, CodeStubAssembler) {
                   vector);
 }
 
-TF_BUILTIN(KeyedHasIC_SloppyArguments, CodeStubAssembler) {
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* key = Parameter(Descriptor::kName);
-  Node* slot = Parameter(Descriptor::kSlot);
-  Node* vector = Parameter(Descriptor::kVector);
-  Node* context = Parameter(Descriptor::kContext);
+TF_BUILTIN(KeyedHasIC_SloppyArguments, HandlerBuiltinsAssembler) {
+  TNode<JSObject> receiver = CAST(Parameter(Descriptor::kReceiver));
+  TNode<Object> key = CAST(Parameter(Descriptor::kName));
+  TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Label miss(this);
 
-  Node* result = HasKeyedSloppyArguments(receiver, key, &miss);
+  TNode<Object> result = HasKeyedSloppyArguments(receiver, key, &miss);
   Return(result);
 
   BIND(&miss);
@@ -512,11 +582,11 @@ TF_BUILTIN(KeyedHasIC_SloppyArguments, CodeStubAssembler) {
 }
 
 TF_BUILTIN(HasIndexedInterceptorIC, CodeStubAssembler) {
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* key = Parameter(Descriptor::kName);
-  Node* slot = Parameter(Descriptor::kSlot);
-  Node* vector = Parameter(Descriptor::kVector);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<JSObject> receiver = CAST(Parameter(Descriptor::kReceiver));
+  TNode<Object> key = CAST(Parameter(Descriptor::kName));
+  TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Label if_keyispositivesmi(this), if_keyisinvalid(this);
   Branch(TaggedIsPositiveSmi(key), &if_keyispositivesmi, &if_keyisinvalid);
@@ -528,13 +598,5 @@ TF_BUILTIN(HasIndexedInterceptorIC, CodeStubAssembler) {
                   vector);
 }
 
-TF_BUILTIN(HasIC_Slow, CodeStubAssembler) {
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
-  Node* context = Parameter(Descriptor::kContext);
-
-  TailCallRuntime(Runtime::kHasProperty, context, receiver, name);
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-ic-gen.cc b/deps/v8/src/builtins/builtins-ic-gen.cc
index 605b2a6b1a3aed..723b50630915cd 100644
--- a/deps/v8/src/builtins/builtins-ic-gen.cc
+++ b/deps/v8/src/builtins/builtins-ic-gen.cc
@@ -31,6 +31,7 @@ IC_BUILTIN(KeyedLoadIC_Megamorphic)
 IC_BUILTIN(KeyedLoadIC_PolymorphicName)
 IC_BUILTIN(KeyedLoadICTrampoline)
 IC_BUILTIN(KeyedLoadICTrampoline_Megamorphic)
+IC_BUILTIN(LoadGlobalIC_NoFeedback)
 IC_BUILTIN(StoreGlobalIC)
 IC_BUILTIN(StoreGlobalICTrampoline)
 IC_BUILTIN(StoreIC)
diff --git a/deps/v8/src/builtins/builtins-internal-gen.cc b/deps/v8/src/builtins/builtins-internal-gen.cc
index 0625b8affcd23a..880f665c0258bf 100644
--- a/deps/v8/src/builtins/builtins-internal-gen.cc
+++ b/deps/v8/src/builtins/builtins-internal-gen.cc
@@ -41,9 +41,8 @@ TF_BUILTIN(CopyFastSmiOrObjectElements, CodeStubAssembler) {
 }
 
 TF_BUILTIN(GrowFastDoubleElements, CodeStubAssembler) {
-  Node* object = Parameter(Descriptor::kObject);
-  Node* key = Parameter(Descriptor::kKey);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<JSObject> object = CAST(Parameter(Descriptor::kObject));
+  TNode<Number> key = CAST(Parameter(Descriptor::kKey));
 
   Label runtime(this, Label::kDeferred);
   TNode<FixedArrayBase> elements = LoadElements(object);
@@ -52,13 +51,13 @@ TF_BUILTIN(GrowFastDoubleElements, CodeStubAssembler) {
   Return(elements);
 
   BIND(&runtime);
-  TailCallRuntime(Runtime::kGrowArrayElements, context, object, key);
+  TailCallRuntime(Runtime::kGrowArrayElements, NoContextConstant(), object,
+                  key);
 }
 
 TF_BUILTIN(GrowFastSmiOrObjectElements, CodeStubAssembler) {
-  Node* object = Parameter(Descriptor::kObject);
-  Node* key = Parameter(Descriptor::kKey);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<JSObject> object = CAST(Parameter(Descriptor::kObject));
+  TNode<Number> key = CAST(Parameter(Descriptor::kKey));
 
   Label runtime(this, Label::kDeferred);
   TNode<FixedArrayBase> elements = LoadElements(object);
@@ -67,11 +66,12 @@ TF_BUILTIN(GrowFastSmiOrObjectElements, CodeStubAssembler) {
   Return(elements);
 
   BIND(&runtime);
-  TailCallRuntime(Runtime::kGrowArrayElements, context, object, key);
+  TailCallRuntime(Runtime::kGrowArrayElements, NoContextConstant(), object,
+                  key);
 }
 
 TF_BUILTIN(NewArgumentsElements, CodeStubAssembler) {
-  Node* frame = Parameter(Descriptor::kFrame);
+  TNode<IntPtrT> frame = UncheckedCast<IntPtrT>(Parameter(Descriptor::kFrame));
   TNode<IntPtrT> length = SmiToIntPtr(Parameter(Descriptor::kLength));
   TNode<IntPtrT> mapped_count =
       SmiToIntPtr(Parameter(Descriptor::kMappedCount));
@@ -168,7 +168,8 @@ TF_BUILTIN(NewArgumentsElements, CodeStubAssembler) {
 }
 
 TF_BUILTIN(ReturnReceiver, CodeStubAssembler) {
-  Return(Parameter(Descriptor::kReceiver));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
+  Return(receiver);
 }
 
 TF_BUILTIN(DebugBreakTrampoline, CodeStubAssembler) {
@@ -211,10 +212,10 @@ class RecordWriteCodeStubAssembler : public CodeStubAssembler {
   explicit RecordWriteCodeStubAssembler(compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state) {}
 
-  Node* IsMarking() {
+  TNode<BoolT> IsMarking() {
     TNode<ExternalReference> is_marking_addr = ExternalConstant(
         ExternalReference::heap_is_marking_flag_address(this->isolate()));
-    return Load(MachineType::Uint8(), is_marking_addr);
+    return Word32NotEqual(Load<Uint8T>(is_marking_addr), Int32Constant(0));
   }
 
   TNode<BoolT> IsPageFlagSet(TNode<IntPtrT> object, int mask) {
@@ -228,34 +229,34 @@ class RecordWriteCodeStubAssembler : public CodeStubAssembler {
 
   TNode<BoolT> IsWhite(TNode<IntPtrT> object) {
     DCHECK_EQ(strcmp(Marking::kWhiteBitPattern, "00"), 0);
-    Node* cell;
-    Node* mask;
+    TNode<IntPtrT> cell;
+    TNode<IntPtrT> mask;
     GetMarkBit(object, &cell, &mask);
-    mask = TruncateIntPtrToInt32(mask);
+    TNode<Int32T> mask32 = TruncateIntPtrToInt32(mask);
     // Non-white has 1 for the first bit, so we only need to check for the first
     // bit.
-    return Word32Equal(Word32And(Load(MachineType::Int32(), cell), mask),
-                       Int32Constant(0));
+    return Word32Equal(Word32And(Load<Int32T>(cell), mask32), Int32Constant(0));
   }
 
-  void GetMarkBit(TNode<IntPtrT> object, Node** cell, Node** mask) {
+  void GetMarkBit(TNode<IntPtrT> object, TNode<IntPtrT>* cell,
+                  TNode<IntPtrT>* mask) {
     TNode<IntPtrT> page = PageFromAddress(object);
-    Node* bitmap = Load(MachineType::Pointer(), page,
-                        IntPtrConstant(MemoryChunk::kMarkBitmapOffset));
+    TNode<IntPtrT> bitmap =
+        Load<IntPtrT>(page, IntPtrConstant(MemoryChunk::kMarkBitmapOffset));
 
     {
       // Temp variable to calculate cell offset in bitmap.
-      Node* r0;
+      TNode<WordT> r0;
       int shift = Bitmap::kBitsPerCellLog2 + kTaggedSizeLog2 -
                   Bitmap::kBytesPerCellLog2;
       r0 = WordShr(object, IntPtrConstant(shift));
       r0 = WordAnd(r0, IntPtrConstant((kPageAlignmentMask >> shift) &
                                       ~(Bitmap::kBytesPerCell - 1)));
-      *cell = IntPtrAdd(bitmap, r0);
+      *cell = IntPtrAdd(bitmap, Signed(r0));
     }
     {
       // Temp variable to calculate bit offset in cell.
-      Node* r1;
+      TNode<WordT> r1;
       r1 = WordShr(object, IntPtrConstant(kTaggedSizeLog2));
       r1 = WordAnd(r1, IntPtrConstant((1 << Bitmap::kBitsPerCellLog2) - 1));
       // It seems that LSB(e.g. cl) is automatically used, so no manual masking
@@ -265,83 +266,88 @@ class RecordWriteCodeStubAssembler : public CodeStubAssembler {
     }
   }
 
-  Node* ShouldSkipFPRegs(SloppyTNode<Object> mode) {
+  TNode<BoolT> ShouldSkipFPRegs(SloppyTNode<Smi> mode) {
     return TaggedEqual(mode, SmiConstant(kDontSaveFPRegs));
   }
 
-  Node* ShouldEmitRememberSet(SloppyTNode<Object> remembered_set) {
+  TNode<BoolT> ShouldEmitRememberSet(SloppyTNode<Smi> remembered_set) {
     return TaggedEqual(remembered_set, SmiConstant(EMIT_REMEMBERED_SET));
   }
 
+  template <typename Ret, typename Arg0, typename Arg1>
   void CallCFunction2WithCallerSavedRegistersMode(
-      MachineType return_type, MachineType arg0_type, MachineType arg1_type,
-      Node* function, Node* arg0, Node* arg1, Node* mode, Label* next) {
+      TNode<ExternalReference> function, TNode<Arg0> arg0, TNode<Arg1> arg1,
+      TNode<Smi> mode, Label* next) {
     Label dont_save_fp(this), save_fp(this);
     Branch(ShouldSkipFPRegs(mode), &dont_save_fp, &save_fp);
     BIND(&dont_save_fp);
     {
       CallCFunctionWithCallerSavedRegisters(
-          function, return_type, kDontSaveFPRegs,
-          std::make_pair(arg0_type, arg0), std::make_pair(arg1_type, arg1));
+          function, MachineTypeOf<Ret>::value, kDontSaveFPRegs,
+          std::make_pair(MachineTypeOf<Arg0>::value, arg0),
+          std::make_pair(MachineTypeOf<Arg1>::value, arg1));
       Goto(next);
     }
 
     BIND(&save_fp);
     {
-      CallCFunctionWithCallerSavedRegisters(function, return_type, kSaveFPRegs,
-                                            std::make_pair(arg0_type, arg0),
-                                            std::make_pair(arg1_type, arg1));
+      CallCFunctionWithCallerSavedRegisters(
+          function, MachineTypeOf<Ret>::value, kSaveFPRegs,
+          std::make_pair(MachineTypeOf<Arg0>::value, arg0),
+          std::make_pair(MachineTypeOf<Arg1>::value, arg1));
       Goto(next);
     }
   }
 
+  template <typename Ret, typename Arg0, typename Arg1, typename Arg2>
   void CallCFunction3WithCallerSavedRegistersMode(
-      MachineType return_type, MachineType arg0_type, MachineType arg1_type,
-      MachineType arg2_type, Node* function, Node* arg0, Node* arg1, Node* arg2,
-      Node* mode, Label* next) {
+      TNode<ExternalReference> function, TNode<Arg0> arg0, TNode<Arg1> arg1,
+      TNode<Arg2> arg2, TNode<Smi> mode, Label* next) {
     Label dont_save_fp(this), save_fp(this);
     Branch(ShouldSkipFPRegs(mode), &dont_save_fp, &save_fp);
     BIND(&dont_save_fp);
     {
       CallCFunctionWithCallerSavedRegisters(
-          function, return_type, kDontSaveFPRegs,
-          std::make_pair(arg0_type, arg0), std::make_pair(arg1_type, arg1),
-          std::make_pair(arg2_type, arg2));
+          function, MachineTypeOf<Ret>::value, kDontSaveFPRegs,
+          std::make_pair(MachineTypeOf<Arg0>::value, arg0),
+          std::make_pair(MachineTypeOf<Arg1>::value, arg1),
+          std::make_pair(MachineTypeOf<Arg2>::value, arg2));
       Goto(next);
     }
 
     BIND(&save_fp);
     {
       CallCFunctionWithCallerSavedRegisters(
-          function, return_type, kSaveFPRegs, std::make_pair(arg0_type, arg0),
-          std::make_pair(arg1_type, arg1), std::make_pair(arg2_type, arg2));
+          function, MachineTypeOf<Ret>::value, kSaveFPRegs,
+          std::make_pair(MachineTypeOf<Arg0>::value, arg0),
+          std::make_pair(MachineTypeOf<Arg1>::value, arg1),
+          std::make_pair(MachineTypeOf<Arg2>::value, arg2));
       Goto(next);
     }
   }
 
-  void InsertIntoRememberedSetAndGotoSlow(Node* isolate, TNode<IntPtrT> object,
-                                          TNode<IntPtrT> slot, Node* mode,
+  void InsertIntoRememberedSetAndGotoSlow(TNode<IntPtrT> object,
+                                          TNode<IntPtrT> slot, TNode<Smi> mode,
                                           Label* next) {
     TNode<IntPtrT> page = PageFromAddress(object);
     TNode<ExternalReference> function =
         ExternalConstant(ExternalReference::insert_remembered_set_function());
-    CallCFunction2WithCallerSavedRegistersMode(
-        MachineType::Int32(), MachineType::Pointer(), MachineType::Pointer(),
+    CallCFunction2WithCallerSavedRegistersMode<Int32T, IntPtrT, IntPtrT>(
         function, page, slot, mode, next);
   }
 
-  void InsertIntoRememberedSetAndGoto(Node* isolate, TNode<IntPtrT> object,
-                                      TNode<IntPtrT> slot, Node* mode,
+  void InsertIntoRememberedSetAndGoto(TNode<IntPtrT> object,
+                                      TNode<IntPtrT> slot, TNode<Smi> mode,
                                       Label* next) {
     Label slow_path(this);
     TNode<IntPtrT> page = PageFromAddress(object);
 
     // Load address of SlotSet
-    TNode<IntPtrT> slot_set_array = LoadSlotSetArray(page, &slow_path);
+    TNode<IntPtrT> slot_set = LoadSlotSet(page, &slow_path);
     TNode<IntPtrT> slot_offset = IntPtrSub(slot, page);
 
     // Load bucket
-    TNode<IntPtrT> bucket = LoadBucket(slot_set_array, slot_offset, &slow_path);
+    TNode<IntPtrT> bucket = LoadBucket(slot_set, slot_offset, &slow_path);
 
     // Update cell
     SetBitInCell(bucket, slot_offset);
@@ -349,26 +355,24 @@ class RecordWriteCodeStubAssembler : public CodeStubAssembler {
     Goto(next);
 
     BIND(&slow_path);
-    InsertIntoRememberedSetAndGotoSlow(isolate, object, slot, mode, next);
+    InsertIntoRememberedSetAndGotoSlow(object, slot, mode, next);
   }
 
-  TNode<IntPtrT> LoadSlotSetArray(TNode<IntPtrT> page, Label* slow_path) {
-    TNode<IntPtrT> slot_set_array = UncheckedCast<IntPtrT>(
+  TNode<IntPtrT> LoadSlotSet(TNode<IntPtrT> page, Label* slow_path) {
+    TNode<IntPtrT> slot_set = UncheckedCast<IntPtrT>(
         Load(MachineType::Pointer(), page,
              IntPtrConstant(MemoryChunk::kOldToNewSlotSetOffset)));
-    GotoIf(WordEqual(slot_set_array, IntPtrConstant(0)), slow_path);
+    GotoIf(WordEqual(slot_set, IntPtrConstant(0)), slow_path);
 
-    return slot_set_array;
+    return slot_set;
   }
 
-  TNode<IntPtrT> LoadBucket(TNode<IntPtrT> slot_set_array,
-                            TNode<WordT> slot_offset, Label* slow_path) {
-    // Assume here that SlotSet only contains of buckets
-    DCHECK_EQ(SlotSet::kSize, SlotSet::kBuckets * sizeof(SlotSet::Bucket));
+  TNode<IntPtrT> LoadBucket(TNode<IntPtrT> slot_set, TNode<WordT> slot_offset,
+                            Label* slow_path) {
     TNode<WordT> bucket_index =
         WordShr(slot_offset, SlotSet::kBitsPerBucketLog2 + kTaggedSizeLog2);
     TNode<IntPtrT> bucket = UncheckedCast<IntPtrT>(
-        Load(MachineType::Pointer(), slot_set_array,
+        Load(MachineType::Pointer(), slot_set,
              WordShl(bucket_index, kSystemPointerSizeLog2)));
     GotoIf(WordEqual(bucket, IntPtrConstant(0)), slow_path);
     return bucket;
@@ -403,7 +407,8 @@ TF_BUILTIN(RecordWrite, RecordWriteCodeStubAssembler) {
   Label incremental_wb(this);
   Label exit(this);
 
-  Node* remembered_set = Parameter(Descriptor::kRememberedSet);
+  TNode<Smi> remembered_set =
+      UncheckedCast<Smi>(Parameter(Descriptor::kRememberedSet));
   Branch(ShouldEmitRememberSet(remembered_set), &generational_wb,
          &incremental_wb);
 
@@ -442,24 +447,18 @@ TF_BUILTIN(RecordWrite, RecordWriteCodeStubAssembler) {
 
     BIND(&store_buffer_exit);
     {
-      TNode<ExternalReference> isolate_constant =
-          ExternalConstant(ExternalReference::isolate_address(isolate()));
-      Node* fp_mode = Parameter(Descriptor::kFPMode);
+      TNode<Smi> fp_mode = UncheckedCast<Smi>(Parameter(Descriptor::kFPMode));
       TNode<IntPtrT> object =
           BitcastTaggedToWord(Parameter(Descriptor::kObject));
-      InsertIntoRememberedSetAndGoto(isolate_constant, object, slot, fp_mode,
-                                     &exit);
+      InsertIntoRememberedSetAndGoto(object, slot, fp_mode, &exit);
     }
 
     BIND(&store_buffer_incremental_wb);
     {
-      TNode<ExternalReference> isolate_constant =
-          ExternalConstant(ExternalReference::isolate_address(isolate()));
-      Node* fp_mode = Parameter(Descriptor::kFPMode);
+      TNode<Smi> fp_mode = UncheckedCast<Smi>(Parameter(Descriptor::kFPMode));
       TNode<IntPtrT> object =
           BitcastTaggedToWord(Parameter(Descriptor::kObject));
-      InsertIntoRememberedSetAndGoto(isolate_constant, object, slot, fp_mode,
-                                     &incremental_wb);
+      InsertIntoRememberedSetAndGoto(object, slot, fp_mode, &incremental_wb);
     }
   }
 
@@ -491,13 +490,12 @@ TF_BUILTIN(RecordWrite, RecordWriteCodeStubAssembler) {
           ExternalReference::incremental_marking_record_write_function());
       TNode<ExternalReference> isolate_constant =
           ExternalConstant(ExternalReference::isolate_address(isolate()));
-      Node* fp_mode = Parameter(Descriptor::kFPMode);
+      TNode<Smi> fp_mode = UncheckedCast<Smi>(Parameter(Descriptor::kFPMode));
       TNode<IntPtrT> object =
           BitcastTaggedToWord(Parameter(Descriptor::kObject));
-      CallCFunction3WithCallerSavedRegistersMode(
-          MachineType::Int32(), MachineType::Pointer(), MachineType::Pointer(),
-          MachineType::Pointer(), function, object, slot, isolate_constant,
-          fp_mode, &exit);
+      CallCFunction3WithCallerSavedRegistersMode<Int32T, IntPtrT, IntPtrT,
+                                                 ExternalReference>(
+          function, object, slot, isolate_constant, fp_mode, &exit);
     }
   }
 
@@ -513,13 +511,13 @@ TF_BUILTIN(EphemeronKeyBarrier, RecordWriteCodeStubAssembler) {
       ExternalReference::ephemeron_key_write_barrier_function());
   TNode<ExternalReference> isolate_constant =
       ExternalConstant(ExternalReference::isolate_address(isolate()));
-  Node* address = Parameter(Descriptor::kSlotAddress);
+  TNode<IntPtrT> address =
+      UncheckedCast<IntPtrT>(Parameter(Descriptor::kSlotAddress));
   TNode<IntPtrT> object = BitcastTaggedToWord(Parameter(Descriptor::kObject));
-  Node* fp_mode = Parameter(Descriptor::kFPMode);
-  CallCFunction3WithCallerSavedRegistersMode(
-      MachineType::Int32(), MachineType::Pointer(), MachineType::Pointer(),
-      MachineType::Pointer(), function, object, address, isolate_constant,
-      fp_mode, &exit);
+  TNode<Smi> fp_mode = UncheckedCast<Smi>(Parameter(Descriptor::kFPMode));
+  CallCFunction3WithCallerSavedRegistersMode<Int32T, IntPtrT, IntPtrT,
+                                             ExternalReference>(
+      function, object, address, isolate_constant, fp_mode, &exit);
 
   BIND(&exit);
   IncrementCounter(isolate()->counters()->write_barriers(), 1);
@@ -542,8 +540,7 @@ class DeletePropertyBaseAssembler : public AccessorAssembler {
 
     BIND(&dictionary_found);
     TNode<IntPtrT> key_index = var_name_index.value();
-    TNode<Uint32T> details =
-        LoadDetailsByKeyIndex<NameDictionary>(properties, key_index);
+    TNode<Uint32T> details = LoadDetailsByKeyIndex(properties, key_index);
     GotoIf(IsSetWord32(details, PropertyDetails::kAttributesDontDeleteMask),
            dont_delete);
     // Overwrite the entry itself (see NameDictionary::SetEntry).
@@ -585,7 +582,7 @@ TF_BUILTIN(DeleteProperty, DeletePropertyBaseAssembler) {
 
   TVARIABLE(IntPtrT, var_index);
   TVARIABLE(Name, var_unique);
-  Label if_index(this), if_unique_name(this), if_notunique(this),
+  Label if_index(this, &var_index), if_unique_name(this), if_notunique(this),
       if_notfound(this), slow(this), if_proxy(this);
 
   GotoIf(TaggedIsSmi(receiver), &slow);
@@ -784,11 +781,9 @@ TF_BUILTIN(ForInEnumerate, CodeStubAssembler) {
 }
 
 TF_BUILTIN(ForInFilter, CodeStubAssembler) {
-  Node* key = Parameter(Descriptor::kKey);
-  Node* object = Parameter(Descriptor::kObject);
-  Node* context = Parameter(Descriptor::kContext);
-
-  CSA_ASSERT(this, IsString(key));
+  TNode<String> key = CAST(Parameter(Descriptor::kKey));
+  TNode<HeapObject> object = CAST(Parameter(Descriptor::kObject));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Label if_true(this), if_false(this);
   TNode<Oddball> result = HasProperty(context, object, key, kForInHasProperty);
@@ -802,8 +797,8 @@ TF_BUILTIN(ForInFilter, CodeStubAssembler) {
 }
 
 TF_BUILTIN(SameValue, CodeStubAssembler) {
-  Node* lhs = Parameter(Descriptor::kLeft);
-  Node* rhs = Parameter(Descriptor::kRight);
+  TNode<Object> lhs = CAST(Parameter(Descriptor::kLeft));
+  TNode<Object> rhs = CAST(Parameter(Descriptor::kRight));
 
   Label if_true(this), if_false(this);
   BranchIfSameValue(lhs, rhs, &if_true, &if_false);
@@ -816,8 +811,8 @@ TF_BUILTIN(SameValue, CodeStubAssembler) {
 }
 
 TF_BUILTIN(SameValueNumbersOnly, CodeStubAssembler) {
-  Node* lhs = Parameter(Descriptor::kLeft);
-  Node* rhs = Parameter(Descriptor::kRight);
+  TNode<Object> lhs = CAST(Parameter(Descriptor::kLeft));
+  TNode<Object> rhs = CAST(Parameter(Descriptor::kRight));
 
   Label if_true(this), if_false(this);
   BranchIfSameValue(lhs, rhs, &if_true, &if_false, SameValueMode::kNumbersOnly);
@@ -992,31 +987,31 @@ void Builtins::Generate_MemMove(MacroAssembler* masm) {
 
 // ES6 [[Get]] operation.
 TF_BUILTIN(GetProperty, CodeStubAssembler) {
-  Node* object = Parameter(Descriptor::kObject);
-  Node* key = Parameter(Descriptor::kKey);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Object> object = CAST(Parameter(Descriptor::kObject));
+  TNode<Object> key = CAST(Parameter(Descriptor::kKey));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   // TODO(duongn): consider tailcalling to GetPropertyWithReceiver(object,
   // object, key, OnNonExistent::kReturnUndefined).
   Label if_notfound(this), if_proxy(this, Label::kDeferred),
       if_slow(this, Label::kDeferred);
 
-  CodeStubAssembler::LookupInHolder lookup_property_in_holder =
-      [=](Node* receiver, Node* holder, Node* holder_map,
-          Node* holder_instance_type, Node* unique_name, Label* next_holder,
-          Label* if_bailout) {
-        VARIABLE(var_value, MachineRepresentation::kTagged);
+  CodeStubAssembler::LookupPropertyInHolder lookup_property_in_holder =
+      [=](TNode<HeapObject> receiver, TNode<HeapObject> holder,
+          TNode<Map> holder_map, TNode<Int32T> holder_instance_type,
+          TNode<Name> unique_name, Label* next_holder, Label* if_bailout) {
+        TVARIABLE(Object, var_value);
         Label if_found(this);
-        TryGetOwnProperty(context, receiver, holder, holder_map,
+        TryGetOwnProperty(context, receiver, CAST(holder), holder_map,
                           holder_instance_type, unique_name, &if_found,
                           &var_value, next_holder, if_bailout);
         BIND(&if_found);
         Return(var_value.value());
       };
 
-  CodeStubAssembler::LookupInHolder lookup_element_in_holder =
-      [=](Node* receiver, Node* holder, Node* holder_map,
-          Node* holder_instance_type, Node* index, Label* next_holder,
-          Label* if_bailout) {
+  CodeStubAssembler::LookupElementInHolder lookup_element_in_holder =
+      [=](TNode<HeapObject> receiver, TNode<HeapObject> holder,
+          TNode<Map> holder_map, TNode<Int32T> holder_instance_type,
+          TNode<IntPtrT> index, Label* next_holder, Label* if_bailout) {
         // Not supported yet.
         Use(next_holder);
         Goto(if_bailout);
@@ -1047,31 +1042,31 @@ TF_BUILTIN(GetProperty, CodeStubAssembler) {
 
 // ES6 [[Get]] operation with Receiver.
 TF_BUILTIN(GetPropertyWithReceiver, CodeStubAssembler) {
-  Node* object = Parameter(Descriptor::kObject);
-  Node* key = Parameter(Descriptor::kKey);
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> object = CAST(Parameter(Descriptor::kObject));
+  TNode<Object> key = CAST(Parameter(Descriptor::kKey));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> on_non_existent = CAST(Parameter(Descriptor::kOnNonExistent));
   Label if_notfound(this), if_proxy(this, Label::kDeferred),
       if_slow(this, Label::kDeferred);
 
-  CodeStubAssembler::LookupInHolder lookup_property_in_holder =
-      [=](Node* receiver, Node* holder, Node* holder_map,
-          Node* holder_instance_type, Node* unique_name, Label* next_holder,
-          Label* if_bailout) {
-        VARIABLE(var_value, MachineRepresentation::kTagged);
+  CodeStubAssembler::LookupPropertyInHolder lookup_property_in_holder =
+      [=](TNode<HeapObject> receiver, TNode<HeapObject> holder,
+          TNode<Map> holder_map, TNode<Int32T> holder_instance_type,
+          TNode<Name> unique_name, Label* next_holder, Label* if_bailout) {
+        TVARIABLE(Object, var_value);
         Label if_found(this);
-        TryGetOwnProperty(context, receiver, holder, holder_map,
+        TryGetOwnProperty(context, receiver, CAST(holder), holder_map,
                           holder_instance_type, unique_name, &if_found,
                           &var_value, next_holder, if_bailout);
         BIND(&if_found);
         Return(var_value.value());
       };
 
-  CodeStubAssembler::LookupInHolder lookup_element_in_holder =
-      [=](Node* receiver, Node* holder, Node* holder_map,
-          Node* holder_instance_type, Node* index, Label* next_holder,
-          Label* if_bailout) {
+  CodeStubAssembler::LookupElementInHolder lookup_element_in_holder =
+      [=](TNode<HeapObject> receiver, TNode<HeapObject> holder,
+          TNode<Map> holder_map, TNode<Int32T> holder_instance_type,
+          TNode<IntPtrT> index, Label* next_holder, Label* if_bailout) {
         // Not supported yet.
         Use(next_holder);
         Goto(if_bailout);
@@ -1138,5 +1133,33 @@ TF_BUILTIN(SetPropertyInLiteral, CodeStubAssembler) {
                                                    key, value);
 }
 
+TF_BUILTIN(InstantiateAsmJs, CodeStubAssembler) {
+  Label tailcall_to_function(this);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kNewTarget));
+  TNode<Int32T> arg_count =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
+  TNode<JSFunction> function = CAST(Parameter(Descriptor::kTarget));
+
+  // Retrieve arguments from caller (stdlib, foreign, heap).
+  CodeStubArguments args(this, arg_count);
+  TNode<Object> stdlib = args.GetOptionalArgumentValue(0);
+  TNode<Object> foreign = args.GetOptionalArgumentValue(1);
+  TNode<Object> heap = args.GetOptionalArgumentValue(2);
+
+  // Call runtime, on success just pass the result to the caller and pop all
+  // arguments. A smi 0 is returned on failure, an object on success.
+  TNode<Object> maybe_result_or_smi_zero = CallRuntime(
+      Runtime::kInstantiateAsmJs, context, function, stdlib, foreign, heap);
+  GotoIf(TaggedIsSmi(maybe_result_or_smi_zero), &tailcall_to_function);
+  args.PopAndReturn(maybe_result_or_smi_zero);
+
+  BIND(&tailcall_to_function);
+  // On failure, tail call back to regular JavaScript by re-calling the given
+  // function which has been reset to the compile lazy builtin.
+  TNode<Code> code = CAST(LoadObjectField(function, JSFunction::kCodeOffset));
+  TailCallJSCode(code, context, function, new_target, arg_count);
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-intl-gen.cc b/deps/v8/src/builtins/builtins-intl-gen.cc
index 23305537210fee..51546f98e86d17 100644
--- a/deps/v8/src/builtins/builtins-intl-gen.cc
+++ b/deps/v8/src/builtins/builtins-intl-gen.cc
@@ -40,12 +40,12 @@ class IntlBuiltinsAssembler : public CodeStubAssembler {
 };
 
 TF_BUILTIN(StringToLowerCaseIntl, IntlBuiltinsAssembler) {
-  TNode<String> const string = CAST(Parameter(Descriptor::kString));
+  const TNode<String> string = CAST(Parameter(Descriptor::kString));
 
   Label call_c(this), return_string(this), runtime(this, Label::kDeferred);
 
   // Early exit on empty strings.
-  TNode<Uint32T> const length = LoadStringLengthAsWord32(string);
+  const TNode<Uint32T> length = LoadStringLengthAsWord32(string);
   GotoIf(Word32Equal(length, Uint32Constant(0)), &return_string);
 
   // Unpack strings if possible, and bail to runtime unless we get a one-byte
@@ -54,14 +54,14 @@ TF_BUILTIN(StringToLowerCaseIntl, IntlBuiltinsAssembler) {
       state(), string, ToDirectStringAssembler::kDontUnpackSlicedStrings);
   to_direct.TryToDirect(&runtime);
 
-  TNode<Int32T> const instance_type = to_direct.instance_type();
+  const TNode<Int32T> instance_type = to_direct.instance_type();
   CSA_ASSERT(this,
              Word32BinaryNot(IsIndirectStringInstanceType(instance_type)));
   GotoIfNot(IsOneByteStringInstanceType(instance_type), &runtime);
 
   // For short strings, do the conversion in CSA through the lookup table.
 
-  TNode<String> const dst = AllocateSeqOneByteString(length);
+  const TNode<String> dst = AllocateSeqOneByteString(length);
 
   const int kMaxShortStringLength = 24;  // Determined empirically.
   GotoIf(Uint32GreaterThan(length, Uint32Constant(kMaxShortStringLength)),
@@ -71,12 +71,12 @@ TF_BUILTIN(StringToLowerCaseIntl, IntlBuiltinsAssembler) {
     const TNode<IntPtrT> dst_ptr = PointerToSeqStringData(dst);
     TVARIABLE(IntPtrT, var_cursor, IntPtrConstant(0));
 
-    TNode<IntPtrT> const start_address =
+    const TNode<IntPtrT> start_address =
         ReinterpretCast<IntPtrT>(to_direct.PointerToData(&call_c));
-    TNode<IntPtrT> const end_address =
+    const TNode<IntPtrT> end_address =
         Signed(IntPtrAdd(start_address, ChangeUint32ToWord(length)));
 
-    TNode<ExternalReference> const to_lower_table_addr =
+    const TNode<ExternalReference> to_lower_table_addr =
         ExternalConstant(ExternalReference::intl_to_latin1_lower_table());
 
     TVARIABLE(Word32T, var_did_change, Int32Constant(0));
@@ -110,9 +110,9 @@ TF_BUILTIN(StringToLowerCaseIntl, IntlBuiltinsAssembler) {
   // String ConvertOneByteToLower(String src, String dst);
   BIND(&call_c);
   {
-    TNode<String> const src = to_direct.string();
+    const TNode<String> src = to_direct.string();
 
-    TNode<ExternalReference> const function_addr =
+    const TNode<ExternalReference> function_addr =
         ExternalConstant(ExternalReference::intl_convert_one_byte_to_lower());
 
     MachineType type_tagged = MachineType::AnyTagged();
@@ -129,7 +129,7 @@ TF_BUILTIN(StringToLowerCaseIntl, IntlBuiltinsAssembler) {
 
   BIND(&runtime);
   {
-    TNode<Object> const result = CallRuntime(Runtime::kStringToLowerCaseIntl,
+    const TNode<Object> result = CallRuntime(Runtime::kStringToLowerCaseIntl,
                                              NoContextConstant(), string);
     Return(result);
   }
@@ -178,7 +178,7 @@ TNode<JSArray> IntlBuiltinsAssembler::AllocateEmptyJSArray(
   return CodeStubAssembler::AllocateJSArray(
       PACKED_ELEMENTS,
       LoadJSArrayElementsMap(PACKED_ELEMENTS, LoadNativeContext(context)),
-      SmiConstant(0), SmiConstant(0));
+      IntPtrConstant(0), SmiConstant(0));
 }
 
 TF_BUILTIN(ListFormatPrototypeFormat, IntlBuiltinsAssembler) {
diff --git a/deps/v8/src/builtins/builtins-intl.cc b/deps/v8/src/builtins/builtins-intl.cc
index 81954a481f0a44..afa7ef2d30b421 100644
--- a/deps/v8/src/builtins/builtins-intl.cc
+++ b/deps/v8/src/builtins/builtins-intl.cc
@@ -20,6 +20,7 @@
 #include "src/objects/js-break-iterator-inl.h"
 #include "src/objects/js-collator-inl.h"
 #include "src/objects/js-date-time-format-inl.h"
+#include "src/objects/js-display-names-inl.h"
 #include "src/objects/js-list-format-inl.h"
 #include "src/objects/js-locale-inl.h"
 #include "src/objects/js-number-format-inl.h"
@@ -387,6 +388,45 @@ Object CallOrConstructConstructor(BuiltinArguments args, Isolate* isolate,
 }
 }  // namespace
 
+// Intl.DisplayNames
+
+BUILTIN(DisplayNamesConstructor) {
+  HandleScope scope(isolate);
+
+  return DisallowCallConstructor<JSDisplayNames>(
+      args, isolate, v8::Isolate::UseCounterFeature::kDisplayNames,
+      "Intl.DisplayNames");
+}
+
+BUILTIN(DisplayNamesPrototypeResolvedOptions) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSDisplayNames, holder,
+                 "Intl.DisplayNames.prototype.resolvedOptions");
+  return *JSDisplayNames::ResolvedOptions(isolate, holder);
+}
+
+BUILTIN(DisplayNamesSupportedLocalesOf) {
+  HandleScope scope(isolate);
+  Handle<Object> locales = args.atOrUndefined(isolate, 1);
+  Handle<Object> options = args.atOrUndefined(isolate, 2);
+
+  RETURN_RESULT_OR_FAILURE(
+      isolate, Intl::SupportedLocalesOf(
+                   isolate, "Intl.DisplayNames.supportedLocalesOf",
+                   JSDisplayNames::GetAvailableLocales(), locales, options));
+}
+
+BUILTIN(DisplayNamesPrototypeOf) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSDisplayNames, holder, "Intl.DisplayNames.prototype.of");
+  Handle<Object> code_obj = args.atOrUndefined(isolate, 1);
+
+  RETURN_RESULT_OR_FAILURE(isolate,
+                           JSDisplayNames::Of(isolate, holder, code_obj));
+}
+
+// Intl.NumberFormat
+
 BUILTIN(NumberFormatConstructor) {
   HandleScope scope(isolate);
 
diff --git a/deps/v8/src/builtins/builtins-iterator-gen.cc b/deps/v8/src/builtins/builtins-iterator-gen.cc
index 2f8761902b5553..e9dca2dbc3bc96 100644
--- a/deps/v8/src/builtins/builtins-iterator-gen.cc
+++ b/deps/v8/src/builtins/builtins-iterator-gen.cc
@@ -18,29 +18,26 @@ namespace internal {
 using IteratorRecord = TorqueStructIteratorRecord;
 using compiler::Node;
 
-TNode<Object> IteratorBuiltinsAssembler::GetIteratorMethod(Node* context,
-                                                           Node* object) {
+TNode<Object> IteratorBuiltinsAssembler::GetIteratorMethod(
+    TNode<Context> context, TNode<Object> object) {
   return GetProperty(context, object, factory()->iterator_symbol());
 }
 
-IteratorRecord IteratorBuiltinsAssembler::GetIterator(Node* context,
-                                                      Node* object,
-                                                      Label* if_exception,
-                                                      Variable* exception) {
+IteratorRecord IteratorBuiltinsAssembler::GetIterator(
+    SloppyTNode<Context> context, SloppyTNode<Object> object,
+    Label* if_exception, TVariable<Object>* exception) {
   TNode<Object> method = GetIteratorMethod(context, object);
   return GetIterator(context, object, method, if_exception, exception);
 }
 
-IteratorRecord IteratorBuiltinsAssembler::GetIterator(Node* context,
-                                                      Node* object,
-                                                      Node* method,
-                                                      Label* if_exception,
-                                                      Variable* exception) {
+IteratorRecord IteratorBuiltinsAssembler::GetIterator(
+    TNode<Context> context, TNode<Object> object, TNode<Object> method,
+    Label* if_exception, TVariable<Object>* exception) {
   GotoIfException(method, if_exception, exception);
 
   Label if_not_callable(this, Label::kDeferred), if_callable(this);
   GotoIf(TaggedIsSmi(method), &if_not_callable);
-  Branch(IsCallable(method), &if_callable, &if_not_callable);
+  Branch(IsCallable(CAST(method)), &if_callable, &if_not_callable);
 
   BIND(&if_not_callable);
   {
@@ -53,12 +50,12 @@ IteratorRecord IteratorBuiltinsAssembler::GetIterator(Node* context,
   BIND(&if_callable);
   {
     Callable callable = CodeFactory::Call(isolate());
-    Node* iterator = CallJS(callable, context, method, object);
+    TNode<Object> iterator = CallJS(callable, context, method, object);
     GotoIfException(iterator, if_exception, exception);
 
     Label get_next(this), if_notobject(this, Label::kDeferred);
     GotoIf(TaggedIsSmi(iterator), &if_notobject);
-    Branch(IsJSReceiver(iterator), &get_next, &if_notobject);
+    Branch(IsJSReceiver(CAST(iterator)), &get_next, &if_notobject);
 
     BIND(&if_notobject);
     {
@@ -69,7 +66,7 @@ IteratorRecord IteratorBuiltinsAssembler::GetIterator(Node* context,
     }
 
     BIND(&get_next);
-    TNode<Object> const next =
+    const TNode<Object> next =
         GetProperty(context, iterator, factory()->next_string());
     GotoIfException(next, if_exception, exception);
 
@@ -81,17 +78,19 @@ IteratorRecord IteratorBuiltinsAssembler::GetIterator(Node* context,
 TNode<JSReceiver> IteratorBuiltinsAssembler::IteratorStep(
     TNode<Context> context, const IteratorRecord& iterator, Label* if_done,
     base::Optional<TNode<Map>> fast_iterator_result_map, Label* if_exception,
-    Variable* exception) {
+    TVariable<Object>* exception) {
   DCHECK_NOT_NULL(if_done);
   // 1. a. Let result be ? Invoke(iterator, "next", « »).
   Callable callable = CodeFactory::Call(isolate());
-  Node* result = CallJS(callable, context, iterator.next, iterator.object);
+  TNode<Object> result =
+      CallJS(callable, context, iterator.next, iterator.object);
   GotoIfException(result, if_exception, exception);
 
   // 3. If Type(result) is not Object, throw a TypeError exception.
   Label if_notobject(this, Label::kDeferred), return_result(this);
   GotoIf(TaggedIsSmi(result), &if_notobject);
-  TNode<Map> result_map = LoadMap(result);
+  TNode<HeapObject> heap_object_result = CAST(result);
+  TNode<Map> result_map = LoadMap(heap_object_result);
 
   if (fast_iterator_result_map) {
     // Fast iterator result case:
@@ -102,7 +101,8 @@ TNode<JSReceiver> IteratorBuiltinsAssembler::IteratorStep(
 
     // IteratorComplete
     // 2. Return ToBoolean(? Get(iterResult, "done")).
-    TNode<Object> done = LoadObjectField(result, JSIteratorResult::kDoneOffset);
+    TNode<Object> done =
+        LoadObjectField(heap_object_result, JSIteratorResult::kDoneOffset);
     BranchIfToBooleanIsTrue(done, if_done, &return_result);
 
     BIND(&if_generic);
@@ -115,7 +115,8 @@ TNode<JSReceiver> IteratorBuiltinsAssembler::IteratorStep(
 
     // IteratorComplete
     // 2. Return ToBoolean(? Get(iterResult, "done")).
-    TNode<Object> done = GetProperty(context, result, factory()->done_string());
+    TNode<Object> done =
+        GetProperty(context, heap_object_result, factory()->done_string());
     GotoIfException(done, if_exception, exception);
     BranchIfToBooleanIsTrue(done, if_done, &return_result);
   }
@@ -129,13 +130,13 @@ TNode<JSReceiver> IteratorBuiltinsAssembler::IteratorStep(
   }
 
   BIND(&return_result);
-  return CAST(result);
+  return CAST(heap_object_result);
 }
 
 TNode<Object> IteratorBuiltinsAssembler::IteratorValue(
     TNode<Context> context, TNode<JSReceiver> result,
     base::Optional<TNode<Map>> fast_iterator_result_map, Label* if_exception,
-    Variable* exception) {
+    TVariable<Object>* exception) {
   Label exit(this);
   TVARIABLE(Object, var_value);
   if (fast_iterator_result_map) {
@@ -163,8 +164,8 @@ TNode<Object> IteratorBuiltinsAssembler::IteratorValue(
 }
 
 void IteratorBuiltinsAssembler::IteratorCloseOnException(
-    Node* context, const IteratorRecord& iterator, Label* if_exception,
-    Variable* exception) {
+    TNode<Context> context, const IteratorRecord& iterator, Label* if_exception,
+    TVariable<Object>* exception) {
   // Perform ES #sec-iteratorclose when an exception occurs. This simpler
   // algorithm does not include redundant steps which are never reachable from
   // the spec IteratorClose algorithm.
@@ -183,7 +184,7 @@ void IteratorBuiltinsAssembler::IteratorCloseOnException(
   {
     // Let innerResult be Call(return, iterator, « »).
     // If an exception occurs, the original exception remains bound
-    Node* inner_result =
+    TNode<Object> inner_result =
         CallJS(CodeFactory::Call(isolate()), context, method, iterator.object);
     GotoIfException(inner_result, if_exception, nullptr);
 
@@ -193,7 +194,8 @@ void IteratorBuiltinsAssembler::IteratorCloseOnException(
 }
 
 void IteratorBuiltinsAssembler::IteratorCloseOnException(
-    Node* context, const IteratorRecord& iterator, TNode<Object> exception) {
+    TNode<Context> context, const IteratorRecord& iterator,
+    TNode<Object> exception) {
   Label rethrow(this, Label::kDeferred);
   TVARIABLE(Object, exception_variable, exception);
   IteratorCloseOnException(context, iterator, &rethrow, &exception_variable);
@@ -211,9 +213,9 @@ TNode<JSArray> IteratorBuiltinsAssembler::IterableToList(
   // 2. Let values be a new empty List.
   GrowableFixedArray values(state());
 
-  Variable* vars[] = {values.var_array(), values.var_length(),
-                      values.var_capacity()};
-  Label loop_start(this, 3, vars), done(this);
+  Label loop_start(
+      this, {values.var_array(), values.var_length(), values.var_capacity()}),
+      done(this);
   Goto(&loop_start);
   // 3. Let next be true.
   // 4. Repeat, while next is not false
@@ -252,9 +254,9 @@ TF_BUILTIN(IterableToFixedArrayForWasm, IteratorBuiltinsAssembler) {
 
   GrowableFixedArray values(state());
 
-  Variable* vars[] = {values.var_array(), values.var_length(),
-                      values.var_capacity()};
-  Label loop_start(this, 3, vars), compare_length(this), done(this);
+  Label loop_start(
+      this, {values.var_array(), values.var_length(), values.var_capacity()}),
+      compare_length(this), done(this);
   Goto(&loop_start);
   BIND(&loop_start);
   {
@@ -289,8 +291,8 @@ TNode<JSArray> IteratorBuiltinsAssembler::StringListFromIterable(
 
   // 3. Let list be a new empty List.
 
-  Variable* vars[] = {list.var_array(), list.var_length(), list.var_capacity()};
-  Label loop_start(this, 3, vars);
+  Label loop_start(this,
+                   {list.var_array(), list.var_length(), list.var_capacity()});
   Goto(&loop_start);
   // 4. Let next be true.
   // 5. Repeat, while next is not false
@@ -366,7 +368,7 @@ TF_BUILTIN(IterableToListMayPreserveHoles, IteratorBuiltinsAssembler) {
 
 void IteratorBuiltinsAssembler::FastIterableToList(
     TNode<Context> context, TNode<Object> iterable,
-    TVariable<Object>* var_result, Label* slow) {
+    TVariable<JSArray>* var_result, Label* slow) {
   Label done(this), check_string(this), check_map(this), check_set(this);
 
   GotoIfNot(
@@ -375,8 +377,8 @@ void IteratorBuiltinsAssembler::FastIterableToList(
       &check_string);
 
   // Fast path for fast JSArray.
-  *var_result =
-      CallBuiltin(Builtins::kCloneFastJSArrayFillingHoles, context, iterable);
+  *var_result = CAST(
+      CallBuiltin(Builtins::kCloneFastJSArrayFillingHoles, context, iterable));
   Goto(&done);
 
   BIND(&check_string);
@@ -387,12 +389,12 @@ void IteratorBuiltinsAssembler::FastIterableToList(
         iterable, context, &string_maybe_fast_call, &check_map);
 
     BIND(&string_maybe_fast_call);
-    TNode<IntPtrT> const length = LoadStringLengthAsWord(CAST(iterable));
+    const TNode<IntPtrT> length = LoadStringLengthAsWord(CAST(iterable));
     // Use string length as conservative approximation of number of codepoints.
     GotoIf(
         IntPtrGreaterThan(length, IntPtrConstant(JSArray::kMaxFastArrayLength)),
         slow);
-    *var_result = CallBuiltin(Builtins::kStringToList, context, iterable);
+    *var_result = CAST(CallBuiltin(Builtins::kStringToList, context, iterable));
     Goto(&done);
   }
 
@@ -403,7 +405,8 @@ void IteratorBuiltinsAssembler::FastIterableToList(
         state(), iterable, context, &map_fast_call, &check_set);
 
     BIND(&map_fast_call);
-    *var_result = CallBuiltin(Builtins::kMapIteratorToList, context, iterable);
+    *var_result =
+        CAST(CallBuiltin(Builtins::kMapIteratorToList, context, iterable));
     Goto(&done);
   }
 
@@ -415,13 +418,20 @@ void IteratorBuiltinsAssembler::FastIterableToList(
 
     BIND(&set_fast_call);
     *var_result =
-        CallBuiltin(Builtins::kSetOrSetIteratorToList, context, iterable);
+        CAST(CallBuiltin(Builtins::kSetOrSetIteratorToList, context, iterable));
     Goto(&done);
   }
 
   BIND(&done);
 }
 
+TNode<JSArray> IteratorBuiltinsAssembler::FastIterableToList(
+    TNode<Context> context, TNode<Object> iterable, Label* slow) {
+  TVARIABLE(JSArray, var_fast_result);
+  FastIterableToList(context, iterable, &var_fast_result, slow);
+  return var_fast_result.value();
+}
+
 // This builtin loads the property Symbol.iterator as the iterator, and has fast
 // paths for fast arrays, for primitive strings, for sets and set iterators, and
 // for map iterators. These fast paths will only be taken if Symbol.iterator and
@@ -441,7 +451,7 @@ TF_BUILTIN(IterableToListWithSymbolLookup, IteratorBuiltinsAssembler) {
 
   GotoIfForceSlowPath(&slow_path);
 
-  TVARIABLE(Object, var_result);
+  TVARIABLE(JSArray, var_result);
   FastIterableToList(context, iterable, &var_result, &slow_path);
   Return(var_result.value());
 
diff --git a/deps/v8/src/builtins/builtins-iterator-gen.h b/deps/v8/src/builtins/builtins-iterator-gen.h
index 7d6e7d5b811c1a..61665d28255bdd 100644
--- a/deps/v8/src/builtins/builtins-iterator-gen.h
+++ b/deps/v8/src/builtins/builtins-iterator-gen.h
@@ -20,16 +20,18 @@ class IteratorBuiltinsAssembler : public CodeStubAssembler {
   using IteratorRecord = TorqueStructIteratorRecord;
 
   // Returns object[Symbol.iterator].
-  TNode<Object> GetIteratorMethod(Node* context, Node* object);
+  TNode<Object> GetIteratorMethod(TNode<Context> context, TNode<Object>);
 
   // https://tc39.github.io/ecma262/#sec-getiterator --- never used for
   // @@asyncIterator.
-  IteratorRecord GetIterator(Node* context, Node* object,
+  IteratorRecord GetIterator(SloppyTNode<Context> context,
+                             SloppyTNode<Object> object,
                              Label* if_exception = nullptr,
-                             Variable* exception = nullptr);
-  IteratorRecord GetIterator(Node* context, Node* object, Node* method,
+                             TVariable<Object>* exception = nullptr);
+  IteratorRecord GetIterator(TNode<Context> context, TNode<Object> object,
+                             TNode<Object> method,
                              Label* if_exception = nullptr,
-                             Variable* exception = nullptr);
+                             TVariable<Object>* exception = nullptr);
 
   // https://tc39.github.io/ecma262/#sec-iteratorstep
   // If the iterator is done, goto {if_done}, otherwise returns an iterator
@@ -39,7 +41,7 @@ class IteratorBuiltinsAssembler : public CodeStubAssembler {
   TNode<JSReceiver> IteratorStep(
       TNode<Context> context, const IteratorRecord& iterator, Label* if_done,
       base::Optional<TNode<Map>> fast_iterator_result_map = base::nullopt,
-      Label* if_exception = nullptr, Variable* exception = nullptr);
+      Label* if_exception = nullptr, TVariable<Object>* exception = nullptr);
 
   TNode<JSReceiver> IteratorStep(
       TNode<Context> context, const IteratorRecord& iterator,
@@ -54,12 +56,15 @@ class IteratorBuiltinsAssembler : public CodeStubAssembler {
   TNode<Object> IteratorValue(
       TNode<Context> context, TNode<JSReceiver> result,
       base::Optional<TNode<Map>> fast_iterator_result_map = base::nullopt,
-      Label* if_exception = nullptr, Variable* exception = nullptr);
+      Label* if_exception = nullptr, TVariable<Object>* exception = nullptr);
 
   // https://tc39.github.io/ecma262/#sec-iteratorclose
-  void IteratorCloseOnException(Node* context, const IteratorRecord& iterator,
-                                Label* if_exception, Variable* exception);
-  void IteratorCloseOnException(Node* context, const IteratorRecord& iterator,
+  void IteratorCloseOnException(TNode<Context> context,
+                                const IteratorRecord& iterator,
+                                Label* if_exception,
+                                TVariable<Object>* exception);
+  void IteratorCloseOnException(TNode<Context> context,
+                                const IteratorRecord& iterator,
                                 TNode<Object> exception);
 
   // #sec-iterabletolist
@@ -74,7 +79,9 @@ class IteratorBuiltinsAssembler : public CodeStubAssembler {
                                         TNode<Object> iterable);
 
   void FastIterableToList(TNode<Context> context, TNode<Object> iterable,
-                          TVariable<Object>* var_result, Label* slow);
+                          TVariable<JSArray>* var_result, Label* slow);
+  TNode<JSArray> FastIterableToList(TNode<Context> context,
+                                    TNode<Object> iterable, Label* slow);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-math-gen.cc b/deps/v8/src/builtins/builtins-math-gen.cc
deleted file mode 100644
index 3bae7c06c35b46..00000000000000
--- a/deps/v8/src/builtins/builtins-math-gen.cc
+++ /dev/null
@@ -1,276 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/builtins/builtins-math-gen.h"
-
-#include "src/builtins/builtins-utils-gen.h"
-#include "src/builtins/builtins.h"
-#include "src/codegen/code-factory.h"
-#include "src/codegen/code-stub-assembler.h"
-#include "src/objects/fixed-array.h"
-
-namespace v8 {
-namespace internal {
-
-// -----------------------------------------------------------------------------
-// ES6 section 20.2.2 Function Properties of the Math Object
-
-// ES6 #sec-math.abs
-TF_BUILTIN(MathAbs, CodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-
-  // We might need to loop once for ToNumber conversion.
-  VARIABLE(var_x, MachineRepresentation::kTagged);
-  Label loop(this, &var_x);
-  var_x.Bind(Parameter(Descriptor::kX));
-  Goto(&loop);
-  BIND(&loop);
-  {
-    // Load the current {x} value.
-    Node* x = var_x.value();
-
-    // Check if {x} is a Smi or a HeapObject.
-    Label if_xissmi(this), if_xisnotsmi(this);
-    Branch(TaggedIsSmi(x), &if_xissmi, &if_xisnotsmi);
-
-    BIND(&if_xissmi);
-    {
-      Label if_overflow(this, Label::kDeferred);
-
-      // check if support abs function
-      if (IsIntPtrAbsWithOverflowSupported()) {
-        TNode<PairT<IntPtrT, BoolT>> pair = IntPtrAbsWithOverflow(x);
-        Node* overflow = Projection(1, pair);
-        GotoIf(overflow, &if_overflow);
-
-        // There is a Smi representation for negated {x}.
-        Node* result = Projection(0, pair);
-        Return(BitcastWordToTagged(result));
-
-      } else {
-        // Check if {x} is already positive.
-        Label if_xispositive(this), if_xisnotpositive(this);
-        BranchIfSmiLessThanOrEqual(SmiConstant(0), CAST(x), &if_xispositive,
-                                   &if_xisnotpositive);
-
-        BIND(&if_xispositive);
-        {
-          // Just return the input {x}.
-          Return(x);
-        }
-
-        BIND(&if_xisnotpositive);
-        {
-          // Try to negate the {x} value.
-          TNode<Smi> result = TrySmiSub(SmiConstant(0), CAST(x), &if_overflow);
-          Return(result);
-        }
-      }
-
-      BIND(&if_overflow);
-      { Return(NumberConstant(0.0 - Smi::kMinValue)); }
-    }
-
-    BIND(&if_xisnotsmi);
-    {
-      // Check if {x} is a HeapNumber.
-      Label if_xisheapnumber(this), if_xisnotheapnumber(this, Label::kDeferred);
-      Branch(IsHeapNumber(x), &if_xisheapnumber, &if_xisnotheapnumber);
-
-      BIND(&if_xisheapnumber);
-      {
-        TNode<Float64T> x_value = LoadHeapNumberValue(x);
-        TNode<Float64T> value = Float64Abs(x_value);
-        TNode<HeapNumber> result = AllocateHeapNumberWithValue(value);
-        Return(result);
-      }
-
-      BIND(&if_xisnotheapnumber);
-      {
-        // Need to convert {x} to a Number first.
-        var_x.Bind(CallBuiltin(Builtins::kNonNumberToNumber, context, x));
-        Goto(&loop);
-      }
-    }
-  }
-}
-
-void MathBuiltinsAssembler::MathRoundingOperation(
-    Node* context, Node* x,
-    TNode<Float64T> (CodeStubAssembler::*float64op)(SloppyTNode<Float64T>)) {
-  // We might need to loop once for ToNumber conversion.
-  VARIABLE(var_x, MachineRepresentation::kTagged, x);
-  Label loop(this, &var_x);
-  Goto(&loop);
-  BIND(&loop);
-  {
-    // Load the current {x} value.
-    Node* x = var_x.value();
-
-    // Check if {x} is a Smi or a HeapObject.
-    Label if_xissmi(this), if_xisnotsmi(this);
-    Branch(TaggedIsSmi(x), &if_xissmi, &if_xisnotsmi);
-
-    BIND(&if_xissmi);
-    {
-      // Nothing to do when {x} is a Smi.
-      Return(x);
-    }
-
-    BIND(&if_xisnotsmi);
-    {
-      // Check if {x} is a HeapNumber.
-      Label if_xisheapnumber(this), if_xisnotheapnumber(this, Label::kDeferred);
-      Branch(IsHeapNumber(x), &if_xisheapnumber, &if_xisnotheapnumber);
-
-      BIND(&if_xisheapnumber);
-      {
-        TNode<Float64T> x_value = LoadHeapNumberValue(x);
-        TNode<Float64T> value = (this->*float64op)(x_value);
-        TNode<Number> result = ChangeFloat64ToTagged(value);
-        Return(result);
-      }
-
-      BIND(&if_xisnotheapnumber);
-      {
-        // Need to convert {x} to a Number first.
-        var_x.Bind(CallBuiltin(Builtins::kNonNumberToNumber, context, x));
-        Goto(&loop);
-      }
-    }
-  }
-}
-
-void MathBuiltinsAssembler::MathMaxMin(
-    TNode<Context> context, TNode<Int32T> argc,
-    TNode<Float64T> (CodeStubAssembler::*float64op)(SloppyTNode<Float64T>,
-                                                    SloppyTNode<Float64T>),
-    double default_val) {
-  CodeStubArguments arguments(this, argc);
-
-  TVARIABLE(Float64T, result, Float64Constant(default_val));
-
-  CodeStubAssembler::VariableList vars({&result}, zone());
-  arguments.ForEach(vars, [&](TNode<Object> arg) {
-    TNode<Float64T> float_value = TruncateTaggedToFloat64(context, arg);
-    result = (this->*float64op)(result.value(), float_value);
-  });
-
-  arguments.PopAndReturn(ChangeFloat64ToTagged(result.value()));
-}
-
-// ES6 #sec-math.ceil
-TF_BUILTIN(MathCeil, MathBuiltinsAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* x = Parameter(Descriptor::kX);
-  MathRoundingOperation(context, x, &CodeStubAssembler::Float64Ceil);
-}
-
-// ES6 #sec-math.floor
-TF_BUILTIN(MathFloor, MathBuiltinsAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* x = Parameter(Descriptor::kX);
-  MathRoundingOperation(context, x, &CodeStubAssembler::Float64Floor);
-}
-
-// ES6 #sec-math.imul
-TF_BUILTIN(MathImul, CodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* x = Parameter(Descriptor::kX);
-  Node* y = Parameter(Descriptor::kY);
-  TNode<Word32T> x_value = TruncateTaggedToWord32(context, x);
-  TNode<Word32T> y_value = TruncateTaggedToWord32(context, y);
-  TNode<Int32T> value = Signed(Int32Mul(x_value, y_value));
-  TNode<Number> result = ChangeInt32ToTagged(value);
-  Return(result);
-}
-
-CodeStubAssembler::Node* MathBuiltinsAssembler::MathPow(Node* context,
-                                                        Node* base,
-                                                        Node* exponent) {
-  TNode<Float64T> base_value = TruncateTaggedToFloat64(context, base);
-  TNode<Float64T> exponent_value = TruncateTaggedToFloat64(context, exponent);
-  TNode<Float64T> value = Float64Pow(base_value, exponent_value);
-  return ChangeFloat64ToTagged(value);
-}
-
-// ES6 #sec-math.pow
-TF_BUILTIN(MathPow, MathBuiltinsAssembler) {
-  Return(MathPow(Parameter(Descriptor::kContext), Parameter(Descriptor::kBase),
-                 Parameter(Descriptor::kExponent)));
-}
-
-// ES6 #sec-math.random
-TF_BUILTIN(MathRandom, CodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  TNode<NativeContext> native_context = LoadNativeContext(context);
-
-  // Load cache index.
-  TVARIABLE(Smi, smi_index);
-  smi_index = CAST(
-      LoadContextElement(native_context, Context::MATH_RANDOM_INDEX_INDEX));
-
-  // Cached random numbers are exhausted if index is 0. Go to slow path.
-  Label if_cached(this);
-  GotoIf(SmiAbove(smi_index.value(), SmiConstant(0)), &if_cached);
-
-  // Cache exhausted, populate the cache. Return value is the new index.
-  TNode<ExternalReference> const refill_math_random =
-      ExternalConstant(ExternalReference::refill_math_random());
-  TNode<ExternalReference> const isolate_ptr =
-      ExternalConstant(ExternalReference::isolate_address(isolate()));
-  MachineType type_tagged = MachineType::AnyTagged();
-  MachineType type_ptr = MachineType::Pointer();
-
-  smi_index = CAST(CallCFunction(refill_math_random, type_tagged,
-                                 std::make_pair(type_ptr, isolate_ptr),
-                                 std::make_pair(type_tagged, native_context)));
-  Goto(&if_cached);
-
-  // Compute next index by decrement.
-  BIND(&if_cached);
-  TNode<Smi> new_smi_index = SmiSub(smi_index.value(), SmiConstant(1));
-  StoreContextElement(native_context, Context::MATH_RANDOM_INDEX_INDEX,
-                      new_smi_index);
-
-  // Load and return next cached random number.
-  TNode<FixedDoubleArray> array = CAST(
-      LoadContextElement(native_context, Context::MATH_RANDOM_CACHE_INDEX));
-  TNode<Float64T> random = LoadFixedDoubleArrayElement(
-      array, new_smi_index, MachineType::Float64(), 0, SMI_PARAMETERS);
-  Return(AllocateHeapNumberWithValue(random));
-}
-
-// ES6 #sec-math.round
-TF_BUILTIN(MathRound, MathBuiltinsAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* x = Parameter(Descriptor::kX);
-  MathRoundingOperation(context, x, &CodeStubAssembler::Float64Round);
-}
-
-// ES6 #sec-math.trunc
-TF_BUILTIN(MathTrunc, MathBuiltinsAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* x = Parameter(Descriptor::kX);
-  MathRoundingOperation(context, x, &CodeStubAssembler::Float64Trunc);
-}
-
-// ES6 #sec-math.max
-TF_BUILTIN(MathMax, MathBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Int32T> argc =
-      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
-  MathMaxMin(context, argc, &CodeStubAssembler::Float64Max, -1.0 * V8_INFINITY);
-}
-
-// ES6 #sec-math.min
-TF_BUILTIN(MathMin, MathBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Int32T> argc =
-      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
-  MathMaxMin(context, argc, &CodeStubAssembler::Float64Min, V8_INFINITY);
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-math-gen.h b/deps/v8/src/builtins/builtins-math-gen.h
deleted file mode 100644
index 4de654fa201609..00000000000000
--- a/deps/v8/src/builtins/builtins-math-gen.h
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_BUILTINS_BUILTINS_MATH_GEN_H_
-#define V8_BUILTINS_BUILTINS_MATH_GEN_H_
-
-#include "src/codegen/code-stub-assembler.h"
-
-namespace v8 {
-namespace internal {
-
-class MathBuiltinsAssembler : public CodeStubAssembler {
- public:
-  explicit MathBuiltinsAssembler(compiler::CodeAssemblerState* state)
-      : CodeStubAssembler(state) {}
-
-  Node* MathPow(Node* context, Node* base, Node* exponent);
-
- protected:
-  void MathRoundingOperation(
-      Node* context, Node* x,
-      TNode<Float64T> (CodeStubAssembler::*float64op)(SloppyTNode<Float64T>));
-  void MathMaxMin(TNode<Context> context, TNode<Int32T> argc,
-                  TNode<Float64T> (CodeStubAssembler::*float64op)(
-                      SloppyTNode<Float64T>, SloppyTNode<Float64T>),
-                  double default_val);
-};
-
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_BUILTINS_BUILTINS_MATH_GEN_H_
diff --git a/deps/v8/src/builtins/builtins-microtask-queue-gen.cc b/deps/v8/src/builtins/builtins-microtask-queue-gen.cc
index 62aee3b300b371..630d65e72c33a7 100644
--- a/deps/v8/src/builtins/builtins-microtask-queue-gen.cc
+++ b/deps/v8/src/builtins/builtins-microtask-queue-gen.cc
@@ -147,7 +147,7 @@ void MicrotaskQueueBuiltinsAssembler::RunSingleMicrotask(
 
     TNode<JSReceiver> callable =
         LoadObjectField<JSReceiver>(microtask, CallableTask::kCallableOffset);
-    Node* const result = CallJS(
+    const TNode<Object> result = CallJS(
         CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
         microtask_context, callable, UndefinedConstant());
     GotoIfException(result, &if_exception, &var_exception);
@@ -158,9 +158,9 @@ void MicrotaskQueueBuiltinsAssembler::RunSingleMicrotask(
 
   BIND(&is_callback);
   {
-    TNode<Object> const microtask_callback =
+    const TNode<Object> microtask_callback =
         LoadObjectField(microtask, CallbackTask::kCallbackOffset);
-    TNode<Object> const microtask_data =
+    const TNode<Object> microtask_data =
         LoadObjectField(microtask, CallbackTask::kDataOffset);
 
     // If this turns out to become a bottleneck because of the calls
@@ -173,7 +173,7 @@ void MicrotaskQueueBuiltinsAssembler::RunSingleMicrotask(
     // But from our current measurements it doesn't seem to be a
     // serious performance problem, even if the microtask is full
     // of CallHandlerTasks (which is not a realistic use case anyways).
-    TNode<Object> const result =
+    const TNode<Object> result =
         CallRuntime(Runtime::kRunMicrotaskCallback, current_context,
                     microtask_callback, microtask_data);
     GotoIfException(result, &if_exception, &var_exception);
@@ -188,14 +188,14 @@ void MicrotaskQueueBuiltinsAssembler::RunSingleMicrotask(
     TNode<NativeContext> native_context = LoadNativeContext(microtask_context);
     PrepareForContext(native_context, &done);
 
-    TNode<Object> const promise_to_resolve = LoadObjectField(
+    const TNode<Object> promise_to_resolve = LoadObjectField(
         microtask, PromiseResolveThenableJobTask::kPromiseToResolveOffset);
-    TNode<Object> const then =
+    const TNode<Object> then =
         LoadObjectField(microtask, PromiseResolveThenableJobTask::kThenOffset);
-    TNode<Object> const thenable = LoadObjectField(
+    const TNode<Object> thenable = LoadObjectField(
         microtask, PromiseResolveThenableJobTask::kThenableOffset);
 
-    TNode<Object> const result =
+    const TNode<Object> result =
         CallBuiltin(Builtins::kPromiseResolveThenableJob, native_context,
                     promise_to_resolve, thenable, then);
     GotoIfException(result, &if_exception, &var_exception);
@@ -212,18 +212,18 @@ void MicrotaskQueueBuiltinsAssembler::RunSingleMicrotask(
     TNode<NativeContext> native_context = LoadNativeContext(microtask_context);
     PrepareForContext(native_context, &done);
 
-    TNode<Object> const argument =
+    const TNode<Object> argument =
         LoadObjectField(microtask, PromiseReactionJobTask::kArgumentOffset);
-    TNode<Object> const handler =
+    const TNode<Object> handler =
         LoadObjectField(microtask, PromiseReactionJobTask::kHandlerOffset);
-    TNode<HeapObject> const promise_or_capability = CAST(LoadObjectField(
+    const TNode<HeapObject> promise_or_capability = CAST(LoadObjectField(
         microtask, PromiseReactionJobTask::kPromiseOrCapabilityOffset));
 
     // Run the promise before/debug hook if enabled.
     RunPromiseHook(Runtime::kPromiseHookBefore, microtask_context,
                    promise_or_capability);
 
-    TNode<Object> const result =
+    const TNode<Object> result =
         CallBuiltin(Builtins::kPromiseFulfillReactionJob, microtask_context,
                     argument, handler, promise_or_capability);
     GotoIfException(result, &if_exception, &var_exception);
@@ -245,18 +245,18 @@ void MicrotaskQueueBuiltinsAssembler::RunSingleMicrotask(
     TNode<NativeContext> native_context = LoadNativeContext(microtask_context);
     PrepareForContext(native_context, &done);
 
-    TNode<Object> const argument =
+    const TNode<Object> argument =
         LoadObjectField(microtask, PromiseReactionJobTask::kArgumentOffset);
-    TNode<Object> const handler =
+    const TNode<Object> handler =
         LoadObjectField(microtask, PromiseReactionJobTask::kHandlerOffset);
-    TNode<HeapObject> const promise_or_capability = CAST(LoadObjectField(
+    const TNode<HeapObject> promise_or_capability = CAST(LoadObjectField(
         microtask, PromiseReactionJobTask::kPromiseOrCapabilityOffset));
 
     // Run the promise before/debug hook if enabled.
     RunPromiseHook(Runtime::kPromiseHookBefore, microtask_context,
                    promise_or_capability);
 
-    TNode<Object> const result =
+    const TNode<Object> result =
         CallBuiltin(Builtins::kPromiseRejectReactionJob, microtask_context,
                     argument, handler, promise_or_capability);
     GotoIfException(result, &if_exception, &var_exception);
@@ -395,9 +395,11 @@ void MicrotaskQueueBuiltinsAssembler::RewindEnteredContext(
                      ContextStack::kSizeOffset);
 
 #ifdef ENABLE_VERIFY_CSA
-  TNode<IntPtrT> size = Load<IntPtrT>(hsi, size_offset);
-  CSA_ASSERT(this, IntPtrLessThan(IntPtrConstant(0), size));
-  CSA_ASSERT(this, IntPtrLessThanOrEqual(saved_entered_context_count, size));
+  {
+    TNode<IntPtrT> size = Load<IntPtrT>(hsi, size_offset);
+    CSA_CHECK(this, IntPtrLessThan(IntPtrConstant(0), size));
+    CSA_CHECK(this, IntPtrLessThanOrEqual(saved_entered_context_count, size));
+  }
 #endif
 
   StoreNoWriteBarrier(MachineType::PointerRepresentation(), hsi, size_offset,
diff --git a/deps/v8/src/builtins/builtins-number-gen.cc b/deps/v8/src/builtins/builtins-number-gen.cc
index fc737b793bec26..4513d73abc77b7 100644
--- a/deps/v8/src/builtins/builtins-number-gen.cc
+++ b/deps/v8/src/builtins/builtins-number-gen.cc
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/builtins/builtins-math-gen.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/codegen/code-stub-assembler.h"
@@ -26,29 +25,8 @@ class NumberBuiltinsAssembler : public CodeStubAssembler {
     TNode<Object> right = CAST(Parameter(Descriptor::kRight));
     TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
-    TVARIABLE(Word32T, var_left_word32);
-    TVARIABLE(Word32T, var_right_word32);
-    TVARIABLE(Object, var_left_maybe_bigint, left);
-    TVARIABLE(Object, var_right_maybe_bigint);
-    Label if_left_number(this), do_number_op(this);
-    Label if_left_bigint(this), do_bigint_op(this);
-
-    TaggedToWord32OrBigInt(context, left, &if_left_number, &var_left_word32,
-                           &if_left_bigint, &var_left_maybe_bigint);
-    BIND(&if_left_number);
-    TaggedToWord32OrBigInt(context, right, &do_number_op, &var_right_word32,
-                           &do_bigint_op, &var_right_maybe_bigint);
-    BIND(&do_number_op);
-    Return(BitwiseOp(var_left_word32.value(), var_right_word32.value(), op));
-
-    // BigInt cases.
-    BIND(&if_left_bigint);
-    TaggedToNumeric(context, right, &do_bigint_op, &var_right_maybe_bigint);
-
-    BIND(&do_bigint_op);
-    Return(CallRuntime(Runtime::kBigIntBinaryOp, context,
-                       var_left_maybe_bigint.value(),
-                       var_right_maybe_bigint.value(), SmiConstant(op)));
+    BinaryOpAssembler binop_asm(state());
+    Return(binop_asm.Generate_BitwiseBinaryOp(op, left, right, context));
   }
 
   template <typename Descriptor>
@@ -713,8 +691,8 @@ TF_BUILTIN(Subtract, NumberBuiltinsAssembler) {
   BIND(&do_bigint_sub);
   {
     TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-    Return(CallRuntime(Runtime::kBigIntBinaryOp, context, var_left.value(),
-                       var_right.value(), SmiConstant(Operation::kSubtract)));
+    TailCallBuiltin(Builtins::kBigIntSubtract, context, var_left.value(),
+                    var_right.value());
   }
 }
 
@@ -952,10 +930,7 @@ TF_BUILTIN(Exponentiate, NumberBuiltinsAssembler) {
                        nullptr, nullptr, &do_bigint_exp);
 
   BIND(&do_number_exp);
-  {
-    MathBuiltinsAssembler math_asm(state());
-    Return(math_asm.MathPow(context, var_left.value(), var_right.value()));
-  }
+  { Return(MathPowImpl(context, var_left.value(), var_right.value())); }
 
   BIND(&do_bigint_exp);
   Return(CallRuntime(Runtime::kBigIntBinaryOp, context, var_left.value(),
diff --git a/deps/v8/src/builtins/builtins-number.cc b/deps/v8/src/builtins/builtins-number.cc
index 49e7ff27b850d2..f6ff61a70410e5 100644
--- a/deps/v8/src/builtins/builtins-number.cc
+++ b/deps/v8/src/builtins/builtins-number.cc
@@ -186,65 +186,5 @@ BUILTIN(NumberPrototypeToPrecision) {
   return *result;
 }
 
-// ES6 section 20.1.3.6 Number.prototype.toString ( [ radix ] )
-BUILTIN(NumberPrototypeToString) {
-  HandleScope scope(isolate);
-  Handle<Object> value = args.at(0);
-  Handle<Object> radix = args.atOrUndefined(isolate, 1);
-
-  // Unwrap the receiver {value}.
-  if (value->IsJSPrimitiveWrapper()) {
-    value = handle(Handle<JSPrimitiveWrapper>::cast(value)->value(), isolate);
-  }
-  if (!value->IsNumber()) {
-    THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewTypeError(MessageTemplate::kNotGeneric,
-                              isolate->factory()->NewStringFromAsciiChecked(
-                                  "Number.prototype.toString"),
-                              isolate->factory()->Number_string()));
-  }
-  double const value_number = value->Number();
-
-  // If no {radix} was specified, just return ToString of {value}.
-  if (radix->IsUndefined(isolate)) {
-    return *isolate->factory()->NumberToString(value);
-  }
-
-  // Convert the {radix} to an integer first.
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, radix,
-                                     Object::ToInteger(isolate, radix));
-  double const radix_number = radix->Number();
-
-  // If {radix} is 10, just return ToString of {value}.
-  if (radix_number == 10.0) return *isolate->factory()->NumberToString(value);
-
-  // Make sure the {radix} is within the valid range.
-  if (radix_number < 2.0 || radix_number > 36.0) {
-    THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewRangeError(MessageTemplate::kToRadixFormatRange));
-  }
-
-  // Fast case where the result is a one character string.
-  if ((IsUint32Double(value_number) && value_number < radix_number) ||
-      IsMinusZero(value_number)) {
-    // Character array used for conversion.
-    static const char kCharTable[] = "0123456789abcdefghijklmnopqrstuvwxyz";
-    return *isolate->factory()->LookupSingleCharacterStringFromCode(
-        kCharTable[static_cast<uint32_t>(value_number)]);
-  }
-
-  // Slow case.
-  if (std::isnan(value_number)) return ReadOnlyRoots(isolate).NaN_string();
-  if (std::isinf(value_number)) {
-    return (value_number < 0.0) ? ReadOnlyRoots(isolate).minus_Infinity_string()
-                                : ReadOnlyRoots(isolate).Infinity_string();
-  }
-  char* const str =
-      DoubleToRadixCString(value_number, static_cast<int>(radix_number));
-  Handle<String> result = isolate->factory()->NewStringFromAsciiChecked(str);
-  DeleteArray(str);
-  return *result;
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-object-gen.cc b/deps/v8/src/builtins/builtins-object-gen.cc
index a35990e2f57801..9c5cd5461395a5 100644
--- a/deps/v8/src/builtins/builtins-object-gen.cc
+++ b/deps/v8/src/builtins/builtins-object-gen.cc
@@ -34,7 +34,7 @@ class ObjectBuiltinsAssembler : public CodeStubAssembler {
                          Handle<Name> name, TNode<Object> value,
                          Label* bailout);
   TNode<JSObject> FromPropertyDescriptor(TNode<Context> context,
-                                         TNode<FixedArray> desc);
+                                         TNode<PropertyDescriptorObject> desc);
   TNode<JSObject> FromPropertyDetails(TNode<Context> context,
                                       TNode<Object> raw_value,
                                       TNode<Word32T> details,
@@ -230,7 +230,7 @@ TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
   Label if_has_enum_cache(this), if_not_has_enum_cache(this),
       collect_entries(this);
   TNode<IntPtrT> object_enum_length =
-      Signed(DecodeWordFromWord32<Map::EnumLengthBits>(bit_field3));
+      Signed(DecodeWordFromWord32<Map::Bits3::EnumLengthBits>(bit_field3));
   TNode<BoolT> has_enum_cache = WordNotEqual(
       object_enum_length, IntPtrConstant(kInvalidEnumCacheSentinel));
 
@@ -262,10 +262,10 @@ TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
 
     TVARIABLE(IntPtrT, var_result_index, IntPtrConstant(0));
     TVARIABLE(IntPtrT, var_descriptor_number, IntPtrConstant(0));
-    VariableList vars({&var_descriptor_number, &var_result_index}, zone());
     // Let desc be ? O.[[GetOwnProperty]](key).
     TNode<DescriptorArray> descriptors = LoadMapDescriptors(map);
-    Label loop(this, vars), after_loop(this), next_descriptor(this);
+    Label loop(this, {&var_descriptor_number, &var_result_index}),
+        after_loop(this), next_descriptor(this);
     Branch(IntPtrEqual(var_descriptor_number.value(), object_enum_length),
            &after_loop, &loop);
 
@@ -387,7 +387,8 @@ TF_BUILTIN(ObjectPrototypeHasOwnProperty, ObjectBuiltinsAssembler) {
     TVARIABLE(IntPtrT, var_index);
     TVARIABLE(Name, var_unique);
 
-    Label if_index(this), if_unique_name(this), if_notunique_name(this);
+    Label if_index(this, &var_index), if_unique_name(this),
+        if_notunique_name(this);
     TryToName(key, &if_index, &var_index, &if_unique_name, &var_unique,
               &call_runtime, &if_notunique_name);
 
@@ -397,10 +398,7 @@ TF_BUILTIN(ObjectPrototypeHasOwnProperty, ObjectBuiltinsAssembler) {
 
     BIND(&if_index);
     {
-      // Handle negative keys in the runtime.
-      GotoIf(IntPtrLessThan(var_index.value(), IntPtrConstant(0)),
-             &call_runtime);
-      TryLookupElement(object, map, instance_type, var_index.value(),
+      TryLookupElement(CAST(object), map, instance_type, var_index.value(),
                        &return_true, &return_false, &return_false,
                        &call_runtime);
     }
@@ -482,7 +480,7 @@ TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
   TNode<Map> object_map = LoadMap(CAST(object));
   TNode<Uint32T> object_bit_field3 = LoadMapBitField3(object_map);
   TNode<UintPtrT> object_enum_length =
-      DecodeWordFromWord32<Map::EnumLengthBits>(object_bit_field3);
+      DecodeWordFromWord32<Map::Bits3::EnumLengthBits>(object_bit_field3);
   GotoIf(
       WordEqual(object_enum_length, IntPtrConstant(kInvalidEnumCacheSentinel)),
       &if_slow);
@@ -515,8 +513,8 @@ TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
         LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
     TNode<Smi> array_length = SmiTag(Signed(object_enum_length));
     std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
-        PACKED_ELEMENTS, array_map, array_length, {}, object_enum_length,
-        INTPTR_PARAMETERS);
+        PACKED_ELEMENTS, array_map, array_length, {},
+        Signed(object_enum_length));
     CopyFixedArrayElements(PACKED_ELEMENTS, object_enum_keys, elements,
                            object_enum_length, SKIP_WRITE_BARRIER);
     Return(array);
@@ -579,14 +577,15 @@ TF_BUILTIN(ObjectGetOwnPropertyNames, ObjectBuiltinsAssembler) {
   BIND(&if_empty_elements);
   TNode<Uint32T> object_bit_field3 = LoadMapBitField3(object_map);
   TNode<UintPtrT> object_enum_length =
-      DecodeWordFromWord32<Map::EnumLengthBits>(object_bit_field3);
+      DecodeWordFromWord32<Map::Bits3::EnumLengthBits>(object_bit_field3);
   GotoIf(
       WordEqual(object_enum_length, IntPtrConstant(kInvalidEnumCacheSentinel)),
       &try_fast);
 
   // Check whether all own properties are enumerable.
   TNode<UintPtrT> number_descriptors =
-      DecodeWordFromWord32<Map::NumberOfOwnDescriptorsBits>(object_bit_field3);
+      DecodeWordFromWord32<Map::Bits3::NumberOfOwnDescriptorsBits>(
+          object_bit_field3);
   GotoIfNot(WordEqual(object_enum_length, number_descriptors), &if_slow);
 
   // Check whether there are enumerable properties.
@@ -610,8 +609,8 @@ TF_BUILTIN(ObjectGetOwnPropertyNames, ObjectBuiltinsAssembler) {
     TNode<JSArray> array;
     TNode<FixedArrayBase> elements;
     std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
-        PACKED_ELEMENTS, array_map, array_length, {}, object_enum_length,
-        INTPTR_PARAMETERS);
+        PACKED_ELEMENTS, array_map, array_length, {},
+        Signed(object_enum_length));
     CopyFixedArrayElements(PACKED_ELEMENTS, object_enum_keys, elements,
                            object_enum_length, SKIP_WRITE_BARRIER);
     Return(array);
@@ -747,9 +746,9 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
   // This is arranged to check the likely cases first.
   GotoIf(TaggedIsSmi(receiver), &if_number);
 
-  TNode<HeapObject> reciever_heap_object = CAST(receiver);
-  TNode<Map> receiver_map = LoadMap(reciever_heap_object);
-  var_holder = reciever_heap_object;
+  TNode<HeapObject> receiver_heap_object = CAST(receiver);
+  TNode<Map> receiver_map = LoadMap(receiver_heap_object);
+  var_holder = receiver_heap_object;
   TNode<Uint16T> receiver_instance_type = LoadMapInstanceType(receiver_map);
   GotoIf(IsPrimitiveInstanceType(receiver_instance_type), &if_primitive);
   const struct {
@@ -970,10 +969,10 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
         if_value_is_string(this, Label::kDeferred);
 
     TNode<Object> receiver_value =
-        LoadJSPrimitiveWrapperValue(CAST(reciever_heap_object));
+        LoadJSPrimitiveWrapperValue(CAST(receiver_heap_object));
     // We need to start with the object to see if the value was a subclass
     // which might have interesting properties.
-    var_holder = reciever_heap_object;
+    var_holder = receiver_heap_object;
     GotoIf(TaggedIsSmi(receiver_value), &if_value_is_number);
     TNode<Map> receiver_value_map = LoadMap(CAST(receiver_value));
     GotoIf(IsHeapNumberMap(receiver_value_map), &if_value_is_number);
@@ -1031,7 +1030,8 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
       GotoIf(IsNull(holder), &return_default);
       TNode<Map> holder_map = LoadMap(holder);
       TNode<Uint32T> holder_bit_field3 = LoadMapBitField3(holder_map);
-      GotoIf(IsSetWord32<Map::MayHaveInterestingSymbolsBit>(holder_bit_field3),
+      GotoIf(IsSetWord32<Map::Bits3::MayHaveInterestingSymbolsBit>(
+                 holder_bit_field3),
              &return_generic);
       var_holder = LoadMapPrototype(holder_map);
       Goto(&loop);
@@ -1059,70 +1059,6 @@ TF_BUILTIN(ObjectPrototypeValueOf, CodeStubAssembler) {
   Return(ToObject_Inline(context, receiver));
 }
 
-// ES #sec-object.create
-TF_BUILTIN(CreateObjectWithoutProperties, ObjectBuiltinsAssembler) {
-  TNode<Object> const prototype = CAST(Parameter(Descriptor::kPrototypeArg));
-  TNode<Context> const context = CAST(Parameter(Descriptor::kContext));
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  Label call_runtime(this, Label::kDeferred), prototype_null(this),
-      prototype_jsreceiver(this);
-  {
-    Comment("Argument check: prototype");
-    GotoIf(IsNull(prototype), &prototype_null);
-    BranchIfJSReceiver(prototype, &prototype_jsreceiver, &call_runtime);
-  }
-
-  TVARIABLE(Map, map);
-  TVARIABLE(HeapObject, properties);
-  Label instantiate_map(this);
-
-  BIND(&prototype_null);
-  {
-    Comment("Prototype is null");
-    map = CAST(LoadContextElement(
-        native_context, Context::SLOW_OBJECT_WITH_NULL_PROTOTYPE_MAP));
-    properties = AllocateNameDictionary(NameDictionary::kInitialCapacity);
-    Goto(&instantiate_map);
-  }
-
-  BIND(&prototype_jsreceiver);
-  {
-    Comment("Prototype is JSReceiver");
-    properties = EmptyFixedArrayConstant();
-    TNode<HeapObject> object_function = CAST(
-        LoadContextElement(native_context, Context::OBJECT_FUNCTION_INDEX));
-    TNode<Map> object_function_map = LoadObjectField<Map>(
-        object_function, JSFunction::kPrototypeOrInitialMapOffset);
-    map = object_function_map;
-    GotoIf(TaggedEqual(prototype, LoadMapPrototype(map.value())),
-           &instantiate_map);
-    Comment("Try loading the prototype info");
-    TNode<PrototypeInfo> prototype_info =
-        LoadMapPrototypeInfo(LoadMap(CAST(prototype)), &call_runtime);
-    TNode<MaybeObject> maybe_map = LoadMaybeWeakObjectField(
-        prototype_info, PrototypeInfo::kObjectCreateMapOffset);
-    GotoIf(TaggedEqual(maybe_map, UndefinedConstant()), &call_runtime);
-    map = CAST(GetHeapObjectAssumeWeak(maybe_map, &call_runtime));
-    Goto(&instantiate_map);
-  }
-
-  BIND(&instantiate_map);
-  {
-    Comment("Instantiate map");
-    TNode<JSObject> instance =
-        AllocateJSObjectFromMap(map.value(), properties.value());
-    Return(instance);
-  }
-
-  BIND(&call_runtime);
-  {
-    Comment("Call Runtime (prototype is not null/jsreceiver)");
-    TNode<Object> result = CallRuntime(Runtime::kObjectCreate, context,
-                                       prototype, UndefinedConstant());
-    Return(result);
-  }
-}
-
 // ES #sec-object.create
 TF_BUILTIN(ObjectCreate, ObjectBuiltinsAssembler) {
   int const kPrototypeArg = 0;
@@ -1159,8 +1095,9 @@ TF_BUILTIN(ObjectCreate, ObjectBuiltinsAssembler) {
         &call_runtime);
     // Handle dictionary objects or fast objects with properties in runtime.
     TNode<Uint32T> bit_field3 = LoadMapBitField3(properties_map);
-    GotoIf(IsSetWord32<Map::IsDictionaryMapBit>(bit_field3), &call_runtime);
-    Branch(IsSetWord32<Map::NumberOfOwnDescriptorsBits>(bit_field3),
+    GotoIf(IsSetWord32<Map::Bits3::IsDictionaryMapBit>(bit_field3),
+           &call_runtime);
+    Branch(IsSetWord32<Map::Bits3::NumberOfOwnDescriptorsBits>(bit_field3),
            &call_runtime, &no_properties);
   }
 
@@ -1220,8 +1157,8 @@ TF_BUILTIN(ObjectCreate, ObjectBuiltinsAssembler) {
 
 // ES #sec-object.is
 TF_BUILTIN(ObjectIs, ObjectBuiltinsAssembler) {
-  TNode<Object> const left = CAST(Parameter(Descriptor::kLeft));
-  TNode<Object> const right = CAST(Parameter(Descriptor::kRight));
+  const TNode<Object> left = CAST(Parameter(Descriptor::kLeft));
+  const TNode<Object> right = CAST(Parameter(Descriptor::kRight));
 
   Label return_true(this), return_false(this);
   BranchIfSameValue(left, right, &return_true, &return_false);
@@ -1234,15 +1171,15 @@ TF_BUILTIN(ObjectIs, ObjectBuiltinsAssembler) {
 }
 
 TF_BUILTIN(CreateIterResultObject, ObjectBuiltinsAssembler) {
-  TNode<Object> const value = CAST(Parameter(Descriptor::kValue));
-  TNode<Oddball> const done = CAST(Parameter(Descriptor::kDone));
-  TNode<Context> const context = CAST(Parameter(Descriptor::kContext));
+  const TNode<Object> value = CAST(Parameter(Descriptor::kValue));
+  const TNode<Oddball> done = CAST(Parameter(Descriptor::kDone));
+  const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Map> const map = CAST(
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Map> map = CAST(
       LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX));
 
-  TNode<JSObject> const result = AllocateJSObjectFromMap(map);
+  const TNode<JSObject> result = AllocateJSObjectFromMap(map);
 
   StoreObjectFieldNoWriteBarrier(result, JSIteratorResult::kValueOffset, value);
   StoreObjectFieldNoWriteBarrier(result, JSIteratorResult::kDoneOffset, done);
@@ -1301,11 +1238,11 @@ TF_BUILTIN(CreateGeneratorObject, ObjectBuiltinsAssembler) {
   TNode<BytecodeArray> bytecode_array =
       LoadSharedFunctionInfoBytecodeArray(shared);
 
-  TNode<IntPtrT> formal_parameter_count = ChangeInt32ToIntPtr(
-      LoadObjectField(shared, SharedFunctionInfo::kFormalParameterCountOffset,
-                      MachineType::Uint16()));
-  TNode<IntPtrT> frame_size = ChangeInt32ToIntPtr(LoadObjectField(
-      bytecode_array, BytecodeArray::kFrameSizeOffset, MachineType::Int32()));
+  TNode<IntPtrT> formal_parameter_count =
+      ChangeInt32ToIntPtr(LoadObjectField<Uint16T>(
+          shared, SharedFunctionInfo::kFormalParameterCountOffset));
+  TNode<IntPtrT> frame_size = ChangeInt32ToIntPtr(
+      LoadObjectField<Int32T>(bytecode_array, BytecodeArray::kFrameSizeOffset));
   TNode<IntPtrT> size =
       IntPtrAdd(WordSar(frame_size, IntPtrConstant(kTaggedSizeLog2)),
                 formal_parameter_count);
@@ -1314,8 +1251,8 @@ TF_BUILTIN(CreateGeneratorObject, ObjectBuiltinsAssembler) {
   FillFixedArrayWithValue(HOLEY_ELEMENTS, parameters_and_registers,
                           IntPtrConstant(0), size, RootIndex::kUndefinedValue);
   // TODO(cbruni): support start_offset to avoid double initialization.
-  TNode<JSObject> result =
-      AllocateJSObjectFromMap(map, nullptr, nullptr, kNone, kWithSlackTracking);
+  TNode<JSObject> result = AllocateJSObjectFromMap(
+      map, base::nullopt, base::nullopt, kNone, kWithSlackTracking);
   StoreObjectFieldNoWriteBarrier(result, JSGeneratorObject::kFunctionOffset,
                                  closure);
   StoreObjectFieldNoWriteBarrier(result, JSGeneratorObject::kContextOffset,
@@ -1399,7 +1336,7 @@ TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
       Label if_found_value(this), return_empty(this), if_not_found(this);
 
       TVARIABLE(Object, var_value);
-      TVARIABLE(Word32T, var_details);
+      TVARIABLE(Uint32T, var_details);
       TVARIABLE(Object, var_raw_value);
 
       TryGetOwnProperty(context, object, object, map, instance_type,
@@ -1432,10 +1369,10 @@ TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
 
     GotoIf(IsUndefined(desc), &return_undefined);
 
-    TNode<FixedArray> desc_array = CAST(desc);
+    TNode<PropertyDescriptorObject> desc_object = CAST(desc);
 
     // 4. Return FromPropertyDescriptor(desc).
-    TNode<JSObject> js_desc = FromPropertyDescriptor(context, desc_array);
+    TNode<JSObject> js_desc = FromPropertyDescriptor(context, desc_object);
     args.PopAndReturn(js_desc);
   }
   BIND(&return_undefined);
@@ -1455,7 +1392,7 @@ void ObjectBuiltinsAssembler::AddToDictionaryIf(
 }
 
 TNode<JSObject> ObjectBuiltinsAssembler::FromPropertyDescriptor(
-    TNode<Context> context, TNode<FixedArray> desc) {
+    TNode<Context> context, TNode<PropertyDescriptorObject> desc) {
   TVARIABLE(JSObject, js_descriptor);
 
   TNode<Int32T> flags = LoadAndUntagToWord32ObjectField(
diff --git a/deps/v8/src/builtins/builtins-object.cc b/deps/v8/src/builtins/builtins-object.cc
index 93f011ffa1efe4..b482c6ba02c67a 100644
--- a/deps/v8/src/builtins/builtins-object.cc
+++ b/deps/v8/src/builtins/builtins-object.cc
@@ -105,13 +105,14 @@ Object ObjectLookupAccessor(Isolate* isolate, Handle<Object> object,
                             Handle<Object> key, AccessorComponent component) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, object,
                                      Object::ToObject(isolate, object));
+  // TODO(jkummerow/verwaest): LookupIterator::Key(..., bool*) performs a
+  // functionally equivalent conversion, but handles element indices slightly
+  // differently. Does one of the approaches have a performance advantage?
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, key,
                                      Object::ToPropertyKey(isolate, key));
-  bool success = false;
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, object, key, &success,
-      LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
-  DCHECK(success);
+  LookupIterator::Key lookup_key(isolate, key);
+  LookupIterator it(isolate, object, lookup_key,
+                    LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
 
   for (; it.IsFound(); it.Next()) {
     switch (it.state()) {
diff --git a/deps/v8/src/builtins/builtins-promise-gen.cc b/deps/v8/src/builtins/builtins-promise-gen.cc
index b20b288c3d63a3..6b1f43d8eaa7e1 100644
--- a/deps/v8/src/builtins/builtins-promise-gen.cc
+++ b/deps/v8/src/builtins/builtins-promise-gen.cc
@@ -20,2696 +20,22 @@
 namespace v8 {
 namespace internal {
 
-using Node = compiler::Node;
-using IteratorRecord = TorqueStructIteratorRecord;
-
-TNode<JSPromise> PromiseBuiltinsAssembler::AllocateJSPromise(
-    TNode<Context> context) {
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<JSFunction> const promise_fun =
-      CAST(LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX));
-  CSA_ASSERT(this, IsFunctionWithPrototypeSlotMap(LoadMap(promise_fun)));
-  TNode<Object> const promise_map =
-      LoadObjectField(promise_fun, JSFunction::kPrototypeOrInitialMapOffset);
-  TNode<HeapObject> const promise =
-      Allocate(JSPromise::kSizeWithEmbedderFields);
-  StoreMapNoWriteBarrier(promise, promise_map);
-  StoreObjectFieldRoot(promise, JSPromise::kPropertiesOrHashOffset,
-                       RootIndex::kEmptyFixedArray);
-  StoreObjectFieldRoot(promise, JSPromise::kElementsOffset,
-                       RootIndex::kEmptyFixedArray);
-  return CAST(promise);
-}
-
-void PromiseBuiltinsAssembler::PromiseInit(Node* promise) {
-  STATIC_ASSERT(v8::Promise::kPending == 0);
-  StoreObjectFieldNoWriteBarrier(promise, JSPromise::kReactionsOrResultOffset,
-                                 SmiConstant(Smi::zero()));
-  StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset,
-                                 SmiConstant(Smi::zero()));
-  for (int offset = JSPromise::kSize;
+void PromiseBuiltinsAssembler::ZeroOutEmbedderOffsets(
+    TNode<JSPromise> promise) {
+  for (int offset = JSPromise::kHeaderSize;
        offset < JSPromise::kSizeWithEmbedderFields; offset += kTaggedSize) {
     StoreObjectFieldNoWriteBarrier(promise, offset, SmiConstant(Smi::zero()));
   }
 }
 
-TNode<JSPromise> PromiseBuiltinsAssembler::AllocateAndInitJSPromise(
+TNode<HeapObject> PromiseBuiltinsAssembler::AllocatePromiseReactionJobTask(
     TNode<Context> context) {
-  return AllocateAndInitJSPromise(context, UndefinedConstant());
-}
-
-TNode<JSPromise> PromiseBuiltinsAssembler::AllocateAndInitJSPromise(
-    TNode<Context> context, TNode<Object> parent) {
-  const TNode<JSPromise> instance = AllocateJSPromise(context);
-  PromiseInit(instance);
-
-  Label out(this);
-  GotoIfNot(IsPromiseHookEnabledOrHasAsyncEventDelegate(), &out);
-  CallRuntime(Runtime::kPromiseHookInit, context, instance, parent);
-  Goto(&out);
-
-  BIND(&out);
-  return instance;
-}
-
-TNode<JSPromise> PromiseBuiltinsAssembler::AllocateAndSetJSPromise(
-    TNode<Context> context, v8::Promise::PromiseState status,
-    TNode<Object> result) {
-  DCHECK_NE(Promise::kPending, status);
-
-  const TNode<JSPromise> instance = AllocateJSPromise(context);
-  StoreObjectFieldNoWriteBarrier(instance, JSPromise::kReactionsOrResultOffset,
-                                 result);
-  STATIC_ASSERT(JSPromise::kStatusShift == 0);
-  StoreObjectFieldNoWriteBarrier(instance, JSPromise::kFlagsOffset,
-                                 SmiConstant(status));
-  for (int offset = JSPromise::kSize;
-       offset < JSPromise::kSizeWithEmbedderFields; offset += kTaggedSize) {
-    StoreObjectFieldNoWriteBarrier(instance, offset, SmiConstant(0));
-  }
-
-  Label out(this);
-  GotoIfNot(IsPromiseHookEnabledOrHasAsyncEventDelegate(), &out);
-  CallRuntime(Runtime::kPromiseHookInit, context, instance,
-              UndefinedConstant());
-  Goto(&out);
-
-  BIND(&out);
-  return instance;
-}
-
-std::pair<TNode<JSFunction>, TNode<JSFunction>>
-PromiseBuiltinsAssembler::CreatePromiseResolvingFunctions(
-    TNode<JSPromise> promise, TNode<Object> debug_event,
-    TNode<NativeContext> native_context) {
-  const TNode<Context> promise_context = CreatePromiseResolvingFunctionsContext(
-      promise, debug_event, native_context);
-  const TNode<Map> map = CAST(LoadContextElement(
-      native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX));
-  const TNode<SharedFunctionInfo> resolve_info = CAST(LoadContextElement(
-      native_context,
-      Context::PROMISE_CAPABILITY_DEFAULT_RESOLVE_SHARED_FUN_INDEX));
-  const TNode<JSFunction> resolve =
-      AllocateFunctionWithMapAndContext(map, resolve_info, promise_context);
-  const TNode<SharedFunctionInfo> reject_info = CAST(LoadContextElement(
-      native_context,
-      Context::PROMISE_CAPABILITY_DEFAULT_REJECT_SHARED_FUN_INDEX));
-  const TNode<JSFunction> reject =
-      AllocateFunctionWithMapAndContext(map, reject_info, promise_context);
-  return std::make_pair(resolve, reject);
-}
-
-void PromiseBuiltinsAssembler::ExtractHandlerContext(Node* handler,
-                                                     Variable* var_context) {
-  VARIABLE(var_handler, MachineRepresentation::kTagged, handler);
-  Label loop(this, &var_handler), done(this, Label::kDeferred);
-  Goto(&loop);
-  BIND(&loop);
-  {
-    Label if_function(this), if_bound_function(this, Label::kDeferred),
-        if_proxy(this, Label::kDeferred);
-    GotoIf(TaggedIsSmi(var_handler.value()), &done);
-
-    int32_t case_values[] = {
-        JS_FUNCTION_TYPE,
-        JS_BOUND_FUNCTION_TYPE,
-        JS_PROXY_TYPE,
-    };
-    Label* case_labels[] = {
-        &if_function,
-        &if_bound_function,
-        &if_proxy,
-    };
-    static_assert(arraysize(case_values) == arraysize(case_labels), "");
-    TNode<Map> handler_map = LoadMap(var_handler.value());
-    TNode<Uint16T> handler_type = LoadMapInstanceType(handler_map);
-    Switch(handler_type, &done, case_values, case_labels,
-           arraysize(case_labels));
-
-    BIND(&if_bound_function);
-    {
-      // Use the target function's context for JSBoundFunction.
-      var_handler.Bind(LoadObjectField(
-          var_handler.value(), JSBoundFunction::kBoundTargetFunctionOffset));
-      Goto(&loop);
-    }
-
-    BIND(&if_proxy);
-    {
-      // Use the target function's context for JSProxy.
-      // If the proxy is revoked, |var_handler| will be undefined and this
-      // function will return with unchanged |var_context|.
-      var_handler.Bind(
-          LoadObjectField(var_handler.value(), JSProxy::kTargetOffset));
-      Goto(&loop);
-    }
-
-    BIND(&if_function);
-    {
-      // Use the function's context.
-      TNode<Object> handler_context =
-          LoadObjectField(var_handler.value(), JSFunction::kContextOffset);
-      var_context->Bind(LoadNativeContext(CAST(handler_context)));
-      Goto(&done);
-    }
-  }
-
-  // If no valid context is available, |var_context| is unchanged and the caller
-  // will use a fallback context.
-  BIND(&done);
-}
-
-// ES #sec-newpromisecapability
-TF_BUILTIN(NewPromiseCapability, PromiseBuiltinsAssembler) {
-  TNode<Context> const context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> const constructor = CAST(Parameter(Descriptor::kConstructor));
-  TNode<Object> const debug_event = CAST(Parameter(Descriptor::kDebugEvent));
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-
-  Label if_not_constructor(this, Label::kDeferred),
-      if_notcallable(this, Label::kDeferred), if_fast_promise_capability(this),
-      if_slow_promise_capability(this, Label::kDeferred);
-  GotoIf(TaggedIsSmi(constructor), &if_not_constructor);
-  GotoIfNot(IsConstructorMap(LoadMap(CAST(constructor))), &if_not_constructor);
-  Branch(TaggedEqual(constructor,
-                     LoadContextElement(native_context,
-                                        Context::PROMISE_FUNCTION_INDEX)),
-         &if_fast_promise_capability, &if_slow_promise_capability);
-
-  BIND(&if_fast_promise_capability);
-  {
-    TNode<JSPromise> promise =
-        AllocateAndInitJSPromise(native_context, UndefinedConstant());
-
-    Node* resolve = nullptr;
-    Node* reject = nullptr;
-    std::tie(resolve, reject) =
-        CreatePromiseResolvingFunctions(promise, debug_event, native_context);
-
-    TNode<HeapObject> capability = Allocate(PromiseCapability::kSize);
-    StoreMapNoWriteBarrier(capability, RootIndex::kPromiseCapabilityMap);
-    StoreObjectFieldNoWriteBarrier(capability,
-                                   PromiseCapability::kPromiseOffset, promise);
-    StoreObjectFieldNoWriteBarrier(capability,
-                                   PromiseCapability::kResolveOffset, resolve);
-    StoreObjectFieldNoWriteBarrier(capability, PromiseCapability::kRejectOffset,
-                                   reject);
-    Return(capability);
-  }
-
-  BIND(&if_slow_promise_capability);
-  {
-    TNode<HeapObject> capability = Allocate(PromiseCapability::kSize);
-    StoreMapNoWriteBarrier(capability, RootIndex::kPromiseCapabilityMap);
-    StoreObjectFieldRoot(capability, PromiseCapability::kPromiseOffset,
-                         RootIndex::kUndefinedValue);
-    StoreObjectFieldRoot(capability, PromiseCapability::kResolveOffset,
-                         RootIndex::kUndefinedValue);
-    StoreObjectFieldRoot(capability, PromiseCapability::kRejectOffset,
-                         RootIndex::kUndefinedValue);
-
-    TNode<Context> executor_context =
-        CAST(CreatePromiseGetCapabilitiesExecutorContext(capability,
-                                                         native_context));
-    TNode<SharedFunctionInfo> executor_info = CAST(LoadContextElement(
-        native_context, Context::PROMISE_GET_CAPABILITIES_EXECUTOR_SHARED_FUN));
-    TNode<Map> function_map = CAST(LoadContextElement(
-        native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX));
-    TNode<JSFunction> executor = AllocateFunctionWithMapAndContext(
-        function_map, executor_info, executor_context);
-
-    TNode<JSReceiver> promise =
-        Construct(native_context, CAST(constructor), executor);
-    StoreObjectField(capability, PromiseCapability::kPromiseOffset, promise);
-
-    TNode<Object> resolve =
-        LoadObjectField(capability, PromiseCapability::kResolveOffset);
-    GotoIf(TaggedIsSmi(resolve), &if_notcallable);
-    GotoIfNot(IsCallable(CAST(resolve)), &if_notcallable);
-
-    TNode<Object> reject =
-        LoadObjectField(capability, PromiseCapability::kRejectOffset);
-    GotoIf(TaggedIsSmi(reject), &if_notcallable);
-    GotoIfNot(IsCallable(CAST(reject)), &if_notcallable);
-    Return(capability);
-  }
-
-  BIND(&if_not_constructor);
-  ThrowTypeError(context, MessageTemplate::kNotConstructor, constructor);
-
-  BIND(&if_notcallable);
-  ThrowTypeError(context, MessageTemplate::kPromiseNonCallable);
-}
-
-TNode<Context> PromiseBuiltinsAssembler::CreatePromiseContext(
-    TNode<NativeContext> native_context, int slots) {
-  DCHECK_GE(slots, Context::MIN_CONTEXT_SLOTS);
-
-  TNode<HeapObject> const context =
-      AllocateInNewSpace(FixedArray::SizeFor(slots));
-  InitializeFunctionContext(native_context, context, slots);
-  return CAST(context);
-}
-
-Node* PromiseBuiltinsAssembler::CreatePromiseAllResolveElementContext(
-    Node* promise_capability, Node* native_context) {
-  CSA_ASSERT(this, IsNativeContext(native_context));
-
-  // TODO(bmeurer): Manually fold this into a single allocation.
-  TNode<Map> array_map = CAST(LoadContextElement(
-      native_context, Context::JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX));
-  TNode<JSArray> values_array = AllocateJSArray(
-      PACKED_ELEMENTS, array_map, IntPtrConstant(0), SmiConstant(0));
-
-  TNode<Context> const context = CreatePromiseContext(
-      CAST(native_context), PromiseBuiltins::kPromiseAllResolveElementLength);
-  StoreContextElementNoWriteBarrier(
-      context, PromiseBuiltins::kPromiseAllResolveElementRemainingSlot,
-      SmiConstant(1));
-  StoreContextElementNoWriteBarrier(
-      context, PromiseBuiltins::kPromiseAllResolveElementCapabilitySlot,
-      promise_capability);
-  StoreContextElementNoWriteBarrier(
-      context, PromiseBuiltins::kPromiseAllResolveElementValuesArraySlot,
-      values_array);
-
-  return context;
-}
-
-TNode<JSFunction>
-PromiseBuiltinsAssembler::CreatePromiseAllResolveElementFunction(
-    Node* context, TNode<Smi> index, Node* native_context, int slot_index) {
-  CSA_ASSERT(this, SmiGreaterThan(index, SmiConstant(0)));
-  CSA_ASSERT(this, SmiLessThanOrEqual(
-                       index, SmiConstant(PropertyArray::HashField::kMax)));
-  CSA_ASSERT(this, IsNativeContext(native_context));
-
-  const TNode<Map> map = CAST(LoadContextElement(
-      native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX));
-  const TNode<SharedFunctionInfo> resolve_info =
-      CAST(LoadContextElement(native_context, slot_index));
-  TNode<JSFunction> resolve =
-      AllocateFunctionWithMapAndContext(map, resolve_info, CAST(context));
-
-  STATIC_ASSERT(PropertyArray::kNoHashSentinel == 0);
-  StoreObjectFieldNoWriteBarrier(resolve, JSFunction::kPropertiesOrHashOffset,
-                                 index);
-
-  return resolve;
-}
-
-TNode<Context> PromiseBuiltinsAssembler::CreatePromiseResolvingFunctionsContext(
-    TNode<JSPromise> promise, TNode<Object> debug_event,
-    TNode<NativeContext> native_context) {
-  const TNode<Context> context = CreatePromiseContext(
-      native_context, PromiseBuiltins::kPromiseContextLength);
-  StoreContextElementNoWriteBarrier(context, PromiseBuiltins::kPromiseSlot,
-                                    promise);
-  StoreContextElementNoWriteBarrier(
-      context, PromiseBuiltins::kAlreadyResolvedSlot, FalseConstant());
-  StoreContextElementNoWriteBarrier(context, PromiseBuiltins::kDebugEventSlot,
-                                    debug_event);
-  return context;
-}
-
-Node* PromiseBuiltinsAssembler::CreatePromiseGetCapabilitiesExecutorContext(
-    Node* promise_capability, Node* native_context) {
-  int kContextLength = PromiseBuiltins::kCapabilitiesContextLength;
-  TNode<Context> context =
-      CreatePromiseContext(CAST(native_context), kContextLength);
-  StoreContextElementNoWriteBarrier(context, PromiseBuiltins::kCapabilitySlot,
-                                    promise_capability);
-  return context;
-}
-
-Node* PromiseBuiltinsAssembler::PromiseHasHandler(Node* promise) {
-  TNode<Smi> const flags =
-      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
-  return IsSetWord(SmiUntag(flags), 1 << JSPromise::kHasHandlerBit);
-}
-
-void PromiseBuiltinsAssembler::PromiseSetHasHandler(Node* promise) {
-  TNode<Smi> const flags =
-      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
-  TNode<Smi> const new_flags =
-      SmiOr(flags, SmiConstant(1 << JSPromise::kHasHandlerBit));
-  StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset, new_flags);
-}
-
-TNode<BoolT> PromiseBuiltinsAssembler::IsPromiseStatus(
-    TNode<Word32T> actual, v8::Promise::PromiseState expected) {
-  return Word32Equal(actual, Int32Constant(expected));
-}
-
-TNode<Word32T> PromiseBuiltinsAssembler::PromiseStatus(Node* promise) {
-  STATIC_ASSERT(JSPromise::kStatusShift == 0);
-  TNode<Smi> const flags =
-      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
-  return Word32And(SmiToInt32(flags), Int32Constant(JSPromise::kStatusMask));
-}
-
-void PromiseBuiltinsAssembler::PromiseSetStatus(
-    Node* promise, v8::Promise::PromiseState const status) {
-  CSA_ASSERT(this,
-             IsPromiseStatus(PromiseStatus(promise), v8::Promise::kPending));
-  CHECK_NE(status, v8::Promise::kPending);
-
-  TNode<Smi> mask = SmiConstant(status);
-  TNode<Smi> const flags =
-      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
-  StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset,
-                                 SmiOr(flags, mask));
-}
-
-void PromiseBuiltinsAssembler::PromiseSetHandledHint(Node* promise) {
-  TNode<Smi> const flags =
-      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
-  TNode<Smi> const new_flags =
-      SmiOr(flags, SmiConstant(1 << JSPromise::kHandledHintBit));
-  StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset, new_flags);
-}
-
-// ES #sec-performpromisethen
-void PromiseBuiltinsAssembler::PerformPromiseThen(
-    TNode<Context> context, TNode<JSPromise> promise,
-    TNode<HeapObject> on_fulfilled, TNode<HeapObject> on_rejected,
-    TNode<HeapObject> result_promise_or_capability) {
-  CSA_ASSERT(this,
-             Word32Or(IsCallable(on_fulfilled), IsUndefined(on_fulfilled)));
-  CSA_ASSERT(this, Word32Or(IsCallable(on_rejected), IsUndefined(on_rejected)));
-  CSA_ASSERT(
-      this,
-      Word32Or(Word32Or(IsJSPromise(result_promise_or_capability),
-                        IsPromiseCapability(result_promise_or_capability)),
-               IsUndefined(result_promise_or_capability)));
-
-  Label if_pending(this), if_notpending(this), done(this);
-  TNode<Word32T> const status = PromiseStatus(promise);
-  Branch(IsPromiseStatus(status, v8::Promise::kPending), &if_pending,
-         &if_notpending);
-
-  BIND(&if_pending);
-  {
-    // The {promise} is still in "Pending" state, so we just record a new
-    // PromiseReaction holding both the onFulfilled and onRejected callbacks.
-    // Once the {promise} is resolved we decide on the concrete handler to
-    // push onto the microtask queue.
-    const TNode<Object> promise_reactions =
-        LoadObjectField(promise, JSPromise::kReactionsOrResultOffset);
-    const TNode<PromiseReaction> reaction =
-        AllocatePromiseReaction(promise_reactions, result_promise_or_capability,
-                                on_fulfilled, on_rejected);
-    StoreObjectField(promise, JSPromise::kReactionsOrResultOffset, reaction);
-    Goto(&done);
-  }
-
-  BIND(&if_notpending);
-  {
-    TVARIABLE(Map, var_map);
-    TVARIABLE(HeapObject, var_handler);
-    TVARIABLE(Object, var_handler_context, UndefinedConstant());
-    Label if_fulfilled(this), if_rejected(this, Label::kDeferred),
-        enqueue(this);
-    Branch(IsPromiseStatus(status, v8::Promise::kFulfilled), &if_fulfilled,
-           &if_rejected);
-
-    BIND(&if_fulfilled);
-    {
-      var_map = PromiseFulfillReactionJobTaskMapConstant();
-      var_handler = on_fulfilled;
-
-      Label use_fallback(this, Label::kDeferred), done(this);
-      ExtractHandlerContext(on_fulfilled, &var_handler_context);
-      Branch(IsUndefined(var_handler_context.value()), &use_fallback, &done);
-
-      BIND(&use_fallback);
-      var_handler_context = context;
-      ExtractHandlerContext(on_rejected, &var_handler_context);
-      Goto(&done);
-
-      BIND(&done);
-      Goto(&enqueue);
-    }
-
-    BIND(&if_rejected);
-    {
-      CSA_ASSERT(this, IsPromiseStatus(status, v8::Promise::kRejected));
-      var_map = PromiseRejectReactionJobTaskMapConstant();
-      var_handler = on_rejected;
-
-      Label use_fallback(this, Label::kDeferred), done(this);
-      ExtractHandlerContext(on_rejected, &var_handler_context);
-      Branch(IsUndefined(var_handler_context.value()), &use_fallback, &done);
-
-      BIND(&use_fallback);
-      var_handler_context = context;
-      ExtractHandlerContext(on_fulfilled, &var_handler_context);
-      Goto(&done);
-      BIND(&done);
-
-      GotoIf(PromiseHasHandler(promise), &enqueue);
-      CallRuntime(Runtime::kPromiseRevokeReject, context, promise);
-      Goto(&enqueue);
-    }
-
-    BIND(&enqueue);
-    {
-      TNode<Object> argument =
-          LoadObjectField(promise, JSPromise::kReactionsOrResultOffset);
-      TNode<PromiseReactionJobTask> microtask = AllocatePromiseReactionJobTask(
-          var_map.value(), CAST(var_handler_context.value()), argument,
-          var_handler.value(), result_promise_or_capability);
-      CallBuiltin(Builtins::kEnqueueMicrotask, var_handler_context.value(),
-                  microtask);
-      Goto(&done);
-    }
-  }
-
-  BIND(&done);
-  PromiseSetHasHandler(promise);
-}
-
-// ES #sec-performpromisethen
-TF_BUILTIN(PerformPromiseThen, PromiseBuiltinsAssembler) {
-  const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  const TNode<JSPromise> promise = CAST(Parameter(Descriptor::kPromise));
-  const TNode<HeapObject> on_fulfilled =
-      CAST(Parameter(Descriptor::kOnFulfilled));
-  const TNode<HeapObject> on_rejected =
-      CAST(Parameter(Descriptor::kOnRejected));
-  const TNode<HeapObject> result_promise =
-      CAST(Parameter(Descriptor::kResultPromise));
-
-  CSA_ASSERT(
-      this, Word32Or(IsJSPromise(result_promise), IsUndefined(result_promise)));
-
-  PerformPromiseThen(context, promise, on_fulfilled, on_rejected,
-                     result_promise);
-  Return(result_promise);
-}
-
-TNode<PromiseReaction> PromiseBuiltinsAssembler::AllocatePromiseReaction(
-    TNode<Object> next, TNode<HeapObject> promise_or_capability,
-    TNode<HeapObject> fulfill_handler, TNode<HeapObject> reject_handler) {
-  TNode<HeapObject> const reaction = Allocate(PromiseReaction::kSize);
-  StoreMapNoWriteBarrier(reaction, RootIndex::kPromiseReactionMap);
-  StoreObjectFieldNoWriteBarrier(reaction, PromiseReaction::kNextOffset, next);
-  StoreObjectFieldNoWriteBarrier(reaction,
-                                 PromiseReaction::kPromiseOrCapabilityOffset,
-                                 promise_or_capability);
-  StoreObjectFieldNoWriteBarrier(
-      reaction, PromiseReaction::kFulfillHandlerOffset, fulfill_handler);
-  StoreObjectFieldNoWriteBarrier(
-      reaction, PromiseReaction::kRejectHandlerOffset, reject_handler);
-  return CAST(reaction);
-}
-
-TNode<PromiseReactionJobTask>
-PromiseBuiltinsAssembler::AllocatePromiseReactionJobTask(
-    TNode<Map> map, TNode<Context> context, TNode<Object> argument,
-    TNode<HeapObject> handler, TNode<HeapObject> promise_or_capability) {
-  TNode<HeapObject> const microtask =
-      Allocate(PromiseReactionJobTask::kSizeOfAllPromiseReactionJobTasks);
-  StoreMapNoWriteBarrier(microtask, map);
-  StoreObjectFieldNoWriteBarrier(
-      microtask, PromiseReactionJobTask::kArgumentOffset, argument);
-  StoreObjectFieldNoWriteBarrier(
-      microtask, PromiseReactionJobTask::kContextOffset, context);
-  StoreObjectFieldNoWriteBarrier(
-      microtask, PromiseReactionJobTask::kHandlerOffset, handler);
-  StoreObjectFieldNoWriteBarrier(
-      microtask, PromiseReactionJobTask::kPromiseOrCapabilityOffset,
-      promise_or_capability);
-  return CAST(microtask);
-}
-
-TNode<PromiseResolveThenableJobTask>
-PromiseBuiltinsAssembler::AllocatePromiseResolveThenableJobTask(
-    TNode<JSPromise> promise_to_resolve, TNode<JSReceiver> then,
-    TNode<JSReceiver> thenable, TNode<Context> context) {
-  const TNode<HeapObject> microtask =
-      Allocate(PromiseResolveThenableJobTask::kSize);
-  StoreMapNoWriteBarrier(microtask,
-                         RootIndex::kPromiseResolveThenableJobTaskMap);
-  StoreObjectFieldNoWriteBarrier(
-      microtask, PromiseResolveThenableJobTask::kContextOffset, context);
-  StoreObjectFieldNoWriteBarrier(
-      microtask, PromiseResolveThenableJobTask::kPromiseToResolveOffset,
-      promise_to_resolve);
-  StoreObjectFieldNoWriteBarrier(
-      microtask, PromiseResolveThenableJobTask::kThenOffset, then);
-  StoreObjectFieldNoWriteBarrier(
-      microtask, PromiseResolveThenableJobTask::kThenableOffset, thenable);
-  return CAST(microtask);
-}
-
-// ES #sec-triggerpromisereactions
-Node* PromiseBuiltinsAssembler::TriggerPromiseReactions(
-    Node* context, Node* reactions, Node* argument,
-    PromiseReaction::Type type) {
-  // We need to reverse the {reactions} here, since we record them on the
-  // JSPromise in the reverse order.
-  {
-    VARIABLE(var_current, MachineRepresentation::kTagged, reactions);
-    VARIABLE(var_reversed, MachineRepresentation::kTagged,
-             SmiConstant(Smi::zero()));
-
-    // As an additional safety net against misuse of the V8 Extras API, we
-    // sanity check the {reactions} to make sure that they are actually
-    // PromiseReaction instances and not actual JavaScript values (which
-    // would indicate that we're rejecting or resolving an already settled
-    // promise), see https://crbug.com/931640 for details on this.
-    TNode<Map> promise_reaction_map = PromiseReactionMapConstant();
-
-    Label loop(this, {&var_current, &var_reversed}), done_loop(this);
-    Goto(&loop);
-    BIND(&loop);
-    {
-      Node* current = var_current.value();
-      GotoIf(TaggedIsSmi(current), &done_loop);
-      CSA_CHECK(this,
-                TaggedEqual(LoadMap(CAST(current)), promise_reaction_map));
-      var_current.Bind(LoadObjectField(current, PromiseReaction::kNextOffset));
-      StoreObjectField(current, PromiseReaction::kNextOffset,
-                       var_reversed.value());
-      var_reversed.Bind(current);
-      Goto(&loop);
-    }
-    BIND(&done_loop);
-    reactions = var_reversed.value();
-  }
-
-  // Morph the {reactions} into PromiseReactionJobTasks and push them
-  // onto the microtask queue.
-  {
-    VARIABLE(var_current, MachineRepresentation::kTagged, reactions);
-
-    Label loop(this, {&var_current}), done_loop(this);
-    Goto(&loop);
-    BIND(&loop);
-    {
-      Node* current = var_current.value();
-      GotoIf(TaggedIsSmi(current), &done_loop);
-      var_current.Bind(LoadObjectField(current, PromiseReaction::kNextOffset));
-
-      VARIABLE(var_context, MachineRepresentation::kTagged,
-               UndefinedConstant());
-
-      Node* primary_handler;
-      Node* secondary_handler;
-      if (type == PromiseReaction::kFulfill) {
-        primary_handler =
-            LoadObjectField(current, PromiseReaction::kFulfillHandlerOffset);
-        secondary_handler =
-            LoadObjectField(current, PromiseReaction::kRejectHandlerOffset);
-      } else {
-        primary_handler =
-            LoadObjectField(current, PromiseReaction::kRejectHandlerOffset);
-        secondary_handler =
-            LoadObjectField(current, PromiseReaction::kFulfillHandlerOffset);
-      }
-
-      {
-        Label use_fallback(this, Label::kDeferred), done(this);
-        ExtractHandlerContext(primary_handler, &var_context);
-        Branch(IsUndefined(var_context.value()), &use_fallback, &done);
-
-        BIND(&use_fallback);
-        var_context.Bind(context);
-        ExtractHandlerContext(secondary_handler, &var_context);
-        CSA_ASSERT(this, IsNotUndefined(var_context.value()));
-        Goto(&done);
-
-        BIND(&done);
-      }
-
-      // Morph {current} from a PromiseReaction into a PromiseReactionJobTask
-      // and schedule that on the microtask queue. We try to minimize the number
-      // of stores here to avoid screwing up the store buffer.
-      STATIC_ASSERT(
-          static_cast<int>(PromiseReaction::kSize) ==
-          static_cast<int>(
-              PromiseReactionJobTask::kSizeOfAllPromiseReactionJobTasks));
-      if (type == PromiseReaction::kFulfill) {
-        StoreMapNoWriteBarrier(current,
-                               RootIndex::kPromiseFulfillReactionJobTaskMap);
-        StoreObjectField(current, PromiseReactionJobTask::kArgumentOffset,
-                         argument);
-        StoreObjectField(current, PromiseReactionJobTask::kContextOffset,
-                         var_context.value());
-        STATIC_ASSERT(
-            static_cast<int>(PromiseReaction::kFulfillHandlerOffset) ==
-            static_cast<int>(PromiseReactionJobTask::kHandlerOffset));
-        STATIC_ASSERT(
-            static_cast<int>(PromiseReaction::kPromiseOrCapabilityOffset) ==
-            static_cast<int>(
-                PromiseReactionJobTask::kPromiseOrCapabilityOffset));
-      } else {
-        StoreMapNoWriteBarrier(current,
-                               RootIndex::kPromiseRejectReactionJobTaskMap);
-        StoreObjectField(current, PromiseReactionJobTask::kArgumentOffset,
-                         argument);
-        StoreObjectField(current, PromiseReactionJobTask::kContextOffset,
-                         var_context.value());
-        StoreObjectField(current, PromiseReactionJobTask::kHandlerOffset,
-                         primary_handler);
-        STATIC_ASSERT(
-            static_cast<int>(PromiseReaction::kPromiseOrCapabilityOffset) ==
-            static_cast<int>(
-                PromiseReactionJobTask::kPromiseOrCapabilityOffset));
-      }
-      CallBuiltin(Builtins::kEnqueueMicrotask, var_context.value(), current);
-      Goto(&loop);
-    }
-    BIND(&done_loop);
-  }
-
-  return UndefinedConstant();
-}
-
-template <typename... TArgs>
-Node* PromiseBuiltinsAssembler::InvokeThen(Node* native_context, Node* receiver,
-                                           TArgs... args) {
-  CSA_ASSERT(this, IsNativeContext(native_context));
-
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-  Label if_fast(this), if_slow(this, Label::kDeferred), done(this, &var_result);
-  GotoIf(TaggedIsSmi(receiver), &if_slow);
-  TNode<Map> const receiver_map = LoadMap(receiver);
-  // We can skip the "then" lookup on {receiver} if it's [[Prototype]]
-  // is the (initial) Promise.prototype and the Promise#then protector
-  // is intact, as that guards the lookup path for the "then" property
-  // on JSPromise instances which have the (initial) %PromisePrototype%.
-  BranchIfPromiseThenLookupChainIntact(native_context, receiver_map, &if_fast,
-                                       &if_slow);
-
-  BIND(&if_fast);
-  {
-    TNode<Object> const then =
-        LoadContextElement(native_context, Context::PROMISE_THEN_INDEX);
-    Node* const result =
-        CallJS(CodeFactory::CallFunction(
-                   isolate(), ConvertReceiverMode::kNotNullOrUndefined),
-               native_context, then, receiver, args...);
-    var_result.Bind(result);
-    Goto(&done);
-  }
-
-  BIND(&if_slow);
-  {
-    TNode<Object> const then = GetProperty(native_context, receiver,
-                                           isolate()->factory()->then_string());
-    Node* const result = CallJS(
-        CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
-        native_context, then, receiver, args...);
-    var_result.Bind(result);
-    Goto(&done);
-  }
-
-  BIND(&done);
-  return var_result.value();
-}
-
-Node* PromiseBuiltinsAssembler::CallResolve(Node* native_context,
-                                            Node* constructor, Node* resolve,
-                                            Node* value, Label* if_exception,
-                                            Variable* var_exception) {
-  CSA_ASSERT(this, IsNativeContext(native_context));
-  CSA_ASSERT(this, IsConstructor(constructor));
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-  Label if_fast(this), if_slow(this, Label::kDeferred), done(this, &var_result);
-
-  // Undefined can never be a valid value for the resolve function,
-  // instead it is used as a special marker for the fast path.
-  Branch(IsUndefined(resolve), &if_fast, &if_slow);
-
-  BIND(&if_fast);
-  {
-    TNode<Object> const result = CallBuiltin(
-        Builtins::kPromiseResolve, native_context, constructor, value);
-    GotoIfException(result, if_exception, var_exception);
-
-    var_result.Bind(result);
-    Goto(&done);
-  }
-
-  BIND(&if_slow);
-  {
-    CSA_ASSERT(this, IsCallable(resolve));
-
-    Node* const result = CallJS(
-        CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
-        native_context, resolve, constructor, value);
-    GotoIfException(result, if_exception, var_exception);
-
-    var_result.Bind(result);
-    Goto(&done);
-  }
-
-  BIND(&done);
-  return var_result.value();
-}
-
-void PromiseBuiltinsAssembler::BranchIfPromiseResolveLookupChainIntact(
-    Node* native_context, SloppyTNode<Object> constructor, Label* if_fast,
-    Label* if_slow) {
-  CSA_ASSERT(this, IsNativeContext(native_context));
-
-  GotoIfForceSlowPath(if_slow);
-  TNode<Object> promise_fun =
-      LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
-  GotoIfNot(TaggedEqual(promise_fun, constructor), if_slow);
-  Branch(IsPromiseResolveProtectorCellInvalid(), if_slow, if_fast);
-}
-
-void PromiseBuiltinsAssembler::GotoIfNotPromiseResolveLookupChainIntact(
-    Node* native_context, SloppyTNode<Object> constructor, Label* if_slow) {
-  Label if_fast(this);
-  BranchIfPromiseResolveLookupChainIntact(native_context, constructor, &if_fast,
-                                          if_slow);
-  BIND(&if_fast);
-}
-
-void PromiseBuiltinsAssembler::BranchIfPromiseSpeciesLookupChainIntact(
-    Node* native_context, Node* promise_map, Label* if_fast, Label* if_slow) {
-  CSA_ASSERT(this, IsNativeContext(native_context));
-  CSA_ASSERT(this, IsJSPromiseMap(promise_map));
-
-  TNode<Object> promise_prototype =
-      LoadContextElement(native_context, Context::PROMISE_PROTOTYPE_INDEX);
-  GotoIfForceSlowPath(if_slow);
-  GotoIfNot(TaggedEqual(LoadMapPrototype(promise_map), promise_prototype),
-            if_slow);
-  Branch(IsPromiseSpeciesProtectorCellInvalid(), if_slow, if_fast);
-}
-
-void PromiseBuiltinsAssembler::BranchIfPromiseThenLookupChainIntact(
-    Node* native_context, Node* receiver_map, Label* if_fast, Label* if_slow) {
-  CSA_ASSERT(this, IsMap(receiver_map));
-  CSA_ASSERT(this, IsNativeContext(native_context));
-
-  GotoIfForceSlowPath(if_slow);
-  GotoIfNot(IsJSPromiseMap(receiver_map), if_slow);
-  TNode<Object> const promise_prototype =
-      LoadContextElement(native_context, Context::PROMISE_PROTOTYPE_INDEX);
-  GotoIfNot(TaggedEqual(LoadMapPrototype(receiver_map), promise_prototype),
-            if_slow);
-  Branch(IsPromiseThenProtectorCellInvalid(), if_slow, if_fast);
-}
-
-void PromiseBuiltinsAssembler::BranchIfAccessCheckFailed(
-    SloppyTNode<Context> context, SloppyTNode<Context> native_context,
-    Node* promise_constructor, Node* executor, Label* if_noaccess) {
-  VARIABLE(var_executor, MachineRepresentation::kTagged);
-  var_executor.Bind(executor);
-  Label has_access(this), call_runtime(this, Label::kDeferred);
-
-  // If executor is a bound function, load the bound function until we've
-  // reached an actual function.
-  Label found_function(this), loop_over_bound_function(this, &var_executor);
-  Goto(&loop_over_bound_function);
-  BIND(&loop_over_bound_function);
-  {
-    TNode<Uint16T> executor_type = LoadInstanceType(var_executor.value());
-    GotoIf(InstanceTypeEqual(executor_type, JS_FUNCTION_TYPE), &found_function);
-    GotoIfNot(InstanceTypeEqual(executor_type, JS_BOUND_FUNCTION_TYPE),
-              &call_runtime);
-    var_executor.Bind(LoadObjectField(
-        var_executor.value(), JSBoundFunction::kBoundTargetFunctionOffset));
-    Goto(&loop_over_bound_function);
-  }
-
-  // Load the context from the function and compare it to the Promise
-  // constructor's context. If they match, everything is fine, otherwise, bail
-  // out to the runtime.
-  BIND(&found_function);
-  {
-    TNode<Context> function_context =
-        CAST(LoadObjectField(var_executor.value(), JSFunction::kContextOffset));
-    TNode<NativeContext> native_function_context =
-        LoadNativeContext(function_context);
-    Branch(TaggedEqual(native_context, native_function_context), &has_access,
-           &call_runtime);
-  }
-
-  BIND(&call_runtime);
-  {
-    Branch(TaggedEqual(CallRuntime(Runtime::kAllowDynamicFunction, context,
-                                   promise_constructor),
-                       TrueConstant()),
-           &has_access, if_noaccess);
-  }
-
-  BIND(&has_access);
-}
-
-void PromiseBuiltinsAssembler::SetForwardingHandlerIfTrue(
-    Node* context, Node* condition, const NodeGenerator& object) {
-  Label done(this);
-  GotoIfNot(condition, &done);
-  SetPropertyStrict(
-      CAST(context), CAST(object()),
-      HeapConstant(factory()->promise_forwarding_handler_symbol()),
-      TrueConstant());
-  Goto(&done);
-  BIND(&done);
+  return Allocate(PromiseReactionJobTask::kSizeOfAllPromiseReactionJobTasks);
 }
 
-void PromiseBuiltinsAssembler::SetPromiseHandledByIfTrue(
-    Node* context, Node* condition, Node* promise,
-    const NodeGenerator& handled_by) {
-  Label done(this);
-  GotoIfNot(condition, &done);
-  GotoIf(TaggedIsSmi(promise), &done);
-  GotoIfNot(HasInstanceType(promise, JS_PROMISE_TYPE), &done);
-  SetPropertyStrict(CAST(context), CAST(promise),
-                    HeapConstant(factory()->promise_handled_by_symbol()),
-                    CAST(handled_by()));
-  Goto(&done);
-  BIND(&done);
-}
-
-// ES #sec-promise-reject-functions
-TF_BUILTIN(PromiseCapabilityDefaultReject, PromiseBuiltinsAssembler) {
-  Node* const reason = Parameter(Descriptor::kReason);
-  Node* const context = Parameter(Descriptor::kContext);
-
-  // 2. Let promise be F.[[Promise]].
-  TNode<Object> const promise =
-      LoadContextElement(context, PromiseBuiltins::kPromiseSlot);
-
-  // 3. Let alreadyResolved be F.[[AlreadyResolved]].
-  Label if_already_resolved(this, Label::kDeferred);
-  TNode<Object> const already_resolved =
-      LoadContextElement(context, PromiseBuiltins::kAlreadyResolvedSlot);
-
-  // 4. If alreadyResolved.[[Value]] is true, return undefined.
-  GotoIf(IsTrue(already_resolved), &if_already_resolved);
-
-  // 5. Set alreadyResolved.[[Value]] to true.
-  StoreContextElementNoWriteBarrier(
-      context, PromiseBuiltins::kAlreadyResolvedSlot, TrueConstant());
-
-  // 6. Return RejectPromise(promise, reason).
-  TNode<Object> const debug_event =
-      LoadContextElement(context, PromiseBuiltins::kDebugEventSlot);
-  Return(CallBuiltin(Builtins::kRejectPromise, context, promise, reason,
-                     debug_event));
-
-  BIND(&if_already_resolved);
-  {
-    Return(CallRuntime(Runtime::kPromiseRejectAfterResolved, context, promise,
-                       reason));
-  }
-}
-
-// ES #sec-promise-resolve-functions
-TF_BUILTIN(PromiseCapabilityDefaultResolve, PromiseBuiltinsAssembler) {
-  Node* const resolution = Parameter(Descriptor::kResolution);
-  Node* const context = Parameter(Descriptor::kContext);
-
-  // 2. Let promise be F.[[Promise]].
-  TNode<Object> const promise =
-      LoadContextElement(context, PromiseBuiltins::kPromiseSlot);
-
-  // 3. Let alreadyResolved be F.[[AlreadyResolved]].
-  Label if_already_resolved(this, Label::kDeferred);
-  TNode<Object> const already_resolved =
-      LoadContextElement(context, PromiseBuiltins::kAlreadyResolvedSlot);
-
-  // 4. If alreadyResolved.[[Value]] is true, return undefined.
-  GotoIf(IsTrue(already_resolved), &if_already_resolved);
-
-  // 5. Set alreadyResolved.[[Value]] to true.
-  StoreContextElementNoWriteBarrier(
-      context, PromiseBuiltins::kAlreadyResolvedSlot, TrueConstant());
-
-  // The rest of the logic (and the catch prediction) is
-  // encapsulated in the dedicated ResolvePromise builtin.
-  Return(CallBuiltin(Builtins::kResolvePromise, context, promise, resolution));
-
-  BIND(&if_already_resolved);
-  {
-    Return(CallRuntime(Runtime::kPromiseResolveAfterResolved, context, promise,
-                       resolution));
-  }
-}
-
-TF_BUILTIN(PromiseConstructorLazyDeoptContinuation, PromiseBuiltinsAssembler) {
-  Node* promise = Parameter(Descriptor::kPromise);
-  Node* reject = Parameter(Descriptor::kReject);
-  Node* exception = Parameter(Descriptor::kException);
-  Node* const context = Parameter(Descriptor::kContext);
-
-  Label finally(this);
-
-  GotoIf(IsTheHole(exception), &finally);
-  CallJS(CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
-         context, reject, UndefinedConstant(), exception);
-  Goto(&finally);
-
-  BIND(&finally);
-  Return(promise);
-}
-
-// ES6 #sec-promise-executor
-TF_BUILTIN(PromiseConstructor, PromiseBuiltinsAssembler) {
-  TNode<Object> executor = CAST(Parameter(Descriptor::kExecutor));
-  TNode<Object> new_target = CAST(Parameter(Descriptor::kJSNewTarget));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  Isolate* isolate = this->isolate();
-
-  Label if_targetisundefined(this, Label::kDeferred);
-
-  GotoIf(IsUndefined(new_target), &if_targetisundefined);
-
-  Label if_notcallable(this, Label::kDeferred);
-
-  GotoIf(TaggedIsSmi(executor), &if_notcallable);
-
-  TNode<Map> const executor_map = LoadMap(CAST(executor));
-  GotoIfNot(IsCallableMap(executor_map), &if_notcallable);
-
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<JSFunction> const promise_fun =
-      CAST(LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX));
-  Node* const is_debug_active = IsDebugActive();
-  Label if_targetisnotmodified(this),
-      if_targetismodified(this, Label::kDeferred), run_executor(this),
-      debug_push(this), if_noaccess(this, Label::kDeferred);
-
-  BranchIfAccessCheckFailed(context, native_context, promise_fun, executor,
-                            &if_noaccess);
-
-  Branch(TaggedEqual(promise_fun, new_target), &if_targetisnotmodified,
-         &if_targetismodified);
-
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-  VARIABLE(var_reject_call, MachineRepresentation::kTagged);
-  VARIABLE(var_reason, MachineRepresentation::kTagged);
-
-  BIND(&if_targetisnotmodified);
-  {
-    TNode<JSPromise> const instance = AllocateAndInitJSPromise(context);
-    var_result.Bind(instance);
-    Goto(&debug_push);
-  }
-
-  BIND(&if_targetismodified);
-  {
-    ConstructorBuiltinsAssembler constructor_assembler(this->state());
-    TNode<JSObject> instance = constructor_assembler.EmitFastNewObject(
-        context, promise_fun, CAST(new_target));
-    PromiseInit(instance);
-    var_result.Bind(instance);
-
-    GotoIfNot(IsPromiseHookEnabledOrHasAsyncEventDelegate(), &debug_push);
-    CallRuntime(Runtime::kPromiseHookInit, context, instance,
-                UndefinedConstant());
-    Goto(&debug_push);
-  }
-
-  BIND(&debug_push);
-  {
-    GotoIfNot(is_debug_active, &run_executor);
-    CallRuntime(Runtime::kDebugPushPromise, context, var_result.value());
-    Goto(&run_executor);
-  }
-
-  BIND(&run_executor);
-  {
-    Label out(this), if_rejectpromise(this), debug_pop(this, Label::kDeferred);
-
-    Node *resolve, *reject;
-    std::tie(resolve, reject) = CreatePromiseResolvingFunctions(
-        CAST(var_result.value()), TrueConstant(), native_context);
-
-    Node* const maybe_exception = CallJS(
-        CodeFactory::Call(isolate, ConvertReceiverMode::kNullOrUndefined),
-        context, executor, UndefinedConstant(), resolve, reject);
-
-    GotoIfException(maybe_exception, &if_rejectpromise, &var_reason);
-    Branch(is_debug_active, &debug_pop, &out);
-
-    BIND(&if_rejectpromise);
-    {
-      CallJS(CodeFactory::Call(isolate, ConvertReceiverMode::kNullOrUndefined),
-             context, reject, UndefinedConstant(), var_reason.value());
-      Branch(is_debug_active, &debug_pop, &out);
-    }
-
-    BIND(&debug_pop);
-    {
-      CallRuntime(Runtime::kDebugPopPromise, context);
-      Goto(&out);
-    }
-    BIND(&out);
-    Return(var_result.value());
-  }
-
-  // 1. If NewTarget is undefined, throw a TypeError exception.
-  BIND(&if_targetisundefined);
-  ThrowTypeError(context, MessageTemplate::kNotAPromise, new_target);
-
-  // 2. If IsCallable(executor) is false, throw a TypeError exception.
-  BIND(&if_notcallable);
-  ThrowTypeError(context, MessageTemplate::kResolverNotAFunction, executor);
-
-  // Silently fail if the stack looks fishy.
-  BIND(&if_noaccess);
-  {
-    TNode<Smi> const counter_id =
-        SmiConstant(v8::Isolate::kPromiseConstructorReturnedUndefined);
-    CallRuntime(Runtime::kIncrementUseCounter, context, counter_id);
-    Return(UndefinedConstant());
-  }
-}
-
-// V8 Extras: v8.createPromise(parent)
-TF_BUILTIN(PromiseInternalConstructor, PromiseBuiltinsAssembler) {
-  const TNode<Object> parent = CAST(Parameter(Descriptor::kParent));
-  const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  Return(AllocateAndInitJSPromise(context, parent));
-}
-
-// V8 Extras: v8.rejectPromise(promise, reason)
-TF_BUILTIN(PromiseInternalReject, PromiseBuiltinsAssembler) {
-  Node* const promise = Parameter(Descriptor::kPromise);
-  Node* const reason = Parameter(Descriptor::kReason);
-  Node* const context = Parameter(Descriptor::kContext);
-
-  // Main V8 Extras invariant that {promise} is still "pending" at
-  // this point, aka that {promise} is not resolved multiple times.
-  Label if_promise_is_settled(this, Label::kDeferred);
-  GotoIfNot(IsPromiseStatus(PromiseStatus(promise), v8::Promise::kPending),
-            &if_promise_is_settled);
-
-  // We pass true to trigger the debugger's on exception handler.
-  Return(CallBuiltin(Builtins::kRejectPromise, context, promise, reason,
-                     TrueConstant()));
-
-  BIND(&if_promise_is_settled);
-  Abort(AbortReason::kPromiseAlreadySettled);
-}
-
-// V8 Extras: v8.resolvePromise(promise, resolution)
-TF_BUILTIN(PromiseInternalResolve, PromiseBuiltinsAssembler) {
-  Node* const promise = Parameter(Descriptor::kPromise);
-  Node* const resolution = Parameter(Descriptor::kResolution);
-  Node* const context = Parameter(Descriptor::kContext);
-
-  // Main V8 Extras invariant that {promise} is still "pending" at
-  // this point, aka that {promise} is not resolved multiple times.
-  Label if_promise_is_settled(this, Label::kDeferred);
-  GotoIfNot(IsPromiseStatus(PromiseStatus(promise), v8::Promise::kPending),
-            &if_promise_is_settled);
-
-  Return(CallBuiltin(Builtins::kResolvePromise, context, promise, resolution));
-
-  BIND(&if_promise_is_settled);
-  Abort(AbortReason::kPromiseAlreadySettled);
-}
-
-// ES#sec-promise.prototype.then
-// Promise.prototype.then ( onFulfilled, onRejected )
-TF_BUILTIN(PromisePrototypeThen, PromiseBuiltinsAssembler) {
-  // 1. Let promise be the this value.
-  const TNode<Object> maybe_promise = CAST(Parameter(Descriptor::kReceiver));
-  const TNode<Object> on_fulfilled = CAST(Parameter(Descriptor::kOnFulfilled));
-  const TNode<Object> on_rejected = CAST(Parameter(Descriptor::kOnRejected));
-  const TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  // 2. If IsPromise(promise) is false, throw a TypeError exception.
-  ThrowIfNotInstanceType(context, maybe_promise, JS_PROMISE_TYPE,
-                         "Promise.prototype.then");
-  TNode<JSPromise> js_promise = CAST(maybe_promise);
-
-  // 3. Let C be ? SpeciesConstructor(promise, %Promise%).
-  Label fast_promise_capability(this), slow_constructor(this, Label::kDeferred),
-      slow_promise_capability(this, Label::kDeferred);
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<JSFunction> promise_fun =
-      CAST(LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX));
-  TNode<Map> const promise_map = LoadMap(js_promise);
-  BranchIfPromiseSpeciesLookupChainIntact(
-      native_context, promise_map, &fast_promise_capability, &slow_constructor);
-
-  BIND(&slow_constructor);
-  TNode<JSReceiver> constructor =
-      SpeciesConstructor(native_context, js_promise, promise_fun);
-  Branch(TaggedEqual(constructor, promise_fun), &fast_promise_capability,
-         &slow_promise_capability);
-
-  // 4. Let resultCapability be ? NewPromiseCapability(C).
-  Label perform_promise_then(this);
-  TVARIABLE(Object, var_result_promise);
-  TVARIABLE(HeapObject, var_result_promise_or_capability);
-
-  BIND(&fast_promise_capability);
-  {
-    const TNode<JSPromise> result_promise =
-        AllocateAndInitJSPromise(context, js_promise);
-    var_result_promise_or_capability = result_promise;
-    var_result_promise = result_promise;
-    Goto(&perform_promise_then);
-  }
-
-  BIND(&slow_promise_capability);
-  {
-    TNode<Oddball> const debug_event = TrueConstant();
-    TNode<PromiseCapability> const capability = CAST(CallBuiltin(
-        Builtins::kNewPromiseCapability, context, constructor, debug_event));
-    var_result_promise =
-        LoadObjectField(capability, PromiseCapability::kPromiseOffset);
-    var_result_promise_or_capability = capability;
-    Goto(&perform_promise_then);
-  }
-
-  // 5. Return PerformPromiseThen(promise, onFulfilled, onRejected,
-  //    resultCapability).
-  BIND(&perform_promise_then);
-  {
-    // We do some work of the PerformPromiseThen operation here, in that
-    // we check the handlers and turn non-callable handlers into undefined.
-    // This is because this is the one and only callsite of PerformPromiseThen
-    // that has to do this.
-
-    // 3. If IsCallable(onFulfilled) is false, then
-    //    a. Set onFulfilled to undefined.
-    TVARIABLE(Object, var_on_fulfilled, on_fulfilled);
-    Label if_fulfilled_done(this), if_fulfilled_notcallable(this);
-    GotoIf(TaggedIsSmi(on_fulfilled), &if_fulfilled_notcallable);
-    Branch(IsCallable(CAST(on_fulfilled)), &if_fulfilled_done,
-           &if_fulfilled_notcallable);
-    BIND(&if_fulfilled_notcallable);
-    var_on_fulfilled = UndefinedConstant();
-    Goto(&if_fulfilled_done);
-    BIND(&if_fulfilled_done);
-
-    // 4. If IsCallable(onRejected) is false, then
-    //    a. Set onRejected to undefined.
-    TVARIABLE(Object, var_on_rejected, on_rejected);
-    Label if_rejected_done(this), if_rejected_notcallable(this);
-    GotoIf(TaggedIsSmi(on_rejected), &if_rejected_notcallable);
-    Branch(IsCallable(CAST(on_rejected)), &if_rejected_done,
-           &if_rejected_notcallable);
-    BIND(&if_rejected_notcallable);
-    var_on_rejected = UndefinedConstant();
-    Goto(&if_rejected_done);
-    BIND(&if_rejected_done);
-
-    PerformPromiseThen(context, js_promise, CAST(var_on_fulfilled.value()),
-                       CAST(var_on_rejected.value()),
-                       var_result_promise_or_capability.value());
-    Return(var_result_promise.value());
-  }
-}
-
-// ES#sec-promise.prototype.catch
-// Promise.prototype.catch ( onRejected )
-TF_BUILTIN(PromisePrototypeCatch, PromiseBuiltinsAssembler) {
-  // 1. Let promise be the this value.
-  Node* const receiver = Parameter(Descriptor::kReceiver);
-  TNode<Oddball> const on_fulfilled = UndefinedConstant();
-  Node* const on_rejected = Parameter(Descriptor::kOnRejected);
-  Node* const context = Parameter(Descriptor::kContext);
-
-  // 2. Return ? Invoke(promise, "then", « undefined, onRejected »).
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  Return(InvokeThen(native_context, receiver, on_fulfilled, on_rejected));
-}
-
-// ES #sec-promiseresolvethenablejob
-TF_BUILTIN(PromiseResolveThenableJob, PromiseBuiltinsAssembler) {
-  TNode<NativeContext> native_context = CAST(Parameter(Descriptor::kContext));
-  TNode<JSPromise> promise_to_resolve =
-      CAST(Parameter(Descriptor::kPromiseToResolve));
-  TNode<JSReceiver> thenable = CAST(Parameter(Descriptor::kThenable));
-  TNode<Object> then = CAST(Parameter(Descriptor::kThen));
-
-  // We can use a simple optimization here if we know that {then} is the initial
-  // Promise.prototype.then method, and {thenable} is a JSPromise whose
-  // @@species lookup chain is intact: We can connect {thenable} and
-  // {promise_to_resolve} directly in that case and avoid the allocation of a
-  // temporary JSPromise and the closures plus context.
-  //
-  // We take the generic (slow-)path if a PromiseHook is enabled or the debugger
-  // is active, to make sure we expose spec compliant behavior.
-  Label if_fast(this), if_slow(this, Label::kDeferred);
-  TNode<Object> promise_then =
-      LoadContextElement(native_context, Context::PROMISE_THEN_INDEX);
-  GotoIfNot(TaggedEqual(then, promise_then), &if_slow);
-  TNode<Map> const thenable_map = LoadMap(thenable);
-  GotoIfNot(IsJSPromiseMap(thenable_map), &if_slow);
-  GotoIf(IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate(),
-         &if_slow);
-  BranchIfPromiseSpeciesLookupChainIntact(native_context, thenable_map,
-                                          &if_fast, &if_slow);
-
-  BIND(&if_fast);
-  {
-    // We know that the {thenable} is a JSPromise, which doesn't require
-    // any special treatment and that {then} corresponds to the initial
-    // Promise.prototype.then method. So instead of allocating a temporary
-    // JSPromise to connect the {thenable} with the {promise_to_resolve},
-    // we can directly schedule the {promise_to_resolve} with default
-    // handlers onto the {thenable} promise. This does not only save the
-    // JSPromise allocation, but also avoids the allocation of the two
-    // resolving closures and the shared context.
-    //
-    // What happens normally in this case is
-    //
-    //   resolve, reject = CreateResolvingFunctions(promise_to_resolve)
-    //   result_capability = NewPromiseCapability(%Promise%)
-    //   PerformPromiseThen(thenable, resolve, reject, result_capability)
-    //
-    // which means that PerformPromiseThen will either schedule a new
-    // PromiseReaction with resolve and reject or a PromiseReactionJob
-    // with resolve or reject based on the state of {thenable}. And
-    // resolve or reject will just invoke the default [[Resolve]] or
-    // [[Reject]] functions on the {promise_to_resolve}.
-    //
-    // This is the same as just doing
-    //
-    //   PerformPromiseThen(thenable, undefined, undefined, promise_to_resolve)
-    //
-    // which performs exactly the same (observable) steps.
-    TailCallBuiltin(Builtins::kPerformPromiseThen, native_context, thenable,
-                    UndefinedConstant(), UndefinedConstant(),
-                    promise_to_resolve);
-  }
-
-  BIND(&if_slow);
-  {
-    Node* resolve = nullptr;
-    Node* reject = nullptr;
-    std::tie(resolve, reject) = CreatePromiseResolvingFunctions(
-        promise_to_resolve, FalseConstant(), native_context);
-
-    Label if_exception(this, Label::kDeferred);
-    VARIABLE(var_exception, MachineRepresentation::kTagged, TheHoleConstant());
-    Node* const result = CallJS(
-        CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
-        native_context, then, thenable, resolve, reject);
-    GotoIfException(result, &if_exception, &var_exception);
-    Return(result);
-
-    BIND(&if_exception);
-    {
-      // We need to reject the {thenable}.
-      Node* const result = CallJS(
-          CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-          native_context, reject, UndefinedConstant(), var_exception.value());
-      Return(result);
-    }
-  }
-}
-
-// ES #sec-promisereactionjob
-void PromiseBuiltinsAssembler::PromiseReactionJob(Node* context, Node* argument,
-                                                  Node* handler,
-                                                  Node* promise_or_capability,
-                                                  PromiseReaction::Type type) {
-  CSA_ASSERT(this, TaggedIsNotSmi(handler));
-  CSA_ASSERT(this, Word32Or(IsUndefined(handler), IsCallable(handler)));
-  CSA_ASSERT(this, TaggedIsNotSmi(promise_or_capability));
-  CSA_ASSERT(this,
-             Word32Or(Word32Or(IsJSPromise(promise_or_capability),
-                               IsPromiseCapability(promise_or_capability)),
-                      IsUndefined(promise_or_capability)));
-
-  VARIABLE(var_handler_result, MachineRepresentation::kTagged, argument);
-  Label if_handler_callable(this), if_fulfill(this), if_reject(this),
-      if_internal(this);
-  Branch(IsUndefined(handler),
-         type == PromiseReaction::kFulfill ? &if_fulfill : &if_reject,
-         &if_handler_callable);
-
-  BIND(&if_handler_callable);
-  {
-    Node* const result = CallJS(
-        CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-        context, handler, UndefinedConstant(), argument);
-    GotoIfException(result, &if_reject, &var_handler_result);
-    var_handler_result.Bind(result);
-    Branch(IsUndefined(promise_or_capability), &if_internal, &if_fulfill);
-  }
-
-  BIND(&if_internal);
-  {
-    // There's no [[Capability]] for this promise reaction job, which
-    // means that this is a specification-internal operation (aka await)
-    // where the result does not matter (see the specification change in
-    // https://github.com/tc39/ecma262/pull/1146 for details).
-    Return(UndefinedConstant());
-  }
-
-  BIND(&if_fulfill);
-  {
-    Label if_promise(this), if_promise_capability(this, Label::kDeferred);
-    Node* const value = var_handler_result.value();
-    Branch(IsPromiseCapability(promise_or_capability), &if_promise_capability,
-           &if_promise);
-
-    BIND(&if_promise);
-    {
-      // For fast native promises we can skip the indirection
-      // via the promiseCapability.[[Resolve]] function and
-      // run the resolve logic directly from here.
-      TailCallBuiltin(Builtins::kResolvePromise, context, promise_or_capability,
-                      value);
-    }
-
-    BIND(&if_promise_capability);
-    {
-      // In the general case we need to call the (user provided)
-      // promiseCapability.[[Resolve]] function.
-      TNode<Object> const resolve = LoadObjectField(
-          promise_or_capability, PromiseCapability::kResolveOffset);
-      Node* const result = CallJS(
-          CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-          context, resolve, UndefinedConstant(), value);
-      GotoIfException(result, &if_reject, &var_handler_result);
-      Return(result);
-    }
-  }
-
-  BIND(&if_reject);
-  if (type == PromiseReaction::kReject) {
-    Label if_promise(this), if_promise_capability(this, Label::kDeferred);
-    Node* const reason = var_handler_result.value();
-    Branch(IsPromiseCapability(promise_or_capability), &if_promise_capability,
-           &if_promise);
-
-    BIND(&if_promise);
-    {
-      // For fast native promises we can skip the indirection
-      // via the promiseCapability.[[Reject]] function and
-      // run the resolve logic directly from here.
-      TailCallBuiltin(Builtins::kRejectPromise, context, promise_or_capability,
-                      reason, FalseConstant());
-    }
-
-    BIND(&if_promise_capability);
-    {
-      // In the general case we need to call the (user provided)
-      // promiseCapability.[[Reject]] function.
-      Label if_exception(this, Label::kDeferred);
-      VARIABLE(var_exception, MachineRepresentation::kTagged,
-               TheHoleConstant());
-      TNode<Object> const reject = LoadObjectField(
-          promise_or_capability, PromiseCapability::kRejectOffset);
-      Node* const result = CallJS(
-          CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-          context, reject, UndefinedConstant(), reason);
-      GotoIfException(result, &if_exception, &var_exception);
-      Return(result);
-
-      // Swallow the exception here.
-      BIND(&if_exception);
-      TailCallRuntime(Runtime::kReportMessage, context, var_exception.value());
-    }
-  } else {
-    // We have to call out to the dedicated PromiseRejectReactionJob builtin
-    // here, instead of just doing the work inline, as otherwise the catch
-    // predictions in the debugger will be wrong, which just walks the stack
-    // and checks for certain builtins.
-    TailCallBuiltin(Builtins::kPromiseRejectReactionJob, context,
-                    var_handler_result.value(), UndefinedConstant(),
-                    promise_or_capability);
-  }
-}
-
-// ES #sec-promisereactionjob
-TF_BUILTIN(PromiseFulfillReactionJob, PromiseBuiltinsAssembler) {
-  Node* const context = Parameter(Descriptor::kContext);
-  Node* const value = Parameter(Descriptor::kValue);
-  Node* const handler = Parameter(Descriptor::kHandler);
-  Node* const promise_or_capability =
-      Parameter(Descriptor::kPromiseOrCapability);
-
-  PromiseReactionJob(context, value, handler, promise_or_capability,
-                     PromiseReaction::kFulfill);
-}
-
-// ES #sec-promisereactionjob
-TF_BUILTIN(PromiseRejectReactionJob, PromiseBuiltinsAssembler) {
-  Node* const context = Parameter(Descriptor::kContext);
-  Node* const reason = Parameter(Descriptor::kReason);
-  Node* const handler = Parameter(Descriptor::kHandler);
-  Node* const promise_or_capability =
-      Parameter(Descriptor::kPromiseOrCapability);
-
-  PromiseReactionJob(context, reason, handler, promise_or_capability,
-                     PromiseReaction::kReject);
-}
-
-TF_BUILTIN(PromiseResolveTrampoline, PromiseBuiltinsAssembler) {
-  //  1. Let C be the this value.
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* value = Parameter(Descriptor::kValue);
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  // 2. If Type(C) is not Object, throw a TypeError exception.
-  ThrowIfNotJSReceiver(context, CAST(receiver),
-                       MessageTemplate::kCalledOnNonObject, "PromiseResolve");
-
-  // 3. Return ? PromiseResolve(C, x).
-  Return(CallBuiltin(Builtins::kPromiseResolve, context, receiver, value));
-}
-
-TF_BUILTIN(PromiseResolve, PromiseBuiltinsAssembler) {
-  TNode<JSReceiver> constructor = CAST(Parameter(Descriptor::kConstructor));
-  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<JSFunction> promise_fun =
-      CAST(LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX));
-
-  Label if_slow_constructor(this, Label::kDeferred), if_need_to_allocate(this);
-
-  // Check if {value} is a JSPromise.
-  GotoIf(TaggedIsSmi(value), &if_need_to_allocate);
-  TNode<Map> const value_map = LoadMap(CAST(value));
-  GotoIfNot(IsJSPromiseMap(value_map), &if_need_to_allocate);
-
-  // We can skip the "constructor" lookup on {value} if it's [[Prototype]]
-  // is the (initial) Promise.prototype and the @@species protector is
-  // intact, as that guards the lookup path for "constructor" on
-  // JSPromise instances which have the (initial) Promise.prototype.
-  TNode<Object> promise_prototype =
-      LoadContextElement(native_context, Context::PROMISE_PROTOTYPE_INDEX);
-  GotoIfNot(TaggedEqual(LoadMapPrototype(value_map), promise_prototype),
-            &if_slow_constructor);
-  GotoIf(IsPromiseSpeciesProtectorCellInvalid(), &if_slow_constructor);
-
-  // If the {constructor} is the Promise function, we just immediately
-  // return the {value} here and don't bother wrapping it into a
-  // native Promise.
-  GotoIfNot(TaggedEqual(promise_fun, constructor), &if_slow_constructor);
-  Return(value);
-
-  // At this point, value or/and constructor are not native promises, but
-  // they could be of the same subclass.
-  BIND(&if_slow_constructor);
-  {
-    TNode<Object> value_constructor =
-        GetProperty(context, value, isolate()->factory()->constructor_string());
-    GotoIfNot(TaggedEqual(value_constructor, constructor),
-              &if_need_to_allocate);
-    Return(value);
-  }
-
-  BIND(&if_need_to_allocate);
-  {
-    Label if_nativepromise(this), if_notnativepromise(this, Label::kDeferred);
-    Branch(TaggedEqual(promise_fun, constructor), &if_nativepromise,
-           &if_notnativepromise);
-
-    // This adds a fast path for native promises that don't need to
-    // create NewPromiseCapability.
-    BIND(&if_nativepromise);
-    {
-      TNode<JSPromise> const result = AllocateAndInitJSPromise(context);
-      CallBuiltin(Builtins::kResolvePromise, context, result, value);
-      Return(result);
-    }
-
-    BIND(&if_notnativepromise);
-    {
-      TNode<Oddball> const debug_event = TrueConstant();
-      TNode<PromiseCapability> const capability = CAST(CallBuiltin(
-          Builtins::kNewPromiseCapability, context, constructor, debug_event));
-
-      TNode<Object> const resolve =
-          LoadObjectField(capability, PromiseCapability::kResolveOffset);
-      CallJS(
-          CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-          context, resolve, UndefinedConstant(), value);
-
-      TNode<Object> const result =
-          LoadObjectField(capability, PromiseCapability::kPromiseOffset);
-      Return(result);
-    }
-  }
-}
-
-// ES6 #sec-getcapabilitiesexecutor-functions
-TF_BUILTIN(PromiseGetCapabilitiesExecutor, PromiseBuiltinsAssembler) {
-  Node* const resolve = Parameter(Descriptor::kResolve);
-  Node* const reject = Parameter(Descriptor::kReject);
-  Node* const context = Parameter(Descriptor::kContext);
-
-  TNode<PromiseCapability> const capability =
-      CAST(LoadContextElement(context, PromiseBuiltins::kCapabilitySlot));
-
-  Label if_alreadyinvoked(this, Label::kDeferred);
-  GotoIfNot(IsUndefined(
-                LoadObjectField(capability, PromiseCapability::kResolveOffset)),
-            &if_alreadyinvoked);
-  GotoIfNot(IsUndefined(
-                LoadObjectField(capability, PromiseCapability::kRejectOffset)),
-            &if_alreadyinvoked);
-
-  StoreObjectField(capability, PromiseCapability::kResolveOffset, resolve);
-  StoreObjectField(capability, PromiseCapability::kRejectOffset, reject);
-
-  Return(UndefinedConstant());
-
-  BIND(&if_alreadyinvoked);
-  ThrowTypeError(context, MessageTemplate::kPromiseExecutorAlreadyInvoked);
-}
-
-TF_BUILTIN(PromiseReject, PromiseBuiltinsAssembler) {
-  // 1. Let C be the this value.
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  TNode<Object> reason = CAST(Parameter(Descriptor::kReason));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  // 2. If Type(C) is not Object, throw a TypeError exception.
-  ThrowIfNotJSReceiver(context, receiver, MessageTemplate::kCalledOnNonObject,
-                       "PromiseReject");
-
-  Label if_nativepromise(this), if_custompromise(this, Label::kDeferred);
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-
-  TNode<Object> promise_fun =
-      LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
-  Branch(TaggedEqual(promise_fun, receiver), &if_nativepromise,
-         &if_custompromise);
-
-  BIND(&if_nativepromise);
-  {
-    TNode<JSPromise> const promise =
-        AllocateAndSetJSPromise(context, v8::Promise::kRejected, reason);
-    CallRuntime(Runtime::kPromiseRejectEventFromStack, context, promise,
-                reason);
-    Return(promise);
-  }
-
-  BIND(&if_custompromise);
-  {
-    // 3. Let promiseCapability be ? NewPromiseCapability(C).
-    TNode<Oddball> const debug_event = TrueConstant();
-    TNode<PromiseCapability> const capability = CAST(CallBuiltin(
-        Builtins::kNewPromiseCapability, context, receiver, debug_event));
-
-    // 4. Perform ? Call(promiseCapability.[[Reject]], undefined, « r »).
-    TNode<Object> const reject =
-        LoadObjectField(capability, PromiseCapability::kRejectOffset);
-    CallJS(CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-           context, reject, UndefinedConstant(), reason);
-
-    // 5. Return promiseCapability.[[Promise]].
-    TNode<Object> const promise =
-        LoadObjectField(capability, PromiseCapability::kPromiseOffset);
-    Return(promise);
-  }
-}
-
-std::pair<Node*, Node*> PromiseBuiltinsAssembler::CreatePromiseFinallyFunctions(
-    Node* on_finally, Node* constructor, Node* native_context) {
-  const TNode<Context> promise_context = CreatePromiseContext(
-      CAST(native_context), PromiseBuiltins::kPromiseFinallyContextLength);
-  StoreContextElementNoWriteBarrier(
-      promise_context, PromiseBuiltins::kOnFinallySlot, on_finally);
-  StoreContextElementNoWriteBarrier(
-      promise_context, PromiseBuiltins::kConstructorSlot, constructor);
-  const TNode<Map> map = CAST(LoadContextElement(
-      native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX));
-  const TNode<SharedFunctionInfo> then_finally_info = CAST(LoadContextElement(
-      native_context, Context::PROMISE_THEN_FINALLY_SHARED_FUN));
-  TNode<JSFunction> const then_finally = AllocateFunctionWithMapAndContext(
-      map, then_finally_info, promise_context);
-  const TNode<SharedFunctionInfo> catch_finally_info = CAST(LoadContextElement(
-      native_context, Context::PROMISE_CATCH_FINALLY_SHARED_FUN));
-  TNode<JSFunction> const catch_finally = AllocateFunctionWithMapAndContext(
-      map, catch_finally_info, promise_context);
-  return std::make_pair(then_finally, catch_finally);
-}
-
-TF_BUILTIN(PromiseValueThunkFinally, PromiseBuiltinsAssembler) {
-  Node* const context = Parameter(Descriptor::kContext);
-
-  TNode<Object> const value =
-      LoadContextElement(context, PromiseBuiltins::kValueSlot);
-  Return(value);
-}
-
-Node* PromiseBuiltinsAssembler::CreateValueThunkFunction(Node* value,
-                                                         Node* native_context) {
-  const TNode<Context> value_thunk_context = CreatePromiseContext(
-      CAST(native_context),
-      PromiseBuiltins::kPromiseValueThunkOrReasonContextLength);
-  StoreContextElementNoWriteBarrier(value_thunk_context,
-                                    PromiseBuiltins::kValueSlot, value);
-  const TNode<Map> map = CAST(LoadContextElement(
-      native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX));
-  const TNode<SharedFunctionInfo> value_thunk_info = CAST(LoadContextElement(
-      native_context, Context::PROMISE_VALUE_THUNK_FINALLY_SHARED_FUN));
-  TNode<JSFunction> const value_thunk = AllocateFunctionWithMapAndContext(
-      map, value_thunk_info, value_thunk_context);
-  return value_thunk;
-}
-
-TF_BUILTIN(PromiseThenFinally, PromiseBuiltinsAssembler) {
-  CSA_ASSERT_JS_ARGC_EQ(this, 1);
-
-  Node* const value = Parameter(Descriptor::kValue);
-  Node* const context = Parameter(Descriptor::kContext);
-
-  // 1. Let onFinally be F.[[OnFinally]].
-  TNode<HeapObject> const on_finally =
-      CAST(LoadContextElement(context, PromiseBuiltins::kOnFinallySlot));
-
-  // 2.  Assert: IsCallable(onFinally) is true.
-  CSA_ASSERT(this, IsCallable(on_finally));
-
-  // 3. Let result be ?  Call(onFinally).
-  Node* const result = CallJS(
-      CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-      context, on_finally, UndefinedConstant());
-
-  // 4. Let C be F.[[Constructor]].
-  TNode<JSFunction> const constructor =
-      CAST(LoadContextElement(context, PromiseBuiltins::kConstructorSlot));
-
-  // 5. Assert: IsConstructor(C) is true.
-  CSA_ASSERT(this, IsConstructor(constructor));
-
-  // 6. Let promise be ? PromiseResolve(C, result).
-  TNode<Object> const promise =
-      CallBuiltin(Builtins::kPromiseResolve, context, constructor, result);
-
-  // 7. Let valueThunk be equivalent to a function that returns value.
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  Node* const value_thunk = CreateValueThunkFunction(value, native_context);
-
-  // 8. Return ? Invoke(promise, "then", « valueThunk »).
-  Return(InvokeThen(native_context, promise, value_thunk));
-}
-
-TF_BUILTIN(PromiseThrowerFinally, PromiseBuiltinsAssembler) {
-  Node* const context = Parameter(Descriptor::kContext);
-
-  TNode<Object> const reason =
-      LoadContextElement(context, PromiseBuiltins::kValueSlot);
-  CallRuntime(Runtime::kThrow, context, reason);
-  Unreachable();
-}
-
-Node* PromiseBuiltinsAssembler::CreateThrowerFunction(Node* reason,
-                                                      Node* native_context) {
-  const TNode<Context> thrower_context = CreatePromiseContext(
-      CAST(native_context),
-      PromiseBuiltins::kPromiseValueThunkOrReasonContextLength);
-  StoreContextElementNoWriteBarrier(thrower_context,
-                                    PromiseBuiltins::kValueSlot, reason);
-  const TNode<Map> map = CAST(LoadContextElement(
-      native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX));
-  const TNode<SharedFunctionInfo> thrower_info = CAST(LoadContextElement(
-      native_context, Context::PROMISE_THROWER_FINALLY_SHARED_FUN));
-  TNode<JSFunction> const thrower =
-      AllocateFunctionWithMapAndContext(map, thrower_info, thrower_context);
-  return thrower;
-}
-
-TF_BUILTIN(PromiseCatchFinally, PromiseBuiltinsAssembler) {
-  CSA_ASSERT_JS_ARGC_EQ(this, 1);
-
-  Node* const reason = Parameter(Descriptor::kReason);
-  Node* const context = Parameter(Descriptor::kContext);
-
-  // 1. Let onFinally be F.[[OnFinally]].
-  TNode<HeapObject> const on_finally =
-      CAST(LoadContextElement(context, PromiseBuiltins::kOnFinallySlot));
-
-  // 2. Assert: IsCallable(onFinally) is true.
-  CSA_ASSERT(this, IsCallable(on_finally));
-
-  // 3. Let result be ? Call(onFinally).
-  Node* result = CallJS(
-      CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-      context, on_finally, UndefinedConstant());
-
-  // 4. Let C be F.[[Constructor]].
-  TNode<JSFunction> const constructor =
-      CAST(LoadContextElement(context, PromiseBuiltins::kConstructorSlot));
-
-  // 5. Assert: IsConstructor(C) is true.
-  CSA_ASSERT(this, IsConstructor(constructor));
-
-  // 6. Let promise be ? PromiseResolve(C, result).
-  TNode<Object> const promise =
-      CallBuiltin(Builtins::kPromiseResolve, context, constructor, result);
-
-  // 7. Let thrower be equivalent to a function that throws reason.
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  Node* const thrower = CreateThrowerFunction(reason, native_context);
-
-  // 8. Return ? Invoke(promise, "then", « thrower »).
-  Return(InvokeThen(native_context, promise, thrower));
-}
-
-TF_BUILTIN(PromisePrototypeFinally, PromiseBuiltinsAssembler) {
-  CSA_ASSERT_JS_ARGC_EQ(this, 1);
-
-  // 1.  Let promise be the this value.
-  Node* const receiver = Parameter(Descriptor::kReceiver);
-  Node* const on_finally = Parameter(Descriptor::kOnFinally);
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  // 2. If Type(promise) is not Object, throw a TypeError exception.
-  ThrowIfNotJSReceiver(context, CAST(receiver),
-                       MessageTemplate::kCalledOnNonObject,
-                       "Promise.prototype.finally");
-
-  // 3. Let C be ? SpeciesConstructor(promise, %Promise%).
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Object> const promise_fun =
-      LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
-  VARIABLE(var_constructor, MachineRepresentation::kTagged, promise_fun);
-  Label slow_constructor(this, Label::kDeferred), done_constructor(this);
-  TNode<Map> const receiver_map = LoadMap(receiver);
-  GotoIfNot(IsJSPromiseMap(receiver_map), &slow_constructor);
-  BranchIfPromiseSpeciesLookupChainIntact(native_context, receiver_map,
-                                          &done_constructor, &slow_constructor);
-  BIND(&slow_constructor);
-  {
-    TNode<JSReceiver> const constructor =
-        SpeciesConstructor(context, receiver, CAST(promise_fun));
-    var_constructor.Bind(constructor);
-    Goto(&done_constructor);
-  }
-  BIND(&done_constructor);
-  Node* const constructor = var_constructor.value();
-
-  // 4. Assert: IsConstructor(C) is true.
-  CSA_ASSERT(this, IsConstructor(constructor));
-
-  VARIABLE(var_then_finally, MachineRepresentation::kTagged);
-  VARIABLE(var_catch_finally, MachineRepresentation::kTagged);
-
-  Label if_notcallable(this, Label::kDeferred), perform_finally(this);
-
-  GotoIf(TaggedIsSmi(on_finally), &if_notcallable);
-  GotoIfNot(IsCallable(on_finally), &if_notcallable);
-
-  // 6. Else,
-  //   a. Let thenFinally be a new built-in function object as defined
-  //   in ThenFinally Function.
-  //   b. Let catchFinally be a new built-in function object as
-  //   defined in CatchFinally Function.
-  //   c. Set thenFinally and catchFinally's [[Constructor]] internal
-  //   slots to C.
-  //   d. Set thenFinally and catchFinally's [[OnFinally]] internal
-  //   slots to onFinally.
-  Node* then_finally = nullptr;
-  Node* catch_finally = nullptr;
-  std::tie(then_finally, catch_finally) =
-      CreatePromiseFinallyFunctions(on_finally, constructor, native_context);
-  var_then_finally.Bind(then_finally);
-  var_catch_finally.Bind(catch_finally);
-  Goto(&perform_finally);
-
-  // 5. If IsCallable(onFinally) is not true,
-  //    a. Let thenFinally be onFinally.
-  //    b. Let catchFinally be onFinally.
-  BIND(&if_notcallable);
-  {
-    var_then_finally.Bind(on_finally);
-    var_catch_finally.Bind(on_finally);
-    Goto(&perform_finally);
-  }
-
-  // 7. Return ? Invoke(promise, "then", « thenFinally, catchFinally »).
-  BIND(&perform_finally);
-  Return(InvokeThen(native_context, receiver, var_then_finally.value(),
-                    var_catch_finally.value()));
-}
-
-// ES #sec-fulfillpromise
-TF_BUILTIN(FulfillPromise, PromiseBuiltinsAssembler) {
-  Node* const promise = Parameter(Descriptor::kPromise);
-  Node* const value = Parameter(Descriptor::kValue);
-  Node* const context = Parameter(Descriptor::kContext);
-
-  CSA_ASSERT(this, TaggedIsNotSmi(promise));
-  CSA_ASSERT(this, IsJSPromise(promise));
-
-  // 2. Let reactions be promise.[[PromiseFulfillReactions]].
-  TNode<Object> const reactions =
-      LoadObjectField(promise, JSPromise::kReactionsOrResultOffset);
-
-  // 3. Set promise.[[PromiseResult]] to value.
-  // 4. Set promise.[[PromiseFulfillReactions]] to undefined.
-  // 5. Set promise.[[PromiseRejectReactions]] to undefined.
-  StoreObjectField(promise, JSPromise::kReactionsOrResultOffset, value);
-
-  // 6. Set promise.[[PromiseState]] to "fulfilled".
-  PromiseSetStatus(promise, Promise::kFulfilled);
-
-  // 7. Return TriggerPromiseReactions(reactions, value).
-  Return(TriggerPromiseReactions(context, reactions, value,
-                                 PromiseReaction::kFulfill));
-}
-
-// ES #sec-rejectpromise
-TF_BUILTIN(RejectPromise, PromiseBuiltinsAssembler) {
-  Node* const promise = Parameter(Descriptor::kPromise);
-  Node* const reason = Parameter(Descriptor::kReason);
-  Node* const debug_event = Parameter(Descriptor::kDebugEvent);
-  Node* const context = Parameter(Descriptor::kContext);
-
-  CSA_ASSERT(this, TaggedIsNotSmi(promise));
-  CSA_ASSERT(this, IsJSPromise(promise));
-  CSA_ASSERT(this, IsBoolean(debug_event));
-  Label if_runtime(this, Label::kDeferred);
-
-  // If promise hook is enabled or the debugger is active, let
-  // the runtime handle this operation, which greatly reduces
-  // the complexity here and also avoids a couple of back and
-  // forth between JavaScript and C++ land.
-  GotoIf(IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate(),
-         &if_runtime);
-
-  // 7. If promise.[[PromiseIsHandled]] is false, perform
-  //    HostPromiseRejectionTracker(promise, "reject").
-  // We don't try to handle rejecting {promise} without handler
-  // here, but we let the C++ code take care of this completely.
-  GotoIfNot(PromiseHasHandler(promise), &if_runtime);
-
-  // 2. Let reactions be promise.[[PromiseRejectReactions]].
-  TNode<Object> reactions =
-      LoadObjectField(promise, JSPromise::kReactionsOrResultOffset);
-
-  // 3. Set promise.[[PromiseResult]] to reason.
-  // 4. Set promise.[[PromiseFulfillReactions]] to undefined.
-  // 5. Set promise.[[PromiseRejectReactions]] to undefined.
-  StoreObjectField(promise, JSPromise::kReactionsOrResultOffset, reason);
-
-  // 6. Set promise.[[PromiseState]] to "rejected".
-  PromiseSetStatus(promise, Promise::kRejected);
-
-  // 7. Return TriggerPromiseReactions(reactions, reason).
-  Return(TriggerPromiseReactions(context, reactions, reason,
-                                 PromiseReaction::kReject));
-
-  BIND(&if_runtime);
-  TailCallRuntime(Runtime::kRejectPromise, context, promise, reason,
-                  debug_event);
-}
-
-// ES #sec-promise-resolve-functions
-TF_BUILTIN(ResolvePromise, PromiseBuiltinsAssembler) {
-  TNode<JSPromise> const promise = CAST(Parameter(Descriptor::kPromise));
-  TNode<Object> const resolution = CAST(Parameter(Descriptor::kResolution));
-  TNode<Context> const context = CAST(Parameter(Descriptor::kContext));
-
-  Label do_enqueue(this), if_fulfill(this), if_reject(this, Label::kDeferred),
-      if_runtime(this, Label::kDeferred);
-  TVARIABLE(Object, var_reason);
-  TVARIABLE(JSReceiver, var_then);
-
-  // If promise hook is enabled or the debugger is active, let
-  // the runtime handle this operation, which greatly reduces
-  // the complexity here and also avoids a couple of back and
-  // forth between JavaScript and C++ land.
-  GotoIf(IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate(),
-         &if_runtime);
-
-  // 6. If SameValue(resolution, promise) is true, then
-  // We can use pointer comparison here, since the {promise} is guaranteed
-  // to be a JSPromise inside this function and thus is reference comparable.
-  GotoIf(TaggedEqual(promise, resolution), &if_runtime);
-
-  // 7. If Type(resolution) is not Object, then
-  GotoIf(TaggedIsSmi(resolution), &if_fulfill);
-  TNode<Map> resolution_map = LoadMap(CAST(resolution));
-  GotoIfNot(IsJSReceiverMap(resolution_map), &if_fulfill);
-
-  // We can skip the "then" lookup on {resolution} if its [[Prototype]]
-  // is the (initial) Promise.prototype and the Promise#then protector
-  // is intact, as that guards the lookup path for the "then" property
-  // on JSPromise instances which have the (initial) %PromisePrototype%.
-  Label if_fast(this), if_receiver(this), if_slow(this, Label::kDeferred);
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  GotoIfForceSlowPath(&if_slow);
-  GotoIf(IsPromiseThenProtectorCellInvalid(), &if_slow);
-  GotoIfNot(IsJSPromiseMap(resolution_map), &if_receiver);
-  TNode<Object> const promise_prototype =
-      LoadContextElement(native_context, Context::PROMISE_PROTOTYPE_INDEX);
-  Branch(TaggedEqual(LoadMapPrototype(resolution_map), promise_prototype),
-         &if_fast, &if_slow);
-
-  BIND(&if_fast);
-  {
-    // The {resolution} is a native Promise in this case.
-    var_then =
-        CAST(LoadContextElement(native_context, Context::PROMISE_THEN_INDEX));
-    Goto(&do_enqueue);
-  }
-
-  BIND(&if_receiver);
-  {
-    // We can skip the lookup of "then" if the {resolution} is a (newly
-    // created) IterResultObject, as the Promise#then() protector also
-    // ensures that the intrinsic %ObjectPrototype% doesn't contain any
-    // "then" property. This helps to avoid negative lookups on iterator
-    // results from async generators.
-    CSA_ASSERT(this, IsJSReceiverMap(resolution_map));
-    CSA_ASSERT(this, Word32BinaryNot(IsPromiseThenProtectorCellInvalid()));
-    TNode<Object> const iterator_result_map =
-        LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX);
-    Branch(TaggedEqual(resolution_map, iterator_result_map), &if_fulfill,
-           &if_slow);
-  }
-
-  BIND(&if_slow);
-  {
-    // 8. Let then be Get(resolution, "then").
-    TNode<Object> then =
-        GetProperty(context, resolution, isolate()->factory()->then_string());
-
-    // 9. If then is an abrupt completion, then
-    GotoIfException(then, &if_reject, &var_reason);
-
-    // 11. If IsCallable(thenAction) is false, then
-    GotoIf(TaggedIsSmi(then), &if_fulfill);
-    TNode<Map> const then_map = LoadMap(CAST(then));
-    GotoIfNot(IsCallableMap(then_map), &if_fulfill);
-    var_then = CAST(then);
-    Goto(&do_enqueue);
-  }
-
-  BIND(&do_enqueue);
-  {
-    // 12. Perform EnqueueJob("PromiseJobs", PromiseResolveThenableJob,
-    //                        «promise, resolution, thenAction»).
-    const TNode<PromiseResolveThenableJobTask> task =
-        AllocatePromiseResolveThenableJobTask(promise, var_then.value(),
-                                              CAST(resolution), native_context);
-    TailCallBuiltin(Builtins::kEnqueueMicrotask, native_context, task);
-  }
-
-  BIND(&if_fulfill);
-  {
-    // 7.b Return FulfillPromise(promise, resolution).
-    TailCallBuiltin(Builtins::kFulfillPromise, context, promise, resolution);
-  }
-
-  BIND(&if_runtime);
-  Return(CallRuntime(Runtime::kResolvePromise, context, promise, resolution));
-
-  BIND(&if_reject);
-  {
-    // 9.a Return RejectPromise(promise, then.[[Value]]).
-    TailCallBuiltin(Builtins::kRejectPromise, context, promise,
-                    var_reason.value(), FalseConstant());
-  }
-}
-
-Node* PromiseBuiltinsAssembler::PerformPromiseAll(
-    Node* context, Node* constructor, Node* capability,
-    const IteratorRecord& iterator,
-    const PromiseAllResolvingElementFunction& create_resolve_element_function,
-    const PromiseAllResolvingElementFunction& create_reject_element_function,
-    Label* if_exception, Variable* var_exception) {
-  IteratorBuiltinsAssembler iter_assembler(state());
-
-  TNode<NativeContext> native_context = LoadNativeContext(context);
-
-  // For catch prediction, don't treat the .then calls as handling it;
-  // instead, recurse outwards.
-  SetForwardingHandlerIfTrue(
-      native_context, IsDebugActive(),
-      LoadObjectField(capability, PromiseCapability::kRejectOffset));
-
-  TNode<Context> resolve_element_context =
-      Cast(CreatePromiseAllResolveElementContext(capability, native_context));
-
-  TVARIABLE(Smi, var_index, SmiConstant(1));
-  Label loop(this, &var_index), done_loop(this),
-      too_many_elements(this, Label::kDeferred),
-      close_iterator(this, Label::kDeferred), if_slow(this, Label::kDeferred);
-
-  // We can skip the "resolve" lookup on {constructor} if it's the
-  // Promise constructor and the Promise.resolve protector is intact,
-  // as that guards the lookup path for the "resolve" property on the
-  // Promise constructor.
-  TVARIABLE(Object, var_promise_resolve_function, UndefinedConstant());
-  GotoIfNotPromiseResolveLookupChainIntact(native_context, constructor,
-                                           &if_slow);
-  Goto(&loop);
-
-  BIND(&if_slow);
-  {
-    // 5. Let _promiseResolve_ be ? Get(_constructor_, `"resolve"`).
-    TNode<Object> resolve =
-        GetProperty(native_context, constructor, factory()->resolve_string());
-    GotoIfException(resolve, &close_iterator, var_exception);
-
-    // 6. If IsCallable(_promiseResolve_) is *false*, throw a *TypeError*
-    // exception.
-    ThrowIfNotCallable(CAST(context), resolve, "resolve");
-
-    var_promise_resolve_function = resolve;
-    Goto(&loop);
-  }
-
-  BIND(&loop);
-  {
-    // Let next be IteratorStep(iteratorRecord.[[Iterator]]).
-    // If next is an abrupt completion, set iteratorRecord.[[Done]] to true.
-    // ReturnIfAbrupt(next).
-    TNode<Map> const fast_iterator_result_map = CAST(
-        LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX));
-    TNode<JSReceiver> const next = iter_assembler.IteratorStep(
-        native_context, iterator, &done_loop, fast_iterator_result_map,
-        if_exception, var_exception);
-
-    // Let nextValue be IteratorValue(next).
-    // If nextValue is an abrupt completion, set iteratorRecord.[[Done]] to
-    //     true.
-    // ReturnIfAbrupt(nextValue).
-    TNode<Object> const next_value = iter_assembler.IteratorValue(
-        native_context, next, fast_iterator_result_map, if_exception,
-        var_exception);
-
-    // Check if we reached the limit.
-    TNode<Smi> const index = var_index.value();
-    GotoIf(SmiEqual(index, SmiConstant(PropertyArray::HashField::kMax)),
-           &too_many_elements);
-
-    // Set index to index + 1.
-    var_index = SmiAdd(index, SmiConstant(1));
-
-    // Set remainingElementsCount.[[Value]] to
-    //     remainingElementsCount.[[Value]] + 1.
-    TNode<Smi> const remaining_elements_count = CAST(LoadContextElement(
-        resolve_element_context,
-        PromiseBuiltins::kPromiseAllResolveElementRemainingSlot));
-    StoreContextElementNoWriteBarrier(
-        resolve_element_context,
-        PromiseBuiltins::kPromiseAllResolveElementRemainingSlot,
-        SmiAdd(remaining_elements_count, SmiConstant(1)));
-
-    // Let resolveElement be CreateBuiltinFunction(steps,
-    //                                             « [[AlreadyCalled]],
-    //                                               [[Index]],
-    //                                               [[Values]],
-    //                                               [[Capability]],
-    //                                               [[RemainingElements]] »).
-    // Set resolveElement.[[AlreadyCalled]] to a Record { [[Value]]: false }.
-    // Set resolveElement.[[Index]] to index.
-    // Set resolveElement.[[Values]] to values.
-    // Set resolveElement.[[Capability]] to resultCapability.
-    // Set resolveElement.[[RemainingElements]] to remainingElementsCount.
-    TNode<Object> const resolve_element_fun = create_resolve_element_function(
-        resolve_element_context, index, native_context, Cast(capability));
-    TNode<Object> const reject_element_fun = create_reject_element_function(
-        resolve_element_context, index, native_context, Cast(capability));
-
-    // We can skip the "resolve" lookup on the {constructor} as well as the
-    // "then" lookup on the result of the "resolve" call, and immediately
-    // chain continuation onto the {next_value} if:
-    //
-    //   (a) The {constructor} is the intrinsic %Promise% function, and
-    //       looking up "resolve" on {constructor} yields the initial
-    //       Promise.resolve() builtin, and
-    //   (b) the promise @@species protector cell is valid, meaning that
-    //       no one messed with the Symbol.species property on any
-    //       intrinsic promise or on the Promise.prototype, and
-    //   (c) the {next_value} is a JSPromise whose [[Prototype]] field
-    //       contains the intrinsic %PromisePrototype%, and
-    //   (d) we're not running with async_hooks or DevTools enabled.
-    //
-    // In that case we also don't need to allocate a chained promise for
-    // the PromiseReaction (aka we can pass undefined to PerformPromiseThen),
-    // since this is only necessary for DevTools and PromiseHooks.
-    Label if_fast(this), if_slow(this);
-    GotoIfNot(IsUndefined(var_promise_resolve_function.value()), &if_slow);
-    GotoIf(IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate(),
-           &if_slow);
-    GotoIf(IsPromiseSpeciesProtectorCellInvalid(), &if_slow);
-    GotoIf(TaggedIsSmi(next_value), &if_slow);
-    TNode<Map> const next_value_map = LoadMap(CAST(next_value));
-    BranchIfPromiseThenLookupChainIntact(native_context, next_value_map,
-                                         &if_fast, &if_slow);
-
-    BIND(&if_fast);
-    {
-      // Register the PromiseReaction immediately on the {next_value}, not
-      // passing any chained promise since neither async_hooks nor DevTools
-      // are enabled, so there's no use of the resulting promise.
-      PerformPromiseThen(native_context, CAST(next_value),
-                         CAST(resolve_element_fun), CAST(reject_element_fun),
-                         UndefinedConstant());
-      Goto(&loop);
-    }
-
-    BIND(&if_slow);
-    {
-      // Let nextPromise be ? Call(constructor, _promiseResolve_, « nextValue
-      // »).
-      Node* const next_promise = CallResolve(
-          native_context, constructor, var_promise_resolve_function.value(),
-          next_value, &close_iterator, var_exception);
-
-      // Perform ? Invoke(nextPromise, "then", « resolveElement,
-      //                  resultCapability.[[Reject]] »).
-      TNode<Object> const then =
-          GetProperty(native_context, next_promise, factory()->then_string());
-      GotoIfException(then, &close_iterator, var_exception);
-
-      Node* const then_call =
-          CallJS(CodeFactory::Call(isolate(),
-                                   ConvertReceiverMode::kNotNullOrUndefined),
-                 native_context, then, next_promise, resolve_element_fun,
-                 reject_element_fun);
-      GotoIfException(then_call, &close_iterator, var_exception);
-
-      // For catch prediction, mark that rejections here are semantically
-      // handled by the combined Promise.
-      SetPromiseHandledByIfTrue(
-          native_context, IsDebugActive(), then_call, [=]() {
-            // Load promiseCapability.[[Promise]]
-            return LoadObjectField(capability,
-                                   PromiseCapability::kPromiseOffset);
-          });
-
-      Goto(&loop);
-    }
-  }
-
-  BIND(&too_many_elements);
-  {
-    // If there are too many elements (currently more than 2**21-1), raise a
-    // RangeError here (which is caught directly and turned into a rejection)
-    // of the resulting promise. We could gracefully handle this case as well
-    // and support more than this number of elements by going to a separate
-    // function and pass the larger indices via a separate context, but it
-    // doesn't seem likely that we need this, and it's unclear how the rest
-    // of the system deals with 2**21 live Promises anyways.
-    TNode<Object> const result =
-        CallRuntime(Runtime::kThrowRangeError, native_context,
-                    SmiConstant(MessageTemplate::kTooManyElementsInPromiseAll));
-    GotoIfException(result, &close_iterator, var_exception);
-    Unreachable();
-  }
-
-  BIND(&close_iterator);
-  {
-    // Exception must be bound to a JS value.
-    CSA_ASSERT(this, IsNotTheHole(var_exception->value()));
-    iter_assembler.IteratorCloseOnException(native_context, iterator,
-                                            if_exception, var_exception);
-  }
-
-  BIND(&done_loop);
-  {
-    Label resolve_promise(this, Label::kDeferred), return_promise(this);
-    // Set iteratorRecord.[[Done]] to true.
-    // Set remainingElementsCount.[[Value]] to
-    //    remainingElementsCount.[[Value]] - 1.
-    TNode<Smi> remaining_elements_count = CAST(LoadContextElement(
-        resolve_element_context,
-        PromiseBuiltins::kPromiseAllResolveElementRemainingSlot));
-    remaining_elements_count = SmiSub(remaining_elements_count, SmiConstant(1));
-    StoreContextElementNoWriteBarrier(
-        resolve_element_context,
-        PromiseBuiltins::kPromiseAllResolveElementRemainingSlot,
-        remaining_elements_count);
-    GotoIf(SmiEqual(remaining_elements_count, SmiConstant(0)),
-           &resolve_promise);
-
-    // Pre-allocate the backing store for the {values_array} to the desired
-    // capacity here. We may already have elements here in case of some
-    // fancy Thenable that calls the resolve callback immediately, so we need
-    // to handle that correctly here.
-    TNode<JSArray> const values_array = CAST(LoadContextElement(
-        resolve_element_context,
-        PromiseBuiltins::kPromiseAllResolveElementValuesArraySlot));
-    TNode<FixedArrayBase> const old_elements = LoadElements(values_array);
-    TNode<Smi> const old_capacity = LoadFixedArrayBaseLength(old_elements);
-    TNode<Smi> const new_capacity = var_index.value();
-    GotoIf(SmiGreaterThanOrEqual(old_capacity, new_capacity), &return_promise);
-    TNode<FixedArrayBase> const new_elements =
-        AllocateFixedArray(PACKED_ELEMENTS, new_capacity, SMI_PARAMETERS,
-                           AllocationFlag::kAllowLargeObjectAllocation);
-    CopyFixedArrayElements(PACKED_ELEMENTS, old_elements, PACKED_ELEMENTS,
-                           new_elements, SmiConstant(0), old_capacity,
-                           new_capacity, UPDATE_WRITE_BARRIER, SMI_PARAMETERS);
-    StoreObjectField(values_array, JSArray::kElementsOffset, new_elements);
-    Goto(&return_promise);
-
-    // If remainingElementsCount.[[Value]] is 0, then
-    //     Let valuesArray be CreateArrayFromList(values).
-    //     Perform ? Call(resultCapability.[[Resolve]], undefined,
-    //                    « valuesArray »).
-    BIND(&resolve_promise);
-    {
-      TNode<Object> const resolve =
-          LoadObjectField(capability, PromiseCapability::kResolveOffset);
-      TNode<Object> const values_array = LoadContextElement(
-          resolve_element_context,
-          PromiseBuiltins::kPromiseAllResolveElementValuesArraySlot);
-      Node* const resolve_call = CallJS(
-          CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-          native_context, resolve, UndefinedConstant(), values_array);
-      GotoIfException(resolve_call, if_exception, var_exception);
-      Goto(&return_promise);
-    }
-
-    // Return resultCapability.[[Promise]].
-    BIND(&return_promise);
-  }
-
-  TNode<Object> const promise =
-      LoadObjectField(capability, PromiseCapability::kPromiseOffset);
-  return promise;
-}
-
-void PromiseBuiltinsAssembler::Generate_PromiseAll(
-    TNode<Context> context, TNode<Object> receiver, TNode<Object> iterable,
-    const PromiseAllResolvingElementFunction& create_resolve_element_function,
-    const PromiseAllResolvingElementFunction& create_reject_element_function) {
-  IteratorBuiltinsAssembler iter_assembler(state());
-
-  // Let C be the this value.
-  // If Type(C) is not Object, throw a TypeError exception.
-  ThrowIfNotJSReceiver(context, receiver, MessageTemplate::kCalledOnNonObject,
-                       "Promise.all");
-
-  // Let promiseCapability be ? NewPromiseCapability(C).
-  // Don't fire debugEvent so that forwarding the rejection through all does not
-  // trigger redundant ExceptionEvents
-  TNode<Oddball> const debug_event = FalseConstant();
-  TNode<PromiseCapability> const capability = CAST(CallBuiltin(
-      Builtins::kNewPromiseCapability, context, receiver, debug_event));
-
-  VARIABLE(var_exception, MachineRepresentation::kTagged, TheHoleConstant());
-  Label reject_promise(this, &var_exception, Label::kDeferred);
-
-  // Let iterator be GetIterator(iterable).
-  // IfAbruptRejectPromise(iterator, promiseCapability).
-  IteratorRecord iterator = iter_assembler.GetIterator(
-      context, iterable, &reject_promise, &var_exception);
-
-  // Let result be PerformPromiseAll(iteratorRecord, C, promiseCapability).
-  // If result is an abrupt completion, then
-  //   If iteratorRecord.[[Done]] is false, let result be
-  //       IteratorClose(iterator, result).
-  //    IfAbruptRejectPromise(result, promiseCapability).
-  Node* const result = PerformPromiseAll(
-      context, receiver, capability, iterator, create_resolve_element_function,
-      create_reject_element_function, &reject_promise, &var_exception);
-
-  Return(result);
-
-  BIND(&reject_promise);
-  {
-    // Exception must be bound to a JS value.
-    CSA_SLOW_ASSERT(this, IsNotTheHole(var_exception.value()));
-    TNode<Object> const reject =
-        LoadObjectField(capability, PromiseCapability::kRejectOffset);
-    CallJS(CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-           context, reject, UndefinedConstant(), var_exception.value());
-
-    TNode<Object> const promise =
-        LoadObjectField(capability, PromiseCapability::kPromiseOffset);
-    Return(promise);
-  }
-}
-
-// ES#sec-promise.all
-// Promise.all ( iterable )
-TF_BUILTIN(PromiseAll, PromiseBuiltinsAssembler) {
-  TNode<Object> receiver = Cast(Parameter(Descriptor::kReceiver));
-  TNode<Context> context = Cast(Parameter(Descriptor::kContext));
-  TNode<Object> iterable = Cast(Parameter(Descriptor::kIterable));
-  Generate_PromiseAll(
-      context, receiver, iterable,
-      [this](TNode<Context> context, TNode<Smi> index,
-             TNode<NativeContext> native_context,
-             TNode<PromiseCapability> capability) {
-        return CreatePromiseAllResolveElementFunction(
-            context, index, native_context,
-            Context::PROMISE_ALL_RESOLVE_ELEMENT_SHARED_FUN);
-      },
-      [this](TNode<Context> context, TNode<Smi> index,
-             TNode<NativeContext> native_context,
-             TNode<PromiseCapability> capability) {
-        return LoadObjectField(capability, PromiseCapability::kRejectOffset);
-      });
-}
-
-// ES#sec-promise.allsettled
-// Promise.allSettled ( iterable )
-TF_BUILTIN(PromiseAllSettled, PromiseBuiltinsAssembler) {
-  TNode<Object> receiver = Cast(Parameter(Descriptor::kReceiver));
-  TNode<Context> context = Cast(Parameter(Descriptor::kContext));
-  TNode<Object> iterable = Cast(Parameter(Descriptor::kIterable));
-  Generate_PromiseAll(
-      context, receiver, iterable,
-      [this](TNode<Context> context, TNode<Smi> index,
-             TNode<NativeContext> native_context,
-             TNode<PromiseCapability> capability) {
-        return CreatePromiseAllResolveElementFunction(
-            context, index, native_context,
-            Context::PROMISE_ALL_SETTLED_RESOLVE_ELEMENT_SHARED_FUN);
-      },
-      [this](TNode<Context> context, TNode<Smi> index,
-             TNode<NativeContext> native_context,
-             TNode<PromiseCapability> capability) {
-        return CreatePromiseAllResolveElementFunction(
-            context, index, native_context,
-            Context::PROMISE_ALL_SETTLED_REJECT_ELEMENT_SHARED_FUN);
-      });
-}
-
-void PromiseBuiltinsAssembler::Generate_PromiseAllResolveElementClosure(
-    TNode<Context> context, TNode<Object> value, TNode<JSFunction> function,
-    const CreatePromiseAllResolveElementFunctionValue& callback) {
-  Label already_called(this, Label::kDeferred), resolve_promise(this);
-
-  // We use the {function}s context as the marker to remember whether this
-  // resolve element closure was already called. It points to the resolve
-  // element context (which is a FunctionContext) until it was called the
-  // first time, in which case we make it point to the native context here
-  // to mark this resolve element closure as done.
-  GotoIf(IsNativeContext(context), &already_called);
-  CSA_ASSERT(
-      this,
-      SmiEqual(LoadObjectField<Smi>(context, Context::kLengthOffset),
-               SmiConstant(PromiseBuiltins::kPromiseAllResolveElementLength)));
-  TNode<NativeContext> native_context = LoadNativeContext(context);
-  StoreObjectField(function, JSFunction::kContextOffset, native_context);
-
-  // Update the value depending on whether Promise.all or
-  // Promise.allSettled is called.
-  value = callback(context, native_context, value);
-
-  // Determine the index from the {function}.
-  Label unreachable(this, Label::kDeferred);
-  STATIC_ASSERT(PropertyArray::kNoHashSentinel == 0);
-  TNode<IntPtrT> identity_hash =
-      LoadJSReceiverIdentityHash(function, &unreachable);
-  CSA_ASSERT(this, IntPtrGreaterThan(identity_hash, IntPtrConstant(0)));
-  TNode<IntPtrT> index = IntPtrSub(identity_hash, IntPtrConstant(1));
-
-  // Check if we need to grow the [[ValuesArray]] to store {value} at {index}.
-  TNode<JSArray> values_array = CAST(LoadContextElement(
-      context, PromiseBuiltins::kPromiseAllResolveElementValuesArraySlot));
-  TNode<FixedArray> elements = CAST(LoadElements(values_array));
-  TNode<IntPtrT> values_length =
-      LoadAndUntagObjectField(values_array, JSArray::kLengthOffset);
-  Label if_inbounds(this), if_outofbounds(this), done(this);
-  Branch(IntPtrLessThan(index, values_length), &if_inbounds, &if_outofbounds);
-
-  BIND(&if_outofbounds);
-  {
-    // Check if we need to grow the backing store.
-    TNode<IntPtrT> new_length = IntPtrAdd(index, IntPtrConstant(1));
-    TNode<IntPtrT> elements_length =
-        LoadAndUntagObjectField(elements, FixedArray::kLengthOffset);
-    Label if_grow(this, Label::kDeferred), if_nogrow(this);
-    Branch(IntPtrLessThan(index, elements_length), &if_nogrow, &if_grow);
-
-    BIND(&if_grow);
-    {
-      // We need to grow the backing store to fit the {index} as well.
-      TNode<IntPtrT> new_elements_length =
-          IntPtrMin(CalculateNewElementsCapacity(new_length),
-                    IntPtrConstant(PropertyArray::HashField::kMax + 1));
-      CSA_ASSERT(this, IntPtrLessThan(index, new_elements_length));
-      CSA_ASSERT(this, IntPtrLessThan(elements_length, new_elements_length));
-      TNode<FixedArray> new_elements =
-          CAST(AllocateFixedArray(PACKED_ELEMENTS, new_elements_length,
-                                  AllocationFlag::kAllowLargeObjectAllocation));
-      CopyFixedArrayElements(PACKED_ELEMENTS, elements, PACKED_ELEMENTS,
-                             new_elements, elements_length,
-                             new_elements_length);
-      StoreFixedArrayElement(new_elements, index, value);
-
-      // Update backing store and "length" on {values_array}.
-      StoreObjectField(values_array, JSArray::kElementsOffset, new_elements);
-      StoreObjectFieldNoWriteBarrier(values_array, JSArray::kLengthOffset,
-                                     SmiTag(new_length));
-      Goto(&done);
-    }
-
-    BIND(&if_nogrow);
-    {
-      // The {index} is within bounds of the {elements} backing store, so
-      // just store the {value} and update the "length" of the {values_array}.
-      StoreObjectFieldNoWriteBarrier(values_array, JSArray::kLengthOffset,
-                                     SmiTag(new_length));
-      StoreFixedArrayElement(elements, index, value);
-      Goto(&done);
-    }
-  }
-
-  BIND(&if_inbounds);
-  {
-    // The {index} is in bounds of the {values_array},
-    // just store the {value} and continue.
-    StoreFixedArrayElement(elements, index, value);
-    Goto(&done);
-  }
-
-  BIND(&done);
-  TNode<Smi> remaining_elements_count = CAST(LoadContextElement(
-      context, PromiseBuiltins::kPromiseAllResolveElementRemainingSlot));
-  remaining_elements_count = SmiSub(remaining_elements_count, SmiConstant(1));
-  StoreContextElement(context,
-                      PromiseBuiltins::kPromiseAllResolveElementRemainingSlot,
-                      remaining_elements_count);
-  GotoIf(SmiEqual(remaining_elements_count, SmiConstant(0)), &resolve_promise);
-  Return(UndefinedConstant());
-
-  BIND(&resolve_promise);
-  TNode<PromiseCapability> capability = CAST(LoadContextElement(
-      context, PromiseBuiltins::kPromiseAllResolveElementCapabilitySlot));
-  TNode<Object> resolve =
-      LoadObjectField(capability, PromiseCapability::kResolveOffset);
-  CallJS(CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-         context, resolve, UndefinedConstant(), values_array);
-  Return(UndefinedConstant());
-
-  BIND(&already_called);
-  Return(UndefinedConstant());
-
-  BIND(&unreachable);
-  Unreachable();
-}
-
-TF_BUILTIN(PromiseAllResolveElementClosure, PromiseBuiltinsAssembler) {
-  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<JSFunction> function = CAST(Parameter(Descriptor::kJSTarget));
-
-  Generate_PromiseAllResolveElementClosure(
-      context, value, function,
-      [](TNode<Object>, TNode<NativeContext>, TNode<Object> value) {
-        return value;
-      });
-}
-
-TF_BUILTIN(PromiseAllSettledResolveElementClosure, PromiseBuiltinsAssembler) {
-  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<JSFunction> function = CAST(Parameter(Descriptor::kJSTarget));
-
-  Generate_PromiseAllResolveElementClosure(
-      context, value, function,
-      [this](TNode<Context> context, TNode<NativeContext> native_context,
-             TNode<Object> value) {
-        // TODO(gsathya): Optimize the creation using a cached map to
-        // prevent transitions here.
-        // 9. Let obj be ! ObjectCreate(%ObjectPrototype%).
-        TNode<HeapObject> object_function = Cast(
-            LoadContextElement(native_context, Context::OBJECT_FUNCTION_INDEX));
-        TNode<Map> object_function_map = Cast(LoadObjectField(
-            object_function, JSFunction::kPrototypeOrInitialMapOffset));
-        TNode<JSObject> obj = AllocateJSObjectFromMap(object_function_map);
-
-        // 10. Perform ! CreateDataProperty(obj, "status", "fulfilled").
-        CallBuiltin(Builtins::kFastCreateDataProperty, context, obj,
-                    StringConstant("status"), StringConstant("fulfilled"));
-
-        // 11. Perform ! CreateDataProperty(obj, "value", x).
-        CallBuiltin(Builtins::kFastCreateDataProperty, context, obj,
-                    StringConstant("value"), value);
-
-        return obj;
-      });
-}
-
-TF_BUILTIN(PromiseAllSettledRejectElementClosure, PromiseBuiltinsAssembler) {
-  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<JSFunction> function = CAST(Parameter(Descriptor::kJSTarget));
-
-  Generate_PromiseAllResolveElementClosure(
-      context, value, function,
-      [this](TNode<Context> context, TNode<NativeContext> native_context,
-             TNode<Object> value) {
-        // TODO(gsathya): Optimize the creation using a cached map to
-        // prevent transitions here.
-        // 9. Let obj be ! ObjectCreate(%ObjectPrototype%).
-        TNode<HeapObject> object_function = Cast(
-            LoadContextElement(native_context, Context::OBJECT_FUNCTION_INDEX));
-        TNode<Map> object_function_map = Cast(LoadObjectField(
-            object_function, JSFunction::kPrototypeOrInitialMapOffset));
-        TNode<JSObject> obj = AllocateJSObjectFromMap(object_function_map);
-
-        // 10. Perform ! CreateDataProperty(obj, "status", "rejected").
-        CallBuiltin(Builtins::kFastCreateDataProperty, context, obj,
-                    StringConstant("status"), StringConstant("rejected"));
-
-        // 11. Perform ! CreateDataProperty(obj, "reason", x).
-        CallBuiltin(Builtins::kFastCreateDataProperty, context, obj,
-                    StringConstant("reason"), value);
-
-        return obj;
-      });
-}
-
-// ES#sec-promise.race
-// Promise.race ( iterable )
-TF_BUILTIN(PromiseRace, PromiseBuiltinsAssembler) {
-  IteratorBuiltinsAssembler iter_assembler(state());
-  VARIABLE(var_exception, MachineRepresentation::kTagged, TheHoleConstant());
-
-  Node* const receiver = Parameter(Descriptor::kReceiver);
-  TNode<Context> const context = CAST(Parameter(Descriptor::kContext));
-  ThrowIfNotJSReceiver(context, CAST(receiver),
-                       MessageTemplate::kCalledOnNonObject, "Promise.race");
-
-  // Let promiseCapability be ? NewPromiseCapability(C).
-  // Don't fire debugEvent so that forwarding the rejection through all does not
-  // trigger redundant ExceptionEvents
-  TNode<Oddball> const debug_event = FalseConstant();
-  TNode<PromiseCapability> const capability = CAST(CallBuiltin(
-      Builtins::kNewPromiseCapability, context, receiver, debug_event));
-
-  TNode<Object> const resolve =
-      LoadObjectField(capability, PromiseCapability::kResolveOffset);
-  TNode<Object> const reject =
-      LoadObjectField(capability, PromiseCapability::kRejectOffset);
-
-  Label close_iterator(this, Label::kDeferred);
-  Label reject_promise(this, Label::kDeferred);
-
-  // For catch prediction, don't treat the .then calls as handling it;
-  // instead, recurse outwards.
-  SetForwardingHandlerIfTrue(context, IsDebugActive(), reject);
-
-  // Let iterator be GetIterator(iterable).
-  // IfAbruptRejectPromise(iterator, promiseCapability).
-  Node* const iterable = Parameter(Descriptor::kIterable);
-  IteratorRecord iterator = iter_assembler.GetIterator(
-      context, iterable, &reject_promise, &var_exception);
-
-  // Let result be PerformPromiseRace(iteratorRecord, C, promiseCapability).
-  {
-    // We can skip the "resolve" lookup on {constructor} if it's the
-    // Promise constructor and the Promise.resolve protector is intact,
-    // as that guards the lookup path for the "resolve" property on the
-    // Promise constructor.
-    Label loop(this), break_loop(this), if_slow(this, Label::kDeferred);
-    TNode<NativeContext> const native_context = LoadNativeContext(context);
-    TVARIABLE(Object, var_promise_resolve_function, UndefinedConstant());
-    GotoIfNotPromiseResolveLookupChainIntact(native_context, receiver,
-                                             &if_slow);
-    Goto(&loop);
-
-    BIND(&if_slow);
-    {
-      // 3. Let _promiseResolve_ be ? Get(_constructor_, `"resolve"`).
-      TNode<Object> resolve =
-          GetProperty(native_context, receiver, factory()->resolve_string());
-      GotoIfException(resolve, &close_iterator, &var_exception);
-
-      // 4. If IsCallable(_promiseResolve_) is *false*, throw a *TypeError*
-      // exception.
-      ThrowIfNotCallable(context, resolve, "resolve");
-
-      var_promise_resolve_function = resolve;
-      Goto(&loop);
-    }
-
-    BIND(&loop);
-    {
-      TNode<Map> const fast_iterator_result_map = CAST(LoadContextElement(
-          native_context, Context::ITERATOR_RESULT_MAP_INDEX));
-
-      // Let next be IteratorStep(iteratorRecord.[[Iterator]]).
-      // If next is an abrupt completion, set iteratorRecord.[[Done]] to true.
-      // ReturnIfAbrupt(next).
-      TNode<JSReceiver> const next = iter_assembler.IteratorStep(
-          context, iterator, &break_loop, fast_iterator_result_map,
-          &reject_promise, &var_exception);
-
-      // Let nextValue be IteratorValue(next).
-      // If nextValue is an abrupt completion, set iteratorRecord.[[Done]] to
-      //     true.
-      // ReturnIfAbrupt(nextValue).
-      TNode<Object> const next_value =
-          iter_assembler.IteratorValue(context, next, fast_iterator_result_map,
-                                       &reject_promise, &var_exception);
-
-      // Let nextPromise be ? Call(constructor, _promiseResolve_, « nextValue
-      // »).
-      Node* const next_promise = CallResolve(
-          native_context, receiver, var_promise_resolve_function.value(),
-          next_value, &close_iterator, &var_exception);
-
-      // Perform ? Invoke(nextPromise, "then", « resolveElement,
-      //                  resultCapability.[[Reject]] »).
-      TNode<Object> const then =
-          GetProperty(context, next_promise, factory()->then_string());
-      GotoIfException(then, &close_iterator, &var_exception);
-
-      Node* const then_call =
-          CallJS(CodeFactory::Call(isolate(),
-                                   ConvertReceiverMode::kNotNullOrUndefined),
-                 context, then, next_promise, resolve, reject);
-      GotoIfException(then_call, &close_iterator, &var_exception);
-
-      // For catch prediction, mark that rejections here are semantically
-      // handled by the combined Promise.
-      SetPromiseHandledByIfTrue(context, IsDebugActive(), then_call, [=]() {
-        // Load promiseCapability.[[Promise]]
-        return LoadObjectField(capability, PromiseCapability::kPromiseOffset);
-      });
-      Goto(&loop);
-    }
-
-    BIND(&break_loop);
-    Return(LoadObjectField(capability, PromiseCapability::kPromiseOffset));
-  }
-
-  BIND(&close_iterator);
-  {
-    CSA_ASSERT(this, IsNotTheHole(var_exception.value()));
-    iter_assembler.IteratorCloseOnException(context, iterator, &reject_promise,
-                                            &var_exception);
-  }
-
-  BIND(&reject_promise);
-  {
-    TNode<Object> const reject =
-        LoadObjectField(capability, PromiseCapability::kRejectOffset);
-    CallJS(CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-           context, reject, UndefinedConstant(), var_exception.value());
-
-    TNode<Object> const promise =
-        LoadObjectField(capability, PromiseCapability::kPromiseOffset);
-    Return(promise);
-  }
+TNode<HeapObject> PromiseBuiltinsAssembler::AllocateJSPromise(
+    TNode<Context> context) {
+  return Allocate(JSPromise::kSizeWithEmbedderFields);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-promise-gen.h b/deps/v8/src/builtins/builtins-promise-gen.h
index b2ae8fe8765d8c..66044b51af0428 100644
--- a/deps/v8/src/builtins/builtins-promise-gen.h
+++ b/deps/v8/src/builtins/builtins-promise-gen.h
@@ -17,174 +17,11 @@ class V8_EXPORT_PRIVATE PromiseBuiltinsAssembler : public CodeStubAssembler {
  public:
   explicit PromiseBuiltinsAssembler(compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state) {}
-  // These allocate and initialize a promise with pending state and
-  // undefined fields.
-  //
-  // This uses undefined as the parent promise for the promise init
-  // hook.
-  TNode<JSPromise> AllocateAndInitJSPromise(TNode<Context> context);
-  // This uses the given parent as the parent promise for the promise
-  // init hook.
-  TNode<JSPromise> AllocateAndInitJSPromise(TNode<Context> context,
-                                            TNode<Object> parent);
+  void ZeroOutEmbedderOffsets(TNode<JSPromise> promise);
 
-  // This allocates and initializes a promise with the given state and
-  // fields.
-  TNode<JSPromise> AllocateAndSetJSPromise(TNode<Context> context,
-                                           v8::Promise::PromiseState status,
-                                           TNode<Object> result);
+  TNode<HeapObject> AllocateJSPromise(TNode<Context> context);
 
-  TNode<PromiseReaction> AllocatePromiseReaction(
-      TNode<Object> next, TNode<HeapObject> promise_or_capability,
-      TNode<HeapObject> fulfill_handler, TNode<HeapObject> reject_handler);
-
-  TNode<PromiseReactionJobTask> AllocatePromiseReactionJobTask(
-      TNode<Map> map, TNode<Context> context, TNode<Object> argument,
-      TNode<HeapObject> handler, TNode<HeapObject> promise_or_capability);
-
-  TNode<PromiseResolveThenableJobTask> AllocatePromiseResolveThenableJobTask(
-      TNode<JSPromise> promise_to_resolve, TNode<JSReceiver> then,
-      TNode<JSReceiver> thenable, TNode<Context> context);
-
-  std::pair<TNode<JSFunction>, TNode<JSFunction>>
-  CreatePromiseResolvingFunctions(TNode<JSPromise> promise,
-                                  TNode<Object> debug_event,
-                                  TNode<NativeContext> native_context);
-
-  Node* PromiseHasHandler(Node* promise);
-
-  // Creates the context used by all Promise.all resolve element closures,
-  // together with the values array. Since all closures for a single Promise.all
-  // call use the same context, we need to store the indices for the individual
-  // closures somewhere else (we put them into the identity hash field of the
-  // closures), and we also need to have a separate marker for when the closure
-  // was called already (we slap the native context onto the closure in that
-  // case to mark it's done).
-  Node* CreatePromiseAllResolveElementContext(Node* promise_capability,
-                                              Node* native_context);
-  TNode<JSFunction> CreatePromiseAllResolveElementFunction(Node* context,
-                                                           TNode<Smi> index,
-                                                           Node* native_context,
-                                                           int slot_index);
-
-  TNode<Context> CreatePromiseResolvingFunctionsContext(
-      TNode<JSPromise> promise, TNode<Object> debug_event,
-      TNode<NativeContext> native_context);
-
-  Node* CreatePromiseGetCapabilitiesExecutorContext(Node* promise_capability,
-                                                    Node* native_context);
-
- protected:
-  void PromiseInit(Node* promise);
-
-  void PromiseSetHasHandler(Node* promise);
-  void PromiseSetHandledHint(Node* promise);
-
-  void PerformPromiseThen(TNode<Context> context, TNode<JSPromise> promise,
-                          TNode<HeapObject> on_fulfilled,
-                          TNode<HeapObject> on_rejected,
-                          TNode<HeapObject> result_promise_or_capability);
-
-  TNode<Context> CreatePromiseContext(TNode<NativeContext> native_context,
-                                      int slots);
-
-  Node* TriggerPromiseReactions(Node* context, Node* promise, Node* result,
-                                PromiseReaction::Type type);
-
-  // We can skip the "resolve" lookup on {constructor} if it's the (initial)
-  // Promise constructor and the Promise.resolve() protector is intact, as
-  // that guards the lookup path for the "resolve" property on the %Promise%
-  // intrinsic object.
-  void BranchIfPromiseResolveLookupChainIntact(Node* native_context,
-                                               SloppyTNode<Object> constructor,
-                                               Label* if_fast, Label* if_slow);
-  void GotoIfNotPromiseResolveLookupChainIntact(Node* native_context,
-                                                SloppyTNode<Object> constructor,
-                                                Label* if_slow);
-
-  // We can shortcut the SpeciesConstructor on {promise_map} if it's
-  // [[Prototype]] is the (initial)  Promise.prototype and the @@species
-  // protector is intact, as that guards the lookup path for the "constructor"
-  // property on JSPromise instances which have the %PromisePrototype%.
-  void BranchIfPromiseSpeciesLookupChainIntact(Node* native_context,
-                                               Node* promise_map,
-                                               Label* if_fast, Label* if_slow);
-
-  // We can skip the "then" lookup on {receiver_map} if it's [[Prototype]]
-  // is the (initial) Promise.prototype and the Promise#then() protector
-  // is intact, as that guards the lookup path for the "then" property
-  // on JSPromise instances which have the (initial) %PromisePrototype%.
-  void BranchIfPromiseThenLookupChainIntact(Node* native_context,
-                                            Node* receiver_map, Label* if_fast,
-                                            Label* if_slow);
-
-  // If resolve is Undefined, we use the builtin %PromiseResolve%
-  // intrinsic, otherwise we use the given resolve function.
-  Node* CallResolve(Node* native_context, Node* constructor, Node* resolve,
-                    Node* value, Label* if_exception, Variable* var_exception);
-  template <typename... TArgs>
-  Node* InvokeThen(Node* native_context, Node* receiver, TArgs... args);
-
-  void BranchIfAccessCheckFailed(SloppyTNode<Context> context,
-                                 SloppyTNode<Context> native_context,
-                                 Node* promise_constructor, Node* executor,
-                                 Label* if_noaccess);
-
-  std::pair<Node*, Node*> CreatePromiseFinallyFunctions(Node* on_finally,
-                                                        Node* constructor,
-                                                        Node* native_context);
-  Node* CreateValueThunkFunction(Node* value, Node* native_context);
-
-  Node* CreateThrowerFunction(Node* reason, Node* native_context);
-
-  using PromiseAllResolvingElementFunction =
-      std::function<TNode<Object>(TNode<Context> context, TNode<Smi> index,
-                                  TNode<NativeContext> native_context,
-                                  TNode<PromiseCapability> capability)>;
-
-  Node* PerformPromiseAll(
-      Node* context, Node* constructor, Node* capability,
-      const TorqueStructIteratorRecord& record,
-      const PromiseAllResolvingElementFunction& create_resolve_element_function,
-      const PromiseAllResolvingElementFunction& create_reject_element_function,
-      Label* if_exception, Variable* var_exception);
-
-  void SetForwardingHandlerIfTrue(Node* context, Node* condition,
-                                  const NodeGenerator& object);
-  inline void SetForwardingHandlerIfTrue(Node* context, Node* condition,
-                                         Node* object) {
-    return SetForwardingHandlerIfTrue(context, condition,
-                                      [object]() -> Node* { return object; });
-  }
-  void SetPromiseHandledByIfTrue(Node* context, Node* condition, Node* promise,
-                                 const NodeGenerator& handled_by);
-
-  TNode<Word32T> PromiseStatus(Node* promise);
-
-  void PromiseReactionJob(Node* context, Node* argument, Node* handler,
-                          Node* promise_or_capability,
-                          PromiseReaction::Type type);
-
-  TNode<BoolT> IsPromiseStatus(TNode<Word32T> actual,
-                               v8::Promise::PromiseState expected);
-  void PromiseSetStatus(Node* promise, v8::Promise::PromiseState status);
-
-  TNode<JSPromise> AllocateJSPromise(TNode<Context> context);
-
-  void ExtractHandlerContext(Node* handler, Variable* var_context);
-  void Generate_PromiseAll(
-      TNode<Context> context, TNode<Object> receiver, TNode<Object> iterable,
-      const PromiseAllResolvingElementFunction& create_resolve_element_function,
-      const PromiseAllResolvingElementFunction& create_reject_element_function);
-
-  using CreatePromiseAllResolveElementFunctionValue =
-      std::function<TNode<Object>(TNode<Context> context,
-                                  TNode<NativeContext> native_context,
-                                  TNode<Object> value)>;
-
-  void Generate_PromiseAllResolveElementClosure(
-      TNode<Context> context, TNode<Object> value, TNode<JSFunction> function,
-      const CreatePromiseAllResolveElementFunctionValue& callback);
+  TNode<HeapObject> AllocatePromiseReactionJobTask(TNode<Context> context);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-proxy-gen.cc b/deps/v8/src/builtins/builtins-proxy-gen.cc
index 71d4e8226f595b..c0901953d1da4d 100644
--- a/deps/v8/src/builtins/builtins-proxy-gen.cc
+++ b/deps/v8/src/builtins/builtins-proxy-gen.cc
@@ -11,13 +11,15 @@
 #include "src/objects/js-proxy.h"
 #include "src/objects/objects-inl.h"
 
+#include "torque-generated/exported-macros-assembler-tq.h"
+
 namespace v8 {
 namespace internal {
 
 TNode<JSProxy> ProxiesCodeStubAssembler::AllocateProxy(
     TNode<Context> context, TNode<JSReceiver> target,
     TNode<JSReceiver> handler) {
-  VARIABLE(map, MachineRepresentation::kTagged);
+  TVARIABLE(Map, map);
 
   Label callable_target(this), constructor_target(this), none_target(this),
       create_proxy(this);
@@ -31,19 +33,19 @@ TNode<JSProxy> ProxiesCodeStubAssembler::AllocateProxy(
     // Every object that is a constructor is implicitly callable
     // so it's okay to nest this check here
     GotoIf(IsConstructor(target), &constructor_target);
-    map.Bind(
+    map = CAST(
         LoadContextElement(nativeContext, Context::PROXY_CALLABLE_MAP_INDEX));
     Goto(&create_proxy);
   }
   BIND(&constructor_target);
   {
-    map.Bind(LoadContextElement(nativeContext,
-                                Context::PROXY_CONSTRUCTOR_MAP_INDEX));
+    map = CAST(LoadContextElement(nativeContext,
+                                  Context::PROXY_CONSTRUCTOR_MAP_INDEX));
     Goto(&create_proxy);
   }
   BIND(&none_target);
   {
-    map.Bind(LoadContextElement(nativeContext, Context::PROXY_MAP_INDEX));
+    map = CAST(LoadContextElement(nativeContext, Context::PROXY_MAP_INDEX));
     Goto(&create_proxy);
   }
 
@@ -58,79 +60,20 @@ TNode<JSProxy> ProxiesCodeStubAssembler::AllocateProxy(
   return CAST(proxy);
 }
 
-Node* ProxiesCodeStubAssembler::AllocateJSArrayForCodeStubArguments(
-    Node* context, const CodeStubArguments& args, Node* argc,
-    ParameterMode mode) {
-  Comment("AllocateJSArrayForCodeStubArguments");
-
-  Label if_empty_array(this), allocate_js_array(this);
-  // Do not use AllocateJSArray since {elements} might end up in LOS.
-  VARIABLE(elements, MachineRepresentation::kTagged);
-
-  TNode<Smi> length = ParameterToTagged(argc, mode);
-  GotoIf(SmiEqual(length, SmiConstant(0)), &if_empty_array);
-  {
-    Label if_large_object(this, Label::kDeferred);
-    TNode<FixedArrayBase> allocated_elements = AllocateFixedArray(
-        PACKED_ELEMENTS, argc, mode, kAllowLargeObjectAllocation);
-    elements.Bind(allocated_elements);
-
-    TVARIABLE(IntPtrT, offset,
-              IntPtrConstant(FixedArrayBase::kHeaderSize - kHeapObjectTag));
-    VariableList list({&offset}, zone());
-
-    GotoIf(SmiGreaterThan(length, SmiConstant(FixedArray::kMaxRegularLength)),
-           &if_large_object);
-    args.ForEach(list, [&](TNode<Object> arg) {
-      StoreNoWriteBarrier(MachineRepresentation::kTagged, allocated_elements,
-                          offset.value(), arg);
-      Increment(&offset, kTaggedSize);
-    });
-    Goto(&allocate_js_array);
-
-    BIND(&if_large_object);
-    {
-      args.ForEach(list, [&](TNode<Object> arg) {
-        Store(allocated_elements, offset.value(), arg);
-        Increment(&offset, kTaggedSize);
-      });
-      Goto(&allocate_js_array);
-    }
-  }
-
-  BIND(&if_empty_array);
-  {
-    elements.Bind(EmptyFixedArrayConstant());
-    Goto(&allocate_js_array);
-  }
-
-  BIND(&allocate_js_array);
-  // Allocate the result JSArray.
-  TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<Map> array_map =
-      LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
-  TNode<JSArray> array =
-      AllocateJSArray(array_map, CAST(elements.value()), length);
-
-  return array;
-}
-
-Node* ProxiesCodeStubAssembler::CreateProxyRevokeFunctionContext(
-    Node* proxy, Node* native_context) {
-  TNode<HeapObject> const context =
-      Allocate(FixedArray::SizeFor(kProxyContextLength));
-  StoreMapNoWriteBarrier(context, RootIndex::kFunctionContextMap);
-  InitializeFunctionContext(native_context, context, kProxyContextLength);
-  StoreContextElementNoWriteBarrier(CAST(context), kProxySlot, proxy);
+TNode<Context> ProxiesCodeStubAssembler::CreateProxyRevokeFunctionContext(
+    TNode<JSProxy> proxy, TNode<NativeContext> native_context) {
+  const TNode<Context> context =
+      AllocateSyntheticFunctionContext(native_context, kProxyContextLength);
+  StoreContextElementNoWriteBarrier(context, kProxySlot, proxy);
   return context;
 }
 
 TNode<JSFunction> ProxiesCodeStubAssembler::AllocateProxyRevokeFunction(
     TNode<Context> context, TNode<JSProxy> proxy) {
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
 
   const TNode<Context> proxy_context =
-      CAST(CreateProxyRevokeFunctionContext(proxy, native_context));
+      CreateProxyRevokeFunctionContext(proxy, native_context);
   const TNode<Map> revoke_map = CAST(LoadContextElement(
       native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX));
   const TNode<SharedFunctionInfo> revoke_info = CAST(
@@ -141,14 +84,15 @@ TNode<JSFunction> ProxiesCodeStubAssembler::AllocateProxyRevokeFunction(
 }
 
 TF_BUILTIN(CallProxy, ProxiesCodeStubAssembler) {
-  Node* argc = Parameter(Descriptor::kActualArgumentsCount);
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
   TNode<IntPtrT> argc_ptr = ChangeInt32ToIntPtr(argc);
   TNode<JSProxy> proxy = CAST(Parameter(Descriptor::kFunction));
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   CSA_ASSERT(this, IsCallable(proxy));
 
-  PerformStackCheck(CAST(context));
+  PerformStackCheck(context);
 
   Label throw_proxy_handler_revoked(this, Label::kDeferred),
       trap_undefined(this);
@@ -170,18 +114,20 @@ TF_BUILTIN(CallProxy, ProxiesCodeStubAssembler) {
   // 5. Let trap be ? GetMethod(handler, "apply").
   // 6. If trap is undefined, then
   Handle<Name> trap_name = factory()->apply_string();
-  Node* trap = GetMethod(context, handler, trap_name, &trap_undefined);
+  TNode<Object> trap = GetMethod(context, handler, trap_name, &trap_undefined);
 
   CodeStubArguments args(this, argc_ptr);
   TNode<Object> receiver = args.GetReceiver();
 
   // 7. Let argArray be CreateArrayFromList(argumentsList).
-  Node* array = AllocateJSArrayForCodeStubArguments(context, args, argc_ptr,
-                                                    INTPTR_PARAMETERS);
+  TNode<JSArray> array =
+      EmitFastNewAllArguments(UncheckedCast<Context>(context),
+                              UncheckedCast<RawPtrT>(LoadFramePointer()),
+                              UncheckedCast<IntPtrT>(argc_ptr));
 
   // 8. Return Call(trap, handler, «target, thisArgument, argArray»).
-  Node* result = CallJS(CodeFactory::Call(isolate()), context, trap, handler,
-                        target, receiver, array);
+  TNode<Object> result = CallJS(CodeFactory::Call(isolate()), context, trap,
+                                handler, target, receiver, array);
   args.PopAndReturn(result);
 
   BIND(&trap_undefined);
@@ -195,13 +141,13 @@ TF_BUILTIN(CallProxy, ProxiesCodeStubAssembler) {
 }
 
 TF_BUILTIN(ConstructProxy, ProxiesCodeStubAssembler) {
-  Node* argc = Parameter(Descriptor::kActualArgumentsCount);
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
   TNode<IntPtrT> argc_ptr = ChangeInt32ToIntPtr(argc);
-  Node* proxy = Parameter(Descriptor::kTarget);
-  Node* new_target = Parameter(Descriptor::kNewTarget);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<JSProxy> proxy = CAST(Parameter(Descriptor::kTarget));
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kNewTarget));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
-  CSA_ASSERT(this, IsJSProxy(proxy));
   CSA_ASSERT(this, IsCallable(proxy));
 
   Label throw_proxy_handler_revoked(this, Label::kDeferred),
@@ -224,21 +170,23 @@ TF_BUILTIN(ConstructProxy, ProxiesCodeStubAssembler) {
   // 5. Let trap be ? GetMethod(handler, "construct").
   // 6. If trap is undefined, then
   Handle<Name> trap_name = factory()->construct_string();
-  Node* trap = GetMethod(context, handler, trap_name, &trap_undefined);
+  TNode<Object> trap = GetMethod(context, handler, trap_name, &trap_undefined);
 
   CodeStubArguments args(this, argc_ptr);
 
   // 7. Let argArray be CreateArrayFromList(argumentsList).
-  Node* array = AllocateJSArrayForCodeStubArguments(context, args, argc_ptr,
-                                                    INTPTR_PARAMETERS);
+  TNode<JSArray> array =
+      EmitFastNewAllArguments(UncheckedCast<Context>(context),
+                              UncheckedCast<RawPtrT>(LoadFramePointer()),
+                              UncheckedCast<IntPtrT>(argc_ptr));
 
   // 8. Let newObj be ? Call(trap, handler, « target, argArray, newTarget »).
-  Node* new_obj = CallJS(CodeFactory::Call(isolate()), context, trap, handler,
-                         target, array, new_target);
+  TNode<Object> new_obj = CallJS(CodeFactory::Call(isolate()), context, trap,
+                                 handler, target, array, new_target);
 
   // 9. If Type(newObj) is not Object, throw a TypeError exception.
   GotoIf(TaggedIsSmi(new_obj), &not_an_object);
-  GotoIfNot(IsJSReceiver(new_obj), &not_an_object);
+  GotoIfNot(IsJSReceiver(CAST(new_obj)), &not_an_object);
 
   // 10. Return newObj.
   args.PopAndReturn(new_obj);
@@ -268,9 +216,9 @@ void ProxiesCodeStubAssembler::CheckGetSetTrapResult(
     JSProxy::AccessKind access_kind) {
   // TODO(mslekova): Think of a better name for the trap_result param.
   TNode<Map> map = LoadMap(target);
-  VARIABLE(var_value, MachineRepresentation::kTagged);
-  VARIABLE(var_details, MachineRepresentation::kWord32);
-  VARIABLE(var_raw_value, MachineRepresentation::kTagged);
+  TVARIABLE(Object, var_value);
+  TVARIABLE(Uint32T, var_details);
+  TVARIABLE(Object, var_raw_value);
 
   Label if_found_value(this), check_in_runtime(this, Label::kDeferred),
       check_passed(this);
@@ -311,7 +259,7 @@ void ProxiesCodeStubAssembler::CheckGetSetTrapResult(
 
     BIND(&check_accessor);
     {
-      Node* accessor_pair = var_raw_value.value();
+      TNode<HeapObject> accessor_pair = CAST(var_raw_value.value());
 
       if (access_kind == JSProxy::kGet) {
         Label continue_check(this, Label::kDeferred);
@@ -376,9 +324,9 @@ void ProxiesCodeStubAssembler::CheckHasTrapResult(TNode<Context> context,
                                                   TNode<JSProxy> proxy,
                                                   TNode<Name> name) {
   TNode<Map> target_map = LoadMap(target);
-  VARIABLE(var_value, MachineRepresentation::kTagged);
-  VARIABLE(var_details, MachineRepresentation::kWord32);
-  VARIABLE(var_raw_value, MachineRepresentation::kTagged);
+  TVARIABLE(Object, var_value);
+  TVARIABLE(Uint32T, var_details);
+  TVARIABLE(Object, var_raw_value);
 
   Label if_found_value(this, Label::kDeferred),
       throw_non_configurable(this, Label::kDeferred),
diff --git a/deps/v8/src/builtins/builtins-proxy-gen.h b/deps/v8/src/builtins/builtins-proxy-gen.h
index 03b3749bf5d44a..e0ac0824590876 100644
--- a/deps/v8/src/builtins/builtins-proxy-gen.h
+++ b/deps/v8/src/builtins/builtins-proxy-gen.h
@@ -39,12 +39,9 @@ class ProxiesCodeStubAssembler : public CodeStubAssembler {
     kProxyContextLength,
   };
 
-  Node* AllocateJSArrayForCodeStubArguments(Node* context,
-                                            const CodeStubArguments& args,
-                                            Node* argc, ParameterMode mode);
-
  private:
-  Node* CreateProxyRevokeFunctionContext(Node* proxy, Node* native_context);
+  TNode<Context> CreateProxyRevokeFunctionContext(
+      TNode<JSProxy> proxy, TNode<NativeContext> native_context);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-reflect-gen.cc b/deps/v8/src/builtins/builtins-reflect-gen.cc
deleted file mode 100644
index 6cffd6ed55ba39..00000000000000
--- a/deps/v8/src/builtins/builtins-reflect-gen.cc
+++ /dev/null
@@ -1,25 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/builtins/builtins-utils-gen.h"
-#include "src/builtins/builtins.h"
-#include "src/codegen/code-stub-assembler.h"
-
-namespace v8 {
-namespace internal {
-
-// ES section #sec-reflect.has
-TF_BUILTIN(ReflectHas, CodeStubAssembler) {
-  TNode<Object> target = CAST(Parameter(Descriptor::kTarget));
-  TNode<Object> key = CAST(Parameter(Descriptor::kKey));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  ThrowIfNotJSReceiver(context, target, MessageTemplate::kCalledOnNonObject,
-                       "Reflect.has");
-
-  Return(CallBuiltin(Builtins::kHasProperty, context, target, key));
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-reflect.cc b/deps/v8/src/builtins/builtins-reflect.cc
index 6151fcbd4761c4..8ad1e56143747e 100644
--- a/deps/v8/src/builtins/builtins-reflect.cc
+++ b/deps/v8/src/builtins/builtins-reflect.cc
@@ -113,8 +113,9 @@ BUILTIN(ReflectSet) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, name,
                                      Object::ToName(isolate, key));
 
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, receiver, name, Handle<JSReceiver>::cast(target));
+  LookupIterator::Key lookup_key(isolate, name);
+  LookupIterator it(isolate, receiver, lookup_key,
+                    Handle<JSReceiver>::cast(target));
   Maybe<bool> result = Object::SetSuperProperty(
       &it, value, StoreOrigin::kMaybeKeyed, Just(ShouldThrow::kDontThrow));
   MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
diff --git a/deps/v8/src/builtins/builtins-regexp-gen.cc b/deps/v8/src/builtins/builtins-regexp-gen.cc
index b333f2a820c681..792f0e44a67967 100644
--- a/deps/v8/src/builtins/builtins-regexp-gen.cc
+++ b/deps/v8/src/builtins/builtins-regexp-gen.cc
@@ -44,8 +44,8 @@ TNode<RawPtrT> RegExpBuiltinsAssembler::LoadCodeObjectEntry(TNode<Code> code) {
   TVARIABLE(RawPtrT, var_result);
 
   Label if_code_is_off_heap(this), out(this);
-  TNode<Int32T> builtin_index = UncheckedCast<Int32T>(
-      LoadObjectField(code, Code::kBuiltinIndexOffset, MachineType::Int32()));
+  TNode<Int32T> builtin_index =
+      LoadObjectField<Int32T>(code, Code::kBuiltinIndexOffset);
   {
     GotoIfNot(Word32Equal(builtin_index, Int32Constant(Builtins::kNoBuiltinId)),
               &if_code_is_off_heap);
@@ -78,7 +78,7 @@ TNode<RawPtrT> RegExpBuiltinsAssembler::LoadCodeObjectEntry(TNode<Code> code) {
 
 TNode<JSRegExpResult> RegExpBuiltinsAssembler::AllocateRegExpResult(
     TNode<Context> context, TNode<Smi> length, TNode<Smi> index,
-    TNode<String> input, TNode<RegExpMatchInfo> match_info,
+    TNode<String> input, TNode<JSRegExp> regexp, TNode<Number> last_index,
     TNode<FixedArray>* elements_out) {
   CSA_ASSERT(this, SmiLessThanOrEqual(
                        length, SmiConstant(JSArray::kMaxFastArrayLength)));
@@ -99,11 +99,11 @@ TNode<JSRegExpResult> RegExpBuiltinsAssembler::AllocateRegExpResult(
   TNode<FixedArrayBase> elements;
   std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
       elements_kind, map, length, no_allocation_site, length_intptr,
-      INTPTR_PARAMETERS, kAllowLargeObjectAllocation, JSRegExpResult::kSize);
+      kAllowLargeObjectAllocation, JSRegExpResult::kSize);
 
   // Finish result initialization.
 
-  TNode<JSRegExpResult> result = CAST(array);
+  TNode<JSRegExpResult> result = UncheckedCast<JSRegExpResult>(array);
 
   // Load undefined value once here to avoid multiple LoadRoots.
   TNode<Oddball> undefined_value = UncheckedCast<Oddball>(
@@ -117,10 +117,20 @@ TNode<JSRegExpResult> RegExpBuiltinsAssembler::AllocateRegExpResult(
   StoreObjectFieldNoWriteBarrier(result, JSRegExpResult::kNamesOffset,
                                  undefined_value);
 
-  // Stash match_info in order to build JSRegExpResultIndices lazily when the
-  // 'indices' property is accessed.
-  StoreObjectField(result, JSRegExpResult::kCachedIndicesOrMatchInfoOffset,
-                   match_info);
+  // Stash regexp in order to re-execute and build JSRegExpResultIndices lazily
+  // when the 'indices' property is accessed.
+  StoreObjectField(result, JSRegExpResult::kCachedIndicesOrRegexpOffset,
+                   regexp);
+  StoreObjectField(result, JSRegExpResult::kRegexpInputOffset, input);
+
+  // If non-smi last_index then store an SmiZero instead.
+  {
+    TNode<Smi> last_index_smi = Select<Smi>(
+        TaggedIsSmi(last_index), [=] { return CAST(last_index); },
+        [=] { return SmiZero(); });
+    StoreObjectField(result, JSRegExpResult::kRegexpLastIndexOffset,
+                     last_index_smi);
+  }
 
   // Finish elements initialization.
 
@@ -131,33 +141,11 @@ TNode<JSRegExpResult> RegExpBuiltinsAssembler::AllocateRegExpResult(
   return result;
 }
 
-TNode<Object> RegExpBuiltinsAssembler::RegExpCreate(
-    TNode<Context> context, TNode<Context> native_context,
-    TNode<Object> maybe_string, TNode<String> flags) {
-  TNode<JSFunction> regexp_function =
-      CAST(LoadContextElement(native_context, Context::REGEXP_FUNCTION_INDEX));
-  TNode<Map> initial_map = CAST(LoadObjectField(
-      regexp_function, JSFunction::kPrototypeOrInitialMapOffset));
-  return RegExpCreate(context, initial_map, maybe_string, flags);
-}
-
-TNode<Object> RegExpBuiltinsAssembler::RegExpCreate(TNode<Context> context,
-                                                    TNode<Map> initial_map,
-                                                    TNode<Object> maybe_string,
-                                                    TNode<String> flags) {
-  TNode<String> pattern = Select<String>(
-      IsUndefined(maybe_string), [=] { return EmptyStringConstant(); },
-      [=] { return ToString_Inline(context, maybe_string); });
-  TNode<JSObject> regexp = AllocateJSObjectFromMap(initial_map);
-  return CallRuntime(Runtime::kRegExpInitializeAndCompile, context, regexp,
-                     pattern, flags);
-}
-
 TNode<Object> RegExpBuiltinsAssembler::FastLoadLastIndexBeforeSmiCheck(
     TNode<JSRegExp> regexp) {
   // Load the in-object field.
   static const int field_offset =
-      JSRegExp::kSize + JSRegExp::kLastIndexFieldIndex * kTaggedSize;
+      JSRegExp::kHeaderSize + JSRegExp::kLastIndexFieldIndex * kTaggedSize;
   return LoadObjectField(regexp, field_offset);
 }
 
@@ -166,20 +154,13 @@ TNode<Object> RegExpBuiltinsAssembler::SlowLoadLastIndex(TNode<Context> context,
   return GetProperty(context, regexp, isolate()->factory()->lastIndex_string());
 }
 
-TNode<Object> RegExpBuiltinsAssembler::LoadLastIndex(TNode<Context> context,
-                                                     TNode<Object> regexp,
-                                                     bool is_fastpath) {
-  return is_fastpath ? FastLoadLastIndex(CAST(regexp))
-                     : SlowLoadLastIndex(context, regexp);
-}
-
 // The fast-path of StoreLastIndex when regexp is guaranteed to be an unmodified
 // JSRegExp instance.
 void RegExpBuiltinsAssembler::FastStoreLastIndex(TNode<JSRegExp> regexp,
                                                  TNode<Smi> value) {
   // Store the in-object field.
   static const int field_offset =
-      JSRegExp::kSize + JSRegExp::kLastIndexFieldIndex * kTaggedSize;
+      JSRegExp::kHeaderSize + JSRegExp::kLastIndexFieldIndex * kTaggedSize;
   StoreObjectField(regexp, field_offset, value);
 }
 
@@ -190,20 +171,10 @@ void RegExpBuiltinsAssembler::SlowStoreLastIndex(SloppyTNode<Context> context,
   SetPropertyStrict(context, regexp, name, value);
 }
 
-void RegExpBuiltinsAssembler::StoreLastIndex(TNode<Context> context,
-                                             TNode<Object> regexp,
-                                             TNode<Number> value,
-                                             bool is_fastpath) {
-  if (is_fastpath) {
-    FastStoreLastIndex(CAST(regexp), CAST(value));
-  } else {
-    SlowStoreLastIndex(context, regexp, value);
-  }
-}
-
 TNode<JSRegExpResult> RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
-    TNode<Context> context, TNode<JSReceiver> maybe_regexp,
-    TNode<RegExpMatchInfo> match_info, TNode<String> string) {
+    TNode<Context> context, TNode<JSRegExp> regexp,
+    TNode<RegExpMatchInfo> match_info, TNode<String> string,
+    TNode<Number> last_index) {
   Label named_captures(this), out(this);
 
   TNode<IntPtrT> num_indices = SmiUntag(CAST(UnsafeLoadFixedArrayElement(
@@ -221,8 +192,9 @@ TNode<JSRegExpResult> RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
       CAST(CallBuiltin(Builtins::kSubString, context, string, start, end));
 
   TNode<FixedArray> result_elements;
-  TNode<JSRegExpResult> result = AllocateRegExpResult(
-      context, num_results, start, string, match_info, &result_elements);
+  TNode<JSRegExpResult> result =
+      AllocateRegExpResult(context, num_results, start, string, regexp,
+                           last_index, &result_elements);
 
   UnsafeStoreFixedArrayElement(result_elements, 0, first);
 
@@ -271,16 +243,14 @@ TNode<JSRegExpResult> RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
   {
     CSA_ASSERT(this, SmiGreaterThan(num_results, SmiConstant(1)));
 
-    // We reach this point only if captures exist, implying that this is an
-    // IRREGEXP JSRegExp.
-
-    TNode<JSRegExp> regexp = CAST(maybe_regexp);
-
     // Preparations for named capture properties. Exit early if the result does
     // not have any named captures to minimize performance impact.
 
     TNode<FixedArray> data =
         CAST(LoadObjectField(regexp, JSRegExp::kDataOffset));
+
+    // We reach this point only if captures exist, implying that this is an
+    // IRREGEXP JSRegExp.
     CSA_ASSERT(this,
                SmiEqual(CAST(LoadFixedArrayElement(data, JSRegExp::kTagIndex)),
                         SmiConstant(JSRegExp::IRREGEXP)));
@@ -398,8 +368,6 @@ TNode<HeapObject> RegExpBuiltinsAssembler::RegExpExecInternal(
       ExternalConstant(ExternalReference::isolate_address(isolate()));
   TNode<ExternalReference> regexp_stack_memory_top_address = ExternalConstant(
       ExternalReference::address_of_regexp_stack_memory_top_address(isolate()));
-  TNode<ExternalReference> regexp_stack_memory_size_address = ExternalConstant(
-      ExternalReference::address_of_regexp_stack_memory_size(isolate()));
   TNode<ExternalReference> static_offsets_vector_address = ExternalConstant(
       ExternalReference::address_of_static_offsets_vector(isolate()));
 
@@ -518,21 +486,6 @@ TNode<HeapObject> RegExpBuiltinsAssembler::RegExpExecInternal(
   GotoIf(TaggedIsSmi(var_code.value()), &runtime);
   TNode<Code> code = CAST(var_code.value());
 
-  // Ensure that a RegExp stack is allocated when using compiled Irregexp.
-  // TODO(jgruber): Guarantee an allocated stack and remove this check.
-  {
-    Label next(this);
-    GotoIfNot(TaggedIsSmi(var_bytecode.value()), &next);
-    CSA_ASSERT(this, SmiEqual(CAST(var_bytecode.value()),
-                              SmiConstant(JSRegExp::kUninitializedValue)));
-
-    TNode<IntPtrT> stack_size = UncheckedCast<IntPtrT>(
-        Load(MachineType::IntPtr(), regexp_stack_memory_size_address));
-    Branch(IntPtrEqual(stack_size, IntPtrZero()), &runtime, &next);
-
-    BIND(&next);
-  }
-
   Label if_success(this), if_exception(this, Label::kDeferred);
   {
     IncrementCounter(isolate()->counters()->regexp_entry_native(), 1);
@@ -729,178 +682,6 @@ TNode<HeapObject> RegExpBuiltinsAssembler::RegExpExecInternal(
   return var_result.value();
 }
 
-// ES#sec-regexp.prototype.exec
-// RegExp.prototype.exec ( string )
-// Implements the core of RegExp.prototype.exec but without actually
-// constructing the JSRegExpResult. Returns a fixed array containing match
-// indices as returned by RegExpExecStub on successful match, and jumps to
-// if_didnotmatch otherwise.
-TNode<RegExpMatchInfo>
-RegExpBuiltinsAssembler::RegExpPrototypeExecBodyWithoutResult(
-    TNode<Context> context, TNode<JSReceiver> maybe_regexp,
-    TNode<String> string, Label* if_didnotmatch, const bool is_fastpath) {
-  if (!is_fastpath) {
-    ThrowIfNotInstanceType(context, maybe_regexp, JS_REG_EXP_TYPE,
-                           "RegExp.prototype.exec");
-  }
-
-  TNode<JSRegExp> regexp = CAST(maybe_regexp);
-
-  TVARIABLE(HeapObject, var_result);
-  Label out(this);
-
-  // Load lastIndex.
-  TVARIABLE(Number, var_lastindex);
-  {
-    TNode<Object> regexp_lastindex =
-        LoadLastIndex(context, regexp, is_fastpath);
-
-    if (is_fastpath) {
-      // ToLength on a positive smi is a nop and can be skipped.
-      CSA_ASSERT(this, TaggedIsPositiveSmi(regexp_lastindex));
-      var_lastindex = CAST(regexp_lastindex);
-    } else {
-      // Omit ToLength if lastindex is a non-negative smi.
-      Label call_tolength(this, Label::kDeferred), is_smi(this), next(this);
-      Branch(TaggedIsPositiveSmi(regexp_lastindex), &is_smi, &call_tolength);
-
-      BIND(&call_tolength);
-      var_lastindex = ToLength_Inline(context, regexp_lastindex);
-      Goto(&next);
-
-      BIND(&is_smi);
-      var_lastindex = CAST(regexp_lastindex);
-      Goto(&next);
-
-      BIND(&next);
-    }
-  }
-
-  // Check whether the regexp is global or sticky, which determines whether we
-  // update last index later on.
-  TNode<Smi> flags = CAST(LoadObjectField(regexp, JSRegExp::kFlagsOffset));
-  TNode<IntPtrT> is_global_or_sticky = WordAnd(
-      SmiUntag(flags), IntPtrConstant(JSRegExp::kGlobal | JSRegExp::kSticky));
-  TNode<BoolT> should_update_last_index =
-      WordNotEqual(is_global_or_sticky, IntPtrZero());
-
-  // Grab and possibly update last index.
-  Label run_exec(this);
-  {
-    Label if_doupdate(this), if_dontupdate(this);
-    Branch(should_update_last_index, &if_doupdate, &if_dontupdate);
-
-    BIND(&if_doupdate);
-    {
-      Label if_isoob(this, Label::kDeferred);
-      GotoIfNot(TaggedIsSmi(var_lastindex.value()), &if_isoob);
-      TNode<Smi> string_length = LoadStringLengthAsSmi(string);
-      GotoIfNot(SmiLessThanOrEqual(CAST(var_lastindex.value()), string_length),
-                &if_isoob);
-      Goto(&run_exec);
-
-      BIND(&if_isoob);
-      {
-        StoreLastIndex(context, regexp, SmiZero(), is_fastpath);
-        Goto(if_didnotmatch);
-      }
-    }
-
-    BIND(&if_dontupdate);
-    {
-      var_lastindex = SmiZero();
-      Goto(&run_exec);
-    }
-  }
-
-  TNode<HeapObject> match_indices;
-  Label successful_match(this);
-  BIND(&run_exec);
-  {
-    // Get last match info from the context.
-    TNode<NativeContext> native_context = LoadNativeContext(context);
-    TNode<RegExpMatchInfo> last_match_info = CAST(LoadContextElement(
-        native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX));
-
-    // Call the exec stub.
-    match_indices = RegExpExecInternal(context, regexp, string,
-                                       var_lastindex.value(), last_match_info);
-    var_result = match_indices;
-
-    // {match_indices} is either null or the RegExpMatchInfo array.
-    // Return early if exec failed, possibly updating last index.
-    GotoIfNot(IsNull(match_indices), &successful_match);
-
-    GotoIfNot(should_update_last_index, if_didnotmatch);
-
-    StoreLastIndex(context, regexp, SmiZero(), is_fastpath);
-    Goto(if_didnotmatch);
-  }
-
-  BIND(&successful_match);
-  {
-    GotoIfNot(should_update_last_index, &out);
-
-    // Update the new last index from {match_indices}.
-    TNode<Smi> new_lastindex = CAST(UnsafeLoadFixedArrayElement(
-        CAST(match_indices), RegExpMatchInfo::kFirstCaptureIndex + 1));
-
-    StoreLastIndex(context, regexp, new_lastindex, is_fastpath);
-    Goto(&out);
-  }
-
-  BIND(&out);
-  return CAST(var_result.value());
-}
-
-TNode<RegExpMatchInfo>
-RegExpBuiltinsAssembler::RegExpPrototypeExecBodyWithoutResultFast(
-    TNode<Context> context, TNode<JSRegExp> maybe_regexp, TNode<String> string,
-    Label* if_didnotmatch) {
-  return RegExpPrototypeExecBodyWithoutResult(context, maybe_regexp, string,
-                                              if_didnotmatch, true);
-}
-
-// ES#sec-regexp.prototype.exec
-// RegExp.prototype.exec ( string )
-TNode<HeapObject> RegExpBuiltinsAssembler::RegExpPrototypeExecBody(
-    TNode<Context> context, TNode<JSReceiver> maybe_regexp,
-    TNode<String> string, const bool is_fastpath) {
-  TVARIABLE(HeapObject, var_result);
-
-  Label if_didnotmatch(this), out(this);
-  TNode<RegExpMatchInfo> match_indices = RegExpPrototypeExecBodyWithoutResult(
-      context, maybe_regexp, string, &if_didnotmatch, is_fastpath);
-
-  // Successful match.
-  {
-    var_result = ConstructNewResultFromMatchInfo(context, maybe_regexp,
-                                                 match_indices, string);
-    Goto(&out);
-  }
-
-  BIND(&if_didnotmatch);
-  {
-    var_result = NullConstant();
-    Goto(&out);
-  }
-
-  BIND(&out);
-  return var_result.value();
-}
-
-TNode<BoolT> RegExpBuiltinsAssembler::IsReceiverInitialRegExpPrototype(
-    SloppyTNode<Context> context, SloppyTNode<Object> receiver) {
-  TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<JSFunction> const regexp_fun =
-      CAST(LoadContextElement(native_context, Context::REGEXP_FUNCTION_INDEX));
-  TNode<Object> const initial_map =
-      LoadObjectField(regexp_fun, JSFunction::kPrototypeOrInitialMapOffset);
-  TNode<HeapObject> const initial_prototype =
-      LoadMapPrototype(CAST(initial_map));
-  return TaggedEqual(receiver, initial_prototype);
-}
-
 TNode<BoolT> RegExpBuiltinsAssembler::IsFastRegExpNoPrototype(
     TNode<Context> context, TNode<Object> object, TNode<Map> map) {
   Label out(this);
@@ -911,12 +692,12 @@ TNode<BoolT> RegExpBuiltinsAssembler::IsFastRegExpNoPrototype(
   GotoIfForceSlowPath(&out);
 #endif
 
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<HeapObject> const regexp_fun =
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<HeapObject> regexp_fun =
       CAST(LoadContextElement(native_context, Context::REGEXP_FUNCTION_INDEX));
-  TNode<Object> const initial_map =
+  const TNode<Object> initial_map =
       LoadObjectField(regexp_fun, JSFunction::kPrototypeOrInitialMapOffset);
-  TNode<BoolT> const has_initialmap = TaggedEqual(map, initial_map);
+  const TNode<BoolT> has_initialmap = TaggedEqual(map, initial_map);
 
   var_result = has_initialmap;
   GotoIfNot(has_initialmap, &out);
@@ -931,51 +712,6 @@ TNode<BoolT> RegExpBuiltinsAssembler::IsFastRegExpNoPrototype(
   return var_result.value();
 }
 
-// We also return true if exec is undefined (and hence per spec)
-// the original {exec} will be used.
-TNode<BoolT> RegExpBuiltinsAssembler::IsFastRegExpWithOriginalExec(
-    TNode<Context> context, TNode<JSRegExp> object) {
-  CSA_ASSERT(this, TaggedIsNotSmi(object));
-  Label out(this);
-  Label check_last_index(this);
-  TVARIABLE(BoolT, var_result);
-
-#ifdef V8_ENABLE_FORCE_SLOW_PATH
-  var_result = BoolConstant(false);
-  GotoIfForceSlowPath(&out);
-#endif
-
-  TNode<BoolT> is_regexp = HasInstanceType(object, JS_REG_EXP_TYPE);
-
-  var_result = is_regexp;
-  GotoIfNot(is_regexp, &out);
-
-  TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<Object> original_exec =
-      LoadContextElement(native_context, Context::REGEXP_EXEC_FUNCTION_INDEX);
-
-  TNode<Object> regexp_exec =
-      GetProperty(context, object, isolate()->factory()->exec_string());
-
-  TNode<BoolT> has_initialexec = TaggedEqual(regexp_exec, original_exec);
-  var_result = has_initialexec;
-  GotoIf(has_initialexec, &check_last_index);
-  TNode<BoolT> is_undefined = IsUndefined(regexp_exec);
-  var_result = is_undefined;
-  GotoIfNot(is_undefined, &out);
-  Goto(&check_last_index);
-
-  BIND(&check_last_index);
-  // The smi check is required to omit ToLength(lastIndex) calls with possible
-  // user-code execution on the fast path.
-  TNode<Object> last_index = FastLoadLastIndexBeforeSmiCheck(object);
-  var_result = TaggedIsPositiveSmi(last_index);
-  Goto(&out);
-
-  BIND(&out);
-  return var_result.value();
-}
-
 TNode<BoolT> RegExpBuiltinsAssembler::IsFastRegExpNoPrototype(
     TNode<Context> context, TNode<Object> object) {
   CSA_ASSERT(this, TaggedIsNotSmi(object));
@@ -1052,14 +788,15 @@ void RegExpBuiltinsAssembler::BranchIfFastRegExp_Permissive(
                      if_isunmodified, if_ismodified);
 }
 
-void RegExpBuiltinsAssembler::BranchIfFastRegExpResult(
-    const TNode<Context> context, const TNode<Object> object,
-    Label* if_isunmodified, Label* if_ismodified) {
+void RegExpBuiltinsAssembler::BranchIfRegExpResult(const TNode<Context> context,
+                                                   const TNode<Object> object,
+                                                   Label* if_isunmodified,
+                                                   Label* if_ismodified) {
   // Could be a Smi.
-  TNode<Map> const map = LoadReceiverMap(object);
+  const TNode<Map> map = LoadReceiverMap(object);
 
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Object> const initial_regexp_result_map =
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Object> initial_regexp_result_map =
       LoadContextElement(native_context, Context::REGEXP_RESULT_MAP_INDEX);
 
   Branch(TaggedEqual(map, initial_regexp_result_map), if_isunmodified,
@@ -1089,10 +826,10 @@ TF_BUILTIN(RegExpExecAtom, RegExpBuiltinsAssembler) {
              UintPtrLessThanOrEqual(SmiUntag(last_index),
                                     LoadStringLengthAsWord(subject_string)));
 
-  TNode<String> const needle_string =
+  const TNode<String> needle_string =
       CAST(UnsafeLoadFixedArrayElement(data, JSRegExp::kAtomPatternIndex));
 
-  TNode<Smi> const match_from =
+  const TNode<Smi> match_from =
       CAST(CallBuiltin(Builtins::kStringIndexOf, context, subject_string,
                        needle_string, last_index));
 
@@ -1108,7 +845,7 @@ TF_BUILTIN(RegExpExecAtom, RegExpBuiltinsAssembler) {
     const int kNumRegisters = 2;
     STATIC_ASSERT(RegExpMatchInfo::kInitialCaptureIndices >= kNumRegisters);
 
-    TNode<Smi> const match_to =
+    const TNode<Smi> match_to =
         SmiAdd(match_from, LoadStringLengthAsSmi(needle_string));
 
     UnsafeStoreFixedArrayElement(
@@ -1150,7 +887,7 @@ TNode<String> RegExpBuiltinsAssembler::FlagsGetter(TNode<Context> context,
                                                    bool is_fastpath) {
   Isolate* isolate = this->isolate();
 
-  TNode<IntPtrT> const int_one = IntPtrConstant(1);
+  const TNode<IntPtrT> int_one = IntPtrConstant(1);
   TVARIABLE(Uint32T, var_length, Uint32Constant(0));
   TVARIABLE(IntPtrT, var_flags);
 
@@ -1160,7 +897,7 @@ TNode<String> RegExpBuiltinsAssembler::FlagsGetter(TNode<Context> context,
   if (is_fastpath) {
     // Refer to JSRegExp's flag property on the fast-path.
     CSA_ASSERT(this, IsJSRegExp(CAST(regexp)));
-    TNode<Smi> const flags_smi =
+    const TNode<Smi> flags_smi =
         CAST(LoadObjectField(CAST(regexp), JSRegExp::kFlagsOffset));
     var_flags = SmiUntag(flags_smi);
 
@@ -1189,7 +926,7 @@ TNode<String> RegExpBuiltinsAssembler::FlagsGetter(TNode<Context> context,
 #define CASE_FOR_FLAG(NAME, FLAG)                                          \
   do {                                                                     \
     Label next(this);                                                      \
-    TNode<Object> const flag = GetProperty(                                \
+    const TNode<Object> flag = GetProperty(                                \
         context, regexp, isolate->factory()->InternalizeUtf8String(NAME)); \
     Label if_isflagset(this);                                              \
     BranchIfToBooleanIsTrue(flag, &if_isflagset, &next);                   \
@@ -1213,7 +950,7 @@ TNode<String> RegExpBuiltinsAssembler::FlagsGetter(TNode<Context> context,
   // char for each set flag.
 
   {
-    TNode<String> const result = AllocateSeqOneByteString(var_length.value());
+    const TNode<String> result = AllocateSeqOneByteString(var_length.value());
 
     TVARIABLE(IntPtrT, var_offset,
               IntPtrConstant(SeqOneByteString::kHeaderSize - kHeapObjectTag));
@@ -1222,7 +959,7 @@ TNode<String> RegExpBuiltinsAssembler::FlagsGetter(TNode<Context> context,
   do {                                                         \
     Label next(this);                                          \
     GotoIfNot(IsSetWord(var_flags.value(), FLAG), &next);      \
-    TNode<Int32T> const value = Int32Constant(CHAR);           \
+    const TNode<Int32T> value = Int32Constant(CHAR);           \
     StoreNoWriteBarrier(MachineRepresentation::kWord8, result, \
                         var_offset.value(), value);            \
     var_offset = IntPtrAdd(var_offset.value(), int_one);       \
@@ -1248,12 +985,12 @@ TNode<Object> RegExpBuiltinsAssembler::RegExpInitialize(
     const TNode<Context> context, const TNode<JSRegExp> regexp,
     const TNode<Object> maybe_pattern, const TNode<Object> maybe_flags) {
   // Normalize pattern.
-  TNode<Object> const pattern = Select<Object>(
+  const TNode<Object> pattern = Select<Object>(
       IsUndefined(maybe_pattern), [=] { return EmptyStringConstant(); },
       [=] { return ToString_Inline(context, maybe_pattern); });
 
   // Normalize flags.
-  TNode<Object> const flags = Select<Object>(
+  const TNode<Object> flags = Select<Object>(
       IsUndefined(maybe_flags), [=] { return EmptyStringConstant(); },
       [=] { return ToString_Inline(context, maybe_flags); });
 
@@ -1362,7 +1099,7 @@ TF_BUILTIN(RegExpConstructor, RegExpBuiltinsAssembler) {
 
     BIND(&allocate_jsregexp);
     {
-      TNode<Map> const initial_map = CAST(LoadObjectField(
+      const TNode<Map> initial_map = CAST(LoadObjectField(
           regexp_function, JSFunction::kPrototypeOrInitialMapOffset));
       var_regexp = CAST(AllocateJSObjectFromMap(initial_map));
       Goto(&next);
@@ -1417,8 +1154,8 @@ TF_BUILTIN(RegExpPrototypeCompile, RegExpBuiltinsAssembler) {
     }
 
     const TNode<JSRegExp> pattern = CAST(maybe_pattern);
-    TNode<String> const new_flags = FlagsGetter(context, pattern, true);
-    TNode<Object> const new_pattern =
+    const TNode<String> new_flags = FlagsGetter(context, pattern, true);
+    const TNode<Object> new_pattern =
         LoadObjectField(pattern, JSRegExp::kSourceOffset);
 
     var_flags = new_flags;
@@ -1512,6 +1249,9 @@ TNode<Number> RegExpBuiltinsAssembler::AdvanceStringIndex(
   TNode<Number> index_plus_one = NumberInc(index);
   TVARIABLE(Number, var_result, index_plus_one);
 
+  // TODO(v8:9880): Given that we have to convert index from Number to UintPtrT
+  // anyway, consider using UintPtrT index to simplify the code below.
+
   // Advancing the index has some subtle issues involving the distinction
   // between Smis and HeapNumbers. There's three cases:
   // * {index} is a Smi, {index_plus_one} is a Smi. The standard case.
@@ -1536,16 +1276,18 @@ TNode<Number> RegExpBuiltinsAssembler::AdvanceStringIndex(
 
   BIND(&if_isunicode);
   {
-    TNode<IntPtrT> const string_length = LoadStringLengthAsWord(string);
-    TNode<IntPtrT> untagged_plus_one = SmiUntag(CAST(index_plus_one));
-    GotoIfNot(IntPtrLessThan(untagged_plus_one, string_length), &out);
+    TNode<UintPtrT> string_length = Unsigned(LoadStringLengthAsWord(string));
+    TNode<UintPtrT> untagged_plus_one =
+        Unsigned(SmiUntag(CAST(index_plus_one)));
+    GotoIfNot(UintPtrLessThan(untagged_plus_one, string_length), &out);
 
-    TNode<Int32T> const lead = StringCharCodeAt(string, SmiUntag(CAST(index)));
+    TNode<Int32T> lead =
+        StringCharCodeAt(string, Unsigned(SmiUntag(CAST(index))));
     GotoIfNot(Word32Equal(Word32And(lead, Int32Constant(0xFC00)),
                           Int32Constant(0xD800)),
               &out);
 
-    TNode<Int32T> const trail = StringCharCodeAt(string, untagged_plus_one);
+    TNode<Int32T> trail = StringCharCodeAt(string, untagged_plus_one);
     GotoIfNot(Word32Equal(Word32And(trail, Int32Constant(0xFC00)),
                           Int32Constant(0xDC00)),
               &out);
@@ -1561,165 +1303,6 @@ TNode<Number> RegExpBuiltinsAssembler::AdvanceStringIndex(
   return var_result.value();
 }
 
-TNode<Object> RegExpBuiltinsAssembler::RegExpPrototypeMatchBody(
-    TNode<Context> context, TNode<Object> regexp, TNode<String> string,
-    const bool is_fastpath) {
-  if (is_fastpath) {
-    CSA_ASSERT_BRANCH(this, [&](Label* ok, Label* not_ok) {
-      BranchIfFastRegExp_Strict(context, CAST(regexp), ok, not_ok);
-    });
-  }
-
-  TVARIABLE(Object, var_result);
-
-  TNode<BoolT> const is_global =
-      FlagGetter(context, regexp, JSRegExp::kGlobal, is_fastpath);
-
-  Label if_isglobal(this), if_isnotglobal(this), done(this);
-  Branch(is_global, &if_isglobal, &if_isnotglobal);
-
-  BIND(&if_isnotglobal);
-  {
-    var_result = is_fastpath ? RegExpPrototypeExecBody(context, CAST(regexp),
-                                                       string, true)
-                             : RegExpExec(context, CAST(regexp), string);
-    Goto(&done);
-  }
-
-  BIND(&if_isglobal);
-  {
-    TNode<BoolT> const is_unicode =
-        FlagGetter(context, regexp, JSRegExp::kUnicode, is_fastpath);
-
-    StoreLastIndex(context, regexp, SmiZero(), is_fastpath);
-
-    // Allocate an array to store the resulting match strings.
-
-    GrowableFixedArray array(state());
-
-    // Loop preparations. Within the loop, collect results from RegExpExec
-    // and store match strings in the array.
-
-    Label loop(this,
-               {array.var_array(), array.var_length(), array.var_capacity()}),
-        out(this);
-
-    // Check if the regexp is an ATOM type. If then, keep the literal string to
-    // search for so that we can avoid calling substring in the loop below.
-    TVARIABLE(BoolT, var_atom, Int32FalseConstant());
-    TVARIABLE(String, var_search_string, EmptyStringConstant());
-    if (is_fastpath) {
-      TNode<JSRegExp> maybe_atom_regexp = CAST(regexp);
-      TNode<FixedArray> data =
-          CAST(LoadObjectField(maybe_atom_regexp, JSRegExp::kDataOffset));
-      GotoIfNot(SmiEqual(CAST(LoadFixedArrayElement(data, JSRegExp::kTagIndex)),
-                         SmiConstant(JSRegExp::ATOM)),
-                &loop);
-      var_search_string =
-          CAST(LoadFixedArrayElement(data, JSRegExp::kAtomPatternIndex));
-      var_atom = Int32TrueConstant();
-    }
-    Goto(&loop);
-
-    BIND(&loop);
-    {
-      TVARIABLE(String, var_match);
-
-      Label if_didmatch(this), if_didnotmatch(this);
-      if (is_fastpath) {
-        // On the fast path, grab the matching string from the raw match index
-        // array.
-        TNode<RegExpMatchInfo> match_indices =
-            RegExpPrototypeExecBodyWithoutResult(context, CAST(regexp), string,
-                                                 &if_didnotmatch, true);
-        Label dosubstring(this), donotsubstring(this);
-        Branch(var_atom.value(), &donotsubstring, &dosubstring);
-
-        BIND(&dosubstring);
-        {
-          TNode<Object> const match_from = UnsafeLoadFixedArrayElement(
-              match_indices, RegExpMatchInfo::kFirstCaptureIndex);
-          TNode<Object> const match_to = UnsafeLoadFixedArrayElement(
-              match_indices, RegExpMatchInfo::kFirstCaptureIndex + 1);
-          var_match = CAST(CallBuiltin(Builtins::kSubString, context, string,
-                                       match_from, match_to));
-          Goto(&if_didmatch);
-        }
-
-        BIND(&donotsubstring);
-        var_match = var_search_string.value();
-        Goto(&if_didmatch);
-      } else {
-        DCHECK(!is_fastpath);
-        TNode<Object> const result = RegExpExec(context, CAST(regexp), string);
-
-        Label load_match(this);
-        Branch(IsNull(result), &if_didnotmatch, &load_match);
-
-        BIND(&load_match);
-        var_match =
-            ToString_Inline(context, GetProperty(context, result, SmiZero()));
-        Goto(&if_didmatch);
-      }
-
-      BIND(&if_didnotmatch);
-      {
-        // Return null if there were no matches, otherwise just exit the loop.
-        GotoIfNot(IntPtrEqual(array.length(), IntPtrZero()), &out);
-        var_result = NullConstant();
-        Goto(&done);
-      }
-
-      BIND(&if_didmatch);
-      {
-        TNode<String> match = var_match.value();
-
-        // Store the match, growing the fixed array if needed.
-
-        array.Push(match);
-
-        // Advance last index if the match is the empty string.
-
-        TNode<Smi> const match_length = LoadStringLengthAsSmi(match);
-        GotoIfNot(SmiEqual(match_length, SmiZero()), &loop);
-
-        TNode<Object> last_index = LoadLastIndex(context, regexp, is_fastpath);
-        if (is_fastpath) {
-          CSA_ASSERT(this, TaggedIsPositiveSmi(last_index));
-        } else {
-          last_index = ToLength_Inline(context, last_index);
-        }
-
-        TNode<Number> new_last_index = AdvanceStringIndex(
-            string, CAST(last_index), is_unicode, is_fastpath);
-
-        if (is_fastpath) {
-          // On the fast path, we can be certain that lastIndex can never be
-          // incremented to overflow the Smi range since the maximal string
-          // length is less than the maximal Smi value.
-          STATIC_ASSERT(String::kMaxLength < Smi::kMaxValue);
-          CSA_ASSERT(this, TaggedIsPositiveSmi(new_last_index));
-        }
-
-        StoreLastIndex(context, regexp, new_last_index, is_fastpath);
-
-        Goto(&loop);
-      }
-    }
-
-    BIND(&out);
-    {
-      // Wrap the match in a JSArray.
-
-      var_result = array.ToJSArray(context);
-      Goto(&done);
-    }
-  }
-
-  BIND(&done);
-  return var_result.value();
-}
-
 // ES#sec-createregexpstringiterator
 // CreateRegExpStringIterator ( R, S, global, fullUnicode )
 TNode<Object> RegExpMatchAllAssembler::CreateRegExpStringIterator(
@@ -1732,7 +1315,7 @@ TNode<Object> RegExpMatchAllAssembler::CreateRegExpStringIterator(
   // 4. Let iterator be ObjectCreate(%RegExpStringIteratorPrototype%, «
   // [[IteratingRegExp]], [[IteratedString]], [[Global]], [[Unicode]],
   // [[Done]] »).
-  TNode<HeapObject> iterator = Allocate(JSRegExpStringIterator::kSize);
+  TNode<HeapObject> iterator = Allocate(JSRegExpStringIterator::kHeaderSize);
   StoreMapNoWriteBarrier(iterator, map);
   StoreObjectFieldRoot(iterator,
                        JSRegExpStringIterator::kPropertiesOrHashOffset,
@@ -1768,17 +1351,17 @@ TNode<Object> RegExpMatchAllAssembler::CreateRegExpStringIterator(
 // JSRegExp, {string} is a String, and {limit} is a Smi.
 TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
     TNode<Context> context, TNode<JSRegExp> regexp, TNode<String> string,
-    TNode<Smi> const limit) {
+    const TNode<Smi> limit) {
   CSA_ASSERT(this, IsFastRegExpPermissive(context, regexp));
   CSA_ASSERT(this, Word32BinaryNot(FastFlagGetter(regexp, JSRegExp::kSticky)));
 
-  TNode<IntPtrT> const int_limit = SmiUntag(limit);
+  const TNode<IntPtrT> int_limit = SmiUntag(limit);
 
   const ElementsKind kind = PACKED_ELEMENTS;
   const ParameterMode mode = CodeStubAssembler::INTPTR_PARAMETERS;
 
   TNode<AllocationSite> allocation_site = {};
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
   TNode<Map> array_map = LoadJSArrayElementsMap(kind, native_context);
 
   Label return_empty_array(this, Label::kDeferred);
@@ -1792,7 +1375,7 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
     BIND(&next);
   }
 
-  TNode<Smi> const string_length = LoadStringLengthAsSmi(string);
+  const TNode<Smi> string_length = LoadStringLengthAsSmi(string);
 
   // If passed the empty {string}, return either an empty array or a singleton
   // array depending on whether the {regexp} matches.
@@ -1802,10 +1385,10 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
 
     BIND(&if_stringisempty);
     {
-      TNode<Object> const last_match_info = LoadContextElement(
+      const TNode<Object> last_match_info = LoadContextElement(
           native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX);
 
-      TNode<Object> const match_indices =
+      const TNode<Object> match_indices =
           CallBuiltin(Builtins::kRegExpExecInternal, context, regexp, string,
                       SmiZero(), last_match_info);
 
@@ -1817,8 +1400,8 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
       {
         TNode<Smi> length = SmiConstant(1);
         TNode<IntPtrT> capacity = IntPtrConstant(1);
-        var_result = AllocateJSArray(kind, array_map, capacity, length,
-                                     allocation_site, mode);
+        var_result =
+            AllocateJSArray(kind, array_map, capacity, length, allocation_site);
 
         TNode<FixedArray> fixed_array = CAST(LoadElements(var_result.value()));
         UnsafeStoreFixedArrayElement(fixed_array, 0, string);
@@ -1844,8 +1427,8 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
 
   BIND(&loop);
   {
-    TNode<Smi> const next_search_from = var_next_search_from.value();
-    TNode<Smi> const last_matched_until = var_last_matched_until.value();
+    const TNode<Smi> next_search_from = var_next_search_from.value();
+    const TNode<Smi> last_matched_until = var_last_matched_until.value();
 
     // We're done if we've reached the end of the string.
     {
@@ -1857,10 +1440,10 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
 
     // Search for the given {regexp}.
 
-    TNode<Object> const last_match_info = LoadContextElement(
+    const TNode<Object> last_match_info = LoadContextElement(
         native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX);
 
-    TNode<HeapObject> const match_indices_ho =
+    const TNode<HeapObject> match_indices_ho =
         CAST(CallBuiltin(Builtins::kRegExpExecInternal, context, regexp, string,
                          next_search_from, last_match_info));
 
@@ -1872,7 +1455,7 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
     }
 
     TNode<FixedArray> match_indices = CAST(match_indices_ho);
-    TNode<Smi> const match_from = CAST(UnsafeLoadFixedArrayElement(
+    const TNode<Smi> match_from = CAST(UnsafeLoadFixedArrayElement(
         match_indices, RegExpMatchInfo::kFirstCaptureIndex));
 
     // We're done if the match starts beyond the string.
@@ -1882,7 +1465,7 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
       BIND(&next);
     }
 
-    TNode<Smi> const match_to = CAST(UnsafeLoadFixedArrayElement(
+    const TNode<Smi> match_to = CAST(UnsafeLoadFixedArrayElement(
         match_indices, RegExpMatchInfo::kFirstCaptureIndex + 1));
 
     // Advance index and continue if the match is empty.
@@ -1892,9 +1475,9 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
       GotoIfNot(SmiEqual(match_to, next_search_from), &next);
       GotoIfNot(SmiEqual(match_to, last_matched_until), &next);
 
-      TNode<BoolT> const is_unicode =
+      const TNode<BoolT> is_unicode =
           FastFlagGetter(regexp, JSRegExp::kUnicode);
-      TNode<Number> const new_next_search_from =
+      const TNode<Number> new_next_search_from =
           AdvanceStringIndex(string, next_search_from, is_unicode, true);
       var_next_search_from = CAST(new_next_search_from);
       Goto(&loop);
@@ -1904,17 +1487,17 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
 
     // A valid match was found, add the new substring to the array.
     {
-      TNode<Smi> const from = last_matched_until;
-      TNode<Smi> const to = match_from;
+      const TNode<Smi> from = last_matched_until;
+      const TNode<Smi> to = match_from;
       array.Push(CallBuiltin(Builtins::kSubString, context, string, from, to));
       GotoIf(WordEqual(array.length(), int_limit), &out);
     }
 
     // Add all captures to the array.
     {
-      TNode<Smi> const num_registers = CAST(LoadFixedArrayElement(
+      const TNode<Smi> num_registers = CAST(LoadFixedArrayElement(
           match_indices, RegExpMatchInfo::kNumberOfCapturesIndex));
-      TNode<IntPtrT> const int_num_registers = SmiUntag(num_registers);
+      const TNode<IntPtrT> int_num_registers = SmiUntag(num_registers);
 
       TVARIABLE(IntPtrT, var_reg, IntPtrConstant(2));
 
@@ -1927,10 +1510,10 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
       BIND(&nested_loop);
       {
         const TNode<IntPtrT> reg = var_reg.value();
-        TNode<Object> const from = LoadFixedArrayElement(
+        const TNode<Object> from = LoadFixedArrayElement(
             match_indices, reg,
             RegExpMatchInfo::kFirstCaptureIndex * kTaggedSize, mode);
-        TNode<Smi> const to = CAST(LoadFixedArrayElement(
+        const TNode<Smi> to = CAST(LoadFixedArrayElement(
             match_indices, reg,
             (RegExpMatchInfo::kFirstCaptureIndex + 1) * kTaggedSize, mode));
 
@@ -1991,8 +1574,8 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
   {
     TNode<Smi> length = SmiZero();
     TNode<IntPtrT> capacity = IntPtrZero();
-    var_result = AllocateJSArray(kind, array_map, capacity, length,
-                                 allocation_site, mode);
+    var_result =
+        AllocateJSArray(kind, array_map, capacity, length, allocation_site);
     Goto(&done);
   }
 
diff --git a/deps/v8/src/builtins/builtins-regexp-gen.h b/deps/v8/src/builtins/builtins-regexp-gen.h
index c6de458ef2a2d9..c12ed63722ef28 100644
--- a/deps/v8/src/builtins/builtins-regexp-gen.h
+++ b/deps/v8/src/builtins/builtins-regexp-gen.h
@@ -17,14 +17,6 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
   explicit RegExpBuiltinsAssembler(compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state) {}
 
-  // Create and initialize a RegExp object.
-  TNode<Object> RegExpCreate(TNode<Context> context,
-                             TNode<Context> native_context,
-                             TNode<Object> regexp_string, TNode<String> flags);
-
-  TNode<Object> RegExpCreate(TNode<Context> context, TNode<Map> initial_map,
-                             TNode<Object> regexp_string, TNode<String> flags);
-
   TNode<Smi> SmiZero();
   TNode<IntPtrT> IntPtrZero();
 
@@ -35,7 +27,7 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
   // and input string.
   TNode<JSRegExpResult> AllocateRegExpResult(
       TNode<Context> context, TNode<Smi> length, TNode<Smi> index,
-      TNode<String> input, TNode<RegExpMatchInfo> match_info,
+      TNode<String> input, TNode<JSRegExp> regexp, TNode<Number> last_index,
       TNode<FixedArray>* elements_out = nullptr);
 
   TNode<Object> FastLoadLastIndexBeforeSmiCheck(TNode<JSRegExp> regexp);
@@ -43,15 +35,11 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
     return CAST(FastLoadLastIndexBeforeSmiCheck(regexp));
   }
   TNode<Object> SlowLoadLastIndex(TNode<Context> context, TNode<Object> regexp);
-  TNode<Object> LoadLastIndex(TNode<Context> context, TNode<Object> regexp,
-                              bool is_fastpath);
 
   void FastStoreLastIndex(TNode<JSRegExp> regexp, TNode<Smi> value);
   void SlowStoreLastIndex(SloppyTNode<Context> context,
                           SloppyTNode<Object> regexp,
                           SloppyTNode<Object> value);
-  void StoreLastIndex(TNode<Context> context, TNode<Object> regexp,
-                      TNode<Number> value, bool is_fastpath);
 
   // Loads {var_string_start} and {var_string_end} with the corresponding
   // offsets into the given {string_data}.
@@ -70,23 +58,9 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
                                        TNode<RegExpMatchInfo> match_info);
 
   TNode<JSRegExpResult> ConstructNewResultFromMatchInfo(
-      TNode<Context> context, TNode<JSReceiver> maybe_regexp,
-      TNode<RegExpMatchInfo> match_info, TNode<String> string);
-
-  TNode<RegExpMatchInfo> RegExpPrototypeExecBodyWithoutResult(
-      TNode<Context> context, TNode<JSReceiver> maybe_regexp,
-      TNode<String> string, Label* if_didnotmatch, const bool is_fastpath);
-  TNode<RegExpMatchInfo> RegExpPrototypeExecBodyWithoutResultFast(
-      TNode<Context> context, TNode<JSRegExp> maybe_regexp,
-      TNode<String> string, Label* if_didnotmatch);
-
-  TNode<HeapObject> RegExpPrototypeExecBody(TNode<Context> context,
-                                            TNode<JSReceiver> maybe_regexp,
-                                            TNode<String> string,
-                                            const bool is_fastpath);
-
-  TNode<BoolT> IsReceiverInitialRegExpPrototype(SloppyTNode<Context> context,
-                                                SloppyTNode<Object> receiver);
+      TNode<Context> context, TNode<JSRegExp> regexp,
+      TNode<RegExpMatchInfo> match_info, TNode<String> string,
+      TNode<Number> last_index);
 
   // Fast path check logic.
   //
@@ -142,13 +116,9 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
   TNode<BoolT> IsFastRegExpNoPrototype(TNode<Context> context,
                                        TNode<Object> object, TNode<Map> map);
 
-  // For debugging only. Uses a slow GetProperty call to fetch object.exec.
-  TNode<BoolT> IsFastRegExpWithOriginalExec(TNode<Context> context,
-                                            TNode<JSRegExp> object);
-
-  void BranchIfFastRegExpResult(const TNode<Context> context,
-                                const TNode<Object> object,
-                                Label* if_isunmodified, Label* if_ismodified);
+  void BranchIfRegExpResult(const TNode<Context> context,
+                            const TNode<Object> object, Label* if_isunmodified,
+                            Label* if_ismodified);
 
   TNode<String> FlagsGetter(TNode<Context> context, TNode<Object> regexp,
                             const bool is_fastpath);
@@ -185,15 +155,10 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
     return CAST(AdvanceStringIndex(string, index, is_unicode, false));
   }
 
-  TNode<Object> RegExpPrototypeMatchBody(TNode<Context> context,
-                                         TNode<Object> regexp,
-                                         TNode<String> const string,
-                                         const bool is_fastpath);
-
   TNode<JSArray> RegExpPrototypeSplitBody(TNode<Context> context,
                                           TNode<JSRegExp> regexp,
-                                          TNode<String> const string,
-                                          TNode<Smi> const limit);
+                                          const TNode<String> string,
+                                          const TNode<Smi> limit);
 };
 
 class RegExpMatchAllAssembler : public RegExpBuiltinsAssembler {
diff --git a/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc b/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc
index 85cb4f10f77ce3..3049b01d2f5b4c 100644
--- a/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc
+++ b/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc
@@ -23,18 +23,21 @@ class SharedArrayBufferBuiltinsAssembler : public CodeStubAssembler {
                                                      Node* base, Node* offset,
                                                      Node* value,
                                                      Node* value_high);
-  void ValidateSharedTypedArray(Node* tagged, Node* context,
+  void ValidateSharedTypedArray(TNode<Object> maybe_array,
+                                TNode<Context> context,
                                 TNode<Int32T>* out_elements_kind,
-                                Node** out_backing_store);
-  Node* ConvertTaggedAtomicIndexToWord32(Node* tagged, Node* context,
-                                         Node** number_index);
-  void ValidateAtomicIndex(Node* array, Node* index_word, Node* context);
-#if DEBUG
-  void DebugSanityCheckAtomicIndex(Node* array, Node* index_word,
-                                   Node* context);
-#endif
-  void AtomicBinopBuiltinCommon(Node* array, Node* index, Node* value,
-                                Node* context, AssemblerFunction function,
+                                TNode<RawPtrT>* out_backing_store);
+
+  TNode<UintPtrT> ValidateAtomicAccess(TNode<JSTypedArray> array,
+                                       TNode<Object> index,
+                                       TNode<Context> context);
+
+  inline void DebugSanityCheckAtomicIndex(TNode<JSTypedArray> array,
+                                          TNode<UintPtrT> index);
+
+  void AtomicBinopBuiltinCommon(TNode<Object> maybe_array, TNode<Object> index,
+                                TNode<Object> value, TNode<Context> context,
+                                AssemblerFunction function,
                                 Runtime::FunctionId runtime_function);
 
   // Create a BigInt from the result of a 64-bit atomic operation, using
@@ -43,20 +46,22 @@ class SharedArrayBufferBuiltinsAssembler : public CodeStubAssembler {
   TNode<BigInt> BigIntFromUnsigned64(Node* unsigned64);
 };
 
+// https://tc39.es/ecma262/#sec-validatesharedintegertypedarray
 void SharedArrayBufferBuiltinsAssembler::ValidateSharedTypedArray(
-    Node* tagged, Node* context, TNode<Int32T>* out_elements_kind,
-    Node** out_backing_store) {
+    TNode<Object> maybe_array, TNode<Context> context,
+    TNode<Int32T>* out_elements_kind, TNode<RawPtrT>* out_backing_store) {
   Label not_float_or_clamped(this), invalid(this);
 
   // Fail if it is not a heap object.
-  GotoIf(TaggedIsSmi(tagged), &invalid);
+  GotoIf(TaggedIsSmi(maybe_array), &invalid);
 
   // Fail if the array's instance type is not JSTypedArray.
-  TNode<Map> tagged_map = LoadMap(tagged);
-  GotoIfNot(IsJSTypedArrayMap(tagged_map), &invalid);
+  TNode<Map> map = LoadMap(CAST(maybe_array));
+  GotoIfNot(IsJSTypedArrayMap(map), &invalid);
+  TNode<JSTypedArray> array = CAST(maybe_array);
 
   // Fail if the array's JSArrayBuffer is not shared.
-  TNode<JSArrayBuffer> array_buffer = LoadJSArrayBufferViewBuffer(CAST(tagged));
+  TNode<JSArrayBuffer> array_buffer = LoadJSArrayBufferViewBuffer(array);
   TNode<Uint32T> bitfield = LoadJSArrayBufferBitField(array_buffer);
   GotoIfNot(IsSetWord32<JSArrayBuffer::IsSharedBit>(bitfield), &invalid);
 
@@ -67,7 +72,7 @@ void SharedArrayBufferBuiltinsAssembler::ValidateSharedTypedArray(
   STATIC_ASSERT(UINT8_ELEMENTS < FLOAT32_ELEMENTS);
   STATIC_ASSERT(UINT16_ELEMENTS < FLOAT32_ELEMENTS);
   STATIC_ASSERT(UINT32_ELEMENTS < FLOAT32_ELEMENTS);
-  TNode<Int32T> elements_kind = LoadMapElementsKind(tagged_map);
+  TNode<Int32T> elements_kind = LoadMapElementsKind(map);
   GotoIf(Int32LessThan(elements_kind, Int32Constant(FLOAT32_ELEMENTS)),
          &not_float_or_clamped);
   STATIC_ASSERT(BIGINT64_ELEMENTS > UINT8_CLAMPED_ELEMENTS);
@@ -78,65 +83,45 @@ void SharedArrayBufferBuiltinsAssembler::ValidateSharedTypedArray(
   BIND(&invalid);
   {
     ThrowTypeError(context, MessageTemplate::kNotIntegerSharedTypedArray,
-                   tagged);
+                   maybe_array);
   }
 
   BIND(&not_float_or_clamped);
   *out_elements_kind = elements_kind;
 
   TNode<RawPtrT> backing_store = LoadJSArrayBufferBackingStore(array_buffer);
-  TNode<UintPtrT> byte_offset = LoadJSArrayBufferViewByteOffset(CAST(tagged));
-  *out_backing_store = IntPtrAdd(backing_store, byte_offset);
+  TNode<UintPtrT> byte_offset = LoadJSArrayBufferViewByteOffset(array);
+  *out_backing_store = RawPtrAdd(backing_store, Signed(byte_offset));
 }
 
 // https://tc39.github.io/ecma262/#sec-validateatomicaccess
-Node* SharedArrayBufferBuiltinsAssembler::ConvertTaggedAtomicIndexToWord32(
-    Node* tagged, Node* context, Node** number_index) {
-  VARIABLE(var_result, MachineRepresentation::kWord32);
+// ValidateAtomicAccess( typedArray, requestIndex )
+TNode<UintPtrT> SharedArrayBufferBuiltinsAssembler::ValidateAtomicAccess(
+    TNode<JSTypedArray> array, TNode<Object> index, TNode<Context> context) {
   Label done(this), range_error(this);
 
-  // Returns word32 since index cannot be longer than a TypedArray length,
-  // which has a uint32 maximum.
-  // The |number_index| output parameter is used only for architectures that
-  // don't currently have a TF implementation and forward to runtime functions
-  // instead; they expect the value has already been coerced to an integer.
-  *number_index = ToSmiIndex(CAST(context), CAST(tagged), &range_error);
-  var_result.Bind(SmiToInt32(*number_index));
-  Goto(&done);
-
-  BIND(&range_error);
-  { ThrowRangeError(context, MessageTemplate::kInvalidAtomicAccessIndex); }
+  TNode<UintPtrT> index_uintptr = ToIndex(context, index, &range_error);
 
-  BIND(&done);
-  return var_result.value();
-}
-
-void SharedArrayBufferBuiltinsAssembler::ValidateAtomicIndex(Node* array,
-                                                             Node* index,
-                                                             Node* context) {
-  // Check if the index is in bounds. If not, throw RangeError.
-  Label check_passed(this);
-  TNode<UintPtrT> array_length = LoadJSTypedArrayLength(CAST(array));
-  // TODO(v8:4153): Use UintPtr for the {index} as well.
-  GotoIf(UintPtrLessThan(ChangeUint32ToWord(index), array_length),
-         &check_passed);
+  TNode<UintPtrT> array_length = LoadJSTypedArrayLength(array);
+  Branch(UintPtrLessThan(index_uintptr, array_length), &done, &range_error);
 
+  BIND(&range_error);
   ThrowRangeError(context, MessageTemplate::kInvalidAtomicAccessIndex);
 
-  BIND(&check_passed);
+  BIND(&done);
+  return index_uintptr;
 }
 
-#if DEBUG
 void SharedArrayBufferBuiltinsAssembler::DebugSanityCheckAtomicIndex(
-    Node* array, Node* index_word, Node* context) {
+    TNode<JSTypedArray> array, TNode<UintPtrT> index) {
   // In Debug mode, we re-validate the index as a sanity check because
   // ToInteger above calls out to JavaScript. A SharedArrayBuffer can't be
   // detached and the TypedArray length can't change either, so skipping this
   // check in Release mode is safe.
-  CSA_ASSERT(this, UintPtrLessThan(ChangeUint32ToWord(index_word),
-                                   LoadJSTypedArrayLength(CAST(array))));
+  CSA_ASSERT(this, Word32BinaryNot(
+                       IsDetachedBuffer(LoadJSArrayBufferViewBuffer(array))));
+  CSA_ASSERT(this, UintPtrLessThan(index, LoadJSTypedArrayLength(array)));
 }
-#endif
 
 TNode<BigInt> SharedArrayBufferBuiltinsAssembler::BigIntFromSigned64(
     Node* signed64) {
@@ -160,20 +145,19 @@ TNode<BigInt> SharedArrayBufferBuiltinsAssembler::BigIntFromUnsigned64(
   }
 }
 
+// https://tc39.es/ecma262/#sec-atomicload
 TF_BUILTIN(AtomicsLoad, SharedArrayBufferBuiltinsAssembler) {
-  Node* array = Parameter(Descriptor::kArray);
-  Node* index = Parameter(Descriptor::kIndex);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Object> maybe_array = CAST(Parameter(Descriptor::kArray));
+  TNode<Object> index = CAST(Parameter(Descriptor::kIndex));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   TNode<Int32T> elements_kind;
-  Node* backing_store;
-  ValidateSharedTypedArray(array, context, &elements_kind, &backing_store);
+  TNode<RawPtrT> backing_store;
+  ValidateSharedTypedArray(maybe_array, context, &elements_kind,
+                           &backing_store);
+  TNode<JSTypedArray> array = CAST(maybe_array);
 
-  Node* index_integer;
-  Node* index_word32 =
-      ConvertTaggedAtomicIndexToWord32(index, context, &index_integer);
-  ValidateAtomicIndex(array, index_word32, context);
-  TNode<UintPtrT> index_word = ChangeUint32ToWord(index_word32);
+  TNode<UintPtrT> index_word = ValidateAtomicAccess(array, index, context);
 
   Label i8(this), u8(this), i16(this), u16(this), i32(this), u32(this),
       i64(this), u64(this), other(this);
@@ -210,10 +194,13 @@ TF_BUILTIN(AtomicsLoad, SharedArrayBufferBuiltinsAssembler) {
                                          WordShl(index_word, 2))));
 #if V8_TARGET_ARCH_MIPS && !_MIPS_ARCH_MIPS32R6
   BIND(&i64);
-  Return(CallRuntime(Runtime::kAtomicsLoad64, context, array, index_integer));
+  Goto(&u64);
 
   BIND(&u64);
-  Return(CallRuntime(Runtime::kAtomicsLoad64, context, array, index_integer));
+  {
+    TNode<Number> index_number = ChangeUintPtrToTagged(index_word);
+    Return(CallRuntime(Runtime::kAtomicsLoad64, context, array, index_number));
+  }
 #else
   BIND(&i64);
   // This uses Uint64() intentionally: AtomicLoad is not implemented for
@@ -231,33 +218,30 @@ TF_BUILTIN(AtomicsLoad, SharedArrayBufferBuiltinsAssembler) {
   Unreachable();
 }
 
+// https://tc39.es/ecma262/#sec-atomics.store
 TF_BUILTIN(AtomicsStore, SharedArrayBufferBuiltinsAssembler) {
-  Node* array = Parameter(Descriptor::kArray);
-  Node* index = Parameter(Descriptor::kIndex);
-  Node* value = Parameter(Descriptor::kValue);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Object> maybe_array = CAST(Parameter(Descriptor::kArray));
+  TNode<Object> index = CAST(Parameter(Descriptor::kIndex));
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   TNode<Int32T> elements_kind;
-  Node* backing_store;
-  ValidateSharedTypedArray(array, context, &elements_kind, &backing_store);
+  TNode<RawPtrT> backing_store;
+  ValidateSharedTypedArray(maybe_array, context, &elements_kind,
+                           &backing_store);
+  TNode<JSTypedArray> array = CAST(maybe_array);
 
-  Node* index_integer;
-  Node* index_word32 =
-      ConvertTaggedAtomicIndexToWord32(index, context, &index_integer);
-  ValidateAtomicIndex(array, index_word32, context);
-  TNode<UintPtrT> index_word = ChangeUint32ToWord(index_word32);
+  TNode<UintPtrT> index_word = ValidateAtomicAccess(array, index, context);
 
   Label u8(this), u16(this), u32(this), u64(this), other(this);
   STATIC_ASSERT(BIGINT64_ELEMENTS > INT32_ELEMENTS);
   STATIC_ASSERT(BIGUINT64_ELEMENTS > INT32_ELEMENTS);
   GotoIf(Int32GreaterThan(elements_kind, Int32Constant(INT32_ELEMENTS)), &u64);
 
-  TNode<Number> value_integer = ToInteger_Inline(CAST(context), CAST(value));
+  TNode<Number> value_integer = ToInteger_Inline(context, value);
   TNode<Word32T> value_word32 = TruncateTaggedToWord32(context, value_integer);
 
-#if DEBUG
-  DebugSanityCheckAtomicIndex(array, index_word32, context);
-#endif
+  DebugSanityCheckAtomicIndex(array, index_word);
 
   int32_t case_values[] = {
       INT8_ELEMENTS,   UINT8_ELEMENTS, INT16_ELEMENTS,
@@ -284,17 +268,18 @@ TF_BUILTIN(AtomicsStore, SharedArrayBufferBuiltinsAssembler) {
 
   BIND(&u64);
 #if V8_TARGET_ARCH_MIPS && !_MIPS_ARCH_MIPS32R6
-  Return(CallRuntime(Runtime::kAtomicsStore64, context, array, index_integer,
+  TNode<Number> index_number = ChangeUintPtrToTagged(index_word);
+  Return(CallRuntime(Runtime::kAtomicsStore64, context, array, index_number,
                      value));
 #else
-  TNode<BigInt> value_bigint = ToBigInt(CAST(context), CAST(value));
-#if DEBUG
-  DebugSanityCheckAtomicIndex(array, index_word32, context);
-#endif
+  TNode<BigInt> value_bigint = ToBigInt(context, value);
+
+  DebugSanityCheckAtomicIndex(array, index_word);
+
   TVARIABLE(UintPtrT, var_low);
   TVARIABLE(UintPtrT, var_high);
   BigIntToRawBytes(value_bigint, &var_low, &var_high);
-  Node* high = Is64() ? nullptr : static_cast<Node*>(var_high.value());
+  TNode<UintPtrT> high = Is64() ? TNode<UintPtrT>() : var_high.value();
   AtomicStore(MachineRepresentation::kWord64, backing_store,
               WordShl(index_word, 3), var_low.value(), high);
   Return(value_bigint);
@@ -305,26 +290,26 @@ TF_BUILTIN(AtomicsStore, SharedArrayBufferBuiltinsAssembler) {
   Unreachable();
 }
 
+// https://tc39.es/ecma262/#sec-atomics.exchange
 TF_BUILTIN(AtomicsExchange, SharedArrayBufferBuiltinsAssembler) {
-  Node* array = Parameter(Descriptor::kArray);
-  Node* index = Parameter(Descriptor::kIndex);
-  Node* value = Parameter(Descriptor::kValue);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Object> maybe_array = CAST(Parameter(Descriptor::kArray));
+  TNode<Object> index = CAST(Parameter(Descriptor::kIndex));
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   TNode<Int32T> elements_kind;
-  Node* backing_store;
-  ValidateSharedTypedArray(array, context, &elements_kind, &backing_store);
+  TNode<RawPtrT> backing_store;
+  ValidateSharedTypedArray(maybe_array, context, &elements_kind,
+                           &backing_store);
+  TNode<JSTypedArray> array = CAST(maybe_array);
 
-  Node* index_integer;
-  Node* index_word32 =
-      ConvertTaggedAtomicIndexToWord32(index, context, &index_integer);
-  ValidateAtomicIndex(array, index_word32, context);
+  TNode<UintPtrT> index_word = ValidateAtomicAccess(array, index, context);
 
 #if V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64
-  Return(CallRuntime(Runtime::kAtomicsExchange, context, array, index_integer,
+  TNode<Number> index_number = ChangeUintPtrToTagged(index_word);
+  Return(CallRuntime(Runtime::kAtomicsExchange, context, array, index_number,
                      value));
 #else
-  TNode<UintPtrT> index_word = ChangeUint32ToWord(index_word32);
 
   Label i8(this), u8(this), i16(this), u16(this), i32(this), u32(this),
       i64(this), u64(this), big(this), other(this);
@@ -332,10 +317,10 @@ TF_BUILTIN(AtomicsExchange, SharedArrayBufferBuiltinsAssembler) {
   STATIC_ASSERT(BIGUINT64_ELEMENTS > INT32_ELEMENTS);
   GotoIf(Int32GreaterThan(elements_kind, Int32Constant(INT32_ELEMENTS)), &big);
 
-  TNode<Number> value_integer = ToInteger_Inline(CAST(context), CAST(value));
-#if DEBUG
-  DebugSanityCheckAtomicIndex(array, index_word32, context);
-#endif
+  TNode<Number> value_integer = ToInteger_Inline(context, value);
+
+  DebugSanityCheckAtomicIndex(array, index_word);
+
   TNode<Word32T> value_word32 = TruncateTaggedToWord32(context, value_integer);
 
   int32_t case_values[] = {
@@ -375,14 +360,14 @@ TF_BUILTIN(AtomicsExchange, SharedArrayBufferBuiltinsAssembler) {
                      WordShl(index_word, 2), value_word32)));
 
   BIND(&big);
-  TNode<BigInt> value_bigint = ToBigInt(CAST(context), CAST(value));
-#if DEBUG
-  DebugSanityCheckAtomicIndex(array, index_word32, context);
-#endif
+  TNode<BigInt> value_bigint = ToBigInt(context, value);
+
+  DebugSanityCheckAtomicIndex(array, index_word);
+
   TVARIABLE(UintPtrT, var_low);
   TVARIABLE(UintPtrT, var_high);
   BigIntToRawBytes(value_bigint, &var_low, &var_high);
-  Node* high = Is64() ? nullptr : static_cast<Node*>(var_high.value());
+  TNode<UintPtrT> high = Is64() ? TNode<UintPtrT>() : var_high.value();
   GotoIf(Word32Equal(elements_kind, Int32Constant(BIGINT64_ELEMENTS)), &i64);
   GotoIf(Word32Equal(elements_kind, Int32Constant(BIGUINT64_ELEMENTS)), &u64);
   Unreachable();
@@ -406,42 +391,39 @@ TF_BUILTIN(AtomicsExchange, SharedArrayBufferBuiltinsAssembler) {
 #endif  // V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64
 }
 
+// https://tc39.es/ecma262/#sec-atomics.compareexchange
 TF_BUILTIN(AtomicsCompareExchange, SharedArrayBufferBuiltinsAssembler) {
-  Node* array = Parameter(Descriptor::kArray);
-  Node* index = Parameter(Descriptor::kIndex);
-  Node* old_value = Parameter(Descriptor::kOldValue);
-  Node* new_value = Parameter(Descriptor::kNewValue);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Object> maybe_array = CAST(Parameter(Descriptor::kArray));
+  TNode<Object> index = CAST(Parameter(Descriptor::kIndex));
+  TNode<Object> old_value = CAST(Parameter(Descriptor::kOldValue));
+  TNode<Object> new_value = CAST(Parameter(Descriptor::kNewValue));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   TNode<Int32T> elements_kind;
-  Node* backing_store;
-  ValidateSharedTypedArray(array, context, &elements_kind, &backing_store);
+  TNode<RawPtrT> backing_store;
+  ValidateSharedTypedArray(maybe_array, context, &elements_kind,
+                           &backing_store);
+  TNode<JSTypedArray> array = CAST(maybe_array);
 
-  Node* index_integer;
-  Node* index_word32 =
-      ConvertTaggedAtomicIndexToWord32(index, context, &index_integer);
-  ValidateAtomicIndex(array, index_word32, context);
+  TNode<UintPtrT> index_word = ValidateAtomicAccess(array, index, context);
 
 #if V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_PPC64 || \
     V8_TARGET_ARCH_PPC || V8_TARGET_ARCH_S390 || V8_TARGET_ARCH_S390X
+  TNode<Number> index_number = ChangeUintPtrToTagged(index_word);
   Return(CallRuntime(Runtime::kAtomicsCompareExchange, context, array,
-                     index_integer, old_value, new_value));
+                     index_number, old_value, new_value));
 #else
-  TNode<UintPtrT> index_word = ChangeUint32ToWord(index_word32);
-
   Label i8(this), u8(this), i16(this), u16(this), i32(this), u32(this),
       i64(this), u64(this), big(this), other(this);
   STATIC_ASSERT(BIGINT64_ELEMENTS > INT32_ELEMENTS);
   STATIC_ASSERT(BIGUINT64_ELEMENTS > INT32_ELEMENTS);
   GotoIf(Int32GreaterThan(elements_kind, Int32Constant(INT32_ELEMENTS)), &big);
 
-  TNode<Number> old_value_integer =
-      ToInteger_Inline(CAST(context), CAST(old_value));
-  TNode<Number> new_value_integer =
-      ToInteger_Inline(CAST(context), CAST(new_value));
-#if DEBUG
-  DebugSanityCheckAtomicIndex(array, index_word32, context);
-#endif
+  TNode<Number> old_value_integer = ToInteger_Inline(context, old_value);
+  TNode<Number> new_value_integer = ToInteger_Inline(context, new_value);
+
+  DebugSanityCheckAtomicIndex(array, index_word);
+
   TNode<Word32T> old_value_word32 =
       TruncateTaggedToWord32(context, old_value_integer);
   TNode<Word32T> new_value_word32 =
@@ -488,19 +470,19 @@ TF_BUILTIN(AtomicsCompareExchange, SharedArrayBufferBuiltinsAssembler) {
       old_value_word32, new_value_word32)));
 
   BIND(&big);
-  TNode<BigInt> old_value_bigint = ToBigInt(CAST(context), CAST(old_value));
-  TNode<BigInt> new_value_bigint = ToBigInt(CAST(context), CAST(new_value));
-#if DEBUG
-  DebugSanityCheckAtomicIndex(array, index_word32, context);
-#endif
+  TNode<BigInt> old_value_bigint = ToBigInt(context, old_value);
+  TNode<BigInt> new_value_bigint = ToBigInt(context, new_value);
+
+  DebugSanityCheckAtomicIndex(array, index_word);
+
   TVARIABLE(UintPtrT, var_old_low);
   TVARIABLE(UintPtrT, var_old_high);
   TVARIABLE(UintPtrT, var_new_low);
   TVARIABLE(UintPtrT, var_new_high);
   BigIntToRawBytes(old_value_bigint, &var_old_low, &var_old_high);
   BigIntToRawBytes(new_value_bigint, &var_new_low, &var_new_high);
-  Node* old_high = Is64() ? nullptr : static_cast<Node*>(var_old_high.value());
-  Node* new_high = Is64() ? nullptr : static_cast<Node*>(var_new_high.value());
+  TNode<UintPtrT> old_high = Is64() ? TNode<UintPtrT>() : var_old_high.value();
+  TNode<UintPtrT> new_high = Is64() ? TNode<UintPtrT>() : var_new_high.value();
   GotoIf(Word32Equal(elements_kind, Int32Constant(BIGINT64_ELEMENTS)), &i64);
   GotoIf(Word32Equal(elements_kind, Int32Constant(BIGUINT64_ELEMENTS)), &u64);
   Unreachable();
@@ -525,41 +507,46 @@ TF_BUILTIN(AtomicsCompareExchange, SharedArrayBufferBuiltinsAssembler) {
         // || V8_TARGET_ARCH_PPC || V8_TARGET_ARCH_S390 || V8_TARGET_ARCH_S390X
 }
 
-#define BINOP_BUILTIN(op)                                       \
-  TF_BUILTIN(Atomics##op, SharedArrayBufferBuiltinsAssembler) { \
-    Node* array = Parameter(Descriptor::kArray);                \
-    Node* index = Parameter(Descriptor::kIndex);                \
-    Node* value = Parameter(Descriptor::kValue);                \
-    Node* context = Parameter(Descriptor::kContext);            \
-    AtomicBinopBuiltinCommon(array, index, value, context,      \
-                             &CodeAssembler::Atomic##op,        \
-                             Runtime::kAtomics##op);            \
+#define BINOP_BUILTIN(op)                                           \
+  TF_BUILTIN(Atomics##op, SharedArrayBufferBuiltinsAssembler) {     \
+    TNode<Object> array = CAST(Parameter(Descriptor::kArray));      \
+    TNode<Object> index = CAST(Parameter(Descriptor::kIndex));      \
+    TNode<Object> value = CAST(Parameter(Descriptor::kValue));      \
+    TNode<Context> context = CAST(Parameter(Descriptor::kContext)); \
+    AtomicBinopBuiltinCommon(array, index, value, context,          \
+                             &CodeAssembler::Atomic##op,            \
+                             Runtime::kAtomics##op);                \
   }
+// https://tc39.es/ecma262/#sec-atomics.add
 BINOP_BUILTIN(Add)
+// https://tc39.es/ecma262/#sec-atomics.sub
 BINOP_BUILTIN(Sub)
+// https://tc39.es/ecma262/#sec-atomics.and
 BINOP_BUILTIN(And)
+// https://tc39.es/ecma262/#sec-atomics.or
 BINOP_BUILTIN(Or)
+// https://tc39.es/ecma262/#sec-atomics.xor
 BINOP_BUILTIN(Xor)
 #undef BINOP_BUILTIN
 
+// https://tc39.es/ecma262/#sec-atomicreadmodifywrite
 void SharedArrayBufferBuiltinsAssembler::AtomicBinopBuiltinCommon(
-    Node* array, Node* index, Node* value, Node* context,
-    AssemblerFunction function, Runtime::FunctionId runtime_function) {
+    TNode<Object> maybe_array, TNode<Object> index, TNode<Object> value,
+    TNode<Context> context, AssemblerFunction function,
+    Runtime::FunctionId runtime_function) {
   TNode<Int32T> elements_kind;
-  Node* backing_store;
-  ValidateSharedTypedArray(array, context, &elements_kind, &backing_store);
+  TNode<RawPtrT> backing_store;
+  ValidateSharedTypedArray(maybe_array, context, &elements_kind,
+                           &backing_store);
+  TNode<JSTypedArray> array = CAST(maybe_array);
 
-  Node* index_integer;
-  Node* index_word32 =
-      ConvertTaggedAtomicIndexToWord32(index, context, &index_integer);
-  ValidateAtomicIndex(array, index_word32, context);
+  TNode<UintPtrT> index_word = ValidateAtomicAccess(array, index, context);
 
 #if V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_PPC64 || \
     V8_TARGET_ARCH_PPC || V8_TARGET_ARCH_S390 || V8_TARGET_ARCH_S390X
-  Return(CallRuntime(runtime_function, context, array, index_integer, value));
+  TNode<Number> index_number = ChangeUintPtrToTagged(index_word);
+  Return(CallRuntime(runtime_function, context, array, index_number, value));
 #else
-  TNode<UintPtrT> index_word = ChangeUint32ToWord(index_word32);
-
   Label i8(this), u8(this), i16(this), u16(this), i32(this), u32(this),
       i64(this), u64(this), big(this), other(this);
 
@@ -567,10 +554,10 @@ void SharedArrayBufferBuiltinsAssembler::AtomicBinopBuiltinCommon(
   STATIC_ASSERT(BIGUINT64_ELEMENTS > INT32_ELEMENTS);
   GotoIf(Int32GreaterThan(elements_kind, Int32Constant(INT32_ELEMENTS)), &big);
 
-  TNode<Number> value_integer = ToInteger_Inline(CAST(context), CAST(value));
-#if DEBUG
-  DebugSanityCheckAtomicIndex(array, index_word32, context);
-#endif
+  TNode<Number> value_integer = ToInteger_Inline(context, value);
+
+  DebugSanityCheckAtomicIndex(array, index_word);
+
   TNode<Word32T> value_word32 = TruncateTaggedToWord32(context, value_integer);
 
   int32_t case_values[] = {
@@ -612,14 +599,14 @@ void SharedArrayBufferBuiltinsAssembler::AtomicBinopBuiltinCommon(
                         WordShl(index_word, 2), value_word32, nullptr)));
 
   BIND(&big);
-  TNode<BigInt> value_bigint = ToBigInt(CAST(context), CAST(value));
-#if DEBUG
-  DebugSanityCheckAtomicIndex(array, index_word32, context);
-#endif
+  TNode<BigInt> value_bigint = ToBigInt(context, value);
+
+  DebugSanityCheckAtomicIndex(array, index_word);
+
   TVARIABLE(UintPtrT, var_low);
   TVARIABLE(UintPtrT, var_high);
   BigIntToRawBytes(value_bigint, &var_low, &var_high);
-  Node* high = Is64() ? nullptr : static_cast<Node*>(var_high.value());
+  TNode<UintPtrT> high = Is64() ? TNode<UintPtrT>() : var_high.value();
   GotoIf(Word32Equal(elements_kind, Int32Constant(BIGINT64_ELEMENTS)), &i64);
   GotoIf(Word32Equal(elements_kind, Int32Constant(BIGUINT64_ELEMENTS)), &u64);
   Unreachable();
diff --git a/deps/v8/src/builtins/builtins-string-gen.cc b/deps/v8/src/builtins/builtins-string-gen.cc
index 425ffc46d29bc9..5fe534879aaa87 100644
--- a/deps/v8/src/builtins/builtins-string-gen.cc
+++ b/deps/v8/src/builtins/builtins-string-gen.cc
@@ -20,10 +20,10 @@ namespace internal {
 
 using Node = compiler::Node;
 
-Node* StringBuiltinsAssembler::DirectStringData(Node* string,
-                                                Node* string_instance_type) {
+TNode<IntPtrT> StringBuiltinsAssembler::DirectStringData(
+    TNode<String> string, TNode<Word32T> string_instance_type) {
   // Compute the effective offset of the first character.
-  VARIABLE(var_data, MachineType::PointerRepresentation());
+  TVARIABLE(IntPtrT, var_data);
   Label if_sequential(this), if_external(this), if_join(this);
   Branch(Word32Equal(Word32And(string_instance_type,
                                Int32Constant(kStringRepresentationMask)),
@@ -32,9 +32,9 @@ Node* StringBuiltinsAssembler::DirectStringData(Node* string,
 
   BIND(&if_sequential);
   {
-    var_data.Bind(IntPtrAdd(
+    var_data = IntPtrAdd(
         IntPtrConstant(SeqOneByteString::kHeaderSize - kHeapObjectTag),
-        BitcastTaggedToWord(string)));
+        BitcastTaggedToWord(string));
     Goto(&if_join);
   }
 
@@ -46,8 +46,8 @@ Node* StringBuiltinsAssembler::DirectStringData(Node* string,
                          Word32And(string_instance_type,
                                    Int32Constant(kUncachedExternalStringMask)),
                          Int32Constant(kUncachedExternalStringTag)));
-    var_data.Bind(LoadObjectField(string, ExternalString::kResourceDataOffset,
-                                  MachineType::Pointer()));
+    var_data =
+        LoadObjectField<IntPtrT>(string, ExternalString::kResourceDataOffset);
     Goto(&if_join);
   }
 
@@ -56,22 +56,22 @@ Node* StringBuiltinsAssembler::DirectStringData(Node* string,
 }
 
 void StringBuiltinsAssembler::DispatchOnStringEncodings(
-    Node* const lhs_instance_type, Node* const rhs_instance_type,
-    Label* if_one_one, Label* if_one_two, Label* if_two_one,
-    Label* if_two_two) {
+    TNode<Word32T> const lhs_instance_type,
+    TNode<Word32T> const rhs_instance_type, Label* if_one_one,
+    Label* if_one_two, Label* if_two_one, Label* if_two_two) {
   STATIC_ASSERT(kStringEncodingMask == 0x8);
   STATIC_ASSERT(kTwoByteStringTag == 0x0);
   STATIC_ASSERT(kOneByteStringTag == 0x8);
 
   // First combine the encodings.
 
-  TNode<Int32T> const encoding_mask = Int32Constant(kStringEncodingMask);
-  TNode<Word32T> const lhs_encoding =
+  const TNode<Int32T> encoding_mask = Int32Constant(kStringEncodingMask);
+  const TNode<Word32T> lhs_encoding =
       Word32And(lhs_instance_type, encoding_mask);
-  TNode<Word32T> const rhs_encoding =
+  const TNode<Word32T> rhs_encoding =
       Word32And(rhs_instance_type, encoding_mask);
 
-  TNode<Word32T> const combined_encodings =
+  const TNode<Word32T> combined_encodings =
       Word32Or(lhs_encoding, Word32Shr(rhs_encoding, 1));
 
   // Then dispatch on the combined encoding.
@@ -96,26 +96,25 @@ void StringBuiltinsAssembler::DispatchOnStringEncodings(
 }
 
 template <typename SubjectChar, typename PatternChar>
-Node* StringBuiltinsAssembler::CallSearchStringRaw(Node* const subject_ptr,
-                                                   Node* const subject_length,
-                                                   Node* const search_ptr,
-                                                   Node* const search_length,
-                                                   Node* const start_position) {
-  TNode<ExternalReference> const function_addr = ExternalConstant(
+TNode<IntPtrT> StringBuiltinsAssembler::CallSearchStringRaw(
+    const TNode<RawPtrT> subject_ptr, const TNode<IntPtrT> subject_length,
+    const TNode<RawPtrT> search_ptr, const TNode<IntPtrT> search_length,
+    const TNode<IntPtrT> start_position) {
+  const TNode<ExternalReference> function_addr = ExternalConstant(
       ExternalReference::search_string_raw<SubjectChar, PatternChar>());
-  TNode<ExternalReference> const isolate_ptr =
+  const TNode<ExternalReference> isolate_ptr =
       ExternalConstant(ExternalReference::isolate_address(isolate()));
 
   MachineType type_ptr = MachineType::Pointer();
   MachineType type_intptr = MachineType::IntPtr();
 
-  Node* const result = CallCFunction(
+  const TNode<IntPtrT> result = UncheckedCast<IntPtrT>(CallCFunction(
       function_addr, type_intptr, std::make_pair(type_ptr, isolate_ptr),
       std::make_pair(type_ptr, subject_ptr),
       std::make_pair(type_intptr, subject_length),
       std::make_pair(type_ptr, search_ptr),
       std::make_pair(type_intptr, search_length),
-      std::make_pair(type_intptr, start_position));
+      std::make_pair(type_intptr, start_position)));
 
   return result;
 }
@@ -171,8 +170,8 @@ void StringBuiltinsAssembler::GenerateStringEqual(TNode<String> left,
 }
 
 void StringBuiltinsAssembler::StringEqual_Core(
-    SloppyTNode<String> lhs, Node* lhs_instance_type, SloppyTNode<String> rhs,
-    Node* rhs_instance_type, TNode<IntPtrT> length, Label* if_equal,
+    TNode<String> lhs, TNode<Word32T> lhs_instance_type, TNode<String> rhs,
+    TNode<Word32T> rhs_instance_type, TNode<IntPtrT> length, Label* if_equal,
     Label* if_not_equal, Label* if_indirect) {
   CSA_ASSERT(this, WordEqual(LoadStringLengthAsWord(lhs), length));
   CSA_ASSERT(this, WordEqual(LoadStringLengthAsWord(rhs), length));
@@ -248,17 +247,15 @@ void StringBuiltinsAssembler::StringEqual_Core(
 }
 
 void StringBuiltinsAssembler::StringEqual_Loop(
-    Node* lhs, Node* lhs_instance_type, MachineType lhs_type, Node* rhs,
-    Node* rhs_instance_type, MachineType rhs_type, TNode<IntPtrT> length,
-    Label* if_equal, Label* if_not_equal) {
-  CSA_ASSERT(this, IsString(lhs));
-  CSA_ASSERT(this, IsString(rhs));
+    TNode<String> lhs, TNode<Word32T> lhs_instance_type, MachineType lhs_type,
+    TNode<String> rhs, TNode<Word32T> rhs_instance_type, MachineType rhs_type,
+    TNode<IntPtrT> length, Label* if_equal, Label* if_not_equal) {
   CSA_ASSERT(this, WordEqual(LoadStringLengthAsWord(lhs), length));
   CSA_ASSERT(this, WordEqual(LoadStringLengthAsWord(rhs), length));
 
   // Compute the effective offset of the first character.
-  Node* lhs_data = DirectStringData(lhs, lhs_instance_type);
-  Node* rhs_data = DirectStringData(rhs, rhs_instance_type);
+  TNode<IntPtrT> lhs_data = DirectStringData(lhs, lhs_instance_type);
+  TNode<IntPtrT> rhs_data = DirectStringData(rhs, rhs_instance_type);
 
   // Loop over the {lhs} and {rhs} strings to see if they are equal.
   TVARIABLE(IntPtrT, var_offset, IntPtrConstant(0));
@@ -291,7 +288,7 @@ void StringBuiltinsAssembler::StringEqual_Loop(
 
 TNode<String> StringBuiltinsAssembler::StringFromSingleUTF16EncodedCodePoint(
     TNode<Int32T> codepoint) {
-  VARIABLE(var_result, MachineRepresentation::kTagged, EmptyStringConstant());
+  TVARIABLE(String, var_result, EmptyStringConstant());
 
   Label if_isword16(this), if_isword32(this), return_result(this);
 
@@ -300,7 +297,7 @@ TNode<String> StringBuiltinsAssembler::StringFromSingleUTF16EncodedCodePoint(
 
   BIND(&if_isword16);
   {
-    var_result.Bind(StringFromSingleCharCode(codepoint));
+    var_result = StringFromSingleCharCode(codepoint);
     Goto(&return_result);
   }
 
@@ -311,12 +308,12 @@ TNode<String> StringBuiltinsAssembler::StringFromSingleUTF16EncodedCodePoint(
         MachineRepresentation::kWord32, value,
         IntPtrConstant(SeqTwoByteString::kHeaderSize - kHeapObjectTag),
         codepoint);
-    var_result.Bind(value);
+    var_result = value;
     Goto(&return_result);
   }
 
   BIND(&return_result);
-  return CAST(var_result.value());
+  return var_result.value();
 }
 
 TNode<String> StringBuiltinsAssembler::AllocateConsString(TNode<Uint32T> length,
@@ -339,17 +336,15 @@ TNode<String> StringBuiltinsAssembler::AllocateConsString(TNode<Uint32T> length,
       [=] { return ConsStringMapConstant(); }));
   TNode<HeapObject> result = AllocateInNewSpace(ConsString::kSize);
   StoreMapNoWriteBarrier(result, result_map);
-  StoreObjectFieldNoWriteBarrier(result, ConsString::kLengthOffset, length,
-                                 MachineRepresentation::kWord32);
+  StoreObjectFieldNoWriteBarrier(result, ConsString::kLengthOffset, length);
   StoreObjectFieldNoWriteBarrier(result, ConsString::kHashFieldOffset,
-                                 Int32Constant(String::kEmptyHashField),
-                                 MachineRepresentation::kWord32);
+                                 Int32Constant(String::kEmptyHashField));
   StoreObjectFieldNoWriteBarrier(result, ConsString::kFirstOffset, left);
   StoreObjectFieldNoWriteBarrier(result, ConsString::kSecondOffset, right);
   return CAST(result);
 }
 
-TNode<String> StringBuiltinsAssembler::StringAdd(Node* context,
+TNode<String> StringBuiltinsAssembler::StringAdd(SloppyTNode<Context> context,
                                                  TNode<String> left,
                                                  TNode<String> right) {
   TVARIABLE(String, result);
@@ -380,8 +375,7 @@ TNode<String> StringBuiltinsAssembler::StringAdd(Node* context,
 
     TVARIABLE(String, var_left, left);
     TVARIABLE(String, var_right, right);
-    Variable* input_vars[2] = {&var_left, &var_right};
-    Label non_cons(this, 2, input_vars);
+    Label non_cons(this, {&var_left, &var_right});
     Label slow(this, Label::kDeferred);
     GotoIf(Uint32LessThan(new_length, Uint32Constant(ConsString::kMinLength)),
            &non_cons);
@@ -564,9 +558,8 @@ void StringBuiltinsAssembler::GenerateStringRelationalComparison(
   TVARIABLE(String, var_left, left);
   TVARIABLE(String, var_right, right);
 
-  Variable* input_vars[2] = {&var_left, &var_right};
   Label if_less(this), if_equal(this), if_greater(this);
-  Label restart(this, 2, input_vars);
+  Label restart(this, {&var_left, &var_right});
   Goto(&restart);
   BIND(&restart);
 
@@ -761,8 +754,9 @@ TF_BUILTIN(StringGreaterThanOrEqual, StringBuiltinsAssembler) {
 }
 
 TF_BUILTIN(StringCodePointAt, StringBuiltinsAssembler) {
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* position = Parameter(Descriptor::kPosition);
+  TNode<String> receiver = CAST(Parameter(Descriptor::kReceiver));
+  TNode<IntPtrT> position =
+      UncheckedCast<IntPtrT>(Parameter(Descriptor::kPosition));
 
   // TODO(sigurds) Figure out if passing length as argument pays off.
   TNode<IntPtrT> length = LoadStringLengthAsWord(receiver);
@@ -799,7 +793,7 @@ TF_BUILTIN(StringFromCharCode, StringBuiltinsAssembler) {
   // arguments are reordered.
   TNode<Int32T> argc =
       UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   CodeStubArguments arguments(this, argc);
   // Check if we have exactly one argument (plus the implicit receiver), i.e.
@@ -821,7 +815,7 @@ TF_BUILTIN(StringFromCharCode, StringBuiltinsAssembler) {
     arguments.PopAndReturn(result);
   }
 
-  Node* code16 = nullptr;
+  TNode<Word32T> code16;
   BIND(&if_notoneargument);
   {
     Label two_byte(this);
@@ -898,13 +892,13 @@ TF_BUILTIN(StringFromCharCode, StringBuiltinsAssembler) {
 }
 
 void StringBuiltinsAssembler::StringIndexOf(
-    TNode<String> const subject_string, TNode<String> const search_string,
-    TNode<Smi> const position,
+    const TNode<String> subject_string, const TNode<String> search_string,
+    const TNode<Smi> position,
     const std::function<void(TNode<Smi>)>& f_return) {
-  TNode<IntPtrT> const int_zero = IntPtrConstant(0);
-  TNode<IntPtrT> const search_length = LoadStringLengthAsWord(search_string);
-  TNode<IntPtrT> const subject_length = LoadStringLengthAsWord(subject_string);
-  TNode<IntPtrT> const start_position = IntPtrMax(SmiUntag(position), int_zero);
+  const TNode<IntPtrT> int_zero = IntPtrConstant(0);
+  const TNode<IntPtrT> search_length = LoadStringLengthAsWord(search_string);
+  const TNode<IntPtrT> subject_length = LoadStringLengthAsWord(subject_string);
+  const TNode<IntPtrT> start_position = IntPtrMax(SmiUntag(position), int_zero);
 
   Label zero_length_needle(this), return_minus_1(this);
   {
@@ -932,13 +926,13 @@ void StringBuiltinsAssembler::StringIndexOf(
   search_to_direct.TryToDirect(&call_runtime_unchecked);
 
   // Load pointers to string data.
-  TNode<RawPtrT> const subject_ptr =
+  const TNode<RawPtrT> subject_ptr =
       subject_to_direct.PointerToData(&call_runtime_unchecked);
-  TNode<RawPtrT> const search_ptr =
+  const TNode<RawPtrT> search_ptr =
       search_to_direct.PointerToData(&call_runtime_unchecked);
 
-  TNode<IntPtrT> const subject_offset = subject_to_direct.offset();
-  TNode<IntPtrT> const search_offset = search_to_direct.offset();
+  const TNode<IntPtrT> subject_offset = subject_to_direct.offset();
+  const TNode<IntPtrT> search_offset = search_to_direct.offset();
 
   // Like String::IndexOf, the actual matching is done by the optimized
   // SearchString method in string-search.h. Dispatch based on string instance
@@ -961,9 +955,9 @@ void StringBuiltinsAssembler::StringIndexOf(
 
   BIND(&one_one);
   {
-    TNode<RawPtrT> const adjusted_subject_ptr = PointerToStringDataAtIndex(
+    const TNode<RawPtrT> adjusted_subject_ptr = PointerToStringDataAtIndex(
         subject_ptr, subject_offset, String::ONE_BYTE_ENCODING);
-    TNode<RawPtrT> const adjusted_search_ptr = PointerToStringDataAtIndex(
+    const TNode<RawPtrT> adjusted_search_ptr = PointerToStringDataAtIndex(
         search_ptr, search_offset, String::ONE_BYTE_ENCODING);
 
     Label direct_memchr_call(this), generic_fast_path(this);
@@ -974,29 +968,29 @@ void StringBuiltinsAssembler::StringIndexOf(
     // search strings.
     BIND(&direct_memchr_call);
     {
-      TNode<RawPtrT> const string_addr =
+      const TNode<RawPtrT> string_addr =
           RawPtrAdd(adjusted_subject_ptr, start_position);
-      TNode<IntPtrT> const search_length =
+      const TNode<IntPtrT> search_length =
           IntPtrSub(subject_length, start_position);
-      TNode<IntPtrT> const search_byte =
+      const TNode<IntPtrT> search_byte =
           ChangeInt32ToIntPtr(Load(MachineType::Uint8(), adjusted_search_ptr));
 
-      TNode<ExternalReference> const memchr =
+      const TNode<ExternalReference> memchr =
           ExternalConstant(ExternalReference::libc_memchr_function());
-      TNode<RawPtrT> const result_address = UncheckedCast<RawPtrT>(
+      const TNode<RawPtrT> result_address = UncheckedCast<RawPtrT>(
           CallCFunction(memchr, MachineType::Pointer(),
                         std::make_pair(MachineType::Pointer(), string_addr),
                         std::make_pair(MachineType::IntPtr(), search_byte),
                         std::make_pair(MachineType::UintPtr(), search_length)));
       GotoIf(WordEqual(result_address, int_zero), &return_minus_1);
-      TNode<IntPtrT> const result_index =
+      const TNode<IntPtrT> result_index =
           IntPtrAdd(RawPtrSub(result_address, string_addr), start_position);
       f_return(SmiTag(result_index));
     }
 
     BIND(&generic_fast_path);
     {
-      Node* const result = CallSearchStringRaw<onebyte_t, onebyte_t>(
+      const TNode<IntPtrT> result = CallSearchStringRaw<onebyte_t, onebyte_t>(
           adjusted_subject_ptr, subject_length, adjusted_search_ptr,
           search_length, start_position);
       f_return(SmiTag(result));
@@ -1005,12 +999,12 @@ void StringBuiltinsAssembler::StringIndexOf(
 
   BIND(&one_two);
   {
-    TNode<RawPtrT> const adjusted_subject_ptr = PointerToStringDataAtIndex(
+    const TNode<RawPtrT> adjusted_subject_ptr = PointerToStringDataAtIndex(
         subject_ptr, subject_offset, String::ONE_BYTE_ENCODING);
-    TNode<RawPtrT> const adjusted_search_ptr = PointerToStringDataAtIndex(
+    const TNode<RawPtrT> adjusted_search_ptr = PointerToStringDataAtIndex(
         search_ptr, search_offset, String::TWO_BYTE_ENCODING);
 
-    Node* const result = CallSearchStringRaw<onebyte_t, twobyte_t>(
+    const TNode<IntPtrT> result = CallSearchStringRaw<onebyte_t, twobyte_t>(
         adjusted_subject_ptr, subject_length, adjusted_search_ptr,
         search_length, start_position);
     f_return(SmiTag(result));
@@ -1018,12 +1012,12 @@ void StringBuiltinsAssembler::StringIndexOf(
 
   BIND(&two_one);
   {
-    TNode<RawPtrT> const adjusted_subject_ptr = PointerToStringDataAtIndex(
+    const TNode<RawPtrT> adjusted_subject_ptr = PointerToStringDataAtIndex(
         subject_ptr, subject_offset, String::TWO_BYTE_ENCODING);
-    TNode<RawPtrT> const adjusted_search_ptr = PointerToStringDataAtIndex(
+    const TNode<RawPtrT> adjusted_search_ptr = PointerToStringDataAtIndex(
         search_ptr, search_offset, String::ONE_BYTE_ENCODING);
 
-    Node* const result = CallSearchStringRaw<twobyte_t, onebyte_t>(
+    const TNode<IntPtrT> result = CallSearchStringRaw<twobyte_t, onebyte_t>(
         adjusted_subject_ptr, subject_length, adjusted_search_ptr,
         search_length, start_position);
     f_return(SmiTag(result));
@@ -1031,12 +1025,12 @@ void StringBuiltinsAssembler::StringIndexOf(
 
   BIND(&two_two);
   {
-    TNode<RawPtrT> const adjusted_subject_ptr = PointerToStringDataAtIndex(
+    const TNode<RawPtrT> adjusted_subject_ptr = PointerToStringDataAtIndex(
         subject_ptr, subject_offset, String::TWO_BYTE_ENCODING);
-    TNode<RawPtrT> const adjusted_search_ptr = PointerToStringDataAtIndex(
+    const TNode<RawPtrT> adjusted_search_ptr = PointerToStringDataAtIndex(
         search_ptr, search_offset, String::TWO_BYTE_ENCODING);
 
-    Node* const result = CallSearchStringRaw<twobyte_t, twobyte_t>(
+    const TNode<IntPtrT> result = CallSearchStringRaw<twobyte_t, twobyte_t>(
         adjusted_subject_ptr, subject_length, adjusted_search_ptr,
         search_length, start_position);
     f_return(SmiTag(result));
@@ -1099,7 +1093,7 @@ void StringIncludesIndexOfAssembler::Generate(SearchVariant variant,
                                               TNode<IntPtrT> argc,
                                               TNode<Context> context) {
   CodeStubArguments arguments(this, argc);
-  TNode<Object> const receiver = arguments.GetReceiver();
+  const TNode<Object> receiver = arguments.GetReceiver();
 
   TVARIABLE(Object, var_search_string);
   TVARIABLE(Object, var_position);
@@ -1134,8 +1128,8 @@ void StringIncludesIndexOfAssembler::Generate(SearchVariant variant,
   BIND(&fast_path);
   {
     Comment("Fast Path");
-    TNode<Object> const search = var_search_string.value();
-    TNode<Smi> const position = CAST(var_position.value());
+    const TNode<Object> search = var_search_string.value();
+    const TNode<Smi> position = CAST(var_position.value());
     GotoIf(TaggedIsSmi(receiver), &call_runtime);
     GotoIf(TaggedIsSmi(search), &call_runtime);
     GotoIfNot(IsString(CAST(receiver)), &call_runtime);
@@ -1157,7 +1151,7 @@ void StringIncludesIndexOfAssembler::Generate(SearchVariant variant,
     Runtime::FunctionId runtime = variant == kIndexOf
                                       ? Runtime::kStringIndexOf
                                       : Runtime::kStringIncludes;
-    TNode<Object> const result =
+    const TNode<Object> result =
         CallRuntime(runtime, context, receiver, var_search_string.value(),
                     var_position.value());
     arguments.PopAndReturn(result);
@@ -1165,14 +1159,15 @@ void StringIncludesIndexOfAssembler::Generate(SearchVariant variant,
 }
 
 void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
-    Node* const context, Node* const object, Node* const maybe_string,
-    Handle<Symbol> symbol,
+    const TNode<Context> context, const TNode<Object> object,
+    const TNode<Object> maybe_string, Handle<Symbol> symbol,
     DescriptorIndexNameValue additional_property_to_check,
     const NodeFunction0& regexp_call, const NodeFunction1& generic_call) {
   Label out(this);
 
   // Smis definitely don't have an attached symbol.
   GotoIf(TaggedIsSmi(object), &out);
+  TNode<HeapObject> heap_object = CAST(object);
 
   // Take the fast path for RegExps.
   // There's two conditions: {object} needs to be a fast regexp, and
@@ -1182,7 +1177,7 @@ void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
     Label stub_call(this), slow_lookup(this);
 
     GotoIf(TaggedIsSmi(maybe_string), &slow_lookup);
-    GotoIfNot(IsString(maybe_string), &slow_lookup);
+    GotoIfNot(IsString(CAST(maybe_string)), &slow_lookup);
 
     // Note we don't run a full (= permissive) check here, because passing the
     // check implies calling the fast variants of target builtins, which assume
@@ -1192,7 +1187,7 @@ void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
     // permissive.
     RegExpBuiltinsAssembler regexp_asm(state());
     regexp_asm.BranchIfFastRegExp(
-        CAST(context), CAST(object), LoadMap(object),
+        context, heap_object, LoadMap(heap_object),
         PrototypeCheckAssembler::kCheckPrototypePropertyConstness,
         additional_property_to_check, &stub_call, &slow_lookup);
 
@@ -1203,17 +1198,17 @@ void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
     BIND(&slow_lookup);
   }
 
-  GotoIf(IsNullOrUndefined(object), &out);
+  GotoIf(IsNullOrUndefined(heap_object), &out);
 
-  // Fall back to a slow lookup of {object[symbol]}.
+  // Fall back to a slow lookup of {heap_object[symbol]}.
   //
-  // The spec uses GetMethod({object}, {symbol}), which has a few quirks:
+  // The spec uses GetMethod({heap_object}, {symbol}), which has a few quirks:
   // * null values are turned into undefined, and
   // * an exception is thrown if the value is not undefined, null, or callable.
   // We handle the former by jumping to {out} for null values as well, while
   // the latter is already handled by the Call({maybe_func}) operation.
 
-  TNode<Object> const maybe_func = GetProperty(context, object, symbol);
+  const TNode<Object> maybe_func = GetProperty(context, heap_object, symbol);
   GotoIf(IsUndefined(maybe_func), &out);
   GotoIf(IsNull(maybe_func), &out);
 
@@ -1223,27 +1218,24 @@ void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
   BIND(&out);
 }
 
-TNode<Smi> StringBuiltinsAssembler::IndexOfDollarChar(Node* const context,
-                                                      Node* const string) {
-  CSA_ASSERT(this, IsString(string));
-
-  TNode<String> const dollar_string = HeapConstant(
+const TNode<Smi> StringBuiltinsAssembler::IndexOfDollarChar(
+    const TNode<Context> context, const TNode<String> string) {
+  const TNode<String> dollar_string = HeapConstant(
       isolate()->factory()->LookupSingleCharacterStringFromCode('$'));
-  TNode<Smi> const dollar_ix =
+  const TNode<Smi> dollar_ix =
       CAST(CallBuiltin(Builtins::kStringIndexOf, context, string, dollar_string,
                        SmiConstant(0)));
   return dollar_ix;
 }
 
-compiler::Node* StringBuiltinsAssembler::GetSubstitution(
-    Node* context, Node* subject_string, Node* match_start_index,
-    Node* match_end_index, Node* replace_string) {
-  CSA_ASSERT(this, IsString(subject_string));
-  CSA_ASSERT(this, IsString(replace_string));
+TNode<String> StringBuiltinsAssembler::GetSubstitution(
+    TNode<Context> context, TNode<String> subject_string,
+    TNode<Smi> match_start_index, TNode<Smi> match_end_index,
+    TNode<String> replace_string) {
   CSA_ASSERT(this, TaggedIsPositiveSmi(match_start_index));
   CSA_ASSERT(this, TaggedIsPositiveSmi(match_end_index));
 
-  VARIABLE(var_result, MachineRepresentation::kTagged, replace_string);
+  TVARIABLE(String, var_result, replace_string);
   Label runtime(this), out(this);
 
   // In this primitive implementation we simply look for the next '$' char in
@@ -1254,20 +1246,20 @@ compiler::Node* StringBuiltinsAssembler::GetSubstitution(
   // TODO(jgruber): Possibly extend this in the future to handle more complex
   // cases without runtime calls.
 
-  TNode<Smi> const dollar_index = IndexOfDollarChar(context, replace_string);
+  const TNode<Smi> dollar_index = IndexOfDollarChar(context, replace_string);
   Branch(SmiIsNegative(dollar_index), &out, &runtime);
 
   BIND(&runtime);
   {
     CSA_ASSERT(this, TaggedIsPositiveSmi(dollar_index));
 
-    TNode<Object> const matched =
+    const TNode<Object> matched =
         CallBuiltin(Builtins::kStringSubstring, context, subject_string,
                     SmiUntag(match_start_index), SmiUntag(match_end_index));
-    TNode<Object> const replacement_string =
+    const TNode<String> replacement_string = CAST(
         CallRuntime(Runtime::kGetSubstitution, context, matched, subject_string,
-                    match_start_index, replace_string, dollar_index);
-    var_result.Bind(replacement_string);
+                    match_start_index, replace_string, dollar_index));
+    var_result = replacement_string;
 
     Goto(&out);
   }
@@ -1281,11 +1273,11 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
   Label out(this);
 
   TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  Node* const search = Parameter(Descriptor::kSearch);
-  Node* const replace = Parameter(Descriptor::kReplace);
+  const TNode<Object> search = CAST(Parameter(Descriptor::kSearch));
+  const TNode<Object> replace = CAST(Parameter(Descriptor::kReplace));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
-  TNode<Smi> const smi_zero = SmiConstant(0);
+  const TNode<Smi> smi_zero = SmiConstant(0);
 
   RequireObjectCoercible(context, receiver, "String.prototype.replace");
 
@@ -1300,18 +1292,18 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
         Return(CallBuiltin(Builtins::kRegExpReplace, context, search, receiver,
                            replace));
       },
-      [=](Node* fn) {
+      [=](TNode<Object> fn) {
         Callable call_callable = CodeFactory::Call(isolate());
         Return(CallJS(call_callable, context, fn, search, receiver, replace));
       });
 
   // Convert {receiver} and {search} to strings.
 
-  TNode<String> const subject_string = ToString_Inline(context, receiver);
-  TNode<String> const search_string = ToString_Inline(context, search);
+  const TNode<String> subject_string = ToString_Inline(context, receiver);
+  const TNode<String> search_string = ToString_Inline(context, search);
 
-  TNode<IntPtrT> const subject_length = LoadStringLengthAsWord(subject_string);
-  TNode<IntPtrT> const search_length = LoadStringLengthAsWord(search_string);
+  const TNode<IntPtrT> subject_length = LoadStringLengthAsWord(subject_string);
+  const TNode<IntPtrT> search_length = LoadStringLengthAsWord(search_string);
 
   // Fast-path single-char {search}, long cons {receiver}, and simple string
   // {replace}.
@@ -1321,13 +1313,15 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
     GotoIfNot(WordEqual(search_length, IntPtrConstant(1)), &next);
     GotoIfNot(IntPtrGreaterThan(subject_length, IntPtrConstant(0xFF)), &next);
     GotoIf(TaggedIsSmi(replace), &next);
-    GotoIfNot(IsString(replace), &next);
+    GotoIfNot(IsString(CAST(replace)), &next);
 
-    TNode<Uint16T> const subject_instance_type =
+    TNode<String> replace_string = CAST(replace);
+    const TNode<Uint16T> subject_instance_type =
         LoadInstanceType(subject_string);
     GotoIfNot(IsConsStringInstanceType(subject_instance_type), &next);
 
-    GotoIf(TaggedIsPositiveSmi(IndexOfDollarChar(context, replace)), &next);
+    GotoIf(TaggedIsPositiveSmi(IndexOfDollarChar(context, replace_string)),
+           &next);
 
     // Searching by traversing a cons string tree and replace with cons of
     // slices works only when the replaced string is a single character, being
@@ -1335,7 +1329,7 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
     // TODO(jgruber): Reevaluate if this is still beneficial.
     // TODO(jgruber): TailCallRuntime when it correctly handles adapter frames.
     Return(CallRuntime(Runtime::kStringReplaceOneCharWithString, context,
-                       subject_string, search_string, replace));
+                       subject_string, search_string, replace_string));
 
     BIND(&next);
   }
@@ -1344,7 +1338,7 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
   // longer substrings - we can handle up to 8 chars (one-byte) / 4 chars
   // (2-byte).
 
-  TNode<Smi> const match_start_index =
+  const TNode<Smi> match_start_index =
       CAST(CallBuiltin(Builtins::kStringIndexOf, context, subject_string,
                        search_string, smi_zero));
 
@@ -1359,7 +1353,7 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
     // Since ToString() being applied to Smi does not have side effects for
     // numbers we can skip it.
     GotoIf(TaggedIsSmi(replace), &return_subject);
-    GotoIf(IsCallableMap(LoadMap(replace)), &return_subject);
+    GotoIf(IsCallableMap(LoadMap(CAST(replace))), &return_subject);
 
     // TODO(jgruber): Could introduce ToStringSideeffectsStub which only
     // performs observable parts of ToString.
@@ -1372,20 +1366,20 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
     BIND(&next);
   }
 
-  TNode<Smi> const match_end_index =
+  const TNode<Smi> match_end_index =
       SmiAdd(match_start_index, SmiFromIntPtr(search_length));
 
-  VARIABLE(var_result, MachineRepresentation::kTagged, EmptyStringConstant());
+  TVARIABLE(String, var_result, EmptyStringConstant());
 
   // Compute the prefix.
   {
     Label next(this);
 
     GotoIf(SmiEqual(match_start_index, smi_zero), &next);
-    TNode<Object> const prefix =
-        CallBuiltin(Builtins::kStringSubstring, context, subject_string,
-                    IntPtrConstant(0), SmiUntag(match_start_index));
-    var_result.Bind(prefix);
+    const TNode<String> prefix =
+        CAST(CallBuiltin(Builtins::kStringSubstring, context, subject_string,
+                         IntPtrConstant(0), SmiUntag(match_start_index)));
+    var_result = prefix;
 
     Goto(&next);
     BIND(&next);
@@ -1395,39 +1389,39 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
 
   Label if_iscallablereplace(this), if_notcallablereplace(this);
   GotoIf(TaggedIsSmi(replace), &if_notcallablereplace);
-  Branch(IsCallableMap(LoadMap(replace)), &if_iscallablereplace,
+  Branch(IsCallableMap(LoadMap(CAST(replace))), &if_iscallablereplace,
          &if_notcallablereplace);
 
   BIND(&if_iscallablereplace);
   {
     Callable call_callable = CodeFactory::Call(isolate());
-    Node* const replacement =
+    const TNode<Object> replacement =
         CallJS(call_callable, context, replace, UndefinedConstant(),
                search_string, match_start_index, subject_string);
-    TNode<String> const replacement_string =
+    const TNode<String> replacement_string =
         ToString_Inline(context, replacement);
-    var_result.Bind(CallBuiltin(Builtins::kStringAdd_CheckNone, context,
-                                var_result.value(), replacement_string));
+    var_result = CAST(CallBuiltin(Builtins::kStringAdd_CheckNone, context,
+                                  var_result.value(), replacement_string));
     Goto(&out);
   }
 
   BIND(&if_notcallablereplace);
   {
-    TNode<String> const replace_string = ToString_Inline(context, replace);
-    Node* const replacement =
+    const TNode<String> replace_string = ToString_Inline(context, replace);
+    const TNode<Object> replacement =
         GetSubstitution(context, subject_string, match_start_index,
                         match_end_index, replace_string);
-    var_result.Bind(CallBuiltin(Builtins::kStringAdd_CheckNone, context,
-                                var_result.value(), replacement));
+    var_result = CAST(CallBuiltin(Builtins::kStringAdd_CheckNone, context,
+                                  var_result.value(), replacement));
     Goto(&out);
   }
 
   BIND(&out);
   {
-    TNode<Object> const suffix =
+    const TNode<Object> suffix =
         CallBuiltin(Builtins::kStringSubstring, context, subject_string,
                     SmiUntag(match_end_index), subject_length);
-    TNode<Object> const result = CallBuiltin(
+    const TNode<Object> result = CallBuiltin(
         Builtins::kStringAdd_CheckNone, context, var_result.value(), suffix);
     Return(result);
   }
@@ -1468,7 +1462,7 @@ class StringMatchSearchAssembler : public StringBuiltinsAssembler {
     MaybeCallFunctionAtSymbol(
         context, maybe_regexp, receiver, symbol, property_to_check,
         [=] { Return(CallBuiltin(builtin, context, maybe_regexp, receiver)); },
-        [=](Node* fn) {
+        [=](TNode<Object> fn) {
           Callable call_callable = CodeFactory::Call(isolate());
           Return(CallJS(call_callable, context, fn, maybe_regexp, receiver));
         });
@@ -1529,7 +1523,59 @@ TF_BUILTIN(StringPrototypeMatchAll, StringBuiltinsAssembler) {
   // 1. Let O be ? RequireObjectCoercible(this value).
   RequireObjectCoercible(context, receiver, method_name);
 
-  // 2. If regexp is neither undefined nor null, then
+  RegExpMatchAllAssembler regexp_asm(state());
+  {
+    Label fast(this), slow(this, Label::kDeferred),
+        throw_exception(this, Label::kDeferred),
+        throw_flags_exception(this, Label::kDeferred), next(this);
+
+    // 2. If regexp is neither undefined nor null, then
+    //   a. Let isRegExp be ? IsRegExp(regexp).
+    //   b. If isRegExp is true, then
+    //     i. Let flags be ? Get(regexp, "flags").
+    //    ii. Perform ? RequireObjectCoercible(flags).
+    //   iii. If ? ToString(flags) does not contain "g", throw a
+    //        TypeError exception.
+    GotoIf(TaggedIsSmi(maybe_regexp), &next);
+    TNode<HeapObject> heap_maybe_regexp = CAST(maybe_regexp);
+    regexp_asm.BranchIfFastRegExp_Strict(context, heap_maybe_regexp, &fast,
+                                         &slow);
+
+    BIND(&fast);
+    {
+      TNode<BoolT> is_global = regexp_asm.FlagGetter(context, heap_maybe_regexp,
+                                                     JSRegExp::kGlobal, true);
+      Branch(is_global, &next, &throw_exception);
+    }
+
+    BIND(&slow);
+    {
+      GotoIfNot(regexp_asm.IsRegExp(native_context, heap_maybe_regexp), &next);
+
+      TNode<Object> flags = GetProperty(context, heap_maybe_regexp,
+                                        isolate()->factory()->flags_string());
+      // TODO(syg): Implement a RequireObjectCoercible with more flexible error
+      // messages.
+      GotoIf(IsNullOrUndefined(flags), &throw_flags_exception);
+
+      TNode<String> flags_string = ToString_Inline(context, flags);
+      TNode<String> global_char_string = StringConstant("g");
+      TNode<Smi> global_ix =
+          CAST(CallBuiltin(Builtins::kStringIndexOf, context, flags_string,
+                           global_char_string, SmiConstant(0)));
+      Branch(SmiEqual(global_ix, SmiConstant(-1)), &throw_exception, &next);
+    }
+
+    BIND(&throw_exception);
+    ThrowTypeError(context, MessageTemplate::kRegExpGlobalInvokedOnNonGlobal,
+                   method_name);
+
+    BIND(&throw_flags_exception);
+    ThrowTypeError(context,
+                   MessageTemplate::kStringMatchAllNullOrUndefinedFlags);
+
+    BIND(&next);
+  }
   //   a. Let matcher be ? GetMethod(regexp, @@matchAll).
   //   b. If matcher is not undefined, then
   //     i. Return ? Call(matcher, regexp, « O »).
@@ -1541,7 +1587,7 @@ TF_BUILTIN(StringPrototypeMatchAll, StringBuiltinsAssembler) {
     Return(
         RegExpPrototypeMatchAllImpl(context, native_context, maybe_regexp, s));
   };
-  auto if_generic_call = [=](Node* fn) {
+  auto if_generic_call = [=](TNode<Object> fn) {
     Callable call_callable = CodeFactory::Call(isolate());
     Return(CallJS(call_callable, context, fn, maybe_regexp, receiver));
   };
@@ -1552,8 +1598,6 @@ TF_BUILTIN(StringPrototypeMatchAll, StringBuiltinsAssembler) {
                                Context::REGEXP_MATCH_ALL_FUNCTION_INDEX},
       if_regexp_call, if_generic_call);
 
-  RegExpMatchAllAssembler regexp_asm(state());
-
   // 3. Let S be ? ToString(O).
   TNode<String> s = ToString_Inline(context, receiver);
 
@@ -1655,13 +1699,13 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
   const int kSeparatorArg = 0;
   const int kLimitArg = 1;
 
-  TNode<IntPtrT> const argc =
+  const TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   TNode<Object> receiver = args.GetReceiver();
-  TNode<Object> const separator = args.GetOptionalArgumentValue(kSeparatorArg);
-  TNode<Object> const limit = args.GetOptionalArgumentValue(kLimitArg);
+  const TNode<Object> separator = args.GetOptionalArgumentValue(kSeparatorArg);
+  const TNode<Object> limit = args.GetOptionalArgumentValue(kLimitArg);
   TNode<NativeContext> context = CAST(Parameter(Descriptor::kContext));
 
   TNode<Smi> smi_zero = SmiConstant(0);
@@ -1679,7 +1723,7 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
         args.PopAndReturn(CallBuiltin(Builtins::kRegExpSplit, context,
                                       separator, receiver, limit));
       },
-      [&](Node* fn) {
+      [&](TNode<Object> fn) {
         Callable call_callable = CodeFactory::Call(isolate());
         args.PopAndReturn(
             CallJS(call_callable, context, fn, separator, receiver, limit));
@@ -1691,7 +1735,7 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
   TNode<Number> limit_number = Select<Number>(
       IsUndefined(limit), [=] { return NumberConstant(kMaxUInt32); },
       [=] { return ToUint32(context, limit); });
-  TNode<String> const separator_string = ToString_Inline(context, separator);
+  const TNode<String> separator_string = ToString_Inline(context, separator);
 
   Label return_empty_array(this);
 
@@ -1705,7 +1749,7 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
     GotoIfNot(IsUndefined(separator), &next);
 
     const ElementsKind kind = PACKED_ELEMENTS;
-    TNode<NativeContext> const native_context = LoadNativeContext(context);
+    const TNode<NativeContext> native_context = LoadNativeContext(context);
     TNode<Map> array_map = LoadJSArrayElementsMap(kind, native_context);
 
     TNode<Smi> length = SmiConstant(1);
@@ -1735,7 +1779,7 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
     BIND(&next);
   }
 
-  TNode<Object> const result =
+  const TNode<Object> result =
       CallRuntime(Runtime::kStringSplit, context, subject_string,
                   separator_string, limit_number);
   args.PopAndReturn(result);
@@ -1743,7 +1787,7 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
   BIND(&return_empty_array);
   {
     const ElementsKind kind = PACKED_ELEMENTS;
-    TNode<NativeContext> const native_context = LoadNativeContext(context);
+    const TNode<NativeContext> native_context = LoadNativeContext(context);
     TNode<Map> array_map = LoadJSArrayElementsMap(kind, native_context);
 
     TNode<Smi> length = smi_zero;
@@ -1754,104 +1798,6 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
   }
 }
 
-// ES6 #sec-string.prototype.substr
-TF_BUILTIN(StringPrototypeSubstr, StringBuiltinsAssembler) {
-  const int kStartArg = 0;
-  const int kLengthArg = 1;
-
-  TNode<IntPtrT> const argc =
-      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
-  CodeStubArguments args(this, argc);
-
-  TNode<Object> receiver = args.GetReceiver();
-  TNode<Object> start = args.GetOptionalArgumentValue(kStartArg);
-  TNode<Object> length = args.GetOptionalArgumentValue(kLengthArg);
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  Label out(this);
-
-  TVARIABLE(IntPtrT, var_start);
-  TVARIABLE(Number, var_length);
-
-  TNode<IntPtrT> const zero = IntPtrConstant(0);
-
-  // Check that {receiver} is coercible to Object and convert it to a String.
-  TNode<String> const string =
-      ToThisString(context, receiver, "String.prototype.substr");
-
-  TNode<IntPtrT> const string_length = LoadStringLengthAsWord(string);
-
-  // Convert {start} to a relative index.
-  var_start = ConvertToRelativeIndex(context, start, string_length);
-
-  // Conversions and bounds-checks for {length}.
-  Label if_issmi(this), if_isheapnumber(this, Label::kDeferred);
-
-  // Default to {string_length} if {length} is undefined.
-  {
-    Label if_isundefined(this, Label::kDeferred), if_isnotundefined(this);
-    Branch(IsUndefined(length), &if_isundefined, &if_isnotundefined);
-
-    BIND(&if_isundefined);
-    var_length = SmiTag(string_length);
-    Goto(&if_issmi);
-
-    BIND(&if_isnotundefined);
-    var_length = ToInteger_Inline(context, length,
-                                  CodeStubAssembler::kTruncateMinusZero);
-  }
-
-  TVARIABLE(IntPtrT, var_result_length);
-
-  Branch(TaggedIsSmi(var_length.value()), &if_issmi, &if_isheapnumber);
-
-  // Set {length} to min(max({length}, 0), {string_length} - {start}
-  BIND(&if_issmi);
-  {
-    TNode<IntPtrT> const positive_length =
-        IntPtrMax(SmiUntag(CAST(var_length.value())), zero);
-    TNode<IntPtrT> const minimal_length =
-        IntPtrSub(string_length, var_start.value());
-    var_result_length = IntPtrMin(positive_length, minimal_length);
-
-    GotoIfNot(IntPtrLessThanOrEqual(var_result_length.value(), zero), &out);
-    args.PopAndReturn(EmptyStringConstant());
-  }
-
-  BIND(&if_isheapnumber);
-  {
-    // If {length} is a heap number, it is definitely out of bounds. There are
-    // two cases according to the spec: if it is negative, "" is returned; if
-    // it is positive, then length is set to {string_length} - {start}.
-
-    CSA_ASSERT(this, IsHeapNumber(CAST(var_length.value())));
-
-    Label if_isnegative(this), if_ispositive(this);
-    TNode<Float64T> const float_zero = Float64Constant(0.);
-    TNode<Float64T> const length_float =
-        LoadHeapNumberValue(CAST(var_length.value()));
-    Branch(Float64LessThan(length_float, float_zero), &if_isnegative,
-           &if_ispositive);
-
-    BIND(&if_isnegative);
-    args.PopAndReturn(EmptyStringConstant());
-
-    BIND(&if_ispositive);
-    {
-      var_result_length = IntPtrSub(string_length, var_start.value());
-      GotoIfNot(IntPtrLessThanOrEqual(var_result_length.value(), zero), &out);
-      args.PopAndReturn(EmptyStringConstant());
-    }
-  }
-
-  BIND(&out);
-  {
-    TNode<IntPtrT> const end =
-        IntPtrAdd(var_start.value(), var_result_length.value());
-    args.PopAndReturn(SubString(string, var_start.value(), end));
-  }
-}
-
 TF_BUILTIN(StringSubstring, StringBuiltinsAssembler) {
   TNode<String> string = CAST(Parameter(Descriptor::kString));
   TNode<IntPtrT> from = UncheckedCast<IntPtrT>(Parameter(Descriptor::kFrom));
@@ -1896,16 +1842,16 @@ void StringTrimAssembler::Generate(String::TrimMode mode,
   TNode<Object> receiver = arguments.GetReceiver();
 
   // Check that {receiver} is coercible to Object and convert it to a String.
-  TNode<String> const string = ToThisString(context, receiver, method_name);
-  TNode<IntPtrT> const string_length = LoadStringLengthAsWord(string);
+  const TNode<String> string = ToThisString(context, receiver, method_name);
+  const TNode<IntPtrT> string_length = LoadStringLengthAsWord(string);
 
   ToDirectStringAssembler to_direct(state(), string);
   to_direct.TryToDirect(&if_runtime);
-  TNode<RawPtrT> const string_data = to_direct.PointerToData(&if_runtime);
-  TNode<Int32T> const instance_type = to_direct.instance_type();
-  TNode<BoolT> const is_stringonebyte =
+  const TNode<RawPtrT> string_data = to_direct.PointerToData(&if_runtime);
+  const TNode<Int32T> instance_type = to_direct.instance_type();
+  const TNode<BoolT> is_stringonebyte =
       IsOneByteStringInstanceType(instance_type);
-  TNode<IntPtrT> const string_data_offset = to_direct.offset();
+  const TNode<IntPtrT> string_data_offset = to_direct.offset();
 
   TVARIABLE(IntPtrT, var_start, IntPtrConstant(0));
   TVARIABLE(IntPtrT, var_end, IntPtrSub(string_length, IntPtrConstant(1)));
@@ -1934,35 +1880,37 @@ void StringTrimAssembler::Generate(String::TrimMode mode,
 }
 
 void StringTrimAssembler::ScanForNonWhiteSpaceOrLineTerminator(
-    Node* const string_data, Node* const string_data_offset,
-    Node* const is_stringonebyte, TVariable<IntPtrT>* const var_index,
-    TNode<IntPtrT> const end, int increment, Label* const if_none_found) {
+    const TNode<RawPtrT> string_data, const TNode<IntPtrT> string_data_offset,
+    const TNode<BoolT> is_stringonebyte, TVariable<IntPtrT>* const var_index,
+    const TNode<IntPtrT> end, int increment, Label* const if_none_found) {
   Label if_stringisonebyte(this), out(this);
 
   GotoIf(is_stringonebyte, &if_stringisonebyte);
 
   // Two Byte String
-  BuildLoop(
-      var_index, end, increment, if_none_found, &out, [&](Node* const index) {
-        return Load(
-            MachineType::Uint16(), string_data,
+  BuildLoop<Uint16T>(
+      var_index, end, increment, if_none_found, &out,
+      [&](const TNode<IntPtrT> index) {
+        return Load<Uint16T>(
+            string_data,
             WordShl(IntPtrAdd(index, string_data_offset), IntPtrConstant(1)));
       });
 
   BIND(&if_stringisonebyte);
-  BuildLoop(var_index, end, increment, if_none_found, &out,
-            [&](Node* const index) {
-              return Load(MachineType::Uint8(), string_data,
-                          IntPtrAdd(index, string_data_offset));
-            });
+  BuildLoop<Uint8T>(var_index, end, increment, if_none_found, &out,
+                    [&](const TNode<IntPtrT> index) {
+                      return Load<Uint8T>(string_data,
+                                          IntPtrAdd(index, string_data_offset));
+                    });
 
   BIND(&out);
 }
 
+template <typename T>
 void StringTrimAssembler::BuildLoop(
-    TVariable<IntPtrT>* const var_index, TNode<IntPtrT> const end,
+    TVariable<IntPtrT>* const var_index, const TNode<IntPtrT> end,
     int increment, Label* const if_none_found, Label* const out,
-    const std::function<Node*(Node*)>& get_character) {
+    const std::function<TNode<T>(const TNode<IntPtrT>)>& get_character) {
   Label loop(this, var_index);
   Goto(&loop);
   BIND(&loop);
@@ -1977,7 +1925,7 @@ void StringTrimAssembler::BuildLoop(
 }
 
 void StringTrimAssembler::GotoIfNotWhiteSpaceOrLineTerminator(
-    TNode<Word32T> const char_code, Label* const if_not_whitespace) {
+    const TNode<Word32T> char_code, Label* const if_not_whitespace) {
   Label out(this);
 
   // 0x0020 - SPACE (Intentionally out of order to fast path a commmon case)
@@ -2033,13 +1981,14 @@ void StringTrimAssembler::GotoIfNotWhiteSpaceOrLineTerminator(
 
 // Return the |word32| codepoint at {index}. Supports SeqStrings and
 // ExternalStrings.
+// TODO(v8:9880): Use UintPtrT here.
 TNode<Int32T> StringBuiltinsAssembler::LoadSurrogatePairAt(
-    SloppyTNode<String> string, SloppyTNode<IntPtrT> length,
-    SloppyTNode<IntPtrT> index, UnicodeEncoding encoding) {
+    TNode<String> string, TNode<IntPtrT> length, TNode<IntPtrT> index,
+    UnicodeEncoding encoding) {
   Label handle_surrogate_pair(this), return_result(this);
   TVARIABLE(Int32T, var_result);
   TVARIABLE(Int32T, var_trail);
-  var_result = StringCharCodeAt(string, index);
+  var_result = StringCharCodeAt(string, Unsigned(index));
   var_trail = Int32Constant(0);
 
   GotoIf(Word32NotEqual(Word32And(var_result.value(), Int32Constant(0xFC00)),
@@ -2048,7 +1997,7 @@ TNode<Int32T> StringBuiltinsAssembler::LoadSurrogatePairAt(
   TNode<IntPtrT> next_index = IntPtrAdd(index, IntPtrConstant(1));
 
   GotoIfNot(IntPtrLessThan(next_index, length), &return_result);
-  var_trail = StringCharCodeAt(string, next_index);
+  var_trail = StringCharCodeAt(string, Unsigned(next_index));
   Branch(Word32Equal(Word32And(var_trail.value(), Int32Constant(0xFC00)),
                      Int32Constant(0xDC00)),
          &handle_surrogate_pair, &return_result);
@@ -2112,13 +2061,26 @@ void StringBuiltinsAssembler::BranchIfStringPrimitiveWithNoCustomIteration(
       if_true, if_false);
 }
 
+// Instantiate template due to shared library requirements.
+template V8_EXPORT_PRIVATE void StringBuiltinsAssembler::CopyStringCharacters(
+    TNode<String> from_string, TNode<String> to_string,
+    TNode<IntPtrT> from_index, TNode<IntPtrT> to_index,
+    TNode<IntPtrT> character_count, String::Encoding from_encoding,
+    String::Encoding to_encoding);
+
+template V8_EXPORT_PRIVATE void StringBuiltinsAssembler::CopyStringCharacters(
+    TNode<RawPtrT> from_string, TNode<String> to_string,
+    TNode<IntPtrT> from_index, TNode<IntPtrT> to_index,
+    TNode<IntPtrT> character_count, String::Encoding from_encoding,
+    String::Encoding to_encoding);
+
+template <typename T>
 void StringBuiltinsAssembler::CopyStringCharacters(
-    Node* from_string, Node* to_string, TNode<IntPtrT> from_index,
+    TNode<T> from_string, TNode<String> to_string, TNode<IntPtrT> from_index,
     TNode<IntPtrT> to_index, TNode<IntPtrT> character_count,
     String::Encoding from_encoding, String::Encoding to_encoding) {
-  // Cannot assert IsString(from_string) and IsString(to_string) here because
-  // SubString can pass in faked sequential strings when handling external
-  // subject strings.
+  // from_string could be either a String or a RawPtrT in the case we pass in
+  // faked sequential strings when handling external subject strings.
   bool from_one_byte = from_encoding == String::ONE_BYTE_ENCODING;
   bool to_one_byte = to_encoding == String::ONE_BYTE_ENCODING;
   DCHECK_IMPLIES(to_one_byte, from_one_byte);
@@ -2157,10 +2119,9 @@ void StringBuiltinsAssembler::CopyStringCharacters(
   BuildFastLoop<IntPtrT>(
       vars, from_offset, limit_offset,
       [&](TNode<IntPtrT> offset) {
-        Node* value = Load(type, from_string, offset);
         StoreNoWriteBarrier(rep, to_string,
                             index_same ? offset : current_to_offset.value(),
-                            value);
+                            Load(type, from_string, offset));
         if (!index_same) {
           Increment(&current_to_offset, to_increment);
         }
@@ -2173,8 +2134,9 @@ void StringBuiltinsAssembler::CopyStringCharacters(
 // given character range using CopyStringCharacters.
 // |from_string| must be a sequential string.
 // 0 <= |from_index| <= |from_index| + |character_count| < from_string.length.
+template <typename T>
 TNode<String> StringBuiltinsAssembler::AllocAndCopyStringCharacters(
-    Node* from, Node* from_instance_type, TNode<IntPtrT> from_index,
+    TNode<T> from, TNode<Int32T> from_instance_type, TNode<IntPtrT> from_index,
     TNode<IntPtrT> character_count) {
   Label end(this), one_byte_sequential(this), two_byte_sequential(this);
   TVARIABLE(String, var_result);
@@ -2187,9 +2149,9 @@ TNode<String> StringBuiltinsAssembler::AllocAndCopyStringCharacters(
   {
     TNode<String> result = AllocateSeqOneByteString(
         Unsigned(TruncateIntPtrToInt32(character_count)));
-    CopyStringCharacters(from, result, from_index, IntPtrConstant(0),
-                         character_count, String::ONE_BYTE_ENCODING,
-                         String::ONE_BYTE_ENCODING);
+    CopyStringCharacters<T>(from, result, from_index, IntPtrConstant(0),
+                            character_count, String::ONE_BYTE_ENCODING,
+                            String::ONE_BYTE_ENCODING);
     var_result = result;
     Goto(&end);
   }
@@ -2199,9 +2161,9 @@ TNode<String> StringBuiltinsAssembler::AllocAndCopyStringCharacters(
   {
     TNode<String> result = AllocateSeqTwoByteString(
         Unsigned(TruncateIntPtrToInt32(character_count)));
-    CopyStringCharacters(from, result, from_index, IntPtrConstant(0),
-                         character_count, String::TWO_BYTE_ENCODING,
-                         String::TWO_BYTE_ENCODING);
+    CopyStringCharacters<T>(from, result, from_index, IntPtrConstant(0),
+                            character_count, String::TWO_BYTE_ENCODING,
+                            String::TWO_BYTE_ENCODING);
     var_result = result;
     Goto(&end);
   }
@@ -2210,6 +2172,7 @@ TNode<String> StringBuiltinsAssembler::AllocAndCopyStringCharacters(
   return var_result.value();
 }
 
+// TODO(v8:9880): Use UintPtrT here.
 TNode<String> StringBuiltinsAssembler::SubString(TNode<String> string,
                                                  TNode<IntPtrT> from,
                                                  TNode<IntPtrT> to) {
@@ -2217,8 +2180,8 @@ TNode<String> StringBuiltinsAssembler::SubString(TNode<String> string,
   ToDirectStringAssembler to_direct(state(), string);
   Label end(this), runtime(this);
 
-  TNode<IntPtrT> const substr_length = IntPtrSub(to, from);
-  TNode<IntPtrT> const string_length = LoadStringLengthAsWord(string);
+  const TNode<IntPtrT> substr_length = IntPtrSub(to, from);
+  const TNode<IntPtrT> string_length = LoadStringLengthAsWord(string);
 
   // Begin dispatching based on substring length.
 
@@ -2238,7 +2201,7 @@ TNode<String> StringBuiltinsAssembler::SubString(TNode<String> string,
 
   TNode<String> direct_string = to_direct.TryToDirect(&runtime);
   TNode<IntPtrT> offset = IntPtrAdd(from, to_direct.offset());
-  TNode<Int32T> const instance_type = to_direct.instance_type();
+  const TNode<Int32T> instance_type = to_direct.instance_type();
 
   // The subject string can only be external or sequential string of either
   // encoding at this point.
@@ -2296,7 +2259,7 @@ TNode<String> StringBuiltinsAssembler::SubString(TNode<String> string,
   // Handle external string.
   BIND(&external_string);
   {
-    TNode<RawPtrT> const fake_sequential_string =
+    const TNode<RawPtrT> fake_sequential_string =
         to_direct.PointerToString(&runtime);
 
     var_result = AllocAndCopyStringCharacters(
@@ -2317,7 +2280,7 @@ TNode<String> StringBuiltinsAssembler::SubString(TNode<String> string,
   // Substrings of length 1 are generated through CharCodeAt and FromCharCode.
   BIND(&single_char);
   {
-    TNode<Int32T> char_code = StringCharCodeAt(string, from);
+    TNode<Int32T> char_code = StringCharCodeAt(string, Unsigned(from));
     var_result = StringFromSingleCharCode(char_code);
     Goto(&end);
   }
diff --git a/deps/v8/src/builtins/builtins-string-gen.h b/deps/v8/src/builtins/builtins-string-gen.h
index 0dfcf88a8c77da..93b2086dd7f61c 100644
--- a/deps/v8/src/builtins/builtins-string-gen.h
+++ b/deps/v8/src/builtins/builtins-string-gen.h
@@ -16,11 +16,13 @@ class StringBuiltinsAssembler : public CodeStubAssembler {
       : CodeStubAssembler(state) {}
 
   // ES#sec-getsubstitution
-  Node* GetSubstitution(Node* context, Node* subject_string,
-                        Node* match_start_index, Node* match_end_index,
-                        Node* replace_string);
-  void StringEqual_Core(SloppyTNode<String> lhs, Node* lhs_instance_type,
-                        SloppyTNode<String> rhs, Node* rhs_instance_type,
+  TNode<String> GetSubstitution(TNode<Context> context,
+                                TNode<String> subject_string,
+                                TNode<Smi> match_start_index,
+                                TNode<Smi> match_end_index,
+                                TNode<String> replace_string);
+  void StringEqual_Core(TNode<String> lhs, TNode<Word32T> lhs_instance_type,
+                        TNode<String> rhs, TNode<Word32T> rhs_instance_type,
                         TNode<IntPtrT> length, Label* if_equal,
                         Label* if_not_equal, Label* if_indirect);
   void BranchIfStringPrimitiveWithNoCustomIteration(TNode<Object> object,
@@ -28,17 +30,22 @@ class StringBuiltinsAssembler : public CodeStubAssembler {
                                                     Label* if_true,
                                                     Label* if_false);
 
-  TNode<Int32T> LoadSurrogatePairAt(SloppyTNode<String> string,
-                                    SloppyTNode<IntPtrT> length,
-                                    SloppyTNode<IntPtrT> index,
+  TNode<Int32T> LoadSurrogatePairAt(TNode<String> string, TNode<IntPtrT> length,
+                                    TNode<IntPtrT> index,
                                     UnicodeEncoding encoding);
 
   TNode<String> StringFromSingleUTF16EncodedCodePoint(TNode<Int32T> codepoint);
 
   // Return a new string object which holds a substring containing the range
   // [from,to[ of string.
+  // TODO(v8:9880): Fix implementation to use UintPtrT arguments and drop
+  // IntPtrT version once all callers use UintPtrT version.
   TNode<String> SubString(TNode<String> string, TNode<IntPtrT> from,
                           TNode<IntPtrT> to);
+  TNode<String> SubString(TNode<String> string, TNode<UintPtrT> from,
+                          TNode<UintPtrT> to) {
+    return SubString(string, Signed(from), Signed(to));
+  }
 
   // Copies |character_count| elements from |from_string| to |to_string|
   // starting at the |from_index|'th character. |from_string| and |to_string|
@@ -47,37 +54,38 @@ class StringBuiltinsAssembler : public CodeStubAssembler {
   // |from_index|, |to_index| and |character_count| must be intptr_ts s.t. 0 <=
   // |from_index| <= |from_index| + |character_count| <= from_string.length and
   // 0 <= |to_index| <= |to_index| + |character_count| <= to_string.length.
-  V8_EXPORT_PRIVATE void CopyStringCharacters(
-      Node* from_string, Node* to_string, TNode<IntPtrT> from_index,
-      TNode<IntPtrT> to_index, TNode<IntPtrT> character_count,
-      String::Encoding from_encoding, String::Encoding to_encoding);
+  template <typename T>
+  void CopyStringCharacters(TNode<T> from_string, TNode<String> to_string,
+                            TNode<IntPtrT> from_index, TNode<IntPtrT> to_index,
+                            TNode<IntPtrT> character_count,
+                            String::Encoding from_encoding,
+                            String::Encoding to_encoding);
 
  protected:
-  void StringEqual_Loop(Node* lhs, Node* lhs_instance_type,
-                        MachineType lhs_type, Node* rhs,
-                        Node* rhs_instance_type, MachineType rhs_type,
+  void StringEqual_Loop(TNode<String> lhs, TNode<Word32T> lhs_instance_type,
+                        MachineType lhs_type, TNode<String> rhs,
+                        TNode<Word32T> rhs_instance_type, MachineType rhs_type,
                         TNode<IntPtrT> length, Label* if_equal,
                         Label* if_not_equal);
-  Node* DirectStringData(Node* string, Node* string_instance_type);
+  TNode<IntPtrT> DirectStringData(TNode<String> string,
+                                  TNode<Word32T> string_instance_type);
 
-  void DispatchOnStringEncodings(Node* const lhs_instance_type,
-                                 Node* const rhs_instance_type,
+  void DispatchOnStringEncodings(const TNode<Word32T> lhs_instance_type,
+                                 const TNode<Word32T> rhs_instance_type,
                                  Label* if_one_one, Label* if_one_two,
                                  Label* if_two_one, Label* if_two_two);
 
   template <typename SubjectChar, typename PatternChar>
-  Node* CallSearchStringRaw(Node* const subject_ptr, Node* const subject_length,
-                            Node* const search_ptr, Node* const search_length,
-                            Node* const start_position);
+  TNode<IntPtrT> CallSearchStringRaw(const TNode<RawPtrT> subject_ptr,
+                                     const TNode<IntPtrT> subject_length,
+                                     const TNode<RawPtrT> search_ptr,
+                                     const TNode<IntPtrT> search_length,
+                                     const TNode<IntPtrT> start_position);
 
   TNode<RawPtrT> PointerToStringDataAtIndex(TNode<RawPtrT> string_data,
                                             TNode<IntPtrT> index,
                                             String::Encoding encoding);
 
-  // substr and slice have a common way of handling the {start} argument.
-  void ConvertAndBoundsCheckStartArgument(Node* context, Variable* var_start,
-                                          Node* start, Node* string_length);
-
   void GenerateStringEqual(TNode<String> left, TNode<String> right);
   void GenerateStringRelationalComparison(TNode<String> left,
                                           TNode<String> right, Operation op);
@@ -85,12 +93,13 @@ class StringBuiltinsAssembler : public CodeStubAssembler {
   using StringAtAccessor = std::function<TNode<Object>(
       TNode<String> receiver, TNode<IntPtrT> length, TNode<IntPtrT> index)>;
 
-  void StringIndexOf(TNode<String> const subject_string,
-                     TNode<String> const search_string,
-                     TNode<Smi> const position,
+  void StringIndexOf(const TNode<String> subject_string,
+                     const TNode<String> search_string,
+                     const TNode<Smi> position,
                      const std::function<void(TNode<Smi>)>& f_return);
 
-  TNode<Smi> IndexOfDollarChar(Node* const context, Node* const string);
+  const TNode<Smi> IndexOfDollarChar(const TNode<Context> context,
+                                     const TNode<String> string);
 
   TNode<JSArray> StringToArray(TNode<NativeContext> context,
                                TNode<String> subject_string,
@@ -104,7 +113,7 @@ class StringBuiltinsAssembler : public CodeStubAssembler {
   TNode<String> AllocateConsString(TNode<Uint32T> length, TNode<String> left,
                                    TNode<String> right);
 
-  TNode<String> StringAdd(Node* context, TNode<String> left,
+  TNode<String> StringAdd(SloppyTNode<Context> context, TNode<String> left,
                           TNode<String> right);
 
   // Check if |string| is an indirect (thin or flat cons) string type that can
@@ -146,18 +155,19 @@ class StringBuiltinsAssembler : public CodeStubAssembler {
   // Contains fast paths for Smi and RegExp objects.
   // Important: {regexp_call} may not contain any code that can call into JS.
   using NodeFunction0 = std::function<void()>;
-  using NodeFunction1 = std::function<void(Node* fn)>;
+  using NodeFunction1 = std::function<void(TNode<Object> fn)>;
   using DescriptorIndexNameValue =
       PrototypeCheckAssembler::DescriptorIndexNameValue;
   void MaybeCallFunctionAtSymbol(
-      Node* const context, Node* const object, Node* const maybe_string,
-      Handle<Symbol> symbol,
+      const TNode<Context> context, const TNode<Object> object,
+      const TNode<Object> maybe_string, Handle<Symbol> symbol,
       DescriptorIndexNameValue additional_property_to_check,
       const NodeFunction0& regexp_call, const NodeFunction1& generic_call);
 
  private:
-  TNode<String> AllocAndCopyStringCharacters(Node* from,
-                                             Node* from_instance_type,
+  template <typename T>
+  TNode<String> AllocAndCopyStringCharacters(TNode<T> from,
+                                             TNode<Int32T> from_instance_type,
                                              TNode<IntPtrT> from_index,
                                              TNode<IntPtrT> character_count);
 };
@@ -180,20 +190,22 @@ class StringTrimAssembler : public StringBuiltinsAssembler {
       : StringBuiltinsAssembler(state) {}
 
   V8_EXPORT_PRIVATE void GotoIfNotWhiteSpaceOrLineTerminator(
-      TNode<Word32T> const char_code, Label* const if_not_whitespace);
+      const TNode<Word32T> char_code, Label* const if_not_whitespace);
 
  protected:
   void Generate(String::TrimMode mode, const char* method, TNode<IntPtrT> argc,
                 TNode<Context> context);
 
   void ScanForNonWhiteSpaceOrLineTerminator(
-      Node* const string_data, Node* const string_data_offset,
-      Node* const is_stringonebyte, TVariable<IntPtrT>* const var_index,
-      TNode<IntPtrT> const end, int increment, Label* const if_none_found);
-
-  void BuildLoop(TVariable<IntPtrT>* const var_index, TNode<IntPtrT> const end,
-                 int increment, Label* const if_none_found, Label* const out,
-                 const std::function<Node*(Node*)>& get_character);
+      const TNode<RawPtrT> string_data, const TNode<IntPtrT> string_data_offset,
+      const TNode<BoolT> is_stringonebyte, TVariable<IntPtrT>* const var_index,
+      const TNode<IntPtrT> end, int increment, Label* const if_none_found);
+
+  template <typename T>
+  void BuildLoop(
+      TVariable<IntPtrT>* const var_index, const TNode<IntPtrT> end,
+      int increment, Label* const if_none_found, Label* const out,
+      const std::function<TNode<T>(const TNode<IntPtrT>)>& get_character);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-string.cc b/deps/v8/src/builtins/builtins-string.cc
index ba2346d661c7fa..8a897765c83ab5 100644
--- a/deps/v8/src/builtins/builtins-string.cc
+++ b/deps/v8/src/builtins/builtins-string.cc
@@ -155,13 +155,13 @@ BUILTIN(StringPrototypeLocaleCompare) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, str2,
                                      Object::ToString(isolate, args.at(1)));
 
-  if (str1.is_identical_to(str2)) return Smi::kZero;  // Equal.
+  if (str1.is_identical_to(str2)) return Smi::zero();  // Equal.
   int str1_length = str1->length();
   int str2_length = str2->length();
 
   // Decide trivial cases without flattening.
   if (str1_length == 0) {
-    if (str2_length == 0) return Smi::kZero;  // Equal.
+    if (str2_length == 0) return Smi::zero();  // Equal.
     return Smi::FromInt(-str2_length);
   } else {
     if (str2_length == 0) return Smi::FromInt(str1_length);
diff --git a/deps/v8/src/builtins/string.tq b/deps/v8/src/builtins/builtins-string.tq
similarity index 68%
rename from deps/v8/src/builtins/string.tq
rename to deps/v8/src/builtins/builtins-string.tq
index 4f2c342fd554b9..3ef8fc2a9bb6af 100644
--- a/deps/v8/src/builtins/string.tq
+++ b/deps/v8/src/builtins/builtins-string.tq
@@ -5,18 +5,23 @@
 #include 'src/builtins/builtins-string-gen.h'
 
 namespace string {
+  extern macro StringBuiltinsAssembler::SubString(String, uintptr, uintptr):
+      String;
+
   // ES6 #sec-string.prototype.tostring
   transitioning javascript builtin
-  StringPrototypeToString(js-implicit context: Context, receiver: JSAny)():
-      JSAny {
-    return ToThisValue(receiver, kString, 'String.prototype.toString');
+  StringPrototypeToString(
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+    return ToThisValue(
+        receiver, PrimitiveType::kString, 'String.prototype.toString');
   }
 
   // ES6 #sec-string.prototype.valueof
   transitioning javascript builtin
-  StringPrototypeValueOf(js-implicit context: Context, receiver: JSAny)():
+  StringPrototypeValueOf(js-implicit context: NativeContext, receiver: JSAny)():
       JSAny {
-    return ToThisValue(receiver, kString, 'String.prototype.valueOf');
+    return ToThisValue(
+        receiver, PrimitiveType::kString, 'String.prototype.valueOf');
   }
 
   extern macro StringBuiltinsAssembler::LoadSurrogatePairAt(
@@ -27,16 +32,16 @@ namespace string {
   // This function assumes StringPrimitiveWithNoCustomIteration is true.
   transitioning builtin StringToList(implicit context: Context)(string: String):
       JSArray {
-    const kind = PACKED_ELEMENTS;
+    const kind = ElementsKind::PACKED_ELEMENTS;
     const stringLength: intptr = string.length_intptr;
 
     const nativeContext = LoadNativeContext(context);
     const map: Map = LoadJSArrayElementsMap(kind, nativeContext);
     const array: JSArray = AllocateJSArray(
         kind, map, stringLength, SmiTag(stringLength),
-        kAllowLargeObjectAllocation);
+        AllocationFlag::kAllowLargeObjectAllocation);
     const elements = UnsafeCast<FixedArray>(array.elements);
-    const encoding = UTF16;
+    const encoding = UnicodeEncoding::UTF16;
     let arrayLength: Smi = 0;
     let i: intptr = 0;
     while (i < stringLength) {
@@ -57,28 +62,46 @@ namespace string {
   transitioning macro GenerateStringAt(implicit context: Context)(
       receiver: JSAny, position: JSAny,
       methodName: constexpr string): never labels
-  IfInBounds(String, intptr, intptr), IfOutOfBounds {
-    // Check that {receiver} is coercible to Object and convert it to a String.
+  IfInBounds(String, uintptr, uintptr), IfOutOfBounds {
+    // 1. Let O be ? RequireObjectCoercible(this value).
+    // 2. Let S be ? ToString(O).
     const string: String = ToThisString(receiver, methodName);
-    // Convert the {position} to a Smi and check that it's in bounds of
+
+    // 3. Let position be ? ToInteger(pos).
+    const indexNumber: Number = ToInteger_Inline(position, kTruncateMinusZero);
+
+    // Convert the {position} to a uintptr and check that it's in bounds of
     // the {string}.
-    const indexNumber: Number =
-        ToInteger_Inline(context, position, kTruncateMinusZero);
-    if (TaggedIsNotSmi(indexNumber)) goto IfOutOfBounds;
-    const index: intptr = SmiUntag(UnsafeCast<Smi>(indexNumber));
-    const length: intptr = string.length_intptr;
-    if (Convert<uintptr>(index) >= Convert<uintptr>(length)) goto IfOutOfBounds;
-    goto IfInBounds(string, index, length);
+    typeswitch (indexNumber) {
+      case (indexSmi: Smi): {
+        const length: uintptr = string.length_uintptr;
+        const index: uintptr = Unsigned(Convert<intptr>(indexSmi));
+        // Max string length fits Smi range, so we can do an unsigned bounds
+        // check.
+        const kMaxStringLengthFitsSmi: constexpr bool =
+            kStringMaxLengthUintptr < kSmiMaxValue;
+        StaticAssert(kMaxStringLengthFitsSmi);
+        if (index >= length) goto IfOutOfBounds;
+        goto IfInBounds(string, index, length);
+      }
+      case (indexHeapNumber: HeapNumber): {
+        assert(IsNumberNormalized(indexHeapNumber));
+        // Valid string indices fit into Smi range, so HeapNumber index is
+        // definitely an out of bounds case.
+        goto IfOutOfBounds;
+      }
+    }
   }
 
   // ES6 #sec-string.prototype.charat
   transitioning javascript builtin StringPrototypeCharAt(
-      js-implicit context: Context, receiver: JSAny)(position: JSAny): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(position: JSAny): JSAny {
     try {
       GenerateStringAt(receiver, position, 'String.prototype.charAt')
           otherwise IfInBounds, IfOutOfBounds;
     }
-    label IfInBounds(string: String, index: intptr, _length: intptr) {
+    label IfInBounds(string: String, index: uintptr, _length: uintptr) {
       const code: int32 = StringCharCodeAt(string, index);
       return StringFromSingleCharCode(code);
     }
@@ -89,12 +112,13 @@ namespace string {
 
   // ES6 #sec-string.prototype.charcodeat
   transitioning javascript builtin StringPrototypeCharCodeAt(
-      js-implicit context: Context, receiver: JSAny)(position: JSAny): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(position: JSAny): JSAny {
     try {
       GenerateStringAt(receiver, position, 'String.prototype.charCodeAt')
           otherwise IfInBounds, IfOutOfBounds;
     }
-    label IfInBounds(string: String, index: intptr, _length: intptr) {
+    label IfInBounds(string: String, index: uintptr, _length: uintptr) {
       const code: int32 = StringCharCodeAt(string, index);
       return Convert<Smi>(code);
     }
@@ -105,15 +129,17 @@ namespace string {
 
   // ES6 #sec-string.prototype.codepointat
   transitioning javascript builtin StringPrototypeCodePointAt(
-      js-implicit context: Context, receiver: JSAny)(position: JSAny): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(position: JSAny): JSAny {
     try {
       GenerateStringAt(receiver, position, 'String.prototype.codePointAt')
           otherwise IfInBounds, IfOutOfBounds;
     }
-    label IfInBounds(string: String, index: intptr, length: intptr) {
+    label IfInBounds(string: String, index: uintptr, length: uintptr) {
       // This is always a call to a builtin from Javascript, so we need to
       // produce UTF32.
-      const code: int32 = LoadSurrogatePairAt(string, length, index, UTF32);
+      const code: int32 = LoadSurrogatePairAt(
+          string, Signed(length), Signed(index), UnicodeEncoding::UTF32);
       return Convert<Smi>(code);
     }
     label IfOutOfBounds {
@@ -124,14 +150,15 @@ namespace string {
   // ES6 String.prototype.concat(...args)
   // ES6 #sec-string.prototype.concat
   transitioning javascript builtin StringPrototypeConcat(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     // Check that {receiver} is coercible to Object and convert it to a String.
     let string: String = ToThisString(receiver, 'String.prototype.concat');
 
     // Concatenate all the arguments passed to this builtin.
     const length: intptr = Convert<intptr>(arguments.length);
     for (let i: intptr = 0; i < length; i++) {
-      const temp: String = ToString_Inline(context, arguments[i]);
+      const temp: String = ToString_Inline(arguments[i]);
       string = string + temp;
     }
     return string;
@@ -143,7 +170,7 @@ namespace string {
   // ES #sec-string-constructor
   // https://tc39.github.io/ecma262/#sec-string-constructor
   transitioning javascript builtin StringConstructor(
-      js-implicit context: Context, receiver: JSAny, newTarget: JSAny,
+      js-implicit context: NativeContext, receiver: JSAny, newTarget: JSAny,
       target: JSFunction)(...arguments): JSAny {
     const length: intptr = Convert<intptr>(arguments.length);
     let s: String;
@@ -164,7 +191,7 @@ namespace string {
         }
       }
       // 2. b. Let s be ? ToString(value).
-      s = ToString_Inline(context, arguments[0]);
+      s = ToString_Inline(arguments[0]);
     }
     // 3. If NewTarget is undefined, return s.
     if (newTarget == Undefined) {
@@ -190,7 +217,7 @@ namespace string {
   }
 
   builtin StringCharAt(implicit context: Context)(
-      receiver: String, position: intptr): String {
+      receiver: String, position: uintptr): String {
     // Load the character code at the {position} from the {receiver}.
     const code: int32 = StringCharCodeAt(receiver, position);
     // And return the single character string with only that {code}
diff --git a/deps/v8/src/builtins/builtins-symbol-gen.cc b/deps/v8/src/builtins/builtins-symbol-gen.cc
deleted file mode 100644
index cb1ee28501a705..00000000000000
--- a/deps/v8/src/builtins/builtins-symbol-gen.cc
+++ /dev/null
@@ -1,59 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/builtins/builtins-utils-gen.h"
-#include "src/builtins/builtins.h"
-#include "src/codegen/code-stub-assembler.h"
-
-namespace v8 {
-namespace internal {
-
-// -----------------------------------------------------------------------------
-// ES #sec-symbol-objects
-// ES #sec-symbol.prototype.description
-TF_BUILTIN(SymbolPrototypeDescriptionGetter, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-
-  TNode<Symbol> value =
-      CAST(ToThisValue(context, receiver, PrimitiveType::kSymbol,
-                       "Symbol.prototype.description"));
-  TNode<Object> result = LoadObjectField(value, Symbol::kNameOffset);
-  Return(result);
-}
-
-// ES6 #sec-symbol.prototype-@@toprimitive
-TF_BUILTIN(SymbolPrototypeToPrimitive, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-
-  TNode<Object> result = ToThisValue(context, receiver, PrimitiveType::kSymbol,
-                                     "Symbol.prototype [ @@toPrimitive ]");
-  Return(result);
-}
-
-// ES6 #sec-symbol.prototype.tostring
-TF_BUILTIN(SymbolPrototypeToString, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-
-  TNode<Object> value = ToThisValue(context, receiver, PrimitiveType::kSymbol,
-                                    "Symbol.prototype.toString");
-  TNode<Object> result =
-      CallRuntime(Runtime::kSymbolDescriptiveString, context, value);
-  Return(result);
-}
-
-// ES6 #sec-symbol.prototype.valueof
-TF_BUILTIN(SymbolPrototypeValueOf, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-
-  TNode<Object> result = ToThisValue(context, receiver, PrimitiveType::kSymbol,
-                                     "Symbol.prototype.valueOf");
-  Return(result);
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-symbol.cc b/deps/v8/src/builtins/builtins-symbol.cc
index e705aec8b073d4..54db6b79b4ea9a 100644
--- a/deps/v8/src/builtins/builtins-symbol.cc
+++ b/deps/v8/src/builtins/builtins-symbol.cc
@@ -28,7 +28,7 @@ BUILTIN(SymbolConstructor) {
   if (!description->IsUndefined(isolate)) {
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, description,
                                        Object::ToString(isolate, description));
-    result->set_name(*description);
+    result->set_description(String::cast(*description));
   }
   return *result;
 }
@@ -55,7 +55,7 @@ BUILTIN(SymbolKeyFor) {
   DisallowHeapAllocation no_gc;
   Object result;
   if (symbol->is_in_public_symbol_table()) {
-    result = symbol->name();
+    result = symbol->description();
     DCHECK(result.IsString());
   } else {
     result = ReadOnlyRoots(isolate).undefined_value();
diff --git a/deps/v8/src/builtins/builtins-typed-array-gen.cc b/deps/v8/src/builtins/builtins-typed-array-gen.cc
index c69034e813b1c8..23339fa1c8fa45 100644
--- a/deps/v8/src/builtins/builtins-typed-array-gen.cc
+++ b/deps/v8/src/builtins/builtins-typed-array-gen.cc
@@ -51,25 +51,26 @@ TNode<JSArrayBuffer> TypedArrayBuiltinsAssembler::AllocateEmptyOnHeapBuffer(
   //  - Set IsExternal and IsDetachable bits of BitFieldSlot.
   //  - Set the byte_length field to byte_length.
   //  - Set backing_store to null/Smi(0).
+  //  - Set extension to null.
   //  - Set all embedder fields to Smi(0).
   if (FIELD_SIZE(JSArrayBuffer::kOptionalPaddingOffset) != 0) {
     DCHECK_EQ(4, FIELD_SIZE(JSArrayBuffer::kOptionalPaddingOffset));
     StoreObjectFieldNoWriteBarrier(
-        buffer, JSArrayBuffer::kOptionalPaddingOffset, Int32Constant(0),
-        MachineRepresentation::kWord32);
+        buffer, JSArrayBuffer::kOptionalPaddingOffset, Int32Constant(0));
   }
   int32_t bitfield_value = (1 << JSArrayBuffer::IsExternalBit::kShift) |
                            (1 << JSArrayBuffer::IsDetachableBit::kShift);
   StoreObjectFieldNoWriteBarrier(buffer, JSArrayBuffer::kBitFieldOffset,
-                                 Int32Constant(bitfield_value),
-                                 MachineRepresentation::kWord32);
+                                 Int32Constant(bitfield_value));
 
   StoreObjectFieldNoWriteBarrier(buffer, JSArrayBuffer::kByteLengthOffset,
-                                 byte_length,
-                                 MachineType::PointerRepresentation());
+                                 byte_length);
   StoreObjectFieldNoWriteBarrier(buffer, JSArrayBuffer::kBackingStoreOffset,
-                                 IntPtrConstant(0),
-                                 MachineType::PointerRepresentation());
+                                 IntPtrConstant(0));
+  if (V8_ARRAY_BUFFER_EXTENSION_BOOL) {
+    StoreObjectFieldNoWriteBarrier(buffer, JSArrayBuffer::kExtensionOffset,
+                                   IntPtrConstant(0));
+  }
   for (int offset = JSArrayBuffer::kHeaderSize;
        offset < JSArrayBuffer::kSizeWithEmbedderFields; offset += kTaggedSize) {
     StoreObjectFieldNoWriteBarrier(buffer, offset, SmiConstant(0));
@@ -168,19 +169,19 @@ TF_BUILTIN(TypedArrayPrototypeLength, TypedArrayBuiltinsAssembler) {
 }
 
 TNode<BoolT> TypedArrayBuiltinsAssembler::IsUint8ElementsKind(
-    TNode<Word32T> kind) {
+    TNode<Int32T> kind) {
   return Word32Or(Word32Equal(kind, Int32Constant(UINT8_ELEMENTS)),
                   Word32Equal(kind, Int32Constant(UINT8_CLAMPED_ELEMENTS)));
 }
 
 TNode<BoolT> TypedArrayBuiltinsAssembler::IsBigInt64ElementsKind(
-    TNode<Word32T> kind) {
-  return Word32Or(Word32Equal(kind, Int32Constant(BIGINT64_ELEMENTS)),
-                  Word32Equal(kind, Int32Constant(BIGUINT64_ELEMENTS)));
+    TNode<Int32T> kind) {
+  STATIC_ASSERT(BIGUINT64_ELEMENTS + 1 == BIGINT64_ELEMENTS);
+  return IsElementsKindInRange(kind, BIGUINT64_ELEMENTS, BIGINT64_ELEMENTS);
 }
 
 TNode<IntPtrT> TypedArrayBuiltinsAssembler::GetTypedArrayElementSize(
-    TNode<Word32T> elements_kind) {
+    TNode<Int32T> elements_kind) {
   TVARIABLE(IntPtrT, element_size);
 
   DispatchTypedArrayByElementsKind(
@@ -231,36 +232,6 @@ TNode<JSFunction> TypedArrayBuiltinsAssembler::GetDefaultConstructor(
       LoadContextElement(LoadNativeContext(context), context_slot.value()));
 }
 
-TNode<JSTypedArray> TypedArrayBuiltinsAssembler::TypedArrayCreateByLength(
-    TNode<Context> context, TNode<Object> constructor, TNode<Smi> len,
-    const char* method_name) {
-  CSA_ASSERT(this, TaggedIsPositiveSmi(len));
-
-  // Let newTypedArray be ? Construct(constructor, argumentList).
-  TNode<Object> new_object = CAST(ConstructJS(CodeFactory::Construct(isolate()),
-                                              context, constructor, len));
-
-  // Perform ? ValidateTypedArray(newTypedArray).
-  TNode<JSTypedArray> new_typed_array =
-      ValidateTypedArray(context, new_object, method_name);
-
-  ThrowIfLengthLessThan(context, new_typed_array, len);
-  return new_typed_array;
-}
-
-void TypedArrayBuiltinsAssembler::ThrowIfLengthLessThan(
-    TNode<Context> context, TNode<JSTypedArray> typed_array,
-    TNode<Smi> min_length) {
-  // If typed_array.[[ArrayLength]] < min_length, throw a TypeError exception.
-  Label if_length_is_not_short(this);
-  TNode<UintPtrT> new_length = LoadJSTypedArrayLength(typed_array);
-  GotoIfNot(UintPtrLessThan(new_length, SmiUntag(min_length)),
-            &if_length_is_not_short);
-  ThrowTypeError(context, MessageTemplate::kTypedArrayTooShort);
-
-  BIND(&if_length_is_not_short);
-}
-
 TNode<JSArrayBuffer> TypedArrayBuiltinsAssembler::GetBuffer(
     TNode<Context> context, TNode<JSTypedArray> array) {
   Label call_runtime(this), done(this);
@@ -294,127 +265,6 @@ TNode<JSTypedArray> TypedArrayBuiltinsAssembler::ValidateTypedArray(
   return CAST(obj);
 }
 
-void TypedArrayBuiltinsAssembler::SetTypedArraySource(
-    TNode<Context> context, TNode<JSTypedArray> source,
-    TNode<JSTypedArray> target, TNode<IntPtrT> offset, Label* call_runtime,
-    Label* if_source_too_large) {
-  CSA_ASSERT(this, Word32BinaryNot(
-                       IsDetachedBuffer(LoadJSArrayBufferViewBuffer(source))));
-  CSA_ASSERT(this, Word32BinaryNot(
-                       IsDetachedBuffer(LoadJSArrayBufferViewBuffer(target))));
-  CSA_ASSERT(this, IntPtrGreaterThanOrEqual(offset, IntPtrConstant(0)));
-  CSA_ASSERT(this,
-             IntPtrLessThanOrEqual(offset, IntPtrConstant(Smi::kMaxValue)));
-
-  // Check for possible range errors.
-
-  TNode<IntPtrT> source_length = Signed(LoadJSTypedArrayLength(source));
-  TNode<IntPtrT> target_length = Signed(LoadJSTypedArrayLength(target));
-  TNode<IntPtrT> required_target_length = IntPtrAdd(source_length, offset);
-
-  GotoIf(IntPtrGreaterThan(required_target_length, target_length),
-         if_source_too_large);
-
-  // Grab pointers and byte lengths we need later on.
-
-  TNode<RawPtrT> target_data_ptr = LoadJSTypedArrayDataPtr(target);
-  TNode<RawPtrT> source_data_ptr = LoadJSTypedArrayDataPtr(source);
-
-  TNode<Int32T> source_el_kind = LoadElementsKind(source);
-  TNode<Int32T> target_el_kind = LoadElementsKind(target);
-
-  TNode<IntPtrT> source_el_size = GetTypedArrayElementSize(source_el_kind);
-  TNode<IntPtrT> target_el_size = GetTypedArrayElementSize(target_el_kind);
-
-  // A note on byte lengths: both source- and target byte lengths must be valid,
-  // i.e. it must be possible to allocate an array of the given length. That
-  // means we're safe from overflows in the following multiplication.
-  TNode<IntPtrT> source_byte_length = IntPtrMul(source_length, source_el_size);
-  CSA_ASSERT(this,
-             UintPtrGreaterThanOrEqual(source_byte_length, IntPtrConstant(0)));
-
-  Label call_memmove(this), fast_c_call(this), out(this), exception(this);
-
-  // A fast memmove call can be used when the source and target types are are
-  // the same or either Uint8 or Uint8Clamped.
-  GotoIf(Word32Equal(source_el_kind, target_el_kind), &call_memmove);
-  GotoIfNot(IsUint8ElementsKind(source_el_kind), &fast_c_call);
-  Branch(IsUint8ElementsKind(target_el_kind), &call_memmove, &fast_c_call);
-
-  BIND(&call_memmove);
-  {
-    TNode<RawPtrT> target_start =
-        RawPtrAdd(target_data_ptr, IntPtrMul(offset, target_el_size));
-    CallCMemmove(target_start, source_data_ptr, Unsigned(source_byte_length));
-    Goto(&out);
-  }
-
-  BIND(&fast_c_call);
-  {
-    CSA_ASSERT(
-        this, UintPtrGreaterThanOrEqual(
-                  IntPtrMul(target_length, target_el_size), IntPtrConstant(0)));
-
-    GotoIf(Word32NotEqual(IsBigInt64ElementsKind(source_el_kind),
-                          IsBigInt64ElementsKind(target_el_kind)),
-           &exception);
-
-    TNode<IntPtrT> source_length = Signed(LoadJSTypedArrayLength(source));
-    CallCCopyTypedArrayElementsToTypedArray(source, target, source_length,
-                                            offset);
-    Goto(&out);
-  }
-
-  BIND(&exception);
-  ThrowTypeError(context, MessageTemplate::kBigIntMixedTypes);
-
-  BIND(&out);
-}
-
-void TypedArrayBuiltinsAssembler::SetJSArraySource(
-    TNode<Context> context, TNode<JSArray> source, TNode<JSTypedArray> target,
-    TNode<IntPtrT> offset, Label* call_runtime, Label* if_source_too_large) {
-  CSA_ASSERT(this, IsFastJSArray(source, context));
-  CSA_ASSERT(this, IntPtrGreaterThanOrEqual(offset, IntPtrConstant(0)));
-  CSA_ASSERT(this,
-             IntPtrLessThanOrEqual(offset, IntPtrConstant(Smi::kMaxValue)));
-
-  TNode<IntPtrT> source_length = SmiUntag(LoadFastJSArrayLength(source));
-  TNode<IntPtrT> target_length = Signed(LoadJSTypedArrayLength(target));
-
-  // Maybe out of bounds?
-  GotoIf(IntPtrGreaterThan(IntPtrAdd(source_length, offset), target_length),
-         if_source_too_large);
-
-  // Nothing to do if {source} is empty.
-  Label out(this), fast_c_call(this);
-  GotoIf(IntPtrEqual(source_length, IntPtrConstant(0)), &out);
-
-  // Dispatch based on the source elements kind.
-  {
-    // These are the supported elements kinds in TryCopyElementsFastNumber.
-    int32_t values[] = {
-        PACKED_SMI_ELEMENTS, HOLEY_SMI_ELEMENTS, PACKED_DOUBLE_ELEMENTS,
-        HOLEY_DOUBLE_ELEMENTS,
-    };
-    Label* labels[] = {
-        &fast_c_call, &fast_c_call, &fast_c_call, &fast_c_call,
-    };
-    STATIC_ASSERT(arraysize(values) == arraysize(labels));
-
-    TNode<Int32T> source_elements_kind = LoadElementsKind(source);
-    Switch(source_elements_kind, call_runtime, values, labels,
-           arraysize(values));
-  }
-
-  BIND(&fast_c_call);
-  GotoIf(IsBigInt64ElementsKind(LoadElementsKind(target)), call_runtime);
-  CallCCopyFastNumberJSArrayElementsToTypedArray(context, source, target,
-                                                 source_length, offset);
-  Goto(&out);
-  BIND(&out);
-}
-
 void TypedArrayBuiltinsAssembler::CallCMemmove(TNode<RawPtrT> dest_ptr,
                                                TNode<RawPtrT> src_ptr,
                                                TNode<UintPtrT> byte_length) {
@@ -449,11 +299,9 @@ void TypedArrayBuiltinsAssembler::CallCMemset(TNode<RawPtrT> dest_ptr,
 }
 
 void TypedArrayBuiltinsAssembler::
-    CallCCopyFastNumberJSArrayElementsToTypedArray(TNode<Context> context,
-                                                   TNode<JSArray> source,
-                                                   TNode<JSTypedArray> dest,
-                                                   TNode<IntPtrT> source_length,
-                                                   TNode<IntPtrT> offset) {
+    CallCCopyFastNumberJSArrayElementsToTypedArray(
+        TNode<Context> context, TNode<JSArray> source, TNode<JSTypedArray> dest,
+        TNode<UintPtrT> source_length, TNode<UintPtrT> offset) {
   CSA_ASSERT(this,
              Word32BinaryNot(IsBigInt64ElementsKind(LoadElementsKind(dest))));
   TNode<ExternalReference> f = ExternalConstant(
@@ -468,7 +316,7 @@ void TypedArrayBuiltinsAssembler::
 
 void TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsToTypedArray(
     TNode<JSTypedArray> source, TNode<JSTypedArray> dest,
-    TNode<IntPtrT> source_length, TNode<IntPtrT> offset) {
+    TNode<UintPtrT> source_length, TNode<UintPtrT> offset) {
   TNode<ExternalReference> f = ExternalConstant(
       ExternalReference::copy_typed_array_elements_to_typed_array());
   CallCFunction(f, MachineType::AnyTagged(),
@@ -479,8 +327,8 @@ void TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsToTypedArray(
 }
 
 void TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsSlice(
-    TNode<JSTypedArray> source, TNode<JSTypedArray> dest, TNode<IntPtrT> start,
-    TNode<IntPtrT> end) {
+    TNode<JSTypedArray> source, TNode<JSTypedArray> dest, TNode<UintPtrT> start,
+    TNode<UintPtrT> end) {
   TNode<ExternalReference> f =
       ExternalConstant(ExternalReference::copy_typed_array_elements_slice());
   CallCFunction(f, MachineType::AnyTagged(),
@@ -546,7 +394,7 @@ void TypedArrayBuiltinsAssembler::SetJSTypedArrayOnHeapDataPtr(
     TNode<Int32T> compressed_base = TruncateIntPtrToInt32(full_base);
     // TODO(v8:9706): Add a way to directly use kRootRegister value.
     TNode<IntPtrT> isolate_root =
-        IntPtrSub(full_base, ChangeInt32ToIntPtr(compressed_base));
+        IntPtrSub(full_base, Signed(ChangeUint32ToWord(compressed_base)));
     // Add JSTypedArray::ExternalPointerCompensationForOnHeapArray() to offset.
     DCHECK_EQ(
         isolate()->isolate_root(),
@@ -570,9 +418,9 @@ void TypedArrayBuiltinsAssembler::SetJSTypedArrayOffHeapDataPtr(
       holder, JSTypedArray::kExternalPointerOffset, base);
 }
 
-void TypedArrayBuiltinsAssembler::StoreJSTypedArrayElementFromTagged(
+void TypedArrayBuiltinsAssembler::StoreJSTypedArrayElementFromNumeric(
     TNode<Context> context, TNode<JSTypedArray> typed_array,
-    TNode<Smi> index_node, TNode<Object> value, ElementsKind elements_kind) {
+    TNode<UintPtrT> index, TNode<Numeric> value, ElementsKind elements_kind) {
   TNode<RawPtrT> data_ptr = LoadJSTypedArrayDataPtr(typed_array);
   switch (elements_kind) {
     case UINT8_ELEMENTS:
@@ -580,109 +428,46 @@ void TypedArrayBuiltinsAssembler::StoreJSTypedArrayElementFromTagged(
     case INT8_ELEMENTS:
     case UINT16_ELEMENTS:
     case INT16_ELEMENTS:
-      StoreElement(data_ptr, elements_kind, index_node, SmiToInt32(CAST(value)),
-                   SMI_PARAMETERS);
+      StoreElement(data_ptr, elements_kind, index, SmiToInt32(CAST(value)));
       break;
     case UINT32_ELEMENTS:
     case INT32_ELEMENTS:
-      StoreElement(data_ptr, elements_kind, index_node,
-                   TruncateTaggedToWord32(context, value), SMI_PARAMETERS);
+      StoreElement(data_ptr, elements_kind, index,
+                   TruncateTaggedToWord32(context, value));
       break;
     case FLOAT32_ELEMENTS:
-      StoreElement(data_ptr, elements_kind, index_node,
-                   TruncateFloat64ToFloat32(LoadHeapNumberValue(CAST(value))),
-                   SMI_PARAMETERS);
+      StoreElement(data_ptr, elements_kind, index,
+                   TruncateFloat64ToFloat32(LoadHeapNumberValue(CAST(value))));
       break;
     case FLOAT64_ELEMENTS:
-      StoreElement(data_ptr, elements_kind, index_node,
-                   LoadHeapNumberValue(CAST(value)), SMI_PARAMETERS);
+      StoreElement(data_ptr, elements_kind, index,
+                   LoadHeapNumberValue(CAST(value)));
       break;
     case BIGUINT64_ELEMENTS:
     case BIGINT64_ELEMENTS:
-      StoreElement(data_ptr, elements_kind, index_node,
-                   UncheckedCast<BigInt>(value), SMI_PARAMETERS);
+      StoreElement(data_ptr, elements_kind, index,
+                   UncheckedCast<BigInt>(value));
       break;
     default:
       UNREACHABLE();
   }
 }
 
-// ES #sec-get-%typedarray%.prototype.set
-TF_BUILTIN(TypedArrayPrototypeSet, TypedArrayBuiltinsAssembler) {
-  const char* method_name = "%TypedArray%.prototype.set";
-  TNode<Int32T> argc =
-      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  CodeStubArguments args(this, argc);
-
-  Label if_source_is_typed_array(this), if_source_is_fast_jsarray(this),
-      if_offset_is_out_of_bounds(this, Label::kDeferred),
-      if_source_too_large(this, Label::kDeferred),
-      if_receiver_is_not_typedarray(this, Label::kDeferred);
-
-  // Check the receiver is a typed array.
-  TNode<Object> receiver = args.GetReceiver();
-  GotoIf(TaggedIsSmi(receiver), &if_receiver_is_not_typedarray);
-  GotoIfNot(IsJSTypedArray(CAST(receiver)), &if_receiver_is_not_typedarray);
-
-  // Normalize offset argument (using ToInteger) and handle heap number cases.
-  TNode<Object> offset = args.GetOptionalArgumentValue(1, SmiConstant(0));
-  TNode<Number> offset_num =
-      ToInteger_Inline(context, offset, kTruncateMinusZero);
-
-  // Since ToInteger always returns a Smi if the given value is within Smi
-  // range, and the only corner case of -0.0 has already been truncated to 0.0,
-  // we can simply throw unless the offset is a non-negative Smi.
-  // TODO(jgruber): It's an observable spec violation to throw here if
-  // {offset_num} is a positive number outside the Smi range. Per spec, we need
-  // to check for detached buffers and call the observable ToObject/ToLength
-  // operations first.
-  GotoIfNot(TaggedIsPositiveSmi(offset_num), &if_offset_is_out_of_bounds);
-  TNode<Smi> offset_smi = CAST(offset_num);
-
-  // Check the receiver is not detached.
-  ThrowIfArrayBufferViewBufferIsDetached(context, CAST(receiver), method_name);
-
-  // Check the source argument is valid and whether a fast path can be taken.
-  Label call_runtime(this);
-  TNode<Object> source = args.GetOptionalArgumentValue(0);
-  GotoIf(TaggedIsSmi(source), &call_runtime);
-  GotoIf(IsJSTypedArray(CAST(source)), &if_source_is_typed_array);
-  BranchIfFastJSArray(source, context, &if_source_is_fast_jsarray,
-                      &call_runtime);
-
-  // Fast path for a typed array source argument.
-  BIND(&if_source_is_typed_array);
-  {
-    // Check the source argument is not detached.
-    ThrowIfArrayBufferViewBufferIsDetached(context, CAST(source), method_name);
-
-    SetTypedArraySource(context, CAST(source), CAST(receiver),
-                        SmiUntag(offset_smi), &call_runtime,
-                        &if_source_too_large);
-    args.PopAndReturn(UndefinedConstant());
-  }
-
-  // Fast path for a fast JSArray source argument.
-  BIND(&if_source_is_fast_jsarray);
-  {
-    SetJSArraySource(context, CAST(source), CAST(receiver),
-                     SmiUntag(offset_smi), &call_runtime, &if_source_too_large);
-    args.PopAndReturn(UndefinedConstant());
-  }
-
-  BIND(&call_runtime);
-  args.PopAndReturn(CallRuntime(Runtime::kTypedArraySet, context, receiver,
-                                source, offset_smi));
-
-  BIND(&if_offset_is_out_of_bounds);
-  ThrowRangeError(context, MessageTemplate::kTypedArraySetOffsetOutOfBounds);
+void TypedArrayBuiltinsAssembler::StoreJSTypedArrayElementFromTagged(
+    TNode<Context> context, TNode<JSTypedArray> typed_array,
+    TNode<UintPtrT> index, TNode<Object> value, ElementsKind elements_kind,
+    Label* if_detached) {
+  // |prepared_value| is Word32T or Float64T or Float32T or BigInt.
+  Node* prepared_value =
+      PrepareValueForWriteToTypedArray(value, elements_kind, context);
 
-  BIND(&if_source_too_large);
-  ThrowRangeError(context, MessageTemplate::kTypedArraySetSourceTooLarge);
+  // ToNumber/ToBigInt may execute JavaScript code, which could detach
+  // the array's buffer.
+  TNode<JSArrayBuffer> buffer = LoadJSArrayBufferViewBuffer(typed_array);
+  GotoIf(IsDetachedBuffer(buffer), if_detached);
 
-  BIND(&if_receiver_is_not_typedarray);
-  ThrowTypeError(context, MessageTemplate::kNotTypedArray);
+  TNode<RawPtrT> data_ptr = LoadJSTypedArrayDataPtr(typed_array);
+  StoreElement(data_ptr, elements_kind, index, prepared_value);
 }
 
 // ES #sec-get-%typedarray%.prototype-@@tostringtag
@@ -771,298 +556,5 @@ TF_BUILTIN(TypedArrayPrototypeKeys, TypedArrayBuiltinsAssembler) {
       context, receiver, "%TypedArray%.prototype.keys()", IterationKind::kKeys);
 }
 
-// ES6 #sec-%typedarray%.of
-TF_BUILTIN(TypedArrayOf, TypedArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  // 1. Let len be the actual number of arguments passed to this function.
-  TNode<IntPtrT> length = ChangeInt32ToIntPtr(
-      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount)));
-  // 2. Let items be the List of arguments passed to this function.
-  CodeStubArguments args(this, length);
-
-  Label if_not_constructor(this, Label::kDeferred),
-      if_detached(this, Label::kDeferred);
-
-  // 3. Let C be the this value.
-  // 4. If IsConstructor(C) is false, throw a TypeError exception.
-  TNode<Object> receiver = args.GetReceiver();
-  GotoIf(TaggedIsSmi(receiver), &if_not_constructor);
-  GotoIfNot(IsConstructor(CAST(receiver)), &if_not_constructor);
-
-  // 5. Let newObj be ? TypedArrayCreate(C, len).
-  TNode<JSTypedArray> new_typed_array = TypedArrayCreateByLength(
-      context, receiver, SmiTag(length), "%TypedArray%.of");
-
-  TNode<Int32T> elements_kind = LoadElementsKind(new_typed_array);
-
-  // 6. Let k be 0.
-  // 7. Repeat, while k < len
-  //  a. Let kValue be items[k].
-  //  b. Let Pk be ! ToString(k).
-  //  c. Perform ? Set(newObj, Pk, kValue, true).
-  //  d. Increase k by 1.
-  DispatchTypedArrayByElementsKind(
-      elements_kind,
-      [&](ElementsKind kind, int size, int typed_array_fun_index) {
-        BuildFastLoop<IntPtrT>(
-            IntPtrConstant(0), length,
-            [&](TNode<IntPtrT> index) {
-              TNode<Object> item = args.AtIndex(index);
-              Node* value =
-                  PrepareValueForWriteToTypedArray(item, kind, context);
-
-              // ToNumber/ToBigInt may execute JavaScript code, which could
-              // detach the array's buffer.
-              TNode<JSArrayBuffer> buffer =
-                  LoadJSArrayBufferViewBuffer(new_typed_array);
-              GotoIf(IsDetachedBuffer(buffer), &if_detached);
-
-              // GC may move backing store in ToNumber, thus load backing
-              // store everytime in this loop.
-              TNode<RawPtrT> data_ptr =
-                  LoadJSTypedArrayDataPtr(new_typed_array);
-              StoreElement(data_ptr, kind, index, value, INTPTR_PARAMETERS);
-            },
-            1, IndexAdvanceMode::kPost);
-      });
-
-  // 8. Return newObj.
-  args.PopAndReturn(new_typed_array);
-
-  BIND(&if_not_constructor);
-  ThrowTypeError(context, MessageTemplate::kNotConstructor, receiver);
-
-  BIND(&if_detached);
-  ThrowTypeError(context, MessageTemplate::kDetachedOperation,
-                 "%TypedArray%.of");
-}
-
-// ES6 #sec-%typedarray%.from
-TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
-  TNode<Int32T> argc =
-      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  Label check_iterator(this), from_array_like(this), fast_path(this),
-      slow_path(this), create_typed_array(this), check_typedarray(this),
-      if_not_constructor(this, Label::kDeferred),
-      if_map_fn_not_callable(this, Label::kDeferred),
-      if_iterator_fn_not_callable(this, Label::kDeferred),
-      if_detached(this, Label::kDeferred);
-
-  CodeStubArguments args(this, argc);
-  TNode<Object> source = args.GetOptionalArgumentValue(0);
-
-  // 5. If thisArg is present, let T be thisArg; else let T be undefined.
-  TNode<Object> this_arg = args.GetOptionalArgumentValue(2);
-
-  // 1. Let C be the this value.
-  // 2. If IsConstructor(C) is false, throw a TypeError exception.
-  TNode<Object> receiver = args.GetReceiver();
-  GotoIf(TaggedIsSmi(receiver), &if_not_constructor);
-  GotoIfNot(IsConstructor(CAST(receiver)), &if_not_constructor);
-
-  // 3. If mapfn is present and mapfn is not undefined, then
-  TNode<Object> map_fn = args.GetOptionalArgumentValue(1);
-  TVARIABLE(BoolT, mapping, Int32FalseConstant());
-  GotoIf(IsUndefined(map_fn), &check_typedarray);
-
-  //  a. If IsCallable(mapfn) is false, throw a TypeError exception.
-  //  b. Let mapping be true.
-  // 4. Else, let mapping be false.
-  GotoIf(TaggedIsSmi(map_fn), &if_map_fn_not_callable);
-  GotoIfNot(IsCallable(CAST(map_fn)), &if_map_fn_not_callable);
-  mapping = Int32TrueConstant();
-  Goto(&check_typedarray);
-
-  TVARIABLE(Object, final_source);
-  TVARIABLE(Smi, final_length);
-
-  // We split up this builtin differently to the way it is written in the spec.
-  // We already have great code in the elements accessor for copying from a
-  // JSArray into a TypedArray, so we use that when possible. We only avoid
-  // calling into the elements accessor when we have a mapping function, because
-  // we can't handle that. Here, presence of a mapping function is the slow
-  // path. We also combine the two different loops in the specification
-  // (starting at 7.e and 13) because they are essentially identical. We also
-  // save on code-size this way.
-
-  // Get the iterator function
-  BIND(&check_typedarray);
-  TNode<Object> iterator_fn =
-      CAST(GetMethod(context, source, isolate()->factory()->iterator_symbol(),
-                     &from_array_like));
-  GotoIf(TaggedIsSmi(iterator_fn), &if_iterator_fn_not_callable);
-
-  {
-    // TypedArrays have iterators, so normally we would go through the
-    // IterableToList case below, which would convert the TypedArray to a
-    // JSArray (boxing the values if they won't fit in a Smi).
-    //
-    // However, if we can guarantee that the source object has the built-in
-    // iterator and that the %ArrayIteratorPrototype%.next method has not been
-    // overridden, then we know the behavior of the iterator: returning the
-    // values in the TypedArray sequentially from index 0 to length-1.
-    //
-    // In this case, we can avoid creating the intermediate array and the
-    // associated HeapNumbers, and use the fast path in TypedArrayCopyElements
-    // which uses the same ordering as the default iterator.
-    //
-    // Drop through to the default check_iterator behavior if any of these
-    // checks fail.
-
-    // Check that the source is a TypedArray
-    GotoIf(TaggedIsSmi(source), &check_iterator);
-    GotoIfNot(IsJSTypedArray(CAST(source)), &check_iterator);
-    TNode<JSArrayBuffer> source_buffer =
-        LoadJSArrayBufferViewBuffer(CAST(source));
-    GotoIf(IsDetachedBuffer(source_buffer), &check_iterator);
-
-    // Check that the iterator function is Builtins::kTypedArrayPrototypeValues
-    GotoIfNot(IsJSFunction(CAST(iterator_fn)), &check_iterator);
-    TNode<SharedFunctionInfo> shared_info = LoadObjectField<SharedFunctionInfo>(
-        CAST(iterator_fn), JSFunction::kSharedFunctionInfoOffset);
-    GotoIfNot(
-        TaggedEqual(LoadObjectField(shared_info,
-                                    SharedFunctionInfo::kFunctionDataOffset),
-                    SmiConstant(Builtins::kTypedArrayPrototypeValues)),
-        &check_iterator);
-    // Check that the ArrayIterator prototype's "next" method hasn't been
-    // overridden
-    TNode<PropertyCell> protector_cell = ArrayIteratorProtectorConstant();
-    GotoIfNot(
-        TaggedEqual(LoadObjectField(protector_cell, PropertyCell::kValueOffset),
-                    SmiConstant(Protectors::kProtectorValid)),
-        &check_iterator);
-
-    // Source is a TypedArray with unmodified iterator behavior. Use the
-    // source object directly, taking advantage of the special-case code in
-    // TypedArrayCopyElements
-    // TODO(v8:4153): This needs to be handle to huge TypedArrays.
-    final_length = SmiTag(Signed(LoadJSTypedArrayLength(CAST(source))));
-    final_source = source;
-    Goto(&create_typed_array);
-  }
-
-  BIND(&check_iterator);
-  {
-    // 6. Let usingIterator be ? GetMethod(source, @@iterator).
-    GotoIfNot(IsCallable(CAST(iterator_fn)), &if_iterator_fn_not_callable);
-
-    // We are using the iterator.
-    Label if_length_not_smi(this, Label::kDeferred);
-    // 7. If usingIterator is not undefined, then
-    //  a. Let values be ? IterableToList(source, usingIterator).
-    //  b. Let len be the number of elements in values.
-    TNode<JSArray> values = CAST(
-        CallBuiltin(Builtins::kIterableToList, context, source, iterator_fn));
-
-    // This is not a spec'd limit, so it doesn't particularly matter when we
-    // throw the range error for typed array length > MaxSmi.
-    TNode<Number> raw_length = LoadJSArrayLength(values);
-    GotoIfNot(TaggedIsSmi(raw_length), &if_length_not_smi);
-
-    final_length = CAST(raw_length);
-    final_source = values;
-    Goto(&create_typed_array);
-
-    BIND(&if_length_not_smi);
-    ThrowRangeError(context, MessageTemplate::kInvalidTypedArrayLength,
-                    raw_length);
-  }
-
-  BIND(&from_array_like);
-  {
-    // TODO(7881): support larger-than-smi typed array lengths
-    Label if_length_not_smi(this, Label::kDeferred);
-    final_source = source;
-
-    // 10. Let len be ? ToLength(? Get(arrayLike, "length")).
-    TNode<Object> raw_length =
-        GetProperty(context, final_source.value(), LengthStringConstant());
-    final_length = ToSmiLength(context, raw_length, &if_length_not_smi);
-    Goto(&create_typed_array);
-
-    BIND(&if_length_not_smi);
-    ThrowRangeError(context, MessageTemplate::kInvalidTypedArrayLength,
-                    raw_length);
-  }
-
-  TVARIABLE(JSTypedArray, target_obj);
-
-  BIND(&create_typed_array);
-  {
-    // 7c/11. Let targetObj be ? TypedArrayCreate(C, «len»).
-    target_obj = TypedArrayCreateByLength(
-        context, receiver, final_length.value(), "%TypedArray%.from");
-
-    Branch(mapping.value(), &slow_path, &fast_path);
-  }
-
-  BIND(&fast_path);
-  {
-    Label done(this);
-    GotoIf(SmiEqual(final_length.value(), SmiConstant(0)), &done);
-
-    CallRuntime(Runtime::kTypedArrayCopyElements, context, target_obj.value(),
-                final_source.value(), final_length.value());
-    Goto(&done);
-
-    BIND(&done);
-    args.PopAndReturn(target_obj.value());
-  }
-
-  BIND(&slow_path);
-  TNode<Int32T> elements_kind = LoadElementsKind(target_obj.value());
-
-  // 7e/13 : Copy the elements
-  BuildFastLoop<Smi>(
-      SmiConstant(0), final_length.value(),
-      [&](TNode<Smi> index) {
-        TNode<Object> const k_value =
-            GetProperty(context, final_source.value(), index);
-
-        TNode<Object> const mapped_value =
-            CallJS(CodeFactory::Call(isolate()), context, map_fn, this_arg,
-                   k_value, index);
-
-        DispatchTypedArrayByElementsKind(
-            elements_kind,
-            [&](ElementsKind kind, int size, int typed_array_fun_index) {
-              Node* const final_value =
-                  PrepareValueForWriteToTypedArray(mapped_value, kind, context);
-
-              // ToNumber/ToBigInt may execute JavaScript code, which could
-              // detach the array's buffer.
-              TNode<JSArrayBuffer> buffer =
-                  LoadJSArrayBufferViewBuffer(target_obj.value());
-              GotoIf(IsDetachedBuffer(buffer), &if_detached);
-
-              // GC may move backing store in map_fn, thus load backing
-              // store in each iteration of this loop.
-              TNode<RawPtrT> data_ptr =
-                  LoadJSTypedArrayDataPtr(target_obj.value());
-              StoreElement(data_ptr, kind, index, final_value, SMI_PARAMETERS);
-            });
-      },
-      1, IndexAdvanceMode::kPost);
-
-  args.PopAndReturn(target_obj.value());
-
-  BIND(&if_not_constructor);
-  ThrowTypeError(context, MessageTemplate::kNotConstructor, receiver);
-
-  BIND(&if_map_fn_not_callable);
-  ThrowTypeError(context, MessageTemplate::kCalledNonCallable, map_fn);
-
-  BIND(&if_iterator_fn_not_callable);
-  ThrowTypeError(context, MessageTemplate::kIteratorSymbolNonCallable);
-
-  BIND(&if_detached);
-  ThrowTypeError(context, MessageTemplate::kDetachedOperation,
-                 "%TypedArray%.from");
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-typed-array-gen.h b/deps/v8/src/builtins/builtins-typed-array-gen.h
index 10a2cb608c6139..742402059649aa 100644
--- a/deps/v8/src/builtins/builtins-typed-array-gen.h
+++ b/deps/v8/src/builtins/builtins-typed-array-gen.h
@@ -16,12 +16,6 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
   explicit TypedArrayBuiltinsAssembler(compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state) {}
 
-  template <class... TArgs>
-  TNode<JSTypedArray> TypedArraySpeciesCreate(const char* method_name,
-                                              TNode<Context> context,
-                                              TNode<JSTypedArray> exemplar,
-                                              TArgs... args);
-
   void GenerateTypedArrayPrototypeIterationMethod(TNode<Context> context,
                                                   TNode<Object> receiver,
                                                   const char* method_name,
@@ -41,13 +35,13 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
                                            TNode<UintPtrT> byte_offset);
 
   // Returns true if kind is either UINT8_ELEMENTS or UINT8_CLAMPED_ELEMENTS.
-  TNode<BoolT> IsUint8ElementsKind(TNode<Word32T> kind);
+  TNode<BoolT> IsUint8ElementsKind(TNode<Int32T> kind);
 
   // Returns true if kind is either BIGINT64_ELEMENTS or BIGUINT64_ELEMENTS.
-  TNode<BoolT> IsBigInt64ElementsKind(TNode<Word32T> kind);
+  TNode<BoolT> IsBigInt64ElementsKind(TNode<Int32T> kind);
 
   // Returns the byte size of an element for a TypedArray elements kind.
-  TNode<IntPtrT> GetTypedArrayElementSize(TNode<Word32T> elements_kind);
+  TNode<IntPtrT> GetTypedArrayElementSize(TNode<Int32T> elements_kind);
 
   // Returns information (byte size and map) about a TypedArray's elements.
   ElementsInfo GetTypedArrayElementsInfo(TNode<JSTypedArray> typed_array);
@@ -56,15 +50,6 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
   TNode<JSFunction> GetDefaultConstructor(TNode<Context> context,
                                           TNode<JSTypedArray> exemplar);
 
-  TNode<JSTypedArray> TypedArrayCreateByLength(TNode<Context> context,
-                                               TNode<Object> constructor,
-                                               TNode<Smi> len,
-                                               const char* method_name);
-
-  void ThrowIfLengthLessThan(TNode<Context> context,
-                             TNode<JSTypedArray> typed_array,
-                             TNode<Smi> min_length);
-
   TNode<JSArrayBuffer> GetBuffer(TNode<Context> context,
                                  TNode<JSTypedArray> array);
 
@@ -72,16 +57,6 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
                                          TNode<Object> obj,
                                          const char* method_name);
 
-  // Fast path for setting a TypedArray (source) onto another TypedArray
-  // (target) at an element offset.
-  void SetTypedArraySource(TNode<Context> context, TNode<JSTypedArray> source,
-                           TNode<JSTypedArray> target, TNode<IntPtrT> offset,
-                           Label* call_runtime, Label* if_source_too_large);
-
-  void SetJSArraySource(TNode<Context> context, TNode<JSArray> source,
-                        TNode<JSTypedArray> target, TNode<IntPtrT> offset,
-                        Label* call_runtime, Label* if_source_too_large);
-
   void CallCMemmove(TNode<RawPtrT> dest_ptr, TNode<RawPtrT> src_ptr,
                     TNode<UintPtrT> byte_length);
 
@@ -93,17 +68,17 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
 
   void CallCCopyFastNumberJSArrayElementsToTypedArray(
       TNode<Context> context, TNode<JSArray> source, TNode<JSTypedArray> dest,
-      TNode<IntPtrT> source_length, TNode<IntPtrT> offset);
+      TNode<UintPtrT> source_length, TNode<UintPtrT> offset);
 
   void CallCCopyTypedArrayElementsToTypedArray(TNode<JSTypedArray> source,
                                                TNode<JSTypedArray> dest,
-                                               TNode<IntPtrT> source_length,
-                                               TNode<IntPtrT> offset);
+                                               TNode<UintPtrT> source_length,
+                                               TNode<UintPtrT> offset);
 
   void CallCCopyTypedArrayElementsSlice(TNode<JSTypedArray> source,
                                         TNode<JSTypedArray> dest,
-                                        TNode<IntPtrT> start,
-                                        TNode<IntPtrT> end);
+                                        TNode<UintPtrT> start,
+                                        TNode<UintPtrT> end);
 
   using TypedArraySwitchCase = std::function<void(ElementsKind, int, int)>;
 
@@ -118,11 +93,17 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
   void SetJSTypedArrayOffHeapDataPtr(TNode<JSTypedArray> holder,
                                      TNode<RawPtrT> base,
                                      TNode<UintPtrT> offset);
+  void StoreJSTypedArrayElementFromNumeric(TNode<Context> context,
+                                           TNode<JSTypedArray> typed_array,
+                                           TNode<UintPtrT> index_node,
+                                           TNode<Numeric> value,
+                                           ElementsKind elements_kind);
   void StoreJSTypedArrayElementFromTagged(TNode<Context> context,
                                           TNode<JSTypedArray> typed_array,
-                                          TNode<Smi> index_node,
+                                          TNode<UintPtrT> index_node,
                                           TNode<Object> value,
-                                          ElementsKind elements_kind);
+                                          ElementsKind elements_kind,
+                                          Label* if_detached);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-typed-array.cc b/deps/v8/src/builtins/builtins-typed-array.cc
index 326841bb4af16a..fdadc7a554cbae 100644
--- a/deps/v8/src/builtins/builtins-typed-array.cc
+++ b/deps/v8/src/builtins/builtins-typed-array.cc
@@ -154,9 +154,7 @@ BUILTIN(TypedArrayPrototypeFill) {
   DCHECK_LE(end, len);
   DCHECK_LE(count, len);
 
-  return ElementsAccessor::ForKind(kind)->Fill(array, obj_value,
-                                               static_cast<uint32_t>(start),
-                                               static_cast<uint32_t>(end));
+  return ElementsAccessor::ForKind(kind)->Fill(array, obj_value, start, end);
 }
 
 BUILTIN(TypedArrayPrototypeIncludes) {
@@ -186,9 +184,8 @@ BUILTIN(TypedArrayPrototypeIncludes) {
 
   Handle<Object> search_element = args.atOrUndefined(isolate, 1);
   ElementsAccessor* elements = array->GetElementsAccessor();
-  Maybe<bool> result = elements->IncludesValue(isolate, array, search_element,
-                                               static_cast<uint32_t>(index),
-                                               static_cast<uint32_t>(len));
+  Maybe<bool> result =
+      elements->IncludesValue(isolate, array, search_element, index, len);
   MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return *isolate->factory()->ToBoolean(result.FromJust());
 }
@@ -217,9 +214,8 @@ BUILTIN(TypedArrayPrototypeIndexOf) {
 
   Handle<Object> search_element = args.atOrUndefined(isolate, 1);
   ElementsAccessor* elements = array->GetElementsAccessor();
-  Maybe<int64_t> result = elements->IndexOfValue(isolate, array, search_element,
-                                                 static_cast<uint32_t>(index),
-                                                 static_cast<uint32_t>(len));
+  Maybe<int64_t> result =
+      elements->IndexOfValue(isolate, array, search_element, index, len);
   MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return *isolate->factory()->NewNumberFromInt64(result.FromJust());
 }
@@ -252,8 +248,8 @@ BUILTIN(TypedArrayPrototypeLastIndexOf) {
 
   Handle<Object> search_element = args.atOrUndefined(isolate, 1);
   ElementsAccessor* elements = array->GetElementsAccessor();
-  Maybe<int64_t> result = elements->LastIndexOfValue(
-      array, search_element, static_cast<uint32_t>(index));
+  Maybe<int64_t> result =
+      elements->LastIndexOfValue(array, search_element, index);
   MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return *isolate->factory()->NewNumberFromInt64(result.FromJust());
 }
diff --git a/deps/v8/src/builtins/builtins-wasm-gen.cc b/deps/v8/src/builtins/builtins-wasm-gen.cc
index d6346fb9aa439e..0f5d86e64687f0 100644
--- a/deps/v8/src/builtins/builtins-wasm-gen.cc
+++ b/deps/v8/src/builtins/builtins-wasm-gen.cc
@@ -18,98 +18,49 @@ class WasmBuiltinsAssembler : public CodeStubAssembler {
       : CodeStubAssembler(state) {}
 
  protected:
-  TNode<Object> UncheckedParameter(int index) {
-    return UncheckedCast<Object>(Parameter(index));
-  }
-
-  TNode<Code> LoadBuiltinFromFrame(Builtins::Name id) {
-    TNode<Object> instance = LoadInstanceFromFrame();
-    TNode<IntPtrT> isolate_root = UncheckedCast<IntPtrT>(
-        Load(MachineType::Pointer(), instance,
-             IntPtrConstant(WasmInstanceObject::kIsolateRootOffset -
-                            kHeapObjectTag)));
-    TNode<Code> target = UncheckedCast<Code>(
-        Load(MachineType::TaggedPointer(), isolate_root,
-             IntPtrConstant(IsolateData::builtin_slot_offset(id))));
-    return target;
-  }
-
-  TNode<Object> LoadInstanceFromFrame() {
-    return UncheckedCast<Object>(
+  TNode<WasmInstanceObject> LoadInstanceFromFrame() {
+    return CAST(
         LoadFromParentFrame(WasmCompiledFrameConstants::kWasmInstanceOffset));
   }
 
-  TNode<Object> LoadContextFromInstance(TNode<Object> instance) {
-    return UncheckedCast<Object>(
-        Load(MachineType::AnyTagged(), instance,
-             IntPtrConstant(WasmInstanceObject::kNativeContextOffset -
-                            kHeapObjectTag)));
-  }
-
-  TNode<Code> LoadCEntryFromInstance(TNode<Object> instance) {
-    TNode<IntPtrT> isolate_root = UncheckedCast<IntPtrT>(
-        Load(MachineType::Pointer(), instance,
-             IntPtrConstant(WasmInstanceObject::kIsolateRootOffset -
-                            kHeapObjectTag)));
-    auto centry_id =
-        Builtins::kCEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit;
-    TNode<Code> target = UncheckedCast<Code>(
-        Load(MachineType::TaggedPointer(), isolate_root,
-             IntPtrConstant(IsolateData::builtin_slot_offset(centry_id))));
-    return target;
+  TNode<Context> LoadContextFromInstance(TNode<WasmInstanceObject> instance) {
+    return CAST(Load(MachineType::AnyTagged(), instance,
+                     IntPtrConstant(WasmInstanceObject::kNativeContextOffset -
+                                    kHeapObjectTag)));
   }
 };
 
-TF_BUILTIN(WasmAllocateHeapNumber, WasmBuiltinsAssembler) {
-  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kAllocateHeapNumber);
-  TailCallStub(AllocateHeapNumberDescriptor(), target, NoContextConstant());
-}
-
-TF_BUILTIN(WasmRecordWrite, WasmBuiltinsAssembler) {
-  TNode<Object> object = UncheckedParameter(Descriptor::kObject);
-  TNode<Object> slot = UncheckedParameter(Descriptor::kSlot);
-  TNode<Object> remembered = UncheckedParameter(Descriptor::kRememberedSet);
-  TNode<Object> fp_mode = UncheckedParameter(Descriptor::kFPMode);
-  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kRecordWrite);
-  TailCallStub(RecordWriteDescriptor{}, target, NoContextConstant(), object,
-               slot, remembered, fp_mode);
-}
-
-TF_BUILTIN(WasmToNumber, WasmBuiltinsAssembler) {
-  TNode<Object> context = UncheckedParameter(Descriptor::kContext);
-  TNode<Object> argument = UncheckedParameter(Descriptor::kArgument);
-  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kToNumber);
-  TailCallStub(TypeConversionDescriptor(), target, context, argument);
-}
-
 TF_BUILTIN(WasmStackGuard, WasmBuiltinsAssembler) {
-  TNode<Object> instance = LoadInstanceFromFrame();
-  TNode<Code> centry = LoadCEntryFromInstance(instance);
-  TNode<Object> context = LoadContextFromInstance(instance);
-  TailCallRuntimeWithCEntry(Runtime::kWasmStackGuard, centry, context);
+  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
+  TNode<Context> context = LoadContextFromInstance(instance);
+  TailCallRuntime(Runtime::kWasmStackGuard, context);
 }
 
 TF_BUILTIN(WasmStackOverflow, WasmBuiltinsAssembler) {
-  TNode<Object> instance = LoadInstanceFromFrame();
-  TNode<Code> centry = LoadCEntryFromInstance(instance);
-  TNode<Object> context = LoadContextFromInstance(instance);
-  TailCallRuntimeWithCEntry(Runtime::kThrowWasmStackOverflow, centry, context);
+  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
+  TNode<Context> context = LoadContextFromInstance(instance);
+  TailCallRuntime(Runtime::kThrowWasmStackOverflow, context);
 }
 
 TF_BUILTIN(WasmThrow, WasmBuiltinsAssembler) {
-  TNode<Object> exception = UncheckedParameter(Descriptor::kException);
-  TNode<Object> instance = LoadInstanceFromFrame();
-  TNode<Code> centry = LoadCEntryFromInstance(instance);
-  TNode<Object> context = LoadContextFromInstance(instance);
-  TailCallRuntimeWithCEntry(Runtime::kThrow, centry, context, exception);
+  TNode<Object> exception = CAST(Parameter(Descriptor::kException));
+  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
+  TNode<Context> context = LoadContextFromInstance(instance);
+  TailCallRuntime(Runtime::kThrow, context, exception);
 }
 
 TF_BUILTIN(WasmRethrow, WasmBuiltinsAssembler) {
-  TNode<Object> exception = UncheckedParameter(Descriptor::kException);
-  TNode<Object> instance = LoadInstanceFromFrame();
-  TNode<Code> centry = LoadCEntryFromInstance(instance);
-  TNode<Object> context = LoadContextFromInstance(instance);
-  TailCallRuntimeWithCEntry(Runtime::kReThrow, centry, context, exception);
+  TNode<Object> exception = CAST(Parameter(Descriptor::kException));
+  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
+  TNode<Context> context = LoadContextFromInstance(instance);
+  TailCallRuntime(Runtime::kReThrow, context, exception);
+}
+
+TF_BUILTIN(WasmTraceMemory, WasmBuiltinsAssembler) {
+  TNode<Smi> info = CAST(Parameter(Descriptor::kMemoryTracingInfo));
+  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
+  TNode<Context> context = LoadContextFromInstance(instance);
+  TailCallRuntime(Runtime::kWasmTraceMemory, context, info);
 }
 
 TF_BUILTIN(WasmAtomicNotify, WasmBuiltinsAssembler) {
@@ -117,25 +68,15 @@ TF_BUILTIN(WasmAtomicNotify, WasmBuiltinsAssembler) {
       UncheckedCast<Uint32T>(Parameter(Descriptor::kAddress));
   TNode<Uint32T> count = UncheckedCast<Uint32T>(Parameter(Descriptor::kCount));
 
-  TNode<Object> instance = LoadInstanceFromFrame();
-  TNode<Code> centry = LoadCEntryFromInstance(instance);
-
-  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kAllocateHeapNumber);
-  TNode<Object> context = LoadContextFromInstance(instance);
+  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
+  TNode<Number> address_number = ChangeUint32ToTagged(address);
+  TNode<Number> count_number = ChangeUint32ToTagged(count);
+  TNode<Context> context = LoadContextFromInstance(instance);
 
-  // TODO(aseemgarg): Use SMIs if possible for address and count
-  TNode<HeapNumber> address_heap = UncheckedCast<HeapNumber>(
-      CallStub(AllocateHeapNumberDescriptor(), target, context));
-  StoreHeapNumberValue(address_heap, ChangeUint32ToFloat64(address));
-
-  TNode<HeapNumber> count_heap = UncheckedCast<HeapNumber>(
-      CallStub(AllocateHeapNumberDescriptor(), target, context));
-  StoreHeapNumberValue(count_heap, ChangeUint32ToFloat64(count));
-
-  TNode<Smi> result_smi = UncheckedCast<Smi>(CallRuntimeWithCEntry(
-      Runtime::kWasmAtomicNotify, centry, context, instance,
-      address_heap, count_heap));
-  ReturnRaw(SmiToInt32(result_smi));
+  TNode<Smi> result_smi =
+      CAST(CallRuntime(Runtime::kWasmAtomicNotify, context, instance,
+                       address_number, count_number));
+  Return(Unsigned(SmiToInt32(result_smi)));
 }
 
 TF_BUILTIN(WasmI32AtomicWait, WasmBuiltinsAssembler) {
@@ -146,30 +87,16 @@ TF_BUILTIN(WasmI32AtomicWait, WasmBuiltinsAssembler) {
   TNode<Float64T> timeout =
       UncheckedCast<Float64T>(Parameter(Descriptor::kTimeout));
 
-  TNode<Object> instance = LoadInstanceFromFrame();
-  TNode<Code> centry = LoadCEntryFromInstance(instance);
-
-  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kAllocateHeapNumber);
-  TNode<Object> context = LoadContextFromInstance(instance);
+  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
+  TNode<Number> address_number = ChangeUint32ToTagged(address);
+  TNode<Number> expected_value_number = ChangeInt32ToTagged(expected_value);
+  TNode<Number> timeout_number = ChangeFloat64ToTagged(timeout);
+  TNode<Context> context = LoadContextFromInstance(instance);
 
-  // TODO(aseemgarg): Use SMIs if possible for address and expected_value
-  TNode<HeapNumber> address_heap = UncheckedCast<HeapNumber>(
-      CallStub(AllocateHeapNumberDescriptor(), target, context));
-  StoreHeapNumberValue(address_heap, ChangeUint32ToFloat64(address));
-
-  TNode<HeapNumber> expected_value_heap = UncheckedCast<HeapNumber>(
-      CallStub(AllocateHeapNumberDescriptor(), target, context));
-  StoreHeapNumberValue(expected_value_heap,
-                       ChangeInt32ToFloat64(expected_value));
-
-  TNode<HeapNumber> timeout_heap = UncheckedCast<HeapNumber>(
-      CallStub(AllocateHeapNumberDescriptor(), target, context));
-  StoreHeapNumberValue(timeout_heap, timeout);
-
-  TNode<Smi> result_smi = UncheckedCast<Smi>(CallRuntimeWithCEntry(
-      Runtime::kWasmI32AtomicWait, centry, context, instance,
-      address_heap, expected_value_heap, timeout_heap));
-  ReturnRaw(SmiToInt32(result_smi));
+  TNode<Smi> result_smi =
+      CAST(CallRuntime(Runtime::kWasmI32AtomicWait, context, instance,
+                       address_number, expected_value_number, timeout_number));
+  Return(Unsigned(SmiToInt32(result_smi)));
 }
 
 TF_BUILTIN(WasmI64AtomicWait, WasmBuiltinsAssembler) {
@@ -182,36 +109,19 @@ TF_BUILTIN(WasmI64AtomicWait, WasmBuiltinsAssembler) {
   TNode<Float64T> timeout =
       UncheckedCast<Float64T>(Parameter(Descriptor::kTimeout));
 
-  TNode<Object> instance = LoadInstanceFromFrame();
-  TNode<Code> centry = LoadCEntryFromInstance(instance);
-
-  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kAllocateHeapNumber);
-  TNode<Object> context = LoadContextFromInstance(instance);
-
-  // TODO(aseemgarg): Use SMIs if possible for address and expected_value
-  TNode<HeapNumber> address_heap = UncheckedCast<HeapNumber>(
-      CallStub(AllocateHeapNumberDescriptor(), target, context));
-  StoreHeapNumberValue(address_heap, ChangeUint32ToFloat64(address));
-
-  TNode<HeapNumber> expected_value_high_heap = UncheckedCast<HeapNumber>(
-      CallStub(AllocateHeapNumberDescriptor(), target, context));
-  StoreHeapNumberValue(expected_value_high_heap,
-                       ChangeUint32ToFloat64(expected_value_high));
+  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
+  TNode<Number> address_number = ChangeUint32ToTagged(address);
+  TNode<Number> expected_value_high_number =
+      ChangeUint32ToTagged(expected_value_high);
+  TNode<Number> expected_value_low_number =
+      ChangeUint32ToTagged(expected_value_low);
+  TNode<Number> timeout_number = ChangeFloat64ToTagged(timeout);
+  TNode<Context> context = LoadContextFromInstance(instance);
 
-  TNode<HeapNumber> expected_value_low_heap = UncheckedCast<HeapNumber>(
-      CallStub(AllocateHeapNumberDescriptor(), target, context));
-  StoreHeapNumberValue(expected_value_low_heap,
-                       ChangeUint32ToFloat64(expected_value_low));
-
-  TNode<HeapNumber> timeout_heap = UncheckedCast<HeapNumber>(
-      CallStub(AllocateHeapNumberDescriptor(), target, context));
-  StoreHeapNumberValue(timeout_heap, timeout);
-
-  TNode<Smi> result_smi = UncheckedCast<Smi>(CallRuntimeWithCEntry(
-      Runtime::kWasmI64AtomicWait, centry, context, instance,
-      address_heap, expected_value_high_heap, expected_value_low_heap,
-      timeout_heap));
-  ReturnRaw(SmiToInt32(result_smi));
+  TNode<Smi> result_smi = CAST(CallRuntime(
+      Runtime::kWasmI64AtomicWait, context, instance, address_number,
+      expected_value_high_number, expected_value_low_number, timeout_number));
+  Return(Unsigned(SmiToInt32(result_smi)));
 }
 
 TF_BUILTIN(WasmMemoryGrow, WasmBuiltinsAssembler) {
@@ -224,24 +134,21 @@ TF_BUILTIN(WasmMemoryGrow, WasmBuiltinsAssembler) {
   GotoIfNot(num_pages_fits_in_smi, &num_pages_out_of_range);
 
   TNode<Smi> num_pages_smi = SmiFromInt32(num_pages);
-  TNode<Object> instance = LoadInstanceFromFrame();
-  TNode<Code> centry = LoadCEntryFromInstance(instance);
-  TNode<Object> context = LoadContextFromInstance(instance);
-  TNode<Smi> ret_smi = UncheckedCast<Smi>(CallRuntimeWithCEntry(
-      Runtime::kWasmMemoryGrow, centry, context, instance, num_pages_smi));
-  TNode<Int32T> ret = SmiToInt32(ret_smi);
-  ReturnRaw(ret);
+  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
+  TNode<Context> context = LoadContextFromInstance(instance);
+  TNode<Smi> ret_smi = CAST(
+      CallRuntime(Runtime::kWasmMemoryGrow, context, instance, num_pages_smi));
+  Return(SmiToInt32(ret_smi));
 
   BIND(&num_pages_out_of_range);
-  ReturnRaw(Int32Constant(-1));
+  Return(Int32Constant(-1));
 }
 
 TF_BUILTIN(WasmTableGet, WasmBuiltinsAssembler) {
   TNode<Int32T> entry_index =
       UncheckedCast<Int32T>(Parameter(Descriptor::kEntryIndex));
-  TNode<Object> instance = LoadInstanceFromFrame();
-  TNode<Code> centry = LoadCEntryFromInstance(instance);
-  TNode<Object> context = LoadContextFromInstance(instance);
+  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
+  TNode<Context> context = LoadContextFromInstance(instance);
   Label entry_index_out_of_range(this, Label::kDeferred);
 
   TNode<BoolT> entry_index_fits_in_smi =
@@ -249,25 +156,23 @@ TF_BUILTIN(WasmTableGet, WasmBuiltinsAssembler) {
   GotoIfNot(entry_index_fits_in_smi, &entry_index_out_of_range);
 
   TNode<Smi> entry_index_smi = SmiFromInt32(entry_index);
-  TNode<Smi> table_index_smi =
-      UncheckedCast<Smi>(Parameter(Descriptor::kTableIndex));
+  TNode<Smi> table_index_smi = CAST(Parameter(Descriptor::kTableIndex));
 
-  TailCallRuntimeWithCEntry(Runtime::kWasmFunctionTableGet, centry, context,
-                            instance, table_index_smi, entry_index_smi);
+  TailCallRuntime(Runtime::kWasmFunctionTableGet, context, instance,
+                  table_index_smi, entry_index_smi);
 
   BIND(&entry_index_out_of_range);
   MessageTemplate message_id =
       wasm::WasmOpcodes::TrapReasonToMessageId(wasm::kTrapTableOutOfBounds);
-  TailCallRuntimeWithCEntry(Runtime::kThrowWasmError, centry, context,
-                            SmiConstant(static_cast<int>(message_id)));
+  TailCallRuntime(Runtime::kThrowWasmError, context,
+                  SmiConstant(static_cast<int>(message_id)));
 }
 
 TF_BUILTIN(WasmTableSet, WasmBuiltinsAssembler) {
   TNode<Int32T> entry_index =
       UncheckedCast<Int32T>(Parameter(Descriptor::kEntryIndex));
-  TNode<Object> instance = LoadInstanceFromFrame();
-  TNode<Code> centry = LoadCEntryFromInstance(instance);
-  TNode<Object> context = LoadContextFromInstance(instance);
+  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
+  TNode<Context> context = LoadContextFromInstance(instance);
   Label entry_index_out_of_range(this, Label::kDeferred);
 
   TNode<BoolT> entry_index_fits_in_smi =
@@ -275,88 +180,29 @@ TF_BUILTIN(WasmTableSet, WasmBuiltinsAssembler) {
   GotoIfNot(entry_index_fits_in_smi, &entry_index_out_of_range);
 
   TNode<Smi> entry_index_smi = SmiFromInt32(entry_index);
-  TNode<Smi> table_index_smi =
-      UncheckedCast<Smi>(Parameter(Descriptor::kTableIndex));
-  TNode<Object> value = UncheckedCast<Object>(Parameter(Descriptor::kValue));
-  TailCallRuntimeWithCEntry(Runtime::kWasmFunctionTableSet, centry, context,
-                            instance, table_index_smi, entry_index_smi, value);
+  TNode<Smi> table_index_smi = CAST(Parameter(Descriptor::kTableIndex));
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
+  TailCallRuntime(Runtime::kWasmFunctionTableSet, context, instance,
+                  table_index_smi, entry_index_smi, value);
 
   BIND(&entry_index_out_of_range);
   MessageTemplate message_id =
       wasm::WasmOpcodes::TrapReasonToMessageId(wasm::kTrapTableOutOfBounds);
-  TailCallRuntimeWithCEntry(Runtime::kThrowWasmError, centry, context,
-                            SmiConstant(static_cast<int>(message_id)));
-}
-
-TF_BUILTIN(WasmI64ToBigInt, WasmBuiltinsAssembler) {
-  if (!Is64()) {
-    Unreachable();
-    return;
-  }
-
-  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kI64ToBigInt);
-  TNode<IntPtrT> argument =
-      UncheckedCast<IntPtrT>(Parameter(Descriptor::kArgument));
-
-  TailCallStub(I64ToBigIntDescriptor(), target, NoContextConstant(), argument);
-}
-
-TF_BUILTIN(WasmI32PairToBigInt, WasmBuiltinsAssembler) {
-  if (!Is32()) {
-    Unreachable();
-    return;
-  }
-
-  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kI32PairToBigInt);
-  TNode<IntPtrT> low = UncheckedCast<IntPtrT>(Parameter(Descriptor::kLow));
-  TNode<IntPtrT> high = UncheckedCast<IntPtrT>(Parameter(Descriptor::kHigh));
-
-  TailCallStub(I32PairToBigIntDescriptor(), target, NoContextConstant(), low,
-               high);
-}
-
-TF_BUILTIN(WasmBigIntToI64, WasmBuiltinsAssembler) {
-  if (!Is64()) {
-    Unreachable();
-    return;
-  }
-
-  TNode<Object> context =
-      UncheckedCast<Object>(Parameter(Descriptor::kContext));
-  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kBigIntToI64);
-  TNode<IntPtrT> argument =
-      UncheckedCast<IntPtrT>(Parameter(Descriptor::kArgument));
-
-  TailCallStub(BigIntToI64Descriptor(), target, context, argument);
-}
-
-TF_BUILTIN(WasmBigIntToI32Pair, WasmBuiltinsAssembler) {
-  if (!Is32()) {
-    Unreachable();
-    return;
-  }
-
-  TNode<Object> context =
-      UncheckedCast<Object>(Parameter(Descriptor::kContext));
-  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kBigIntToI32Pair);
-  TNode<IntPtrT> argument =
-      UncheckedCast<IntPtrT>(Parameter(Descriptor::kArgument));
-
-  TailCallStub(BigIntToI32PairDescriptor(), target, context, argument);
-}
-
-#define DECLARE_ENUM(name)                                                \
-  TF_BUILTIN(ThrowWasm##name, WasmBuiltinsAssembler) {                    \
-    TNode<Object> instance = LoadInstanceFromFrame();                     \
-    TNode<Code> centry = LoadCEntryFromInstance(instance);                \
-    TNode<Object> context = LoadContextFromInstance(instance);            \
-    MessageTemplate message_id =                                          \
-        wasm::WasmOpcodes::TrapReasonToMessageId(wasm::k##name);          \
-    TailCallRuntimeWithCEntry(Runtime::kThrowWasmError, centry, context,  \
-                              SmiConstant(static_cast<int>(message_id))); \
+  TailCallRuntime(Runtime::kThrowWasmError, context,
+                  SmiConstant(static_cast<int>(message_id)));
+}
+
+#define DECLARE_THROW_RUNTIME_FN(name)                            \
+  TF_BUILTIN(ThrowWasm##name, WasmBuiltinsAssembler) {            \
+    TNode<WasmInstanceObject> instance = LoadInstanceFromFrame(); \
+    TNode<Context> context = LoadContextFromInstance(instance);   \
+    MessageTemplate message_id =                                  \
+        wasm::WasmOpcodes::TrapReasonToMessageId(wasm::k##name);  \
+    TailCallRuntime(Runtime::kThrowWasmError, context,            \
+                    SmiConstant(static_cast<int>(message_id)));   \
   }
-FOREACH_WASM_TRAPREASON(DECLARE_ENUM)
-#undef DECLARE_ENUM
+FOREACH_WASM_TRAPREASON(DECLARE_THROW_RUNTIME_FN)
+#undef DECLARE_THROW_RUNTIME_FN
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins.cc b/deps/v8/src/builtins/builtins.cc
index e0750a732c68a3..955656d669f99b 100644
--- a/deps/v8/src/builtins/builtins.cc
+++ b/deps/v8/src/builtins/builtins.cc
@@ -105,10 +105,8 @@ void Builtins::TearDown() { initialized_ = false; }
 
 const char* Builtins::Lookup(Address pc) {
   // Off-heap pc's can be looked up through binary search.
-  if (FLAG_embedded_builtins) {
-    Code maybe_builtin = InstructionStream::TryLookupCode(isolate_, pc);
-    if (!maybe_builtin.is_null()) return name(maybe_builtin.builtin_index());
-  }
+  Code maybe_builtin = InstructionStream::TryLookupCode(isolate_, pc);
+  if (!maybe_builtin.is_null()) return name(maybe_builtin.builtin_index());
 
   // May be called during initialization (disassembler).
   if (initialized_) {
@@ -190,6 +188,13 @@ Callable Builtins::CallableFor(Isolate* isolate, Name name) {
   return Callable{code, CallInterfaceDescriptorFor(name)};
 }
 
+// static
+bool Builtins::HasJSLinkage(int builtin_index) {
+  Name name = static_cast<Name>(builtin_index);
+  DCHECK_NE(BCH, Builtins::KindOf(name));
+  return CallInterfaceDescriptorFor(name) == JSTrampolineDescriptor{};
+}
+
 // static
 const char* Builtins::name(int index) {
   DCHECK(IsBuiltinId(index));
@@ -250,37 +255,21 @@ bool Builtins::IsBuiltinHandle(Handle<HeapObject> maybe_code,
 
 // static
 bool Builtins::IsIsolateIndependentBuiltin(const Code code) {
-  if (FLAG_embedded_builtins) {
-    const int builtin_index = code.builtin_index();
-    return Builtins::IsBuiltinId(builtin_index) &&
-           Builtins::IsIsolateIndependent(builtin_index);
-  } else {
-    return false;
-  }
-}
-
-// static
-bool Builtins::IsWasmRuntimeStub(int index) {
-  DCHECK(IsBuiltinId(index));
-  switch (index) {
-#define CASE_TRAP(Name) case kThrowWasm##Name:
-#define CASE(Name) case k##Name:
-    WASM_RUNTIME_STUB_LIST(CASE, CASE_TRAP)
-#undef CASE_TRAP
-#undef CASE
-    return true;
-    default:
-      return false;
-  }
-  UNREACHABLE();
+  const int builtin_index = code.builtin_index();
+  return Builtins::IsBuiltinId(builtin_index) &&
+         Builtins::IsIsolateIndependent(builtin_index);
 }
 
 // static
-void Builtins::UpdateBuiltinEntryTable(Isolate* isolate) {
-  Heap* heap = isolate->heap();
+void Builtins::InitializeBuiltinEntryTable(Isolate* isolate) {
+  EmbeddedData d = EmbeddedData::FromBlob();
   Address* builtin_entry_table = isolate->builtin_entry_table();
   for (int i = 0; i < builtin_count; i++) {
-    builtin_entry_table[i] = heap->builtin(i).InstructionStart();
+    // TODO(jgruber,chromium:1020986): Remove the CHECK once the linked issue is
+    // resolved.
+    CHECK(Builtins::IsBuiltinId(isolate->heap()->builtin(i).builtin_index()));
+    DCHECK(isolate->heap()->builtin(i).is_off_heap_trampoline());
+    builtin_entry_table[i] = d.InstructionStartOfBuiltin(i);
   }
 }
 
@@ -293,15 +282,16 @@ void Builtins::EmitCodeCreateEvents(Isolate* isolate) {
 
   Address* builtins = isolate->builtins_table();
   int i = 0;
+  HandleScope scope(isolate);
   for (; i < kFirstBytecodeHandler; i++) {
-    auto code = AbstractCode::cast(Object(builtins[i]));
+    Handle<AbstractCode> code(AbstractCode::cast(Object(builtins[i])), isolate);
     PROFILE(isolate, CodeCreateEvent(CodeEventListener::BUILTIN_TAG, code,
                                      Builtins::name(i)));
   }
 
   STATIC_ASSERT(kLastBytecodeHandlerPlusOne == builtin_count);
   for (; i < builtin_count; i++) {
-    auto code = AbstractCode::cast(Object(builtins[i]));
+    Handle<AbstractCode> code(AbstractCode::cast(Object(builtins[i])), isolate);
     interpreter::Bytecode bytecode =
         builtin_metadata[i].data.bytecode_and_scale.bytecode;
     interpreter::OperandScale scale =
@@ -314,6 +304,7 @@ void Builtins::EmitCodeCreateEvents(Isolate* isolate) {
 }
 
 namespace {
+enum TrampolineType { kAbort, kJump };
 
 class OffHeapTrampolineGenerator {
  public:
@@ -322,12 +313,16 @@ class OffHeapTrampolineGenerator {
         masm_(isolate, CodeObjectRequired::kYes,
               ExternalAssemblerBuffer(buffer_, kBufferSize)) {}
 
-  CodeDesc Generate(Address off_heap_entry) {
+  CodeDesc Generate(Address off_heap_entry, TrampolineType type) {
     // Generate replacement code that simply tail-calls the off-heap code.
     DCHECK(!masm_.has_frame());
     {
       FrameScope scope(&masm_, StackFrame::NONE);
-      masm_.JumpToInstructionStream(off_heap_entry);
+      if (type == TrampolineType::kJump) {
+        masm_.JumpToInstructionStream(off_heap_entry);
+      } else {
+        masm_.Trap();
+      }
     }
 
     CodeDesc desc;
@@ -351,16 +346,22 @@ constexpr int OffHeapTrampolineGenerator::kBufferSize;
 
 // static
 Handle<Code> Builtins::GenerateOffHeapTrampolineFor(
-    Isolate* isolate, Address off_heap_entry, int32_t kind_specfic_flags) {
+    Isolate* isolate, Address off_heap_entry, int32_t kind_specfic_flags,
+    bool generate_jump_to_instruction_stream) {
   DCHECK_NOT_NULL(isolate->embedded_blob());
   DCHECK_NE(0, isolate->embedded_blob_size());
 
   OffHeapTrampolineGenerator generator(isolate);
-  CodeDesc desc = generator.Generate(off_heap_entry);
+
+  CodeDesc desc =
+      generator.Generate(off_heap_entry, generate_jump_to_instruction_stream
+                                             ? TrampolineType::kJump
+                                             : TrampolineType::kAbort);
 
   return Factory::CodeBuilder(isolate, desc, Code::BUILTIN)
-      .set_self_reference(generator.CodeObject())
       .set_read_only_data_container(kind_specfic_flags)
+      .set_self_reference(generator.CodeObject())
+      .set_is_executable(generate_jump_to_instruction_stream)
       .Build();
 }
 
@@ -370,7 +371,7 @@ Handle<ByteArray> Builtins::GenerateOffHeapTrampolineRelocInfo(
   OffHeapTrampolineGenerator generator(isolate);
   // Generate a jump to a dummy address as we're not actually interested in the
   // generated instruction stream.
-  CodeDesc desc = generator.Generate(kNullAddress);
+  CodeDesc desc = generator.Generate(kNullAddress, TrampolineType::kJump);
 
   Handle<ByteArray> reloc_info = isolate->factory()->NewByteArray(
       desc.reloc_size, AllocationType::kReadOnly);
@@ -419,6 +420,61 @@ bool Builtins::AllowDynamicFunction(Isolate* isolate, Handle<JSFunction> target,
   return isolate->MayAccess(responsible_context, target_global_proxy);
 }
 
+// static
+bool Builtins::CodeObjectIsExecutable(int builtin_index) {
+  // If the runtime/optimized code always knows when executing a given builtin
+  // that it is a builtin, then that builtin does not need an executable Code
+  // object. Such Code objects can go in read_only_space (and can even be
+  // smaller with no branch instruction), thus saving memory.
+
+  // Builtins with JS linkage will always have executable Code objects since
+  // they can be called directly from jitted code with no way of determining
+  // that they are builtins at generation time. E.g.
+  //   f = Array.of;
+  //   f(1, 2, 3);
+  // TODO(delphick): This is probably too loose but for now Wasm can call any JS
+  // linkage builtin via its Code object. Once Wasm is fixed this can either be
+  // tighted or removed completely.
+  if (Builtins::KindOf(builtin_index) != BCH && HasJSLinkage(builtin_index)) {
+    return true;
+  }
+
+  // There are some other non-TF builtins that also have JS linkage like
+  // InterpreterEntryTrampoline which are explicitly allow-listed below.
+  // TODO(delphick): Some of these builtins do not fit with the above, but
+  // currently cause problems if they're not executable. This list should be
+  // pared down as much as possible.
+  switch (builtin_index) {
+    case Builtins::kInterpreterEntryTrampoline:
+    case Builtins::kCompileLazy:
+    case Builtins::kCompileLazyDeoptimizedCode:
+    case Builtins::kCallFunction_ReceiverIsNullOrUndefined:
+    case Builtins::kCallFunction_ReceiverIsNotNullOrUndefined:
+    case Builtins::kCallFunction_ReceiverIsAny:
+    case Builtins::kCallBoundFunction:
+    case Builtins::kCall_ReceiverIsNullOrUndefined:
+    case Builtins::kCall_ReceiverIsNotNullOrUndefined:
+    case Builtins::kCall_ReceiverIsAny:
+    case Builtins::kArgumentsAdaptorTrampoline:
+    case Builtins::kHandleApiCall:
+    case Builtins::kInstantiateAsmJs:
+
+    // TODO(delphick): Remove this when calls to it have the trampoline inlined
+    // or are converted to use kCallBuiltinPointer.
+    case Builtins::kCEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit:
+      return true;
+    default:
+#if V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64
+      // TODO(Loongson): Move non-JS linkage builtins code objects into RO_SPACE
+      // caused MIPS platform to crash, and we need some time to handle it. Now
+      // disable this change temporarily on MIPS platform.
+      return true;
+#else
+      return false;
+#endif  // V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64
+  }
+}
+
 Builtins::Name ExampleBuiltinForTorqueFunctionPointerType(
     size_t function_pointer_type_id) {
   switch (function_pointer_type_id) {
diff --git a/deps/v8/src/builtins/builtins.h b/deps/v8/src/builtins/builtins.h
index 0b9f2a2b57d016..0eaa9d48d81680 100644
--- a/deps/v8/src/builtins/builtins.h
+++ b/deps/v8/src/builtins/builtins.h
@@ -95,6 +95,7 @@ class Builtins {
 
   static CallInterfaceDescriptor CallInterfaceDescriptorFor(Name name);
   V8_EXPORT_PRIVATE static Callable CallableFor(Isolate* isolate, Name name);
+  static bool HasJSLinkage(int index);
 
   static int GetStackParameterCount(Name name);
 
@@ -135,14 +136,9 @@ class Builtins {
     return kAllBuiltinsAreIsolateIndependent;
   }
 
-  // Wasm runtime stubs are treated specially by wasm. To guarantee reachability
-  // through near jumps, their code is completely copied into a fresh off-heap
-  // area.
-  static bool IsWasmRuntimeStub(int index);
-
-  // Updates the table of builtin entry points based on the current contents of
-  // the builtins table.
-  static void UpdateBuiltinEntryTable(Isolate* isolate);
+  // Initializes the table of builtin entry points based on the current contents
+  // of the builtins table.
+  static void InitializeBuiltinEntryTable(Isolate* isolate);
 
   // Emits a CodeCreateEvent for every builtin.
   static void EmitCodeCreateEvents(Isolate* isolate);
@@ -172,14 +168,21 @@ class Builtins {
   // Creates a trampoline code object that jumps to the given off-heap entry.
   // The result should not be used directly, but only from the related Factory
   // function.
-  static Handle<Code> GenerateOffHeapTrampolineFor(Isolate* isolate,
-                                                   Address off_heap_entry,
-                                                   int32_t kind_specific_flags);
+  // TODO(delphick): Come up with a better name since it may not generate an
+  // executable trampoline.
+  static Handle<Code> GenerateOffHeapTrampolineFor(
+      Isolate* isolate, Address off_heap_entry, int32_t kind_specific_flags,
+      bool generate_jump_to_instruction_stream);
 
   // Generate the RelocInfo ByteArray that would be generated for an offheap
   // trampoline.
   static Handle<ByteArray> GenerateOffHeapTrampolineRelocInfo(Isolate* isolate);
 
+  // Only builtins with JS linkage should ever need to be called via their
+  // trampoline Code object. The remaining builtins have non-executable Code
+  // objects.
+  static bool CodeObjectIsExecutable(int builtin_index);
+
   static bool IsJSEntryVariant(int builtin_index) {
     switch (builtin_index) {
       case kJSEntry:
diff --git a/deps/v8/src/builtins/cast.tq b/deps/v8/src/builtins/cast.tq
new file mode 100644
index 00000000000000..7e8d08097ff0c7
--- /dev/null
+++ b/deps/v8/src/builtins/cast.tq
@@ -0,0 +1,744 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern macro IsCallable(HeapObject): bool;
+extern macro IsConstructor(HeapObject): bool;
+extern macro IsFeedbackVector(HeapObject): bool;
+extern macro IsJSArray(HeapObject): bool;
+extern macro IsJSProxy(HeapObject): bool;
+extern macro IsJSRegExp(HeapObject): bool;
+extern macro IsJSRegExpStringIterator(HeapObject): bool;
+extern macro IsMap(HeapObject): bool;
+extern macro IsJSFunction(HeapObject): bool;
+extern macro IsJSBoundFunction(HeapObject): bool;
+extern macro IsJSObject(HeapObject): bool;
+extern macro IsJSPromise(HeapObject): bool;
+extern macro IsJSTypedArray(HeapObject): bool;
+extern macro IsNumberDictionary(HeapObject): bool;
+extern macro IsContext(HeapObject): bool;
+extern macro IsNativeContext(HeapObject): bool;
+extern macro IsJSReceiver(HeapObject): bool;
+extern macro TaggedIsCallable(Object): bool;
+extern macro IsDetachedBuffer(JSArrayBuffer): bool;
+extern macro IsHeapNumber(HeapObject): bool;
+extern macro IsBigInt(HeapObject): bool;
+extern macro IsFixedArray(HeapObject): bool;
+extern macro IsName(HeapObject): bool;
+extern macro IsPrivateSymbol(HeapObject): bool;
+extern macro IsNumber(Object): bool;
+extern macro IsNumberNormalized(Number): bool;
+extern macro IsSafeInteger(Object): bool;
+extern macro IsOddball(HeapObject): bool;
+extern macro IsSymbol(HeapObject): bool;
+extern macro IsJSArrayMap(Map): bool;
+extern macro IsExtensibleMap(Map): bool;
+extern macro IsJSPrimitiveWrapper(HeapObject): bool;
+extern macro IsPromiseCapability(HeapObject): bool;
+extern macro IsPromiseReaction(HeapObject): bool;
+extern macro IsPromiseReactionJobTask(HeapObject): bool;
+extern macro IsPromiseRejectReactionJobTask(HeapObject): bool;
+extern macro IsPromiseFulfillReactionJobTask(HeapObject): bool;
+extern macro IsSharedFunctionInfo(HeapObject): bool;
+extern macro IsCustomElementsReceiverInstanceType(int32): bool;
+
+extern macro HeapObjectToJSDataView(HeapObject): JSDataView
+    labels CastError;
+extern macro HeapObjectToJSProxy(HeapObject): JSProxy
+    labels CastError;
+extern macro HeapObjectToJSStringIterator(HeapObject): JSStringIterator
+    labels CastError;
+extern macro HeapObjectToJSArrayBuffer(HeapObject): JSArrayBuffer
+    labels CastError;
+extern macro TaggedToHeapObject(Object): HeapObject
+    labels CastError;
+extern macro TaggedToSmi(Object): Smi
+    labels CastError;
+extern macro TaggedToPositiveSmi(Object): PositiveSmi
+    labels CastError;
+extern macro TaggedToDirectString(Object): DirectString
+    labels CastError;
+extern macro HeapObjectToJSArray(HeapObject): JSArray
+    labels CastError;
+extern macro HeapObjectToCallable(HeapObject): Callable
+    labels CastError;
+extern macro HeapObjectToFixedArray(HeapObject): FixedArray
+    labels CastError;
+extern macro HeapObjectToFixedDoubleArray(HeapObject): FixedDoubleArray
+    labels CastError;
+extern macro HeapObjectToString(HeapObject): String
+    labels CastError;
+extern macro HeapObjectToConstructor(HeapObject): Constructor
+    labels CastError;
+extern macro HeapObjectToJSFunctionWithPrototypeSlot(HeapObject):
+    JSFunctionWithPrototypeSlot
+    labels CastError;
+extern macro HeapObjectToHeapNumber(HeapObject): HeapNumber
+    labels CastError;
+extern macro HeapObjectToSloppyArgumentsElements(HeapObject):
+    SloppyArgumentsElements
+    labels CastError;
+extern macro TaggedToNumber(Object): Number
+    labels CastError;
+
+macro Cast<A : type extends WeakHeapObject>(o: A|Object): A labels CastError {
+  if (!IsWeakOrCleared(o)) goto CastError;
+  return %RawDownCast<A>(o);
+}
+
+macro Cast<A: type>(o: MaybeObject): A labels CastError;
+
+Cast<Undefined>(o: MaybeObject): Undefined labels CastError {
+  if (TaggedNotEqual(o, Undefined)) goto CastError;
+  return %RawDownCast<Undefined>(o);
+}
+
+macro Cast<A : type extends Object>(implicit context: Context)(o: Object): A
+    labels CastError {
+  return Cast<A>(TaggedToHeapObject(o) otherwise CastError)
+      otherwise CastError;
+}
+
+Cast<Smi>(o: Object): Smi
+    labels CastError {
+  return TaggedToSmi(o) otherwise CastError;
+}
+
+Cast<PositiveSmi>(o: Object): PositiveSmi
+    labels CastError {
+  return TaggedToPositiveSmi(o) otherwise CastError;
+}
+
+Cast<Zero>(o: Object): Zero labels CastError {
+  if (TaggedEqual(o, SmiConstant(0))) return %RawDownCast<Zero>(o);
+  goto CastError;
+}
+
+Cast<Number>(o: Object): Number
+    labels CastError {
+  return TaggedToNumber(o) otherwise CastError;
+}
+
+Cast<Undefined>(o: Object): Undefined
+    labels CastError {
+  const o: MaybeObject = o;
+  return Cast<Undefined>(o) otherwise CastError;
+}
+
+Cast<Numeric>(o: Object): Numeric labels CastError {
+  typeswitch (o) {
+    case (o: Number): {
+      return o;
+    }
+    case (o: BigInt): {
+      return o;
+    }
+    case (HeapObject): {
+      goto CastError;
+    }
+  }
+}
+
+Cast<TheHole>(o: Object): TheHole labels CastError {
+  if (o == TheHole) return %RawDownCast<TheHole>(o);
+  goto CastError;
+}
+
+Cast<TheHole>(o: HeapObject): TheHole labels CastError {
+  const o: Object = o;
+  return Cast<TheHole>(o) otherwise CastError;
+}
+
+Cast<True>(o: Object): True labels CastError {
+  if (o == True) return %RawDownCast<True>(o);
+  goto CastError;
+}
+
+Cast<True>(o: HeapObject): True labels CastError {
+  const o: Object = o;
+  return Cast<True>(o) otherwise CastError;
+}
+
+Cast<False>(o: Object): False labels CastError {
+  if (o == False) return %RawDownCast<False>(o);
+  goto CastError;
+}
+
+Cast<False>(o: HeapObject): False labels CastError {
+  const o: Object = o;
+  return Cast<False>(o) otherwise CastError;
+}
+
+Cast<Boolean>(o: Object): Boolean labels CastError {
+  typeswitch (o) {
+    case (o: True): {
+      return o;
+    }
+    case (o: False): {
+      return o;
+    }
+    case (Object): {
+      goto CastError;
+    }
+  }
+}
+
+Cast<Boolean>(o: HeapObject): Boolean labels CastError {
+  const o: Object = o;
+  return Cast<Boolean>(o) otherwise CastError;
+}
+
+// TODO(tebbi): These trivial casts for union types should be generated
+// automatically.
+
+Cast<JSPrimitive>(o: Object): JSPrimitive labels CastError {
+  typeswitch (o) {
+    case (o: Numeric): {
+      return o;
+    }
+    case (o: String): {
+      return o;
+    }
+    case (o: Symbol): {
+      return o;
+    }
+    case (o: Boolean): {
+      return o;
+    }
+    case (o: Undefined): {
+      return o;
+    }
+    case (o: Null): {
+      return o;
+    }
+    case (Object): {
+      goto CastError;
+    }
+  }
+}
+
+Cast<JSAny>(o: Object): JSAny labels CastError {
+  typeswitch (o) {
+    case (o: JSPrimitive): {
+      return o;
+    }
+    case (o: JSReceiver): {
+      return o;
+    }
+    case (Object): {
+      goto CastError;
+    }
+  }
+}
+
+Cast<JSAny|TheHole>(o: Object): JSAny|TheHole labels CastError {
+  typeswitch (o) {
+    case (o: JSAny): {
+      return o;
+    }
+    case (o: TheHole): {
+      return o;
+    }
+    case (Object): {
+      goto CastError;
+    }
+  }
+}
+
+Cast<Number|TheHole>(o: Object): Number|TheHole labels CastError {
+  typeswitch (o) {
+    case (o: Number): {
+      return o;
+    }
+    case (o: TheHole): {
+      return o;
+    }
+    case (Object): {
+      goto CastError;
+    }
+  }
+}
+
+macro Cast<A : type extends HeapObject>(o: HeapObject): A
+    labels CastError;
+
+Cast<HeapObject>(o: HeapObject): HeapObject
+labels _CastError {
+  return o;
+}
+
+Cast<Null>(o: HeapObject): Null
+    labels CastError {
+  if (o != Null) goto CastError;
+  return %RawDownCast<Null>(o);
+}
+
+Cast<Undefined>(o: HeapObject): Undefined
+    labels CastError {
+  const o: MaybeObject = o;
+  return Cast<Undefined>(o) otherwise CastError;
+}
+
+Cast<FixedArray>(o: HeapObject): FixedArray
+    labels CastError {
+  return HeapObjectToFixedArray(o) otherwise CastError;
+}
+
+Cast<FixedDoubleArray>(o: HeapObject): FixedDoubleArray
+    labels CastError {
+  return HeapObjectToFixedDoubleArray(o) otherwise CastError;
+}
+
+Cast<EmptyFixedArray>(o: Object): EmptyFixedArray
+    labels CastError {
+  if (o != kEmptyFixedArray) goto CastError;
+  return %RawDownCast<EmptyFixedArray>(o);
+}
+Cast<EmptyFixedArray>(o: HeapObject): EmptyFixedArray
+    labels CastError {
+  const o: Object = o;
+  return Cast<EmptyFixedArray>(o) otherwise CastError;
+}
+
+Cast<(FixedDoubleArray | EmptyFixedArray)>(o: HeapObject): FixedDoubleArray|
+    EmptyFixedArray labels CastError {
+  typeswitch (o) {
+    case (o: EmptyFixedArray): {
+      return o;
+    }
+    case (o: FixedDoubleArray): {
+      return o;
+    }
+    case (HeapObject): {
+      goto CastError;
+    }
+  }
+}
+
+Cast<SloppyArgumentsElements>(o: HeapObject): SloppyArgumentsElements
+    labels CastError {
+  return HeapObjectToSloppyArgumentsElements(o) otherwise CastError;
+}
+
+Cast<JSDataView>(o: HeapObject): JSDataView
+    labels CastError {
+  return HeapObjectToJSDataView(o) otherwise CastError;
+}
+
+Cast<JSProxy>(o: HeapObject): JSProxy
+    labels CastError {
+  return HeapObjectToJSProxy(o) otherwise CastError;
+}
+
+Cast<JSStringIterator>(o: HeapObject): JSStringIterator
+    labels CastError {
+  return HeapObjectToJSStringIterator(o) otherwise CastError;
+}
+
+Cast<JSRegExpStringIterator>(o: HeapObject): JSRegExpStringIterator
+    labels CastError {
+  if (IsJSRegExpStringIterator(o)) {
+    return %RawDownCast<JSRegExpStringIterator>(o);
+  }
+  goto CastError;
+}
+
+Cast<JSTypedArray>(o: HeapObject): JSTypedArray
+    labels CastError {
+  if (IsJSTypedArray(o)) return %RawDownCast<JSTypedArray>(o);
+  goto CastError;
+}
+
+Cast<JSTypedArray>(implicit context: Context)(o: Object): JSTypedArray
+    labels CastError {
+  const heapObject = Cast<HeapObject>(o) otherwise CastError;
+  return Cast<JSTypedArray>(heapObject) otherwise CastError;
+}
+
+Cast<Callable>(o: HeapObject): Callable
+    labels CastError {
+  return HeapObjectToCallable(o) otherwise CastError;
+}
+
+Cast<Undefined|Callable>(o: HeapObject): Undefined|Callable
+    labels CastError {
+  if (o == Undefined) return Undefined;
+  return HeapObjectToCallable(o) otherwise CastError;
+}
+
+Cast<JSArray>(o: HeapObject): JSArray
+    labels CastError {
+  return HeapObjectToJSArray(o) otherwise CastError;
+}
+
+Cast<JSArrayBuffer>(o: HeapObject): JSArrayBuffer
+    labels CastError {
+  return HeapObjectToJSArrayBuffer(o) otherwise CastError;
+}
+
+Cast<Context>(o: HeapObject): Context
+    labels CastError {
+  if (IsContext(o)) return %RawDownCast<Context>(o);
+  goto CastError;
+}
+
+Cast<NativeContext>(o: HeapObject): NativeContext
+    labels CastError {
+  if (IsNativeContext(o)) return %RawDownCast<NativeContext>(o);
+  goto CastError;
+}
+
+Cast<JSObject>(o: HeapObject): JSObject
+    labels CastError {
+  if (IsJSObject(o)) return %RawDownCast<JSObject>(o);
+  goto CastError;
+}
+
+Cast<NumberDictionary>(o: HeapObject): NumberDictionary
+    labels CastError {
+  if (IsNumberDictionary(o)) return %RawDownCast<NumberDictionary>(o);
+  goto CastError;
+}
+
+Cast<String>(o: HeapObject): String
+    labels CastError {
+  return HeapObjectToString(o) otherwise CastError;
+}
+
+Cast<Oddball>(o: HeapObject): Oddball
+    labels CastError {
+  if (IsOddball(o)) return %RawDownCast<Oddball>(o);
+  goto CastError;
+}
+
+Cast<Symbol>(o: HeapObject): Symbol
+    labels CastError {
+  if (IsSymbol(o)) return %RawDownCast<Symbol>(o);
+  goto CastError;
+}
+
+macro Cast<T : type extends Symbol>(o: Symbol): T labels CastError;
+Cast<PublicSymbol>(o: Symbol): PublicSymbol labels CastError {
+  if (IsPrivateSymbol(o)) goto CastError;
+  return %RawDownCast<PublicSymbol>(o);
+}
+Cast<PrivateSymbol>(o: Symbol): PrivateSymbol labels CastError {
+  if (IsPrivateSymbol(o)) {
+    return %RawDownCast<PrivateSymbol>(o);
+  }
+  goto CastError;
+}
+
+Cast<PublicSymbol>(o: HeapObject): PublicSymbol labels CastError {
+  const o = Cast<Symbol>(o) otherwise CastError;
+  return Cast<PublicSymbol>(o) otherwise CastError;
+}
+Cast<PrivateSymbol>(o: HeapObject): PrivateSymbol labels CastError {
+  const o = Cast<Symbol>(o) otherwise CastError;
+  return Cast<PrivateSymbol>(o) otherwise CastError;
+}
+
+Cast<DirectString>(o: HeapObject): DirectString
+    labels CastError {
+  return TaggedToDirectString(o) otherwise CastError;
+}
+
+Cast<Constructor>(o: HeapObject): Constructor
+    labels CastError {
+  return HeapObjectToConstructor(o) otherwise CastError;
+}
+
+Cast<JSFunctionWithPrototypeSlot>(o: HeapObject): JSFunctionWithPrototypeSlot
+    labels CastError {
+  return HeapObjectToJSFunctionWithPrototypeSlot(o) otherwise CastError;
+}
+
+Cast<HeapNumber>(o: HeapObject): HeapNumber
+    labels CastError {
+  if (IsHeapNumber(o)) return %RawDownCast<HeapNumber>(o);
+  goto CastError;
+}
+
+Cast<BigInt>(o: HeapObject): BigInt labels CastError {
+  if (IsBigInt(o)) return %RawDownCast<BigInt>(o);
+  goto CastError;
+}
+
+Cast<JSRegExp>(o: HeapObject): JSRegExp
+    labels CastError {
+  if (IsJSRegExp(o)) return %RawDownCast<JSRegExp>(o);
+  goto CastError;
+}
+
+Cast<JSRegExpResult>(implicit context: Context)(o: HeapObject): JSRegExpResult
+    labels CastError {
+  if (regexp::IsRegExpResult(o)) return %RawDownCast<JSRegExpResult>(o);
+  goto CastError;
+}
+
+Cast<Map>(implicit context: Context)(o: HeapObject): Map
+    labels CastError {
+  if (IsMap(o)) return %RawDownCast<Map>(o);
+  goto CastError;
+}
+
+Cast<FeedbackVector>(implicit context: Context)(o: HeapObject): FeedbackVector
+    labels CastError {
+  if (IsFeedbackVector(o)) return %RawDownCast<FeedbackVector>(o);
+  goto CastError;
+}
+
+Cast<JSPrimitiveWrapper>(o: HeapObject): JSPrimitiveWrapper
+    labels CastError {
+  if (IsJSPrimitiveWrapper(o)) return %RawDownCast<JSPrimitiveWrapper>(o);
+  goto CastError;
+}
+
+Cast<JSSloppyArgumentsObject>(implicit context: Context)(o: HeapObject):
+    JSSloppyArgumentsObject
+    labels CastError {
+  const map: Map = o.map;
+  if (IsFastAliasedArgumentsMap(map) || IsSloppyArgumentsMap(map) ||
+      IsSlowAliasedArgumentsMap(map)) {
+    return %RawDownCast<JSSloppyArgumentsObject>(o);
+  }
+  goto CastError;
+}
+
+Cast<JSStrictArgumentsObject>(implicit context: Context)(o: HeapObject):
+    JSStrictArgumentsObject
+    labels CastError {
+  const map: Map = o.map;
+  if (!IsStrictArgumentsMap(map)) goto CastError;
+  return %RawDownCast<JSStrictArgumentsObject>(o);
+}
+
+Cast<JSArgumentsObjectWithLength>(implicit context: Context)(o: HeapObject):
+    JSArgumentsObjectWithLength
+    labels CastError {
+  typeswitch (o) {
+    case (o: JSStrictArgumentsObject): {
+      return o;
+    }
+    case (o: JSSloppyArgumentsObject): {
+      return o;
+    }
+    case (HeapObject): {
+      goto CastError;
+    }
+  }
+}
+
+Cast<FastJSRegExp>(implicit context: Context)(o: HeapObject): FastJSRegExp
+    labels CastError {
+  // TODO(jgruber): Remove or redesign this. There is no single 'fast' regexp,
+  // the conditions to make a regexp object fast differ based on the callsite.
+  // For now, run the strict variant since replace (the only current callsite)
+  // accesses flag getters.
+  if (regexp::IsFastRegExpStrict(o)) {
+    return %RawDownCast<FastJSRegExp>(o);
+  }
+  goto CastError;
+}
+
+Cast<FastJSArray>(implicit context: Context)(o: HeapObject): FastJSArray
+    labels CastError {
+  if (IsForceSlowPath()) goto CastError;
+
+  const map: Map = o.map;
+  if (!IsJSArrayMap(map)) goto CastError;
+
+  // Bailout if receiver has slow elements.
+  const elementsKind: ElementsKind = LoadMapElementsKind(map);
+  if (!IsFastElementsKind(elementsKind)) goto CastError;
+
+  // Verify that our prototype is the initial array prototype.
+  if (!IsPrototypeInitialArrayPrototype(map)) goto CastError;
+
+  if (IsNoElementsProtectorCellInvalid()) goto CastError;
+  return %RawDownCast<FastJSArray>(o);
+}
+
+Cast<FastJSArrayForRead>(implicit context: Context)(o: HeapObject):
+    FastJSArrayForRead
+    labels CastError {
+  const map: Map = o.map;
+  if (!IsJSArrayMap(map)) goto CastError;
+
+  // Bailout if receiver has slow elements.
+  const elementsKind: ElementsKind = LoadMapElementsKind(map);
+  if (!IsElementsKindLessThanOrEqual(
+          elementsKind, ElementsKind::LAST_ANY_NONEXTENSIBLE_ELEMENTS_KIND))
+    goto CastError;
+
+  // Verify that our prototype is the initial array prototype.
+  if (!IsPrototypeInitialArrayPrototype(map)) goto CastError;
+
+  if (IsNoElementsProtectorCellInvalid()) goto CastError;
+  return %RawDownCast<FastJSArrayForRead>(o);
+}
+
+Cast<FastJSArrayForCopy>(implicit context: Context)(o: HeapObject):
+    FastJSArrayForCopy
+    labels CastError {
+  if (IsArraySpeciesProtectorCellInvalid()) goto CastError;
+  const a = Cast<FastJSArray>(o) otherwise CastError;
+  return %RawDownCast<FastJSArrayForCopy>(a);
+}
+
+Cast<FastJSArrayWithNoCustomIteration>(implicit context: Context)(
+    o: HeapObject): FastJSArrayWithNoCustomIteration
+    labels CastError {
+  if (IsArrayIteratorProtectorCellInvalid()) goto CastError;
+  const a = Cast<FastJSArray>(o) otherwise CastError;
+  return %RawDownCast<FastJSArrayWithNoCustomIteration>(a);
+}
+
+Cast<FastJSArrayForReadWithNoCustomIteration>(implicit context: Context)(
+    o: HeapObject): FastJSArrayForReadWithNoCustomIteration
+    labels CastError {
+  if (IsArrayIteratorProtectorCellInvalid()) goto CastError;
+  const a = Cast<FastJSArrayForRead>(o) otherwise CastError;
+  return %RawDownCast<FastJSArrayForReadWithNoCustomIteration>(a);
+}
+
+Cast<JSReceiver>(o: HeapObject): JSReceiver
+    labels CastError {
+  if (IsJSReceiver(o)) return %RawDownCast<JSReceiver>(o);
+  goto CastError;
+}
+
+Cast<JSFunction>(implicit context: Context)(o: HeapObject): JSFunction
+    labels CastError {
+  if (IsJSFunction(o)) return %RawDownCast<JSFunction>(o);
+  goto CastError;
+}
+
+extern macro IsDebugInfo(HeapObject): bool;
+Cast<DebugInfo>(implicit context: Context)(o: HeapObject): DebugInfo
+    labels CastError {
+  if (IsDebugInfo(o)) return %RawDownCast<DebugInfo>(o);
+  goto CastError;
+}
+
+extern macro IsCoverageInfo(HeapObject): bool;
+Cast<CoverageInfo>(implicit context: Context)(o: HeapObject): CoverageInfo
+    labels CastError {
+  // TODO(jgruber): Assign an instance type.
+  if (IsFixedArray(o)) return %RawDownCast<CoverageInfo>(o);
+  goto CastError;
+}
+
+Cast<JSReceiver|Null>(o: HeapObject): JSReceiver|Null
+    labels CastError {
+  typeswitch (o) {
+    case (o: Null): {
+      return o;
+    }
+    case (o: JSReceiver): {
+      return o;
+    }
+    case (HeapObject): {
+      goto CastError;
+    }
+  }
+}
+
+Cast<PromiseReactionJobTask>(o: HeapObject):
+    PromiseReactionJobTask labels CastError {
+  if (IsPromiseReactionJobTask(o)) {
+    return %RawDownCast<PromiseReactionJobTask>(o);
+  }
+  goto CastError;
+}
+
+Cast<PromiseFulfillReactionJobTask>(o: HeapObject):
+    PromiseFulfillReactionJobTask labels CastError {
+  if (IsPromiseFulfillReactionJobTask(o)) {
+    return %RawDownCast<PromiseFulfillReactionJobTask>(o);
+  }
+  goto CastError;
+}
+
+Cast<PromiseRejectReactionJobTask>(o: HeapObject):
+    PromiseRejectReactionJobTask labels CastError {
+  if (IsPromiseRejectReactionJobTask(o)) {
+    return %RawDownCast<PromiseRejectReactionJobTask>(o);
+  }
+  goto CastError;
+}
+
+Cast<PromiseReaction>(o: HeapObject): PromiseReaction labels CastError {
+  if (IsPromiseReaction(o)) return %RawDownCast<PromiseReaction>(o);
+  goto CastError;
+}
+
+Cast<Smi|PromiseReaction>(o: Object): Smi|PromiseReaction labels CastError {
+  typeswitch (o) {
+    case (o: Smi): {
+      return o;
+    }
+    case (o: PromiseReaction): {
+      return o;
+    }
+    case (Object): {
+      goto CastError;
+    }
+  }
+}
+
+Cast<String|Callable>(implicit context: Context)(o: Object): String|
+    Callable labels CastError {
+  typeswitch (o) {
+    case (o: String): {
+      return o;
+    }
+    case (o: Callable): {
+      return o;
+    }
+    case (Object): {
+      goto CastError;
+    }
+  }
+}
+
+Cast<Zero|PromiseReaction>(implicit context: Context)(o: Object): Zero|
+    PromiseReaction labels CastError {
+  typeswitch (o) {
+    case (o: Zero): {
+      return o;
+    }
+    case (o: PromiseReaction): {
+      return o;
+    }
+    case (Object): {
+      goto CastError;
+    }
+  }
+}
+
+Cast<JSBoundFunction>(o: HeapObject): JSBoundFunction labels CastError {
+  if (IsJSBoundFunction(o)) return %RawDownCast<JSBoundFunction>(o);
+  goto CastError;
+}
+
+Cast<PromiseCapability>(o: HeapObject): PromiseCapability labels CastError {
+  if (IsPromiseCapability(o)) return %RawDownCast<PromiseCapability>(o);
+  goto CastError;
+}
+
+Cast<SharedFunctionInfo>(o: HeapObject): SharedFunctionInfo labels CastError {
+  if (IsSharedFunctionInfo(o)) return %RawDownCast<SharedFunctionInfo>(o);
+  goto CastError;
+}
+
+Cast<JSPromise>(o: HeapObject): JSPromise labels CastError {
+  if (IsJSPromise(o)) return %RawDownCast<JSPromise>(o);
+  goto CastError;
+}
+
+UnsafeCast<RegExpMatchInfo>(implicit context: Context)(o: Object):
+    RegExpMatchInfo {
+  assert(Is<FixedArray>(o));
+  return %RawDownCast<RegExpMatchInfo>(o);
+}
diff --git a/deps/v8/src/builtins/collections.tq b/deps/v8/src/builtins/collections.tq
index 47d9ec664a65f4..60136af63365ec 100644
--- a/deps/v8/src/builtins/collections.tq
+++ b/deps/v8/src/builtins/collections.tq
@@ -37,7 +37,7 @@ namespace collections {
         goto MayHaveSideEffects;
       }
       case (o: JSAny): deferred {
-        ThrowTypeError(kIteratorValueNotAnObject, o);
+        ThrowTypeError(MessageTemplate::kIteratorValueNotAnObject, o);
       }
     }
   }
diff --git a/deps/v8/src/builtins/console.tq b/deps/v8/src/builtins/console.tq
new file mode 100644
index 00000000000000..48d5d08abc4f87
--- /dev/null
+++ b/deps/v8/src/builtins/console.tq
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace console {
+  extern builtin ConsoleAssert(implicit context:
+                                   Context)(JSFunction, JSAny, int32): JSAny;
+
+  javascript builtin FastConsoleAssert(
+      js-implicit context: NativeContext, receiver: JSAny, newTarget: JSAny,
+      target: JSFunction)(...arguments): JSAny {
+    if (ToBoolean(arguments[0])) {
+      return Undefined;
+    } else {
+      tail ConsoleAssert(target, newTarget, Convert<int32>(arguments.length));
+    }
+  }
+}
diff --git a/deps/v8/src/builtins/convert.tq b/deps/v8/src/builtins/convert.tq
new file mode 100644
index 00000000000000..fe44fe128727c3
--- /dev/null
+++ b/deps/v8/src/builtins/convert.tq
@@ -0,0 +1,272 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+intrinsic %FromConstexpr<To: type, From: type>(b: From): To;
+macro FromConstexpr<To: type, From: type>(o: From): To;
+FromConstexpr<int31, constexpr int31>(i: constexpr int31): int31 {
+  return %FromConstexpr<int31>(i);
+}
+FromConstexpr<int32, constexpr int31>(i: constexpr int31): int32 {
+  return %FromConstexpr<int32>(i);
+}
+FromConstexpr<int32, constexpr int32>(i: constexpr int32): int32 {
+  return %FromConstexpr<int32>(i);
+}
+FromConstexpr<intptr, constexpr int31>(i: constexpr int31): intptr {
+  return %FromConstexpr<intptr>(i);
+}
+FromConstexpr<intptr, constexpr int32>(i: constexpr int32): intptr {
+  return %FromConstexpr<intptr>(i);
+}
+FromConstexpr<intptr, constexpr intptr>(i: constexpr intptr): intptr {
+  return %FromConstexpr<intptr>(i);
+}
+FromConstexpr<uintptr, constexpr uintptr>(i: constexpr uintptr): uintptr {
+  return %FromConstexpr<uintptr>(i);
+}
+FromConstexpr<Smi, constexpr int31>(i: constexpr int31): Smi {
+  return %FromConstexpr<Smi>(i);
+}
+FromConstexpr<PositiveSmi, constexpr int31>(i: constexpr int31): PositiveSmi {
+  assert(i >= 0);
+  return %FromConstexpr<PositiveSmi>(i);
+}
+FromConstexpr<String, constexpr string>(s: constexpr string): String {
+  return %FromConstexpr<String>(s);
+}
+FromConstexpr<Number, constexpr uint32>(i: constexpr uint32): Number {
+  return %FromConstexpr<Number>(i);
+}
+FromConstexpr<Number, constexpr int32>(i: constexpr int32): Number {
+  return %FromConstexpr<Number>(i);
+}
+FromConstexpr<Number, constexpr float64>(f: constexpr float64): Number {
+  return %FromConstexpr<Number>(f);
+}
+FromConstexpr<Number, constexpr int31>(i: constexpr int31): Number {
+  return %FromConstexpr<Number>(i);
+}
+FromConstexpr<uint8, constexpr int31>(i: constexpr int31): uint8 {
+  const i: uint32 = i;
+  StaticAssert(i <= 255);
+  return %RawDownCast<uint8>(i);
+}
+FromConstexpr<Number, constexpr Smi>(s: constexpr Smi): Number {
+  return SmiConstant(s);
+}
+FromConstexpr<Smi, constexpr Smi>(s: constexpr Smi): Smi {
+  return SmiConstant(s);
+}
+FromConstexpr<uint32, constexpr int31>(i: constexpr int31): uint32 {
+  return Unsigned(Int32Constant(i));
+}
+FromConstexpr<uint32, constexpr uint32>(i: constexpr uint32): uint32 {
+  return Unsigned(%FromConstexpr<int32>(i));
+}
+FromConstexpr<uintptr, constexpr int31>(i: constexpr int31): uintptr {
+  return ChangeUint32ToWord(i);
+}
+FromConstexpr<float64, constexpr int31>(i: constexpr int31): float64 {
+  return Float64Constant(i);
+}
+FromConstexpr<float64, constexpr float64>(i: constexpr float64): float64 {
+  return Float64Constant(i);
+}
+FromConstexpr<bool, constexpr bool>(b: constexpr bool): bool {
+  return BoolConstant(b);
+}
+FromConstexpr<Object, constexpr string>(s: constexpr string): Object {
+  return StringConstant(s);
+}
+FromConstexpr<JSAny, constexpr string>(s: constexpr string): JSAny {
+  return StringConstant(s);
+}
+FromConstexpr<ContextSlot, constexpr ContextSlot>(c: constexpr ContextSlot):
+    ContextSlot {
+  return IntPtrConstant(c);
+}
+FromConstexpr<LanguageModeSmi, constexpr LanguageMode>(
+    c: constexpr LanguageMode): LanguageModeSmi {
+  return %RawDownCast<LanguageModeSmi>(SmiConstant(c));
+}
+
+macro Convert<To: type, From: type>(i: From): To {
+  return i;
+}
+
+macro Convert<To: type, From: type>(i: From): To labels Overflow {
+  return i;
+}
+
+extern macro ConvertElementsKindToInt(ElementsKind): int32;
+Convert<int32, ElementsKind>(elementsKind: ElementsKind): int32 {
+  return ConvertElementsKindToInt(elementsKind);
+}
+Convert<Number, int32>(i: int32): Number {
+  return ChangeInt32ToTagged(i);
+}
+Convert<intptr, int32>(i: int32): intptr {
+  return ChangeInt32ToIntPtr(i);
+}
+Convert<intptr, uint32>(i: uint32): intptr {
+  return Signed(ChangeUint32ToWord(i));
+}
+Convert<Smi, int32>(i: int32): Smi {
+  return SmiFromInt32(i);
+}
+Convert<Number, uint32>(ui: uint32): Number {
+  return ChangeUint32ToTagged(ui);
+}
+Convert<Smi, uint32>(ui: uint32): Smi {
+  return SmiFromUint32(ui);
+}
+Convert<uintptr, uint32>(ui: uint32): uintptr {
+  return ChangeUint32ToWord(ui);
+}
+Convert<intptr, uint16>(ui: uint16): intptr {
+  return Signed(ChangeUint32ToWord(ui));
+}
+Convert<intptr, uint8>(ui: uint8): intptr {
+  return Signed(ChangeUint32ToWord(ui));
+}
+Convert<uint8, intptr>(i: intptr): uint8 {
+  return %RawDownCast<uint8>(Unsigned(TruncateIntPtrToInt32(i)) & 0xFF);
+}
+Convert<int32, uint8>(i: uint8): int32 {
+  return Signed(Convert<uint32>(i));
+}
+Convert<int32, uint16>(i: uint16): int32 {
+  return Signed(Convert<uint32>(i));
+}
+Convert<int32, uint31>(i: uint31): int32 {
+  return Signed(Convert<uint32>(i));
+}
+Convert<int32, intptr>(i: intptr): int32 {
+  return TruncateIntPtrToInt32(i);
+}
+Convert<int32, Number>(n: Number): int32 {
+  typeswitch (n) {
+    case (s: Smi): {
+      return Convert<int32>(s);
+    }
+    case (h: HeapNumber): {
+      return TruncateHeapNumberValueToWord32(h);
+    }
+  }
+}
+
+Convert<Smi, intptr>(i: intptr): Smi {
+  return SmiTag(i);
+}
+Convert<uint32, uintptr>(ui: uintptr): uint32 {
+  return Unsigned(TruncateIntPtrToInt32(Signed(ui)));
+}
+Convert<intptr, Smi>(s: Smi): intptr {
+  return SmiUntag(s);
+}
+Convert<uintptr, PositiveSmi>(ps: PositiveSmi): uintptr {
+  return Unsigned(SmiUntag(ps));
+}
+Convert<intptr, uintptr>(ui: uintptr): intptr {
+  const i = Signed(ui);
+  assert(i >= 0);
+  return i;
+}
+Convert<PositiveSmi, intptr>(i: intptr): PositiveSmi {
+  assert(IsValidPositiveSmi(i));
+  return %RawDownCast<PositiveSmi>(SmiTag(i));
+}
+Convert<PositiveSmi, uintptr>(ui: uintptr): PositiveSmi labels IfOverflow {
+  if (ui > kSmiMaxValue) deferred {
+      goto IfOverflow;
+    }
+  return %RawDownCast<PositiveSmi>(SmiTag(Signed(ui)));
+}
+Convert<PositiveSmi, intptr>(i: intptr): PositiveSmi labels IfOverflow {
+  if (IsValidPositiveSmi(i)) {
+    return %RawDownCast<PositiveSmi>(SmiTag(i));
+  } else
+    deferred {
+      goto IfOverflow;
+    }
+}
+Convert<int32, Smi>(s: Smi): int32 {
+  return SmiToInt32(s);
+}
+Convert<float64, HeapNumber>(h: HeapNumber): float64 {
+  return LoadHeapNumberValue(h);
+}
+Convert<float64, Number>(n: Number): float64 {
+  return ChangeNumberToFloat64(n);
+}
+Convert<uintptr, Number>(n: Number): uintptr {
+  return ChangeUintPtrNumberToUintPtr(n);
+}
+Convert<float64, float32>(f: float32): float64 {
+  return ChangeFloat32ToFloat64(f);
+}
+Convert<float64_or_hole, float64>(f: float64): float64_or_hole {
+  return float64_or_hole{is_hole: false, value: f};
+}
+Convert<float64_or_hole, Number>(n: Number): float64_or_hole {
+  return Convert<float64_or_hole>(Convert<float64>(n));
+}
+Convert<float32, float64>(f: float64): float32 {
+  return TruncateFloat64ToFloat32(f);
+}
+Convert<float32, Number>(n: Number): float32 {
+  return Convert<float32>(ChangeNumberToFloat64(n));
+}
+Convert<Number, float64>(d: float64): Number {
+  return ChangeFloat64ToTagged(d);
+}
+Convert<float64, uintptr>(ui: uintptr): float64 {
+  return ChangeUintPtrToFloat64(ui);
+}
+Convert<Number, uintptr>(ui: uintptr): Number {
+  return ChangeUintPtrToTagged(ui);
+}
+Convert<Number, intptr>(i: intptr): Number {
+  return ChangeUintPtrToTagged(Unsigned(i));
+}
+Convert<uintptr, float64>(d: float64): uintptr {
+  return ChangeFloat64ToUintPtr(d);
+}
+Convert<uintptr, intptr>(i: intptr): uintptr {
+  return Unsigned(i);
+}
+Convert<uintptr, RawPtr>(r: RawPtr): uintptr {
+  return Unsigned(r);
+}
+Convert<intptr, RawPtr>(r: RawPtr): intptr {
+  return Signed(r);
+}
+Convert<intptr, Number>(n: Number): intptr {
+  return ChangeFloat64ToIntPtr(ChangeNumberToFloat64(n));
+}
+Convert<bint, int32>(v: int32): bint {
+  return IntPtrToBInt(Convert<intptr>(v));
+}
+extern macro IntPtrToBInt(intptr): bint;
+Convert<bint, intptr>(v: intptr): bint {
+  return IntPtrToBInt(v);
+}
+extern macro BIntToIntPtr(bint): intptr;
+Convert<intptr, bint>(v: bint): intptr {
+  return BIntToIntPtr(v);
+}
+extern macro SmiToBInt(Smi): bint;
+Convert<bint, Smi>(v: Smi): bint {
+  return SmiToBInt(v);
+}
+extern macro BIntToSmi(bint): Smi;
+Convert<Smi, bint>(v: bint): Smi {
+  return BIntToSmi(v);
+}
+Convert<PromiseState, int32>(s: int32): PromiseState {
+  return %RawDownCast<PromiseState>(s);
+}
+Convert<ScopeFlags, Smi>(s: Smi): ScopeFlags {
+  return %RawDownCast<ScopeFlags>(Unsigned(SmiToInt32(s)));
+}
diff --git a/deps/v8/src/builtins/data-view.tq b/deps/v8/src/builtins/data-view.tq
index 2cf06095611bdf..c5808dfd9de727 100644
--- a/deps/v8/src/builtins/data-view.tq
+++ b/deps/v8/src/builtins/data-view.tq
@@ -7,25 +7,25 @@
 namespace data_view {
 
   macro MakeDataViewGetterNameString(kind: constexpr ElementsKind): String {
-    if constexpr (kind == UINT8_ELEMENTS) {
+    if constexpr (kind == ElementsKind::UINT8_ELEMENTS) {
       return 'DataView.prototype.getUint8';
-    } else if constexpr (kind == INT8_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::INT8_ELEMENTS) {
       return 'DataView.prototype.getInt8';
-    } else if constexpr (kind == UINT16_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::UINT16_ELEMENTS) {
       return 'DataView.prototype.getUint16';
-    } else if constexpr (kind == INT16_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::INT16_ELEMENTS) {
       return 'DataView.prototype.getInt16';
-    } else if constexpr (kind == UINT32_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::UINT32_ELEMENTS) {
       return 'DataView.prototype.getUint32';
-    } else if constexpr (kind == INT32_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::INT32_ELEMENTS) {
       return 'DataView.prototype.getInt32';
-    } else if constexpr (kind == FLOAT32_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
       return 'DataView.prototype.getFloat32';
-    } else if constexpr (kind == FLOAT64_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::FLOAT64_ELEMENTS) {
       return 'DataView.prototype.getFloat64';
-    } else if constexpr (kind == BIGINT64_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::BIGINT64_ELEMENTS) {
       return 'DataView.prototype.getBigInt64';
-    } else if constexpr (kind == BIGUINT64_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::BIGUINT64_ELEMENTS) {
       return 'DataView.prototype.getBigUint64';
     } else {
       unreachable;
@@ -33,25 +33,25 @@ namespace data_view {
   }
 
   macro MakeDataViewSetterNameString(kind: constexpr ElementsKind): String {
-    if constexpr (kind == UINT8_ELEMENTS) {
+    if constexpr (kind == ElementsKind::UINT8_ELEMENTS) {
       return 'DataView.prototype.setUint8';
-    } else if constexpr (kind == INT8_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::INT8_ELEMENTS) {
       return 'DataView.prototype.setInt8';
-    } else if constexpr (kind == UINT16_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::UINT16_ELEMENTS) {
       return 'DataView.prototype.setUint16';
-    } else if constexpr (kind == INT16_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::INT16_ELEMENTS) {
       return 'DataView.prototype.setInt16';
-    } else if constexpr (kind == UINT32_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::UINT32_ELEMENTS) {
       return 'DataView.prototype.setUint32';
-    } else if constexpr (kind == INT32_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::INT32_ELEMENTS) {
       return 'DataView.prototype.setInt32';
-    } else if constexpr (kind == FLOAT32_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
       return 'DataView.prototype.setFloat32';
-    } else if constexpr (kind == FLOAT64_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::FLOAT64_ELEMENTS) {
       return 'DataView.prototype.setFloat64';
-    } else if constexpr (kind == BIGINT64_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::BIGINT64_ELEMENTS) {
       return 'DataView.prototype.setBigInt64';
-    } else if constexpr (kind == BIGUINT64_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::BIGUINT64_ELEMENTS) {
       return 'DataView.prototype.setBigUint64';
     } else {
       unreachable;
@@ -68,13 +68,13 @@ namespace data_view {
       return Cast<JSDataView>(o) otherwise CastError;
     }
     label CastError {
-      ThrowTypeError(kIncompatibleMethodReceiver, method);
+      ThrowTypeError(MessageTemplate::kIncompatibleMethodReceiver, method);
     }
   }
 
   // ES6 section 24.2.4.1 get DataView.prototype.buffer
   javascript builtin DataViewPrototypeGetBuffer(
-      js-implicit context: Context,
+      js-implicit context: NativeContext,
       receiver: JSAny)(...arguments): JSArrayBuffer {
     const dataView: JSDataView =
         ValidateDataView(context, receiver, 'get DataView.prototype.buffer');
@@ -83,7 +83,8 @@ namespace data_view {
 
   // ES6 section 24.2.4.2 get DataView.prototype.byteLength
   javascript builtin DataViewPrototypeGetByteLength(
-      js-implicit context: Context, receiver: JSAny)(...arguments): Number {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): Number {
     const dataView: JSDataView = ValidateDataView(
         context, receiver, 'get DataView.prototype.byte_length');
     if (WasDetached(dataView)) {
@@ -96,7 +97,8 @@ namespace data_view {
 
   // ES6 section 24.2.4.3 get DataView.prototype.byteOffset
   javascript builtin DataViewPrototypeGetByteOffset(
-      js-implicit context: Context, receiver: JSAny)(...arguments): Number {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): Number {
     const dataView: JSDataView = ValidateDataView(
         context, receiver, 'get DataView.prototype.byte_offset');
     if (WasDetached(dataView)) {
@@ -170,11 +172,11 @@ namespace data_view {
       result = (b0 << 24) | (b1 << 16) | (b2 << 8) | b3;
     }
 
-    if constexpr (kind == INT32_ELEMENTS) {
+    if constexpr (kind == ElementsKind::INT32_ELEMENTS) {
       return Convert<Number>(Signed(result));
-    } else if constexpr (kind == UINT32_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::UINT32_ELEMENTS) {
       return Convert<Number>(result);
-    } else if constexpr (kind == FLOAT32_ELEMENTS) {
+    } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
       const floatRes: float64 = Convert<float64>(BitcastInt32ToFloat32(result));
       return Convert<Number>(floatRes);
     } else {
@@ -351,152 +353,184 @@ namespace data_view {
     return MakeBigInt(lowWord, highWord, signed);
   }
 
-  extern macro ToSmiIndex(JSAny, Context): Smi
-      labels RangeError;
   extern macro DataViewBuiltinsAssembler::DataViewElementSize(
       constexpr ElementsKind): constexpr int31;
 
+  // GetViewValue ( view, requestIndex, isLittleEndian, type )
+  // https://tc39.es/ecma262/#sec-getviewvalue
   transitioning macro DataViewGet(
-      context: Context, receiver: JSAny, offset: JSAny,
+      context: Context, receiver: JSAny, requestIndex: JSAny,
       requestedLittleEndian: JSAny, kind: constexpr ElementsKind): Numeric {
+    // 1. Perform ? RequireInternalSlot(view, [[DataView]]).
+    // 2. Assert: view has a [[ViewedArrayBuffer]] internal slot.
     const dataView: JSDataView =
         ValidateDataView(context, receiver, MakeDataViewGetterNameString(kind));
 
-    let getIndex: Number;
     try {
-      getIndex = ToIndex(offset, context) otherwise RangeError;
-    }
-    label RangeError {
-      ThrowRangeError(kInvalidDataViewAccessorOffset);
-    }
+      // 3. Let getIndex be ? ToIndex(requestIndex).
+      const getIndex: uintptr = ToIndex(requestIndex) otherwise RangeError;
 
-    const littleEndian: bool = ToBoolean(requestedLittleEndian);
-    const buffer: JSArrayBuffer = dataView.buffer;
-
-    if (IsDetachedBuffer(buffer)) {
-      ThrowTypeError(kDetachedOperation, MakeDataViewGetterNameString(kind));
-    }
+      // 4. Set isLittleEndian to ! ToBoolean(isLittleEndian).
+      const littleEndian: bool = ToBoolean(requestedLittleEndian);
 
-    const getIndexFloat: float64 = Convert<float64>(getIndex);
-    const getIndexWord: uintptr = Convert<uintptr>(getIndexFloat);
+      // 5. Let buffer be view.[[ViewedArrayBuffer]].
+      const buffer: JSArrayBuffer = dataView.buffer;
 
-    const viewOffsetWord: uintptr = dataView.byte_offset;
-    const viewSizeFloat: float64 = Convert<float64>(dataView.byte_length);
-    const elementSizeFloat: float64 = DataViewElementSize(kind);
+      // 6. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+      if (IsDetachedBuffer(buffer)) {
+        ThrowTypeError(
+            MessageTemplate::kDetachedOperation,
+            MakeDataViewGetterNameString(kind));
+      }
 
-    if (getIndexFloat + elementSizeFloat > viewSizeFloat) {
-      ThrowRangeError(kInvalidDataViewAccessorOffset);
+      // 7. Let viewOffset be view.[[ByteOffset]].
+      const viewOffset: uintptr = dataView.byte_offset;
+
+      // 8. Let viewSize be view.[[ByteLength]].
+      const viewSize: uintptr = dataView.byte_length;
+
+      // 9. Let elementSize be the Element Size value specified in Table 62
+      // for Element Type type.
+      const elementSize: uintptr = DataViewElementSize(kind);
+
+      // 10. If getIndex + elementSize > viewSize, throw a RangeError exception.
+      CheckIntegerIndexAdditionOverflow(getIndex, elementSize, viewSize)
+          otherwise RangeError;
+
+      // 11. Let bufferIndex be getIndex + viewOffset.
+      const bufferIndex: uintptr = getIndex + viewOffset;
+
+      if constexpr (kind == ElementsKind::UINT8_ELEMENTS) {
+        return LoadDataView8(buffer, bufferIndex, false);
+      } else if constexpr (kind == ElementsKind::INT8_ELEMENTS) {
+        return LoadDataView8(buffer, bufferIndex, true);
+      } else if constexpr (kind == ElementsKind::UINT16_ELEMENTS) {
+        return LoadDataView16(buffer, bufferIndex, littleEndian, false);
+      } else if constexpr (kind == ElementsKind::INT16_ELEMENTS) {
+        return LoadDataView16(buffer, bufferIndex, littleEndian, true);
+      } else if constexpr (kind == ElementsKind::UINT32_ELEMENTS) {
+        return LoadDataView32(buffer, bufferIndex, littleEndian, kind);
+      } else if constexpr (kind == ElementsKind::INT32_ELEMENTS) {
+        return LoadDataView32(buffer, bufferIndex, littleEndian, kind);
+      } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
+        return LoadDataView32(buffer, bufferIndex, littleEndian, kind);
+      } else if constexpr (kind == ElementsKind::FLOAT64_ELEMENTS) {
+        return LoadDataViewFloat64(buffer, bufferIndex, littleEndian);
+      } else if constexpr (kind == ElementsKind::BIGUINT64_ELEMENTS) {
+        return LoadDataViewBigInt(buffer, bufferIndex, littleEndian, false);
+      } else if constexpr (kind == ElementsKind::BIGINT64_ELEMENTS) {
+        return LoadDataViewBigInt(buffer, bufferIndex, littleEndian, true);
+      } else {
+        unreachable;
+      }
     }
-
-    const bufferIndex: uintptr = getIndexWord + viewOffsetWord;
-
-    if constexpr (kind == UINT8_ELEMENTS) {
-      return LoadDataView8(buffer, bufferIndex, false);
-    } else if constexpr (kind == INT8_ELEMENTS) {
-      return LoadDataView8(buffer, bufferIndex, true);
-    } else if constexpr (kind == UINT16_ELEMENTS) {
-      return LoadDataView16(buffer, bufferIndex, littleEndian, false);
-    } else if constexpr (kind == INT16_ELEMENTS) {
-      return LoadDataView16(buffer, bufferIndex, littleEndian, true);
-    } else if constexpr (kind == UINT32_ELEMENTS) {
-      return LoadDataView32(buffer, bufferIndex, littleEndian, kind);
-    } else if constexpr (kind == INT32_ELEMENTS) {
-      return LoadDataView32(buffer, bufferIndex, littleEndian, kind);
-    } else if constexpr (kind == FLOAT32_ELEMENTS) {
-      return LoadDataView32(buffer, bufferIndex, littleEndian, kind);
-    } else if constexpr (kind == FLOAT64_ELEMENTS) {
-      return LoadDataViewFloat64(buffer, bufferIndex, littleEndian);
-    } else if constexpr (kind == BIGUINT64_ELEMENTS) {
-      return LoadDataViewBigInt(buffer, bufferIndex, littleEndian, false);
-    } else if constexpr (kind == BIGINT64_ELEMENTS) {
-      return LoadDataViewBigInt(buffer, bufferIndex, littleEndian, true);
-    } else {
-      unreachable;
+    label RangeError {
+      ThrowRangeError(MessageTemplate::kInvalidDataViewAccessorOffset);
     }
   }
 
   transitioning javascript builtin DataViewPrototypeGetUint8(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    return DataViewGet(context, receiver, offset, Undefined, UINT8_ELEMENTS);
+    return DataViewGet(
+        context, receiver, offset, Undefined, ElementsKind::UINT8_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeGetInt8(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    return DataViewGet(context, receiver, offset, Undefined, INT8_ELEMENTS);
+    return DataViewGet(
+        context, receiver, offset, Undefined, ElementsKind::INT8_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeGetUint16(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 1 ? arguments[1] : Undefined;
     return DataViewGet(
-        context, receiver, offset, isLittleEndian, UINT16_ELEMENTS);
+        context, receiver, offset, isLittleEndian,
+        ElementsKind::UINT16_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeGetInt16(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 1 ? arguments[1] : Undefined;
     return DataViewGet(
-        context, receiver, offset, isLittleEndian, INT16_ELEMENTS);
+        context, receiver, offset, isLittleEndian,
+        ElementsKind::INT16_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeGetUint32(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 1 ? arguments[1] : Undefined;
     return DataViewGet(
-        context, receiver, offset, isLittleEndian, UINT32_ELEMENTS);
+        context, receiver, offset, isLittleEndian,
+        ElementsKind::UINT32_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeGetInt32(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 1 ? arguments[1] : Undefined;
     return DataViewGet(
-        context, receiver, offset, isLittleEndian, INT32_ELEMENTS);
+        context, receiver, offset, isLittleEndian,
+        ElementsKind::INT32_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeGetFloat32(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 1 ? arguments[1] : Undefined;
     return DataViewGet(
-        context, receiver, offset, isLittleEndian, FLOAT32_ELEMENTS);
+        context, receiver, offset, isLittleEndian,
+        ElementsKind::FLOAT32_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeGetFloat64(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 1 ? arguments[1] : Undefined;
     return DataViewGet(
-        context, receiver, offset, isLittleEndian, FLOAT64_ELEMENTS);
+        context, receiver, offset, isLittleEndian,
+        ElementsKind::FLOAT64_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeGetBigUint64(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 1 ? arguments[1] : Undefined;
     return DataViewGet(
-        context, receiver, offset, isLittleEndian, BIGUINT64_ELEMENTS);
+        context, receiver, offset, isLittleEndian,
+        ElementsKind::BIGUINT64_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeGetBigInt64(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 1 ? arguments[1] : Undefined;
     return DataViewGet(
-        context, receiver, offset, isLittleEndian, BIGINT64_ELEMENTS);
+        context, receiver, offset, isLittleEndian,
+        ElementsKind::BIGINT64_ELEMENTS);
   }
 
   extern macro ToNumber(Context, JSAny): Number;
@@ -631,185 +665,218 @@ namespace data_view {
     StoreDataView64(buffer, offset, lowWord, highWord, requestedLittleEndian);
   }
 
+  // SetViewValue ( view, requestIndex, isLittleEndian, type, value )
+  // https://tc39.es/ecma262/#sec-setviewvalue
   transitioning macro DataViewSet(
-      context: Context, receiver: JSAny, offset: JSAny, value: JSAny,
+      context: Context, receiver: JSAny, requestIndex: JSAny, value: JSAny,
       requestedLittleEndian: JSAny, kind: constexpr ElementsKind): JSAny {
+    // 1. Perform ? RequireInternalSlot(view, [[DataView]]).
+    // 2. Assert: view has a [[ViewedArrayBuffer]] internal slot.
     const dataView: JSDataView =
         ValidateDataView(context, receiver, MakeDataViewSetterNameString(kind));
 
-    let getIndex: Number;
     try {
-      getIndex = ToIndex(offset, context) otherwise RangeError;
-    }
-    label RangeError {
-      ThrowRangeError(kInvalidDataViewAccessorOffset);
-    }
-
-    const littleEndian: bool = ToBoolean(requestedLittleEndian);
-    const buffer: JSArrayBuffer = dataView.buffer;
-
-    // According to ES6 section 24.2.1.2 SetViewValue, we must perform
-    // the conversion before doing the bounds check.
-    if constexpr (kind == BIGUINT64_ELEMENTS || kind == BIGINT64_ELEMENTS) {
-      const bigIntValue: BigInt = ToBigInt(context, value);
+      // 3. Let getIndex be ? ToIndex(requestIndex).
+      const getIndex: uintptr = ToIndex(requestIndex) otherwise RangeError;
+
+      const littleEndian: bool = ToBoolean(requestedLittleEndian);
+      const buffer: JSArrayBuffer = dataView.buffer;
+
+      let numberValue: Numeric;
+      if constexpr (
+          kind == ElementsKind::BIGUINT64_ELEMENTS ||
+          kind == ElementsKind::BIGINT64_ELEMENTS) {
+        // 4. If ! IsBigIntElementType(type) is true, let numberValue be
+        // ? ToBigInt(value).
+        numberValue = ToBigInt(context, value);
+      } else {
+        // 5. Otherwise, let numberValue be ? ToNumber(value).
+        numberValue = ToNumber(context, value);
+      }
 
+      // 6. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
       if (IsDetachedBuffer(buffer)) {
-        ThrowTypeError(kDetachedOperation, MakeDataViewSetterNameString(kind));
+        ThrowTypeError(
+            MessageTemplate::kDetachedOperation,
+            MakeDataViewSetterNameString(kind));
       }
 
-      const getIndexFloat: float64 = Convert<float64>(getIndex);
-      const getIndexWord: uintptr = Convert<uintptr>(getIndexFloat);
+      // 9. Let viewOffset be view.[[ByteOffset]].
+      const viewOffset: uintptr = dataView.byte_offset;
 
-      const viewOffsetWord: uintptr = dataView.byte_offset;
-      const viewSizeFloat: float64 = Convert<float64>(dataView.byte_length);
-      const elementSizeFloat: float64 = DataViewElementSize(kind);
+      // 10. Let viewSize be view.[[ByteLength]].
+      const viewSize: uintptr = dataView.byte_length;
 
-      if (getIndexFloat + elementSizeFloat > viewSizeFloat) {
-        ThrowRangeError(kInvalidDataViewAccessorOffset);
-      }
+      // 11. Let elementSize be the Element Size value specified in Table 62
+      // for Element Type type.
+      const elementSize: uintptr = DataViewElementSize(kind);
 
-      const bufferIndex: uintptr = getIndexWord + viewOffsetWord;
-      StoreDataViewBigInt(buffer, bufferIndex, bigIntValue, littleEndian);
-    } else {
-      const numValue: Number = ToNumber(context, value);
+      // 12. If getIndex + elementSize > viewSize, throw a RangeError exception.
+      CheckIntegerIndexAdditionOverflow(getIndex, elementSize, viewSize)
+          otherwise RangeError;
 
-      if (IsDetachedBuffer(buffer)) {
-        ThrowTypeError(kDetachedOperation, MakeDataViewSetterNameString(kind));
-      }
+      // 13. Let bufferIndex be getIndex + viewOffset.
+      const bufferIndex: uintptr = getIndex + viewOffset;
 
-      const getIndexFloat: float64 = Convert<float64>(getIndex);
-      const getIndexWord: uintptr = Convert<uintptr>(getIndexFloat);
-
-      const viewOffsetWord: uintptr = dataView.byte_offset;
-      const viewSizeFloat: float64 = Convert<float64>(dataView.byte_length);
-      const elementSizeFloat: float64 = DataViewElementSize(kind);
-
-      if (getIndexFloat + elementSizeFloat > viewSizeFloat) {
-        ThrowRangeError(kInvalidDataViewAccessorOffset);
-      }
-
-      const bufferIndex: uintptr = getIndexWord + viewOffsetWord;
-
-      const doubleValue: float64 = ChangeNumberToFloat64(numValue);
-
-      if constexpr (kind == UINT8_ELEMENTS || kind == INT8_ELEMENTS) {
-        StoreDataView8(
-            buffer, bufferIndex, TruncateFloat64ToWord32(doubleValue));
-      } else if constexpr (kind == UINT16_ELEMENTS || kind == INT16_ELEMENTS) {
-        StoreDataView16(
-            buffer, bufferIndex, TruncateFloat64ToWord32(doubleValue),
-            littleEndian);
-      } else if constexpr (kind == UINT32_ELEMENTS || kind == INT32_ELEMENTS) {
-        StoreDataView32(
-            buffer, bufferIndex, TruncateFloat64ToWord32(doubleValue),
-            littleEndian);
-      } else if constexpr (kind == FLOAT32_ELEMENTS) {
-        const floatValue: float32 = TruncateFloat64ToFloat32(doubleValue);
-        StoreDataView32(
-            buffer, bufferIndex, BitcastFloat32ToInt32(floatValue),
-            littleEndian);
-      } else if constexpr (kind == FLOAT64_ELEMENTS) {
-        const lowWord: uint32 = Float64ExtractLowWord32(doubleValue);
-        const highWord: uint32 = Float64ExtractHighWord32(doubleValue);
-        StoreDataView64(buffer, bufferIndex, lowWord, highWord, littleEndian);
+      if constexpr (
+          kind == ElementsKind::BIGUINT64_ELEMENTS ||
+          kind == ElementsKind::BIGINT64_ELEMENTS) {
+        // For these elements kinds numberValue is BigInt.
+        const bigIntValue: BigInt = %RawDownCast<BigInt>(numberValue);
+        StoreDataViewBigInt(buffer, bufferIndex, bigIntValue, littleEndian);
+      } else {
+        // For these elements kinds numberValue is Number.
+        const numValue: Number = %RawDownCast<Number>(numberValue);
+        const doubleValue: float64 = ChangeNumberToFloat64(numValue);
+
+        if constexpr (
+            kind == ElementsKind::UINT8_ELEMENTS ||
+            kind == ElementsKind::INT8_ELEMENTS) {
+          StoreDataView8(
+              buffer, bufferIndex, TruncateFloat64ToWord32(doubleValue));
+        } else if constexpr (
+            kind == ElementsKind::UINT16_ELEMENTS ||
+            kind == ElementsKind::INT16_ELEMENTS) {
+          StoreDataView16(
+              buffer, bufferIndex, TruncateFloat64ToWord32(doubleValue),
+              littleEndian);
+        } else if constexpr (
+            kind == ElementsKind::UINT32_ELEMENTS ||
+            kind == ElementsKind::INT32_ELEMENTS) {
+          StoreDataView32(
+              buffer, bufferIndex, TruncateFloat64ToWord32(doubleValue),
+              littleEndian);
+        } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
+          const floatValue: float32 = TruncateFloat64ToFloat32(doubleValue);
+          StoreDataView32(
+              buffer, bufferIndex, BitcastFloat32ToInt32(floatValue),
+              littleEndian);
+        } else if constexpr (kind == ElementsKind::FLOAT64_ELEMENTS) {
+          const lowWord: uint32 = Float64ExtractLowWord32(doubleValue);
+          const highWord: uint32 = Float64ExtractHighWord32(doubleValue);
+          StoreDataView64(buffer, bufferIndex, lowWord, highWord, littleEndian);
+        }
       }
+      return Undefined;
+    }
+    label RangeError {
+      ThrowRangeError(MessageTemplate::kInvalidDataViewAccessorOffset);
     }
-    return Undefined;
   }
 
   transitioning javascript builtin DataViewPrototypeSetUint8(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
     return DataViewSet(
-        context, receiver, offset, value, Undefined, UINT8_ELEMENTS);
+        context, receiver, offset, value, Undefined,
+        ElementsKind::UINT8_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeSetInt8(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
     return DataViewSet(
-        context, receiver, offset, value, Undefined, INT8_ELEMENTS);
+        context, receiver, offset, value, Undefined,
+        ElementsKind::INT8_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeSetUint16(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 2 ? arguments[2] : Undefined;
     return DataViewSet(
-        context, receiver, offset, value, isLittleEndian, UINT16_ELEMENTS);
+        context, receiver, offset, value, isLittleEndian,
+        ElementsKind::UINT16_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeSetInt16(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 2 ? arguments[2] : Undefined;
     return DataViewSet(
-        context, receiver, offset, value, isLittleEndian, INT16_ELEMENTS);
+        context, receiver, offset, value, isLittleEndian,
+        ElementsKind::INT16_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeSetUint32(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 2 ? arguments[2] : Undefined;
     return DataViewSet(
-        context, receiver, offset, value, isLittleEndian, UINT32_ELEMENTS);
+        context, receiver, offset, value, isLittleEndian,
+        ElementsKind::UINT32_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeSetInt32(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 2 ? arguments[2] : Undefined;
     return DataViewSet(
-        context, receiver, offset, value, isLittleEndian, INT32_ELEMENTS);
+        context, receiver, offset, value, isLittleEndian,
+        ElementsKind::INT32_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeSetFloat32(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 2 ? arguments[2] : Undefined;
     return DataViewSet(
-        context, receiver, offset, value, isLittleEndian, FLOAT32_ELEMENTS);
+        context, receiver, offset, value, isLittleEndian,
+        ElementsKind::FLOAT32_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeSetFloat64(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 2 ? arguments[2] : Undefined;
     return DataViewSet(
-        context, receiver, offset, value, isLittleEndian, FLOAT64_ELEMENTS);
+        context, receiver, offset, value, isLittleEndian,
+        ElementsKind::FLOAT64_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeSetBigUint64(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 2 ? arguments[2] : Undefined;
     return DataViewSet(
-        context, receiver, offset, value, isLittleEndian, BIGUINT64_ELEMENTS);
+        context, receiver, offset, value, isLittleEndian,
+        ElementsKind::BIGUINT64_ELEMENTS);
   }
 
   transitioning javascript builtin DataViewPrototypeSetBigInt64(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
     const isLittleEndian: JSAny =
         arguments.length > 2 ? arguments[2] : Undefined;
     return DataViewSet(
-        context, receiver, offset, value, isLittleEndian, BIGINT64_ELEMENTS);
+        context, receiver, offset, value, isLittleEndian,
+        ElementsKind::BIGINT64_ELEMENTS);
   }
 }
diff --git a/deps/v8/src/builtins/extras-utils.tq b/deps/v8/src/builtins/extras-utils.tq
deleted file mode 100644
index 0b48b962e2c46f..00000000000000
--- a/deps/v8/src/builtins/extras-utils.tq
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-namespace extras_utils {
-  extern runtime CreatePrivateSymbol(Context, JSAny): PrivateSymbol;
-  extern runtime PromiseMarkAsHandled(Context, JSAny): Undefined;
-  extern runtime PromiseStatus(Context, JSAny): Smi;
-
-  javascript builtin ExtrasUtilsCreatePrivateSymbol(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
-    return CreatePrivateSymbol(context, arguments[0]);
-  }
-
-  javascript builtin ExtrasUtilsMarkPromiseAsHandled(
-      js-implicit context: Context, receiver: JSAny)(...arguments): Undefined {
-    return PromiseMarkAsHandled(context, arguments[0]);
-  }
-
-  javascript builtin ExtrasUtilsPromiseState(
-      js-implicit context: Context, receiver: JSAny)(...arguments): Smi {
-    return PromiseStatus(context, arguments[0]);
-  }
-}
diff --git a/deps/v8/src/builtins/frame-arguments.tq b/deps/v8/src/builtins/frame-arguments.tq
new file mode 100644
index 00000000000000..d57b2f4f01ba90
--- /dev/null
+++ b/deps/v8/src/builtins/frame-arguments.tq
@@ -0,0 +1,64 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@export
+struct Arguments {
+  const frame: FrameWithArguments;
+  const base: RawPtr;
+  const length: intptr;
+}
+
+extern operator '[]' macro GetArgumentValue(Arguments, intptr): JSAny;
+extern macro GetFrameArguments(FrameWithArguments, intptr): Arguments;
+
+struct ArgumentsIterator {
+  macro Next(): Object labels NoMore {
+    if (this.current == this.arguments.length) goto NoMore;
+    return this.arguments[this.current++];
+  }
+  const arguments: Arguments;
+  current: intptr;
+}
+
+struct FrameWithArgumentsInfo {
+  const frame: FrameWithArguments;
+  const argument_count: bint;
+  const formal_parameter_count: bint;
+}
+
+// Calculates and returns the frame pointer, argument count and formal
+// parameter count to be used to access a function's parameters, taking
+// argument adapter frames into account.
+//
+// TODO(danno):
+// This macro is should only be used in builtins that can be called from
+// interpreted or JITted code, not from CSA/Torque builtins (the number of
+// returned formal parameters would be wrong).
+// It is difficult to actually check/assert this, since interpreted or JITted
+// frames are StandardFrames, but so are hand-written builtins. Doing that
+// more refined check would be prohibitively expensive.
+macro GetFrameWithArgumentsInfo(implicit context: Context)():
+    FrameWithArgumentsInfo {
+  const frame =
+      Cast<StandardFrame>(LoadParentFramePointer()) otherwise unreachable;
+  const f: JSFunction = frame.function;
+
+  const shared: SharedFunctionInfo = f.shared_function_info;
+  const formalParameterCount: bint =
+      Convert<bint>(Convert<int32>(shared.formal_parameter_count));
+  const argumentCount: bint = formalParameterCount;
+
+  const adaptor = Cast<ArgumentsAdaptorFrame>(frame.caller)
+      otherwise return FrameWithArgumentsInfo{
+    frame,
+    argument_count: argumentCount,
+    formal_parameter_count: formalParameterCount
+  };
+
+  return FrameWithArgumentsInfo{
+    frame: adaptor,
+    argument_count: Convert<bint>(adaptor.length),
+    formal_parameter_count: formalParameterCount
+  };
+}
diff --git a/deps/v8/src/builtins/frames.tq b/deps/v8/src/builtins/frames.tq
index 79f2a0ae010f78..ef01b67b76185f 100644
--- a/deps/v8/src/builtins/frames.tq
+++ b/deps/v8/src/builtins/frames.tq
@@ -33,8 +33,8 @@ type FrameBase extends RawPtr constexpr 'void*';
 type StandardFrame extends FrameBase constexpr 'void*';
 type ArgumentsAdaptorFrame extends FrameBase constexpr 'void*';
 type StubFrame extends FrameBase constexpr 'void*';
-type FrameWithArguments = StandardFrame | ArgumentsAdaptorFrame;
-type Frame = FrameWithArguments | StubFrame;
+type FrameWithArguments = StandardFrame|ArgumentsAdaptorFrame;
+type Frame = FrameWithArguments|StubFrame;
 
 extern macro LoadFramePointer(): Frame;
 extern macro LoadParentFramePointer(): Frame;
@@ -67,7 +67,7 @@ operator '.caller' macro LoadCallerFromFrame(f: Frame): Frame {
   return %RawDownCast<Frame>(result);
 }
 
-type ContextOrFrameType = Context | FrameType;
+type ContextOrFrameType = Context|FrameType;
 Cast<ContextOrFrameType>(implicit context: Context)(o: Object):
     ContextOrFrameType
     labels CastError {
@@ -105,7 +105,8 @@ operator '==' macro FrameTypeEquals(f1: FrameType, f2: FrameType): bool {
   return TaggedEqual(f1, f2);
 }
 
-macro Cast<A: type>(implicit context: Context)(o: Frame): A labels CastError;
+macro Cast<A : type extends Frame>(implicit context: Context)(o: Frame):
+    A labels CastError;
 Cast<StandardFrame>(implicit context: Context)(f: Frame):
     StandardFrame labels CastError {
   const o: HeapObject =
diff --git a/deps/v8/src/builtins/growable-fixed-array-gen.cc b/deps/v8/src/builtins/growable-fixed-array-gen.cc
index 4fc051eb14de55..487d01c060a0ec 100644
--- a/deps/v8/src/builtins/growable-fixed-array-gen.cc
+++ b/deps/v8/src/builtins/growable-fixed-array-gen.cc
@@ -9,9 +9,9 @@
 namespace v8 {
 namespace internal {
 
-void GrowableFixedArray::Push(TNode<Object> const value) {
-  TNode<IntPtrT> const length = var_length_.value();
-  TNode<IntPtrT> const capacity = var_capacity_.value();
+void GrowableFixedArray::Push(const TNode<Object> value) {
+  const TNode<IntPtrT> length = var_length_.value();
+  const TNode<IntPtrT> capacity = var_capacity_.value();
 
   Label grow(this), store(this);
   Branch(IntPtrEqual(capacity, length), &grow, &store);
@@ -26,25 +26,25 @@ void GrowableFixedArray::Push(TNode<Object> const value) {
 
   BIND(&store);
   {
-    TNode<FixedArray> const array = var_array_.value();
+    const TNode<FixedArray> array = var_array_.value();
     UnsafeStoreFixedArrayElement(array, length, value);
 
     var_length_ = IntPtrAdd(length, IntPtrConstant(1));
   }
 }
 
-TNode<JSArray> GrowableFixedArray::ToJSArray(TNode<Context> const context) {
+TNode<JSArray> GrowableFixedArray::ToJSArray(const TNode<Context> context) {
   const ElementsKind kind = PACKED_ELEMENTS;
 
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Map> const array_map = LoadJSArrayElementsMap(kind, native_context);
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Map> array_map = LoadJSArrayElementsMap(kind, native_context);
 
   // Shrink to fit if necessary.
   {
     Label next(this);
 
-    TNode<IntPtrT> const length = var_length_.value();
-    TNode<IntPtrT> const capacity = var_capacity_.value();
+    const TNode<IntPtrT> length = var_length_.value();
+    const TNode<IntPtrT> capacity = var_capacity_.value();
 
     GotoIf(WordEqual(length, capacity), &next);
 
@@ -55,8 +55,8 @@ TNode<JSArray> GrowableFixedArray::ToJSArray(TNode<Context> const context) {
     BIND(&next);
   }
 
-  TNode<Smi> const result_length = SmiTag(length());
-  TNode<JSArray> const result =
+  const TNode<Smi> result_length = SmiTag(length());
+  const TNode<JSArray> result =
       AllocateJSArray(array_map, var_array_.value(), result_length);
   return result;
 }
@@ -69,7 +69,7 @@ TNode<IntPtrT> GrowableFixedArray::NewCapacity(
   // Growth rate is analog to JSObject::NewElementsCapacity:
   // new_capacity = (current_capacity + (current_capacity >> 1)) + 16.
 
-  TNode<IntPtrT> const new_capacity =
+  const TNode<IntPtrT> new_capacity =
       IntPtrAdd(IntPtrAdd(current_capacity, WordShr(current_capacity, 1)),
                 IntPtrConstant(16));
 
@@ -77,12 +77,12 @@ TNode<IntPtrT> GrowableFixedArray::NewCapacity(
 }
 
 TNode<FixedArray> GrowableFixedArray::ResizeFixedArray(
-    TNode<IntPtrT> const element_count, TNode<IntPtrT> const new_capacity) {
+    const TNode<IntPtrT> element_count, const TNode<IntPtrT> new_capacity) {
   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(element_count, IntPtrConstant(0)));
   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(new_capacity, IntPtrConstant(0)));
   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(new_capacity, element_count));
 
-  TNode<FixedArray> const from_array = var_array_.value();
+  const TNode<FixedArray> from_array = var_array_.value();
 
   CodeStubAssembler::ExtractFixedArrayFlags flags;
   flags |= CodeStubAssembler::ExtractFixedArrayFlag::kFixedArrays;
diff --git a/deps/v8/src/builtins/growable-fixed-array-gen.h b/deps/v8/src/builtins/growable-fixed-array-gen.h
index 8f72429a97e3fc..6e5d2ac7683b76 100644
--- a/deps/v8/src/builtins/growable-fixed-array-gen.h
+++ b/deps/v8/src/builtins/growable-fixed-array-gen.h
@@ -30,17 +30,17 @@ class GrowableFixedArray : public CodeStubAssembler {
   TVariable<IntPtrT>* var_length() { return &var_length_; }
   TVariable<IntPtrT>* var_capacity() { return &var_capacity_; }
 
-  void Push(TNode<Object> const value);
+  void Push(const TNode<Object> value);
 
-  TNode<JSArray> ToJSArray(TNode<Context> const context);
+  TNode<JSArray> ToJSArray(const TNode<Context> context);
 
  private:
   TNode<IntPtrT> NewCapacity(TNode<IntPtrT> current_capacity);
 
   // Creates a new array with {new_capacity} and copies the first
   // {element_count} elements from the current array.
-  TNode<FixedArray> ResizeFixedArray(TNode<IntPtrT> const element_count,
-                                     TNode<IntPtrT> const new_capacity);
+  TNode<FixedArray> ResizeFixedArray(const TNode<IntPtrT> element_count,
+                                     const TNode<IntPtrT> new_capacity);
 
  private:
   TVariable<FixedArray> var_array_;
diff --git a/deps/v8/src/builtins/growable-fixed-array.tq b/deps/v8/src/builtins/growable-fixed-array.tq
index a11e3e6cbdc4ab..0666c39fd75e53 100644
--- a/deps/v8/src/builtins/growable-fixed-array.tq
+++ b/deps/v8/src/builtins/growable-fixed-array.tq
@@ -5,19 +5,18 @@
 namespace growable_fixed_array {
   // TODO(pwong): Support FixedTypedArrays.
   struct GrowableFixedArray {
-    Push(obj: Object) {
+    macro Push(obj: Object) {
       this.EnsureCapacity();
       this.array.objects[this.length++] = obj;
     }
-    ResizeFixedArray(newCapacity: intptr): FixedArray {
+    macro ResizeFixedArray(newCapacity: intptr): FixedArray {
       assert(this.length >= 0);
       assert(newCapacity >= 0);
       assert(newCapacity >= this.length);
       const first: intptr = 0;
-      return ExtractFixedArray(
-          this.array, first, this.length, newCapacity, kFixedArrays);
+      return ExtractFixedArray(this.array, first, this.length, newCapacity);
     }
-    EnsureCapacity() {
+    macro EnsureCapacity() {
       assert(this.length <= this.capacity);
       if (this.capacity == this.length) {
         // Growth rate is analog to JSObject::NewElementsCapacity:
@@ -26,15 +25,17 @@ namespace growable_fixed_array {
         this.array = this.ResizeFixedArray(this.capacity);
       }
     }
-    ToJSArray(implicit context: Context)(): JSArray {
+    macro ToJSArray(implicit context: Context)(): JSArray {
       const nativeContext: NativeContext = LoadNativeContext(context);
-      const map: Map = LoadJSArrayElementsMap(PACKED_ELEMENTS, nativeContext);
+      const map: Map =
+          LoadJSArrayElementsMap(ElementsKind::PACKED_ELEMENTS, nativeContext);
       const fixedArray: FixedArray = this.ResizeFixedArray(this.length);
       const lengthSmi = Convert<Smi>(this.length);
       return AllocateJSArray(map, fixedArray, lengthSmi);
     }
 
     array: FixedArray;
+    // TODO(v8:4153): make capacity and length uintptr
     capacity: intptr;
     length: intptr;
   }
diff --git a/deps/v8/src/builtins/ia32/builtins-ia32.cc b/deps/v8/src/builtins/ia32/builtins-ia32.cc
index 0885b6e633741d..739cdfdcdc778e 100644
--- a/deps/v8/src/builtins/ia32/builtins-ia32.cc
+++ b/deps/v8/src/builtins/ia32/builtins-ia32.cc
@@ -141,10 +141,9 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     // eax: number of arguments (untagged)
     // edi: constructor function
     // edx: new target
-    ParameterCount actual(eax);
     // Reload context from the frame.
     __ mov(esi, Operand(ebp, ConstructFrameConstants::kContextOffset));
-    __ InvokeFunction(edi, edx, actual, CALL_FUNCTION);
+    __ InvokeFunction(edi, edx, eax, CALL_FUNCTION);
 
     // Restore context from the frame.
     __ mov(esi, Operand(ebp, ConstructFrameConstants::kContextOffset));
@@ -298,8 +297,7 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
 
     // Restore and and call the constructor function.
     __ mov(edi, Operand(ebp, ConstructFrameConstants::kConstructorOffset));
-    ParameterCount actual(eax);
-    __ InvokeFunction(edi, edx, actual, CALL_FUNCTION);
+    __ InvokeFunction(edi, edx, eax, CALL_FUNCTION);
 
     // ----------- S t a t e -------------
     //  --                eax: constructor result
@@ -1139,7 +1137,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
   __ sub(start_address, Immediate(kSystemPointerSize));
   __ bind(&loop_check);
   __ cmp(start_address, array_limit);
-  __ j(greater, &loop_header, Label::kNear);
+  __ j(above, &loop_header, Label::kNear);
 }
 
 // static
@@ -1352,7 +1350,7 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   Label builtin_trampoline, trampoline_loaded;
   Smi interpreter_entry_return_pc_offset(
       masm->isolate()->heap()->interpreter_entry_return_pc_offset());
-  DCHECK_NE(interpreter_entry_return_pc_offset, Smi::kZero);
+  DCHECK_NE(interpreter_entry_return_pc_offset, Smi::zero());
 
   static constexpr Register scratch = ecx;
 
@@ -1449,78 +1447,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- eax : argument count (preserved for callee)
-  //  -- edx : new target (preserved for callee)
-  //  -- edi : target function (preserved for callee)
-  // -----------------------------------
-  Label failed;
-  {
-    FrameScope scope(masm, StackFrame::INTERNAL);
-    // Preserve argument count for later compare.
-    __ mov(ecx, eax);
-    // Push the number of arguments to the callee.
-    __ SmiTag(eax);
-    __ push(eax);
-    // Push a copy of the target function and the new target.
-    __ push(edi);
-    __ push(edx);
-
-    // The function.
-    __ push(edi);
-    // Copy arguments from caller (stdlib, foreign, heap).
-    Label args_done;
-    for (int j = 0; j < 4; ++j) {
-      Label over;
-      if (j < 3) {
-        __ cmp(ecx, Immediate(j));
-        __ j(not_equal, &over, Label::kNear);
-      }
-      for (int i = j - 1; i >= 0; --i) {
-        __ Push(Operand(ebp, StandardFrameConstants::kCallerSPOffset +
-                                 i * kSystemPointerSize));
-      }
-      for (int i = 0; i < 3 - j; ++i) {
-        __ PushRoot(RootIndex::kUndefinedValue);
-      }
-      if (j < 3) {
-        __ jmp(&args_done, Label::kNear);
-        __ bind(&over);
-      }
-    }
-    __ bind(&args_done);
-
-    // Call runtime, on success unwind frame, and parent frame.
-    __ CallRuntime(Runtime::kInstantiateAsmJs, 4);
-    // A smi 0 is returned on failure, an object on success.
-    __ JumpIfSmi(eax, &failed, Label::kNear);
-
-    __ Drop(2);
-    __ Pop(ecx);
-    __ SmiUntag(ecx);
-    scope.GenerateLeaveFrame();
-
-    __ PopReturnAddressTo(edx);
-    __ inc(ecx);
-    __ lea(esp, Operand(esp, ecx, times_system_pointer_size, 0));
-    __ PushReturnAddressFrom(edx);
-    __ ret(0);
-
-    __ bind(&failed);
-    // Restore target function and new target.
-    __ pop(edx);
-    __ pop(edi);
-    __ pop(eax);
-    __ SmiUntag(eax);
-  }
-  // On failure, tail call back to regular js by re-calling the function
-  // which has be reset to the compile lazy builtin.
-  static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
-  __ mov(ecx, FieldOperand(edi, JSFunction::kCodeOffset));
-  __ JumpCodeObject(ecx);
-}
-
 namespace {
 void Generate_ContinueToBuiltinHelper(MacroAssembler* masm,
                                       bool java_script_builtin,
@@ -1838,31 +1764,6 @@ void Builtins::Generate_ReflectConstruct(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 }
 
-void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- eax : argc
-  //  -- esp[0] : return address
-  //  -- esp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin InternalArray function should be a map.
-    __ mov(ecx, FieldOperand(edi, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ test(ecx, Immediate(kSmiTagMask));
-    __ Assert(not_zero,
-              AbortReason::kUnexpectedInitialMapForInternalArrayFunction);
-    __ CmpObjectType(ecx, MAP_TYPE, ecx);
-    __ Assert(equal,
-              AbortReason::kUnexpectedInitialMapForInternalArrayFunction);
-  }
-
-  // Run the native code for the InternalArray function called as a normal
-  // function.
-  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
-          RelocInfo::CODE_TARGET);
-}
-
 static void EnterArgumentsAdaptorFrame(MacroAssembler* masm) {
   __ push(ebp);
   __ mov(ebp, esp);
@@ -2009,7 +1910,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
     __ JumpIfSmi(edx, &new_target_not_constructor, Label::kNear);
     __ mov(scratch, FieldOperand(edx, HeapObject::kMapOffset));
     __ test_b(FieldOperand(scratch, Map::kBitFieldOffset),
-              Immediate(Map::IsConstructorBit::kMask));
+              Immediate(Map::Bits1::IsConstructorBit::kMask));
     __ j(not_zero, &new_target_constructor, Label::kNear);
     __ bind(&new_target_not_constructor);
     {
@@ -2031,7 +1932,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
          Immediate(StackFrame::TypeToMarker(StackFrame::ARGUMENTS_ADAPTOR)));
   __ j(equal, &arguments_adaptor, Label::kNear);
   {
-    __ mov(edx, Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
+    __ mov(edx, Operand(ebp, StandardFrameConstants::kFunctionOffset));
     __ mov(edx, FieldOperand(edx, JSFunction::kSharedFunctionInfoOffset));
     __ movzx_w(edx, FieldOperand(
                         edx, SharedFunctionInfo::kFormalParameterCountOffset));
@@ -2179,9 +2080,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
 
   __ movzx_w(
       ecx, FieldOperand(edx, SharedFunctionInfo::kFormalParameterCountOffset));
-  ParameterCount actual(eax);
-  ParameterCount expected(ecx);
-  __ InvokeFunctionCode(edi, no_reg, expected, actual, JUMP_FUNCTION);
+  __ InvokeFunctionCode(edi, no_reg, ecx, eax, JUMP_FUNCTION);
   // The function is a "classConstructor", need to raise an exception.
   __ bind(&class_constructor);
   {
@@ -2340,7 +2239,7 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
   // Check if target is a proxy and call CallProxy external builtin
   __ bind(&non_jsboundfunction);
   __ test_b(FieldOperand(ecx, Map::kBitFieldOffset),
-            Immediate(Map::IsCallableBit::kMask));
+            Immediate(Map::Bits1::IsCallableBit::kMask));
   __ j(zero, &non_callable);
 
   // Call CallProxy external builtin
@@ -2354,7 +2253,7 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
   // Overwrite the original receiver with the (original) target.
   __ mov(Operand(esp, eax, times_system_pointer_size, kSystemPointerSize), edi);
   // Let the "call_as_function_delegate" take care of the rest.
-  __ LoadGlobalFunction(Context::CALL_AS_FUNCTION_DELEGATE_INDEX, edi);
+  __ LoadNativeContextSlot(edi, Context::CALL_AS_FUNCTION_DELEGATE_INDEX);
   __ Jump(masm->isolate()->builtins()->CallFunction(
               ConvertReceiverMode::kNotNullOrUndefined),
           RelocInfo::CODE_TARGET);
@@ -2443,7 +2342,7 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   // Check if target has a [[Construct]] internal method.
   __ mov(ecx, FieldOperand(edi, HeapObject::kMapOffset));
   __ test_b(FieldOperand(ecx, Map::kBitFieldOffset),
-            Immediate(Map::IsConstructorBit::kMask));
+            Immediate(Map::Bits1::IsConstructorBit::kMask));
   __ j(zero, &non_constructor);
 
   // Dispatch based on instance type.
@@ -2474,7 +2373,7 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
     __ mov(Operand(esp, eax, times_system_pointer_size, kSystemPointerSize),
            edi);
     // Let the "call_as_constructor_delegate" take care of the rest.
-    __ LoadGlobalFunction(Context::CALL_AS_CONSTRUCTOR_DELEGATE_INDEX, edi);
+    __ LoadNativeContextSlot(edi, Context::CALL_AS_CONSTRUCTOR_DELEGATE_INDEX);
     __ Jump(masm->isolate()->builtins()->CallFunction(),
             RelocInfo::CODE_TARGET);
   }
@@ -2669,19 +2568,13 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
     __ Push(kWasmInstanceRegister);
     // Push the function index as second argument.
     __ Push(kWasmCompileLazyFuncIndexRegister);
-    // Load the correct CEntry builtin from the instance object.
-    __ mov(ecx, FieldOperand(kWasmInstanceRegister,
-                             WasmInstanceObject::kIsolateRootOffset));
-    auto centry_id =
-        Builtins::kCEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit;
-    __ mov(ecx, MemOperand(ecx, IsolateData::builtin_slot_offset(centry_id)));
     // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ Move(kContextRegister, Smi::zero());
     {
       // At this point, ebx has been spilled to the stack but is not yet
       // overwritten with another value. We can still use it as kRootRegister.
-      __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, ecx);
+      __ CallRuntime(Runtime::kWasmCompileLazy, 2);
     }
     // The entrypoint address is the return value.
     __ mov(edi, kReturnRegister0);
@@ -2932,49 +2825,6 @@ void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
   __ ret(0);
 }
 
-void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- eax : argc
-  //  -- edi : constructor
-  //  -- esp[0] : return address
-  //  -- esp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ mov(ecx, FieldOperand(edi, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ test(ecx, Immediate(kSmiTagMask));
-    __ Assert(not_zero, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CmpObjectType(ecx, MAP_TYPE, ecx);
-    __ Assert(equal, AbortReason::kUnexpectedInitialMapForArrayFunction);
-
-    // Figure out the right elements kind
-    __ mov(ecx, FieldOperand(edi, JSFunction::kPrototypeOrInitialMapOffset));
-
-    // Load the map's "bit field 2" into |result|. We only need the first byte,
-    // but the following masking takes care of that anyway.
-    __ mov(ecx, FieldOperand(ecx, Map::kBitField2Offset));
-    // Retrieve elements_kind from bit field 2.
-    __ DecodeField<Map::ElementsKindBits>(ecx);
-
-    // Initial elements kind should be packed elements.
-    __ cmp(ecx, Immediate(PACKED_ELEMENTS));
-    __ Assert(equal, AbortReason::kInvalidElementsKindForInternalPackedArray);
-
-    // No arguments should be passed.
-    __ test(eax, eax);
-    __ Assert(zero, AbortReason::kWrongNumberOfArgumentsForInternalPackedArray);
-  }
-
-  __ Jump(
-      BUILTIN_CODE(masm->isolate(), InternalArrayNoArgumentConstructor_Packed),
-      RelocInfo::CODE_TARGET);
-}
-
 namespace {
 
 // Generates an Operand for saving parameters after PrepareCallApiFunction.
diff --git a/deps/v8/src/builtins/iterator.tq b/deps/v8/src/builtins/iterator.tq
index e662e4e75e5afe..51a95648501d59 100644
--- a/deps/v8/src/builtins/iterator.tq
+++ b/deps/v8/src/builtins/iterator.tq
@@ -6,6 +6,7 @@
 
 namespace iterator {
   // Returned from IteratorBuiltinsAssembler::GetIterator().
+  @export
   struct IteratorRecord {
     // iteratorRecord.[[Iterator]]
     object: JSReceiver;
@@ -14,10 +15,15 @@ namespace iterator {
     next: JSAny;
   }
 
+  extern macro IteratorBuiltinsAssembler::FastIterableToList(
+      implicit context: Context)(JSAny): JSArray labels Slow;
+
   extern macro IteratorBuiltinsAssembler::GetIteratorMethod(
       implicit context: Context)(JSAny): JSAny;
   extern macro IteratorBuiltinsAssembler::GetIterator(
       implicit context: Context)(JSAny): IteratorRecord;
+  extern macro IteratorBuiltinsAssembler::GetIterator(
+      implicit context: Context)(JSAny, JSAny): IteratorRecord;
 
   extern macro IteratorBuiltinsAssembler::IteratorStep(
       implicit context: Context)(IteratorRecord): JSReceiver
@@ -47,7 +53,7 @@ namespace iterator {
 
   transitioning builtin GetIteratorWithFeedback(
       context: Context, receiver: JSAny, loadSlot: Smi, callSlot: Smi,
-      feedback: Undefined | FeedbackVector): JSAny {
+      feedback: Undefined|FeedbackVector): JSAny {
     let iteratorMethod: JSAny;
     typeswitch (feedback) {
       case (Undefined): {
@@ -64,19 +70,38 @@ namespace iterator {
 
   transitioning builtin CallIteratorWithFeedback(
       context: Context, receiver: JSAny, iteratorMethod: JSAny, callSlot: Smi,
-      feedback: Undefined | FeedbackVector): JSAny {
+      feedback: Undefined|FeedbackVector): JSAny {
     const callSlotUnTagged: uintptr = Unsigned(SmiUntag(callSlot));
     CollectCallFeedback(iteratorMethod, context, feedback, callSlotUnTagged);
     const iteratorCallable: Callable = Cast<Callable>(iteratorMethod)
         otherwise ThrowCalledNonCallable(iteratorMethod);
-    const iterator: JSAny = Call(context, iteratorCallable, receiver);
-    typeswitch (iterator) {
-      case (JSReceiver): {
-        return iterator;
-      }
-      case (JSPrimitive): {
-        ThrowSymbolIteratorInvalid();
-      }
+    return Call(context, iteratorCallable, receiver);
+  }
+
+  transitioning
+  macro IteratorCloseOnException(implicit context: Context)(
+      iterator: IteratorRecord, exception: Object): never labels
+  IfException(Object) {
+    // Let return be ? GetMethod(iterator, "return").
+    let method: JSAny;
+    try {
+      method = GetProperty(iterator.object, kReturnString);
+    } catch (e) {
+      goto IfException(e);
     }
+
+    // If return is undefined, return Completion(completion).
+    if (method == Undefined || method == Null) goto IfException(exception);
+
+    // Let innerResult be Call(return, iterator, « »).
+    // If an exception occurs, the original exception remains bound
+    try {
+      Call(context, method, iterator.object);
+    } catch (_e) {
+      goto IfException(exception);
+    }
+
+    // (If completion.[[Type]] is throw) return Completion(completion).
+    goto IfException(exception);
   }
 }
diff --git a/deps/v8/src/builtins/math.tq b/deps/v8/src/builtins/math.tq
index 99a29bd5cb6651..8c9998906a533e 100644
--- a/deps/v8/src/builtins/math.tq
+++ b/deps/v8/src/builtins/math.tq
@@ -3,12 +3,179 @@
 // LICENSE file.
 
 namespace math {
+
+  extern transitioning builtin
+  NonNumberToNumber(implicit context: Context)(HeapObject): Number;
+
+  transitioning macro ReduceToSmiOrFloat64(implicit context: Context)(x: JSAny):
+      never
+      labels SmiResult(Smi), Float64Result(float64) {
+    let x1: JSAny = x;
+    while (true) {
+      typeswitch (x1) {
+        case (s: Smi): {
+          goto SmiResult(s);
+        }
+        case (h: HeapNumber): {
+          goto Float64Result(Convert<float64>(h));
+        }
+        case (a: JSAnyNotNumber): {
+          x1 = NonNumberToNumber(a);
+        }
+      }
+    }
+    VerifiedUnreachable();
+  }
+
+  // ES6 #sec-math.abs
+  extern macro IsIntPtrAbsWithOverflowSupported(): constexpr bool;
+  extern macro TrySmiSub(Smi, Smi): Smi labels Overflow;
+  extern macro TrySmiAbs(Smi): Smi labels Overflow;
+  extern macro Float64Abs(float64): float64;
+  const kSmiMaxValuePlusOne:
+      constexpr float64 generates '0.0 - kSmiMinValue';
+
+  transitioning javascript builtin
+  MathAbs(js-implicit context: NativeContext)(x: JSAny): Number {
+    try {
+      ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
+    }
+    label SmiResult(s: Smi) {
+      try {
+        if constexpr (IsIntPtrAbsWithOverflowSupported()) {
+          const result: Smi = TrySmiAbs(s)
+              otherwise SmiOverflow;
+          return result;
+        } else {
+          if (0 <= s) {
+            return s;
+          } else {
+            const result: Smi = TrySmiSub(0, s) otherwise SmiOverflow;
+            return result;
+          }
+        }
+      }
+      label SmiOverflow {
+        return NumberConstant(kSmiMaxValuePlusOne);
+      }
+    }
+    label Float64Result(f: float64) {
+      return Convert<Number>(Float64Abs(f));
+    }
+  }
+
+  // ES6 #sec-math.ceil
+  extern macro Float64Ceil(float64): float64;
+  transitioning javascript builtin
+  MathCeil(js-implicit context: NativeContext)(x: JSAny): Number {
+    try {
+      ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
+    }
+    label SmiResult(s: Smi) {
+      return s;
+    }
+    label Float64Result(f: float64) {
+      return Convert<Number>(Float64Ceil(f));
+    }
+  }
+
+  // ES6 #sec-math.floor
+  extern macro Float64Floor(float64): float64;
+  transitioning javascript builtin
+  MathFloor(js-implicit context: NativeContext)(x: JSAny): Number {
+    try {
+      ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
+    }
+    label SmiResult(s: Smi) {
+      return s;
+    }
+    label Float64Result(f: float64) {
+      return Convert<Number>(Float64Floor(f));
+    }
+  }
+
+  // ES6 #sec-math.round
+  extern macro Float64Round(float64): float64;
+  transitioning javascript builtin
+  MathRound(js-implicit context: NativeContext)(x: JSAny): Number {
+    try {
+      ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
+    }
+    label SmiResult(s: Smi) {
+      return s;
+    }
+    label Float64Result(f: float64) {
+      return Convert<Number>(Float64Round(f));
+    }
+  }
+
+  // ES6 #sec-math.trunc
+  extern macro Float64Trunc(float64): float64;
+  transitioning javascript builtin
+  MathTrunc(js-implicit context: NativeContext)(x: JSAny): Number {
+    try {
+      ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
+    }
+    label SmiResult(s: Smi) {
+      return s;
+    }
+    label Float64Result(f: float64) {
+      return Convert<Number>(Float64Trunc(f));
+    }
+  }
+
+  // ES6 #sec-math.pow
+  extern macro Float64Pow(float64, float64): float64;
+  extern macro TruncateTaggedToFloat64(implicit context: Context)(JSAny):
+      float64;
+
+  @export
+  macro MathPowImpl(implicit context: Context)(base: JSAny, exponent: JSAny):
+      Number {
+    const baseValue: float64 = TruncateTaggedToFloat64(base);
+    const exponentValue: float64 = TruncateTaggedToFloat64(exponent);
+    const result: float64 = Float64Pow(baseValue, exponentValue);
+    return Convert<Number>(result);
+  }
+
+  transitioning javascript builtin
+  MathPow(js-implicit context: NativeContext)(base: JSAny, exponent: JSAny):
+      Number {
+    return MathPowImpl(base, exponent);
+  }
+
+  // ES6 #sec-math.max
+  extern macro Float64Max(float64, float64): float64;
+  transitioning javascript builtin
+  MathMax(js-implicit context: NativeContext)(...arguments): Number {
+    let result: float64 = MINUS_V8_INFINITY;
+    const argCount = arguments.length;
+    for (let i: intptr = 0; i < argCount; i++) {
+      const doubleValue = TruncateTaggedToFloat64(arguments[i]);
+      result = Float64Max(result, doubleValue);
+    }
+    return Convert<Number>(result);
+  }
+
+  // ES6 #sec-math.min
+  extern macro Float64Min(float64, float64): float64;
+  transitioning javascript builtin
+  MathMin(js-implicit context: NativeContext)(...arguments): Number {
+    let result: float64 = V8_INFINITY;
+    const argCount = arguments.length;
+    for (let i: intptr = 0; i < argCount; i++) {
+      const doubleValue = TruncateTaggedToFloat64(arguments[i]);
+      result = Float64Min(result, doubleValue);
+    }
+    return Convert<Number>(result);
+  }
+
   // ES6 #sec-math.acos
   extern macro Float64Acos(float64): float64;
 
   transitioning javascript builtin
-  MathAcos(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathAcos(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Acos(value));
   }
 
@@ -16,8 +183,8 @@ namespace math {
   extern macro Float64Acosh(float64): float64;
 
   transitioning javascript builtin
-  MathAcosh(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathAcosh(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Acosh(value));
   }
 
@@ -25,8 +192,8 @@ namespace math {
   extern macro Float64Asin(float64): float64;
 
   transitioning javascript builtin
-  MathAsin(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathAsin(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Asin(value));
   }
 
@@ -34,8 +201,8 @@ namespace math {
   extern macro Float64Asinh(float64): float64;
 
   transitioning javascript builtin
-  MathAsinh(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathAsinh(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Asinh(value));
   }
 
@@ -43,8 +210,8 @@ namespace math {
   extern macro Float64Atan(float64): float64;
 
   transitioning javascript builtin
-  MathAtan(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathAtan(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Atan(value));
   }
 
@@ -52,9 +219,9 @@ namespace math {
   extern macro Float64Atan2(float64, float64): float64;
 
   transitioning javascript builtin
-  MathAtan2(js-implicit context: Context)(y: JSAny, x: JSAny): Number {
-    const yValue = Convert<float64>(ToNumber_Inline(context, y));
-    const xValue = Convert<float64>(ToNumber_Inline(context, x));
+  MathAtan2(js-implicit context: NativeContext)(y: JSAny, x: JSAny): Number {
+    const yValue = Convert<float64>(ToNumber_Inline(y));
+    const xValue = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Atan2(yValue, xValue));
   }
 
@@ -62,8 +229,8 @@ namespace math {
   extern macro Float64Atanh(float64): float64;
 
   transitioning javascript builtin
-  MathAtanh(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathAtanh(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Atanh(value));
   }
 
@@ -71,8 +238,8 @@ namespace math {
   extern macro Float64Cbrt(float64): float64;
 
   transitioning javascript builtin
-  MathCbrt(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathCbrt(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Cbrt(value));
   }
 
@@ -80,19 +247,8 @@ namespace math {
   extern macro Word32Clz(int32): int32;
 
   transitioning javascript builtin
-  MathClz32(js-implicit context: Context)(x: JSAny): Number {
-    const num = ToNumber_Inline(context, x);
-
-    let value: int32;
-    typeswitch (num) {
-      case (s: Smi): {
-        value = Convert<int32>(s);
-      }
-      case (h: HeapNumber): {
-        value = TruncateHeapNumberValueToWord32(h);
-      }
-    }
-
+  MathClz32(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value: int32 = Convert<int32>(ToNumber_Inline(x));
     return Convert<Number>(Word32Clz(value));
   }
 
@@ -100,8 +256,8 @@ namespace math {
   extern macro Float64Cos(float64): float64;
 
   transitioning javascript builtin
-  MathCos(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathCos(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Cos(value));
   }
 
@@ -109,8 +265,8 @@ namespace math {
   extern macro Float64Cosh(float64): float64;
 
   transitioning javascript builtin
-  MathCosh(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathCosh(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Cosh(value));
   }
 
@@ -118,8 +274,8 @@ namespace math {
   extern macro Float64Exp(float64): float64;
 
   transitioning javascript builtin
-  MathExp(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathExp(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Exp(value));
   }
 
@@ -127,25 +283,33 @@ namespace math {
   extern macro Float64Expm1(float64): float64;
 
   transitioning javascript builtin
-  MathExpm1(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathExpm1(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Expm1(value));
   }
 
   // ES6 #sec-math.fround
   transitioning javascript builtin
-  MathFround(js-implicit context: Context)(x: JSAny): Number {
-    const x32 = Convert<float32>(ToNumber_Inline(context, x));
+  MathFround(js-implicit context: NativeContext)(x: JSAny): Number {
+    const x32 = Convert<float32>(ToNumber_Inline(x));
     const x64 = Convert<float64>(x32);
     return Convert<Number>(x64);
   }
 
+  // ES6 #sec-math.imul
+  transitioning javascript builtin
+  MathImul(js-implicit context: NativeContext)(x: JSAny, y: JSAny): Number {
+    const x = Convert<int32>(ToNumber_Inline(x));
+    const y = Convert<int32>(ToNumber_Inline(y));
+    return Convert<Number>(x * y);
+  }
+
   // ES6 #sec-math.log
   extern macro Float64Log(float64): float64;
 
   transitioning javascript builtin
-  MathLog(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathLog(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Log(value));
   }
 
@@ -153,8 +317,8 @@ namespace math {
   extern macro Float64Log1p(float64): float64;
 
   transitioning javascript builtin
-  MathLog1p(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathLog1p(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Log1p(value));
   }
 
@@ -162,8 +326,8 @@ namespace math {
   extern macro Float64Log10(float64): float64;
 
   transitioning javascript builtin
-  MathLog10(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathLog10(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Log10(value));
   }
 
@@ -171,8 +335,8 @@ namespace math {
   extern macro Float64Log2(float64): float64;
 
   transitioning javascript builtin
-  MathLog2(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathLog2(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Log2(value));
   }
 
@@ -180,15 +344,15 @@ namespace math {
   extern macro Float64Sin(float64): float64;
 
   transitioning javascript builtin
-  MathSin(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathSin(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Sin(value));
   }
 
   // ES6 #sec-math.sign
   transitioning javascript builtin
-  MathSign(js-implicit context: Context)(x: JSAny): Number {
-    const num = ToNumber_Inline(context, x);
+  MathSign(js-implicit context: NativeContext)(x: JSAny): Number {
+    const num = ToNumber_Inline(x);
     const value = Convert<float64>(num);
 
     if (value < 0) {
@@ -204,8 +368,8 @@ namespace math {
   extern macro Float64Sinh(float64): float64;
 
   transitioning javascript builtin
-  MathSinh(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathSinh(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Sinh(value));
   }
 
@@ -213,8 +377,8 @@ namespace math {
   extern macro Float64Sqrt(float64): float64;
 
   transitioning javascript builtin
-  MathSqrt(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathSqrt(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Sqrt(value));
   }
 
@@ -222,8 +386,8 @@ namespace math {
   extern macro Float64Tan(float64): float64;
 
   transitioning javascript builtin
-  MathTan(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathTan(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Tan(value));
   }
 
@@ -231,16 +395,14 @@ namespace math {
   extern macro Float64Tanh(float64): float64;
 
   transitioning javascript builtin
-  MathTanh(js-implicit context: Context)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(context, x));
+  MathTanh(js-implicit context: NativeContext)(x: JSAny): Number {
+    const value = Convert<float64>(ToNumber_Inline(x));
     return Convert<Number>(Float64Tanh(value));
   }
 
-  extern macro Float64Abs(float64): float64;
-
   // ES6 #sec-math.hypot
   transitioning javascript builtin
-  MathHypot(js-implicit context: Context, receiver: JSAny)(...arguments):
+  MathHypot(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
       Number {
     const length = arguments.length;
     if (length == 0) {
@@ -250,12 +412,12 @@ namespace math {
     let oneArgIsNaN: bool = false;
     let max: float64 = 0;
     for (let i: intptr = 0; i < length; ++i) {
-      const value = Convert<float64>(ToNumber_Inline(context, arguments[i]));
+      const value = Convert<float64>(ToNumber_Inline(arguments[i]));
       if (Float64IsNaN(value)) {
         oneArgIsNaN = true;
       } else {
         const absValue = Float64Abs(value);
-        absValues.floats[i] = absValue;
+        absValues.floats[i] = Convert<float64_or_hole>(absValue);
         if (absValue > max) {
           max = absValue;
         }
@@ -275,7 +437,7 @@ namespace math {
     let sum: float64 = 0;
     let compensation: float64 = 0;
     for (let i: intptr = 0; i < length; ++i) {
-      const n = absValues.floats[i] / max;
+      const n = absValues.floats[i].ValueUnsafeAssumeNotHole() / max;
       const summand = n * n - compensation;
       const preliminary = sum + summand;
       compensation = (preliminary - sum) - summand;
@@ -283,4 +445,27 @@ namespace math {
     }
     return Convert<Number>(Float64Sqrt(sum) * max);
   }
+
+  // ES6 #sec-math.random
+  extern macro RefillMathRandom(NativeContext): Smi;
+
+  transitioning javascript builtin
+  MathRandom(js-implicit context: NativeContext, receiver: JSAny)(): Number {
+    let smiIndex: Smi =
+        Cast<Smi>(context[NativeContextSlot::MATH_RANDOM_INDEX_INDEX])
+        otherwise unreachable;
+    if (smiIndex == 0) {
+      // refill math random.
+      smiIndex = RefillMathRandom(context);
+    }
+    const newSmiIndex: Smi = smiIndex - 1;
+    context[NativeContextSlot::MATH_RANDOM_INDEX_INDEX] = newSmiIndex;
+
+    const array: FixedDoubleArray = Cast<FixedDoubleArray>(
+        context[NativeContextSlot::MATH_RANDOM_CACHE_INDEX])
+        otherwise unreachable;
+    const random: float64 =
+        array.floats[Convert<intptr>(newSmiIndex)].ValueUnsafeAssumeNotHole();
+    return AllocateHeapNumberWithValue(random);
+  }
 }
diff --git a/deps/v8/src/builtins/mips/builtins-mips.cc b/deps/v8/src/builtins/mips/builtins-mips.cc
index ecfb224fb27d2b..2561177cd62598 100644
--- a/deps/v8/src/builtins/mips/builtins-mips.cc
+++ b/deps/v8/src/builtins/mips/builtins-mips.cc
@@ -36,29 +36,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address) {
           RelocInfo::CODE_TARGET);
 }
 
-void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0     : number of arguments
-  //  -- ra     : return address
-  //  -- sp[...]: constructor arguments
-  // -----------------------------------
-  if (FLAG_debug_code) {
-    // Initial map for the builtin InternalArray functions should be maps.
-    __ lw(a2, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-    __ SmiTst(a2, t0);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForInternalArrayFunction,
-              t0, Operand(zero_reg));
-    __ GetObjectType(a2, a3, t0);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForInternalArrayFunction,
-              t0, Operand(MAP_TYPE));
-  }
-
-  // Run the native code for the InternalArray function called as a normal
-  // function.
-  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
-          RelocInfo::CODE_TARGET);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -145,8 +122,7 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     // a0: number of arguments (untagged)
     // a1: constructor function
     // a3: new target
-    ParameterCount actual(a0);
-    __ InvokeFunction(a1, a3, actual, CALL_FUNCTION);
+    __ InvokeFunctionWithNewTarget(a1, a3, a0, CALL_FUNCTION);
 
     // Restore context from the frame.
     __ lw(cp, MemOperand(fp, ConstructFrameConstants::kContextOffset));
@@ -302,8 +278,7 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
     __ Branch(&loop, greater_equal, t3, Operand(zero_reg));
 
     // Call the function.
-    ParameterCount actual(a0);
-    __ InvokeFunction(a1, a3, actual, CALL_FUNCTION);
+    __ InvokeFunctionWithNewTarget(a1, a3, a0, CALL_FUNCTION);
 
     // ----------- S t a t e -------------
     //  --                 v0: constructor result
@@ -818,9 +793,11 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   }
 }
 
-static void ReplaceClosureCodeWithOptimizedCode(
-    MacroAssembler* masm, Register optimized_code, Register closure,
-    Register scratch1, Register scratch2, Register scratch3) {
+static void ReplaceClosureCodeWithOptimizedCode(MacroAssembler* masm,
+                                                Register optimized_code,
+                                                Register closure,
+                                                Register scratch1,
+                                                Register scratch2) {
   // Store code entry in the closure.
   __ sw(optimized_code, FieldMemOperand(closure, JSFunction::kCodeOffset));
   __ mov(scratch1, optimized_code);  // Write barrier clobbers scratch1 below.
@@ -856,97 +833,73 @@ static void TailCallRuntimeIfMarkerEquals(MacroAssembler* masm,
   __ bind(&no_match);
 }
 
-static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
-                                           Register feedback_vector,
-                                           Register scratch1, Register scratch2,
-                                           Register scratch3) {
+static void TailCallOptimizedCodeSlot(MacroAssembler* masm,
+                                      Register optimized_code_entry,
+                                      Register scratch1, Register scratch2) {
   // ----------- S t a t e -------------
   //  -- a3 : new target (preserved for callee if needed, and caller)
   //  -- a1 : target function (preserved for callee if needed, and caller)
-  //  -- feedback vector (preserved for caller if needed)
   // -----------------------------------
-  DCHECK(!AreAliased(feedback_vector, a1, a3, scratch1, scratch2, scratch3));
-
-  Label optimized_code_slot_is_weak_ref, fallthrough;
+  DCHECK(!AreAliased(optimized_code_entry, a1, a3, scratch1, scratch2));
 
   Register closure = a1;
-  Register optimized_code_entry = scratch1;
-
-  __ lw(optimized_code_entry,
-        FieldMemOperand(feedback_vector,
-                        FeedbackVector::kOptimizedCodeWeakOrSmiOffset));
-
-  // Check if the code entry is a Smi. If yes, we interpret it as an
-  // optimisation marker. Otherwise, interpret it as a weak cell to a code
-  // object.
-  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_weak_ref);
-
-  {
-    // Optimized code slot is a Smi optimization marker.
-
-    // Fall through if no optimization trigger.
-    __ Branch(&fallthrough, eq, optimized_code_entry,
-              Operand(Smi::FromEnum(OptimizationMarker::kNone)));
-
-    TailCallRuntimeIfMarkerEquals(masm, optimized_code_entry,
-                                  OptimizationMarker::kLogFirstExecution,
-                                  Runtime::kFunctionFirstExecution);
-    TailCallRuntimeIfMarkerEquals(masm, optimized_code_entry,
-                                  OptimizationMarker::kCompileOptimized,
-                                  Runtime::kCompileOptimized_NotConcurrent);
-    TailCallRuntimeIfMarkerEquals(
-        masm, optimized_code_entry,
-        OptimizationMarker::kCompileOptimizedConcurrent,
-        Runtime::kCompileOptimized_Concurrent);
 
-    {
-      // Otherwise, the marker is InOptimizationQueue, so fall through hoping
-      // that an interrupt will eventually update the slot with optimized code.
-      if (FLAG_debug_code) {
-        __ Assert(
-            eq, AbortReason::kExpectedOptimizationSentinel,
-            optimized_code_entry,
-            Operand(Smi::FromEnum(OptimizationMarker::kInOptimizationQueue)));
-      }
-      __ jmp(&fallthrough);
-    }
-  }
+  // Check if the optimized code is marked for deopt. If it is, call the
+  // runtime to clear it.
+  Label found_deoptimized_code;
+  __ Lw(scratch1,
+        FieldMemOperand(optimized_code_entry, Code::kCodeDataContainerOffset));
+  __ Lw(scratch1,
+        FieldMemOperand(scratch1, CodeDataContainer::kKindSpecificFlagsOffset));
+  __ And(scratch1, scratch1, Operand(1 << Code::kMarkedForDeoptimizationBit));
+  __ Branch(&found_deoptimized_code, ne, scratch1, Operand(zero_reg));
+
+  // Optimized code is good, get it into the closure and link the closure into
+  // the optimized functions list, then tail call the optimized code.
+  // The feedback vector is no longer used, so re-use it as a scratch
+  // register.
+  ReplaceClosureCodeWithOptimizedCode(masm, optimized_code_entry, closure,
+                                      scratch1, scratch2);
+  static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+  __ Addu(a2, optimized_code_entry, Code::kHeaderSize - kHeapObjectTag);
+  __ Jump(a2);
 
-  {
-    // Optimized code slot is a weak reference.
-    __ bind(&optimized_code_slot_is_weak_ref);
-
-    __ LoadWeakValue(optimized_code_entry, optimized_code_entry, &fallthrough);
-
-    // Check if the optimized code is marked for deopt. If it is, call the
-    // runtime to clear it.
-    Label found_deoptimized_code;
-    __ lw(scratch2, FieldMemOperand(optimized_code_entry,
-                                    Code::kCodeDataContainerOffset));
-    __ lw(scratch2, FieldMemOperand(
-                        scratch2, CodeDataContainer::kKindSpecificFlagsOffset));
-    __ And(scratch2, scratch2, Operand(1 << Code::kMarkedForDeoptimizationBit));
-    __ Branch(&found_deoptimized_code, ne, scratch2, Operand(zero_reg));
-
-    // Optimized code is good, get it into the closure and link the closure into
-    // the optimized functions list, then tail call the optimized code.
-    // The feedback vector is no longer used, so re-use it as a scratch
-    // register.
-    ReplaceClosureCodeWithOptimizedCode(masm, optimized_code_entry, closure,
-                                        scratch2, scratch3, feedback_vector);
-    static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
-    __ Addu(a2, optimized_code_entry, Code::kHeaderSize - kHeapObjectTag);
-    __ Jump(a2);
+  // Optimized code slot contains deoptimized code, evict it and re-enter the
+  // closure's code.
+  __ bind(&found_deoptimized_code);
+  GenerateTailCallToReturnedCode(masm, Runtime::kEvictOptimizedCodeSlot);
+}
 
-    // Optimized code slot contains deoptimized code, evict it and re-enter the
-    // losure's code.
-    __ bind(&found_deoptimized_code);
-    GenerateTailCallToReturnedCode(masm, Runtime::kEvictOptimizedCodeSlot);
+static void MaybeOptimizeCode(MacroAssembler* masm, Register feedback_vector,
+                              Register optimization_marker) {
+  // ----------- S t a t e -------------
+  //  -- a3 : new target (preserved for callee if needed, and caller)
+  //  -- a1 : target function (preserved for callee if needed, and caller)
+  //  -- feedback vector (preserved for caller if needed)
+  //  -- optimization_marker : a Smi containing a non-zero optimization marker.
+  // -----------------------------------
+  DCHECK(!AreAliased(feedback_vector, a1, a3, optimization_marker));
+
+  // TODO(v8:8394): The logging of first execution will break if
+  // feedback vectors are not allocated. We need to find a different way of
+  // logging these events if required.
+  TailCallRuntimeIfMarkerEquals(masm, optimization_marker,
+                                OptimizationMarker::kLogFirstExecution,
+                                Runtime::kFunctionFirstExecution);
+  TailCallRuntimeIfMarkerEquals(masm, optimization_marker,
+                                OptimizationMarker::kCompileOptimized,
+                                Runtime::kCompileOptimized_NotConcurrent);
+  TailCallRuntimeIfMarkerEquals(masm, optimization_marker,
+                                OptimizationMarker::kCompileOptimizedConcurrent,
+                                Runtime::kCompileOptimized_Concurrent);
+
+  // Otherwise, the marker is InOptimizationQueue, so fall through hoping
+  // that an interrupt will eventually update the slot with optimized code.
+  if (FLAG_debug_code) {
+    __ Assert(eq, AbortReason::kExpectedOptimizationSentinel,
+              optimization_marker,
+              Operand(Smi::FromEnum(OptimizationMarker::kInOptimizationQueue)));
   }
-
-  // Fall-through if the optimized code cell is clear and there is no
-  // optimization marker.
-  __ bind(&fallthrough);
 }
 
 // Advance the current bytecode offset. This simulates what all bytecode
@@ -1051,7 +1004,19 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 
   // Read off the optimized code slot in the feedback vector, and if there
   // is optimized code or an optimization marker, call that instead.
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, t0, t3, t1);
+  Register optimized_code_entry = t0;
+  __ Lw(optimized_code_entry,
+        FieldMemOperand(feedback_vector,
+                        FeedbackVector::kOptimizedCodeWeakOrSmiOffset));
+
+  // Check if the optimized code slot is not empty.
+  Label optimized_code_slot_not_empty;
+
+  __ Branch(&optimized_code_slot_not_empty, ne, optimized_code_entry,
+            Operand(Smi::FromEnum(OptimizationMarker::kNone)));
+
+  Label not_optimized;
+  __ bind(&not_optimized);
 
   // Increment invocation count for the function.
   __ lw(t0, FieldMemOperand(feedback_vector,
@@ -1163,6 +1128,21 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   LeaveInterpreterFrame(masm, t0);
   __ Jump(ra);
 
+  __ bind(&optimized_code_slot_not_empty);
+  Label maybe_has_optimized_code;
+  // Check if optimized code marker is actually a weak reference to the
+  // optimized code as opposed to an optimization marker.
+  __ JumpIfNotSmi(optimized_code_entry, &maybe_has_optimized_code);
+  MaybeOptimizeCode(masm, feedback_vector, optimized_code_entry);
+  // Fall through if there's no runnable optimized code.
+  __ jmp(&not_optimized);
+
+  __ bind(&maybe_has_optimized_code);
+  // Load code entry from the weak reference, if it was cleared, resume
+  // execution of unoptimized code.
+  __ LoadWeakValue(optimized_code_entry, optimized_code_entry, &not_optimized);
+  TailCallOptimizedCodeSlot(masm, optimized_code_entry, t1, t3);
+
   __ bind(&compile_lazy);
   GenerateTailCallToReturnedCode(masm, Runtime::kCompileLazy);
   // Unreachable code.
@@ -1190,7 +1170,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
   __ Addu(index, index, Operand(-kPointerSize));
   __ push(scratch);
   __ bind(&loop_check);
-  __ Branch(&loop_header, gt, index, Operand(scratch2));
+  __ Branch(&loop_header, hi, index, Operand(scratch2));
 }
 
 // static
@@ -1397,71 +1377,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argument count (preserved for callee)
-  //  -- a1 : new target (preserved for callee)
-  //  -- a3 : target function (preserved for callee)
-  // -----------------------------------
-  Label failed;
-  {
-    FrameScope scope(masm, StackFrame::INTERNAL);
-    // Preserve argument count for later compare.
-    __ Move(t4, a0);
-    // Push a copy of the target function and the new target.
-    // Push function as parameter to the runtime call.
-    __ SmiTag(a0);
-    __ Push(a0, a1, a3, a1);
-
-    // Copy arguments from caller (stdlib, foreign, heap).
-    Label args_done;
-    for (int j = 0; j < 4; ++j) {
-      Label over;
-      if (j < 3) {
-        __ Branch(&over, ne, t4, Operand(j));
-      }
-      for (int i = j - 1; i >= 0; --i) {
-        __ lw(t4, MemOperand(fp, StandardFrameConstants::kCallerSPOffset +
-                                     i * kPointerSize));
-        __ push(t4);
-      }
-      for (int i = 0; i < 3 - j; ++i) {
-        __ PushRoot(RootIndex::kUndefinedValue);
-      }
-      if (j < 3) {
-        __ jmp(&args_done);
-        __ bind(&over);
-      }
-    }
-    __ bind(&args_done);
-
-    // Call runtime, on success unwind frame, and parent frame.
-    __ CallRuntime(Runtime::kInstantiateAsmJs, 4);
-    // A smi 0 is returned on failure, an object on success.
-    __ JumpIfSmi(v0, &failed);
-
-    __ Drop(2);
-    __ pop(t4);
-    __ SmiUntag(t4);
-    scope.GenerateLeaveFrame();
-
-    __ Addu(t4, t4, Operand(1));
-    __ Lsa(sp, sp, t4, kPointerSizeLog2);
-    __ Ret();
-
-    __ bind(&failed);
-    // Restore target function and new target.
-    __ Pop(a0, a1, a3);
-    __ SmiUntag(a0);
-  }
-  // On failure, tail call back to regular js by re-calling the function
-  // which has be reset to the compile lazy builtin.
-  static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
-  __ lw(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
-  __ Addu(a2, a2, Code::kHeaderSize - kHeapObjectTag);
-  __ Jump(a2);
-}
-
 namespace {
 void Generate_ContinueToBuiltinHelper(MacroAssembler* masm,
                                       bool java_script_builtin,
@@ -1865,7 +1780,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
     __ JumpIfSmi(a3, &new_target_not_constructor);
     __ lw(t1, FieldMemOperand(a3, HeapObject::kMapOffset));
     __ lbu(t1, FieldMemOperand(t1, Map::kBitFieldOffset));
-    __ And(t1, t1, Operand(Map::IsConstructorBit::kMask));
+    __ And(t1, t1, Operand(Map::Bits1::IsConstructorBit::kMask));
     __ Branch(&new_target_constructor, ne, t1, Operand(zero_reg));
     __ bind(&new_target_not_constructor);
     {
@@ -1884,7 +1799,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   __ Branch(&arguments_adaptor, eq, t2,
             Operand(StackFrame::TypeToMarker(StackFrame::ARGUMENTS_ADAPTOR)));
   {
-    __ lw(t2, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+    __ lw(t2, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
     __ lw(t2, FieldMemOperand(t2, JSFunction::kSharedFunctionInfoOffset));
     __ lhu(t2, FieldMemOperand(
                    t2, SharedFunctionInfo::kFormalParameterCountOffset));
@@ -2022,9 +1937,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
 
   __ lhu(a2,
          FieldMemOperand(a2, SharedFunctionInfo::kFormalParameterCountOffset));
-  ParameterCount actual(a0);
-  ParameterCount expected(a2);
-  __ InvokeFunctionCode(a1, no_reg, expected, actual, JUMP_FUNCTION);
+  __ InvokeFunctionCode(a1, no_reg, a2, a0, JUMP_FUNCTION);
 
   // The function is a "classConstructor", need to raise an exception.
   __ bind(&class_constructor);
@@ -2139,7 +2052,7 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
 
   // Check if target has a [[Call]] internal method.
   __ lbu(t1, FieldMemOperand(t1, Map::kBitFieldOffset));
-  __ And(t1, t1, Operand(Map::IsCallableBit::kMask));
+  __ And(t1, t1, Operand(Map::Bits1::IsCallableBit::kMask));
   __ Branch(&non_callable, eq, t1, Operand(zero_reg));
 
   // Check if target is a proxy and call CallProxy external builtin
@@ -2301,7 +2214,7 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   // Check if target has a [[Construct]] internal method.
   __ lw(t1, FieldMemOperand(a1, HeapObject::kMapOffset));
   __ lbu(t3, FieldMemOperand(t1, Map::kBitFieldOffset));
-  __ And(t3, t3, Operand(Map::IsConstructorBit::kMask));
+  __ And(t3, t3, Operand(Map::Bits1::IsConstructorBit::kMask));
   __ Branch(&non_constructor, eq, t3, Operand(zero_reg));
 
   // Dispatch based on instance type.
@@ -2484,25 +2397,19 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
     // Save all parameter registers (see wasm-linkage.cc). They might be
     // overwritten in the runtime call below. We don't have any callee-saved
     // registers in wasm, so no need to store anything else.
-    constexpr RegList gp_regs = Register::ListOf<a0, a1, a2, a3>();
+    constexpr RegList gp_regs = Register::ListOf(a0, a1, a2, a3);
     constexpr RegList fp_regs =
-        DoubleRegister::ListOf<f2, f4, f6, f8, f10, f12, f14>();
+        DoubleRegister::ListOf(f2, f4, f6, f8, f10, f12, f14);
     __ MultiPush(gp_regs);
     __ MultiPushFPU(fp_regs);
 
     // Pass instance and function index as an explicit arguments to the runtime
     // function.
     __ Push(kWasmInstanceRegister, kWasmCompileLazyFuncIndexRegister);
-    // Load the correct CEntry builtin from the instance object.
-    __ lw(a2, FieldMemOperand(kWasmInstanceRegister,
-                              WasmInstanceObject::kIsolateRootOffset));
-    auto centry_id =
-        Builtins::kCEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit;
-    __ lw(a2, MemOperand(a2, IsolateData::builtin_slot_offset(centry_id)));
     // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ Move(kContextRegister, Smi::zero());
-    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, a2);
+    __ CallRuntime(Runtime::kWasmCompileLazy, 2);
 
     // Restore registers.
     __ MultiPopFPU(fp_regs);
@@ -2774,51 +2681,6 @@ void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
   __ Ret();
 }
 
-void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argc
-  //  -- a1 : constructor
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ lw(a3, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ SmiTst(a3, kScratchReg);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction,
-              kScratchReg, Operand(zero_reg));
-    __ GetObjectType(a3, a3, t0);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction, t0,
-              Operand(MAP_TYPE));
-
-    // Figure out the right elements kind.
-    __ lw(a3, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-
-    // Load the map's "bit field 2" into a3. We only need the first byte,
-    // but the following bit field extraction takes care of that anyway.
-    __ lbu(a3, FieldMemOperand(a3, Map::kBitField2Offset));
-    // Retrieve elements_kind from bit field 2.
-    __ DecodeField<Map::ElementsKindBits>(a3);
-
-    // Initial elements kind should be packed elements.
-    __ Assert(eq, AbortReason::kInvalidElementsKindForInternalPackedArray, a3,
-              Operand(PACKED_ELEMENTS));
-
-    // No arguments should be passed.
-    __ Assert(eq, AbortReason::kWrongNumberOfArgumentsForInternalPackedArray,
-              a0, Operand(0));
-  }
-
-  __ Jump(
-      BUILTIN_CODE(masm->isolate(), InternalArrayNoArgumentConstructor_Packed),
-      RelocInfo::CODE_TARGET);
-}
-
 namespace {
 
 int AddressOffset(ExternalReference ref0, ExternalReference ref1) {
@@ -3095,7 +2957,7 @@ void Builtins::Generate_CallApiGetter(MacroAssembler* masm) {
   __ sw(scratch, MemOperand(sp, (PCA::kIsolateIndex + 1) * kPointerSize));
   __ sw(holder, MemOperand(sp, (PCA::kHolderIndex + 1) * kPointerSize));
   // should_throw_on_error -> false
-  DCHECK_EQ(0, Smi::kZero.ptr());
+  DCHECK_EQ(0, Smi::zero().ptr());
   __ sw(zero_reg,
         MemOperand(sp, (PCA::kShouldThrowOnErrorIndex + 1) * kPointerSize));
   __ lw(scratch, FieldMemOperand(callback, AccessorInfo::kNameOffset));
diff --git a/deps/v8/src/builtins/mips64/builtins-mips64.cc b/deps/v8/src/builtins/mips64/builtins-mips64.cc
index 47dbc340020dab..8e91f8840f4417 100644
--- a/deps/v8/src/builtins/mips64/builtins-mips64.cc
+++ b/deps/v8/src/builtins/mips64/builtins-mips64.cc
@@ -36,29 +36,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address) {
           RelocInfo::CODE_TARGET);
 }
 
-void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0     : number of arguments
-  //  -- ra     : return address
-  //  -- sp[...]: constructor arguments
-  // -----------------------------------
-  if (FLAG_debug_code) {
-    // Initial map for the builtin InternalArray functions should be maps.
-    __ Ld(a2, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-    __ SmiTst(a2, a4);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForInternalArrayFunction,
-              a4, Operand(zero_reg));
-    __ GetObjectType(a2, a3, a4);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForInternalArrayFunction,
-              a4, Operand(MAP_TYPE));
-  }
-
-  // Run the native code for the InternalArray function called as a normal
-  // function.
-  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
-          RelocInfo::CODE_TARGET);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -145,8 +122,7 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     // a0: number of arguments (untagged)
     // a1: constructor function
     // a3: new target
-    ParameterCount actual(a0);
-    __ InvokeFunction(a1, a3, actual, CALL_FUNCTION);
+    __ InvokeFunctionWithNewTarget(a1, a3, a0, CALL_FUNCTION);
 
     // Restore context from the frame.
     __ Ld(cp, MemOperand(fp, ConstructFrameConstants::kContextOffset));
@@ -303,8 +279,7 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
     __ Branch(&loop, greater_equal, t3, Operand(zero_reg));
 
     // Call the function.
-    ParameterCount actual(a0);
-    __ InvokeFunction(a1, a3, actual, CALL_FUNCTION);
+    __ InvokeFunctionWithNewTarget(a1, a3, a0, CALL_FUNCTION);
 
     // ----------- S t a t e -------------
     //  --                 v0: constructor result
@@ -837,9 +812,11 @@ void Builtins::Generate_RunMicrotasksTrampoline(MacroAssembler* masm) {
   __ Jump(BUILTIN_CODE(masm->isolate(), RunMicrotasks), RelocInfo::CODE_TARGET);
 }
 
-static void ReplaceClosureCodeWithOptimizedCode(
-    MacroAssembler* masm, Register optimized_code, Register closure,
-    Register scratch1, Register scratch2, Register scratch3) {
+static void ReplaceClosureCodeWithOptimizedCode(MacroAssembler* masm,
+                                                Register optimized_code,
+                                                Register closure,
+                                                Register scratch1,
+                                                Register scratch2) {
   // Store code entry in the closure.
   __ Sd(optimized_code, FieldMemOperand(closure, JSFunction::kCodeOffset));
   __ mov(scratch1, optimized_code);  // Write barrier clobbers scratch1 below.
@@ -874,98 +851,74 @@ static void TailCallRuntimeIfMarkerEquals(MacroAssembler* masm,
   __ bind(&no_match);
 }
 
-static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
-                                           Register feedback_vector,
-                                           Register scratch1, Register scratch2,
-                                           Register scratch3) {
+static void TailCallOptimizedCodeSlot(MacroAssembler* masm,
+                                      Register optimized_code_entry,
+                                      Register scratch1, Register scratch2) {
   // ----------- S t a t e -------------
   //  -- a3 : new target (preserved for callee if needed, and caller)
   //  -- a1 : target function (preserved for callee if needed, and caller)
-  //  -- feedback vector (preserved for caller if needed)
   // -----------------------------------
-  DCHECK(!AreAliased(feedback_vector, a1, a3, scratch1, scratch2, scratch3));
-
-  Label optimized_code_slot_is_weak_ref, fallthrough;
+  DCHECK(!AreAliased(optimized_code_entry, a1, a3, scratch1, scratch2));
 
   Register closure = a1;
-  Register optimized_code_entry = scratch1;
-
-  __ Ld(optimized_code_entry,
-        FieldMemOperand(feedback_vector,
-                        FeedbackVector::kOptimizedCodeWeakOrSmiOffset));
 
-  // Check if the code entry is a Smi. If yes, we interpret it as an
-  // optimisation marker. Otherwise, interpret it as a weak reference to a code
-  // object.
-  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_weak_ref);
+  // Check if the optimized code is marked for deopt. If it is, call the
+  // runtime to clear it.
+  Label found_deoptimized_code;
+  __ Ld(a5,
+        FieldMemOperand(optimized_code_entry, Code::kCodeDataContainerOffset));
+  __ Lw(a5, FieldMemOperand(a5, CodeDataContainer::kKindSpecificFlagsOffset));
+  __ And(a5, a5, Operand(1 << Code::kMarkedForDeoptimizationBit));
+  __ Branch(&found_deoptimized_code, ne, a5, Operand(zero_reg));
+
+  // Optimized code is good, get it into the closure and link the closure into
+  // the optimized functions list, then tail call the optimized code.
+  // The feedback vector is no longer used, so re-use it as a scratch
+  // register.
+  ReplaceClosureCodeWithOptimizedCode(masm, optimized_code_entry, closure,
+                                      scratch1, scratch2);
 
-  {
-    // Optimized code slot is a Smi optimization marker.
-
-    // Fall through if no optimization trigger.
-    __ Branch(&fallthrough, eq, optimized_code_entry,
-              Operand(Smi::FromEnum(OptimizationMarker::kNone)));
-
-    TailCallRuntimeIfMarkerEquals(masm, optimized_code_entry,
-                                  OptimizationMarker::kLogFirstExecution,
-                                  Runtime::kFunctionFirstExecution);
-    TailCallRuntimeIfMarkerEquals(masm, optimized_code_entry,
-                                  OptimizationMarker::kCompileOptimized,
-                                  Runtime::kCompileOptimized_NotConcurrent);
-    TailCallRuntimeIfMarkerEquals(
-        masm, optimized_code_entry,
-        OptimizationMarker::kCompileOptimizedConcurrent,
-        Runtime::kCompileOptimized_Concurrent);
-
-    {
-      // Otherwise, the marker is InOptimizationQueue, so fall through hoping
-      // that an interrupt will eventually update the slot with optimized code.
-      if (FLAG_debug_code) {
-        __ Assert(
-            eq, AbortReason::kExpectedOptimizationSentinel,
-            optimized_code_entry,
-            Operand(Smi::FromEnum(OptimizationMarker::kInOptimizationQueue)));
-      }
-      __ jmp(&fallthrough);
-    }
-  }
-
-  {
-    // Optimized code slot is a weak reference.
-    __ bind(&optimized_code_slot_is_weak_ref);
-
-    __ LoadWeakValue(optimized_code_entry, optimized_code_entry, &fallthrough);
-
-    // Check if the optimized code is marked for deopt. If it is, call the
-    // runtime to clear it.
-    Label found_deoptimized_code;
-    __ Ld(a5, FieldMemOperand(optimized_code_entry,
-                              Code::kCodeDataContainerOffset));
-    __ Lw(a5, FieldMemOperand(a5, CodeDataContainer::kKindSpecificFlagsOffset));
-    __ And(a5, a5, Operand(1 << Code::kMarkedForDeoptimizationBit));
-    __ Branch(&found_deoptimized_code, ne, a5, Operand(zero_reg));
-
-    // Optimized code is good, get it into the closure and link the closure into
-    // the optimized functions list, then tail call the optimized code.
-    // The feedback vector is no longer used, so re-use it as a scratch
-    // register.
-    ReplaceClosureCodeWithOptimizedCode(masm, optimized_code_entry, closure,
-                                        scratch2, scratch3, feedback_vector);
+  static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+  __ Daddu(a2, optimized_code_entry,
+           Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ Jump(a2);
 
-    static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
-    __ Daddu(a2, optimized_code_entry,
-             Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ Jump(a2);
+  // Optimized code slot contains deoptimized code, evict it and re-enter the
+  // closure's code.
+  __ bind(&found_deoptimized_code);
+  GenerateTailCallToReturnedCode(masm, Runtime::kEvictOptimizedCodeSlot);
+}
 
-    // Optimized code slot contains deoptimized code, evict it and re-enter the
-    // losure's code.
-    __ bind(&found_deoptimized_code);
-    GenerateTailCallToReturnedCode(masm, Runtime::kEvictOptimizedCodeSlot);
+static void MaybeOptimizeCode(MacroAssembler* masm, Register feedback_vector,
+                              Register optimization_marker) {
+  // ----------- S t a t e -------------
+  //  -- a3 : new target (preserved for callee if needed, and caller)
+  //  -- a1 : target function (preserved for callee if needed, and caller)
+  //  -- feedback vector (preserved for caller if needed)
+  //  -- optimization_marker : a Smi containing a non-zero optimization marker.
+  // -----------------------------------
+  DCHECK(!AreAliased(feedback_vector, a1, a3, optimization_marker));
+
+  // TODO(v8:8394): The logging of first execution will break if
+  // feedback vectors are not allocated. We need to find a different way of
+  // logging these events if required.
+  TailCallRuntimeIfMarkerEquals(masm, optimization_marker,
+                                OptimizationMarker::kLogFirstExecution,
+                                Runtime::kFunctionFirstExecution);
+  TailCallRuntimeIfMarkerEquals(masm, optimization_marker,
+                                OptimizationMarker::kCompileOptimized,
+                                Runtime::kCompileOptimized_NotConcurrent);
+  TailCallRuntimeIfMarkerEquals(masm, optimization_marker,
+                                OptimizationMarker::kCompileOptimizedConcurrent,
+                                Runtime::kCompileOptimized_Concurrent);
+
+  // Otherwise, the marker is InOptimizationQueue, so fall through hoping
+  // that an interrupt will eventually update the slot with optimized code.
+  if (FLAG_debug_code) {
+    __ Assert(eq, AbortReason::kExpectedOptimizationSentinel,
+              optimization_marker,
+              Operand(Smi::FromEnum(OptimizationMarker::kInOptimizationQueue)));
   }
-
-  // Fall-through if the optimized code cell is clear and there is no
-  // optimization marker.
-  __ bind(&fallthrough);
 }
 
 // Advance the current bytecode offset. This simulates what all bytecode
@@ -1069,7 +1022,19 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 
   // Read off the optimized code slot in the feedback vector, and if there
   // is optimized code or an optimization marker, call that instead.
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, a4, t3, a5);
+  Register optimized_code_entry = a4;
+  __ Ld(optimized_code_entry,
+        FieldMemOperand(feedback_vector,
+                        FeedbackVector::kOptimizedCodeWeakOrSmiOffset));
+
+  // Check if the optimized code slot is not empty.
+  Label optimized_code_slot_not_empty;
+
+  __ Branch(&optimized_code_slot_not_empty, ne, optimized_code_entry,
+            Operand(Smi::FromEnum(OptimizationMarker::kNone)));
+
+  Label not_optimized;
+  __ bind(&not_optimized);
 
   // Increment invocation count for the function.
   __ Lw(a4, FieldMemOperand(feedback_vector,
@@ -1182,6 +1147,21 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   LeaveInterpreterFrame(masm, t0);
   __ Jump(ra);
 
+  __ bind(&optimized_code_slot_not_empty);
+  Label maybe_has_optimized_code;
+  // Check if optimized code marker is actually a weak reference to the
+  // optimized code as opposed to an optimization marker.
+  __ JumpIfNotSmi(optimized_code_entry, &maybe_has_optimized_code);
+  MaybeOptimizeCode(masm, feedback_vector, optimized_code_entry);
+  // Fall through if there's no runnable optimized code.
+  __ jmp(&not_optimized);
+
+  __ bind(&maybe_has_optimized_code);
+  // Load code entry from the weak reference, if it was cleared, resume
+  // execution of unoptimized code.
+  __ LoadWeakValue(optimized_code_entry, optimized_code_entry, &not_optimized);
+  TailCallOptimizedCodeSlot(masm, optimized_code_entry, t3, a5);
+
   __ bind(&compile_lazy);
   GenerateTailCallToReturnedCode(masm, Runtime::kCompileLazy);
   // Unreachable code.
@@ -1209,7 +1189,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
   __ Daddu(index, index, Operand(-kPointerSize));
   __ push(scratch);
   __ bind(&loop_check);
-  __ Branch(&loop_header, gt, index, Operand(scratch2));
+  __ Branch(&loop_header, hi, index, Operand(scratch2));
 }
 
 // static
@@ -1415,70 +1395,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argument count (preserved for callee)
-  //  -- a1 : new target (preserved for callee)
-  //  -- a3 : target function (preserved for callee)
-  // -----------------------------------
-  Label failed;
-  {
-    FrameScope scope(masm, StackFrame::INTERNAL);
-    // Push a copy of the target function and the new target.
-    // Push function as parameter to the runtime call.
-    __ Move(t2, a0);
-    __ SmiTag(a0);
-    __ Push(a0, a1, a3, a1);
-
-    // Copy arguments from caller (stdlib, foreign, heap).
-    Label args_done;
-    for (int j = 0; j < 4; ++j) {
-      Label over;
-      if (j < 3) {
-        __ Branch(&over, ne, t2, Operand(j));
-      }
-      for (int i = j - 1; i >= 0; --i) {
-        __ Ld(t2, MemOperand(fp, StandardFrameConstants::kCallerSPOffset +
-                                     i * kPointerSize));
-        __ push(t2);
-      }
-      for (int i = 0; i < 3 - j; ++i) {
-        __ PushRoot(RootIndex::kUndefinedValue);
-      }
-      if (j < 3) {
-        __ jmp(&args_done);
-        __ bind(&over);
-      }
-    }
-    __ bind(&args_done);
-
-    // Call runtime, on success unwind frame, and parent frame.
-    __ CallRuntime(Runtime::kInstantiateAsmJs, 4);
-    // A smi 0 is returned on failure, an object on success.
-    __ JumpIfSmi(v0, &failed);
-
-    __ Drop(2);
-    __ pop(t2);
-    __ SmiUntag(t2);
-    scope.GenerateLeaveFrame();
-
-    __ Daddu(t2, t2, Operand(1));
-    __ Dlsa(sp, sp, t2, kPointerSizeLog2);
-    __ Ret();
-
-    __ bind(&failed);
-    // Restore target function and new target.
-    __ Pop(a0, a1, a3);
-    __ SmiUntag(a0);
-  }
-  // On failure, tail call back to regular js by re-calling the function
-  // which has be reset to the compile lazy builtin.
-  static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
-  __ Ld(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
-  __ Daddu(a2, a2, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(a2);
-}
-
 namespace {
 void Generate_ContinueToBuiltinHelper(MacroAssembler* masm,
                                       bool java_script_builtin,
@@ -1906,7 +1822,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
     __ JumpIfSmi(a3, &new_target_not_constructor);
     __ ld(t1, FieldMemOperand(a3, HeapObject::kMapOffset));
     __ lbu(t1, FieldMemOperand(t1, Map::kBitFieldOffset));
-    __ And(t1, t1, Operand(Map::IsConstructorBit::kMask));
+    __ And(t1, t1, Operand(Map::Bits1::IsConstructorBit::kMask));
     __ Branch(&new_target_constructor, ne, t1, Operand(zero_reg));
     __ bind(&new_target_not_constructor);
     {
@@ -1925,7 +1841,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   __ Branch(&arguments_adaptor, eq, a7,
             Operand(StackFrame::TypeToMarker(StackFrame::ARGUMENTS_ADAPTOR)));
   {
-    __ Ld(a7, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+    __ Ld(a7, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
     __ Ld(a7, FieldMemOperand(a7, JSFunction::kSharedFunctionInfoOffset));
     __ Lhu(a7, FieldMemOperand(
                    a7, SharedFunctionInfo::kFormalParameterCountOffset));
@@ -2063,9 +1979,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
 
   __ Lhu(a2,
          FieldMemOperand(a2, SharedFunctionInfo::kFormalParameterCountOffset));
-  ParameterCount actual(a0);
-  ParameterCount expected(a2);
-  __ InvokeFunctionCode(a1, no_reg, expected, actual, JUMP_FUNCTION);
+  __ InvokeFunctionCode(a1, no_reg, a2, a0, JUMP_FUNCTION);
 
   // The function is a "classConstructor", need to raise an exception.
   __ bind(&class_constructor);
@@ -2178,7 +2092,7 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
 
   // Check if target has a [[Call]] internal method.
   __ Lbu(t1, FieldMemOperand(t1, Map::kBitFieldOffset));
-  __ And(t1, t1, Operand(Map::IsCallableBit::kMask));
+  __ And(t1, t1, Operand(Map::Bits1::IsCallableBit::kMask));
   __ Branch(&non_callable, eq, t1, Operand(zero_reg));
 
   __ Jump(BUILTIN_CODE(masm->isolate(), CallProxy),
@@ -2336,7 +2250,7 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   // Check if target has a [[Construct]] internal method.
   __ ld(t1, FieldMemOperand(a1, HeapObject::kMapOffset));
   __ Lbu(t3, FieldMemOperand(t1, Map::kBitFieldOffset));
-  __ And(t3, t3, Operand(Map::IsConstructorBit::kMask));
+  __ And(t3, t3, Operand(Map::Bits1::IsConstructorBit::kMask));
   __ Branch(&non_constructor, eq, t3, Operand(zero_reg));
 
   // Dispatch based on instance type.
@@ -2522,25 +2436,19 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
     // overwritten in the runtime call below. We don't have any callee-saved
     // registers in wasm, so no need to store anything else.
     constexpr RegList gp_regs =
-        Register::ListOf<a0, a1, a2, a3, a4, a5, a6, a7>();
+        Register::ListOf(a0, a1, a2, a3, a4, a5, a6, a7);
     constexpr RegList fp_regs =
-        DoubleRegister::ListOf<f2, f4, f6, f8, f10, f12, f14>();
+        DoubleRegister::ListOf(f2, f4, f6, f8, f10, f12, f14);
     __ MultiPush(gp_regs);
     __ MultiPushFPU(fp_regs);
 
     // Pass instance and function index as an explicit arguments to the runtime
     // function.
     __ Push(kWasmInstanceRegister, kWasmCompileLazyFuncIndexRegister);
-    // Load the correct CEntry builtin from the instance object.
-    __ Ld(a2, FieldMemOperand(kWasmInstanceRegister,
-                              WasmInstanceObject::kIsolateRootOffset));
-    auto centry_id =
-        Builtins::kCEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit;
-    __ Ld(a2, MemOperand(a2, IsolateData::builtin_slot_offset(centry_id)));
     // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ Move(kContextRegister, Smi::zero());
-    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, a2);
+    __ CallRuntime(Runtime::kWasmCompileLazy, 2);
 
     // Restore registers.
     __ MultiPopFPU(fp_regs);
@@ -2813,51 +2721,6 @@ void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
   __ Ret();
 }
 
-void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argc
-  //  -- a1 : constructor
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ Ld(a3, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ SmiTst(a3, kScratchReg);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction,
-              kScratchReg, Operand(zero_reg));
-    __ GetObjectType(a3, a3, a4);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction, a4,
-              Operand(MAP_TYPE));
-
-    // Figure out the right elements kind.
-    __ Ld(a3, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-
-    // Load the map's "bit field 2" into a3. We only need the first byte,
-    // but the following bit field extraction takes care of that anyway.
-    __ Lbu(a3, FieldMemOperand(a3, Map::kBitField2Offset));
-    // Retrieve elements_kind from bit field 2.
-    __ DecodeField<Map::ElementsKindBits>(a3);
-
-    // Initial elements kind should be packed elements.
-    __ Assert(eq, AbortReason::kInvalidElementsKindForInternalPackedArray, a3,
-              Operand(PACKED_ELEMENTS));
-
-    // No arguments should be passed.
-    __ Assert(eq, AbortReason::kWrongNumberOfArgumentsForInternalPackedArray,
-              a0, Operand(static_cast<int64_t>(0)));
-  }
-
-  __ Jump(
-      BUILTIN_CODE(masm->isolate(), InternalArrayNoArgumentConstructor_Packed),
-      RelocInfo::CODE_TARGET);
-}
-
 namespace {
 
 int AddressOffset(ExternalReference ref0, ExternalReference ref1) {
@@ -3138,7 +3001,7 @@ void Builtins::Generate_CallApiGetter(MacroAssembler* masm) {
   __ Sd(scratch, MemOperand(sp, (PCA::kIsolateIndex + 1) * kPointerSize));
   __ Sd(holder, MemOperand(sp, (PCA::kHolderIndex + 1) * kPointerSize));
   // should_throw_on_error -> false
-  DCHECK_EQ(0, Smi::kZero.ptr());
+  DCHECK_EQ(0, Smi::zero().ptr());
   __ Sd(zero_reg,
         MemOperand(sp, (PCA::kShouldThrowOnErrorIndex + 1) * kPointerSize));
   __ Ld(scratch, FieldMemOperand(callback, AccessorInfo::kNameOffset));
diff --git a/deps/v8/src/builtins/number.tq b/deps/v8/src/builtins/number.tq
new file mode 100644
index 00000000000000..37d51812a9de27
--- /dev/null
+++ b/deps/v8/src/builtins/number.tq
@@ -0,0 +1,75 @@
+// Copyright 2019 the V8 project authors. All rights reserved. Use of this
+// source code is governed by a BSD-style license that can be found in the
+// LICENSE file.
+
+namespace runtime {
+  extern transitioning runtime
+  DoubleToStringWithRadix(implicit context: Context)(Number, Number): String;
+}  // namespace runtime
+
+namespace number {
+  extern macro NaNStringConstant(): String;
+  extern macro ZeroStringConstant(): String;
+  extern macro InfinityStringConstant(): String;
+  extern macro MinusInfinityStringConstant(): String;
+
+  const kAsciiZero: constexpr int32 = 48;        // '0' (ascii)
+  const kAsciiLowerCaseA: constexpr int32 = 97;  // 'a' (ascii)
+
+  transitioning macro ThisNumberValue(implicit context: Context)(
+      receiver: JSAny, method: constexpr string): Number {
+    return UnsafeCast<Number>(
+        ToThisValue(receiver, PrimitiveType::kNumber, method));
+  }
+
+  // https://tc39.github.io/ecma262/#sec-number.prototype.tostring
+  transitioning javascript builtin NumberPrototypeToString(
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): String {
+    // 1. Let x be ? thisNumberValue(this value).
+    const x = ThisNumberValue(receiver, 'Number.prototype.toString');
+
+    // 2. If radix is not present, let radixNumber be 10.
+    // 3. Else if radix is undefined, let radixNumber be 10.
+    // 4. Else, let radixNumber be ? ToInteger(radix).
+    const radix: JSAny = arguments[0];
+    const radixNumber: Number =
+        radix == Undefined ? 10 : ToInteger_Inline(radix, kTruncateMinusZero);
+
+    // 5. If radixNumber < 2 or radixNumber > 36, throw a RangeError exception.
+    if (radixNumber < 2 || radixNumber > 36) {
+      ThrowRangeError(MessageTemplate::kToRadixFormatRange);
+    }
+
+    // 6. If radixNumber = 10, return ! ToString(x).
+    if (radixNumber == 10) {
+      return NumberToString(x);
+    }
+
+    // 7. Return the String representation of this Number
+    //    value using the radix specified by radixNumber.
+
+    // Fast case where the result is a one character string.
+    if (TaggedIsPositiveSmi(x) && x < radixNumber) {
+      let charCode = Convert<int32>(UnsafeCast<Smi>(x));
+      if (charCode < 10) {
+        charCode += kAsciiZero;
+      } else {
+        charCode = charCode - 10 + kAsciiLowerCaseA;
+      }
+      return StringFromSingleCharCode(charCode);
+    }
+
+    if (x == -0) {
+      return ZeroStringConstant();
+    } else if (NumberIsNaN(x)) {
+      return NaNStringConstant();
+    } else if (x == V8_INFINITY) {
+      return InfinityStringConstant();
+    } else if (x == MINUS_V8_INFINITY) {
+      return MinusInfinityStringConstant();
+    }
+
+    return runtime::DoubleToStringWithRadix(x, radixNumber);
+  }
+}
diff --git a/deps/v8/src/builtins/object-fromentries.tq b/deps/v8/src/builtins/object-fromentries.tq
index fc36e34038d96f..2dbe9beacf1a05 100644
--- a/deps/v8/src/builtins/object-fromentries.tq
+++ b/deps/v8/src/builtins/object-fromentries.tq
@@ -33,7 +33,7 @@ namespace object {
   }
 
   transitioning javascript builtin
-  ObjectFromEntries(js-implicit context: Context, receiver: JSAny)(
+  ObjectFromEntries(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): JSAny {
     const iterable: JSAny = arguments[0];
     try {
@@ -62,7 +62,7 @@ namespace object {
       }
     }
     label Throw deferred {
-      ThrowTypeError(kNotIterable);
+      ThrowTypeError(MessageTemplate::kNotIterable);
     }
   }
 }  // namespace object
diff --git a/deps/v8/src/builtins/object.tq b/deps/v8/src/builtins/object.tq
index 3dc973cf4067dc..c6d3e922797a75 100644
--- a/deps/v8/src/builtins/object.tq
+++ b/deps/v8/src/builtins/object.tq
@@ -24,11 +24,14 @@ namespace runtime {
   extern transitioning runtime
   JSReceiverSetPrototypeOfDontThrow(implicit context:
                                         Context)(JSReceiver, JSAny): JSAny;
+
+  extern transitioning runtime ObjectCreate(implicit context:
+                                                Context)(JSAny, JSAny): JSAny;
 }  // namespace runtime
 
 namespace object {
   transitioning macro
-  ObjectIsExtensible(implicit context: Context)(object: JSAny): JSAny {
+  ObjectIsExtensibleImpl(implicit context: Context)(object: JSAny): JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object) otherwise return False;
     const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
         otherwise return runtime::ObjectIsExtensible(objectJSReceiver);
@@ -57,7 +60,7 @@ namespace object {
   }
 
   transitioning macro
-  ObjectGetPrototypeOf(implicit context: Context)(object: JSAny): JSAny {
+  ObjectGetPrototypeOfImpl(implicit context: Context)(object: JSAny): JSAny {
     const objectJSReceiver: JSReceiver = ToObject_Inline(context, object);
     return object::JSReceiverGetPrototypeOf(objectJSReceiver);
   }
@@ -72,7 +75,7 @@ namespace object {
 
   transitioning macro
   ObjectSetPrototypeOfThrow(implicit context: Context)(
-      object: JSAny, proto: JSReceiver | Null): JSAny {
+      object: JSAny, proto: JSReceiver|Null): JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object) otherwise return object;
     const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
         otherwise return runtime::JSReceiverSetPrototypeOfThrow(
@@ -83,43 +86,80 @@ namespace object {
 
   transitioning macro
   ObjectSetPrototypeOfDontThrow(implicit context: Context)(
-      object: JSAny, proto: JSReceiver | Null): JSAny {
+      object: JSAny, proto: JSReceiver|Null): JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object) otherwise return False;
     const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
         otherwise return runtime::JSReceiverSetPrototypeOfDontThrow(
         objectJSReceiver, proto);
     return proxy::ProxySetPrototypeOf(objectJSProxy, proto, False);
   }
-}  // namespace object
 
-namespace object_isextensible {
+  transitioning builtin CreateObjectWithoutProperties(
+      implicit context: Context)(prototype: JSAny): JSAny {
+    const nativeContext = LoadNativeContext(context);
+
+    try {
+      let map: Map;
+      let properties: NameDictionary|EmptyFixedArray;
+      typeswitch (prototype) {
+        case (Null): {
+          map = UnsafeCast<Map>(
+              nativeContext
+                  [NativeContextSlot::SLOW_OBJECT_WITH_NULL_PROTOTYPE_MAP]);
+          properties = AllocateNameDictionary(kNameDictionaryInitialCapacity);
+        }
+        case (prototype: JSReceiver): {
+          properties = kEmptyFixedArray;
+          const objectFunction = UnsafeCast<JSFunction>(
+              nativeContext[NativeContextSlot::OBJECT_FUNCTION_INDEX]);
+          map = UnsafeCast<Map>(objectFunction.prototype_or_initial_map);
+          if (prototype != map.prototype) {
+            const prototypeInfo =
+                prototype.map.PrototypeInfo() otherwise Runtime;
+            typeswitch (prototypeInfo.object_create_map) {
+              case (Undefined): {
+                goto Runtime;
+              }
+              case (weak_map: Weak<Map>): {
+                map = WeakToStrong(weak_map) otherwise Runtime;
+              }
+            }
+          }
+        }
+        case (JSAny): {
+          goto Runtime;
+        }
+      }
+      return AllocateJSObjectFromMap(map, properties);
+    }
+    label Runtime deferred {
+      return runtime::ObjectCreate(prototype, Undefined);
+    }
+  }
+
   // ES6 section 19.1.2.11 Object.isExtensible ( O )
   transitioning javascript builtin
-  ObjectIsExtensible(js-implicit context: Context)(object: JSAny): JSAny {
-    return object::ObjectIsExtensible(object);
+  ObjectIsExtensible(js-implicit context: NativeContext)(object: JSAny): JSAny {
+    return object::ObjectIsExtensibleImpl(object);
   }
-}  // namespace object_isextensible
 
-namespace object_preventextensions {
-  // ES6 section 19.1.2.11 Object.isExtensible ( O )
+  // ES6 section 19.1.2.18 Object.preventExtensions ( O )
   transitioning javascript builtin
-  ObjectPreventExtensions(js-implicit context: Context)(object: JSAny): JSAny {
+  ObjectPreventExtensions(js-implicit context: NativeContext)(object: JSAny):
+      JSAny {
     return object::ObjectPreventExtensionsThrow(object);
   }
-}  // namespace object_preventextensions
 
-namespace object_getprototypeof {
   // ES6 section 19.1.2.9 Object.getPrototypeOf ( O )
   transitioning javascript builtin
-  ObjectGetPrototypeOf(js-implicit context: Context)(object: JSAny): JSAny {
-    return object::ObjectGetPrototypeOf(object);
+  ObjectGetPrototypeOf(js-implicit context: NativeContext)(object: JSAny):
+      JSAny {
+    return object::ObjectGetPrototypeOfImpl(object);
   }
-}  // namespace object_getprototypeof
 
-namespace object_setprototypeof {
   // ES6 section 19.1.2.21 Object.setPrototypeOf ( O, proto )
   transitioning javascript builtin ObjectSetPrototypeOf(
-      js-implicit context: Context)(object: JSAny, proto: JSAny): JSAny {
+      js-implicit context: NativeContext)(object: JSAny, proto: JSAny): JSAny {
     // 1. Set O to ? RequireObjectCoercible(O).
     RequireObjectCoercible(object, 'Object.setPrototypeOf');
 
@@ -130,12 +170,12 @@ namespace object_setprototypeof {
     // 5. If status is false, throw a TypeError exception.
     // 6. Return O.
     typeswitch (proto) {
-      case (proto: JSReceiver | Null): {
+      case (proto: JSReceiver|Null): {
         return object::ObjectSetPrototypeOfThrow(object, proto);
       }
       case (JSAny): {
-        ThrowTypeError(kProtoObjectOrNull, proto);
+        ThrowTypeError(MessageTemplate::kProtoObjectOrNull, proto);
       }
     }
   }
-}  // namespace object_setprototypeof
+}  // namespace object
diff --git a/deps/v8/src/builtins/ppc/builtins-ppc.cc b/deps/v8/src/builtins/ppc/builtins-ppc.cc
index ab0c7900d59490..97e870959ab2ab 100644
--- a/deps/v8/src/builtins/ppc/builtins-ppc.cc
+++ b/deps/v8/src/builtins/ppc/builtins-ppc.cc
@@ -34,29 +34,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address) {
           RelocInfo::CODE_TARGET);
 }
 
-void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3     : number of arguments
-  //  -- lr     : return address
-  //  -- sp[...]: constructor arguments
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin InternalArray functions should be maps.
-    __ LoadP(r5, FieldMemOperand(r4, JSFunction::kPrototypeOrInitialMapOffset));
-    __ TestIfSmi(r5, r0);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForInternalArrayFunction,
-              cr0);
-    __ CompareObjectType(r5, r6, r7, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForInternalArrayFunction);
-  }
-
-  // Run the native code for the InternalArray function called as a normal
-  // function.
-  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
-          RelocInfo::CODE_TARGET);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -90,7 +67,7 @@ void LoadRealStackLimit(MacroAssembler* masm, Register destination) {
   intptr_t offset =
       TurboAssembler::RootRegisterOffsetForExternalReference(isolate, limit);
   CHECK(is_int32(offset));
-  __ LoadP(destination, MemOperand(kRootRegister, offset));
+  __ LoadP(destination, MemOperand(kRootRegister, offset), r0);
 }
 
 void Generate_StackOverflowCheck(MacroAssembler* masm, Register num_args,
@@ -167,8 +144,7 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     // r6: new target
     {
       ConstantPoolUnavailableScope constant_pool_unavailable(masm);
-      ParameterCount actual(r3);
-      __ InvokeFunction(r4, r6, actual, CALL_FUNCTION);
+      __ InvokeFunctionWithNewTarget(r4, r6, r3, CALL_FUNCTION);
     }
 
     // Restore context from the frame.
@@ -323,8 +299,7 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
     // Call the function.
     {
       ConstantPoolUnavailableScope constant_pool_unavailable(masm);
-      ParameterCount actual(r3);
-      __ InvokeFunction(r4, r6, actual, CALL_FUNCTION);
+      __ InvokeFunctionWithNewTarget(r4, r6, r3, CALL_FUNCTION);
     }
 
     // ----------- S t a t e -------------
@@ -1464,71 +1439,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3 : argument count (preserved for callee)
-  //  -- r4 : new target (preserved for callee)
-  //  -- r6 : target function (preserved for callee)
-  // -----------------------------------
-  Label failed;
-  {
-    FrameScope scope(masm, StackFrame::INTERNAL);
-    // Preserve argument count for later compare.
-    __ Move(r7, r3);
-    // Push a copy of the target function and the new target.
-    // Push function as parameter to the runtime call.
-    __ SmiTag(r3);
-    __ Push(r3, r4, r6, r4);
-
-    // Copy arguments from caller (stdlib, foreign, heap).
-    Label args_done;
-    for (int j = 0; j < 4; ++j) {
-      Label over;
-      if (j < 3) {
-        __ cmpi(r7, Operand(j));
-        __ bne(&over);
-      }
-      for (int i = j - 1; i >= 0; --i) {
-        __ LoadP(r7, MemOperand(fp, StandardFrameConstants::kCallerSPOffset +
-                                        i * kPointerSize));
-        __ push(r7);
-      }
-      for (int i = 0; i < 3 - j; ++i) {
-        __ PushRoot(RootIndex::kUndefinedValue);
-      }
-      if (j < 3) {
-        __ jmp(&args_done);
-        __ bind(&over);
-      }
-    }
-    __ bind(&args_done);
-
-    // Call runtime, on success unwind frame, and parent frame.
-    __ CallRuntime(Runtime::kInstantiateAsmJs, 4);
-    // A smi 0 is returned on failure, an object on success.
-    __ JumpIfSmi(r3, &failed);
-
-    __ Drop(2);
-    __ pop(r7);
-    __ SmiUntag(r7);
-    scope.GenerateLeaveFrame();
-
-    __ addi(r7, r7, Operand(1));
-    __ Drop(r7);
-    __ Ret();
-
-    __ bind(&failed);
-    // Restore target function and new target.
-    __ Pop(r3, r4, r6);
-    __ SmiUntag(r3);
-  }
-  // On failure, tail call back to regular js by re-calling the function
-  // which has be reset to the compile lazy builtin.
-  static_assert(kJavaScriptCallCodeStartRegister == r5, "ABI mismatch");
-  __ LoadP(r5, FieldMemOperand(r4, JSFunction::kCodeOffset));
-  __ JumpCodeObject(r5);
-}
-
 namespace {
 void Generate_ContinueToBuiltinHelper(MacroAssembler* masm,
                                       bool java_script_builtin,
@@ -1964,7 +1874,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
     __ JumpIfSmi(r6, &new_target_not_constructor);
     __ LoadP(scratch, FieldMemOperand(r6, HeapObject::kMapOffset));
     __ lbz(scratch, FieldMemOperand(scratch, Map::kBitFieldOffset));
-    __ TestBit(scratch, Map::IsConstructorBit::kShift, r0);
+    __ TestBit(scratch, Map::Bits1::IsConstructorBit::kShift, r0);
     __ bne(&new_target_constructor, cr0);
     __ bind(&new_target_not_constructor);
     {
@@ -1985,7 +1895,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
           Operand(StackFrame::TypeToMarker(StackFrame::ARGUMENTS_ADAPTOR)));
   __ beq(&arguments_adaptor);
   {
-    __ LoadP(r8, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+    __ LoadP(r8, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
     __ LoadP(r8, FieldMemOperand(r8, JSFunction::kSharedFunctionInfoOffset));
     __ LoadHalfWord(
         r8,
@@ -2125,9 +2035,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
 
   __ LoadHalfWord(
       r5, FieldMemOperand(r5, SharedFunctionInfo::kFormalParameterCountOffset));
-  ParameterCount actual(r3);
-  ParameterCount expected(r5);
-  __ InvokeFunctionCode(r4, no_reg, expected, actual, JUMP_FUNCTION);
+  __ InvokeFunctionCode(r4, no_reg, r5, r3, JUMP_FUNCTION);
 
   // The function is a "classConstructor", need to raise an exception.
   __ bind(&class_constructor);
@@ -2268,7 +2176,7 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
 
   // Check if target has a [[Call]] internal method.
   __ lbz(r7, FieldMemOperand(r7, Map::kBitFieldOffset));
-  __ TestBit(r7, Map::IsCallableBit::kShift, r0);
+  __ TestBit(r7, Map::Bits1::IsCallableBit::kShift, r0);
   __ beq(&non_callable, cr0);
 
   // Check if target is a proxy and call CallProxy external builtin
@@ -2369,7 +2277,7 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   // Check if target has a [[Construct]] internal method.
   __ LoadP(r7, FieldMemOperand(r4, HeapObject::kMapOffset));
   __ lbz(r5, FieldMemOperand(r7, Map::kBitFieldOffset));
-  __ TestBit(r5, Map::IsConstructorBit::kShift, r0);
+  __ TestBit(r5, Map::Bits1::IsConstructorBit::kShift, r0);
   __ beq(&non_constructor, cr0);
 
   // Dispatch based on instance type.
@@ -2600,25 +2508,19 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
     // overwritten in the runtime call below. We don't have any callee-saved
     // registers in wasm, so no need to store anything else.
     constexpr RegList gp_regs =
-        Register::ListOf<r3, r4, r5, r6, r7, r8, r9, r10>();
+        Register::ListOf(r3, r4, r5, r6, r7, r8, r9, r10);
     constexpr RegList fp_regs =
-        DoubleRegister::ListOf<d1, d2, d3, d4, d5, d6, d7, d8>();
+        DoubleRegister::ListOf(d1, d2, d3, d4, d5, d6, d7, d8);
     __ MultiPush(gp_regs);
     __ MultiPushDoubles(fp_regs);
 
     // Pass instance and function index as explicit arguments to the runtime
     // function.
     __ Push(kWasmInstanceRegister, kWasmCompileLazyFuncIndexRegister);
-    // Load the correct CEntry builtin from the instance object.
-    __ LoadP(r5, FieldMemOperand(kWasmInstanceRegister,
-                                 WasmInstanceObject::kIsolateRootOffset));
-    auto centry_id =
-        Builtins::kCEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit;
-    __ LoadP(r5, MemOperand(r5, IsolateData::builtin_slot_offset(centry_id)));
     // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ LoadSmiLiteral(cp, Smi::zero());
-    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, r5);
+    __ CallRuntime(Runtime::kWasmCompileLazy, 2);
     // The entrypoint address is the return value.
     __ mr(r11, kReturnRegister0);
 
@@ -2917,47 +2819,6 @@ void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
   __ Ret();
 }
 
-void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3 : argc
-  //  -- r4 : constructor
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ LoadP(r6, FieldMemOperand(r4, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ TestIfSmi(r6, r0);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, cr0);
-    __ CompareObjectType(r6, r6, r7, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
-
-    // Figure out the right elements kind
-    __ LoadP(r6, FieldMemOperand(r4, JSFunction::kPrototypeOrInitialMapOffset));
-    // Load the map's "bit field 2" into |result|.
-    __ lbz(r6, FieldMemOperand(r6, Map::kBitField2Offset));
-    // Retrieve elements_kind from bit field 2.
-    __ DecodeField<Map::ElementsKindBits>(r6);
-
-    // Initial elements kind should be packed elements.
-    __ cmpi(r6, Operand(PACKED_ELEMENTS));
-    __ Assert(eq, AbortReason::kInvalidElementsKindForInternalPackedArray);
-
-    // No arguments should be passed.
-    __ cmpi(r3, Operand(0));
-    __ Assert(eq, AbortReason::kWrongNumberOfArgumentsForInternalPackedArray);
-  }
-
-  __ Jump(
-      BUILTIN_CODE(masm->isolate(), InternalArrayNoArgumentConstructor_Packed),
-      RelocInfo::CODE_TARGET);
-}
-
 namespace {
 
 static int AddressOffset(ExternalReference ref0, ExternalReference ref1) {
@@ -3315,7 +3176,7 @@ void Builtins::Generate_DirectCEntry(MacroAssembler* masm) {
   __ mflr(r0);
   __ StoreP(r0, MemOperand(sp, kStackFrameExtraParamSlot * kPointerSize));
 
-  if (ABI_USES_FUNCTION_DESCRIPTORS && FLAG_embedded_builtins) {
+  if (ABI_USES_FUNCTION_DESCRIPTORS) {
     // AIX/PPC64BE Linux use a function descriptor;
     __ LoadP(ToRegister(ABI_TOC_REGISTER), MemOperand(temp2, kPointerSize));
     __ LoadP(temp2, MemOperand(temp2, 0));  // Instruction address
diff --git a/deps/v8/src/builtins/promise-abstract-operations.tq b/deps/v8/src/builtins/promise-abstract-operations.tq
new file mode 100644
index 00000000000000..8828ab84d26662
--- /dev/null
+++ b/deps/v8/src/builtins/promise-abstract-operations.tq
@@ -0,0 +1,535 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-promise.h'
+#include 'src/builtins/builtins-promise-gen.h'
+
+namespace runtime {
+  extern transitioning runtime
+  RejectPromise(implicit context: Context)(JSPromise, JSAny, Boolean): JSAny;
+
+  extern transitioning runtime
+  PromiseRevokeReject(implicit context: Context)(JSPromise): JSAny;
+
+  extern transitioning runtime
+  PromiseRejectAfterResolved(implicit context: Context)(JSPromise, JSAny):
+      JSAny;
+
+  extern transitioning runtime
+  PromiseResolveAfterResolved(implicit context: Context)(JSPromise, JSAny):
+      JSAny;
+
+  extern transitioning runtime
+  PromiseRejectEventFromStack(implicit context: Context)(JSPromise, JSAny):
+      JSAny;
+}
+
+// https://tc39.es/ecma262/#sec-promise-abstract-operations
+namespace promise {
+  extern macro AllocateFunctionWithMapAndContext(
+      Map, SharedFunctionInfo, Context): JSFunction;
+
+  extern macro PromiseReactionMapConstant(): Map;
+  extern macro PromiseFulfillReactionJobTaskMapConstant(): Map;
+  extern macro PromiseRejectReactionJobTaskMapConstant(): Map;
+  extern transitioning builtin
+  ResolvePromise(Context, JSPromise, JSAny): JSAny;
+
+  extern transitioning builtin
+  EnqueueMicrotask(Context, Microtask): Undefined;
+
+  macro
+  ExtractHandlerContext(implicit context: Context)(handler: Callable|Undefined):
+      Context labels NotFound {
+    let iter: JSAny = handler;
+    while (true) {
+      typeswitch (iter) {
+        case (b: JSBoundFunction): {
+          iter = b.bound_target_function;
+        }
+        case (p: JSProxy): {
+          iter = p.target;
+        }
+        case (f: JSFunction): {
+          return f.context;
+        }
+        case (JSAny): {
+          break;
+        }
+      }
+    }
+    goto NotFound;
+  }
+
+  // According to the HTML specification, we use the handler's context to
+  // EnqueueJob for Promise resolution.
+  macro
+  ExtractHandlerContext(implicit context: Context)(
+      primary: Callable|Undefined, secondary: Callable|Undefined): Context {
+    try {
+      return ExtractHandlerContext(primary) otherwise NotFound;
+    }
+    label NotFound deferred {
+      return ExtractHandlerContext(secondary) otherwise Default;
+    }
+    label Default deferred {
+      return context;
+    }
+  }
+
+  transitioning macro MorphAndEnqueuePromiseReaction(implicit context: Context)(
+      promiseReaction: PromiseReaction, argument: JSAny,
+      reactionType: constexpr PromiseReactionType): void {
+    let primaryHandler: Callable|Undefined;
+    let secondaryHandler: Callable|Undefined;
+    if constexpr (reactionType == kPromiseReactionFulfill) {
+      primaryHandler = promiseReaction.fulfill_handler;
+      secondaryHandler = promiseReaction.reject_handler;
+    } else {
+      StaticAssert(reactionType == kPromiseReactionReject);
+      primaryHandler = promiseReaction.reject_handler;
+      secondaryHandler = promiseReaction.fulfill_handler;
+    }
+
+    const handlerContext: Context =
+        ExtractHandlerContext(primaryHandler, secondaryHandler);
+
+    // Morph {current} from a PromiseReaction into a PromiseReactionJobTask
+    // and schedule that on the microtask queue. We try to minimize the number
+    // of stores here to avoid screwing up the store buffer.
+    StaticAssert(
+        kPromiseReactionSize ==
+        kPromiseReactionJobTaskSizeOfAllPromiseReactionJobTasks);
+    if constexpr (reactionType == kPromiseReactionFulfill) {
+      promiseReaction.map = PromiseFulfillReactionJobTaskMapConstant();
+      const promiseReactionJobTask =
+          UnsafeCast<PromiseFulfillReactionJobTask>(promiseReaction);
+      promiseReactionJobTask.argument = argument;
+      promiseReactionJobTask.context = handlerContext;
+      EnqueueMicrotask(handlerContext, promiseReactionJobTask);
+      StaticAssert(
+          kPromiseReactionFulfillHandlerOffset ==
+          kPromiseReactionJobTaskHandlerOffset);
+      StaticAssert(
+          kPromiseReactionPromiseOrCapabilityOffset ==
+          kPromiseReactionJobTaskPromiseOrCapabilityOffset);
+    } else {
+      StaticAssert(reactionType == kPromiseReactionReject);
+      promiseReaction.map = PromiseRejectReactionJobTaskMapConstant();
+      const promiseReactionJobTask =
+          UnsafeCast<PromiseRejectReactionJobTask>(promiseReaction);
+      promiseReactionJobTask.argument = argument;
+      promiseReactionJobTask.context = handlerContext;
+      promiseReactionJobTask.handler = primaryHandler;
+      EnqueueMicrotask(handlerContext, promiseReactionJobTask);
+      StaticAssert(
+          kPromiseReactionPromiseOrCapabilityOffset ==
+          kPromiseReactionJobTaskPromiseOrCapabilityOffset);
+    }
+  }
+
+  // https://tc39.es/ecma262/#sec-triggerpromisereactions
+  transitioning macro TriggerPromiseReactions(implicit context: Context)(
+      reactions: Zero|PromiseReaction, argument: JSAny,
+      reactionType: constexpr PromiseReactionType): void {
+    // We need to reverse the {reactions} here, since we record them on the
+    // JSPromise in the reverse order.
+    let current = reactions;
+    let reversed: Zero|PromiseReaction = kZero;
+
+    // As an additional safety net against misuse of the V8 Extras API, we
+    // sanity check the {reactions} to make sure that they are actually
+    // PromiseReaction instances and not actual JavaScript values (which
+    // would indicate that we're rejecting or resolving an already settled
+    // promise), see https://crbug.com/931640 for details on this.
+    while (true) {
+      typeswitch (current) {
+        case (Zero): {
+          break;
+        }
+        case (currentReaction: PromiseReaction): {
+          current = currentReaction.next;
+          currentReaction.next = reversed;
+          reversed = currentReaction;
+        }
+      }
+    }
+    // Morph the {reactions} into PromiseReactionJobTasks and push them
+    // onto the microtask queue.
+    current = reversed;
+    while (true) {
+      typeswitch (current) {
+        case (Zero): {
+          break;
+        }
+        case (currentReaction: PromiseReaction): {
+          current = currentReaction.next;
+          MorphAndEnqueuePromiseReaction(
+              currentReaction, argument, reactionType);
+        }
+      }
+    }
+  }
+
+  // https://tc39.es/ecma262/#sec-fulfillpromise
+  transitioning builtin
+  FulfillPromise(implicit context: Context)(promise: JSPromise, value: JSAny):
+      Undefined {
+    // Assert: The value of promise.[[PromiseState]] is "pending".
+    assert(promise.Status() == PromiseState::kPending);
+
+    // 2. Let reactions be promise.[[PromiseFulfillReactions]].
+    const reactions =
+        UnsafeCast<(Zero | PromiseReaction)>(promise.reactions_or_result);
+
+    // 3. Set promise.[[PromiseResult]] to value.
+    // 4. Set promise.[[PromiseFulfillReactions]] to undefined.
+    // 5. Set promise.[[PromiseRejectReactions]] to undefined.
+    promise.reactions_or_result = value;
+
+    // 6. Set promise.[[PromiseState]] to "fulfilled".
+    promise.SetStatus(PromiseState::kFulfilled);
+
+    // 7. Return TriggerPromiseReactions(reactions, value).
+    TriggerPromiseReactions(reactions, value, kPromiseReactionFulfill);
+    return Undefined;
+  }
+
+  extern macro PromiseBuiltinsAssembler::
+      IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate(): bool;
+
+  // https://tc39.es/ecma262/#sec-rejectpromise
+  transitioning builtin
+  RejectPromise(implicit context: Context)(
+      promise: JSPromise, reason: JSAny, debugEvent: Boolean): JSAny {
+    // If promise hook is enabled or the debugger is active, let
+    // the runtime handle this operation, which greatly reduces
+    // the complexity here and also avoids a couple of back and
+    // forth between JavaScript and C++ land.
+    if (IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate() ||
+        !promise.HasHandler()) {
+      // 7. If promise.[[PromiseIsHandled]] is false, perform
+      //    HostPromiseRejectionTracker(promise, "reject").
+      // We don't try to handle rejecting {promise} without handler
+      // here, but we let the C++ code take care of this completely.
+      return runtime::RejectPromise(promise, reason, debugEvent);
+    }
+
+    // 2. Let reactions be promise.[[PromiseRejectReactions]].
+    const reactions =
+        UnsafeCast<(Zero | PromiseReaction)>(promise.reactions_or_result);
+
+    // 3. Set promise.[[PromiseResult]] to reason.
+    // 4. Set promise.[[PromiseFulfillReactions]] to undefined.
+    // 5. Set promise.[[PromiseRejectReactions]] to undefined.
+    promise.reactions_or_result = reason;
+
+    // 6. Set promise.[[PromiseState]] to "rejected".
+    promise.SetStatus(PromiseState::kRejected);
+
+    // 8. Return TriggerPromiseReactions(reactions, reason).
+    TriggerPromiseReactions(reactions, reason, kPromiseReactionReject);
+    return Undefined;
+  }
+
+  const kPromiseCapabilitySize:
+      constexpr int31 generates 'PromiseCapability::kSize';
+  const kPromiseBuiltinsCapabilitiesContextLength: constexpr int31
+  generates 'PromiseBuiltins::kCapabilitiesContextLength';
+  const kPromiseBuiltinsCapabilitySlot: constexpr ContextSlot
+  generates 'PromiseBuiltins::kCapabilitySlot';
+  const kPromiseBuiltinsPromiseSlot: constexpr ContextSlot
+  generates 'PromiseBuiltins::kPromiseSlot';
+  const kPromiseBuiltinsAlreadyResolvedSlot: constexpr ContextSlot
+  generates 'PromiseBuiltins::kAlreadyResolvedSlot';
+  const kPromiseBuiltinsDebugEventSlot: constexpr ContextSlot
+  generates 'PromiseBuiltins::kDebugEventSlot';
+
+  @export
+  macro CreatePromiseCapabilitiesExecutorContext(
+      nativeContext: NativeContext, capability: PromiseCapability): Context {
+    const executorContext = AllocateSyntheticFunctionContext(
+        nativeContext, kPromiseBuiltinsCapabilitiesContextLength);
+
+    executorContext[kPromiseBuiltinsCapabilitySlot] = capability;
+    return executorContext;
+  }
+
+  @export
+  macro CreatePromiseCapability(
+      promise: JSReceiver|Undefined, resolve: JSFunction|Undefined,
+      reject: JSFunction|Undefined): PromiseCapability {
+    return new PromiseCapability{
+      map: kPromiseCapabilityMap,
+      promise: promise,
+      resolve: resolve,
+      reject: reject
+    };
+  }
+
+  @export
+  struct PromiseResolvingFunctions {
+    resolve: JSFunction;
+    reject: JSFunction;
+  }
+
+  @export
+  macro CreatePromiseResolvingFunctions(implicit context: Context)(
+      promise: JSPromise, debugEvent: Object, nativeContext: NativeContext):
+      PromiseResolvingFunctions {
+    const promiseContext = CreatePromiseResolvingFunctionsContext(
+        promise, debugEvent, nativeContext);
+    const map = UnsafeCast<Map>(
+        nativeContext
+            [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
+    const resolveInfo = UnsafeCast<SharedFunctionInfo>(
+        nativeContext[NativeContextSlot::
+                          PROMISE_CAPABILITY_DEFAULT_RESOLVE_SHARED_FUN_INDEX]);
+    const resolve: JSFunction =
+        AllocateFunctionWithMapAndContext(map, resolveInfo, promiseContext);
+    const rejectInfo = UnsafeCast<SharedFunctionInfo>(
+        nativeContext[NativeContextSlot::
+                          PROMISE_CAPABILITY_DEFAULT_REJECT_SHARED_FUN_INDEX]);
+    const reject: JSFunction =
+        AllocateFunctionWithMapAndContext(map, rejectInfo, promiseContext);
+    return PromiseResolvingFunctions{resolve: resolve, reject: reject};
+  }
+
+  transitioning macro
+  InnerNewPromiseCapability(implicit context: Context)(
+      constructor: HeapObject, debugEvent: Object): PromiseCapability {
+    const nativeContext = LoadNativeContext(context);
+    if (TaggedEqual(
+            constructor,
+            nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX])) {
+      const promise = NewJSPromise();
+
+      const pair =
+          CreatePromiseResolvingFunctions(promise, debugEvent, nativeContext);
+
+      return CreatePromiseCapability(promise, pair.resolve, pair.reject);
+    } else {
+      // We have to create the capability before the associated promise
+      // because the builtin PromiseConstructor uses the executor.
+      const capability =
+          CreatePromiseCapability(Undefined, Undefined, Undefined);
+      const executorContext =
+          CreatePromiseCapabilitiesExecutorContext(nativeContext, capability);
+
+      const executorInfo = UnsafeCast<SharedFunctionInfo>(
+          nativeContext[NativeContextSlot::
+                            PROMISE_GET_CAPABILITIES_EXECUTOR_SHARED_FUN]);
+      const functionMap = UnsafeCast<Map>(
+          nativeContext
+              [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
+      const executor = AllocateFunctionWithMapAndContext(
+          functionMap, executorInfo, executorContext);
+
+      const promiseConstructor = UnsafeCast<Constructor>(constructor);
+      const promise = Construct(promiseConstructor, executor);
+      capability.promise = promise;
+
+      if (!TaggedIsCallable(capability.resolve) ||
+          !TaggedIsCallable(capability.reject)) {
+        ThrowTypeError(MessageTemplate::kPromiseNonCallable);
+      }
+      return capability;
+    }
+  }
+
+  // https://tc39.es/ecma262/#sec-newpromisecapability
+  transitioning builtin
+  NewPromiseCapability(implicit context: Context)(
+      maybeConstructor: Object, debugEvent: Object): PromiseCapability {
+    typeswitch (maybeConstructor) {
+      case (Smi): {
+        ThrowTypeError(MessageTemplate::kNotConstructor, maybeConstructor);
+      }
+      case (constructor: HeapObject): {
+        if (!IsConstructor(constructor)) {
+          ThrowTypeError(MessageTemplate::kNotConstructor, maybeConstructor);
+        }
+        return InnerNewPromiseCapability(constructor, debugEvent);
+      }
+    }
+  }
+
+  // https://tc39.es/ecma262/#sec-promise-reject-functions
+  transitioning javascript builtin
+  PromiseCapabilityDefaultReject(
+      js-implicit context: NativeContext,
+      receiver: JSAny)(reason: JSAny): JSAny {
+    // 2. Let promise be F.[[Promise]].
+    const promise = UnsafeCast<JSPromise>(context[kPromiseBuiltinsPromiseSlot]);
+
+    // 3. Let alreadyResolved be F.[[AlreadyResolved]].
+    const alreadyResolved =
+        UnsafeCast<Boolean>(context[kPromiseBuiltinsAlreadyResolvedSlot]);
+
+    // 4. If alreadyResolved.[[Value]] is true, return undefined.
+    if (alreadyResolved == True) {
+      return runtime::PromiseRejectAfterResolved(promise, reason);
+    }
+
+    // 5. Set alreadyResolved.[[Value]] to true.
+    context[kPromiseBuiltinsAlreadyResolvedSlot] = True;
+
+    // 6. Return RejectPromise(promise, reason).
+    const debugEvent =
+        UnsafeCast<Boolean>(context[kPromiseBuiltinsDebugEventSlot]);
+    return RejectPromise(promise, reason, debugEvent);
+  }
+
+  // https://tc39.es/ecma262/#sec-promise-resolve-functions
+  transitioning javascript builtin
+  PromiseCapabilityDefaultResolve(
+      js-implicit context: NativeContext,
+      receiver: JSAny)(resolution: JSAny): JSAny {
+    // 2. Let promise be F.[[Promise]].
+    const promise = UnsafeCast<JSPromise>(context[kPromiseBuiltinsPromiseSlot]);
+
+    // 3. Let alreadyResolved be F.[[AlreadyResolved]].
+    const alreadyResolved =
+        UnsafeCast<Boolean>(context[kPromiseBuiltinsAlreadyResolvedSlot]);
+
+    // 4. If alreadyResolved.[[Value]] is true, return undefined.
+    if (alreadyResolved == True) {
+      return runtime::PromiseResolveAfterResolved(promise, resolution);
+    }
+
+    // 5. Set alreadyResolved.[[Value]] to true.
+    context[kPromiseBuiltinsAlreadyResolvedSlot] = True;
+
+    // The rest of the logic (and the catch prediction) is
+    // encapsulated in the dedicated ResolvePromise builtin.
+    return ResolvePromise(context, promise, resolution);
+  }
+
+  @export
+  transitioning macro PerformPromiseThenImpl(implicit context: Context)(
+      promise: JSPromise, onFulfilled: Callable|Undefined,
+      onRejected: Callable|Undefined,
+      resultPromiseOrCapability: JSPromise|PromiseCapability|Undefined): void {
+    if (promise.Status() == PromiseState::kPending) {
+      // The {promise} is still in "Pending" state, so we just record a new
+      // PromiseReaction holding both the onFulfilled and onRejected callbacks.
+      // Once the {promise} is resolved we decide on the concrete handler to
+      // push onto the microtask queue.
+      const promiseReactions =
+          UnsafeCast<(Zero | PromiseReaction)>(promise.reactions_or_result);
+      const reaction = NewPromiseReaction(
+          promiseReactions, resultPromiseOrCapability, onFulfilled, onRejected);
+      promise.reactions_or_result = reaction;
+    } else {
+      let map: Map;
+      let handler: Callable|Undefined = Undefined;
+      let handlerContext: Context;
+      if (promise.Status() == PromiseState::kFulfilled) {
+        map = PromiseFulfillReactionJobTaskMapConstant();
+        handler = onFulfilled;
+        handlerContext = ExtractHandlerContext(onFulfilled, onRejected);
+      } else
+        deferred {
+          assert(promise.Status() == PromiseState::kRejected);
+          map = PromiseRejectReactionJobTaskMapConstant();
+          handler = onRejected;
+          handlerContext = ExtractHandlerContext(onRejected, onFulfilled);
+          if (!promise.HasHandler()) {
+            runtime::PromiseRevokeReject(promise);
+          }
+        }
+
+      const reactionsOrResult = promise.reactions_or_result;
+      const microtask = NewPromiseReactionJobTask(
+          map, handlerContext, reactionsOrResult, handler,
+          resultPromiseOrCapability);
+      EnqueueMicrotask(handlerContext, microtask);
+    }
+    promise.SetHasHandler();
+  }
+
+  // https://tc39.es/ecma262/#sec-performpromisethen
+  transitioning builtin
+  PerformPromiseThen(implicit context: Context)(
+      promise: JSPromise, onFulfilled: Callable|Undefined,
+      onRejected: Callable|Undefined,
+      resultPromise: JSPromise|Undefined): JSAny {
+    PerformPromiseThenImpl(promise, onFulfilled, onRejected, resultPromise);
+    return resultPromise;
+  }
+
+  // https://tc39.es/ecma262/#sec-promise-reject-functions
+  transitioning javascript builtin
+  PromiseReject(js-implicit context: NativeContext, receiver: JSAny)(
+      reason: JSAny): JSAny {
+    // 1. Let C be the this value.
+    // 2. If Type(C) is not Object, throw a TypeError exception.
+    const receiver = Cast<JSReceiver>(receiver) otherwise
+    ThrowTypeError(MessageTemplate::kCalledOnNonObject, 'PromiseReject');
+
+    const promiseFun = context[NativeContextSlot::PROMISE_FUNCTION_INDEX];
+    if (promiseFun == receiver) {
+      const promise = NewJSPromise(PromiseState::kRejected, reason);
+      runtime::PromiseRejectEventFromStack(promise, reason);
+      return promise;
+    } else {
+      // 3. Let promiseCapability be ? NewPromiseCapability(C).
+      const capability = NewPromiseCapability(receiver, True);
+
+      // 4. Perform ? Call(promiseCapability.[[Reject]], undefined, « r »).
+      const reject = UnsafeCast<Callable>(capability.reject);
+      Call(context, reject, Undefined, reason);
+
+      // 5. Return promiseCapability.[[Promise]].
+      return capability.promise;
+    }
+  }
+
+  const kPromiseExecutorAlreadyInvoked: constexpr MessageTemplate
+  generates 'MessageTemplate::kPromiseExecutorAlreadyInvoked';
+
+  // https://tc39.es/ecma262/#sec-getcapabilitiesexecutor-functions
+  transitioning javascript builtin
+  PromiseGetCapabilitiesExecutor(
+      js-implicit context: NativeContext,
+      receiver: JSAny)(resolve: JSAny, reject: JSAny): JSAny {
+    const capability =
+        UnsafeCast<PromiseCapability>(context[kPromiseBuiltinsCapabilitySlot]);
+    if (capability.resolve != Undefined || capability.reject != Undefined)
+      deferred {
+        ThrowTypeError(kPromiseExecutorAlreadyInvoked);
+      }
+
+    capability.resolve = resolve;
+    capability.reject = reject;
+    return Undefined;
+  }
+
+  transitioning macro CallResolve(implicit context: Context)(
+      constructor: Constructor, resolve: JSAny, value: JSAny): JSAny {
+    // Undefined can never be a valid value for the resolve function,
+    // instead it is used as a special marker for the fast path.
+    if (resolve == Undefined) {
+      return PromiseResolve(constructor, value);
+    } else
+      deferred {
+        return Call(context, UnsafeCast<Callable>(resolve), constructor, value);
+      }
+  }
+
+  transitioning javascript builtin
+  PromiseConstructorLazyDeoptContinuation(
+      js-implicit context: NativeContext, receiver: JSAny)(
+      promise: JSAny, reject: JSAny, exception: JSAny|TheHole,
+      _result: JSAny): JSAny {
+    typeswitch (exception) {
+      case (TheHole): {
+      }
+      case (e: JSAny): {
+        Call(context, reject, Undefined, e);
+      }
+    }
+    return promise;
+  }
+}
diff --git a/deps/v8/src/builtins/promise-all-element-closure.tq b/deps/v8/src/builtins/promise-all-element-closure.tq
new file mode 100644
index 00000000000000..c320b24f036c1c
--- /dev/null
+++ b/deps/v8/src/builtins/promise-all-element-closure.tq
@@ -0,0 +1,189 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-promise.h'
+#include 'src/builtins/builtins-promise-gen.h'
+#include 'src/objects/property-array.h'
+
+namespace promise {
+
+  struct PromiseAllWrapResultAsFulfilledFunctor {
+    macro Call(_nativeContext: NativeContext, value: JSAny): JSAny {
+      return value;
+    }
+  }
+
+  struct PromiseAllSettledWrapResultAsFulfilledFunctor {
+    transitioning
+    macro Call(implicit context: Context)(
+        nativeContext: NativeContext, value: JSAny): JSAny {
+      // TODO(gsathya): Optimize the creation using a cached map to
+      // prevent transitions here.
+      // 9. Let obj be ! ObjectCreate(%ObjectPrototype%).
+      const objectFunction = UnsafeCast<JSFunction>(
+          nativeContext[NativeContextSlot::OBJECT_FUNCTION_INDEX]);
+      const objectFunctionMap =
+          UnsafeCast<Map>(objectFunction.prototype_or_initial_map);
+      const obj = AllocateJSObjectFromMap(objectFunctionMap);
+
+      // 10. Perform ! CreateDataProperty(obj, "status", "fulfilled").
+      FastCreateDataProperty(
+          obj, StringConstant('status'), StringConstant('fulfilled'));
+
+      // 11. Perform ! CreateDataProperty(obj, "value", x).
+      FastCreateDataProperty(obj, StringConstant('value'), value);
+      return obj;
+    }
+  }
+
+  struct PromiseAllSettledWrapResultAsRejectedFunctor {
+    transitioning
+    macro Call(implicit context: Context)(
+        nativeContext: NativeContext, value: JSAny): JSAny {
+      // TODO(gsathya): Optimize the creation using a cached map to
+      // prevent transitions here.
+      // 9. Let obj be ! ObjectCreate(%ObjectPrototype%).
+      const objectFunction = UnsafeCast<JSFunction>(
+          nativeContext[NativeContextSlot::OBJECT_FUNCTION_INDEX]);
+      const objectFunctionMap =
+          UnsafeCast<Map>(objectFunction.prototype_or_initial_map);
+      const obj = AllocateJSObjectFromMap(objectFunctionMap);
+
+      // 10. Perform ! CreateDataProperty(obj, "status", "rejected").
+      FastCreateDataProperty(
+          obj, StringConstant('status'), StringConstant('rejected'));
+
+      // 11. Perform ! CreateDataProperty(obj, "reason", x).
+      FastCreateDataProperty(obj, StringConstant('reason'), value);
+      return obj;
+    }
+  }
+
+  extern macro LoadJSReceiverIdentityHash(Object): intptr labels IfNoHash;
+
+  extern enum PromiseAllResolveElementContextSlots extends int31
+  constexpr 'PromiseBuiltins::PromiseAllResolveElementContextSlots' {
+    kPromiseAllResolveElementRemainingSlot,
+    kPromiseAllResolveElementCapabilitySlot,
+    kPromiseAllResolveElementValuesArraySlot,
+    kPromiseAllResolveElementLength
+  }
+  extern operator '[]=' macro StoreContextElement(
+      Context, constexpr PromiseAllResolveElementContextSlots, Object): void;
+  extern operator '[]' macro LoadContextElement(
+      Context, constexpr PromiseAllResolveElementContextSlots): Object;
+
+  const kPropertyArrayNoHashSentinel: constexpr int31
+  generates 'PropertyArray::kNoHashSentinel';
+
+  const kPropertyArrayHashFieldMax: constexpr int31
+  generates 'PropertyArray::HashField::kMax';
+
+  transitioning macro PromiseAllResolveElementClosure<F: type>(
+      implicit context:
+          Context)(value: JSAny, function: JSFunction, wrapResultFunctor: F):
+      JSAny {
+    // We use the {function}s context as the marker to remember whether this
+    // resolve element closure was already called. It points to the resolve
+    // element context (which is a FunctionContext) until it was called the
+    // first time, in which case we make it point to the native context here
+    // to mark this resolve element closure as done.
+    if (IsNativeContext(context)) deferred {
+        return Undefined;
+      }
+
+    assert(
+        context.length ==
+        PromiseAllResolveElementContextSlots::kPromiseAllResolveElementLength);
+    const nativeContext = LoadNativeContext(context);
+    function.context = nativeContext;
+
+    // Update the value depending on whether Promise.all or
+    // Promise.allSettled is called.
+    const updatedValue = wrapResultFunctor.Call(nativeContext, value);
+
+    // Determine the index from the {function}.
+    assert(kPropertyArrayNoHashSentinel == 0);
+    const identityHash =
+        LoadJSReceiverIdentityHash(function) otherwise unreachable;
+    assert(identityHash > 0);
+    const index = identityHash - 1;
+
+    // Check if we need to grow the [[ValuesArray]] to store {value} at {index}.
+    const valuesArray = UnsafeCast<JSArray>(
+        context[PromiseAllResolveElementContextSlots::
+                    kPromiseAllResolveElementValuesArraySlot]);
+    const elements = UnsafeCast<FixedArray>(valuesArray.elements);
+    const valuesLength = Convert<intptr>(valuesArray.length);
+    if (index < valuesLength) {
+      // The {index} is in bounds of the {values_array},
+      // just store the {value} and continue.
+      elements.objects[index] = updatedValue;
+    } else {
+      // Check if we need to grow the backing store.
+      const newLength = index + 1;
+      const elementsLength = elements.length_intptr;
+      if (index < elementsLength) {
+        // The {index} is within bounds of the {elements} backing store, so
+        // just store the {value} and update the "length" of the {values_array}.
+        valuesArray.length = Convert<Smi>(newLength);
+        elements.objects[index] = updatedValue;
+      } else
+        deferred {
+          // We need to grow the backing store to fit the {index} as well.
+          const newElementsLength = IntPtrMin(
+              CalculateNewElementsCapacity(newLength),
+              kPropertyArrayHashFieldMax + 1);
+          assert(index < newElementsLength);
+          assert(elementsLength < newElementsLength);
+          const newElements =
+              ExtractFixedArray(elements, 0, elementsLength, newElementsLength);
+          newElements.objects[index] = updatedValue;
+
+          // Update backing store and "length" on {values_array}.
+          valuesArray.elements = newElements;
+          valuesArray.length = Convert<Smi>(newLength);
+        }
+    }
+    let remainingElementsCount =
+        UnsafeCast<Smi>(context[PromiseAllResolveElementContextSlots::
+                                    kPromiseAllResolveElementRemainingSlot]);
+    remainingElementsCount = remainingElementsCount - 1;
+    context[PromiseAllResolveElementContextSlots::
+                kPromiseAllResolveElementRemainingSlot] =
+        remainingElementsCount;
+    if (remainingElementsCount == 0) {
+      const capability = UnsafeCast<PromiseCapability>(
+          context[PromiseAllResolveElementContextSlots::
+                      kPromiseAllResolveElementCapabilitySlot]);
+      const resolve = UnsafeCast<JSAny>(capability.resolve);
+      Call(context, resolve, Undefined, valuesArray);
+    }
+    return Undefined;
+  }
+
+  transitioning javascript builtin
+  PromiseAllResolveElementClosure(
+      js-implicit context: Context, receiver: JSAny,
+      target: JSFunction)(value: JSAny): JSAny {
+    return PromiseAllResolveElementClosure(
+        value, target, PromiseAllWrapResultAsFulfilledFunctor{});
+  }
+
+  transitioning javascript builtin
+  PromiseAllSettledResolveElementClosure(
+      js-implicit context: Context, receiver: JSAny,
+      target: JSFunction)(value: JSAny): JSAny {
+    return PromiseAllResolveElementClosure(
+        value, target, PromiseAllSettledWrapResultAsFulfilledFunctor{});
+  }
+
+  transitioning javascript builtin
+  PromiseAllSettledRejectElementClosure(
+      js-implicit context: Context, receiver: JSAny,
+      target: JSFunction)(value: JSAny): JSAny {
+    return PromiseAllResolveElementClosure(
+        value, target, PromiseAllSettledWrapResultAsRejectedFunctor{});
+  }
+}
diff --git a/deps/v8/src/builtins/promise-all.tq b/deps/v8/src/builtins/promise-all.tq
new file mode 100644
index 00000000000000..19a16d8da858f1
--- /dev/null
+++ b/deps/v8/src/builtins/promise-all.tq
@@ -0,0 +1,384 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-promise.h'
+#include 'src/builtins/builtins-promise-gen.h'
+
+namespace promise {
+  const kPromiseBuiltinsPromiseContextLength: constexpr int31
+  generates 'PromiseBuiltins::kPromiseContextLength';
+
+  // Creates the context used by all Promise.all resolve element closures,
+  // together with the values array. Since all closures for a single Promise.all
+  // call use the same context, we need to store the indices for the individual
+  // closures somewhere else (we put them into the identity hash field of the
+  // closures), and we also need to have a separate marker for when the closure
+  // was called already (we slap the native context onto the closure in that
+  // case to mark it's done).
+  macro CreatePromiseAllResolveElementContext(implicit context: Context)(
+      capability: PromiseCapability, nativeContext: NativeContext): Context {
+    // TODO(bmeurer): Manually fold this into a single allocation.
+    const arrayMap = UnsafeCast<Map>(
+        nativeContext[NativeContextSlot::JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX]);
+    const valuesArray = AllocateJSArray(
+        ElementsKind::PACKED_ELEMENTS, arrayMap, IntPtrConstant(0),
+        SmiConstant(0));
+    const resolveContext = AllocateSyntheticFunctionContext(
+        nativeContext,
+        PromiseAllResolveElementContextSlots::kPromiseAllResolveElementLength);
+    resolveContext[PromiseAllResolveElementContextSlots::
+                       kPromiseAllResolveElementRemainingSlot] = SmiConstant(1);
+    resolveContext[PromiseAllResolveElementContextSlots::
+                       kPromiseAllResolveElementCapabilitySlot] = capability;
+    resolveContext[PromiseAllResolveElementContextSlots::
+                       kPromiseAllResolveElementValuesArraySlot] = valuesArray;
+    return resolveContext;
+  }
+
+  macro CreatePromiseAllResolveElementFunction(implicit context: Context)(
+      resolveElementContext: Context, index: Smi, nativeContext: NativeContext,
+      slotIndex: constexpr NativeContextSlot): JSFunction {
+    assert(index > 0);
+    assert(index < kPropertyArrayHashFieldMax);
+
+    const map = UnsafeCast<Map>(
+        nativeContext
+            [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
+    const resolveInfo =
+        UnsafeCast<SharedFunctionInfo>(nativeContext[slotIndex]);
+    const resolve = AllocateFunctionWithMapAndContext(
+        map, resolveInfo, resolveElementContext);
+
+    assert(kPropertyArrayNoHashSentinel == 0);
+    resolve.properties_or_hash = index;
+    return resolve;
+  }
+
+  @export
+  macro CreatePromiseResolvingFunctionsContext(implicit context: Context)(
+      promise: JSPromise, debugEvent: Object, nativeContext: NativeContext):
+      Context {
+    const resolveContext = AllocateSyntheticFunctionContext(
+        nativeContext, kPromiseBuiltinsPromiseContextLength);
+    resolveContext[kPromiseBuiltinsPromiseSlot] = promise;
+    resolveContext[kPromiseBuiltinsAlreadyResolvedSlot] = False;
+    resolveContext[kPromiseBuiltinsDebugEventSlot] = debugEvent;
+    return resolveContext;
+  }
+
+  macro IsPromiseThenLookupChainIntact(implicit context: Context)(
+      nativeContext: NativeContext, receiverMap: Map): bool {
+    if (IsForceSlowPath()) return false;
+    if (!IsJSPromiseMap(receiverMap)) return false;
+    if (receiverMap.prototype !=
+        nativeContext[NativeContextSlot::PROMISE_PROTOTYPE_INDEX])
+      return false;
+    return !IsPromiseThenProtectorCellInvalid();
+  }
+
+  struct PromiseAllResolveElementFunctor {
+    macro Call(implicit context: Context)(
+        resolveElementContext: Context, nativeContext: NativeContext,
+        index: Smi, _capability: PromiseCapability): Callable {
+      return CreatePromiseAllResolveElementFunction(
+          resolveElementContext, index, nativeContext,
+          NativeContextSlot::PROMISE_ALL_RESOLVE_ELEMENT_SHARED_FUN);
+    }
+  }
+
+  struct PromiseAllRejectElementFunctor {
+    macro Call(implicit context: Context)(
+        _resolveElementContext: Context, _nativeContext: NativeContext,
+        _index: Smi, capability: PromiseCapability): Callable {
+      return UnsafeCast<Callable>(capability.reject);
+    }
+  }
+
+  struct PromiseAllSettledResolveElementFunctor {
+    macro Call(implicit context: Context)(
+        resolveElementContext: Context, nativeContext: NativeContext,
+        index: Smi, _capability: PromiseCapability): Callable {
+      return CreatePromiseAllResolveElementFunction(
+          resolveElementContext, index, nativeContext,
+          NativeContextSlot::PROMISE_ALL_SETTLED_RESOLVE_ELEMENT_SHARED_FUN);
+    }
+  }
+
+  struct PromiseAllSettledRejectElementFunctor {
+    macro Call(implicit context: Context)(
+        resolveElementContext: Context, nativeContext: NativeContext,
+        index: Smi, _capability: PromiseCapability): Callable {
+      return CreatePromiseAllResolveElementFunction(
+          resolveElementContext, index, nativeContext,
+          NativeContextSlot::PROMISE_ALL_SETTLED_REJECT_ELEMENT_SHARED_FUN);
+    }
+  }
+
+  transitioning macro PerformPromiseAll<F1: type, F2: type>(implicit context:
+                                                                  Context)(
+      constructor: JSReceiver, capability: PromiseCapability,
+      iter: iterator::IteratorRecord, createResolveElementFunctor: F1,
+      createRejectElementFunctor: F2): JSAny labels Reject(Object) {
+    const nativeContext = LoadNativeContext(context);
+    const promise = capability.promise;
+    const resolve = capability.resolve;
+    const reject = capability.reject;
+
+    // For catch prediction, don't treat the .then calls as handling it;
+    // instead, recurse outwards.
+    if (IsDebugActive()) deferred {
+        SetPropertyStrict(
+            context, reject, kPromiseForwardingHandlerSymbol, True);
+      }
+
+    const resolveElementContext =
+        CreatePromiseAllResolveElementContext(capability, nativeContext);
+
+    let index: Smi = 1;
+
+    // We can skip the "resolve" lookup on {constructor} if it's the
+    // Promise constructor and the Promise.resolve protector is intact,
+    // as that guards the lookup path for the "resolve" property on the
+    // Promise constructor.
+    let promiseResolveFunction: JSAny = Undefined;
+    try {
+      try {
+        if (!IsPromiseResolveLookupChainIntact(nativeContext, constructor)) {
+          // 5. Let _promiseResolve_ be ? Get(_constructor_, `"resolve"`).
+          let promiseResolve: JSAny;
+          try {
+            promiseResolve = GetProperty(constructor, kResolveString);
+          } catch (e) deferred {
+            iterator::IteratorCloseOnException(iter, e) otherwise Reject;
+          }
+
+          // 6. If IsCallable(_promiseResolve_) is *false*, throw a *TypeError*
+          // exception.
+          promiseResolveFunction = Cast<Callable>(promiseResolve)
+              otherwise ThrowTypeError(
+              MessageTemplate::kCalledNonCallable, 'resolve');
+        }
+
+        const fastIteratorResultMap = UnsafeCast<Map>(
+            nativeContext[NativeContextSlot::ITERATOR_RESULT_MAP_INDEX]);
+        while (true) {
+          let nextValue: JSAny;
+
+          // Let next be IteratorStep(iteratorRecord.[[Iterator]]).
+          // If next is an abrupt completion, set iteratorRecord.[[Done]] to
+          // true. ReturnIfAbrupt(next).
+          const next: JSReceiver = iterator::IteratorStep(
+              iter, fastIteratorResultMap) otherwise goto Done;
+
+          // Let nextValue be IteratorValue(next).
+          // If nextValue is an abrupt completion, set iteratorRecord.[[Done]]
+          // to true.
+          // ReturnIfAbrupt(nextValue).
+          nextValue = iterator::IteratorValue(next, fastIteratorResultMap);
+
+          // Check if we reached the limit.
+          if (index == kPropertyArrayHashFieldMax) {
+            // If there are too many elements (currently more than 2**21-1),
+            // raise a RangeError here (which is caught directly and turned into
+            // a rejection) of the resulting promise. We could gracefully handle
+            // this case as well and support more than this number of elements
+            // by going to a separate function and pass the larger indices via a
+            // separate context, but it doesn't seem likely that we need this,
+            // and it's unclear how the rest of the system deals with 2**21 live
+            // Promises anyways.
+            try {
+              ThrowRangeError(MessageTemplate::kTooManyElementsInPromiseAll);
+            } catch (e) deferred {
+              iterator::IteratorCloseOnException(iter, e) otherwise Reject;
+            }
+          }
+
+          // Set remainingElementsCount.[[Value]] to
+          //     remainingElementsCount.[[Value]] + 1.
+          const remainingElementsCount =
+              UnsafeCast<Smi>(resolveElementContext
+                                  [PromiseAllResolveElementContextSlots::
+                                       kPromiseAllResolveElementRemainingSlot]);
+          resolveElementContext[PromiseAllResolveElementContextSlots::
+                                    kPromiseAllResolveElementRemainingSlot] =
+              remainingElementsCount + 1;
+
+          // Let resolveElement be CreateBuiltinFunction(steps,
+          //                                             « [[AlreadyCalled]],
+          //                                               [[Index]],
+          //                                               [[Values]],
+          //                                               [[Capability]],
+          //                                               [[RemainingElements]]
+          //                                               »).
+          // Set resolveElement.[[AlreadyCalled]] to a Record { [[Value]]: false
+          // }. Set resolveElement.[[Index]] to index. Set
+          // resolveElement.[[Values]] to values. Set
+          // resolveElement.[[Capability]] to resultCapability. Set
+          // resolveElement.[[RemainingElements]] to remainingElementsCount.
+          const resolveElementFun = createResolveElementFunctor.Call(
+              resolveElementContext, nativeContext, index, capability);
+          const rejectElementFun = createRejectElementFunctor.Call(
+              resolveElementContext, nativeContext, index, capability);
+
+          // We can skip the "resolve" lookup on the {constructor} as well as
+          // the "then" lookup on the result of the "resolve" call, and
+          // immediately chain continuation onto the {next_value} if:
+          //
+          //   (a) The {constructor} is the intrinsic %Promise% function, and
+          //       looking up "resolve" on {constructor} yields the initial
+          //       Promise.resolve() builtin, and
+          //   (b) the promise @@species protector cell is valid, meaning that
+          //       no one messed with the Symbol.species property on any
+          //       intrinsic promise or on the Promise.prototype, and
+          //   (c) the {next_value} is a JSPromise whose [[Prototype]] field
+          //       contains the intrinsic %PromisePrototype%, and
+          //   (d) we're not running with async_hooks or DevTools enabled.
+          //
+          // In that case we also don't need to allocate a chained promise for
+          // the PromiseReaction (aka we can pass undefined to
+          // PerformPromiseThen), since this is only necessary for DevTools and
+          // PromiseHooks.
+          if (promiseResolveFunction != Undefined ||
+              IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate() ||
+              IsPromiseSpeciesProtectorCellInvalid() || Is<Smi>(nextValue) ||
+              !IsPromiseThenLookupChainIntact(
+                  nativeContext, UnsafeCast<HeapObject>(nextValue).map)) {
+            try {
+              // Let nextPromise be ? Call(constructor, _promiseResolve_, «
+              // nextValue »).
+              const nextPromise = CallResolve(
+                  UnsafeCast<Constructor>(constructor), promiseResolveFunction,
+                  nextValue);
+
+              // Perform ? Invoke(nextPromise, "then", « resolveElement,
+              //                  resultCapability.[[Reject]] »).
+              const then = GetProperty(nextPromise, kThenString);
+              const thenResult = Call(
+                  nativeContext, then, nextPromise, resolveElementFun,
+                  rejectElementFun);
+
+              // For catch prediction, mark that rejections here are
+              // semantically handled by the combined Promise.
+              if (IsDebugActive() && Is<JSPromise>(thenResult)) deferred {
+                  SetPropertyStrict(
+                      context, thenResult, kPromiseHandledBySymbol, promise);
+                }
+            } catch (e) deferred {
+              iterator::IteratorCloseOnException(iter, e) otherwise Reject;
+            }
+          } else {
+            PerformPromiseThenImpl(
+                UnsafeCast<JSPromise>(nextValue), resolveElementFun,
+                rejectElementFun, Undefined);
+          }
+
+          // Set index to index + 1.
+          index += 1;
+        }
+      }
+    }
+    label Done {}
+
+    // Set iteratorRecord.[[Done]] to true.
+    // Set remainingElementsCount.[[Value]] to
+    //    remainingElementsCount.[[Value]] - 1.
+    let remainingElementsCount = UnsafeCast<Smi>(
+        resolveElementContext[PromiseAllResolveElementContextSlots::
+                                  kPromiseAllResolveElementRemainingSlot]);
+    remainingElementsCount -= 1;
+    resolveElementContext[PromiseAllResolveElementContextSlots::
+                              kPromiseAllResolveElementRemainingSlot] =
+        remainingElementsCount;
+    if (remainingElementsCount > 0) {
+      // Pre-allocate the backing store for the {values_array} to the desired
+      // capacity here. We may already have elements here in case of some
+      // fancy Thenable that calls the resolve callback immediately, so we need
+      // to handle that correctly here.
+      const valuesArray = UnsafeCast<JSArray>(
+          resolveElementContext[PromiseAllResolveElementContextSlots::
+                                    kPromiseAllResolveElementValuesArraySlot]);
+      const oldElements = UnsafeCast<FixedArray>(valuesArray.elements);
+      const oldCapacity = oldElements.length_intptr;
+      const newCapacity = SmiUntag(index);
+      if (oldCapacity < newCapacity) {
+        valuesArray.elements =
+            ExtractFixedArray(oldElements, 0, oldCapacity, newCapacity);
+      }
+    } else
+      deferred {
+        // If remainingElementsCount.[[Value]] is 0, then
+        //     Let valuesArray be CreateArrayFromList(values).
+        //     Perform ? Call(resultCapability.[[Resolve]], undefined,
+        //                    « valuesArray »).
+        assert(remainingElementsCount == 0);
+        const valuesArray = UnsafeCast<JSAny>(
+            resolveElementContext
+                [PromiseAllResolveElementContextSlots::
+                     kPromiseAllResolveElementValuesArraySlot]);
+        Call(nativeContext, UnsafeCast<JSAny>(resolve), Undefined, valuesArray);
+      }
+
+    // Return resultCapability.[[Promise]].
+    return promise;
+  }
+
+  transitioning macro GeneratePromiseAll<F1: type, F2: type>(implicit context:
+                                                                   Context)(
+      receiver: JSAny, iterable: JSAny, createResolveElementFunctor: F1,
+      createRejectElementFunctor: F2): JSAny {
+    // Let C be the this value.
+    // If Type(C) is not Object, throw a TypeError exception.
+    const receiver = Cast<JSReceiver>(receiver)
+        otherwise ThrowTypeError(
+        MessageTemplate::kCalledOnNonObject, 'Promise.all');
+
+    // Let promiseCapability be ? NewPromiseCapability(C).
+    // Don't fire debugEvent so that forwarding the rejection through all does
+    // not trigger redundant ExceptionEvents
+    const capability = NewPromiseCapability(receiver, False);
+
+    try {
+      try {
+        // Let iterator be GetIterator(iterable).
+        // IfAbruptRejectPromise(iterator, promiseCapability).
+        let i = iterator::GetIterator(iterable);
+
+        // Let result be PerformPromiseAll(iteratorRecord, C,
+        // promiseCapability). If result is an abrupt completion, then
+        //   If iteratorRecord.[[Done]] is false, let result be
+        //       IteratorClose(iterator, result).
+        //    IfAbruptRejectPromise(result, promiseCapability).
+        return PerformPromiseAll(
+            receiver, capability, i, createResolveElementFunctor,
+            createRejectElementFunctor) otherwise Reject;
+      } catch (e) deferred {
+        goto Reject(e);
+      }
+    }
+    label Reject(e: Object) deferred {
+      // Exception must be bound to a JS value.
+      const e = UnsafeCast<JSAny>(e);
+      const reject = UnsafeCast<JSAny>(capability.reject);
+      Call(context, reject, Undefined, e);
+      return capability.promise;
+    }
+  }
+
+  // ES#sec-promise.all
+  transitioning javascript builtin PromiseAll(
+      js-implicit context: Context, receiver: JSAny)(iterable: JSAny): JSAny {
+    return GeneratePromiseAll(
+        receiver, iterable, PromiseAllResolveElementFunctor{},
+        PromiseAllRejectElementFunctor{});
+  }
+
+  // ES#sec-promise.allsettled
+  // Promise.allSettled ( iterable )
+  transitioning javascript builtin PromiseAllSettled(
+      js-implicit context: Context, receiver: JSAny)(iterable: JSAny): JSAny {
+    return GeneratePromiseAll(
+        receiver, iterable, PromiseAllSettledResolveElementFunctor{},
+        PromiseAllSettledRejectElementFunctor{});
+  }
+}
diff --git a/deps/v8/src/builtins/promise-constructor.tq b/deps/v8/src/builtins/promise-constructor.tq
new file mode 100644
index 00000000000000..dc0e077485cabe
--- /dev/null
+++ b/deps/v8/src/builtins/promise-constructor.tq
@@ -0,0 +1,109 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-constructor-gen.h'
+#include 'src/builtins/builtins-promise-gen.h'
+
+namespace runtime {
+  extern transitioning runtime
+  DebugPushPromise(implicit context: Context)(JSAny): JSAny;
+
+  extern transitioning runtime
+  DebugPopPromise(implicit context: Context)(): JSAny;
+
+  extern transitioning runtime
+  PromiseHookInit(implicit context: Context)(Object, Object): JSAny;
+}
+
+// https://tc39.es/ecma262/#sec-promise-constructor
+namespace promise {
+
+  extern runtime IncrementUseCounter(Context, Smi): void;
+  type UseCounterFeature extends int31
+  constexpr 'v8::Isolate::UseCounterFeature';
+  const kPromiseConstructorReturnedUndefined: constexpr UseCounterFeature
+  generates 'v8::Isolate::kPromiseConstructorReturnedUndefined';
+
+  extern macro
+  IsDebugActive(): bool;
+
+  transitioning macro
+  HasAccessCheckFailed(implicit context: Context)(
+      nativeContext: NativeContext, promiseFun: JSAny, executor: JSAny): bool {
+    BranchIfAccessCheckFailed(nativeContext, promiseFun, executor)
+        otherwise return true;
+    return false;
+  }
+
+  extern macro ConstructorBuiltinsAssembler::EmitFastNewObject(
+      Context, JSFunction, JSReceiver): JSObject;
+
+  extern macro
+  PromiseBuiltinsAssembler::IsPromiseHookEnabledOrHasAsyncEventDelegate(): bool;
+
+  // https://tc39.es/ecma262/#sec-promise-executor
+  transitioning javascript builtin
+  PromiseConstructor(
+      js-implicit context: NativeContext, receiver: JSAny,
+      newTarget: JSAny)(executor: JSAny): JSAny {
+    // 1. If NewTarget is undefined, throw a TypeError exception.
+    if (newTarget == Undefined) {
+      ThrowTypeError(MessageTemplate::kNotAPromise, newTarget);
+    }
+
+    // 2. If IsCallable(executor) is false, throw a TypeError exception.
+    if (!TaggedIsCallable(executor)) {
+      ThrowTypeError(MessageTemplate::kResolverNotAFunction, executor);
+    }
+
+    const promiseFun = UnsafeCast<JSFunction>(
+        context[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
+
+    // Silently fail if the stack looks fishy.
+    if (HasAccessCheckFailed(context, promiseFun, executor)) {
+      IncrementUseCounter(
+          context, SmiConstant(kPromiseConstructorReturnedUndefined));
+      return Undefined;
+    }
+
+    let result: JSPromise;
+    if (promiseFun == newTarget) {
+      result = NewJSPromise();
+    } else {
+      result = UnsafeCast<JSPromise>(EmitFastNewObject(
+          context, promiseFun, UnsafeCast<JSReceiver>(newTarget)));
+      PromiseInit(result);
+      if (IsPromiseHookEnabledOrHasAsyncEventDelegate()) {
+        runtime::PromiseHookInit(result, Undefined);
+      }
+    }
+
+    const isDebugActive = IsDebugActive();
+    if (isDebugActive) runtime::DebugPushPromise(result);
+
+    const funcs = CreatePromiseResolvingFunctions(result, True, context);
+    const resolve = funcs.resolve;
+    const reject = funcs.reject;
+    try {
+      Call(context, UnsafeCast<Callable>(executor), Undefined, resolve, reject);
+    } catch (e) {
+      Call(context, reject, Undefined, e);
+    }
+
+    if (isDebugActive) runtime::DebugPopPromise();
+    return result;
+  }
+
+  // Promise.prototype.catch ( onRejected )
+  // https://tc39.es/ecma262/#sec-promise.prototype.catch
+  transitioning javascript builtin
+  PromisePrototypeCatch(js-implicit context: Context, receiver: JSAny)(
+      onRejected: JSAny): JSAny {
+    // 1. Let promise be the this value.
+    // 2. Return ? Invoke(promise, "then", « undefined, onRejected »).
+    const nativeContext = LoadNativeContext(context);
+    return UnsafeCast<JSAny>(
+        InvokeThen(nativeContext, receiver, Undefined, onRejected));
+  }
+}
diff --git a/deps/v8/src/builtins/promise-finally.tq b/deps/v8/src/builtins/promise-finally.tq
new file mode 100644
index 00000000000000..32028b819dabdf
--- /dev/null
+++ b/deps/v8/src/builtins/promise-finally.tq
@@ -0,0 +1,207 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-promise.h'
+#include 'src/builtins/builtins-promise-gen.h'
+
+namespace promise {
+
+  // TODO(joshualitt): The below ContextSlots are only available on synthetic
+  // contexts created by the promise pipeline for use in the promise pipeline.
+  // However, with Torque we should type the context and its slots to prevent
+  // accidentially using these slots on contexts which don't support them.
+  const kPromiseBuiltinsValueSlot: constexpr ContextSlot
+  generates 'PromiseBuiltins::kValueSlot';
+  const kPromiseBuiltinsOnFinallySlot: constexpr ContextSlot
+  generates 'PromiseBuiltins::kOnFinallySlot';
+  const kPromiseBuiltinsConstructorSlot: constexpr ContextSlot
+  generates 'PromiseBuiltins::kConstructorSlot';
+  const kPromiseBuiltinsPromiseValueThunkOrReasonContextLength: constexpr int31
+  generates 'PromiseBuiltins::kPromiseValueThunkOrReasonContextLength';
+  const kPromiseBuiltinsPromiseFinallyContextLength: constexpr int31
+  generates 'PromiseBuiltins::kPromiseFinallyContextLength';
+
+  transitioning javascript builtin
+  PromiseValueThunkFinally(js-implicit context: Context, receiver: JSAny)():
+      JSAny {
+    return UnsafeCast<JSAny>(context[kPromiseBuiltinsValueSlot]);
+  }
+
+  transitioning javascript builtin
+  PromiseThrowerFinally(js-implicit context: Context, receiver: JSAny)():
+      never {
+    const reason = UnsafeCast<JSAny>(context[kPromiseBuiltinsValueSlot]);
+    Throw(reason);
+  }
+
+  macro CreateThrowerFunction(implicit context: Context)(
+      nativeContext: NativeContext, reason: JSAny): JSFunction {
+    const throwerContext = AllocateSyntheticFunctionContext(
+        nativeContext, kPromiseBuiltinsPromiseValueThunkOrReasonContextLength);
+    throwerContext[kPromiseBuiltinsValueSlot] = reason;
+    const map = UnsafeCast<Map>(
+        nativeContext
+            [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
+    const throwerInfo = UnsafeCast<SharedFunctionInfo>(
+        nativeContext[NativeContextSlot::PROMISE_THROWER_FINALLY_SHARED_FUN]);
+    return AllocateFunctionWithMapAndContext(map, throwerInfo, throwerContext);
+  }
+
+  transitioning javascript builtin
+  PromiseCatchFinally(js-implicit context: Context, receiver: JSAny)(
+      reason: JSAny): JSAny {
+    // 1. Let onFinally be F.[[OnFinally]].
+    // 2. Assert: IsCallable(onFinally) is true.
+    const onFinally =
+        UnsafeCast<Callable>(context[kPromiseBuiltinsOnFinallySlot]);
+
+    // 3. Let result be ? Call(onFinally).
+    const result = Call(context, onFinally, Undefined);
+
+    // 4. Let C be F.[[Constructor]].
+    const constructor =
+        UnsafeCast<JSFunction>(context[kPromiseBuiltinsConstructorSlot]);
+
+    // 5. Assert: IsConstructor(C) is true.
+    assert(IsConstructor(constructor));
+
+    // 6. Let promise be ? PromiseResolve(C, result).
+    const promise = PromiseResolve(constructor, result);
+
+    // 7. Let thrower be equivalent to a function that throws reason.
+    const nativeContext = LoadNativeContext(context);
+    const thrower = CreateThrowerFunction(nativeContext, reason);
+
+    // 8. Return ? Invoke(promise, "then", « thrower »).
+    return UnsafeCast<JSAny>(InvokeThen(nativeContext, promise, thrower));
+  }
+
+  macro CreateValueThunkFunction(implicit context: Context)(
+      nativeContext: NativeContext, value: JSAny): JSFunction {
+    const valueThunkContext = AllocateSyntheticFunctionContext(
+        nativeContext, kPromiseBuiltinsPromiseValueThunkOrReasonContextLength);
+    valueThunkContext[kPromiseBuiltinsValueSlot] = value;
+    const map = UnsafeCast<Map>(
+        nativeContext
+            [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
+    const valueThunkInfo = UnsafeCast<SharedFunctionInfo>(
+        nativeContext
+            [NativeContextSlot::PROMISE_VALUE_THUNK_FINALLY_SHARED_FUN]);
+    return AllocateFunctionWithMapAndContext(
+        map, valueThunkInfo, valueThunkContext);
+  }
+
+  transitioning javascript builtin
+  PromiseThenFinally(js-implicit context: Context, receiver: JSAny)(
+      value: JSAny): JSAny {
+    // 1. Let onFinally be F.[[OnFinally]].
+    // 2.  Assert: IsCallable(onFinally) is true.
+    const onFinally =
+        UnsafeCast<Callable>(context[kPromiseBuiltinsOnFinallySlot]);
+
+    // 3. Let result be ?  Call(onFinally).
+    const result = Call(context, onFinally, Undefined);
+
+    // 4. Let C be F.[[Constructor]].
+    const constructor =
+        UnsafeCast<JSFunction>(context[kPromiseBuiltinsConstructorSlot]);
+
+    // 5. Assert: IsConstructor(C) is true.
+    assert(IsConstructor(constructor));
+
+    // 6. Let promise be ? PromiseResolve(C, result).
+    const promise = PromiseResolve(constructor, result);
+
+    // 7. Let valueThunk be equivalent to a function that returns value.
+    const nativeContext = LoadNativeContext(context);
+    const valueThunk = CreateValueThunkFunction(nativeContext, value);
+
+    // 8. Return ? Invoke(promise, "then", « valueThunk »).
+    return UnsafeCast<JSAny>(InvokeThen(nativeContext, promise, valueThunk));
+  }
+
+  struct PromiseFinallyFunctions {
+    then_finally: JSFunction;
+    catch_finally: JSFunction;
+  }
+
+  macro CreatePromiseFinallyFunctions(implicit context: Context)(
+      nativeContext: NativeContext, onFinally: Callable,
+      constructor: JSReceiver): PromiseFinallyFunctions {
+    const promiseContext = AllocateSyntheticFunctionContext(
+        nativeContext, kPromiseBuiltinsPromiseFinallyContextLength);
+    promiseContext[kPromiseBuiltinsOnFinallySlot] = onFinally;
+    promiseContext[kPromiseBuiltinsConstructorSlot] = constructor;
+    const map = UnsafeCast<Map>(
+        nativeContext
+            [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
+    const thenFinallyInfo = UnsafeCast<SharedFunctionInfo>(
+        nativeContext[NativeContextSlot::PROMISE_THEN_FINALLY_SHARED_FUN]);
+    const thenFinally =
+        AllocateFunctionWithMapAndContext(map, thenFinallyInfo, promiseContext);
+    const catchFinallyInfo = UnsafeCast<SharedFunctionInfo>(
+        nativeContext[NativeContextSlot::PROMISE_CATCH_FINALLY_SHARED_FUN]);
+    const catchFinally = AllocateFunctionWithMapAndContext(
+        map, catchFinallyInfo, promiseContext);
+    return PromiseFinallyFunctions{
+      then_finally: thenFinally,
+      catch_finally: catchFinally
+    };
+  }
+
+  transitioning javascript builtin
+  PromisePrototypeFinally(js-implicit context: Context, receiver: JSAny)(
+      onFinally: JSAny): JSAny {
+    // 1. Let promise be the this value.
+    // 2. If Type(promise) is not Object, throw a TypeError exception.
+    const jsReceiver = Cast<JSReceiver>(receiver) otherwise ThrowTypeError(
+        MessageTemplate::kCalledOnNonObject, 'Promise.prototype.finally');
+
+    // 3. Let C be ? SpeciesConstructor(promise, %Promise%).
+    const nativeContext = LoadNativeContext(context);
+    const promiseFun = UnsafeCast<Callable>(
+        nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
+
+    let constructor: JSReceiver = promiseFun;
+    const receiverMap = jsReceiver.map;
+    if (!IsJSPromiseMap(receiverMap) ||
+        !IsPromiseSpeciesLookupChainIntact(nativeContext, receiverMap))
+      deferred {
+        constructor = SpeciesConstructor(jsReceiver, promiseFun);
+      }
+
+    // 4. Assert: IsConstructor(C) is true.
+    assert(IsConstructor(constructor));
+
+    // 5. If IsCallable(onFinally) is not true,
+    //    a. Let thenFinally be onFinally.
+    //    b. Let catchFinally be onFinally.
+    // 6. Else,
+    //   a. Let thenFinally be a new built-in function object as defined
+    //   in ThenFinally Function.
+    //   b. Let catchFinally be a new built-in function object as
+    //   defined in CatchFinally Function.
+    //   c. Set thenFinally and catchFinally's [[Constructor]] internal
+    //   slots to C.
+    //   d. Set thenFinally and catchFinally's [[OnFinally]] internal
+    //   slots to onFinally.
+    let thenFinally: JSAny;
+    let catchFinally: JSAny;
+    if (!TaggedIsSmi(onFinally) &&
+        IsCallable(UnsafeCast<HeapObject>(onFinally))) {
+      const pair = CreatePromiseFinallyFunctions(
+          nativeContext, UnsafeCast<Callable>(onFinally), constructor);
+      thenFinally = pair.then_finally;
+      catchFinally = pair.catch_finally;
+    } else
+      deferred {
+        thenFinally = onFinally;
+        catchFinally = onFinally;
+      }
+
+    // 7. Return ? Invoke(promise, "then", « thenFinally, catchFinally »).
+    return UnsafeCast<JSAny>(
+        InvokeThen(nativeContext, receiver, thenFinally, catchFinally));
+  }
+}
diff --git a/deps/v8/src/builtins/promise-jobs.tq b/deps/v8/src/builtins/promise-jobs.tq
new file mode 100644
index 00000000000000..ee049605e1afb4
--- /dev/null
+++ b/deps/v8/src/builtins/promise-jobs.tq
@@ -0,0 +1,73 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-promise.h'
+
+// https://tc39.es/ecma262/#sec-promise-jobs
+namespace promise {
+  extern macro IsJSPromiseMap(Map): bool;
+
+  // https://tc39.es/ecma262/#sec-promiseresolvethenablejob
+  transitioning builtin
+  PromiseResolveThenableJob(implicit context: Context)(
+      promiseToResolve: JSPromise, thenable: JSReceiver, then: JSAny): JSAny {
+    // We can use a simple optimization here if we know that {then} is the
+    // initial Promise.prototype.then method, and {thenable} is a JSPromise
+    // whose
+    // @@species lookup chain is intact: We can connect {thenable} and
+    // {promise_to_resolve} directly in that case and avoid the allocation of a
+    // temporary JSPromise and the closures plus context.
+    //
+    // We take the generic (slow-)path if a PromiseHook is enabled or the
+    // debugger is active, to make sure we expose spec compliant behavior.
+    const nativeContext = LoadNativeContext(context);
+    const promiseThen = nativeContext[NativeContextSlot::PROMISE_THEN_INDEX];
+    const thenableMap = thenable.map;
+    if (TaggedEqual(then, promiseThen) && IsJSPromiseMap(thenableMap) &&
+        !IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate() &&
+        IsPromiseSpeciesLookupChainIntact(nativeContext, thenableMap)) {
+      // We know that the {thenable} is a JSPromise, which doesn't require
+      // any special treatment and that {then} corresponds to the initial
+      // Promise.prototype.then method. So instead of allocating a temporary
+      // JSPromise to connect the {thenable} with the {promise_to_resolve},
+      // we can directly schedule the {promise_to_resolve} with default
+      // handlers onto the {thenable} promise. This does not only save the
+      // JSPromise allocation, but also avoids the allocation of the two
+      // resolving closures and the shared context.
+      //
+      // What happens normally in this case is
+      //
+      //   resolve, reject = CreateResolvingFunctions(promise_to_resolve)
+      //   result_capability = NewPromiseCapability(%Promise%)
+      //   PerformPromiseThen(thenable, resolve, reject, result_capability)
+      //
+      // which means that PerformPromiseThen will either schedule a new
+      // PromiseReaction with resolve and reject or a PromiseReactionJob
+      // with resolve or reject based on the state of {thenable}. And
+      // resolve or reject will just invoke the default [[Resolve]] or
+      // [[Reject]] functions on the {promise_to_resolve}.
+      //
+      // This is the same as just doing
+      //
+      //   PerformPromiseThen(thenable, undefined, undefined,
+      //   promise_to_resolve)
+      //
+      // which performs exactly the same (observable) steps.
+      return PerformPromiseThen(
+          UnsafeCast<JSPromise>(thenable), UndefinedConstant(),
+          UndefinedConstant(), promiseToResolve);
+    } else {
+      const funcs = CreatePromiseResolvingFunctions(
+          promiseToResolve, False, nativeContext);
+      const resolve = funcs.resolve;
+      const reject = funcs.reject;
+      try {
+        return Call(
+            context, UnsafeCast<Callable>(then), thenable, resolve, reject);
+      } catch (e) {
+        return Call(context, UnsafeCast<Callable>(reject), Undefined, e);
+      }
+    }
+  }
+}
diff --git a/deps/v8/src/builtins/promise-misc.tq b/deps/v8/src/builtins/promise-misc.tq
new file mode 100644
index 00000000000000..7996cc5b3d952c
--- /dev/null
+++ b/deps/v8/src/builtins/promise-misc.tq
@@ -0,0 +1,236 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-promise.h'
+#include 'src/builtins/builtins-promise-gen.h'
+
+namespace runtime {
+  extern transitioning runtime
+  AllowDynamicFunction(implicit context: Context)(JSAny): JSAny;
+}
+
+// Unsafe functions that should be used very carefully.
+namespace promise_internal {
+  extern macro PromiseBuiltinsAssembler::ZeroOutEmbedderOffsets(JSPromise):
+      void;
+
+  extern macro PromiseBuiltinsAssembler::AllocateJSPromise(Context): HeapObject;
+
+  extern macro PromiseBuiltinsAssembler::AllocatePromiseReactionJobTask(
+      Context): HeapObject;
+
+}
+
+namespace promise {
+  extern macro IsFunctionWithPrototypeSlotMap(Map): bool;
+
+  @export
+  macro PromiseHasHandler(promise: JSPromise): bool {
+    return promise.HasHandler();
+  }
+
+  @export
+  macro PromiseInit(promise: JSPromise): void {
+    assert(PromiseState::kPending == 0);
+    promise.reactions_or_result = kZero;
+    promise.flags = 0;
+    promise_internal::ZeroOutEmbedderOffsets(promise);
+  }
+
+  macro InnerNewJSPromise(implicit context: Context)(): JSPromise {
+    const nativeContext = LoadNativeContext(context);
+    const promiseFun = UnsafeCast<JSFunction>(
+        nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
+    assert(IsFunctionWithPrototypeSlotMap(promiseFun.map));
+    const promiseMap = UnsafeCast<Map>(promiseFun.prototype_or_initial_map);
+    const promiseHeapObject = promise_internal::AllocateJSPromise(context);
+    promiseHeapObject.map = promiseMap;
+    const promise = UnsafeCast<JSPromise>(promiseHeapObject);
+    promise.properties_or_hash = kEmptyFixedArray;
+    promise.elements = kEmptyFixedArray;
+    promise.reactions_or_result = kZero;
+    promise.flags = 0;
+    return promise;
+  }
+
+  macro NewPromiseReactionJobTask(implicit context: Context)(
+      map: Map, handlerContext: Context, argument: Object,
+      handler: Callable|Undefined,
+      promiseOrCapability: JSPromise|PromiseCapability|
+      Undefined): PromiseReactionJobTask {
+    const taskHeapObject =
+        promise_internal::AllocatePromiseReactionJobTask(context);
+    taskHeapObject.map = map;
+    const jobTask = UnsafeCast<PromiseReactionJobTask>(taskHeapObject);
+    jobTask.argument = argument;
+    jobTask.context = handlerContext;
+    jobTask.handler = handler;
+    jobTask.promise_or_capability = promiseOrCapability;
+    return jobTask;
+  }
+
+  // These allocate and initialize a promise with pending state and
+  // undefined fields.
+  //
+  // This uses the given parent as the parent promise for the promise
+  // init hook.
+  @export
+  transitioning macro NewJSPromise(implicit context: Context)(parent: Object):
+      JSPromise {
+    const instance = InnerNewJSPromise();
+    PromiseInit(instance);
+    if (IsPromiseHookEnabledOrHasAsyncEventDelegate()) {
+      runtime::PromiseHookInit(instance, parent);
+    }
+    return instance;
+  }
+
+  // This uses undefined as the parent promise for the promise init
+  // hook.
+  @export
+  transitioning macro NewJSPromise(implicit context: Context)(): JSPromise {
+    return NewJSPromise(Undefined);
+  }
+
+  // This allocates and initializes a promise with the given state and
+  // fields.
+  @export
+  transitioning macro NewJSPromise(implicit context: Context)(
+      status: constexpr PromiseState, result: JSAny): JSPromise {
+    assert(status != PromiseState::kPending);
+    assert(kJSPromiseStatusShift == 0);
+
+    const instance = InnerNewJSPromise();
+    instance.reactions_or_result = result;
+    instance.SetStatus(status);
+    promise_internal::ZeroOutEmbedderOffsets(instance);
+
+    if (IsPromiseHookEnabledOrHasAsyncEventDelegate()) {
+      runtime::PromiseHookInit(instance, Undefined);
+    }
+    return instance;
+  }
+
+  macro NewPromiseReaction(implicit context: Context)(
+      next: Zero|PromiseReaction,
+      promiseOrCapability: JSPromise|PromiseCapability|Undefined,
+      fulfillHandler: Callable|Undefined,
+      rejectHandler: Callable|Undefined): PromiseReaction {
+    return new PromiseReaction{
+      map: PromiseReactionMapConstant(),
+      next: next,
+      reject_handler: rejectHandler,
+      fulfill_handler: fulfillHandler,
+      promise_or_capability: promiseOrCapability
+    };
+  }
+
+  extern macro PromiseResolveThenableJobTaskMapConstant(): Map;
+
+  macro NewPromiseResolveThenableJobTask(implicit context: Context)(
+      promiseToResolve: JSPromise, then: JSReceiver, thenable: JSReceiver,
+      thenableContext: Context): PromiseResolveThenableJobTask {
+    return new PromiseResolveThenableJobTask{
+      map: PromiseResolveThenableJobTaskMapConstant(),
+      context: thenableContext,
+      promise_to_resolve: promiseToResolve,
+      then: then,
+      thenable: thenable
+    };
+  }
+
+  struct InvokeThenOneArgFunctor {
+    transitioning
+    macro Call(
+        nativeContext: NativeContext, then: JSAny, receiver: JSAny, arg1: JSAny,
+        _arg2: JSAny): JSAny {
+      return Call(nativeContext, then, receiver, arg1);
+    }
+  }
+
+  struct InvokeThenTwoArgFunctor {
+    transitioning
+    macro Call(
+        nativeContext: NativeContext, then: JSAny, receiver: JSAny, arg1: JSAny,
+        arg2: JSAny): JSAny {
+      return Call(nativeContext, then, receiver, arg1, arg2);
+    }
+  }
+
+  transitioning
+  macro InvokeThen<F: type>(implicit context: Context)(
+      nativeContext: NativeContext, receiver: JSAny, arg1: JSAny, arg2: JSAny,
+      callFunctor: F): JSAny {
+    // We can skip the "then" lookup on {receiver} if it's [[Prototype]]
+    // is the (initial) Promise.prototype and the Promise#then protector
+    // is intact, as that guards the lookup path for the "then" property
+    // on JSPromise instances which have the (initial) %PromisePrototype%.
+    if (!Is<Smi>(receiver) &&
+        IsPromiseThenLookupChainIntact(
+            nativeContext, UnsafeCast<HeapObject>(receiver).map)) {
+      const then = UnsafeCast<JSAny>(
+          nativeContext[NativeContextSlot::PROMISE_THEN_INDEX]);
+      return callFunctor.Call(nativeContext, then, receiver, arg1, arg2);
+    } else
+      deferred {
+        const then = UnsafeCast<JSAny>(GetProperty(receiver, kThenString));
+        return callFunctor.Call(nativeContext, then, receiver, arg1, arg2);
+      }
+  }
+
+  transitioning
+  macro InvokeThen(implicit context: Context)(
+      nativeContext: NativeContext, receiver: JSAny, arg: JSAny): JSAny {
+    return InvokeThen(
+        nativeContext, receiver, arg, Undefined, InvokeThenOneArgFunctor{});
+  }
+
+  transitioning
+  macro InvokeThen(implicit context: Context)(
+      nativeContext: NativeContext, receiver: JSAny, arg1: JSAny,
+      arg2: JSAny): JSAny {
+    return InvokeThen(
+        nativeContext, receiver, arg1, arg2, InvokeThenTwoArgFunctor{});
+  }
+
+  transitioning
+  macro BranchIfAccessCheckFailed(implicit context: Context)(
+      nativeContext: NativeContext, promiseConstructor: JSAny,
+      executor: JSAny): void labels IfNoAccess {
+    try {
+      // If executor is a bound function, load the bound function until we've
+      // reached an actual function.
+      let foundExecutor = executor;
+      while (true) {
+        typeswitch (foundExecutor) {
+          case (f: JSFunction): {
+            // Load the context from the function and compare it to the Promise
+            // constructor's context. If they match, everything is fine,
+            // otherwise, bail out to the runtime.
+            const functionContext = f.context;
+            const nativeFunctionContext = LoadNativeContext(functionContext);
+            if (TaggedEqual(nativeContext, nativeFunctionContext)) {
+              goto HasAccess;
+            } else {
+              goto CallRuntime;
+            }
+          }
+          case (b: JSBoundFunction): {
+            foundExecutor = b.bound_target_function;
+          }
+          case (Object): {
+            goto CallRuntime;
+          }
+        }
+      }
+    }
+    label CallRuntime deferred {
+      const result = runtime::AllowDynamicFunction(promiseConstructor);
+      if (result != True) {
+        goto IfNoAccess;
+      }
+    }
+    label HasAccess {}
+  }
+}
diff --git a/deps/v8/src/builtins/promise-race.tq b/deps/v8/src/builtins/promise-race.tq
new file mode 100644
index 00000000000000..7e56a08c8443ad
--- /dev/null
+++ b/deps/v8/src/builtins/promise-race.tq
@@ -0,0 +1,131 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-promise-gen.h'
+
+namespace promise {
+
+  extern macro PromiseForwardingHandlerSymbolConstant(): Symbol;
+  const kPromiseForwardingHandlerSymbol: Symbol =
+      PromiseForwardingHandlerSymbolConstant();
+  extern macro PromiseHandledBySymbolConstant(): Symbol;
+  const kPromiseHandledBySymbol: Symbol = PromiseHandledBySymbolConstant();
+  extern macro ResolveStringConstant(): String;
+  const kResolveString: String = ResolveStringConstant();
+  extern macro SetPropertyStrict(Context, Object, Object, Object): Object;
+  extern macro IsPromiseResolveProtectorCellInvalid(): bool;
+
+  macro IsPromiseResolveLookupChainIntact(implicit context: Context)(
+      nativeContext: NativeContext, constructor: JSReceiver): bool {
+    if (IsForceSlowPath()) return false;
+    const promiseFun = UnsafeCast<JSFunction>(
+        nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
+    return promiseFun == constructor && !IsPromiseResolveProtectorCellInvalid();
+  }
+
+  // https://tc39.es/ecma262/#sec-promise.race
+  transitioning javascript builtin
+  PromiseRace(js-implicit context: Context, receiver: JSAny)(iterable: JSAny):
+      JSAny {
+    const receiver = Cast<JSReceiver>(receiver)
+        otherwise ThrowTypeError(
+        MessageTemplate::kCalledOnNonObject, 'Promise.race');
+
+    // Let promiseCapability be ? NewPromiseCapability(C).
+    // Don't fire debugEvent so that forwarding the rejection through all does
+    // not trigger redundant ExceptionEvents
+    const capability = NewPromiseCapability(receiver, False);
+    const resolve = capability.resolve;
+    const reject = capability.reject;
+    const promise = capability.promise;
+
+    // For catch prediction, don't treat the .then calls as handling it;
+    // instead, recurse outwards.
+    if (IsDebugActive()) deferred {
+        SetPropertyStrict(
+            context, reject, kPromiseForwardingHandlerSymbol, True);
+      }
+
+    try {
+      // Let iterator be GetIterator(iterable).
+      // IfAbruptRejectPromise(iterator, promiseCapability).
+      let i: iterator::IteratorRecord;
+      try {
+        i = iterator::GetIterator(iterable);
+      } catch (e) deferred {
+        goto Reject(e);
+      }
+
+      // Let result be PerformPromiseRace(iteratorRecord, C, promiseCapability).
+      try {
+        // We can skip the "resolve" lookup on {constructor} if it's the
+        // Promise constructor and the Promise.resolve protector is intact,
+        // as that guards the lookup path for the "resolve" property on the
+        // Promise constructor.
+        const nativeContext = LoadNativeContext(context);
+        let promiseResolveFunction: JSAny = Undefined;
+        if (!IsPromiseResolveLookupChainIntact(nativeContext, receiver))
+          deferred {
+            // 3. Let _promiseResolve_ be ? Get(_constructor_, `"resolve"`).
+            const resolve = GetProperty(receiver, kResolveString);
+
+            // 4. If IsCallable(_promiseResolve_) is *false*, throw a
+            // *TypeError* exception.
+            promiseResolveFunction = Cast<Callable>(resolve)
+                otherwise ThrowTypeError(
+                MessageTemplate::kCalledNonCallable, 'resolve');
+          }
+
+        const fastIteratorResultMap = UnsafeCast<Map>(
+            nativeContext[NativeContextSlot::ITERATOR_RESULT_MAP_INDEX]);
+        while (true) {
+          let nextValue: JSAny;
+          try {
+            // Let next be IteratorStep(iteratorRecord.[[Iterator]]).
+            // If next is an abrupt completion, set iteratorRecord.[[Done]] to
+            // true. ReturnIfAbrupt(next).
+            const next: JSReceiver = iterator::IteratorStep(
+                i, fastIteratorResultMap) otherwise return promise;
+
+            // Let nextValue be IteratorValue(next).
+            // If nextValue is an abrupt completion, set iteratorRecord.[[Done]]
+            // to true.
+            // ReturnIfAbrupt(nextValue).
+            nextValue = iterator::IteratorValue(next, fastIteratorResultMap);
+          } catch (e) {
+            goto Reject(e);
+          }
+          // Let nextPromise be ? Call(constructor, _promiseResolve_, «
+          // nextValue »).
+          const nextPromise = CallResolve(
+              UnsafeCast<Constructor>(receiver), promiseResolveFunction,
+              nextValue);
+
+          // Perform ? Invoke(nextPromise, "then", « resolveElement,
+          //                  resultCapability.[[Reject]] »).
+          const then = GetProperty(nextPromise, kThenString);
+          const thenResult = Call(
+              context, then, nextPromise, UnsafeCast<JSAny>(resolve),
+              UnsafeCast<JSAny>(reject));
+
+          // For catch prediction, mark that rejections here are semantically
+          // handled by the combined Promise.
+          if (IsDebugActive() && !Is<JSPromise>(promise)) deferred {
+              SetPropertyStrict(
+                  context, thenResult, kPromiseHandledBySymbol, promise);
+            }
+        }
+      } catch (e) deferred {
+        iterator::IteratorCloseOnException(i, e) otherwise Reject;
+      }
+    }
+    label Reject(exception: Object) deferred {
+      Call(
+          context, UnsafeCast<JSAny>(reject), Undefined,
+          UnsafeCast<JSAny>(exception));
+      return promise;
+    }
+    unreachable;
+  }
+}
diff --git a/deps/v8/src/builtins/promise-reaction-job.tq b/deps/v8/src/builtins/promise-reaction-job.tq
new file mode 100644
index 00000000000000..1db33f4a7a1007
--- /dev/null
+++ b/deps/v8/src/builtins/promise-reaction-job.tq
@@ -0,0 +1,131 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-promise-gen.h'
+
+namespace runtime {
+  extern transitioning runtime
+  ReportMessage(implicit context: Context)(JSAny): JSAny;
+}
+
+namespace promise {
+
+  transitioning
+  macro RejectPromiseReactionJob(
+      context: Context,
+      promiseOrCapability: JSPromise|PromiseCapability|Undefined, reason: JSAny,
+      reactionType: constexpr PromiseReactionType): JSAny {
+    if constexpr (reactionType == kPromiseReactionReject) {
+      if (IsJSPromise(promiseOrCapability)) {
+        // For fast native promises we can skip the indirection via the
+        // promiseCapability.[[Reject]] function and run the resolve logic
+        // directly from here.
+        return RejectPromise(
+            UnsafeCast<JSPromise>(promiseOrCapability), reason, False);
+      } else
+        deferred {
+          assert(IsPromiseCapability(promiseOrCapability));
+          // In the general case we need to call the (user provided)
+          // promiseCapability.[[Reject]] function.
+          try {
+            const promiseCapability =
+                UnsafeCast<PromiseCapability>(promiseOrCapability);
+            const reject = UnsafeCast<Callable>(promiseCapability.reject);
+            return Call(context, reject, Undefined, reason);
+          } catch (e) {
+            // Swallow the exception here.
+            return runtime::ReportMessage(e);
+          }
+        }
+    } else {
+      StaticAssert(reactionType == kPromiseReactionFulfill);
+      // We have to call out to the dedicated PromiseRejectReactionJob
+      // builtin here, instead of just doing the work inline, as otherwise
+      // the catch predictions in the debugger will be wrong, which just
+      // walks the stack and checks for certain builtins.
+      return PromiseRejectReactionJob(reason, Undefined, promiseOrCapability);
+    }
+  }
+
+  transitioning
+  macro FuflfillPromiseReactionJob(
+      context: Context,
+      promiseOrCapability: JSPromise|PromiseCapability|Undefined, result: JSAny,
+      reactionType: constexpr PromiseReactionType): JSAny {
+    if (IsJSPromise(promiseOrCapability)) {
+      // For fast native promises we can skip the indirection via the
+      // promiseCapability.[[Resolve]] function and run the resolve logic
+      // directly from here.
+      return ResolvePromise(
+          context, UnsafeCast<JSPromise>(promiseOrCapability), result);
+    } else
+      deferred {
+        assert(IsPromiseCapability(promiseOrCapability));
+        // In the general case we need to call the (user provided)
+        // promiseCapability.[[Resolve]] function.
+        const promiseCapability =
+            UnsafeCast<PromiseCapability>(promiseOrCapability);
+        const resolve = UnsafeCast<Callable>(promiseCapability.resolve);
+        try {
+          return Call(context, resolve, Undefined, result);
+        } catch (e) {
+          return RejectPromiseReactionJob(
+              context, promiseOrCapability, e, reactionType);
+        }
+      }
+  }
+
+  // https://tc39.es/ecma262/#sec-promisereactionjob
+  transitioning
+  macro PromiseReactionJob(
+      context: Context, argument: JSAny, handler: Callable|Undefined,
+      promiseOrCapability: JSPromise|PromiseCapability|Undefined,
+      reactionType: constexpr PromiseReactionType): JSAny {
+    if (handler == Undefined) {
+      if constexpr (reactionType == kPromiseReactionFulfill) {
+        return FuflfillPromiseReactionJob(
+            context, promiseOrCapability, argument, reactionType);
+      } else {
+        StaticAssert(reactionType == kPromiseReactionReject);
+        return RejectPromiseReactionJob(
+            context, promiseOrCapability, argument, reactionType);
+      }
+    } else {
+      try {
+        const result =
+            Call(context, UnsafeCast<Callable>(handler), Undefined, argument);
+        if (promiseOrCapability == Undefined) {
+          // There's no [[Capability]] for this promise reaction job, which
+          // means that this is a specification-internal operation (aka
+          // await) where the result does not matter (see the specification
+          // change in https://github.com/tc39/ecma262/pull/1146 for
+          // details).
+          return Undefined;
+        } else {
+          return FuflfillPromiseReactionJob(
+              context, promiseOrCapability, result, reactionType);
+        }
+      } catch (e) {
+        return RejectPromiseReactionJob(
+            context, promiseOrCapability, e, reactionType);
+      }
+    }
+  }
+
+  transitioning builtin
+  PromiseFulfillReactionJob(implicit context: Context)(
+      value: JSAny, handler: Callable|Undefined,
+      promiseOrCapability: JSPromise|PromiseCapability|Undefined): JSAny {
+    return PromiseReactionJob(
+        context, value, handler, promiseOrCapability, kPromiseReactionFulfill);
+  }
+
+  transitioning builtin
+  PromiseRejectReactionJob(implicit context: Context)(
+      reason: JSAny, handler: Callable|Undefined,
+      promiseOrCapability: JSPromise|PromiseCapability|Undefined): JSAny {
+    return PromiseReactionJob(
+        context, reason, handler, promiseOrCapability, kPromiseReactionReject);
+  }
+}
diff --git a/deps/v8/src/builtins/promise-resolve.tq b/deps/v8/src/builtins/promise-resolve.tq
new file mode 100644
index 00000000000000..af7dd7afa0ceaf
--- /dev/null
+++ b/deps/v8/src/builtins/promise-resolve.tq
@@ -0,0 +1,187 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-promise-gen.h'
+
+namespace runtime {
+  extern transitioning runtime
+  ResolvePromise(implicit context: Context)(JSPromise, JSAny): JSAny;
+}
+
+namespace promise {
+  extern macro ConstructorStringConstant(): String;
+  const kConstructorString: String = ConstructorStringConstant();
+
+  // https://tc39.es/ecma262/#sec-promise.resolve
+  transitioning javascript builtin
+  PromiseResolveTrampoline(js-implicit context: NativeContext, receiver: JSAny)(
+      value: JSAny): JSAny {
+    // 1. Let C be the this value.
+    // 2. If Type(C) is not Object, throw a TypeError exception.
+    const receiver = Cast<JSReceiver>(receiver) otherwise
+    ThrowTypeError(MessageTemplate::kCalledOnNonObject, 'PromiseResolve');
+
+    // 3. Return ? PromiseResolve(C, x).
+    return PromiseResolve(receiver, value);
+  }
+
+  transitioning builtin
+  PromiseResolve(implicit context:
+                     Context)(constructor: JSReceiver, value: JSAny): JSAny {
+    const nativeContext = LoadNativeContext(context);
+    const promiseFun = nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX];
+    try {
+      // Check if {value} is a JSPromise.
+      const value = Cast<JSPromise>(value) otherwise NeedToAllocate;
+
+      // We can skip the "constructor" lookup on {value} if it's [[Prototype]]
+      // is the (initial) Promise.prototype and the @@species protector is
+      // intact, as that guards the lookup path for "constructor" on
+      // JSPromise instances which have the (initial) Promise.prototype.
+      const promisePrototype =
+          nativeContext[NativeContextSlot::PROMISE_PROTOTYPE_INDEX];
+      if (value.map.prototype != promisePrototype) {
+        goto SlowConstructor;
+      }
+
+      if (IsPromiseSpeciesProtectorCellInvalid()) goto SlowConstructor;
+
+      // If the {constructor} is the Promise function, we just immediately
+      // return the {value} here and don't bother wrapping it into a
+      // native Promise.
+      if (promiseFun != constructor) goto SlowConstructor;
+      return value;
+    }
+    label SlowConstructor deferred {
+      // At this point, value or/and constructor are not native promises, but
+      // they could be of the same subclass.
+      const valueConstructor = GetProperty(value, kConstructorString);
+      if (valueConstructor != constructor) goto NeedToAllocate;
+      return value;
+    }
+    label NeedToAllocate {
+      if (promiseFun == constructor) {
+        // This adds a fast path for native promises that don't need to
+        // create NewPromiseCapability.
+        const result = NewJSPromise();
+        ResolvePromise(context, result, value);
+        return result;
+      } else
+        deferred {
+          const capability = NewPromiseCapability(constructor, True);
+          const resolve = UnsafeCast<Callable>(capability.resolve);
+          Call(context, resolve, Undefined, value);
+          return capability.promise;
+        }
+    }
+  }
+
+  extern macro IsJSReceiverMap(Map): bool;
+
+  extern macro IsPromiseThenProtectorCellInvalid(): bool;
+
+  extern macro ThenStringConstant(): String;
+
+  const kThenString: String = ThenStringConstant();
+
+  transitioning builtin
+  ResolvePromise(implicit context:
+                     Context)(promise: JSPromise, resolution: JSAny): JSAny {
+    // 6. If SameValue(resolution, promise) is true, then
+    // If promise hook is enabled or the debugger is active, let
+    // the runtime handle this operation, which greatly reduces
+    // the complexity here and also avoids a couple of back and
+    // forth between JavaScript and C++ land.
+    // We also let the runtime handle it if promise == resolution.
+    // We can use pointer comparison here, since the {promise} is guaranteed
+    // to be a JSPromise inside this function and thus is reference comparable.
+    if (IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate() ||
+        TaggedEqual(promise, resolution))
+      deferred {
+        return runtime::ResolvePromise(promise, resolution);
+      }
+
+    let then: Object = Undefined;
+    try {
+      // 7. If Type(resolution) is not Object, then
+      // 7.b Return FulfillPromise(promise, resolution).
+      if (TaggedIsSmi(resolution)) {
+        return FulfillPromise(promise, resolution);
+      }
+
+      const heapResolution = UnsafeCast<HeapObject>(resolution);
+      const resolutionMap = heapResolution.map;
+      if (!IsJSReceiverMap(resolutionMap)) {
+        return FulfillPromise(promise, resolution);
+      }
+
+      // We can skip the "then" lookup on {resolution} if its [[Prototype]]
+      // is the (initial) Promise.prototype and the Promise#then protector
+      // is intact, as that guards the lookup path for the "then" property
+      // on JSPromise instances which have the (initial) %PromisePrototype%.
+      if (IsForceSlowPath()) {
+        goto Slow;
+      }
+
+      if (IsPromiseThenProtectorCellInvalid()) {
+        goto Slow;
+      }
+
+      const nativeContext = LoadNativeContext(context);
+      if (!IsJSPromiseMap(resolutionMap)) {
+        // We can skip the lookup of "then" if the {resolution} is a (newly
+        // created) IterResultObject, as the Promise#then() protector also
+        // ensures that the intrinsic %ObjectPrototype% doesn't contain any
+        // "then" property. This helps to avoid negative lookups on iterator
+        // results from async generators.
+        assert(IsJSReceiverMap(resolutionMap));
+        assert(!IsPromiseThenProtectorCellInvalid());
+        if (resolutionMap ==
+            nativeContext[NativeContextSlot::ITERATOR_RESULT_MAP_INDEX]) {
+          return FulfillPromise(promise, resolution);
+        } else {
+          goto Slow;
+        }
+      }
+
+      const promisePrototype =
+          nativeContext[NativeContextSlot::PROMISE_PROTOTYPE_INDEX];
+      if (resolutionMap.prototype == promisePrototype) {
+        // The {resolution} is a native Promise in this case.
+        then = nativeContext[NativeContextSlot::PROMISE_THEN_INDEX];
+        goto Enqueue;
+      }
+      goto Slow;
+    }
+    label Slow deferred {
+      // 8. Let then be Get(resolution, "then").
+      // 9. If then is an abrupt completion, then
+      // 9.a Return RejectPromise(promise, then.[[Value]]).
+      try {
+        then = GetProperty(resolution, kThenString);
+      } catch (e) {
+        return RejectPromise(promise, e, False);
+      }
+
+      // 11. If IsCallable(thenAction) is false, then
+      if (TaggedIsSmi(then)) {
+        return FulfillPromise(promise, resolution);
+      }
+
+      if (!IsCallable(UnsafeCast<HeapObject>(then))) {
+        return FulfillPromise(promise, resolution);
+      }
+      goto Enqueue;
+    }
+    label Enqueue {
+      // 12. Perform EnqueueJob("PromiseJobs", PromiseResolveThenableJob,
+      //                        «promise, resolution, thenAction»).
+      const nativeContext = LoadNativeContext(context);
+      const task = NewPromiseResolveThenableJobTask(
+          promise, UnsafeCast<JSReceiver>(then),
+          UnsafeCast<JSReceiver>(resolution), nativeContext);
+      return EnqueueMicrotask(nativeContext, task);
+    }
+  }
+}
diff --git a/deps/v8/src/builtins/promise-then.tq b/deps/v8/src/builtins/promise-then.tq
new file mode 100644
index 00000000000000..45f8fd0c81f6d0
--- /dev/null
+++ b/deps/v8/src/builtins/promise-then.tq
@@ -0,0 +1,79 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-promise-gen.h'
+
+namespace promise {
+
+  macro
+  IsPromiseSpeciesLookupChainIntact(
+      nativeContext: NativeContext, promiseMap: Map): bool {
+    const promisePrototype =
+        nativeContext[NativeContextSlot::PROMISE_PROTOTYPE_INDEX];
+    if (IsForceSlowPath()) return false;
+    if (promiseMap.prototype != promisePrototype) return false;
+    return !IsPromiseSpeciesProtectorCellInvalid();
+  }
+
+  // https://tc39.es/ecma262/#sec-promise.prototype.then
+  transitioning javascript builtin
+  PromisePrototypeThen(js-implicit context: NativeContext, receiver: JSAny)(
+      onFulfilled: JSAny, onRejected: JSAny): JSAny {
+    // 1. Let promise be the this value.
+    // 2. If IsPromise(promise) is false, throw a TypeError exception.
+    const promise = Cast<JSPromise>(receiver) otherwise ThrowTypeError(
+        MessageTemplate::kIncompatibleMethodReceiver, 'Promise.prototype.then',
+        receiver);
+
+    // 3. Let C be ? SpeciesConstructor(promise, %Promise%).
+    const promiseFun = UnsafeCast<JSFunction>(
+        context[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
+
+    // 4. Let resultCapability be ? NewPromiseCapability(C).
+    let resultPromiseOrCapability: JSPromise|PromiseCapability;
+    let resultPromise: JSAny;
+    try {
+      if (IsPromiseSpeciesLookupChainIntact(context, promise.map)) {
+        goto AllocateAndInit;
+      }
+
+      const constructor = SpeciesConstructor(promise, promiseFun);
+      if (TaggedEqual(constructor, promiseFun)) {
+        goto AllocateAndInit;
+      } else {
+        const promiseCapability = NewPromiseCapability(constructor, True);
+        resultPromiseOrCapability = promiseCapability;
+        resultPromise = promiseCapability.promise;
+      }
+    }
+    label AllocateAndInit {
+      const resultJSPromise = NewJSPromise(promise);
+      resultPromiseOrCapability = resultJSPromise;
+      resultPromise = resultJSPromise;
+    }
+
+    // We do some work of the PerformPromiseThen operation here, in that
+    // we check the handlers and turn non-callable handlers into undefined.
+    // This is because this is the one and only callsite of PerformPromiseThen
+    // that has to do this.
+
+    // 3. If IsCallable(onFulfilled) is false, then
+    //    a. Set onFulfilled to undefined.
+    const onFulfilled = TaggedIsCallable(onFulfilled) ?
+        UnsafeCast<Callable>(onFulfilled) :
+        Undefined;
+
+    // 4. If IsCallable(onRejected) is false, then
+    //    a. Set onRejected to undefined.
+    const onRejected = TaggedIsCallable(onRejected) ?
+        UnsafeCast<Callable>(onRejected) :
+        Undefined;
+
+    // 5. Return PerformPromiseThen(promise, onFulfilled, onRejected,
+    //    resultCapability).
+    PerformPromiseThenImpl(
+        promise, onFulfilled, onRejected, resultPromiseOrCapability);
+    return resultPromise;
+  }
+}
diff --git a/deps/v8/src/builtins/proxy-constructor.tq b/deps/v8/src/builtins/proxy-constructor.tq
index cfb11046a7ab64..ef886e4f2878c2 100644
--- a/deps/v8/src/builtins/proxy-constructor.tq
+++ b/deps/v8/src/builtins/proxy-constructor.tq
@@ -10,12 +10,12 @@ namespace proxy {
   // https://tc39.github.io/ecma262/#sec-proxy-constructor
   transitioning javascript builtin
   ProxyConstructor(
-      js-implicit context: Context, receiver: JSAny,
+      js-implicit context: NativeContext, receiver: JSAny,
       newTarget: JSAny)(target: JSAny, handler: JSAny): JSProxy {
     try {
       // 1. If NewTarget is undefined, throw a TypeError exception.
       if (newTarget == Undefined) {
-        ThrowTypeError(kConstructorNotFunction, 'Proxy');
+        ThrowTypeError(MessageTemplate::kConstructorNotFunction, 'Proxy');
       }
 
       // 2. Return ? ProxyCreate(target, handler).
@@ -51,10 +51,10 @@ namespace proxy {
       return AllocateProxy(targetJSReceiver, handlerJSReceiver);
     }
     label ThrowProxyNonObject deferred {
-      ThrowTypeError(kProxyNonObject);
+      ThrowTypeError(MessageTemplate::kProxyNonObject);
     }
     label ThrowProxyHandlerOrTargetRevoked deferred {
-      ThrowTypeError(kProxyHandlerOrTargetRevoked);
+      ThrowTypeError(MessageTemplate::kProxyHandlerOrTargetRevoked);
     }
   }
 }
diff --git a/deps/v8/src/builtins/proxy-delete-property.tq b/deps/v8/src/builtins/proxy-delete-property.tq
index 3054c0d07acbab..b068f3afb1a19b 100644
--- a/deps/v8/src/builtins/proxy-delete-property.tq
+++ b/deps/v8/src/builtins/proxy-delete-property.tq
@@ -10,7 +10,7 @@ namespace proxy {
   // https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-delete-p
   transitioning builtin
   ProxyDeleteProperty(implicit context: Context)(
-      proxy: JSProxy, name: PropertyKey, languageMode: LanguageMode): JSAny {
+      proxy: JSProxy, name: PropertyKey, languageMode: LanguageModeSmi): JSAny {
     const kTrapName: constexpr string = 'deleteProperty';
     // Handle deeply nested proxy.
     PerformStackCheck();
@@ -41,8 +41,10 @@ namespace proxy {
 
       // 9. If booleanTrapResult is false, return false.
       if (!ToBoolean(trapResult)) {
-        if (languageMode == SmiConstant(kStrict)) {
-          ThrowTypeError(kProxyTrapReturnedFalsishFor, kTrapName, name);
+        const strictValue: LanguageModeSmi = LanguageMode::kStrict;
+        if (languageMode == strictValue) {
+          ThrowTypeError(
+              MessageTemplate::kProxyTrapReturnedFalsishFor, kTrapName, name);
         }
         return False;
       }
@@ -63,7 +65,7 @@ namespace proxy {
       return DeleteProperty(target, name, languageMode);
     }
     label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(kProxyRevoked, kTrapName);
+      ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
     }
   }
 }
diff --git a/deps/v8/src/builtins/proxy-get-property.tq b/deps/v8/src/builtins/proxy-get-property.tq
index 54b8cde24339ff..7138648a851d4e 100644
--- a/deps/v8/src/builtins/proxy-get-property.tq
+++ b/deps/v8/src/builtins/proxy-get-property.tq
@@ -27,7 +27,7 @@ namespace proxy {
     let handler: JSReceiver;
     typeswitch (proxy.handler) {
       case (Null): {
-        ThrowTypeError(kProxyRevoked, 'get');
+        ThrowTypeError(MessageTemplate::kProxyRevoked, 'get');
       }
       case (h: JSReceiver): {
         handler = h;
diff --git a/deps/v8/src/builtins/proxy-get-prototype-of.tq b/deps/v8/src/builtins/proxy-get-prototype-of.tq
index 5b90a1bb02a064..8c556e27c2bf45 100644
--- a/deps/v8/src/builtins/proxy-get-prototype-of.tq
+++ b/deps/v8/src/builtins/proxy-get-prototype-of.tq
@@ -39,14 +39,14 @@ namespace proxy {
 
       // 9. Let extensibleTarget be ? IsExtensible(target).
       // 10. If extensibleTarget is true, return handlerProto.
-      const extensibleTarget: JSAny = object::ObjectIsExtensible(target);
+      const extensibleTarget: JSAny = object::ObjectIsExtensibleImpl(target);
       assert(extensibleTarget == True || extensibleTarget == False);
       if (extensibleTarget == True) {
         return handlerProto;
       }
 
       // 11. Let targetProto be ? target.[[GetPrototypeOf]]().
-      const targetProto = object::ObjectGetPrototypeOf(target);
+      const targetProto = object::ObjectGetPrototypeOfImpl(target);
 
       // 12. If SameValue(handlerProto, targetProto) is false, throw a TypeError
       // exception.
@@ -54,17 +54,17 @@ namespace proxy {
       if (SameValue(targetProto, handlerProto)) {
         return handlerProto;
       }
-      ThrowTypeError(kProxyGetPrototypeOfNonExtensible);
+      ThrowTypeError(MessageTemplate::kProxyGetPrototypeOfNonExtensible);
     }
     label TrapUndefined(target: JSAny) {
       // 6.a. Return ? target.[[GetPrototypeOf]]().
-      return object::ObjectGetPrototypeOf(target);
+      return object::ObjectGetPrototypeOfImpl(target);
     }
     label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(kProxyRevoked, kTrapName);
+      ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
     }
     label ThrowProxyGetPrototypeOfInvalid deferred {
-      ThrowTypeError(kProxyGetPrototypeOfInvalid);
+      ThrowTypeError(MessageTemplate::kProxyGetPrototypeOfInvalid);
     }
   }
 }
diff --git a/deps/v8/src/builtins/proxy-has-property.tq b/deps/v8/src/builtins/proxy-has-property.tq
index 1f14c68903c838..286314666714dd 100644
--- a/deps/v8/src/builtins/proxy-has-property.tq
+++ b/deps/v8/src/builtins/proxy-has-property.tq
@@ -51,7 +51,7 @@ namespace proxy {
       tail HasProperty(target, name);
     }
     label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(kProxyRevoked, 'has');
+      ThrowTypeError(MessageTemplate::kProxyRevoked, 'has');
     }
   }
 }
diff --git a/deps/v8/src/builtins/proxy-is-extensible.tq b/deps/v8/src/builtins/proxy-is-extensible.tq
index dfbdc6f734625f..9c0d45c5294950 100644
--- a/deps/v8/src/builtins/proxy-is-extensible.tq
+++ b/deps/v8/src/builtins/proxy-is-extensible.tq
@@ -33,13 +33,14 @@ namespace proxy {
       const trapResult = ToBoolean(Call(context, trap, handler, target));
 
       // 8. Let targetResult be ? IsExtensible(target).
-      const targetResult: bool = ToBoolean(object::ObjectIsExtensible(target));
+      const targetResult: bool =
+          ToBoolean(object::ObjectIsExtensibleImpl(target));
 
       // 9. If SameValue(booleanTrapResult, targetResult) is false, throw a
       // TypeError exception.
       if (trapResult != targetResult) {
         ThrowTypeError(
-            kProxyIsExtensibleInconsistent,
+            MessageTemplate::kProxyIsExtensibleInconsistent,
             SelectBooleanConstant(targetResult));
       }
       // 10. Return booleanTrapResult.
@@ -47,10 +48,10 @@ namespace proxy {
     }
     label TrapUndefined(target: JSAny) {
       // 6.a. Return ? IsExtensible(target).
-      return object::ObjectIsExtensible(target);
+      return object::ObjectIsExtensibleImpl(target);
     }
     label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(kProxyRevoked, kTrapName);
+      ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
     }
   }
 }
diff --git a/deps/v8/src/builtins/proxy-prevent-extensions.tq b/deps/v8/src/builtins/proxy-prevent-extensions.tq
index ab75cfc4cb3707..10bd1f45f0145e 100644
--- a/deps/v8/src/builtins/proxy-prevent-extensions.tq
+++ b/deps/v8/src/builtins/proxy-prevent-extensions.tq
@@ -37,14 +37,14 @@ namespace proxy {
       //    8.a. Let extensibleTarget be ? IsExtensible(target).
       //    8.b If extensibleTarget is true, throw a TypeError exception.
       if (ToBoolean(trapResult)) {
-        const extensibleTarget: JSAny = object::ObjectIsExtensible(target);
+        const extensibleTarget: JSAny = object::ObjectIsExtensibleImpl(target);
         assert(extensibleTarget == True || extensibleTarget == False);
         if (extensibleTarget == True) {
-          ThrowTypeError(kProxyPreventExtensionsExtensible);
+          ThrowTypeError(MessageTemplate::kProxyPreventExtensionsExtensible);
         }
       } else {
         if (doThrow == True) {
-          ThrowTypeError(kProxyTrapReturnedFalsish, kTrapName);
+          ThrowTypeError(MessageTemplate::kProxyTrapReturnedFalsish, kTrapName);
         }
         return False;
       }
@@ -60,7 +60,7 @@ namespace proxy {
       return object::ObjectPreventExtensionsDontThrow(target);
     }
     label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(kProxyRevoked, kTrapName);
+      ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
     }
   }
 }  // namespace proxy
diff --git a/deps/v8/src/builtins/proxy-revocable.tq b/deps/v8/src/builtins/proxy-revocable.tq
index 465b1aef964037..2b853afefea618 100644
--- a/deps/v8/src/builtins/proxy-revocable.tq
+++ b/deps/v8/src/builtins/proxy-revocable.tq
@@ -12,8 +12,8 @@ namespace proxy {
   // Proxy.revocable(target, handler)
   // https://tc39.github.io/ecma262/#sec-proxy.revocable
   transitioning javascript builtin
-  ProxyRevocable(js-implicit context: Context)(target: JSAny, handler: JSAny):
-      JSProxyRevocableResult {
+  ProxyRevocable(js-implicit context: NativeContext)(
+      target: JSAny, handler: JSAny): JSProxyRevocableResult {
     try {
       const targetJSReceiver =
           Cast<JSReceiver>(target) otherwise ThrowProxyNonObject;
@@ -43,10 +43,11 @@ namespace proxy {
       return NewJSProxyRevocableResult(proxy, revoke);
     }
     label ThrowProxyNonObject deferred {
-      ThrowTypeError(kProxyNonObject, 'Proxy.revocable');
+      ThrowTypeError(MessageTemplate::kProxyNonObject, 'Proxy.revocable');
     }
     label ThrowProxyHandlerOrTargetRevoked deferred {
-      ThrowTypeError(kProxyHandlerOrTargetRevoked, 'Proxy.revocable');
+      ThrowTypeError(
+          MessageTemplate::kProxyHandlerOrTargetRevoked, 'Proxy.revocable');
     }
   }
 }
diff --git a/deps/v8/src/builtins/proxy-revoke.tq b/deps/v8/src/builtins/proxy-revoke.tq
index d89b54077ae109..7300f4d7179e70 100644
--- a/deps/v8/src/builtins/proxy-revoke.tq
+++ b/deps/v8/src/builtins/proxy-revoke.tq
@@ -9,7 +9,7 @@ namespace proxy {
   // Proxy Revocation Functions
   // https://tc39.github.io/ecma262/#sec-proxy-revocation-functions
   transitioning javascript builtin
-  ProxyRevoke(js-implicit context: Context)(): Undefined {
+  ProxyRevoke(js-implicit context: NativeContext)(): Undefined {
     // 1. Let p be F.[[RevocableProxy]].
     const proxyObject: Object = context[PROXY_SLOT];
 
diff --git a/deps/v8/src/builtins/proxy-set-property.tq b/deps/v8/src/builtins/proxy-set-property.tq
index 2d9636c88173c3..2d084eac7a5666 100644
--- a/deps/v8/src/builtins/proxy-set-property.tq
+++ b/deps/v8/src/builtins/proxy-set-property.tq
@@ -19,7 +19,7 @@ namespace proxy {
   // https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-set-p-v-receiver
   transitioning builtin
   ProxySetProperty(implicit context: Context)(
-      proxy: JSProxy, name: PropertyKey | PrivateSymbol, value: JSAny,
+      proxy: JSProxy, name: PropertyKey|PrivateSymbol, value: JSAny,
       receiverValue: JSAny): JSAny {
     // 1. Assert: IsPropertyKey(P) is true.
     assert(TaggedIsNotSmi(name));
@@ -28,7 +28,7 @@ namespace proxy {
     let key: PropertyKey;
     typeswitch (name) {
       case (PrivateSymbol): {
-        CallThrowTypeErrorIfStrict(kProxyPrivate);
+        CallThrowTypeErrorIfStrict(MessageTemplate::kProxyPrivate);
         return Undefined;
       }
       case (name: PropertyKey): {
@@ -73,7 +73,8 @@ namespace proxy {
         return value;
       }
       ThrowTypeErrorIfStrict(
-          SmiConstant(kProxyTrapReturnedFalsishFor), 'set', name);
+          SmiConstant(MessageTemplate::kProxyTrapReturnedFalsishFor), 'set',
+          name);
       return value;
     }
     label TrapUndefined(target: Object) {
@@ -82,7 +83,7 @@ namespace proxy {
       return value;
     }
     label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(kProxyRevoked, 'set');
+      ThrowTypeError(MessageTemplate::kProxyRevoked, 'set');
     }
   }
 }
diff --git a/deps/v8/src/builtins/proxy-set-prototype-of.tq b/deps/v8/src/builtins/proxy-set-prototype-of.tq
index 355c258ab8f24b..a7a76b753551b5 100644
--- a/deps/v8/src/builtins/proxy-set-prototype-of.tq
+++ b/deps/v8/src/builtins/proxy-set-prototype-of.tq
@@ -10,7 +10,7 @@ namespace proxy {
   // https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-setprototypeof-v
   transitioning builtin
   ProxySetPrototypeOf(implicit context: Context)(
-      proxy: JSProxy, proto: Null | JSReceiver, doThrow: Boolean): JSAny {
+      proxy: JSProxy, proto: Null|JSReceiver, doThrow: Boolean): JSAny {
     PerformStackCheck();
     const kTrapName: constexpr string = 'setPrototypeOf';
     try {
@@ -39,21 +39,22 @@ namespace proxy {
       // 9. If booleanTrapResult is false, return false.
       if (!ToBoolean(trapResult)) {
         if (doThrow == True) {
-          ThrowTypeError(kProxyTrapReturnedFalsishFor, kTrapName);
+          ThrowTypeError(
+              MessageTemplate::kProxyTrapReturnedFalsishFor, kTrapName);
         }
         return False;
       }
 
       // 10. Let extensibleTarget be ? IsExtensible(target).
       // 11. If extensibleTarget is true, return true.
-      const extensibleTarget: Object = object::ObjectIsExtensible(target);
+      const extensibleTarget: Object = object::ObjectIsExtensibleImpl(target);
       assert(extensibleTarget == True || extensibleTarget == False);
       if (extensibleTarget == True) {
         return True;
       }
 
       // 12. Let targetProto be ? target.[[GetPrototypeOf]]().
-      const targetProto = object::ObjectGetPrototypeOf(target);
+      const targetProto = object::ObjectGetPrototypeOfImpl(target);
 
       // 13. If SameValue(V, targetProto) is false, throw a TypeError
       // exception.
@@ -61,9 +62,9 @@ namespace proxy {
       if (SameValue(proto, targetProto)) {
         return True;
       }
-      ThrowTypeError(kProxySetPrototypeOfNonExtensible);
+      ThrowTypeError(MessageTemplate::kProxySetPrototypeOfNonExtensible);
     }
-    label TrapUndefined(target: JSAny, proto: JSReceiver | Null) {
+    label TrapUndefined(target: JSAny, proto: JSReceiver|Null) {
       // 7.a. Return ? target.[[SetPrototypeOf]]().
       if (doThrow == True) {
         return object::ObjectSetPrototypeOfThrow(target, proto);
@@ -71,7 +72,7 @@ namespace proxy {
       return object::ObjectSetPrototypeOfDontThrow(target, proto);
     }
     label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(kProxyRevoked, kTrapName);
+      ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
     }
   }
 }
diff --git a/deps/v8/src/builtins/proxy.tq b/deps/v8/src/builtins/proxy.tq
index d95def5d0e3874..2db794e8e80c83 100644
--- a/deps/v8/src/builtins/proxy.tq
+++ b/deps/v8/src/builtins/proxy.tq
@@ -25,31 +25,6 @@ namespace proxy {
   extern transitioning macro ProxiesCodeStubAssembler::CheckHasTrapResult(
       implicit context: Context)(JSReceiver, JSProxy, Name);
 
-  const kProxyNonObject: constexpr MessageTemplate
-  generates 'MessageTemplate::kProxyNonObject';
-  const kProxyHandlerOrTargetRevoked: constexpr MessageTemplate
-  generates 'MessageTemplate::kProxyHandlerOrTargetRevoked';
-  const kProxyRevoked: constexpr MessageTemplate
-  generates 'MessageTemplate::kProxyRevoked';
-  const kProxyTrapReturnedFalsishFor: constexpr MessageTemplate
-  generates 'MessageTemplate::kProxyTrapReturnedFalsishFor';
-  const kProxyPrivate: constexpr MessageTemplate
-  generates 'MessageTemplate::kProxyPrivate';
-  const kProxyIsExtensibleInconsistent: constexpr MessageTemplate
-  generates 'MessageTemplate::kProxyIsExtensibleInconsistent';
-  const kProxyPreventExtensionsExtensible: constexpr MessageTemplate
-  generates 'MessageTemplate::kProxyPreventExtensionsExtensible';
-  const kProxyTrapReturnedFalsish: constexpr MessageTemplate
-  generates 'MessageTemplate::kProxyTrapReturnedFalsish';
-  const kProxyGetPrototypeOfInvalid: constexpr MessageTemplate
-  generates 'MessageTemplate::kProxyGetPrototypeOfInvalid';
-  const kProxyGetPrototypeOfNonExtensible: constexpr MessageTemplate
-  generates 'MessageTemplate::kProxyGetPrototypeOfNonExtensible';
-  const kProxySetPrototypeOfNonExtensible: constexpr MessageTemplate
-  generates 'MessageTemplate::kProxySetPrototypeOfNonExtensible';
-  const kProxyDeletePropertyNonExtensible: constexpr MessageTemplate
-  generates 'MessageTemplate::kProxyDeletePropertyNonExtensible';
-
   const kProxyGet: constexpr int31
   generates 'JSProxy::AccessKind::kGet';
   const kProxySet: constexpr int31
diff --git a/deps/v8/src/builtins/reflect.tq b/deps/v8/src/builtins/reflect.tq
index 97c6ec81a74ec0..f1818ed32d7310 100644
--- a/deps/v8/src/builtins/reflect.tq
+++ b/deps/v8/src/builtins/reflect.tq
@@ -3,45 +3,48 @@
 // found in the LICENSE file.
 
 namespace reflect {
-
-  const kCalledOnNonObject: constexpr MessageTemplate
-  generates 'MessageTemplate::kCalledOnNonObject';
-
   // ES6 section 26.1.10 Reflect.isExtensible
   transitioning javascript builtin
-  ReflectIsExtensible(js-implicit context: Context)(object: JSAny): JSAny {
+  ReflectIsExtensible(js-implicit context: NativeContext)(object: JSAny):
+      JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object)
-        otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.isExtensible');
-    return object::ObjectIsExtensible(objectJSReceiver);
+        otherwise ThrowTypeError(
+        MessageTemplate::kCalledOnNonObject, 'Reflect.isExtensible');
+    return object::ObjectIsExtensibleImpl(objectJSReceiver);
   }
 
   // ES6 section 26.1.12 Reflect.preventExtensions
   transitioning javascript builtin
-  ReflectPreventExtensions(js-implicit context: Context)(object: JSAny): JSAny {
+  ReflectPreventExtensions(js-implicit context: NativeContext)(object: JSAny):
+      JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object)
-        otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.preventExtensions');
+        otherwise ThrowTypeError(
+        MessageTemplate::kCalledOnNonObject, 'Reflect.preventExtensions');
     return object::ObjectPreventExtensionsDontThrow(objectJSReceiver);
   }
 
   // ES6 section 26.1.8 Reflect.getPrototypeOf
   transitioning javascript builtin
-  ReflectGetPrototypeOf(js-implicit context: Context)(object: JSAny): JSAny {
+  ReflectGetPrototypeOf(js-implicit context: NativeContext)(object: JSAny):
+      JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object)
-        otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.getPrototypeOf');
+        otherwise ThrowTypeError(
+        MessageTemplate::kCalledOnNonObject, 'Reflect.getPrototypeOf');
     return object::JSReceiverGetPrototypeOf(objectJSReceiver);
   }
 
   // ES6 section 26.1.14 Reflect.setPrototypeOf
   transitioning javascript builtin ReflectSetPrototypeOf(
-      js-implicit context: Context)(object: JSAny, proto: JSAny): JSAny {
+      js-implicit context: NativeContext)(object: JSAny, proto: JSAny): JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object)
-        otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.setPrototypeOf');
+        otherwise ThrowTypeError(
+        MessageTemplate::kCalledOnNonObject, 'Reflect.setPrototypeOf');
     typeswitch (proto) {
-      case (proto: JSReceiver | Null): {
+      case (proto: JSReceiver|Null): {
         return object::ObjectSetPrototypeOfDontThrow(objectJSReceiver, proto);
       }
       case (JSAny): {
-        ThrowTypeError(kProtoObjectOrNull, proto);
+        ThrowTypeError(MessageTemplate::kProtoObjectOrNull, proto);
       }
     }
   }
@@ -57,11 +60,12 @@ namespace reflect {
 
   // ES6 section 26.1.6 Reflect.get
   transitioning javascript builtin
-  ReflectGet(js-implicit context: Context)(...arguments): JSAny {
+  ReflectGet(js-implicit context: NativeContext)(...arguments): JSAny {
     const length = arguments.length;
     const object: JSAny = length > 0 ? arguments[0] : Undefined;
     const objectJSReceiver = Cast<JSReceiver>(object)
-        otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.get');
+        otherwise ThrowTypeError(
+        MessageTemplate::kCalledOnNonObject, 'Reflect.get');
     const propertyKey: JSAny = length > 1 ? arguments[1] : Undefined;
     const name: AnyName = ToName(propertyKey);
     const receiver: JSAny = length > 2 ? arguments[2] : objectJSReceiver;
@@ -71,9 +75,20 @@ namespace reflect {
 
   // ES6 section 26.1.4 Reflect.deleteProperty
   transitioning javascript builtin ReflectDeleteProperty(
-      js-implicit context: Context)(object: JSAny, key: JSAny): JSAny {
+      js-implicit context: NativeContext)(object: JSAny, key: JSAny): JSAny {
+    const objectJSReceiver = Cast<JSReceiver>(object)
+        otherwise ThrowTypeError(
+        MessageTemplate::kCalledOnNonObject, 'Reflect.deleteProperty');
+    return DeleteProperty(objectJSReceiver, key, LanguageMode::kSloppy);
+  }
+
+  // ES section #sec-reflect.has
+  transitioning javascript builtin
+  ReflectHas(js-implicit context: NativeContext)(object: JSAny, key: JSAny):
+      JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object)
-        otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.deleteProperty');
-    return DeleteProperty(objectJSReceiver, key, kSloppy);
+        otherwise ThrowTypeError(
+        MessageTemplate::kCalledOnNonObject, 'Reflect.has');
+    return HasProperty(objectJSReceiver, key);
   }
 }  // namespace reflect
diff --git a/deps/v8/src/builtins/regexp-exec.tq b/deps/v8/src/builtins/regexp-exec.tq
index b2ca9de10b57ee..0b11c42fbf7f01 100644
--- a/deps/v8/src/builtins/regexp-exec.tq
+++ b/deps/v8/src/builtins/regexp-exec.tq
@@ -6,9 +6,7 @@
 
 namespace regexp {
 
-  extern transitioning macro RegExpBuiltinsAssembler::RegExpPrototypeExecBody(
-      implicit context: Context)(JSReceiver, String, constexpr bool): JSAny;
-
+  @export
   transitioning macro RegExpPrototypeExecBodyFast(implicit context: Context)(
       receiver: JSReceiver, string: String): JSAny {
     return RegExpPrototypeExecBody(receiver, string, true);
@@ -32,11 +30,13 @@ namespace regexp {
   // ES#sec-regexp.prototype.exec
   // RegExp.prototype.exec ( string )
   transitioning javascript builtin RegExpPrototypeExec(
-      js-implicit context: Context, receiver: JSAny)(string: JSAny): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(string: JSAny): JSAny {
     // Ensure {receiver} is a JSRegExp.
     const receiver = Cast<JSRegExp>(receiver) otherwise ThrowTypeError(
-        kIncompatibleMethodReceiver, 'RegExp.prototype.exec', receiver);
-    const string = ToString_Inline(context, string);
+        MessageTemplate::kIncompatibleMethodReceiver, 'RegExp.prototype.exec',
+        receiver);
+    const string = ToString_Inline(string);
 
     return IsFastRegExpNoPrototype(receiver) ?
         RegExpPrototypeExecBodyFast(receiver, string) :
diff --git a/deps/v8/src/builtins/regexp-match-all.tq b/deps/v8/src/builtins/regexp-match-all.tq
index 1be6e69afce748..022f8bc53f101d 100644
--- a/deps/v8/src/builtins/regexp-match-all.tq
+++ b/deps/v8/src/builtins/regexp-match-all.tq
@@ -6,9 +6,6 @@
 
 namespace regexp {
 
-  extern transitioning macro RegExpBuiltinsAssembler::RegExpCreate(
-      implicit context: Context)(Context, Object, String): Object;
-
   extern transitioning macro
   RegExpMatchAllAssembler::CreateRegExpStringIterator(
       NativeContext, Object, String, bool, bool): JSAny;
@@ -19,11 +16,12 @@ namespace regexp {
     // 1. Let R be the this value.
     // 2. If Type(R) is not Object, throw a TypeError exception.
     ThrowIfNotJSReceiver(
-        receiver, kIncompatibleMethodReceiver, 'RegExp.prototype.@@matchAll');
+        receiver, MessageTemplate::kIncompatibleMethodReceiver,
+        'RegExp.prototype.@@matchAll');
     const receiver = UnsafeCast<JSReceiver>(receiver);
 
     // 3. Let S be ? ToString(O).
-    const string: String = ToString_Inline(context, string);
+    const string: String = ToString_Inline(string);
 
     let matcher: Object;
     let global: bool;
@@ -52,29 +50,27 @@ namespace regexp {
 
         // 9. If flags contains "g", let global be true.
         // 10. Else, let global be false.
-        global = FastFlagGetter(matcherRegExp, kGlobal);
+        global = FastFlagGetter(matcherRegExp, Flag::kGlobal);
 
         // 11. If flags contains "u", let fullUnicode be true.
         // 12. Else, let fullUnicode be false.
-        unicode = FastFlagGetter(matcherRegExp, kUnicode);
+        unicode = FastFlagGetter(matcherRegExp, Flag::kUnicode);
       }
       case (Object): {
         // 4. Let C be ? SpeciesConstructor(R, %RegExp%).
-        const regexpFun =
-            UnsafeCast<JSFunction>(nativeContext[REGEXP_FUNCTION_INDEX]);
+        const regexpFun = LoadRegExpFunction(nativeContext);
         const speciesConstructor =
             UnsafeCast<Constructor>(SpeciesConstructor(receiver, regexpFun));
 
         // 5. Let flags be ? ToString(? Get(R, "flags")).
         const flags = GetProperty(receiver, 'flags');
-        const flagsString = ToString_Inline(context, flags);
+        const flagsString = ToString_Inline(flags);
 
         // 6. Let matcher be ? Construct(C, « R, flags »).
         matcher = Construct(speciesConstructor, receiver, flagsString);
 
         // 7. Let lastIndex be ? ToLength(? Get(R, "lastIndex")).
-        const lastIndex: Number =
-            ToLength_Inline(context, SlowLoadLastIndex(receiver));
+        const lastIndex: Number = ToLength_Inline(SlowLoadLastIndex(receiver));
 
         // 8. Perform ? Set(matcher, "lastIndex", lastIndex, true).
         SlowStoreLastIndex(UnsafeCast<JSReceiver>(matcher), lastIndex);
@@ -103,9 +99,9 @@ namespace regexp {
   // https://tc39.github.io/proposal-string-matchall/
   // RegExp.prototype [ @@matchAll ] ( string )
   transitioning javascript builtin RegExpPrototypeMatchAll(
-      js-implicit context: Context, receiver: JSAny)(string: JSAny): JSAny {
-    const nativeContext: NativeContext = LoadNativeContext(context);
-    return RegExpPrototypeMatchAllImpl(nativeContext, receiver, string);
+      js-implicit context: NativeContext,
+      receiver: JSAny)(string: JSAny): JSAny {
+    return RegExpPrototypeMatchAllImpl(context, receiver, string);
   }
 
   const kJSRegExpStringIteratorDone:
@@ -134,14 +130,10 @@ namespace regexp {
     iterator.flags = newFlags;
   }
 
-  extern macro RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
-      implicit context: Context)(JSReceiver, RegExpMatchInfo, String):
-      JSRegExpResult;
-
   // https://tc39.github.io/proposal-string-matchall/
   // %RegExpStringIteratorPrototype%.next ( )
   transitioning javascript builtin RegExpStringIteratorPrototypeNext(
-      js-implicit context: Context, receiver: JSAny)(): JSAny {
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
     // 1. Let O be the this value.
     // 2. If Type(O) is not Object, throw a TypeError exception.
     // 3. If O does not have all of the internal slots of a RegExp String
@@ -149,7 +141,8 @@ namespace regexp {
     const methodName: constexpr string =
         '%RegExpStringIterator%.prototype.next';
     const receiver = Cast<JSRegExpStringIterator>(receiver) otherwise
-    ThrowTypeError(kIncompatibleMethodReceiver, methodName, receiver);
+    ThrowTypeError(
+        MessageTemplate::kIncompatibleMethodReceiver, methodName, receiver);
 
     try {
       // 4. If O.[[Done]] is true, then
@@ -170,12 +163,14 @@ namespace regexp {
       let isFastRegExp: bool = false;
       try {
         if (IsFastRegExpPermissive(iteratingRegExp)) {
+          const regexp = UnsafeCast<JSRegExp>(iteratingRegExp);
+          const lastIndex = LoadLastIndexAsLength(regexp, true);
           const matchIndices: RegExpMatchInfo =
               RegExpPrototypeExecBodyWithoutResultFast(
-                  UnsafeCast<JSRegExp>(iteratingRegExp), iteratingString)
+                  regexp, iteratingString, lastIndex)
               otherwise IfNoMatch;
           match = ConstructNewResultFromMatchInfo(
-              iteratingRegExp, matchIndices, iteratingString);
+              regexp, matchIndices, iteratingString, lastIndex);
           isFastRegExp = true;
         } else {
           match = RegExpExec(iteratingRegExp, iteratingString);
@@ -196,7 +191,7 @@ namespace regexp {
         assert(HasGlobalFlag(flags));
         if (isFastRegExp) {
           // i. Let matchStr be ? ToString(? Get(match, "0")).
-          const match = UnsafeCast<FastJSRegExpResult>(match);
+          const match = UnsafeCast<JSRegExpResult>(match);
           const resultFixedArray = UnsafeCast<FixedArray>(match.elements);
           const matchStr = UnsafeCast<String>(resultFixedArray.objects[0]);
 
@@ -223,13 +218,12 @@ namespace regexp {
         assert(!isFastRegExp);
         // i. Let matchStr be ? ToString(? Get(match, "0")).
         const match = UnsafeCast<JSAny>(match);
-        const matchStr =
-            ToString_Inline(context, GetProperty(match, SmiConstant(0)));
+        const matchStr = ToString_Inline(GetProperty(match, SmiConstant(0)));
 
         if (matchStr == kEmptyString) {
           // 1. Let thisIndex be ? ToLength(? Get(R, "lastIndex")).
           const lastIndex: JSAny = SlowLoadLastIndex(iteratingRegExp);
-          const thisIndex: Number = ToLength_Inline(context, lastIndex);
+          const thisIndex: Number = ToLength_Inline(lastIndex);
 
           // 2. Let nextIndex be ! AdvanceStringIndex(S, thisIndex,
           // fullUnicode).
diff --git a/deps/v8/src/builtins/regexp-match.tq b/deps/v8/src/builtins/regexp-match.tq
index dbee8a616ad564..9b0255762c0f8a 100644
--- a/deps/v8/src/builtins/regexp-match.tq
+++ b/deps/v8/src/builtins/regexp-match.tq
@@ -6,8 +6,122 @@
 
 namespace regexp {
 
-  extern transitioning macro RegExpBuiltinsAssembler::RegExpPrototypeMatchBody(
-      implicit context: Context)(Object, String, constexpr bool): JSAny;
+  const kATOM: constexpr int31
+  generates 'JSRegExp::ATOM';
+  const kTagIndex: constexpr int31
+  generates 'JSRegExp::kTagIndex';
+  const kAtomPatternIndex: constexpr int31
+  generates 'JSRegExp::kAtomPatternIndex';
+
+  extern transitioning macro RegExpBuiltinsAssembler::FlagGetter(
+      implicit context: Context)(Object, constexpr Flag, constexpr bool): bool;
+
+  extern macro UnsafeLoadFixedArrayElement(RegExpMatchInfo, constexpr int31):
+      Object;
+
+  transitioning macro RegExpPrototypeMatchBody(implicit context: Context)(
+      regexp: JSReceiver, string: String, isFastPath: constexpr bool): JSAny {
+    if constexpr (isFastPath) {
+      assert(Is<FastJSRegExp>(regexp));
+    }
+
+    const isGlobal: bool = FlagGetter(regexp, Flag::kGlobal, isFastPath);
+
+    if (!isGlobal) {
+      return isFastPath ? RegExpPrototypeExecBodyFast(regexp, string) :
+                          RegExpExec(regexp, string);
+    }
+
+    assert(isGlobal);
+    const isUnicode: bool = FlagGetter(regexp, Flag::kUnicode, isFastPath);
+
+    StoreLastIndex(regexp, 0, isFastPath);
+
+    // Allocate an array to store the resulting match strings.
+
+    let array = growable_fixed_array::NewGrowableFixedArray();
+
+    // Check if the regexp is an ATOM type. If so, then keep the literal string
+    // to search for so that we can avoid calling substring in the loop below.
+    let atom: bool = false;
+    let searchString: String = EmptyStringConstant();
+    if constexpr (isFastPath) {
+      const maybeAtomRegexp = UnsafeCast<JSRegExp>(regexp);
+      const data = UnsafeCast<FixedArray>(maybeAtomRegexp.data);
+      if (UnsafeCast<Smi>(data.objects[kTagIndex]) == kATOM) {
+        searchString = UnsafeCast<String>(data.objects[kAtomPatternIndex]);
+        atom = true;
+      }
+    }
+
+    while (true) {
+      let match: String = EmptyStringConstant();
+      try {
+        if constexpr (isFastPath) {
+          // On the fast path, grab the matching string from the raw match index
+          // array.
+          const matchIndices: RegExpMatchInfo =
+              RegExpPrototypeExecBodyWithoutResultFast(
+                  UnsafeCast<JSRegExp>(regexp), string) otherwise IfDidNotMatch;
+          if (atom) {
+            match = searchString;
+          } else {
+            const matchFrom = UnsafeLoadFixedArrayElement(
+                matchIndices, kRegExpMatchInfoFirstCaptureIndex);
+            const matchTo = UnsafeLoadFixedArrayElement(
+                matchIndices, kRegExpMatchInfoFirstCaptureIndex + 1);
+            match = SubString(
+                string, UnsafeCast<Smi>(matchFrom), UnsafeCast<Smi>(matchTo));
+          }
+        } else {
+          assert(!isFastPath);
+          const resultTemp = RegExpExec(regexp, string);
+          if (resultTemp == Null) {
+            goto IfDidNotMatch;
+          }
+          match = ToString_Inline(GetProperty(resultTemp, SmiConstant(0)));
+        }
+        goto IfDidMatch;
+      }
+      label IfDidNotMatch {
+        return array.length == 0 ? Null : array.ToJSArray();
+      }
+      label IfDidMatch {
+        // Store the match, growing the fixed array if needed.
+
+        array.Push(match);
+
+        // Advance last index if the match is the empty string.
+        const matchLength: Smi = match.length_smi;
+        if (matchLength != 0) {
+          continue;
+        }
+        let lastIndex = LoadLastIndex(regexp, isFastPath);
+        if constexpr (isFastPath) {
+          assert(TaggedIsPositiveSmi(lastIndex));
+        } else {
+          lastIndex = ToLength_Inline(lastIndex);
+        }
+
+        const newLastIndex: Number = AdvanceStringIndex(
+            string, UnsafeCast<Number>(lastIndex), isUnicode, isFastPath);
+
+        if constexpr (isFastPath) {
+          // On the fast path, we can be certain that lastIndex can never be
+          // incremented to overflow the Smi range since the maximal string
+          // length is less than the maximal Smi value.
+          const kMaxStringLengthFitsSmi: constexpr bool =
+              kStringMaxLengthUintptr < kSmiMaxValue;
+          StaticAssert(kMaxStringLengthFitsSmi);
+          assert(TaggedIsPositiveSmi(newLastIndex));
+        }
+
+        StoreLastIndex(regexp, newLastIndex, isFastPath);
+      }
+    }
+
+    VerifiedUnreachable();
+  }
 
   transitioning macro FastRegExpPrototypeMatchBody(implicit context: Context)(
       receiver: FastJSRegExp, string: String): JSAny {
@@ -15,7 +129,7 @@ namespace regexp {
   }
 
   transitioning macro SlowRegExpPrototypeMatchBody(implicit context: Context)(
-      receiver: Object, string: String): JSAny {
+      receiver: JSReceiver, string: String): JSAny {
     return RegExpPrototypeMatchBody(receiver, string, false);
   }
 
@@ -30,11 +144,13 @@ namespace regexp {
   // ES#sec-regexp.prototype-@@match
   // RegExp.prototype [ @@match ] ( string )
   transitioning javascript builtin RegExpPrototypeMatch(
-      js-implicit context: Context, receiver: JSAny)(string: JSAny): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(string: JSAny): JSAny {
     ThrowIfNotJSReceiver(
-        receiver, kIncompatibleMethodReceiver, 'RegExp.prototype.@@match');
+        receiver, MessageTemplate::kIncompatibleMethodReceiver,
+        'RegExp.prototype.@@match');
     const receiver = UnsafeCast<JSReceiver>(receiver);
-    const string: String = ToString_Inline(context, string);
+    const string: String = ToString_Inline(string);
 
     // Strict: Reads global and unicode properties.
     // TODO(jgruber): Handle slow flag accesses on the fast path and make this
diff --git a/deps/v8/src/builtins/regexp-replace.tq b/deps/v8/src/builtins/regexp-replace.tq
index 1333ce97fb9f59..fc9d13cf3c6237 100644
--- a/deps/v8/src/builtins/regexp-replace.tq
+++ b/deps/v8/src/builtins/regexp-replace.tq
@@ -10,7 +10,7 @@ namespace regexp {
   SubString(implicit context: Context)(String, Smi, Smi): String;
 
   extern runtime RegExpExecMultiple(implicit context: Context)(
-      JSRegExp, String, RegExpMatchInfo, JSArray): Null | JSArray;
+      JSRegExp, String, RegExpMatchInfo, JSArray): Null|JSArray;
   extern transitioning runtime
   RegExpReplaceRT(Context, JSReceiver, String, Object): String;
   extern transitioning runtime
@@ -50,7 +50,7 @@ namespace regexp {
         case (elString: String): {
           const replacementObj: JSAny =
               Call(context, replaceFn, Undefined, elString, matchStart, string);
-          const replacement: String = ToString_Inline(context, replacementObj);
+          const replacement: String = ToString_Inline(replacementObj);
           matchesElements.objects[i] = replacement;
           matchStart += elString.length_smi;
         }
@@ -75,7 +75,7 @@ namespace regexp {
 
       // Overwrite the i'th element in the results with the string
       // we got back from the callback function.
-      matchesElements.objects[i] = ToString_Inline(context, replacementObj);
+      matchesElements.objects[i] = ToString_Inline(replacementObj);
     }
   }
 
@@ -84,12 +84,12 @@ namespace regexp {
       regexp: FastJSRegExp, string: String, replaceFn: Callable): String {
     regexp.lastIndex = 0;
 
-    const kInitialCapacity: Smi = 16;
+    const kInitialCapacity: intptr = 16;
     const kInitialLength: Smi = 0;
-    const result: Null | JSArray = RegExpExecMultiple(
+    const result: Null|JSArray = RegExpExecMultiple(
         regexp, string, GetRegExpLastMatchInfo(),
         AllocateJSArray(
-            PACKED_ELEMENTS, GetFastPackedElementsJSArrayMap(),
+            ElementsKind::PACKED_ELEMENTS, GetFastPackedElementsJSArrayMap(),
             kInitialCapacity, kInitialLength));
 
     regexp.lastIndex = 0;
@@ -121,7 +121,7 @@ namespace regexp {
   }
 
   transitioning macro RegExpReplaceFastString(implicit context: Context)(
-      regexp: FastJSRegExp, string: String, replaceString: String): String {
+      regexp: JSRegExp, string: String, replaceString: String): String {
     // The fast path is reached only if {receiver} is an unmodified JSRegExp
     // instance, {replace_value} is non-callable, and ToString({replace_value})
     // does not contain '$', i.e. we're doing a simple string replacement.
@@ -129,16 +129,17 @@ namespace regexp {
     let lastMatchEnd: Smi = 0;
     let unicode: bool = false;
     const replaceLength: Smi = replaceString.length_smi;
-    const global: bool = regexp.global;
+    const fastRegexp = UnsafeCast<FastJSRegExp>(regexp);
+    const global: bool = fastRegexp.global;
 
     if (global) {
-      unicode = regexp.unicode;
-      regexp.lastIndex = 0;
+      unicode = fastRegexp.unicode;
+      fastRegexp.lastIndex = 0;
     }
 
     while (true) {
       const match: RegExpMatchInfo =
-          regexp::RegExpPrototypeExecBodyWithoutResultFast(regexp, string)
+          RegExpPrototypeExecBodyWithoutResultFast(regexp, string)
           otherwise break;
       const matchStart: Smi = match.GetStartOfCapture(0);
       const matchEnd: Smi = match.GetEndOfCapture(0);
@@ -155,8 +156,19 @@ namespace regexp {
 
       // If match is the empty string, we have to increment lastIndex.
       if (matchEnd == matchStart) {
-        regexp.lastIndex =
-            AdvanceStringIndexFast(string, regexp.lastIndex, unicode);
+        typeswitch (regexp) {
+          case (fastRegexp: FastJSRegExp): {
+            fastRegexp.lastIndex =
+                AdvanceStringIndexFast(string, fastRegexp.lastIndex, unicode);
+          }
+          case (Object): {
+            const lastIndex: JSAny = SlowLoadLastIndex(regexp);
+            const thisIndex: Number = ToLength_Inline(lastIndex);
+            const nextIndex: Number =
+                AdvanceStringIndexSlow(string, thisIndex, unicode);
+            SlowStoreLastIndex(regexp, nextIndex);
+          }
+        }
       }
     }
 
@@ -178,7 +190,7 @@ namespace regexp {
       }
       case (JSAny): {
         const stableRegexp: JSRegExp = regexp;
-        const replaceString: String = ToString_Inline(context, replaceValue);
+        const replaceString: String = ToString_Inline(replaceValue);
 
         try {
           // ToString(replaceValue) could potentially change the shape of the
@@ -199,8 +211,12 @@ namespace regexp {
     }
   }
 
+  const kRegExpReplaceCalledOnSlowRegExp: constexpr int31
+  generates 'v8::Isolate::kRegExpReplaceCalledOnSlowRegExp';
+
   transitioning javascript builtin RegExpPrototypeReplace(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     const methodName: constexpr string = 'RegExp.prototype.@@replace';
 
     // RegExpPrototypeReplace is a bit of a beast - a summary of dispatch logic:
@@ -227,10 +243,11 @@ namespace regexp {
     // Let rx be the this value.
     // If Type(rx) is not Object, throw a TypeError exception.
     const rx = Cast<JSReceiver>(receiver)
-        otherwise ThrowTypeError(kIncompatibleMethodReceiver, methodName);
+        otherwise ThrowTypeError(
+        MessageTemplate::kIncompatibleMethodReceiver, methodName);
 
     // Let S be ? ToString(string).
-    const s = ToString_Inline(context, string);
+    const s = ToString_Inline(string);
 
     // Fast-path checks: 1. Is the {receiver} an unmodified JSRegExp instance?
     try {
@@ -238,6 +255,8 @@ namespace regexp {
       return RegExpReplace(fastRx, s, replaceValue);
     }
     label Runtime deferred {
+      IncrementUseCounter(
+          context, SmiConstant(kRegExpReplaceCalledOnSlowRegExp));
       return RegExpReplaceRT(context, rx, s, replaceValue);
     }
   }
diff --git a/deps/v8/src/builtins/regexp-search.tq b/deps/v8/src/builtins/regexp-search.tq
index 3c4e57d734e09b..14fb9f9b03c202 100644
--- a/deps/v8/src/builtins/regexp-search.tq
+++ b/deps/v8/src/builtins/regexp-search.tq
@@ -20,7 +20,8 @@ namespace regexp {
     // Call exec.
     try {
       const matchIndices: RegExpMatchInfo =
-          RegExpPrototypeExecBodyWithoutResultFast(regexp, string)
+          RegExpPrototypeExecBodyWithoutResultFast(
+              UnsafeCast<JSRegExp>(regexp), string)
           otherwise DidNotMatch;
 
       // Successful match.
@@ -38,13 +39,13 @@ namespace regexp {
     }
   }
 
-  extern macro RegExpBuiltinsAssembler::BranchIfFastRegExpResult(
+  extern macro RegExpBuiltinsAssembler::BranchIfRegExpResult(
       implicit context: Context)(Object): never labels IsUnmodified,
       IsModified;
 
   macro
-  IsFastRegExpResult(implicit context: Context)(execResult: HeapObject): bool {
-    BranchIfFastRegExpResult(execResult) otherwise return true, return false;
+  IsRegExpResult(implicit context: Context)(execResult: HeapObject): bool {
+    BranchIfRegExpResult(execResult) otherwise return true, return false;
   }
 
   transitioning macro RegExpPrototypeSearchBodySlow(implicit context: Context)(
@@ -73,7 +74,7 @@ namespace regexp {
     }
 
     // Return the index of the match.
-    const fastExecResult = Cast<FastJSRegExpResult>(execResult)
+    const fastExecResult = Cast<JSRegExpResult>(execResult)
         otherwise return GetProperty(execResult, 'index');
     return fastExecResult.index;
   }
@@ -89,11 +90,13 @@ namespace regexp {
   // ES#sec-regexp.prototype-@@search
   // RegExp.prototype [ @@search ] ( string )
   transitioning javascript builtin RegExpPrototypeSearch(
-      js-implicit context: Context, receiver: JSAny)(string: JSAny): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(string: JSAny): JSAny {
     ThrowIfNotJSReceiver(
-        receiver, kIncompatibleMethodReceiver, 'RegExp.prototype.@@search');
+        receiver, MessageTemplate::kIncompatibleMethodReceiver,
+        'RegExp.prototype.@@search');
     const receiver = UnsafeCast<JSReceiver>(receiver);
-    const string: String = ToString_Inline(context, string);
+    const string: String = ToString_Inline(string);
 
     if (IsFastRegExpPermissive(receiver)) {
       // TODO(pwong): Could be optimized to remove the overhead of calling the
diff --git a/deps/v8/src/builtins/regexp-source.tq b/deps/v8/src/builtins/regexp-source.tq
index 266c9e7472f2fa..009e5181dc2190 100644
--- a/deps/v8/src/builtins/regexp-source.tq
+++ b/deps/v8/src/builtins/regexp-source.tq
@@ -9,7 +9,7 @@ namespace regexp {
   // ES6 21.2.5.10.
   // ES #sec-get-regexp.prototype.source
   transitioning javascript builtin RegExpPrototypeSourceGetter(
-      js-implicit context: Context, receiver: JSAny)(): JSAny {
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
     typeswitch (receiver) {
       case (receiver: JSRegExp): {
         return receiver.source;
@@ -19,7 +19,7 @@ namespace regexp {
     }
     if (!IsReceiverInitialRegExpPrototype(receiver)) {
       const methodName: constexpr string = 'RegExp.prototype.source';
-      ThrowTypeError(kRegExpNonRegExp, methodName);
+      ThrowTypeError(MessageTemplate::kRegExpNonRegExp, methodName);
     }
     IncrementUseCounter(context, SmiConstant(kRegExpPrototypeSourceGetter));
     return '(?:)';
diff --git a/deps/v8/src/builtins/regexp-split.tq b/deps/v8/src/builtins/regexp-split.tq
index 8a9a30a7e90f3d..e4092803eeae9d 100644
--- a/deps/v8/src/builtins/regexp-split.tq
+++ b/deps/v8/src/builtins/regexp-split.tq
@@ -43,7 +43,7 @@ namespace regexp {
     // the given regexp is non-sticky to avoid invalid results. See
     // crbug.com/v8/6706.
 
-    if (FastFlagGetter(regexp, kSticky)) {
+    if (FastFlagGetter(regexp, Flag::kSticky)) {
       return runtime::RegExpSplit(regexp, string, sanitizedLimit);
     }
 
@@ -54,11 +54,13 @@ namespace regexp {
   // ES#sec-regexp.prototype-@@split
   // RegExp.prototype [ @@split ] ( string, limit )
   transitioning javascript builtin RegExpPrototypeSplit(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     ThrowIfNotJSReceiver(
-        receiver, kIncompatibleMethodReceiver, 'RegExp.prototype.@@split');
+        receiver, MessageTemplate::kIncompatibleMethodReceiver,
+        'RegExp.prototype.@@split');
     const receiver = UnsafeCast<JSReceiver>(receiver);
-    const string: String = ToString_Inline(context, arguments[0]);
+    const string: String = ToString_Inline(arguments[0]);
     const limit = arguments[1];
 
     // Strict: Reads the flags property.
diff --git a/deps/v8/src/builtins/regexp-test.tq b/deps/v8/src/builtins/regexp-test.tq
index f2ebb7c2597273..cd418239757185 100644
--- a/deps/v8/src/builtins/regexp-test.tq
+++ b/deps/v8/src/builtins/regexp-test.tq
@@ -9,11 +9,13 @@ namespace regexp {
   // ES#sec-regexp.prototype.test
   // RegExp.prototype.test ( S )
   transitioning javascript builtin RegExpPrototypeTest(
-      js-implicit context: Context, receiver: JSAny)(string: JSAny): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(string: JSAny): JSAny {
     const methodName: constexpr string = 'RegExp.prototype.test';
     const receiver = Cast<JSReceiver>(receiver)
-        otherwise ThrowTypeError(kIncompatibleMethodReceiver, methodName);
-    const str: String = ToString_Inline(context, string);
+        otherwise ThrowTypeError(
+        MessageTemplate::kIncompatibleMethodReceiver, methodName);
+    const str: String = ToString_Inline(string);
     if (IsFastRegExpPermissive(receiver)) {
       RegExpPrototypeExecBodyWithoutResultFast(
           UnsafeCast<JSRegExp>(receiver), str)
@@ -24,12 +26,8 @@ namespace regexp {
     return SelectBooleanConstant(matchIndices != Null);
   }
 
-  extern macro RegExpBuiltinsAssembler::IsFastRegExpWithOriginalExec(
-      implicit context: Context)(JSRegExp): bool;
-
   transitioning builtin RegExpPrototypeTestFast(implicit context: Context)(
       receiver: JSRegExp, string: String): Object {
-    assert(IsFastRegExpWithOriginalExec(receiver));
     RegExpPrototypeExecBodyWithoutResultFast(receiver, string)
         otherwise return False;
     return True;
diff --git a/deps/v8/src/builtins/regexp.tq b/deps/v8/src/builtins/regexp.tq
index e48e7c584deabd..a48dce3863bacb 100644
--- a/deps/v8/src/builtins/regexp.tq
+++ b/deps/v8/src/builtins/regexp.tq
@@ -22,9 +22,6 @@ namespace regexp {
     BranchIfFastRegExp_Permissive(o) otherwise return true, return false;
   }
 
-  const kInvalidRegExpExecResult: constexpr MessageTemplate
-  generates 'MessageTemplate::kInvalidRegExpExecResult';
-
   // ES#sec-regexpexec Runtime Semantics: RegExpExec ( R, S )
   @export
   transitioning macro RegExpExec(implicit context: Context)(
@@ -39,39 +36,160 @@ namespace regexp {
       case (execCallable: Callable): {
         const result = Call(context, execCallable, receiver, string);
         if (result != Null) {
-          ThrowIfNotJSReceiver(result, kInvalidRegExpExecResult, '');
+          ThrowIfNotJSReceiver(
+              result, MessageTemplate::kInvalidRegExpExecResult, '');
         }
         return result;
       }
       case (Object): {
         const regexp = Cast<JSRegExp>(receiver) otherwise ThrowTypeError(
-            kIncompatibleMethodReceiver, 'RegExp.prototype.exec', receiver);
+            MessageTemplate::kIncompatibleMethodReceiver,
+            'RegExp.prototype.exec', receiver);
         return RegExpPrototypeExecSlow(regexp, string);
       }
     }
   }
 
-  extern macro
-  RegExpBuiltinsAssembler::RegExpPrototypeExecBodyWithoutResultFast(
-      implicit context: Context)(JSRegExp, String):
-      RegExpMatchInfo labels IfDidNotMatch;
-
-  extern macro RegExpBuiltinsAssembler::IsReceiverInitialRegExpPrototype(
-      implicit context: Context)(Object): bool;
-
-  type Flag constexpr 'JSRegExp::Flag';
-  const kGlobal: constexpr Flag
-  generates 'JSRegExp::kGlobal';
-  const kIgnoreCase: constexpr Flag
-  generates 'JSRegExp::kIgnoreCase';
-  const kMultiline: constexpr Flag
-  generates 'JSRegExp::kMultiline';
-  const kDotAll: constexpr Flag
-  generates 'JSRegExp::kDotAll';
-  const kSticky: constexpr Flag
-  generates 'JSRegExp::kSticky';
-  const kUnicode: constexpr Flag
-  generates 'JSRegExp::kUnicode';
+  extern macro RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
+      implicit context: Context)(JSRegExp, RegExpMatchInfo, String, Number):
+      JSRegExpResult;
+
+  const kGlobalOrSticky: constexpr int31
+  generates 'JSRegExp::kGlobal | JSRegExp::kSticky';
+
+  extern macro RegExpBuiltinsAssembler::RegExpExecInternal(
+      implicit context: Context)(JSRegExp, String, Number, RegExpMatchInfo):
+      HeapObject;
+
+  // ES#sec-regexp.prototype.exec
+  // RegExp.prototype.exec ( string )
+  // Implements the core of RegExp.prototype.exec but without actually
+  // constructing the JSRegExpResult. Returns a fixed array containing match
+  // indices as returned by RegExpExecStub on successful match, and jumps to
+  // IfDidNotMatch otherwise.
+  transitioning macro RegExpPrototypeExecBodyWithoutResult(implicit context:
+                                                               Context)(
+      regexp: JSRegExp, string: String, regexpLastIndex: Number,
+      isFastPath: constexpr bool): RegExpMatchInfo labels IfDidNotMatch {
+    if (isFastPath) {
+      assert(HasInitialRegExpMap(regexp));
+    } else {
+      IncrementUseCounter(context, SmiConstant(kRegExpExecCalledOnSlowRegExp));
+    }
+
+    let lastIndex = regexpLastIndex;
+
+    // Check whether the regexp is global or sticky, which determines whether we
+    // update last index later on.
+    const flags = UnsafeCast<Smi>(regexp.flags);
+    const isGlobalOrSticky: intptr =
+        SmiUntag(flags) & IntPtrConstant(kGlobalOrSticky);
+    const shouldUpdateLastIndex: bool = isGlobalOrSticky != 0;
+
+    // Grab and possibly update last index.
+    if (shouldUpdateLastIndex) {
+      if (!TaggedIsSmi(lastIndex) || (lastIndex > string.length_smi)) {
+        StoreLastIndex(regexp, SmiConstant(0), isFastPath);
+        goto IfDidNotMatch;
+      }
+    } else {
+      lastIndex = SmiConstant(0);
+    }
+
+    const lastMatchInfo: RegExpMatchInfo = GetRegExpLastMatchInfo();
+
+    const matchIndices =
+        RegExpExecInternal(regexp, string, lastIndex, lastMatchInfo);
+
+    // {match_indices} is either null or the RegExpMatchInfo array.
+    // Return early if exec failed, possibly updating last index.
+    if (matchIndices != Null) {
+      const matchIndicesRegExpMatchInfo =
+          UnsafeCast<RegExpMatchInfo>(matchIndices);
+      if (shouldUpdateLastIndex) {
+        // Update the new last index from {match_indices}.
+        const newLastIndex: Smi =
+            matchIndicesRegExpMatchInfo.GetEndOfCapture(0);
+        StoreLastIndex(regexp, newLastIndex, isFastPath);
+      }
+      return matchIndicesRegExpMatchInfo;
+    }
+    if (shouldUpdateLastIndex) {
+      StoreLastIndex(regexp, SmiConstant(0), isFastPath);
+    }
+    goto IfDidNotMatch;
+  }
+
+  @export
+  transitioning macro RegExpPrototypeExecBodyWithoutResultFast(
+      implicit context: Context)(regexp: JSRegExp, string: String):
+      RegExpMatchInfo labels IfDidNotMatch {
+    const lastIndex = LoadLastIndexAsLength(regexp, true);
+    return RegExpPrototypeExecBodyWithoutResult(regexp, string, lastIndex, true)
+        otherwise IfDidNotMatch;
+  }
+
+  transitioning macro RegExpPrototypeExecBodyWithoutResultFast(
+      implicit context:
+          Context)(regexp: JSRegExp, string: String, lastIndex: Number):
+      RegExpMatchInfo labels IfDidNotMatch {
+    return RegExpPrototypeExecBodyWithoutResult(regexp, string, lastIndex, true)
+        otherwise IfDidNotMatch;
+  }
+
+  // ES#sec-regexp.prototype.exec
+  // RegExp.prototype.exec ( string )
+  transitioning macro RegExpPrototypeExecBody(implicit context: Context)(
+      receiver: JSReceiver, string: String, isFastPath: constexpr bool): JSAny {
+    let regexp: JSRegExp;
+    if constexpr (isFastPath) {
+      regexp = UnsafeCast<JSRegExp>(receiver);
+    } else {
+      regexp = Cast<JSRegExp>(receiver) otherwise ThrowTypeError(
+          MessageTemplate::kIncompatibleMethodReceiver, 'RegExp.prototype.exec',
+          receiver);
+    }
+    const lastIndex = LoadLastIndexAsLength(regexp, isFastPath);
+    const matchIndices: RegExpMatchInfo = RegExpPrototypeExecBodyWithoutResult(
+        regexp, string, lastIndex, isFastPath) otherwise return Null;
+    return ConstructNewResultFromMatchInfo(
+        regexp, matchIndices, string, lastIndex);
+  }
+
+  macro LoadRegExpFunction(implicit context: Context)(
+      nativeContext: NativeContext): JSFunction {
+    return UnsafeCast<JSFunction>(
+        nativeContext[NativeContextSlot::REGEXP_FUNCTION_INDEX]);
+  }
+
+  // Note this doesn't guarantee const-ness of object properties, just
+  // unchanged object layout.
+  macro HasInitialRegExpMap(implicit context: Context)(o: HeapObject): bool {
+    const nativeContext = LoadNativeContext(context);
+    const function = LoadRegExpFunction(nativeContext);
+    const initialMap = UnsafeCast<Map>(function.prototype_or_initial_map);
+    return initialMap == o.map;
+  }
+
+  macro IsReceiverInitialRegExpPrototype(implicit context:
+                                             Context)(receiver: Object): bool {
+    const nativeContext = LoadNativeContext(context);
+    const regexpFun = LoadRegExpFunction(nativeContext);
+    const initialMap = UnsafeCast<Map>(regexpFun.prototype_or_initial_map);
+    const initialPrototype: HeapObject = initialMap.prototype;
+    return TaggedEqual(receiver, initialPrototype);
+  }
+
+  extern enum Flag constexpr 'JSRegExp::Flag' {
+    kNone,
+    kGlobal,
+    kIgnoreCase,
+    kMultiline,
+    kSticky,
+    kUnicode,
+    kDotAll,
+    kInvalid
+  }
 
   const kRegExpPrototypeOldFlagGetter: constexpr int31
   generates 'v8::Isolate::kRegExpPrototypeOldFlagGetter';
@@ -82,8 +200,6 @@ namespace regexp {
 
   extern macro RegExpBuiltinsAssembler::FastFlagGetter(
       JSRegExp, constexpr Flag): bool;
-  const kRegExpNonRegExp: constexpr MessageTemplate
-  generates 'MessageTemplate::kRegExpNonRegExp';
   extern runtime IncrementUseCounter(Context, Smi): void;
 
   macro FlagGetter(implicit context: Context)(
@@ -97,7 +213,7 @@ namespace regexp {
       }
     }
     if (!IsReceiverInitialRegExpPrototype(receiver)) {
-      ThrowTypeError(kRegExpNonRegExp, methodName);
+      ThrowTypeError(MessageTemplate::kRegExpNonRegExp, methodName);
     }
     if constexpr (counter != -1) {
       IncrementUseCounter(context, SmiConstant(counter));
@@ -108,52 +224,53 @@ namespace regexp {
   // ES6 21.2.5.4.
   // ES #sec-get-regexp.prototype.global
   transitioning javascript builtin RegExpPrototypeGlobalGetter(
-      js-implicit context: Context, receiver: JSAny)(): JSAny {
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
     return FlagGetter(
-        receiver, kGlobal, kRegExpPrototypeOldFlagGetter,
+        receiver, Flag::kGlobal, kRegExpPrototypeOldFlagGetter,
         'RegExp.prototype.global');
   }
 
   // ES6 21.2.5.5.
   // ES #sec-get-regexp.prototype.ignorecase
   transitioning javascript builtin RegExpPrototypeIgnoreCaseGetter(
-      js-implicit context: Context, receiver: JSAny)(): JSAny {
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
     return FlagGetter(
-        receiver, kIgnoreCase, kRegExpPrototypeOldFlagGetter,
+        receiver, Flag::kIgnoreCase, kRegExpPrototypeOldFlagGetter,
         'RegExp.prototype.ignoreCase');
   }
 
   // ES6 21.2.5.7.
   // ES #sec-get-regexp.prototype.multiline
   transitioning javascript builtin RegExpPrototypeMultilineGetter(
-      js-implicit context: Context, receiver: JSAny)(): JSAny {
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
     return FlagGetter(
-        receiver, kMultiline, kRegExpPrototypeOldFlagGetter,
+        receiver, Flag::kMultiline, kRegExpPrototypeOldFlagGetter,
         'RegExp.prototype.multiline');
   }
 
   // ES #sec-get-regexp.prototype.dotAll
   transitioning javascript builtin RegExpPrototypeDotAllGetter(
-      js-implicit context: Context, receiver: JSAny)(): JSAny {
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
     const kNoCounter: constexpr int31 = -1;
-    return FlagGetter(receiver, kDotAll, kNoCounter, 'RegExp.prototype.dotAll');
+    return FlagGetter(
+        receiver, Flag::kDotAll, kNoCounter, 'RegExp.prototype.dotAll');
   }
 
   // ES6 21.2.5.12.
   // ES #sec-get-regexp.prototype.sticky
   transitioning javascript builtin RegExpPrototypeStickyGetter(
-      js-implicit context: Context, receiver: JSAny)(): JSAny {
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
     return FlagGetter(
-        receiver, kSticky, kRegExpPrototypeStickyGetter,
+        receiver, Flag::kSticky, kRegExpPrototypeStickyGetter,
         'RegExp.prototype.sticky');
   }
 
   // ES6 21.2.5.15.
   // ES #sec-get-regexp.prototype.unicode
   transitioning javascript builtin RegExpPrototypeUnicodeGetter(
-      js-implicit context: Context, receiver: JSAny)(): JSAny {
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
     return FlagGetter(
-        receiver, kUnicode, kRegExpPrototypeUnicodeGetter,
+        receiver, Flag::kUnicode, kRegExpPrototypeUnicodeGetter,
         'RegExp.prototype.unicode');
   }
 
@@ -171,14 +288,12 @@ namespace regexp {
     return FlagsGetter(receiver, false);
   }
 
-  const kRegExpNonObject: constexpr MessageTemplate
-  generates 'MessageTemplate::kRegExpNonObject';
-
   // ES #sec-get-regexp.prototype.flags
   // TFJ(RegExpPrototypeFlagsGetter, 0, kReceiver) \
   transitioning javascript builtin RegExpPrototypeFlagsGetter(
-      js-implicit context: Context, receiver: JSAny)(): String {
-    ThrowIfNotJSReceiver(receiver, kRegExpNonObject, 'RegExp.prototype.flags');
+      js-implicit context: NativeContext, receiver: JSAny)(): String {
+    ThrowIfNotJSReceiver(
+        receiver, MessageTemplate::kRegExpNonObject, 'RegExp.prototype.flags');
 
     // The check is strict because the following code relies on individual flag
     // getters on the regexp prototype (e.g.: global, sticky, ...). We don't
@@ -196,9 +311,48 @@ namespace regexp {
   extern macro RegExpBuiltinsAssembler::FastLoadLastIndex(JSRegExp): Smi;
   extern macro RegExpBuiltinsAssembler::FastStoreLastIndex(JSRegExp, Smi): void;
 
+  @export
+  transitioning macro LoadLastIndex(implicit context: Context)(
+      regexp: JSAny, isFastPath: constexpr bool): JSAny {
+    return isFastPath ? FastLoadLastIndex(UnsafeCast<JSRegExp>(regexp)) :
+                        SlowLoadLastIndex(regexp);
+  }
+
+  @export
+  transitioning macro LoadLastIndexAsLength(implicit context: Context)(
+      regexp: JSRegExp, isFastPath: constexpr bool): Number {
+    const lastIndex = LoadLastIndex(regexp, isFastPath);
+    if (isFastPath) {
+      // ToLength on a positive smi is a nop and can be skipped.
+      return UnsafeCast<PositiveSmi>(lastIndex);
+    } else {
+      // Omit ToLength if last_index is a non-negative smi.
+      typeswitch (lastIndex) {
+        case (i: PositiveSmi): {
+          return i;
+        }
+        case (o: JSAny): {
+          return ToLength_Inline(o);
+        }
+      }
+    }
+  }
+
+  @export
+  transitioning macro StoreLastIndex(implicit context: Context)(
+      regexp: JSAny, value: Number, isFastPath: constexpr bool): void {
+    if (isFastPath) {
+      FastStoreLastIndex(UnsafeCast<JSRegExp>(regexp), UnsafeCast<Smi>(value));
+    } else {
+      SlowStoreLastIndex(regexp, value);
+    }
+  }
+
   extern builtin
   StringIndexOf(implicit context: Context)(String, String, Smi): Smi;
 
+  extern macro RegExpBuiltinsAssembler::AdvanceStringIndex(
+      String, Number, bool, constexpr bool): Number;
   extern macro
   RegExpBuiltinsAssembler::AdvanceStringIndexFast(String, Smi, bool): Smi;
   extern macro
@@ -212,6 +366,8 @@ namespace regexp {
   generates 'v8::Isolate::kRegExpMatchIsFalseishOnJSRegExp';
   const kRegExpPrototypeSourceGetter: constexpr UseCounterFeature
   generates 'v8::Isolate::kRegExpPrototypeSourceGetter';
+  const kRegExpExecCalledOnSlowRegExp: constexpr UseCounterFeature
+  generates 'v8::Isolate::kRegExpExecCalledOnSlowRegExp';
 
   // ES#sec-isregexp IsRegExp ( argument )
   @export
@@ -242,4 +398,25 @@ namespace regexp {
     }
     return false;
   }
+
+  extern runtime RegExpInitializeAndCompile(Context, JSRegExp, String, String):
+      JSAny;
+
+  @export
+  transitioning macro RegExpCreate(implicit context: Context)(
+      nativeContext: NativeContext, maybeString: JSAny, flags: String): JSAny {
+    const regexpFun = LoadRegExpFunction(nativeContext);
+    const initialMap = UnsafeCast<Map>(regexpFun.prototype_or_initial_map);
+    return RegExpCreate(initialMap, maybeString, flags);
+  }
+
+  @export
+  transitioning macro RegExpCreate(implicit context: Context)(
+      initialMap: Map, maybeString: JSAny, flags: String): JSAny {
+    const pattern: String =
+        maybeString == Undefined ? kEmptyString : ToString_Inline(maybeString);
+    const regexp =
+        UnsafeCast<JSRegExp>(AllocateFastOrSlowJSObjectFromMap(initialMap));
+    return RegExpInitializeAndCompile(context, regexp, pattern, flags);
+  }
 }
diff --git a/deps/v8/src/builtins/s390/builtins-s390.cc b/deps/v8/src/builtins/s390/builtins-s390.cc
index 7fc6b91ba37783..b9e56659f793eb 100644
--- a/deps/v8/src/builtins/s390/builtins-s390.cc
+++ b/deps/v8/src/builtins/s390/builtins-s390.cc
@@ -34,29 +34,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address) {
           RelocInfo::CODE_TARGET);
 }
 
-void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r2     : number of arguments
-  //  -- lr     : return address
-  //  -- sp[...]: constructor arguments
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin InternalArray functions should be maps.
-    __ LoadP(r4, FieldMemOperand(r3, JSFunction::kPrototypeOrInitialMapOffset));
-    __ TestIfSmi(r4);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForInternalArrayFunction,
-              cr0);
-    __ CompareObjectType(r4, r5, r6, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForInternalArrayFunction);
-  }
-
-  // Run the native code for the InternalArray function called as a normal
-  // function.
-  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
-          RelocInfo::CODE_TARGET);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -162,8 +139,7 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     // r3: constructor function
     // r5: new target
 
-    ParameterCount actual(r2);
-    __ InvokeFunction(r3, r5, actual, CALL_FUNCTION);
+    __ InvokeFunctionWithNewTarget(r3, r5, r2, CALL_FUNCTION);
 
     // Restore context from the frame.
     __ LoadP(cp, MemOperand(fp, ConstructFrameConstants::kContextOffset));
@@ -316,8 +292,7 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
     __ bind(&no_args);
 
     // Call the function.
-    ParameterCount actual(r2);
-    __ InvokeFunction(r3, r5, actual, CALL_FUNCTION);
+    __ InvokeFunctionWithNewTarget(r3, r5, r2, CALL_FUNCTION);
 
     // ----------- S t a t e -------------
     //  --                 r0: constructor result
@@ -1445,7 +1420,7 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   __ LoadP(r4, MemOperand(r4));
 
   __ bind(&trampoline_loaded);
-  __ AddP(r14, r4, Operand(interpreter_entry_return_pc_offset->value()));
+  __ AddP(r14, r4, Operand(interpreter_entry_return_pc_offset.value()));
 
   // Initialize the dispatch table register.
   __ Move(
@@ -1517,71 +1492,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r2 : argument count (preserved for callee)
-  //  -- r3 : new target (preserved for callee)
-  //  -- r5 : target function (preserved for callee)
-  // -----------------------------------
-  Label failed;
-  {
-    FrameScope scope(masm, StackFrame::INTERNAL);
-    // Preserve argument count for later compare.
-    __ Move(r6, r2);
-    // Push a copy of the target function and the new target.
-    __ SmiTag(r2);
-    // Push another copy as a parameter to the runtime call.
-    __ Push(r2, r3, r5, r3);
-
-    // Copy arguments from caller (stdlib, foreign, heap).
-    Label args_done;
-    for (int j = 0; j < 4; ++j) {
-      Label over;
-      if (j < 3) {
-        __ CmpP(r6, Operand(j));
-        __ b(ne, &over);
-      }
-      for (int i = j - 1; i >= 0; --i) {
-        __ LoadP(r6, MemOperand(fp, StandardFrameConstants::kCallerSPOffset +
-                                        i * kSystemPointerSize));
-        __ push(r6);
-      }
-      for (int i = 0; i < 3 - j; ++i) {
-        __ PushRoot(RootIndex::kUndefinedValue);
-      }
-      if (j < 3) {
-        __ jmp(&args_done);
-        __ bind(&over);
-      }
-    }
-    __ bind(&args_done);
-
-    // Call runtime, on success unwind frame, and parent frame.
-    __ CallRuntime(Runtime::kInstantiateAsmJs, 4);
-    // A smi 0 is returned on failure, an object on success.
-    __ JumpIfSmi(r2, &failed);
-
-    __ Drop(2);
-    __ pop(r6);
-    __ SmiUntag(r6);
-    scope.GenerateLeaveFrame();
-
-    __ AddP(r6, r6, Operand(1));
-    __ Drop(r6);
-    __ Ret();
-
-    __ bind(&failed);
-    // Restore target function and new target.
-    __ Pop(r2, r3, r5);
-    __ SmiUntag(r2);
-  }
-  // On failure, tail call back to regular js by re-calling the function
-  // which has be reset to the compile lazy builtin.
-  static_assert(kJavaScriptCallCodeStartRegister == r4, "ABI mismatch");
-  __ LoadP(r4, FieldMemOperand(r3, JSFunction::kCodeOffset));
-  __ JumpCodeObject(r4);
-}
-
 namespace {
 void Generate_ContinueToBuiltinHelper(MacroAssembler* masm,
                                       bool java_script_builtin,
@@ -2022,7 +1932,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
     __ JumpIfSmi(r5, &new_target_not_constructor);
     __ LoadP(scratch, FieldMemOperand(r5, HeapObject::kMapOffset));
     __ LoadlB(scratch, FieldMemOperand(scratch, Map::kBitFieldOffset));
-    __ tmll(scratch, Operand(Map::IsConstructorBit::kShift));
+    __ tmll(scratch, Operand(Map::Bits1::IsConstructorBit::kShift));
     __ bne(&new_target_constructor);
     __ bind(&new_target_not_constructor);
     {
@@ -2043,7 +1953,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
           Operand(StackFrame::TypeToMarker(StackFrame::ARGUMENTS_ADAPTOR)));
   __ beq(&arguments_adaptor);
   {
-    __ LoadP(r7, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+    __ LoadP(r7, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
     __ LoadP(r7, FieldMemOperand(r7, JSFunction::kSharedFunctionInfoOffset));
     __ LoadLogicalHalfWordP(
         r7,
@@ -2183,9 +2093,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
 
   __ LoadLogicalHalfWordP(
       r4, FieldMemOperand(r4, SharedFunctionInfo::kFormalParameterCountOffset));
-  ParameterCount actual(r2);
-  ParameterCount expected(r4);
-  __ InvokeFunctionCode(r3, no_reg, expected, actual, JUMP_FUNCTION);
+  __ InvokeFunctionCode(r3, no_reg, r4, r2, JUMP_FUNCTION);
 
   // The function is a "classConstructor", need to raise an exception.
   __ bind(&class_constructor);
@@ -2323,7 +2231,7 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
 
   // Check if target has a [[Call]] internal method.
   __ LoadlB(r6, FieldMemOperand(r6, Map::kBitFieldOffset));
-  __ TestBit(r6, Map::IsCallableBit::kShift);
+  __ TestBit(r6, Map::Bits1::IsCallableBit::kShift);
   __ beq(&non_callable);
 
   // Check if target is a proxy and call CallProxy external builtin
@@ -2423,7 +2331,7 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   // Check if target has a [[Construct]] internal method.
   __ LoadP(r6, FieldMemOperand(r3, HeapObject::kMapOffset));
   __ LoadlB(r4, FieldMemOperand(r6, Map::kBitFieldOffset));
-  __ TestBit(r4, Map::IsConstructorBit::kShift);
+  __ TestBit(r4, Map::Bits1::IsConstructorBit::kShift);
   __ beq(&non_constructor);
 
   // Dispatch based on instance type.
@@ -2653,11 +2561,11 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
     // Save all parameter registers (see wasm-linkage.cc). They might be
     // overwritten in the runtime call below. We don't have any callee-saved
     // registers in wasm, so no need to store anything else.
-    constexpr RegList gp_regs = Register::ListOf<r2, r3, r4, r5, r6>();
+    constexpr RegList gp_regs = Register::ListOf(r2, r3, r4, r5, r6);
 #if V8_TARGET_ARCH_S390X
-    constexpr RegList fp_regs = DoubleRegister::ListOf<d0, d2, d4, d6>();
+    constexpr RegList fp_regs = DoubleRegister::ListOf(d0, d2, d4, d6);
 #else
-    constexpr RegList fp_regs = DoubleRegister::ListOf<d0, d2>();
+    constexpr RegList fp_regs = DoubleRegister::ListOf(d0, d2);
 #endif
     __ MultiPush(gp_regs);
     __ MultiPushDoubles(fp_regs);
@@ -2665,16 +2573,10 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
     // Pass instance and function index as explicit arguments to the runtime
     // function.
     __ Push(kWasmInstanceRegister, r7);
-    // Load the correct CEntry builtin from the instance object.
-    __ LoadP(r4, FieldMemOperand(kWasmInstanceRegister,
-                                 WasmInstanceObject::kIsolateRootOffset));
-    auto centry_id =
-        Builtins::kCEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit;
-    __ LoadP(r4, MemOperand(r4, IsolateData::builtin_slot_offset(centry_id)));
     // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ LoadSmiLiteral(cp, Smi::zero());
-    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, r4);
+    __ CallRuntime(Runtime::kWasmCompileLazy, 2);
     // The entrypoint address is the return value.
     __ LoadRR(ip, r2);
 
@@ -2966,42 +2868,6 @@ void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
   __ Ret();
 }
 
-void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r2 : argc
-  //  -- r3 : constructor
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ LoadP(r5, FieldMemOperand(r3, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ TestIfSmi(r5);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, cr0);
-    __ CompareObjectType(r5, r5, r6, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
-
-    // Figure out the right elements kind
-    __ LoadP(r5, FieldMemOperand(r3, JSFunction::kPrototypeOrInitialMapOffset));
-    // Load the map's "bit field 2" into |result|.
-    __ LoadlB(r5, FieldMemOperand(r5, Map::kBitField2Offset));
-    // Retrieve elements_kind from bit field 2.
-    __ DecodeField<Map::ElementsKindBits>(r5);
-
-    __ CmpP(r5, Operand(PACKED_ELEMENTS));
-    __ Assert(eq, AbortReason::kInvalidElementsKindForInternalPackedArray);
-  }
-
-  __ Jump(
-      BUILTIN_CODE(masm->isolate(), InternalArrayNoArgumentConstructor_Packed),
-      RelocInfo::CODE_TARGET);
-}
-
 namespace {
 
 static int AddressOffset(ExternalReference ref0, ExternalReference ref1) {
diff --git a/deps/v8/src/builtins/string-endswith.tq b/deps/v8/src/builtins/string-endswith.tq
index 9590b853e793a3..6941728b39aa87 100644
--- a/deps/v8/src/builtins/string-endswith.tq
+++ b/deps/v8/src/builtins/string-endswith.tq
@@ -4,17 +4,15 @@
 
 namespace string {
   macro TryFastStringCompareSequence(
-      string: String, searchStr: String, start: Number,
-      searchLength: Smi): Boolean labels Slow {
+      string: String, searchStr: String, start: uintptr,
+      searchLength: uintptr): Boolean labels Slow {
     const directString = Cast<DirectString>(string) otherwise Slow;
     const directSearchStr = Cast<DirectString>(searchStr) otherwise Slow;
-    const stringIndexSmi: Smi = Cast<Smi>(start) otherwise Slow;
 
-    let searchIndex: intptr = 0;
-    let stringIndex = Convert<intptr>(stringIndexSmi);
-    const searchLengthInteger = Convert<intptr>(searchLength);
+    let searchIndex: uintptr = 0;
+    let stringIndex: uintptr = start;
 
-    while (searchIndex < searchLengthInteger) {
+    while (searchIndex < searchLength) {
       if (StringCharCodeAt(directSearchStr, searchIndex) !=
           StringCharCodeAt(directString, stringIndex)) {
         return False;
@@ -28,46 +26,42 @@ namespace string {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.endswith
   transitioning javascript builtin StringPrototypeEndsWith(
-      js-implicit context: Context, receiver: JSAny)(...arguments): Boolean {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): Boolean {
     const searchString: JSAny = arguments[0];
     const endPosition: JSAny = arguments[1];
     const kBuiltinName: constexpr string = 'String.prototype.endsWith';
 
     // 1. Let O be ? RequireObjectCoercible(this value).
-    const object: JSAny = RequireObjectCoercible(receiver, kBuiltinName);
-
     // 2. Let S be ? ToString(O).
-    const string: String = ToString_Inline(context, object);
+    const string: String = ToThisString(receiver, kBuiltinName);
 
     // 3. Let isRegExp be ? IsRegExp(searchString).
     // 4. If isRegExp is true, throw a TypeError exception.
     if (regexp::IsRegExp(searchString)) {
-      ThrowTypeError(kFirstArgumentNotRegExp, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kFirstArgumentNotRegExp, kBuiltinName);
     }
 
     // 5. Let searchStr be ? ToString(searchString).
-    const searchStr: String = ToString_Inline(context, searchString);
+    const searchStr: String = ToString_Inline(searchString);
 
     // 6. Let len be the length of S.
-    const len: Number = string.length_smi;
+    const len: uintptr = string.length_uintptr;
 
     // 7. If endPosition is undefined, let pos be len,
     // else let pos be ? ToInteger(endPosition).
-    const pos: Number = (endPosition == Undefined) ?
-        len :
-        ToInteger_Inline(context, endPosition);
-
     // 8. Let end be min(max(pos, 0), len).
-    const end: Number = NumberMin(NumberMax(pos, 0), len);
+    const end: uintptr =
+        (endPosition != Undefined) ? ClampToIndexRange(endPosition, len) : len;
 
     // 9. Let searchLength be the length of searchStr.
-    const searchLength: Smi = searchStr.length_smi;
+    const searchLength: uintptr = searchStr.length_uintptr;
 
     // 10. Let start be end - searchLength.
-    const start = end - searchLength;
+    const start: uintptr = end - searchLength;
 
     // 11. If start is less than 0, return false.
-    if (start < 0) return False;
+    if (Signed(start) < 0) return False;
 
     // 12. If the sequence of code units of S starting at start of length
     // searchLength is the same as the full code unit sequence of searchStr,
@@ -80,7 +74,8 @@ namespace string {
     }
     label Slow {
       // Slow Path: If either of the string is indirect, bail into runtime.
-      return StringCompareSequence(context, string, searchStr, start);
+      return StringCompareSequence(
+          context, string, searchStr, Convert<Number>(start));
     }
   }
 }
diff --git a/deps/v8/src/builtins/string-html.tq b/deps/v8/src/builtins/string-html.tq
index 0b0fdfeaef5c51..f12c2dd22f1e03 100644
--- a/deps/v8/src/builtins/string-html.tq
+++ b/deps/v8/src/builtins/string-html.tq
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace string_html {
+namespace string {
   extern runtime StringEscapeQuotes(Context, String): String;
 
   // https://tc39.github.io/ecma262/#sec-createhtml
@@ -13,7 +13,7 @@ namespace string_html {
     let result = '<' + tagName;
     if (attr != kEmptyString) {
       const attrStringValue: String =
-          StringEscapeQuotes(context, ToString_Inline(context, attrValue));
+          StringEscapeQuotes(context, ToString_Inline(attrValue));
       result = result + ' ' + attr + '=\"' + attrStringValue + '\"';
     }
 
@@ -22,14 +22,15 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.anchor
   transitioning javascript builtin StringPrototypeAnchor(
-      js-implicit context: Context, receiver: JSAny)(...arguments): String {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.anchor', 'a', 'name', arguments[0]);
   }
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.big
   transitioning javascript builtin
-  StringPrototypeBig(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypeBig(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.big', 'big', kEmptyString, kEmptyString);
@@ -37,7 +38,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.blink
   transitioning javascript builtin
-  StringPrototypeBlink(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypeBlink(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.blink', 'blink', kEmptyString,
@@ -46,7 +47,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.bold
   transitioning javascript builtin
-  StringPrototypeBold(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypeBold(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.bold', 'b', kEmptyString, kEmptyString);
@@ -54,7 +55,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.fontcolor
   transitioning javascript builtin
-  StringPrototypeFontcolor(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypeFontcolor(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.fontcolor', 'font', 'color', arguments[0]);
@@ -62,7 +63,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.fontsize
   transitioning javascript builtin
-  StringPrototypeFontsize(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypeFontsize(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.fontsize', 'font', 'size', arguments[0]);
@@ -70,7 +71,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.fixed
   transitioning javascript builtin
-  StringPrototypeFixed(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypeFixed(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.fixed', 'tt', kEmptyString, kEmptyString);
@@ -78,7 +79,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.italics
   transitioning javascript builtin
-  StringPrototypeItalics(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypeItalics(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.italics', 'i', kEmptyString, kEmptyString);
@@ -86,7 +87,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.link
   transitioning javascript builtin
-  StringPrototypeLink(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypeLink(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.link', 'a', 'href', arguments[0]);
@@ -94,7 +95,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.small
   transitioning javascript builtin
-  StringPrototypeSmall(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypeSmall(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.small', 'small', kEmptyString,
@@ -103,7 +104,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.strike
   transitioning javascript builtin
-  StringPrototypeStrike(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypeStrike(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.strike', 'strike', kEmptyString,
@@ -112,7 +113,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.sub
   transitioning javascript builtin
-  StringPrototypeSub(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypeSub(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.sub', 'sub', kEmptyString, kEmptyString);
@@ -120,7 +121,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.sup
   transitioning javascript builtin
-  StringPrototypeSup(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypeSup(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.sup', 'sup', kEmptyString, kEmptyString);
diff --git a/deps/v8/src/builtins/string-iterator.tq b/deps/v8/src/builtins/string-iterator.tq
index b0bbb8d4a35dc2..79032e0e28074e 100644
--- a/deps/v8/src/builtins/string-iterator.tq
+++ b/deps/v8/src/builtins/string-iterator.tq
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace string_iterator {
+namespace string {
 
   macro NewJSStringIterator(implicit context: Context)(
       string: String, nextIndex: Smi): JSStringIterator {
@@ -17,7 +17,7 @@ namespace string_iterator {
 
   // ES6 #sec-string.prototype-@@iterator
   transitioning javascript builtin StringPrototypeIterator(
-      js-implicit context: Context, receiver: JSAny)(): JSStringIterator {
+      js-implicit context: NativeContext, receiver: JSAny)(): JSStringIterator {
     const name: String =
         ToThisString(receiver, 'String.prototype[Symbol.iterator]');
     const index: Smi = 0;
@@ -26,10 +26,10 @@ namespace string_iterator {
 
   // ES6 #sec-%stringiteratorprototype%.next
   transitioning javascript builtin StringIteratorPrototypeNext(
-      js-implicit context: Context, receiver: JSAny)(): JSObject {
+      js-implicit context: NativeContext, receiver: JSAny)(): JSObject {
     const iterator = Cast<JSStringIterator>(receiver) otherwise ThrowTypeError(
-        kIncompatibleMethodReceiver, 'String Iterator.prototype.next',
-        receiver);
+        MessageTemplate::kIncompatibleMethodReceiver,
+        'String Iterator.prototype.next', receiver);
     const string = iterator.string;
     const position: intptr = SmiUntag(iterator.index);
     const length: intptr = string.length_intptr;
@@ -37,7 +37,7 @@ namespace string_iterator {
       return AllocateJSIteratorResult(Undefined, True);
     }
     // Move to next codepoint.
-    const encoding = UTF16;
+    const encoding = UnicodeEncoding::UTF16;
     const ch = string::LoadSurrogatePairAt(string, length, position, encoding);
     const value: String = string::StringFromSingleUTF16EncodedCodePoint(ch);
     iterator.index = SmiTag(position + value.length_intptr);
diff --git a/deps/v8/src/builtins/string-pad.tq b/deps/v8/src/builtins/string-pad.tq
index 2368067c4e3bc9..4a4c3704065ae1 100644
--- a/deps/v8/src/builtins/string-pad.tq
+++ b/deps/v8/src/builtins/string-pad.tq
@@ -21,7 +21,7 @@ namespace string {
     if (arguments.length == 0) {
       return receiverString;
     }
-    const maxLength: Number = ToLength_Inline(context, arguments[0]);
+    const maxLength: Number = ToLength_Inline(arguments[0]);
     assert(IsNumberNormalized(maxLength));
 
     typeswitch (maxLength) {
@@ -40,7 +40,7 @@ namespace string {
     if (arguments.length != 1) {
       const fill = arguments[1];
       if (fill != Undefined) {
-        fillString = ToString_Inline(context, fill);
+        fillString = ToString_Inline(fill);
         fillLength = fillString.length_intptr;
         if (fillLength == 0) {
           return receiverString;
@@ -95,7 +95,7 @@ namespace string {
 
   // ES6 #sec-string.prototype.padstart
   transitioning javascript builtin
-  StringPrototypePadStart(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypePadStart(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     const methodName: constexpr string = 'String.prototype.padStart';
     return StringPad(receiver, arguments, methodName, kStringPadStart);
@@ -103,7 +103,7 @@ namespace string {
 
   // ES6 #sec-string.prototype.padend
   transitioning javascript builtin
-  StringPrototypePadEnd(js-implicit context: Context, receiver: JSAny)(
+  StringPrototypePadEnd(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): String {
     const methodName: constexpr string = 'String.prototype.padEnd';
     return StringPad(receiver, arguments, methodName, kStringPadEnd);
diff --git a/deps/v8/src/builtins/string-repeat.tq b/deps/v8/src/builtins/string-repeat.tq
index f341ed4336baaf..1c14be6cb45729 100644
--- a/deps/v8/src/builtins/string-repeat.tq
+++ b/deps/v8/src/builtins/string-repeat.tq
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace string_repeat {
+namespace string {
   const kBuiltinName: constexpr string = 'String.prototype.repeat';
 
   builtin StringRepeat(implicit context: Context)(string: String, count: Smi):
@@ -28,14 +28,15 @@ namespace string_repeat {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.repeat
   transitioning javascript builtin StringPrototypeRepeat(
-      js-implicit context: Context, receiver: JSAny)(count: JSAny): String {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(count: JSAny): String {
     // 1. Let O be ? RequireObjectCoercible(this value).
     // 2. Let S be ? ToString(O).
     const s: String = ToThisString(receiver, kBuiltinName);
 
     try {
       // 3. Let n be ? ToInteger(count).
-      typeswitch (ToInteger_Inline(context, count, kTruncateMinusZero)) {
+      typeswitch (ToInteger_Inline(count, kTruncateMinusZero)) {
         case (n: Smi): {
           // 4. If n < 0, throw a RangeError exception.
           if (n < 0) goto InvalidCount;
@@ -68,7 +69,7 @@ namespace string_repeat {
       return kEmptyString;
     }
     label InvalidCount deferred {
-      ThrowRangeError(kInvalidCountValue, count);
+      ThrowRangeError(MessageTemplate::kInvalidCountValue, count);
     }
     label InvalidStringLength deferred {
       ThrowInvalidStringLength(context);
diff --git a/deps/v8/src/builtins/string-replaceall.tq b/deps/v8/src/builtins/string-replaceall.tq
new file mode 100644
index 00000000000000..c7589f18a66bd4
--- /dev/null
+++ b/deps/v8/src/builtins/string-replaceall.tq
@@ -0,0 +1,222 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-string-gen.h'
+
+namespace string {
+  extern macro ReplaceSymbolConstant(): Symbol;
+
+  extern macro StringBuiltinsAssembler::GetSubstitution(
+      implicit context: Context)(String, Smi, Smi, String): String;
+
+  extern builtin
+  StringIndexOf(implicit context: Context)(String, String, Smi): Smi;
+
+  macro TryFastAbstractStringIndexOf(implicit context: Context)(
+      string: String, searchString: String, fromIndex: Smi): Smi labels Slow {
+    const stringLen = string.length_uintptr;
+    const searchLen = searchString.length_uintptr;
+    const directString = Cast<DirectString>(string) otherwise Slow;
+    const directSearchStr = Cast<DirectString>(searchString) otherwise Slow;
+    const fromIndexUint = Unsigned(SmiUntag(fromIndex));
+
+    for (let i: uintptr = fromIndexUint; i < stringLen; i++) {
+      let j = i;
+      let k: uintptr = 0;
+      while (j < stringLen && k < searchLen &&
+             StringCharCodeAt(directString, j) ==
+                 StringCharCodeAt(directSearchStr, k)) {
+        j++;
+        k++;
+      }
+      if (k == searchLen) {
+        return SmiTag(Signed(i));
+      }
+    }
+    return -1;
+  }
+
+  macro AbstractStringIndexOf(implicit context: Context)(
+      string: String, searchString: String, fromIndex: Smi): Smi {
+    // Special case the empty string.
+    const searchStringLength = searchString.length_intptr;
+    const stringLength = string.length_intptr;
+    if (searchStringLength == 0 && SmiUntag(fromIndex) <= stringLength) {
+      return fromIndex;
+    }
+
+    // Don't bother to search if the searchString would go past the end
+    // of the string. This is actually necessary because of runtime
+    // checks.
+    if (SmiUntag(fromIndex) + searchStringLength > stringLength) {
+      return -1;
+    }
+
+    try {
+      return TryFastAbstractStringIndexOf(string, searchString, fromIndex)
+          otherwise Slow;
+    }
+    label Slow {
+      for (let i: intptr = SmiUntag(fromIndex);
+           i + searchStringLength <= stringLength; i++) {
+        if (StringCompareSequence(
+                context, string, searchString, Convert<Number>(SmiTag(i))) ==
+            True) {
+          return SmiTag(i);
+        }
+      }
+      return -1;
+    }
+  }
+
+  transitioning macro
+  ThrowIfNotGlobal(implicit context: Context)(searchValue: JSAny): void {
+    let shouldThrow: bool;
+    typeswitch (searchValue) {
+      case (fastRegExp: FastJSRegExp): {
+        shouldThrow = !fastRegExp.global;
+      }
+      case (Object): {
+        const flags = GetProperty(searchValue, 'flags');
+        RequireObjectCoercible(flags, 'String.prototype.replaceAll');
+        shouldThrow =
+            StringIndexOf(ToString_Inline(flags), StringConstant('g'), 0) == -1;
+      }
+    }
+    if (shouldThrow) {
+      ThrowTypeError(
+          MessageTemplate::kRegExpGlobalInvokedOnNonGlobal,
+          'String.prototype.replaceAll');
+    }
+  }
+
+  // https://tc39.es/ecma262/#sec-string.prototype.replaceall
+  transitioning javascript builtin StringPrototypeReplaceAll(
+      js-implicit context: NativeContext,
+      receiver: JSAny)(searchValue: JSAny, replaceValue: JSAny): JSAny {
+    // 1. Let O be ? RequireObjectCoercible(this value).
+    RequireObjectCoercible(receiver, 'String.prototype.replaceAll');
+
+    // 2. If searchValue is neither undefined nor null, then
+    if (searchValue != Undefined && searchValue != Null) {
+      // a. Let isRegExp be ? IsRegExp(searchString).
+      // b. If isRegExp is true, then
+      //   i. Let flags be ? Get(searchValue, "flags").
+      //  ii. Perform ? RequireObjectCoercible(flags).
+      // iii. If ? ToString(flags) does not contain "g", throw a
+      //      TypeError exception.
+      if (regexp::IsRegExp(searchValue)) {
+        ThrowIfNotGlobal(searchValue);
+      }
+
+      // TODO(joshualitt): We could easily add fast paths for string
+      //                   searchValues and potential FastRegExps.
+      // c. Let replacer be ? GetMethod(searchValue, @@replace).
+      // d. If replacer is not undefined, then
+      //   i. Return ? Call(replacer, searchValue, « O, replaceValue »).
+      try {
+        const replacer = GetMethod(searchValue, ReplaceSymbolConstant())
+            otherwise ReplaceSymbolIsNullOrUndefined;
+        return Call(context, replacer, searchValue, receiver, replaceValue);
+      }
+      label ReplaceSymbolIsNullOrUndefined {}
+    }
+
+    // 3. Let string be ? ToString(O).
+    const string = ToString_Inline(receiver);
+
+    // 4. Let searchString be ? ToString(searchValue).
+    const searchString = ToString_Inline(searchValue);
+
+    // 5. Let functionalReplace be IsCallable(replaceValue).
+    let replaceValueArg = replaceValue;
+    const functionalReplace = TaggedIsCallable(replaceValue);
+
+    // 6. If functionalReplace is false, then
+    if (!functionalReplace) {
+      // a. Let replaceValue be ? ToString(replaceValue).
+      replaceValueArg = ToString_Inline(replaceValue);
+    }
+
+    // 7. Let searchLength be the length of searchString.
+    const searchLength = searchString.length_smi;
+
+    // 8. Let advanceBy be max(1, searchLength).
+    const advanceBy = SmiMax(1, searchLength);
+
+    // We combine the two loops from the spec into one to avoid
+    // needing a growable array.
+    //
+    // 9. Let matchPositions be a new empty List.
+    // 10. Let position be ! StringIndexOf(string, searchString, 0).
+    // 11. Repeat, while position is not -1
+    //   a. Append position to the end of matchPositions.
+    //   b. Let position be ! StringIndexOf(string, searchString,
+    //                                      position + advanceBy).
+    // 12. Let endOfLastMatch be 0.
+    // 13. Let result be the empty string value.
+    // 14. For each position in matchPositions, do
+    let endOfLastMatch: Smi = 0;
+    let result: String = kEmptyString;
+    let position = AbstractStringIndexOf(string, searchString, 0);
+    while (position != -1) {
+      // a. If functionalReplace is true, then
+      // b. Else,
+      let replacement: String;
+      if (functionalReplace) {
+        // i. Let replacement be ? ToString(? Call(replaceValue, undefined,
+        //                                         « searchString, position,
+        //                                           string »).
+        replacement = ToString_Inline(Call(
+            context, UnsafeCast<Callable>(replaceValueArg), Undefined,
+            searchString, position, string));
+      } else {
+        // i. Assert: Type(replaceValue) is String.
+        const replaceValueString = UnsafeCast<String>(replaceValueArg);
+
+        // ii. Let captures be a new empty List.
+        // iii. Let replacement be GetSubstitution(searchString,
+        //                                         string, position, captures,
+        //                                         undefined, replaceValue).
+        // Note: Instead we just call a simpler GetSubstitution primitive.
+        const matchEndPosition = position + searchLength;
+        replacement = GetSubstitution(
+            string, position, matchEndPosition, replaceValueString);
+      }
+
+      // c. Let stringSlice be the substring of string consisting of the code
+      //    units from endOfLastMatch (inclusive) up through position
+      //    (exclusive).
+      const stringSlice = string::SubString(
+          string, Unsigned(SmiUntag(endOfLastMatch)),
+          Unsigned(SmiUntag(position)));
+
+      // d. Let result be the string-concatenation of result, stringSlice,
+      //    and replacement.
+      // TODO(joshualitt): This leaves a completely degenerate ConsString tree.
+      //                   We could be smarter here.
+      result = result + stringSlice + replacement;
+
+      // e. Let endOfLastMatch be position + searchLength.
+      endOfLastMatch = position + searchLength;
+
+      position =
+          AbstractStringIndexOf(string, searchString, position + advanceBy);
+    }
+
+    // 15. If endOfLastMatch < the length of string, then
+    if (endOfLastMatch < string.length_smi) {
+      // a. Let result be the string-concatenation of result and the substring
+      //    of string consisting of the code units from endOfLastMatch
+      //    (inclusive) up through the final code unit of string (inclusive).
+      result = result +
+          string::SubString(
+                   string, Unsigned(SmiUntag(endOfLastMatch)),
+                   Unsigned(string.length_intptr));
+    }
+
+    // 16. Return result.
+    return result;
+  }
+}
diff --git a/deps/v8/src/builtins/string-slice.tq b/deps/v8/src/builtins/string-slice.tq
index b5ddbdb2ccbe74..ea95d44a82381a 100644
--- a/deps/v8/src/builtins/string-slice.tq
+++ b/deps/v8/src/builtins/string-slice.tq
@@ -2,30 +2,29 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace string_slice {
-
-  extern macro StringBuiltinsAssembler::SubString(String, intptr, intptr):
-      String;
-
+namespace string {
   // ES6 #sec-string.prototype.slice ( start, end )
   // https://tc39.github.io/ecma262/#sec-string.prototype.slice
   transitioning javascript builtin StringPrototypeSlice(
-      js-implicit context: Context, receiver: JSAny)(...arguments): String {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): String {
     // 1. Let O be ? RequireObjectCoercible(this value).
     // 2. Let S be ? ToString(O).
     const string: String = ToThisString(receiver, 'String.prototype.slice');
 
     // 3. Let len be the number of elements in S.
-    const length: intptr = string.length_intptr;
+    const length: uintptr = string.length_uintptr;
 
     // Convert {start} to a relative index.
-    const start: intptr = ConvertToRelativeIndex(arguments[0], length);
+    const arg0 = arguments[0];
+    const start: uintptr =
+        arg0 != Undefined ? ConvertToRelativeIndex(arg0, length) : 0;
 
     // 5. If end is undefined, let intEnd be len;
     // else Convert {end} to a relative index.
-    const temp = arguments[1];
-    const end: intptr =
-        temp == Undefined ? length : ConvertToRelativeIndex(temp, length);
+    const arg1 = arguments[1];
+    const end: uintptr =
+        arg1 != Undefined ? ConvertToRelativeIndex(arg1, length) : length;
 
     if (end <= start) {
       return kEmptyString;
diff --git a/deps/v8/src/builtins/string-startswith.tq b/deps/v8/src/builtins/string-startswith.tq
index 3238f52b86bd20..045722dd824daa 100644
--- a/deps/v8/src/builtins/string-startswith.tq
+++ b/deps/v8/src/builtins/string-startswith.tq
@@ -7,41 +7,41 @@
 namespace string {
   // https://tc39.github.io/ecma262/#sec-string.prototype.startswith
   transitioning javascript builtin StringPrototypeStartsWith(
-      js-implicit context: Context, receiver: JSAny)(...arguments): Boolean {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): Boolean {
     const searchString: JSAny = arguments[0];
     const position: JSAny = arguments[1];
     const kBuiltinName: constexpr string = 'String.prototype.startsWith';
 
     // 1. Let O be ? RequireObjectCoercible(this value).
-    const object: JSAny = RequireObjectCoercible(receiver, kBuiltinName);
-
     // 2. Let S be ? ToString(O).
-    const string: String = ToString_Inline(context, object);
+    const string: String = ToThisString(receiver, kBuiltinName);
 
     // 3. Let isRegExp be ? IsRegExp(searchString).
     // 4. If isRegExp is true, throw a TypeError exception.
     if (regexp::IsRegExp(searchString)) {
-      ThrowTypeError(kFirstArgumentNotRegExp, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kFirstArgumentNotRegExp, kBuiltinName);
     }
 
     // 5. Let searchStr be ? ToString(searchString).
-    const searchStr: String = ToString_Inline(context, searchString);
-
-    // 6. Let pos be ? ToInteger(position).
-    const pos: Number = ToInteger_Inline(context, position);
+    const searchStr: String = ToString_Inline(searchString);
 
-    // 7. Assert: If position is undefined, then pos is 0.
     // 8. Let len be the length of S.
-    const len: Number = string.length_smi;
+    const len: uintptr = string.length_uintptr;
 
+    // 6. Let pos be ? ToInteger(position).
+    // 7. Assert: If position is undefined, then pos is 0.
     // 9. Let start be min(max(pos, 0), len).
-    const start: Number = NumberMin(NumberMax(pos, 0), len);
+    const start: uintptr =
+        (position != Undefined) ? ClampToIndexRange(position, len) : 0;
 
     // 10. Let searchLength be the length of searchStr.
-    const searchLength: Smi = searchStr.length_smi;
+    const searchLength: uintptr = searchStr.length_uintptr;
 
     // 11. If searchLength + start is greater than len, return false.
-    if (searchLength + start > len) return False;
+    // The comparison is rephrased to be overflow-friendly with unsigned
+    // indices.
+    if (searchLength > len - start) return False;
 
     // 12. If the sequence of code units of S starting at start of length
     // searchLength is the same as the full code unit sequence of searchStr,
@@ -54,7 +54,8 @@ namespace string {
     }
     label Slow {
       // Slow Path: If either of the string is indirect, bail into runtime.
-      return StringCompareSequence(context, string, searchStr, start);
+      return StringCompareSequence(
+          context, string, searchStr, Convert<Number>(start));
     }
   }
 }
diff --git a/deps/v8/src/builtins/string-substr.tq b/deps/v8/src/builtins/string-substr.tq
new file mode 100644
index 00000000000000..917bee691e0623
--- /dev/null
+++ b/deps/v8/src/builtins/string-substr.tq
@@ -0,0 +1,43 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace string {
+
+  // String.prototype.substr ( start, length )
+  // ES6 #sec-string.prototype.substr
+  transitioning javascript builtin StringPrototypeSubstr(
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): String {
+    const methodName: constexpr string = 'String.prototype.substr';
+    // 1. Let O be ? RequireObjectCoercible(this value).
+    // 2. Let S be ? ToString(O).
+    const string: String = ToThisString(receiver, methodName);
+
+    // 5. Let size be the number of code units in S.
+    const size: uintptr = string.length_uintptr;
+
+    // 3. Let intStart be ? ToInteger(start).
+    // 6. If intStart < 0, set intStart to max(size + intStart, 0).
+    const start = arguments[0];
+    const initStart: uintptr =
+        start != Undefined ? ConvertToRelativeIndex(start, size) : 0;
+
+    // 4. If length is undefined,
+    //   let end be +∞; otherwise let end be ? ToInteger(length).
+    // 7. Let resultLength be min(max(end, 0), size - intStart).
+    const length = arguments[1];
+    const lengthLimit = size - initStart;
+    assert(lengthLimit <= size);
+    const resultLength: uintptr = length != Undefined ?
+        ClampToIndexRange(length, lengthLimit) :
+        lengthLimit;
+
+    // 8. If resultLength ≤ 0, return the empty String "".
+    if (resultLength == 0) return EmptyStringConstant();
+
+    // 9. Return the String value containing resultLength consecutive code units
+    // from S beginning with the code unit at index intStart.
+    return SubString(string, initStart, initStart + resultLength);
+  }
+}
diff --git a/deps/v8/src/builtins/string-substring.tq b/deps/v8/src/builtins/string-substring.tq
index 813dc35ab2817b..e4e7d700003721 100644
--- a/deps/v8/src/builtins/string-substring.tq
+++ b/deps/v8/src/builtins/string-substring.tq
@@ -2,50 +2,30 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace string_substring {
-
-  extern macro StringBuiltinsAssembler::SubString(String, intptr, intptr):
-      String;
-
-  transitioning macro ToSmiBetweenZeroAnd(implicit context: Context)(
-      value: JSAny, limit: Smi): Smi {
-    const valueInt: Number =
-        ToInteger_Inline(context, value, kTruncateMinusZero);
-    typeswitch (valueInt) {
-      case (valueSmi: Smi): {
-        if (SmiAbove(valueSmi, limit)) {
-          return valueSmi < 0 ? 0 : limit;
-        }
-        return valueSmi;
-      }
-      // {value} is a heap number - in this case, it is definitely out of
-      // bounds.
-      case (hn: HeapNumber): {
-        const valueFloat: float64 = LoadHeapNumberValue(hn);
-        return valueFloat < 0. ? 0 : limit;
-      }
-    }
-  }
+namespace string {
 
   // ES6 #sec-string.prototype.substring
   transitioning javascript builtin StringPrototypeSubstring(
-      js-implicit context: Context, receiver: JSAny)(...arguments): String {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): String {
     // Check that {receiver} is coercible to Object and convert it to a String.
     const string: String = ToThisString(receiver, 'String.prototype.substring');
-    const length = string.length_smi;
+    const length: uintptr = string.length_uintptr;
 
     // Conversion and bounds-checks for {start}.
-    let start: Smi = ToSmiBetweenZeroAnd(arguments[0], length);
+    const arg0 = arguments[0];
+    let start: uintptr =
+        arg0 != Undefined ? ClampToIndexRange(arg0, length) : 0;
 
     // Conversion and bounds-checks for {end}.
-    let end: Smi = arguments[1] == Undefined ?
-        length :
-        ToSmiBetweenZeroAnd(arguments[1], length);
+    const arg1 = arguments[1];
+    let end: uintptr =
+        arg1 != Undefined ? ClampToIndexRange(arg1, length) : length;
     if (end < start) {
-      const tmp: Smi = end;
+      const tmp: uintptr = end;
       end = start;
       start = tmp;
     }
-    return SubString(string, SmiUntag(start), SmiUntag(end));
+    return SubString(string, start, end);
   }
 }
diff --git a/deps/v8/src/builtins/symbol.tq b/deps/v8/src/builtins/symbol.tq
new file mode 100644
index 00000000000000..cda344471fbc45
--- /dev/null
+++ b/deps/v8/src/builtins/symbol.tq
@@ -0,0 +1,49 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace symbol {
+  extern runtime SymbolDescriptiveString(implicit context: Context)(Symbol):
+      String;
+
+  transitioning macro ThisSymbolValue(implicit context: Context)(
+      receiver: JSAny, method: constexpr string): Symbol {
+    return UnsafeCast<Symbol>(
+        ToThisValue(receiver, PrimitiveType::kSymbol, method));
+  }
+
+  // ES #sec-symbol.prototype.description
+  transitioning javascript builtin SymbolPrototypeDescriptionGetter(
+      js-implicit context: NativeContext, receiver: JSAny)(): String|Undefined {
+    // 1. Let s be the this value.
+    // 2. Let sym be ? thisSymbolValue(s).
+    const sym: Symbol =
+        ThisSymbolValue(receiver, 'Symbol.prototype.description');
+    // 3. Return sym.[[Description]].
+    return sym.description;
+  }
+
+  // ES6 #sec-symbol.prototype-@@toprimitive
+  transitioning javascript builtin SymbolPrototypeToPrimitive(
+      js-implicit context: NativeContext,
+      receiver: JSAny)(_hint: JSAny): JSAny {
+    // 1. Return ? thisSymbolValue(this value).
+    return ThisSymbolValue(receiver, 'Symbol.prototype [ @@toPrimitive ]');
+  }
+
+  // ES6 #sec-symbol.prototype.tostring
+  transitioning javascript builtin SymbolPrototypeToString(
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+    // 1. Let sym be ? thisSymbolValue(this value).
+    const sym: Symbol = ThisSymbolValue(receiver, 'Symbol.prototype.toString');
+    // 2. Return SymbolDescriptiveString(sym).
+    return SymbolDescriptiveString(sym);
+  }
+
+  // ES6 #sec-symbol.prototype.valueof
+  transitioning javascript builtin SymbolPrototypeValueOf(
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+    // 1. Return ? thisSymbolValue(this value).
+    return ThisSymbolValue(receiver, 'Symbol.prototype.valueOf');
+  }
+}
diff --git a/deps/v8/src/builtins/torque-internal.tq b/deps/v8/src/builtins/torque-internal.tq
index 48a08deb0aa207..47e91c93dcfdfb 100644
--- a/deps/v8/src/builtins/torque-internal.tq
+++ b/deps/v8/src/builtins/torque-internal.tq
@@ -3,21 +3,15 @@
 // found in the LICENSE file.
 
 namespace torque_internal {
-  // TODO(gsps): Synthesize SizeOf<T> in the compiler
-
-  macro SizeOf<T: type>(): constexpr int31;
-  SizeOf<Object>(): constexpr int31 {
-    return kTaggedSize;
-  }
-  SizeOf<float64>(): constexpr int31 {
-    return kDoubleSize;
-  }
-
   // Unsafe is a marker that we require to be passed when calling internal APIs
   // that might lead to unsoundness when used incorrectly. Unsafe markers should
   // therefore not be instantiated anywhere outside of this namespace.
   struct Unsafe {}
 
+  // Size of a type in memory (on the heap). For class types, this is the size
+  // of the pointer, not of the instance.
+  intrinsic %SizeOf<T: type>(): constexpr int31;
+
   struct Reference<T: type> {
     const object: HeapObject;
     const offset: intptr;
@@ -33,31 +27,35 @@ namespace torque_internal {
   }
 
   struct Slice<T: type> {
-    TryAtIndex(index: intptr):&T labels OutOfBounds {
+    macro TryAtIndex(index: intptr):&T labels OutOfBounds {
       if (Convert<uintptr>(index) < Convert<uintptr>(this.length)) {
         return UnsafeNewReference<T>(
-            this.object, this.offset + index * SizeOf<T>());
+            this.object, this.offset + index * %SizeOf<T>());
       } else {
         goto OutOfBounds;
       }
     }
 
-    AtIndex(index: intptr):&T {
+    macro AtIndex(index: intptr):&T {
       return this.TryAtIndex(index) otherwise unreachable;
     }
 
-    AtIndex(index: constexpr int31):&T {
+    macro AtIndex(index: uintptr):&T {
+      return this.TryAtIndex(Convert<intptr>(index)) otherwise unreachable;
+    }
+
+    macro AtIndex(index: constexpr int31):&T {
       const i: intptr = Convert<intptr>(index);
       return this.TryAtIndex(i) otherwise unreachable;
     }
 
-    AtIndex(index: Smi):&T {
+    macro AtIndex(index: Smi):&T {
       const i: intptr = Convert<intptr>(index);
       return this.TryAtIndex(i) otherwise unreachable;
     }
 
-    Iterator(): SliceIterator<T> {
-      const end = this.offset + this.length * SizeOf<T>();
+    macro Iterator(): SliceIterator<T> {
+      const end = this.offset + this.length * %SizeOf<T>();
       return SliceIterator<T>{
         object: this.object,
         start: this.offset,
@@ -65,6 +63,19 @@ namespace torque_internal {
         unsafeMarker: Unsafe {}
       };
     }
+    macro Iterator(startIndex: intptr, endIndex: intptr): SliceIterator<T> {
+      check(
+          Convert<uintptr>(endIndex) <= Convert<uintptr>(this.length) &&
+          Convert<uintptr>(startIndex) <= Convert<uintptr>(endIndex));
+      const start = this.offset + startIndex * %SizeOf<T>();
+      const end = this.offset + endIndex * %SizeOf<T>();
+      return SliceIterator<T>{
+        object: this.object,
+        start,
+        end,
+        unsafeMarker: Unsafe {}
+      };
+    }
 
     const object: HeapObject;
     const offset: intptr;
@@ -83,16 +94,20 @@ namespace torque_internal {
   }
 
   struct SliceIterator<T: type> {
-    Empty(): bool {
+    macro Empty(): bool {
       return this.start == this.end;
     }
 
-    Next():&T labels NoMore {
+    macro Next(): T labels NoMore {
+      return * this.NextReference() otherwise NoMore;
+    }
+
+    macro NextReference():&T labels NoMore {
       if (this.Empty()) {
         goto NoMore;
       } else {
         const result = UnsafeNewReference<T>(this.object, this.start);
-        this.start += SizeOf<T>();
+        this.start += %SizeOf<T>();
         return result;
       }
     }
@@ -103,4 +118,102 @@ namespace torque_internal {
     unsafeMarker: Unsafe;
   }
 
+  macro AddIndexedFieldSizeToObjectSize(
+      baseSize: intptr, arrayLength: intptr,
+      fieldSize: constexpr int32): intptr {
+    const arrayLength = Convert<int32>(arrayLength);
+    const byteLength = TryInt32Mul(arrayLength, fieldSize)
+        otherwise unreachable;
+    return TryIntPtrAdd(baseSize, Convert<intptr>(byteLength))
+        otherwise unreachable;
+  }
+
+  macro AlignTagged(x: intptr): intptr {
+    // Round up to a multiple of kTaggedSize.
+    return (x + kObjectAlignmentMask) & ~kObjectAlignmentMask;
+  }
+
+  macro IsTaggedAligned(x: intptr): bool {
+    return (x & kObjectAlignmentMask) == 0;
+  }
+
+  macro ValidAllocationSize(sizeInBytes: intptr, map: Map): bool {
+    if (sizeInBytes <= 0) return false;
+    if (!IsTaggedAligned(sizeInBytes)) return false;
+    const instanceSizeInWords = Convert<intptr>(map.instance_size_in_words);
+    return instanceSizeInWords == kVariableSizeSentinel ||
+        instanceSizeInWords * kTaggedSize == sizeInBytes;
+  }
+
+  type UninitializedHeapObject extends HeapObject;
+
+  extern macro AllocateAllowLOS(intptr): UninitializedHeapObject;
+  extern macro GetStructMap(constexpr InstanceType): Map;
+
+  macro Allocate(sizeInBytes: intptr, map: Map): UninitializedHeapObject {
+    assert(ValidAllocationSize(sizeInBytes, map));
+    return AllocateAllowLOS(sizeInBytes);
+  }
+
+  macro InitializeFieldsFromIterator<T: type, Iterator: type>(
+      target: Slice<T>, originIterator: Iterator) {
+    let targetIterator = target.Iterator();
+    let originIterator = originIterator;
+    while (true) {
+      const ref:&T = targetIterator.NextReference() otherwise break;
+      * ref = originIterator.Next() otherwise unreachable;
+    }
+  }
+  // Dummy implementations: do not initialize for UninitializedIterator.
+  InitializeFieldsFromIterator<char8, UninitializedIterator>(
+      _target: Slice<char8>, _originIterator: UninitializedIterator) {}
+  InitializeFieldsFromIterator<char16, UninitializedIterator>(
+      _target: Slice<char16>, _originIterator: UninitializedIterator) {}
+
+  extern macro IsDoubleHole(HeapObject, intptr): bool;
+  extern macro StoreDoubleHole(HeapObject, intptr);
+
+  macro LoadFloat64OrHole(r:&float64_or_hole): float64_or_hole {
+    return float64_or_hole{
+      is_hole: IsDoubleHole(r.object, r.offset - kHeapObjectTag),
+      value: * UnsafeNewReference<float64>(r.object, r.offset)
+    };
+  }
+  macro StoreFloat64OrHole(r:&float64_or_hole, value: float64_or_hole) {
+    if (value.is_hole) {
+      StoreDoubleHole(r.object, r.offset - kHeapObjectTag);
+    } else {
+      * UnsafeNewReference<float64>(r.object, r.offset) = value.value;
+    }
+  }
 }  // namespace torque_internal
+
+// Indicates that an array-field should not be initialized.
+// For safety reasons, this is only allowed for untagged types.
+struct UninitializedIterator {}
+
+// %RawDownCast should *never* be used anywhere in Torque code except for
+// in Torque-based UnsafeCast operators preceeded by an appropriate
+// type assert()
+intrinsic %RawDownCast<To: type, From: type>(x: From): To;
+intrinsic %RawConstexprCast<To: type, From: type>(f: From): To;
+
+struct IteratorSequence<T: type, FirstIterator: type, SecondIterator: type> {
+  macro Empty(): bool {
+    return this.first.Empty() && this.second.Empty();
+  }
+
+  macro Next(): T labels NoMore {
+    return this.first.Next()
+        otherwise return (this.second.Next() otherwise NoMore);
+  }
+
+  first: FirstIterator;
+  second: SecondIterator;
+}
+
+macro IteratorSequence<T: type, FirstIterator: type, SecondIterator: type>(
+    first: FirstIterator, second: SecondIterator):
+    IteratorSequence<T, FirstIterator, SecondIterator> {
+  return IteratorSequence<T>{first, second};
+}
diff --git a/deps/v8/src/builtins/typed-array-createtypedarray.tq b/deps/v8/src/builtins/typed-array-createtypedarray.tq
index a6bd445e34a483..77a0b404bed4f0 100644
--- a/deps/v8/src/builtins/typed-array-createtypedarray.tq
+++ b/deps/v8/src/builtins/typed-array-createtypedarray.tq
@@ -4,7 +4,7 @@
 
 #include 'src/builtins/builtins-constructor-gen.h'
 
-namespace typed_array_createtypedarray {
+namespace typed_array {
   extern builtin IterableToListMayPreserveHoles(Context, Object, Callable):
       JSArray;
 
@@ -20,8 +20,6 @@ namespace typed_array_createtypedarray {
 
   extern runtime ThrowInvalidTypedArrayAlignment(implicit context: Context)(
       Map, String): never;
-  extern runtime TypedArrayCopyElements(Context, JSTypedArray, Object, Number):
-      void;
 
   transitioning macro AllocateTypedArray(implicit context: Context)(
       isOnHeap: constexpr bool, map: Map, buffer: JSArrayBuffer,
@@ -72,11 +70,11 @@ namespace typed_array_createtypedarray {
   }
 
   transitioning macro TypedArrayInitialize(implicit context: Context)(
-      initialize: constexpr bool, map: Map, length: PositiveSmi,
+      initialize: constexpr bool, map: Map, length: uintptr,
       elementsInfo: typed_array::TypedArrayElementsInfo,
-      bufferConstructor: JSReceiver): JSTypedArray {
+      bufferConstructor: JSReceiver): JSTypedArray labels IfRangeError {
     const byteLength = elementsInfo.CalculateByteLength(length)
-        otherwise ThrowRangeError(kInvalidArrayBufferLength);
+        otherwise IfRangeError;
     const byteLengthNum = Convert<Number>(byteLength);
     const defaultConstructor = GetArrayBufferFunction();
     const byteOffset: uintptr = 0;
@@ -93,8 +91,7 @@ namespace typed_array_createtypedarray {
 
       const isOnHeap: constexpr bool = true;
       const typedArray = AllocateTypedArray(
-          isOnHeap, map, buffer, byteOffset, byteLength,
-          Convert<uintptr>(length));
+          isOnHeap, map, buffer, byteOffset, byteLength, length);
 
       if constexpr (initialize) {
         const backingStore = typedArray.data_ptr;
@@ -115,87 +112,93 @@ namespace typed_array_createtypedarray {
       const buffer = Cast<JSArrayBuffer>(bufferObj) otherwise unreachable;
       const isOnHeap: constexpr bool = false;
       return AllocateTypedArray(
-          isOnHeap, map, buffer, byteOffset, byteLength,
-          Convert<uintptr>(length));
+          isOnHeap, map, buffer, byteOffset, byteLength, length);
     }
   }
 
   // 22.2.4.2 TypedArray ( length )
   // ES #sec-typedarray-length
   transitioning macro ConstructByLength(implicit context: Context)(
-      map: Map, length: JSAny,
+      map: Map, lengthObj: JSAny,
       elementsInfo: typed_array::TypedArrayElementsInfo): JSTypedArray {
-    const convertedLength: Number =
-        ToInteger_Inline(context, length, kTruncateMinusZero);
-    // The maximum length of a TypedArray is MaxSmi().
-    // Note: this is not per spec, but rather a constraint of our current
-    // representation (which uses Smis).
-    // TODO(7881): support larger-than-smi typed array lengths
-    const positiveLength: PositiveSmi = Cast<PositiveSmi>(convertedLength)
-        otherwise ThrowRangeError(kInvalidTypedArrayLength, length);
-    const defaultConstructor: Constructor = GetArrayBufferFunction();
-    const initialize: constexpr bool = true;
-    return TypedArrayInitialize(
-        initialize, map, positiveLength, elementsInfo, defaultConstructor);
+    try {
+      const length: uintptr = ToIndex(lengthObj) otherwise RangeError;
+      const defaultConstructor: Constructor = GetArrayBufferFunction();
+      const initialize: constexpr bool = true;
+      return TypedArrayInitialize(
+          initialize, map, length, elementsInfo, defaultConstructor)
+          otherwise RangeError;
+    }
+    label RangeError deferred {
+      ThrowRangeError(MessageTemplate::kInvalidTypedArrayLength, lengthObj);
+    }
   }
 
   // 22.2.4.4 TypedArray ( object )
   // ES #sec-typedarray-object
   transitioning macro ConstructByArrayLike(implicit context: Context)(
-      map: Map, arrayLike: HeapObject, initialLength: JSAny,
+      map: Map, arrayLike: HeapObject, length: uintptr,
       elementsInfo: typed_array::TypedArrayElementsInfo,
       bufferConstructor: JSReceiver): JSTypedArray {
-    // The caller has looked up length on arrayLike, which is observable.
-    const length: PositiveSmi = ToSmiLength(initialLength)
-        otherwise ThrowRangeError(kInvalidTypedArrayLength, initialLength);
-    const initialize: constexpr bool = false;
-    const typedArray = TypedArrayInitialize(
-        initialize, map, length, elementsInfo, bufferConstructor);
-
     try {
-      const src: JSTypedArray = Cast<JSTypedArray>(arrayLike) otherwise IfSlow;
-
-      if (IsDetachedBuffer(src.buffer)) {
-        ThrowTypeError(kDetachedOperation, 'Construct');
-
-      } else if (src.elements_kind != elementsInfo.kind) {
-        goto IfSlow;
-
-      } else if (length > 0) {
-        const byteLength = typedArray.byte_length;
-        assert(byteLength <= kArrayBufferMaxByteLength);
-        typed_array::CallCMemcpy(typedArray.data_ptr, src.data_ptr, byteLength);
+      const initialize: constexpr bool = false;
+      const typedArray = TypedArrayInitialize(
+          initialize, map, length, elementsInfo, bufferConstructor)
+          otherwise RangeError;
+
+      try {
+        const src: JSTypedArray =
+            Cast<JSTypedArray>(arrayLike) otherwise IfSlow;
+
+        if (IsDetachedBuffer(src.buffer)) {
+          ThrowTypeError(MessageTemplate::kDetachedOperation, 'Construct');
+
+        } else if (src.elements_kind != elementsInfo.kind) {
+          goto IfSlow;
+
+        } else if (length > 0) {
+          const byteLength = typedArray.byte_length;
+          assert(byteLength <= kArrayBufferMaxByteLength);
+          typed_array::CallCMemcpy(
+              typedArray.data_ptr, src.data_ptr, byteLength);
+        }
       }
-    }
-    label IfSlow deferred {
-      if (length > 0) {
-        TypedArrayCopyElements(context, typedArray, arrayLike, length);
+      label IfSlow deferred {
+        if (length > 0) {
+          TypedArrayCopyElements(
+              context, typedArray, arrayLike, Convert<Number>(length));
+        }
       }
+      return typedArray;
+    }
+    label RangeError deferred {
+      ThrowRangeError(
+          MessageTemplate::kInvalidTypedArrayLength, Convert<Number>(length));
     }
-    return typedArray;
   }
 
   // 22.2.4.4 TypedArray ( object )
   // ES #sec-typedarray-object
   transitioning macro ConstructByIterable(implicit context: Context)(
       iterable: JSReceiver, iteratorFn: Callable): never
-      labels IfConstructByArrayLike(JSArray, Number, JSReceiver) {
+      labels IfConstructByArrayLike(JSArray, uintptr, JSReceiver) {
     const array: JSArray =
         IterableToListMayPreserveHoles(context, iterable, iteratorFn);
-    goto IfConstructByArrayLike(array, array.length, GetArrayBufferFunction());
+    // Max JSArray length is a valid JSTypedArray length so we just use it.
+    goto IfConstructByArrayLike(
+        array, array.length_uintptr, GetArrayBufferFunction());
   }
 
   // 22.2.4.3 TypedArray ( typedArray )
   // ES #sec-typedarray-typedarray
   transitioning macro ConstructByTypedArray(implicit context: Context)(
       srcTypedArray: JSTypedArray): never
-      labels IfConstructByArrayLike(JSTypedArray, Number, JSReceiver) {
+      labels IfConstructByArrayLike(JSTypedArray, uintptr, JSReceiver) {
     let bufferConstructor: JSReceiver = GetArrayBufferFunction();
     const srcBuffer: JSArrayBuffer = srcTypedArray.buffer;
     // TODO(petermarshall): Throw on detached typedArray.
-    // TODO(v8:4156): Update this to support huge TypedArrays.
-    let length =
-        IsDetachedBuffer(srcBuffer) ? 0 : Convert<Number>(srcTypedArray.length);
+    let length: uintptr =
+        IsDetachedBuffer(srcBuffer) ? 0 : srcTypedArray.length;
 
     // The spec requires that constructing a typed array using a SAB-backed
     // typed array use the ArrayBuffer constructor, not the species constructor.
@@ -214,30 +217,22 @@ namespace typed_array_createtypedarray {
       map: Map, buffer: JSArrayBuffer, byteOffset: JSAny, length: JSAny,
       elementsInfo: typed_array::TypedArrayElementsInfo): JSTypedArray {
     try {
-      let offset: uintptr = 0;
-      if (byteOffset != Undefined) {
-        // 6. Let offset be ? ToIndex(byteOffset).
-        offset = TryNumberToUintPtr(
-            ToInteger_Inline(context, byteOffset, kTruncateMinusZero))
-            otherwise goto IfInvalidOffset;
-
-        // 7. If offset modulo elementSize ≠ 0, throw a RangeError exception.
-        if (elementsInfo.IsUnaligned(offset)) {
-          goto IfInvalidAlignment('start offset');
-        }
+      // 6. Let offset be ? ToIndex(byteOffset).
+      const offset: uintptr = ToIndex(byteOffset) otherwise IfInvalidOffset;
+
+      // 7. If offset modulo elementSize ≠ 0, throw a RangeError exception.
+      if (elementsInfo.IsUnaligned(offset)) {
+        goto IfInvalidAlignment('start offset');
       }
 
-      let newLength: PositiveSmi = 0;
-      let newByteLength: uintptr;
       // 8. If length is present and length is not undefined, then
-      if (length != Undefined) {
-        // a. Let newLength be ? ToIndex(length).
-        newLength = ToSmiIndex(length) otherwise IfInvalidLength;
-      }
+      // a. Let newLength be ? ToIndex(length).
+      let newLength: uintptr = ToIndex(length) otherwise IfInvalidLength;
+      let newByteLength: uintptr;
 
       // 9. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
       if (IsDetachedBuffer(buffer)) {
-        ThrowTypeError(kDetachedOperation, 'Construct');
+        ThrowTypeError(MessageTemplate::kDetachedOperation, 'Construct');
       }
 
       // 10. Let bufferByteLength be buffer.[[ArrayBufferByteLength]].
@@ -265,7 +260,7 @@ namespace typed_array_createtypedarray {
       } else {
         // a. Let newByteLength be newLength × elementSize.
         newByteLength = elementsInfo.CalculateByteLength(newLength)
-            otherwise IfInvalidByteLength;
+            otherwise IfInvalidLength;
 
         // b. If offset + newByteLength > bufferByteLength, throw a RangeError
         // exception.
@@ -276,42 +271,76 @@ namespace typed_array_createtypedarray {
 
       const isOnHeap: constexpr bool = false;
       return AllocateTypedArray(
-          isOnHeap, map, buffer, offset, newByteLength,
-          Convert<uintptr>(newLength));
+          isOnHeap, map, buffer, offset, newByteLength, newLength);
     }
     label IfInvalidAlignment(problemString: String) deferred {
       ThrowInvalidTypedArrayAlignment(map, problemString);
     }
-    label IfInvalidByteLength deferred {
-      ThrowRangeError(kInvalidArrayBufferLength);
-    }
     label IfInvalidLength deferred {
-      ThrowRangeError(kInvalidTypedArrayLength, length);
+      ThrowRangeError(MessageTemplate::kInvalidTypedArrayLength, length);
     }
     label IfInvalidOffset deferred {
-      ThrowRangeError(kInvalidOffset, byteOffset);
+      ThrowRangeError(MessageTemplate::kInvalidOffset, byteOffset);
     }
   }
 
+  // 22.2.4.6 TypedArrayCreate ( constructor, argumentList )
+  // ES #typedarray-create
+  @export
+  transitioning macro TypedArrayCreateByLength(implicit context: Context)(
+      constructor: Constructor, length: Number, methodName: constexpr string):
+      JSTypedArray {
+    assert(IsSafeInteger(length));
+
+    // 1. Let newTypedArray be ? Construct(constructor, argumentList).
+    const newTypedArrayObj = Construct(constructor, length);
+
+    // 2. Perform ? ValidateTypedArray(newTypedArray).
+    //    ValidateTypedArray currently returns the array, not the ViewBuffer.
+    const newTypedArray: JSTypedArray =
+        ValidateTypedArray(context, newTypedArrayObj, methodName);
+
+    if (IsDetachedBuffer(newTypedArray.buffer)) deferred {
+        ThrowTypeError(MessageTemplate::kDetachedOperation, methodName);
+      }
+
+    // 3. If argumentList is a List of a single Number, then
+    //   a. If newTypedArray.[[ArrayLength]] < argumentList[0], throw a
+    //      TypeError exception.
+    if (newTypedArray.length < Convert<uintptr>(length)) deferred {
+        ThrowTypeError(MessageTemplate::kTypedArrayTooShort);
+      }
+
+    // 4. Return newTypedArray.
+    return newTypedArray;
+  }
+
   transitioning macro ConstructByJSReceiver(implicit context:
                                                 Context)(obj: JSReceiver): never
-      labels IfConstructByArrayLike(JSReceiver, Number, JSReceiver) {
+      labels IfConstructByArrayLike(JSReceiver, uintptr, JSReceiver) {
     try {
-      const iteratorMethod: Object =
-          GetIteratorMethod(obj) otherwise IfIteratorUndefined;
-      const iteratorFn: Callable = Cast<Callable>(iteratorMethod)
-          otherwise ThrowTypeError(kIteratorSymbolNonCallable);
-      ConstructByIterable(obj, iteratorFn)
+      // TODO(v8:8906): Use iterator::GetIteratorMethod() once it supports
+      // labels.
+      const iteratorMethod = GetMethod(obj, IteratorSymbolConstant())
+          otherwise IfIteratorUndefined, IfIteratorNotCallable;
+      ConstructByIterable(obj, iteratorMethod)
           otherwise IfConstructByArrayLike;
     }
     label IfIteratorUndefined {
       const lengthObj: JSAny = GetProperty(obj, kLengthString);
-      const length: Smi = ToSmiLength(lengthObj)
-          otherwise goto IfInvalidLength(lengthObj);
+      const lengthNumber: Number = ToLength_Inline(lengthObj);
+      // Throw RangeError here if the length does not fit in uintptr because
+      // such a length will not pass bounds checks in ConstructByArrayLike()
+      // anyway.
+      const length: uintptr = ChangeSafeIntegerNumberToUintPtr(lengthNumber)
+          otherwise goto IfInvalidLength(lengthNumber);
       goto IfConstructByArrayLike(obj, length, GetArrayBufferFunction());
     }
-    label IfInvalidLength(length: Object) {
-      ThrowRangeError(kInvalidTypedArrayLength, length);
+    label IfInvalidLength(length: Number) {
+      ThrowRangeError(MessageTemplate::kInvalidTypedArrayLength, length);
+    }
+    label IfIteratorNotCallable(_value: JSAny) deferred {
+      ThrowTypeError(MessageTemplate::kIteratorSymbolNonCallable);
     }
   }
 
@@ -327,8 +356,7 @@ namespace typed_array_createtypedarray {
 
     // 5. Let elementSize be the Number value of the Element Size value in Table
     // 56 for constructorName.
-    const elementsInfo: typed_array::TypedArrayElementsInfo =
-        typed_array::GetTypedArrayElementsInfo(map);
+    const elementsInfo = GetTypedArrayElementsInfo(map);
 
     try {
       typeswitch (arg1) {
@@ -355,7 +383,7 @@ namespace typed_array_createtypedarray {
       return ConstructByLength(map, length, elementsInfo);
     }
     label IfConstructByArrayLike(
-        arrayLike: JSReceiver, length: Number, bufferConstructor: JSReceiver) {
+        arrayLike: JSReceiver, length: uintptr, bufferConstructor: JSReceiver) {
       return ConstructByArrayLike(
           map, arrayLike, length, elementsInfo, bufferConstructor);
     }
@@ -395,22 +423,36 @@ namespace typed_array_createtypedarray {
         newObj = Construct(constructor, arg0, arg1, arg2);
       }
 
-      return typed_array::ValidateTypedArray(context, newObj, methodName);
+      return ValidateTypedArray(context, newObj, methodName);
     }
   }
 
   @export
   transitioning macro TypedArraySpeciesCreateByLength(implicit context:
                                                           Context)(
-      methodName: constexpr string, exemplar: JSTypedArray,
-      length: PositiveSmi): JSTypedArray {
+      methodName: constexpr string, exemplar: JSTypedArray, length: uintptr):
+      JSTypedArray {
     const numArgs: constexpr int31 = 1;
+    // TODO(v8:4153): pass length further as uintptr.
     const typedArray: JSTypedArray = TypedArraySpeciesCreate(
-        methodName, numArgs, exemplar, length, Undefined, Undefined);
-    if (typedArray.length < Convert<uintptr>(length)) deferred {
-        ThrowTypeError(kTypedArrayTooShort);
+        methodName, numArgs, exemplar, Convert<Number>(length), Undefined,
+        Undefined);
+    if (typedArray.length < length) deferred {
+        ThrowTypeError(MessageTemplate::kTypedArrayTooShort);
       }
+    return typedArray;
+  }
 
+  transitioning macro TypedArraySpeciesCreateByBuffer(implicit context:
+                                                          Context)(
+      methodName: constexpr string, exemplar: JSTypedArray,
+      buffer: JSArrayBuffer, beginByteOffset: uintptr,
+      newLength: uintptr): JSTypedArray {
+    const numArgs: constexpr int31 = 3;
+    // TODO(v8:4153): pass length further as uintptr.
+    const typedArray: JSTypedArray = TypedArraySpeciesCreate(
+        methodName, numArgs, exemplar, buffer, Convert<Number>(beginByteOffset),
+        Convert<Number>(newLength));
     return typedArray;
   }
 }
diff --git a/deps/v8/src/builtins/typed-array-every.tq b/deps/v8/src/builtins/typed-array-every.tq
index 4b4fe72eb18e9f..cba688244b59ea 100644
--- a/deps/v8/src/builtins/typed-array-every.tq
+++ b/deps/v8/src/builtins/typed-array-every.tq
@@ -4,22 +4,23 @@
 
 #include 'src/builtins/builtins-typed-array-gen.h'
 
-namespace typed_array_every {
-  const kBuiltinName: constexpr string = '%TypedArray%.prototype.every';
+namespace typed_array {
+  const kBuiltinNameEvery: constexpr string = '%TypedArray%.prototype.every';
 
   transitioning macro EveryAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
       thisArg: JSAny): Boolean {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    // TODO(v8:4153): Support huge TypedArrays here.
-    const length =
-        Cast<Smi>(Convert<Number>(witness.Get().length)) otherwise unreachable;
-    for (let k: Smi = 0; k < length; k++) {
+    const length: uintptr = witness.Get().length;
+    for (let k: uintptr = 0; k < length; k++) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
       const value: JSAny = witness.Load(k);
-      const result =
-          Call(context, callbackfn, thisArg, value, k, witness.GetStable());
+      // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+      // indices to optimize Convert<Number>(k) for the most common case.
+      const result = Call(
+          context, callbackfn, thisArg, value, Convert<Number>(k),
+          witness.GetStable());
       if (!ToBoolean(result)) {
         return False;
       }
@@ -29,7 +30,7 @@ namespace typed_array_every {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.every
   transitioning javascript builtin
-  TypedArrayPrototypeEvery(js-implicit context: Context, receiver: JSAny)(
+  TypedArrayPrototypeEvery(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = thisArg
@@ -43,13 +44,13 @@ namespace typed_array_every {
       return EveryAllElements(uarray, callbackfn, thisArg);
     }
     label NotCallable deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
     label NotTypedArray deferred {
-      ThrowTypeError(kNotTypedArray, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameEvery);
     }
     label IsDetached deferred {
-      ThrowTypeError(kDetachedOperation, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameEvery);
     }
   }
 }
diff --git a/deps/v8/src/builtins/typed-array-filter.tq b/deps/v8/src/builtins/typed-array-filter.tq
index 66823f29e1ffb8..dd3b4900dc70bf 100644
--- a/deps/v8/src/builtins/typed-array-filter.tq
+++ b/deps/v8/src/builtins/typed-array-filter.tq
@@ -2,43 +2,44 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace typed_array_filter {
-  const kBuiltinName: constexpr string = '%TypedArray%.prototype.filter';
-
-  extern runtime TypedArrayCopyElements(Context, JSTypedArray, Object, Number):
-      void;
+namespace typed_array {
+  const kBuiltinNameFilter: constexpr string = '%TypedArray%.prototype.filter';
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.filter
   transitioning javascript builtin TypedArrayPrototypeFilter(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = thisArg
     try {
       // 1. Let O be the this value.
       // 2. Perform ? ValidateTypedArray(O).
       const array: JSTypedArray = Cast<JSTypedArray>(receiver)
-          otherwise ThrowTypeError(kNotTypedArray, kBuiltinName);
+          otherwise ThrowTypeError(
+          MessageTemplate::kNotTypedArray, kBuiltinNameFilter);
       const src = typed_array::EnsureAttached(array) otherwise IsDetached;
 
       // 3. Let len be O.[[ArrayLength]].
-      // TODO(v8:4153): Support huge TypedArrays here.
-      const len = Cast<Smi>(Convert<Number>(src.length)) otherwise unreachable;
+      const len: uintptr = src.length;
 
       // 4. If IsCallable(callbackfn) is false, throw a TypeError exception.
       const callbackfn = Cast<Callable>(arguments[0])
-          otherwise ThrowTypeError(kCalledNonCallable, arguments[0]);
+          otherwise ThrowTypeError(
+          MessageTemplate::kCalledNonCallable, arguments[0]);
 
       // 5. If thisArg is present, let T be thisArg; else let T be undefined.
       const thisArg: JSAny = arguments[1];
 
       // 6. Let kept be a new empty List.
+      // TODO(v8:4153): Support huge TypedArrays here. (growable fixed arrays
+      // can't be longer than kMaxSmiValue).
       let kept = growable_fixed_array::NewGrowableFixedArray();
       let witness = typed_array::NewAttachedJSTypedArrayWitness(src);
 
       // 7. Let k be 0.
       // 8. Let captured be 0.
       // 9. Repeat, while k < len
-      for (let k: Smi = 0; k < len; k++) {
+      for (let k: uintptr = 0; k < len; k++) {
         witness.Recheck() otherwise IsDetached;
 
         // a. Let Pk be ! ToString(k).
@@ -47,8 +48,11 @@ namespace typed_array_filter {
 
         // c. Let selected be ToBoolean(? Call(callbackfn, T, « kValue, k, O
         // »)).
-        const selected: JSAny =
-            Call(context, callbackfn, thisArg, value, k, witness.GetStable());
+        // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+        // indices to optimize Convert<Number>(k) for the most common case.
+        const selected: JSAny = Call(
+            context, callbackfn, thisArg, value, Convert<Number>(k),
+            witness.GetStable());
 
         // d. If selected is true, then
         //    i. Append kValue to the end of kept.
@@ -59,22 +63,25 @@ namespace typed_array_filter {
       }
 
       // 10. Let A be ? TypedArraySpeciesCreate(O, captured).
-      const lengthSmi = Convert<PositiveSmi>(kept.length);
-      const typedArray: JSTypedArray =
-          typed_array_createtypedarray::TypedArraySpeciesCreateByLength(
-              kBuiltinName, array, lengthSmi);
+      const typedArray: JSTypedArray = TypedArraySpeciesCreateByLength(
+          kBuiltinNameFilter, array, Unsigned(kept.length));
 
       // 11. Let n be 0.
       // 12. For each element e of kept, do
       //   a. Perform ! Set(A, ! ToString(n), e, true).
       //   b. Increment n by 1.
-      TypedArrayCopyElements(context, typedArray, kept.ToJSArray(), lengthSmi);
+      // TODO(v8:4153): Consider passing growable typed array directly to
+      // TypedArrayCopyElements() to avoid JSArray materialization. Or collect
+      // indices instead of values the loop above.
+      const lengthNumber = Convert<Number>(Unsigned(kept.length));
+      TypedArrayCopyElements(
+          context, typedArray, kept.ToJSArray(), lengthNumber);
 
       // 13. Return A.
       return typedArray;
     }
     label IsDetached deferred {
-      ThrowTypeError(kDetachedOperation, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameFilter);
     }
   }
 }
diff --git a/deps/v8/src/builtins/typed-array-find.tq b/deps/v8/src/builtins/typed-array-find.tq
index 9922abdc171c62..ef4954274b2c63 100644
--- a/deps/v8/src/builtins/typed-array-find.tq
+++ b/deps/v8/src/builtins/typed-array-find.tq
@@ -4,22 +4,23 @@
 
 #include 'src/builtins/builtins-typed-array-gen.h'
 
-namespace typed_array_find {
-  const kBuiltinName: constexpr string = '%TypedArray%.prototype.find';
+namespace typed_array {
+  const kBuiltinNameFind: constexpr string = '%TypedArray%.prototype.find';
 
   transitioning macro FindAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
       thisArg: JSAny): JSAny {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    // TODO(v8:4153): Support huge TypedArrays here.
-    const length =
-        Cast<Smi>(Convert<Number>(witness.Get().length)) otherwise unreachable;
-    for (let k: Smi = 0; k < length; k++) {
+    const length: uintptr = witness.Get().length;
+    for (let k: uintptr = 0; k < length; k++) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
       const value: JSAny = witness.Load(k);
-      const result =
-          Call(context, callbackfn, thisArg, value, k, witness.GetStable());
+      // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+      // indices to optimize Convert<Number>(k) for the most common case.
+      const result = Call(
+          context, callbackfn, thisArg, value, Convert<Number>(k),
+          witness.GetStable());
       if (ToBoolean(result)) {
         return value;
       }
@@ -29,7 +30,7 @@ namespace typed_array_find {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.find
   transitioning javascript builtin
-  TypedArrayPrototypeFind(js-implicit context: Context, receiver: JSAny)(
+  TypedArrayPrototypeFind(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = thisArg
@@ -43,13 +44,13 @@ namespace typed_array_find {
       return FindAllElements(uarray, callbackfn, thisArg);
     }
     label NotCallable deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
     label NotTypedArray deferred {
-      ThrowTypeError(kNotTypedArray, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameFind);
     }
     label IsDetached deferred {
-      ThrowTypeError(kDetachedOperation, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameFind);
     }
   }
 }
diff --git a/deps/v8/src/builtins/typed-array-findindex.tq b/deps/v8/src/builtins/typed-array-findindex.tq
index 5438f3dbfe32e3..5af9aede2968a1 100644
--- a/deps/v8/src/builtins/typed-array-findindex.tq
+++ b/deps/v8/src/builtins/typed-array-findindex.tq
@@ -4,24 +4,27 @@
 
 #include 'src/builtins/builtins-typed-array-gen.h'
 
-namespace typed_array_findindex {
-  const kBuiltinName: constexpr string = '%TypedArray%.prototype.findIndex';
+namespace typed_array {
+  const kBuiltinNameFindIndex: constexpr string =
+      '%TypedArray%.prototype.findIndex';
 
   transitioning macro FindIndexAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
       thisArg: JSAny): Number {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    // TODO(v8:4153): Support huge TypedArrays here.
-    const length =
-        Cast<Smi>(Convert<Number>(witness.Get().length)) otherwise unreachable;
-    for (let k: Smi = 0; k < length; k++) {
+    const length: uintptr = witness.Get().length;
+    for (let k: uintptr = 0; k < length; k++) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
       const value: JSAny = witness.Load(k);
-      const result =
-          Call(context, callbackfn, thisArg, value, k, witness.GetStable());
+      // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+      // indices to optimize Convert<Number>(k) for the most common case.
+      const indexNumber: Number = Convert<Number>(k);
+      const result = Call(
+          context, callbackfn, thisArg, value, indexNumber,
+          witness.GetStable());
       if (ToBoolean(result)) {
-        return k;
+        return indexNumber;
       }
     }
     return -1;
@@ -29,8 +32,9 @@ namespace typed_array_findindex {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.findIndex
   transitioning javascript builtin
-  TypedArrayPrototypeFindIndex(js-implicit context: Context, receiver: JSAny)(
-      ...arguments): JSAny {
+  TypedArrayPrototypeFindIndex(
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = thisArg.
     try {
@@ -43,13 +47,14 @@ namespace typed_array_findindex {
       return FindIndexAllElements(uarray, callbackfn, thisArg);
     }
     label NotCallable deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
     label NotTypedArray deferred {
-      ThrowTypeError(kNotTypedArray, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameFindIndex);
     }
     label IsDetached deferred {
-      ThrowTypeError(kDetachedOperation, kBuiltinName);
+      ThrowTypeError(
+          MessageTemplate::kDetachedOperation, kBuiltinNameFindIndex);
     }
   }
 }
diff --git a/deps/v8/src/builtins/typed-array-foreach.tq b/deps/v8/src/builtins/typed-array-foreach.tq
index b1ad894122fa68..dd134174568916 100644
--- a/deps/v8/src/builtins/typed-array-foreach.tq
+++ b/deps/v8/src/builtins/typed-array-foreach.tq
@@ -4,29 +4,33 @@
 
 #include 'src/builtins/builtins-typed-array-gen.h'
 
-namespace typed_array_foreach {
-  const kBuiltinName: constexpr string = '%TypedArray%.prototype.forEach';
+namespace typed_array {
+  const kBuiltinNameForEach: constexpr string =
+      '%TypedArray%.prototype.forEach';
 
   transitioning macro ForEachAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
       thisArg: JSAny): Undefined {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    // TODO(v8:4153): Support huge TypedArrays here.
-    const length =
-        Cast<Smi>(Convert<Number>(witness.Get().length)) otherwise unreachable;
-    for (let k: Smi = 0; k < length; k++) {
+    const length: uintptr = witness.Get().length;
+    for (let k: uintptr = 0; k < length; k++) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
       const value: JSAny = witness.Load(k);
-      Call(context, callbackfn, thisArg, value, k, witness.GetStable());
+      // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+      // indices to optimize Convert<Number>(k) for the most common case.
+      Call(
+          context, callbackfn, thisArg, value, Convert<Number>(k),
+          witness.GetStable());
     }
     return Undefined;
   }
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.every
   transitioning javascript builtin
-  TypedArrayPrototypeForEach(js-implicit context: Context, receiver: JSAny)(
-      ...arguments): Undefined {
+  TypedArrayPrototypeForEach(
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): Undefined {
     // arguments[0] = callback
     // arguments[1] = this_arg.
 
@@ -40,13 +44,13 @@ namespace typed_array_foreach {
       return ForEachAllElements(uarray, callbackfn, thisArg);
     }
     label NotCallable deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
     label NotTypedArray deferred {
-      ThrowTypeError(kNotTypedArray, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameForEach);
     }
     label IsDetached deferred {
-      ThrowTypeError(kDetachedOperation, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameForEach);
     }
   }
 }
diff --git a/deps/v8/src/builtins/typed-array-from.tq b/deps/v8/src/builtins/typed-array-from.tq
new file mode 100644
index 00000000000000..a0c2fa72a86314
--- /dev/null
+++ b/deps/v8/src/builtins/typed-array-from.tq
@@ -0,0 +1,194 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-typed-array-gen.h'
+
+namespace typed_array {
+  const kBuiltinNameFrom: constexpr string = '%TypedArray%.from';
+
+  type BuiltinsName extends int31 constexpr 'Builtins::Name';
+  const kTypedArrayPrototypeValues: constexpr BuiltinsName
+  generates 'Builtins::kTypedArrayPrototypeValues';
+
+  extern builtin IterableToList(implicit context: Context)(JSAny, JSAny):
+      JSArray;
+
+  // %TypedArray%.from ( source [ , mapfn [ , thisArg ] ] )
+  // https://tc39.github.io/ecma262/#sec-%typedarray%.from
+  transitioning javascript builtin
+  TypedArrayFrom(js-implicit context: NativeContext, receiver: JSAny)(
+      ...arguments): JSTypedArray {
+    try {
+      const source: JSAny = arguments[0];
+
+      // 1. Let C be the this value.
+      // 2. If IsConstructor(C) is false, throw a TypeError exception.
+      const constructor = Cast<Constructor>(receiver) otherwise NotConstructor;
+
+      // 3. If mapfn is present and mapfn is not undefined, then
+      //   a. If IsCallable(mapfn) is false, throw a TypeError exception.
+      //   b. Let mapping be true.
+      // 4. Else, let mapping be false.
+      const mapping: bool = arguments.length > 1;
+      const mapfnObj: JSAny = mapping ? arguments[1] : Undefined;
+      if (mapping && !TaggedIsCallable(mapfnObj)) deferred {
+          ThrowTypeError(MessageTemplate::kCalledNonCallable, mapfnObj);
+        }
+
+      // 5. If thisArg is present, let T be thisArg; else let T be undefined.
+      const thisArg = arguments.length > 2 ? arguments[2] : Undefined;
+
+      // We split up this builtin differently to the way it is written in the
+      // spec. We already have great code in the elements accessor for copying
+      // from a JSArray into a TypedArray, so we use that when possible. We only
+      // avoid calling into the elements accessor when we have a mapping
+      // function, because we can't handle that. Here, presence of a mapping
+      // function is the slow path. We also combine the two different loops in
+      // the specification (starting at 7.e and 13) because they are essentially
+      // identical. We also save on code-size this way.
+
+      let finalLength: uintptr;
+      let finalSource: JSAny;
+
+      try {
+        // 6. Let usingIterator be ? GetMethod(source, @@iterator).
+        // TODO(v8:8906): Use iterator::GetIteratorMethod() once it supports
+        // labels.
+        const usingIterator = GetMethod(source, IteratorSymbolConstant())
+            otherwise IteratorIsUndefined, IteratorNotCallable;
+
+        try {
+          // TypedArrays have iterators, so normally we would go through the
+          // IterableToList case below, which would convert the TypedArray to a
+          // JSArray (boxing the values if they won't fit in a Smi).
+          //
+          // However, if we can guarantee that the source object has the
+          // built-in iterator and that the %ArrayIteratorPrototype%.next method
+          // has not been overridden, then we know the behavior of the iterator:
+          // returning the values in the TypedArray sequentially from index 0 to
+          // length-1.
+          //
+          // In this case, we can avoid creating the intermediate array and the
+          // associated HeapNumbers, and use the fast path in
+          // TypedArrayCopyElements which uses the same ordering as the default
+          // iterator.
+          //
+          // Drop through to the default check_iterator behavior if any of these
+          // checks fail.
+          const sourceTypedArray =
+              Cast<JSTypedArray>(source) otherwise UseUserProvidedIterator;
+          const sourceBuffer = sourceTypedArray.buffer;
+          if (IsDetachedBuffer(sourceBuffer)) goto UseUserProvidedIterator;
+
+          // Check that the iterator function is exactly
+          // Builtins::kTypedArrayPrototypeValues.
+          const iteratorFn =
+              Cast<JSFunction>(usingIterator) otherwise UseUserProvidedIterator;
+          if (!TaggedEqual(
+                  iteratorFn.shared_function_info.function_data,
+                  SmiConstant(kTypedArrayPrototypeValues)))
+            goto UseUserProvidedIterator;
+
+          // Check that the ArrayIterator prototype's "next" method hasn't been
+          // overridden.
+          if (IsArrayIteratorProtectorCellInvalid())
+            goto UseUserProvidedIterator;
+
+          // Source is a TypedArray with unmodified iterator behavior. Use the
+          // source object directly, taking advantage of the special-case code
+          // in TypedArrayCopyElements
+          finalLength = sourceTypedArray.length;
+          finalSource = source;
+        }
+        label UseUserProvidedIterator {
+          // 7. If usingIterator is not undefined, then
+          //  a. Let values be ? IterableToList(source, usingIterator).
+          //  b. Let len be the number of elements in values.
+          const values: JSArray = IterableToList(source, usingIterator);
+
+          finalLength = Convert<uintptr>(values.length);
+          finalSource = values;
+        }
+      }
+      label IteratorIsUndefined {
+        // 8. NOTE: source is not an Iterable so assume it is already an
+        // array-like object.
+
+        // 9. Let arrayLike be ! ToObject(source).
+        const arrayLike: JSReceiver = ToObject_Inline(context, source);
+
+        // 10. Let len be ? ToLength(? Get(arrayLike, "length")).
+        const length = GetLengthProperty(arrayLike);
+
+        try {
+          finalLength = ChangeSafeIntegerNumberToUintPtr(length)
+              otherwise IfInvalidLength;
+          finalSource = arrayLike;
+        }
+        label IfInvalidLength deferred {
+          ThrowRangeError(MessageTemplate::kInvalidTypedArrayLength, length);
+        }
+      }
+      label IteratorNotCallable(_value: JSAny) deferred {
+        ThrowTypeError(MessageTemplate::kIteratorSymbolNonCallable);
+      }
+
+      const finalLengthNum = Convert<Number>(finalLength);
+
+      // 7c/11. Let targetObj be ? TypedArrayCreate(C, «len»).
+      const targetObj = TypedArrayCreateByLength(
+          constructor, finalLengthNum, kBuiltinNameFrom);
+
+      if (!mapping) {
+        // Fast path.
+        if (finalLength != 0) {
+          // Call runtime.
+          TypedArrayCopyElements(
+              context, targetObj, finalSource, finalLengthNum);
+        }
+        return targetObj;
+      }
+      // Slow path.
+
+      const mapfn: Callable = Cast<Callable>(mapfnObj) otherwise unreachable;
+      const accessor: TypedArrayAccessor =
+          GetTypedArrayAccessor(targetObj.elements_kind);
+
+      // 7d-7e and 12-13.
+      // 12. Let k be 0.
+      // 13. Repeat, while k < len
+      for (let k: uintptr = 0; k < finalLength; k++) {
+        // 13a. Let Pk be ! ToString(k).
+        const kNum = Convert<Number>(k);
+
+        // 13b. Let kValue be ? Get(arrayLike, Pk).
+        const kValue: JSAny = GetProperty(finalSource, kNum);
+
+        let mappedValue: JSAny;
+        // 13c. If mapping is true, then
+        if (mapping) {
+          // i. Let mappedValue be ? Call(mapfn, T, « kValue, k »).
+          mappedValue = Call(context, mapfn, thisArg, kValue, kNum);
+        } else {
+          // 13d. Else, let mappedValue be kValue.
+          mappedValue = kValue;
+        }
+
+        // 13e. Perform ? Set(targetObj, Pk, mappedValue, true).
+        // Buffer may be detached during executing ToNumber/ToBigInt.
+        accessor.StoreJSAny(context, targetObj, k, mappedValue)
+            otherwise IfDetached;
+
+        // 13f. Set k to k + 1. (done by the loop).
+      }
+      return targetObj;
+    }
+    label NotConstructor deferred {
+      ThrowTypeError(MessageTemplate::kNotConstructor, receiver);
+    }
+    label IfDetached deferred {
+      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameFrom);
+    }
+  }
+}
diff --git a/deps/v8/src/builtins/typed-array-of.tq b/deps/v8/src/builtins/typed-array-of.tq
new file mode 100644
index 00000000000000..c65deeeb150aac
--- /dev/null
+++ b/deps/v8/src/builtins/typed-array-of.tq
@@ -0,0 +1,56 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-typed-array-gen.h'
+
+namespace typed_array {
+  const kBuiltinNameOf: constexpr string = '%TypedArray%.of';
+
+  // %TypedArray%.of ( ...items )
+  // https://tc39.github.io/ecma262/#sec-%typedarray%.of
+  transitioning javascript builtin
+  TypedArrayOf(js-implicit context: NativeContext, receiver: JSAny)(
+      ...arguments): JSTypedArray {
+    try {
+      // 1. Let len be the actual number of arguments passed to this function.
+      const len: uintptr = Unsigned(arguments.length);
+
+      // 2. Let items be the List of arguments passed to this function.
+
+      // 3. Let C be the this value.
+      // 4. If IsConstructor(C) is false, throw a TypeError exception.
+      const constructor = Cast<Constructor>(receiver) otherwise NotConstructor;
+
+      // 5. Let newObj be ? TypedArrayCreate(C, len).
+      const newObj = TypedArrayCreateByLength(
+          constructor, Convert<Number>(len), kBuiltinNameOf);
+
+      const accessor: TypedArrayAccessor =
+          GetTypedArrayAccessor(newObj.elements_kind);
+
+      // 6. Let k be 0.
+      // 7. Repeat, while k < len
+      for (let k: uintptr = 0; k < len; k++) {
+        // 7a. Let kValue be items[k].
+        const kValue: JSAny = arguments[Signed(k)];
+
+        // 7b. Let Pk be ! ToString(k).
+        // 7c. Perform ? Set(newObj, Pk, kValue, true).
+        // Buffer may be detached during executing ToNumber/ToBigInt.
+        accessor.StoreJSAny(context, newObj, k, kValue) otherwise IfDetached;
+
+        // 7d. Increase k by 1. (done by the loop).
+      }
+
+      // 8. Return newObj.
+      return newObj;
+    }
+    label NotConstructor deferred {
+      ThrowTypeError(MessageTemplate::kNotConstructor, receiver);
+    }
+    label IfDetached deferred {
+      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameOf);
+    }
+  }
+}
diff --git a/deps/v8/src/builtins/typed-array-reduce.tq b/deps/v8/src/builtins/typed-array-reduce.tq
index 7f8eeb7de5a9db..a2ff53f65c4f6c 100644
--- a/deps/v8/src/builtins/typed-array-reduce.tq
+++ b/deps/v8/src/builtins/typed-array-reduce.tq
@@ -4,18 +4,16 @@
 
 #include 'src/builtins/builtins-typed-array-gen.h'
 
-namespace typed_array_reduce {
-  const kBuiltinName: constexpr string = '%TypedArray%.prototype.reduce';
+namespace typed_array {
+  const kBuiltinNameReduce: constexpr string = '%TypedArray%.prototype.reduce';
 
   transitioning macro ReduceAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      initialValue: JSAny | TheHole): JSAny {
+      initialValue: JSAny|TheHole): JSAny {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    // TODO(v8:4153): Support huge TypedArrays here.
-    const length =
-        Cast<Smi>(Convert<Number>(witness.Get().length)) otherwise unreachable;
+    const length: uintptr = witness.Get().length;
     let accumulator = initialValue;
-    for (let k: Smi = 0; k < length; k++) {
+    for (let k: uintptr = 0; k < length; k++) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
       const value: JSAny = witness.Load(k);
@@ -24,15 +22,17 @@ namespace typed_array_reduce {
           accumulator = value;
         }
         case (accumulatorNotHole: JSAny): {
+          // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+          // indices to optimize Convert<Number>(k) for the most common case.
           accumulator = Call(
-              context, callbackfn, Undefined, accumulatorNotHole, value, k,
-              witness.GetStable());
+              context, callbackfn, Undefined, accumulatorNotHole, value,
+              Convert<Number>(k), witness.GetStable());
         }
       }
     }
     typeswitch (accumulator) {
       case (TheHole): {
-        ThrowTypeError(kReduceNoInitial, kBuiltinName);
+        ThrowTypeError(MessageTemplate::kReduceNoInitial, kBuiltinNameReduce);
       }
       case (accumulator: JSAny): {
         return accumulator;
@@ -42,8 +42,9 @@ namespace typed_array_reduce {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.reduce
   transitioning javascript builtin
-  TypedArrayPrototypeReduce(js-implicit context: Context, receiver: JSAny)(
-      ...arguments): JSAny {
+  TypedArrayPrototypeReduce(
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = initialValue.
     try {
@@ -56,13 +57,13 @@ namespace typed_array_reduce {
       return ReduceAllElements(uarray, callbackfn, initialValue);
     }
     label NotCallable deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
     label NotTypedArray deferred {
-      ThrowTypeError(kNotTypedArray, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameReduce);
     }
     label IsDetached deferred {
-      ThrowTypeError(kDetachedOperation, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameReduce);
     }
   }
 }
diff --git a/deps/v8/src/builtins/typed-array-reduceright.tq b/deps/v8/src/builtins/typed-array-reduceright.tq
index c8e4fe83d367fd..ab334a1b8667e9 100644
--- a/deps/v8/src/builtins/typed-array-reduceright.tq
+++ b/deps/v8/src/builtins/typed-array-reduceright.tq
@@ -4,18 +4,17 @@
 
 #include 'src/builtins/builtins-typed-array-gen.h'
 
-namespace typed_array_reduceright {
-  const kBuiltinName: constexpr string = '%TypedArray%.prototype.reduceRight';
+namespace typed_array {
+  const kBuiltinNameReduceRight: constexpr string =
+      '%TypedArray%.prototype.reduceRight';
 
   transitioning macro ReduceRightAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      initialValue: JSAny | TheHole): JSAny {
+      initialValue: JSAny|TheHole): JSAny {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    // TODO(v8:4153): Support huge TypedArrays here.
-    const length =
-        Cast<Smi>(Convert<Number>(witness.Get().length)) otherwise unreachable;
+    const length: uintptr = witness.Get().length;
     let accumulator = initialValue;
-    for (let k: Smi = length - 1; k >= 0; k--) {
+    for (let k: uintptr = length; k-- > 0;) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
       const value: JSAny = witness.Load(k);
@@ -24,15 +23,18 @@ namespace typed_array_reduceright {
           accumulator = value;
         }
         case (accumulatorNotHole: JSAny): {
+          // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+          // indices to optimize Convert<Number>(k) for the most common case.
           accumulator = Call(
-              context, callbackfn, Undefined, accumulatorNotHole, value, k,
-              witness.GetStable());
+              context, callbackfn, Undefined, accumulatorNotHole, value,
+              Convert<Number>(k), witness.GetStable());
         }
       }
     }
     typeswitch (accumulator) {
       case (TheHole): {
-        ThrowTypeError(kReduceNoInitial, kBuiltinName);
+        ThrowTypeError(
+            MessageTemplate::kReduceNoInitial, kBuiltinNameReduceRight);
       }
       case (accumulator: JSAny): {
         return accumulator;
@@ -42,8 +44,9 @@ namespace typed_array_reduceright {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.reduceright
   transitioning javascript builtin
-  TypedArrayPrototypeReduceRight(js-implicit context: Context, receiver: JSAny)(
-      ...arguments): JSAny {
+  TypedArrayPrototypeReduceRight(
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = initialValue.
     try {
@@ -57,13 +60,14 @@ namespace typed_array_reduceright {
       return ReduceRightAllElements(uarray, callbackfn, initialValue);
     }
     label NotCallable deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
     label NotTypedArray deferred {
-      ThrowTypeError(kNotTypedArray, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameReduceRight);
     }
     label IsDetached deferred {
-      ThrowTypeError(kDetachedOperation, kBuiltinName);
+      ThrowTypeError(
+          MessageTemplate::kDetachedOperation, kBuiltinNameReduceRight);
     }
   }
 }
diff --git a/deps/v8/src/builtins/typed-array-set.tq b/deps/v8/src/builtins/typed-array-set.tq
new file mode 100644
index 00000000000000..bb70692e766b92
--- /dev/null
+++ b/deps/v8/src/builtins/typed-array-set.tq
@@ -0,0 +1,319 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-typed-array-gen.h'
+
+namespace typed_array {
+  const kBuiltinNameSet: constexpr string = '%TypedArray%.prototype.set';
+
+  extern runtime TypedArraySet(Context, JSTypedArray, Object, Number, Number):
+      void;
+
+  extern macro
+  TypedArrayBuiltinsAssembler::CallCCopyFastNumberJSArrayElementsToTypedArray(
+      Context,
+      FastJSArray,           // source
+      AttachedJSTypedArray,  // dest
+      uintptr,               // sourceLength
+      uintptr                // destOffset
+      ): void;
+
+  extern macro
+  TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsToTypedArray(
+      AttachedJSTypedArray,  // source
+      AttachedJSTypedArray,  // dest
+      uintptr,               // sourceLength
+      uintptr                // destOffset
+      ): void;
+
+  // %TypedArray%.prototype.set ( overloaded [ , offset ] )
+  // https://tc39.es/ecma262/#sec-%typedarray%.prototype.set-overloaded-offset
+  transitioning javascript builtin
+  TypedArrayPrototypeSet(js-implicit context: NativeContext, receiver: JSAny)(
+      ...arguments): JSAny {
+    // Steps 2-8 are the same for
+    // %TypedArray%.prototype.set ( array [ , offset ] ) and
+    // %TypedArray%.prototype.set ( typedArray [ , offset ] ) overloads.
+
+    let target: JSTypedArray;
+    try {
+      // 2. Let target be the this value.
+      // 3. Perform ? RequireInternalSlot(target, [[TypedArrayName]]).
+      // 4. Assert: target has a [[ViewedArrayBuffer]] internal slot.
+      target = Cast<JSTypedArray>(receiver) otherwise NotTypedArray;
+    }
+    label NotTypedArray deferred {
+      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameSet);
+    }
+
+    try {
+      // 5. Let targetOffset be ? ToInteger(offset).
+      // 6. If targetOffset < 0, throw a RangeError exception.
+      let targetOffsetOverflowed: bool = false;
+      let targetOffset: uintptr = 0;
+      if (arguments.length > 1) {
+        const offsetArg = arguments[1];
+        try {
+          targetOffset = ToUintPtr(offsetArg)
+          // On values less than zero throw RangeError immediately.
+              otherwise OffsetOutOfBounds,
+              // On UintPtr or SafeInteger range overflow throw RangeError after
+              // performing observable steps to follow the spec.
+              OffsetOverflow, OffsetOverflow;
+        }
+        label OffsetOverflow {
+          targetOffsetOverflowed = true;
+        }
+      } else {
+        // If the offset argument is not provided then the targetOffset is 0.
+      }
+
+      // 7. Let targetBuffer be target.[[ViewedArrayBuffer]].
+      // 8. If IsDetachedBuffer(targetBuffer) is true, throw a TypeError
+      //   exception.
+      const utarget = typed_array::EnsureAttached(target) otherwise IsDetached;
+
+      const overloadedArg = arguments[0];
+      try {
+        // 1. Choose 22.2.3.23.2 or 22.2.3.23.1 depending on whether the
+        //   overloadedArg has a [[TypedArrayName]] internal slot.
+        //   If it does, the definition in 22.2.3.23.2 applies.
+        //   If it does not, the definition in 22.2.3.23.1 applies.
+        const typedArray =
+            Cast<JSTypedArray>(overloadedArg) otherwise NotTypedArray;
+
+        // Step 9 is not observable, do it later.
+
+        // 10. Let srcBuffer be typedArray.[[ViewedArrayBuffer]].
+        // 11. If IsDetachedBuffer(srcBuffer) is true, throw a TypeError
+        //   exception.
+        const utypedArray =
+            typed_array::EnsureAttached(typedArray) otherwise IsDetached;
+
+        TypedArrayPrototypeSetTypedArray(
+            utarget, utypedArray, targetOffset, targetOffsetOverflowed)
+            otherwise OffsetOutOfBounds;
+        return Undefined;
+      }
+      label NotTypedArray deferred {
+        TypedArrayPrototypeSetArray(
+            utarget, overloadedArg, targetOffset, targetOffsetOverflowed)
+            otherwise OffsetOutOfBounds, IsDetached;
+        return Undefined;
+      }
+    }
+    label OffsetOutOfBounds deferred {
+      ThrowRangeError(MessageTemplate::kTypedArraySetOffsetOutOfBounds);
+    }
+    label IsDetached deferred {
+      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameSet);
+    }
+  }
+
+  // %TypedArray%.prototype.set ( array [ , offset ] )
+  // https://tc39.es/ecma262/#sec-%typedarray%.prototype.set-array-offset
+  transitioning macro
+  TypedArrayPrototypeSetArray(implicit context: Context, receiver: JSAny)(
+      target: JSTypedArray, arrayArg: JSAny, targetOffset: uintptr,
+      targetOffsetOverflowed: bool): void labels IfOffsetOutOfBounds,
+      IfDetached {
+    // Steps 9-13 are not observable, do them later.
+
+    // TODO(v8:8906): This ported behaviour is an observable spec violation and
+    // the comment below seems to be outdated. Consider removing this code.
+    try {
+      const _arrayArgNum = Cast<Number>(arrayArg) otherwise NotNumber;
+      // For number as a first argument, throw TypeError instead of silently
+      // ignoring the call, so that users know they did something wrong.
+      // (Consistent with Firefox and Blink/WebKit)
+      ThrowTypeError(MessageTemplate::kInvalidArgument);
+    }
+    label NotNumber {
+      // Proceed to step 14.
+    }
+
+    // 14. Let src be ? ToObject(array).
+    const src: JSReceiver = ToObject_Inline(context, arrayArg);
+
+    // 15. Let srcLength be ? LengthOfArrayLike(src).
+    const srcLengthNum: Number = GetLengthProperty(src);
+
+    if (targetOffsetOverflowed) goto IfOffsetOutOfBounds;
+
+    // 9. Let targetLength be target.[[ArrayLength]].
+    const targetLength = target.length;
+
+    // 16. If srcLength + targetOffset > targetLength, throw a RangeError
+    //   exception.
+    const srcLength = ChangeSafeIntegerNumberToUintPtr(srcLengthNum)
+        otherwise IfOffsetOutOfBounds;
+    CheckIntegerIndexAdditionOverflow(srcLength, targetOffset, targetLength)
+        otherwise IfOffsetOutOfBounds;
+
+    // All the obvervable side effects are executed, so there's nothing else
+    // to do with the empty source array.
+    if (srcLength == 0) return;
+
+    // 10. Let targetName be the String value of target.[[TypedArrayName]].
+    // 11. Let targetElementSize be the Element Size value specified in
+    //   Table 62 for targetName.
+    // 12. Let targetType be the Element Type value in Table 62 for
+    //   targetName.
+
+    try {
+      // BigInt typed arrays are not handled by
+      // CopyFastNumberJSArrayElementsToTypedArray.
+      if (IsBigInt64ElementsKind(target.elements_kind)) goto IfSlow;
+
+      const fastSrc: FastJSArray = Cast<FastJSArray>(src) otherwise goto IfSlow;
+      const srcKind: ElementsKind = fastSrc.map.elements_kind;
+
+      // CopyFastNumberJSArrayElementsToTypedArray() can be used only with the
+      // following elements kinds:
+      // PACKED_SMI_ELEMENTS, HOLEY_SMI_ELEMENTS, PACKED_DOUBLE_ELEMENTS,
+      // HOLEY_DOUBLE_ELEMENTS.
+      if (IsElementsKindInRange(
+              srcKind, ElementsKind::PACKED_SMI_ELEMENTS,
+              ElementsKind::HOLEY_SMI_ELEMENTS) ||
+          IsElementsKindInRange(
+              srcKind, ElementsKind::PACKED_DOUBLE_ELEMENTS,
+              ElementsKind::HOLEY_DOUBLE_ELEMENTS)) {
+        const utarget =
+            typed_array::EnsureAttached(target) otherwise IfDetached;
+        CallCCopyFastNumberJSArrayElementsToTypedArray(
+            context, fastSrc, utarget, srcLength, targetOffset);
+
+      } else {
+        goto IfSlow;
+      }
+    }
+    label IfSlow deferred {
+      TypedArraySet(
+          context, target, src, srcLengthNum, Convert<Number>(targetOffset));
+    }
+  }
+
+  // %TypedArray%.prototype.set ( typedArray [ , offset ] )
+  // https://tc39.es/ecma262/#sec-%typedarray%.prototype.set-typedarray-offset
+  transitioning macro
+  TypedArrayPrototypeSetTypedArray(implicit context: Context, receiver: JSAny)(
+      target: AttachedJSTypedArray, typedArray: AttachedJSTypedArray,
+      targetOffset: uintptr,
+      targetOffsetOverflowed: bool): void labels IfOffsetOutOfBounds {
+    // Steps 12-20 are not observable, so we can handle offset overflow
+    // at step 21 here.
+    if (targetOffsetOverflowed) goto IfOffsetOutOfBounds;
+
+    // 9. Let targetLength be target.[[ArrayLength]].
+    const targetLength = target.length;
+
+    // 19. Let srcLength be typedArray.[[ArrayLength]].
+    const srcLength: uintptr = typedArray.length;
+
+    // Steps 12-20 are not observable, so we can do step 21 here.
+
+    // 21. If srcLength + targetOffset > targetLength, throw a RangeError
+    //   exception.
+    CheckIntegerIndexAdditionOverflow(srcLength, targetOffset, targetLength)
+        otherwise IfOffsetOutOfBounds;
+
+    // 12. Let targetName be the String value of target.[[TypedArrayName]].
+    // 13. Let targetType be the Element Type value in Table 62 for
+    //   targetName.
+    // 14. Let targetElementSize be the Element Size value specified in
+    //   Table 62 for targetName.
+    const targetElementsInfo = GetTypedArrayElementsInfo(target);
+
+    // 16. Let srcName be the String value of typedArray.[[TypedArrayName]].
+    // 17. Let srcType be the Element Type value in Table 62 for srcName.
+    // 18. Let srcElementSize be the Element Size value specified in
+    //   Table 62 for srcName.
+    const srcKind: ElementsKind = typedArray.elements_kind;
+    // const srcElementsInfo = GetTypedArrayElementsInfo(typedArray);
+
+    // We skip steps 23-25 because both memmove and
+    // CopyTypedArrayElementsToTypedArray() properly handle overlapping
+    // regions.
+
+    // 23. If both IsSharedArrayBuffer(srcBuffer) and
+    //   IsSharedArrayBuffer(targetBuffer) are true, then
+    // 23a. If srcBuffer.[[ArrayBufferData]] and
+    //   targetBuffer.[[ArrayBufferData]] are the same Shared Data Block
+    //   values, let same be true; else let same be false.
+    // 24. Else, let same be SameValue(srcBuffer, targetBuffer).
+    // 25. If same is true, then
+    //   a. Let srcByteLength be typedArray.[[ByteLength]].
+    //   b. Set srcBuffer to ? CloneArrayBuffer(srcBuffer, srcByteOffset,
+    //    srcByteLength, %ArrayBuffer%).
+    //   c. NOTE: %ArrayBuffer% is used to clone srcBuffer because is it known
+    //    to not have any observable side-effects.
+    //   d. Let srcByteIndex be 0.
+
+    try {
+      // Use memmove if possible.
+      if (srcKind != targetElementsInfo.kind) {
+        // Uint8/Uint8Clamped elements could still be copied with memmove.
+        if (!IsUint8ElementsKind(srcKind) ||
+            !IsUint8ElementsKind(targetElementsInfo.kind)) {
+          goto IfSlow;
+        }
+      }
+
+      // All the obvervable side effects are executed, so there's nothing else
+      // to do with the empty source array.
+      if (srcLength == 0) return;
+
+      // Source and destination typed arrays have same elements kinds (modulo
+      // Uint8-Uint8Clamped difference) so we can use targetElementsInfo for
+      // calculations.
+      const countBytes: uintptr =
+          targetElementsInfo.CalculateByteLength(srcLength)
+          otherwise unreachable;
+      const startOffset: uintptr =
+          targetElementsInfo.CalculateByteLength(targetOffset)
+          otherwise unreachable;
+      const dstPtr: RawPtr = target.data_ptr + Convert<intptr>(startOffset);
+
+      assert(countBytes <= target.byte_length - startOffset);
+      assert(countBytes <= typedArray.byte_length);
+
+      // 29. If srcType is the same as targetType, then
+      //   a. NOTE: If srcType and targetType are the same, the transfer must
+      //      be performed in a manner that preserves the bit-level encoding of
+      //      the source data.
+      //   b. Repeat, while targetByteIndex < limit
+      //      i. Let value be GetValueFromBuffer(srcBuffer, srcByteIndex, Uint8,
+      //                                         true, Unordered).
+      //     ii. Perform SetValueInBuffer(targetBuffer, targetByteIndex, Uint8,
+      //                                  value, true, Unordered).
+      //    iii. Set srcByteIndex to srcByteIndex + 1.
+      //     iv. Set targetByteIndex to targetByteIndex + 1.
+      CallCMemmove(dstPtr, typedArray.data_ptr, countBytes);
+    }
+    label IfSlow deferred {
+      // 22. If target.[[ContentType]] is not equal to
+      //   typedArray.[[ContentType]], throw a TypeError exception.
+      if (IsBigInt64ElementsKind(srcKind) !=
+          IsBigInt64ElementsKind(targetElementsInfo.kind))
+        deferred {
+          ThrowTypeError(MessageTemplate::kBigIntMixedTypes);
+        }
+
+      // All the obvervable side effects are executed, so there's nothing else
+      // to do with the empty source array.
+      if (srcLength == 0) return;
+
+      // 30. Else,
+      //   a. Repeat, while targetByteIndex < limit
+      //      i. Let value be GetValueFromBuffer(srcBuffer, srcByteIndex,
+      //                                         srcType, true, Unordered).
+      //     ii. Perform SetValueInBuffer(targetBuffer, targetByteIndex,
+      //                                  targetType, value, true, Unordered).
+      //    iii. Set srcByteIndex to srcByteIndex + srcElementSize.
+      //     iv. Set targetByteIndex to targetByteIndex + targetElementSize.
+      CallCCopyTypedArrayElementsToTypedArray(
+          typedArray, target, srcLength, targetOffset);
+    }
+  }
+}
diff --git a/deps/v8/src/builtins/typed-array-slice.tq b/deps/v8/src/builtins/typed-array-slice.tq
index d17ff4a3756b1c..578c2d017ada71 100644
--- a/deps/v8/src/builtins/typed-array-slice.tq
+++ b/deps/v8/src/builtins/typed-array-slice.tq
@@ -4,15 +4,15 @@
 
 #include 'src/builtins/builtins-typed-array-gen.h'
 
-namespace typed_array_slice {
-  const kBuiltinName: constexpr string = '%TypedArray%.prototype.slice';
+namespace typed_array {
+  const kBuiltinNameSlice: constexpr string = '%TypedArray%.prototype.slice';
 
   extern macro TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsSlice(
-      JSTypedArray, JSTypedArray, intptr, intptr): void;
+      JSTypedArray, JSTypedArray, uintptr, uintptr): void;
 
   macro FastCopy(
-      src: typed_array::AttachedJSTypedArray, dest: JSTypedArray, k: intptr,
-      count: PositiveSmi) labels IfSlow {
+      src: typed_array::AttachedJSTypedArray, dest: JSTypedArray, k: uintptr,
+      count: uintptr) labels IfSlow {
     if (IsForceSlowPath()) goto IfSlow;
 
     const srcKind: ElementsKind = src.elements_kind;
@@ -27,10 +27,9 @@ namespace typed_array_slice {
       goto IfSlow;
     }
 
-    const countBytes: uintptr =
-        destInfo.CalculateByteLength(count) otherwise unreachable;
-    const startOffset: uintptr =
-        destInfo.CalculateByteLength(Convert<PositiveSmi>(k))
+    const countBytes: uintptr = destInfo.CalculateByteLength(count)
+        otherwise unreachable;
+    const startOffset: uintptr = destInfo.CalculateByteLength(k)
         otherwise unreachable;
     const srcPtr: RawPtr = src.data_ptr + Convert<intptr>(startOffset);
 
@@ -41,11 +40,11 @@ namespace typed_array_slice {
   }
 
   macro SlowCopy(implicit context: Context)(
-      src: JSTypedArray, dest: JSTypedArray, k: intptr, final: intptr) {
+      src: JSTypedArray, dest: JSTypedArray, k: uintptr, final: uintptr) {
     if (typed_array::IsBigInt64ElementsKind(src.elements_kind) !=
         typed_array::IsBigInt64ElementsKind(dest.elements_kind))
       deferred {
-        ThrowTypeError(kBigIntMixedTypes);
+        ThrowTypeError(MessageTemplate::kBigIntMixedTypes);
       }
 
     CallCCopyTypedArrayElementsSlice(src, dest, k, final);
@@ -53,23 +52,24 @@ namespace typed_array_slice {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.slice
   transitioning javascript builtin TypedArrayPrototypeSlice(
-      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSAny {
     // arguments[0] = start
     // arguments[1] = end
 
     // 1. Let O be the this value.
     // 2. Perform ? ValidateTypedArray(O).
     const src: JSTypedArray =
-        typed_array::ValidateTypedArray(context, receiver, kBuiltinName);
+        ValidateTypedArray(context, receiver, kBuiltinNameSlice);
 
     // 3. Let len be O.[[ArrayLength]].
-    const len = Convert<intptr>(src.length);
+    const len: uintptr = src.length;
 
     // 4. Let relativeStart be ? ToInteger(start).
     // 5. If relativeStart < 0, let k be max((len + relativeStart), 0);
     //    else let k be min(relativeStart, len).
     const start = arguments[0];
-    const k: intptr =
+    const k: uintptr =
         start != Undefined ? ConvertToRelativeIndex(start, len) : 0;
 
     // 6. If end is undefined, let relativeEnd be len;
@@ -77,16 +77,15 @@ namespace typed_array_slice {
     // 7. If relativeEnd < 0, let final be max((len + relativeEnd), 0);
     //    else let final be min(relativeEnd, len).
     const end = arguments[1];
-    const final: intptr =
+    const final: uintptr =
         end != Undefined ? ConvertToRelativeIndex(end, len) : len;
 
     // 8. Let count be max(final - k, 0).
-    const count = Convert<PositiveSmi>(IntPtrMax(final - k, 0));
+    const count: uintptr = Unsigned(IntPtrMax(Signed(final - k), 0));
 
     // 9. Let A be ? TypedArraySpeciesCreate(O, « count »).
     const dest: JSTypedArray =
-        typed_array_createtypedarray::TypedArraySpeciesCreateByLength(
-            kBuiltinName, src, count);
+        TypedArraySpeciesCreateByLength(kBuiltinNameSlice, src, count);
 
     if (count > 0) {
       try {
@@ -95,7 +94,7 @@ namespace typed_array_slice {
         FastCopy(srcAttached, dest, k, count) otherwise IfSlow;
       }
       label IfDetached deferred {
-        ThrowTypeError(kDetachedOperation, kBuiltinName);
+        ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameSlice);
       }
       label IfSlow deferred {
         SlowCopy(src, dest, k, final);
diff --git a/deps/v8/src/builtins/typed-array-some.tq b/deps/v8/src/builtins/typed-array-some.tq
index 7d08b1433b5d69..a09ce964d58a0d 100644
--- a/deps/v8/src/builtins/typed-array-some.tq
+++ b/deps/v8/src/builtins/typed-array-some.tq
@@ -4,22 +4,23 @@
 
 #include 'src/builtins/builtins-typed-array-gen.h'
 
-namespace typed_array_some {
-  const kBuiltinName: constexpr string = '%TypedArray%.prototype.some';
+namespace typed_array {
+  const kBuiltinNameSome: constexpr string = '%TypedArray%.prototype.some';
 
   transitioning macro SomeAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
       thisArg: JSAny): Boolean {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    // TODO(v8:4153): Support huge TypedArrays here.
-    const length =
-        Cast<Smi>(Convert<Number>(witness.Get().length)) otherwise unreachable;
-    for (let k: Smi = 0; k < length; k++) {
+    const length: uintptr = witness.Get().length;
+    for (let k: uintptr = 0; k < length; k++) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
       const value: JSAny = witness.Load(k);
-      const result =
-          Call(context, callbackfn, thisArg, value, k, witness.GetStable());
+      // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+      // indices to optimize Convert<Number>(k) for the most common case.
+      const result = Call(
+          context, callbackfn, thisArg, value, Convert<Number>(k),
+          witness.GetStable());
       if (ToBoolean(result)) {
         return True;
       }
@@ -29,7 +30,7 @@ namespace typed_array_some {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.some
   transitioning javascript builtin
-  TypedArrayPrototypeSome(js-implicit context: Context, receiver: JSAny)(
+  TypedArrayPrototypeSome(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = thisArg.
@@ -43,13 +44,13 @@ namespace typed_array_some {
       return SomeAllElements(uarray, callbackfn, thisArg);
     }
     label NotCallable deferred {
-      ThrowTypeError(kCalledNonCallable, arguments[0]);
+      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
     }
     label NotTypedArray deferred {
-      ThrowTypeError(kNotTypedArray, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameSome);
     }
     label IsDetached deferred {
-      ThrowTypeError(kDetachedOperation, kBuiltinName);
+      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameSome);
     }
   }
 }
diff --git a/deps/v8/src/builtins/typed-array-sort.tq b/deps/v8/src/builtins/typed-array-sort.tq
new file mode 100644
index 00000000000000..171068761d6747
--- /dev/null
+++ b/deps/v8/src/builtins/typed-array-sort.tq
@@ -0,0 +1,145 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-typed-array-gen.h'
+
+namespace typed_array {
+  const kBuiltinNameSort: constexpr string = '%TypedArray%.prototype.sort';
+
+  extern runtime TypedArraySortFast(Context, JSAny): JSTypedArray;
+
+  transitioning macro CallCompare(
+      implicit context: Context, array: JSTypedArray,
+      comparefn: Callable)(a: JSAny, b: JSAny): Number {
+    // a. Let v be ? ToNumber(? Call(comparefn, undefined, x, y)).
+    const v: Number =
+        ToNumber_Inline(Call(context, comparefn, Undefined, a, b));
+
+    // b. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+    if (IsDetachedBuffer(array.buffer)) {
+      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameSort);
+    }
+
+    // c. If v is NaN, return +0.
+    if (NumberIsNaN(v)) return 0;
+
+    // d. return v.
+    return v;
+  }
+
+  // Merges two sorted runs [from, middle) and [middle, to)
+  // from "source" into "target".
+  transitioning macro
+  TypedArrayMerge(
+      implicit context: Context, array: JSTypedArray, comparefn: Callable)(
+      source: FixedArray, from: uintptr, middle: uintptr, to: uintptr,
+      target: FixedArray) {
+    let left: uintptr = from;
+    let right: uintptr = middle;
+
+    for (let targetIndex: uintptr = from; targetIndex < to; ++targetIndex) {
+      if (left < middle && right >= to) {
+        // If the left run has elements, but the right does not, we take
+        // from the left.
+        target.objects[targetIndex] = source.objects[left++];
+      } else if (left < middle) {
+        // If both have elements, we need to compare.
+        const leftElement = UnsafeCast<JSAny>(source.objects[left]);
+        const rightElement = UnsafeCast<JSAny>(source.objects[right]);
+        if (CallCompare(leftElement, rightElement) <= 0) {
+          target.objects[targetIndex] = leftElement;
+          left++;
+        } else {
+          target.objects[targetIndex] = rightElement;
+          right++;
+        }
+      } else {
+        // No elements on the left, but the right does, so we take
+        // from the right.
+        assert(left == middle);
+        target.objects[targetIndex] = source.objects[right++];
+      }
+    }
+  }
+
+  transitioning builtin
+  TypedArrayMergeSort(implicit context: Context)(
+      source: FixedArray, from: uintptr, to: uintptr, target: FixedArray,
+      array: JSTypedArray, comparefn: Callable): JSAny {
+    assert(to - from > 1);
+    const middle: uintptr = from + ((to - from) >>> 1);
+
+    // On the next recursion step source becomes target and vice versa.
+    // This saves the copy of the relevant range from the original
+    // array into a work array on each recursion step.
+    if (middle - from > 1) {
+      TypedArrayMergeSort(target, from, middle, source, array, comparefn);
+    }
+    if (to - middle > 1) {
+      TypedArrayMergeSort(target, middle, to, source, array, comparefn);
+    }
+
+    TypedArrayMerge(source, from, middle, to, target);
+
+    return Undefined;
+  }
+
+  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.sort
+  transitioning javascript builtin TypedArrayPrototypeSort(
+      js-implicit context: NativeContext,
+      receiver: JSAny)(...arguments): JSTypedArray {
+    // 1. If comparefn is not undefined and IsCallable(comparefn) is false,
+    //    throw a TypeError exception.
+    const comparefnObj: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
+    if (comparefnObj != Undefined && !TaggedIsCallable(comparefnObj)) {
+      ThrowTypeError(MessageTemplate::kBadSortComparisonFunction, comparefnObj);
+    }
+
+    // 2. Let obj be the this value.
+    const obj: JSAny = receiver;
+
+    // 3. Let buffer be ? ValidateTypedArray(obj).
+    //    ValidateTypedArray currently returns the array, not the ViewBuffer.
+    const array: JSTypedArray =
+        ValidateTypedArray(context, obj, kBuiltinNameSort);
+
+    // 4. Let len be obj.[[ArrayLength]].
+    const len: uintptr = array.length;
+
+    // Arrays of length 1 or less are considered sorted.
+    if (len < 2) return array;
+
+    // Default sorting is done in C++ using std::sort
+    if (comparefnObj == Undefined) {
+      return TypedArraySortFast(context, obj);
+    }
+
+    const comparefn: Callable =
+        Cast<Callable>(comparefnObj) otherwise unreachable;
+    const accessor: TypedArrayAccessor =
+        GetTypedArrayAccessor(array.elements_kind);
+
+    // Prepare the two work arrays. All numbers are converted to tagged
+    // objects first, and merge sorted between the two FixedArrays.
+    // The result is then written back into the JSTypedArray.
+    const work1: FixedArray = AllocateZeroedFixedArray(Convert<intptr>(len));
+    const work2: FixedArray = AllocateZeroedFixedArray(Convert<intptr>(len));
+
+    for (let i: uintptr = 0; i < len; ++i) {
+      const element: Numeric = accessor.LoadNumeric(context, array, i);
+      work1.objects[i] = element;
+      work2.objects[i] = element;
+    }
+
+    TypedArrayMergeSort(work2, 0, len, work1, array, comparefn);
+
+    // work1 contains the sorted numbers. Write them back.
+    for (let i: uintptr = 0; i < len; ++i) {
+      accessor.StoreNumeric(
+          context, array, i, UnsafeCast<Numeric>(work1.objects[i]));
+    }
+
+    return array;
+  }
+}
diff --git a/deps/v8/src/builtins/typed-array-subarray.tq b/deps/v8/src/builtins/typed-array-subarray.tq
index 589e67230c8dc8..c0adc5f19e3959 100644
--- a/deps/v8/src/builtins/typed-array-subarray.tq
+++ b/deps/v8/src/builtins/typed-array-subarray.tq
@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-namespace typed_array_subarray {
+namespace typed_array {
   // ES %TypedArray%.prototype.subarray
   transitioning javascript builtin TypedArrayPrototypeSubArray(
-      js-implicit context: Context,
+      js-implicit context: NativeContext,
       receiver: JSAny)(...arguments): JSTypedArray {
     const methodName: constexpr string = '%TypedArray%.prototype.subarray';
 
@@ -13,20 +13,21 @@ namespace typed_array_subarray {
     // 3. If O does not have a [[TypedArrayName]] internal slot, throw a
     // TypeError exception.
     const source = Cast<JSTypedArray>(receiver)
-        otherwise ThrowTypeError(kIncompatibleMethodReceiver, methodName);
+        otherwise ThrowTypeError(
+        MessageTemplate::kIncompatibleMethodReceiver, methodName);
 
     // 5. Let buffer be O.[[ViewedArrayBuffer]].
     const buffer = typed_array::GetBuffer(source);
 
     // 6. Let srcLength be O.[[ArrayLength]].
-    const srcLength = Convert<intptr>(source.length);
+    const srcLength: uintptr = source.length;
 
     // 7. Let relativeBegin be ? ToInteger(begin).
     // 8. If relativeBegin < 0, let beginIndex be max((srcLength +
     // relativeBegin), 0); else let beginIndex be min(relativeBegin,
     // srcLength).
     const arg0 = arguments[0];
-    const begin: intptr =
+    const begin: uintptr =
         arg0 != Undefined ? ConvertToRelativeIndex(arg0, srcLength) : 0;
 
     // 9. If end is undefined, let relativeEnd be srcLength;
@@ -34,11 +35,11 @@ namespace typed_array_subarray {
     // 10. If relativeEnd < 0, let endIndex be max((srcLength + relativeEnd),
     // 0); else let endIndex be min(relativeEnd, srcLength).
     const arg1 = arguments[1];
-    const end: intptr =
+    const end: uintptr =
         arg1 != Undefined ? ConvertToRelativeIndex(arg1, srcLength) : srcLength;
 
     // 11. Let newLength be max(endIndex - beginIndex, 0).
-    const newLength = Convert<PositiveSmi>(IntPtrMax(end - begin, 0));
+    const newLength: uintptr = Unsigned(IntPtrMax(Signed(end - begin), 0));
 
     // 12. Let constructorName be the String value of O.[[TypedArrayName]].
     // 13. Let elementSize be the Number value of the Element Size value
@@ -49,16 +50,13 @@ namespace typed_array_subarray {
     const srcByteOffset: uintptr = source.byte_offset;
 
     // 15. Let beginByteOffset be srcByteOffset + beginIndex × elementSize.
-    const beginByteOffset = srcByteOffset +
-        elementsInfo.CalculateByteLength(Convert<PositiveSmi>(begin))
-        otherwise ThrowRangeError(kInvalidArrayBufferLength);
+    const beginByteOffset =
+        srcByteOffset + elementsInfo.CalculateByteLength(begin)
+        otherwise ThrowRangeError(MessageTemplate::kInvalidArrayBufferLength);
 
     // 16. Let argumentsList be « buffer, beginByteOffset, newLength ».
-    const beginByteOffsetNum = Convert<Number>(beginByteOffset);
-
     // 17. Return ? TypedArraySpeciesCreate(O, argumentsList).
-    const numArgs: constexpr int31 = 3;
-    return typed_array_createtypedarray::TypedArraySpeciesCreate(
-        methodName, numArgs, source, buffer, beginByteOffsetNum, newLength);
+    return TypedArraySpeciesCreateByBuffer(
+        methodName, source, buffer, beginByteOffset, newLength);
   }
 }
diff --git a/deps/v8/src/builtins/typed-array.tq b/deps/v8/src/builtins/typed-array.tq
index 1c901abf752195..1b23d3f57297d1 100644
--- a/deps/v8/src/builtins/typed-array.tq
+++ b/deps/v8/src/builtins/typed-array.tq
@@ -8,39 +8,40 @@ namespace typed_array {
   // Naming convention from elements.cc. We have a similar intent but implement
   // fastpaths using generics instead of using a class hierarchy for elements
   // kinds specific implementations.
-  type Uint8Elements;
-  type Int8Elements;
-  type Uint16Elements;
-  type Int16Elements;
-  type Uint32Elements;
-  type Int32Elements;
-  type Float32Elements;
-  type Float64Elements;
-  type Uint8ClampedElements;
-  type BigUint64Elements;
-  type BigInt64Elements;
-
+  type Uint8Elements extends ElementsKind;
+  type Int8Elements extends ElementsKind;
+  type Uint16Elements extends ElementsKind;
+  type Int16Elements extends ElementsKind;
+  type Uint32Elements extends ElementsKind;
+  type Int32Elements extends ElementsKind;
+  type Float32Elements extends ElementsKind;
+  type Float64Elements extends ElementsKind;
+  type Uint8ClampedElements extends ElementsKind;
+  type BigUint64Elements extends ElementsKind;
+  type BigInt64Elements extends ElementsKind;
+
+  @export
   struct TypedArrayElementsInfo {
     // Calculates the number of bytes required for specified number of elements.
-    CalculateByteLength(lengthSmi: PositiveSmi): uintptr labels IfInvalid {
-      const length = Convert<uintptr>(lengthSmi);
+    macro CalculateByteLength(length: uintptr): uintptr labels IfInvalid {
+      if (length > kTypedArrayMaxLength) goto IfInvalid;
+      const maxArrayLength = kArrayBufferMaxByteLength >>> this.sizeLog2;
+      if (length > maxArrayLength) goto IfInvalid;
       const byteLength = length << this.sizeLog2;
-      // If an overflow ocurred, the byte length exceeds
-      // JSArrayBuffer::kMaxByteLength and is invalid.
-      if (byteLength >>> this.sizeLog2 != length) goto IfInvalid;
       return byteLength;
     }
 
     // Calculates the maximum number of elements supported by a specified number
     // of bytes.
-    CalculateLength(byteLength: uintptr): PositiveSmi labels IfInvalid {
-      return Convert<PositiveSmi>(byteLength >>> this.sizeLog2)
-          otherwise IfInvalid;
+    macro CalculateLength(byteLength: uintptr): uintptr labels IfInvalid {
+      const length = byteLength >>> this.sizeLog2;
+      if (length > kTypedArrayMaxLength) goto IfInvalid;
+      return length;
     }
 
     // Determines if `bytes` (byte offset or length) cannot be evenly divided by
     // element size.
-    IsUnaligned(bytes: uintptr): bool {
+    macro IsUnaligned(bytes: uintptr): bool {
       // Exploits the fact the element size is a power of 2. Determining whether
       // there is remainder (not aligned) can be achieved efficiently with bit
       // masking. Shift is safe as sizeLog2 can be 3 at most (see
@@ -51,7 +52,8 @@ namespace typed_array {
     sizeLog2: uintptr;
     kind: ElementsKind;
   }
-  extern runtime TypedArraySortFast(Context, JSAny): JSTypedArray;
+  extern runtime TypedArrayCopyElements(Context, JSTypedArray, Object, Number):
+      void;
   extern macro TypedArrayBuiltinsAssembler::ValidateTypedArray(
       Context, JSAny, constexpr string): JSTypedArray;
 
@@ -67,15 +69,95 @@ namespace typed_array {
       JSTypedArray): TypedArrayElementsInfo;
   extern macro TypedArrayBuiltinsAssembler::GetTypedArrayElementsInfo(Map):
       TypedArrayElementsInfo;
+  extern macro TypedArrayBuiltinsAssembler::IsUint8ElementsKind(ElementsKind):
+      bool;
   extern macro TypedArrayBuiltinsAssembler::IsBigInt64ElementsKind(
       ElementsKind): bool;
   extern macro LoadFixedTypedArrayElementAsTagged(
-      RawPtr, Smi, constexpr ElementsKind): Numeric;
+      RawPtr, uintptr, constexpr ElementsKind): Numeric;
+  extern macro TypedArrayBuiltinsAssembler::StoreJSTypedArrayElementFromNumeric(
+      Context, JSTypedArray, uintptr, Numeric, constexpr ElementsKind);
   extern macro TypedArrayBuiltinsAssembler::StoreJSTypedArrayElementFromTagged(
-      Context, JSTypedArray, Smi, JSAny, constexpr ElementsKind);
+      Context, JSTypedArray, uintptr, JSAny,
+      constexpr ElementsKind) labels IfDetached;
+
+  type LoadNumericFn = builtin(Context, JSTypedArray, uintptr) => Numeric;
+  type StoreNumericFn = builtin(Context, JSTypedArray, uintptr, Numeric) => Smi;
+  type StoreJSAnyFn = builtin(Context, JSTypedArray, uintptr, JSAny) => Smi;
+
+  // The result codes returned by StoreNumericFn and StoreJSAnyFn builtins.
+  const kStoreSucceded: Smi = 0;
+  const kStoreFailureArrayDetached: Smi = 1;
+
+  struct TypedArrayAccessor {
+    macro LoadNumeric(
+        context: Context, array: JSTypedArray, index: uintptr): Numeric {
+      const loadfn: LoadNumericFn = this.loadNumericFn;
+      return loadfn(context, array, index);
+    }
+
+    macro StoreNumeric(
+        context: Context, array: JSTypedArray, index: uintptr, value: Numeric) {
+      const storefn: StoreNumericFn = this.storeNumericFn;
+      const result = storefn(context, array, index, value);
+      assert(result == kStoreSucceded);
+    }
+
+    macro StoreJSAny(
+        context: Context, array: JSTypedArray, index: uintptr, value: JSAny)
+        labels IfDetached {
+      const storefn: StoreJSAnyFn = this.storeJSAnyFn;
+      const result = storefn(context, array, index, value);
+      if (result == kStoreFailureArrayDetached) {
+        goto IfDetached;
+      }
+      assert(result == kStoreSucceded);
+    }
 
-  type LoadFn = builtin(Context, JSTypedArray, Smi) => JSAny;
-  type StoreFn = builtin(Context, JSTypedArray, Smi, JSAny) => JSAny;
+    loadNumericFn: LoadNumericFn;
+    storeNumericFn: StoreNumericFn;
+    storeJSAnyFn: StoreJSAnyFn;
+  }
+
+  macro GetTypedArrayAccessor<T : type extends ElementsKind>():
+      TypedArrayAccessor {
+    const loadNumericFn = LoadTypedElement<T>;
+    const storeNumericFn = StoreTypedElementNumeric<T>;
+    const storeJSAnyFn = StoreTypedElementJSAny<T>;
+    return TypedArrayAccessor{loadNumericFn, storeNumericFn, storeJSAnyFn};
+  }
+
+  macro GetTypedArrayAccessor(elementsKind: ElementsKind): TypedArrayAccessor {
+    if (IsElementsKindGreaterThan(
+            elementsKind, ElementsKind::UINT32_ELEMENTS)) {
+      if (elementsKind == ElementsKind::INT32_ELEMENTS) {
+        return GetTypedArrayAccessor<Int32Elements>();
+      } else if (elementsKind == ElementsKind::FLOAT32_ELEMENTS) {
+        return GetTypedArrayAccessor<Float32Elements>();
+      } else if (elementsKind == ElementsKind::FLOAT64_ELEMENTS) {
+        return GetTypedArrayAccessor<Float64Elements>();
+      } else if (elementsKind == ElementsKind::UINT8_CLAMPED_ELEMENTS) {
+        return GetTypedArrayAccessor<Uint8ClampedElements>();
+      } else if (elementsKind == ElementsKind::BIGUINT64_ELEMENTS) {
+        return GetTypedArrayAccessor<BigUint64Elements>();
+      } else if (elementsKind == ElementsKind::BIGINT64_ELEMENTS) {
+        return GetTypedArrayAccessor<BigInt64Elements>();
+      }
+    } else {
+      if (elementsKind == ElementsKind::UINT8_ELEMENTS) {
+        return GetTypedArrayAccessor<Uint8Elements>();
+      } else if (elementsKind == ElementsKind::INT8_ELEMENTS) {
+        return GetTypedArrayAccessor<Int8Elements>();
+      } else if (elementsKind == ElementsKind::UINT16_ELEMENTS) {
+        return GetTypedArrayAccessor<Uint16Elements>();
+      } else if (elementsKind == ElementsKind::INT16_ELEMENTS) {
+        return GetTypedArrayAccessor<Int16Elements>();
+      } else if (elementsKind == ElementsKind::UINT32_ELEMENTS) {
+        return GetTypedArrayAccessor<Uint32Elements>();
+      }
+    }
+    unreachable;
+  }
 
   extern macro TypedArrayBuiltinsAssembler::SetJSTypedArrayOnHeapDataPtr(
       JSTypedArray, ByteArray, uintptr): void;
@@ -92,292 +174,102 @@ namespace typed_array {
   }
 
   struct AttachedJSTypedArrayWitness {
-    Get(): AttachedJSTypedArray {
+    macro Get(): AttachedJSTypedArray {
       return this.unstable;
     }
 
-    GetStable(): JSTypedArray {
+    macro GetStable(): JSTypedArray {
       return this.stable;
     }
 
-    Recheck() labels Detached {
+    macro Recheck() labels Detached {
       if (IsDetachedBuffer(this.stable.buffer)) goto Detached;
       this.unstable = %RawDownCast<AttachedJSTypedArray>(this.stable);
     }
 
-    Load(implicit context: Context)(k: Smi): JSAny {
-      const lf: LoadFn = this.loadfn;
+    macro Load(implicit context: Context)(k: uintptr): JSAny {
+      const lf: LoadNumericFn = this.loadfn;
       return lf(context, this.unstable, k);
     }
 
     stable: JSTypedArray;
     unstable: AttachedJSTypedArray;
-    loadfn: LoadFn;
+    loadfn: LoadNumericFn;
   }
 
   macro NewAttachedJSTypedArrayWitness(array: AttachedJSTypedArray):
       AttachedJSTypedArrayWitness {
     const kind = array.elements_kind;
+    const accessor: TypedArrayAccessor = GetTypedArrayAccessor(kind);
     return AttachedJSTypedArrayWitness{
       stable: array,
       unstable: array,
-      loadfn: GetLoadFnForElementsKind(kind)
+      loadfn: accessor.loadNumericFn
     };
   }
 
-  macro GetLoadFnForElementsKind(elementsKind: ElementsKind): LoadFn {
-    if (IsElementsKindGreaterThan(elementsKind, UINT32_ELEMENTS)) {
-      if (elementsKind == INT32_ELEMENTS) {
-        return LoadFixedElement<Int32Elements>;
-      } else if (elementsKind == FLOAT32_ELEMENTS) {
-        return LoadFixedElement<Float32Elements>;
-      } else if (elementsKind == FLOAT64_ELEMENTS) {
-        return LoadFixedElement<Float64Elements>;
-      } else if (elementsKind == UINT8_CLAMPED_ELEMENTS) {
-        return LoadFixedElement<Uint8ClampedElements>;
-      } else if (elementsKind == BIGUINT64_ELEMENTS) {
-        return LoadFixedElement<BigUint64Elements>;
-      } else if (elementsKind == BIGINT64_ELEMENTS) {
-        return LoadFixedElement<BigInt64Elements>;
-      } else {
-        unreachable;
-      }
-    } else {
-      if (elementsKind == UINT8_ELEMENTS) {
-        return LoadFixedElement<Uint8Elements>;
-      } else if (elementsKind == INT8_ELEMENTS) {
-        return LoadFixedElement<Int8Elements>;
-      } else if (elementsKind == UINT16_ELEMENTS) {
-        return LoadFixedElement<Uint16Elements>;
-      } else if (elementsKind == INT16_ELEMENTS) {
-        return LoadFixedElement<Int16Elements>;
-      } else if (elementsKind == UINT32_ELEMENTS) {
-        return LoadFixedElement<Uint32Elements>;
-      } else {
-        unreachable;
-      }
-    }
-  }
-
-  macro KindForArrayType<T: type>(): constexpr ElementsKind;
+  macro KindForArrayType<T : type extends ElementsKind>():
+      constexpr ElementsKind;
   KindForArrayType<Uint8Elements>(): constexpr ElementsKind {
-    return UINT8_ELEMENTS;
+    return ElementsKind::UINT8_ELEMENTS;
   }
   KindForArrayType<Int8Elements>(): constexpr ElementsKind {
-    return INT8_ELEMENTS;
+    return ElementsKind::INT8_ELEMENTS;
   }
   KindForArrayType<Uint16Elements>(): constexpr ElementsKind {
-    return UINT16_ELEMENTS;
+    return ElementsKind::UINT16_ELEMENTS;
   }
   KindForArrayType<Int16Elements>(): constexpr ElementsKind {
-    return INT16_ELEMENTS;
+    return ElementsKind::INT16_ELEMENTS;
   }
   KindForArrayType<Uint32Elements>(): constexpr ElementsKind {
-    return UINT32_ELEMENTS;
+    return ElementsKind::UINT32_ELEMENTS;
   }
   KindForArrayType<Int32Elements>(): constexpr ElementsKind {
-    return INT32_ELEMENTS;
+    return ElementsKind::INT32_ELEMENTS;
   }
   KindForArrayType<Float32Elements>(): constexpr ElementsKind {
-    return FLOAT32_ELEMENTS;
+    return ElementsKind::FLOAT32_ELEMENTS;
   }
   KindForArrayType<Float64Elements>(): constexpr ElementsKind {
-    return FLOAT64_ELEMENTS;
+    return ElementsKind::FLOAT64_ELEMENTS;
   }
   KindForArrayType<Uint8ClampedElements>(): constexpr ElementsKind {
-    return UINT8_CLAMPED_ELEMENTS;
+    return ElementsKind::UINT8_CLAMPED_ELEMENTS;
   }
   KindForArrayType<BigUint64Elements>(): constexpr ElementsKind {
-    return BIGUINT64_ELEMENTS;
+    return ElementsKind::BIGUINT64_ELEMENTS;
   }
   KindForArrayType<BigInt64Elements>(): constexpr ElementsKind {
-    return BIGINT64_ELEMENTS;
+    return ElementsKind::BIGINT64_ELEMENTS;
   }
 
-  builtin LoadFixedElement<T: type>(
-      _context: Context, array: JSTypedArray, index: Smi): JSAny {
+  builtin LoadTypedElement<T : type extends ElementsKind>(
+      _context: Context, array: JSTypedArray, index: uintptr): Numeric {
     return LoadFixedTypedArrayElementAsTagged(
         array.data_ptr, index, KindForArrayType<T>());
   }
 
-  builtin StoreFixedElement<T: type>(
-      context: Context, typedArray: JSTypedArray, index: Smi,
-      value: JSAny): JSAny {
-    typed_array::StoreJSTypedArrayElementFromTagged(
+  builtin StoreTypedElementNumeric<T : type extends ElementsKind>(
+      context: Context, typedArray: JSTypedArray, index: uintptr,
+      value: Numeric): Smi {
+    StoreJSTypedArrayElementFromNumeric(
         context, typedArray, index, value, KindForArrayType<T>());
-    return Undefined;
-  }
-
-  transitioning macro CallCompare(
-      implicit context: Context, array: JSTypedArray,
-      comparefn: Callable)(a: JSAny, b: JSAny): Number {
-    // a. Let v be ? ToNumber(? Call(comparefn, undefined, x, y)).
-    const v: Number =
-        ToNumber_Inline(context, Call(context, comparefn, Undefined, a, b));
-
-    // b. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
-    if (IsDetachedBuffer(array.buffer)) {
-      ThrowTypeError(kDetachedOperation, '%TypedArray%.prototype.sort');
-    }
-
-    // c. If v is NaN, return +0.
-    if (NumberIsNaN(v)) return 0;
-
-    // d. return v.
-    return v;
+    return kStoreSucceded;
   }
 
-  // Merges two sorted runs [from, middle) and [middle, to)
-  // from "source" into "target".
-  transitioning macro
-  TypedArrayMerge(
-      implicit context: Context, array: JSTypedArray, comparefn: Callable)(
-      source: FixedArray, from: Smi, middle: Smi, to: Smi, target: FixedArray) {
-    let left: Smi = from;
-    let right: Smi = middle;
-
-    for (let targetIndex: Smi = from; targetIndex < to; ++targetIndex) {
-      if (left < middle && right >= to) {
-        // If the left run has elements, but the right does not, we take
-        // from the left.
-        target.objects[targetIndex] = source.objects[left++];
-      } else if (left < middle) {
-        // If both have elements, we need to compare.
-        const leftElement = UnsafeCast<JSAny>(source.objects[left]);
-        const rightElement = UnsafeCast<JSAny>(source.objects[right]);
-        if (CallCompare(leftElement, rightElement) <= 0) {
-          target.objects[targetIndex] = leftElement;
-          left++;
-        } else {
-          target.objects[targetIndex] = rightElement;
-          right++;
-        }
-      } else {
-        // No elements on the left, but the right does, so we take
-        // from the right.
-        assert(left == middle);
-        target.objects[targetIndex] = source.objects[right++];
-      }
-    }
-  }
-
-  transitioning builtin
-  TypedArrayMergeSort(
-      implicit context: Context, array: JSTypedArray, comparefn: Callable)(
-      source: FixedArray, from: Smi, to: Smi, target: FixedArray): JSAny {
-    assert(to - from > 1);
-    const middle: Smi = from + ((to - from) >> 1);
-
-    // On the next recursion step source becomes target and vice versa.
-    // This saves the copy of the relevant range from the original
-    // array into a work array on each recursion step.
-    if (middle - from > 1) TypedArrayMergeSort(target, from, middle, source);
-    if (to - middle > 1) TypedArrayMergeSort(target, middle, to, source);
-
-    TypedArrayMerge(source, from, middle, to, target);
-
-    return Undefined;
-  }
-
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.sort
-  transitioning javascript builtin TypedArrayPrototypeSort(
-      js-implicit context: Context,
-      receiver: JSAny)(...arguments): JSTypedArray {
-    // 1. If comparefn is not undefined and IsCallable(comparefn) is false,
-    //    throw a TypeError exception.
-    const comparefnObj: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    if (comparefnObj != Undefined && !TaggedIsCallable(comparefnObj)) {
-      ThrowTypeError(kBadSortComparisonFunction, comparefnObj);
-    }
-
-    // 2. Let obj be the this value.
-    const obj: JSAny = receiver;
-
-    // 3. Let buffer be ? ValidateTypedArray(obj).
-    //    ValidateTypedArray currently returns the array, not the ViewBuffer.
-    const array: JSTypedArray =
-        ValidateTypedArray(context, obj, '%TypedArray%.prototype.sort');
-
-    // Default sorting is done in C++ using std::sort
-    if (comparefnObj == Undefined) {
-      return TypedArraySortFast(context, obj);
+  // Returns True on sucess or False if the typedArrays was detached.
+  builtin StoreTypedElementJSAny<T : type extends ElementsKind>(
+      context: Context, typedArray: JSTypedArray, index: uintptr,
+      value: JSAny): Smi {
+    try {
+      StoreJSTypedArrayElementFromTagged(
+          context, typedArray, index, value, KindForArrayType<T>())
+          otherwise IfDetached;
     }
-
-    // 4. Let len be obj.[[ArrayLength]].
-    // TODO(v8:4153): Support huge TypedArrays here.
-    const len = Cast<Smi>(Convert<Number>(array.length)) otherwise unreachable;
-
-    // Arrays of length 1 or less are considered sorted.
-    if (len < 2) return array;
-
-    const comparefn: Callable =
-        Cast<Callable>(comparefnObj) otherwise unreachable;
-    let loadfn: LoadFn;
-    let storefn: StoreFn;
-
-    const elementsKind: ElementsKind = array.elements_kind;
-
-    if (IsElementsKindGreaterThan(elementsKind, UINT32_ELEMENTS)) {
-      if (elementsKind == INT32_ELEMENTS) {
-        loadfn = LoadFixedElement<Int32Elements>;
-        storefn = StoreFixedElement<Int32Elements>;
-      } else if (elementsKind == FLOAT32_ELEMENTS) {
-        loadfn = LoadFixedElement<Float32Elements>;
-        storefn = StoreFixedElement<Float32Elements>;
-      } else if (elementsKind == FLOAT64_ELEMENTS) {
-        loadfn = LoadFixedElement<Float64Elements>;
-        storefn = StoreFixedElement<Float64Elements>;
-      } else if (elementsKind == UINT8_CLAMPED_ELEMENTS) {
-        loadfn = LoadFixedElement<Uint8ClampedElements>;
-        storefn = StoreFixedElement<Uint8ClampedElements>;
-      } else if (elementsKind == BIGUINT64_ELEMENTS) {
-        loadfn = LoadFixedElement<BigUint64Elements>;
-        storefn = StoreFixedElement<BigUint64Elements>;
-      } else if (elementsKind == BIGINT64_ELEMENTS) {
-        loadfn = LoadFixedElement<BigInt64Elements>;
-        storefn = StoreFixedElement<BigInt64Elements>;
-      } else {
-        unreachable;
-      }
-    } else {
-      if (elementsKind == UINT8_ELEMENTS) {
-        loadfn = LoadFixedElement<Uint8Elements>;
-        storefn = StoreFixedElement<Uint8Elements>;
-      } else if (elementsKind == INT8_ELEMENTS) {
-        loadfn = LoadFixedElement<Int8Elements>;
-        storefn = StoreFixedElement<Int8Elements>;
-      } else if (elementsKind == UINT16_ELEMENTS) {
-        loadfn = LoadFixedElement<Uint16Elements>;
-        storefn = StoreFixedElement<Uint16Elements>;
-      } else if (elementsKind == INT16_ELEMENTS) {
-        loadfn = LoadFixedElement<Int16Elements>;
-        storefn = StoreFixedElement<Int16Elements>;
-      } else if (elementsKind == UINT32_ELEMENTS) {
-        loadfn = LoadFixedElement<Uint32Elements>;
-        storefn = StoreFixedElement<Uint32Elements>;
-      } else {
-        unreachable;
-      }
-    }
-
-    // Prepare the two work arrays. All numbers are converted to tagged
-    // objects first, and merge sorted between the two FixedArrays.
-    // The result is then written back into the JSTypedArray.
-    const work1: FixedArray = AllocateZeroedFixedArray(Convert<intptr>(len));
-    const work2: FixedArray = AllocateZeroedFixedArray(Convert<intptr>(len));
-
-    for (let i: Smi = 0; i < len; ++i) {
-      const element: JSAny = loadfn(context, array, i);
-      work1.objects[i] = element;
-      work2.objects[i] = element;
+    label IfDetached {
+      return kStoreFailureArrayDetached;
     }
-
-    TypedArrayMergeSort(work2, 0, len, work1);
-
-    // work1 contains the sorted numbers. Write them back.
-    for (let i: Smi = 0; i < len; ++i)
-      storefn(context, array, i, UnsafeCast<JSAny>(work1.objects[i]));
-
-    return array;
+    return kStoreSucceded;
   }
 }
diff --git a/deps/v8/src/builtins/x64/builtins-x64.cc b/deps/v8/src/builtins/x64/builtins-x64.cc
index 9679237ff820f7..99f052d695a4c6 100644
--- a/deps/v8/src/builtins/x64/builtins-x64.cc
+++ b/deps/v8/src/builtins/x64/builtins-x64.cc
@@ -146,8 +146,7 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     // rax: number of arguments (untagged)
     // rdi: constructor function
     // rdx: new target
-    ParameterCount actual(rax);
-    __ InvokeFunction(rdi, rdx, actual, CALL_FUNCTION);
+    __ InvokeFunction(rdi, rdx, rax, CALL_FUNCTION);
 
     // Restore context from the frame.
     __ movq(rsi, Operand(rbp, ConstructFrameConstants::kContextOffset));
@@ -299,8 +298,7 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
     __ j(greater_equal, &loop, Label::kNear);
 
     // Call the function.
-    ParameterCount actual(rax);
-    __ InvokeFunction(rdi, rdx, actual, CALL_FUNCTION);
+    __ InvokeFunction(rdi, rdx, rax, CALL_FUNCTION);
 
     // ----------- S t a t e -------------
     //  -- rax                 constructor result
@@ -720,7 +718,6 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
                       kDontSaveFPRegs);
 
   Register decompr_scratch1 = COMPRESS_POINTERS_BOOL ? r11 : no_reg;
-  Register decompr_scratch2 = COMPRESS_POINTERS_BOOL ? r12 : no_reg;
 
   // Load suspended function and context.
   __ LoadTaggedPointerField(
@@ -784,7 +781,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     __ j(greater_equal, &done_loop, Label::kNear);
     __ PushTaggedAnyField(
         FieldOperand(rbx, r9, times_tagged_size, FixedArray::kHeaderSize),
-        decompr_scratch1, decompr_scratch2);
+        decompr_scratch1);
     __ addl(r9, Immediate(1));
     __ jmp(&loop);
 
@@ -1073,13 +1070,11 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   // is optimized code or an optimization marker, call that instead.
 
   Register optimized_code_entry = rcx;
-  Register decompr_scratch = COMPRESS_POINTERS_BOOL ? r11 : no_reg;
 
   __ LoadAnyTaggedField(
       optimized_code_entry,
       FieldOperand(feedback_vector,
-                   FeedbackVector::kOptimizedCodeWeakOrSmiOffset),
-      decompr_scratch);
+                   FeedbackVector::kOptimizedCodeWeakOrSmiOffset));
 
   // Check if the optimized code slot is not empty.
   Label optimized_code_slot_not_empty;
@@ -1243,7 +1238,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
   __ subq(start_address, Immediate(kSystemPointerSize));
   __ bind(&loop_check);
   __ cmpq(start_address, scratch);
-  __ j(greater, &loop_header, Label::kNear);
+  __ j(above, &loop_header, Label::kNear);
 }
 
 // static
@@ -1373,7 +1368,7 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   Label builtin_trampoline, trampoline_loaded;
   Smi interpreter_entry_return_pc_offset(
       masm->isolate()->heap()->interpreter_entry_return_pc_offset());
-  DCHECK_NE(interpreter_entry_return_pc_offset, Smi::kZero);
+  DCHECK_NE(interpreter_entry_return_pc_offset, Smi::zero());
 
   // If the SFI function_data is an InterpreterData, the function will have a
   // custom copy of the interpreter entry trampoline for profiling. If so,
@@ -1387,8 +1382,8 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   __ CmpObjectType(rbx, INTERPRETER_DATA_TYPE, kScratchRegister);
   __ j(not_equal, &builtin_trampoline, Label::kNear);
 
-  __ movq(rbx,
-          FieldOperand(rbx, InterpreterData::kInterpreterTrampolineOffset));
+  __ LoadTaggedPointerField(
+      rbx, FieldOperand(rbx, InterpreterData::kInterpreterTrampolineOffset));
   __ addq(rbx, Immediate(Code::kHeaderSize - kHeapObjectTag));
   __ jmp(&trampoline_loaded, Label::kNear);
 
@@ -1470,77 +1465,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rax : argument count (preserved for callee)
-  //  -- rdx : new target (preserved for callee)
-  //  -- rdi : target function (preserved for callee)
-  // -----------------------------------
-  Label failed;
-  {
-    FrameScope scope(masm, StackFrame::INTERNAL);
-    // Preserve argument count for later compare.
-    __ movq(rcx, rax);
-    // Push the number of arguments to the callee.
-    __ SmiTag(rax);
-    __ Push(rax);
-    // Push a copy of the target function and the new target.
-    __ Push(rdi);
-    __ Push(rdx);
-
-    // The function.
-    __ Push(rdi);
-    // Copy arguments from caller (stdlib, foreign, heap).
-    Label args_done;
-    for (int j = 0; j < 4; ++j) {
-      Label over;
-      if (j < 3) {
-        __ cmpq(rcx, Immediate(j));
-        __ j(not_equal, &over, Label::kNear);
-      }
-      for (int i = j - 1; i >= 0; --i) {
-        __ Push(Operand(rbp, StandardFrameConstants::kCallerSPOffset +
-                                 i * kSystemPointerSize));
-      }
-      for (int i = 0; i < 3 - j; ++i) {
-        __ PushRoot(RootIndex::kUndefinedValue);
-      }
-      if (j < 3) {
-        __ jmp(&args_done, Label::kNear);
-        __ bind(&over);
-      }
-    }
-    __ bind(&args_done);
-
-    // Call runtime, on success unwind frame, and parent frame.
-    __ CallRuntime(Runtime::kInstantiateAsmJs, 4);
-    // A smi 0 is returned on failure, an object on success.
-    __ JumpIfSmi(rax, &failed, Label::kNear);
-
-    __ Drop(2);
-    __ Pop(rcx);
-    __ SmiUntag(rcx);
-    scope.GenerateLeaveFrame();
-
-    __ PopReturnAddressTo(rbx);
-    __ incq(rcx);
-    __ leaq(rsp, Operand(rsp, rcx, times_system_pointer_size, 0));
-    __ PushReturnAddressFrom(rbx);
-    __ ret(0);
-
-    __ bind(&failed);
-    // Restore target function and new target.
-    __ Pop(rdx);
-    __ Pop(rdi);
-    __ Pop(rax);
-    __ SmiUntag(rax);
-  }
-  // On failure, tail call back to regular js by re-calling the function
-  // which has be reset to the compile lazy builtin.
-  __ LoadTaggedPointerField(rcx, FieldOperand(rdi, JSFunction::kCodeOffset));
-  __ JumpCodeObject(rcx);
-}
-
 namespace {
 void Generate_ContinueToBuiltinHelper(MacroAssembler* masm,
                                       bool java_script_builtin,
@@ -1842,32 +1766,6 @@ void Builtins::Generate_ReflectConstruct(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 }
 
-void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rax    : argc
-  //  -- rsp[0] : return address
-  //  -- rsp[8] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin InternalArray functions should be maps.
-    __ LoadTaggedPointerField(
-        rbx, FieldOperand(rdi, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    STATIC_ASSERT(kSmiTag == 0);
-    Condition not_smi = NegateCondition(masm->CheckSmi(rbx));
-    __ Check(not_smi,
-             AbortReason::kUnexpectedInitialMapForInternalArrayFunction);
-    __ CmpObjectType(rbx, MAP_TYPE, rcx);
-    __ Check(equal, AbortReason::kUnexpectedInitialMapForInternalArrayFunction);
-  }
-
-  // Run the native code for the InternalArray function called as a normal
-  // function.
-  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
-          RelocInfo::CODE_TARGET);
-}
-
 static void EnterArgumentsAdaptorFrame(MacroAssembler* masm) {
   __ pushq(rbp);
   __ movq(rbp, rsp);
@@ -2059,7 +1957,6 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
   //  -- rsp[0] : return address
   // -----------------------------------
   Register scratch = r11;
-  Register decompr_scratch = COMPRESS_POINTERS_BOOL ? r12 : no_reg;
 
   if (masm->emit_debug_code()) {
     // Allow rbx to be a FixedArray, or a FixedDoubleArray if rcx == 0.
@@ -2093,10 +1990,8 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
     __ cmpl(r9, rcx);
     __ j(equal, &done, Label::kNear);
     // Turn the hole into undefined as we go.
-    __ LoadAnyTaggedField(
-        value,
-        FieldOperand(rbx, r9, times_tagged_size, FixedArray::kHeaderSize),
-        decompr_scratch);
+    __ LoadAnyTaggedField(value, FieldOperand(rbx, r9, times_tagged_size,
+                                              FixedArray::kHeaderSize));
     __ CompareRoot(value, RootIndex::kTheHoleValue);
     __ j(not_equal, &push, Label::kNear);
     __ LoadRoot(value, RootIndex::kUndefinedValue);
@@ -2133,7 +2028,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
     __ JumpIfSmi(rdx, &new_target_not_constructor, Label::kNear);
     __ LoadTaggedPointerField(rbx, FieldOperand(rdx, HeapObject::kMapOffset));
     __ testb(FieldOperand(rbx, Map::kBitFieldOffset),
-             Immediate(Map::IsConstructorBit::kMask));
+             Immediate(Map::Bits1::IsConstructorBit::kMask));
     __ j(not_zero, &new_target_constructor, Label::kNear);
     __ bind(&new_target_not_constructor);
     {
@@ -2152,7 +2047,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
           Immediate(StackFrame::TypeToMarker(StackFrame::ARGUMENTS_ADAPTOR)));
   __ j(equal, &arguments_adaptor, Label::kNear);
   {
-    __ movq(r8, Operand(rbp, JavaScriptFrameConstants::kFunctionOffset));
+    __ movq(r8, Operand(rbp, StandardFrameConstants::kFunctionOffset));
     __ LoadTaggedPointerField(
         r8, FieldOperand(r8, JSFunction::kSharedFunctionInfoOffset));
     __ movzxwq(
@@ -2301,10 +2196,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
 
   __ movzxwq(
       rbx, FieldOperand(rdx, SharedFunctionInfo::kFormalParameterCountOffset));
-  ParameterCount actual(rax);
-  ParameterCount expected(rbx);
 
-  __ InvokeFunctionCode(rdi, no_reg, expected, actual, JUMP_FUNCTION);
+  __ InvokeFunctionCode(rdi, no_reg, rbx, rax, JUMP_FUNCTION);
 
   // The function is a "classConstructor", need to raise an exception.
   __ bind(&class_constructor);
@@ -2324,8 +2217,6 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
   //  -- rdi : target (checked to be a JSBoundFunction)
   // -----------------------------------
 
-  Register decompr_scratch = COMPRESS_POINTERS_BOOL ? r11 : no_reg;
-
   // Load [[BoundArguments]] into rcx and length of that into rbx.
   Label no_bound_arguments;
   __ LoadTaggedPointerField(
@@ -2394,10 +2285,9 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
       // offset in order to move be able to move decl(rbx) right before the loop
       // condition. This is necessary in order to avoid flags corruption by
       // pointer decompression code.
-      __ LoadAnyTaggedField(r12,
-                            FieldOperand(rcx, rbx, times_tagged_size,
-                                         FixedArray::kHeaderSize - kTaggedSize),
-                            decompr_scratch);
+      __ LoadAnyTaggedField(
+          r12, FieldOperand(rcx, rbx, times_tagged_size,
+                            FixedArray::kHeaderSize - kTaggedSize));
       __ movq(Operand(rsp, rax, times_system_pointer_size, 0), r12);
       __ leal(rax, Operand(rax, 1));
       __ decl(rbx);
@@ -2422,13 +2312,10 @@ void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
   // -----------------------------------
   __ AssertBoundFunction(rdi);
 
-  Register decompr_scratch = COMPRESS_POINTERS_BOOL ? r11 : no_reg;
-
   // Patch the receiver to [[BoundThis]].
   StackArgumentsAccessor args(rsp, rax);
   __ LoadAnyTaggedField(rbx,
-                        FieldOperand(rdi, JSBoundFunction::kBoundThisOffset),
-                        decompr_scratch);
+                        FieldOperand(rdi, JSBoundFunction::kBoundThisOffset));
   __ movq(args.GetReceiverOperand(), rbx);
 
   // Push the [[BoundArguments]] onto the stack.
@@ -2461,7 +2348,7 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
 
   // Check if target has a [[Call]] internal method.
   __ testb(FieldOperand(rcx, Map::kBitFieldOffset),
-           Immediate(Map::IsCallableBit::kMask));
+           Immediate(Map::Bits1::IsCallableBit::kMask));
   __ j(zero, &non_callable, Label::kNear);
 
   // Check if target is a proxy and call CallProxy external builtin
@@ -2561,7 +2448,7 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   // Check if target has a [[Construct]] internal method.
   __ LoadTaggedPointerField(rcx, FieldOperand(rdi, HeapObject::kMapOffset));
   __ testb(FieldOperand(rcx, Map::kBitFieldOffset),
-           Immediate(Map::IsConstructorBit::kMask));
+           Immediate(Map::Bits1::IsConstructorBit::kMask));
   __ j(zero, &non_constructor);
 
   // Dispatch based on instance type.
@@ -2666,17 +2553,10 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
     __ Push(kWasmInstanceRegister);
     // Push the function index as second argument.
     __ Push(r11);
-    // Load the correct CEntry builtin from the instance object.
-    __ movq(rcx, FieldOperand(kWasmInstanceRegister,
-                              WasmInstanceObject::kIsolateRootOffset));
-    auto centry_id =
-        Builtins::kCEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit;
-    __ LoadTaggedPointerField(
-        rcx, MemOperand(rcx, IsolateData::builtin_slot_offset(centry_id)));
     // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ Move(kContextRegister, Smi::zero());
-    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, rcx);
+    __ CallRuntime(Runtime::kWasmCompileLazy, 2);
     // The entrypoint address is the return value.
     __ movq(r11, kReturnRegister0);
 
@@ -2926,52 +2806,6 @@ void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
   __ ret(0);
 }
 
-void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rax    : argc
-  //  -- rdi    : constructor
-  //  -- rsp[0] : return address
-  //  -- rsp[8] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ LoadTaggedPointerField(
-        rcx, FieldOperand(rdi, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    STATIC_ASSERT(kSmiTag == 0);
-    Condition not_smi = NegateCondition(masm->CheckSmi(rcx));
-    __ Check(not_smi, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CmpObjectType(rcx, MAP_TYPE, rcx);
-    __ Check(equal, AbortReason::kUnexpectedInitialMapForArrayFunction);
-
-    // Figure out the right elements kind
-    __ LoadTaggedPointerField(
-        rcx, FieldOperand(rdi, JSFunction::kPrototypeOrInitialMapOffset));
-
-    // Load the map's "bit field 2" into |result|. We only need the first byte,
-    // but the following masking takes care of that anyway.
-    __ movzxbq(rcx, FieldOperand(rcx, Map::kBitField2Offset));
-    // Retrieve elements_kind from bit field 2.
-    __ DecodeField<Map::ElementsKindBits>(rcx);
-
-    // Initial elements kind should be packed elements.
-    __ cmpl(rcx, Immediate(PACKED_ELEMENTS));
-    __ Assert(equal, AbortReason::kInvalidElementsKindForInternalPackedArray);
-
-    // No arguments should be passed.
-    __ testq(rax, rax);
-    __ Assert(zero, AbortReason::kWrongNumberOfArgumentsForInternalPackedArray);
-  }
-
-  __ Jump(
-      BUILTIN_CODE(masm->isolate(), InternalArrayNoArgumentConstructor_Packed),
-      RelocInfo::CODE_TARGET);
-}
-
 namespace {
 
 int Offset(ExternalReference ref0, ExternalReference ref1) {
@@ -3258,10 +3092,8 @@ void Builtins::Generate_CallApiGetter(MacroAssembler* masm) {
   Register callback = ApiGetterDescriptor::CallbackRegister();
   Register scratch = rax;
   Register decompr_scratch1 = COMPRESS_POINTERS_BOOL ? r11 : no_reg;
-  Register decompr_scratch2 = COMPRESS_POINTERS_BOOL ? r12 : no_reg;
 
-  DCHECK(!AreAliased(receiver, holder, callback, scratch, decompr_scratch1,
-                     decompr_scratch2));
+  DCHECK(!AreAliased(receiver, holder, callback, scratch, decompr_scratch1));
 
   // Build v8::PropertyCallbackInfo::args_ array on the stack and push property
   // name below the exit frame to make GC aware of them.
@@ -3278,7 +3110,7 @@ void Builtins::Generate_CallApiGetter(MacroAssembler* masm) {
   __ PopReturnAddressTo(scratch);
   __ Push(receiver);
   __ PushTaggedAnyField(FieldOperand(callback, AccessorInfo::kDataOffset),
-                        decompr_scratch1, decompr_scratch2);
+                        decompr_scratch1);
   __ LoadRoot(kScratchRegister, RootIndex::kUndefinedValue);
   __ Push(kScratchRegister);  // return value
   __ Push(kScratchRegister);  // return value default
diff --git a/deps/v8/src/codegen/OWNERS b/deps/v8/src/codegen/OWNERS
index 64d2d7b97deb01..8846258784965f 100644
--- a/deps/v8/src/codegen/OWNERS
+++ b/deps/v8/src/codegen/OWNERS
@@ -8,12 +8,12 @@ jgruber@chromium.org
 jkummerow@chromium.org
 leszeks@chromium.org
 mslekova@chromium.org
-mstarzinger@chromium.org
 mvstanton@chromium.org
 neis@chromium.org
 rmcilroy@chromium.org
 sigurds@chromium.org
 tebbi@chromium.org
 titzer@chromium.org
+mythria@chromium.org
 
 # COMPONENT: Blink>JavaScript>Compiler
diff --git a/deps/v8/src/codegen/arm/assembler-arm.cc b/deps/v8/src/codegen/arm/assembler-arm.cc
index 6659960bb809d0..9032714f574f0f 100644
--- a/deps/v8/src/codegen/arm/assembler-arm.cc
+++ b/deps/v8/src/codegen/arm/assembler-arm.cc
@@ -2621,6 +2621,38 @@ static void DoubleAsTwoUInt32(Double d, uint32_t* lo, uint32_t* hi) {
   *hi = i >> 32;
 }
 
+// This checks if imm can be encoded into an immediate for vmov.
+// See Table A7-15 in ARM DDI 0406C.d.
+// Currently only supports the first row of the table.
+static bool FitsVmovImm64(uint64_t imm, uint32_t* encoding) {
+  uint32_t lo = imm & 0xFFFFFFFF;
+  uint32_t hi = imm >> 32;
+  if (lo == hi && ((lo & 0xffffff00) == 0)) {
+    *encoding = ((lo & 0x80) << (24 - 7));   // a
+    *encoding |= ((lo & 0x70) << (16 - 4));  // bcd
+    *encoding |= (lo & 0x0f);                //  efgh
+    return true;
+  }
+
+  return false;
+}
+
+void Assembler::vmov(const QwNeonRegister dst, uint64_t imm) {
+  uint32_t enc;
+  if (CpuFeatures::IsSupported(VFPv3) && FitsVmovImm64(imm, &enc)) {
+    CpuFeatureScope scope(this, VFPv3);
+    // Instruction details available in ARM DDI 0406C.b, A8-937.
+    // 001i1(27-23) | D(22) | 000(21-19) | imm3(18-16) | Vd(15-12) | cmode(11-8)
+    // | 0(7) | Q(6) | op(5) | 4(1) | imm4(3-0)
+    int vd, d;
+    dst.split_code(&vd, &d);
+    emit(kSpecialCondition | 0x05 * B23 | d * B22 | vd * B12 | 0x1 * B6 |
+         0x1 * B4 | enc);
+  } else {
+    UNIMPLEMENTED();
+  }
+}
+
 // Only works for little endian floating point formats.
 // We don't support VFP on the mixed endian floating point platform.
 static bool FitsVmovFPImmediate(Double d, uint32_t* encoding) {
@@ -3631,6 +3663,17 @@ void Assembler::vld1(NeonSize size, const NeonListOperand& dst,
        src.rm().code());
 }
 
+// vld1r(eplicate)
+void Assembler::vld1r(NeonSize size, const NeonListOperand& dst,
+                      const NeonMemOperand& src) {
+  DCHECK(IsEnabled(NEON));
+  int vd, d;
+  dst.base().split_code(&vd, &d);
+  emit(0xFU * B28 | 4 * B24 | 1 * B23 | d * B22 | 2 * B20 |
+       src.rn().code() * B16 | vd * B12 | 0xC * B8 | size * B6 |
+       dst.length() * B5 | src.rm().code());
+}
+
 void Assembler::vst1(NeonSize size, const NeonListOperand& src,
                      const NeonMemOperand& dst) {
   // Instruction details available in ARM DDI 0406C.b, A8.8.404.
@@ -3658,17 +3701,19 @@ void Assembler::vmovl(NeonDataType dt, QwNeonRegister dst, DwVfpRegister src) {
        0xA * B8 | m * B5 | B4 | vm);
 }
 
-void Assembler::vqmovn(NeonDataType dt, DwVfpRegister dst, QwNeonRegister src) {
+void Assembler::vqmovn(NeonDataType dst_dt, NeonDataType src_dt,
+                       DwVfpRegister dst, QwNeonRegister src) {
   // Instruction details available in ARM DDI 0406C.b, A8.8.1004.
   // vqmovn.<type><size> Dd, Qm. ARM vector narrowing move with saturation.
+  // vqmovun.<type><size> Dd, Qm. Same as above, but produces unsigned results.
   DCHECK(IsEnabled(NEON));
+  DCHECK_IMPLIES(NeonU(src_dt), NeonU(dst_dt));
   int vd, d;
   dst.split_code(&vd, &d);
   int vm, m;
   src.split_code(&vm, &m);
-  int size = NeonSz(dt);
-  int u = NeonU(dt);
-  int op = u != 0 ? 3 : 2;
+  int size = NeonSz(dst_dt);
+  int op = NeonU(src_dt) ? 0b11 : NeonU(dst_dt) ? 0b01 : 0b10;
   emit(0x1E7U * B23 | d * B22 | 0x3 * B20 | size * B18 | 0x2 * B16 | vd * B12 |
        0x2 * B8 | op * B6 | m * B5 | vm);
 }
@@ -3991,6 +4036,15 @@ void Assembler::vand(QwNeonRegister dst, QwNeonRegister src1,
                                  src2.code()));
 }
 
+void Assembler::vbic(QwNeonRegister dst, QwNeonRegister src1,
+                     QwNeonRegister src2) {
+  // Qd = vbic(Qn, Qm) SIMD AND.
+  // Instruction details available in ARM DDI 0406C.b, A8-840.
+  DCHECK(IsEnabled(NEON));
+  emit(EncodeNeonBinaryBitwiseOp(VBIC, NEON_Q, dst.code(), src1.code(),
+                                 src2.code()));
+}
+
 void Assembler::vbsl(QwNeonRegister dst, QwNeonRegister src1,
                      QwNeonRegister src2) {
   // Qd = vbsl(Qn, Qm) SIMD bitwise select.
@@ -4098,7 +4152,8 @@ enum IntegerBinOp {
   VTST,
   VCEQ,
   VCGE,
-  VCGT
+  VCGT,
+  VRHADD
 };
 
 static Instr EncodeNeonBinOp(IntegerBinOp op, NeonDataType dt,
@@ -4139,6 +4194,9 @@ static Instr EncodeNeonBinOp(IntegerBinOp op, NeonDataType dt,
     case VCGT:
       op_encoding = 0x3 * B8;
       break;
+    case VRHADD:
+      op_encoding = B8;
+      break;
     default:
       UNREACHABLE();
   }
@@ -4209,6 +4267,25 @@ void Assembler::vqsub(NeonDataType dt, QwNeonRegister dst, QwNeonRegister src1,
   emit(EncodeNeonBinOp(VQSUB, dt, dst, src1, src2));
 }
 
+void Assembler::vmlal(NeonDataType dt, QwNeonRegister dst, DwVfpRegister src1,
+                      DwVfpRegister src2) {
+  DCHECK(IsEnabled(NEON));
+  // Qd = vmlal(Dn, Dm) Vector Multiply Accumulate Long (integer)
+  // Instruction details available in ARM DDI 0406C.b, A8-931.
+  int vd, d;
+  dst.split_code(&vd, &d);
+  int vn, n;
+  src1.split_code(&vn, &n);
+  int vm, m;
+  src2.split_code(&vm, &m);
+  int size = NeonSz(dt);
+  int u = NeonU(dt);
+  if (!u) UNIMPLEMENTED();
+  DCHECK_NE(size, 3);  // SEE "Related encodings"
+  emit(0xFU * B28 | B25 | u * B24 | B23 | d * B22 | size * B20 | vn * B16 |
+       vd * B12 | 0x8 * B8 | n * B7 | m * B5 | vm);
+}
+
 void Assembler::vmul(QwNeonRegister dst, QwNeonRegister src1,
                      QwNeonRegister src2) {
   DCHECK(IsEnabled(NEON));
@@ -4225,6 +4302,24 @@ void Assembler::vmul(NeonSize size, QwNeonRegister dst, QwNeonRegister src1,
   emit(EncodeNeonBinOp(VMUL, size, dst, src1, src2));
 }
 
+void Assembler::vmull(NeonDataType dt, QwNeonRegister dst, DwVfpRegister src1,
+                      DwVfpRegister src2) {
+  DCHECK(IsEnabled(NEON));
+  // Qd = vmull(Dn, Dm) Vector Multiply Long (integer).
+  // Instruction details available in ARM DDI 0406C.b, A8-960.
+  int vd, d;
+  dst.split_code(&vd, &d);
+  int vn, n;
+  src1.split_code(&vn, &n);
+  int vm, m;
+  src2.split_code(&vm, &m);
+  int size = NeonSz(dt);
+  int u = NeonU(dt);
+  if (!u) UNIMPLEMENTED();
+  emit(0xFU * B28 | B25 | u * B24 | B23 | d * B22 | size * B20 | vn * B16 |
+       vd * B12 | 0xC * B8 | n * B7 | m * B5 | vm);
+}
+
 void Assembler::vmin(QwNeonRegister dst, QwNeonRegister src1,
                      QwNeonRegister src2) {
   DCHECK(IsEnabled(NEON));
@@ -4280,9 +4375,8 @@ static Instr EncodeNeonShiftRegisterOp(NeonShiftOp op, NeonDataType dt,
 static Instr EncodeNeonShiftOp(NeonShiftOp op, NeonSize size, bool is_unsigned,
                                NeonRegType reg_type, int dst_code, int src_code,
                                int shift) {
-  int imm6 = 0;
   int size_in_bits = kBitsPerByte << static_cast<int>(size);
-  int op_encoding = 0;
+  int op_encoding = 0, imm6 = 0, L = 0;
   switch (op) {
     case VSHL: {
       DCHECK(shift >= 0 && size_in_bits > shift);
@@ -4299,30 +4393,29 @@ static Instr EncodeNeonShiftOp(NeonShiftOp op, NeonSize size, bool is_unsigned,
     case VSLI: {
       DCHECK(shift >= 0 && size_in_bits > shift);
       imm6 = size_in_bits + shift;
-      int L = imm6 >> 6;
-      imm6 &= 0x3F;
-      op_encoding = B24 | 0x5 * B8 | L * B7;
+      op_encoding = B24 | 0x5 * B8;
       break;
     }
     case VSRI: {
       DCHECK(shift > 0 && size_in_bits >= shift);
       imm6 = 2 * size_in_bits - shift;
-      int L = imm6 >> 6;
-      imm6 &= 0x3F;
-      op_encoding = B24 | 0x4 * B8 | L * B7;
+      op_encoding = B24 | 0x4 * B8;
       break;
     }
     default:
       UNREACHABLE();
   }
 
+  L = imm6 >> 6;
+  imm6 &= 0x3F;
+
   int vd, d;
   NeonSplitCode(reg_type, dst_code, &vd, &d, &op_encoding);
   int vm, m;
   NeonSplitCode(reg_type, src_code, &vm, &m, &op_encoding);
 
-  return 0x1E5U * B23 | d * B22 | imm6 * B16 | vd * B12 | m * B5 | B4 | vm |
-         op_encoding;
+  return 0x1E5U * B23 | d * B22 | imm6 * B16 | vd * B12 | L * B7 | m * B5 | B4 |
+         vm | op_encoding;
 }
 
 void Assembler::vshl(NeonDataType dt, QwNeonRegister dst, QwNeonRegister src,
@@ -4538,6 +4631,14 @@ void Assembler::vcgt(NeonDataType dt, QwNeonRegister dst, QwNeonRegister src1,
   emit(EncodeNeonBinOp(VCGT, dt, dst, src1, src2));
 }
 
+void Assembler::vrhadd(NeonDataType dt, QwNeonRegister dst, QwNeonRegister src1,
+                       QwNeonRegister src2) {
+  DCHECK(IsEnabled(NEON));
+  // Qd = vrhadd(Qn, Qm) SIMD integer rounding halving add.
+  // Instruction details available in ARM DDI 0406C.b, A8-1030.
+  emit(EncodeNeonBinOp(VRHADD, dt, dst, src1, src2));
+}
+
 void Assembler::vext(QwNeonRegister dst, QwNeonRegister src1,
                      QwNeonRegister src2, int bytes) {
   DCHECK(IsEnabled(NEON));
diff --git a/deps/v8/src/codegen/arm/assembler-arm.h b/deps/v8/src/codegen/arm/assembler-arm.h
index 1d280e5555b8e1..61205760df046b 100644
--- a/deps/v8/src/codegen/arm/assembler-arm.h
+++ b/deps/v8/src/codegen/arm/assembler-arm.h
@@ -839,17 +839,21 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   // All these APIs support D0 to D31 and Q0 to Q15.
   void vld1(NeonSize size, const NeonListOperand& dst,
             const NeonMemOperand& src);
+  void vld1r(NeonSize size, const NeonListOperand& dst,
+             const NeonMemOperand& src);
   void vst1(NeonSize size, const NeonListOperand& src,
             const NeonMemOperand& dst);
   // dt represents the narrower type
   void vmovl(NeonDataType dt, QwNeonRegister dst, DwVfpRegister src);
-  // dt represents the narrower type.
-  void vqmovn(NeonDataType dt, DwVfpRegister dst, QwNeonRegister src);
+  // dst_dt represents the narrower type, src_dt represents the src type.
+  void vqmovn(NeonDataType dst_dt, NeonDataType src_dt, DwVfpRegister dst,
+              QwNeonRegister src);
 
   // Only unconditional core <-> scalar moves are currently supported.
   void vmov(NeonDataType dt, DwVfpRegister dst, int index, Register src);
   void vmov(NeonDataType dt, Register dst, DwVfpRegister src, int index);
 
+  void vmov(QwNeonRegister dst, uint64_t imm);
   void vmov(QwNeonRegister dst, QwNeonRegister src);
   void vdup(NeonSize size, QwNeonRegister dst, Register src);
   void vdup(NeonSize size, QwNeonRegister dst, DwVfpRegister src, int index);
@@ -869,6 +873,7 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void vneg(NeonSize size, QwNeonRegister dst, QwNeonRegister src);
 
   void vand(QwNeonRegister dst, QwNeonRegister src1, QwNeonRegister src2);
+  void vbic(QwNeonRegister dst, QwNeonRegister src1, QwNeonRegister src2);
   void veor(DwVfpRegister dst, DwVfpRegister src1, DwVfpRegister src2);
   void veor(QwNeonRegister dst, QwNeonRegister src1, QwNeonRegister src2);
   void vbsl(QwNeonRegister dst, QwNeonRegister src1, QwNeonRegister src2);
@@ -883,9 +888,13 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
             QwNeonRegister src2);
   void vqsub(NeonDataType dt, QwNeonRegister dst, QwNeonRegister src1,
              QwNeonRegister src2);
+  void vmlal(NeonDataType size, QwNeonRegister dst, DwVfpRegister src1,
+             DwVfpRegister src2);
   void vmul(QwNeonRegister dst, QwNeonRegister src1, QwNeonRegister src2);
   void vmul(NeonSize size, QwNeonRegister dst, QwNeonRegister src1,
             QwNeonRegister src2);
+  void vmull(NeonDataType size, QwNeonRegister dst, DwVfpRegister src1,
+             DwVfpRegister src2);
   void vmin(QwNeonRegister dst, QwNeonRegister src1, QwNeonRegister src2);
   void vmin(NeonDataType dt, QwNeonRegister dst, QwNeonRegister src1,
             QwNeonRegister src2);
@@ -921,6 +930,8 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void vcgt(QwNeonRegister dst, QwNeonRegister src1, QwNeonRegister src2);
   void vcgt(NeonDataType dt, QwNeonRegister dst, QwNeonRegister src1,
             QwNeonRegister src2);
+  void vrhadd(NeonDataType dt, QwNeonRegister dst, QwNeonRegister src1,
+              QwNeonRegister src2);
   void vext(QwNeonRegister dst, QwNeonRegister src1, QwNeonRegister src2,
             int bytes);
   void vzip(NeonSize size, DwVfpRegister src1, DwVfpRegister src2);
@@ -1198,6 +1209,7 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   // not have to check for overflow. The same is true for writes of large
   // relocation info entries.
   static constexpr int kGap = 32;
+  STATIC_ASSERT(AssemblerBase::kMinimalBufferSize >= 2 * kGap);
 
   // Relocation info generation
   // Each relocation is encoded as a variable size value
diff --git a/deps/v8/src/codegen/arm/constants-arm.h b/deps/v8/src/codegen/arm/constants-arm.h
index 66eea2180b70b4..171de9e1d7d135 100644
--- a/deps/v8/src/codegen/arm/constants-arm.h
+++ b/deps/v8/src/codegen/arm/constants-arm.h
@@ -295,15 +295,16 @@ enum LFlag {
 // Neon sizes.
 enum NeonSize { Neon8 = 0x0, Neon16 = 0x1, Neon32 = 0x2, Neon64 = 0x3 };
 
-// NEON data type
+// NEON data type, top bit set for unsigned data types.
 enum NeonDataType {
   NeonS8 = 0,
   NeonS16 = 1,
   NeonS32 = 2,
-  // Gap to make it easier to extract U and size.
+  NeonS64 = 3,
   NeonU8 = 4,
   NeonU16 = 5,
-  NeonU32 = 6
+  NeonU32 = 6,
+  NeonU64 = 7
 };
 
 inline int NeonU(NeonDataType dt) { return static_cast<int>(dt) >> 2; }
diff --git a/deps/v8/src/codegen/arm/cpu-arm.cc b/deps/v8/src/codegen/arm/cpu-arm.cc
index 868f360d5e44cf..9113de705d2052 100644
--- a/deps/v8/src/codegen/arm/cpu-arm.cc
+++ b/deps/v8/src/codegen/arm/cpu-arm.cc
@@ -7,6 +7,9 @@
 #ifdef __QNXNTO__
 #include <sys/mman.h>  // for cache flushing.
 #undef MAP_TYPE        // NOLINT
+#elif V8_OS_FREEBSD
+#include <machine/sysarch.h>  // for cache flushing
+#include <sys/types.h>
 #else
 #include <sys/syscall.h>  // for cache flushing.
 #endif
@@ -25,6 +28,10 @@ V8_NOINLINE void CpuFeatures::FlushICache(void* start, size_t size) {
 #if !defined(USE_SIMULATOR)
 #if V8_OS_QNX
   msync(start, size, MS_SYNC | MS_INVALIDATE_ICACHE);
+#elif V8_OS_FREEBSD
+  struct arm_sync_icache_args args = {
+      .addr = reinterpret_cast<uintptr_t>(start), .len = size};
+  sysarch(ARM_SYNC_ICACHE, reinterpret_cast<void*>(&args));
 #else
   register uint32_t beg asm("r0") = reinterpret_cast<uint32_t>(start);
   register uint32_t end asm("r1") = beg + size;
diff --git a/deps/v8/src/codegen/arm/macro-assembler-arm.cc b/deps/v8/src/codegen/arm/macro-assembler-arm.cc
index 6f1adfead26d14..46ad405489e7a7 100644
--- a/deps/v8/src/codegen/arm/macro-assembler-arm.cc
+++ b/deps/v8/src/codegen/arm/macro-assembler-arm.cc
@@ -121,28 +121,11 @@ void TurboAssembler::LoadFromConstantsTable(Register destination,
                                             int constant_index) {
   DCHECK(RootsTable::IsImmortalImmovable(RootIndex::kBuiltinsConstantsTable));
 
-  // The ldr call below could end up clobbering ip when the offset does not fit
-  // into 12 bits (and thus needs to be loaded from the constant pool). In that
-  // case, we need to be extra-careful and temporarily use another register as
-  // the target.
-
   const uint32_t offset =
       FixedArray::kHeaderSize + constant_index * kPointerSize - kHeapObjectTag;
-  const bool could_clobber_ip = !is_uint12(offset);
-
-  Register reg = destination;
-  if (could_clobber_ip) {
-    Push(r7);
-    reg = r7;
-  }
-
-  LoadRoot(reg, RootIndex::kBuiltinsConstantsTable);
-  ldr(destination, MemOperand(reg, offset));
 
-  if (could_clobber_ip) {
-    DCHECK_EQ(reg, r7);
-    Pop(r7);
-  }
+  LoadRoot(destination, RootIndex::kBuiltinsConstantsTable);
+  ldr(destination, MemOperand(destination, offset));
 }
 
 void TurboAssembler::LoadRootRelative(Register destination, int32_t offset) {
@@ -301,6 +284,7 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
   }
 
   // 'code' is always generated ARM code, never THUMB code
+  DCHECK(code->IsExecutable());
   Call(code.address(), rmode, cond, mode);
 }
 
@@ -326,7 +310,6 @@ void TurboAssembler::CallBuiltinByIndex(Register builtin_index) {
 
 void TurboAssembler::CallBuiltin(int builtin_index, Condition cond) {
   DCHECK(Builtins::IsBuiltinId(builtin_index));
-  DCHECK(FLAG_embedded_builtins);
   RecordCommentForOffHeapTrampoline(builtin_index);
   EmbeddedData d = EmbeddedData::FromBlob();
   Address entry = d.InstructionStartOfBuiltin(builtin_index);
@@ -447,21 +430,23 @@ void TurboAssembler::Push(Smi smi) {
 void TurboAssembler::Move(Register dst, Smi smi) { mov(dst, Operand(smi)); }
 
 void TurboAssembler::Move(Register dst, Handle<HeapObject> value) {
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadConstant(dst, value);
-      return;
-    }
+  // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+  // non-isolate-independent code. In many cases it might be cheaper than
+  // embedding the relocatable value.
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadConstant(dst, value);
+    return;
   }
   mov(dst, Operand(value));
 }
 
 void TurboAssembler::Move(Register dst, ExternalReference reference) {
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadExternalReference(dst, reference);
-      return;
-    }
+  // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+  // non-isolate-independent code. In many cases it might be cheaper than
+  // embedding the relocatable value.
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadExternalReference(dst, reference);
+    return;
   }
   mov(dst, Operand(reference));
 }
@@ -563,7 +548,9 @@ void MacroAssembler::And(Register dst, Register src1, const Operand& src2,
              base::bits::IsPowerOfTwo(src2.immediate() + 1)) {
     CpuFeatureScope scope(this, ARMv7);
     ubfx(dst, src1, 0,
-         WhichPowerOf2(static_cast<uint32_t>(src2.immediate()) + 1), cond);
+         base::bits::WhichPowerOfTwo(static_cast<uint32_t>(src2.immediate()) +
+                                     1),
+         cond);
   } else {
     and_(dst, src1, src2, LeaveCC, cond);
   }
@@ -1125,6 +1112,12 @@ void TurboAssembler::ExtractLane(SwVfpRegister dst, QwNeonRegister src,
   VmovExtended(dst.code(), s_code);
 }
 
+void TurboAssembler::ExtractLane(DwVfpRegister dst, QwNeonRegister src,
+                                 int lane) {
+  DwVfpRegister double_dst = DwVfpRegister::from_code(src.code() * 2 + lane);
+  vmov(dst, double_dst);
+}
+
 void TurboAssembler::ReplaceLane(QwNeonRegister dst, QwNeonRegister src,
                                  Register src_lane, NeonDataType dt, int lane) {
   Move(dst, src);
@@ -1145,6 +1138,13 @@ void TurboAssembler::ReplaceLane(QwNeonRegister dst, QwNeonRegister src,
   VmovExtended(s_code, src_lane.code());
 }
 
+void TurboAssembler::ReplaceLane(QwNeonRegister dst, QwNeonRegister src,
+                                 DwVfpRegister src_lane, int lane) {
+  Move(dst, src);
+  DwVfpRegister double_dst = DwVfpRegister::from_code(dst.code() * 2 + lane);
+  vmov(double_dst, src_lane);
+}
+
 void TurboAssembler::LslPair(Register dst_low, Register dst_high,
                              Register src_low, Register src_high,
                              Register shift) {
@@ -1173,6 +1173,7 @@ void TurboAssembler::LslPair(Register dst_low, Register dst_high,
 void TurboAssembler::LslPair(Register dst_low, Register dst_high,
                              Register src_low, Register src_high,
                              uint32_t shift) {
+  DCHECK_GE(63, shift);
   DCHECK(!AreAliased(dst_high, src_low));
 
   if (shift == 0) {
@@ -1221,6 +1222,7 @@ void TurboAssembler::LsrPair(Register dst_low, Register dst_high,
 void TurboAssembler::LsrPair(Register dst_low, Register dst_high,
                              Register src_low, Register src_high,
                              uint32_t shift) {
+  DCHECK_GE(63, shift);
   DCHECK(!AreAliased(dst_low, src_high));
 
   if (shift == 32) {
@@ -1268,6 +1270,7 @@ void TurboAssembler::AsrPair(Register dst_low, Register dst_high,
 void TurboAssembler::AsrPair(Register dst_low, Register dst_high,
                              Register src_low, Register src_high,
                              uint32_t shift) {
+  DCHECK_GE(63, shift);
   DCHECK(!AreAliased(dst_low, src_high));
 
   if (shift == 32) {
@@ -1480,35 +1483,23 @@ void TurboAssembler::MovFromFloatParameter(DwVfpRegister dst) {
   MovFromFloatResult(dst);
 }
 
-void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
-                                        Register caller_args_count_reg,
+void TurboAssembler::PrepareForTailCall(Register callee_args_count,
+                                        Register caller_args_count,
                                         Register scratch0, Register scratch1) {
-#if DEBUG
-  if (callee_args_count.is_reg()) {
-    DCHECK(!AreAliased(callee_args_count.reg(), caller_args_count_reg, scratch0,
-                       scratch1));
-  } else {
-    DCHECK(!AreAliased(caller_args_count_reg, scratch0, scratch1));
-  }
-#endif
+  DCHECK(!AreAliased(callee_args_count, caller_args_count, scratch0, scratch1));
 
   // Calculate the end of destination area where we will put the arguments
   // after we drop current frame. We add kPointerSize to count the receiver
   // argument which is not included into formal parameters count.
   Register dst_reg = scratch0;
-  add(dst_reg, fp, Operand(caller_args_count_reg, LSL, kPointerSizeLog2));
+  add(dst_reg, fp, Operand(caller_args_count, LSL, kPointerSizeLog2));
   add(dst_reg, dst_reg,
       Operand(StandardFrameConstants::kCallerSPOffset + kPointerSize));
 
-  Register src_reg = caller_args_count_reg;
+  Register src_reg = caller_args_count;
   // Calculate the end of source area. +kPointerSize is for the receiver.
-  if (callee_args_count.is_reg()) {
-    add(src_reg, sp, Operand(callee_args_count.reg(), LSL, kPointerSizeLog2));
-    add(src_reg, src_reg, Operand(kPointerSize));
-  } else {
-    add(src_reg, sp,
-        Operand((callee_args_count.immediate() + 1) * kPointerSize));
-  }
+  add(src_reg, sp, Operand(callee_args_count, LSL, kPointerSizeLog2));
+  add(src_reg, src_reg, Operand(kPointerSize));
 
   if (FLAG_debug_code) {
     cmp(src_reg, dst_reg);
@@ -1539,12 +1530,9 @@ void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
   mov(sp, dst_reg);
 }
 
-void MacroAssembler::InvokePrologue(const ParameterCount& expected,
-                                    const ParameterCount& actual, Label* done,
-                                    bool* definitely_mismatches,
-                                    InvokeFlag flag) {
-  bool definitely_matches = false;
-  *definitely_mismatches = false;
+void MacroAssembler::InvokePrologue(Register expected_parameter_count,
+                                    Register actual_parameter_count,
+                                    Label* done, InvokeFlag flag) {
   Label regular_invoke;
 
   // Check whether the expected and actual arguments count match. If not,
@@ -1554,72 +1542,36 @@ void MacroAssembler::InvokePrologue(const ParameterCount& expected,
   //  r2: expected arguments count
 
   // The code below is made a lot easier because the calling code already sets
-  // up actual and expected registers according to the contract if values are
-  // passed in registers.
-  DCHECK(actual.is_immediate() || actual.reg() == r0);
-  DCHECK(expected.is_immediate() || expected.reg() == r2);
-
-  if (expected.is_immediate()) {
-    DCHECK(actual.is_immediate());
-    mov(r0, Operand(actual.immediate()));
-    if (expected.immediate() == actual.immediate()) {
-      definitely_matches = true;
-    } else {
-      const int sentinel = SharedFunctionInfo::kDontAdaptArgumentsSentinel;
-      if (expected.immediate() == sentinel) {
-        // Don't worry about adapting arguments for builtins that
-        // don't want that done. Skip adaption code by making it look
-        // like we have a match between expected and actual number of
-        // arguments.
-        definitely_matches = true;
-      } else {
-        *definitely_mismatches = true;
-        mov(r2, Operand(expected.immediate()));
-      }
-    }
+  // up actual and expected registers according to the contract.
+  DCHECK_EQ(actual_parameter_count, r0);
+  DCHECK_EQ(expected_parameter_count, r2);
+
+  cmp(expected_parameter_count, actual_parameter_count);
+  b(eq, &regular_invoke);
+
+  Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
+  if (flag == CALL_FUNCTION) {
+    Call(adaptor);
+    b(done);
   } else {
-    if (actual.is_immediate()) {
-      mov(r0, Operand(actual.immediate()));
-      cmp(expected.reg(), Operand(actual.immediate()));
-      b(eq, &regular_invoke);
-    } else {
-      cmp(expected.reg(), Operand(actual.reg()));
-      b(eq, &regular_invoke);
-    }
+    Jump(adaptor, RelocInfo::CODE_TARGET);
   }
-
-  if (!definitely_matches) {
-    Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
-    if (flag == CALL_FUNCTION) {
-      Call(adaptor);
-      if (!*definitely_mismatches) {
-        b(done);
-      }
-    } else {
-      Jump(adaptor, RelocInfo::CODE_TARGET);
-    }
     bind(&regular_invoke);
-  }
 }
 
 void MacroAssembler::CallDebugOnFunctionCall(Register fun, Register new_target,
-                                             const ParameterCount& expected,
-                                             const ParameterCount& actual) {
+                                             Register expected_parameter_count,
+                                             Register actual_parameter_count) {
   // Load receiver to pass it later to DebugOnFunctionCall hook.
-  if (actual.is_reg()) {
-    ldr(r4, MemOperand(sp, actual.reg(), LSL, kPointerSizeLog2));
-  } else {
-    ldr(r4, MemOperand(sp, actual.immediate() << kPointerSizeLog2));
-  }
+  ldr(r4, MemOperand(sp, actual_parameter_count, LSL, kPointerSizeLog2));
   FrameScope frame(this, has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
-  if (expected.is_reg()) {
-    SmiTag(expected.reg());
-    Push(expected.reg());
-  }
-  if (actual.is_reg()) {
-    SmiTag(actual.reg());
-    Push(actual.reg());
-  }
+
+  SmiTag(expected_parameter_count);
+  Push(expected_parameter_count);
+
+  SmiTag(actual_parameter_count);
+  Push(actual_parameter_count);
+
   if (new_target.is_valid()) {
     Push(new_target);
   }
@@ -1631,23 +1583,21 @@ void MacroAssembler::CallDebugOnFunctionCall(Register fun, Register new_target,
   if (new_target.is_valid()) {
     Pop(new_target);
   }
-  if (actual.is_reg()) {
-    Pop(actual.reg());
-    SmiUntag(actual.reg());
-  }
-  if (expected.is_reg()) {
-    Pop(expected.reg());
-    SmiUntag(expected.reg());
-  }
+
+  Pop(actual_parameter_count);
+  SmiUntag(actual_parameter_count);
+
+  Pop(expected_parameter_count);
+  SmiUntag(expected_parameter_count);
 }
 
 void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
-                                        const ParameterCount& expected,
-                                        const ParameterCount& actual,
+                                        Register expected_parameter_count,
+                                        Register actual_parameter_count,
                                         InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
-  DCHECK(function == r1);
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
+  DCHECK_EQ(function, r1);
   DCHECK_IMPLIES(new_target.is_valid(), new_target == r3);
 
   // On function call, call into the debugger if necessary.
@@ -1668,26 +1618,24 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
   }
 
   Label done;
-  bool definitely_mismatches = false;
-  InvokePrologue(expected, actual, &done, &definitely_mismatches, flag);
-  if (!definitely_mismatches) {
-    // We call indirectly through the code field in the function to
-    // allow recompilation to take effect without changing any of the
-    // call sites.
-    Register code = kJavaScriptCallCodeStartRegister;
-    ldr(code, FieldMemOperand(function, JSFunction::kCodeOffset));
-    if (flag == CALL_FUNCTION) {
-      CallCodeObject(code);
-    } else {
-      DCHECK(flag == JUMP_FUNCTION);
-      JumpCodeObject(code);
-    }
+  InvokePrologue(expected_parameter_count, actual_parameter_count, &done, flag);
+  // We call indirectly through the code field in the function to
+  // allow recompilation to take effect without changing any of the
+  // call sites.
+  Register code = kJavaScriptCallCodeStartRegister;
+  ldr(code, FieldMemOperand(function, JSFunction::kCodeOffset));
+  if (flag == CALL_FUNCTION) {
+    CallCodeObject(code);
+  } else {
+    DCHECK(flag == JUMP_FUNCTION);
+    JumpCodeObject(code);
   }
   b(&done);
 
   // Deferred debug hook.
   bind(&debug_hook);
-  CallDebugOnFunctionCall(function, new_target, expected, actual);
+  CallDebugOnFunctionCall(function, new_target, expected_parameter_count,
+                          actual_parameter_count);
   b(&continue_after_hook);
 
   // Continue here if InvokePrologue does handle the invocation due to
@@ -1695,14 +1643,14 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
   bind(&done);
 }
 
-void MacroAssembler::InvokeFunction(Register fun, Register new_target,
-                                    const ParameterCount& actual,
-                                    InvokeFlag flag) {
+void MacroAssembler::InvokeFunctionWithNewTarget(
+    Register fun, Register new_target, Register actual_parameter_count,
+    InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
 
   // Contract with called JS functions requires that function is passed in r1.
-  DCHECK(fun == r1);
+  DCHECK_EQ(fun, r1);
 
   Register expected_reg = r2;
   Register temp_reg = r4;
@@ -1713,24 +1661,25 @@ void MacroAssembler::InvokeFunction(Register fun, Register new_target,
        FieldMemOperand(temp_reg,
                        SharedFunctionInfo::kFormalParameterCountOffset));
 
-  ParameterCount expected(expected_reg);
-  InvokeFunctionCode(fun, new_target, expected, actual, flag);
+  InvokeFunctionCode(fun, new_target, expected_reg, actual_parameter_count,
+                     flag);
 }
 
 void MacroAssembler::InvokeFunction(Register function,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
+                                    Register expected_parameter_count,
+                                    Register actual_parameter_count,
                                     InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
 
   // Contract with called JS functions requires that function is passed in r1.
-  DCHECK(function == r1);
+  DCHECK_EQ(function, r1);
 
   // Get the function and setup the context.
   ldr(cp, FieldMemOperand(r1, JSFunction::kContextOffset));
 
-  InvokeFunctionCode(r1, no_reg, expected, actual, flag);
+  InvokeFunctionCode(r1, no_reg, expected_parameter_count,
+                     actual_parameter_count, flag);
 }
 
 void MacroAssembler::MaybeDropFrames() {
@@ -1775,7 +1724,7 @@ void MacroAssembler::CompareObjectType(Register object, Register map,
   UseScratchRegisterScope temps(this);
   const Register temp = type_reg == no_reg ? temps.Acquire() : type_reg;
 
-  ldr(map, FieldMemOperand(object, HeapObject::kMapOffset));
+  LoadMap(map, object);
   CompareInstanceType(map, temp, type);
 }
 
@@ -1860,19 +1809,6 @@ void TurboAssembler::TruncateDoubleToI(Isolate* isolate, Zone* zone,
   bind(&done);
 }
 
-void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
-                                           Register centry) {
-  const Runtime::Function* f = Runtime::FunctionForId(fid);
-  // TODO(1236192): Most runtime routines don't need the number of
-  // arguments passed in because it is constant. At some point we
-  // should remove this need and make the runtime routine entry code
-  // smarter.
-  mov(r0, Operand(f->nargs));
-  Move(r1, ExternalReference::Create(f));
-  DCHECK(!AreAliased(centry, r0, r1));
-  CallCodeObject(centry);
-}
-
 void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
                                  SaveFPRegsMode save_doubles) {
   // All parameters are on the stack.  r0 has the return value after call.
@@ -2010,13 +1946,19 @@ void TurboAssembler::Abort(AbortReason reason) {
   // will not return here
 }
 
+void MacroAssembler::LoadMap(Register destination, Register object) {
+  ldr(destination, FieldMemOperand(object, HeapObject::kMapOffset));
+}
+
 void MacroAssembler::LoadGlobalProxy(Register dst) {
   LoadNativeContextSlot(Context::GLOBAL_PROXY_INDEX, dst);
 }
 
 void MacroAssembler::LoadNativeContextSlot(int index, Register dst) {
-  ldr(dst, NativeContextMemOperand());
-  ldr(dst, ContextMemOperand(dst, index));
+  LoadMap(dst, cp);
+  ldr(dst, FieldMemOperand(
+               dst, Map::kConstructorOrBackPointerOrNativeContextOffset));
+  ldr(dst, MemOperand(dst, Context::SlotOffset(index)));
 }
 
 void TurboAssembler::InitializeRootRegister() {
@@ -2078,9 +2020,9 @@ void MacroAssembler::AssertConstructor(Register object) {
     tst(object, Operand(kSmiTagMask));
     Check(ne, AbortReason::kOperandIsASmiAndNotAConstructor);
     push(object);
-    ldr(object, FieldMemOperand(object, HeapObject::kMapOffset));
+    LoadMap(object, object);
     ldrb(object, FieldMemOperand(object, Map::kBitFieldOffset));
-    tst(object, Operand(Map::IsConstructorBit::kMask));
+    tst(object, Operand(Map::Bits1::IsConstructorBit::kMask));
     pop(object);
     Check(ne, AbortReason::kOperandIsNotAConstructor);
   }
@@ -2118,7 +2060,7 @@ void MacroAssembler::AssertGeneratorObject(Register object) {
   // Load map
   Register map = object;
   push(object);
-  ldr(map, FieldMemOperand(object, HeapObject::kMapOffset));
+  LoadMap(map, object);
 
   // Check if JSGeneratorObject
   Label do_check;
@@ -2146,7 +2088,7 @@ void MacroAssembler::AssertUndefinedOrAllocationSite(Register object,
     AssertNotSmi(object);
     CompareRoot(object, RootIndex::kUndefinedValue);
     b(eq, &done_checking);
-    ldr(scratch, FieldMemOperand(object, HeapObject::kMapOffset));
+    LoadMap(scratch, object);
     CompareInstanceType(scratch, scratch, ALLOCATION_SITE_TYPE);
     Assert(eq, AbortReason::kExpectedUndefinedOrCell);
     bind(&done_checking);
@@ -2530,6 +2472,8 @@ void TurboAssembler::CallForDeoptimization(Address target, int deopt_id) {
   CheckConstPool(false, false);
 }
 
+void TurboAssembler::Trap() { stop(); }
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/arm/macro-assembler-arm.h b/deps/v8/src/codegen/arm/macro-assembler-arm.h
index 4807a6d20da3f9..d0d9b1c6552384 100644
--- a/deps/v8/src/codegen/arm/macro-assembler-arm.h
+++ b/deps/v8/src/codegen/arm/macro-assembler-arm.h
@@ -223,11 +223,11 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 
   // Removes current frame and its arguments from the stack preserving
   // the arguments and a return address pushed to the stack for the next call.
-  // Both |callee_args_count| and |caller_args_count_reg| do not include
-  // receiver. |callee_args_count| is not modified, |caller_args_count_reg|
+  // Both |callee_args_count| and |caller_args_count| do not include
+  // receiver. |callee_args_count| is not modified. |caller_args_count|
   // is trashed.
-  void PrepareForTailCall(const ParameterCount& callee_args_count,
-                          Register caller_args_count_reg, Register scratch0,
+  void PrepareForTailCall(Register callee_args_count,
+                          Register caller_args_count, Register scratch0,
                           Register scratch1);
 
   // There are two ways of passing double arguments on ARM, depending on
@@ -253,6 +253,8 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void MovFromFloatParameter(DwVfpRegister dst);
   void MovFromFloatResult(DwVfpRegister dst);
 
+  void Trap() override;
+
   // Calls Abort(msg) if the condition cond is not satisfied.
   // Use --debug-code to enable.
   void Assert(Condition cond, AbortReason reason);
@@ -285,10 +287,6 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void LoadRootRegisterOffset(Register destination, intptr_t offset) override;
   void LoadRootRelative(Register destination, int32_t offset) override;
 
-  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
-  // builtin for the target runtime function and uses an indirect call.
-  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
-
   // Jump, Call, and Ret pseudo instructions implementing inter-working.
   void Call(Register target, Condition cond = al);
   void Call(Address target, RelocInfo::Mode rmode, Condition cond = al,
@@ -440,10 +438,13 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void ExtractLane(Register dst, QwNeonRegister src, NeonDataType dt, int lane);
   void ExtractLane(Register dst, DwVfpRegister src, NeonDataType dt, int lane);
   void ExtractLane(SwVfpRegister dst, QwNeonRegister src, int lane);
+  void ExtractLane(DwVfpRegister dst, QwNeonRegister src, int lane);
   void ReplaceLane(QwNeonRegister dst, QwNeonRegister src, Register src_lane,
                    NeonDataType dt, int lane);
   void ReplaceLane(QwNeonRegister dst, QwNeonRegister src,
                    SwVfpRegister src_lane, int lane);
+  void ReplaceLane(QwNeonRegister dst, QwNeonRegister src,
+                   DwVfpRegister src_lane, int lane);
 
   // Register move. May do nothing if the registers are identical.
   void Move(Register dst, Smi smi);
@@ -620,6 +621,8 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   void LeaveExitFrame(bool save_doubles, Register argument_count,
                       bool argument_count_is_length = false);
 
+  void LoadMap(Register destination, Register object);
+
   // Load the global proxy from the current context.
   void LoadGlobalProxy(Register dst);
 
@@ -630,21 +633,22 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
 
   // Invoke the JavaScript function code by either calling or jumping.
   void InvokeFunctionCode(Register function, Register new_target,
-                          const ParameterCount& expected,
-                          const ParameterCount& actual, InvokeFlag flag);
+                          Register expected_parameter_count,
+                          Register actual_parameter_count, InvokeFlag flag);
 
   // On function call, call into the debugger.
   void CallDebugOnFunctionCall(Register fun, Register new_target,
-                               const ParameterCount& expected,
-                               const ParameterCount& actual);
+                               Register expected_parameter_count,
+                               Register actual_parameter_count);
 
   // Invoke the JavaScript function in the given register. Changes the
   // current context to the context in the function before invoking.
-  void InvokeFunction(Register function, Register new_target,
-                      const ParameterCount& actual, InvokeFlag flag);
+  void InvokeFunctionWithNewTarget(Register function, Register new_target,
+                                   Register actual_parameter_count,
+                                   InvokeFlag flag);
 
-  void InvokeFunction(Register function, const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
+  void InvokeFunction(Register function, Register expected_parameter_count,
+                      Register actual_parameter_count, InvokeFlag flag);
 
   // Frame restart support
   void MaybeDropFrames();
@@ -791,9 +795,9 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
 
  private:
   // Helper functions for generating invokes.
-  void InvokePrologue(const ParameterCount& expected,
-                      const ParameterCount& actual, Label* done,
-                      bool* definitely_mismatches, InvokeFlag flag);
+  void InvokePrologue(Register expected_parameter_count,
+                      Register actual_parameter_count, Label* done,
+                      InvokeFlag flag);
 
   // Compute memory operands for safepoint stack slots.
   static int SafepointRegisterStackIndex(int reg_code);
@@ -805,17 +809,6 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   DISALLOW_IMPLICIT_CONSTRUCTORS(MacroAssembler);
 };
 
-// -----------------------------------------------------------------------------
-// Static helper functions.
-
-inline MemOperand ContextMemOperand(Register context, int index = 0) {
-  return MemOperand(context, Context::SlotOffset(index));
-}
-
-inline MemOperand NativeContextMemOperand() {
-  return ContextMemOperand(cp, Context::NATIVE_CONTEXT_INDEX);
-}
-
 #define ACCESS_MASM(masm) masm->
 
 }  // namespace internal
diff --git a/deps/v8/src/codegen/arm/register-arm.h b/deps/v8/src/codegen/arm/register-arm.h
index f3639a8f27896d..2130bdf0a4bbe0 100644
--- a/deps/v8/src/codegen/arm/register-arm.h
+++ b/deps/v8/src/codegen/arm/register-arm.h
@@ -126,7 +126,7 @@ static_assert(sizeof(Register) == sizeof(int),
 
 // r7: context register
 #define DECLARE_REGISTER(R) \
-  constexpr Register R = Register::from_code<kRegCode_##R>();
+  constexpr Register R = Register::from_code(kRegCode_##R);
 GENERAL_REGISTERS(DECLARE_REGISTER)
 #undef DECLARE_REGISTER
 constexpr Register no_reg = Register::no_reg();
@@ -223,7 +223,7 @@ using DoubleRegister = DwVfpRegister;
 class LowDwVfpRegister
     : public RegisterBase<LowDwVfpRegister, kDoubleCode_d16> {
  public:
-  constexpr operator DwVfpRegister() const { return DwVfpRegister(reg_code_); }
+  constexpr operator DwVfpRegister() const { return DwVfpRegister(code()); }
 
   SwVfpRegister low() const { return SwVfpRegister::from_code(code() * 2); }
   SwVfpRegister high() const {
@@ -292,24 +292,24 @@ class CRegister : public RegisterBase<CRegister, kCAfterLast> {
 // Support for the VFP registers s0 to s31 (d0 to d15).
 // Note that "s(N):s(N+1)" is the same as "d(N/2)".
 #define DECLARE_FLOAT_REGISTER(R) \
-  constexpr SwVfpRegister R = SwVfpRegister::from_code<kSwVfpCode_##R>();
+  constexpr SwVfpRegister R = SwVfpRegister::from_code(kSwVfpCode_##R);
 FLOAT_REGISTERS(DECLARE_FLOAT_REGISTER)
 #undef DECLARE_FLOAT_REGISTER
 
 #define DECLARE_LOW_DOUBLE_REGISTER(R) \
-  constexpr LowDwVfpRegister R = LowDwVfpRegister::from_code<kDoubleCode_##R>();
+  constexpr LowDwVfpRegister R = LowDwVfpRegister::from_code(kDoubleCode_##R);
 LOW_DOUBLE_REGISTERS(DECLARE_LOW_DOUBLE_REGISTER)
 #undef DECLARE_LOW_DOUBLE_REGISTER
 
 #define DECLARE_DOUBLE_REGISTER(R) \
-  constexpr DwVfpRegister R = DwVfpRegister::from_code<kDoubleCode_##R>();
+  constexpr DwVfpRegister R = DwVfpRegister::from_code(kDoubleCode_##R);
 NON_LOW_DOUBLE_REGISTERS(DECLARE_DOUBLE_REGISTER)
 #undef DECLARE_DOUBLE_REGISTER
 
 constexpr DwVfpRegister no_dreg = DwVfpRegister::no_reg();
 
 #define DECLARE_SIMD128_REGISTER(R) \
-  constexpr Simd128Register R = Simd128Register::from_code<kSimd128Code_##R>();
+  constexpr Simd128Register R = Simd128Register::from_code(kSimd128Code_##R);
 SIMD128_REGISTERS(DECLARE_SIMD128_REGISTER)
 #undef DECLARE_SIMD128_REGISTER
 
@@ -321,7 +321,7 @@ constexpr LowDwVfpRegister kDoubleRegZero = d13;
 constexpr CRegister no_creg = CRegister::no_reg();
 
 #define DECLARE_C_REGISTER(R) \
-  constexpr CRegister R = CRegister::from_code<kCCode_##R>();
+  constexpr CRegister R = CRegister::from_code(kCCode_##R);
 C_REGISTERS(DECLARE_C_REGISTER)
 #undef DECLARE_C_REGISTER
 
diff --git a/deps/v8/src/codegen/arm64/assembler-arm64-inl.h b/deps/v8/src/codegen/arm64/assembler-arm64-inl.h
index ce34da7dc2acf6..8416defe3cccaa 100644
--- a/deps/v8/src/codegen/arm64/assembler-arm64-inl.h
+++ b/deps/v8/src/codegen/arm64/assembler-arm64-inl.h
@@ -44,13 +44,13 @@ inline bool CPURegister::IsSameSizeAndType(const CPURegister& other) const {
 }
 
 inline bool CPURegister::IsZero() const {
-  DCHECK(IsValid());
-  return IsRegister() && (reg_code_ == kZeroRegCode);
+  DCHECK(is_valid());
+  return IsRegister() && (code() == kZeroRegCode);
 }
 
 inline bool CPURegister::IsSP() const {
-  DCHECK(IsValid());
-  return IsRegister() && (reg_code_ == kSPRegInternalCode);
+  DCHECK(is_valid());
+  return IsRegister() && (code() == kSPRegInternalCode);
 }
 
 inline void CPURegList::Combine(const CPURegList& other) {
@@ -82,13 +82,13 @@ inline void CPURegList::Remove(const CPURegister& other1,
 }
 
 inline void CPURegList::Combine(int code) {
-  DCHECK(CPURegister::Create(code, size_, type_).IsValid());
+  DCHECK(CPURegister::Create(code, size_, type_).is_valid());
   list_ |= (1ULL << code);
-  DCHECK(IsValid());
+  DCHECK(is_valid());
 }
 
 inline void CPURegList::Remove(int code) {
-  DCHECK(CPURegister::Create(code, size_, type_).IsValid());
+  DCHECK(CPURegister::Create(code, size_, type_).is_valid());
   list_ &= ~(1ULL << code);
 }
 
@@ -142,52 +142,52 @@ inline VRegister VRegister::VRegFromCode(unsigned code) {
 
 inline Register CPURegister::W() const {
   DCHECK(IsRegister());
-  return Register::WRegFromCode(reg_code_);
+  return Register::WRegFromCode(code());
 }
 
 inline Register CPURegister::Reg() const {
   DCHECK(IsRegister());
-  return Register::Create(reg_code_, reg_size_);
+  return Register::Create(code(), reg_size_);
 }
 
 inline VRegister CPURegister::VReg() const {
   DCHECK(IsVRegister());
-  return VRegister::Create(reg_code_, reg_size_);
+  return VRegister::Create(code(), reg_size_);
 }
 
 inline Register CPURegister::X() const {
   DCHECK(IsRegister());
-  return Register::XRegFromCode(reg_code_);
+  return Register::XRegFromCode(code());
 }
 
 inline VRegister CPURegister::V() const {
   DCHECK(IsVRegister());
-  return VRegister::VRegFromCode(reg_code_);
+  return VRegister::VRegFromCode(code());
 }
 
 inline VRegister CPURegister::B() const {
   DCHECK(IsVRegister());
-  return VRegister::BRegFromCode(reg_code_);
+  return VRegister::BRegFromCode(code());
 }
 
 inline VRegister CPURegister::H() const {
   DCHECK(IsVRegister());
-  return VRegister::HRegFromCode(reg_code_);
+  return VRegister::HRegFromCode(code());
 }
 
 inline VRegister CPURegister::S() const {
   DCHECK(IsVRegister());
-  return VRegister::SRegFromCode(reg_code_);
+  return VRegister::SRegFromCode(code());
 }
 
 inline VRegister CPURegister::D() const {
   DCHECK(IsVRegister());
-  return VRegister::DRegFromCode(reg_code_);
+  return VRegister::DRegFromCode(code());
 }
 
 inline VRegister CPURegister::Q() const {
   DCHECK(IsVRegister());
-  return VRegister::QRegFromCode(reg_code_);
+  return VRegister::QRegFromCode(code());
 }
 
 // Immediate.
@@ -261,7 +261,7 @@ Operand::Operand(Register reg, Extend extend, unsigned shift_amount)
       shift_(NO_SHIFT),
       extend_(extend),
       shift_amount_(shift_amount) {
-  DCHECK(reg.IsValid());
+  DCHECK(reg.is_valid());
   DCHECK_LE(shift_amount, 4);
   DCHECK(!reg.IsSP());
 
@@ -270,7 +270,7 @@ Operand::Operand(Register reg, Extend extend, unsigned shift_amount)
 }
 
 bool Operand::IsHeapObjectRequest() const {
-  DCHECK_IMPLIES(heap_object_request_.has_value(), reg_.Is(NoReg));
+  DCHECK_IMPLIES(heap_object_request_.has_value(), reg_ == NoReg);
   DCHECK_IMPLIES(heap_object_request_.has_value(),
                  immediate_.rmode() == RelocInfo::FULL_EMBEDDED_OBJECT ||
                      immediate_.rmode() == RelocInfo::CODE_TARGET);
@@ -283,15 +283,15 @@ HeapObjectRequest Operand::heap_object_request() const {
 }
 
 bool Operand::IsImmediate() const {
-  return reg_.Is(NoReg) && !IsHeapObjectRequest();
+  return reg_ == NoReg && !IsHeapObjectRequest();
 }
 
 bool Operand::IsShiftedRegister() const {
-  return reg_.IsValid() && (shift_ != NO_SHIFT);
+  return reg_.is_valid() && (shift_ != NO_SHIFT);
 }
 
 bool Operand::IsExtendedRegister() const {
-  return reg_.IsValid() && (extend_ != NO_EXTEND);
+  return reg_.is_valid() && (extend_ != NO_EXTEND);
 }
 
 bool Operand::IsZero() const {
@@ -452,11 +452,11 @@ MemOperand::MemOperand(Register base, const Operand& offset, AddrMode addrmode)
 }
 
 bool MemOperand::IsImmediateOffset() const {
-  return (addrmode_ == Offset) && regoffset_.Is(NoReg);
+  return (addrmode_ == Offset) && regoffset_ == NoReg;
 }
 
 bool MemOperand::IsRegisterOffset() const {
-  return (addrmode_ == Offset) && !regoffset_.Is(NoReg);
+  return (addrmode_ == Offset) && regoffset_ != NoReg;
 }
 
 bool MemOperand::IsPreIndex() const { return addrmode_ == PreIndex; }
@@ -476,14 +476,7 @@ Operand MemOperand::OffsetAsOperand() const {
   }
 }
 
-void Assembler::Unreachable() {
-#ifdef USE_SIMULATOR
-  debug("UNREACHABLE", __LINE__, BREAK);
-#else
-  // Crash by branching to 0. lr now points near the fault.
-  Emit(BLR | Rn(xzr));
-#endif
-}
+void Assembler::Unreachable() { debug("UNREACHABLE", __LINE__, BREAK); }
 
 Address Assembler::target_pointer_address_at(Address pc) {
   Instruction* instr = reinterpret_cast<Instruction*>(pc);
@@ -782,7 +775,7 @@ void RelocInfo::WipeOut() {
 }
 
 LoadStoreOp Assembler::LoadOpFor(const CPURegister& rt) {
-  DCHECK(rt.IsValid());
+  DCHECK(rt.is_valid());
   if (rt.IsRegister()) {
     return rt.Is64Bits() ? LDR_x : LDR_w;
   } else {
@@ -804,7 +797,7 @@ LoadStoreOp Assembler::LoadOpFor(const CPURegister& rt) {
 }
 
 LoadStoreOp Assembler::StoreOpFor(const CPURegister& rt) {
-  DCHECK(rt.IsValid());
+  DCHECK(rt.is_valid());
   if (rt.IsRegister()) {
     return rt.Is64Bits() ? STR_x : STR_w;
   } else {
@@ -1013,7 +1006,8 @@ Instr Assembler::ImmLS(int imm9) {
 }
 
 Instr Assembler::ImmLSPair(int imm7, unsigned size) {
-  DCHECK_EQ((imm7 >> size) << size, imm7);
+  DCHECK_EQ(imm7,
+            static_cast<int>(static_cast<uint32_t>(imm7 >> size) << size));
   int scaled_imm7 = imm7 >> size;
   DCHECK(is_int7(scaled_imm7));
   return truncate_to_int7(scaled_imm7) << ImmLSPair_offset;
diff --git a/deps/v8/src/codegen/arm64/assembler-arm64.cc b/deps/v8/src/codegen/arm64/assembler-arm64.cc
index ea2f4696bdbca1..c3bae988f6999a 100644
--- a/deps/v8/src/codegen/arm64/assembler-arm64.cc
+++ b/deps/v8/src/codegen/arm64/assembler-arm64.cc
@@ -216,7 +216,7 @@ bool AreAliased(const CPURegister& reg1, const CPURegister& reg2,
       number_of_valid_fpregs++;
       unique_fpregs |= regs[i].bit();
     } else {
-      DCHECK(!regs[i].IsValid());
+      DCHECK(!regs[i].is_valid());
     }
   }
 
@@ -236,44 +236,44 @@ bool AreSameSizeAndType(const CPURegister& reg1, const CPURegister& reg2,
                         const CPURegister& reg3, const CPURegister& reg4,
                         const CPURegister& reg5, const CPURegister& reg6,
                         const CPURegister& reg7, const CPURegister& reg8) {
-  DCHECK(reg1.IsValid());
+  DCHECK(reg1.is_valid());
   bool match = true;
-  match &= !reg2.IsValid() || reg2.IsSameSizeAndType(reg1);
-  match &= !reg3.IsValid() || reg3.IsSameSizeAndType(reg1);
-  match &= !reg4.IsValid() || reg4.IsSameSizeAndType(reg1);
-  match &= !reg5.IsValid() || reg5.IsSameSizeAndType(reg1);
-  match &= !reg6.IsValid() || reg6.IsSameSizeAndType(reg1);
-  match &= !reg7.IsValid() || reg7.IsSameSizeAndType(reg1);
-  match &= !reg8.IsValid() || reg8.IsSameSizeAndType(reg1);
+  match &= !reg2.is_valid() || reg2.IsSameSizeAndType(reg1);
+  match &= !reg3.is_valid() || reg3.IsSameSizeAndType(reg1);
+  match &= !reg4.is_valid() || reg4.IsSameSizeAndType(reg1);
+  match &= !reg5.is_valid() || reg5.IsSameSizeAndType(reg1);
+  match &= !reg6.is_valid() || reg6.IsSameSizeAndType(reg1);
+  match &= !reg7.is_valid() || reg7.IsSameSizeAndType(reg1);
+  match &= !reg8.is_valid() || reg8.IsSameSizeAndType(reg1);
   return match;
 }
 
 bool AreSameFormat(const VRegister& reg1, const VRegister& reg2,
                    const VRegister& reg3, const VRegister& reg4) {
-  DCHECK(reg1.IsValid());
-  return (!reg2.IsValid() || reg2.IsSameFormat(reg1)) &&
-         (!reg3.IsValid() || reg3.IsSameFormat(reg1)) &&
-         (!reg4.IsValid() || reg4.IsSameFormat(reg1));
+  DCHECK(reg1.is_valid());
+  return (!reg2.is_valid() || reg2.IsSameFormat(reg1)) &&
+         (!reg3.is_valid() || reg3.IsSameFormat(reg1)) &&
+         (!reg4.is_valid() || reg4.IsSameFormat(reg1));
 }
 
 bool AreConsecutive(const VRegister& reg1, const VRegister& reg2,
                     const VRegister& reg3, const VRegister& reg4) {
-  DCHECK(reg1.IsValid());
-  if (!reg2.IsValid()) {
-    DCHECK(!reg3.IsValid() && !reg4.IsValid());
+  DCHECK(reg1.is_valid());
+  if (!reg2.is_valid()) {
+    DCHECK(!reg3.is_valid() && !reg4.is_valid());
     return true;
   } else if (reg2.code() != ((reg1.code() + 1) % kNumberOfVRegisters)) {
     return false;
   }
 
-  if (!reg3.IsValid()) {
-    DCHECK(!reg4.IsValid());
+  if (!reg3.is_valid()) {
+    DCHECK(!reg4.is_valid());
     return true;
   } else if (reg3.code() != ((reg2.code() + 1) % kNumberOfVRegisters)) {
     return false;
   }
 
-  if (!reg4.IsValid()) {
+  if (!reg4.is_valid()) {
     return true;
   } else if (reg4.code() != ((reg3.code() + 1) % kNumberOfVRegisters)) {
     return false;
@@ -299,7 +299,7 @@ MemOperand::PairResult MemOperand::AreConsistentForPair(
   DCHECK_LE(access_size_log2, 3);
   // Step one: check that they share the same base, that the mode is Offset
   // and that the offset is a multiple of access size.
-  if (!operandA.base().Is(operandB.base()) || (operandA.addrmode() != Offset) ||
+  if (operandA.base() != operandB.base() || (operandA.addrmode() != Offset) ||
       (operandB.addrmode() != Offset) ||
       ((operandA.offset() & ((1 << access_size_log2) - 1)) != 0)) {
     return kNotPair;
@@ -752,7 +752,7 @@ void Assembler::blr(const Register& xn) {
   DCHECK(xn.Is64Bits());
   // The pattern 'blr xzr' is used as a guard to detect when execution falls
   // through the constant pool. It should not be emitted.
-  DCHECK(!xn.Is(xzr));
+  DCHECK_NE(xn, xzr);
   Emit(BLR | Rn(xn));
 }
 
@@ -1209,7 +1209,7 @@ void Assembler::ldpsw(const Register& rt, const Register& rt2,
 void Assembler::LoadStorePair(const CPURegister& rt, const CPURegister& rt2,
                               const MemOperand& addr, LoadStorePairOp op) {
   // 'rt' and 'rt2' can only be aliased for stores.
-  DCHECK(((op & LoadStorePairLBit) == 0) || !rt.Is(rt2));
+  DCHECK(((op & LoadStorePairLBit) == 0) || rt != rt2);
   DCHECK(AreSameSizeAndType(rt, rt2));
   DCHECK(IsImmLSPair(addr.offset(), CalcLSPairDataSize(op)));
   int offset = static_cast<int>(addr.offset());
@@ -1222,8 +1222,8 @@ void Assembler::LoadStorePair(const CPURegister& rt, const CPURegister& rt2,
     addrmodeop = LoadStorePairOffsetFixed;
   } else {
     // Pre-index and post-index modes.
-    DCHECK(!rt.Is(addr.base()));
-    DCHECK(!rt2.Is(addr.base()));
+    DCHECK_NE(rt, addr.base());
+    DCHECK_NE(rt2, addr.base());
     DCHECK_NE(addr.offset(), 0);
     if (addr.IsPreIndex()) {
       addrmodeop = LoadStorePairPreIndexFixed;
@@ -1337,7 +1337,7 @@ void Assembler::stlr(const Register& rt, const Register& rn) {
 void Assembler::stlxr(const Register& rs, const Register& rt,
                       const Register& rn) {
   DCHECK(rn.Is64Bits());
-  DCHECK(!rs.Is(rt) && !rs.Is(rn));
+  DCHECK(rs != rt && rs != rn);
   LoadStoreAcquireReleaseOp op = rt.Is32Bits() ? STLXR_w : STLXR_x;
   Emit(op | Rs(rs) | Rt2(x31) | RnSP(rn) | Rt(rt));
 }
@@ -1365,7 +1365,7 @@ void Assembler::stlxrb(const Register& rs, const Register& rt,
   DCHECK(rs.Is32Bits());
   DCHECK(rt.Is32Bits());
   DCHECK(rn.Is64Bits());
-  DCHECK(!rs.Is(rt) && !rs.Is(rn));
+  DCHECK(rs != rt && rs != rn);
   Emit(STLXR_b | Rs(rs) | Rt2(x31) | RnSP(rn) | Rt(rt));
 }
 
@@ -1392,7 +1392,7 @@ void Assembler::stlxrh(const Register& rs, const Register& rt,
   DCHECK(rs.Is32Bits());
   DCHECK(rt.Is32Bits());
   DCHECK(rn.Is64Bits());
-  DCHECK(!rs.Is(rt) && !rs.Is(rn));
+  DCHECK(rs != rt && rs != rn);
   Emit(STLXR_h | Rs(rs) | Rt2(x31) | RnSP(rn) | Rt(rt));
 }
 
@@ -2282,7 +2282,7 @@ void Assembler::LoadStoreStructVerify(const VRegister& vt,
       default:
         UNREACHABLE();
     }
-    DCHECK(!addr.regoffset().Is(NoReg) || addr.offset() == offset);
+    DCHECK(addr.regoffset() != NoReg || addr.offset() == offset);
   }
 #else
   USE(vt);
@@ -3654,7 +3654,6 @@ void Assembler::EmitStringData(const char* string) {
 }
 
 void Assembler::debug(const char* message, uint32_t code, Instr params) {
-#ifdef USE_SIMULATOR
   if (options().enable_simulator_code) {
     // The arguments to the debug marker need to be contiguous in memory, so
     // make sure we don't try to emit pools.
@@ -3676,12 +3675,6 @@ void Assembler::debug(const char* message, uint32_t code, Instr params) {
 
     return;
   }
-  // Fall through if Serializer is enabled.
-#else
-  // Make sure we haven't dynamically enabled simulator code when there is no
-  // simulator built in.
-  DCHECK(!options().enable_simulator_code);
-#endif
 
   if (params & BREAK) {
     brk(0);
@@ -3947,7 +3940,7 @@ void Assembler::LoadStore(const CPURegister& rt, const MemOperand& addr,
          ExtendMode(ext) | ImmShiftLS((shift_amount > 0) ? 1 : 0));
   } else {
     // Pre-index and post-index modes.
-    DCHECK(!rt.Is(addr.base()));
+    DCHECK_NE(rt, addr.base());
     if (IsImmLSUnscaled(addr.offset())) {
       int offset = static_cast<int>(addr.offset());
       if (addr.IsPreIndex()) {
diff --git a/deps/v8/src/codegen/arm64/assembler-arm64.h b/deps/v8/src/codegen/arm64/assembler-arm64.h
index 23e8acb1f95c91..04fbaf3fb0105e 100644
--- a/deps/v8/src/codegen/arm64/assembler-arm64.h
+++ b/deps/v8/src/codegen/arm64/assembler-arm64.h
@@ -2638,7 +2638,8 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   // not have to check for overflow. The same is true for writes of large
   // relocation info entries, and debug strings encoded in the instruction
   // stream.
-  static constexpr int kGap = 128;
+  static constexpr int kGap = 64;
+  STATIC_ASSERT(AssemblerBase::kMinimalBufferSize >= 2 * kGap);
 
  public:
 #ifdef DEBUG
diff --git a/deps/v8/src/codegen/arm64/instrument-arm64.cc b/deps/v8/src/codegen/arm64/instrument-arm64.cc
deleted file mode 100644
index a399cd3ad1e070..00000000000000
--- a/deps/v8/src/codegen/arm64/instrument-arm64.cc
+++ /dev/null
@@ -1,698 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/codegen/arm64/instrument-arm64.h"
-
-namespace v8 {
-namespace internal {
-
-Counter::Counter(const char* name, CounterType type)
-    : count_(0), enabled_(false), type_(type) {
-  DCHECK_NOT_NULL(name);
-  strncpy(name_, name, kCounterNameMaxLength);
-}
-
-void Counter::Enable() { enabled_ = true; }
-
-void Counter::Disable() { enabled_ = false; }
-
-bool Counter::IsEnabled() { return enabled_; }
-
-void Counter::Increment() {
-  if (enabled_) {
-    count_++;
-  }
-}
-
-uint64_t Counter::count() {
-  uint64_t result = count_;
-  if (type_ == Gauge) {
-    // If the counter is a Gauge, reset the count after reading.
-    count_ = 0;
-  }
-  return result;
-}
-
-const char* Counter::name() { return name_; }
-
-CounterType Counter::type() { return type_; }
-
-struct CounterDescriptor {
-  const char* name;
-  CounterType type;
-};
-
-static const CounterDescriptor kCounterList[] = {
-    {"Instruction", Cumulative},
-
-    {"Move Immediate", Gauge},
-    {"Add/Sub DP", Gauge},
-    {"Logical DP", Gauge},
-    {"Other Int DP", Gauge},
-    {"FP DP", Gauge},
-    {"NEON", Gauge},
-
-    {"Conditional Select", Gauge},
-    {"Conditional Compare", Gauge},
-
-    {"Unconditional Branch", Gauge},
-    {"Compare and Branch", Gauge},
-    {"Test and Branch", Gauge},
-    {"Conditional Branch", Gauge},
-
-    {"Load Integer", Gauge},
-    {"Load FP", Gauge},
-    {"Load Pair", Gauge},
-    {"Load Literal", Gauge},
-    {"Load Acquire", Gauge},
-
-    {"Store Integer", Gauge},
-    {"Store FP", Gauge},
-    {"Store Pair", Gauge},
-    {"Store Release", Gauge},
-
-    {"PC Addressing", Gauge},
-    {"Other", Gauge},
-};
-
-Instrument::Instrument(const char* datafile, uint64_t sample_period)
-    : output_stream_(stderr), sample_period_(sample_period) {
-  // Set up the output stream. If datafile is non-nullptr, use that file. If it
-  // can't be opened, or datafile is nullptr, use stderr.
-  if (datafile != nullptr) {
-    output_stream_ = fopen(datafile, "w");
-    if (output_stream_ == nullptr) {
-      fprintf(stderr, "Can't open output file %s. Using stderr.\n", datafile);
-      output_stream_ = stderr;
-    }
-  }
-
-  static const int num_counters = arraysize(kCounterList);
-
-  // Dump an instrumentation description comment at the top of the file.
-  fprintf(output_stream_, "# counters=%d\n", num_counters);
-  fprintf(output_stream_, "# sample_period=%" PRIu64 "\n", sample_period_);
-
-  // Construct Counter objects from counter description array.
-  for (int i = 0; i < num_counters; i++) {
-    Counter* counter = new Counter(kCounterList[i].name, kCounterList[i].type);
-    counters_.push_back(counter);
-  }
-
-  DumpCounterNames();
-}
-
-Instrument::~Instrument() {
-  // Dump any remaining instruction data to the output file.
-  DumpCounters();
-
-  // Free all the counter objects.
-  std::list<Counter*>::iterator it;
-  for (it = counters_.begin(); it != counters_.end(); it++) {
-    delete *it;
-  }
-
-  if (output_stream_ != stderr) {
-    fclose(output_stream_);
-  }
-}
-
-void Instrument::Update() {
-  // Increment the instruction counter, and dump all counters if a sample period
-  // has elapsed.
-  static Counter* counter = GetCounter("Instruction");
-  DCHECK(counter->type() == Cumulative);
-  counter->Increment();
-
-  if (counter->IsEnabled() && (counter->count() % sample_period_) == 0) {
-    DumpCounters();
-  }
-}
-
-void Instrument::DumpCounters() {
-  // Iterate through the counter objects, dumping their values to the output
-  // stream.
-  std::list<Counter*>::const_iterator it;
-  for (it = counters_.begin(); it != counters_.end(); it++) {
-    fprintf(output_stream_, "%" PRIu64 ",", (*it)->count());
-  }
-  fprintf(output_stream_, "\n");
-  fflush(output_stream_);
-}
-
-void Instrument::DumpCounterNames() {
-  // Iterate through the counter objects, dumping the counter names to the
-  // output stream.
-  std::list<Counter*>::const_iterator it;
-  for (it = counters_.begin(); it != counters_.end(); it++) {
-    fprintf(output_stream_, "%s,", (*it)->name());
-  }
-  fprintf(output_stream_, "\n");
-  fflush(output_stream_);
-}
-
-void Instrument::HandleInstrumentationEvent(unsigned event) {
-  switch (event) {
-    case InstrumentStateEnable:
-      Enable();
-      break;
-    case InstrumentStateDisable:
-      Disable();
-      break;
-    default:
-      DumpEventMarker(event);
-  }
-}
-
-void Instrument::DumpEventMarker(unsigned marker) {
-  // Dumpan event marker to the output stream as a specially formatted comment
-  // line.
-  static Counter* counter = GetCounter("Instruction");
-
-  fprintf(output_stream_, "# %c%c @ %" PRId64 "\n", marker & 0xFF,
-          (marker >> 8) & 0xFF, counter->count());
-}
-
-Counter* Instrument::GetCounter(const char* name) {
-  // Get a Counter object by name from the counter list.
-  std::list<Counter*>::const_iterator it;
-  for (it = counters_.begin(); it != counters_.end(); it++) {
-    if (strcmp((*it)->name(), name) == 0) {
-      return *it;
-    }
-  }
-
-  // A Counter by that name does not exist: print an error message to stderr
-  // and the output file, and exit.
-  static const char* error_message =
-      "# Error: Unknown counter \"%s\". Exiting.\n";
-  fprintf(stderr, error_message, name);
-  fprintf(output_stream_, error_message, name);
-  exit(1);
-}
-
-void Instrument::Enable() {
-  std::list<Counter*>::iterator it;
-  for (it = counters_.begin(); it != counters_.end(); it++) {
-    (*it)->Enable();
-  }
-}
-
-void Instrument::Disable() {
-  std::list<Counter*>::iterator it;
-  for (it = counters_.begin(); it != counters_.end(); it++) {
-    (*it)->Disable();
-  }
-}
-
-void Instrument::VisitPCRelAddressing(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("PC Addressing");
-  counter->Increment();
-}
-
-void Instrument::VisitAddSubImmediate(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Add/Sub DP");
-  counter->Increment();
-}
-
-void Instrument::VisitLogicalImmediate(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Logical DP");
-  counter->Increment();
-}
-
-void Instrument::VisitMoveWideImmediate(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Move Immediate");
-
-  if (instr->IsMovn() && (instr->Rd() == kZeroRegCode)) {
-    unsigned imm = instr->ImmMoveWide();
-    HandleInstrumentationEvent(imm);
-  } else {
-    counter->Increment();
-  }
-}
-
-void Instrument::VisitBitfield(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Other Int DP");
-  counter->Increment();
-}
-
-void Instrument::VisitExtract(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Other Int DP");
-  counter->Increment();
-}
-
-void Instrument::VisitUnconditionalBranch(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Unconditional Branch");
-  counter->Increment();
-}
-
-void Instrument::VisitUnconditionalBranchToRegister(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Unconditional Branch");
-  counter->Increment();
-}
-
-void Instrument::VisitCompareBranch(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Compare and Branch");
-  counter->Increment();
-}
-
-void Instrument::VisitTestBranch(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Test and Branch");
-  counter->Increment();
-}
-
-void Instrument::VisitConditionalBranch(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Conditional Branch");
-  counter->Increment();
-}
-
-void Instrument::VisitSystem(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Other");
-  counter->Increment();
-}
-
-void Instrument::VisitException(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Other");
-  counter->Increment();
-}
-
-void Instrument::InstrumentLoadStorePair(Instruction* instr) {
-  static Counter* load_pair_counter = GetCounter("Load Pair");
-  static Counter* store_pair_counter = GetCounter("Store Pair");
-  if (instr->Mask(LoadStorePairLBit) != 0) {
-    load_pair_counter->Increment();
-  } else {
-    store_pair_counter->Increment();
-  }
-}
-
-void Instrument::VisitLoadStorePairPostIndex(Instruction* instr) {
-  Update();
-  InstrumentLoadStorePair(instr);
-}
-
-void Instrument::VisitLoadStorePairOffset(Instruction* instr) {
-  Update();
-  InstrumentLoadStorePair(instr);
-}
-
-void Instrument::VisitLoadStorePairPreIndex(Instruction* instr) {
-  Update();
-  InstrumentLoadStorePair(instr);
-}
-
-void Instrument::VisitLoadLiteral(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Load Literal");
-  counter->Increment();
-}
-
-void Instrument::InstrumentLoadStore(Instruction* instr) {
-  static Counter* load_int_counter = GetCounter("Load Integer");
-  static Counter* store_int_counter = GetCounter("Store Integer");
-  static Counter* load_fp_counter = GetCounter("Load FP");
-  static Counter* store_fp_counter = GetCounter("Store FP");
-
-  switch (instr->Mask(LoadStoreMask)) {
-    case STRB_w:  // Fall through.
-    case STRH_w:  // Fall through.
-    case STR_w:   // Fall through.
-    case STR_x:
-      store_int_counter->Increment();
-      break;
-    case STR_s:  // Fall through.
-    case STR_d:
-      store_fp_counter->Increment();
-      break;
-    case LDRB_w:   // Fall through.
-    case LDRH_w:   // Fall through.
-    case LDR_w:    // Fall through.
-    case LDR_x:    // Fall through.
-    case LDRSB_x:  // Fall through.
-    case LDRSH_x:  // Fall through.
-    case LDRSW_x:  // Fall through.
-    case LDRSB_w:  // Fall through.
-    case LDRSH_w:
-      load_int_counter->Increment();
-      break;
-    case LDR_s:  // Fall through.
-    case LDR_d:
-      load_fp_counter->Increment();
-      break;
-    default:
-      UNREACHABLE();
-  }
-}
-
-void Instrument::VisitLoadStoreUnscaledOffset(Instruction* instr) {
-  Update();
-  InstrumentLoadStore(instr);
-}
-
-void Instrument::VisitLoadStorePostIndex(Instruction* instr) {
-  Update();
-  InstrumentLoadStore(instr);
-}
-
-void Instrument::VisitLoadStorePreIndex(Instruction* instr) {
-  Update();
-  InstrumentLoadStore(instr);
-}
-
-void Instrument::VisitLoadStoreRegisterOffset(Instruction* instr) {
-  Update();
-  InstrumentLoadStore(instr);
-}
-
-void Instrument::VisitLoadStoreUnsignedOffset(Instruction* instr) {
-  Update();
-  InstrumentLoadStore(instr);
-}
-
-void Instrument::VisitLoadStoreAcquireRelease(Instruction* instr) {
-  Update();
-  static Counter* load_counter = GetCounter("Load Acquire");
-  static Counter* store_counter = GetCounter("Store Release");
-
-  switch (instr->Mask(LoadStoreAcquireReleaseMask)) {
-    case LDAR_b:   // Fall-through.
-    case LDAR_h:   // Fall-through.
-    case LDAR_w:   // Fall-through.
-    case LDAR_x:   // Fall-through.
-    case LDAXR_b:  // Fall-through.
-    case LDAXR_h:  // Fall-through.
-    case LDAXR_w:  // Fall-through.
-    case LDAXR_x:
-      load_counter->Increment();
-      break;
-    case STLR_b:   // Fall-through.
-    case STLR_h:   // Fall-through.
-    case STLR_w:   // Fall-through.
-    case STLR_x:   // Fall-through.
-    case STLXR_b:  // Fall-through.
-    case STLXR_h:  // Fall-through.
-    case STLXR_w:  // Fall-through.
-    case STLXR_x:
-      store_counter->Increment();
-      break;
-    default:
-      UNREACHABLE();
-  }
-}
-
-void Instrument::VisitLogicalShifted(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Logical DP");
-  counter->Increment();
-}
-
-void Instrument::VisitAddSubShifted(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Add/Sub DP");
-  counter->Increment();
-}
-
-void Instrument::VisitAddSubExtended(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Add/Sub DP");
-  counter->Increment();
-}
-
-void Instrument::VisitAddSubWithCarry(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Add/Sub DP");
-  counter->Increment();
-}
-
-void Instrument::VisitConditionalCompareRegister(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Conditional Compare");
-  counter->Increment();
-}
-
-void Instrument::VisitConditionalCompareImmediate(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Conditional Compare");
-  counter->Increment();
-}
-
-void Instrument::VisitConditionalSelect(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Conditional Select");
-  counter->Increment();
-}
-
-void Instrument::VisitDataProcessing1Source(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Other Int DP");
-  counter->Increment();
-}
-
-void Instrument::VisitDataProcessing2Source(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Other Int DP");
-  counter->Increment();
-}
-
-void Instrument::VisitDataProcessing3Source(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Other Int DP");
-  counter->Increment();
-}
-
-void Instrument::VisitFPCompare(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("FP DP");
-  counter->Increment();
-}
-
-void Instrument::VisitFPConditionalCompare(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Conditional Compare");
-  counter->Increment();
-}
-
-void Instrument::VisitFPConditionalSelect(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Conditional Select");
-  counter->Increment();
-}
-
-void Instrument::VisitFPImmediate(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("FP DP");
-  counter->Increment();
-}
-
-void Instrument::VisitFPDataProcessing1Source(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("FP DP");
-  counter->Increment();
-}
-
-void Instrument::VisitFPDataProcessing2Source(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("FP DP");
-  counter->Increment();
-}
-
-void Instrument::VisitFPDataProcessing3Source(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("FP DP");
-  counter->Increment();
-}
-
-void Instrument::VisitFPIntegerConvert(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("FP DP");
-  counter->Increment();
-}
-
-void Instrument::VisitFPFixedPointConvert(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("FP DP");
-  counter->Increment();
-}
-
-void Instrument::VisitNEON2RegMisc(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEON3Different(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEON3Same(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONAcrossLanes(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONByIndexedElement(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONCopy(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONExtract(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONLoadStoreMultiStruct(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONLoadStoreMultiStructPostIndex(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONLoadStoreSingleStruct(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONLoadStoreSingleStructPostIndex(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONModifiedImmediate(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONPerm(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONScalar2RegMisc(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONScalar3Diff(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONScalar3Same(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONScalarByIndexedElement(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONScalarCopy(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONScalarPairwise(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONScalarShiftImmediate(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONShiftImmediate(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitNEONTable(Instruction* instr) {
-  USE(instr);
-  Update();
-  static Counter* counter = GetCounter("NEON");
-  counter->Increment();
-}
-
-void Instrument::VisitUnallocated(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Other");
-  counter->Increment();
-}
-
-void Instrument::VisitUnimplemented(Instruction* instr) {
-  Update();
-  static Counter* counter = GetCounter("Other");
-  counter->Increment();
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/codegen/arm64/instrument-arm64.h b/deps/v8/src/codegen/arm64/instrument-arm64.h
deleted file mode 100644
index 690cb7a49f3f84..00000000000000
--- a/deps/v8/src/codegen/arm64/instrument-arm64.h
+++ /dev/null
@@ -1,80 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_CODEGEN_ARM64_INSTRUMENT_ARM64_H_
-#define V8_CODEGEN_ARM64_INSTRUMENT_ARM64_H_
-
-#include "src/common/globals.h"
-#include "src/utils/utils.h"
-
-#include "src/codegen/arm64/constants-arm64.h"
-#include "src/codegen/arm64/decoder-arm64.h"
-
-namespace v8 {
-namespace internal {
-
-const int kCounterNameMaxLength = 256;
-const uint64_t kDefaultInstrumentationSamplingPeriod = 1 << 22;
-
-enum InstrumentState { InstrumentStateDisable = 0, InstrumentStateEnable = 1 };
-
-enum CounterType {
-  Gauge = 0,      // Gauge counters reset themselves after reading.
-  Cumulative = 1  // Cumulative counters keep their value after reading.
-};
-
-class Counter {
- public:
-  explicit Counter(const char* name, CounterType type = Gauge);
-
-  void Increment();
-  void Enable();
-  void Disable();
-  bool IsEnabled();
-  uint64_t count();
-  const char* name();
-  CounterType type();
-
- private:
-  char name_[kCounterNameMaxLength];
-  uint64_t count_;
-  bool enabled_;
-  CounterType type_;
-};
-
-class Instrument : public DecoderVisitor {
- public:
-  explicit Instrument(
-      const char* datafile = nullptr,
-      uint64_t sample_period = kDefaultInstrumentationSamplingPeriod);
-  ~Instrument();
-
-// Declare all Visitor functions.
-#define DECLARE(A) void Visit##A(Instruction* instr);
-  VISITOR_LIST(DECLARE)
-#undef DECLARE
-
- private:
-  void Update();
-  void Enable();
-  void Disable();
-  void DumpCounters();
-  void DumpCounterNames();
-  void DumpEventMarker(unsigned marker);
-  void HandleInstrumentationEvent(unsigned event);
-  Counter* GetCounter(const char* name);
-
-  void InstrumentLoadStore(Instruction* instr);
-  void InstrumentLoadStorePair(Instruction* instr);
-
-  std::list<Counter*> counters_;
-
-  FILE* output_stream_;
-  uint64_t sample_period_;
-};
-
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_CODEGEN_ARM64_INSTRUMENT_ARM64_H_
diff --git a/deps/v8/src/codegen/arm64/macro-assembler-arm64-inl.h b/deps/v8/src/codegen/arm64/macro-assembler-arm64-inl.h
index 261fd1e564a62b..aa2df90d0fba5d 100644
--- a/deps/v8/src/codegen/arm64/macro-assembler-arm64-inl.h
+++ b/deps/v8/src/codegen/arm64/macro-assembler-arm64-inl.h
@@ -12,7 +12,6 @@
 #include "src/base/bits.h"
 #include "src/codegen/arm64/assembler-arm64-inl.h"
 #include "src/codegen/arm64/assembler-arm64.h"
-#include "src/codegen/arm64/instrument-arm64.h"
 #include "src/codegen/macro-assembler.h"
 
 namespace v8 {
@@ -390,7 +389,7 @@ void TurboAssembler::CmovX(const Register& rd, const Register& rn,
   DCHECK(!rd.IsSP());
   DCHECK(rd.Is64Bits() && rn.Is64Bits());
   DCHECK((cond != al) && (cond != nv));
-  if (!rd.is(rn)) {
+  if (rd != rn) {
     csel(rd, rn, rd, cond);
   }
 }
@@ -596,7 +595,7 @@ void TurboAssembler::Fmov(VRegister fd, VRegister fn) {
   // registers. fmov(s0, s0) is not a no-op because it clears the top word of
   // d0. Technically, fmov(d0, d0) is not a no-op either because it clears the
   // top of q0, but VRegister does not currently support Q registers.
-  if (!fd.Is(fn) || !fd.Is64Bits()) {
+  if (fd != fn || !fd.Is64Bits()) {
     fmov(fd, fn);
   }
 }
@@ -771,7 +770,7 @@ void TurboAssembler::Mrs(const Register& rt, SystemRegister sysreg) {
   mrs(rt, sysreg);
 }
 
-void MacroAssembler::Msr(SystemRegister sysreg, const Register& rt) {
+void TurboAssembler::Msr(SystemRegister sysreg, const Register& rt) {
   DCHECK(allow_macro_instructions());
   msr(sysreg, rt);
 }
@@ -1252,27 +1251,6 @@ void MacroAssembler::InlineData(uint64_t data) {
   movz(xzr, data);
 }
 
-void MacroAssembler::EnableInstrumentation() {
-  InstructionAccurateScope scope(this, 1);
-  movn(xzr, InstrumentStateEnable);
-}
-
-void MacroAssembler::DisableInstrumentation() {
-  InstructionAccurateScope scope(this, 1);
-  movn(xzr, InstrumentStateDisable);
-}
-
-void MacroAssembler::AnnotateInstrumentation(const char* marker_name) {
-  DCHECK_EQ(strlen(marker_name), 2);
-
-  // We allow only printable characters in the marker names. Unprintable
-  // characters are reserved for controlling features of the instrumentation.
-  DCHECK(isprint(marker_name[0]) && isprint(marker_name[1]));
-
-  InstructionAccurateScope scope(this, 1);
-  movn(xzr, (marker_name[1] << 8) | marker_name[0]);
-}
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc b/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc
index 892458fe8bb9ed..07e308b48bbfd4 100644
--- a/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc
+++ b/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc
@@ -165,7 +165,7 @@ void TurboAssembler::LogicalMacro(const Register& rd, const Register& rn,
 
       // If the left-hand input is the stack pointer, we can't pre-shift the
       // immediate, as the encoding won't allow the subsequent post shift.
-      PreShiftImmMode mode = rn.Is(sp) ? kNoShift : kAnyShift;
+      PreShiftImmMode mode = rn == sp ? kNoShift : kAnyShift;
       Operand imm_operand = MoveImmediateForShiftedOp(temp, immediate, mode);
 
       if (rd.IsSP()) {
@@ -285,21 +285,22 @@ void TurboAssembler::Mov(const Register& rd, const Operand& operand,
   Register dst = (rd.IsSP()) ? temps.AcquireSameSizeAs(rd) : rd;
 
   if (operand.NeedsRelocation(this)) {
-    if (FLAG_embedded_builtins) {
-      if (root_array_available_ && options().isolate_independent_code) {
-        if (operand.ImmediateRMode() == RelocInfo::EXTERNAL_REFERENCE) {
-          Address addr = static_cast<Address>(operand.ImmediateValue());
-          ExternalReference reference = bit_cast<ExternalReference>(addr);
-          IndirectLoadExternalReference(rd, reference);
-          return;
-        } else if (RelocInfo::IsEmbeddedObjectMode(operand.ImmediateRMode())) {
-          Handle<HeapObject> x(
-              reinterpret_cast<Address*>(operand.ImmediateValue()));
-          // TODO(v8:9706): Fix-it! This load will always uncompress the value
-          // even when we are loading a compressed embedded object.
-          IndirectLoadConstant(rd.X(), x);
-          return;
-        }
+    // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+    // non-isolate-independent code. In many cases it might be cheaper than
+    // embedding the relocatable value.
+    if (root_array_available_ && options().isolate_independent_code) {
+      if (operand.ImmediateRMode() == RelocInfo::EXTERNAL_REFERENCE) {
+        Address addr = static_cast<Address>(operand.ImmediateValue());
+        ExternalReference reference = bit_cast<ExternalReference>(addr);
+        IndirectLoadExternalReference(rd, reference);
+        return;
+      } else if (RelocInfo::IsEmbeddedObjectMode(operand.ImmediateRMode())) {
+        Handle<HeapObject> x(
+            reinterpret_cast<Address*>(operand.ImmediateValue()));
+        // TODO(v8:9706): Fix-it! This load will always uncompress the value
+        // even when we are loading a compressed embedded object.
+        IndirectLoadConstant(rd.X(), x);
+        return;
       }
     }
     Ldr(dst, operand);
@@ -326,7 +327,7 @@ void TurboAssembler::Mov(const Register& rd, const Operand& operand,
     // this case, the instruction is discarded.
     //
     // If sp is an operand, add #0 is emitted, otherwise, orr #0.
-    if (!rd.Is(operand.reg()) ||
+    if (rd != operand.reg() ||
         (rd.Is32Bits() && (discard_mode == kDontDiscardForSameWReg))) {
       Assembler::mov(rd, operand.reg());
     }
@@ -335,7 +336,7 @@ void TurboAssembler::Mov(const Register& rd, const Operand& operand,
   }
 
   // Copy the result to the system stack pointer.
-  if (!dst.Is(rd)) {
+  if (dst != rd) {
     DCHECK(rd.IsSP());
     Assembler::mov(rd, dst);
   }
@@ -696,7 +697,7 @@ Operand TurboAssembler::MoveImmediateForShiftedOp(const Register& dst,
 void TurboAssembler::AddSubMacro(const Register& rd, const Register& rn,
                                  const Operand& operand, FlagsUpdate S,
                                  AddSubOp op) {
-  if (operand.IsZero() && rd.Is(rn) && rd.Is64Bits() && rn.Is64Bits() &&
+  if (operand.IsZero() && rd == rn && rd.Is64Bits() && rn.Is64Bits() &&
       !operand.NeedsRelocation(this) && (S == LeaveFlags)) {
     // The instruction would be a nop. Avoid generating useless code.
     return;
@@ -719,11 +720,11 @@ void TurboAssembler::AddSubMacro(const Register& rd, const Register& rn,
       // If the destination or source register is the stack pointer, we can
       // only pre-shift the immediate right by values supported in the add/sub
       // extend encoding.
-      if (rd.Is(sp)) {
+      if (rd == sp) {
         // If the destination is SP and flags will be set, we can't pre-shift
         // the immediate at all.
         mode = (S == SetFlags) ? kNoShift : kLimitShiftForSP;
-      } else if (rn.Is(sp)) {
+      } else if (rn == sp) {
         mode = kLimitShiftForSP;
       }
 
@@ -909,7 +910,7 @@ void TurboAssembler::Adr(const Register& rd, Label* label, AdrHint hint) {
 }
 
 void TurboAssembler::B(Label* label, BranchType type, Register reg, int bit) {
-  DCHECK((reg.Is(NoReg) || type >= kBranchTypeFirstUsingReg) &&
+  DCHECK((reg == NoReg || type >= kBranchTypeFirstUsingReg) &&
          (bit == -1 || type >= kBranchTypeFirstUsingBit));
   if (kBranchTypeFirstCondition <= type && type <= kBranchTypeLastCondition) {
     B(static_cast<Condition>(type), label);
@@ -1048,7 +1049,7 @@ void TurboAssembler::Push(const CPURegister& src0, const CPURegister& src1,
                           const CPURegister& src2, const CPURegister& src3) {
   DCHECK(AreSameSizeAndType(src0, src1, src2, src3));
 
-  int count = 1 + src1.IsValid() + src2.IsValid() + src3.IsValid();
+  int count = 1 + src1.is_valid() + src2.is_valid() + src3.is_valid();
   int size = src0.SizeInBytes();
   DCHECK_EQ(0, (size * count) % 16);
 
@@ -1061,7 +1062,7 @@ void TurboAssembler::Push(const CPURegister& src0, const CPURegister& src1,
                           const CPURegister& src6, const CPURegister& src7) {
   DCHECK(AreSameSizeAndType(src0, src1, src2, src3, src4, src5, src6, src7));
 
-  int count = 5 + src5.IsValid() + src6.IsValid() + src6.IsValid();
+  int count = 5 + src5.is_valid() + src6.is_valid() + src6.is_valid();
   int size = src0.SizeInBytes();
   DCHECK_EQ(0, (size * count) % 16);
 
@@ -1075,9 +1076,9 @@ void TurboAssembler::Pop(const CPURegister& dst0, const CPURegister& dst1,
   // instruction, not even into the zero register.
   DCHECK(!AreAliased(dst0, dst1, dst2, dst3));
   DCHECK(AreSameSizeAndType(dst0, dst1, dst2, dst3));
-  DCHECK(dst0.IsValid());
+  DCHECK(dst0.is_valid());
 
-  int count = 1 + dst1.IsValid() + dst2.IsValid() + dst3.IsValid();
+  int count = 1 + dst1.is_valid() + dst2.is_valid() + dst3.is_valid();
   int size = dst0.SizeInBytes();
   DCHECK_EQ(0, (size * count) % 16);
 
@@ -1092,9 +1093,9 @@ void TurboAssembler::Pop(const CPURegister& dst0, const CPURegister& dst1,
   // instruction, not even into the zero register.
   DCHECK(!AreAliased(dst0, dst1, dst2, dst3, dst4, dst5, dst6, dst7));
   DCHECK(AreSameSizeAndType(dst0, dst1, dst2, dst3, dst4, dst5, dst6, dst7));
-  DCHECK(dst0.IsValid());
+  DCHECK(dst0.is_valid());
 
-  int count = 5 + dst5.IsValid() + dst6.IsValid() + dst7.IsValid();
+  int count = 5 + dst5.is_valid() + dst6.is_valid() + dst7.is_valid();
   int size = dst0.SizeInBytes();
   DCHECK_EQ(0, (size * count) % 16);
 
@@ -1295,15 +1296,16 @@ void MacroAssembler::PushCalleeSavedRegisters() {
   stp(d10, d11, tos);
   stp(d8, d9, tos);
 
-  stp(x29, x30, tos);
-#if defined(V8_OS_WIN)
-  // kFramePointerOffsetInPushCalleeSavedRegisters is the offset from tos at
-  // the end of this function to the saved caller's fp/x29 pointer. It includes
-  // registers from x19 to x28, which is 10 pointers defined by below stp
-  // instructions.
-  STATIC_ASSERT(kFramePointerOffsetInPushCalleeSavedRegisters ==
-                10 * kSystemPointerSize);
-#endif  // defined(V8_OS_WIN)
+  STATIC_ASSERT(
+      EntryFrameConstants::kCalleeSavedRegisterBytesPushedBeforeFpLrPair ==
+      8 * kSystemPointerSize);
+
+  stp(x29, x30, tos);  // fp, lr
+
+  STATIC_ASSERT(
+      EntryFrameConstants::kCalleeSavedRegisterBytesPushedAfterFpLrPair ==
+      10 * kSystemPointerSize);
+
   stp(x27, x28, tos);
   stp(x25, x26, tos);
   stp(x23, x24, tos);
@@ -1485,7 +1487,7 @@ void TurboAssembler::MovePair(Register dst0, Register src0, Register dst1,
 
 void TurboAssembler::Swap(Register lhs, Register rhs) {
   DCHECK(lhs.IsSameSizeAndType(rhs));
-  DCHECK(!lhs.Is(rhs));
+  DCHECK_NE(lhs, rhs);
   UseScratchRegisterScope temps(this);
   Register temp = temps.AcquireX();
   Mov(temp, rhs);
@@ -1495,7 +1497,7 @@ void TurboAssembler::Swap(Register lhs, Register rhs) {
 
 void TurboAssembler::Swap(VRegister lhs, VRegister rhs) {
   DCHECK(lhs.IsSameSizeAndType(rhs));
-  DCHECK(!lhs.Is(rhs));
+  DCHECK_NE(lhs, rhs);
   UseScratchRegisterScope temps(this);
   VRegister temp = VRegister::no_reg();
   if (lhs.IsS()) {
@@ -1534,10 +1536,9 @@ void MacroAssembler::AssertConstructor(Register object) {
     UseScratchRegisterScope temps(this);
     Register temp = temps.AcquireX();
 
-    LoadTaggedPointerField(temp,
-                           FieldMemOperand(object, HeapObject::kMapOffset));
+    LoadMap(temp, object);
     Ldrb(temp, FieldMemOperand(temp, Map::kBitFieldOffset));
-    Tst(temp, Operand(Map::IsConstructorBit::kMask));
+    Tst(temp, Operand(Map::Bits1::IsConstructorBit::kMask));
 
     Check(ne, AbortReason::kOperandIsNotAConstructor);
   }
@@ -1574,7 +1575,7 @@ void MacroAssembler::AssertGeneratorObject(Register object) {
   // Load map
   UseScratchRegisterScope temps(this);
   Register temp = temps.AcquireX();
-  LoadTaggedPointerField(temp, FieldMemOperand(object, HeapObject::kMapOffset));
+  LoadMap(temp, object);
 
   Label do_check;
   // Load instance type and check if JSGeneratorObject
@@ -1600,8 +1601,7 @@ void MacroAssembler::AssertUndefinedOrAllocationSite(Register object) {
     Label done_checking;
     AssertNotSmi(object);
     JumpIfRoot(object, RootIndex::kUndefinedValue, &done_checking);
-    LoadTaggedPointerField(scratch,
-                           FieldMemOperand(object, HeapObject::kMapOffset));
+    LoadMap(scratch, object);
     CompareInstanceType(scratch, scratch, ALLOCATION_SITE_TYPE);
     Assert(eq, AbortReason::kExpectedUndefinedOrCell);
     Bind(&done_checking);
@@ -1618,19 +1618,6 @@ void TurboAssembler::AssertPositiveOrZero(Register value) {
   }
 }
 
-void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
-                                           Register centry) {
-  const Runtime::Function* f = Runtime::FunctionForId(fid);
-  // TODO(1236192): Most runtime routines don't need the number of
-  // arguments passed in because it is constant. At some point we
-  // should remove this need and make the runtime routine entry code
-  // smarter.
-  Mov(x0, f->nargs);
-  Mov(x1, ExternalReference::Create(f));
-  DCHECK(!AreAliased(centry, x0, x1));
-  CallCodeObject(centry);
-}
-
 void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
                                  SaveFPRegsMode save_doubles) {
   // All arguments must be on the stack before this function is called.
@@ -1906,6 +1893,7 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode) {
     }
   }
 
+  DCHECK(code->IsExecutable());
   if (CanUseNearCallOrJump(rmode)) {
     EmbeddedObjectIndex index = AddEmbeddedObject(code);
     DCHECK(is_int32(index));
@@ -1951,7 +1939,6 @@ void TurboAssembler::CallBuiltinByIndex(Register builtin_index) {
 
 void TurboAssembler::CallBuiltin(int builtin_index) {
   DCHECK(Builtins::IsBuiltinId(builtin_index));
-  DCHECK(FLAG_embedded_builtins);
   RecordCommentForOffHeapTrampoline(builtin_index);
   CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
   UseScratchRegisterScope temps(this);
@@ -2075,23 +2062,16 @@ void TurboAssembler::CallForDeoptimization(Address target, int deopt_id) {
   DCHECK_EQ(SizeOfCodeGeneratedSince(&start), Deoptimizer::kDeoptExitSize);
 }
 
-void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
-                                        Register caller_args_count_reg,
+void TurboAssembler::PrepareForTailCall(Register callee_args_count,
+                                        Register caller_args_count,
                                         Register scratch0, Register scratch1) {
-#if DEBUG
-  if (callee_args_count.is_reg()) {
-    DCHECK(!AreAliased(callee_args_count.reg(), caller_args_count_reg, scratch0,
-                       scratch1));
-  } else {
-    DCHECK(!AreAliased(caller_args_count_reg, scratch0, scratch1));
-  }
-#endif
+  DCHECK(!AreAliased(callee_args_count, caller_args_count, scratch0, scratch1));
 
   // Calculate the end of destination area where we will put the arguments
   // after we drop current frame. We add kSystemPointerSize to count the
   // receiver argument which is not included into formal parameters count.
   Register dst_reg = scratch0;
-  Add(dst_reg, fp, Operand(caller_args_count_reg, LSL, kSystemPointerSizeLog2));
+  Add(dst_reg, fp, Operand(caller_args_count, LSL, kSystemPointerSizeLog2));
   Add(dst_reg, dst_reg,
       StandardFrameConstants::kCallerSPOffset + kSystemPointerSize);
   // Round dst_reg up to a multiple of 16 bytes, so that we overwrite any
@@ -2099,15 +2079,10 @@ void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
   Add(dst_reg, dst_reg, 15);
   Bic(dst_reg, dst_reg, 15);
 
-  Register src_reg = caller_args_count_reg;
+  Register src_reg = caller_args_count;
   // Calculate the end of source area. +kSystemPointerSize is for the receiver.
-  if (callee_args_count.is_reg()) {
-    Add(src_reg, sp,
-        Operand(callee_args_count.reg(), LSL, kSystemPointerSizeLog2));
-    Add(src_reg, src_reg, kSystemPointerSize);
-  } else {
-    Add(src_reg, sp, (callee_args_count.immediate() + 1) * kSystemPointerSize);
-  }
+  Add(src_reg, sp, Operand(callee_args_count, LSL, kSystemPointerSizeLog2));
+  Add(src_reg, src_reg, kSystemPointerSize);
 
   // Round src_reg up to a multiple of 16 bytes, so we include any potential
   // padding in the copy.
@@ -2143,112 +2118,69 @@ void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
   Mov(sp, dst_reg);
 }
 
-void MacroAssembler::InvokePrologue(const ParameterCount& expected,
-                                    const ParameterCount& actual, Label* done,
-                                    InvokeFlag flag,
-                                    bool* definitely_mismatches) {
-  bool definitely_matches = false;
-  *definitely_mismatches = false;
+void MacroAssembler::InvokePrologue(Register expected_parameter_count,
+                                    Register actual_parameter_count,
+                                    Label* done, InvokeFlag flag) {
   Label regular_invoke;
 
-  // Check whether the expected and actual arguments count match. If not,
-  // setup registers according to contract with ArgumentsAdaptorTrampoline:
+  // Check whether the expected and actual arguments count match. The registers
+  // are set up according to contract with ArgumentsAdaptorTrampoline:
   //  x0: actual arguments count.
   //  x1: function (passed through to callee).
   //  x2: expected arguments count.
-
   // The code below is made a lot easier because the calling code already sets
-  // up actual and expected registers according to the contract if values are
-  // passed in registers.
-  DCHECK(actual.is_immediate() || actual.reg().is(x0));
-  DCHECK(expected.is_immediate() || expected.reg().is(x2));
-
-  if (expected.is_immediate()) {
-    DCHECK(actual.is_immediate());
-    Mov(x0, actual.immediate());
-    if (expected.immediate() == actual.immediate()) {
-      definitely_matches = true;
-
-    } else {
-      if (expected.immediate() ==
-          SharedFunctionInfo::kDontAdaptArgumentsSentinel) {
-        // Don't worry about adapting arguments for builtins that
-        // don't want that done. Skip adaption code by making it look
-        // like we have a match between expected and actual number of
-        // arguments.
-        definitely_matches = true;
-      } else {
-        *definitely_mismatches = true;
-        // Set up x2 for the argument adaptor.
-        Mov(x2, expected.immediate());
-      }
-    }
-
-  } else {  // expected is a register.
-    Operand actual_op = actual.is_immediate() ? Operand(actual.immediate())
-                                              : Operand(actual.reg());
-    Mov(x0, actual_op);
-    // If actual == expected perform a regular invocation.
-    Cmp(expected.reg(), actual_op);
-    B(eq, &regular_invoke);
-  }
-
-  // If the argument counts may mismatch, generate a call to the argument
-  // adaptor.
-  if (!definitely_matches) {
-    Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
-    if (flag == CALL_FUNCTION) {
-      Call(adaptor);
-      if (!*definitely_mismatches) {
-        // If the arg counts don't match, no extra code is emitted by
-        // MAsm::InvokeFunctionCode and we can just fall through.
-        B(done);
-      }
-    } else {
-      Jump(adaptor, RelocInfo::CODE_TARGET);
-    }
+  // up actual and expected registers according to the contract.
+  DCHECK_EQ(actual_parameter_count, x0);
+  DCHECK_EQ(expected_parameter_count, x2);
+
+  // If actual == expected perform a regular invocation.
+  Cmp(expected_parameter_count, actual_parameter_count);
+  B(eq, &regular_invoke);
+
+  // The argument counts mismatch, generate a call to the argument adaptor.
+  Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
+  if (flag == CALL_FUNCTION) {
+    Call(adaptor);
+    // If the arg counts don't match, no extra code is emitted by
+    // MAsm::InvokeFunctionCode and we can just fall through.
+    B(done);
+  } else {
+    Jump(adaptor, RelocInfo::CODE_TARGET);
   }
+
   Bind(&regular_invoke);
 }
 
 void MacroAssembler::CallDebugOnFunctionCall(Register fun, Register new_target,
-                                             const ParameterCount& expected,
-                                             const ParameterCount& actual) {
+                                             Register expected_parameter_count,
+                                             Register actual_parameter_count) {
   // Load receiver to pass it later to DebugOnFunctionCall hook.
-  if (actual.is_reg()) {
-    Ldr(x4, MemOperand(sp, actual.reg(), LSL, kSystemPointerSizeLog2));
-  } else {
-    Ldr(x4, MemOperand(sp, actual.immediate() << kSystemPointerSizeLog2));
-  }
+  Ldr(x4, MemOperand(sp, actual_parameter_count, LSL, kSystemPointerSizeLog2));
   FrameScope frame(this, has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
 
-  Register expected_reg = padreg;
-  Register actual_reg = padreg;
-  if (expected.is_reg()) expected_reg = expected.reg();
-  if (actual.is_reg()) actual_reg = actual.reg();
   if (!new_target.is_valid()) new_target = padreg;
 
   // Save values on stack.
-  SmiTag(expected_reg);
-  SmiTag(actual_reg);
-  Push(expected_reg, actual_reg, new_target, fun);
+  SmiTag(expected_parameter_count);
+  SmiTag(actual_parameter_count);
+  Push(expected_parameter_count, actual_parameter_count, new_target, fun);
   Push(fun, x4);
   CallRuntime(Runtime::kDebugOnFunctionCall);
 
   // Restore values from stack.
-  Pop(fun, new_target, actual_reg, expected_reg);
-  SmiUntag(actual_reg);
-  SmiUntag(expected_reg);
+  Pop(fun, new_target, actual_parameter_count, expected_parameter_count);
+  SmiUntag(actual_parameter_count);
+  SmiUntag(expected_parameter_count);
 }
 
 void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
-                                        const ParameterCount& expected,
-                                        const ParameterCount& actual,
+                                        Register expected_parameter_count,
+                                        Register actual_parameter_count,
                                         InvokeFlag flag) {
   // You can't call a function without a valid frame.
   DCHECK(flag == JUMP_FUNCTION || has_frame());
-  DCHECK(function.is(x1));
-  DCHECK_IMPLIES(new_target.is_valid(), new_target.is(x3));
+  DCHECK_EQ(function, x1);
+  DCHECK_IMPLIES(new_target.is_valid(), new_target == x3);
 
   // On function call, call into the debugger if necessary.
   Label debug_hook, continue_after_hook;
@@ -2265,31 +2197,29 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
   }
 
   Label done;
-  bool definitely_mismatches = false;
-  InvokePrologue(expected, actual, &done, flag, &definitely_mismatches);
+  InvokePrologue(expected_parameter_count, actual_parameter_count, &done, flag);
 
-  // If we are certain that actual != expected, then we know InvokePrologue will
-  // have handled the call through the argument adaptor mechanism.
+  // If actual != expected, InvokePrologue will have handled the call through
+  // the argument adaptor mechanism.
   // The called function expects the call kind in x5.
-  if (!definitely_mismatches) {
-    // We call indirectly through the code field in the function to
-    // allow recompilation to take effect without changing any of the
-    // call sites.
-    Register code = kJavaScriptCallCodeStartRegister;
-    LoadTaggedPointerField(code,
-                           FieldMemOperand(function, JSFunction::kCodeOffset));
-    if (flag == CALL_FUNCTION) {
-      CallCodeObject(code);
-    } else {
-      DCHECK(flag == JUMP_FUNCTION);
-      JumpCodeObject(code);
-    }
+  // We call indirectly through the code field in the function to
+  // allow recompilation to take effect without changing any of the
+  // call sites.
+  Register code = kJavaScriptCallCodeStartRegister;
+  LoadTaggedPointerField(code,
+                         FieldMemOperand(function, JSFunction::kCodeOffset));
+  if (flag == CALL_FUNCTION) {
+    CallCodeObject(code);
+  } else {
+    DCHECK(flag == JUMP_FUNCTION);
+    JumpCodeObject(code);
   }
   B(&done);
 
   // Deferred debug hook.
   bind(&debug_hook);
-  CallDebugOnFunctionCall(function, new_target, expected, actual);
+  CallDebugOnFunctionCall(function, new_target, expected_parameter_count,
+                          actual_parameter_count);
   B(&continue_after_hook);
 
   // Continue here if InvokePrologue does handle the invocation due to
@@ -2297,17 +2227,17 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
   Bind(&done);
 }
 
-void MacroAssembler::InvokeFunction(Register function, Register new_target,
-                                    const ParameterCount& actual,
-                                    InvokeFlag flag) {
+void MacroAssembler::InvokeFunctionWithNewTarget(
+    Register function, Register new_target, Register actual_parameter_count,
+    InvokeFlag flag) {
   // You can't call a function without a valid frame.
   DCHECK(flag == JUMP_FUNCTION || has_frame());
 
   // Contract with called JS functions requires that function is passed in x1.
   // (See FullCodeGenerator::Generate().)
-  DCHECK(function.is(x1));
+  DCHECK_EQ(function, x1);
 
-  Register expected_reg = x2;
+  Register expected_parameter_count = x2;
 
   LoadTaggedPointerField(cp,
                          FieldMemOperand(function, JSFunction::kContextOffset));
@@ -2315,32 +2245,33 @@ void MacroAssembler::InvokeFunction(Register function, Register new_target,
   // (SharedFunctionInfo::kDontAdaptArgumentsSentinel), so we need sign
   // extension to correctly handle it.
   LoadTaggedPointerField(
-      expected_reg,
+      expected_parameter_count,
       FieldMemOperand(function, JSFunction::kSharedFunctionInfoOffset));
-  Ldrh(expected_reg,
-       FieldMemOperand(expected_reg,
+  Ldrh(expected_parameter_count,
+       FieldMemOperand(expected_parameter_count,
                        SharedFunctionInfo::kFormalParameterCountOffset));
 
-  ParameterCount expected(expected_reg);
-  InvokeFunctionCode(function, new_target, expected, actual, flag);
+  InvokeFunctionCode(function, new_target, expected_parameter_count,
+                     actual_parameter_count, flag);
 }
 
 void MacroAssembler::InvokeFunction(Register function,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
+                                    Register expected_parameter_count,
+                                    Register actual_parameter_count,
                                     InvokeFlag flag) {
   // You can't call a function without a valid frame.
   DCHECK(flag == JUMP_FUNCTION || has_frame());
 
   // Contract with called JS functions requires that function is passed in x1.
   // (See FullCodeGenerator::Generate().)
-  DCHECK(function.Is(x1));
+  DCHECK_EQ(function, x1);
 
   // Set up the context.
   LoadTaggedPointerField(cp,
                          FieldMemOperand(function, JSFunction::kContextOffset));
 
-  InvokeFunctionCode(function, no_reg, expected, actual, flag);
+  InvokeFunctionCode(function, no_reg, expected_parameter_count,
+                     actual_parameter_count, flag);
 }
 
 void TurboAssembler::TryConvertDoubleToInt64(Register result,
@@ -2620,10 +2551,14 @@ void MacroAssembler::JumpIfObjectType(Register object, Register map,
 // Sets condition flags based on comparison, and returns type in type_reg.
 void MacroAssembler::CompareObjectType(Register object, Register map,
                                        Register type_reg, InstanceType type) {
-  LoadTaggedPointerField(map, FieldMemOperand(object, HeapObject::kMapOffset));
+  LoadMap(map, object);
   CompareInstanceType(map, type_reg, type);
 }
 
+void MacroAssembler::LoadMap(Register dst, Register object) {
+  LoadTaggedPointerField(dst, FieldMemOperand(object, HeapObject::kMapOffset));
+}
+
 // Sets condition flags based on comparison, and returns type in type_reg.
 void MacroAssembler::CompareInstanceType(Register map, Register type_reg,
                                          InstanceType type) {
@@ -2635,7 +2570,7 @@ void MacroAssembler::LoadElementsKindFromMap(Register result, Register map) {
   // Load the map's "bit field 2".
   Ldrb(result, FieldMemOperand(map, Map::kBitField2Offset));
   // Retrieve elements_kind from bit field 2.
-  DecodeField<Map::ElementsKindBits>(result);
+  DecodeField<Map::Bits2::ElementsKindBits>(result);
 }
 
 void MacroAssembler::CompareRoot(const Register& obj, RootIndex index) {
@@ -2709,13 +2644,11 @@ void TurboAssembler::DecompressTaggedSigned(const Register& destination,
                                             const MemOperand& field_operand) {
   RecordComment("[ DecompressTaggedSigned");
   Ldr(destination.W(), field_operand);
-  RecordComment("]");
-}
-
-void TurboAssembler::DecompressTaggedSigned(const Register& destination,
-                                            const Register& source) {
-  RecordComment("[ DecompressTaggedSigned");
-  Mov(destination.W(), source.W());
+  if (FLAG_debug_code) {
+    // Corrupt the top 32 bits. Made up of 16 fixed bits and 16 pc offset bits.
+    Add(destination, destination,
+        ((kDebugZapValue << 16) | (pc_offset() & 0xffff)) << 32);
+  }
   RecordComment("]");
 }
 
@@ -2742,13 +2675,6 @@ void TurboAssembler::DecompressAnyTagged(const Register& destination,
   RecordComment("]");
 }
 
-void TurboAssembler::DecompressAnyTagged(const Register& destination,
-                                         const Register& source) {
-  RecordComment("[ DecompressAnyTagged");
-  Add(destination, kRootRegister, Operand(source, UXTW));
-  RecordComment("]");
-}
-
 int MacroAssembler::SafepointRegisterStackIndex(int reg_code) {
   // Make sure the safepoint registers list is what we expect.
   DCHECK_EQ(CPURegList::GetSafepointSavedRegisters().list(), 0x6FFCFFFF);
@@ -3034,6 +2960,8 @@ void TurboAssembler::Check(Condition cond, AbortReason reason) {
   Bind(&ok);
 }
 
+void TurboAssembler::Trap() { Brk(0); }
+
 void TurboAssembler::Abort(AbortReason reason) {
 #ifdef DEBUG
   RecordComment("Abort message: ");
@@ -3077,13 +3005,16 @@ void TurboAssembler::Abort(AbortReason reason) {
 }
 
 void MacroAssembler::LoadNativeContextSlot(int index, Register dst) {
-  LoadTaggedPointerField(dst, NativeContextMemOperand());
-  LoadTaggedPointerField(dst, ContextMemOperand(dst, index));
+  LoadMap(dst, cp);
+  LoadTaggedPointerField(
+      dst, FieldMemOperand(
+               dst, Map::kConstructorOrBackPointerOrNativeContextOffset));
+  LoadTaggedPointerField(dst, MemOperand(dst, Context::SlotOffset(index)));
 }
 
 // This is the main Printf implementation. All other Printf variants call
 // PrintfNoPreserve after setting up one or more PreserveRegisterScopes.
-void MacroAssembler::PrintfNoPreserve(const char* format,
+void TurboAssembler::PrintfNoPreserve(const char* format,
                                       const CPURegister& arg0,
                                       const CPURegister& arg1,
                                       const CPURegister& arg2,
@@ -3116,7 +3047,7 @@ void MacroAssembler::PrintfNoPreserve(const char* format,
   fp_tmp_list.Remove(kPCSVarargsFP);
   fp_tmp_list.Remove(arg0, arg1, arg2, arg3);
 
-  // Override the MacroAssembler's scratch register list. The lists will be
+  // Override the TurboAssembler's scratch register list. The lists will be
   // reset automatically at the end of the UseScratchRegisterScope.
   UseScratchRegisterScope temps(this);
   TmpList()->set_list(tmp_list.list());
@@ -3207,11 +3138,10 @@ void MacroAssembler::PrintfNoPreserve(const char* format,
 }
 
 void TurboAssembler::CallPrintf(int arg_count, const CPURegister* args) {
-// A call to printf needs special handling for the simulator, since the system
-// printf function will use a different instruction set and the procedure-call
-// standard will not be compatible.
-#ifdef USE_SIMULATOR
-  {
+  // A call to printf needs special handling for the simulator, since the system
+  // printf function will use a different instruction set and the procedure-call
+  // standard will not be compatible.
+  if (options().enable_simulator_code) {
     InstructionAccurateScope scope(this, kPrintfLength / kInstrSize);
     hlt(kImmExceptionIsPrintf);
     dc32(arg_count);  // kPrintfArgCountOffset
@@ -3230,13 +3160,13 @@ void TurboAssembler::CallPrintf(int arg_count, const CPURegister* args) {
       arg_pattern_list |= (arg_pattern << (kPrintfArgPatternBits * i));
     }
     dc32(arg_pattern_list);  // kPrintfArgPatternListOffset
+    return;
   }
-#else
+
   Call(ExternalReference::printf_function());
-#endif
 }
 
-void MacroAssembler::Printf(const char* format, CPURegister arg0,
+void TurboAssembler::Printf(const char* format, CPURegister arg0,
                             CPURegister arg1, CPURegister arg2,
                             CPURegister arg3) {
   // Printf is expected to preserve all registers, so make sure that none are
@@ -3268,10 +3198,10 @@ void MacroAssembler::Printf(const char* format, CPURegister arg0,
     // If any of the arguments are the current stack pointer, allocate a new
     // register for them, and adjust the value to compensate for pushing the
     // caller-saved registers.
-    bool arg0_sp = sp.Aliases(arg0);
-    bool arg1_sp = sp.Aliases(arg1);
-    bool arg2_sp = sp.Aliases(arg2);
-    bool arg3_sp = sp.Aliases(arg3);
+    bool arg0_sp = arg0.is_valid() && sp.Aliases(arg0);
+    bool arg1_sp = arg1.is_valid() && sp.Aliases(arg1);
+    bool arg2_sp = arg2.is_valid() && sp.Aliases(arg2);
+    bool arg3_sp = arg3.is_valid() && sp.Aliases(arg3);
     if (arg0_sp || arg1_sp || arg2_sp || arg3_sp) {
       // Allocate a register to hold the original stack pointer value, to pass
       // to PrintfNoPreserve as an argument.
@@ -3334,14 +3264,6 @@ CPURegister UseScratchRegisterScope::AcquireNextAvailable(
   return result;
 }
 
-MemOperand ContextMemOperand(Register context, int index) {
-  return MemOperand(context, Context::SlotOffset(index));
-}
-
-MemOperand NativeContextMemOperand() {
-  return ContextMemOperand(cp, Context::NATIVE_CONTEXT_INDEX);
-}
-
 void TurboAssembler::ComputeCodeStartAddress(const Register& rd) {
   // We can use adr to load a pc relative location.
   adr(rd, -pc_offset());
diff --git a/deps/v8/src/codegen/arm64/macro-assembler-arm64.h b/deps/v8/src/codegen/arm64/macro-assembler-arm64.h
index cb3b51eb527f9f..f7fbb1105d012f 100644
--- a/deps/v8/src/codegen/arm64/macro-assembler-arm64.h
+++ b/deps/v8/src/codegen/arm64/macro-assembler-arm64.h
@@ -83,12 +83,6 @@ inline MemOperand FieldMemOperand(Register object, int offset);
 // ----------------------------------------------------------------------------
 // MacroAssembler
 
-#if defined(V8_OS_WIN)
-// This offset is originated from PushCalleeSavedRegisters.
-static constexpr int kFramePointerOffsetInPushCalleeSavedRegisters =
-    10 * kSystemPointerSize;
-#endif  // V8_OS_WIN
-
 enum BranchType {
   // Copies of architectural conditions.
   // The associated conditions can be used in place of those, the code will
@@ -566,17 +560,13 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   inline void Isb();
   inline void Csdb();
 
-  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
-  // builtin for the target runtime function and uses an indirect call.
-  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
-
   // Removes current frame and its arguments from the stack preserving
   // the arguments and a return address pushed to the stack for the next call.
-  // Both |callee_args_count| and |caller_args_count_reg| do not include
-  // receiver. |callee_args_count| is not modified, |caller_args_count_reg|
-  // is trashed.
-  void PrepareForTailCall(const ParameterCount& callee_args_count,
-                          Register caller_args_count_reg, Register scratch0,
+  // Both |callee_args_count| and |caller_args_count| do not include
+  // receiver. |callee_args_count| is not modified. |caller_args_count| is
+  // trashed.
+  void PrepareForTailCall(Register callee_args_count,
+                          Register caller_args_count, Register scratch0,
                           Register scratch1);
 
   inline void SmiUntag(Register dst, Register src);
@@ -599,9 +589,38 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 
   inline void Debug(const char* message, uint32_t code, Instr params = BREAK);
 
+  void Trap() override;
+
   // Print a message to stderr and abort execution.
   void Abort(AbortReason reason);
 
+  // Like printf, but print at run-time from generated code.
+  //
+  // The caller must ensure that arguments for floating-point placeholders
+  // (such as %e, %f or %g) are VRegisters, and that arguments for integer
+  // placeholders are Registers.
+  //
+  // Format placeholders that refer to more than one argument, or to a specific
+  // argument, are not supported. This includes formats like "%1$d" or "%.*d".
+  //
+  // This function automatically preserves caller-saved registers so that
+  // calling code can use Printf at any point without having to worry about
+  // corruption. The preservation mechanism generates a lot of code. If this is
+  // a problem, preserve the important registers manually and then call
+  // PrintfNoPreserve. Callee-saved registers are not used by Printf, and are
+  // implicitly preserved.
+  void Printf(const char* format, CPURegister arg0 = NoCPUReg,
+              CPURegister arg1 = NoCPUReg, CPURegister arg2 = NoCPUReg,
+              CPURegister arg3 = NoCPUReg);
+
+  // Like Printf, but don't preserve any caller-saved registers, not even 'lr'.
+  //
+  // The return code from the system printf call will be returned in x0.
+  void PrintfNoPreserve(const char* format, const CPURegister& arg0 = NoCPUReg,
+                        const CPURegister& arg1 = NoCPUReg,
+                        const CPURegister& arg2 = NoCPUReg,
+                        const CPURegister& arg3 = NoCPUReg);
+
   // Remaining instructions are simple pass-through calls to the assembler.
   inline void Asr(const Register& rd, const Register& rn, unsigned shift);
   inline void Asr(const Register& rd, const Register& rn, const Register& rm);
@@ -1200,6 +1219,7 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
                                Label* done);
 
   inline void Mrs(const Register& rt, SystemRegister sysreg);
+  inline void Msr(SystemRegister sysreg, const Register& rt);
 
   // Generates function prologue code.
   void Prologue();
@@ -1268,15 +1288,12 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 
   void DecompressTaggedSigned(const Register& destination,
                               const MemOperand& field_operand);
-  void DecompressTaggedSigned(const Register& destination,
-                              const Register& source);
   void DecompressTaggedPointer(const Register& destination,
                                const MemOperand& field_operand);
   void DecompressTaggedPointer(const Register& destination,
                                const Register& source);
   void DecompressAnyTagged(const Register& destination,
                            const MemOperand& field_operand);
-  void DecompressAnyTagged(const Register& destination, const Register& source);
 
  protected:
   // The actual Push and Pop implementations. These don't generate any code
@@ -1436,7 +1453,6 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   inline void Ldnp(const CPURegister& rt, const CPURegister& rt2,
                    const MemOperand& src);
   inline void Movk(const Register& rd, uint64_t imm, int shift = -1);
-  inline void Msr(SystemRegister sysreg, const Register& rt);
   inline void Nop() { nop(); }
   void Mvni(const VRegister& vd, const int imm8, Shift shift = LSL,
             const int shift_amount = 0) {
@@ -1656,18 +1672,6 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   // side effects.
   inline void InlineData(uint64_t data);
 
-  // Insert an instrumentation enable marker into the instruction stream.
-  inline void EnableInstrumentation();
-
-  // Insert an instrumentation disable marker into the instruction stream.
-  inline void DisableInstrumentation();
-
-  // Insert an instrumentation event marker into the instruction stream. These
-  // will be picked up by the instrumentation system to annotate an instruction
-  // profile. The argument marker_name must be a printable two character string;
-  // it will be encoded in the event marker.
-  inline void AnnotateInstrumentation(const char* marker_name);
-
   // Preserve the callee-saved registers (as defined by AAPCS64).
   //
   // Higher-numbered registers are pushed before lower-numbered registers, and
@@ -1766,23 +1770,24 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   // 'actual' must use an immediate or x0.
   // 'expected' must use an immediate or x2.
   // 'call_kind' must be x5.
-  void InvokePrologue(const ParameterCount& expected,
-                      const ParameterCount& actual, Label* done,
-                      InvokeFlag flag, bool* definitely_mismatches);
+  void InvokePrologue(Register expected_parameter_count,
+                      Register actual_parameter_count, Label* done,
+                      InvokeFlag flag);
 
   // On function call, call into the debugger.
   void CallDebugOnFunctionCall(Register fun, Register new_target,
-                               const ParameterCount& expected,
-                               const ParameterCount& actual);
+                               Register expected_parameter_count,
+                               Register actual_parameter_count);
   void InvokeFunctionCode(Register function, Register new_target,
-                          const ParameterCount& expected,
-                          const ParameterCount& actual, InvokeFlag flag);
+                          Register expected_parameter_count,
+                          Register actual_parameter_count, InvokeFlag flag);
   // Invoke the JavaScript function in the given register.
   // Changes the current context to the context in the function before invoking.
-  void InvokeFunction(Register function, Register new_target,
-                      const ParameterCount& actual, InvokeFlag flag);
-  void InvokeFunction(Register function, const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
+  void InvokeFunctionWithNewTarget(Register function, Register new_target,
+                                   Register actual_parameter_count,
+                                   InvokeFlag flag);
+  void InvokeFunction(Register function, Register expected_parameter_count,
+                      Register actual_parameter_count, InvokeFlag flag);
 
   // ---- Code generation helpers ----
 
@@ -1878,6 +1883,8 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   void LeaveExitFrame(bool save_doubles, const Register& scratch,
                       const Register& scratch2);
 
+  void LoadMap(Register dst, Register object);
+
   // Load the global proxy from the current context.
   void LoadGlobalProxy(Register dst);
 
@@ -1924,33 +1931,6 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
 
   void LoadNativeContextSlot(int index, Register dst);
 
-  // Like printf, but print at run-time from generated code.
-  //
-  // The caller must ensure that arguments for floating-point placeholders
-  // (such as %e, %f or %g) are VRegisters, and that arguments for integer
-  // placeholders are Registers.
-  //
-  // Format placeholders that refer to more than one argument, or to a specific
-  // argument, are not supported. This includes formats like "%1$d" or "%.*d".
-  //
-  // This function automatically preserves caller-saved registers so that
-  // calling code can use Printf at any point without having to worry about
-  // corruption. The preservation mechanism generates a lot of code. If this is
-  // a problem, preserve the important registers manually and then call
-  // PrintfNoPreserve. Callee-saved registers are not used by Printf, and are
-  // implicitly preserved.
-  void Printf(const char* format, CPURegister arg0 = NoCPUReg,
-              CPURegister arg1 = NoCPUReg, CPURegister arg2 = NoCPUReg,
-              CPURegister arg3 = NoCPUReg);
-
-  // Like Printf, but don't preserve any caller-saved registers, not even 'lr'.
-  //
-  // The return code from the system printf call will be returned in x0.
-  void PrintfNoPreserve(const char* format, const CPURegister& arg0 = NoCPUReg,
-                        const CPURegister& arg1 = NoCPUReg,
-                        const CPURegister& arg2 = NoCPUReg,
-                        const CPURegister& arg3 = NoCPUReg);
-
   // Far branches resolving.
   //
   // The various classes of branch instructions with immediate offsets have
@@ -2081,9 +2061,6 @@ class UseScratchRegisterScope {
   RegList old_availablefp_;  // kVRegister
 };
 
-MemOperand ContextMemOperand(Register context, int index = 0);
-MemOperand NativeContextMemOperand();
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/arm64/register-arm64.h b/deps/v8/src/codegen/arm64/register-arm64.h
index bc088a3308772f..c1d44945ed2e5a 100644
--- a/deps/v8/src/codegen/arm64/register-arm64.h
+++ b/deps/v8/src/codegen/arm64/register-arm64.h
@@ -108,62 +108,54 @@ class CPURegister : public RegisterBase<CPURegister, kRegAfterLast> {
     return CPURegister{kCode_no_reg, 0, kNoRegister};
   }
 
-  template <int code, int size, RegisterType type>
-  static constexpr CPURegister Create() {
-    static_assert(IsValid(code, size, type), "Cannot create invalid registers");
-    return CPURegister{code, size, type};
-  }
-
-  static CPURegister Create(int code, int size, RegisterType type) {
+  static constexpr CPURegister Create(int code, int size, RegisterType type) {
+#if V8_HAS_CXX14_CONSTEXPR
     DCHECK(IsValid(code, size, type));
+#endif
     return CPURegister{code, size, type};
   }
 
   RegisterType type() const { return reg_type_; }
   int SizeInBits() const {
-    DCHECK(IsValid());
+    DCHECK(is_valid());
     return reg_size_;
   }
   int SizeInBytes() const {
-    DCHECK(IsValid());
+    DCHECK(is_valid());
     DCHECK_EQ(SizeInBits() % 8, 0);
     return reg_size_ / 8;
   }
   bool Is8Bits() const {
-    DCHECK(IsValid());
+    DCHECK(is_valid());
     return reg_size_ == 8;
   }
   bool Is16Bits() const {
-    DCHECK(IsValid());
+    DCHECK(is_valid());
     return reg_size_ == 16;
   }
   bool Is32Bits() const {
-    DCHECK(IsValid());
+    DCHECK(is_valid());
     return reg_size_ == 32;
   }
   bool Is64Bits() const {
-    DCHECK(IsValid());
+    DCHECK(is_valid());
     return reg_size_ == 64;
   }
   bool Is128Bits() const {
-    DCHECK(IsValid());
+    DCHECK(is_valid());
     return reg_size_ == 128;
   }
-  bool IsValid() const { return reg_type_ != kNoRegister; }
   bool IsNone() const { return reg_type_ == kNoRegister; }
-  constexpr bool Is(const CPURegister& other) const {
-    return Aliases(other) && (reg_size_ == other.reg_size_);
-  }
   constexpr bool Aliases(const CPURegister& other) const {
-    return (reg_code_ == other.reg_code_) && (reg_type_ == other.reg_type_);
+    return RegisterBase::operator==(other) && reg_type_ == other.reg_type_;
   }
 
   constexpr bool operator==(const CPURegister& other) const {
-    return Is(other);
+    return RegisterBase::operator==(other) && reg_size_ == other.reg_size_ &&
+           reg_type_ == other.reg_type_;
   }
-
   constexpr bool operator!=(const CPURegister& other) const {
-    return !(*this == other);
+    return !operator==(other);
   }
 
   bool IsZero() const;
@@ -204,9 +196,6 @@ class CPURegister : public RegisterBase<CPURegister, kRegAfterLast> {
 
   bool IsSameSizeAndType(const CPURegister& other) const;
 
-  bool is(const CPURegister& other) const { return Is(other); }
-  bool is_valid() const { return IsValid(); }
-
  protected:
   int reg_size_;
   RegisterType reg_type_;
@@ -249,29 +238,18 @@ class Register : public CPURegister {
  public:
   static constexpr Register no_reg() { return Register(CPURegister::no_reg()); }
 
-  template <int code, int size>
-  static constexpr Register Create() {
-    return Register(CPURegister::Create<code, size, CPURegister::kRegister>());
-  }
-
-  static Register Create(int code, int size) {
+  static constexpr Register Create(int code, int size) {
     return Register(CPURegister::Create(code, size, CPURegister::kRegister));
   }
 
   static Register XRegFromCode(unsigned code);
   static Register WRegFromCode(unsigned code);
 
-  static Register from_code(int code) {
+  static constexpr Register from_code(int code) {
     // Always return an X register.
     return Register::Create(code, kXRegSizeInBits);
   }
 
-  template <int code>
-  static Register from_code() {
-    // Always return an X register.
-    return Register::Create<code, kXRegSizeInBits>();
-  }
-
   static const char* GetSpecialRegisterName(int code) {
     return (code == kSPRegInternalCode) ? "sp" : "UNKNOWN";
   }
@@ -342,14 +320,10 @@ class VRegister : public CPURegister {
     return VRegister(CPURegister::no_reg(), 0);
   }
 
-  template <int code, int size, int lane_count = 1>
-  static constexpr VRegister Create() {
-    static_assert(IsValidLaneCount(lane_count), "Invalid lane count");
-    return VRegister(CPURegister::Create<code, size, kVRegister>(), lane_count);
-  }
-
-  static VRegister Create(int code, int size, int lane_count = 1) {
+  static constexpr VRegister Create(int code, int size, int lane_count = 1) {
+#if V8_HAS_CXX14_CONSTEXPR
     DCHECK(IsValidLaneCount(lane_count));
+#endif
     return VRegister(CPURegister::Create(code, size, CPURegister::kVRegister),
                      lane_count);
   }
@@ -457,8 +431,8 @@ class VRegister : public CPURegister {
 ASSERT_TRIVIALLY_COPYABLE(VRegister);
 
 // No*Reg is used to indicate an unused argument, or an error case. Note that
-// these all compare equal (using the Is() method). The Register and VRegister
-// variants are provided for convenience.
+// these all compare equal. The Register and VRegister variants are provided for
+// convenience.
 constexpr Register NoReg = Register::no_reg();
 constexpr VRegister NoVReg = VRegister::no_reg();
 constexpr CPURegister NoCPUReg = CPURegister::no_reg();
@@ -466,7 +440,7 @@ constexpr Register no_reg = NoReg;
 constexpr VRegister no_dreg = NoVReg;
 
 #define DEFINE_REGISTER(register_class, name, ...) \
-  constexpr register_class name = register_class::Create<__VA_ARGS__>()
+  constexpr register_class name = register_class::Create(__VA_ARGS__)
 #define ALIAS_REGISTER(register_class, alias, name) \
   constexpr register_class alias = name
 
@@ -525,13 +499,11 @@ ALIAS_REGISTER(VRegister, fp_scratch2, d31);
 
 // AreAliased returns true if any of the named registers overlap. Arguments set
 // to NoReg are ignored. The system stack pointer may be specified.
-bool AreAliased(const CPURegister& reg1, const CPURegister& reg2,
-                const CPURegister& reg3 = NoReg,
-                const CPURegister& reg4 = NoReg,
-                const CPURegister& reg5 = NoReg,
-                const CPURegister& reg6 = NoReg,
-                const CPURegister& reg7 = NoReg,
-                const CPURegister& reg8 = NoReg);
+V8_EXPORT_PRIVATE bool AreAliased(
+    const CPURegister& reg1, const CPURegister& reg2,
+    const CPURegister& reg3 = NoReg, const CPURegister& reg4 = NoReg,
+    const CPURegister& reg5 = NoReg, const CPURegister& reg6 = NoReg,
+    const CPURegister& reg7 = NoReg, const CPURegister& reg8 = NoReg);
 
 // AreSameSizeAndType returns true if all of the specified registers have the
 // same size, and are of the same type. The system stack pointer may be
@@ -567,20 +539,18 @@ using Simd128Register = VRegister;
 // Lists of registers.
 class V8_EXPORT_PRIVATE CPURegList {
  public:
-  CPURegList() = default;
-
   template <typename... CPURegisters>
   explicit CPURegList(CPURegister reg0, CPURegisters... regs)
       : list_(CPURegister::ListOf(reg0, regs...)),
         size_(reg0.SizeInBits()),
         type_(reg0.type()) {
     DCHECK(AreSameSizeAndType(reg0, regs...));
-    DCHECK(IsValid());
+    DCHECK(is_valid());
   }
 
   CPURegList(CPURegister::RegisterType type, int size, RegList list)
       : list_(list), size_(size), type_(type) {
-    DCHECK(IsValid());
+    DCHECK(is_valid());
   }
 
   CPURegList(CPURegister::RegisterType type, int size, int first_reg,
@@ -593,7 +563,7 @@ class V8_EXPORT_PRIVATE CPURegList {
     DCHECK(last_reg >= first_reg);
     list_ = (1ULL << (last_reg + 1)) - 1;
     list_ &= ~((1ULL << first_reg) - 1);
-    DCHECK(IsValid());
+    DCHECK(is_valid());
   }
 
   CPURegister::RegisterType type() const {
@@ -606,7 +576,7 @@ class V8_EXPORT_PRIVATE CPURegList {
 
   inline void set_list(RegList new_list) {
     list_ = new_list;
-    DCHECK(IsValid());
+    DCHECK(is_valid());
   }
 
   // Combine another CPURegList into this one. Registers that already exist in
@@ -692,7 +662,7 @@ class V8_EXPORT_PRIVATE CPURegList {
   int size_;
   CPURegister::RegisterType type_;
 
-  bool IsValid() const {
+  bool is_valid() const {
     constexpr RegList kValidRegisters{0x8000000ffffffff};
     constexpr RegList kValidVRegisters{0x0000000ffffffff};
     switch (type_) {
diff --git a/deps/v8/src/codegen/assembler.cc b/deps/v8/src/codegen/assembler.cc
index 4e354d9e54b29d..bc30192a7c0ce0 100644
--- a/deps/v8/src/codegen/assembler.cc
+++ b/deps/v8/src/codegen/assembler.cc
@@ -49,23 +49,26 @@
 namespace v8 {
 namespace internal {
 
-AssemblerOptions AssemblerOptions::Default(
-    Isolate* isolate, bool explicitly_support_serialization) {
+AssemblerOptions AssemblerOptions::Default(Isolate* isolate) {
   AssemblerOptions options;
-  const bool serializer =
-      isolate->serializer_enabled() || explicitly_support_serialization;
+  const bool serializer = isolate->serializer_enabled();
   const bool generating_embedded_builtin =
       isolate->IsGeneratingEmbeddedBuiltins();
   options.record_reloc_info_for_serialization = serializer;
   options.enable_root_array_delta_access =
       !serializer && !generating_embedded_builtin;
 #ifdef USE_SIMULATOR
-  // Don't generate simulator specific code if we are building a snapshot, which
-  // might be run on real hardware.
-  options.enable_simulator_code = !serializer;
+  // Even though the simulator is enabled, we may still need to generate code
+  // that may need to run on both the simulator and real hardware. For example,
+  // if we are cross-compiling and embedding a script into the snapshot, the
+  // script will need to run on the host causing the embedded builtins to run in
+  // the simulator. While the final cross-compiled V8 will not have a simulator.
+
+  // So here we enable simulator specific code if not generating the snapshot or
+  // if we are but we are targetting the simulator *only*.
+  options.enable_simulator_code = !serializer || FLAG_target_is_simulator;
 #endif
-  options.inline_offheap_trampolines &=
-      !serializer && !generating_embedded_builtin;
+  options.inline_offheap_trampolines &= !generating_embedded_builtin;
 #if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
   const base::AddressRegion& code_range =
       isolate->heap()->memory_allocator()->code_range();
@@ -141,7 +144,7 @@ AssemblerBase::AssemblerBase(const AssemblerOptions& options,
       predictable_code_size_(false),
       constant_pool_available_(false),
       jump_optimization_info_(nullptr) {
-  if (!buffer_) buffer_ = NewAssemblerBuffer(kMinimalBufferSize);
+  if (!buffer_) buffer_ = NewAssemblerBuffer(kDefaultBufferSize);
   buffer_start_ = buffer_->start();
   pc_ = buffer_start_;
 }
diff --git a/deps/v8/src/codegen/assembler.h b/deps/v8/src/codegen/assembler.h
index af70c4a48fb279..92925a5bf9ad2c 100644
--- a/deps/v8/src/codegen/assembler.h
+++ b/deps/v8/src/codegen/assembler.h
@@ -162,7 +162,7 @@ struct V8_EXPORT_PRIVATE AssemblerOptions {
   bool isolate_independent_code = false;
   // Enables the use of isolate-independent builtins through an off-heap
   // trampoline. (macro assembler feature).
-  bool inline_offheap_trampolines = FLAG_embedded_builtins;
+  bool inline_offheap_trampolines = true;
   // On some platforms, all code is within a given range in the process,
   // and the start of this range is configured here.
   Address code_range_start = 0;
@@ -175,8 +175,7 @@ struct V8_EXPORT_PRIVATE AssemblerOptions {
   // on a function prologue/epilogue.
   bool collect_win64_unwind_info = false;
 
-  static AssemblerOptions Default(
-      Isolate* isolate, bool explicitly_support_serialization = false);
+  static AssemblerOptions Default(Isolate* isolate);
 };
 
 class AssemblerBuffer {
@@ -271,7 +270,13 @@ class V8_EXPORT_PRIVATE AssemblerBase : public Malloced {
     }
   }
 
-  static const int kMinimalBufferSize = 4 * KB;
+  // The minimum buffer size. Should be at least two times the platform-specific
+  // {Assembler::kGap}.
+  static constexpr int kMinimalBufferSize = 128;
+
+  // The default buffer size used if we do not know the final size of the
+  // generated code.
+  static constexpr int kDefaultBufferSize = 4 * KB;
 
  protected:
   // Add 'target' to the {code_targets_} vector, if necessary, and return the
diff --git a/deps/v8/src/codegen/bailout-reason.h b/deps/v8/src/codegen/bailout-reason.h
index e928a634ac5ee1..3e01dca7d0cbbe 100644
--- a/deps/v8/src/codegen/bailout-reason.h
+++ b/deps/v8/src/codegen/bailout-reason.h
@@ -26,8 +26,6 @@ namespace internal {
   V(kInputStringTooLong, "Input string too long")                             \
   V(kInvalidBytecode, "Invalid bytecode")                                     \
   V(kInvalidBytecodeAdvance, "Cannot advance current bytecode, ")             \
-  V(kInvalidElementsKindForInternalPackedArray,                               \
-    "Invalid ElementsKind for InternalPackedArray")                           \
   V(kInvalidHandleScopeLevel, "Invalid HandleScope level")                    \
   V(kInvalidJumpTableIndex, "Invalid jump table index")                       \
   V(kInvalidParametersAndRegistersInGenerator,                                \
@@ -66,8 +64,6 @@ namespace internal {
     "Unexpected runtime function id for the InvokeIntrinsic bytecode")        \
   V(kUnexpectedInitialMapForArrayFunction,                                    \
     "Unexpected initial map for Array function")                              \
-  V(kUnexpectedInitialMapForInternalArrayFunction,                            \
-    "Unexpected initial map for InternalArray function")                      \
   V(kUnexpectedLevelAfterReturnFromApiCall,                                   \
     "Unexpected level after return from api call")                            \
   V(kUnexpectedNegativeValue, "Unexpected negative value")                    \
@@ -86,8 +82,6 @@ namespace internal {
     "Wrong number of arguments for intrinsic")                                \
   V(kWrongFunctionCodeStart, "Wrong value in code start register passed")     \
   V(kWrongFunctionContext, "Wrong context passed to function")                \
-  V(kWrongNumberOfArgumentsForInternalPackedArray,                            \
-    "Wrong number of arguments for InternalPackedArray")                      \
   V(kUnexpectedThreadInWasmSet, "thread_in_wasm flag was already set")        \
   V(kUnexpectedThreadInWasmUnset, "thread_in_wasm flag was not set")
 
diff --git a/deps/v8/src/codegen/code-comments.cc b/deps/v8/src/codegen/code-comments.cc
index 78888633733bdf..b0271a00fb4da6 100644
--- a/deps/v8/src/codegen/code-comments.cc
+++ b/deps/v8/src/codegen/code-comments.cc
@@ -33,9 +33,9 @@ CodeCommentsIterator::CodeCommentsIterator(Address code_comments_start,
       code_comments_size_(code_comments_size),
       current_entry_(code_comments_start + kOffsetToFirstCommentEntry) {
   DCHECK_NE(kNullAddress, code_comments_start);
-  DCHECK_IMPLIES(
-      code_comments_size,
-      code_comments_size == *reinterpret_cast<uint32_t*>(code_comments_start_));
+  DCHECK_IMPLIES(code_comments_size,
+                 code_comments_size ==
+                     base::ReadUnalignedValue<uint32_t>(code_comments_start_));
 }
 
 uint32_t CodeCommentsIterator::size() const { return code_comments_size_; }
diff --git a/deps/v8/src/codegen/code-desc.h b/deps/v8/src/codegen/code-desc.h
index 9a2ee2d868f908..16941b074ad131 100644
--- a/deps/v8/src/codegen/code-desc.h
+++ b/deps/v8/src/codegen/code-desc.h
@@ -69,7 +69,7 @@ class CodeDesc {
   int reloc_size = 0;
 
   // Unwinding information.
-  // TODO(jgruber,mstarzinger): Pack this into the inlined metadata section.
+  // TODO(jgruber): Pack this into the inlined metadata section.
 
   byte* unwinding_info = nullptr;
   int unwinding_info_size = 0;
diff --git a/deps/v8/src/codegen/code-factory.cc b/deps/v8/src/codegen/code-factory.cc
index c8838b05666463..060a66edc7ad8a 100644
--- a/deps/v8/src/codegen/code-factory.cc
+++ b/deps/v8/src/codegen/code-factory.cc
@@ -122,53 +122,6 @@ Callable CodeFactory::KeyedStoreIC_SloppyArguments(Isolate* isolate,
   return isolate->builtins()->CallableFor(isolate, builtin_index);
 }
 
-Callable CodeFactory::KeyedStoreIC_Slow(Isolate* isolate,
-                                        KeyedAccessStoreMode mode) {
-  Builtins::Name builtin_index;
-  switch (mode) {
-    case STANDARD_STORE:
-      builtin_index = Builtins::kKeyedStoreIC_Slow_Standard;
-      break;
-    case STORE_AND_GROW_HANDLE_COW:
-      builtin_index = Builtins::kKeyedStoreIC_Slow_GrowNoTransitionHandleCOW;
-      break;
-    case STORE_IGNORE_OUT_OF_BOUNDS:
-      builtin_index = Builtins::kKeyedStoreIC_Slow_NoTransitionIgnoreOOB;
-      break;
-    case STORE_HANDLE_COW:
-      builtin_index = Builtins::kKeyedStoreIC_Slow_NoTransitionHandleCOW;
-      break;
-    default:
-      UNREACHABLE();
-  }
-  return isolate->builtins()->CallableFor(isolate, builtin_index);
-}
-
-Callable CodeFactory::StoreInArrayLiteralIC_Slow(Isolate* isolate,
-                                                 KeyedAccessStoreMode mode) {
-  Builtins::Name builtin_index;
-  switch (mode) {
-    case STANDARD_STORE:
-      builtin_index = Builtins::kStoreInArrayLiteralIC_Slow_Standard;
-      break;
-    case STORE_AND_GROW_HANDLE_COW:
-      builtin_index =
-          Builtins::kStoreInArrayLiteralIC_Slow_GrowNoTransitionHandleCOW;
-      break;
-    case STORE_IGNORE_OUT_OF_BOUNDS:
-      builtin_index =
-          Builtins::kStoreInArrayLiteralIC_Slow_NoTransitionIgnoreOOB;
-      break;
-    case STORE_HANDLE_COW:
-      builtin_index =
-          Builtins::kStoreInArrayLiteralIC_Slow_NoTransitionHandleCOW;
-      break;
-    default:
-      UNREACHABLE();
-  }
-  return isolate->builtins()->CallableFor(isolate, builtin_index);
-}
-
 Callable CodeFactory::ElementsTransitionAndStore(Isolate* isolate,
                                                  KeyedAccessStoreMode mode) {
   Builtins::Name builtin_index;
diff --git a/deps/v8/src/codegen/code-factory.h b/deps/v8/src/codegen/code-factory.h
index 57484e89eca79c..b8d294ce714d27 100644
--- a/deps/v8/src/codegen/code-factory.h
+++ b/deps/v8/src/codegen/code-factory.h
@@ -42,10 +42,6 @@ class V8_EXPORT_PRIVATE CodeFactory final {
 
   static Callable KeyedStoreIC_SloppyArguments(Isolate* isolate,
                                                KeyedAccessStoreMode mode);
-  static Callable KeyedStoreIC_Slow(Isolate* isolate,
-                                    KeyedAccessStoreMode mode);
-  static Callable StoreInArrayLiteralIC_Slow(Isolate* isolate,
-                                             KeyedAccessStoreMode mode);
   static Callable ElementsTransitionAndStore(Isolate* isolate,
                                              KeyedAccessStoreMode mode);
   static Callable StoreFastElementIC(Isolate* isolate,
diff --git a/deps/v8/src/codegen/code-stub-assembler.cc b/deps/v8/src/codegen/code-stub-assembler.cc
index 3051ce3662c8ce..702a64d0919702 100644
--- a/deps/v8/src/codegen/code-stub-assembler.cc
+++ b/deps/v8/src/codegen/code-stub-assembler.cc
@@ -73,7 +73,7 @@ void CodeStubAssembler::Assert(const BranchGenerator& branch,
 #endif
 }
 
-void CodeStubAssembler::Assert(const NodeGenerator& condition_body,
+void CodeStubAssembler::Assert(const NodeGenerator<BoolT>& condition_body,
                                const char* message, const char* file, int line,
                                std::initializer_list<ExtraNode> extra_nodes) {
 #if defined(DEBUG)
@@ -112,7 +112,7 @@ void CodeStubAssembler::Check(const BranchGenerator& branch,
   Comment("] Assert");
 }
 
-void CodeStubAssembler::Check(const NodeGenerator& condition_body,
+void CodeStubAssembler::Check(const NodeGenerator<BoolT>& condition_body,
                               const char* message, const char* file, int line,
                               std::initializer_list<ExtraNode> extra_nodes) {
   BranchGenerator branch = [=](Label* ok, Label* not_ok) {
@@ -280,10 +280,7 @@ void CodeStubAssembler::FastCheck(TNode<BoolT> condition) {
   Label ok(this), not_ok(this, Label::kDeferred);
   Branch(condition, &ok, &not_ok);
   BIND(&not_ok);
-  {
-    DebugBreak();
-    Goto(&ok);
-  }
+  Unreachable();
   BIND(&ok);
 }
 
@@ -310,29 +307,6 @@ void CodeStubAssembler::FailAssert(
   Unreachable();
 }
 
-Node* CodeStubAssembler::SelectImpl(TNode<BoolT> condition,
-                                    const NodeGenerator& true_body,
-                                    const NodeGenerator& false_body,
-                                    MachineRepresentation rep) {
-  VARIABLE(value, rep);
-  Label vtrue(this), vfalse(this), end(this);
-  Branch(condition, &vtrue, &vfalse);
-
-  BIND(&vtrue);
-  {
-    value.Bind(true_body());
-    Goto(&end);
-  }
-  BIND(&vfalse);
-  {
-    value.Bind(false_body());
-    Goto(&end);
-  }
-
-  BIND(&end);
-  return value.value();
-}
-
 TNode<Int32T> CodeStubAssembler::SelectInt32Constant(
     SloppyTNode<BoolT> condition, int true_value, int false_value) {
   return SelectConstant<Int32T>(condition, Int32Constant(true_value),
@@ -413,6 +387,11 @@ TNode<IntPtrT> CodeStubAssembler::IntPtrOrSmiConstant<IntPtrT>(int value) {
   return IntPtrConstant(value);
 }
 
+template <>
+TNode<UintPtrT> CodeStubAssembler::IntPtrOrSmiConstant<UintPtrT>(int value) {
+  return Unsigned(IntPtrConstant(value));
+}
+
 template <>
 TNode<RawPtrT> CodeStubAssembler::IntPtrOrSmiConstant<RawPtrT>(int value) {
   return ReinterpretCast<RawPtrT>(IntPtrConstant(value));
@@ -514,11 +493,11 @@ TNode<Float64T> CodeStubAssembler::Float64Round(SloppyTNode<Float64T> x) {
   Label return_x(this);
 
   // Round up {x} towards Infinity.
-  VARIABLE(var_x, MachineRepresentation::kFloat64, Float64Ceil(x));
+  TVARIABLE(Float64T, var_x, Float64Ceil(x));
 
   GotoIf(Float64LessThanOrEqual(Float64Sub(var_x.value(), one_half), x),
          &return_x);
-  var_x.Bind(Float64Sub(var_x.value(), one));
+  var_x = Float64Sub(var_x.value(), one);
   Goto(&return_x);
 
   BIND(&return_x);
@@ -535,7 +514,7 @@ TNode<Float64T> CodeStubAssembler::Float64Ceil(SloppyTNode<Float64T> x) {
   TNode<Float64T> two_52 = Float64Constant(4503599627370496.0E0);
   TNode<Float64T> minus_two_52 = Float64Constant(-4503599627370496.0E0);
 
-  VARIABLE(var_x, MachineRepresentation::kFloat64, x);
+  TVARIABLE(Float64T, var_x, x);
   Label return_x(this), return_minus_x(this);
 
   // Check if {x} is greater than zero.
@@ -549,9 +528,9 @@ TNode<Float64T> CodeStubAssembler::Float64Ceil(SloppyTNode<Float64T> x) {
     GotoIf(Float64GreaterThanOrEqual(x, two_52), &return_x);
 
     // Round positive {x} towards Infinity.
-    var_x.Bind(Float64Sub(Float64Add(two_52, x), two_52));
+    var_x = Float64Sub(Float64Add(two_52, x), two_52);
     GotoIfNot(Float64LessThan(var_x.value(), x), &return_x);
-    var_x.Bind(Float64Add(var_x.value(), one));
+    var_x = Float64Add(var_x.value(), one);
     Goto(&return_x);
   }
 
@@ -563,14 +542,14 @@ TNode<Float64T> CodeStubAssembler::Float64Ceil(SloppyTNode<Float64T> x) {
 
     // Round negated {x} towards Infinity and return the result negated.
     TNode<Float64T> minus_x = Float64Neg(x);
-    var_x.Bind(Float64Sub(Float64Add(two_52, minus_x), two_52));
+    var_x = Float64Sub(Float64Add(two_52, minus_x), two_52);
     GotoIfNot(Float64GreaterThan(var_x.value(), minus_x), &return_minus_x);
-    var_x.Bind(Float64Sub(var_x.value(), one));
+    var_x = Float64Sub(var_x.value(), one);
     Goto(&return_minus_x);
   }
 
   BIND(&return_minus_x);
-  var_x.Bind(Float64Neg(var_x.value()));
+  var_x = Float64Neg(var_x.value());
   Goto(&return_x);
 
   BIND(&return_x);
@@ -587,7 +566,7 @@ TNode<Float64T> CodeStubAssembler::Float64Floor(SloppyTNode<Float64T> x) {
   TNode<Float64T> two_52 = Float64Constant(4503599627370496.0E0);
   TNode<Float64T> minus_two_52 = Float64Constant(-4503599627370496.0E0);
 
-  VARIABLE(var_x, MachineRepresentation::kFloat64, x);
+  TVARIABLE(Float64T, var_x, x);
   Label return_x(this), return_minus_x(this);
 
   // Check if {x} is greater than zero.
@@ -601,9 +580,9 @@ TNode<Float64T> CodeStubAssembler::Float64Floor(SloppyTNode<Float64T> x) {
     GotoIf(Float64GreaterThanOrEqual(x, two_52), &return_x);
 
     // Round positive {x} towards -Infinity.
-    var_x.Bind(Float64Sub(Float64Add(two_52, x), two_52));
+    var_x = Float64Sub(Float64Add(two_52, x), two_52);
     GotoIfNot(Float64GreaterThan(var_x.value(), x), &return_x);
-    var_x.Bind(Float64Sub(var_x.value(), one));
+    var_x = Float64Sub(var_x.value(), one);
     Goto(&return_x);
   }
 
@@ -615,14 +594,14 @@ TNode<Float64T> CodeStubAssembler::Float64Floor(SloppyTNode<Float64T> x) {
 
     // Round negated {x} towards -Infinity and return the result negated.
     TNode<Float64T> minus_x = Float64Neg(x);
-    var_x.Bind(Float64Sub(Float64Add(two_52, minus_x), two_52));
+    var_x = Float64Sub(Float64Add(two_52, minus_x), two_52);
     GotoIfNot(Float64LessThan(var_x.value(), minus_x), &return_minus_x);
-    var_x.Bind(Float64Add(var_x.value(), one));
+    var_x = Float64Add(var_x.value(), one);
     Goto(&return_minus_x);
   }
 
   BIND(&return_minus_x);
-  var_x.Bind(Float64Neg(var_x.value()));
+  var_x = Float64Neg(var_x.value());
   Goto(&return_x);
 
   BIND(&return_x);
@@ -637,7 +616,7 @@ TNode<Float64T> CodeStubAssembler::Float64RoundToEven(SloppyTNode<Float64T> x) {
   TNode<Float64T> f = Float64Floor(x);
   TNode<Float64T> f_and_half = Float64Add(f, Float64Constant(0.5));
 
-  VARIABLE(var_result, MachineRepresentation::kFloat64);
+  TVARIABLE(Float64T, var_result);
   Label return_f(this), return_f_plus_one(this), done(this);
 
   GotoIf(Float64LessThan(f_and_half, x), &return_f_plus_one);
@@ -649,11 +628,11 @@ TNode<Float64T> CodeStubAssembler::Float64RoundToEven(SloppyTNode<Float64T> x) {
   }
 
   BIND(&return_f);
-  var_result.Bind(f);
+  var_result = f;
   Goto(&done);
 
   BIND(&return_f_plus_one);
-  var_result.Bind(Float64Add(f, Float64Constant(1.0)));
+  var_result = Float64Add(f, Float64Constant(1.0));
   Goto(&done);
 
   BIND(&done);
@@ -670,7 +649,7 @@ TNode<Float64T> CodeStubAssembler::Float64Trunc(SloppyTNode<Float64T> x) {
   TNode<Float64T> two_52 = Float64Constant(4503599627370496.0E0);
   TNode<Float64T> minus_two_52 = Float64Constant(-4503599627370496.0E0);
 
-  VARIABLE(var_x, MachineRepresentation::kFloat64, x);
+  TVARIABLE(Float64T, var_x, x);
   Label return_x(this), return_minus_x(this);
 
   // Check if {x} is greater than 0.
@@ -681,15 +660,15 @@ TNode<Float64T> CodeStubAssembler::Float64Trunc(SloppyTNode<Float64T> x) {
   BIND(&if_xgreaterthanzero);
   {
     if (IsFloat64RoundDownSupported()) {
-      var_x.Bind(Float64RoundDown(x));
+      var_x = Float64RoundDown(x);
     } else {
       // Just return {x} unless it's in the range ]0,2^52[.
       GotoIf(Float64GreaterThanOrEqual(x, two_52), &return_x);
 
       // Round positive {x} towards -Infinity.
-      var_x.Bind(Float64Sub(Float64Add(two_52, x), two_52));
+      var_x = Float64Sub(Float64Add(two_52, x), two_52);
       GotoIfNot(Float64GreaterThan(var_x.value(), x), &return_x);
-      var_x.Bind(Float64Sub(var_x.value(), one));
+      var_x = Float64Sub(var_x.value(), one);
     }
     Goto(&return_x);
   }
@@ -697,7 +676,7 @@ TNode<Float64T> CodeStubAssembler::Float64Trunc(SloppyTNode<Float64T> x) {
   BIND(&if_xnotgreaterthanzero);
   {
     if (IsFloat64RoundUpSupported()) {
-      var_x.Bind(Float64RoundUp(x));
+      var_x = Float64RoundUp(x);
       Goto(&return_x);
     } else {
       // Just return {x} unless its in the range ]-2^52,0[.
@@ -706,15 +685,15 @@ TNode<Float64T> CodeStubAssembler::Float64Trunc(SloppyTNode<Float64T> x) {
 
       // Round negated {x} towards -Infinity and return result negated.
       TNode<Float64T> minus_x = Float64Neg(x);
-      var_x.Bind(Float64Sub(Float64Add(two_52, minus_x), two_52));
+      var_x = Float64Sub(Float64Add(two_52, minus_x), two_52);
       GotoIfNot(Float64GreaterThan(var_x.value(), minus_x), &return_minus_x);
-      var_x.Bind(Float64Sub(var_x.value(), one));
+      var_x = Float64Sub(var_x.value(), one);
       Goto(&return_minus_x);
     }
   }
 
   BIND(&return_minus_x);
-  var_x.Bind(Float64Neg(var_x.value()));
+  var_x = Float64Neg(var_x.value());
   Goto(&return_x);
 
   BIND(&return_x);
@@ -889,6 +868,26 @@ TNode<Smi> CodeStubAssembler::TrySmiSub(TNode<Smi> lhs, TNode<Smi> rhs,
   }
 }
 
+TNode<Smi> CodeStubAssembler::TrySmiAbs(TNode<Smi> a, Label* if_overflow) {
+  if (SmiValuesAre32Bits()) {
+    TNode<PairT<IntPtrT, BoolT>> pair =
+        IntPtrAbsWithOverflow(BitcastTaggedToWordForTagAndSmiBits(a));
+    TNode<BoolT> overflow = Projection<1>(pair);
+    GotoIf(overflow, if_overflow);
+    TNode<IntPtrT> result = Projection<0>(pair);
+    return BitcastWordToTaggedSigned(result);
+  } else {
+    CHECK(SmiValuesAre31Bits());
+    CHECK(IsInt32AbsWithOverflowSupported());
+    TNode<PairT<Int32T, BoolT>> pair = Int32AbsWithOverflow(
+        TruncateIntPtrToInt32(BitcastTaggedToWordForTagAndSmiBits(a)));
+    TNode<BoolT> overflow = Projection<1>(pair);
+    GotoIf(overflow, if_overflow);
+    TNode<Int32T> result = Projection<0>(pair);
+    return BitcastWordToTaggedSigned(ChangeInt32ToIntPtr(result));
+  }
+}
+
 TNode<Number> CodeStubAssembler::NumberMax(SloppyTNode<Number> a,
                                            SloppyTNode<Number> b) {
   // TODO(danno): This could be optimized by specifically handling smi cases.
@@ -927,44 +926,6 @@ TNode<Number> CodeStubAssembler::NumberMin(SloppyTNode<Number> a,
   return result.value();
 }
 
-TNode<IntPtrT> CodeStubAssembler::ConvertToRelativeIndex(
-    TNode<Context> context, TNode<Object> index, TNode<IntPtrT> length) {
-  TVARIABLE(IntPtrT, result);
-
-  TNode<Number> const index_int =
-      ToInteger_Inline(context, index, CodeStubAssembler::kTruncateMinusZero);
-  TNode<IntPtrT> zero = IntPtrConstant(0);
-
-  Label done(this);
-  Label if_issmi(this), if_isheapnumber(this, Label::kDeferred);
-  Branch(TaggedIsSmi(index_int), &if_issmi, &if_isheapnumber);
-
-  BIND(&if_issmi);
-  {
-    TNode<Smi> const index_smi = CAST(index_int);
-    result = Select<IntPtrT>(
-        IntPtrLessThan(SmiUntag(index_smi), zero),
-        [=] { return IntPtrMax(IntPtrAdd(length, SmiUntag(index_smi)), zero); },
-        [=] { return IntPtrMin(SmiUntag(index_smi), length); });
-    Goto(&done);
-  }
-
-  BIND(&if_isheapnumber);
-  {
-    // If {index} is a heap number, it is definitely out of bounds. If it is
-    // negative, {index} = max({length} + {index}),0) = 0'. If it is positive,
-    // set {index} to {length}.
-    TNode<HeapNumber> const index_hn = CAST(index_int);
-    TNode<Float64T> const float_zero = Float64Constant(0.);
-    TNode<Float64T> const index_float = LoadHeapNumberValue(index_hn);
-    result = SelectConstant<IntPtrT>(Float64LessThan(index_float, float_zero),
-                                     zero, length);
-    Goto(&done);
-  }
-  BIND(&done);
-  return result.value();
-}
-
 TNode<Number> CodeStubAssembler::SmiMod(TNode<Smi> a, TNode<Smi> b) {
   TVARIABLE(Number, var_result);
   Label return_result(this, &var_result),
@@ -1030,8 +991,8 @@ TNode<Number> CodeStubAssembler::SmiMod(TNode<Smi> a, TNode<Smi> b) {
 
 TNode<Number> CodeStubAssembler::SmiMul(TNode<Smi> a, TNode<Smi> b) {
   TVARIABLE(Number, var_result);
-  VARIABLE(var_lhs_float64, MachineRepresentation::kFloat64);
-  VARIABLE(var_rhs_float64, MachineRepresentation::kFloat64);
+  TVARIABLE(Float64T, var_lhs_float64);
+  TVARIABLE(Float64T, var_rhs_float64);
   Label return_result(this, &var_result);
 
   // Both {a} and {b} are Smis. Convert them to integers and multiply.
@@ -1077,8 +1038,8 @@ TNode<Number> CodeStubAssembler::SmiMul(TNode<Smi> a, TNode<Smi> b) {
   }
   BIND(&if_overflow);
   {
-    var_lhs_float64.Bind(SmiToFloat64(a));
-    var_rhs_float64.Bind(SmiToFloat64(b));
+    var_lhs_float64 = SmiToFloat64(a);
+    var_rhs_float64 = SmiToFloat64(b);
     TNode<Float64T> value =
         Float64Mul(var_lhs_float64.value(), var_rhs_float64.value());
     var_result = AllocateHeapNumberWithValue(value);
@@ -1163,7 +1124,7 @@ TNode<Int32T> CodeStubAssembler::TruncateIntPtrToInt32(
   return ReinterpretCast<Int32T>(value);
 }
 
-TNode<BoolT> CodeStubAssembler::TaggedIsSmi(TNode<MaybeObject> a) {
+TNode<BoolT> CodeStubAssembler::TaggedIsSmi(SloppyTNode<MaybeObject> a) {
   STATIC_ASSERT(kSmiTagMask < kMaxUInt32);
   return Word32Equal(
       Word32And(TruncateIntPtrToInt32(BitcastTaggedToWordForTagAndSmiBits(a)),
@@ -1171,7 +1132,7 @@ TNode<BoolT> CodeStubAssembler::TaggedIsSmi(TNode<MaybeObject> a) {
       Int32Constant(0));
 }
 
-TNode<BoolT> CodeStubAssembler::TaggedIsNotSmi(TNode<MaybeObject> a) {
+TNode<BoolT> CodeStubAssembler::TaggedIsNotSmi(SloppyTNode<MaybeObject> a) {
   return Word32BinaryNot(TaggedIsSmi(a));
 }
 
@@ -1228,9 +1189,9 @@ void CodeStubAssembler::BranchIfJSReceiver(SloppyTNode<Object> object,
 
 void CodeStubAssembler::GotoIfForceSlowPath(Label* if_true) {
 #ifdef V8_ENABLE_FORCE_SLOW_PATH
-  TNode<ExternalReference> const force_slow_path_addr =
+  const TNode<ExternalReference> force_slow_path_addr =
       ExternalConstant(ExternalReference::force_slow_path(isolate()));
-  Node* const force_slow = Load(MachineType::Uint8(), force_slow_path_addr);
+  const TNode<Uint8T> force_slow = Load<Uint8T>(force_slow_path_addr);
 
   GotoIf(force_slow, if_true);
 #endif
@@ -1258,10 +1219,8 @@ TNode<HeapObject> CodeStubAssembler::AllocateRaw(TNode<IntPtrT> size_in_bytes,
     GotoIfNot(IsValidPositiveSmi(size_in_bytes), &if_out_of_memory);
   }
 
-  TNode<RawPtrT> top =
-      UncheckedCast<RawPtrT>(Load(MachineType::Pointer(), top_address));
-  TNode<RawPtrT> limit =
-      UncheckedCast<RawPtrT>(Load(MachineType::Pointer(), limit_address));
+  TNode<RawPtrT> top = Load<RawPtrT>(top_address);
+  TNode<RawPtrT> limit = Load<RawPtrT>(limit_address);
 
   // If there's not enough space, call the runtime.
   TVARIABLE(Object, result);
@@ -1518,8 +1477,8 @@ void CodeStubAssembler::BranchIfToBooleanIsTrue(SloppyTNode<Object> value,
     BIND(&if_heapnumber);
     {
       // Load the floating point value of {value}.
-      Node* value_value = LoadObjectField(
-          value_heapobject, HeapNumber::kValueOffset, MachineType::Float64());
+      TNode<Float64T> value_value =
+          LoadObjectField<Float64T>(value_heapobject, HeapNumber::kValueOffset);
 
       // Check if the floating point {value} is neither 0.0, -0.0 nor NaN.
       Branch(Float64LessThan(Float64Constant(0.0), Float64Abs(value_value)),
@@ -1536,14 +1495,10 @@ void CodeStubAssembler::BranchIfToBooleanIsTrue(SloppyTNode<Object> value,
   }
 }
 
-Node* CodeStubAssembler::LoadFromParentFrame(int offset, MachineType type) {
+TNode<Object> CodeStubAssembler::LoadFromParentFrame(int offset) {
   TNode<RawPtrT> frame_pointer = LoadParentFramePointer();
-  return Load(type, frame_pointer, IntPtrConstant(offset));
-}
-
-Node* CodeStubAssembler::LoadBufferObject(Node* buffer, int offset,
-                                          MachineType type) {
-  return Load(type, buffer, IntPtrConstant(offset));
+  return CAST(
+      Load(MachineType::AnyTagged(), frame_pointer, IntPtrConstant(offset)));
 }
 
 Node* CodeStubAssembler::LoadObjectField(SloppyTNode<HeapObject> object,
@@ -1637,8 +1592,8 @@ TNode<BoolT> CodeStubAssembler::IsSpecialReceiverMap(SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
   TNode<BoolT> is_special =
       IsSpecialReceiverInstanceType(LoadMapInstanceType(map));
-  uint32_t mask =
-      Map::HasNamedInterceptorBit::kMask | Map::IsAccessCheckNeededBit::kMask;
+  uint32_t mask = Map::Bits1::HasNamedInterceptorBit::kMask |
+                  Map::Bits1::IsAccessCheckNeededBit::kMask;
   USE(mask);
   // Interceptors or access checks imply special receiver.
   CSA_ASSERT(this,
@@ -1680,14 +1635,12 @@ TNode<HeapObject> CodeStubAssembler::LoadSlowProperties(
       [=] { return CAST(properties); });
 }
 
-TNode<Number> CodeStubAssembler::LoadJSArrayLength(SloppyTNode<JSArray> array) {
-  CSA_ASSERT(this, IsJSArray(array));
-  return CAST(LoadObjectField(array, JSArray::kLengthOffset));
-}
-
-TNode<Object> CodeStubAssembler::LoadJSArgumentsObjectWithLength(
-    SloppyTNode<JSArgumentsObjectWithLength> array) {
-  return LoadObjectField(array, JSArgumentsObjectWithLength::kLengthOffset);
+TNode<Object> CodeStubAssembler::LoadJSArgumentsObjectLength(
+    TNode<Context> context, TNode<JSArgumentsObject> array) {
+  CSA_ASSERT(this, IsJSArgumentsObjectWithLength(context, array));
+  constexpr int offset = JSStrictArgumentsObject::kLengthOffset;
+  STATIC_ASSERT(offset == JSSloppyArgumentsObject::kLengthOffset);
+  return LoadObjectField(array, offset);
 }
 
 TNode<Smi> CodeStubAssembler::LoadFastJSArrayLength(
@@ -1700,13 +1653,13 @@ TNode<Smi> CodeStubAssembler::LoadFastJSArrayLength(
                                 LAST_ANY_NONEXTENSIBLE_ELEMENTS_KIND)));
   // JSArray length is always a positive Smi for fast arrays.
   CSA_SLOW_ASSERT(this, TaggedIsPositiveSmi(length));
-  return UncheckedCast<Smi>(length);
+  return CAST(length);
 }
 
 TNode<Smi> CodeStubAssembler::LoadFixedArrayBaseLength(
     SloppyTNode<FixedArrayBase> array) {
   CSA_SLOW_ASSERT(this, IsNotWeakFixedArraySubclass(array));
-  return CAST(LoadObjectField(array, FixedArrayBase::kLengthOffset));
+  return LoadObjectField<Smi>(array, FixedArrayBase::kLengthOffset);
 }
 
 TNode<IntPtrT> CodeStubAssembler::LoadAndUntagFixedArrayBaseLength(
@@ -1740,7 +1693,7 @@ TNode<Int32T> CodeStubAssembler::LoadNumberOfDescriptors(
 TNode<Int32T> CodeStubAssembler::LoadNumberOfOwnDescriptors(TNode<Map> map) {
   TNode<Uint32T> bit_field3 = LoadMapBitField3(map);
   return UncheckedCast<Int32T>(
-      DecodeWord32<Map::NumberOfOwnDescriptorsBits>(bit_field3));
+      DecodeWord32<Map::Bits3::NumberOfOwnDescriptorsBits>(bit_field3));
 }
 
 TNode<Int32T> CodeStubAssembler::LoadMapBitField(SloppyTNode<Map> map) {
@@ -1768,7 +1721,7 @@ TNode<Uint16T> CodeStubAssembler::LoadMapInstanceType(SloppyTNode<Map> map) {
 TNode<Int32T> CodeStubAssembler::LoadMapElementsKind(SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
   TNode<Int32T> bit_field2 = LoadMapBitField2(map);
-  return Signed(DecodeWord32<Map::ElementsKindBits>(bit_field2));
+  return Signed(DecodeWord32<Map::Bits2::ElementsKindBits>(bit_field2));
 }
 
 TNode<Int32T> CodeStubAssembler::LoadElementsKind(
@@ -1787,24 +1740,6 @@ TNode<HeapObject> CodeStubAssembler::LoadMapPrototype(SloppyTNode<Map> map) {
   return LoadObjectField<HeapObject>(map, Map::kPrototypeOffset);
 }
 
-TNode<PrototypeInfo> CodeStubAssembler::LoadMapPrototypeInfo(
-    SloppyTNode<Map> map, Label* if_no_proto_info) {
-  Label if_strong_heap_object(this);
-  CSA_ASSERT(this, IsMap(map));
-  TNode<MaybeObject> maybe_prototype_info =
-      LoadMaybeWeakObjectField(map, Map::kTransitionsOrPrototypeInfoOffset);
-  TVARIABLE(Object, prototype_info);
-  DispatchMaybeObject(maybe_prototype_info, if_no_proto_info, if_no_proto_info,
-                      if_no_proto_info, &if_strong_heap_object,
-                      &prototype_info);
-
-  BIND(&if_strong_heap_object);
-  GotoIfNot(TaggedEqual(LoadMap(CAST(prototype_info.value())),
-                        PrototypeInfoMapConstant()),
-            if_no_proto_info);
-  return CAST(prototype_info.value());
-}
-
 TNode<IntPtrT> CodeStubAssembler::LoadMapInstanceSizeInWords(
     SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
@@ -1835,7 +1770,8 @@ TNode<IntPtrT> CodeStubAssembler::LoadMapConstructorFunctionIndex(
 TNode<Object> CodeStubAssembler::LoadMapConstructor(SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
   TVARIABLE(Object, result,
-            LoadObjectField(map, Map::kConstructorOrBackPointerOffset));
+            LoadObjectField(
+                map, Map::kConstructorOrBackPointerOrNativeContextOffset));
 
   Label done(this), loop(this, &result);
   Goto(&loop);
@@ -1845,8 +1781,9 @@ TNode<Object> CodeStubAssembler::LoadMapConstructor(SloppyTNode<Map> map) {
     TNode<BoolT> is_map_type =
         InstanceTypeEqual(LoadInstanceType(CAST(result.value())), MAP_TYPE);
     GotoIfNot(is_map_type, &done);
-    result = LoadObjectField(CAST(result.value()),
-                             Map::kConstructorOrBackPointerOffset);
+    result =
+        LoadObjectField(CAST(result.value()),
+                        Map::kConstructorOrBackPointerOrNativeContextOffset);
     Goto(&loop);
   }
   BIND(&done);
@@ -1856,12 +1793,12 @@ TNode<Object> CodeStubAssembler::LoadMapConstructor(SloppyTNode<Map> map) {
 TNode<WordT> CodeStubAssembler::LoadMapEnumLength(SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
   TNode<Uint32T> bit_field3 = LoadMapBitField3(map);
-  return DecodeWordFromWord32<Map::EnumLengthBits>(bit_field3);
+  return DecodeWordFromWord32<Map::Bits3::EnumLengthBits>(bit_field3);
 }
 
 TNode<Object> CodeStubAssembler::LoadMapBackPointer(SloppyTNode<Map> map) {
-  TNode<HeapObject> object =
-      CAST(LoadObjectField(map, Map::kConstructorOrBackPointerOffset));
+  TNode<HeapObject> object = CAST(LoadObjectField(
+      map, Map::kConstructorOrBackPointerOrNativeContextOffset));
   return Select<Object>(
       IsMap(object), [=] { return object; },
       [=] { return UndefinedConstant(); });
@@ -1874,7 +1811,8 @@ TNode<Uint32T> CodeStubAssembler::EnsureOnlyHasSimpleProperties(
   GotoIf(IsCustomElementsReceiverInstanceType(instance_type), bailout);
 
   TNode<Uint32T> bit_field3 = LoadMapBitField3(map);
-  GotoIf(IsSetWord32(bit_field3, Map::IsDictionaryMapBit::kMask), bailout);
+  GotoIf(IsSetWord32(bit_field3, Map::Bits3::IsDictionaryMapBit::kMask),
+         bailout);
 
   return bit_field3;
 }
@@ -1951,8 +1889,7 @@ TNode<Uint32T> CodeStubAssembler::LoadNameHash(SloppyTNode<Name> name,
   return Unsigned(Word32Shr(hash_field, Int32Constant(Name::kHashShift)));
 }
 
-TNode<Smi> CodeStubAssembler::LoadStringLengthAsSmi(
-    SloppyTNode<String> string) {
+TNode<Smi> CodeStubAssembler::LoadStringLengthAsSmi(TNode<String> string) {
   return SmiFromIntPtr(LoadStringLengthAsWord(string));
 }
 
@@ -2231,25 +2168,18 @@ TNode<RawPtrT> CodeStubAssembler::LoadJSTypedArrayDataPtr(
 TNode<BigInt> CodeStubAssembler::LoadFixedBigInt64ArrayElementAsTagged(
     SloppyTNode<RawPtrT> data_pointer, SloppyTNode<IntPtrT> offset) {
   if (Is64()) {
-    TNode<IntPtrT> value = UncheckedCast<IntPtrT>(
-        Load(MachineType::IntPtr(), data_pointer, offset));
+    TNode<IntPtrT> value = Load<IntPtrT>(data_pointer, offset);
     return BigIntFromInt64(value);
   } else {
     DCHECK(!Is64());
 #if defined(V8_TARGET_BIG_ENDIAN)
-    TNode<IntPtrT> high = UncheckedCast<IntPtrT>(
-        Load(MachineType::UintPtr(), data_pointer, offset));
-    TNode<IntPtrT> low = UncheckedCast<IntPtrT>(
-        Load(MachineType::UintPtr(), data_pointer,
-             Int32Add(TruncateIntPtrToInt32(offset),
-                      Int32Constant(kSystemPointerSize))));
+    TNode<IntPtrT> high = Load<IntPtrT>(data_pointer, offset);
+    TNode<IntPtrT> low = Load<IntPtrT>(
+        data_pointer, IntPtrAdd(offset, IntPtrConstant(kSystemPointerSize)));
 #else
-    TNode<IntPtrT> low = UncheckedCast<IntPtrT>(
-        Load(MachineType::UintPtr(), data_pointer, offset));
-    TNode<IntPtrT> high = UncheckedCast<IntPtrT>(
-        Load(MachineType::UintPtr(), data_pointer,
-             Int32Add(TruncateIntPtrToInt32(offset),
-                      Int32Constant(kSystemPointerSize))));
+    TNode<IntPtrT> low = Load<IntPtrT>(data_pointer, offset);
+    TNode<IntPtrT> high = Load<IntPtrT>(
+        data_pointer, IntPtrAdd(offset, IntPtrConstant(kSystemPointerSize)));
 #endif
     return BigIntFromInt32Pair(low, high);
   }
@@ -2364,25 +2294,18 @@ TNode<BigInt> CodeStubAssembler::LoadFixedBigUint64ArrayElementAsTagged(
     SloppyTNode<RawPtrT> data_pointer, SloppyTNode<IntPtrT> offset) {
   Label if_zero(this), done(this);
   if (Is64()) {
-    TNode<UintPtrT> value = UncheckedCast<UintPtrT>(
-        Load(MachineType::UintPtr(), data_pointer, offset));
+    TNode<UintPtrT> value = Load<UintPtrT>(data_pointer, offset);
     return BigIntFromUint64(value);
   } else {
     DCHECK(!Is64());
 #if defined(V8_TARGET_BIG_ENDIAN)
-    TNode<UintPtrT> high = UncheckedCast<UintPtrT>(
-        Load(MachineType::UintPtr(), data_pointer, offset));
-    TNode<UintPtrT> low = UncheckedCast<UintPtrT>(
-        Load(MachineType::UintPtr(), data_pointer,
-             Int32Add(TruncateIntPtrToInt32(offset),
-                      Int32Constant(kSystemPointerSize))));
+    TNode<UintPtrT> high = Load<UintPtrT>(data_pointer, offset);
+    TNode<UintPtrT> low = Load<UintPtrT>(
+        data_pointer, IntPtrAdd(offset, IntPtrConstant(kSystemPointerSize)));
 #else
-    TNode<UintPtrT> low = UncheckedCast<UintPtrT>(
-        Load(MachineType::UintPtr(), data_pointer, offset));
-    TNode<UintPtrT> high = UncheckedCast<UintPtrT>(
-        Load(MachineType::UintPtr(), data_pointer,
-             Int32Add(TruncateIntPtrToInt32(offset),
-                      Int32Constant(kSystemPointerSize))));
+    TNode<UintPtrT> low = Load<UintPtrT>(data_pointer, offset);
+    TNode<UintPtrT> high = Load<UintPtrT>(
+        data_pointer, IntPtrAdd(offset, IntPtrConstant(kSystemPointerSize)));
 #endif
     return BigIntFromUint32Pair(low, high);
   }
@@ -2431,32 +2354,29 @@ TNode<BigInt> CodeStubAssembler::BigIntFromUint64(TNode<UintPtrT> value) {
 }
 
 TNode<Numeric> CodeStubAssembler::LoadFixedTypedArrayElementAsTagged(
-    TNode<RawPtrT> data_pointer, Node* index_node, ElementsKind elements_kind,
-    ParameterMode parameter_mode) {
+    TNode<RawPtrT> data_pointer, TNode<UintPtrT> index,
+    ElementsKind elements_kind) {
   TNode<IntPtrT> offset =
-      ElementOffsetFromIndex(index_node, elements_kind, parameter_mode, 0);
+      ElementOffsetFromIndex(Signed(index), elements_kind, 0);
   switch (elements_kind) {
     case UINT8_ELEMENTS: /* fall through */
     case UINT8_CLAMPED_ELEMENTS:
-      return SmiFromInt32(Load(MachineType::Uint8(), data_pointer, offset));
+      return SmiFromInt32(Load<Uint8T>(data_pointer, offset));
     case INT8_ELEMENTS:
-      return SmiFromInt32(Load(MachineType::Int8(), data_pointer, offset));
+      return SmiFromInt32(Load<Int8T>(data_pointer, offset));
     case UINT16_ELEMENTS:
-      return SmiFromInt32(Load(MachineType::Uint16(), data_pointer, offset));
+      return SmiFromInt32(Load<Uint16T>(data_pointer, offset));
     case INT16_ELEMENTS:
-      return SmiFromInt32(Load(MachineType::Int16(), data_pointer, offset));
+      return SmiFromInt32(Load<Int16T>(data_pointer, offset));
     case UINT32_ELEMENTS:
-      return ChangeUint32ToTagged(
-          Load(MachineType::Uint32(), data_pointer, offset));
+      return ChangeUint32ToTagged(Load<Uint32T>(data_pointer, offset));
     case INT32_ELEMENTS:
-      return ChangeInt32ToTagged(
-          Load(MachineType::Int32(), data_pointer, offset));
+      return ChangeInt32ToTagged(Load<Int32T>(data_pointer, offset));
     case FLOAT32_ELEMENTS:
-      return AllocateHeapNumberWithValue(ChangeFloat32ToFloat64(
-          Load(MachineType::Float32(), data_pointer, offset)));
-    case FLOAT64_ELEMENTS:
       return AllocateHeapNumberWithValue(
-          Load(MachineType::Float64(), data_pointer, offset));
+          ChangeFloat32ToFloat64(Load<Float32T>(data_pointer, offset)));
+    case FLOAT64_ELEMENTS:
+      return AllocateHeapNumberWithValue(Load<Float64T>(data_pointer, offset));
     case BIGINT64_ELEMENTS:
       return LoadFixedBigInt64ArrayElementAsTagged(data_pointer, offset);
     case BIGUINT64_ELEMENTS:
@@ -2467,7 +2387,7 @@ TNode<Numeric> CodeStubAssembler::LoadFixedTypedArrayElementAsTagged(
 }
 
 TNode<Numeric> CodeStubAssembler::LoadFixedTypedArrayElementAsTagged(
-    TNode<RawPtrT> data_pointer, TNode<Smi> index,
+    TNode<RawPtrT> data_pointer, TNode<UintPtrT> index,
     TNode<Int32T> elements_kind) {
   TVARIABLE(Numeric, var_result);
   Label done(this), if_unknown_type(this, Label::kDeferred);
@@ -2494,12 +2414,12 @@ TNode<Numeric> CodeStubAssembler::LoadFixedTypedArrayElementAsTagged(
   BIND(&if_unknown_type);
   Unreachable();
 
-#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype)              \
-  BIND(&if_##type##array);                                     \
-  {                                                            \
-    var_result = LoadFixedTypedArrayElementAsTagged(           \
-        data_pointer, index, TYPE##_ELEMENTS, SMI_PARAMETERS); \
-    Goto(&done);                                               \
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype)                        \
+  BIND(&if_##type##array);                                               \
+  {                                                                      \
+    var_result = LoadFixedTypedArrayElementAsTagged(data_pointer, index, \
+                                                    TYPE##_ELEMENTS);    \
+    Goto(&done);                                                         \
   }
   TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
@@ -2549,7 +2469,7 @@ TNode<Int32T> CodeStubAssembler::LoadAndUntagToWord32ArrayElement(
   CSA_ASSERT(this, IsOffsetInBounds(offset, LoadArrayLength(object),
                                     array_header_size + endian_correction));
   if (SmiValuesAre32Bits()) {
-    return UncheckedCast<Int32T>(Load(MachineType::Int32(), object, offset));
+    return Load<Int32T>(object, offset);
   } else {
     return SmiToInt32(Load(MachineType::TaggedSigned(), object, offset));
   }
@@ -2655,23 +2575,26 @@ TNode<Object> CodeStubAssembler::LoadFixedArrayBaseElementAsTagged(
   return var_result.value();
 }
 
+TNode<BoolT> CodeStubAssembler::IsDoubleHole(TNode<Object> base,
+                                             TNode<IntPtrT> offset) {
+  // TODO(ishell): Compare only the upper part for the hole once the
+  // compiler is able to fold addition of already complex |offset| with
+  // |kIeeeDoubleExponentWordOffset| into one addressing mode.
+  if (Is64()) {
+    TNode<Uint64T> element = Load<Uint64T>(base, offset);
+    return Word64Equal(element, Int64Constant(kHoleNanInt64));
+  } else {
+    TNode<Uint32T> element_upper = Load<Uint32T>(
+        base, IntPtrAdd(offset, IntPtrConstant(kIeeeDoubleExponentWordOffset)));
+    return Word32Equal(element_upper, Int32Constant(kHoleNanUpper32));
+  }
+}
+
 TNode<Float64T> CodeStubAssembler::LoadDoubleWithHoleCheck(
     SloppyTNode<Object> base, SloppyTNode<IntPtrT> offset, Label* if_hole,
     MachineType machine_type) {
   if (if_hole) {
-    // TODO(ishell): Compare only the upper part for the hole once the
-    // compiler is able to fold addition of already complex |offset| with
-    // |kIeeeDoubleExponentWordOffset| into one addressing mode.
-    if (Is64()) {
-      TNode<Uint64T> element = Load<Uint64T>(base, offset);
-      GotoIf(Word64Equal(element, Int64Constant(kHoleNanInt64)), if_hole);
-    } else {
-      TNode<Uint32T> element_upper = Load<Uint32T>(
-          base,
-          IntPtrAdd(offset, IntPtrConstant(kIeeeDoubleExponentWordOffset)));
-      GotoIf(Word32Equal(element_upper, Int32Constant(kHoleNanUpper32)),
-             if_hole);
-    }
+    GotoIf(IsDoubleHole(base, offset), if_hole);
   }
   if (machine_type.IsNone()) {
     // This means the actual value is not needed.
@@ -2680,32 +2603,35 @@ TNode<Float64T> CodeStubAssembler::LoadDoubleWithHoleCheck(
   return UncheckedCast<Float64T>(Load(machine_type, base, offset));
 }
 
-TNode<BoolT> CodeStubAssembler::LoadContextHasExtensionField(
-    SloppyTNode<Context> context) {
+TNode<ScopeInfo> CodeStubAssembler::LoadScopeInfo(TNode<Context> context) {
+  return CAST(LoadContextElement(context, Context::SCOPE_INFO_INDEX));
+}
+
+TNode<BoolT> CodeStubAssembler::LoadScopeInfoHasExtensionField(
+    TNode<ScopeInfo> scope_info) {
   TNode<IntPtrT> value =
-      LoadAndUntagObjectField(context, Context::kLengthOffset);
-  return IsSetWord<Context::HasExtensionField>(value);
+      LoadAndUntagObjectField(scope_info, ScopeInfo::kFlagsOffset);
+  return IsSetWord<ScopeInfo::HasContextExtensionSlotBit>(value);
 }
 
 TNode<Object> CodeStubAssembler::LoadContextElement(
     SloppyTNode<Context> context, int slot_index) {
   int offset = Context::SlotOffset(slot_index);
-  return UncheckedCast<Object>(
-      Load(MachineType::AnyTagged(), context, IntPtrConstant(offset)));
+  return Load<Object>(context, IntPtrConstant(offset));
 }
 
 TNode<Object> CodeStubAssembler::LoadContextElement(
     SloppyTNode<Context> context, SloppyTNode<IntPtrT> slot_index) {
   TNode<IntPtrT> offset = ElementOffsetFromIndex(slot_index, PACKED_ELEMENTS,
                                                  Context::SlotOffset(0));
-  return UncheckedCast<Object>(Load(MachineType::AnyTagged(), context, offset));
+  return Load<Object>(context, offset);
 }
 
 TNode<Object> CodeStubAssembler::LoadContextElement(TNode<Context> context,
                                                     TNode<Smi> slot_index) {
   TNode<IntPtrT> offset = ElementOffsetFromIndex(slot_index, PACKED_ELEMENTS,
                                                  Context::SlotOffset(0));
-  return UncheckedCast<Object>(Load(MachineType::AnyTagged(), context, offset));
+  return Load<Object>(context, offset);
 }
 
 void CodeStubAssembler::StoreContextElement(SloppyTNode<Context> context,
@@ -2732,31 +2658,33 @@ void CodeStubAssembler::StoreContextElementNoWriteBarrier(
 
 TNode<NativeContext> CodeStubAssembler::LoadNativeContext(
     SloppyTNode<Context> context) {
-  return UncheckedCast<NativeContext>(
-      LoadContextElement(context, Context::NATIVE_CONTEXT_INDEX));
+  TNode<Map> map = LoadMap(context);
+  return CAST(LoadObjectField(
+      map, Map::kConstructorOrBackPointerOrNativeContextOffset));
 }
 
 TNode<Context> CodeStubAssembler::LoadModuleContext(
     SloppyTNode<Context> context) {
-  TNode<Map> module_map = ModuleContextMapConstant();
-  Variable cur_context(this, MachineRepresentation::kTaggedPointer);
-  cur_context.Bind(context);
+  TNode<NativeContext> native_context = LoadNativeContext(context);
+  TNode<Map> module_map = CAST(
+      LoadContextElement(native_context, Context::MODULE_CONTEXT_MAP_INDEX));
+  TVariable<Object> cur_context(context, this);
 
   Label context_found(this);
 
-  Variable* context_search_loop_variables[1] = {&cur_context};
-  Label context_search(this, 1, context_search_loop_variables);
+  Label context_search(this, &cur_context);
 
   // Loop until cur_context->map() is module_map.
   Goto(&context_search);
   BIND(&context_search);
   {
-    CSA_ASSERT(this, Word32BinaryNot(IsNativeContext(cur_context.value())));
-    GotoIf(TaggedEqual(LoadMap(cur_context.value()), module_map),
+    CSA_ASSERT(this, Word32BinaryNot(
+                         TaggedEqual(cur_context.value(), native_context)));
+    GotoIf(TaggedEqual(LoadMap(CAST(cur_context.value())), module_map),
            &context_found);
 
-    cur_context.Bind(
-        LoadContextElement(cur_context.value(), Context::PREVIOUS_INDEX));
+    cur_context =
+        LoadContextElement(CAST(cur_context.value()), Context::PREVIOUS_INDEX);
     Goto(&context_search);
   }
 
@@ -2781,57 +2709,55 @@ TNode<Map> CodeStubAssembler::LoadJSArrayElementsMap(
 
 TNode<BoolT> CodeStubAssembler::IsGeneratorFunction(
     TNode<JSFunction> function) {
-  TNode<SharedFunctionInfo> const shared_function_info =
+  const TNode<SharedFunctionInfo> shared_function_info =
       LoadObjectField<SharedFunctionInfo>(
           function, JSFunction::kSharedFunctionInfoOffset);
 
-  TNode<Uint32T> const function_kind =
+  const TNode<Uint32T> function_kind =
       DecodeWord32<SharedFunctionInfo::FunctionKindBits>(LoadObjectField(
           shared_function_info, SharedFunctionInfo::kFlagsOffset,
           MachineType::Uint32()));
 
-  return TNode<BoolT>::UncheckedCast(Word32Or(
-      Word32Or(
-          Word32Or(
-              Word32Equal(function_kind,
-                          Int32Constant(FunctionKind::kAsyncGeneratorFunction)),
-              Word32Equal(
-                  function_kind,
-                  Int32Constant(FunctionKind::kAsyncConciseGeneratorMethod))),
-          Word32Equal(function_kind,
-                      Int32Constant(FunctionKind::kGeneratorFunction))),
-      Word32Equal(function_kind,
-                  Int32Constant(FunctionKind::kConciseGeneratorMethod))));
+  // See IsGeneratorFunction(FunctionKind kind).
+  return IsInRange(function_kind, FunctionKind::kAsyncConciseGeneratorMethod,
+                   FunctionKind::kConciseGeneratorMethod);
 }
 
-TNode<BoolT> CodeStubAssembler::HasPrototypeSlot(TNode<JSFunction> function) {
-  return TNode<BoolT>::UncheckedCast(IsSetWord32<Map::HasPrototypeSlotBit>(
-      LoadMapBitField(LoadMap(function))));
+TNode<BoolT> CodeStubAssembler::IsJSFunctionWithPrototypeSlot(
+    TNode<HeapObject> object) {
+  // Only JSFunction maps may have HasPrototypeSlotBit set.
+  return TNode<BoolT>::UncheckedCast(
+      IsSetWord32<Map::Bits1::HasPrototypeSlotBit>(
+          LoadMapBitField(LoadMap(object))));
 }
 
-TNode<BoolT> CodeStubAssembler::HasPrototypeProperty(TNode<JSFunction> function,
-                                                     TNode<Map> map) {
+void CodeStubAssembler::BranchIfHasPrototypeProperty(
+    TNode<JSFunction> function, TNode<Int32T> function_map_bit_field,
+    Label* if_true, Label* if_false) {
   // (has_prototype_slot() && IsConstructor()) ||
   // IsGeneratorFunction(shared()->kind())
-  uint32_t mask =
-      Map::HasPrototypeSlotBit::kMask | Map::IsConstructorBit::kMask;
-  return TNode<BoolT>::UncheckedCast(
-      Word32Or(IsAllSetWord32(LoadMapBitField(map), mask),
-               IsGeneratorFunction(function)));
+  uint32_t mask = Map::Bits1::HasPrototypeSlotBit::kMask |
+                  Map::Bits1::IsConstructorBit::kMask;
+
+  GotoIf(IsAllSetWord32(function_map_bit_field, mask), if_true);
+  Branch(IsGeneratorFunction(function), if_true, if_false);
 }
 
 void CodeStubAssembler::GotoIfPrototypeRequiresRuntimeLookup(
     TNode<JSFunction> function, TNode<Map> map, Label* runtime) {
   // !has_prototype_property() || has_non_instance_prototype()
-  GotoIfNot(HasPrototypeProperty(function, map), runtime);
-  GotoIf(IsSetWord32<Map::HasNonInstancePrototypeBit>(LoadMapBitField(map)),
+  TNode<Int32T> map_bit_field = LoadMapBitField(map);
+  Label next_check(this);
+  BranchIfHasPrototypeProperty(function, map_bit_field, &next_check, runtime);
+  BIND(&next_check);
+  GotoIf(IsSetWord32<Map::Bits1::HasNonInstancePrototypeBit>(map_bit_field),
          runtime);
 }
 
-Node* CodeStubAssembler::LoadJSFunctionPrototype(TNode<JSFunction> function,
-                                                 Label* if_bailout) {
+TNode<HeapObject> CodeStubAssembler::LoadJSFunctionPrototype(
+    TNode<JSFunction> function, Label* if_bailout) {
   CSA_ASSERT(this, IsFunctionWithPrototypeSlotMap(LoadMap(function)));
-  CSA_ASSERT(this, IsClearWord32<Map::HasNonInstancePrototypeBit>(
+  CSA_ASSERT(this, IsClearWord32<Map::Bits1::HasNonInstancePrototypeBit>(
                        LoadMapBitField(LoadMap(function))));
   TNode<HeapObject> proto_or_map = LoadObjectField<HeapObject>(
       function, JSFunction::kPrototypeOrInitialMapOffset);
@@ -2850,16 +2776,16 @@ Node* CodeStubAssembler::LoadJSFunctionPrototype(TNode<JSFunction> function,
 
 TNode<BytecodeArray> CodeStubAssembler::LoadSharedFunctionInfoBytecodeArray(
     SloppyTNode<SharedFunctionInfo> shared) {
-  TNode<Object> function_data =
-      LoadObjectField(shared, SharedFunctionInfo::kFunctionDataOffset);
+  TNode<HeapObject> function_data = LoadObjectField<HeapObject>(
+      shared, SharedFunctionInfo::kFunctionDataOffset);
 
-  VARIABLE(var_result, MachineRepresentation::kTagged, function_data);
+  TVARIABLE(HeapObject, var_result, function_data);
   Label done(this, &var_result);
 
-  GotoIfNot(HasInstanceType(CAST(function_data), INTERPRETER_DATA_TYPE), &done);
-  TNode<Object> bytecode_array = LoadObjectField(
-      CAST(function_data), InterpreterData::kBytecodeArrayOffset);
-  var_result.Bind(bytecode_array);
+  GotoIfNot(HasInstanceType(function_data, INTERPRETER_DATA_TYPE), &done);
+  TNode<BytecodeArray> bytecode_array = LoadObjectField<BytecodeArray>(
+      function_data, InterpreterData::kBytecodeArrayOffset);
+  var_result = bytecode_array;
   Goto(&done);
 
   BIND(&done);
@@ -2875,20 +2801,20 @@ void CodeStubAssembler::StoreObjectByteNoWriteBarrier(TNode<HeapObject> object,
 
 void CodeStubAssembler::StoreHeapNumberValue(SloppyTNode<HeapNumber> object,
                                              SloppyTNode<Float64T> value) {
-  StoreObjectFieldNoWriteBarrier(object, HeapNumber::kValueOffset, value,
-                                 MachineRepresentation::kFloat64);
+  StoreObjectFieldNoWriteBarrier(object, HeapNumber::kValueOffset, value);
 }
 
-void CodeStubAssembler::StoreObjectField(Node* object, int offset,
-                                         Node* value) {
+void CodeStubAssembler::StoreObjectField(TNode<HeapObject> object, int offset,
+                                         TNode<Object> value) {
   DCHECK_NE(HeapObject::kMapOffset, offset);  // Use StoreMap instead.
 
   OptimizedStoreField(MachineRepresentation::kTagged,
                       UncheckedCast<HeapObject>(object), offset, value);
 }
 
-void CodeStubAssembler::StoreObjectField(Node* object, Node* offset,
-                                         Node* value) {
+void CodeStubAssembler::StoreObjectField(TNode<HeapObject> object,
+                                         TNode<IntPtrT> offset,
+                                         TNode<Object> value) {
   int const_offset;
   if (ToInt32Constant(offset, &const_offset)) {
     StoreObjectField(object, const_offset, value);
@@ -2897,56 +2823,33 @@ void CodeStubAssembler::StoreObjectField(Node* object, Node* offset,
   }
 }
 
-void CodeStubAssembler::StoreObjectFieldNoWriteBarrier(
-    Node* object, int offset, Node* value, MachineRepresentation rep) {
-  if (CanBeTaggedPointer(rep)) {
-    OptimizedStoreFieldAssertNoWriteBarrier(
-        rep, UncheckedCast<HeapObject>(object), offset, value);
-  } else {
-    OptimizedStoreFieldUnsafeNoWriteBarrier(
-        rep, UncheckedCast<HeapObject>(object), offset, value);
-  }
-}
-
 void CodeStubAssembler::UnsafeStoreObjectFieldNoWriteBarrier(
     TNode<HeapObject> object, int offset, TNode<Object> value) {
   OptimizedStoreFieldUnsafeNoWriteBarrier(MachineRepresentation::kTagged,
                                           object, offset, value);
 }
 
-void CodeStubAssembler::StoreObjectFieldNoWriteBarrier(
-    Node* object, SloppyTNode<IntPtrT> offset, Node* value,
-    MachineRepresentation rep) {
-  int const_offset;
-  if (ToInt32Constant(offset, &const_offset)) {
-    return StoreObjectFieldNoWriteBarrier(object, const_offset, value, rep);
-  }
-  StoreNoWriteBarrier(rep, object,
-                      IntPtrSub(offset, IntPtrConstant(kHeapObjectTag)), value);
+void CodeStubAssembler::StoreMap(TNode<HeapObject> object, TNode<Map> map) {
+  OptimizedStoreMap(object, map);
 }
 
-void CodeStubAssembler::StoreMap(Node* object, Node* map) {
-  OptimizedStoreMap(UncheckedCast<HeapObject>(object), CAST(map));
-}
-
-void CodeStubAssembler::StoreMapNoWriteBarrier(Node* object,
+void CodeStubAssembler::StoreMapNoWriteBarrier(TNode<HeapObject> object,
                                                RootIndex map_root_index) {
-  StoreMapNoWriteBarrier(object, LoadRoot(map_root_index));
+  StoreMapNoWriteBarrier(object, CAST(LoadRoot(map_root_index)));
 }
 
-void CodeStubAssembler::StoreMapNoWriteBarrier(Node* object, Node* map) {
-  CSA_SLOW_ASSERT(this, IsMap(map));
+void CodeStubAssembler::StoreMapNoWriteBarrier(TNode<HeapObject> object,
+                                               TNode<Map> map) {
   OptimizedStoreFieldAssertNoWriteBarrier(MachineRepresentation::kTaggedPointer,
-                                          UncheckedCast<HeapObject>(object),
-                                          HeapObject::kMapOffset, map);
+                                          object, HeapObject::kMapOffset, map);
 }
 
-void CodeStubAssembler::StoreObjectFieldRoot(Node* object, int offset,
-                                             RootIndex root_index) {
+void CodeStubAssembler::StoreObjectFieldRoot(TNode<HeapObject> object,
+                                             int offset, RootIndex root_index) {
   if (RootsTable::IsImmortalImmovable(root_index)) {
-    return StoreObjectFieldNoWriteBarrier(object, offset, LoadRoot(root_index));
+    StoreObjectFieldNoWriteBarrier(object, offset, LoadRoot(root_index));
   } else {
-    return StoreObjectField(object, offset, LoadRoot(root_index));
+    StoreObjectField(object, offset, LoadRoot(root_index));
   }
 }
 
@@ -3005,7 +2908,6 @@ void CodeStubAssembler::StoreFixedArrayOrPropertyArrayElement(
 void CodeStubAssembler::StoreFixedDoubleArrayElement(
     TNode<FixedDoubleArray> object, Node* index_node, TNode<Float64T> value,
     ParameterMode parameter_mode, CheckBounds check_bounds) {
-  CSA_ASSERT(this, IsFixedDoubleArray(object));
   CSA_SLOW_ASSERT(this, MatchesParameterMode(index_node, parameter_mode));
   if (NeedsBoundsCheck(check_bounds)) {
     FixedArrayBoundsCheck(object, index_node, 0, parameter_mode);
@@ -3046,40 +2948,18 @@ void CodeStubAssembler::StoreFeedbackVectorSlot(
   }
 }
 
-void CodeStubAssembler::EnsureArrayLengthWritable(TNode<Map> map,
-                                                  Label* bailout) {
-  // Don't support arrays in dictionary named property mode.
-  GotoIf(IsDictionaryMap(map), bailout);
-
-  // Check whether the length property is writable. The length property is the
-  // only default named property on arrays. It's nonconfigurable, hence is
-  // guaranteed to stay the first property.
-  TNode<DescriptorArray> descriptors = LoadMapDescriptors(map);
-
-  int length_index = JSArray::kLengthDescriptorIndex;
-#ifdef DEBUG
-  TNode<Name> maybe_length =
-      LoadKeyByDescriptorEntry(descriptors, length_index);
-  CSA_ASSERT(this, TaggedEqual(maybe_length, LengthStringConstant()));
-#endif
-
-  TNode<Uint32T> details =
-      LoadDetailsByDescriptorEntry(descriptors, length_index);
-  GotoIf(IsSetWord32(details, PropertyDetails::kAttributesReadOnlyMask),
-         bailout);
-}
-
-TNode<Int32T> CodeStubAssembler::EnsureArrayPushable(TNode<Map> map,
+TNode<Int32T> CodeStubAssembler::EnsureArrayPushable(TNode<Context> context,
+                                                     TNode<Map> map,
                                                      Label* bailout) {
   // Disallow pushing onto prototypes. It might be the JSArray prototype.
   // Disallow pushing onto non-extensible objects.
   Comment("Disallow pushing onto prototypes");
   GotoIfNot(IsExtensibleNonPrototypeMap(map), bailout);
 
-  EnsureArrayLengthWritable(map, bailout);
+  EnsureArrayLengthWritable(context, map, bailout);
 
   TNode<Uint32T> kind =
-      DecodeWord32<Map::ElementsKindBits>(LoadMapBitField2(map));
+      DecodeWord32<Map::Bits2::ElementsKindBits>(LoadMapBitField2(map));
   return Signed(kind);
 }
 
@@ -3102,11 +2982,10 @@ void CodeStubAssembler::PossiblyGrowElementsCapacity(
 }
 
 TNode<Smi> CodeStubAssembler::BuildAppendJSArray(ElementsKind kind,
-                                                 SloppyTNode<JSArray> array,
+                                                 TNode<JSArray> array,
                                                  CodeStubArguments* args,
                                                  TVariable<IntPtrT>* arg_index,
                                                  Label* bailout) {
-  CSA_SLOW_ASSERT(this, IsJSArray(array));
   Comment("BuildAppendJSArray: ", ElementsKindToString(kind));
   Label pre_bailout(this);
   Label success(this);
@@ -3161,7 +3040,7 @@ void CodeStubAssembler::TryStoreArrayElement(ElementsKind kind,
   if (IsSmiElementsKind(kind)) {
     GotoIf(TaggedIsNotSmi(value), bailout);
   } else if (IsDoubleElementsKind(kind)) {
-    GotoIfNotNumber(value, bailout);
+    GotoIfNotNumber(CAST(value), bailout);
   }
   if (IsDoubleElementsKind(kind)) {
     value = ChangeNumberToFloat64(CAST(value));
@@ -3169,13 +3048,14 @@ void CodeStubAssembler::TryStoreArrayElement(ElementsKind kind,
   StoreElement(elements, kind, index, value, mode);
 }
 
-void CodeStubAssembler::BuildAppendJSArray(ElementsKind kind, Node* array,
-                                           Node* value, Label* bailout) {
-  CSA_SLOW_ASSERT(this, IsJSArray(array));
+void CodeStubAssembler::BuildAppendJSArray(ElementsKind kind,
+                                           TNode<JSArray> array,
+                                           TNode<Object> value,
+                                           Label* bailout) {
   Comment("BuildAppendJSArray: ", ElementsKindToString(kind));
   ParameterMode mode = OptimalParameterMode();
   TVARIABLE(BInt, var_length, SmiToBInt(LoadFastJSArrayLength(array)));
-  VARIABLE(var_elements, MachineRepresentation::kTagged, LoadElements(array));
+  TVARIABLE(FixedArrayBase, var_elements, LoadElements(array));
 
   // Resize the capacity of the fixed array if it doesn't fit.
   Node* growth = IntPtrOrSmiConstant(1, mode);
@@ -3192,22 +3072,21 @@ void CodeStubAssembler::BuildAppendJSArray(ElementsKind kind, Node* array,
   StoreObjectFieldNoWriteBarrier(array, JSArray::kLengthOffset, length);
 }
 
-Node* CodeStubAssembler::AllocateCellWithValue(Node* value,
-                                               WriteBarrierMode mode) {
+TNode<Cell> CodeStubAssembler::AllocateCellWithValue(TNode<Object> value,
+                                                     WriteBarrierMode mode) {
   TNode<HeapObject> result = Allocate(Cell::kSize, kNone);
   StoreMapNoWriteBarrier(result, RootIndex::kCellMap);
-  StoreCellValue(result, value, mode);
-  return result;
+  TNode<Cell> cell = CAST(result);
+  StoreCellValue(cell, value, mode);
+  return cell;
 }
 
-TNode<Object> CodeStubAssembler::LoadCellValue(Node* cell) {
-  CSA_SLOW_ASSERT(this, HasInstanceType(cell, CELL_TYPE));
+TNode<Object> CodeStubAssembler::LoadCellValue(TNode<Cell> cell) {
   return LoadObjectField(cell, Cell::kValueOffset);
 }
 
-void CodeStubAssembler::StoreCellValue(Node* cell, Node* value,
+void CodeStubAssembler::StoreCellValue(TNode<Cell> cell, TNode<Object> value,
                                        WriteBarrierMode mode) {
-  CSA_SLOW_ASSERT(this, HasInstanceType(cell, CELL_TYPE));
   DCHECK(mode == SKIP_WRITE_BARRIER || mode == UPDATE_WRITE_BARRIER);
 
   if (mode == UPDATE_WRITE_BARRIER) {
@@ -3268,16 +3147,14 @@ TNode<BigInt> CodeStubAssembler::AllocateRawBigInt(TNode<IntPtrT> length) {
   if (FIELD_SIZE(BigInt::kOptionalPaddingOffset) != 0) {
     DCHECK_EQ(4, FIELD_SIZE(BigInt::kOptionalPaddingOffset));
     StoreObjectFieldNoWriteBarrier(raw_result, BigInt::kOptionalPaddingOffset,
-                                   Int32Constant(0),
-                                   MachineRepresentation::kWord32);
+                                   Int32Constant(0));
   }
   return UncheckedCast<BigInt>(raw_result);
 }
 
 void CodeStubAssembler::StoreBigIntBitfield(TNode<BigInt> bigint,
                                             TNode<Word32T> bitfield) {
-  StoreObjectFieldNoWriteBarrier(bigint, BigInt::kBitfieldOffset, bitfield,
-                                 MachineRepresentation::kWord32);
+  StoreObjectFieldNoWriteBarrier(bigint, BigInt::kBitfieldOffset, bitfield);
 }
 
 void CodeStubAssembler::StoreBigIntDigit(TNode<BigInt> bigint,
@@ -3289,7 +3166,7 @@ void CodeStubAssembler::StoreBigIntDigit(TNode<BigInt> bigint,
       bigint,
       BigInt::kDigitsOffset +
           static_cast<int>(digit_index) * kSystemPointerSize,
-      digit, UintPtrT::kMachineRepresentation);
+      digit);
 }
 
 void CodeStubAssembler::StoreBigIntDigit(TNode<BigInt> bigint,
@@ -3298,8 +3175,7 @@ void CodeStubAssembler::StoreBigIntDigit(TNode<BigInt> bigint,
   TNode<IntPtrT> offset =
       IntPtrAdd(IntPtrConstant(BigInt::kDigitsOffset),
                 IntPtrMul(digit_index, IntPtrConstant(kSystemPointerSize)));
-  StoreObjectFieldNoWriteBarrier(bigint, offset, digit,
-                                 UintPtrT::kMachineRepresentation);
+  StoreObjectFieldNoWriteBarrier(bigint, offset, digit);
 }
 
 TNode<Word32T> CodeStubAssembler::LoadBigIntBitfield(TNode<BigInt> bigint) {
@@ -3330,7 +3206,7 @@ TNode<UintPtrT> CodeStubAssembler::LoadBigIntDigit(TNode<BigInt> bigint,
 TNode<ByteArray> CodeStubAssembler::AllocateByteArray(TNode<UintPtrT> length,
                                                       AllocationFlags flags) {
   Comment("AllocateByteArray");
-  VARIABLE(var_result, MachineRepresentation::kTagged);
+  TVARIABLE(Object, var_result);
 
   // Compute the ByteArray size and check if it fits into new space.
   Label if_lengthiszero(this), if_sizeissmall(this),
@@ -3338,7 +3214,7 @@ TNode<ByteArray> CodeStubAssembler::AllocateByteArray(TNode<UintPtrT> length,
   GotoIf(WordEqual(length, UintPtrConstant(0)), &if_lengthiszero);
 
   TNode<IntPtrT> raw_size =
-      GetArrayAllocationSize(Signed(length), UINT8_ELEMENTS, INTPTR_PARAMETERS,
+      GetArrayAllocationSize(Signed(length), UINT8_ELEMENTS,
                              ByteArray::kHeaderSize + kObjectAlignmentMask);
   TNode<IntPtrT> size =
       WordAnd(raw_size, IntPtrConstant(~kObjectAlignmentMask));
@@ -3354,7 +3230,7 @@ TNode<ByteArray> CodeStubAssembler::AllocateByteArray(TNode<UintPtrT> length,
     StoreMapNoWriteBarrier(result, RootIndex::kByteArrayMap);
     StoreObjectFieldNoWriteBarrier(result, ByteArray::kLengthOffset,
                                    SmiTag(Signed(length)));
-    var_result.Bind(result);
+    var_result = result;
     Goto(&if_join);
   }
 
@@ -3364,13 +3240,13 @@ TNode<ByteArray> CodeStubAssembler::AllocateByteArray(TNode<UintPtrT> length,
     TNode<Object> result =
         CallRuntime(Runtime::kAllocateByteArray, NoContextConstant(),
                     ChangeUintPtrToTagged(length));
-    var_result.Bind(result);
+    var_result = result;
     Goto(&if_join);
   }
 
   BIND(&if_lengthiszero);
   {
-    var_result.Bind(EmptyByteArrayConstant());
+    var_result = EmptyByteArrayConstant();
     Goto(&if_join);
   }
 
@@ -3388,11 +3264,9 @@ TNode<String> CodeStubAssembler::AllocateSeqOneByteString(
   DCHECK(RootsTable::IsImmortalImmovable(RootIndex::kOneByteStringMap));
   StoreMapNoWriteBarrier(result, RootIndex::kOneByteStringMap);
   StoreObjectFieldNoWriteBarrier(result, SeqOneByteString::kLengthOffset,
-                                 Uint32Constant(length),
-                                 MachineRepresentation::kWord32);
+                                 Uint32Constant(length));
   StoreObjectFieldNoWriteBarrier(result, SeqOneByteString::kHashFieldOffset,
-                                 Int32Constant(String::kEmptyHashField),
-                                 MachineRepresentation::kWord32);
+                                 Int32Constant(String::kEmptyHashField));
   return CAST(result);
 }
 
@@ -3402,60 +3276,6 @@ TNode<BoolT> CodeStubAssembler::IsZeroOrContext(SloppyTNode<Object> object) {
       [=] { return IsContext(CAST(object)); });
 }
 
-TNode<String> CodeStubAssembler::AllocateSeqOneByteString(
-    TNode<Uint32T> length, AllocationFlags flags) {
-  Comment("AllocateSeqOneByteString");
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-
-  // Compute the SeqOneByteString size and check if it fits into new space.
-  Label if_lengthiszero(this), if_sizeissmall(this),
-      if_notsizeissmall(this, Label::kDeferred), if_join(this);
-  GotoIf(Word32Equal(length, Uint32Constant(0)), &if_lengthiszero);
-
-  TNode<IntPtrT> raw_size = GetArrayAllocationSize(
-      Signed(ChangeUint32ToWord(length)), UINT8_ELEMENTS, INTPTR_PARAMETERS,
-      SeqOneByteString::kHeaderSize + kObjectAlignmentMask);
-  TNode<IntPtrT> size =
-      WordAnd(raw_size, IntPtrConstant(~kObjectAlignmentMask));
-  Branch(IntPtrLessThanOrEqual(size, IntPtrConstant(kMaxRegularHeapObjectSize)),
-         &if_sizeissmall, &if_notsizeissmall);
-
-  BIND(&if_sizeissmall);
-  {
-    // Just allocate the SeqOneByteString in new space.
-    TNode<HeapObject> result =
-        AllocateInNewSpace(UncheckedCast<IntPtrT>(size), flags);
-    DCHECK(RootsTable::IsImmortalImmovable(RootIndex::kOneByteStringMap));
-    StoreMapNoWriteBarrier(result, RootIndex::kOneByteStringMap);
-    StoreObjectFieldNoWriteBarrier(result, SeqOneByteString::kLengthOffset,
-                                   length, MachineRepresentation::kWord32);
-    StoreObjectFieldNoWriteBarrier(result, SeqOneByteString::kHashFieldOffset,
-                                   Int32Constant(String::kEmptyHashField),
-                                   MachineRepresentation::kWord32);
-    var_result.Bind(result);
-    Goto(&if_join);
-  }
-
-  BIND(&if_notsizeissmall);
-  {
-    // We might need to allocate in large object space, go to the runtime.
-    TNode<Object> result =
-        CallRuntime(Runtime::kAllocateSeqOneByteString, NoContextConstant(),
-                    ChangeUint32ToTagged(length));
-    var_result.Bind(result);
-    Goto(&if_join);
-  }
-
-  BIND(&if_lengthiszero);
-  {
-    var_result.Bind(EmptyStringConstant());
-    Goto(&if_join);
-  }
-
-  BIND(&if_join);
-  return CAST(var_result.value());
-}
-
 TNode<String> CodeStubAssembler::AllocateSeqTwoByteString(
     uint32_t length, AllocationFlags flags) {
   Comment("AllocateSeqTwoByteString");
@@ -3466,68 +3286,12 @@ TNode<String> CodeStubAssembler::AllocateSeqTwoByteString(
   DCHECK(RootsTable::IsImmortalImmovable(RootIndex::kStringMap));
   StoreMapNoWriteBarrier(result, RootIndex::kStringMap);
   StoreObjectFieldNoWriteBarrier(result, SeqTwoByteString::kLengthOffset,
-                                 Uint32Constant(length),
-                                 MachineRepresentation::kWord32);
+                                 Uint32Constant(length));
   StoreObjectFieldNoWriteBarrier(result, SeqTwoByteString::kHashFieldOffset,
-                                 Int32Constant(String::kEmptyHashField),
-                                 MachineRepresentation::kWord32);
+                                 Int32Constant(String::kEmptyHashField));
   return CAST(result);
 }
 
-TNode<String> CodeStubAssembler::AllocateSeqTwoByteString(
-    TNode<Uint32T> length, AllocationFlags flags) {
-  Comment("AllocateSeqTwoByteString");
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-
-  // Compute the SeqTwoByteString size and check if it fits into new space.
-  Label if_lengthiszero(this), if_sizeissmall(this),
-      if_notsizeissmall(this, Label::kDeferred), if_join(this);
-  GotoIf(Word32Equal(length, Uint32Constant(0)), &if_lengthiszero);
-
-  TNode<IntPtrT> raw_size = GetArrayAllocationSize(
-      Signed(ChangeUint32ToWord(length)), UINT16_ELEMENTS, INTPTR_PARAMETERS,
-      SeqOneByteString::kHeaderSize + kObjectAlignmentMask);
-  TNode<IntPtrT> size =
-      WordAnd(raw_size, IntPtrConstant(~kObjectAlignmentMask));
-  Branch(IntPtrLessThanOrEqual(size, IntPtrConstant(kMaxRegularHeapObjectSize)),
-         &if_sizeissmall, &if_notsizeissmall);
-
-  BIND(&if_sizeissmall);
-  {
-    // Just allocate the SeqTwoByteString in new space.
-    TNode<HeapObject> result =
-        AllocateInNewSpace(UncheckedCast<IntPtrT>(size), flags);
-    DCHECK(RootsTable::IsImmortalImmovable(RootIndex::kStringMap));
-    StoreMapNoWriteBarrier(result, RootIndex::kStringMap);
-    StoreObjectFieldNoWriteBarrier(result, SeqTwoByteString::kLengthOffset,
-                                   length, MachineRepresentation::kWord32);
-    StoreObjectFieldNoWriteBarrier(result, SeqTwoByteString::kHashFieldOffset,
-                                   Int32Constant(String::kEmptyHashField),
-                                   MachineRepresentation::kWord32);
-    var_result.Bind(result);
-    Goto(&if_join);
-  }
-
-  BIND(&if_notsizeissmall);
-  {
-    // We might need to allocate in large object space, go to the runtime.
-    TNode<Object> result =
-        CallRuntime(Runtime::kAllocateSeqTwoByteString, NoContextConstant(),
-                    ChangeUint32ToTagged(length));
-    var_result.Bind(result);
-    Goto(&if_join);
-  }
-
-  BIND(&if_lengthiszero);
-  {
-    var_result.Bind(EmptyStringConstant());
-    Goto(&if_join);
-  }
-
-  BIND(&if_join);
-  return CAST(var_result.value());
-}
-
 TNode<String> CodeStubAssembler::AllocateSlicedString(RootIndex map_root_index,
                                                       TNode<Uint32T> length,
                                                       TNode<String> parent,
@@ -3538,14 +3302,10 @@ TNode<String> CodeStubAssembler::AllocateSlicedString(RootIndex map_root_index,
   DCHECK(RootsTable::IsImmortalImmovable(map_root_index));
   StoreMapNoWriteBarrier(result, map_root_index);
   StoreObjectFieldNoWriteBarrier(result, SlicedString::kHashFieldOffset,
-                                 Int32Constant(String::kEmptyHashField),
-                                 MachineRepresentation::kWord32);
-  StoreObjectFieldNoWriteBarrier(result, SlicedString::kLengthOffset, length,
-                                 MachineRepresentation::kWord32);
-  StoreObjectFieldNoWriteBarrier(result, SlicedString::kParentOffset, parent,
-                                 MachineRepresentation::kTagged);
-  StoreObjectFieldNoWriteBarrier(result, SlicedString::kOffsetOffset, offset,
-                                 MachineRepresentation::kTagged);
+                                 Int32Constant(String::kEmptyHashField));
+  StoreObjectFieldNoWriteBarrier(result, SlicedString::kLengthOffset, length);
+  StoreObjectFieldNoWriteBarrier(result, SlicedString::kParentOffset, parent);
+  StoreObjectFieldNoWriteBarrier(result, SlicedString::kOffsetOffset, offset);
   return CAST(result);
 }
 
@@ -3650,7 +3410,7 @@ TNode<NameDictionary> CodeStubAssembler::CopyNameDictionary(
 }
 
 template <typename CollectionType>
-Node* CodeStubAssembler::AllocateOrderedHashTable() {
+TNode<CollectionType> CodeStubAssembler::AllocateOrderedHashTable() {
   static const int kCapacity = CollectionType::kMinCapacity;
   static const int kBucketCount = kCapacity / CollectionType::kLoadFactor;
   static const int kDataTableLength = kCapacity * CollectionType::kEntrySize;
@@ -3667,7 +3427,7 @@ Node* CodeStubAssembler::AllocateOrderedHashTable() {
   TNode<IntPtrT> length_intptr = IntPtrConstant(kFixedArrayLength);
   TNode<Map> fixed_array_map =
       CAST(LoadRoot(CollectionType::GetMapRootIndex()));
-  TNode<FixedArray> table =
+  TNode<CollectionType> table =
       CAST(AllocateFixedArray(elements_kind, length_intptr,
                               kAllowLargeObjectAllocation, fixed_array_map));
 
@@ -3701,129 +3461,14 @@ Node* CodeStubAssembler::AllocateOrderedHashTable() {
   return table;
 }
 
-template Node* CodeStubAssembler::AllocateOrderedHashTable<OrderedHashMap>();
-template Node* CodeStubAssembler::AllocateOrderedHashTable<OrderedHashSet>();
-
-template <typename CollectionType>
-TNode<CollectionType> CodeStubAssembler::AllocateSmallOrderedHashTable(
-    TNode<IntPtrT> capacity) {
-  CSA_ASSERT(this, WordIsPowerOfTwo(capacity));
-  CSA_ASSERT(this, IntPtrLessThan(
-                       capacity, IntPtrConstant(CollectionType::kMaxCapacity)));
-
-  TNode<IntPtrT> data_table_start_offset =
-      IntPtrConstant(CollectionType::DataTableStartOffset());
-
-  TNode<IntPtrT> data_table_size = IntPtrMul(
-      capacity, IntPtrConstant(CollectionType::kEntrySize * kTaggedSize));
-
-  TNode<Int32T> hash_table_size =
-      Int32Div(TruncateIntPtrToInt32(capacity),
-               Int32Constant(CollectionType::kLoadFactor));
-
-  TNode<IntPtrT> hash_table_start_offset =
-      IntPtrAdd(data_table_start_offset, data_table_size);
-
-  TNode<IntPtrT> hash_table_and_chain_table_size =
-      IntPtrAdd(ChangeInt32ToIntPtr(hash_table_size), capacity);
-
-  TNode<IntPtrT> total_size =
-      IntPtrAdd(hash_table_start_offset, hash_table_and_chain_table_size);
-
-  TNode<IntPtrT> total_size_word_aligned =
-      IntPtrAdd(total_size, IntPtrConstant(kTaggedSize - 1));
-  total_size_word_aligned = ChangeInt32ToIntPtr(
-      Int32Div(TruncateIntPtrToInt32(total_size_word_aligned),
-               Int32Constant(kTaggedSize)));
-  total_size_word_aligned =
-      UncheckedCast<IntPtrT>(TimesTaggedSize(total_size_word_aligned));
-
-  // Allocate the table and add the proper map.
-  TNode<Map> small_ordered_hash_map =
-      CAST(LoadRoot(CollectionType::GetMapRootIndex()));
-  TNode<HeapObject> table_obj = AllocateInNewSpace(total_size_word_aligned);
-  StoreMapNoWriteBarrier(table_obj, small_ordered_hash_map);
-  TNode<CollectionType> table = UncheckedCast<CollectionType>(table_obj);
-
-  {
-    // This store overlaps with the header fields stored below.
-    // Since it happens first, it effectively still just zero-initializes the
-    // padding.
-    constexpr int offset =
-        RoundDown<kTaggedSize>(CollectionType::PaddingOffset());
-    STATIC_ASSERT(offset + kTaggedSize == CollectionType::PaddingOffset() +
-                                              CollectionType::PaddingSize());
-    StoreObjectFieldNoWriteBarrier(table, offset, SmiConstant(0));
-  }
-
-  // Initialize the SmallOrderedHashTable fields.
-  StoreObjectByteNoWriteBarrier(
-      table, CollectionType::NumberOfBucketsOffset(),
-      Word32And(Int32Constant(0xFF), hash_table_size));
-  StoreObjectByteNoWriteBarrier(table, CollectionType::NumberOfElementsOffset(),
-                                Int32Constant(0));
-  StoreObjectByteNoWriteBarrier(
-      table, CollectionType::NumberOfDeletedElementsOffset(), Int32Constant(0));
-
-  TNode<IntPtrT> table_address =
-      IntPtrSub(BitcastTaggedToWord(table), IntPtrConstant(kHeapObjectTag));
-  TNode<IntPtrT> hash_table_start_address =
-      IntPtrAdd(table_address, hash_table_start_offset);
-
-  // Initialize the HashTable part.
-  TNode<ExternalReference> memset =
-      ExternalConstant(ExternalReference::libc_memset_function());
-  CallCFunction(
-      memset, MachineType::AnyTagged(),
-      std::make_pair(MachineType::Pointer(), hash_table_start_address),
-      std::make_pair(MachineType::IntPtr(), IntPtrConstant(0xFF)),
-      std::make_pair(MachineType::UintPtr(), hash_table_and_chain_table_size));
-
-  // Initialize the DataTable part.
-  TNode<Oddball> filler = TheHoleConstant();
-  TNode<IntPtrT> data_table_start_address =
-      IntPtrAdd(table_address, data_table_start_offset);
-  TNode<IntPtrT> data_table_end_address =
-      IntPtrAdd(data_table_start_address, data_table_size);
-  StoreFieldsNoWriteBarrier(data_table_start_address, data_table_end_address,
-                            filler);
-
-  return table;
-}
-
-template V8_EXPORT_PRIVATE TNode<SmallOrderedHashMap>
-CodeStubAssembler::AllocateSmallOrderedHashTable<SmallOrderedHashMap>(
-    TNode<IntPtrT> capacity);
-template V8_EXPORT_PRIVATE TNode<SmallOrderedHashSet>
-CodeStubAssembler::AllocateSmallOrderedHashTable<SmallOrderedHashSet>(
-    TNode<IntPtrT> capacity);
-
-Node* CodeStubAssembler::AllocateStruct(Node* map, AllocationFlags flags) {
-  Comment("AllocateStruct");
-  CSA_ASSERT(this, IsMap(map));
-  TNode<IntPtrT> size = TimesTaggedSize(LoadMapInstanceSizeInWords(map));
-  TNode<HeapObject> object = Allocate(size, flags);
-  StoreMapNoWriteBarrier(object, map);
-  InitializeStructBody(object, size, Struct::kHeaderSize);
-  return object;
-}
-
-void CodeStubAssembler::InitializeStructBody(TNode<HeapObject> object,
-                                             TNode<IntPtrT> size,
-                                             int start_offset) {
-  Comment("InitializeStructBody");
-  TNode<Oddball> filler = UndefinedConstant();
-  // Calculate the untagged field addresses.
-  TNode<IntPtrT> start_address =
-      IntPtrAdd(BitcastTaggedToWord(object),
-                IntPtrConstant(start_offset - kHeapObjectTag));
-  TNode<IntPtrT> end_address = IntPtrAdd(start_address, size);
-  StoreFieldsNoWriteBarrier(start_address, end_address, filler);
-}
+template TNode<OrderedHashMap>
+CodeStubAssembler::AllocateOrderedHashTable<OrderedHashMap>();
+template TNode<OrderedHashSet>
+CodeStubAssembler::AllocateOrderedHashTable<OrderedHashSet>();
 
 TNode<JSObject> CodeStubAssembler::AllocateJSObjectFromMap(
-    SloppyTNode<Map> map, SloppyTNode<HeapObject> properties,
-    SloppyTNode<FixedArray> elements, AllocationFlags flags,
+    TNode<Map> map, base::Optional<TNode<HeapObject>> properties,
+    base::Optional<TNode<FixedArray>> elements, AllocationFlags flags,
     SlackTrackingMode slack_tracking_mode) {
   CSA_ASSERT(this, IsMap(map));
   CSA_ASSERT(this, Word32BinaryNot(IsJSFunctionMap(map)));
@@ -3839,29 +3484,30 @@ TNode<JSObject> CodeStubAssembler::AllocateJSObjectFromMap(
 }
 
 void CodeStubAssembler::InitializeJSObjectFromMap(
-    SloppyTNode<HeapObject> object, SloppyTNode<Map> map,
-    SloppyTNode<IntPtrT> instance_size, Node* properties, Node* elements,
+    TNode<HeapObject> object, TNode<Map> map, TNode<IntPtrT> instance_size,
+    base::Optional<TNode<HeapObject>> properties,
+    base::Optional<TNode<FixedArray>> elements,
     SlackTrackingMode slack_tracking_mode) {
   CSA_SLOW_ASSERT(this, IsMap(map));
   // This helper assumes that the object is in new-space, as guarded by the
   // check in AllocatedJSObjectFromMap.
-  if (properties == nullptr) {
+  if (!properties) {
     CSA_ASSERT(this, Word32BinaryNot(IsDictionaryMap((map))));
     StoreObjectFieldRoot(object, JSObject::kPropertiesOrHashOffset,
                          RootIndex::kEmptyFixedArray);
   } else {
-    CSA_ASSERT(this, Word32Or(Word32Or(IsPropertyArray(properties),
-                                       IsNameDictionary(properties)),
-                              IsEmptyFixedArray(properties)));
+    CSA_ASSERT(this, Word32Or(Word32Or(IsPropertyArray(*properties),
+                                       IsNameDictionary(*properties)),
+                              IsEmptyFixedArray(*properties)));
     StoreObjectFieldNoWriteBarrier(object, JSObject::kPropertiesOrHashOffset,
-                                   properties);
+                                   *properties);
   }
-  if (elements == nullptr) {
+  if (!elements) {
     StoreObjectFieldRoot(object, JSObject::kElementsOffset,
                          RootIndex::kEmptyFixedArray);
   } else {
-    CSA_ASSERT(this, IsFixedArray(elements));
-    StoreObjectFieldNoWriteBarrier(object, JSObject::kElementsOffset, elements);
+    StoreObjectFieldNoWriteBarrier(object, JSObject::kElementsOffset,
+                                   *elements);
   }
   if (slack_tracking_mode == kNoSlackTracking) {
     InitializeJSObjectBodyNoSlackTracking(object, map, instance_size);
@@ -3875,8 +3521,8 @@ void CodeStubAssembler::InitializeJSObjectBodyNoSlackTracking(
     SloppyTNode<HeapObject> object, SloppyTNode<Map> map,
     SloppyTNode<IntPtrT> instance_size, int start_offset) {
   STATIC_ASSERT(Map::kNoSlackTracking == 0);
-  CSA_ASSERT(
-      this, IsClearWord32<Map::ConstructionCounterBits>(LoadMapBitField3(map)));
+  CSA_ASSERT(this, IsClearWord32<Map::Bits3::ConstructionCounterBits>(
+                       LoadMapBitField3(map)));
   InitializeFieldsWithRoot(object, IntPtrConstant(start_offset), instance_size,
                            RootIndex::kUndefinedValue);
 }
@@ -3891,7 +3537,7 @@ void CodeStubAssembler::InitializeJSObjectBodyWithSlackTracking(
   TNode<Uint32T> bit_field3 = LoadMapBitField3(map);
   Label end(this), slack_tracking(this), complete(this, Label::kDeferred);
   STATIC_ASSERT(Map::kNoSlackTracking == 0);
-  GotoIf(IsSetWord32<Map::ConstructionCounterBits>(bit_field3),
+  GotoIf(IsSetWord32<Map::Bits3::ConstructionCounterBits>(bit_field3),
          &slack_tracking);
   Comment("No slack tracking");
   InitializeJSObjectBodyNoSlackTracking(object, map, instance_size);
@@ -3902,11 +3548,11 @@ void CodeStubAssembler::InitializeJSObjectBodyWithSlackTracking(
     Comment("Decrease construction counter");
     // Slack tracking is only done on initial maps.
     CSA_ASSERT(this, IsUndefined(LoadMapBackPointer(map)));
-    STATIC_ASSERT(Map::ConstructionCounterBits::kLastUsedBit == 31);
+    STATIC_ASSERT(Map::Bits3::ConstructionCounterBits::kLastUsedBit == 31);
     TNode<Word32T> new_bit_field3 = Int32Sub(
-        bit_field3, Int32Constant(1 << Map::ConstructionCounterBits::kShift));
-    StoreObjectFieldNoWriteBarrier(map, Map::kBitField3Offset, new_bit_field3,
-                                   MachineRepresentation::kWord32);
+        bit_field3,
+        Int32Constant(1 << Map::Bits3::ConstructionCounterBits::kShift));
+    StoreObjectFieldNoWriteBarrier(map, Map::kBitField3Offset, new_bit_field3);
     STATIC_ASSERT(Map::kSlackTrackingCounterEnd == 1);
 
     // The object still has in-object slack therefore the |unsed_or_unused|
@@ -3924,7 +3570,7 @@ void CodeStubAssembler::InitializeJSObjectBodyWithSlackTracking(
                              RootIndex::kUndefinedValue);
 
     STATIC_ASSERT(Map::kNoSlackTracking == 0);
-    GotoIf(IsClearWord32<Map::ConstructionCounterBits>(new_bit_field3),
+    GotoIf(IsClearWord32<Map::Bits3::ConstructionCounterBits>(new_bit_field3),
            &complete);
     Goto(&end);
   }
@@ -3958,10 +3604,9 @@ void CodeStubAssembler::StoreFieldsNoWriteBarrier(TNode<IntPtrT> start_address,
 }
 
 TNode<BoolT> CodeStubAssembler::IsValidFastJSArrayCapacity(
-    Node* capacity, ParameterMode capacity_mode) {
-  return UncheckedCast<BoolT>(
-      UintPtrLessThanOrEqual(ParameterToIntPtr(capacity, capacity_mode),
-                             IntPtrConstant(JSArray::kMaxFastArrayLength)));
+    TNode<IntPtrT> capacity) {
+  return UintPtrLessThanOrEqual(capacity,
+                                UintPtrConstant(JSArray::kMaxFastArrayLength));
 }
 
 TNode<JSArray> CodeStubAssembler::AllocateJSArray(
@@ -3985,9 +3630,8 @@ TNode<JSArray> CodeStubAssembler::AllocateJSArray(
 std::pair<TNode<JSArray>, TNode<FixedArrayBase>>
 CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
     ElementsKind kind, TNode<Map> array_map, TNode<Smi> length,
-    TNode<AllocationSite> allocation_site, Node* capacity,
-    ParameterMode capacity_mode, AllocationFlags allocation_flags,
-    int array_header_size) {
+    TNode<AllocationSite> allocation_site, TNode<IntPtrT> capacity,
+    AllocationFlags allocation_flags, int array_header_size) {
   Comment("begin allocation of JSArray with elements");
   CHECK_EQ(allocation_flags & ~kAllowLargeObjectAllocation, 0);
   CSA_SLOW_ASSERT(this, TaggedIsPositiveSmi(length));
@@ -3998,7 +3642,7 @@ CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
   Label out(this), empty(this), nonempty(this);
 
   int capacity_int;
-  if (TryGetIntPtrOrSmiConstantValue(capacity, &capacity_int, capacity_mode)) {
+  if (ToInt32Constant(capacity, &capacity_int)) {
     if (capacity_int == 0) {
       TNode<FixedArray> empty_array = EmptyFixedArrayConstant();
       array = AllocateJSArray(array_map, empty_array, length, allocation_site,
@@ -4008,8 +3652,7 @@ CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
       Goto(&nonempty);
     }
   } else {
-    Branch(SmiEqual(ParameterToTagged(capacity, capacity_mode), SmiConstant(0)),
-           &empty, &nonempty);
+    Branch(WordEqual(capacity, IntPtrConstant(0)), &empty, &nonempty);
 
     BIND(&empty);
     {
@@ -4032,8 +3675,7 @@ CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
 
     // Compute space for elements
     base_size += FixedArray::kHeaderSize;
-    TNode<IntPtrT> size =
-        ElementOffsetFromIndex(capacity, kind, capacity_mode, base_size);
+    TNode<IntPtrT> size = ElementOffsetFromIndex(capacity, kind, base_size);
 
     // For very large arrays in which the requested allocation exceeds the
     // maximal size of a regular heap object, we cannot use the allocation
@@ -4044,19 +3686,16 @@ CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
       Label next(this);
       GotoIf(IsRegularHeapObjectSize(size), &next);
 
-      CSA_CHECK(this, IsValidFastJSArrayCapacity(capacity, capacity_mode));
+      CSA_CHECK(this, IsValidFastJSArrayCapacity(capacity));
 
       // Allocate and initialize the elements first. Full initialization is
       // needed because the upcoming JSArray allocation could trigger GC.
-      elements =
-          AllocateFixedArray(kind, capacity, capacity_mode, allocation_flags);
+      elements = AllocateFixedArray(kind, capacity, allocation_flags);
 
       if (IsDoubleElementsKind(kind)) {
-        FillFixedDoubleArrayWithZero(
-            CAST(elements.value()), ParameterToIntPtr(capacity, capacity_mode));
+        FillFixedDoubleArrayWithZero(CAST(elements.value()), capacity);
       } else {
-        FillFixedArrayWithSmiZero(CAST(elements.value()),
-                                  ParameterToIntPtr(capacity, capacity_mode));
+        FillFixedArrayWithSmiZero(CAST(elements.value()), capacity);
       }
 
       // The JSArray and possibly allocation memento next. Note that
@@ -4087,8 +3726,8 @@ CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
     DCHECK(RootsTable::IsImmortalImmovable(elements_map_index));
     StoreMapNoWriteBarrier(elements.value(), elements_map_index);
 
-    TNode<Smi> capacity_smi = ParameterToTagged(capacity, capacity_mode);
-    CSA_ASSERT(this, SmiGreaterThan(capacity_smi, SmiConstant(0)));
+    CSA_ASSERT(this, WordNotEqual(capacity, IntPtrConstant(0)));
+    TNode<Smi> capacity_smi = SmiTag(capacity);
     StoreObjectFieldNoWriteBarrier(elements.value(), FixedArray::kLengthOffset,
                                    capacity_smi);
     Goto(&out);
@@ -4112,7 +3751,7 @@ TNode<JSArray> CodeStubAssembler::AllocateUninitializedJSArray(
                        RootIndex::kEmptyFixedArray);
 
   if (!allocation_site.is_null()) {
-    InitializeAllocationMemento(array, IntPtrConstant(JSArray::kSize),
+    InitializeAllocationMemento(array, IntPtrConstant(JSArray::kHeaderSize),
                                 allocation_site);
   }
 
@@ -4120,23 +3759,21 @@ TNode<JSArray> CodeStubAssembler::AllocateUninitializedJSArray(
 }
 
 TNode<JSArray> CodeStubAssembler::AllocateJSArray(
-    ElementsKind kind, TNode<Map> array_map, Node* capacity, TNode<Smi> length,
-    TNode<AllocationSite> allocation_site, ParameterMode capacity_mode,
+    ElementsKind kind, TNode<Map> array_map, TNode<IntPtrT> capacity,
+    TNode<Smi> length, TNode<AllocationSite> allocation_site,
     AllocationFlags allocation_flags) {
   CSA_SLOW_ASSERT(this, TaggedIsPositiveSmi(length));
-  CSA_SLOW_ASSERT(this, MatchesParameterMode(capacity, capacity_mode));
 
+  ParameterMode capacity_mode = INTPTR_PARAMETERS;
   TNode<JSArray> array;
   TNode<FixedArrayBase> elements;
 
   std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
-      kind, array_map, length, allocation_site, capacity, capacity_mode,
-      allocation_flags);
+      kind, array_map, length, allocation_site, capacity, allocation_flags);
 
   Label out(this), nonempty(this);
 
-  Branch(SmiEqual(ParameterToTagged(capacity, capacity_mode), SmiConstant(0)),
-         &out, &nonempty);
+  Branch(WordEqual(capacity, IntPtrConstant(0)), &out, &nonempty);
 
   BIND(&nonempty);
   {
@@ -4150,13 +3787,13 @@ TNode<JSArray> CodeStubAssembler::AllocateJSArray(
   return array;
 }
 
-Node* CodeStubAssembler::ExtractFastJSArray(
+TNode<JSArray> CodeStubAssembler::ExtractFastJSArray(
     TNode<Context> context, TNode<JSArray> array, Node* begin, Node* count,
     ParameterMode mode, Node* capacity, TNode<AllocationSite> allocation_site) {
   TNode<Map> original_array_map = LoadMap(array);
   TNode<Int32T> elements_kind = LoadMapElementsKind(original_array_map);
 
-  // Use the cannonical map for the Array's ElementsKind
+  // Use the canonical map for the Array's ElementsKind
   TNode<NativeContext> native_context = LoadNativeContext(context);
   TNode<Map> array_map = LoadJSArrayElementsMap(elements_kind, native_context);
 
@@ -4170,12 +3807,14 @@ Node* CodeStubAssembler::ExtractFastJSArray(
 }
 
 TNode<JSArray> CodeStubAssembler::CloneFastJSArray(
-    TNode<Context> context, TNode<JSArray> array, ParameterMode mode,
+    TNode<Context> context, TNode<JSArray> array,
     TNode<AllocationSite> allocation_site, HoleConversionMode convert_holes) {
   // TODO(dhai): we should be able to assert IsFastJSArray(array) here, but this
   // function is also used to copy boilerplates even when the no-elements
   // protector is invalid. This function should be renamed to reflect its uses.
 
+  // TODO(v8:9708): remove ParameterMode
+  ParameterMode mode = OptimalParameterMode();
   TNode<Number> length = LoadJSArrayLength(array);
   TNode<FixedArrayBase> new_elements;
   TVARIABLE(FixedArrayBase, var_new_elements);
@@ -4394,8 +4033,7 @@ TNode<FixedArray> CodeStubAssembler::ExtractToFixedArray(
     TNode<IntPtrT> object_word = BitcastTaggedToWord(to_elements);
     TNode<IntPtrT> object_page = PageFromAddress(object_word);
     TNode<IntPtrT> page_flags =
-        UncheckedCast<IntPtrT>(Load(MachineType::IntPtr(), object_page,
-                                    IntPtrConstant(Page::kFlagsOffset)));
+        Load<IntPtrT>(object_page, IntPtrConstant(Page::kFlagsOffset));
     CSA_ASSERT(
         this,
         WordNotEqual(
@@ -4488,11 +4126,11 @@ TNode<FixedArrayBase> CodeStubAssembler::ExtractFixedDoubleArrayFillingHoles(
   DCHECK_NE(var_holes_converted, nullptr);
   CSA_ASSERT(this, IsFixedDoubleArrayMap(fixed_array_map));
 
-  VARIABLE(var_result, MachineRepresentation::kTagged);
+  TVARIABLE(FixedArrayBase, var_result);
   const ElementsKind kind = PACKED_DOUBLE_ELEMENTS;
   TNode<FixedArrayBase> to_elements = AllocateFixedArray(
       kind, capacity, mode, allocation_flags, fixed_array_map);
-  var_result.Bind(to_elements);
+  var_result = to_elements;
   // We first try to copy the FixedDoubleArray to a new FixedDoubleArray.
   // |var_holes_converted| is set to False preliminarily.
   *var_holes_converted = Int32FalseConstant();
@@ -4554,13 +4192,13 @@ TNode<FixedArrayBase> CodeStubAssembler::ExtractFixedDoubleArrayFillingHoles(
         ExtractToFixedArray(from_array, first, count, capacity, fixed_array_map,
                             kind, allocation_flags, extract_flags, mode,
                             HoleConversionMode::kConvertToUndefined);
-    var_result.Bind(to_elements);
+    var_result = to_elements;
     Goto(&done);
   }
 
   BIND(&done);
   Comment("] ExtractFixedDoubleArrayFillingHoles");
-  return UncheckedCast<FixedArrayBase>(var_result.value());
+  return var_result.value();
 }
 
 TNode<FixedArrayBase> CodeStubAssembler::ExtractFixedArray(
@@ -4576,7 +4214,7 @@ TNode<FixedArrayBase> CodeStubAssembler::ExtractFixedArray(
   HoleConversionMode convert_holes =
       var_holes_converted != nullptr ? HoleConversionMode::kConvertToUndefined
                                      : HoleConversionMode::kDontConvert;
-  VARIABLE(var_result, MachineRepresentation::kTagged);
+  TVARIABLE(FixedArrayBase, var_result);
   const AllocationFlags allocation_flags =
       (extract_flags & ExtractFixedArrayFlag::kNewSpaceAllocationOnly)
           ? CodeStubAssembler::kNone
@@ -4601,7 +4239,7 @@ TNode<FixedArrayBase> CodeStubAssembler::ExtractFixedArray(
                          parameter_mode)));
   }
 
-  Label if_fixed_double_array(this), empty(this), done(this, {&var_result});
+  Label if_fixed_double_array(this), empty(this), done(this, &var_result);
   TNode<Map> source_map = LoadMap(source);
   GotoIf(IntPtrOrSmiEqual(IntPtrOrSmiConstant(0, parameter_mode), capacity,
                           parameter_mode),
@@ -4622,7 +4260,7 @@ TNode<FixedArrayBase> CodeStubAssembler::ExtractFixedArray(
         source, first, count, capacity, source_map, PACKED_ELEMENTS,
         allocation_flags, extract_flags, parameter_mode, convert_holes,
         var_holes_converted, source_runtime_kind);
-    var_result.Bind(to_elements);
+    var_result = to_elements;
     Goto(&done);
   }
 
@@ -4634,7 +4272,7 @@ TNode<FixedArrayBase> CodeStubAssembler::ExtractFixedArray(
       TNode<FixedArrayBase> to_elements = ExtractFixedDoubleArrayFillingHoles(
           source, first, count, capacity, source_map, var_holes_converted,
           allocation_flags, extract_flags, parameter_mode);
-      var_result.Bind(to_elements);
+      var_result = to_elements;
     } else {
       // We use PACKED_DOUBLE_ELEMENTS to signify that both the source and
       // the target are FixedDoubleArray. That it is PACKED or HOLEY does not
@@ -4647,7 +4285,7 @@ TNode<FixedArrayBase> CodeStubAssembler::ExtractFixedArray(
       CopyElements(kind, to_elements, IntPtrConstant(0), CAST(source),
                    ParameterToIntPtr(first, parameter_mode),
                    ParameterToIntPtr(count, parameter_mode));
-      var_result.Bind(to_elements);
+      var_result = to_elements;
     }
 
     Goto(&done);
@@ -4657,18 +4295,16 @@ TNode<FixedArrayBase> CodeStubAssembler::ExtractFixedArray(
   {
     Comment("Copy empty array");
 
-    var_result.Bind(EmptyFixedArrayConstant());
+    var_result = EmptyFixedArrayConstant();
     Goto(&done);
   }
 
   BIND(&done);
-  return UncheckedCast<FixedArray>(var_result.value());
+  return var_result.value();
 }
 
-void CodeStubAssembler::InitializePropertyArrayLength(Node* property_array,
-                                                      Node* length,
-                                                      ParameterMode mode) {
-  CSA_SLOW_ASSERT(this, IsPropertyArray(property_array));
+void CodeStubAssembler::InitializePropertyArrayLength(
+    TNode<PropertyArray> property_array, Node* length, ParameterMode mode) {
   CSA_ASSERT(
       this, IntPtrOrSmiGreaterThan(length, IntPtrOrSmiConstant(0, mode), mode));
   CSA_ASSERT(
@@ -4676,9 +4312,9 @@ void CodeStubAssembler::InitializePropertyArrayLength(Node* property_array,
       IntPtrOrSmiLessThanOrEqual(
           length, IntPtrOrSmiConstant(PropertyArray::LengthField::kMax, mode),
           mode));
-  StoreObjectFieldNoWriteBarrier(
-      property_array, PropertyArray::kLengthAndHashOffset,
-      ParameterToTagged(length, mode), MachineRepresentation::kTaggedSigned);
+  StoreObjectFieldNoWriteBarrier(property_array,
+                                 PropertyArray::kLengthAndHashOffset,
+                                 ParameterToTagged(length, mode));
 }
 
 Node* CodeStubAssembler::AllocatePropertyArray(Node* capacity_node,
@@ -4694,7 +4330,7 @@ Node* CodeStubAssembler::AllocatePropertyArray(Node* capacity_node,
   RootIndex map_index = RootIndex::kPropertyArrayMap;
   DCHECK(RootsTable::IsImmortalImmovable(map_index));
   StoreMapNoWriteBarrier(array, map_index);
-  InitializePropertyArrayLength(array, capacity_node, mode);
+  InitializePropertyArrayLength(CAST(array), capacity_node, mode);
   return array;
 }
 
@@ -4748,15 +4384,8 @@ void CodeStubAssembler::FillFixedArrayWithValue(ElementsKind kind, Node* array,
       mode);
 }
 
-void CodeStubAssembler::StoreFixedDoubleArrayHole(
-    TNode<FixedDoubleArray> array, Node* index, ParameterMode parameter_mode) {
-  CSA_SLOW_ASSERT(this, MatchesParameterMode(index, parameter_mode));
-  TNode<IntPtrT> offset =
-      ElementOffsetFromIndex(index, PACKED_DOUBLE_ELEMENTS, parameter_mode,
-                             FixedArray::kHeaderSize - kHeapObjectTag);
-  CSA_ASSERT(this, IsOffsetInBounds(
-                       offset, LoadAndUntagFixedArrayBaseLength(array),
-                       FixedDoubleArray::kHeaderSize, PACKED_DOUBLE_ELEMENTS));
+void CodeStubAssembler::StoreDoubleHole(TNode<HeapObject> object,
+                                        TNode<IntPtrT> offset) {
   TNode<UintPtrT> double_hole =
       Is64() ? ReinterpretCast<UintPtrT>(Int64Constant(kHoleNanInt64))
              : ReinterpretCast<UintPtrT>(Int32Constant(kHoleNanLower32));
@@ -4764,17 +4393,29 @@ void CodeStubAssembler::StoreFixedDoubleArrayHole(
   // preserves double bits during manipulation, remove this code/change
   // this to an indexed Float64 store.
   if (Is64()) {
-    StoreNoWriteBarrier(MachineRepresentation::kWord64, array, offset,
+    StoreNoWriteBarrier(MachineRepresentation::kWord64, object, offset,
                         double_hole);
   } else {
-    StoreNoWriteBarrier(MachineRepresentation::kWord32, array, offset,
+    StoreNoWriteBarrier(MachineRepresentation::kWord32, object, offset,
                         double_hole);
-    StoreNoWriteBarrier(MachineRepresentation::kWord32, array,
+    StoreNoWriteBarrier(MachineRepresentation::kWord32, object,
                         IntPtrAdd(offset, IntPtrConstant(kInt32Size)),
                         double_hole);
   }
 }
 
+void CodeStubAssembler::StoreFixedDoubleArrayHole(
+    TNode<FixedDoubleArray> array, Node* index, ParameterMode parameter_mode) {
+  CSA_SLOW_ASSERT(this, MatchesParameterMode(index, parameter_mode));
+  TNode<IntPtrT> offset =
+      ElementOffsetFromIndex(index, PACKED_DOUBLE_ELEMENTS, parameter_mode,
+                             FixedArray::kHeaderSize - kHeapObjectTag);
+  CSA_ASSERT(this, IsOffsetInBounds(
+                       offset, LoadAndUntagFixedArrayBaseLength(array),
+                       FixedDoubleArray::kHeaderSize, PACKED_DOUBLE_ELEMENTS));
+  StoreDoubleHole(array, offset);
+}
+
 void CodeStubAssembler::FillFixedArrayWithSmiZero(TNode<FixedArray> array,
                                                   TNode<IntPtrT> length) {
   CSA_ASSERT(this, WordEqual(length, LoadAndUntagFixedArrayBaseLength(array)));
@@ -4890,8 +4531,8 @@ void CodeStubAssembler::MoveElements(ElementsKind kind,
           IntPtrMul(IntPtrSub(dst_index, begin),
                     IntPtrConstant(ElementsKindToByteSize(kind)));
       auto loop_body = [&](Node* array, Node* offset) {
-        Node* const element = Load(MachineType::AnyTagged(), array, offset);
-        TNode<WordT> const delta_offset = IntPtrAdd(offset, delta);
+        const TNode<AnyTaggedT> element = Load<AnyTaggedT>(array, offset);
+        const TNode<WordT> delta_offset = IntPtrAdd(offset, delta);
         Store(array, delta_offset, element);
       };
 
@@ -4983,8 +4624,8 @@ void CodeStubAssembler::CopyElements(ElementsKind kind,
       BuildFastFixedArrayForEach(
           src_elements, kind, begin, end,
           [&](Node* array, Node* offset) {
-            Node* const element = Load(MachineType::AnyTagged(), array, offset);
-            TNode<WordT> const delta_offset = IntPtrAdd(offset, delta);
+            const TNode<AnyTaggedT> element = Load<AnyTaggedT>(array, offset);
+            const TNode<WordT> delta_offset = IntPtrAdd(offset, delta);
             if (write_barrier == SKIP_WRITE_BARRIER) {
               StoreNoWriteBarrier(MachineRepresentation::kTagged, dst_elements,
                                   delta_offset, element);
@@ -5065,12 +4706,12 @@ void CodeStubAssembler::CopyFixedArrayElements(
                              from_kind, mode, first_element_offset));
   // This second variable is used only when the element sizes of source and
   // destination arrays do not match.
-  VARIABLE(var_to_offset, MachineType::PointerRepresentation());
+  TVARIABLE(IntPtrT, var_to_offset);
   if (element_offset_matches) {
-    var_to_offset.Bind(var_from_offset.value());
+    var_to_offset = var_from_offset.value();
   } else {
-    var_to_offset.Bind(ElementOffsetFromIndex(element_count, to_kind, mode,
-                                              first_element_offset));
+    var_to_offset = ElementOffsetFromIndex(element_count, to_kind, mode,
+                                           first_element_offset);
   }
 
   Variable* vars[] = {&var_from_offset, &var_to_offset, var_holes_converted};
@@ -5092,14 +4733,14 @@ void CodeStubAssembler::CopyFixedArrayElements(
         IntPtrConstant(from_double_elements ? kDoubleSize : kTaggedSize)));
     var_from_offset = from_offset;
 
-    Node* to_offset;
+    TNode<IntPtrT> to_offset;
     if (element_offset_matches) {
       to_offset = from_offset;
     } else {
       to_offset = IntPtrSub(
           var_to_offset.value(),
           IntPtrConstant(to_double_elements ? kDoubleSize : kTaggedSize));
-      var_to_offset.Bind(to_offset);
+      var_to_offset = to_offset;
     }
 
     Label next_iter(this), store_double_hole(this), signal_hole(this);
@@ -5210,7 +4851,7 @@ void CodeStubAssembler::CopyPropertyArrayValues(Node* from_array,
       from_array, kind, start, property_count,
       [this, to_array, needs_write_barrier, destroy_source](Node* array,
                                                             Node* offset) {
-        Node* value = Load(MachineType::AnyTagged(), array, offset);
+        TNode<AnyTaggedT> value = Load<AnyTaggedT>(array, offset);
 
         if (destroy_source == DestroySource::kNo) {
           value = CloneIfMutablePrimitive(CAST(value));
@@ -5254,7 +4895,7 @@ Node* CodeStubAssembler::LoadElementAndPrepareForStore(Node* array,
     return value;
 
   } else {
-    TNode<Object> value = CAST(Load(MachineType::AnyTagged(), array, offset));
+    TNode<Object> value = Load<Object>(array, offset);
     if (if_hole) {
       GotoIf(TaggedEqual(value, TheHoleConstant()), if_hole);
     }
@@ -5336,32 +4977,32 @@ TNode<FixedArrayBase> CodeStubAssembler::GrowElementsCapacity(
   // Copy the elements from the old elements store to the new.
   // The size-check above guarantees that the |new_elements| is allocated
   // in new space so we can skip the write barrier.
-  CopyFixedArrayElements(from_kind, elements, to_kind, new_elements, capacity,
-                         new_capacity, SKIP_WRITE_BARRIER, mode);
+  CopyFixedArrayElements(from_kind, CAST(elements), to_kind, new_elements,
+                         UncheckedCast<IntPtrT>(capacity),
+                         UncheckedCast<IntPtrT>(new_capacity),
+                         SKIP_WRITE_BARRIER, mode);
 
-  StoreObjectField(object, JSObject::kElementsOffset, new_elements);
+  StoreObjectField(CAST(object), JSObject::kElementsOffset, new_elements);
   Comment("] GrowElementsCapacity");
   return new_elements;
 }
 
-void CodeStubAssembler::InitializeAllocationMemento(Node* base,
-                                                    Node* base_allocation_size,
-                                                    Node* allocation_site) {
+void CodeStubAssembler::InitializeAllocationMemento(
+    TNode<HeapObject> base, TNode<IntPtrT> base_allocation_size,
+    TNode<AllocationSite> allocation_site) {
   Comment("[Initialize AllocationMemento");
-  TNode<HeapObject> memento =
-      InnerAllocate(CAST(base), UncheckedCast<IntPtrT>(base_allocation_size));
+  TNode<HeapObject> memento = InnerAllocate(base, base_allocation_size);
   StoreMapNoWriteBarrier(memento, RootIndex::kAllocationMementoMap);
   StoreObjectFieldNoWriteBarrier(
       memento, AllocationMemento::kAllocationSiteOffset, allocation_site);
   if (FLAG_allocation_site_pretenuring) {
-    TNode<Int32T> count = UncheckedCast<Int32T>(LoadObjectField(
-        allocation_site, AllocationSite::kPretenureCreateCountOffset,
-        MachineType::Int32()));
+    TNode<Int32T> count = LoadObjectField<Int32T>(
+        allocation_site, AllocationSite::kPretenureCreateCountOffset);
 
     TNode<Int32T> incremented_count = Int32Add(count, Int32Constant(1));
-    StoreObjectFieldNoWriteBarrier(
-        allocation_site, AllocationSite::kPretenureCreateCountOffset,
-        incremented_count, MachineRepresentation::kWord32);
+    StoreObjectFieldNoWriteBarrier(allocation_site,
+                                   AllocationSite::kPretenureCreateCountOffset,
+                                   incremented_count);
   }
   Comment("]");
 }
@@ -5421,7 +5062,7 @@ TNode<Word32T> CodeStubAssembler::TruncateTaggedToWord32(
 void CodeStubAssembler::TaggedToWord32OrBigInt(
     TNode<Context> context, TNode<Object> value, Label* if_number,
     TVariable<Word32T>* var_word32, Label* if_bigint,
-    TVariable<Object>* var_maybe_bigint) {
+    TVariable<BigInt>* var_maybe_bigint) {
   TaggedToWord32OrBigIntImpl<Object::Conversion::kToNumeric>(
       context, value, if_number, var_word32, if_bigint, var_maybe_bigint);
 }
@@ -5432,7 +5073,7 @@ void CodeStubAssembler::TaggedToWord32OrBigInt(
 void CodeStubAssembler::TaggedToWord32OrBigIntWithFeedback(
     TNode<Context> context, TNode<Object> value, Label* if_number,
     TVariable<Word32T>* var_word32, Label* if_bigint,
-    TVariable<Object>* var_maybe_bigint, TVariable<Smi>* var_feedback) {
+    TVariable<BigInt>* var_maybe_bigint, TVariable<Smi>* var_feedback) {
   TaggedToWord32OrBigIntImpl<Object::Conversion::kToNumeric>(
       context, value, if_number, var_word32, if_bigint, var_maybe_bigint,
       var_feedback);
@@ -5442,7 +5083,7 @@ template <Object::Conversion conversion>
 void CodeStubAssembler::TaggedToWord32OrBigIntImpl(
     TNode<Context> context, TNode<Object> value, Label* if_number,
     TVariable<Word32T>* var_word32, Label* if_bigint,
-    TVariable<Object>* var_maybe_bigint, TVariable<Smi>* var_feedback) {
+    TVariable<BigInt>* var_maybe_bigint, TVariable<Smi>* var_feedback) {
   // We might need to loop after conversion.
   TVARIABLE(Object, var_value, value);
   OverwriteFeedback(var_feedback, BinaryOperationFeedback::kNone);
@@ -5504,7 +5145,7 @@ void CodeStubAssembler::TaggedToWord32OrBigIntImpl(
 
     if (conversion == Object::Conversion::kToNumeric) {
       BIND(&is_bigint);
-      *var_maybe_bigint = value;
+      *var_maybe_bigint = CAST(value);
       CombineFeedback(var_feedback, BinaryOperationFeedback::kBigInt);
       Goto(if_bigint);
     }
@@ -5662,7 +5303,7 @@ TNode<Number> CodeStubAssembler::ChangeUintPtrToTagged(TNode<UintPtrT> value) {
 TNode<String> CodeStubAssembler::ToThisString(TNode<Context> context,
                                               TNode<Object> value,
                                               TNode<String> method_name) {
-  VARIABLE(var_value, MachineRepresentation::kTagged, value);
+  TVARIABLE(Object, var_value, value);
 
   // Check if the {value} is a Smi or a HeapObject.
   Label if_valueissmi(this, Label::kDeferred), if_valueisnotsmi(this),
@@ -5683,7 +5324,7 @@ TNode<String> CodeStubAssembler::ToThisString(TNode<Context> context,
       Label if_valueisnullorundefined(this, Label::kDeferred);
       GotoIf(IsNullOrUndefined(value), &if_valueisnullorundefined);
       // Convert the {value} to a String.
-      var_value.Bind(CallBuiltin(Builtins::kToString, context, value));
+      var_value = CallBuiltin(Builtins::kToString, context, value);
       Goto(&if_valueisstring);
 
       BIND(&if_valueisnullorundefined);
@@ -5697,7 +5338,7 @@ TNode<String> CodeStubAssembler::ToThisString(TNode<Context> context,
   BIND(&if_valueissmi);
   {
     // The {value} is a Smi, convert it to a String.
-    var_value.Bind(CallBuiltin(Builtins::kNumberToString, context, value));
+    var_value = CallBuiltin(Builtins::kNumberToString, context, value);
     Goto(&if_valueisstring);
   }
   BIND(&if_valueisstring);
@@ -5740,36 +5381,6 @@ TNode<Float64T> CodeStubAssembler::ChangeNumberToFloat64(TNode<Number> value) {
   return result.value();
 }
 
-TNode<UintPtrT> CodeStubAssembler::TryNumberToUintPtr(TNode<Number> value,
-                                                      Label* if_negative) {
-  TVARIABLE(UintPtrT, result);
-  Label done(this, &result);
-  Branch(
-      TaggedIsSmi(value),
-      [&] {
-        TNode<Smi> value_smi = CAST(value);
-        if (if_negative == nullptr) {
-          CSA_SLOW_ASSERT(this, SmiLessThan(SmiConstant(-1), value_smi));
-        } else {
-          GotoIfNot(TaggedIsPositiveSmi(value), if_negative);
-        }
-        result = UncheckedCast<UintPtrT>(SmiToIntPtr(value_smi));
-        Goto(&done);
-      },
-      [&] {
-        TNode<HeapNumber> value_hn = CAST(value);
-        TNode<Float64T> value = LoadHeapNumberValue(value_hn);
-        if (if_negative != nullptr) {
-          GotoIf(Float64LessThan(value, Float64Constant(0.0)), if_negative);
-        }
-        result = ChangeFloat64ToUintPtr(value);
-        Goto(&done);
-      });
-
-  BIND(&done);
-  return result.value();
-}
-
 TNode<WordT> CodeStubAssembler::TimesSystemPointerSize(
     SloppyTNode<WordT> value) {
   return WordShl(value, kSystemPointerSizeLog2);
@@ -5867,18 +5478,17 @@ TNode<Object> CodeStubAssembler::ToThisValue(TNode<Context> context,
   return var_value.value();
 }
 
-Node* CodeStubAssembler::ThrowIfNotInstanceType(Node* context, Node* value,
-                                                InstanceType instance_type,
-                                                char const* method_name) {
+void CodeStubAssembler::ThrowIfNotInstanceType(TNode<Context> context,
+                                               TNode<Object> value,
+                                               InstanceType instance_type,
+                                               char const* method_name) {
   Label out(this), throw_exception(this, Label::kDeferred);
-  VARIABLE(var_value_map, MachineRepresentation::kTagged);
 
   GotoIf(TaggedIsSmi(value), &throw_exception);
 
   // Load the instance type of the {value}.
-  var_value_map.Bind(LoadMap(value));
-  TNode<Uint16T> const value_instance_type =
-      LoadMapInstanceType(var_value_map.value());
+  TNode<Map> map = LoadMap(CAST(value));
+  const TNode<Uint16T> value_instance_type = LoadMapInstanceType(map);
 
   Branch(Word32Equal(value_instance_type, Int32Constant(instance_type)), &out,
          &throw_exception);
@@ -5889,7 +5499,6 @@ Node* CodeStubAssembler::ThrowIfNotInstanceType(Node* context, Node* value,
                  StringConstant(method_name), value);
 
   BIND(&out);
-  return var_value_map.value();
 }
 
 void CodeStubAssembler::ThrowIfNotJSReceiver(TNode<Context> context,
@@ -5902,7 +5511,7 @@ void CodeStubAssembler::ThrowIfNotJSReceiver(TNode<Context> context,
 
   // Load the instance type of the {value}.
   TNode<Map> value_map = LoadMap(CAST(value));
-  TNode<Uint16T> const value_instance_type = LoadMapInstanceType(value_map);
+  const TNode<Uint16T> value_instance_type = LoadMapInstanceType(value_map);
 
   Branch(IsJSReceiverInstanceType(value_instance_type), &done,
          &throw_exception);
@@ -5929,43 +5538,52 @@ void CodeStubAssembler::ThrowIfNotCallable(TNode<Context> context,
   BIND(&out);
 }
 
-void CodeStubAssembler::ThrowRangeError(Node* context, MessageTemplate message,
-                                        Node* arg0, Node* arg1, Node* arg2) {
+void CodeStubAssembler::ThrowRangeError(TNode<Context> context,
+                                        MessageTemplate message,
+                                        base::Optional<TNode<Object>> arg0,
+                                        base::Optional<TNode<Object>> arg1,
+                                        base::Optional<TNode<Object>> arg2) {
   TNode<Smi> template_index = SmiConstant(static_cast<int>(message));
-  if (arg0 == nullptr) {
+  if (!arg0) {
     CallRuntime(Runtime::kThrowRangeError, context, template_index);
-  } else if (arg1 == nullptr) {
-    CallRuntime(Runtime::kThrowRangeError, context, template_index, arg0);
-  } else if (arg2 == nullptr) {
-    CallRuntime(Runtime::kThrowRangeError, context, template_index, arg0, arg1);
+  } else if (!arg1) {
+    CallRuntime(Runtime::kThrowRangeError, context, template_index, *arg0);
+  } else if (!arg2) {
+    CallRuntime(Runtime::kThrowRangeError, context, template_index, *arg0,
+                *arg1);
   } else {
-    CallRuntime(Runtime::kThrowRangeError, context, template_index, arg0, arg1,
-                arg2);
+    CallRuntime(Runtime::kThrowRangeError, context, template_index, *arg0,
+                *arg1, *arg2);
   }
   Unreachable();
 }
 
-void CodeStubAssembler::ThrowTypeError(Node* context, MessageTemplate message,
+void CodeStubAssembler::ThrowTypeError(TNode<Context> context,
+                                       MessageTemplate message,
                                        char const* arg0, char const* arg1) {
-  Node* arg0_node = nullptr;
+  base::Optional<TNode<Object>> arg0_node;
   if (arg0) arg0_node = StringConstant(arg0);
-  Node* arg1_node = nullptr;
+  base::Optional<TNode<Object>> arg1_node;
   if (arg1) arg1_node = StringConstant(arg1);
   ThrowTypeError(context, message, arg0_node, arg1_node);
 }
 
-void CodeStubAssembler::ThrowTypeError(Node* context, MessageTemplate message,
-                                       Node* arg0, Node* arg1, Node* arg2) {
+void CodeStubAssembler::ThrowTypeError(TNode<Context> context,
+                                       MessageTemplate message,
+                                       base::Optional<TNode<Object>> arg0,
+                                       base::Optional<TNode<Object>> arg1,
+                                       base::Optional<TNode<Object>> arg2) {
   TNode<Smi> template_index = SmiConstant(static_cast<int>(message));
-  if (arg0 == nullptr) {
+  if (!arg0) {
     CallRuntime(Runtime::kThrowTypeError, context, template_index);
-  } else if (arg1 == nullptr) {
-    CallRuntime(Runtime::kThrowTypeError, context, template_index, arg0);
-  } else if (arg2 == nullptr) {
-    CallRuntime(Runtime::kThrowTypeError, context, template_index, arg0, arg1);
+  } else if (!arg1) {
+    CallRuntime(Runtime::kThrowTypeError, context, template_index, *arg0);
+  } else if (!arg2) {
+    CallRuntime(Runtime::kThrowTypeError, context, template_index, *arg0,
+                *arg1);
   } else {
-    CallRuntime(Runtime::kThrowTypeError, context, template_index, arg0, arg1,
-                arg2);
+    CallRuntime(Runtime::kThrowTypeError, context, template_index, *arg0, *arg1,
+                *arg2);
   }
   Unreachable();
 }
@@ -5977,24 +5595,25 @@ TNode<BoolT> CodeStubAssembler::InstanceTypeEqual(
 
 TNode<BoolT> CodeStubAssembler::IsDictionaryMap(SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
-  return IsSetWord32<Map::IsDictionaryMapBit>(LoadMapBitField3(map));
+  return IsSetWord32<Map::Bits3::IsDictionaryMapBit>(LoadMapBitField3(map));
 }
 
 TNode<BoolT> CodeStubAssembler::IsExtensibleMap(SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
-  return IsSetWord32<Map::IsExtensibleBit>(LoadMapBitField3(map));
+  return IsSetWord32<Map::Bits3::IsExtensibleBit>(LoadMapBitField3(map));
 }
 
 TNode<BoolT> CodeStubAssembler::IsExtensibleNonPrototypeMap(TNode<Map> map) {
-  int kMask = Map::IsExtensibleBit::kMask | Map::IsPrototypeMapBit::kMask;
-  int kExpected = Map::IsExtensibleBit::kMask;
+  int kMask =
+      Map::Bits3::IsExtensibleBit::kMask | Map::Bits3::IsPrototypeMapBit::kMask;
+  int kExpected = Map::Bits3::IsExtensibleBit::kMask;
   return Word32Equal(Word32And(LoadMapBitField3(map), Int32Constant(kMask)),
                      Int32Constant(kExpected));
 }
 
 TNode<BoolT> CodeStubAssembler::IsCallableMap(SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
-  return IsSetWord32<Map::IsCallableBit>(LoadMapBitField(map));
+  return IsSetWord32<Map::Bits1::IsCallableBit>(LoadMapBitField(map));
 }
 
 TNode<BoolT> CodeStubAssembler::IsDebugInfo(TNode<HeapObject> object) {
@@ -6003,12 +5622,12 @@ TNode<BoolT> CodeStubAssembler::IsDebugInfo(TNode<HeapObject> object) {
 
 TNode<BoolT> CodeStubAssembler::IsDeprecatedMap(SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
-  return IsSetWord32<Map::IsDeprecatedBit>(LoadMapBitField3(map));
+  return IsSetWord32<Map::Bits3::IsDeprecatedBit>(LoadMapBitField3(map));
 }
 
 TNode<BoolT> CodeStubAssembler::IsUndetectableMap(SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
-  return IsSetWord32<Map::IsUndetectableBit>(LoadMapBitField(map));
+  return IsSetWord32<Map::Bits1::IsUndetectableBit>(LoadMapBitField(map));
 }
 
 TNode<BoolT> CodeStubAssembler::IsNoElementsProtectorCellInvalid() {
@@ -6071,8 +5690,8 @@ TNode<BoolT> CodeStubAssembler::IsPromiseSpeciesProtectorCellInvalid() {
 
 TNode<BoolT> CodeStubAssembler::IsPrototypeInitialArrayPrototype(
     SloppyTNode<Context> context, SloppyTNode<Map> map) {
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Object> const initial_array_prototype = LoadContextElement(
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Object> initial_array_prototype = LoadContextElement(
       native_context, Context::INITIAL_ARRAY_PROTOTYPE_INDEX);
   TNode<HeapObject> proto = LoadMapPrototype(map);
   return TaggedEqual(proto, initial_array_prototype);
@@ -6080,8 +5699,8 @@ TNode<BoolT> CodeStubAssembler::IsPrototypeInitialArrayPrototype(
 
 TNode<BoolT> CodeStubAssembler::IsPrototypeTypedArrayPrototype(
     SloppyTNode<Context> context, SloppyTNode<Map> map) {
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Object> const typed_array_prototype =
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Object> typed_array_prototype =
       LoadContextElement(native_context, Context::TYPED_ARRAY_PROTOTYPE_INDEX);
   TNode<HeapObject> proto = LoadMapPrototype(map);
   TNode<HeapObject> proto_of_proto = Select<HeapObject>(
@@ -6092,32 +5711,32 @@ TNode<BoolT> CodeStubAssembler::IsPrototypeTypedArrayPrototype(
 
 TNode<BoolT> CodeStubAssembler::IsFastAliasedArgumentsMap(
     TNode<Context> context, TNode<Map> map) {
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Object> const arguments_map = LoadContextElement(
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Object> arguments_map = LoadContextElement(
       native_context, Context::FAST_ALIASED_ARGUMENTS_MAP_INDEX);
   return TaggedEqual(arguments_map, map);
 }
 
 TNode<BoolT> CodeStubAssembler::IsSlowAliasedArgumentsMap(
     TNode<Context> context, TNode<Map> map) {
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Object> const arguments_map = LoadContextElement(
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Object> arguments_map = LoadContextElement(
       native_context, Context::SLOW_ALIASED_ARGUMENTS_MAP_INDEX);
   return TaggedEqual(arguments_map, map);
 }
 
 TNode<BoolT> CodeStubAssembler::IsSloppyArgumentsMap(TNode<Context> context,
                                                      TNode<Map> map) {
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Object> const arguments_map =
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Object> arguments_map =
       LoadContextElement(native_context, Context::SLOPPY_ARGUMENTS_MAP_INDEX);
   return TaggedEqual(arguments_map, map);
 }
 
 TNode<BoolT> CodeStubAssembler::IsStrictArgumentsMap(TNode<Context> context,
                                                      TNode<Map> map) {
-  TNode<NativeContext> const native_context = LoadNativeContext(context);
-  TNode<Object> const arguments_map =
+  const TNode<NativeContext> native_context = LoadNativeContext(context);
+  const TNode<Object> arguments_map =
       LoadContextElement(native_context, Context::STRICT_ARGUMENTS_MAP_INDEX);
   return TaggedEqual(arguments_map, map);
 }
@@ -6144,7 +5763,7 @@ TNode<BoolT> CodeStubAssembler::IsCode(SloppyTNode<HeapObject> object) {
 
 TNode<BoolT> CodeStubAssembler::IsConstructorMap(SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
-  return IsSetWord32<Map::IsConstructorBit>(LoadMapBitField(map));
+  return IsSetWord32<Map::Bits1::IsConstructorBit>(LoadMapBitField(map));
 }
 
 TNode<BoolT> CodeStubAssembler::IsConstructor(SloppyTNode<HeapObject> object) {
@@ -6154,7 +5773,7 @@ TNode<BoolT> CodeStubAssembler::IsConstructor(SloppyTNode<HeapObject> object) {
 TNode<BoolT> CodeStubAssembler::IsFunctionWithPrototypeSlotMap(
     SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
-  return IsSetWord32<Map::HasPrototypeSlotBit>(LoadMapBitField(map));
+  return IsSetWord32<Map::Bits1::HasPrototypeSlotBit>(LoadMapBitField(map));
 }
 
 TNode<BoolT> CodeStubAssembler::IsSpecialReceiverInstanceType(
@@ -6177,7 +5796,7 @@ TNode<BoolT> CodeStubAssembler::IsStringInstanceType(
 }
 
 TNode<BoolT> CodeStubAssembler::IsOneByteStringInstanceType(
-    SloppyTNode<Int32T> instance_type) {
+    TNode<Int32T> instance_type) {
   CSA_ASSERT(this, IsStringInstanceType(instance_type));
   return Word32Equal(
       Word32And(instance_type, Int32Constant(kStringEncodingMask)),
@@ -6386,6 +6005,28 @@ TNode<BoolT> CodeStubAssembler::IsPropertyArray(
   return HasInstanceType(object, PROPERTY_ARRAY_TYPE);
 }
 
+TNode<BoolT> CodeStubAssembler::IsPromiseReaction(
+    SloppyTNode<HeapObject> object) {
+  return HasInstanceType(object, PROMISE_REACTION_TYPE);
+}
+
+TNode<BoolT> CodeStubAssembler::IsPromiseReactionJobTask(
+    TNode<HeapObject> object) {
+  TNode<Uint16T> instance_type = LoadInstanceType(object);
+  return IsInRange(instance_type, FIRST_PROMISE_REACTION_JOB_TASK_TYPE,
+                   LAST_PROMISE_REACTION_JOB_TASK_TYPE);
+}
+
+TNode<BoolT> CodeStubAssembler::IsPromiseRejectReactionJobTask(
+    SloppyTNode<HeapObject> object) {
+  return HasInstanceType(object, PROMISE_REJECT_REACTION_JOB_TASK_TYPE);
+}
+
+TNode<BoolT> CodeStubAssembler::IsPromiseFulfillReactionJobTask(
+    SloppyTNode<HeapObject> object) {
+  return HasInstanceType(object, PROMISE_FULFILL_REACTION_JOB_TASK_TYPE);
+}
+
 // This complicated check is due to elements oddities. If a smi array is empty
 // after Array.p.shift, it is replaced by the empty array constant. If it is
 // later filled with a double element, we try to grow it but pass in a double
@@ -6402,7 +6043,7 @@ TNode<BoolT> CodeStubAssembler::IsFixedArrayWithKindOrEmpty(
 
   GotoIf(IsFixedArrayWithKind(object, kind), &out);
 
-  TNode<Smi> const length = LoadFixedArrayBaseLength(CAST(object));
+  const TNode<Smi> length = LoadFixedArrayBaseLength(CAST(object));
   GotoIf(SmiEqual(length, SmiConstant(0)), &out);
 
   var_result = Int32FalseConstant();
@@ -6556,7 +6197,7 @@ TNode<BoolT> CodeStubAssembler::IsPrivateName(SloppyTNode<Symbol> symbol) {
 
 TNode<BoolT> CodeStubAssembler::IsNativeContext(
     SloppyTNode<HeapObject> object) {
-  return TaggedEqual(LoadMap(object), NativeContextMapConstant());
+  return HasInstanceType(object, NATIVE_CONTEXT_TYPE);
 }
 
 TNode<BoolT> CodeStubAssembler::IsFixedDoubleArray(
@@ -6611,6 +6252,11 @@ TNode<BoolT> CodeStubAssembler::IsJSFunction(SloppyTNode<HeapObject> object) {
   return IsJSFunctionMap(LoadMap(object));
 }
 
+TNode<BoolT> CodeStubAssembler::IsJSBoundFunction(
+    SloppyTNode<HeapObject> object) {
+  return HasInstanceType(object, JS_BOUND_FUNCTION_TYPE);
+}
+
 TNode<BoolT> CodeStubAssembler::IsJSFunctionMap(SloppyTNode<Map> map) {
   return IsJSFunctionInstanceType(LoadMapInstanceType(map));
 }
@@ -6781,12 +6427,9 @@ Node* CodeStubAssembler::FixedArraySizeDoesntFitInNewSpace(Node* element_count,
       element_count, IntPtrOrSmiConstant(max_newspace_elements, mode), mode);
 }
 
-TNode<Int32T> CodeStubAssembler::StringCharCodeAt(SloppyTNode<String> string,
-                                                  SloppyTNode<IntPtrT> index) {
-  CSA_ASSERT(this, IsString(string));
-
-  CSA_ASSERT(this, IntPtrGreaterThanOrEqual(index, IntPtrConstant(0)));
-  CSA_ASSERT(this, IntPtrLessThan(index, LoadStringLengthAsWord(string)));
+TNode<Int32T> CodeStubAssembler::StringCharCodeAt(TNode<String> string,
+                                                  TNode<UintPtrT> index) {
+  CSA_ASSERT(this, UintPtrLessThan(index, LoadStringLengthAsWord(string)));
 
   TVARIABLE(Int32T, var_result);
 
@@ -6795,9 +6438,10 @@ TNode<Int32T> CodeStubAssembler::StringCharCodeAt(SloppyTNode<String> string,
 
   ToDirectStringAssembler to_direct(state(), string);
   to_direct.TryToDirect(&if_runtime);
-  TNode<IntPtrT> const offset = IntPtrAdd(index, to_direct.offset());
-  TNode<Int32T> const instance_type = to_direct.instance_type();
-  TNode<RawPtrT> const string_data = to_direct.PointerToData(&if_runtime);
+  const TNode<UintPtrT> offset =
+      UintPtrAdd(index, Unsigned(to_direct.offset()));
+  const TNode<Int32T> instance_type = to_direct.instance_type();
+  const TNode<RawPtrT> string_data = to_direct.PointerToData(&if_runtime);
 
   // Check if the {string} is a TwoByteSeqString or a OneByteSeqString.
   Branch(IsOneByteStringInstanceType(instance_type), &if_stringisonebyte,
@@ -6805,23 +6449,22 @@ TNode<Int32T> CodeStubAssembler::StringCharCodeAt(SloppyTNode<String> string,
 
   BIND(&if_stringisonebyte);
   {
-    var_result =
-        UncheckedCast<Int32T>(Load(MachineType::Uint8(), string_data, offset));
+    var_result = UncheckedCast<Int32T>(Load<Uint8T>(string_data, offset));
     Goto(&return_result);
   }
 
   BIND(&if_stringistwobyte);
   {
-    var_result =
-        UncheckedCast<Int32T>(Load(MachineType::Uint16(), string_data,
-                                   WordShl(offset, IntPtrConstant(1))));
+    var_result = UncheckedCast<Int32T>(
+        Load<Uint16T>(string_data, WordShl(offset, IntPtrConstant(1))));
     Goto(&return_result);
   }
 
   BIND(&if_runtime);
   {
-    TNode<Object> result = CallRuntime(
-        Runtime::kStringCharCodeAt, NoContextConstant(), string, SmiTag(index));
+    TNode<Object> result =
+        CallRuntime(Runtime::kStringCharCodeAt, NoContextConstant(), string,
+                    ChangeUintPtrToTagged(index));
     var_result = SmiToInt32(CAST(result));
     Goto(&return_result);
   }
@@ -6831,7 +6474,7 @@ TNode<Int32T> CodeStubAssembler::StringCharCodeAt(SloppyTNode<String> string,
 }
 
 TNode<String> CodeStubAssembler::StringFromSingleCharCode(TNode<Int32T> code) {
-  VARIABLE(var_result, MachineRepresentation::kTagged);
+  TVARIABLE(String, var_result);
 
   // Check if the {code} is a one-byte char code.
   Label if_codeisonebyte(this), if_codeistwobyte(this, Label::kDeferred),
@@ -6859,14 +6502,14 @@ TNode<String> CodeStubAssembler::StringFromSingleCharCode(TNode<Int32T> code) {
           MachineRepresentation::kWord8, result,
           IntPtrConstant(SeqOneByteString::kHeaderSize - kHeapObjectTag), code);
       StoreFixedArrayElement(cache, code_index, result);
-      var_result.Bind(result);
+      var_result = result;
       Goto(&if_done);
     }
 
     BIND(&if_entryisnotundefined);
     {
       // Return the entry from the {cache}.
-      var_result.Bind(entry);
+      var_result = CAST(entry);
       Goto(&if_done);
     }
   }
@@ -6878,13 +6521,12 @@ TNode<String> CodeStubAssembler::StringFromSingleCharCode(TNode<Int32T> code) {
     StoreNoWriteBarrier(
         MachineRepresentation::kWord16, result,
         IntPtrConstant(SeqTwoByteString::kHeaderSize - kHeapObjectTag), code);
-    var_result.Bind(result);
+    var_result = result;
     Goto(&if_done);
   }
 
   BIND(&if_done);
-  CSA_ASSERT(this, IsString(var_result.value()));
-  return CAST(var_result.value());
+  return var_result.value();
 }
 
 ToDirectStringAssembler::ToDirectStringAssembler(
@@ -6919,7 +6561,7 @@ TNode<String> ToDirectStringAssembler::TryToDirect(Label* if_bailout) {
     };
     STATIC_ASSERT(arraysize(values) == arraysize(labels));
 
-    TNode<Int32T> const representation = Word32And(
+    const TNode<Int32T> representation = Word32And(
         var_instance_type_.value(), Int32Constant(kStringRepresentationMask));
     Switch(representation, if_bailout, values, labels, arraysize(values));
   }
@@ -6928,12 +6570,12 @@ TNode<String> ToDirectStringAssembler::TryToDirect(Label* if_bailout) {
   // Flat cons strings have an empty second part.
   BIND(&if_iscons);
   {
-    TNode<String> const string = var_string_.value();
+    const TNode<String> string = var_string_.value();
     GotoIfNot(IsEmptyString(
                   LoadObjectField<String>(string, ConsString::kSecondOffset)),
               if_bailout);
 
-    TNode<String> const lhs =
+    const TNode<String> lhs =
         LoadObjectField<String>(string, ConsString::kFirstOffset);
     var_string_ = lhs;
     var_instance_type_ = LoadInstanceType(lhs);
@@ -6947,12 +6589,12 @@ TNode<String> ToDirectStringAssembler::TryToDirect(Label* if_bailout) {
     if (!FLAG_string_slices || (flags_ & kDontUnpackSlicedStrings)) {
       Goto(if_bailout);
     } else {
-      TNode<String> const string = var_string_.value();
-      TNode<IntPtrT> const sliced_offset =
+      const TNode<String> string = var_string_.value();
+      const TNode<IntPtrT> sliced_offset =
           LoadAndUntagObjectField(string, SlicedString::kOffsetOffset);
       var_offset_ = IntPtrAdd(var_offset_.value(), sliced_offset);
 
-      TNode<String> const parent =
+      const TNode<String> parent =
           LoadObjectField<String>(string, SlicedString::kParentOffset);
       var_string_ = parent;
       var_instance_type_ = LoadInstanceType(parent);
@@ -6964,10 +6606,10 @@ TNode<String> ToDirectStringAssembler::TryToDirect(Label* if_bailout) {
   // Thin string. Fetch the actual string.
   BIND(&if_isthin);
   {
-    TNode<String> const string = var_string_.value();
-    TNode<String> const actual_string =
+    const TNode<String> string = var_string_.value();
+    const TNode<String> actual_string =
         LoadObjectField<String>(string, ThinString::kActualOffset);
-    TNode<Uint16T> const actual_instance_type = LoadInstanceType(actual_string);
+    const TNode<Uint16T> actual_instance_type = LoadInstanceType(actual_string);
 
     var_string_ = actual_string;
     var_instance_type_ = actual_instance_type;
@@ -7147,22 +6789,21 @@ TNode<String> CodeStubAssembler::NumberToString(TNode<Number> input) {
   return result.value();
 }
 
-Node* CodeStubAssembler::NonNumberToNumberOrNumeric(
-    Node* context, Node* input, Object::Conversion mode,
+TNode<Numeric> CodeStubAssembler::NonNumberToNumberOrNumeric(
+    TNode<Context> context, TNode<HeapObject> input, Object::Conversion mode,
     BigIntHandling bigint_handling) {
-  CSA_ASSERT(this, Word32BinaryNot(TaggedIsSmi(input)));
   CSA_ASSERT(this, Word32BinaryNot(IsHeapNumber(input)));
 
   // We might need to loop once here due to ToPrimitive conversions.
-  VARIABLE(var_input, MachineRepresentation::kTagged, input);
-  VARIABLE(var_result, MachineRepresentation::kTagged);
+  TVARIABLE(HeapObject, var_input, input);
+  TVARIABLE(Numeric, var_result);
   Label loop(this, &var_input);
   Label end(this);
   Goto(&loop);
   BIND(&loop);
   {
     // Load the current {input} value (known to be a HeapObject).
-    Node* input = var_input.value();
+    TNode<HeapObject> input = var_input.value();
 
     // Dispatch on the {input} instance type.
     TNode<Uint16T> input_instance_type = LoadInstanceType(input);
@@ -7180,13 +6821,13 @@ Node* CodeStubAssembler::NonNumberToNumberOrNumeric(
     {
       // The {input} is a String, use the fast stub to convert it to a Number.
       TNode<String> string_input = CAST(input);
-      var_result.Bind(StringToNumber(string_input));
+      var_result = StringToNumber(string_input);
       Goto(&end);
     }
 
     BIND(&if_inputisbigint);
     if (mode == Object::Conversion::kToNumeric) {
-      var_result.Bind(input);
+      var_result = CAST(input);
       Goto(&end);
     } else {
       DCHECK_EQ(mode, Object::Conversion::kToNumber);
@@ -7194,7 +6835,8 @@ Node* CodeStubAssembler::NonNumberToNumberOrNumeric(
         Goto(&if_inputisother);
       } else {
         DCHECK_EQ(bigint_handling, BigIntHandling::kConvertToNumber);
-        var_result.Bind(CallRuntime(Runtime::kBigIntToNumber, context, input));
+        var_result =
+            CAST(CallRuntime(Runtime::kBigIntToNumber, context, input));
         Goto(&end);
       }
     }
@@ -7202,7 +6844,7 @@ Node* CodeStubAssembler::NonNumberToNumberOrNumeric(
     BIND(&if_inputisoddball);
     {
       // The {input} is an Oddball, we just need to load the Number value of it.
-      var_result.Bind(LoadObjectField(input, Oddball::kToNumberOffset));
+      var_result = LoadObjectField<Number>(input, Oddball::kToNumberOffset);
       Goto(&end);
     }
 
@@ -7224,14 +6866,14 @@ Node* CodeStubAssembler::NonNumberToNumberOrNumeric(
       {
         // The ToPrimitive conversion already gave us a Number/Numeric, so we're
         // done.
-        var_result.Bind(result);
+        var_result = CAST(result);
         Goto(&end);
       }
 
       BIND(&if_notdone);
       {
         // We now have a Primitive {result}, but it's not yet a Number/Numeric.
-        var_input.Bind(result);
+        var_input = CAST(result);
         Goto(&loop);
       }
     }
@@ -7247,17 +6889,16 @@ Node* CodeStubAssembler::NonNumberToNumberOrNumeric(
       auto function_id = mode == Object::Conversion::kToNumber
                              ? Runtime::kToNumber
                              : Runtime::kToNumeric;
-      var_result.Bind(CallRuntime(function_id, context, input));
+      var_result = CAST(CallRuntime(function_id, context, input));
       Goto(&end);
     }
   }
 
   BIND(&end);
-  if (mode == Object::Conversion::kToNumeric) {
-    CSA_ASSERT(this, IsNumeric(var_result.value()));
-  } else {
-    DCHECK_EQ(mode, Object::Conversion::kToNumber);
+  if (mode == Object::Conversion::kToNumber) {
     CSA_ASSERT(this, IsNumber(var_result.value()));
+  } else {
+    DCHECK_EQ(mode, Object::Conversion::kToNumeric);
   }
   return var_result.value();
 }
@@ -7271,10 +6912,8 @@ TNode<Number> CodeStubAssembler::NonNumberToNumber(
 
 TNode<Numeric> CodeStubAssembler::NonNumberToNumeric(
     SloppyTNode<Context> context, SloppyTNode<HeapObject> input) {
-  Node* result = NonNumberToNumberOrNumeric(context, input,
-                                            Object::Conversion::kToNumeric);
-  CSA_SLOW_ASSERT(this, IsNumeric(result));
-  return UncheckedCast<Numeric>(result);
+  return NonNumberToNumberOrNumeric(context, input,
+                                    Object::Conversion::kToNumeric);
 }
 
 TNode<Number> CodeStubAssembler::ToNumber_Inline(SloppyTNode<Context> context,
@@ -7334,8 +6973,8 @@ TNode<Number> CodeStubAssembler::ToNumber(SloppyTNode<Context> context,
   return var_result.value();
 }
 
-TNode<BigInt> CodeStubAssembler::ToBigInt(SloppyTNode<Context> context,
-                                          SloppyTNode<Object> input) {
+TNode<BigInt> CodeStubAssembler::ToBigInt(TNode<Context> context,
+                                          TNode<Object> input) {
   TVARIABLE(BigInt, var_result);
   Label if_bigint(this), done(this), if_throw(this);
 
@@ -7355,59 +6994,68 @@ TNode<BigInt> CodeStubAssembler::ToBigInt(SloppyTNode<Context> context,
   return var_result.value();
 }
 
-void CodeStubAssembler::TaggedToNumeric(Node* context, Node* value, Label* done,
-                                        Variable* var_numeric) {
-  TaggedToNumeric(context, value, done, var_numeric, nullptr);
+void CodeStubAssembler::TaggedToNumeric(TNode<Context> context,
+                                        TNode<Object> value,
+                                        TVariable<Numeric>* var_numeric) {
+  TaggedToNumeric(context, value, var_numeric, nullptr);
 }
 
-void CodeStubAssembler::TaggedToNumericWithFeedback(Node* context, Node* value,
-                                                    Label* done,
-                                                    Variable* var_numeric,
-                                                    Variable* var_feedback) {
+void CodeStubAssembler::TaggedToNumericWithFeedback(
+    TNode<Context> context, TNode<Object> value,
+    TVariable<Numeric>* var_numeric, TVariable<Smi>* var_feedback) {
   DCHECK_NOT_NULL(var_feedback);
-  TaggedToNumeric(context, value, done, var_numeric, var_feedback);
+  TaggedToNumeric(context, value, var_numeric, var_feedback);
 }
 
-void CodeStubAssembler::TaggedToNumeric(Node* context, Node* value, Label* done,
-                                        Variable* var_numeric,
-                                        Variable* var_feedback) {
-  var_numeric->Bind(value);
-  Label if_smi(this), if_heapnumber(this), if_bigint(this), if_oddball(this);
+void CodeStubAssembler::TaggedToNumeric(TNode<Context> context,
+                                        TNode<Object> value,
+                                        TVariable<Numeric>* var_numeric,
+                                        TVariable<Smi>* var_feedback) {
+  Label done(this), if_smi(this), if_heapnumber(this), if_bigint(this),
+      if_oddball(this);
   GotoIf(TaggedIsSmi(value), &if_smi);
-  TNode<Map> map = LoadMap(value);
+  TNode<HeapObject> heap_object_value = CAST(value);
+  TNode<Map> map = LoadMap(heap_object_value);
   GotoIf(IsHeapNumberMap(map), &if_heapnumber);
   TNode<Uint16T> instance_type = LoadMapInstanceType(map);
   GotoIf(IsBigIntInstanceType(instance_type), &if_bigint);
 
-  // {value} is not a Numeric yet.
+  // {heap_object_value} is not a Numeric yet.
   GotoIf(Word32Equal(instance_type, Int32Constant(ODDBALL_TYPE)), &if_oddball);
-  var_numeric->Bind(CallBuiltin(Builtins::kNonNumberToNumeric, context, value));
+  *var_numeric = CAST(
+      CallBuiltin(Builtins::kNonNumberToNumeric, context, heap_object_value));
   OverwriteFeedback(var_feedback, BinaryOperationFeedback::kAny);
-  Goto(done);
+  Goto(&done);
 
   BIND(&if_smi);
+  *var_numeric = CAST(value);
   OverwriteFeedback(var_feedback, BinaryOperationFeedback::kSignedSmall);
-  Goto(done);
+  Goto(&done);
 
   BIND(&if_heapnumber);
+  *var_numeric = CAST(value);
   OverwriteFeedback(var_feedback, BinaryOperationFeedback::kNumber);
-  Goto(done);
+  Goto(&done);
 
   BIND(&if_bigint);
+  *var_numeric = CAST(value);
   OverwriteFeedback(var_feedback, BinaryOperationFeedback::kBigInt);
-  Goto(done);
+  Goto(&done);
 
   BIND(&if_oddball);
   OverwriteFeedback(var_feedback, BinaryOperationFeedback::kNumberOrOddball);
-  var_numeric->Bind(LoadObjectField(value, Oddball::kToNumberOffset));
-  Goto(done);
+  *var_numeric =
+      CAST(LoadObjectField(heap_object_value, Oddball::kToNumberOffset));
+  Goto(&done);
+
+  Bind(&done);
 }
 
 // ES#sec-touint32
 TNode<Number> CodeStubAssembler::ToUint32(SloppyTNode<Context> context,
                                           SloppyTNode<Object> input) {
-  TNode<Float64T> const float_zero = Float64Constant(0.0);
-  TNode<Float64T> const float_two_32 =
+  const TNode<Float64T> float_zero = Float64Constant(0.0);
+  const TNode<Float64T> float_two_32 =
       Float64Constant(static_cast<double>(1ULL << 32));
 
   Label out(this);
@@ -7423,7 +7071,7 @@ TNode<Number> CodeStubAssembler::ToUint32(SloppyTNode<Context> context,
     BIND(&next);
   }
 
-  TNode<Number> const number = ToNumber(context, input);
+  const TNode<Number> number = ToNumber(context, input);
   var_result.Bind(number);
 
   // Perhaps we have a positive smi now.
@@ -7438,7 +7086,7 @@ TNode<Number> CodeStubAssembler::ToUint32(SloppyTNode<Context> context,
 
   BIND(&if_isnegativesmi);
   {
-    TNode<Int32T> const uint32_value = SmiToInt32(CAST(number));
+    const TNode<Int32T> uint32_value = SmiToInt32(CAST(number));
     TNode<Float64T> float64_value = ChangeUint32ToFloat64(uint32_value);
     var_result.Bind(AllocateHeapNumberWithValue(float64_value));
     Goto(&out);
@@ -7447,7 +7095,7 @@ TNode<Number> CodeStubAssembler::ToUint32(SloppyTNode<Context> context,
   BIND(&if_isheapnumber);
   {
     Label return_zero(this);
-    TNode<Float64T> const value = LoadHeapNumberValue(CAST(number));
+    const TNode<Float64T> value = LoadHeapNumberValue(CAST(number));
 
     {
       // +-0.
@@ -7466,7 +7114,7 @@ TNode<Number> CodeStubAssembler::ToUint32(SloppyTNode<Context> context,
     {
       // +Infinity.
       Label next(this);
-      TNode<Float64T> const positive_infinity =
+      const TNode<Float64T> positive_infinity =
           Float64Constant(std::numeric_limits<double>::infinity());
       Branch(Float64Equal(value, positive_infinity), &return_zero, &next);
       BIND(&next);
@@ -7475,7 +7123,7 @@ TNode<Number> CodeStubAssembler::ToUint32(SloppyTNode<Context> context,
     {
       // -Infinity.
       Label next(this);
-      TNode<Float64T> const negative_infinity =
+      const TNode<Float64T> negative_infinity =
           Float64Constant(-1.0 * std::numeric_limits<double>::infinity());
       Branch(Float64Equal(value, negative_infinity), &return_zero, &next);
       BIND(&next);
@@ -7491,7 +7139,7 @@ TNode<Number> CodeStubAssembler::ToUint32(SloppyTNode<Context> context,
       x = Float64Add(x, float_two_32);
       x = Float64Mod(x, float_two_32);
 
-      TNode<Number> const result = ChangeFloat64ToTagged(x);
+      const TNode<Number> result = ChangeFloat64ToTagged(x);
       var_result.Bind(result);
       Goto(&out);
     }
@@ -7552,76 +7200,6 @@ TNode<JSReceiver> CodeStubAssembler::ToObject_Inline(TNode<Context> context,
   return result.value();
 }
 
-TNode<Smi> CodeStubAssembler::ToSmiIndex(TNode<Context> context,
-                                         TNode<Object> input,
-                                         Label* range_error) {
-  TVARIABLE(Smi, result);
-  Label check_undefined(this), return_zero(this), defined(this),
-      negative_check(this), done(this);
-
-  GotoIfNot(TaggedIsSmi(input), &check_undefined);
-  result = CAST(input);
-  Goto(&negative_check);
-
-  BIND(&check_undefined);
-  Branch(IsUndefined(input), &return_zero, &defined);
-
-  BIND(&defined);
-  TNode<Number> integer_input =
-      CAST(CallBuiltin(Builtins::kToInteger_TruncateMinusZero, context, input));
-  GotoIfNot(TaggedIsSmi(integer_input), range_error);
-  result = CAST(integer_input);
-  Goto(&negative_check);
-
-  BIND(&negative_check);
-  Branch(SmiLessThan(result.value(), SmiConstant(0)), range_error, &done);
-
-  BIND(&return_zero);
-  result = SmiConstant(0);
-  Goto(&done);
-
-  BIND(&done);
-  return result.value();
-}
-
-TNode<Smi> CodeStubAssembler::ToSmiLength(TNode<Context> context,
-                                          TNode<Object> input,
-                                          Label* range_error) {
-  TVARIABLE(Smi, result);
-  Label to_integer(this), negative_check(this),
-      heap_number_negative_check(this), return_zero(this), done(this);
-
-  GotoIfNot(TaggedIsSmi(input), &to_integer);
-  result = CAST(input);
-  Goto(&negative_check);
-
-  BIND(&to_integer);
-  {
-    TNode<Number> integer_input = CAST(
-        CallBuiltin(Builtins::kToInteger_TruncateMinusZero, context, input));
-    GotoIfNot(TaggedIsSmi(integer_input), &heap_number_negative_check);
-    result = CAST(integer_input);
-    Goto(&negative_check);
-
-    // integer_input can still be a negative HeapNumber here.
-    BIND(&heap_number_negative_check);
-    TNode<HeapNumber> heap_number_input = CAST(integer_input);
-    Branch(IsTrue(CallBuiltin(Builtins::kLessThan, context, heap_number_input,
-                              SmiConstant(0))),
-           &return_zero, range_error);
-  }
-
-  BIND(&negative_check);
-  Branch(SmiLessThan(result.value(), SmiConstant(0)), &return_zero, &done);
-
-  BIND(&return_zero);
-  result = SmiConstant(0);
-  Goto(&done);
-
-  BIND(&done);
-  return result.value();
-}
-
 TNode<Number> CodeStubAssembler::ToLength_Inline(SloppyTNode<Context> context,
                                                  SloppyTNode<Object> input) {
   TNode<Smi> smi_zero = SmiConstant(0);
@@ -7708,24 +7286,38 @@ TNode<Number> CodeStubAssembler::ToInteger(SloppyTNode<Context> context,
 
 TNode<Uint32T> CodeStubAssembler::DecodeWord32(SloppyTNode<Word32T> word32,
                                                uint32_t shift, uint32_t mask) {
-  return UncheckedCast<Uint32T>(Word32Shr(
-      Word32And(word32, Int32Constant(mask)), static_cast<int>(shift)));
+  DCHECK_EQ((mask >> shift) << shift, mask);
+  return Unsigned(Word32And(Word32Shr(word32, static_cast<int>(shift)),
+                            Int32Constant(mask >> shift)));
 }
 
 TNode<UintPtrT> CodeStubAssembler::DecodeWord(SloppyTNode<WordT> word,
                                               uint32_t shift, uint32_t mask) {
-  return Unsigned(
-      WordShr(WordAnd(word, IntPtrConstant(mask)), static_cast<int>(shift)));
+  DCHECK_EQ((mask >> shift) << shift, mask);
+  return Unsigned(WordAnd(WordShr(word, static_cast<int>(shift)),
+                          IntPtrConstant(mask >> shift)));
+}
+
+TNode<Word32T> CodeStubAssembler::UpdateWord32(TNode<Word32T> word,
+                                               TNode<Uint32T> value,
+                                               uint32_t shift, uint32_t mask) {
+  DCHECK_EQ((mask >> shift) << shift, mask);
+  // Ensure the {value} fits fully in the mask.
+  CSA_ASSERT(this, Uint32LessThanOrEqual(value, Uint32Constant(mask >> shift)));
+  TNode<Word32T> encoded_value = Word32Shl(value, Int32Constant(shift));
+  TNode<Word32T> inverted_mask = Int32Constant(~mask);
+  return Word32Or(Word32And(word, inverted_mask), encoded_value);
 }
 
 TNode<WordT> CodeStubAssembler::UpdateWord(TNode<WordT> word,
-                                           TNode<WordT> value, uint32_t shift,
-                                           uint32_t mask) {
+                                           TNode<UintPtrT> value,
+                                           uint32_t shift, uint32_t mask) {
+  DCHECK_EQ((mask >> shift) << shift, mask);
+  // Ensure the {value} fits fully in the mask.
+  CSA_ASSERT(this,
+             UintPtrLessThanOrEqual(value, UintPtrConstant(mask >> shift)));
   TNode<WordT> encoded_value = WordShl(value, static_cast<int>(shift));
   TNode<IntPtrT> inverted_mask = IntPtrConstant(~static_cast<intptr_t>(mask));
-  // Ensure the {value} fits fully in the mask.
-  CSA_ASSERT(this, WordEqual(WordAnd(encoded_value, inverted_mask),
-                             IntPtrConstant(0)));
   return WordOr(WordAnd(word, inverted_mask), encoded_value);
 }
 
@@ -7746,7 +7338,7 @@ void CodeStubAssembler::IncrementCounter(StatsCounter* counter, int delta) {
     // This operation has to be exactly 32-bit wide in case the external
     // reference table redirects the counter to a uint32_t dummy_stats_counter_
     // field.
-    Node* value = Load(MachineType::Int32(), counter_address);
+    TNode<Int32T> value = Load<Int32T>(counter_address);
     value = Int32Add(value, Int32Constant(delta));
     StoreNoWriteBarrier(MachineRepresentation::kWord32, counter_address, value);
   }
@@ -7760,7 +7352,7 @@ void CodeStubAssembler::DecrementCounter(StatsCounter* counter, int delta) {
     // This operation has to be exactly 32-bit wide in case the external
     // reference table redirects the counter to a uint32_t dummy_stats_counter_
     // field.
-    Node* value = Load(MachineType::Int32(), counter_address);
+    TNode<Int32T> value = Load<Int32T>(counter_address);
     value = Int32Sub(value, Int32Constant(delta));
     StoreNoWriteBarrier(MachineRepresentation::kWord32, counter_address, value);
   }
@@ -7793,24 +7385,23 @@ void CodeStubAssembler::TryToName(SloppyTNode<Object> key, Label* if_keyisindex,
                                   Label* if_notinternalized) {
   Comment("TryToName");
 
+  TVARIABLE(Int32T, var_instance_type);
   Label if_keyisnotindex(this);
-  // Handle Smi and HeapNumber keys.
-  *var_index = TryToIntptr(key, &if_keyisnotindex);
+  *var_index = TryToIntptr(key, &if_keyisnotindex, &var_instance_type);
   Goto(if_keyisindex);
 
   BIND(&if_keyisnotindex);
   {
     Label if_symbol(this), if_string(this),
         if_keyisother(this, Label::kDeferred);
-    TNode<HeapObject> key_heap_object = CAST(key);
-    TNode<Map> key_map = LoadMap(key_heap_object);
 
-    GotoIf(IsSymbolMap(key_map), &if_symbol);
+    // Symbols are unique.
+    GotoIf(IsSymbolInstanceType(var_instance_type.value()), &if_symbol);
 
     // Miss if |key| is not a String.
     STATIC_ASSERT(FIRST_NAME_TYPE == FIRST_TYPE);
-    TNode<Uint16T> key_instance_type = LoadMapInstanceType(key_map);
-    Branch(IsStringInstanceType(key_instance_type), &if_string, &if_keyisother);
+    Branch(IsStringInstanceType(var_instance_type.value()), &if_string,
+           &if_keyisother);
 
     // Symbols are unique.
     BIND(&if_symbol);
@@ -7821,45 +7412,51 @@ void CodeStubAssembler::TryToName(SloppyTNode<Object> key, Label* if_keyisindex,
 
     BIND(&if_string);
     {
-      Label if_hascachedindex(this), if_thinstring(this);
+      Label if_thinstring(this), if_has_cached_index(this);
 
-      // |key| is a String. Check if it has a cached array index.
-      TNode<String> key_string = CAST(key);
-      TNode<Uint32T> hash = LoadNameHashField(key_string);
+      TNode<Uint32T> hash = LoadNameHashField(CAST(key));
       GotoIf(IsClearWord32(hash, Name::kDoesNotContainCachedArrayIndexMask),
-             &if_hascachedindex);
+             &if_has_cached_index);
       // No cached array index. If the string knows that it contains an index,
       // then it must be an uncacheable index. Handle this case in the runtime.
       GotoIf(IsClearWord32(hash, Name::kIsNotArrayIndexMask), if_bailout);
-      // Check if we have a ThinString.
-      GotoIf(InstanceTypeEqual(key_instance_type, THIN_STRING_TYPE),
+
+      GotoIf(InstanceTypeEqual(var_instance_type.value(), THIN_STRING_TYPE),
              &if_thinstring);
-      GotoIf(InstanceTypeEqual(key_instance_type, THIN_ONE_BYTE_STRING_TYPE),
+      GotoIf(InstanceTypeEqual(var_instance_type.value(),
+                               THIN_ONE_BYTE_STRING_TYPE),
              &if_thinstring);
       // Finally, check if |key| is internalized.
       STATIC_ASSERT(kNotInternalizedTag != 0);
-      GotoIf(IsSetWord32(key_instance_type, kIsNotInternalizedMask),
+      GotoIf(IsSetWord32(var_instance_type.value(), kIsNotInternalizedMask),
              if_notinternalized != nullptr ? if_notinternalized : if_bailout);
 
-      *var_unique = key_string;
+      *var_unique = CAST(key);
       Goto(if_keyisunique);
 
       BIND(&if_thinstring);
-      *var_unique =
-          LoadObjectField<String>(key_string, ThinString::kActualOffset);
-      Goto(if_keyisunique);
+      {
+        *var_unique =
+            LoadObjectField<String>(CAST(key), ThinString::kActualOffset);
+        Goto(if_keyisunique);
+      }
 
-      BIND(&if_hascachedindex);
-      *var_index =
-          Signed(DecodeWordFromWord32<Name::ArrayIndexValueBits>(hash));
-      Goto(if_keyisindex);
+      BIND(&if_has_cached_index);
+      {
+        TNode<IntPtrT> index =
+            Signed(DecodeWordFromWord32<String::ArrayIndexValueBits>(hash));
+        CSA_ASSERT(this, IntPtrLessThan(index, IntPtrConstant(INT_MAX)));
+        *var_index = index;
+        Goto(if_keyisindex);
+      }
     }
 
     BIND(&if_keyisother);
     {
-      GotoIfNot(InstanceTypeEqual(key_instance_type, ODDBALL_TYPE), if_bailout);
+      GotoIfNot(InstanceTypeEqual(var_instance_type.value(), ODDBALL_TYPE),
+                if_bailout);
       *var_unique =
-          LoadObjectField<String>(key_heap_object, Oddball::kToStringOffset);
+          LoadObjectField<String>(CAST(key), Oddball::kToStringOffset);
       Goto(if_keyisunique);
     }
   }
@@ -7871,7 +7468,7 @@ void CodeStubAssembler::TryInternalizeString(
     Label* if_not_internalized, Label* if_bailout) {
   TNode<ExternalReference> function =
       ExternalConstant(ExternalReference::try_internalize_string_function());
-  TNode<ExternalReference> const isolate_ptr =
+  const TNode<ExternalReference> isolate_ptr =
       ExternalConstant(ExternalReference::isolate_address(isolate()));
   TNode<Object> result =
       CAST(CallCFunction(function, MachineType::AnyTagged(),
@@ -7987,12 +7584,12 @@ TNode<MaybeObject> CodeStubAssembler::LoadFieldTypeByDescriptorEntry(
       DescriptorArray::ToValueIndex(0) * kTaggedSize);
 }
 
-template TNode<IntPtrT> CodeStubAssembler::EntryToIndex<NameDictionary>(
-    TNode<IntPtrT>, int);
-template TNode<IntPtrT> CodeStubAssembler::EntryToIndex<GlobalDictionary>(
-    TNode<IntPtrT>, int);
-template TNode<IntPtrT> CodeStubAssembler::EntryToIndex<NumberDictionary>(
-    TNode<IntPtrT>, int);
+template V8_EXPORT_PRIVATE TNode<IntPtrT>
+CodeStubAssembler::EntryToIndex<NameDictionary>(TNode<IntPtrT>, int);
+template V8_EXPORT_PRIVATE TNode<IntPtrT>
+CodeStubAssembler::EntryToIndex<GlobalDictionary>(TNode<IntPtrT>, int);
+template V8_EXPORT_PRIVATE TNode<IntPtrT>
+CodeStubAssembler::EntryToIndex<NumberDictionary>(TNode<IntPtrT>, int);
 
 // This must be kept in sync with HashTableBase::ComputeCapacity().
 TNode<IntPtrT> CodeStubAssembler::HashTableComputeCapacity(
@@ -8026,6 +7623,19 @@ TNode<IntPtrT> CodeStubAssembler::IntPtrMin(SloppyTNode<IntPtrT> left,
                                  right);
 }
 
+TNode<UintPtrT> CodeStubAssembler::UintPtrMin(TNode<UintPtrT> left,
+                                              TNode<UintPtrT> right) {
+  intptr_t left_constant;
+  intptr_t right_constant;
+  if (ToIntPtrConstant(left, &left_constant) &&
+      ToIntPtrConstant(right, &right_constant)) {
+    return UintPtrConstant(std::min(static_cast<uintptr_t>(left_constant),
+                                    static_cast<uintptr_t>(right_constant)));
+  }
+  return SelectConstant<UintPtrT>(UintPtrLessThanOrEqual(left, right), left,
+                                  right);
+}
+
 template <>
 TNode<HeapObject> CodeStubAssembler::LoadName<NameDictionary>(
     TNode<HeapObject> key) {
@@ -8106,32 +7716,19 @@ template V8_EXPORT_PRIVATE void CodeStubAssembler::NameDictionaryLookup<
     GlobalDictionary>(TNode<GlobalDictionary>, TNode<Name>, Label*,
                       TVariable<IntPtrT>*, Label*, LookupMode);
 
-Node* CodeStubAssembler::ComputeUnseededHash(Node* key) {
-  // See v8::internal::ComputeUnseededHash()
-  TNode<Word32T> hash = TruncateIntPtrToInt32(key);
-  hash = Int32Add(Word32Xor(hash, Int32Constant(0xFFFFFFFF)),
-                  Word32Shl(hash, Int32Constant(15)));
-  hash = Word32Xor(hash, Word32Shr(hash, Int32Constant(12)));
-  hash = Int32Add(hash, Word32Shl(hash, Int32Constant(2)));
-  hash = Word32Xor(hash, Word32Shr(hash, Int32Constant(4)));
-  hash = Int32Mul(hash, Int32Constant(2057));
-  hash = Word32Xor(hash, Word32Shr(hash, Int32Constant(16)));
-  return Word32And(hash, Int32Constant(0x3FFFFFFF));
-}
-
-Node* CodeStubAssembler::ComputeSeededHash(Node* key) {
-  TNode<ExternalReference> const function_addr =
+TNode<Word32T> CodeStubAssembler::ComputeSeededHash(TNode<IntPtrT> key) {
+  const TNode<ExternalReference> function_addr =
       ExternalConstant(ExternalReference::compute_integer_hash());
-  TNode<ExternalReference> const isolate_ptr =
+  const TNode<ExternalReference> isolate_ptr =
       ExternalConstant(ExternalReference::isolate_address(isolate()));
 
   MachineType type_ptr = MachineType::Pointer();
   MachineType type_uint32 = MachineType::Uint32();
+  MachineType type_int32 = MachineType::Int32();
 
-  Node* const result = CallCFunction(
+  return UncheckedCast<Word32T>(CallCFunction(
       function_addr, type_uint32, std::make_pair(type_ptr, isolate_ptr),
-      std::make_pair(type_uint32, TruncateIntPtrToInt32(key)));
-  return result;
+      std::make_pair(type_int32, TruncateIntPtrToInt32(key))));
 }
 
 void CodeStubAssembler::NumberDictionaryLookup(
@@ -8206,13 +7803,12 @@ TNode<Object> CodeStubAssembler::BasicLoadNumberDictionaryElement(
 
   // Check that the value is a data property.
   TNode<IntPtrT> index = EntryToIndex<NumberDictionary>(var_entry.value());
-  TNode<Uint32T> details =
-      LoadDetailsByKeyIndex<NumberDictionary>(dictionary, index);
+  TNode<Uint32T> details = LoadDetailsByKeyIndex(dictionary, index);
   TNode<Uint32T> kind = DecodeWord32<PropertyDetails::KindField>(details);
   // TODO(jkummerow): Support accessors without missing?
   GotoIfNot(Word32Equal(kind, Int32Constant(kData)), not_data);
   // Finally, load the value.
-  return LoadValueByKeyIndex<NumberDictionary>(dictionary, index);
+  return LoadValueByKeyIndex(dictionary, index);
 }
 
 template <class Dictionary>
@@ -8509,7 +8105,7 @@ void CodeStubAssembler::ForEachEnumerableOwnProperty(
 
   TVARIABLE(DescriptorArray, var_descriptors, LoadMapDescriptors(map));
   TNode<Uint32T> nof_descriptors =
-      DecodeWord32<Map::NumberOfOwnDescriptorsBits>(bit_field3);
+      DecodeWord32<Map::Bits3::NumberOfOwnDescriptorsBits>(bit_field3);
 
   TVARIABLE(BoolT, var_stable, Int32TrueConstant());
 
@@ -8629,8 +8225,7 @@ void CodeStubAssembler::ForEachEnumerableOwnProperty(
             TNode<NameDictionary> dictionary = CAST(var_meta_storage.value());
             TNode<IntPtrT> entry = var_entry.value();
 
-            TNode<Uint32T> details =
-                LoadDetailsByKeyIndex<NameDictionary>(dictionary, entry);
+            TNode<Uint32T> details = LoadDetailsByKeyIndex(dictionary, entry);
             // Skip non-enumerable properties.
             GotoIf(
                 IsSetWord32(details, PropertyDetails::kAttributesDontEnumMask),
@@ -8699,8 +8294,9 @@ TNode<Object> CodeStubAssembler::GetConstructor(TNode<Map> map) {
 
   BIND(&loop);
   {
-    var_maybe_constructor = CAST(LoadObjectField(
-        var_maybe_constructor.value(), Map::kConstructorOrBackPointerOffset));
+    var_maybe_constructor = CAST(
+        LoadObjectField(var_maybe_constructor.value(),
+                        Map::kConstructorOrBackPointerOrNativeContextOffset));
     GotoIf(IsMap(var_maybe_constructor.value()), &loop);
     Goto(&done);
   }
@@ -8755,7 +8351,8 @@ void CodeStubAssembler::DescriptorLookup(
     SloppyTNode<Uint32T> bitfield3, Label* if_found,
     TVariable<IntPtrT>* var_name_index, Label* if_not_found) {
   Comment("DescriptorArrayLookup");
-  TNode<Uint32T> nof = DecodeWord32<Map::NumberOfOwnDescriptorsBits>(bitfield3);
+  TNode<Uint32T> nof =
+      DecodeWord32<Map::Bits3::NumberOfOwnDescriptorsBits>(bitfield3);
   Lookup<DescriptorArray>(unique_name, descriptors, nof, if_found,
                           var_name_index, if_not_found);
 }
@@ -8799,8 +8396,8 @@ void CodeStubAssembler::Lookup(TNode<Name> unique_name, TNode<Array> array,
 }
 
 TNode<BoolT> CodeStubAssembler::IsSimpleObjectMap(TNode<Map> map) {
-  uint32_t mask =
-      Map::HasNamedInterceptorBit::kMask | Map::IsAccessCheckNeededBit::kMask;
+  uint32_t mask = Map::Bits1::HasNamedInterceptorBit::kMask |
+                  Map::Bits1::IsAccessCheckNeededBit::kMask;
   // !IsSpecialReceiverType && !IsNamedInterceptor && !IsAccessCheckNeeded
   return Select<BoolT>(
       IsSpecialReceiverInstanceType(LoadMapInstanceType(map)),
@@ -8818,7 +8415,7 @@ void CodeStubAssembler::TryLookupPropertyInSimpleObject(
 
   TNode<Uint32T> bit_field3 = LoadMapBitField3(map);
   Label if_isfastmap(this), if_isslowmap(this);
-  Branch(IsSetWord32<Map::IsDictionaryMapBit>(bit_field3), &if_isslowmap,
+  Branch(IsSetWord32<Map::Bits3::IsDictionaryMapBit>(bit_field3), &if_isslowmap,
          &if_isfastmap);
   BIND(&if_isfastmap);
   {
@@ -8859,8 +8456,8 @@ void CodeStubAssembler::TryLookupProperty(
 
     // Handle interceptors and access checks in runtime.
     TNode<Int32T> bit_field = LoadMapBitField(map);
-    int mask =
-        Map::HasNamedInterceptorBit::kMask | Map::IsAccessCheckNeededBit::kMask;
+    int mask = Map::Bits1::HasNamedInterceptorBit::kMask |
+               Map::Bits1::IsAccessCheckNeededBit::kMask;
     GotoIf(IsSetWord32(bit_field, mask), if_bailout);
 
     TNode<GlobalDictionary> dictionary = CAST(LoadSlowProperties(object));
@@ -8888,19 +8485,20 @@ void CodeStubAssembler::TryHasOwnProperty(Node* object, Node* map,
 
   BIND(&if_found_global);
   {
-    VARIABLE(var_value, MachineRepresentation::kTagged);
-    VARIABLE(var_details, MachineRepresentation::kWord32);
+    TVARIABLE(Object, var_value);
+    TVARIABLE(Uint32T, var_details);
     // Check if the property cell is not deleted.
-    LoadPropertyFromGlobalDictionary(var_meta_storage.value(),
-                                     var_name_index.value(), &var_value,
-                                     &var_details, if_not_found);
+    LoadPropertyFromGlobalDictionary(CAST(var_meta_storage.value()),
+                                     var_name_index.value(), &var_details,
+                                     &var_value, if_not_found);
     Goto(if_found);
   }
 }
 
-Node* CodeStubAssembler::GetMethod(Node* context, Node* object,
-                                   Handle<Name> name,
-                                   Label* if_null_or_undefined) {
+TNode<Object> CodeStubAssembler::GetMethod(TNode<Context> context,
+                                           TNode<Object> object,
+                                           Handle<Name> name,
+                                           Label* if_null_or_undefined) {
   TNode<Object> method = GetProperty(context, object, name);
 
   GotoIf(IsUndefined(method), if_null_or_undefined);
@@ -8912,28 +8510,25 @@ Node* CodeStubAssembler::GetMethod(Node* context, Node* object,
 TNode<Object> CodeStubAssembler::GetIteratorMethod(
     TNode<Context> context, TNode<HeapObject> heap_obj,
     Label* if_iteratorundefined) {
-  return CAST(GetMethod(context, heap_obj,
-                        isolate()->factory()->iterator_symbol(),
-                        if_iteratorundefined));
+  return GetMethod(context, heap_obj, isolate()->factory()->iterator_symbol(),
+                   if_iteratorundefined);
 }
 
 void CodeStubAssembler::LoadPropertyFromFastObject(
-    Node* object, Node* map, TNode<DescriptorArray> descriptors,
-    Node* name_index, Variable* var_details, Variable* var_value) {
-  DCHECK_EQ(MachineRepresentation::kWord32, var_details->rep());
-  DCHECK_EQ(MachineRepresentation::kTagged, var_value->rep());
-
-  TNode<Uint32T> details =
-      LoadDetailsByKeyIndex(descriptors, UncheckedCast<IntPtrT>(name_index));
-  var_details->Bind(details);
+    TNode<HeapObject> object, TNode<Map> map,
+    TNode<DescriptorArray> descriptors, TNode<IntPtrT> name_index,
+    TVariable<Uint32T>* var_details, TVariable<Object>* var_value) {
+  TNode<Uint32T> details = LoadDetailsByKeyIndex(descriptors, name_index);
+  *var_details = details;
 
   LoadPropertyFromFastObject(object, map, descriptors, name_index, details,
                              var_value);
 }
 
 void CodeStubAssembler::LoadPropertyFromFastObject(
-    Node* object, Node* map, TNode<DescriptorArray> descriptors,
-    Node* name_index, Node* details, Variable* var_value) {
+    TNode<HeapObject> object, TNode<Map> map,
+    TNode<DescriptorArray> descriptors, TNode<IntPtrT> name_index,
+    TNode<Uint32T> details, TVariable<Object>* var_value) {
   Comment("[ LoadPropertyFromFastObject");
 
   TNode<Uint32T> location =
@@ -8954,7 +8549,7 @@ void CodeStubAssembler::LoadPropertyFromFastObject(
     TNode<IntPtrT> instance_size_in_words = LoadMapInstanceSizeInWords(map);
 
     Label if_inobject(this), if_backing_store(this);
-    VARIABLE(var_double_value, MachineRepresentation::kFloat64);
+    TVARIABLE(Float64T, var_double_value);
     Label rebox_double(this, &var_double_value);
     Branch(UintPtrLessThan(field_index, instance_size_in_words), &if_inobject,
            &if_backing_store);
@@ -8969,18 +8564,17 @@ void CodeStubAssembler::LoadPropertyFromFastObject(
              &if_tagged, &if_double);
       BIND(&if_tagged);
       {
-        var_value->Bind(LoadObjectField(object, field_offset));
+        *var_value = LoadObjectField(object, field_offset);
         Goto(&done);
       }
       BIND(&if_double);
       {
         if (FLAG_unbox_double_fields) {
-          var_double_value.Bind(
-              LoadObjectField(object, field_offset, MachineType::Float64()));
+          var_double_value = LoadObjectField<Float64T>(object, field_offset);
         } else {
           TNode<HeapNumber> heap_number =
               CAST(LoadObjectField(object, field_offset));
-          var_double_value.Bind(LoadHeapNumberValue(heap_number));
+          var_double_value = LoadHeapNumberValue(heap_number);
         }
         Goto(&rebox_double);
       }
@@ -8988,7 +8582,7 @@ void CodeStubAssembler::LoadPropertyFromFastObject(
     BIND(&if_backing_store);
     {
       Comment("if_backing_store");
-      TNode<HeapObject> properties = LoadFastProperties(object);
+      TNode<HeapObject> properties = LoadFastProperties(CAST(object));
       field_index = Signed(IntPtrSub(field_index, instance_size_in_words));
       TNode<Object> value =
           LoadPropertyArrayElement(CAST(properties), field_index);
@@ -8999,12 +8593,12 @@ void CodeStubAssembler::LoadPropertyFromFastObject(
              &if_tagged, &if_double);
       BIND(&if_tagged);
       {
-        var_value->Bind(value);
+        *var_value = value;
         Goto(&done);
       }
       BIND(&if_double);
       {
-        var_double_value.Bind(LoadHeapNumberValue(CAST(value)));
+        var_double_value = LoadHeapNumberValue(CAST(value));
         Goto(&rebox_double);
       }
     }
@@ -9013,14 +8607,13 @@ void CodeStubAssembler::LoadPropertyFromFastObject(
       Comment("rebox_double");
       TNode<HeapNumber> heap_number =
           AllocateHeapNumberWithValue(var_double_value.value());
-      var_value->Bind(heap_number);
+      *var_value = heap_number;
       Goto(&done);
     }
   }
   BIND(&if_in_descriptor);
   {
-    var_value->Bind(
-        LoadValueByKeyIndex(descriptors, UncheckedCast<IntPtrT>(name_index)));
+    *var_value = LoadValueByKeyIndex(descriptors, name_index);
     Goto(&done);
   }
   BIND(&done);
@@ -9028,40 +8621,33 @@ void CodeStubAssembler::LoadPropertyFromFastObject(
   Comment("] LoadPropertyFromFastObject");
 }
 
-void CodeStubAssembler::LoadPropertyFromNameDictionary(Node* dictionary,
-                                                       Node* name_index,
-                                                       Variable* var_details,
-                                                       Variable* var_value) {
+void CodeStubAssembler::LoadPropertyFromNameDictionary(
+    TNode<NameDictionary> dictionary, TNode<IntPtrT> name_index,
+    TVariable<Uint32T>* var_details, TVariable<Object>* var_value) {
   Comment("LoadPropertyFromNameDictionary");
-  CSA_ASSERT(this, IsNameDictionary(dictionary));
-
-  var_details->Bind(
-      LoadDetailsByKeyIndex<NameDictionary>(dictionary, name_index));
-  var_value->Bind(LoadValueByKeyIndex<NameDictionary>(dictionary, name_index));
+  *var_details = LoadDetailsByKeyIndex(dictionary, name_index);
+  *var_value = LoadValueByKeyIndex(dictionary, name_index);
 
   Comment("] LoadPropertyFromNameDictionary");
 }
 
-void CodeStubAssembler::LoadPropertyFromGlobalDictionary(Node* dictionary,
-                                                         Node* name_index,
-                                                         Variable* var_details,
-                                                         Variable* var_value,
-                                                         Label* if_deleted) {
+void CodeStubAssembler::LoadPropertyFromGlobalDictionary(
+    TNode<GlobalDictionary> dictionary, TNode<IntPtrT> name_index,
+    TVariable<Uint32T>* var_details, TVariable<Object>* var_value,
+    Label* if_deleted) {
   Comment("[ LoadPropertyFromGlobalDictionary");
-  CSA_ASSERT(this, IsGlobalDictionary(dictionary));
-
   TNode<PropertyCell> property_cell =
-      CAST(LoadFixedArrayElement(CAST(dictionary), name_index));
+      CAST(LoadFixedArrayElement(dictionary, name_index));
 
   TNode<Object> value =
       LoadObjectField(property_cell, PropertyCell::kValueOffset);
   GotoIf(TaggedEqual(value, TheHoleConstant()), if_deleted);
 
-  var_value->Bind(value);
+  *var_value = value;
 
-  TNode<Int32T> details = LoadAndUntagToWord32ObjectField(
-      property_cell, PropertyCell::kPropertyDetailsRawOffset);
-  var_details->Bind(details);
+  TNode<Uint32T> details = Unsigned(LoadAndUntagToWord32ObjectField(
+      property_cell, PropertyCell::kPropertyDetailsRawOffset));
+  *var_details = details;
 
   Comment("] LoadPropertyFromGlobalDictionary");
 }
@@ -9070,16 +8656,16 @@ void CodeStubAssembler::LoadPropertyFromGlobalDictionary(Node* dictionary,
 // or an accessor pair, as specified by |details|.
 // Returns either the original value, or the result of the getter call.
 TNode<Object> CodeStubAssembler::CallGetterIfAccessor(
-    Node* value, Node* details, Node* context, Node* receiver,
-    Label* if_bailout, GetOwnPropertyMode mode) {
-  VARIABLE(var_value, MachineRepresentation::kTagged, value);
+    TNode<Object> value, TNode<Uint32T> details, TNode<Context> context,
+    TNode<Object> receiver, Label* if_bailout, GetOwnPropertyMode mode) {
+  TVARIABLE(Object, var_value, value);
   Label done(this), if_accessor_info(this, Label::kDeferred);
 
   TNode<Uint32T> kind = DecodeWord32<PropertyDetails::KindField>(details);
   GotoIf(Word32Equal(kind, Int32Constant(kData)), &done);
 
   // Accessor case.
-  GotoIfNot(IsAccessorPair(value), &if_accessor_info);
+  GotoIfNot(IsAccessorPair(CAST(value)), &if_accessor_info);
 
   // AccessorPair case.
   {
@@ -9094,15 +8680,14 @@ TNode<Object> CodeStubAssembler::CallGetterIfAccessor(
       GotoIf(IsFunctionTemplateInfoMap(getter_map), &if_function_template_info);
 
       // Return undefined if the {getter} is not callable.
-      var_value.Bind(UndefinedConstant());
+      var_value = UndefinedConstant();
       Goto(&done);
 
       BIND(&if_callable);
       {
         // Call the accessor.
         Callable callable = CodeFactory::Call(isolate());
-        Node* result = CallJS(callable, context, getter, receiver);
-        var_value.Bind(result);
+        var_value = CallJS(callable, context, getter, receiver);
         Goto(&done);
       }
 
@@ -9114,9 +8699,9 @@ TNode<Object> CodeStubAssembler::CallGetterIfAccessor(
 
         TNode<NativeContext> creation_context =
             GetCreationContext(CAST(receiver), if_bailout);
-        var_value.Bind(CallBuiltin(
+        var_value = CallBuiltin(
             Builtins::kCallFunctionTemplate_CheckAccessAndCompatibleReceiver,
-            creation_context, getter, IntPtrConstant(0), receiver));
+            creation_context, getter, IntPtrConstant(0), receiver);
         Goto(&done);
       }
     } else {
@@ -9127,13 +8712,12 @@ TNode<Object> CodeStubAssembler::CallGetterIfAccessor(
   // AccessorInfo case.
   BIND(&if_accessor_info);
   {
-    Node* accessor_info = value;
-    CSA_ASSERT(this, IsAccessorInfo(value));
     CSA_ASSERT(this, TaggedIsNotSmi(receiver));
+    TNode<AccessorInfo> accessor_info = CAST(value);
     Label if_array(this), if_function(this), if_wrapper(this);
 
     // Dispatch based on {receiver} instance type.
-    TNode<Map> receiver_map = LoadMap(receiver);
+    TNode<Map> receiver_map = LoadMap(CAST(receiver));
     TNode<Uint16T> receiver_instance_type = LoadMapInstanceType(receiver_map);
     GotoIf(IsJSArrayInstanceType(receiver_instance_type), &if_array);
     GotoIf(IsJSFunctionInstanceType(receiver_instance_type), &if_function);
@@ -9147,7 +8731,8 @@ TNode<Object> CodeStubAssembler::CallGetterIfAccessor(
       GotoIfNot(IsLengthString(
                     LoadObjectField(accessor_info, AccessorInfo::kNameOffset)),
                 if_bailout);
-      var_value.Bind(LoadJSArrayLength(receiver));
+      TNode<JSArray> array = CAST(receiver);
+      var_value = LoadJSArrayLength(array);
       Goto(&done);
     }
 
@@ -9161,7 +8746,7 @@ TNode<Object> CodeStubAssembler::CallGetterIfAccessor(
 
       GotoIfPrototypeRequiresRuntimeLookup(CAST(receiver), receiver_map,
                                            if_bailout);
-      var_value.Bind(LoadJSFunctionPrototype(CAST(receiver), if_bailout));
+      var_value = LoadJSFunctionPrototype(CAST(receiver), if_bailout);
       Goto(&done);
     }
 
@@ -9177,39 +8762,41 @@ TNode<Object> CodeStubAssembler::CallGetterIfAccessor(
           LoadJSPrimitiveWrapperValue(CAST(receiver));
       GotoIfNot(TaggedIsNotSmi(receiver_value), if_bailout);
       GotoIfNot(IsString(CAST(receiver_value)), if_bailout);
-      var_value.Bind(LoadStringLengthAsSmi(CAST(receiver_value)));
+      var_value = LoadStringLengthAsSmi(CAST(receiver_value));
       Goto(&done);
     }
   }
 
   BIND(&done);
-  return UncheckedCast<Object>(var_value.value());
+  return var_value.value();
 }
 
 void CodeStubAssembler::TryGetOwnProperty(
-    Node* context, Node* receiver, Node* object, Node* map, Node* instance_type,
-    Node* unique_name, Label* if_found_value, Variable* var_value,
-    Label* if_not_found, Label* if_bailout) {
+    TNode<Context> context, TNode<HeapObject> receiver,
+    TNode<JSReceiver> object, TNode<Map> map, TNode<Int32T> instance_type,
+    TNode<Name> unique_name, Label* if_found_value,
+    TVariable<Object>* var_value, Label* if_not_found, Label* if_bailout) {
   TryGetOwnProperty(context, receiver, object, map, instance_type, unique_name,
                     if_found_value, var_value, nullptr, nullptr, if_not_found,
                     if_bailout, kCallJSGetter);
 }
 
 void CodeStubAssembler::TryGetOwnProperty(
-    Node* context, Node* receiver, Node* object, Node* map, Node* instance_type,
-    Node* unique_name, Label* if_found_value, Variable* var_value,
-    Variable* var_details, Variable* var_raw_value, Label* if_not_found,
-    Label* if_bailout, GetOwnPropertyMode mode) {
+    TNode<Context> context, TNode<HeapObject> receiver,
+    TNode<JSReceiver> object, TNode<Map> map, TNode<Int32T> instance_type,
+    TNode<Name> unique_name, Label* if_found_value,
+    TVariable<Object>* var_value, TVariable<Uint32T>* var_details,
+    TVariable<Object>* var_raw_value, Label* if_not_found, Label* if_bailout,
+    GetOwnPropertyMode mode) {
   DCHECK_EQ(MachineRepresentation::kTagged, var_value->rep());
   Comment("TryGetOwnProperty");
-  CSA_ASSERT(this, IsUniqueNameNoIndex(CAST(unique_name)));
-
+  CSA_ASSERT(this, IsUniqueNameNoIndex(unique_name));
   TVARIABLE(HeapObject, var_meta_storage);
   TVARIABLE(IntPtrT, var_entry);
 
   Label if_found_fast(this), if_found_dict(this), if_found_global(this);
 
-  VARIABLE(local_var_details, MachineRepresentation::kWord32);
+  TVARIABLE(Uint32T, local_var_details);
   if (!var_details) {
     var_details = &local_var_details;
   }
@@ -9229,14 +8816,14 @@ void CodeStubAssembler::TryGetOwnProperty(
   }
   BIND(&if_found_dict);
   {
-    TNode<HeapObject> dictionary = var_meta_storage.value();
+    TNode<NameDictionary> dictionary = CAST(var_meta_storage.value());
     TNode<IntPtrT> entry = var_entry.value();
     LoadPropertyFromNameDictionary(dictionary, entry, var_details, var_value);
     Goto(&if_found);
   }
   BIND(&if_found_global);
   {
-    TNode<HeapObject> dictionary = var_meta_storage.value();
+    TNode<GlobalDictionary> dictionary = CAST(var_meta_storage.value());
     TNode<IntPtrT> entry = var_entry.value();
 
     LoadPropertyFromGlobalDictionary(dictionary, entry, var_details, var_value,
@@ -9248,22 +8835,20 @@ void CodeStubAssembler::TryGetOwnProperty(
   {
     // TODO(ishell): Execute C++ accessor in case of accessor info
     if (var_raw_value) {
-      var_raw_value->Bind(var_value->value());
+      *var_raw_value = *var_value;
     }
     TNode<Object> value =
         CallGetterIfAccessor(var_value->value(), var_details->value(), context,
                              receiver, if_bailout, mode);
-    var_value->Bind(value);
+    *var_value = value;
     Goto(if_found_value);
   }
 }
 
-void CodeStubAssembler::TryLookupElement(Node* object, Node* map,
-                                         SloppyTNode<Int32T> instance_type,
-                                         SloppyTNode<IntPtrT> intptr_index,
-                                         Label* if_found, Label* if_absent,
-                                         Label* if_not_found,
-                                         Label* if_bailout) {
+void CodeStubAssembler::TryLookupElement(
+    TNode<HeapObject> object, TNode<Map> map, SloppyTNode<Int32T> instance_type,
+    SloppyTNode<IntPtrT> intptr_index, Label* if_found, Label* if_absent,
+    Label* if_not_found, Label* if_bailout) {
   // Handle special objects in runtime.
   GotoIf(IsSpecialReceiverInstanceType(instance_type), if_bailout);
 
@@ -9331,7 +8916,7 @@ void CodeStubAssembler::TryLookupElement(Node* object, Node* map,
 
   BIND(&if_isobjectorsmi);
   {
-    TNode<FixedArray> elements = CAST(LoadElements(object));
+    TNode<FixedArray> elements = CAST(LoadElements(CAST(object)));
     TNode<IntPtrT> length = LoadAndUntagFixedArrayBaseLength(elements);
 
     GotoIfNot(UintPtrLessThan(intptr_index, length), &if_oob);
@@ -9342,7 +8927,7 @@ void CodeStubAssembler::TryLookupElement(Node* object, Node* map,
   }
   BIND(&if_isdouble);
   {
-    TNode<FixedArrayBase> elements = LoadElements(object);
+    TNode<FixedArrayBase> elements = LoadElements(CAST(object));
     TNode<IntPtrT> length = LoadAndUntagFixedArrayBaseLength(elements);
 
     GotoIfNot(UintPtrLessThan(intptr_index, length), &if_oob);
@@ -9355,11 +8940,17 @@ void CodeStubAssembler::TryLookupElement(Node* object, Node* map,
   }
   BIND(&if_isdictionary);
   {
-    // Negative keys must be converted to property names.
-    GotoIf(IntPtrLessThan(intptr_index, IntPtrConstant(0)), if_bailout);
+    // Negative and too-large keys must be converted to property names.
+    if (Is64()) {
+      GotoIf(UintPtrLessThan(IntPtrConstant(JSArray::kMaxArrayIndex),
+                             intptr_index),
+             if_bailout);
+    } else {
+      GotoIf(IntPtrLessThan(intptr_index, IntPtrConstant(0)), if_bailout);
+    }
 
     TVARIABLE(IntPtrT, var_entry);
-    TNode<NumberDictionary> elements = CAST(LoadElements(object));
+    TNode<NumberDictionary> elements = CAST(LoadElements(CAST(object)));
     NumberDictionaryLookup(elements, intptr_index, if_found, &var_entry,
                            if_not_found);
   }
@@ -9387,9 +8978,15 @@ void CodeStubAssembler::TryLookupElement(Node* object, Node* map,
   }
   BIND(&if_oob);
   {
-    // Positive OOB indices mean "not found", negative indices must be
-    // converted to property names.
-    GotoIf(IntPtrLessThan(intptr_index, IntPtrConstant(0)), if_bailout);
+    // Positive OOB indices mean "not found", negative indices and indices
+    // out of array index range must be converted to property names.
+    if (Is64()) {
+      GotoIf(UintPtrLessThan(IntPtrConstant(JSArray::kMaxArrayIndex),
+                             intptr_index),
+             if_bailout);
+    } else {
+      GotoIf(IntPtrLessThan(intptr_index, IntPtrConstant(0)), if_bailout);
+    }
     Goto(if_not_found);
   }
 }
@@ -9409,7 +9006,7 @@ void CodeStubAssembler::BranchIfMaybeSpecialIndex(TNode<String> name_string,
 
   // If the first character of name is not a digit or '-', or we can't match it
   // to Infinity or NaN, then this is not a special index.
-  TNode<Int32T> first_char = StringCharCodeAt(name_string, IntPtrConstant(0));
+  TNode<Int32T> first_char = StringCharCodeAt(name_string, UintPtrConstant(0));
   // If the name starts with '-', it can be a negative index.
   GotoIf(Word32Equal(first_char, Int32Constant('-')), if_maybe_special_index);
   // If the name starts with 'I', it can be "Infinity".
@@ -9424,13 +9021,13 @@ void CodeStubAssembler::BranchIfMaybeSpecialIndex(TNode<String> name_string,
 }
 
 void CodeStubAssembler::TryPrototypeChainLookup(
-    Node* receiver, Node* object, Node* key,
-    const LookupInHolder& lookup_property_in_holder,
-    const LookupInHolder& lookup_element_in_holder, Label* if_end,
+    TNode<Object> receiver, TNode<Object> object_arg, TNode<Object> key,
+    const LookupPropertyInHolder& lookup_property_in_holder,
+    const LookupElementInHolder& lookup_element_in_holder, Label* if_end,
     Label* if_bailout, Label* if_proxy) {
   // Ensure receiver is JSReceiver, otherwise bailout.
   GotoIf(TaggedIsSmi(receiver), if_bailout);
-  CSA_ASSERT(this, TaggedIsNotSmi(object));
+  TNode<HeapObject> object = CAST(object_arg);
 
   TNode<Map> map = LoadMap(object);
   TNode<Uint16T> instance_type = LoadMapInstanceType(map);
@@ -9454,7 +9051,7 @@ void CodeStubAssembler::TryPrototypeChainLookup(
 
   BIND(&if_iskeyunique);
   {
-    TVARIABLE(HeapObject, var_holder, CAST(object));
+    TVARIABLE(HeapObject, var_holder, object);
     TVARIABLE(Map, var_holder_map, map);
     TVARIABLE(Int32T, var_holder_instance_type, instance_type);
 
@@ -9466,7 +9063,7 @@ void CodeStubAssembler::TryPrototypeChainLookup(
       TNode<Int32T> holder_instance_type = var_holder_instance_type.value();
 
       Label next_proto(this), check_integer_indexed_exotic(this);
-      lookup_property_in_holder(receiver, var_holder.value(), holder_map,
+      lookup_property_in_holder(CAST(receiver), var_holder.value(), holder_map,
                                 holder_instance_type, var_unique.value(),
                                 &check_integer_indexed_exotic, if_bailout);
 
@@ -9497,7 +9094,7 @@ void CodeStubAssembler::TryPrototypeChainLookup(
   }
   BIND(&if_keyisindex);
   {
-    TVARIABLE(HeapObject, var_holder, CAST(object));
+    TVARIABLE(HeapObject, var_holder, object);
     TVARIABLE(Map, var_holder_map, map);
     TVARIABLE(Int32T, var_holder_instance_type, instance_type);
 
@@ -9506,7 +9103,7 @@ void CodeStubAssembler::TryPrototypeChainLookup(
     BIND(&loop);
     {
       Label next_proto(this);
-      lookup_element_in_holder(receiver, var_holder.value(),
+      lookup_element_in_holder(CAST(receiver), var_holder.value(),
                                var_holder_map.value(),
                                var_holder_instance_type.value(),
                                var_index.value(), &next_proto, if_bailout);
@@ -9553,8 +9150,8 @@ TNode<Oddball> CodeStubAssembler::HasInPrototypeChain(TNode<Context> context,
       GotoIf(InstanceTypeEqual(object_instance_type, JS_PROXY_TYPE),
              &return_runtime);
       TNode<Int32T> object_bitfield = LoadMapBitField(object_map);
-      int mask = Map::HasNamedInterceptorBit::kMask |
-                 Map::IsAccessCheckNeededBit::kMask;
+      int mask = Map::Bits1::HasNamedInterceptorBit::kMask |
+                 Map::Bits1::IsAccessCheckNeededBit::kMask;
       Branch(IsSetWord32(object_bitfield, mask), &return_runtime,
              &if_objectisdirect);
     }
@@ -9789,7 +9386,7 @@ TNode<ClosureFeedbackCellArray> CodeStubAssembler::LoadClosureFeedbackArray(
 
 TNode<FeedbackVector> CodeStubAssembler::LoadFeedbackVectorForStub() {
   TNode<JSFunction> function =
-      CAST(LoadFromParentFrame(JavaScriptFrameConstants::kFunctionOffset));
+      CAST(LoadFromParentFrame(StandardFrameConstants::kFunctionOffset));
   return CAST(LoadFeedbackVector(function));
 }
 
@@ -9825,35 +9422,32 @@ void CodeStubAssembler::ReportFeedbackUpdate(
     const char* reason) {
   // Reset profiler ticks.
   StoreObjectFieldNoWriteBarrier(
-      feedback_vector, FeedbackVector::kProfilerTicksOffset, Int32Constant(0),
-      MachineRepresentation::kWord32);
+      feedback_vector, FeedbackVector::kProfilerTicksOffset, Int32Constant(0));
 
 #ifdef V8_TRACE_FEEDBACK_UPDATES
   // Trace the update.
   CallRuntime(Runtime::kInterpreterTraceUpdateFeedback, NoContextConstant(),
-              LoadFromParentFrame(JavaScriptFrameConstants::kFunctionOffset),
+              LoadFromParentFrame(StandardFrameConstants::kFunctionOffset),
               SmiTag(Signed(slot_id)), StringConstant(reason));
 #endif  // V8_TRACE_FEEDBACK_UPDATES
 }
 
-void CodeStubAssembler::OverwriteFeedback(Variable* existing_feedback,
+void CodeStubAssembler::OverwriteFeedback(TVariable<Smi>* existing_feedback,
                                           int new_feedback) {
   if (existing_feedback == nullptr) return;
-  existing_feedback->Bind(SmiConstant(new_feedback));
+  *existing_feedback = SmiConstant(new_feedback);
 }
 
-void CodeStubAssembler::CombineFeedback(Variable* existing_feedback,
+void CodeStubAssembler::CombineFeedback(TVariable<Smi>* existing_feedback,
                                         int feedback) {
   if (existing_feedback == nullptr) return;
-  existing_feedback->Bind(
-      SmiOr(CAST(existing_feedback->value()), SmiConstant(feedback)));
+  *existing_feedback = SmiOr(existing_feedback->value(), SmiConstant(feedback));
 }
 
-void CodeStubAssembler::CombineFeedback(Variable* existing_feedback,
-                                        Node* feedback) {
+void CodeStubAssembler::CombineFeedback(TVariable<Smi>* existing_feedback,
+                                        TNode<Smi> feedback) {
   if (existing_feedback == nullptr) return;
-  existing_feedback->Bind(
-      SmiOr(CAST(existing_feedback->value()), CAST(feedback)));
+  *existing_feedback = SmiOr(existing_feedback->value(), feedback);
 }
 
 void CodeStubAssembler::CheckForAssociatedProtector(SloppyTNode<Name> name,
@@ -9876,144 +9470,51 @@ TNode<Map> CodeStubAssembler::LoadReceiverMap(SloppyTNode<Object> receiver) {
       [=] { return LoadMap(UncheckedCast<HeapObject>(receiver)); });
 }
 
-TNode<IntPtrT> CodeStubAssembler::TryToIntptr(SloppyTNode<Object> key,
-                                              Label* miss) {
+TNode<IntPtrT> CodeStubAssembler::TryToIntptr(
+    SloppyTNode<Object> key, Label* if_not_intptr,
+    TVariable<Int32T>* var_instance_type) {
   TVARIABLE(IntPtrT, var_intptr_key);
-  Label done(this, &var_intptr_key), key_is_smi(this);
+  Label done(this, &var_intptr_key), key_is_smi(this), key_is_heapnumber(this);
   GotoIf(TaggedIsSmi(key), &key_is_smi);
 
-  // Try to convert a heap number to a Smi.
-  GotoIfNot(IsHeapNumber(CAST(key)), miss);
-  {
-    TNode<Float64T> value = LoadHeapNumberValue(CAST(key));
-    TNode<Int32T> int_value = RoundFloat64ToInt32(value);
-    GotoIfNot(Float64Equal(value, ChangeInt32ToFloat64(int_value)), miss);
-    var_intptr_key = ChangeInt32ToIntPtr(int_value);
-    Goto(&done);
+  TNode<Int32T> instance_type = LoadInstanceType(CAST(key));
+  if (var_instance_type != nullptr) {
+    *var_instance_type = instance_type;
   }
 
+  Branch(IsHeapNumberInstanceType(instance_type), &key_is_heapnumber,
+         if_not_intptr);
+
   BIND(&key_is_smi);
   {
     var_intptr_key = SmiUntag(CAST(key));
     Goto(&done);
   }
 
-  BIND(&done);
-  return var_intptr_key.value();
-}
-
-Node* CodeStubAssembler::EmitKeyedSloppyArguments(
-    Node* receiver, Node* key, Node* value, Label* bailout,
-    ArgumentsAccessMode access_mode) {
-  // Mapped arguments are actual arguments. Unmapped arguments are values added
-  // to the arguments object after it was created for the call. Mapped arguments
-  // are stored in the context at indexes given by elements[key + 2]. Unmapped
-  // arguments are stored as regular indexed properties in the arguments array,
-  // held at elements[1]. See NewSloppyArguments() in runtime.cc for a detailed
-  // look at argument object construction.
-  //
-  // The sloppy arguments elements array has a special format:
-  //
-  // 0: context
-  // 1: unmapped arguments array
-  // 2: mapped_index0,
-  // 3: mapped_index1,
-  // ...
-  //
-  // length is 2 + min(number_of_actual_arguments, number_of_formal_arguments).
-  // If key + 2 >= elements.length then attempt to look in the unmapped
-  // arguments array (given by elements[1]) and return the value at key, missing
-  // to the runtime if the unmapped arguments array is not a fixed array or if
-  // key >= unmapped_arguments_array.length.
-  //
-  // Otherwise, t = elements[key + 2]. If t is the hole, then look up the value
-  // in the unmapped arguments array, as described above. Otherwise, t is a Smi
-  // index into the context array given at elements[0]. Return the value at
-  // context[t].
-
-  GotoIfNot(TaggedIsSmi(key), bailout);
-  key = SmiUntag(key);
-  GotoIf(IntPtrLessThan(key, IntPtrConstant(0)), bailout);
-
-  TNode<FixedArray> elements = CAST(LoadElements(receiver));
-  TNode<IntPtrT> elements_length = LoadAndUntagFixedArrayBaseLength(elements);
-
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-  if (access_mode == ArgumentsAccessMode::kStore) {
-    var_result.Bind(value);
-  } else {
-    DCHECK(access_mode == ArgumentsAccessMode::kLoad ||
-           access_mode == ArgumentsAccessMode::kHas);
-  }
-  Label if_mapped(this), if_unmapped(this), end(this, &var_result);
-  TNode<IntPtrT> intptr_two = IntPtrConstant(2);
-  TNode<IntPtrT> adjusted_length = IntPtrSub(elements_length, intptr_two);
-
-  GotoIf(UintPtrGreaterThanOrEqual(key, adjusted_length), &if_unmapped);
-
-  TNode<Object> mapped_index =
-      LoadFixedArrayElement(elements, IntPtrAdd(key, intptr_two));
-  Branch(TaggedEqual(mapped_index, TheHoleConstant()), &if_unmapped,
-         &if_mapped);
-
-  BIND(&if_mapped);
-  {
-    TNode<IntPtrT> mapped_index_intptr = SmiUntag(CAST(mapped_index));
-    TNode<Context> the_context = CAST(LoadFixedArrayElement(elements, 0));
-    if (access_mode == ArgumentsAccessMode::kLoad) {
-      TNode<Object> result =
-          LoadContextElement(the_context, mapped_index_intptr);
-      CSA_ASSERT(this, TaggedNotEqual(result, TheHoleConstant()));
-      var_result.Bind(result);
-    } else if (access_mode == ArgumentsAccessMode::kHas) {
-      CSA_ASSERT(this, Word32BinaryNot(IsTheHole(LoadContextElement(
-                           the_context, mapped_index_intptr))));
-      var_result.Bind(TrueConstant());
-    } else {
-      StoreContextElement(the_context, mapped_index_intptr, value);
-    }
-    Goto(&end);
-  }
-
-  BIND(&if_unmapped);
+  BIND(&key_is_heapnumber);
   {
-    TNode<HeapObject> backing_store_ho =
-        CAST(LoadFixedArrayElement(elements, 1));
-    GotoIf(TaggedNotEqual(LoadMap(backing_store_ho), FixedArrayMapConstant()),
-           bailout);
-    TNode<FixedArray> backing_store = CAST(backing_store_ho);
-
-    TNode<IntPtrT> backing_store_length =
-        LoadAndUntagFixedArrayBaseLength(backing_store);
-    if (access_mode == ArgumentsAccessMode::kHas) {
-      Label out_of_bounds(this);
-      GotoIf(UintPtrGreaterThanOrEqual(key, backing_store_length),
-             &out_of_bounds);
-      TNode<Object> result = LoadFixedArrayElement(backing_store, key);
-      var_result.Bind(
-          SelectBooleanConstant(TaggedNotEqual(result, TheHoleConstant())));
-      Goto(&end);
-
-      BIND(&out_of_bounds);
-      var_result.Bind(FalseConstant());
-      Goto(&end);
-    } else {
-      GotoIf(UintPtrGreaterThanOrEqual(key, backing_store_length), bailout);
-
-      // The key falls into unmapped range.
-      if (access_mode == ArgumentsAccessMode::kLoad) {
-        TNode<Object> result = LoadFixedArrayElement(backing_store, key);
-        GotoIf(TaggedEqual(result, TheHoleConstant()), bailout);
-        var_result.Bind(result);
-      } else {
-        StoreFixedArrayElement(backing_store, key, value);
-      }
-      Goto(&end);
-    }
+    TNode<Float64T> value = LoadHeapNumberValue(CAST(key));
+    TNode<IntPtrT> int_value = ChangeFloat64ToIntPtr(value);
+    GotoIfNot(Float64Equal(value, RoundIntPtrToFloat64(int_value)),
+              if_not_intptr);
+#if V8_TARGET_ARCH_64_BIT
+    // We can't rely on Is64() alone because 32-bit compilers rightly complain
+    // about kMaxSafeIntegerUint64 not fitting into an intptr_t.
+    DCHECK(Is64());
+    // TODO(jkummerow): Investigate whether we can drop support for
+    // negative indices.
+    GotoIfNot(IsInRange(int_value, static_cast<intptr_t>(-kMaxSafeInteger),
+                        static_cast<intptr_t>(kMaxSafeIntegerUint64)),
+              if_not_intptr);
+#else
+    DCHECK(!Is64());
+#endif
+    var_intptr_key = int_value;
+    Goto(&done);
   }
 
-  BIND(&end);
-  return var_result.value();
+  BIND(&done);
+  return var_intptr_key.value();
 }
 
 TNode<Context> CodeStubAssembler::LoadScriptContext(
@@ -10258,11 +9759,10 @@ void CodeStubAssembler::BigIntToRawBytes(TNode<BigInt> bigint,
   BIND(&done);
 }
 
-void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
-                                         ElementsKind elements_kind,
-                                         KeyedAccessStoreMode store_mode,
-                                         Label* bailout, Node* context,
-                                         Variable* maybe_converted_value) {
+void CodeStubAssembler::EmitElementStore(
+    TNode<JSObject> object, TNode<Object> key, TNode<Object> value,
+    ElementsKind elements_kind, KeyedAccessStoreMode store_mode, Label* bailout,
+    TNode<Context> context, TVariable<Object>* maybe_converted_value) {
   CSA_ASSERT(this, Word32BinaryNot(IsJSProxy(object)));
 
   TNode<FixedArrayBase> elements = LoadElements(object);
@@ -10278,13 +9778,17 @@ void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
   ParameterMode parameter_mode = INTPTR_PARAMETERS;
   TNode<IntPtrT> intptr_key = TryToIntptr(key, bailout);
 
+  // TODO(rmcilroy): TNodify the converted value once this funciton and
+  // StoreElement are templated based on the type elements_kind type.
+  Node* converted_value = value;
   if (IsTypedArrayElementsKind(elements_kind)) {
     Label done(this), update_value_and_bailout(this, Label::kDeferred);
 
     // IntegerIndexedElementSet converts value to a Number/BigInt prior to the
     // bounds check.
-    Node* converted_value = PrepareValueForWriteToTypedArray(
-        CAST(value), elements_kind, CAST(context));
+    converted_value =
+        PrepareValueForWriteToTypedArray(value, elements_kind, context);
+    TNode<JSTypedArray> typed_array = CAST(object);
 
     // There must be no allocations between the buffer load and
     // and the actual store to backing store, because GC may decide that
@@ -10292,7 +9796,7 @@ void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
     // TODO(ishell): introduce DisallowHeapAllocationCode scope here.
 
     // Check if buffer has been detached.
-    TNode<JSArrayBuffer> buffer = LoadJSArrayBufferViewBuffer(CAST(object));
+    TNode<JSArrayBuffer> buffer = LoadJSArrayBufferViewBuffer(typed_array);
     if (maybe_converted_value) {
       GotoIf(IsDetachedBuffer(buffer), &update_value_and_bailout);
     } else {
@@ -10300,7 +9804,7 @@ void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
     }
 
     // Bounds check.
-    TNode<UintPtrT> length = LoadJSTypedArrayLength(CAST(object));
+    TNode<UintPtrT> length = LoadJSTypedArrayLength(typed_array);
 
     if (store_mode == STORE_IGNORE_OUT_OF_BOUNDS) {
       // Skip the store if we write beyond the length or
@@ -10311,7 +9815,7 @@ void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
       GotoIfNot(UintPtrLessThan(intptr_key, length), &update_value_and_bailout);
     }
 
-    TNode<RawPtrT> data_ptr = LoadJSTypedArrayDataPtr(CAST(object));
+    TNode<RawPtrT> data_ptr = LoadJSTypedArrayDataPtr(typed_array);
     StoreElement(data_ptr, elements_kind, intptr_key, converted_value,
                  parameter_mode);
     Goto(&done);
@@ -10331,26 +9835,26 @@ void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
         case UINT16_ELEMENTS:
         case INT16_ELEMENTS:
         case UINT8_CLAMPED_ELEMENTS:
-          maybe_converted_value->Bind(SmiFromInt32(converted_value));
+          *maybe_converted_value = SmiFromInt32(converted_value);
           break;
         case UINT32_ELEMENTS:
-          maybe_converted_value->Bind(ChangeUint32ToTagged(converted_value));
+          *maybe_converted_value = ChangeUint32ToTagged(converted_value);
           break;
         case INT32_ELEMENTS:
-          maybe_converted_value->Bind(ChangeInt32ToTagged(converted_value));
+          *maybe_converted_value = ChangeInt32ToTagged(converted_value);
           break;
         case FLOAT32_ELEMENTS: {
           Label dont_allocate_heap_number(this), end(this);
           GotoIf(TaggedIsSmi(value), &dont_allocate_heap_number);
-          GotoIf(IsHeapNumber(value), &dont_allocate_heap_number);
+          GotoIf(IsHeapNumber(CAST(value)), &dont_allocate_heap_number);
           {
-            maybe_converted_value->Bind(AllocateHeapNumberWithValue(
-                ChangeFloat32ToFloat64(converted_value)));
+            *maybe_converted_value = AllocateHeapNumberWithValue(
+                ChangeFloat32ToFloat64(converted_value));
             Goto(&end);
           }
           BIND(&dont_allocate_heap_number);
           {
-            maybe_converted_value->Bind(value);
+            *maybe_converted_value = value;
             Goto(&end);
           }
           BIND(&end);
@@ -10359,15 +9863,15 @@ void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
         case FLOAT64_ELEMENTS: {
           Label dont_allocate_heap_number(this), end(this);
           GotoIf(TaggedIsSmi(value), &dont_allocate_heap_number);
-          GotoIf(IsHeapNumber(value), &dont_allocate_heap_number);
+          GotoIf(IsHeapNumber(CAST(value)), &dont_allocate_heap_number);
           {
-            maybe_converted_value->Bind(
-                AllocateHeapNumberWithValue(converted_value));
+            *maybe_converted_value =
+                AllocateHeapNumberWithValue(converted_value);
             Goto(&end);
           }
           BIND(&dont_allocate_heap_number);
           {
-            maybe_converted_value->Bind(value);
+            *maybe_converted_value = value;
             Goto(&end);
           }
           BIND(&end);
@@ -10375,7 +9879,7 @@ void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
         }
         case BIGINT64_ELEMENTS:
         case BIGUINT64_ELEMENTS:
-          maybe_converted_value->Bind(converted_value);
+          *maybe_converted_value = CAST(converted_value);
           break;
         default:
           UNREACHABLE();
@@ -10390,29 +9894,31 @@ void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
          IsSealedElementsKind(elements_kind) ||
          IsNonextensibleElementsKind(elements_kind));
 
-  Node* length = SelectImpl(
-      IsJSArray(object), [=]() { return LoadJSArrayLength(object); },
-      [=]() { return LoadFixedArrayBaseLength(elements); },
-      MachineRepresentation::kTagged);
-  length = TaggedToParameter(length, parameter_mode);
-
   // In case value is stored into a fast smi array, assure that the value is
   // a smi before manipulating the backing store. Otherwise the backing store
   // may be left in an invalid state.
   if (IsSmiElementsKind(elements_kind)) {
     GotoIfNot(TaggedIsSmi(value), bailout);
   } else if (IsDoubleElementsKind(elements_kind)) {
-    value = TryTaggedToFloat64(CAST(value), bailout);
+    converted_value = TryTaggedToFloat64(value, bailout);
   }
 
+  TNode<Smi> smi_length = Select<Smi>(
+      IsJSArray(object),
+      [=]() {
+        // This is casting Number -> Smi which may not actually be safe.
+        return CAST(LoadJSArrayLength(CAST(object)));
+      },
+      [=]() { return LoadFixedArrayBaseLength(elements); });
+
+  TNode<UintPtrT> length = Unsigned(SmiUntag(smi_length));
   if (IsGrowStoreMode(store_mode) &&
       !(IsSealedElementsKind(elements_kind) ||
         IsNonextensibleElementsKind(elements_kind))) {
-    elements =
-        CAST(CheckForCapacityGrow(object, elements, elements_kind, length,
-                                  intptr_key, parameter_mode, bailout));
+    elements = CAST(CheckForCapacityGrow(object, elements, elements_kind,
+                                         length, intptr_key, bailout));
   } else {
-    GotoIfNot(UintPtrLessThan(intptr_key, length), bailout);
+    GotoIfNot(UintPtrLessThan(Unsigned(intptr_key), length), bailout);
   }
 
   // Cannot store to a hole in holey sealed elements so bailout.
@@ -10435,15 +9941,13 @@ void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
   }
 
   CSA_ASSERT(this, Word32BinaryNot(IsFixedCOWArrayMap(LoadMap(elements))));
-  StoreElement(elements, elements_kind, intptr_key, value, parameter_mode);
+  StoreElement(elements, elements_kind, intptr_key, converted_value,
+               parameter_mode);
 }
 
-Node* CodeStubAssembler::CheckForCapacityGrow(Node* object, Node* elements,
-                                              ElementsKind kind,
-                                              SloppyTNode<UintPtrT> length,
-                                              SloppyTNode<WordT> key,
-                                              ParameterMode mode,
-                                              Label* bailout) {
+Node* CodeStubAssembler::CheckForCapacityGrow(
+    TNode<JSObject> object, TNode<FixedArrayBase> elements, ElementsKind kind,
+    TNode<UintPtrT> length, TNode<IntPtrT> key, Label* bailout) {
   DCHECK(IsFastElementsKind(kind));
   VARIABLE(checked_elements, MachineRepresentation::kTagged);
   Label grow_case(this), no_grow_case(this), done(this),
@@ -10460,25 +9964,25 @@ Node* CodeStubAssembler::CheckForCapacityGrow(Node* object, Node* elements,
 
   BIND(&grow_case);
   {
-    Node* current_capacity =
-        TaggedToParameter(LoadFixedArrayBaseLength(elements), mode);
+    TNode<IntPtrT> current_capacity =
+        SmiUntag(LoadFixedArrayBaseLength(elements));
     checked_elements.Bind(elements);
     Label fits_capacity(this);
     // If key is negative, we will notice in Runtime::kGrowArrayElements.
     GotoIf(UintPtrLessThan(key, current_capacity), &fits_capacity);
 
     {
-      Node* new_elements = TryGrowElementsCapacity(
-          object, elements, kind, key, current_capacity, mode, &grow_bailout);
+      Node* new_elements =
+          TryGrowElementsCapacity(object, elements, kind, key, current_capacity,
+                                  INTPTR_PARAMETERS, &grow_bailout);
       checked_elements.Bind(new_elements);
       Goto(&fits_capacity);
     }
 
     BIND(&grow_bailout);
     {
-      Node* tagged_key = mode == SMI_PARAMETERS
-                             ? static_cast<Node*>(key)
-                             : ChangeInt32ToTagged(TruncateWordToInt32(key));
+      GotoIf(IntPtrLessThan(key, IntPtrConstant(0)), bailout);
+      TNode<Number> tagged_key = ChangeUintPtrToTagged(Unsigned(key));
       TNode<Object> maybe_elements = CallRuntime(
           Runtime::kGrowArrayElements, NoContextConstant(), object, tagged_key);
       GotoIf(TaggedIsSmi(maybe_elements), bailout);
@@ -10490,9 +9994,9 @@ Node* CodeStubAssembler::CheckForCapacityGrow(Node* object, Node* elements,
     BIND(&fits_capacity);
     GotoIfNot(IsJSArray(object), &done);
 
-    TNode<WordT> new_length = IntPtrAdd(key, IntPtrOrSmiConstant(1, mode));
+    TNode<IntPtrT> new_length = IntPtrAdd(key, IntPtrConstant(1));
     StoreObjectFieldNoWriteBarrier(object, JSArray::kLengthOffset,
-                                   ParameterToTagged(new_length, mode));
+                                   SmiTag(new_length));
     Goto(&done);
   }
 
@@ -10528,7 +10032,8 @@ Node* CodeStubAssembler::CopyElementsOnWrite(Node* object, Node* elements,
   return new_elements_var.value();
 }
 
-void CodeStubAssembler::TransitionElementsKind(Node* object, Node* map,
+void CodeStubAssembler::TransitionElementsKind(TNode<JSObject> object,
+                                               TNode<Map> map,
                                                ElementsKind from_kind,
                                                ElementsKind to_kind,
                                                Label* bailout) {
@@ -10548,14 +10053,13 @@ void CodeStubAssembler::TransitionElementsKind(Node* object, Node* map,
     ParameterMode mode = INTPTR_PARAMETERS;
     TNode<IntPtrT> elements_length =
         SmiUntag(LoadFixedArrayBaseLength(elements));
-    Node* array_length = SelectImpl(
+    TNode<IntPtrT> array_length = Select<IntPtrT>(
         IsJSArray(object),
         [=]() {
           CSA_ASSERT(this, IsFastElementsKind(LoadElementsKind(object)));
-          return SmiUntag(LoadFastJSArrayLength(object));
+          return SmiUntag(LoadFastJSArrayLength(CAST(object)));
         },
-        [=]() { return elements_length; },
-        MachineType::PointerRepresentation());
+        [=]() { return elements_length; });
 
     CSA_ASSERT(this, WordNotEqual(elements_length, IntPtrConstant(0)));
 
@@ -10568,7 +10072,7 @@ void CodeStubAssembler::TransitionElementsKind(Node* object, Node* map,
   StoreMap(object, map);
 }
 
-void CodeStubAssembler::TrapAllocationMemento(Node* object,
+void CodeStubAssembler::TrapAllocationMemento(TNode<JSObject> object,
                                               Label* memento_found) {
   Comment("[ TrapAllocationMemento");
   Label no_memento_found(this);
@@ -10576,7 +10080,7 @@ void CodeStubAssembler::TrapAllocationMemento(Node* object,
 
   TNode<ExternalReference> new_space_top_address = ExternalConstant(
       ExternalReference::new_space_allocation_top_address(isolate()));
-  const int kMementoMapOffset = JSArray::kSize;
+  const int kMementoMapOffset = JSArray::kHeaderSize;
   const int kMementoLastWordOffset =
       kMementoMapOffset + AllocationMemento::kSize - kTaggedSize;
 
@@ -10585,8 +10089,7 @@ void CodeStubAssembler::TrapAllocationMemento(Node* object,
   TNode<IntPtrT> object_page = PageFromAddress(object_word);
   {
     TNode<IntPtrT> page_flags =
-        UncheckedCast<IntPtrT>(Load(MachineType::IntPtr(), object_page,
-                                    IntPtrConstant(Page::kFlagsOffset)));
+        Load<IntPtrT>(object_page, IntPtrConstant(Page::kFlagsOffset));
     GotoIf(WordEqual(
                WordAnd(page_flags,
                        IntPtrConstant(MemoryChunk::kIsInYoungGenerationMask)),
@@ -10604,8 +10107,7 @@ void CodeStubAssembler::TrapAllocationMemento(Node* object,
       object_word, IntPtrConstant(kMementoLastWordOffset - kHeapObjectTag));
   TNode<IntPtrT> memento_last_word_page = PageFromAddress(memento_last_word);
 
-  TNode<IntPtrT> new_space_top = UncheckedCast<IntPtrT>(
-      Load(MachineType::Pointer(), new_space_top_address));
+  TNode<IntPtrT> new_space_top = Load<IntPtrT>(new_space_top_address);
   TNode<IntPtrT> new_space_top_page = PageFromAddress(new_space_top);
 
   // If the object is in new space, we need to check whether respective
@@ -10648,7 +10150,7 @@ TNode<AllocationSite> CodeStubAssembler::CreateAllocationSiteInFeedbackVector(
   StoreMapNoWriteBarrier(site, RootIndex::kAllocationSiteWithWeakNextMap);
   // Should match AllocationSite::Initialize.
   TNode<WordT> field = UpdateWord<AllocationSite::ElementsKindBits>(
-      IntPtrConstant(0), IntPtrConstant(GetInitialFastElementsKind()));
+      IntPtrConstant(0), UintPtrConstant(GetInitialFastElementsKind()));
   StoreObjectFieldNoWriteBarrier(
       site, AllocationSite::kTransitionInfoOrBoilerplateOffset,
       SmiTag(Signed(field)));
@@ -10659,13 +10161,11 @@ TNode<AllocationSite> CodeStubAssembler::CreateAllocationSiteInFeedbackVector(
 
   // Pretenuring calculation field.
   StoreObjectFieldNoWriteBarrier(site, AllocationSite::kPretenureDataOffset,
-                                 Int32Constant(0),
-                                 MachineRepresentation::kWord32);
+                                 Int32Constant(0));
 
   // Pretenuring memento creation count field.
   StoreObjectFieldNoWriteBarrier(
-      site, AllocationSite::kPretenureCreateCountOffset, Int32Constant(0),
-      MachineRepresentation::kWord32);
+      site, AllocationSite::kPretenureCreateCountOffset, Int32Constant(0));
 
   // Store an empty fixed array for the code dependency.
   StoreObjectFieldRoot(site, AllocationSite::kDependentCodeOffset,
@@ -10770,15 +10270,15 @@ TNode<TIndex> CodeStubAssembler::BuildFastLoop(const VariableList& vars,
   return var.value();
 }
 
-// Instantiate BuildFastLoop for Smi and IntPtrT.
-template TNode<Smi> CodeStubAssembler::BuildFastLoop<Smi>(
-    const VariableList& vars, TNode<Smi> start_index, TNode<Smi> end_index,
-    const FastLoopBody<Smi>& body, int increment,
-    IndexAdvanceMode advance_mode);
+// Instantiate BuildFastLoop for IntPtrT and UintPtrT.
 template TNode<IntPtrT> CodeStubAssembler::BuildFastLoop<IntPtrT>(
     const VariableList& vars, TNode<IntPtrT> start_index,
     TNode<IntPtrT> end_index, const FastLoopBody<IntPtrT>& body, int increment,
     IndexAdvanceMode advance_mode);
+template TNode<UintPtrT> CodeStubAssembler::BuildFastLoop<UintPtrT>(
+    const VariableList& vars, TNode<UintPtrT> start_index,
+    TNode<UintPtrT> end_index, const FastLoopBody<UintPtrT>& body,
+    int increment, IndexAdvanceMode advance_mode);
 
 void CodeStubAssembler::BuildFastFixedArrayForEach(
     const CodeStubAssembler::VariableList& vars, Node* fixed_array,
@@ -10954,8 +10454,8 @@ void CodeStubAssembler::BranchIfNumberRelationalComparison(
   }
 }
 
-void CodeStubAssembler::GotoIfNumberGreaterThanOrEqual(Node* left, Node* right,
-                                                       Label* if_true) {
+void CodeStubAssembler::GotoIfNumberGreaterThanOrEqual(
+    SloppyTNode<Number> left, SloppyTNode<Number> right, Label* if_true) {
   Label if_false(this);
   BranchIfNumberRelationalComparison(Operation::kGreaterThanOrEqual, left,
                                      right, if_true, &if_false);
@@ -11417,7 +10917,7 @@ TNode<Smi> CodeStubAssembler::CollectFeedbackForString(
 
 void CodeStubAssembler::GenerateEqual_Same(SloppyTNode<Object> value,
                                            Label* if_equal, Label* if_notequal,
-                                           Variable* var_type_feedback) {
+                                           TVariable<Smi>* var_type_feedback) {
   // In case of abstract or strict equality checks, we need additional checks
   // for NaN values because they are not considered equal, even if both the
   // left and the right hand side reference exactly the same value.
@@ -11758,7 +11258,6 @@ TNode<Oddball> CodeStubAssembler::Equal(SloppyTNode<Object> left,
               *var_type_feedback = SmiConstant(
                   CompareOperationFeedback::kReceiverOrNullOrUndefined);
               GotoIf(IsJSReceiverInstanceType(right_type), &if_notequal);
-              GotoIfNot(IsBooleanMap(right_map), &if_notequal);
               *var_type_feedback = SmiConstant(CompareOperationFeedback::kAny);
             }
             Goto(&if_notequal);
@@ -12241,8 +11740,8 @@ void CodeStubAssembler::BranchIfSameValue(SloppyTNode<Object> lhs,
                                           SloppyTNode<Object> rhs,
                                           Label* if_true, Label* if_false,
                                           SameValueMode mode) {
-  VARIABLE(var_lhs_value, MachineRepresentation::kFloat64);
-  VARIABLE(var_rhs_value, MachineRepresentation::kFloat64);
+  TVARIABLE(Float64T, var_lhs_value);
+  TVARIABLE(Float64T, var_rhs_value);
   Label do_fcmp(this);
 
   // Immediately jump to {if_true} if {lhs} == {rhs}, because - unlike
@@ -12259,8 +11758,8 @@ void CodeStubAssembler::BranchIfSameValue(SloppyTNode<Object> lhs,
     // iff the {rhs} is a HeapNumber with the same float64 value.
     Branch(TaggedIsSmi(rhs), if_false, [&] {
       GotoIfNot(IsHeapNumber(CAST(rhs)), if_false);
-      var_lhs_value.Bind(SmiToFloat64(CAST(lhs)));
-      var_rhs_value.Bind(LoadHeapNumberValue(CAST(rhs)));
+      var_lhs_value = SmiToFloat64(CAST(lhs));
+      var_rhs_value = LoadHeapNumberValue(CAST(rhs));
       Goto(&do_fcmp);
     });
   }
@@ -12274,8 +11773,8 @@ void CodeStubAssembler::BranchIfSameValue(SloppyTNode<Object> lhs,
           // Since {rhs} is a Smi, the comparison can only yield true
           // iff the {lhs} is a HeapNumber with the same float64 value.
           GotoIfNot(IsHeapNumber(CAST(lhs)), if_false);
-          var_lhs_value.Bind(LoadHeapNumberValue(CAST(lhs)));
-          var_rhs_value.Bind(SmiToFloat64(CAST(rhs)));
+          var_lhs_value = LoadHeapNumberValue(CAST(lhs));
+          var_rhs_value = SmiToFloat64(CAST(rhs));
           Goto(&do_fcmp);
         },
         [&] {
@@ -12285,10 +11784,10 @@ void CodeStubAssembler::BranchIfSameValue(SloppyTNode<Object> lhs,
           // value.
           Label if_lhsisheapnumber(this), if_lhsisstring(this),
               if_lhsisbigint(this);
-          TNode<Map> const lhs_map = LoadMap(CAST(lhs));
+          const TNode<Map> lhs_map = LoadMap(CAST(lhs));
           GotoIf(IsHeapNumberMap(lhs_map), &if_lhsisheapnumber);
           if (mode != SameValueMode::kNumbersOnly) {
-            TNode<Uint16T> const lhs_instance_type =
+            const TNode<Uint16T> lhs_instance_type =
                 LoadMapInstanceType(lhs_map);
             GotoIf(IsStringInstanceType(lhs_instance_type), &if_lhsisstring);
             GotoIf(IsBigIntInstanceType(lhs_instance_type), &if_lhsisbigint);
@@ -12298,8 +11797,8 @@ void CodeStubAssembler::BranchIfSameValue(SloppyTNode<Object> lhs,
           BIND(&if_lhsisheapnumber);
           {
             GotoIfNot(IsHeapNumber(CAST(rhs)), if_false);
-            var_lhs_value.Bind(LoadHeapNumberValue(CAST(lhs)));
-            var_rhs_value.Bind(LoadHeapNumberValue(CAST(rhs)));
+            var_lhs_value = LoadHeapNumberValue(CAST(lhs));
+            var_rhs_value = LoadHeapNumberValue(CAST(rhs));
             Goto(&do_fcmp);
           }
 
@@ -12309,7 +11808,7 @@ void CodeStubAssembler::BranchIfSameValue(SloppyTNode<Object> lhs,
               // Now we can only yield true if {rhs} is also a String
               // with the same sequence of characters.
               GotoIfNot(IsString(CAST(rhs)), if_false);
-              TNode<Object> const result = CallBuiltin(
+              const TNode<Object> result = CallBuiltin(
                   Builtins::kStringEqual, NoContextConstant(), lhs, rhs);
               Branch(IsTrue(result), if_true, if_false);
             }
@@ -12317,7 +11816,7 @@ void CodeStubAssembler::BranchIfSameValue(SloppyTNode<Object> lhs,
             BIND(&if_lhsisbigint);
             {
               GotoIfNot(IsBigInt(CAST(rhs)), if_false);
-              TNode<Object> const result = CallRuntime(
+              const TNode<Object> result = CallRuntime(
                   Runtime::kBigIntEqualToBigInt, NoContextConstant(), lhs, rhs);
               Branch(IsTrue(result), if_true, if_false);
             }
@@ -12345,8 +11844,8 @@ void CodeStubAssembler::BranchIfSameNumberValue(TNode<Float64T> lhs_value,
     // We still need to handle the case when {lhs} and {rhs} are -0.0 and
     // 0.0 (or vice versa). Compare the high word to
     // distinguish between the two.
-    TNode<Uint32T> const lhs_hi_word = Float64ExtractHighWord32(lhs_value);
-    TNode<Uint32T> const rhs_hi_word = Float64ExtractHighWord32(rhs_value);
+    const TNode<Uint32T> lhs_hi_word = Float64ExtractHighWord32(lhs_value);
+    const TNode<Uint32T> rhs_hi_word = Float64ExtractHighWord32(rhs_value);
 
     // If x is +0 and y is -0, return false.
     // If x is -0 and y is +0, return false.
@@ -12368,19 +11867,20 @@ TNode<Oddball> CodeStubAssembler::HasProperty(SloppyTNode<Context> context,
   Label call_runtime(this, Label::kDeferred), return_true(this),
       return_false(this), end(this), if_proxy(this, Label::kDeferred);
 
-  CodeStubAssembler::LookupInHolder lookup_property_in_holder =
-      [this, &return_true](Node* receiver, Node* holder, Node* holder_map,
-                           Node* holder_instance_type, Node* unique_name,
-                           Label* next_holder, Label* if_bailout) {
+  CodeStubAssembler::LookupPropertyInHolder lookup_property_in_holder =
+      [this, &return_true](
+          TNode<HeapObject> receiver, TNode<HeapObject> holder,
+          TNode<Map> holder_map, TNode<Int32T> holder_instance_type,
+          TNode<Name> unique_name, Label* next_holder, Label* if_bailout) {
         TryHasOwnProperty(holder, holder_map, holder_instance_type, unique_name,
                           &return_true, next_holder, if_bailout);
       };
 
-  CodeStubAssembler::LookupInHolder lookup_element_in_holder =
+  CodeStubAssembler::LookupElementInHolder lookup_element_in_holder =
       [this, &return_true, &return_false](
-          Node* receiver, Node* holder, Node* holder_map,
-          Node* holder_instance_type, Node* index, Label* next_holder,
-          Label* if_bailout) {
+          TNode<HeapObject> receiver, TNode<HeapObject> holder,
+          TNode<Map> holder_map, TNode<Int32T> holder_instance_type,
+          TNode<IntPtrT> index, Label* next_holder, Label* if_bailout) {
         TryLookupElement(holder, holder_map, holder_instance_type, index,
                          &return_true, &return_false, next_holder, if_bailout);
       };
@@ -12460,12 +11960,13 @@ TNode<String> CodeStubAssembler::Typeof(SloppyTNode<Object> value) {
 
   GotoIf(InstanceTypeEqual(instance_type, ODDBALL_TYPE), &if_oddball);
 
-  TNode<Int32T> callable_or_undetectable_mask = Word32And(
-      LoadMapBitField(map),
-      Int32Constant(Map::IsCallableBit::kMask | Map::IsUndetectableBit::kMask));
+  TNode<Int32T> callable_or_undetectable_mask =
+      Word32And(LoadMapBitField(map),
+                Int32Constant(Map::Bits1::IsCallableBit::kMask |
+                              Map::Bits1::IsUndetectableBit::kMask));
 
   GotoIf(Word32Equal(callable_or_undetectable_mask,
-                     Int32Constant(Map::IsCallableBit::kMask)),
+                     Int32Constant(Map::Bits1::IsCallableBit::kMask)),
          &return_function);
 
   GotoIfNot(Word32Equal(callable_or_undetectable_mask, Int32Constant(0)),
@@ -12801,19 +12302,21 @@ TNode<Number> CodeStubAssembler::NumberSub(SloppyTNode<Number> a,
   return var_result.value();
 }
 
-void CodeStubAssembler::GotoIfNotNumber(Node* input, Label* is_not_number) {
+void CodeStubAssembler::GotoIfNotNumber(TNode<Object> input,
+                                        Label* is_not_number) {
   Label is_number(this);
   GotoIf(TaggedIsSmi(input), &is_number);
-  Branch(IsHeapNumber(input), &is_number, is_not_number);
+  Branch(IsHeapNumber(CAST(input)), &is_number, is_not_number);
   BIND(&is_number);
 }
 
-void CodeStubAssembler::GotoIfNumber(Node* input, Label* is_number) {
+void CodeStubAssembler::GotoIfNumber(TNode<Object> input, Label* is_number) {
   GotoIf(TaggedIsSmi(input), is_number);
-  GotoIf(IsHeapNumber(input), is_number);
+  GotoIf(IsHeapNumber(CAST(input)), is_number);
 }
 
-TNode<Number> CodeStubAssembler::BitwiseOp(Node* left32, Node* right32,
+TNode<Number> CodeStubAssembler::BitwiseOp(TNode<Word32T> left32,
+                                           TNode<Word32T> right32,
                                            Operation bitwise_op) {
   switch (bitwise_op) {
     case Operation::kBitwiseAnd:
@@ -12849,7 +12352,7 @@ TNode<JSArrayIterator> CodeStubAssembler::CreateArrayIterator(
   TNode<NativeContext> native_context = LoadNativeContext(context);
   TNode<Map> iterator_map = CAST(LoadContextElement(
       native_context, Context::INITIAL_ARRAY_ITERATOR_MAP_INDEX));
-  TNode<HeapObject> iterator = Allocate(JSArrayIterator::kSize);
+  TNode<HeapObject> iterator = Allocate(JSArrayIterator::kHeaderSize);
   StoreMapNoWriteBarrier(iterator, iterator_map);
   StoreObjectFieldRoot(iterator, JSArrayIterator::kPropertiesOrHashOffset,
                        RootIndex::kEmptyFixedArray);
@@ -12870,8 +12373,8 @@ TNode<JSObject> CodeStubAssembler::AllocateJSIteratorResult(
     SloppyTNode<Oddball> done) {
   CSA_ASSERT(this, IsBoolean(done));
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<Object> map =
-      LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX);
+  TNode<Map> map = CAST(
+      LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX));
   TNode<HeapObject> result = Allocate(JSIteratorResult::kSize);
   StoreMapNoWriteBarrier(result, map);
   StoreObjectFieldRoot(result, JSIteratorResult::kPropertiesOrHashOffset,
@@ -12889,23 +12392,23 @@ TNode<JSObject> CodeStubAssembler::AllocateJSIteratorResultForEntry(
   TNode<Smi> length = SmiConstant(2);
   int const elements_size = FixedArray::SizeFor(2);
   TNode<FixedArray> elements = UncheckedCast<FixedArray>(
-      Allocate(elements_size + JSArray::kSize + JSIteratorResult::kSize));
+      Allocate(elements_size + JSArray::kHeaderSize + JSIteratorResult::kSize));
   StoreObjectFieldRoot(elements, FixedArray::kMapOffset,
                        RootIndex::kFixedArrayMap);
   StoreObjectFieldNoWriteBarrier(elements, FixedArray::kLengthOffset, length);
   StoreFixedArrayElement(elements, 0, key);
   StoreFixedArrayElement(elements, 1, value);
-  TNode<Object> array_map = LoadContextElement(
-      native_context, Context::JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX);
+  TNode<Map> array_map = CAST(LoadContextElement(
+      native_context, Context::JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX));
   TNode<HeapObject> array = InnerAllocate(elements, elements_size);
   StoreMapNoWriteBarrier(array, array_map);
   StoreObjectFieldRoot(array, JSArray::kPropertiesOrHashOffset,
                        RootIndex::kEmptyFixedArray);
   StoreObjectFieldNoWriteBarrier(array, JSArray::kElementsOffset, elements);
   StoreObjectFieldNoWriteBarrier(array, JSArray::kLengthOffset, length);
-  TNode<Object> iterator_map =
-      LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX);
-  TNode<HeapObject> result = InnerAllocate(array, JSArray::kSize);
+  TNode<Map> iterator_map = CAST(
+      LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX));
+  TNode<HeapObject> result = InnerAllocate(array, JSArray::kHeaderSize);
   StoreMapNoWriteBarrier(result, iterator_map);
   StoreObjectFieldRoot(result, JSIteratorResult::kPropertiesOrHashOffset,
                        RootIndex::kEmptyFixedArray);
@@ -13090,7 +12593,7 @@ void CodeStubArguments::ForEach(
       -kSystemPointerSize, CodeStubAssembler::IndexAdvanceMode::kPost);
 }
 
-void CodeStubArguments::PopAndReturn(Node* value) {
+void CodeStubArguments::PopAndReturn(TNode<Object> value) {
   TNode<IntPtrT> pop_count;
   if (receiver_mode_ == ReceiverMode::kHasReceiver) {
     pop_count = assembler_->IntPtrAdd(argc_, assembler_->IntPtrConstant(1));
@@ -13168,43 +12671,35 @@ TNode<BoolT> CodeStubAssembler::IsElementsKindLessThanOrEqual(
   return Int32LessThanOrEqual(target_kind, Int32Constant(reference_kind));
 }
 
-TNode<BoolT> CodeStubAssembler::IsElementsKindInRange(
-    TNode<Int32T> target_kind, ElementsKind lower_reference_kind,
-    ElementsKind higher_reference_kind) {
-  return Uint32LessThanOrEqual(
-      Int32Sub(target_kind, Int32Constant(lower_reference_kind)),
-      Int32Constant(higher_reference_kind - lower_reference_kind));
-}
-
-Node* CodeStubAssembler::IsDebugActive() {
+TNode<BoolT> CodeStubAssembler::IsDebugActive() {
   TNode<Uint8T> is_debug_active = Load<Uint8T>(
       ExternalConstant(ExternalReference::debug_is_active_address(isolate())));
   return Word32NotEqual(is_debug_active, Int32Constant(0));
 }
 
-Node* CodeStubAssembler::IsPromiseHookEnabled() {
-  TNode<RawPtrT> const promise_hook = Load<RawPtrT>(
+TNode<BoolT> CodeStubAssembler::IsPromiseHookEnabled() {
+  const TNode<RawPtrT> promise_hook = Load<RawPtrT>(
       ExternalConstant(ExternalReference::promise_hook_address(isolate())));
   return WordNotEqual(promise_hook, IntPtrConstant(0));
 }
 
-Node* CodeStubAssembler::HasAsyncEventDelegate() {
-  TNode<RawPtrT> const async_event_delegate = Load<RawPtrT>(ExternalConstant(
+TNode<BoolT> CodeStubAssembler::HasAsyncEventDelegate() {
+  const TNode<RawPtrT> async_event_delegate = Load<RawPtrT>(ExternalConstant(
       ExternalReference::async_event_delegate_address(isolate())));
   return WordNotEqual(async_event_delegate, IntPtrConstant(0));
 }
 
-Node* CodeStubAssembler::IsPromiseHookEnabledOrHasAsyncEventDelegate() {
-  TNode<Uint8T> const promise_hook_or_async_event_delegate =
+TNode<BoolT> CodeStubAssembler::IsPromiseHookEnabledOrHasAsyncEventDelegate() {
+  const TNode<Uint8T> promise_hook_or_async_event_delegate =
       Load<Uint8T>(ExternalConstant(
           ExternalReference::promise_hook_or_async_event_delegate_address(
               isolate())));
   return Word32NotEqual(promise_hook_or_async_event_delegate, Int32Constant(0));
 }
 
-Node* CodeStubAssembler::
+TNode<BoolT> CodeStubAssembler::
     IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate() {
-  TNode<Uint8T> const promise_hook_or_debug_is_active_or_async_event_delegate =
+  const TNode<Uint8T> promise_hook_or_debug_is_active_or_async_event_delegate =
       Load<Uint8T>(ExternalConstant(
           ExternalReference::
               promise_hook_or_debug_is_active_or_async_event_delegate_address(
@@ -13334,14 +12829,14 @@ TNode<Code> CodeStubAssembler::GetSharedFunctionInfoCode(
 TNode<JSFunction> CodeStubAssembler::AllocateFunctionWithMapAndContext(
     TNode<Map> map, TNode<SharedFunctionInfo> shared_info,
     TNode<Context> context) {
-  TNode<Code> const code = GetSharedFunctionInfoCode(shared_info);
+  const TNode<Code> code = GetSharedFunctionInfoCode(shared_info);
 
   // TODO(ishell): All the callers of this function pass map loaded from
   // Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX. So we can remove
   // map parameter.
   CSA_ASSERT(this, Word32BinaryNot(IsConstructorMap(map)));
   CSA_ASSERT(this, Word32BinaryNot(IsFunctionWithPrototypeSlotMap(map)));
-  TNode<HeapObject> const fun = Allocate(JSFunction::kSizeWithoutPrototype);
+  const TNode<HeapObject> fun = Allocate(JSFunction::kSizeWithoutPrototype);
   STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kTaggedSize);
   StoreMapNoWriteBarrier(fun, map);
   StoreObjectFieldRoot(fun, JSObject::kPropertiesOrHashOffset,
@@ -13385,7 +12880,7 @@ void CodeStubAssembler::CheckPrototypeEnumCache(Node* receiver,
 
     // It might still be an empty JSArray.
     GotoIfNot(IsJSArrayMap(object_map), if_slow);
-    TNode<Number> object_length = LoadJSArrayLength(object);
+    TNode<Number> object_length = LoadJSArrayLength(CAST(object));
     Branch(TaggedEqual(object_length, SmiConstant(0)), &if_no_elements,
            if_slow);
 
@@ -13420,7 +12915,12 @@ TNode<Map> CodeStubAssembler::CheckEnumCache(TNode<HeapObject> receiver,
   {
     // Avoid runtime-call for empty dictionary receivers.
     GotoIfNot(IsDictionaryMap(receiver_map), if_runtime);
-    TNode<NameDictionary> properties = CAST(LoadSlowProperties(CAST(receiver)));
+    TNode<HashTableBase> properties =
+        UncheckedCast<HashTableBase>(LoadSlowProperties(CAST(receiver)));
+    CSA_ASSERT(this, Word32Or(IsNameDictionary(properties),
+                              IsGlobalDictionary(properties)));
+    STATIC_ASSERT(static_cast<int>(NameDictionary::kNumberOfElementsIndex) ==
+                  static_cast<int>(GlobalDictionary::kNumberOfElementsIndex));
     TNode<Smi> length = GetNumberOfElements(properties);
     GotoIfNot(TaggedEqual(length, SmiConstant(0)), if_runtime);
     // Check that there are no elements on the {receiver} and its prototype
@@ -13456,7 +12956,8 @@ void CodeStubAssembler::Print(const char* s) {
               StringConstant(formatted.c_str()));
 }
 
-void CodeStubAssembler::Print(const char* prefix, Node* tagged_value) {
+void CodeStubAssembler::Print(const char* prefix,
+                              SloppyTNode<MaybeObject> tagged_value) {
   if (prefix != nullptr) {
     std::string formatted(prefix);
     formatted += ": ";
@@ -13465,7 +12966,10 @@ void CodeStubAssembler::Print(const char* prefix, Node* tagged_value) {
     CallRuntime(Runtime::kGlobalPrint, NoContextConstant(),
                 HeapConstant(string));
   }
-  CallRuntime(Runtime::kDebugPrint, NoContextConstant(), tagged_value);
+  // CallRuntime only accepts Objects, so do an UncheckedCast to object.
+  // DebugPrint explicitly checks whether the tagged value is a MaybeObject.
+  TNode<Object> arg = UncheckedCast<Object>(tagged_value);
+  CallRuntime(Runtime::kDebugPrint, NoContextConstant(), arg);
 }
 
 void CodeStubAssembler::PerformStackCheck(TNode<Context> context) {
@@ -13485,23 +12989,33 @@ void CodeStubAssembler::PerformStackCheck(TNode<Context> context) {
   BIND(&ok);
 }
 
-void CodeStubAssembler::InitializeFunctionContext(Node* native_context,
-                                                  Node* context, int slots) {
+TNode<Context> CodeStubAssembler::AllocateSyntheticFunctionContext(
+    TNode<NativeContext> native_context, int slots) {
+  DCHECK_GE(slots, Context::MIN_CONTEXT_SLOTS);
+  TNode<HeapObject> context_heap_object =
+      AllocateInNewSpace(FixedArray::SizeFor(slots));
+  InitializeSyntheticFunctionContext(native_context, context_heap_object,
+                                     slots);
+  return CAST(context_heap_object);
+}
+
+void CodeStubAssembler::InitializeSyntheticFunctionContext(
+    TNode<NativeContext> native_context, TNode<HeapObject> context_heap_object,
+    int slots) {
   DCHECK_GE(slots, Context::MIN_CONTEXT_SLOTS);
-  StoreMapNoWriteBarrier(context, RootIndex::kFunctionContextMap);
-  StoreObjectFieldNoWriteBarrier(context, FixedArray::kLengthOffset,
+  TNode<Map> map = CAST(
+      LoadContextElement(native_context, Context::FUNCTION_CONTEXT_MAP_INDEX));
+  StoreMapNoWriteBarrier(context_heap_object, map);
+  StoreObjectFieldNoWriteBarrier(context_heap_object, FixedArray::kLengthOffset,
                                  SmiConstant(slots));
 
-  TNode<Object> const empty_scope_info =
+  TNode<Context> context = CAST(context_heap_object);
+  const TNode<Object> empty_scope_info =
       LoadContextElement(native_context, Context::SCOPE_INFO_INDEX);
   StoreContextElementNoWriteBarrier(context, Context::SCOPE_INFO_INDEX,
                                     empty_scope_info);
   StoreContextElementNoWriteBarrier(context, Context::PREVIOUS_INDEX,
                                     UndefinedConstant());
-  StoreContextElementNoWriteBarrier(context, Context::EXTENSION_INDEX,
-                                    TheHoleConstant());
-  StoreContextElementNoWriteBarrier(context, Context::NATIVE_CONTEXT_INDEX,
-                                    native_context);
 }
 
 TNode<JSArray> CodeStubAssembler::ArrayCreate(TNode<Context> context,
@@ -13532,7 +13046,7 @@ TNode<JSArray> CodeStubAssembler::ArrayCreate(TNode<Context> context,
   }
 
   BIND(&next);
-  CSA_ASSERT(this, TaggedIsSmi(length));
+  TNode<Smi> length_smi = CAST(length);
 
   TNode<Map> array_map = CAST(LoadContextElement(
       context, Context::JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX));
@@ -13540,8 +13054,8 @@ TNode<JSArray> CodeStubAssembler::ArrayCreate(TNode<Context> context,
   // TODO(delphick): Consider using
   // AllocateUninitializedJSArrayWithElements to avoid initializing an
   // array and then writing over it.
-  array = AllocateJSArray(PACKED_SMI_ELEMENTS, array_map, length,
-                          SmiConstant(0), {}, ParameterMode::SMI_PARAMETERS);
+  array = AllocateJSArray(PACKED_SMI_ELEMENTS, array_map, length_smi,
+                          SmiConstant(0));
   Goto(&done);
 
   BIND(&done);
@@ -13589,6 +13103,21 @@ void CodeStubAssembler::SetPropertyLength(TNode<Context> context,
   BIND(&done);
 }
 
+TNode<Smi> CodeStubAssembler::RefillMathRandom(
+    TNode<NativeContext> native_context) {
+  // Cache exhausted, populate the cache. Return value is the new index.
+  const TNode<ExternalReference> refill_math_random =
+      ExternalConstant(ExternalReference::refill_math_random());
+  const TNode<ExternalReference> isolate_ptr =
+      ExternalConstant(ExternalReference::isolate_address(isolate()));
+  MachineType type_tagged = MachineType::AnyTagged();
+  MachineType type_ptr = MachineType::Pointer();
+
+  return CAST(CallCFunction(refill_math_random, type_tagged,
+                            std::make_pair(type_ptr, isolate_ptr),
+                            std::make_pair(type_tagged, native_context)));
+}
+
 TNode<String> CodeStubAssembler::TaggedToDirectString(TNode<Object> value,
                                                       Label* fail) {
   ToDirectStringAssembler to_direct(state(), CAST(value));
diff --git a/deps/v8/src/codegen/code-stub-assembler.h b/deps/v8/src/codegen/code-stub-assembler.h
index eee3e7a376a9d3..6eb9baef69980e 100644
--- a/deps/v8/src/codegen/code-stub-assembler.h
+++ b/deps/v8/src/codegen/code-stub-assembler.h
@@ -15,6 +15,7 @@
 #include "src/objects/arguments.h"
 #include "src/objects/bigint.h"
 #include "src/objects/objects.h"
+#include "src/objects/promise.h"
 #include "src/objects/shared-function-info.h"
 #include "src/objects/smi.h"
 #include "src/roots/roots.h"
@@ -92,6 +93,7 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
   V(GlobalPropertyCellMap, global_property_cell_map, PropertyCellMap)          \
   V(has_instance_symbol, has_instance_symbol, HasInstanceSymbol)               \
   V(HeapNumberMap, heap_number_map, HeapNumberMap)                             \
+  V(Infinity_string, Infinity_string, InfinityString)                          \
   V(is_concat_spreadable_symbol, is_concat_spreadable_symbol,                  \
     IsConcatSpreadableSymbol)                                                  \
   V(iterator_symbol, iterator_symbol, IteratorSymbol)                          \
@@ -100,11 +102,11 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
   V(match_symbol, match_symbol, MatchSymbol)                                   \
   V(megamorphic_symbol, megamorphic_symbol, MegamorphicSymbol)                 \
   V(MetaMap, meta_map, MetaMap)                                                \
+  V(minus_Infinity_string, minus_Infinity_string, MinusInfinityString)         \
   V(MinusZeroValue, minus_zero_value, MinusZero)                               \
-  V(ModuleContextMap, module_context_map, ModuleContextMap)                    \
   V(name_string, name_string, NameString)                                      \
   V(NanValue, nan_value, Nan)                                                  \
-  V(NativeContextMap, native_context_map, NativeContextMap)                    \
+  V(NaN_string, NaN_string, NaNString)                                         \
   V(next_string, next_string, NextString)                                      \
   V(NoClosuresCellMap, no_closures_cell_map, NoClosuresCellMap)                \
   V(null_to_string, null_to_string, NullToString)                              \
@@ -113,27 +115,43 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
   V(number_to_string, number_to_string, NumberToString)                        \
   V(Object_string, Object_string, ObjectString)                                \
   V(object_to_string, object_to_string, ObjectToString)                        \
+  V(OneByteStringMap, one_byte_string_map, OneByteStringMap)                   \
   V(OneClosureCellMap, one_closure_cell_map, OneClosureCellMap)                \
   V(OnePointerFillerMap, one_pointer_filler_map, OnePointerFillerMap)          \
   V(PreparseDataMap, preparse_data_map, PreparseDataMap)                       \
   V(PromiseCapabilityMap, promise_capability_map, PromiseCapabilityMap)        \
+  V(promise_forwarding_handler_symbol, promise_forwarding_handler_symbol,      \
+    PromiseForwardingHandlerSymbol)                                            \
   V(PromiseFulfillReactionJobTaskMap, promise_fulfill_reaction_job_task_map,   \
     PromiseFulfillReactionJobTaskMap)                                          \
+  V(promise_handled_by_symbol, promise_handled_by_symbol,                      \
+    PromiseHandledBySymbol)                                                    \
   V(PromiseReactionMap, promise_reaction_map, PromiseReactionMap)              \
   V(PromiseRejectReactionJobTaskMap, promise_reject_reaction_job_task_map,     \
     PromiseRejectReactionJobTaskMap)                                           \
+  V(PromiseResolveThenableJobTaskMap, promise_resolve_thenable_job_task_map,   \
+    PromiseResolveThenableJobTaskMap)                                          \
   V(prototype_string, prototype_string, PrototypeString)                       \
   V(PrototypeInfoMap, prototype_info_map, PrototypeInfoMap)                    \
+  V(replace_symbol, replace_symbol, ReplaceSymbol)                             \
   V(regexp_to_string, regexp_to_string, RegexpToString)                        \
   V(resolve_string, resolve_string, ResolveString)                             \
+  V(return_string, return_string, ReturnString)                                \
   V(SharedFunctionInfoMap, shared_function_info_map, SharedFunctionInfoMap)    \
   V(SloppyArgumentsElementsMap, sloppy_arguments_elements_map,                 \
     SloppyArgumentsElementsMap)                                                \
+  V(SmallOrderedHashSetMap, small_ordered_hash_set_map,                        \
+    SmallOrderedHashSetMap)                                                    \
+  V(SmallOrderedHashMapMap, small_ordered_hash_map_map,                        \
+    SmallOrderedHashMapMap)                                                    \
+  V(SmallOrderedNameDictionaryMap, small_ordered_name_dictionary_map,          \
+    SmallOrderedNameDictionaryMap)                                             \
   V(species_symbol, species_symbol, SpeciesSymbol)                             \
   V(StaleRegister, stale_register, StaleRegister)                              \
   V(StoreHandler0Map, store_handler0_map, StoreHandler0Map)                    \
   V(string_string, string_string, StringString)                                \
   V(string_to_string, string_to_string, StringToString)                        \
+  V(StringMap, string_map, StringMap)                                          \
   V(SymbolMap, symbol_map, SymbolMap)                                          \
   V(TheHoleValue, the_hole_value, TheHole)                                     \
   V(then_string, then_string, ThenString)                                      \
@@ -141,7 +159,10 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
   V(TransitionArrayMap, transition_array_map, TransitionArrayMap)              \
   V(TrueValue, true_value, True)                                               \
   V(Tuple2Map, tuple2_map, Tuple2Map)                                          \
-  V(Tuple3Map, tuple3_map, Tuple3Map)                                          \
+  V(BreakPointMap, break_point_map, BreakPointMap)                             \
+  V(BreakPointInfoMap, break_point_info_map, BreakPointInfoMap)                \
+  V(CachedTemplateObjectMap, cached_template_object_map,                       \
+    CachedTemplateObjectMap)                                                   \
   V(UncompiledDataWithoutPreparseDataMap,                                      \
     uncompiled_data_without_preparse_data_map,                                 \
     UncompiledDataWithoutPreparseDataMap)                                      \
@@ -150,19 +171,16 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
   V(undefined_to_string, undefined_to_string, UndefinedToString)               \
   V(UndefinedValue, undefined_value, Undefined)                                \
   V(uninitialized_symbol, uninitialized_symbol, UninitializedSymbol)           \
-  V(WeakFixedArrayMap, weak_fixed_array_map, WeakFixedArrayMap)
+  V(WeakFixedArrayMap, weak_fixed_array_map, WeakFixedArrayMap)                \
+  V(zero_string, zero_string, ZeroString)
 
 #define HEAP_IMMOVABLE_OBJECT_LIST(V)   \
   HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(V) \
   HEAP_IMMUTABLE_IMMOVABLE_OBJECT_LIST(V)
 
 #ifdef DEBUG
-#define CSA_CHECK(csa, x)                              \
-  (csa)->Check(                                        \
-      [&]() -> compiler::Node* {                       \
-        return implicit_cast<SloppyTNode<Word32T>>(x); \
-      },                                               \
-      #x, __FILE__, __LINE__)
+#define CSA_CHECK(csa, x) \
+  (csa)->Check([&]() -> TNode<BoolT> { return x; }, #x, __FILE__, __LINE__)
 #else
 #define CSA_CHECK(csa, x) (csa)->FastCheck(x)
 #endif
@@ -198,8 +216,8 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
 
 #define CSA_ASSERT_JS_ARGC_OP(csa, Op, op, expected)                         \
   (csa)->Assert(                                                             \
-      [&]() -> compiler::Node* {                                             \
-        TNode<Word32T> const argc = UncheckedCast<Word32T>(                  \
+      [&]() -> TNode<BoolT> {                                                \
+        const TNode<Word32T> argc = UncheckedCast<Word32T>(                  \
             (csa)->Parameter(Descriptor::kJSActualArgumentsCount));          \
         return (csa)->Op(argc, (csa)->Int32Constant(expected));              \
       },                                                                     \
@@ -453,6 +471,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     return CAST(heap_object);
   }
 
+  TNode<JSFunction> HeapObjectToJSFunctionWithPrototypeSlot(
+      TNode<HeapObject> heap_object, Label* fail) {
+    GotoIfNot(IsJSFunctionWithPrototypeSlot(heap_object), fail);
+    return CAST(heap_object);
+  }
+
   Node* MatchesParameterMode(Node* value, ParameterMode mode);
 
 #define PARAMETER_BINOP(OpName, IntPtrOpName, SmiOpName)                    \
@@ -470,6 +494,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<IntPtrT> OpName(TNode<IntPtrT> a, TNode<IntPtrT> b) {               \
     return IntPtrOpName(a, b);                                              \
   }                                                                         \
+  TNode<UintPtrT> OpName(TNode<UintPtrT> a, TNode<UintPtrT> b) {            \
+    return Unsigned(IntPtrOpName(Signed(a), Signed(b)));                    \
+  }                                                                         \
   TNode<RawPtrT> OpName(TNode<RawPtrT> a, TNode<RawPtrT> b) {               \
     return ReinterpretCast<RawPtrT>(IntPtrOpName(                           \
         ReinterpretCast<IntPtrT>(a), ReinterpretCast<IntPtrT>(b)));         \
@@ -495,6 +522,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> OpName(TNode<IntPtrT> a, TNode<IntPtrT> b) {                   \
     return IntPtrOpName(a, b);                                                \
   }                                                                           \
+  TNode<BoolT> OpName(TNode<UintPtrT> a, TNode<UintPtrT> b) {                 \
+    return IntPtrOpName(Signed(a), Signed(b));                                \
+  }                                                                           \
   TNode<BoolT> OpName(TNode<RawPtrT> a, TNode<RawPtrT> b) {                   \
     return IntPtrOpName(a, b);                                                \
   }
@@ -520,12 +550,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   uintptr_t ConstexprWordNot(uintptr_t a) { return ~a; }
 
   TNode<BoolT> TaggedEqual(TNode<AnyTaggedT> a, TNode<AnyTaggedT> b) {
-#ifdef V8_COMPRESS_POINTERS
-    return Word32Equal(ChangeTaggedToCompressed(a),
-                       ChangeTaggedToCompressed(b));
-#else
-    return WordEqual(ReinterpretCast<WordT>(a), ReinterpretCast<WordT>(b));
-#endif
+    if (COMPRESS_POINTERS_BOOL) {
+      return Word32Equal(ReinterpretCast<Word32T>(a),
+                         ReinterpretCast<Word32T>(b));
+    } else {
+      return WordEqual(ReinterpretCast<WordT>(a), ReinterpretCast<WordT>(b));
+    }
   }
 
   TNode<BoolT> TaggedNotEqual(TNode<AnyTaggedT> a, TNode<AnyTaggedT> b) {
@@ -577,6 +607,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // Select the minimum of the two provided IntPtr values.
   TNode<IntPtrT> IntPtrMin(SloppyTNode<IntPtrT> left,
                            SloppyTNode<IntPtrT> right);
+  TNode<UintPtrT> UintPtrMin(TNode<UintPtrT> left, TNode<UintPtrT> right);
 
   // Float64 operations.
   TNode<Float64T> Float64Ceil(SloppyTNode<Float64T> x);
@@ -589,12 +620,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // Select the minimum of the two provided Number values.
   TNode<Number> NumberMin(SloppyTNode<Number> left, SloppyTNode<Number> right);
 
-  // After converting an index to an integer, calculate a relative index: if
-  // index < 0, max(length + index, 0); else min(index, length)
-  TNode<IntPtrT> ConvertToRelativeIndex(TNode<Context> context,
-                                        TNode<Object> index,
-                                        TNode<IntPtrT> length);
-
   // Returns true iff the given value fits into smi range and is >= 0.
   TNode<BoolT> IsValidPositiveSmi(TNode<IntPtrT> value);
 
@@ -634,7 +659,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   SMI_ARITHMETIC_BINOP(SmiAnd, WordAnd, Word32And)
   SMI_ARITHMETIC_BINOP(SmiOr, WordOr, Word32Or)
 #undef SMI_ARITHMETIC_BINOP
-  TNode<Smi> SmiInc(TNode<Smi> value) { return SmiAdd(value, SmiConstant(1)); }
 
   TNode<IntPtrT> TryIntPtrAdd(TNode<IntPtrT> a, TNode<IntPtrT> b,
                               Label* if_overflow);
@@ -644,6 +668,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                             Label* if_overflow);
   TNode<Smi> TrySmiAdd(TNode<Smi> a, TNode<Smi> b, Label* if_overflow);
   TNode<Smi> TrySmiSub(TNode<Smi> a, TNode<Smi> b, Label* if_overflow);
+  TNode<Smi> TrySmiAbs(TNode<Smi> a, Label* if_overflow);
 
   TNode<Smi> SmiShl(TNode<Smi> a, int shift) {
     return BitcastWordToTaggedSigned(
@@ -779,11 +804,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<Number> NumberDec(SloppyTNode<Number> value);
   TNode<Number> NumberAdd(SloppyTNode<Number> a, SloppyTNode<Number> b);
   TNode<Number> NumberSub(SloppyTNode<Number> a, SloppyTNode<Number> b);
-  void GotoIfNotNumber(Node* value, Label* is_not_number);
-  void GotoIfNumber(Node* value, Label* is_number);
+  void GotoIfNotNumber(TNode<Object> value, Label* is_not_number);
+  void GotoIfNumber(TNode<Object> value, Label* is_number);
   TNode<Number> SmiToNumber(TNode<Smi> v) { return v; }
 
-  TNode<Number> BitwiseOp(Node* left32, Node* right32, Operation bitwise_op);
+  TNode<Number> BitwiseOp(TNode<Word32T> left32, TNode<Word32T> right32,
+                          Operation bitwise_op);
 
   // Allocate an object of the given size.
   TNode<HeapObject> AllocateInNewSpace(TNode<IntPtrT> size,
@@ -791,6 +817,10 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<HeapObject> AllocateInNewSpace(int size, AllocationFlags flags = kNone);
   TNode<HeapObject> Allocate(TNode<IntPtrT> size,
                              AllocationFlags flags = kNone);
+  TNode<HeapObject> AllocateAllowLOS(TNode<IntPtrT> size) {
+    return Allocate(size, AllocationFlag::kAllowLargeObjectAllocation);
+  }
+
   TNode<HeapObject> Allocate(int size, AllocationFlags flags = kNone);
   TNode<HeapObject> InnerAllocate(TNode<HeapObject> previous, int offset);
   TNode<HeapObject> InnerAllocate(TNode<HeapObject> previous,
@@ -799,13 +829,14 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> IsRegularHeapObjectSize(TNode<IntPtrT> size);
 
   using BranchGenerator = std::function<void(Label*, Label*)>;
-  using NodeGenerator = std::function<Node*()>;
-  using ExtraNode = std::pair<Node*, const char*>;
+  template <typename T>
+  using NodeGenerator = std::function<TNode<T>()>;
+  using ExtraNode = std::pair<TNode<Object>, const char*>;
 
   void Assert(const BranchGenerator& branch, const char* message,
               const char* file, int line,
               std::initializer_list<ExtraNode> extra_nodes = {});
-  void Assert(const NodeGenerator& condition_body, const char* message,
+  void Assert(const NodeGenerator<BoolT>& condition_body, const char* message,
               const char* file, int line,
               std::initializer_list<ExtraNode> extra_nodes = {});
   void Assert(SloppyTNode<Word32T> condition_node, const char* message,
@@ -814,7 +845,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   void Check(const BranchGenerator& branch, const char* message,
              const char* file, int line,
              std::initializer_list<ExtraNode> extra_nodes = {});
-  void Check(const NodeGenerator& condition_body, const char* message,
+  void Check(const NodeGenerator<BoolT>& condition_body, const char* message,
              const char* file, int line,
              std::initializer_list<ExtraNode> extra_nodes = {});
   void Check(SloppyTNode<Word32T> condition_node, const char* message,
@@ -862,14 +893,26 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     return ConstructWithTarget(context, new_target, new_target, args...);
   }
 
-  template <class A, class F, class G>
-  TNode<A> Select(SloppyTNode<BoolT> condition, const F& true_body,
-                  const G& false_body) {
-    return UncheckedCast<A>(SelectImpl(
-        condition,
-        [&]() -> Node* { return implicit_cast<TNode<A>>(true_body()); },
-        [&]() -> Node* { return implicit_cast<TNode<A>>(false_body()); },
-        MachineRepresentationOf<A>::value));
+  template <typename T>
+  TNode<T> Select(TNode<BoolT> condition, const NodeGenerator<T>& true_body,
+                  const NodeGenerator<T>& false_body) {
+    TVARIABLE(T, value);
+    Label vtrue(this), vfalse(this), end(this);
+    Branch(condition, &vtrue, &vfalse);
+
+    BIND(&vtrue);
+    {
+      value = true_body();
+      Goto(&end);
+    }
+    BIND(&vfalse);
+    {
+      value = false_body();
+      Goto(&end);
+    }
+
+    BIND(&end);
+    return value.value();
   }
 
   template <class A>
@@ -911,20 +954,31 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<Int32T> TruncateIntPtrToInt32(SloppyTNode<IntPtrT> value);
 
   // Check a value for smi-ness
-  TNode<BoolT> TaggedIsSmi(TNode<MaybeObject> a);
-  TNode<BoolT> TaggedIsSmi(SloppyTNode<Object> a) {
-    return TaggedIsSmi(UncheckedCast<MaybeObject>(a));
-  }
-  TNode<BoolT> TaggedIsNotSmi(TNode<MaybeObject> a);
-  TNode<BoolT> TaggedIsNotSmi(SloppyTNode<Object> a) {
-    return TaggedIsNotSmi(UncheckedCast<MaybeObject>(a));
-  }
+  TNode<BoolT> TaggedIsSmi(SloppyTNode<MaybeObject> a);
+  TNode<BoolT> TaggedIsNotSmi(SloppyTNode<MaybeObject> a);
+
   // Check that the value is a non-negative smi.
   TNode<BoolT> TaggedIsPositiveSmi(SloppyTNode<Object> a);
   // Check that a word has a word-aligned address.
   TNode<BoolT> WordIsAligned(SloppyTNode<WordT> word, size_t alignment);
   TNode<BoolT> WordIsPowerOfTwo(SloppyTNode<IntPtrT> value);
 
+  // Check if lower_limit <= value <= higher_limit.
+  template <typename U>
+  TNode<BoolT> IsInRange(TNode<Word32T> value, U lower_limit, U higher_limit) {
+    DCHECK_LE(lower_limit, higher_limit);
+    STATIC_ASSERT(sizeof(U) <= kInt32Size);
+    return Uint32LessThanOrEqual(Int32Sub(value, Int32Constant(lower_limit)),
+                                 Int32Constant(higher_limit - lower_limit));
+  }
+
+  TNode<BoolT> IsInRange(TNode<WordT> value, intptr_t lower_limit,
+                         intptr_t higher_limit) {
+    DCHECK_LE(lower_limit, higher_limit);
+    return UintPtrLessThanOrEqual(IntPtrSub(value, IntPtrConstant(lower_limit)),
+                                  IntPtrConstant(higher_limit - lower_limit));
+  }
+
 #if DEBUG
   void Bind(Label* label, AssemblerDebugInfo debug_info);
 #endif  // DEBUG
@@ -979,24 +1033,25 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   void GotoIfForceSlowPath(Label* if_true);
 
   // Load value from current parent frame by given offset in bytes.
-  Node* LoadFromParentFrame(int offset,
-                            MachineType type = MachineType::AnyTagged());
+  TNode<Object> LoadFromParentFrame(int offset);
 
   // Load an object pointer from a buffer that isn't in the heap.
-  Node* LoadBufferObject(Node* buffer, int offset, MachineType type);
-  TNode<Object> LoadBufferObject(TNode<RawPtrT> buffer, int offset) {
-    return CAST(LoadBufferObject(buffer, offset, MachineType::AnyTagged()));
+  template <typename T = Object>
+  TNode<T> LoadBufferObject(TNode<RawPtrT> buffer, int offset) {
+    return CAST(Load(MachineTypeOf<T>::value, buffer, IntPtrConstant(offset)));
+  }
+  template <typename T>
+  TNode<T> LoadBufferData(TNode<RawPtrT> buffer, int offset) {
+    return UncheckedCast<T>(
+        Load(MachineTypeOf<T>::value, buffer, IntPtrConstant(offset)));
   }
   TNode<RawPtrT> LoadBufferPointer(TNode<RawPtrT> buffer, int offset) {
-    return UncheckedCast<RawPtrT>(
-        LoadBufferObject(buffer, offset, MachineType::Pointer()));
+    return LoadBufferData<RawPtrT>(buffer, offset);
   }
   TNode<Smi> LoadBufferSmi(TNode<RawPtrT> buffer, int offset) {
-    return CAST(LoadBufferObject(buffer, offset, MachineType::TaggedSigned()));
+    return LoadBufferObject<Smi>(buffer, offset);
   }
   // Load a field from an object on the heap.
-  Node* LoadObjectField(SloppyTNode<HeapObject> object, int offset,
-                        MachineType type);
   template <class T, typename std::enable_if<
                          std::is_convertible<TNode<T>, TNode<Object>>::value,
                          int>::type = 0>
@@ -1014,8 +1069,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     return UncheckedCast<Object>(
         LoadObjectField(object, offset, MachineType::AnyTagged()));
   }
-  Node* LoadObjectField(SloppyTNode<HeapObject> object,
-                        SloppyTNode<IntPtrT> offset, MachineType type);
   TNode<Object> LoadObjectField(SloppyTNode<HeapObject> object,
                                 SloppyTNode<IntPtrT> offset) {
     return UncheckedCast<Object>(
@@ -1042,7 +1095,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   }
 
   TNode<Object> LoadConstructorOrBackPointer(TNode<Map> map) {
-    return LoadObjectField(map, Map::kConstructorOrBackPointerOffset);
+    return LoadObjectField(map,
+                           Map::kConstructorOrBackPointerOrNativeContextOffset);
   }
 
   // Reference is the CSA-equivalent of a Torque reference value,
@@ -1066,9 +1120,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     return CAST(
         LoadFromObject(MachineTypeOf<T>::value, reference.object, offset));
   }
-  template <class T, typename std::enable_if<
-                         std::is_convertible<TNode<T>, TNode<UntaggedT>>::value,
-                         int>::type = 0>
+  template <class T,
+            typename std::enable_if<
+                std::is_convertible<TNode<T>, TNode<UntaggedT>>::value ||
+                    std::is_same<T, MaybeObject>::value,
+                int>::type = 0>
   TNode<T> LoadReference(Reference reference) {
     TNode<IntPtrT> offset =
         IntPtrSub(reference.offset, IntPtrConstant(kHeapObjectTag));
@@ -1076,7 +1132,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
         LoadFromObject(MachineTypeOf<T>::value, reference.object, offset));
   }
   template <class T, typename std::enable_if<
-                         std::is_convertible<TNode<T>, TNode<Object>>::value,
+                         std::is_convertible<TNode<T>, TNode<Object>>::value ||
+                             std::is_same<T, MaybeObject>::value,
                          int>::type = 0>
   void StoreReference(Reference reference, TNode<T> value) {
     MachineRepresentation rep = MachineRepresentationOf<T>::value;
@@ -1125,10 +1182,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     return LoadJSObjectElements(object);
   }
   // Load the length of a JSArray instance.
-  TNode<Object> LoadJSArgumentsObjectWithLength(
-      SloppyTNode<JSArgumentsObjectWithLength> array);
-  // Load the length of a JSArray instance.
-  TNode<Number> LoadJSArrayLength(SloppyTNode<JSArray> array);
+  TNode<Object> LoadJSArgumentsObjectLength(TNode<Context> context,
+                                            TNode<JSArgumentsObject> array);
   // Load the length of a fast JSArray instance. Returns a positive Smi.
   TNode<Smi> LoadFastJSArrayLength(SloppyTNode<JSArray> array);
   // Load the length of a fixed array base instance.
@@ -1159,10 +1214,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<DescriptorArray> LoadMapDescriptors(SloppyTNode<Map> map);
   // Load the prototype of a map.
   TNode<HeapObject> LoadMapPrototype(SloppyTNode<Map> map);
-  // Load the prototype info of a map. The result has to be checked if it is a
-  // prototype info object or not.
-  TNode<PrototypeInfo> LoadMapPrototypeInfo(SloppyTNode<Map> map,
-                                            Label* if_has_no_proto_info);
   // Load the instance size of a Map.
   TNode<IntPtrT> LoadMapInstanceSizeInWords(SloppyTNode<Map> map);
   // Load the inobject properties start of a Map (valid only for JSObjects).
@@ -1185,8 +1236,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   // This is only used on a newly allocated PropertyArray which
   // doesn't have an existing hash.
-  void InitializePropertyArrayLength(Node* property_array, Node* length,
-                                     ParameterMode mode);
+  void InitializePropertyArrayLength(TNode<PropertyArray> property_array,
+                                     Node* length, ParameterMode mode);
 
   // Check if the map is set for slow properties.
   TNode<BoolT> IsDictionaryMap(SloppyTNode<Map> map);
@@ -1200,7 +1251,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                               Label* if_hash_not_computed = nullptr);
 
   // Load length field of a String object as Smi value.
-  TNode<Smi> LoadStringLengthAsSmi(SloppyTNode<String> string);
+  TNode<Smi> LoadStringLengthAsSmi(TNode<String> string);
   // Load length field of a String object as intptr_t value.
   TNode<IntPtrT> LoadStringLengthAsWord(SloppyTNode<String> string);
   // Load length field of a String object as uint32_t value.
@@ -1221,10 +1272,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                            TVariable<Object>* extracted);
   // See MaybeObject for semantics of these functions.
   TNode<BoolT> IsStrong(TNode<MaybeObject> value);
-  // This variant is for overzealous checking.
-  TNode<BoolT> IsStrong(TNode<Object> value) {
-    return IsStrong(ReinterpretCast<MaybeObject>(value));
-  }
   TNode<HeapObject> GetHeapObjectIfStrong(TNode<MaybeObject> value,
                                           Label* if_not_strong);
 
@@ -1376,9 +1423,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
       ParameterMode parameter_mode = INTPTR_PARAMETERS,
       Label* if_hole = nullptr);
 
-  Node* LoadFixedDoubleArrayElement(TNode<FixedDoubleArray> object,
-                                    TNode<Smi> index,
-                                    Label* if_hole = nullptr) {
+  TNode<Float64T> LoadFixedDoubleArrayElement(TNode<FixedDoubleArray> object,
+                                              TNode<Smi> index,
+                                              Label* if_hole = nullptr) {
     return LoadFixedDoubleArrayElement(object, index, MachineType::Float64(), 0,
                                        SMI_PARAMETERS, if_hole);
   }
@@ -1413,24 +1460,24 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<Float64T> LoadDoubleWithHoleCheck(TNode<FixedDoubleArray> array,
                                           TNode<IntPtrT> index,
                                           Label* if_hole = nullptr);
+  TNode<Float64T> LoadDoubleWithHoleCheck(TNode<FixedDoubleArray> array,
+                                          TNode<UintPtrT> index,
+                                          Label* if_hole = nullptr) {
+    return LoadDoubleWithHoleCheck(array, Signed(index), if_hole);
+  }
 
+  TNode<BoolT> IsDoubleHole(TNode<Object> base, TNode<IntPtrT> offset);
   // Load Float64 value by |base| + |offset| address. If the value is a double
   // hole then jump to |if_hole|. If |machine_type| is None then only the hole
   // check is generated.
   TNode<Float64T> LoadDoubleWithHoleCheck(
       SloppyTNode<Object> base, SloppyTNode<IntPtrT> offset, Label* if_hole,
       MachineType machine_type = MachineType::Float64());
+  TNode<Numeric> LoadFixedTypedArrayElementAsTagged(TNode<RawPtrT> data_pointer,
+                                                    TNode<UintPtrT> index,
+                                                    ElementsKind elements_kind);
   TNode<Numeric> LoadFixedTypedArrayElementAsTagged(
-      TNode<RawPtrT> data_pointer, Node* index_node, ElementsKind elements_kind,
-      ParameterMode parameter_mode = INTPTR_PARAMETERS);
-  TNode<Numeric> LoadFixedTypedArrayElementAsTagged(
-      TNode<RawPtrT> data_pointer, TNode<Smi> index_node,
-      ElementsKind elements_kind) {
-    return LoadFixedTypedArrayElementAsTagged(data_pointer, index_node,
-                                              elements_kind, SMI_PARAMETERS);
-  }
-  TNode<Numeric> LoadFixedTypedArrayElementAsTagged(
-      TNode<RawPtrT> data_pointer, TNode<Smi> index,
+      TNode<RawPtrT> data_pointer, TNode<UintPtrT> index,
       TNode<Int32T> elements_kind);
   // Parts of the above, factored out for readability:
   TNode<BigInt> LoadFixedBigInt64ArrayElementAsTagged(
@@ -1444,8 +1491,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BigInt> BigIntFromInt32Pair(TNode<IntPtrT> low, TNode<IntPtrT> high);
   TNode<BigInt> BigIntFromUint32Pair(TNode<UintPtrT> low, TNode<UintPtrT> high);
 
-  // Context manipulation
-  TNode<BoolT> LoadContextHasExtensionField(SloppyTNode<Context> context);
+  // ScopeInfo:
+  TNode<ScopeInfo> LoadScopeInfo(TNode<Context> context);
+  TNode<BoolT> LoadScopeInfoHasExtensionField(TNode<ScopeInfo> scope_info);
+
+  // Context manipulation:
   TNode<Object> LoadContextElement(SloppyTNode<Context> context,
                                    int slot_index);
   TNode<Object> LoadContextElement(SloppyTNode<Context> context,
@@ -1465,8 +1515,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<Context> LoadModuleContext(SloppyTNode<Context> context);
 
   void GotoIfContextElementEqual(SloppyTNode<Object> value,
-                                 Node* native_context, int slot_index,
-                                 Label* if_equal) {
+                                 TNode<NativeContext> native_context,
+                                 int slot_index, Label* if_equal) {
     GotoIf(TaggedEqual(value, LoadContextElement(native_context, slot_index)),
            if_equal);
   }
@@ -1476,13 +1526,16 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<Map> LoadJSArrayElementsMap(SloppyTNode<Int32T> kind,
                                     SloppyTNode<NativeContext> native_context);
 
-  TNode<BoolT> HasPrototypeSlot(TNode<JSFunction> function);
+  TNode<BoolT> IsJSFunctionWithPrototypeSlot(TNode<HeapObject> object);
   TNode<BoolT> IsGeneratorFunction(TNode<JSFunction> function);
-  TNode<BoolT> HasPrototypeProperty(TNode<JSFunction> function, TNode<Map> map);
+  void BranchIfHasPrototypeProperty(TNode<JSFunction> function,
+                                    TNode<Int32T> function_map_bit_field,
+                                    Label* if_true, Label* if_false);
   void GotoIfPrototypeRequiresRuntimeLookup(TNode<JSFunction> function,
                                             TNode<Map> map, Label* runtime);
   // Load the "prototype" property of a JSFunction.
-  Node* LoadJSFunctionPrototype(TNode<JSFunction> function, Label* if_bailout);
+  TNode<HeapObject> LoadJSFunctionPrototype(TNode<JSFunction> function,
+                                            Label* if_bailout);
 
   TNode<BytecodeArray> LoadSharedFunctionInfoBytecodeArray(
       SloppyTNode<SharedFunctionInfo> shared);
@@ -1494,35 +1547,44 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   void StoreHeapNumberValue(SloppyTNode<HeapNumber> object,
                             SloppyTNode<Float64T> value);
   // Store a field to an object on the heap.
-  void StoreObjectField(Node* object, int offset, Node* value);
-  void StoreObjectField(Node* object, Node* offset, Node* value);
-  void StoreObjectFieldNoWriteBarrier(
-      Node* object, int offset, Node* value,
-      MachineRepresentation rep = MachineRepresentation::kTagged);
-  void UnsafeStoreObjectFieldNoWriteBarrier(TNode<HeapObject> object,
-                                            int offset, TNode<Object> value);
-  void StoreObjectFieldNoWriteBarrier(
-      Node* object, SloppyTNode<IntPtrT> offset, Node* value,
-      MachineRepresentation rep = MachineRepresentation::kTagged);
-
-  template <class T = Object>
-  void StoreObjectFieldNoWriteBarrier(Node* object, SloppyTNode<IntPtrT> offset,
+  void StoreObjectField(TNode<HeapObject> object, int offset,
+                        TNode<Object> value);
+  void StoreObjectField(TNode<HeapObject> object, TNode<IntPtrT> offset,
+                        TNode<Object> value);
+  template <class T>
+  void StoreObjectFieldNoWriteBarrier(TNode<HeapObject> object,
+                                      SloppyTNode<IntPtrT> offset,
                                       TNode<T> value) {
-    StoreObjectFieldNoWriteBarrier(object, offset, value,
-                                   MachineRepresentationOf<T>::value);
+    int const_offset;
+    if (ToInt32Constant(offset, &const_offset)) {
+      return StoreObjectFieldNoWriteBarrier<T>(object, const_offset, value);
+    }
+    StoreNoWriteBarrier(MachineRepresentationOf<T>::value, object,
+                        IntPtrSub(offset, IntPtrConstant(kHeapObjectTag)),
+                        value);
   }
-  template <class T = Object>
-  void StoreObjectFieldNoWriteBarrier(Node* object, int offset,
+  template <class T>
+  void StoreObjectFieldNoWriteBarrier(TNode<HeapObject> object, int offset,
                                       TNode<T> value) {
-    StoreObjectFieldNoWriteBarrier(object, offset, value,
-                                   MachineRepresentationOf<T>::value);
+    if (CanBeTaggedPointer(MachineRepresentationOf<T>::value)) {
+      OptimizedStoreFieldAssertNoWriteBarrier(MachineRepresentationOf<T>::value,
+                                              object, offset, value);
+    } else {
+      OptimizedStoreFieldUnsafeNoWriteBarrier(MachineRepresentationOf<T>::value,
+                                              object, offset, value);
+    }
   }
 
+  void UnsafeStoreObjectFieldNoWriteBarrier(TNode<HeapObject> object,
+                                            int offset, TNode<Object> value);
+
   // Store the Map of an HeapObject.
-  void StoreMap(Node* object, Node* map);
-  void StoreMapNoWriteBarrier(Node* object, RootIndex map_root_index);
-  void StoreMapNoWriteBarrier(Node* object, Node* map);
-  void StoreObjectFieldRoot(Node* object, int offset, RootIndex root);
+  void StoreMap(TNode<HeapObject> object, TNode<Map> map);
+  void StoreMapNoWriteBarrier(TNode<HeapObject> object,
+                              RootIndex map_root_index);
+  void StoreMapNoWriteBarrier(TNode<HeapObject> object, TNode<Map> map);
+  void StoreObjectFieldRoot(TNode<HeapObject> object, int offset,
+                            RootIndex root);
   // Store an array element to a FixedArray.
   void StoreFixedArrayElement(
       TNode<FixedArray> object, int index, SloppyTNode<Object> value,
@@ -1656,6 +1718,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     StoreFixedDoubleArrayElement(object, index, value, SMI_PARAMETERS);
   }
 
+  void StoreDoubleHole(TNode<HeapObject> object, TNode<IntPtrT> offset);
   void StoreFixedDoubleArrayHole(TNode<FixedDoubleArray> array, Node* index,
                                  ParameterMode mode = INTPTR_PARAMETERS);
   void StoreFixedDoubleArrayHoleSmi(TNode<FixedDoubleArray> array,
@@ -1669,39 +1732,38 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
       WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
       int additional_offset = 0);
 
-  void EnsureArrayLengthWritable(TNode<Map> map, Label* bailout);
-
   // EnsureArrayPushable verifies that receiver with this map is:
   //   1. Is not a prototype.
   //   2. Is not a dictionary.
   //   3. Has a writeable length property.
   // It returns ElementsKind as a node for further division into cases.
-  TNode<Int32T> EnsureArrayPushable(TNode<Map> map, Label* bailout);
+  TNode<Int32T> EnsureArrayPushable(TNode<Context> context, TNode<Map> map,
+                                    Label* bailout);
 
   void TryStoreArrayElement(ElementsKind kind, ParameterMode mode,
                             Label* bailout, Node* elements, Node* index,
                             Node* value);
   // Consumes args into the array, and returns tagged new length.
-  TNode<Smi> BuildAppendJSArray(ElementsKind kind, SloppyTNode<JSArray> array,
+  TNode<Smi> BuildAppendJSArray(ElementsKind kind, TNode<JSArray> array,
                                 CodeStubArguments* args,
                                 TVariable<IntPtrT>* arg_index, Label* bailout);
   // Pushes value onto the end of array.
-  void BuildAppendJSArray(ElementsKind kind, Node* array, Node* value,
-                          Label* bailout);
+  void BuildAppendJSArray(ElementsKind kind, TNode<JSArray> array,
+                          TNode<Object> value, Label* bailout);
 
   void StoreFieldsNoWriteBarrier(TNode<IntPtrT> start_address,
                                  TNode<IntPtrT> end_address,
                                  TNode<Object> value);
 
-  Node* AllocateCellWithValue(Node* value,
-                              WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
-  Node* AllocateSmiCell(int value = 0) {
+  TNode<Cell> AllocateCellWithValue(
+      TNode<Object> value, WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  TNode<Cell> AllocateSmiCell(int value = 0) {
     return AllocateCellWithValue(SmiConstant(value), SKIP_WRITE_BARRIER);
   }
 
-  TNode<Object> LoadCellValue(Node* cell);
+  TNode<Object> LoadCellValue(TNode<Cell> cell);
 
-  void StoreCellValue(Node* cell, Node* value,
+  void StoreCellValue(TNode<Cell> cell, TNode<Object> value,
                       WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   // Allocate a HeapNumber without initializing its value.
@@ -1735,13 +1797,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // Allocate a SeqOneByteString with the given length.
   TNode<String> AllocateSeqOneByteString(uint32_t length,
                                          AllocationFlags flags = kNone);
-  TNode<String> AllocateSeqOneByteString(TNode<Uint32T> length,
-                                         AllocationFlags flags = kNone);
+  using TorqueGeneratedExportedMacrosAssembler::AllocateSeqOneByteString;
+
   // Allocate a SeqTwoByteString with the given length.
   TNode<String> AllocateSeqTwoByteString(uint32_t length,
                                          AllocationFlags flags = kNone);
-  TNode<String> AllocateSeqTwoByteString(TNode<Uint32T> length,
-                                         AllocationFlags flags = kNone);
+  using TorqueGeneratedExportedMacrosAssembler::AllocateSeqTwoByteString;
 
   // Allocate a SlicedOneByteString with the given length, parent and offset.
   // |length| and |offset| are expected to be tagged.
@@ -1764,24 +1825,19 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                            Label* large_object_fallback);
 
   template <typename CollectionType>
-  Node* AllocateOrderedHashTable();
-
-  template <typename CollectionType>
-  TNode<CollectionType> AllocateSmallOrderedHashTable(TNode<IntPtrT> capacity);
-
-  Node* AllocateStruct(Node* map, AllocationFlags flags = kNone);
-  void InitializeStructBody(TNode<HeapObject> object, TNode<IntPtrT> size,
-                            int start_offset = Struct::kHeaderSize);
+  TNode<CollectionType> AllocateOrderedHashTable();
 
   TNode<JSObject> AllocateJSObjectFromMap(
-      SloppyTNode<Map> map, SloppyTNode<HeapObject> properties = nullptr,
-      SloppyTNode<FixedArray> elements = nullptr, AllocationFlags flags = kNone,
+      TNode<Map> map,
+      base::Optional<TNode<HeapObject>> properties = base::nullopt,
+      base::Optional<TNode<FixedArray>> elements = base::nullopt,
+      AllocationFlags flags = kNone,
       SlackTrackingMode slack_tracking_mode = kNoSlackTracking);
 
   void InitializeJSObjectFromMap(
-      SloppyTNode<HeapObject> object, SloppyTNode<Map> map,
-      SloppyTNode<IntPtrT> instance_size, Node* properties = nullptr,
-      Node* elements = nullptr,
+      TNode<HeapObject> object, TNode<Map> map, TNode<IntPtrT> instance_size,
+      base::Optional<TNode<HeapObject>> properties = base::nullopt,
+      base::Optional<TNode<FixedArray>> elements = base::nullopt,
       SlackTrackingMode slack_tracking_mode = kNoSlackTracking);
 
   void InitializeJSObjectBodyWithSlackTracking(
@@ -1792,8 +1848,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
       SloppyTNode<IntPtrT> instance_size,
       int start_offset = JSObject::kHeaderSize);
 
-  TNode<BoolT> IsValidFastJSArrayCapacity(Node* capacity,
-                                          ParameterMode capacity_mode);
+  TNode<BoolT> IsValidFastJSArrayCapacity(TNode<IntPtrT> capacity);
 
   //
   // Allocate and return a JSArray with initialized header fields and its
@@ -1802,30 +1857,33 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   std::pair<TNode<JSArray>, TNode<FixedArrayBase>>
   AllocateUninitializedJSArrayWithElements(
       ElementsKind kind, TNode<Map> array_map, TNode<Smi> length,
-      TNode<AllocationSite> allocation_site, Node* capacity,
-      ParameterMode capacity_mode = INTPTR_PARAMETERS,
+      TNode<AllocationSite> allocation_site, TNode<IntPtrT> capacity,
       AllocationFlags allocation_flags = kNone,
-      int array_header_size = JSArray::kSize);
+      int array_header_size = JSArray::kHeaderSize);
 
   // Allocate a JSArray and fill elements with the hole.
-  // The ParameterMode argument is only used for the capacity parameter.
-  TNode<JSArray> AllocateJSArray(
-      ElementsKind kind, TNode<Map> array_map, Node* capacity,
-      TNode<Smi> length, TNode<AllocationSite> allocation_site = {},
-      ParameterMode capacity_mode = INTPTR_PARAMETERS,
-      AllocationFlags allocation_flags = kNone);
-
   TNode<JSArray> AllocateJSArray(ElementsKind kind, TNode<Map> array_map,
-                                 TNode<Smi> capacity, TNode<Smi> length) {
-    return AllocateJSArray(kind, array_map, capacity, length, {},
-                           SMI_PARAMETERS);
+                                 TNode<IntPtrT> capacity, TNode<Smi> length,
+                                 TNode<AllocationSite> allocation_site,
+                                 AllocationFlags allocation_flags = kNone);
+  TNode<JSArray> AllocateJSArray(ElementsKind kind, TNode<Map> array_map,
+                                 TNode<Smi> capacity, TNode<Smi> length,
+                                 TNode<AllocationSite> allocation_site,
+                                 AllocationFlags allocation_flags = kNone) {
+    return AllocateJSArray(kind, array_map, SmiUntag(capacity), length,
+                           allocation_site, allocation_flags);
+  }
+  TNode<JSArray> AllocateJSArray(ElementsKind kind, TNode<Map> array_map,
+                                 TNode<Smi> capacity, TNode<Smi> length,
+                                 AllocationFlags allocation_flags = kNone) {
+    return AllocateJSArray(kind, array_map, SmiUntag(capacity), length, {},
+                           allocation_flags);
   }
-
   TNode<JSArray> AllocateJSArray(ElementsKind kind, TNode<Map> array_map,
                                  TNode<IntPtrT> capacity, TNode<Smi> length,
                                  AllocationFlags allocation_flags = kNone) {
     return AllocateJSArray(kind, array_map, capacity, length, {},
-                           INTPTR_PARAMETERS, allocation_flags);
+                           allocation_flags);
   }
 
   // Allocate a JSArray and initialize the header fields.
@@ -1833,7 +1891,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                  TNode<FixedArrayBase> elements,
                                  TNode<Smi> length,
                                  TNode<AllocationSite> allocation_site = {},
-                                 int array_header_size = JSArray::kSize);
+                                 int array_header_size = JSArray::kHeaderSize);
 
   enum class HoleConversionMode { kDontConvert, kConvertToUndefined };
   // Clone a fast JSArray |array| into a new fast JSArray.
@@ -1848,15 +1906,15 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // function generates significantly less code in this case.
   TNode<JSArray> CloneFastJSArray(
       TNode<Context> context, TNode<JSArray> array,
-      ParameterMode mode = INTPTR_PARAMETERS,
       TNode<AllocationSite> allocation_site = {},
       HoleConversionMode convert_holes = HoleConversionMode::kDontConvert);
 
-  Node* ExtractFastJSArray(TNode<Context> context, TNode<JSArray> array,
-                           Node* begin, Node* count,
-                           ParameterMode mode = INTPTR_PARAMETERS,
-                           Node* capacity = nullptr,
-                           TNode<AllocationSite> allocation_site = {});
+  TNode<JSArray> ExtractFastJSArray(TNode<Context> context,
+                                    TNode<JSArray> array, Node* begin,
+                                    Node* count,
+                                    ParameterMode mode = INTPTR_PARAMETERS,
+                                    Node* capacity = nullptr,
+                                    TNode<AllocationSite> allocation_site = {});
 
   TNode<FixedArrayBase> AllocateFixedArray(
       ElementsKind kind, Node* capacity, ParameterMode mode = INTPTR_PARAMETERS,
@@ -1870,6 +1928,13 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                               fixed_array_map);
   }
 
+  TNode<FixedArrayBase> AllocateFixedArray(
+      ElementsKind kind, TNode<Smi> capacity, AllocationFlags flags,
+      SloppyTNode<Map> fixed_array_map = nullptr) {
+    return AllocateFixedArray(kind, capacity, SMI_PARAMETERS, flags,
+                              fixed_array_map);
+  }
+
   TNode<NativeContext> GetCreationContext(TNode<JSReceiver> receiver,
                                           Label* if_bailout);
   TNode<Object> GetConstructor(TNode<Map> map);
@@ -2001,8 +2066,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // zero to |to_array| of |capacity| size respecting both array's elements
   // kinds.
   void CopyFixedArrayElements(
-      ElementsKind from_kind, Node* from_array, ElementsKind to_kind,
-      Node* to_array, Node* element_count, Node* capacity,
+      ElementsKind from_kind, TNode<Object> from_array, ElementsKind to_kind,
+      TNode<Object> to_array, TNode<IntPtrT> element_count,
+      TNode<IntPtrT> capacity,
       WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
       ParameterMode mode = INTPTR_PARAMETERS) {
     CopyFixedArrayElements(from_kind, from_array, to_kind, to_array,
@@ -2282,9 +2348,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                     Label* bailout);
 
   // Allocation site manipulation
-  void InitializeAllocationMemento(Node* base_allocation,
-                                   Node* base_allocation_size,
-                                   Node* allocation_site);
+  void InitializeAllocationMemento(TNode<HeapObject> base,
+                                   TNode<IntPtrT> base_allocation_size,
+                                   TNode<AllocationSite> allocation_site);
 
   TNode<Float64T> TryTaggedToFloat64(TNode<Object> value,
                                      Label* if_valueisnotnumber);
@@ -2295,12 +2361,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   void TaggedToWord32OrBigInt(TNode<Context> context, TNode<Object> value,
                               Label* if_number, TVariable<Word32T>* var_word32,
                               Label* if_bigint,
-                              TVariable<Object>* var_maybe_bigint);
+                              TVariable<BigInt>* var_maybe_bigint);
   void TaggedToWord32OrBigIntWithFeedback(TNode<Context> context,
                                           TNode<Object> value, Label* if_number,
                                           TVariable<Word32T>* var_word32,
                                           Label* if_bigint,
-                                          TVariable<Object>* var_maybe_bigint,
+                                          TVariable<BigInt>* var_maybe_bigint,
                                           TVariable<Smi>* var_feedback);
 
   // Truncate the floating point value of a HeapNumber to an Int32.
@@ -2317,16 +2383,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<Number> ChangeUintPtrToTagged(TNode<UintPtrT> value);
   TNode<Uint32T> ChangeNumberToUint32(TNode<Number> value);
   TNode<Float64T> ChangeNumberToFloat64(TNode<Number> value);
-  TNode<UintPtrT> TryNumberToUintPtr(TNode<Number> value, Label* if_negative);
-  TNode<UintPtrT> ChangeNonnegativeNumberToUintPtr(TNode<Number> value) {
-    return TryNumberToUintPtr(value, nullptr);
-  }
 
-  void TaggedToNumeric(Node* context, Node* value, Label* done,
-                       Variable* var_numeric);
-  void TaggedToNumericWithFeedback(Node* context, Node* value, Label* done,
-                                   Variable* var_numeric,
-                                   Variable* var_feedback);
+  void TaggedToNumeric(TNode<Context> context, TNode<Object> value,
+                       TVariable<Numeric>* var_numeric);
+  void TaggedToNumericWithFeedback(TNode<Context> context, TNode<Object> value,
+                                   TVariable<Numeric>* var_numeric,
+                                   TVariable<Smi>* var_feedback);
 
   TNode<WordT> TimesSystemPointerSize(SloppyTNode<WordT> value);
   TNode<IntPtrT> TimesSystemPointerSize(TNode<IntPtrT> value) {
@@ -2370,10 +2432,10 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                             char const* method_name);
 
   // Throws a TypeError for {method_name} if {value} is not of the given
-  // instance type. Returns {value}'s map.
-  Node* ThrowIfNotInstanceType(Node* context, Node* value,
-                               InstanceType instance_type,
-                               char const* method_name);
+  // instance type.
+  void ThrowIfNotInstanceType(TNode<Context> context, TNode<Object> value,
+                              InstanceType instance_type,
+                              char const* method_name);
   // Throws a TypeError for {method_name} if {value} is not a JSReceiver.
   void ThrowIfNotJSReceiver(TNode<Context> context, TNode<Object> value,
                             MessageTemplate msg_template,
@@ -2381,13 +2443,16 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   void ThrowIfNotCallable(TNode<Context> context, TNode<Object> value,
                           const char* method_name);
 
-  void ThrowRangeError(Node* context, MessageTemplate message,
-                       Node* arg0 = nullptr, Node* arg1 = nullptr,
-                       Node* arg2 = nullptr);
-  void ThrowTypeError(Node* context, MessageTemplate message,
+  void ThrowRangeError(TNode<Context> context, MessageTemplate message,
+                       base::Optional<TNode<Object>> arg0 = base::nullopt,
+                       base::Optional<TNode<Object>> arg1 = base::nullopt,
+                       base::Optional<TNode<Object>> arg2 = base::nullopt);
+  void ThrowTypeError(TNode<Context> context, MessageTemplate message,
                       char const* arg0 = nullptr, char const* arg1 = nullptr);
-  void ThrowTypeError(Node* context, MessageTemplate message, Node* arg0,
-                      Node* arg1 = nullptr, Node* arg2 = nullptr);
+  void ThrowTypeError(TNode<Context> context, MessageTemplate message,
+                      base::Optional<TNode<Object>> arg0,
+                      base::Optional<TNode<Object>> arg1 = base::nullopt,
+                      base::Optional<TNode<Object>> arg2 = base::nullopt);
 
   // Type checks.
   // Check whether the map is for an object with special properties, such as a
@@ -2445,6 +2510,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> IsAllocationSiteInstanceType(SloppyTNode<Int32T> instance_type);
   TNode<BoolT> IsJSFunctionMap(SloppyTNode<Map> map);
   TNode<BoolT> IsJSFunction(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSBoundFunction(SloppyTNode<HeapObject> object);
   TNode<BoolT> IsJSGeneratorObject(TNode<HeapObject> object);
   TNode<BoolT> IsJSGlobalProxyInstanceType(SloppyTNode<Int32T> instance_type);
   TNode<BoolT> IsJSGlobalProxyMap(SloppyTNode<Map> map);
@@ -2476,13 +2542,17 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> IsNullOrJSReceiver(SloppyTNode<HeapObject> object);
   TNode<BoolT> IsNullOrUndefined(SloppyTNode<Object> object);
   TNode<BoolT> IsNumberDictionary(SloppyTNode<HeapObject> object);
-  TNode<BoolT> IsOneByteStringInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsOneByteStringInstanceType(TNode<Int32T> instance_type);
   TNode<BoolT> IsPrimitiveInstanceType(SloppyTNode<Int32T> instance_type);
   TNode<BoolT> IsPrivateSymbol(SloppyTNode<HeapObject> object);
   TNode<BoolT> IsPrivateName(SloppyTNode<Symbol> symbol);
   TNode<BoolT> IsPromiseCapability(SloppyTNode<HeapObject> object);
   TNode<BoolT> IsPropertyArray(SloppyTNode<HeapObject> object);
   TNode<BoolT> IsPropertyCell(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsPromiseReaction(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsPromiseReactionJobTask(TNode<HeapObject> object);
+  TNode<BoolT> IsPromiseRejectReactionJobTask(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsPromiseFulfillReactionJobTask(SloppyTNode<HeapObject> object);
   TNode<BoolT> IsPrototypeInitialArrayPrototype(SloppyTNode<Context> context,
                                                 SloppyTNode<Map> map);
   TNode<BoolT> IsPrototypeTypedArrayPrototype(SloppyTNode<Context> context,
@@ -2517,7 +2587,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> IsNotWeakFixedArraySubclass(SloppyTNode<HeapObject> object);
   TNode<BoolT> IsZeroOrContext(SloppyTNode<Object> object);
 
-  inline Node* IsSharedFunctionInfo(Node* object) {
+  inline TNode<BoolT> IsSharedFunctionInfo(TNode<HeapObject> object) {
     return IsSharedFunctionInfoMap(LoadMap(object));
   }
 
@@ -2595,15 +2665,16 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                          ElementsKind reference_kind);
   TNode<BoolT> IsElementsKindLessThanOrEqual(TNode<Int32T> target_kind,
                                              ElementsKind reference_kind);
-  // Check if reference_kind_a <= target_kind <= reference_kind_b
+  // Check if lower_reference_kind <= target_kind <= higher_reference_kind.
   TNode<BoolT> IsElementsKindInRange(TNode<Int32T> target_kind,
                                      ElementsKind lower_reference_kind,
-                                     ElementsKind higher_reference_kind);
+                                     ElementsKind higher_reference_kind) {
+    return IsInRange(target_kind, lower_reference_kind, higher_reference_kind);
+  }
 
   // String helpers.
   // Load a character from a String (might flatten a ConsString).
-  TNode<Int32T> StringCharCodeAt(SloppyTNode<String> string,
-                                 SloppyTNode<IntPtrT> index);
+  TNode<Int32T> StringCharCodeAt(TNode<String> string, TNode<UintPtrT> index);
   // Return the single character string with only {code}.
   TNode<String> StringFromSingleCharCode(TNode<Int32T> code);
 
@@ -2634,8 +2705,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   // Try to convert an object to a BigInt. Throws on failure (e.g. for Numbers).
   // https://tc39.github.io/proposal-bigint/#sec-to-bigint
-  TNode<BigInt> ToBigInt(SloppyTNode<Context> context,
-                         SloppyTNode<Object> input);
+  TNode<BigInt> ToBigInt(TNode<Context> context, TNode<Object> input);
 
   // Converts |input| to one of 2^32 integer values in the range 0 through
   // 2^32-1, inclusive.
@@ -2660,14 +2730,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     kTruncateMinusZero,
   };
 
-  // ES6 7.1.17 ToIndex, but jumps to range_error if the result is not a Smi.
-  TNode<Smi> ToSmiIndex(TNode<Context> context, TNode<Object> input,
-                        Label* range_error);
-
-  // ES6 7.1.15 ToLength, but jumps to range_error if the result is not a Smi.
-  TNode<Smi> ToSmiLength(TNode<Context> context, TNode<Object> input,
-                         Label* range_error);
-
   // ES6 7.1.15 ToLength, but with inlined fast path.
   TNode<Number> ToLength_Inline(SloppyTNode<Context> context,
                                 SloppyTNode<Object> input);
@@ -2719,14 +2781,39 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   // Returns a node that contains the updated values of a |BitField|.
   template <typename BitField>
-  TNode<WordT> UpdateWord(TNode<WordT> word, TNode<WordT> value) {
+  TNode<Word32T> UpdateWord32(TNode<Word32T> word, TNode<Uint32T> value) {
+    return UpdateWord32(word, value, BitField::kShift, BitField::kMask);
+  }
+
+  // Returns a node that contains the updated values of a |BitField|.
+  template <typename BitField>
+  TNode<WordT> UpdateWord(TNode<WordT> word, TNode<UintPtrT> value) {
     return UpdateWord(word, value, BitField::kShift, BitField::kMask);
   }
 
+  // Returns a node that contains the updated values of a |BitField|.
+  template <typename BitField>
+  TNode<Word32T> UpdateWordInWord32(TNode<Word32T> word,
+                                    TNode<UintPtrT> value) {
+    return UncheckedCast<Uint32T>(TruncateIntPtrToInt32(
+        Signed(UpdateWord<BitField>(ChangeUint32ToWord(word), value))));
+  }
+
+  // Returns a node that contains the updated values of a |BitField|.
+  template <typename BitField>
+  TNode<WordT> UpdateWord32InWord(TNode<WordT> word, TNode<Uint32T> value) {
+    return UpdateWord<BitField>(word, ChangeUint32ToWord(value));
+  }
+
+  // Returns a node that contains the updated {value} inside {word} starting
+  // at {shift} and fitting in {mask}.
+  TNode<Word32T> UpdateWord32(TNode<Word32T> word, TNode<Uint32T> value,
+                              uint32_t shift, uint32_t mask);
+
   // Returns a node that contains the updated {value} inside {word} starting
   // at {shift} and fitting in {mask}.
-  TNode<WordT> UpdateWord(TNode<WordT> word, TNode<WordT> value, uint32_t shift,
-                          uint32_t mask);
+  TNode<WordT> UpdateWord(TNode<WordT> word, TNode<UintPtrT> value,
+                          uint32_t shift, uint32_t mask);
 
   // Returns true if any of the |T|'s bits in given |word32| are set.
   template <typename T>
@@ -2851,36 +2938,37 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // Calculates array index for given dictionary entry and entry field.
   // See Dictionary::EntryToIndex().
   template <typename Dictionary>
-  V8_EXPORT_PRIVATE TNode<IntPtrT> EntryToIndex(TNode<IntPtrT> entry,
-                                                int field_index);
+  TNode<IntPtrT> EntryToIndex(TNode<IntPtrT> entry, int field_index);
   template <typename Dictionary>
-  V8_EXPORT_PRIVATE TNode<IntPtrT> EntryToIndex(TNode<IntPtrT> entry) {
+  TNode<IntPtrT> EntryToIndex(TNode<IntPtrT> entry) {
     return EntryToIndex<Dictionary>(entry, Dictionary::kEntryKeyIndex);
   }
 
   // Loads the details for the entry with the given key_index.
   // Returns an untagged int32.
   template <class ContainerType>
-  TNode<Uint32T> LoadDetailsByKeyIndex(Node* container, Node* key_index) {
+  TNode<Uint32T> LoadDetailsByKeyIndex(TNode<ContainerType> container,
+                                       TNode<IntPtrT> key_index) {
     static_assert(!std::is_same<ContainerType, DescriptorArray>::value,
                   "Use the non-templatized version for DescriptorArray");
     const int kKeyToDetailsOffset =
         (ContainerType::kEntryDetailsIndex - ContainerType::kEntryKeyIndex) *
         kTaggedSize;
-    return Unsigned(LoadAndUntagToWord32FixedArrayElement(
-        CAST(container), key_index, kKeyToDetailsOffset));
+    return Unsigned(LoadAndUntagToWord32FixedArrayElement(container, key_index,
+                                                          kKeyToDetailsOffset));
   }
 
   // Loads the value for the entry with the given key_index.
   // Returns a tagged value.
   template <class ContainerType>
-  TNode<Object> LoadValueByKeyIndex(Node* container, Node* key_index) {
+  TNode<Object> LoadValueByKeyIndex(TNode<ContainerType> container,
+                                    TNode<IntPtrT> key_index) {
     static_assert(!std::is_same<ContainerType, DescriptorArray>::value,
                   "Use the non-templatized version for DescriptorArray");
     const int kKeyToValueOffset =
         (ContainerType::kEntryValueIndex - ContainerType::kEntryKeyIndex) *
         kTaggedSize;
-    return LoadFixedArrayElement(CAST(container), key_index, kKeyToValueOffset);
+    return LoadFixedArrayElement(container, key_index, kKeyToValueOffset);
   }
 
   // Stores the details for the entry with the given key_index.
@@ -2978,8 +3066,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                             Label* if_not_found,
                             LookupMode mode = kFindExisting);
 
-  Node* ComputeUnseededHash(Node* key);
-  Node* ComputeSeededHash(Node* key);
+  TNode<Word32T> ComputeSeededHash(TNode<IntPtrT> key);
 
   void NumberDictionaryLookup(TNode<NumberDictionary> dictionary,
                               TNode<IntPtrT> intptr_index, Label* if_found,
@@ -3015,16 +3102,18 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // is an accessor then it also calls a getter. If the property is a double
   // field it re-wraps value in an immutable heap number. {unique_name} must be
   // a unique name (Symbol or InternalizedString) that is not an array index.
-  void TryGetOwnProperty(Node* context, Node* receiver, Node* object, Node* map,
-                         Node* instance_type, Node* unique_name,
-                         Label* if_found, Variable* var_value,
+  void TryGetOwnProperty(TNode<Context> context, TNode<HeapObject> receiver,
+                         TNode<JSReceiver> object, TNode<Map> map,
+                         TNode<Int32T> instance_type, TNode<Name> unique_name,
+                         Label* if_found_value, TVariable<Object>* var_value,
                          Label* if_not_found, Label* if_bailout);
-  void TryGetOwnProperty(Node* context, Node* receiver, Node* object, Node* map,
-                         Node* instance_type, Node* unique_name,
-                         Label* if_found, Variable* var_value,
-                         Variable* var_details, Variable* var_raw_value,
-                         Label* if_not_found, Label* if_bailout,
-                         GetOwnPropertyMode mode);
+  void TryGetOwnProperty(TNode<Context> context, TNode<HeapObject> receiver,
+                         TNode<JSReceiver> object, TNode<Map> map,
+                         TNode<Int32T> instance_type, TNode<Name> unique_name,
+                         Label* if_found_value, TVariable<Object>* var_value,
+                         TVariable<Uint32T>* var_details,
+                         TVariable<Object>* var_raw_value, Label* if_not_found,
+                         Label* if_bailout, GetOwnPropertyMode mode);
 
   TNode<Object> GetProperty(SloppyTNode<Context> context,
                             SloppyTNode<Object> receiver, Handle<Name> name) {
@@ -3050,8 +3139,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                        value);
   }
 
-  Node* GetMethod(Node* context, Node* object, Handle<Name> name,
-                  Label* if_null_or_undefined);
+  TNode<Object> GetMethod(TNode<Context> context, TNode<Object> object,
+                          Handle<Name> name, Label* if_null_or_undefined);
 
   TNode<Object> GetIteratorMethod(TNode<Context> context,
                                   TNode<HeapObject> heap_obj,
@@ -3070,23 +3159,26 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     return TailCallStub(Builtins::CallableFor(isolate(), id), context, args...);
   }
 
-  void LoadPropertyFromFastObject(Node* object, Node* map,
+  void LoadPropertyFromFastObject(TNode<HeapObject> object, TNode<Map> map,
                                   TNode<DescriptorArray> descriptors,
-                                  Node* name_index, Variable* var_details,
-                                  Variable* var_value);
+                                  TNode<IntPtrT> name_index,
+                                  TVariable<Uint32T>* var_details,
+                                  TVariable<Object>* var_value);
 
-  void LoadPropertyFromFastObject(Node* object, Node* map,
+  void LoadPropertyFromFastObject(TNode<HeapObject> object, TNode<Map> map,
                                   TNode<DescriptorArray> descriptors,
-                                  Node* name_index, Node* details,
-                                  Variable* var_value);
-
-  void LoadPropertyFromNameDictionary(Node* dictionary, Node* entry,
-                                      Variable* var_details,
-                                      Variable* var_value);
-
-  void LoadPropertyFromGlobalDictionary(Node* dictionary, Node* entry,
-                                        Variable* var_details,
-                                        Variable* var_value, Label* if_deleted);
+                                  TNode<IntPtrT> name_index, TNode<Uint32T>,
+                                  TVariable<Object>* var_value);
+
+  void LoadPropertyFromNameDictionary(TNode<NameDictionary> dictionary,
+                                      TNode<IntPtrT> name_index,
+                                      TVariable<Uint32T>* var_details,
+                                      TVariable<Object>* var_value);
+  void LoadPropertyFromGlobalDictionary(TNode<GlobalDictionary> dictionary,
+                                        TNode<IntPtrT> name_index,
+                                        TVariable<Uint32T>* var_details,
+                                        TVariable<Object>* var_value,
+                                        Label* if_deleted);
 
   // Generic property lookup generator. If the {object} is fast and
   // {unique_name} property is found then the control goes to {if_found_fast}
@@ -3121,19 +3213,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // This method jumps to if_found if the element is known to exist. To
   // if_absent if it's known to not exist. To if_not_found if the prototype
   // chain needs to be checked. And if_bailout if the lookup is unsupported.
-  void TryLookupElement(Node* object, Node* map,
+  void TryLookupElement(TNode<HeapObject> object, TNode<Map> map,
                         SloppyTNode<Int32T> instance_type,
                         SloppyTNode<IntPtrT> intptr_index, Label* if_found,
                         Label* if_absent, Label* if_not_found,
                         Label* if_bailout);
 
-  // This is a type of a lookup in holder generator function. In case of a
-  // property lookup the {key} is guaranteed to be an unique name and in case of
-  // element lookup the key is an Int32 index.
-  using LookupInHolder = std::function<void(
-      Node* receiver, Node* holder, Node* map, Node* instance_type, Node* key,
-      Label* next_holder, Label* if_bailout)>;
-
   // For integer indexed exotic cases, check if the given string cannot be a
   // special index. If we are not sure that the given string is not a special
   // index with a simple check, return False. Note that "False" return value
@@ -3143,6 +3228,20 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                  Label* if_maybe_special_index,
                                  Label* if_not_special_index);
 
+  // This is a type of a lookup property in holder generator function. The {key}
+  // is guaranteed to be an unique name.
+  using LookupPropertyInHolder = std::function<void(
+      TNode<HeapObject> receiver, TNode<HeapObject> holder, TNode<Map> map,
+      TNode<Int32T> instance_type, TNode<Name> key, Label* next_holder,
+      Label* if_bailout)>;
+
+  // This is a type of a lookup element in holder generator function. The {key}
+  // is an Int32 index.
+  using LookupElementInHolder = std::function<void(
+      TNode<HeapObject> receiver, TNode<HeapObject> holder, TNode<Map> map,
+      TNode<Int32T> instance_type, TNode<IntPtrT> key, Label* next_holder,
+      Label* if_bailout)>;
+
   // Generic property prototype chain lookup generator.
   // For properties it generates lookup using given {lookup_property_in_holder}
   // and for elements it uses {lookup_element_in_holder}.
@@ -3150,11 +3249,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // If it can't handle the case {receiver}/{key} case then the control goes
   // to {if_bailout}.
   // If {if_proxy} is nullptr, proxies go to if_bailout.
-  void TryPrototypeChainLookup(Node* receiver, Node* object, Node* key,
-                               const LookupInHolder& lookup_property_in_holder,
-                               const LookupInHolder& lookup_element_in_holder,
-                               Label* if_end, Label* if_bailout,
-                               Label* if_proxy);
+  void TryPrototypeChainLookup(
+      TNode<Object> receiver, TNode<Object> object, TNode<Object> key,
+      const LookupPropertyInHolder& lookup_property_in_holder,
+      const LookupElementInHolder& lookup_element_in_holder, Label* if_end,
+      Label* if_bailout, Label* if_proxy);
 
   // Instanceof helpers.
   // Returns true if {object} has {prototype} somewhere in it's prototype
@@ -3198,12 +3297,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   // Combine the new feedback with the existing_feedback. Do nothing if
   // existing_feedback is nullptr.
-  void CombineFeedback(Variable* existing_feedback, int feedback);
-  void CombineFeedback(Variable* existing_feedback, Node* feedback);
+  void CombineFeedback(TVariable<Smi>* existing_feedback, int feedback);
+  void CombineFeedback(TVariable<Smi>* existing_feedback, TNode<Smi> feedback);
 
   // Overwrite the existing feedback with new_feedback. Do nothing if
   // existing_feedback is nullptr.
-  void OverwriteFeedback(Variable* existing_feedback, int new_feedback);
+  void OverwriteFeedback(TVariable<Smi>* existing_feedback, int new_feedback);
 
   // Check if a property name might require protector invalidation when it is
   // used for a property store or deletion.
@@ -3211,28 +3310,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   TNode<Map> LoadReceiverMap(SloppyTNode<Object> receiver);
 
-  enum class ArgumentsAccessMode { kLoad, kStore, kHas };
-  // Emits keyed sloppy arguments has. Returns whether the key is in the
-  // arguments.
-  Node* HasKeyedSloppyArguments(Node* receiver, Node* key, Label* bailout) {
-    return EmitKeyedSloppyArguments(receiver, key, nullptr, bailout,
-                                    ArgumentsAccessMode::kHas);
-  }
-
-  // Emits keyed sloppy arguments load. Returns either the loaded value.
-  Node* LoadKeyedSloppyArguments(Node* receiver, Node* key, Label* bailout) {
-    return EmitKeyedSloppyArguments(receiver, key, nullptr, bailout,
-                                    ArgumentsAccessMode::kLoad);
-  }
-
-  // Emits keyed sloppy arguments store.
-  void StoreKeyedSloppyArguments(Node* receiver, Node* key, Node* value,
-                                 Label* bailout) {
-    DCHECK_NOT_NULL(value);
-    EmitKeyedSloppyArguments(receiver, key, value, bailout,
-                             ArgumentsAccessMode::kStore);
-  }
-
   // Loads script context from the script context table.
   TNode<Context> LoadScriptContext(TNode<Context> context,
                                    TNode<IntPtrT> context_index);
@@ -3250,6 +3327,10 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // teach TurboFan to handle int64_t on 32-bit platforms eventually.
   void StoreElement(Node* elements, ElementsKind kind, Node* index, Node* value,
                     ParameterMode mode);
+  void StoreElement(TNode<RawPtrT> elements, ElementsKind kind,
+                    TNode<UintPtrT> index, Node* value) {
+    return StoreElement(elements, kind, index, value, INTPTR_PARAMETERS);
+  }
 
   // Implements the BigInt part of
   // https://tc39.github.io/proposal-bigint/#sec-numbertorawbytes,
@@ -3258,24 +3339,25 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   void BigIntToRawBytes(TNode<BigInt> bigint, TVariable<UintPtrT>* var_low,
                         TVariable<UintPtrT>* var_high);
 
-  void EmitElementStore(Node* object, Node* key, Node* value,
-                        ElementsKind elements_kind,
+  void EmitElementStore(TNode<JSObject> object, TNode<Object> key,
+                        TNode<Object> value, ElementsKind elements_kind,
                         KeyedAccessStoreMode store_mode, Label* bailout,
-                        Node* context,
-                        Variable* maybe_converted_value = nullptr);
+                        TNode<Context> context,
+                        TVariable<Object>* maybe_converted_value = nullptr);
 
-  Node* CheckForCapacityGrow(Node* object, Node* elements, ElementsKind kind,
-                             SloppyTNode<UintPtrT> length,
-                             SloppyTNode<WordT> key, ParameterMode mode,
+  Node* CheckForCapacityGrow(TNode<JSObject> object,
+                             TNode<FixedArrayBase> elements, ElementsKind kind,
+                             TNode<UintPtrT> length, TNode<IntPtrT> key,
                              Label* bailout);
 
   Node* CopyElementsOnWrite(Node* object, Node* elements, ElementsKind kind,
                             Node* length, ParameterMode mode, Label* bailout);
 
-  void TransitionElementsKind(Node* object, Node* map, ElementsKind from_kind,
-                              ElementsKind to_kind, Label* bailout);
+  void TransitionElementsKind(TNode<JSObject> object, TNode<Map> map,
+                              ElementsKind from_kind, ElementsKind to_kind,
+                              Label* bailout);
 
-  void TrapAllocationMemento(Node* object, Label* memento_found);
+  void TrapAllocationMemento(TNode<JSObject> object, Label* memento_found);
 
   TNode<IntPtrT> PageFromAddress(TNode<IntPtrT> address);
 
@@ -3336,6 +3418,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                last_element_exclusive, body, mode, direction);
   }
 
+  TNode<IntPtrT> GetArrayAllocationSize(TNode<IntPtrT> element_count,
+                                        ElementsKind kind, int header_size) {
+    return ElementOffsetFromIndex(element_count, kind, header_size);
+  }
+
+  // TODO(v8:9708): remove once all uses are ported.
   TNode<IntPtrT> GetArrayAllocationSize(Node* element_count, ElementsKind kind,
                                         ParameterMode mode, int header_size) {
     return ElementOffsetFromIndex(element_count, kind, mode, header_size);
@@ -3406,13 +3494,15 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                        right, if_true, if_false);
   }
 
-  void BranchIfAccessorPair(Node* value, Label* if_accessor_pair,
+  void BranchIfAccessorPair(TNode<Object> value, Label* if_accessor_pair,
                             Label* if_not_accessor_pair) {
     GotoIf(TaggedIsSmi(value), if_not_accessor_pair);
-    Branch(IsAccessorPair(value), if_accessor_pair, if_not_accessor_pair);
+    Branch(IsAccessorPair(CAST(value)), if_accessor_pair, if_not_accessor_pair);
   }
 
-  void GotoIfNumberGreaterThanOrEqual(Node* left, Node* right, Label* if_false);
+  void GotoIfNumberGreaterThanOrEqual(SloppyTNode<Number> left,
+                                      SloppyTNode<Number> right,
+                                      Label* if_false);
 
   TNode<Oddball> Equal(SloppyTNode<Object> lhs, SloppyTNode<Object> rhs,
                        SloppyTNode<Context> context,
@@ -3462,7 +3552,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                             TNode<Context> context);
 
   // Debug helpers
-  Node* IsDebugActive();
+  TNode<BoolT> IsDebugActive();
 
   // JSArrayBuffer helpers
   TNode<Uint32T> LoadJSArrayBufferBitField(TNode<JSArrayBuffer> array_buffer);
@@ -3515,10 +3605,10 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
       TNode<Context> context);
 
   // Promise helpers
-  Node* IsPromiseHookEnabled();
-  Node* HasAsyncEventDelegate();
-  Node* IsPromiseHookEnabledOrHasAsyncEventDelegate();
-  Node* IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate();
+  TNode<BoolT> IsPromiseHookEnabled();
+  TNode<BoolT> HasAsyncEventDelegate();
+  TNode<BoolT> IsPromiseHookEnabledOrHasAsyncEventDelegate();
+  TNode<BoolT> IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate();
 
   // for..in helpers
   void CheckPrototypeEnumCache(Node* receiver, Node* receiver_map,
@@ -3534,21 +3624,19 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   // Support for printf-style debugging
   void Print(const char* s);
-  void Print(const char* prefix, Node* tagged_value);
-  inline void Print(SloppyTNode<Object> tagged_value) {
-    return Print(nullptr, tagged_value);
-  }
-  inline void Print(TNode<MaybeObject> tagged_value) {
+  void Print(const char* prefix, SloppyTNode<MaybeObject> tagged_value);
+  void Print(SloppyTNode<MaybeObject> tagged_value) {
     return Print(nullptr, tagged_value);
   }
 
   template <class... TArgs>
-  Node* MakeTypeError(MessageTemplate message, Node* context, TArgs... args) {
+  TNode<HeapObject> MakeTypeError(MessageTemplate message,
+                                  TNode<Context> context, TArgs... args) {
     STATIC_ASSERT(sizeof...(TArgs) <= 3);
-    TNode<Object> const make_type_error = LoadContextElement(
+    const TNode<Object> make_type_error = LoadContextElement(
         LoadNativeContext(context), Context::MAKE_TYPE_ERROR_INDEX);
-    return CallJS(CodeFactory::Call(isolate()), context, make_type_error,
-                  UndefinedConstant(), SmiConstant(message), args...);
+    return CAST(CallJS(CodeFactory::Call(isolate()), context, make_type_error,
+                       UndefinedConstant(), SmiConstant(message), args...));
   }
 
   void Abort(AbortReason reason) {
@@ -3561,6 +3649,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   bool ConstexprInt31Equal(int31_t a, int31_t b) { return a == b; }
   bool ConstexprInt31NotEqual(int31_t a, int31_t b) { return a != b; }
   bool ConstexprInt31GreaterThanEqual(int31_t a, int31_t b) { return a >= b; }
+  bool ConstexprInt32GreaterThanEqual(int32_t a, int32_t b) { return a >= b; }
   uint32_t ConstexprUint32Add(uint32_t a, uint32_t b) { return a + b; }
   int31_t ConstexprInt31Add(int31_t a, int31_t b) {
     int32_t val;
@@ -3573,6 +3662,21 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     return val;
   }
 
+  bool ConstexprUintPtrLessThan(uintptr_t a, uintptr_t b) { return a < b; }
+
+  // CSA does not support 64-bit types on 32-bit platforms so as a workaround
+  // the kMaxSafeIntegerUint64 is defined as uintptr and allowed to be used only
+  // inside if constexpr (Is64()) i.e. on 64-bit architectures.
+  static uintptr_t MaxSafeIntegerUintPtr() {
+#if defined(V8_HOST_ARCH_64_BIT)
+    // This ifdef is required to avoid build issues on 32-bit MSVC which
+    // complains about static_cast<uintptr_t>(kMaxSafeIntegerUint64).
+    return kMaxSafeIntegerUint64;
+#else
+    UNREACHABLE();
+#endif
+  }
+
   void PerformStackCheck(TNode<Context> context);
 
   void SetPropertyLength(TNode<Context> context, TNode<Object> array,
@@ -3677,14 +3781,20 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                     const ForEachKeyValueFunction& body,
                                     Label* bailout);
 
-  TNode<Object> CallGetterIfAccessor(Node* value, Node* details, Node* context,
-                                     Node* receiver, Label* if_bailout,
+  TNode<Object> CallGetterIfAccessor(TNode<Object> value,
+                                     TNode<Uint32T> details,
+                                     TNode<Context> context,
+                                     TNode<Object> receiver, Label* if_bailout,
                                      GetOwnPropertyMode mode = kCallJSGetter);
 
-  TNode<IntPtrT> TryToIntptr(SloppyTNode<Object> key, Label* miss);
+  TNode<IntPtrT> TryToIntptr(SloppyTNode<Object> key, Label* if_not_intptr,
+                             TVariable<Int32T>* var_instance_type = nullptr);
 
-  void InitializeFunctionContext(Node* native_context, Node* context,
-                                 int slots);
+  TNode<Context> AllocateSyntheticFunctionContext(
+      TNode<NativeContext> native_context, int slots);
+  void InitializeSyntheticFunctionContext(TNode<NativeContext> native_context,
+                                          TNode<HeapObject> context_heap_object,
+                                          int slots);
 
   TNode<JSArray> ArrayCreate(TNode<Context> context, TNode<Number> length);
 
@@ -3692,6 +3802,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // HeapNumber.
   TNode<Object> CloneIfMutablePrimitive(TNode<Object> object);
 
+  TNode<Smi> RefillMathRandom(TNode<NativeContext> native_context);
+
  private:
   friend class CodeStubArguments;
 
@@ -3725,19 +3837,10 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     return Int32Constant(kSmiShiftSize + kSmiTagSize);
   }
 
-  // Emits keyed sloppy arguments load if the |value| is nullptr or store
-  // otherwise. Returns either the loaded value or |value|.
-  Node* EmitKeyedSloppyArguments(Node* receiver, Node* key, Node* value,
-                                 Label* bailout,
-                                 ArgumentsAccessMode access_mode);
-
   TNode<String> AllocateSlicedString(RootIndex map_root_index,
                                      TNode<Uint32T> length,
                                      TNode<String> parent, TNode<Smi> offset);
 
-  Node* SelectImpl(TNode<BoolT> condition, const NodeGenerator& true_body,
-                   const NodeGenerator& false_body, MachineRepresentation rep);
-
   // Implements [Descriptor/Transition]Array::number_of_entries.
   template <typename Array>
   TNode<Uint32T> NumberOfEntries(TNode<Array> array);
@@ -3750,27 +3853,32 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<Smi> CollectFeedbackForString(SloppyTNode<Int32T> instance_type);
   void GenerateEqual_Same(SloppyTNode<Object> value, Label* if_equal,
                           Label* if_notequal,
-                          Variable* var_type_feedback = nullptr);
+                          TVariable<Smi>* var_type_feedback = nullptr);
 
   static const int kElementLoopUnrollThreshold = 8;
 
   // {convert_bigint} is only meaningful when {mode} == kToNumber.
-  Node* NonNumberToNumberOrNumeric(
-      Node* context, Node* input, Object::Conversion mode,
+  TNode<Numeric> NonNumberToNumberOrNumeric(
+      TNode<Context> context, TNode<HeapObject> input, Object::Conversion mode,
       BigIntHandling bigint_handling = BigIntHandling::kThrow);
 
-  void TaggedToNumeric(Node* context, Node* value, Label* done,
-                       Variable* var_numeric, Variable* var_feedback);
+  void TaggedToNumeric(TNode<Context> context, TNode<Object> value,
+                       TVariable<Numeric>* var_numeric,
+                       TVariable<Smi>* var_feedback);
 
   template <Object::Conversion conversion>
   void TaggedToWord32OrBigIntImpl(TNode<Context> context, TNode<Object> value,
                                   Label* if_number,
                                   TVariable<Word32T>* var_word32,
                                   Label* if_bigint = nullptr,
-                                  TVariable<Object>* var_maybe_bigint = nullptr,
+                                  TVariable<BigInt>* var_maybe_bigint = nullptr,
                                   TVariable<Smi>* var_feedback = nullptr);
 
- private:
+  Node* LoadObjectField(SloppyTNode<HeapObject> object, int offset,
+                        MachineType type);
+  Node* LoadObjectField(SloppyTNode<HeapObject> object,
+                        SloppyTNode<IntPtrT> offset, MachineType type);
+
   // Low-level accessors for Descriptor arrays.
   template <typename T>
   TNode<T> LoadDescriptorArrayElement(TNode<DescriptorArray> object,
@@ -3898,11 +4006,9 @@ class V8_EXPORT_PRIVATE CodeStubArguments {
     return ForEach(vars, body, first_intptr, last_intptr);
   }
 
-  void PopAndReturn(Node* value);
+  void PopAndReturn(TNode<Object> value);
 
  private:
-  Node* GetArguments();
-
   CodeStubAssembler* assembler_;
   ReceiverMode receiver_mode_;
   TNode<IntPtrT> argc_;
@@ -3951,6 +4057,7 @@ class ToDirectStringAssembler : public CodeStubAssembler {
 
   TVariable<String> var_string_;
   TVariable<Int32T> var_instance_type_;
+  // TODO(v8:9880): Use UintPtrT here.
   TVariable<IntPtrT> var_offset_;
   TVariable<Word32T> var_is_external_;
 
diff --git a/deps/v8/src/codegen/compiler.cc b/deps/v8/src/codegen/compiler.cc
index d73be13a30a7d6..04e80f5a6e407b 100644
--- a/deps/v8/src/codegen/compiler.cc
+++ b/deps/v8/src/codegen/compiler.cc
@@ -95,13 +95,14 @@ void LogFunctionCompilation(CodeEventListener::LogEventsAndTags tag,
 
   int line_num = Script::GetLineNumber(script, shared->StartPosition()) + 1;
   int column_num = Script::GetColumnNumber(script, shared->StartPosition()) + 1;
-  String script_name = script->name().IsString()
-                           ? String::cast(script->name())
-                           : ReadOnlyRoots(isolate).empty_string();
+  Handle<String> script_name(script->name().IsString()
+                                 ? String::cast(script->name())
+                                 : ReadOnlyRoots(isolate).empty_string(),
+                             isolate);
   CodeEventListener::LogEventsAndTags log_tag =
       Logger::ToNativeByScript(tag, *script);
-  PROFILE(isolate, CodeCreateEvent(log_tag, *abstract_code, *shared,
-                                   script_name, line_num, column_num));
+  PROFILE(isolate, CodeCreateEvent(log_tag, abstract_code, shared, script_name,
+                                   line_num, column_num));
   if (!FLAG_log_function_events) return;
 
   DisallowHeapAllocation no_gc;
@@ -194,8 +195,9 @@ void UnoptimizedCompilationJob::RecordFunctionCompilation(
   double time_taken_ms = time_taken_to_execute_.InMillisecondsF() +
                          time_taken_to_finalize_.InMillisecondsF();
 
-  LogFunctionCompilation(tag, shared, parse_info()->script(), abstract_code,
-                         false, time_taken_ms, isolate);
+  Handle<Script> script(Script::cast(shared->script()), isolate);
+  LogFunctionCompilation(tag, shared, script, abstract_code, false,
+                         time_taken_ms, isolate);
 }
 
 // ----------------------------------------------------------------------------
@@ -219,12 +221,13 @@ CompilationJob::Status OptimizedCompilationJob::PrepareJob(Isolate* isolate) {
   return UpdateState(PrepareJobImpl(isolate), State::kReadyToExecute);
 }
 
-CompilationJob::Status OptimizedCompilationJob::ExecuteJob() {
+CompilationJob::Status OptimizedCompilationJob::ExecuteJob(
+    RuntimeCallStats* stats) {
   DisallowHeapAccess no_heap_access;
   // Delegate to the underlying implementation.
   DCHECK_EQ(state(), State::kReadyToExecute);
   ScopedTimer t(&time_taken_to_execute_);
-  return UpdateState(ExecuteJobImpl(), State::kReadyToFinalize);
+  return UpdateState(ExecuteJobImpl(stats), State::kReadyToFinalize);
 }
 
 CompilationJob::Status OptimizedCompilationJob::FinalizeJob(Isolate* isolate) {
@@ -380,18 +383,19 @@ void InstallBytecodeArray(Handle<BytecodeArray> bytecode_array,
 
   shared_info->set_interpreter_data(*interpreter_data);
 
-  Handle<Script> script = parse_info->script();
+  Handle<Script> script(Script::cast(shared_info->script()), isolate);
   Handle<AbstractCode> abstract_code = Handle<AbstractCode>::cast(code);
   int line_num =
       Script::GetLineNumber(script, shared_info->StartPosition()) + 1;
   int column_num =
       Script::GetColumnNumber(script, shared_info->StartPosition()) + 1;
-  String script_name = script->name().IsString()
-                           ? String::cast(script->name())
-                           : ReadOnlyRoots(isolate).empty_string();
+  Handle<String> script_name =
+      handle(script->name().IsString() ? String::cast(script->name())
+                                       : ReadOnlyRoots(isolate).empty_string(),
+             isolate);
   CodeEventListener::LogEventsAndTags log_tag = Logger::ToNativeByScript(
       CodeEventListener::INTERPRETED_FUNCTION_TAG, *script);
-  PROFILE(isolate, CodeCreateEvent(log_tag, *abstract_code, *shared_info,
+  PROFILE(isolate, CodeCreateEvent(log_tag, abstract_code, shared_info,
                                    script_name, line_num, column_num));
 }
 
@@ -438,18 +442,18 @@ void InstallUnoptimizedCode(UnoptimizedCompilationInfo* compilation_info,
   }
 }
 
-void EnsureSharedFunctionInfosArrayOnScript(ParseInfo* parse_info,
+void EnsureSharedFunctionInfosArrayOnScript(Handle<Script> script,
+                                            ParseInfo* parse_info,
                                             Isolate* isolate) {
   DCHECK(parse_info->is_toplevel());
-  DCHECK(!parse_info->script().is_null());
-  if (parse_info->script()->shared_function_infos().length() > 0) {
-    DCHECK_EQ(parse_info->script()->shared_function_infos().length(),
+  if (script->shared_function_infos().length() > 0) {
+    DCHECK_EQ(script->shared_function_infos().length(),
               parse_info->max_function_literal_id() + 1);
     return;
   }
   Handle<WeakFixedArray> infos(isolate->factory()->NewWeakFixedArray(
       parse_info->max_function_literal_id() + 1));
-  parse_info->script()->set_shared_function_infos(*infos);
+  script->set_shared_function_infos(*infos);
 }
 
 void SetSharedFunctionFlagsFromLiteral(FunctionLiteral* literal,
@@ -476,6 +480,15 @@ CompilationJob::Status FinalizeUnoptimizedCompilationJob(
   CompilationJob::Status status = job->FinalizeJob(shared_info, isolate);
   if (status == CompilationJob::SUCCEEDED) {
     InstallUnoptimizedCode(compilation_info, shared_info, parse_info, isolate);
+
+    // It's possible that source position collection was enabled after the
+    // background compile was started in which the compiled bytecode will not be
+    // missing source positions (for instance by enabling the cpu profiler). So
+    // force source position collection now in that case.
+    if (isolate->NeedsDetailedOptimizedCodeLineInfo()) {
+      SharedFunctionInfo::EnsureSourcePositionsAvailable(isolate, shared_info);
+    }
+
     CodeEventListener::LogEventsAndTags log_tag;
     if (parse_info->is_toplevel()) {
       log_tag = compilation_info->is_eval() ? CodeEventListener::EVAL_TAG
@@ -548,17 +561,16 @@ std::unique_ptr<UnoptimizedCompilationJob> GenerateUnoptimizedCode(
 }
 
 MaybeHandle<SharedFunctionInfo> GenerateUnoptimizedCodeForToplevel(
-    Isolate* isolate, ParseInfo* parse_info, AccountingAllocator* allocator,
-    IsCompiledScope* is_compiled_scope) {
-  EnsureSharedFunctionInfosArrayOnScript(parse_info, isolate);
-  parse_info->ast_value_factory()->Internalize(isolate);
+    Isolate* isolate, Handle<Script> script, ParseInfo* parse_info,
+    AccountingAllocator* allocator, IsCompiledScope* is_compiled_scope) {
+  EnsureSharedFunctionInfosArrayOnScript(script, parse_info, isolate);
+  parse_info->ast_value_factory()->Internalize(isolate->factory());
 
   if (!Compiler::Analyze(parse_info)) return MaybeHandle<SharedFunctionInfo>();
   DeclarationScope::AllocateScopeInfos(parse_info, isolate);
 
   // Prepare and execute compilation of the outer-most function.
   // Create the SharedFunctionInfo and add it to the script's list.
-  Handle<Script> script = parse_info->script();
   Handle<SharedFunctionInfo> top_level =
       isolate->factory()->NewSharedFunctionInfoForLiteral(parse_info->literal(),
                                                           script, true);
@@ -636,12 +648,13 @@ bool FinalizeUnoptimizedCode(
     return false;
   }
 
+  Handle<Script> script(Script::cast(shared_info->script()), isolate);
+
   // Finalize the inner functions' compilation jobs.
   for (auto&& inner_job : *inner_function_jobs) {
     Handle<SharedFunctionInfo> inner_shared_info =
         Compiler::GetSharedFunctionInfo(
-            inner_job->compilation_info()->literal(), parse_info->script(),
-            isolate);
+            inner_job->compilation_info()->literal(), script, isolate);
     // The inner function might be compiled already if compiling for debug.
     if (inner_shared_info->is_compiled()) continue;
     if (FinalizeUnoptimizedCompilationJob(inner_job.get(), inner_shared_info,
@@ -653,8 +666,7 @@ bool FinalizeUnoptimizedCode(
 
   // Report any warnings generated during compilation.
   if (parse_info->pending_error_handler()->has_pending_warnings()) {
-    parse_info->pending_error_handler()->ReportWarnings(isolate,
-                                                        parse_info->script());
+    parse_info->pending_error_handler()->ReportWarnings(isolate, script);
   }
 
   return true;
@@ -730,13 +742,14 @@ void InsertCodeIntoOptimizedCodeCache(
 bool GetOptimizedCodeNow(OptimizedCompilationJob* job, Isolate* isolate) {
   TimerEventScope<TimerEventRecompileSynchronous> timer(isolate);
   RuntimeCallTimerScope runtimeTimer(
-      isolate, RuntimeCallCounterId::kRecompileSynchronous);
+      isolate, RuntimeCallCounterId::kOptimizeNonConcurrent);
   OptimizedCompilationInfo* compilation_info = job->compilation_info();
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-               "V8.RecompileSynchronous");
+               "V8.OptimizeNonConcurrent");
 
   if (job->PrepareJob(isolate) != CompilationJob::SUCCEEDED ||
-      job->ExecuteJob() != CompilationJob::SUCCEEDED ||
+      job->ExecuteJob(isolate->counters()->runtime_call_stats()) !=
+          CompilationJob::SUCCEEDED ||
       job->FinalizeJob(isolate) != CompilationJob::SUCCEEDED) {
     if (FLAG_trace_opt) {
       PrintF("[aborted optimizing ");
@@ -777,9 +790,9 @@ bool GetOptimizedCodeLater(OptimizedCompilationJob* job, Isolate* isolate) {
 
   TimerEventScope<TimerEventRecompileSynchronous> timer(isolate);
   RuntimeCallTimerScope runtimeTimer(
-      isolate, RuntimeCallCounterId::kRecompileSynchronous);
+      isolate, RuntimeCallCounterId::kOptimizeConcurrentPrepare);
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-               "V8.RecompileSynchronous");
+               "V8.OptimizeConcurrentPrepare");
 
   if (job->PrepareJob(isolate) != CompilationJob::SUCCEEDED) return false;
   isolate->optimizing_compile_dispatcher()->QueueForOptimization(job);
@@ -852,11 +865,10 @@ MaybeHandle<Code> GetOptimizedCode(Handle<JSFunction> function,
   // tolerate the lack of a script without bytecode.
   DCHECK_IMPLIES(!has_script, shared->HasBytecodeArray());
   std::unique_ptr<OptimizedCompilationJob> job(
-      compiler::Pipeline::NewCompilationJob(isolate, function, has_script));
+      compiler::Pipeline::NewCompilationJob(isolate, function, has_script,
+                                            osr_offset, osr_frame));
   OptimizedCompilationInfo* compilation_info = job->compilation_info();
 
-  compilation_info->SetOptimizingForOsr(osr_offset, osr_frame);
-
   // Do not use TurboFan if we need to be able to set break points.
   if (compilation_info->shared_info()->HasBreakInfo()) {
     compilation_info->AbortOptimization(BailoutReason::kFunctionBeingDebugged);
@@ -904,14 +916,15 @@ MaybeHandle<Code> GetOptimizedCode(Handle<JSFunction> function,
   return MaybeHandle<Code>();
 }
 
-bool FailWithPendingException(Isolate* isolate, ParseInfo* parse_info,
+bool FailWithPendingException(Isolate* isolate, Handle<Script> script,
+                              ParseInfo* parse_info,
                               Compiler::ClearExceptionFlag flag) {
   if (flag == Compiler::CLEAR_EXCEPTION) {
     isolate->clear_pending_exception();
   } else if (!isolate->has_pending_exception()) {
     if (parse_info->pending_error_handler()->has_pending_error()) {
       parse_info->pending_error_handler()->ReportErrors(
-          isolate, parse_info->script(), parse_info->ast_value_factory());
+          isolate, script, parse_info->ast_value_factory());
     } else {
       isolate->StackOverflow();
     }
@@ -919,8 +932,8 @@ bool FailWithPendingException(Isolate* isolate, ParseInfo* parse_info,
   return false;
 }
 
-void FinalizeScriptCompilation(Isolate* isolate, ParseInfo* parse_info) {
-  Handle<Script> script = parse_info->script();
+void FinalizeScriptCompilation(Isolate* isolate, Handle<Script> script,
+                               ParseInfo* parse_info) {
   script->set_compilation_state(Script::COMPILATION_STATE_COMPILED);
 
   // Register any pending parallel tasks with the associated SFI.
@@ -942,36 +955,36 @@ void FinalizeScriptCompilation(Isolate* isolate, ParseInfo* parse_info) {
 }
 
 MaybeHandle<SharedFunctionInfo> FinalizeTopLevel(
-    ParseInfo* parse_info, Isolate* isolate,
+    ParseInfo* parse_info, Handle<Script> script, Isolate* isolate,
     UnoptimizedCompilationJob* outer_function_job,
     UnoptimizedCompilationJobList* inner_function_jobs) {
   // Internalize ast values onto the heap.
-  parse_info->ast_value_factory()->Internalize(isolate);
+  parse_info->ast_value_factory()->Internalize(isolate->factory());
 
   // Create shared function infos for top level and shared function infos array
   // for inner functions.
-  EnsureSharedFunctionInfosArrayOnScript(parse_info, isolate);
+  EnsureSharedFunctionInfosArrayOnScript(script, parse_info, isolate);
   DCHECK_EQ(kNoSourcePosition,
             parse_info->literal()->function_token_position());
   Handle<SharedFunctionInfo> shared_info =
-      isolate->factory()->NewSharedFunctionInfoForLiteral(
-          parse_info->literal(), parse_info->script(), true);
+      isolate->factory()->NewSharedFunctionInfoForLiteral(parse_info->literal(),
+                                                          script, true);
 
   // Finalize compilation of the unoptimized bytecode or asm-js data.
   if (!FinalizeUnoptimizedCode(parse_info, isolate, shared_info,
                                outer_function_job, inner_function_jobs)) {
-    FailWithPendingException(isolate, parse_info,
+    FailWithPendingException(isolate, script, parse_info,
                              Compiler::ClearExceptionFlag::KEEP_EXCEPTION);
     return MaybeHandle<SharedFunctionInfo>();
   }
 
-  FinalizeScriptCompilation(isolate, parse_info);
+  FinalizeScriptCompilation(isolate, script, parse_info);
 
   return shared_info;
 }
 
 MaybeHandle<SharedFunctionInfo> CompileToplevel(
-    ParseInfo* parse_info, Isolate* isolate,
+    ParseInfo* parse_info, Handle<Script> script, Isolate* isolate,
     IsCompiledScope* is_compiled_scope) {
   TimerEventScope<TimerEventCompileCode> top_level_timer(isolate);
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"), "V8.CompileCode");
@@ -984,7 +997,7 @@ MaybeHandle<SharedFunctionInfo> CompileToplevel(
                                      : RuntimeCallCounterId::kCompileScript);
   VMState<BYTECODE_COMPILER> state(isolate);
   if (parse_info->literal() == nullptr &&
-      !parsing::ParseProgram(parse_info, isolate)) {
+      !parsing::ParseProgram(parse_info, script, isolate)) {
     return MaybeHandle<SharedFunctionInfo>();
   }
   // Measure how long it takes to do the compilation; only take the
@@ -1000,14 +1013,14 @@ MaybeHandle<SharedFunctionInfo> CompileToplevel(
   // Generate the unoptimized bytecode or asm-js data.
   MaybeHandle<SharedFunctionInfo> shared_info =
       GenerateUnoptimizedCodeForToplevel(
-          isolate, parse_info, isolate->allocator(), is_compiled_scope);
+          isolate, script, parse_info, isolate->allocator(), is_compiled_scope);
   if (shared_info.is_null()) {
-    FailWithPendingException(isolate, parse_info,
+    FailWithPendingException(isolate, script, parse_info,
                              Compiler::ClearExceptionFlag::KEEP_EXCEPTION);
     return MaybeHandle<SharedFunctionInfo>();
   }
 
-  FinalizeScriptCompilation(isolate, parse_info);
+  FinalizeScriptCompilation(isolate, script, parse_info);
   return shared_info;
 }
 
@@ -1094,9 +1107,9 @@ BackgroundCompileTask::~BackgroundCompileTask() = default;
 
 namespace {
 
-// A scope object that ensures a parse info's runtime call stats, stack limit
-// and on_background_thread fields is set correctly during worker-thread
-// compile, and restores it after going out of scope.
+// A scope object that ensures a parse info's runtime call stats and stack limit
+// are set correctly during worker-thread compile, and restores it after going
+// out of scope.
 class OffThreadParseInfoScope {
  public:
   OffThreadParseInfoScope(
@@ -1106,7 +1119,6 @@ class OffThreadParseInfoScope {
         original_runtime_call_stats_(parse_info_->runtime_call_stats()),
         original_stack_limit_(parse_info_->stack_limit()),
         worker_thread_scope_(worker_thread_runtime_stats) {
-    parse_info_->set_on_background_thread(true);
     parse_info_->set_runtime_call_stats(worker_thread_scope_.Get());
     parse_info_->set_stack_limit(GetCurrentStackPosition() - stack_size * KB);
   }
@@ -1114,7 +1126,6 @@ class OffThreadParseInfoScope {
   ~OffThreadParseInfoScope() {
     parse_info_->set_stack_limit(original_stack_limit_);
     parse_info_->set_runtime_call_stats(original_runtime_call_stats_);
-    parse_info_->set_on_background_thread(false);
   }
 
  private:
@@ -1164,11 +1175,9 @@ void BackgroundCompileTask::Run() {
 
 bool Compiler::Analyze(ParseInfo* parse_info) {
   DCHECK_NOT_NULL(parse_info->literal());
-  RuntimeCallTimerScope runtimeTimer(
-      parse_info->runtime_call_stats(),
-      parse_info->on_background_thread()
-          ? RuntimeCallCounterId::kCompileBackgroundAnalyse
-          : RuntimeCallCounterId::kCompileAnalyse);
+  RuntimeCallTimerScope runtimeTimer(parse_info->runtime_call_stats(),
+                                     RuntimeCallCounterId::kCompileAnalyse,
+                                     RuntimeCallStats::kThreadSpecific);
   if (!Rewriter::Rewrite(parse_info)) return false;
   if (!DeclarationScope::Analyze(parse_info)) return false;
   return true;
@@ -1222,7 +1231,7 @@ bool Compiler::CollectSourcePositions(Isolate* isolate,
   HistogramTimerScope timer(isolate->counters()->collect_source_positions());
 
   // Set up parse info.
-  ParseInfo parse_info(isolate, shared_info);
+  ParseInfo parse_info(isolate, *shared_info);
   parse_info.set_lazy_compile();
   parse_info.set_collect_source_positions();
   if (FLAG_allow_natives_syntax) parse_info.set_allow_natives_syntax();
@@ -1234,7 +1243,8 @@ bool Compiler::CollectSourcePositions(Isolate* isolate,
     // Parsing failed probably as a result of stack exhaustion.
     bytecode->SetSourcePositionsFailedToCollect();
     return FailWithPendingException(
-        isolate, &parse_info, Compiler::ClearExceptionFlag::CLEAR_EXCEPTION);
+        isolate, handle(Script::cast(shared_info->script()), isolate),
+        &parse_info, Compiler::ClearExceptionFlag::CLEAR_EXCEPTION);
   }
 
   // Character stream shouldn't be used again.
@@ -1249,7 +1259,8 @@ bool Compiler::CollectSourcePositions(Isolate* isolate,
       // Recompiling failed probably as a result of stack exhaustion.
       bytecode->SetSourcePositionsFailedToCollect();
       return FailWithPendingException(
-          isolate, &parse_info, Compiler::ClearExceptionFlag::CLEAR_EXCEPTION);
+          isolate, handle(Script::cast(shared_info->script()), isolate),
+          &parse_info, Compiler::ClearExceptionFlag::CLEAR_EXCEPTION);
     }
 
     job = interpreter::Interpreter::NewSourcePositionCollectionJob(
@@ -1260,7 +1271,8 @@ bool Compiler::CollectSourcePositions(Isolate* isolate,
       // Recompiling failed probably as a result of stack exhaustion.
       bytecode->SetSourcePositionsFailedToCollect();
       return FailWithPendingException(
-          isolate, &parse_info, Compiler::ClearExceptionFlag::CLEAR_EXCEPTION);
+          isolate, handle(Script::cast(shared_info->script()), isolate),
+          &parse_info, Compiler::ClearExceptionFlag::CLEAR_EXCEPTION);
     }
   }
 
@@ -1302,14 +1314,16 @@ bool Compiler::Compile(Handle<SharedFunctionInfo> shared_info,
   AggregatedHistogramTimerScope timer(isolate->counters()->compile_lazy());
 
   // Set up parse info.
-  ParseInfo parse_info(isolate, shared_info);
+  ParseInfo parse_info(isolate, *shared_info);
   parse_info.set_lazy_compile();
 
   // Check if the compiler dispatcher has shared_info enqueued for compile.
   CompilerDispatcher* dispatcher = isolate->compiler_dispatcher();
   if (dispatcher->IsEnqueued(shared_info)) {
     if (!dispatcher->FinishNow(shared_info)) {
-      return FailWithPendingException(isolate, &parse_info, flag);
+      return FailWithPendingException(
+          isolate, handle(Script::cast(shared_info->script()), isolate),
+          &parse_info, flag);
     }
     *is_compiled_scope = shared_info->is_compiled_scope();
     DCHECK(is_compiled_scope->is_compiled());
@@ -1326,7 +1340,9 @@ bool Compiler::Compile(Handle<SharedFunctionInfo> shared_info,
 
   // Parse and update ParseInfo with the results.
   if (!parsing::ParseAny(&parse_info, shared_info, isolate)) {
-    return FailWithPendingException(isolate, &parse_info, flag);
+    return FailWithPendingException(
+        isolate, handle(Script::cast(shared_info->script()), isolate),
+        &parse_info, flag);
   }
 
   // Generate the unoptimized bytecode or asm-js data.
@@ -1335,17 +1351,21 @@ bool Compiler::Compile(Handle<SharedFunctionInfo> shared_info,
       GenerateUnoptimizedCode(&parse_info, isolate->allocator(),
                               &inner_function_jobs));
   if (!outer_function_job) {
-    return FailWithPendingException(isolate, &parse_info, flag);
+    return FailWithPendingException(
+        isolate, handle(Script::cast(shared_info->script()), isolate),
+        &parse_info, flag);
   }
 
   // Internalize ast values onto the heap.
-  parse_info.ast_value_factory()->Internalize(isolate);
+  parse_info.ast_value_factory()->Internalize(isolate->factory());
 
   // Finalize compilation of the unoptimized bytecode or asm-js data.
   if (!FinalizeUnoptimizedCode(&parse_info, isolate, shared_info,
                                outer_function_job.get(),
                                &inner_function_jobs)) {
-    return FailWithPendingException(isolate, &parse_info, flag);
+    return FailWithPendingException(
+        isolate, handle(Script::cast(shared_info->script()), isolate),
+        &parse_info, flag);
   }
 
   DCHECK(!isolate->has_pending_exception());
@@ -1357,12 +1377,13 @@ bool Compiler::Compile(Handle<SharedFunctionInfo> shared_info,
     // mismatches.
     SharedFunctionInfo::EnsureSourcePositionsAvailable(isolate, shared_info);
 
+    Handle<Script> script(Script::cast(shared_info->script()), isolate);
+
     // Do the same for eagerly compiled inner functions.
     for (auto&& inner_job : inner_function_jobs) {
       Handle<SharedFunctionInfo> inner_shared_info =
           Compiler::GetSharedFunctionInfo(
-              inner_job->compilation_info()->literal(), parse_info.script(),
-              isolate);
+              inner_job->compilation_info()->literal(), script, isolate);
       SharedFunctionInfo::EnsureSourcePositionsAvailable(isolate,
                                                          inner_shared_info);
     }
@@ -1435,23 +1456,25 @@ bool Compiler::FinalizeBackgroundCompileTask(
   DCHECK(!shared_info->is_compiled());
 
   Handle<Script> script(Script::cast(shared_info->script()), isolate);
-  parse_info->set_script(script);
+  // TODO(leszeks): We can probably remove this, the parse_info flags should
+  // already match the script's.
+  parse_info->SetFlagsFromScript(isolate, *script);
 
   task->parser()->UpdateStatistics(isolate, script);
   task->parser()->HandleSourceURLComments(isolate, script);
 
   if (parse_info->literal() == nullptr || !task->outer_function_job()) {
     // Parsing or compile failed on background thread - report error messages.
-    return FailWithPendingException(isolate, parse_info, flag);
+    return FailWithPendingException(isolate, script, parse_info, flag);
   }
 
   // Parsing has succeeded - finalize compilation.
-  parse_info->ast_value_factory()->Internalize(isolate);
+  parse_info->ast_value_factory()->Internalize(isolate->factory());
   if (!FinalizeUnoptimizedCode(parse_info, isolate, shared_info,
                                task->outer_function_job(),
                                task->inner_function_jobs())) {
     // Finalization failed - throw an exception.
-    return FailWithPendingException(isolate, parse_info, flag);
+    return FailWithPendingException(isolate, script, parse_info, flag);
   }
 
   DCHECK(!isolate->has_pending_exception());
@@ -1493,9 +1516,9 @@ bool Compiler::CompileOptimized(Handle<JSFunction> function,
 }
 
 MaybeHandle<SharedFunctionInfo> Compiler::CompileForLiveEdit(
-    ParseInfo* parse_info, Isolate* isolate) {
+    ParseInfo* parse_info, Handle<Script> script, Isolate* isolate) {
   IsCompiledScope is_compiled_scope;
-  return CompileToplevel(parse_info, isolate, &is_compiled_scope);
+  return CompileToplevel(parse_info, script, isolate, &is_compiled_scope);
 }
 
 MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
@@ -1562,10 +1585,6 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
       }
     }
     script->set_eval_from_position(eval_position);
-    TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID(
-        TRACE_DISABLED_BY_DEFAULT("v8.compile"), "Script",
-        TRACE_ID_WITH_SCOPE(Script::kTraceScope, script->id()),
-        script->ToTracedValue());
 
     parse_info.set_eval();
     parse_info.set_language_mode(language_mode);
@@ -1576,7 +1595,7 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
     }
     DCHECK(!parse_info.is_module());
 
-    if (!CompileToplevel(&parse_info, isolate, &is_compiled_scope)
+    if (!CompileToplevel(&parse_info, script, isolate, &is_compiled_scope)
              .ToHandle(&shared_info)) {
       return MaybeHandle<JSFunction>();
     }
@@ -1652,13 +1671,14 @@ bool ModifyCodeGenerationFromStrings(Isolate* isolate, Handle<Context> context,
       isolate->modify_code_gen_callback();
   RuntimeCallTimerScope timer(
       isolate, RuntimeCallCounterId::kCodeGenerationFromStringsCallbacks);
-  MaybeLocal<v8::String> modified_source =
+  ModifyCodeGenerationFromStringsResult result =
       modify_callback(v8::Utils::ToLocal(context), v8::Utils::ToLocal(*source));
-  if (modified_source.IsEmpty()) return false;
-
-  // Use the new source (which might be the same as the old source) and return.
-  *source = Utils::OpenHandle(*modified_source.ToLocalChecked(), false);
-  return true;
+  if (result.codegen_allowed && !result.modified_source.IsEmpty()) {
+    // Use the new source (which might be the same as the old source).
+    *source =
+        Utils::OpenHandle(*result.modified_source.ToLocalChecked(), false);
+  }
+  return result.codegen_allowed;
 }
 
 // Run Embedder-mandated checks before generating code from a string.
@@ -1676,38 +1696,49 @@ bool ModifyCodeGenerationFromStrings(Isolate* isolate, Handle<Context> context,
 // - !source_is_null() and unknown_object can't be true at the same time.
 std::pair<MaybeHandle<String>, bool> Compiler::ValidateDynamicCompilationSource(
     Isolate* isolate, Handle<Context> context,
-    Handle<i::Object> source_object) {
-  Handle<String> source;
-  if (source_object->IsString()) source = Handle<String>::cast(source_object);
-
+    Handle<i::Object> original_source) {
   // Check if the context unconditionally allows code gen from strings.
   // allow_code_gen_from_strings can be many things, so we'll always check
   // against the 'false' literal, so that e.g. undefined and 'true' are treated
   // the same.
   if (!context->allow_code_gen_from_strings().IsFalse(isolate)) {
-    return {source, !source_object->IsString()};
+    if (!original_source->IsString()) {
+      return {MaybeHandle<String>(), true};
+    }
+    return {Handle<String>::cast(original_source), false};
   }
 
   // Check if the context allows code generation for this string.
   // allow_code_gen_callback only allows proper strings.
   // (I.e., let allow_code_gen_callback decide, if it has been set.)
   if (isolate->allow_code_gen_callback()) {
-    if (source_object->IsString() &&
-        CodeGenerationFromStringsAllowed(isolate, context, source)) {
-      return {source, !source_object->IsString()};
+    if (!original_source->IsString()) {
+      return {MaybeHandle<String>(), true};
     }
+    Handle<String> string_source = Handle<String>::cast(original_source);
+    if (!CodeGenerationFromStringsAllowed(isolate, context, string_source)) {
+      return {MaybeHandle<String>(), false};
+    }
+    return {string_source, false};
   }
 
   // Check if the context wants to block or modify this source object.
   // Double-check that we really have a string now.
   // (Let modify_code_gen_callback decide, if it's been set.)
   if (isolate->modify_code_gen_callback()) {
-    if (ModifyCodeGenerationFromStrings(isolate, context, &source_object) &&
-        source_object->IsString())
-      return {Handle<String>::cast(source_object), false};
+    Handle<i::Object> modified_source = original_source;
+    if (!ModifyCodeGenerationFromStrings(isolate, context, &modified_source)) {
+      return {MaybeHandle<String>(), false};
+    }
+    if (!modified_source->IsString()) {
+      return {MaybeHandle<String>(), true};
+    }
+    return {Handle<String>::cast(modified_source), false};
   }
 
-  return {MaybeHandle<String>(), !source_object->IsString()};
+  // If unconditional codegen was disabled, and no callback defined, we block
+  // strings and allow all other objects.
+  return {MaybeHandle<String>(), !original_source->IsString()};
 }
 
 MaybeHandle<JSFunction> Compiler::GetFunctionFromValidatedString(
@@ -1956,8 +1987,8 @@ Handle<Script> NewScript(Isolate* isolate, ParseInfo* parse_info,
                          ScriptOriginOptions origin_options,
                          NativesFlag natives) {
   // Create a script object describing the script to be compiled.
-  Handle<Script> script =
-      parse_info->CreateScript(isolate, source, origin_options, natives);
+  Handle<Script> script = parse_info->CreateScript(
+      isolate, source, origin_options, script_details.repl_mode, natives);
   Handle<Object> script_name;
   if (script_details.name_obj.ToHandle(&script_name)) {
     script->set_name(*script_name);
@@ -1973,10 +2004,6 @@ Handle<Script> NewScript(Isolate* isolate, ParseInfo* parse_info,
     script->set_host_defined_options(*host_defined_options);
   }
   LOG(isolate, ScriptDetails(*script));
-  TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID(
-      TRACE_DISABLED_BY_DEFAULT("v8.compile"), "Script",
-      TRACE_ID_WITH_SCOPE(Script::kTraceScope, script->id()),
-      script->ToTracedValue());
   return script;
 }
 
@@ -2052,8 +2079,9 @@ MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
   if (maybe_result.is_null()) {
     ParseInfo parse_info(isolate);
     // No cache entry found compile the script.
-    NewScript(isolate, &parse_info, source, script_details, origin_options,
-              natives);
+    Handle<Script> script = NewScript(isolate, &parse_info, source,
+                                      script_details, origin_options, natives);
+    DCHECK_EQ(parse_info.is_repl_mode(), script->is_repl_mode());
 
     // Compile the function and add it to the isolate cache.
     if (origin_options.IsModule()) parse_info.set_module();
@@ -2062,7 +2090,8 @@ MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
 
     parse_info.set_language_mode(
         stricter_language_mode(parse_info.language_mode(), language_mode));
-    maybe_result = CompileToplevel(&parse_info, isolate, &is_compiled_scope);
+    maybe_result =
+        CompileToplevel(&parse_info, script, isolate, &is_compiled_scope);
     Handle<SharedFunctionInfo> result;
     if (extension == nullptr && maybe_result.ToHandle(&result)) {
       DCHECK(is_compiled_scope.is_compiled());
@@ -2128,6 +2157,7 @@ MaybeHandle<JSFunction> Compiler::GetWrappedFunction(
 
     parse_info.set_eval();  // Use an eval scope as declaration scope.
     parse_info.set_function_syntax_kind(FunctionSyntaxKind::kWrapped);
+    parse_info.set_wrapped_arguments(arguments);
     // TODO(delphick): Remove this and instead make the wrapped and wrapper
     // functions fully non-lazy instead thus preventing source positions from
     // being omitted.
@@ -2140,7 +2170,8 @@ MaybeHandle<JSFunction> Compiler::GetWrappedFunction(
         stricter_language_mode(parse_info.language_mode(), language_mode));
 
     Handle<SharedFunctionInfo> top_level;
-    maybe_result = CompileToplevel(&parse_info, isolate, &is_compiled_scope);
+    maybe_result =
+        CompileToplevel(&parse_info, script, isolate, &is_compiled_scope);
     if (maybe_result.is_null()) isolate->ReportPendingMessages();
     ASSIGN_RETURN_ON_EXCEPTION(isolate, top_level, maybe_result, JSFunction);
 
@@ -2202,16 +2233,16 @@ Compiler::GetSharedFunctionInfoForStreamedScript(
 
     if (parse_info->literal() == nullptr || !task->outer_function_job()) {
       // Parsing has failed - report error messages.
-      FailWithPendingException(isolate, parse_info,
+      FailWithPendingException(isolate, script, parse_info,
                                Compiler::ClearExceptionFlag::KEEP_EXCEPTION);
     } else {
       // Parsing has succeeded - finalize compilation.
-      maybe_result =
-          FinalizeTopLevel(parse_info, isolate, task->outer_function_job(),
-                           task->inner_function_jobs());
+      maybe_result = FinalizeTopLevel(parse_info, script, isolate,
+                                      task->outer_function_job(),
+                                      task->inner_function_jobs());
       if (maybe_result.is_null()) {
         // Finalization failed - throw an exception.
-        FailWithPendingException(isolate, parse_info,
+        FailWithPendingException(isolate, script, parse_info,
                                  Compiler::ClearExceptionFlag::KEEP_EXCEPTION);
       }
     }
@@ -2290,9 +2321,9 @@ bool Compiler::FinalizeOptimizedCompilationJob(OptimizedCompilationJob* job,
 
   TimerEventScope<TimerEventRecompileSynchronous> timer(isolate);
   RuntimeCallTimerScope runtimeTimer(
-      isolate, RuntimeCallCounterId::kRecompileSynchronous);
+      isolate, RuntimeCallCounterId::kOptimizeConcurrentFinalize);
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-               "V8.RecompileSynchronous");
+               "V8.OptimizeConcurrentFinalize");
 
   Handle<SharedFunctionInfo> shared = compilation_info->shared_info();
 
diff --git a/deps/v8/src/codegen/compiler.h b/deps/v8/src/codegen/compiler.h
index 83d44dea29cf78..7747d1c0740efb 100644
--- a/deps/v8/src/codegen/compiler.h
+++ b/deps/v8/src/codegen/compiler.h
@@ -28,6 +28,7 @@ class OptimizedCompilationInfo;
 class OptimizedCompilationJob;
 class ParseInfo;
 class Parser;
+class RuntimeCallStats;
 class ScriptData;
 struct ScriptStreamingData;
 class TimedHistogram;
@@ -72,7 +73,8 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
                                      Handle<SharedFunctionInfo> shared);
 
   V8_WARN_UNUSED_RESULT static MaybeHandle<SharedFunctionInfo>
-  CompileForLiveEdit(ParseInfo* parse_info, Isolate* isolate);
+  CompileForLiveEdit(ParseInfo* parse_info, Handle<Script> script,
+                     Isolate* isolate);
 
   // Finalize and install code from previously run background compile task.
   static bool FinalizeBackgroundCompileTask(
@@ -112,15 +114,20 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
       int eval_scope_position, int eval_position);
 
   struct ScriptDetails {
-    ScriptDetails() : line_offset(0), column_offset(0) {}
+    ScriptDetails()
+        : line_offset(0), column_offset(0), repl_mode(REPLMode::kNo) {}
     explicit ScriptDetails(Handle<Object> script_name)
-        : line_offset(0), column_offset(0), name_obj(script_name) {}
+        : line_offset(0),
+          column_offset(0),
+          name_obj(script_name),
+          repl_mode(REPLMode::kNo) {}
 
     int line_offset;
     int column_offset;
     i::MaybeHandle<i::Object> name_obj;
     i::MaybeHandle<i::Object> source_map_url;
     i::MaybeHandle<i::FixedArray> host_defined_options;
+    REPLMode repl_mode;
   };
 
   // Create a function that results from wrapping |source| in a function,
@@ -300,7 +307,7 @@ class OptimizedCompilationJob : public CompilationJob {
 
   // Executes the compile job. Can be called on a background thread if
   // can_execute_on_background_thread() returns true.
-  V8_WARN_UNUSED_RESULT Status ExecuteJob();
+  V8_WARN_UNUSED_RESULT Status ExecuteJob(RuntimeCallStats* stats);
 
   // Finalizes the compile job. Must be called on the main thread.
   V8_WARN_UNUSED_RESULT Status FinalizeJob(Isolate* isolate);
@@ -325,7 +332,7 @@ class OptimizedCompilationJob : public CompilationJob {
  protected:
   // Overridden by the actual implementation.
   virtual Status PrepareJobImpl(Isolate* isolate) = 0;
-  virtual Status ExecuteJobImpl() = 0;
+  virtual Status ExecuteJobImpl(RuntimeCallStats* stats) = 0;
   virtual Status FinalizeJobImpl(Isolate* isolate) = 0;
 
  private:
diff --git a/deps/v8/src/codegen/cpu-features.h b/deps/v8/src/codegen/cpu-features.h
index 6b3d3934d0c111..9ff38bc40bf61a 100644
--- a/deps/v8/src/codegen/cpu-features.h
+++ b/deps/v8/src/codegen/cpu-features.h
@@ -62,6 +62,7 @@ enum CpuFeature {
   FLOATING_POINT_EXT,
   VECTOR_FACILITY,
   VECTOR_ENHANCE_FACILITY_1,
+  VECTOR_ENHANCE_FACILITY_2,
   MISC_INSTR_EXT2,
 #endif
 
diff --git a/deps/v8/src/codegen/external-reference.cc b/deps/v8/src/codegen/external-reference.cc
index e1f873cb38d330..3bd2f299d1c420 100644
--- a/deps/v8/src/codegen/external-reference.cc
+++ b/deps/v8/src/codegen/external-reference.cc
@@ -287,6 +287,8 @@ FUNCTION_REFERENCE(wasm_word32_popcnt, wasm::word32_popcnt_wrapper)
 FUNCTION_REFERENCE(wasm_word64_popcnt, wasm::word64_popcnt_wrapper)
 FUNCTION_REFERENCE(wasm_word32_rol, wasm::word32_rol_wrapper)
 FUNCTION_REFERENCE(wasm_word32_ror, wasm::word32_ror_wrapper)
+FUNCTION_REFERENCE(wasm_word64_rol, wasm::word64_rol_wrapper)
+FUNCTION_REFERENCE(wasm_word64_ror, wasm::word64_ror_wrapper)
 FUNCTION_REFERENCE(wasm_memory_copy, wasm::memory_copy_wrapper)
 FUNCTION_REFERENCE(wasm_memory_fill, wasm::memory_fill_wrapper)
 
@@ -504,16 +506,6 @@ ExternalReference ExternalReference::address_of_regexp_stack_limit_address(
   return ExternalReference(isolate->regexp_stack()->limit_address_address());
 }
 
-ExternalReference ExternalReference::address_of_regexp_stack_memory_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->regexp_stack()->memory_address_address());
-}
-
-ExternalReference ExternalReference::address_of_regexp_stack_memory_size(
-    Isolate* isolate) {
-  return ExternalReference(isolate->regexp_stack()->memory_size_address());
-}
-
 ExternalReference ExternalReference::address_of_regexp_stack_memory_top_address(
     Isolate* isolate) {
   return ExternalReference(
@@ -636,9 +628,9 @@ static Address JSReceiverCreateIdentityHash(Isolate* isolate, Address raw_key) {
 FUNCTION_REFERENCE(jsreceiver_create_identity_hash,
                    JSReceiverCreateIdentityHash)
 
-static uint32_t ComputeSeededIntegerHash(Isolate* isolate, uint32_t key) {
+static uint32_t ComputeSeededIntegerHash(Isolate* isolate, int32_t key) {
   DisallowHeapAllocation no_gc;
-  return ComputeSeededHash(key, HashSeed(isolate));
+  return ComputeSeededHash(static_cast<uint32_t>(key), HashSeed(isolate));
 }
 
 FUNCTION_REFERENCE(compute_integer_hash, ComputeSeededIntegerHash)
@@ -649,6 +641,7 @@ FUNCTION_REFERENCE(copy_typed_array_elements_to_typed_array,
 FUNCTION_REFERENCE(copy_typed_array_elements_slice, CopyTypedArrayElementsSlice)
 FUNCTION_REFERENCE(try_internalize_string_function,
                    StringTable::LookupStringIfExists_NoAllocate)
+FUNCTION_REFERENCE(string_to_array_index_function, String::ToArrayIndex)
 
 static Address LexicographicCompareWrapper(Isolate* isolate, Address smi_x,
                                            Address smi_y) {
diff --git a/deps/v8/src/codegen/external-reference.h b/deps/v8/src/codegen/external-reference.h
index 7cc0241fc4a5f8..9eb95e18d9e378 100644
--- a/deps/v8/src/codegen/external-reference.h
+++ b/deps/v8/src/codegen/external-reference.h
@@ -74,9 +74,6 @@ class StatsCounter;
   V(stack_is_iterable_address, "IsolateData::stack_is_iterable_address")       \
   V(address_of_regexp_stack_limit_address,                                     \
     "RegExpStack::limit_address_address()")                                    \
-  V(address_of_regexp_stack_memory_address,                                    \
-    "RegExpStack::memory_address_address()")                                   \
-  V(address_of_regexp_stack_memory_size, "RegExpStack::memory_size_address()") \
   V(address_of_regexp_stack_memory_top_address,                                \
     "RegExpStack::memory_top_address_address()")                               \
   V(address_of_static_offsets_vector, "OffsetsVector::static_offsets_vector")  \
@@ -170,6 +167,7 @@ class StatsCounter;
   V(search_string_raw_two_one, "search_string_raw_two_one")                   \
   V(search_string_raw_two_two, "search_string_raw_two_two")                   \
   V(smi_lexicographic_compare_function, "smi_lexicographic_compare_function") \
+  V(string_to_array_index_function, "String::ToArrayIndex")                   \
   V(try_internalize_string_function, "try_internalize_string_function")       \
   V(wasm_call_trap_callback_for_testing,                                      \
     "wasm::call_trap_callback_for_testing")                                   \
@@ -198,6 +196,8 @@ class StatsCounter;
   V(wasm_word32_popcnt, "wasm::word32_popcnt")                                \
   V(wasm_word32_rol, "wasm::word32_rol")                                      \
   V(wasm_word32_ror, "wasm::word32_ror")                                      \
+  V(wasm_word64_rol, "wasm::word64_rol")                                      \
+  V(wasm_word64_ror, "wasm::word64_ror")                                      \
   V(wasm_word64_ctz, "wasm::word64_ctz")                                      \
   V(wasm_word64_popcnt, "wasm::word64_popcnt")                                \
   V(wasm_memory_copy, "wasm::memory_copy")                                    \
diff --git a/deps/v8/src/codegen/handler-table.cc b/deps/v8/src/codegen/handler-table.cc
index 4f94746ea58f45..fcfb08cb7dd2b9 100644
--- a/deps/v8/src/codegen/handler-table.cc
+++ b/deps/v8/src/codegen/handler-table.cc
@@ -4,8 +4,10 @@
 
 #include "src/codegen/handler-table.h"
 
+#include <algorithm>
 #include <iomanip>
 
+#include "src/base/iterator.h"
 #include "src/codegen/assembler-inl.h"
 #include "src/objects/code-inl.h"
 #include "src/objects/objects-inl.h"
@@ -187,15 +189,39 @@ int HandlerTable::LookupRange(int pc_offset, int* data_out,
   return innermost_handler;
 }
 
-// TODO(turbofan): Make sure table is sorted and use binary search.
 int HandlerTable::LookupReturn(int pc_offset) {
-  for (int i = 0; i < NumberOfReturnEntries(); ++i) {
-    int return_offset = GetReturnOffset(i);
-    if (pc_offset == return_offset) {
-      return GetReturnHandler(i);
+  // We only implement the methods needed by the standard libraries we care
+  // about. This is not technically a full random access iterator by the spec.
+  struct Iterator : base::iterator<std::random_access_iterator_tag, int> {
+    Iterator(HandlerTable* tbl, int idx) : table(tbl), index(idx) {}
+    value_type operator*() const { return table->GetReturnOffset(index); }
+    bool operator!=(const Iterator& other) const { return !(*this == other); }
+    bool operator==(const Iterator& other) const {
+      return index == other.index;
     }
-  }
-  return -1;
+    Iterator& operator++() {
+      index++;
+      return *this;
+    }
+    Iterator& operator--() {
+      index--;
+      return *this;
+    }
+    Iterator& operator+=(difference_type offset) {
+      index += offset;
+      return *this;
+    }
+    difference_type operator-(const Iterator& other) const {
+      return index - other.index;
+    }
+    HandlerTable* table;
+    int index;
+  };
+  Iterator begin{this, 0}, end{this, NumberOfReturnEntries()};
+  SLOW_DCHECK(std::is_sorted(begin, end));  // Must be sorted.
+  Iterator result = std::lower_bound(begin, end, pc_offset);
+  bool exact_match = result != end && *result == pc_offset;
+  return exact_match ? GetReturnHandler(result.index) : -1;
 }
 
 #ifdef ENABLE_DISASSEMBLER
diff --git a/deps/v8/src/codegen/handler-table.h b/deps/v8/src/codegen/handler-table.h
index 1aa6b8120315de..cf88724682381f 100644
--- a/deps/v8/src/codegen/handler-table.h
+++ b/deps/v8/src/codegen/handler-table.h
@@ -5,9 +5,9 @@
 #ifndef V8_CODEGEN_HANDLER_TABLE_H_
 #define V8_CODEGEN_HANDLER_TABLE_H_
 
+#include "src/base/bit-field.h"
 #include "src/common/assert-scope.h"
 #include "src/common/globals.h"
-#include "src/utils/utils.h"
 
 namespace v8 {
 namespace internal {
@@ -43,6 +43,10 @@ class V8_EXPORT_PRIVATE HandlerTable {
     ASYNC_AWAIT,  // The exception will be caught and cause a promise rejection
                   // in the desugaring of an async function, so special
                   // async/await handling in the debugger can take place.
+    UNCAUGHT_ASYNC_AWAIT,  // The exception will be caught and cause a promise
+                           // rejection in the desugaring of an async REPL
+                           // script. The corresponding message object needs to
+                           // be kept alive on the Isolate though.
   };
 
   enum EncodingMode { kRangeBasedEncoding, kReturnAddressBasedEncoding };
@@ -129,8 +133,8 @@ class V8_EXPORT_PRIVATE HandlerTable {
   static const int kReturnEntrySize = 2;
 
   // Encoding of the {handler} field.
-  using HandlerPredictionField = BitField<CatchPrediction, 0, 3>;
-  using HandlerOffsetField = BitField<int, 3, 29>;
+  using HandlerPredictionField = base::BitField<CatchPrediction, 0, 3>;
+  using HandlerOffsetField = base::BitField<int, 3, 29>;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/codegen/ia32/assembler-ia32.cc b/deps/v8/src/codegen/ia32/assembler-ia32.cc
index 405e4b7c553fe1..1d3b9e2644fb16 100644
--- a/deps/v8/src/codegen/ia32/assembler-ia32.cc
+++ b/deps/v8/src/codegen/ia32/assembler-ia32.cc
@@ -1194,7 +1194,7 @@ void Assembler::shrd(Register dst, Register src, uint8_t shift) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0xAC);
-  emit_operand(dst, Operand(src));
+  emit_operand(src, Operand(dst));
   EMIT(shift);
 }
 
@@ -1225,7 +1225,7 @@ void Assembler::sub(Operand dst, Register src) {
 void Assembler::sub_sp_32(uint32_t imm) {
   EnsureSpace ensure_space(this);
   EMIT(0x81);  // using a literal 32-bit immediate.
-  static constexpr Register ireg = Register::from_code<5>();
+  static constexpr Register ireg = Register::from_code(5);
   emit_operand(ireg, Operand(esp));
   emit(imm);
 }
@@ -1577,6 +1577,7 @@ void Assembler::call(Operand adr) {
 void Assembler::call(Handle<Code> code, RelocInfo::Mode rmode) {
   EnsureSpace ensure_space(this);
   DCHECK(RelocInfo::IsCodeTarget(rmode));
+  DCHECK(code->IsExecutable());
   EMIT(0xE8);
   emit(code, rmode);
 }
@@ -2311,6 +2312,15 @@ void Assembler::movups(Operand dst, XMMRegister src) {
   emit_sse_operand(src, dst);
 }
 
+void Assembler::movddup(XMMRegister dst, Operand src) {
+  DCHECK(IsEnabled(SSE3));
+  EnsureSpace ensure_space(this);
+  EMIT(0xF2);
+  EMIT(0x0F);
+  EMIT(0x12);
+  emit_sse_operand(dst, src);
+}
+
 void Assembler::shufps(XMMRegister dst, XMMRegister src, byte imm8) {
   DCHECK(is_uint8(imm8));
   EnsureSpace ensure_space(this);
@@ -2495,14 +2505,6 @@ void Assembler::psllq(XMMRegister reg, uint8_t shift) {
   EMIT(shift);
 }
 
-void Assembler::psllq(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  EMIT(0x66);
-  EMIT(0x0F);
-  EMIT(0xF3);
-  emit_sse_operand(dst, src);
-}
-
 void Assembler::psrlq(XMMRegister reg, uint8_t shift) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
@@ -2512,14 +2514,6 @@ void Assembler::psrlq(XMMRegister reg, uint8_t shift) {
   EMIT(shift);
 }
 
-void Assembler::psrlq(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  EMIT(0x66);
-  EMIT(0x0F);
-  EMIT(0xD3);
-  emit_sse_operand(dst, src);
-}
-
 void Assembler::pshufhw(XMMRegister dst, Operand src, uint8_t shuffle) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
@@ -2798,6 +2792,12 @@ void Assembler::vpslld(XMMRegister dst, XMMRegister src, uint8_t imm8) {
   EMIT(imm8);
 }
 
+void Assembler::vpsllq(XMMRegister dst, XMMRegister src, uint8_t imm8) {
+  XMMRegister iop = XMMRegister::from_code(6);
+  vinstr(0x73, iop, dst, Operand(src), k66, k0F, kWIG);
+  EMIT(imm8);
+}
+
 void Assembler::vpsrlw(XMMRegister dst, XMMRegister src, uint8_t imm8) {
   XMMRegister iop = XMMRegister::from_code(2);
   vinstr(0x71, iop, dst, Operand(src), k66, k0F, kWIG);
@@ -2941,7 +2941,7 @@ void Assembler::bmi2(SIMDPrefix pp, byte op, Register reg, Register vreg,
 void Assembler::rorx(Register dst, Operand src, byte imm8) {
   DCHECK(IsEnabled(BMI2));
   DCHECK(is_uint8(imm8));
-  Register vreg = Register::from_code<0>();  // VEX.vvvv unused
+  Register vreg = Register::from_code(0);  // VEX.vvvv unused
   EnsureSpace ensure_space(this);
   emit_vex_prefix(vreg, kLZ, kF2, k0F3A, kW0);
   EMIT(0xF0);
diff --git a/deps/v8/src/codegen/ia32/assembler-ia32.h b/deps/v8/src/codegen/ia32/assembler-ia32.h
index 8161ff83223688..4cd713811b6862 100644
--- a/deps/v8/src/codegen/ia32/assembler-ia32.h
+++ b/deps/v8/src/codegen/ia32/assembler-ia32.h
@@ -343,8 +343,8 @@ class Displacement {
  private:
   int data_;
 
-  using TypeField = BitField<Type, 0, 2>;
-  using NextField = BitField<int, 2, 32 - 2>;
+  using TypeField = base::BitField<Type, 0, 2>;
+  using NextField = base::BitField<int, 2, 32 - 2>;
 
   void init(Label* L, Type type);
 };
@@ -361,6 +361,7 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   // otherwise valid instructions.)
   // This allows for a single, fast space check per instruction.
   static constexpr int kGap = 32;
+  STATIC_ASSERT(AssemblerBase::kMinimalBufferSize >= 2 * kGap);
 
  public:
   // Create an assembler. Instructions and relocation information are emitted
@@ -996,9 +997,7 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void psraw(XMMRegister reg, uint8_t shift);
   void psrad(XMMRegister reg, uint8_t shift);
   void psllq(XMMRegister reg, uint8_t shift);
-  void psllq(XMMRegister dst, XMMRegister src);
   void psrlq(XMMRegister reg, uint8_t shift);
-  void psrlq(XMMRegister dst, XMMRegister src);
 
   void pshufhw(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
     pshufhw(dst, Operand(src), shuffle);
@@ -1027,6 +1026,10 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
     pextrb(Operand(dst), src, offset);
   }
   void pextrb(Operand dst, XMMRegister src, uint8_t offset);
+  // SSE3 instructions
+  void movddup(XMMRegister dst, Operand src);
+  void movddup(XMMRegister dst, XMMRegister src) { movddup(dst, Operand(src)); }
+
   // Use SSE4_1 encoding for pextrw reg, xmm, imm8 for consistency
   void pextrw(Register dst, XMMRegister src, uint8_t offset) {
     pextrw(Operand(dst), src, offset);
@@ -1332,6 +1335,7 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
 
   void vpsllw(XMMRegister dst, XMMRegister src, uint8_t imm8);
   void vpslld(XMMRegister dst, XMMRegister src, uint8_t imm8);
+  void vpsllq(XMMRegister dst, XMMRegister src, uint8_t imm8);
   void vpsrlw(XMMRegister dst, XMMRegister src, uint8_t imm8);
   void vpsrld(XMMRegister dst, XMMRegister src, uint8_t imm8);
   void vpsraw(XMMRegister dst, XMMRegister src, uint8_t imm8);
@@ -1411,6 +1415,15 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
     vinstr(0x5B, dst, xmm0, src, kF3, k0F, kWIG);
   }
 
+  void vmovddup(XMMRegister dst, Operand src) {
+    vinstr(0x12, dst, xmm0, src, kF2, k0F, kWIG);
+  }
+  void vmovddup(XMMRegister dst, XMMRegister src) {
+    vmovddup(dst, Operand(src));
+  }
+  void vbroadcastss(XMMRegister dst, Operand src) {
+    vinstr(0x18, dst, xmm0, src, k66, k0F38, kW0);
+  }
   void vmovdqu(XMMRegister dst, Operand src) {
     vinstr(0x6F, dst, xmm0, src, kF3, k0F, kWIG);
   }
diff --git a/deps/v8/src/codegen/ia32/macro-assembler-ia32.cc b/deps/v8/src/codegen/ia32/macro-assembler-ia32.cc
index dd11bc496eda80..4741cdb10d9c00 100644
--- a/deps/v8/src/codegen/ia32/macro-assembler-ia32.cc
+++ b/deps/v8/src/codegen/ia32/macro-assembler-ia32.cc
@@ -159,7 +159,6 @@ Operand TurboAssembler::ExternalReferenceAsOperand(ExternalReference reference,
 // TurboAssembler.
 Operand TurboAssembler::ExternalReferenceAddressAsOperand(
     ExternalReference reference) {
-  DCHECK(FLAG_embedded_builtins);
   DCHECK(root_array_available());
   DCHECK(options().isolate_independent_code);
   return Operand(
@@ -170,7 +169,6 @@ Operand TurboAssembler::ExternalReferenceAddressAsOperand(
 // TODO(v8:6666): If possible, refactor into a platform-independent function in
 // TurboAssembler.
 Operand TurboAssembler::HeapObjectAsOperand(Handle<HeapObject> object) {
-  DCHECK(FLAG_embedded_builtins);
   DCHECK(root_array_available());
 
   int builtin_index;
@@ -573,9 +571,10 @@ void TurboAssembler::Cvttsd2ui(Register dst, Operand src, XMMRegister tmp) {
 }
 
 void TurboAssembler::ShlPair(Register high, Register low, uint8_t shift) {
+  DCHECK_GE(63, shift);
   if (shift >= 32) {
     mov(high, low);
-    shl(high, shift - 32);
+    if (shift != 32) shl(high, shift - 32);
     xor_(low, low);
   } else {
     shld(high, low, shift);
@@ -595,12 +594,13 @@ void TurboAssembler::ShlPair_cl(Register high, Register low) {
 }
 
 void TurboAssembler::ShrPair(Register high, Register low, uint8_t shift) {
+  DCHECK_GE(63, shift);
   if (shift >= 32) {
     mov(low, high);
-    shr(low, shift - 32);
+    if (shift != 32) shr(low, shift - 32);
     xor_(high, high);
   } else {
-    shrd(high, low, shift);
+    shrd(low, high, shift);
     shr(high, shift);
   }
 }
@@ -617,12 +617,13 @@ void TurboAssembler::ShrPair_cl(Register high, Register low) {
 }
 
 void TurboAssembler::SarPair(Register high, Register low, uint8_t shift) {
+  DCHECK_GE(63, shift);
   if (shift >= 32) {
     mov(low, high);
-    sar(low, shift - 32);
+    if (shift != 32) sar(low, shift - 32);
     sar(high, 31);
   } else {
-    shrd(high, low, shift);
+    shrd(low, high, shift);
     sar(high, shift);
   }
 }
@@ -638,9 +639,13 @@ void TurboAssembler::SarPair_cl(Register high, Register low) {
   bind(&done);
 }
 
+void TurboAssembler::LoadMap(Register destination, Register object) {
+  mov(destination, FieldOperand(object, HeapObject::kMapOffset));
+}
+
 void MacroAssembler::CmpObjectType(Register heap_object, InstanceType type,
                                    Register map) {
-  mov(map, FieldOperand(heap_object, HeapObject::kMapOffset));
+  LoadMap(map, heap_object);
   CmpInstanceType(map, type);
 }
 
@@ -660,9 +665,9 @@ void MacroAssembler::AssertConstructor(Register object) {
     test(object, Immediate(kSmiTagMask));
     Check(not_equal, AbortReason::kOperandIsASmiAndNotAConstructor);
     Push(object);
-    mov(object, FieldOperand(object, HeapObject::kMapOffset));
+    LoadMap(object, object);
     test_b(FieldOperand(object, Map::kBitFieldOffset),
-           Immediate(Map::IsConstructorBit::kMask));
+           Immediate(Map::Bits1::IsConstructorBit::kMask));
     Pop(object);
     Check(not_zero, AbortReason::kOperandIsNotAConstructor);
   }
@@ -700,8 +705,7 @@ void MacroAssembler::AssertGeneratorObject(Register object) {
     Push(object);
     Register map = object;
 
-    // Load map
-    mov(map, FieldOperand(object, HeapObject::kMapOffset));
+    LoadMap(map, object);
 
     Label do_check;
     // Check if JSGeneratorObject
@@ -976,20 +980,6 @@ void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
   Call(code, RelocInfo::CODE_TARGET);
 }
 
-void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
-                                           Register centry) {
-  const Runtime::Function* f = Runtime::FunctionForId(fid);
-  // TODO(1236192): Most runtime routines don't need the number of
-  // arguments passed in because it is constant. At some point we
-  // should remove this need and make the runtime routine entry code
-  // smarter.
-  Move(kRuntimeCallArgCountRegister, Immediate(f->nargs));
-  Move(kRuntimeCallFunctionRegister, Immediate(ExternalReference::Create(f)));
-  DCHECK(!AreAliased(centry, kRuntimeCallArgCountRegister,
-                     kRuntimeCallFunctionRegister));
-  CallCodeObject(centry);
-}
-
 void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
   // ----------- S t a t e -------------
   //  -- esp[0]                 : return address
@@ -1027,36 +1017,18 @@ void MacroAssembler::JumpToInstructionStream(Address entry) {
 }
 
 void TurboAssembler::PrepareForTailCall(
-    const ParameterCount& callee_args_count, Register caller_args_count_reg,
-    Register scratch0, Register scratch1,
-    int number_of_temp_values_after_return_address) {
-#if DEBUG
-  if (callee_args_count.is_reg()) {
-    DCHECK(!AreAliased(callee_args_count.reg(), caller_args_count_reg, scratch0,
-                       scratch1));
-  } else {
-    DCHECK(!AreAliased(caller_args_count_reg, scratch0, scratch1));
-  }
-#endif
+    Register callee_args_count, Register caller_args_count, Register scratch0,
+    Register scratch1, int number_of_temp_values_after_return_address) {
+  DCHECK(!AreAliased(callee_args_count, caller_args_count, scratch0, scratch1));
 
   // Calculate the destination address where we will put the return address
   // after we drop current frame.
   Register new_sp_reg = scratch0;
-  if (callee_args_count.is_reg()) {
-    sub(caller_args_count_reg, callee_args_count.reg());
-    lea(new_sp_reg,
-        Operand(ebp, caller_args_count_reg, times_system_pointer_size,
-                StandardFrameConstants::kCallerPCOffset -
-                    number_of_temp_values_after_return_address *
-                        kSystemPointerSize));
-  } else {
-    lea(new_sp_reg,
-        Operand(ebp, caller_args_count_reg, times_system_pointer_size,
-                StandardFrameConstants::kCallerPCOffset -
-                    (callee_args_count.immediate() +
-                     number_of_temp_values_after_return_address) *
-                        kSystemPointerSize));
-  }
+  sub(caller_args_count, callee_args_count);
+  lea(new_sp_reg, Operand(ebp, caller_args_count, times_system_pointer_size,
+                          StandardFrameConstants::kCallerPCOffset -
+                              number_of_temp_values_after_return_address *
+                                  kSystemPointerSize));
 
   if (FLAG_debug_code) {
     cmp(esp, new_sp_reg);
@@ -1077,15 +1049,9 @@ void TurboAssembler::PrepareForTailCall(
   mov(ebp, Operand(ebp, StandardFrameConstants::kCallerFPOffset));
 
   // +2 here is to copy both receiver and return address.
-  Register count_reg = caller_args_count_reg;
-  if (callee_args_count.is_reg()) {
-    lea(count_reg, Operand(callee_args_count.reg(),
-                           2 + number_of_temp_values_after_return_address));
-  } else {
-    mov(count_reg, Immediate(callee_args_count.immediate() + 2 +
-                             number_of_temp_values_after_return_address));
-    // TODO(ishell): Unroll copying loop for small immediate values.
-  }
+  Register count_reg = caller_args_count;
+  lea(count_reg, Operand(callee_args_count,
+                         2 + number_of_temp_values_after_return_address));
 
   // Now copy callee arguments to the caller frame going backwards to avoid
   // callee arguments corruption (source and destination areas could overlap).
@@ -1103,121 +1069,70 @@ void TurboAssembler::PrepareForTailCall(
   mov(esp, new_sp_reg);
 }
 
-void MacroAssembler::InvokePrologue(const ParameterCount& expected,
-                                    const ParameterCount& actual, Label* done,
-                                    bool* definitely_mismatches,
-                                    InvokeFlag flag,
-                                    Label::Distance done_near) {
-  DCHECK_IMPLIES(expected.is_reg(), expected.reg() == ecx);
-  DCHECK_IMPLIES(actual.is_reg(), actual.reg() == eax);
-
-  bool definitely_matches = false;
-  *definitely_mismatches = false;
-  Label invoke;
-  if (expected.is_immediate()) {
-    DCHECK(actual.is_immediate());
-    mov(eax, actual.immediate());
-    if (expected.immediate() == actual.immediate()) {
-      definitely_matches = true;
-    } else {
-      const int sentinel = SharedFunctionInfo::kDontAdaptArgumentsSentinel;
-      if (expected.immediate() == sentinel) {
-        // Don't worry about adapting arguments for builtins that
-        // don't want that done. Skip adaption code by making it look
-        // like we have a match between expected and actual number of
-        // arguments.
-        definitely_matches = true;
-      } else {
-        *definitely_mismatches = true;
-        mov(ecx, expected.immediate());
-      }
-    }
-  } else {
-    if (actual.is_immediate()) {
-      // Expected is in register, actual is immediate. This is the
-      // case when we invoke function values without going through the
-      // IC mechanism.
-      mov(eax, actual.immediate());
-      cmp(expected.reg(), actual.immediate());
-      j(equal, &invoke);
-      DCHECK(expected.reg() == ecx);
-    } else if (expected.reg() != actual.reg()) {
-      // Both expected and actual are in (different) registers. This
-      // is the case when we invoke functions using call and apply.
-      cmp(expected.reg(), actual.reg());
-      j(equal, &invoke);
-      DCHECK(actual.reg() == eax);
-      DCHECK(expected.reg() == ecx);
-    } else {
-      definitely_matches = true;
-      Move(eax, actual.reg());
-    }
-  }
+void MacroAssembler::InvokePrologue(Register expected_parameter_count,
+                                    Register actual_parameter_count,
+                                    Label* done, InvokeFlag flag) {
+  DCHECK_EQ(actual_parameter_count, eax);
 
-  if (!definitely_matches) {
+  if (expected_parameter_count != actual_parameter_count) {
+    DCHECK_EQ(expected_parameter_count, ecx);
+
+    Label regular_invoke;
+    cmp(expected_parameter_count, actual_parameter_count);
+    j(equal, &regular_invoke);
     Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
     if (flag == CALL_FUNCTION) {
       Call(adaptor, RelocInfo::CODE_TARGET);
-      if (!*definitely_mismatches) {
-        jmp(done, done_near);
-      }
+      jmp(done, Label::kNear);
     } else {
       Jump(adaptor, RelocInfo::CODE_TARGET);
     }
-    bind(&invoke);
+    bind(&regular_invoke);
   }
 }
 
 void MacroAssembler::CallDebugOnFunctionCall(Register fun, Register new_target,
-                                             const ParameterCount& expected,
-                                             const ParameterCount& actual) {
+                                             Register expected_parameter_count,
+                                             Register actual_parameter_count) {
   FrameScope frame(this, has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
-  if (expected.is_reg()) {
-    SmiTag(expected.reg());
-    Push(expected.reg());
-  }
-  if (actual.is_reg()) {
-    SmiTag(actual.reg());
-    Push(actual.reg());
-    SmiUntag(actual.reg());
-  }
+  SmiTag(expected_parameter_count);
+  Push(expected_parameter_count);
+
+  SmiTag(actual_parameter_count);
+  Push(actual_parameter_count);
+  SmiUntag(actual_parameter_count);
+
   if (new_target.is_valid()) {
     Push(new_target);
   }
   Push(fun);
   Push(fun);
   Operand receiver_op =
-      actual.is_reg()
-          ? Operand(ebp, actual.reg(), times_system_pointer_size,
-                    kSystemPointerSize * 2)
-          : Operand(ebp, actual.immediate() * times_system_pointer_size +
-                             kSystemPointerSize * 2);
+      Operand(ebp, actual_parameter_count, times_system_pointer_size,
+              kSystemPointerSize * 2);
   Push(receiver_op);
   CallRuntime(Runtime::kDebugOnFunctionCall);
   Pop(fun);
   if (new_target.is_valid()) {
     Pop(new_target);
   }
-  if (actual.is_reg()) {
-    Pop(actual.reg());
-    SmiUntag(actual.reg());
-  }
-  if (expected.is_reg()) {
-    Pop(expected.reg());
-    SmiUntag(expected.reg());
-  }
+  Pop(actual_parameter_count);
+  SmiUntag(actual_parameter_count);
+
+  Pop(expected_parameter_count);
+  SmiUntag(expected_parameter_count);
 }
 
 void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
-                                        const ParameterCount& expected,
-                                        const ParameterCount& actual,
+                                        Register expected_parameter_count,
+                                        Register actual_parameter_count,
                                         InvokeFlag flag) {
   // You can't call a function without a valid frame.
   DCHECK(flag == JUMP_FUNCTION || has_frame());
-  DCHECK(function == edi);
+  DCHECK_EQ(function, edi);
   DCHECK_IMPLIES(new_target.is_valid(), new_target == edx);
-  DCHECK_IMPLIES(expected.is_reg(), expected.reg() == ecx);
-  DCHECK_IMPLIES(actual.is_reg(), actual.reg() == eax);
+  DCHECK(expected_parameter_count == ecx || expected_parameter_count == eax);
+  DCHECK_EQ(actual_parameter_count, eax);
 
   // On function call, call into the debugger if necessary.
   Label debug_hook, continue_after_hook;
@@ -1237,34 +1152,31 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
   }
 
   Label done;
-  bool definitely_mismatches = false;
-  InvokePrologue(expected, actual, &done, &definitely_mismatches, flag,
-                 Label::kNear);
-  if (!definitely_mismatches) {
-    // We call indirectly through the code field in the function to
-    // allow recompilation to take effect without changing any of the
-    // call sites.
-    static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
-    mov(ecx, FieldOperand(function, JSFunction::kCodeOffset));
-    if (flag == CALL_FUNCTION) {
-      CallCodeObject(ecx);
-    } else {
-      DCHECK(flag == JUMP_FUNCTION);
-      JumpCodeObject(ecx);
-    }
+  InvokePrologue(expected_parameter_count, actual_parameter_count, &done, flag);
+  // We call indirectly through the code field in the function to
+  // allow recompilation to take effect without changing any of the
+  // call sites.
+  static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
+  mov(ecx, FieldOperand(function, JSFunction::kCodeOffset));
+  if (flag == CALL_FUNCTION) {
+    CallCodeObject(ecx);
+  } else {
+    DCHECK(flag == JUMP_FUNCTION);
+    JumpCodeObject(ecx);
   }
   jmp(&done, Label::kNear);
 
   // Deferred debug hook.
   bind(&debug_hook);
-  CallDebugOnFunctionCall(function, new_target, expected, actual);
+  CallDebugOnFunctionCall(function, new_target, expected_parameter_count,
+                          actual_parameter_count);
   jmp(&continue_after_hook, Label::kNear);
 
   bind(&done);
 }
 
 void MacroAssembler::InvokeFunction(Register fun, Register new_target,
-                                    const ParameterCount& actual,
+                                    Register actual_parameter_count,
                                     InvokeFlag flag) {
   // You can't call a function without a valid frame.
   DCHECK(flag == JUMP_FUNCTION || has_frame());
@@ -1275,20 +1187,21 @@ void MacroAssembler::InvokeFunction(Register fun, Register new_target,
   movzx_w(ecx,
           FieldOperand(ecx, SharedFunctionInfo::kFormalParameterCountOffset));
 
-  ParameterCount expected(ecx);
-  InvokeFunctionCode(edi, new_target, expected, actual, flag);
+  InvokeFunctionCode(edi, new_target, ecx, actual_parameter_count, flag);
 }
 
 void MacroAssembler::LoadGlobalProxy(Register dst) {
-  mov(dst, NativeContextOperand());
-  mov(dst, ContextOperand(dst, Context::GLOBAL_PROXY_INDEX));
+  LoadNativeContextSlot(dst, Context::GLOBAL_PROXY_INDEX);
 }
 
-void MacroAssembler::LoadGlobalFunction(int index, Register function) {
+void MacroAssembler::LoadNativeContextSlot(Register destination, int index) {
   // Load the native context from the current context.
-  mov(function, NativeContextOperand());
+  LoadMap(destination, esi);
+  mov(destination,
+      FieldOperand(destination,
+                   Map::kConstructorOrBackPointerOrNativeContextOffset));
   // Load the function from the native context.
-  mov(function, ContextOperand(function, index));
+  mov(destination, Operand(destination, Context::SlotOffset(index)));
 }
 
 int MacroAssembler::SafepointRegisterStackIndex(int reg_code) {
@@ -1628,6 +1541,20 @@ void TurboAssembler::Pextrd(Register dst, XMMRegister src, uint8_t imm8) {
   add(esp, Immediate(kDoubleSize));
 }
 
+void TurboAssembler::Pinsrb(XMMRegister dst, Operand src, int8_t imm8) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpinsrb(dst, dst, src, imm8);
+    return;
+  }
+  if (CpuFeatures::IsSupported(SSE4_1)) {
+    CpuFeatureScope sse_scope(this, SSE4_1);
+    pinsrb(dst, src, imm8);
+    return;
+  }
+  FATAL("no AVX or SSE4.1 support");
+}
+
 void TurboAssembler::Pinsrd(XMMRegister dst, Operand src, uint8_t imm8) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
@@ -1658,6 +1585,27 @@ void TurboAssembler::Pinsrd(XMMRegister dst, Operand src, uint8_t imm8) {
   add(esp, Immediate(kDoubleSize));
 }
 
+void TurboAssembler::Pinsrw(XMMRegister dst, Operand src, int8_t imm8) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpinsrw(dst, dst, src, imm8);
+    return;
+  } else {
+    pinsrw(dst, src, imm8);
+    return;
+  }
+}
+
+void TurboAssembler::Vbroadcastss(XMMRegister dst, Operand src) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope avx_scope(this, AVX);
+    vbroadcastss(dst, src);
+    return;
+  }
+  movss(dst, src);
+  shufps(dst, dst, static_cast<byte>(0));
+}
+
 void TurboAssembler::Lzcnt(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(LZCNT)) {
     CpuFeatureScope scope(this, LZCNT);
@@ -1667,7 +1615,7 @@ void TurboAssembler::Lzcnt(Register dst, Operand src) {
   Label not_zero_src;
   bsr(dst, src);
   j(not_zero, &not_zero_src, Label::kNear);
-  Move(dst, Immediate(63));  // 63^31 == 32
+  mov(dst, 63);  // 63^31 == 32
   bind(&not_zero_src);
   xor_(dst, Immediate(31));  // for x in [0..31], 31^x == 31-x.
 }
@@ -1681,7 +1629,7 @@ void TurboAssembler::Tzcnt(Register dst, Operand src) {
   Label not_zero_src;
   bsf(dst, src);
   j(not_zero, &not_zero_src, Label::kNear);
-  Move(dst, Immediate(32));  // The result of tzcnt is 32 if src = 0.
+  mov(dst, 32);  // The result of tzcnt is 32 if src = 0.
   bind(&not_zero_src);
 }
 
@@ -1908,7 +1856,6 @@ void TurboAssembler::CallBuiltinByIndex(Register builtin_index) {
 
 void TurboAssembler::CallBuiltin(int builtin_index) {
   DCHECK(Builtins::IsBuiltinId(builtin_index));
-  DCHECK(FLAG_embedded_builtins);
   RecordCommentForOffHeapTrampoline(builtin_index);
   CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
   EmbeddedData d = EmbeddedData::FromBlob();
@@ -2088,6 +2035,8 @@ void TurboAssembler::CallForDeoptimization(Address target, int deopt_id) {
   call(target, RelocInfo::RUNTIME_ENTRY);
 }
 
+void TurboAssembler::Trap() { int3(); }
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/ia32/macro-assembler-ia32.h b/deps/v8/src/codegen/ia32/macro-assembler-ia32.h
index 9e7774c55d5da6..4d2ea96a923a98 100644
--- a/deps/v8/src/codegen/ia32/macro-assembler-ia32.h
+++ b/deps/v8/src/codegen/ia32/macro-assembler-ia32.h
@@ -103,13 +103,13 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 
   void Jump(Handle<Code> code_object, RelocInfo::Mode rmode);
 
+  void LoadMap(Register destination, Register object);
+
   void RetpolineJump(Register reg);
 
-  void CallForDeoptimization(Address target, int deopt_id);
+  void Trap() override;
 
-  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
-  // builtin for the target runtime function and uses an indirect call.
-  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
+  void CallForDeoptimization(Address target, int deopt_id);
 
   // Jump the register contains a smi.
   inline void JumpIfSmi(Register value, Label* smi_label,
@@ -138,14 +138,14 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 
   // Removes current frame and its arguments from the stack preserving the
   // arguments and a return address pushed to the stack for the next call. Both
-  // |callee_args_count| and |caller_args_count_reg| do not include receiver.
-  // |callee_args_count| is not modified, |caller_args_count_reg| is trashed.
+  // |callee_args_count| and |caller_args_count| do not include receiver.
+  // |callee_args_count| is not modified. |caller_args_count| is trashed.
   // |number_of_temp_values_after_return_address| specifies the number of words
   // pushed to the stack after the return address. This is to allow "allocation"
   // of scratch registers that this function requires by saving their values on
   // the stack.
-  void PrepareForTailCall(const ParameterCount& callee_args_count,
-                          Register caller_args_count_reg, Register scratch0,
+  void PrepareForTailCall(Register callee_args_count,
+                          Register caller_args_count, Register scratch0,
                           Register scratch1,
                           int number_of_temp_values_after_return_address);
 
@@ -260,6 +260,7 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_OP2_WITH_TYPE(Movd, movd, Operand, XMMRegister)
   AVX_OP2_WITH_TYPE(Cvtdq2ps, cvtdq2ps, XMMRegister, Operand)
   AVX_OP2_WITH_TYPE(Sqrtpd, sqrtpd, XMMRegister, const Operand&)
+  AVX_OP2_WITH_TYPE(Movaps, movaps, XMMRegister, XMMRegister)
   AVX_OP2_WITH_TYPE(Movapd, movapd, XMMRegister, XMMRegister)
   AVX_OP2_WITH_TYPE(Movapd, movapd, XMMRegister, const Operand&)
 
@@ -289,8 +290,11 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_OP3_XO(Psubb, psubb)
   AVX_OP3_XO(Psubw, psubw)
   AVX_OP3_XO(Psubd, psubd)
+  AVX_OP3_XO(Psubq, psubq)
   AVX_OP3_XO(Punpcklbw, punpcklbw)
   AVX_OP3_XO(Punpckhbw, punpckhbw)
+  AVX_OP3_XO(Punpckldq, punpckldq)
+  AVX_OP3_XO(Punpcklqdq, punpcklqdq)
   AVX_OP3_XO(Pxor, pxor)
   AVX_OP3_XO(Andps, andps)
   AVX_OP3_XO(Andnps, andnps)
@@ -331,7 +335,16 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_PACKED_OP3(Minpd, minpd)
   AVX_PACKED_OP3(Maxpd, maxpd)
   AVX_PACKED_OP3(Cmpunordpd, cmpunordpd)
+  AVX_PACKED_OP3(Psllq, psllq)
+  AVX_PACKED_OP3(Psrlq, psrlq)
+  AVX_PACKED_OP3(Paddq, paddq)
+  AVX_PACKED_OP3(Psubq, psubq)
+  AVX_PACKED_OP3(Pmuludq, pmuludq)
+  AVX_PACKED_OP3(Pavgb, pavgb)
+  AVX_PACKED_OP3(Pavgw, pavgw)
 #undef AVX_PACKED_OP3
+
+  AVX_PACKED_OP3_WITH_TYPE(Psllq, psllq, XMMRegister, uint8_t)
 #undef AVX_PACKED_OP3_WITH_TYPE
 
 // Non-SSE2 instructions.
@@ -350,6 +363,12 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
     }                                                                 \
     UNREACHABLE();                                                    \
   }
+#define AVX_OP2_XO_SSE3(macro_name, name)                                   \
+  AVX_OP2_WITH_TYPE_SCOPE(macro_name, name, XMMRegister, XMMRegister, SSE3) \
+  AVX_OP2_WITH_TYPE_SCOPE(macro_name, name, XMMRegister, Operand, SSE3)
+  AVX_OP2_XO_SSE3(Movddup, movddup)
+
+#undef AVX_OP2_XO_SSE3
 #define AVX_OP2_XO_SSE4(macro_name, name)                                     \
   AVX_OP2_WITH_TYPE_SCOPE(macro_name, name, XMMRegister, XMMRegister, SSE4_1) \
   AVX_OP2_WITH_TYPE_SCOPE(macro_name, name, XMMRegister, Operand, SSE4_1)
@@ -357,8 +376,10 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_OP2_XO_SSE4(Ptest, ptest)
   AVX_OP2_XO_SSE4(Pmovsxbw, pmovsxbw)
   AVX_OP2_XO_SSE4(Pmovsxwd, pmovsxwd)
+  AVX_OP2_XO_SSE4(Pmovsxdq, pmovsxdq)
   AVX_OP2_XO_SSE4(Pmovzxbw, pmovzxbw)
   AVX_OP2_XO_SSE4(Pmovzxwd, pmovzxwd)
+  AVX_OP2_XO_SSE4(Pmovzxdq, pmovzxdq)
 
 #undef AVX_OP2_WITH_TYPE_SCOPE
 #undef AVX_OP2_XO_SSE4
@@ -385,10 +406,19 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void Pextrb(Register dst, XMMRegister src, uint8_t imm8);
   void Pextrw(Register dst, XMMRegister src, uint8_t imm8);
   void Pextrd(Register dst, XMMRegister src, uint8_t imm8);
+  void Pinsrb(XMMRegister dst, Register src, int8_t imm8) {
+    Pinsrb(dst, Operand(src), imm8);
+  }
+  void Pinsrb(XMMRegister dst, Operand src, int8_t imm8);
   void Pinsrd(XMMRegister dst, Register src, uint8_t imm8) {
     Pinsrd(dst, Operand(src), imm8);
   }
   void Pinsrd(XMMRegister dst, Operand src, uint8_t imm8);
+  void Pinsrw(XMMRegister dst, Register src, int8_t imm8) {
+    Pinsrw(dst, Operand(src), imm8);
+  }
+  void Pinsrw(XMMRegister dst, Operand src, int8_t imm8);
+  void Vbroadcastss(XMMRegister dst, Operand src);
 
   // Expression support
   // cvtsi2sd instruction only writes to the low 64-bit of dst register, which
@@ -553,8 +583,8 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   // Load the global proxy from the current context.
   void LoadGlobalProxy(Register dst);
 
-  // Load the global function with the given index.
-  void LoadGlobalFunction(int index, Register function);
+  // Load a value from the native context with a given index.
+  void LoadNativeContextSlot(Register dst, int index);
 
   // ---------------------------------------------------------------------------
   // JavaScript invokes
@@ -562,19 +592,19 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   // Invoke the JavaScript function code by either calling or jumping.
 
   void InvokeFunctionCode(Register function, Register new_target,
-                          const ParameterCount& expected,
-                          const ParameterCount& actual, InvokeFlag flag);
+                          Register expected_parameter_count,
+                          Register actual_parameter_count, InvokeFlag flag);
 
   // On function call, call into the debugger.
   // This may clobber ecx.
   void CallDebugOnFunctionCall(Register fun, Register new_target,
-                               const ParameterCount& expected,
-                               const ParameterCount& actual);
+                               Register expected_parameter_count,
+                               Register actual_parameter_count);
 
   // Invoke the JavaScript function in the given register. Changes the
   // current context to the context in the function before invoking.
   void InvokeFunction(Register function, Register new_target,
-                      const ParameterCount& actual, InvokeFlag flag);
+                      Register actual_parameter_count, InvokeFlag flag);
 
   // Compare object type for heap object.
   // Incoming register is heap_object and outgoing register is map.
@@ -704,10 +734,9 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
 
  private:
   // Helper functions for generating invokes.
-  void InvokePrologue(const ParameterCount& expected,
-                      const ParameterCount& actual, Label* done,
-                      bool* definitely_mismatches, InvokeFlag flag,
-                      Label::Distance done_distance);
+  void InvokePrologue(Register expected_parameter_count,
+                      Register actual_parameter_count, Label* done,
+                      InvokeFlag flag);
 
   void EnterExitFramePrologue(StackFrame::Type frame_type, Register scratch);
   void EnterExitFrameEpilogue(int argc, bool save_doubles);
@@ -738,18 +767,6 @@ inline Operand FieldOperand(Register object, Register index, ScaleFactor scale,
   return Operand(object, index, scale, offset - kHeapObjectTag);
 }
 
-inline Operand ContextOperand(Register context, int index) {
-  return Operand(context, Context::SlotOffset(index));
-}
-
-inline Operand ContextOperand(Register context, Register index) {
-  return Operand(context, index, times_tagged_size, Context::SlotOffset(0));
-}
-
-inline Operand NativeContextOperand() {
-  return ContextOperand(esi, Context::NATIVE_CONTEXT_INDEX);
-}
-
 #define ACCESS_MASM(masm) masm->
 
 }  // namespace internal
diff --git a/deps/v8/src/codegen/ia32/register-ia32.h b/deps/v8/src/codegen/ia32/register-ia32.h
index aa24cf65113dee..dafb8cbcf06e66 100644
--- a/deps/v8/src/codegen/ia32/register-ia32.h
+++ b/deps/v8/src/codegen/ia32/register-ia32.h
@@ -59,7 +59,7 @@ enum RegisterCode {
 
 class Register : public RegisterBase<Register, kRegAfterLast> {
  public:
-  bool is_byte_register() const { return reg_code_ <= 3; }
+  bool is_byte_register() const { return code() <= 3; }
 
  private:
   friend class RegisterBase<Register, kRegAfterLast>;
@@ -71,7 +71,7 @@ static_assert(sizeof(Register) == sizeof(int),
               "Register can efficiently be passed by value");
 
 #define DEFINE_REGISTER(R) \
-  constexpr Register R = Register::from_code<kRegCode_##R>();
+  constexpr Register R = Register::from_code(kRegCode_##R);
 GENERAL_REGISTERS(DEFINE_REGISTER)
 #undef DEFINE_REGISTER
 constexpr Register no_reg = Register::no_reg();
@@ -99,7 +99,7 @@ using DoubleRegister = XMMRegister;
 using Simd128Register = XMMRegister;
 
 #define DEFINE_REGISTER(R) \
-  constexpr DoubleRegister R = DoubleRegister::from_code<kDoubleCode_##R>();
+  constexpr DoubleRegister R = DoubleRegister::from_code(kDoubleCode_##R);
 DOUBLE_REGISTERS(DEFINE_REGISTER)
 #undef DEFINE_REGISTER
 constexpr DoubleRegister no_dreg = DoubleRegister::no_reg();
@@ -109,10 +109,9 @@ constexpr int kNumRegs = 8;
 
 // Caller-saved registers
 constexpr RegList kJSCallerSaved =
-    Register::ListOf<eax, ecx, edx,
-                     ebx,  // used as a caller-saved register in JavaScript code
-                     edi   // callee function
-                     >();
+    Register::ListOf(eax, ecx, edx,
+                     ebx,   // used as caller-saved register in JavaScript code
+                     edi);  // callee function
 
 constexpr int kNumJSCallerSaved = 5;
 
diff --git a/deps/v8/src/codegen/ia32/sse-instr.h b/deps/v8/src/codegen/ia32/sse-instr.h
index 87c333d188299c..c63b6aa3f3d7d1 100644
--- a/deps/v8/src/codegen/ia32/sse-instr.h
+++ b/deps/v8/src/codegen/ia32/sse-instr.h
@@ -12,6 +12,7 @@
   V(paddb, 66, 0F, FC)           \
   V(paddw, 66, 0F, FD)           \
   V(paddd, 66, 0F, FE)           \
+  V(paddq, 66, 0F, D4)           \
   V(paddsb, 66, 0F, EC)          \
   V(paddsw, 66, 0F, ED)          \
   V(paddusb, 66, 0F, DC)         \
@@ -31,13 +32,19 @@
   V(por, 66, 0F, EB)             \
   V(psllw, 66, 0F, F1)           \
   V(pslld, 66, 0F, F2)           \
+  V(psllq, 66, 0F, F3)           \
+  V(pmuludq, 66, 0F, F4)         \
+  V(pavgb, 66, 0F, E0)           \
   V(psraw, 66, 0F, E1)           \
   V(psrad, 66, 0F, E2)           \
+  V(pavgw, 66, 0F, E3)           \
   V(psrlw, 66, 0F, D1)           \
   V(psrld, 66, 0F, D2)           \
+  V(psrlq, 66, 0F, D3)           \
   V(psubb, 66, 0F, F8)           \
   V(psubw, 66, 0F, F9)           \
   V(psubd, 66, 0F, FA)           \
+  V(psubq, 66, 0F, FB)           \
   V(psubsb, 66, 0F, E8)          \
   V(psubsw, 66, 0F, E9)          \
   V(psubusb, 66, 0F, D8)         \
@@ -75,8 +82,10 @@
 #define SSE4_RM_INSTRUCTION_LIST(V) \
   V(pmovsxbw, 66, 0F, 38, 20)       \
   V(pmovsxwd, 66, 0F, 38, 23)       \
+  V(pmovsxdq, 66, 0F, 38, 25)       \
   V(pmovzxbw, 66, 0F, 38, 30)       \
   V(pmovzxwd, 66, 0F, 38, 33)       \
+  V(pmovzxdq, 66, 0F, 38, 35)       \
   V(ptest, 66, 0F, 38, 17)
 
 #endif  // V8_CODEGEN_IA32_SSE_INSTR_H_
diff --git a/deps/v8/src/codegen/interface-descriptors.cc b/deps/v8/src/codegen/interface-descriptors.cc
index 1525f814cd97d6..345c82454e72e0 100644
--- a/deps/v8/src/codegen/interface-descriptors.cc
+++ b/deps/v8/src/codegen/interface-descriptors.cc
@@ -200,12 +200,24 @@ void LoadDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+void LoadNoFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  Register registers[] = {ReceiverRegister(), NameRegister(), ICKindRegister()};
+  data->InitializePlatformSpecific(arraysize(registers), registers);
+}
+
 void LoadGlobalDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {NameRegister(), SlotRegister()};
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+void LoadGlobalNoFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  Register registers[] = {NameRegister(), ICKindRegister()};
+  data->InitializePlatformSpecific(arraysize(registers), registers);
+}
+
 void LoadGlobalWithVectorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {NameRegister(), SlotRegister(), VectorRegister()};
diff --git a/deps/v8/src/codegen/interface-descriptors.h b/deps/v8/src/codegen/interface-descriptors.h
index e305d666a3e70e..0701c66be53564 100644
--- a/deps/v8/src/codegen/interface-descriptors.h
+++ b/deps/v8/src/codegen/interface-descriptors.h
@@ -68,6 +68,8 @@ namespace internal {
   V(JSTrampoline)                     \
   V(Load)                             \
   V(LoadGlobal)                       \
+  V(LoadGlobalNoFeedback)             \
+  V(LoadNoFeedback)                   \
   V(LoadGlobalWithVector)             \
   V(LoadWithVector)                   \
   V(NewArgumentsElements)             \
@@ -103,11 +105,14 @@ class V8_EXPORT_PRIVATE CallInterfaceDescriptorData {
   enum Flag {
     kNoFlags = 0u,
     kNoContext = 1u << 0,
-
     // This indicates that the code uses a special frame that does not scan the
     // stack arguments, e.g. EntryFrame. And this allows the code to use
     // untagged stack arguments.
     kNoStackScan = 1u << 1,
+    // In addition to the specified parameters, additional arguments can be
+    // passed on the stack.
+    // This does not indicate if arguments adaption is used or not.
+    kAllowVarArgs = 1u << 2,
   };
   using Flags = base::Flags<Flag>;
 
@@ -249,6 +254,10 @@ class V8_EXPORT_PRIVATE CallInterfaceDescriptor {
     return (flags() & CallInterfaceDescriptorData::kNoContext) == 0;
   }
 
+  bool AllowVarArgs() const {
+    return flags() & CallInterfaceDescriptorData::kAllowVarArgs;
+  }
+
   int GetReturnCount() const { return data()->return_count(); }
 
   MachineType GetReturnType(int index) const {
@@ -283,6 +292,10 @@ class V8_EXPORT_PRIVATE CallInterfaceDescriptor {
 
   const char* DebugName() const;
 
+  bool operator==(const CallInterfaceDescriptor& other) const {
+    return data() == other.data();
+  }
+
  protected:
   const CallInterfaceDescriptorData* data() const { return data_; }
 
@@ -400,28 +413,20 @@ STATIC_ASSERT(kMaxTFSBuiltinRegisterParams <= kMaxBuiltinRegisterParams);
                                                                             \
  public:
 
-#define DEFINE_RESULT_AND_PARAMETERS(return_count, ...)   \
-  static constexpr int kDescriptorFlags =                 \
-      CallInterfaceDescriptorData::kNoFlags;              \
-  static constexpr int kReturnCount = return_count;       \
-  enum ParameterIndices {                                 \
-    __dummy = -1, /* to be able to pass zero arguments */ \
-    ##__VA_ARGS__,                                        \
-                                                          \
-    kParameterCount,                                      \
-    kContext = kParameterCount /* implicit parameter */   \
+#define DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS(flags, return_count, ...) \
+  static constexpr int kDescriptorFlags = flags;                         \
+  static constexpr int kReturnCount = return_count;                      \
+  enum ParameterIndices {                                                \
+    __dummy = -1, /* to be able to pass zero arguments */                \
+    ##__VA_ARGS__,                                                       \
+                                                                         \
+    kParameterCount,                                                     \
+    kContext = kParameterCount /* implicit parameter */                  \
   };
 
-#define DEFINE_RESULT_AND_PARAMETERS_NO_CONTEXT(return_count, ...) \
-  static constexpr int kDescriptorFlags =                          \
-      CallInterfaceDescriptorData::kNoContext;                     \
-  static constexpr int kReturnCount = return_count;                \
-  enum ParameterIndices {                                          \
-    __dummy = -1, /* to be able to pass zero arguments */          \
-    ##__VA_ARGS__,                                                 \
-                                                                   \
-    kParameterCount                                                \
-  };
+#define DEFINE_RESULT_AND_PARAMETERS(return_count, ...) \
+  DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS(               \
+      CallInterfaceDescriptorData::kNoFlags, return_count, ##__VA_ARGS__)
 
 // This is valid only for builtins that use EntryFrame, which does not scan
 // stack arguments on GC.
@@ -437,10 +442,17 @@ STATIC_ASSERT(kMaxTFSBuiltinRegisterParams <= kMaxBuiltinRegisterParams);
     kParameterCount                                       \
   };
 
-#define DEFINE_PARAMETERS(...) DEFINE_RESULT_AND_PARAMETERS(1, ##__VA_ARGS__)
+#define DEFINE_PARAMETERS(...)            \
+  DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS( \
+      CallInterfaceDescriptorData::kNoFlags, 1, ##__VA_ARGS__)
 
 #define DEFINE_PARAMETERS_NO_CONTEXT(...) \
-  DEFINE_RESULT_AND_PARAMETERS_NO_CONTEXT(1, ##__VA_ARGS__)
+  DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS( \
+      CallInterfaceDescriptorData::kNoContext, 1, ##__VA_ARGS__)
+
+#define DEFINE_PARAMETERS_VARARGS(...)    \
+  DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS( \
+      CallInterfaceDescriptorData::kAllowVarArgs, 1, ##__VA_ARGS__)
 
 #define DEFINE_RESULT_AND_PARAMETER_TYPES(...)                                 \
   void InitializePlatformIndependent(CallInterfaceDescriptorData* data)        \
@@ -460,7 +472,7 @@ STATIC_ASSERT(kMaxTFSBuiltinRegisterParams <= kMaxBuiltinRegisterParams);
 
 #define DEFINE_JS_PARAMETERS(...)                       \
   static constexpr int kDescriptorFlags =               \
-      CallInterfaceDescriptorData::kNoFlags;            \
+      CallInterfaceDescriptorData::kAllowVarArgs;       \
   static constexpr int kReturnCount = 1;                \
   enum ParameterIndices {                               \
     kTarget,                                            \
@@ -589,6 +601,43 @@ class LoadDescriptor : public CallInterfaceDescriptor {
   static const Register SlotRegister();
 };
 
+class LoadGlobalNoFeedbackDescriptor : public CallInterfaceDescriptor {
+ public:
+  DEFINE_PARAMETERS(kName, kICKind)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),     // kName
+                         MachineType::TaggedSigned())  // kICKind
+  DECLARE_DESCRIPTOR(LoadGlobalNoFeedbackDescriptor, CallInterfaceDescriptor)
+
+  static const Register NameRegister() {
+    return LoadDescriptor::NameRegister();
+  }
+
+  static const Register ICKindRegister() {
+    return LoadDescriptor::SlotRegister();
+  }
+};
+
+class LoadNoFeedbackDescriptor : public LoadGlobalNoFeedbackDescriptor {
+ public:
+  DEFINE_PARAMETERS(kReceiver, kName, kICKind)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),     // kReceiver
+                         MachineType::AnyTagged(),     // kName
+                         MachineType::TaggedSigned())  // kICKind
+  DECLARE_DESCRIPTOR(LoadNoFeedbackDescriptor, LoadGlobalNoFeedbackDescriptor)
+
+  static const Register ReceiverRegister() {
+    return LoadDescriptor::ReceiverRegister();
+  }
+
+  static const Register NameRegister() {
+    return LoadGlobalNoFeedbackDescriptor::NameRegister();
+  }
+
+  static const Register ICKindRegister() {
+    return LoadGlobalNoFeedbackDescriptor::ICKindRegister();
+  }
+};
+
 class LoadGlobalDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kName, kSlot)
@@ -843,7 +892,7 @@ class TypeofDescriptor : public CallInterfaceDescriptor {
 
 class CallTrampolineDescriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS(kFunction, kActualArgumentsCount)
+  DEFINE_PARAMETERS_VARARGS(kFunction, kActualArgumentsCount)
   DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kFunction
                          MachineType::Int32())      // kActualArgumentsCount
   DECLARE_DESCRIPTOR(CallTrampolineDescriptor, CallInterfaceDescriptor)
@@ -871,7 +920,7 @@ class CallForwardVarargsDescriptor : public CallInterfaceDescriptor {
 
 class CallFunctionTemplateDescriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS(kFunctionTemplateInfo, kArgumentsCount)
+  DEFINE_PARAMETERS_VARARGS(kFunctionTemplateInfo, kArgumentsCount)
   DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kFunctionTemplateInfo
                          MachineType::IntPtr())     // kArgumentsCount
   DECLARE_DESCRIPTOR(CallFunctionTemplateDescriptor, CallInterfaceDescriptor)
@@ -1087,8 +1136,8 @@ class CEntry1ArgvOnStackDescriptor : public CallInterfaceDescriptor {
 
 class ApiCallbackDescriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS(kApiFunctionAddress, kActualArgumentsCount, kCallData,
-                    kHolder)
+  DEFINE_PARAMETERS_VARARGS(kApiFunctionAddress, kActualArgumentsCount,
+                            kCallData, kHolder)
   //                           receiver is implicit stack argument 1
   //                           argv are implicit stack arguments [2, 2 + kArgc[
   DEFINE_PARAMETER_TYPES(MachineType::Pointer(),    // kApiFunctionAddress
@@ -1364,9 +1413,10 @@ BUILTIN_LIST_TFS(DEFINE_TFS_BUILTIN_DESCRIPTOR)
 #undef DECLARE_DESCRIPTOR_WITH_BASE
 #undef DECLARE_DESCRIPTOR
 #undef DECLARE_JS_COMPATIBLE_DESCRIPTOR
+#undef DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS
 #undef DEFINE_RESULT_AND_PARAMETERS
-#undef DEFINE_RESULT_AND_PARAMETERS_NO_CONTEXT
 #undef DEFINE_PARAMETERS
+#undef DEFINE_PARAMETERS_VARARGS
 #undef DEFINE_PARAMETERS_NO_CONTEXT
 #undef DEFINE_RESULT_AND_PARAMETER_TYPES
 #undef DEFINE_PARAMETER_TYPES
diff --git a/deps/v8/src/codegen/machine-type.cc b/deps/v8/src/codegen/machine-type.cc
index 5d2ecb48cdb40f..86fc480ea5bb78 100644
--- a/deps/v8/src/codegen/machine-type.cc
+++ b/deps/v8/src/codegen/machine-type.cc
@@ -14,7 +14,6 @@ bool IsSubtype(MachineRepresentation rep1, MachineRepresentation rep2) {
     case MachineRepresentation::kTaggedSigned:  // Fall through.
     case MachineRepresentation::kTaggedPointer:
       return rep2 == MachineRepresentation::kTagged;
-    case MachineRepresentation::kCompressedSigned:  // Fall through.
     case MachineRepresentation::kCompressedPointer:
       return rep2 == MachineRepresentation::kCompressed;
     default:
@@ -52,8 +51,6 @@ const char* MachineReprToString(MachineRepresentation rep) {
       return "kRepTaggedPointer";
     case MachineRepresentation::kTagged:
       return "kRepTagged";
-    case MachineRepresentation::kCompressedSigned:
-      return "kRepCompressedSigned";
     case MachineRepresentation::kCompressedPointer:
       return "kRepCompressedPointer";
     case MachineRepresentation::kCompressed:
diff --git a/deps/v8/src/codegen/machine-type.h b/deps/v8/src/codegen/machine-type.h
index a0bef4e07d65a4..b89da584c10e93 100644
--- a/deps/v8/src/codegen/machine-type.h
+++ b/deps/v8/src/codegen/machine-type.h
@@ -21,12 +21,11 @@ enum class MachineRepresentation : uint8_t {
   kWord16,
   kWord32,
   kWord64,
-  kTaggedSigned,
-  kTaggedPointer,
-  kTagged,
-  kCompressedSigned,
-  kCompressedPointer,
-  kCompressed,
+  kTaggedSigned,       // (uncompressed) Smi
+  kTaggedPointer,      // (uncompressed) HeapObject
+  kTagged,             // (uncompressed) Object (Smi or HeapObject)
+  kCompressedPointer,  // (compressed) HeapObject
+  kCompressed,         // (compressed) Object (Smi or HeapObject)
   // FP representations must be last, and in order of increasing size.
   kFloat32,
   kFloat64,
@@ -54,9 +53,10 @@ enum class MachineSemantic : uint8_t {
   kAny
 };
 
-V8_EXPORT_PRIVATE inline int ElementSizeLog2Of(MachineRepresentation rep);
+V8_EXPORT_PRIVATE inline constexpr int ElementSizeLog2Of(MachineRepresentation);
 
-V8_EXPORT_PRIVATE inline int ElementSizeInBytes(MachineRepresentation rep);
+V8_EXPORT_PRIVATE inline constexpr int ElementSizeInBytes(
+    MachineRepresentation);
 
 class MachineType {
  public:
@@ -106,12 +106,8 @@ class MachineType {
   }
   constexpr bool IsCompressed() const {
     return representation() == MachineRepresentation::kCompressedPointer ||
-           representation() == MachineRepresentation::kCompressedSigned ||
            representation() == MachineRepresentation::kCompressed;
   }
-  constexpr bool IsCompressedSigned() const {
-    return representation() == MachineRepresentation::kCompressedSigned;
-  }
   constexpr bool IsCompressedPointer() const {
     return representation() == MachineRepresentation::kCompressedPointer;
   }
@@ -181,10 +177,6 @@ class MachineType {
   constexpr static MachineType AnyTagged() {
     return MachineType(MachineRepresentation::kTagged, MachineSemantic::kAny);
   }
-  constexpr static MachineType CompressedSigned() {
-    return MachineType(MachineRepresentation::kCompressedSigned,
-                       MachineSemantic::kInt32);
-  }
   constexpr static MachineType CompressedPointer() {
     return MachineType(MachineRepresentation::kCompressedPointer,
                        MachineSemantic::kAny);
@@ -240,85 +232,6 @@ class MachineType {
     return MachineType(MachineRepresentation::kBit, MachineSemantic::kNone);
   }
 
-  // These methods return compressed representations when the compressed
-  // pointer flag is enabled. Otherwise, they returned the corresponding tagged
-  // one.
-  constexpr static MachineRepresentation RepCompressedTagged() {
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      return MachineRepresentation::kCompressed;
-    } else {
-      return MachineRepresentation::kTagged;
-    }
-  }
-  constexpr static MachineRepresentation RepCompressedTaggedSigned() {
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      return MachineRepresentation::kCompressedSigned;
-    } else {
-      return MachineRepresentation::kTaggedSigned;
-    }
-  }
-  constexpr static MachineRepresentation RepCompressedTaggedPointer() {
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      return MachineRepresentation::kCompressedPointer;
-    } else {
-      return MachineRepresentation::kTaggedPointer;
-    }
-  }
-
-  constexpr static MachineType TypeRawTagged() {
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      return MachineType::Int32();
-    } else {
-      return MachineType::Pointer();
-    }
-  }
-
-  constexpr static MachineType TypeCompressedTagged() {
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      return MachineType::AnyCompressed();
-    } else {
-      return MachineType::AnyTagged();
-    }
-  }
-  constexpr static MachineType TypeCompressedTaggedSigned() {
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      return MachineType::CompressedSigned();
-    } else {
-      return MachineType::TaggedSigned();
-    }
-  }
-  constexpr static MachineType TypeCompressedTaggedPointer() {
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      return MachineType::CompressedPointer();
-    } else {
-      return MachineType::TaggedPointer();
-    }
-  }
-
-  constexpr bool IsCompressedTagged() const {
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      return IsCompressed();
-    } else {
-      return IsTagged();
-    }
-  }
-
-  constexpr bool IsCompressedTaggedSigned() const {
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      return IsCompressedSigned();
-    } else {
-      return IsTaggedSigned();
-    }
-  }
-
-  constexpr bool IsCompressedTaggedPointer() const {
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      return IsCompressedPointer();
-    } else {
-      return IsTaggedPointer();
-    }
-  }
-
   static MachineType TypeForRepresentation(const MachineRepresentation& rep,
                                            bool isSigned = true) {
     switch (rep) {
@@ -350,8 +263,6 @@ class MachineType {
         return MachineType::AnyCompressed();
       case MachineRepresentation::kCompressedPointer:
         return MachineType::CompressedPointer();
-      case MachineRepresentation::kCompressedSigned:
-        return MachineType::CompressedSigned();
       default:
         UNREACHABLE();
     }
@@ -407,26 +318,13 @@ inline bool CanBeTaggedOrCompressedPointer(MachineRepresentation rep) {
   return CanBeTaggedPointer(rep) || CanBeCompressedPointer(rep);
 }
 
-inline bool CanBeCompressedSigned(MachineRepresentation rep) {
-  return rep == MachineRepresentation::kCompressed ||
-         rep == MachineRepresentation::kCompressedSigned;
-}
-
 inline bool IsAnyCompressed(MachineRepresentation rep) {
-  return CanBeCompressedPointer(rep) ||
-         rep == MachineRepresentation::kCompressedSigned;
-}
-
-inline bool IsAnyCompressedTagged(MachineRepresentation rep) {
-  if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-    return IsAnyCompressed(rep);
-  } else {
-    return IsAnyTagged(rep);
-  }
+  return CanBeCompressedPointer(rep);
 }
 
 // Gets the log2 of the element size in bytes of the machine type.
-V8_EXPORT_PRIVATE inline int ElementSizeLog2Of(MachineRepresentation rep) {
+V8_EXPORT_PRIVATE inline constexpr int ElementSizeLog2Of(
+    MachineRepresentation rep) {
   switch (rep) {
     case MachineRepresentation::kBit:
     case MachineRepresentation::kWord8:
@@ -444,17 +342,21 @@ V8_EXPORT_PRIVATE inline int ElementSizeLog2Of(MachineRepresentation rep) {
     case MachineRepresentation::kTaggedSigned:
     case MachineRepresentation::kTaggedPointer:
     case MachineRepresentation::kTagged:
-    case MachineRepresentation::kCompressedSigned:
     case MachineRepresentation::kCompressedPointer:
     case MachineRepresentation::kCompressed:
       return kTaggedSizeLog2;
     default:
-      break;
+#if V8_HAS_CXX14_CONSTEXPR
+      UNREACHABLE();
+#else
+      // Return something for older compilers.
+      return -1;
+#endif
   }
-  UNREACHABLE();
 }
 
-V8_EXPORT_PRIVATE inline int ElementSizeInBytes(MachineRepresentation rep) {
+V8_EXPORT_PRIVATE inline constexpr int ElementSizeInBytes(
+    MachineRepresentation rep) {
   return 1 << ElementSizeLog2Of(rep);
 }
 
diff --git a/deps/v8/src/codegen/macro-assembler.h b/deps/v8/src/codegen/macro-assembler.h
index 0e588c08059933..28b3b3a3c45583 100644
--- a/deps/v8/src/codegen/macro-assembler.h
+++ b/deps/v8/src/codegen/macro-assembler.h
@@ -80,16 +80,6 @@ class FrameScope {
     tasm_->set_has_frame(old_has_frame_);
   }
 
-  // Normally we generate the leave-frame code when this object goes
-  // out of scope.  Sometimes we may need to generate the code somewhere else
-  // in addition.  Calling this will achieve that, but the object stays in
-  // scope, the MacroAssembler is still marked as being in a frame scope, and
-  // the code will be generated again when it goes out of scope.
-  void GenerateLeaveFrame() {
-    DCHECK(type_ != StackFrame::MANUAL && type_ != StackFrame::NONE);
-    tasm_->LeaveFrame(type_);
-  }
-
  private:
   TurboAssembler* tasm_;
   StackFrame::Type type_;
@@ -121,16 +111,6 @@ class FrameAndConstantPoolScope {
     }
   }
 
-  // Normally we generate the leave-frame code when this object goes
-  // out of scope.  Sometimes we may need to generate the code somewhere else
-  // in addition.  Calling this will achieve that, but the object stays in
-  // scope, the MacroAssembler is still marked as being in a frame scope, and
-  // the code will be generated again when it goes out of scope.
-  void GenerateLeaveFrame() {
-    DCHECK(type_ != StackFrame::MANUAL && type_ != StackFrame::NONE);
-    masm_->LeaveFrame(type_);
-  }
-
  private:
   MacroAssembler* masm_;
   StackFrame::Type type_;
@@ -186,34 +166,6 @@ class NoRootArrayScope {
   bool old_value_;
 };
 
-// Wrapper class for passing expected and actual parameter counts as
-// either registers or immediate values. Used to make sure that the
-// caller provides exactly the expected number of parameters to the
-// callee.
-class ParameterCount {
- public:
-  explicit ParameterCount(Register reg) : reg_(reg), immediate_(0) {}
-  explicit ParameterCount(uint16_t imm) : reg_(no_reg), immediate_(imm) {}
-
-  bool is_reg() const { return reg_.is_valid(); }
-  bool is_immediate() const { return !is_reg(); }
-
-  Register reg() const {
-    DCHECK(is_reg());
-    return reg_;
-  }
-  uint16_t immediate() const {
-    DCHECK(is_immediate());
-    return immediate_;
-  }
-
- private:
-  const Register reg_;
-  const uint16_t immediate_;
-
-  DISALLOW_IMPLICIT_CONSTRUCTORS(ParameterCount);
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/mips/assembler-mips.h b/deps/v8/src/codegen/mips/assembler-mips.h
index d8cb8ec3f2a9e8..a414168a9f333c 100644
--- a/deps/v8/src/codegen/mips/assembler-mips.h
+++ b/deps/v8/src/codegen/mips/assembler-mips.h
@@ -1610,6 +1610,7 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   // not have to check for overflow. The same is true for writes of large
   // relocation info entries.
   static constexpr int kGap = 32;
+  STATIC_ASSERT(AssemblerBase::kMinimalBufferSize >= 2 * kGap);
 
   // Repeated checking whether the trampoline pool should be emitted is rather
   // expensive. By default we only check again once a number of instructions
diff --git a/deps/v8/src/codegen/mips/macro-assembler-mips.cc b/deps/v8/src/codegen/mips/macro-assembler-mips.cc
index 760d33d7c9179b..6526f48da533e3 100644
--- a/deps/v8/src/codegen/mips/macro-assembler-mips.cc
+++ b/deps/v8/src/codegen/mips/macro-assembler-mips.cc
@@ -1346,21 +1346,23 @@ void TurboAssembler::Sc(Register rd, const MemOperand& rs) {
 }
 
 void TurboAssembler::li(Register dst, Handle<HeapObject> value, LiFlags mode) {
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadConstant(dst, value);
-      return;
-    }
+  // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+  // non-isolate-independent code. In many cases it might be cheaper than
+  // embedding the relocatable value.
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadConstant(dst, value);
+    return;
   }
   li(dst, Operand(value), mode);
 }
 
 void TurboAssembler::li(Register dst, ExternalReference value, LiFlags mode) {
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadExternalReference(dst, value);
-      return;
-    }
+  // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+  // non-isolate-independent code. In many cases it might be cheaper than
+  // embedding the relocatable value.
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadExternalReference(dst, value);
+    return;
   }
   li(dst, Operand(value), mode);
 }
@@ -1558,12 +1560,15 @@ void TurboAssembler::ShlPair(Register dst_low, Register dst_high,
 void TurboAssembler::ShlPair(Register dst_low, Register dst_high,
                              Register src_low, Register src_high,
                              uint32_t shift, Register scratch) {
+  DCHECK_NE(dst_low, src_low);
+  DCHECK_NE(dst_high, src_low);
   shift = shift & 0x3F;
   if (shift == 0) {
-    mov(dst_low, src_low);
     mov(dst_high, src_high);
+    mov(dst_low, src_low);
   } else if (shift < 32) {
     if (IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) {
+      DCHECK_NE(dst_high, src_high);
       srl(dst_high, src_low, 32 - shift);
       Ins(dst_high, src_high, shift, 32 - shift);
       sll(dst_low, src_low, shift);
@@ -1612,6 +1617,8 @@ void TurboAssembler::ShrPair(Register dst_low, Register dst_high,
 void TurboAssembler::ShrPair(Register dst_low, Register dst_high,
                              Register src_low, Register src_high,
                              uint32_t shift, Register scratch) {
+  DCHECK_NE(dst_low, src_high);
+  DCHECK_NE(dst_high, src_high);
   shift = shift & 0x3F;
   if (shift == 0) {
     mov(dst_low, src_low);
@@ -1622,8 +1629,8 @@ void TurboAssembler::ShrPair(Register dst_low, Register dst_high,
       Ins(dst_low, src_high, 32 - shift, shift);
       srl(dst_high, src_high, shift);
     } else {
-      srl(dst_high, src_high, shift);
       srl(dst_low, src_low, shift);
+      srl(dst_high, src_high, shift);
       shift = 32 - shift;
       sll(scratch, src_high, shift);
       Or(dst_low, dst_low, scratch);
@@ -1662,6 +1669,8 @@ void TurboAssembler::SarPair(Register dst_low, Register dst_high,
 void TurboAssembler::SarPair(Register dst_low, Register dst_high,
                              Register src_low, Register src_high,
                              uint32_t shift, Register scratch) {
+  DCHECK_NE(dst_low, src_high);
+  DCHECK_NE(dst_high, src_high);
   shift = shift & 0x3F;
   if (shift == 0) {
     mov(dst_low, src_low);
@@ -1672,8 +1681,8 @@ void TurboAssembler::SarPair(Register dst_low, Register dst_high,
       Ins(dst_low, src_high, 32 - shift, shift);
       sra(dst_high, src_high, shift);
     } else {
-      sra(dst_high, src_high, shift);
       srl(dst_low, src_low, shift);
+      sra(dst_high, src_high, shift);
       shift = 32 - shift;
       sll(scratch, src_high, shift);
       Or(dst_low, dst_low, scratch);
@@ -3814,41 +3823,41 @@ void TurboAssembler::Jump(Handle<Code> code, RelocInfo::Mode rmode,
                           BranchDelaySlot bd) {
   DCHECK(RelocInfo::IsCodeTarget(rmode));
   BlockTrampolinePoolScope block_trampoline_pool(this);
-  if (FLAG_embedded_builtins) {
-    int builtin_index = Builtins::kNoBuiltinId;
-    bool target_is_isolate_independent_builtin =
-        isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
-        Builtins::IsIsolateIndependent(builtin_index);
-    if (target_is_isolate_independent_builtin &&
-        options().use_pc_relative_calls_and_jumps) {
-      int32_t code_target_index = AddCodeTarget(code);
-      Label skip;
-      BlockTrampolinePoolScope block_trampoline_pool(this);
-      if (cond != cc_always) {
-        // By using delay slot, we always execute first instruction of
-        // GenPcRelativeJump (which is or_(t8, ra, zero_reg)).
-        Branch(USE_DELAY_SLOT, &skip, NegateCondition(cond), rs, rt);
-      }
-      GenPCRelativeJump(t8, t9, code_target_index,
-                        RelocInfo::RELATIVE_CODE_TARGET, bd);
-      bind(&skip);
-      return;
-    } else if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadConstant(t9, code);
-      Jump(t9, Code::kHeaderSize - kHeapObjectTag, cond, rs, rt, bd);
-      return;
-    } else if (target_is_isolate_independent_builtin &&
-               options().inline_offheap_trampolines) {
-      // Inline the trampoline.
-      RecordCommentForOffHeapTrampoline(builtin_index);
-      CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
-      EmbeddedData d = EmbeddedData::FromBlob();
-      Address entry = d.InstructionStartOfBuiltin(builtin_index);
-      li(t9, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
-      Jump(t9, 0, cond, rs, rt, bd);
-      return;
+
+  int builtin_index = Builtins::kNoBuiltinId;
+  bool target_is_isolate_independent_builtin =
+      isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+      Builtins::IsIsolateIndependent(builtin_index);
+  if (target_is_isolate_independent_builtin &&
+      options().use_pc_relative_calls_and_jumps) {
+    int32_t code_target_index = AddCodeTarget(code);
+    Label skip;
+    BlockTrampolinePoolScope block_trampoline_pool(this);
+    if (cond != cc_always) {
+      // By using delay slot, we always execute first instruction of
+      // GenPcRelativeJump (which is or_(t8, ra, zero_reg)).
+      Branch(USE_DELAY_SLOT, &skip, NegateCondition(cond), rs, rt);
     }
+    GenPCRelativeJump(t8, t9, code_target_index,
+                      RelocInfo::RELATIVE_CODE_TARGET, bd);
+    bind(&skip);
+    return;
+  } else if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadConstant(t9, code);
+    Jump(t9, Code::kHeaderSize - kHeapObjectTag, cond, rs, rt, bd);
+    return;
+  } else if (target_is_isolate_independent_builtin &&
+             options().inline_offheap_trampolines) {
+    // Inline the trampoline.
+    RecordCommentForOffHeapTrampoline(builtin_index);
+    CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
+    EmbeddedData d = EmbeddedData::FromBlob();
+    Address entry = d.InstructionStartOfBuiltin(builtin_index);
+    li(t9, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+    Jump(t9, 0, cond, rs, rt, bd);
+    return;
   }
+
   Jump(static_cast<intptr_t>(code.address()), rmode, cond, rs, rt, bd);
 }
 
@@ -3954,40 +3963,41 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond, Register rs, const Operand& rt,
                           BranchDelaySlot bd) {
   BlockTrampolinePoolScope block_trampoline_pool(this);
-  if (FLAG_embedded_builtins) {
-    int builtin_index = Builtins::kNoBuiltinId;
-    bool target_is_isolate_independent_builtin =
-        isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
-        Builtins::IsIsolateIndependent(builtin_index);
-    if (target_is_isolate_independent_builtin &&
-        options().use_pc_relative_calls_and_jumps) {
-      int32_t code_target_index = AddCodeTarget(code);
-      Label skip;
-      BlockTrampolinePoolScope block_trampoline_pool(this);
-      if (cond != cc_always) {
-        Branch(PROTECT, &skip, NegateCondition(cond), rs, rt);
-      }
-      GenPCRelativeJumpAndLink(t8, code_target_index,
-                               RelocInfo::RELATIVE_CODE_TARGET, bd);
-      bind(&skip);
-      return;
-    } else if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadConstant(t9, code);
-      Call(t9, Code::kHeaderSize - kHeapObjectTag, cond, rs, rt, bd);
-      return;
-    } else if (target_is_isolate_independent_builtin &&
-               options().inline_offheap_trampolines) {
-      // Inline the trampoline.
-      RecordCommentForOffHeapTrampoline(builtin_index);
-      CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
-      EmbeddedData d = EmbeddedData::FromBlob();
-      Address entry = d.InstructionStartOfBuiltin(builtin_index);
-      li(t9, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
-      Call(t9, 0, cond, rs, rt, bd);
-      return;
+
+  int builtin_index = Builtins::kNoBuiltinId;
+  bool target_is_isolate_independent_builtin =
+      isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+      Builtins::IsIsolateIndependent(builtin_index);
+  if (target_is_isolate_independent_builtin &&
+      options().use_pc_relative_calls_and_jumps) {
+    int32_t code_target_index = AddCodeTarget(code);
+    Label skip;
+    BlockTrampolinePoolScope block_trampoline_pool(this);
+    if (cond != cc_always) {
+      Branch(PROTECT, &skip, NegateCondition(cond), rs, rt);
     }
+    GenPCRelativeJumpAndLink(t8, code_target_index,
+                             RelocInfo::RELATIVE_CODE_TARGET, bd);
+    bind(&skip);
+    return;
+  } else if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadConstant(t9, code);
+    Call(t9, Code::kHeaderSize - kHeapObjectTag, cond, rs, rt, bd);
+    return;
+  } else if (target_is_isolate_independent_builtin &&
+             options().inline_offheap_trampolines) {
+    // Inline the trampoline.
+    RecordCommentForOffHeapTrampoline(builtin_index);
+    CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
+    EmbeddedData d = EmbeddedData::FromBlob();
+    Address entry = d.InstructionStartOfBuiltin(builtin_index);
+    li(t9, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+    Call(t9, 0, cond, rs, rt, bd);
+    return;
   }
+
   DCHECK(RelocInfo::IsCodeTarget(rmode));
+  DCHECK(code->IsExecutable());
   Call(code.address(), rmode, cond, rs, rt, bd);
 }
 
@@ -4009,6 +4019,25 @@ void TurboAssembler::CallBuiltinByIndex(Register builtin_index) {
   Call(builtin_index);
 }
 
+void TurboAssembler::PatchAndJump(Address target) {
+  if (kArchVariant != kMips32r6) {
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.Acquire();
+    mov(scratch, ra);
+    bal(1);                                  // jump to lw
+    nop();                                   // in the delay slot
+    lw(t9, MemOperand(ra, kInstrSize * 3));  // ra == pc_
+    jr(t9);
+    mov(ra, scratch);  // in delay slot
+    DCHECK_EQ(reinterpret_cast<uint32_t>(pc_) % 8, 0);
+    *reinterpret_cast<uint32_t*>(pc_) = target;
+    pc_ += sizeof(uint32_t);
+  } else {
+    // TODO(mips r6): Implement.
+    UNIMPLEMENTED();
+  }
+}
+
 void TurboAssembler::StoreReturnAddressAndCall(Register target) {
   // This generates the final instruction sequence for calls to C functions
   // once an exit frame has been constructed.
@@ -4268,35 +4297,21 @@ void TurboAssembler::MovToFloatParameters(DoubleRegister src1,
 // -----------------------------------------------------------------------------
 // JavaScript invokes.
 
-void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
-                                        Register caller_args_count_reg,
+void TurboAssembler::PrepareForTailCall(Register callee_args_count,
+                                        Register caller_args_count,
                                         Register scratch0, Register scratch1) {
-#if DEBUG
-  if (callee_args_count.is_reg()) {
-    DCHECK(!AreAliased(callee_args_count.reg(), caller_args_count_reg, scratch0,
-                       scratch1));
-  } else {
-    DCHECK(!AreAliased(caller_args_count_reg, scratch0, scratch1));
-  }
-#endif
-
   // Calculate the end of destination area where we will put the arguments
   // after we drop current frame. We add kPointerSize to count the receiver
   // argument which is not included into formal parameters count.
   Register dst_reg = scratch0;
-  Lsa(dst_reg, fp, caller_args_count_reg, kPointerSizeLog2);
+  Lsa(dst_reg, fp, caller_args_count, kPointerSizeLog2);
   Addu(dst_reg, dst_reg,
        Operand(StandardFrameConstants::kCallerSPOffset + kPointerSize));
 
-  Register src_reg = caller_args_count_reg;
+  Register src_reg = caller_args_count;
   // Calculate the end of source area. +kPointerSize is for the receiver.
-  if (callee_args_count.is_reg()) {
-    Lsa(src_reg, sp, callee_args_count.reg(), kPointerSizeLog2);
-    Addu(src_reg, src_reg, Operand(kPointerSize));
-  } else {
-    Addu(src_reg, sp,
-         Operand((callee_args_count.immediate() + 1) * kPointerSize));
-  }
+  Lsa(src_reg, sp, callee_args_count, kPointerSizeLog2);
+  Addu(src_reg, src_reg, Operand(kPointerSize));
 
   if (FLAG_debug_code) {
     Check(lo, AbortReason::kStackAccessBelowStackPointer, src_reg,
@@ -4328,68 +4343,39 @@ void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
   mov(sp, dst_reg);
 }
 
-void MacroAssembler::InvokePrologue(const ParameterCount& expected,
-                                    const ParameterCount& actual, Label* done,
-                                    bool* definitely_mismatches,
-                                    InvokeFlag flag) {
-  bool definitely_matches = false;
-  *definitely_mismatches = false;
+void MacroAssembler::InvokePrologue(Register expected_parameter_count,
+                                    Register actual_parameter_count,
+                                    Label* done, InvokeFlag flag) {
   Label regular_invoke;
 
-  // Check whether the expected and actual arguments count match. If not,
-  // setup registers according to contract with ArgumentsAdaptorTrampoline:
+  // Check whether the expected and actual arguments count match. The registers
+  // are set up according to contract with ArgumentsAdaptorTrampoline:
   //  a0: actual arguments count
   //  a1: function (passed through to callee)
   //  a2: expected arguments count
 
   // The code below is made a lot easier because the calling code already sets
-  // up actual and expected registers according to the contract if values are
-  // passed in registers.
-  DCHECK(actual.is_immediate() || actual.reg() == a0);
-  DCHECK(expected.is_immediate() || expected.reg() == a2);
-
-  if (expected.is_immediate()) {
-    DCHECK(actual.is_immediate());
-    li(a0, Operand(actual.immediate()));
-    if (expected.immediate() == actual.immediate()) {
-      definitely_matches = true;
-    } else {
-      const int sentinel = SharedFunctionInfo::kDontAdaptArgumentsSentinel;
-      if (expected.immediate() == sentinel) {
-        // Don't worry about adapting arguments for builtins that
-        // don't want that done. Skip adaption code by making it look
-        // like we have a match between expected and actual number of
-        // arguments.
-        definitely_matches = true;
-      } else {
-        *definitely_mismatches = true;
-        li(a2, Operand(expected.immediate()));
-      }
-    }
-  } else if (actual.is_immediate()) {
-    li(a0, Operand(actual.immediate()));
-    Branch(&regular_invoke, eq, expected.reg(), Operand(a0));
+  // up actual and expected registers according to the contract.
+  DCHECK_EQ(actual_parameter_count, a0);
+  DCHECK_EQ(expected_parameter_count, a2);
+
+  Branch(&regular_invoke, eq, expected_parameter_count,
+         Operand(actual_parameter_count));
+
+  Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
+  if (flag == CALL_FUNCTION) {
+    Call(adaptor);
+    Branch(done);
   } else {
-    Branch(&regular_invoke, eq, expected.reg(), Operand(actual.reg()));
+    Jump(adaptor, RelocInfo::CODE_TARGET);
   }
 
-  if (!definitely_matches) {
-    Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
-    if (flag == CALL_FUNCTION) {
-      Call(adaptor);
-      if (!*definitely_mismatches) {
-        Branch(done);
-      }
-    } else {
-      Jump(adaptor, RelocInfo::CODE_TARGET);
-    }
-    bind(&regular_invoke);
-  }
+  bind(&regular_invoke);
 }
 
 void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual) {
+                                    Register expected_parameter_count,
+                                    Register actual_parameter_count) {
   Label skip_hook;
   li(t0, ExternalReference::debug_hook_on_function_call_address(isolate()));
   lb(t0, MemOperand(t0));
@@ -4397,23 +4383,16 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
 
   {
     // Load receiver to pass it later to DebugOnFunctionCall hook.
-    if (actual.is_reg()) {
-      mov(t0, actual.reg());
-    } else {
-      li(t0, actual.immediate());
-    }
-    Lsa(at, sp, t0, kPointerSizeLog2);
+    Lsa(at, sp, actual_parameter_count, kPointerSizeLog2);
     lw(t0, MemOperand(at));
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
-    if (expected.is_reg()) {
-      SmiTag(expected.reg());
-      Push(expected.reg());
-    }
-    if (actual.is_reg()) {
-      SmiTag(actual.reg());
-      Push(actual.reg());
-    }
+    SmiTag(expected_parameter_count);
+    Push(expected_parameter_count);
+
+    SmiTag(actual_parameter_count);
+    Push(actual_parameter_count);
+
     if (new_target.is_valid()) {
       Push(new_target);
     }
@@ -4425,29 +4404,28 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
     if (new_target.is_valid()) {
       Pop(new_target);
     }
-    if (actual.is_reg()) {
-      Pop(actual.reg());
-      SmiUntag(actual.reg());
-    }
-    if (expected.is_reg()) {
-      Pop(expected.reg());
-      SmiUntag(expected.reg());
-    }
+
+    Pop(actual_parameter_count);
+    SmiUntag(actual_parameter_count);
+
+    Pop(expected_parameter_count);
+    SmiUntag(expected_parameter_count);
   }
   bind(&skip_hook);
 }
 
 void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
-                                        const ParameterCount& expected,
-                                        const ParameterCount& actual,
+                                        Register expected_parameter_count,
+                                        Register actual_parameter_count,
                                         InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
-  DCHECK(function == a1);
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
+  DCHECK_EQ(function, a1);
   DCHECK_IMPLIES(new_target.is_valid(), new_target == a3);
 
   // On function call, call into the debugger if necessary.
-  CheckDebugHook(function, new_target, expected, actual);
+  CheckDebugHook(function, new_target, expected_parameter_count,
+                 actual_parameter_count);
 
   // Clear the new.target register if not given.
   if (!new_target.is_valid()) {
@@ -4455,36 +4433,34 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
   }
 
   Label done;
-  bool definitely_mismatches = false;
-  InvokePrologue(expected, actual, &done, &definitely_mismatches, flag);
-  if (!definitely_mismatches) {
-    // We call indirectly through the code field in the function to
-    // allow recompilation to take effect without changing any of the
-    // call sites.
-    Register code = kJavaScriptCallCodeStartRegister;
-    lw(code, FieldMemOperand(function, JSFunction::kCodeOffset));
-    if (flag == CALL_FUNCTION) {
-      Addu(code, code, Code::kHeaderSize - kHeapObjectTag);
-      Call(code);
-    } else {
-      DCHECK(flag == JUMP_FUNCTION);
-      Addu(code, code, Code::kHeaderSize - kHeapObjectTag);
-      Jump(code);
-    }
-    // Continue here if InvokePrologue does handle the invocation due to
-    // mismatched parameter counts.
-    bind(&done);
-  }
+  InvokePrologue(expected_parameter_count, actual_parameter_count, &done, flag);
+  // We call indirectly through the code field in the function to
+  // allow recompilation to take effect without changing any of the
+  // call sites.
+  Register code = kJavaScriptCallCodeStartRegister;
+  lw(code, FieldMemOperand(function, JSFunction::kCodeOffset));
+  if (flag == CALL_FUNCTION) {
+    Addu(code, code, Code::kHeaderSize - kHeapObjectTag);
+    Call(code);
+  } else {
+    DCHECK(flag == JUMP_FUNCTION);
+    Addu(code, code, Code::kHeaderSize - kHeapObjectTag);
+    Jump(code);
+  }
+
+  // Continue here if InvokePrologue does handle the invocation due to
+  // mismatched parameter counts.
+  bind(&done);
 }
 
-void MacroAssembler::InvokeFunction(Register function, Register new_target,
-                                    const ParameterCount& actual,
-                                    InvokeFlag flag) {
+void MacroAssembler::InvokeFunctionWithNewTarget(
+    Register function, Register new_target, Register actual_parameter_count,
+    InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
 
   // Contract with called JS functions requires that function is passed in a1.
-  DCHECK(function == a1);
+  DCHECK_EQ(function, a1);
   Register expected_reg = a2;
   Register temp_reg = t0;
 
@@ -4494,24 +4470,25 @@ void MacroAssembler::InvokeFunction(Register function, Register new_target,
       FieldMemOperand(temp_reg,
                       SharedFunctionInfo::kFormalParameterCountOffset));
 
-  ParameterCount expected(expected_reg);
-  InvokeFunctionCode(function, new_target, expected, actual, flag);
+  InvokeFunctionCode(function, new_target, expected_reg, actual_parameter_count,
+                     flag);
 }
 
 void MacroAssembler::InvokeFunction(Register function,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
+                                    Register expected_parameter_count,
+                                    Register actual_parameter_count,
                                     InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
 
   // Contract with called JS functions requires that function is passed in a1.
-  DCHECK(function == a1);
+  DCHECK_EQ(function, a1);
 
   // Get the function and setup the context.
   lw(cp, FieldMemOperand(a1, JSFunction::kContextOffset));
 
-  InvokeFunctionCode(a1, no_reg, expected, actual, flag);
+  InvokeFunctionCode(a1, no_reg, expected_parameter_count,
+                     actual_parameter_count, flag);
 }
 
 // ---------------------------------------------------------------------------
@@ -4519,7 +4496,7 @@ void MacroAssembler::InvokeFunction(Register function,
 
 void MacroAssembler::GetObjectType(Register object, Register map,
                                    Register type_reg) {
-  lw(map, FieldMemOperand(object, HeapObject::kMapOffset));
+  LoadMap(map, object);
   lhu(type_reg, FieldMemOperand(map, Map::kInstanceTypeOffset));
 }
 
@@ -4615,19 +4592,6 @@ void TurboAssembler::MulOverflow(Register dst, Register left,
   }
 }
 
-void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
-                                           Register centry) {
-  const Runtime::Function* f = Runtime::FunctionForId(fid);
-  // TODO(1236192): Most runtime routines don't need the number of
-  // arguments passed in because it is constant. At some point we
-  // should remove this need and make the runtime routine entry code
-  // smarter.
-  PrepareCEntryArgs(f->nargs);
-  PrepareCEntryFunction(ExternalReference::Create(f));
-  DCHECK(!AreAliased(centry, a0, a1));
-  Call(centry, Code::kHeaderSize - kHeapObjectTag);
-}
-
 void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
                                  SaveFPRegsMode save_doubles) {
   // All parameters are on the stack. v0 has the return value after call.
@@ -4703,6 +4667,8 @@ void MacroAssembler::DecrementCounter(StatsCounter* counter, int value,
 // -----------------------------------------------------------------------------
 // Debugging.
 
+void TurboAssembler::Trap() { stop(); }
+
 void TurboAssembler::Assert(Condition cc, AbortReason reason, Register rs,
                             Operand rt) {
   if (emit_debug_code()) Check(cc, reason, rs, rt);
@@ -4768,9 +4734,15 @@ void TurboAssembler::Abort(AbortReason reason) {
   }
 }
 
+void MacroAssembler::LoadMap(Register destination, Register object) {
+  Lw(destination, FieldMemOperand(object, HeapObject::kMapOffset));
+}
+
 void MacroAssembler::LoadNativeContextSlot(int index, Register dst) {
-  lw(dst, NativeContextMemOperand());
-  lw(dst, ContextMemOperand(dst, index));
+  LoadMap(dst, cp);
+  Lw(dst,
+     FieldMemOperand(dst, Map::kConstructorOrBackPointerOrNativeContextOffset));
+  Lw(dst, MemOperand(dst, Context::SlotOffset(index)));
 }
 
 void TurboAssembler::StubPrologue(StackFrame::Type type) {
@@ -5012,9 +4984,9 @@ void MacroAssembler::AssertConstructor(Register object) {
     Check(ne, AbortReason::kOperandIsASmiAndNotAConstructor, t8,
           Operand(zero_reg));
 
-    lw(t8, FieldMemOperand(object, HeapObject::kMapOffset));
+    LoadMap(t8, object);
     lbu(t8, FieldMemOperand(t8, Map::kBitFieldOffset));
-    And(t8, t8, Operand(Map::IsConstructorBit::kMask));
+    And(t8, t8, Operand(Map::Bits1::IsConstructorBit::kMask));
     Check(ne, AbortReason::kOperandIsNotAConstructor, t8, Operand(zero_reg));
   }
 }
diff --git a/deps/v8/src/codegen/mips/macro-assembler-mips.h b/deps/v8/src/codegen/mips/macro-assembler-mips.h
index e82c88f0b5e4c6..f916b9d101c31f 100644
--- a/deps/v8/src/codegen/mips/macro-assembler-mips.h
+++ b/deps/v8/src/codegen/mips/macro-assembler-mips.h
@@ -57,15 +57,6 @@ Register GetRegisterThatIsNotOneOf(Register reg1, Register reg2 = no_reg,
 
 // -----------------------------------------------------------------------------
 // Static helper functions.
-
-inline MemOperand ContextMemOperand(Register context, int index) {
-  return MemOperand(context, Context::SlotOffset(index));
-}
-
-inline MemOperand NativeContextMemOperand() {
-  return ContextMemOperand(cp, Context::NATIVE_CONTEXT_INDEX);
-}
-
 // Generate a MemOperand for loading a field from an object.
 inline MemOperand FieldMemOperand(Register object, int offset) {
   return MemOperand(object, offset - kHeapObjectTag);
@@ -111,6 +102,8 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   // -------------------------------------------------------------------------
   // Debugging.
 
+  void Trap() override;
+
   // Calls Abort(msg) if the condition cc is not satisfied.
   // Use --debug_code to enable.
   void Assert(Condition cc, AbortReason reason, Register rs, Operand rt);
@@ -205,6 +198,10 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void Jump(Register target, const Operand& offset, COND_ARGS);
   void Jump(intptr_t target, RelocInfo::Mode rmode, COND_ARGS);
   void Jump(Address target, RelocInfo::Mode rmode, COND_ARGS);
+  // Deffer from li, this method save target to the memory, and then load
+  // it to register use lw, it can be used in wasm jump table for concurrent
+  // patching.
+  void PatchAndJump(Address target);
   void Jump(Handle<Code> code, RelocInfo::Mode rmode, COND_ARGS);
   void Jump(const ExternalReference& reference) override;
   void Call(Register target, int16_t offset = 0, COND_ARGS);
@@ -452,11 +449,11 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 
   // Removes current frame and its arguments from the stack preserving
   // the arguments and a return address pushed to the stack for the next call.
-  // Both |callee_args_count| and |caller_args_count_reg| do not include
-  // receiver. |callee_args_count| is not modified, |caller_args_count_reg|
+  // Both |callee_args_count| and |caller_args_count| do not include
+  // receiver. |callee_args_count| is not modified. |caller_args_count|
   // is trashed.
-  void PrepareForTailCall(const ParameterCount& callee_args_count,
-                          Register caller_args_count_reg, Register scratch0,
+  void PrepareForTailCall(Register callee_args_count,
+                          Register caller_args_count, Register scratch0,
                           Register scratch1);
 
   int CalculateStackPassedWords(int num_reg_arguments,
@@ -511,10 +508,6 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
                      Label* condition_met);
 #undef COND_ARGS
 
-  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
-  // builtin for the target runtime function and uses an indirect call.
-  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
-
   // Performs a truncating conversion of a floating point number as used by
   // the JS bitwise operations. See ECMA-262 9.5: ToInt32.
   // Exits with 'result' holding the answer.
@@ -980,6 +973,8 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
                       bool do_return = NO_EMIT_RETURN,
                       bool argument_count_is_length = false);
 
+  void LoadMap(Register destination, Register object);
+
   // Make sure the stack is aligned. Only emits code in debug mode.
   void AssertStackIsAligned();
 
@@ -995,21 +990,22 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
 
   // Invoke the JavaScript function code by either calling or jumping.
   void InvokeFunctionCode(Register function, Register new_target,
-                          const ParameterCount& expected,
-                          const ParameterCount& actual, InvokeFlag flag);
+                          Register expected_parameter_count,
+                          Register actual_parameter_count, InvokeFlag flag);
 
   // On function call, call into the debugger if necessary.
   void CheckDebugHook(Register fun, Register new_target,
-                      const ParameterCount& expected,
-                      const ParameterCount& actual);
+                      Register expected_parameter_count,
+                      Register actual_parameter_count);
 
   // Invoke the JavaScript function in the given register. Changes the
   // current context to the context in the function before invoking.
-  void InvokeFunction(Register function, Register new_target,
-                      const ParameterCount& actual, InvokeFlag flag);
+  void InvokeFunctionWithNewTarget(Register function, Register new_target,
+                                   Register actual_parameter_count,
+                                   InvokeFlag flag);
 
-  void InvokeFunction(Register function, const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
+  void InvokeFunction(Register function, Register expected_parameter_count,
+                      Register actual_parameter_count, InvokeFlag flag);
 
   // Frame restart support.
   void MaybeDropFrames();
@@ -1121,9 +1117,9 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
 
  private:
   // Helper functions for generating invokes.
-  void InvokePrologue(const ParameterCount& expected,
-                      const ParameterCount& actual, Label* done,
-                      bool* definitely_mismatches, InvokeFlag flag);
+  void InvokePrologue(Register expected_parameter_count,
+                      Register actual_parameter_count, Label* done,
+                      InvokeFlag flag);
 
   // Compute memory operands for safepoint stack slots.
   static int SafepointRegisterStackIndex(int reg_code);
diff --git a/deps/v8/src/codegen/mips/register-mips.h b/deps/v8/src/codegen/mips/register-mips.h
index 0c8496c6ce8be6..f009a3fd0f4a08 100644
--- a/deps/v8/src/codegen/mips/register-mips.h
+++ b/deps/v8/src/codegen/mips/register-mips.h
@@ -194,7 +194,7 @@ class Register : public RegisterBase<Register, kRegAfterLast> {
 // s3: scratch register
 // s4: scratch register 2
 #define DECLARE_REGISTER(R) \
-  constexpr Register R = Register::from_code<kRegCode_##R>();
+  constexpr Register R = Register::from_code(kRegCode_##R);
 GENERAL_REGISTERS(DECLARE_REGISTER)
 #undef DECLARE_REGISTER
 constexpr Register no_reg = Register::no_reg();
@@ -265,7 +265,7 @@ using FloatRegister = FPURegister;
 using DoubleRegister = FPURegister;
 
 #define DECLARE_DOUBLE_REGISTER(R) \
-  constexpr DoubleRegister R = DoubleRegister::from_code<kDoubleCode_##R>();
+  constexpr DoubleRegister R = DoubleRegister::from_code(kDoubleCode_##R);
 DOUBLE_REGISTERS(DECLARE_DOUBLE_REGISTER)
 #undef DECLARE_DOUBLE_REGISTER
 
@@ -275,7 +275,7 @@ constexpr DoubleRegister no_dreg = DoubleRegister::no_reg();
 using Simd128Register = MSARegister;
 
 #define DECLARE_SIMD128_REGISTER(R) \
-  constexpr Simd128Register R = Simd128Register::from_code<kMsaCode_##R>();
+  constexpr Simd128Register R = Simd128Register::from_code(kMsaCode_##R);
 SIMD128_REGISTERS(DECLARE_SIMD128_REGISTER)
 #undef DECLARE_SIMD128_REGISTER
 
diff --git a/deps/v8/src/codegen/mips64/assembler-mips64.h b/deps/v8/src/codegen/mips64/assembler-mips64.h
index 48733eebea524d..f70e46f81b379f 100644
--- a/deps/v8/src/codegen/mips64/assembler-mips64.h
+++ b/deps/v8/src/codegen/mips64/assembler-mips64.h
@@ -1642,7 +1642,8 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   // the generated instructions. This is so that multi-instruction sequences do
   // not have to check for overflow. The same is true for writes of large
   // relocation info entries.
-  static constexpr int kGap = 128;
+  static constexpr int kGap = 64;
+  STATIC_ASSERT(AssemblerBase::kMinimalBufferSize >= 2 * kGap);
 
   // Repeated checking whether the trampoline pool should be emitted is rather
   // expensive. By default we only check again once a number of instructions
diff --git a/deps/v8/src/codegen/mips64/macro-assembler-mips64.cc b/deps/v8/src/codegen/mips64/macro-assembler-mips64.cc
index 2ea770d224070e..a9bbcf54aab3e0 100644
--- a/deps/v8/src/codegen/mips64/macro-assembler-mips64.cc
+++ b/deps/v8/src/codegen/mips64/macro-assembler-mips64.cc
@@ -1556,21 +1556,23 @@ void TurboAssembler::Scd(Register rd, const MemOperand& rs) {
 }
 
 void TurboAssembler::li(Register dst, Handle<HeapObject> value, LiFlags mode) {
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadConstant(dst, value);
-      return;
-    }
+  // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+  // non-isolate-independent code. In many cases it might be cheaper than
+  // embedding the relocatable value.
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadConstant(dst, value);
+    return;
   }
   li(dst, Operand(value), mode);
 }
 
 void TurboAssembler::li(Register dst, ExternalReference value, LiFlags mode) {
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadExternalReference(dst, value);
-      return;
-    }
+  // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+  // non-isolate-independent code. In many cases it might be cheaper than
+  // embedding the relocatable value.
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadExternalReference(dst, value);
+    return;
   }
   li(dst, Operand(value), mode);
 }
@@ -2988,6 +2990,8 @@ void TurboAssembler::Movf(Register rd, Register rs, uint16_t cc) {
 
 void TurboAssembler::Clz(Register rd, Register rs) { clz(rd, rs); }
 
+void TurboAssembler::Dclz(Register rd, Register rs) { dclz(rd, rs); }
+
 void TurboAssembler::Ctz(Register rd, Register rs) {
   if (kArchVariant == kMips64r6) {
     // We don't have an instruction to count the number of trailing zeroes.
@@ -4176,28 +4180,28 @@ void TurboAssembler::Jump(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond, Register rs, const Operand& rt,
                           BranchDelaySlot bd) {
   DCHECK(RelocInfo::IsCodeTarget(rmode));
-  if (FLAG_embedded_builtins) {
-    BlockTrampolinePoolScope block_trampoline_pool(this);
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadConstant(t9, code);
-      Daddu(t9, t9, Operand(Code::kHeaderSize - kHeapObjectTag));
+
+  BlockTrampolinePoolScope block_trampoline_pool(this);
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadConstant(t9, code);
+    Daddu(t9, t9, Operand(Code::kHeaderSize - kHeapObjectTag));
+    Jump(t9, cond, rs, rt, bd);
+    return;
+  } else if (options().inline_offheap_trampolines) {
+    int builtin_index = Builtins::kNoBuiltinId;
+    if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+        Builtins::IsIsolateIndependent(builtin_index)) {
+      // Inline the trampoline.
+      RecordCommentForOffHeapTrampoline(builtin_index);
+      CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
+      EmbeddedData d = EmbeddedData::FromBlob();
+      Address entry = d.InstructionStartOfBuiltin(builtin_index);
+      li(t9, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
       Jump(t9, cond, rs, rt, bd);
       return;
-    } else if (options().inline_offheap_trampolines) {
-      int builtin_index = Builtins::kNoBuiltinId;
-      if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
-          Builtins::IsIsolateIndependent(builtin_index)) {
-        // Inline the trampoline.
-        RecordCommentForOffHeapTrampoline(builtin_index);
-        CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
-        EmbeddedData d = EmbeddedData::FromBlob();
-        Address entry = d.InstructionStartOfBuiltin(builtin_index);
-        li(t9, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
-        Jump(t9, cond, rs, rt, bd);
-        return;
-      }
     }
   }
+
   Jump(static_cast<intptr_t>(code.address()), rmode, cond, rs, rt, bd);
 }
 
@@ -4255,28 +4259,29 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond, Register rs, const Operand& rt,
                           BranchDelaySlot bd) {
   BlockTrampolinePoolScope block_trampoline_pool(this);
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadConstant(t9, code);
-      Daddu(t9, t9, Operand(Code::kHeaderSize - kHeapObjectTag));
+
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadConstant(t9, code);
+    Daddu(t9, t9, Operand(Code::kHeaderSize - kHeapObjectTag));
+    Call(t9, cond, rs, rt, bd);
+    return;
+  } else if (options().inline_offheap_trampolines) {
+    int builtin_index = Builtins::kNoBuiltinId;
+    if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+        Builtins::IsIsolateIndependent(builtin_index)) {
+      // Inline the trampoline.
+      RecordCommentForOffHeapTrampoline(builtin_index);
+      CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
+      EmbeddedData d = EmbeddedData::FromBlob();
+      Address entry = d.InstructionStartOfBuiltin(builtin_index);
+      li(t9, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
       Call(t9, cond, rs, rt, bd);
       return;
-    } else if (options().inline_offheap_trampolines) {
-      int builtin_index = Builtins::kNoBuiltinId;
-      if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
-          Builtins::IsIsolateIndependent(builtin_index)) {
-        // Inline the trampoline.
-        RecordCommentForOffHeapTrampoline(builtin_index);
-        CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
-        EmbeddedData d = EmbeddedData::FromBlob();
-        Address entry = d.InstructionStartOfBuiltin(builtin_index);
-        li(t9, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
-        Call(t9, cond, rs, rt, bd);
-        return;
-      }
     }
   }
+
   DCHECK(RelocInfo::IsCodeTarget(rmode));
+  DCHECK(code->IsExecutable());
   Call(code.address(), rmode, cond, rs, rt, bd);
 }
 
@@ -4297,6 +4302,25 @@ void TurboAssembler::CallBuiltinByIndex(Register builtin_index) {
   Call(builtin_index);
 }
 
+void TurboAssembler::PatchAndJump(Address target) {
+  if (kArchVariant != kMips64r6) {
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.Acquire();
+    mov(scratch, ra);
+    bal(1);                                  // jump to ld
+    nop();                                   // in the delay slot
+    ld(t9, MemOperand(ra, kInstrSize * 3));  // ra == pc_
+    jr(t9);
+    mov(ra, scratch);  // in delay slot
+    DCHECK_EQ(reinterpret_cast<uint64_t>(pc_) % 8, 0);
+    *reinterpret_cast<uint64_t*>(pc_) = target;  // pc_ should be align.
+    pc_ += sizeof(uint64_t);
+  } else {
+    // TODO(mips r6): Implement.
+    UNIMPLEMENTED();
+  }
+}
+
 void TurboAssembler::StoreReturnAddressAndCall(Register target) {
   // This generates the final instruction sequence for calls to C functions
   // once an exit frame has been constructed.
@@ -4581,35 +4605,21 @@ void TurboAssembler::MovToFloatParameters(DoubleRegister src1,
 // -----------------------------------------------------------------------------
 // JavaScript invokes.
 
-void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
-                                        Register caller_args_count_reg,
+void TurboAssembler::PrepareForTailCall(Register callee_args_count,
+                                        Register caller_args_count,
                                         Register scratch0, Register scratch1) {
-#if DEBUG
-  if (callee_args_count.is_reg()) {
-    DCHECK(!AreAliased(callee_args_count.reg(), caller_args_count_reg, scratch0,
-                       scratch1));
-  } else {
-    DCHECK(!AreAliased(caller_args_count_reg, scratch0, scratch1));
-  }
-#endif
-
   // Calculate the end of destination area where we will put the arguments
   // after we drop current frame. We add kPointerSize to count the receiver
   // argument which is not included into formal parameters count.
   Register dst_reg = scratch0;
-  Dlsa(dst_reg, fp, caller_args_count_reg, kPointerSizeLog2);
+  Dlsa(dst_reg, fp, caller_args_count, kPointerSizeLog2);
   Daddu(dst_reg, dst_reg,
         Operand(StandardFrameConstants::kCallerSPOffset + kPointerSize));
 
-  Register src_reg = caller_args_count_reg;
+  Register src_reg = caller_args_count;
   // Calculate the end of source area. +kPointerSize is for the receiver.
-  if (callee_args_count.is_reg()) {
-    Dlsa(src_reg, sp, callee_args_count.reg(), kPointerSizeLog2);
-    Daddu(src_reg, src_reg, Operand(kPointerSize));
-  } else {
-    Daddu(src_reg, sp,
-          Operand((callee_args_count.immediate() + 1) * kPointerSize));
-  }
+  Dlsa(src_reg, sp, callee_args_count, kPointerSizeLog2);
+  Daddu(src_reg, src_reg, Operand(kPointerSize));
 
   if (FLAG_debug_code) {
     Check(lo, AbortReason::kStackAccessBelowStackPointer, src_reg,
@@ -4641,68 +4651,40 @@ void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
   mov(sp, dst_reg);
 }
 
-void MacroAssembler::InvokePrologue(const ParameterCount& expected,
-                                    const ParameterCount& actual, Label* done,
-                                    bool* definitely_mismatches,
-                                    InvokeFlag flag) {
-  bool definitely_matches = false;
-  *definitely_mismatches = false;
+void MacroAssembler::InvokePrologue(Register expected_parameter_count,
+                                    Register actual_parameter_count,
+                                    Label* done, InvokeFlag flag) {
   Label regular_invoke;
 
-  // Check whether the expected and actual arguments count match. If not,
-  // setup registers according to contract with ArgumentsAdaptorTrampoline:
+  // Check whether the expected and actual arguments count match. The registers
+  // are set up according to contract with ArgumentsAdaptorTrampoline:
   //  a0: actual arguments count
   //  a1: function (passed through to callee)
   //  a2: expected arguments count
 
   // The code below is made a lot easier because the calling code already sets
-  // up actual and expected registers according to the contract if values are
-  // passed in registers.
-  DCHECK(actual.is_immediate() || actual.reg() == a0);
-  DCHECK(expected.is_immediate() || expected.reg() == a2);
-
-  if (expected.is_immediate()) {
-    DCHECK(actual.is_immediate());
-    li(a0, Operand(actual.immediate()));
-    if (expected.immediate() == actual.immediate()) {
-      definitely_matches = true;
-    } else {
-      const int sentinel = SharedFunctionInfo::kDontAdaptArgumentsSentinel;
-      if (expected.immediate() == sentinel) {
-        // Don't worry about adapting arguments for builtins that
-        // don't want that done. Skip adaption code by making it look
-        // like we have a match between expected and actual number of
-        // arguments.
-        definitely_matches = true;
-      } else {
-        *definitely_mismatches = true;
-        li(a2, Operand(expected.immediate()));
-      }
-    }
-  } else if (actual.is_immediate()) {
-    li(a0, Operand(actual.immediate()));
-    Branch(&regular_invoke, eq, expected.reg(), Operand(a0));
+  // up actual and expected registers according to the contract.
+
+  DCHECK_EQ(actual_parameter_count, a0);
+  DCHECK_EQ(expected_parameter_count, a2);
+
+  Branch(&regular_invoke, eq, expected_parameter_count,
+         Operand(actual_parameter_count));
+
+  Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
+  if (flag == CALL_FUNCTION) {
+    Call(adaptor);
+    Branch(done);
   } else {
-    Branch(&regular_invoke, eq, expected.reg(), Operand(actual.reg()));
+    Jump(adaptor, RelocInfo::CODE_TARGET);
   }
 
-  if (!definitely_matches) {
-    Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
-    if (flag == CALL_FUNCTION) {
-      Call(adaptor);
-      if (!*definitely_mismatches) {
-        Branch(done);
-      }
-    } else {
-      Jump(adaptor, RelocInfo::CODE_TARGET);
-    }
-    bind(&regular_invoke);
-  }
+  bind(&regular_invoke);
 }
 
 void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual) {
+                                    Register expected_parameter_count,
+                                    Register actual_parameter_count) {
   Label skip_hook;
 
   li(t0, ExternalReference::debug_hook_on_function_call_address(isolate()));
@@ -4711,23 +4693,16 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
 
   {
     // Load receiver to pass it later to DebugOnFunctionCall hook.
-    if (actual.is_reg()) {
-      mov(t0, actual.reg());
-    } else {
-      li(t0, actual.immediate());
-    }
-    Dlsa(t0, sp, t0, kPointerSizeLog2);
+    Dlsa(t0, sp, actual_parameter_count, kPointerSizeLog2);
     Ld(t0, MemOperand(t0));
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
-    if (expected.is_reg()) {
-      SmiTag(expected.reg());
-      Push(expected.reg());
-    }
-    if (actual.is_reg()) {
-      SmiTag(actual.reg());
-      Push(actual.reg());
-    }
+    SmiTag(expected_parameter_count);
+    Push(expected_parameter_count);
+
+    SmiTag(actual_parameter_count);
+    Push(actual_parameter_count);
+
     if (new_target.is_valid()) {
       Push(new_target);
     }
@@ -4739,29 +4714,28 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
     if (new_target.is_valid()) {
       Pop(new_target);
     }
-    if (actual.is_reg()) {
-      Pop(actual.reg());
-      SmiUntag(actual.reg());
-    }
-    if (expected.is_reg()) {
-      Pop(expected.reg());
-      SmiUntag(expected.reg());
-    }
+
+    Pop(actual_parameter_count);
+    SmiUntag(actual_parameter_count);
+
+    Pop(expected_parameter_count);
+    SmiUntag(expected_parameter_count);
   }
   bind(&skip_hook);
 }
 
 void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
-                                        const ParameterCount& expected,
-                                        const ParameterCount& actual,
+                                        Register expected_parameter_count,
+                                        Register actual_parameter_count,
                                         InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
-  DCHECK(function == a1);
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
+  DCHECK_EQ(function, a1);
   DCHECK_IMPLIES(new_target.is_valid(), new_target == a3);
 
   // On function call, call into the debugger if necessary.
-  CheckDebugHook(function, new_target, expected, actual);
+  CheckDebugHook(function, new_target, expected_parameter_count,
+                 actual_parameter_count);
 
   // Clear the new.target register if not given.
   if (!new_target.is_valid()) {
@@ -4769,62 +4743,62 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
   }
 
   Label done;
-  bool definitely_mismatches = false;
-  InvokePrologue(expected, actual, &done, &definitely_mismatches, flag);
-  if (!definitely_mismatches) {
-    // We call indirectly through the code field in the function to
-    // allow recompilation to take effect without changing any of the
-    // call sites.
-    Register code = kJavaScriptCallCodeStartRegister;
-    Ld(code, FieldMemOperand(function, JSFunction::kCodeOffset));
-    if (flag == CALL_FUNCTION) {
-      Daddu(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
-      Call(code);
-    } else {
-      DCHECK(flag == JUMP_FUNCTION);
-      Daddu(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
-      Jump(code);
-    }
-    // Continue here if InvokePrologue does handle the invocation due to
-    // mismatched parameter counts.
-    bind(&done);
-  }
+  InvokePrologue(expected_parameter_count, actual_parameter_count, &done, flag);
+  // We call indirectly through the code field in the function to
+  // allow recompilation to take effect without changing any of the
+  // call sites.
+  Register code = kJavaScriptCallCodeStartRegister;
+  Ld(code, FieldMemOperand(function, JSFunction::kCodeOffset));
+  if (flag == CALL_FUNCTION) {
+    Daddu(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
+    Call(code);
+  } else {
+    DCHECK(flag == JUMP_FUNCTION);
+    Daddu(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
+    Jump(code);
+  }
+
+  // Continue here if InvokePrologue does handle the invocation due to
+  // mismatched parameter counts.
+  bind(&done);
 }
 
-void MacroAssembler::InvokeFunction(Register function, Register new_target,
-                                    const ParameterCount& actual,
-                                    InvokeFlag flag) {
+void MacroAssembler::InvokeFunctionWithNewTarget(
+    Register function, Register new_target, Register actual_parameter_count,
+    InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
 
   // Contract with called JS functions requires that function is passed in a1.
-  DCHECK(function == a1);
-  Register expected_reg = a2;
+  DCHECK_EQ(function, a1);
+  Register expected_parameter_count = a2;
   Register temp_reg = t0;
   Ld(temp_reg, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
   Ld(cp, FieldMemOperand(a1, JSFunction::kContextOffset));
   // The argument count is stored as uint16_t
-  Lhu(expected_reg,
+  Lhu(expected_parameter_count,
       FieldMemOperand(temp_reg,
                       SharedFunctionInfo::kFormalParameterCountOffset));
-  ParameterCount expected(expected_reg);
-  InvokeFunctionCode(a1, new_target, expected, actual, flag);
+
+  InvokeFunctionCode(a1, new_target, expected_parameter_count,
+                     actual_parameter_count, flag);
 }
 
 void MacroAssembler::InvokeFunction(Register function,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
+                                    Register expected_parameter_count,
+                                    Register actual_parameter_count,
                                     InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
 
   // Contract with called JS functions requires that function is passed in a1.
-  DCHECK(function == a1);
+  DCHECK_EQ(function, a1);
 
   // Get the function and setup the context.
   Ld(cp, FieldMemOperand(a1, JSFunction::kContextOffset));
 
-  InvokeFunctionCode(a1, no_reg, expected, actual, flag);
+  InvokeFunctionCode(a1, no_reg, expected_parameter_count,
+                     actual_parameter_count, flag);
 }
 
 // ---------------------------------------------------------------------------
@@ -4832,7 +4806,7 @@ void MacroAssembler::InvokeFunction(Register function,
 
 void MacroAssembler::GetObjectType(Register object, Register map,
                                    Register type_reg) {
-  Ld(map, FieldMemOperand(object, HeapObject::kMapOffset));
+  LoadMap(map, object);
   Lhu(type_reg, FieldMemOperand(map, Map::kInstanceTypeOffset));
 }
 
@@ -4928,20 +4902,6 @@ void TurboAssembler::MulOverflow(Register dst, Register left,
   xor_(overflow, overflow, scratch);
 }
 
-void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
-                                           Register centry) {
-  const Runtime::Function* f = Runtime::FunctionForId(fid);
-  // TODO(1236192): Most runtime routines don't need the number of
-  // arguments passed in because it is constant. At some point we
-  // should remove this need and make the runtime routine entry code
-  // smarter.
-  PrepareCEntryArgs(f->nargs);
-  PrepareCEntryFunction(ExternalReference::Create(f));
-  DCHECK(!AreAliased(centry, a0, a1));
-  Daddu(centry, centry, Operand(Code::kHeaderSize - kHeapObjectTag));
-  Call(centry);
-}
-
 void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
                                  SaveFPRegsMode save_doubles) {
   // All parameters are on the stack. v0 has the return value after call.
@@ -5023,6 +4983,8 @@ void MacroAssembler::DecrementCounter(StatsCounter* counter, int value,
 // -----------------------------------------------------------------------------
 // Debugging.
 
+void TurboAssembler::Trap() { stop(); }
+
 void TurboAssembler::Assert(Condition cc, AbortReason reason, Register rs,
                             Operand rt) {
   if (emit_debug_code()) Check(cc, reason, rs, rt);
@@ -5088,9 +5050,15 @@ void TurboAssembler::Abort(AbortReason reason) {
   }
 }
 
+void MacroAssembler::LoadMap(Register destination, Register object) {
+  Ld(destination, FieldMemOperand(object, HeapObject::kMapOffset));
+}
+
 void MacroAssembler::LoadNativeContextSlot(int index, Register dst) {
-  Ld(dst, NativeContextMemOperand());
-  Ld(dst, ContextMemOperand(dst, index));
+  LoadMap(dst, cp);
+  Ld(dst,
+     FieldMemOperand(dst, Map::kConstructorOrBackPointerOrNativeContextOffset));
+  Ld(dst, MemOperand(dst, Context::SlotOffset(index)));
 }
 
 void TurboAssembler::StubPrologue(StackFrame::Type type) {
@@ -5345,9 +5313,9 @@ void MacroAssembler::AssertConstructor(Register object) {
     Check(ne, AbortReason::kOperandIsASmiAndNotAConstructor, t8,
           Operand(zero_reg));
 
-    ld(t8, FieldMemOperand(object, HeapObject::kMapOffset));
+    LoadMap(t8, object);
     Lbu(t8, FieldMemOperand(t8, Map::kBitFieldOffset));
-    And(t8, t8, Operand(Map::IsConstructorBit::kMask));
+    And(t8, t8, Operand(Map::Bits1::IsConstructorBit::kMask));
     Check(ne, AbortReason::kOperandIsNotAConstructor, t8, Operand(zero_reg));
   }
 }
diff --git a/deps/v8/src/codegen/mips64/macro-assembler-mips64.h b/deps/v8/src/codegen/mips64/macro-assembler-mips64.h
index 886d64e494b3b0..d1f681c38a274d 100644
--- a/deps/v8/src/codegen/mips64/macro-assembler-mips64.h
+++ b/deps/v8/src/codegen/mips64/macro-assembler-mips64.h
@@ -74,14 +74,6 @@ Register GetRegisterThatIsNotOneOf(Register reg1, Register reg2 = no_reg,
 #define SmiWordOffset(offset) offset
 #endif
 
-inline MemOperand ContextMemOperand(Register context, int index) {
-  return MemOperand(context, Context::SlotOffset(index));
-}
-
-inline MemOperand NativeContextMemOperand() {
-  return ContextMemOperand(cp, Context::NATIVE_CONTEXT_INDEX);
-}
-
 // Generate a MemOperand for loading a field from an object.
 inline MemOperand FieldMemOperand(Register object, int offset) {
   return MemOperand(object, offset - kHeapObjectTag);
@@ -130,6 +122,8 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   // -------------------------------------------------------------------------
   // Debugging.
 
+  void Trap() override;
+
   // Calls Abort(msg) if the condition cc is not satisfied.
   // Use --debug_code to enable.
   void Assert(Condition cc, AbortReason reason, Register rs, Operand rt);
@@ -228,6 +222,10 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void Jump(Register target, COND_ARGS);
   void Jump(intptr_t target, RelocInfo::Mode rmode, COND_ARGS);
   void Jump(Address target, RelocInfo::Mode rmode, COND_ARGS);
+  // Deffer from li, this method save target to the memory, and then load
+  // it to register use ld, it can be used in wasm jump table for concurrent
+  // patching.
+  void PatchAndJump(Address target);
   void Jump(Handle<Code> code, RelocInfo::Mode rmode, COND_ARGS);
   void Jump(const ExternalReference& reference) override;
   void Call(Register target, COND_ARGS);
@@ -474,11 +472,11 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 
   // Removes current frame and its arguments from the stack preserving
   // the arguments and a return address pushed to the stack for the next call.
-  // Both |callee_args_count| and |caller_args_count_reg| do not include
-  // receiver. |callee_args_count| is not modified, |caller_args_count_reg|
+  // Both |callee_args_count| and |caller_args_count| do not include
+  // receiver. |callee_args_count| is not modified. |caller_args_count|
   // is trashed.
-  void PrepareForTailCall(const ParameterCount& callee_args_count,
-                          Register caller_args_count_reg, Register scratch0,
+  void PrepareForTailCall(Register callee_args_count,
+                          Register caller_args_count, Register scratch0,
                           Register scratch1);
 
   int CalculateStackPassedWords(int num_reg_arguments,
@@ -533,10 +531,6 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
                      Label* condition_met);
 #undef COND_ARGS
 
-  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
-  // builtin for the target runtime function and uses an indirect call.
-  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
-
   // Performs a truncating conversion of a floating point number as used by
   // the JS bitwise operations. See ECMA-262 9.5: ToInt32.
   // Exits with 'result' holding the answer.
@@ -558,6 +552,7 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
                            Condition cond);
 
   void Clz(Register rd, Register rs);
+  void Dclz(Register rd, Register rs);
   void Ctz(Register rd, Register rs);
   void Dctz(Register rd, Register rs);
   void Popcnt(Register rd, Register rs);
@@ -1015,6 +1010,8 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
                       bool do_return = NO_EMIT_RETURN,
                       bool argument_count_is_length = false);
 
+  void LoadMap(Register destination, Register object);
+
   // Make sure the stack is aligned. Only emits code in debug mode.
   void AssertStackIsAligned();
 
@@ -1035,21 +1032,21 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
 
   // Invoke the JavaScript function code by either calling or jumping.
   void InvokeFunctionCode(Register function, Register new_target,
-                          const ParameterCount& expected,
-                          const ParameterCount& actual, InvokeFlag flag);
+                          Register expected_parameter_count,
+                          Register actual_parameter_count, InvokeFlag flag);
 
   // On function call, call into the debugger if necessary.
   void CheckDebugHook(Register fun, Register new_target,
-                      const ParameterCount& expected,
-                      const ParameterCount& actual);
+                      Register expected_parameter_count,
+                      Register actual_parameter_count);
 
   // Invoke the JavaScript function in the given register. Changes the
   // current context to the context in the function before invoking.
-  void InvokeFunction(Register function, Register new_target,
-                      const ParameterCount& actual, InvokeFlag flag);
-
-  void InvokeFunction(Register function, const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
+  void InvokeFunctionWithNewTarget(Register function, Register new_target,
+                                   Register actual_parameter_count,
+                                   InvokeFlag flag);
+  void InvokeFunction(Register function, Register expected_parameter_count,
+                      Register actual_parameter_count, InvokeFlag flag);
 
   // Frame restart support.
   void MaybeDropFrames();
@@ -1181,9 +1178,9 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
 
  private:
   // Helper functions for generating invokes.
-  void InvokePrologue(const ParameterCount& expected,
-                      const ParameterCount& actual, Label* done,
-                      bool* definitely_mismatches, InvokeFlag flag);
+  void InvokePrologue(Register expected_parameter_count,
+                      Register actual_parameter_count, Label* done,
+                      InvokeFlag flag);
 
   // Compute memory operands for safepoint stack slots.
   static int SafepointRegisterStackIndex(int reg_code);
diff --git a/deps/v8/src/codegen/mips64/register-mips64.h b/deps/v8/src/codegen/mips64/register-mips64.h
index 976b7bf3f04953..9915f7d942f5bb 100644
--- a/deps/v8/src/codegen/mips64/register-mips64.h
+++ b/deps/v8/src/codegen/mips64/register-mips64.h
@@ -193,7 +193,7 @@ class Register : public RegisterBase<Register, kRegAfterLast> {
 // s3: scratch register
 // s4: scratch register 2
 #define DECLARE_REGISTER(R) \
-  constexpr Register R = Register::from_code<kRegCode_##R>();
+  constexpr Register R = Register::from_code(kRegCode_##R);
 GENERAL_REGISTERS(DECLARE_REGISTER)
 #undef DECLARE_REGISTER
 
@@ -271,7 +271,7 @@ using FloatRegister = FPURegister;
 using DoubleRegister = FPURegister;
 
 #define DECLARE_DOUBLE_REGISTER(R) \
-  constexpr DoubleRegister R = DoubleRegister::from_code<kDoubleCode_##R>();
+  constexpr DoubleRegister R = DoubleRegister::from_code(kDoubleCode_##R);
 DOUBLE_REGISTERS(DECLARE_DOUBLE_REGISTER)
 #undef DECLARE_DOUBLE_REGISTER
 
@@ -281,7 +281,7 @@ constexpr DoubleRegister no_dreg = DoubleRegister::no_reg();
 using Simd128Register = MSARegister;
 
 #define DECLARE_SIMD128_REGISTER(R) \
-  constexpr Simd128Register R = Simd128Register::from_code<kMsaCode_##R>();
+  constexpr Simd128Register R = Simd128Register::from_code(kMsaCode_##R);
 SIMD128_REGISTERS(DECLARE_SIMD128_REGISTER)
 #undef DECLARE_SIMD128_REGISTER
 
diff --git a/deps/v8/src/codegen/optimized-compilation-info.cc b/deps/v8/src/codegen/optimized-compilation-info.cc
index de89371adbf365..7cf71e8d0f30ed 100644
--- a/deps/v8/src/codegen/optimized-compilation-info.cc
+++ b/deps/v8/src/codegen/optimized-compilation-info.cc
@@ -132,10 +132,6 @@ void OptimizedCompilationInfo::ReopenHandlesInNewHandleScope(Isolate* isolate) {
 void OptimizedCompilationInfo::AbortOptimization(BailoutReason reason) {
   DCHECK_NE(reason, BailoutReason::kNoReason);
   if (bailout_reason_ == BailoutReason::kNoReason) {
-    TRACE_EVENT_INSTANT2(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-                         "V8.AbortOptimization", TRACE_EVENT_SCOPE_THREAD,
-                         "reason", GetBailoutReason(reason), "function",
-                         shared_info()->TraceIDRef());
     bailout_reason_ = reason;
   }
   SetFlag(kDisableFutureOptimization);
@@ -144,10 +140,6 @@ void OptimizedCompilationInfo::AbortOptimization(BailoutReason reason) {
 void OptimizedCompilationInfo::RetryOptimization(BailoutReason reason) {
   DCHECK_NE(reason, BailoutReason::kNoReason);
   if (GetFlag(kDisableFutureOptimization)) return;
-  TRACE_EVENT_INSTANT2(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-                       "V8.RetryOptimization", TRACE_EVENT_SCOPE_THREAD,
-                       "reason", GetBailoutReason(reason), "function",
-                       shared_info()->TraceIDRef());
   bailout_reason_ = reason;
 }
 
@@ -251,33 +243,5 @@ OptimizedCompilationInfo::InlinedFunctionHolder::InlinedFunctionHolder(
   position.inlined_function_id = DeoptimizationData::kNotInlinedIndex;
 }
 
-std::unique_ptr<v8::tracing::TracedValue>
-OptimizedCompilationInfo::ToTracedValue() {
-  auto value = v8::tracing::TracedValue::Create();
-  value->SetBoolean("osr", is_osr());
-  value->SetBoolean("functionContextSpecialized",
-                    is_function_context_specializing());
-  if (has_shared_info()) {
-    value->SetValue("function", shared_info()->TraceIDRef());
-  }
-  if (bailout_reason() != BailoutReason::kNoReason) {
-    value->SetString("bailoutReason", GetBailoutReason(bailout_reason()));
-    value->SetBoolean("disableFutureOptimization",
-                      is_disable_future_optimization());
-  } else {
-    value->SetInteger("optimizationId", optimization_id());
-    value->BeginArray("inlinedFunctions");
-    for (auto const& inlined_function : inlined_functions()) {
-      value->BeginDictionary();
-      value->SetValue("function", inlined_function.shared_info->TraceIDRef());
-      // TODO(bmeurer): Also include the source position from the
-      // {inlined_function} here as dedicated "sourcePosition" field.
-      value->EndDictionary();
-    }
-    value->EndArray();
-  }
-  return value;
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/codegen/optimized-compilation-info.h b/deps/v8/src/codegen/optimized-compilation-info.h
index 2f3afafc68da5e..af3514b828110a 100644
--- a/deps/v8/src/codegen/optimized-compilation-info.h
+++ b/deps/v8/src/codegen/optimized-compilation-info.h
@@ -44,28 +44,28 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
   // Various configuration flags for a compilation, as well as some properties
   // of the compiled code produced by a compilation.
   enum Flag {
-    kAccessorInliningEnabled = 1 << 0,
-    kFunctionContextSpecializing = 1 << 1,
-    kInliningEnabled = 1 << 2,
-    kDisableFutureOptimization = 1 << 3,
-    kSplittingEnabled = 1 << 4,
-    kSourcePositionsEnabled = 1 << 5,
-    kBailoutOnUninitialized = 1 << 6,
-    kLoopPeelingEnabled = 1 << 7,
-    kUntrustedCodeMitigations = 1 << 8,
-    kSwitchJumpTableEnabled = 1 << 9,
-    kCalledWithCodeStartRegister = 1 << 10,
-    kPoisonRegisterArguments = 1 << 11,
-    kAllocationFoldingEnabled = 1 << 12,
-    kAnalyzeEnvironmentLiveness = 1 << 13,
-    kTraceTurboJson = 1 << 14,
-    kTraceTurboGraph = 1 << 15,
-    kTraceTurboScheduled = 1 << 16,
-    kTraceTurboAllocation = 1 << 17,
-    kTraceHeapBroker = 1 << 18,
-    kWasmRuntimeExceptionSupport = 1 << 19,
-    kTurboControlFlowAwareAllocation = 1 << 20,
-    kTurboPreprocessRanges = 1 << 21
+    kFunctionContextSpecializing = 1 << 0,
+    kInliningEnabled = 1 << 1,
+    kDisableFutureOptimization = 1 << 2,
+    kSplittingEnabled = 1 << 3,
+    kSourcePositionsEnabled = 1 << 4,
+    kBailoutOnUninitialized = 1 << 5,
+    kLoopPeelingEnabled = 1 << 6,
+    kUntrustedCodeMitigations = 1 << 7,
+    kSwitchJumpTableEnabled = 1 << 8,
+    kCalledWithCodeStartRegister = 1 << 9,
+    kPoisonRegisterArguments = 1 << 10,
+    kAllocationFoldingEnabled = 1 << 11,
+    kAnalyzeEnvironmentLiveness = 1 << 12,
+    kTraceTurboJson = 1 << 13,
+    kTraceTurboGraph = 1 << 14,
+    kTraceTurboScheduled = 1 << 15,
+    kTraceTurboAllocation = 1 << 16,
+    kTraceHeapBroker = 1 << 17,
+    kWasmRuntimeExceptionSupport = 1 << 18,
+    kTurboControlFlowAwareAllocation = 1 << 19,
+    kTurboPreprocessRanges = 1 << 20,
+    kConcurrentInlining = 1 << 21,
   };
 
   // Construct a compilation info for optimized compilation.
@@ -94,6 +94,9 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
 
   // Flags used by optimized compilation.
 
+  void MarkAsConcurrentInlining() { SetFlag(kConcurrentInlining); }
+  bool is_concurrent_inlining() const { return GetFlag(kConcurrentInlining); }
+
   void MarkAsTurboControlFlowAwareAllocation() {
     SetFlag(kTurboControlFlowAwareAllocation);
   }
@@ -113,11 +116,6 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
     return GetFlag(kFunctionContextSpecializing);
   }
 
-  void MarkAsAccessorInliningEnabled() { SetFlag(kAccessorInliningEnabled); }
-  bool is_accessor_inlining_enabled() const {
-    return GetFlag(kAccessorInliningEnabled);
-  }
-
   void MarkAsSourcePositionsEnabled() { SetFlag(kSourcePositionsEnabled); }
   bool is_source_positions_enabled() const {
     return GetFlag(kSourcePositionsEnabled);
@@ -284,8 +282,6 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
     trace_turbo_filename_ = std::move(filename);
   }
 
-  std::unique_ptr<v8::tracing::TracedValue> ToTracedValue();
-
   TickCounter& tick_counter() { return tick_counter_; }
 
  private:
diff --git a/deps/v8/src/codegen/ppc/assembler-ppc.cc b/deps/v8/src/codegen/ppc/assembler-ppc.cc
index 03dbb2edaa0dc3..321386af147df4 100644
--- a/deps/v8/src/codegen/ppc/assembler-ppc.cc
+++ b/deps/v8/src/codegen/ppc/assembler-ppc.cc
@@ -123,6 +123,11 @@ void CpuFeatures::PrintTarget() {
 
 void CpuFeatures::PrintFeatures() {
   printf("FPU=%d\n", CpuFeatures::IsSupported(FPU));
+  printf("FPR_GPR_MOV=%d\n", CpuFeatures::IsSupported(FPR_GPR_MOV));
+  printf("LWSYNC=%d\n", CpuFeatures::IsSupported(LWSYNC));
+  printf("ISELECT=%d\n", CpuFeatures::IsSupported(ISELECT));
+  printf("VSX=%d\n", CpuFeatures::IsSupported(VSX));
+  printf("MODULO=%d\n", CpuFeatures::IsSupported(MODULO));
 }
 
 Register ToRegister(int num) {
diff --git a/deps/v8/src/codegen/ppc/assembler-ppc.h b/deps/v8/src/codegen/ppc/assembler-ppc.h
index c056de9f2feaeb..222d4c28ad7d5f 100644
--- a/deps/v8/src/codegen/ppc/assembler-ppc.h
+++ b/deps/v8/src/codegen/ppc/assembler-ppc.h
@@ -1158,6 +1158,7 @@ class Assembler : public AssemblerBase {
   // not have to check for overflow. The same is true for writes of large
   // relocation info entries.
   static constexpr int kGap = 32;
+  STATIC_ASSERT(AssemblerBase::kMinimalBufferSize >= 2 * kGap);
 
   RelocInfoWriter reloc_info_writer;
 
diff --git a/deps/v8/src/codegen/ppc/constants-ppc.h b/deps/v8/src/codegen/ppc/constants-ppc.h
index 2e499fd2c41357..d8892097bd8e2a 100644
--- a/deps/v8/src/codegen/ppc/constants-ppc.h
+++ b/deps/v8/src/codegen/ppc/constants-ppc.h
@@ -2992,4 +2992,9 @@ class DoubleRegisters {
 }  // namespace internal
 }  // namespace v8
 
+static constexpr int kR0DwarfCode = 0;
+static constexpr int kFpDwarfCode = 31;  // frame-pointer
+static constexpr int kLrDwarfCode = 65;  // return-address(lr)
+static constexpr int kSpDwarfCode = 1;   // stack-pointer (sp)
+
 #endif  // V8_CODEGEN_PPC_CONSTANTS_PPC_H_
diff --git a/deps/v8/src/codegen/ppc/macro-assembler-ppc.cc b/deps/v8/src/codegen/ppc/macro-assembler-ppc.cc
index 08fb85dd2ced21..96a9058240ae01 100644
--- a/deps/v8/src/codegen/ppc/macro-assembler-ppc.cc
+++ b/deps/v8/src/codegen/ppc/macro-assembler-ppc.cc
@@ -290,6 +290,7 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
     bind(&skip);
     return;
   }
+  DCHECK(code->IsExecutable());
   Call(code.address(), rmode, cond);
 }
 
@@ -317,21 +318,23 @@ void TurboAssembler::Push(Smi smi) {
 }
 
 void TurboAssembler::Move(Register dst, Handle<HeapObject> value) {
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadConstant(dst, value);
-      return;
-    }
+  // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+  // non-isolate-independent code. In many cases it might be cheaper than
+  // embedding the relocatable value.
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadConstant(dst, value);
+    return;
   }
   mov(dst, Operand(value));
 }
 
 void TurboAssembler::Move(Register dst, ExternalReference reference) {
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadExternalReference(dst, reference);
-      return;
-    }
+  // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+  // non-isolate-independent code. In many cases it might be cheaper than
+  // embedding the relocatable value.
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadExternalReference(dst, reference);
+    return;
   }
   mov(dst, Operand(reference));
 }
@@ -1073,7 +1076,8 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, int stack_space,
   const int frame_alignment = ActivationFrameAlignment();
   if (frame_alignment > kPointerSize) {
     DCHECK(base::bits::IsPowerOfTwo(frame_alignment));
-    ClearRightImm(sp, sp, Operand(WhichPowerOf2(frame_alignment)));
+    ClearRightImm(sp, sp,
+                  Operand(base::bits::WhichPowerOfTwo(frame_alignment)));
   }
   li(r0, Operand::Zero());
   StorePU(r0, MemOperand(sp, -kNumRequiredStackFrameSlots * kPointerSize));
@@ -1150,36 +1154,25 @@ void TurboAssembler::MovFromFloatParameter(const DoubleRegister dst) {
   Move(dst, d1);
 }
 
-void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
-                                        Register caller_args_count_reg,
+void TurboAssembler::PrepareForTailCall(Register callee_args_count,
+                                        Register caller_args_count,
                                         Register scratch0, Register scratch1) {
-#if DEBUG
-  if (callee_args_count.is_reg()) {
-    DCHECK(!AreAliased(callee_args_count.reg(), caller_args_count_reg, scratch0,
-                       scratch1));
-  } else {
-    DCHECK(!AreAliased(caller_args_count_reg, scratch0, scratch1));
-  }
-#endif
+  DCHECK(!AreAliased(callee_args_count, caller_args_count, scratch0, scratch1));
 
   // Calculate the end of destination area where we will put the arguments
   // after we drop current frame. We add kPointerSize to count the receiver
   // argument which is not included into formal parameters count.
   Register dst_reg = scratch0;
-  ShiftLeftImm(dst_reg, caller_args_count_reg, Operand(kPointerSizeLog2));
+  ShiftLeftImm(dst_reg, caller_args_count, Operand(kPointerSizeLog2));
   add(dst_reg, fp, dst_reg);
   addi(dst_reg, dst_reg,
        Operand(StandardFrameConstants::kCallerSPOffset + kPointerSize));
 
-  Register src_reg = caller_args_count_reg;
+  Register src_reg = caller_args_count;
   // Calculate the end of source area. +kPointerSize is for the receiver.
-  if (callee_args_count.is_reg()) {
-    ShiftLeftImm(src_reg, callee_args_count.reg(), Operand(kPointerSizeLog2));
-    add(src_reg, sp, src_reg);
-    addi(src_reg, src_reg, Operand(kPointerSize));
-  } else {
-    Add(src_reg, sp, (callee_args_count.immediate() + 1) * kPointerSize, r0);
-  }
+  ShiftLeftImm(src_reg, callee_args_count, Operand(kPointerSizeLog2));
+  add(src_reg, sp, src_reg);
+  addi(src_reg, src_reg, Operand(kPointerSize));
 
   if (FLAG_debug_code) {
     cmpl(src_reg, dst_reg);
@@ -1197,11 +1190,7 @@ void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
   // so they must be pre-decremented in the loop.
   Register tmp_reg = scratch1;
   Label loop;
-  if (callee_args_count.is_reg()) {
-    addi(tmp_reg, callee_args_count.reg(), Operand(1));  // +1 for receiver
-  } else {
-    mov(tmp_reg, Operand(callee_args_count.immediate() + 1));
-  }
+  addi(tmp_reg, callee_args_count, Operand(1));  // +1 for receiver
   mtctr(tmp_reg);
   bind(&loop);
   LoadPU(tmp_reg, MemOperand(src_reg, -kPointerSize));
@@ -1212,12 +1201,9 @@ void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
   mr(sp, dst_reg);
 }
 
-void MacroAssembler::InvokePrologue(const ParameterCount& expected,
-                                    const ParameterCount& actual, Label* done,
-                                    bool* definitely_mismatches,
-                                    InvokeFlag flag) {
-  bool definitely_matches = false;
-  *definitely_mismatches = false;
+void MacroAssembler::InvokePrologue(Register expected_parameter_count,
+                                    Register actual_parameter_count,
+                                    Label* done, InvokeFlag flag) {
   Label regular_invoke;
 
   // Check whether the expected and actual arguments count match. If not,
@@ -1230,56 +1216,28 @@ void MacroAssembler::InvokePrologue(const ParameterCount& expected,
   // up actual and expected registers according to the contract if values are
   // passed in registers.
 
+  // The code below is made a lot easier because the calling code already sets
+  // up actual and expected registers according to the contract.
   // ARM has some sanity checks as per below, considering add them for PPC
-  //  DCHECK(actual.is_immediate() || actual.reg() == r3);
-  //  DCHECK(expected.is_immediate() || expected.reg() == r5);
-
-  if (expected.is_immediate()) {
-    DCHECK(actual.is_immediate());
-    mov(r3, Operand(actual.immediate()));
-    if (expected.immediate() == actual.immediate()) {
-      definitely_matches = true;
-    } else {
-      const int sentinel = SharedFunctionInfo::kDontAdaptArgumentsSentinel;
-      if (expected.immediate() == sentinel) {
-        // Don't worry about adapting arguments for builtins that
-        // don't want that done. Skip adaption code by making it look
-        // like we have a match between expected and actual number of
-        // arguments.
-        definitely_matches = true;
-      } else {
-        *definitely_mismatches = true;
-        mov(r5, Operand(expected.immediate()));
-      }
-    }
+  // DCHECK_EQ(actual_parameter_count, r3);
+  // DCHECK_EQ(expected_parameter_count, r5);
+
+  cmp(expected_parameter_count, actual_parameter_count);
+  beq(&regular_invoke);
+
+  Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
+  if (flag == CALL_FUNCTION) {
+    Call(adaptor);
+    b(done);
   } else {
-    if (actual.is_immediate()) {
-      mov(r3, Operand(actual.immediate()));
-      cmpi(expected.reg(), Operand(actual.immediate()));
-      beq(&regular_invoke);
-    } else {
-      cmp(expected.reg(), actual.reg());
-      beq(&regular_invoke);
-    }
+    Jump(adaptor, RelocInfo::CODE_TARGET);
   }
-
-  if (!definitely_matches) {
-    Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
-    if (flag == CALL_FUNCTION) {
-      Call(adaptor);
-      if (!*definitely_mismatches) {
-        b(done);
-      }
-    } else {
-      Jump(adaptor, RelocInfo::CODE_TARGET);
-    }
     bind(&regular_invoke);
-  }
 }
 
 void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual) {
+                                    Register expected_parameter_count,
+                                    Register actual_parameter_count) {
   Label skip_hook;
 
   ExternalReference debug_hook_active =
@@ -1292,22 +1250,17 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
 
   {
     // Load receiver to pass it later to DebugOnFunctionCall hook.
-    if (actual.is_reg()) {
-      ShiftLeftImm(r7, actual.reg(), Operand(kPointerSizeLog2));
-      LoadPX(r7, MemOperand(sp, r7));
-    } else {
-      LoadP(r7, MemOperand(sp, actual.immediate() << kPointerSizeLog2), r0);
-    }
+    ShiftLeftImm(r7, actual_parameter_count, Operand(kPointerSizeLog2));
+    LoadPX(r7, MemOperand(sp, r7));
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
-    if (expected.is_reg()) {
-      SmiTag(expected.reg());
-      Push(expected.reg());
-    }
-    if (actual.is_reg()) {
-      SmiTag(actual.reg());
-      Push(actual.reg());
-    }
+
+    SmiTag(expected_parameter_count);
+    Push(expected_parameter_count);
+
+    SmiTag(actual_parameter_count);
+    Push(actual_parameter_count);
+
     if (new_target.is_valid()) {
       Push(new_target);
     }
@@ -1317,29 +1270,28 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
     if (new_target.is_valid()) {
       Pop(new_target);
     }
-    if (actual.is_reg()) {
-      Pop(actual.reg());
-      SmiUntag(actual.reg());
-    }
-    if (expected.is_reg()) {
-      Pop(expected.reg());
-      SmiUntag(expected.reg());
-    }
+
+    Pop(actual_parameter_count);
+    SmiUntag(actual_parameter_count);
+
+    Pop(expected_parameter_count);
+    SmiUntag(expected_parameter_count);
   }
   bind(&skip_hook);
 }
 
 void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
-                                        const ParameterCount& expected,
-                                        const ParameterCount& actual,
+                                        Register expected_parameter_count,
+                                        Register actual_parameter_count,
                                         InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
-  DCHECK(function == r4);
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
+  DCHECK_EQ(function, r4);
   DCHECK_IMPLIES(new_target.is_valid(), new_target == r6);
 
   // On function call, call into the debugger if necessary.
-  CheckDebugHook(function, new_target, expected, actual);
+  CheckDebugHook(function, new_target, expected_parameter_count,
+                 actual_parameter_count);
 
   // Clear the new.target register if not given.
   if (!new_target.is_valid()) {
@@ -1347,35 +1299,32 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
   }
 
   Label done;
-  bool definitely_mismatches = false;
-  InvokePrologue(expected, actual, &done, &definitely_mismatches, flag);
-  if (!definitely_mismatches) {
-    // We call indirectly through the code field in the function to
-    // allow recompilation to take effect without changing any of the
-    // call sites.
-    Register code = kJavaScriptCallCodeStartRegister;
-    LoadP(code, FieldMemOperand(function, JSFunction::kCodeOffset));
-    if (flag == CALL_FUNCTION) {
-      CallCodeObject(code);
-    } else {
-      DCHECK(flag == JUMP_FUNCTION);
-      JumpCodeObject(code);
-    }
+  InvokePrologue(expected_parameter_count, actual_parameter_count, &done, flag);
+  // We call indirectly through the code field in the function to
+  // allow recompilation to take effect without changing any of the
+  // call sites.
+  Register code = kJavaScriptCallCodeStartRegister;
+  LoadP(code, FieldMemOperand(function, JSFunction::kCodeOffset));
+  if (flag == CALL_FUNCTION) {
+    CallCodeObject(code);
+  } else {
+    DCHECK(flag == JUMP_FUNCTION);
+    JumpCodeObject(code);
+  }
 
     // Continue here if InvokePrologue does handle the invocation due to
     // mismatched parameter counts.
     bind(&done);
-  }
 }
 
-void MacroAssembler::InvokeFunction(Register fun, Register new_target,
-                                    const ParameterCount& actual,
-                                    InvokeFlag flag) {
+void MacroAssembler::InvokeFunctionWithNewTarget(
+    Register fun, Register new_target, Register actual_parameter_count,
+    InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
 
   // Contract with called JS functions requires that function is passed in r4.
-  DCHECK(fun == r4);
+  DCHECK_EQ(fun, r4);
 
   Register expected_reg = r5;
   Register temp_reg = r7;
@@ -1386,24 +1335,25 @@ void MacroAssembler::InvokeFunction(Register fun, Register new_target,
                FieldMemOperand(
                    temp_reg, SharedFunctionInfo::kFormalParameterCountOffset));
 
-  ParameterCount expected(expected_reg);
-  InvokeFunctionCode(fun, new_target, expected, actual, flag);
+  InvokeFunctionCode(fun, new_target, expected_reg, actual_parameter_count,
+                     flag);
 }
 
 void MacroAssembler::InvokeFunction(Register function,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
+                                    Register expected_parameter_count,
+                                    Register actual_parameter_count,
                                     InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
 
   // Contract with called JS functions requires that function is passed in r4.
-  DCHECK(function == r4);
+  DCHECK_EQ(function, r4);
 
   // Get the function and setup the context.
   LoadP(cp, FieldMemOperand(r4, JSFunction::kContextOffset));
 
-  InvokeFunctionCode(r4, no_reg, expected, actual, flag);
+  InvokeFunctionCode(r4, no_reg, expected_parameter_count,
+                     actual_parameter_count, flag);
 }
 
 void MacroAssembler::MaybeDropFrames() {
@@ -1451,7 +1401,7 @@ void MacroAssembler::CompareObjectType(Register object, Register map,
                                        Register type_reg, InstanceType type) {
   const Register temp = type_reg == no_reg ? r0 : type_reg;
 
-  LoadP(map, FieldMemOperand(object, HeapObject::kMapOffset));
+  LoadMap(map, object);
   CompareInstanceType(map, temp, type);
 }
 
@@ -1623,19 +1573,6 @@ void TurboAssembler::TryInlineTruncateDoubleToI(Register result,
   beq(done);
 }
 
-void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
-                                           Register centry) {
-  const Runtime::Function* f = Runtime::FunctionForId(fid);
-  // TODO(1236192): Most runtime routines don't need the number of
-  // arguments passed in because it is constant. At some point we
-  // should remove this need and make the runtime routine entry code
-  // smarter.
-  mov(r3, Operand(f->nargs));
-  Move(r4, ExternalReference::Create(f));
-  DCHECK(!AreAliased(centry, r3, r4));
-  CallCodeObject(centry);
-}
-
 void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
                                  SaveFPRegsMode save_doubles) {
   // All parameters are on the stack.  r3 has the return value after call.
@@ -1769,9 +1706,15 @@ void TurboAssembler::Abort(AbortReason reason) {
   // will not return here
 }
 
+void MacroAssembler::LoadMap(Register destination, Register object) {
+  LoadP(destination, FieldMemOperand(object, HeapObject::kMapOffset));
+}
+
 void MacroAssembler::LoadNativeContextSlot(int index, Register dst) {
-  LoadP(dst, NativeContextMemOperand());
-  LoadP(dst, ContextMemOperand(dst, index));
+  LoadMap(dst, cp);
+  LoadP(dst, FieldMemOperand(
+                 dst, Map::kConstructorOrBackPointerOrNativeContextOffset));
+  LoadP(dst, MemOperand(dst, Context::SlotOffset(index)));
 }
 
 void MacroAssembler::AssertNotSmi(Register object) {
@@ -1796,9 +1739,9 @@ void MacroAssembler::AssertConstructor(Register object) {
     TestIfSmi(object, r0);
     Check(ne, AbortReason::kOperandIsASmiAndNotAConstructor, cr0);
     push(object);
-    LoadP(object, FieldMemOperand(object, HeapObject::kMapOffset));
+    LoadMap(object, object);
     lbz(object, FieldMemOperand(object, Map::kBitFieldOffset));
-    andi(object, object, Operand(Map::IsConstructorBit::kMask));
+    andi(object, object, Operand(Map::Bits1::IsConstructorBit::kMask));
     pop(object);
     Check(ne, AbortReason::kOperandIsNotAConstructor, cr0);
   }
@@ -1836,7 +1779,7 @@ void MacroAssembler::AssertGeneratorObject(Register object) {
   // Load map
   Register map = object;
   push(object);
-  LoadP(map, FieldMemOperand(object, HeapObject::kMapOffset));
+  LoadMap(map, object);
 
   // Check if JSGeneratorObject
   Label do_check;
@@ -1864,7 +1807,7 @@ void MacroAssembler::AssertUndefinedOrAllocationSite(Register object,
     AssertNotSmi(object);
     CompareRoot(object, RootIndex::kUndefinedValue);
     beq(&done_checking);
-    LoadP(scratch, FieldMemOperand(object, HeapObject::kMapOffset));
+    LoadMap(scratch, object);
     CompareInstanceType(scratch, scratch, ALLOCATION_SITE_TYPE);
     Assert(eq, AbortReason::kExpectedUndefinedOrCell);
     bind(&done_checking);
@@ -1901,7 +1844,8 @@ void TurboAssembler::PrepareCallCFunction(int num_reg_arguments,
     mr(scratch, sp);
     addi(sp, sp, Operand(-(stack_passed_arguments + 1) * kPointerSize));
     DCHECK(base::bits::IsPowerOfTwo(frame_alignment));
-    ClearRightImm(sp, sp, Operand(WhichPowerOf2(frame_alignment)));
+    ClearRightImm(sp, sp,
+                  Operand(base::bits::WhichPowerOfTwo(frame_alignment)));
     StoreP(scratch, MemOperand(sp, stack_passed_arguments * kPointerSize));
   } else {
     // Make room for stack arguments
@@ -1996,6 +1940,7 @@ void TurboAssembler::CallCFunctionHelper(Register function,
     LoadP(ip, MemOperand(function, 0));
     dest = ip;
   } else if (ABI_CALL_VIA_IP) {
+    // pLinux and Simualtor, not AIX
     Move(ip, function);
     dest = ip;
   }
@@ -3090,6 +3035,8 @@ void TurboAssembler::ZeroExtWord32(Register dst, Register src) {
   clrldi(dst, src, Operand(32));
 }
 
+void TurboAssembler::Trap() { stop(); }
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/ppc/macro-assembler-ppc.h b/deps/v8/src/codegen/ppc/macro-assembler-ppc.h
index 1c88558fc4a0a3..87de0a77c8db36 100644
--- a/deps/v8/src/codegen/ppc/macro-assembler-ppc.h
+++ b/deps/v8/src/codegen/ppc/macro-assembler-ppc.h
@@ -333,8 +333,8 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
                             Register scratch);
   void PrepareCallCFunction(int num_reg_arguments, Register scratch);
 
-  void PrepareForTailCall(const ParameterCount& callee_args_count,
-                          Register caller_args_count_reg, Register scratch0,
+  void PrepareForTailCall(Register callee_args_count,
+                          Register caller_args_count, Register scratch0,
                           Register scratch1);
 
   // There are two ways of passing double arguments on ARM, depending on
@@ -351,23 +351,21 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   // return address (unless this is somehow accounted for by the called
   // function).
   void CallCFunction(ExternalReference function, int num_arguments,
-                     bool has_function_descriptor = kHasFunctionDescriptor);
+                     bool has_function_descriptor = true);
   void CallCFunction(Register function, int num_arguments,
-                     bool has_function_descriptor = kHasFunctionDescriptor);
+                     bool has_function_descriptor = true);
   void CallCFunction(ExternalReference function, int num_reg_arguments,
                      int num_double_arguments,
-                     bool has_function_descriptor = kHasFunctionDescriptor);
+                     bool has_function_descriptor = true);
   void CallCFunction(Register function, int num_reg_arguments,
                      int num_double_arguments,
-                     bool has_function_descriptor = kHasFunctionDescriptor);
-
-  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
-  // builtin for the target runtime function and uses an indirect call.
-  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
+                     bool has_function_descriptor = true);
 
   void MovFromFloatParameter(DoubleRegister dst);
   void MovFromFloatResult(DoubleRegister dst);
 
+  void Trap() override;
+
   // Calls Abort(msg) if the condition cond is not satisfied.
   // Use --debug_code to enable.
   void Assert(Condition cond, AbortReason reason, CRegister cr = cr7);
@@ -694,6 +692,8 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   void LeaveExitFrame(bool save_doubles, Register argument_count,
                       bool argument_count_is_length = false);
 
+  void LoadMap(Register destination, Register object);
+
   // Load the global proxy from the current context.
   void LoadGlobalProxy(Register dst) {
     LoadNativeContextSlot(Context::GLOBAL_PROXY_INDEX, dst);
@@ -741,27 +741,27 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
 
   // Removes current frame and its arguments from the stack preserving
   // the arguments and a return address pushed to the stack for the next call.
-  // Both |callee_args_count| and |caller_args_count_reg| do not include
-  // receiver. |callee_args_count| is not modified, |caller_args_count_reg|
+  // Both |callee_args_count| and |caller_args_countg| do not include
+  // receiver. |callee_args_count| is not modified. |caller_args_count|
   // is trashed.
 
   // Invoke the JavaScript function code by either calling or jumping.
   void InvokeFunctionCode(Register function, Register new_target,
-                          const ParameterCount& expected,
-                          const ParameterCount& actual, InvokeFlag flag);
+                          Register expected_parameter_count,
+                          Register actual_parameter_count, InvokeFlag flag);
 
   // On function call, call into the debugger if necessary.
   void CheckDebugHook(Register fun, Register new_target,
-                      const ParameterCount& expected,
-                      const ParameterCount& actual);
+                      Register expected_parameter_count,
+                      Register actual_parameter_count);
 
   // Invoke the JavaScript function in the given register. Changes the
   // current context to the context in the function before invoking.
-  void InvokeFunction(Register function, Register new_target,
-                      const ParameterCount& actual, InvokeFlag flag);
-
-  void InvokeFunction(Register function, const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
+  void InvokeFunctionWithNewTarget(Register function, Register new_target,
+                                   Register actual_parameter_count,
+                                   InvokeFlag flag);
+  void InvokeFunction(Register function, Register expected_parameter_count,
+                      Register actual_parameter_count, InvokeFlag flag);
 
   void DebugBreak();
   // Frame restart support
@@ -948,9 +948,9 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   static const int kSmiShift = kSmiTagSize + kSmiShiftSize;
 
   // Helper functions for generating invokes.
-  void InvokePrologue(const ParameterCount& expected,
-                      const ParameterCount& actual, Label* done,
-                      bool* definitely_mismatches, InvokeFlag flag);
+  void InvokePrologue(Register expected_parameter_count,
+                      Register actual_parameter_count, Label* done,
+                      InvokeFlag flag);
 
   // Compute memory operands for safepoint stack slots.
   static int SafepointRegisterStackIndex(int reg_code);
@@ -962,17 +962,6 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   DISALLOW_IMPLICIT_CONSTRUCTORS(MacroAssembler);
 };
 
-// -----------------------------------------------------------------------------
-// Static helper functions.
-
-inline MemOperand ContextMemOperand(Register context, int index = 0) {
-  return MemOperand(context, Context::SlotOffset(index));
-}
-
-inline MemOperand NativeContextMemOperand() {
-  return ContextMemOperand(cp, Context::NATIVE_CONTEXT_INDEX);
-}
-
 #define ACCESS_MASM(masm) masm->
 
 }  // namespace internal
diff --git a/deps/v8/src/codegen/ppc/register-ppc.h b/deps/v8/src/codegen/ppc/register-ppc.h
index 63a9fd803cd971..92f7632e143780 100644
--- a/deps/v8/src/codegen/ppc/register-ppc.h
+++ b/deps/v8/src/codegen/ppc/register-ppc.h
@@ -210,7 +210,7 @@ static_assert(sizeof(Register) == sizeof(int),
               "Register can efficiently be passed by value");
 
 #define DEFINE_REGISTER(R) \
-  constexpr Register R = Register::from_code<kRegCode_##R>();
+  constexpr Register R = Register::from_code(kRegCode_##R);
 GENERAL_REGISTERS(DEFINE_REGISTER)
 #undef DEFINE_REGISTER
 constexpr Register no_reg = Register::no_reg();
@@ -256,7 +256,7 @@ using FloatRegister = DoubleRegister;
 using Simd128Register = DoubleRegister;
 
 #define DEFINE_REGISTER(R) \
-  constexpr DoubleRegister R = DoubleRegister::from_code<kDoubleCode_##R>();
+  constexpr DoubleRegister R = DoubleRegister::from_code(kDoubleCode_##R);
 DOUBLE_REGISTERS(DEFINE_REGISTER)
 #undef DEFINE_REGISTER
 constexpr DoubleRegister no_dreg = DoubleRegister::no_reg();
@@ -283,7 +283,7 @@ class CRegister : public RegisterBase<CRegister, kCAfterLast> {
 
 constexpr CRegister no_creg = CRegister::no_reg();
 #define DECLARE_C_REGISTER(R) \
-  constexpr CRegister R = CRegister::from_code<kCCode_##R>();
+  constexpr CRegister R = CRegister::from_code(kCCode_##R);
 C_REGISTERS(DECLARE_C_REGISTER)
 #undef DECLARE_C_REGISTER
 
diff --git a/deps/v8/src/codegen/register.h b/deps/v8/src/codegen/register.h
index 406a423892cced..bf499668bb1640 100644
--- a/deps/v8/src/codegen/register.h
+++ b/deps/v8/src/codegen/register.h
@@ -25,70 +25,37 @@ namespace internal {
 // and best performance in optimized code.
 template <typename SubType, int kAfterLastRegister>
 class RegisterBase {
-  // Internal enum class; used for calling constexpr methods, where we need to
-  // pass an integral type as template parameter.
-  enum class RegisterCode : int { kFirst = 0, kAfterLast = kAfterLastRegister };
-
  public:
   static constexpr int kCode_no_reg = -1;
   static constexpr int kNumRegisters = kAfterLastRegister;
 
   static constexpr SubType no_reg() { return SubType{kCode_no_reg}; }
 
-  template <int code>
-  static constexpr SubType from_code() {
-    static_assert(code >= 0 && code < kNumRegisters, "must be valid reg code");
-    return SubType{code};
-  }
-
-  constexpr operator RegisterCode() const {
-    return static_cast<RegisterCode>(reg_code_);
-  }
-
-  template <RegisterCode reg_code>
-  static constexpr int code() {
-    static_assert(
-        reg_code >= RegisterCode::kFirst && reg_code < RegisterCode::kAfterLast,
-        "must be valid reg");
-    return static_cast<int>(reg_code);
-  }
-
-  template <RegisterCode reg_code>
-  static constexpr int is_valid() {
-    return static_cast<int>(reg_code) != kCode_no_reg;
-  }
-
-  template <RegisterCode reg_code>
-  static constexpr RegList bit() {
-    return is_valid<reg_code>() ? RegList{1} << code<reg_code>() : RegList{};
-  }
-
-  static SubType from_code(int code) {
+  static constexpr SubType from_code(int code) {
+#if V8_HAS_CXX14_CONSTEXPR
     DCHECK_LE(0, code);
     DCHECK_GT(kNumRegisters, code);
+#endif
     return SubType{code};
   }
 
-  // Constexpr version (pass registers as template parameters).
-  template <RegisterCode... reg_codes>
-  static constexpr RegList ListOf() {
-    return CombineRegLists(RegisterBase::bit<reg_codes>()...);
-  }
-
-  // Non-constexpr version (pass registers as method parameters).
   template <typename... Register>
-  static RegList ListOf(Register... regs) {
+  static constexpr RegList ListOf(Register... regs) {
     return CombineRegLists(regs.bit()...);
   }
 
   constexpr bool is_valid() const { return reg_code_ != kCode_no_reg; }
 
-  int code() const {
+  constexpr int code() const {
+#if V8_HAS_CXX14_CONSTEXPR
     DCHECK(is_valid());
+#endif
     return reg_code_;
   }
 
-  RegList bit() const { return is_valid() ? RegList{1} << code() : RegList{}; }
+  constexpr RegList bit() const {
+    return is_valid() ? RegList{1} << code() : RegList{};
+  }
 
   inline constexpr bool operator==(SubType other) const {
     return reg_code_ == other.reg_code_;
@@ -102,6 +69,8 @@ class RegisterBase {
 
  protected:
   explicit constexpr RegisterBase(int code) : reg_code_(code) {}
+
+ private:
   int reg_code_;
 };
 
diff --git a/deps/v8/src/codegen/reloc-info.h b/deps/v8/src/codegen/reloc-info.h
index 6e72e84f40faab..50ce001103ea0b 100644
--- a/deps/v8/src/codegen/reloc-info.h
+++ b/deps/v8/src/codegen/reloc-info.h
@@ -142,8 +142,8 @@ class RelocInfo {
     return COMPRESS_POINTERS_BOOL && mode == COMPRESSED_EMBEDDED_OBJECT;
   }
   static constexpr bool IsEmbeddedObjectMode(Mode mode) {
-    return IsInRange(mode, FIRST_EMBEDDED_OBJECT_RELOC_MODE,
-                     LAST_EMBEDDED_OBJECT_RELOC_MODE);
+    return base::IsInRange(mode, FIRST_EMBEDDED_OBJECT_RELOC_MODE,
+                           LAST_EMBEDDED_OBJECT_RELOC_MODE);
   }
   static constexpr bool IsRuntimeEntry(Mode mode) {
     return mode == RUNTIME_ENTRY;
diff --git a/deps/v8/src/codegen/s390/assembler-s390.cc b/deps/v8/src/codegen/s390/assembler-s390.cc
index 9de95ed5084bd0..88d22657128be2 100644
--- a/deps/v8/src/codegen/s390/assembler-s390.cc
+++ b/deps/v8/src/codegen/s390/assembler-s390.cc
@@ -218,6 +218,11 @@ void CpuFeatures::ProbeImpl(bool cross_compile) {
         supportsCPUFeature("vx")) {
       supported_ |= (1u << VECTOR_ENHANCE_FACILITY_1);
     }
+    // Test for Vector Enhancement Facility 2 - Bit 148
+    if (facilities[2] & (one << (63 - (148 - 128))) &&
+        supportsCPUFeature("vx")) {
+      supported_ |= (1u << VECTOR_ENHANCE_FACILITY_2);
+    }
     // Test for Miscellaneous Instruction Extension Facility - Bit 58
     if (facilities[0] & (1lu << (63 - 58))) {
       supported_ |= (1u << MISC_INSTR_EXT2);
@@ -256,6 +261,10 @@ void CpuFeatures::PrintFeatures() {
   PrintF("GENERAL_INSTR=%d\n", CpuFeatures::IsSupported(GENERAL_INSTR_EXT));
   PrintF("DISTINCT_OPS=%d\n", CpuFeatures::IsSupported(DISTINCT_OPS));
   PrintF("VECTOR_FACILITY=%d\n", CpuFeatures::IsSupported(VECTOR_FACILITY));
+  PrintF("VECTOR_ENHANCE_FACILITY_1=%d\n",
+         CpuFeatures::IsSupported(VECTOR_ENHANCE_FACILITY_1));
+  PrintF("VECTOR_ENHANCE_FACILITY_2=%d\n",
+         CpuFeatures::IsSupported(VECTOR_ENHANCE_FACILITY_2));
   PrintF("MISC_INSTR_EXT2=%d\n", CpuFeatures::IsSupported(MISC_INSTR_EXT2));
 }
 
diff --git a/deps/v8/src/codegen/s390/assembler-s390.h b/deps/v8/src/codegen/s390/assembler-s390.h
index f1a418d1afa01e..933996050cf852 100644
--- a/deps/v8/src/codegen/s390/assembler-s390.h
+++ b/deps/v8/src/codegen/s390/assembler-s390.h
@@ -1146,6 +1146,19 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   S390_VRR_E_OPCODE_LIST(DECLARE_VRR_E_INSTRUCTIONS)
 #undef DECLARE_VRR_E_INSTRUCTIONS
 
+#define DECLARE_VRR_F_INSTRUCTIONS(name, opcode_name, opcode_value)        \
+  void name(DoubleRegister v1, Register r1, Register r2) {                 \
+    uint64_t code = (static_cast<uint64_t>(opcode_value & 0xFF00)) * B32 | \
+                    (static_cast<uint64_t>(v1.code())) * B36 |             \
+                    (static_cast<uint64_t>(r1.code())) * B32 |             \
+                    (static_cast<uint64_t>(r2.code())) * B28 |             \
+                    (static_cast<uint64_t>(0)) * B8 |                      \
+                    (static_cast<uint64_t>(opcode_value & 0x00FF));        \
+    emit6bytes(code);                                                      \
+  }
+  S390_VRR_F_OPCODE_LIST(DECLARE_VRR_F_INSTRUCTIONS)
+#undef DECLARE_VRR_E_INSTRUCTIONS
+
 #define DECLARE_VRX_INSTRUCTIONS(name, opcode_name, opcode_value)       \
   void name(DoubleRegister v1, const MemOperand& opnd, Condition m3) {  \
     uint64_t code =                                                     \
@@ -1371,6 +1384,7 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   // not have to check for overflow. The same is true for writes of large
   // relocation info entries.
   static constexpr int kGap = 32;
+  STATIC_ASSERT(AssemblerBase::kMinimalBufferSize >= 2 * kGap);
 
   // Relocation info generation
   // Each relocation is encoded as a variable size value
diff --git a/deps/v8/src/codegen/s390/constants-s390.h b/deps/v8/src/codegen/s390/constants-s390.h
index 1d23294ae43152..e2a906204edc7d 100644
--- a/deps/v8/src/codegen/s390/constants-s390.h
+++ b/deps/v8/src/codegen/s390/constants-s390.h
@@ -1549,21 +1549,24 @@ using SixByteInstr = uint64_t;
   V(risbhg, RISBHG,                                                            \
     0xEC5D) /* type = RIE_F ROTATE THEN INSERT SELECTED BITS HIGH (64)  */
 
-#define S390_VRX_OPCODE_LIST(V)                                             \
-  V(vleb, VLEB, 0xE700) /* type = VRX   VECTOR LOAD ELEMENT (8)  */         \
-  V(vleh, VLEH, 0xE701) /* type = VRX   VECTOR LOAD ELEMENT (16)  */        \
-  V(vleg, VLEG, 0xE702) /* type = VRX   VECTOR LOAD ELEMENT (64)  */        \
-  V(vlef, VLEF, 0xE703) /* type = VRX   VECTOR LOAD ELEMENT (32)  */        \
-  V(vllez, VLLEZ,                                                           \
-    0xE704) /* type = VRX   VECTOR LOAD LOGICAL ELEMENT AND ZERO  */        \
-  V(vlrep, VLREP, 0xE705) /* type = VRX   VECTOR LOAD AND REPLICATE  */     \
-  V(vl, VL, 0xE706)       /* type = VRX   VECTOR LOAD  */                   \
-  V(vlbb, VLBB, 0xE707)   /* type = VRX   VECTOR LOAD TO BLOCK BOUNDARY  */ \
-  V(vsteb, VSTEB, 0xE708) /* type = VRX   VECTOR STORE ELEMENT (8)  */      \
-  V(vsteh, VSTEH, 0xE709) /* type = VRX   VECTOR STORE ELEMENT (16)  */     \
-  V(vsteg, VSTEG, 0xE70A) /* type = VRX   VECTOR STORE ELEMENT (64)  */     \
-  V(vstef, VSTEF, 0xE70B) /* type = VRX   VECTOR STORE ELEMENT (32)  */     \
-  V(vst, VST, 0xE70E)     /* type = VRX   VECTOR STORE  */
+#define S390_VRX_OPCODE_LIST(V)                                               \
+  V(vleb, VLEB, 0xE700) /* type = VRX   VECTOR LOAD ELEMENT (8)  */           \
+  V(vleh, VLEH, 0xE701) /* type = VRX   VECTOR LOAD ELEMENT (16)  */          \
+  V(vleg, VLEG, 0xE702) /* type = VRX   VECTOR LOAD ELEMENT (64)  */          \
+  V(vlef, VLEF, 0xE703) /* type = VRX   VECTOR LOAD ELEMENT (32)  */          \
+  V(vllez, VLLEZ,                                                             \
+    0xE704) /* type = VRX   VECTOR LOAD LOGICAL ELEMENT AND ZERO  */          \
+  V(vlrep, VLREP, 0xE705) /* type = VRX   VECTOR LOAD AND REPLICATE  */       \
+  V(vl, VL, 0xE706)       /* type = VRX   VECTOR LOAD  */                     \
+  V(vlbb, VLBB, 0xE707)   /* type = VRX   VECTOR LOAD TO BLOCK BOUNDARY  */   \
+  V(vsteb, VSTEB, 0xE708) /* type = VRX   VECTOR STORE ELEMENT (8)  */        \
+  V(vsteh, VSTEH, 0xE709) /* type = VRX   VECTOR STORE ELEMENT (16)  */       \
+  V(vsteg, VSTEG, 0xE70A) /* type = VRX   VECTOR STORE ELEMENT (64)  */       \
+  V(vstef, VSTEF, 0xE70B) /* type = VRX   VECTOR STORE ELEMENT (32)  */       \
+  V(vst, VST, 0xE70E)     /* type = VRX   VECTOR STORE  */                    \
+  V(vlbr, VLBR, 0xE606) /* type = VRX   VECTOR LOAD BYTE REVERSED ELEMENTS */ \
+  V(vstbr, VSTBR, 0xE60E) /* type = VRX   VECTOR STORE BYTE REVERSED ELEMENTS \
+                           */
 
 #define S390_RIE_G_OPCODE_LIST(V)                                             \
   V(lochi, LOCHI,                                                             \
diff --git a/deps/v8/src/codegen/s390/macro-assembler-s390.cc b/deps/v8/src/codegen/s390/macro-assembler-s390.cc
index b3748332f48ece..c540a5773bb7ef 100644
--- a/deps/v8/src/codegen/s390/macro-assembler-s390.cc
+++ b/deps/v8/src/codegen/s390/macro-assembler-s390.cc
@@ -253,6 +253,7 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
     Call(ip);
     return;
   }
+  DCHECK(code->IsExecutable());
   call(code, rmode);
 }
 
@@ -287,21 +288,23 @@ void TurboAssembler::Push(Smi smi) {
 }
 
 void TurboAssembler::Move(Register dst, Handle<HeapObject> value) {
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadConstant(dst, value);
-      return;
-    }
+  // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+  // non-isolate-independent code. In many cases it might be cheaper than
+  // embedding the relocatable value.
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadConstant(dst, value);
+    return;
   }
   mov(dst, Operand(value));
 }
 
 void TurboAssembler::Move(Register dst, ExternalReference reference) {
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadExternalReference(dst, reference);
-      return;
-    }
+  // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+  // non-isolate-independent code. In many cases it might be cheaper than
+  // embedding the relocatable value.
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadExternalReference(dst, reference);
+    return;
   }
   mov(dst, Operand(reference));
 }
@@ -1199,39 +1202,25 @@ void TurboAssembler::MovFromFloatParameter(const DoubleRegister dst) {
   Move(dst, d0);
 }
 
-void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
-                                        Register caller_args_count_reg,
+void TurboAssembler::PrepareForTailCall(Register callee_args_count,
+                                        Register caller_args_count,
                                         Register scratch0, Register scratch1) {
-#if DEBUG
-  if (callee_args_count.is_reg()) {
-    DCHECK(!AreAliased(callee_args_count.reg(), caller_args_count_reg, scratch0,
-                       scratch1));
-  } else {
-    DCHECK(!AreAliased(caller_args_count_reg, scratch0, scratch1));
-  }
-#endif
+  DCHECK(!AreAliased(callee_args_count, caller_args_count, scratch0, scratch1));
 
   // Calculate the end of destination area where we will put the arguments
   // after we drop current frame. We AddP kSystemPointerSize to count the
   // receiver argument which is not included into formal parameters count.
   Register dst_reg = scratch0;
-  ShiftLeftP(dst_reg, caller_args_count_reg, Operand(kSystemPointerSizeLog2));
+  ShiftLeftP(dst_reg, caller_args_count, Operand(kSystemPointerSizeLog2));
   AddP(dst_reg, fp, dst_reg);
   AddP(dst_reg, dst_reg,
        Operand(StandardFrameConstants::kCallerSPOffset + kSystemPointerSize));
 
-  Register src_reg = caller_args_count_reg;
+  Register src_reg = caller_args_count;
   // Calculate the end of source area. +kSystemPointerSize is for the receiver.
-  if (callee_args_count.is_reg()) {
-    ShiftLeftP(src_reg, callee_args_count.reg(),
-               Operand(kSystemPointerSizeLog2));
-    AddP(src_reg, sp, src_reg);
-    AddP(src_reg, src_reg, Operand(kSystemPointerSize));
-  } else {
-    mov(src_reg,
-        Operand((callee_args_count.immediate() + 1) * kSystemPointerSize));
-    AddP(src_reg, src_reg, sp);
-  }
+  ShiftLeftP(src_reg, callee_args_count, Operand(kSystemPointerSizeLog2));
+  AddP(src_reg, sp, src_reg);
+  AddP(src_reg, src_reg, Operand(kSystemPointerSize));
 
   if (FLAG_debug_code) {
     CmpLogicalP(src_reg, dst_reg);
@@ -1249,11 +1238,7 @@ void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
   // so they must be pre-decremented in the loop.
   Register tmp_reg = scratch1;
   Label loop;
-  if (callee_args_count.is_reg()) {
-    AddP(tmp_reg, callee_args_count.reg(), Operand(1));  // +1 for receiver
-  } else {
-    mov(tmp_reg, Operand(callee_args_count.immediate() + 1));
-  }
+  AddP(tmp_reg, callee_args_count, Operand(1));  // +1 for receiver
   LoadRR(r1, tmp_reg);
   bind(&loop);
   LoadP(tmp_reg, MemOperand(src_reg, -kSystemPointerSize));
@@ -1266,12 +1251,9 @@ void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
   LoadRR(sp, dst_reg);
 }
 
-void MacroAssembler::InvokePrologue(const ParameterCount& expected,
-                                    const ParameterCount& actual, Label* done,
-                                    bool* definitely_mismatches,
-                                    InvokeFlag flag) {
-  bool definitely_matches = false;
-  *definitely_mismatches = false;
+void MacroAssembler::InvokePrologue(Register expected_parameter_count,
+                                    Register actual_parameter_count,
+                                    Label* done, InvokeFlag flag) {
   Label regular_invoke;
 
   // Check whether the expected and actual arguments count match. If not,
@@ -1281,59 +1263,27 @@ void MacroAssembler::InvokePrologue(const ParameterCount& expected,
   //  r4: expected arguments count
 
   // The code below is made a lot easier because the calling code already sets
-  // up actual and expected registers according to the contract if values are
-  // passed in registers.
-
+  // up actual and expected registers according to the contract.
   // ARM has some sanity checks as per below, considering add them for S390
-  DCHECK(actual.is_immediate() || actual.reg() == r2);
-  DCHECK(expected.is_immediate() || expected.reg() == r4);
-
-  if (expected.is_immediate()) {
-    DCHECK(actual.is_immediate());
-    mov(r2, Operand(actual.immediate()));
-    if (expected.immediate() == actual.immediate()) {
-      definitely_matches = true;
-    } else {
-      const int sentinel = SharedFunctionInfo::kDontAdaptArgumentsSentinel;
-      if (expected.immediate() == sentinel) {
-        // Don't worry about adapting arguments for builtins that
-        // don't want that done. Skip adaption code by making it look
-        // like we have a match between expected and actual number of
-        // arguments.
-        definitely_matches = true;
-      } else {
-        *definitely_mismatches = true;
-        mov(r4, Operand(expected.immediate()));
-      }
-    }
+  DCHECK_EQ(actual_parameter_count, r2);
+  DCHECK_EQ(expected_parameter_count, r4);
+
+  CmpP(expected_parameter_count, actual_parameter_count);
+  beq(&regular_invoke);
+
+  Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
+  if (flag == CALL_FUNCTION) {
+    Call(adaptor);
+    b(done);
   } else {
-    if (actual.is_immediate()) {
-      mov(r2, Operand(actual.immediate()));
-      CmpPH(expected.reg(), Operand(actual.immediate()));
-      beq(&regular_invoke);
-    } else {
-      CmpP(expected.reg(), actual.reg());
-      beq(&regular_invoke);
-    }
+    Jump(adaptor, RelocInfo::CODE_TARGET);
   }
-
-  if (!definitely_matches) {
-    Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
-    if (flag == CALL_FUNCTION) {
-      Call(adaptor);
-      if (!*definitely_mismatches) {
-        b(done);
-      }
-    } else {
-      Jump(adaptor, RelocInfo::CODE_TARGET);
-    }
     bind(&regular_invoke);
-  }
 }
 
 void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual) {
+                                    Register expected_parameter_count,
+                                    Register actual_parameter_count) {
   Label skip_hook;
 
   ExternalReference debug_hook_active =
@@ -1344,23 +1294,17 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
 
   {
     // Load receiver to pass it later to DebugOnFunctionCall hook.
-    if (actual.is_reg()) {
-      ShiftLeftP(r6, actual.reg(), Operand(kSystemPointerSizeLog2));
-      LoadP(r6, MemOperand(sp, r6));
-    } else {
-      LoadP(r6, MemOperand(sp, actual.immediate() << kSystemPointerSizeLog2),
-            ip);
-    }
+    ShiftLeftP(r6, actual_parameter_count, Operand(kSystemPointerSizeLog2));
+    LoadP(r6, MemOperand(sp, r6));
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
-    if (expected.is_reg()) {
-      SmiTag(expected.reg());
-      Push(expected.reg());
-    }
-    if (actual.is_reg()) {
-      SmiTag(actual.reg());
-      Push(actual.reg());
-    }
+
+    SmiTag(expected_parameter_count);
+    Push(expected_parameter_count);
+
+    SmiTag(actual_parameter_count);
+    Push(actual_parameter_count);
+
     if (new_target.is_valid()) {
       Push(new_target);
     }
@@ -1370,30 +1314,28 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
     if (new_target.is_valid()) {
       Pop(new_target);
     }
-    if (actual.is_reg()) {
-      Pop(actual.reg());
-      SmiUntag(actual.reg());
-    }
-    if (expected.is_reg()) {
-      Pop(expected.reg());
-      SmiUntag(expected.reg());
-    }
+
+    Pop(actual_parameter_count);
+    SmiUntag(actual_parameter_count);
+
+    Pop(expected_parameter_count);
+    SmiUntag(expected_parameter_count);
   }
   bind(&skip_hook);
 }
 
 void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
-                                        const ParameterCount& expected,
-                                        const ParameterCount& actual,
+                                        Register expected_parameter_count,
+                                        Register actual_parameter_count,
                                         InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
-
-  DCHECK(function == r3);
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
+  DCHECK_EQ(function, r3);
   DCHECK_IMPLIES(new_target.is_valid(), new_target == r5);
 
   // On function call, call into the debugger if necessary.
-  CheckDebugHook(function, new_target, expected, actual);
+  CheckDebugHook(function, new_target, expected_parameter_count,
+                 actual_parameter_count);
 
   // Clear the new.target register if not given.
   if (!new_target.is_valid()) {
@@ -1401,35 +1343,32 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
   }
 
   Label done;
-  bool definitely_mismatches = false;
-  InvokePrologue(expected, actual, &done, &definitely_mismatches, flag);
-  if (!definitely_mismatches) {
-    // We call indirectly through the code field in the function to
-    // allow recompilation to take effect without changing any of the
-    // call sites.
-    Register code = kJavaScriptCallCodeStartRegister;
-    LoadP(code, FieldMemOperand(function, JSFunction::kCodeOffset));
-    if (flag == CALL_FUNCTION) {
-      CallCodeObject(code);
-    } else {
-      DCHECK(flag == JUMP_FUNCTION);
-      JumpCodeObject(code);
-    }
+  InvokePrologue(expected_parameter_count, actual_parameter_count, &done, flag);
+  // We call indirectly through the code field in the function to
+  // allow recompilation to take effect without changing any of the
+  // call sites.
+  Register code = kJavaScriptCallCodeStartRegister;
+  LoadP(code, FieldMemOperand(function, JSFunction::kCodeOffset));
+  if (flag == CALL_FUNCTION) {
+    CallCodeObject(code);
+  } else {
+    DCHECK(flag == JUMP_FUNCTION);
+    JumpCodeObject(code);
+  }
 
     // Continue here if InvokePrologue does handle the invocation due to
     // mismatched parameter counts.
     bind(&done);
-  }
 }
 
-void MacroAssembler::InvokeFunction(Register fun, Register new_target,
-                                    const ParameterCount& actual,
-                                    InvokeFlag flag) {
+void MacroAssembler::InvokeFunctionWithNewTarget(
+    Register fun, Register new_target, Register actual_parameter_count,
+    InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
 
   // Contract with called JS functions requires that function is passed in r3.
-  DCHECK(fun == r3);
+  DCHECK_EQ(fun, r3);
 
   Register expected_reg = r4;
   Register temp_reg = r6;
@@ -1440,24 +1379,25 @@ void MacroAssembler::InvokeFunction(Register fun, Register new_target,
       FieldMemOperand(temp_reg,
                       SharedFunctionInfo::kFormalParameterCountOffset));
 
-  ParameterCount expected(expected_reg);
-  InvokeFunctionCode(fun, new_target, expected, actual, flag);
+  InvokeFunctionCode(fun, new_target, expected_reg, actual_parameter_count,
+                     flag);
 }
 
 void MacroAssembler::InvokeFunction(Register function,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
+                                    Register expected_parameter_count,
+                                    Register actual_parameter_count,
                                     InvokeFlag flag) {
   // You can't call a function without a valid frame.
-  DCHECK(flag == JUMP_FUNCTION || has_frame());
+  DCHECK_IMPLIES(flag == CALL_FUNCTION, has_frame());
 
   // Contract with called JS functions requires that function is passed in r3.
-  DCHECK(function == r3);
+  DCHECK_EQ(function, r3);
 
   // Get the function and setup the context.
   LoadP(cp, FieldMemOperand(r3, JSFunction::kContextOffset));
 
-  InvokeFunctionCode(r3, no_reg, expected, actual, flag);
+  InvokeFunctionCode(r3, no_reg, expected_parameter_count,
+                     actual_parameter_count, flag);
 }
 
 void MacroAssembler::MaybeDropFrames() {
@@ -1511,7 +1451,7 @@ void MacroAssembler::CompareObjectType(Register object, Register map,
                                        Register type_reg, InstanceType type) {
   const Register temp = type_reg == no_reg ? r0 : type_reg;
 
-  LoadP(map, FieldMemOperand(object, HeapObject::kMapOffset));
+  LoadMap(map, object);
   CompareInstanceType(map, temp, type);
 }
 
@@ -1578,15 +1518,6 @@ void TurboAssembler::TryInlineTruncateDoubleToI(Register result,
   beq(done);
 }
 
-void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
-                                           Register centry) {
-  const Runtime::Function* f = Runtime::FunctionForId(fid);
-  mov(r2, Operand(f->nargs));
-  Move(r3, ExternalReference::Create(f));
-  DCHECK(!AreAliased(centry, r2, r3));
-  CallCodeObject(centry);
-}
-
 void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
                                  SaveFPRegsMode save_doubles) {
   // All parameters are on the stack.  r2 has the return value after call.
@@ -1719,9 +1650,15 @@ void TurboAssembler::Abort(AbortReason reason) {
   // will not return here
 }
 
+void MacroAssembler::LoadMap(Register destination, Register object) {
+  LoadP(destination, FieldMemOperand(object, HeapObject::kMapOffset));
+}
+
 void MacroAssembler::LoadNativeContextSlot(int index, Register dst) {
-  LoadP(dst, NativeContextMemOperand());
-  LoadP(dst, ContextMemOperand(dst, index));
+  LoadMap(dst, cp);
+  LoadP(dst, FieldMemOperand(
+                 dst, Map::kConstructorOrBackPointerOrNativeContextOffset));
+  LoadP(dst, MemOperand(dst, Context::SlotOffset(index)));
 }
 
 void MacroAssembler::AssertNotSmi(Register object) {
@@ -1745,9 +1682,9 @@ void MacroAssembler::AssertConstructor(Register object, Register scratch) {
     STATIC_ASSERT(kSmiTag == 0);
     TestIfSmi(object);
     Check(ne, AbortReason::kOperandIsASmiAndNotAConstructor);
-    LoadP(scratch, FieldMemOperand(object, HeapObject::kMapOffset));
+    LoadMap(scratch, object);
     tm(FieldMemOperand(scratch, Map::kBitFieldOffset),
-       Operand(Map::IsConstructorBit::kMask));
+       Operand(Map::Bits1::IsConstructorBit::kMask));
     Check(ne, AbortReason::kOperandIsNotAConstructor);
   }
 }
@@ -1784,7 +1721,7 @@ void MacroAssembler::AssertGeneratorObject(Register object) {
   // Load map
   Register map = object;
   push(object);
-  LoadP(map, FieldMemOperand(object, HeapObject::kMapOffset));
+  LoadMap(map, object);
 
   // Check if JSGeneratorObject
   Label do_check;
@@ -1812,7 +1749,7 @@ void MacroAssembler::AssertUndefinedOrAllocationSite(Register object,
     AssertNotSmi(object);
     CompareRoot(object, RootIndex::kUndefinedValue);
     beq(&done_checking, Label::kNear);
-    LoadP(scratch, FieldMemOperand(object, HeapObject::kMapOffset));
+    LoadMap(scratch, object);
     CompareInstanceType(scratch, scratch, ALLOCATION_SITE_TYPE);
     Assert(eq, AbortReason::kExpectedUndefinedOrCell);
     bind(&done_checking);
@@ -1848,7 +1785,8 @@ void TurboAssembler::PrepareCallCFunction(int num_reg_arguments,
     LoadRR(scratch, sp);
     lay(sp, MemOperand(sp, -(stack_passed_arguments + 1) * kSystemPointerSize));
     DCHECK(base::bits::IsPowerOfTwo(frame_alignment));
-    ClearRightImm(sp, sp, Operand(WhichPowerOf2(frame_alignment)));
+    ClearRightImm(sp, sp,
+                  Operand(base::bits::WhichPowerOfTwo(frame_alignment)));
     StoreP(scratch,
            MemOperand(sp, (stack_passed_arguments)*kSystemPointerSize));
   } else {
@@ -4453,6 +4391,8 @@ void TurboAssembler::CallForDeoptimization(Address target, int deopt_id) {
   Call(target, RelocInfo::RUNTIME_ENTRY);
 }
 
+void TurboAssembler::Trap() { stop(); }
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/s390/macro-assembler-s390.h b/deps/v8/src/codegen/s390/macro-assembler-s390.h
index 06c26cb305f984..d0d6ca6c06b8b5 100644
--- a/deps/v8/src/codegen/s390/macro-assembler-s390.h
+++ b/deps/v8/src/codegen/s390/macro-assembler-s390.h
@@ -804,17 +804,13 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 #endif
   }
 
-  void PrepareForTailCall(const ParameterCount& callee_args_count,
-                          Register caller_args_count_reg, Register scratch0,
+  void PrepareForTailCall(Register callee_args_count,
+                          Register caller_args_count, Register scratch0,
                           Register scratch1);
 
   // ---------------------------------------------------------------------------
   // Runtime calls
 
-  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
-  // builtin for the target runtime function and uses an indirect call.
-  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
-
   // Before calling a C-function from generated code, align arguments on stack.
   // After aligning the frame, non-register arguments must be stored in
   // sp[0], sp[4], etc., not pushed. The argument count assumes all arguments
@@ -852,6 +848,8 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void MovFromFloatParameter(DoubleRegister dst);
   void MovFromFloatResult(DoubleRegister dst);
 
+  void Trap() override;
+
   // Emit code for a truncating division by a constant. The dividend register is
   // unchanged and ip gets clobbered. Dividend and result must be different.
   void TruncateDoubleToI(Isolate* isolate, Zone* zone, Register result,
@@ -1119,27 +1117,27 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
 
   // Removes current frame and its arguments from the stack preserving
   // the arguments and a return address pushed to the stack for the next call.
-  // Both |callee_args_count| and |caller_args_count_reg| do not include
-  // receiver. |callee_args_count| is not modified, |caller_args_count_reg|
+  // Both |callee_args_count| and |caller_args_count| do not include
+  // receiver. |callee_args_count| is not modified. |caller_args_count|
   // is trashed.
 
   // Invoke the JavaScript function code by either calling or jumping.
   void InvokeFunctionCode(Register function, Register new_target,
-                          const ParameterCount& expected,
-                          const ParameterCount& actual, InvokeFlag flag);
+                          Register expected_parameter_count,
+                          Register actual_parameter_count, InvokeFlag flag);
 
   // On function call, call into the debugger if necessary.
   void CheckDebugHook(Register fun, Register new_target,
-                      const ParameterCount& expected,
-                      const ParameterCount& actual);
+                      Register expected_parameter_count,
+                      Register actual_parameter_count);
 
   // Invoke the JavaScript function in the given register. Changes the
   // current context to the context in the function before invoking.
-  void InvokeFunction(Register function, Register new_target,
-                      const ParameterCount& actual, InvokeFlag flag);
-
-  void InvokeFunction(Register function, const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
+  void InvokeFunctionWithNewTarget(Register function, Register new_target,
+                                   Register actual_parameter_count,
+                                   InvokeFlag flag);
+  void InvokeFunction(Register function, Register expected_parameter_count,
+                      Register actual_parameter_count, InvokeFlag flag);
 
   // Frame restart support
   void MaybeDropFrames();
@@ -1165,6 +1163,8 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   void LeaveExitFrame(bool save_doubles, Register argument_count,
                       bool argument_count_is_length = false);
 
+  void LoadMap(Register destination, Register object);
+
   // Load the global proxy from the current context.
   void LoadGlobalProxy(Register dst) {
     LoadNativeContextSlot(Context::GLOBAL_PROXY_INDEX, dst);
@@ -1274,9 +1274,9 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
  private:
   static const int kSmiShift = kSmiTagSize + kSmiShiftSize;
   // Helper functions for generating invokes.
-  void InvokePrologue(const ParameterCount& expected,
-                      const ParameterCount& actual, Label* done,
-                      bool* definitely_mismatches, InvokeFlag flag);
+  void InvokePrologue(Register expected_parameter_count,
+                      Register actual_parameter_count, Label* done,
+                      InvokeFlag flag);
 
   // Compute memory operands for safepoint stack slots.
   static int SafepointRegisterStackIndex(int reg_code);
@@ -1288,17 +1288,6 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   DISALLOW_IMPLICIT_CONSTRUCTORS(MacroAssembler);
 };
 
-// -----------------------------------------------------------------------------
-// Static helper functions.
-
-inline MemOperand ContextMemOperand(Register context, int index = 0) {
-  return MemOperand(context, Context::SlotOffset(index));
-}
-
-inline MemOperand NativeContextMemOperand() {
-  return ContextMemOperand(cp, Context::NATIVE_CONTEXT_INDEX);
-}
-
 #define ACCESS_MASM(masm) masm->
 
 }  // namespace internal
diff --git a/deps/v8/src/codegen/s390/register-s390.h b/deps/v8/src/codegen/s390/register-s390.h
index ccb35fcb6808f9..dddd16d89c984b 100644
--- a/deps/v8/src/codegen/s390/register-s390.h
+++ b/deps/v8/src/codegen/s390/register-s390.h
@@ -170,7 +170,7 @@ static_assert(sizeof(Register) == sizeof(int),
               "Register can efficiently be passed by value");
 
 #define DEFINE_REGISTER(R) \
-  constexpr Register R = Register::from_code<kRegCode_##R>();
+  constexpr Register R = Register::from_code(kRegCode_##R);
 GENERAL_REGISTERS(DEFINE_REGISTER)
 #undef DEFINE_REGISTER
 constexpr Register no_reg = Register::no_reg();
@@ -216,7 +216,7 @@ using FloatRegister = DoubleRegister;
 using Simd128Register = DoubleRegister;
 
 #define DEFINE_REGISTER(R) \
-  constexpr DoubleRegister R = DoubleRegister::from_code<kDoubleCode_##R>();
+  constexpr DoubleRegister R = DoubleRegister::from_code(kDoubleCode_##R);
 DOUBLE_REGISTERS(DEFINE_REGISTER)
 #undef DEFINE_REGISTER
 constexpr DoubleRegister no_dreg = DoubleRegister::no_reg();
@@ -241,7 +241,7 @@ class CRegister : public RegisterBase<CRegister, kCAfterLast> {
 
 constexpr CRegister no_creg = CRegister::no_reg();
 #define DECLARE_C_REGISTER(R) \
-  constexpr CRegister R = CRegister::from_code<kCCode_##R>();
+  constexpr CRegister R = CRegister::from_code(kCCode_##R);
 C_REGISTERS(DECLARE_C_REGISTER)
 #undef DECLARE_C_REGISTER
 
diff --git a/deps/v8/src/codegen/source-position-table.cc b/deps/v8/src/codegen/source-position-table.cc
index ba8e5981f06fb2..b0c9d95456e0d1 100644
--- a/deps/v8/src/codegen/source-position-table.cc
+++ b/deps/v8/src/codegen/source-position-table.cc
@@ -27,8 +27,8 @@ namespace internal {
 namespace {
 
 // Each byte is encoded as MoreBit | ValueBits.
-using MoreBit = BitField8<bool, 7, 1>;
-using ValueBits = BitField8<unsigned, 0, 7>;
+using MoreBit = base::BitField8<bool, 7, 1>;
+using ValueBits = base::BitField8<unsigned, 0, 7>;
 
 // Helper: Add the offsets from 'other' to 'value'. Also set is_statement.
 void AddAndSetEntry(PositionTableEntry* value,
diff --git a/deps/v8/src/codegen/source-position-table.h b/deps/v8/src/codegen/source-position-table.h
index e4e506a114982b..b3bba3bc8aae4f 100644
--- a/deps/v8/src/codegen/source-position-table.h
+++ b/deps/v8/src/codegen/source-position-table.h
@@ -9,6 +9,7 @@
 #include "src/common/assert-scope.h"
 #include "src/common/checks.h"
 #include "src/common/globals.h"
+#include "src/utils/vector.h"
 #include "src/zone/zone-containers.h"
 
 namespace v8 {
diff --git a/deps/v8/src/codegen/source-position.h b/deps/v8/src/codegen/source-position.h
index ad0132b827e8a5..0db12aea22c1b5 100644
--- a/deps/v8/src/codegen/source-position.h
+++ b/deps/v8/src/codegen/source-position.h
@@ -7,10 +7,10 @@
 
 #include <ostream>
 
+#include "src/base/bit-field.h"
 #include "src/common/globals.h"
 #include "src/flags/flags.h"
 #include "src/handles/handles.h"
-#include "src/utils/utils.h"
 
 namespace v8 {
 namespace internal {
@@ -142,18 +142,18 @@ class SourcePosition final {
 
   void Print(std::ostream& out, SharedFunctionInfo function) const;
 
-  using IsExternalField = BitField64<bool, 0, 1>;
+  using IsExternalField = base::BitField64<bool, 0, 1>;
 
   // The two below are only used if IsExternal() is true.
-  using ExternalLineField = BitField64<int, 1, 20>;
-  using ExternalFileIdField = BitField64<int, 21, 10>;
+  using ExternalLineField = base::BitField64<int, 1, 20>;
+  using ExternalFileIdField = base::BitField64<int, 21, 10>;
 
   // ScriptOffsetField is only used if IsExternal() is false.
-  using ScriptOffsetField = BitField64<int, 1, 30>;
+  using ScriptOffsetField = base::BitField64<int, 1, 30>;
 
   // InliningId is in the high bits for better compression in
   // SourcePositionTable.
-  using InliningIdField = BitField64<int, 31, 16>;
+  using InliningIdField = base::BitField64<int, 31, 16>;
 
   // Leaving the highest bit untouched to allow for signed conversion.
   uint64_t value_;
diff --git a/deps/v8/src/codegen/string-constants.cc b/deps/v8/src/codegen/string-constants.cc
index 2553789d7c18d2..92a5e97396248b 100644
--- a/deps/v8/src/codegen/string-constants.cc
+++ b/deps/v8/src/codegen/string-constants.cc
@@ -22,6 +22,7 @@ Handle<String> StringConstantBase::AllocateStringConstant(
   switch (kind()) {
     case StringConstantKind::kStringLiteral: {
       result = static_cast<const StringLiteral*>(this)->str();
+      CHECK(!result.is_null());
       break;
     }
     case StringConstantKind::kNumberToStringConstant: {
@@ -29,6 +30,7 @@ Handle<String> StringConstantBase::AllocateStringConstant(
       Handle<Object> num_obj =
           isolate->factory()->NewNumber(num_constant->num());
       result = isolate->factory()->NumberToString(num_obj);
+      CHECK(!result.is_null());
       break;
     }
     case StringConstantKind::kStringCons: {
diff --git a/deps/v8/src/codegen/tnode.cc b/deps/v8/src/codegen/tnode.cc
new file mode 100644
index 00000000000000..07b4d15b5133a4
--- /dev/null
+++ b/deps/v8/src/codegen/tnode.cc
@@ -0,0 +1,13 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/codegen/tnode.h"
+
+namespace v8 {
+namespace internal {
+
+constexpr MachineType MachineTypeOf<ExternalReference>::value;
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/codegen/tnode.h b/deps/v8/src/codegen/tnode.h
index 1f6c627929b11e..64a4272d17f55a 100644
--- a/deps/v8/src/codegen/tnode.h
+++ b/deps/v8/src/codegen/tnode.h
@@ -26,8 +26,7 @@ struct IntegralT : UntaggedT {};
 
 struct WordT : IntegralT {
   static const MachineRepresentation kMachineRepresentation =
-      (kSystemPointerSize == 4) ? MachineRepresentation::kWord32
-                                : MachineRepresentation::kWord64;
+      MachineType::PointerRepresentation();
 };
 
 struct RawPtrT : WordT {
@@ -137,6 +136,10 @@ struct MachineTypeOf<HeapObjectSubtype,
                          HeapObject, HeapObjectSubtype>::value>::type> {
   static constexpr MachineType value = MachineType::TaggedPointer();
 };
+template <>
+struct MachineTypeOf<ExternalReference> {
+  static constexpr MachineType value = MachineType::Pointer();
+};
 
 template <class HeapObjectSubtype>
 constexpr MachineType MachineTypeOf<
@@ -147,6 +150,12 @@ template <class Type, class Enable = void>
 struct MachineRepresentationOf {
   static const MachineRepresentation value = Type::kMachineRepresentation;
 };
+// If T defines kMachineType, then we take the machine representation from
+// there.
+template <class T>
+struct MachineRepresentationOf<T, base::void_t<decltype(T::kMachineType)>> {
+  static const MachineRepresentation value = T::kMachineType.representation();
+};
 template <class T>
 struct MachineRepresentationOf<
     T, typename std::enable_if<std::is_base_of<Object, T>::value>::type> {
@@ -164,6 +173,11 @@ struct MachineRepresentationOf<ExternalReference> {
   static const MachineRepresentation value = RawPtrT::kMachineRepresentation;
 };
 
+template <typename T>
+constexpr bool IsMachineRepresentationOf(MachineRepresentation r) {
+  return MachineRepresentationOf<T>::value == r;
+}
+
 template <class T>
 struct is_valid_type_tag {
   static const bool value = std::is_base_of<Object, T>::value ||
@@ -231,7 +245,9 @@ class int31_t {
 
 template <class T, class U>
 struct is_subtype {
-  static const bool value = std::is_base_of<U, T>::value;
+  static const bool value =
+      std::is_base_of<U, T>::value || (std::is_same<U, MaybeObject>::value &&
+                                       std::is_convertible<T, Object>::value);
 };
 template <class T1, class T2, class U>
 struct is_subtype<UnionT<T1, T2>, U> {
@@ -301,19 +317,11 @@ struct types_have_common_values<UnionT<T1, T2>, UnionT<U1, U2>> {
                             types_have_common_values<T2, U2>::value;
 };
 
-template <class T>
-struct types_have_common_values<T, MaybeObject> {
-  static const bool value = types_have_common_values<T, Object>::value;
-};
-
-template <class T>
-struct types_have_common_values<MaybeObject, T> {
-  static const bool value = types_have_common_values<Object, T>::value;
-};
-
 // TNode<T> is an SSA value with the static type tag T, which is one of the
 // following:
-//   - a subclass of internal::Object represents a tagged type
+//   - MaybeObject represents the type of all tagged values, including weak
+//     pointers.
+//   - a subclass of internal::Object represents a non-weak tagged type.
 //   - a subclass of internal::UntaggedT represents an untagged type
 //   - ExternalReference
 //   - PairT<T1, T2> for an operation returning two values, with types T1
diff --git a/deps/v8/src/codegen/turbo-assembler.h b/deps/v8/src/codegen/turbo-assembler.h
index 6e11ad5c3fbf69..bb38eb55547291 100644
--- a/deps/v8/src/codegen/turbo-assembler.h
+++ b/deps/v8/src/codegen/turbo-assembler.h
@@ -85,6 +85,8 @@ class V8_EXPORT_PRIVATE TurboAssemblerBase : public Assembler {
 
   virtual void LoadRoot(Register destination, RootIndex index) = 0;
 
+  virtual void Trap() = 0;
+
   static int32_t RootRegisterOffsetForRootIndex(RootIndex root_index);
   static int32_t RootRegisterOffsetForBuiltinIndex(int builtin_index);
 
diff --git a/deps/v8/src/codegen/x64/assembler-x64-inl.h b/deps/v8/src/codegen/x64/assembler-x64-inl.h
index d8457d9d3e38a0..fedff2b0f1d0d5 100644
--- a/deps/v8/src/codegen/x64/assembler-x64-inl.h
+++ b/deps/v8/src/codegen/x64/assembler-x64-inl.h
@@ -142,6 +142,22 @@ void Assembler::emit_optional_rex_32(Operand op) {
   if (op.data().rex != 0) emit(0x40 | op.data().rex);
 }
 
+void Assembler::emit_optional_rex_8(Register reg) {
+  if (!reg.is_byte_register()) {
+    // Register is not one of al, bl, cl, dl.  Its encoding needs REX.
+    emit_rex_32(reg);
+  }
+}
+
+void Assembler::emit_optional_rex_8(Register reg, Operand op) {
+  if (!reg.is_byte_register()) {
+    // Register is not one of al, bl, cl, dl.  Its encoding needs REX.
+    emit_rex_32(reg, op);
+  } else {
+    emit_optional_rex_32(reg, op);
+  }
+}
+
 // byte 1 of 3-byte VEX
 void Assembler::emit_vex3_byte1(XMMRegister reg, XMMRegister rm,
                                 LeadingOpcode m) {
diff --git a/deps/v8/src/codegen/x64/assembler-x64.cc b/deps/v8/src/codegen/x64/assembler-x64.cc
index 16791a6453926d..a058cbb24e3c8f 100644
--- a/deps/v8/src/codegen/x64/assembler-x64.cc
+++ b/deps/v8/src/codegen/x64/assembler-x64.cc
@@ -1023,24 +1023,6 @@ void Assembler::bsfq(Register dst, Operand src) {
   emit_operand(dst, src);
 }
 
-void Assembler::pshufw(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x70);
-  emit_sse_operand(dst, src);
-  emit(shuffle);
-}
-
-void Assembler::pshufw(XMMRegister dst, Operand src, uint8_t shuffle) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x70);
-  emit_operand(dst.code(), src);
-  emit(shuffle);
-}
-
 void Assembler::pblendw(XMMRegister dst, Operand src, uint8_t mask) {
   sse4_instr(dst, src, 0x66, 0x0F, 0x3A, 0x0E);
   emit(mask);
@@ -1090,6 +1072,7 @@ void Assembler::call(Address entry, RelocInfo::Mode rmode) {
 
 void Assembler::call(Handle<Code> target, RelocInfo::Mode rmode) {
   DCHECK(RelocInfo::IsCodeTarget(rmode));
+  DCHECK(target->IsExecutable());
   EnsureSpace ensure_space(this);
   // 1110 1000 #32-bit disp.
   emit(0xE8);
@@ -1130,20 +1113,6 @@ void Assembler::call(Operand op) {
   emit_operand(0x2, op);
 }
 
-// Calls directly to the given address using a relative offset.
-// Should only ever be used in Code objects for calls within the
-// same Code object. Should not be used when generating new code (use labels),
-// but only when patching existing code.
-void Assembler::call(Address target) {
-  EnsureSpace ensure_space(this);
-  // 1110 1000 #32-bit disp.
-  emit(0xE8);
-  Address source = reinterpret_cast<Address>(pc_) + 4;
-  intptr_t displacement = target - source;
-  DCHECK(is_int32(displacement));
-  emitl(static_cast<int32_t>(displacement));
-}
-
 void Assembler::clc() {
   EnsureSpace ensure_space(this);
   emit(0xF8);
@@ -1233,6 +1202,39 @@ void Assembler::lock() {
   emit(0xF0);
 }
 
+void Assembler::xaddb(Operand dst, Register src) {
+  EnsureSpace ensure_space(this);
+  emit_optional_rex_8(src, dst);
+  emit(0x0F);
+  emit(0xC0);
+  emit_operand(src, dst);
+}
+
+void Assembler::xaddw(Operand dst, Register src) {
+  EnsureSpace ensure_space(this);
+  emit(0x66);
+  emit_optional_rex_32(src, dst);
+  emit(0x0F);
+  emit(0xC1);
+  emit_operand(src, dst);
+}
+
+void Assembler::xaddl(Operand dst, Register src) {
+  EnsureSpace ensure_space(this);
+  emit_optional_rex_32(src, dst);
+  emit(0x0F);
+  emit(0xC1);
+  emit_operand(src, dst);
+}
+
+void Assembler::xaddq(Operand dst, Register src) {
+  EnsureSpace ensure_space(this);
+  emit_rex(src, dst, kInt64Size);
+  emit(0x0F);
+  emit(0xC1);
+  emit_operand(src, dst);
+}
+
 void Assembler::cmpxchgb(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   if (!src.is_byte_register()) {
@@ -1425,7 +1427,7 @@ void Assembler::int3() {
 
 void Assembler::j(Condition cc, Label* L, Label::Distance distance) {
   if (cc == always) {
-    jmp(L);
+    jmp(L, distance);
     return;
   } else if (cc == never) {
     return;
@@ -1971,6 +1973,12 @@ void Assembler::emit_repmovs(int size) {
   emit(0xA5);
 }
 
+void Assembler::repstosl() {
+  EnsureSpace ensure_space(this);
+  emit(0xF3);
+  emit(0xAB);
+}
+
 void Assembler::repstosq() {
   EnsureSpace ensure_space(this);
   emit(0xF3);
@@ -1999,18 +2007,62 @@ void Assembler::mulq(Register src) {
   emit_modrm(0x4, src);
 }
 
-void Assembler::emit_neg(Register dst, int size) {
+void Assembler::negb(Register reg) {
   EnsureSpace ensure_space(this);
-  emit_rex(dst, size);
+  emit_optional_rex_8(reg);
+  emit(0xF6);
+  emit_modrm(0x3, reg);
+}
+
+void Assembler::negw(Register reg) {
+  EnsureSpace ensure_space(this);
+  emit(0x66);
+  emit_optional_rex_32(reg);
   emit(0xF7);
-  emit_modrm(0x3, dst);
+  emit_modrm(0x3, reg);
 }
 
-void Assembler::emit_neg(Operand dst, int size) {
+void Assembler::negl(Register reg) {
   EnsureSpace ensure_space(this);
-  emit_rex_64(dst);
+  emit_optional_rex_32(reg);
+  emit(0xF7);
+  emit_modrm(0x3, reg);
+}
+
+void Assembler::negq(Register reg) {
+  EnsureSpace ensure_space(this);
+  emit_rex_64(reg);
+  emit(0xF7);
+  emit_modrm(0x3, reg);
+}
+
+void Assembler::negb(Operand op) {
+  EnsureSpace ensure_space(this);
+  emit_optional_rex_32(op);
+  emit(0xF6);
+  emit_operand(0x3, op);
+}
+
+void Assembler::negw(Operand op) {
+  EnsureSpace ensure_space(this);
+  emit(0x66);
+  emit_optional_rex_32(op);
+  emit(0xF7);
+  emit_operand(0x3, op);
+}
+
+void Assembler::negl(Operand op) {
+  EnsureSpace ensure_space(this);
+  emit_optional_rex_32(op);
+  emit(0xF7);
+  emit_operand(0x3, op);
+}
+
+void Assembler::negq(Operand op) {
+  EnsureSpace ensure_space(this);
+  emit_rex_64(op);
   emit(0xF7);
-  emit_operand(3, dst);
+  emit_operand(0x3, op);
 }
 
 void Assembler::nop() {
@@ -2699,138 +2751,6 @@ void Assembler::emit_farith(int b1, int b2, int i) {
   emit(b2 + i);
 }
 
-// SSE operations.
-
-void Assembler::andps(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x54);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::andps(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x54);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::andnps(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x55);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::andnps(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x55);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::orps(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x56);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::orps(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x56);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::xorps(XMMRegister dst, XMMRegister src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x57);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::xorps(XMMRegister dst, Operand src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x57);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::addps(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x58);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::addps(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x58);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::subps(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5C);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::subps(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5C);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::mulps(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x59);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::mulps(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x59);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::divps(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5E);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::divps(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5E);
-  emit_sse_operand(dst, src);
-}
-
 // SSE 2 operations.
 
 void Assembler::movd(XMMRegister dst, Register src) {
@@ -2952,45 +2872,6 @@ void Assembler::movdqu(XMMRegister dst, Operand src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::extractps(Register dst, XMMRegister src, byte imm8) {
-  DCHECK(IsEnabled(SSE4_1));
-  DCHECK(is_uint8(imm8));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(src, dst);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x17);
-  emit_sse_operand(src, dst);
-  emit(imm8);
-}
-
-void Assembler::pextrb(Register dst, XMMRegister src, int8_t imm8) {
-  DCHECK(IsEnabled(SSE4_1));
-  DCHECK(is_uint8(imm8));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(src, dst);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x14);
-  emit_sse_operand(src, dst);
-  emit(imm8);
-}
-
-void Assembler::pextrb(Operand dst, XMMRegister src, int8_t imm8) {
-  DCHECK(IsEnabled(SSE4_1));
-  DCHECK(is_uint8(imm8));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(src, dst);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x14);
-  emit_sse_operand(src, dst);
-  emit(imm8);
-}
-
 void Assembler::pinsrw(XMMRegister dst, Register src, int8_t imm8) {
   DCHECK(is_uint8(imm8));
   EnsureSpace ensure_space(this);
@@ -3013,163 +2894,72 @@ void Assembler::pinsrw(XMMRegister dst, Operand src, int8_t imm8) {
   emit(imm8);
 }
 
-void Assembler::pextrw(Register dst, XMMRegister src, int8_t imm8) {
+void Assembler::pextrq(Register dst, XMMRegister src, int8_t imm8) {
   DCHECK(IsEnabled(SSE4_1));
-  DCHECK(is_uint8(imm8));
   EnsureSpace ensure_space(this);
   emit(0x66);
-  emit_optional_rex_32(src, dst);
+  emit_rex_64(src, dst);
   emit(0x0F);
   emit(0x3A);
-  emit(0x15);
+  emit(0x16);
   emit_sse_operand(src, dst);
   emit(imm8);
 }
 
-void Assembler::pextrw(Operand dst, XMMRegister src, int8_t imm8) {
+void Assembler::pinsrq(XMMRegister dst, Register src, int8_t imm8) {
   DCHECK(IsEnabled(SSE4_1));
-  DCHECK(is_uint8(imm8));
   EnsureSpace ensure_space(this);
   emit(0x66);
-  emit_optional_rex_32(src, dst);
+  emit_rex_64(dst, src);
   emit(0x0F);
   emit(0x3A);
-  emit(0x15);
-  emit_sse_operand(src, dst);
+  emit(0x22);
+  emit_sse_operand(dst, src);
   emit(imm8);
 }
 
-void Assembler::pextrd(Register dst, XMMRegister src, int8_t imm8) {
+void Assembler::pinsrq(XMMRegister dst, Operand src, int8_t imm8) {
   DCHECK(IsEnabled(SSE4_1));
+  DCHECK(is_uint8(imm8));
   EnsureSpace ensure_space(this);
   emit(0x66);
-  emit_optional_rex_32(src, dst);
+  emit_rex_64(dst, src);
   emit(0x0F);
   emit(0x3A);
-  emit(0x16);
-  emit_sse_operand(src, dst);
+  emit(0x22);
+  emit_sse_operand(dst, src);
   emit(imm8);
 }
 
-void Assembler::pextrd(Operand dst, XMMRegister src, int8_t imm8) {
-  DCHECK(IsEnabled(SSE4_1));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(src, dst);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x16);
-  emit_sse_operand(src, dst);
-  emit(imm8);
-}
-
-void Assembler::pextrq(Register dst, XMMRegister src, int8_t imm8) {
-  DCHECK(IsEnabled(SSE4_1));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_rex_64(src, dst);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x16);
-  emit_sse_operand(src, dst);
-  emit(imm8);
-}
-
-void Assembler::pinsrq(XMMRegister dst, Register src, int8_t imm8) {
-  DCHECK(IsEnabled(SSE4_1));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_rex_64(dst, src);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x22);
-  emit_sse_operand(dst, src);
-  emit(imm8);
-}
-
-void Assembler::pinsrq(XMMRegister dst, Operand src, int8_t imm8) {
-  DCHECK(IsEnabled(SSE4_1));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_rex_64(dst, src);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x22);
-  emit_sse_operand(dst, src);
-  emit(imm8);
-}
-
-void Assembler::pinsrd(XMMRegister dst, Register src, int8_t imm8) {
-  DCHECK(IsEnabled(SSE4_1));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x22);
-  emit_sse_operand(dst, src);
-  emit(imm8);
-}
-
-void Assembler::pinsrd(XMMRegister dst, Operand src, int8_t imm8) {
-  DCHECK(IsEnabled(SSE4_1));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x22);
-  emit_sse_operand(dst, src);
+void Assembler::pinsrd(XMMRegister dst, Register src, int8_t imm8) {
+  sse4_instr(dst, src, 0x66, 0x0F, 0x3A, 0x22, imm8);
+}
+
+void Assembler::pinsrd(XMMRegister dst, Operand src, int8_t imm8) {
+  DCHECK(is_uint8(imm8));
+  sse4_instr(dst, src, 0x66, 0x0F, 0x3A, 0x22);
   emit(imm8);
 }
 
 void Assembler::pinsrb(XMMRegister dst, Register src, int8_t imm8) {
-  DCHECK(IsEnabled(SSE4_1));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x20);
-  emit_sse_operand(dst, src);
-  emit(imm8);
+  sse4_instr(dst, src, 0x66, 0x0F, 0x3A, 0x20, imm8);
 }
 
 void Assembler::pinsrb(XMMRegister dst, Operand src, int8_t imm8) {
-  DCHECK(IsEnabled(SSE4_1));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x20);
-  emit_sse_operand(dst, src);
+  DCHECK(is_uint8(imm8));
+  sse4_instr(dst, src, 0x66, 0x0F, 0x3A, 0x20);
   emit(imm8);
 }
 
 void Assembler::insertps(XMMRegister dst, XMMRegister src, byte imm8) {
-  DCHECK(CpuFeatures::IsSupported(SSE4_1));
   DCHECK(is_uint8(imm8));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x21);
-  emit_sse_operand(dst, src);
+  sse4_instr(dst, src, 0x66, 0x0F, 0x3A, 0x21);
   emit(imm8);
 }
 
 void Assembler::insertps(XMMRegister dst, Operand src, byte imm8) {
-  DCHECK(CpuFeatures::IsSupported(SSE4_1));
   DCHECK(is_uint8(imm8));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x21);
-  emit_sse_operand(dst, src);
+  sse4_instr(dst, src, 0x66, 0x0F, 0x3A, 0x21);
   emit(imm8);
 }
 
@@ -3267,132 +3057,6 @@ void Assembler::movupd(Operand dst, XMMRegister src) {
   emit_sse_operand(src, dst);
 }
 
-void Assembler::addss(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x58);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::addss(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x58);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::subss(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5C);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::subss(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5C);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::mulss(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x59);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::mulss(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x59);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::divss(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5E);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::divss(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5E);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::maxss(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5F);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::maxss(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5F);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::minss(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5D);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::minss(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5D);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::sqrtss(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x51);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::sqrtss(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x51);
-  emit_sse_operand(dst, src);
-}
-
 void Assembler::ucomiss(XMMRegister dst, XMMRegister src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
@@ -3441,88 +3105,6 @@ void Assembler::movss(Operand src, XMMRegister dst) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::psllq(XMMRegister reg, byte imm8) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(reg);
-  emit(0x0F);
-  emit(0x73);
-  emit_sse_operand(rsi, reg);  // rsi == 6
-  emit(imm8);
-}
-
-void Assembler::psrlq(XMMRegister reg, byte imm8) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(reg);
-  emit(0x0F);
-  emit(0x73);
-  emit_sse_operand(rdx, reg);  // rdx == 2
-  emit(imm8);
-}
-
-void Assembler::psllw(XMMRegister reg, byte imm8) {
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(reg);
-  emit(0x0F);
-  emit(0x71);
-  emit_sse_operand(rsi, reg);  // rsi == 6
-  emit(imm8);
-}
-
-void Assembler::pslld(XMMRegister reg, byte imm8) {
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(reg);
-  emit(0x0F);
-  emit(0x72);
-  emit_sse_operand(rsi, reg);  // rsi == 6
-  emit(imm8);
-}
-
-void Assembler::psrlw(XMMRegister reg, byte imm8) {
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(reg);
-  emit(0x0F);
-  emit(0x71);
-  emit_sse_operand(rdx, reg);  // rdx == 2
-  emit(imm8);
-}
-
-void Assembler::psrld(XMMRegister reg, byte imm8) {
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(reg);
-  emit(0x0F);
-  emit(0x72);
-  emit_sse_operand(rdx, reg);  // rdx == 2
-  emit(imm8);
-}
-
-void Assembler::psraw(XMMRegister reg, byte imm8) {
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(reg);
-  emit(0x0F);
-  emit(0x71);
-  emit_sse_operand(rsp, reg);  // rsp == 4
-  emit(imm8);
-}
-
-void Assembler::psrad(XMMRegister reg, byte imm8) {
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(reg);
-  emit(0x0F);
-  emit(0x72);
-  emit_sse_operand(rsp, reg);  // rsp == 4
-  emit(imm8);
-}
-
 void Assembler::cmpps(XMMRegister dst, XMMRegister src, int8_t cmp) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
@@ -3682,227 +3264,119 @@ void Assembler::cvtlsi2sd(XMMRegister dst, Register src) {
 void Assembler::cvtlsi2ss(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x2A);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::cvtlsi2ss(XMMRegister dst, Register src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x2A);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::cvtqsi2ss(XMMRegister dst, Operand src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_rex_64(dst, src);
-  emit(0x0F);
-  emit(0x2A);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::cvtqsi2ss(XMMRegister dst, Register src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_rex_64(dst, src);
-  emit(0x0F);
-  emit(0x2A);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::cvtqsi2sd(XMMRegister dst, Operand src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0xF2);
-  emit_rex_64(dst, src);
-  emit(0x0F);
-  emit(0x2A);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::cvtqsi2sd(XMMRegister dst, Register src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0xF2);
-  emit_rex_64(dst, src);
-  emit(0x0F);
-  emit(0x2A);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::cvtss2sd(XMMRegister dst, XMMRegister src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5A);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::cvtss2sd(XMMRegister dst, Operand src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0xF3);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5A);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::cvtsd2ss(XMMRegister dst, XMMRegister src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0xF2);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5A);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::cvtsd2ss(XMMRegister dst, Operand src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0xF2);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5A);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::cvtsd2si(Register dst, XMMRegister src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0xF2);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x2D);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::cvtsd2siq(Register dst, XMMRegister src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0xF2);
-  emit_rex_64(dst, src);
-  emit(0x0F);
-  emit(0x2D);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::addsd(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit(0xF2);
+  emit(0xF3);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
-  emit(0x58);
+  emit(0x2A);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::addsd(XMMRegister dst, Operand src) {
+void Assembler::cvtlsi2ss(XMMRegister dst, Register src) {
   EnsureSpace ensure_space(this);
-  emit(0xF2);
+  emit(0xF3);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
-  emit(0x58);
+  emit(0x2A);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::mulsd(XMMRegister dst, XMMRegister src) {
+void Assembler::cvtqsi2ss(XMMRegister dst, Operand src) {
+  DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
-  emit(0xF2);
-  emit_optional_rex_32(dst, src);
+  emit(0xF3);
+  emit_rex_64(dst, src);
   emit(0x0F);
-  emit(0x59);
+  emit(0x2A);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::mulsd(XMMRegister dst, Operand src) {
+void Assembler::cvtqsi2ss(XMMRegister dst, Register src) {
+  DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
-  emit(0xF2);
-  emit_optional_rex_32(dst, src);
+  emit(0xF3);
+  emit_rex_64(dst, src);
   emit(0x0F);
-  emit(0x59);
+  emit(0x2A);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::subsd(XMMRegister dst, XMMRegister src) {
+void Assembler::cvtqsi2sd(XMMRegister dst, Operand src) {
+  DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);
-  emit_optional_rex_32(dst, src);
+  emit_rex_64(dst, src);
   emit(0x0F);
-  emit(0x5C);
+  emit(0x2A);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::subsd(XMMRegister dst, Operand src) {
+void Assembler::cvtqsi2sd(XMMRegister dst, Register src) {
+  DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);
-  emit_optional_rex_32(dst, src);
+  emit_rex_64(dst, src);
   emit(0x0F);
-  emit(0x5C);
+  emit(0x2A);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::divsd(XMMRegister dst, XMMRegister src) {
+void Assembler::cvtss2sd(XMMRegister dst, XMMRegister src) {
+  DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
-  emit(0xF2);
+  emit(0xF3);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
-  emit(0x5E);
+  emit(0x5A);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::divsd(XMMRegister dst, Operand src) {
+void Assembler::cvtss2sd(XMMRegister dst, Operand src) {
+  DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
-  emit(0xF2);
+  emit(0xF3);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
-  emit(0x5E);
+  emit(0x5A);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::maxsd(XMMRegister dst, XMMRegister src) {
+void Assembler::cvtsd2ss(XMMRegister dst, XMMRegister src) {
+  DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
-  emit(0x5F);
+  emit(0x5A);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::maxsd(XMMRegister dst, Operand src) {
+void Assembler::cvtsd2ss(XMMRegister dst, Operand src) {
+  DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
-  emit(0x5F);
+  emit(0x5A);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::minsd(XMMRegister dst, XMMRegister src) {
+void Assembler::cvtsd2si(Register dst, XMMRegister src) {
+  DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
-  emit(0x5D);
+  emit(0x2D);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::minsd(XMMRegister dst, Operand src) {
+void Assembler::cvtsd2siq(Register dst, XMMRegister src) {
+  DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);
-  emit_optional_rex_32(dst, src);
+  emit_rex_64(dst, src);
   emit(0x0F);
-  emit(0x5D);
+  emit(0x2D);
   emit_sse_operand(dst, src);
 }
 
@@ -3962,26 +3436,6 @@ void Assembler::xorpd(XMMRegister dst, Operand src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::sqrtsd(XMMRegister dst, XMMRegister src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0xF2);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x51);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::sqrtsd(XMMRegister dst, Operand src) {
-  DCHECK(!IsEnabled(AVX));
-  EnsureSpace ensure_space(this);
-  emit(0xF2);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x51);
-  emit_sse_operand(dst, src);
-}
-
 void Assembler::haddps(XMMRegister dst, XMMRegister src) {
   DCHECK(IsEnabled(SSE3));
   EnsureSpace ensure_space(this);
@@ -4034,28 +3488,14 @@ void Assembler::cmpltsd(XMMRegister dst, XMMRegister src) {
 
 void Assembler::roundss(XMMRegister dst, XMMRegister src, RoundingMode mode) {
   DCHECK(!IsEnabled(AVX));
-  DCHECK(IsEnabled(SSE4_1));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x0A);
-  emit_sse_operand(dst, src);
+  sse4_instr(dst, src, 0x66, 0x0F, 0x3A, 0x0A);
   // Mask precision exception.
   emit(static_cast<byte>(mode) | 0x8);
 }
 
 void Assembler::roundsd(XMMRegister dst, XMMRegister src, RoundingMode mode) {
   DCHECK(!IsEnabled(AVX));
-  DCHECK(IsEnabled(SSE4_1));
-  EnsureSpace ensure_space(this);
-  emit(0x66);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x3A);
-  emit(0x0B);
-  emit_sse_operand(dst, src);
+  sse4_instr(dst, src, 0x66, 0x0F, 0x3A, 0x0B);
   // Mask precision exception.
   emit(static_cast<byte>(mode) | 0x8);
 }
@@ -4078,74 +3518,47 @@ void Assembler::movmskps(Register dst, XMMRegister src) {
 }
 
 // AVX instructions
-void Assembler::vfmasd(byte op, XMMRegister dst, XMMRegister src1,
-                       XMMRegister src2) {
-  DCHECK(IsEnabled(FMA3));
-  EnsureSpace ensure_space(this);
-  emit_vex_prefix(dst, src1, src2, kLIG, k66, k0F38, kW1);
-  emit(op);
-  emit_sse_operand(dst, src2);
-}
-
-void Assembler::vfmasd(byte op, XMMRegister dst, XMMRegister src1,
-                       Operand src2) {
-  DCHECK(IsEnabled(FMA3));
-  EnsureSpace ensure_space(this);
-  emit_vex_prefix(dst, src1, src2, kLIG, k66, k0F38, kW1);
-  emit(op);
-  emit_sse_operand(dst, src2);
-}
-
-void Assembler::vfmass(byte op, XMMRegister dst, XMMRegister src1,
-                       XMMRegister src2) {
-  DCHECK(IsEnabled(FMA3));
-  EnsureSpace ensure_space(this);
-  emit_vex_prefix(dst, src1, src2, kLIG, k66, k0F38, kW0);
-  emit(op);
-  emit_sse_operand(dst, src2);
-}
 
-void Assembler::vfmass(byte op, XMMRegister dst, XMMRegister src1,
-                       Operand src2) {
-  DCHECK(IsEnabled(FMA3));
+void Assembler::vmovddup(XMMRegister dst, XMMRegister src) {
+  DCHECK(IsEnabled(AVX));
   EnsureSpace ensure_space(this);
-  emit_vex_prefix(dst, src1, src2, kLIG, k66, k0F38, kW0);
-  emit(op);
-  emit_sse_operand(dst, src2);
+  emit_vex_prefix(dst, xmm0, src, kL128, kF2, k0F, kWIG);
+  emit(0x12);
+  emit_sse_operand(dst, src);
 }
 
-void Assembler::vfmaps(byte op, XMMRegister dst, XMMRegister src1,
-                       XMMRegister src2) {
-  DCHECK(IsEnabled(FMA3));
+void Assembler::vmovddup(XMMRegister dst, Operand src) {
+  DCHECK(IsEnabled(AVX));
   EnsureSpace ensure_space(this);
-  emit_vex_prefix(dst, src1, src2, kL128, k66, k0F38, kW0);
-  emit(op);
-  emit_sse_operand(dst, src2);
+  emit_vex_prefix(dst, xmm0, src, kL128, kF2, k0F, kWIG);
+  emit(0x12);
+  emit_sse_operand(dst, src);
 }
 
-void Assembler::vfmaps(byte op, XMMRegister dst, XMMRegister src1,
-                       Operand src2) {
-  DCHECK(IsEnabled(FMA3));
+void Assembler::vbroadcastss(XMMRegister dst, Operand src) {
+  DCHECK(IsEnabled(AVX));
   EnsureSpace ensure_space(this);
-  emit_vex_prefix(dst, src1, src2, kL128, k66, k0F38, kW0);
-  emit(op);
-  emit_sse_operand(dst, src2);
+  emit_vex_prefix(dst, xmm0, src, kL128, k66, k0F38, kW0);
+  emit(0x18);
+  emit_sse_operand(dst, src);
 }
 
-void Assembler::vfmapd(byte op, XMMRegister dst, XMMRegister src1,
-                       XMMRegister src2) {
+void Assembler::fma_instr(byte op, XMMRegister dst, XMMRegister src1,
+                          XMMRegister src2, VectorLength l, SIMDPrefix pp,
+                          LeadingOpcode m, VexW w) {
   DCHECK(IsEnabled(FMA3));
   EnsureSpace ensure_space(this);
-  emit_vex_prefix(dst, src1, src2, kL128, k66, k0F38, kW1);
+  emit_vex_prefix(dst, src1, src2, l, pp, m, w);
   emit(op);
   emit_sse_operand(dst, src2);
 }
 
-void Assembler::vfmapd(byte op, XMMRegister dst, XMMRegister src1,
-                       Operand src2) {
+void Assembler::fma_instr(byte op, XMMRegister dst, XMMRegister src1,
+                          Operand src2, VectorLength l, SIMDPrefix pp,
+                          LeadingOpcode m, VexW w) {
   DCHECK(IsEnabled(FMA3));
   EnsureSpace ensure_space(this);
-  emit_vex_prefix(dst, src1, src2, kL128, k66, k0F38, kW1);
+  emit_vex_prefix(dst, src1, src2, l, pp, m, w);
   emit(op);
   emit_sse_operand(dst, src2);
 }
@@ -4210,12 +3623,12 @@ void Assembler::vmovdqu(XMMRegister dst, Operand src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::vmovdqu(Operand src, XMMRegister dst) {
+void Assembler::vmovdqu(Operand dst, XMMRegister src) {
   DCHECK(IsEnabled(AVX));
   EnsureSpace ensure_space(this);
-  emit_vex_prefix(dst, xmm0, src, kL128, kF3, k0F, kWIG);
+  emit_vex_prefix(src, xmm0, dst, kL128, kF3, k0F, kWIG);
   emit(0x7F);
-  emit_sse_operand(dst, src);
+  emit_sse_operand(src, dst);
 }
 
 void Assembler::vinstr(byte op, XMMRegister dst, XMMRegister src1,
@@ -4254,6 +3667,16 @@ void Assembler::vps(byte op, XMMRegister dst, XMMRegister src1, Operand src2) {
   emit_sse_operand(dst, src2);
 }
 
+void Assembler::vps(byte op, XMMRegister dst, XMMRegister src1,
+                    XMMRegister src2, byte imm8) {
+  DCHECK(IsEnabled(AVX));
+  EnsureSpace ensure_space(this);
+  emit_vex_prefix(dst, src1, src2, kL128, kNone, k0F, kWIG);
+  emit(op);
+  emit_sse_operand(dst, src2);
+  emit(imm8);
+}
+
 void Assembler::vpd(byte op, XMMRegister dst, XMMRegister src1,
                     XMMRegister src2) {
   DCHECK(IsEnabled(AVX));
@@ -4495,7 +3918,7 @@ void Assembler::bmi2l(SIMDPrefix pp, byte op, Register reg, Register vreg,
 void Assembler::rorxq(Register dst, Register src, byte imm8) {
   DCHECK(IsEnabled(BMI2));
   DCHECK(is_uint8(imm8));
-  Register vreg = Register::from_code<0>();  // VEX.vvvv unused
+  Register vreg = Register::from_code(0);  // VEX.vvvv unused
   EnsureSpace ensure_space(this);
   emit_vex_prefix(dst, vreg, src, kLZ, kF2, k0F3A, kW1);
   emit(0xF0);
@@ -4506,7 +3929,7 @@ void Assembler::rorxq(Register dst, Register src, byte imm8) {
 void Assembler::rorxq(Register dst, Operand src, byte imm8) {
   DCHECK(IsEnabled(BMI2));
   DCHECK(is_uint8(imm8));
-  Register vreg = Register::from_code<0>();  // VEX.vvvv unused
+  Register vreg = Register::from_code(0);  // VEX.vvvv unused
   EnsureSpace ensure_space(this);
   emit_vex_prefix(dst, vreg, src, kLZ, kF2, k0F3A, kW1);
   emit(0xF0);
@@ -4517,7 +3940,7 @@ void Assembler::rorxq(Register dst, Operand src, byte imm8) {
 void Assembler::rorxl(Register dst, Register src, byte imm8) {
   DCHECK(IsEnabled(BMI2));
   DCHECK(is_uint8(imm8));
-  Register vreg = Register::from_code<0>();  // VEX.vvvv unused
+  Register vreg = Register::from_code(0);  // VEX.vvvv unused
   EnsureSpace ensure_space(this);
   emit_vex_prefix(dst, vreg, src, kLZ, kF2, k0F3A, kW0);
   emit(0xF0);
@@ -4528,7 +3951,7 @@ void Assembler::rorxl(Register dst, Register src, byte imm8) {
 void Assembler::rorxl(Register dst, Operand src, byte imm8) {
   DCHECK(IsEnabled(BMI2));
   DCHECK(is_uint8(imm8));
-  Register vreg = Register::from_code<0>();  // VEX.vvvv unused
+  Register vreg = Register::from_code(0);  // VEX.vvvv unused
   EnsureSpace ensure_space(this);
   emit_vex_prefix(dst, vreg, src, kLZ, kF2, k0F3A, kW0);
   emit(0xF0);
@@ -4541,102 +3964,6 @@ void Assembler::pause() {
   emit(0x90);
 }
 
-void Assembler::minps(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5D);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::minps(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5D);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::maxps(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5F);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::maxps(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5F);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::rcpps(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x53);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::rcpps(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x53);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::rsqrtps(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x52);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::rsqrtps(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x52);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::sqrtps(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x51);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::sqrtps(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x51);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::cvtdq2ps(XMMRegister dst, XMMRegister src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5B);
-  emit_sse_operand(dst, src);
-}
-
-void Assembler::cvtdq2ps(XMMRegister dst, Operand src) {
-  EnsureSpace ensure_space(this);
-  emit_optional_rex_32(dst, src);
-  emit(0x0F);
-  emit(0x5B);
-  emit_sse_operand(dst, src);
-}
-
 void Assembler::movups(XMMRegister dst, XMMRegister src) {
   EnsureSpace ensure_space(this);
   if (src.low_bits() == 4) {
@@ -4669,6 +3996,24 @@ void Assembler::movups(Operand dst, XMMRegister src) {
   emit_sse_operand(src, dst);
 }
 
+void Assembler::sse_instr(XMMRegister dst, XMMRegister src, byte escape,
+                          byte opcode) {
+  EnsureSpace ensure_space(this);
+  emit_optional_rex_32(dst, src);
+  emit(escape);
+  emit(opcode);
+  emit_sse_operand(dst, src);
+}
+
+void Assembler::sse_instr(XMMRegister dst, Operand src, byte escape,
+                          byte opcode) {
+  EnsureSpace ensure_space(this);
+  emit_optional_rex_32(dst, src);
+  emit(escape);
+  emit(opcode);
+  emit_sse_operand(dst, src);
+}
+
 void Assembler::sse2_instr(XMMRegister dst, XMMRegister src, byte prefix,
                            byte escape, byte opcode) {
   EnsureSpace ensure_space(this);
@@ -4713,6 +4058,21 @@ void Assembler::ssse3_instr(XMMRegister dst, Operand src, byte prefix,
   emit_sse_operand(dst, src);
 }
 
+void Assembler::sse4_instr(XMMRegister dst, Register src, byte prefix,
+                           byte escape1, byte escape2, byte opcode,
+                           int8_t imm8) {
+  DCHECK(is_uint8(imm8));
+  DCHECK(IsEnabled(SSE4_1));
+  EnsureSpace ensure_space(this);
+  emit(prefix);
+  emit_optional_rex_32(dst, src);
+  emit(escape1);
+  emit(escape2);
+  emit(opcode);
+  emit_sse_operand(dst, src);
+  emit(imm8);
+}
+
 void Assembler::sse4_instr(XMMRegister dst, XMMRegister src, byte prefix,
                            byte escape1, byte escape2, byte opcode) {
   DCHECK(IsEnabled(SSE4_1));
@@ -4737,6 +4097,36 @@ void Assembler::sse4_instr(XMMRegister dst, Operand src, byte prefix,
   emit_sse_operand(dst, src);
 }
 
+void Assembler::sse4_instr(Register dst, XMMRegister src, byte prefix,
+                           byte escape1, byte escape2, byte opcode,
+                           int8_t imm8) {
+  DCHECK(is_uint8(imm8));
+  DCHECK(IsEnabled(SSE4_1));
+  EnsureSpace ensure_space(this);
+  emit(prefix);
+  emit_optional_rex_32(src, dst);
+  emit(escape1);
+  emit(escape2);
+  emit(opcode);
+  emit_sse_operand(src, dst);
+  emit(imm8);
+}
+
+void Assembler::sse4_instr(Operand dst, XMMRegister src, byte prefix,
+                           byte escape1, byte escape2, byte opcode,
+                           int8_t imm8) {
+  DCHECK(is_uint8(imm8));
+  DCHECK(IsEnabled(SSE4_1));
+  EnsureSpace ensure_space(this);
+  emit(prefix);
+  emit_optional_rex_32(src, dst);
+  emit(escape1);
+  emit(escape2);
+  emit(opcode);
+  emit_sse_operand(src, dst);
+  emit(imm8);
+}
+
 void Assembler::sse4_2_instr(XMMRegister dst, XMMRegister src, byte prefix,
                              byte escape1, byte escape2, byte opcode) {
   DCHECK(IsEnabled(SSE4_2));
diff --git a/deps/v8/src/codegen/x64/assembler-x64.h b/deps/v8/src/codegen/x64/assembler-x64.h
index 74cfd0ab850500..23921460658b24 100644
--- a/deps/v8/src/codegen/x64/assembler-x64.h
+++ b/deps/v8/src/codegen/x64/assembler-x64.h
@@ -45,6 +45,7 @@
 #include "src/codegen/assembler.h"
 #include "src/codegen/label.h"
 #include "src/codegen/x64/constants-x64.h"
+#include "src/codegen/x64/fma-instr.h"
 #include "src/codegen/x64/register-x64.h"
 #include "src/codegen/x64/sse-instr.h"
 #include "src/objects/smi.h"
@@ -224,7 +225,6 @@ static_assert(sizeof(Operand) <= 2 * kSystemPointerSize,
   V(mov)                              \
   V(movzxb)                           \
   V(movzxw)                           \
-  V(neg)                              \
   V(not)                              \
   V(or)                               \
   V(repmovs)                          \
@@ -317,6 +317,7 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   // otherwise valid instructions.)
   // This allows for a single, fast space check per instruction.
   static constexpr int kGap = 32;
+  STATIC_ASSERT(AssemblerBase::kMinimalBufferSize >= 2 * kGap);
 
  public:
   // Create an assembler. Instructions and relocation information are emitted
@@ -543,6 +544,8 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void repmovsl() { emit_repmovs(kInt32Size); }
   void repmovsq() { emit_repmovs(kInt64Size); }
 
+  // Repeated store of doublewords (fill (E)CX bytes at ES:[(E)DI] with EAX).
+  void repstosl();
   // Repeated store of quadwords (fill RCX quadwords at [RDI] with RAX).
   void repstosq();
 
@@ -603,6 +606,20 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void xchgb(Register reg, Operand op);
   void xchgw(Register reg, Operand op);
 
+  void xaddb(Operand dst, Register src);
+  void xaddw(Operand dst, Register src);
+  void xaddl(Operand dst, Register src);
+  void xaddq(Operand dst, Register src);
+
+  void negb(Register reg);
+  void negw(Register reg);
+  void negl(Register reg);
+  void negq(Register reg);
+  void negb(Operand op);
+  void negw(Operand op);
+  void negl(Operand op);
+  void negq(Operand op);
+
   void cmpxchgb(Operand dst, Register src);
   void cmpxchgw(Operand dst, Register src);
 
@@ -696,8 +713,6 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void ud2();
   void setcc(Condition cc, Register reg);
 
-  void pshufw(XMMRegister dst, XMMRegister src, uint8_t shuffle);
-  void pshufw(XMMRegister dst, Operand src, uint8_t shuffle);
   void pblendw(XMMRegister dst, Operand src, uint8_t mask);
   void pblendw(XMMRegister dst, XMMRegister src, uint8_t mask);
   void palignr(XMMRegister dst, Operand src, uint8_t mask);
@@ -734,12 +749,6 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void call(Handle<Code> target,
             RelocInfo::Mode rmode = RelocInfo::CODE_TARGET);
 
-  // Calls directly to the given address using a relative offset.
-  // Should only ever be used in Code objects for calls within the
-  // same Code object. Should not be used when generating new code (use labels),
-  // but only when patching existing code.
-  void call(Address target);
-
   // Call near absolute indirect, address in register
   void call(Register adr);
 
@@ -834,24 +843,6 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
 
   void sahf();
 
-  // SSE instructions
-  void addss(XMMRegister dst, XMMRegister src);
-  void addss(XMMRegister dst, Operand src);
-  void subss(XMMRegister dst, XMMRegister src);
-  void subss(XMMRegister dst, Operand src);
-  void mulss(XMMRegister dst, XMMRegister src);
-  void mulss(XMMRegister dst, Operand src);
-  void divss(XMMRegister dst, XMMRegister src);
-  void divss(XMMRegister dst, Operand src);
-
-  void maxss(XMMRegister dst, XMMRegister src);
-  void maxss(XMMRegister dst, Operand src);
-  void minss(XMMRegister dst, XMMRegister src);
-  void minss(XMMRegister dst, Operand src);
-
-  void sqrtss(XMMRegister dst, XMMRegister src);
-  void sqrtss(XMMRegister dst, Operand src);
-
   void ucomiss(XMMRegister dst, XMMRegister src);
   void ucomiss(XMMRegister dst, Operand src);
   void movaps(XMMRegister dst, XMMRegister src);
@@ -871,24 +862,6 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void cvtlsi2ss(XMMRegister dst, Operand src);
   void cvtlsi2ss(XMMRegister dst, Register src);
 
-  void andps(XMMRegister dst, XMMRegister src);
-  void andps(XMMRegister dst, Operand src);
-  void andnps(XMMRegister dst, XMMRegister src);
-  void andnps(XMMRegister dst, Operand src);
-  void orps(XMMRegister dst, XMMRegister src);
-  void orps(XMMRegister dst, Operand src);
-  void xorps(XMMRegister dst, XMMRegister src);
-  void xorps(XMMRegister dst, Operand src);
-
-  void addps(XMMRegister dst, XMMRegister src);
-  void addps(XMMRegister dst, Operand src);
-  void subps(XMMRegister dst, XMMRegister src);
-  void subps(XMMRegister dst, Operand src);
-  void mulps(XMMRegister dst, XMMRegister src);
-  void mulps(XMMRegister dst, Operand src);
-  void divps(XMMRegister dst, XMMRegister src);
-  void divps(XMMRegister dst, Operand src);
-
   void movmskps(Register dst, XMMRegister src);
 
   void vinstr(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2,
@@ -896,7 +869,22 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void vinstr(byte op, XMMRegister dst, XMMRegister src1, Operand src2,
               SIMDPrefix pp, LeadingOpcode m, VexW w);
 
-  // SSE2 instructions
+  // SSE instructions
+  void sse_instr(XMMRegister dst, XMMRegister src, byte escape, byte opcode);
+  void sse_instr(XMMRegister dst, Operand src, byte escape, byte opcode);
+#define DECLARE_SSE_INSTRUCTION(instruction, escape, opcode) \
+  void instruction(XMMRegister dst, XMMRegister src) {       \
+    sse_instr(dst, src, 0x##escape, 0x##opcode);             \
+  }                                                          \
+  void instruction(XMMRegister dst, Operand src) {           \
+    sse_instr(dst, src, 0x##escape, 0x##opcode);             \
+  }
+
+  SSE_UNOP_INSTRUCTION_LIST(DECLARE_SSE_INSTRUCTION)
+  SSE_BINOP_INSTRUCTION_LIST(DECLARE_SSE_INSTRUCTION)
+#undef DECLARE_SSE_INSTRUCTION
+
+  // SSE instructions with prefix and SSE2 instructions
   void sse2_instr(XMMRegister dst, XMMRegister src, byte prefix, byte escape,
                   byte opcode);
   void sse2_instr(XMMRegister dst, Operand src, byte prefix, byte escape,
@@ -909,9 +897,26 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
     sse2_instr(dst, src, 0x##prefix, 0x##escape, 0x##opcode);         \
   }
 
+  // These SSE instructions have the same encoding as the SSE2 instructions.
+  SSE_INSTRUCTION_LIST_SS(DECLARE_SSE2_INSTRUCTION)
   SSE2_INSTRUCTION_LIST(DECLARE_SSE2_INSTRUCTION)
+  SSE2_INSTRUCTION_LIST_SD(DECLARE_SSE2_INSTRUCTION)
 #undef DECLARE_SSE2_INSTRUCTION
 
+  void sse2_instr(XMMRegister reg, byte imm8, byte prefix, byte escape,
+                  byte opcode, int extension) {
+    XMMRegister ext_reg = XMMRegister::from_code(extension);
+    sse2_instr(ext_reg, reg, prefix, escape, opcode);
+    emit(imm8);
+  }
+
+#define DECLARE_SSE2_SHIFT_IMM(instruction, prefix, escape, opcode, extension) \
+  void instruction(XMMRegister reg, byte imm8) {                               \
+    sse2_instr(reg, imm8, 0x##prefix, 0x##escape, 0x##opcode, 0x##extension);  \
+  }
+  SSE2_INSTRUCTION_LIST_SHIFT_IMM(DECLARE_SSE2_SHIFT_IMM)
+#undef DECLARE_SSE2_SHIFT_IMM
+
 #define DECLARE_SSE2_AVX_INSTRUCTION(instruction, prefix, escape, opcode)    \
   void v##instruction(XMMRegister dst, XMMRegister src1, XMMRegister src2) { \
     vinstr(0x##opcode, dst, src1, src2, k##prefix, k##escape, kW0);          \
@@ -947,6 +952,12 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
 #undef DECLARE_SSSE3_INSTRUCTION
 
   // SSE4
+  void sse4_instr(Register dst, XMMRegister src, byte prefix, byte escape1,
+                  byte escape2, byte opcode, int8_t imm8);
+  void sse4_instr(Operand dst, XMMRegister src, byte prefix, byte escape1,
+                  byte escape2, byte opcode, int8_t imm8);
+  void sse4_instr(XMMRegister dst, Register src, byte prefix, byte escape1,
+                  byte escape2, byte opcode, int8_t imm8);
   void sse4_instr(XMMRegister dst, XMMRegister src, byte prefix, byte escape1,
                   byte escape2, byte opcode);
   void sse4_instr(XMMRegister dst, Operand src, byte prefix, byte escape1,
@@ -961,8 +972,24 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   }
 
   SSE4_INSTRUCTION_LIST(DECLARE_SSE4_INSTRUCTION)
+  SSE4_PMOV_INSTRUCTION_LIST(DECLARE_SSE4_INSTRUCTION)
+  DECLARE_SSE4_INSTRUCTION(blendvpd, 66, 0F, 38, 15)
 #undef DECLARE_SSE4_INSTRUCTION
 
+#define DECLARE_SSE4_EXTRACT_INSTRUCTION(instruction, prefix, escape1,     \
+                                         escape2, opcode)                  \
+  void instruction(Register dst, XMMRegister src, int8_t imm8) {           \
+    sse4_instr(dst, src, 0x##prefix, 0x##escape1, 0x##escape2, 0x##opcode, \
+               imm8);                                                      \
+  }                                                                        \
+  void instruction(Operand dst, XMMRegister src, int8_t imm8) {            \
+    sse4_instr(dst, src, 0x##prefix, 0x##escape1, 0x##escape2, 0x##opcode, \
+               imm8);                                                      \
+  }
+
+  SSE4_EXTRACT_INSTRUCTION_LIST(DECLARE_SSE4_EXTRACT_INSTRUCTION)
+#undef DECLARE_SSE4_EXTRACT_INSTRUCTION
+
   // SSE4.2
   void sse4_2_instr(XMMRegister dst, XMMRegister src, byte prefix, byte escape1,
                     byte escape2, byte opcode);
@@ -991,8 +1018,27 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
 
   SSSE3_INSTRUCTION_LIST(DECLARE_SSE34_AVX_INSTRUCTION)
   SSE4_INSTRUCTION_LIST(DECLARE_SSE34_AVX_INSTRUCTION)
+  SSE4_2_INSTRUCTION_LIST(DECLARE_SSE34_AVX_INSTRUCTION)
 #undef DECLARE_SSE34_AVX_INSTRUCTION
 
+  void vblendvpd(XMMRegister dst, XMMRegister src1, XMMRegister src2,
+                 XMMRegister mask) {
+    vinstr(0x4B, dst, src1, src2, k66, k0F3A, kW0);
+    // The mask operand is encoded in bits[7:4] of the immediate byte.
+    emit(mask.code() << 4);
+  }
+
+#define DECLARE_SSE4_PMOV_AVX_INSTRUCTION(instruction, prefix, escape1,      \
+                                          escape2, opcode)                   \
+  void v##instruction(XMMRegister dst, XMMRegister src) {                    \
+    vinstr(0x##opcode, dst, xmm0, src, k##prefix, k##escape1##escape2, kW0); \
+  }                                                                          \
+  void v##instruction(XMMRegister dst, Operand src) {                        \
+    vinstr(0x##opcode, dst, xmm0, src, k##prefix, k##escape1##escape2, kW0); \
+  }
+  SSE4_PMOV_INSTRUCTION_LIST(DECLARE_SSE4_PMOV_AVX_INSTRUCTION)
+#undef DECLARE_SSE4_PMOV_AVX_INSTRUCTION
+
   void movd(XMMRegister dst, Register src);
   void movd(XMMRegister dst, Operand src);
   void movd(Register dst, XMMRegister src);
@@ -1020,15 +1066,6 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void movupd(XMMRegister dst, Operand src);
   void movupd(Operand dst, XMMRegister src);
 
-  void psllq(XMMRegister reg, byte imm8);
-  void psrlq(XMMRegister reg, byte imm8);
-  void psllw(XMMRegister reg, byte imm8);
-  void pslld(XMMRegister reg, byte imm8);
-  void psrlw(XMMRegister reg, byte imm8);
-  void psrld(XMMRegister reg, byte imm8);
-  void psraw(XMMRegister reg, byte imm8);
-  void psrad(XMMRegister reg, byte imm8);
-
   void cvttsd2si(Register dst, Operand src);
   void cvttsd2si(Register dst, XMMRegister src);
   void cvttss2siq(Register dst, XMMRegister src);
@@ -1055,28 +1092,12 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void cvtsd2si(Register dst, XMMRegister src);
   void cvtsd2siq(Register dst, XMMRegister src);
 
-  void addsd(XMMRegister dst, XMMRegister src);
-  void addsd(XMMRegister dst, Operand src);
-  void subsd(XMMRegister dst, XMMRegister src);
-  void subsd(XMMRegister dst, Operand src);
-  void mulsd(XMMRegister dst, XMMRegister src);
-  void mulsd(XMMRegister dst, Operand src);
-  void divsd(XMMRegister dst, XMMRegister src);
-  void divsd(XMMRegister dst, Operand src);
-
-  void maxsd(XMMRegister dst, XMMRegister src);
-  void maxsd(XMMRegister dst, Operand src);
-  void minsd(XMMRegister dst, XMMRegister src);
-  void minsd(XMMRegister dst, Operand src);
-
   void andpd(XMMRegister dst, XMMRegister src);
   void andpd(XMMRegister dst, Operand src);
   void orpd(XMMRegister dst, XMMRegister src);
   void orpd(XMMRegister dst, Operand src);
   void xorpd(XMMRegister dst, XMMRegister src);
   void xorpd(XMMRegister dst, Operand src);
-  void sqrtsd(XMMRegister dst, XMMRegister src);
-  void sqrtsd(XMMRegister dst, Operand src);
 
   void haddps(XMMRegister dst, XMMRegister src);
   void haddps(XMMRegister dst, Operand src);
@@ -1090,13 +1111,6 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   // SSE 4.1 instruction
   void insertps(XMMRegister dst, XMMRegister src, byte imm8);
   void insertps(XMMRegister dst, Operand src, byte imm8);
-  void extractps(Register dst, XMMRegister src, byte imm8);
-  void pextrb(Register dst, XMMRegister src, int8_t imm8);
-  void pextrb(Operand dst, XMMRegister src, int8_t imm8);
-  void pextrw(Register dst, XMMRegister src, int8_t imm8);
-  void pextrw(Operand dst, XMMRegister src, int8_t imm8);
-  void pextrd(Register dst, XMMRegister src, int8_t imm8);
-  void pextrd(Operand dst, XMMRegister src, int8_t imm8);
   void pextrq(Register dst, XMMRegister src, int8_t imm8);
   void pinsrb(XMMRegister dst, Register src, int8_t imm8);
   void pinsrb(XMMRegister dst, Operand src, int8_t imm8);
@@ -1130,16 +1144,6 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
 
 #undef SSE_CMP_P
 
-  void minps(XMMRegister dst, XMMRegister src);
-  void minps(XMMRegister dst, Operand src);
-  void maxps(XMMRegister dst, XMMRegister src);
-  void maxps(XMMRegister dst, Operand src);
-  void rcpps(XMMRegister dst, XMMRegister src);
-  void rcpps(XMMRegister dst, Operand src);
-  void rsqrtps(XMMRegister dst, XMMRegister src);
-  void rsqrtps(XMMRegister dst, Operand src);
-  void sqrtps(XMMRegister dst, XMMRegister src);
-  void sqrtps(XMMRegister dst, Operand src);
   void movups(XMMRegister dst, XMMRegister src);
   void movups(XMMRegister dst, Operand src);
   void movups(Operand dst, XMMRegister src);
@@ -1150,189 +1154,32 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void pshufhw(XMMRegister dst, Operand src, uint8_t shuffle);
   void pshuflw(XMMRegister dst, XMMRegister src, uint8_t shuffle);
   void pshuflw(XMMRegister dst, Operand src, uint8_t shuffle);
-  void cvtdq2ps(XMMRegister dst, XMMRegister src);
-  void cvtdq2ps(XMMRegister dst, Operand src);
 
-  // AVX instruction
-  void vfmadd132sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmasd(0x99, dst, src1, src2);
-  }
-  void vfmadd213sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmasd(0xa9, dst, src1, src2);
-  }
-  void vfmadd231sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmasd(0xb9, dst, src1, src2);
-  }
-  void vfmadd132sd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmasd(0x99, dst, src1, src2);
-  }
-  void vfmadd213sd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmasd(0xa9, dst, src1, src2);
+  void movlhps(XMMRegister dst, XMMRegister src) {
+    sse_instr(dst, src, 0x0F, 0x16);
   }
-  void vfmadd231sd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmasd(0xb9, dst, src1, src2);
-  }
-  void vfmsub132sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmasd(0x9b, dst, src1, src2);
-  }
-  void vfmsub213sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmasd(0xab, dst, src1, src2);
-  }
-  void vfmsub231sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmasd(0xbb, dst, src1, src2);
-  }
-  void vfmsub132sd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmasd(0x9b, dst, src1, src2);
-  }
-  void vfmsub213sd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmasd(0xab, dst, src1, src2);
-  }
-  void vfmsub231sd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmasd(0xbb, dst, src1, src2);
-  }
-  void vfnmadd132sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmasd(0x9d, dst, src1, src2);
-  }
-  void vfnmadd213sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmasd(0xad, dst, src1, src2);
-  }
-  void vfnmadd231sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmasd(0xbd, dst, src1, src2);
-  }
-  void vfnmadd132sd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmasd(0x9d, dst, src1, src2);
-  }
-  void vfnmadd213sd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmasd(0xad, dst, src1, src2);
-  }
-  void vfnmadd231sd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmasd(0xbd, dst, src1, src2);
-  }
-  void vfnmsub132sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmasd(0x9f, dst, src1, src2);
-  }
-  void vfnmsub213sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmasd(0xaf, dst, src1, src2);
-  }
-  void vfnmsub231sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmasd(0xbf, dst, src1, src2);
-  }
-  void vfnmsub132sd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmasd(0x9f, dst, src1, src2);
-  }
-  void vfnmsub213sd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmasd(0xaf, dst, src1, src2);
-  }
-  void vfnmsub231sd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmasd(0xbf, dst, src1, src2);
-  }
-  void vfmasd(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
-  void vfmasd(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
 
-  void vfmadd132ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmass(0x99, dst, src1, src2);
-  }
-  void vfmadd213ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmass(0xa9, dst, src1, src2);
-  }
-  void vfmadd231ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmass(0xb9, dst, src1, src2);
-  }
-  void vfmadd132ss(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmass(0x99, dst, src1, src2);
-  }
-  void vfmadd213ss(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmass(0xa9, dst, src1, src2);
-  }
-  void vfmadd231ss(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmass(0xb9, dst, src1, src2);
-  }
-  void vfmsub132ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmass(0x9b, dst, src1, src2);
-  }
-  void vfmsub213ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmass(0xab, dst, src1, src2);
-  }
-  void vfmsub231ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmass(0xbb, dst, src1, src2);
-  }
-  void vfmsub132ss(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmass(0x9b, dst, src1, src2);
-  }
-  void vfmsub213ss(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmass(0xab, dst, src1, src2);
-  }
-  void vfmsub231ss(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmass(0xbb, dst, src1, src2);
-  }
-  void vfnmadd132ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmass(0x9d, dst, src1, src2);
-  }
-  void vfnmadd213ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmass(0xad, dst, src1, src2);
-  }
-  void vfnmadd231ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmass(0xbd, dst, src1, src2);
-  }
-  void vfnmadd132ss(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmass(0x9d, dst, src1, src2);
-  }
-  void vfnmadd213ss(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmass(0xad, dst, src1, src2);
-  }
-  void vfnmadd231ss(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmass(0xbd, dst, src1, src2);
-  }
-  void vfnmsub132ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmass(0x9f, dst, src1, src2);
-  }
-  void vfnmsub213ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmass(0xaf, dst, src1, src2);
-  }
-  void vfnmsub231ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmass(0xbf, dst, src1, src2);
-  }
-  void vfnmsub132ss(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmass(0x9f, dst, src1, src2);
-  }
-  void vfnmsub213ss(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmass(0xaf, dst, src1, src2);
-  }
-  void vfnmsub231ss(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmass(0xbf, dst, src1, src2);
-  }
-  void vfmass(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
-  void vfmass(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
-
-  void vfmadd231ps(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmaps(0xb8, dst, src1, src2);
-  }
-  void vfmadd231ps(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmaps(0xb8, dst, src1, src2);
-  }
-  void vfnmadd231ps(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmaps(0xbc, dst, src1, src2);
-  }
-  void vfnmadd231ps(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmaps(0xbc, dst, src1, src2);
-  }
-  void vfmaps(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
-  void vfmaps(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
-
-  void vfmadd231pd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmapd(0xb8, dst, src1, src2);
-  }
-  void vfmadd231pd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmapd(0xb8, dst, src1, src2);
-  }
-  void vfnmadd231pd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
-    vfmapd(0xbc, dst, src1, src2);
-  }
-  void vfnmadd231pd(XMMRegister dst, XMMRegister src1, Operand src2) {
-    vfmapd(0xbc, dst, src1, src2);
+  // AVX instruction
+  void vmovddup(XMMRegister dst, XMMRegister src);
+  void vmovddup(XMMRegister dst, Operand src);
+  void vbroadcastss(XMMRegister dst, Operand src);
+
+  void fma_instr(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2,
+                 VectorLength l, SIMDPrefix pp, LeadingOpcode m, VexW w);
+  void fma_instr(byte op, XMMRegister dst, XMMRegister src1, Operand src2,
+                 VectorLength l, SIMDPrefix pp, LeadingOpcode m, VexW w);
+
+#define FMA(instr, length, prefix, escape1, escape2, extension, opcode) \
+  void instr(XMMRegister dst, XMMRegister src1, XMMRegister src2) {     \
+    fma_instr(0x##opcode, dst, src1, src2, k##length, k##prefix,        \
+              k##escape1##escape2, k##extension);                       \
+  }                                                                     \
+  void instr(XMMRegister dst, XMMRegister src1, Operand src2) {         \
+    fma_instr(0x##opcode, dst, src1, src2, k##length, k##prefix,        \
+              k##escape1##escape2, k##extension);                       \
   }
-  void vfmapd(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
-  void vfmapd(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
+  FMA_INSTRUCTION_LIST(FMA)
+#undef FMA
 
   void vmovd(XMMRegister dst, Register src);
   void vmovd(XMMRegister dst, Operand src);
@@ -1349,17 +1196,25 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void vmovdqu(XMMRegister dst, Operand src);
   void vmovdqu(Operand dst, XMMRegister src);
 
-#define AVX_SP_3(instr, opcode) \
-  AVX_S_3(instr, opcode)        \
-  AVX_P_3(instr, opcode)
-
-#define AVX_S_3(instr, opcode)  \
-  AVX_3(instr##ss, opcode, vss) \
-  AVX_3(instr##sd, opcode, vsd)
+#define AVX_SSE_UNOP(instr, escape, opcode)          \
+  void v##instr(XMMRegister dst, XMMRegister src2) { \
+    vps(0x##opcode, dst, xmm0, src2);                \
+  }                                                  \
+  void v##instr(XMMRegister dst, Operand src2) {     \
+    vps(0x##opcode, dst, xmm0, src2);                \
+  }
+  SSE_UNOP_INSTRUCTION_LIST(AVX_SSE_UNOP)
+#undef AVX_SSE_UNOP
 
-#define AVX_P_3(instr, opcode)  \
-  AVX_3(instr##ps, opcode, vps) \
-  AVX_3(instr##pd, opcode, vpd)
+#define AVX_SSE_BINOP(instr, escape, opcode)                           \
+  void v##instr(XMMRegister dst, XMMRegister src1, XMMRegister src2) { \
+    vps(0x##opcode, dst, src1, src2);                                  \
+  }                                                                    \
+  void v##instr(XMMRegister dst, XMMRegister src1, Operand src2) {     \
+    vps(0x##opcode, dst, src1, src2);                                  \
+  }
+  SSE_BINOP_INSTRUCTION_LIST(AVX_SSE_BINOP)
+#undef AVX_SSE_BINOP
 
 #define AVX_3(instr, opcode, impl)                                  \
   void instr(XMMRegister dst, XMMRegister src1, XMMRegister src2) { \
@@ -1369,34 +1224,36 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
     impl(opcode, dst, src1, src2);                                  \
   }
 
-  // vsqrtpd is defined by sqrtpd in SSE2_INSTRUCTION_LIST
-  AVX_S_3(vsqrt, 0x51)
-  AVX_3(vsqrtps, 0x51, vps)
-  AVX_S_3(vadd, 0x58)
-  AVX_S_3(vsub, 0x5c)
-  AVX_S_3(vmul, 0x59)
-  AVX_S_3(vdiv, 0x5e)
-  AVX_S_3(vmin, 0x5d)
-  AVX_S_3(vmax, 0x5f)
-  AVX_P_3(vand, 0x54)
-  AVX_3(vandnps, 0x55, vps)
-  AVX_P_3(vor, 0x56)
-  AVX_P_3(vxor, 0x57)
+  AVX_3(vandpd, 0x54, vpd)
+  AVX_3(vorpd, 0x56, vpd)
+  AVX_3(vxorpd, 0x57, vpd)
   AVX_3(vcvtsd2ss, 0x5a, vsd)
   AVX_3(vhaddps, 0x7c, vsd)
 
+#define AVX_SCALAR(instr, prefix, escape, opcode)                      \
+  void v##instr(XMMRegister dst, XMMRegister src1, XMMRegister src2) { \
+    vinstr(0x##opcode, dst, src1, src2, k##prefix, k##escape, kWIG);   \
+  }                                                                    \
+  void v##instr(XMMRegister dst, XMMRegister src1, Operand src2) {     \
+    vinstr(0x##opcode, dst, src1, src2, k##prefix, k##escape, kWIG);   \
+  }
+  SSE_INSTRUCTION_LIST_SS(AVX_SCALAR)
+  SSE2_INSTRUCTION_LIST_SD(AVX_SCALAR)
+#undef AVX_SCALAR
+
 #undef AVX_3
-#undef AVX_S_3
-#undef AVX_P_3
-#undef AVX_SP_3
 
-  void vpsrlq(XMMRegister dst, XMMRegister src, byte imm8) {
-    vpd(0x73, xmm2, dst, src);
-    emit(imm8);
+#define AVX_SSE2_SHIFT_IMM(instr, prefix, escape, opcode, extension)   \
+  void v##instr(XMMRegister dst, XMMRegister src, byte imm8) {         \
+    XMMRegister ext_reg = XMMRegister::from_code(extension);           \
+    vinstr(0x##opcode, ext_reg, dst, src, k##prefix, k##escape, kWIG); \
+    emit(imm8);                                                        \
   }
-  void vpsllq(XMMRegister dst, XMMRegister src, byte imm8) {
-    vpd(0x73, xmm6, dst, src);
-    emit(imm8);
+  SSE2_INSTRUCTION_LIST_SHIFT_IMM(AVX_SSE2_SHIFT_IMM)
+#undef AVX_SSE2_SHIFT_IMM
+
+  void vmovlhps(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
+    vinstr(0x16, dst, src1, src2, kNone, k0F, kWIG);
   }
   void vcvtss2sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vinstr(0x5a, dst, src1, src2, kF3, k0F, kWIG);
@@ -1502,6 +1359,10 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void vss(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
   void vss(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
 
+  void vshufps(XMMRegister dst, XMMRegister src1, XMMRegister src2, byte imm8) {
+    vps(0xC6, dst, src1, src2, imm8);
+  }
+
   void vmovaps(XMMRegister dst, XMMRegister src) { vps(0x28, dst, xmm0, src); }
   void vmovups(XMMRegister dst, XMMRegister src) { vps(0x10, dst, xmm0, src); }
   void vmovups(XMMRegister dst, Operand src) { vps(0x10, dst, xmm0, src); }
@@ -1560,28 +1421,18 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void vlddqu(XMMRegister dst, Operand src) {
     vinstr(0xF0, dst, xmm0, src, kF2, k0F, kWIG);
   }
-  void vpsllw(XMMRegister dst, XMMRegister src, uint8_t imm8) {
-    vinstr(0x71, xmm6, dst, src, k66, k0F, kWIG);
-    emit(imm8);
-  }
-  void vpsrlw(XMMRegister dst, XMMRegister src, uint8_t imm8) {
-    vinstr(0x71, xmm2, dst, src, k66, k0F, kWIG);
-    emit(imm8);
-  }
-  void vpsraw(XMMRegister dst, XMMRegister src, uint8_t imm8) {
-    vinstr(0x71, xmm4, dst, src, k66, k0F, kWIG);
-    emit(imm8);
-  }
-  void vpslld(XMMRegister dst, XMMRegister src, uint8_t imm8) {
-    vinstr(0x72, xmm6, dst, src, k66, k0F, kWIG);
+  void vinsertps(XMMRegister dst, XMMRegister src1, XMMRegister src2,
+                 byte imm8) {
+    vinstr(0x21, dst, src1, src2, k66, k0F3A, kWIG);
     emit(imm8);
   }
-  void vpsrld(XMMRegister dst, XMMRegister src, uint8_t imm8) {
-    vinstr(0x72, xmm2, dst, src, k66, k0F, kWIG);
+  void vinsertps(XMMRegister dst, XMMRegister src1, Operand src2, byte imm8) {
+    vinstr(0x21, dst, src1, src2, k66, k0F3A, kWIG);
     emit(imm8);
   }
-  void vpsrad(XMMRegister dst, XMMRegister src, uint8_t imm8) {
-    vinstr(0x72, xmm4, dst, src, k66, k0F, kWIG);
+  void vextractps(Register dst, XMMRegister src, int8_t imm8) {
+    XMMRegister idst = XMMRegister::from_code(dst.code());
+    vinstr(0x17, src, xmm0, idst, k66, k0F3A, kWIG);
     emit(imm8);
   }
   void vpextrb(Register dst, XMMRegister src, uint8_t imm8) {
@@ -1611,6 +1462,11 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
     vinstr(0x16, src, xmm0, dst, k66, k0F3A, kW0);
     emit(imm8);
   }
+  void vpextrq(Register dst, XMMRegister src, int8_t imm8) {
+    XMMRegister idst = XMMRegister::from_code(dst.code());
+    vinstr(0x16, src, xmm0, idst, k66, k0F3A, kW1);
+    emit(imm8);
+  }
   void vpinsrb(XMMRegister dst, XMMRegister src1, Register src2, uint8_t imm8) {
     XMMRegister isrc = XMMRegister::from_code(src2.code());
     vinstr(0x20, dst, src1, isrc, k66, k0F3A, kW0);
@@ -1638,13 +1494,49 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
     vinstr(0x22, dst, src1, src2, k66, k0F3A, kW0);
     emit(imm8);
   }
+  void vpinsrq(XMMRegister dst, XMMRegister src1, Register src2, int8_t imm8) {
+    XMMRegister isrc = XMMRegister::from_code(src2.code());
+    vinstr(0x22, dst, src1, isrc, k66, k0F3A, kW1);
+    emit(imm8);
+  }
+  void vpinsrq(XMMRegister dst, XMMRegister src1, Operand src2, int8_t imm8) {
+    vinstr(0x22, dst, src1, src2, k66, k0F3A, kW1);
+    emit(imm8);
+  }
+
   void vpshufd(XMMRegister dst, XMMRegister src, uint8_t imm8) {
     vinstr(0x70, dst, xmm0, src, k66, k0F, kWIG);
     emit(imm8);
   }
+  void vpshuflw(XMMRegister dst, XMMRegister src, uint8_t imm8) {
+    vinstr(0x70, dst, xmm0, src, kF2, k0F, kWIG);
+    emit(imm8);
+  }
+  void vpshuflw(XMMRegister dst, Operand src, uint8_t imm8) {
+    vinstr(0x70, dst, xmm0, src, kF2, k0F, kWIG);
+    emit(imm8);
+  }
+
+  void vpblendw(XMMRegister dst, XMMRegister src1, XMMRegister src2,
+                uint8_t mask) {
+    vinstr(0x0E, dst, src1, src2, k66, k0F3A, kWIG);
+    emit(mask);
+  }
+  void vpblendw(XMMRegister dst, XMMRegister src1, Operand src2, uint8_t mask) {
+    vinstr(0x0E, dst, src1, src2, k66, k0F3A, kWIG);
+    emit(mask);
+  }
+
+  void vpalignr(XMMRegister dst, XMMRegister src1, XMMRegister src2,
+                uint8_t imm8) {
+    vinstr(0x0F, dst, src1, src2, k66, k0F3A, kWIG);
+    emit(imm8);
+  }
 
   void vps(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
   void vps(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
+  void vps(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2,
+           byte imm8);
   void vpd(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
   void vpd(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
 
@@ -1952,6 +1844,13 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   // numbers have a high bit set.
   inline void emit_optional_rex_32(Operand op);
 
+  // Calls emit_rex_32(Register) for all non-byte registers.
+  inline void emit_optional_rex_8(Register reg);
+
+  // Calls emit_rex_32(Register, Operand) for all non-byte registers, and
+  // emit_optional_rex_32(Register, Operand) for byte registers.
+  inline void emit_optional_rex_8(Register reg, Operand op);
+
   void emit_rex(int size) {
     if (size == kInt64Size) {
       emit_rex_64();
diff --git a/deps/v8/src/codegen/x64/fma-instr.h b/deps/v8/src/codegen/x64/fma-instr.h
new file mode 100644
index 00000000000000..f41c91ee51268c
--- /dev/null
+++ b/deps/v8/src/codegen/x64/fma-instr.h
@@ -0,0 +1,38 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+#ifndef V8_CODEGEN_X64_FMA_INSTR_H_
+#define V8_CODEGEN_X64_FMA_INSTR_H_
+
+#define FMA_INSTRUCTION_LIST(V)             \
+  V(vfmadd132sd, L128, 66, 0F, 38, W1, 99)  \
+  V(vfmadd213sd, L128, 66, 0F, 38, W1, a9)  \
+  V(vfmadd231sd, L128, 66, 0F, 38, W1, b9)  \
+  V(vfmsub132sd, L128, 66, 0F, 38, W1, 9b)  \
+  V(vfmsub213sd, L128, 66, 0F, 38, W1, ab)  \
+  V(vfmsub231sd, L128, 66, 0F, 38, W1, bb)  \
+  V(vfnmadd132sd, L128, 66, 0F, 38, W1, 9d) \
+  V(vfnmadd213sd, L128, 66, 0F, 38, W1, ad) \
+  V(vfnmadd231sd, L128, 66, 0F, 38, W1, bd) \
+  V(vfnmsub132sd, L128, 66, 0F, 38, W1, 9f) \
+  V(vfnmsub213sd, L128, 66, 0F, 38, W1, af) \
+  V(vfnmsub231sd, L128, 66, 0F, 38, W1, bf) \
+  V(vfmadd132ss, LIG, 66, 0F, 38, W0, 99)   \
+  V(vfmadd213ss, LIG, 66, 0F, 38, W0, a9)   \
+  V(vfmadd231ss, LIG, 66, 0F, 38, W0, b9)   \
+  V(vfmsub132ss, LIG, 66, 0F, 38, W0, 9b)   \
+  V(vfmsub213ss, LIG, 66, 0F, 38, W0, ab)   \
+  V(vfmsub231ss, LIG, 66, 0F, 38, W0, bb)   \
+  V(vfnmadd132ss, LIG, 66, 0F, 38, W0, 9d)  \
+  V(vfnmadd213ss, LIG, 66, 0F, 38, W0, ad)  \
+  V(vfnmadd231ss, LIG, 66, 0F, 38, W0, bd)  \
+  V(vfnmsub132ss, LIG, 66, 0F, 38, W0, 9f)  \
+  V(vfnmsub213ss, LIG, 66, 0F, 38, W0, af)  \
+  V(vfnmsub231ss, LIG, 66, 0F, 38, W0, bf)  \
+  V(vfmadd231ps, L128, 66, 0F, 38, W0, b8)  \
+  V(vfnmadd231ps, L128, 66, 0F, 38, W0, bc) \
+  V(vfmadd231pd, L128, 66, 0F, 38, W1, b8)  \
+  V(vfnmadd231pd, L128, 66, 0F, 38, W1, bc)
+
+#endif  // V8_CODEGEN_X64_FMA_INSTR_H_
diff --git a/deps/v8/src/codegen/x64/macro-assembler-x64.cc b/deps/v8/src/codegen/x64/macro-assembler-x64.cc
index d02b95b38e1736..60b2c2b10c214a 100644
--- a/deps/v8/src/codegen/x64/macro-assembler-x64.cc
+++ b/deps/v8/src/codegen/x64/macro-assembler-x64.cc
@@ -58,19 +58,6 @@ Operand StackArgumentsAccessor::GetArgumentOperand(int index) {
   }
 }
 
-StackArgumentsAccessor::StackArgumentsAccessor(
-    Register base_reg, const ParameterCount& parameter_count,
-    StackArgumentsAccessorReceiverMode receiver_mode,
-    int extra_displacement_to_last_argument)
-    : base_reg_(base_reg),
-      argument_count_reg_(parameter_count.is_reg() ? parameter_count.reg()
-                                                   : no_reg),
-      argument_count_immediate_(
-          parameter_count.is_immediate() ? parameter_count.immediate() : 0),
-      receiver_mode_(receiver_mode),
-      extra_displacement_to_last_argument_(
-          extra_displacement_to_last_argument) {}
-
 void MacroAssembler::Load(Register destination, ExternalReference source) {
   if (root_array_available_ && options().enable_root_array_delta_access) {
     intptr_t delta = RootRegisterOffsetForExternalReference(isolate(), source);
@@ -137,11 +124,12 @@ void TurboAssembler::LoadAddress(Register destination,
     }
   }
   // Safe code.
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadExternalReference(destination, source);
-      return;
-    }
+  // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+  // non-isolate-independent code. In many cases it might be cheaper than
+  // embedding the relocatable value.
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadExternalReference(destination, source);
+    return;
   }
   Move(destination, source);
 }
@@ -193,8 +181,8 @@ void MacroAssembler::PushRoot(RootIndex index) {
 
 void TurboAssembler::CompareRoot(Register with, RootIndex index) {
   DCHECK(root_array_available_);
-  if (IsInRange(index, RootIndex::kFirstStrongOrReadOnlyRoot,
-                RootIndex::kLastStrongOrReadOnlyRoot)) {
+  if (base::IsInRange(index, RootIndex::kFirstStrongOrReadOnlyRoot,
+                      RootIndex::kLastStrongOrReadOnlyRoot)) {
     cmp_tagged(with,
                Operand(kRootRegister, RootRegisterOffsetForRootIndex(index)));
   } else {
@@ -207,8 +195,8 @@ void TurboAssembler::CompareRoot(Operand with, RootIndex index) {
   DCHECK(root_array_available_);
   DCHECK(!with.AddressUsesRegister(kScratchRegister));
   LoadRoot(kScratchRegister, index);
-  if (IsInRange(index, RootIndex::kFirstStrongOrReadOnlyRoot,
-                RootIndex::kLastStrongOrReadOnlyRoot)) {
+  if (base::IsInRange(index, RootIndex::kFirstStrongOrReadOnlyRoot,
+                      RootIndex::kLastStrongOrReadOnlyRoot)) {
     cmp_tagged(with, kScratchRegister);
   } else {
     // Some smi roots contain system pointer size values like stack limits.
@@ -216,6 +204,11 @@ void TurboAssembler::CompareRoot(Operand with, RootIndex index) {
   }
 }
 
+void TurboAssembler::LoadMap(Register destination, Register object) {
+  LoadTaggedPointerField(destination,
+                         FieldOperand(object, HeapObject::kMapOffset));
+}
+
 void TurboAssembler::LoadTaggedPointerField(Register destination,
                                             Operand field_operand) {
   if (COMPRESS_POINTERS_BOOL) {
@@ -226,10 +219,9 @@ void TurboAssembler::LoadTaggedPointerField(Register destination,
 }
 
 void TurboAssembler::LoadAnyTaggedField(Register destination,
-                                        Operand field_operand,
-                                        Register scratch) {
+                                        Operand field_operand) {
   if (COMPRESS_POINTERS_BOOL) {
-    DecompressAnyTagged(destination, field_operand, scratch);
+    DecompressAnyTagged(destination, field_operand);
   } else {
     mov_tagged(destination, field_operand);
   }
@@ -247,13 +239,11 @@ void TurboAssembler::PushTaggedPointerField(Operand field_operand,
 }
 
 void TurboAssembler::PushTaggedAnyField(Operand field_operand,
-                                        Register scratch1, Register scratch2) {
+                                        Register scratch) {
   if (COMPRESS_POINTERS_BOOL) {
-    DCHECK(!AreAliased(scratch1, scratch2));
-    DCHECK(!field_operand.AddressUsesRegister(scratch1));
-    DCHECK(!field_operand.AddressUsesRegister(scratch2));
-    DecompressAnyTagged(scratch1, field_operand, scratch2);
-    Push(scratch1);
+    DCHECK(!field_operand.AddressUsesRegister(scratch));
+    DecompressAnyTagged(scratch, field_operand);
+    Push(scratch);
   } else {
     Push(field_operand);
   }
@@ -288,13 +278,6 @@ void TurboAssembler::DecompressTaggedSigned(Register destination,
   RecordComment("]");
 }
 
-void TurboAssembler::DecompressTaggedSigned(Register destination,
-                                            Register source) {
-  RecordComment("[ DecompressTaggedSigned");
-  movl(destination, source);
-  RecordComment("]");
-}
-
 void TurboAssembler::DecompressTaggedPointer(Register destination,
                                              Operand field_operand) {
   RecordComment("[ DecompressTaggedPointer");
@@ -311,27 +294,11 @@ void TurboAssembler::DecompressTaggedPointer(Register destination,
   RecordComment("]");
 }
 
-void TurboAssembler::DecompressRegisterAnyTagged(Register destination,
-                                                 Register scratch) {
-  addq(destination, kRootRegister);
-}
-
 void TurboAssembler::DecompressAnyTagged(Register destination,
-                                         Operand field_operand,
-                                         Register scratch) {
-  DCHECK(!AreAliased(destination, scratch));
+                                         Operand field_operand) {
   RecordComment("[ DecompressAnyTagged");
   movl(destination, field_operand);
-  DecompressRegisterAnyTagged(destination, scratch);
-  RecordComment("]");
-}
-
-void TurboAssembler::DecompressAnyTagged(Register destination, Register source,
-                                         Register scratch) {
-  DCHECK(!AreAliased(destination, scratch));
-  RecordComment("[ DecompressAnyTagged");
-  movl(destination, source);
-  DecompressRegisterAnyTagged(destination, scratch);
+  addq(destination, kRootRegister);
   RecordComment("]");
 }
 
@@ -597,20 +564,6 @@ void TurboAssembler::Abort(AbortReason reason) {
   int3();
 }
 
-void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
-                                           Register centry) {
-  const Runtime::Function* f = Runtime::FunctionForId(fid);
-  // TODO(1236192): Most runtime routines don't need the number of
-  // arguments passed in because it is constant. At some point we
-  // should remove this need and make the runtime routine entry code
-  // smarter.
-  Set(rax, f->nargs);
-  LoadAddress(rbx, ExternalReference::Create(f));
-  DCHECK(!AreAliased(centry, rax, rbx));
-  DCHECK(centry == rcx);
-  CallCodeObject(centry);
-}
-
 void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
                                  SaveFPRegsMode save_doubles) {
   // If the expected number of arguments of the runtime function is
@@ -773,8 +726,7 @@ void TurboAssembler::Cvtsd2ss(XMMRegister dst, Operand src) {
 void TurboAssembler::Cvtlsi2sd(XMMRegister dst, Register src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
-    vxorpd(dst, dst, dst);
-    vcvtlsi2sd(dst, dst, src);
+    vcvtlsi2sd(dst, kScratchDoubleReg, src);
   } else {
     xorpd(dst, dst);
     cvtlsi2sd(dst, src);
@@ -784,8 +736,7 @@ void TurboAssembler::Cvtlsi2sd(XMMRegister dst, Register src) {
 void TurboAssembler::Cvtlsi2sd(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
-    vxorpd(dst, dst, dst);
-    vcvtlsi2sd(dst, dst, src);
+    vcvtlsi2sd(dst, kScratchDoubleReg, src);
   } else {
     xorpd(dst, dst);
     cvtlsi2sd(dst, src);
@@ -795,8 +746,7 @@ void TurboAssembler::Cvtlsi2sd(XMMRegister dst, Operand src) {
 void TurboAssembler::Cvtlsi2ss(XMMRegister dst, Register src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
-    vxorps(dst, dst, dst);
-    vcvtlsi2ss(dst, dst, src);
+    vcvtlsi2ss(dst, kScratchDoubleReg, src);
   } else {
     xorps(dst, dst);
     cvtlsi2ss(dst, src);
@@ -806,8 +756,7 @@ void TurboAssembler::Cvtlsi2ss(XMMRegister dst, Register src) {
 void TurboAssembler::Cvtlsi2ss(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
-    vxorps(dst, dst, dst);
-    vcvtlsi2ss(dst, dst, src);
+    vcvtlsi2ss(dst, kScratchDoubleReg, src);
   } else {
     xorps(dst, dst);
     cvtlsi2ss(dst, src);
@@ -817,8 +766,7 @@ void TurboAssembler::Cvtlsi2ss(XMMRegister dst, Operand src) {
 void TurboAssembler::Cvtqsi2ss(XMMRegister dst, Register src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
-    vxorps(dst, dst, dst);
-    vcvtqsi2ss(dst, dst, src);
+    vcvtqsi2ss(dst, kScratchDoubleReg, src);
   } else {
     xorps(dst, dst);
     cvtqsi2ss(dst, src);
@@ -828,8 +776,7 @@ void TurboAssembler::Cvtqsi2ss(XMMRegister dst, Register src) {
 void TurboAssembler::Cvtqsi2ss(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
-    vxorps(dst, dst, dst);
-    vcvtqsi2ss(dst, dst, src);
+    vcvtqsi2ss(dst, kScratchDoubleReg, src);
   } else {
     xorps(dst, dst);
     cvtqsi2ss(dst, src);
@@ -839,8 +786,7 @@ void TurboAssembler::Cvtqsi2ss(XMMRegister dst, Operand src) {
 void TurboAssembler::Cvtqsi2sd(XMMRegister dst, Register src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
-    vxorpd(dst, dst, dst);
-    vcvtqsi2sd(dst, dst, src);
+    vcvtqsi2sd(dst, kScratchDoubleReg, src);
   } else {
     xorpd(dst, dst);
     cvtqsi2sd(dst, src);
@@ -850,8 +796,7 @@ void TurboAssembler::Cvtqsi2sd(XMMRegister dst, Register src) {
 void TurboAssembler::Cvtqsi2sd(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
-    vxorpd(dst, dst, dst);
-    vcvtqsi2sd(dst, dst, src);
+    vcvtqsi2sd(dst, kScratchDoubleReg, src);
   } else {
     xorpd(dst, dst);
     cvtqsi2sd(dst, src);
@@ -1042,20 +987,20 @@ void ConvertFloatToUint64(TurboAssembler* tasm, Register dst,
 }
 }  // namespace
 
-void TurboAssembler::Cvttsd2uiq(Register dst, Operand src, Label* success) {
-  ConvertFloatToUint64<Operand, true>(this, dst, src, success);
+void TurboAssembler::Cvttsd2uiq(Register dst, Operand src, Label* fail) {
+  ConvertFloatToUint64<Operand, true>(this, dst, src, fail);
 }
 
-void TurboAssembler::Cvttsd2uiq(Register dst, XMMRegister src, Label* success) {
-  ConvertFloatToUint64<XMMRegister, true>(this, dst, src, success);
+void TurboAssembler::Cvttsd2uiq(Register dst, XMMRegister src, Label* fail) {
+  ConvertFloatToUint64<XMMRegister, true>(this, dst, src, fail);
 }
 
-void TurboAssembler::Cvttss2uiq(Register dst, Operand src, Label* success) {
-  ConvertFloatToUint64<Operand, false>(this, dst, src, success);
+void TurboAssembler::Cvttss2uiq(Register dst, Operand src, Label* fail) {
+  ConvertFloatToUint64<Operand, false>(this, dst, src, fail);
 }
 
-void TurboAssembler::Cvttss2uiq(Register dst, XMMRegister src, Label* success) {
-  ConvertFloatToUint64<XMMRegister, false>(this, dst, src, success);
+void TurboAssembler::Cvttss2uiq(Register dst, XMMRegister src, Label* fail) {
+  ConvertFloatToUint64<XMMRegister, false>(this, dst, src, fail);
 }
 
 void TurboAssembler::Set(Register dst, int64_t x) {
@@ -1108,11 +1053,12 @@ void TurboAssembler::Move(Register dst, Smi source) {
 }
 
 void TurboAssembler::Move(Register dst, ExternalReference ext) {
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      IndirectLoadExternalReference(dst, ext);
-      return;
-    }
+  // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+  // non-isolate-independent code. In many cases it might be cheaper than
+  // embedding the relocatable value.
+  if (root_array_available_ && options().isolate_independent_code) {
+    IndirectLoadExternalReference(dst, ext);
+    return;
   }
   movq(dst, Immediate64(ext.address(), RelocInfo::EXTERNAL_REFERENCE));
 }
@@ -1171,11 +1117,10 @@ void TurboAssembler::SmiUntag(Register dst, Operand src) {
     DCHECK(SmiValuesAre31Bits());
     if (COMPRESS_POINTERS_BOOL) {
       movsxlq(dst, src);
-      sarq(dst, Immediate(kSmiShift));
     } else {
       movq(dst, src);
-      sarq(dst, Immediate(kSmiShift));
     }
+    sarq(dst, Immediate(kSmiShift));
   }
 }
 
@@ -1191,10 +1136,10 @@ void MacroAssembler::SmiCompare(Register dst, Smi src) {
 }
 
 void MacroAssembler::Cmp(Register dst, Smi src) {
-  DCHECK_NE(dst, kScratchRegister);
   if (src.value() == 0) {
     test_tagged(dst, dst);
   } else {
+    DCHECK_NE(dst, kScratchRegister);
     Register constant_reg = GetSmiConstant(src);
     cmp_tagged(dst, constant_reg);
   }
@@ -1468,15 +1413,14 @@ void TurboAssembler::Push(Handle<HeapObject> source) {
 
 void TurboAssembler::Move(Register result, Handle<HeapObject> object,
                           RelocInfo::Mode rmode) {
-  if (FLAG_embedded_builtins) {
-    if (root_array_available_ && options().isolate_independent_code) {
-      // TODO(v8:9706): Fix-it! This load will always uncompress the value
-      // even when we are loading a compressed embedded object.
-      IndirectLoadConstant(result, object);
-      return;
-    }
-  }
-  if (RelocInfo::IsCompressedEmbeddedObject(rmode)) {
+  // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
+  // non-isolate-independent code. In many cases it might be cheaper than
+  // embedding the relocatable value.
+  if (root_array_available_ && options().isolate_independent_code) {
+    // TODO(v8:9706): Fix-it! This load will always uncompress the value
+    // even when we are loading a compressed embedded object.
+    IndirectLoadConstant(result, object);
+  } else if (RelocInfo::IsCompressedEmbeddedObject(rmode)) {
     EmbeddedObjectIndex index = AddEmbeddedObject(object);
     DCHECK(is_uint32(index));
     movl(result, Immediate(static_cast<int>(index), rmode));
@@ -1636,7 +1580,6 @@ void TurboAssembler::CallBuiltinByIndex(Register builtin_index) {
 
 void TurboAssembler::CallBuiltin(int builtin_index) {
   DCHECK(Builtins::IsBuiltinId(builtin_index));
-  DCHECK(FLAG_embedded_builtins);
   RecordCommentForOffHeapTrampoline(builtin_index);
   CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
   EmbeddedData d = EmbeddedData::FromBlob();
@@ -1910,16 +1853,6 @@ void TurboAssembler::Psrld(XMMRegister dst, byte imm8) {
   }
 }
 
-void TurboAssembler::Pshufd(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vpshufd(dst, src, shuffle);
-  } else {
-    DCHECK(!IsEnabled(AVX));
-    pshufd(dst, src, shuffle);
-  }
-}
-
 void TurboAssembler::Lzcntl(Register dst, Register src) {
   if (CpuFeatures::IsSupported(LZCNT)) {
     CpuFeatureScope scope(this, LZCNT);
@@ -1929,7 +1862,7 @@ void TurboAssembler::Lzcntl(Register dst, Register src) {
   Label not_zero_src;
   bsrl(dst, src);
   j(not_zero, &not_zero_src, Label::kNear);
-  Set(dst, 63);  // 63^31 == 32
+  movl(dst, Immediate(63));  // 63^31 == 32
   bind(&not_zero_src);
   xorl(dst, Immediate(31));  // for x in [0..31], 31^x == 31 - x
 }
@@ -1943,7 +1876,7 @@ void TurboAssembler::Lzcntl(Register dst, Operand src) {
   Label not_zero_src;
   bsrl(dst, src);
   j(not_zero, &not_zero_src, Label::kNear);
-  Set(dst, 63);  // 63^31 == 32
+  movl(dst, Immediate(63));  // 63^31 == 32
   bind(&not_zero_src);
   xorl(dst, Immediate(31));  // for x in [0..31], 31^x == 31 - x
 }
@@ -1957,7 +1890,7 @@ void TurboAssembler::Lzcntq(Register dst, Register src) {
   Label not_zero_src;
   bsrq(dst, src);
   j(not_zero, &not_zero_src, Label::kNear);
-  Set(dst, 127);  // 127^63 == 64
+  movl(dst, Immediate(127));  // 127^63 == 64
   bind(&not_zero_src);
   xorl(dst, Immediate(63));  // for x in [0..63], 63^x == 63 - x
 }
@@ -1971,7 +1904,7 @@ void TurboAssembler::Lzcntq(Register dst, Operand src) {
   Label not_zero_src;
   bsrq(dst, src);
   j(not_zero, &not_zero_src, Label::kNear);
-  Set(dst, 127);  // 127^63 == 64
+  movl(dst, Immediate(127));  // 127^63 == 64
   bind(&not_zero_src);
   xorl(dst, Immediate(63));  // for x in [0..63], 63^x == 63 - x
 }
@@ -1986,7 +1919,7 @@ void TurboAssembler::Tzcntq(Register dst, Register src) {
   bsfq(dst, src);
   j(not_zero, &not_zero_src, Label::kNear);
   // Define the result of tzcnt(0) separately, because bsf(0) is undefined.
-  Set(dst, 64);
+  movl(dst, Immediate(64));
   bind(&not_zero_src);
 }
 
@@ -2000,7 +1933,7 @@ void TurboAssembler::Tzcntq(Register dst, Operand src) {
   bsfq(dst, src);
   j(not_zero, &not_zero_src, Label::kNear);
   // Define the result of tzcnt(0) separately, because bsf(0) is undefined.
-  Set(dst, 64);
+  movl(dst, Immediate(64));
   bind(&not_zero_src);
 }
 
@@ -2013,7 +1946,7 @@ void TurboAssembler::Tzcntl(Register dst, Register src) {
   Label not_zero_src;
   bsfl(dst, src);
   j(not_zero, &not_zero_src, Label::kNear);
-  Set(dst, 32);  // The result of tzcnt is 32 if src = 0.
+  movl(dst, Immediate(32));  // The result of tzcnt is 32 if src = 0.
   bind(&not_zero_src);
 }
 
@@ -2026,7 +1959,7 @@ void TurboAssembler::Tzcntl(Register dst, Operand src) {
   Label not_zero_src;
   bsfl(dst, src);
   j(not_zero, &not_zero_src, Label::kNear);
-  Set(dst, 32);  // The result of tzcnt is 32 if src = 0.
+  movl(dst, Immediate(32));  // The result of tzcnt is 32 if src = 0.
   bind(&not_zero_src);
 }
 
@@ -2111,8 +2044,7 @@ void TurboAssembler::Ret(int bytes_dropped, Register scratch) {
 
 void MacroAssembler::CmpObjectType(Register heap_object, InstanceType type,
                                    Register map) {
-  LoadTaggedPointerField(map,
-                         FieldOperand(heap_object, HeapObject::kMapOffset));
+  LoadMap(map, heap_object);
   CmpInstanceType(map, type);
 }
 
@@ -2155,10 +2087,9 @@ void MacroAssembler::AssertConstructor(Register object) {
     testb(object, Immediate(kSmiTagMask));
     Check(not_equal, AbortReason::kOperandIsASmiAndNotAConstructor);
     Push(object);
-    LoadTaggedPointerField(object,
-                           FieldOperand(object, HeapObject::kMapOffset));
+    LoadMap(object, object);
     testb(FieldOperand(object, Map::kBitFieldOffset),
-          Immediate(Map::IsConstructorBit::kMask));
+          Immediate(Map::Bits1::IsConstructorBit::kMask));
     Pop(object);
     Check(not_zero, AbortReason::kOperandIsNotAConstructor);
   }
@@ -2194,7 +2125,7 @@ void MacroAssembler::AssertGeneratorObject(Register object) {
   // Load map
   Register map = object;
   Push(object);
-  LoadTaggedPointerField(map, FieldOperand(object, HeapObject::kMapOffset));
+  LoadMap(map, object);
 
   Label do_check;
   // Check if JSGeneratorObject
@@ -2279,32 +2210,17 @@ void MacroAssembler::MaybeDropFrames() {
   bind(&dont_drop);
 }
 
-void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
-                                        Register caller_args_count_reg,
+void TurboAssembler::PrepareForTailCall(Register callee_args_count,
+                                        Register caller_args_count,
                                         Register scratch0, Register scratch1) {
-#if DEBUG
-  if (callee_args_count.is_reg()) {
-    DCHECK(!AreAliased(callee_args_count.reg(), caller_args_count_reg, scratch0,
-                       scratch1));
-  } else {
-    DCHECK(!AreAliased(caller_args_count_reg, scratch0, scratch1));
-  }
-#endif
+  DCHECK(!AreAliased(callee_args_count, caller_args_count, scratch0, scratch1));
 
   // Calculate the destination address where we will put the return address
   // after we drop current frame.
   Register new_sp_reg = scratch0;
-  if (callee_args_count.is_reg()) {
-    subq(caller_args_count_reg, callee_args_count.reg());
-    leaq(new_sp_reg,
-         Operand(rbp, caller_args_count_reg, times_system_pointer_size,
-                 StandardFrameConstants::kCallerPCOffset));
-  } else {
-    leaq(new_sp_reg,
-         Operand(rbp, caller_args_count_reg, times_system_pointer_size,
-                 StandardFrameConstants::kCallerPCOffset -
-                     callee_args_count.immediate() * kSystemPointerSize));
-  }
+  subq(caller_args_count, callee_args_count);
+  leaq(new_sp_reg, Operand(rbp, caller_args_count, times_system_pointer_size,
+                           StandardFrameConstants::kCallerPCOffset));
 
   if (FLAG_debug_code) {
     cmpq(rsp, new_sp_reg);
@@ -2323,13 +2239,8 @@ void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
   movq(rbp, Operand(rbp, StandardFrameConstants::kCallerFPOffset));
 
   // +2 here is to copy both receiver and return address.
-  Register count_reg = caller_args_count_reg;
-  if (callee_args_count.is_reg()) {
-    leaq(count_reg, Operand(callee_args_count.reg(), 2));
-  } else {
-    movq(count_reg, Immediate(callee_args_count.immediate() + 2));
-    // TODO(ishell): Unroll copying loop for small immediate values.
-  }
+  Register count_reg = caller_args_count;
+  leaq(count_reg, Operand(callee_args_count, 2));
 
   // Now copy callee arguments to the caller frame going backwards to avoid
   // callee arguments corruption (source and destination areas could overlap).
@@ -2348,30 +2259,30 @@ void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
 }
 
 void MacroAssembler::InvokeFunction(Register function, Register new_target,
-                                    const ParameterCount& actual,
+                                    Register actual_parameter_count,
                                     InvokeFlag flag) {
   LoadTaggedPointerField(
       rbx, FieldOperand(function, JSFunction::kSharedFunctionInfoOffset));
   movzxwq(rbx,
           FieldOperand(rbx, SharedFunctionInfo::kFormalParameterCountOffset));
 
-  ParameterCount expected(rbx);
-  InvokeFunction(function, new_target, expected, actual, flag);
+  InvokeFunction(function, new_target, rbx, actual_parameter_count, flag);
 }
 
 void MacroAssembler::InvokeFunction(Register function, Register new_target,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
+                                    Register expected_parameter_count,
+                                    Register actual_parameter_count,
                                     InvokeFlag flag) {
   DCHECK(function == rdi);
   LoadTaggedPointerField(rsi,
                          FieldOperand(function, JSFunction::kContextOffset));
-  InvokeFunctionCode(rdi, new_target, expected, actual, flag);
+  InvokeFunctionCode(rdi, new_target, expected_parameter_count,
+                     actual_parameter_count, flag);
 }
 
 void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
-                                        const ParameterCount& expected,
-                                        const ParameterCount& actual,
+                                        Register expected_parameter_count,
+                                        Register actual_parameter_count,
                                         InvokeFlag flag) {
   // You can't call a function without a valid frame.
   DCHECK(flag == JUMP_FUNCTION || has_frame());
@@ -2396,127 +2307,81 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
   }
 
   Label done;
-  bool definitely_mismatches = false;
-  InvokePrologue(expected, actual, &done, &definitely_mismatches, flag,
-                 Label::kNear);
-  if (!definitely_mismatches) {
-    // We call indirectly through the code field in the function to
-    // allow recompilation to take effect without changing any of the
-    // call sites.
-    static_assert(kJavaScriptCallCodeStartRegister == rcx, "ABI mismatch");
-    LoadTaggedPointerField(rcx,
-                           FieldOperand(function, JSFunction::kCodeOffset));
-    if (flag == CALL_FUNCTION) {
-      CallCodeObject(rcx);
-    } else {
-      DCHECK(flag == JUMP_FUNCTION);
-      JumpCodeObject(rcx);
-    }
+  InvokePrologue(expected_parameter_count, actual_parameter_count, &done, flag);
+  // We call indirectly through the code field in the function to
+  // allow recompilation to take effect without changing any of the
+  // call sites.
+  static_assert(kJavaScriptCallCodeStartRegister == rcx, "ABI mismatch");
+  LoadTaggedPointerField(rcx, FieldOperand(function, JSFunction::kCodeOffset));
+  if (flag == CALL_FUNCTION) {
+    CallCodeObject(rcx);
+  } else {
+    DCHECK(flag == JUMP_FUNCTION);
+    JumpCodeObject(rcx);
   }
   jmp(&done, Label::kNear);
 
   // Deferred debug hook.
   bind(&debug_hook);
-  CallDebugOnFunctionCall(function, new_target, expected, actual);
+  CallDebugOnFunctionCall(function, new_target, expected_parameter_count,
+                          actual_parameter_count);
   jmp(&continue_after_hook, Label::kNear);
 
   bind(&done);
 }
 
-void MacroAssembler::InvokePrologue(const ParameterCount& expected,
-                                    const ParameterCount& actual, Label* done,
-                                    bool* definitely_mismatches,
-                                    InvokeFlag flag,
-                                    Label::Distance near_jump) {
-  bool definitely_matches = false;
-  *definitely_mismatches = false;
-  Label invoke;
-  if (expected.is_immediate()) {
-    DCHECK(actual.is_immediate());
-    Set(rax, actual.immediate());
-    if (expected.immediate() == actual.immediate()) {
-      definitely_matches = true;
-    } else {
-      if (expected.immediate() ==
-          SharedFunctionInfo::kDontAdaptArgumentsSentinel) {
-        // Don't worry about adapting arguments for built-ins that
-        // don't want that done. Skip adaption code by making it look
-        // like we have a match between expected and actual number of
-        // arguments.
-        definitely_matches = true;
-      } else {
-        *definitely_mismatches = true;
-        Set(rbx, expected.immediate());
-      }
-    }
-  } else {
-    if (actual.is_immediate()) {
-      // Expected is in register, actual is immediate. This is the
-      // case when we invoke function values without going through the
-      // IC mechanism.
-      Set(rax, actual.immediate());
-      cmpq(expected.reg(), Immediate(actual.immediate()));
-      j(equal, &invoke, Label::kNear);
-      DCHECK(expected.reg() == rbx);
-    } else if (expected.reg() != actual.reg()) {
-      // Both expected and actual are in (different) registers. This
-      // is the case when we invoke functions using call and apply.
-      cmpq(expected.reg(), actual.reg());
-      j(equal, &invoke, Label::kNear);
-      DCHECK(actual.reg() == rax);
-      DCHECK(expected.reg() == rbx);
-    } else {
-      definitely_matches = true;
-      Move(rax, actual.reg());
-    }
-  }
-
-  if (!definitely_matches) {
+void MacroAssembler::InvokePrologue(Register expected_parameter_count,
+                                    Register actual_parameter_count,
+                                    Label* done, InvokeFlag flag) {
+  if (expected_parameter_count != actual_parameter_count) {
+    Label regular_invoke;
+    // Both expected and actual are in (different) registers. This
+    // is the case when we invoke functions using call and apply.
+    cmpq(expected_parameter_count, actual_parameter_count);
+    j(equal, &regular_invoke, Label::kNear);
+    DCHECK_EQ(actual_parameter_count, rax);
+    DCHECK_EQ(expected_parameter_count, rbx);
     Handle<Code> adaptor = BUILTIN_CODE(isolate(), ArgumentsAdaptorTrampoline);
     if (flag == CALL_FUNCTION) {
       Call(adaptor, RelocInfo::CODE_TARGET);
-      if (!*definitely_mismatches) {
-        jmp(done, near_jump);
-      }
+      jmp(done, Label::kNear);
     } else {
       Jump(adaptor, RelocInfo::CODE_TARGET);
     }
-    bind(&invoke);
+    bind(&regular_invoke);
+  } else {
+    Move(rax, actual_parameter_count);
   }
 }
 
 void MacroAssembler::CallDebugOnFunctionCall(Register fun, Register new_target,
-                                             const ParameterCount& expected,
-                                             const ParameterCount& actual) {
+                                             Register expected_parameter_count,
+                                             Register actual_parameter_count) {
   FrameScope frame(this, has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
-  if (expected.is_reg()) {
-    SmiTag(expected.reg());
-    Push(expected.reg());
-  }
-  if (actual.is_reg()) {
-    SmiTag(actual.reg());
-    Push(actual.reg());
-    SmiUntag(actual.reg());
-  }
+
+  SmiTag(expected_parameter_count);
+  Push(expected_parameter_count);
+
+  SmiTag(actual_parameter_count);
+  Push(actual_parameter_count);
+  SmiUntag(actual_parameter_count);
+
   if (new_target.is_valid()) {
     Push(new_target);
   }
   Push(fun);
   Push(fun);
-  Push(StackArgumentsAccessor(rbp, actual).GetReceiverOperand());
+  Push(
+      StackArgumentsAccessor(rbp, actual_parameter_count).GetReceiverOperand());
   CallRuntime(Runtime::kDebugOnFunctionCall);
   Pop(fun);
   if (new_target.is_valid()) {
     Pop(new_target);
   }
-  if (actual.is_reg()) {
-    Pop(actual.reg());
-    SmiUntag(actual.reg());
-  }
-  if (expected.is_reg()) {
-    Pop(expected.reg());
-    SmiUntag(expected.reg());
-  }
+  Pop(actual_parameter_count);
+  SmiUntag(actual_parameter_count);
+  Pop(expected_parameter_count);
+  SmiUntag(expected_parameter_count);
 }
 
 void TurboAssembler::StubPrologue(StackFrame::Type type) {
@@ -2727,8 +2592,13 @@ static const int kRegisterPassedArguments = 6;
 #endif
 
 void MacroAssembler::LoadNativeContextSlot(int index, Register dst) {
-  LoadTaggedPointerField(dst, NativeContextOperand());
-  LoadTaggedPointerField(dst, ContextOperand(dst, index));
+  // Load native context.
+  LoadMap(dst, rsi);
+  LoadTaggedPointerField(
+      dst,
+      FieldOperand(dst, Map::kConstructorOrBackPointerOrNativeContextOffset));
+  // Load value from native context.
+  LoadTaggedPointerField(dst, Operand(dst, Context::SlotOffset(index)));
 }
 
 int TurboAssembler::ArgumentStackSlotsForCFunctionCall(int num_arguments) {
@@ -2849,6 +2719,8 @@ void TurboAssembler::CallForDeoptimization(Address target, int deopt_id) {
   call(target, RelocInfo::RUNTIME_ENTRY);
 }
 
+void TurboAssembler::Trap() { int3(); }
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/x64/macro-assembler-x64.h b/deps/v8/src/codegen/x64/macro-assembler-x64.h
index f38da45788c162..84244ea4559cba 100644
--- a/deps/v8/src/codegen/x64/macro-assembler-x64.h
+++ b/deps/v8/src/codegen/x64/macro-assembler-x64.h
@@ -51,12 +51,6 @@ class StackArgumentsAccessor {
         extra_displacement_to_last_argument_(
             extra_displacement_to_last_argument) {}
 
-  StackArgumentsAccessor(Register base_reg,
-                         const ParameterCount& parameter_count,
-                         StackArgumentsAccessorReceiverMode receiver_mode =
-                             ARGUMENTS_CONTAIN_RECEIVER,
-                         int extra_displacement_to_last_argument = 0);
-
   Operand GetArgumentOperand(int index);
   Operand GetReceiverOperand() {
     DCHECK(receiver_mode_ == ARGUMENTS_CONTAIN_RECEIVER);
@@ -80,6 +74,7 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   template <typename Dst, typename... Args>
   struct AvxHelper {
     Assembler* assm;
+    base::Optional<CpuFeature> feature = base::nullopt;
     // Call a method where the AVX version expects the dst argument to be
     // duplicated.
     template <void (Assembler::*avx)(Dst, Dst, Args...),
@@ -88,6 +83,10 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
       if (CpuFeatures::IsSupported(AVX)) {
         CpuFeatureScope scope(assm, AVX);
         (assm->*avx)(dst, dst, args...);
+      } else if (feature.has_value()) {
+        DCHECK(CpuFeatures::IsSupported(*feature));
+        CpuFeatureScope scope(assm, *feature);
+        (assm->*no_avx)(dst, args...);
       } else {
         (assm->*no_avx)(dst, args...);
       }
@@ -100,6 +99,10 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
       if (CpuFeatures::IsSupported(AVX)) {
         CpuFeatureScope scope(assm, AVX);
         (assm->*avx)(dst, args...);
+      } else if (feature.has_value()) {
+        DCHECK(CpuFeatures::IsSupported(*feature));
+        CpuFeatureScope scope(assm, *feature);
+        (assm->*no_avx)(dst, args...);
       } else {
         (assm->*no_avx)(dst, args...);
       }
@@ -113,9 +116,36 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
         .template emit<&Assembler::v##name, &Assembler::name>(dst, args...); \
   }
 
+#define AVX_OP_SSE3(macro_name, name)                                        \
+  template <typename Dst, typename... Args>                                  \
+  void macro_name(Dst dst, Args... args) {                                   \
+    AvxHelper<Dst, Args...>{this, base::Optional<CpuFeature>(SSE3)}          \
+        .template emit<&Assembler::v##name, &Assembler::name>(dst, args...); \
+  }
+
+#define AVX_OP_SSSE3(macro_name, name)                                       \
+  template <typename Dst, typename... Args>                                  \
+  void macro_name(Dst dst, Args... args) {                                   \
+    AvxHelper<Dst, Args...>{this, base::Optional<CpuFeature>(SSSE3)}         \
+        .template emit<&Assembler::v##name, &Assembler::name>(dst, args...); \
+  }
+
+#define AVX_OP_SSE4_1(macro_name, name)                                      \
+  template <typename Dst, typename... Args>                                  \
+  void macro_name(Dst dst, Args... args) {                                   \
+    AvxHelper<Dst, Args...>{this, base::Optional<CpuFeature>(SSE4_1)}        \
+        .template emit<&Assembler::v##name, &Assembler::name>(dst, args...); \
+  }
+#define AVX_OP_SSE4_2(macro_name, name)                                      \
+  template <typename Dst, typename... Args>                                  \
+  void macro_name(Dst dst, Args... args) {                                   \
+    AvxHelper<Dst, Args...>{this, base::Optional<CpuFeature>(SSE4_2)}        \
+        .template emit<&Assembler::v##name, &Assembler::name>(dst, args...); \
+  }
   AVX_OP(Subsd, subsd)
   AVX_OP(Divss, divss)
   AVX_OP(Divsd, divsd)
+  AVX_OP(Orps, orps)
   AVX_OP(Xorps, xorps)
   AVX_OP(Xorpd, xorpd)
   AVX_OP(Movd, movd)
@@ -135,6 +165,7 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_OP(Andps, andps)
   AVX_OP(Andnps, andnps)
   AVX_OP(Andpd, andpd)
+  AVX_OP(Andnpd, andnpd)
   AVX_OP(Orpd, orpd)
   AVX_OP(Cmpeqps, cmpeqps)
   AVX_OP(Cmpltps, cmpltps)
@@ -152,26 +183,70 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_OP(Roundsd, roundsd)
   AVX_OP(Sqrtss, sqrtss)
   AVX_OP(Sqrtsd, sqrtsd)
+  AVX_OP(Sqrtps, sqrtps)
   AVX_OP(Sqrtpd, sqrtpd)
   AVX_OP(Ucomiss, ucomiss)
   AVX_OP(Ucomisd, ucomisd)
-  AVX_OP(Pshufb, pshufb)
   AVX_OP(Paddusb, paddusb)
-  AVX_OP(Psignd, psignd)
   AVX_OP(Pand, pand)
   AVX_OP(Por, por)
   AVX_OP(Pxor, pxor)
   AVX_OP(Psubd, psubd)
+  AVX_OP(Psubq, psubq)
   AVX_OP(Pslld, pslld)
+  AVX_OP(Pavgb, pavgb)
+  AVX_OP(Pavgw, pavgw)
   AVX_OP(Psrad, psrad)
   AVX_OP(Psrld, psrld)
   AVX_OP(Paddd, paddd)
-  AVX_OP(Pmulld, pmulld)
-  AVX_OP(Pminsd, pminsd)
-  AVX_OP(Pminud, pminud)
-  AVX_OP(Pmaxsd, pmaxsd)
-  AVX_OP(Pmaxud, pmaxud)
+  AVX_OP(Paddq, paddq)
   AVX_OP(Pcmpgtd, pcmpgtd)
+  AVX_OP(Pmuludq, pmuludq)
+  AVX_OP(Addpd, addpd)
+  AVX_OP(Subpd, subpd)
+  AVX_OP(Mulpd, mulpd)
+  AVX_OP(Minps, minps)
+  AVX_OP(Minpd, minpd)
+  AVX_OP(Divpd, divpd)
+  AVX_OP(Maxps, maxps)
+  AVX_OP(Maxpd, maxpd)
+  AVX_OP(Shufps, shufps)
+  AVX_OP(Cvtdq2ps, cvtdq2ps)
+  AVX_OP(Rcpps, rcpps)
+  AVX_OP(Rsqrtps, rsqrtps)
+  AVX_OP(Addps, addps)
+  AVX_OP(Haddps, haddps)
+  AVX_OP(Subps, subps)
+  AVX_OP(Mulps, mulps)
+  AVX_OP(Divps, divps)
+  AVX_OP(Pshuflw, pshuflw)
+  AVX_OP(Punpcklqdq, punpcklqdq)
+  AVX_OP(Pshufd, pshufd)
+  AVX_OP(Cmpps, cmpps)
+  AVX_OP(Cmppd, cmppd)
+  AVX_OP(Movlhps, movlhps)
+  AVX_OP_SSE3(Movddup, movddup)
+  AVX_OP_SSSE3(Pshufb, pshufb)
+  AVX_OP_SSSE3(Psignd, psignd)
+  AVX_OP_SSSE3(Palignr, palignr)
+  AVX_OP_SSE4_1(Pcmpeqq, pcmpeqq)
+  AVX_OP_SSE4_1(Pmulld, pmulld)
+  AVX_OP_SSE4_1(Pminsd, pminsd)
+  AVX_OP_SSE4_1(Pminud, pminud)
+  AVX_OP_SSE4_1(Pmaxsd, pmaxsd)
+  AVX_OP_SSE4_1(Pmaxud, pmaxud)
+  AVX_OP_SSE4_1(Extractps, extractps)
+  AVX_OP_SSE4_1(Insertps, insertps)
+  AVX_OP_SSE4_1(Pinsrq, pinsrq)
+  AVX_OP_SSE4_1(Pblendw, pblendw)
+  AVX_OP_SSE4_1(Pmovsxbw, pmovsxbw)
+  AVX_OP_SSE4_1(Pmovsxwd, pmovsxwd)
+  AVX_OP_SSE4_1(Pmovsxdq, pmovsxdq)
+  AVX_OP_SSE4_1(Pmovzxbw, pmovzxbw)
+  AVX_OP_SSE4_1(Pmovzxwd, pmovzxwd)
+  AVX_OP_SSE4_1(Pmovzxdq, pmovzxdq)
+  AVX_OP_SSE4_1(Pextrq, pextrq)
+  AVX_OP_SSE4_2(Pcmpgtq, pcmpgtq)
 
 #undef AVX_OP
 
@@ -238,12 +313,6 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void Cvttss2si(Register dst, Operand src);
   void Cvttss2siq(Register dst, XMMRegister src);
   void Cvttss2siq(Register dst, Operand src);
-  void Cvtqsi2ss(XMMRegister dst, Register src);
-  void Cvtqsi2ss(XMMRegister dst, Operand src);
-  void Cvtqsi2sd(XMMRegister dst, Register src);
-  void Cvtqsi2sd(XMMRegister dst, Operand src);
-  void Cvtlsi2ss(XMMRegister dst, Register src);
-  void Cvtlsi2ss(XMMRegister dst, Operand src);
   void Cvtlui2ss(XMMRegister dst, Register src);
   void Cvtlui2ss(XMMRegister dst, Operand src);
   void Cvtlui2sd(XMMRegister dst, Register src);
@@ -257,9 +326,17 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void Cvttss2uiq(Register dst, Operand src, Label* fail = nullptr);
   void Cvttss2uiq(Register dst, XMMRegister src, Label* fail = nullptr);
 
-  // cvtsi2sd instruction only writes to the low 64-bit of dst register, which
-  // hinders register renaming and makes dependence chains longer. So we use
-  // xorpd to clear the dst register before cvtsi2sd to solve this issue.
+  // cvtsi2sd and cvtsi2ss instructions only write to the low 64/32-bit of dst
+  // register, which hinders register renaming and makes dependence chains
+  // longer. So we use xorpd to clear the dst register before cvtsi2sd for
+  // non-AVX and a scratch XMM register as first src for AVX to solve this
+  // issue.
+  void Cvtqsi2ss(XMMRegister dst, Register src);
+  void Cvtqsi2ss(XMMRegister dst, Operand src);
+  void Cvtqsi2sd(XMMRegister dst, Register src);
+  void Cvtqsi2sd(XMMRegister dst, Operand src);
+  void Cvtlsi2ss(XMMRegister dst, Register src);
+  void Cvtlsi2ss(XMMRegister dst, Operand src);
   void Cvtlsi2sd(XMMRegister dst, Register src);
   void Cvtlsi2sd(XMMRegister dst, Operand src);
 
@@ -294,6 +371,8 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
     j(less, dest);
   }
 
+  void LoadMap(Register destination, Register object);
+
   void Move(Register dst, Smi source);
 
   void Move(Operand dst, Smi source) {
@@ -383,6 +462,8 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 
   void CallForDeoptimization(Address target, int deopt_id);
 
+  void Trap() override;
+
   // Non-SSE2 instructions.
   void Pextrd(Register dst, XMMRegister src, int8_t imm8);
   void Pextrw(Register dst, XMMRegister src, int8_t imm8);
@@ -399,8 +480,6 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void Pslld(XMMRegister dst, byte imm8);
   void Psrld(XMMRegister dst, byte imm8);
 
-  void Pshufd(XMMRegister dst, XMMRegister src, uint8_t shuffle);
-
   void CompareRoot(Register with, RootIndex index);
   void CompareRoot(Operand with, RootIndex index);
 
@@ -452,16 +531,12 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 
   // Removes current frame and its arguments from the stack preserving the
   // arguments and a return address pushed to the stack for the next call.  Both
-  // |callee_args_count| and |caller_args_count_reg| do not include receiver.
-  // |callee_args_count| is not modified, |caller_args_count_reg| is trashed.
-  void PrepareForTailCall(const ParameterCount& callee_args_count,
-                          Register caller_args_count_reg, Register scratch0,
+  // |callee_args_count| and |caller_args_count| do not include receiver.
+  // |callee_args_count| is not modified. |caller_args_count| is trashed.
+  void PrepareForTailCall(Register callee_args_count,
+                          Register caller_args_count, Register scratch0,
                           Register scratch1);
 
-  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
-  // builtin for the target runtime function and uses an indirect call.
-  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
-
   void InitializeRootRegister() {
     ExternalReference isolate_root = ExternalReference::isolate_root(isolate());
     Move(kRootRegister, isolate_root);
@@ -519,10 +594,7 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void LoadTaggedPointerField(Register destination, Operand field_operand);
 
   // Loads a field containing any tagged value and decompresses it if necessary.
-  // When pointer compression is enabled, uses |scratch| to decompress the
-  // value.
-  void LoadAnyTaggedField(Register destination, Operand field_operand,
-                          Register scratch = kScratchRegister);
+  void LoadAnyTaggedField(Register destination, Operand field_operand);
 
   // Loads a field containing a HeapObject, decompresses it if necessary and
   // pushes full pointer to the stack. When pointer compression is enabled,
@@ -531,9 +603,8 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 
   // Loads a field containing any tagged value, decompresses it if necessary and
   // pushes the full pointer to the stack. When pointer compression is enabled,
-  // uses |scratch1| and |scratch2| to decompress the value.
-  void PushTaggedAnyField(Operand field_operand, Register scratch1,
-                          Register scratch2);
+  // uses |scratch| to decompress the value.
+  void PushTaggedAnyField(Operand field_operand, Register scratch);
 
   // Loads a field containing smi value and untags it.
   void SmiUntagField(Register dst, Operand src);
@@ -545,16 +616,9 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 
   // The following macros work even when pointer compression is not enabled.
   void DecompressTaggedSigned(Register destination, Operand field_operand);
-  void DecompressTaggedSigned(Register destination, Register source);
   void DecompressTaggedPointer(Register destination, Operand field_operand);
   void DecompressTaggedPointer(Register destination, Register source);
-  // Auxiliary function used by DecompressAnyTagged to perform the actual
-  // decompression. Assumes destination is already signed extended.
-  void DecompressRegisterAnyTagged(Register destination, Register scratch);
-  void DecompressAnyTagged(Register destination, Operand field_operand,
-                           Register scratch = kScratchRegister);
-  void DecompressAnyTagged(Register destination, Register source,
-                           Register scratch = kScratchRegister);
+  void DecompressAnyTagged(Register destination, Operand field_operand);
 
  protected:
   static const int kSmiShift = kSmiTagSize + kSmiShiftSize;
@@ -672,22 +736,22 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
 
   // Invoke the JavaScript function code by either calling or jumping.
   void InvokeFunctionCode(Register function, Register new_target,
-                          const ParameterCount& expected,
-                          const ParameterCount& actual, InvokeFlag flag);
+                          Register expected_parameter_count,
+                          Register actual_parameter_count, InvokeFlag flag);
 
   // On function call, call into the debugger.
   void CallDebugOnFunctionCall(Register fun, Register new_target,
-                               const ParameterCount& expected,
-                               const ParameterCount& actual);
+                               Register expected_parameter_count,
+                               Register actual_parameter_count);
 
   // Invoke the JavaScript function in the given register. Changes the
   // current context to the context in the function before invoking.
   void InvokeFunction(Register function, Register new_target,
-                      const ParameterCount& actual, InvokeFlag flag);
+                      Register actual_parameter_count, InvokeFlag flag);
 
   void InvokeFunction(Register function, Register new_target,
-                      const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
+                      Register expected_parameter_count,
+                      Register actual_parameter_count, InvokeFlag flag);
 
   // ---------------------------------------------------------------------------
   // Conversions between tagged smi values and non-tagged integer values.
@@ -893,10 +957,9 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   static const int kNumSafepointSavedRegisters = 12;
 
   // Helper functions for generating invokes.
-  void InvokePrologue(const ParameterCount& expected,
-                      const ParameterCount& actual, Label* done,
-                      bool* definitely_mismatches, InvokeFlag flag,
-                      Label::Distance near_jump);
+  void InvokePrologue(Register expected_parameter_count,
+                      Register actual_parameter_count, Label* done,
+                      InvokeFlag flag);
 
   void EnterExitFramePrologue(bool save_rax, StackFrame::Type frame_type);
 
@@ -932,19 +995,6 @@ inline Operand FieldOperand(Register object, Register index, ScaleFactor scale,
   return Operand(object, index, scale, offset - kHeapObjectTag);
 }
 
-inline Operand ContextOperand(Register context, int index) {
-  return Operand(context, Context::SlotOffset(index));
-}
-
-inline Operand ContextOperand(Register context, Register index) {
-  return Operand(context, index, times_system_pointer_size,
-                 Context::SlotOffset(0));
-}
-
-inline Operand NativeContextOperand() {
-  return ContextOperand(rsi, Context::NATIVE_CONTEXT_INDEX);
-}
-
 // Provides access to exit frame stack space (not GCed).
 inline Operand StackSpaceOperand(int index) {
 #ifdef V8_TARGET_OS_WIN
diff --git a/deps/v8/src/codegen/x64/register-x64.h b/deps/v8/src/codegen/x64/register-x64.h
index 181da9d9f3a20d..39e8c02b3fead4 100644
--- a/deps/v8/src/codegen/x64/register-x64.h
+++ b/deps/v8/src/codegen/x64/register-x64.h
@@ -52,13 +52,13 @@ enum RegisterCode {
 
 class Register : public RegisterBase<Register, kRegAfterLast> {
  public:
-  bool is_byte_register() const { return reg_code_ <= 3; }
+  bool is_byte_register() const { return code() <= 3; }
   // Return the high bit of the register code as a 0 or 1.  Used often
   // when constructing the REX prefix byte.
-  int high_bit() const { return reg_code_ >> 3; }
+  int high_bit() const { return code() >> 3; }
   // Return the 3 low bits of the register code.  Used when encoding registers
   // in modR/M, SIB, and opcode bytes.
-  int low_bits() const { return reg_code_ & 0x7; }
+  int low_bits() const { return code() & 0x7; }
 
  private:
   friend class RegisterBase<Register, kRegAfterLast>;
@@ -70,7 +70,7 @@ static_assert(sizeof(Register) == sizeof(int),
               "Register can efficiently be passed by value");
 
 #define DECLARE_REGISTER(R) \
-  constexpr Register R = Register::from_code<kRegCode_##R>();
+  constexpr Register R = Register::from_code(kRegCode_##R);
 GENERAL_REGISTERS(DECLARE_REGISTER)
 #undef DECLARE_REGISTER
 constexpr Register no_reg = Register::no_reg();
@@ -78,10 +78,9 @@ constexpr Register no_reg = Register::no_reg();
 constexpr int kNumRegs = 16;
 
 constexpr RegList kJSCallerSaved =
-    Register::ListOf<rax, rcx, rdx,
+    Register::ListOf(rax, rcx, rdx,
                      rbx,  // used as a caller-saved register in JavaScript code
-                     rdi   // callee function
-                     >();
+                     rdi);  // callee function
 
 constexpr int kNumJSCallerSaved = 5;
 
@@ -155,10 +154,10 @@ class XMMRegister : public RegisterBase<XMMRegister, kDoubleAfterLast> {
  public:
   // Return the high bit of the register code as a 0 or 1.  Used often
   // when constructing the REX prefix byte.
-  int high_bit() const { return reg_code_ >> 3; }
+  int high_bit() const { return code() >> 3; }
   // Return the 3 low bits of the register code.  Used when encoding registers
   // in modR/M, SIB, and opcode bytes.
-  int low_bits() const { return reg_code_ & 0x7; }
+  int low_bits() const { return code() & 0x7; }
 
  private:
   friend class RegisterBase<XMMRegister, kDoubleAfterLast>;
@@ -176,7 +175,7 @@ using DoubleRegister = XMMRegister;
 using Simd128Register = XMMRegister;
 
 #define DECLARE_REGISTER(R) \
-  constexpr DoubleRegister R = DoubleRegister::from_code<kDoubleCode_##R>();
+  constexpr DoubleRegister R = DoubleRegister::from_code(kDoubleCode_##R);
 DOUBLE_REGISTERS(DECLARE_REGISTER)
 #undef DECLARE_REGISTER
 constexpr DoubleRegister no_dreg = DoubleRegister::no_reg();
diff --git a/deps/v8/src/codegen/x64/sse-instr.h b/deps/v8/src/codegen/x64/sse-instr.h
index 8af06ae92c8d63..6fba5c070cba12 100644
--- a/deps/v8/src/codegen/x64/sse-instr.h
+++ b/deps/v8/src/codegen/x64/sse-instr.h
@@ -5,6 +5,36 @@
 #ifndef V8_CODEGEN_X64_SSE_INSTR_H_
 #define V8_CODEGEN_X64_SSE_INSTR_H_
 
+// SSE instructions whose AVX version has two operands.
+#define SSE_UNOP_INSTRUCTION_LIST(V) \
+  V(sqrtps, 0F, 51)                  \
+  V(rsqrtps, 0F, 52)                 \
+  V(rcpps, 0F, 53)                   \
+  V(cvtdq2ps, 0F, 5B)
+
+// SSE instructions whose AVX version has three operands.
+#define SSE_BINOP_INSTRUCTION_LIST(V) \
+  V(andps, 0F, 54)                    \
+  V(andnps, 0F, 55)                   \
+  V(orps, 0F, 56)                     \
+  V(xorps, 0F, 57)                    \
+  V(addps, 0F, 58)                    \
+  V(mulps, 0F, 59)                    \
+  V(subps, 0F, 5C)                    \
+  V(minps, 0F, 5D)                    \
+  V(divps, 0F, 5E)                    \
+  V(maxps, 0F, 5F)
+
+// Instructions dealing with scalar single-precision values.
+#define SSE_INSTRUCTION_LIST_SS(V) \
+  V(sqrtss, F3, 0F, 51)            \
+  V(addss, F3, 0F, 58)             \
+  V(mulss, F3, 0F, 59)             \
+  V(subss, F3, 0F, 5C)             \
+  V(minss, F3, 0F, 5D)             \
+  V(divss, F3, 0F, 5E)             \
+  V(maxss, F3, 0F, 5F)
+
 #define SSE2_INSTRUCTION_LIST(V) \
   V(sqrtpd, 66, 0F, 51)          \
   V(andnpd, 66, 0F, 55)          \
@@ -49,8 +79,10 @@
   V(psllw, 66, 0F, F1)           \
   V(pslld, 66, 0F, F2)           \
   V(psllq, 66, 0F, F3)           \
+  V(pavgb, 66, 0F, E0)           \
   V(psraw, 66, 0F, E1)           \
   V(psrad, 66, 0F, E2)           \
+  V(pavgw, 66, 0F, E3)           \
   V(psrlw, 66, 0F, D1)           \
   V(psrld, 66, 0F, D2)           \
   V(psrlq, 66, 0F, D3)           \
@@ -66,6 +98,28 @@
   V(por, 66, 0F, EB)             \
   V(pxor, 66, 0F, EF)
 
+// SSE2 shift instructions with an immediate operand. The last element is the
+// extension to the opcode.
+#define SSE2_INSTRUCTION_LIST_SHIFT_IMM(V) \
+  V(psrlw, 66, 0F, 71, 2)                  \
+  V(psrld, 66, 0F, 72, 2)                  \
+  V(psrlq, 66, 0F, 73, 2)                  \
+  V(psraw, 66, 0F, 71, 4)                  \
+  V(psrad, 66, 0F, 72, 4)                  \
+  V(psllw, 66, 0F, 71, 6)                  \
+  V(pslld, 66, 0F, 72, 6)                  \
+  V(psllq, 66, 0F, 73, 6)
+
+// Instructions dealing with scalar double-precision values.
+#define SSE2_INSTRUCTION_LIST_SD(V) \
+  V(sqrtsd, F2, 0F, 51)             \
+  V(addsd, F2, 0F, 58)              \
+  V(mulsd, F2, 0F, 59)              \
+  V(subsd, F2, 0F, 5C)              \
+  V(minsd, F2, 0F, 5D)              \
+  V(divsd, F2, 0F, 5E)              \
+  V(maxsd, F2, 0F, 5F)
+
 #define SSSE3_INSTRUCTION_LIST(V) \
   V(pabsb, 66, 0F, 38, 1C)        \
   V(pabsw, 66, 0F, 38, 1D)        \
@@ -78,14 +132,9 @@
   V(psignd, 66, 0F, 38, 0A)
 
 #define SSE4_INSTRUCTION_LIST(V) \
-  V(blendvpd, 66, 0F, 38, 15)    \
   V(pcmpeqq, 66, 0F, 38, 29)     \
   V(ptest, 66, 0F, 38, 17)       \
-  V(pmovsxbw, 66, 0F, 38, 20)    \
-  V(pmovsxwd, 66, 0F, 38, 23)    \
   V(packusdw, 66, 0F, 38, 2B)    \
-  V(pmovzxbw, 66, 0F, 38, 30)    \
-  V(pmovzxwd, 66, 0F, 38, 33)    \
   V(pminsb, 66, 0F, 38, 38)      \
   V(pminsd, 66, 0F, 38, 39)      \
   V(pminuw, 66, 0F, 38, 3A)      \
@@ -96,6 +145,21 @@
   V(pmaxud, 66, 0F, 38, 3F)      \
   V(pmulld, 66, 0F, 38, 40)
 
+// SSE instructions whose AVX version has two operands.
+#define SSE4_PMOV_INSTRUCTION_LIST(V) \
+  V(pmovsxbw, 66, 0F, 38, 20)         \
+  V(pmovsxwd, 66, 0F, 38, 23)         \
+  V(pmovsxdq, 66, 0F, 38, 25)         \
+  V(pmovzxbw, 66, 0F, 38, 30)         \
+  V(pmovzxwd, 66, 0F, 38, 33)         \
+  V(pmovzxdq, 66, 0F, 38, 35)
+
+#define SSE4_EXTRACT_INSTRUCTION_LIST(V) \
+  V(extractps, 66, 0F, 3A, 17)           \
+  V(pextrb, 66, 0F, 3A, 14)              \
+  V(pextrw, 66, 0F, 3A, 15)              \
+  V(pextrd, 66, 0F, 3A, 16)
+
 #define SSE4_2_INSTRUCTION_LIST(V) V(pcmpgtq, 66, 0F, 38, 37)
 
 #endif  // V8_CODEGEN_X64_SSE_INSTR_H_
diff --git a/deps/v8/src/common/assert-scope.cc b/deps/v8/src/common/assert-scope.cc
index 5138ce7122129d..ba9a6f0875aca8 100644
--- a/deps/v8/src/common/assert-scope.cc
+++ b/deps/v8/src/common/assert-scope.cc
@@ -94,7 +94,7 @@ bool PerThreadAssertScope<kType, kAllow>::IsAllowed() {
 
 namespace {
 template <PerIsolateAssertType kType>
-using DataBit = BitField<bool, kType, 1>;
+using DataBit = base::BitField<bool, kType, 1>;
 }
 
 template <PerIsolateAssertType kType, bool kAllow>
diff --git a/deps/v8/src/common/globals.h b/deps/v8/src/common/globals.h
index 9d5771f6946380..44441e0fc995ae 100644
--- a/deps/v8/src/common/globals.h
+++ b/deps/v8/src/common/globals.h
@@ -29,6 +29,10 @@ class RecursiveMutex;
 
 namespace internal {
 
+constexpr int KB = 1024;
+constexpr int MB = KB * 1024;
+constexpr int GB = MB * 1024;
+
 // Determine whether we are running in a simulated environment.
 // Setting USE_SIMULATOR explicitly from the build script will force
 // the use of a simulated environment.
@@ -75,9 +79,20 @@ namespace internal {
 // Minimum stack size in KB required by compilers.
 constexpr int kStackSpaceRequiredForCompilation = 40;
 
+// In order to emit more efficient stack checks in optimized code,
+// deoptimization may implicitly exceed the V8 stack limit by this many bytes.
+// Stack checks in functions with `difference between optimized and unoptimized
+// stack frame sizes <= slack` can simply emit the simple stack check.
+constexpr int kStackLimitSlackForDeoptimizationInBytes = 256;
+
+// Sanity-check, assuming that we aim for a real OS stack size of at least 1MB.
+STATIC_ASSERT(V8_DEFAULT_STACK_SIZE_KB* KB +
+                  kStackLimitSlackForDeoptimizationInBytes <=
+              MB);
+
 // Determine whether double field unboxing feature is enabled.
 #if V8_TARGET_ARCH_64_BIT && !defined(V8_COMPRESS_POINTERS)
-#define V8_DOUBLE_FIELDS_UNBOXING true
+#define V8_DOUBLE_FIELDS_UNBOXING false
 #else
 #define V8_DOUBLE_FIELDS_UNBOXING false
 #endif
@@ -123,9 +138,6 @@ using byte = uint8_t;
 // -----------------------------------------------------------------------------
 // Constants
 
-constexpr int KB = 1024;
-constexpr int MB = KB * KB;
-constexpr int GB = KB * KB * KB;
 constexpr int kMaxInt = 0x7FFFFFFF;
 constexpr int kMinInt = -kMaxInt - 1;
 constexpr int kMaxInt8 = (1 << 7) - 1;
@@ -283,6 +295,8 @@ constexpr int kMaxRegularHeapObjectSize = (1 << (kPageSizeBits - 1));
 constexpr int kBitsPerByte = 8;
 constexpr int kBitsPerByteLog2 = 3;
 constexpr int kBitsPerSystemPointer = kSystemPointerSize * kBitsPerByte;
+constexpr int kBitsPerSystemPointerLog2 =
+    kSystemPointerSizeLog2 + kBitsPerByteLog2;
 constexpr int kBitsPerInt = kIntSize * kBitsPerByte;
 
 // IEEE 754 single precision floating point number bit layout.
@@ -400,7 +414,6 @@ enum TypeofMode : int { INSIDE_TYPEOF, NOT_INSIDE_TYPEOF };
 // Enums used by CEntry.
 enum SaveFPRegsMode { kDontSaveFPRegs, kSaveFPRegs };
 enum ArgvMode { kArgvOnStack, kArgvInRegister };
-enum FunctionDescriptorMode { kNoFunctionDescriptor, kHasFunctionDescriptor };
 
 // This constant is used as an undefined value when passing source positions.
 constexpr int kNoSourcePosition = -1;
@@ -599,7 +612,6 @@ class JSReceiver;
 class JSArray;
 class JSFunction;
 class JSObject;
-class LargeObjectSpace;
 class MacroAssembler;
 class Map;
 class MapSpace;
@@ -617,6 +629,7 @@ class NewSpace;
 class NewLargeObjectSpace;
 class NumberDictionary;
 class Object;
+class OldLargeObjectSpace;
 template <HeapObjectReferenceType kRefType, typename StorageType>
 class TaggedImpl;
 class StrongTaggedValue;
@@ -629,7 +642,6 @@ class FullObjectSlot;
 class FullMaybeObjectSlot;
 class FullHeapObjectSlot;
 class OldSpace;
-class ParameterCount;
 class ReadOnlySpace;
 class RelocInfo;
 class Scope;
@@ -745,7 +757,12 @@ inline std::ostream& operator<<(std::ostream& os, AllocationType kind) {
 }
 
 // TODO(ishell): review and rename kWordAligned to kTaggedAligned.
-enum AllocationAlignment { kWordAligned, kDoubleAligned, kDoubleUnaligned };
+enum AllocationAlignment {
+  kWordAligned,
+  kDoubleAligned,
+  kDoubleUnaligned,
+  kCodeAligned
+};
 
 enum class AccessMode { ATOMIC, NON_ATOMIC };
 
@@ -758,6 +775,17 @@ enum MinimumCapacity {
 
 enum GarbageCollector { SCAVENGER, MARK_COMPACTOR, MINOR_MARK_COMPACTOR };
 
+enum class LocalSpaceKind {
+  kNone,
+  kOffThreadSpace,
+  kCompactionSpaceForScavenge,
+  kCompactionSpaceForMarkCompact,
+  kCompactionSpaceForMinorMarkCompact,
+
+  kFirstCompactionSpace = kCompactionSpaceForScavenge,
+  kLastCompactionSpace = kCompactionSpaceForMinorMarkCompact,
+};
+
 enum Executability { NOT_EXECUTABLE, EXECUTABLE };
 
 enum VisitMode {
@@ -767,6 +795,7 @@ enum VisitMode {
   VISIT_ALL_IN_SCAVENGE,
   VISIT_ALL_IN_SWEEP_NEWSPACE,
   VISIT_ONLY_STRONG,
+  VISIT_ONLY_STRONG_IGNORE_STACK,
   VISIT_FOR_SERIALIZATION,
 };
 
@@ -776,6 +805,12 @@ enum class BytecodeFlushMode {
   kStressFlushBytecode,
 };
 
+// Indicates whether a script should be parsed and compiled in REPL mode.
+enum class REPLMode {
+  kYes,
+  kNo,
+};
+
 // Flag indicating whether code is built into the VM (one of the natives files).
 enum NativesFlag { NOT_NATIVES_CODE, EXTENSION_CODE, INSPECTOR_CODE };
 
@@ -1034,7 +1069,10 @@ constexpr uint64_t kHoleNanInt64 =
     (static_cast<uint64_t>(kHoleNanUpper32) << 32) | kHoleNanLower32;
 
 // ES6 section 20.1.2.6 Number.MAX_SAFE_INTEGER
-constexpr double kMaxSafeInteger = 9007199254740991.0;  // 2^53-1
+constexpr uint64_t kMaxSafeIntegerUint64 = 9007199254740991;  // 2^53-1
+constexpr double kMaxSafeInteger = static_cast<double>(kMaxSafeIntegerUint64);
+
+constexpr double kMaxUInt32Double = double{kMaxUInt32};
 
 // The order of this enum has to be kept in sync with the predicates below.
 enum class VariableMode : uint8_t {
@@ -1182,7 +1220,17 @@ enum VariableLocation : uint8_t {
   // A named slot in a module's export table.
   MODULE,
 
-  kLastVariableLocation = MODULE
+  // An indexed slot in a script context. index() is the variable
+  // index in the context object on the heap, starting at 0.
+  // Important: REPL_GLOBAL variables from different scripts with the
+  //            same name share a single script context slot. Every
+  //            script context will reserve a slot, but only one will be used.
+  // REPL_GLOBAL variables are stored in script contexts, but accessed like
+  // globals, i.e. they always require a lookup at runtime to find the right
+  // script context.
+  REPL_GLOBAL,
+
+  kLastVariableLocation = REPL_GLOBAL
 };
 
 // ES6 specifies declarative environment records with mutable and immutable
@@ -1585,6 +1633,13 @@ V8_INLINE bool operator!(ExceptionStatus status) {
   return !static_cast<bool>(status);
 }
 
+enum class TraceRetainingPathMode { kEnabled, kDisabled };
+
+// Used in the ScopeInfo flags fields for the function name variable for named
+// function expressions, and for the receiver. Must be declared here so that it
+// can be used in Torque.
+enum class VariableAllocationInfo { NONE, STACK, CONTEXT, UNUSED };
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/common/message-template.h b/deps/v8/src/common/message-template.h
index 41af7b8f18a733..8c10c42b7b3814 100644
--- a/deps/v8/src/common/message-template.h
+++ b/deps/v8/src/common/message-template.h
@@ -65,6 +65,8 @@ namespace internal {
   T(ConstructorClassField, "Classes may not have a field named 'constructor'") \
   T(ConstructorNonCallable,                                                    \
     "Class constructor % cannot be invoked without 'new'")                     \
+  T(AnonymousConstructorNonCallable,                                           \
+    "Class constructors cannot be invoked without 'new'")                      \
   T(ConstructorNotFunction, "Constructor % requires 'new'")                    \
   T(ConstructorNotReceiver, "The .constructor property is not an object")      \
   T(CurrencyCode, "Currency code is required with currency style.")            \
@@ -111,8 +113,6 @@ namespace internal {
   T(MapperFunctionNonCallable, "flatMap mapper function is not callable")      \
   T(MethodCalledOnWrongObject,                                                 \
     "Method % called on a non-object or on a wrong type of object.")           \
-  T(MethodInvokedOnNullOrUndefined,                                            \
-    "Method invoked on undefined or null value.")                              \
   T(MethodInvokedOnWrongType, "Method invoked on an object that is not %.")    \
   T(NoAccess, "no access")                                                     \
   T(NonCallableInInstanceOfCheck,                                              \
@@ -270,6 +270,8 @@ namespace internal {
     "Cannot supply flags when constructing one RegExp from another")           \
   T(RegExpNonObject, "% getter called on non-object %")                        \
   T(RegExpNonRegExp, "% getter called on non-RegExp object")                   \
+  T(RegExpGlobalInvokedOnNonGlobal,                                            \
+    "% called with a non-global RegExp argument")                              \
   T(RelativeDateTimeFormatterBadParameters,                                    \
     "Incorrect RelativeDateTimeFormatter provided")                            \
   T(ResolverNotAFunction, "Promise resolver % is not a function")              \
@@ -288,6 +290,9 @@ namespace internal {
   T(StrictReadOnlyProperty,                                                    \
     "Cannot assign to read only property '%' of % '%'")                        \
   T(StrictCannotCreateProperty, "Cannot create property '%' on % '%'")         \
+  T(StringMatchAllNullOrUndefinedFlags,                                        \
+    "The .flags property of the argument to String.prototype.matchAll cannot " \
+    "be null or undefined")                                                    \
   T(SymbolIteratorInvalid,                                                     \
     "Result of the Symbol.iterator method is not an object")                   \
   T(SymbolAsyncIteratorInvalid,                                                \
diff --git a/deps/v8/src/common/ptr-compr-inl.h b/deps/v8/src/common/ptr-compr-inl.h
index 17239d15c2783a..75ea2e069fc3bb 100644
--- a/deps/v8/src/common/ptr-compr-inl.h
+++ b/deps/v8/src/common/ptr-compr-inl.h
@@ -19,12 +19,7 @@ V8_INLINE Tagged_t CompressTagged(Address tagged) {
   return static_cast<Tagged_t>(static_cast<uint32_t>(tagged));
 }
 
-// Calculates isolate root value from any on-heap address.
-template <typename TOnHeapAddress>
-V8_INLINE Address GetIsolateRoot(TOnHeapAddress on_heap_addr);
-
-template <>
-V8_INLINE Address GetIsolateRoot<Address>(Address on_heap_addr) {
+V8_INLINE Address GetIsolateRoot(Address on_heap_addr) {
   // We subtract 1 here in order to let the compiler generate addition of 32-bit
   // signed constant instead of 64-bit constant (the problem is that 2Gb looks
   // like a negative 32-bit value). It's correct because we will never use
@@ -32,8 +27,7 @@ V8_INLINE Address GetIsolateRoot<Address>(Address on_heap_addr) {
   return RoundDown<kPtrComprIsolateRootAlignment>(on_heap_addr);
 }
 
-template <>
-V8_INLINE Address GetIsolateRoot<Isolate*>(Isolate* isolate) {
+V8_INLINE Address GetIsolateRoot(const Isolate* isolate) {
   Address isolate_root = isolate->isolate_root();
 #ifdef V8_COMPRESS_POINTERS
   isolate_root = reinterpret_cast<Address>(V8_ASSUME_ALIGNED(
diff --git a/deps/v8/src/compiler-dispatcher/OWNERS b/deps/v8/src/compiler-dispatcher/OWNERS
index 9664a4857ca4e8..b71c01a3053b2a 100644
--- a/deps/v8/src/compiler-dispatcher/OWNERS
+++ b/deps/v8/src/compiler-dispatcher/OWNERS
@@ -1,7 +1,6 @@
 ahaas@chromium.org
 jkummerow@chromium.org
 leszeks@chromium.org
-mstarzinger@chromium.org
 rmcilroy@chromium.org
 
 # COMPONENT: Blink>JavaScript>Compiler
diff --git a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc
index 3d2342e9a22bf0..6fd1113689bf11 100644
--- a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc
+++ b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc
@@ -65,18 +65,19 @@ class OptimizingCompileDispatcher::CompileTask : public CancelableTask {
           worker_thread_runtime_call_stats_);
       RuntimeCallTimerScope runtimeTimer(
           runtime_call_stats_scope.Get(),
-          RuntimeCallCounterId::kRecompileConcurrent);
+          RuntimeCallCounterId::kOptimizeBackgroundDispatcherJob);
 
       TimerEventScope<TimerEventRecompileConcurrent> timer(isolate_);
       TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-                   "V8.RecompileConcurrent");
+                   "V8.OptimizeBackground");
 
       if (dispatcher_->recompilation_delay_ != 0) {
         base::OS::Sleep(base::TimeDelta::FromMilliseconds(
             dispatcher_->recompilation_delay_));
       }
 
-      dispatcher_->CompileNext(dispatcher_->NextInput(true));
+      dispatcher_->CompileNext(dispatcher_->NextInput(true),
+                               runtime_call_stats_scope.Get());
     }
     {
       base::MutexGuard lock_guard(&dispatcher_->ref_count_mutex_);
@@ -122,11 +123,12 @@ OptimizedCompilationJob* OptimizingCompileDispatcher::NextInput(
   return job;
 }
 
-void OptimizingCompileDispatcher::CompileNext(OptimizedCompilationJob* job) {
+void OptimizingCompileDispatcher::CompileNext(OptimizedCompilationJob* job,
+                                              RuntimeCallStats* stats) {
   if (!job) return;
 
   // The function may have already been optimized by OSR.  Simply continue.
-  CompilationJob::Status status = job->ExecuteJob();
+  CompilationJob::Status status = job->ExecuteJob(stats);
   USE(status);  // Prevent an unused-variable error.
 
   {
@@ -193,14 +195,10 @@ void OptimizingCompileDispatcher::Stop() {
     mode_ = COMPILE;
   }
 
-  if (recompilation_delay_ != 0) {
-    // At this point the optimizing compiler thread's event loop has stopped.
-    // There is no need for a mutex when reading input_queue_length_.
-    while (input_queue_length_ > 0) CompileNext(NextInput());
-    InstallOptimizedFunctions();
-  } else {
-    FlushOutputQueue(false);
-  }
+  // At this point the optimizing compiler thread's event loop has stopped.
+  // There is no need for a mutex when reading input_queue_length_.
+  DCHECK_EQ(input_queue_length_, 0);
+  FlushOutputQueue(false);
 }
 
 void OptimizingCompileDispatcher::InstallOptimizedFunctions() {
diff --git a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.h b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.h
index c1b92ff5c9b2cd..51803822d15353 100644
--- a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.h
+++ b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.h
@@ -19,6 +19,7 @@ namespace v8 {
 namespace internal {
 
 class OptimizedCompilationJob;
+class RuntimeCallStats;
 class SharedFunctionInfo;
 
 class V8_EXPORT_PRIVATE OptimizingCompileDispatcher {
@@ -57,7 +58,7 @@ class V8_EXPORT_PRIVATE OptimizingCompileDispatcher {
   enum ModeFlag { COMPILE, FLUSH };
 
   void FlushOutputQueue(bool restore_function_code);
-  void CompileNext(OptimizedCompilationJob* job);
+  void CompileNext(OptimizedCompilationJob* job, RuntimeCallStats* stats);
   OptimizedCompilationJob* NextInput(bool check_if_flushing = false);
 
   inline int InputQueueIndex(int i) {
diff --git a/deps/v8/src/compiler/OWNERS b/deps/v8/src/compiler/OWNERS
index 204c0ba115e3c9..8eac0495047c53 100644
--- a/deps/v8/src/compiler/OWNERS
+++ b/deps/v8/src/compiler/OWNERS
@@ -1,6 +1,5 @@
 bmeurer@chromium.org
 jarin@chromium.org
-mstarzinger@chromium.org
 titzer@chromium.org
 danno@chromium.org
 sigurds@chromium.org
diff --git a/deps/v8/src/compiler/access-builder.cc b/deps/v8/src/compiler/access-builder.cc
index e6c5568af03a41..f820b3db4ca53f 100644
--- a/deps/v8/src/compiler/access-builder.cc
+++ b/deps/v8/src/compiler/access-builder.cc
@@ -32,11 +32,10 @@ FieldAccess AccessBuilder::ForExternalIntPtr() {
 
 // static
 FieldAccess AccessBuilder::ForMap() {
-  FieldAccess access = {
-      kTaggedBase,           HeapObject::kMapOffset,
-      MaybeHandle<Name>(),   MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TypeCompressedTaggedPointer(),
-      kMapWriteBarrier};
+  FieldAccess access = {kTaggedBase,           HeapObject::kMapOffset,
+                        MaybeHandle<Name>(),   MaybeHandle<Map>(),
+                        Type::OtherInternal(), MachineType::TaggedPointer(),
+                        kMapWriteBarrier};
   return access;
 }
 
@@ -80,31 +79,28 @@ FieldAccess AccessBuilder::ForBigIntLeastSignificantDigit64() {
 
 // static
 FieldAccess AccessBuilder::ForJSObjectPropertiesOrHash() {
-  FieldAccess access = {
-      kTaggedBase,         JSObject::kPropertiesOrHashOffset,
-      MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::Any(),         MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier,   LoadSensitivity::kCritical};
+  FieldAccess access = {kTaggedBase,         JSObject::kPropertiesOrHashOffset,
+                        MaybeHandle<Name>(), MaybeHandle<Map>(),
+                        Type::Any(),         MachineType::AnyTagged(),
+                        kFullWriteBarrier,   LoadSensitivity::kCritical};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer() {
-  FieldAccess access = {
-      kTaggedBase,          JSObject::kPropertiesOrHashOffset,
-      MaybeHandle<Name>(),  MaybeHandle<Map>(),
-      Type::Any(),          MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier, LoadSensitivity::kCritical};
+  FieldAccess access = {kTaggedBase,          JSObject::kPropertiesOrHashOffset,
+                        MaybeHandle<Name>(),  MaybeHandle<Map>(),
+                        Type::Any(),          MachineType::TaggedPointer(),
+                        kPointerWriteBarrier, LoadSensitivity::kCritical};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSObjectElements() {
-  FieldAccess access = {
-      kTaggedBase,          JSObject::kElementsOffset,
-      MaybeHandle<Name>(),  MaybeHandle<Map>(),
-      Type::Internal(),     MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier, LoadSensitivity::kCritical};
+  FieldAccess access = {kTaggedBase,          JSObject::kElementsOffset,
+                        MaybeHandle<Name>(),  MaybeHandle<Map>(),
+                        Type::Internal(),     MachineType::TaggedPointer(),
+                        kPointerWriteBarrier, LoadSensitivity::kCritical};
   return access;
 }
 
@@ -112,32 +108,29 @@ FieldAccess AccessBuilder::ForJSObjectElements() {
 FieldAccess AccessBuilder::ForJSObjectInObjectProperty(const MapRef& map,
                                                        int index) {
   int const offset = map.GetInObjectPropertyOffset(index);
-  FieldAccess access = {
-      kTaggedBase,         offset,
-      MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier};
+  FieldAccess access = {kTaggedBase,         offset,
+                        MaybeHandle<Name>(), MaybeHandle<Map>(),
+                        Type::NonInternal(), MachineType::AnyTagged(),
+                        kFullWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSObjectOffset(
     int offset, WriteBarrierKind write_barrier_kind) {
-  FieldAccess access = {
-      kTaggedBase,         offset,
-      MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
-      write_barrier_kind};
+  FieldAccess access = {kTaggedBase,         offset,
+                        MaybeHandle<Name>(), MaybeHandle<Map>(),
+                        Type::NonInternal(), MachineType::AnyTagged(),
+                        write_barrier_kind};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSCollectionTable() {
-  FieldAccess access = {
-      kTaggedBase,           JSCollection::kTableOffset,
-      MaybeHandle<Name>(),   MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,           JSCollection::kTableOffset,
+                        MaybeHandle<Name>(),   MaybeHandle<Map>(),
+                        Type::OtherInternal(), MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
@@ -146,7 +139,7 @@ FieldAccess AccessBuilder::ForJSCollectionIteratorTable() {
   FieldAccess access = {
       kTaggedBase,           JSCollectionIterator::kTableOffset,
       MaybeHandle<Name>(),   MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TypeCompressedTaggedPointer(),
+      Type::OtherInternal(), MachineType::TaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
@@ -158,7 +151,7 @@ FieldAccess AccessBuilder::ForJSCollectionIteratorIndex() {
                         MaybeHandle<Name>(),
                         MaybeHandle<Map>(),
                         TypeCache::Get()->kFixedArrayLengthType,
-                        MachineType::TypeCompressedTaggedSigned(),
+                        MachineType::TaggedSigned(),
                         kNoWriteBarrier};
   return access;
 }
@@ -168,18 +161,17 @@ FieldAccess AccessBuilder::ForJSFunctionPrototypeOrInitialMap() {
   FieldAccess access = {
       kTaggedBase,         JSFunction::kPrototypeOrInitialMapOffset,
       MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::Any(),         MachineType::TypeCompressedTaggedPointer(),
+      Type::Any(),         MachineType::TaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSFunctionContext() {
-  FieldAccess access = {
-      kTaggedBase,         JSFunction::kContextOffset,
-      MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::Internal(),    MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,         JSFunction::kContextOffset,
+                        MaybeHandle<Name>(), MaybeHandle<Map>(),
+                        Type::Internal(),    MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
@@ -188,28 +180,26 @@ FieldAccess AccessBuilder::ForJSFunctionSharedFunctionInfo() {
   FieldAccess access = {
       kTaggedBase,           JSFunction::kSharedFunctionInfoOffset,
       Handle<Name>(),        MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TypeCompressedTaggedPointer(),
+      Type::OtherInternal(), MachineType::TaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSFunctionFeedbackCell() {
-  FieldAccess access = {
-      kTaggedBase,         JSFunction::kFeedbackCellOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Internal(),    MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,         JSFunction::kFeedbackCellOffset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::Internal(),    MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSFunctionCode() {
-  FieldAccess access = {
-      kTaggedBase,           JSFunction::kCodeOffset,
-      Handle<Name>(),        MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,           JSFunction::kCodeOffset,
+                        Handle<Name>(),        MaybeHandle<Map>(),
+                        Type::OtherInternal(), MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
@@ -218,18 +208,17 @@ FieldAccess AccessBuilder::ForJSBoundFunctionBoundTargetFunction() {
   FieldAccess access = {
       kTaggedBase,         JSBoundFunction::kBoundTargetFunctionOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Callable(),    MachineType::TypeCompressedTaggedPointer(),
+      Type::Callable(),    MachineType::TaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSBoundFunctionBoundThis() {
-  FieldAccess access = {
-      kTaggedBase,         JSBoundFunction::kBoundThisOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier};
+  FieldAccess access = {kTaggedBase,         JSBoundFunction::kBoundThisOffset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::NonInternal(), MachineType::AnyTagged(),
+                        kFullWriteBarrier};
   return access;
 }
 
@@ -238,38 +227,35 @@ FieldAccess AccessBuilder::ForJSBoundFunctionBoundArguments() {
   FieldAccess access = {
       kTaggedBase,         JSBoundFunction::kBoundArgumentsOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Internal(),    MachineType::TypeCompressedTaggedPointer(),
+      Type::Internal(),    MachineType::TaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSGeneratorObjectContext() {
-  FieldAccess access = {
-      kTaggedBase,         JSGeneratorObject::kContextOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Internal(),    MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,         JSGeneratorObject::kContextOffset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::Internal(),    MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSGeneratorObjectFunction() {
-  FieldAccess access = {
-      kTaggedBase,         JSGeneratorObject::kFunctionOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Function(),    MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,         JSGeneratorObject::kFunctionOffset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::Function(),    MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSGeneratorObjectReceiver() {
-  FieldAccess access = {
-      kTaggedBase,         JSGeneratorObject::kReceiverOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Internal(),    MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,         JSGeneratorObject::kReceiverOffset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::Internal(),    MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
@@ -278,7 +264,7 @@ FieldAccess AccessBuilder::ForJSGeneratorObjectContinuation() {
   FieldAccess access = {
       kTaggedBase,         JSGeneratorObject::kContinuationOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::SignedSmall(), MachineType::TypeCompressedTaggedSigned(),
+      Type::SignedSmall(), MachineType::TaggedSigned(),
       kNoWriteBarrier};
   return access;
 }
@@ -288,7 +274,7 @@ FieldAccess AccessBuilder::ForJSGeneratorObjectInputOrDebugPos() {
   FieldAccess access = {
       kTaggedBase,         JSGeneratorObject::kInputOrDebugPosOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
+      Type::NonInternal(), MachineType::AnyTagged(),
       kFullWriteBarrier};
   return access;
 }
@@ -298,7 +284,7 @@ FieldAccess AccessBuilder::ForJSGeneratorObjectParametersAndRegisters() {
   FieldAccess access = {
       kTaggedBase,         JSGeneratorObject::kParametersAndRegistersOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Internal(),    MachineType::TypeCompressedTaggedPointer(),
+      Type::Internal(),    MachineType::TaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
@@ -308,7 +294,7 @@ FieldAccess AccessBuilder::ForJSGeneratorObjectResumeMode() {
   FieldAccess access = {
       kTaggedBase,         JSGeneratorObject::kResumeModeOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::SignedSmall(), MachineType::TypeCompressedTaggedSigned(),
+      Type::SignedSmall(), MachineType::TaggedSigned(),
       kNoWriteBarrier};
   return access;
 }
@@ -318,7 +304,7 @@ FieldAccess AccessBuilder::ForJSAsyncFunctionObjectPromise() {
   FieldAccess access = {
       kTaggedBase,         JSAsyncFunctionObject::kPromiseOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::OtherObject(), MachineType::TypeCompressedTaggedPointer(),
+      Type::OtherObject(), MachineType::TaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
@@ -328,7 +314,7 @@ FieldAccess AccessBuilder::ForJSAsyncGeneratorObjectQueue() {
   FieldAccess access = {
       kTaggedBase,         JSAsyncGeneratorObject::kQueueOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
+      Type::NonInternal(), MachineType::AnyTagged(),
       kFullWriteBarrier};
   return access;
 }
@@ -338,7 +324,7 @@ FieldAccess AccessBuilder::ForJSAsyncGeneratorObjectIsAwaiting() {
   FieldAccess access = {
       kTaggedBase,         JSAsyncGeneratorObject::kIsAwaitingOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::SignedSmall(), MachineType::TypeCompressedTaggedSigned(),
+      Type::SignedSmall(), MachineType::TaggedSigned(),
       kNoWriteBarrier};
   return access;
 }
@@ -351,15 +337,15 @@ FieldAccess AccessBuilder::ForJSArrayLength(ElementsKind elements_kind) {
                         Handle<Name>(),
                         MaybeHandle<Map>(),
                         type_cache->kJSArrayLengthType,
-                        MachineType::TypeCompressedTagged(),
+                        MachineType::AnyTagged(),
                         kFullWriteBarrier};
   if (IsDoubleElementsKind(elements_kind)) {
     access.type = type_cache->kFixedDoubleArrayLengthType;
-    access.machine_type = MachineType::TypeCompressedTaggedSigned();
+    access.machine_type = MachineType::TaggedSigned();
     access.write_barrier_kind = kNoWriteBarrier;
   } else if (IsFastElementsKind(elements_kind)) {
     access.type = type_cache->kFixedArrayLengthType;
-    access.machine_type = MachineType::TypeCompressedTaggedSigned();
+    access.machine_type = MachineType::TaggedSigned();
     access.write_barrier_kind = kNoWriteBarrier;
   }
   return access;
@@ -376,11 +362,10 @@ FieldAccess AccessBuilder::ForJSArrayBufferBitField() {
 
 // static
 FieldAccess AccessBuilder::ForJSArrayBufferViewBuffer() {
-  FieldAccess access = {
-      kTaggedBase,           JSArrayBufferView::kBufferOffset,
-      MaybeHandle<Name>(),   MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,           JSArrayBufferView::kBufferOffset,
+                        MaybeHandle<Name>(),   MaybeHandle<Map>(),
+                        Type::OtherInternal(), MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
@@ -422,11 +407,10 @@ FieldAccess AccessBuilder::ForJSTypedArrayLength() {
 
 // static
 FieldAccess AccessBuilder::ForJSTypedArrayBasePointer() {
-  FieldAccess access = {
-      kTaggedBase,           JSTypedArray::kBasePointerOffset,
-      MaybeHandle<Name>(),   MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier,     LoadSensitivity::kCritical};
+  FieldAccess access = {kTaggedBase,           JSTypedArray::kBasePointerOffset,
+                        MaybeHandle<Name>(),   MaybeHandle<Map>(),
+                        Type::OtherInternal(), MachineType::AnyTagged(),
+                        kFullWriteBarrier,     LoadSensitivity::kCritical};
   return access;
 }
 
@@ -459,7 +443,7 @@ FieldAccess AccessBuilder::ForJSDateValue() {
                         MaybeHandle<Name>(),
                         MaybeHandle<Map>(),
                         TypeCache::Get()->kJSDateValueType,
-                        MachineType::TypeCompressedTagged(),
+                        MachineType::AnyTagged(),
                         kFullWriteBarrier};
   return access;
 }
@@ -469,68 +453,62 @@ FieldAccess AccessBuilder::ForJSDateField(JSDate::FieldIndex index) {
   FieldAccess access = {
       kTaggedBase,         JSDate::kValueOffset + index * kTaggedSize,
       MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::Number(),      MachineType::TypeCompressedTagged(),
+      Type::Number(),      MachineType::AnyTagged(),
       kFullWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSIteratorResultDone() {
-  FieldAccess access = {
-      kTaggedBase,         JSIteratorResult::kDoneOffset,
-      MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier};
+  FieldAccess access = {kTaggedBase,         JSIteratorResult::kDoneOffset,
+                        MaybeHandle<Name>(), MaybeHandle<Map>(),
+                        Type::NonInternal(), MachineType::AnyTagged(),
+                        kFullWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSIteratorResultValue() {
-  FieldAccess access = {
-      kTaggedBase,         JSIteratorResult::kValueOffset,
-      MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier};
+  FieldAccess access = {kTaggedBase,         JSIteratorResult::kValueOffset,
+                        MaybeHandle<Name>(), MaybeHandle<Map>(),
+                        Type::NonInternal(), MachineType::AnyTagged(),
+                        kFullWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSRegExpData() {
-  FieldAccess access = {
-      kTaggedBase,         JSRegExp::kDataOffset,
-      MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier};
+  FieldAccess access = {kTaggedBase,         JSRegExp::kDataOffset,
+                        MaybeHandle<Name>(), MaybeHandle<Map>(),
+                        Type::NonInternal(), MachineType::AnyTagged(),
+                        kFullWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSRegExpFlags() {
-  FieldAccess access = {
-      kTaggedBase,         JSRegExp::kFlagsOffset,
-      MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier};
+  FieldAccess access = {kTaggedBase,         JSRegExp::kFlagsOffset,
+                        MaybeHandle<Name>(), MaybeHandle<Map>(),
+                        Type::NonInternal(), MachineType::AnyTagged(),
+                        kFullWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSRegExpLastIndex() {
-  FieldAccess access = {
-      kTaggedBase,         JSRegExp::kLastIndexOffset,
-      MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier};
+  FieldAccess access = {kTaggedBase,         JSRegExp::kLastIndexOffset,
+                        MaybeHandle<Name>(), MaybeHandle<Map>(),
+                        Type::NonInternal(), MachineType::AnyTagged(),
+                        kFullWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSRegExpSource() {
-  FieldAccess access = {
-      kTaggedBase,         JSRegExp::kSourceOffset,
-      MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier};
+  FieldAccess access = {kTaggedBase,         JSRegExp::kSourceOffset,
+                        MaybeHandle<Name>(), MaybeHandle<Map>(),
+                        Type::NonInternal(), MachineType::AnyTagged(),
+                        kFullWriteBarrier};
   return access;
 }
 
@@ -541,7 +519,7 @@ FieldAccess AccessBuilder::ForFixedArrayLength() {
                         MaybeHandle<Name>(),
                         MaybeHandle<Map>(),
                         TypeCache::Get()->kFixedArrayLengthType,
-                        MachineType::TypeCompressedTaggedSigned(),
+                        MachineType::TaggedSigned(),
                         kNoWriteBarrier};
   return access;
 }
@@ -551,7 +529,7 @@ FieldAccess AccessBuilder::ForPropertyArrayLengthAndHash() {
   FieldAccess access = {
       kTaggedBase,         PropertyArray::kLengthAndHashOffset,
       MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::SignedSmall(), MachineType::TypeCompressedTaggedSigned(),
+      Type::SignedSmall(), MachineType::TaggedSigned(),
       kNoWriteBarrier};
   return access;
 }
@@ -561,7 +539,7 @@ FieldAccess AccessBuilder::ForDescriptorArrayEnumCache() {
   FieldAccess access = {
       kTaggedBase,           DescriptorArray::kEnumCacheOffset,
       Handle<Name>(),        MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TypeCompressedTaggedPointer(),
+      Type::OtherInternal(), MachineType::TaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
@@ -595,11 +573,10 @@ FieldAccess AccessBuilder::ForMapBitField3() {
 
 // static
 FieldAccess AccessBuilder::ForMapDescriptors() {
-  FieldAccess access = {
-      kTaggedBase,           Map::kInstanceDescriptorsOffset,
-      Handle<Name>(),        MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,           Map::kInstanceDescriptorsOffset,
+                        Handle<Name>(),        MaybeHandle<Map>(),
+                        Type::OtherInternal(), MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
@@ -614,11 +591,10 @@ FieldAccess AccessBuilder::ForMapInstanceType() {
 
 // static
 FieldAccess AccessBuilder::ForMapPrototype() {
-  FieldAccess access = {
-      kTaggedBase,         Map::kPrototypeOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Any(),         MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,         Map::kPrototypeOffset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::Any(),         MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
@@ -627,7 +603,7 @@ FieldAccess AccessBuilder::ForModuleRegularExports() {
   FieldAccess access = {
       kTaggedBase,           SourceTextModule::kRegularExportsOffset,
       Handle<Name>(),        MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TypeCompressedTaggedPointer(),
+      Type::OtherInternal(), MachineType::TaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
@@ -637,7 +613,7 @@ FieldAccess AccessBuilder::ForModuleRegularImports() {
   FieldAccess access = {
       kTaggedBase,           SourceTextModule::kRegularImportsOffset,
       Handle<Name>(),        MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TypeCompressedTaggedPointer(),
+      Type::OtherInternal(), MachineType::TaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
@@ -665,51 +641,46 @@ FieldAccess AccessBuilder::ForStringLength() {
 
 // static
 FieldAccess AccessBuilder::ForConsStringFirst() {
-  FieldAccess access = {
-      kTaggedBase,         ConsString::kFirstOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::String(),      MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,         ConsString::kFirstOffset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::String(),      MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForConsStringSecond() {
-  FieldAccess access = {
-      kTaggedBase,         ConsString::kSecondOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::String(),      MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,         ConsString::kSecondOffset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::String(),      MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForThinStringActual() {
-  FieldAccess access = {
-      kTaggedBase,         ThinString::kActualOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::String(),      MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,         ThinString::kActualOffset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::String(),      MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForSlicedStringOffset() {
-  FieldAccess access = {
-      kTaggedBase,         SlicedString::kOffsetOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::SignedSmall(), MachineType::TypeCompressedTaggedSigned(),
-      kNoWriteBarrier};
+  FieldAccess access = {kTaggedBase,         SlicedString::kOffsetOffset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::SignedSmall(), MachineType::TaggedSigned(),
+                        kNoWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForSlicedStringParent() {
-  FieldAccess access = {
-      kTaggedBase,         SlicedString::kParentOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::String(),      MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,         SlicedString::kParentOffset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::String(),      MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
@@ -746,7 +717,7 @@ FieldAccess AccessBuilder::ForJSGlobalProxyNativeContext() {
   FieldAccess access = {
       kTaggedBase,         JSGlobalProxy::kNativeContextOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Internal(),    MachineType::TypeCompressedTaggedPointer(),
+      Type::Internal(),    MachineType::TaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
@@ -756,7 +727,7 @@ FieldAccess AccessBuilder::ForJSArrayIteratorIteratedObject() {
   FieldAccess access = {
       kTaggedBase,         JSArrayIterator::kIteratedObjectOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Receiver(),    MachineType::TypeCompressedTaggedPointer(),
+      Type::Receiver(),    MachineType::TaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
@@ -770,7 +741,7 @@ FieldAccess AccessBuilder::ForJSArrayIteratorNextIndex() {
                         Handle<Name>(),
                         MaybeHandle<Map>(),
                         TypeCache::Get()->kPositiveSafeInteger,
-                        MachineType::TypeCompressedTagged(),
+                        MachineType::AnyTagged(),
                         kFullWriteBarrier};
   return access;
 }
@@ -782,18 +753,17 @@ FieldAccess AccessBuilder::ForJSArrayIteratorKind() {
                         Handle<Name>(),
                         MaybeHandle<Map>(),
                         TypeCache::Get()->kJSArrayIteratorKindType,
-                        MachineType::TypeCompressedTaggedSigned(),
+                        MachineType::TaggedSigned(),
                         kNoWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSStringIteratorString() {
-  FieldAccess access = {
-      kTaggedBase,         JSStringIterator::kStringOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::String(),      MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,         JSStringIterator::kStringOffset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::String(),      MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
@@ -804,18 +774,19 @@ FieldAccess AccessBuilder::ForJSStringIteratorIndex() {
                         Handle<Name>(),
                         MaybeHandle<Map>(),
                         TypeCache::Get()->kStringLengthType,
-                        MachineType::TypeCompressedTaggedSigned(),
+                        MachineType::TaggedSigned(),
                         kNoWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForArgumentsLength() {
-  FieldAccess access = {
-      kTaggedBase,         JSArgumentsObjectWithLength::kLengthOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier};
+  constexpr int offset = JSStrictArgumentsObject::kLengthOffset;
+  STATIC_ASSERT(offset == JSSloppyArgumentsObject::kLengthOffset);
+  FieldAccess access = {kTaggedBase,         offset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::NonInternal(), MachineType::AnyTagged(),
+                        kFullWriteBarrier};
   return access;
 }
 
@@ -824,7 +795,7 @@ FieldAccess AccessBuilder::ForArgumentsCallee() {
   FieldAccess access = {
       kTaggedBase,         JSSloppyArgumentsObject::kCalleeOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
+      Type::NonInternal(), MachineType::AnyTagged(),
       kFullWriteBarrier};
   return access;
 }
@@ -835,7 +806,7 @@ FieldAccess AccessBuilder::ForFixedArraySlot(
   int offset = FixedArray::OffsetOfElementAt(static_cast<int>(index));
   FieldAccess access = {kTaggedBase,       offset,
                         Handle<Name>(),    MaybeHandle<Map>(),
-                        Type::Any(),       MachineType::TypeCompressedTagged(),
+                        Type::Any(),       MachineType::AnyTagged(),
                         write_barrier_kind};
   return access;
 }
@@ -844,11 +815,20 @@ FieldAccess AccessBuilder::ForFixedArraySlot(
 FieldAccess AccessBuilder::ForCellValue() {
   FieldAccess access = {kTaggedBase,       Cell::kValueOffset,
                         Handle<Name>(),    MaybeHandle<Map>(),
-                        Type::Any(),       MachineType::TypeCompressedTagged(),
+                        Type::Any(),       MachineType::AnyTagged(),
                         kFullWriteBarrier, LoadSensitivity::kCritical};
   return access;
 }
 
+// static
+FieldAccess AccessBuilder::ForScopeInfoFlags() {
+  FieldAccess access = {kTaggedBase,         ScopeInfo::kFlagsOffset,
+                        MaybeHandle<Name>(), MaybeHandle<Map>(),
+                        Type::SignedSmall(), MachineType::TaggedSigned(),
+                        kNoWriteBarrier};
+  return access;
+}
+
 // static
 FieldAccess AccessBuilder::ForContextSlot(size_t index) {
   int offset = Context::OffsetOfElementAt(static_cast<int>(index));
@@ -856,7 +836,7 @@ FieldAccess AccessBuilder::ForContextSlot(size_t index) {
             Context::SlotOffset(static_cast<int>(index)) + kHeapObjectTag);
   FieldAccess access = {kTaggedBase,      offset,
                         Handle<Name>(),   MaybeHandle<Map>(),
-                        Type::Any(),      MachineType::TypeCompressedTagged(),
+                        Type::Any(),      MachineType::AnyTagged(),
                         kFullWriteBarrier};
   return access;
 }
@@ -866,33 +846,30 @@ FieldAccess AccessBuilder::ForContextSlotKnownPointer(size_t index) {
   int offset = Context::OffsetOfElementAt(static_cast<int>(index));
   DCHECK_EQ(offset,
             Context::SlotOffset(static_cast<int>(index)) + kHeapObjectTag);
-  FieldAccess access = {
-      kTaggedBase,         offset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Any(),         MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,         offset,
+                        Handle<Name>(),      MaybeHandle<Map>(),
+                        Type::Any(),         MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
 // static
 ElementAccess AccessBuilder::ForFixedArrayElement() {
   ElementAccess access = {kTaggedBase, FixedArray::kHeaderSize, Type::Any(),
-                          MachineType::TypeCompressedTagged(),
-                          kFullWriteBarrier};
+                          MachineType::AnyTagged(), kFullWriteBarrier};
   return access;
 }
 
 // static
 ElementAccess AccessBuilder::ForFixedArrayElement(
     ElementsKind kind, LoadSensitivity load_sensitivity) {
-  ElementAccess access = {
-      kTaggedBase,       FixedArray::kHeaderSize,
-      Type::Any(),       MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier, load_sensitivity};
+  ElementAccess access = {kTaggedBase,       FixedArray::kHeaderSize,
+                          Type::Any(),       MachineType::AnyTagged(),
+                          kFullWriteBarrier, load_sensitivity};
   switch (kind) {
     case PACKED_SMI_ELEMENTS:
       access.type = Type::SignedSmall();
-      access.machine_type = MachineType::TypeCompressedTaggedSigned();
+      access.machine_type = MachineType::TaggedSigned();
       access.write_barrier_kind = kNoWriteBarrier;
       break;
     case HOLEY_SMI_ELEMENTS:
@@ -939,21 +916,19 @@ ElementAccess AccessBuilder::ForFixedDoubleArrayElement() {
 
 // static
 FieldAccess AccessBuilder::ForEnumCacheKeys() {
-  FieldAccess access = {
-      kTaggedBase,           EnumCache::kKeysOffset,
-      MaybeHandle<Name>(),   MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,           EnumCache::kKeysOffset,
+                        MaybeHandle<Name>(),   MaybeHandle<Map>(),
+                        Type::OtherInternal(), MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForEnumCacheIndices() {
-  FieldAccess access = {
-      kTaggedBase,           EnumCache::kIndicesOffset,
-      MaybeHandle<Name>(),   MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
+  FieldAccess access = {kTaggedBase,           EnumCache::kIndicesOffset,
+                        MaybeHandle<Name>(),   MaybeHandle<Map>(),
+                        Type::OtherInternal(), MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
   return access;
 }
 
@@ -1029,7 +1004,7 @@ FieldAccess AccessBuilder::ForHashTableBaseNumberOfElements() {
       MaybeHandle<Name>(),
       MaybeHandle<Map>(),
       Type::SignedSmall(),
-      MachineType::TypeCompressedTaggedSigned(),
+      MachineType::TaggedSigned(),
       kNoWriteBarrier};
   return access;
 }
@@ -1042,7 +1017,7 @@ FieldAccess AccessBuilder::ForHashTableBaseNumberOfDeletedElement() {
                         MaybeHandle<Name>(),
                         MaybeHandle<Map>(),
                         Type::SignedSmall(),
-                        MachineType::TypeCompressedTaggedSigned(),
+                        MachineType::TaggedSigned(),
                         kNoWriteBarrier};
   return access;
 }
@@ -1055,7 +1030,7 @@ FieldAccess AccessBuilder::ForHashTableBaseCapacity() {
       MaybeHandle<Name>(),
       MaybeHandle<Map>(),
       Type::SignedSmall(),
-      MachineType::TypeCompressedTaggedSigned(),
+      MachineType::TaggedSigned(),
       kNoWriteBarrier};
   return access;
 }
@@ -1069,7 +1044,7 @@ FieldAccess AccessBuilder::ForOrderedHashMapOrSetNextTable() {
   FieldAccess const access = {
       kTaggedBase,         OrderedHashMap::NextTableOffset(),
       MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::Any(),         MachineType::TypeCompressedTagged(),
+      Type::Any(),         MachineType::AnyTagged(),
       kFullWriteBarrier};
   return access;
 }
@@ -1085,7 +1060,7 @@ FieldAccess AccessBuilder::ForOrderedHashMapOrSetNumberOfBuckets() {
                               MaybeHandle<Name>(),
                               MaybeHandle<Map>(),
                               TypeCache::Get()->kFixedArrayLengthType,
-                              MachineType::TypeCompressedTaggedSigned(),
+                              MachineType::TaggedSigned(),
                               kNoWriteBarrier};
   return access;
 }
@@ -1101,7 +1076,7 @@ FieldAccess AccessBuilder::ForOrderedHashMapOrSetNumberOfDeletedElements() {
                               MaybeHandle<Name>(),
                               MaybeHandle<Map>(),
                               TypeCache::Get()->kFixedArrayLengthType,
-                              MachineType::TypeCompressedTaggedSigned(),
+                              MachineType::TaggedSigned(),
                               kNoWriteBarrier};
   return access;
 }
@@ -1117,18 +1092,18 @@ FieldAccess AccessBuilder::ForOrderedHashMapOrSetNumberOfElements() {
                               MaybeHandle<Name>(),
                               MaybeHandle<Map>(),
                               TypeCache::Get()->kFixedArrayLengthType,
-                              MachineType::TypeCompressedTaggedSigned(),
+                              MachineType::TaggedSigned(),
                               kNoWriteBarrier};
   return access;
 }
 
 // static
 ElementAccess AccessBuilder::ForOrderedHashMapEntryValue() {
-  ElementAccess const access = {
-      kTaggedBase,
-      OrderedHashMap::HashTableStartOffset() +
-          OrderedHashMap::kValueOffset * kTaggedSize,
-      Type::Any(), MachineType::TypeCompressedTagged(), kFullWriteBarrier};
+  ElementAccess const access = {kTaggedBase,
+                                OrderedHashMap::HashTableStartOffset() +
+                                    OrderedHashMap::kValueOffset * kTaggedSize,
+                                Type::Any(), MachineType::AnyTagged(),
+                                kFullWriteBarrier};
   return access;
 }
 
@@ -1140,7 +1115,7 @@ FieldAccess AccessBuilder::ForDictionaryNextEnumerationIndex() {
       MaybeHandle<Name>(),
       MaybeHandle<Map>(),
       Type::SignedSmall(),
-      MachineType::TypeCompressedTaggedSigned(),
+      MachineType::TaggedSigned(),
       kNoWriteBarrier};
   return access;
 }
@@ -1153,7 +1128,7 @@ FieldAccess AccessBuilder::ForDictionaryObjectHashIndex() {
       MaybeHandle<Name>(),
       MaybeHandle<Map>(),
       Type::SignedSmall(),
-      MachineType::TypeCompressedTaggedSigned(),
+      MachineType::TaggedSigned(),
       kNoWriteBarrier};
   return access;
 }
diff --git a/deps/v8/src/compiler/access-builder.h b/deps/v8/src/compiler/access-builder.h
index 4aa69e3726e0fc..622dc1d76c2d0e 100644
--- a/deps/v8/src/compiler/access-builder.h
+++ b/deps/v8/src/compiler/access-builder.h
@@ -268,6 +268,9 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   static FieldAccess ForFixedArraySlot(
       size_t index, WriteBarrierKind write_barrier_kind = kFullWriteBarrier);
 
+  // Provides access to ScopeInfo flags.
+  static FieldAccess ForScopeInfoFlags();
+
   // Provides access to Context slots.
   static FieldAccess ForContextSlot(size_t index);
 
diff --git a/deps/v8/src/compiler/allocation-builder-inl.h b/deps/v8/src/compiler/allocation-builder-inl.h
index 4cab0a7e6e2d15..26fbe503c365fe 100644
--- a/deps/v8/src/compiler/allocation-builder-inl.h
+++ b/deps/v8/src/compiler/allocation-builder-inl.h
@@ -15,7 +15,8 @@ namespace internal {
 namespace compiler {
 
 void AllocationBuilder::AllocateContext(int variadic_part_length, MapRef map) {
-  DCHECK(IsInRange(map.instance_type(), FIRST_CONTEXT_TYPE, LAST_CONTEXT_TYPE));
+  DCHECK(base::IsInRange(map.instance_type(), FIRST_CONTEXT_TYPE,
+                         LAST_CONTEXT_TYPE));
   DCHECK_NE(NATIVE_CONTEXT_TYPE, map.instance_type());
   int size = Context::SizeFor(variadic_part_length);
   Allocate(size, AllocationType::kYoung, Type::OtherInternal());
diff --git a/deps/v8/src/compiler/backend/arm/code-generator-arm.cc b/deps/v8/src/compiler/backend/arm/code-generator-arm.cc
index 3fe5361083895a..a82eb4b35c32ed 100644
--- a/deps/v8/src/compiler/backend/arm/code-generator-arm.cc
+++ b/deps/v8/src/compiler/backend/arm/code-generator-arm.cc
@@ -9,6 +9,7 @@
 #include "src/codegen/optimized-compilation-info.h"
 #include "src/compiler/backend/code-generator-impl.h"
 #include "src/compiler/backend/gap-resolver.h"
+#include "src/compiler/backend/instruction-codes.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/osr.h"
 #include "src/heap/heap-inl.h"  // crbug.com/v8/8499
@@ -54,6 +55,7 @@ class ArmOperandConverter final : public InstructionOperandConverter {
       case kMode_None:
       case kMode_Offset_RI:
       case kMode_Offset_RR:
+      case kMode_Root:
         break;
       case kMode_Operand2_I:
         return InputImmediate(index + 0);
@@ -103,6 +105,9 @@ class ArmOperandConverter final : public InstructionOperandConverter {
       case kMode_Offset_RR:
         *first_index += 2;
         return MemOperand(InputRegister(index + 0), InputRegister(index + 1));
+      case kMode_Root:
+        *first_index += 1;
+        return MemOperand(kRootRegister, InputInt32(index));
     }
     UNREACHABLE();
   }
@@ -200,7 +205,7 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
       __ CallEphemeronKeyBarrier(object_, offset_, save_fp_mode);
     } else if (stub_mode_ == StubCallMode::kCallWasmRuntimeStub) {
       __ CallRecordWriteStub(object_, offset_, remembered_set_action,
-                             save_fp_mode, wasm::WasmCode::kWasmRecordWrite);
+                             save_fp_mode, wasm::WasmCode::kRecordWrite);
     } else {
       __ CallRecordWriteStub(object_, offset_, remembered_set_action,
                              save_fp_mode);
@@ -459,20 +464,20 @@ void ComputePoisonedAddressForLoad(CodeGenerator* codegen,
     DCHECK_EQ(LeaveCC, i.OutputSBit());                                        \
   } while (0)
 
-#define ASSEMBLE_NEON_NARROWING_OP(dt)                \
+#define ASSEMBLE_NEON_NARROWING_OP(dt, sdt)           \
   do {                                                \
     Simd128Register dst = i.OutputSimd128Register(),  \
                     src0 = i.InputSimd128Register(0), \
                     src1 = i.InputSimd128Register(1); \
     if (dst == src0 && dst == src1) {                 \
-      __ vqmovn(dt, dst.low(), src0);                 \
+      __ vqmovn(dt, sdt, dst.low(), src0);            \
       __ vmov(dst.high(), dst.low());                 \
     } else if (dst == src0) {                         \
-      __ vqmovn(dt, dst.low(), src0);                 \
-      __ vqmovn(dt, dst.high(), src1);                \
+      __ vqmovn(dt, sdt, dst.low(), src0);            \
+      __ vqmovn(dt, sdt, dst.high(), src1);           \
     } else {                                          \
-      __ vqmovn(dt, dst.high(), src1);                \
-      __ vqmovn(dt, dst.low(), src0);                 \
+      __ vqmovn(dt, sdt, dst.high(), src1);           \
+      __ vqmovn(dt, sdt, dst.low(), src0);            \
     }                                                 \
   } while (0)
 
@@ -494,6 +499,14 @@ void ComputePoisonedAddressForLoad(CodeGenerator* codegen,
     }                                                     \
   } while (0)
 
+#define ASSEMBLE_F64X2_ARITHMETIC_BINOP(op)                                   \
+  do {                                                                        \
+    __ op(i.OutputSimd128Register().low(), i.InputSimd128Register(0).low(),   \
+          i.InputSimd128Register(1).low());                                   \
+    __ op(i.OutputSimd128Register().high(), i.InputSimd128Register(0).high(), \
+          i.InputSimd128Register(1).high());                                  \
+  } while (0)
+
 void CodeGenerator::AssembleDeconstructFrame() {
   __ LeaveFrame(StackFrame::MANUAL);
   unwinding_info_writer_.MarkFrameDeconstructed(__ pc_offset());
@@ -501,8 +514,7 @@ void CodeGenerator::AssembleDeconstructFrame() {
 
 void CodeGenerator::AssemblePrepareTailCall() {
   if (frame_access_state()->has_frame()) {
-    __ ldr(lr, MemOperand(fp, StandardFrameConstants::kCallerPCOffset));
-    __ ldr(fp, MemOperand(fp, StandardFrameConstants::kCallerFPOffset));
+    __ ldm(ia, fp, lr.bit() | fp.bit());
   }
   frame_access_state()->SetFrameAccessToSP();
 }
@@ -527,9 +539,7 @@ void CodeGenerator::AssemblePopArgumentsAdaptorFrame(Register args_reg,
          MemOperand(fp, ArgumentsAdaptorFrameConstants::kLengthOffset));
   __ SmiUntag(caller_args_count_reg);
 
-  ParameterCount callee_args_count(args_reg);
-  __ PrepareForTailCall(callee_args_count, caller_args_count_reg, scratch2,
-                        scratch3);
+  __ PrepareForTailCall(args_reg, caller_args_count_reg, scratch2, scratch3);
   __ bind(&done);
 }
 
@@ -584,12 +594,20 @@ void AdjustStackPointerForTailCall(
 bool VerifyOutputOfAtomicPairInstr(ArmOperandConverter* converter,
                                    const Instruction* instr, Register low,
                                    Register high) {
-  if (instr->OutputCount() > 0) {
-    if (converter->OutputRegister(0) != low) return false;
-    if (instr->OutputCount() == 2 && converter->OutputRegister(1) != high)
-      return false;
+  DCHECK_GE(instr->OutputCount() + instr->TempCount(), 2);
+  if (instr->OutputCount() == 2) {
+    return (converter->OutputRegister(0) == low &&
+            converter->OutputRegister(1) == high);
   }
-  return true;
+  if (instr->OutputCount() == 1) {
+    return (converter->OutputRegister(0) == low &&
+            converter->TempRegister(instr->TempCount() - 1) == high) ||
+           (converter->OutputRegister(0) == high &&
+            converter->TempRegister(instr->TempCount() - 1) == low);
+  }
+  DCHECK_EQ(instr->OutputCount(), 0);
+  return (converter->TempRegister(instr->TempCount() - 2) == low &&
+          converter->TempRegister(instr->TempCount() - 1) == high);
 }
 #endif
 
@@ -843,7 +861,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         Register func = i.InputRegister(0);
         __ CallCFunction(func, num_parameters);
       }
-      RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
+      if (linkage()->GetIncomingDescriptor()->IsWasmCapiFunction()) {
+        RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
+      }
       frame_access_state()->SetFrameAccessToDefault();
       // Ideally, we should decrement SP delta to match the change of stack
       // pointer in CallCFunction. However, for certain architectures (e.g.
@@ -929,11 +949,26 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     case kArchStackPointerGreaterThan: {
+      // Potentially apply an offset to the current stack pointer before the
+      // comparison to consider the size difference of an optimized frame versus
+      // the contained unoptimized frames.
+
+      Register lhs_register = sp;
+      uint32_t offset;
+
+      if (ShouldApplyOffsetToStackCheck(instr, &offset)) {
+        lhs_register = i.TempRegister(0);
+        __ sub(lhs_register, sp, Operand(offset));
+      }
+
       constexpr size_t kValueIndex = 0;
       DCHECK(instr->InputAt(kValueIndex)->IsRegister());
-      __ cmp(sp, i.InputRegister(kValueIndex));
+      __ cmp(lhs_register, i.InputRegister(kValueIndex));
       break;
     }
+    case kArchStackCheckOffset:
+      __ Move(i.OutputRegister(), Smi::FromInt(GetStackCheckOffset()));
+      break;
     case kArchTruncateDoubleToI:
       __ TruncateDoubleToI(isolate(), zone(), i.OutputRegister(),
                            i.InputDoubleRegister(0), DetermineStubCallMode());
@@ -1763,6 +1798,281 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ and_(i.OutputRegister(0), i.InputRegister(0),
               Operand(kSpeculationPoisonRegister));
       break;
+    case kArmF64x2Splat: {
+      Simd128Register dst = i.OutputSimd128Register();
+      DoubleRegister src = i.InputDoubleRegister(0);
+      __ Move(dst.low(), src);
+      __ Move(dst.high(), src);
+      break;
+    }
+    case kArmF64x2ExtractLane: {
+      __ ExtractLane(i.OutputDoubleRegister(), i.InputSimd128Register(0),
+                     i.InputInt8(1));
+      break;
+    }
+    case kArmF64x2ReplaceLane: {
+      __ ReplaceLane(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                     i.InputDoubleRegister(2), i.InputInt8(1));
+      break;
+    }
+    case kArmF64x2Abs: {
+      __ vabs(i.OutputSimd128Register().low(), i.InputSimd128Register(0).low());
+      __ vabs(i.OutputSimd128Register().high(),
+              i.InputSimd128Register(0).high());
+      break;
+    }
+    case kArmF64x2Neg: {
+      __ vneg(i.OutputSimd128Register().low(), i.InputSimd128Register(0).low());
+      __ vneg(i.OutputSimd128Register().high(),
+              i.InputSimd128Register(0).high());
+      break;
+    }
+    case kArmF64x2Sqrt: {
+      __ vsqrt(i.OutputSimd128Register().low(),
+               i.InputSimd128Register(0).low());
+      __ vsqrt(i.OutputSimd128Register().high(),
+               i.InputSimd128Register(0).high());
+      break;
+    }
+    case kArmF64x2Add: {
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(vadd);
+      break;
+    }
+    case kArmF64x2Sub: {
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(vsub);
+      break;
+    }
+    case kArmF64x2Mul: {
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(vmul);
+      break;
+    }
+    case kArmF64x2Div: {
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(vdiv);
+      break;
+    }
+    case kArmF64x2Min: {
+      Simd128Register result = i.OutputSimd128Register();
+      Simd128Register left = i.InputSimd128Register(0);
+      Simd128Register right = i.InputSimd128Register(1);
+      if (left == right) {
+        __ Move(result, left);
+      } else {
+        auto ool_low = new (zone())
+            OutOfLineFloat64Min(this, result.low(), left.low(), right.low());
+        auto ool_high = new (zone())
+            OutOfLineFloat64Min(this, result.high(), left.high(), right.high());
+        __ FloatMin(result.low(), left.low(), right.low(), ool_low->entry());
+        __ bind(ool_low->exit());
+        __ FloatMin(result.high(), left.high(), right.high(),
+                    ool_high->entry());
+        __ bind(ool_high->exit());
+      }
+      DCHECK_EQ(LeaveCC, i.OutputSBit());
+      break;
+    }
+    case kArmF64x2Max: {
+      Simd128Register result = i.OutputSimd128Register();
+      Simd128Register left = i.InputSimd128Register(0);
+      Simd128Register right = i.InputSimd128Register(1);
+      if (left == right) {
+        __ Move(result, left);
+      } else {
+        auto ool_low = new (zone())
+            OutOfLineFloat64Max(this, result.low(), left.low(), right.low());
+        auto ool_high = new (zone())
+            OutOfLineFloat64Max(this, result.high(), left.high(), right.high());
+        __ FloatMax(result.low(), left.low(), right.low(), ool_low->entry());
+        __ bind(ool_low->exit());
+        __ FloatMax(result.high(), left.high(), right.high(),
+                    ool_high->entry());
+        __ bind(ool_high->exit());
+      }
+      DCHECK_EQ(LeaveCC, i.OutputSBit());
+      break;
+    }
+#undef ASSEMBLE_F64X2_ARITHMETIC_BINOP
+    case kArmF64x2Eq: {
+      UseScratchRegisterScope temps(tasm());
+      Register scratch = temps.Acquire();
+      __ mov(scratch, Operand(0));
+      __ VFPCompareAndSetFlags(i.InputSimd128Register(0).low(),
+                               i.InputSimd128Register(1).low());
+      __ mov(scratch, Operand(-1), LeaveCC, eq);
+      __ vmov(i.OutputSimd128Register().low(), scratch, scratch);
+
+      __ mov(scratch, Operand(0));
+      __ VFPCompareAndSetFlags(i.InputSimd128Register(0).high(),
+                               i.InputSimd128Register(1).high());
+      __ mov(scratch, Operand(-1), LeaveCC, eq);
+      __ vmov(i.OutputSimd128Register().high(), scratch, scratch);
+      break;
+    }
+    case kArmF64x2Ne: {
+      UseScratchRegisterScope temps(tasm());
+      Register scratch = temps.Acquire();
+      __ mov(scratch, Operand(0));
+      __ VFPCompareAndSetFlags(i.InputSimd128Register(0).low(),
+                               i.InputSimd128Register(1).low());
+      __ mov(scratch, Operand(-1), LeaveCC, ne);
+      __ vmov(i.OutputSimd128Register().low(), scratch, scratch);
+
+      __ mov(scratch, Operand(0));
+      __ VFPCompareAndSetFlags(i.InputSimd128Register(0).high(),
+                               i.InputSimd128Register(1).high());
+      __ mov(scratch, Operand(-1), LeaveCC, ne);
+      __ vmov(i.OutputSimd128Register().high(), scratch, scratch);
+      break;
+    }
+    case kArmF64x2Lt: {
+      UseScratchRegisterScope temps(tasm());
+      Register scratch = temps.Acquire();
+      __ mov(scratch, Operand(0));
+      __ VFPCompareAndSetFlags(i.InputSimd128Register(0).low(),
+                               i.InputSimd128Register(1).low());
+      __ mov(scratch, Operand(-1), LeaveCC, lt);
+      // Check for NaN.
+      __ mov(scratch, Operand(0), LeaveCC, vs);
+      __ vmov(i.OutputSimd128Register().low(), scratch, scratch);
+
+      __ mov(scratch, Operand(0));
+      __ VFPCompareAndSetFlags(i.InputSimd128Register(0).high(),
+                               i.InputSimd128Register(1).high());
+      __ mov(scratch, Operand(-1), LeaveCC, lt);
+      // Check for NaN.
+      __ mov(scratch, Operand(0), LeaveCC, vs);
+      __ vmov(i.OutputSimd128Register().high(), scratch, scratch);
+      break;
+    }
+    case kArmF64x2Le: {
+      UseScratchRegisterScope temps(tasm());
+      Register scratch = temps.Acquire();
+      __ mov(scratch, Operand(0));
+      __ VFPCompareAndSetFlags(i.InputSimd128Register(0).low(),
+                               i.InputSimd128Register(1).low());
+      __ mov(scratch, Operand(-1), LeaveCC, le);
+      // Check for NaN.
+      __ mov(scratch, Operand(0), LeaveCC, vs);
+      __ vmov(i.OutputSimd128Register().low(), scratch, scratch);
+
+      __ mov(scratch, Operand(0));
+      __ VFPCompareAndSetFlags(i.InputSimd128Register(0).high(),
+                               i.InputSimd128Register(1).high());
+      __ mov(scratch, Operand(-1), LeaveCC, le);
+      // Check for NaN.
+      __ mov(scratch, Operand(0), LeaveCC, vs);
+      __ vmov(i.OutputSimd128Register().high(), scratch, scratch);
+      break;
+    }
+    case kArmI64x2SplatI32Pair: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vdup(Neon32, dst, i.InputRegister(0));
+      __ ReplaceLane(dst, dst, i.InputRegister(1), NeonS32, 1);
+      __ ReplaceLane(dst, dst, i.InputRegister(1), NeonS32, 3);
+      break;
+    }
+    case kArmI64x2ReplaceLaneI32Pair: {
+      Simd128Register dst = i.OutputSimd128Register();
+      int8_t lane = i.InputInt8(1);
+      __ ReplaceLane(dst, dst, i.InputRegister(2), NeonS32, lane * 2);
+      __ ReplaceLane(dst, dst, i.InputRegister(3), NeonS32, lane * 2 + 1);
+      break;
+    }
+    case kArmI64x2Add: {
+      __ vadd(Neon64, i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1));
+      break;
+    }
+    case kArmI64x2Sub: {
+      __ vsub(Neon64, i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1));
+      break;
+    }
+    case kArmI64x2Mul: {
+      QwNeonRegister dst = i.OutputSimd128Register();
+      QwNeonRegister left = i.InputSimd128Register(0);
+      QwNeonRegister right = i.InputSimd128Register(1);
+      QwNeonRegister tmp1 = i.TempSimd128Register(0);
+      QwNeonRegister tmp2 = i.TempSimd128Register(1);
+
+      // This algorithm uses vector operations to perform 64-bit integer
+      // multiplication by splitting it into a high and low 32-bit integers.
+      // The tricky part is getting the low and high integers in the correct
+      // place inside a NEON register, so that we can use as little vmull and
+      // vmlal as possible.
+
+      // Move left and right into temporaries, they will be modified by vtrn.
+      __ vmov(tmp1, left);
+      __ vmov(tmp2, right);
+
+      // This diagram shows how the 64-bit integers fit into NEON registers.
+      //
+      //             [q.high()| q.low()]
+      // left/tmp1:  [ a3, a2 | a1, a0 ]
+      // right/tmp2: [ b3, b2 | b1, b0 ]
+      //
+      // We want to multiply the low 32 bits of left with high 32 bits of right,
+      // for each lane, i.e. a2 * b3, a0 * b1. However, vmull takes two input d
+      // registers, and multiply the corresponding low/high 32 bits, to get a
+      // 64-bit integer: a1 * b1, a0 * b0. In order to make it work we transpose
+      // the vectors, so that we get the low 32 bits of each 64-bit integer into
+      // the same lane, similarly for high 32 bits.
+      __ vtrn(Neon32, tmp1.low(), tmp1.high());
+      // tmp1: [ a3, a1 | a2, a0 ]
+      __ vtrn(Neon32, tmp2.low(), tmp2.high());
+      // tmp2: [ b3, b1 | b2, b0 ]
+
+      __ vmull(NeonU32, dst, tmp1.low(), tmp2.high());
+      // dst: [ a2*b3 | a0*b1 ]
+      __ vmlal(NeonU32, dst, tmp1.high(), tmp2.low());
+      // dst: [ a2*b3 + a3*b2 | a0*b1 + a1*b0 ]
+      __ vshl(NeonU64, dst, dst, 32);
+      // dst: [ (a2*b3 + a3*b2) << 32 | (a0*b1 + a1*b0) << 32 ]
+
+      __ vmlal(NeonU32, dst, tmp1.low(), tmp2.low());
+      // dst: [ (a2*b3 + a3*b2)<<32 + (a2*b2) | (a0*b1 + a1*b0)<<32 + (a0*b0) ]
+      break;
+    }
+    case kArmI64x2Neg: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vmov(dst, static_cast<uint64_t>(0));
+      __ vqsub(NeonS64, dst, dst, i.InputSimd128Register(0));
+      break;
+    }
+    case kArmI64x2Shl: {
+      QwNeonRegister tmp = i.TempSimd128Register(0);
+      Register shift = i.TempRegister(1);
+      // Take shift value modulo 64.
+      __ and_(shift, i.InputRegister(1), Operand(63));
+      // Only the least significant byte of each lane is used.
+      __ vdup(Neon32, tmp, shift);
+      __ vshl(NeonS64, i.OutputSimd128Register(), i.InputSimd128Register(0),
+              tmp);
+      break;
+    }
+    case kArmI64x2ShrS: {
+      QwNeonRegister tmp = i.TempSimd128Register(0);
+      Register shift = i.TempRegister(1);
+      // Take shift value modulo 64.
+      __ and_(shift, i.InputRegister(1), Operand(63));
+      // Only the least significant byte of each lane is used.
+      __ vdup(Neon32, tmp, shift);
+      __ vneg(Neon32, tmp, tmp);
+      __ vshl(NeonS64, i.OutputSimd128Register(), i.InputSimd128Register(0),
+              tmp);
+      break;
+    }
+    case kArmI64x2ShrU: {
+      QwNeonRegister tmp = i.TempSimd128Register(0);
+      Register shift = i.TempRegister(1);
+      // Take shift value modulo 64.
+      __ and_(shift, i.InputRegister(1), Operand(63));
+      // Only the least significant byte of each lane is used.
+      __ vdup(Neon32, tmp, shift);
+      __ vneg(Neon32, tmp, tmp);
+      __ vshl(NeonU64, i.OutputSimd128Register(), i.InputSimd128Register(0),
+              tmp);
+      break;
+    }
     case kArmF32x4Splat: {
       int src_code = i.InputFloatRegister(0).code();
       __ vdup(Neon32, i.OutputSimd128Register(),
@@ -2047,11 +2357,16 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ vdup(Neon16, i.OutputSimd128Register(), i.InputRegister(0));
       break;
     }
-    case kArmI16x8ExtractLane: {
+    case kArmI16x8ExtractLaneU: {
       __ ExtractLane(i.OutputRegister(), i.InputSimd128Register(0), NeonU16,
                      i.InputInt8(1));
       break;
     }
+    case kArmI16x8ExtractLaneS: {
+      __ ExtractLane(i.OutputRegister(), i.InputSimd128Register(0), NeonS16,
+                     i.InputInt8(1));
+      break;
+    }
     case kArmI16x8ReplaceLane: {
       __ ReplaceLane(i.OutputSimd128Register(), i.InputSimd128Register(0),
                      i.InputRegister(2), NeonS16, i.InputInt8(1));
@@ -2093,7 +2408,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kArmI16x8SConvertI32x4:
-      ASSEMBLE_NEON_NARROWING_OP(NeonS16);
+      ASSEMBLE_NEON_NARROWING_OP(NeonS16, NeonS16);
       break;
     case kArmI16x8Add: {
       __ vadd(Neon16, i.OutputSimd128Register(), i.InputSimd128Register(0),
@@ -2177,7 +2492,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kArmI16x8UConvertI32x4:
-      ASSEMBLE_NEON_NARROWING_OP(NeonU16);
+      ASSEMBLE_NEON_NARROWING_OP(NeonU16, NeonS16);
       break;
     case kArmI16x8AddSaturateU: {
       __ vqadd(NeonU16, i.OutputSimd128Register(), i.InputSimd128Register(0),
@@ -2209,15 +2524,25 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
               i.InputSimd128Register(1));
       break;
     }
+    case kArmI16x8RoundingAverageU: {
+      __ vrhadd(NeonU16, i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
     case kArmI8x16Splat: {
       __ vdup(Neon8, i.OutputSimd128Register(), i.InputRegister(0));
       break;
     }
-    case kArmI8x16ExtractLane: {
+    case kArmI8x16ExtractLaneU: {
       __ ExtractLane(i.OutputRegister(), i.InputSimd128Register(0), NeonU8,
                      i.InputInt8(1));
       break;
     }
+    case kArmI8x16ExtractLaneS: {
+      __ ExtractLane(i.OutputRegister(), i.InputSimd128Register(0), NeonS8,
+                     i.InputInt8(1));
+      break;
+    }
     case kArmI8x16ReplaceLane: {
       __ ReplaceLane(i.OutputSimd128Register(), i.InputSimd128Register(0),
                      i.InputRegister(2), NeonS8, i.InputInt8(1));
@@ -2249,7 +2574,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kArmI8x16SConvertI16x8:
-      ASSEMBLE_NEON_NARROWING_OP(NeonS8);
+      ASSEMBLE_NEON_NARROWING_OP(NeonS8, NeonS8);
       break;
     case kArmI8x16Add: {
       __ vadd(Neon8, i.OutputSimd128Register(), i.InputSimd128Register(0),
@@ -2319,7 +2644,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kArmI8x16UConvertI16x8:
-      ASSEMBLE_NEON_NARROWING_OP(NeonU8);
+      ASSEMBLE_NEON_NARROWING_OP(NeonU8, NeonS8);
       break;
     case kArmI8x16AddSaturateU: {
       __ vqadd(NeonU8, i.OutputSimd128Register(), i.InputSimd128Register(0),
@@ -2351,6 +2676,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
               i.InputSimd128Register(1));
       break;
     }
+    case kArmI8x16RoundingAverageU: {
+      __ vrhadd(NeonU8, i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
     case kArmS128Zero: {
       __ veor(i.OutputSimd128Register(), i.OutputSimd128Register(),
               i.OutputSimd128Register());
@@ -2393,6 +2723,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ vbsl(dst, i.InputSimd128Register(1), i.InputSimd128Register(2));
       break;
     }
+    case kArmS128AndNot: {
+      __ vbic(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1));
+      break;
+    }
     case kArmS32x4ZipLeft: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src1 = i.InputSimd128Register(1);
@@ -2607,6 +2942,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
               i.InputSimd128Register(1), i.InputInt4(2));
       break;
     }
+    case kArmS8x16Swizzle: {
+      Simd128Register dst = i.OutputSimd128Register(),
+                      tbl = i.InputSimd128Register(0),
+                      src = i.InputSimd128Register(1);
+      NeonListOperand table(tbl);
+      __ vtbl(dst.low(), table, src.low());
+      __ vtbl(dst.high(), table, src.high());
+      break;
+    }
     case kArmS8x16Shuffle: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src0 = i.InputSimd128Register(0),
@@ -2737,6 +3081,63 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ mov(i.OutputRegister(), Operand(1), LeaveCC, ne);
       break;
     }
+    case kArmS8x16LoadSplat: {
+      __ vld1r(Neon8, NeonListOperand(i.OutputSimd128Register()),
+               i.NeonInputOperand(0));
+      break;
+    }
+    case kArmS16x8LoadSplat: {
+      __ vld1r(Neon16, NeonListOperand(i.OutputSimd128Register()),
+               i.NeonInputOperand(0));
+      break;
+    }
+    case kArmS32x4LoadSplat: {
+      __ vld1r(Neon32, NeonListOperand(i.OutputSimd128Register()),
+               i.NeonInputOperand(0));
+      break;
+    }
+    case kArmS64x2LoadSplat: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vld1(Neon32, NeonListOperand(dst.low()), i.NeonInputOperand(0));
+      __ Move(dst.high(), dst.low());
+      break;
+    }
+    case kArmI16x8Load8x8S: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vld1(Neon8, NeonListOperand(dst.low()), i.NeonInputOperand(0));
+      __ vmovl(NeonS8, dst, dst.low());
+      break;
+    }
+    case kArmI16x8Load8x8U: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vld1(Neon8, NeonListOperand(dst.low()), i.NeonInputOperand(0));
+      __ vmovl(NeonU8, dst, dst.low());
+      break;
+    }
+    case kArmI32x4Load16x4S: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vld1(Neon16, NeonListOperand(dst.low()), i.NeonInputOperand(0));
+      __ vmovl(NeonS16, dst, dst.low());
+      break;
+    }
+    case kArmI32x4Load16x4U: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vld1(Neon16, NeonListOperand(dst.low()), i.NeonInputOperand(0));
+      __ vmovl(NeonU16, dst, dst.low());
+      break;
+    }
+    case kArmI64x2Load32x2S: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vld1(Neon32, NeonListOperand(dst.low()), i.NeonInputOperand(0));
+      __ vmovl(NeonS32, dst, dst.low());
+      break;
+    }
+    case kArmI64x2Load32x2U: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vld1(Neon32, NeonListOperand(dst.low()), i.NeonInputOperand(0));
+      __ vmovl(NeonU32, dst, dst.low());
+      break;
+    }
     case kWord32AtomicLoadInt8:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(ldrsb);
       break;
@@ -2834,10 +3235,27 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       ATOMIC_BINOP_CASE(Xor, eor)
 #undef ATOMIC_BINOP_CASE
     case kArmWord32AtomicPairLoad: {
-      DCHECK(VerifyOutputOfAtomicPairInstr(&i, instr, r0, r1));
-      __ add(i.TempRegister(0), i.InputRegister(0), i.InputRegister(1));
-      __ ldrexd(r0, r1, i.TempRegister(0));
-      __ dmb(ISH);
+      if (instr->OutputCount() == 2) {
+        DCHECK(VerifyOutputOfAtomicPairInstr(&i, instr, r0, r1));
+        __ add(i.TempRegister(0), i.InputRegister(0), i.InputRegister(1));
+        __ ldrexd(r0, r1, i.TempRegister(0));
+        __ dmb(ISH);
+      } else {
+        // A special case of this instruction: even though this is a pair load,
+        // we only need one of the two words. We emit a normal atomic load.
+        DCHECK_EQ(instr->OutputCount(), 1);
+        Register base = i.InputRegister(0);
+        Register offset = i.InputRegister(1);
+        DCHECK(instr->InputAt(2)->IsImmediate());
+        int32_t offset_imm = i.InputInt32(2);
+        if (offset_imm != 0) {
+          Register temp = i.TempRegister(0);
+          __ add(temp, offset, Operand(offset_imm));
+          offset = temp;
+        }
+        __ ldr(i.OutputRegister(), MemOperand(base, offset));
+        __ dmb(ISH);
+      }
       break;
     }
     case kArmWord32AtomicPairStore: {
@@ -3047,9 +3465,10 @@ void CodeGenerator::AssembleArchTableSwitch(Instruction* instr) {
   ArmOperandConverter i(this, instr);
   Register input = i.InputRegister(0);
   size_t const case_count = instr->InputCount() - 2;
+  // This {cmp} might still emit a constant pool entry.
+  __ cmp(input, Operand(case_count));
   // Ensure to emit the constant pool first if necessary.
   __ CheckConstPool(true, true);
-  __ cmp(input, Operand(case_count));
   __ BlockConstPoolFor(case_count + 2);
   __ add(pc, pc, Operand(input, LSL, 2), LeaveCC, lo);
   __ b(GetLabel(i.InputRpo(1)));
diff --git a/deps/v8/src/compiler/backend/arm/instruction-codes-arm.h b/deps/v8/src/compiler/backend/arm/instruction-codes-arm.h
index d398ec0ed6e2f2..8173d32833c98b 100644
--- a/deps/v8/src/compiler/backend/arm/instruction-codes-arm.h
+++ b/deps/v8/src/compiler/backend/arm/instruction-codes-arm.h
@@ -128,6 +128,22 @@ namespace compiler {
   V(ArmPeek)                       \
   V(ArmDmbIsh)                     \
   V(ArmDsbIsb)                     \
+  V(ArmF64x2Splat)                 \
+  V(ArmF64x2ExtractLane)           \
+  V(ArmF64x2ReplaceLane)           \
+  V(ArmF64x2Abs)                   \
+  V(ArmF64x2Neg)                   \
+  V(ArmF64x2Sqrt)                  \
+  V(ArmF64x2Add)                   \
+  V(ArmF64x2Sub)                   \
+  V(ArmF64x2Mul)                   \
+  V(ArmF64x2Div)                   \
+  V(ArmF64x2Min)                   \
+  V(ArmF64x2Max)                   \
+  V(ArmF64x2Eq)                    \
+  V(ArmF64x2Ne)                    \
+  V(ArmF64x2Lt)                    \
+  V(ArmF64x2Le)                    \
   V(ArmF32x4Splat)                 \
   V(ArmF32x4ExtractLane)           \
   V(ArmF32x4ReplaceLane)           \
@@ -149,6 +165,15 @@ namespace compiler {
   V(ArmF32x4Ne)                    \
   V(ArmF32x4Lt)                    \
   V(ArmF32x4Le)                    \
+  V(ArmI64x2SplatI32Pair)          \
+  V(ArmI64x2ReplaceLaneI32Pair)    \
+  V(ArmI64x2Neg)                   \
+  V(ArmI64x2Shl)                   \
+  V(ArmI64x2ShrS)                  \
+  V(ArmI64x2Add)                   \
+  V(ArmI64x2Sub)                   \
+  V(ArmI64x2Mul)                   \
+  V(ArmI64x2ShrU)                  \
   V(ArmI32x4Splat)                 \
   V(ArmI32x4ExtractLane)           \
   V(ArmI32x4ReplaceLane)           \
@@ -177,7 +202,7 @@ namespace compiler {
   V(ArmI32x4GtU)                   \
   V(ArmI32x4GeU)                   \
   V(ArmI16x8Splat)                 \
-  V(ArmI16x8ExtractLane)           \
+  V(ArmI16x8ExtractLaneS)          \
   V(ArmI16x8ReplaceLane)           \
   V(ArmI16x8SConvertI8x16Low)      \
   V(ArmI16x8SConvertI8x16High)     \
@@ -197,6 +222,7 @@ namespace compiler {
   V(ArmI16x8Ne)                    \
   V(ArmI16x8GtS)                   \
   V(ArmI16x8GeS)                   \
+  V(ArmI16x8ExtractLaneU)          \
   V(ArmI16x8UConvertI8x16Low)      \
   V(ArmI16x8UConvertI8x16High)     \
   V(ArmI16x8ShrU)                  \
@@ -207,8 +233,9 @@ namespace compiler {
   V(ArmI16x8MaxU)                  \
   V(ArmI16x8GtU)                   \
   V(ArmI16x8GeU)                   \
+  V(ArmI16x8RoundingAverageU)      \
   V(ArmI8x16Splat)                 \
-  V(ArmI8x16ExtractLane)           \
+  V(ArmI8x16ExtractLaneS)          \
   V(ArmI8x16ReplaceLane)           \
   V(ArmI8x16Neg)                   \
   V(ArmI8x16Shl)                   \
@@ -225,6 +252,7 @@ namespace compiler {
   V(ArmI8x16Ne)                    \
   V(ArmI8x16GtS)                   \
   V(ArmI8x16GeS)                   \
+  V(ArmI8x16ExtractLaneU)          \
   V(ArmI8x16ShrU)                  \
   V(ArmI8x16UConvertI16x8)         \
   V(ArmI8x16AddSaturateU)          \
@@ -233,6 +261,7 @@ namespace compiler {
   V(ArmI8x16MaxU)                  \
   V(ArmI8x16GtU)                   \
   V(ArmI8x16GeU)                   \
+  V(ArmI8x16RoundingAverageU)      \
   V(ArmS128Zero)                   \
   V(ArmS128Dup)                    \
   V(ArmS128And)                    \
@@ -240,6 +269,7 @@ namespace compiler {
   V(ArmS128Xor)                    \
   V(ArmS128Not)                    \
   V(ArmS128Select)                 \
+  V(ArmS128AndNot)                 \
   V(ArmS32x4ZipLeft)               \
   V(ArmS32x4ZipRight)              \
   V(ArmS32x4UnzipLeft)             \
@@ -260,6 +290,7 @@ namespace compiler {
   V(ArmS8x16TransposeLeft)         \
   V(ArmS8x16TransposeRight)        \
   V(ArmS8x16Concat)                \
+  V(ArmS8x16Swizzle)               \
   V(ArmS8x16Shuffle)               \
   V(ArmS32x2Reverse)               \
   V(ArmS16x4Reverse)               \
@@ -273,6 +304,16 @@ namespace compiler {
   V(ArmS1x8AllTrue)                \
   V(ArmS1x16AnyTrue)               \
   V(ArmS1x16AllTrue)               \
+  V(ArmS8x16LoadSplat)             \
+  V(ArmS16x8LoadSplat)             \
+  V(ArmS32x4LoadSplat)             \
+  V(ArmS64x2LoadSplat)             \
+  V(ArmI16x8Load8x8S)              \
+  V(ArmI16x8Load8x8U)              \
+  V(ArmI32x4Load16x4S)             \
+  V(ArmI32x4Load16x4U)             \
+  V(ArmI64x2Load32x2S)             \
+  V(ArmI64x2Load32x2U)             \
   V(ArmWord32AtomicPairLoad)       \
   V(ArmWord32AtomicPairStore)      \
   V(ArmWord32AtomicPairAdd)        \
@@ -299,7 +340,8 @@ namespace compiler {
   V(Operand2_R_ASR_R) /* %r0 ASR %r1 */ \
   V(Operand2_R_LSL_R) /* %r0 LSL %r1 */ \
   V(Operand2_R_LSR_R) /* %r0 LSR %r1 */ \
-  V(Operand2_R_ROR_R) /* %r0 ROR %r1 */
+  V(Operand2_R_ROR_R) /* %r0 ROR %r1 */ \
+  V(Root)             /* [%rr + K] */
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/backend/arm/instruction-scheduler-arm.cc b/deps/v8/src/compiler/backend/arm/instruction-scheduler-arm.cc
index 92be55dcc3d662..4c0be32d8aa8b1 100644
--- a/deps/v8/src/compiler/backend/arm/instruction-scheduler-arm.cc
+++ b/deps/v8/src/compiler/backend/arm/instruction-scheduler-arm.cc
@@ -108,6 +108,22 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmFloat32Min:
     case kArmFloat64Min:
     case kArmFloat64SilenceNaN:
+    case kArmF64x2Splat:
+    case kArmF64x2ExtractLane:
+    case kArmF64x2ReplaceLane:
+    case kArmF64x2Abs:
+    case kArmF64x2Neg:
+    case kArmF64x2Sqrt:
+    case kArmF64x2Add:
+    case kArmF64x2Sub:
+    case kArmF64x2Mul:
+    case kArmF64x2Div:
+    case kArmF64x2Min:
+    case kArmF64x2Max:
+    case kArmF64x2Eq:
+    case kArmF64x2Ne:
+    case kArmF64x2Lt:
+    case kArmF64x2Le:
     case kArmF32x4Splat:
     case kArmF32x4ExtractLane:
     case kArmF32x4ReplaceLane:
@@ -129,6 +145,15 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmF32x4Ne:
     case kArmF32x4Lt:
     case kArmF32x4Le:
+    case kArmI64x2SplatI32Pair:
+    case kArmI64x2ReplaceLaneI32Pair:
+    case kArmI64x2Neg:
+    case kArmI64x2Shl:
+    case kArmI64x2ShrS:
+    case kArmI64x2Add:
+    case kArmI64x2Sub:
+    case kArmI64x2Mul:
+    case kArmI64x2ShrU:
     case kArmI32x4Splat:
     case kArmI32x4ExtractLane:
     case kArmI32x4ReplaceLane:
@@ -157,7 +182,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmI32x4GtU:
     case kArmI32x4GeU:
     case kArmI16x8Splat:
-    case kArmI16x8ExtractLane:
+    case kArmI16x8ExtractLaneS:
     case kArmI16x8ReplaceLane:
     case kArmI16x8SConvertI8x16Low:
     case kArmI16x8SConvertI8x16High:
@@ -177,6 +202,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmI16x8Ne:
     case kArmI16x8GtS:
     case kArmI16x8GeS:
+    case kArmI16x8ExtractLaneU:
     case kArmI16x8UConvertI8x16Low:
     case kArmI16x8UConvertI8x16High:
     case kArmI16x8ShrU:
@@ -187,8 +213,9 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmI16x8MaxU:
     case kArmI16x8GtU:
     case kArmI16x8GeU:
+    case kArmI16x8RoundingAverageU:
     case kArmI8x16Splat:
-    case kArmI8x16ExtractLane:
+    case kArmI8x16ExtractLaneS:
     case kArmI8x16ReplaceLane:
     case kArmI8x16Neg:
     case kArmI8x16Shl:
@@ -205,6 +232,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmI8x16Ne:
     case kArmI8x16GtS:
     case kArmI8x16GeS:
+    case kArmI8x16ExtractLaneU:
     case kArmI8x16UConvertI16x8:
     case kArmI8x16AddSaturateU:
     case kArmI8x16SubSaturateU:
@@ -213,6 +241,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmI8x16MaxU:
     case kArmI8x16GtU:
     case kArmI8x16GeU:
+    case kArmI8x16RoundingAverageU:
     case kArmS128Zero:
     case kArmS128Dup:
     case kArmS128And:
@@ -220,6 +249,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmS128Xor:
     case kArmS128Not:
     case kArmS128Select:
+    case kArmS128AndNot:
     case kArmS32x4ZipLeft:
     case kArmS32x4ZipRight:
     case kArmS32x4UnzipLeft:
@@ -240,6 +270,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmS8x16TransposeLeft:
     case kArmS8x16TransposeRight:
     case kArmS8x16Concat:
+    case kArmS8x16Swizzle:
     case kArmS8x16Shuffle:
     case kArmS32x2Reverse:
     case kArmS16x4Reverse:
@@ -266,6 +297,16 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmLdr:
     case kArmPeek:
     case kArmWord32AtomicPairLoad:
+    case kArmS8x16LoadSplat:
+    case kArmS16x8LoadSplat:
+    case kArmS32x4LoadSplat:
+    case kArmS64x2LoadSplat:
+    case kArmI16x8Load8x8S:
+    case kArmI16x8Load8x8U:
+    case kArmI32x4Load16x4S:
+    case kArmI32x4Load16x4U:
+    case kArmI64x2Load32x2S:
+    case kArmI64x2Load32x2U:
       return kIsLoadOperation;
 
     case kArmVstrF32:
diff --git a/deps/v8/src/compiler/backend/arm/instruction-selector-arm.cc b/deps/v8/src/compiler/backend/arm/instruction-selector-arm.cc
index 303648051f8d85..0027c7a570b0ee 100644
--- a/deps/v8/src/compiler/backend/arm/instruction-selector-arm.cc
+++ b/deps/v8/src/compiler/backend/arm/instruction-selector-arm.cc
@@ -133,7 +133,7 @@ void VisitRRIR(InstructionSelector* selector, ArchOpcode opcode, Node* node) {
   int32_t imm = OpParameter<int32_t>(node->op());
   selector->Emit(opcode, g.DefineAsRegister(node),
                  g.UseRegister(node->InputAt(0)), g.UseImmediate(imm),
-                 g.UseRegister(node->InputAt(1)));
+                 g.UseUniqueRegister(node->InputAt(1)));
 }
 
 template <IrOpcode::Value kOpcode, int kImmMin, int kImmMax,
@@ -361,7 +361,6 @@ void EmitAddBeforeS128LoadStore(InstructionSelector* selector,
                                 InstructionCode* opcode_return,
                                 size_t* input_count_return,
                                 InstructionOperand* inputs) {
-  DCHECK(*opcode_return == kArmVld1S128 || *opcode_return == kArmVst1S128);
   ArmOperandGenerator g(selector);
   InstructionOperand addr = g.TempRegister();
   InstructionCode op = kArmAdd;
@@ -378,6 +377,22 @@ void EmitLoad(InstructionSelector* selector, InstructionCode opcode,
   InstructionOperand inputs[3];
   size_t input_count = 2;
 
+  ExternalReferenceMatcher m(base);
+  if (m.HasValue() && selector->CanAddressRelativeToRootsRegister(m.Value())) {
+    Int32Matcher int_matcher(index);
+    if (int_matcher.HasValue()) {
+      ptrdiff_t const delta =
+          int_matcher.Value() +
+          TurboAssemblerBase::RootRegisterOffsetForExternalReference(
+              selector->isolate(), m.Value());
+      input_count = 1;
+      inputs[0] = g.UseImmediate(static_cast<int32_t>(delta));
+      opcode |= AddressingModeField::encode(kMode_Root);
+      selector->Emit(opcode, 1, output, input_count, inputs);
+      return;
+    }
+  }
+
   inputs[0] = g.UseRegister(base);
   if (g.CanBeImmediate(index, opcode)) {
     inputs[1] = g.UseImmediate(index);
@@ -428,33 +443,32 @@ void VisitPairAtomicBinOp(InstructionSelector* selector, Node* node,
   Node* value = node->InputAt(2);
   Node* value_high = node->InputAt(3);
   AddressingMode addressing_mode = kMode_Offset_RR;
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
   InstructionOperand inputs[] = {
       g.UseUniqueRegister(value), g.UseUniqueRegister(value_high),
       g.UseUniqueRegister(base), g.UseUniqueRegister(index)};
+  InstructionOperand outputs[2];
+  size_t output_count = 0;
+  InstructionOperand temps[6];
+  size_t temp_count = 0;
+  temps[temp_count++] = g.TempRegister();
+  temps[temp_count++] = g.TempRegister(r6);
+  temps[temp_count++] = g.TempRegister(r7);
+  temps[temp_count++] = g.TempRegister();
   Node* projection0 = NodeProperties::FindProjection(node, 0);
   Node* projection1 = NodeProperties::FindProjection(node, 1);
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  if (projection0) {
+    outputs[output_count++] = g.DefineAsFixed(projection0, r2);
+  } else {
+    temps[temp_count++] = g.TempRegister(r2);
+  }
   if (projection1) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, r2),
-                                    g.DefineAsFixed(projection1, r3)};
-    InstructionOperand temps[] = {g.TempRegister(), g.TempRegister(r6),
-                                  g.TempRegister(r7), g.TempRegister()};
-    selector->Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
-                   arraysize(temps), temps);
-  } else if (projection0) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, r2)};
-    InstructionOperand temps[] = {g.TempRegister(), g.TempRegister(r6),
-                                  g.TempRegister(r7), g.TempRegister(),
-                                  g.TempRegister(r3)};
-    selector->Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
-                   arraysize(temps), temps);
+    outputs[output_count++] = g.DefineAsFixed(projection1, r3);
   } else {
-    InstructionOperand temps[] = {g.TempRegister(),   g.TempRegister(r6),
-                                  g.TempRegister(r7), g.TempRegister(),
-                                  g.TempRegister(r2), g.TempRegister(r3)};
-    selector->Emit(code, 0, nullptr, arraysize(inputs), inputs,
-                   arraysize(temps), temps);
+    temps[temp_count++] = g.TempRegister(r3);
   }
+  selector->Emit(code, output_count, outputs, arraysize(inputs), inputs,
+                 temp_count, temps);
 }
 
 }  // namespace
@@ -473,6 +487,54 @@ void InstructionSelector::VisitAbortCSAAssert(Node* node) {
   Emit(kArchAbortCSAAssert, g.NoOutput(), g.UseFixed(node->InputAt(0), r1));
 }
 
+void InstructionSelector::VisitLoadTransform(Node* node) {
+  LoadTransformParameters params = LoadTransformParametersOf(node->op());
+  InstructionCode opcode = kArchNop;
+  switch (params.transformation) {
+    case LoadTransformation::kS8x16LoadSplat:
+      opcode = kArmS8x16LoadSplat;
+      break;
+    case LoadTransformation::kS16x8LoadSplat:
+      opcode = kArmS16x8LoadSplat;
+      break;
+    case LoadTransformation::kS32x4LoadSplat:
+      opcode = kArmS32x4LoadSplat;
+      break;
+    case LoadTransformation::kS64x2LoadSplat:
+      opcode = kArmS64x2LoadSplat;
+      break;
+    case LoadTransformation::kI16x8Load8x8S:
+      opcode = kArmI16x8Load8x8S;
+      break;
+    case LoadTransformation::kI16x8Load8x8U:
+      opcode = kArmI16x8Load8x8U;
+      break;
+    case LoadTransformation::kI32x4Load16x4S:
+      opcode = kArmI32x4Load16x4S;
+      break;
+    case LoadTransformation::kI32x4Load16x4U:
+      opcode = kArmI32x4Load16x4U;
+      break;
+    case LoadTransformation::kI64x2Load32x2S:
+      opcode = kArmI64x2Load32x2S;
+      break;
+    case LoadTransformation::kI64x2Load32x2U:
+      opcode = kArmI64x2Load32x2U;
+      break;
+    default:
+      UNIMPLEMENTED();
+  }
+
+  ArmOperandGenerator g(this);
+  InstructionOperand output = g.DefineAsRegister(node);
+  InstructionOperand inputs[2];
+  size_t input_count = 2;
+  inputs[0] = g.UseRegister(node->InputAt(0));
+  inputs[1] = g.UseRegister(node->InputAt(1));
+  EmitAddBeforeS128LoadStore(this, &opcode, &input_count, &inputs[0]);
+  Emit(opcode, 1, &output, input_count, inputs);
+}
+
 void InstructionSelector::VisitLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   ArmOperandGenerator g(this);
@@ -503,7 +565,6 @@ void InstructionSelector::VisitLoad(Node* node) {
     case MachineRepresentation::kSimd128:
       opcode = kArmVld1S128;
       break;
-    case MachineRepresentation::kCompressedSigned:   // Fall through.
     case MachineRepresentation::kCompressedPointer:  // Fall through.
     case MachineRepresentation::kCompressed:         // Fall through.
     case MachineRepresentation::kWord64:             // Fall through.
@@ -584,7 +645,6 @@ void InstructionSelector::VisitStore(Node* node) {
       case MachineRepresentation::kSimd128:
         opcode = kArmVst1S128;
         break;
-      case MachineRepresentation::kCompressedSigned:   // Fall through.
       case MachineRepresentation::kCompressedPointer:  // Fall through.
       case MachineRepresentation::kCompressed:         // Fall through.
       case MachineRepresentation::kWord64:             // Fall through.
@@ -593,6 +653,24 @@ void InstructionSelector::VisitStore(Node* node) {
         return;
     }
 
+    ExternalReferenceMatcher m(base);
+    if (m.HasValue() && CanAddressRelativeToRootsRegister(m.Value())) {
+      Int32Matcher int_matcher(index);
+      if (int_matcher.HasValue()) {
+        ptrdiff_t const delta =
+            int_matcher.Value() +
+            TurboAssemblerBase::RootRegisterOffsetForExternalReference(
+                isolate(), m.Value());
+        int input_count = 2;
+        InstructionOperand inputs[2];
+        inputs[0] = g.UseRegister(value);
+        inputs[1] = g.UseImmediate(static_cast<int32_t>(delta));
+        opcode |= AddressingModeField::encode(kMode_Root);
+        Emit(opcode, 0, nullptr, input_count, inputs);
+        return;
+      }
+    }
+
     InstructionOperand inputs[4];
     size_t input_count = 0;
     inputs[input_count++] = g.UseRegister(value);
@@ -909,11 +987,31 @@ void InstructionSelector::VisitWord32Xor(Node* node) {
 
 void InstructionSelector::VisitStackPointerGreaterThan(
     Node* node, FlagsContinuation* cont) {
-  Node* const value = node->InputAt(0);
-  InstructionCode opcode = kArchStackPointerGreaterThan;
+  StackCheckKind kind = StackCheckKindOf(node->op());
+  InstructionCode opcode =
+      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
 
   ArmOperandGenerator g(this);
-  EmitWithContinuation(opcode, g.UseRegister(value), cont);
+
+  // No outputs.
+  InstructionOperand* const outputs = nullptr;
+  const int output_count = 0;
+
+  // Applying an offset to this stack check requires a temp register. Offsets
+  // are only applied to the first stack check. If applying an offset, we must
+  // ensure the input and temp registers do not alias, thus kUniqueRegister.
+  InstructionOperand temps[] = {g.TempRegister()};
+  const int temp_count = (kind == StackCheckKind::kJSFunctionEntry) ? 1 : 0;
+  const auto register_mode = (kind == StackCheckKind::kJSFunctionEntry)
+                                 ? OperandGenerator::kUniqueRegister
+                                 : OperandGenerator::kRegister;
+
+  Node* const value = node->InputAt(0);
+  InstructionOperand inputs[] = {g.UseRegisterWithMode(value, register_mode)};
+  static constexpr int input_count = arraysize(inputs);
+
+  EmitWithContinuation(opcode, output_count, outputs, input_count, inputs,
+                       temp_count, temps, cont);
 }
 
 namespace {
@@ -1310,14 +1408,14 @@ void InstructionSelector::VisitInt32Mul(Node* node) {
       Emit(kArmAdd | AddressingModeField::encode(kMode_Operand2_R_LSL_I),
            g.DefineAsRegister(node), g.UseRegister(m.left().node()),
            g.UseRegister(m.left().node()),
-           g.TempImmediate(WhichPowerOf2(value - 1)));
+           g.TempImmediate(base::bits::WhichPowerOfTwo(value - 1)));
       return;
     }
     if (value < kMaxInt && base::bits::IsPowerOfTwo(value + 1)) {
       Emit(kArmRsb | AddressingModeField::encode(kMode_Operand2_R_LSL_I),
            g.DefineAsRegister(node), g.UseRegister(m.left().node()),
            g.UseRegister(m.left().node()),
-           g.TempImmediate(WhichPowerOf2(value + 1)));
+           g.TempImmediate(base::bits::WhichPowerOfTwo(value + 1)));
       return;
     }
   }
@@ -2247,29 +2345,34 @@ void InstructionSelector::VisitWord32AtomicPairLoad(Node* node) {
   ArmOperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
-  AddressingMode addressing_mode = kMode_Offset_RR;
-  InstructionCode code =
-      kArmWord32AtomicPairLoad | AddressingModeField::encode(addressing_mode);
-  InstructionOperand inputs[] = {g.UseUniqueRegister(base),
-                                 g.UseUniqueRegister(index)};
+  InstructionOperand inputs[3];
+  size_t input_count = 0;
+  inputs[input_count++] = g.UseUniqueRegister(base);
+  inputs[input_count++] = g.UseUniqueRegister(index);
+  InstructionOperand temps[1];
+  size_t temp_count = 0;
+  InstructionOperand outputs[2];
+  size_t output_count = 0;
+
   Node* projection0 = NodeProperties::FindProjection(node, 0);
   Node* projection1 = NodeProperties::FindProjection(node, 1);
-  if (projection1) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, r0),
-                                    g.DefineAsFixed(projection1, r1)};
-    InstructionOperand temps[] = {g.TempRegister()};
-    Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
-         arraysize(temps), temps);
+  if (projection0 && projection1) {
+    outputs[output_count++] = g.DefineAsFixed(projection0, r0);
+    outputs[output_count++] = g.DefineAsFixed(projection1, r1);
+    temps[temp_count++] = g.TempRegister();
   } else if (projection0) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, r0)};
-    InstructionOperand temps[] = {g.TempRegister(), g.TempRegister(r1)};
-    Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
-         arraysize(temps), temps);
+    inputs[input_count++] = g.UseImmediate(0);
+    outputs[output_count++] = g.DefineAsRegister(projection0);
+  } else if (projection1) {
+    inputs[input_count++] = g.UseImmediate(4);
+    temps[temp_count++] = g.TempRegister();
+    outputs[output_count++] = g.DefineAsRegister(projection1);
   } else {
-    InstructionOperand temps[] = {g.TempRegister(), g.TempRegister(r0),
-                                  g.TempRegister(r1)};
-    Emit(code, 0, nullptr, arraysize(inputs), inputs, arraysize(temps), temps);
+    // There is no use of the loaded value, we don't need to generate code.
+    return;
   }
+  Emit(kArmWord32AtomicPairLoad, output_count, outputs, input_count, inputs,
+       temp_count, temps);
 }
 
 void InstructionSelector::VisitWord32AtomicPairStore(Node* node) {
@@ -2382,6 +2485,9 @@ void InstructionSelector::VisitWord32AtomicPairCompareExchange(Node* node) {
   V(I8x16)
 
 #define SIMD_UNOP_LIST(V)                               \
+  V(F64x2Abs, kArmF64x2Abs)                             \
+  V(F64x2Neg, kArmF64x2Neg)                             \
+  V(F64x2Sqrt, kArmF64x2Sqrt)                           \
   V(F32x4SConvertI32x4, kArmF32x4SConvertI32x4)         \
   V(F32x4UConvertI32x4, kArmF32x4UConvertI32x4)         \
   V(F32x4Abs, kArmF32x4Abs)                             \
@@ -2410,6 +2516,9 @@ void InstructionSelector::VisitWord32AtomicPairCompareExchange(Node* node) {
   V(S1x16AllTrue, kArmS1x16AllTrue)
 
 #define SIMD_SHIFT_OP_LIST(V) \
+  V(I64x2Shl)                 \
+  V(I64x2ShrS)                \
+  V(I64x2ShrU)                \
   V(I32x4Shl)                 \
   V(I32x4ShrS)                \
   V(I32x4ShrU)                \
@@ -2420,73 +2529,88 @@ void InstructionSelector::VisitWord32AtomicPairCompareExchange(Node* node) {
   V(I8x16ShrS)                \
   V(I8x16ShrU)
 
-#define SIMD_BINOP_LIST(V)                      \
-  V(F32x4Add, kArmF32x4Add)                     \
-  V(F32x4AddHoriz, kArmF32x4AddHoriz)           \
-  V(F32x4Sub, kArmF32x4Sub)                     \
-  V(F32x4Mul, kArmF32x4Mul)                     \
-  V(F32x4Min, kArmF32x4Min)                     \
-  V(F32x4Max, kArmF32x4Max)                     \
-  V(F32x4Eq, kArmF32x4Eq)                       \
-  V(F32x4Ne, kArmF32x4Ne)                       \
-  V(F32x4Lt, kArmF32x4Lt)                       \
-  V(F32x4Le, kArmF32x4Le)                       \
-  V(I32x4Add, kArmI32x4Add)                     \
-  V(I32x4AddHoriz, kArmI32x4AddHoriz)           \
-  V(I32x4Sub, kArmI32x4Sub)                     \
-  V(I32x4Mul, kArmI32x4Mul)                     \
-  V(I32x4MinS, kArmI32x4MinS)                   \
-  V(I32x4MaxS, kArmI32x4MaxS)                   \
-  V(I32x4Eq, kArmI32x4Eq)                       \
-  V(I32x4Ne, kArmI32x4Ne)                       \
-  V(I32x4GtS, kArmI32x4GtS)                     \
-  V(I32x4GeS, kArmI32x4GeS)                     \
-  V(I32x4MinU, kArmI32x4MinU)                   \
-  V(I32x4MaxU, kArmI32x4MaxU)                   \
-  V(I32x4GtU, kArmI32x4GtU)                     \
-  V(I32x4GeU, kArmI32x4GeU)                     \
-  V(I16x8SConvertI32x4, kArmI16x8SConvertI32x4) \
-  V(I16x8Add, kArmI16x8Add)                     \
-  V(I16x8AddSaturateS, kArmI16x8AddSaturateS)   \
-  V(I16x8AddHoriz, kArmI16x8AddHoriz)           \
-  V(I16x8Sub, kArmI16x8Sub)                     \
-  V(I16x8SubSaturateS, kArmI16x8SubSaturateS)   \
-  V(I16x8Mul, kArmI16x8Mul)                     \
-  V(I16x8MinS, kArmI16x8MinS)                   \
-  V(I16x8MaxS, kArmI16x8MaxS)                   \
-  V(I16x8Eq, kArmI16x8Eq)                       \
-  V(I16x8Ne, kArmI16x8Ne)                       \
-  V(I16x8GtS, kArmI16x8GtS)                     \
-  V(I16x8GeS, kArmI16x8GeS)                     \
-  V(I16x8UConvertI32x4, kArmI16x8UConvertI32x4) \
-  V(I16x8AddSaturateU, kArmI16x8AddSaturateU)   \
-  V(I16x8SubSaturateU, kArmI16x8SubSaturateU)   \
-  V(I16x8MinU, kArmI16x8MinU)                   \
-  V(I16x8MaxU, kArmI16x8MaxU)                   \
-  V(I16x8GtU, kArmI16x8GtU)                     \
-  V(I16x8GeU, kArmI16x8GeU)                     \
-  V(I8x16SConvertI16x8, kArmI8x16SConvertI16x8) \
-  V(I8x16Add, kArmI8x16Add)                     \
-  V(I8x16AddSaturateS, kArmI8x16AddSaturateS)   \
-  V(I8x16Sub, kArmI8x16Sub)                     \
-  V(I8x16SubSaturateS, kArmI8x16SubSaturateS)   \
-  V(I8x16Mul, kArmI8x16Mul)                     \
-  V(I8x16MinS, kArmI8x16MinS)                   \
-  V(I8x16MaxS, kArmI8x16MaxS)                   \
-  V(I8x16Eq, kArmI8x16Eq)                       \
-  V(I8x16Ne, kArmI8x16Ne)                       \
-  V(I8x16GtS, kArmI8x16GtS)                     \
-  V(I8x16GeS, kArmI8x16GeS)                     \
-  V(I8x16UConvertI16x8, kArmI8x16UConvertI16x8) \
-  V(I8x16AddSaturateU, kArmI8x16AddSaturateU)   \
-  V(I8x16SubSaturateU, kArmI8x16SubSaturateU)   \
-  V(I8x16MinU, kArmI8x16MinU)                   \
-  V(I8x16MaxU, kArmI8x16MaxU)                   \
-  V(I8x16GtU, kArmI8x16GtU)                     \
-  V(I8x16GeU, kArmI8x16GeU)                     \
-  V(S128And, kArmS128And)                       \
-  V(S128Or, kArmS128Or)                         \
-  V(S128Xor, kArmS128Xor)
+#define SIMD_BINOP_LIST(V)                            \
+  V(F64x2Add, kArmF64x2Add)                           \
+  V(F64x2Sub, kArmF64x2Sub)                           \
+  V(F64x2Mul, kArmF64x2Mul)                           \
+  V(F64x2Div, kArmF64x2Div)                           \
+  V(F64x2Min, kArmF64x2Min)                           \
+  V(F64x2Max, kArmF64x2Max)                           \
+  V(F64x2Eq, kArmF64x2Eq)                             \
+  V(F64x2Ne, kArmF64x2Ne)                             \
+  V(F64x2Lt, kArmF64x2Lt)                             \
+  V(F64x2Le, kArmF64x2Le)                             \
+  V(F32x4Add, kArmF32x4Add)                           \
+  V(F32x4AddHoriz, kArmF32x4AddHoriz)                 \
+  V(F32x4Sub, kArmF32x4Sub)                           \
+  V(F32x4Mul, kArmF32x4Mul)                           \
+  V(F32x4Min, kArmF32x4Min)                           \
+  V(F32x4Max, kArmF32x4Max)                           \
+  V(F32x4Eq, kArmF32x4Eq)                             \
+  V(F32x4Ne, kArmF32x4Ne)                             \
+  V(F32x4Lt, kArmF32x4Lt)                             \
+  V(F32x4Le, kArmF32x4Le)                             \
+  V(I64x2Add, kArmI64x2Add)                           \
+  V(I64x2Sub, kArmI64x2Sub)                           \
+  V(I32x4Add, kArmI32x4Add)                           \
+  V(I32x4AddHoriz, kArmI32x4AddHoriz)                 \
+  V(I32x4Sub, kArmI32x4Sub)                           \
+  V(I32x4Mul, kArmI32x4Mul)                           \
+  V(I32x4MinS, kArmI32x4MinS)                         \
+  V(I32x4MaxS, kArmI32x4MaxS)                         \
+  V(I32x4Eq, kArmI32x4Eq)                             \
+  V(I32x4Ne, kArmI32x4Ne)                             \
+  V(I32x4GtS, kArmI32x4GtS)                           \
+  V(I32x4GeS, kArmI32x4GeS)                           \
+  V(I32x4MinU, kArmI32x4MinU)                         \
+  V(I32x4MaxU, kArmI32x4MaxU)                         \
+  V(I32x4GtU, kArmI32x4GtU)                           \
+  V(I32x4GeU, kArmI32x4GeU)                           \
+  V(I16x8SConvertI32x4, kArmI16x8SConvertI32x4)       \
+  V(I16x8Add, kArmI16x8Add)                           \
+  V(I16x8AddSaturateS, kArmI16x8AddSaturateS)         \
+  V(I16x8AddHoriz, kArmI16x8AddHoriz)                 \
+  V(I16x8Sub, kArmI16x8Sub)                           \
+  V(I16x8SubSaturateS, kArmI16x8SubSaturateS)         \
+  V(I16x8Mul, kArmI16x8Mul)                           \
+  V(I16x8MinS, kArmI16x8MinS)                         \
+  V(I16x8MaxS, kArmI16x8MaxS)                         \
+  V(I16x8Eq, kArmI16x8Eq)                             \
+  V(I16x8Ne, kArmI16x8Ne)                             \
+  V(I16x8GtS, kArmI16x8GtS)                           \
+  V(I16x8GeS, kArmI16x8GeS)                           \
+  V(I16x8UConvertI32x4, kArmI16x8UConvertI32x4)       \
+  V(I16x8AddSaturateU, kArmI16x8AddSaturateU)         \
+  V(I16x8SubSaturateU, kArmI16x8SubSaturateU)         \
+  V(I16x8MinU, kArmI16x8MinU)                         \
+  V(I16x8MaxU, kArmI16x8MaxU)                         \
+  V(I16x8GtU, kArmI16x8GtU)                           \
+  V(I16x8GeU, kArmI16x8GeU)                           \
+  V(I16x8RoundingAverageU, kArmI16x8RoundingAverageU) \
+  V(I8x16SConvertI16x8, kArmI8x16SConvertI16x8)       \
+  V(I8x16Add, kArmI8x16Add)                           \
+  V(I8x16AddSaturateS, kArmI8x16AddSaturateS)         \
+  V(I8x16Sub, kArmI8x16Sub)                           \
+  V(I8x16SubSaturateS, kArmI8x16SubSaturateS)         \
+  V(I8x16Mul, kArmI8x16Mul)                           \
+  V(I8x16MinS, kArmI8x16MinS)                         \
+  V(I8x16MaxS, kArmI8x16MaxS)                         \
+  V(I8x16Eq, kArmI8x16Eq)                             \
+  V(I8x16Ne, kArmI8x16Ne)                             \
+  V(I8x16GtS, kArmI8x16GtS)                           \
+  V(I8x16GeS, kArmI8x16GeS)                           \
+  V(I8x16UConvertI16x8, kArmI8x16UConvertI16x8)       \
+  V(I8x16AddSaturateU, kArmI8x16AddSaturateU)         \
+  V(I8x16SubSaturateU, kArmI8x16SubSaturateU)         \
+  V(I8x16MinU, kArmI8x16MinU)                         \
+  V(I8x16MaxU, kArmI8x16MaxU)                         \
+  V(I8x16GtU, kArmI8x16GtU)                           \
+  V(I8x16GeU, kArmI8x16GeU)                           \
+  V(I8x16RoundingAverageU, kArmI8x16RoundingAverageU) \
+  V(S128And, kArmS128And)                             \
+  V(S128Or, kArmS128Or)                               \
+  V(S128Xor, kArmS128Xor)                             \
+  V(S128AndNot, kArmS128AndNot)
 
 void InstructionSelector::VisitS128Zero(Node* node) {
   ArmOperandGenerator g(this);
@@ -2498,13 +2622,20 @@ void InstructionSelector::VisitS128Zero(Node* node) {
     VisitRR(this, kArm##Type##Splat, node);                  \
   }
 SIMD_TYPE_LIST(SIMD_VISIT_SPLAT)
+SIMD_VISIT_SPLAT(F64x2)
 #undef SIMD_VISIT_SPLAT
 
-#define SIMD_VISIT_EXTRACT_LANE(Type)                              \
-  void InstructionSelector::Visit##Type##ExtractLane(Node* node) { \
-    VisitRRI(this, kArm##Type##ExtractLane, node);                 \
-  }
-SIMD_TYPE_LIST(SIMD_VISIT_EXTRACT_LANE)
+#define SIMD_VISIT_EXTRACT_LANE(Type, Sign)                              \
+  void InstructionSelector::Visit##Type##ExtractLane##Sign(Node* node) { \
+    VisitRRI(this, kArm##Type##ExtractLane##Sign, node);                 \
+  }
+SIMD_VISIT_EXTRACT_LANE(F64x2, )
+SIMD_VISIT_EXTRACT_LANE(F32x4, )
+SIMD_VISIT_EXTRACT_LANE(I32x4, )
+SIMD_VISIT_EXTRACT_LANE(I16x8, U)
+SIMD_VISIT_EXTRACT_LANE(I16x8, S)
+SIMD_VISIT_EXTRACT_LANE(I8x16, U)
+SIMD_VISIT_EXTRACT_LANE(I8x16, S)
 #undef SIMD_VISIT_EXTRACT_LANE
 
 #define SIMD_VISIT_REPLACE_LANE(Type)                              \
@@ -2512,6 +2643,7 @@ SIMD_TYPE_LIST(SIMD_VISIT_EXTRACT_LANE)
     VisitRRIR(this, kArm##Type##ReplaceLane, node);                \
   }
 SIMD_TYPE_LIST(SIMD_VISIT_REPLACE_LANE)
+SIMD_VISIT_REPLACE_LANE(F64x2)
 #undef SIMD_VISIT_REPLACE_LANE
 #undef SIMD_TYPE_LIST
 
@@ -2539,6 +2671,38 @@ SIMD_BINOP_LIST(SIMD_VISIT_BINOP)
 #undef SIMD_VISIT_BINOP
 #undef SIMD_BINOP_LIST
 
+void InstructionSelector::VisitI64x2SplatI32Pair(Node* node) {
+  ArmOperandGenerator g(this);
+  InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
+  InstructionOperand operand1 = g.UseRegister(node->InputAt(1));
+  Emit(kArmI64x2SplatI32Pair, g.DefineAsRegister(node), operand0, operand1);
+}
+
+void InstructionSelector::VisitI64x2ReplaceLaneI32Pair(Node* node) {
+  ArmOperandGenerator g(this);
+  InstructionOperand operand = g.UseRegister(node->InputAt(0));
+  InstructionOperand lane = g.UseImmediate(OpParameter<int32_t>(node->op()));
+  InstructionOperand low = g.UseRegister(node->InputAt(1));
+  InstructionOperand high = g.UseRegister(node->InputAt(2));
+  Emit(kArmI64x2ReplaceLaneI32Pair, g.DefineSameAsFirst(node), operand, lane,
+       low, high);
+}
+
+void InstructionSelector::VisitI64x2Neg(Node* node) {
+  ArmOperandGenerator g(this);
+  Emit(kArmI64x2Neg, g.DefineAsRegister(node),
+       g.UseUniqueRegister(node->InputAt(0)));
+}
+
+void InstructionSelector::VisitI64x2Mul(Node* node) {
+  ArmOperandGenerator g(this);
+  InstructionOperand temps[] = {g.TempSimd128Register(),
+                                g.TempSimd128Register()};
+  Emit(kArmI64x2Mul, g.DefineAsRegister(node),
+       g.UseUniqueRegister(node->InputAt(0)),
+       g.UseUniqueRegister(node->InputAt(1)), arraysize(temps), temps);
+}
+
 void InstructionSelector::VisitF32x4Sqrt(Node* node) {
   ArmOperandGenerator g(this);
   // Use fixed registers in the lower 8 Q-registers so we can directly access
@@ -2709,6 +2873,14 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
        g.UseImmediate(Pack4Lanes(shuffle + 12)));
 }
 
+void InstructionSelector::VisitS8x16Swizzle(Node* node) {
+  ArmOperandGenerator g(this);
+  // We don't want input 0 (the table) to be the same as output, since we will
+  // modify output twice (low and high), and need to keep the table the same.
+  Emit(kArmS8x16Swizzle, g.DefineAsRegister(node),
+       g.UseUniqueRegister(node->InputAt(0)), g.UseRegister(node->InputAt(1)));
+}
+
 void InstructionSelector::VisitSignExtendWord8ToInt32(Node* node) {
   ArmOperandGenerator g(this);
   Emit(kArmSxtb, g.DefineAsRegister(node), g.UseRegister(node->InputAt(0)),
diff --git a/deps/v8/src/compiler/backend/arm64/code-generator-arm64.cc b/deps/v8/src/compiler/backend/arm64/code-generator-arm64.cc
index 6f65c905dd136b..7ab1ce07d5502e 100644
--- a/deps/v8/src/compiler/backend/arm64/code-generator-arm64.cc
+++ b/deps/v8/src/compiler/backend/arm64/code-generator-arm64.cc
@@ -301,7 +301,7 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
       // Just encode the stub index. This will be patched when the code
       // is added to the native module and copied into wasm code space.
       __ CallRecordWriteStub(object_, offset_, remembered_set_action,
-                             save_fp_mode, wasm::WasmCode::kWasmRecordWrite);
+                             save_fp_mode, wasm::WasmCode::kRecordWrite);
     } else {
       __ CallRecordWriteStub(object_, offset_, remembered_set_action,
                              save_fp_mode);
@@ -503,8 +503,11 @@ void CodeGenerator::AssembleDeconstructFrame() {
 
 void CodeGenerator::AssemblePrepareTailCall() {
   if (frame_access_state()->has_frame()) {
-    __ Ldr(lr, MemOperand(fp, StandardFrameConstants::kCallerPCOffset));
-    __ Ldr(fp, MemOperand(fp, StandardFrameConstants::kCallerFPOffset));
+    static_assert(
+        StandardFrameConstants::kCallerFPOffset + kSystemPointerSize ==
+            StandardFrameConstants::kCallerPCOffset,
+        "Offsets must be consecutive for ldp!");
+    __ Ldp(fp, lr, MemOperand(fp, StandardFrameConstants::kCallerFPOffset));
   }
   frame_access_state()->SetFrameAccessToSP();
 }
@@ -529,9 +532,7 @@ void CodeGenerator::AssemblePopArgumentsAdaptorFrame(Register args_reg,
          MemOperand(fp, ArgumentsAdaptorFrameConstants::kLengthOffset));
   __ SmiUntag(caller_args_count_reg);
 
-  ParameterCount callee_args_count(args_reg);
-  __ PrepareForTailCall(callee_args_count, caller_args_count_reg, scratch2,
-                        scratch3);
+  __ PrepareForTailCall(args_reg, caller_args_count_reg, scratch2, scratch3);
   __ bind(&done);
 }
 
@@ -792,7 +793,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ CallCFunction(func, num_parameters, 0);
       }
       __ Bind(&return_location);
-      RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
+      if (linkage()->GetIncomingDescriptor()->IsWasmCapiFunction()) {
+        RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
+      }
       frame_access_state()->SetFrameAccessToDefault();
       // Ideally, we should decrement SP delta to match the change of stack
       // pointer in CallCFunction. However, for certain architectures (e.g.
@@ -825,7 +828,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       AssembleArchLookupSwitch(instr);
       break;
     case kArchAbortCSAAssert:
-      DCHECK(i.InputRegister(0).is(x1));
+      DCHECK_EQ(i.InputRegister(0), x1);
       {
         // We don't actually want to generate a pile of code for this, so just
         // claim there is a stack frame, without generating one.
@@ -869,11 +872,26 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     case kArchStackPointerGreaterThan: {
+      // Potentially apply an offset to the current stack pointer before the
+      // comparison to consider the size difference of an optimized frame versus
+      // the contained unoptimized frames.
+
+      Register lhs_register = sp;
+      uint32_t offset;
+
+      if (ShouldApplyOffsetToStackCheck(instr, &offset)) {
+        lhs_register = i.TempRegister(0);
+        __ Sub(lhs_register, sp, offset);
+      }
+
       constexpr size_t kValueIndex = 0;
       DCHECK(instr->InputAt(kValueIndex)->IsRegister());
-      __ Cmp(sp, i.InputRegister(kValueIndex));
+      __ Cmp(lhs_register, i.InputRegister(kValueIndex));
       break;
     }
+    case kArchStackCheckOffset:
+      __ Move(i.OutputRegister(), Smi::FromInt(GetStackCheckOffset()));
+      break;
     case kArchTruncateDoubleToI:
       __ TruncateDoubleToI(isolate(), zone(), i.OutputRegister(),
                            i.InputDoubleRegister(0), DetermineStubCallMode());
@@ -1414,9 +1432,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArm64Float64Mod: {
       // TODO(turbofan): implement directly.
       FrameScope scope(tasm(), StackFrame::MANUAL);
-      DCHECK(d0.is(i.InputDoubleRegister(0)));
-      DCHECK(d1.is(i.InputDoubleRegister(1)));
-      DCHECK(d0.is(i.OutputDoubleRegister()));
+      DCHECK_EQ(d0, i.InputDoubleRegister(0));
+      DCHECK_EQ(d1, i.InputDoubleRegister(1));
+      DCHECK_EQ(d0, i.OutputDoubleRegister());
       // TODO(turbofan): make sure this saves all relevant registers.
       __ CallCFunction(ExternalReference::mod_two_doubles_operation(), 0, 2);
       break;
@@ -1552,11 +1570,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Umov(i.OutputRegister32(), i.InputFloat64Register(0).V2S(), 1);
       break;
     case kArm64Float64InsertLowWord32:
-      DCHECK(i.OutputFloat64Register().Is(i.InputFloat64Register(0)));
+      DCHECK_EQ(i.OutputFloat64Register(), i.InputFloat64Register(0));
       __ Ins(i.OutputFloat64Register().V2S(), 0, i.InputRegister32(1));
       break;
     case kArm64Float64InsertHighWord32:
-      DCHECK(i.OutputFloat64Register().Is(i.InputFloat64Register(0)));
+      DCHECK_EQ(i.OutputFloat64Register(), i.InputFloat64Register(0));
       __ Ins(i.OutputFloat64Register().V2S(), 1, i.InputRegister32(1));
       break;
     case kArm64Float64MoveU64:
@@ -1623,18 +1641,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArm64StrCompressTagged:
       __ StoreTaggedField(i.InputOrZeroRegister64(0), i.MemoryOperand(1));
       break;
-    case kArm64DecompressSigned: {
-      __ DecompressTaggedSigned(i.OutputRegister(), i.InputRegister(0));
-      break;
-    }
-    case kArm64DecompressPointer: {
-      __ DecompressTaggedPointer(i.OutputRegister(), i.InputRegister(0));
-      break;
-    }
-    case kArm64DecompressAny: {
-      __ DecompressAnyTagged(i.OutputRegister(), i.InputRegister(0));
-      break;
-    }
     case kArm64LdrS:
       EmitMaybePoisonedFPLoad(this, opcode, &i, i.OutputDoubleRegister().S());
       break;
@@ -1820,7 +1826,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArm64F64x2ReplaceLane: {
       VRegister dst = i.OutputSimd128Register().V2D(),
                 src1 = i.InputSimd128Register(0).V2D();
-      if (!dst.is(src1)) {
+      if (dst != src1) {
         __ Mov(dst, src1);
       }
       __ Mov(dst, i.InputInt8(1), i.InputSimd128Register(2).V2D(), 0);
@@ -1877,7 +1883,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArm64F32x4ReplaceLane: {
       VRegister dst = i.OutputSimd128Register().V4S(),
                 src1 = i.InputSimd128Register(0).V4S();
-      if (!dst.is(src1)) {
+      if (dst != src1) {
         __ Mov(dst, src1);
       }
       __ Mov(dst, i.InputInt8(1), i.InputSimd128Register(2).V4S(), 0);
@@ -1939,7 +1945,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArm64I64x2ReplaceLane: {
       VRegister dst = i.OutputSimd128Register().V2D(),
                 src1 = i.InputSimd128Register(0).V2D();
-      if (!dst.is(src1)) {
+      if (dst != src1) {
         __ Mov(dst, src1);
       }
       __ Mov(dst, i.InputInt8(1), i.InputRegister64(2));
@@ -2063,7 +2069,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArm64I32x4ReplaceLane: {
       VRegister dst = i.OutputSimd128Register().V4S(),
                 src1 = i.InputSimd128Register(0).V4S();
-      if (!dst.is(src1)) {
+      if (dst != src1) {
         __ Mov(dst, src1);
       }
       __ Mov(dst, i.InputInt8(1), i.InputRegister32(2));
@@ -2132,15 +2138,20 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Dup(i.OutputSimd128Register().V8H(), i.InputRegister32(0));
       break;
     }
-    case kArm64I16x8ExtractLane: {
+    case kArm64I16x8ExtractLaneU: {
       __ Umov(i.OutputRegister32(), i.InputSimd128Register(0).V8H(),
               i.InputInt8(1));
       break;
     }
+    case kArm64I16x8ExtractLaneS: {
+      __ Smov(i.OutputRegister32(), i.InputSimd128Register(0).V8H(),
+              i.InputInt8(1));
+      break;
+    }
     case kArm64I16x8ReplaceLane: {
       VRegister dst = i.OutputSimd128Register().V8H(),
                 src1 = i.InputSimd128Register(0).V8H();
-      if (!dst.is(src1)) {
+      if (dst != src1) {
         __ Mov(dst, src1);
       }
       __ Mov(dst, i.InputInt8(1), i.InputRegister32(2));
@@ -2176,7 +2187,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 src1 = i.InputSimd128Register(1);
       UseScratchRegisterScope scope(tasm());
       VRegister temp = scope.AcquireV(kFormat4S);
-      if (dst.is(src1)) {
+      if (dst == src1) {
         __ Mov(temp, src1.V4S());
         src1 = temp;
       }
@@ -2228,12 +2239,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 src1 = i.InputSimd128Register(1);
       UseScratchRegisterScope scope(tasm());
       VRegister temp = scope.AcquireV(kFormat4S);
-      if (dst.is(src1)) {
+      if (dst == src1) {
         __ Mov(temp, src1.V4S());
         src1 = temp;
       }
-      __ Uqxtn(dst.V4H(), src0.V4S());
-      __ Uqxtn2(dst.V8H(), src1.V4S());
+      __ Sqxtun(dst.V4H(), src0.V4S());
+      __ Sqxtun2(dst.V8H(), src1.V4S());
       break;
     }
       SIMD_BINOP_CASE(kArm64I16x8AddSaturateU, Uqadd, 8H);
@@ -2242,19 +2253,25 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       SIMD_BINOP_CASE(kArm64I16x8MaxU, Umax, 8H);
       SIMD_BINOP_CASE(kArm64I16x8GtU, Cmhi, 8H);
       SIMD_BINOP_CASE(kArm64I16x8GeU, Cmhs, 8H);
+      SIMD_BINOP_CASE(kArm64I16x8RoundingAverageU, Urhadd, 8H);
     case kArm64I8x16Splat: {
       __ Dup(i.OutputSimd128Register().V16B(), i.InputRegister32(0));
       break;
     }
-    case kArm64I8x16ExtractLane: {
+    case kArm64I8x16ExtractLaneU: {
       __ Umov(i.OutputRegister32(), i.InputSimd128Register(0).V16B(),
               i.InputInt8(1));
       break;
     }
+    case kArm64I8x16ExtractLaneS: {
+      __ Smov(i.OutputRegister32(), i.InputSimd128Register(0).V16B(),
+              i.InputInt8(1));
+      break;
+    }
     case kArm64I8x16ReplaceLane: {
       VRegister dst = i.OutputSimd128Register().V16B(),
                 src1 = i.InputSimd128Register(0).V16B();
-      if (!dst.is(src1)) {
+      if (dst != src1) {
         __ Mov(dst, src1);
       }
       __ Mov(dst, i.InputInt8(1), i.InputRegister32(2));
@@ -2288,7 +2305,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 src1 = i.InputSimd128Register(1);
       UseScratchRegisterScope scope(tasm());
       VRegister temp = scope.AcquireV(kFormat8H);
-      if (dst.is(src1)) {
+      if (dst == src1) {
         __ Mov(temp, src1.V8H());
         src1 = temp;
       }
@@ -2330,12 +2347,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 src1 = i.InputSimd128Register(1);
       UseScratchRegisterScope scope(tasm());
       VRegister temp = scope.AcquireV(kFormat8H);
-      if (dst.is(src1)) {
+      if (dst == src1) {
         __ Mov(temp, src1.V8H());
         src1 = temp;
       }
-      __ Uqxtn(dst.V8B(), src0.V8H());
-      __ Uqxtn2(dst.V16B(), src1.V8H());
+      __ Sqxtun(dst.V8B(), src0.V8H());
+      __ Sqxtun2(dst.V16B(), src1.V8H());
       break;
     }
       SIMD_BINOP_CASE(kArm64I8x16AddSaturateU, Uqadd, 16B);
@@ -2344,6 +2361,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       SIMD_BINOP_CASE(kArm64I8x16MaxU, Umax, 16B);
       SIMD_BINOP_CASE(kArm64I8x16GtU, Cmhi, 16B);
       SIMD_BINOP_CASE(kArm64I8x16GeU, Cmhs, 16B);
+      SIMD_BINOP_CASE(kArm64I8x16RoundingAverageU, Urhadd, 16B);
     case kArm64S128Zero: {
       __ Movi(i.OutputSimd128Register().V16B(), 0);
       break;
@@ -2375,11 +2393,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArm64S128Select: {
       VRegister dst = i.OutputSimd128Register().V16B();
-      DCHECK(dst.is(i.InputSimd128Register(0).V16B()));
+      DCHECK_EQ(dst, i.InputSimd128Register(0).V16B());
       __ Bsl(dst, i.InputSimd128Register(1).V16B(),
              i.InputSimd128Register(2).V16B());
       break;
     }
+      SIMD_BINOP_CASE(kArm64S128AndNot, Bic, 16B);
     case kArm64S32x4Shuffle: {
       Simd128Register dst = i.OutputSimd128Register().V4S(),
                       src0 = i.InputSimd128Register(0).V4S(),
@@ -2388,10 +2407,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       // If dst == src0 == src1, then the shuffle is unary and we only use src0.
       UseScratchRegisterScope scope(tasm());
       VRegister temp = scope.AcquireV(kFormat4S);
-      if (dst.is(src0)) {
+      if (dst == src0) {
         __ Mov(temp, src0);
         src0 = temp;
-      } else if (dst.is(src1)) {
+      } else if (dst == src1) {
         __ Mov(temp, src1);
         src1 = temp;
       }
@@ -2444,7 +2463,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       // Unary shuffle table is in src0, binary shuffle table is in src0, src1,
       // which must be consecutive.
       int64_t mask = 0;
-      if (src0.is(src1)) {
+      if (src0 == src1) {
         mask = 0x0F0F0F0F;
       } else {
         mask = 0x1F1F1F1F;
@@ -2458,7 +2477,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       VRegister temp = scope.AcquireV(kFormat16B);
       __ Movi(temp, imm2, imm1);
 
-      if (src0.is(src1)) {
+      if (src0 == src1) {
         __ Tbl(dst, src0, temp.V16B());
       } else {
         __ Tbl(dst, src0, src1, temp.V16B());
@@ -2482,6 +2501,52 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Add(i.OutputRegister32(), i.OutputRegister32(), 1);
       break;
     }
+    case kArm64S8x16LoadSplat: {
+      __ ld1r(i.OutputSimd128Register().V16B(), i.MemoryOperand(0));
+      break;
+    }
+    case kArm64S16x8LoadSplat: {
+      __ ld1r(i.OutputSimd128Register().V8H(), i.MemoryOperand(0));
+      break;
+    }
+    case kArm64S32x4LoadSplat: {
+      __ ld1r(i.OutputSimd128Register().V4S(), i.MemoryOperand(0));
+      break;
+    }
+    case kArm64S64x2LoadSplat: {
+      __ ld1r(i.OutputSimd128Register().V2D(), i.MemoryOperand(0));
+      break;
+    }
+    case kArm64I16x8Load8x8S: {
+      __ ld1(i.OutputSimd128Register().V8B(), i.MemoryOperand(0));
+      __ Sxtl(i.OutputSimd128Register().V8H(), i.OutputSimd128Register().V8B());
+      break;
+    }
+    case kArm64I16x8Load8x8U: {
+      __ ld1(i.OutputSimd128Register().V8B(), i.MemoryOperand(0));
+      __ Uxtl(i.OutputSimd128Register().V8H(), i.OutputSimd128Register().V8B());
+      break;
+    }
+    case kArm64I32x4Load16x4S: {
+      __ ld1(i.OutputSimd128Register().V4H(), i.MemoryOperand(0));
+      __ Sxtl(i.OutputSimd128Register().V4S(), i.OutputSimd128Register().V4H());
+      break;
+    }
+    case kArm64I32x4Load16x4U: {
+      __ ld1(i.OutputSimd128Register().V4H(), i.MemoryOperand(0));
+      __ Uxtl(i.OutputSimd128Register().V4S(), i.OutputSimd128Register().V4H());
+      break;
+    }
+    case kArm64I64x2Load32x2S: {
+      __ ld1(i.OutputSimd128Register().V2S(), i.MemoryOperand(0));
+      __ Sxtl(i.OutputSimd128Register().V2D(), i.OutputSimd128Register().V2S());
+      break;
+    }
+    case kArm64I64x2Load32x2U: {
+      __ ld1(i.OutputSimd128Register().V2S(), i.MemoryOperand(0));
+      __ Uxtl(i.OutputSimd128Register().V2D(), i.OutputSimd128Register().V2S());
+      break;
+    }
 #define SIMD_REDUCE_OP_CASE(Op, Instr, format, FORMAT)     \
   case Op: {                                               \
     UseScratchRegisterScope scope(tasm());                 \
diff --git a/deps/v8/src/compiler/backend/arm64/instruction-codes-arm64.h b/deps/v8/src/compiler/backend/arm64/instruction-codes-arm64.h
index 880a3fbf9e0a3a..0e78a346a6f3ac 100644
--- a/deps/v8/src/compiler/backend/arm64/instruction-codes-arm64.h
+++ b/deps/v8/src/compiler/backend/arm64/instruction-codes-arm64.h
@@ -166,9 +166,6 @@ namespace compiler {
   V(Arm64LdrDecompressAnyTagged)            \
   V(Arm64Str)                               \
   V(Arm64StrCompressTagged)                 \
-  V(Arm64DecompressSigned)                  \
-  V(Arm64DecompressPointer)                 \
-  V(Arm64DecompressAny)                     \
   V(Arm64DmbIsh)                            \
   V(Arm64DsbIsb)                            \
   V(Arm64F64x2Splat)                        \
@@ -256,7 +253,8 @@ namespace compiler {
   V(Arm64I32x4GtU)                          \
   V(Arm64I32x4GeU)                          \
   V(Arm64I16x8Splat)                        \
-  V(Arm64I16x8ExtractLane)                  \
+  V(Arm64I16x8ExtractLaneU)                 \
+  V(Arm64I16x8ExtractLaneS)                 \
   V(Arm64I16x8ReplaceLane)                  \
   V(Arm64I16x8SConvertI8x16Low)             \
   V(Arm64I16x8SConvertI8x16High)            \
@@ -286,8 +284,10 @@ namespace compiler {
   V(Arm64I16x8MaxU)                         \
   V(Arm64I16x8GtU)                          \
   V(Arm64I16x8GeU)                          \
+  V(Arm64I16x8RoundingAverageU)             \
   V(Arm64I8x16Splat)                        \
-  V(Arm64I8x16ExtractLane)                  \
+  V(Arm64I8x16ExtractLaneU)                 \
+  V(Arm64I8x16ExtractLaneS)                 \
   V(Arm64I8x16ReplaceLane)                  \
   V(Arm64I8x16Neg)                          \
   V(Arm64I8x16Shl)                          \
@@ -312,6 +312,7 @@ namespace compiler {
   V(Arm64I8x16MaxU)                         \
   V(Arm64I8x16GtU)                          \
   V(Arm64I8x16GeU)                          \
+  V(Arm64I8x16RoundingAverageU)             \
   V(Arm64S128Zero)                          \
   V(Arm64S128Dup)                           \
   V(Arm64S128And)                           \
@@ -319,6 +320,7 @@ namespace compiler {
   V(Arm64S128Xor)                           \
   V(Arm64S128Not)                           \
   V(Arm64S128Select)                        \
+  V(Arm64S128AndNot)                        \
   V(Arm64S32x4ZipLeft)                      \
   V(Arm64S32x4ZipRight)                     \
   V(Arm64S32x4UnzipLeft)                    \
@@ -355,6 +357,16 @@ namespace compiler {
   V(Arm64S1x8AllTrue)                       \
   V(Arm64S1x16AnyTrue)                      \
   V(Arm64S1x16AllTrue)                      \
+  V(Arm64S8x16LoadSplat)                    \
+  V(Arm64S16x8LoadSplat)                    \
+  V(Arm64S32x4LoadSplat)                    \
+  V(Arm64S64x2LoadSplat)                    \
+  V(Arm64I16x8Load8x8S)                     \
+  V(Arm64I16x8Load8x8U)                     \
+  V(Arm64I32x4Load16x4S)                    \
+  V(Arm64I32x4Load16x4U)                    \
+  V(Arm64I64x2Load32x2S)                    \
+  V(Arm64I64x2Load32x2U)                    \
   V(Arm64Word64AtomicLoadUint8)             \
   V(Arm64Word64AtomicLoadUint16)            \
   V(Arm64Word64AtomicLoadUint32)            \
diff --git a/deps/v8/src/compiler/backend/arm64/instruction-scheduler-arm64.cc b/deps/v8/src/compiler/backend/arm64/instruction-scheduler-arm64.cc
index b0f92029684703..f032e333c1c8a5 100644
--- a/deps/v8/src/compiler/backend/arm64/instruction-scheduler-arm64.cc
+++ b/deps/v8/src/compiler/backend/arm64/instruction-scheduler-arm64.cc
@@ -223,7 +223,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64I32x4GtU:
     case kArm64I32x4GeU:
     case kArm64I16x8Splat:
-    case kArm64I16x8ExtractLane:
+    case kArm64I16x8ExtractLaneU:
+    case kArm64I16x8ExtractLaneS:
     case kArm64I16x8ReplaceLane:
     case kArm64I16x8SConvertI8x16Low:
     case kArm64I16x8SConvertI8x16High:
@@ -253,8 +254,10 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64I16x8MaxU:
     case kArm64I16x8GtU:
     case kArm64I16x8GeU:
+    case kArm64I16x8RoundingAverageU:
     case kArm64I8x16Splat:
-    case kArm64I8x16ExtractLane:
+    case kArm64I8x16ExtractLaneU:
+    case kArm64I8x16ExtractLaneS:
     case kArm64I8x16ReplaceLane:
     case kArm64I8x16Neg:
     case kArm64I8x16Shl:
@@ -279,6 +282,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64I8x16MaxU:
     case kArm64I8x16GtU:
     case kArm64I8x16GeU:
+    case kArm64I8x16RoundingAverageU:
     case kArm64S128Zero:
     case kArm64S128Dup:
     case kArm64S128And:
@@ -286,6 +290,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64S128Xor:
     case kArm64S128Not:
     case kArm64S128Select:
+    case kArm64S128AndNot:
     case kArm64S32x4ZipLeft:
     case kArm64S32x4ZipRight:
     case kArm64S32x4UnzipLeft:
@@ -326,9 +331,6 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64TestAndBranch:
     case kArm64CompareAndBranch32:
     case kArm64CompareAndBranch:
-    case kArm64DecompressSigned:
-    case kArm64DecompressPointer:
-    case kArm64DecompressAny:
       return kNoOpcodeFlags;
 
     case kArm64LdrS:
@@ -345,6 +347,16 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64LdrDecompressTaggedPointer:
     case kArm64LdrDecompressAnyTagged:
     case kArm64Peek:
+    case kArm64S8x16LoadSplat:
+    case kArm64S16x8LoadSplat:
+    case kArm64S32x4LoadSplat:
+    case kArm64S64x2LoadSplat:
+    case kArm64I16x8Load8x8S:
+    case kArm64I16x8Load8x8U:
+    case kArm64I32x4Load16x4S:
+    case kArm64I32x4Load16x4U:
+    case kArm64I64x2Load32x2S:
+    case kArm64I64x2Load32x2U:
       return kIsLoadOperation;
 
     case kArm64Claim:
diff --git a/deps/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc b/deps/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc
index 53a289fe6a664f..3c7c337537d3e9 100644
--- a/deps/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc
+++ b/deps/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/base/bits.h"
 #include "src/codegen/assembler-inl.h"
 #include "src/compiler/backend/instruction-selector-impl.h"
 #include "src/compiler/node-matchers.h"
@@ -179,7 +180,7 @@ void VisitRRIR(InstructionSelector* selector, ArchOpcode opcode, Node* node) {
   int32_t imm = OpParameter<int32_t>(node->op());
   selector->Emit(opcode, g.DefineAsRegister(node),
                  g.UseRegister(node->InputAt(0)), g.UseImmediate(imm),
-                 g.UseRegister(node->InputAt(1)));
+                 g.UseUniqueRegister(node->InputAt(1)));
 }
 
 struct ExtendingLoadMatcher {
@@ -353,15 +354,15 @@ bool TryMatchLoadStoreShift(Arm64OperandGenerator* g,
 // Bitfields describing binary operator properties:
 // CanCommuteField is true if we can switch the two operands, potentially
 // requiring commuting the flags continuation condition.
-using CanCommuteField = BitField8<bool, 1, 1>;
+using CanCommuteField = base::BitField8<bool, 1, 1>;
 // MustCommuteCondField is true when we need to commute the flags continuation
 // condition in order to switch the operands.
-using MustCommuteCondField = BitField8<bool, 2, 1>;
+using MustCommuteCondField = base::BitField8<bool, 2, 1>;
 // IsComparisonField is true when the operation is a comparison and has no other
 // result other than the condition.
-using IsComparisonField = BitField8<bool, 3, 1>;
+using IsComparisonField = base::BitField8<bool, 3, 1>;
 // IsAddSubField is true when an instruction is encoded as ADD or SUB.
-using IsAddSubField = BitField8<bool, 4, 1>;
+using IsAddSubField = base::BitField8<bool, 4, 1>;
 
 // Get properties of a binary operator.
 uint8_t GetBinopProperties(InstructionCode opcode) {
@@ -518,7 +519,7 @@ int32_t LeftShiftForReducedMultiply(Matcher* m) {
   if (m->right().HasValue() && m->right().Value() >= 3) {
     uint64_t value_minus_one = m->right().Value() - 1;
     if (base::bits::IsPowerOfTwo(value_minus_one)) {
-      return WhichPowerOf2(value_minus_one);
+      return base::bits::WhichPowerOfTwo(value_minus_one);
     }
   }
   return 0;
@@ -591,6 +592,66 @@ void EmitLoad(InstructionSelector* selector, Node* node, InstructionCode opcode,
   selector->Emit(opcode, arraysize(outputs), outputs, input_count, inputs);
 }
 
+void InstructionSelector::VisitLoadTransform(Node* node) {
+  LoadTransformParameters params = LoadTransformParametersOf(node->op());
+  InstructionCode opcode = kArchNop;
+  switch (params.transformation) {
+    case LoadTransformation::kS8x16LoadSplat:
+      opcode = kArm64S8x16LoadSplat;
+      break;
+    case LoadTransformation::kS16x8LoadSplat:
+      opcode = kArm64S16x8LoadSplat;
+      break;
+    case LoadTransformation::kS32x4LoadSplat:
+      opcode = kArm64S32x4LoadSplat;
+      break;
+    case LoadTransformation::kS64x2LoadSplat:
+      opcode = kArm64S64x2LoadSplat;
+      break;
+    case LoadTransformation::kI16x8Load8x8S:
+      opcode = kArm64I16x8Load8x8S;
+      break;
+    case LoadTransformation::kI16x8Load8x8U:
+      opcode = kArm64I16x8Load8x8U;
+      break;
+    case LoadTransformation::kI32x4Load16x4S:
+      opcode = kArm64I32x4Load16x4S;
+      break;
+    case LoadTransformation::kI32x4Load16x4U:
+      opcode = kArm64I32x4Load16x4U;
+      break;
+    case LoadTransformation::kI64x2Load32x2S:
+      opcode = kArm64I64x2Load32x2S;
+      break;
+    case LoadTransformation::kI64x2Load32x2U:
+      opcode = kArm64I64x2Load32x2U;
+      break;
+    default:
+      UNIMPLEMENTED();
+  }
+  // ARM64 supports unaligned loads
+  DCHECK_NE(params.kind, LoadKind::kUnaligned);
+
+  Arm64OperandGenerator g(this);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  InstructionOperand inputs[2];
+  InstructionOperand outputs[1];
+
+  inputs[0] = g.UseRegister(base);
+  inputs[1] = g.UseRegister(index);
+  outputs[0] = g.DefineAsRegister(node);
+
+  // ld1r uses post-index, so construct address first.
+  // TODO(v8:9886) If index can be immediate, use vldr without this add.
+  InstructionOperand addr = g.TempRegister();
+  Emit(kArm64Add, 1, &addr, 2, inputs);
+  inputs[0] = addr;
+  inputs[1] = g.TempImmediate(0);
+  opcode |= AddressingModeField::encode(kMode_MRI);
+  Emit(opcode, 1, outputs, 2, inputs);
+}
+
 void InstructionSelector::VisitLoad(Node* node) {
   InstructionCode opcode = kArchNop;
   ImmediateMode immediate_mode = kNoImmediate;
@@ -618,7 +679,6 @@ void InstructionSelector::VisitLoad(Node* node) {
       opcode = kArm64LdrW;
       immediate_mode = kLoadStoreImm32;
       break;
-    case MachineRepresentation::kCompressedSigned:   // Fall through.
     case MachineRepresentation::kCompressedPointer:  // Fall through.
     case MachineRepresentation::kCompressed:
 #ifdef V8_COMPRESS_POINTERS
@@ -735,7 +795,6 @@ void InstructionSelector::VisitStore(Node* node) {
         opcode = kArm64StrW;
         immediate_mode = kLoadStoreImm32;
         break;
-      case MachineRepresentation::kCompressedSigned:   // Fall through.
       case MachineRepresentation::kCompressedPointer:  // Fall through.
       case MachineRepresentation::kCompressed:
 #ifdef V8_COMPRESS_POINTERS
@@ -764,6 +823,24 @@ void InstructionSelector::VisitStore(Node* node) {
         UNREACHABLE();
     }
 
+    ExternalReferenceMatcher m(base);
+    if (m.HasValue() && g.IsIntegerConstant(index) &&
+        CanAddressRelativeToRootsRegister(m.Value())) {
+      ptrdiff_t const delta =
+          g.GetIntegerConstantValue(index) +
+          TurboAssemblerBase::RootRegisterOffsetForExternalReference(isolate(),
+                                                                     m.Value());
+      if (is_int32(delta)) {
+        input_count = 2;
+        InstructionOperand inputs[2];
+        inputs[0] = g.UseRegister(value);
+        inputs[1] = g.UseImmediate(static_cast<int32_t>(delta));
+        opcode |= AddressingModeField::encode(kMode_Root);
+        Emit(opcode, 0, nullptr, input_count, inputs);
+        return;
+      }
+    }
+
     inputs[0] = g.UseRegisterOrImmediateZero(value);
     inputs[1] = g.UseRegister(base);
 
@@ -1028,11 +1105,31 @@ void InstructionSelector::VisitWord64Shl(Node* node) {
 
 void InstructionSelector::VisitStackPointerGreaterThan(
     Node* node, FlagsContinuation* cont) {
-  Node* const value = node->InputAt(0);
-  InstructionCode opcode = kArchStackPointerGreaterThan;
+  StackCheckKind kind = StackCheckKindOf(node->op());
+  InstructionCode opcode =
+      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
 
   Arm64OperandGenerator g(this);
-  EmitWithContinuation(opcode, g.UseRegister(value), cont);
+
+  // No outputs.
+  InstructionOperand* const outputs = nullptr;
+  const int output_count = 0;
+
+  // Applying an offset to this stack check requires a temp register. Offsets
+  // are only applied to the first stack check. If applying an offset, we must
+  // ensure the input and temp registers do not alias, thus kUniqueRegister.
+  InstructionOperand temps[] = {g.TempRegister()};
+  const int temp_count = (kind == StackCheckKind::kJSFunctionEntry) ? 1 : 0;
+  const auto register_mode = (kind == StackCheckKind::kJSFunctionEntry)
+                                 ? OperandGenerator::kUniqueRegister
+                                 : OperandGenerator::kRegister;
+
+  Node* const value = node->InputAt(0);
+  InstructionOperand inputs[] = {g.UseRegisterWithMode(value, register_mode)};
+  static constexpr int input_count = arraysize(inputs);
+
+  EmitWithContinuation(opcode, output_count, outputs, input_count, inputs,
+                       temp_count, temps, cont);
 }
 
 namespace {
@@ -1572,6 +1669,12 @@ void InstructionSelector::VisitTryTruncateFloat64ToUint64(Node* node) {
   Emit(kArm64Float64ToUint64, output_count, outputs, 1, inputs);
 }
 
+void InstructionSelector::VisitBitcastWord32ToWord64(Node* node) {
+  DCHECK(SmiValuesAre31Bits());
+  DCHECK(COMPRESS_POINTERS_BOOL);
+  EmitIdentity(node);
+}
+
 void InstructionSelector::VisitChangeInt32ToInt64(Node* node) {
   Node* value = node->InputAt(0);
   if (value->opcode() == IrOpcode::kLoad && CanCover(node, value)) {
@@ -1671,93 +1774,6 @@ void InstructionSelector::VisitChangeUint32ToUint64(Node* node) {
   Emit(kArm64Mov32, g.DefineAsRegister(node), g.UseRegister(value));
 }
 
-void InstructionSelector::VisitChangeTaggedToCompressed(Node* node) {
-  // The top 32 bits in the 64-bit register will be undefined, and
-  // must not be used by a dependent node.
-  EmitIdentity(node);
-}
-
-void InstructionSelector::VisitChangeTaggedPointerToCompressedPointer(
-    Node* node) {
-  // The top 32 bits in the 64-bit register will be undefined, and
-  // must not be used by a dependent node.
-  EmitIdentity(node);
-}
-
-void InstructionSelector::VisitChangeTaggedSignedToCompressedSigned(
-    Node* node) {
-  // The top 32 bits in the 64-bit register will be undefined, and
-  // must not be used by a dependent node.
-  EmitIdentity(node);
-}
-
-void InstructionSelector::VisitChangeCompressedToTagged(Node* node) {
-  Arm64OperandGenerator g(this);
-  Node* const value = node->InputAt(0);
-  if ((value->opcode() == IrOpcode::kLoad ||
-       value->opcode() == IrOpcode::kPoisonedLoad) &&
-      CanCover(node, value)) {
-    DCHECK_EQ(LoadRepresentationOf(value->op()).representation(),
-              MachineRepresentation::kCompressed);
-    InstructionCode opcode = kArm64LdrDecompressAnyTagged;
-    if (value->opcode() == IrOpcode::kPoisonedLoad) {
-      CHECK_NE(poisoning_level_, PoisoningMitigationLevel::kDontPoison);
-      opcode |= MiscField::encode(kMemoryAccessPoisoned);
-    }
-    ImmediateMode immediate_mode = kLoadStoreImm32;
-    MachineRepresentation rep = MachineRepresentation::kCompressed;
-    EmitLoad(this, value, opcode, immediate_mode, rep, node);
-  } else {
-    Emit(kArm64DecompressAny, g.DefineAsRegister(node), g.UseRegister(value));
-  }
-}
-
-void InstructionSelector::VisitChangeCompressedPointerToTaggedPointer(
-    Node* node) {
-  Arm64OperandGenerator g(this);
-  Node* const value = node->InputAt(0);
-  if ((value->opcode() == IrOpcode::kLoad ||
-       value->opcode() == IrOpcode::kPoisonedLoad) &&
-      CanCover(node, value)) {
-    DCHECK_EQ(LoadRepresentationOf(value->op()).representation(),
-              MachineRepresentation::kCompressedPointer);
-    InstructionCode opcode = kArm64LdrDecompressTaggedPointer;
-    if (value->opcode() == IrOpcode::kPoisonedLoad) {
-      CHECK_NE(poisoning_level_, PoisoningMitigationLevel::kDontPoison);
-      opcode |= MiscField::encode(kMemoryAccessPoisoned);
-    }
-    ImmediateMode immediate_mode = kLoadStoreImm32;
-    MachineRepresentation rep = MachineRepresentation::kCompressedPointer;
-    EmitLoad(this, value, opcode, immediate_mode, rep, node);
-  } else {
-    Emit(kArm64DecompressPointer, g.DefineAsRegister(node),
-         g.UseRegister(value));
-  }
-}
-
-void InstructionSelector::VisitChangeCompressedSignedToTaggedSigned(
-    Node* node) {
-  Arm64OperandGenerator g(this);
-  Node* const value = node->InputAt(0);
-  if ((value->opcode() == IrOpcode::kLoad ||
-       value->opcode() == IrOpcode::kPoisonedLoad) &&
-      CanCover(node, value)) {
-    DCHECK_EQ(LoadRepresentationOf(value->op()).representation(),
-              MachineRepresentation::kCompressedSigned);
-    InstructionCode opcode = kArm64LdrDecompressTaggedSigned;
-    if (value->opcode() == IrOpcode::kPoisonedLoad) {
-      CHECK_NE(poisoning_level_, PoisoningMitigationLevel::kDontPoison);
-      opcode |= MiscField::encode(kMemoryAccessPoisoned);
-    }
-    ImmediateMode immediate_mode = kLoadStoreImm32;
-    MachineRepresentation rep = MachineRepresentation::kCompressedSigned;
-    EmitLoad(this, value, opcode, immediate_mode, rep, node);
-  } else {
-    Emit(kArm64DecompressSigned, g.DefineAsRegister(node),
-         g.UseRegister(value));
-  }
-}
-
 void InstructionSelector::VisitTruncateInt64ToInt32(Node* node) {
   Arm64OperandGenerator g(this);
   // The top 32 bits in the 64-bit register will be undefined, and
@@ -3171,92 +3187,95 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(I8x16ShrS)                \
   V(I8x16ShrU)
 
-#define SIMD_BINOP_LIST(V)                        \
-  V(F64x2Add, kArm64F64x2Add)                     \
-  V(F64x2Sub, kArm64F64x2Sub)                     \
-  V(F64x2Mul, kArm64F64x2Mul)                     \
-  V(F64x2Div, kArm64F64x2Div)                     \
-  V(F64x2Min, kArm64F64x2Min)                     \
-  V(F64x2Max, kArm64F64x2Max)                     \
-  V(F64x2Eq, kArm64F64x2Eq)                       \
-  V(F64x2Ne, kArm64F64x2Ne)                       \
-  V(F64x2Lt, kArm64F64x2Lt)                       \
-  V(F64x2Le, kArm64F64x2Le)                       \
-  V(F32x4Add, kArm64F32x4Add)                     \
-  V(F32x4AddHoriz, kArm64F32x4AddHoriz)           \
-  V(F32x4Sub, kArm64F32x4Sub)                     \
-  V(F32x4Mul, kArm64F32x4Mul)                     \
-  V(F32x4Div, kArm64F32x4Div)                     \
-  V(F32x4Min, kArm64F32x4Min)                     \
-  V(F32x4Max, kArm64F32x4Max)                     \
-  V(F32x4Eq, kArm64F32x4Eq)                       \
-  V(F32x4Ne, kArm64F32x4Ne)                       \
-  V(F32x4Lt, kArm64F32x4Lt)                       \
-  V(F32x4Le, kArm64F32x4Le)                       \
-  V(I64x2Add, kArm64I64x2Add)                     \
-  V(I64x2Sub, kArm64I64x2Sub)                     \
-  V(I64x2Eq, kArm64I64x2Eq)                       \
-  V(I64x2Ne, kArm64I64x2Ne)                       \
-  V(I64x2GtS, kArm64I64x2GtS)                     \
-  V(I64x2GeS, kArm64I64x2GeS)                     \
-  V(I64x2GtU, kArm64I64x2GtU)                     \
-  V(I64x2GeU, kArm64I64x2GeU)                     \
-  V(I32x4Add, kArm64I32x4Add)                     \
-  V(I32x4AddHoriz, kArm64I32x4AddHoriz)           \
-  V(I32x4Sub, kArm64I32x4Sub)                     \
-  V(I32x4Mul, kArm64I32x4Mul)                     \
-  V(I32x4MinS, kArm64I32x4MinS)                   \
-  V(I32x4MaxS, kArm64I32x4MaxS)                   \
-  V(I32x4Eq, kArm64I32x4Eq)                       \
-  V(I32x4Ne, kArm64I32x4Ne)                       \
-  V(I32x4GtS, kArm64I32x4GtS)                     \
-  V(I32x4GeS, kArm64I32x4GeS)                     \
-  V(I32x4MinU, kArm64I32x4MinU)                   \
-  V(I32x4MaxU, kArm64I32x4MaxU)                   \
-  V(I32x4GtU, kArm64I32x4GtU)                     \
-  V(I32x4GeU, kArm64I32x4GeU)                     \
-  V(I16x8SConvertI32x4, kArm64I16x8SConvertI32x4) \
-  V(I16x8Add, kArm64I16x8Add)                     \
-  V(I16x8AddSaturateS, kArm64I16x8AddSaturateS)   \
-  V(I16x8AddHoriz, kArm64I16x8AddHoriz)           \
-  V(I16x8Sub, kArm64I16x8Sub)                     \
-  V(I16x8SubSaturateS, kArm64I16x8SubSaturateS)   \
-  V(I16x8Mul, kArm64I16x8Mul)                     \
-  V(I16x8MinS, kArm64I16x8MinS)                   \
-  V(I16x8MaxS, kArm64I16x8MaxS)                   \
-  V(I16x8Eq, kArm64I16x8Eq)                       \
-  V(I16x8Ne, kArm64I16x8Ne)                       \
-  V(I16x8GtS, kArm64I16x8GtS)                     \
-  V(I16x8GeS, kArm64I16x8GeS)                     \
-  V(I16x8UConvertI32x4, kArm64I16x8UConvertI32x4) \
-  V(I16x8AddSaturateU, kArm64I16x8AddSaturateU)   \
-  V(I16x8SubSaturateU, kArm64I16x8SubSaturateU)   \
-  V(I16x8MinU, kArm64I16x8MinU)                   \
-  V(I16x8MaxU, kArm64I16x8MaxU)                   \
-  V(I16x8GtU, kArm64I16x8GtU)                     \
-  V(I16x8GeU, kArm64I16x8GeU)                     \
-  V(I8x16SConvertI16x8, kArm64I8x16SConvertI16x8) \
-  V(I8x16Add, kArm64I8x16Add)                     \
-  V(I8x16AddSaturateS, kArm64I8x16AddSaturateS)   \
-  V(I8x16Sub, kArm64I8x16Sub)                     \
-  V(I8x16SubSaturateS, kArm64I8x16SubSaturateS)   \
-  V(I8x16Mul, kArm64I8x16Mul)                     \
-  V(I8x16MinS, kArm64I8x16MinS)                   \
-  V(I8x16MaxS, kArm64I8x16MaxS)                   \
-  V(I8x16Eq, kArm64I8x16Eq)                       \
-  V(I8x16Ne, kArm64I8x16Ne)                       \
-  V(I8x16GtS, kArm64I8x16GtS)                     \
-  V(I8x16GeS, kArm64I8x16GeS)                     \
-  V(I8x16UConvertI16x8, kArm64I8x16UConvertI16x8) \
-  V(I8x16AddSaturateU, kArm64I8x16AddSaturateU)   \
-  V(I8x16SubSaturateU, kArm64I8x16SubSaturateU)   \
-  V(I8x16MinU, kArm64I8x16MinU)                   \
-  V(I8x16MaxU, kArm64I8x16MaxU)                   \
-  V(I8x16GtU, kArm64I8x16GtU)                     \
-  V(I8x16GeU, kArm64I8x16GeU)                     \
-  V(S128And, kArm64S128And)                       \
-  V(S128Or, kArm64S128Or)                         \
-  V(S128Xor, kArm64S128Xor)
+#define SIMD_BINOP_LIST(V)                              \
+  V(F64x2Add, kArm64F64x2Add)                           \
+  V(F64x2Sub, kArm64F64x2Sub)                           \
+  V(F64x2Mul, kArm64F64x2Mul)                           \
+  V(F64x2Div, kArm64F64x2Div)                           \
+  V(F64x2Min, kArm64F64x2Min)                           \
+  V(F64x2Max, kArm64F64x2Max)                           \
+  V(F64x2Eq, kArm64F64x2Eq)                             \
+  V(F64x2Ne, kArm64F64x2Ne)                             \
+  V(F64x2Lt, kArm64F64x2Lt)                             \
+  V(F64x2Le, kArm64F64x2Le)                             \
+  V(F32x4Add, kArm64F32x4Add)                           \
+  V(F32x4AddHoriz, kArm64F32x4AddHoriz)                 \
+  V(F32x4Sub, kArm64F32x4Sub)                           \
+  V(F32x4Mul, kArm64F32x4Mul)                           \
+  V(F32x4Div, kArm64F32x4Div)                           \
+  V(F32x4Min, kArm64F32x4Min)                           \
+  V(F32x4Max, kArm64F32x4Max)                           \
+  V(F32x4Eq, kArm64F32x4Eq)                             \
+  V(F32x4Ne, kArm64F32x4Ne)                             \
+  V(F32x4Lt, kArm64F32x4Lt)                             \
+  V(F32x4Le, kArm64F32x4Le)                             \
+  V(I64x2Add, kArm64I64x2Add)                           \
+  V(I64x2Sub, kArm64I64x2Sub)                           \
+  V(I64x2Eq, kArm64I64x2Eq)                             \
+  V(I64x2Ne, kArm64I64x2Ne)                             \
+  V(I64x2GtS, kArm64I64x2GtS)                           \
+  V(I64x2GeS, kArm64I64x2GeS)                           \
+  V(I64x2GtU, kArm64I64x2GtU)                           \
+  V(I64x2GeU, kArm64I64x2GeU)                           \
+  V(I32x4Add, kArm64I32x4Add)                           \
+  V(I32x4AddHoriz, kArm64I32x4AddHoriz)                 \
+  V(I32x4Sub, kArm64I32x4Sub)                           \
+  V(I32x4Mul, kArm64I32x4Mul)                           \
+  V(I32x4MinS, kArm64I32x4MinS)                         \
+  V(I32x4MaxS, kArm64I32x4MaxS)                         \
+  V(I32x4Eq, kArm64I32x4Eq)                             \
+  V(I32x4Ne, kArm64I32x4Ne)                             \
+  V(I32x4GtS, kArm64I32x4GtS)                           \
+  V(I32x4GeS, kArm64I32x4GeS)                           \
+  V(I32x4MinU, kArm64I32x4MinU)                         \
+  V(I32x4MaxU, kArm64I32x4MaxU)                         \
+  V(I32x4GtU, kArm64I32x4GtU)                           \
+  V(I32x4GeU, kArm64I32x4GeU)                           \
+  V(I16x8SConvertI32x4, kArm64I16x8SConvertI32x4)       \
+  V(I16x8Add, kArm64I16x8Add)                           \
+  V(I16x8AddSaturateS, kArm64I16x8AddSaturateS)         \
+  V(I16x8AddHoriz, kArm64I16x8AddHoriz)                 \
+  V(I16x8Sub, kArm64I16x8Sub)                           \
+  V(I16x8SubSaturateS, kArm64I16x8SubSaturateS)         \
+  V(I16x8Mul, kArm64I16x8Mul)                           \
+  V(I16x8MinS, kArm64I16x8MinS)                         \
+  V(I16x8MaxS, kArm64I16x8MaxS)                         \
+  V(I16x8Eq, kArm64I16x8Eq)                             \
+  V(I16x8Ne, kArm64I16x8Ne)                             \
+  V(I16x8GtS, kArm64I16x8GtS)                           \
+  V(I16x8GeS, kArm64I16x8GeS)                           \
+  V(I16x8UConvertI32x4, kArm64I16x8UConvertI32x4)       \
+  V(I16x8AddSaturateU, kArm64I16x8AddSaturateU)         \
+  V(I16x8SubSaturateU, kArm64I16x8SubSaturateU)         \
+  V(I16x8MinU, kArm64I16x8MinU)                         \
+  V(I16x8MaxU, kArm64I16x8MaxU)                         \
+  V(I16x8GtU, kArm64I16x8GtU)                           \
+  V(I16x8GeU, kArm64I16x8GeU)                           \
+  V(I16x8RoundingAverageU, kArm64I16x8RoundingAverageU) \
+  V(I8x16SConvertI16x8, kArm64I8x16SConvertI16x8)       \
+  V(I8x16Add, kArm64I8x16Add)                           \
+  V(I8x16AddSaturateS, kArm64I8x16AddSaturateS)         \
+  V(I8x16Sub, kArm64I8x16Sub)                           \
+  V(I8x16SubSaturateS, kArm64I8x16SubSaturateS)         \
+  V(I8x16Mul, kArm64I8x16Mul)                           \
+  V(I8x16MinS, kArm64I8x16MinS)                         \
+  V(I8x16MaxS, kArm64I8x16MaxS)                         \
+  V(I8x16Eq, kArm64I8x16Eq)                             \
+  V(I8x16Ne, kArm64I8x16Ne)                             \
+  V(I8x16GtS, kArm64I8x16GtS)                           \
+  V(I8x16GeS, kArm64I8x16GeS)                           \
+  V(I8x16UConvertI16x8, kArm64I8x16UConvertI16x8)       \
+  V(I8x16AddSaturateU, kArm64I8x16AddSaturateU)         \
+  V(I8x16SubSaturateU, kArm64I8x16SubSaturateU)         \
+  V(I8x16MinU, kArm64I8x16MinU)                         \
+  V(I8x16MaxU, kArm64I8x16MaxU)                         \
+  V(I8x16GtU, kArm64I8x16GtU)                           \
+  V(I8x16GeU, kArm64I8x16GeU)                           \
+  V(I8x16RoundingAverageU, kArm64I8x16RoundingAverageU) \
+  V(S128And, kArm64S128And)                             \
+  V(S128Or, kArm64S128Or)                               \
+  V(S128Xor, kArm64S128Xor)                             \
+  V(S128AndNot, kArm64S128AndNot)
 
 void InstructionSelector::VisitS128Zero(Node* node) {
   Arm64OperandGenerator g(this);
@@ -3270,11 +3289,18 @@ void InstructionSelector::VisitS128Zero(Node* node) {
 SIMD_TYPE_LIST(SIMD_VISIT_SPLAT)
 #undef SIMD_VISIT_SPLAT
 
-#define SIMD_VISIT_EXTRACT_LANE(Type)                              \
-  void InstructionSelector::Visit##Type##ExtractLane(Node* node) { \
-    VisitRRI(this, kArm64##Type##ExtractLane, node);               \
-  }
-SIMD_TYPE_LIST(SIMD_VISIT_EXTRACT_LANE)
+#define SIMD_VISIT_EXTRACT_LANE(Type, Sign)                              \
+  void InstructionSelector::Visit##Type##ExtractLane##Sign(Node* node) { \
+    VisitRRI(this, kArm64##Type##ExtractLane##Sign, node);               \
+  }
+SIMD_VISIT_EXTRACT_LANE(F64x2, )
+SIMD_VISIT_EXTRACT_LANE(F32x4, )
+SIMD_VISIT_EXTRACT_LANE(I64x2, )
+SIMD_VISIT_EXTRACT_LANE(I32x4, )
+SIMD_VISIT_EXTRACT_LANE(I16x8, U)
+SIMD_VISIT_EXTRACT_LANE(I16x8, S)
+SIMD_VISIT_EXTRACT_LANE(I8x16, U)
+SIMD_VISIT_EXTRACT_LANE(I8x16, S)
 #undef SIMD_VISIT_EXTRACT_LANE
 
 #define SIMD_VISIT_REPLACE_LANE(Type)                              \
diff --git a/deps/v8/src/compiler/backend/code-generator.cc b/deps/v8/src/compiler/backend/code-generator.cc
index 43eb4a1f15a590..a441a3649641d2 100644
--- a/deps/v8/src/compiler/backend/code-generator.cc
+++ b/deps/v8/src/compiler/backend/code-generator.cc
@@ -10,6 +10,7 @@
 #include "src/codegen/optimized-compilation-info.h"
 #include "src/codegen/string-constants.h"
 #include "src/compiler/backend/code-generator-impl.h"
+#include "src/compiler/globals.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/pipeline.h"
 #include "src/compiler/wasm-compiler.h"
@@ -48,7 +49,7 @@ CodeGenerator::CodeGenerator(
     int start_source_position, JumpOptimizationInfo* jump_opt,
     PoisoningMitigationLevel poisoning_level, const AssemblerOptions& options,
     int32_t builtin_index, size_t max_unoptimized_frame_height,
-    std::unique_ptr<AssemblerBuffer> buffer)
+    size_t max_pushed_argument_count, std::unique_ptr<AssemblerBuffer> buffer)
     : zone_(codegen_zone),
       isolate_(isolate),
       frame_access_state_(nullptr),
@@ -68,6 +69,7 @@ CodeGenerator::CodeGenerator(
       deoptimization_literals_(zone()),
       translations_(zone()),
       max_unoptimized_frame_height_(max_unoptimized_frame_height),
+      max_pushed_argument_count_(max_pushed_argument_count),
       caller_registers_saved_(false),
       jump_tables_(nullptr),
       ools_(nullptr),
@@ -92,9 +94,7 @@ CodeGenerator::CodeGenerator(
       code_kind == Code::WASM_TO_CAPI_FUNCTION ||
       code_kind == Code::WASM_TO_JS_FUNCTION ||
       code_kind == Code::WASM_INTERPRETER_ENTRY ||
-      code_kind == Code::JS_TO_WASM_FUNCTION ||
-      (Builtins::IsBuiltinId(builtin_index) &&
-       Builtins::IsWasmRuntimeStub(builtin_index))) {
+      code_kind == Code::JS_TO_WASM_FUNCTION) {
     tasm_.set_abort_hard(true);
   }
   tasm_.set_builtin_index(builtin_index);
@@ -115,6 +115,41 @@ void CodeGenerator::CreateFrameAccessState(Frame* frame) {
   frame_access_state_ = new (zone()) FrameAccessState(frame);
 }
 
+bool CodeGenerator::ShouldApplyOffsetToStackCheck(Instruction* instr,
+                                                  uint32_t* offset) {
+  DCHECK_EQ(instr->arch_opcode(), kArchStackPointerGreaterThan);
+
+  StackCheckKind kind =
+      static_cast<StackCheckKind>(MiscField::decode(instr->opcode()));
+  if (kind != StackCheckKind::kJSFunctionEntry) return false;
+
+  uint32_t stack_check_offset = *offset = GetStackCheckOffset();
+  return stack_check_offset > kStackLimitSlackForDeoptimizationInBytes;
+}
+
+uint32_t CodeGenerator::GetStackCheckOffset() {
+  if (!frame_access_state()->has_frame()) {
+    DCHECK_EQ(max_unoptimized_frame_height_, 0);
+    DCHECK_EQ(max_pushed_argument_count_, 0);
+    return 0;
+  }
+
+  int32_t optimized_frame_height =
+      frame()->GetTotalFrameSlotCount() * kSystemPointerSize;
+  DCHECK(is_int32(max_unoptimized_frame_height_));
+  int32_t signed_max_unoptimized_frame_height =
+      static_cast<int32_t>(max_unoptimized_frame_height_);
+
+  // The offset is either the delta between the optimized frames and the
+  // interpreted frame, or the maximal number of bytes pushed to the stack
+  // while preparing for function calls, whichever is bigger.
+  uint32_t frame_height_delta = static_cast<uint32_t>(std::max(
+      signed_max_unoptimized_frame_height - optimized_frame_height, 0));
+  uint32_t max_pushed_argument_bytes =
+      static_cast<uint32_t>(max_pushed_argument_count_ * kSystemPointerSize);
+  return std::max(frame_height_delta, max_pushed_argument_bytes);
+}
+
 CodeGenerator::CodeGenResult CodeGenerator::AssembleDeoptimizerCall(
     DeoptimizationExit* exit) {
   int deoptimization_id = exit->deoptimization_id();
@@ -852,13 +887,14 @@ Handle<DeoptimizationData> CodeGenerator::GenerateDeoptimizationData() {
   if (info->has_shared_info()) {
     data->SetSharedFunctionInfo(*info->shared_info());
   } else {
-    data->SetSharedFunctionInfo(Smi::kZero);
+    data->SetSharedFunctionInfo(Smi::zero());
   }
 
   Handle<FixedArray> literals = isolate()->factory()->NewFixedArray(
       static_cast<int>(deoptimization_literals_.size()), AllocationType::kOld);
   for (unsigned i = 0; i < deoptimization_literals_.size(); i++) {
     Handle<Object> object = deoptimization_literals_[i].Reify(isolate());
+    CHECK(!object.is_null());
     literals->set(i, *object);
   }
   data->SetLiteralArray(*literals);
@@ -1218,7 +1254,7 @@ void CodeGenerator::AddTranslationForOperand(Translation* translation,
         literal = DeoptimizationLiteral(constant.ToHeapObject());
         break;
       case Constant::kCompressedHeapObject:
-        DCHECK_EQ(MachineRepresentation::kCompressed, type.representation());
+        DCHECK_EQ(MachineType::AnyTagged(), type);
         literal = DeoptimizationLiteral(constant.ToHeapObject());
         break;
       case Constant::kDelayedStringConstant:
diff --git a/deps/v8/src/compiler/backend/code-generator.h b/deps/v8/src/compiler/backend/code-generator.h
index d56b1edae0e0a8..e54d988b521079 100644
--- a/deps/v8/src/compiler/backend/code-generator.h
+++ b/deps/v8/src/compiler/backend/code-generator.h
@@ -59,7 +59,7 @@ class DeoptimizationLiteral {
   DeoptimizationLiteral() : object_(), number_(0), string_(nullptr) {}
   explicit DeoptimizationLiteral(Handle<Object> object)
       : kind_(DeoptimizationLiteralKind::kObject), object_(object) {
-    DCHECK(!object_.is_null());
+    CHECK(!object_.is_null());
   }
   explicit DeoptimizationLiteral(double number)
       : kind_(DeoptimizationLiteralKind::kNumber), number_(number) {}
@@ -109,16 +109,14 @@ struct TurbolizerInstructionStartInfo {
 // Generates native code for a sequence of instructions.
 class V8_EXPORT_PRIVATE CodeGenerator final : public GapResolver::Assembler {
  public:
-  explicit CodeGenerator(Zone* codegen_zone, Frame* frame, Linkage* linkage,
-                         InstructionSequence* instructions,
-                         OptimizedCompilationInfo* info, Isolate* isolate,
-                         base::Optional<OsrHelper> osr_helper,
-                         int start_source_position,
-                         JumpOptimizationInfo* jump_opt,
-                         PoisoningMitigationLevel poisoning_level,
-                         const AssemblerOptions& options, int32_t builtin_index,
-                         size_t max_unoptimized_frame_height,
-                         std::unique_ptr<AssemblerBuffer> = {});
+  explicit CodeGenerator(
+      Zone* codegen_zone, Frame* frame, Linkage* linkage,
+      InstructionSequence* instructions, OptimizedCompilationInfo* info,
+      Isolate* isolate, base::Optional<OsrHelper> osr_helper,
+      int start_source_position, JumpOptimizationInfo* jump_opt,
+      PoisoningMitigationLevel poisoning_level, const AssemblerOptions& options,
+      int32_t builtin_index, size_t max_unoptimized_frame_height,
+      size_t max_pushed_argument_count, std::unique_ptr<AssemblerBuffer> = {});
 
   // Generate native code. After calling AssembleCode, call FinalizeCode to
   // produce the actual code object. If an error occurs during either phase,
@@ -171,6 +169,15 @@ class V8_EXPORT_PRIVATE CodeGenerator final : public GapResolver::Assembler {
 
   static constexpr int kBinarySearchSwitchMinimalCases = 4;
 
+  // Returns true if an offset should be applied to the given stack check. There
+  // are two reasons that this could happen:
+  // 1. The optimized frame is smaller than the corresponding deoptimized frames
+  //    and an offset must be applied in order to be able to deopt safely.
+  // 2. The current function pushes a large number of arguments to the stack.
+  //    These are not accounted for by the initial frame setup.
+  bool ShouldApplyOffsetToStackCheck(Instruction* instr, uint32_t* offset);
+  uint32_t GetStackCheckOffset();
+
  private:
   GapResolver* resolver() { return &resolver_; }
   SafepointTableBuilder* safepoints() { return &safepoints_; }
@@ -425,9 +432,11 @@ class V8_EXPORT_PRIVATE CodeGenerator final : public GapResolver::Assembler {
   int handler_table_offset_ = 0;
   int last_lazy_deopt_pc_ = 0;
 
-  // The maximal combined height of all frames produced upon deoptimization.
-  // Applied as an offset to the first stack check of an optimized function.
+  // The maximal combined height of all frames produced upon deoptimization, and
+  // the maximal number of pushed arguments for function calls. Applied as an
+  // offset to the first stack check of an optimized function.
   const size_t max_unoptimized_frame_height_;
+  const size_t max_pushed_argument_count_;
 
   // kArchCallCFunction could be reached either:
   //   kArchCallCFunction;
diff --git a/deps/v8/src/compiler/backend/ia32/code-generator-ia32.cc b/deps/v8/src/compiler/backend/ia32/code-generator-ia32.cc
index 068268a3da4940..7484d91dbff24e 100644
--- a/deps/v8/src/compiler/backend/ia32/code-generator-ia32.cc
+++ b/deps/v8/src/compiler/backend/ia32/code-generator-ia32.cc
@@ -321,7 +321,7 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
       // Just encode the stub index. This will be patched when the code
       // is added to the native module and copied into wasm code space.
       __ CallRecordWriteStub(object_, scratch1_, remembered_set_action,
-                             save_fp_mode, wasm::WasmCode::kWasmRecordWrite);
+                             save_fp_mode, wasm::WasmCode::kRecordWrite);
     } else {
       __ CallRecordWriteStub(object_, scratch1_, remembered_set_action,
                              save_fp_mode);
@@ -533,9 +533,8 @@ void CodeGenerator::AssemblePopArgumentsAdaptorFrame(Register args_reg,
          Operand(ebp, ArgumentsAdaptorFrameConstants::kLengthOffset));
   __ SmiUntag(caller_args_count_reg);
 
-  ParameterCount callee_args_count(args_reg);
-  __ PrepareForTailCall(callee_args_count, caller_args_count_reg, scratch2,
-                        scratch3, scratch_count);
+  __ PrepareForTailCall(args_reg, caller_args_count_reg, scratch2, scratch3,
+                        scratch_count);
   __ pop(scratch3);
   __ pop(scratch2);
   __ pop(scratch1);
@@ -564,12 +563,19 @@ void AdjustStackPointerForTailCall(TurboAssembler* tasm,
 #ifdef DEBUG
 bool VerifyOutputOfAtomicPairInstr(IA32OperandConverter* converter,
                                    const Instruction* instr) {
-  if (instr->OutputCount() > 0) {
-    if (converter->OutputRegister(0) != eax) return false;
-    if (instr->OutputCount() == 2 && converter->OutputRegister(1) != edx)
-      return false;
+  if (instr->OutputCount() == 2) {
+    return (converter->OutputRegister(0) == eax &&
+            converter->OutputRegister(1) == edx);
   }
-  return true;
+  if (instr->OutputCount() == 1) {
+    return (converter->OutputRegister(0) == eax &&
+            converter->TempRegister(0) == edx) ||
+           (converter->OutputRegister(0) == edx &&
+            converter->TempRegister(0) == eax);
+  }
+  DCHECK_EQ(instr->OutputCount(), 0);
+  return (converter->TempRegister(0) == eax &&
+          converter->TempRegister(1) == edx);
 }
 #endif
 
@@ -642,7 +648,7 @@ void CodeGenerator::BailoutIfDeoptimized() {
   __ pop(eax);  // Restore eax.
 
   Label skip;
-  __ j(zero, &skip);
+  __ j(zero, &skip, Label::kNear);
   __ Jump(BUILTIN_CODE(isolate(), CompileLazyDeoptimizedCode),
           RelocInfo::CODE_TARGET);
   __ bind(&skip);
@@ -670,7 +676,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (op->IsImmediate()) {
         Handle<Code> code = i.InputCode(0);
         __ Call(code, RelocInfo::CODE_TARGET);
-      } else if (op->IsRegister()) {
+      } else {
         Register reg = i.InputRegister(0);
         DCHECK_IMPLIES(
             HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
@@ -681,23 +687,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         } else {
           __ call(reg);
         }
-      } else {
-        CHECK(tasm()->root_array_available());
-        // This is used to allow calls to the arguments adaptor trampoline from
-        // code that only has 5 gp registers available and cannot call through
-        // an immediate. This happens when the arguments adaptor trampoline is
-        // not an embedded builtin.
-        // TODO(v8:6666): Remove once only embedded builtins are supported.
-        __ push(eax);
-        frame_access_state()->IncreaseSPDelta(1);
-        Operand virtual_call_target_register(
-            kRootRegister, IsolateData::virtual_call_target_register_offset());
-        __ mov(eax, i.InputOperand(0));
-        __ LoadCodeObjectEntry(eax, eax);
-        __ mov(virtual_call_target_register, eax);
-        __ pop(eax);
-        frame_access_state()->IncreaseSPDelta(-1);
-        __ call(virtual_call_target_register);
       }
       RecordCallPosition(instr);
       frame_access_state()->ClearSPDelta();
@@ -866,7 +855,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ CallCFunction(func, num_parameters);
       }
       __ bind(&return_location);
-      RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
+      if (linkage()->GetIncomingDescriptor()->IsWasmCapiFunction()) {
+        RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
+      }
       frame_access_state()->SetFrameAccessToDefault();
       // Ideally, we should decrement SP delta to match the change of stack
       // pointer in CallCFunction. However, for certain architectures (e.g.
@@ -941,14 +932,28 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     case kArchStackPointerGreaterThan: {
+      // Potentially apply an offset to the current stack pointer before the
+      // comparison to consider the size difference of an optimized frame versus
+      // the contained unoptimized frames.
+      Register lhs_register = esp;
+      uint32_t offset;
+
+      if (ShouldApplyOffsetToStackCheck(instr, &offset)) {
+        lhs_register = i.TempRegister(0);
+        __ lea(lhs_register, Operand(esp, -1 * static_cast<int32_t>(offset)));
+      }
+
       constexpr size_t kValueIndex = 0;
       if (HasAddressingMode(instr)) {
-        __ cmp(esp, i.MemoryOperand(kValueIndex));
+        __ cmp(lhs_register, i.MemoryOperand(kValueIndex));
       } else {
-        __ cmp(esp, i.InputRegister(kValueIndex));
+        __ cmp(lhs_register, i.InputRegister(kValueIndex));
       }
       break;
     }
+    case kArchStackCheckOffset:
+      __ Move(i.OutputRegister(), Smi::FromInt(GetStackCheckOffset()));
+      break;
     case kArchTruncateDoubleToI: {
       auto result = i.OutputRegister();
       auto input = i.InputDoubleRegister(0);
@@ -1898,14 +1903,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       XMMRegister src = i.InputSimd128Register(0);
       int8_t lane = i.InputInt8(1);
       DoubleRegister rep = i.InputDoubleRegister(2);
+      DCHECK_NE(dst, rep);
 
       DCHECK_LT(lane, 2);
       if (lane == 0) {
         __ vinsertps(dst, src, rep, 0b00000000);
-        __ vinsertps(dst, src, rep, 0b01010000);
+        __ vinsertps(dst, dst, rep, 0b01010000);
       } else {
-        __ vinsertps(dst, src, rep, 0b10100000);
-        __ vinsertps(dst, src, rep, 0b11110000);
+        __ vinsertps(dst, src, rep, 0b00100000);
+        __ vinsertps(dst, dst, rep, 0b01110000);
       }
       break;
     }
@@ -1994,6 +2000,100 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                  i.InputOperand(1));
       break;
     }
+    case kIA32I64x2SplatI32Pair: {
+      XMMRegister dst = i.OutputSimd128Register();
+      __ Pinsrd(dst, i.InputRegister(0), 0);
+      __ Pinsrd(dst, i.InputOperand(1), 1);
+      __ Pshufd(dst, dst, 0x44);
+      break;
+    }
+    case kIA32I64x2ReplaceLaneI32Pair: {
+      int8_t lane = i.InputInt8(1);
+      __ Pinsrd(i.OutputSimd128Register(), i.InputOperand(2), lane * 2);
+      __ Pinsrd(i.OutputSimd128Register(), i.InputOperand(3), lane * 2 + 1);
+      break;
+    }
+    case kIA32I64x2Neg: {
+      XMMRegister dst = i.OutputSimd128Register();
+      Operand src = i.InputOperand(0);
+      __ Pxor(dst, dst);
+      __ Psubq(dst, src);
+      break;
+    }
+    case kIA32I64x2Shl: {
+      XMMRegister tmp = i.TempSimd128Register(0);
+      Register shift = i.InputRegister(1);
+      // Take shift value modulo 64.
+      __ and_(shift, Immediate(63));
+      __ Movd(tmp, shift);
+      __ Psllq(i.OutputSimd128Register(), i.InputSimd128Register(0), tmp);
+      break;
+    }
+    case kIA32I64x2ShrS: {
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src = i.InputSimd128Register(0);
+      XMMRegister tmp = i.TempSimd128Register(0);
+      XMMRegister tmp2 = i.TempSimd128Register(1);
+      Operand shift = i.InputOperand(1);
+
+      // Take shift value modulo 64.
+      __ and_(shift, Immediate(63));
+      __ Movd(tmp, shift);
+
+      // Set up a mask [0x80000000,0,0x80000000,0].
+      __ Pcmpeqb(tmp2, tmp2);
+      __ Psllq(tmp2, tmp2, 63);
+
+      __ Psrlq(tmp2, tmp2, tmp);
+      __ Psrlq(dst, src, tmp);
+      __ Pxor(dst, tmp2);
+      __ Psubq(dst, tmp2);
+      break;
+    }
+    case kIA32I64x2Add: {
+      __ Paddq(i.OutputSimd128Register(), i.InputSimd128Register(0),
+               i.InputOperand(1));
+      break;
+    }
+    case kIA32I64x2Sub: {
+      __ Psubq(i.OutputSimd128Register(), i.InputSimd128Register(0),
+               i.InputOperand(1));
+      break;
+    }
+    case kIA32I64x2Mul: {
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister left = i.InputSimd128Register(0);
+      XMMRegister right = i.InputSimd128Register(1);
+      XMMRegister tmp1 = i.TempSimd128Register(0);
+      XMMRegister tmp2 = i.TempSimd128Register(1);
+
+      __ Movaps(tmp1, left);
+      __ Movaps(tmp2, right);
+
+      // Multiply high dword of each qword of left with right.
+      __ Psrlq(tmp1, 32);
+      __ Pmuludq(tmp1, tmp1, right);
+
+      // Multiply high dword of each qword of right with left.
+      __ Psrlq(tmp2, 32);
+      __ Pmuludq(tmp2, tmp2, left);
+
+      __ Paddq(tmp2, tmp2, tmp1);
+      __ Psllq(tmp2, tmp2, 32);
+
+      __ Pmuludq(dst, left, right);
+      __ Paddq(dst, dst, tmp2);
+      break;
+    }
+    case kIA32I64x2ShrU: {
+      XMMRegister tmp = i.TempSimd128Register(0);
+      Register shift = i.InputRegister(1);
+      // Take shift value modulo 64.
+      __ and_(shift, Immediate(63));
+      __ Movd(tmp, shift);
+      __ Psrlq(i.OutputSimd128Register(), i.InputSimd128Register(0), tmp);
+      break;
+    }
     case kSSEF32x4Splat: {
       DCHECK_EQ(i.OutputDoubleRegister(), i.InputDoubleRegister(0));
       XMMRegister dst = i.OutputSimd128Register();
@@ -2707,9 +2807,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Pshufd(dst, dst, 0x0);
       break;
     }
-    case kIA32I16x8ExtractLane: {
+    case kIA32I16x8ExtractLaneU: {
+      Register dst = i.OutputRegister();
+      __ Pextrw(dst, i.InputSimd128Register(0), i.InputInt8(1));
+      break;
+    }
+    case kIA32I16x8ExtractLaneS: {
       Register dst = i.OutputRegister();
       __ Pextrw(dst, i.InputSimd128Register(0), i.InputInt8(1));
+      __ movsx_w(dst, dst);
       break;
     }
     case kSSEI16x8ReplaceLane: {
@@ -2972,25 +3078,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kSSEI16x8UConvertI32x4: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       CpuFeatureScope sse_scope(tasm(), SSE4_1);
-      XMMRegister dst = i.OutputSimd128Register();
-      // Change negative lanes to 0x7FFFFFFF
-      __ pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
-      __ psrld(kScratchDoubleReg, 1);
-      __ pminud(dst, kScratchDoubleReg);
-      __ pminud(kScratchDoubleReg, i.InputOperand(1));
-      __ packusdw(dst, kScratchDoubleReg);
+      __ packusdw(i.OutputSimd128Register(), i.InputOperand(1));
       break;
     }
     case kAVXI16x8UConvertI32x4: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       CpuFeatureScope avx_scope(tasm(), AVX);
       XMMRegister dst = i.OutputSimd128Register();
-      // Change negative lanes to 0x7FFFFFFF
-      __ vpcmpeqd(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
-      __ vpsrld(kScratchDoubleReg, kScratchDoubleReg, 1);
-      __ vpminud(dst, kScratchDoubleReg, i.InputSimd128Register(0));
-      __ vpminud(kScratchDoubleReg, kScratchDoubleReg, i.InputOperand(1));
-      __ vpackusdw(dst, dst, kScratchDoubleReg);
+      __ vpackusdw(dst, dst, i.InputOperand(1));
       break;
     }
     case kSSEI16x8AddSaturateU: {
@@ -3078,6 +3173,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ vpcmpeqw(i.OutputSimd128Register(), kScratchDoubleReg, src2);
       break;
     }
+    case kIA32I16x8RoundingAverageU: {
+      __ Pavgw(i.OutputSimd128Register(), i.InputSimd128Register(0),
+               i.InputOperand(1));
+      break;
+    }
     case kIA32I8x16Splat: {
       XMMRegister dst = i.OutputSimd128Register();
       __ Movd(dst, i.InputOperand(0));
@@ -3085,9 +3185,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Pshufb(dst, kScratchDoubleReg);
       break;
     }
-    case kIA32I8x16ExtractLane: {
+    case kIA32I8x16ExtractLaneU: {
+      Register dst = i.OutputRegister();
+      __ Pextrb(dst, i.InputSimd128Register(0), i.InputInt8(1));
+      break;
+    }
+    case kIA32I8x16ExtractLaneS: {
       Register dst = i.OutputRegister();
       __ Pextrb(dst, i.InputSimd128Register(0), i.InputInt8(1));
+      __ movsx_b(dst, dst);
       break;
     }
     case kSSEI8x16ReplaceLane: {
@@ -3390,24 +3496,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       CpuFeatureScope sse_scope(tasm(), SSE4_1);
       XMMRegister dst = i.OutputSimd128Register();
-      // Change negative lanes to 0x7FFF
-      __ pcmpeqw(kScratchDoubleReg, kScratchDoubleReg);
-      __ psrlw(kScratchDoubleReg, 1);
-      __ pminuw(dst, kScratchDoubleReg);
-      __ pminuw(kScratchDoubleReg, i.InputOperand(1));
-      __ packuswb(dst, kScratchDoubleReg);
+      __ packuswb(dst, i.InputOperand(1));
       break;
     }
     case kAVXI8x16UConvertI16x8: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       CpuFeatureScope avx_scope(tasm(), AVX);
       XMMRegister dst = i.OutputSimd128Register();
-      // Change negative lanes to 0x7FFF
-      __ vpcmpeqw(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
-      __ vpsrlw(kScratchDoubleReg, kScratchDoubleReg, 1);
-      __ vpminuw(dst, kScratchDoubleReg, i.InputSimd128Register(0));
-      __ vpminuw(kScratchDoubleReg, kScratchDoubleReg, i.InputOperand(1));
-      __ vpackuswb(dst, dst, kScratchDoubleReg);
+      __ vpackuswb(dst, dst, i.InputOperand(1));
       break;
     }
     case kSSEI8x16AddSaturateU: {
@@ -3510,6 +3606,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ vpcmpeqb(i.OutputSimd128Register(), kScratchDoubleReg, src2);
       break;
     }
+    case kIA32I8x16RoundingAverageU: {
+      __ Pavgb(i.OutputSimd128Register(), i.InputSimd128Register(0),
+               i.InputOperand(1));
+      break;
+    }
     case kIA32S128Zero: {
       XMMRegister dst = i.OutputSimd128Register();
       __ Pxor(dst, dst);
@@ -3585,6 +3686,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ vxorps(dst, kScratchDoubleReg, i.InputSimd128Register(2));
       break;
     }
+    case kIA32S128AndNot: {
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      // The inputs have been inverted by instruction selector, so we can call
+      // andnps here without any modifications.
+      XMMRegister src1 = i.InputSimd128Register(1);
+      __ Andnps(dst, src1);
+      break;
+    }
     case kIA32S8x16Swizzle: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       XMMRegister dst = i.OutputSimd128Register();
@@ -3642,6 +3752,51 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ mov(esp, tmp);
       break;
     }
+    case kIA32S8x16LoadSplat: {
+      __ Pinsrb(i.OutputSimd128Register(), i.MemoryOperand(), 0);
+      __ Pxor(kScratchDoubleReg, kScratchDoubleReg);
+      __ Pshufb(i.OutputSimd128Register(), kScratchDoubleReg);
+      break;
+    }
+    case kIA32S16x8LoadSplat: {
+      __ Pinsrw(i.OutputSimd128Register(), i.MemoryOperand(), 0);
+      __ Pshuflw(i.OutputSimd128Register(), i.OutputSimd128Register(),
+                 static_cast<uint8_t>(0));
+      __ Punpcklqdq(i.OutputSimd128Register(), i.OutputSimd128Register());
+      break;
+    }
+    case kIA32S32x4LoadSplat: {
+      __ Vbroadcastss(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
+    case kIA32S64x2LoadSplat: {
+      __ Movddup(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
+    case kIA32I16x8Load8x8S: {
+      __ Pmovsxbw(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
+    case kIA32I16x8Load8x8U: {
+      __ Pmovzxbw(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
+    case kIA32I32x4Load16x4S: {
+      __ Pmovsxwd(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
+    case kIA32I32x4Load16x4U: {
+      __ Pmovzxwd(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
+    case kIA32I64x2Load32x2S: {
+      __ Pmovsxdq(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
+    case kIA32I64x2Load32x2U: {
+      __ Pmovzxdq(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
     case kIA32S32x4Swizzle: {
       DCHECK_EQ(2, instr->InputCount());
       __ Pshufd(i.OutputSimd128Register(), i.InputOperand(0), i.InputInt8(1));
@@ -3983,13 +4138,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kIA32Word32AtomicPairLoad: {
       XMMRegister tmp = i.ToDoubleRegister(instr->TempAt(0));
       __ movq(tmp, i.MemoryOperand());
-      if (instr->OutputCount() == 2) {
-        __ Pextrd(i.OutputRegister(0), tmp, 0);
-        __ Pextrd(i.OutputRegister(1), tmp, 1);
-      } else if (instr->OutputCount() == 1) {
-        __ Pextrd(i.OutputRegister(0), tmp, 0);
-        __ Pextrd(i.TempRegister(1), tmp, 1);
-      }
+      __ Pextrd(i.OutputRegister(0), tmp, 0);
+      __ Pextrd(i.OutputRegister(1), tmp, 1);
       break;
     }
     case kIA32Word32AtomicPairStore: {
@@ -4295,7 +4445,7 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
   Label* tlabel = ool->entry();
   Label end;
   if (condition == kUnorderedEqual) {
-    __ j(parity_even, &end);
+    __ j(parity_even, &end, Label::kNear);
   } else if (condition == kUnorderedNotEqual) {
     __ j(parity_even, tlabel);
   }
@@ -4597,7 +4747,7 @@ void CodeGenerator::AssembleConstructFrame() {
         __ add(scratch, Immediate(required_slots * kSystemPointerSize));
         __ cmp(esp, scratch);
         __ pop(scratch);
-        __ j(above_equal, &done);
+        __ j(above_equal, &done, Label::kNear);
       }
 
       __ wasm_call(wasm::WasmCode::kWasmStackOverflow,
diff --git a/deps/v8/src/compiler/backend/ia32/instruction-codes-ia32.h b/deps/v8/src/compiler/backend/ia32/instruction-codes-ia32.h
index a77fb8cd372edc..d53c1ecc01dbbe 100644
--- a/deps/v8/src/compiler/backend/ia32/instruction-codes-ia32.h
+++ b/deps/v8/src/compiler/backend/ia32/instruction-codes-ia32.h
@@ -133,6 +133,15 @@ namespace compiler {
   V(IA32F64x2Ne)                   \
   V(IA32F64x2Lt)                   \
   V(IA32F64x2Le)                   \
+  V(IA32I64x2SplatI32Pair)         \
+  V(IA32I64x2ReplaceLaneI32Pair)   \
+  V(IA32I64x2Neg)                  \
+  V(IA32I64x2Shl)                  \
+  V(IA32I64x2ShrS)                 \
+  V(IA32I64x2Add)                  \
+  V(IA32I64x2Sub)                  \
+  V(IA32I64x2Mul)                  \
+  V(IA32I64x2ShrU)                 \
   V(SSEF32x4Splat)                 \
   V(AVXF32x4Splat)                 \
   V(SSEF32x4ExtractLane)           \
@@ -220,7 +229,8 @@ namespace compiler {
   V(SSEI32x4GeU)                   \
   V(AVXI32x4GeU)                   \
   V(IA32I16x8Splat)                \
-  V(IA32I16x8ExtractLane)          \
+  V(IA32I16x8ExtractLaneU)         \
+  V(IA32I16x8ExtractLaneS)         \
   V(SSEI16x8ReplaceLane)           \
   V(AVXI16x8ReplaceLane)           \
   V(IA32I16x8SConvertI8x16Low)     \
@@ -274,8 +284,10 @@ namespace compiler {
   V(AVXI16x8GtU)                   \
   V(SSEI16x8GeU)                   \
   V(AVXI16x8GeU)                   \
+  V(IA32I16x8RoundingAverageU)     \
   V(IA32I8x16Splat)                \
-  V(IA32I8x16ExtractLane)          \
+  V(IA32I8x16ExtractLaneU)         \
+  V(IA32I8x16ExtractLaneS)         \
   V(SSEI8x16ReplaceLane)           \
   V(AVXI8x16ReplaceLane)           \
   V(SSEI8x16SConvertI16x8)         \
@@ -321,6 +333,7 @@ namespace compiler {
   V(AVXI8x16GtU)                   \
   V(SSEI8x16GeU)                   \
   V(AVXI8x16GeU)                   \
+  V(IA32I8x16RoundingAverageU)     \
   V(IA32S128Zero)                  \
   V(SSES128Not)                    \
   V(AVXS128Not)                    \
@@ -332,8 +345,19 @@ namespace compiler {
   V(AVXS128Xor)                    \
   V(SSES128Select)                 \
   V(AVXS128Select)                 \
+  V(IA32S128AndNot)                \
   V(IA32S8x16Swizzle)              \
   V(IA32S8x16Shuffle)              \
+  V(IA32S8x16LoadSplat)            \
+  V(IA32S16x8LoadSplat)            \
+  V(IA32S32x4LoadSplat)            \
+  V(IA32S64x2LoadSplat)            \
+  V(IA32I16x8Load8x8S)             \
+  V(IA32I16x8Load8x8U)             \
+  V(IA32I32x4Load16x4S)            \
+  V(IA32I32x4Load16x4U)            \
+  V(IA32I64x2Load32x2S)            \
+  V(IA32I64x2Load32x2U)            \
   V(IA32S32x4Swizzle)              \
   V(IA32S32x4Shuffle)              \
   V(IA32S16x8Blend)                \
diff --git a/deps/v8/src/compiler/backend/ia32/instruction-scheduler-ia32.cc b/deps/v8/src/compiler/backend/ia32/instruction-scheduler-ia32.cc
index 287eb49a4803aa..61c39a17e36a69 100644
--- a/deps/v8/src/compiler/backend/ia32/instruction-scheduler-ia32.cc
+++ b/deps/v8/src/compiler/backend/ia32/instruction-scheduler-ia32.cc
@@ -114,6 +114,15 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kIA32F64x2Ne:
     case kIA32F64x2Lt:
     case kIA32F64x2Le:
+    case kIA32I64x2SplatI32Pair:
+    case kIA32I64x2ReplaceLaneI32Pair:
+    case kIA32I64x2Neg:
+    case kIA32I64x2Shl:
+    case kIA32I64x2ShrS:
+    case kIA32I64x2Add:
+    case kIA32I64x2Sub:
+    case kIA32I64x2Mul:
+    case kIA32I64x2ShrU:
     case kSSEF32x4Splat:
     case kAVXF32x4Splat:
     case kSSEF32x4ExtractLane:
@@ -201,7 +210,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kSSEI32x4GeU:
     case kAVXI32x4GeU:
     case kIA32I16x8Splat:
-    case kIA32I16x8ExtractLane:
+    case kIA32I16x8ExtractLaneU:
+    case kIA32I16x8ExtractLaneS:
     case kSSEI16x8ReplaceLane:
     case kAVXI16x8ReplaceLane:
     case kIA32I16x8SConvertI8x16Low:
@@ -255,8 +265,10 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXI16x8GtU:
     case kSSEI16x8GeU:
     case kAVXI16x8GeU:
+    case kIA32I16x8RoundingAverageU:
     case kIA32I8x16Splat:
-    case kIA32I8x16ExtractLane:
+    case kIA32I8x16ExtractLaneU:
+    case kIA32I8x16ExtractLaneS:
     case kSSEI8x16ReplaceLane:
     case kAVXI8x16ReplaceLane:
     case kSSEI8x16SConvertI16x8:
@@ -302,6 +314,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXI8x16GtU:
     case kSSEI8x16GeU:
     case kAVXI8x16GeU:
+    case kIA32I8x16RoundingAverageU:
     case kIA32S128Zero:
     case kSSES128Not:
     case kAVXS128Not:
@@ -313,6 +326,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXS128Xor:
     case kSSES128Select:
     case kAVXS128Select:
+    case kIA32S128AndNot:
     case kIA32S8x16Swizzle:
     case kIA32S8x16Shuffle:
     case kIA32S32x4Swizzle:
@@ -375,7 +389,17 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kIA32Movss:
     case kIA32Movsd:
     case kIA32Movdqu:
-      // Moves are used for memory load/store operations.
+    // Moves are used for memory load/store operations.
+    case kIA32S8x16LoadSplat:
+    case kIA32S16x8LoadSplat:
+    case kIA32S32x4LoadSplat:
+    case kIA32S64x2LoadSplat:
+    case kIA32I16x8Load8x8S:
+    case kIA32I16x8Load8x8U:
+    case kIA32I32x4Load16x4S:
+    case kIA32I32x4Load16x4U:
+    case kIA32I64x2Load32x2S:
+    case kIA32I64x2Load32x2U:
       return instr->HasOutput() ? kIsLoadOperation : kHasSideEffect;
 
     case kIA32Peek:
diff --git a/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc b/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc
index a24727aba20f26..cb02f56e4808da 100644
--- a/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc
+++ b/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc
@@ -86,15 +86,11 @@ class IA32OperandGenerator final : public OperandGenerator {
     }
   }
 
-  AddressingMode GenerateMemoryOperandInputs(Node* index, int scale, Node* base,
-                                             Node* displacement_node,
-                                             DisplacementMode displacement_mode,
-                                             InstructionOperand inputs[],
-                                             size_t* input_count) {
+  AddressingMode GenerateMemoryOperandInputs(
+      Node* index, int scale, Node* base, int32_t displacement,
+      DisplacementMode displacement_mode, InstructionOperand inputs[],
+      size_t* input_count, RegisterMode register_mode = kRegister) {
     AddressingMode mode = kMode_MRI;
-    int32_t displacement = (displacement_node == nullptr)
-                               ? 0
-                               : OpParameter<int32_t>(displacement_node->op());
     if (displacement_mode == kNegativeDisplacement) {
       displacement = -displacement;
     }
@@ -105,10 +101,10 @@ class IA32OperandGenerator final : public OperandGenerator {
       }
     }
     if (base != nullptr) {
-      inputs[(*input_count)++] = UseRegister(base);
+      inputs[(*input_count)++] = UseRegisterWithMode(base, register_mode);
       if (index != nullptr) {
         DCHECK(scale >= 0 && scale <= 3);
-        inputs[(*input_count)++] = UseRegister(index);
+        inputs[(*input_count)++] = UseRegisterWithMode(index, register_mode);
         if (displacement != 0) {
           inputs[(*input_count)++] = TempImmediate(displacement);
           static const AddressingMode kMRnI_modes[] = {kMode_MR1I, kMode_MR2I,
@@ -130,7 +126,7 @@ class IA32OperandGenerator final : public OperandGenerator {
     } else {
       DCHECK(scale >= 0 && scale <= 3);
       if (index != nullptr) {
-        inputs[(*input_count)++] = UseRegister(index);
+        inputs[(*input_count)++] = UseRegisterWithMode(index, register_mode);
         if (displacement != 0) {
           inputs[(*input_count)++] = TempImmediate(displacement);
           static const AddressingMode kMnI_modes[] = {kMode_MRI, kMode_M2I,
@@ -149,9 +145,21 @@ class IA32OperandGenerator final : public OperandGenerator {
     return mode;
   }
 
-  AddressingMode GetEffectiveAddressMemoryOperand(Node* node,
-                                                  InstructionOperand inputs[],
-                                                  size_t* input_count) {
+  AddressingMode GenerateMemoryOperandInputs(
+      Node* index, int scale, Node* base, Node* displacement_node,
+      DisplacementMode displacement_mode, InstructionOperand inputs[],
+      size_t* input_count, RegisterMode register_mode = kRegister) {
+    int32_t displacement = (displacement_node == nullptr)
+                               ? 0
+                               : OpParameter<int32_t>(displacement_node->op());
+    return GenerateMemoryOperandInputs(index, scale, base, displacement,
+                                       displacement_mode, inputs, input_count,
+                                       register_mode);
+  }
+
+  AddressingMode GetEffectiveAddressMemoryOperand(
+      Node* node, InstructionOperand inputs[], size_t* input_count,
+      RegisterMode register_mode = kRegister) {
     {
       LoadMatcher<ExternalReferenceMatcher> m(node);
       if (m.index().HasValue() && m.object().HasValue() &&
@@ -172,10 +180,12 @@ class IA32OperandGenerator final : public OperandGenerator {
     if ((m.displacement() == nullptr || CanBeImmediate(m.displacement()))) {
       return GenerateMemoryOperandInputs(
           m.index(), m.scale(), m.base(), m.displacement(),
-          m.displacement_mode(), inputs, input_count);
+          m.displacement_mode(), inputs, input_count, register_mode);
     } else {
-      inputs[(*input_count)++] = UseRegister(node->InputAt(0));
-      inputs[(*input_count)++] = UseRegister(node->InputAt(1));
+      inputs[(*input_count)++] =
+          UseRegisterWithMode(node->InputAt(0), register_mode);
+      inputs[(*input_count)++] =
+          UseRegisterWithMode(node->InputAt(1), register_mode);
       return kMode_MR1;
     }
   }
@@ -275,7 +285,7 @@ void VisitRRISimd(InstructionSelector* selector, Node* node,
       g.UseImmediate(OpParameter<int32_t>(node->op()));
   // 8x16 uses movsx_b on dest to extract a byte, which only works
   // if dest is a byte register.
-  InstructionOperand dest = opcode == kIA32I8x16ExtractLane
+  InstructionOperand dest = opcode == kIA32I8x16ExtractLaneS
                                 ? g.DefineAsFixed(node, eax)
                                 : g.DefineAsRegister(node);
   selector->Emit(opcode, dest, operand0, operand1);
@@ -335,6 +345,60 @@ void InstructionSelector::VisitAbortCSAAssert(Node* node) {
   Emit(kArchAbortCSAAssert, g.NoOutput(), g.UseFixed(node->InputAt(0), edx));
 }
 
+void InstructionSelector::VisitLoadTransform(Node* node) {
+  LoadTransformParameters params = LoadTransformParametersOf(node->op());
+  InstructionCode opcode = kArchNop;
+  switch (params.transformation) {
+    case LoadTransformation::kS8x16LoadSplat:
+      opcode = kIA32S8x16LoadSplat;
+      break;
+    case LoadTransformation::kS16x8LoadSplat:
+      opcode = kIA32S16x8LoadSplat;
+      break;
+    case LoadTransformation::kS32x4LoadSplat:
+      opcode = kIA32S32x4LoadSplat;
+      break;
+    case LoadTransformation::kS64x2LoadSplat:
+      opcode = kIA32S64x2LoadSplat;
+      break;
+    case LoadTransformation::kI16x8Load8x8S:
+      opcode = kIA32I16x8Load8x8S;
+      break;
+    case LoadTransformation::kI16x8Load8x8U:
+      opcode = kIA32I16x8Load8x8U;
+      break;
+    case LoadTransformation::kI32x4Load16x4S:
+      opcode = kIA32I32x4Load16x4S;
+      break;
+    case LoadTransformation::kI32x4Load16x4U:
+      opcode = kIA32I32x4Load16x4U;
+      break;
+    case LoadTransformation::kI64x2Load32x2S:
+      opcode = kIA32I64x2Load32x2S;
+      break;
+    case LoadTransformation::kI64x2Load32x2U:
+      opcode = kIA32I64x2Load32x2U;
+      break;
+    default:
+      UNREACHABLE();
+  }
+
+  // IA32 supports unaligned loads.
+  DCHECK_NE(params.kind, LoadKind::kUnaligned);
+  // Trap handler is not supported on IA32.
+  DCHECK_NE(params.kind, LoadKind::kProtected);
+
+  IA32OperandGenerator g(this);
+  InstructionOperand outputs[1];
+  outputs[0] = g.DefineAsRegister(node);
+  InstructionOperand inputs[3];
+  size_t input_count = 0;
+  AddressingMode mode =
+      g.GetEffectiveAddressMemoryOperand(node, inputs, &input_count);
+  InstructionCode code = opcode | AddressingModeField::encode(mode);
+  Emit(code, 1, outputs, input_count, inputs);
+}
+
 void InstructionSelector::VisitLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
 
@@ -362,7 +426,6 @@ void InstructionSelector::VisitLoad(Node* node) {
     case MachineRepresentation::kSimd128:
       opcode = kIA32Movdqu;
       break;
-    case MachineRepresentation::kCompressedSigned:   // Fall through.
     case MachineRepresentation::kCompressedPointer:  // Fall through.
     case MachineRepresentation::kCompressed:         // Fall through.
     case MachineRepresentation::kWord64:             // Fall through.
@@ -443,7 +506,6 @@ void InstructionSelector::VisitStore(Node* node) {
       case MachineRepresentation::kSimd128:
         opcode = kIA32Movdqu;
         break;
-      case MachineRepresentation::kCompressedSigned:   // Fall through.
       case MachineRepresentation::kCompressedPointer:  // Fall through.
       case MachineRepresentation::kCompressed:         // Fall through.
       case MachineRepresentation::kWord64:             // Fall through.
@@ -577,14 +639,32 @@ void InstructionSelector::VisitWord32Xor(Node* node) {
 
 void InstructionSelector::VisitStackPointerGreaterThan(
     Node* node, FlagsContinuation* cont) {
-  Node* const value = node->InputAt(0);
-  InstructionCode opcode = kArchStackPointerGreaterThan;
+  StackCheckKind kind = StackCheckKindOf(node->op());
+  InstructionCode opcode =
+      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
 
-  DCHECK(cont->IsBranch());
-  const int effect_level =
-      GetEffectLevel(cont->true_block()->PredecessorAt(0)->control_input());
+  int effect_level = GetEffectLevel(node);
+  if (cont->IsBranch()) {
+    effect_level =
+        GetEffectLevel(cont->true_block()->PredecessorAt(0)->control_input());
+  }
 
   IA32OperandGenerator g(this);
+
+  // No outputs.
+  InstructionOperand* const outputs = nullptr;
+  const int output_count = 0;
+
+  // Applying an offset to this stack check requires a temp register. Offsets
+  // are only applied to the first stack check. If applying an offset, we must
+  // ensure the input and temp registers do not alias, thus kUniqueRegister.
+  InstructionOperand temps[] = {g.TempRegister()};
+  const int temp_count = (kind == StackCheckKind::kJSFunctionEntry) ? 1 : 0;
+  const auto register_mode = (kind == StackCheckKind::kJSFunctionEntry)
+                                 ? OperandGenerator::kUniqueRegister
+                                 : OperandGenerator::kRegister;
+
+  Node* const value = node->InputAt(0);
   if (g.CanBeMemoryOperand(kIA32Cmp, node, value, effect_level)) {
     DCHECK_EQ(IrOpcode::kLoad, value->opcode());
 
@@ -593,14 +673,18 @@ void InstructionSelector::VisitStackPointerGreaterThan(
 
     size_t input_count = 0;
     InstructionOperand inputs[kMaxInputCount];
-    AddressingMode addressing_mode =
-        g.GetEffectiveAddressMemoryOperand(value, inputs, &input_count);
+    AddressingMode addressing_mode = g.GetEffectiveAddressMemoryOperand(
+        value, inputs, &input_count, register_mode);
     opcode |= AddressingModeField::encode(addressing_mode);
     DCHECK_LE(input_count, kMaxInputCount);
 
-    EmitWithContinuation(opcode, 0, nullptr, input_count, inputs, cont);
+    EmitWithContinuation(opcode, output_count, outputs, input_count, inputs,
+                         temp_count, temps, cont);
   } else {
-    EmitWithContinuation(opcode, g.UseRegister(value), cont);
+    InstructionOperand inputs[] = {g.UseRegisterWithMode(value, register_mode)};
+    static constexpr int input_count = arraysize(inputs);
+    EmitWithContinuation(opcode, output_count, outputs, input_count, inputs,
+                         temp_count, temps, cont);
   }
 }
 
@@ -1430,23 +1514,22 @@ void VisitPairAtomicBinOp(InstructionSelector* selector, Node* node,
   InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
   Node* projection0 = NodeProperties::FindProjection(node, 0);
   Node* projection1 = NodeProperties::FindProjection(node, 1);
+  InstructionOperand outputs[2];
+  size_t output_count = 0;
+  InstructionOperand temps[2];
+  size_t temp_count = 0;
+  if (projection0) {
+    outputs[output_count++] = g.DefineAsFixed(projection0, eax);
+  } else {
+    temps[temp_count++] = g.TempRegister(eax);
+  }
   if (projection1) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, eax),
-                                    g.DefineAsFixed(projection1, edx)};
-    selector->Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
-                   0, {});
-  } else if (projection0) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, eax)};
-    InstructionOperand temps[] = {g.TempRegister(edx)};
-    const int num_temps = arraysize(temps);
-    selector->Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
-                   num_temps, temps);
+    outputs[output_count++] = g.DefineAsFixed(projection1, edx);
   } else {
-    InstructionOperand temps[] = {g.TempRegister(eax), g.TempRegister(edx)};
-    const int num_temps = arraysize(temps);
-    selector->Emit(code, 0, nullptr, arraysize(inputs), inputs, num_temps,
-                   temps);
+    temps[temp_count++] = g.TempRegister(edx);
   }
+  selector->Emit(code, output_count, outputs, arraysize(inputs), inputs,
+                 temp_count, temps);
 }
 
 }  // namespace
@@ -1826,28 +1909,33 @@ void InstructionSelector::VisitWord32AtomicPairLoad(Node* node) {
   AddressingMode mode;
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
-  InstructionOperand inputs[] = {g.UseUniqueRegister(base),
-                                 g.GetEffectiveIndexOperand(index, &mode)};
   Node* projection0 = NodeProperties::FindProjection(node, 0);
   Node* projection1 = NodeProperties::FindProjection(node, 1);
-  InstructionCode code =
-      kIA32Word32AtomicPairLoad | AddressingModeField::encode(mode);
-
-  if (projection1) {
+  if (projection0 && projection1) {
+    InstructionOperand inputs[] = {g.UseUniqueRegister(base),
+                                   g.GetEffectiveIndexOperand(index, &mode)};
+    InstructionCode code =
+        kIA32Word32AtomicPairLoad | AddressingModeField::encode(mode);
     InstructionOperand temps[] = {g.TempDoubleRegister()};
     InstructionOperand outputs[] = {g.DefineAsRegister(projection0),
                                     g.DefineAsRegister(projection1)};
-    Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
-         arraysize(temps), temps);
-  } else if (projection0) {
-    InstructionOperand temps[] = {g.TempDoubleRegister(), g.TempRegister()};
-    InstructionOperand outputs[] = {g.DefineAsRegister(projection0)};
-    Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
-         arraysize(temps), temps);
-  } else {
-    InstructionOperand temps[] = {g.TempDoubleRegister(), g.TempRegister(),
-                                  g.TempRegister()};
-    Emit(code, 0, nullptr, arraysize(inputs), inputs, arraysize(temps), temps);
+    Emit(code, 2, outputs, 2, inputs, 1, temps);
+  } else if (projection0 || projection1) {
+    // Only one word is needed, so it's enough to load just that.
+    ArchOpcode opcode = kIA32Movl;
+
+    InstructionOperand outputs[] = {
+        g.DefineAsRegister(projection0 ? projection0 : projection1)};
+    InstructionOperand inputs[3];
+    size_t input_count = 0;
+    // TODO(ahaas): Introduce an enum for {scale} instead of an integer.
+    // {scale = 0} means *1 in the generated code.
+    int scale = 0;
+    AddressingMode mode = g.GenerateMemoryOperandInputs(
+        index, scale, base, projection0 ? 0 : 4, kPositiveDisplacement, inputs,
+        &input_count);
+    InstructionCode code = opcode | AddressingModeField::encode(mode);
+    Emit(code, 1, outputs, input_count, inputs);
   }
 }
 
@@ -2004,6 +2092,12 @@ void InstructionSelector::VisitWord32AtomicPairCompareExchange(Node* node) {
   V(S128Or)                \
   V(S128Xor)
 
+#define SIMD_BINOP_UNIFIED_SSE_AVX_LIST(V) \
+  V(I64x2Add)                              \
+  V(I64x2Sub)                              \
+  V(I16x8RoundingAverageU)                 \
+  V(I8x16RoundingAverageU)
+
 #define SIMD_UNOP_LIST(V)   \
   V(F32x4SConvertI32x4)     \
   V(F32x4RecipApprox)       \
@@ -2044,6 +2138,10 @@ void InstructionSelector::VisitWord32AtomicPairCompareExchange(Node* node) {
   V(I16x8ShrS)                \
   V(I16x8ShrU)
 
+#define SIMD_SHIFT_OPCODES_UNIFED_SSE_AVX(V) \
+  V(I64x2Shl)                                \
+  V(I64x2ShrU)
+
 #define SIMD_I8X16_RIGHT_SHIFT_OPCODES(V) \
   V(I8x16ShrS)                            \
   V(I8x16ShrU)
@@ -2085,6 +2183,59 @@ void InstructionSelector::VisitF64x2ExtractLane(Node* node) {
   VisitRRISimd(this, node, kAVXF64x2ExtractLane, kSSEF64x2ExtractLane);
 }
 
+void InstructionSelector::VisitI64x2SplatI32Pair(Node* node) {
+  IA32OperandGenerator g(this);
+  InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
+  InstructionOperand operand1 = g.Use(node->InputAt(1));
+  Emit(kIA32I64x2SplatI32Pair, g.DefineAsRegister(node), operand0, operand1);
+}
+
+void InstructionSelector::VisitI64x2ReplaceLaneI32Pair(Node* node) {
+  IA32OperandGenerator g(this);
+  InstructionOperand operand = g.UseRegister(node->InputAt(0));
+  InstructionOperand lane = g.UseImmediate(OpParameter<int32_t>(node->op()));
+  InstructionOperand low = g.Use(node->InputAt(1));
+  InstructionOperand high = g.Use(node->InputAt(2));
+  Emit(kIA32I64x2ReplaceLaneI32Pair, g.DefineSameAsFirst(node), operand, lane,
+       low, high);
+}
+
+void InstructionSelector::VisitI64x2Neg(Node* node) {
+  IA32OperandGenerator g(this);
+  InstructionOperand operand0 = g.UseUnique(node->InputAt(0));
+  Emit(kIA32I64x2Neg, g.DefineAsRegister(node), operand0);
+}
+
+void InstructionSelector::VisitI64x2ShrS(Node* node) {
+  IA32OperandGenerator g(this);
+  InstructionOperand temps[] = {g.TempSimd128Register(),
+                                g.TempSimd128Register()};
+  if (IsSupported(AVX)) {
+    Emit(kIA32I64x2ShrS, g.DefineAsRegister(node),
+         g.UseUniqueRegister(node->InputAt(0)), g.Use(node->InputAt(1)),
+         arraysize(temps), temps);
+  } else {
+    Emit(kIA32I64x2ShrS, g.DefineSameAsFirst(node),
+         g.UseUniqueRegister(node->InputAt(0)), g.Use(node->InputAt(1)),
+         arraysize(temps), temps);
+  }
+}
+
+void InstructionSelector::VisitI64x2Mul(Node* node) {
+  IA32OperandGenerator g(this);
+  InstructionOperand temps[] = {g.TempSimd128Register(),
+                                g.TempSimd128Register()};
+  if (IsSupported(AVX)) {
+    Emit(kIA32I64x2Mul, g.DefineAsRegister(node),
+         g.UseUniqueRegister(node->InputAt(0)),
+         g.UseUniqueRegister(node->InputAt(1)), arraysize(temps), temps);
+  } else {
+    Emit(kIA32I64x2Mul, g.DefineSameAsFirst(node),
+         g.UseUniqueRegister(node->InputAt(0)),
+         g.UseUniqueRegister(node->InputAt(1)), arraysize(temps), temps);
+  }
+}
+
 void InstructionSelector::VisitF32x4Splat(Node* node) {
   VisitRRSimd(this, node, kAVXF32x4Splat, kSSEF32x4Splat);
 }
@@ -2142,6 +2293,13 @@ void InstructionSelector::VisitS128Select(Node* node) {
   }
 }
 
+void InstructionSelector::VisitS128AndNot(Node* node) {
+  IA32OperandGenerator g(this);
+  // andnps a b does ~a & b, but we want a & !b, so flip the input.
+  Emit(kIA32S128AndNot, g.DefineSameAsFirst(node),
+       g.UseRegister(node->InputAt(1)), g.UseRegister(node->InputAt(0)));
+}
+
 #define VISIT_SIMD_SPLAT(Type)                               \
   void InstructionSelector::Visit##Type##Splat(Node* node) { \
     VisitRO(this, node, kIA32##Type##Splat);                 \
@@ -2149,12 +2307,16 @@ void InstructionSelector::VisitS128Select(Node* node) {
 SIMD_INT_TYPES(VISIT_SIMD_SPLAT)
 #undef VISIT_SIMD_SPLAT
 
-#define VISIT_SIMD_EXTRACT_LANE(Type)                              \
-  void InstructionSelector::Visit##Type##ExtractLane(Node* node) { \
-    VisitRRISimd(this, node, kIA32##Type##ExtractLane);            \
+#define SIMD_VISIT_EXTRACT_LANE(Type, Sign)                              \
+  void InstructionSelector::Visit##Type##ExtractLane##Sign(Node* node) { \
+    VisitRRISimd(this, node, kIA32##Type##ExtractLane##Sign);            \
   }
-SIMD_INT_TYPES(VISIT_SIMD_EXTRACT_LANE)
-#undef VISIT_SIMD_EXTRACT_LANE
+SIMD_VISIT_EXTRACT_LANE(I32x4, )
+SIMD_VISIT_EXTRACT_LANE(I16x8, U)
+SIMD_VISIT_EXTRACT_LANE(I16x8, S)
+SIMD_VISIT_EXTRACT_LANE(I8x16, U)
+SIMD_VISIT_EXTRACT_LANE(I8x16, S)
+#undef SIMD_VISIT_EXTRACT_LANE
 
 #define VISIT_SIMD_REPLACE_LANE(Type)                                    \
   void InstructionSelector::Visit##Type##ReplaceLane(Node* node) {       \
@@ -2186,7 +2348,7 @@ VISIT_SIMD_REPLACE_LANE(F32x4)
     InstructionOperand operand0 = g.UseRegister(node->InputAt(0));       \
     InstructionOperand operand1 =                                        \
         g.UseImmediate(OpParameter<int32_t>(node->op()));                \
-    InstructionOperand operand2 = g.UseRegister(node->InputAt(1));       \
+    InstructionOperand operand2 = g.UseUniqueRegister(node->InputAt(1)); \
     if (IsSupported(AVX)) {                                              \
       Emit(kAVX##Type##ReplaceLane, g.DefineAsRegister(node), operand0,  \
            operand1, operand2);                                          \
@@ -2206,6 +2368,14 @@ SIMD_SHIFT_OPCODES(VISIT_SIMD_SHIFT)
 #undef VISIT_SIMD_SHIFT
 #undef SIMD_SHIFT_OPCODES
 
+#define VISIT_SIMD_SHIFT_UNIFIED_SSE_AVX(Opcode)                 \
+  void InstructionSelector::Visit##Opcode(Node* node) {          \
+    VisitRROSimdShift(this, node, kIA32##Opcode, kIA32##Opcode); \
+  }
+SIMD_SHIFT_OPCODES_UNIFED_SSE_AVX(VISIT_SIMD_SHIFT_UNIFIED_SSE_AVX)
+#undef VISIT_SIMD_SHIFT_UNIFIED_SSE_AVX
+#undef SIMD_SHIFT_OPCODES_UNIFED_SSE_AVX
+
 #define VISIT_SIMD_I8x16_RIGHT_SHIFT(Opcode)                \
   void InstructionSelector::Visit##Opcode(Node* node) {     \
     VisitRROI8x16SimdRightShift(this, node, kIA32##Opcode); \
@@ -2263,6 +2433,14 @@ SIMD_BINOP_LIST(VISIT_SIMD_BINOP)
 #undef VISIT_SIMD_BINOP
 #undef SIMD_BINOP_LIST
 
+#define VISIT_SIMD_BINOP_UNIFIED_SSE_AVX(Opcode)             \
+  void InstructionSelector::Visit##Opcode(Node* node) {      \
+    VisitRROFloat(this, node, kIA32##Opcode, kIA32##Opcode); \
+  }
+SIMD_BINOP_UNIFIED_SSE_AVX_LIST(VISIT_SIMD_BINOP_UNIFIED_SSE_AVX)
+#undef VISIT_SIMD_BINOP_UNIFIED_SSE_AVX
+#undef SIMD_BINOP_UNIFIED_SSE_AVX_LIST
+
 void VisitPack(InstructionSelector* selector, Node* node, ArchOpcode avx_opcode,
                ArchOpcode sse_opcode) {
   IA32OperandGenerator g(selector);
diff --git a/deps/v8/src/compiler/backend/instruction-codes.h b/deps/v8/src/compiler/backend/instruction-codes.h
index 589c1bda3b1509..23e4e44b768513 100644
--- a/deps/v8/src/compiler/backend/instruction-codes.h
+++ b/deps/v8/src/compiler/backend/instruction-codes.h
@@ -27,8 +27,8 @@
 #define TARGET_ARCH_OPCODE_LIST(V)
 #define TARGET_ADDRESSING_MODE_LIST(V)
 #endif
+#include "src/base/bit-field.h"
 #include "src/compiler/write-barrier-kind.h"
-#include "src/utils/utils.h"
 
 namespace v8 {
 namespace internal {
@@ -63,101 +63,105 @@ inline RecordWriteMode WriteBarrierKindToRecordWriteMode(
 
 // Target-specific opcodes that specify which assembly sequence to emit.
 // Most opcodes specify a single instruction.
-#define COMMON_ARCH_OPCODE_LIST(V)        \
-  V(ArchCallCodeObject)                   \
-  V(ArchTailCallCodeObjectFromJSFunction) \
-  V(ArchTailCallCodeObject)               \
-  V(ArchCallJSFunction)                   \
-  V(ArchTailCallAddress)                  \
-  V(ArchPrepareCallCFunction)             \
-  V(ArchSaveCallerRegisters)              \
-  V(ArchRestoreCallerRegisters)           \
-  V(ArchCallCFunction)                    \
-  V(ArchPrepareTailCall)                  \
-  V(ArchCallWasmFunction)                 \
-  V(ArchTailCallWasm)                     \
-  V(ArchCallBuiltinPointer)               \
-  V(ArchJmp)                              \
-  V(ArchBinarySearchSwitch)               \
-  V(ArchLookupSwitch)                     \
-  V(ArchTableSwitch)                      \
-  V(ArchNop)                              \
-  V(ArchAbortCSAAssert)                   \
-  V(ArchDebugBreak)                       \
-  V(ArchComment)                          \
-  V(ArchThrowTerminator)                  \
-  V(ArchDeoptimize)                       \
-  V(ArchRet)                              \
-  V(ArchFramePointer)                     \
-  V(ArchParentFramePointer)               \
-  V(ArchTruncateDoubleToI)                \
-  V(ArchStoreWithWriteBarrier)            \
-  V(ArchStackSlot)                        \
-  V(ArchWordPoisonOnSpeculation)          \
-  V(ArchStackPointerGreaterThan)          \
-  V(Word32AtomicLoadInt8)                 \
-  V(Word32AtomicLoadUint8)                \
-  V(Word32AtomicLoadInt16)                \
-  V(Word32AtomicLoadUint16)               \
-  V(Word32AtomicLoadWord32)               \
-  V(Word32AtomicStoreWord8)               \
-  V(Word32AtomicStoreWord16)              \
-  V(Word32AtomicStoreWord32)              \
-  V(Word32AtomicExchangeInt8)             \
-  V(Word32AtomicExchangeUint8)            \
-  V(Word32AtomicExchangeInt16)            \
-  V(Word32AtomicExchangeUint16)           \
-  V(Word32AtomicExchangeWord32)           \
-  V(Word32AtomicCompareExchangeInt8)      \
-  V(Word32AtomicCompareExchangeUint8)     \
-  V(Word32AtomicCompareExchangeInt16)     \
-  V(Word32AtomicCompareExchangeUint16)    \
-  V(Word32AtomicCompareExchangeWord32)    \
-  V(Word32AtomicAddInt8)                  \
-  V(Word32AtomicAddUint8)                 \
-  V(Word32AtomicAddInt16)                 \
-  V(Word32AtomicAddUint16)                \
-  V(Word32AtomicAddWord32)                \
-  V(Word32AtomicSubInt8)                  \
-  V(Word32AtomicSubUint8)                 \
-  V(Word32AtomicSubInt16)                 \
-  V(Word32AtomicSubUint16)                \
-  V(Word32AtomicSubWord32)                \
-  V(Word32AtomicAndInt8)                  \
-  V(Word32AtomicAndUint8)                 \
-  V(Word32AtomicAndInt16)                 \
-  V(Word32AtomicAndUint16)                \
-  V(Word32AtomicAndWord32)                \
-  V(Word32AtomicOrInt8)                   \
-  V(Word32AtomicOrUint8)                  \
-  V(Word32AtomicOrInt16)                  \
-  V(Word32AtomicOrUint16)                 \
-  V(Word32AtomicOrWord32)                 \
-  V(Word32AtomicXorInt8)                  \
-  V(Word32AtomicXorUint8)                 \
-  V(Word32AtomicXorInt16)                 \
-  V(Word32AtomicXorUint16)                \
-  V(Word32AtomicXorWord32)                \
-  V(Ieee754Float64Acos)                   \
-  V(Ieee754Float64Acosh)                  \
-  V(Ieee754Float64Asin)                   \
-  V(Ieee754Float64Asinh)                  \
-  V(Ieee754Float64Atan)                   \
-  V(Ieee754Float64Atanh)                  \
-  V(Ieee754Float64Atan2)                  \
-  V(Ieee754Float64Cbrt)                   \
-  V(Ieee754Float64Cos)                    \
-  V(Ieee754Float64Cosh)                   \
-  V(Ieee754Float64Exp)                    \
-  V(Ieee754Float64Expm1)                  \
-  V(Ieee754Float64Log)                    \
-  V(Ieee754Float64Log1p)                  \
-  V(Ieee754Float64Log10)                  \
-  V(Ieee754Float64Log2)                   \
-  V(Ieee754Float64Pow)                    \
-  V(Ieee754Float64Sin)                    \
-  V(Ieee754Float64Sinh)                   \
-  V(Ieee754Float64Tan)                    \
+#define COMMON_ARCH_OPCODE_LIST(V)                                     \
+  /* Tail call opcodes are grouped together to make IsTailCall fast */ \
+  V(ArchTailCallCodeObjectFromJSFunction)                              \
+  V(ArchTailCallCodeObject)                                            \
+  V(ArchTailCallAddress)                                               \
+  V(ArchTailCallWasm)                                                  \
+  /* Update IsTailCall if further TailCall opcodes are added */        \
+                                                                       \
+  V(ArchCallCodeObject)                                                \
+  V(ArchCallJSFunction)                                                \
+  V(ArchPrepareCallCFunction)                                          \
+  V(ArchSaveCallerRegisters)                                           \
+  V(ArchRestoreCallerRegisters)                                        \
+  V(ArchCallCFunction)                                                 \
+  V(ArchPrepareTailCall)                                               \
+  V(ArchCallWasmFunction)                                              \
+  V(ArchCallBuiltinPointer)                                            \
+  V(ArchJmp)                                                           \
+  V(ArchBinarySearchSwitch)                                            \
+  V(ArchLookupSwitch)                                                  \
+  V(ArchTableSwitch)                                                   \
+  V(ArchNop)                                                           \
+  V(ArchAbortCSAAssert)                                                \
+  V(ArchDebugBreak)                                                    \
+  V(ArchComment)                                                       \
+  V(ArchThrowTerminator)                                               \
+  V(ArchDeoptimize)                                                    \
+  V(ArchRet)                                                           \
+  V(ArchFramePointer)                                                  \
+  V(ArchParentFramePointer)                                            \
+  V(ArchTruncateDoubleToI)                                             \
+  V(ArchStoreWithWriteBarrier)                                         \
+  V(ArchStackSlot)                                                     \
+  V(ArchWordPoisonOnSpeculation)                                       \
+  V(ArchStackPointerGreaterThan)                                       \
+  V(ArchStackCheckOffset)                                              \
+  V(Word32AtomicLoadInt8)                                              \
+  V(Word32AtomicLoadUint8)                                             \
+  V(Word32AtomicLoadInt16)                                             \
+  V(Word32AtomicLoadUint16)                                            \
+  V(Word32AtomicLoadWord32)                                            \
+  V(Word32AtomicStoreWord8)                                            \
+  V(Word32AtomicStoreWord16)                                           \
+  V(Word32AtomicStoreWord32)                                           \
+  V(Word32AtomicExchangeInt8)                                          \
+  V(Word32AtomicExchangeUint8)                                         \
+  V(Word32AtomicExchangeInt16)                                         \
+  V(Word32AtomicExchangeUint16)                                        \
+  V(Word32AtomicExchangeWord32)                                        \
+  V(Word32AtomicCompareExchangeInt8)                                   \
+  V(Word32AtomicCompareExchangeUint8)                                  \
+  V(Word32AtomicCompareExchangeInt16)                                  \
+  V(Word32AtomicCompareExchangeUint16)                                 \
+  V(Word32AtomicCompareExchangeWord32)                                 \
+  V(Word32AtomicAddInt8)                                               \
+  V(Word32AtomicAddUint8)                                              \
+  V(Word32AtomicAddInt16)                                              \
+  V(Word32AtomicAddUint16)                                             \
+  V(Word32AtomicAddWord32)                                             \
+  V(Word32AtomicSubInt8)                                               \
+  V(Word32AtomicSubUint8)                                              \
+  V(Word32AtomicSubInt16)                                              \
+  V(Word32AtomicSubUint16)                                             \
+  V(Word32AtomicSubWord32)                                             \
+  V(Word32AtomicAndInt8)                                               \
+  V(Word32AtomicAndUint8)                                              \
+  V(Word32AtomicAndInt16)                                              \
+  V(Word32AtomicAndUint16)                                             \
+  V(Word32AtomicAndWord32)                                             \
+  V(Word32AtomicOrInt8)                                                \
+  V(Word32AtomicOrUint8)                                               \
+  V(Word32AtomicOrInt16)                                               \
+  V(Word32AtomicOrUint16)                                              \
+  V(Word32AtomicOrWord32)                                              \
+  V(Word32AtomicXorInt8)                                               \
+  V(Word32AtomicXorUint8)                                              \
+  V(Word32AtomicXorInt16)                                              \
+  V(Word32AtomicXorUint16)                                             \
+  V(Word32AtomicXorWord32)                                             \
+  V(Ieee754Float64Acos)                                                \
+  V(Ieee754Float64Acosh)                                               \
+  V(Ieee754Float64Asin)                                                \
+  V(Ieee754Float64Asinh)                                               \
+  V(Ieee754Float64Atan)                                                \
+  V(Ieee754Float64Atanh)                                               \
+  V(Ieee754Float64Atan2)                                               \
+  V(Ieee754Float64Cbrt)                                                \
+  V(Ieee754Float64Cos)                                                 \
+  V(Ieee754Float64Cosh)                                                \
+  V(Ieee754Float64Exp)                                                 \
+  V(Ieee754Float64Expm1)                                               \
+  V(Ieee754Float64Log)                                                 \
+  V(Ieee754Float64Log1p)                                               \
+  V(Ieee754Float64Log10)                                               \
+  V(Ieee754Float64Log2)                                                \
+  V(Ieee754Float64Pow)                                                 \
+  V(Ieee754Float64Sin)                                                 \
+  V(Ieee754Float64Sinh)                                                \
+  V(Ieee754Float64Tan)                                                 \
   V(Ieee754Float64Tanh)
 
 #define ARCH_OPCODE_LIST(V)  \
@@ -260,17 +264,17 @@ enum MemoryAccessMode {
 // what code to emit for an instruction in the code generator. It is not
 // interesting to the register allocator, as the inputs and flags on the
 // instructions specify everything of interest.
-using InstructionCode = int32_t;
+using InstructionCode = uint32_t;
 
 // Helpers for encoding / decoding InstructionCode into the fields needed
 // for code generation. We encode the instruction, addressing mode, and flags
 // continuation into a single InstructionCode which is stored as part of
 // the instruction.
-using ArchOpcodeField = BitField<ArchOpcode, 0, 9>;
-using AddressingModeField = BitField<AddressingMode, 9, 5>;
-using FlagsModeField = BitField<FlagsMode, 14, 3>;
-using FlagsConditionField = BitField<FlagsCondition, 17, 5>;
-using MiscField = BitField<int, 22, 10>;
+using ArchOpcodeField = base::BitField<ArchOpcode, 0, 9>;
+using AddressingModeField = base::BitField<AddressingMode, 9, 5>;
+using FlagsModeField = base::BitField<FlagsMode, 14, 3>;
+using FlagsConditionField = base::BitField<FlagsCondition, 17, 5>;
+using MiscField = base::BitField<int, 22, 10>;
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/backend/instruction-scheduler.cc b/deps/v8/src/compiler/backend/instruction-scheduler.cc
index d4920cd575ac1e..dd4bca4d819007 100644
--- a/deps/v8/src/compiler/backend/instruction-scheduler.cc
+++ b/deps/v8/src/compiler/backend/instruction-scheduler.cc
@@ -5,8 +5,8 @@
 #include "src/compiler/backend/instruction-scheduler.h"
 
 #include "src/base/iterator.h"
+#include "src/base/optional.h"
 #include "src/base/utils/random-number-generator.h"
-#include "src/execution/isolate.h"
 
 namespace v8 {
 namespace internal {
@@ -50,7 +50,7 @@ InstructionScheduler::StressSchedulerQueue::PopBestCandidate(int cycle) {
   DCHECK(!IsEmpty());
   // Choose a random element from the ready list.
   auto candidate = nodes_.begin();
-  std::advance(candidate, isolate()->random_number_generator()->NextInt(
+  std::advance(candidate, random_number_generator()->NextInt(
                               static_cast<int>(nodes_.size())));
   ScheduleGraphNode* result = *candidate;
   nodes_.erase(candidate);
@@ -81,7 +81,12 @@ InstructionScheduler::InstructionScheduler(Zone* zone,
       pending_loads_(zone),
       last_live_in_reg_marker_(nullptr),
       last_deopt_or_trap_(nullptr),
-      operands_map_(zone) {}
+      operands_map_(zone) {
+  if (FLAG_turbo_stress_instruction_scheduling) {
+    random_number_generator_ =
+        base::Optional<base::RandomNumberGenerator>(FLAG_random_seed);
+  }
+}
 
 void InstructionScheduler::StartBlock(RpoNumber rpo) {
   DCHECK(graph_.empty());
@@ -95,17 +100,11 @@ void InstructionScheduler::StartBlock(RpoNumber rpo) {
 
 void InstructionScheduler::EndBlock(RpoNumber rpo) {
   if (FLAG_turbo_stress_instruction_scheduling) {
-    ScheduleBlock<StressSchedulerQueue>();
+    Schedule<StressSchedulerQueue>();
   } else {
-    ScheduleBlock<CriticalPathFirstQueue>();
+    Schedule<CriticalPathFirstQueue>();
   }
   sequence()->EndBlock(rpo);
-  graph_.clear();
-  last_side_effect_instr_ = nullptr;
-  pending_loads_.clear();
-  last_live_in_reg_marker_ = nullptr;
-  last_deopt_or_trap_ = nullptr;
-  operands_map_.clear();
 }
 
 void InstructionScheduler::AddTerminator(Instruction* instr) {
@@ -119,6 +118,16 @@ void InstructionScheduler::AddTerminator(Instruction* instr) {
 }
 
 void InstructionScheduler::AddInstruction(Instruction* instr) {
+  if (IsBarrier(instr)) {
+    if (FLAG_turbo_stress_instruction_scheduling) {
+      Schedule<StressSchedulerQueue>();
+    } else {
+      Schedule<CriticalPathFirstQueue>();
+    }
+    sequence()->AddInstruction(instr);
+    return;
+  }
+
   ScheduleGraphNode* new_node = new (zone()) ScheduleGraphNode(zone(), instr);
 
   // We should not have branches in the middle of a block.
@@ -197,7 +206,7 @@ void InstructionScheduler::AddInstruction(Instruction* instr) {
 }
 
 template <typename QueueType>
-void InstructionScheduler::ScheduleBlock() {
+void InstructionScheduler::Schedule() {
   QueueType ready_list(this);
 
   // Compute total latencies so that we can schedule the critical path first.
@@ -231,11 +240,20 @@ void InstructionScheduler::ScheduleBlock() {
 
     cycle++;
   }
+
+  // Reset own state.
+  graph_.clear();
+  operands_map_.clear();
+  pending_loads_.clear();
+  last_deopt_or_trap_ = nullptr;
+  last_live_in_reg_marker_ = nullptr;
+  last_side_effect_instr_ = nullptr;
 }
 
 int InstructionScheduler::GetInstructionFlags(const Instruction* instr) const {
   switch (instr->arch_opcode()) {
     case kArchNop:
+    case kArchStackCheckOffset:
     case kArchFramePointer:
     case kArchParentFramePointer:
     case kArchStackSlot:  // Despite its name this opcode will produce a
@@ -287,22 +305,32 @@ int InstructionScheduler::GetInstructionFlags(const Instruction* instr) const {
       return kHasSideEffect;
 
     case kArchPrepareCallCFunction:
-    case kArchSaveCallerRegisters:
-    case kArchRestoreCallerRegisters:
     case kArchPrepareTailCall:
-    case kArchCallCFunction:
-    case kArchCallCodeObject:
-    case kArchCallJSFunction:
-    case kArchCallWasmFunction:
-    case kArchCallBuiltinPointer:
     case kArchTailCallCodeObjectFromJSFunction:
     case kArchTailCallCodeObject:
     case kArchTailCallAddress:
     case kArchTailCallWasm:
     case kArchAbortCSAAssert:
-    case kArchDebugBreak:
       return kHasSideEffect;
 
+    case kArchDebugBreak:
+      return kIsBarrier;
+
+    case kArchSaveCallerRegisters:
+    case kArchRestoreCallerRegisters:
+      return kIsBarrier;
+
+    case kArchCallCFunction:
+    case kArchCallCodeObject:
+    case kArchCallJSFunction:
+    case kArchCallWasmFunction:
+    case kArchCallBuiltinPointer:
+      // Calls can cause GC and GC may relocate objects. If a pure instruction
+      // operates on a tagged pointer that was cast to a word then it may be
+      // incorrect to move the instruction across the call. Hence we mark all
+      // (non-tail-)calls as barriers.
+      return kIsBarrier;
+
     case kArchStoreWithWriteBarrier:
       return kHasSideEffect;
 
diff --git a/deps/v8/src/compiler/backend/instruction-scheduler.h b/deps/v8/src/compiler/backend/instruction-scheduler.h
index b73c225c94c6b3..b63796b034d99e 100644
--- a/deps/v8/src/compiler/backend/instruction-scheduler.h
+++ b/deps/v8/src/compiler/backend/instruction-scheduler.h
@@ -5,10 +5,16 @@
 #ifndef V8_COMPILER_BACKEND_INSTRUCTION_SCHEDULER_H_
 #define V8_COMPILER_BACKEND_INSTRUCTION_SCHEDULER_H_
 
+#include "src/base/optional.h"
 #include "src/compiler/backend/instruction.h"
 #include "src/zone/zone-containers.h"
 
 namespace v8 {
+
+namespace base {
+class RandomNumberGenerator;
+}
+
 namespace internal {
 namespace compiler {
 
@@ -24,6 +30,9 @@ enum ArchOpcodeFlags {
                                  // instruction e.g. div on Intel platform which
                                  // will raise an exception when the divisor is
                                  // zero.
+  kIsBarrier = 8,  // The instruction can cause GC or it reads/writes registers
+                   // that are not explicitly given. Nothing can be reordered
+                   // across such an instruction.
 };
 
 class InstructionScheduler final : public ZoneObject {
@@ -46,7 +55,7 @@ class InstructionScheduler final : public ZoneObject {
    public:
     ScheduleGraphNode(Zone* zone, Instruction* instr);
 
-    // Mark the instruction represented by 'node' as a dependecy of this one.
+    // Mark the instruction represented by 'node' as a dependency of this one.
     // The current instruction will be registered as an unscheduled predecessor
     // of 'node' (i.e. it must be scheduled before 'node').
     void AddSuccessor(ScheduleGraphNode* node);
@@ -135,18 +144,24 @@ class InstructionScheduler final : public ZoneObject {
     ScheduleGraphNode* PopBestCandidate(int cycle);
 
    private:
-    Isolate* isolate() { return scheduler_->isolate(); }
+    base::RandomNumberGenerator* random_number_generator() {
+      return scheduler_->random_number_generator();
+    }
   };
 
   // Perform scheduling for the current block specifying the queue type to
   // use to determine the next best candidate.
   template <typename QueueType>
-  void ScheduleBlock();
+  void Schedule();
 
   // Return the scheduling properties of the given instruction.
   V8_EXPORT_PRIVATE int GetInstructionFlags(const Instruction* instr) const;
   int GetTargetInstructionFlags(const Instruction* instr) const;
 
+  bool IsBarrier(const Instruction* instr) const {
+    return (GetInstructionFlags(instr) & kIsBarrier) != 0;
+  }
+
   // Check whether the given instruction has side effects (e.g. function call,
   // memory store).
   bool HasSideEffect(const Instruction* instr) const {
@@ -193,7 +208,9 @@ class InstructionScheduler final : public ZoneObject {
 
   Zone* zone() { return zone_; }
   InstructionSequence* sequence() { return sequence_; }
-  Isolate* isolate() { return sequence()->isolate(); }
+  base::RandomNumberGenerator* random_number_generator() {
+    return &random_number_generator_.value();
+  }
 
   Zone* zone_;
   InstructionSequence* sequence_;
@@ -223,6 +240,8 @@ class InstructionScheduler final : public ZoneObject {
   // Keep track of definition points for virtual registers. This is used to
   // record operand dependencies in the scheduling graph.
   ZoneMap<int32_t, ScheduleGraphNode*> operands_map_;
+
+  base::Optional<base::RandomNumberGenerator> random_number_generator_;
 };
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/backend/instruction-selector-impl.h b/deps/v8/src/compiler/backend/instruction-selector-impl.h
index 13ea049eba401f..7569d1280aa898 100644
--- a/deps/v8/src/compiler/backend/instruction-selector-impl.h
+++ b/deps/v8/src/compiler/backend/instruction-selector-impl.h
@@ -241,6 +241,19 @@ class OperandGenerator {
                               UnallocatedOperand::USED_AT_START, vreg);
   }
 
+  // The kind of register generated for memory operands. kRegister is alive
+  // until the start of the operation, kUniqueRegister until the end.
+  enum RegisterMode {
+    kRegister,
+    kUniqueRegister,
+  };
+
+  InstructionOperand UseRegisterWithMode(Node* node,
+                                         RegisterMode register_mode) {
+    return register_mode == kRegister ? UseRegister(node)
+                                      : UseUniqueRegister(node);
+  }
+
   InstructionOperand TempDoubleRegister() {
     UnallocatedOperand op = UnallocatedOperand(
         UnallocatedOperand::MUST_HAVE_REGISTER,
@@ -333,7 +346,6 @@ class OperandGenerator {
           case MachineRepresentation::kTaggedSigned:
           case MachineRepresentation::kTaggedPointer:
           case MachineRepresentation::kCompressed:
-          case MachineRepresentation::kCompressedSigned:
           case MachineRepresentation::kCompressedPointer:
             return Constant(static_cast<int32_t>(0));
           case MachineRepresentation::kFloat64:
diff --git a/deps/v8/src/compiler/backend/instruction-selector.cc b/deps/v8/src/compiler/backend/instruction-selector.cc
index e165c6c6a9e93a..6c6db9f6d70aa4 100644
--- a/deps/v8/src/compiler/backend/instruction-selector.cc
+++ b/deps/v8/src/compiler/backend/instruction-selector.cc
@@ -26,7 +26,7 @@ InstructionSelector::InstructionSelector(
     InstructionSequence* sequence, Schedule* schedule,
     SourcePositionTable* source_positions, Frame* frame,
     EnableSwitchJumpTable enable_switch_jump_table, TickCounter* tick_counter,
-    size_t* max_unoptimized_frame_height,
+    size_t* max_unoptimized_frame_height, size_t* max_pushed_argument_count,
     SourcePositionMode source_position_mode, Features features,
     EnableScheduling enable_scheduling,
     EnableRootsRelativeAddressing enable_roots_relative_addressing,
@@ -42,6 +42,7 @@ InstructionSelector::InstructionSelector(
       instructions_(zone),
       continuation_inputs_(sequence->zone()),
       continuation_outputs_(sequence->zone()),
+      continuation_temps_(sequence->zone()),
       defined_(node_count, false, zone),
       used_(node_count, false, zone),
       effect_level_(node_count, 0, zone),
@@ -58,7 +59,8 @@ InstructionSelector::InstructionSelector(
       instr_origins_(sequence->zone()),
       trace_turbo_(trace_turbo),
       tick_counter_(tick_counter),
-      max_unoptimized_frame_height_(max_unoptimized_frame_height) {
+      max_unoptimized_frame_height_(max_unoptimized_frame_height),
+      max_pushed_argument_count_(max_pushed_argument_count) {
   DCHECK_EQ(*max_unoptimized_frame_height, 0);  // Caller-initialized.
 
   instructions_.reserve(node_count);
@@ -481,6 +483,7 @@ InstructionOperand OperandForDeopt(Isolate* isolate, OperandGenerator* g,
     case IrOpcode::kFloat64Constant:
     case IrOpcode::kDelayedStringConstant:
       return g->UseImmediate(input);
+    case IrOpcode::kCompressedHeapConstant:
     case IrOpcode::kHeapConstant: {
       if (!CanBeTaggedOrCompressedPointer(rep)) {
         // If we have inconsistent static and dynamic types, e.g. if we
@@ -723,6 +726,14 @@ Instruction* InstructionSelector::EmitWithContinuation(
 Instruction* InstructionSelector::EmitWithContinuation(
     InstructionCode opcode, size_t output_count, InstructionOperand* outputs,
     size_t input_count, InstructionOperand* inputs, FlagsContinuation* cont) {
+  return EmitWithContinuation(opcode, output_count, outputs, input_count,
+                              inputs, 0, nullptr, cont);
+}
+
+Instruction* InstructionSelector::EmitWithContinuation(
+    InstructionCode opcode, size_t output_count, InstructionOperand* outputs,
+    size_t input_count, InstructionOperand* inputs, size_t temp_count,
+    InstructionOperand* temps, FlagsContinuation* cont) {
   OperandGenerator g(this);
 
   opcode = cont->Encode(opcode);
@@ -737,6 +748,11 @@ Instruction* InstructionSelector::EmitWithContinuation(
     continuation_outputs_.push_back(outputs[i]);
   }
 
+  continuation_temps_.resize(0);
+  for (size_t i = 0; i < temp_count; i++) {
+    continuation_temps_.push_back(temps[i]);
+  }
+
   if (cont->IsBranch()) {
     continuation_inputs_.push_back(g.Label(cont->true_block()));
     continuation_inputs_.push_back(g.Label(cont->false_block()));
@@ -760,8 +776,10 @@ Instruction* InstructionSelector::EmitWithContinuation(
   size_t const emit_outputs_size = continuation_outputs_.size();
   auto* emit_outputs =
       emit_outputs_size ? &continuation_outputs_.front() : nullptr;
+  size_t const emit_temps_size = continuation_temps_.size();
+  auto* emit_temps = emit_temps_size ? &continuation_temps_.front() : nullptr;
   return Emit(opcode, emit_outputs_size, emit_outputs, emit_inputs_size,
-              emit_inputs, 0, nullptr);
+              emit_inputs, emit_temps_size, emit_temps);
 }
 
 void InstructionSelector::AppendDeoptimizeArguments(
@@ -905,7 +923,6 @@ void InstructionSelector::InitializeCallBuffer(Node* call, CallBuffer* buffer,
   bool call_code_immediate = (flags & kCallCodeImmediate) != 0;
   bool call_address_immediate = (flags & kCallAddressImmediate) != 0;
   bool call_use_fixed_target_reg = (flags & kCallFixedTargetRegister) != 0;
-  bool call_through_slot = (flags & kAllowCallThroughSlot) != 0;
   switch (buffer->descriptor->kind()) {
     case CallDescriptor::kCallCodeObject:
       // TODO(jgruber, v8:7449): The below is a hack to support tail-calls from
@@ -919,8 +936,7 @@ void InstructionSelector::InitializeCallBuffer(Node* call, CallBuffer* buffer,
               : call_use_fixed_target_reg
                     ? g.UseFixed(callee, kJavaScriptCallCodeStartRegister)
                     : is_tail_call ? g.UseUniqueRegister(callee)
-                                   : call_through_slot ? g.UseUniqueSlot(callee)
-                                                       : g.UseRegister(callee));
+                                   : g.UseRegister(callee));
       break;
     case CallDescriptor::kCallAddress:
       buffer->instruction_args.push_back(
@@ -1378,6 +1394,10 @@ void InstructionSelector::VisitNode(Node* node) {
       MarkAsRepresentation(type.representation(), node);
       return VisitLoad(node);
     }
+    case IrOpcode::kLoadTransform: {
+      MarkAsRepresentation(MachineRepresentation::kSimd128, node);
+      return VisitLoadTransform(node);
+    }
     case IrOpcode::kPoisonedLoad: {
       LoadRepresentation type = LoadRepresentationOf(node->op());
       MarkAsRepresentation(type.representation(), node);
@@ -1512,12 +1532,6 @@ void InstructionSelector::VisitNode(Node* node) {
     case IrOpcode::kBitcastWordToTaggedSigned:
       return MarkAsRepresentation(MachineRepresentation::kTaggedSigned, node),
              EmitIdentity(node);
-    case IrOpcode::kBitcastWord32ToCompressedSigned:
-      return MarkAsRepresentation(MachineRepresentation::kCompressedSigned,
-                                  node),
-             EmitIdentity(node);
-    case IrOpcode::kBitcastCompressedSignedToWord32:
-      return MarkAsWord32(node), EmitIdentity(node);
     case IrOpcode::kChangeFloat32ToFloat64:
       return MarkAsFloat64(node), VisitChangeFloat32ToFloat64(node);
     case IrOpcode::kChangeInt32ToFloat64:
@@ -1557,31 +1571,12 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsWord64(node), VisitTryTruncateFloat32ToUint64(node);
     case IrOpcode::kTryTruncateFloat64ToUint64:
       return MarkAsWord64(node), VisitTryTruncateFloat64ToUint64(node);
+    case IrOpcode::kBitcastWord32ToWord64:
+      return MarkAsWord64(node), VisitBitcastWord32ToWord64(node);
     case IrOpcode::kChangeInt32ToInt64:
       return MarkAsWord64(node), VisitChangeInt32ToInt64(node);
     case IrOpcode::kChangeUint32ToUint64:
       return MarkAsWord64(node), VisitChangeUint32ToUint64(node);
-// TODO(mips-team): Support compress pointers.
-#ifdef V8_COMPRESS_POINTERS
-    case IrOpcode::kChangeTaggedToCompressed:
-      return MarkAsCompressed(node), VisitChangeTaggedToCompressed(node);
-    case IrOpcode::kChangeTaggedPointerToCompressedPointer:
-      return MarkAsRepresentation(MachineRepresentation::kCompressedPointer,
-                                  node),
-             VisitChangeTaggedPointerToCompressedPointer(node);
-    case IrOpcode::kChangeTaggedSignedToCompressedSigned:
-      return MarkAsRepresentation(MachineRepresentation::kCompressedSigned,
-                                  node),
-             VisitChangeTaggedSignedToCompressedSigned(node);
-    case IrOpcode::kChangeCompressedToTagged:
-      return MarkAsTagged(node), VisitChangeCompressedToTagged(node);
-    case IrOpcode::kChangeCompressedPointerToTaggedPointer:
-      return MarkAsRepresentation(MachineRepresentation::kTaggedPointer, node),
-             VisitChangeCompressedPointerToTaggedPointer(node);
-    case IrOpcode::kChangeCompressedSignedToTaggedSigned:
-      return MarkAsRepresentation(MachineRepresentation::kTaggedSigned, node),
-             VisitChangeCompressedSignedToTaggedSigned(node);
-#endif
     case IrOpcode::kTruncateFloat64ToFloat32:
       return MarkAsFloat32(node), VisitTruncateFloat64ToFloat32(node);
     case IrOpcode::kTruncateFloat64ToWord32:
@@ -1738,6 +1733,8 @@ void InstructionSelector::VisitNode(Node* node) {
       return VisitStackSlot(node);
     case IrOpcode::kStackPointerGreaterThan:
       return VisitStackPointerGreaterThan(node);
+    case IrOpcode::kLoadStackCheckOffset:
+      return VisitLoadStackCheckOffset(node);
     case IrOpcode::kLoadFramePointer:
       return VisitLoadFramePointer(node);
     case IrOpcode::kLoadParentFramePointer:
@@ -1933,10 +1930,14 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsSimd128(node), VisitF32x4Qfms(node);
     case IrOpcode::kI64x2Splat:
       return MarkAsSimd128(node), VisitI64x2Splat(node);
+    case IrOpcode::kI64x2SplatI32Pair:
+      return MarkAsSimd128(node), VisitI64x2SplatI32Pair(node);
     case IrOpcode::kI64x2ExtractLane:
       return MarkAsWord64(node), VisitI64x2ExtractLane(node);
     case IrOpcode::kI64x2ReplaceLane:
       return MarkAsSimd128(node), VisitI64x2ReplaceLane(node);
+    case IrOpcode::kI64x2ReplaceLaneI32Pair:
+      return MarkAsSimd128(node), VisitI64x2ReplaceLaneI32Pair(node);
     case IrOpcode::kI64x2Neg:
       return MarkAsSimd128(node), VisitI64x2Neg(node);
     case IrOpcode::kI64x2Shl:
@@ -2027,8 +2028,10 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsSimd128(node), VisitI32x4GeU(node);
     case IrOpcode::kI16x8Splat:
       return MarkAsSimd128(node), VisitI16x8Splat(node);
-    case IrOpcode::kI16x8ExtractLane:
-      return MarkAsWord32(node), VisitI16x8ExtractLane(node);
+    case IrOpcode::kI16x8ExtractLaneU:
+      return MarkAsWord32(node), VisitI16x8ExtractLaneU(node);
+    case IrOpcode::kI16x8ExtractLaneS:
+      return MarkAsWord32(node), VisitI16x8ExtractLaneS(node);
     case IrOpcode::kI16x8ReplaceLane:
       return MarkAsSimd128(node), VisitI16x8ReplaceLane(node);
     case IrOpcode::kI16x8SConvertI8x16Low:
@@ -2087,10 +2090,14 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsSimd128(node), VisitI16x8GtU(node);
     case IrOpcode::kI16x8GeU:
       return MarkAsSimd128(node), VisitI16x8GeU(node);
+    case IrOpcode::kI16x8RoundingAverageU:
+      return MarkAsSimd128(node), VisitI16x8RoundingAverageU(node);
     case IrOpcode::kI8x16Splat:
       return MarkAsSimd128(node), VisitI8x16Splat(node);
-    case IrOpcode::kI8x16ExtractLane:
-      return MarkAsWord32(node), VisitI8x16ExtractLane(node);
+    case IrOpcode::kI8x16ExtractLaneU:
+      return MarkAsWord32(node), VisitI8x16ExtractLaneU(node);
+    case IrOpcode::kI8x16ExtractLaneS:
+      return MarkAsWord32(node), VisitI8x16ExtractLaneS(node);
     case IrOpcode::kI8x16ReplaceLane:
       return MarkAsSimd128(node), VisitI8x16ReplaceLane(node);
     case IrOpcode::kI8x16Neg:
@@ -2139,6 +2146,8 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsSimd128(node), VisitI8x16GtU(node);
     case IrOpcode::kI8x16GeU:
       return MarkAsSimd128(node), VisitI8x16GeU(node);
+    case IrOpcode::kI8x16RoundingAverageU:
+      return MarkAsSimd128(node), VisitI8x16RoundingAverageU(node);
     case IrOpcode::kS128Zero:
       return MarkAsSimd128(node), VisitS128Zero(node);
     case IrOpcode::kS128And:
@@ -2151,6 +2160,8 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsSimd128(node), VisitS128Not(node);
     case IrOpcode::kS128Select:
       return MarkAsSimd128(node), VisitS128Select(node);
+    case IrOpcode::kS128AndNot:
+      return MarkAsSimd128(node), VisitS128AndNot(node);
     case IrOpcode::kS8x16Swizzle:
       return MarkAsSimd128(node), VisitS8x16Swizzle(node);
     case IrOpcode::kS8x16Shuffle:
@@ -2208,6 +2219,11 @@ void InstructionSelector::VisitStackPointerGreaterThan(Node* node) {
   VisitStackPointerGreaterThan(node, &cont);
 }
 
+void InstructionSelector::VisitLoadStackCheckOffset(Node* node) {
+  OperandGenerator g(this);
+  Emit(kArchStackCheckOffset, g.DefineAsRegister(node));
+}
+
 void InstructionSelector::VisitLoadFramePointer(Node* node) {
   OperandGenerator g(this);
   Emit(kArchFramePointer, g.DefineAsRegister(node));
@@ -2428,48 +2444,21 @@ void InstructionSelector::VisitUint64LessThanOrEqual(Node* node) {
 
 void InstructionSelector::VisitUint64Mod(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitChangeInt32ToInt64(Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeInt64ToFloat64(Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeUint32ToUint64(Node* node) {
-  UNIMPLEMENTED();
-}
-
-// TODO(mips-team): Support compress pointers.
-#ifdef V8_COMPRESS_POINTERS
-void InstructionSelector::VisitChangeTaggedToCompressed(Node* node) {
+void InstructionSelector::VisitBitcastWord32ToWord64(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitChangeTaggedPointerToCompressedPointer(
-    Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeTaggedSignedToCompressedSigned(
-    Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeCompressedToTagged(Node* node) {
+void InstructionSelector::VisitChangeInt32ToInt64(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitChangeCompressedPointerToTaggedPointer(
-    Node* node) {
+void InstructionSelector::VisitChangeInt64ToFloat64(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitChangeCompressedSignedToTaggedSigned(
-    Node* node) {
+void InstructionSelector::VisitChangeUint32ToUint64(Node* node) {
   UNIMPLEMENTED();
 }
-#endif
 
 void InstructionSelector::VisitChangeFloat64ToInt64(Node* node) {
   UNIMPLEMENTED();
@@ -2621,39 +2610,23 @@ void InstructionSelector::VisitWord64AtomicCompareExchange(Node* node) {
 #endif  // !V8_TARGET_ARCH_X64 && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_PPC
         // !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_S390
 
+#if !V8_TARGET_ARCH_IA32 && !V8_TARGET_ARCH_ARM
+// This is only needed on 32-bit to split the 64-bit value into two operands.
+void InstructionSelector::VisitI64x2SplatI32Pair(Node* node) {
+  UNIMPLEMENTED();
+}
+void InstructionSelector::VisitI64x2ReplaceLaneI32Pair(Node* node) {
+  UNIMPLEMENTED();
+}
+#endif  // !V8_TARGET_ARCH_IA32
+
 #if !V8_TARGET_ARCH_X64
 #if !V8_TARGET_ARCH_ARM64
-#if !V8_TARGET_ARCH_IA32
-void InstructionSelector::VisitF64x2Splat(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2ExtractLane(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2ReplaceLane(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2Abs(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2Neg(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2Sqrt(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitS8x16Swizzle(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2Add(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2Sub(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2Mul(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2Div(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2Eq(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2Ne(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2Lt(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2Le(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2Min(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitF64x2Max(Node* node) { UNIMPLEMENTED(); }
-#endif  // !V8_TARGET_ARCH_IA32
 void InstructionSelector::VisitI64x2Splat(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2ExtractLane(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2ReplaceLane(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitI64x2Neg(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitI64x2Shl(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitI64x2ShrS(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitI64x2Add(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitI64x2Sub(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitI64x2Mul(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2Eq(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2Ne(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitI64x2ShrU(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2GtS(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2GeS(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2GtU(Node* node) { UNIMPLEMENTED(); }
@@ -2762,13 +2735,19 @@ void InstructionSelector::VisitConstant(Node* node) {
   Emit(kArchNop, g.DefineAsConstant(node));
 }
 
+void InstructionSelector::UpdateMaxPushedArgumentCount(size_t count) {
+  *max_pushed_argument_count_ = std::max(count, *max_pushed_argument_count_);
+}
+
 void InstructionSelector::VisitCall(Node* node, BasicBlock* handler) {
   OperandGenerator g(this);
   auto call_descriptor = CallDescriptorOf(node->op());
 
   if (call_descriptor->NeedsCallerSavedRegisters()) {
-    Emit(kArchSaveCallerRegisters | MiscField::encode(static_cast<int>(
-                                        call_descriptor->get_save_fp_mode())),
+    SaveFPRegsMode mode = call_descriptor->NeedsCallerSavedFPRegisters()
+                              ? kSaveFPRegs
+                              : kDontSaveFPRegs;
+    Emit(kArchSaveCallerRegisters | MiscField::encode(static_cast<int>(mode)),
          g.NoOutput());
   }
 
@@ -2787,18 +2766,10 @@ void InstructionSelector::VisitCall(Node* node, BasicBlock* handler) {
   // Improve constant pool and the heuristics in the register allocator
   // for where to emit constants.
   CallBufferFlags call_buffer_flags(kCallCodeImmediate | kCallAddressImmediate);
-  if (flags & CallDescriptor::kAllowCallThroughSlot) {
-    // TODO(v8:6666): Remove kAllowCallThroughSlot and use a pc-relative call
-    // instead once builtins are embedded in every build configuration.
-    call_buffer_flags |= kAllowCallThroughSlot;
-#ifndef V8_TARGET_ARCH_32_BIT
-    // kAllowCallThroughSlot is only supported on ia32.
-    UNREACHABLE();
-#endif
-  }
   InitializeCallBuffer(node, &buffer, call_buffer_flags, false);
 
-  EmitPrepareArguments(&(buffer.pushed_nodes), call_descriptor, node);
+  EmitPrepareArguments(&buffer.pushed_nodes, call_descriptor, node);
+  UpdateMaxPushedArgumentCount(buffer.pushed_nodes.size());
 
   // Pass label of exception handler block.
   if (handler) {
@@ -2815,8 +2786,9 @@ void InstructionSelector::VisitCall(Node* node, BasicBlock* handler) {
 #if defined(_AIX)
       // Highest misc_field bit is used on AIX to indicate if a CFunction call
       // has function descriptor or not.
-      misc_field |= call_descriptor->HasFunctionDescriptor()
-                    << kHasFunctionDescriptorBitShift;
+      if (!call_descriptor->NoFunctionDescriptor()) {
+        misc_field |= 1 << kHasFunctionDescriptorBitShift;
+      }
 #endif
       opcode = kArchCallCFunction | MiscField::encode(misc_field);
       break;
@@ -2849,10 +2821,12 @@ void InstructionSelector::VisitCall(Node* node, BasicBlock* handler) {
   EmitPrepareResults(&(buffer.output_nodes), call_descriptor, node);
 
   if (call_descriptor->NeedsCallerSavedRegisters()) {
-    Emit(kArchRestoreCallerRegisters |
-             MiscField::encode(
-                 static_cast<int>(call_descriptor->get_save_fp_mode())),
-         g.NoOutput());
+    SaveFPRegsMode mode = call_descriptor->NeedsCallerSavedFPRegisters()
+                              ? kSaveFPRegs
+                              : kDontSaveFPRegs;
+    Emit(
+        kArchRestoreCallerRegisters | MiscField::encode(static_cast<int>(mode)),
+        g.NoOutput());
   }
 }
 
@@ -2874,8 +2848,8 @@ void InstructionSelector::VisitTailCall(Node* node) {
   if (callee->flags() & CallDescriptor::kFixedTargetRegister) {
     flags |= kCallFixedTargetRegister;
   }
-  DCHECK_EQ(callee->flags() & CallDescriptor::kAllowCallThroughSlot, 0);
   InitializeCallBuffer(node, &buffer, flags, true, stack_param_delta);
+  UpdateMaxPushedArgumentCount(stack_param_delta);
 
   // Select the appropriate opcode based on the call type.
   InstructionCode opcode;
@@ -3163,7 +3137,7 @@ void InstructionSelector::CanonicalizeShuffle(bool inputs_equal,
 void InstructionSelector::CanonicalizeShuffle(Node* node, uint8_t* shuffle,
                                               bool* is_swizzle) {
   // Get raw shuffle indices.
-  memcpy(shuffle, S8x16ShuffleOf(node->op()), kSimd128Size);
+  memcpy(shuffle, S8x16ShuffleParameterOf(node->op()).data(), kSimd128Size);
   bool needs_swap;
   bool inputs_equal = GetVirtualRegister(node->InputAt(0)) ==
                       GetVirtualRegister(node->InputAt(1));
diff --git a/deps/v8/src/compiler/backend/instruction-selector.h b/deps/v8/src/compiler/backend/instruction-selector.h
index e951c90f953f04..a142993ef2d471 100644
--- a/deps/v8/src/compiler/backend/instruction-selector.h
+++ b/deps/v8/src/compiler/backend/instruction-selector.h
@@ -271,7 +271,7 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
       InstructionSequence* sequence, Schedule* schedule,
       SourcePositionTable* source_positions, Frame* frame,
       EnableSwitchJumpTable enable_switch_jump_table, TickCounter* tick_counter,
-      size_t* max_unoptimized_frame_height,
+      size_t* max_unoptimized_frame_height, size_t* max_pushed_argument_count,
       SourcePositionMode source_position_mode = kCallSourcePositions,
       Features features = SupportedFeatures(),
       EnableScheduling enable_scheduling = FLAG_turbo_instruction_scheduling
@@ -346,6 +346,10 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
                                     size_t input_count,
                                     InstructionOperand* inputs,
                                     FlagsContinuation* cont);
+  Instruction* EmitWithContinuation(
+      InstructionCode opcode, size_t output_count, InstructionOperand* outputs,
+      size_t input_count, InstructionOperand* inputs, size_t temp_count,
+      InstructionOperand* temps, FlagsContinuation* cont);
 
   // ===========================================================================
   // ===== Architecture-independent deoptimization exit emission methods. ======
@@ -559,8 +563,7 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
     kCallCodeImmediate = 1u << 0,
     kCallAddressImmediate = 1u << 1,
     kCallTail = 1u << 2,
-    kCallFixedTargetRegister = 1u << 3,
-    kAllowCallThroughSlot = 1u << 4
+    kCallFixedTargetRegister = 1u << 3
   };
   using CallBufferFlags = base::Flags<CallBufferFlag>;
 
@@ -575,6 +578,8 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   bool IsTailCallAddressImmediate();
   int GetTempsCountForTailCallFromJSFunction();
 
+  void UpdateMaxPushedArgumentCount(size_t count);
+
   FrameStateDescriptor* GetFrameStateDescriptor(Node* node);
   size_t AddInputsToFrameStateDescriptor(FrameStateDescriptor* descriptor,
                                          Node* state, OperandGenerator* g,
@@ -613,6 +618,7 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
 
   // Visit the load node with a value and opcode to replace with.
   void VisitLoad(Node* node, Node* value, InstructionCode opcode);
+  void VisitLoadTransform(Node* node, Node* value, InstructionCode opcode);
   void VisitFinishRegion(Node* node);
   void VisitParameter(Node* node);
   void VisitIfException(Node* node);
@@ -766,6 +772,7 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   ZoneVector<Instruction*> instructions_;
   InstructionOperandVector continuation_inputs_;
   InstructionOperandVector continuation_outputs_;
+  InstructionOperandVector continuation_temps_;
   BoolVector defined_;
   BoolVector used_;
   IntVector effect_level_;
@@ -783,9 +790,10 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   EnableTraceTurboJson trace_turbo_;
   TickCounter* const tick_counter_;
 
-  // Store the maximal unoptimized frame height. Later used to apply an offset
-  // to stack checks.
+  // Store the maximal unoptimized frame height and an maximal number of pushed
+  // arguments (for calls). Later used to apply an offset to stack checks.
   size_t* max_unoptimized_frame_height_;
+  size_t* max_pushed_argument_count_;
 };
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/backend/instruction.cc b/deps/v8/src/compiler/backend/instruction.cc
index 076f1b596e2859..f4c09a7cf47a51 100644
--- a/deps/v8/src/compiler/backend/instruction.cc
+++ b/deps/v8/src/compiler/backend/instruction.cc
@@ -11,9 +11,10 @@
 #include "src/codegen/source-position.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/graph.h"
+#include "src/compiler/node.h"
 #include "src/compiler/schedule.h"
-#include "src/compiler/state-values-utils.h"
 #include "src/execution/frames.h"
+#include "src/utils/ostreams.h"
 
 namespace v8 {
 namespace internal {
@@ -228,9 +229,6 @@ std::ostream& operator<<(std::ostream& os, const InstructionOperand& op) {
         case MachineRepresentation::kTagged:
           os << "|t";
           break;
-        case MachineRepresentation::kCompressedSigned:
-          os << "|cs";
-          break;
         case MachineRepresentation::kCompressedPointer:
           os << "|cp";
           break;
@@ -892,7 +890,6 @@ static MachineRepresentation FilterRepresentation(MachineRepresentation rep) {
     case MachineRepresentation::kFloat32:
     case MachineRepresentation::kFloat64:
     case MachineRepresentation::kSimd128:
-    case MachineRepresentation::kCompressedSigned:
     case MachineRepresentation::kCompressedPointer:
     case MachineRepresentation::kCompressed:
       return rep;
diff --git a/deps/v8/src/compiler/backend/instruction.h b/deps/v8/src/compiler/backend/instruction.h
index 462b0daf6b9c72..92fa95270cca17 100644
--- a/deps/v8/src/compiler/backend/instruction.h
+++ b/deps/v8/src/compiler/backend/instruction.h
@@ -125,7 +125,7 @@ class V8_EXPORT_PRIVATE InstructionOperand {
 
   inline uint64_t GetCanonicalizedValue() const;
 
-  using KindField = BitField64<Kind, 0, 3>;
+  using KindField = base::BitField64<Kind, 0, 3>;
 
   uint64_t value_;
 };
@@ -322,24 +322,24 @@ class UnallocatedOperand final : public InstructionOperand {
   //     P ... Policy
   //
   // The slot index is a signed value which requires us to decode it manually
-  // instead of using the BitField utility class.
+  // instead of using the base::BitField utility class.
 
   STATIC_ASSERT(KindField::kSize == 3);
 
-  using VirtualRegisterField = BitField64<uint32_t, 3, 32>;
+  using VirtualRegisterField = base::BitField64<uint32_t, 3, 32>;
 
-  // BitFields for all unallocated operands.
-  using BasicPolicyField = BitField64<BasicPolicy, 35, 1>;
+  // base::BitFields for all unallocated operands.
+  using BasicPolicyField = base::BitField64<BasicPolicy, 35, 1>;
 
   // BitFields specific to BasicPolicy::FIXED_SLOT.
-  using FixedSlotIndexField = BitField64<int, 36, 28>;
+  using FixedSlotIndexField = base::BitField64<int, 36, 28>;
 
   // BitFields specific to BasicPolicy::EXTENDED_POLICY.
-  using ExtendedPolicyField = BitField64<ExtendedPolicy, 36, 3>;
-  using LifetimeField = BitField64<Lifetime, 39, 1>;
-  using HasSecondaryStorageField = BitField64<bool, 40, 1>;
-  using FixedRegisterField = BitField64<int, 41, 6>;
-  using SecondaryStorageField = BitField64<int, 47, 3>;
+  using ExtendedPolicyField = base::BitField64<ExtendedPolicy, 36, 3>;
+  using LifetimeField = base::BitField64<Lifetime, 39, 1>;
+  using HasSecondaryStorageField = base::BitField64<bool, 40, 1>;
+  using FixedRegisterField = base::BitField64<int, 41, 6>;
+  using SecondaryStorageField = base::BitField64<int, 47, 3>;
 
  private:
   explicit UnallocatedOperand(int virtual_register)
@@ -368,7 +368,7 @@ class ConstantOperand : public InstructionOperand {
   INSTRUCTION_OPERAND_CASTS(ConstantOperand, CONSTANT)
 
   STATIC_ASSERT(KindField::kSize == 3);
-  using VirtualRegisterField = BitField64<uint32_t, 3, 32>;
+  using VirtualRegisterField = base::BitField64<uint32_t, 3, 32>;
 };
 
 class ImmediateOperand : public InstructionOperand {
@@ -401,8 +401,8 @@ class ImmediateOperand : public InstructionOperand {
   INSTRUCTION_OPERAND_CASTS(ImmediateOperand, IMMEDIATE)
 
   STATIC_ASSERT(KindField::kSize == 3);
-  using TypeField = BitField64<ImmediateType, 3, 1>;
-  using ValueField = BitField64<int32_t, 32, 32>;
+  using TypeField = base::BitField64<ImmediateType, 3, 1>;
+  using ValueField = base::BitField64<int32_t, 32, 32>;
 };
 
 class LocationOperand : public InstructionOperand {
@@ -472,7 +472,6 @@ class LocationOperand : public InstructionOperand {
       case MachineRepresentation::kTaggedSigned:
       case MachineRepresentation::kTaggedPointer:
       case MachineRepresentation::kTagged:
-      case MachineRepresentation::kCompressedSigned:
       case MachineRepresentation::kCompressedPointer:
       case MachineRepresentation::kCompressed:
         return true;
@@ -504,9 +503,9 @@ class LocationOperand : public InstructionOperand {
   }
 
   STATIC_ASSERT(KindField::kSize == 3);
-  using LocationKindField = BitField64<LocationKind, 3, 2>;
-  using RepresentationField = BitField64<MachineRepresentation, 5, 8>;
-  using IndexField = BitField64<int32_t, 35, 29>;
+  using LocationKindField = base::BitField64<LocationKind, 3, 2>;
+  using RepresentationField = base::BitField64<MachineRepresentation, 5, 8>;
+  using IndexField = base::BitField64<int32_t, 35, 29>;
 };
 
 class AllocatedOperand : public LocationOperand {
@@ -807,12 +806,10 @@ class V8_EXPORT_PRIVATE Instruction final {
                           size_t output_count, InstructionOperand* outputs,
                           size_t input_count, InstructionOperand* inputs,
                           size_t temp_count, InstructionOperand* temps) {
-    // TODO(9872)
-    // DCHECK_LE(0, opcode);
     DCHECK(output_count == 0 || outputs != nullptr);
     DCHECK(input_count == 0 || inputs != nullptr);
     DCHECK(temp_count == 0 || temps != nullptr);
-    // TODO(jarin/mstarzinger): Handle this gracefully. See crbug.com/582702.
+    // TODO(turbofan): Handle this gracefully. See crbug.com/582702.
     CHECK(InputCountField::is_valid(input_count));
 
     size_t total_extra_ops = output_count + input_count + temp_count;
@@ -864,10 +861,7 @@ class V8_EXPORT_PRIVATE Instruction final {
   bool IsJump() const { return arch_opcode() == ArchOpcode::kArchJmp; }
   bool IsRet() const { return arch_opcode() == ArchOpcode::kArchRet; }
   bool IsTailCall() const {
-    return arch_opcode() == ArchOpcode::kArchTailCallCodeObject ||
-           arch_opcode() == ArchOpcode::kArchTailCallCodeObjectFromJSFunction ||
-           arch_opcode() == ArchOpcode::kArchTailCallAddress ||
-           arch_opcode() == ArchOpcode::kArchTailCallWasm;
+    return arch_opcode() <= ArchOpcode::kArchTailCallWasm;
   }
   bool IsThrow() const {
     return arch_opcode() == ArchOpcode::kArchThrowTerminator;
@@ -912,9 +906,9 @@ class V8_EXPORT_PRIVATE Instruction final {
   // APIs to aid debugging. For general-stream APIs, use operator<<.
   void Print() const;
 
-  using OutputCountField = BitField<size_t, 0, 8>;
-  using InputCountField = BitField<size_t, 8, 16>;
-  using TempCountField = BitField<size_t, 24, 6>;
+  using OutputCountField = base::BitField<size_t, 0, 8>;
+  using InputCountField = base::BitField<size_t, 8, 16>;
+  using TempCountField = base::BitField<size_t, 24, 6>;
 
   static const size_t kMaxOutputCount = OutputCountField::kMax;
   static const size_t kMaxInputCount = InputCountField::kMax;
@@ -928,7 +922,7 @@ class V8_EXPORT_PRIVATE Instruction final {
               InstructionOperand* inputs, size_t temp_count,
               InstructionOperand* temps);
 
-  using IsCallField = BitField<bool, 30, 1>;
+  using IsCallField = base::BitField<bool, 30, 1>;
 
   InstructionCode opcode_;
   uint32_t bit_field_;
@@ -1421,7 +1415,7 @@ class V8_EXPORT_PRIVATE InstructionBlock final
   const RpoNumber loop_end_;
   int32_t code_start_;   // start index of arch-specific code.
   int32_t code_end_ = -1;     // end index of arch-specific code.
-  const bool deferred_ = -1;  // Block contains deferred code.
+  const bool deferred_;       // Block contains deferred code.
   const bool handler_;   // Block is a handler entry point.
   bool switch_target_ = false;
   bool alignment_ = false;  // insert alignment before this block
diff --git a/deps/v8/src/compiler/backend/mips/code-generator-mips.cc b/deps/v8/src/compiler/backend/mips/code-generator-mips.cc
index ee23402e69bf38..dd35d47dc41cd1 100644
--- a/deps/v8/src/compiler/backend/mips/code-generator-mips.cc
+++ b/deps/v8/src/compiler/backend/mips/code-generator-mips.cc
@@ -179,7 +179,7 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
       // Just encode the stub index. This will be patched when the code
       // is added to the native module and copied into wasm code space.
       __ CallRecordWriteStub(object_, scratch1_, remembered_set_action,
-                             save_fp_mode, wasm::WasmCode::kWasmRecordWrite);
+                             save_fp_mode, wasm::WasmCode::kRecordWrite);
     } else {
       __ CallRecordWriteStub(object_, scratch1_, remembered_set_action,
                              save_fp_mode);
@@ -519,6 +519,12 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
     __ MovFromFloatResult(i.OutputDoubleRegister());                        \
   } while (0)
 
+#define ASSEMBLE_F64X2_ARITHMETIC_BINOP(op)                     \
+  do {                                                          \
+    __ op(i.OutputSimd128Register(), i.InputSimd128Register(0), \
+          i.InputSimd128Register(1));                           \
+  } while (0)
+
 void CodeGenerator::AssembleDeconstructFrame() {
   __ mov(sp, fp);
   __ Pop(ra, fp);
@@ -551,9 +557,7 @@ void CodeGenerator::AssemblePopArgumentsAdaptorFrame(Register args_reg,
         MemOperand(fp, ArgumentsAdaptorFrameConstants::kLengthOffset));
   __ SmiUntag(caller_args_count_reg);
 
-  ParameterCount callee_args_count(args_reg);
-  __ PrepareForTailCall(callee_args_count, caller_args_count_reg, scratch2,
-                        scratch3);
+  __ PrepareForTailCall(args_reg, caller_args_count_reg, scratch2, scratch3);
   __ bind(&done);
 }
 
@@ -808,9 +812,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       if (isWasmCapiFunction) {
         CHECK_EQ(offset, __ SizeOfCodeGeneratedSince(&start_call));
+        RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
       }
 
-      RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
       frame_access_state()->SetFrameAccessToDefault();
       // Ideally, we should decrement SP delta to match the change of stack
       // pointer in CallCFunction. However, for certain architectures (e.g.
@@ -877,6 +881,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchStackPointerGreaterThan:
       // Pseudo-instruction used for cmp/branch. No opcode emitted here.
       break;
+    case kArchStackCheckOffset:
+      __ Move(i.OutputRegister(), Smi::FromInt(GetStackCheckOffset()));
+      break;
     case kArchFramePointer:
       __ mov(i.OutputRegister(), fp);
       break;
@@ -1709,6 +1716,117 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ ByteSwapSigned(i.OutputRegister(0), i.InputRegister(0), 4);
       break;
     }
+    case kMipsS8x16LoadSplat: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ lb(kScratchReg, i.MemoryOperand());
+      __ fill_b(i.OutputSimd128Register(), kScratchReg);
+      break;
+    }
+    case kMipsS16x8LoadSplat: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ lh(kScratchReg, i.MemoryOperand());
+      __ fill_h(i.OutputSimd128Register(), kScratchReg);
+      break;
+    }
+    case kMipsS32x4LoadSplat: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ Lw(kScratchReg, i.MemoryOperand());
+      __ fill_w(i.OutputSimd128Register(), kScratchReg);
+      break;
+    }
+    case kMipsS64x2LoadSplat: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      MemOperand memLow = i.MemoryOperand();
+      MemOperand memHigh = MemOperand(memLow.rm(), memLow.offset() + 4);
+      __ Lw(kScratchReg, memLow);
+      __ fill_w(dst, kScratchReg);
+      __ Lw(kScratchReg, memHigh);
+      __ fill_w(kSimd128ScratchReg, kScratchReg);
+      __ ilvr_w(dst, kSimd128ScratchReg, dst);
+      break;
+    }
+    case kMipsI16x8Load8x8S: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      MemOperand memLow = i.MemoryOperand();
+      MemOperand memHigh = MemOperand(memLow.rm(), memLow.offset() + 4);
+      __ Lw(kScratchReg, memLow);
+      __ fill_w(dst, kScratchReg);
+      __ Lw(kScratchReg, memHigh);
+      __ fill_w(kSimd128ScratchReg, kScratchReg);
+      __ ilvr_w(dst, kSimd128ScratchReg, dst);
+      __ clti_s_b(kSimd128ScratchReg, dst, 0);
+      __ ilvr_b(dst, kSimd128ScratchReg, dst);
+      break;
+    }
+    case kMipsI16x8Load8x8U: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      MemOperand memLow = i.MemoryOperand();
+      MemOperand memHigh = MemOperand(memLow.rm(), memLow.offset() + 4);
+      __ Lw(kScratchReg, memLow);
+      __ fill_w(dst, kScratchReg);
+      __ Lw(kScratchReg, memHigh);
+      __ fill_w(kSimd128ScratchReg, kScratchReg);
+      __ ilvr_w(dst, kSimd128ScratchReg, dst);
+      __ ilvr_b(dst, kSimd128RegZero, dst);
+      break;
+    }
+    case kMipsI32x4Load16x4S: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      MemOperand memLow = i.MemoryOperand();
+      MemOperand memHigh = MemOperand(memLow.rm(), memLow.offset() + 4);
+      __ Lw(kScratchReg, memLow);
+      __ fill_w(dst, kScratchReg);
+      __ Lw(kScratchReg, memHigh);
+      __ fill_w(kSimd128ScratchReg, kScratchReg);
+      __ ilvr_w(dst, kSimd128ScratchReg, dst);
+      __ clti_s_h(kSimd128ScratchReg, dst, 0);
+      __ ilvr_h(dst, kSimd128ScratchReg, dst);
+      break;
+    }
+    case kMipsI32x4Load16x4U: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      MemOperand memLow = i.MemoryOperand();
+      MemOperand memHigh = MemOperand(memLow.rm(), memLow.offset() + 4);
+      __ Lw(kScratchReg, memLow);
+      __ fill_w(dst, kScratchReg);
+      __ Lw(kScratchReg, memHigh);
+      __ fill_w(kSimd128ScratchReg, kScratchReg);
+      __ ilvr_w(dst, kSimd128ScratchReg, dst);
+      __ ilvr_h(dst, kSimd128RegZero, dst);
+      break;
+    }
+    case kMipsI64x2Load32x2S: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      MemOperand memLow = i.MemoryOperand();
+      MemOperand memHigh = MemOperand(memLow.rm(), memLow.offset() + 4);
+      __ Lw(kScratchReg, memLow);
+      __ fill_w(dst, kScratchReg);
+      __ Lw(kScratchReg, memHigh);
+      __ fill_w(kSimd128ScratchReg, kScratchReg);
+      __ ilvr_w(dst, kSimd128ScratchReg, dst);
+      __ clti_s_w(kSimd128ScratchReg, dst, 0);
+      __ ilvr_w(dst, kSimd128ScratchReg, dst);
+      break;
+    }
+    case kMipsI64x2Load32x2U: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      MemOperand memLow = i.MemoryOperand();
+      MemOperand memHigh = MemOperand(memLow.rm(), memLow.offset() + 4);
+      __ Lw(kScratchReg, memLow);
+      __ fill_w(dst, kScratchReg);
+      __ Lw(kScratchReg, memHigh);
+      __ fill_w(kSimd128ScratchReg, kScratchReg);
+      __ ilvr_w(dst, kSimd128ScratchReg, dst);
+      __ ilvr_w(dst, kSimd128RegZero, dst);
+      break;
+    }
     case kWord32AtomicLoadInt8:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(lb);
       break;
@@ -1942,6 +2060,151 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 i.InputSimd128Register(1));
       break;
     }
+    case kMipsF64x2Abs: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ bclri_d(i.OutputSimd128Register(), i.InputSimd128Register(0), 63);
+      break;
+    }
+    case kMipsF64x2Neg: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ bnegi_d(i.OutputSimd128Register(), i.InputSimd128Register(0), 63);
+      break;
+    }
+    case kMipsF64x2Sqrt: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ fsqrt_d(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      break;
+    }
+    case kMipsF64x2Add: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fadd_d);
+      break;
+    }
+    case kMipsF64x2Sub: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fsub_d);
+      break;
+    }
+    case kMipsF64x2Mul: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fmul_d);
+      break;
+    }
+    case kMipsF64x2Div: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fdiv_d);
+      break;
+    }
+    case kMipsF64x2Min: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fmin_d);
+      break;
+    }
+    case kMipsF64x2Max: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fmax_d);
+      break;
+    }
+    case kMipsF64x2Eq: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ fceq_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMipsF64x2Ne: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ fcne_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMipsF64x2Lt: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ fclt_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMipsF64x2Le: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ fcle_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMipsF64x2Splat: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      __ FmoveLow(kScratchReg, i.InputDoubleRegister(0));
+      __ insert_w(dst, 0, kScratchReg);
+      __ insert_w(dst, 2, kScratchReg);
+      __ FmoveHigh(kScratchReg, i.InputDoubleRegister(0));
+      __ insert_w(dst, 1, kScratchReg);
+      __ insert_w(dst, 3, kScratchReg);
+      break;
+    }
+    case kMipsF64x2ExtractLane: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ copy_u_w(kScratchReg, i.InputSimd128Register(0), i.InputInt8(1) * 2);
+      __ FmoveLow(i.OutputDoubleRegister(), kScratchReg);
+      __ copy_u_w(kScratchReg, i.InputSimd128Register(0),
+                  i.InputInt8(1) * 2 + 1);
+      __ FmoveHigh(i.OutputDoubleRegister(), kScratchReg);
+      break;
+    }
+    case kMipsF64x2ReplaceLane: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      if (src != dst) {
+        __ move_v(dst, src);
+      }
+      __ FmoveLow(kScratchReg, i.InputDoubleRegister(2));
+      __ insert_w(dst, i.InputInt8(1) * 2, kScratchReg);
+      __ FmoveHigh(kScratchReg, i.InputDoubleRegister(2));
+      __ insert_w(dst, i.InputInt8(1) * 2 + 1, kScratchReg);
+      break;
+    }
+    case kMipsI64x2Add: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ addv_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMipsI64x2Sub: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ subv_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMipsI64x2Mul: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ mulv_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMipsI64x2Neg: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+      __ subv_d(i.OutputSimd128Register(), kSimd128RegZero,
+                i.InputSimd128Register(0));
+      break;
+    }
+    case kMipsI64x2Shl: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ slli_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputInt6(1));
+      break;
+    }
+    case kMipsI64x2ShrS: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ srai_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputInt6(1));
+      break;
+    }
+    case kMipsI64x2ShrU: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ srli_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputInt6(1));
+      break;
+    }
     case kMipsF32x4Splat: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       __ FmoveLow(kScratchReg, i.InputSingleRegister(0));
@@ -2043,6 +2306,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 i.InputSimd128Register(1));
       break;
     }
+    case kMipsS128AndNot: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      __ nor_v(dst, i.InputSimd128Register(1), i.InputSimd128Register(1));
+      __ and_v(dst, dst, i.InputSimd128Register(0));
+      break;
+    }
     case kMipsF32x4Abs: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       __ bclri_w(i.OutputSimd128Register(), i.InputSimd128Register(0), 31);
@@ -2174,7 +2444,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ fill_h(i.OutputSimd128Register(), i.InputRegister(0));
       break;
     }
-    case kMipsI16x8ExtractLane: {
+    case kMipsI16x8ExtractLaneU: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ copy_u_h(i.OutputRegister(), i.InputSimd128Register(0),
+                  i.InputInt8(1));
+      break;
+    }
+    case kMipsI16x8ExtractLaneS: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       __ copy_s_h(i.OutputRegister(), i.InputSimd128Register(0),
                   i.InputInt8(1));
@@ -2318,12 +2594,24 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                  i.InputSimd128Register(0));
       break;
     }
+    case kMipsI16x8RoundingAverageU: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ aver_u_h(i.OutputSimd128Register(), i.InputSimd128Register(1),
+                  i.InputSimd128Register(0));
+      break;
+    }
     case kMipsI8x16Splat: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       __ fill_b(i.OutputSimd128Register(), i.InputRegister(0));
       break;
     }
-    case kMipsI8x16ExtractLane: {
+    case kMipsI8x16ExtractLaneU: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ copy_u_b(i.OutputRegister(), i.InputSimd128Register(0),
+                  i.InputInt8(1));
+      break;
+    }
+    case kMipsI8x16ExtractLaneS: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       __ copy_s_b(i.OutputRegister(), i.InputSimd128Register(0),
                   i.InputInt8(1));
@@ -2467,6 +2755,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                  i.InputSimd128Register(0));
       break;
     }
+    case kMipsI8x16RoundingAverageU: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ aver_u_b(i.OutputSimd128Register(), i.InputSimd128Register(1),
+                  i.InputSimd128Register(0));
+      break;
+    }
     case kMipsS128And: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       __ and_v(i.OutputSimd128Register(), i.InputSimd128Register(0),
@@ -2828,6 +3122,17 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ vshf_b(dst, src1, src0);
       break;
     }
+    case kMipsS8x16Swizzle: {
+      Simd128Register dst = i.OutputSimd128Register(),
+                      tbl = i.InputSimd128Register(0),
+                      ctl = i.InputSimd128Register(1);
+      DCHECK(dst != ctl && dst != tbl);
+      Simd128Register zeroReg = i.TempSimd128Register(0);
+      __ fill_w(zeroReg, zero_reg);
+      __ move_v(dst, ctl);
+      __ vshf_b(dst, tbl, zeroReg);
+      break;
+    }
     case kMipsS8x8Reverse: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       // src = [15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0]
@@ -3042,7 +3347,13 @@ void AssembleBranchToLabels(CodeGenerator* gen, TurboAssembler* tasm,
     __ Branch(tlabel, cc, i.InputRegister(0), i.InputOperand(1));
   } else if (instr->arch_opcode() == kArchStackPointerGreaterThan) {
     cc = FlagsConditionToConditionCmp(condition);
-    __ Branch(tlabel, cc, sp, Operand(i.InputRegister(0)));
+    Register lhs_register = sp;
+    uint32_t offset;
+    if (gen->ShouldApplyOffsetToStackCheck(instr, &offset)) {
+      lhs_register = i.TempRegister(0);
+      __ Subu(lhs_register, sp, offset);
+    }
+    __ Branch(tlabel, cc, lhs_register, Operand(i.InputRegister(0)));
   } else if (instr->arch_opcode() == kMipsCmpS ||
              instr->arch_opcode() == kMipsCmpD) {
     bool predicate;
diff --git a/deps/v8/src/compiler/backend/mips/instruction-codes-mips.h b/deps/v8/src/compiler/backend/mips/instruction-codes-mips.h
index af0774f4688441..c3458e7b9143c8 100644
--- a/deps/v8/src/compiler/backend/mips/instruction-codes-mips.h
+++ b/deps/v8/src/compiler/backend/mips/instruction-codes-mips.h
@@ -142,6 +142,26 @@ namespace compiler {
   V(MipsI32x4Add)                  \
   V(MipsI32x4AddHoriz)             \
   V(MipsI32x4Sub)                  \
+  V(MipsF64x2Abs)                  \
+  V(MipsF64x2Neg)                  \
+  V(MipsF64x2Sqrt)                 \
+  V(MipsF64x2Add)                  \
+  V(MipsF64x2Sub)                  \
+  V(MipsF64x2Mul)                  \
+  V(MipsF64x2Div)                  \
+  V(MipsF64x2Min)                  \
+  V(MipsF64x2Max)                  \
+  V(MipsF64x2Eq)                   \
+  V(MipsF64x2Ne)                   \
+  V(MipsF64x2Lt)                   \
+  V(MipsF64x2Le)                   \
+  V(MipsI64x2Add)                  \
+  V(MipsI64x2Sub)                  \
+  V(MipsI64x2Mul)                  \
+  V(MipsI64x2Neg)                  \
+  V(MipsI64x2Shl)                  \
+  V(MipsI64x2ShrS)                 \
+  V(MipsI64x2ShrU)                 \
   V(MipsF32x4Splat)                \
   V(MipsF32x4ExtractLane)          \
   V(MipsF32x4ReplaceLane)          \
@@ -157,6 +177,9 @@ namespace compiler {
   V(MipsI32x4ShrU)                 \
   V(MipsI32x4MaxU)                 \
   V(MipsI32x4MinU)                 \
+  V(MipsF64x2Splat)                \
+  V(MipsF64x2ExtractLane)          \
+  V(MipsF64x2ReplaceLane)          \
   V(MipsF32x4Abs)                  \
   V(MipsF32x4Neg)                  \
   V(MipsF32x4Sqrt)                 \
@@ -181,7 +204,8 @@ namespace compiler {
   V(MipsI32x4GtU)                  \
   V(MipsI32x4GeU)                  \
   V(MipsI16x8Splat)                \
-  V(MipsI16x8ExtractLane)          \
+  V(MipsI16x8ExtractLaneU)         \
+  V(MipsI16x8ExtractLaneS)         \
   V(MipsI16x8ReplaceLane)          \
   V(MipsI16x8Neg)                  \
   V(MipsI16x8Shl)                  \
@@ -205,8 +229,10 @@ namespace compiler {
   V(MipsI16x8MinU)                 \
   V(MipsI16x8GtU)                  \
   V(MipsI16x8GeU)                  \
+  V(MipsI16x8RoundingAverageU)     \
   V(MipsI8x16Splat)                \
-  V(MipsI8x16ExtractLane)          \
+  V(MipsI8x16ExtractLaneU)         \
+  V(MipsI8x16ExtractLaneS)         \
   V(MipsI8x16ReplaceLane)          \
   V(MipsI8x16Neg)                  \
   V(MipsI8x16Shl)                  \
@@ -229,11 +255,13 @@ namespace compiler {
   V(MipsI8x16MinU)                 \
   V(MipsI8x16GtU)                  \
   V(MipsI8x16GeU)                  \
+  V(MipsI8x16RoundingAverageU)     \
   V(MipsS128And)                   \
   V(MipsS128Or)                    \
   V(MipsS128Xor)                   \
   V(MipsS128Not)                   \
   V(MipsS128Select)                \
+  V(MipsS128AndNot)                \
   V(MipsS1x4AnyTrue)               \
   V(MipsS1x4AllTrue)               \
   V(MipsS1x8AnyTrue)               \
@@ -262,10 +290,21 @@ namespace compiler {
   V(MipsS8x16InterleaveEven)       \
   V(MipsS8x16InterleaveOdd)        \
   V(MipsS8x16Shuffle)              \
+  V(MipsS8x16Swizzle)              \
   V(MipsS8x16Concat)               \
   V(MipsS8x8Reverse)               \
   V(MipsS8x4Reverse)               \
   V(MipsS8x2Reverse)               \
+  V(MipsS8x16LoadSplat)            \
+  V(MipsS16x8LoadSplat)            \
+  V(MipsS32x4LoadSplat)            \
+  V(MipsS64x2LoadSplat)            \
+  V(MipsI16x8Load8x8S)             \
+  V(MipsI16x8Load8x8U)             \
+  V(MipsI32x4Load16x4S)            \
+  V(MipsI32x4Load16x4U)            \
+  V(MipsI64x2Load32x2S)            \
+  V(MipsI64x2Load32x2U)            \
   V(MipsMsaLd)                     \
   V(MipsMsaSt)                     \
   V(MipsI32x4SConvertI16x8Low)     \
diff --git a/deps/v8/src/compiler/backend/mips/instruction-scheduler-mips.cc b/deps/v8/src/compiler/backend/mips/instruction-scheduler-mips.cc
index ba17ad25819cab..c6a7f6b95aa771 100644
--- a/deps/v8/src/compiler/backend/mips/instruction-scheduler-mips.cc
+++ b/deps/v8/src/compiler/backend/mips/instruction-scheduler-mips.cc
@@ -41,6 +41,29 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMipsDivS:
     case kMipsDivU:
     case kMipsExt:
+    case kMipsF64x2Abs:
+    case kMipsF64x2Neg:
+    case kMipsF64x2Sqrt:
+    case kMipsF64x2Add:
+    case kMipsF64x2Sub:
+    case kMipsF64x2Mul:
+    case kMipsF64x2Div:
+    case kMipsF64x2Min:
+    case kMipsF64x2Max:
+    case kMipsF64x2Eq:
+    case kMipsF64x2Ne:
+    case kMipsF64x2Lt:
+    case kMipsF64x2Le:
+    case kMipsF64x2Splat:
+    case kMipsF64x2ExtractLane:
+    case kMipsF64x2ReplaceLane:
+    case kMipsI64x2Add:
+    case kMipsI64x2Sub:
+    case kMipsI64x2Mul:
+    case kMipsI64x2Neg:
+    case kMipsI64x2Shl:
+    case kMipsI64x2ShrS:
+    case kMipsI64x2ShrU:
     case kMipsF32x4Abs:
     case kMipsF32x4Add:
     case kMipsF32x4AddHoriz:
@@ -86,9 +109,11 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMipsI16x8AddSaturateS:
     case kMipsI16x8AddSaturateU:
     case kMipsI16x8Eq:
-    case kMipsI16x8ExtractLane:
+    case kMipsI16x8ExtractLaneU:
+    case kMipsI16x8ExtractLaneS:
     case kMipsI16x8GeS:
     case kMipsI16x8GeU:
+    case kMipsI16x8RoundingAverageU:
     case kMipsI16x8GtS:
     case kMipsI16x8GtU:
     case kMipsI16x8MaxS:
@@ -143,9 +168,11 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMipsI8x16AddSaturateS:
     case kMipsI8x16AddSaturateU:
     case kMipsI8x16Eq:
-    case kMipsI8x16ExtractLane:
+    case kMipsI8x16ExtractLaneU:
+    case kMipsI8x16ExtractLaneS:
     case kMipsI8x16GeS:
     case kMipsI8x16GeU:
+    case kMipsI8x16RoundingAverageU:
     case kMipsI8x16GtS:
     case kMipsI8x16GtU:
     case kMipsI8x16MaxS:
@@ -199,6 +226,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMipsS128Select:
     case kMipsS128Xor:
     case kMipsS128Zero:
+    case kMipsS128AndNot:
     case kMipsS16x2Reverse:
     case kMipsS16x4Reverse:
     case kMipsS16x8InterleaveEven:
@@ -228,6 +256,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMipsS8x16PackEven:
     case kMipsS8x16PackOdd:
     case kMipsS8x16Shuffle:
+    case kMipsS8x16Swizzle:
     case kMipsS8x2Reverse:
     case kMipsS8x4Reverse:
     case kMipsS8x8Reverse:
@@ -268,6 +297,16 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMipsUlhu:
     case kMipsUlw:
     case kMipsUlwc1:
+    case kMipsS8x16LoadSplat:
+    case kMipsS16x8LoadSplat:
+    case kMipsS32x4LoadSplat:
+    case kMipsS64x2LoadSplat:
+    case kMipsI16x8Load8x8S:
+    case kMipsI16x8Load8x8U:
+    case kMipsI32x4Load16x4S:
+    case kMipsI32x4Load16x4U:
+    case kMipsI64x2Load32x2S:
+    case kMipsI64x2Load32x2U:
     case kMipsWord32AtomicPairLoad:
       return kIsLoadOperation;
 
diff --git a/deps/v8/src/compiler/backend/mips/instruction-selector-mips.cc b/deps/v8/src/compiler/backend/mips/instruction-selector-mips.cc
index 7ee5c7c2c77d04..22f8217e4dc2c4 100644
--- a/deps/v8/src/compiler/backend/mips/instruction-selector-mips.cc
+++ b/deps/v8/src/compiler/backend/mips/instruction-selector-mips.cc
@@ -233,33 +233,31 @@ static void VisitPairAtomicBinop(InstructionSelector* selector, Node* node,
   Node* index = node->InputAt(1);
   Node* value = node->InputAt(2);
   Node* value_high = node->InputAt(3);
-
+  AddressingMode addressing_mode = kMode_None;
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
   InstructionOperand inputs[] = {g.UseRegister(base), g.UseRegister(index),
                                  g.UseFixed(value, a1),
                                  g.UseFixed(value_high, a2)};
+  InstructionOperand outputs[2];
+  size_t output_count = 0;
+  InstructionOperand temps[3];
+  size_t temp_count = 0;
+  temps[temp_count++] = g.TempRegister(a0);
+
   Node* projection0 = NodeProperties::FindProjection(node, 0);
   Node* projection1 = NodeProperties::FindProjection(node, 1);
+  if (projection0) {
+    outputs[output_count++] = g.DefineAsFixed(projection0, v0);
+  } else {
+    temps[temp_count++] = g.TempRegister(v0);
+  }
   if (projection1) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, v0),
-                                    g.DefineAsFixed(projection1, v1)};
-    InstructionOperand temps[] = {g.TempRegister(a0), g.TempRegister(),
-                                  g.TempRegister()};
-    selector->Emit(opcode | AddressingModeField::encode(kMode_None),
-                   arraysize(outputs), outputs, arraysize(inputs), inputs,
-                   arraysize(temps), temps);
-  } else if (projection0) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, v0)};
-    InstructionOperand temps[] = {g.TempRegister(a0), g.TempRegister(v1),
-                                  g.TempRegister()};
-    selector->Emit(opcode | AddressingModeField::encode(kMode_None),
-                   arraysize(outputs), outputs, arraysize(inputs), inputs,
-                   arraysize(temps), temps);
+    outputs[output_count++] = g.DefineAsFixed(projection1, v1);
   } else {
-    InstructionOperand temps[] = {g.TempRegister(a0), g.TempRegister(v0),
-                                  g.TempRegister(v1)};
-    selector->Emit(opcode | AddressingModeField::encode(kMode_None), 0, nullptr,
-                   arraysize(inputs), inputs, arraysize(temps), temps);
+    temps[temp_count++] = g.TempRegister(v1);
   }
+  selector->Emit(code, output_count, outputs, arraysize(inputs), inputs,
+                 temp_count, temps);
 }
 
 void InstructionSelector::VisitStackSlot(Node* node) {
@@ -278,6 +276,61 @@ void InstructionSelector::VisitAbortCSAAssert(Node* node) {
   Emit(kArchAbortCSAAssert, g.NoOutput(), g.UseFixed(node->InputAt(0), a0));
 }
 
+void InstructionSelector::VisitLoadTransform(Node* node) {
+  LoadTransformParameters params = LoadTransformParametersOf(node->op());
+  MipsOperandGenerator g(this);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+
+  InstructionCode opcode = kArchNop;
+  switch (params.transformation) {
+    case LoadTransformation::kS8x16LoadSplat:
+      opcode = kMipsS8x16LoadSplat;
+      break;
+    case LoadTransformation::kS16x8LoadSplat:
+      opcode = kMipsS16x8LoadSplat;
+      break;
+    case LoadTransformation::kS32x4LoadSplat:
+      opcode = kMipsS32x4LoadSplat;
+      break;
+    case LoadTransformation::kS64x2LoadSplat:
+      opcode = kMipsS64x2LoadSplat;
+      break;
+    case LoadTransformation::kI16x8Load8x8S:
+      opcode = kMipsI16x8Load8x8S;
+      break;
+    case LoadTransformation::kI16x8Load8x8U:
+      opcode = kMipsI16x8Load8x8U;
+      break;
+    case LoadTransformation::kI32x4Load16x4S:
+      opcode = kMipsI32x4Load16x4S;
+      break;
+    case LoadTransformation::kI32x4Load16x4U:
+      opcode = kMipsI32x4Load16x4U;
+      break;
+    case LoadTransformation::kI64x2Load32x2S:
+      opcode = kMipsI64x2Load32x2S;
+      break;
+    case LoadTransformation::kI64x2Load32x2U:
+      opcode = kMipsI64x2Load32x2U;
+      break;
+    default:
+      UNIMPLEMENTED();
+  }
+
+  if (g.CanBeImmediate(index, opcode)) {
+    Emit(opcode | AddressingModeField::encode(kMode_MRI),
+         g.DefineAsRegister(node), g.UseRegister(base), g.UseImmediate(index));
+  } else {
+    InstructionOperand addr_reg = g.TempRegister();
+    Emit(kMipsAdd | AddressingModeField::encode(kMode_None), addr_reg,
+         g.UseRegister(index), g.UseRegister(base));
+    // Emit desired load opcode, using temp addr_reg.
+    Emit(opcode | AddressingModeField::encode(kMode_MRI),
+         g.DefineAsRegister(node), addr_reg, g.TempImmediate(0));
+  }
+}
+
 void InstructionSelector::VisitLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   MipsOperandGenerator g(this);
@@ -308,7 +361,6 @@ void InstructionSelector::VisitLoad(Node* node) {
     case MachineRepresentation::kSimd128:
       opcode = kMipsMsaLd;
       break;
-    case MachineRepresentation::kCompressedSigned:   // Fall through.
     case MachineRepresentation::kCompressedPointer:  // Fall through.
     case MachineRepresentation::kCompressed:         // Fall through.
     case MachineRepresentation::kWord64:             // Fall through.
@@ -391,7 +443,6 @@ void InstructionSelector::VisitStore(Node* node) {
       case MachineRepresentation::kSimd128:
         opcode = kMipsMsaSt;
         break;
-      case MachineRepresentation::kCompressedSigned:   // Fall through.
       case MachineRepresentation::kCompressedPointer:  // Fall through.
       case MachineRepresentation::kCompressed:         // Fall through.
       case MachineRepresentation::kWord64:             // Fall through.
@@ -676,29 +727,29 @@ void InstructionSelector::VisitWord32AtomicPairLoad(Node* node) {
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
   ArchOpcode opcode = kMipsWord32AtomicPairLoad;
+  AddressingMode addressing_mode = kMode_MRI;
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  InstructionOperand inputs[] = {g.UseRegister(base), g.UseRegister(index)};
+  InstructionOperand temps[3];
+  size_t temp_count = 0;
+  temps[temp_count++] = g.TempRegister(a0);
+  InstructionOperand outputs[2];
+  size_t output_count = 0;
 
   Node* projection0 = NodeProperties::FindProjection(node, 0);
   Node* projection1 = NodeProperties::FindProjection(node, 1);
-
-  InstructionOperand inputs[] = {g.UseRegister(base), g.UseRegister(index)};
-
+  if (projection0) {
+    outputs[output_count++] = g.DefineAsFixed(projection0, v0);
+  } else {
+    temps[temp_count++] = g.TempRegister(v0);
+  }
   if (projection1) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, v0),
-                                    g.DefineAsFixed(projection1, v1)};
-    InstructionOperand temps[] = {g.TempRegister(a0)};
-    Emit(opcode | AddressingModeField::encode(kMode_MRI), arraysize(outputs),
-         outputs, arraysize(inputs), inputs, arraysize(temps), temps);
-  } else if (projection0) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, v0)};
-    InstructionOperand temps[] = {g.TempRegister(a0), g.TempRegister(v1)};
-    Emit(opcode | AddressingModeField::encode(kMode_MRI), arraysize(outputs),
-         outputs, arraysize(inputs), inputs, arraysize(temps), temps);
+    outputs[output_count++] = g.DefineAsFixed(projection1, v1);
   } else {
-    InstructionOperand temps[] = {g.TempRegister(a0), g.TempRegister(v0),
-                                  g.TempRegister(v1)};
-    Emit(opcode | AddressingModeField::encode(kMode_MRI), 0, nullptr,
-         arraysize(inputs), inputs, arraysize(temps), temps);
+    temps[temp_count++] = g.TempRegister(v1);
   }
+  Emit(code, output_count, outputs, arraysize(inputs), inputs, temp_count,
+       temps);
 }
 
 void InstructionSelector::VisitWord32AtomicPairStore(Node* node) {
@@ -752,22 +803,23 @@ void InstructionSelector::VisitWord32AtomicPairCompareExchange(Node* node) {
                          AddressingModeField::encode(kMode_MRI);
   Node* projection0 = NodeProperties::FindProjection(node, 0);
   Node* projection1 = NodeProperties::FindProjection(node, 1);
+  InstructionOperand outputs[2];
+  size_t output_count = 0;
+  InstructionOperand temps[3];
+  size_t temp_count = 0;
+  temps[temp_count++] = g.TempRegister(a0);
+  if (projection0) {
+    outputs[output_count++] = g.DefineAsFixed(projection0, v0);
+  } else {
+    temps[temp_count++] = g.TempRegister(v0);
+  }
   if (projection1) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, v0),
-                                    g.DefineAsFixed(projection1, v1)};
-    InstructionOperand temps[] = {g.TempRegister(a0)};
-    Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
-         arraysize(temps), temps);
-  } else if (projection0) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, v0)};
-    InstructionOperand temps[] = {g.TempRegister(a0), g.TempRegister(v1)};
-    Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
-         arraysize(temps), temps);
+    outputs[output_count++] = g.DefineAsFixed(projection1, v1);
   } else {
-    InstructionOperand temps[] = {g.TempRegister(a0), g.TempRegister(v0),
-                                  g.TempRegister(v1)};
-    Emit(code, 0, nullptr, arraysize(inputs), inputs, arraysize(temps), temps);
+    temps[temp_count++] = g.TempRegister(v1);
   }
+  Emit(code, output_count, outputs, arraysize(inputs), inputs, temp_count,
+       temps);
 }
 
 void InstructionSelector::VisitWord32ReverseBits(Node* node) { UNREACHABLE(); }
@@ -847,21 +899,21 @@ void InstructionSelector::VisitInt32Mul(Node* node) {
     if (base::bits::IsPowerOfTwo(value)) {
       Emit(kMipsShl | AddressingModeField::encode(kMode_None),
            g.DefineAsRegister(node), g.UseRegister(m.left().node()),
-           g.TempImmediate(WhichPowerOf2(value)));
+           g.TempImmediate(base::bits::WhichPowerOfTwo(value)));
       return;
     }
     if (base::bits::IsPowerOfTwo(value - 1) && IsMipsArchVariant(kMips32r6) &&
         value - 1 > 0 && value - 1 <= 31) {
       Emit(kMipsLsa, g.DefineAsRegister(node), g.UseRegister(m.left().node()),
            g.UseRegister(m.left().node()),
-           g.TempImmediate(WhichPowerOf2(value - 1)));
+           g.TempImmediate(base::bits::WhichPowerOfTwo(value - 1)));
       return;
     }
     if (base::bits::IsPowerOfTwo(value + 1)) {
       InstructionOperand temp = g.TempRegister();
       Emit(kMipsShl | AddressingModeField::encode(kMode_None), temp,
            g.UseRegister(m.left().node()),
-           g.TempImmediate(WhichPowerOf2(value + 1)));
+           g.TempImmediate(base::bits::WhichPowerOfTwo(value + 1)));
       Emit(kMipsSub | AddressingModeField::encode(kMode_None),
            g.DefineAsRegister(node), temp, g.UseRegister(m.left().node()));
       return;
@@ -1343,7 +1395,6 @@ void InstructionSelector::VisitUnalignedLoad(Node* node) {
     case MachineRepresentation::kSimd128:
       opcode = kMipsMsaLd;
       break;
-    case MachineRepresentation::kCompressedSigned:   // Fall through.
     case MachineRepresentation::kCompressedPointer:  // Fall through.
     case MachineRepresentation::kCompressed:         // Fall through.
     case MachineRepresentation::kWord64:             // Fall through.
@@ -1396,7 +1447,6 @@ void InstructionSelector::VisitUnalignedStore(Node* node) {
     case MachineRepresentation::kSimd128:
       opcode = kMipsMsaSt;
       break;
-    case MachineRepresentation::kCompressedSigned:   // Fall through.
     case MachineRepresentation::kCompressedPointer:  // Fall through.
     case MachineRepresentation::kCompressed:         // Fall through.
     case MachineRepresentation::kWord64:             // Fall through.
@@ -1535,11 +1585,31 @@ void VisitWordCompare(InstructionSelector* selector, Node* node,
 
 void InstructionSelector::VisitStackPointerGreaterThan(
     Node* node, FlagsContinuation* cont) {
-  Node* const value = node->InputAt(0);
-  InstructionCode opcode = kArchStackPointerGreaterThan;
+  StackCheckKind kind = StackCheckKindOf(node->op());
+  InstructionCode opcode =
+      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
 
   MipsOperandGenerator g(this);
-  EmitWithContinuation(opcode, g.UseRegister(value), cont);
+
+  // No outputs.
+  InstructionOperand* const outputs = nullptr;
+  const int output_count = 0;
+
+  // Applying an offset to this stack check requires a temp register. Offsets
+  // are only applied to the first stack check. If applying an offset, we must
+  // ensure the input and temp registers do not alias, thus kUniqueRegister.
+  InstructionOperand temps[] = {g.TempRegister()};
+  const int temp_count = (kind == StackCheckKind::kJSFunctionEntry ? 1 : 0);
+  const auto register_mode = (kind == StackCheckKind::kJSFunctionEntry)
+                                 ? OperandGenerator::kUniqueRegister
+                                 : OperandGenerator::kRegister;
+
+  Node* const value = node->InputAt(0);
+  InstructionOperand inputs[] = {g.UseRegisterWithMode(value, register_mode)};
+  static constexpr int input_count = arraysize(inputs);
+
+  EmitWithContinuation(opcode, output_count, outputs, input_count, inputs,
+                       temp_count, temps, cont);
 }
 
 // Shared routine for word comparisons against zero.
@@ -2014,6 +2084,10 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(I8x16)
 
 #define SIMD_UNOP_LIST(V)                                \
+  V(F64x2Abs, kMipsF64x2Abs)                             \
+  V(F64x2Neg, kMipsF64x2Neg)                             \
+  V(F64x2Sqrt, kMipsF64x2Sqrt)                           \
+  V(I64x2Neg, kMipsI64x2Neg)                             \
   V(F32x4SConvertI32x4, kMipsF32x4SConvertI32x4)         \
   V(F32x4UConvertI32x4, kMipsF32x4UConvertI32x4)         \
   V(F32x4Abs, kMipsF32x4Abs)                             \
@@ -2043,6 +2117,9 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(S1x16AllTrue, kMipsS1x16AllTrue)
 
 #define SIMD_SHIFT_OP_LIST(V) \
+  V(I64x2Shl)                 \
+  V(I64x2ShrS)                \
+  V(I64x2ShrU)                \
   V(I32x4Shl)                 \
   V(I32x4ShrS)                \
   V(I32x4ShrU)                \
@@ -2053,74 +2130,90 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(I8x16ShrS)                \
   V(I8x16ShrU)
 
-#define SIMD_BINOP_LIST(V)                       \
-  V(F32x4Add, kMipsF32x4Add)                     \
-  V(F32x4AddHoriz, kMipsF32x4AddHoriz)           \
-  V(F32x4Sub, kMipsF32x4Sub)                     \
-  V(F32x4Mul, kMipsF32x4Mul)                     \
-  V(F32x4Div, kMipsF32x4Div)                     \
-  V(F32x4Max, kMipsF32x4Max)                     \
-  V(F32x4Min, kMipsF32x4Min)                     \
-  V(F32x4Eq, kMipsF32x4Eq)                       \
-  V(F32x4Ne, kMipsF32x4Ne)                       \
-  V(F32x4Lt, kMipsF32x4Lt)                       \
-  V(F32x4Le, kMipsF32x4Le)                       \
-  V(I32x4Add, kMipsI32x4Add)                     \
-  V(I32x4AddHoriz, kMipsI32x4AddHoriz)           \
-  V(I32x4Sub, kMipsI32x4Sub)                     \
-  V(I32x4Mul, kMipsI32x4Mul)                     \
-  V(I32x4MaxS, kMipsI32x4MaxS)                   \
-  V(I32x4MinS, kMipsI32x4MinS)                   \
-  V(I32x4MaxU, kMipsI32x4MaxU)                   \
-  V(I32x4MinU, kMipsI32x4MinU)                   \
-  V(I32x4Eq, kMipsI32x4Eq)                       \
-  V(I32x4Ne, kMipsI32x4Ne)                       \
-  V(I32x4GtS, kMipsI32x4GtS)                     \
-  V(I32x4GeS, kMipsI32x4GeS)                     \
-  V(I32x4GtU, kMipsI32x4GtU)                     \
-  V(I32x4GeU, kMipsI32x4GeU)                     \
-  V(I16x8Add, kMipsI16x8Add)                     \
-  V(I16x8AddSaturateS, kMipsI16x8AddSaturateS)   \
-  V(I16x8AddSaturateU, kMipsI16x8AddSaturateU)   \
-  V(I16x8AddHoriz, kMipsI16x8AddHoriz)           \
-  V(I16x8Sub, kMipsI16x8Sub)                     \
-  V(I16x8SubSaturateS, kMipsI16x8SubSaturateS)   \
-  V(I16x8SubSaturateU, kMipsI16x8SubSaturateU)   \
-  V(I16x8Mul, kMipsI16x8Mul)                     \
-  V(I16x8MaxS, kMipsI16x8MaxS)                   \
-  V(I16x8MinS, kMipsI16x8MinS)                   \
-  V(I16x8MaxU, kMipsI16x8MaxU)                   \
-  V(I16x8MinU, kMipsI16x8MinU)                   \
-  V(I16x8Eq, kMipsI16x8Eq)                       \
-  V(I16x8Ne, kMipsI16x8Ne)                       \
-  V(I16x8GtS, kMipsI16x8GtS)                     \
-  V(I16x8GeS, kMipsI16x8GeS)                     \
-  V(I16x8GtU, kMipsI16x8GtU)                     \
-  V(I16x8GeU, kMipsI16x8GeU)                     \
-  V(I16x8SConvertI32x4, kMipsI16x8SConvertI32x4) \
-  V(I16x8UConvertI32x4, kMipsI16x8UConvertI32x4) \
-  V(I8x16Add, kMipsI8x16Add)                     \
-  V(I8x16AddSaturateS, kMipsI8x16AddSaturateS)   \
-  V(I8x16AddSaturateU, kMipsI8x16AddSaturateU)   \
-  V(I8x16Sub, kMipsI8x16Sub)                     \
-  V(I8x16SubSaturateS, kMipsI8x16SubSaturateS)   \
-  V(I8x16SubSaturateU, kMipsI8x16SubSaturateU)   \
-  V(I8x16Mul, kMipsI8x16Mul)                     \
-  V(I8x16MaxS, kMipsI8x16MaxS)                   \
-  V(I8x16MinS, kMipsI8x16MinS)                   \
-  V(I8x16MaxU, kMipsI8x16MaxU)                   \
-  V(I8x16MinU, kMipsI8x16MinU)                   \
-  V(I8x16Eq, kMipsI8x16Eq)                       \
-  V(I8x16Ne, kMipsI8x16Ne)                       \
-  V(I8x16GtS, kMipsI8x16GtS)                     \
-  V(I8x16GeS, kMipsI8x16GeS)                     \
-  V(I8x16GtU, kMipsI8x16GtU)                     \
-  V(I8x16GeU, kMipsI8x16GeU)                     \
-  V(I8x16SConvertI16x8, kMipsI8x16SConvertI16x8) \
-  V(I8x16UConvertI16x8, kMipsI8x16UConvertI16x8) \
-  V(S128And, kMipsS128And)                       \
-  V(S128Or, kMipsS128Or)                         \
-  V(S128Xor, kMipsS128Xor)
+#define SIMD_BINOP_LIST(V)                             \
+  V(F64x2Add, kMipsF64x2Add)                           \
+  V(F64x2Sub, kMipsF64x2Sub)                           \
+  V(F64x2Mul, kMipsF64x2Mul)                           \
+  V(F64x2Div, kMipsF64x2Div)                           \
+  V(F64x2Min, kMipsF64x2Min)                           \
+  V(F64x2Max, kMipsF64x2Max)                           \
+  V(F64x2Eq, kMipsF64x2Eq)                             \
+  V(F64x2Ne, kMipsF64x2Ne)                             \
+  V(F64x2Lt, kMipsF64x2Lt)                             \
+  V(F64x2Le, kMipsF64x2Le)                             \
+  V(I64x2Add, kMipsI64x2Add)                           \
+  V(I64x2Sub, kMipsI64x2Sub)                           \
+  V(I64x2Mul, kMipsI64x2Mul)                           \
+  V(F32x4Add, kMipsF32x4Add)                           \
+  V(F32x4AddHoriz, kMipsF32x4AddHoriz)                 \
+  V(F32x4Sub, kMipsF32x4Sub)                           \
+  V(F32x4Mul, kMipsF32x4Mul)                           \
+  V(F32x4Div, kMipsF32x4Div)                           \
+  V(F32x4Max, kMipsF32x4Max)                           \
+  V(F32x4Min, kMipsF32x4Min)                           \
+  V(F32x4Eq, kMipsF32x4Eq)                             \
+  V(F32x4Ne, kMipsF32x4Ne)                             \
+  V(F32x4Lt, kMipsF32x4Lt)                             \
+  V(F32x4Le, kMipsF32x4Le)                             \
+  V(I32x4Add, kMipsI32x4Add)                           \
+  V(I32x4AddHoriz, kMipsI32x4AddHoriz)                 \
+  V(I32x4Sub, kMipsI32x4Sub)                           \
+  V(I32x4Mul, kMipsI32x4Mul)                           \
+  V(I32x4MaxS, kMipsI32x4MaxS)                         \
+  V(I32x4MinS, kMipsI32x4MinS)                         \
+  V(I32x4MaxU, kMipsI32x4MaxU)                         \
+  V(I32x4MinU, kMipsI32x4MinU)                         \
+  V(I32x4Eq, kMipsI32x4Eq)                             \
+  V(I32x4Ne, kMipsI32x4Ne)                             \
+  V(I32x4GtS, kMipsI32x4GtS)                           \
+  V(I32x4GeS, kMipsI32x4GeS)                           \
+  V(I32x4GtU, kMipsI32x4GtU)                           \
+  V(I32x4GeU, kMipsI32x4GeU)                           \
+  V(I16x8Add, kMipsI16x8Add)                           \
+  V(I16x8AddSaturateS, kMipsI16x8AddSaturateS)         \
+  V(I16x8AddSaturateU, kMipsI16x8AddSaturateU)         \
+  V(I16x8AddHoriz, kMipsI16x8AddHoriz)                 \
+  V(I16x8Sub, kMipsI16x8Sub)                           \
+  V(I16x8SubSaturateS, kMipsI16x8SubSaturateS)         \
+  V(I16x8SubSaturateU, kMipsI16x8SubSaturateU)         \
+  V(I16x8Mul, kMipsI16x8Mul)                           \
+  V(I16x8MaxS, kMipsI16x8MaxS)                         \
+  V(I16x8MinS, kMipsI16x8MinS)                         \
+  V(I16x8MaxU, kMipsI16x8MaxU)                         \
+  V(I16x8MinU, kMipsI16x8MinU)                         \
+  V(I16x8Eq, kMipsI16x8Eq)                             \
+  V(I16x8Ne, kMipsI16x8Ne)                             \
+  V(I16x8GtS, kMipsI16x8GtS)                           \
+  V(I16x8GeS, kMipsI16x8GeS)                           \
+  V(I16x8GtU, kMipsI16x8GtU)                           \
+  V(I16x8GeU, kMipsI16x8GeU)                           \
+  V(I16x8SConvertI32x4, kMipsI16x8SConvertI32x4)       \
+  V(I16x8UConvertI32x4, kMipsI16x8UConvertI32x4)       \
+  V(I16x8RoundingAverageU, kMipsI16x8RoundingAverageU) \
+  V(I8x16Add, kMipsI8x16Add)                           \
+  V(I8x16AddSaturateS, kMipsI8x16AddSaturateS)         \
+  V(I8x16AddSaturateU, kMipsI8x16AddSaturateU)         \
+  V(I8x16Sub, kMipsI8x16Sub)                           \
+  V(I8x16SubSaturateS, kMipsI8x16SubSaturateS)         \
+  V(I8x16SubSaturateU, kMipsI8x16SubSaturateU)         \
+  V(I8x16Mul, kMipsI8x16Mul)                           \
+  V(I8x16MaxS, kMipsI8x16MaxS)                         \
+  V(I8x16MinS, kMipsI8x16MinS)                         \
+  V(I8x16MaxU, kMipsI8x16MaxU)                         \
+  V(I8x16MinU, kMipsI8x16MinU)                         \
+  V(I8x16Eq, kMipsI8x16Eq)                             \
+  V(I8x16Ne, kMipsI8x16Ne)                             \
+  V(I8x16GtS, kMipsI8x16GtS)                           \
+  V(I8x16GeS, kMipsI8x16GeS)                           \
+  V(I8x16GtU, kMipsI8x16GtU)                           \
+  V(I8x16GeU, kMipsI8x16GeU)                           \
+  V(I8x16RoundingAverageU, kMipsI8x16RoundingAverageU) \
+  V(I8x16SConvertI16x8, kMipsI8x16SConvertI16x8)       \
+  V(I8x16UConvertI16x8, kMipsI8x16UConvertI16x8)       \
+  V(S128And, kMipsS128And)                             \
+  V(S128Or, kMipsS128Or)                               \
+  V(S128Xor, kMipsS128Xor)                             \
+  V(S128AndNot, kMipsS128AndNot)
 
 void InstructionSelector::VisitS128Zero(Node* node) {
   MipsOperandGenerator g(this);
@@ -2132,13 +2225,20 @@ void InstructionSelector::VisitS128Zero(Node* node) {
     VisitRR(this, kMips##Type##Splat, node);                 \
   }
 SIMD_TYPE_LIST(SIMD_VISIT_SPLAT)
+SIMD_VISIT_SPLAT(F64x2)
 #undef SIMD_VISIT_SPLAT
 
-#define SIMD_VISIT_EXTRACT_LANE(Type)                              \
-  void InstructionSelector::Visit##Type##ExtractLane(Node* node) { \
-    VisitRRI(this, kMips##Type##ExtractLane, node);                \
-  }
-SIMD_TYPE_LIST(SIMD_VISIT_EXTRACT_LANE)
+#define SIMD_VISIT_EXTRACT_LANE(Type, Sign)                              \
+  void InstructionSelector::Visit##Type##ExtractLane##Sign(Node* node) { \
+    VisitRRI(this, kMips##Type##ExtractLane##Sign, node);                \
+  }
+SIMD_VISIT_EXTRACT_LANE(F64x2, )
+SIMD_VISIT_EXTRACT_LANE(F32x4, )
+SIMD_VISIT_EXTRACT_LANE(I32x4, )
+SIMD_VISIT_EXTRACT_LANE(I16x8, U)
+SIMD_VISIT_EXTRACT_LANE(I16x8, S)
+SIMD_VISIT_EXTRACT_LANE(I8x16, U)
+SIMD_VISIT_EXTRACT_LANE(I8x16, S)
 #undef SIMD_VISIT_EXTRACT_LANE
 
 #define SIMD_VISIT_REPLACE_LANE(Type)                              \
@@ -2146,6 +2246,7 @@ SIMD_TYPE_LIST(SIMD_VISIT_EXTRACT_LANE)
     VisitRRIR(this, kMips##Type##ReplaceLane, node);               \
   }
 SIMD_TYPE_LIST(SIMD_VISIT_REPLACE_LANE)
+SIMD_VISIT_REPLACE_LANE(F64x2)
 #undef SIMD_VISIT_REPLACE_LANE
 
 #define SIMD_VISIT_UNOP(Name, instruction)            \
@@ -2279,6 +2380,17 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
        g.UseImmediate(Pack4Lanes(shuffle + 12)));
 }
 
+void InstructionSelector::VisitS8x16Swizzle(Node* node) {
+  MipsOperandGenerator g(this);
+  InstructionOperand temps[] = {g.TempSimd128Register()};
+  // We don't want input 0 or input 1 to be the same as output, since we will
+  // modify output before do the calculation.
+  Emit(kMipsS8x16Swizzle, g.DefineAsRegister(node),
+       g.UseUniqueRegister(node->InputAt(0)),
+       g.UseUniqueRegister(node->InputAt(1)),
+       arraysize(temps), temps);
+}
+
 void InstructionSelector::VisitSignExtendWord8ToInt32(Node* node) {
   MipsOperandGenerator g(this);
   Emit(kMipsSeb, g.DefineAsRegister(node), g.UseRegister(node->InputAt(0)));
diff --git a/deps/v8/src/compiler/backend/mips64/code-generator-mips64.cc b/deps/v8/src/compiler/backend/mips64/code-generator-mips64.cc
index 9cec463e875b1f..1e36c6ed92a067 100644
--- a/deps/v8/src/compiler/backend/mips64/code-generator-mips64.cc
+++ b/deps/v8/src/compiler/backend/mips64/code-generator-mips64.cc
@@ -180,7 +180,7 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
       // Just encode the stub index. This will be patched when the code
       // is added to the native module and copied into wasm code space.
       __ CallRecordWriteStub(object_, scratch1_, remembered_set_action,
-                             save_fp_mode, wasm::WasmCode::kWasmRecordWrite);
+                             save_fp_mode, wasm::WasmCode::kRecordWrite);
     } else {
       __ CallRecordWriteStub(object_, scratch1_, remembered_set_action,
                              save_fp_mode);
@@ -490,6 +490,12 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
     __ MovFromFloatResult(i.OutputDoubleRegister());                        \
   } while (0)
 
+#define ASSEMBLE_F64X2_ARITHMETIC_BINOP(op)                     \
+  do {                                                          \
+    __ op(i.OutputSimd128Register(), i.InputSimd128Register(0), \
+          i.InputSimd128Register(1));                           \
+  } while (0)
+
 void CodeGenerator::AssembleDeconstructFrame() {
   __ mov(sp, fp);
   __ Pop(ra, fp);
@@ -522,9 +528,7 @@ void CodeGenerator::AssemblePopArgumentsAdaptorFrame(Register args_reg,
         MemOperand(fp, ArgumentsAdaptorFrameConstants::kLengthOffset));
   __ SmiUntag(caller_args_count_reg);
 
-  ParameterCount callee_args_count(args_reg);
-  __ PrepareForTailCall(callee_args_count, caller_args_count_reg, scratch2,
-                        scratch3);
+  __ PrepareForTailCall(args_reg, caller_args_count_reg, scratch2, scratch3);
   __ bind(&done);
 }
 
@@ -786,9 +790,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       if (isWasmCapiFunction) {
         CHECK_EQ(offset, __ SizeOfCodeGeneratedSince(&start_call));
+        RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
       }
 
-      RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
       frame_access_state()->SetFrameAccessToDefault();
       // Ideally, we should decrement SP delta to match the change of stack
       // pointer in CallCFunction. However, for certain architectures (e.g.
@@ -855,6 +859,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchStackPointerGreaterThan:
       // Pseudo-instruction used for cmp/branch. No opcode emitted here.
       break;
+    case kArchStackCheckOffset:
+      __ Move(i.OutputRegister(), Smi::FromInt(GetStackCheckOffset()));
+      break;
     case kArchFramePointer:
       __ mov(i.OutputRegister(), fp);
       break;
@@ -1087,27 +1094,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ And(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMips64And32:
-      if (instr->InputAt(1)->IsRegister()) {
-        __ sll(i.InputRegister(0), i.InputRegister(0), 0x0);
-        __ sll(i.InputRegister(1), i.InputRegister(1), 0x0);
         __ And(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
-      } else {
-        __ sll(i.InputRegister(0), i.InputRegister(0), 0x0);
-        __ And(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
-      }
+        __ sll(i.OutputRegister(), i.OutputRegister(), 0x0);
       break;
     case kMips64Or:
       __ Or(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMips64Or32:
-      if (instr->InputAt(1)->IsRegister()) {
-        __ sll(i.InputRegister(0), i.InputRegister(0), 0x0);
-        __ sll(i.InputRegister(1), i.InputRegister(1), 0x0);
         __ Or(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
-      } else {
-        __ sll(i.InputRegister(0), i.InputRegister(0), 0x0);
-        __ Or(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
-      }
+        __ sll(i.OutputRegister(), i.OutputRegister(), 0x0);
       break;
     case kMips64Nor:
       if (instr->InputAt(1)->IsRegister()) {
@@ -1119,27 +1114,20 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kMips64Nor32:
       if (instr->InputAt(1)->IsRegister()) {
-        __ sll(i.InputRegister(0), i.InputRegister(0), 0x0);
-        __ sll(i.InputRegister(1), i.InputRegister(1), 0x0);
         __ Nor(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
+        __ sll(i.OutputRegister(), i.OutputRegister(), 0x0);
       } else {
         DCHECK_EQ(0, i.InputOperand(1).immediate());
-        __ sll(i.InputRegister(0), i.InputRegister(0), 0x0);
         __ Nor(i.OutputRegister(), i.InputRegister(0), zero_reg);
+        __ sll(i.OutputRegister(), i.OutputRegister(), 0x0);
       }
       break;
     case kMips64Xor:
       __ Xor(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMips64Xor32:
-      if (instr->InputAt(1)->IsRegister()) {
-        __ sll(i.InputRegister(0), i.InputRegister(0), 0x0);
-        __ sll(i.InputRegister(1), i.InputRegister(1), 0x0);
-        __ Xor(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
-      } else {
-        __ sll(i.InputRegister(0), i.InputRegister(0), 0x0);
         __ Xor(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
-      }
+        __ sll(i.OutputRegister(), i.OutputRegister(), 0x0);
       break;
     case kMips64Clz:
       __ Clz(i.OutputRegister(), i.InputRegister(0));
@@ -1182,8 +1170,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ srlv(i.OutputRegister(), i.InputRegister(0), i.InputRegister(1));
       } else {
         int64_t imm = i.InputOperand(1).immediate();
-        __ sll(i.InputRegister(0), i.InputRegister(0), 0x0);
-        __ srl(i.OutputRegister(), i.InputRegister(0),
+        __ sll(i.OutputRegister(), i.InputRegister(0), 0x0);
+        __ srl(i.OutputRegister(), i.OutputRegister(),
                static_cast<uint16_t>(imm));
       }
       break;
@@ -1193,8 +1181,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ srav(i.OutputRegister(), i.InputRegister(0), i.InputRegister(1));
       } else {
         int64_t imm = i.InputOperand(1).immediate();
-        __ sll(i.InputRegister(0), i.InputRegister(0), 0x0);
-        __ sra(i.OutputRegister(), i.InputRegister(0),
+        __ sll(i.OutputRegister(), i.InputRegister(0), 0x0);
+        __ sra(i.OutputRegister(), i.OutputRegister(),
                static_cast<uint16_t>(imm));
       }
       break;
@@ -1870,6 +1858,84 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ ByteSwapSigned(i.OutputRegister(0), i.InputRegister(0), 4);
       break;
     }
+    case kMips64S8x16LoadSplat: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ Lb(kScratchReg, i.MemoryOperand());
+      __ fill_b(i.OutputSimd128Register(), kScratchReg);
+      break;
+    }
+    case kMips64S16x8LoadSplat: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ Lh(kScratchReg, i.MemoryOperand());
+      __ fill_h(i.OutputSimd128Register(), kScratchReg);
+      break;
+    }
+    case kMips64S32x4LoadSplat: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ Lw(kScratchReg, i.MemoryOperand());
+      __ fill_w(i.OutputSimd128Register(), kScratchReg);
+      break;
+    }
+    case kMips64S64x2LoadSplat: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ Ld(kScratchReg, i.MemoryOperand());
+      __ fill_d(i.OutputSimd128Register(), kScratchReg);
+      break;
+    }
+    case kMips64I16x8Load8x8S: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register scratch = kSimd128ScratchReg;
+      __ Ld(kScratchReg, i.MemoryOperand());
+      __ fill_d(dst, kScratchReg);
+      __ clti_s_b(scratch, dst, 0);
+      __ ilvr_b(dst, scratch, dst);
+      break;
+    }
+    case kMips64I16x8Load8x8U: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      __ Ld(kScratchReg, i.MemoryOperand());
+      __ fill_d(dst, kScratchReg);
+      __ ilvr_b(dst, kSimd128RegZero, dst);
+      break;
+    }
+    case kMips64I32x4Load16x4S: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register scratch = kSimd128ScratchReg;
+      __ Ld(kScratchReg, i.MemoryOperand());
+      __ fill_d(dst, kScratchReg);
+      __ clti_s_h(scratch, dst, 0);
+      __ ilvr_h(dst, scratch, dst);
+      break;
+    }
+    case kMips64I32x4Load16x4U: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      __ Ld(kScratchReg, i.MemoryOperand());
+      __ fill_d(dst, kScratchReg);
+      __ ilvr_h(dst, kSimd128RegZero, dst);
+      break;
+    }
+    case kMips64I64x2Load32x2S: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register scratch = kSimd128ScratchReg;
+      __ Ld(kScratchReg, i.MemoryOperand());
+      __ fill_d(dst, kScratchReg);
+      __ clti_s_w(scratch, dst, 0);
+      __ ilvr_w(dst, scratch, dst);
+      break;
+    }
+    case kMips64I64x2Load32x2U: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      __ Ld(kScratchReg, i.MemoryOperand());
+      __ fill_d(dst, kScratchReg);
+      __ ilvr_w(dst, kSimd128RegZero, dst);
+      break;
+    }
     case kWord32AtomicLoadInt8:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(Lb);
       break;
@@ -2057,6 +2123,141 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 i.InputSimd128Register(1));
       break;
     }
+    case kMips64F64x2Abs: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ bclri_d(i.OutputSimd128Register(), i.InputSimd128Register(0), 63);
+      break;
+    }
+    case kMips64F64x2Neg: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ bnegi_d(i.OutputSimd128Register(), i.InputSimd128Register(0), 63);
+      break;
+    }
+    case kMips64F64x2Sqrt: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ fsqrt_d(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      break;
+    }
+    case kMips64F64x2Add: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fadd_d);
+      break;
+    }
+    case kMips64F64x2Sub: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fsub_d);
+      break;
+    }
+    case kMips64F64x2Mul: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fmul_d);
+      break;
+    }
+    case kMips64F64x2Div: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fdiv_d);
+      break;
+    }
+    case kMips64F64x2Min: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fmin_d);
+      break;
+    }
+    case kMips64F64x2Max: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fmax_d);
+      break;
+    }
+    case kMips64F64x2Eq: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ fceq_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMips64F64x2Ne: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ fcne_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMips64F64x2Lt: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ fclt_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMips64F64x2Le: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ fcle_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMips64F64x2Splat: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ Move(kScratchReg, i.InputDoubleRegister(0));
+      __ fill_d(i.OutputSimd128Register(), kScratchReg);
+      break;
+    }
+    case kMips64F64x2ExtractLane: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ copy_s_d(kScratchReg, i.InputSimd128Register(0), i.InputInt8(1));
+      __ Move(i.OutputDoubleRegister(), kScratchReg);
+      break;
+    }
+    case kMips64F64x2ReplaceLane: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      if (src != dst) {
+        __ move_v(dst, src);
+      }
+      __ Move(kScratchReg, i.InputDoubleRegister(2));
+      __ insert_d(dst, i.InputInt8(1), kScratchReg);
+      break;
+    }
+    case kMips64I64x2Add: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ addv_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMips64I64x2Sub: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ subv_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMips64I64x2Mul: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ mulv_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kMips64I64x2Neg: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+      __ subv_d(i.OutputSimd128Register(), kSimd128RegZero,
+                i.InputSimd128Register(0));
+      break;
+    }
+    case kMips64I64x2Shl: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ slli_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputInt6(1));
+      break;
+    }
+    case kMips64I64x2ShrS: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ srai_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputInt6(1));
+      break;
+    }
+    case kMips64I64x2ShrU: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ srli_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputInt6(1));
+      break;
+    }
     case kMips64F32x4Splat: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       __ FmoveLow(kScratchReg, i.InputSingleRegister(0));
@@ -2158,6 +2359,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 i.InputSimd128Register(1));
       break;
     }
+    case kMips64S128AndNot: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register dst = i.OutputSimd128Register();
+      __ nor_v(dst, i.InputSimd128Register(1), i.InputSimd128Register(1));
+      __ and_v(dst, dst, i.InputSimd128Register(0));
+      break;
+    }
     case kMips64F32x4Abs: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       __ bclri_w(i.OutputSimd128Register(), i.InputSimd128Register(0), 31);
@@ -2289,7 +2497,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ fill_h(i.OutputSimd128Register(), i.InputRegister(0));
       break;
     }
-    case kMips64I16x8ExtractLane: {
+    case kMips64I16x8ExtractLaneU: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ copy_u_h(i.OutputRegister(), i.InputSimd128Register(0),
+                  i.InputInt8(1));
+      break;
+    }
+    case kMips64I16x8ExtractLaneS: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       __ copy_s_h(i.OutputRegister(), i.InputSimd128Register(0),
                   i.InputInt8(1));
@@ -2433,12 +2647,24 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                  i.InputSimd128Register(0));
       break;
     }
+    case kMips64I16x8RoundingAverageU: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ aver_u_h(i.OutputSimd128Register(), i.InputSimd128Register(1),
+                  i.InputSimd128Register(0));
+      break;
+    }
     case kMips64I8x16Splat: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       __ fill_b(i.OutputSimd128Register(), i.InputRegister(0));
       break;
     }
-    case kMips64I8x16ExtractLane: {
+    case kMips64I8x16ExtractLaneU: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ copy_u_b(i.OutputRegister(), i.InputSimd128Register(0),
+                  i.InputInt8(1));
+      break;
+    }
+    case kMips64I8x16ExtractLaneS: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       __ copy_s_b(i.OutputRegister(), i.InputSimd128Register(0),
                   i.InputInt8(1));
@@ -2582,6 +2808,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                  i.InputSimd128Register(0));
       break;
     }
+    case kMips64I8x16RoundingAverageU: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ aver_u_b(i.OutputSimd128Register(), i.InputSimd128Register(1),
+                  i.InputSimd128Register(0));
+      break;
+    }
     case kMips64S128And: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       __ and_v(i.OutputSimd128Register(), i.InputSimd128Register(0),
@@ -2942,6 +3174,17 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ vshf_b(dst, src1, src0);
       break;
     }
+    case kMips64S8x16Swizzle: {
+      Simd128Register dst = i.OutputSimd128Register(),
+                      tbl = i.InputSimd128Register(0),
+                      ctl = i.InputSimd128Register(1);
+      DCHECK(dst != ctl && dst != tbl);
+      Simd128Register zeroReg = i.TempSimd128Register(0);
+      __ fill_d(zeroReg, zero_reg);
+      __ move_v(dst, ctl);
+      __ vshf_b(dst, tbl, zeroReg);
+      break;
+    }
     case kMips64S8x8Reverse: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       // src = [15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0]
@@ -3167,7 +3410,13 @@ void AssembleBranchToLabels(CodeGenerator* gen, TurboAssembler* tasm,
     __ Branch(tlabel, cc, i.InputRegister(0), i.InputOperand(1));
   } else if (instr->arch_opcode() == kArchStackPointerGreaterThan) {
     cc = FlagsConditionToConditionCmp(condition);
-    __ Branch(tlabel, cc, sp, Operand(i.InputRegister(0)));
+    Register lhs_register = sp;
+    uint32_t offset;
+    if (gen->ShouldApplyOffsetToStackCheck(instr, &offset)) {
+      lhs_register = i.TempRegister(0);
+      __ Dsubu(lhs_register, sp, offset);
+    }
+    __ Branch(tlabel, cc, lhs_register, Operand(i.InputRegister(0)));
   } else if (instr->arch_opcode() == kMips64CmpS ||
              instr->arch_opcode() == kMips64CmpD) {
     bool predicate;
diff --git a/deps/v8/src/compiler/backend/mips64/instruction-codes-mips64.h b/deps/v8/src/compiler/backend/mips64/instruction-codes-mips64.h
index bcf3532b5725f3..bed1080cbed60e 100644
--- a/deps/v8/src/compiler/backend/mips64/instruction-codes-mips64.h
+++ b/deps/v8/src/compiler/backend/mips64/instruction-codes-mips64.h
@@ -172,6 +172,8 @@ namespace compiler {
   V(Mips64I32x4Add)                          \
   V(Mips64I32x4AddHoriz)                     \
   V(Mips64I32x4Sub)                          \
+  V(Mips64F64x2Abs)                          \
+  V(Mips64F64x2Neg)                          \
   V(Mips64F32x4Splat)                        \
   V(Mips64F32x4ExtractLane)                  \
   V(Mips64F32x4ReplaceLane)                  \
@@ -187,9 +189,30 @@ namespace compiler {
   V(Mips64I32x4ShrU)                         \
   V(Mips64I32x4MaxU)                         \
   V(Mips64I32x4MinU)                         \
+  V(Mips64F64x2Sqrt)                         \
+  V(Mips64F64x2Add)                          \
+  V(Mips64F64x2Sub)                          \
+  V(Mips64F64x2Mul)                          \
+  V(Mips64F64x2Div)                          \
+  V(Mips64F64x2Min)                          \
+  V(Mips64F64x2Max)                          \
+  V(Mips64F64x2Eq)                           \
+  V(Mips64F64x2Ne)                           \
+  V(Mips64F64x2Lt)                           \
+  V(Mips64F64x2Le)                           \
+  V(Mips64F64x2Splat)                        \
+  V(Mips64F64x2ExtractLane)                  \
+  V(Mips64F64x2ReplaceLane)                  \
+  V(Mips64I64x2Add)                          \
+  V(Mips64I64x2Sub)                          \
+  V(Mips64I64x2Mul)                          \
+  V(Mips64I64x2Neg)                          \
+  V(Mips64I64x2Shl)                          \
+  V(Mips64I64x2ShrS)                         \
+  V(Mips64I64x2ShrU)                         \
   V(Mips64F32x4Abs)                          \
   V(Mips64F32x4Neg)                          \
-  V(Mips64F32x4Sqrt)                          \
+  V(Mips64F32x4Sqrt)                         \
   V(Mips64F32x4RecipApprox)                  \
   V(Mips64F32x4RecipSqrtApprox)              \
   V(Mips64F32x4Add)                          \
@@ -211,7 +234,8 @@ namespace compiler {
   V(Mips64I32x4GtU)                          \
   V(Mips64I32x4GeU)                          \
   V(Mips64I16x8Splat)                        \
-  V(Mips64I16x8ExtractLane)                  \
+  V(Mips64I16x8ExtractLaneU)                 \
+  V(Mips64I16x8ExtractLaneS)                 \
   V(Mips64I16x8ReplaceLane)                  \
   V(Mips64I16x8Neg)                          \
   V(Mips64I16x8Shl)                          \
@@ -235,8 +259,10 @@ namespace compiler {
   V(Mips64I16x8MinU)                         \
   V(Mips64I16x8GtU)                          \
   V(Mips64I16x8GeU)                          \
+  V(Mips64I16x8RoundingAverageU)             \
   V(Mips64I8x16Splat)                        \
-  V(Mips64I8x16ExtractLane)                  \
+  V(Mips64I8x16ExtractLaneU)                 \
+  V(Mips64I8x16ExtractLaneS)                 \
   V(Mips64I8x16ReplaceLane)                  \
   V(Mips64I8x16Neg)                          \
   V(Mips64I8x16Shl)                          \
@@ -259,11 +285,13 @@ namespace compiler {
   V(Mips64I8x16MinU)                         \
   V(Mips64I8x16GtU)                          \
   V(Mips64I8x16GeU)                          \
+  V(Mips64I8x16RoundingAverageU)             \
   V(Mips64S128And)                           \
   V(Mips64S128Or)                            \
   V(Mips64S128Xor)                           \
   V(Mips64S128Not)                           \
   V(Mips64S128Select)                        \
+  V(Mips64S128AndNot)                        \
   V(Mips64S1x4AnyTrue)                       \
   V(Mips64S1x4AllTrue)                       \
   V(Mips64S1x8AnyTrue)                       \
@@ -292,10 +320,21 @@ namespace compiler {
   V(Mips64S8x16InterleaveEven)               \
   V(Mips64S8x16InterleaveOdd)                \
   V(Mips64S8x16Shuffle)                      \
+  V(Mips64S8x16Swizzle)                      \
   V(Mips64S8x16Concat)                       \
   V(Mips64S8x8Reverse)                       \
   V(Mips64S8x4Reverse)                       \
   V(Mips64S8x2Reverse)                       \
+  V(Mips64S8x16LoadSplat)                    \
+  V(Mips64S16x8LoadSplat)                    \
+  V(Mips64S32x4LoadSplat)                    \
+  V(Mips64S64x2LoadSplat)                    \
+  V(Mips64I16x8Load8x8S)                     \
+  V(Mips64I16x8Load8x8U)                     \
+  V(Mips64I32x4Load16x4S)                    \
+  V(Mips64I32x4Load16x4U)                    \
+  V(Mips64I64x2Load32x2S)                    \
+  V(Mips64I64x2Load32x2U)                    \
   V(Mips64MsaLd)                             \
   V(Mips64MsaSt)                             \
   V(Mips64I32x4SConvertI16x8Low)             \
diff --git a/deps/v8/src/compiler/backend/mips64/instruction-scheduler-mips64.cc b/deps/v8/src/compiler/backend/mips64/instruction-scheduler-mips64.cc
index fe2d33d1db5865..ff6517be006121 100644
--- a/deps/v8/src/compiler/backend/mips64/instruction-scheduler-mips64.cc
+++ b/deps/v8/src/compiler/backend/mips64/instruction-scheduler-mips64.cc
@@ -69,6 +69,26 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMips64Dsub:
     case kMips64DsubOvf:
     case kMips64Ext:
+    case kMips64F64x2Abs:
+    case kMips64F64x2Neg:
+    case kMips64F64x2Sqrt:
+    case kMips64F64x2Add:
+    case kMips64F64x2Sub:
+    case kMips64F64x2Mul:
+    case kMips64F64x2Div:
+    case kMips64F64x2Min:
+    case kMips64F64x2Max:
+    case kMips64F64x2Eq:
+    case kMips64F64x2Ne:
+    case kMips64F64x2Lt:
+    case kMips64F64x2Le:
+    case kMips64I64x2Add:
+    case kMips64I64x2Sub:
+    case kMips64I64x2Mul:
+    case kMips64I64x2Neg:
+    case kMips64I64x2Shl:
+    case kMips64I64x2ShrS:
+    case kMips64I64x2ShrU:
     case kMips64F32x4Abs:
     case kMips64F32x4Add:
     case kMips64F32x4AddHoriz:
@@ -90,6 +110,9 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMips64F32x4Splat:
     case kMips64F32x4Sub:
     case kMips64F32x4UConvertI32x4:
+    case kMips64F64x2Splat:
+    case kMips64F64x2ExtractLane:
+    case kMips64F64x2ReplaceLane:
     case kMips64Float32Max:
     case kMips64Float32Min:
     case kMips64Float32RoundDown:
@@ -114,7 +137,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMips64I16x8AddSaturateS:
     case kMips64I16x8AddSaturateU:
     case kMips64I16x8Eq:
-    case kMips64I16x8ExtractLane:
+    case kMips64I16x8ExtractLaneU:
+    case kMips64I16x8ExtractLaneS:
     case kMips64I16x8GeS:
     case kMips64I16x8GeU:
     case kMips64I16x8GtS:
@@ -142,6 +166,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMips64I16x8UConvertI32x4:
     case kMips64I16x8UConvertI8x16High:
     case kMips64I16x8UConvertI8x16Low:
+    case kMips64I16x8RoundingAverageU:
     case kMips64I32x4Add:
     case kMips64I32x4AddHoriz:
     case kMips64I32x4Eq:
@@ -173,7 +198,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMips64I8x16AddSaturateS:
     case kMips64I8x16AddSaturateU:
     case kMips64I8x16Eq:
-    case kMips64I8x16ExtractLane:
+    case kMips64I8x16ExtractLaneU:
+    case kMips64I8x16ExtractLaneS:
     case kMips64I8x16GeS:
     case kMips64I8x16GeU:
     case kMips64I8x16GtS:
@@ -193,6 +219,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMips64I8x16Sub:
     case kMips64I8x16SubSaturateS:
     case kMips64I8x16SubSaturateU:
+    case kMips64I8x16RoundingAverageU:
     case kMips64Ins:
     case kMips64Lsa:
     case kMips64MaxD:
@@ -221,6 +248,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMips64S128Or:
     case kMips64S128Not:
     case kMips64S128Select:
+    case kMips64S128AndNot:
     case kMips64S128Xor:
     case kMips64S128Zero:
     case kMips64S16x8InterleaveEven:
@@ -255,6 +283,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMips64S8x4Reverse:
     case kMips64S8x8Reverse:
     case kMips64S8x16Shuffle:
+    case kMips64S8x16Swizzle:
     case kMips64Sar:
     case kMips64Seb:
     case kMips64Seh:
@@ -296,6 +325,16 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMips64Ulw:
     case kMips64Ulwu:
     case kMips64Ulwc1:
+    case kMips64S8x16LoadSplat:
+    case kMips64S16x8LoadSplat:
+    case kMips64S32x4LoadSplat:
+    case kMips64S64x2LoadSplat:
+    case kMips64I16x8Load8x8S:
+    case kMips64I16x8Load8x8U:
+    case kMips64I32x4Load16x4S:
+    case kMips64I32x4Load16x4U:
+    case kMips64I64x2Load32x2S:
+    case kMips64I64x2Load32x2U:
     case kMips64Word64AtomicLoadUint8:
     case kMips64Word64AtomicLoadUint16:
     case kMips64Word64AtomicLoadUint32:
diff --git a/deps/v8/src/compiler/backend/mips64/instruction-selector-mips64.cc b/deps/v8/src/compiler/backend/mips64/instruction-selector-mips64.cc
index dfc0ff5badf17b..12a12e456c7000 100644
--- a/deps/v8/src/compiler/backend/mips64/instruction-selector-mips64.cc
+++ b/deps/v8/src/compiler/backend/mips64/instruction-selector-mips64.cc
@@ -359,6 +359,48 @@ void EmitLoad(InstructionSelector* selector, Node* node, InstructionCode opcode,
   }
 }
 
+void InstructionSelector::VisitLoadTransform(Node* node) {
+  LoadTransformParameters params = LoadTransformParametersOf(node->op());
+
+  InstructionCode opcode = kArchNop;
+  switch (params.transformation) {
+    case LoadTransformation::kS8x16LoadSplat:
+      opcode = kMips64S8x16LoadSplat;
+      break;
+    case LoadTransformation::kS16x8LoadSplat:
+      opcode = kMips64S16x8LoadSplat;
+      break;
+    case LoadTransformation::kS32x4LoadSplat:
+      opcode = kMips64S32x4LoadSplat;
+      break;
+    case LoadTransformation::kS64x2LoadSplat:
+      opcode = kMips64S64x2LoadSplat;
+      break;
+    case LoadTransformation::kI16x8Load8x8S:
+      opcode = kMips64I16x8Load8x8S;
+      break;
+    case LoadTransformation::kI16x8Load8x8U:
+      opcode = kMips64I16x8Load8x8U;
+      break;
+    case LoadTransformation::kI32x4Load16x4S:
+      opcode = kMips64I32x4Load16x4S;
+      break;
+    case LoadTransformation::kI32x4Load16x4U:
+      opcode = kMips64I32x4Load16x4U;
+      break;
+    case LoadTransformation::kI64x2Load32x2S:
+      opcode = kMips64I64x2Load32x2S;
+      break;
+    case LoadTransformation::kI64x2Load32x2U:
+      opcode = kMips64I64x2Load32x2U;
+      break;
+    default:
+      UNIMPLEMENTED();
+  }
+
+  EmitLoad(this, node, opcode);
+}
+
 void InstructionSelector::VisitLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
 
@@ -389,7 +431,6 @@ void InstructionSelector::VisitLoad(Node* node) {
     case MachineRepresentation::kSimd128:
       opcode = kMips64MsaLd;
       break;
-    case MachineRepresentation::kCompressedSigned:   // Fall through.
     case MachineRepresentation::kCompressedPointer:  // Fall through.
     case MachineRepresentation::kCompressed:         // Fall through.
     case MachineRepresentation::kNone:
@@ -464,7 +505,6 @@ void InstructionSelector::VisitStore(Node* node) {
       case MachineRepresentation::kSimd128:
         opcode = kMips64MsaSt;
         break;
-      case MachineRepresentation::kCompressedSigned:   // Fall through.
       case MachineRepresentation::kCompressedPointer:  // Fall through.
       case MachineRepresentation::kCompressed:         // Fall through.
       case MachineRepresentation::kNone:
@@ -954,21 +994,21 @@ void InstructionSelector::VisitInt32Mul(Node* node) {
     if (base::bits::IsPowerOfTwo(value)) {
       Emit(kMips64Shl | AddressingModeField::encode(kMode_None),
            g.DefineAsRegister(node), g.UseRegister(m.left().node()),
-           g.TempImmediate(WhichPowerOf2(value)));
+           g.TempImmediate(base::bits::WhichPowerOfTwo(value)));
       return;
     }
     if (base::bits::IsPowerOfTwo(value - 1) && kArchVariant == kMips64r6 &&
         value - 1 > 0 && value - 1 <= 31) {
       Emit(kMips64Lsa, g.DefineAsRegister(node), g.UseRegister(m.left().node()),
            g.UseRegister(m.left().node()),
-           g.TempImmediate(WhichPowerOf2(value - 1)));
+           g.TempImmediate(base::bits::WhichPowerOfTwo(value - 1)));
       return;
     }
     if (base::bits::IsPowerOfTwo(value + 1)) {
       InstructionOperand temp = g.TempRegister();
       Emit(kMips64Shl | AddressingModeField::encode(kMode_None), temp,
            g.UseRegister(m.left().node()),
-           g.TempImmediate(WhichPowerOf2(value + 1)));
+           g.TempImmediate(base::bits::WhichPowerOfTwo(value + 1)));
       Emit(kMips64Sub | AddressingModeField::encode(kMode_None),
            g.DefineAsRegister(node), temp, g.UseRegister(m.left().node()));
       return;
@@ -1009,7 +1049,7 @@ void InstructionSelector::VisitInt64Mul(Node* node) {
     if (base::bits::IsPowerOfTwo(value)) {
       Emit(kMips64Dshl | AddressingModeField::encode(kMode_None),
            g.DefineAsRegister(node), g.UseRegister(m.left().node()),
-           g.TempImmediate(WhichPowerOf2(value)));
+           g.TempImmediate(base::bits::WhichPowerOfTwo(value)));
       return;
     }
     if (base::bits::IsPowerOfTwo(value - 1) && kArchVariant == kMips64r6 &&
@@ -1017,14 +1057,14 @@ void InstructionSelector::VisitInt64Mul(Node* node) {
       // Dlsa macro will handle the shifting value out of bound cases.
       Emit(kMips64Dlsa, g.DefineAsRegister(node),
            g.UseRegister(m.left().node()), g.UseRegister(m.left().node()),
-           g.TempImmediate(WhichPowerOf2(value - 1)));
+           g.TempImmediate(base::bits::WhichPowerOfTwo(value - 1)));
       return;
     }
     if (base::bits::IsPowerOfTwo(value + 1)) {
       InstructionOperand temp = g.TempRegister();
       Emit(kMips64Dshl | AddressingModeField::encode(kMode_None), temp,
            g.UseRegister(m.left().node()),
-           g.TempImmediate(WhichPowerOf2(value + 1)));
+           g.TempImmediate(base::bits::WhichPowerOfTwo(value + 1)));
       Emit(kMips64Dsub | AddressingModeField::encode(kMode_None),
            g.DefineAsRegister(node), temp, g.UseRegister(m.left().node()));
       return;
@@ -1296,6 +1336,10 @@ void InstructionSelector::VisitTryTruncateFloat64ToUint64(Node* node) {
   Emit(kMips64TruncUlD, output_count, outputs, 1, inputs);
 }
 
+void InstructionSelector::VisitBitcastWord32ToWord64(Node* node) {
+  UNIMPLEMENTED();
+}
+
 void InstructionSelector::VisitChangeInt32ToInt64(Node* node) {
   Node* value = node->InputAt(0);
   if (value->opcode() == IrOpcode::kLoad && CanCover(node, value)) {
@@ -1691,7 +1735,6 @@ void InstructionSelector::VisitUnalignedLoad(Node* node) {
     case MachineRepresentation::kSimd128:
       opcode = kMips64MsaLd;
       break;
-    case MachineRepresentation::kCompressedSigned:   // Fall through.
     case MachineRepresentation::kCompressedPointer:  // Fall through.
     case MachineRepresentation::kCompressed:         // Fall through.
     case MachineRepresentation::kNone:
@@ -1744,7 +1787,6 @@ void InstructionSelector::VisitUnalignedStore(Node* node) {
     case MachineRepresentation::kSimd128:
       opcode = kMips64MsaSt;
       break;
-    case MachineRepresentation::kCompressedSigned:   // Fall through.
     case MachineRepresentation::kCompressedPointer:  // Fall through.
     case MachineRepresentation::kCompressed:         // Fall through.
     case MachineRepresentation::kNone:
@@ -2096,11 +2138,31 @@ void VisitAtomicBinop(InstructionSelector* selector, Node* node,
 
 void InstructionSelector::VisitStackPointerGreaterThan(
     Node* node, FlagsContinuation* cont) {
-  Node* const value = node->InputAt(0);
-  InstructionCode opcode = kArchStackPointerGreaterThan;
+  StackCheckKind kind = StackCheckKindOf(node->op());
+  InstructionCode opcode =
+      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
 
   Mips64OperandGenerator g(this);
-  EmitWithContinuation(opcode, g.UseRegister(value), cont);
+
+  // No outputs.
+  InstructionOperand* const outputs = nullptr;
+  const int output_count = 0;
+
+  // Applying an offset to this stack check requires a temp register. Offsets
+  // are only applied to the first stack check. If applying an offset, we must
+  // ensure the input and temp registers do not alias, thus kUniqueRegister.
+  InstructionOperand temps[] = {g.TempRegister()};
+  const int temp_count = (kind == StackCheckKind::kJSFunctionEntry ? 1 : 0);
+  const auto register_mode = (kind == StackCheckKind::kJSFunctionEntry)
+                                 ? OperandGenerator::kUniqueRegister
+                                 : OperandGenerator::kRegister;
+
+  Node* const value = node->InputAt(0);
+  InstructionOperand inputs[] = {g.UseRegisterWithMode(value, register_mode)};
+  static constexpr int input_count = arraysize(inputs);
+
+  EmitWithContinuation(opcode, output_count, outputs, input_count, inputs,
+                       temp_count, temps, cont);
 }
 
 // Shared routine for word comparisons against zero.
@@ -2677,6 +2739,10 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(I8x16)
 
 #define SIMD_UNOP_LIST(V)                                  \
+  V(F64x2Abs, kMips64F64x2Abs)                             \
+  V(F64x2Neg, kMips64F64x2Neg)                             \
+  V(F64x2Sqrt, kMips64F64x2Sqrt)                           \
+  V(I64x2Neg, kMips64I64x2Neg)                             \
   V(F32x4SConvertI32x4, kMips64F32x4SConvertI32x4)         \
   V(F32x4UConvertI32x4, kMips64F32x4UConvertI32x4)         \
   V(F32x4Abs, kMips64F32x4Abs)                             \
@@ -2706,6 +2772,9 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(S1x16AllTrue, kMips64S1x16AllTrue)
 
 #define SIMD_SHIFT_OP_LIST(V) \
+  V(I64x2Shl)                 \
+  V(I64x2ShrS)                \
+  V(I64x2ShrU)                \
   V(I32x4Shl)                 \
   V(I32x4ShrS)                \
   V(I32x4ShrU)                \
@@ -2716,74 +2785,90 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(I8x16ShrS)                \
   V(I8x16ShrU)
 
-#define SIMD_BINOP_LIST(V)                         \
-  V(F32x4Add, kMips64F32x4Add)                     \
-  V(F32x4AddHoriz, kMips64F32x4AddHoriz)           \
-  V(F32x4Sub, kMips64F32x4Sub)                     \
-  V(F32x4Mul, kMips64F32x4Mul)                     \
-  V(F32x4Div, kMips64F32x4Div)                     \
-  V(F32x4Max, kMips64F32x4Max)                     \
-  V(F32x4Min, kMips64F32x4Min)                     \
-  V(F32x4Eq, kMips64F32x4Eq)                       \
-  V(F32x4Ne, kMips64F32x4Ne)                       \
-  V(F32x4Lt, kMips64F32x4Lt)                       \
-  V(F32x4Le, kMips64F32x4Le)                       \
-  V(I32x4Add, kMips64I32x4Add)                     \
-  V(I32x4AddHoriz, kMips64I32x4AddHoriz)           \
-  V(I32x4Sub, kMips64I32x4Sub)                     \
-  V(I32x4Mul, kMips64I32x4Mul)                     \
-  V(I32x4MaxS, kMips64I32x4MaxS)                   \
-  V(I32x4MinS, kMips64I32x4MinS)                   \
-  V(I32x4MaxU, kMips64I32x4MaxU)                   \
-  V(I32x4MinU, kMips64I32x4MinU)                   \
-  V(I32x4Eq, kMips64I32x4Eq)                       \
-  V(I32x4Ne, kMips64I32x4Ne)                       \
-  V(I32x4GtS, kMips64I32x4GtS)                     \
-  V(I32x4GeS, kMips64I32x4GeS)                     \
-  V(I32x4GtU, kMips64I32x4GtU)                     \
-  V(I32x4GeU, kMips64I32x4GeU)                     \
-  V(I16x8Add, kMips64I16x8Add)                     \
-  V(I16x8AddSaturateS, kMips64I16x8AddSaturateS)   \
-  V(I16x8AddSaturateU, kMips64I16x8AddSaturateU)   \
-  V(I16x8AddHoriz, kMips64I16x8AddHoriz)           \
-  V(I16x8Sub, kMips64I16x8Sub)                     \
-  V(I16x8SubSaturateS, kMips64I16x8SubSaturateS)   \
-  V(I16x8SubSaturateU, kMips64I16x8SubSaturateU)   \
-  V(I16x8Mul, kMips64I16x8Mul)                     \
-  V(I16x8MaxS, kMips64I16x8MaxS)                   \
-  V(I16x8MinS, kMips64I16x8MinS)                   \
-  V(I16x8MaxU, kMips64I16x8MaxU)                   \
-  V(I16x8MinU, kMips64I16x8MinU)                   \
-  V(I16x8Eq, kMips64I16x8Eq)                       \
-  V(I16x8Ne, kMips64I16x8Ne)                       \
-  V(I16x8GtS, kMips64I16x8GtS)                     \
-  V(I16x8GeS, kMips64I16x8GeS)                     \
-  V(I16x8GtU, kMips64I16x8GtU)                     \
-  V(I16x8GeU, kMips64I16x8GeU)                     \
-  V(I16x8SConvertI32x4, kMips64I16x8SConvertI32x4) \
-  V(I16x8UConvertI32x4, kMips64I16x8UConvertI32x4) \
-  V(I8x16Add, kMips64I8x16Add)                     \
-  V(I8x16AddSaturateS, kMips64I8x16AddSaturateS)   \
-  V(I8x16AddSaturateU, kMips64I8x16AddSaturateU)   \
-  V(I8x16Sub, kMips64I8x16Sub)                     \
-  V(I8x16SubSaturateS, kMips64I8x16SubSaturateS)   \
-  V(I8x16SubSaturateU, kMips64I8x16SubSaturateU)   \
-  V(I8x16Mul, kMips64I8x16Mul)                     \
-  V(I8x16MaxS, kMips64I8x16MaxS)                   \
-  V(I8x16MinS, kMips64I8x16MinS)                   \
-  V(I8x16MaxU, kMips64I8x16MaxU)                   \
-  V(I8x16MinU, kMips64I8x16MinU)                   \
-  V(I8x16Eq, kMips64I8x16Eq)                       \
-  V(I8x16Ne, kMips64I8x16Ne)                       \
-  V(I8x16GtS, kMips64I8x16GtS)                     \
-  V(I8x16GeS, kMips64I8x16GeS)                     \
-  V(I8x16GtU, kMips64I8x16GtU)                     \
-  V(I8x16GeU, kMips64I8x16GeU)                     \
-  V(I8x16SConvertI16x8, kMips64I8x16SConvertI16x8) \
-  V(I8x16UConvertI16x8, kMips64I8x16UConvertI16x8) \
-  V(S128And, kMips64S128And)                       \
-  V(S128Or, kMips64S128Or)                         \
-  V(S128Xor, kMips64S128Xor)
+#define SIMD_BINOP_LIST(V)                               \
+  V(F64x2Add, kMips64F64x2Add)                           \
+  V(F64x2Sub, kMips64F64x2Sub)                           \
+  V(F64x2Mul, kMips64F64x2Mul)                           \
+  V(F64x2Div, kMips64F64x2Div)                           \
+  V(F64x2Min, kMips64F64x2Min)                           \
+  V(F64x2Max, kMips64F64x2Max)                           \
+  V(F64x2Eq, kMips64F64x2Eq)                             \
+  V(F64x2Ne, kMips64F64x2Ne)                             \
+  V(F64x2Lt, kMips64F64x2Lt)                             \
+  V(F64x2Le, kMips64F64x2Le)                             \
+  V(I64x2Add, kMips64I64x2Add)                           \
+  V(I64x2Sub, kMips64I64x2Sub)                           \
+  V(I64x2Mul, kMips64I64x2Mul)                           \
+  V(F32x4Add, kMips64F32x4Add)                           \
+  V(F32x4AddHoriz, kMips64F32x4AddHoriz)                 \
+  V(F32x4Sub, kMips64F32x4Sub)                           \
+  V(F32x4Mul, kMips64F32x4Mul)                           \
+  V(F32x4Div, kMips64F32x4Div)                           \
+  V(F32x4Max, kMips64F32x4Max)                           \
+  V(F32x4Min, kMips64F32x4Min)                           \
+  V(F32x4Eq, kMips64F32x4Eq)                             \
+  V(F32x4Ne, kMips64F32x4Ne)                             \
+  V(F32x4Lt, kMips64F32x4Lt)                             \
+  V(F32x4Le, kMips64F32x4Le)                             \
+  V(I32x4Add, kMips64I32x4Add)                           \
+  V(I32x4AddHoriz, kMips64I32x4AddHoriz)                 \
+  V(I32x4Sub, kMips64I32x4Sub)                           \
+  V(I32x4Mul, kMips64I32x4Mul)                           \
+  V(I32x4MaxS, kMips64I32x4MaxS)                         \
+  V(I32x4MinS, kMips64I32x4MinS)                         \
+  V(I32x4MaxU, kMips64I32x4MaxU)                         \
+  V(I32x4MinU, kMips64I32x4MinU)                         \
+  V(I32x4Eq, kMips64I32x4Eq)                             \
+  V(I32x4Ne, kMips64I32x4Ne)                             \
+  V(I32x4GtS, kMips64I32x4GtS)                           \
+  V(I32x4GeS, kMips64I32x4GeS)                           \
+  V(I32x4GtU, kMips64I32x4GtU)                           \
+  V(I32x4GeU, kMips64I32x4GeU)                           \
+  V(I16x8Add, kMips64I16x8Add)                           \
+  V(I16x8AddSaturateS, kMips64I16x8AddSaturateS)         \
+  V(I16x8AddSaturateU, kMips64I16x8AddSaturateU)         \
+  V(I16x8AddHoriz, kMips64I16x8AddHoriz)                 \
+  V(I16x8Sub, kMips64I16x8Sub)                           \
+  V(I16x8SubSaturateS, kMips64I16x8SubSaturateS)         \
+  V(I16x8SubSaturateU, kMips64I16x8SubSaturateU)         \
+  V(I16x8Mul, kMips64I16x8Mul)                           \
+  V(I16x8MaxS, kMips64I16x8MaxS)                         \
+  V(I16x8MinS, kMips64I16x8MinS)                         \
+  V(I16x8MaxU, kMips64I16x8MaxU)                         \
+  V(I16x8MinU, kMips64I16x8MinU)                         \
+  V(I16x8Eq, kMips64I16x8Eq)                             \
+  V(I16x8Ne, kMips64I16x8Ne)                             \
+  V(I16x8GtS, kMips64I16x8GtS)                           \
+  V(I16x8GeS, kMips64I16x8GeS)                           \
+  V(I16x8GtU, kMips64I16x8GtU)                           \
+  V(I16x8GeU, kMips64I16x8GeU)                           \
+  V(I16x8RoundingAverageU, kMips64I16x8RoundingAverageU) \
+  V(I16x8SConvertI32x4, kMips64I16x8SConvertI32x4)       \
+  V(I16x8UConvertI32x4, kMips64I16x8UConvertI32x4)       \
+  V(I8x16Add, kMips64I8x16Add)                           \
+  V(I8x16AddSaturateS, kMips64I8x16AddSaturateS)         \
+  V(I8x16AddSaturateU, kMips64I8x16AddSaturateU)         \
+  V(I8x16Sub, kMips64I8x16Sub)                           \
+  V(I8x16SubSaturateS, kMips64I8x16SubSaturateS)         \
+  V(I8x16SubSaturateU, kMips64I8x16SubSaturateU)         \
+  V(I8x16Mul, kMips64I8x16Mul)                           \
+  V(I8x16MaxS, kMips64I8x16MaxS)                         \
+  V(I8x16MinS, kMips64I8x16MinS)                         \
+  V(I8x16MaxU, kMips64I8x16MaxU)                         \
+  V(I8x16MinU, kMips64I8x16MinU)                         \
+  V(I8x16Eq, kMips64I8x16Eq)                             \
+  V(I8x16Ne, kMips64I8x16Ne)                             \
+  V(I8x16GtS, kMips64I8x16GtS)                           \
+  V(I8x16GeS, kMips64I8x16GeS)                           \
+  V(I8x16GtU, kMips64I8x16GtU)                           \
+  V(I8x16GeU, kMips64I8x16GeU)                           \
+  V(I8x16RoundingAverageU, kMips64I8x16RoundingAverageU) \
+  V(I8x16SConvertI16x8, kMips64I8x16SConvertI16x8)       \
+  V(I8x16UConvertI16x8, kMips64I8x16UConvertI16x8)       \
+  V(S128And, kMips64S128And)                             \
+  V(S128Or, kMips64S128Or)                               \
+  V(S128Xor, kMips64S128Xor)                             \
+  V(S128AndNot, kMips64S128AndNot)
 
 void InstructionSelector::VisitS128Zero(Node* node) {
   Mips64OperandGenerator g(this);
@@ -2795,13 +2880,20 @@ void InstructionSelector::VisitS128Zero(Node* node) {
     VisitRR(this, kMips64##Type##Splat, node);               \
   }
 SIMD_TYPE_LIST(SIMD_VISIT_SPLAT)
+SIMD_VISIT_SPLAT(F64x2)
 #undef SIMD_VISIT_SPLAT
 
-#define SIMD_VISIT_EXTRACT_LANE(Type)                              \
-  void InstructionSelector::Visit##Type##ExtractLane(Node* node) { \
-    VisitRRI(this, kMips64##Type##ExtractLane, node);              \
-  }
-SIMD_TYPE_LIST(SIMD_VISIT_EXTRACT_LANE)
+#define SIMD_VISIT_EXTRACT_LANE(Type, Sign)                              \
+  void InstructionSelector::Visit##Type##ExtractLane##Sign(Node* node) { \
+    VisitRRI(this, kMips64##Type##ExtractLane##Sign, node);              \
+  }
+SIMD_VISIT_EXTRACT_LANE(F64x2, )
+SIMD_VISIT_EXTRACT_LANE(F32x4, )
+SIMD_VISIT_EXTRACT_LANE(I32x4, )
+SIMD_VISIT_EXTRACT_LANE(I16x8, U)
+SIMD_VISIT_EXTRACT_LANE(I16x8, S)
+SIMD_VISIT_EXTRACT_LANE(I8x16, U)
+SIMD_VISIT_EXTRACT_LANE(I8x16, S)
 #undef SIMD_VISIT_EXTRACT_LANE
 
 #define SIMD_VISIT_REPLACE_LANE(Type)                              \
@@ -2809,6 +2901,7 @@ SIMD_TYPE_LIST(SIMD_VISIT_EXTRACT_LANE)
     VisitRRIR(this, kMips64##Type##ReplaceLane, node);             \
   }
 SIMD_TYPE_LIST(SIMD_VISIT_REPLACE_LANE)
+SIMD_VISIT_REPLACE_LANE(F64x2)
 #undef SIMD_VISIT_REPLACE_LANE
 
 #define SIMD_VISIT_UNOP(Name, instruction)            \
@@ -2947,6 +3040,17 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
        g.UseImmediate(Pack4Lanes(shuffle + 12)));
 }
 
+void InstructionSelector::VisitS8x16Swizzle(Node* node) {
+  Mips64OperandGenerator g(this);
+  InstructionOperand temps[] = {g.TempSimd128Register()};
+  // We don't want input 0 or input 1 to be the same as output, since we will
+  // modify output before do the calculation.
+  Emit(kMips64S8x16Swizzle, g.DefineAsRegister(node),
+       g.UseUniqueRegister(node->InputAt(0)),
+       g.UseUniqueRegister(node->InputAt(1)),
+       arraysize(temps), temps);
+}
+
 void InstructionSelector::VisitSignExtendWord8ToInt32(Node* node) {
   Mips64OperandGenerator g(this);
   Emit(kMips64Seb, g.DefineAsRegister(node), g.UseRegister(node->InputAt(0)));
diff --git a/deps/v8/src/compiler/backend/ppc/code-generator-ppc.cc b/deps/v8/src/compiler/backend/ppc/code-generator-ppc.cc
index 964f88881678da..c43295f03f04c4 100644
--- a/deps/v8/src/compiler/backend/ppc/code-generator-ppc.cc
+++ b/deps/v8/src/compiler/backend/ppc/code-generator-ppc.cc
@@ -129,7 +129,8 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
  public:
   OutOfLineRecordWrite(CodeGenerator* gen, Register object, Register offset,
                        Register value, Register scratch0, Register scratch1,
-                       RecordWriteMode mode, StubCallMode stub_mode)
+                       RecordWriteMode mode, StubCallMode stub_mode,
+                       UnwindingInfoWriter* unwinding_info_writer)
       : OutOfLineCode(gen),
         object_(object),
         offset_(offset),
@@ -140,11 +141,13 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
         mode_(mode),
         stub_mode_(stub_mode),
         must_save_lr_(!gen->frame_access_state()->has_frame()),
+        unwinding_info_writer_(unwinding_info_writer),
         zone_(gen->zone()) {}
 
   OutOfLineRecordWrite(CodeGenerator* gen, Register object, int32_t offset,
                        Register value, Register scratch0, Register scratch1,
-                       RecordWriteMode mode, StubCallMode stub_mode)
+                       RecordWriteMode mode, StubCallMode stub_mode,
+                       UnwindingInfoWriter* unwinding_info_writer)
       : OutOfLineCode(gen),
         object_(object),
         offset_(no_reg),
@@ -155,6 +158,7 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
         mode_(mode),
         stub_mode_(stub_mode),
         must_save_lr_(!gen->frame_access_state()->has_frame()),
+        unwinding_info_writer_(unwinding_info_writer),
         zone_(gen->zone()) {}
 
   void Generate() final {
@@ -180,12 +184,13 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
       // We need to save and restore lr if the frame was elided.
       __ mflr(scratch0_);
       __ Push(scratch0_);
+      unwinding_info_writer_->MarkLinkRegisterOnTopOfStack(__ pc_offset());
     }
     if (mode_ == RecordWriteMode::kValueIsEphemeronKey) {
       __ CallEphemeronKeyBarrier(object_, scratch1_, save_fp_mode);
     } else if (stub_mode_ == StubCallMode::kCallWasmRuntimeStub) {
       __ CallRecordWriteStub(object_, scratch1_, remembered_set_action,
-                             save_fp_mode, wasm::WasmCode::kWasmRecordWrite);
+                             save_fp_mode, wasm::WasmCode::kRecordWrite);
     } else {
       __ CallRecordWriteStub(object_, scratch1_, remembered_set_action,
                              save_fp_mode);
@@ -194,6 +199,7 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
       // We need to save and restore lr if the frame was elided.
       __ Pop(scratch0_);
       __ mtlr(scratch0_);
+      unwinding_info_writer_->MarkPopLinkRegisterFromTopOfStack(__ pc_offset());
     }
   }
 
@@ -207,6 +213,7 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
   RecordWriteMode const mode_;
   StubCallMode stub_mode_;
   bool must_save_lr_;
+  UnwindingInfoWriter* const unwinding_info_writer_;
   Zone* zone_;
 };
 
@@ -675,6 +682,7 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen, Instruction* instr,
 
 void CodeGenerator::AssembleDeconstructFrame() {
   __ LeaveFrame(StackFrame::MANUAL);
+  unwinding_info_writer_.MarkFrameDeconstructed(__ pc_offset());
 }
 
 void CodeGenerator::AssemblePrepareTailCall() {
@@ -704,9 +712,7 @@ void CodeGenerator::AssemblePopArgumentsAdaptorFrame(Register args_reg,
            MemOperand(fp, ArgumentsAdaptorFrameConstants::kLengthOffset));
   __ SmiUntag(caller_args_count_reg);
 
-  ParameterCount callee_args_count(args_reg);
-  __ PrepareForTailCall(callee_args_count, caller_args_count_reg, scratch2,
-                        scratch3);
+  __ PrepareForTailCall(args_reg, caller_args_count_reg, scratch2, scratch3);
   __ bind(&done);
 }
 
@@ -1025,17 +1031,18 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       Label start_call;
       bool isWasmCapiFunction =
           linkage()->GetIncomingDescriptor()->IsWasmCapiFunction();
+      int offset = 9 * kInstrSize;
 #if defined(_AIX)
       // AIX/PPC64BE Linux uses a function descriptor
       int kNumParametersMask = kHasFunctionDescriptorBitMask - 1;
       num_parameters = kNumParametersMask & misc_field;
       has_function_descriptor =
           (misc_field & kHasFunctionDescriptorBitMask) != 0;
-      // AIX emits 2 extra Load instructions under CallCFunctionHelper
+      // AIX may emit 2 extra Load instructions under CallCFunctionHelper
       // due to having function descriptor.
-      constexpr int offset = 11 * kInstrSize;
-#else
-      constexpr int offset = 9 * kInstrSize;
+      if (has_function_descriptor) {
+        offset = 11 * kInstrSize;
+      }
 #endif
       if (isWasmCapiFunction) {
         __ mflr(r0);
@@ -1059,10 +1066,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       // counted from where we are binding to the label and ends at this spot.
       // If failed, replace it with the correct offset suggested. More info on
       // f5ab7d3.
-      if (isWasmCapiFunction)
+      if (isWasmCapiFunction) {
         CHECK_EQ(offset, __ SizeOfCodeGeneratedSince(&start_call));
-
-      RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
+        RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
+      }
       frame_access_state()->SetFrameAccessToDefault();
       // Ideally, we should decrement SP delta to match the change of stack
       // pointer in CallCFunction. However, for certain architectures (e.g.
@@ -1140,11 +1147,32 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     case kArchStackPointerGreaterThan: {
+      // Potentially apply an offset to the current stack pointer before the
+      // comparison to consider the size difference of an optimized frame versus
+      // the contained unoptimized frames.
+
+      Register lhs_register = sp;
+      uint32_t offset;
+
+      if (ShouldApplyOffsetToStackCheck(instr, &offset)) {
+        lhs_register = i.TempRegister(0);
+        if (is_int16(offset)) {
+          __ subi(lhs_register, sp, Operand(offset));
+        } else {
+          __ mov(kScratchReg, Operand(offset));
+          __ sub(lhs_register, sp, kScratchReg);
+        }
+      }
+
       constexpr size_t kValueIndex = 0;
       DCHECK(instr->InputAt(kValueIndex)->IsRegister());
-      __ cmpl(sp, i.InputRegister(kValueIndex), cr0);
+      __ cmpl(lhs_register, i.InputRegister(kValueIndex), cr0);
       break;
     }
+    case kArchStackCheckOffset:
+      __ LoadSmiLiteral(i.OutputRegister(),
+                        Smi::FromInt(GetStackCheckOffset()));
+      break;
     case kArchTruncateDoubleToI:
       __ TruncateDoubleToI(isolate(), zone(), i.OutputRegister(),
                            i.InputDoubleRegister(0), DetermineStubCallMode());
@@ -1163,16 +1191,16 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
           AddressingModeField::decode(instr->opcode());
       if (addressing_mode == kMode_MRI) {
         int32_t offset = i.InputInt32(1);
-        ool = new (zone())
-            OutOfLineRecordWrite(this, object, offset, value, scratch0,
-                                 scratch1, mode, DetermineStubCallMode());
+        ool = new (zone()) OutOfLineRecordWrite(
+            this, object, offset, value, scratch0, scratch1, mode,
+            DetermineStubCallMode(), &unwinding_info_writer_);
         __ StoreP(value, MemOperand(object, offset));
       } else {
         DCHECK_EQ(kMode_MRR, addressing_mode);
         Register offset(i.InputRegister(1));
-        ool = new (zone())
-            OutOfLineRecordWrite(this, object, offset, value, scratch0,
-                                 scratch1, mode, DetermineStubCallMode());
+        ool = new (zone()) OutOfLineRecordWrite(
+            this, object, offset, value, scratch0, scratch1, mode,
+            DetermineStubCallMode(), &unwinding_info_writer_);
         __ StorePX(value, MemOperand(object, offset));
       }
       __ CheckPageFlag(object, scratch0,
@@ -2388,6 +2416,7 @@ void CodeGenerator::AssembleConstructFrame() {
         }
       }
     }
+    unwinding_info_writer_.MarkFrameConstructed(__ pc_offset());
   }
 
   int required_slots =
@@ -2498,6 +2527,7 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
     __ MultiPopDoubles(double_saves);
   }
   PPCOperandConverter g(this, nullptr);
+  unwinding_info_writer_.MarkBlockWillExit();
 
   if (call_descriptor->IsCFunctionCall()) {
     AssembleDeconstructFrame();
diff --git a/deps/v8/src/compiler/backend/ppc/instruction-codes-ppc.h b/deps/v8/src/compiler/backend/ppc/instruction-codes-ppc.h
index f37529bd884eaf..82d1d40b5bc094 100644
--- a/deps/v8/src/compiler/backend/ppc/instruction-codes-ppc.h
+++ b/deps/v8/src/compiler/backend/ppc/instruction-codes-ppc.h
@@ -129,9 +129,6 @@ namespace compiler {
   V(PPC_StoreDouble)                 \
   V(PPC_ByteRev32)                   \
   V(PPC_ByteRev64)                   \
-  V(PPC_DecompressSigned)            \
-  V(PPC_DecompressPointer)           \
-  V(PPC_DecompressAny)               \
   V(PPC_CompressSigned)              \
   V(PPC_CompressPointer)             \
   V(PPC_CompressAny)                 \
diff --git a/deps/v8/src/compiler/backend/ppc/instruction-scheduler-ppc.cc b/deps/v8/src/compiler/backend/ppc/instruction-scheduler-ppc.cc
index 61c2d2be3bd5a7..3062dfb53d00de 100644
--- a/deps/v8/src/compiler/backend/ppc/instruction-scheduler-ppc.cc
+++ b/deps/v8/src/compiler/backend/ppc/instruction-scheduler-ppc.cc
@@ -110,9 +110,6 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kPPC_BitcastDoubleToInt64:
     case kPPC_ByteRev32:
     case kPPC_ByteRev64:
-    case kPPC_DecompressSigned:
-    case kPPC_DecompressPointer:
-    case kPPC_DecompressAny:
     case kPPC_CompressSigned:
     case kPPC_CompressPointer:
     case kPPC_CompressAny:
diff --git a/deps/v8/src/compiler/backend/ppc/instruction-selector-ppc.cc b/deps/v8/src/compiler/backend/ppc/instruction-selector-ppc.cc
index 2ffd6495d72e1d..a7b4e3e870239e 100644
--- a/deps/v8/src/compiler/backend/ppc/instruction-selector-ppc.cc
+++ b/deps/v8/src/compiler/backend/ppc/instruction-selector-ppc.cc
@@ -198,7 +198,6 @@ void InstructionSelector::VisitLoad(Node* node) {
       opcode = kPPC_LoadWord64;
       mode = kInt16Imm_4ByteAligned;
       break;
-    case MachineRepresentation::kCompressedSigned:   // Fall through.
     case MachineRepresentation::kCompressedPointer:  // Fall through.
     case MachineRepresentation::kCompressed:         // Fall through.
     case MachineRepresentation::kSimd128:  // Fall through.
@@ -322,7 +321,6 @@ void InstructionSelector::VisitStore(Node* node) {
 #else
       case MachineRepresentation::kWord64:  // Fall through.
 #endif
-      case MachineRepresentation::kCompressedSigned:   // Fall through.
       case MachineRepresentation::kCompressedPointer:  // Fall through.
       case MachineRepresentation::kCompressed:         // Fall through.
       case MachineRepresentation::kSimd128:  // Fall through.
@@ -550,11 +548,31 @@ void InstructionSelector::VisitWord32Xor(Node* node) {
 
 void InstructionSelector::VisitStackPointerGreaterThan(
     Node* node, FlagsContinuation* cont) {
-  Node* const value = node->InputAt(0);
-  InstructionCode opcode = kArchStackPointerGreaterThan;
+  StackCheckKind kind = StackCheckKindOf(node->op());
+  InstructionCode opcode =
+      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
 
   PPCOperandGenerator g(this);
-  EmitWithContinuation(opcode, g.UseRegister(value), cont);
+
+  // No outputs.
+  InstructionOperand* const outputs = nullptr;
+  const int output_count = 0;
+
+  // Applying an offset to this stack check requires a temp register. Offsets
+  // are only applied to the first stack check. If applying an offset, we must
+  // ensure the input and temp registers do not alias, thus kUniqueRegister.
+  InstructionOperand temps[] = {g.TempRegister()};
+  const int temp_count = (kind == StackCheckKind::kJSFunctionEntry) ? 1 : 0;
+  const auto register_mode = (kind == StackCheckKind::kJSFunctionEntry)
+                                 ? OperandGenerator::kUniqueRegister
+                                 : OperandGenerator::kRegister;
+
+  Node* const value = node->InputAt(0);
+  InstructionOperand inputs[] = {g.UseRegisterWithMode(value, register_mode)};
+  static constexpr int input_count = arraysize(inputs);
+
+  EmitWithContinuation(opcode, output_count, outputs, input_count, inputs,
+                       temp_count, temps, cont);
 }
 
 #if V8_TARGET_ARCH_PPC64
@@ -1119,6 +1137,12 @@ void InstructionSelector::VisitTryTruncateFloat64ToUint64(Node* node) {
   VisitTryTruncateDouble(this, kPPC_DoubleToUint64, node);
 }
 
+void InstructionSelector::VisitBitcastWord32ToWord64(Node* node) {
+  DCHECK(SmiValuesAre31Bits());
+  DCHECK(COMPRESS_POINTERS_BOOL);
+  EmitIdentity(node);
+}
+
 void InstructionSelector::VisitChangeInt32ToInt64(Node* node) {
   // TODO(mbrandy): inspect input to see if nop is appropriate.
   VisitRR(this, kPPC_ExtendSignWord32, node);
@@ -1144,34 +1168,6 @@ void InstructionSelector::VisitChangeUint32ToUint64(Node* node) {
   VisitRR(this, kPPC_Uint32ToUint64, node);
 }
 
-void InstructionSelector::VisitChangeTaggedToCompressed(Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeTaggedPointerToCompressedPointer(
-    Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeTaggedSignedToCompressedSigned(
-    Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeCompressedToTagged(Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeCompressedPointerToTaggedPointer(
-    Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeCompressedSignedToTaggedSigned(
-    Node* node) {
-  UNIMPLEMENTED();
-}
-
 void InstructionSelector::VisitChangeFloat64ToUint64(Node* node) {
   VisitRR(this, kPPC_DoubleToUint64, node);
 }
@@ -2092,9 +2088,20 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   UNREACHABLE();
 }
 
-void InstructionSelector::VisitI32x4Splat(Node* node) { UNIMPLEMENTED(); }
+#define SIMD_VISIT_EXTRACT_LANE(Type, Sign)                              \
+  void InstructionSelector::Visit##Type##ExtractLane##Sign(Node* node) { \
+    UNIMPLEMENTED();                                                     \
+  }
+SIMD_VISIT_EXTRACT_LANE(F64x2, )
+SIMD_VISIT_EXTRACT_LANE(F32x4, )
+SIMD_VISIT_EXTRACT_LANE(I32x4, )
+SIMD_VISIT_EXTRACT_LANE(I16x8, U)
+SIMD_VISIT_EXTRACT_LANE(I16x8, S)
+SIMD_VISIT_EXTRACT_LANE(I8x16, U)
+SIMD_VISIT_EXTRACT_LANE(I8x16, S)
+#undef SIMD_VISIT_EXTRACT_LANE
 
-void InstructionSelector::VisitI32x4ExtractLane(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitI32x4Splat(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI32x4ReplaceLane(Node* node) { UNIMPLEMENTED(); }
 
@@ -2134,8 +2141,6 @@ void InstructionSelector::VisitI32x4GeU(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI16x8Splat(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI16x8ExtractLane(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI16x8ReplaceLane(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI16x8Shl(Node* node) { UNIMPLEMENTED(); }
@@ -2188,12 +2193,18 @@ void InstructionSelector::VisitI16x8GtU(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI16x8GeU(Node* node) { UNIMPLEMENTED(); }
 
+void InstructionSelector::VisitI16x8RoundingAverageU(Node* node) {
+  UNIMPLEMENTED();
+}
+
+void InstructionSelector::VisitI8x16RoundingAverageU(Node* node) {
+  UNIMPLEMENTED();
+}
+
 void InstructionSelector::VisitI8x16Neg(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI8x16Splat(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI8x16ExtractLane(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI8x16ReplaceLane(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI8x16Add(Node* node) { UNIMPLEMENTED(); }
@@ -2244,6 +2255,8 @@ void InstructionSelector::VisitS128Xor(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitS128Not(Node* node) { UNIMPLEMENTED(); }
 
+void InstructionSelector::VisitS128AndNot(Node* node) { UNIMPLEMENTED(); }
+
 void InstructionSelector::VisitS128Zero(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF32x4Eq(Node* node) { UNIMPLEMENTED(); }
@@ -2256,8 +2269,6 @@ void InstructionSelector::VisitF32x4Le(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF32x4Splat(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitF32x4ExtractLane(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitF32x4ReplaceLane(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::EmitPrepareResults(
@@ -2398,6 +2409,54 @@ void InstructionSelector::VisitI8x16Mul(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitS8x16Shuffle(Node* node) { UNIMPLEMENTED(); }
 
+void InstructionSelector::VisitS8x16Swizzle(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Splat(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2ReplaceLane(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Abs(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Neg(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Sqrt(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Add(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Sub(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Mul(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Div(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Eq(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Ne(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Lt(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Le(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2Neg(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2Add(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2Sub(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2Shl(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2ShrS(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2ShrU(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2Mul(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Min(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Max(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitLoadTransform(Node* node) { UNIMPLEMENTED(); }
+
 // static
 MachineOperatorBuilder::Flags
 InstructionSelector::SupportedMachineOperatorFlags() {
diff --git a/deps/v8/src/compiler/backend/ppc/unwinding-info-writer-ppc.cc b/deps/v8/src/compiler/backend/ppc/unwinding-info-writer-ppc.cc
new file mode 100644
index 00000000000000..b387b1076a8adb
--- /dev/null
+++ b/deps/v8/src/compiler/backend/ppc/unwinding-info-writer-ppc.cc
@@ -0,0 +1,105 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/backend/ppc/unwinding-info-writer-ppc.h"
+#include "src/compiler/backend/instruction.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+void UnwindingInfoWriter::BeginInstructionBlock(int pc_offset,
+                                                const InstructionBlock* block) {
+  if (!enabled()) return;
+
+  block_will_exit_ = false;
+
+  DCHECK_LT(block->rpo_number().ToInt(),
+            static_cast<int>(block_initial_states_.size()));
+  const BlockInitialState* initial_state =
+      block_initial_states_[block->rpo_number().ToInt()];
+  if (!initial_state) return;
+  if (initial_state->saved_lr_ != saved_lr_) {
+    eh_frame_writer_.AdvanceLocation(pc_offset);
+    if (initial_state->saved_lr_) {
+      eh_frame_writer_.RecordRegisterSavedToStack(kLrDwarfCode,
+                                                  kSystemPointerSize);
+      eh_frame_writer_.RecordRegisterSavedToStack(fp, 0);
+    } else {
+      eh_frame_writer_.RecordRegisterFollowsInitialRule(kLrDwarfCode);
+    }
+    saved_lr_ = initial_state->saved_lr_;
+  }
+}
+
+void UnwindingInfoWriter::EndInstructionBlock(const InstructionBlock* block) {
+  if (!enabled() || block_will_exit_) return;
+
+  for (const RpoNumber& successor : block->successors()) {
+    int successor_index = successor.ToInt();
+    DCHECK_LT(successor_index, static_cast<int>(block_initial_states_.size()));
+    const BlockInitialState* existing_state =
+        block_initial_states_[successor_index];
+
+    // If we already had an entry for this BB, check that the values are the
+    // same we are trying to insert.
+    if (existing_state) {
+      DCHECK_EQ(existing_state->saved_lr_, saved_lr_);
+    } else {
+      block_initial_states_[successor_index] =
+          new (zone_) BlockInitialState(saved_lr_);
+    }
+  }
+}
+
+void UnwindingInfoWriter::MarkFrameConstructed(int at_pc) {
+  if (!enabled()) return;
+
+  // Regardless of the type of frame constructed, the relevant part of the
+  // layout is always the one in the diagram:
+  //
+  // |   ....   |         higher addresses
+  // +----------+               ^
+  // |    LR    |               |            |
+  // +----------+               |            |
+  // | saved FP |               |            |
+  // +----------+ <-- FP                     v
+  // |   ....   |                       stack growth
+  //
+  // The LR is pushed on the stack, and we can record this fact at the end of
+  // the construction, since the LR itself is not modified in the process.
+  eh_frame_writer_.AdvanceLocation(at_pc);
+  eh_frame_writer_.RecordRegisterSavedToStack(kLrDwarfCode,
+                                              kSystemPointerSize);
+  eh_frame_writer_.RecordRegisterSavedToStack(fp, 0);
+  saved_lr_ = true;
+}
+
+void UnwindingInfoWriter::MarkFrameDeconstructed(int at_pc) {
+  if (!enabled()) return;
+
+  // The lr is restored by the last operation in LeaveFrame().
+  eh_frame_writer_.AdvanceLocation(at_pc);
+  eh_frame_writer_.RecordRegisterFollowsInitialRule(kLrDwarfCode);
+  saved_lr_ = false;
+}
+
+void UnwindingInfoWriter::MarkLinkRegisterOnTopOfStack(int pc_offset) {
+  if (!enabled()) return;
+
+  eh_frame_writer_.AdvanceLocation(pc_offset);
+  eh_frame_writer_.SetBaseAddressRegisterAndOffset(sp, 0);
+  eh_frame_writer_.RecordRegisterSavedToStack(kLrDwarfCode, 0);
+}
+
+void UnwindingInfoWriter::MarkPopLinkRegisterFromTopOfStack(int pc_offset) {
+  if (!enabled()) return;
+
+  eh_frame_writer_.AdvanceLocation(pc_offset);
+  eh_frame_writer_.SetBaseAddressRegisterAndOffset(fp, 0);
+  eh_frame_writer_.RecordRegisterFollowsInitialRule(kLrDwarfCode);
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/compiler/backend/ppc/unwinding-info-writer-ppc.h b/deps/v8/src/compiler/backend/ppc/unwinding-info-writer-ppc.h
new file mode 100644
index 00000000000000..e96a48308fb609
--- /dev/null
+++ b/deps/v8/src/compiler/backend/ppc/unwinding-info-writer-ppc.h
@@ -0,0 +1,73 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_BACKEND_PPC_UNWINDING_INFO_WRITER_PPC_H_
+#define V8_COMPILER_BACKEND_PPC_UNWINDING_INFO_WRITER_PPC_H_
+
+#include "src/diagnostics/eh-frame.h"
+#include "src/flags/flags.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+class InstructionBlock;
+
+class UnwindingInfoWriter {
+ public:
+  explicit UnwindingInfoWriter(Zone* zone)
+      : zone_(zone),
+        eh_frame_writer_(zone),
+        saved_lr_(false),
+        block_will_exit_(false),
+        block_initial_states_(zone) {
+    if (enabled()) eh_frame_writer_.Initialize();
+  }
+
+  void SetNumberOfInstructionBlocks(int number) {
+    if (enabled()) block_initial_states_.resize(number);
+  }
+
+  void BeginInstructionBlock(int pc_offset, const InstructionBlock* block);
+  void EndInstructionBlock(const InstructionBlock* block);
+
+  void MarkLinkRegisterOnTopOfStack(int pc_offset);
+  void MarkPopLinkRegisterFromTopOfStack(int pc_offset);
+
+  void MarkFrameConstructed(int at_pc);
+  void MarkFrameDeconstructed(int at_pc);
+
+  void MarkBlockWillExit() { block_will_exit_ = true; }
+
+  void Finish(int code_size) {
+    if (enabled()) eh_frame_writer_.Finish(code_size);
+  }
+
+  EhFrameWriter* eh_frame_writer() {
+    return enabled() ? &eh_frame_writer_ : nullptr;
+  }
+
+ private:
+  bool enabled() const { return FLAG_perf_prof_unwinding_info; }
+
+  class BlockInitialState : public ZoneObject {
+   public:
+    explicit BlockInitialState(bool saved_lr) : saved_lr_(saved_lr) {}
+
+    bool saved_lr_;
+  };
+
+  Zone* zone_;
+  EhFrameWriter eh_frame_writer_;
+  bool saved_lr_;
+  bool block_will_exit_;
+
+  ZoneVector<const BlockInitialState*> block_initial_states_;
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_BACKEND_PPC_UNWINDING_INFO_WRITER_PPC_H_
diff --git a/deps/v8/src/compiler/backend/register-allocator-verifier.cc b/deps/v8/src/compiler/backend/register-allocator-verifier.cc
index 17e0b8ca755fb3..0090895367bfcf 100644
--- a/deps/v8/src/compiler/backend/register-allocator-verifier.cc
+++ b/deps/v8/src/compiler/backend/register-allocator-verifier.cc
@@ -48,13 +48,15 @@ void VerifyAllocatedGaps(const Instruction* instr, const char* caller_info) {
 
 RegisterAllocatorVerifier::RegisterAllocatorVerifier(
     Zone* zone, const RegisterConfiguration* config,
-    const InstructionSequence* sequence)
+    const InstructionSequence* sequence, const Frame* frame)
     : zone_(zone),
       config_(config),
       sequence_(sequence),
       constraints_(zone),
       assessments_(zone),
-      outstanding_assessments_(zone) {
+      outstanding_assessments_(zone),
+      spill_slot_delta_(frame->GetTotalFrameSlotCount() -
+                        frame->GetSpillSlotCount()) {
   constraints_.reserve(sequence->instructions().size());
   // TODO(dcarney): model unique constraints.
   // Construct OperandConstraints for all InstructionOperands, eliminating
@@ -286,11 +288,20 @@ void BlockAssessments::PerformParallelMoves(const ParallelMove* moves) {
     // The LHS of a parallel move should not have been assigned in this
     // parallel move.
     CHECK(map_for_moves_.find(move->destination()) == map_for_moves_.end());
+    // The RHS of a parallel move should not be a stale reference.
+    CHECK(!IsStaleReferenceStackSlot(move->source()));
     // Copy the assessment to the destination.
     map_for_moves_[move->destination()] = it->second;
   }
   for (auto pair : map_for_moves_) {
-    map_[pair.first] = pair.second;
+    // Re-insert the existing key for the new assignment so that it has the
+    // correct representation (which is ignored by the canonicalizing map
+    // comparator).
+    InstructionOperand op = pair.first;
+    map_.erase(op);
+    map_.insert(pair);
+    // Destination is no longer a stale reference.
+    stale_ref_stack_slots().erase(op);
   }
   map_for_moves_.clear();
 }
@@ -304,6 +315,41 @@ void BlockAssessments::DropRegisters() {
   }
 }
 
+void BlockAssessments::CheckReferenceMap(const ReferenceMap* reference_map) {
+  // First mark all existing reference stack spill slots as stale.
+  for (auto pair : map()) {
+    InstructionOperand op = pair.first;
+    if (op.IsStackSlot()) {
+      const LocationOperand* loc_op = LocationOperand::cast(&op);
+      // Only mark arguments that are spill slots as stale, the reference map
+      // doesn't track arguments or fixed stack slots, which are implicitly
+      // tracked by the GC.
+      if (CanBeTaggedOrCompressedPointer(loc_op->representation()) &&
+          loc_op->index() >= spill_slot_delta()) {
+        stale_ref_stack_slots().insert(op);
+      }
+    }
+  }
+
+  // Now remove any stack spill slots in the reference map from the list of
+  // stale slots.
+  for (auto ref_map_operand : reference_map->reference_operands()) {
+    if (ref_map_operand.IsStackSlot()) {
+      auto pair = map().find(ref_map_operand);
+      CHECK(pair != map().end());
+      stale_ref_stack_slots().erase(pair->first);
+    }
+  }
+}
+
+bool BlockAssessments::IsStaleReferenceStackSlot(InstructionOperand op) {
+  if (!op.IsStackSlot()) return false;
+
+  const LocationOperand* loc_op = LocationOperand::cast(&op);
+  return CanBeTaggedOrCompressedPointer(loc_op->representation()) &&
+         stale_ref_stack_slots().find(op) != stale_ref_stack_slots().end();
+}
+
 void BlockAssessments::Print() const {
   StdoutStream os;
   for (const auto pair : map()) {
@@ -317,6 +363,9 @@ void BlockAssessments::Print() const {
     } else {
       os << "P";
     }
+    if (stale_ref_stack_slots().find(op) != stale_ref_stack_slots().end()) {
+      os << " (stale reference)";
+    }
     os << std::endl;
   }
   os << std::endl;
@@ -326,7 +375,8 @@ BlockAssessments* RegisterAllocatorVerifier::CreateForBlock(
     const InstructionBlock* block) {
   RpoNumber current_block_id = block->rpo_number();
 
-  BlockAssessments* ret = new (zone()) BlockAssessments(zone());
+  BlockAssessments* ret =
+      new (zone()) BlockAssessments(zone(), spill_slot_delta());
   if (block->PredecessorCount() == 0) {
     // TODO(mtrofin): the following check should hold, however, in certain
     // unit tests it is invalidated by the last block. Investigate and
@@ -360,6 +410,12 @@ BlockAssessments* RegisterAllocatorVerifier::CreateForBlock(
               operand, new (zone()) PendingAssessment(zone(), block, operand)));
         }
       }
+
+      // Any references stack slots that became stale in predecessors will be
+      // stale here.
+      ret->stale_ref_stack_slots().insert(
+          pred_assessments->stale_ref_stack_slots().begin(),
+          pred_assessments->stale_ref_stack_slots().end());
     }
   }
   return ret;
@@ -463,6 +519,9 @@ void RegisterAllocatorVerifier::ValidateUse(
   CHECK(iterator != current_assessments->map().end());
   Assessment* assessment = iterator->second;
 
+  // The operand shouldn't be a stale reference stack slot.
+  CHECK(!current_assessments->IsStaleReferenceStackSlot(op));
+
   switch (assessment->kind()) {
     case Final:
       CHECK_EQ(FinalAssessment::cast(assessment)->virtual_register(),
@@ -510,6 +569,9 @@ void RegisterAllocatorVerifier::VerifyGapMoves() {
       if (instr->IsCall()) {
         block_assessments->DropRegisters();
       }
+      if (instr->HasReferenceMap()) {
+        block_assessments->CheckReferenceMap(instr->reference_map());
+      }
       for (size_t i = 0; i < instr->OutputCount(); ++i, ++count) {
         int virtual_register = op_constraints[count].virtual_register_;
         block_assessments->AddDefinition(*instr->OutputAt(i), virtual_register);
@@ -536,6 +598,9 @@ void RegisterAllocatorVerifier::VerifyGapMoves() {
       int vreg = pair.second;
       auto found_op = block_assessments->map().find(op);
       CHECK(found_op != block_assessments->map().end());
+      // This block is a jump back to the loop header, ensure that the op hasn't
+      // become a stale reference during the blocks in the loop.
+      CHECK(!block_assessments->IsStaleReferenceStackSlot(op));
       switch (found_op->second->kind()) {
         case Final:
           CHECK_EQ(FinalAssessment::cast(found_op->second)->virtual_register(),
diff --git a/deps/v8/src/compiler/backend/register-allocator-verifier.h b/deps/v8/src/compiler/backend/register-allocator-verifier.h
index 7110c2eb42c6f4..fba7a0b535de17 100644
--- a/deps/v8/src/compiler/backend/register-allocator-verifier.h
+++ b/deps/v8/src/compiler/backend/register-allocator-verifier.h
@@ -133,15 +133,25 @@ struct OperandAsKeyLess {
 class BlockAssessments : public ZoneObject {
  public:
   using OperandMap = ZoneMap<InstructionOperand, Assessment*, OperandAsKeyLess>;
-  explicit BlockAssessments(Zone* zone)
-      : map_(zone), map_for_moves_(zone), zone_(zone) {}
-  void Drop(InstructionOperand operand) { map_.erase(operand); }
+  using OperandSet = ZoneSet<InstructionOperand, OperandAsKeyLess>;
+  explicit BlockAssessments(Zone* zone, int spill_slot_delta)
+      : map_(zone),
+        map_for_moves_(zone),
+        stale_ref_stack_slots_(zone),
+        spill_slot_delta_(spill_slot_delta),
+        zone_(zone) {}
+  void Drop(InstructionOperand operand) {
+    map_.erase(operand);
+    stale_ref_stack_slots_.erase(operand);
+  }
   void DropRegisters();
   void AddDefinition(InstructionOperand operand, int virtual_register) {
     auto existent = map_.find(operand);
     if (existent != map_.end()) {
       // Drop the assignment
       map_.erase(existent);
+      // Destination operand is no longer a stale reference.
+      stale_ref_stack_slots_.erase(operand);
     }
     map_.insert(
         std::make_pair(operand, new (zone_) FinalAssessment(virtual_register)));
@@ -151,17 +161,32 @@ class BlockAssessments : public ZoneObject {
   void PerformParallelMoves(const ParallelMove* moves);
   void CopyFrom(const BlockAssessments* other) {
     CHECK(map_.empty());
+    CHECK(stale_ref_stack_slots_.empty());
     CHECK_NOT_NULL(other);
     map_.insert(other->map_.begin(), other->map_.end());
+    stale_ref_stack_slots_.insert(other->stale_ref_stack_slots_.begin(),
+                                  other->stale_ref_stack_slots_.end());
   }
+  void CheckReferenceMap(const ReferenceMap* reference_map);
+  bool IsStaleReferenceStackSlot(InstructionOperand op);
 
   OperandMap& map() { return map_; }
   const OperandMap& map() const { return map_; }
+
+  OperandSet& stale_ref_stack_slots() { return stale_ref_stack_slots_; }
+  const OperandSet& stale_ref_stack_slots() const {
+    return stale_ref_stack_slots_;
+  }
+
+  int spill_slot_delta() const { return spill_slot_delta_; }
+
   void Print() const;
 
  private:
   OperandMap map_;
   OperandMap map_for_moves_;
+  OperandSet stale_ref_stack_slots_;
+  int spill_slot_delta_;
   Zone* zone_;
 
   DISALLOW_COPY_AND_ASSIGN(BlockAssessments);
@@ -170,7 +195,8 @@ class BlockAssessments : public ZoneObject {
 class RegisterAllocatorVerifier final : public ZoneObject {
  public:
   RegisterAllocatorVerifier(Zone* zone, const RegisterConfiguration* config,
-                            const InstructionSequence* sequence);
+                            const InstructionSequence* sequence,
+                            const Frame* frame);
 
   void VerifyAssignment(const char* caller_info);
   void VerifyGapMoves();
@@ -234,6 +260,7 @@ class RegisterAllocatorVerifier final : public ZoneObject {
   const RegisterConfiguration* config() { return config_; }
   const InstructionSequence* sequence() const { return sequence_; }
   Constraints* constraints() { return &constraints_; }
+  int spill_slot_delta() const { return spill_slot_delta_; }
 
   static void VerifyInput(const OperandConstraint& constraint);
   static void VerifyTemp(const OperandConstraint& constraint);
@@ -260,6 +287,7 @@ class RegisterAllocatorVerifier final : public ZoneObject {
   Constraints constraints_;
   ZoneMap<RpoNumber, BlockAssessments*> assessments_;
   ZoneMap<RpoNumber, DelayedAssessments*> outstanding_assessments_;
+  int spill_slot_delta_;
   // TODO(chromium:725559): remove after we understand this bug's root cause.
   const char* caller_info_ = nullptr;
 
diff --git a/deps/v8/src/compiler/backend/register-allocator.cc b/deps/v8/src/compiler/backend/register-allocator.cc
index 945554eb32361c..f37faf850d1586 100644
--- a/deps/v8/src/compiler/backend/register-allocator.cc
+++ b/deps/v8/src/compiler/backend/register-allocator.cc
@@ -78,7 +78,6 @@ int GetByteWidth(MachineRepresentation rep) {
     case MachineRepresentation::kTaggedSigned:
     case MachineRepresentation::kTaggedPointer:
     case MachineRepresentation::kTagged:
-    case MachineRepresentation::kCompressedSigned:
     case MachineRepresentation::kCompressedPointer:
     case MachineRepresentation::kCompressed:
       // TODO(ishell): kTaggedSize once half size locations are supported.
@@ -3394,6 +3393,18 @@ RpoNumber LinearScanAllocator::ChooseOneOfTwoPredecessorStates(
              : current_block->predecessors()[1];
 }
 
+bool LinearScanAllocator::CheckConflict(MachineRepresentation rep, int reg,
+                                        RangeWithRegisterSet* to_be_live) {
+  for (RangeWithRegister range_with_reg : *to_be_live) {
+    if (data()->config()->AreAliases(range_with_reg.range->representation(),
+                                     range_with_reg.expected_register, rep,
+                                     reg)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 void LinearScanAllocator::ComputeStateFromManyPredecessors(
     InstructionBlock* current_block, RangeWithRegisterSet* to_be_live) {
   struct Vote {
@@ -3441,24 +3452,33 @@ void LinearScanAllocator::ComputeStateFromManyPredecessors(
                             std::function<bool(TopLevelLiveRange*)> filter,
                             RangeWithRegisterSet* to_be_live,
                             bool* taken_registers) {
+    bool check_aliasing = !kSimpleFPAliasing && check_fp_aliasing();
     for (const auto& val : counts) {
       if (!filter(val.first)) continue;
       if (val.second.count >= majority) {
         int register_max = 0;
         int reg = kUnassignedRegister;
-        for (int idx = 0; idx < RegisterConfiguration::kMaxRegisters; idx++) {
+        bool conflict = false;
+        int num_regs = num_registers();
+        int num_codes = num_allocatable_registers();
+        const int* codes = allocatable_register_codes();
+        MachineRepresentation rep = val.first->representation();
+        if (check_aliasing && (rep == MachineRepresentation::kFloat32 ||
+                               rep == MachineRepresentation::kSimd128))
+          GetFPRegisterSet(rep, &num_regs, &num_codes, &codes);
+        for (int idx = 0; idx < num_regs; idx++) {
           int uses = val.second.used_registers[idx];
           if (uses == 0) continue;
-          if (uses > register_max) {
-            reg = idx;
-            register_max = val.second.used_registers[idx];
-          } else if (taken_registers[reg] && uses == register_max) {
+          if (uses > register_max || (conflict && uses == register_max)) {
             reg = idx;
+            register_max = uses;
+            conflict = check_aliasing ? CheckConflict(rep, reg, to_be_live)
+                                      : taken_registers[reg];
           }
         }
-        if (taken_registers[reg]) {
+        if (conflict) {
           reg = kUnassignedRegister;
-        } else {
+        } else if (!check_aliasing) {
           taken_registers[reg] = true;
         }
         to_be_live->emplace(val.first, reg);
@@ -3857,10 +3877,6 @@ void LinearScanAllocator::AllocateRegisters() {
             SpillNotLiveRanges(&to_be_live, next_block_boundary, spill_mode);
             ReloadLiveRanges(to_be_live, next_block_boundary);
           }
-
-          // TODO(herhut) Check removal.
-          // Now forward to current position
-          ForwardStateTo(next_block_boundary);
         }
         // Update block information
         last_block = current_block->rpo_number();
@@ -4243,7 +4259,7 @@ int LinearScanAllocator::PickRegisterThatIsAvailableLongest(
   // set before the call. Hence, the argument registers always get ignored,
   // as their available time is shorter.
   int reg = (hint_reg == kUnassignedRegister) ? codes[0] : hint_reg;
-  int current_free = -1;
+  int current_free = free_until_pos[reg].ToInstructionIndex();
   for (int i = 0; i < num_codes; ++i) {
     int code = codes[i];
     // Prefer registers that have no fixed uses to avoid blocking later hints.
diff --git a/deps/v8/src/compiler/backend/register-allocator.h b/deps/v8/src/compiler/backend/register-allocator.h
index 17d664e5077897..6c943dbe68fbcb 100644
--- a/deps/v8/src/compiler/backend/register-allocator.h
+++ b/deps/v8/src/compiler/backend/register-allocator.h
@@ -485,10 +485,10 @@ class V8_EXPORT_PRIVATE UsePosition final
   static UsePositionHintType HintTypeForOperand(const InstructionOperand& op);
 
  private:
-  using TypeField = BitField<UsePositionType, 0, 2>;
-  using HintTypeField = BitField<UsePositionHintType, 2, 3>;
-  using RegisterBeneficialField = BitField<bool, 5, 1>;
-  using AssignedRegisterField = BitField<int32_t, 6, 6>;
+  using TypeField = base::BitField<UsePositionType, 0, 2>;
+  using HintTypeField = base::BitField<UsePositionHintType, 2, 3>;
+  using RegisterBeneficialField = base::BitField<bool, 5, 1>;
+  using AssignedRegisterField = base::BitField<int32_t, 6, 6>;
 
   InstructionOperand* const operand_;
   void* hint_;
@@ -669,12 +669,12 @@ class V8_EXPORT_PRIVATE LiveRange : public NON_EXPORTED_BASE(ZoneObject) {
   void VerifyPositions() const;
   void VerifyIntervals() const;
 
-  using SpilledField = BitField<bool, 0, 1>;
+  using SpilledField = base::BitField<bool, 0, 1>;
   // Bits (1,7[ are used by TopLevelLiveRange.
-  using AssignedRegisterField = BitField<int32_t, 7, 6>;
-  using RepresentationField = BitField<MachineRepresentation, 13, 8>;
-  using RecombineField = BitField<bool, 21, 1>;
-  using ControlFlowRegisterHint = BitField<uint8_t, 22, 6>;
+  using AssignedRegisterField = base::BitField<int32_t, 7, 6>;
+  using RepresentationField = base::BitField<MachineRepresentation, 13, 8>;
+  using RecombineField = base::BitField<bool, 21, 1>;
+  using ControlFlowRegisterHint = base::BitField<uint8_t, 22, 6>;
   // Bit 28 is used by TopLevelLiveRange.
 
   // Unique among children and splinters of the same virtual register.
@@ -985,11 +985,11 @@ class V8_EXPORT_PRIVATE TopLevelLiveRange final : public LiveRange {
   friend class LiveRange;
   void SetSplinteredFrom(TopLevelLiveRange* splinter_parent);
 
-  using HasSlotUseField = BitField<SlotUseKind, 1, 2>;
-  using IsPhiField = BitField<bool, 3, 1>;
-  using IsNonLoopPhiField = BitField<bool, 4, 1>;
-  using SpillTypeField = BitField<SpillType, 5, 2>;
-  using DeferredFixedField = BitField<bool, 28, 1>;
+  using HasSlotUseField = base::BitField<SlotUseKind, 1, 2>;
+  using IsPhiField = base::BitField<bool, 3, 1>;
+  using IsNonLoopPhiField = base::BitField<bool, 4, 1>;
+  using SpillTypeField = base::BitField<SpillType, 5, 2>;
+  using DeferredFixedField = base::BitField<bool, 28, 1>;
 
   int vreg_;
   int last_child_id_;
@@ -1365,6 +1365,8 @@ class LinearScanAllocator final : public RegisterAllocator {
                                    RpoNumber predecessor);
   RpoNumber ChooseOneOfTwoPredecessorStates(InstructionBlock* current_block,
                                             LifetimePosition boundary);
+  bool CheckConflict(MachineRepresentation rep, int reg,
+                     RangeWithRegisterSet* to_be_live);
   void ComputeStateFromManyPredecessors(InstructionBlock* current_block,
                                         RangeWithRegisterSet* to_be_live);
 
diff --git a/deps/v8/src/compiler/backend/s390/code-generator-s390.cc b/deps/v8/src/compiler/backend/s390/code-generator-s390.cc
index d0f97eca57b08c..5b7d0adb095e17 100644
--- a/deps/v8/src/compiler/backend/s390/code-generator-s390.cc
+++ b/deps/v8/src/compiler/backend/s390/code-generator-s390.cc
@@ -168,7 +168,8 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
  public:
   OutOfLineRecordWrite(CodeGenerator* gen, Register object, Register offset,
                        Register value, Register scratch0, Register scratch1,
-                       RecordWriteMode mode, StubCallMode stub_mode)
+                       RecordWriteMode mode, StubCallMode stub_mode,
+                       UnwindingInfoWriter* unwinding_info_writer)
       : OutOfLineCode(gen),
         object_(object),
         offset_(offset),
@@ -179,11 +180,13 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
         mode_(mode),
         stub_mode_(stub_mode),
         must_save_lr_(!gen->frame_access_state()->has_frame()),
+        unwinding_info_writer_(unwinding_info_writer),
         zone_(gen->zone()) {}
 
   OutOfLineRecordWrite(CodeGenerator* gen, Register object, int32_t offset,
                        Register value, Register scratch0, Register scratch1,
-                       RecordWriteMode mode, StubCallMode stub_mode)
+                       RecordWriteMode mode, StubCallMode stub_mode,
+                       UnwindingInfoWriter* unwinding_info_writer)
       : OutOfLineCode(gen),
         object_(object),
         offset_(no_reg),
@@ -194,6 +197,7 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
         mode_(mode),
         stub_mode_(stub_mode),
         must_save_lr_(!gen->frame_access_state()->has_frame()),
+        unwinding_info_writer_(unwinding_info_writer),
         zone_(gen->zone()) {}
 
   void Generate() final {
@@ -217,12 +221,13 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
     if (must_save_lr_) {
       // We need to save and restore r14 if the frame was elided.
       __ Push(r14);
+      unwinding_info_writer_->MarkLinkRegisterOnTopOfStack(__ pc_offset());
     }
     if (mode_ == RecordWriteMode::kValueIsEphemeronKey) {
       __ CallEphemeronKeyBarrier(object_, scratch1_, save_fp_mode);
     } else if (stub_mode_ == StubCallMode::kCallWasmRuntimeStub) {
       __ CallRecordWriteStub(object_, scratch1_, remembered_set_action,
-                             save_fp_mode, wasm::WasmCode::kWasmRecordWrite);
+                             save_fp_mode, wasm::WasmCode::kRecordWrite);
     } else {
       __ CallRecordWriteStub(object_, scratch1_, remembered_set_action,
                              save_fp_mode);
@@ -230,6 +235,7 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
     if (must_save_lr_) {
       // We need to save and restore r14 if the frame was elided.
       __ Pop(r14);
+      unwinding_info_writer_->MarkPopLinkRegisterFromTopOfStack(__ pc_offset());
     }
   }
 
@@ -243,6 +249,7 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
   RecordWriteMode const mode_;
   StubCallMode stub_mode_;
   bool must_save_lr_;
+  UnwindingInfoWriter* const unwinding_info_writer_;
   Zone* zone_;
 };
 
@@ -1164,6 +1171,7 @@ static inline int AssembleUnaryOp(Instruction* instr, _R _r, _M _m, _I _i) {
 
 void CodeGenerator::AssembleDeconstructFrame() {
   __ LeaveFrame(StackFrame::MANUAL);
+  unwinding_info_writer_.MarkFrameDeconstructed(__ pc_offset());
 }
 
 void CodeGenerator::AssemblePrepareTailCall() {
@@ -1193,9 +1201,7 @@ void CodeGenerator::AssemblePopArgumentsAdaptorFrame(Register args_reg,
            MemOperand(fp, ArgumentsAdaptorFrameConstants::kLengthOffset));
   __ SmiUntag(caller_args_count_reg);
 
-  ParameterCount callee_args_count(args_reg);
-  __ PrepareForTailCall(callee_args_count, caller_args_count_reg, scratch2,
-                        scratch3);
+  __ PrepareForTailCall(args_reg, caller_args_count_reg, scratch2, scratch3);
   __ bind(&done);
 }
 
@@ -1525,7 +1531,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ CallCFunction(func, num_parameters);
       }
       __ bind(&return_location);
-      RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
+      if (linkage()->GetIncomingDescriptor()->IsWasmCapiFunction()) {
+        RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
+      }
       frame_access_state()->SetFrameAccessToDefault();
       // Ideally, we should decrement SP delta to match the change of stack
       // pointer in CallCFunction. However, for certain architectures (e.g.
@@ -1597,11 +1605,27 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     case kArchStackPointerGreaterThan: {
+      // Potentially apply an offset to the current stack pointer before the
+      // comparison to consider the size difference of an optimized frame versus
+      // the contained unoptimized frames.
+
+      Register lhs_register = sp;
+      uint32_t offset;
+
+      if (ShouldApplyOffsetToStackCheck(instr, &offset)) {
+        lhs_register = i.TempRegister(0);
+        __ SubP(lhs_register, sp, Operand(offset));
+      }
+
       constexpr size_t kValueIndex = 0;
       DCHECK(instr->InputAt(kValueIndex)->IsRegister());
-      __ CmpLogicalP(sp, i.InputRegister(kValueIndex));
+      __ CmpLogicalP(lhs_register, i.InputRegister(kValueIndex));
       break;
     }
+    case kArchStackCheckOffset:
+      __ LoadSmiLiteral(i.OutputRegister(),
+                        Smi::FromInt(GetStackCheckOffset()));
+      break;
     case kArchTruncateDoubleToI:
       __ TruncateDoubleToI(isolate(), zone(), i.OutputRegister(),
                            i.InputDoubleRegister(0), DetermineStubCallMode());
@@ -1619,16 +1643,16 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
           AddressingModeField::decode(instr->opcode());
       if (addressing_mode == kMode_MRI) {
         int32_t offset = i.InputInt32(1);
-        ool = new (zone())
-            OutOfLineRecordWrite(this, object, offset, value, scratch0,
-                                 scratch1, mode, DetermineStubCallMode());
+        ool = new (zone()) OutOfLineRecordWrite(
+            this, object, offset, value, scratch0, scratch1, mode,
+            DetermineStubCallMode(), &unwinding_info_writer_);
         __ StoreP(value, MemOperand(object, offset));
       } else {
         DCHECK_EQ(kMode_MRR, addressing_mode);
         Register offset(i.InputRegister(1));
-        ool = new (zone())
-            OutOfLineRecordWrite(this, object, offset, value, scratch0,
-                                 scratch1, mode, DetermineStubCallMode());
+        ool = new (zone()) OutOfLineRecordWrite(
+            this, object, offset, value, scratch0, scratch1, mode,
+            DetermineStubCallMode(), &unwinding_info_writer_);
         __ StoreP(value, MemOperand(object, offset));
       }
       __ CheckPageFlag(object, scratch0,
@@ -2517,6 +2541,27 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kS390_LoadReverse64RR:
       __ lrvgr(i.OutputRegister(), i.InputRegister(0));
       break;
+    case kS390_LoadReverseSimd128RR:
+      __ vlgv(r0, i.InputSimd128Register(0), MemOperand(r0, 0), Condition(3));
+      __ vlgv(r1, i.InputSimd128Register(0), MemOperand(r0, 1), Condition(3));
+      __ lrvgr(r0, r0);
+      __ lrvgr(r1, r1);
+      __ vlvg(i.OutputSimd128Register(), r0, MemOperand(r0, 1), Condition(3));
+      __ vlvg(i.OutputSimd128Register(), r1, MemOperand(r0, 0), Condition(3));
+      break;
+    case kS390_LoadReverseSimd128: {
+      AddressingMode mode = kMode_None;
+      MemOperand operand = i.MemoryOperand(&mode);
+      if (CpuFeatures::IsSupported(VECTOR_ENHANCE_FACILITY_2)) {
+        __ vlbr(i.OutputSimd128Register(), operand, Condition(4));
+      } else {
+        __ lrvg(r0, operand);
+        __ lrvg(r1, MemOperand(operand.rx(), operand.rb(),
+                               operand.offset() + kBitsPerByte));
+        __ vlvgp(i.OutputSimd128Register(), r1, r0);
+      }
+      break;
+    }
     case kS390_LoadWord64:
       ASSEMBLE_LOAD_INTEGER(lg);
       EmitWordLoadPoisoningIfNeeded(this, instr, i);
@@ -2535,6 +2580,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kS390_LoadDouble:
       ASSEMBLE_LOAD_FLOAT(LoadDouble);
       break;
+    case kS390_LoadSimd128: {
+      AddressingMode mode = kMode_None;
+      MemOperand operand = i.MemoryOperand(&mode);
+      __ vl(i.OutputSimd128Register(), operand, Condition(0));
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
+      break;
+    }
     case kS390_StoreWord8:
       ASSEMBLE_STORE_INTEGER(StoreByte);
       break;
@@ -2558,12 +2610,36 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kS390_StoreReverse64:
       ASSEMBLE_STORE_INTEGER(strvg);
       break;
+    case kS390_StoreReverseSimd128: {
+      size_t index = 0;
+      AddressingMode mode = kMode_None;
+      MemOperand operand = i.MemoryOperand(&mode, &index);
+      if (CpuFeatures::IsSupported(VECTOR_ENHANCE_FACILITY_2)) {
+        __ vstbr(i.InputSimd128Register(index), operand, Condition(4));
+      } else {
+        __ vlgv(r0, i.InputSimd128Register(index), MemOperand(r0, 1),
+                Condition(3));
+        __ vlgv(r1, i.InputSimd128Register(index), MemOperand(r0, 0),
+                Condition(3));
+        __ strvg(r0, operand);
+        __ strvg(r1, MemOperand(operand.rx(), operand.rb(),
+                                operand.offset() + kBitsPerByte));
+      }
+      break;
+    }
     case kS390_StoreFloat32:
       ASSEMBLE_STORE_FLOAT32();
       break;
     case kS390_StoreDouble:
       ASSEMBLE_STORE_DOUBLE();
       break;
+    case kS390_StoreSimd128: {
+      size_t index = 0;
+      AddressingMode mode = kMode_None;
+      MemOperand operand = i.MemoryOperand(&mode, &index);
+      __ vst(i.InputSimd128Register(index), operand, Condition(0));
+      break;
+    }
     case kS390_Lay:
       __ lay(i.OutputRegister(), i.MemoryOperand());
       break;
@@ -2810,6 +2886,613 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kS390_Word64AtomicCompareExchangeUint64:
       ASSEMBLE_ATOMIC64_COMP_EXCHANGE_WORD64();
       break;
+      // vector replicate element
+    case kS390_F32x4Splat: {
+#ifdef V8_TARGET_BIG_ENDIAN
+      __ vrep(i.OutputSimd128Register(), i.InputDoubleRegister(0), Operand(0),
+              Condition(2));
+#else
+      __ vrep(i.OutputSimd128Register(), i.InputDoubleRegister(0), Operand(1),
+              Condition(2));
+#endif
+      break;
+    }
+    case kS390_I32x4Splat: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vlvg(dst, i.InputRegister(0), MemOperand(r0, 0), Condition(2));
+      __ vrep(dst, dst, Operand(0), Condition(2));
+      break;
+    }
+    case kS390_I16x8Splat: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vlvg(dst, i.InputRegister(0), MemOperand(r0, 0), Condition(1));
+      __ vrep(dst, dst, Operand(0), Condition(1));
+      break;
+    }
+    case kS390_I8x16Splat: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vlvg(dst, i.InputRegister(0), MemOperand(r0, 0), Condition(0));
+      __ vrep(dst, dst, Operand(0), Condition(0));
+      break;
+    }
+    // vector extract element
+    case kS390_F32x4ExtractLane: {
+      __ vrep(i.OutputDoubleRegister(), i.InputSimd128Register(0),
+              Operand(3 - i.InputInt8(1)), Condition(2));
+      break;
+    }
+    case kS390_I32x4ExtractLane: {
+      __ vlgv(i.OutputRegister(), i.InputSimd128Register(0),
+              MemOperand(r0, 3 - i.InputInt8(1)), Condition(2));
+      break;
+    }
+    case kS390_I16x8ExtractLaneU: {
+      __ vlgv(i.OutputRegister(), i.InputSimd128Register(0),
+              MemOperand(r0, 7 - i.InputInt8(1)), Condition(1));
+      break;
+    }
+    case kS390_I16x8ExtractLaneS: {
+      __ vlgv(i.OutputRegister(), i.InputSimd128Register(0),
+              MemOperand(r0, 7 - i.InputInt8(1)), Condition(1));
+      break;
+    }
+    case kS390_I8x16ExtractLaneU: {
+      __ vlgv(i.OutputRegister(), i.InputSimd128Register(0),
+              MemOperand(r0, 15 - i.InputInt8(1)), Condition(0));
+      break;
+    }
+    case kS390_I8x16ExtractLaneS: {
+      __ vlgv(i.OutputRegister(), i.InputSimd128Register(0),
+              MemOperand(r0, 15 - i.InputInt8(1)), Condition(0));
+      break;
+    }
+    // vector replace element
+    case kS390_F32x4ReplaceLane: {
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      if (src != dst) {
+        __ vlr(dst, src, Condition(0), Condition(0), Condition(0));
+      }
+      __ lgdr(kScratchReg, i.InputDoubleRegister(2));
+      __ srlg(kScratchReg, kScratchReg, Operand(32));
+      __ vlvg(i.OutputSimd128Register(), kScratchReg,
+              MemOperand(r0, 3 - i.InputInt8(1)), Condition(2));
+      break;
+    }
+    case kS390_I32x4ReplaceLane: {
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      if (src != dst) {
+        __ vlr(dst, src, Condition(0), Condition(0), Condition(0));
+      }
+      __ vlvg(i.OutputSimd128Register(), i.InputRegister(2),
+              MemOperand(r0, 3 - i.InputInt8(1)), Condition(2));
+      break;
+    }
+    case kS390_I16x8ReplaceLane: {
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      if (src != dst) {
+        __ vlr(dst, src, Condition(0), Condition(0), Condition(0));
+      }
+      __ vlvg(i.OutputSimd128Register(), i.InputRegister(2),
+              MemOperand(r0, 7 - i.InputInt8(1)), Condition(1));
+      break;
+    }
+    case kS390_I8x16ReplaceLane: {
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      if (src != dst) {
+        __ vlr(dst, src, Condition(0), Condition(0), Condition(0));
+      }
+      __ vlvg(i.OutputSimd128Register(), i.InputRegister(2),
+              MemOperand(r0, 15 - i.InputInt8(1)), Condition(0));
+      break;
+    }
+    // vector binops
+    case kS390_F32x4Add: {
+      __ vfa(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0),
+             Condition(2));
+      break;
+    }
+    case kS390_F32x4AddHoriz: {
+      Simd128Register src0 = i.InputSimd128Register(0);
+      Simd128Register src1 = i.InputSimd128Register(1);
+      Simd128Register dst = i.OutputSimd128Register();
+      DoubleRegister tempFPReg1 = i.ToSimd128Register(instr->TempAt(0));
+      DoubleRegister tempFPReg2 = i.ToSimd128Register(instr->TempAt(1));
+      constexpr int shift_bits = 32;
+      // generate first operand
+      __ vpk(dst, src1, src0, Condition(0), Condition(0), Condition(3));
+      // generate second operand
+      __ vesrl(tempFPReg1, src0, MemOperand(r0, shift_bits), Condition(3));
+      __ vesrl(tempFPReg2, src1, MemOperand(r0, shift_bits), Condition(3));
+      __ vpk(kScratchDoubleReg, tempFPReg2, tempFPReg1, Condition(0),
+             Condition(0), Condition(3));
+      // add the operands
+      __ vfa(dst, kScratchDoubleReg, dst, Condition(0), Condition(0),
+             Condition(2));
+      break;
+    }
+    case kS390_F32x4Sub: {
+      __ vfs(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0),
+             Condition(2));
+      break;
+    }
+    case kS390_F32x4Mul: {
+      __ vfm(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0),
+             Condition(2));
+      break;
+    }
+    case kS390_I32x4Add: {
+      __ va(i.OutputSimd128Register(), i.InputSimd128Register(0),
+            i.InputSimd128Register(1), Condition(0), Condition(0),
+            Condition(2));
+      break;
+    }
+    case kS390_I32x4AddHoriz: {
+      Simd128Register src0 = i.InputSimd128Register(0);
+      Simd128Register src1 = i.InputSimd128Register(1);
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vs(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg,
+            Condition(0), Condition(0), Condition(2));
+      __ vsumg(dst, src0, kScratchDoubleReg, Condition(0), Condition(0),
+               Condition(2));
+      __ vsumg(kScratchDoubleReg, src1, kScratchDoubleReg, Condition(0),
+               Condition(0), Condition(2));
+      __ vpk(dst, kScratchDoubleReg, dst, Condition(0), Condition(0),
+             Condition(3));
+      break;
+    }
+    case kS390_I32x4Sub: {
+      __ vs(i.OutputSimd128Register(), i.InputSimd128Register(0),
+            i.InputSimd128Register(1), Condition(0), Condition(0),
+            Condition(2));
+      break;
+    }
+    case kS390_I32x4Mul: {
+      __ vml(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0),
+             Condition(2));
+      break;
+    }
+    case kS390_I16x8Add: {
+      __ va(i.OutputSimd128Register(), i.InputSimd128Register(0),
+            i.InputSimd128Register(1), Condition(0), Condition(0),
+            Condition(1));
+      break;
+    }
+    case kS390_I16x8AddHoriz: {
+      Simd128Register src0 = i.InputSimd128Register(0);
+      Simd128Register src1 = i.InputSimd128Register(1);
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vs(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg,
+            Condition(0), Condition(0), Condition(1));
+      __ vsum(dst, src0, kScratchDoubleReg, Condition(0), Condition(0),
+              Condition(1));
+      __ vsum(kScratchDoubleReg, src1, kScratchDoubleReg, Condition(0),
+              Condition(0), Condition(1));
+      __ vpk(dst, kScratchDoubleReg, dst, Condition(0), Condition(0),
+             Condition(2));
+      break;
+    }
+    case kS390_I16x8Sub: {
+      __ vs(i.OutputSimd128Register(), i.InputSimd128Register(0),
+            i.InputSimd128Register(1), Condition(0), Condition(0),
+            Condition(1));
+      break;
+    }
+    case kS390_I16x8Mul: {
+      __ vml(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0),
+             Condition(1));
+      break;
+    }
+    case kS390_I8x16Add: {
+      __ va(i.OutputSimd128Register(), i.InputSimd128Register(0),
+            i.InputSimd128Register(1), Condition(0), Condition(0),
+            Condition(0));
+      break;
+    }
+    case kS390_I8x16Sub: {
+      __ vs(i.OutputSimd128Register(), i.InputSimd128Register(0),
+            i.InputSimd128Register(1), Condition(0), Condition(0),
+            Condition(0));
+      break;
+    }
+    case kS390_I8x16Mul: {
+      __ vml(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0),
+             Condition(0));
+      break;
+    }
+    // vector comparisons
+    case kS390_I32x4MinS: {
+      __ vmn(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0),
+             Condition(2));
+      break;
+    }
+    case kS390_I32x4MinU: {
+      __ vmnl(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0),
+              Condition(2));
+      break;
+    }
+    case kS390_I16x8MinS: {
+      __ vmn(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0),
+             Condition(1));
+      break;
+    }
+    case kS390_I16x8MinU: {
+      __ vmnl(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0),
+              Condition(1));
+      break;
+    }
+    case kS390_I8x16MinS: {
+      __ vmn(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0),
+             Condition(0));
+      break;
+    }
+    case kS390_I8x16MinU: {
+      __ vmnl(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0),
+              Condition(0));
+      break;
+    }
+    case kS390_I32x4MaxS: {
+      __ vmx(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0),
+             Condition(2));
+      break;
+    }
+    case kS390_I32x4MaxU: {
+      __ vmxl(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0),
+              Condition(2));
+      break;
+    }
+    case kS390_I16x8MaxS: {
+      __ vmx(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0),
+             Condition(1));
+      break;
+    }
+    case kS390_I16x8MaxU: {
+      __ vmxl(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0),
+              Condition(1));
+      break;
+    }
+    case kS390_I8x16MaxS: {
+      __ vmx(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0),
+             Condition(0));
+      break;
+    }
+    case kS390_I8x16MaxU: {
+      __ vmxl(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0),
+              Condition(0));
+      break;
+    }
+    case kS390_F32x4Eq: {
+      __ vfce(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0),
+              Condition(2));
+      break;
+    }
+    case kS390_I32x4Eq: {
+      __ vceq(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(2));
+      break;
+    }
+    case kS390_I16x8Eq: {
+      __ vceq(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(1));
+      break;
+    }
+    case kS390_I8x16Eq: {
+      __ vceq(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0));
+      break;
+    }
+    case kS390_F32x4Ne: {
+      __ vfce(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0),
+              Condition(2));
+      __ vno(i.OutputSimd128Register(), i.OutputSimd128Register(),
+             i.OutputSimd128Register(), Condition(0), Condition(0),
+             Condition(2));
+      break;
+    }
+    case kS390_I32x4Ne: {
+      __ vceq(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(2));
+      __ vno(i.OutputSimd128Register(), i.OutputSimd128Register(),
+             i.OutputSimd128Register(), Condition(0), Condition(0),
+             Condition(2));
+      break;
+    }
+    case kS390_I16x8Ne: {
+      __ vceq(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(1));
+      __ vno(i.OutputSimd128Register(), i.OutputSimd128Register(),
+             i.OutputSimd128Register(), Condition(0), Condition(0),
+             Condition(1));
+      break;
+    }
+    case kS390_I8x16Ne: {
+      __ vceq(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0));
+      __ vno(i.OutputSimd128Register(), i.OutputSimd128Register(),
+             i.OutputSimd128Register(), Condition(0), Condition(0),
+             Condition(0));
+      break;
+    }
+    case kS390_F32x4Lt: {
+      __ vfch(i.OutputSimd128Register(), i.InputSimd128Register(1),
+              i.InputSimd128Register(0), Condition(0), Condition(0),
+              Condition(2));
+      break;
+    }
+    case kS390_F32x4Le: {
+      __ vfche(i.OutputSimd128Register(), i.InputSimd128Register(1),
+               i.InputSimd128Register(0), Condition(0), Condition(0),
+               Condition(2));
+      break;
+    }
+    case kS390_I32x4GtS: {
+      __ vch(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(2));
+      break;
+    }
+    case kS390_I32x4GeS: {
+      __ vceq(kScratchDoubleReg, i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(2));
+      __ vch(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(2));
+      __ vo(i.OutputSimd128Register(), i.OutputSimd128Register(),
+            kScratchDoubleReg, Condition(0), Condition(0), Condition(2));
+      break;
+    }
+    case kS390_I32x4GtU: {
+      __ vchl(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(2));
+      break;
+    }
+    case kS390_I32x4GeU: {
+      __ vceq(kScratchDoubleReg, i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(2));
+      __ vchl(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(2));
+      __ vo(i.OutputSimd128Register(), i.OutputSimd128Register(),
+            kScratchDoubleReg, Condition(0), Condition(0), Condition(2));
+      break;
+    }
+    case kS390_I16x8GtS: {
+      __ vch(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(1));
+      break;
+    }
+    case kS390_I16x8GeS: {
+      __ vceq(kScratchDoubleReg, i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(1));
+      __ vch(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(1));
+      __ vo(i.OutputSimd128Register(), i.OutputSimd128Register(),
+            kScratchDoubleReg, Condition(0), Condition(0), Condition(1));
+      break;
+    }
+    case kS390_I16x8GtU: {
+      __ vchl(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(1));
+      break;
+    }
+    case kS390_I16x8GeU: {
+      __ vceq(kScratchDoubleReg, i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(1));
+      __ vchl(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(1));
+      __ vo(i.OutputSimd128Register(), i.OutputSimd128Register(),
+            kScratchDoubleReg, Condition(0), Condition(0), Condition(1));
+      break;
+    }
+    case kS390_I8x16GtS: {
+      __ vch(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0));
+      break;
+    }
+    case kS390_I8x16GeS: {
+      __ vceq(kScratchDoubleReg, i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0));
+      __ vch(i.OutputSimd128Register(), i.InputSimd128Register(0),
+             i.InputSimd128Register(1), Condition(0), Condition(0));
+      __ vo(i.OutputSimd128Register(), i.OutputSimd128Register(),
+            kScratchDoubleReg, Condition(0), Condition(0), Condition(0));
+      break;
+    }
+    case kS390_I8x16GtU: {
+      __ vchl(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0));
+      break;
+    }
+    case kS390_I8x16GeU: {
+      __ vceq(kScratchDoubleReg, i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0));
+      __ vchl(i.OutputSimd128Register(), i.InputSimd128Register(0),
+              i.InputSimd128Register(1), Condition(0), Condition(0));
+      __ vo(i.OutputSimd128Register(), i.OutputSimd128Register(),
+            kScratchDoubleReg, Condition(0), Condition(0), Condition(0));
+      break;
+    }
+    // vector shifts
+#define VECTOR_SHIFT(op, mode)                                             \
+  {                                                                        \
+    __ vlvg(kScratchDoubleReg, i.InputRegister(1), MemOperand(r0, 0),      \
+            Condition(mode));                                              \
+    __ vrep(kScratchDoubleReg, kScratchDoubleReg, Operand(0),              \
+            Condition(mode));                                              \
+    __ op(i.OutputSimd128Register(), i.InputSimd128Register(0),            \
+          kScratchDoubleReg, Condition(0), Condition(0), Condition(mode)); \
+  }
+    case kS390_I32x4Shl: {
+      VECTOR_SHIFT(veslv, 2);
+      break;
+    }
+    case kS390_I32x4ShrS: {
+      VECTOR_SHIFT(vesrav, 2);
+      break;
+    }
+    case kS390_I32x4ShrU: {
+      VECTOR_SHIFT(vesrlv, 2);
+      break;
+    }
+    case kS390_I16x8Shl: {
+      VECTOR_SHIFT(veslv, 1);
+      break;
+    }
+    case kS390_I16x8ShrS: {
+      VECTOR_SHIFT(vesrav, 1);
+      break;
+    }
+    case kS390_I16x8ShrU: {
+      VECTOR_SHIFT(vesrlv, 1);
+      break;
+    }
+    case kS390_I8x16Shl: {
+      VECTOR_SHIFT(veslv, 0);
+      break;
+    }
+    case kS390_I8x16ShrS: {
+      VECTOR_SHIFT(vesrav, 0);
+      break;
+    }
+    case kS390_I8x16ShrU: {
+      VECTOR_SHIFT(vesrlv, 0);
+      break;
+    }
+    // vector unary ops
+    case kS390_F32x4Abs: {
+      __ vfpso(i.OutputSimd128Register(), i.InputSimd128Register(0),
+               Condition(2), Condition(0), Condition(2));
+      break;
+    }
+    case kS390_F32x4Neg: {
+      __ vfpso(i.OutputSimd128Register(), i.InputSimd128Register(0),
+               Condition(0), Condition(0), Condition(2));
+      break;
+    }
+    case kS390_I32x4Neg: {
+      __ vlc(i.OutputSimd128Register(), i.InputSimd128Register(0), Condition(0),
+             Condition(0), Condition(2));
+      break;
+    }
+    case kS390_I16x8Neg: {
+      __ vlc(i.OutputSimd128Register(), i.InputSimd128Register(0), Condition(0),
+             Condition(0), Condition(1));
+      break;
+    }
+    case kS390_I8x16Neg: {
+      __ vlc(i.OutputSimd128Register(), i.InputSimd128Register(0), Condition(0),
+             Condition(0), Condition(0));
+      break;
+    }
+    case kS390_F32x4RecipApprox: {
+      __ lgfi(kScratchReg, Operand(1));
+      __ ConvertIntToFloat(kScratchDoubleReg, kScratchReg);
+      __ vrep(kScratchDoubleReg, kScratchDoubleReg, Operand(0), Condition(2));
+      __ vfd(i.OutputSimd128Register(), kScratchDoubleReg,
+             i.InputSimd128Register(0), Condition(0), Condition(0),
+             Condition(2));
+      break;
+    }
+    case kS390_F32x4RecipSqrtApprox: {
+      DoubleRegister tempFPReg1 = i.ToSimd128Register(instr->TempAt(0));
+      __ vfsq(tempFPReg1, i.InputSimd128Register(0), Condition(0), Condition(0),
+              Condition(2));
+      __ lgfi(kScratchReg, Operand(1));
+      __ ConvertIntToFloat(kScratchDoubleReg, kScratchReg);
+      __ vrep(kScratchDoubleReg, kScratchDoubleReg, Operand(0), Condition(2));
+      __ vfd(i.OutputSimd128Register(), kScratchDoubleReg, tempFPReg1,
+             Condition(0), Condition(0), Condition(2));
+      break;
+    }
+    case kS390_S128Not: {
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      __ vno(dst, src, src, Condition(0), Condition(0), Condition(0));
+      break;
+    }
+    // vector boolean unops
+    case kS390_S1x4AnyTrue:
+    case kS390_S1x8AnyTrue:
+    case kS390_S1x16AnyTrue: {
+      Simd128Register src = i.InputSimd128Register(0);
+      Register dst = i.OutputRegister();
+      Register temp = i.TempRegister(0);
+      __ lgfi(dst, Operand(1));
+      __ xgr(temp, temp);
+      __ vtm(src, src, Condition(0), Condition(0), Condition(0));
+      __ locgr(Condition(8), dst, temp);
+      break;
+    }
+    case kS390_S1x4AllTrue:
+    case kS390_S1x8AllTrue:
+    case kS390_S1x16AllTrue: {
+      Simd128Register src = i.InputSimd128Register(0);
+      Register dst = i.OutputRegister();
+      Register temp = i.TempRegister(0);
+      __ lgfi(temp, Operand(1));
+      __ xgr(dst, dst);
+      __ vceq(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg,
+              Condition(0), Condition(2));
+      __ vtm(src, kScratchDoubleReg, Condition(0), Condition(0), Condition(0));
+      __ locgr(Condition(1), dst, temp);
+      break;
+    }
+    // vector bitwise ops
+    case kS390_S128And: {
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register src = i.InputSimd128Register(1);
+      __ vn(dst, i.InputSimd128Register(0), src, Condition(0), Condition(0),
+            Condition(0));
+      break;
+    }
+    case kS390_S128Or: {
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register src = i.InputSimd128Register(1);
+      __ vo(dst, i.InputSimd128Register(0), src, Condition(0), Condition(0),
+            Condition(0));
+      break;
+    }
+    case kS390_S128Xor: {
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register src = i.InputSimd128Register(1);
+      __ vx(dst, i.InputSimd128Register(0), src, Condition(0), Condition(0),
+            Condition(0));
+      break;
+    }
+    case kS390_S128Zero: {
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register src = i.InputSimd128Register(1);
+      __ vx(dst, dst, src, Condition(0), Condition(0), Condition(0));
+      break;
+    }
+    case kS390_S128Select: {
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register mask = i.InputSimd128Register(0);
+      Simd128Register src1 = i.InputSimd128Register(1);
+      Simd128Register src2 = i.InputSimd128Register(2);
+      __ vsel(dst, src1, src2, mask, Condition(0), Condition(0));
+      break;
+    }
     default:
       UNREACHABLE();
   }
@@ -3061,6 +3744,7 @@ void CodeGenerator::AssembleConstructFrame() {
         }
       }
     }
+    unwinding_info_writer_.MarkFrameConstructed(__ pc_offset());
   }
 
   int required_slots =
@@ -3165,6 +3849,8 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
     __ MultiPopDoubles(double_saves);
   }
 
+  unwinding_info_writer_.MarkBlockWillExit();
+
   S390OperandConverter g(this, nullptr);
   if (call_descriptor->IsCFunctionCall()) {
     AssembleDeconstructFrame();
diff --git a/deps/v8/src/compiler/backend/s390/instruction-codes-s390.h b/deps/v8/src/compiler/backend/s390/instruction-codes-s390.h
index 1d93acb15ef6ae..165c811787c2ac 100644
--- a/deps/v8/src/compiler/backend/s390/instruction-codes-s390.h
+++ b/deps/v8/src/compiler/backend/s390/instruction-codes-s390.h
@@ -148,6 +148,8 @@ namespace compiler {
   V(S390_LoadReverse16RR)                   \
   V(S390_LoadReverse32RR)                   \
   V(S390_LoadReverse64RR)                   \
+  V(S390_LoadReverseSimd128RR)              \
+  V(S390_LoadReverseSimd128)                \
   V(S390_LoadReverse16)                     \
   V(S390_LoadReverse32)                     \
   V(S390_LoadReverse64)                     \
@@ -161,11 +163,9 @@ namespace compiler {
   V(S390_StoreReverse16)                    \
   V(S390_StoreReverse32)                    \
   V(S390_StoreReverse64)                    \
+  V(S390_StoreReverseSimd128)               \
   V(S390_StoreFloat32)                      \
   V(S390_StoreDouble)                       \
-  V(S390_DecompressSigned)                  \
-  V(S390_DecompressPointer)                 \
-  V(S390_DecompressAny)                     \
   V(S390_CompressSigned)                    \
   V(S390_CompressPointer)                   \
   V(S390_CompressAny)                       \
@@ -196,7 +196,100 @@ namespace compiler {
   V(S390_Word64AtomicXorUint8)              \
   V(S390_Word64AtomicXorUint16)             \
   V(S390_Word64AtomicXorUint32)             \
-  V(S390_Word64AtomicXorUint64)
+  V(S390_Word64AtomicXorUint64)             \
+  V(S390_F32x4Splat)                        \
+  V(S390_F32x4ExtractLane)                  \
+  V(S390_F32x4ReplaceLane)                  \
+  V(S390_F32x4Add)                          \
+  V(S390_F32x4AddHoriz)                     \
+  V(S390_F32x4Sub)                          \
+  V(S390_F32x4Mul)                          \
+  V(S390_F32x4Eq)                           \
+  V(S390_F32x4Ne)                           \
+  V(S390_F32x4Lt)                           \
+  V(S390_F32x4Le)                           \
+  V(S390_F32x4Abs)                          \
+  V(S390_F32x4Neg)                          \
+  V(S390_F32x4RecipApprox)                  \
+  V(S390_F32x4RecipSqrtApprox)              \
+  V(S390_I32x4Splat)                        \
+  V(S390_I32x4ExtractLane)                  \
+  V(S390_I32x4ReplaceLane)                  \
+  V(S390_I32x4Add)                          \
+  V(S390_I32x4AddHoriz)                     \
+  V(S390_I32x4Sub)                          \
+  V(S390_I32x4Mul)                          \
+  V(S390_I32x4MinS)                         \
+  V(S390_I32x4MinU)                         \
+  V(S390_I32x4MaxS)                         \
+  V(S390_I32x4MaxU)                         \
+  V(S390_I32x4Eq)                           \
+  V(S390_I32x4Ne)                           \
+  V(S390_I32x4GtS)                          \
+  V(S390_I32x4GeS)                          \
+  V(S390_I32x4GtU)                          \
+  V(S390_I32x4GeU)                          \
+  V(S390_I32x4Neg)                          \
+  V(S390_I16x8Splat)                        \
+  V(S390_I32x4Shl)                          \
+  V(S390_I32x4ShrS)                         \
+  V(S390_I32x4ShrU)                         \
+  V(S390_I16x8ExtractLaneU)                 \
+  V(S390_I16x8ExtractLaneS)                 \
+  V(S390_I16x8ReplaceLane)                  \
+  V(S390_I16x8Add)                          \
+  V(S390_I16x8AddHoriz)                     \
+  V(S390_I16x8Sub)                          \
+  V(S390_I16x8Mul)                          \
+  V(S390_I16x8MinS)                         \
+  V(S390_I16x8MinU)                         \
+  V(S390_I16x8MaxS)                         \
+  V(S390_I16x8MaxU)                         \
+  V(S390_I16x8Eq)                           \
+  V(S390_I16x8Ne)                           \
+  V(S390_I16x8GtS)                          \
+  V(S390_I16x8GeS)                          \
+  V(S390_I16x8GtU)                          \
+  V(S390_I16x8GeU)                          \
+  V(S390_I16x8Shl)                          \
+  V(S390_I16x8ShrS)                         \
+  V(S390_I16x8ShrU)                         \
+  V(S390_I16x8Neg)                          \
+  V(S390_I8x16Splat)                        \
+  V(S390_I8x16ExtractLaneU)                 \
+  V(S390_I8x16ExtractLaneS)                 \
+  V(S390_I8x16ReplaceLane)                  \
+  V(S390_I8x16Add)                          \
+  V(S390_I8x16Sub)                          \
+  V(S390_I8x16Mul)                          \
+  V(S390_I8x16MinS)                         \
+  V(S390_I8x16MinU)                         \
+  V(S390_I8x16MaxS)                         \
+  V(S390_I8x16MaxU)                         \
+  V(S390_I8x16Eq)                           \
+  V(S390_I8x16Ne)                           \
+  V(S390_I8x16GtS)                          \
+  V(S390_I8x16GeS)                          \
+  V(S390_I8x16GtU)                          \
+  V(S390_I8x16GeU)                          \
+  V(S390_I8x16Shl)                          \
+  V(S390_I8x16ShrS)                         \
+  V(S390_I8x16ShrU)                         \
+  V(S390_I8x16Neg)                          \
+  V(S390_S1x4AnyTrue)                       \
+  V(S390_S1x8AnyTrue)                       \
+  V(S390_S1x16AnyTrue)                      \
+  V(S390_S1x4AllTrue)                       \
+  V(S390_S1x8AllTrue)                       \
+  V(S390_S1x16AllTrue)                      \
+  V(S390_S128And)                           \
+  V(S390_S128Or)                            \
+  V(S390_S128Xor)                           \
+  V(S390_S128Zero)                          \
+  V(S390_S128Not)                           \
+  V(S390_S128Select)                        \
+  V(S390_StoreSimd128)                      \
+  V(S390_LoadSimd128)
 
 // Addressing modes represent the "shape" of inputs to an instruction.
 // Many instructions support multiple addressing modes. Addressing modes
diff --git a/deps/v8/src/compiler/backend/s390/instruction-scheduler-s390.cc b/deps/v8/src/compiler/backend/s390/instruction-scheduler-s390.cc
index c0ac5076e105fa..50d23766b6537a 100644
--- a/deps/v8/src/compiler/backend/s390/instruction-scheduler-s390.cc
+++ b/deps/v8/src/compiler/backend/s390/instruction-scheduler-s390.cc
@@ -134,16 +134,106 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kS390_LoadReverse16RR:
     case kS390_LoadReverse32RR:
     case kS390_LoadReverse64RR:
+    case kS390_LoadReverseSimd128RR:
+    case kS390_LoadReverseSimd128:
     case kS390_LoadAndTestWord32:
     case kS390_LoadAndTestWord64:
     case kS390_LoadAndTestFloat32:
     case kS390_LoadAndTestFloat64:
-    case kS390_DecompressSigned:
-    case kS390_DecompressPointer:
-    case kS390_DecompressAny:
     case kS390_CompressSigned:
     case kS390_CompressPointer:
     case kS390_CompressAny:
+    case kS390_F32x4Splat:
+    case kS390_F32x4ExtractLane:
+    case kS390_F32x4ReplaceLane:
+    case kS390_F32x4Add:
+    case kS390_F32x4AddHoriz:
+    case kS390_F32x4Sub:
+    case kS390_F32x4Mul:
+    case kS390_F32x4Eq:
+    case kS390_F32x4Ne:
+    case kS390_F32x4Lt:
+    case kS390_F32x4Le:
+    case kS390_F32x4Abs:
+    case kS390_F32x4Neg:
+    case kS390_F32x4RecipApprox:
+    case kS390_F32x4RecipSqrtApprox:
+    case kS390_I32x4Splat:
+    case kS390_I32x4ExtractLane:
+    case kS390_I32x4ReplaceLane:
+    case kS390_I32x4Add:
+    case kS390_I32x4AddHoriz:
+    case kS390_I32x4Sub:
+    case kS390_I32x4Mul:
+    case kS390_I32x4MinS:
+    case kS390_I32x4MinU:
+    case kS390_I32x4MaxS:
+    case kS390_I32x4MaxU:
+    case kS390_I32x4Eq:
+    case kS390_I32x4Ne:
+    case kS390_I32x4GtS:
+    case kS390_I32x4GeS:
+    case kS390_I32x4GtU:
+    case kS390_I32x4GeU:
+    case kS390_I32x4Shl:
+    case kS390_I32x4ShrS:
+    case kS390_I32x4ShrU:
+    case kS390_I32x4Neg:
+    case kS390_I16x8Splat:
+    case kS390_I16x8ExtractLaneU:
+    case kS390_I16x8ExtractLaneS:
+    case kS390_I16x8ReplaceLane:
+    case kS390_I16x8Add:
+    case kS390_I16x8AddHoriz:
+    case kS390_I16x8Sub:
+    case kS390_I16x8Mul:
+    case kS390_I16x8MinS:
+    case kS390_I16x8MinU:
+    case kS390_I16x8MaxS:
+    case kS390_I16x8MaxU:
+    case kS390_I16x8Eq:
+    case kS390_I16x8Ne:
+    case kS390_I16x8GtS:
+    case kS390_I16x8GeS:
+    case kS390_I16x8GtU:
+    case kS390_I16x8GeU:
+    case kS390_I16x8Shl:
+    case kS390_I16x8ShrS:
+    case kS390_I16x8ShrU:
+    case kS390_I16x8Neg:
+    case kS390_I8x16Splat:
+    case kS390_I8x16ExtractLaneU:
+    case kS390_I8x16ExtractLaneS:
+    case kS390_I8x16ReplaceLane:
+    case kS390_I8x16Add:
+    case kS390_I8x16Sub:
+    case kS390_I8x16Mul:
+    case kS390_I8x16MinS:
+    case kS390_I8x16MinU:
+    case kS390_I8x16MaxS:
+    case kS390_I8x16MaxU:
+    case kS390_I8x16Eq:
+    case kS390_I8x16Ne:
+    case kS390_I8x16GtS:
+    case kS390_I8x16GeS:
+    case kS390_I8x16GtU:
+    case kS390_I8x16GeU:
+    case kS390_I8x16Shl:
+    case kS390_I8x16ShrS:
+    case kS390_I8x16ShrU:
+    case kS390_I8x16Neg:
+    case kS390_S1x4AnyTrue:
+    case kS390_S1x8AnyTrue:
+    case kS390_S1x16AnyTrue:
+    case kS390_S1x4AllTrue:
+    case kS390_S1x8AllTrue:
+    case kS390_S1x16AllTrue:
+    case kS390_S128And:
+    case kS390_S128Or:
+    case kS390_S128Xor:
+    case kS390_S128Zero:
+    case kS390_S128Not:
+    case kS390_S128Select:
       return kNoOpcodeFlags;
 
     case kS390_LoadWordS8:
@@ -155,6 +245,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kS390_LoadWord64:
     case kS390_LoadFloat32:
     case kS390_LoadDouble:
+    case kS390_LoadSimd128:
     case kS390_LoadReverse16:
     case kS390_LoadReverse32:
     case kS390_LoadReverse64:
@@ -165,11 +256,13 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kS390_StoreWord16:
     case kS390_StoreWord32:
     case kS390_StoreWord64:
+    case kS390_StoreReverseSimd128:
     case kS390_StoreReverse16:
     case kS390_StoreReverse32:
     case kS390_StoreReverse64:
     case kS390_StoreFloat32:
     case kS390_StoreDouble:
+    case kS390_StoreSimd128:
     case kS390_Push:
     case kS390_PushFrame:
     case kS390_StoreToStackSlot:
diff --git a/deps/v8/src/compiler/backend/s390/instruction-selector-s390.cc b/deps/v8/src/compiler/backend/s390/instruction-selector-s390.cc
index 7b002fe6d3bdfa..b66530f1dcc22e 100644
--- a/deps/v8/src/compiler/backend/s390/instruction-selector-s390.cc
+++ b/deps/v8/src/compiler/backend/s390/instruction-selector-s390.cc
@@ -293,6 +293,9 @@ ArchOpcode SelectLoadOpcode(Node* node) {
     case MachineRepresentation::kWord32:
       opcode = kS390_LoadWordU32;
       break;
+    case MachineRepresentation::kSimd128:
+      opcode = kS390_LoadSimd128;
+      break;
 #if V8_TARGET_ARCH_S390X
     case MachineRepresentation::kTaggedSigned:   // Fall through.
     case MachineRepresentation::kTaggedPointer:  // Fall through.
@@ -303,10 +306,8 @@ ArchOpcode SelectLoadOpcode(Node* node) {
 #else
     case MachineRepresentation::kWord64:  // Fall through.
 #endif
-    case MachineRepresentation::kCompressedSigned:   // Fall through.
     case MachineRepresentation::kCompressedPointer:  // Fall through.
     case MachineRepresentation::kCompressed:         // Fall through.
-    case MachineRepresentation::kSimd128:  // Fall through.
     case MachineRepresentation::kNone:
     default:
       UNREACHABLE();
@@ -757,7 +758,6 @@ static void VisitGeneralStore(
       case MachineRepresentation::kTaggedSigned:       // Fall through.
       case MachineRepresentation::kTaggedPointer:      // Fall through.
       case MachineRepresentation::kTagged:             // Fall through.
-      case MachineRepresentation::kCompressedSigned:   // Fall through.
       case MachineRepresentation::kCompressedPointer:  // Fall through.
       case MachineRepresentation::kCompressed:         // Fall through.
 #endif
@@ -768,11 +768,17 @@ static void VisitGeneralStore(
           value = value->InputAt(0);
         }
         break;
+      case MachineRepresentation::kSimd128:
+        opcode = kS390_StoreSimd128;
+        if (m.IsSimd128ReverseBytes()) {
+          opcode = kS390_StoreReverseSimd128;
+          value = value->InputAt(0);
+        }
+        break;
 #if V8_TARGET_ARCH_S390X
       case MachineRepresentation::kTaggedSigned:       // Fall through.
       case MachineRepresentation::kTaggedPointer:      // Fall through.
       case MachineRepresentation::kTagged:             // Fall through.
-      case MachineRepresentation::kCompressedSigned:   // Fall through.
       case MachineRepresentation::kCompressedPointer:  // Fall through.
       case MachineRepresentation::kCompressed:         // Fall through.
       case MachineRepresentation::kWord64:
@@ -785,7 +791,6 @@ static void VisitGeneralStore(
 #else
       case MachineRepresentation::kWord64:  // Fall through.
 #endif
-      case MachineRepresentation::kSimd128:  // Fall through.
       case MachineRepresentation::kNone:
         UNREACHABLE();
         return;
@@ -824,11 +829,31 @@ void InstructionSelector::VisitUnalignedStore(Node* node) { UNREACHABLE(); }
 
 void InstructionSelector::VisitStackPointerGreaterThan(
     Node* node, FlagsContinuation* cont) {
-  Node* const value = node->InputAt(0);
-  InstructionCode opcode = kArchStackPointerGreaterThan;
+  StackCheckKind kind = StackCheckKindOf(node->op());
+  InstructionCode opcode =
+      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
 
   S390OperandGenerator g(this);
-  EmitWithContinuation(opcode, g.UseRegister(value), cont);
+
+  // No outputs.
+  InstructionOperand* const outputs = nullptr;
+  const int output_count = 0;
+
+  // Applying an offset to this stack check requires a temp register. Offsets
+  // are only applied to the first stack check. If applying an offset, we must
+  // ensure the input and temp registers do not alias, thus kUniqueRegister.
+  InstructionOperand temps[] = {g.TempRegister()};
+  const int temp_count = (kind == StackCheckKind::kJSFunctionEntry) ? 1 : 0;
+  const auto register_mode = (kind == StackCheckKind::kJSFunctionEntry)
+                                 ? OperandGenerator::kUniqueRegister
+                                 : OperandGenerator::kRegister;
+
+  Node* const value = node->InputAt(0);
+  InstructionOperand inputs[] = {g.UseRegisterWithMode(value, register_mode)};
+  static constexpr int input_count = arraysize(inputs);
+
+  EmitWithContinuation(opcode, output_count, outputs, input_count, inputs,
+                       temp_count, temps, cont);
 }
 
 #if 0
@@ -1171,9 +1196,22 @@ void InstructionSelector::VisitWord32ReverseBytes(Node* node) {
 }
 
 void InstructionSelector::VisitSimd128ReverseBytes(Node* node) {
-  // TODO(miladfar): Implement the s390 selector for reversing SIMD bytes.
-  // Check if the input node is a Load and do a Load Reverse at once.
-  UNIMPLEMENTED();
+  S390OperandGenerator g(this);
+  NodeMatcher input(node->InputAt(0));
+  if (CanCover(node, input.node()) && input.IsLoad()) {
+    LoadRepresentation load_rep = LoadRepresentationOf(input.node()->op());
+    if (load_rep.representation() == MachineRepresentation::kSimd128) {
+      Node* base = input.node()->InputAt(0);
+      Node* offset = input.node()->InputAt(1);
+      Emit(kS390_LoadReverseSimd128 | AddressingModeField::encode(kMode_MRR),
+           // TODO(miladfar): one of the base and offset can be imm.
+           g.DefineAsRegister(node), g.UseRegister(base),
+           g.UseRegister(offset));
+      return;
+    }
+  }
+  Emit(kS390_LoadReverseSimd128RR, g.DefineAsRegister(node),
+       g.UseRegister(node->InputAt(0)));
 }
 
 template <class Matcher, ArchOpcode neg_opcode>
@@ -1583,6 +1621,12 @@ void InstructionSelector::VisitTryTruncateFloat64ToUint64(Node* node) {
 
 #endif
 
+void InstructionSelector::VisitBitcastWord32ToWord64(Node* node) {
+  DCHECK(SmiValuesAre31Bits());
+  DCHECK(COMPRESS_POINTERS_BOOL);
+  EmitIdentity(node);
+}
+
 void InstructionSelector::VisitFloat64Mod(Node* node) {
   S390OperandGenerator g(this);
   Emit(kS390_ModDouble, g.DefineAsFixed(node, d1),
@@ -2210,34 +2254,6 @@ bool InstructionSelector::IsTailCallAddressImmediate() { return false; }
 
 int InstructionSelector::GetTempsCountForTailCallFromJSFunction() { return 3; }
 
-void InstructionSelector::VisitChangeTaggedToCompressed(Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeTaggedPointerToCompressedPointer(
-    Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeTaggedSignedToCompressedSigned(
-    Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeCompressedToTagged(Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeCompressedPointerToTaggedPointer(
-    Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitChangeCompressedSignedToTaggedSigned(
-    Node* node) {
-  UNIMPLEMENTED();
-}
-
 void InstructionSelector::VisitWord32AtomicLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   DCHECK(load_rep.representation() == MachineRepresentation::kWord8 ||
@@ -2495,80 +2511,196 @@ void InstructionSelector::VisitWord64AtomicStore(Node* node) {
   VisitGeneralStore(this, node, rep);
 }
 
-void InstructionSelector::VisitI32x4Splat(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4ExtractLane(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4ReplaceLane(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4Add(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4Sub(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4Shl(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4ShrS(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4Mul(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4MaxS(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4MinS(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4Eq(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4Ne(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4MinU(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4MaxU(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4ShrU(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4Neg(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4GtS(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4GeS(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4GtU(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI32x4GeU(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8Splat(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8ExtractLane(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8ReplaceLane(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8Shl(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8ShrS(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8ShrU(Node* node) { UNIMPLEMENTED(); }
+#define SIMD_TYPES(V) \
+  V(F32x4)            \
+  V(I32x4)            \
+  V(I16x8)            \
+  V(I8x16)
+
+#define SIMD_BINOP_LIST(V) \
+  V(F32x4Add)              \
+  V(F32x4AddHoriz)         \
+  V(F32x4Sub)              \
+  V(F32x4Mul)              \
+  V(F32x4Eq)               \
+  V(F32x4Ne)               \
+  V(F32x4Lt)               \
+  V(F32x4Le)               \
+  V(I32x4Add)              \
+  V(I32x4AddHoriz)         \
+  V(I32x4Sub)              \
+  V(I32x4Mul)              \
+  V(I32x4MinS)             \
+  V(I32x4MinU)             \
+  V(I32x4MaxS)             \
+  V(I32x4MaxU)             \
+  V(I32x4Eq)               \
+  V(I32x4Ne)               \
+  V(I32x4GtS)              \
+  V(I32x4GeS)              \
+  V(I32x4GtU)              \
+  V(I32x4GeU)              \
+  V(I16x8Add)              \
+  V(I16x8AddHoriz)         \
+  V(I16x8Sub)              \
+  V(I16x8Mul)              \
+  V(I16x8MinS)             \
+  V(I16x8MinU)             \
+  V(I16x8MaxS)             \
+  V(I16x8MaxU)             \
+  V(I16x8Eq)               \
+  V(I16x8Ne)               \
+  V(I16x8GtS)              \
+  V(I16x8GeS)              \
+  V(I16x8GtU)              \
+  V(I16x8GeU)              \
+  V(I8x16Add)              \
+  V(I8x16Sub)              \
+  V(I8x16Mul)              \
+  V(I8x16MinS)             \
+  V(I8x16MinU)             \
+  V(I8x16MaxS)             \
+  V(I8x16MaxU)             \
+  V(I8x16Eq)               \
+  V(I8x16Ne)               \
+  V(I8x16GtS)              \
+  V(I8x16GeS)              \
+  V(I8x16GtU)              \
+  V(I8x16GeU)              \
+  V(S128And)               \
+  V(S128Or)                \
+  V(S128Xor)
+
+#define SIMD_UNOP_LIST(V) \
+  V(F32x4Abs)             \
+  V(F32x4Neg)             \
+  V(F32x4RecipApprox)     \
+  V(F32x4RecipSqrtApprox) \
+  V(I32x4Neg)             \
+  V(I16x8Neg)             \
+  V(I8x16Neg)             \
+  V(S128Not)
+
+#define SIMD_SHIFT_OPCODES(V) \
+  V(I32x4Shl)                 \
+  V(I32x4ShrS)                \
+  V(I32x4ShrU)                \
+  V(I16x8Shl)                 \
+  V(I16x8ShrS)                \
+  V(I16x8ShrU)                \
+  V(I8x16Shl)                 \
+  V(I8x16ShrS)                \
+  V(I8x16ShrU)
+
+#define SIMD_BOOL_LIST(V) \
+  V(S1x4AnyTrue)          \
+  V(S1x8AnyTrue)          \
+  V(S1x16AnyTrue)         \
+  V(S1x4AllTrue)          \
+  V(S1x8AllTrue)          \
+  V(S1x16AllTrue)
+
+#define SIMD_VISIT_SPLAT(Type)                               \
+  void InstructionSelector::Visit##Type##Splat(Node* node) { \
+    S390OperandGenerator g(this);                            \
+    Emit(kS390_##Type##Splat, g.DefineAsRegister(node),      \
+         g.UseRegister(node->InputAt(0)));                   \
+  }
+SIMD_TYPES(SIMD_VISIT_SPLAT)
+#undef SIMD_VISIT_SPLAT
+
+#define SIMD_VISIT_EXTRACT_LANE(Type, Sign)                              \
+  void InstructionSelector::Visit##Type##ExtractLane##Sign(Node* node) { \
+    S390OperandGenerator g(this);                                        \
+    int32_t lane = OpParameter<int32_t>(node->op());                     \
+    Emit(kS390_##Type##ExtractLane##Sign, g.DefineAsRegister(node),      \
+         g.UseRegister(node->InputAt(0)), g.UseImmediate(lane));         \
+  }
+SIMD_VISIT_EXTRACT_LANE(F32x4, )
+SIMD_VISIT_EXTRACT_LANE(I32x4, )
+SIMD_VISIT_EXTRACT_LANE(I16x8, U)
+SIMD_VISIT_EXTRACT_LANE(I16x8, S)
+SIMD_VISIT_EXTRACT_LANE(I8x16, U)
+SIMD_VISIT_EXTRACT_LANE(I8x16, S)
+#undef SIMD_VISIT_EXTRACT_LANE
+
+#define SIMD_VISIT_REPLACE_LANE(Type)                              \
+  void InstructionSelector::Visit##Type##ReplaceLane(Node* node) { \
+    S390OperandGenerator g(this);                                  \
+    int32_t lane = OpParameter<int32_t>(node->op());               \
+    Emit(kS390_##Type##ReplaceLane, g.DefineAsRegister(node),      \
+         g.UseRegister(node->InputAt(0)), g.UseImmediate(lane),    \
+         g.UseRegister(node->InputAt(1)));                         \
+  }
+SIMD_TYPES(SIMD_VISIT_REPLACE_LANE)
+#undef SIMD_VISIT_REPLACE_LANE
+
+#define SIMD_VISIT_BINOP(Opcode)                                          \
+  void InstructionSelector::Visit##Opcode(Node* node) {                   \
+    S390OperandGenerator g(this);                                         \
+    InstructionOperand temps[] = {g.TempSimd128Register(),                \
+                                  g.TempSimd128Register()};               \
+    Emit(kS390_##Opcode, g.DefineAsRegister(node),                        \
+         g.UseUniqueRegister(node->InputAt(0)),                           \
+         g.UseUniqueRegister(node->InputAt(1)), arraysize(temps), temps); \
+  }
+SIMD_BINOP_LIST(SIMD_VISIT_BINOP)
+#undef SIMD_VISIT_BINOP
+#undef SIMD_BINOP_LIST
+
+#define SIMD_VISIT_UNOP(Opcode)                                     \
+  void InstructionSelector::Visit##Opcode(Node* node) {             \
+    S390OperandGenerator g(this);                                   \
+    InstructionOperand temps[] = {g.TempSimd128Register()};         \
+    Emit(kS390_##Opcode, g.DefineAsRegister(node),                  \
+         g.UseRegister(node->InputAt(0)), arraysize(temps), temps); \
+  }
+SIMD_UNOP_LIST(SIMD_VISIT_UNOP)
+#undef SIMD_VISIT_UNOP
+#undef SIMD_UNOP_LIST
+
+#define SIMD_VISIT_SHIFT(Opcode)                        \
+  void InstructionSelector::Visit##Opcode(Node* node) { \
+    S390OperandGenerator g(this);                       \
+    Emit(kS390_##Opcode, g.DefineAsRegister(node),      \
+         g.UseUniqueRegister(node->InputAt(0)),         \
+         g.UseUniqueRegister(node->InputAt(1)));        \
+  }
+SIMD_SHIFT_OPCODES(SIMD_VISIT_SHIFT)
+#undef SIMD_VISIT_SHIFT
+#undef SIMD_SHIFT_OPCODES
+
+#define SIMD_VISIT_BOOL(Opcode)                                           \
+  void InstructionSelector::Visit##Opcode(Node* node) {                   \
+    S390OperandGenerator g(this);                                         \
+    InstructionOperand temps[] = {g.TempRegister()};                      \
+    Emit(kS390_##Opcode, g.DefineAsRegister(node),                        \
+         g.UseUniqueRegister(node->InputAt(0)), arraysize(temps), temps); \
+  }
+SIMD_BOOL_LIST(SIMD_VISIT_BOOL)
+#undef SIMD_VISIT_BOOL
+#undef SIMD_TYPES
+
+void InstructionSelector::VisitS128Zero(Node* node) {
+  S390OperandGenerator g(this);
+  Emit(kS390_S128Zero, g.DefineAsRegister(node), g.DefineAsRegister(node));
+}
 
-void InstructionSelector::VisitI16x8Add(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitS128Select(Node* node) {
+  S390OperandGenerator g(this);
+  Emit(kS390_S128Select, g.DefineAsRegister(node),
+       g.UseRegister(node->InputAt(0)), g.UseRegister(node->InputAt(1)),
+       g.UseRegister(node->InputAt(2)));
+}
 
 void InstructionSelector::VisitI16x8AddSaturateS(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitI16x8Sub(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI16x8SubSaturateS(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitI16x8Mul(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8MinS(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8MaxS(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8Eq(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8Ne(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI16x8AddSaturateU(Node* node) {
   UNIMPLEMENTED();
 }
@@ -2577,52 +2709,22 @@ void InstructionSelector::VisitI16x8SubSaturateU(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitI16x8MinU(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8MaxU(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8Neg(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8GtS(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8GeS(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8GtU(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8GeU(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16Neg(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16Splat(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16ExtractLane(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16ReplaceLane(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitI16x8RoundingAverageU(Node* node) {
+  UNIMPLEMENTED();
+}
 
-void InstructionSelector::VisitI8x16Add(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitI8x16RoundingAverageU(Node* node) {
+  UNIMPLEMENTED();
+}
 
 void InstructionSelector::VisitI8x16AddSaturateS(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitI8x16Sub(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI8x16SubSaturateS(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitI8x16MinS(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16MaxS(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16Eq(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16Ne(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16GtS(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16GeS(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI8x16AddSaturateU(Node* node) {
   UNIMPLEMENTED();
 }
@@ -2631,37 +2733,7 @@ void InstructionSelector::VisitI8x16SubSaturateU(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitI8x16MinU(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16MaxU(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16GtU(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16GeU(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitS128And(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitS128Or(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitS128Xor(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitS128Not(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitS128Zero(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4Eq(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4Ne(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4Lt(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4Le(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4Splat(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4ExtractLane(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4ReplaceLane(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitS128AndNot(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::EmitPrepareResults(
     ZoneVector<PushParameter>* results, const CallDescriptor* call_descriptor,
@@ -2686,12 +2758,6 @@ void InstructionSelector::EmitPrepareResults(
   }
 }
 
-void InstructionSelector::VisitF32x4Add(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4Sub(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4Mul(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitF32x4Sqrt(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF32x4Div(Node* node) { UNIMPLEMENTED(); }
@@ -2700,22 +2766,6 @@ void InstructionSelector::VisitF32x4Min(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF32x4Max(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitS128Select(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4Neg(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4Abs(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4RecipSqrtApprox(Node* node) {
-  UNIMPLEMENTED();
-}
-
-void InstructionSelector::VisitF32x4RecipApprox(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4AddHoriz(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitI32x4AddHoriz(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitI16x8AddHoriz(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitF32x4SConvertI32x4(Node* node) {
   UNIMPLEMENTED();
 }
@@ -2779,27 +2829,57 @@ void InstructionSelector::VisitI8x16UConvertI16x8(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitS1x4AnyTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitS8x16Shuffle(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitS1x4AllTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitS8x16Swizzle(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitS1x8AnyTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF64x2Splat(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitS1x8AllTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF64x2ReplaceLane(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitS1x16AnyTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF64x2Abs(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitS1x16AllTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF64x2Neg(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI8x16Shl(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF64x2Sqrt(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI8x16ShrS(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF64x2Add(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI8x16ShrU(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF64x2Sub(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI8x16Mul(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF64x2Mul(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitS8x16Shuffle(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF64x2Div(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Eq(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Ne(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Lt(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Le(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2Neg(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2Add(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2Sub(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2Shl(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2ShrS(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2ShrU(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI64x2Mul(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Min(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2Max(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF64x2ExtractLane(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitLoadTransform(Node* node) { UNIMPLEMENTED(); }
 
 // static
 MachineOperatorBuilder::Flags
diff --git a/deps/v8/src/compiler/backend/s390/unwinding-info-writer-s390.cc b/deps/v8/src/compiler/backend/s390/unwinding-info-writer-s390.cc
new file mode 100644
index 00000000000000..f35f72225d38ab
--- /dev/null
+++ b/deps/v8/src/compiler/backend/s390/unwinding-info-writer-s390.cc
@@ -0,0 +1,103 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/backend/s390/unwinding-info-writer-s390.h"
+#include "src/compiler/backend/instruction.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+void UnwindingInfoWriter::BeginInstructionBlock(int pc_offset,
+                                                const InstructionBlock* block) {
+  if (!enabled()) return;
+
+  block_will_exit_ = false;
+
+  DCHECK_LT(block->rpo_number().ToInt(),
+            static_cast<int>(block_initial_states_.size()));
+  const BlockInitialState* initial_state =
+      block_initial_states_[block->rpo_number().ToInt()];
+  if (!initial_state) return;
+  if (initial_state->saved_lr_ != saved_lr_) {
+    eh_frame_writer_.AdvanceLocation(pc_offset);
+    if (initial_state->saved_lr_) {
+      eh_frame_writer_.RecordRegisterSavedToStack(r14, kSystemPointerSize);
+      eh_frame_writer_.RecordRegisterSavedToStack(fp, 0);
+    } else {
+      eh_frame_writer_.RecordRegisterFollowsInitialRule(r14);
+    }
+    saved_lr_ = initial_state->saved_lr_;
+  }
+}
+
+void UnwindingInfoWriter::EndInstructionBlock(const InstructionBlock* block) {
+  if (!enabled() || block_will_exit_) return;
+
+  for (const RpoNumber& successor : block->successors()) {
+    int successor_index = successor.ToInt();
+    DCHECK_LT(successor_index, static_cast<int>(block_initial_states_.size()));
+    const BlockInitialState* existing_state =
+        block_initial_states_[successor_index];
+
+    // If we already had an entry for this BB, check that the values are the
+    // same we are trying to insert.
+    if (existing_state) {
+      DCHECK_EQ(existing_state->saved_lr_, saved_lr_);
+    } else {
+      block_initial_states_[successor_index] =
+          new (zone_) BlockInitialState(saved_lr_);
+    }
+  }
+}
+
+void UnwindingInfoWriter::MarkFrameConstructed(int at_pc) {
+  if (!enabled()) return;
+
+  // Regardless of the type of frame constructed, the relevant part of the
+  // layout is always the one in the diagram:
+  //
+  // |   ....   |         higher addresses
+  // +----------+               ^
+  // |    LR    |               |            |
+  // +----------+               |            |
+  // | saved FP |               |            |
+  // +----------+ <-- FP                     v
+  // |   ....   |                       stack growth
+  //
+  // The LR is pushed on the stack, and we can record this fact at the end of
+  // the construction, since the LR itself is not modified in the process.
+  eh_frame_writer_.AdvanceLocation(at_pc);
+  eh_frame_writer_.RecordRegisterSavedToStack(r14, kSystemPointerSize);
+  eh_frame_writer_.RecordRegisterSavedToStack(fp, 0);
+  saved_lr_ = true;
+}
+
+void UnwindingInfoWriter::MarkFrameDeconstructed(int at_pc) {
+  if (!enabled()) return;
+
+  // The lr is restored by the last operation in LeaveFrame().
+  eh_frame_writer_.AdvanceLocation(at_pc);
+  eh_frame_writer_.RecordRegisterFollowsInitialRule(r14);
+  saved_lr_ = false;
+}
+
+void UnwindingInfoWriter::MarkLinkRegisterOnTopOfStack(int pc_offset) {
+  if (!enabled()) return;
+
+  eh_frame_writer_.AdvanceLocation(pc_offset);
+  eh_frame_writer_.SetBaseAddressRegisterAndOffset(sp, 0);
+  eh_frame_writer_.RecordRegisterSavedToStack(r14, 0);
+}
+
+void UnwindingInfoWriter::MarkPopLinkRegisterFromTopOfStack(int pc_offset) {
+  if (!enabled()) return;
+
+  eh_frame_writer_.AdvanceLocation(pc_offset);
+  eh_frame_writer_.SetBaseAddressRegisterAndOffset(fp, 0);
+  eh_frame_writer_.RecordRegisterFollowsInitialRule(r14);
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/compiler/backend/s390/unwinding-info-writer-s390.h b/deps/v8/src/compiler/backend/s390/unwinding-info-writer-s390.h
new file mode 100644
index 00000000000000..2202c285957cf8
--- /dev/null
+++ b/deps/v8/src/compiler/backend/s390/unwinding-info-writer-s390.h
@@ -0,0 +1,73 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_BACKEND_S390_UNWINDING_INFO_WRITER_S390_H_
+#define V8_COMPILER_BACKEND_S390_UNWINDING_INFO_WRITER_S390_H_
+
+#include "src/diagnostics/eh-frame.h"
+#include "src/flags/flags.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+class InstructionBlock;
+
+class UnwindingInfoWriter {
+ public:
+  explicit UnwindingInfoWriter(Zone* zone)
+      : zone_(zone),
+        eh_frame_writer_(zone),
+        saved_lr_(false),
+        block_will_exit_(false),
+        block_initial_states_(zone) {
+    if (enabled()) eh_frame_writer_.Initialize();
+  }
+
+  void SetNumberOfInstructionBlocks(int number) {
+    if (enabled()) block_initial_states_.resize(number);
+  }
+
+  void BeginInstructionBlock(int pc_offset, const InstructionBlock* block);
+  void EndInstructionBlock(const InstructionBlock* block);
+
+  void MarkLinkRegisterOnTopOfStack(int pc_offset);
+  void MarkPopLinkRegisterFromTopOfStack(int pc_offset);
+
+  void MarkFrameConstructed(int at_pc);
+  void MarkFrameDeconstructed(int at_pc);
+
+  void MarkBlockWillExit() { block_will_exit_ = true; }
+
+  void Finish(int code_size) {
+    if (enabled()) eh_frame_writer_.Finish(code_size);
+  }
+
+  EhFrameWriter* eh_frame_writer() {
+    return enabled() ? &eh_frame_writer_ : nullptr;
+  }
+
+ private:
+  bool enabled() const { return FLAG_perf_prof_unwinding_info; }
+
+  class BlockInitialState : public ZoneObject {
+   public:
+    explicit BlockInitialState(bool saved_lr) : saved_lr_(saved_lr) {}
+
+    bool saved_lr_;
+  };
+
+  Zone* zone_;
+  EhFrameWriter eh_frame_writer_;
+  bool saved_lr_;
+  bool block_will_exit_;
+
+  ZoneVector<const BlockInitialState*> block_initial_states_;
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_BACKEND_S390_UNWINDING_INFO_WRITER_S390_H_
diff --git a/deps/v8/src/compiler/backend/unwinding-info-writer.h b/deps/v8/src/compiler/backend/unwinding-info-writer.h
index d3a52b34b7712a..7f195db51b06cc 100644
--- a/deps/v8/src/compiler/backend/unwinding-info-writer.h
+++ b/deps/v8/src/compiler/backend/unwinding-info-writer.h
@@ -13,6 +13,10 @@
 #include "src/compiler/backend/arm64/unwinding-info-writer-arm64.h"
 #elif V8_TARGET_ARCH_X64
 #include "src/compiler/backend/x64/unwinding-info-writer-x64.h"
+#elif V8_TARGET_ARCH_S390X
+#include "src/compiler/backend/s390/unwinding-info-writer-s390.h"
+#elif V8_TARGET_ARCH_PPC64
+#include "src/compiler/backend/ppc/unwinding-info-writer-ppc.h"
 #else
 
 // Placeholder for unsupported architectures.
@@ -29,20 +33,19 @@ namespace compiler {
 
 class InstructionBlock;
 
+static_assert(!FLAG_perf_prof_unwinding_info,
+              "--perf-prof-unwinding-info should be statically disabled if not "
+              "supported");
+
 class UnwindingInfoWriter {
  public:
-  explicit UnwindingInfoWriter(Zone* zone) {}
-
-  void SetNumberOfInstructionBlocks(int number) {
-    if (FLAG_perf_prof_unwinding_info) UNIMPLEMENTED();
-  }
-
-  void BeginInstructionBlock(int pc_offset, const InstructionBlock* block) {
-    if (FLAG_perf_prof_unwinding_info) UNIMPLEMENTED();
-  }
-  void EndInstructionBlock(const InstructionBlock* block) {
-    if (FLAG_perf_prof_unwinding_info) UNIMPLEMENTED();
-  }
+  explicit UnwindingInfoWriter(Zone*) {}
+
+  void SetNumberOfInstructionBlocks(int number) {}
+
+  void BeginInstructionBlock(int pc_offset, const InstructionBlock*) {}
+
+  void EndInstructionBlock(const InstructionBlock*) {}
 
   void Finish(int code_size) {}
 
diff --git a/deps/v8/src/compiler/backend/x64/code-generator-x64.cc b/deps/v8/src/compiler/backend/x64/code-generator-x64.cc
index 44da872f26d0a4..571502be77bba0 100644
--- a/deps/v8/src/compiler/backend/x64/code-generator-x64.cc
+++ b/deps/v8/src/compiler/backend/x64/code-generator-x64.cc
@@ -280,7 +280,7 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
       // Just encode the stub index. This will be patched when the code
       // is added to the native module and copied into wasm code space.
       __ CallRecordWriteStub(object_, scratch1_, remembered_set_action,
-                             save_fp_mode, wasm::WasmCode::kWasmRecordWrite);
+                             save_fp_mode, wasm::WasmCode::kRecordWrite);
     } else {
       __ CallRecordWriteStub(object_, scratch1_, remembered_set_action,
                              save_fp_mode);
@@ -632,9 +632,7 @@ void CodeGenerator::AssemblePopArgumentsAdaptorFrame(Register args_reg,
   __ SmiUntag(caller_args_count_reg,
               Operand(rbp, ArgumentsAdaptorFrameConstants::kLengthOffset));
 
-  ParameterCount callee_args_count(args_reg);
-  __ PrepareForTailCall(callee_args_count, caller_args_count_reg, scratch2,
-                        scratch3);
+  __ PrepareForTailCall(args_reg, caller_args_count_reg, scratch2, scratch3);
   __ bind(&done);
 }
 
@@ -942,7 +940,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ CallCFunction(func, num_parameters);
       }
       __ bind(&return_location);
-      RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
+      if (linkage()->GetIncomingDescriptor()->IsWasmCapiFunction()) {
+        RecordSafepoint(instr->reference_map(), Safepoint::kNoLazyDeopt);
+      }
       frame_access_state()->SetFrameAccessToDefault();
       // Ideally, we should decrement SP delta to match the change of stack
       // pointer in CallCFunction. However, for certain architectures (e.g.
@@ -1022,14 +1022,29 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     case kArchStackPointerGreaterThan: {
+      // Potentially apply an offset to the current stack pointer before the
+      // comparison to consider the size difference of an optimized frame versus
+      // the contained unoptimized frames.
+
+      Register lhs_register = rsp;
+      uint32_t offset;
+
+      if (ShouldApplyOffsetToStackCheck(instr, &offset)) {
+        lhs_register = kScratchRegister;
+        __ leaq(lhs_register, Operand(rsp, static_cast<int32_t>(offset) * -1));
+      }
+
       constexpr size_t kValueIndex = 0;
       if (HasAddressingMode(instr)) {
-        __ cmpq(rsp, i.MemoryOperand(kValueIndex));
+        __ cmpq(lhs_register, i.MemoryOperand(kValueIndex));
       } else {
-        __ cmpq(rsp, i.InputRegister(kValueIndex));
+        __ cmpq(lhs_register, i.InputRegister(kValueIndex));
       }
       break;
     }
+    case kArchStackCheckOffset:
+      __ Move(i.OutputRegister(), Smi::FromInt(GetStackCheckOffset()));
+      break;
     case kArchTruncateDoubleToI: {
       auto result = i.OutputRegister();
       auto input = i.InputDoubleRegister(0);
@@ -1614,13 +1629,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
           __ Ucomiss(kScratchDoubleReg, i.InputOperand(0));
         }
         // If the input is NaN, then the conversion fails.
-        __ j(parity_even, &fail);
+        __ j(parity_even, &fail, Label::kNear);
         // If the input is INT64_MIN, then the conversion succeeds.
-        __ j(equal, &done);
+        __ j(equal, &done, Label::kNear);
         __ cmpq(i.OutputRegister(0), Immediate(1));
         // If the conversion results in INT64_MIN, but the input was not
         // INT64_MIN, then the conversion fails.
-        __ j(no_overflow, &done);
+        __ j(no_overflow, &done, Label::kNear);
         __ bind(&fail);
         __ Set(i.OutputRegister(1), 0);
         __ bind(&done);
@@ -1643,13 +1658,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
           __ Ucomisd(kScratchDoubleReg, i.InputOperand(0));
         }
         // If the input is NaN, then the conversion fails.
-        __ j(parity_even, &fail);
+        __ j(parity_even, &fail, Label::kNear);
         // If the input is INT64_MIN, then the conversion succeeds.
-        __ j(equal, &done);
+        __ j(equal, &done, Label::kNear);
         __ cmpq(i.OutputRegister(0), Immediate(1));
         // If the conversion results in INT64_MIN, but the input was not
         // INT64_MIN, then the conversion fails.
-        __ j(no_overflow, &done);
+        __ j(no_overflow, &done, Label::kNear);
         __ bind(&fail);
         __ Set(i.OutputRegister(1), 0);
         __ bind(&done);
@@ -2001,24 +2016,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     }
-    case kX64DecompressSigned: {
-      CHECK(instr->HasOutput());
-      ASSEMBLE_MOVX(DecompressTaggedSigned);
-      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
-      break;
-    }
-    case kX64DecompressPointer: {
-      CHECK(instr->HasOutput());
-      ASSEMBLE_MOVX(DecompressTaggedPointer);
-      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
-      break;
-    }
-    case kX64DecompressAny: {
-      CHECK(instr->HasOutput());
-      ASSEMBLE_MOVX(DecompressAnyTagged);
-      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
-      break;
-    }
     case kX64Movq:
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
       if (instr->HasOutput()) {
@@ -2270,26 +2267,26 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       CpuFeatureScope sse_scope(tasm(), SSE3);
       XMMRegister dst = i.OutputSimd128Register();
       if (instr->InputAt(0)->IsFPRegister()) {
-        __ movddup(dst, i.InputDoubleRegister(0));
+        __ Movddup(dst, i.InputDoubleRegister(0));
       } else {
-        __ movddup(dst, i.InputOperand(0));
+        __ Movddup(dst, i.InputOperand(0));
       }
       break;
     }
     case kX64F64x2ReplaceLane: {
       CpuFeatureScope sse_scope(tasm(), SSE4_1);
       if (instr->InputAt(2)->IsFPRegister()) {
-        __ movq(kScratchRegister, i.InputDoubleRegister(2));
-        __ pinsrq(i.OutputSimd128Register(), kScratchRegister, i.InputInt8(1));
+        __ Movq(kScratchRegister, i.InputDoubleRegister(2));
+        __ Pinsrq(i.OutputSimd128Register(), kScratchRegister, i.InputInt8(1));
       } else {
-        __ pinsrq(i.OutputSimd128Register(), i.InputOperand(2), i.InputInt8(1));
+        __ Pinsrq(i.OutputSimd128Register(), i.InputOperand(2), i.InputInt8(1));
       }
       break;
     }
     case kX64F64x2ExtractLane: {
       CpuFeatureScope sse_scope(tasm(), SSE4_1);
-      __ pextrq(kScratchRegister, i.InputSimd128Register(0), i.InputInt8(1));
-      __ movq(i.OutputDoubleRegister(), kScratchRegister);
+      __ Pextrq(kScratchRegister, i.InputSimd128Register(0), i.InputInt8(1));
+      __ Movq(i.OutputDoubleRegister(), kScratchRegister);
       break;
     }
     case kX64F64x2Sqrt: {
@@ -2297,19 +2294,19 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64F64x2Add: {
-      ASSEMBLE_SSE_BINOP(addpd);
+      ASSEMBLE_SSE_BINOP(Addpd);
       break;
     }
     case kX64F64x2Sub: {
-      ASSEMBLE_SSE_BINOP(subpd);
+      ASSEMBLE_SSE_BINOP(Subpd);
       break;
     }
     case kX64F64x2Mul: {
-      ASSEMBLE_SSE_BINOP(mulpd);
+      ASSEMBLE_SSE_BINOP(Mulpd);
       break;
     }
     case kX64F64x2Div: {
-      ASSEMBLE_SSE_BINOP(divpd);
+      ASSEMBLE_SSE_BINOP(Divpd);
       break;
     }
     case kX64F64x2Min: {
@@ -2318,16 +2315,16 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       DCHECK_EQ(dst, i.InputSimd128Register(0));
       // The minpd instruction doesn't propagate NaNs and +0's in its first
       // operand. Perform minpd in both orders, merge the resuls, and adjust.
-      __ movapd(kScratchDoubleReg, src1);
-      __ minpd(kScratchDoubleReg, dst);
-      __ minpd(dst, src1);
+      __ Movapd(kScratchDoubleReg, src1);
+      __ Minpd(kScratchDoubleReg, dst);
+      __ Minpd(dst, src1);
       // propagate -0's and NaNs, which may be non-canonical.
-      __ orpd(kScratchDoubleReg, dst);
+      __ Orpd(kScratchDoubleReg, dst);
       // Canonicalize NaNs by quieting and clearing the payload.
-      __ cmppd(dst, kScratchDoubleReg, 3);
-      __ orpd(kScratchDoubleReg, dst);
-      __ psrlq(dst, 13);
-      __ andnpd(dst, kScratchDoubleReg);
+      __ Cmppd(dst, kScratchDoubleReg, static_cast<int8_t>(3));
+      __ Orpd(kScratchDoubleReg, dst);
+      __ Psrlq(dst, 13);
+      __ Andnpd(dst, kScratchDoubleReg);
       break;
     }
     case kX64F64x2Max: {
@@ -2336,19 +2333,19 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       DCHECK_EQ(dst, i.InputSimd128Register(0));
       // The maxpd instruction doesn't propagate NaNs and +0's in its first
       // operand. Perform maxpd in both orders, merge the resuls, and adjust.
-      __ movapd(kScratchDoubleReg, src1);
-      __ maxpd(kScratchDoubleReg, dst);
-      __ maxpd(dst, src1);
+      __ Movapd(kScratchDoubleReg, src1);
+      __ Maxpd(kScratchDoubleReg, dst);
+      __ Maxpd(dst, src1);
       // Find discrepancies.
-      __ xorpd(dst, kScratchDoubleReg);
+      __ Xorpd(dst, kScratchDoubleReg);
       // Propagate NaNs, which may be non-canonical.
-      __ orpd(kScratchDoubleReg, dst);
+      __ Orpd(kScratchDoubleReg, dst);
       // Propagate sign discrepancy and (subtle) quiet NaNs.
-      __ subpd(kScratchDoubleReg, dst);
+      __ Subpd(kScratchDoubleReg, dst);
       // Canonicalize NaNs by clearing the payload. Sign is non-deterministic.
-      __ cmppd(dst, kScratchDoubleReg, 3);
-      __ psrlq(dst, 13);
-      __ andnpd(dst, kScratchDoubleReg);
+      __ Cmppd(dst, kScratchDoubleReg, static_cast<int8_t>(3));
+      __ Psrlq(dst, 13);
+      __ Andnpd(dst, kScratchDoubleReg);
       break;
     }
     case kX64F64x2Eq: {
@@ -2378,9 +2375,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                        i.InputSimd128Register(2));
       } else {
         XMMRegister tmp = i.TempSimd128Register(0);
-        __ movapd(tmp, i.InputSimd128Register(2));
-        __ mulpd(tmp, i.InputSimd128Register(1));
-        __ addpd(i.OutputSimd128Register(), tmp);
+        __ Movapd(tmp, i.InputSimd128Register(2));
+        __ Mulpd(tmp, i.InputSimd128Register(1));
+        __ Addpd(i.OutputSimd128Register(), tmp);
       }
       break;
     }
@@ -2391,9 +2388,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                         i.InputSimd128Register(2));
       } else {
         XMMRegister tmp = i.TempSimd128Register(0);
-        __ movapd(tmp, i.InputSimd128Register(2));
-        __ mulpd(tmp, i.InputSimd128Register(1));
-        __ subpd(i.OutputSimd128Register(), tmp);
+        __ Movapd(tmp, i.InputSimd128Register(2));
+        __ Mulpd(tmp, i.InputSimd128Register(1));
+        __ Subpd(i.OutputSimd128Register(), tmp);
       }
       break;
     }
@@ -2401,34 +2398,32 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kX64F32x4Splat: {
       XMMRegister dst = i.OutputSimd128Register();
       if (instr->InputAt(0)->IsFPRegister()) {
-        __ movss(dst, i.InputDoubleRegister(0));
+        __ Movss(dst, i.InputDoubleRegister(0));
       } else {
-        __ movss(dst, i.InputOperand(0));
+        __ Movss(dst, i.InputOperand(0));
       }
-      __ shufps(dst, dst, 0x0);
+      __ Shufps(dst, dst, static_cast<byte>(0x0));
       break;
     }
     case kX64F32x4ExtractLane: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
-      __ extractps(kScratchRegister, i.InputSimd128Register(0), i.InputInt8(1));
-      __ movd(i.OutputDoubleRegister(), kScratchRegister);
+      __ Extractps(kScratchRegister, i.InputSimd128Register(0), i.InputInt8(1));
+      __ Movd(i.OutputDoubleRegister(), kScratchRegister);
       break;
     }
     case kX64F32x4ReplaceLane: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       // The insertps instruction uses imm8[5:4] to indicate the lane
       // that needs to be replaced.
       byte select = i.InputInt8(1) << 4 & 0x30;
       if (instr->InputAt(2)->IsFPRegister()) {
-        __ insertps(i.OutputSimd128Register(), i.InputDoubleRegister(2),
+        __ Insertps(i.OutputSimd128Register(), i.InputDoubleRegister(2),
                     select);
       } else {
-        __ insertps(i.OutputSimd128Register(), i.InputOperand(2), select);
+        __ Insertps(i.OutputSimd128Register(), i.InputOperand(2), select);
       }
       break;
     }
     case kX64F32x4SConvertI32x4: {
-      __ cvtdq2ps(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      __ Cvtdq2ps(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
     case kX64F32x4UConvertI32x4: {
@@ -2436,27 +2431,29 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       DCHECK_NE(i.OutputSimd128Register(), kScratchDoubleReg);
       CpuFeatureScope sse_scope(tasm(), SSE4_1);
       XMMRegister dst = i.OutputSimd128Register();
-      __ pxor(kScratchDoubleReg, kScratchDoubleReg);      // zeros
-      __ pblendw(kScratchDoubleReg, dst, 0x55);           // get lo 16 bits
-      __ psubd(dst, kScratchDoubleReg);                   // get hi 16 bits
-      __ cvtdq2ps(kScratchDoubleReg, kScratchDoubleReg);  // convert lo exactly
-      __ psrld(dst, 1);                  // divide by 2 to get in unsigned range
-      __ cvtdq2ps(dst, dst);             // convert hi exactly
-      __ addps(dst, dst);                // double hi, exactly
-      __ addps(dst, kScratchDoubleReg);  // add hi and lo, may round.
+      __ Pxor(kScratchDoubleReg, kScratchDoubleReg);  // zeros
+      __ Pblendw(kScratchDoubleReg, dst,
+                 static_cast<uint8_t>(0x55));             // get lo 16 bits
+      __ Psubd(dst, kScratchDoubleReg);                   // get hi 16 bits
+      __ Cvtdq2ps(kScratchDoubleReg, kScratchDoubleReg);  // convert lo exactly
+      __ Psrld(dst,
+               static_cast<byte>(1));    // divide by 2 to get in unsigned range
+      __ Cvtdq2ps(dst, dst);             // convert hi exactly
+      __ Addps(dst, dst);                // double hi, exactly
+      __ Addps(dst, kScratchDoubleReg);  // add hi and lo, may round.
       break;
     }
     case kX64F32x4Abs: {
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister src = i.InputSimd128Register(0);
       if (dst == src) {
-        __ pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
-        __ psrld(kScratchDoubleReg, 1);
-        __ andps(i.OutputSimd128Register(), kScratchDoubleReg);
+        __ Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+        __ Psrld(kScratchDoubleReg, static_cast<byte>(1));
+        __ Andps(i.OutputSimd128Register(), kScratchDoubleReg);
       } else {
-        __ pcmpeqd(dst, dst);
-        __ psrld(dst, 1);
-        __ andps(dst, i.InputSimd128Register(0));
+        __ Pcmpeqd(dst, dst);
+        __ Psrld(dst, static_cast<byte>(1));
+        __ Andps(dst, i.InputSimd128Register(0));
       }
       break;
     }
@@ -2464,52 +2461,52 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister src = i.InputSimd128Register(0);
       if (dst == src) {
-        __ pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
-        __ pslld(kScratchDoubleReg, 31);
-        __ xorps(i.OutputSimd128Register(), kScratchDoubleReg);
+        __ Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+        __ Pslld(kScratchDoubleReg, static_cast<byte>(31));
+        __ Xorps(i.OutputSimd128Register(), kScratchDoubleReg);
       } else {
-        __ pcmpeqd(dst, dst);
-        __ pslld(dst, 31);
-        __ xorps(dst, i.InputSimd128Register(0));
+        __ Pcmpeqd(dst, dst);
+        __ Pslld(dst, static_cast<byte>(31));
+        __ Xorps(dst, i.InputSimd128Register(0));
       }
       break;
     }
     case kX64F32x4Sqrt: {
-      __ sqrtps(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      __ Sqrtps(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
     case kX64F32x4RecipApprox: {
-      __ rcpps(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      __ Rcpps(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
     case kX64F32x4RecipSqrtApprox: {
-      __ rsqrtps(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      __ Rsqrtps(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
     case kX64F32x4Add: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ addps(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      __ Addps(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64F32x4AddHoriz: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       CpuFeatureScope sse_scope(tasm(), SSE3);
-      __ haddps(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      __ Haddps(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64F32x4Sub: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ subps(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      __ Subps(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64F32x4Mul: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ mulps(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      __ Mulps(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64F32x4Div: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ divps(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      __ Divps(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64F32x4Min: {
@@ -2518,16 +2515,16 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       DCHECK_EQ(dst, i.InputSimd128Register(0));
       // The minps instruction doesn't propagate NaNs and +0's in its first
       // operand. Perform minps in both orders, merge the resuls, and adjust.
-      __ movaps(kScratchDoubleReg, src1);
-      __ minps(kScratchDoubleReg, dst);
-      __ minps(dst, src1);
+      __ Movaps(kScratchDoubleReg, src1);
+      __ Minps(kScratchDoubleReg, dst);
+      __ Minps(dst, src1);
       // propagate -0's and NaNs, which may be non-canonical.
-      __ orps(kScratchDoubleReg, dst);
+      __ Orps(kScratchDoubleReg, dst);
       // Canonicalize NaNs by quieting and clearing the payload.
-      __ cmpps(dst, kScratchDoubleReg, 3);
-      __ orps(kScratchDoubleReg, dst);
-      __ psrld(dst, 10);
-      __ andnps(dst, kScratchDoubleReg);
+      __ Cmpps(dst, kScratchDoubleReg, static_cast<int8_t>(3));
+      __ Orps(kScratchDoubleReg, dst);
+      __ Psrld(dst, static_cast<byte>(10));
+      __ Andnps(dst, kScratchDoubleReg);
       break;
     }
     case kX64F32x4Max: {
@@ -2536,39 +2533,41 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       DCHECK_EQ(dst, i.InputSimd128Register(0));
       // The maxps instruction doesn't propagate NaNs and +0's in its first
       // operand. Perform maxps in both orders, merge the resuls, and adjust.
-      __ movaps(kScratchDoubleReg, src1);
-      __ maxps(kScratchDoubleReg, dst);
-      __ maxps(dst, src1);
+      __ Movaps(kScratchDoubleReg, src1);
+      __ Maxps(kScratchDoubleReg, dst);
+      __ Maxps(dst, src1);
       // Find discrepancies.
-      __ xorps(dst, kScratchDoubleReg);
+      __ Xorps(dst, kScratchDoubleReg);
       // Propagate NaNs, which may be non-canonical.
-      __ orps(kScratchDoubleReg, dst);
+      __ Orps(kScratchDoubleReg, dst);
       // Propagate sign discrepancy and (subtle) quiet NaNs.
-      __ subps(kScratchDoubleReg, dst);
+      __ Subps(kScratchDoubleReg, dst);
       // Canonicalize NaNs by clearing the payload. Sign is non-deterministic.
-      __ cmpps(dst, kScratchDoubleReg, 3);
-      __ psrld(dst, 10);
-      __ andnps(dst, kScratchDoubleReg);
+      __ Cmpps(dst, kScratchDoubleReg, static_cast<int8_t>(3));
+      __ Psrld(dst, static_cast<byte>(10));
+      __ Andnps(dst, kScratchDoubleReg);
       break;
     }
     case kX64F32x4Eq: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ cmpps(i.OutputSimd128Register(), i.InputSimd128Register(1), 0x0);
+      __ Cmpps(i.OutputSimd128Register(), i.InputSimd128Register(1),
+               static_cast<int8_t>(0x0));
       break;
     }
     case kX64F32x4Ne: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ cmpps(i.OutputSimd128Register(), i.InputSimd128Register(1), 0x4);
+      __ Cmpps(i.OutputSimd128Register(), i.InputSimd128Register(1),
+               static_cast<int8_t>(0x4));
       break;
     }
     case kX64F32x4Lt: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ cmpltps(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      __ Cmpltps(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64F32x4Le: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ cmpleps(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      __ Cmpleps(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64F32x4Qfma: {
@@ -2578,9 +2577,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                        i.InputSimd128Register(2));
       } else {
         XMMRegister tmp = i.TempSimd128Register(0);
-        __ movaps(tmp, i.InputSimd128Register(2));
-        __ mulps(tmp, i.InputSimd128Register(1));
-        __ addps(i.OutputSimd128Register(), tmp);
+        __ Movaps(tmp, i.InputSimd128Register(2));
+        __ Mulps(tmp, i.InputSimd128Register(1));
+        __ Addps(i.OutputSimd128Register(), tmp);
       }
       break;
     }
@@ -2591,9 +2590,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                         i.InputSimd128Register(2));
       } else {
         XMMRegister tmp = i.TempSimd128Register(0);
-        __ movaps(tmp, i.InputSimd128Register(2));
-        __ mulps(tmp, i.InputSimd128Register(1));
-        __ subps(i.OutputSimd128Register(), tmp);
+        __ Movaps(tmp, i.InputSimd128Register(2));
+        __ Mulps(tmp, i.InputSimd128Register(1));
+        __ Subps(i.OutputSimd128Register(), tmp);
       }
       break;
     }
@@ -2601,25 +2600,25 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       CpuFeatureScope sse_scope(tasm(), SSE3);
       XMMRegister dst = i.OutputSimd128Register();
       if (HasRegisterInput(instr, 0)) {
-        __ movq(dst, i.InputRegister(0));
+        __ Movq(dst, i.InputRegister(0));
       } else {
-        __ movq(dst, i.InputOperand(0));
+        __ Movq(dst, i.InputOperand(0));
       }
-      __ movddup(dst, dst);
+      __ Movddup(dst, dst);
       break;
     }
     case kX64I64x2ExtractLane: {
       CpuFeatureScope sse_scope(tasm(), SSE4_1);
-      __ pextrq(i.OutputRegister(), i.InputSimd128Register(0), i.InputInt8(1));
+      __ Pextrq(i.OutputRegister(), i.InputSimd128Register(0), i.InputInt8(1));
       break;
     }
     case kX64I64x2ReplaceLane: {
       CpuFeatureScope sse_scope(tasm(), SSE4_1);
       if (HasRegisterInput(instr, 2)) {
-        __ pinsrq(i.OutputSimd128Register(), i.InputRegister(2),
+        __ Pinsrq(i.OutputSimd128Register(), i.InputRegister(2),
                   i.InputInt8(1));
       } else {
-        __ pinsrq(i.OutputSimd128Register(), i.InputOperand(2), i.InputInt8(1));
+        __ Pinsrq(i.OutputSimd128Register(), i.InputOperand(2), i.InputInt8(1));
       }
       break;
     }
@@ -2627,11 +2626,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister src = i.InputSimd128Register(0);
       if (dst == src) {
-        __ movapd(kScratchDoubleReg, src);
+        __ Movapd(kScratchDoubleReg, src);
         src = kScratchDoubleReg;
       }
-      __ pxor(dst, dst);
-      __ psubq(dst, src);
+      __ Pxor(dst, dst);
+      __ Psubq(dst, src);
       break;
     }
     case kX64I64x2Shl: {
@@ -2665,38 +2664,37 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kX64I64x2Add: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ paddq(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      __ Paddq(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64I64x2Sub: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ psubq(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      __ Psubq(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64I64x2Mul: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       XMMRegister left = i.InputSimd128Register(0);
       XMMRegister right = i.InputSimd128Register(1);
       XMMRegister tmp1 = i.TempSimd128Register(0);
       XMMRegister tmp2 = i.TempSimd128Register(1);
 
-      __ movaps(tmp1, left);
-      __ movaps(tmp2, right);
+      __ Movaps(tmp1, left);
+      __ Movaps(tmp2, right);
 
       // Multiply high dword of each qword of left with right.
-      __ psrlq(tmp1, 32);
-      __ pmuludq(tmp1, right);
+      __ Psrlq(tmp1, 32);
+      __ Pmuludq(tmp1, right);
 
       // Multiply high dword of each qword of right with left.
-      __ psrlq(tmp2, 32);
-      __ pmuludq(tmp2, left);
+      __ Psrlq(tmp2, 32);
+      __ Pmuludq(tmp2, left);
 
-      __ paddq(tmp2, tmp1);
-      __ psllq(tmp2, 32);
+      __ Paddq(tmp2, tmp1);
+      __ Psllq(tmp2, 32);
 
-      __ pmuludq(left, right);
-      __ paddq(left, tmp2);  // left == dst
+      __ Pmuludq(left, right);
+      __ Paddq(left, tmp2);  // left == dst
       break;
     }
     case kX64I64x2MinS: {
@@ -2761,36 +2759,32 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kX64I64x2Eq: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
-      __ pcmpeqq(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      __ Pcmpeqq(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64I64x2Ne: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       XMMRegister tmp = i.TempSimd128Register(0);
-      __ pcmpeqq(i.OutputSimd128Register(), i.InputSimd128Register(1));
-      __ pcmpeqq(tmp, tmp);
-      __ pxor(i.OutputSimd128Register(), tmp);
+      __ Pcmpeqq(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      __ Pcmpeqq(tmp, tmp);
+      __ Pxor(i.OutputSimd128Register(), tmp);
       break;
     }
     case kX64I64x2GtS: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      CpuFeatureScope sse_scope(tasm(), SSE4_2);
-      __ pcmpgtq(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      __ Pcmpgtq(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64I64x2GeS: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      CpuFeatureScope sse_scope(tasm(), SSE4_2);
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister src = i.InputSimd128Register(1);
       XMMRegister tmp = i.TempSimd128Register(0);
 
-      __ movaps(tmp, src);
-      __ pcmpgtq(tmp, dst);
-      __ pcmpeqd(dst, dst);
-      __ pxor(dst, tmp);
+      __ Movaps(tmp, src);
+      __ Pcmpgtq(tmp, dst);
+      __ Pcmpeqd(dst, dst);
+      __ Pxor(dst, tmp);
       break;
     }
     case kX64I64x2ShrU: {
@@ -2849,18 +2843,17 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kX64I64x2GtU: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      CpuFeatureScope sse_scope(tasm(), SSE4_2);
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister src = i.InputSimd128Register(1);
       XMMRegister tmp = i.TempSimd128Register(0);
 
-      __ pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
-      __ psllq(kScratchDoubleReg, 63);
+      __ Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+      __ Psllq(kScratchDoubleReg, 63);
 
-      __ movaps(tmp, src);
-      __ pxor(tmp, kScratchDoubleReg);
-      __ pxor(dst, kScratchDoubleReg);
-      __ pcmpgtq(dst, tmp);
+      __ Movaps(tmp, src);
+      __ Pxor(tmp, kScratchDoubleReg);
+      __ Pxor(dst, kScratchDoubleReg);
+      __ Pcmpgtq(dst, tmp);
       break;
     }
     case kX64I64x2GeU: {
@@ -2870,15 +2863,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       XMMRegister src = i.InputSimd128Register(1);
       XMMRegister tmp = i.TempSimd128Register(0);
 
-      __ pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
-      __ psllq(kScratchDoubleReg, 63);
+      __ Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+      __ Psllq(kScratchDoubleReg, 63);
 
-      __ movaps(tmp, src);
-      __ pxor(dst, kScratchDoubleReg);
-      __ pxor(tmp, kScratchDoubleReg);
-      __ pcmpgtq(tmp, dst);
-      __ pcmpeqd(dst, dst);
-      __ pxor(dst, tmp);
+      __ Movaps(tmp, src);
+      __ Pxor(dst, kScratchDoubleReg);
+      __ Pxor(tmp, kScratchDoubleReg);
+      __ Pcmpgtq(tmp, dst);
+      __ Pcmpeqd(dst, dst);
+      __ Pxor(dst, tmp);
       break;
     }
     case kX64I32x4Splat: {
@@ -2888,7 +2881,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       } else {
         __ Movd(dst, i.InputOperand(0));
       }
-      __ Pshufd(dst, dst, 0x0);
+      __ Pshufd(dst, dst, static_cast<uint8_t>(0x0));
       break;
     }
     case kX64I32x4ExtractLane: {
@@ -2927,14 +2920,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kX64I32x4SConvertI16x8Low: {
       CpuFeatureScope sse_scope(tasm(), SSE4_1);
-      __ pmovsxwd(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      __ Pmovsxwd(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
     case kX64I32x4SConvertI16x8High: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       XMMRegister dst = i.OutputSimd128Register();
-      __ palignr(dst, i.InputSimd128Register(0), 8);
-      __ pmovsxwd(dst, dst);
+      __ Palignr(dst, i.InputSimd128Register(0), static_cast<uint8_t>(8));
+      __ Pmovsxwd(dst, dst);
       break;
     }
     case kX64I32x4Neg: {
@@ -3049,15 +3041,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64I32x4UConvertI16x8Low: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
-      __ pmovzxwd(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      __ Pmovzxwd(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
     case kX64I32x4UConvertI16x8High: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       XMMRegister dst = i.OutputSimd128Register();
-      __ palignr(dst, i.InputSimd128Register(0), 8);
-      __ pmovzxwd(dst, dst);
+      __ Palignr(dst, i.InputSimd128Register(0), static_cast<uint8_t>(8));
+      __ Pmovzxwd(dst, dst);
       break;
     }
     case kX64I32x4ShrU: {
@@ -3114,10 +3104,17 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ pshufd(dst, dst, 0x0);
       break;
     }
-    case kX64I16x8ExtractLane: {
+    case kX64I16x8ExtractLaneU: {
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      Register dst = i.OutputRegister();
+      __ Pextrw(dst, i.InputSimd128Register(0), i.InputInt8(1));
+      break;
+    }
+    case kX64I16x8ExtractLaneS: {
       CpuFeatureScope sse_scope(tasm(), SSE4_1);
       Register dst = i.OutputRegister();
       __ Pextrw(dst, i.InputSimd128Register(0), i.InputInt8(1));
+      __ movsxwl(dst, dst);
       break;
     }
     case kX64I16x8ReplaceLane: {
@@ -3131,15 +3128,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64I16x8SConvertI8x16Low: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
-      __ pmovsxbw(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      __ Pmovsxbw(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
     case kX64I16x8SConvertI8x16High: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       XMMRegister dst = i.OutputSimd128Register();
-      __ palignr(dst, i.InputSimd128Register(0), 8);
-      __ pmovsxbw(dst, dst);
+      __ Palignr(dst, i.InputSimd128Register(0), static_cast<uint8_t>(8));
+      __ Pmovsxbw(dst, dst);
       break;
     }
     case kX64I16x8Neg: {
@@ -3243,10 +3238,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64I16x8UConvertI8x16High: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       XMMRegister dst = i.OutputSimd128Register();
-      __ palignr(dst, i.InputSimd128Register(0), 8);
-      __ pmovzxbw(dst, dst);
+      __ Palignr(dst, i.InputSimd128Register(0), static_cast<uint8_t>(8));
+      __ Pmovzxbw(dst, dst);
       break;
     }
     case kX64I16x8ShrU: {
@@ -3261,13 +3255,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kX64I16x8UConvertI32x4: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       CpuFeatureScope sse_scope(tasm(), SSE4_1);
-      XMMRegister dst = i.OutputSimd128Register();
-      // Change negative lanes to 0x7FFFFFFF
-      __ pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
-      __ psrld(kScratchDoubleReg, 1);
-      __ pminud(dst, kScratchDoubleReg);
-      __ pminud(kScratchDoubleReg, i.InputSimd128Register(1));
-      __ packusdw(dst, kScratchDoubleReg);
+      __ packusdw(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64I16x8AddSaturateU: {
@@ -3307,6 +3295,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ pcmpeqw(dst, src);
       break;
     }
+    case kX64I16x8RoundingAverageU: {
+      __ Pavgw(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      break;
+    }
     case kX64I8x16Splat: {
       CpuFeatureScope sse_scope(tasm(), SSSE3);
       XMMRegister dst = i.OutputSimd128Register();
@@ -3319,10 +3311,17 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Pshufb(dst, kScratchDoubleReg);
       break;
     }
-    case kX64I8x16ExtractLane: {
+    case kX64I8x16ExtractLaneU: {
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      Register dst = i.OutputRegister();
+      __ Pextrb(dst, i.InputSimd128Register(0), i.InputInt8(1));
+      break;
+    }
+    case kX64I8x16ExtractLaneS: {
       CpuFeatureScope sse_scope(tasm(), SSE4_1);
       Register dst = i.OutputRegister();
       __ Pextrb(dst, i.InputSimd128Register(0), i.InputInt8(1));
+      __ movsxbl(dst, dst);
       break;
     }
     case kX64I8x16ReplaceLane: {
@@ -3479,13 +3478,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kX64I8x16UConvertI16x8: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       CpuFeatureScope sse_scope(tasm(), SSE4_1);
-      XMMRegister dst = i.OutputSimd128Register();
-      // Change negative lanes to 0x7FFF
-      __ pcmpeqw(kScratchDoubleReg, kScratchDoubleReg);
-      __ psrlw(kScratchDoubleReg, 1);
-      __ pminuw(dst, kScratchDoubleReg);
-      __ pminuw(kScratchDoubleReg, i.InputSimd128Register(1));
-      __ packuswb(dst, kScratchDoubleReg);
+      __ packuswb(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64I8x16ShrU: {
@@ -3545,6 +3538,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ pcmpeqb(dst, src);
       break;
     }
+    case kX64I8x16RoundingAverageU: {
+      __ Pavgb(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      break;
+    }
     case kX64S128And: {
       __ pand(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
@@ -3580,6 +3577,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Xorps(dst, i.InputSimd128Register(2));
       break;
     }
+    case kX64S128AndNot: {
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      // The inputs have been inverted by instruction selector, so we can call
+      // andnps here without any modifications.
+      __ Andnps(dst, i.InputSimd128Register(1));
+      break;
+    }
     case kX64S8x16Swizzle: {
       CpuFeatureScope sse_scope(tasm(), SSSE3);
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
@@ -3589,7 +3594,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       // Out-of-range indices should return 0, add 112 so that any value > 15
       // saturates to 128 (top bit set), so pshufb will zero that lane.
       __ Move(mask, static_cast<uint32_t>(0x70707070));
-      __ Pshufd(mask, mask, 0x0);
+      __ Pshufd(mask, mask, static_cast<uint8_t>(0x0));
       __ Paddusb(mask, i.InputSimd128Register(1));
       __ Pshufb(dst, mask);
       break;
@@ -3643,6 +3648,74 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ movq(rsp, tmp);
       break;
     }
+    case kX64S8x16LoadSplat: {
+      EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
+      __ Pinsrb(i.OutputSimd128Register(), i.MemoryOperand(), 0);
+      __ Pxor(kScratchDoubleReg, kScratchDoubleReg);
+      __ Pshufb(i.OutputSimd128Register(), kScratchDoubleReg);
+      break;
+    }
+    case kX64S16x8LoadSplat: {
+      EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
+      __ Pinsrw(i.OutputSimd128Register(), i.MemoryOperand(), 0);
+      __ Pshuflw(i.OutputSimd128Register(), i.OutputSimd128Register(),
+                 static_cast<uint8_t>(0));
+      __ Punpcklqdq(i.OutputSimd128Register(), i.OutputSimd128Register());
+      break;
+    }
+    case kX64S32x4LoadSplat: {
+      EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
+      if (CpuFeatures::IsSupported(AVX)) {
+        CpuFeatureScope avx_scope(tasm(), AVX);
+        __ vbroadcastss(i.OutputSimd128Register(), i.MemoryOperand());
+      } else {
+        __ Movss(i.OutputSimd128Register(), i.MemoryOperand());
+        __ Shufps(i.OutputSimd128Register(), i.OutputSimd128Register(),
+                  static_cast<byte>(0));
+      }
+      break;
+    }
+    case kX64S64x2LoadSplat: {
+      EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
+      __ Movddup(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
+    case kX64I16x8Load8x8S: {
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
+      __ Pmovsxbw(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
+    case kX64I16x8Load8x8U: {
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
+      __ Pmovzxbw(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
+    case kX64I32x4Load16x4S: {
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
+      __ Pmovsxwd(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
+    case kX64I32x4Load16x4U: {
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
+      __ Pmovzxwd(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
+    case kX64I64x2Load32x2S: {
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
+      __ Pmovsxdq(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
+    case kX64I64x2Load32x2U: {
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
+      __ Pmovzxdq(i.OutputSimd128Register(), i.MemoryOperand());
+      break;
+    }
     case kX64S32x4Swizzle: {
       DCHECK_EQ(2, instr->InputCount());
       ASSEMBLE_SIMD_IMM_INSTR(pshufd, i.OutputSimd128Register(), 0,
@@ -4150,7 +4223,7 @@ void CodeGenerator::AssembleArchDeoptBranch(Instruction* instr,
     __ pushq(rax);
     __ load_rax(counter);
     __ decl(rax);
-    __ j(not_zero, &nodeopt);
+    __ j(not_zero, &nodeopt, Label::kNear);
 
     __ Set(rax, FLAG_deopt_every_n_times);
     __ store_rax(counter);
@@ -4179,7 +4252,7 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
   Label* tlabel = ool->entry();
   Label end;
   if (condition == kUnorderedEqual) {
-    __ j(parity_even, &end);
+    __ j(parity_even, &end, Label::kNear);
   } else if (condition == kUnorderedNotEqual) {
     __ j(parity_even, tlabel);
   }
@@ -4363,7 +4436,7 @@ void CodeGenerator::AssembleConstructFrame() {
         __ addq(kScratchRegister,
                 Immediate(required_slots * kSystemPointerSize));
         __ cmpq(rsp, kScratchRegister);
-        __ j(above_equal, &done);
+        __ j(above_equal, &done, Label::kNear);
       }
 
       __ near_call(wasm::WasmCode::kWasmStackOverflow,
diff --git a/deps/v8/src/compiler/backend/x64/instruction-codes-x64.h b/deps/v8/src/compiler/backend/x64/instruction-codes-x64.h
index e390c6922c8001..64e87430b74848 100644
--- a/deps/v8/src/compiler/backend/x64/instruction-codes-x64.h
+++ b/deps/v8/src/compiler/backend/x64/instruction-codes-x64.h
@@ -137,9 +137,6 @@ namespace compiler {
   V(X64MovqDecompressTaggedPointer)       \
   V(X64MovqDecompressAnyTagged)           \
   V(X64MovqCompressTagged)                \
-  V(X64DecompressSigned)                  \
-  V(X64DecompressPointer)                 \
-  V(X64DecompressAny)                     \
   V(X64Movq)                              \
   V(X64Movsd)                             \
   V(X64Movss)                             \
@@ -244,7 +241,8 @@ namespace compiler {
   V(X64I32x4GtU)                          \
   V(X64I32x4GeU)                          \
   V(X64I16x8Splat)                        \
-  V(X64I16x8ExtractLane)                  \
+  V(X64I16x8ExtractLaneU)                 \
+  V(X64I16x8ExtractLaneS)                 \
   V(X64I16x8ReplaceLane)                  \
   V(X64I16x8SConvertI8x16Low)             \
   V(X64I16x8SConvertI8x16High)            \
@@ -274,8 +272,10 @@ namespace compiler {
   V(X64I16x8MaxU)                         \
   V(X64I16x8GtU)                          \
   V(X64I16x8GeU)                          \
+  V(X64I16x8RoundingAverageU)             \
   V(X64I8x16Splat)                        \
-  V(X64I8x16ExtractLane)                  \
+  V(X64I8x16ExtractLaneU)                 \
+  V(X64I8x16ExtractLaneS)                 \
   V(X64I8x16ReplaceLane)                  \
   V(X64I8x16SConvertI16x8)                \
   V(X64I8x16Neg)                          \
@@ -300,14 +300,26 @@ namespace compiler {
   V(X64I8x16MaxU)                         \
   V(X64I8x16GtU)                          \
   V(X64I8x16GeU)                          \
+  V(X64I8x16RoundingAverageU)             \
   V(X64S128Zero)                          \
   V(X64S128Not)                           \
   V(X64S128And)                           \
   V(X64S128Or)                            \
   V(X64S128Xor)                           \
   V(X64S128Select)                        \
+  V(X64S128AndNot)                        \
   V(X64S8x16Swizzle)                      \
   V(X64S8x16Shuffle)                      \
+  V(X64S8x16LoadSplat)                    \
+  V(X64S16x8LoadSplat)                    \
+  V(X64S32x4LoadSplat)                    \
+  V(X64S64x2LoadSplat)                    \
+  V(X64I16x8Load8x8S)                     \
+  V(X64I16x8Load8x8U)                     \
+  V(X64I32x4Load16x4S)                    \
+  V(X64I32x4Load16x4U)                    \
+  V(X64I64x2Load32x2S)                    \
+  V(X64I64x2Load32x2U)                    \
   V(X64S32x4Swizzle)                      \
   V(X64S32x4Shuffle)                      \
   V(X64S16x8Blend)                        \
diff --git a/deps/v8/src/compiler/backend/x64/instruction-scheduler-x64.cc b/deps/v8/src/compiler/backend/x64/instruction-scheduler-x64.cc
index 28a935fd9164fe..6563ab5f7c979a 100644
--- a/deps/v8/src/compiler/backend/x64/instruction-scheduler-x64.cc
+++ b/deps/v8/src/compiler/backend/x64/instruction-scheduler-x64.cc
@@ -213,7 +213,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64I32x4GtU:
     case kX64I32x4GeU:
     case kX64I16x8Splat:
-    case kX64I16x8ExtractLane:
+    case kX64I16x8ExtractLaneU:
+    case kX64I16x8ExtractLaneS:
     case kX64I16x8ReplaceLane:
     case kX64I16x8SConvertI8x16Low:
     case kX64I16x8SConvertI8x16High:
@@ -243,8 +244,10 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64I16x8MaxU:
     case kX64I16x8GtU:
     case kX64I16x8GeU:
+    case kX64I16x8RoundingAverageU:
     case kX64I8x16Splat:
-    case kX64I8x16ExtractLane:
+    case kX64I8x16ExtractLaneU:
+    case kX64I8x16ExtractLaneS:
     case kX64I8x16ReplaceLane:
     case kX64I8x16SConvertI16x8:
     case kX64I8x16Neg:
@@ -269,12 +272,14 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64I8x16MaxU:
     case kX64I8x16GtU:
     case kX64I8x16GeU:
+    case kX64I8x16RoundingAverageU:
     case kX64S128And:
     case kX64S128Or:
     case kX64S128Xor:
     case kX64S128Not:
     case kX64S128Select:
     case kX64S128Zero:
+    case kX64S128AndNot:
     case kX64S1x2AnyTrue:
     case kX64S1x2AllTrue:
     case kX64S1x4AnyTrue:
@@ -310,9 +315,6 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64S8x2Reverse:
     case kX64S1x16AnyTrue:
     case kX64S1x16AllTrue:
-    case kX64DecompressSigned:
-    case kX64DecompressPointer:
-    case kX64DecompressAny:
       return (instr->addressing_mode() == kMode_None)
                  ? kNoOpcodeFlags
                  : kIsLoadOperation | kHasSideEffect;
@@ -359,6 +361,16 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64Movsd:
     case kX64Movss:
     case kX64Movdqu:
+    case kX64S8x16LoadSplat:
+    case kX64S16x8LoadSplat:
+    case kX64S32x4LoadSplat:
+    case kX64S64x2LoadSplat:
+    case kX64I16x8Load8x8S:
+    case kX64I16x8Load8x8U:
+    case kX64I32x4Load16x4S:
+    case kX64I32x4Load16x4U:
+    case kX64I64x2Load32x2S:
+    case kX64I64x2Load32x2U:
       return instr->HasOutput() ? kIsLoadOperation : kHasSideEffect;
 
     case kX64Peek:
diff --git a/deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc b/deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc
index f5d05fdd85a384..1046ab9a069897 100644
--- a/deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc
+++ b/deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc
@@ -241,7 +241,6 @@ ArchOpcode GetLoadOpcode(LoadRepresentation load_rep) {
     case MachineRepresentation::kWord32:
       opcode = kX64Movl;
       break;
-    case MachineRepresentation::kCompressedSigned:   // Fall through.
     case MachineRepresentation::kCompressedPointer:  // Fall through.
     case MachineRepresentation::kCompressed:
 #ifdef V8_COMPRESS_POINTERS
@@ -290,7 +289,6 @@ ArchOpcode GetStoreOpcode(StoreRepresentation store_rep) {
       return kX64Movw;
     case MachineRepresentation::kWord32:
       return kX64Movl;
-    case MachineRepresentation::kCompressedSigned:   // Fall through.
     case MachineRepresentation::kCompressedPointer:  // Fall through.
     case MachineRepresentation::kCompressed:
 #ifdef V8_COMPRESS_POINTERS
@@ -328,6 +326,52 @@ void InstructionSelector::VisitAbortCSAAssert(Node* node) {
   Emit(kArchAbortCSAAssert, g.NoOutput(), g.UseFixed(node->InputAt(0), rdx));
 }
 
+void InstructionSelector::VisitLoadTransform(Node* node) {
+  LoadTransformParameters params = LoadTransformParametersOf(node->op());
+  ArchOpcode opcode = kArchNop;
+  switch (params.transformation) {
+    case LoadTransformation::kS8x16LoadSplat:
+      opcode = kX64S8x16LoadSplat;
+      break;
+    case LoadTransformation::kS16x8LoadSplat:
+      opcode = kX64S16x8LoadSplat;
+      break;
+    case LoadTransformation::kS32x4LoadSplat:
+      opcode = kX64S32x4LoadSplat;
+      break;
+    case LoadTransformation::kS64x2LoadSplat:
+      opcode = kX64S64x2LoadSplat;
+      break;
+    case LoadTransformation::kI16x8Load8x8S:
+      opcode = kX64I16x8Load8x8S;
+      break;
+    case LoadTransformation::kI16x8Load8x8U:
+      opcode = kX64I16x8Load8x8U;
+      break;
+    case LoadTransformation::kI32x4Load16x4S:
+      opcode = kX64I32x4Load16x4S;
+      break;
+    case LoadTransformation::kI32x4Load16x4U:
+      opcode = kX64I32x4Load16x4U;
+      break;
+    case LoadTransformation::kI64x2Load32x2S:
+      opcode = kX64I64x2Load32x2S;
+      break;
+    case LoadTransformation::kI64x2Load32x2U:
+      opcode = kX64I64x2Load32x2U;
+      break;
+    default:
+      UNREACHABLE();
+  }
+  // x64 supports unaligned loads
+  DCHECK_NE(params.kind, LoadKind::kUnaligned);
+  InstructionCode code = opcode;
+  if (params.kind == LoadKind::kProtected) {
+    code |= MiscField::encode(kMemoryAccessProtected);
+  }
+  VisitLoad(node, node, code);
+}
+
 void InstructionSelector::VisitLoad(Node* node, Node* value,
                                     InstructionCode opcode) {
   X64OperandGenerator g(this);
@@ -389,8 +433,7 @@ void InstructionSelector::VisitStore(Node* node) {
         opcode | AddressingModeField::encode(addressing_mode);
     if ((ElementSizeLog2Of(store_rep.representation()) <
          kSystemPointerSizeLog2) &&
-        (value->opcode() == IrOpcode::kTruncateInt64ToInt32) &&
-        CanCover(node, value)) {
+        value->opcode() == IrOpcode::kTruncateInt64ToInt32) {
       value = value->InputAt(0);
     }
     InstructionOperand value_operand =
@@ -545,14 +588,18 @@ void InstructionSelector::VisitWord64Xor(Node* node) {
 
 void InstructionSelector::VisitStackPointerGreaterThan(
     Node* node, FlagsContinuation* cont) {
-  Node* const value = node->InputAt(0);
-  InstructionCode opcode = kArchStackPointerGreaterThan;
+  StackCheckKind kind = StackCheckKindOf(node->op());
+  InstructionCode opcode =
+      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
 
-  DCHECK(cont->IsBranch());
-  const int effect_level =
-      GetEffectLevel(cont->true_block()->PredecessorAt(0)->control_input());
+  int effect_level = GetEffectLevel(node);
+  if (cont->IsBranch()) {
+    effect_level =
+        GetEffectLevel(cont->true_block()->PredecessorAt(0)->control_input());
+  }
 
   X64OperandGenerator g(this);
+  Node* const value = node->InputAt(0);
   if (g.CanBeMemoryOperand(kX64Cmp, node, value, effect_level)) {
     DCHECK_EQ(IrOpcode::kLoad, value->opcode());
 
@@ -592,7 +639,6 @@ bool TryMergeTruncateInt64ToInt32IntoLoad(InstructionSelector* selector,
       case MachineRepresentation::kWord64:
       case MachineRepresentation::kTaggedSigned:
       case MachineRepresentation::kTagged:
-      case MachineRepresentation::kCompressedSigned:  // Fall through.
       case MachineRepresentation::kCompressed:        // Fall through.
         opcode = kX64Movl;
         break;
@@ -622,8 +668,7 @@ void VisitWord32Shift(InstructionSelector* selector, Node* node,
   Node* left = m.left().node();
   Node* right = m.right().node();
 
-  if (left->opcode() == IrOpcode::kTruncateInt64ToInt32 &&
-      selector->CanCover(node, left)) {
+  if (left->opcode() == IrOpcode::kTruncateInt64ToInt32) {
     left = left->InputAt(0);
   }
 
@@ -895,6 +940,17 @@ void InstructionSelector::VisitSimd128ReverseBytes(Node* node) {
 void InstructionSelector::VisitInt32Add(Node* node) {
   X64OperandGenerator g(this);
 
+  // No need to truncate the values before Int32Add.
+  DCHECK_EQ(node->InputCount(), 2);
+  Node* left = node->InputAt(0);
+  Node* right = node->InputAt(1);
+  if (left->opcode() == IrOpcode::kTruncateInt64ToInt32) {
+    node->ReplaceInput(0, left->InputAt(0));
+  }
+  if (right->opcode() == IrOpcode::kTruncateInt64ToInt32) {
+    node->ReplaceInput(1, right->InputAt(0));
+  }
+
   // Try to match the Add to a leal pattern
   BaseWithIndexAndDisplacement32Matcher m(node);
   if (m.matches() &&
@@ -1178,7 +1234,19 @@ void InstructionSelector::VisitTryTruncateFloat64ToUint64(Node* node) {
   Emit(kSSEFloat64ToUint64, output_count, outputs, 1, inputs);
 }
 
+void InstructionSelector::VisitBitcastWord32ToWord64(Node* node) {
+  DCHECK(SmiValuesAre31Bits());
+  DCHECK(COMPRESS_POINTERS_BOOL);
+  EmitIdentity(node);
+}
+
 void InstructionSelector::VisitChangeInt32ToInt64(Node* node) {
+  DCHECK_EQ(node->InputCount(), 1);
+  Node* input = node->InputAt(0);
+  if (input->opcode() == IrOpcode::kTruncateInt64ToInt32) {
+    node->ReplaceInput(0, input->InputAt(0));
+  }
+
   X64OperandGenerator g(this);
   Node* const value = node->InputAt(0);
   if (value->opcode() == IrOpcode::kLoad && CanCover(node, value)) {
@@ -1285,70 +1353,6 @@ void InstructionSelector::VisitChangeUint32ToUint64(Node* node) {
   Emit(kX64Movl, g.DefineAsRegister(node), g.Use(value));
 }
 
-void InstructionSelector::VisitChangeTaggedToCompressed(Node* node) {
-  // The top 32 bits in the 64-bit register will be undefined, and
-  // must not be used by a dependent node.
-  return EmitIdentity(node);
-}
-
-void InstructionSelector::VisitChangeTaggedPointerToCompressedPointer(
-    Node* node) {
-  // The top 32 bits in the 64-bit register will be undefined, and
-  // must not be used by a dependent node.
-  return EmitIdentity(node);
-}
-
-void InstructionSelector::VisitChangeTaggedSignedToCompressedSigned(
-    Node* node) {
-  // The top 32 bits in the 64-bit register will be undefined, and
-  // must not be used by a dependent node.
-  return EmitIdentity(node);
-}
-
-void InstructionSelector::VisitChangeCompressedToTagged(Node* node) {
-  Node* const value = node->InputAt(0);
-  if ((value->opcode() == IrOpcode::kLoad ||
-       value->opcode() == IrOpcode::kPoisonedLoad) &&
-      CanCover(node, value)) {
-    DCHECK_EQ(LoadRepresentationOf(value->op()).representation(),
-              MachineRepresentation::kCompressed);
-    VisitLoad(node, value, kX64MovqDecompressAnyTagged);
-  } else {
-    X64OperandGenerator g(this);
-    Emit(kX64DecompressAny, g.DefineAsRegister(node), g.Use(value));
-  }
-}
-
-void InstructionSelector::VisitChangeCompressedPointerToTaggedPointer(
-    Node* node) {
-  Node* const value = node->InputAt(0);
-  if ((value->opcode() == IrOpcode::kLoad ||
-       value->opcode() == IrOpcode::kPoisonedLoad) &&
-      CanCover(node, value)) {
-    DCHECK_EQ(LoadRepresentationOf(value->op()).representation(),
-              MachineRepresentation::kCompressedPointer);
-    VisitLoad(node, value, kX64MovqDecompressTaggedPointer);
-  } else {
-    X64OperandGenerator g(this);
-    Emit(kX64DecompressPointer, g.DefineAsRegister(node), g.Use(value));
-  }
-}
-
-void InstructionSelector::VisitChangeCompressedSignedToTaggedSigned(
-    Node* node) {
-  Node* const value = node->InputAt(0);
-  if ((value->opcode() == IrOpcode::kLoad ||
-       value->opcode() == IrOpcode::kPoisonedLoad) &&
-      CanCover(node, value)) {
-    DCHECK_EQ(LoadRepresentationOf(value->op()).representation(),
-              MachineRepresentation::kCompressedSigned);
-    VisitLoad(node, value, kX64MovqDecompressTaggedSigned);
-  } else {
-    X64OperandGenerator g(this);
-    Emit(kX64DecompressSigned, g.DefineAsRegister(node), g.Use(value));
-  }
-}
-
 namespace {
 
 void VisitRO(InstructionSelector* selector, Node* node,
@@ -1812,13 +1816,11 @@ void VisitWordCompare(InstructionSelector* selector, Node* node,
   // The 32-bit comparisons automatically truncate Word64
   // values to Word32 range, no need to do that explicitly.
   if (opcode == kX64Cmp32 || opcode == kX64Test32) {
-    if (left->opcode() == IrOpcode::kTruncateInt64ToInt32 &&
-        selector->CanCover(node, left)) {
+    if (left->opcode() == IrOpcode::kTruncateInt64ToInt32) {
       left = left->InputAt(0);
     }
 
-    if (right->opcode() == IrOpcode::kTruncateInt64ToInt32 &&
-        selector->CanCover(node, right)) {
+    if (right->opcode() == IrOpcode::kTruncateInt64ToInt32) {
       right = right->InputAt(0);
     }
   }
@@ -2680,6 +2682,7 @@ VISIT_ATOMIC_BINOP(Xor)
   V(I16x8MinU)             \
   V(I16x8MaxU)             \
   V(I16x8GeU)              \
+  V(I16x8RoundingAverageU) \
   V(I8x16SConvertI16x8)    \
   V(I8x16Add)              \
   V(I8x16AddSaturateS)     \
@@ -2695,6 +2698,7 @@ VISIT_ATOMIC_BINOP(Xor)
   V(I8x16MinU)             \
   V(I8x16MaxU)             \
   V(I8x16GeU)              \
+  V(I8x16RoundingAverageU) \
   V(S128And)               \
   V(S128Or)                \
   V(S128Xor)
@@ -2774,15 +2778,22 @@ void InstructionSelector::VisitS128Zero(Node* node) {
 SIMD_TYPES(VISIT_SIMD_SPLAT)
 #undef VISIT_SIMD_SPLAT
 
-#define VISIT_SIMD_EXTRACT_LANE(Type)                              \
-  void InstructionSelector::Visit##Type##ExtractLane(Node* node) { \
-    X64OperandGenerator g(this);                                   \
-    int32_t lane = OpParameter<int32_t>(node->op());               \
-    Emit(kX64##Type##ExtractLane, g.DefineAsRegister(node),        \
-         g.UseRegister(node->InputAt(0)), g.UseImmediate(lane));   \
-  }
-SIMD_TYPES(VISIT_SIMD_EXTRACT_LANE)
-#undef VISIT_SIMD_EXTRACT_LANE
+#define SIMD_VISIT_EXTRACT_LANE(Type, Sign)                              \
+  void InstructionSelector::Visit##Type##ExtractLane##Sign(Node* node) { \
+    X64OperandGenerator g(this);                                         \
+    int32_t lane = OpParameter<int32_t>(node->op());                     \
+    Emit(kX64##Type##ExtractLane##Sign, g.DefineAsRegister(node),        \
+         g.UseRegister(node->InputAt(0)), g.UseImmediate(lane));         \
+  }
+SIMD_VISIT_EXTRACT_LANE(F64x2, )
+SIMD_VISIT_EXTRACT_LANE(F32x4, )
+SIMD_VISIT_EXTRACT_LANE(I64x2, )
+SIMD_VISIT_EXTRACT_LANE(I32x4, )
+SIMD_VISIT_EXTRACT_LANE(I16x8, U)
+SIMD_VISIT_EXTRACT_LANE(I16x8, S)
+SIMD_VISIT_EXTRACT_LANE(I8x16, U)
+SIMD_VISIT_EXTRACT_LANE(I8x16, S)
+#undef SIMD_VISIT_EXTRACT_LANE
 
 #define VISIT_SIMD_REPLACE_LANE(Type)                              \
   void InstructionSelector::Visit##Type##ReplaceLane(Node* node) { \
@@ -2881,6 +2892,13 @@ void InstructionSelector::VisitS128Select(Node* node) {
        g.UseRegister(node->InputAt(2)));
 }
 
+void InstructionSelector::VisitS128AndNot(Node* node) {
+  X64OperandGenerator g(this);
+  // andnps a b does ~a & b, but we want a & !b, so flip the input.
+  Emit(kX64S128AndNot, g.DefineSameAsFirst(node),
+       g.UseRegister(node->InputAt(1)), g.UseRegister(node->InputAt(0)));
+}
+
 void InstructionSelector::VisitF64x2Abs(Node* node) {
   X64OperandGenerator g(this);
   InstructionOperand temps[] = {g.TempDoubleRegister()};
@@ -3080,40 +3098,40 @@ static const ShuffleEntry arch_shuffles[] = {
     {{0, 1, 2, 3, 4, 5, 6, 7, 16, 17, 18, 19, 20, 21, 22, 23},
      kX64S64x2UnpackLow,
      true,
-     false},
+     true},
     {{8, 9, 10, 11, 12, 13, 14, 15, 24, 25, 26, 27, 28, 29, 30, 31},
      kX64S64x2UnpackHigh,
      true,
-     false},
+     true},
     {{0, 1, 2, 3, 16, 17, 18, 19, 4, 5, 6, 7, 20, 21, 22, 23},
      kX64S32x4UnpackLow,
      true,
-     false},
+     true},
     {{8, 9, 10, 11, 24, 25, 26, 27, 12, 13, 14, 15, 28, 29, 30, 31},
      kX64S32x4UnpackHigh,
      true,
-     false},
+     true},
     {{0, 1, 16, 17, 2, 3, 18, 19, 4, 5, 20, 21, 6, 7, 22, 23},
      kX64S16x8UnpackLow,
      true,
-     false},
+     true},
     {{8, 9, 24, 25, 10, 11, 26, 27, 12, 13, 28, 29, 14, 15, 30, 31},
      kX64S16x8UnpackHigh,
      true,
-     false},
+     true},
     {{0, 16, 1, 17, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23},
      kX64S8x16UnpackLow,
      true,
-     false},
+     true},
     {{8, 24, 9, 25, 10, 26, 11, 27, 12, 28, 13, 29, 14, 30, 15, 31},
      kX64S8x16UnpackHigh,
      true,
-     false},
+     true},
 
     {{0, 1, 4, 5, 8, 9, 12, 13, 16, 17, 20, 21, 24, 25, 28, 29},
      kX64S16x8UnzipLow,
      true,
-     false},
+     true},
     {{2, 3, 6, 7, 10, 11, 14, 15, 18, 19, 22, 23, 26, 27, 30, 31},
      kX64S16x8UnzipHigh,
      true,
@@ -3211,7 +3229,7 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
     src0_needs_reg = arch_shuffle->src0_needs_reg;
     // SSE can't take advantage of both operands in registers and needs
     // same-as-first.
-    src1_needs_reg = false;
+    src1_needs_reg = arch_shuffle->src1_needs_reg;
     no_same_as_first = false;
   } else if (TryMatch32x4Shuffle(shuffle, shuffle32x4)) {
     uint8_t shuffle_mask = PackShuffle4(shuffle32x4);
@@ -3240,9 +3258,13 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
       } else {
         opcode = kX64S32x4Shuffle;
         no_same_as_first = true;
-        src0_needs_reg = false;
+        // TODO(v8:9083): src0 and src1 is used by pshufd in codegen, which
+        // requires memory to be 16-byte aligned, since we cannot guarantee that
+        // yet, force using a register here.
+        src0_needs_reg = true;
+        src1_needs_reg = true;
         imms[imm_count++] = shuffle_mask;
-        int8_t blend_mask = PackBlend4(shuffle32x4);
+        uint8_t blend_mask = PackBlend4(shuffle32x4);
         imms[imm_count++] = blend_mask;
       }
     }
diff --git a/deps/v8/src/compiler/bytecode-graph-builder.cc b/deps/v8/src/compiler/bytecode-graph-builder.cc
index 17472a305dc1be..064d7ee7e471f1 100644
--- a/deps/v8/src/compiler/bytecode-graph-builder.cc
+++ b/deps/v8/src/compiler/bytecode-graph-builder.cc
@@ -233,6 +233,13 @@ class BytecodeGraphBuilder {
 
   // Check the context chain for extensions, for lookup fast paths.
   Environment* CheckContextExtensions(uint32_t depth);
+  // Slow path taken when we cannot figure out the current scope info.
+  Environment* CheckContextExtensionsSlowPath(uint32_t depth);
+  // Helper function that tries to get the current scope info.
+  base::Optional<ScopeInfoRef> TryGetScopeInfo();
+  // Helper function to create a context extension check.
+  Environment* CheckContextExtensionAtDepth(Environment* slow_environment,
+                                            uint32_t depth);
 
   // Helper function to create binary operation hint from the recorded
   // type feedback.
@@ -347,8 +354,9 @@ class BytecodeGraphBuilder {
   void set_currently_peeled_loop_offset(int offset) {
     currently_peeled_loop_offset_ = offset;
   }
-  bool skip_next_stack_check() const { return skip_next_stack_check_; }
-  void unset_skip_next_stack_check() { skip_next_stack_check_ = false; }
+  bool skip_first_stack_check() const { return skip_first_stack_check_; }
+  bool visited_first_stack_check() const { return visited_first_stack_check_; }
+  void set_visited_first_stack_check() { visited_first_stack_check_ = true; }
   int current_exception_handler() const { return current_exception_handler_; }
   void set_current_exception_handler(int index) {
     current_exception_handler_ = index;
@@ -361,6 +369,10 @@ class BytecodeGraphBuilder {
   NativeContextRef native_context() const { return native_context_; }
   SharedFunctionInfoRef shared_info() const { return shared_info_; }
 
+  bool should_disallow_heap_access() const {
+    return broker_->is_concurrent_inlining();
+  }
+
 #define DECLARE_VISIT_BYTECODE(name, ...) void Visit##name();
   BYTECODE_LIST(DECLARE_VISIT_BYTECODE)
 #undef DECLARE_VISIT_BYTECODE
@@ -381,7 +393,9 @@ class BytecodeGraphBuilder {
   Environment* environment_;
   bool const osr_;
   int currently_peeled_loop_offset_;
-  bool skip_next_stack_check_;
+
+  const bool skip_first_stack_check_;
+  bool visited_first_stack_check_ = false;
 
   // Merge environments are snapshots of the environment at points where the
   // control flow merges. This models a forward data flow propagation of all
@@ -952,13 +966,14 @@ BytecodeGraphBuilder::BytecodeGraphBuilder(
       bytecode_analysis_(broker_->GetBytecodeAnalysis(
           bytecode_array().object(), osr_offset,
           flags & BytecodeGraphBuilderFlag::kAnalyzeEnvironmentLiveness,
-          FLAG_concurrent_inlining ? SerializationPolicy::kAssumeSerialized
-                                   : SerializationPolicy::kSerializeIfNeeded)),
+          should_disallow_heap_access()
+              ? SerializationPolicy::kAssumeSerialized
+              : SerializationPolicy::kSerializeIfNeeded)),
       environment_(nullptr),
       osr_(!osr_offset.IsNone()),
       currently_peeled_loop_offset_(-1),
-      skip_next_stack_check_(flags &
-                             BytecodeGraphBuilderFlag::kSkipFirstStackCheck),
+      skip_first_stack_check_(flags &
+                              BytecodeGraphBuilderFlag::kSkipFirstStackCheck),
       merge_environments_(local_zone),
       generator_merge_environments_(local_zone),
       exception_handlers_(local_zone),
@@ -971,7 +986,7 @@ BytecodeGraphBuilder::BytecodeGraphBuilder(
       source_positions_(source_positions),
       start_position_(shared_info.StartPosition(), inlining_id),
       tick_counter_(tick_counter) {
-  if (FLAG_concurrent_inlining) {
+  if (should_disallow_heap_access()) {
     // With concurrent inlining on, the source position address doesn't change
     // because it's been copied from the heap.
     source_position_iterator_ = std::make_unique<SourcePositionTableIterator>(
@@ -1008,7 +1023,7 @@ FeedbackSource BytecodeGraphBuilder::CreateFeedbackSource(int slot_id) {
 }
 
 void BytecodeGraphBuilder::CreateGraph() {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
   SourcePositionTable::Scope pos_scope(source_positions_, start_position_);
 
   // Set up the basic structure of the graph. Outputs for {Start} are the formal
@@ -1269,12 +1284,6 @@ void BytecodeGraphBuilder::VisitSingleBytecode() {
 
   if (environment() != nullptr) {
     BuildLoopHeaderEnvironment(current_offset);
-    if (skip_next_stack_check() && bytecode_iterator().current_bytecode() ==
-                                       interpreter::Bytecode::kStackCheck) {
-      unset_skip_next_stack_check();
-      return;
-    }
-
     switch (bytecode_iterator().current_bytecode()) {
 #define BYTECODE_CASE(name, ...)       \
   case interpreter::Bytecode::k##name: \
@@ -1309,7 +1318,7 @@ void BytecodeGraphBuilder::VisitBytecodes() {
     VisitSingleBytecode();
   }
 
-  if (!FLAG_concurrent_inlining && has_one_shot_bytecode) {
+  if (!should_disallow_heap_access() && has_one_shot_bytecode) {
     // (For concurrent inlining this is done in the serializer instead.)
     isolate()->CountUsage(
         v8::Isolate::UseCounterFeature::kOptimizedFunctionWithOneShotBytecode);
@@ -1565,47 +1574,115 @@ void BytecodeGraphBuilder::VisitLdaLookupSlotInsideTypeof() {
   BuildLdaLookupSlot(TypeofMode::INSIDE_TYPEOF);
 }
 
+BytecodeGraphBuilder::Environment*
+BytecodeGraphBuilder::CheckContextExtensionAtDepth(
+    Environment* slow_environment, uint32_t depth) {
+  Node* extension_slot = NewNode(
+      javascript()->LoadContext(depth, Context::EXTENSION_INDEX, false));
+  Node* check_no_extension =
+      NewNode(simplified()->ReferenceEqual(), extension_slot,
+              jsgraph()->UndefinedConstant());
+  NewBranch(check_no_extension);
+  {
+    SubEnvironment sub_environment(this);
+    NewIfFalse();
+    // If there is an extension, merge into the slow path.
+    if (slow_environment == nullptr) {
+      slow_environment = environment();
+      NewMerge();
+    } else {
+      slow_environment->Merge(environment(),
+                              bytecode_analysis().GetInLivenessFor(
+                                  bytecode_iterator().current_offset()));
+    }
+  }
+  NewIfTrue();
+  // Do nothing on if there is no extension, eventually falling through to
+  // the fast path.
+  DCHECK_NOT_NULL(slow_environment);
+  return slow_environment;
+}
+
+base::Optional<ScopeInfoRef> BytecodeGraphBuilder::TryGetScopeInfo() {
+  Node* context = environment()->Context();
+  switch (context->opcode()) {
+    case IrOpcode::kJSCreateFunctionContext:
+      return ScopeInfoRef(
+          broker(),
+          CreateFunctionContextParametersOf(context->op()).scope_info());
+    case IrOpcode::kJSCreateBlockContext:
+    case IrOpcode::kJSCreateCatchContext:
+    case IrOpcode::kJSCreateWithContext:
+      return ScopeInfoRef(broker(), ScopeInfoOf(context->op()));
+    case IrOpcode::kParameter: {
+      ScopeInfoRef scope_info = shared_info_.scope_info();
+      if (scope_info.HasOuterScopeInfo()) {
+        scope_info = scope_info.OuterScopeInfo();
+      }
+      return scope_info;
+    }
+    default:
+      return base::nullopt;
+  }
+}
+
 BytecodeGraphBuilder::Environment* BytecodeGraphBuilder::CheckContextExtensions(
     uint32_t depth) {
-  // Output environment where the context has an extension
-  Environment* slow_environment = nullptr;
+  base::Optional<ScopeInfoRef> maybe_scope_info = TryGetScopeInfo();
+  if (!maybe_scope_info.has_value()) {
+    return CheckContextExtensionsSlowPath(depth);
+  }
 
-  // We only need to check up to the last-but-one depth, because the an eval
+  ScopeInfoRef scope_info = maybe_scope_info.value();
+  // We only need to check up to the last-but-one depth, because an eval
   // in the same scope as the variable itself has no way of shadowing it.
+  Environment* slow_environment = nullptr;
   for (uint32_t d = 0; d < depth; d++) {
-    Node* extension_slot =
-        NewNode(javascript()->LoadContext(d, Context::EXTENSION_INDEX, false));
+    if (scope_info.HasContextExtension()) {
+      slow_environment = CheckContextExtensionAtDepth(slow_environment, d);
+    }
+    DCHECK_IMPLIES(!scope_info.HasOuterScopeInfo(), d + 1 == depth);
+    if (scope_info.HasOuterScopeInfo()) {
+      scope_info = scope_info.OuterScopeInfo();
+    }
+  }
+
+  // The depth can be zero, in which case no slow-path checks are built, and
+  // the slow path environment can be null.
+  DCHECK_IMPLIES(slow_environment == nullptr, depth == 0);
+  return slow_environment;
+}
 
-    Node* check_no_extension =
-        NewNode(simplified()->ReferenceEqual(), extension_slot,
-                jsgraph()->TheHoleConstant());
+BytecodeGraphBuilder::Environment*
+BytecodeGraphBuilder::CheckContextExtensionsSlowPath(uint32_t depth) {
+  // Output environment where the context has an extension
+  Environment* slow_environment = nullptr;
 
-    NewBranch(check_no_extension);
+  // We only need to check up to the last-but-one depth, because an eval
+  // in the same scope as the variable itself has no way of shadowing it.
+  for (uint32_t d = 0; d < depth; d++) {
+    Node* has_extension = NewNode(javascript()->HasContextExtension(d));
 
+    Environment* undefined_extension_env;
+    NewBranch(has_extension);
     {
       SubEnvironment sub_environment(this);
-
-      NewIfFalse();
-      // If there is an extension, merge into the slow path.
-      if (slow_environment == nullptr) {
-        slow_environment = environment();
-        NewMerge();
-      } else {
-        slow_environment->Merge(environment(),
-                                bytecode_analysis().GetInLivenessFor(
-                                    bytecode_iterator().current_offset()));
-      }
+      NewIfTrue();
+      slow_environment = CheckContextExtensionAtDepth(slow_environment, d);
+      undefined_extension_env = environment();
     }
-
-    NewIfTrue();
+    NewIfFalse();
+    environment()->Merge(undefined_extension_env,
+                         bytecode_analysis().GetInLivenessFor(
+                             bytecode_iterator().current_offset()));
+    mark_as_needing_eager_checkpoint(true);
     // Do nothing on if there is no extension, eventually falling through to
     // the fast path.
   }
 
   // The depth can be zero, in which case no slow-path checks are built, and
   // the slow path environment can be null.
-  DCHECK(depth == 0 || slow_environment != nullptr);
-
+  DCHECK_IMPLIES(slow_environment == nullptr, depth == 0);
   return slow_environment;
 }
 
@@ -1935,7 +2012,7 @@ void BytecodeGraphBuilder::VisitCreateClosure() {
 }
 
 void BytecodeGraphBuilder::VisitCreateBlockContext() {
-  DisallowHeapAccessIf no_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_access(should_disallow_heap_access());
   ScopeInfoRef scope_info(
       broker(), bytecode_iterator().GetConstantForIndexOperand(0, isolate()));
   const Operator* op = javascript()->CreateBlockContext(scope_info.object());
@@ -1944,7 +2021,7 @@ void BytecodeGraphBuilder::VisitCreateBlockContext() {
 }
 
 void BytecodeGraphBuilder::VisitCreateFunctionContext() {
-  DisallowHeapAccessIf no_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_access(should_disallow_heap_access());
   ScopeInfoRef scope_info(
       broker(), bytecode_iterator().GetConstantForIndexOperand(0, isolate()));
   uint32_t slots = bytecode_iterator().GetUnsignedImmediateOperand(1);
@@ -1955,7 +2032,7 @@ void BytecodeGraphBuilder::VisitCreateFunctionContext() {
 }
 
 void BytecodeGraphBuilder::VisitCreateEvalContext() {
-  DisallowHeapAccessIf no_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_access(should_disallow_heap_access());
   ScopeInfoRef scope_info(
       broker(), bytecode_iterator().GetConstantForIndexOperand(0, isolate()));
   uint32_t slots = bytecode_iterator().GetUnsignedImmediateOperand(1);
@@ -1966,7 +2043,7 @@ void BytecodeGraphBuilder::VisitCreateEvalContext() {
 }
 
 void BytecodeGraphBuilder::VisitCreateCatchContext() {
-  DisallowHeapAccessIf no_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_access(should_disallow_heap_access());
   interpreter::Register reg = bytecode_iterator().GetRegisterOperand(0);
   Node* exception = environment()->LookupRegister(reg);
   ScopeInfoRef scope_info(
@@ -1978,7 +2055,7 @@ void BytecodeGraphBuilder::VisitCreateCatchContext() {
 }
 
 void BytecodeGraphBuilder::VisitCreateWithContext() {
-  DisallowHeapAccessIf no_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_access(should_disallow_heap_access());
   Node* object =
       environment()->LookupRegister(bytecode_iterator().GetRegisterOperand(0));
   ScopeInfoRef scope_info(
@@ -2031,8 +2108,6 @@ void BytecodeGraphBuilder::VisitCreateArrayLiteral() {
   // data to converge. So, we disable allocation site mementos in optimized
   // code. We can revisit this when we have data to the contrary.
   literal_flags |= ArrayLiteral::kDisableMementos;
-  // TODO(mstarzinger): Thread through number of elements. The below number is
-  // only an estimate and does not match {ArrayLiteral::values::length}.
   int number_of_elements =
       array_boilerplate_description.constants_elements_length();
   Node* literal = NewNode(javascript()->CreateLiteralArray(
@@ -2062,8 +2137,6 @@ void BytecodeGraphBuilder::VisitCreateObjectLiteral() {
   int bytecode_flags = bytecode_iterator().GetFlagOperand(2);
   int literal_flags =
       interpreter::CreateObjectLiteralFlags::FlagsBits::decode(bytecode_flags);
-  // TODO(mstarzinger): Thread through number of properties. The below number is
-  // only an estimate and does not match {ObjectLiteral::properties_count}.
   int number_of_properties = constant_properties.size();
   Node* literal = NewNode(javascript()->CreateLiteralObject(
       constant_properties.object(), pair, literal_flags, number_of_properties));
@@ -2089,7 +2162,7 @@ void BytecodeGraphBuilder::VisitCloneObject() {
 }
 
 void BytecodeGraphBuilder::VisitGetTemplateObject() {
-  DisallowHeapAccessIf no_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_access(should_disallow_heap_access());
   FeedbackSource source =
       CreateFeedbackSource(bytecode_iterator().GetIndexOperand(1));
   TemplateObjectDescriptionRef description(
@@ -2153,8 +2226,9 @@ void BytecodeGraphBuilder::BuildCall(ConvertReceiverMode receiver_mode,
   FeedbackSource feedback = CreateFeedbackSource(slot_id);
   CallFrequency frequency = ComputeCallFrequency(slot_id);
   SpeculationMode speculation_mode = GetSpeculationMode(slot_id);
-  const Operator* op = javascript()->Call(arg_count, frequency, feedback,
-                                          receiver_mode, speculation_mode);
+  const Operator* op =
+      javascript()->Call(arg_count, frequency, feedback, receiver_mode,
+                         speculation_mode, CallFeedbackRelation::kRelated);
 
   JSTypeHintLowering::LoweringResult lowering = TryBuildSimplifiedCall(
       op, args, static_cast<int>(arg_count), feedback.slot);
@@ -2337,8 +2411,9 @@ void BytecodeGraphBuilder::VisitCallWithSpread() {
   int const slot_id = bytecode_iterator().GetIndexOperand(3);
   FeedbackSource feedback = CreateFeedbackSource(slot_id);
   CallFrequency frequency = ComputeCallFrequency(slot_id);
+  SpeculationMode speculation_mode = GetSpeculationMode(slot_id);
   const Operator* op = javascript()->CallWithSpread(
-      static_cast<int>(reg_count + 1), frequency, feedback);
+      static_cast<int>(reg_count + 1), frequency, feedback, speculation_mode);
 
   JSTypeHintLowering::LoweringResult lowering = TryBuildSimplifiedCall(
       op, args, static_cast<int>(arg_count), feedback.slot);
@@ -3178,8 +3253,20 @@ void BytecodeGraphBuilder::VisitSwitchOnSmiNoFeedback() {
 }
 
 void BytecodeGraphBuilder::VisitStackCheck() {
+  // Note: The stack check kind is determined heuristically: we simply assume
+  // that the first seen stack check is at function-entry, and all other stack
+  // checks are at iteration-body. An alternative precise solution would be to
+  // parameterize the StackCheck bytecode; but this has the caveat of increased
+  // code size.
+  StackCheckKind kind = StackCheckKind::kJSIterationBody;
+  if (!visited_first_stack_check()) {
+    set_visited_first_stack_check();
+    kind = StackCheckKind::kJSFunctionEntry;
+    if (skip_first_stack_check()) return;
+  }
+
   PrepareEagerCheckpoint();
-  Node* node = NewNode(javascript()->StackCheck());
+  Node* node = NewNode(javascript()->StackCheck(kind));
   environment()->RecordAfterState(node, Environment::kAttachFrameState);
 }
 
@@ -3554,7 +3641,6 @@ void BytecodeGraphBuilder::MergeIntoSuccessorEnvironment(int target_offset) {
     // Append merge nodes to the environment. We may merge here with another
     // environment. So add a place holder for merge nodes. We may add redundant
     // but will be eliminated in a later pass.
-    // TODO(mstarzinger): Be smarter about this!
     NewMerge();
     merge_environment = environment();
   } else {
@@ -4078,7 +4164,7 @@ void BuildGraphFromBytecode(JSHeapBroker* broker, Zone* local_zone,
                             SourcePositionTable* source_positions,
                             int inlining_id, BytecodeGraphBuilderFlags flags,
                             TickCounter* tick_counter) {
-  DCHECK(shared_info.IsSerializedForCompilation(feedback_vector));
+  DCHECK(broker->IsSerializedForCompilation(shared_info, feedback_vector));
   BytecodeGraphBuilder builder(
       broker, local_zone, broker->target_native_context(), shared_info,
       feedback_vector, osr_offset, jsgraph, invocation_frequency,
diff --git a/deps/v8/src/compiler/checkpoint-elimination.cc b/deps/v8/src/compiler/checkpoint-elimination.cc
index 172d42845c2d98..3f9d5b57312b4b 100644
--- a/deps/v8/src/compiler/checkpoint-elimination.cc
+++ b/deps/v8/src/compiler/checkpoint-elimination.cc
@@ -4,6 +4,7 @@
 
 #include "src/compiler/checkpoint-elimination.h"
 
+#include "src/compiler/common-operator.h"
 #include "src/compiler/node-properties.h"
 
 namespace v8 {
@@ -15,14 +16,34 @@ CheckpointElimination::CheckpointElimination(Editor* editor)
 
 namespace {
 
+FrameStateFunctionInfo const* GetFunctionInfo(Node* checkpoint) {
+  DCHECK_EQ(IrOpcode::kCheckpoint, checkpoint->opcode());
+  Node* frame_state = NodeProperties::GetFrameStateInput(checkpoint);
+  return frame_state->opcode() == IrOpcode::kFrameState
+             ? FrameStateInfoOf(frame_state->op()).function_info()
+             : nullptr;
+}
+
 // The given checkpoint is redundant if it is effect-wise dominated by another
-// checkpoint and there is no observable write in between. For now we consider
-// a linear effect chain only instead of true effect-wise dominance.
+// checkpoint of the same origin (*) and there is no observable write in
+// between. For now we consider a linear effect chain only instead of true
+// effect-wise dominance.
+// "Same origin" here refers to the same graph building pass and is expressed as
+// the identity of the checkpoint's FrameStateFunctionInfo pointer. This
+// restriction ensures that an eager deopt from an inlined function will resume
+// the inlined function's bytecode (rather than, say, the call in the caller's
+// bytecode), which in turn is necessary to ensure that we learn something from
+// the deopt in the case where an optimized code object for the inlined function
+// exists. See regress-9945-*.js and v8:9945.
 bool IsRedundantCheckpoint(Node* node) {
+  FrameStateFunctionInfo const* function_info = GetFunctionInfo(node);
+  if (function_info == nullptr) return false;
   Node* effect = NodeProperties::GetEffectInput(node);
   while (effect->op()->HasProperty(Operator::kNoWrite) &&
          effect->op()->EffectInputCount() == 1) {
-    if (effect->opcode() == IrOpcode::kCheckpoint) return true;
+    if (effect->opcode() == IrOpcode::kCheckpoint) {
+      return GetFunctionInfo(effect) == function_info;
+    }
     effect = NodeProperties::GetEffectInput(effect);
   }
   return false;
diff --git a/deps/v8/src/compiler/code-assembler.cc b/deps/v8/src/compiler/code-assembler.cc
index c618daf357ea53..2eee2aed15706f 100644
--- a/deps/v8/src/compiler/code-assembler.cc
+++ b/deps/v8/src/compiler/code-assembler.cc
@@ -6,12 +6,14 @@
 
 #include <ostream>
 
+#include "src/base/bits.h"
 #include "src/codegen/code-factory.h"
 #include "src/codegen/interface-descriptors.h"
 #include "src/codegen/machine-type.h"
 #include "src/codegen/macro-assembler.h"
 #include "src/compiler/backend/instruction-selector.h"
 #include "src/compiler/graph.h"
+#include "src/compiler/js-graph.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/pipeline.h"
@@ -83,7 +85,11 @@ CodeAssemblerState::CodeAssemblerState(Isolate* isolate, Zone* zone,
       name_(name),
       builtin_index_(builtin_index),
       code_generated_(false),
-      variables_(zone) {}
+      variables_(zone),
+      jsgraph_(new (zone) JSGraph(
+          isolate, raw_assembler_->graph(), raw_assembler_->common(),
+          new (zone) JSOperatorBuilder(zone), raw_assembler_->simplified(),
+          raw_assembler_->machine())) {}
 
 CodeAssemblerState::~CodeAssemblerState() = default;
 
@@ -179,7 +185,7 @@ Handle<Code> CodeAssembler::GenerateCode(CodeAssemblerState* state,
   Graph* graph = rasm->ExportForOptimization();
 
   code = Pipeline::GenerateCodeForCodeStub(
-             rasm->isolate(), rasm->call_descriptor(), graph,
+             rasm->isolate(), rasm->call_descriptor(), graph, state->jsgraph_,
              rasm->source_positions(), state->kind_, state->name_,
              state->builtin_index_, rasm->poisoning_level(), options)
              .ToHandleChecked();
@@ -240,15 +246,15 @@ void CodeAssembler::GenerateCheckMaybeObjectIsObject(Node* node,
 #endif
 
 TNode<Int32T> CodeAssembler::Int32Constant(int32_t value) {
-  return UncheckedCast<Int32T>(raw_assembler()->Int32Constant(value));
+  return UncheckedCast<Int32T>(jsgraph()->Int32Constant(value));
 }
 
 TNode<Int64T> CodeAssembler::Int64Constant(int64_t value) {
-  return UncheckedCast<Int64T>(raw_assembler()->Int64Constant(value));
+  return UncheckedCast<Int64T>(jsgraph()->Int64Constant(value));
 }
 
 TNode<IntPtrT> CodeAssembler::IntPtrConstant(intptr_t value) {
-  return UncheckedCast<IntPtrT>(raw_assembler()->IntPtrConstant(value));
+  return UncheckedCast<IntPtrT>(jsgraph()->IntPtrConstant(value));
 }
 
 TNode<Number> CodeAssembler::NumberConstant(double value) {
@@ -276,7 +282,7 @@ TNode<Smi> CodeAssembler::SmiConstant(int value) {
 
 TNode<HeapObject> CodeAssembler::UntypedHeapConstant(
     Handle<HeapObject> object) {
-  return UncheckedCast<HeapObject>(raw_assembler()->HeapConstant(object));
+  return UncheckedCast<HeapObject>(jsgraph()->HeapConstant(object));
 }
 
 TNode<String> CodeAssembler::StringConstant(const char* str) {
@@ -288,7 +294,7 @@ TNode<String> CodeAssembler::StringConstant(const char* str) {
 TNode<Oddball> CodeAssembler::BooleanConstant(bool value) {
   Handle<Object> object = isolate()->factory()->ToBoolean(value);
   return UncheckedCast<Oddball>(
-      raw_assembler()->HeapConstant(Handle<HeapObject>::cast(object)));
+      jsgraph()->HeapConstant(Handle<HeapObject>::cast(object)));
 }
 
 TNode<ExternalReference> CodeAssembler::ExternalConstant(
@@ -298,7 +304,7 @@ TNode<ExternalReference> CodeAssembler::ExternalConstant(
 }
 
 TNode<Float64T> CodeAssembler::Float64Constant(double value) {
-  return UncheckedCast<Float64T>(raw_assembler()->Float64Constant(value));
+  return UncheckedCast<Float64T>(jsgraph()->Float64Constant(value));
 }
 
 bool CodeAssembler::ToInt32Constant(Node* node, int32_t* out_value) {
@@ -380,29 +386,67 @@ TNode<Context> CodeAssembler::GetJSContextParameter() {
       static_cast<int>(call_descriptor->JSParameterCount()))));
 }
 
-void CodeAssembler::Return(SloppyTNode<Object> value) {
-  // TODO(leszeks): This could also return a non-object, depending on the call
-  // descriptor. We should probably have multiple return overloads with
-  // different TNode types which DCHECK the call descriptor.
+void CodeAssembler::Return(TNode<Object> value) {
+  DCHECK_EQ(1, raw_assembler()->call_descriptor()->ReturnCount());
+  DCHECK(raw_assembler()->call_descriptor()->GetReturnType(0).IsTagged());
   return raw_assembler()->Return(value);
 }
 
-void CodeAssembler::Return(SloppyTNode<Object> value1,
-                           SloppyTNode<Object> value2) {
+void CodeAssembler::Return(TNode<Object> value1, TNode<Object> value2) {
+  DCHECK_EQ(2, raw_assembler()->call_descriptor()->ReturnCount());
+  DCHECK(raw_assembler()->call_descriptor()->GetReturnType(0).IsTagged());
+  DCHECK(raw_assembler()->call_descriptor()->GetReturnType(1).IsTagged());
   return raw_assembler()->Return(value1, value2);
 }
 
-void CodeAssembler::Return(SloppyTNode<Object> value1,
-                           SloppyTNode<Object> value2,
-                           SloppyTNode<Object> value3) {
+void CodeAssembler::Return(TNode<Object> value1, TNode<Object> value2,
+                           TNode<Object> value3) {
+  DCHECK_EQ(3, raw_assembler()->call_descriptor()->ReturnCount());
+  DCHECK(raw_assembler()->call_descriptor()->GetReturnType(0).IsTagged());
+  DCHECK(raw_assembler()->call_descriptor()->GetReturnType(1).IsTagged());
+  DCHECK(raw_assembler()->call_descriptor()->GetReturnType(2).IsTagged());
   return raw_assembler()->Return(value1, value2, value3);
 }
 
+void CodeAssembler::Return(TNode<Int32T> value) {
+  DCHECK_EQ(1, raw_assembler()->call_descriptor()->ReturnCount());
+  DCHECK_EQ(MachineType::Int32(),
+            raw_assembler()->call_descriptor()->GetReturnType(0));
+  return raw_assembler()->Return(value);
+}
+
+void CodeAssembler::Return(TNode<Uint32T> value) {
+  DCHECK_EQ(1, raw_assembler()->call_descriptor()->ReturnCount());
+  DCHECK_EQ(MachineType::Uint32(),
+            raw_assembler()->call_descriptor()->GetReturnType(0));
+  return raw_assembler()->Return(value);
+}
+
+void CodeAssembler::Return(TNode<WordT> value) {
+  DCHECK_EQ(1, raw_assembler()->call_descriptor()->ReturnCount());
+  DCHECK_EQ(
+      MachineType::PointerRepresentation(),
+      raw_assembler()->call_descriptor()->GetReturnType(0).representation());
+  return raw_assembler()->Return(value);
+}
+
+void CodeAssembler::Return(TNode<WordT> value1, TNode<WordT> value2) {
+  DCHECK_EQ(2, raw_assembler()->call_descriptor()->ReturnCount());
+  DCHECK_EQ(
+      MachineType::PointerRepresentation(),
+      raw_assembler()->call_descriptor()->GetReturnType(0).representation());
+  DCHECK_EQ(
+      MachineType::PointerRepresentation(),
+      raw_assembler()->call_descriptor()->GetReturnType(1).representation());
+  return raw_assembler()->Return(value1, value2);
+}
+
 void CodeAssembler::PopAndReturn(Node* pop, Node* value) {
+  DCHECK_EQ(1, raw_assembler()->call_descriptor()->ReturnCount());
   return raw_assembler()->PopAndReturn(pop, value);
 }
 
-void CodeAssembler::ReturnIf(Node* condition, Node* value) {
+void CodeAssembler::ReturnIf(Node* condition, TNode<Object> value) {
   Label if_return(this), if_continue(this);
   Branch(condition, &if_return, &if_continue);
   Bind(&if_return);
@@ -410,10 +454,6 @@ void CodeAssembler::ReturnIf(Node* condition, Node* value) {
   Bind(&if_continue);
 }
 
-void CodeAssembler::ReturnRaw(Node* value) {
-  return raw_assembler()->Return(value);
-}
-
 void CodeAssembler::AbortCSAAssert(Node* message) {
   raw_assembler()->AbortCSAAssert(message);
 }
@@ -472,83 +512,6 @@ TNode<WordT> CodeAssembler::WordPoisonOnSpeculation(SloppyTNode<WordT> value) {
 CODE_ASSEMBLER_BINARY_OP_LIST(DEFINE_CODE_ASSEMBLER_BINARY_OP)
 #undef DEFINE_CODE_ASSEMBLER_BINARY_OP
 
-TNode<WordT> CodeAssembler::IntPtrAdd(SloppyTNode<WordT> left,
-                                      SloppyTNode<WordT> right) {
-  intptr_t left_constant;
-  bool is_left_constant = ToIntPtrConstant(left, &left_constant);
-  intptr_t right_constant;
-  bool is_right_constant = ToIntPtrConstant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return IntPtrConstant(left_constant + right_constant);
-    }
-    if (left_constant == 0) {
-      return right;
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<WordT>(raw_assembler()->IntPtrAdd(left, right));
-}
-
-TNode<IntPtrT> CodeAssembler::IntPtrDiv(TNode<IntPtrT> left,
-                                        TNode<IntPtrT> right) {
-  intptr_t left_constant;
-  bool is_left_constant = ToIntPtrConstant(left, &left_constant);
-  intptr_t right_constant;
-  bool is_right_constant = ToIntPtrConstant(right, &right_constant);
-  if (is_right_constant) {
-    if (is_left_constant) {
-      return IntPtrConstant(left_constant / right_constant);
-    }
-    if (base::bits::IsPowerOfTwo(right_constant)) {
-      return WordSar(left, WhichPowerOf2(right_constant));
-    }
-  }
-  return UncheckedCast<IntPtrT>(raw_assembler()->IntPtrDiv(left, right));
-}
-
-TNode<WordT> CodeAssembler::IntPtrSub(SloppyTNode<WordT> left,
-                                      SloppyTNode<WordT> right) {
-  intptr_t left_constant;
-  bool is_left_constant = ToIntPtrConstant(left, &left_constant);
-  intptr_t right_constant;
-  bool is_right_constant = ToIntPtrConstant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return IntPtrConstant(left_constant - right_constant);
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<IntPtrT>(raw_assembler()->IntPtrSub(left, right));
-}
-
-TNode<WordT> CodeAssembler::IntPtrMul(SloppyTNode<WordT> left,
-                                      SloppyTNode<WordT> right) {
-  intptr_t left_constant;
-  bool is_left_constant = ToIntPtrConstant(left, &left_constant);
-  intptr_t right_constant;
-  bool is_right_constant = ToIntPtrConstant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return IntPtrConstant(left_constant * right_constant);
-    }
-    if (base::bits::IsPowerOfTwo(left_constant)) {
-      return WordShl(right, WhichPowerOf2(left_constant));
-    }
-  } else if (is_right_constant) {
-    if (base::bits::IsPowerOfTwo(right_constant)) {
-      return WordShl(left, WhichPowerOf2(right_constant));
-    }
-  }
-  return UncheckedCast<IntPtrT>(raw_assembler()->IntPtrMul(left, right));
-}
-
 TNode<WordT> CodeAssembler::WordShl(SloppyTNode<WordT> value, int shift) {
   return (shift != 0) ? WordShl(value, IntPtrConstant(shift)) : value;
 }
@@ -569,318 +532,6 @@ TNode<Word32T> CodeAssembler::Word32Sar(SloppyTNode<Word32T> value, int shift) {
   return (shift != 0) ? Word32Sar(value, Int32Constant(shift)) : value;
 }
 
-TNode<WordT> CodeAssembler::WordOr(SloppyTNode<WordT> left,
-                                   SloppyTNode<WordT> right) {
-  intptr_t left_constant;
-  bool is_left_constant = ToIntPtrConstant(left, &left_constant);
-  intptr_t right_constant;
-  bool is_right_constant = ToIntPtrConstant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return IntPtrConstant(left_constant | right_constant);
-    }
-    if (left_constant == 0) {
-      return right;
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<WordT>(raw_assembler()->WordOr(left, right));
-}
-
-TNode<WordT> CodeAssembler::WordAnd(SloppyTNode<WordT> left,
-                                    SloppyTNode<WordT> right) {
-  intptr_t left_constant;
-  bool is_left_constant = ToIntPtrConstant(left, &left_constant);
-  intptr_t right_constant;
-  bool is_right_constant = ToIntPtrConstant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return IntPtrConstant(left_constant & right_constant);
-    }
-  }
-  return UncheckedCast<WordT>(raw_assembler()->WordAnd(left, right));
-}
-
-TNode<WordT> CodeAssembler::WordXor(SloppyTNode<WordT> left,
-                                    SloppyTNode<WordT> right) {
-  intptr_t left_constant;
-  bool is_left_constant = ToIntPtrConstant(left, &left_constant);
-  intptr_t right_constant;
-  bool is_right_constant = ToIntPtrConstant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return IntPtrConstant(left_constant ^ right_constant);
-    }
-  }
-  return UncheckedCast<WordT>(raw_assembler()->WordXor(left, right));
-}
-
-TNode<WordT> CodeAssembler::WordShl(SloppyTNode<WordT> left,
-                                    SloppyTNode<IntegralT> right) {
-  intptr_t left_constant;
-  bool is_left_constant = ToIntPtrConstant(left, &left_constant);
-  intptr_t right_constant;
-  bool is_right_constant = ToIntPtrConstant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return IntPtrConstant(left_constant << right_constant);
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<WordT>(raw_assembler()->WordShl(left, right));
-}
-
-TNode<WordT> CodeAssembler::WordShr(SloppyTNode<WordT> left,
-                                    SloppyTNode<IntegralT> right) {
-  intptr_t left_constant;
-  bool is_left_constant = ToIntPtrConstant(left, &left_constant);
-  intptr_t right_constant;
-  bool is_right_constant = ToIntPtrConstant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return IntPtrConstant(static_cast<uintptr_t>(left_constant) >>
-                            right_constant);
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<WordT>(raw_assembler()->WordShr(left, right));
-}
-
-TNode<WordT> CodeAssembler::WordSar(SloppyTNode<WordT> left,
-                                    SloppyTNode<IntegralT> right) {
-  intptr_t left_constant;
-  bool is_left_constant = ToIntPtrConstant(left, &left_constant);
-  intptr_t right_constant;
-  bool is_right_constant = ToIntPtrConstant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return IntPtrConstant(left_constant >> right_constant);
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<WordT>(raw_assembler()->WordSar(left, right));
-}
-
-TNode<Word32T> CodeAssembler::Word32Or(SloppyTNode<Word32T> left,
-                                       SloppyTNode<Word32T> right) {
-  int32_t left_constant;
-  bool is_left_constant = ToInt32Constant(left, &left_constant);
-  int32_t right_constant;
-  bool is_right_constant = ToInt32Constant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return Int32Constant(left_constant | right_constant);
-    }
-    if (left_constant == 0) {
-      return right;
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<Word32T>(raw_assembler()->Word32Or(left, right));
-}
-
-TNode<Word32T> CodeAssembler::Word32And(SloppyTNode<Word32T> left,
-                                        SloppyTNode<Word32T> right) {
-  int32_t left_constant;
-  bool is_left_constant = ToInt32Constant(left, &left_constant);
-  int32_t right_constant;
-  bool is_right_constant = ToInt32Constant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return Int32Constant(left_constant & right_constant);
-    }
-  }
-  return UncheckedCast<Word32T>(raw_assembler()->Word32And(left, right));
-}
-
-TNode<Word32T> CodeAssembler::Word32Xor(SloppyTNode<Word32T> left,
-                                        SloppyTNode<Word32T> right) {
-  int32_t left_constant;
-  bool is_left_constant = ToInt32Constant(left, &left_constant);
-  int32_t right_constant;
-  bool is_right_constant = ToInt32Constant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return Int32Constant(left_constant ^ right_constant);
-    }
-  }
-  return UncheckedCast<Word32T>(raw_assembler()->Word32Xor(left, right));
-}
-
-TNode<Word32T> CodeAssembler::Word32Shl(SloppyTNode<Word32T> left,
-                                        SloppyTNode<Word32T> right) {
-  int32_t left_constant;
-  bool is_left_constant = ToInt32Constant(left, &left_constant);
-  int32_t right_constant;
-  bool is_right_constant = ToInt32Constant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return Int32Constant(left_constant << right_constant);
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<Word32T>(raw_assembler()->Word32Shl(left, right));
-}
-
-TNode<Word32T> CodeAssembler::Word32Shr(SloppyTNode<Word32T> left,
-                                        SloppyTNode<Word32T> right) {
-  int32_t left_constant;
-  bool is_left_constant = ToInt32Constant(left, &left_constant);
-  int32_t right_constant;
-  bool is_right_constant = ToInt32Constant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return Int32Constant(static_cast<uint32_t>(left_constant) >>
-                           right_constant);
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<Word32T>(raw_assembler()->Word32Shr(left, right));
-}
-
-TNode<Word32T> CodeAssembler::Word32Sar(SloppyTNode<Word32T> left,
-                                        SloppyTNode<Word32T> right) {
-  int32_t left_constant;
-  bool is_left_constant = ToInt32Constant(left, &left_constant);
-  int32_t right_constant;
-  bool is_right_constant = ToInt32Constant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return Int32Constant(left_constant >> right_constant);
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<Word32T>(raw_assembler()->Word32Sar(left, right));
-}
-
-TNode<Word64T> CodeAssembler::Word64Or(SloppyTNode<Word64T> left,
-                                       SloppyTNode<Word64T> right) {
-  int64_t left_constant;
-  bool is_left_constant = ToInt64Constant(left, &left_constant);
-  int64_t right_constant;
-  bool is_right_constant = ToInt64Constant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return Int64Constant(left_constant | right_constant);
-    }
-    if (left_constant == 0) {
-      return right;
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<Word64T>(raw_assembler()->Word64Or(left, right));
-}
-
-TNode<Word64T> CodeAssembler::Word64And(SloppyTNode<Word64T> left,
-                                        SloppyTNode<Word64T> right) {
-  int64_t left_constant;
-  bool is_left_constant = ToInt64Constant(left, &left_constant);
-  int64_t right_constant;
-  bool is_right_constant = ToInt64Constant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return Int64Constant(left_constant & right_constant);
-    }
-  }
-  return UncheckedCast<Word64T>(raw_assembler()->Word64And(left, right));
-}
-
-TNode<Word64T> CodeAssembler::Word64Xor(SloppyTNode<Word64T> left,
-                                        SloppyTNode<Word64T> right) {
-  int64_t left_constant;
-  bool is_left_constant = ToInt64Constant(left, &left_constant);
-  int64_t right_constant;
-  bool is_right_constant = ToInt64Constant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return Int64Constant(left_constant ^ right_constant);
-    }
-  }
-  return UncheckedCast<Word64T>(raw_assembler()->Word64Xor(left, right));
-}
-
-TNode<Word64T> CodeAssembler::Word64Shl(SloppyTNode<Word64T> left,
-                                        SloppyTNode<Word64T> right) {
-  int64_t left_constant;
-  bool is_left_constant = ToInt64Constant(left, &left_constant);
-  int64_t right_constant;
-  bool is_right_constant = ToInt64Constant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return Int64Constant(left_constant << right_constant);
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<Word64T>(raw_assembler()->Word64Shl(left, right));
-}
-
-TNode<Word64T> CodeAssembler::Word64Shr(SloppyTNode<Word64T> left,
-                                        SloppyTNode<Word64T> right) {
-  int64_t left_constant;
-  bool is_left_constant = ToInt64Constant(left, &left_constant);
-  int64_t right_constant;
-  bool is_right_constant = ToInt64Constant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return Int64Constant(static_cast<uint64_t>(left_constant) >>
-                           right_constant);
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<Word64T>(raw_assembler()->Word64Shr(left, right));
-}
-
-TNode<Word64T> CodeAssembler::Word64Sar(SloppyTNode<Word64T> left,
-                                        SloppyTNode<Word64T> right) {
-  int64_t left_constant;
-  bool is_left_constant = ToInt64Constant(left, &left_constant);
-  int64_t right_constant;
-  bool is_right_constant = ToInt64Constant(right, &right_constant);
-  if (is_left_constant) {
-    if (is_right_constant) {
-      return Int64Constant(left_constant >> right_constant);
-    }
-  } else if (is_right_constant) {
-    if (right_constant == 0) {
-      return left;
-    }
-  }
-  return UncheckedCast<Word64T>(raw_assembler()->Word64Sar(left, right));
-}
-
 #define CODE_ASSEMBLER_COMPARE(Name, ArgT, VarT, ToConstant, op)          \
   TNode<BoolT> CodeAssembler::Name(TNode<ArgT> left, TNode<ArgT> right) { \
     VarT lhs, rhs;                                                        \
@@ -914,6 +565,14 @@ TNode<IntPtrT> CodeAssembler::ChangeInt32ToIntPtr(SloppyTNode<Word32T> value) {
   return ReinterpretCast<IntPtrT>(value);
 }
 
+TNode<IntPtrT> CodeAssembler::ChangeFloat64ToIntPtr(TNode<Float64T> value) {
+  if (raw_assembler()->machine()->Is64()) {
+    return ReinterpretCast<IntPtrT>(
+        raw_assembler()->ChangeFloat64ToInt64(value));
+  }
+  return ReinterpretCast<IntPtrT>(raw_assembler()->ChangeFloat64ToInt32(value));
+}
+
 TNode<UintPtrT> CodeAssembler::ChangeFloat64ToUintPtr(
     SloppyTNode<Float64T> value) {
   if (raw_assembler()->machine()->Is64()) {
@@ -1234,12 +893,6 @@ TNode<Object> CodeAssembler::CallRuntimeImpl(
   int result_size = Runtime::FunctionForId(function)->result_size;
   TNode<Code> centry =
       HeapConstant(CodeFactory::RuntimeCEntry(isolate(), result_size));
-  return CallRuntimeWithCEntryImpl(function, centry, context, args);
-}
-
-TNode<Object> CodeAssembler::CallRuntimeWithCEntryImpl(
-    Runtime::FunctionId function, TNode<Code> centry, TNode<Object> context,
-    std::initializer_list<TNode<Object>> args) {
   constexpr size_t kMaxNumArgs = 6;
   DCHECK_GE(kMaxNumArgs, args.size());
   int argc = static_cast<int>(args.size());
@@ -1273,12 +926,6 @@ void CodeAssembler::TailCallRuntimeImpl(
   int result_size = Runtime::FunctionForId(function)->result_size;
   TNode<Code> centry =
       HeapConstant(CodeFactory::RuntimeCEntry(isolate(), result_size));
-  return TailCallRuntimeWithCEntryImpl(function, arity, centry, context, args);
-}
-
-void CodeAssembler::TailCallRuntimeWithCEntryImpl(
-    Runtime::FunctionId function, TNode<Int32T> arity, TNode<Code> centry,
-    TNode<Object> context, std::initializer_list<TNode<Object>> args) {
   constexpr size_t kMaxNumArgs = 6;
   DCHECK_GE(kMaxNumArgs, args.size());
   int argc = static_cast<int>(args.size());
@@ -1310,7 +957,13 @@ Node* CodeAssembler::CallStubN(StubCallMode call_mode,
   int implicit_nodes = descriptor.HasContextParameter() ? 2 : 1;
   DCHECK_LE(implicit_nodes, input_count);
   int argc = input_count - implicit_nodes;
-  DCHECK_LE(descriptor.GetParameterCount(), argc);
+#ifdef DEBUG
+  if (descriptor.AllowVarArgs()) {
+    DCHECK_LE(descriptor.GetParameterCount(), argc);
+  } else {
+    DCHECK_EQ(descriptor.GetParameterCount(), argc);
+  }
+#endif
   // Extra arguments not mentioned in the descriptor are passed on the stack.
   int stack_parameter_count = argc - descriptor.GetRegisterParameterCount();
   DCHECK_LE(descriptor.GetStackParameterCount(), stack_parameter_count);
@@ -1570,6 +1223,8 @@ RawMachineAssembler* CodeAssembler::raw_assembler() const {
   return state_->raw_assembler_.get();
 }
 
+JSGraph* CodeAssembler::jsgraph() const { return state_->jsgraph_; }
+
 // The core implementation of Variable is stored through an indirection so
 // that it can outlive the often block-scoped Variable declarations. This is
 // needed to ensure that variable binding and merging through phis can
diff --git a/deps/v8/src/compiler/code-assembler.h b/deps/v8/src/compiler/code-assembler.h
index 8d5b8602854468..af498520153ba5 100644
--- a/deps/v8/src/compiler/code-assembler.h
+++ b/deps/v8/src/compiler/code-assembler.h
@@ -51,6 +51,7 @@ class JSAsyncGeneratorObject;
 class JSCollator;
 class JSCollection;
 class JSDateTimeFormat;
+class JSDisplayNames;
 class JSListFormat;
 class JSLocale;
 class JSNumberFormat;
@@ -106,6 +107,7 @@ inline bool NeedsBoundsCheck(CheckBounds check_bounds) {
 enum class StoreToObjectWriteBarrier { kNone, kMap, kFull };
 
 class AccessCheckNeeded;
+class BigIntBase;
 class BigIntWrapper;
 class ClassBoilerplate;
 class BooleanWrapper;
@@ -185,6 +187,7 @@ class CodeAssemblerVariable;
 template <class T>
 class TypedCodeAssemblerVariable;
 class CodeAssemblerState;
+class JSGraph;
 class Node;
 class RawMachineAssembler;
 class RawMachineLabel;
@@ -246,6 +249,10 @@ class CodeAssemblerParameterizedLabel;
   V(Float64Min, Float64T, Float64T, Float64T)                           \
   V(Float64InsertLowWord32, Float64T, Float64T, Word32T)                \
   V(Float64InsertHighWord32, Float64T, Float64T, Word32T)               \
+  V(IntPtrAdd, WordT, WordT, WordT)                                     \
+  V(IntPtrSub, WordT, WordT, WordT)                                     \
+  V(IntPtrMul, WordT, WordT, WordT)                                     \
+  V(IntPtrDiv, IntPtrT, IntPtrT, IntPtrT)                               \
   V(IntPtrAddWithOverflow, PAIR_TYPE(IntPtrT, BoolT), IntPtrT, IntPtrT) \
   V(IntPtrSubWithOverflow, PAIR_TYPE(IntPtrT, BoolT), IntPtrT, IntPtrT) \
   V(Int32Add, Word32T, Word32T, Word32T)                                \
@@ -256,9 +263,27 @@ class CodeAssemblerParameterizedLabel;
   V(Int32MulWithOverflow, PAIR_TYPE(Int32T, BoolT), Int32T, Int32T)     \
   V(Int32Div, Int32T, Int32T, Int32T)                                   \
   V(Int32Mod, Int32T, Int32T, Int32T)                                   \
+  V(WordOr, WordT, WordT, WordT)                                        \
+  V(WordAnd, WordT, WordT, WordT)                                       \
+  V(WordXor, WordT, WordT, WordT)                                       \
   V(WordRor, WordT, WordT, IntegralT)                                   \
+  V(WordShl, WordT, WordT, IntegralT)                                   \
+  V(WordShr, WordT, WordT, IntegralT)                                   \
+  V(WordSar, WordT, WordT, IntegralT)                                   \
+  V(Word32Or, Word32T, Word32T, Word32T)                                \
+  V(Word32And, Word32T, Word32T, Word32T)                               \
+  V(Word32Xor, Word32T, Word32T, Word32T)                               \
   V(Word32Ror, Word32T, Word32T, Word32T)                               \
-  V(Word64Ror, Word64T, Word64T, Word64T)
+  V(Word32Shl, Word32T, Word32T, Word32T)                               \
+  V(Word32Shr, Word32T, Word32T, Word32T)                               \
+  V(Word32Sar, Word32T, Word32T, Word32T)                               \
+  V(Word64And, Word64T, Word64T, Word64T)                               \
+  V(Word64Or, Word64T, Word64T, Word64T)                                \
+  V(Word64Xor, Word64T, Word64T, Word64T)                               \
+  V(Word64Ror, Word64T, Word64T, Word64T)                               \
+  V(Word64Shl, Word64T, Word64T, Word64T)                               \
+  V(Word64Shr, Word64T, Word64T, Word64T)                               \
+  V(Word64Sar, Word64T, Word64T, Word64T)
 
 TNode<Float64T> Float64Add(TNode<Float64T> a, TNode<Float64T> b);
 
@@ -302,7 +327,6 @@ TNode<Float64T> Float64Add(TNode<Float64T> a, TNode<Float64T> b);
   V(ChangeInt32ToInt64, Int64T, Int32T)                        \
   V(ChangeUint32ToFloat64, Float64T, Word32T)                  \
   V(ChangeUint32ToUint64, Uint64T, Word32T)                    \
-  V(ChangeTaggedToCompressed, TaggedT, AnyTaggedT)             \
   V(BitcastInt32ToFloat32, Float32T, Word32T)                  \
   V(BitcastFloat32ToInt32, Uint32T, Float32T)                  \
   V(RoundFloat64ToInt32, Int32T, Float64T)                     \
@@ -537,15 +561,16 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   Node* Parameter(int value);
 
   TNode<Context> GetJSContextParameter();
-  void Return(SloppyTNode<Object> value);
-  void Return(SloppyTNode<Object> value1, SloppyTNode<Object> value2);
-  void Return(SloppyTNode<Object> value1, SloppyTNode<Object> value2,
-              SloppyTNode<Object> value3);
+  void Return(TNode<Object> value);
+  void Return(TNode<Object> value1, TNode<Object> value2);
+  void Return(TNode<Object> value1, TNode<Object> value2, TNode<Object> value3);
+  void Return(TNode<Int32T> value);
+  void Return(TNode<Uint32T> value);
+  void Return(TNode<WordT> value);
+  void Return(TNode<WordT> value1, TNode<WordT> value2);
   void PopAndReturn(Node* pop, Node* value);
 
-  void ReturnIf(Node* condition, Node* value);
-
-  void ReturnRaw(Node* value);
+  void ReturnIf(Node* condition, TNode<Object> value);
 
   void AbortCSAAssert(Node* message);
   void DebugBreak();
@@ -822,10 +847,6 @@ class V8_EXPORT_PRIVATE CodeAssembler {
         Int32Mul(static_cast<Node*>(left), static_cast<Node*>(right)));
   }
 
-  TNode<WordT> IntPtrAdd(SloppyTNode<WordT> left, SloppyTNode<WordT> right);
-  TNode<IntPtrT> IntPtrDiv(TNode<IntPtrT> left, TNode<IntPtrT> right);
-  TNode<WordT> IntPtrSub(SloppyTNode<WordT> left, SloppyTNode<WordT> right);
-  TNode<WordT> IntPtrMul(SloppyTNode<WordT> left, SloppyTNode<WordT> right);
   TNode<IntPtrT> IntPtrAdd(TNode<IntPtrT> left, TNode<IntPtrT> right) {
     return Signed(
         IntPtrAdd(static_cast<Node*>(left), static_cast<Node*>(right)));
@@ -869,37 +890,6 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   TNode<Word32T> Word32Shr(SloppyTNode<Word32T> value, int shift);
   TNode<Word32T> Word32Sar(SloppyTNode<Word32T> value, int shift);
 
-  TNode<WordT> WordOr(SloppyTNode<WordT> left, SloppyTNode<WordT> right);
-  TNode<WordT> WordAnd(SloppyTNode<WordT> left, SloppyTNode<WordT> right);
-  TNode<WordT> WordXor(SloppyTNode<WordT> left, SloppyTNode<WordT> right);
-  TNode<WordT> WordShl(SloppyTNode<WordT> left, SloppyTNode<IntegralT> right);
-  TNode<WordT> WordShr(SloppyTNode<WordT> left, SloppyTNode<IntegralT> right);
-  TNode<WordT> WordSar(SloppyTNode<WordT> left, SloppyTNode<IntegralT> right);
-  TNode<Word32T> Word32Or(SloppyTNode<Word32T> left,
-                          SloppyTNode<Word32T> right);
-  TNode<Word32T> Word32And(SloppyTNode<Word32T> left,
-                           SloppyTNode<Word32T> right);
-  TNode<Word32T> Word32Xor(SloppyTNode<Word32T> left,
-                           SloppyTNode<Word32T> right);
-  TNode<Word32T> Word32Shl(SloppyTNode<Word32T> left,
-                           SloppyTNode<Word32T> right);
-  TNode<Word32T> Word32Shr(SloppyTNode<Word32T> left,
-                           SloppyTNode<Word32T> right);
-  TNode<Word32T> Word32Sar(SloppyTNode<Word32T> left,
-                           SloppyTNode<Word32T> right);
-  TNode<Word64T> Word64Or(SloppyTNode<Word64T> left,
-                          SloppyTNode<Word64T> right);
-  TNode<Word64T> Word64And(SloppyTNode<Word64T> left,
-                           SloppyTNode<Word64T> right);
-  TNode<Word64T> Word64Xor(SloppyTNode<Word64T> left,
-                           SloppyTNode<Word64T> right);
-  TNode<Word64T> Word64Shl(SloppyTNode<Word64T> left,
-                           SloppyTNode<Word64T> right);
-  TNode<Word64T> Word64Shr(SloppyTNode<Word64T> left,
-                           SloppyTNode<Word64T> right);
-  TNode<Word64T> Word64Sar(SloppyTNode<Word64T> left,
-                           SloppyTNode<Word64T> right);
-
 // Unary
 #define DECLARE_CODE_ASSEMBLER_UNARY_OP(name, ResType, ArgType) \
   TNode<ResType> name(SloppyTNode<ArgType> a);
@@ -914,6 +904,7 @@ class V8_EXPORT_PRIVATE CodeAssembler {
 
   // Changes a double to an inptr_t for pointer arithmetic outside of Smi range.
   // Assumes that the double can be exactly represented as an int.
+  TNode<IntPtrT> ChangeFloat64ToIntPtr(TNode<Float64T> value);
   TNode<UintPtrT> ChangeFloat64ToUintPtr(SloppyTNode<Float64T> value);
   // Same in the opposite direction.
   TNode<Float64T> ChangeUintPtrToFloat64(TNode<UintPtrT> value);
@@ -950,14 +941,6 @@ class V8_EXPORT_PRIVATE CodeAssembler {
                            {implicit_cast<SloppyTNode<Object>>(args)...});
   }
 
-  template <class... TArgs>
-  TNode<Object> CallRuntimeWithCEntry(Runtime::FunctionId function,
-                                      TNode<Code> centry,
-                                      SloppyTNode<Object> context,
-                                      TArgs... args) {
-    return CallRuntimeWithCEntryImpl(function, centry, context, {args...});
-  }
-
   template <class... TArgs>
   void TailCallRuntime(Runtime::FunctionId function,
                        SloppyTNode<Object> context, TArgs... args) {
@@ -974,17 +957,6 @@ class V8_EXPORT_PRIVATE CodeAssembler {
                                {implicit_cast<SloppyTNode<Object>>(args)...});
   }
 
-  template <class... TArgs>
-  void TailCallRuntimeWithCEntry(Runtime::FunctionId function,
-                                 TNode<Code> centry, TNode<Object> context,
-                                 TArgs... args) {
-    int argc = sizeof...(args);
-    TNode<Int32T> arity = Int32Constant(argc);
-    return TailCallRuntimeWithCEntryImpl(
-        function, arity, centry, context,
-        {implicit_cast<SloppyTNode<Object>>(args)...});
-  }
-
   //
   // If context passed to CallStub is nullptr, it won't be passed to the stub.
   //
@@ -1175,19 +1147,10 @@ class V8_EXPORT_PRIVATE CodeAssembler {
                                 TNode<Object> context,
                                 std::initializer_list<TNode<Object>> args);
 
-  TNode<Object> CallRuntimeWithCEntryImpl(
-      Runtime::FunctionId function, TNode<Code> centry, TNode<Object> context,
-      std::initializer_list<TNode<Object>> args);
-
   void TailCallRuntimeImpl(Runtime::FunctionId function, TNode<Int32T> arity,
                            TNode<Object> context,
                            std::initializer_list<TNode<Object>> args);
 
-  void TailCallRuntimeWithCEntryImpl(Runtime::FunctionId function,
-                                     TNode<Int32T> arity, TNode<Code> centry,
-                                     TNode<Object> context,
-                                     std::initializer_list<TNode<Object>> args);
-
   void TailCallStubImpl(const CallInterfaceDescriptor& descriptor,
                         TNode<Code> target, TNode<Object> context,
                         std::initializer_list<Node*> args);
@@ -1207,6 +1170,7 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   TNode<Uint32T> Unsigned(TNode<Uint32T> x);
 
   RawMachineAssembler* raw_assembler() const;
+  JSGraph* jsgraph() const;
 
   // Calls respective callback registered in the state.
   void CallPrologue();
@@ -1461,6 +1425,7 @@ class V8_EXPORT_PRIVATE CodeAssemblerState {
   std::vector<CodeAssemblerExceptionHandlerLabel*> exception_handler_labels_;
   using VariableId = uint32_t;
   VariableId next_variable_id_ = 0;
+  JSGraph* jsgraph_;
 
   VariableId NextVariableId() { return next_variable_id_++; }
 
diff --git a/deps/v8/src/compiler/common-operator.cc b/deps/v8/src/compiler/common-operator.cc
index c2d8cf44693ca6..57cde2ed6e7fed 100644
--- a/deps/v8/src/compiler/common-operator.cc
+++ b/deps/v8/src/compiler/common-operator.cc
@@ -60,7 +60,7 @@ TrapId TrapIdOf(const Operator* const op) {
 }
 
 std::ostream& operator<<(std::ostream& os, BranchOperatorInfo info) {
-  return os << info.hint << "|" << info.is_safety_check;
+  return os << info.hint << ", " << info.is_safety_check;
 }
 
 const BranchOperatorInfo& BranchOperatorInfoOf(const Operator* const op) {
@@ -105,11 +105,8 @@ size_t hash_value(DeoptimizeParameters p) {
 }
 
 std::ostream& operator<<(std::ostream& os, DeoptimizeParameters p) {
-  os << p.kind() << ":" << p.reason() << ":" << p.is_safety_check();
-  if (p.feedback().IsValid()) {
-    os << "; " << p.feedback();
-  }
-  return os;
+  return os << p.kind() << ", " << p.reason() << ", " << p.is_safety_check()
+            << ", " << p.feedback();
 }
 
 DeoptimizeParameters const& DeoptimizeParametersOf(Operator const* const op) {
@@ -169,7 +166,7 @@ size_t hash_value(SelectParameters const& p) {
 
 
 std::ostream& operator<<(std::ostream& os, SelectParameters const& p) {
-  return os << p.representation() << "|" << p.hint();
+  return os << p.representation() << ", " << p.hint();
 }
 
 
@@ -222,13 +219,13 @@ size_t hash_value(ParameterInfo const& p) { return p.index(); }
 
 
 std::ostream& operator<<(std::ostream& os, ParameterInfo const& i) {
-  if (i.debug_name()) os << i.debug_name() << '#';
   os << i.index();
+  if (i.debug_name()) os << ", debug name: " << i.debug_name();
   return os;
 }
 
 std::ostream& operator<<(std::ostream& os, ObjectStateInfo const& i) {
-  return os << "id:" << i.object_id() << "|size:" << i.size();
+  return os << "id:" << i.object_id() << ", size:" << i.size();
 }
 
 size_t hash_value(ObjectStateInfo const& p) {
@@ -236,7 +233,7 @@ size_t hash_value(ObjectStateInfo const& p) {
 }
 
 std::ostream& operator<<(std::ostream& os, TypedObjectStateInfo const& i) {
-  return os << "id:" << i.object_id() << "|" << i.machine_types();
+  return os << "id:" << i.object_id() << ", " << i.machine_types();
 }
 
 size_t hash_value(TypedObjectStateInfo const& p) {
@@ -260,7 +257,7 @@ size_t hash_value(RelocatablePtrConstantInfo const& p) {
 
 std::ostream& operator<<(std::ostream& os,
                          RelocatablePtrConstantInfo const& p) {
-  return os << p.value() << "|" << p.rmode() << "|" << p.type();
+  return os << p.value() << ", " << p.rmode() << ", " << p.type();
 }
 
 SparseInputMask::InputIterator::InputIterator(
@@ -360,7 +357,7 @@ size_t hash_value(TypedStateValueInfo const& p) {
 }
 
 std::ostream& operator<<(std::ostream& os, TypedStateValueInfo const& p) {
-  return os << p.machine_types() << "|" << p.sparse_input_mask();
+  return os << p.machine_types() << ", " << p.sparse_input_mask();
 }
 
 size_t hash_value(RegionObservability observability) {
diff --git a/deps/v8/src/compiler/control-equivalence.cc b/deps/v8/src/compiler/control-equivalence.cc
index 7df7fded78ae0e..4649cf0d6be98f 100644
--- a/deps/v8/src/compiler/control-equivalence.cc
+++ b/deps/v8/src/compiler/control-equivalence.cc
@@ -206,7 +206,7 @@ void ControlEquivalence::DFSPop(DFSStack& stack, Node* node) {
 
 void ControlEquivalence::BracketListDelete(BracketList& blist, Node* to,
                                            DFSDirection direction) {
-  // TODO(mstarzinger): Optimize this to avoid linear search.
+  // TODO(turbofan): Optimize this to avoid linear search.
   for (BracketList::iterator i = blist.begin(); i != blist.end(); /*nop*/) {
     if (i->to == to && i->direction != direction) {
       TRACE("  BList erased: {%d->%d}\n", i->from->id(), i->to->id());
diff --git a/deps/v8/src/compiler/csa-load-elimination.cc b/deps/v8/src/compiler/csa-load-elimination.cc
index 620d98019fd18d..7da9525351e79e 100644
--- a/deps/v8/src/compiler/csa-load-elimination.cc
+++ b/deps/v8/src/compiler/csa-load-elimination.cc
@@ -67,7 +67,7 @@ namespace CsaLoadEliminationHelpers {
 
 bool IsCompatible(MachineRepresentation r1, MachineRepresentation r2) {
   if (r1 == r2) return true;
-  return IsAnyCompressedTagged(r1) && IsAnyCompressedTagged(r2);
+  return IsAnyTagged(r1) && IsAnyTagged(r2);
 }
 
 bool ObjectMayAlias(Node* a, Node* b) {
diff --git a/deps/v8/src/compiler/decompression-elimination.cc b/deps/v8/src/compiler/decompression-elimination.cc
deleted file mode 100644
index 5c0f6b1cfaabf4..00000000000000
--- a/deps/v8/src/compiler/decompression-elimination.cc
+++ /dev/null
@@ -1,271 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/compiler/decompression-elimination.h"
-#include "src/compiler/node-properties.h"
-
-namespace v8 {
-namespace internal {
-namespace compiler {
-
-DecompressionElimination::DecompressionElimination(
-    Editor* editor, Graph* graph, MachineOperatorBuilder* machine,
-    CommonOperatorBuilder* common)
-    : AdvancedReducer(editor),
-      graph_(graph),
-      machine_(machine),
-      common_(common) {}
-
-bool DecompressionElimination::IsReducibleConstantOpcode(
-    IrOpcode::Value opcode) {
-  switch (opcode) {
-    case IrOpcode::kInt64Constant:
-    case IrOpcode::kHeapConstant:
-      return true;
-    default:
-      return false;
-  }
-}
-
-bool DecompressionElimination::IsValidDecompress(
-    IrOpcode::Value compressOpcode, IrOpcode::Value decompressOpcode) {
-  switch (compressOpcode) {
-    case IrOpcode::kChangeTaggedToCompressed:
-      return IrOpcode::IsDecompressOpcode(decompressOpcode);
-    case IrOpcode::kChangeTaggedSignedToCompressedSigned:
-      return decompressOpcode ==
-                 IrOpcode::kChangeCompressedSignedToTaggedSigned ||
-             decompressOpcode == IrOpcode::kChangeCompressedToTagged;
-    case IrOpcode::kChangeTaggedPointerToCompressedPointer:
-      return decompressOpcode ==
-                 IrOpcode::kChangeCompressedPointerToTaggedPointer ||
-             decompressOpcode == IrOpcode::kChangeCompressedToTagged;
-    default:
-      UNREACHABLE();
-  }
-}
-
-Node* DecompressionElimination::GetCompressedConstant(Node* constant) {
-  switch (constant->opcode()) {
-    case IrOpcode::kInt64Constant:
-      return graph()->NewNode(common()->Int32Constant(
-          static_cast<int32_t>(OpParameter<int64_t>(constant->op()))));
-      break;
-    case IrOpcode::kHeapConstant:
-      return graph()->NewNode(
-          common()->CompressedHeapConstant(HeapConstantOf(constant->op())));
-    default:
-      UNREACHABLE();
-  }
-}
-
-Reduction DecompressionElimination::ReduceCompress(Node* node) {
-  DCHECK(IrOpcode::IsCompressOpcode(node->opcode()));
-
-  DCHECK_EQ(node->InputCount(), 1);
-  Node* input_node = node->InputAt(0);
-  IrOpcode::Value input_opcode = input_node->opcode();
-  if (IrOpcode::IsDecompressOpcode(input_opcode)) {
-    DCHECK_EQ(input_node->InputCount(), 1);
-    return Replace(input_node->InputAt(0));
-  } else if (IsReducibleConstantOpcode(input_opcode)) {
-    return Replace(GetCompressedConstant(input_node));
-  } else {
-    return NoChange();
-  }
-}
-
-Reduction DecompressionElimination::ReduceDecompress(Node* node) {
-  DCHECK(IrOpcode::IsDecompressOpcode(node->opcode()));
-
-  DCHECK_EQ(node->InputCount(), 1);
-  Node* input_node = node->InputAt(0);
-  IrOpcode::Value input_opcode = input_node->opcode();
-  if (IrOpcode::IsCompressOpcode(input_opcode)) {
-    DCHECK(IsValidDecompress(input_opcode, node->opcode()));
-    DCHECK_EQ(input_node->InputCount(), 1);
-    return Replace(input_node->InputAt(0));
-  } else {
-    return NoChange();
-  }
-}
-
-Reduction DecompressionElimination::ReducePhi(Node* node) {
-  DCHECK_EQ(node->opcode(), IrOpcode::kPhi);
-
-  const int value_input_count = node->op()->ValueInputCount();
-
-  // Check if all input are decompress nodes, and if all are the same.
-  bool same_decompresses = true;
-  IrOpcode::Value first_opcode = node->InputAt(0)->opcode();
-  for (int i = 0; i < value_input_count; ++i) {
-    Node* input = node->InputAt(i);
-    if (IrOpcode::IsDecompressOpcode(input->opcode())) {
-      same_decompresses &= first_opcode == input->opcode();
-    } else {
-      return NoChange();
-    }
-  }
-
-  // By now, we know that all inputs are decompress nodes. If all are the same,
-  // we can grab the first one to be used after the Phi. If we have different
-  // Decompress nodes as inputs, we need to use a conservative decompression
-  // after the Phi.
-  const Operator* op;
-  if (same_decompresses) {
-    op = node->InputAt(0)->op();
-  } else {
-    op = machine()->ChangeCompressedToTagged();
-  }
-
-  // Rewire phi's inputs to be the compressed inputs.
-  for (int i = 0; i < value_input_count; ++i) {
-    Node* input = node->InputAt(i);
-    DCHECK_EQ(input->InputCount(), 1);
-    node->ReplaceInput(i, input->InputAt(0));
-  }
-
-  // Update the MachineRepresentation on the Phi.
-  MachineRepresentation rep;
-  switch (op->opcode()) {
-    case IrOpcode::kChangeCompressedToTagged:
-      rep = MachineRepresentation::kCompressed;
-      break;
-    case IrOpcode::kChangeCompressedSignedToTaggedSigned:
-      rep = MachineRepresentation::kCompressedSigned;
-      break;
-    case IrOpcode::kChangeCompressedPointerToTaggedPointer:
-      rep = MachineRepresentation::kCompressedPointer;
-      break;
-    default:
-      UNREACHABLE();
-  }
-  NodeProperties::ChangeOp(node, common()->Phi(rep, value_input_count));
-
-  // Add a decompress after the Phi. To do this, we need to replace the Phi with
-  // "Phi <- Decompress".
-  Node* decompress = graph()->NewNode(op, node);
-  ReplaceWithValue(node, decompress);
-  decompress->ReplaceInput(0, node);
-  return Changed(node);
-}
-
-Reduction DecompressionElimination::ReduceTypedStateValues(Node* node) {
-  DCHECK_EQ(node->opcode(), IrOpcode::kTypedStateValues);
-
-  bool any_change = false;
-  for (int i = 0; i < node->InputCount(); ++i) {
-    Node* input = node->InputAt(i);
-    if (IrOpcode::IsDecompressOpcode(input->opcode())) {
-      DCHECK_EQ(input->InputCount(), 1);
-      node->ReplaceInput(i, input->InputAt(0));
-      any_change = true;
-    }
-  }
-  return any_change ? Changed(node) : NoChange();
-}
-
-Reduction DecompressionElimination::ReduceWord32Equal(Node* node) {
-  DCHECK_EQ(node->opcode(), IrOpcode::kWord32Equal);
-
-  DCHECK_EQ(node->InputCount(), 2);
-  Node* lhs = node->InputAt(0);
-  Node* rhs = node->InputAt(1);
-
-  if (!IrOpcode::IsCompressOpcode(lhs->opcode()) ||
-      !IrOpcode::IsCompressOpcode(rhs->opcode())) {
-    return NoChange();
-  }
-  // Input nodes for compress operation.
-  lhs = lhs->InputAt(0);
-  rhs = rhs->InputAt(0);
-
-  bool changed = false;
-
-  if (lhs->opcode() == IrOpcode::kBitcastWordToTaggedSigned) {
-    Node* input = lhs->InputAt(0);
-    if (IsReducibleConstantOpcode(input->opcode())) {
-      node->ReplaceInput(0, GetCompressedConstant(input));
-      changed = true;
-    }
-  }
-
-  if (rhs->opcode() == IrOpcode::kBitcastWordToTaggedSigned) {
-    Node* input = rhs->InputAt(0);
-    if (IsReducibleConstantOpcode(input->opcode())) {
-      node->ReplaceInput(1, GetCompressedConstant(input));
-      changed = true;
-    }
-  }
-
-  return changed ? Changed(node) : NoChange();
-}
-
-Reduction DecompressionElimination::ReduceWord64Equal(Node* node) {
-  DCHECK_EQ(node->opcode(), IrOpcode::kWord64Equal);
-
-  DCHECK_EQ(node->InputCount(), 2);
-  Node* lhs = node->InputAt(0);
-  Node* rhs = node->InputAt(1);
-
-  bool lhs_is_decompress = IrOpcode::IsDecompressOpcode(lhs->opcode());
-  bool rhs_is_decompress = IrOpcode::IsDecompressOpcode(rhs->opcode());
-
-  // Case where both of its inputs are Decompress nodes.
-  if (lhs_is_decompress && rhs_is_decompress) {
-    DCHECK_EQ(lhs->InputCount(), 1);
-    node->ReplaceInput(0, lhs->InputAt(0));
-    DCHECK_EQ(rhs->InputCount(), 1);
-    node->ReplaceInput(1, rhs->InputAt(0));
-    NodeProperties::ChangeOp(node, machine()->Word32Equal());
-    return Changed(node);
-  }
-
-  bool lhs_is_constant = IsReducibleConstantOpcode(lhs->opcode());
-  bool rhs_is_constant = IsReducibleConstantOpcode(rhs->opcode());
-
-  // Case where one input is a Decompress node and the other a constant.
-  if ((lhs_is_decompress && rhs_is_constant) ||
-      (lhs_is_constant && rhs_is_decompress)) {
-    node->ReplaceInput(
-        0, lhs_is_decompress ? lhs->InputAt(0) : GetCompressedConstant(lhs));
-    node->ReplaceInput(
-        1, lhs_is_decompress ? GetCompressedConstant(rhs) : rhs->InputAt(0));
-    NodeProperties::ChangeOp(node, machine()->Word32Equal());
-    return Changed(node);
-  }
-
-  return NoChange();
-}
-
-Reduction DecompressionElimination::Reduce(Node* node) {
-  DisallowHeapAccess no_heap_access;
-
-  switch (node->opcode()) {
-    case IrOpcode::kChangeTaggedToCompressed:
-    case IrOpcode::kChangeTaggedSignedToCompressedSigned:
-    case IrOpcode::kChangeTaggedPointerToCompressedPointer:
-      return ReduceCompress(node);
-    case IrOpcode::kChangeCompressedToTagged:
-    case IrOpcode::kChangeCompressedSignedToTaggedSigned:
-    case IrOpcode::kChangeCompressedPointerToTaggedPointer:
-      return ReduceDecompress(node);
-    case IrOpcode::kPhi:
-      return ReducePhi(node);
-    case IrOpcode::kTypedStateValues:
-      return ReduceTypedStateValues(node);
-    case IrOpcode::kWord32Equal:
-      return ReduceWord32Equal(node);
-    case IrOpcode::kWord64Equal:
-      return ReduceWord64Equal(node);
-    default:
-      break;
-  }
-
-  return NoChange();
-}
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/compiler/decompression-elimination.h b/deps/v8/src/compiler/decompression-elimination.h
deleted file mode 100644
index 6b2be009c6b06f..00000000000000
--- a/deps/v8/src/compiler/decompression-elimination.h
+++ /dev/null
@@ -1,86 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_COMPILER_DECOMPRESSION_ELIMINATION_H_
-#define V8_COMPILER_DECOMPRESSION_ELIMINATION_H_
-
-#include "src/compiler/common-operator.h"
-#include "src/compiler/graph-reducer.h"
-#include "src/compiler/graph.h"
-#include "src/compiler/machine-operator.h"
-
-namespace v8 {
-namespace internal {
-namespace compiler {
-
-// Performs elimination of redundant decompressions within the graph.
-class V8_EXPORT_PRIVATE DecompressionElimination final
-    : public NON_EXPORTED_BASE(AdvancedReducer) {
- public:
-  explicit DecompressionElimination(Editor* editor, Graph* graph,
-                                    MachineOperatorBuilder* machine,
-                                    CommonOperatorBuilder* common);
-  ~DecompressionElimination() final = default;
-
-  const char* reducer_name() const override {
-    return "DecompressionElimination";
-  }
-
-  Reduction Reduce(Node* node) final;
-
- private:
-  // Returns true if the decompress opcode is valid for the compressed one.
-  bool IsValidDecompress(IrOpcode::Value compressOpcode,
-                         IrOpcode::Value decompressOpcode);
-
-  // Returns true if the constant opcode is a reducible one in decompression
-  // elimination.
-  bool IsReducibleConstantOpcode(IrOpcode::Value opcode);
-
-  // Get the new 32 bit node constant given the 64 bit one.
-  Node* GetCompressedConstant(Node* constant);
-
-  // Removes direct Decompressions & Compressions, going from
-  //     Parent <- Decompression <- Compression <- Child
-  // to
-  //     Parent <- Child
-  // Can be used for Any, Signed, and Pointer compressions.
-  Reduction ReduceCompress(Node* node);
-
-  // Removes direct Compressions & Decompressions, analogously to ReduceCompress
-  Reduction ReduceDecompress(Node* node);
-
-  // Replaces Phi's input decompressions with their input node, if and only if
-  // all of the Phi's inputs are Decompress nodes.
-  Reduction ReducePhi(Node* node);
-
-  // Replaces TypedStateValues's input decompressions with their input node.
-  Reduction ReduceTypedStateValues(Node* node);
-
-  // Replaces a Word64Equal with a Word32Equal if both of its inputs are
-  // Decompress nodes, or if one is a Decompress node and the other a constant.
-  // In the case of two decompresses, it uses the original inputs before they
-  // are decompressed. In the case of having a constant, it uses the compressed
-  // value of that constant.
-  Reduction ReduceWord64Equal(Node* node);
-
-  // This is a workaround for load elimination test.
-  // Replaces Compress -> BitcastWordToTaggedSigned -> ReducibleConstant
-  // to CompressedConstant on both inputs of Word32Equal operation.
-  Reduction ReduceWord32Equal(Node* node);
-
-  Graph* graph() const { return graph_; }
-  MachineOperatorBuilder* machine() const { return machine_; }
-  CommonOperatorBuilder* common() const { return common_; }
-
-  Graph* const graph_;
-  MachineOperatorBuilder* const machine_;
-  CommonOperatorBuilder* const common_;
-};
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_COMPILER_DECOMPRESSION_ELIMINATION_H_
diff --git a/deps/v8/src/compiler/decompression-optimizer.cc b/deps/v8/src/compiler/decompression-optimizer.cc
new file mode 100644
index 00000000000000..9b2362c9ef9b2e
--- /dev/null
+++ b/deps/v8/src/compiler/decompression-optimizer.cc
@@ -0,0 +1,254 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/decompression-optimizer.h"
+
+#include "src/compiler/graph.h"
+#include "src/compiler/node-properties.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+namespace {
+
+bool IsMachineLoad(Node* const node) {
+  const IrOpcode::Value opcode = node->opcode();
+  return opcode == IrOpcode::kLoad || opcode == IrOpcode::kPoisonedLoad ||
+         opcode == IrOpcode::kProtectedLoad ||
+         opcode == IrOpcode::kUnalignedLoad;
+}
+
+bool IsTaggedMachineLoad(Node* const node) {
+  return IsMachineLoad(node) &&
+         CanBeTaggedPointer(LoadRepresentationOf(node->op()).representation());
+}
+
+bool IsHeapConstant(Node* const node) {
+  return node->opcode() == IrOpcode::kHeapConstant;
+}
+
+bool IsTaggedPhi(Node* const node) {
+  if (node->opcode() == IrOpcode::kPhi) {
+    return CanBeTaggedPointer(PhiRepresentationOf(node->op()));
+  }
+  return false;
+}
+
+bool CanBeCompressed(Node* const node) {
+  return IsHeapConstant(node) || IsTaggedMachineLoad(node) || IsTaggedPhi(node);
+}
+
+}  // anonymous namespace
+
+DecompressionOptimizer::DecompressionOptimizer(Zone* zone, Graph* graph,
+                                               CommonOperatorBuilder* common,
+                                               MachineOperatorBuilder* machine)
+    : graph_(graph),
+      common_(common),
+      machine_(machine),
+      states_(graph, static_cast<uint32_t>(State::kNumberOfStates)),
+      to_visit_(zone),
+      compressed_candidate_nodes_(zone) {}
+
+void DecompressionOptimizer::MarkNodes() {
+  MaybeMarkAndQueueForRevisit(graph()->end(), State::kOnly32BitsObserved);
+  while (!to_visit_.empty()) {
+    Node* const node = to_visit_.front();
+    to_visit_.pop_front();
+    MarkNodeInputs(node);
+  }
+}
+
+void DecompressionOptimizer::MarkNodeInputs(Node* node) {
+  // Mark the value inputs.
+  switch (node->opcode()) {
+    // UNOPS.
+    case IrOpcode::kBitcastTaggedToWord:
+    case IrOpcode::kBitcastTaggedToWordForTagAndSmiBits:
+      // Replicate the bitcast's state for its input.
+      DCHECK_EQ(node->op()->ValueInputCount(), 1);
+      MaybeMarkAndQueueForRevisit(node->InputAt(0),
+                                  states_.Get(node));  // value
+      break;
+    case IrOpcode::kTruncateInt64ToInt32:
+      DCHECK_EQ(node->op()->ValueInputCount(), 1);
+      MaybeMarkAndQueueForRevisit(node->InputAt(0),
+                                  State::kOnly32BitsObserved);  // value
+      break;
+    // BINOPS.
+    case IrOpcode::kInt32LessThan:
+    case IrOpcode::kInt32LessThanOrEqual:
+    case IrOpcode::kUint32LessThan:
+    case IrOpcode::kUint32LessThanOrEqual:
+    case IrOpcode::kWord32And:
+    case IrOpcode::kWord32Equal:
+    case IrOpcode::kWord32Shl:
+      DCHECK_EQ(node->op()->ValueInputCount(), 2);
+      MaybeMarkAndQueueForRevisit(node->InputAt(0),
+                                  State::kOnly32BitsObserved);  // value_0
+      MaybeMarkAndQueueForRevisit(node->InputAt(1),
+                                  State::kOnly32BitsObserved);  // value_1
+      break;
+    // SPECIAL CASES.
+    // SPECIAL CASES - Store.
+    case IrOpcode::kStore:
+    case IrOpcode::kProtectedStore:
+    case IrOpcode::kUnalignedStore:
+      DCHECK_EQ(node->op()->ValueInputCount(), 3);
+      MaybeMarkAndQueueForRevisit(node->InputAt(0),
+                                  State::kEverythingObserved);  // base pointer
+      MaybeMarkAndQueueForRevisit(node->InputAt(1),
+                                  State::kEverythingObserved);  // index
+      // TODO(v8:7703): When the implementation is done, check if this ternary
+      // operator is too restrictive, since we only mark Tagged stores as 32
+      // bits.
+      MaybeMarkAndQueueForRevisit(
+          node->InputAt(2),
+          IsAnyTagged(StoreRepresentationOf(node->op()).representation())
+              ? State::kOnly32BitsObserved
+              : State::kEverythingObserved);  // value
+      break;
+    // SPECIAL CASES - Variable inputs.
+    // The deopt code knows how to handle Compressed inputs, both
+    // MachineRepresentation kCompressed values and CompressedHeapConstants.
+    case IrOpcode::kFrameState:  // Fall through.
+    // TODO(v8:7703): kStateValues doesn't appear in any test linked to Loads or
+    // HeapConstants. Do we care about this case?
+    case IrOpcode::kStateValues:  // Fall through.
+    case IrOpcode::kTypedStateValues:
+      for (int i = 0; i < node->op()->ValueInputCount(); ++i) {
+        MaybeMarkAndQueueForRevisit(node->InputAt(i),
+                                    State::kOnly32BitsObserved);
+      }
+      break;
+    case IrOpcode::kPhi: {
+      // Replicate the phi's state for its inputs.
+      State curr_state = states_.Get(node);
+      for (int i = 0; i < node->op()->ValueInputCount(); ++i) {
+        MaybeMarkAndQueueForRevisit(node->InputAt(i), curr_state);
+      }
+      break;
+    }
+    default:
+      // To be conservative, we assume that all value inputs need to be 64 bits
+      // unless noted otherwise.
+      for (int i = 0; i < node->op()->ValueInputCount(); ++i) {
+        MaybeMarkAndQueueForRevisit(node->InputAt(i),
+                                    State::kEverythingObserved);
+      }
+      break;
+  }
+
+  // We always mark the non-value input nodes as kOnly32BitsObserved so that
+  // they will be visited. If they need to be kEverythingObserved, they will be
+  // marked as such in a future pass.
+  for (int i = node->op()->ValueInputCount(); i < node->InputCount(); ++i) {
+    MaybeMarkAndQueueForRevisit(node->InputAt(i), State::kOnly32BitsObserved);
+  }
+}
+
+void DecompressionOptimizer::MaybeMarkAndQueueForRevisit(Node* const node,
+                                                         State state) {
+  DCHECK_NE(state, State::kUnvisited);
+  State previous_state = states_.Get(node);
+  // Only update the state if we have relevant new information.
+  if (previous_state == State::kUnvisited ||
+      (previous_state == State::kOnly32BitsObserved &&
+       state == State::kEverythingObserved)) {
+    states_.Set(node, state);
+    to_visit_.push_back(node);
+
+    if (state == State::kOnly32BitsObserved && CanBeCompressed(node)) {
+      compressed_candidate_nodes_.push_back(node);
+    }
+  }
+}
+
+void DecompressionOptimizer::ChangeHeapConstant(Node* const node) {
+  DCHECK(IsHeapConstant(node));
+  NodeProperties::ChangeOp(
+      node, common()->CompressedHeapConstant(HeapConstantOf(node->op())));
+}
+
+void DecompressionOptimizer::ChangePhi(Node* const node) {
+  DCHECK(IsTaggedPhi(node));
+
+  MachineRepresentation mach_rep = PhiRepresentationOf(node->op());
+  if (mach_rep == MachineRepresentation::kTagged) {
+    mach_rep = MachineRepresentation::kCompressed;
+  } else {
+    DCHECK_EQ(mach_rep, MachineRepresentation::kTaggedPointer);
+    mach_rep = MachineRepresentation::kCompressedPointer;
+  }
+
+  NodeProperties::ChangeOp(
+      node, common()->Phi(mach_rep, node->op()->ValueInputCount()));
+}
+
+void DecompressionOptimizer::ChangeLoad(Node* const node) {
+  DCHECK(IsMachineLoad(node));
+  // Change to a Compressed MachRep to avoid the full decompression.
+  LoadRepresentation load_rep = LoadRepresentationOf(node->op());
+  LoadRepresentation compressed_load_rep;
+  if (load_rep == MachineType::AnyTagged()) {
+    compressed_load_rep = MachineType::AnyCompressed();
+  } else {
+    DCHECK_EQ(load_rep, MachineType::TaggedPointer());
+    compressed_load_rep = MachineType::CompressedPointer();
+  }
+
+  // Change to the Operator with the Compressed MachineRepresentation.
+  switch (node->opcode()) {
+    case IrOpcode::kLoad:
+      NodeProperties::ChangeOp(node, machine()->Load(compressed_load_rep));
+      break;
+    case IrOpcode::kPoisonedLoad:
+      NodeProperties::ChangeOp(node,
+                               machine()->PoisonedLoad(compressed_load_rep));
+      break;
+    case IrOpcode::kProtectedLoad:
+      NodeProperties::ChangeOp(node,
+                               machine()->ProtectedLoad(compressed_load_rep));
+      break;
+    case IrOpcode::kUnalignedLoad:
+      NodeProperties::ChangeOp(node,
+                               machine()->UnalignedLoad(compressed_load_rep));
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+void DecompressionOptimizer::ChangeNodes() {
+  for (Node* const node : compressed_candidate_nodes_) {
+    // compressed_candidate_nodes_ contains all the nodes that once had the
+    // State::kOnly32BitsObserved. If we later updated the state to be
+    // State::IsEverythingObserved, then we have to ignore them. This is less
+    // costly than removing them from the compressed_candidate_nodes_ NodeVector
+    // when we update them to State::IsEverythingObserved.
+    if (IsEverythingObserved(node)) continue;
+
+    switch (node->opcode()) {
+      case IrOpcode::kHeapConstant:
+        ChangeHeapConstant(node);
+        break;
+      case IrOpcode::kPhi:
+        ChangePhi(node);
+        break;
+      default:
+        ChangeLoad(node);
+        break;
+    }
+  }
+}
+
+void DecompressionOptimizer::Reduce() {
+  MarkNodes();
+  ChangeNodes();
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/compiler/decompression-optimizer.h b/deps/v8/src/compiler/decompression-optimizer.h
new file mode 100644
index 00000000000000..1d94739e45d8be
--- /dev/null
+++ b/deps/v8/src/compiler/decompression-optimizer.h
@@ -0,0 +1,125 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_DECOMPRESSION_OPTIMIZER_H_
+#define V8_COMPILER_DECOMPRESSION_OPTIMIZER_H_
+
+#include "src/compiler/common-operator.h"
+#include "src/compiler/machine-operator.h"
+#include "src/compiler/node-marker.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+// Forward declare.
+class Graph;
+
+// DecompressionOptimizer purpose is to hide the distinction between 32 bit and
+// 64 bit tagged values, while being able to use the compressed version of nodes
+// whenever possible. Its scope is narrowed down to loads of TaggedPointer and
+// AnyTagged (since TaggedSigned avoids full decompression always), and
+// HeapConstants.
+
+// DecompressionOptimizer will run only when pointer compression is enabled.
+
+// The phase needs to be run when Machine are present in the graph, i.e
+// at the very end of the pipeline. Also, since this phase may change
+// the load's MachineRepresentation from Tagged to Compressed, it's best
+// to run it as late as possible in order to keep the phases that know
+// about Compressed MachineRepresentation to a minimum.
+
+// As an example, if we Load a Tagged value only to Store it back again (i.e
+// Load -> Store nodes, with the Load's value being the Store's value) we don't
+// need to fully decompress it since the Store will ignore the top bits.
+class V8_EXPORT_PRIVATE DecompressionOptimizer final {
+ public:
+  DecompressionOptimizer(Zone* zone, Graph* graph,
+                         CommonOperatorBuilder* common,
+                         MachineOperatorBuilder* machine);
+  ~DecompressionOptimizer() = default;
+
+  // Assign States to the nodes, and then change the node's Operator to use the
+  // compressed version if possible.
+  void Reduce();
+
+ private:
+  // State refers to the node's state as follows:
+  // * kUnvisited === This node has yet to be visited.
+  // * kOnly32BitsObserved === This node either has been visited, or is on
+  // to_visit_. We couldn't find a node that observes the upper bits.
+  // * kEverythingObserved === This node either has been visited, or is on
+  // to_visit_. We found at least one node that observes the upper bits.
+  enum class State : uint8_t {
+    kUnvisited = 0,
+    kOnly32BitsObserved,
+    kEverythingObserved,
+    kNumberOfStates
+  };
+
+  // Change node's op from HeapConstant to CompressedHeapConstant.
+  void ChangeHeapConstant(Node* const node);
+
+  // Change the phi's representation from Tagged to Compressed.
+  void ChangePhi(Node* const node);
+
+  // Change node's load into a compressed one.
+  void ChangeLoad(Node* const node);
+
+  // Go through the already marked nodes and changed the operation for the nodes
+  // that can use compressed outputs.
+  void ChangeNodes();
+
+  // Goes through the nodes to mark them all as appropriate. It will visit each
+  // node at most twice: only when the node was unvisited, then marked as
+  // kOnly32BitsObserved and visited, and finally marked as kEverythingObserved
+  // and visited.
+  void MarkNodes();
+
+  // Mark node's input as appropriate, according to node's opcode. Some input
+  // State may be updated, and therefore has to be revisited.
+  void MarkNodeInputs(Node* node);
+
+  // Mark node's State to be state. We only do this if we have new information,
+  // i.e either if:
+  // * We are marking an unvisited node, or
+  // * We are marking a node as needing 64 bits when we previously had the
+  // information that it could output 32 bits. Also, we store the HeapConstant
+  // and TaggedPointer and AnyTagged loads that have their state set as
+  // kOnly32BitsObserved. If the node's state changes, we queue it for revisit.
+  void MaybeMarkAndQueueForRevisit(Node* const node, State state);
+
+  bool IsEverythingObserved(Node* const node) {
+    return states_.Get(node) == State::kEverythingObserved;
+  }
+
+  bool IsOnly32BitsObserved(Node* const node) {
+    return states_.Get(node) == State::kOnly32BitsObserved;
+  }
+
+  Graph* graph() const { return graph_; }
+  CommonOperatorBuilder* common() const { return common_; }
+  MachineOperatorBuilder* machine() const { return machine_; }
+
+  Graph* const graph_;
+  CommonOperatorBuilder* const common_;
+  MachineOperatorBuilder* const machine_;
+  NodeMarker<State> states_;
+  // to_visit_ is a Deque but it's used as if it were a Queue. The reason why we
+  // are using NodeDeque is because it attempts to reuse 'freed' zone memory
+  // instead of always allocating a new region.
+  NodeDeque to_visit_;
+  // Contains the nodes that can be changed into a compressed version of
+  // themselves. In a way, it functions as a NodeSet since each node will be
+  // contained at most once. It's a Vector since we care about insertion speed.
+  NodeVector compressed_candidate_nodes_;
+
+  DISALLOW_COPY_AND_ASSIGN(DecompressionOptimizer);
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_DECOMPRESSION_OPTIMIZER_H_
diff --git a/deps/v8/src/compiler/effect-control-linearizer.cc b/deps/v8/src/compiler/effect-control-linearizer.cc
index ceff453164bbfb..3f170df0650691 100644
--- a/deps/v8/src/compiler/effect-control-linearizer.cc
+++ b/deps/v8/src/compiler/effect-control-linearizer.cc
@@ -4,6 +4,7 @@
 
 #include "src/compiler/effect-control-linearizer.h"
 
+#include "src/base/bits.h"
 #include "src/codegen/code-factory.h"
 #include "src/codegen/machine-type.h"
 #include "src/common/ptr-compr-inl.h"
@@ -34,26 +35,27 @@ class EffectControlLinearizer {
                           Zone* temp_zone,
                           SourcePositionTable* source_positions,
                           NodeOriginTable* node_origins,
-                          MaskArrayIndexEnable mask_array_index)
+                          MaskArrayIndexEnable mask_array_index,
+                          MaintainSchedule maintain_schedule)
       : js_graph_(js_graph),
         schedule_(schedule),
         temp_zone_(temp_zone),
         mask_array_index_(mask_array_index),
+        maintain_schedule_(maintain_schedule),
         source_positions_(source_positions),
         node_origins_(node_origins),
-        graph_assembler_(js_graph, nullptr, nullptr, temp_zone),
+        graph_assembler_(js_graph, temp_zone,
+                         should_maintain_schedule() ? schedule : nullptr),
         frame_state_zapper_(nullptr) {}
 
   void Run();
 
  private:
-  void ProcessNode(Node* node, Node** frame_state, Node** effect,
-                   Node** control);
+  void UpdateEffectControlForNode(Node* node);
+  void ProcessNode(Node* node, Node** frame_state);
 
-  bool TryWireInStateEffect(Node* node, Node* frame_state, Node** effect,
-                            Node** control);
+  bool TryWireInStateEffect(Node* node, Node* frame_state);
   Node* LowerChangeBitToTagged(Node* node);
-  Node* LowerChangeInt31ToCompressedSigned(Node* node);
   Node* LowerChangeInt31ToTaggedSigned(Node* node);
   Node* LowerChangeInt32ToTagged(Node* node);
   Node* LowerChangeInt64ToTagged(Node* node);
@@ -61,7 +63,6 @@ class EffectControlLinearizer {
   Node* LowerChangeUint64ToTagged(Node* node);
   Node* LowerChangeFloat64ToTagged(Node* node);
   Node* LowerChangeFloat64ToTaggedPointer(Node* node);
-  Node* LowerChangeCompressedSignedToInt32(Node* node);
   Node* LowerChangeTaggedSignedToInt32(Node* node);
   Node* LowerChangeTaggedSignedToInt64(Node* node);
   Node* LowerChangeTaggedToBit(Node* node);
@@ -69,8 +70,6 @@ class EffectControlLinearizer {
   Node* LowerChangeTaggedToUint32(Node* node);
   Node* LowerChangeTaggedToInt64(Node* node);
   Node* LowerChangeTaggedToTaggedSigned(Node* node);
-  Node* LowerChangeCompressedToTaggedSigned(Node* node);
-  Node* LowerChangeTaggedToCompressedSigned(Node* node);
   Node* LowerPoisonIndex(Node* node);
   Node* LowerCheckInternalizedString(Node* node, Node* frame_state);
   void LowerCheckMaps(Node* node, Node* frame_state);
@@ -89,7 +88,6 @@ class EffectControlLinearizer {
   Node* LowerCheckedUint32Div(Node* node, Node* frame_state);
   Node* LowerCheckedUint32Mod(Node* node, Node* frame_state);
   Node* LowerCheckedInt32Mul(Node* node, Node* frame_state);
-  Node* LowerCheckedInt32ToCompressedSigned(Node* node, Node* frame_state);
   Node* LowerCheckedInt32ToTaggedSigned(Node* node, Node* frame_state);
   Node* LowerCheckedInt64ToInt32(Node* node, Node* frame_state);
   Node* LowerCheckedInt64ToTaggedSigned(Node* node, Node* frame_state);
@@ -102,6 +100,7 @@ class EffectControlLinearizer {
   Node* LowerCheckedFloat64ToInt32(Node* node, Node* frame_state);
   Node* LowerCheckedFloat64ToInt64(Node* node, Node* frame_state);
   Node* LowerCheckedTaggedSignedToInt32(Node* node, Node* frame_state);
+  Node* LowerCheckedTaggedToArrayIndex(Node* node, Node* frame_state);
   Node* LowerCheckedTaggedToInt32(Node* node, Node* frame_state);
   Node* LowerCheckedTaggedToInt64(Node* node, Node* frame_state);
   Node* LowerCheckedTaggedToFloat64(Node* node, Node* frame_state);
@@ -110,10 +109,6 @@ class EffectControlLinearizer {
   Node* LowerBigIntAsUintN(Node* node, Node* frame_state);
   Node* LowerChangeUint64ToBigInt(Node* node);
   Node* LowerTruncateBigIntToUint64(Node* node);
-  Node* LowerCheckedCompressedToTaggedSigned(Node* node, Node* frame_state);
-  Node* LowerCheckedCompressedToTaggedPointer(Node* node, Node* frame_state);
-  Node* LowerCheckedTaggedToCompressedSigned(Node* node, Node* frame_state);
-  Node* LowerCheckedTaggedToCompressedPointer(Node* node, Node* frame_state);
   Node* LowerChangeTaggedToFloat64(Node* node);
   void TruncateTaggedPointerToBit(Node* node, GraphAssemblerLabel<1>* done);
   Node* LowerTruncateTaggedToBit(Node* node);
@@ -172,6 +167,7 @@ class EffectControlLinearizer {
   Node* LowerStringLessThan(Node* node);
   Node* LowerStringLessThanOrEqual(Node* node);
   Node* LowerBigIntAdd(Node* node, Node* frame_state);
+  Node* LowerBigIntSubtract(Node* node, Node* frame_state);
   Node* LowerBigIntNegate(Node* node);
   Node* LowerCheckFloat64Hole(Node* node, Node* frame_state);
   Node* LowerCheckNotTaggedHole(Node* node, Node* frame_state);
@@ -218,6 +214,8 @@ class EffectControlLinearizer {
   Node* BuildCheckedFloat64ToInt64(CheckForMinusZeroMode mode,
                                    const FeedbackSource& feedback, Node* value,
                                    Node* frame_state);
+  Node* BuildCheckedFloat64ToIndex(const FeedbackSource& feedback, Node* value,
+                                   Node* frame_state);
   Node* BuildCheckedHeapNumberOrOddballToFloat64(CheckTaggedInputMode mode,
                                                  const FeedbackSource& feedback,
                                                  Node* value,
@@ -225,6 +223,11 @@ class EffectControlLinearizer {
   Node* BuildReverseBytes(ExternalArrayType type, Node* value);
   Node* BuildFloat64RoundDown(Node* value);
   Node* BuildFloat64RoundTruncate(Node* input);
+  template <size_t VarCount, size_t VarCount2>
+  void SmiTagOrOverflow(Node* value, GraphAssemblerLabel<VarCount>* if_overflow,
+                        GraphAssemblerLabel<VarCount2>* done);
+  Node* SmiTagOrDeopt(Node* value, const CheckParameters& params,
+                      Node* frame_state);
   Node* BuildUint32Mod(Node* lhs, Node* rhs);
   Node* ComputeUnseededHash(Node* value);
   Node* LowerStringComparison(Callable const& callable, Node* node);
@@ -232,8 +235,13 @@ class EffectControlLinearizer {
 
   Node* BuildTypedArrayDataPointer(Node* base, Node* external);
 
-  Node* ChangeInt32ToCompressedSmi(Node* value);
   Node* ChangeInt32ToSmi(Node* value);
+  // In pointer compression, we smi-corrupt. This means the upper bits of a Smi
+  // are not important. ChangeTaggedInt32ToSmi has a known tagged int32 as input
+  // and takes advantage of the smi corruption by emitting a Bitcast node
+  // instead of a Change node in order to save instructions.
+  // In non pointer compression, it behaves like ChangeInt32ToSmi.
+  Node* ChangeTaggedInt32ToSmi(Node* value);
   Node* ChangeInt32ToIntPtr(Node* value);
   Node* ChangeInt64ToSmi(Node* value);
   Node* ChangeIntPtrToInt32(Node* value);
@@ -241,18 +249,19 @@ class EffectControlLinearizer {
   Node* ChangeUint32ToUintPtr(Node* value);
   Node* ChangeUint32ToSmi(Node* value);
   Node* ChangeSmiToIntPtr(Node* value);
-  Node* ChangeCompressedSmiToInt32(Node* value);
   Node* ChangeSmiToInt32(Node* value);
   Node* ChangeSmiToInt64(Node* value);
   Node* ObjectIsSmi(Node* value);
-  Node* CompressedObjectIsSmi(Node* value);
   Node* LoadFromSeqString(Node* receiver, Node* position, Node* is_one_byte);
 
   Node* SmiMaxValueConstant();
   Node* SmiShiftBitsConstant();
   void TransitionElementsTo(Node* node, Node* array, ElementsKind from,
                             ElementsKind to);
-  void ConnectUnreachableToEnd(Node* effect, Node* control);
+
+  bool should_maintain_schedule() const {
+    return maintain_schedule_ == MaintainSchedule::kMaintain;
+  }
 
   Factory* factory() const { return isolate()->factory(); }
   Isolate* isolate() const { return jsgraph()->isolate(); }
@@ -265,16 +274,17 @@ class EffectControlLinearizer {
     return js_graph_->simplified();
   }
   MachineOperatorBuilder* machine() const { return js_graph_->machine(); }
-  GraphAssembler* gasm() { return &graph_assembler_; }
+  JSGraphAssembler* gasm() { return &graph_assembler_; }
 
   JSGraph* js_graph_;
   Schedule* schedule_;
   Zone* temp_zone_;
   MaskArrayIndexEnable mask_array_index_;
+  MaintainSchedule maintain_schedule_;
   RegionObservability region_observability_ = RegionObservability::kObservable;
   SourcePositionTable* source_positions_;
   NodeOriginTable* node_origins_;
-  GraphAssembler graph_assembler_;
+  JSGraphAssembler graph_assembler_;
   Node* frame_state_zapper_;  // For tracking down compiler::Node::New crashes.
 };
 
@@ -291,11 +301,11 @@ class BlockEffectControlMap {
   explicit BlockEffectControlMap(Zone* temp_zone) : map_(temp_zone) {}
 
   BlockEffectControlData& For(BasicBlock* from, BasicBlock* to) {
-    return map_[std::make_pair(from->rpo_number(), to->rpo_number())];
+    return map_[std::make_pair(from->id().ToInt(), to->id().ToInt())];
   }
 
   const BlockEffectControlData& For(BasicBlock* from, BasicBlock* to) const {
-    return map_.at(std::make_pair(from->rpo_number(), to->rpo_number()));
+    return map_.at(std::make_pair(from->id().ToInt(), to->id().ToInt()));
   }
 
  private:
@@ -361,15 +371,6 @@ void UpdateBlockControl(BasicBlock* block,
   }
 }
 
-bool HasIncomingBackEdges(BasicBlock* block) {
-  for (BasicBlock* pred : block->predecessors()) {
-    if (pred->rpo_number() >= block->rpo_number()) {
-      return true;
-    }
-  }
-  return false;
-}
-
 void RemoveRenameNode(Node* node) {
   DCHECK(IrOpcode::kFinishRegion == node->opcode() ||
          IrOpcode::kBeginRegion == node->opcode() ||
@@ -554,17 +555,24 @@ void EffectControlLinearizer::Run() {
   ZoneVector<BasicBlock*> pending_block_controls(temp_zone());
   NodeVector inputs_buffer(temp_zone());
 
+  // TODO(rmcilroy) We should not depend on having rpo_order on schedule, and
+  // instead just do our own RPO walk here.
   for (BasicBlock* block : *(schedule()->rpo_order())) {
-    size_t instr = 0;
+    gasm()->Reset(block);
+
+    BasicBlock::iterator instr = block->begin();
+    BasicBlock::iterator end_instr = block->end();
 
     // The control node should be the first.
-    Node* control = block->NodeAt(instr);
+    Node* control = *instr;
+    gasm()->AddNode(control);
+
     DCHECK(NodeProperties::IsControl(control));
+    bool has_incoming_backedge = IrOpcode::kLoop == control->opcode();
     // Update the control inputs.
-    if (HasIncomingBackEdges(block)) {
+    if (has_incoming_backedge) {
       // If there are back edges, we need to update later because we have not
-      // computed the control yet. This should only happen for loops.
-      DCHECK_EQ(IrOpcode::kLoop, control->opcode());
+      // computed the control yet.
       pending_block_controls.push_back(block);
     } else {
       // If there are no back edges, we can update now.
@@ -575,8 +583,8 @@ void EffectControlLinearizer::Run() {
     // Iterate over the phis and update the effect phis.
     Node* effect_phi = nullptr;
     Node* terminate = nullptr;
-    for (; instr < block->NodeCount(); instr++) {
-      Node* node = block->NodeAt(instr);
+    for (; instr != end_instr; instr++) {
+      Node* node = *instr;
       // Only go through the phis and effect phis.
       if (node->opcode() == IrOpcode::kEffectPhi) {
         // There should be at most one effect phi in a block.
@@ -592,11 +600,12 @@ void EffectControlLinearizer::Run() {
       } else {
         break;
       }
+      gasm()->AddNode(node);
     }
 
     if (effect_phi) {
       // Make sure we update the inputs to the incoming blocks' effects.
-      if (HasIncomingBackEdges(block)) {
+      if (has_incoming_backedge) {
         // In case of loops, we do not update the effect phi immediately
         // because the back predecessor has not been handled yet. We just
         // record the effect phi for later processing.
@@ -640,6 +649,7 @@ void EffectControlLinearizer::Run() {
           effect = graph()->NewNode(
               common()->EffectPhi(static_cast<int>(block->PredecessorCount())),
               static_cast<int>(inputs_buffer.size()), &(inputs_buffer.front()));
+          gasm()->AddNode(effect);
           // For loops, we update the effect phi node later to break cycles.
           if (control->opcode() == IrOpcode::kLoop) {
             pending_effect_phis.push_back(PendingEffectPhi(effect, block));
@@ -663,8 +673,6 @@ void EffectControlLinearizer::Run() {
     // The frame state at block entry is determined by the frame states leaving
     // all predecessors. In case there is no frame state dominating this block,
     // we can rely on a checkpoint being present before the next deoptimization.
-    // TODO(mstarzinger): Eventually we will need to go hunt for a frame state
-    // once deoptimizing nodes roam freely through the schedule.
     Node* frame_state = nullptr;
     if (block != schedule()->start()) {
       // If all the predecessors have the same effect, we can use it
@@ -681,42 +689,47 @@ void EffectControlLinearizer::Run() {
       }
     }
 
+    gasm()->InitializeEffectControl(effect, control);
+
     // Process the ordinary instructions.
-    for (; instr < block->NodeCount(); instr++) {
-      Node* node = block->NodeAt(instr);
-      ProcessNode(node, &frame_state, &effect, &control);
+    for (; instr != end_instr; instr++) {
+      Node* node = *instr;
+      ProcessNode(node, &frame_state);
     }
 
+    block = gasm()->FinalizeCurrentBlock(block);
+
     switch (block->control()) {
       case BasicBlock::kGoto:
       case BasicBlock::kNone:
         break;
-
       case BasicBlock::kCall:
       case BasicBlock::kTailCall:
       case BasicBlock::kSwitch:
       case BasicBlock::kReturn:
       case BasicBlock::kDeoptimize:
       case BasicBlock::kThrow:
-        ProcessNode(block->control_input(), &frame_state, &effect, &control);
-        break;
-
       case BasicBlock::kBranch:
-        ProcessNode(block->control_input(), &frame_state, &effect, &control);
-        TryCloneBranch(block->control_input(), block, temp_zone(), graph(),
-                       common(), &block_effects, source_positions_,
-                       node_origins_);
+        UpdateEffectControlForNode(block->control_input());
+        gasm()->UpdateEffectControlWith(block->control_input());
         break;
     }
 
+    if (!should_maintain_schedule() &&
+        block->control() == BasicBlock::kBranch) {
+      TryCloneBranch(block->control_input(), block, temp_zone(), graph(),
+                     common(), &block_effects, source_positions_,
+                     node_origins_);
+    }
+
     // Store the effect, control and frame state for later use.
     for (BasicBlock* successor : block->successors()) {
       BlockEffectControlData* data = &block_effects.For(block, successor);
       if (data->current_effect == nullptr) {
-        data->current_effect = effect;
+        data->current_effect = gasm()->effect();
       }
       if (data->current_control == nullptr) {
-        data->current_control = control;
+        data->current_control = gasm()->control();
       }
       data->current_frame_state = frame_state;
     }
@@ -731,17 +744,42 @@ void EffectControlLinearizer::Run() {
     UpdateEffectPhi(pending_effect_phi.effect_phi, pending_effect_phi.block,
                     &block_effects);
   }
+
+  schedule_->rpo_order()->clear();
+}
+
+void EffectControlLinearizer::UpdateEffectControlForNode(Node* node) {
+  // If the node takes an effect, replace with the current one.
+  if (node->op()->EffectInputCount() > 0) {
+    DCHECK_EQ(1, node->op()->EffectInputCount());
+    NodeProperties::ReplaceEffectInput(node, gasm()->effect());
+  } else {
+    // New effect chain is only started with a Start or ValueEffect node.
+    DCHECK(node->op()->EffectOutputCount() == 0 ||
+           node->opcode() == IrOpcode::kStart);
+  }
+
+  // Rewire control inputs.
+  for (int i = 0; i < node->op()->ControlInputCount(); i++) {
+    NodeProperties::ReplaceControlInput(node, gasm()->control(), i);
+  }
 }
 
-void EffectControlLinearizer::ProcessNode(Node* node, Node** frame_state,
-                                          Node** effect, Node** control) {
+void EffectControlLinearizer::ProcessNode(Node* node, Node** frame_state) {
   SourcePositionTable::Scope scope(source_positions_,
                                    source_positions_->GetSourcePosition(node));
   NodeOriginTable::Scope origin_scope(node_origins_, "process node", node);
 
+  // If basic block is unreachable after this point, update the node's effect
+  // and control inputs to mark it as dead, but don't process further.
+  if (gasm()->effect() == jsgraph()->Dead()) {
+    UpdateEffectControlForNode(node);
+    return;
+  }
+
   // If the node needs to be wired into the effect/control chain, do this
   // here. Pass current frame state for lowering to eager deoptimization.
-  if (TryWireInStateEffect(node, *frame_state, effect, control)) {
+  if (TryWireInStateEffect(node, *frame_state)) {
     return;
   }
 
@@ -790,57 +828,24 @@ void EffectControlLinearizer::ProcessNode(Node* node, Node** frame_state,
   // start nodes are not handled in the ProcessNode method).
   DCHECK_NE(IrOpcode::kIfSuccess, node->opcode());
 
-  // If the node takes an effect, replace with the current one.
-  if (node->op()->EffectInputCount() > 0) {
-    DCHECK_EQ(1, node->op()->EffectInputCount());
-    Node* input_effect = NodeProperties::GetEffectInput(node);
-
-    if (input_effect != *effect) {
-      NodeProperties::ReplaceEffectInput(node, *effect);
-    }
-
-    // If the node produces an effect, update our current effect. (However,
-    // ignore new effect chains started with ValueEffect.)
-    if (node->op()->EffectOutputCount() > 0) {
-      DCHECK_EQ(1, node->op()->EffectOutputCount());
-      *effect = node;
-    }
-  } else {
-    // New effect chain is only started with a Start or ValueEffect node.
-    DCHECK(node->op()->EffectOutputCount() == 0 ||
-           node->opcode() == IrOpcode::kStart);
-  }
+  UpdateEffectControlForNode(node);
 
-  // Rewire control inputs.
-  for (int i = 0; i < node->op()->ControlInputCount(); i++) {
-    NodeProperties::ReplaceControlInput(node, *control, i);
-  }
-  // Update the current control.
-  if (node->op()->ControlOutputCount() > 0) {
-    *control = node;
-  }
+  gasm()->AddNode(node);
 
-  // Break the effect chain on {Unreachable} and reconnect to the graph end.
-  // Mark the following code for deletion by connecting to the {Dead} node.
   if (node->opcode() == IrOpcode::kUnreachable) {
-    ConnectUnreachableToEnd(*effect, *control);
-    *effect = *control = jsgraph()->Dead();
+    // Break the effect chain on {Unreachable} and reconnect to the graph end.
+    // Mark the following code for deletion by connecting to the {Dead} node.
+    gasm()->ConnectUnreachableToEnd();
   }
 }
 
 bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
-                                                   Node* frame_state,
-                                                   Node** effect,
-                                                   Node** control) {
-  gasm()->Reset(*effect, *control);
+                                                   Node* frame_state) {
   Node* result = nullptr;
   switch (node->opcode()) {
     case IrOpcode::kChangeBitToTagged:
       result = LowerChangeBitToTagged(node);
       break;
-    case IrOpcode::kChangeInt31ToCompressedSigned:
-      result = LowerChangeInt31ToCompressedSigned(node);
-      break;
     case IrOpcode::kChangeInt31ToTaggedSigned:
       result = LowerChangeInt31ToTaggedSigned(node);
       break;
@@ -862,9 +867,6 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kChangeFloat64ToTaggedPointer:
       result = LowerChangeFloat64ToTaggedPointer(node);
       break;
-    case IrOpcode::kChangeCompressedSignedToInt32:
-      result = LowerChangeCompressedSignedToInt32(node);
-      break;
     case IrOpcode::kChangeTaggedSignedToInt32:
       result = LowerChangeTaggedSignedToInt32(node);
       break;
@@ -889,12 +891,6 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kChangeTaggedToTaggedSigned:
       result = LowerChangeTaggedToTaggedSigned(node);
       break;
-    case IrOpcode::kChangeCompressedToTaggedSigned:
-      result = LowerChangeCompressedToTaggedSigned(node);
-      break;
-    case IrOpcode::kChangeTaggedToCompressedSigned:
-      result = LowerChangeTaggedToCompressedSigned(node);
-      break;
     case IrOpcode::kTruncateTaggedToBit:
       result = LowerTruncateTaggedToBit(node);
       break;
@@ -958,9 +954,6 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kCheckedInt32Mul:
       result = LowerCheckedInt32Mul(node, frame_state);
       break;
-    case IrOpcode::kCheckedInt32ToCompressedSigned:
-      result = LowerCheckedInt32ToCompressedSigned(node, frame_state);
-      break;
     case IrOpcode::kCheckedInt32ToTaggedSigned:
       result = LowerCheckedInt32ToTaggedSigned(node, frame_state);
       break;
@@ -1001,6 +994,9 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
       }
       result = LowerCheckedTaggedSignedToInt32(node, frame_state);
       break;
+    case IrOpcode::kCheckedTaggedToArrayIndex:
+      result = LowerCheckedTaggedToArrayIndex(node, frame_state);
+      break;
     case IrOpcode::kCheckedTaggedToInt32:
       result = LowerCheckedTaggedToInt32(node, frame_state);
       break;
@@ -1025,18 +1021,6 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kTruncateBigIntToUint64:
       result = LowerTruncateBigIntToUint64(node);
       break;
-    case IrOpcode::kCheckedCompressedToTaggedSigned:
-      result = LowerCheckedCompressedToTaggedSigned(node, frame_state);
-      break;
-    case IrOpcode::kCheckedCompressedToTaggedPointer:
-      result = LowerCheckedCompressedToTaggedPointer(node, frame_state);
-      break;
-    case IrOpcode::kCheckedTaggedToCompressedSigned:
-      result = LowerCheckedTaggedToCompressedSigned(node, frame_state);
-      break;
-    case IrOpcode::kCheckedTaggedToCompressedPointer:
-      result = LowerCheckedTaggedToCompressedPointer(node, frame_state);
-      break;
     case IrOpcode::kTruncateTaggedToWord32:
       result = LowerTruncateTaggedToWord32(node);
       break;
@@ -1178,6 +1162,9 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kBigIntAdd:
       result = LowerBigIntAdd(node, frame_state);
       break;
+    case IrOpcode::kBigIntSubtract:
+      result = LowerBigIntSubtract(node, frame_state);
+      break;
     case IrOpcode::kBigIntNegate:
       result = LowerBigIntNegate(node);
       break;
@@ -1323,19 +1310,11 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
         node->op()->mnemonic());
   }
 
-  *effect = gasm()->ExtractCurrentEffect();
-  *control = gasm()->ExtractCurrentControl();
-  NodeProperties::ReplaceUses(node, result, *effect, *control);
+  NodeProperties::ReplaceUses(node, result, gasm()->effect(),
+                              gasm()->control());
   return true;
 }
 
-void EffectControlLinearizer::ConnectUnreachableToEnd(Node* effect,
-                                                      Node* control) {
-  DCHECK_EQ(effect->opcode(), IrOpcode::kUnreachable);
-  Node* throw_node = graph()->NewNode(common()->Throw(), effect, control);
-  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
-}
-
 #define __ gasm()->
 
 Node* EffectControlLinearizer::LowerChangeFloat64ToTagged(Node* node) {
@@ -1376,13 +1355,7 @@ Node* EffectControlLinearizer::LowerChangeFloat64ToTagged(Node* node) {
       Node* value_smi = ChangeInt32ToSmi(value32);
       __ Goto(&done, value_smi);
     } else {
-      DCHECK(SmiValuesAre31Bits());
-      Node* add = __ Int32AddWithOverflow(value32, value32);
-      Node* ovf = __ Projection(1, add);
-      __ GotoIf(ovf, &if_heapnumber);
-      Node* value_smi = __ Projection(0, add);
-      value_smi = ChangeInt32ToIntPtr(value_smi);
-      __ Goto(&done, value_smi);
+      SmiTagOrOverflow(value32, &if_heapnumber, &done);
     }
   }
 
@@ -1417,11 +1390,6 @@ Node* EffectControlLinearizer::LowerChangeBitToTagged(Node* node) {
   return done.PhiAt(0);
 }
 
-Node* EffectControlLinearizer::LowerChangeInt31ToCompressedSigned(Node* node) {
-  Node* value = node->InputAt(0);
-  return ChangeInt32ToCompressedSmi(value);
-}
-
 Node* EffectControlLinearizer::LowerChangeInt31ToTaggedSigned(Node* node) {
   Node* value = node->InputAt(0);
   return ChangeInt32ToSmi(value);
@@ -1438,12 +1406,7 @@ Node* EffectControlLinearizer::LowerChangeInt32ToTagged(Node* node) {
   auto if_overflow = __ MakeDeferredLabel();
   auto done = __ MakeLabel(MachineRepresentation::kTagged);
 
-  Node* add = __ Int32AddWithOverflow(value, value);
-  Node* ovf = __ Projection(1, add);
-  __ GotoIf(ovf, &if_overflow);
-  Node* value_smi = __ Projection(0, add);
-  value_smi = ChangeInt32ToIntPtr(value_smi);
-  __ Goto(&done, value_smi);
+  SmiTagOrOverflow(value, &if_overflow, &done);
 
   __ Bind(&if_overflow);
   Node* number = AllocateHeapNumberWithValue(__ ChangeInt32ToFloat64(value));
@@ -1467,11 +1430,7 @@ Node* EffectControlLinearizer::LowerChangeInt64ToTagged(Node* node) {
     Node* value_smi = ChangeInt64ToSmi(value);
     __ Goto(&done, value_smi);
   } else {
-    Node* add = __ Int32AddWithOverflow(value32, value32);
-    Node* ovf = __ Projection(1, add);
-    __ GotoIf(ovf, &if_not_in_smi_range);
-    Node* value_smi = ChangeInt32ToIntPtr(__ Projection(0, add));
-    __ Goto(&done, value_smi);
+    SmiTagOrOverflow(value32, &if_not_in_smi_range, &done);
   }
 
   __ Bind(&if_not_in_smi_range);
@@ -1526,11 +1485,6 @@ Node* EffectControlLinearizer::LowerChangeTaggedSignedToInt32(Node* node) {
   return ChangeSmiToInt32(value);
 }
 
-Node* EffectControlLinearizer::LowerChangeCompressedSignedToInt32(Node* node) {
-  Node* value = node->InputAt(0);
-  return ChangeCompressedSmiToInt32(value);
-}
-
 Node* EffectControlLinearizer::LowerChangeTaggedSignedToInt64(Node* node) {
   Node* value = node->InputAt(0);
   return ChangeSmiToInt64(value);
@@ -1567,7 +1521,7 @@ void EffectControlLinearizer::TruncateTaggedPointerToBit(
   __ GotoIfNot(
       __ Word32Equal(
           __ Word32And(value_map_bitfield,
-                       __ Int32Constant(Map::IsUndetectableBit::kMask)),
+                       __ Int32Constant(Map::Bits1::IsUndetectableBit::kMask)),
           zero),
       done, zero);
 
@@ -1718,49 +1672,6 @@ Node* EffectControlLinearizer::LowerChangeTaggedToTaggedSigned(Node* node) {
   return done.PhiAt(0);
 }
 
-Node* EffectControlLinearizer::LowerChangeCompressedToTaggedSigned(Node* node) {
-  Node* value = node->InputAt(0);
-
-  auto if_not_smi = __ MakeDeferredLabel();
-  auto done = __ MakeLabel(MachineRepresentation::kWord32);
-
-  Node* check = CompressedObjectIsSmi(value);
-  __ GotoIfNot(check, &if_not_smi);
-  __ Goto(&done, __ ChangeCompressedSignedToTaggedSigned(value));
-
-  __ Bind(&if_not_smi);
-  STATIC_ASSERT(HeapNumber::kValueOffset == Oddball::kToNumberRawOffset);
-  Node* vfalse = __ LoadField(AccessBuilder::ForHeapNumberValue(),
-                              __ ChangeCompressedToTagged(value));
-  vfalse = __ ChangeFloat64ToInt32(vfalse);
-  vfalse = ChangeInt32ToSmi(vfalse);
-  __ Goto(&done, vfalse);
-
-  __ Bind(&done);
-  return done.PhiAt(0);
-}
-
-Node* EffectControlLinearizer::LowerChangeTaggedToCompressedSigned(Node* node) {
-  Node* value = node->InputAt(0);
-
-  auto if_not_smi = __ MakeDeferredLabel();
-  auto done = __ MakeLabel(MachineRepresentation::kWord32);
-
-  Node* check = ObjectIsSmi(value);
-  __ GotoIfNot(check, &if_not_smi);
-  __ Goto(&done, __ ChangeTaggedSignedToCompressedSigned(value));
-
-  __ Bind(&if_not_smi);
-  STATIC_ASSERT(HeapNumber::kValueOffset == Oddball::kToNumberRawOffset);
-  Node* vfalse = __ LoadField(AccessBuilder::ForHeapNumberValue(), value);
-  vfalse = __ ChangeFloat64ToInt32(vfalse);
-  vfalse = ChangeInt32ToCompressedSmi(vfalse);
-  __ Goto(&done, vfalse);
-
-  __ Bind(&done);
-  return done.PhiAt(0);
-}
-
 Node* EffectControlLinearizer::LowerTruncateTaggedToFloat64(Node* node) {
   Node* value = node->InputAt(0);
 
@@ -1810,10 +1721,10 @@ void EffectControlLinearizer::LowerCheckMaps(Node* node, Node* frame_state) {
       Node* map = __ HeapConstant(maps[i]);
       Node* check = __ TaggedEqual(value_map, map);
       if (i == map_count - 1) {
-        __ Branch(check, &done, &migrate, IsSafetyCheck::kCriticalSafetyCheck);
+        __ BranchWithCriticalSafetyCheck(check, &done, &migrate);
       } else {
         auto next_map = __ MakeLabel();
-        __ Branch(check, &done, &next_map, IsSafetyCheck::kCriticalSafetyCheck);
+        __ BranchWithCriticalSafetyCheck(check, &done, &next_map);
         __ Bind(&next_map);
       }
     }
@@ -1826,7 +1737,7 @@ void EffectControlLinearizer::LowerCheckMaps(Node* node, Node* frame_state) {
           __ LoadField(AccessBuilder::ForMapBitField3(), value_map);
       Node* if_not_deprecated = __ Word32Equal(
           __ Word32And(bitfield3,
-                       __ Int32Constant(Map::IsDeprecatedBit::kMask)),
+                       __ Int32Constant(Map::Bits3::IsDeprecatedBit::kMask)),
           __ Int32Constant(0));
       __ DeoptimizeIf(DeoptimizeReason::kWrongMap, p.feedback(),
                       if_not_deprecated, frame_state,
@@ -1856,7 +1767,7 @@ void EffectControlLinearizer::LowerCheckMaps(Node* node, Node* frame_state) {
                            frame_state, IsSafetyCheck::kCriticalSafetyCheck);
       } else {
         auto next_map = __ MakeLabel();
-        __ Branch(check, &done, &next_map, IsSafetyCheck::kCriticalSafetyCheck);
+        __ BranchWithCriticalSafetyCheck(check, &done, &next_map);
         __ Bind(&next_map);
       }
     }
@@ -1878,7 +1789,7 @@ void EffectControlLinearizer::LowerCheckMaps(Node* node, Node* frame_state) {
                            frame_state, IsSafetyCheck::kCriticalSafetyCheck);
       } else {
         auto next_map = __ MakeLabel();
-        __ Branch(check, &done, &next_map, IsSafetyCheck::kCriticalSafetyCheck);
+        __ BranchWithCriticalSafetyCheck(check, &done, &next_map);
         __ Bind(&next_map);
       }
     }
@@ -1903,7 +1814,7 @@ Node* EffectControlLinearizer::LowerCompareMaps(Node* node) {
 
     auto next_map = __ MakeLabel();
     auto passed = __ MakeLabel();
-    __ Branch(check, &passed, &next_map, IsSafetyCheck::kCriticalSafetyCheck);
+    __ BranchWithCriticalSafetyCheck(check, &passed, &next_map);
 
     __ Bind(&passed);
     __ Goto(&done, __ Int32Constant(1));
@@ -2085,7 +1996,7 @@ Node* EffectControlLinearizer::LowerCheckedInt32Div(Node* node,
     // right shift on {lhs}).
     int32_t divisor = m.Value();
     Node* mask = __ Int32Constant(divisor - 1);
-    Node* shift = __ Int32Constant(WhichPowerOf2(divisor));
+    Node* shift = __ Int32Constant(base::bits::WhichPowerOfTwo(divisor));
     Node* check = __ Word32Equal(__ Word32And(lhs, mask), zero);
     __ DeoptimizeIfNot(DeoptimizeReason::kLostPrecision, FeedbackSource(),
                        check, frame_state);
@@ -2155,6 +2066,35 @@ Node* EffectControlLinearizer::LowerCheckedInt32Div(Node* node,
   }
 }
 
+template <size_t VarCount, size_t VarCount2>
+void EffectControlLinearizer::SmiTagOrOverflow(
+    Node* value, GraphAssemblerLabel<VarCount>* if_overflow,
+    GraphAssemblerLabel<VarCount2>* done) {
+  DCHECK(SmiValuesAre31Bits());
+  // Check for overflow at the same time that we are smi tagging.
+  // Since smi tagging shifts left by one, it's the same as adding value twice.
+  Node* add = __ Int32AddWithOverflow(value, value);
+  Node* ovf = __ Projection(1, add);
+  __ GotoIf(ovf, if_overflow);
+  Node* value_smi = __ Projection(0, add);
+  value_smi = ChangeTaggedInt32ToSmi(value_smi);
+  __ Goto(done, value_smi);
+}
+
+Node* EffectControlLinearizer::SmiTagOrDeopt(Node* value,
+                                             const CheckParameters& params,
+                                             Node* frame_state) {
+  DCHECK(SmiValuesAre31Bits());
+  // Check for the lost precision at the same time that we are smi tagging.
+  // Since smi tagging shifts left by one, it's the same as adding value twice.
+  Node* add = __ Int32AddWithOverflow(value, value);
+  Node* check = __ Projection(1, add);
+  __ DeoptimizeIf(DeoptimizeReason::kLostPrecision, params.feedback(), check,
+                  frame_state);
+  Node* result = __ Projection(0, add);
+  return ChangeTaggedInt32ToSmi(result);
+}
+
 Node* EffectControlLinearizer::BuildUint32Mod(Node* lhs, Node* rhs) {
   auto if_rhs_power_of_two = __ MakeLabel();
   auto done = __ MakeLabel(MachineRepresentation::kWord32);
@@ -2278,7 +2218,7 @@ Node* EffectControlLinearizer::LowerCheckedUint32Div(Node* node,
     // shift on {lhs}).
     uint32_t divisor = m.Value();
     Node* mask = __ Uint32Constant(divisor - 1);
-    Node* shift = __ Uint32Constant(WhichPowerOf2(divisor));
+    Node* shift = __ Uint32Constant(base::bits::WhichPowerOfTwo(divisor));
     Node* check = __ Word32Equal(__ Word32And(lhs, mask), zero);
     __ DeoptimizeIfNot(DeoptimizeReason::kLostPrecision, FeedbackSource(),
                        check, frame_state);
@@ -2350,32 +2290,12 @@ Node* EffectControlLinearizer::LowerCheckedInt32Mul(Node* node,
   return value;
 }
 
-Node* EffectControlLinearizer::LowerCheckedInt32ToCompressedSigned(
-    Node* node, Node* frame_state) {
-  DCHECK(SmiValuesAre31Bits());
-  Node* value = node->InputAt(0);
-  const CheckParameters& params = CheckParametersOf(node->op());
-
-  Node* add = __ Int32AddWithOverflow(value, value);
-  Node* check = __ Projection(1, add);
-  __ DeoptimizeIf(DeoptimizeReason::kLostPrecision, params.feedback(), check,
-                  frame_state);
-  return __ Projection(0, add);
-}
-
 Node* EffectControlLinearizer::LowerCheckedInt32ToTaggedSigned(
     Node* node, Node* frame_state) {
   DCHECK(SmiValuesAre31Bits());
   Node* value = node->InputAt(0);
   const CheckParameters& params = CheckParametersOf(node->op());
-
-  Node* add = __ Int32AddWithOverflow(value, value);
-  Node* check = __ Projection(1, add);
-  __ DeoptimizeIf(DeoptimizeReason::kLostPrecision, params.feedback(), check,
-                  frame_state);
-  Node* result = __ Projection(0, add);
-  result = ChangeInt32ToIntPtr(result);
-  return result;
+  return SmiTagOrDeopt(value, params, frame_state);
 }
 
 Node* EffectControlLinearizer::LowerCheckedInt64ToInt32(Node* node,
@@ -2403,13 +2323,7 @@ Node* EffectControlLinearizer::LowerCheckedInt64ToTaggedSigned(
   if (SmiValuesAre32Bits()) {
     return ChangeInt64ToSmi(value);
   } else {
-    Node* add = __ Int32AddWithOverflow(value32, value32);
-    Node* check = __ Projection(1, add);
-    __ DeoptimizeIf(DeoptimizeReason::kLostPrecision, params.feedback(), check,
-                    frame_state);
-    Node* result = __ Projection(0, add);
-    result = ChangeInt32ToIntPtr(result);
-    return result;
+    return SmiTagOrDeopt(value32, params, frame_state);
   }
 }
 
@@ -2529,6 +2443,31 @@ Node* EffectControlLinearizer::BuildCheckedFloat64ToInt32(
   return value32;
 }
 
+Node* EffectControlLinearizer::BuildCheckedFloat64ToIndex(
+    const FeedbackSource& feedback, Node* value, Node* frame_state) {
+  if (machine()->Is64()) {
+    Node* value64 = __ TruncateFloat64ToInt64(value);
+    Node* check_same = __ Float64Equal(value, __ ChangeInt64ToFloat64(value64));
+    __ DeoptimizeIfNot(DeoptimizeReason::kLostPrecisionOrNaN, feedback,
+                       check_same, frame_state);
+    Node* check_max =
+        __ IntLessThan(value64, __ Int64Constant(kMaxSafeInteger));
+    __ DeoptimizeIfNot(DeoptimizeReason::kNotAnArrayIndex, feedback, check_max,
+                       frame_state);
+    Node* check_min =
+        __ IntLessThan(__ Int64Constant(-kMaxSafeInteger), value64);
+    __ DeoptimizeIfNot(DeoptimizeReason::kNotAnArrayIndex, feedback, check_min,
+                       frame_state);
+    return value64;
+  } else {
+    Node* value32 = __ RoundFloat64ToInt32(value);
+    Node* check_same = __ Float64Equal(value, __ ChangeInt32ToFloat64(value32));
+    __ DeoptimizeIfNot(DeoptimizeReason::kLostPrecisionOrNaN, feedback,
+                       check_same, frame_state);
+    return value32;
+  }
+}
+
 Node* EffectControlLinearizer::LowerCheckedFloat64ToInt32(Node* node,
                                                           Node* frame_state) {
   const CheckMinusZeroParameters& params =
@@ -2587,6 +2526,58 @@ Node* EffectControlLinearizer::LowerCheckedTaggedSignedToInt32(
   return ChangeSmiToInt32(value);
 }
 
+Node* EffectControlLinearizer::LowerCheckedTaggedToArrayIndex(
+    Node* node, Node* frame_state) {
+  CheckParameters const& params = CheckParametersOf(node->op());
+  Node* value = node->InputAt(0);
+
+  auto if_not_smi = __ MakeDeferredLabel();
+  auto done = __ MakeLabel(MachineType::PointerRepresentation());
+
+  __ GotoIfNot(ObjectIsSmi(value), &if_not_smi);
+  // In the Smi case, just convert to intptr_t.
+  __ Goto(&done, ChangeSmiToIntPtr(value));
+
+  // In the non-Smi case, check the heap numberness, load the number and convert
+  // to integer.
+  __ Bind(&if_not_smi);
+  auto if_not_heap_number = __ MakeDeferredLabel();
+  Node* value_map = __ LoadField(AccessBuilder::ForMap(), value);
+  Node* is_heap_number = __ TaggedEqual(value_map, __ HeapNumberMapConstant());
+  __ GotoIfNot(is_heap_number, &if_not_heap_number);
+
+  Node* number = __ LoadField(AccessBuilder::ForHeapNumberValue(), value);
+  number = BuildCheckedFloat64ToIndex(params.feedback(), number, frame_state);
+  __ Goto(&done, number);
+
+  __ Bind(&if_not_heap_number);
+  auto calculate_index = __ MakeDeferredLabel();
+  Node* value_instance_type =
+      __ LoadField(AccessBuilder::ForMapInstanceType(), value_map);
+  Node* is_string = __ Uint32LessThan(value_instance_type,
+                                      __ Uint32Constant(FIRST_NONSTRING_TYPE));
+  __ DeoptimizeIfNot(DeoptimizeReason::kNotAString, params.feedback(),
+                     is_string, frame_state);
+
+  MachineSignature::Builder builder(graph()->zone(), 1, 1);
+  builder.AddReturn(MachineType::IntPtr());
+  builder.AddParam(MachineType::TaggedPointer());
+  Node* string_to_array_index_function =
+      __ ExternalConstant(ExternalReference::string_to_array_index_function());
+  auto call_descriptor =
+      Linkage::GetSimplifiedCDescriptor(graph()->zone(), builder.Build());
+  Node* index = __ Call(common()->Call(call_descriptor),
+                        string_to_array_index_function, value);
+
+  __ DeoptimizeIf(DeoptimizeReason::kNotAnArrayIndex, params.feedback(),
+                  __ Word32Equal(index, __ Int32Constant(-1)), frame_state);
+
+  __ Goto(&done, index);
+
+  __ Bind(&done);
+  return done.PhiAt(0);
+}
+
 Node* EffectControlLinearizer::LowerCheckedTaggedToInt32(Node* node,
                                                          Node* frame_state) {
   const CheckMinusZeroParameters& params =
@@ -2595,7 +2586,6 @@ Node* EffectControlLinearizer::LowerCheckedTaggedToInt32(Node* node,
 
   auto if_not_smi = __ MakeDeferredLabel();
   auto done = __ MakeLabel(MachineRepresentation::kWord32);
-
   Node* check = ObjectIsSmi(value);
   __ GotoIfNot(check, &if_not_smi);
   // In the Smi case, just convert to int32.
@@ -2846,52 +2836,6 @@ Node* EffectControlLinearizer::LowerTruncateBigIntToUint64(Node* node) {
   return done.PhiAt(0);
 }
 
-Node* EffectControlLinearizer::LowerCheckedCompressedToTaggedSigned(
-    Node* node, Node* frame_state) {
-  Node* value = node->InputAt(0);
-  const CheckParameters& params = CheckParametersOf(node->op());
-
-  Node* check = CompressedObjectIsSmi(value);
-  __ DeoptimizeIfNot(DeoptimizeReason::kNotASmi, params.feedback(), check,
-                     frame_state);
-
-  return __ ChangeCompressedSignedToTaggedSigned(value);
-}
-
-Node* EffectControlLinearizer::LowerCheckedCompressedToTaggedPointer(
-    Node* node, Node* frame_state) {
-  Node* value = node->InputAt(0);
-  const CheckParameters& params = CheckParametersOf(node->op());
-
-  Node* check = CompressedObjectIsSmi(value);
-  __ DeoptimizeIf(DeoptimizeReason::kSmi, params.feedback(), check,
-                  frame_state);
-  return __ ChangeCompressedPointerToTaggedPointer(value);
-}
-
-Node* EffectControlLinearizer::LowerCheckedTaggedToCompressedSigned(
-    Node* node, Node* frame_state) {
-  Node* value = node->InputAt(0);
-  const CheckParameters& params = CheckParametersOf(node->op());
-
-  Node* check = ObjectIsSmi(value);
-  __ DeoptimizeIfNot(DeoptimizeReason::kNotASmi, params.feedback(), check,
-                     frame_state);
-
-  return __ ChangeTaggedSignedToCompressedSigned(value);
-}
-
-Node* EffectControlLinearizer::LowerCheckedTaggedToCompressedPointer(
-    Node* node, Node* frame_state) {
-  Node* value = node->InputAt(0);
-  const CheckParameters& params = CheckParametersOf(node->op());
-
-  Node* check = ObjectIsSmi(value);
-  __ DeoptimizeIf(DeoptimizeReason::kSmi, params.feedback(), check,
-                  frame_state);
-  return __ ChangeTaggedPointerToCompressedPointer(value);
-}
-
 Node* EffectControlLinearizer::LowerTruncateTaggedToWord32(Node* node) {
   Node* value = node->InputAt(0);
 
@@ -3017,10 +2961,10 @@ Node* EffectControlLinearizer::LowerObjectIsCallable(Node* node) {
   Node* value_map = __ LoadField(AccessBuilder::ForMap(), value);
   Node* value_bit_field =
       __ LoadField(AccessBuilder::ForMapBitField(), value_map);
-  Node* vfalse =
-      __ Word32Equal(__ Int32Constant(Map::IsCallableBit::kMask),
-                     __ Word32And(value_bit_field,
-                                  __ Int32Constant(Map::IsCallableBit::kMask)));
+  Node* vfalse = __ Word32Equal(
+      __ Int32Constant(Map::Bits1::IsCallableBit::kMask),
+      __ Word32And(value_bit_field,
+                   __ Int32Constant(Map::Bits1::IsCallableBit::kMask)));
   __ Goto(&done, vfalse);
 
   __ Bind(&if_smi);
@@ -3043,9 +2987,9 @@ Node* EffectControlLinearizer::LowerObjectIsConstructor(Node* node) {
   Node* value_bit_field =
       __ LoadField(AccessBuilder::ForMapBitField(), value_map);
   Node* vfalse = __ Word32Equal(
-      __ Int32Constant(Map::IsConstructorBit::kMask),
+      __ Int32Constant(Map::Bits1::IsConstructorBit::kMask),
       __ Word32And(value_bit_field,
-                   __ Int32Constant(Map::IsConstructorBit::kMask)));
+                   __ Int32Constant(Map::Bits1::IsConstructorBit::kMask)));
   __ Goto(&done, vfalse);
 
   __ Bind(&if_smi);
@@ -3068,10 +3012,10 @@ Node* EffectControlLinearizer::LowerObjectIsDetectableCallable(Node* node) {
   Node* value_bit_field =
       __ LoadField(AccessBuilder::ForMapBitField(), value_map);
   Node* vfalse = __ Word32Equal(
-      __ Int32Constant(Map::IsCallableBit::kMask),
+      __ Int32Constant(Map::Bits1::IsCallableBit::kMask),
       __ Word32And(value_bit_field,
-                   __ Int32Constant((Map::IsCallableBit::kMask) |
-                                    (Map::IsUndetectableBit::kMask))));
+                   __ Int32Constant((Map::Bits1::IsCallableBit::kMask) |
+                                    (Map::Bits1::IsUndetectableBit::kMask))));
   __ Goto(&done, vfalse);
 
   __ Bind(&if_smi);
@@ -3315,10 +3259,10 @@ Node* EffectControlLinearizer::LowerObjectIsNonCallable(Node* node) {
 
   Node* value_bit_field =
       __ LoadField(AccessBuilder::ForMapBitField(), value_map);
-  Node* check2 =
-      __ Word32Equal(__ Int32Constant(0),
-                     __ Word32And(value_bit_field,
-                                  __ Int32Constant(Map::IsCallableBit::kMask)));
+  Node* check2 = __ Word32Equal(
+      __ Int32Constant(0),
+      __ Word32And(value_bit_field,
+                   __ Int32Constant(Map::Bits1::IsCallableBit::kMask)));
   __ Goto(&done, check2);
 
   __ Bind(&if_primitive);
@@ -3433,7 +3377,7 @@ Node* EffectControlLinearizer::LowerObjectIsUndetectable(Node* node) {
       __ Word32Equal(
           __ Int32Constant(0),
           __ Word32And(value_bit_field,
-                       __ Int32Constant(Map::IsUndetectableBit::kMask))),
+                       __ Int32Constant(Map::Bits1::IsUndetectableBit::kMask))),
       __ Int32Constant(0));
   __ Goto(&done, vfalse);
 
@@ -3489,12 +3433,12 @@ Node* EffectControlLinearizer::LowerArgumentsLength(Node* node) {
 
     __ Bind(&if_adaptor_frame);
     Node* arguments_length = __ Load(
-        MachineType::TypeCompressedTaggedSigned(), arguments_frame,
+        MachineType::TaggedSigned(), arguments_frame,
         __ IntPtrConstant(ArgumentsAdaptorFrameConstants::kLengthOffset));
 
     Node* rest_length =
-        __ IntSub(arguments_length, __ SmiConstant(formal_parameter_count));
-    __ GotoIf(__ IntLessThan(rest_length, __ SmiConstant(0)), &done,
+        __ SmiSub(arguments_length, __ SmiConstant(formal_parameter_count));
+    __ GotoIf(__ SmiLessThan(rest_length, __ SmiConstant(0)), &done,
               __ SmiConstant(0));
     __ Goto(&done, rest_length);
 
@@ -3514,7 +3458,7 @@ Node* EffectControlLinearizer::LowerArgumentsLength(Node* node) {
 
     __ Bind(&if_adaptor_frame);
     Node* arguments_length = __ Load(
-        MachineType::TypeCompressedTaggedSigned(), arguments_frame,
+        MachineType::TaggedSigned(), arguments_frame,
         __ IntPtrConstant(ArgumentsAdaptorFrameConstants::kLengthOffset));
     __ Goto(&done, arguments_length);
 
@@ -3623,9 +3567,9 @@ Node* EffectControlLinearizer::LowerNewSmiOrObjectElements(Node* node) {
     __ GotoIfNot(check, &done, result);
 
     // Storing "the_hole" doesn't need a write barrier.
-    ElementAccess const access = {
-        kTaggedBase, FixedArray::kHeaderSize, Type::Any(),
-        MachineType::TypeCompressedTagged(), kNoWriteBarrier};
+    ElementAccess const access = {kTaggedBase, FixedArray::kHeaderSize,
+                                  Type::Any(), MachineType::AnyTagged(),
+                                  kNoWriteBarrier};
     __ StoreElement(access, result, index, the_hole);
 
     // Advance the {index}.
@@ -4306,6 +4250,27 @@ Node* EffectControlLinearizer::LowerBigIntAdd(Node* node, Node* frame_state) {
   return value;
 }
 
+Node* EffectControlLinearizer::LowerBigIntSubtract(Node* node,
+                                                   Node* frame_state) {
+  Node* lhs = node->InputAt(0);
+  Node* rhs = node->InputAt(1);
+
+  Callable const callable =
+      Builtins::CallableFor(isolate(), Builtins::kBigIntSubtractNoThrow);
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
+      graph()->zone(), callable.descriptor(),
+      callable.descriptor().GetStackParameterCount(), CallDescriptor::kNoFlags,
+      Operator::kFoldable | Operator::kNoThrow);
+  Node* value = __ Call(call_descriptor, __ HeapConstant(callable.code()), lhs,
+                        rhs, __ NoContextConstant());
+
+  // Check for exception sentinel: Smi is returned to signal BigIntTooBig.
+  __ DeoptimizeIf(DeoptimizeReason::kBigIntTooBig, FeedbackSource{},
+                  ObjectIsSmi(value), frame_state);
+
+  return value;
+}
+
 Node* EffectControlLinearizer::LowerBigIntNegate(Node* node) {
   Callable const callable =
       Builtins::CallableFor(isolate(), Builtins::kBigIntUnaryMinus);
@@ -4472,12 +4437,19 @@ Node* EffectControlLinearizer::AllocateHeapNumberWithValue(Node* value) {
 Node* EffectControlLinearizer::ChangeIntPtrToSmi(Node* value) {
   // Do shift on 32bit values if Smis are stored in the lower word.
   if (machine()->Is64() && SmiValuesAre31Bits()) {
-    return __ ChangeInt32ToInt64(
-        __ Word32Shl(__ TruncateInt64ToInt32(value), SmiShiftBitsConstant()));
+    return ChangeTaggedInt32ToSmi(__ Word32Shl(value, SmiShiftBitsConstant()));
   }
   return __ WordShl(value, SmiShiftBitsConstant());
 }
 
+Node* EffectControlLinearizer::ChangeTaggedInt32ToSmi(Node* value) {
+  DCHECK(SmiValuesAre31Bits());
+  // In pointer compression, we smi-corrupt. Then, the upper bits are not
+  // important.
+  return COMPRESS_POINTERS_BOOL ? __ BitcastWord32ToWord64(value)
+                                : ChangeInt32ToIntPtr(value);
+}
+
 Node* EffectControlLinearizer::ChangeInt32ToIntPtr(Node* value) {
   if (machine()->Is64()) {
     value = __ ChangeInt32ToInt64(value);
@@ -4492,15 +4464,10 @@ Node* EffectControlLinearizer::ChangeIntPtrToInt32(Node* value) {
   return value;
 }
 
-Node* EffectControlLinearizer::ChangeInt32ToCompressedSmi(Node* value) {
-  CHECK(machine()->Is64() && SmiValuesAre31Bits());
-  return __ Word32Shl(value, SmiShiftBitsConstant());
-}
-
 Node* EffectControlLinearizer::ChangeInt32ToSmi(Node* value) {
   // Do shift on 32bit values if Smis are stored in the lower word.
   if (machine()->Is64() && SmiValuesAre31Bits()) {
-    return __ ChangeInt32ToInt64(__ Word32Shl(value, SmiShiftBitsConstant()));
+    return ChangeIntPtrToSmi(value);
   }
   return ChangeIntPtrToSmi(ChangeInt32ToIntPtr(value));
 }
@@ -4520,7 +4487,11 @@ Node* EffectControlLinearizer::ChangeUint32ToUintPtr(Node* value) {
 Node* EffectControlLinearizer::ChangeUint32ToSmi(Node* value) {
   // Do shift on 32bit values if Smis are stored in the lower word.
   if (machine()->Is64() && SmiValuesAre31Bits()) {
-    return __ ChangeUint32ToUint64(__ Word32Shl(value, SmiShiftBitsConstant()));
+    Node* smi_value = __ Word32Shl(value, SmiShiftBitsConstant());
+    // In pointer compression, we smi-corrupt. Then, the upper bits are not
+    // important.
+    return COMPRESS_POINTERS_BOOL ? __ BitcastWord32ToWord64(smi_value)
+                                  : __ ChangeUint32ToUint64(smi_value);
   } else {
     return __ WordShl(ChangeUint32ToUintPtr(value), SmiShiftBitsConstant());
   }
@@ -4546,22 +4517,12 @@ Node* EffectControlLinearizer::ChangeSmiToInt32(Node* value) {
   return ChangeSmiToIntPtr(value);
 }
 
-Node* EffectControlLinearizer::ChangeCompressedSmiToInt32(Node* value) {
-  CHECK(machine()->Is64() && SmiValuesAre31Bits());
-  return __ Word32Sar(value, SmiShiftBitsConstant());
-}
-
 Node* EffectControlLinearizer::ChangeSmiToInt64(Node* value) {
   CHECK(machine()->Is64());
   return ChangeSmiToIntPtr(value);
 }
 
 Node* EffectControlLinearizer::ObjectIsSmi(Node* value) {
-  return __ IntPtrEqual(__ WordAnd(value, __ IntPtrConstant(kSmiTagMask)),
-                        __ IntPtrConstant(kSmiTag));
-}
-
-Node* EffectControlLinearizer::CompressedObjectIsSmi(Node* value) {
   return __ Word32Equal(__ Word32And(value, __ Int32Constant(kSmiTagMask)),
                         __ Int32Constant(kSmiTag));
 }
@@ -4579,7 +4540,7 @@ Node* EffectControlLinearizer::SmiShiftBitsConstant() {
 
 Node* EffectControlLinearizer::LowerPlainPrimitiveToNumber(Node* node) {
   Node* value = node->InputAt(0);
-  return __ ToNumber(value);
+  return __ PlainPrimitiveToNumber(TNode<Object>::UncheckedCast(value));
 }
 
 Node* EffectControlLinearizer::LowerPlainPrimitiveToWord32(Node* node) {
@@ -4594,7 +4555,8 @@ Node* EffectControlLinearizer::LowerPlainPrimitiveToWord32(Node* node) {
   __ Goto(&done, ChangeSmiToInt32(value));
 
   __ Bind(&if_not_smi);
-  Node* to_number = __ ToNumber(value);
+  Node* to_number =
+      __ PlainPrimitiveToNumber(TNode<Object>::UncheckedCast(value));
 
   Node* check1 = ObjectIsSmi(to_number);
   __ GotoIf(check1, &if_to_number_smi);
@@ -4621,7 +4583,8 @@ Node* EffectControlLinearizer::LowerPlainPrimitiveToFloat64(Node* node) {
   __ Goto(&done, __ ChangeInt32ToFloat64(from_smi));
 
   __ Bind(&if_not_smi);
-  Node* to_number = __ ToNumber(value);
+  Node* to_number =
+      __ PlainPrimitiveToNumber(TNode<Object>::UncheckedCast(value));
   Node* check1 = ObjectIsSmi(to_number);
   __ GotoIf(check1, &if_to_number_smi);
 
@@ -4796,8 +4759,7 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
       Node* offset =
           __ IntAdd(__ WordShl(index, __ IntPtrConstant(kTaggedSizeLog2 - 1)),
                     __ IntPtrConstant(JSObject::kHeaderSize - kHeapObjectTag));
-      Node* result =
-          __ Load(MachineType::TypeCompressedTagged(), object, offset);
+      Node* result = __ Load(MachineType::AnyTagged(), object, offset);
       __ Goto(&done, result);
     }
 
@@ -4812,8 +4774,7 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
                                __ IntPtrConstant(kTaggedSizeLog2 - 1)),
                     __ IntPtrConstant((FixedArray::kHeaderSize - kTaggedSize) -
                                       kHeapObjectTag));
-      Node* result =
-          __ Load(MachineType::TypeCompressedTagged(), properties, offset);
+      Node* result = __ Load(MachineType::AnyTagged(), properties, offset);
       __ Goto(&done, result);
     }
   }
@@ -4840,8 +4801,7 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
         Node* result = __ Load(MachineType::Float64(), object, offset);
         __ Goto(&done_double, result);
       } else {
-        Node* field =
-            __ Load(MachineType::TypeCompressedTagged(), object, offset);
+        Node* field = __ Load(MachineType::AnyTagged(), object, offset);
         __ Goto(&loaded_field, field);
       }
     }
@@ -4855,8 +4815,7 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
                                __ IntPtrConstant(kTaggedSizeLog2)),
                     __ IntPtrConstant((FixedArray::kHeaderSize - kTaggedSize) -
                                       kHeapObjectTag));
-      Node* field =
-          __ Load(MachineType::TypeCompressedTagged(), properties, offset);
+      Node* field = __ Load(MachineType::AnyTagged(), properties, offset);
       __ Goto(&loaded_field, field);
     }
 
@@ -5031,15 +4990,6 @@ Node* EffectControlLinearizer::BuildTypedArrayDataPointer(Node* base,
     return external;
   } else {
     if (COMPRESS_POINTERS_BOOL) {
-      // TurboFan does not support loading of compressed fields without
-      // decompression so we add the following operations to workaround that.
-      // We can't load the base value as word32 because in that case the
-      // value will not be marked as tagged in the pointer map and will not
-      // survive GC.
-      // Compress base value back to in order to be able to decompress by
-      // doing an unsafe add below. Both decompression and compression
-      // will be removed by the decompression elimination pass.
-      base = __ ChangeTaggedToCompressed(base);
       base = __ BitcastTaggedToWord(base);
       // Zero-extend Tagged_t to UintPtr according to current compression
       // scheme so that the addition with |external_pointer| (which already
@@ -5176,9 +5126,9 @@ void EffectControlLinearizer::LowerTransitionAndStoreElement(Node* node) {
   Node* kind;
   {
     Node* bit_field2 = __ LoadField(AccessBuilder::ForMapBitField2(), map);
-    Node* mask = __ Int32Constant(Map::ElementsKindBits::kMask);
+    Node* mask = __ Int32Constant(Map::Bits2::ElementsKindBits::kMask);
     Node* andit = __ Word32And(bit_field2, mask);
-    Node* shift = __ Int32Constant(Map::ElementsKindBits::kShift);
+    Node* shift = __ Int32Constant(Map::Bits2::ElementsKindBits::kShift);
     kind = __ Word32Shr(andit, shift);
   }
 
@@ -5294,9 +5244,9 @@ void EffectControlLinearizer::LowerTransitionAndStoreNumberElement(Node* node) {
   Node* kind;
   {
     Node* bit_field2 = __ LoadField(AccessBuilder::ForMapBitField2(), map);
-    Node* mask = __ Int32Constant(Map::ElementsKindBits::kMask);
+    Node* mask = __ Int32Constant(Map::Bits2::ElementsKindBits::kMask);
     Node* andit = __ Word32And(bit_field2, mask);
-    Node* shift = __ Int32Constant(Map::ElementsKindBits::kShift);
+    Node* shift = __ Int32Constant(Map::Bits2::ElementsKindBits::kShift);
     kind = __ Word32Shr(andit, shift);
   }
 
@@ -5357,9 +5307,9 @@ void EffectControlLinearizer::LowerTransitionAndStoreNonNumberElement(
   Node* kind;
   {
     Node* bit_field2 = __ LoadField(AccessBuilder::ForMapBitField2(), map);
-    Node* mask = __ Int32Constant(Map::ElementsKindBits::kMask);
+    Node* mask = __ Int32Constant(Map::Bits2::ElementsKindBits::kMask);
     Node* andit = __ Word32And(bit_field2, mask);
-    Node* shift = __ Int32Constant(Map::ElementsKindBits::kShift);
+    Node* shift = __ Int32Constant(Map::Bits2::ElementsKindBits::kShift);
     kind = __ Word32Shr(andit, shift);
   }
 
@@ -5424,9 +5374,9 @@ void EffectControlLinearizer::LowerStoreSignedSmallElement(Node* node) {
   Node* kind;
   {
     Node* bit_field2 = __ LoadField(AccessBuilder::ForMapBitField2(), map);
-    Node* mask = __ Int32Constant(Map::ElementsKindBits::kMask);
+    Node* mask = __ Int32Constant(Map::Bits2::ElementsKindBits::kMask);
     Node* andit = __ Word32And(bit_field2, mask);
-    Node* shift = __ Int32Constant(Map::ElementsKindBits::kShift);
+    Node* shift = __ Int32Constant(Map::Bits2::ElementsKindBits::kShift);
     kind = __ Word32Shr(andit, shift);
   }
 
@@ -5441,7 +5391,7 @@ void EffectControlLinearizer::LowerStoreSignedSmallElement(Node* node) {
     // the ElementAccess information.
     ElementAccess access = AccessBuilder::ForFixedArrayElement();
     access.type = Type::SignedSmall();
-    access.machine_type = MachineType::TypeCompressedTaggedSigned();
+    access.machine_type = MachineType::TaggedSigned();
     access.write_barrier_kind = kNoWriteBarrier;
     Node* smi_value = ChangeInt32ToSmi(value);
     __ StoreElement(access, elements, index, smi_value);
@@ -5956,7 +5906,7 @@ Node* EffectControlLinearizer::LowerFindOrderedHashMapEntryForInt32Key(
       AccessBuilder::ForOrderedHashMapOrSetNumberOfBuckets(), table));
   hash = __ WordAnd(hash, __ IntSub(number_of_buckets, __ IntPtrConstant(1)));
   Node* first_entry = ChangeSmiToIntPtr(__ Load(
-      MachineType::TypeCompressedTaggedSigned(), table,
+      MachineType::TaggedSigned(), table,
       __ IntAdd(__ WordShl(hash, __ IntPtrConstant(kTaggedSizeLog2)),
                 __ IntPtrConstant(OrderedHashMap::HashTableStartOffset() -
                                   kHeapObjectTag))));
@@ -5975,7 +5925,7 @@ Node* EffectControlLinearizer::LowerFindOrderedHashMapEntryForInt32Key(
         number_of_buckets);
 
     Node* candidate_key = __ Load(
-        MachineType::TypeCompressedTagged(), table,
+        MachineType::AnyTagged(), table,
         __ IntAdd(__ WordShl(entry, __ IntPtrConstant(kTaggedSizeLog2)),
                   __ IntPtrConstant(OrderedHashMap::HashTableStartOffset() -
                                     kHeapObjectTag)));
@@ -5983,15 +5933,9 @@ Node* EffectControlLinearizer::LowerFindOrderedHashMapEntryForInt32Key(
     auto if_match = __ MakeLabel();
     auto if_notmatch = __ MakeLabel();
     auto if_notsmi = __ MakeDeferredLabel();
-    if (COMPRESS_POINTERS_BOOL) {
-      __ GotoIfNot(CompressedObjectIsSmi(candidate_key), &if_notsmi);
-      __ Branch(__ Word32Equal(ChangeCompressedSmiToInt32(candidate_key), key),
-                &if_match, &if_notmatch);
-    } else {
       __ GotoIfNot(ObjectIsSmi(candidate_key), &if_notsmi);
       __ Branch(__ Word32Equal(ChangeSmiToInt32(candidate_key), key), &if_match,
                 &if_notmatch);
-    }
 
     __ Bind(&if_notsmi);
     __ GotoIfNot(
@@ -6009,7 +5953,7 @@ Node* EffectControlLinearizer::LowerFindOrderedHashMapEntryForInt32Key(
     __ Bind(&if_notmatch);
     {
       Node* next_entry = ChangeSmiToIntPtr(__ Load(
-          MachineType::TypeCompressedTaggedSigned(), table,
+          MachineType::TaggedSigned(), table,
           __ IntAdd(
               __ WordShl(entry, __ IntPtrConstant(kTaggedSizeLog2)),
               __ IntPtrConstant(OrderedHashMap::HashTableStartOffset() +
@@ -6038,10 +5982,11 @@ Node* EffectControlLinearizer::LowerDateNow(Node* node) {
 void LinearizeEffectControl(JSGraph* graph, Schedule* schedule, Zone* temp_zone,
                             SourcePositionTable* source_positions,
                             NodeOriginTable* node_origins,
-                            MaskArrayIndexEnable mask_array_index) {
+                            MaskArrayIndexEnable mask_array_index,
+                            MaintainSchedule maintain_schedule) {
   EffectControlLinearizer linearizer(graph, schedule, temp_zone,
                                      source_positions, node_origins,
-                                     mask_array_index);
+                                     mask_array_index, maintain_schedule);
   linearizer.Run();
 }
 
diff --git a/deps/v8/src/compiler/effect-control-linearizer.h b/deps/v8/src/compiler/effect-control-linearizer.h
index 1942b870d516b9..d747da167603ef 100644
--- a/deps/v8/src/compiler/effect-control-linearizer.h
+++ b/deps/v8/src/compiler/effect-control-linearizer.h
@@ -24,10 +24,12 @@ class SourcePositionTable;
 
 enum class MaskArrayIndexEnable { kDoNotMaskArrayIndex, kMaskArrayIndex };
 
+enum class MaintainSchedule { kMaintain, kDiscard };
+
 V8_EXPORT_PRIVATE void LinearizeEffectControl(
     JSGraph* graph, Schedule* schedule, Zone* temp_zone,
     SourcePositionTable* source_positions, NodeOriginTable* node_origins,
-    MaskArrayIndexEnable mask_array_index);
+    MaskArrayIndexEnable mask_array_index, MaintainSchedule maintain_schedule);
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/functional-list.h b/deps/v8/src/compiler/functional-list.h
index 6af63030f83ad9..6fe1f70ede913e 100644
--- a/deps/v8/src/compiler/functional-list.h
+++ b/deps/v8/src/compiler/functional-list.h
@@ -5,6 +5,7 @@
 #ifndef V8_COMPILER_FUNCTIONAL_LIST_H_
 #define V8_COMPILER_FUNCTIONAL_LIST_H_
 
+#include <iterator>
 #include "src/zone/zone.h"
 
 namespace v8 {
@@ -45,6 +46,10 @@ class FunctionalList {
     return !(*this == other);
   }
 
+  bool TriviallyEquals(const FunctionalList<A>& other) const {
+    return elements_ == other.elements_;
+  }
+
   const A& Front() const {
     DCHECK_GT(Size(), 0);
     return elements_->top;
@@ -92,7 +97,7 @@ class FunctionalList {
 
   void Clear() { elements_ = nullptr; }
 
-  class iterator {
+  class iterator : public std::iterator<std::forward_iterator_tag, A> {
    public:
     explicit iterator(Cons* cur) : current_(cur) {}
 
@@ -106,6 +111,14 @@ class FunctionalList {
     }
     bool operator!=(const iterator& other) const { return !(*this == other); }
 
+    // Implemented so that std::find and friends can use std::iterator_traits
+    // for this iterator type.
+    typedef std::forward_iterator_tag iterator_category;
+    typedef ptrdiff_t difference_type;
+    typedef A value_type;
+    typedef A* pointer;
+    typedef A& reference;
+
    private:
     Cons* current_;
   };
diff --git a/deps/v8/src/compiler/globals.h b/deps/v8/src/compiler/globals.h
new file mode 100644
index 00000000000000..a8d8a47c59c0cb
--- /dev/null
+++ b/deps/v8/src/compiler/globals.h
@@ -0,0 +1,61 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_GLOBALS_H_
+#define V8_COMPILER_GLOBALS_H_
+
+#include "src/common/globals.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+enum class StackCheckKind {
+  kJSFunctionEntry = 0,
+  kJSIterationBody,
+  kCodeStubAssembler,
+  kWasm,
+};
+
+inline std::ostream& operator<<(std::ostream& os, StackCheckKind kind) {
+  switch (kind) {
+    case StackCheckKind::kJSFunctionEntry:
+      return os << "JSFunctionEntry";
+    case StackCheckKind::kJSIterationBody:
+      return os << "JSIterationBody";
+    case StackCheckKind::kCodeStubAssembler:
+      return os << "CodeStubAssembler";
+    case StackCheckKind::kWasm:
+      return os << "Wasm";
+  }
+  UNREACHABLE();
+}
+
+inline size_t hash_value(StackCheckKind kind) {
+  return static_cast<size_t>(kind);
+}
+
+// The CallFeedbackRelation states whether the target feedback stored with a
+// JSCall is related to the call. If, during lowering, a JSCall (e.g. of a
+// higher order function) is replaced by a JSCall with another target, the
+// feedback has to be kept but is now unrelated.
+enum class CallFeedbackRelation { kRelated, kUnrelated };
+
+inline std::ostream& operator<<(std::ostream& os,
+                                CallFeedbackRelation call_feedback_relation) {
+  switch (call_feedback_relation) {
+    case CallFeedbackRelation::kRelated:
+      return os << "CallFeedbackRelation::kRelated";
+    case CallFeedbackRelation::kUnrelated:
+      return os << "CallFeedbackRelation::kUnrelated";
+  }
+  UNREACHABLE();
+  return os;
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_GLOBALS_H_
diff --git a/deps/v8/src/compiler/graph-assembler.cc b/deps/v8/src/compiler/graph-assembler.cc
index 5c167db9805511..09b66c306fa904 100644
--- a/deps/v8/src/compiler/graph-assembler.cc
+++ b/deps/v8/src/compiler/graph-assembler.cc
@@ -6,90 +6,445 @@
 
 #include "src/codegen/code-factory.h"
 #include "src/compiler/linkage.h"
+#include "src/compiler/schedule.h"
+// For TNode types.
+#include "src/objects/heap-number.h"
+#include "src/objects/oddball.h"
+#include "src/objects/smi.h"
+#include "src/objects/string.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
-GraphAssembler::GraphAssembler(JSGraph* jsgraph, Node* effect, Node* control,
-                               Zone* zone)
+class GraphAssembler::BasicBlockUpdater {
+ public:
+  BasicBlockUpdater(Schedule* schedule, Graph* graph, Zone* temp_zone);
+
+  Node* AddNode(Node* node);
+  Node* AddNode(Node* node, BasicBlock* to);
+  Node* AddClonedNode(Node* node);
+
+  BasicBlock* NewBasicBlock(bool deferred);
+  BasicBlock* SplitBasicBlock();
+  void AddBind(BasicBlock* block);
+  void AddBranch(Node* branch, BasicBlock* tblock, BasicBlock* fblock);
+  void AddGoto(BasicBlock* to);
+  void AddGoto(BasicBlock* from, BasicBlock* to);
+  void AddThrow(Node* node);
+
+  void StartBlock(BasicBlock* block);
+  BasicBlock* Finalize(BasicBlock* original);
+
+  BasicBlock* original_block() { return original_block_; }
+  BasicBlock::Control original_control() { return original_control_; }
+  Node* original_control_input() { return original_control_input_; }
+
+ private:
+  enum State { kUnchanged, kChanged };
+
+  Zone* temp_zone() { return temp_zone_; }
+
+  bool IsOriginalNode(Node* node);
+  void UpdateSuccessors(BasicBlock* block);
+  void SetBlockDeferredFromPredecessors();
+  void CopyForChange();
+
+  Zone* temp_zone_;
+
+  // Current basic block we are scheduling.
+  BasicBlock* current_block_;
+
+  // The original block that we are lowering.
+  BasicBlock* original_block_;
+
+  // Position in the current block, only applicable in the 'unchanged' state.
+  BasicBlock::iterator node_it_;
+  BasicBlock::iterator end_it_;
+
+  Schedule* schedule_;
+  Graph* graph_;
+
+  // The nodes in the original block if we are in 'changed' state. Retained to
+  // avoid invalidating iterators that are iterating over the original nodes of
+  // the block.
+  NodeVector saved_nodes_;
+
+  // The original control, control input and successors, to enable recovery of
+  // them when we finalize the block.
+  struct SuccessorInfo {
+    BasicBlock* block;
+    size_t index;
+  };
+  ZoneVector<SuccessorInfo> saved_successors_;
+  BasicBlock::Control original_control_;
+  Node* original_control_input_;
+  bool original_deferred_;
+  size_t original_node_count_;
+
+  State state_;
+};
+
+GraphAssembler::BasicBlockUpdater::BasicBlockUpdater(Schedule* schedule,
+                                                     Graph* graph,
+                                                     Zone* temp_zone)
+    : temp_zone_(temp_zone),
+      current_block_(nullptr),
+      original_block_(nullptr),
+      schedule_(schedule),
+      graph_(graph),
+      saved_nodes_(schedule->zone()),
+      saved_successors_(schedule->zone()),
+      original_control_(BasicBlock::kNone),
+      original_control_input_(nullptr),
+      original_deferred_(false),
+      original_node_count_(graph->NodeCount()),
+      state_(kUnchanged) {}
+
+Node* GraphAssembler::BasicBlockUpdater::AddNode(Node* node) {
+  return AddNode(node, current_block_);
+}
+
+Node* GraphAssembler::BasicBlockUpdater::AddNode(Node* node, BasicBlock* to) {
+  if (state_ == kUnchanged) {
+    DCHECK_EQ(to, original_block());
+
+    if (node_it_ != end_it_ && *node_it_ == node) {
+      node_it_++;
+      return node;
+    }
+
+    CopyForChange();
+  }
+
+  // Add the node to the basic block.
+  DCHECK(!schedule_->IsScheduled(node));
+  schedule_->AddNode(to, node);
+  return node;
+}
+
+Node* GraphAssembler::BasicBlockUpdater::AddClonedNode(Node* node) {
+  DCHECK(node->op()->HasProperty(Operator::kPure));
+  if (state_ == kUnchanged) {
+    CopyForChange();
+  }
+
+  if (schedule_->IsScheduled(node) &&
+      schedule_->block(node) == current_block_) {
+    // Node is already scheduled for the current block, don't add it again.
+    return node;
+  } else if (!schedule_->IsScheduled(node) && !IsOriginalNode(node)) {
+    // Node is not scheduled yet, so we can add it directly.
+    return AddNode(node);
+  } else {
+    // TODO(9684): Potentially add some per-block caching so we can avoid
+    // cloning if we've already cloned for this block.
+    return AddNode(graph_->CloneNode(node));
+  }
+}
+
+bool GraphAssembler::BasicBlockUpdater::IsOriginalNode(Node* node) {
+  // Return true if node was part of the original schedule and might currently
+  // be re-added to the schedule after a CopyForChange.
+  return node->id() < original_node_count_;
+}
+
+void GraphAssembler::BasicBlockUpdater::CopyForChange() {
+  DCHECK_EQ(kUnchanged, state_);
+
+  // Save successor.
+  DCHECK(saved_successors_.empty());
+  for (BasicBlock* successor : original_block()->successors()) {
+    for (size_t i = 0; i < successor->PredecessorCount(); i++) {
+      if (successor->PredecessorAt(i) == original_block()) {
+        saved_successors_.push_back({successor, i});
+        break;
+      }
+    }
+  }
+  DCHECK_EQ(saved_successors_.size(), original_block()->SuccessorCount());
+
+  // Save control.
+  original_control_ = original_block()->control();
+  original_control_input_ = original_block()->control_input();
+
+  // Save original nodes (to allow them to continue to be iterated by the user
+  // of graph assembler).
+  original_block()->nodes()->swap(saved_nodes_);
+  DCHECK(original_block()->nodes()->empty());
+
+  // Re-insert the nodes from the front of the block.
+  original_block()->InsertNodes(original_block()->begin(), saved_nodes_.begin(),
+                                node_it_);
+
+  // Remove the tail from the schedule.
+  for (; node_it_ != end_it_; node_it_++) {
+    schedule_->SetBlockForNode(nullptr, *node_it_);
+  }
+
+  // Reset the control.
+  if (original_block()->control() != BasicBlock::kGoto) {
+    schedule_->SetBlockForNode(nullptr, original_block()->control_input());
+  }
+  original_block()->set_control_input(nullptr);
+  original_block()->set_control(BasicBlock::kNone);
+  original_block()->ClearSuccessors();
+
+  state_ = kChanged;
+  end_it_ = {};
+  node_it_ = {};
+}
+
+BasicBlock* GraphAssembler::BasicBlockUpdater::NewBasicBlock(bool deferred) {
+  BasicBlock* block = schedule_->NewBasicBlock();
+  block->set_deferred(deferred || original_deferred_);
+  return block;
+}
+
+BasicBlock* GraphAssembler::BasicBlockUpdater::SplitBasicBlock() {
+  return NewBasicBlock(current_block_->deferred());
+}
+
+void GraphAssembler::BasicBlockUpdater::AddBind(BasicBlock* to) {
+  DCHECK_NOT_NULL(to);
+  current_block_ = to;
+  // Basic block should only have the control node, if any.
+  DCHECK_LE(current_block_->NodeCount(), 1);
+  SetBlockDeferredFromPredecessors();
+}
+
+void GraphAssembler::BasicBlockUpdater::SetBlockDeferredFromPredecessors() {
+  if (!current_block_->deferred()) {
+    bool deferred = true;
+    for (BasicBlock* pred : current_block_->predecessors()) {
+      if (!pred->deferred()) {
+        deferred = false;
+        break;
+      }
+    }
+    current_block_->set_deferred(deferred);
+  }
+}
+
+void GraphAssembler::BasicBlockUpdater::AddBranch(Node* node,
+                                                  BasicBlock* tblock,
+                                                  BasicBlock* fblock) {
+  if (state_ == kUnchanged) {
+    DCHECK_EQ(current_block_, original_block());
+    CopyForChange();
+  }
+
+  DCHECK_EQ(state_, kChanged);
+  schedule_->AddBranch(current_block_, node, tblock, fblock);
+  current_block_ = nullptr;
+}
+
+void GraphAssembler::BasicBlockUpdater::AddGoto(BasicBlock* to) {
+  DCHECK_NOT_NULL(current_block_);
+  AddGoto(current_block_, to);
+}
+
+void GraphAssembler::BasicBlockUpdater::AddGoto(BasicBlock* from,
+                                                BasicBlock* to) {
+  if (state_ == kUnchanged) {
+    CopyForChange();
+  }
+
+  if (to->deferred() && !from->deferred()) {
+    // Add a new block with the correct deferred hint to avoid merges into the
+    // target block with different deferred hints.
+    // TODO(9684): Only split the current basic block if the label's target
+    // block has multiple merges.
+    BasicBlock* new_block = NewBasicBlock(to->deferred());
+    schedule_->AddGoto(from, new_block);
+    from = new_block;
+  }
+
+  schedule_->AddGoto(from, to);
+  current_block_ = nullptr;
+}
+
+void GraphAssembler::BasicBlockUpdater::AddThrow(Node* node) {
+  if (state_ == kUnchanged) {
+    CopyForChange();
+  }
+  schedule_->AddThrow(current_block_, node);
+
+  // Clear original successors and replace the block's original control and
+  // control input to the throw, since this block is now connected directly to
+  // the end.
+  if (original_control_input_ != nullptr) {
+    NodeProperties::ReplaceUses(original_control_input_, node, nullptr, node);
+    original_control_input_->Kill();
+  }
+  original_control_input_ = node;
+  original_control_ = BasicBlock::kThrow;
+
+  for (SuccessorInfo succ : saved_successors_) {
+    succ.block->RemovePredecessor(succ.index);
+  }
+  saved_successors_.clear();
+}
+
+void GraphAssembler::BasicBlockUpdater::UpdateSuccessors(BasicBlock* block) {
+  for (SuccessorInfo succ : saved_successors_) {
+    (succ.block->predecessors())[succ.index] = block;
+    block->AddSuccessor(succ.block);
+  }
+  saved_successors_.clear();
+  block->set_control(original_control_);
+  block->set_control_input(original_control_input_);
+  if (original_control_input_ != nullptr) {
+    schedule_->SetBlockForNode(block, original_control_input_);
+  } else {
+    DCHECK_EQ(BasicBlock::kGoto, original_control_);
+  }
+}
+
+void GraphAssembler::BasicBlockUpdater::StartBlock(BasicBlock* block) {
+  DCHECK_NULL(current_block_);
+  DCHECK_NULL(original_block_);
+  DCHECK(saved_nodes_.empty());
+  block->ResetRPOInfo();
+  current_block_ = block;
+  original_block_ = block;
+  original_deferred_ = block->deferred();
+  node_it_ = block->begin();
+  end_it_ = block->end();
+  state_ = kUnchanged;
+}
+
+BasicBlock* GraphAssembler::BasicBlockUpdater::Finalize(BasicBlock* original) {
+  DCHECK_EQ(original, original_block());
+  BasicBlock* block = current_block_;
+  if (state_ == kChanged) {
+    UpdateSuccessors(block);
+  } else {
+    DCHECK_EQ(block, original_block());
+    if (node_it_ != end_it_) {
+      // We have not got to the end of the node list, we need to trim.
+      block->TrimNodes(node_it_);
+    }
+  }
+  original_control_ = BasicBlock::kNone;
+  saved_nodes_.clear();
+  original_deferred_ = false;
+  original_control_input_ = nullptr;
+  original_block_ = nullptr;
+  current_block_ = nullptr;
+  return block;
+}
+
+GraphAssembler::GraphAssembler(MachineGraph* mcgraph, Zone* zone,
+                               Schedule* schedule, bool mark_loop_exits)
     : temp_zone_(zone),
-      jsgraph_(jsgraph),
-      current_effect_(effect),
-      current_control_(control) {}
+      mcgraph_(mcgraph),
+      effect_(nullptr),
+      control_(nullptr),
+      block_updater_(schedule != nullptr ? new BasicBlockUpdater(
+                                               schedule, mcgraph->graph(), zone)
+                                         : nullptr),
+      loop_headers_(zone),
+      mark_loop_exits_(mark_loop_exits) {}
+
+GraphAssembler::~GraphAssembler() { DCHECK_EQ(loop_nesting_level_, 0); }
 
 Node* GraphAssembler::IntPtrConstant(intptr_t value) {
-  return jsgraph()->IntPtrConstant(value);
+  return AddClonedNode(mcgraph()->IntPtrConstant(value));
 }
 
 Node* GraphAssembler::Int32Constant(int32_t value) {
-  return jsgraph()->Int32Constant(value);
+  return AddClonedNode(mcgraph()->Int32Constant(value));
 }
 
 Node* GraphAssembler::Int64Constant(int64_t value) {
-  return jsgraph()->Int64Constant(value);
+  return AddClonedNode(mcgraph()->Int64Constant(value));
 }
 
 Node* GraphAssembler::UniqueIntPtrConstant(intptr_t value) {
-  return graph()->NewNode(
-      machine()->Is64() ? common()->Int64Constant(value)
-                        : common()->Int32Constant(static_cast<int32_t>(value)));
+  return AddNode(graph()->NewNode(
+      machine()->Is64()
+          ? common()->Int64Constant(value)
+          : common()->Int32Constant(static_cast<int32_t>(value))));
 }
 
-Node* GraphAssembler::SmiConstant(int32_t value) {
-  return jsgraph()->SmiConstant(value);
+Node* JSGraphAssembler::SmiConstant(int32_t value) {
+  return AddClonedNode(jsgraph()->SmiConstant(value));
 }
 
-Node* GraphAssembler::Uint32Constant(int32_t value) {
-  return jsgraph()->Uint32Constant(value);
+Node* GraphAssembler::Uint32Constant(uint32_t value) {
+  return AddClonedNode(mcgraph()->Uint32Constant(value));
 }
 
 Node* GraphAssembler::Float64Constant(double value) {
-  return jsgraph()->Float64Constant(value);
+  return AddClonedNode(mcgraph()->Float64Constant(value));
 }
 
-Node* GraphAssembler::HeapConstant(Handle<HeapObject> object) {
-  return jsgraph()->HeapConstant(object);
+TNode<HeapObject> JSGraphAssembler::HeapConstant(Handle<HeapObject> object) {
+  return TNode<HeapObject>::UncheckedCast(
+      AddClonedNode(jsgraph()->HeapConstant(object)));
 }
 
-Node* GraphAssembler::NumberConstant(double value) {
-  return jsgraph()->Constant(value);
+TNode<Object> JSGraphAssembler::Constant(const ObjectRef& ref) {
+  return TNode<Object>::UncheckedCast(AddClonedNode(jsgraph()->Constant(ref)));
+}
+
+TNode<Number> JSGraphAssembler::NumberConstant(double value) {
+  return TNode<Number>::UncheckedCast(
+      AddClonedNode(jsgraph()->Constant(value)));
 }
 
 Node* GraphAssembler::ExternalConstant(ExternalReference ref) {
-  return jsgraph()->ExternalConstant(ref);
+  return AddClonedNode(mcgraph()->ExternalConstant(ref));
 }
 
-Node* GraphAssembler::CEntryStubConstant(int result_size) {
-  return jsgraph()->CEntryStubConstant(result_size);
+Node* JSGraphAssembler::CEntryStubConstant(int result_size) {
+  return AddClonedNode(jsgraph()->CEntryStubConstant(result_size));
 }
 
 Node* GraphAssembler::LoadFramePointer() {
-  return graph()->NewNode(machine()->LoadFramePointer());
+  return AddNode(graph()->NewNode(machine()->LoadFramePointer()));
 }
 
-#define SINGLETON_CONST_DEF(Name) \
-  Node* GraphAssembler::Name() { return jsgraph()->Name(); }
+Node* GraphAssembler::LoadHeapNumberValue(Node* heap_number) {
+  return Load(MachineType::Float64(), heap_number,
+              IntPtrConstant(HeapNumber::kValueOffset - kHeapObjectTag));
+}
+
+#define SINGLETON_CONST_DEF(Name, Type)              \
+  TNode<Type> JSGraphAssembler::Name##Constant() {   \
+    return TNode<Type>::UncheckedCast(               \
+        AddClonedNode(jsgraph()->Name##Constant())); \
+  }
 JSGRAPH_SINGLETON_CONSTANT_LIST(SINGLETON_CONST_DEF)
 #undef SINGLETON_CONST_DEF
 
-#define PURE_UNOP_DEF(Name)                            \
-  Node* GraphAssembler::Name(Node* input) {            \
-    return graph()->NewNode(machine()->Name(), input); \
+#define SINGLETON_CONST_TEST_DEF(Name, ...)                        \
+  TNode<Boolean> JSGraphAssembler::Is##Name(TNode<Object> value) { \
+    return TNode<Boolean>::UncheckedCast(                          \
+        ReferenceEqual(value, Name##Constant()));                  \
+  }
+JSGRAPH_SINGLETON_CONSTANT_LIST(SINGLETON_CONST_TEST_DEF)
+#undef SINGLETON_CONST_TEST_DEF
+
+#define PURE_UNOP_DEF(Name)                                     \
+  Node* GraphAssembler::Name(Node* input) {                     \
+    return AddNode(graph()->NewNode(machine()->Name(), input)); \
   }
 PURE_ASSEMBLER_MACH_UNOP_LIST(PURE_UNOP_DEF)
 #undef PURE_UNOP_DEF
 
-#define PURE_BINOP_DEF(Name)                                 \
-  Node* GraphAssembler::Name(Node* left, Node* right) {      \
-    return graph()->NewNode(machine()->Name(), left, right); \
+#define PURE_BINOP_DEF(Name)                                          \
+  Node* GraphAssembler::Name(Node* left, Node* right) {               \
+    return AddNode(graph()->NewNode(machine()->Name(), left, right)); \
   }
 PURE_ASSEMBLER_MACH_BINOP_LIST(PURE_BINOP_DEF)
 #undef PURE_BINOP_DEF
 
-#define CHECKED_BINOP_DEF(Name)                                                \
-  Node* GraphAssembler::Name(Node* left, Node* right) {                        \
-    return graph()->NewNode(machine()->Name(), left, right, current_control_); \
+#define CHECKED_BINOP_DEF(Name)                                       \
+  Node* GraphAssembler::Name(Node* left, Node* right) {               \
+    return AddNode(                                                   \
+        graph()->NewNode(machine()->Name(), left, right, control())); \
   }
 CHECKED_ASSEMBLER_MACH_BINOP_LIST(CHECKED_BINOP_DEF)
 #undef CHECKED_BINOP_DEF
@@ -100,89 +455,202 @@ Node* GraphAssembler::IntPtrEqual(Node* left, Node* right) {
 
 Node* GraphAssembler::TaggedEqual(Node* left, Node* right) {
   if (COMPRESS_POINTERS_BOOL) {
-    return Word32Equal(ChangeTaggedToCompressed(left),
-                       ChangeTaggedToCompressed(right));
+    return Word32Equal(left, right);
+  } else {
+    return WordEqual(left, right);
+  }
+}
+
+Node* GraphAssembler::SmiSub(Node* left, Node* right) {
+  if (COMPRESS_POINTERS_BOOL) {
+    return Int32Sub(left, right);
+  } else {
+    return IntSub(left, right);
+  }
+}
+
+Node* GraphAssembler::SmiLessThan(Node* left, Node* right) {
+  if (COMPRESS_POINTERS_BOOL) {
+    return Int32LessThan(left, right);
+  } else {
+    return IntLessThan(left, right);
   }
-  return WordEqual(left, right);
 }
 
 Node* GraphAssembler::Float64RoundDown(Node* value) {
   CHECK(machine()->Float64RoundDown().IsSupported());
-  return graph()->NewNode(machine()->Float64RoundDown().op(), value);
+  return AddNode(graph()->NewNode(machine()->Float64RoundDown().op(), value));
 }
 
 Node* GraphAssembler::Float64RoundTruncate(Node* value) {
   CHECK(machine()->Float64RoundTruncate().IsSupported());
-  return graph()->NewNode(machine()->Float64RoundTruncate().op(), value);
+  return AddNode(
+      graph()->NewNode(machine()->Float64RoundTruncate().op(), value));
 }
 
 Node* GraphAssembler::Projection(int index, Node* value) {
-  return graph()->NewNode(common()->Projection(index), value, current_control_);
+  return AddNode(
+      graph()->NewNode(common()->Projection(index), value, control()));
+}
+
+Node* JSGraphAssembler::Allocate(AllocationType allocation, Node* size) {
+  return AddNode(
+      graph()->NewNode(simplified()->AllocateRaw(Type::Any(), allocation), size,
+                       effect(), control()));
+}
+
+Node* JSGraphAssembler::LoadField(FieldAccess const& access, Node* object) {
+  Node* value = AddNode(graph()->NewNode(simplified()->LoadField(access),
+                                         object, effect(), control()));
+  return value;
+}
+
+Node* JSGraphAssembler::LoadElement(ElementAccess const& access, Node* object,
+                                    Node* index) {
+  Node* value = AddNode(graph()->NewNode(simplified()->LoadElement(access),
+                                         object, index, effect(), control()));
+  return value;
+}
+
+Node* JSGraphAssembler::StoreField(FieldAccess const& access, Node* object,
+                                   Node* value) {
+  return AddNode(graph()->NewNode(simplified()->StoreField(access), object,
+                                  value, effect(), control()));
+}
+
+Node* JSGraphAssembler::StoreElement(ElementAccess const& access, Node* object,
+                                     Node* index, Node* value) {
+  return AddNode(graph()->NewNode(simplified()->StoreElement(access), object,
+                                  index, value, effect(), control()));
+}
+
+void JSGraphAssembler::TransitionAndStoreElement(MapRef double_map,
+                                                 MapRef fast_map,
+                                                 TNode<HeapObject> object,
+                                                 TNode<Number> index,
+                                                 TNode<Object> value) {
+  AddNode(graph()->NewNode(simplified()->TransitionAndStoreElement(
+                               double_map.object(), fast_map.object()),
+                           object, index, value, effect(), control()));
+}
+
+TNode<Number> JSGraphAssembler::StringLength(TNode<String> string) {
+  return AddNode<Number>(
+      graph()->NewNode(simplified()->StringLength(), string));
+}
+
+TNode<Boolean> JSGraphAssembler::ReferenceEqual(TNode<Object> lhs,
+                                                TNode<Object> rhs) {
+  return AddNode<Boolean>(
+      graph()->NewNode(simplified()->ReferenceEqual(), lhs, rhs));
+}
+
+TNode<Number> JSGraphAssembler::NumberMin(TNode<Number> lhs,
+                                          TNode<Number> rhs) {
+  return AddNode<Number>(graph()->NewNode(simplified()->NumberMin(), lhs, rhs));
+}
+
+TNode<Number> JSGraphAssembler::NumberMax(TNode<Number> lhs,
+                                          TNode<Number> rhs) {
+  return AddNode<Number>(graph()->NewNode(simplified()->NumberMax(), lhs, rhs));
+}
+
+TNode<Number> JSGraphAssembler::NumberAdd(TNode<Number> lhs,
+                                          TNode<Number> rhs) {
+  return AddNode<Number>(graph()->NewNode(simplified()->NumberAdd(), lhs, rhs));
+}
+
+TNode<Number> JSGraphAssembler::NumberSubtract(TNode<Number> lhs,
+                                               TNode<Number> rhs) {
+  return AddNode<Number>(
+      graph()->NewNode(simplified()->NumberSubtract(), lhs, rhs));
+}
+
+TNode<Boolean> JSGraphAssembler::NumberLessThan(TNode<Number> lhs,
+                                                TNode<Number> rhs) {
+  return AddNode<Boolean>(
+      graph()->NewNode(simplified()->NumberLessThan(), lhs, rhs));
+}
+
+TNode<Boolean> JSGraphAssembler::NumberLessThanOrEqual(TNode<Number> lhs,
+                                                       TNode<Number> rhs) {
+  return AddNode<Boolean>(
+      graph()->NewNode(simplified()->NumberLessThanOrEqual(), lhs, rhs));
+}
+
+TNode<String> JSGraphAssembler::StringSubstring(TNode<String> string,
+                                                TNode<Number> from,
+                                                TNode<Number> to) {
+  return AddNode<String>(graph()->NewNode(
+      simplified()->StringSubstring(), string, from, to, effect(), control()));
+}
+
+TNode<Boolean> JSGraphAssembler::ObjectIsCallable(TNode<Object> value) {
+  return AddNode<Boolean>(
+      graph()->NewNode(simplified()->ObjectIsCallable(), value));
+}
+
+Node* JSGraphAssembler::CheckIf(Node* cond, DeoptimizeReason reason) {
+  return AddNode(graph()->NewNode(simplified()->CheckIf(reason), cond, effect(),
+                                  control()));
+}
+
+TNode<Boolean> JSGraphAssembler::NumberIsFloat64Hole(TNode<Number> value) {
+  return AddNode<Boolean>(
+      graph()->NewNode(simplified()->NumberIsFloat64Hole(), value));
 }
 
-Node* GraphAssembler::Allocate(AllocationType allocation, Node* size) {
-  return current_control_ = current_effect_ = graph()->NewNode(
-             simplified()->AllocateRaw(Type::Any(), allocation), size,
-             current_effect_, current_control_);
+TNode<Boolean> JSGraphAssembler::ToBoolean(TNode<Object> value) {
+  return AddNode<Boolean>(graph()->NewNode(simplified()->ToBoolean(), value));
 }
 
-Node* GraphAssembler::LoadField(FieldAccess const& access, Node* object) {
-  Node* value = current_effect_ =
-      graph()->NewNode(simplified()->LoadField(access), object, current_effect_,
-                       current_control_);
-  return InsertDecompressionIfNeeded(access.machine_type.representation(),
-                                     value);
+TNode<Object> JSGraphAssembler::ConvertTaggedHoleToUndefined(
+    TNode<Object> value) {
+  return AddNode<Object>(
+      graph()->NewNode(simplified()->ConvertTaggedHoleToUndefined(), value));
 }
 
-Node* GraphAssembler::LoadElement(ElementAccess const& access, Node* object,
-                                  Node* index) {
-  Node* value = current_effect_ =
-      graph()->NewNode(simplified()->LoadElement(access), object, index,
-                       current_effect_, current_control_);
-  return InsertDecompressionIfNeeded(access.machine_type.representation(),
-                                     value);
+TNode<FixedArrayBase> JSGraphAssembler::MaybeGrowFastElements(
+    ElementsKind kind, const FeedbackSource& feedback, TNode<JSArray> array,
+    TNode<FixedArrayBase> elements, TNode<Number> new_length,
+    TNode<Number> old_length) {
+  GrowFastElementsMode mode = IsDoubleElementsKind(kind)
+                                  ? GrowFastElementsMode::kDoubleElements
+                                  : GrowFastElementsMode::kSmiOrObjectElements;
+  return AddNode<FixedArrayBase>(graph()->NewNode(
+      simplified()->MaybeGrowFastElements(mode, feedback), array, elements,
+      new_length, old_length, effect(), control()));
 }
 
-Node* GraphAssembler::StoreField(FieldAccess const& access, Node* object,
-                                 Node* value) {
-  value =
-      InsertCompressionIfNeeded(access.machine_type.representation(), value);
-  return current_effect_ =
-             graph()->NewNode(simplified()->StoreField(access), object, value,
-                              current_effect_, current_control_);
+Node* GraphAssembler::TypeGuard(Type type, Node* value) {
+  return AddNode(
+      graph()->NewNode(common()->TypeGuard(type), value, effect(), control()));
 }
 
-Node* GraphAssembler::StoreElement(ElementAccess const& access, Node* object,
-                                   Node* index, Node* value) {
-  value =
-      InsertCompressionIfNeeded(access.machine_type.representation(), value);
-  return current_effect_ =
-             graph()->NewNode(simplified()->StoreElement(access), object, index,
-                              value, current_effect_, current_control_);
+Node* GraphAssembler::Checkpoint(FrameState frame_state) {
+  return AddNode(graph()->NewNode(common()->Checkpoint(), frame_state, effect(),
+                                  control()));
 }
 
 Node* GraphAssembler::DebugBreak() {
-  return current_effect_ = graph()->NewNode(machine()->DebugBreak(),
-                                            current_effect_, current_control_);
+  return AddNode(
+      graph()->NewNode(machine()->DebugBreak(), effect(), control()));
 }
 
 Node* GraphAssembler::Unreachable() {
-  return current_effect_ = graph()->NewNode(common()->Unreachable(),
-                                            current_effect_, current_control_);
+  return AddNode(
+      graph()->NewNode(common()->Unreachable(), effect(), control()));
 }
 
 Node* GraphAssembler::Store(StoreRepresentation rep, Node* object, Node* offset,
                             Node* value) {
-  value = InsertCompressionIfNeeded(rep.representation(), value);
-  return current_effect_ =
-             graph()->NewNode(machine()->Store(rep), object, offset, value,
-                              current_effect_, current_control_);
+  return AddNode(graph()->NewNode(machine()->Store(rep), object, offset, value,
+                                  effect(), control()));
 }
 
 Node* GraphAssembler::Load(MachineType type, Node* object, Node* offset) {
-  Node* value = current_effect_ = graph()->NewNode(
-      machine()->Load(type), object, offset, current_effect_, current_control_);
-  return InsertDecompressionIfNeeded(type.representation(), value);
+  return AddNode(graph()->NewNode(machine()->Load(type), object, offset,
+                                  effect(), control()));
 }
 
 Node* GraphAssembler::StoreUnaligned(MachineRepresentation rep, Node* object,
@@ -192,8 +660,8 @@ Node* GraphAssembler::StoreUnaligned(MachineRepresentation rep, Node* object,
        machine()->UnalignedStoreSupported(rep))
           ? machine()->Store(StoreRepresentation(rep, kNoWriteBarrier))
           : machine()->UnalignedStore(rep);
-  return current_effect_ = graph()->NewNode(op, object, offset, value,
-                                            current_effect_, current_control_);
+  return AddNode(
+      graph()->NewNode(op, object, offset, value, effect(), control()));
 }
 
 Node* GraphAssembler::LoadUnaligned(MachineType type, Node* object,
@@ -203,160 +671,200 @@ Node* GraphAssembler::LoadUnaligned(MachineType type, Node* object,
        machine()->UnalignedLoadSupported(type.representation()))
           ? machine()->Load(type)
           : machine()->UnalignedLoad(type);
-  return current_effect_ = graph()->NewNode(op, object, offset, current_effect_,
-                                            current_control_);
+  return AddNode(graph()->NewNode(op, object, offset, effect(), control()));
 }
 
 Node* GraphAssembler::Retain(Node* buffer) {
-  return current_effect_ =
-             graph()->NewNode(common()->Retain(), buffer, current_effect_);
+  return AddNode(graph()->NewNode(common()->Retain(), buffer, effect()));
 }
 
 Node* GraphAssembler::UnsafePointerAdd(Node* base, Node* external) {
-  return current_effect_ =
-             graph()->NewNode(machine()->UnsafePointerAdd(), base, external,
-                              current_effect_, current_control_);
+  return AddNode(graph()->NewNode(machine()->UnsafePointerAdd(), base, external,
+                                  effect(), control()));
 }
 
-Node* GraphAssembler::ToNumber(Node* value) {
-  return current_effect_ =
-             graph()->NewNode(ToNumberOperator(), ToNumberBuiltinConstant(),
-                              value, NoContextConstant(), current_effect_);
+TNode<Number> JSGraphAssembler::PlainPrimitiveToNumber(TNode<Object> value) {
+  return AddNode<Number>(graph()->NewNode(PlainPrimitiveToNumberOperator(),
+                                          ToNumberBuiltinConstant(), value,
+                                          NoContextConstant(), effect()));
 }
 
 Node* GraphAssembler::BitcastWordToTagged(Node* value) {
-  return current_effect_ =
-             graph()->NewNode(machine()->BitcastWordToTagged(), value,
-                              current_effect_, current_control_);
+  return AddNode(graph()->NewNode(machine()->BitcastWordToTagged(), value,
+                                  effect(), control()));
 }
 
 Node* GraphAssembler::BitcastTaggedToWord(Node* value) {
-  return current_effect_ =
-             graph()->NewNode(machine()->BitcastTaggedToWord(), value,
-                              current_effect_, current_control_);
+  return AddNode(graph()->NewNode(machine()->BitcastTaggedToWord(), value,
+                                  effect(), control()));
 }
 
 Node* GraphAssembler::BitcastTaggedToWordForTagAndSmiBits(Node* value) {
-  return current_effect_ =
-             graph()->NewNode(machine()->BitcastTaggedToWordForTagAndSmiBits(),
-                              value, current_effect_, current_control_);
+  return AddNode(
+      graph()->NewNode(machine()->BitcastTaggedToWordForTagAndSmiBits(), value,
+                       effect(), control()));
 }
 
 Node* GraphAssembler::Word32PoisonOnSpeculation(Node* value) {
-  return current_effect_ =
-             graph()->NewNode(machine()->Word32PoisonOnSpeculation(), value,
-                              current_effect_, current_control_);
+  return AddNode(graph()->NewNode(machine()->Word32PoisonOnSpeculation(), value,
+                                  effect(), control()));
 }
 
 Node* GraphAssembler::DeoptimizeIf(DeoptimizeReason reason,
                                    FeedbackSource const& feedback,
                                    Node* condition, Node* frame_state,
                                    IsSafetyCheck is_safety_check) {
-  return current_control_ = current_effect_ = graph()->NewNode(
-             common()->DeoptimizeIf(DeoptimizeKind::kEager, reason, feedback,
-                                    is_safety_check),
-             condition, frame_state, current_effect_, current_control_);
+  return AddNode(
+      graph()->NewNode(common()->DeoptimizeIf(DeoptimizeKind::kEager, reason,
+                                              feedback, is_safety_check),
+                       condition, frame_state, effect(), control()));
 }
 
 Node* GraphAssembler::DeoptimizeIfNot(DeoptimizeReason reason,
                                       FeedbackSource const& feedback,
                                       Node* condition, Node* frame_state,
                                       IsSafetyCheck is_safety_check) {
-  return current_control_ = current_effect_ = graph()->NewNode(
-             common()->DeoptimizeUnless(DeoptimizeKind::kEager, reason,
-                                        feedback, is_safety_check),
-             condition, frame_state, current_effect_, current_control_);
+  return AddNode(graph()->NewNode(
+      common()->DeoptimizeUnless(DeoptimizeKind::kEager, reason, feedback,
+                                 is_safety_check),
+      condition, frame_state, effect(), control()));
 }
 
-void GraphAssembler::Branch(Node* condition, GraphAssemblerLabel<0u>* if_true,
-                            GraphAssemblerLabel<0u>* if_false,
-                            IsSafetyCheck is_safety_check) {
-  DCHECK_NOT_NULL(current_control_);
-
+void GraphAssembler::BranchWithCriticalSafetyCheck(
+    Node* condition, GraphAssemblerLabel<0u>* if_true,
+    GraphAssemblerLabel<0u>* if_false) {
   BranchHint hint = BranchHint::kNone;
   if (if_true->IsDeferred() != if_false->IsDeferred()) {
     hint = if_false->IsDeferred() ? BranchHint::kTrue : BranchHint::kFalse;
   }
 
-  Node* branch = graph()->NewNode(common()->Branch(hint, is_safety_check),
-                                  condition, current_control_);
+  BranchImpl(condition, if_true, if_false, hint,
+             IsSafetyCheck::kCriticalSafetyCheck);
+}
 
-  current_control_ = graph()->NewNode(common()->IfTrue(), branch);
-  MergeState(if_true);
+void GraphAssembler::RecordBranchInBlockUpdater(Node* branch,
+                                                Node* if_true_control,
+                                                Node* if_false_control,
+                                                BasicBlock* if_true_block,
+                                                BasicBlock* if_false_block) {
+  DCHECK_NOT_NULL(block_updater_);
+  // TODO(9684): Only split the current basic block if the label's target
+  // block has multiple merges.
+  BasicBlock* if_true_target = block_updater_->SplitBasicBlock();
+  BasicBlock* if_false_target = block_updater_->SplitBasicBlock();
 
-  current_control_ = graph()->NewNode(common()->IfFalse(), branch);
-  MergeState(if_false);
+  block_updater_->AddBranch(branch, if_true_target, if_false_target);
 
-  current_control_ = nullptr;
-  current_effect_ = nullptr;
+  block_updater_->AddNode(if_true_control, if_true_target);
+  block_updater_->AddGoto(if_true_target, if_true_block);
+
+  block_updater_->AddNode(if_false_control, if_false_target);
+  block_updater_->AddGoto(if_false_target, if_false_block);
 }
 
-// Extractors (should be only used when destructing the assembler.
-Node* GraphAssembler::ExtractCurrentControl() {
-  Node* result = current_control_;
-  current_control_ = nullptr;
-  return result;
+void GraphAssembler::BindBasicBlock(BasicBlock* block) {
+  if (block_updater_) {
+    block_updater_->AddBind(block);
+  }
 }
 
-Node* GraphAssembler::ExtractCurrentEffect() {
-  Node* result = current_effect_;
-  current_effect_ = nullptr;
-  return result;
+BasicBlock* GraphAssembler::NewBasicBlock(bool deferred) {
+  if (!block_updater_) return nullptr;
+  return block_updater_->NewBasicBlock(deferred);
 }
 
-Node* GraphAssembler::InsertDecompressionIfNeeded(MachineRepresentation rep,
-                                                  Node* value) {
-  if (COMPRESS_POINTERS_BOOL) {
-    switch (rep) {
-      case MachineRepresentation::kCompressedPointer:
-        value = graph()->NewNode(
-            machine()->ChangeCompressedPointerToTaggedPointer(), value);
-        break;
-      case MachineRepresentation::kCompressedSigned:
-        value = graph()->NewNode(
-            machine()->ChangeCompressedSignedToTaggedSigned(), value);
-        break;
-      case MachineRepresentation::kCompressed:
-        value = graph()->NewNode(machine()->ChangeCompressedToTagged(), value);
-        break;
-      default:
-        break;
+void GraphAssembler::GotoBasicBlock(BasicBlock* block) {
+  if (block_updater_) {
+    block_updater_->AddGoto(block);
+  }
+}
+
+void GraphAssembler::GotoIfBasicBlock(BasicBlock* block, Node* branch,
+                                      IrOpcode::Value goto_if) {
+  if (block_updater_) {
+    // TODO(9684): Only split the current basic block for the goto_target
+    // if block has multiple merges.
+    BasicBlock* goto_target = block_updater_->SplitBasicBlock();
+    BasicBlock* fallthrough_target = block_updater_->SplitBasicBlock();
+
+    if (goto_if == IrOpcode::kIfTrue) {
+      block_updater_->AddBranch(branch, goto_target, fallthrough_target);
+    } else {
+      DCHECK_EQ(goto_if, IrOpcode::kIfFalse);
+      block_updater_->AddBranch(branch, fallthrough_target, goto_target);
     }
+
+    block_updater_->AddNode(control(), goto_target);
+    block_updater_->AddGoto(goto_target, block);
+
+    block_updater_->AddBind(fallthrough_target);
   }
-  return value;
 }
 
-Node* GraphAssembler::InsertCompressionIfNeeded(MachineRepresentation rep,
-                                                Node* value) {
-  if (COMPRESS_POINTERS_BOOL) {
-    switch (rep) {
-      case MachineRepresentation::kCompressedPointer:
-        value = graph()->NewNode(
-            machine()->ChangeTaggedPointerToCompressedPointer(), value);
-        break;
-      case MachineRepresentation::kCompressedSigned:
-        value = graph()->NewNode(
-            machine()->ChangeTaggedSignedToCompressedSigned(), value);
-        break;
-      case MachineRepresentation::kCompressed:
-        value = graph()->NewNode(machine()->ChangeTaggedToCompressed(), value);
-        break;
-      default:
-        break;
+BasicBlock* GraphAssembler::FinalizeCurrentBlock(BasicBlock* block) {
+  if (block_updater_) {
+    block = block_updater_->Finalize(block);
+    if (control() == mcgraph()->Dead()) {
+      // If the block's end is unreachable, then reset current effect and
+      // control to that of the block's throw control node.
+      DCHECK(block->control() == BasicBlock::kThrow);
+      Node* throw_node = block->control_input();
+      control_ = NodeProperties::GetControlInput(throw_node);
+      effect_ = NodeProperties::GetEffectInput(throw_node);
     }
   }
-  return value;
+  return block;
+}
+
+void GraphAssembler::ConnectUnreachableToEnd() {
+  DCHECK_EQ(effect()->opcode(), IrOpcode::kUnreachable);
+  Node* throw_node = graph()->NewNode(common()->Throw(), effect(), control());
+  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
+  effect_ = control_ = mcgraph()->Dead();
+  if (block_updater_) {
+    block_updater_->AddThrow(throw_node);
+  }
+}
+
+Node* GraphAssembler::AddClonedNode(Node* node) {
+  DCHECK(node->op()->HasProperty(Operator::kPure));
+  if (block_updater_) {
+    node = block_updater_->AddClonedNode(node);
+  }
+
+  UpdateEffectControlWith(node);
+  return node;
+}
+
+Node* GraphAssembler::AddNode(Node* node) {
+  if (block_updater_) {
+    block_updater_->AddNode(node);
+  }
+
+  if (node->opcode() == IrOpcode::kTerminate) {
+    return node;
+  }
+
+  UpdateEffectControlWith(node);
+  return node;
+}
+
+void GraphAssembler::Reset(BasicBlock* block) {
+  effect_ = nullptr;
+  control_ = nullptr;
+  if (block_updater_) {
+    block_updater_->StartBlock(block);
+  }
 }
 
-void GraphAssembler::Reset(Node* effect, Node* control) {
-  current_effect_ = effect;
-  current_control_ = control;
+void GraphAssembler::InitializeEffectControl(Node* effect, Node* control) {
+  effect_ = effect;
+  control_ = control;
 }
 
-Operator const* GraphAssembler::ToNumberOperator() {
+Operator const* JSGraphAssembler::PlainPrimitiveToNumberOperator() {
   if (!to_number_operator_.is_set()) {
-    Callable callable =
-        Builtins::CallableFor(jsgraph()->isolate(), Builtins::kToNumber);
+    Callable callable = Builtins::CallableFor(isolate(), Builtins::kToNumber);
     CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
     auto call_descriptor = Linkage::GetStubCallDescriptor(
         graph()->zone(), callable.descriptor(),
diff --git a/deps/v8/src/compiler/graph-assembler.h b/deps/v8/src/compiler/graph-assembler.h
index d2df5a75f3a168..92c37a1860e413 100644
--- a/deps/v8/src/compiler/graph-assembler.h
+++ b/deps/v8/src/compiler/graph-assembler.h
@@ -5,6 +5,7 @@
 #ifndef V8_COMPILER_GRAPH_ASSEMBLER_H_
 #define V8_COMPILER_GRAPH_ASSEMBLER_H_
 
+#include "src/codegen/tnode.h"
 #include "src/compiler/feedback-source.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node.h"
@@ -15,107 +16,157 @@ namespace internal {
 
 class JSGraph;
 class Graph;
+class Oddball;
+
+// TODO(jgruber): Currently this is too permissive, but at least it lets us
+// document which functions expect JS booleans. If a real Boolean type becomes
+// possible in the future, use that instead.
+using Boolean = Oddball;
 
 namespace compiler {
 
-#define PURE_ASSEMBLER_MACH_UNOP_LIST(V)    \
-  V(ChangeInt32ToInt64)                     \
-  V(ChangeInt32ToFloat64)                   \
-  V(ChangeInt64ToFloat64)                   \
-  V(ChangeUint32ToFloat64)                  \
-  V(ChangeUint32ToUint64)                   \
-  V(ChangeFloat64ToInt32)                   \
-  V(ChangeFloat64ToInt64)                   \
-  V(ChangeFloat64ToUint32)                  \
-  V(TruncateInt64ToInt32)                   \
-  V(RoundFloat64ToInt32)                    \
-  V(TruncateFloat64ToInt64)                 \
-  V(TruncateFloat64ToWord32)                \
-  V(Float64ExtractLowWord32)                \
-  V(Float64ExtractHighWord32)               \
-  V(BitcastInt32ToFloat32)                  \
-  V(BitcastInt64ToFloat64)                  \
-  V(BitcastFloat32ToInt32)                  \
-  V(BitcastFloat64ToInt64)                  \
-  V(Float64Abs)                             \
-  V(Word32ReverseBytes)                     \
-  V(Word64ReverseBytes)                     \
-  V(Float64SilenceNaN)                      \
-  V(ChangeCompressedToTagged)               \
-  V(ChangeTaggedToCompressed)               \
-  V(ChangeTaggedSignedToCompressedSigned)   \
-  V(ChangeCompressedSignedToTaggedSigned)   \
-  V(ChangeTaggedPointerToCompressedPointer) \
-  V(ChangeCompressedPointerToTaggedPointer)
+class Schedule;
+class BasicBlock;
+
+#define PURE_ASSEMBLER_MACH_UNOP_LIST(V) \
+  V(BitcastFloat32ToInt32)               \
+  V(BitcastFloat64ToInt64)               \
+  V(BitcastInt32ToFloat32)               \
+  V(BitcastWord32ToWord64)               \
+  V(BitcastInt64ToFloat64)               \
+  V(ChangeFloat64ToInt32)                \
+  V(ChangeFloat64ToInt64)                \
+  V(ChangeFloat64ToUint32)               \
+  V(ChangeInt32ToFloat64)                \
+  V(ChangeInt32ToInt64)                  \
+  V(ChangeInt64ToFloat64)                \
+  V(ChangeUint32ToFloat64)               \
+  V(ChangeUint32ToUint64)                \
+  V(Float64Abs)                          \
+  V(Float64ExtractHighWord32)            \
+  V(Float64ExtractLowWord32)             \
+  V(Float64SilenceNaN)                   \
+  V(RoundFloat64ToInt32)                 \
+  V(TruncateFloat64ToInt64)              \
+  V(TruncateFloat64ToWord32)             \
+  V(TruncateInt64ToInt32)                \
+  V(Word32ReverseBytes)                  \
+  V(Word64ReverseBytes)
+
 #define PURE_ASSEMBLER_MACH_BINOP_LIST(V) \
-  V(WordShl)                              \
-  V(WordSar)                              \
-  V(WordAnd)                              \
-  V(Word32Or)                             \
-  V(Word32And)                            \
-  V(Word32Xor)                            \
-  V(Word32Shr)                            \
-  V(Word32Shl)                            \
-  V(Word32Sar)                            \
-  V(Word64And)                            \
-  V(IntAdd)                               \
-  V(IntSub)                               \
-  V(IntMul)                               \
-  V(IntLessThan)                          \
-  V(UintLessThan)                         \
+  V(Float64Add)                           \
+  V(Float64Div)                           \
+  V(Float64Equal)                         \
+  V(Float64InsertHighWord32)              \
+  V(Float64InsertLowWord32)               \
+  V(Float64LessThan)                      \
+  V(Float64LessThanOrEqual)               \
+  V(Float64Mod)                           \
+  V(Float64Sub)                           \
   V(Int32Add)                             \
-  V(Int32Sub)                             \
-  V(Int32Mul)                             \
+  V(Int32LessThan)                        \
   V(Int32LessThanOrEqual)                 \
+  V(Int32Mul)                             \
+  V(Int32Sub)                             \
+  V(Int64Sub)                             \
+  V(IntAdd)                               \
+  V(IntLessThan)                          \
+  V(IntMul)                               \
+  V(IntSub)                               \
   V(Uint32LessThan)                       \
   V(Uint32LessThanOrEqual)                \
   V(Uint64LessThan)                       \
   V(Uint64LessThanOrEqual)                \
-  V(Int32LessThan)                        \
-  V(Int64Sub)                             \
-  V(Float64Add)                           \
-  V(Float64Sub)                           \
-  V(Float64Div)                           \
-  V(Float64Mod)                           \
-  V(Float64Equal)                         \
-  V(Float64LessThan)                      \
-  V(Float64LessThanOrEqual)               \
-  V(Float64InsertLowWord32)               \
-  V(Float64InsertHighWord32)              \
+  V(UintLessThan)                         \
+  V(Word32And)                            \
   V(Word32Equal)                          \
+  V(Word32Or)                             \
+  V(Word32Sar)                            \
+  V(Word32Shl)                            \
+  V(Word32Shr)                            \
+  V(Word32Xor)                            \
+  V(Word64And)                            \
   V(Word64Equal)                          \
-  V(WordEqual)
+  V(WordAnd)                              \
+  V(WordEqual)                            \
+  V(WordSar)                              \
+  V(WordShl)
 
 #define CHECKED_ASSEMBLER_MACH_BINOP_LIST(V) \
   V(Int32AddWithOverflow)                    \
-  V(Int32SubWithOverflow)                    \
-  V(Int32MulWithOverflow)                    \
-  V(Int32Mod)                                \
   V(Int32Div)                                \
-  V(Uint32Mod)                               \
-  V(Uint32Div)
-
-#define JSGRAPH_SINGLETON_CONSTANT_LIST(V)        \
-  V(TrueConstant)                                 \
-  V(FalseConstant)                                \
-  V(NullConstant)                                 \
-  V(BigIntMapConstant)                            \
-  V(BooleanMapConstant)                           \
-  V(HeapNumberMapConstant)                        \
-  V(NoContextConstant)                            \
-  V(EmptyStringConstant)                          \
-  V(UndefinedConstant)                            \
-  V(TheHoleConstant)                              \
-  V(FixedArrayMapConstant)                        \
-  V(FixedDoubleArrayMapConstant)                  \
-  V(ToNumberBuiltinConstant)                      \
-  V(AllocateInYoungGenerationStubConstant)        \
-  V(AllocateRegularInYoungGenerationStubConstant) \
-  V(AllocateInOldGenerationStubConstant)          \
-  V(AllocateRegularInOldGenerationStubConstant)
+  V(Int32Mod)                                \
+  V(Int32MulWithOverflow)                    \
+  V(Int32SubWithOverflow)                    \
+  V(Uint32Div)                               \
+  V(Uint32Mod)
+
+#define JSGRAPH_SINGLETON_CONSTANT_LIST(V)      \
+  V(AllocateInOldGenerationStub, Code)          \
+  V(AllocateInYoungGenerationStub, Code)        \
+  V(AllocateRegularInOldGenerationStub, Code)   \
+  V(AllocateRegularInYoungGenerationStub, Code) \
+  V(BigIntMap, Map)                             \
+  V(BooleanMap, Map)                            \
+  V(EmptyString, String)                        \
+  V(False, Boolean)                             \
+  V(FixedArrayMap, Map)                         \
+  V(FixedDoubleArrayMap, Map)                   \
+  V(HeapNumberMap, Map)                         \
+  V(MinusOne, Number)                           \
+  V(NaN, Number)                                \
+  V(NoContext, Object)                          \
+  V(Null, Oddball)                              \
+  V(One, Number)                                \
+  V(TheHole, Oddball)                           \
+  V(ToNumberBuiltin, Code)                      \
+  V(True, Boolean)                              \
+  V(Undefined, Oddball)                         \
+  V(Zero, Number)
 
 class GraphAssembler;
 
+// Wrapper classes for special node/edge types (effect, control, frame states)
+// that otherwise don't fit into the type system.
+
+class NodeWrapper {
+ public:
+  explicit constexpr NodeWrapper(Node* node) : node_(node) {}
+  operator Node*() const { return node_; }
+  Node* operator->() const { return node_; }
+
+ private:
+  Node* node_;
+};
+
+class Effect : public NodeWrapper {
+ public:
+  explicit constexpr Effect(Node* node) : NodeWrapper(node) {
+    // TODO(jgruber): Remove the End special case.
+    SLOW_DCHECK(node == nullptr || node->op()->opcode() == IrOpcode::kEnd ||
+                node->op()->EffectOutputCount() > 0);
+  }
+};
+
+class Control : public NodeWrapper {
+ public:
+  explicit constexpr Control(Node* node) : NodeWrapper(node) {
+    // TODO(jgruber): Remove the End special case.
+    SLOW_DCHECK(node == nullptr || node->opcode() == IrOpcode::kEnd ||
+                node->op()->ControlOutputCount() > 0);
+  }
+};
+
+class FrameState : public NodeWrapper {
+ public:
+  explicit constexpr FrameState(Node* node) : NodeWrapper(node) {
+    // TODO(jgruber): Disallow kStart (needed for PromiseConstructorBasic unit
+    // test, among others).
+    SLOW_DCHECK(node->opcode() == IrOpcode::kFrameState ||
+                node->opcode() == IrOpcode::kStart);
+  }
+};
+
 enum class GraphAssemblerLabelType { kDeferred, kNonDeferred, kLoop };
 
 // Label with statically known count of incoming branches and phis.
@@ -124,17 +175,21 @@ class GraphAssemblerLabel {
  public:
   Node* PhiAt(size_t index);
 
-  template <typename... Reps>
-  explicit GraphAssemblerLabel(GraphAssemblerLabelType type, Reps... reps)
-      : type_(type) {
-    STATIC_ASSERT(VarCount == sizeof...(reps));
-    MachineRepresentation reps_array[] = {MachineRepresentation::kNone,
-                                          reps...};
-    for (size_t i = 0; i < VarCount; i++) {
-      representations_[i] = reps_array[i + 1];
-    }
+  template <typename T>
+  TNode<T> PhiAt(size_t index) {
+    // TODO(jgruber): Investigate issues on ptr compression bots and enable.
+    // DCHECK(IsMachineRepresentationOf<T>(representations_[index]));
+    return TNode<T>::UncheckedCast(PhiAt(index));
   }
 
+  GraphAssemblerLabel(GraphAssemblerLabelType type, BasicBlock* basic_block,
+                      int loop_nesting_level,
+                      const std::array<MachineRepresentation, VarCount>& reps)
+      : type_(type),
+        basic_block_(basic_block),
+        loop_nesting_level_(loop_nesting_level),
+        representations_(reps) {}
+
   ~GraphAssemblerLabel() { DCHECK(IsBound() || merged_count_ == 0); }
 
  private:
@@ -149,66 +204,79 @@ class GraphAssemblerLabel {
     return type_ == GraphAssemblerLabelType::kDeferred;
   }
   bool IsLoop() const { return type_ == GraphAssemblerLabelType::kLoop; }
+  BasicBlock* basic_block() { return basic_block_; }
 
   bool is_bound_ = false;
-  GraphAssemblerLabelType const type_;
+  const GraphAssemblerLabelType type_;
+  BasicBlock* const basic_block_;
+  const int loop_nesting_level_;
   size_t merged_count_ = 0;
   Node* effect_;
   Node* control_;
-  Node* bindings_[VarCount + 1];
-  MachineRepresentation representations_[VarCount + 1];
+  std::array<Node*, VarCount> bindings_;
+  const std::array<MachineRepresentation, VarCount> representations_;
 };
 
-class GraphAssembler {
+class V8_EXPORT_PRIVATE GraphAssembler {
  public:
-  GraphAssembler(JSGraph* jsgraph, Node* effect, Node* control, Zone* zone);
+  // Constructs a GraphAssembler. If {schedule} is not null, the graph assembler
+  // will maintain the schedule as it updates blocks.
+  GraphAssembler(MachineGraph* jsgraph, Zone* zone,
+                 Schedule* schedule = nullptr, bool mark_loop_exits = false);
+  virtual ~GraphAssembler();
 
-  void Reset(Node* effect, Node* control);
+  void Reset(BasicBlock* block);
+  void InitializeEffectControl(Node* effect, Node* control);
 
   // Create label.
   template <typename... Reps>
-  static GraphAssemblerLabel<sizeof...(Reps)> MakeLabelFor(
+  GraphAssemblerLabel<sizeof...(Reps)> MakeLabelFor(
       GraphAssemblerLabelType type, Reps... reps) {
-    return GraphAssemblerLabel<sizeof...(Reps)>(type, reps...);
+    std::array<MachineRepresentation, sizeof...(Reps)> reps_array = {reps...};
+    return MakeLabel<sizeof...(Reps)>(reps_array, type);
+  }
+
+  // As above, but with an std::array of machine representations.
+  template <int VarCount>
+  GraphAssemblerLabel<VarCount> MakeLabel(
+      std::array<MachineRepresentation, VarCount> reps_array,
+      GraphAssemblerLabelType type) {
+    return GraphAssemblerLabel<VarCount>(
+        type, NewBasicBlock(type == GraphAssemblerLabelType::kDeferred),
+        loop_nesting_level_, reps_array);
   }
 
   // Convenience wrapper for creating non-deferred labels.
   template <typename... Reps>
-  static GraphAssemblerLabel<sizeof...(Reps)> MakeLabel(Reps... reps) {
+  GraphAssemblerLabel<sizeof...(Reps)> MakeLabel(Reps... reps) {
     return MakeLabelFor(GraphAssemblerLabelType::kNonDeferred, reps...);
   }
 
   // Convenience wrapper for creating loop labels.
   template <typename... Reps>
-  static GraphAssemblerLabel<sizeof...(Reps)> MakeLoopLabel(Reps... reps) {
+  GraphAssemblerLabel<sizeof...(Reps)> MakeLoopLabel(Reps... reps) {
     return MakeLabelFor(GraphAssemblerLabelType::kLoop, reps...);
   }
 
   // Convenience wrapper for creating deferred labels.
   template <typename... Reps>
-  static GraphAssemblerLabel<sizeof...(Reps)> MakeDeferredLabel(Reps... reps) {
+  GraphAssemblerLabel<sizeof...(Reps)> MakeDeferredLabel(Reps... reps) {
     return MakeLabelFor(GraphAssemblerLabelType::kDeferred, reps...);
   }
 
   // Value creation.
   Node* IntPtrConstant(intptr_t value);
-  Node* Uint32Constant(int32_t value);
+  Node* Uint32Constant(uint32_t value);
   Node* Int32Constant(int32_t value);
   Node* Int64Constant(int64_t value);
   Node* UniqueIntPtrConstant(intptr_t value);
-  Node* SmiConstant(int32_t value);
   Node* Float64Constant(double value);
   Node* Projection(int index, Node* value);
-  Node* HeapConstant(Handle<HeapObject> object);
-  Node* NumberConstant(double value);
-  Node* CEntryStubConstant(int result_size);
   Node* ExternalConstant(ExternalReference ref);
 
   Node* LoadFramePointer();
 
-#define SINGLETON_CONST_DECL(Name) Node* Name();
-  JSGRAPH_SINGLETON_CONSTANT_LIST(SINGLETON_CONST_DECL)
-#undef SINGLETON_CONST_DECL
+  Node* LoadHeapNumberValue(Node* heap_number);
 
 #define PURE_UNOP_DECL(Name) Node* Name(Node* input);
   PURE_ASSEMBLER_MACH_UNOP_LIST(PURE_UNOP_DECL)
@@ -227,19 +295,18 @@ class GraphAssembler {
   Node* IntPtrEqual(Node* left, Node* right);
   Node* TaggedEqual(Node* left, Node* right);
 
+  Node* SmiSub(Node* left, Node* right);
+  Node* SmiLessThan(Node* left, Node* right);
+
   Node* Float64RoundDown(Node* value);
   Node* Float64RoundTruncate(Node* value);
 
-  Node* ToNumber(Node* value);
   Node* BitcastWordToTagged(Node* value);
   Node* BitcastTaggedToWord(Node* value);
   Node* BitcastTaggedToWordForTagAndSmiBits(Node* value);
-  Node* Allocate(AllocationType allocation, Node* size);
-  Node* LoadField(FieldAccess const&, Node* object);
-  Node* LoadElement(ElementAccess const&, Node* object, Node* index);
-  Node* StoreField(FieldAccess const&, Node* object, Node* value);
-  Node* StoreElement(ElementAccess const&, Node* object, Node* index,
-                     Node* value);
+
+  Node* TypeGuard(Type type, Node* value);
+  Node* Checkpoint(FrameState frame_state);
 
   Node* Store(StoreRepresentation rep, Node* object, Node* offset, Node* value);
   Node* Load(MachineType type, Node* object, Node* offset);
@@ -273,9 +340,21 @@ class GraphAssembler {
   template <typename... Vars>
   void Goto(GraphAssemblerLabel<sizeof...(Vars)>* label, Vars...);
 
-  void Branch(Node* condition, GraphAssemblerLabel<0u>* if_true,
-              GraphAssemblerLabel<0u>* if_false,
-              IsSafetyCheck is_safety_check = IsSafetyCheck::kNoSafetyCheck);
+  // Branch hints are inferred from if_true/if_false deferred states.
+  void BranchWithCriticalSafetyCheck(Node* condition,
+                                     GraphAssemblerLabel<0u>* if_true,
+                                     GraphAssemblerLabel<0u>* if_false);
+
+  // Branch hints are inferred from if_true/if_false deferred states.
+  template <typename... Vars>
+  void Branch(Node* condition, GraphAssemblerLabel<sizeof...(Vars)>* if_true,
+              GraphAssemblerLabel<sizeof...(Vars)>* if_false, Vars...);
+
+  template <typename... Vars>
+  void BranchWithHint(Node* condition,
+                      GraphAssemblerLabel<sizeof...(Vars)>* if_true,
+                      GraphAssemblerLabel<sizeof...(Vars)>* if_false,
+                      BranchHint hint, Vars...);
 
   // Control helpers.
   // {GotoIf(c, l)} is equivalent to {Branch(c, l, templ);Bind(templ)}.
@@ -288,37 +367,152 @@ class GraphAssembler {
   void GotoIfNot(Node* condition, GraphAssemblerLabel<sizeof...(Vars)>* label,
                  Vars...);
 
-  // Extractors (should be only used when destructing/resetting the assembler).
-  Node* ExtractCurrentControl();
-  Node* ExtractCurrentEffect();
+  // Updates current effect and control based on outputs of {node}.
+  V8_INLINE void UpdateEffectControlWith(Node* node) {
+    if (node->op()->EffectOutputCount() > 0) {
+      effect_ = node;
+    }
+    if (node->op()->ControlOutputCount() > 0) {
+      control_ = node;
+    }
+  }
+
+  // Adds {node} to the current position and updates assembler's current effect
+  // and control.
+  Node* AddNode(Node* node);
+
+  template <typename T>
+  TNode<T> AddNode(Node* node) {
+    return TNode<T>::UncheckedCast(AddNode(node));
+  }
+
+  // Finalizes the {block} being processed by the assembler, returning the
+  // finalized block (which may be different from the original block).
+  BasicBlock* FinalizeCurrentBlock(BasicBlock* block);
+
+  void ConnectUnreachableToEnd();
+
+  Control control() { return Control(control_); }
+  Effect effect() { return Effect(effect_); }
+
+ protected:
+  class BasicBlockUpdater;
 
- private:
-  // Adds a decompression node if pointer compression is enabled and the
-  // representation loaded is a compressed one. To be used after loads.
-  Node* InsertDecompressionIfNeeded(MachineRepresentation rep, Node* value);
-  // Adds a compression node if pointer compression is enabled and the
-  // representation to be stored is a compressed one. To be used before stores.
-  Node* InsertCompressionIfNeeded(MachineRepresentation rep, Node* value);
   template <typename... Vars>
   void MergeState(GraphAssemblerLabel<sizeof...(Vars)>* label, Vars... vars);
+  BasicBlock* NewBasicBlock(bool deferred);
+  void BindBasicBlock(BasicBlock* block);
+  void GotoBasicBlock(BasicBlock* block);
+  void GotoIfBasicBlock(BasicBlock* block, Node* branch,
+                        IrOpcode::Value goto_if);
 
-  Operator const* ToNumberOperator();
+  V8_INLINE Node* AddClonedNode(Node* node);
 
-  JSGraph* jsgraph() const { return jsgraph_; }
-  Isolate* isolate() const { return jsgraph_->isolate(); }
-  Graph* graph() const { return jsgraph_->graph(); }
+  MachineGraph* mcgraph() const { return mcgraph_; }
+  Graph* graph() const { return mcgraph_->graph(); }
   Zone* temp_zone() const { return temp_zone_; }
-  CommonOperatorBuilder* common() const { return jsgraph()->common(); }
-  MachineOperatorBuilder* machine() const { return jsgraph()->machine(); }
-  SimplifiedOperatorBuilder* simplified() const {
-    return jsgraph()->simplified();
-  }
+  CommonOperatorBuilder* common() const { return mcgraph()->common(); }
+  MachineOperatorBuilder* machine() const { return mcgraph()->machine(); }
+
+  // Updates machinery for creating {LoopExit,LoopExitEffect,LoopExitValue}
+  // nodes on loop exits (which are necessary for loop peeling).
+  //
+  // All labels created while a LoopScope is live are considered to be inside
+  // the loop.
+  template <MachineRepresentation... Reps>
+  class LoopScope final {
+   private:
+    // The internal scope is only here to increment the graph assembler's
+    // nesting level prior to `loop_header_label` creation below.
+    class LoopScopeInternal {
+     public:
+      explicit LoopScopeInternal(GraphAssembler* gasm)
+          : previous_loop_nesting_level_(gasm->loop_nesting_level_),
+            gasm_(gasm) {
+        gasm->loop_nesting_level_++;
+      }
+
+      ~LoopScopeInternal() {
+        gasm_->loop_nesting_level_--;
+        DCHECK_EQ(gasm_->loop_nesting_level_, previous_loop_nesting_level_);
+      }
+
+     private:
+      const int previous_loop_nesting_level_;
+      GraphAssembler* const gasm_;
+    };
+
+   public:
+    explicit LoopScope(GraphAssembler* gasm)
+        : internal_scope_(gasm),
+          gasm_(gasm),
+          loop_header_label_(gasm->MakeLoopLabel(Reps...)) {
+      // This feature may only be used if it has been enabled.
+      DCHECK(gasm_->mark_loop_exits_);
+      gasm->loop_headers_.push_back(&loop_header_label_.control_);
+      DCHECK_EQ(static_cast<int>(gasm_->loop_headers_.size()),
+                gasm_->loop_nesting_level_);
+    }
+
+    ~LoopScope() {
+      DCHECK_EQ(static_cast<int>(gasm_->loop_headers_.size()),
+                gasm_->loop_nesting_level_);
+      gasm_->loop_headers_.pop_back();
+    }
+
+    GraphAssemblerLabel<sizeof...(Reps)>* loop_header_label() {
+      return &loop_header_label_;
+    }
+
+   private:
+    const LoopScopeInternal internal_scope_;
+    GraphAssembler* const gasm_;
+    GraphAssemblerLabel<sizeof...(Reps)> loop_header_label_;
+  };
+
+  // Upon destruction, restores effect and control to the state at construction.
+  class RestoreEffectControlScope {
+   public:
+    explicit RestoreEffectControlScope(GraphAssembler* gasm)
+        : gasm_(gasm), effect_(gasm->effect()), control_(gasm->control()) {}
+
+    ~RestoreEffectControlScope() {
+      gasm_->effect_ = effect_;
+      gasm_->control_ = control_;
+    }
+
+   private:
+    GraphAssembler* const gasm_;
+    const Effect effect_;
+    const Control control_;
+  };
+
+ private:
+  template <typename... Vars>
+  void BranchImpl(Node* condition,
+                  GraphAssemblerLabel<sizeof...(Vars)>* if_true,
+                  GraphAssemblerLabel<sizeof...(Vars)>* if_false,
+                  BranchHint hint, IsSafetyCheck is_safety_check, Vars...);
+  void RecordBranchInBlockUpdater(Node* branch, Node* if_true_control,
+                                  Node* if_false_control,
+                                  BasicBlock* if_true_block,
+                                  BasicBlock* if_false_block);
 
-  SetOncePointer<Operator const> to_number_operator_;
   Zone* temp_zone_;
-  JSGraph* jsgraph_;
-  Node* current_effect_;
-  Node* current_control_;
+  MachineGraph* mcgraph_;
+  Node* effect_;
+  Node* control_;
+  std::unique_ptr<BasicBlockUpdater> block_updater_;
+
+  // Track loop information in order to properly mark loop exits with
+  // {LoopExit,LoopExitEffect,LoopExitValue} nodes. The outermost level has
+  // a nesting level of 0. See also GraphAssembler::LoopScope.
+  int loop_nesting_level_ = 0;
+  ZoneVector<Node**> loop_headers_;
+
+  // Feature configuration. As more features are added, this should be turned
+  // into a bitfield.
+  const bool mark_loop_exits_;
 };
 
 template <size_t VarCount>
@@ -331,69 +525,95 @@ Node* GraphAssemblerLabel<VarCount>::PhiAt(size_t index) {
 template <typename... Vars>
 void GraphAssembler::MergeState(GraphAssemblerLabel<sizeof...(Vars)>* label,
                                 Vars... vars) {
-  int merged_count = static_cast<int>(label->merged_count_);
-  Node* var_array[] = {nullptr, vars...};
+  RestoreEffectControlScope restore_effect_control_scope(this);
+
+  const int merged_count = static_cast<int>(label->merged_count_);
+  static constexpr int kVarCount = sizeof...(vars);
+  std::array<Node*, kVarCount> var_array = {vars...};
+
+  const bool is_loop_exit = label->loop_nesting_level_ != loop_nesting_level_;
+  if (is_loop_exit) {
+    // This feature may only be used if it has been enabled.
+    USE(mark_loop_exits_);
+    DCHECK(mark_loop_exits_);
+    // Jumping from loops to loops not supported.
+    DCHECK(!label->IsLoop());
+    // Currently only the simple case of jumping one level is supported.
+    DCHECK_EQ(label->loop_nesting_level_, loop_nesting_level_ - 1);
+    DCHECK(!loop_headers_.empty());
+    DCHECK_NOT_NULL(*loop_headers_.back());
+
+    // Mark this exit to enable loop peeling.
+    AddNode(graph()->NewNode(common()->LoopExit(), control(),
+                             *loop_headers_.back()));
+    AddNode(graph()->NewNode(common()->LoopExitEffect(), effect(), control()));
+    for (size_t i = 0; i < kVarCount; i++) {
+      var_array[i] = AddNode(
+          graph()->NewNode(common()->LoopExitValue(), var_array[i], control()));
+    }
+  }
+
   if (label->IsLoop()) {
     if (merged_count == 0) {
       DCHECK(!label->IsBound());
-      label->control_ = graph()->NewNode(common()->Loop(2), current_control_,
-                                         current_control_);
-      label->effect_ = graph()->NewNode(common()->EffectPhi(2), current_effect_,
-                                        current_effect_, label->control_);
+      label->control_ =
+          graph()->NewNode(common()->Loop(2), control(), control());
+      label->effect_ = graph()->NewNode(common()->EffectPhi(2), effect(),
+                                        effect(), label->control_);
       Node* terminate = graph()->NewNode(common()->Terminate(), label->effect_,
                                          label->control_);
       NodeProperties::MergeControlToEnd(graph(), common(), terminate);
-      for (size_t i = 0; i < sizeof...(vars); i++) {
-        label->bindings_[i] = graph()->NewNode(
-            common()->Phi(label->representations_[i], 2), var_array[i + 1],
-            var_array[i + 1], label->control_);
+      for (size_t i = 0; i < kVarCount; i++) {
+        label->bindings_[i] =
+            graph()->NewNode(common()->Phi(label->representations_[i], 2),
+                             var_array[i], var_array[i], label->control_);
       }
     } else {
       DCHECK(label->IsBound());
       DCHECK_EQ(1, merged_count);
-      label->control_->ReplaceInput(1, current_control_);
-      label->effect_->ReplaceInput(1, current_effect_);
-      for (size_t i = 0; i < sizeof...(vars); i++) {
-        label->bindings_[i]->ReplaceInput(1, var_array[i + 1]);
+      label->control_->ReplaceInput(1, control());
+      label->effect_->ReplaceInput(1, effect());
+      for (size_t i = 0; i < kVarCount; i++) {
+        label->bindings_[i]->ReplaceInput(1, var_array[i]);
       }
     }
   } else {
+    DCHECK(!label->IsLoop());
     DCHECK(!label->IsBound());
     if (merged_count == 0) {
       // Just set the control, effect and variables directly.
-      DCHECK(!label->IsBound());
-      label->control_ = current_control_;
-      label->effect_ = current_effect_;
-      for (size_t i = 0; i < sizeof...(vars); i++) {
-        label->bindings_[i] = var_array[i + 1];
+      label->control_ = control();
+      label->effect_ = effect();
+      for (size_t i = 0; i < kVarCount; i++) {
+        label->bindings_[i] = var_array[i];
       }
     } else if (merged_count == 1) {
       // Create merge, effect phi and a phi for each variable.
-      label->control_ = graph()->NewNode(common()->Merge(2), label->control_,
-                                         current_control_);
+      label->control_ =
+          graph()->NewNode(common()->Merge(2), label->control_, control());
       label->effect_ = graph()->NewNode(common()->EffectPhi(2), label->effect_,
-                                        current_effect_, label->control_);
-      for (size_t i = 0; i < sizeof...(vars); i++) {
+                                        effect(), label->control_);
+      for (size_t i = 0; i < kVarCount; i++) {
         label->bindings_[i] = graph()->NewNode(
             common()->Phi(label->representations_[i], 2), label->bindings_[i],
-            var_array[i + 1], label->control_);
+            var_array[i], label->control_);
       }
     } else {
       // Append to the merge, effect phi and phis.
       DCHECK_EQ(IrOpcode::kMerge, label->control_->opcode());
-      label->control_->AppendInput(graph()->zone(), current_control_);
+      label->control_->AppendInput(graph()->zone(), control());
       NodeProperties::ChangeOp(label->control_,
                                common()->Merge(merged_count + 1));
 
       DCHECK_EQ(IrOpcode::kEffectPhi, label->effect_->opcode());
-      label->effect_->ReplaceInput(merged_count, current_effect_);
+      label->effect_->ReplaceInput(merged_count, effect());
       label->effect_->AppendInput(graph()->zone(), label->control_);
       NodeProperties::ChangeOp(label->effect_,
                                common()->EffectPhi(merged_count + 1));
 
-      for (size_t i = 0; i < sizeof...(vars); i++) {
+      for (size_t i = 0; i < kVarCount; i++) {
         DCHECK_EQ(IrOpcode::kPhi, label->bindings_[i]->opcode());
-        label->bindings_[i]->ReplaceInput(merged_count, var_array[i + 1]);
+        label->bindings_[i]->ReplaceInput(merged_count, var_array[i]);
         label->bindings_[i]->AppendInput(graph()->zone(), label->control_);
         NodeProperties::ChangeOp(
             label->bindings_[i],
@@ -406,24 +626,91 @@ void GraphAssembler::MergeState(GraphAssemblerLabel<sizeof...(Vars)>* label,
 
 template <size_t VarCount>
 void GraphAssembler::Bind(GraphAssemblerLabel<VarCount>* label) {
-  DCHECK_NULL(current_control_);
-  DCHECK_NULL(current_effect_);
+  DCHECK_NULL(control());
+  DCHECK_NULL(effect());
   DCHECK_LT(0, label->merged_count_);
+  DCHECK_EQ(label->loop_nesting_level_, loop_nesting_level_);
 
-  current_control_ = label->control_;
-  current_effect_ = label->effect_;
+  control_ = label->control_;
+  effect_ = label->effect_;
+  BindBasicBlock(label->basic_block());
 
   label->SetBound();
+
+  if (label->merged_count_ > 1 || label->IsLoop()) {
+    AddNode(label->control_);
+    AddNode(label->effect_);
+    for (size_t i = 0; i < VarCount; i++) {
+      AddNode(label->bindings_[i]);
+    }
+  } else {
+    // If the basic block does not have a control node, insert a dummy
+    // Merge node, so that other passes have a control node to start from.
+    control_ = AddNode(graph()->NewNode(common()->Merge(1), control()));
+  }
+}
+
+template <typename... Vars>
+void GraphAssembler::Branch(Node* condition,
+                            GraphAssemblerLabel<sizeof...(Vars)>* if_true,
+                            GraphAssemblerLabel<sizeof...(Vars)>* if_false,
+                            Vars... vars) {
+  BranchHint hint = BranchHint::kNone;
+  if (if_true->IsDeferred() != if_false->IsDeferred()) {
+    hint = if_false->IsDeferred() ? BranchHint::kTrue : BranchHint::kFalse;
+  }
+
+  BranchImpl(condition, if_true, if_false, hint, IsSafetyCheck::kNoSafetyCheck,
+             vars...);
+}
+
+template <typename... Vars>
+void GraphAssembler::BranchWithHint(
+    Node* condition, GraphAssemblerLabel<sizeof...(Vars)>* if_true,
+    GraphAssemblerLabel<sizeof...(Vars)>* if_false, BranchHint hint,
+    Vars... vars) {
+  BranchImpl(condition, if_true, if_false, hint, IsSafetyCheck::kNoSafetyCheck,
+             vars...);
+}
+
+template <typename... Vars>
+void GraphAssembler::BranchImpl(Node* condition,
+                                GraphAssemblerLabel<sizeof...(Vars)>* if_true,
+                                GraphAssemblerLabel<sizeof...(Vars)>* if_false,
+                                BranchHint hint, IsSafetyCheck is_safety_check,
+                                Vars... vars) {
+  DCHECK_NOT_NULL(control());
+
+  Node* branch = graph()->NewNode(common()->Branch(hint, is_safety_check),
+                                  condition, control());
+
+  Node* if_true_control = control_ =
+      graph()->NewNode(common()->IfTrue(), branch);
+  MergeState(if_true, vars...);
+
+  Node* if_false_control = control_ =
+      graph()->NewNode(common()->IfFalse(), branch);
+  MergeState(if_false, vars...);
+
+  if (block_updater_) {
+    RecordBranchInBlockUpdater(branch, if_true_control, if_false_control,
+                               if_true->basic_block(), if_false->basic_block());
+  }
+
+  control_ = nullptr;
+  effect_ = nullptr;
 }
 
 template <typename... Vars>
 void GraphAssembler::Goto(GraphAssemblerLabel<sizeof...(Vars)>* label,
                           Vars... vars) {
-  DCHECK_NOT_NULL(current_control_);
-  DCHECK_NOT_NULL(current_effect_);
+  DCHECK_NOT_NULL(control());
+  DCHECK_NOT_NULL(effect());
   MergeState(label, vars...);
-  current_control_ = nullptr;
-  current_effect_ = nullptr;
+  GotoBasicBlock(label->basic_block());
+
+  control_ = nullptr;
+  effect_ = nullptr;
 }
 
 template <typename... Vars>
@@ -432,13 +719,13 @@ void GraphAssembler::GotoIf(Node* condition,
                             Vars... vars) {
   BranchHint hint =
       label->IsDeferred() ? BranchHint::kFalse : BranchHint::kNone;
-  Node* branch =
-      graph()->NewNode(common()->Branch(hint), condition, current_control_);
+  Node* branch = graph()->NewNode(common()->Branch(hint), condition, control());
 
-  current_control_ = graph()->NewNode(common()->IfTrue(), branch);
+  control_ = graph()->NewNode(common()->IfTrue(), branch);
   MergeState(label, vars...);
 
-  current_control_ = graph()->NewNode(common()->IfFalse(), branch);
+  GotoIfBasicBlock(label->basic_block(), branch, IrOpcode::kIfTrue);
+  control_ = AddNode(graph()->NewNode(common()->IfFalse(), branch));
 }
 
 template <typename... Vars>
@@ -446,13 +733,13 @@ void GraphAssembler::GotoIfNot(Node* condition,
                                GraphAssemblerLabel<sizeof...(Vars)>* label,
                                Vars... vars) {
   BranchHint hint = label->IsDeferred() ? BranchHint::kTrue : BranchHint::kNone;
-  Node* branch =
-      graph()->NewNode(common()->Branch(hint), condition, current_control_);
+  Node* branch = graph()->NewNode(common()->Branch(hint), condition, control());
 
-  current_control_ = graph()->NewNode(common()->IfFalse(), branch);
+  control_ = graph()->NewNode(common()->IfFalse(), branch);
   MergeState(label, vars...);
 
-  current_control_ = graph()->NewNode(common()->IfTrue(), branch);
+  GotoIfBasicBlock(label->basic_block(), branch, IrOpcode::kIfFalse);
+  control_ = AddNode(graph()->NewNode(common()->IfTrue(), branch));
 }
 
 template <typename... Args>
@@ -465,15 +752,97 @@ Node* GraphAssembler::Call(const CallDescriptor* call_descriptor,
 template <typename... Args>
 Node* GraphAssembler::Call(const Operator* op, Args... args) {
   DCHECK_EQ(IrOpcode::kCall, op->opcode());
-  Node* args_array[] = {args..., current_effect_, current_control_};
+  Node* args_array[] = {args..., effect(), control()};
   int size = static_cast<int>(sizeof...(args)) + op->EffectInputCount() +
              op->ControlInputCount();
-  Node* call = graph()->NewNode(op, size, args_array);
-  DCHECK_EQ(0, op->ControlOutputCount());
-  current_effect_ = call;
-  return call;
+  return AddNode(graph()->NewNode(op, size, args_array));
 }
 
+class V8_EXPORT_PRIVATE JSGraphAssembler : public GraphAssembler {
+ public:
+  // Constructs a JSGraphAssembler. If {schedule} is not null, the graph
+  // assembler will maintain the schedule as it updates blocks.
+  JSGraphAssembler(JSGraph* jsgraph, Zone* zone, Schedule* schedule = nullptr,
+                   bool mark_loop_exits = false)
+      : GraphAssembler(jsgraph, zone, schedule, mark_loop_exits),
+        jsgraph_(jsgraph) {}
+
+  Node* SmiConstant(int32_t value);
+  TNode<HeapObject> HeapConstant(Handle<HeapObject> object);
+  TNode<Object> Constant(const ObjectRef& ref);
+  TNode<Number> NumberConstant(double value);
+  Node* CEntryStubConstant(int result_size);
+
+#define SINGLETON_CONST_DECL(Name, Type) TNode<Type> Name##Constant();
+  JSGRAPH_SINGLETON_CONSTANT_LIST(SINGLETON_CONST_DECL)
+#undef SINGLETON_CONST_DECL
+
+#define SINGLETON_CONST_TEST_DECL(Name, ...) \
+  TNode<Boolean> Is##Name(TNode<Object> value);
+  JSGRAPH_SINGLETON_CONSTANT_LIST(SINGLETON_CONST_TEST_DECL)
+#undef SINGLETON_CONST_TEST_DECL
+
+  Node* Allocate(AllocationType allocation, Node* size);
+  Node* LoadField(FieldAccess const&, Node* object);
+  template <typename T>
+  TNode<T> LoadField(FieldAccess const& access, TNode<HeapObject> object) {
+    // TODO(jgruber): Investigate issues on ptr compression bots and enable.
+    // DCHECK(IsMachineRepresentationOf<T>(
+    //     access.machine_type.representation()));
+    return TNode<T>::UncheckedCast(LoadField(access, object));
+  }
+  Node* LoadElement(ElementAccess const&, Node* object, Node* index);
+  template <typename T>
+  TNode<T> LoadElement(ElementAccess const& access, TNode<HeapObject> object,
+                       TNode<Number> index) {
+    // TODO(jgruber): Investigate issues on ptr compression bots and enable.
+    // DCHECK(IsMachineRepresentationOf<T>(
+    //     access.machine_type.representation()));
+    return TNode<T>::UncheckedCast(LoadElement(access, object, index));
+  }
+  Node* StoreField(FieldAccess const&, Node* object, Node* value);
+  Node* StoreElement(ElementAccess const&, Node* object, Node* index,
+                     Node* value);
+  void TransitionAndStoreElement(MapRef double_map, MapRef fast_map,
+                                 TNode<HeapObject> object, TNode<Number> index,
+                                 TNode<Object> value);
+  TNode<Number> StringLength(TNode<String> string);
+  TNode<Boolean> ReferenceEqual(TNode<Object> lhs, TNode<Object> rhs);
+  TNode<Number> PlainPrimitiveToNumber(TNode<Object> value);
+  TNode<Number> NumberMin(TNode<Number> lhs, TNode<Number> rhs);
+  TNode<Number> NumberMax(TNode<Number> lhs, TNode<Number> rhs);
+  TNode<Boolean> NumberLessThan(TNode<Number> lhs, TNode<Number> rhs);
+  TNode<Boolean> NumberLessThanOrEqual(TNode<Number> lhs, TNode<Number> rhs);
+  TNode<Number> NumberAdd(TNode<Number> lhs, TNode<Number> rhs);
+  TNode<Number> NumberSubtract(TNode<Number> lhs, TNode<Number> rhs);
+  TNode<String> StringSubstring(TNode<String> string, TNode<Number> from,
+                                TNode<Number> to);
+  TNode<Boolean> ObjectIsCallable(TNode<Object> value);
+  Node* CheckIf(Node* cond, DeoptimizeReason reason);
+  TNode<Boolean> NumberIsFloat64Hole(TNode<Number> value);
+  TNode<Boolean> ToBoolean(TNode<Object> value);
+  TNode<Object> ConvertTaggedHoleToUndefined(TNode<Object> value);
+  TNode<FixedArrayBase> MaybeGrowFastElements(ElementsKind kind,
+                                              const FeedbackSource& feedback,
+                                              TNode<JSArray> array,
+                                              TNode<FixedArrayBase> elements,
+                                              TNode<Number> new_length,
+                                              TNode<Number> old_length);
+
+  JSGraph* jsgraph() const { return jsgraph_; }
+  Isolate* isolate() const { return jsgraph()->isolate(); }
+  SimplifiedOperatorBuilder* simplified() const {
+    return jsgraph()->simplified();
+  }
+
+ protected:
+  Operator const* PlainPrimitiveToNumberOperator();
+
+ private:
+  JSGraph* jsgraph_;
+  SetOncePointer<Operator const> to_number_operator_;
+};
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/graph-reducer.cc b/deps/v8/src/compiler/graph-reducer.cc
index 9a0dea6b260fe1..91b4b51c91b650 100644
--- a/deps/v8/src/compiler/graph-reducer.cc
+++ b/deps/v8/src/compiler/graph-reducer.cc
@@ -94,7 +94,8 @@ Reduction GraphReducer::Reduce(Node* const node) {
         // all the other reducers for this node, as now there may be more
         // opportunities for reduction.
         if (FLAG_trace_turbo_reduction) {
-          StdoutStream{} << "- In-place update of " << *node << " by reducer "
+          AllowHandleDereference allow_deref;
+          StdoutStream{} << "- In-place update of #" << *node << " by reducer "
                          << (*i)->reducer_name() << std::endl;
         }
         skip = i;
@@ -103,7 +104,8 @@ Reduction GraphReducer::Reduce(Node* const node) {
       } else {
         // {node} was replaced by another node.
         if (FLAG_trace_turbo_reduction) {
-          StdoutStream{} << "- Replacement of " << *node << " with "
+          AllowHandleDereference allow_deref;
+          StdoutStream{} << "- Replacement of #" << *node << " with #"
                          << *(reduction.replacement()) << " by reducer "
                          << (*i)->reducer_name() << std::endl;
         }
diff --git a/deps/v8/src/compiler/graph-visualizer.cc b/deps/v8/src/compiler/graph-visualizer.cc
index dddba7d36f62ff..86e3da9d27ab00 100644
--- a/deps/v8/src/compiler/graph-visualizer.cc
+++ b/deps/v8/src/compiler/graph-visualizer.cc
@@ -748,9 +748,11 @@ void GraphC1Visualizer::PrintLiveRange(const LiveRange* range, const char* type,
         os_ << " \"" << Register::from_code(op.register_code()) << "\"";
       } else if (op.IsDoubleRegister()) {
         os_ << " \"" << DoubleRegister::from_code(op.register_code()) << "\"";
-      } else {
-        DCHECK(op.IsFloatRegister());
+      } else if (op.IsFloatRegister()) {
         os_ << " \"" << FloatRegister::from_code(op.register_code()) << "\"";
+      } else {
+        DCHECK(op.IsSimd128Register());
+        os_ << " \"" << Simd128Register::from_code(op.register_code()) << "\"";
       }
     } else if (range->spilled()) {
       const TopLevelLiveRange* top = range->TopLevel();
diff --git a/deps/v8/src/compiler/graph.h b/deps/v8/src/compiler/graph.h
index 038c9b457f6627..8d2acfded70f77 100644
--- a/deps/v8/src/compiler/graph.h
+++ b/deps/v8/src/compiler/graph.h
@@ -64,9 +64,14 @@ class V8_EXPORT_PRIVATE Graph final : public NON_EXPORTED_BASE(ZoneObject) {
                 bool incomplete = false);
 
   // Factory template for nodes with static input counts.
-  template <typename... Nodes>
-  Node* NewNode(const Operator* op, Nodes*... nodes) {
-    std::array<Node*, sizeof...(nodes)> nodes_arr{{nodes...}};
+  // Note: Template magic below is used to ensure this method is only considered
+  // for argument types convertible to Node* during overload resoluation.
+  template <typename... Nodes,
+            typename = typename std::enable_if_t<
+                base::all(std::is_convertible<Nodes, Node*>::value...)>>
+  Node* NewNode(const Operator* op, Nodes... nodes) {
+    std::array<Node*, sizeof...(nodes)> nodes_arr{
+        {static_cast<Node*>(nodes)...}};
     return NewNode(op, nodes_arr.size(), nodes_arr.data());
   }
 
diff --git a/deps/v8/src/compiler/heap-refs.h b/deps/v8/src/compiler/heap-refs.h
index f08e49832e202e..c9bb6bf9d1e098 100644
--- a/deps/v8/src/compiler/heap-refs.h
+++ b/deps/v8/src/compiler/heap-refs.h
@@ -395,9 +395,13 @@ class ContextRef : public HeapObjectRef {
   V(JSGlobalObject, global_object)                                    \
   V(JSGlobalProxy, global_proxy_object)                               \
   V(JSObject, promise_prototype)                                      \
+  V(Map, block_context_map)                                           \
   V(Map, bound_function_with_constructor_map)                         \
   V(Map, bound_function_without_constructor_map)                      \
+  V(Map, catch_context_map)                                           \
+  V(Map, eval_context_map)                                            \
   V(Map, fast_aliased_arguments_map)                                  \
+  V(Map, function_context_map)                                        \
   V(Map, initial_array_iterator_map)                                  \
   V(Map, initial_string_iterator_map)                                 \
   V(Map, iterator_result_map)                                         \
@@ -410,6 +414,7 @@ class ContextRef : public HeapObjectRef {
   V(Map, sloppy_arguments_map)                                        \
   V(Map, slow_object_with_null_prototype_map)                         \
   V(Map, strict_arguments_map)                                        \
+  V(Map, with_context_map)                                            \
   V(ScriptContextTable, script_context_table)                         \
   V(SharedFunctionInfo, promise_capability_default_reject_shared_fun) \
   V(SharedFunctionInfo, promise_catch_finally_shared_fun)             \
@@ -620,7 +625,8 @@ class V8_EXPORT_PRIVATE MapRef : public HeapObjectRef {
   FieldIndex GetFieldIndexFor(InternalIndex descriptor_index) const;
   ObjectRef GetFieldType(InternalIndex descriptor_index) const;
   bool IsUnboxedDoubleField(InternalIndex descriptor_index) const;
-  ObjectRef GetStrongValue(InternalIndex descriptor_number) const;
+  base::Optional<ObjectRef> GetStrongValue(
+      InternalIndex descriptor_number) const;
 
   void SerializeRootMap();
   base::Optional<MapRef> FindRootMap() const;
@@ -755,23 +761,30 @@ class ScopeInfoRef : public HeapObjectRef {
   Handle<ScopeInfo> object() const;
 
   int ContextLength() const;
-};
-
-#define BROKER_SFI_FIELDS(V)                 \
-  V(int, internal_formal_parameter_count)    \
-  V(bool, has_duplicate_parameters)          \
-  V(int, function_map_index)                 \
-  V(FunctionKind, kind)                      \
-  V(LanguageMode, language_mode)             \
-  V(bool, native)                            \
-  V(bool, HasBreakInfo)                      \
-  V(bool, HasBuiltinId)                      \
-  V(bool, construct_as_builtin)              \
-  V(bool, HasBytecodeArray)                  \
-  V(bool, is_safe_to_skip_arguments_adaptor) \
-  V(bool, IsInlineable)                      \
-  V(int, StartPosition)                      \
-  V(bool, is_compiled)                       \
+  bool HasOuterScopeInfo() const;
+  int Flags() const;
+  bool HasContextExtension() const;
+
+  // Only serialized via SerializeScopeInfoChain.
+  ScopeInfoRef OuterScopeInfo() const;
+  void SerializeScopeInfoChain();
+};
+
+#define BROKER_SFI_FIELDS(V)                             \
+  V(int, internal_formal_parameter_count)                \
+  V(bool, has_duplicate_parameters)                      \
+  V(int, function_map_index)                             \
+  V(FunctionKind, kind)                                  \
+  V(LanguageMode, language_mode)                         \
+  V(bool, native)                                        \
+  V(bool, HasBreakInfo)                                  \
+  V(bool, HasBuiltinId)                                  \
+  V(bool, construct_as_builtin)                          \
+  V(bool, HasBytecodeArray)                              \
+  V(bool, is_safe_to_skip_arguments_adaptor)             \
+  V(SharedFunctionInfo::Inlineability, GetInlineability) \
+  V(int, StartPosition)                                  \
+  V(bool, is_compiled)                                   \
   V(bool, IsUserJavaScript)
 
 class V8_EXPORT_PRIVATE SharedFunctionInfoRef : public HeapObjectRef {
@@ -781,14 +794,16 @@ class V8_EXPORT_PRIVATE SharedFunctionInfoRef : public HeapObjectRef {
   Handle<SharedFunctionInfo> object() const;
 
   int builtin_id() const;
+  int context_header_size() const;
   BytecodeArrayRef GetBytecodeArray() const;
 
 #define DECL_ACCESSOR(type, name) type name() const;
   BROKER_SFI_FIELDS(DECL_ACCESSOR)
 #undef DECL_ACCESSOR
 
-  bool IsSerializedForCompilation(FeedbackVectorRef feedback) const;
-  void SetSerializedForCompilation(FeedbackVectorRef feedback);
+  bool IsInlineable() const {
+    return GetInlineability() == SharedFunctionInfo::kIsInlineable;
+  }
 
   // Template objects may not be created at compilation time. This method
   // wraps the retrieval of the template object and creates it if
@@ -799,6 +814,9 @@ class V8_EXPORT_PRIVATE SharedFunctionInfoRef : public HeapObjectRef {
 
   void SerializeFunctionTemplateInfo();
   base::Optional<FunctionTemplateInfoRef> function_template_info() const;
+
+  void SerializeScopeInfoChain();
+  ScopeInfoRef scope_info() const;
 };
 
 class StringRef : public NameRef {
diff --git a/deps/v8/src/compiler/int64-lowering.cc b/deps/v8/src/compiler/int64-lowering.cc
index 45b49757fb107a..bc6267f375edaa 100644
--- a/deps/v8/src/compiler/int64-lowering.cc
+++ b/deps/v8/src/compiler/int64-lowering.cc
@@ -957,6 +957,32 @@ void Int64Lowering::LowerNode(Node* node) {
       }
       break;
     }
+    case IrOpcode::kI64x2Splat: {
+      DCHECK_EQ(1, node->InputCount());
+      Node* input = node->InputAt(0);
+      node->ReplaceInput(0, GetReplacementLow(input));
+      node->AppendInput(zone(), GetReplacementHigh(input));
+      NodeProperties::ChangeOp(node, machine()->I64x2SplatI32Pair());
+      break;
+    }
+    case IrOpcode::kI64x2ExtractLane: {
+      DCHECK_EQ(1, node->InputCount());
+      Node* input = node->InputAt(0);
+      int32_t lane = OpParameter<int32_t>(node->op());
+      ReplaceNode(
+          node, graph()->NewNode(machine()->I32x4ExtractLane(lane * 2), input),
+          graph()->NewNode(machine()->I32x4ExtractLane(lane * 2 + 1), input));
+      break;
+    }
+    case IrOpcode::kI64x2ReplaceLane: {
+      DCHECK_EQ(2, node->InputCount());
+      int32_t lane = OpParameter<int32_t>(node->op());
+      Node* input = node->InputAt(1);
+      node->ReplaceInput(1, GetReplacementLow(input));
+      node->AppendInput(zone(), GetReplacementHigh(input));
+      NodeProperties::ChangeOp(node, machine()->I64x2ReplaceLaneI32Pair(lane));
+      break;
+    }
 
     default: { DefaultLowering(node); }
   }
diff --git a/deps/v8/src/compiler/js-call-reducer.cc b/deps/v8/src/compiler/js-call-reducer.cc
index b86b1e6baffc3e..dc4e4000ca5b66 100644
--- a/deps/v8/src/compiler/js-call-reducer.cc
+++ b/deps/v8/src/compiler/js-call-reducer.cc
@@ -10,11 +10,13 @@
 #include "src/builtins/builtins-promise.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/codegen/code-factory.h"
+#include "src/codegen/tnode.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/access-info.h"
 #include "src/compiler/allocation-builder.h"
 #include "src/compiler/compilation-dependencies.h"
 #include "src/compiler/feedback-source.h"
+#include "src/compiler/graph-assembler.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/map-inference.h"
@@ -36,2765 +38,3278 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-Reduction JSCallReducer::ReduceMathUnary(Node* node, const Operator* op) {
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
-  if (node->op()->ValueInputCount() < 3) {
-    Node* value = jsgraph()->NaNConstant();
-    ReplaceWithValue(node, value);
-    return Replace(value);
-  }
+// Shorter lambda declarations with less visual clutter.
+#define _ [&]()  // NOLINT(whitespace/braces)
+
+class JSCallReducerAssembler : public JSGraphAssembler {
+ protected:
+  class CatchScope;
+
+ private:
+  static constexpr bool kMarkLoopExits = true;
+
+ public:
+  JSCallReducerAssembler(JSGraph* jsgraph, Zone* zone, Node* node)
+      : JSGraphAssembler(jsgraph, zone, nullptr, kMarkLoopExits),
+        node_(node),
+        outermost_catch_scope_(CatchScope::Outermost(zone)),
+        catch_scope_(&outermost_catch_scope_) {
+    InitializeEffectControl(NodeProperties::GetEffectInput(node),
+                            NodeProperties::GetControlInput(node));
+
+    // Finish initializing the outermost catch scope.
+    bool has_handler =
+        NodeProperties::IsExceptionalCall(node, &outermost_handler_);
+    outermost_catch_scope_.set_has_handler(has_handler);
+    outermost_catch_scope_.set_gasm(this);
+  }
+  virtual ~JSCallReducerAssembler() {}
+
+  TNode<Object> ReduceMathUnary(const Operator* op);
+  TNode<Object> ReduceMathBinary(const Operator* op);
+  TNode<String> ReduceStringPrototypeSubstring();
+  TNode<String> ReduceStringPrototypeSlice();
+
+  TNode<Object> TargetInput() const { return ValueInput(0); }
+
+  CatchScope* catch_scope() const { return catch_scope_; }
+  Node* outermost_handler() const { return outermost_handler_; }
+
+  Node* node_ptr() const { return node_; }
+
+ protected:
+  using NodeGenerator0 = std::function<TNode<Object>()>;
+  using VoidGenerator0 = std::function<void()>;
+
+  // TODO(jgruber): Currently IfBuilder0 and IfBuilder1 are implemented as
+  // separate classes. If, in the future, we encounter additional use cases that
+  // return more than 1 value, we should merge these back into a single variadic
+  // implementation.
+  class IfBuilder0 final {
+   public:
+    IfBuilder0(JSGraphAssembler* gasm, TNode<Boolean> cond, bool negate_cond)
+        : gasm_(gasm),
+          cond_(cond),
+          negate_cond_(negate_cond),
+          initial_effect_(gasm->effect()),
+          initial_control_(gasm->control()) {}
+
+    IfBuilder0& ExpectTrue() {
+      DCHECK_EQ(hint_, BranchHint::kNone);
+      hint_ = BranchHint::kTrue;
+      return *this;
+    }
+    IfBuilder0& ExpectFalse() {
+      DCHECK_EQ(hint_, BranchHint::kNone);
+      hint_ = BranchHint::kFalse;
+      return *this;
+    }
 
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* input = NodeProperties::GetValueInput(node, 2);
+    IfBuilder0& Then(const VoidGenerator0& body) {
+      then_body_ = body;
+      return *this;
+    }
+    IfBuilder0& Else(const VoidGenerator0& body) {
+      else_body_ = body;
+      return *this;
+    }
 
-  input = effect =
-      graph()->NewNode(simplified()->SpeculativeToNumber(
-                           NumberOperationHint::kNumberOrOddball, p.feedback()),
-                       input, effect, control);
-  Node* value = graph()->NewNode(op, input);
-  ReplaceWithValue(node, value, effect);
-  return Replace(value);
-}
+    ~IfBuilder0() {
+      // Ensure correct usage: effect/control must not have been modified while
+      // the IfBuilder0 instance is alive.
+      DCHECK_EQ(gasm_->effect(), initial_effect_);
+      DCHECK_EQ(gasm_->control(), initial_control_);
 
-Reduction JSCallReducer::ReduceMathBinary(Node* node, const Operator* op) {
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
-  if (node->op()->ValueInputCount() < 3) {
-    Node* value = jsgraph()->NaNConstant();
-    ReplaceWithValue(node, value);
-    return Replace(value);
-  }
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
+      // Unlike IfBuilder1, this supports an empty then or else body. This is
+      // possible since the merge does not take any value inputs.
+      DCHECK(then_body_ || else_body_);
 
-  Node* left = NodeProperties::GetValueInput(node, 2);
-  Node* right = node->op()->ValueInputCount() > 3
-                    ? NodeProperties::GetValueInput(node, 3)
-                    : jsgraph()->NaNConstant();
-  left = effect =
-      graph()->NewNode(simplified()->SpeculativeToNumber(
-                           NumberOperationHint::kNumberOrOddball, p.feedback()),
-                       left, effect, control);
-  right = effect =
-      graph()->NewNode(simplified()->SpeculativeToNumber(
-                           NumberOperationHint::kNumberOrOddball, p.feedback()),
-                       right, effect, control);
-  Node* value = graph()->NewNode(op, left, right);
-  ReplaceWithValue(node, value, effect);
-  return Replace(value);
-}
+      if (negate_cond_) std::swap(then_body_, else_body_);
 
-// ES6 section 20.2.2.19 Math.imul ( x, y )
-Reduction JSCallReducer::ReduceMathImul(Node* node) {
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
-  if (node->op()->ValueInputCount() < 3) {
-    Node* value = jsgraph()->ZeroConstant();
-    ReplaceWithValue(node, value);
-    return Replace(value);
-  }
-  Node* left = NodeProperties::GetValueInput(node, 2);
-  Node* right = node->op()->ValueInputCount() > 3
-                    ? NodeProperties::GetValueInput(node, 3)
-                    : jsgraph()->ZeroConstant();
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
+      auto if_true = (hint_ == BranchHint::kFalse) ? gasm_->MakeDeferredLabel()
+                                                   : gasm_->MakeLabel();
+      auto if_false = (hint_ == BranchHint::kTrue) ? gasm_->MakeDeferredLabel()
+                                                   : gasm_->MakeLabel();
+      auto merge = gasm_->MakeLabel();
+      gasm_->Branch(cond_, &if_true, &if_false);
 
-  left = effect =
-      graph()->NewNode(simplified()->SpeculativeToNumber(
-                           NumberOperationHint::kNumberOrOddball, p.feedback()),
-                       left, effect, control);
-  right = effect =
-      graph()->NewNode(simplified()->SpeculativeToNumber(
-                           NumberOperationHint::kNumberOrOddball, p.feedback()),
-                       right, effect, control);
-  left = graph()->NewNode(simplified()->NumberToUint32(), left);
-  right = graph()->NewNode(simplified()->NumberToUint32(), right);
-  Node* value = graph()->NewNode(simplified()->NumberImul(), left, right);
-  ReplaceWithValue(node, value, effect);
-  return Replace(value);
-}
+      gasm_->Bind(&if_true);
+      if (then_body_) then_body_();
+      gasm_->Goto(&merge);
 
-// ES6 section 20.2.2.11 Math.clz32 ( x )
-Reduction JSCallReducer::ReduceMathClz32(Node* node) {
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
-  if (node->op()->ValueInputCount() < 3) {
-    Node* value = jsgraph()->Constant(32);
-    ReplaceWithValue(node, value);
-    return Replace(value);
-  }
-  Node* input = NodeProperties::GetValueInput(node, 2);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
+      gasm_->Bind(&if_false);
+      if (else_body_) else_body_();
+      gasm_->Goto(&merge);
 
-  input = effect =
-      graph()->NewNode(simplified()->SpeculativeToNumber(
-                           NumberOperationHint::kNumberOrOddball, p.feedback()),
-                       input, effect, control);
-  input = graph()->NewNode(simplified()->NumberToUint32(), input);
-  Node* value = graph()->NewNode(simplified()->NumberClz32(), input);
-  ReplaceWithValue(node, value, effect);
-  return Replace(value);
-}
+      gasm_->Bind(&merge);
+    }
 
-// ES6 section 20.2.2.24 Math.max ( value1, value2, ...values )
-// ES6 section 20.2.2.25 Math.min ( value1, value2, ...values )
-Reduction JSCallReducer::ReduceMathMinMax(Node* node, const Operator* op,
-                                          Node* empty_value) {
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
-  if (node->op()->ValueInputCount() <= 2) {
-    ReplaceWithValue(node, empty_value);
-    return Replace(empty_value);
-  }
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
+   private:
+    JSGraphAssembler* const gasm_;
+    const TNode<Boolean> cond_;
+    const bool negate_cond_;
+    const Effect initial_effect_;
+    const Control initial_control_;
+    BranchHint hint_ = BranchHint::kNone;
+    VoidGenerator0 then_body_;
+    VoidGenerator0 else_body_;
+
+    DISALLOW_COPY_AND_ASSIGN(IfBuilder0);
+  };
 
-  Node* value = effect =
-      graph()->NewNode(simplified()->SpeculativeToNumber(
-                           NumberOperationHint::kNumberOrOddball, p.feedback()),
-                       NodeProperties::GetValueInput(node, 2), effect, control);
-  for (int i = 3; i < node->op()->ValueInputCount(); i++) {
-    Node* input = effect = graph()->NewNode(
-        simplified()->SpeculativeToNumber(NumberOperationHint::kNumberOrOddball,
-                                          p.feedback()),
-        NodeProperties::GetValueInput(node, i), effect, control);
-    value = graph()->NewNode(op, value, input);
-  }
+  IfBuilder0 If(TNode<Boolean> cond) { return {this, cond, false}; }
+  IfBuilder0 IfNot(TNode<Boolean> cond) { return {this, cond, true}; }
 
-  ReplaceWithValue(node, value, effect);
-  return Replace(value);
-}
+  template <typename T>
+  class IfBuilder1 {
+    using If1BodyFunction = std::function<TNode<T>()>;
 
-Reduction JSCallReducer::Reduce(Node* node) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+   public:
+    IfBuilder1(JSGraphAssembler* gasm, TNode<Boolean> cond)
+        : gasm_(gasm), cond_(cond) {}
 
-  switch (node->opcode()) {
-    case IrOpcode::kJSConstruct:
-      return ReduceJSConstruct(node);
-    case IrOpcode::kJSConstructWithArrayLike:
-      return ReduceJSConstructWithArrayLike(node);
-    case IrOpcode::kJSConstructWithSpread:
-      return ReduceJSConstructWithSpread(node);
-    case IrOpcode::kJSCall:
-      return ReduceJSCall(node);
-    case IrOpcode::kJSCallWithArrayLike:
-      return ReduceJSCallWithArrayLike(node);
-    case IrOpcode::kJSCallWithSpread:
-      return ReduceJSCallWithSpread(node);
-    default:
-      break;
-  }
-  return NoChange();
-}
+    V8_WARN_UNUSED_RESULT IfBuilder1& ExpectTrue() {
+      DCHECK_EQ(hint_, BranchHint::kNone);
+      hint_ = BranchHint::kTrue;
+      return *this;
+    }
 
-void JSCallReducer::Finalize() {
-  // TODO(turbofan): This is not the best solution; ideally we would be able
-  // to teach the GraphReducer about arbitrary dependencies between different
-  // nodes, even if they don't show up in the use list of the other node.
-  std::set<Node*> const waitlist = std::move(waitlist_);
-  for (Node* node : waitlist) {
-    if (!node->IsDead()) {
-      Reduction const reduction = Reduce(node);
-      if (reduction.Changed()) {
-        Node* replacement = reduction.replacement();
-        if (replacement != node) {
-          Replace(node, replacement);
-        }
-      }
+    V8_WARN_UNUSED_RESULT IfBuilder1& ExpectFalse() {
+      DCHECK_EQ(hint_, BranchHint::kNone);
+      hint_ = BranchHint::kFalse;
+      return *this;
     }
-  }
-}
 
-// ES6 section 22.1.1 The Array Constructor
-Reduction JSCallReducer::ReduceArrayConstructor(Node* node) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+    V8_WARN_UNUSED_RESULT IfBuilder1& Then(const If1BodyFunction& body) {
+      then_body_ = body;
+      return *this;
+    }
+    V8_WARN_UNUSED_RESULT IfBuilder1& Else(const If1BodyFunction& body) {
+      else_body_ = body;
+      return *this;
+    }
 
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  Node* target = NodeProperties::GetValueInput(node, 0);
-  CallParameters const& p = CallParametersOf(node->op());
+    V8_WARN_UNUSED_RESULT TNode<T> Value() {
+      DCHECK(then_body_);
+      DCHECK(else_body_);
+      auto if_true = (hint_ == BranchHint::kFalse) ? gasm_->MakeDeferredLabel()
+                                                   : gasm_->MakeLabel();
+      auto if_false = (hint_ == BranchHint::kTrue) ? gasm_->MakeDeferredLabel()
+                                                   : gasm_->MakeLabel();
+      auto merge = gasm_->MakeLabel(kPhiRepresentation);
+      gasm_->Branch(cond_, &if_true, &if_false);
+
+      gasm_->Bind(&if_true);
+      TNode<T> then_result = then_body_();
+      gasm_->Goto(&merge, then_result);
+
+      gasm_->Bind(&if_false);
+      TNode<T> else_result = else_body_();
+      gasm_->Goto(&merge, else_result);
+
+      gasm_->Bind(&merge);
+      return merge.PhiAt<T>(0);
+    }
 
-  // Turn the {node} into a {JSCreateArray} call.
-  DCHECK_LE(2u, p.arity());
-  size_t const arity = p.arity() - 2;
-  NodeProperties::ReplaceValueInput(node, target, 0);
-  NodeProperties::ReplaceValueInput(node, target, 1);
-  NodeProperties::ChangeOp(
-      node, javascript()->CreateArray(arity, MaybeHandle<AllocationSite>()));
-  return Changed(node);
-}
+   private:
+    static constexpr MachineRepresentation kPhiRepresentation =
+        MachineRepresentation::kTagged;
 
-// ES6 section 19.3.1.1 Boolean ( value )
-Reduction JSCallReducer::ReduceBooleanConstructor(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
+    JSGraphAssembler* const gasm_;
+    const TNode<Boolean> cond_;
+    BranchHint hint_ = BranchHint::kNone;
+    If1BodyFunction then_body_;
+    If1BodyFunction else_body_;
+  };
 
-  // Replace the {node} with a proper {ToBoolean} operator.
-  DCHECK_LE(2u, p.arity());
-  Node* value = (p.arity() == 2) ? jsgraph()->UndefinedConstant()
-                                 : NodeProperties::GetValueInput(node, 2);
-  value = graph()->NewNode(simplified()->ToBoolean(), value);
-  ReplaceWithValue(node, value);
-  return Replace(value);
-}
+  template <typename T>
+  IfBuilder1<T> SelectIf(TNode<Boolean> cond) {
+    return {this, cond};
+  }
+
+  // Simplified operators.
+  TNode<Number> SpeculativeToNumber(
+      TNode<Object> value,
+      NumberOperationHint hint = NumberOperationHint::kNumberOrOddball);
+  TNode<Smi> CheckSmi(TNode<Object> value);
+  TNode<String> CheckString(TNode<Object> value);
+  TNode<Number> CheckBounds(TNode<Number> value, TNode<Number> limit);
+
+  // Common operators.
+  TNode<Smi> TypeGuardUnsignedSmall(TNode<Object> value);
+  TNode<Object> TypeGuardNonInternal(TNode<Object> value);
+  TNode<Number> TypeGuardFixedArrayLength(TNode<Object> value);
+  TNode<Object> Call4(const Callable& callable, TNode<Context> context,
+                      TNode<Object> arg0, TNode<Object> arg1,
+                      TNode<Object> arg2, TNode<Object> arg3);
+
+  // Javascript operators.
+  TNode<Object> JSCall3(TNode<Object> function, TNode<Object> this_arg,
+                        TNode<Object> arg0, TNode<Object> arg1,
+                        TNode<Object> arg2, FrameState frame_state);
+  TNode<Object> JSCall4(TNode<Object> function, TNode<Object> this_arg,
+                        TNode<Object> arg0, TNode<Object> arg1,
+                        TNode<Object> arg2, TNode<Object> arg3,
+                        FrameState frame_state);
+  TNode<Object> JSCallRuntime2(Runtime::FunctionId function_id,
+                               TNode<Object> arg0, TNode<Object> arg1,
+                               FrameState frame_state);
+  // Used in special cases in which we are certain CreateArray does not throw.
+  TNode<JSArray> CreateArrayNoThrow(TNode<Object> ctor, TNode<Number> size);
+
+  TNode<JSArray> AllocateEmptyJSArray(ElementsKind kind,
+                                      const NativeContextRef& native_context);
+
+  TNode<Number> NumberInc(TNode<Number> value) {
+    return NumberAdd(value, OneConstant());
+  }
+
+  void MaybeInsertMapChecks(MapInference* inference,
+                            bool has_stability_dependency) {
+    // TODO(jgruber): Implement MapInference::InsertMapChecks in graph
+    // assembler.
+    if (!has_stability_dependency) {
+      Node* e = effect();
+      inference->InsertMapChecks(jsgraph(), &e, control(), feedback());
+      InitializeEffectControl(e, control());
+    }
+  }
 
-// ES section #sec-object-constructor
-Reduction JSCallReducer::ReduceObjectConstructor(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.arity() < 3) return NoChange();
-  Node* value = (p.arity() >= 3) ? NodeProperties::GetValueInput(node, 2)
-                                 : jsgraph()->UndefinedConstant();
-  Node* effect = NodeProperties::GetEffectInput(node);
+  // TODO(jgruber): Currently, it's the responsibility of the developer to note
+  // which operations may throw and appropriately wrap these in a call to
+  // MayThrow (see e.g. JSCall3 and CallRuntime2). A more methodical approach
+  // would be good.
+  TNode<Object> MayThrow(const NodeGenerator0& body) {
+    TNode<Object> result = body();
 
-  // We can fold away the Object(x) call if |x| is definitely not a primitive.
-  if (NodeProperties::CanBePrimitive(broker(), value, effect)) {
-    if (!NodeProperties::CanBeNullOrUndefined(broker(), value, effect)) {
-      // Turn the {node} into a {JSToObject} call if we know that
-      // the {value} cannot be null or undefined.
-      NodeProperties::ReplaceValueInputs(node, value);
-      NodeProperties::ChangeOp(node, javascript()->ToObject());
-      return Changed(node);
+    if (catch_scope()->has_handler()) {
+      // The IfException node is later merged into the outer graph.
+      // Note: AddNode is intentionally not called since effect and control
+      // should not be updated.
+      Node* if_exception =
+          graph()->NewNode(common()->IfException(), effect(), control());
+      catch_scope()->RegisterIfExceptionNode(if_exception);
+
+      // Control resumes here.
+      AddNode(graph()->NewNode(common()->IfSuccess(), control()));
     }
-  } else {
-    ReplaceWithValue(node, value);
-    return Replace(value);
-  }
-  return NoChange();
-}
 
-// ES6 section 19.2.3.1 Function.prototype.apply ( thisArg, argArray )
-Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
-  DisallowHeapAccessIf no_heap_acess(FLAG_concurrent_inlining);
+    return result;
+  }
+
+  // A catch scope represents a single catch handler. The handler can be
+  // custom catch logic within the reduction itself; or a catch handler in the
+  // outside graph into which the reduction will be integrated (in this case
+  // the scope is called 'outermost').
+  class CatchScope {
+   private:
+    // Only used to partially construct the outermost scope.
+    explicit CatchScope(Zone* zone) : if_exception_nodes_(zone) {}
+
+    // For all inner scopes.
+    CatchScope(Zone* zone, JSCallReducerAssembler* gasm)
+        : gasm_(gasm),
+          parent_(gasm->catch_scope_),
+          has_handler_(true),
+          if_exception_nodes_(zone) {
+      gasm_->catch_scope_ = this;
+    }
 
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
-  size_t arity = p.arity();
-  DCHECK_LE(2u, arity);
-  ConvertReceiverMode convert_mode = ConvertReceiverMode::kAny;
-  if (arity == 2) {
-    // Neither thisArg nor argArray was provided.
-    convert_mode = ConvertReceiverMode::kNullOrUndefined;
-    node->ReplaceInput(0, node->InputAt(1));
-    node->ReplaceInput(1, jsgraph()->UndefinedConstant());
-  } else if (arity == 3) {
-    // The argArray was not provided, just remove the {target}.
-    node->RemoveInput(0);
-    --arity;
-  } else {
-    Node* target = NodeProperties::GetValueInput(node, 1);
-    Node* this_argument = NodeProperties::GetValueInput(node, 2);
-    Node* arguments_list = NodeProperties::GetValueInput(node, 3);
-    Node* context = NodeProperties::GetContextInput(node);
-    Node* frame_state = NodeProperties::GetFrameStateInput(node);
-    Node* effect = NodeProperties::GetEffectInput(node);
-    Node* control = NodeProperties::GetControlInput(node);
+   public:
+    ~CatchScope() { gasm_->catch_scope_ = parent_; }
 
-    // If {arguments_list} cannot be null or undefined, we don't need
-    // to expand this {node} to control-flow.
-    if (!NodeProperties::CanBeNullOrUndefined(broker(), arguments_list,
-                                              effect)) {
-      // Massage the value inputs appropriately.
-      node->ReplaceInput(0, target);
-      node->ReplaceInput(1, this_argument);
-      node->ReplaceInput(2, arguments_list);
-      while (arity-- > 3) node->RemoveInput(3);
+    static CatchScope Outermost(Zone* zone) { return CatchScope{zone}; }
+    static CatchScope Inner(Zone* zone, JSCallReducerAssembler* gasm) {
+      return {zone, gasm};
+    }
 
-      // Morph the {node} to a {JSCallWithArrayLike}.
-      NodeProperties::ChangeOp(node,
-                               javascript()->CallWithArrayLike(p.frequency()));
-      Reduction const reduction = ReduceJSCallWithArrayLike(node);
-      return reduction.Changed() ? reduction : Changed(node);
-    } else {
-      // Check whether {arguments_list} is null.
-      Node* check_null =
-          graph()->NewNode(simplified()->ReferenceEqual(), arguments_list,
-                           jsgraph()->NullConstant());
-      control = graph()->NewNode(common()->Branch(BranchHint::kFalse),
-                                 check_null, control);
-      Node* if_null = graph()->NewNode(common()->IfTrue(), control);
-      control = graph()->NewNode(common()->IfFalse(), control);
+    bool has_handler() const { return has_handler_; }
+    bool is_outermost() const { return parent_ == nullptr; }
+    CatchScope* parent() const { return parent_; }
 
-      // Check whether {arguments_list} is undefined.
-      Node* check_undefined =
-          graph()->NewNode(simplified()->ReferenceEqual(), arguments_list,
-                           jsgraph()->UndefinedConstant());
-      control = graph()->NewNode(common()->Branch(BranchHint::kFalse),
-                                 check_undefined, control);
-      Node* if_undefined = graph()->NewNode(common()->IfTrue(), control);
-      control = graph()->NewNode(common()->IfFalse(), control);
+    // Should only be used to initialize the outermost scope (inner scopes
+    // always have a handler and are passed the gasm pointer at construction).
+    void set_has_handler(bool v) {
+      DCHECK(is_outermost());
+      has_handler_ = v;
+    }
+    void set_gasm(JSCallReducerAssembler* v) {
+      DCHECK(is_outermost());
+      gasm_ = v;
+    }
 
-      // Lower to {JSCallWithArrayLike} if {arguments_list} is neither null
-      // nor undefined.
-      Node* effect0 = effect;
-      Node* control0 = control;
-      Node* value0 = effect0 = control0 = graph()->NewNode(
-          javascript()->CallWithArrayLike(p.frequency()), target, this_argument,
-          arguments_list, context, frame_state, effect0, control0);
+    bool has_exceptional_control_flow() const {
+      return !if_exception_nodes_.empty();
+    }
 
-      // Lower to {JSCall} if {arguments_list} is either null or undefined.
-      Node* effect1 = effect;
-      Node* control1 =
-          graph()->NewNode(common()->Merge(2), if_null, if_undefined);
-      Node* value1 = effect1 = control1 =
-          graph()->NewNode(javascript()->Call(2), target, this_argument,
-                           context, frame_state, effect1, control1);
+    void RegisterIfExceptionNode(Node* if_exception) {
+      DCHECK(has_handler());
+      if_exception_nodes_.push_back(if_exception);
+    }
 
-      // Rewire potential exception edges.
-      Node* if_exception = nullptr;
-      if (NodeProperties::IsExceptionalCall(node, &if_exception)) {
-        // Create appropriate {IfException} and {IfSuccess} nodes.
-        Node* if_exception0 =
-            graph()->NewNode(common()->IfException(), control0, effect0);
-        control0 = graph()->NewNode(common()->IfSuccess(), control0);
-        Node* if_exception1 =
-            graph()->NewNode(common()->IfException(), control1, effect1);
-        control1 = graph()->NewNode(common()->IfSuccess(), control1);
+    void MergeExceptionalPaths(TNode<Object>* exception_out, Effect* effect_out,
+                               Control* control_out) {
+      DCHECK(has_handler());
+      DCHECK(has_exceptional_control_flow());
 
-        // Join the exception edges.
-        Node* merge =
-            graph()->NewNode(common()->Merge(2), if_exception0, if_exception1);
-        Node* ephi = graph()->NewNode(common()->EffectPhi(2), if_exception0,
-                                      if_exception1, merge);
-        Node* phi =
-            graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                             if_exception0, if_exception1, merge);
-        ReplaceWithValue(if_exception, phi, ephi, merge);
+      const int size = static_cast<int>(if_exception_nodes_.size());
+
+      if (size == 1) {
+        // No merge needed.
+        Node* e = if_exception_nodes_.at(0);
+        *exception_out = TNode<Object>::UncheckedCast(e);
+        *effect_out = Effect(e);
+        *control_out = Control(e);
+      } else {
+        DCHECK_GT(size, 1);
+
+        Node* merge = gasm_->graph()->NewNode(gasm_->common()->Merge(size),
+                                              size, if_exception_nodes_.data());
+
+        // These phis additionally take {merge} as an input. Temporarily add
+        // it to the list.
+        if_exception_nodes_.push_back(merge);
+        const int size_with_merge =
+            static_cast<int>(if_exception_nodes_.size());
+
+        Node* ephi = gasm_->graph()->NewNode(gasm_->common()->EffectPhi(size),
+                                             size_with_merge,
+                                             if_exception_nodes_.data());
+        Node* phi = gasm_->graph()->NewNode(
+            gasm_->common()->Phi(MachineRepresentation::kTagged, size),
+            size_with_merge, if_exception_nodes_.data());
+        if_exception_nodes_.pop_back();
+
+        *exception_out = TNode<Object>::UncheckedCast(phi);
+        *effect_out = Effect(ephi);
+        *control_out = Control(merge);
+      }
+    }
+
+   private:
+    JSCallReducerAssembler* gasm_ = nullptr;
+    CatchScope* const parent_ = nullptr;
+    bool has_handler_ = false;
+    NodeVector if_exception_nodes_;
+  };
+
+  class TryCatchBuilder0 {
+   public:
+    using TryFunction = VoidGenerator0;
+    using CatchFunction = std::function<void(TNode<Object>)>;
+
+    TryCatchBuilder0(JSCallReducerAssembler* gasm, const TryFunction& try_body)
+        : gasm_(gasm), try_body_(try_body) {}
+
+    void Catch(const CatchFunction& catch_body) {
+      TNode<Object> handler_exception;
+      Effect handler_effect{nullptr};
+      Control handler_control{nullptr};
+
+      auto continuation = gasm_->MakeLabel();
+
+      // Try.
+      {
+        CatchScope catch_scope = CatchScope::Inner(gasm_->temp_zone(), gasm_);
+        try_body_();
+        gasm_->Goto(&continuation);
+
+        catch_scope.MergeExceptionalPaths(&handler_exception, &handler_effect,
+                                          &handler_control);
       }
 
-      // Join control paths.
-      control = graph()->NewNode(common()->Merge(2), control0, control1);
-      effect =
-          graph()->NewNode(common()->EffectPhi(2), effect0, effect1, control);
-      Node* value =
-          graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                           value0, value1, control);
-      ReplaceWithValue(node, value, effect, control);
-      return Replace(value);
+      // Catch.
+      {
+        gasm_->InitializeEffectControl(handler_effect, handler_control);
+        catch_body(handler_exception);
+        gasm_->Goto(&continuation);
+      }
+
+      gasm_->Bind(&continuation);
     }
-  }
-  // Change {node} to the new {JSCall} operator.
-  // TODO(mslekova): Since this introduces a Call that will get optimized by
-  // the JSCallReducer, we basically might have to do all the serialization
-  // that we do for that here as well. The only difference is that here we
-  // disable speculation (cf. the empty FeedbackSource above), causing the
-  // JSCallReducer to do much less work. We should revisit this later.
-  NodeProperties::ChangeOp(
-      node,
-      javascript()->Call(arity, p.frequency(), FeedbackSource(), convert_mode));
-  // Try to further reduce the JSCall {node}.
-  Reduction const reduction = ReduceJSCall(node);
-  return reduction.Changed() ? reduction : Changed(node);
-}
 
-// ES section #sec-function.prototype.bind
-Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
-  DisallowHeapAccessIf no_heap_acess(FLAG_concurrent_inlining);
+   private:
+    JSCallReducerAssembler* const gasm_;
+    const VoidGenerator0 try_body_;
+  };
 
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
+  TryCatchBuilder0 Try(const VoidGenerator0& try_body) {
+    return {this, try_body};
   }
 
-  // Value inputs to the {node} are as follows:
-  //
-  //  - target, which is Function.prototype.bind JSFunction
-  //  - receiver, which is the [[BoundTargetFunction]]
-  //  - bound_this (optional), which is the [[BoundThis]]
-  //  - and all the remaining value inputs are [[BoundArguments]]
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* bound_this = (node->op()->ValueInputCount() < 3)
-                         ? jsgraph()->UndefinedConstant()
-                         : NodeProperties::GetValueInput(node, 2);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
+  using ConditionFunction1 = std::function<TNode<Boolean>(TNode<Number>)>;
+  using StepFunction1 = std::function<TNode<Number>(TNode<Number>)>;
+  class ForBuilder0 {
+    using For0BodyFunction = std::function<void(TNode<Number>)>;
 
-  // Ensure that the {receiver} is known to be a JSBoundFunction or
-  // a JSFunction with the same [[Prototype]], and all maps we've
-  // seen for the {receiver} so far indicate that {receiver} is
-  // definitely a constructor or not a constructor.
-  MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return NoChange();
-  MapHandles const& receiver_maps = inference.GetMaps();
+   public:
+    ForBuilder0(JSGraphAssembler* gasm, TNode<Number> initial_value,
+                const ConditionFunction1& cond, const StepFunction1& step)
+        : gasm_(gasm),
+          initial_value_(initial_value),
+          cond_(cond),
+          step_(step) {}
 
-  MapRef first_receiver_map(broker(), receiver_maps[0]);
-  bool const is_constructor = first_receiver_map.is_constructor();
+    void Do(const For0BodyFunction& body) {
+      auto loop_exit = gasm_->MakeLabel();
 
-  if (FLAG_concurrent_inlining && !first_receiver_map.serialized_prototype()) {
-    TRACE_BROKER_MISSING(broker(),
-                         "serialized prototype on map " << first_receiver_map);
-    return inference.NoChange();
-  }
-  ObjectRef const prototype = first_receiver_map.prototype();
-  for (Handle<Map> const map : receiver_maps) {
-    MapRef receiver_map(broker(), map);
+      {
+        GraphAssembler::LoopScope<kPhiRepresentation> loop_scope(gasm_);
 
-    if (FLAG_concurrent_inlining && !receiver_map.serialized_prototype()) {
-      TRACE_BROKER_MISSING(broker(),
-                           "serialized prototype on map " << receiver_map);
-      return inference.NoChange();
-    }
+        auto loop_header = loop_scope.loop_header_label();
+        auto loop_body = gasm_->MakeLabel();
 
-    // Check for consistency among the {receiver_maps}.
-    STATIC_ASSERT(LAST_TYPE == LAST_FUNCTION_TYPE);
-    if (!receiver_map.prototype().equals(prototype) ||
-        receiver_map.is_constructor() != is_constructor ||
-        receiver_map.instance_type() < FIRST_FUNCTION_TYPE) {
-      return inference.NoChange();
-    }
+        gasm_->Goto(loop_header, initial_value_);
 
-    // Disallow binding of slow-mode functions. We need to figure out
-    // whether the length and name property are in the original state.
-    if (receiver_map.is_dictionary_map()) return inference.NoChange();
+        gasm_->Bind(loop_header);
+        TNode<Number> i = loop_header->PhiAt<Number>(0);
 
-    // Check whether the length and name properties are still present
-    // as AccessorInfo objects. In that case, their values can be
-    // recomputed even if the actual value of the object changes.
-    // This mirrors the checks done in builtins-function-gen.cc at
-    // runtime otherwise.
-    int minimum_nof_descriptors = i::Max(JSFunction::kLengthDescriptorIndex,
-                                           JSFunction::kNameDescriptorIndex) +
-                                  1;
-    if (receiver_map.NumberOfOwnDescriptors() < minimum_nof_descriptors) {
-      return inference.NoChange();
-    }
-    const InternalIndex kLengthIndex(JSFunction::kLengthDescriptorIndex);
-    const InternalIndex kNameIndex(JSFunction::kNameDescriptorIndex);
-    if (!receiver_map.serialized_own_descriptor(kLengthIndex) ||
-        !receiver_map.serialized_own_descriptor(kNameIndex)) {
-      TRACE_BROKER_MISSING(broker(),
-                           "serialized descriptors on map " << receiver_map);
-      return inference.NoChange();
+        gasm_->BranchWithHint(cond_(i), &loop_body, &loop_exit,
+                              BranchHint::kTrue);
+
+        gasm_->Bind(&loop_body);
+        body(i);
+        gasm_->Goto(loop_header, step_(i));
+      }
+
+      gasm_->Bind(&loop_exit);
     }
-    ReadOnlyRoots roots(isolate());
-    StringRef length_string(broker(), roots.length_string_handle());
-    StringRef name_string(broker(), roots.name_string_handle());
 
-    if (!receiver_map.GetPropertyKey(kLengthIndex).equals(length_string) ||
-        !receiver_map.GetStrongValue(kLengthIndex).IsAccessorInfo() ||
-        !receiver_map.GetPropertyKey(kNameIndex).equals(name_string) ||
-        !receiver_map.GetStrongValue(kNameIndex).IsAccessorInfo()) {
-      return inference.NoChange();
+   private:
+    static constexpr MachineRepresentation kPhiRepresentation =
+        MachineRepresentation::kTagged;
+
+    JSGraphAssembler* const gasm_;
+    const TNode<Number> initial_value_;
+    const ConditionFunction1 cond_;
+    const StepFunction1 step_;
+  };
+
+  ForBuilder0 ForZeroUntil(TNode<Number> excluded_limit) {
+    TNode<Number> initial_value = ZeroConstant();
+    auto cond = [=](TNode<Number> i) {
+      return NumberLessThan(i, excluded_limit);
+    };
+    auto step = [=](TNode<Number> i) { return NumberAdd(i, OneConstant()); };
+    return {this, initial_value, cond, step};
+  }
+
+  ForBuilder0 Forever(TNode<Number> initial_value, const StepFunction1& step) {
+    return {this, initial_value, [=](TNode<Number>) { return TrueConstant(); },
+            step};
+  }
+
+  using For1BodyFunction = std::function<void(TNode<Number>, TNode<Object>*)>;
+  class ForBuilder1 {
+   public:
+    ForBuilder1(JSGraphAssembler* gasm, TNode<Number> initial_value,
+                const ConditionFunction1& cond, const StepFunction1& step,
+                TNode<Object> initial_arg0)
+        : gasm_(gasm),
+          initial_value_(initial_value),
+          cond_(cond),
+          step_(step),
+          initial_arg0_(initial_arg0) {}
+
+    V8_WARN_UNUSED_RESULT ForBuilder1& Do(const For1BodyFunction& body) {
+      body_ = body;
+      return *this;
     }
-  }
 
-  // Choose the map for the resulting JSBoundFunction (but bail out in case of a
-  // custom prototype).
-  MapRef map = is_constructor
-                   ? native_context().bound_function_with_constructor_map()
-                   : native_context().bound_function_without_constructor_map();
-  if (!map.prototype().equals(prototype)) return inference.NoChange();
+    V8_WARN_UNUSED_RESULT TNode<Object> Value() {
+      DCHECK(body_);
+      TNode<Object> arg0 = initial_arg0_;
 
-  inference.RelyOnMapsPreferStability(dependencies(), jsgraph(), &effect,
-                                      control, p.feedback());
+      auto loop_exit = gasm_->MakeDeferredLabel(kPhiRepresentation);
 
-  // Replace the {node} with a JSCreateBoundFunction.
-  int const arity = std::max(0, node->op()->ValueInputCount() - 3);
-  int const input_count = 2 + arity + 3;
-  Node** inputs = graph()->zone()->NewArray<Node*>(input_count);
-  inputs[0] = receiver;
-  inputs[1] = bound_this;
-  for (int i = 0; i < arity; ++i) {
-    inputs[2 + i] = NodeProperties::GetValueInput(node, 3 + i);
-  }
-  inputs[2 + arity + 0] = context;
-  inputs[2 + arity + 1] = effect;
-  inputs[2 + arity + 2] = control;
-  Node* value = effect =
-      graph()->NewNode(javascript()->CreateBoundFunction(arity, map.object()),
-                       input_count, inputs);
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
-}
+      {
+        GraphAssembler::LoopScope<kPhiRepresentation, kPhiRepresentation>
+            loop_scope(gasm_);
 
-// ES6 section 19.2.3.3 Function.prototype.call (thisArg, ...args)
-Reduction JSCallReducer::ReduceFunctionPrototypeCall(Node* node) {
-  DisallowHeapAccessIf no_heap_acess(FLAG_concurrent_inlining);
+        auto loop_header = loop_scope.loop_header_label();
+        auto loop_body = gasm_->MakeDeferredLabel(kPhiRepresentation);
 
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
-  Node* target = NodeProperties::GetValueInput(node, 0);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
+        gasm_->Goto(loop_header, initial_value_, initial_arg0_);
 
-  // Change context of {node} to the Function.prototype.call context,
-  // to ensure any exception is thrown in the correct context.
-  Node* context;
-  HeapObjectMatcher m(target);
-  if (m.HasValue()) {
-    JSFunctionRef function = m.Ref(broker()).AsJSFunction();
-    if (FLAG_concurrent_inlining && !function.serialized()) {
-      TRACE_BROKER_MISSING(broker(), "Serialize call on function " << function);
-      return NoChange();
+        gasm_->Bind(loop_header);
+        TNode<Number> i = loop_header->PhiAt<Number>(0);
+        arg0 = loop_header->PhiAt<Object>(1);
+
+        gasm_->BranchWithHint(cond_(i), &loop_body, &loop_exit,
+                              BranchHint::kTrue, arg0);
+
+        gasm_->Bind(&loop_body);
+        body_(i, &arg0);
+        gasm_->Goto(loop_header, step_(i), arg0);
+      }
+
+      gasm_->Bind(&loop_exit);
+      return TNode<Object>::UncheckedCast(loop_exit.PhiAt<Object>(0));
     }
-    context = jsgraph()->Constant(function.context());
-  } else {
-    context = effect = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForJSFunctionContext()), target,
-        effect, control);
+
+    void ValueIsUnused() { USE(Value()); }
+
+   private:
+    static constexpr MachineRepresentation kPhiRepresentation =
+        MachineRepresentation::kTagged;
+
+    JSGraphAssembler* const gasm_;
+    const TNode<Number> initial_value_;
+    const ConditionFunction1 cond_;
+    const StepFunction1 step_;
+    For1BodyFunction body_;
+    const TNode<Object> initial_arg0_;
+  };
+
+  ForBuilder1 For1(TNode<Number> initial_value, const ConditionFunction1& cond,
+                   const StepFunction1& step, TNode<Object> initial_arg0) {
+    return {this, initial_value, cond, step, initial_arg0};
   }
-  NodeProperties::ReplaceContextInput(node, context);
-  NodeProperties::ReplaceEffectInput(node, effect);
 
-  // Remove the target from {node} and use the receiver as target instead, and
-  // the thisArg becomes the new target.  If thisArg was not provided, insert
-  // undefined instead.
-  size_t arity = p.arity();
-  DCHECK_LE(2u, arity);
-  ConvertReceiverMode convert_mode;
-  if (arity == 2) {
-    // The thisArg was not provided, use undefined as receiver.
-    convert_mode = ConvertReceiverMode::kNullOrUndefined;
-    node->ReplaceInput(0, node->InputAt(1));
-    node->ReplaceInput(1, jsgraph()->UndefinedConstant());
-  } else {
-    // Just remove the target, which is the first value input.
-    convert_mode = ConvertReceiverMode::kAny;
-    node->RemoveInput(0);
-    --arity;
+  ForBuilder1 For1ZeroUntil(TNode<Number> excluded_limit,
+                            TNode<Object> initial_arg0) {
+    TNode<Number> initial_value = ZeroConstant();
+    auto cond = [=](TNode<Number> i) {
+      return NumberLessThan(i, excluded_limit);
+    };
+    auto step = [=](TNode<Number> i) { return NumberAdd(i, OneConstant()); };
+    return {this, initial_value, cond, step, initial_arg0};
   }
-  NodeProperties::ChangeOp(
-      node,
-      javascript()->Call(arity, p.frequency(), FeedbackSource(), convert_mode));
-  // Try to further reduce the JSCall {node}.
-  Reduction const reduction = ReduceJSCall(node);
-  return reduction.Changed() ? reduction : Changed(node);
-}
 
-// ES6 section 19.2.3.6 Function.prototype [ @@hasInstance ] (V)
-Reduction JSCallReducer::ReduceFunctionPrototypeHasInstance(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* object = (node->op()->ValueInputCount() >= 3)
-                     ? NodeProperties::GetValueInput(node, 2)
-                     : jsgraph()->UndefinedConstant();
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
+  void ThrowIfNotCallable(TNode<Object> maybe_callable,
+                          FrameState frame_state) {
+    IfNot(ObjectIsCallable(maybe_callable))
+        .Then(_ {
+          JSCallRuntime2(Runtime::kThrowTypeError,
+                         NumberConstant(static_cast<double>(
+                             MessageTemplate::kCalledNonCallable)),
+                         maybe_callable, frame_state);
+          Unreachable();  // The runtime call throws unconditionally.
+        })
+        .ExpectTrue();
+  }
+
+  const FeedbackSource& feedback() const {
+    CallParameters const& p = CallParametersOf(node_ptr()->op());
+    return p.feedback();
+  }
+
+  int ValueInputCount() const { return node_ptr()->op()->ValueInputCount(); }
+
+  TNode<Object> ValueInput(int index) const {
+    return TNode<Object>::UncheckedCast(
+        NodeProperties::GetValueInput(node_, index));
+  }
+
+  template <typename T>
+  TNode<T> ValueInputAs(int index) const {
+    return TNode<T>::UncheckedCast(ValueInput(index));
+  }
+
+  TNode<Object> ValueInputOrNaN(int index) {
+    return TNode<Object>::UncheckedCast(
+        ValueInputCount() > index ? NodeProperties::GetValueInput(node_, index)
+                                  : NaNConstant());
+  }
+
+  TNode<Object> ValueInputOrUndefined(int index) {
+    return TNode<Object>::UncheckedCast(
+        ValueInputCount() > index ? NodeProperties::GetValueInput(node_, index)
+                                  : UndefinedConstant());
+  }
+
+  TNode<Number> ValueInputOrZero(int index) {
+    return TNode<Number>::UncheckedCast(
+        ValueInputCount() > index ? NodeProperties::GetValueInput(node_, index)
+                                  : ZeroConstant());
+  }
+
+  TNode<Context> ContextInput() const {
+    return TNode<Context>::UncheckedCast(
+        NodeProperties::GetContextInput(node_));
+  }
+
+  FrameState FrameStateInput() const {
+    return FrameState(NodeProperties::GetFrameStateInput(node_));
+  }
+
+  JSOperatorBuilder* javascript() const { return jsgraph()->javascript(); }
+
+ private:
+  Node* const node_;
+
+  CatchScope outermost_catch_scope_;
+  Node* outermost_handler_;
+  CatchScope* catch_scope_;
+  friend class CatchScope;
+};
+
+enum class ArrayReduceDirection { kLeft, kRight };
+enum class ArrayFindVariant { kFind, kFindIndex };
+enum class ArrayEverySomeVariant { kEvery, kSome };
+enum class ArrayIndexOfIncludesVariant { kIncludes, kIndexOf };
+
+// This subclass bundles functionality specific to reducing iterating array
+// builtins.
+class IteratingArrayBuiltinReducerAssembler : public JSCallReducerAssembler {
+ public:
+  IteratingArrayBuiltinReducerAssembler(JSGraph* jsgraph, Zone* zone,
+                                        Node* node)
+      : JSCallReducerAssembler(jsgraph, zone, node) {
+    DCHECK(FLAG_turbo_inline_array_builtins);
+  }
+
+  TNode<Object> ReduceArrayPrototypeForEach(
+      MapInference* inference, const bool has_stability_dependency,
+      ElementsKind kind, const SharedFunctionInfoRef& shared);
+  TNode<Object> ReduceArrayPrototypeReduce(MapInference* inference,
+                                           const bool has_stability_dependency,
+                                           ElementsKind kind,
+                                           ArrayReduceDirection direction,
+                                           const SharedFunctionInfoRef& shared);
+  TNode<JSArray> ReduceArrayPrototypeMap(
+      MapInference* inference, const bool has_stability_dependency,
+      ElementsKind kind, const SharedFunctionInfoRef& shared,
+      const NativeContextRef& native_context);
+  TNode<JSArray> ReduceArrayPrototypeFilter(
+      MapInference* inference, const bool has_stability_dependency,
+      ElementsKind kind, const SharedFunctionInfoRef& shared,
+      const NativeContextRef& native_context);
+  TNode<Object> ReduceArrayPrototypeFind(MapInference* inference,
+                                         const bool has_stability_dependency,
+                                         ElementsKind kind,
+                                         const SharedFunctionInfoRef& shared,
+                                         const NativeContextRef& native_context,
+                                         ArrayFindVariant variant);
+  TNode<Boolean> ReduceArrayPrototypeEverySome(
+      MapInference* inference, const bool has_stability_dependency,
+      ElementsKind kind, const SharedFunctionInfoRef& shared,
+      const NativeContextRef& native_context, ArrayEverySomeVariant variant);
+  TNode<Object> ReduceArrayPrototypeIndexOfIncludes(
+      ElementsKind kind, ArrayIndexOfIncludesVariant variant);
+
+ private:
+  // Returns {index,value}. Assumes that the map has not changed, but possibly
+  // the length and backing store.
+  std::pair<TNode<Number>, TNode<Object>> SafeLoadElement(ElementsKind kind,
+                                                          TNode<JSArray> o,
+                                                          TNode<Number> index) {
+    // Make sure that the access is still in bounds, since the callback could
+    // have changed the array's size.
+    TNode<Number> length = LoadJSArrayLength(o, kind);
+    index = CheckBounds(index, length);
+
+    // Reload the elements pointer before calling the callback, since the
+    // previous callback might have resized the array causing the elements
+    // buffer to be re-allocated.
+    TNode<HeapObject> elements =
+        LoadField<HeapObject>(AccessBuilder::ForJSObjectElements(), o);
+    TNode<Object> value = LoadElement<Object>(
+        AccessBuilder::ForFixedArrayElement(kind, LoadSensitivity::kCritical),
+        elements, index);
+    return std::make_pair(index, value);
+  }
+
+  template <typename... Vars>
+  TNode<Object> MaybeSkipHole(
+      TNode<Object> o, ElementsKind kind,
+      GraphAssemblerLabel<sizeof...(Vars)>* continue_label,
+      TNode<Vars>... vars) {
+    if (!IsHoleyElementsKind(kind)) return o;
+
+    std::array<MachineRepresentation, sizeof...(Vars)> reps = {
+        MachineRepresentationOf<Vars>::value...};
+    auto if_not_hole =
+        MakeLabel<sizeof...(Vars)>(reps, GraphAssemblerLabelType::kNonDeferred);
+    BranchWithHint(HoleCheck(kind, o), continue_label, &if_not_hole,
+                   BranchHint::kFalse, vars...);
 
-  // TODO(turbofan): If JSOrdinaryToInstance raises an exception, the
-  // stack trace doesn't contain the @@hasInstance call; we have the
-  // corresponding bug in the baseline case. Some massaging of the frame
-  // state would be necessary here.
+    // The contract is that we don't leak "the hole" into "user JavaScript",
+    // so we must rename the {element} here to explicitly exclude "the hole"
+    // from the type of {element}.
+    Bind(&if_not_hole);
+    return TypeGuardNonInternal(o);
+  }
 
-  // Morph this {node} into a JSOrdinaryHasInstance node.
-  node->ReplaceInput(0, receiver);
-  node->ReplaceInput(1, object);
-  node->ReplaceInput(2, context);
-  node->ReplaceInput(3, frame_state);
-  node->ReplaceInput(4, effect);
-  node->ReplaceInput(5, control);
-  node->TrimInputCount(6);
-  NodeProperties::ChangeOp(node, javascript()->OrdinaryHasInstance());
-  return Changed(node);
-}
+  TNode<Smi> LoadJSArrayLength(TNode<JSArray> array, ElementsKind kind) {
+    return LoadField<Smi>(AccessBuilder::ForJSArrayLength(kind), array);
+  }
+  void StoreJSArrayLength(TNode<JSArray> array, TNode<Number> value,
+                          ElementsKind kind) {
+    StoreField(AccessBuilder::ForJSArrayLength(kind), array, value);
+  }
+  void StoreFixedArrayBaseElement(TNode<FixedArrayBase> o, TNode<Number> index,
+                                  TNode<Object> v, ElementsKind kind) {
+    StoreElement(AccessBuilder::ForFixedArrayElement(kind), o, index, v);
+  }
 
-Reduction JSCallReducer::ReduceObjectGetPrototype(Node* node, Node* object) {
-  Node* effect = NodeProperties::GetEffectInput(node);
+  TNode<FixedArrayBase> LoadElements(TNode<JSObject> o) {
+    return LoadField<FixedArrayBase>(AccessBuilder::ForJSObjectElements(), o);
+  }
+  TNode<Smi> LoadFixedArrayBaseLength(TNode<FixedArrayBase> o) {
+    return LoadField<Smi>(AccessBuilder::ForFixedArrayLength(), o);
+  }
 
-  // Try to determine the {object} map.
-  MapInference inference(broker(), object, effect);
-  if (!inference.HaveMaps()) return NoChange();
-  MapHandles const& object_maps = inference.GetMaps();
+  TNode<Boolean> HoleCheck(ElementsKind kind, TNode<Object> v) {
+    return IsDoubleElementsKind(kind)
+               ? NumberIsFloat64Hole(TNode<Number>::UncheckedCast(v))
+               : IsTheHole(v);
+  }
 
-  MapRef candidate_map(broker(), object_maps[0]);
-  if (FLAG_concurrent_inlining && !candidate_map.serialized_prototype()) {
-    TRACE_BROKER_MISSING(broker(), "prototype for map " << candidate_map);
-    return inference.NoChange();
+  TNode<Number> CheckFloat64Hole(TNode<Number> value,
+                                 CheckFloat64HoleMode mode) {
+    return AddNode<Number>(
+        graph()->NewNode(simplified()->CheckFloat64Hole(mode, feedback()),
+                         value, effect(), control()));
   }
-  ObjectRef candidate_prototype = candidate_map.prototype();
 
-  // Check if we can constant-fold the {candidate_prototype}.
-  for (size_t i = 0; i < object_maps.size(); ++i) {
-    MapRef object_map(broker(), object_maps[i]);
-    if (FLAG_concurrent_inlining && !object_map.serialized_prototype()) {
-      TRACE_BROKER_MISSING(broker(), "prototype for map " << object_map);
-      return inference.NoChange();
-    }
-    if (IsSpecialReceiverInstanceType(object_map.instance_type()) ||
-        !object_map.prototype().equals(candidate_prototype)) {
-      // We exclude special receivers, like JSProxy or API objects that
-      // might require access checks here; we also don't want to deal
-      // with hidden prototypes at this point.
-      return inference.NoChange();
+  // May deopt for holey double elements.
+  TNode<Object> TryConvertHoleToUndefined(TNode<Object> value,
+                                          ElementsKind kind) {
+    DCHECK(IsHoleyElementsKind(kind));
+    if (kind == HOLEY_DOUBLE_ELEMENTS) {
+      // TODO(7409): avoid deopt if not all uses of value are truncated.
+      TNode<Number> number = TNode<Number>::UncheckedCast(value);
+      return CheckFloat64Hole(number, CheckFloat64HoleMode::kAllowReturnHole);
     }
-    // The above check also excludes maps for primitive values, which is
-    // important because we are not applying [[ToObject]] here as expected.
-    DCHECK(!object_map.IsPrimitiveMap() && object_map.IsJSReceiverMap());
-  }
-  if (!inference.RelyOnMapsViaStability(dependencies())) {
-    return inference.NoChange();
-  }
-  Node* value = jsgraph()->Constant(candidate_prototype);
-  ReplaceWithValue(node, value);
-  return Replace(value);
+
+    return ConvertTaggedHoleToUndefined(value);
+  }
+};
+
+class PromiseBuiltinReducerAssembler : public JSCallReducerAssembler {
+ public:
+  PromiseBuiltinReducerAssembler(JSGraph* jsgraph, Zone* zone, Node* node)
+      : JSCallReducerAssembler(jsgraph, zone, node) {
+    DCHECK_EQ(IrOpcode::kJSConstruct, node->opcode());
+  }
+
+  TNode<Object> ReducePromiseConstructor(
+      const NativeContextRef& native_context);
+
+  int ConstructArity() const {
+    DCHECK_EQ(IrOpcode::kJSConstruct, node_ptr()->opcode());
+    ConstructParameters const& p = ConstructParametersOf(node_ptr()->op());
+    static constexpr int kTarget = 1;     // The first input.
+    static constexpr int kNewTarget = 1;  // The last input.
+    static constexpr int kExtraArgs = kTarget + kNewTarget;
+    DCHECK_GE(p.arity(), kExtraArgs);
+    return static_cast<int>(p.arity() - kExtraArgs);
+  }
+
+  TNode<Object> NewTargetInput() const {
+    // new_target is the last input (after target and all other args).
+    static constexpr int kTarget = 1;
+    return TNode<Object>::UncheckedCast(
+        NodeProperties::GetValueInput(node_ptr(), ConstructArity() + kTarget));
+  }
+
+ private:
+  TNode<JSPromise> CreatePromise(TNode<Context> context) {
+    return AddNode<JSPromise>(
+        graph()->NewNode(javascript()->CreatePromise(), context, effect()));
+  }
+
+  TNode<Context> CreateFunctionContext(const NativeContextRef& native_context,
+                                       TNode<Context> outer_context,
+                                       int slot_count) {
+    return AddNode<Context>(graph()->NewNode(
+        javascript()->CreateFunctionContext(
+            native_context.scope_info().object(),
+            slot_count - Context::MIN_CONTEXT_SLOTS, FUNCTION_SCOPE),
+        outer_context, effect(), control()));
+  }
+
+  void StoreContextSlot(TNode<Context> context, size_t slot_index,
+                        TNode<Object> value) {
+    StoreField(AccessBuilder::ForContextSlot(slot_index), context, value);
+  }
+
+  TNode<JSFunction> CreateClosureFromBuiltinSharedFunctionInfo(
+      SharedFunctionInfoRef shared, TNode<Context> context) {
+    DCHECK(shared.HasBuiltinId());
+    Callable const callable = Builtins::CallableFor(
+        isolate(), static_cast<Builtins::Name>(shared.builtin_id()));
+    return AddNode<JSFunction>(graph()->NewNode(
+        javascript()->CreateClosure(shared.object(),
+                                    isolate()->factory()->many_closures_cell(),
+                                    callable.code()),
+        context, effect(), control()));
+  }
+
+  void CallPromiseExecutor(TNode<Object> executor, TNode<JSFunction> resolve,
+                           TNode<JSFunction> reject, FrameState frame_state) {
+    const ConstructParameters& p = ConstructParametersOf(node_ptr()->op());
+    FeedbackSource no_feedback_source{};
+    MayThrow(_ {
+      return AddNode<Object>(graph()->NewNode(
+          javascript()->Call(4, p.frequency(), no_feedback_source,
+                             ConvertReceiverMode::kNullOrUndefined),
+          executor, UndefinedConstant(), resolve, reject, ContextInput(),
+          frame_state, effect(), control()));
+    });
+  }
+
+  void CallPromiseReject(TNode<JSFunction> reject, TNode<Object> exception,
+                         FrameState frame_state) {
+    const ConstructParameters& p = ConstructParametersOf(node_ptr()->op());
+    FeedbackSource no_feedback_source{};
+    MayThrow(_ {
+      return AddNode<Object>(graph()->NewNode(
+          javascript()->Call(3, p.frequency(), no_feedback_source,
+                             ConvertReceiverMode::kNullOrUndefined),
+          reject, UndefinedConstant(), exception, ContextInput(), frame_state,
+          effect(), control()));
+    });
+  }
+};
+
+TNode<Number> JSCallReducerAssembler::SpeculativeToNumber(
+    TNode<Object> value, NumberOperationHint hint) {
+  return AddNode<Number>(
+      graph()->NewNode(simplified()->SpeculativeToNumber(hint, feedback()),
+                       value, effect(), control()));
 }
 
-// ES6 section 19.1.2.11 Object.getPrototypeOf ( O )
-Reduction JSCallReducer::ReduceObjectGetPrototypeOf(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  Node* object = (node->op()->ValueInputCount() >= 3)
-                     ? NodeProperties::GetValueInput(node, 2)
-                     : jsgraph()->UndefinedConstant();
-  return ReduceObjectGetPrototype(node, object);
+TNode<Smi> JSCallReducerAssembler::CheckSmi(TNode<Object> value) {
+  return AddNode<Smi>(graph()->NewNode(simplified()->CheckSmi(feedback()),
+                                       value, effect(), control()));
 }
 
-// ES section #sec-object.is
-Reduction JSCallReducer::ReduceObjectIs(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& params = CallParametersOf(node->op());
-  int const argc = static_cast<int>(params.arity() - 2);
-  Node* lhs = (argc >= 1) ? NodeProperties::GetValueInput(node, 2)
-                          : jsgraph()->UndefinedConstant();
-  Node* rhs = (argc >= 2) ? NodeProperties::GetValueInput(node, 3)
-                          : jsgraph()->UndefinedConstant();
-  Node* value = graph()->NewNode(simplified()->SameValue(), lhs, rhs);
-  ReplaceWithValue(node, value);
-  return Replace(value);
+TNode<String> JSCallReducerAssembler::CheckString(TNode<Object> value) {
+  return AddNode<String>(graph()->NewNode(simplified()->CheckString(feedback()),
+                                          value, effect(), control()));
 }
 
-// ES6 section B.2.2.1.1 get Object.prototype.__proto__
-Reduction JSCallReducer::ReduceObjectPrototypeGetProto(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  return ReduceObjectGetPrototype(node, receiver);
+TNode<Number> JSCallReducerAssembler::CheckBounds(TNode<Number> value,
+                                                  TNode<Number> limit) {
+  return AddNode<Number>(graph()->NewNode(simplified()->CheckBounds(feedback()),
+                                          value, limit, effect(), control()));
 }
 
-// ES #sec-object.prototype.hasownproperty
-Reduction JSCallReducer::ReduceObjectPrototypeHasOwnProperty(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& params = CallParametersOf(node->op());
-  int const argc = static_cast<int>(params.arity() - 2);
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* name = (argc >= 1) ? NodeProperties::GetValueInput(node, 2)
-                           : jsgraph()->UndefinedConstant();
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
+TNode<Smi> JSCallReducerAssembler::TypeGuardUnsignedSmall(TNode<Object> value) {
+  return TNode<Smi>::UncheckedCast(TypeGuard(Type::UnsignedSmall(), value));
+}
 
-  // We can optimize a call to Object.prototype.hasOwnProperty if it's being
-  // used inside a fast-mode for..in, so for code like this:
-  //
-  //   for (name in receiver) {
-  //     if (receiver.hasOwnProperty(name)) {
-  //        ...
-  //     }
-  //   }
-  //
-  // If the for..in is in fast-mode, we know that the {receiver} has {name}
-  // as own property, otherwise the enumeration wouldn't include it. The graph
-  // constructed by the BytecodeGraphBuilder in this case looks like this:
+TNode<Object> JSCallReducerAssembler::TypeGuardNonInternal(
+    TNode<Object> value) {
+  return TNode<Object>::UncheckedCast(TypeGuard(Type::NonInternal(), value));
+}
 
-  // receiver
-  //  ^    ^
-  //  |    |
-  //  |    +-+
-  //  |      |
-  //  |   JSToObject
-  //  |      ^
-  //  |      |
-  //  |   JSForInNext
-  //  |      ^
-  //  +----+ |
-  //       | |
-  //  JSCall[hasOwnProperty]
+TNode<Number> JSCallReducerAssembler::TypeGuardFixedArrayLength(
+    TNode<Object> value) {
+  DCHECK(TypeCache::Get()->kFixedDoubleArrayLengthType.Is(
+      TypeCache::Get()->kFixedArrayLengthType));
+  return TNode<Number>::UncheckedCast(
+      TypeGuard(TypeCache::Get()->kFixedArrayLengthType, value));
+}
 
-  // We can constant-fold the {node} to True in this case, and insert
-  // a (potentially redundant) map check to guard the fact that the
-  // {receiver} map didn't change since the dominating JSForInNext. This
-  // map check is only necessary when TurboFan cannot prove that there
-  // is no observable side effect between the {JSForInNext} and the
-  // {JSCall} to Object.prototype.hasOwnProperty.
-  //
-  // Also note that it's safe to look through the {JSToObject}, since the
-  // Object.prototype.hasOwnProperty does an implicit ToObject anyway, and
-  // these operations are not observable.
-  if (name->opcode() == IrOpcode::kJSForInNext) {
-    ForInMode const mode = ForInModeOf(name->op());
-    if (mode != ForInMode::kGeneric) {
-      Node* object = NodeProperties::GetValueInput(name, 0);
-      Node* cache_type = NodeProperties::GetValueInput(name, 2);
-      if (object->opcode() == IrOpcode::kJSToObject) {
-        object = NodeProperties::GetValueInput(object, 0);
-      }
-      if (object == receiver) {
-        // No need to repeat the map check if we can prove that there's no
-        // observable side effect between {effect} and {name].
-        if (!NodeProperties::NoObservableSideEffectBetween(effect, name)) {
-          Node* receiver_map = effect =
-              graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
-                               receiver, effect, control);
-          Node* check = graph()->NewNode(simplified()->ReferenceEqual(),
-                                         receiver_map, cache_type);
-          effect = graph()->NewNode(
-              simplified()->CheckIf(DeoptimizeReason::kWrongMap), check, effect,
-              control);
-        }
-        Node* value = jsgraph()->TrueConstant();
-        ReplaceWithValue(node, value, effect, control);
-        return Replace(value);
-      }
-    }
-  }
+TNode<Object> JSCallReducerAssembler::Call4(
+    const Callable& callable, TNode<Context> context, TNode<Object> arg0,
+    TNode<Object> arg1, TNode<Object> arg2, TNode<Object> arg3) {
+  // TODO(jgruber): Make this more generic. Currently it's fitted to its single
+  // callsite.
+  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+      graph()->zone(), callable.descriptor(),
+      callable.descriptor().GetStackParameterCount(), CallDescriptor::kNoFlags,
+      Operator::kEliminatable);
 
-  return NoChange();
+  return TNode<Object>::UncheckedCast(Call(desc, HeapConstant(callable.code()),
+                                           arg0, arg1, arg2, arg3, context));
 }
 
-// ES #sec-object.prototype.isprototypeof
-Reduction JSCallReducer::ReduceObjectPrototypeIsPrototypeOf(Node* node) {
-  DisallowHeapAccessIf no_heap_access(FLAG_concurrent_inlining);
+TNode<Object> JSCallReducerAssembler::JSCall3(
+    TNode<Object> function, TNode<Object> this_arg, TNode<Object> arg0,
+    TNode<Object> arg1, TNode<Object> arg2, FrameState frame_state) {
+  CallParameters const& p = CallParametersOf(node_ptr()->op());
+  return MayThrow(_ {
+    return AddNode<Object>(graph()->NewNode(
+        javascript()->Call(5, p.frequency(), p.feedback(),
+                           ConvertReceiverMode::kAny, p.speculation_mode(),
+                           CallFeedbackRelation::kUnrelated),
+        function, this_arg, arg0, arg1, arg2, ContextInput(), frame_state,
+        effect(), control()));
+  });
+}
 
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* value = node->op()->ValueInputCount() > 2
-                    ? NodeProperties::GetValueInput(node, 2)
-                    : jsgraph()->UndefinedConstant();
-  Node* effect = NodeProperties::GetEffectInput(node);
+TNode<Object> JSCallReducerAssembler::JSCall4(
+    TNode<Object> function, TNode<Object> this_arg, TNode<Object> arg0,
+    TNode<Object> arg1, TNode<Object> arg2, TNode<Object> arg3,
+    FrameState frame_state) {
+  CallParameters const& p = CallParametersOf(node_ptr()->op());
+  return MayThrow(_ {
+    return AddNode<Object>(graph()->NewNode(
+        javascript()->Call(6, p.frequency(), p.feedback(),
+                           ConvertReceiverMode::kAny, p.speculation_mode(),
+                           CallFeedbackRelation::kUnrelated),
+        function, this_arg, arg0, arg1, arg2, arg3, ContextInput(), frame_state,
+        effect(), control()));
+  });
+}
 
-  // Ensure that the {receiver} is known to be a JSReceiver (so that
-  // the ToObject step of Object.prototype.isPrototypeOf is a no-op).
-  MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps() || !inference.AllOfInstanceTypesAreJSReceiver()) {
-    return NoChange();
-  }
+TNode<Object> JSCallReducerAssembler::JSCallRuntime2(
+    Runtime::FunctionId function_id, TNode<Object> arg0, TNode<Object> arg1,
+    FrameState frame_state) {
+  return MayThrow(_ {
+    return AddNode<Object>(
+        graph()->NewNode(javascript()->CallRuntime(function_id, 2), arg0, arg1,
+                         ContextInput(), frame_state, effect(), control()));
+  });
+}
 
-  // We don't check whether {value} is a proper JSReceiver here explicitly,
-  // and don't explicitly rule out Primitive {value}s, since all of them
-  // have null as their prototype, so the prototype chain walk inside the
-  // JSHasInPrototypeChain operator immediately aborts and yields false.
-  NodeProperties::ReplaceValueInput(node, value, 0);
-  NodeProperties::ReplaceValueInput(node, receiver, 1);
-  for (int i = node->op()->ValueInputCount(); i-- > 2;) {
-    node->RemoveInput(i);
-  }
-  NodeProperties::ChangeOp(node, javascript()->HasInPrototypeChain());
-  return Changed(node);
+TNode<JSArray> JSCallReducerAssembler::CreateArrayNoThrow(TNode<Object> ctor,
+                                                          TNode<Number> size) {
+  return AddNode<JSArray>(graph()->NewNode(
+      javascript()->CreateArray(1, MaybeHandle<AllocationSite>()), ctor, ctor,
+      size, ContextInput(), FrameStateInput(), effect(), control()));
 }
 
-// ES6 section 26.1.1 Reflect.apply ( target, thisArgument, argumentsList )
-Reduction JSCallReducer::ReduceReflectApply(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
-  int arity = static_cast<int>(p.arity() - 2);
-  DCHECK_LE(0, arity);
-  // Massage value inputs appropriately.
-  node->RemoveInput(0);
-  node->RemoveInput(0);
-  while (arity < 3) {
-    node->InsertInput(graph()->zone(), arity++, jsgraph()->UndefinedConstant());
-  }
-  while (arity-- > 3) {
-    node->RemoveInput(arity);
-  }
-  NodeProperties::ChangeOp(node,
-                           javascript()->CallWithArrayLike(p.frequency()));
-  Reduction const reduction = ReduceJSCallWithArrayLike(node);
-  return reduction.Changed() ? reduction : Changed(node);
+TNode<JSArray> JSCallReducerAssembler::AllocateEmptyJSArray(
+    ElementsKind kind, const NativeContextRef& native_context) {
+  // TODO(jgruber): Port AllocationBuilder to JSGraphAssembler.
+  MapRef map = native_context.GetInitialJSArrayMap(kind);
+
+  AllocationBuilder ab(jsgraph(), effect(), control());
+  ab.Allocate(map.instance_size(), AllocationType::kYoung, Type::Array());
+  ab.Store(AccessBuilder::ForMap(), map);
+  Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
+  ab.Store(AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer(),
+           empty_fixed_array);
+  ab.Store(AccessBuilder::ForJSObjectElements(), empty_fixed_array);
+  ab.Store(AccessBuilder::ForJSArrayLength(kind), jsgraph()->ZeroConstant());
+  for (int i = 0; i < map.GetInObjectProperties(); ++i) {
+    ab.Store(AccessBuilder::ForJSObjectInObjectProperty(map, i),
+             jsgraph()->UndefinedConstant());
+  }
+  Node* result = ab.Finish();
+  InitializeEffectControl(result, control());
+  return TNode<JSArray>::UncheckedCast(result);
 }
 
-// ES6 section 26.1.2 Reflect.construct ( target, argumentsList [, newTarget] )
-Reduction JSCallReducer::ReduceReflectConstruct(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
-  int arity = static_cast<int>(p.arity() - 2);
-  DCHECK_LE(0, arity);
-  // Massage value inputs appropriately.
-  node->RemoveInput(0);
-  node->RemoveInput(0);
-  while (arity < 2) {
-    node->InsertInput(graph()->zone(), arity++, jsgraph()->UndefinedConstant());
-  }
-  if (arity < 3) {
-    node->InsertInput(graph()->zone(), arity++, node->InputAt(0));
-  }
-  while (arity-- > 3) {
-    node->RemoveInput(arity);
-  }
-  NodeProperties::ChangeOp(node,
-                           javascript()->ConstructWithArrayLike(p.frequency()));
-  Reduction const reduction = ReduceJSConstructWithArrayLike(node);
-  return reduction.Changed() ? reduction : Changed(node);
+TNode<Object> JSCallReducerAssembler::ReduceMathUnary(const Operator* op) {
+  TNode<Object> input = ValueInput(2);
+  TNode<Number> input_as_number = SpeculativeToNumber(input);
+  return TNode<Object>::UncheckedCast(graph()->NewNode(op, input_as_number));
 }
 
-// ES6 section 26.1.7 Reflect.getPrototypeOf ( target )
-Reduction JSCallReducer::ReduceReflectGetPrototypeOf(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  Node* target = (node->op()->ValueInputCount() >= 3)
-                     ? NodeProperties::GetValueInput(node, 2)
-                     : jsgraph()->UndefinedConstant();
-  return ReduceObjectGetPrototype(node, target);
+TNode<Object> JSCallReducerAssembler::ReduceMathBinary(const Operator* op) {
+  TNode<Object> left = ValueInput(2);
+  TNode<Object> right = ValueInputOrNaN(3);
+  TNode<Number> left_number = SpeculativeToNumber(left);
+  TNode<Number> right_number = SpeculativeToNumber(right);
+  return TNode<Object>::UncheckedCast(
+      graph()->NewNode(op, left_number, right_number));
 }
 
-// ES6 section #sec-object.create Object.create(proto, properties)
-Reduction JSCallReducer::ReduceObjectCreate(Node* node) {
-  int arg_count = node->op()->ValueInputCount();
-  Node* properties = arg_count >= 4 ? NodeProperties::GetValueInput(node, 3)
-                                    : jsgraph()->UndefinedConstant();
-  if (properties != jsgraph()->UndefinedConstant()) return NoChange();
+TNode<String> JSCallReducerAssembler::ReduceStringPrototypeSubstring() {
+  TNode<Object> receiver = ValueInput(1);
+  TNode<Object> start = ValueInput(2);
+  TNode<Object> end = ValueInputOrUndefined(3);
 
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* prototype = arg_count >= 3 ? NodeProperties::GetValueInput(node, 2)
-                                   : jsgraph()->UndefinedConstant();
-  node->ReplaceInput(0, prototype);
-  node->ReplaceInput(1, context);
-  node->ReplaceInput(2, frame_state);
-  node->ReplaceInput(3, effect);
-  node->ReplaceInput(4, control);
-  node->TrimInputCount(5);
-  NodeProperties::ChangeOp(node, javascript()->CreateObject());
-  return Changed(node);
+  TNode<String> receiver_string = CheckString(receiver);
+  TNode<Number> start_smi = CheckSmi(start);
+
+  TNode<Number> length = StringLength(receiver_string);
+
+  TNode<Number> end_smi = SelectIf<Number>(IsUndefined(end))
+                              .Then(_ { return length; })
+                              .Else(_ { return CheckSmi(end); })
+                              .ExpectFalse()
+                              .Value();
+
+  TNode<Number> zero = TNode<Number>::UncheckedCast(ZeroConstant());
+  TNode<Number> finalStart = NumberMin(NumberMax(start_smi, zero), length);
+  TNode<Number> finalEnd = NumberMin(NumberMax(end_smi, zero), length);
+  TNode<Number> from = NumberMin(finalStart, finalEnd);
+  TNode<Number> to = NumberMax(finalStart, finalEnd);
+
+  return StringSubstring(receiver_string, from, to);
 }
 
-// ES section #sec-reflect.get
-Reduction JSCallReducer::ReduceReflectGet(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
-  int arity = static_cast<int>(p.arity() - 2);
-  if (arity != 2) return NoChange();
-  Node* target = NodeProperties::GetValueInput(node, 2);
-  Node* key = NodeProperties::GetValueInput(node, 3);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
+TNode<String> JSCallReducerAssembler::ReduceStringPrototypeSlice() {
+  TNode<Object> receiver = ValueInput(1);
+  TNode<Object> start = ValueInput(2);
+  TNode<Object> end = ValueInputOrUndefined(3);
+
+  TNode<String> receiver_string = CheckString(receiver);
+  TNode<Number> start_smi = CheckSmi(start);
+
+  TNode<Number> length = StringLength(receiver_string);
+
+  TNode<Number> end_smi = SelectIf<Number>(IsUndefined(end))
+                              .Then(_ { return length; })
+                              .Else(_ { return CheckSmi(end); })
+                              .ExpectFalse()
+                              .Value();
+
+  TNode<Number> zero = TNode<Number>::UncheckedCast(ZeroConstant());
+  TNode<Number> from_untyped =
+      SelectIf<Number>(NumberLessThan(start_smi, zero))
+          .Then(_ { return NumberMax(NumberAdd(length, start_smi), zero); })
+          .Else(_ { return NumberMin(start_smi, length); })
+          .ExpectFalse()
+          .Value();
+  // {from} is always in non-negative Smi range, but our typer cannot figure
+  // that out yet.
+  TNode<Smi> from = TypeGuardUnsignedSmall(from_untyped);
+
+  TNode<Number> to_untyped =
+      SelectIf<Number>(NumberLessThan(end_smi, zero))
+          .Then(_ { return NumberMax(NumberAdd(length, end_smi), zero); })
+          .Else(_ { return NumberMin(end_smi, length); })
+          .ExpectFalse()
+          .Value();
+  // {to} is always in non-negative Smi range, but our typer cannot figure that
+  // out yet.
+  TNode<Smi> to = TypeGuardUnsignedSmall(to_untyped);
+
+  return SelectIf<String>(NumberLessThan(from, to))
+      .Then(_ { return StringSubstring(receiver_string, from, to); })
+      .Else(_ { return EmptyStringConstant(); })
+      .ExpectTrue()
+      .Value();
+}
 
-  // Check whether {target} is a JSReceiver.
-  Node* check = graph()->NewNode(simplified()->ObjectIsReceiver(), target);
-  Node* branch =
-      graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
+namespace {
 
-  // Throw an appropriate TypeError if the {target} is not a JSReceiver.
-  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-  Node* efalse = effect;
-  {
-    if_false = efalse = graph()->NewNode(
-        javascript()->CallRuntime(Runtime::kThrowTypeError, 2),
-        jsgraph()->Constant(
-            static_cast<int>(MessageTemplate::kCalledOnNonObject)),
-        jsgraph()->HeapConstant(factory()->ReflectGet_string()), context,
-        frame_state, efalse, if_false);
-  }
+struct ForEachFrameStateParams {
+  JSGraph* jsgraph;
+  SharedFunctionInfoRef shared;
+  TNode<Context> context;
+  TNode<Object> target;
+  FrameState outer_frame_state;
+  TNode<Object> receiver;
+  TNode<Object> callback;
+  TNode<Object> this_arg;
+  TNode<Object> original_length;
+};
+
+FrameState ForEachLoopLazyFrameState(const ForEachFrameStateParams& params,
+                                     TNode<Object> k) {
+  Builtins::Name builtin = Builtins::kArrayForEachLoopLazyDeoptContinuation;
+  Node* checkpoint_params[] = {params.receiver, params.callback,
+                               params.this_arg, k, params.original_length};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared, builtin, params.target, params.context,
+      checkpoint_params, arraysize(checkpoint_params), params.outer_frame_state,
+      ContinuationFrameStateMode::LAZY));
+}
 
-  // Otherwise just use the existing GetPropertyStub.
-  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-  Node* etrue = effect;
-  Node* vtrue;
-  {
-    Callable callable =
-        Builtins::CallableFor(isolate(), Builtins::kGetProperty);
-    auto call_descriptor = Linkage::GetStubCallDescriptor(
-        graph()->zone(), callable.descriptor(),
-        callable.descriptor().GetStackParameterCount(),
-        CallDescriptor::kNeedsFrameState, Operator::kNoProperties);
-    Node* stub_code = jsgraph()->HeapConstant(callable.code());
-    vtrue = etrue = if_true =
-        graph()->NewNode(common()->Call(call_descriptor), stub_code, target,
-                         key, context, frame_state, etrue, if_true);
-  }
+FrameState ForEachLoopEagerFrameState(const ForEachFrameStateParams& params,
+                                      TNode<Object> k) {
+  Builtins::Name builtin = Builtins::kArrayForEachLoopEagerDeoptContinuation;
+  Node* checkpoint_params[] = {params.receiver, params.callback,
+                               params.this_arg, k, params.original_length};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared, builtin, params.target, params.context,
+      checkpoint_params, arraysize(checkpoint_params), params.outer_frame_state,
+      ContinuationFrameStateMode::EAGER));
+}
 
-  // Rewire potential exception edges.
-  Node* on_exception = nullptr;
-  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
-    // Create appropriate {IfException} and {IfSuccess} nodes.
-    Node* extrue = graph()->NewNode(common()->IfException(), etrue, if_true);
-    if_true = graph()->NewNode(common()->IfSuccess(), if_true);
-    Node* exfalse = graph()->NewNode(common()->IfException(), efalse, if_false);
-    if_false = graph()->NewNode(common()->IfSuccess(), if_false);
+}  // namespace
 
-    // Join the exception edges.
-    Node* merge = graph()->NewNode(common()->Merge(2), extrue, exfalse);
-    Node* ephi =
-        graph()->NewNode(common()->EffectPhi(2), extrue, exfalse, merge);
-    Node* phi =
-        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                         extrue, exfalse, merge);
-    ReplaceWithValue(on_exception, phi, ephi, merge);
-  }
+TNode<Object>
+IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeForEach(
+    MapInference* inference, const bool has_stability_dependency,
+    ElementsKind kind, const SharedFunctionInfoRef& shared) {
+  FrameState outer_frame_state = FrameStateInput();
+  TNode<Context> context = ContextInput();
+  TNode<Object> target = TargetInput();
+  TNode<JSArray> receiver = ValueInputAs<JSArray>(1);
+  TNode<Object> fncallback = ValueInputOrUndefined(2);
+  TNode<Object> this_arg = ValueInputOrUndefined(3);
 
-  // Connect the throwing path to end.
-  if_false = graph()->NewNode(common()->Throw(), efalse, if_false);
-  NodeProperties::MergeControlToEnd(graph(), common(), if_false);
+  TNode<Number> original_length = LoadJSArrayLength(receiver, kind);
 
-  // Continue on the regular path.
-  ReplaceWithValue(node, vtrue, etrue, if_true);
-  return Changed(vtrue);
+  ForEachFrameStateParams frame_state_params{
+      jsgraph(), shared,     context,  target,         outer_frame_state,
+      receiver,  fncallback, this_arg, original_length};
+
+  ThrowIfNotCallable(fncallback, ForEachLoopLazyFrameState(frame_state_params,
+                                                           ZeroConstant()));
+
+  ForZeroUntil(original_length).Do([&](TNode<Number> k) {
+    Checkpoint(ForEachLoopEagerFrameState(frame_state_params, k));
+
+    // Deopt if the map has changed during the iteration.
+    MaybeInsertMapChecks(inference, has_stability_dependency);
+
+    TNode<Object> element;
+    std::tie(k, element) = SafeLoadElement(kind, receiver, k);
+
+    auto continue_label = MakeLabel();
+    element = MaybeSkipHole(element, kind, &continue_label);
+
+    TNode<Number> next_k = NumberAdd(k, OneConstant());
+    JSCall3(fncallback, this_arg, element, k, receiver,
+            ForEachLoopLazyFrameState(frame_state_params, next_k));
+
+    Goto(&continue_label);
+    Bind(&continue_label);
+  });
+
+  return UndefinedConstant();
 }
 
-// ES section #sec-reflect.has
-Reduction JSCallReducer::ReduceReflectHas(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
-  int arity = static_cast<int>(p.arity() - 2);
-  DCHECK_LE(0, arity);
-  Node* target = (arity >= 1) ? NodeProperties::GetValueInput(node, 2)
-                              : jsgraph()->UndefinedConstant();
-  Node* key = (arity >= 2) ? NodeProperties::GetValueInput(node, 3)
-                           : jsgraph()->UndefinedConstant();
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
+namespace {
 
-  // Check whether {target} is a JSReceiver.
-  Node* check = graph()->NewNode(simplified()->ObjectIsReceiver(), target);
-  Node* branch =
-      graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
+struct ReduceFrameStateParams {
+  JSGraph* jsgraph;
+  SharedFunctionInfoRef shared;
+  ArrayReduceDirection direction;
+  TNode<Context> context;
+  TNode<Object> target;
+  FrameState outer_frame_state;
+};
+
+FrameState ReducePreLoopLazyFrameState(const ReduceFrameStateParams& params,
+                                       TNode<Object> receiver,
+                                       TNode<Object> callback, TNode<Object> k,
+                                       TNode<Number> original_length) {
+  Builtins::Name builtin =
+      (params.direction == ArrayReduceDirection::kLeft)
+          ? Builtins::kArrayReduceLoopLazyDeoptContinuation
+          : Builtins::kArrayReduceRightLoopLazyDeoptContinuation;
+  Node* checkpoint_params[] = {receiver, callback, k, original_length};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared, builtin, params.target, params.context,
+      checkpoint_params, arraysize(checkpoint_params), params.outer_frame_state,
+      ContinuationFrameStateMode::LAZY));
+}
 
-  // Throw an appropriate TypeError if the {target} is not a JSReceiver.
-  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-  Node* efalse = effect;
-  {
-    if_false = efalse = graph()->NewNode(
-        javascript()->CallRuntime(Runtime::kThrowTypeError, 2),
-        jsgraph()->Constant(
-            static_cast<int>(MessageTemplate::kCalledOnNonObject)),
-        jsgraph()->HeapConstant(factory()->ReflectHas_string()), context,
-        frame_state, efalse, if_false);
-  }
+FrameState ReducePreLoopEagerFrameState(const ReduceFrameStateParams& params,
+                                        TNode<Object> receiver,
+                                        TNode<Object> callback,
+                                        TNode<Number> original_length) {
+  Builtins::Name builtin =
+      (params.direction == ArrayReduceDirection::kLeft)
+          ? Builtins::kArrayReducePreLoopEagerDeoptContinuation
+          : Builtins::kArrayReduceRightPreLoopEagerDeoptContinuation;
+  Node* checkpoint_params[] = {receiver, callback, original_length};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared, builtin, params.target, params.context,
+      checkpoint_params, arraysize(checkpoint_params), params.outer_frame_state,
+      ContinuationFrameStateMode::EAGER));
+}
 
-  // Otherwise just use the existing {JSHasProperty} logic.
-  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-  Node* etrue = effect;
-  Node* vtrue;
-  {
-    // TODO(magardn): collect feedback so this can be optimized
-    vtrue = etrue = if_true =
-        graph()->NewNode(javascript()->HasProperty(FeedbackSource()), target,
-                         key, context, frame_state, etrue, if_true);
-  }
+FrameState ReduceLoopLazyFrameState(const ReduceFrameStateParams& params,
+                                    TNode<Object> receiver,
+                                    TNode<Object> callback, TNode<Object> k,
+                                    TNode<Number> original_length) {
+  Builtins::Name builtin =
+      (params.direction == ArrayReduceDirection::kLeft)
+          ? Builtins::kArrayReduceLoopLazyDeoptContinuation
+          : Builtins::kArrayReduceRightLoopLazyDeoptContinuation;
+  Node* checkpoint_params[] = {receiver, callback, k, original_length};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared, builtin, params.target, params.context,
+      checkpoint_params, arraysize(checkpoint_params), params.outer_frame_state,
+      ContinuationFrameStateMode::LAZY));
+}
 
-  // Rewire potential exception edges.
-  Node* on_exception = nullptr;
-  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
-    // Create appropriate {IfException} and {IfSuccess} nodes.
-    Node* extrue = graph()->NewNode(common()->IfException(), etrue, if_true);
-    if_true = graph()->NewNode(common()->IfSuccess(), if_true);
-    Node* exfalse = graph()->NewNode(common()->IfException(), efalse, if_false);
-    if_false = graph()->NewNode(common()->IfSuccess(), if_false);
+FrameState ReduceLoopEagerFrameState(const ReduceFrameStateParams& params,
+                                     TNode<Object> receiver,
+                                     TNode<Object> callback, TNode<Object> k,
+                                     TNode<Number> original_length,
+                                     TNode<Object> accumulator) {
+  Builtins::Name builtin =
+      (params.direction == ArrayReduceDirection::kLeft)
+          ? Builtins::kArrayReduceLoopEagerDeoptContinuation
+          : Builtins::kArrayReduceRightLoopEagerDeoptContinuation;
+  Node* checkpoint_params[] = {receiver, callback, k, original_length,
+                               accumulator};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared, builtin, params.target, params.context,
+      checkpoint_params, arraysize(checkpoint_params), params.outer_frame_state,
+      ContinuationFrameStateMode::EAGER));
+}
 
-    // Join the exception edges.
-    Node* merge = graph()->NewNode(common()->Merge(2), extrue, exfalse);
-    Node* ephi =
-        graph()->NewNode(common()->EffectPhi(2), extrue, exfalse, merge);
-    Node* phi =
-        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                         extrue, exfalse, merge);
-    ReplaceWithValue(on_exception, phi, ephi, merge);
+}  // namespace
+
+TNode<Object> IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeReduce(
+    MapInference* inference, const bool has_stability_dependency,
+    ElementsKind kind, ArrayReduceDirection direction,
+    const SharedFunctionInfoRef& shared) {
+  FrameState outer_frame_state = FrameStateInput();
+  TNode<Context> context = ContextInput();
+  TNode<Object> target = TargetInput();
+  TNode<JSArray> receiver = ValueInputAs<JSArray>(1);
+  TNode<Object> fncallback = ValueInputOrUndefined(2);
+
+  ReduceFrameStateParams frame_state_params{
+      jsgraph(), shared, direction, context, target, outer_frame_state};
+
+  TNode<Number> original_length = LoadJSArrayLength(receiver, kind);
+
+  // Set up variable behavior depending on the reduction kind (left/right).
+  TNode<Number> k;
+  StepFunction1 step;
+  ConditionFunction1 cond;
+  TNode<Number> zero = ZeroConstant();
+  TNode<Number> one = OneConstant();
+  if (direction == ArrayReduceDirection::kLeft) {
+    k = zero;
+    step = [&](TNode<Number> i) { return NumberAdd(i, one); };
+    cond = [&](TNode<Number> i) { return NumberLessThan(i, original_length); };
+  } else {
+    k = NumberSubtract(original_length, one);
+    step = [&](TNode<Number> i) { return NumberSubtract(i, one); };
+    cond = [&](TNode<Number> i) { return NumberLessThanOrEqual(zero, i); };
   }
 
-  // Connect the throwing path to end.
-  if_false = graph()->NewNode(common()->Throw(), efalse, if_false);
-  NodeProperties::MergeControlToEnd(graph(), common(), if_false);
+  ThrowIfNotCallable(
+      fncallback, ReducePreLoopLazyFrameState(frame_state_params, receiver,
+                                              fncallback, k, original_length));
 
-  // Continue on the regular path.
-  ReplaceWithValue(node, vtrue, etrue, if_true);
-  return Changed(vtrue);
+  // Set initial accumulator value.
+  TNode<Object> accumulator;
+  if (node_ptr()->op()->ValueInputCount() > 3) {
+    accumulator = ValueInput(3);  // Initial value specified by the user.
+  } else {
+    // The initial value was not specified by the user. In this case, the first
+    // (or last in the case of reduceRight) non-holey value of the array is
+    // used. Loop until we find it. If not found, trigger a deopt.
+    // TODO(jgruber): The deopt does not seem necessary. Instead we could simply
+    // throw the TypeError here from optimized code.
+    auto found_initial_element = MakeLabel(MachineRepresentation::kTagged,
+                                           MachineRepresentation::kTagged);
+    Forever(k, step).Do([&](TNode<Number> k) {
+      Checkpoint(ReducePreLoopEagerFrameState(frame_state_params, receiver,
+                                              fncallback, original_length));
+      CheckIf(cond(k), DeoptimizeReason::kNoInitialElement);
+
+      TNode<Object> element;
+      std::tie(k, element) = SafeLoadElement(kind, receiver, k);
+
+      auto continue_label = MakeLabel();
+      GotoIf(HoleCheck(kind, element), &continue_label);
+      Goto(&found_initial_element, k, TypeGuardNonInternal(element));
+
+      Bind(&continue_label);
+    });
+    Unreachable();  // The loop is exited either by deopt or a jump to below.
+    InitializeEffectControl(nullptr, nullptr);
+
+    // TODO(jgruber): This manual fiddling with blocks could be avoided by
+    // implementing a `break` mechanic for loop builders.
+    Bind(&found_initial_element);
+    k = step(found_initial_element.PhiAt<Number>(0));
+    accumulator = found_initial_element.PhiAt<Object>(1);
+  }
+
+  TNode<Object> result =
+      For1(k, cond, step, accumulator)
+          .Do([&](TNode<Number> k, TNode<Object>* accumulator) {
+            Checkpoint(ReduceLoopEagerFrameState(frame_state_params, receiver,
+                                                 fncallback, k, original_length,
+                                                 *accumulator));
+
+            // Deopt if the map has changed during the iteration.
+            MaybeInsertMapChecks(inference, has_stability_dependency);
+
+            TNode<Object> element;
+            std::tie(k, element) = SafeLoadElement(kind, receiver, k);
+
+            auto continue_label = MakeLabel(MachineRepresentation::kTagged);
+            element =
+                MaybeSkipHole(element, kind, &continue_label, *accumulator);
+
+            TNode<Number> next_k = step(k);
+            TNode<Object> next_accumulator = JSCall4(
+                fncallback, UndefinedConstant(), *accumulator, element, k,
+                receiver,
+                ReduceLoopLazyFrameState(frame_state_params, receiver,
+                                         fncallback, next_k, original_length));
+            Goto(&continue_label, next_accumulator);
+
+            Bind(&continue_label);
+            *accumulator = continue_label.PhiAt<Object>(0);
+          })
+          .Value();
+
+  return result;
+}
+
+namespace {
+
+struct MapFrameStateParams {
+  JSGraph* jsgraph;
+  SharedFunctionInfoRef shared;
+  TNode<Context> context;
+  TNode<Object> target;
+  FrameState outer_frame_state;
+  TNode<Object> receiver;
+  TNode<Object> callback;
+  TNode<Object> this_arg;
+  TNode<JSArray> a;
+  TNode<Object> original_length;
+};
+
+FrameState MapLoopLazyFrameState(const MapFrameStateParams& params,
+                                 TNode<Number> k) {
+  Node* checkpoint_params[] = {
+      params.receiver,       params.callback, params.this_arg, params.a, k,
+      params.original_length};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared,
+      Builtins::kArrayMapLoopLazyDeoptContinuation, params.target,
+      params.context, checkpoint_params, arraysize(checkpoint_params),
+      params.outer_frame_state, ContinuationFrameStateMode::LAZY));
 }
 
-Node* JSCallReducer::WireInLoopStart(Node* k, Node** control, Node** effect) {
-  Node* loop = *control =
-      graph()->NewNode(common()->Loop(2), *control, *control);
-  Node* eloop = *effect =
-      graph()->NewNode(common()->EffectPhi(2), *effect, *effect, loop);
-  Node* terminate = graph()->NewNode(common()->Terminate(), eloop, loop);
-  NodeProperties::MergeControlToEnd(graph(), common(), terminate);
-  return graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2), k,
-                          k, loop);
+FrameState MapLoopEagerFrameState(const MapFrameStateParams& params,
+                                  TNode<Number> k) {
+  Node* checkpoint_params[] = {
+      params.receiver,       params.callback, params.this_arg, params.a, k,
+      params.original_length};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared,
+      Builtins::kArrayMapLoopEagerDeoptContinuation, params.target,
+      params.context, checkpoint_params, arraysize(checkpoint_params),
+      params.outer_frame_state, ContinuationFrameStateMode::EAGER));
 }
 
-void JSCallReducer::WireInLoopEnd(Node* loop, Node* eloop, Node* vloop, Node* k,
-                                  Node* control, Node* effect) {
-  loop->ReplaceInput(1, control);
-  vloop->ReplaceInput(1, k);
-  eloop->ReplaceInput(1, effect);
+}  // namespace
+
+TNode<JSArray> IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeMap(
+    MapInference* inference, const bool has_stability_dependency,
+    ElementsKind kind, const SharedFunctionInfoRef& shared,
+    const NativeContextRef& native_context) {
+  FrameState outer_frame_state = FrameStateInput();
+  TNode<Context> context = ContextInput();
+  TNode<Object> target = TargetInput();
+  TNode<JSArray> receiver = ValueInputAs<JSArray>(1);
+  TNode<Object> fncallback = ValueInputOrUndefined(2);
+  TNode<Object> this_arg = ValueInputOrUndefined(3);
+
+  TNode<Number> original_length = LoadJSArrayLength(receiver, kind);
+
+  // If the array length >= kMaxFastArrayLength, then CreateArray
+  // will create a dictionary. We should deopt in this case, and make sure
+  // not to attempt inlining again.
+  original_length = CheckBounds(original_length,
+                                NumberConstant(JSArray::kMaxFastArrayLength));
+
+  // Even though {JSCreateArray} is not marked as {kNoThrow}, we can elide the
+  // exceptional projections because it cannot throw with the given
+  // parameters.
+  TNode<Object> array_ctor =
+      Constant(native_context.GetInitialJSArrayMap(kind).GetConstructor());
+  TNode<JSArray> a = CreateArrayNoThrow(array_ctor, original_length);
+
+  MapFrameStateParams frame_state_params{
+      jsgraph(), shared,     context,  target, outer_frame_state,
+      receiver,  fncallback, this_arg, a,      original_length};
+
+  ThrowIfNotCallable(fncallback,
+                     MapLoopLazyFrameState(frame_state_params, ZeroConstant()));
+
+  ForZeroUntil(original_length).Do([&](TNode<Number> k) {
+    Checkpoint(MapLoopEagerFrameState(frame_state_params, k));
+    MaybeInsertMapChecks(inference, has_stability_dependency);
+
+    TNode<Object> element;
+    std::tie(k, element) = SafeLoadElement(kind, receiver, k);
+
+    auto continue_label = MakeLabel();
+    element = MaybeSkipHole(element, kind, &continue_label);
+
+    TNode<Object> v = JSCall3(fncallback, this_arg, element, k, receiver,
+                              MapLoopLazyFrameState(frame_state_params, k));
+
+    // The array {a} should be HOLEY_SMI_ELEMENTS because we'd only come into
+    // this loop if the input array length is non-zero, and "new Array({x > 0})"
+    // always produces a HOLEY array.
+    MapRef holey_double_map =
+        native_context.GetInitialJSArrayMap(HOLEY_DOUBLE_ELEMENTS);
+    MapRef holey_map = native_context.GetInitialJSArrayMap(HOLEY_ELEMENTS);
+    TransitionAndStoreElement(holey_double_map, holey_map, a, k, v);
+
+    Goto(&continue_label);
+    Bind(&continue_label);
+  });
+
+  return a;
 }
 
 namespace {
-bool CanInlineArrayIteratingBuiltin(JSHeapBroker* broker,
-                                    MapHandles const& receiver_maps,
-                                    ElementsKind* kind_return) {
-  DCHECK_NE(0, receiver_maps.size());
-  *kind_return = MapRef(broker, receiver_maps[0]).elements_kind();
-  for (auto receiver_map : receiver_maps) {
-    MapRef map(broker, receiver_map);
-    if (!map.supports_fast_array_iteration() ||
-        !UnionElementsKindUptoSize(kind_return, map.elements_kind())) {
-      return false;
-    }
-  }
-  return true;
+
+struct FilterFrameStateParams {
+  JSGraph* jsgraph;
+  SharedFunctionInfoRef shared;
+  TNode<Context> context;
+  TNode<Object> target;
+  FrameState outer_frame_state;
+  TNode<Object> receiver;
+  TNode<Object> callback;
+  TNode<Object> this_arg;
+  TNode<JSArray> a;
+  TNode<Object> original_length;
+};
+
+FrameState FilterLoopLazyFrameState(const FilterFrameStateParams& params,
+                                    TNode<Number> k, TNode<Number> to,
+                                    TNode<Object> element) {
+  Node* checkpoint_params[] = {params.receiver,
+                               params.callback,
+                               params.this_arg,
+                               params.a,
+                               k,
+                               params.original_length,
+                               element,
+                               to};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared,
+      Builtins::kArrayFilterLoopLazyDeoptContinuation, params.target,
+      params.context, checkpoint_params, arraysize(checkpoint_params),
+      params.outer_frame_state, ContinuationFrameStateMode::LAZY));
 }
 
-bool CanInlineArrayResizingBuiltin(JSHeapBroker* broker,
-                                   MapHandles const& receiver_maps,
-                                   std::vector<ElementsKind>* kinds,
-                                   bool builtin_is_push = false) {
-  DCHECK_NE(0, receiver_maps.size());
-  for (auto receiver_map : receiver_maps) {
-    MapRef map(broker, receiver_map);
-    if (!map.supports_fast_array_resize()) return false;
-    // TODO(turbofan): We should also handle fast holey double elements once
-    // we got the hole NaN mess sorted out in TurboFan/V8.
-    if (map.elements_kind() == HOLEY_DOUBLE_ELEMENTS && !builtin_is_push) {
-      return false;
-    }
-    ElementsKind current_kind = map.elements_kind();
-    auto kind_ptr = kinds->data();
-    size_t i;
-    for (i = 0; i < kinds->size(); i++, kind_ptr++) {
-      if (UnionElementsKindUptoPackedness(kind_ptr, current_kind)) {
-        break;
-      }
+FrameState FilterLoopEagerPostCallbackFrameState(
+    const FilterFrameStateParams& params, TNode<Number> k, TNode<Number> to,
+    TNode<Object> element, TNode<Object> callback_value) {
+  // Note that we are intentionally reusing the
+  // Builtins::kArrayFilterLoopLazyDeoptContinuation as an *eager* entry point
+  // in this case. This is safe, because re-evaluating a [ToBoolean] coercion is
+  // safe.
+  Node* checkpoint_params[] = {params.receiver,
+                               params.callback,
+                               params.this_arg,
+                               params.a,
+                               k,
+                               params.original_length,
+                               element,
+                               to,
+                               callback_value};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared,
+      Builtins::kArrayFilterLoopLazyDeoptContinuation, params.target,
+      params.context, checkpoint_params, arraysize(checkpoint_params),
+      params.outer_frame_state, ContinuationFrameStateMode::EAGER));
+}
+
+FrameState FilterLoopEagerFrameState(const FilterFrameStateParams& params,
+                                     TNode<Number> k, TNode<Number> to) {
+  Node* checkpoint_params[] = {params.receiver,
+                               params.callback,
+                               params.this_arg,
+                               params.a,
+                               k,
+                               params.original_length,
+                               to};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared,
+      Builtins::kArrayFilterLoopEagerDeoptContinuation, params.target,
+      params.context, checkpoint_params, arraysize(checkpoint_params),
+      params.outer_frame_state, ContinuationFrameStateMode::EAGER));
+}
+
+}  // namespace
+
+TNode<JSArray>
+IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeFilter(
+    MapInference* inference, const bool has_stability_dependency,
+    ElementsKind kind, const SharedFunctionInfoRef& shared,
+    const NativeContextRef& native_context) {
+  FrameState outer_frame_state = FrameStateInput();
+  TNode<Context> context = ContextInput();
+  TNode<Object> target = TargetInput();
+  TNode<JSArray> receiver = ValueInputAs<JSArray>(1);
+  TNode<Object> fncallback = ValueInputOrUndefined(2);
+  TNode<Object> this_arg = ValueInputOrUndefined(3);
+
+  // The output array is packed (filter doesn't visit holes).
+  const ElementsKind packed_kind = GetPackedElementsKind(kind);
+  TNode<JSArray> a = AllocateEmptyJSArray(packed_kind, native_context);
+
+  TNode<Number> original_length = LoadJSArrayLength(receiver, kind);
+
+  FilterFrameStateParams frame_state_params{
+      jsgraph(), shared,     context,  target, outer_frame_state,
+      receiver,  fncallback, this_arg, a,      original_length};
+
+  // This frame state doesn't ever call the deopt continuation, it's only
+  // necessary to specify a continuation in order to handle the exceptional
+  // case. We don't have all the values available to completely fill out
+  // the checkpoint parameters yet, but that's okay because it'll never be
+  // called.
+  TNode<Number> zero = ZeroConstant();
+  ThrowIfNotCallable(fncallback, FilterLoopLazyFrameState(frame_state_params,
+                                                          zero, zero, zero));
+
+  TNode<Number> initial_a_length = zero;
+  For1ZeroUntil(original_length, initial_a_length)
+      .Do([&](TNode<Number> k, TNode<Object>* a_length_object) {
+        TNode<Number> a_length = TNode<Number>::UncheckedCast(*a_length_object);
+        Checkpoint(FilterLoopEagerFrameState(frame_state_params, k, a_length));
+        MaybeInsertMapChecks(inference, has_stability_dependency);
+
+        TNode<Object> element;
+        std::tie(k, element) = SafeLoadElement(kind, receiver, k);
+
+        auto continue_label = MakeLabel(MachineRepresentation::kTaggedSigned);
+        element = MaybeSkipHole(element, kind, &continue_label, a_length);
+
+        TNode<Object> v = JSCall3(
+            fncallback, this_arg, element, k, receiver,
+            FilterLoopLazyFrameState(frame_state_params, k, a_length, element));
+
+        // We need an eager frame state for right after the callback function
+        // returned, just in case an attempt to grow the output array fails.
+        Checkpoint(FilterLoopEagerPostCallbackFrameState(frame_state_params, k,
+                                                         a_length, element, v));
+
+        GotoIfNot(ToBoolean(v), &continue_label, a_length);
+
+        // Since the callback returned a trueish value, store the element in a.
+        {
+          TNode<Number> a_length1 = TypeGuardFixedArrayLength(a_length);
+          TNode<FixedArrayBase> elements = LoadElements(a);
+          elements = MaybeGrowFastElements(kind, FeedbackSource{}, a, elements,
+                                           a_length1,
+                                           LoadFixedArrayBaseLength(elements));
+
+          TNode<Number> new_a_length = NumberInc(a_length1);
+          StoreJSArrayLength(a, new_a_length, kind);
+          StoreFixedArrayBaseElement(elements, a_length1, element, kind);
+
+          Goto(&continue_label, new_a_length);
+        }
+
+        Bind(&continue_label);
+        *a_length_object =
+            TNode<Object>::UncheckedCast(continue_label.PhiAt(0));
+      })
+      .ValueIsUnused();
+
+  return a;
+}
+
+namespace {
+
+struct FindFrameStateParams {
+  JSGraph* jsgraph;
+  SharedFunctionInfoRef shared;
+  TNode<Context> context;
+  TNode<Object> target;
+  FrameState outer_frame_state;
+  TNode<Object> receiver;
+  TNode<Object> callback;
+  TNode<Object> this_arg;
+  TNode<Object> original_length;
+};
+
+FrameState FindLoopLazyFrameState(const FindFrameStateParams& params,
+                                  TNode<Number> k, ArrayFindVariant variant) {
+  Builtins::Name builtin =
+      (variant == ArrayFindVariant::kFind)
+          ? Builtins::kArrayFindLoopLazyDeoptContinuation
+          : Builtins::kArrayFindIndexLoopLazyDeoptContinuation;
+  Node* checkpoint_params[] = {params.receiver, params.callback,
+                               params.this_arg, k, params.original_length};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared, builtin, params.target, params.context,
+      checkpoint_params, arraysize(checkpoint_params), params.outer_frame_state,
+      ContinuationFrameStateMode::LAZY));
+}
+
+FrameState FindLoopEagerFrameState(const FindFrameStateParams& params,
+                                   TNode<Number> k, ArrayFindVariant variant) {
+  Builtins::Name builtin =
+      (variant == ArrayFindVariant::kFind)
+          ? Builtins::kArrayFindLoopEagerDeoptContinuation
+          : Builtins::kArrayFindIndexLoopEagerDeoptContinuation;
+  Node* checkpoint_params[] = {params.receiver, params.callback,
+                               params.this_arg, k, params.original_length};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared, builtin, params.target, params.context,
+      checkpoint_params, arraysize(checkpoint_params), params.outer_frame_state,
+      ContinuationFrameStateMode::EAGER));
+}
+
+FrameState FindLoopAfterCallbackLazyFrameState(
+    const FindFrameStateParams& params, TNode<Number> next_k,
+    TNode<Object> if_found_value, ArrayFindVariant variant) {
+  Builtins::Name builtin =
+      (variant == ArrayFindVariant::kFind)
+          ? Builtins::kArrayFindLoopAfterCallbackLazyDeoptContinuation
+          : Builtins::kArrayFindIndexLoopAfterCallbackLazyDeoptContinuation;
+  Node* checkpoint_params[] = {params.receiver,        params.callback,
+                               params.this_arg,        next_k,
+                               params.original_length, if_found_value};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared, builtin, params.target, params.context,
+      checkpoint_params, arraysize(checkpoint_params), params.outer_frame_state,
+      ContinuationFrameStateMode::LAZY));
+}
+
+}  // namespace
+
+TNode<Object> IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeFind(
+    MapInference* inference, const bool has_stability_dependency,
+    ElementsKind kind, const SharedFunctionInfoRef& shared,
+    const NativeContextRef& native_context, ArrayFindVariant variant) {
+  FrameState outer_frame_state = FrameStateInput();
+  TNode<Context> context = ContextInput();
+  TNode<Object> target = TargetInput();
+  TNode<JSArray> receiver = ValueInputAs<JSArray>(1);
+  TNode<Object> fncallback = ValueInputOrUndefined(2);
+  TNode<Object> this_arg = ValueInputOrUndefined(3);
+
+  TNode<Number> original_length = LoadJSArrayLength(receiver, kind);
+
+  FindFrameStateParams frame_state_params{
+      jsgraph(), shared,     context,  target,         outer_frame_state,
+      receiver,  fncallback, this_arg, original_length};
+
+  ThrowIfNotCallable(
+      fncallback,
+      FindLoopLazyFrameState(frame_state_params, ZeroConstant(), variant));
+
+  const bool is_find_variant = (variant == ArrayFindVariant::kFind);
+  auto out = MakeLabel(MachineRepresentation::kTagged);
+
+  ForZeroUntil(original_length).Do([&](TNode<Number> k) {
+    Checkpoint(FindLoopEagerFrameState(frame_state_params, k, variant));
+    MaybeInsertMapChecks(inference, has_stability_dependency);
+
+    TNode<Object> element;
+    std::tie(k, element) = SafeLoadElement(kind, receiver, k);
+
+    if (IsHoleyElementsKind(kind)) {
+      element = TryConvertHoleToUndefined(element, kind);
+    }
+
+    TNode<Object> if_found_value = is_find_variant ? element : k;
+    TNode<Number> next_k = NumberInc(k);
+
+    // The callback result states whether the desired element was found.
+    TNode<Object> v =
+        JSCall3(fncallback, this_arg, element, k, receiver,
+                FindLoopAfterCallbackLazyFrameState(frame_state_params, next_k,
+                                                    if_found_value, variant));
+
+    GotoIf(ToBoolean(v), &out, if_found_value);
+  });
+
+  // If the loop completed, the element was not found.
+  TNode<Object> if_not_found_value =
+      is_find_variant ? TNode<Object>::UncheckedCast(UndefinedConstant())
+                      : TNode<Object>::UncheckedCast(MinusOneConstant());
+  Goto(&out, if_not_found_value);
+
+  Bind(&out);
+  return out.PhiAt<Object>(0);
+}
+
+namespace {
+
+struct EverySomeFrameStateParams {
+  JSGraph* jsgraph;
+  SharedFunctionInfoRef shared;
+  TNode<Context> context;
+  TNode<Object> target;
+  FrameState outer_frame_state;
+  TNode<Object> receiver;
+  TNode<Object> callback;
+  TNode<Object> this_arg;
+  TNode<Object> original_length;
+};
+
+FrameState EverySomeLoopLazyFrameState(const EverySomeFrameStateParams& params,
+                                       TNode<Number> k,
+                                       ArrayEverySomeVariant variant) {
+  Builtins::Name builtin = (variant == ArrayEverySomeVariant::kEvery)
+                               ? Builtins::kArrayEveryLoopLazyDeoptContinuation
+                               : Builtins::kArraySomeLoopLazyDeoptContinuation;
+  Node* checkpoint_params[] = {params.receiver, params.callback,
+                               params.this_arg, k, params.original_length};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared, builtin, params.target, params.context,
+      checkpoint_params, arraysize(checkpoint_params), params.outer_frame_state,
+      ContinuationFrameStateMode::LAZY));
+}
+
+FrameState EverySomeLoopEagerFrameState(const EverySomeFrameStateParams& params,
+                                        TNode<Number> k,
+                                        ArrayEverySomeVariant variant) {
+  Builtins::Name builtin = (variant == ArrayEverySomeVariant::kEvery)
+                               ? Builtins::kArrayEveryLoopEagerDeoptContinuation
+                               : Builtins::kArraySomeLoopEagerDeoptContinuation;
+  Node* checkpoint_params[] = {params.receiver, params.callback,
+                               params.this_arg, k, params.original_length};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared, builtin, params.target, params.context,
+      checkpoint_params, arraysize(checkpoint_params), params.outer_frame_state,
+      ContinuationFrameStateMode::EAGER));
+}
+
+}  // namespace
+
+TNode<Boolean>
+IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeEverySome(
+    MapInference* inference, const bool has_stability_dependency,
+    ElementsKind kind, const SharedFunctionInfoRef& shared,
+    const NativeContextRef& native_context, ArrayEverySomeVariant variant) {
+  FrameState outer_frame_state = FrameStateInput();
+  TNode<Context> context = ContextInput();
+  TNode<Object> target = TargetInput();
+  TNode<JSArray> receiver = ValueInputAs<JSArray>(1);
+  TNode<Object> fncallback = ValueInputOrUndefined(2);
+  TNode<Object> this_arg = ValueInputOrUndefined(3);
+
+  TNode<Number> original_length = LoadJSArrayLength(receiver, kind);
+
+  EverySomeFrameStateParams frame_state_params{
+      jsgraph(), shared,     context,  target,         outer_frame_state,
+      receiver,  fncallback, this_arg, original_length};
+
+  ThrowIfNotCallable(
+      fncallback,
+      EverySomeLoopLazyFrameState(frame_state_params, ZeroConstant(), variant));
+
+  auto out = MakeLabel(MachineRepresentation::kTagged);
+
+  ForZeroUntil(original_length).Do([&](TNode<Number> k) {
+    Checkpoint(EverySomeLoopEagerFrameState(frame_state_params, k, variant));
+    MaybeInsertMapChecks(inference, has_stability_dependency);
+
+    TNode<Object> element;
+    std::tie(k, element) = SafeLoadElement(kind, receiver, k);
+
+    auto continue_label = MakeLabel();
+    element = MaybeSkipHole(element, kind, &continue_label);
+
+    TNode<Object> v =
+        JSCall3(fncallback, this_arg, element, k, receiver,
+                EverySomeLoopLazyFrameState(frame_state_params, k, variant));
+
+    if (variant == ArrayEverySomeVariant::kEvery) {
+      GotoIfNot(ToBoolean(v), &out, FalseConstant());
+    } else {
+      DCHECK_EQ(variant, ArrayEverySomeVariant::kSome);
+      GotoIf(ToBoolean(v), &out, TrueConstant());
+    }
+    Goto(&continue_label);
+    Bind(&continue_label);
+  });
+
+  Goto(&out, (variant == ArrayEverySomeVariant::kEvery) ? TrueConstant()
+                                                        : FalseConstant());
+
+  Bind(&out);
+  return out.PhiAt<Boolean>(0);
+}
+
+namespace {
+
+Callable GetCallableForArrayIndexOfIncludes(ArrayIndexOfIncludesVariant variant,
+                                            ElementsKind elements_kind,
+                                            Isolate* isolate) {
+  if (variant == ArrayIndexOfIncludesVariant::kIndexOf) {
+    switch (elements_kind) {
+      case PACKED_SMI_ELEMENTS:
+      case HOLEY_SMI_ELEMENTS:
+      case PACKED_ELEMENTS:
+      case HOLEY_ELEMENTS:
+        return Builtins::CallableFor(isolate,
+                                     Builtins::kArrayIndexOfSmiOrObject);
+      case PACKED_DOUBLE_ELEMENTS:
+        return Builtins::CallableFor(isolate,
+                                     Builtins::kArrayIndexOfPackedDoubles);
+      default:
+        DCHECK_EQ(HOLEY_DOUBLE_ELEMENTS, elements_kind);
+        return Builtins::CallableFor(isolate,
+                                     Builtins::kArrayIndexOfHoleyDoubles);
+    }
+  } else {
+    DCHECK_EQ(variant, ArrayIndexOfIncludesVariant::kIncludes);
+    switch (elements_kind) {
+      case PACKED_SMI_ELEMENTS:
+      case HOLEY_SMI_ELEMENTS:
+      case PACKED_ELEMENTS:
+      case HOLEY_ELEMENTS:
+        return Builtins::CallableFor(isolate,
+                                     Builtins::kArrayIncludesSmiOrObject);
+      case PACKED_DOUBLE_ELEMENTS:
+        return Builtins::CallableFor(isolate,
+                                     Builtins::kArrayIncludesPackedDoubles);
+      default:
+        DCHECK_EQ(HOLEY_DOUBLE_ELEMENTS, elements_kind);
+        return Builtins::CallableFor(isolate,
+                                     Builtins::kArrayIncludesHoleyDoubles);
+    }
+  }
+  UNREACHABLE();
+}
+
+}  // namespace
+
+TNode<Object>
+IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeIndexOfIncludes(
+    ElementsKind kind, ArrayIndexOfIncludesVariant variant) {
+  TNode<Context> context = ContextInput();
+  TNode<JSArray> receiver = ValueInputAs<JSArray>(1);
+  TNode<Object> search_element = ValueInputOrUndefined(2);
+  TNode<Object> from_index = ValueInputOrZero(3);
+
+  // TODO(jgruber): This currently only reduces to a stub call. Create a full
+  // reduction (similar to other higher-order array builtins) instead of
+  // lowering to a builtin call. E.g. Array.p.every and Array.p.some have almost
+  // identical functionality.
+
+  TNode<Number> length = LoadJSArrayLength(receiver, kind);
+  TNode<FixedArrayBase> elements = LoadElements(receiver);
+
+  const bool have_from_index = ValueInputCount() > 3;
+  if (have_from_index) {
+    TNode<Smi> from_index_smi = CheckSmi(from_index);
+
+    // If the index is negative, it means the offset from the end and
+    // therefore needs to be added to the length. If the result is still
+    // negative, it needs to be clamped to 0.
+    TNode<Boolean> cond = NumberLessThan(from_index_smi, ZeroConstant());
+    from_index = SelectIf<Number>(cond)
+                     .Then(_ {
+                       return NumberMax(NumberAdd(length, from_index_smi),
+                                        ZeroConstant());
+                     })
+                     .Else(_ { return from_index_smi; })
+                     .ExpectFalse()
+                     .Value();
+  }
+
+  return Call4(GetCallableForArrayIndexOfIncludes(variant, kind, isolate()),
+               context, elements, search_element, length, from_index);
+}
+
+namespace {
+
+struct PromiseCtorFrameStateParams {
+  JSGraph* jsgraph;
+  SharedFunctionInfoRef shared;
+  Node* node_ptr;
+  TNode<Context> context;
+  TNode<Object> target;
+  FrameState outer_frame_state;
+};
+
+// Remnant of old-style JSCallReducer code. Could be ported to graph assembler,
+// but probably not worth the effort.
+Node* CreateArtificialFrameState(Node* node, Node* outer_frame_state,
+                                 int parameter_count, BailoutId bailout_id,
+                                 FrameStateType frame_state_type,
+                                 const SharedFunctionInfoRef& shared,
+                                 Node* context, CommonOperatorBuilder* common,
+                                 Graph* graph) {
+  const FrameStateFunctionInfo* state_info =
+      common->CreateFrameStateFunctionInfo(
+          frame_state_type, parameter_count + 1, 0, shared.object());
+
+  const Operator* op = common->FrameState(
+      bailout_id, OutputFrameStateCombine::Ignore(), state_info);
+  const Operator* op0 = common->StateValues(0, SparseInputMask::Dense());
+  Node* node0 = graph->NewNode(op0);
+
+  static constexpr int kTargetInputIndex = 0;
+  static constexpr int kReceiverInputIndex = 1;
+  const int parameter_count_with_receiver = parameter_count + 1;
+  std::vector<Node*> params;
+  params.reserve(parameter_count_with_receiver);
+  for (int i = 0; i < parameter_count_with_receiver; i++) {
+    params.push_back(node->InputAt(kReceiverInputIndex + i));
+  }
+  const Operator* op_param = common->StateValues(
+      static_cast<int>(params.size()), SparseInputMask::Dense());
+  Node* params_node = graph->NewNode(op_param, static_cast<int>(params.size()),
+                                     &params.front());
+  DCHECK(context);
+  return graph->NewNode(op, params_node, node0, node0, context,
+                        node->InputAt(kTargetInputIndex), outer_frame_state);
+}
+
+FrameState PromiseConstructorFrameState(
+    const PromiseCtorFrameStateParams& params, CommonOperatorBuilder* common,
+    Graph* graph) {
+  DCHECK_EQ(1, params.shared.internal_formal_parameter_count());
+  return FrameState(CreateArtificialFrameState(
+      params.node_ptr, params.outer_frame_state, 1,
+      BailoutId::ConstructStubInvoke(), FrameStateType::kConstructStub,
+      params.shared, params.context, common, graph));
+}
+
+FrameState PromiseConstructorLazyFrameState(
+    const PromiseCtorFrameStateParams& params,
+    FrameState constructor_frame_state) {
+  // The deopt continuation of this frame state is never called; the frame state
+  // is only necessary to obtain the right stack trace.
+  JSGraph* jsgraph = params.jsgraph;
+  Node* checkpoint_params[] = {
+      jsgraph->UndefinedConstant(), /* receiver */
+      jsgraph->UndefinedConstant(), /* promise */
+      jsgraph->UndefinedConstant(), /* reject function */
+      jsgraph->TheHoleConstant()    /* exception */
+  };
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      jsgraph, params.shared,
+      Builtins::kPromiseConstructorLazyDeoptContinuation, params.target,
+      params.context, checkpoint_params, arraysize(checkpoint_params),
+      constructor_frame_state, ContinuationFrameStateMode::LAZY));
+}
+
+FrameState PromiseConstructorLazyWithCatchFrameState(
+    const PromiseCtorFrameStateParams& params,
+    FrameState constructor_frame_state, TNode<JSPromise> promise,
+    TNode<JSFunction> reject) {
+  // This continuation just returns the created promise and takes care of
+  // exceptions thrown by the executor.
+  Node* checkpoint_params[] = {
+      params.jsgraph->UndefinedConstant(), /* receiver */
+      promise, reject};
+  return FrameState(CreateJavaScriptBuiltinContinuationFrameState(
+      params.jsgraph, params.shared,
+      Builtins::kPromiseConstructorLazyDeoptContinuation, params.target,
+      params.context, checkpoint_params, arraysize(checkpoint_params),
+      constructor_frame_state, ContinuationFrameStateMode::LAZY_WITH_CATCH));
+}
+
+}  // namespace
+
+TNode<Object> PromiseBuiltinReducerAssembler::ReducePromiseConstructor(
+    const NativeContextRef& native_context) {
+  DCHECK_GE(ConstructArity(), 1);
+
+  FrameState outer_frame_state = FrameStateInput();
+  TNode<Context> context = ContextInput();
+  TNode<Object> target = TargetInput();
+  TNode<Object> executor = ValueInput(1);
+  DCHECK_EQ(target, NewTargetInput());
+
+  SharedFunctionInfoRef promise_shared =
+      native_context.promise_function().shared();
+
+  PromiseCtorFrameStateParams frame_state_params{jsgraph(),  promise_shared,
+                                                 node_ptr(), context,
+                                                 target,     outer_frame_state};
+
+  // Insert a construct stub frame into the chain of frame states. This will
+  // reconstruct the proper frame when deoptimizing within the constructor.
+  // For the frame state, we only provide the executor parameter, even if more
+  // arguments were passed. This is not observable from JS.
+  FrameState constructor_frame_state =
+      PromiseConstructorFrameState(frame_state_params, common(), graph());
+
+  ThrowIfNotCallable(executor,
+                     PromiseConstructorLazyFrameState(frame_state_params,
+                                                      constructor_frame_state));
+
+  TNode<JSPromise> promise = CreatePromise(context);
+
+  // 8. CreatePromiseResolvingFunctions
+  // Allocate a promise context for the closures below.
+  TNode<Context> promise_context = CreateFunctionContext(
+      native_context, context, PromiseBuiltins::kPromiseContextLength);
+  StoreContextSlot(promise_context, PromiseBuiltins::kPromiseSlot, promise);
+  StoreContextSlot(promise_context, PromiseBuiltins::kAlreadyResolvedSlot,
+                   FalseConstant());
+  StoreContextSlot(promise_context, PromiseBuiltins::kDebugEventSlot,
+                   TrueConstant());
+
+  // Allocate closures for the resolve and reject cases.
+  TNode<JSFunction> resolve = CreateClosureFromBuiltinSharedFunctionInfo(
+      native_context.promise_capability_default_resolve_shared_fun(),
+      promise_context);
+  TNode<JSFunction> reject = CreateClosureFromBuiltinSharedFunctionInfo(
+      native_context.promise_capability_default_reject_shared_fun(),
+      promise_context);
+
+  FrameState lazy_with_catch_frame_state =
+      PromiseConstructorLazyWithCatchFrameState(
+          frame_state_params, constructor_frame_state, promise, reject);
+
+  // 9. Call executor with both resolving functions.
+  // 10a. Call reject if the call to executor threw.
+  Try(_ {
+    CallPromiseExecutor(executor, resolve, reject, lazy_with_catch_frame_state);
+  }).Catch([&](TNode<Object> exception) {
+    CallPromiseReject(reject, exception, lazy_with_catch_frame_state);
+  });
+
+  return promise;
+}
+
+#undef _
+
+bool JSCallReducer::should_disallow_heap_access() const {
+  return broker_->is_concurrent_inlining();
+}
+
+Reduction JSCallReducer::ReplaceWithSubgraph(JSCallReducerAssembler* gasm,
+                                             Node* subgraph) {
+  // TODO(jgruber): Consider a less fiddly way of integrating the new subgraph
+  // into the outer graph. For instance, the subgraph could be created in
+  // complete isolation, and then plugged into the outer graph in one go.
+  // Instead of manually tracking IfException nodes, we could iterate the
+  // subgraph.
+
+  // Replace the Call node with the newly-produced subgraph.
+  ReplaceWithValue(gasm->node_ptr(), subgraph, gasm->effect(), gasm->control());
+
+  // Wire exception edges contained in the newly-produced subgraph into the
+  // outer graph.
+  auto catch_scope = gasm->catch_scope();
+  DCHECK(catch_scope->is_outermost());
+
+  if (catch_scope->has_handler() &&
+      catch_scope->has_exceptional_control_flow()) {
+    TNode<Object> handler_exception;
+    Effect handler_effect{nullptr};
+    Control handler_control{nullptr};
+    gasm->catch_scope()->MergeExceptionalPaths(
+        &handler_exception, &handler_effect, &handler_control);
+
+    ReplaceWithValue(gasm->outermost_handler(), handler_exception,
+                     handler_effect, handler_control);
+  }
+
+  return Replace(subgraph);
+}
+
+Reduction JSCallReducer::ReduceMathUnary(Node* node, const Operator* op) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->NaNConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+
+  JSCallReducerAssembler a(jsgraph(), temp_zone(), node);
+  Node* subgraph = a.ReduceMathUnary(op);
+  return ReplaceWithSubgraph(&a, subgraph);
+}
+
+Reduction JSCallReducer::ReduceMathBinary(Node* node, const Operator* op) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->NaNConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+
+  JSCallReducerAssembler a(jsgraph(), temp_zone(), node);
+  Node* subgraph = a.ReduceMathBinary(op);
+  return ReplaceWithSubgraph(&a, subgraph);
+}
+
+// ES6 section 20.2.2.19 Math.imul ( x, y )
+Reduction JSCallReducer::ReduceMathImul(Node* node) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->ZeroConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+  Node* left = NodeProperties::GetValueInput(node, 2);
+  Node* right = node->op()->ValueInputCount() > 3
+                    ? NodeProperties::GetValueInput(node, 3)
+                    : jsgraph()->ZeroConstant();
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  left = effect =
+      graph()->NewNode(simplified()->SpeculativeToNumber(
+                           NumberOperationHint::kNumberOrOddball, p.feedback()),
+                       left, effect, control);
+  right = effect =
+      graph()->NewNode(simplified()->SpeculativeToNumber(
+                           NumberOperationHint::kNumberOrOddball, p.feedback()),
+                       right, effect, control);
+  left = graph()->NewNode(simplified()->NumberToUint32(), left);
+  right = graph()->NewNode(simplified()->NumberToUint32(), right);
+  Node* value = graph()->NewNode(simplified()->NumberImul(), left, right);
+  ReplaceWithValue(node, value, effect);
+  return Replace(value);
+}
+
+// ES6 section 20.2.2.11 Math.clz32 ( x )
+Reduction JSCallReducer::ReduceMathClz32(Node* node) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->Constant(32);
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+  Node* input = NodeProperties::GetValueInput(node, 2);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  input = effect =
+      graph()->NewNode(simplified()->SpeculativeToNumber(
+                           NumberOperationHint::kNumberOrOddball, p.feedback()),
+                       input, effect, control);
+  input = graph()->NewNode(simplified()->NumberToUint32(), input);
+  Node* value = graph()->NewNode(simplified()->NumberClz32(), input);
+  ReplaceWithValue(node, value, effect);
+  return Replace(value);
+}
+
+// ES6 section 20.2.2.24 Math.max ( value1, value2, ...values )
+// ES6 section 20.2.2.25 Math.min ( value1, value2, ...values )
+Reduction JSCallReducer::ReduceMathMinMax(Node* node, const Operator* op,
+                                          Node* empty_value) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() <= 2) {
+    ReplaceWithValue(node, empty_value);
+    return Replace(empty_value);
+  }
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  Node* value = effect =
+      graph()->NewNode(simplified()->SpeculativeToNumber(
+                           NumberOperationHint::kNumberOrOddball, p.feedback()),
+                       NodeProperties::GetValueInput(node, 2), effect, control);
+  for (int i = 3; i < node->op()->ValueInputCount(); i++) {
+    Node* input = effect = graph()->NewNode(
+        simplified()->SpeculativeToNumber(NumberOperationHint::kNumberOrOddball,
+                                          p.feedback()),
+        NodeProperties::GetValueInput(node, i), effect, control);
+    value = graph()->NewNode(op, value, input);
+  }
+
+  ReplaceWithValue(node, value, effect);
+  return Replace(value);
+}
+
+Reduction JSCallReducer::Reduce(Node* node) {
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
+
+  switch (node->opcode()) {
+    case IrOpcode::kJSConstruct:
+      return ReduceJSConstruct(node);
+    case IrOpcode::kJSConstructWithArrayLike:
+      return ReduceJSConstructWithArrayLike(node);
+    case IrOpcode::kJSConstructWithSpread:
+      return ReduceJSConstructWithSpread(node);
+    case IrOpcode::kJSCall:
+      return ReduceJSCall(node);
+    case IrOpcode::kJSCallWithArrayLike:
+      return ReduceJSCallWithArrayLike(node);
+    case IrOpcode::kJSCallWithSpread:
+      return ReduceJSCallWithSpread(node);
+    default:
+      break;
+  }
+  return NoChange();
+}
+
+void JSCallReducer::Finalize() {
+  // TODO(turbofan): This is not the best solution; ideally we would be able
+  // to teach the GraphReducer about arbitrary dependencies between different
+  // nodes, even if they don't show up in the use list of the other node.
+  std::set<Node*> const waitlist = std::move(waitlist_);
+  for (Node* node : waitlist) {
+    if (!node->IsDead()) {
+      Reduction const reduction = Reduce(node);
+      if (reduction.Changed()) {
+        Node* replacement = reduction.replacement();
+        if (replacement != node) {
+          Replace(node, replacement);
+        }
+      }
+    }
+  }
+}
+
+// ES6 section 22.1.1 The Array Constructor
+Reduction JSCallReducer::ReduceArrayConstructor(Node* node) {
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
+
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* target = NodeProperties::GetValueInput(node, 0);
+  CallParameters const& p = CallParametersOf(node->op());
+
+  // Turn the {node} into a {JSCreateArray} call.
+  DCHECK_LE(2u, p.arity());
+  size_t const arity = p.arity() - 2;
+  NodeProperties::ReplaceValueInput(node, target, 0);
+  NodeProperties::ReplaceValueInput(node, target, 1);
+  NodeProperties::ChangeOp(
+      node, javascript()->CreateArray(arity, MaybeHandle<AllocationSite>()));
+  return Changed(node);
+}
+
+// ES6 section 19.3.1.1 Boolean ( value )
+Reduction JSCallReducer::ReduceBooleanConstructor(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+
+  // Replace the {node} with a proper {ToBoolean} operator.
+  DCHECK_LE(2u, p.arity());
+  Node* value = (p.arity() == 2) ? jsgraph()->UndefinedConstant()
+                                 : NodeProperties::GetValueInput(node, 2);
+  value = graph()->NewNode(simplified()->ToBoolean(), value);
+  ReplaceWithValue(node, value);
+  return Replace(value);
+}
+
+// ES section #sec-object-constructor
+Reduction JSCallReducer::ReduceObjectConstructor(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.arity() < 3) return NoChange();
+  Node* value = (p.arity() >= 3) ? NodeProperties::GetValueInput(node, 2)
+                                 : jsgraph()->UndefinedConstant();
+  Node* effect = NodeProperties::GetEffectInput(node);
+
+  // We can fold away the Object(x) call if |x| is definitely not a primitive.
+  if (NodeProperties::CanBePrimitive(broker(), value, effect)) {
+    if (!NodeProperties::CanBeNullOrUndefined(broker(), value, effect)) {
+      // Turn the {node} into a {JSToObject} call if we know that
+      // the {value} cannot be null or undefined.
+      NodeProperties::ReplaceValueInputs(node, value);
+      NodeProperties::ChangeOp(node, javascript()->ToObject());
+      return Changed(node);
     }
-    if (i == kinds->size()) kinds->push_back(current_kind);
+  } else {
+    ReplaceWithValue(node, value);
+    return Replace(value);
   }
-  return true;
+  return NoChange();
 }
-}  // namespace
 
-Reduction JSCallReducer::ReduceArrayForEach(
-    Node* node, const SharedFunctionInfoRef& shared) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+// ES6 section 19.2.3.1 Function.prototype.apply ( thisArg, argArray )
+Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
+  DisallowHeapAccessIf no_heap_acess(should_disallow_heap_access());
 
-  if (!FLAG_turbo_inline_array_builtins) return NoChange();
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
-
-  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* fncallback = node->op()->ValueInputCount() > 2
-                         ? NodeProperties::GetValueInput(node, 2)
-                         : jsgraph()->UndefinedConstant();
-  Node* this_arg = node->op()->ValueInputCount() > 3
-                       ? NodeProperties::GetValueInput(node, 3)
-                       : jsgraph()->UndefinedConstant();
-
-  // Try to determine the {receiver} map.
-  MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return NoChange();
-  MapHandles const& receiver_maps = inference.GetMaps();
-
-  ElementsKind kind;
-  if (!CanInlineArrayIteratingBuiltin(broker(), receiver_maps, &kind)) {
-    return inference.NoChange();
-  }
-  if (!dependencies()->DependOnNoElementsProtector()) UNREACHABLE();
-  bool const stability_dependency = inference.RelyOnMapsPreferStability(
-      dependencies(), jsgraph(), &effect, control, p.feedback());
-
-  Node* k = jsgraph()->ZeroConstant();
-  Node* original_length = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSArrayLength(kind)), receiver,
-      effect, control);
-
-  Node* checkpoint_params[] = {receiver, fncallback, this_arg, k,
-                               original_length};
-  const int stack_parameters = arraysize(checkpoint_params);
-
-  // Check whether the given callback function is callable. Note that this has
-  // to happen outside the loop to make sure we also throw on empty arrays.
-  Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), shared, Builtins::kArrayForEachLoopLazyDeoptContinuation,
-      node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-      outer_frame_state, ContinuationFrameStateMode::LAZY);
-  Node* check_fail = nullptr;
-  Node* check_throw = nullptr;
-  WireInCallbackIsCallableCheck(fncallback, context, check_frame_state, effect,
-                                &control, &check_fail, &check_throw);
-
-  // Start the loop.
-  Node* vloop = k = WireInLoopStart(k, &control, &effect);
-  Node *loop = control, *eloop = effect;
-  checkpoint_params[3] = k;
-
-  Node* continue_test =
-      graph()->NewNode(simplified()->NumberLessThan(), k, original_length);
-  Node* continue_branch = graph()->NewNode(common()->Branch(BranchHint::kNone),
-                                           continue_test, control);
-
-  Node* if_true = graph()->NewNode(common()->IfTrue(), continue_branch);
-  Node* if_false = graph()->NewNode(common()->IfFalse(), continue_branch);
-  control = if_true;
-
-  {
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, Builtins::kArrayForEachLoopEagerDeoptContinuation,
-        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-        outer_frame_state, ContinuationFrameStateMode::EAGER);
-    effect =
-        graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
-  }
-
-  // Deopt if the map has changed during the iteration.
-  if (!stability_dependency) {
-    inference.InsertMapChecks(jsgraph(), &effect, control, p.feedback());
-  }
-
-  Node* element =
-      SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
-  Node* next_k =
-      graph()->NewNode(simplified()->NumberAdd(), k, jsgraph()->OneConstant());
-
-  checkpoint_params[3] = next_k;
+  size_t arity = p.arity();
+  DCHECK_LE(2u, arity);
+  ConvertReceiverMode convert_mode = ConvertReceiverMode::kAny;
+  if (arity == 2) {
+    // Neither thisArg nor argArray was provided.
+    convert_mode = ConvertReceiverMode::kNullOrUndefined;
+    node->ReplaceInput(0, node->InputAt(1));
+    node->ReplaceInput(1, jsgraph()->UndefinedConstant());
+  } else if (arity == 3) {
+    // The argArray was not provided, just remove the {target}.
+    node->RemoveInput(0);
+    --arity;
+  } else {
+    Node* target = NodeProperties::GetValueInput(node, 1);
+    Node* this_argument = NodeProperties::GetValueInput(node, 2);
+    Node* arguments_list = NodeProperties::GetValueInput(node, 3);
+    Node* context = NodeProperties::GetContextInput(node);
+    Node* frame_state = NodeProperties::GetFrameStateInput(node);
+    Node* effect = NodeProperties::GetEffectInput(node);
+    Node* control = NodeProperties::GetControlInput(node);
 
-  Node* hole_true = nullptr;
-  Node* hole_false = nullptr;
-  Node* effect_true = effect;
+    // If {arguments_list} cannot be null or undefined, we don't need
+    // to expand this {node} to control-flow.
+    if (!NodeProperties::CanBeNullOrUndefined(broker(), arguments_list,
+                                              effect)) {
+      // Massage the value inputs appropriately.
+      node->ReplaceInput(0, target);
+      node->ReplaceInput(1, this_argument);
+      node->ReplaceInput(2, arguments_list);
+      while (arity-- > 3) node->RemoveInput(3);
 
-  if (IsHoleyElementsKind(kind)) {
-    // Holey elements kind require a hole check and skipping of the element in
-    // the case of a hole.
-    Node* check;
-    if (IsDoubleElementsKind(kind)) {
-      check = graph()->NewNode(simplified()->NumberIsFloat64Hole(), element);
+      // Morph the {node} to a {JSCallWithArrayLike}.
+      NodeProperties::ChangeOp(
+          node, javascript()->CallWithArrayLike(
+                    p.frequency(), p.feedback(), p.speculation_mode(),
+                    CallFeedbackRelation::kUnrelated));
+      Reduction const reduction = ReduceJSCallWithArrayLike(node);
+      return reduction.Changed() ? reduction : Changed(node);
     } else {
-      check = graph()->NewNode(simplified()->ReferenceEqual(), element,
-                               jsgraph()->TheHoleConstant());
-    }
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-    hole_true = graph()->NewNode(common()->IfTrue(), branch);
-    hole_false = graph()->NewNode(common()->IfFalse(), branch);
-    control = hole_false;
+      // Check whether {arguments_list} is null.
+      Node* check_null =
+          graph()->NewNode(simplified()->ReferenceEqual(), arguments_list,
+                           jsgraph()->NullConstant());
+      control = graph()->NewNode(common()->Branch(BranchHint::kFalse),
+                                 check_null, control);
+      Node* if_null = graph()->NewNode(common()->IfTrue(), control);
+      control = graph()->NewNode(common()->IfFalse(), control);
 
-    // The contract is that we don't leak "the hole" into "user JavaScript",
-    // so we must rename the {element} here to explicitly exclude "the hole"
-    // from the type of {element}.
-    element = effect = graph()->NewNode(
-        common()->TypeGuard(Type::NonInternal()), element, effect, control);
-  }
+      // Check whether {arguments_list} is undefined.
+      Node* check_undefined =
+          graph()->NewNode(simplified()->ReferenceEqual(), arguments_list,
+                           jsgraph()->UndefinedConstant());
+      control = graph()->NewNode(common()->Branch(BranchHint::kFalse),
+                                 check_undefined, control);
+      Node* if_undefined = graph()->NewNode(common()->IfTrue(), control);
+      control = graph()->NewNode(common()->IfFalse(), control);
 
-  Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), shared, Builtins::kArrayForEachLoopLazyDeoptContinuation,
-      node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-      outer_frame_state, ContinuationFrameStateMode::LAZY);
+      // Lower to {JSCallWithArrayLike} if {arguments_list} is neither null
+      // nor undefined.
+      Node* effect0 = effect;
+      Node* control0 = control;
+      Node* value0 = effect0 = control0 = graph()->NewNode(
+          javascript()->CallWithArrayLike(p.frequency(), p.feedback(),
+                                          p.speculation_mode(),
+                                          CallFeedbackRelation::kUnrelated),
+          target, this_argument, arguments_list, context, frame_state, effect0,
+          control0);
 
-  control = effect = graph()->NewNode(
-      javascript()->Call(5, p.frequency()), fncallback, this_arg, element, k,
-      receiver, context, frame_state, effect, control);
+      // Lower to {JSCall} if {arguments_list} is either null or undefined.
+      Node* effect1 = effect;
+      Node* control1 =
+          graph()->NewNode(common()->Merge(2), if_null, if_undefined);
+      Node* value1 = effect1 = control1 =
+          graph()->NewNode(javascript()->Call(2), target, this_argument,
+                           context, frame_state, effect1, control1);
 
-  // Rewire potential exception edges.
-  Node* on_exception = nullptr;
-  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
-    RewirePostCallbackExceptionEdges(check_throw, on_exception, effect,
-                                     &check_fail, &control);
-  }
+      // Rewire potential exception edges.
+      Node* if_exception = nullptr;
+      if (NodeProperties::IsExceptionalCall(node, &if_exception)) {
+        // Create appropriate {IfException} and {IfSuccess} nodes.
+        Node* if_exception0 =
+            graph()->NewNode(common()->IfException(), control0, effect0);
+        control0 = graph()->NewNode(common()->IfSuccess(), control0);
+        Node* if_exception1 =
+            graph()->NewNode(common()->IfException(), control1, effect1);
+        control1 = graph()->NewNode(common()->IfSuccess(), control1);
 
-  if (IsHoleyElementsKind(kind)) {
-    Node* after_call_control = control;
-    Node* after_call_effect = effect;
-    control = hole_true;
-    effect = effect_true;
+        // Join the exception edges.
+        Node* merge =
+            graph()->NewNode(common()->Merge(2), if_exception0, if_exception1);
+        Node* ephi = graph()->NewNode(common()->EffectPhi(2), if_exception0,
+                                      if_exception1, merge);
+        Node* phi =
+            graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                             if_exception0, if_exception1, merge);
+        ReplaceWithValue(if_exception, phi, ephi, merge);
+      }
 
-    control = graph()->NewNode(common()->Merge(2), control, after_call_control);
-    effect = graph()->NewNode(common()->EffectPhi(2), effect, after_call_effect,
-                              control);
+      // Join control paths.
+      control = graph()->NewNode(common()->Merge(2), control0, control1);
+      effect =
+          graph()->NewNode(common()->EffectPhi(2), effect0, effect1, control);
+      Node* value =
+          graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                           value0, value1, control);
+      ReplaceWithValue(node, value, effect, control);
+      return Replace(value);
+    }
   }
-
-  WireInLoopEnd(loop, eloop, vloop, next_k, control, effect);
-
-  control = if_false;
-  effect = eloop;
-
-  // Introduce proper LoopExit and LoopExitEffect nodes to mark
-  // {loop} as a candidate for loop peeling (crbug.com/v8/8273).
-  control = graph()->NewNode(common()->LoopExit(), control, loop);
-  effect = graph()->NewNode(common()->LoopExitEffect(), effect, control);
-
-  // Wire up the branch for the case when IsCallable fails for the callback.
-  // Since {check_throw} is an unconditional throw, it's impossible to
-  // return a successful completion. Therefore, we simply connect the successful
-  // completion to the graph end.
-  Node* throw_node =
-      graph()->NewNode(common()->Throw(), check_throw, check_fail);
-  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
-
-  ReplaceWithValue(node, jsgraph()->UndefinedConstant(), effect, control);
-  return Replace(jsgraph()->UndefinedConstant());
+  // Change {node} to the new {JSCall} operator.
+  NodeProperties::ChangeOp(
+      node, javascript()->Call(arity, p.frequency(), p.feedback(), convert_mode,
+                               p.speculation_mode(),
+                               CallFeedbackRelation::kUnrelated));
+  // Try to further reduce the JSCall {node}.
+  Reduction const reduction = ReduceJSCall(node);
+  return reduction.Changed() ? reduction : Changed(node);
 }
 
-Reduction JSCallReducer::ReduceArrayReduce(
-    Node* node, ArrayReduceDirection direction,
-    const SharedFunctionInfoRef& shared) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+// ES section #sec-function.prototype.bind
+Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
+  DisallowHeapAccessIf no_heap_acess(should_disallow_heap_access());
 
-  if (!FLAG_turbo_inline_array_builtins) return NoChange();
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
   if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
     return NoChange();
   }
-  bool left = direction == ArrayReduceDirection::kLeft;
 
-  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
+  // Value inputs to the {node} are as follows:
+  //
+  //  - target, which is Function.prototype.bind JSFunction
+  //  - receiver, which is the [[BoundTargetFunction]]
+  //  - bound_this (optional), which is the [[BoundThis]]
+  //  - and all the remaining value inputs are [[BoundArguments]]
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* bound_this = (node->op()->ValueInputCount() < 3)
+                         ? jsgraph()->UndefinedConstant()
+                         : NodeProperties::GetValueInput(node, 2);
+  Node* context = NodeProperties::GetContextInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* fncallback = node->op()->ValueInputCount() > 2
-                         ? NodeProperties::GetValueInput(node, 2)
-                         : jsgraph()->UndefinedConstant();
 
-  // Try to determine the {receiver} map.
+  // Ensure that the {receiver} is known to be a JSBoundFunction or
+  // a JSFunction with the same [[Prototype]], and all maps we've
+  // seen for the {receiver} so far indicate that {receiver} is
+  // definitely a constructor or not a constructor.
   MapInference inference(broker(), receiver, effect);
   if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
-  ElementsKind kind;
-  if (!CanInlineArrayIteratingBuiltin(broker(), receiver_maps, &kind)) {
+  MapRef first_receiver_map(broker(), receiver_maps[0]);
+  bool const is_constructor = first_receiver_map.is_constructor();
+
+  if (should_disallow_heap_access() &&
+      !first_receiver_map.serialized_prototype()) {
+    TRACE_BROKER_MISSING(broker(),
+                         "serialized prototype on map " << first_receiver_map);
     return inference.NoChange();
   }
-  if (!dependencies()->DependOnNoElementsProtector()) UNREACHABLE();
-  bool const stability_dependency = inference.RelyOnMapsPreferStability(
-      dependencies(), jsgraph(), &effect, control, p.feedback());
-
-  Node* original_length = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSArrayLength(PACKED_ELEMENTS)),
-      receiver, effect, control);
-
-  Node* initial_index =
-      left ? jsgraph()->ZeroConstant()
-           : graph()->NewNode(simplified()->NumberSubtract(), original_length,
-                              jsgraph()->OneConstant());
-  const Operator* next_op =
-      left ? simplified()->NumberAdd() : simplified()->NumberSubtract();
-  Node* k = initial_index;
+  ObjectRef const prototype = first_receiver_map.prototype();
+  for (Handle<Map> const map : receiver_maps) {
+    MapRef receiver_map(broker(), map);
 
-  Node* check_frame_state;
-  {
-    Builtins::Name builtin_lazy =
-        left ? Builtins::kArrayReduceLoopLazyDeoptContinuation
-             : Builtins::kArrayReduceRightLoopLazyDeoptContinuation;
-    Node* checkpoint_params[] = {receiver, fncallback, k, original_length,
-                                 jsgraph()->UndefinedConstant()};
-    const int stack_parameters = arraysize(checkpoint_params);
-    check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, builtin_lazy, node->InputAt(0), context,
-        &checkpoint_params[0], stack_parameters - 1, outer_frame_state,
-        ContinuationFrameStateMode::LAZY);
-  }
-  Node* check_fail = nullptr;
-  Node* check_throw = nullptr;
-  // Check whether the given callback function is callable. Note that
-  // this has to happen outside the loop to make sure we also throw on
-  // empty arrays.
-  WireInCallbackIsCallableCheck(fncallback, context, check_frame_state, effect,
-                                &control, &check_fail, &check_throw);
-
-  std::function<Node*(Node*)> hole_check = [this, kind](Node* element) {
-    if (IsDoubleElementsKind(kind)) {
-      return graph()->NewNode(simplified()->NumberIsFloat64Hole(), element);
-    } else {
-      return graph()->NewNode(simplified()->ReferenceEqual(), element,
-                              jsgraph()->TheHoleConstant());
+    if (should_disallow_heap_access() && !receiver_map.serialized_prototype()) {
+      TRACE_BROKER_MISSING(broker(),
+                           "serialized prototype on map " << receiver_map);
+      return inference.NoChange();
     }
-  };
-
-  // Set initial accumulator value
-  Node* cur = jsgraph()->TheHoleConstant();
-
-  if (node->op()->ValueInputCount() > 3) {
-    cur = NodeProperties::GetValueInput(node, 3);
-  } else {
-    // Find first/last non holey element. In case the search fails, we need a
-    // deopt continuation.
-    Builtins::Name builtin_eager =
-        left ? Builtins::kArrayReducePreLoopEagerDeoptContinuation
-             : Builtins::kArrayReduceRightPreLoopEagerDeoptContinuation;
-    Node* checkpoint_params[] = {receiver, fncallback, original_length};
-    const int stack_parameters = arraysize(checkpoint_params);
-    Node* find_first_element_frame_state =
-        CreateJavaScriptBuiltinContinuationFrameState(
-            jsgraph(), shared, builtin_eager, node->InputAt(0), context,
-            &checkpoint_params[0], stack_parameters, outer_frame_state,
-            ContinuationFrameStateMode::EAGER);
-
-    Node* vloop = k = WireInLoopStart(k, &control, &effect);
-    Node* loop = control;
-    Node* eloop = effect;
-    effect = graph()->NewNode(common()->Checkpoint(),
-                              find_first_element_frame_state, effect, control);
-    Node* continue_test =
-        left ? graph()->NewNode(simplified()->NumberLessThan(), k,
-                                original_length)
-             : graph()->NewNode(simplified()->NumberLessThanOrEqual(),
-                                jsgraph()->ZeroConstant(), k);
-    effect = graph()->NewNode(
-        simplified()->CheckIf(DeoptimizeReason::kNoInitialElement),
-        continue_test, effect, control);
-
-    cur = SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
-    Node* next_k = graph()->NewNode(next_op, k, jsgraph()->OneConstant());
-
-    Node* hole_branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                         hole_check(cur), control);
-    Node* found_el = graph()->NewNode(common()->IfFalse(), hole_branch);
-    control = found_el;
-    Node* is_hole = graph()->NewNode(common()->IfTrue(), hole_branch);
-
-    WireInLoopEnd(loop, eloop, vloop, next_k, is_hole, effect);
-    // We did the hole-check, so exclude hole from the type.
-    cur = effect = graph()->NewNode(common()->TypeGuard(Type::NonInternal()),
-                                    cur, effect, control);
-    k = next_k;
-  }
-
-  // Start the loop.
-  Node* loop = control = graph()->NewNode(common()->Loop(2), control, control);
-  Node* eloop = effect =
-      graph()->NewNode(common()->EffectPhi(2), effect, effect, loop);
-  Node* terminate = graph()->NewNode(common()->Terminate(), eloop, loop);
-  NodeProperties::MergeControlToEnd(graph(), common(), terminate);
-  Node* kloop = k = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTagged, 2), k, k, loop);
-  Node* curloop = cur = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTagged, 2), cur, cur, loop);
-
-  control = loop;
-  effect = eloop;
-
-  Node* continue_test =
-      left
-          ? graph()->NewNode(simplified()->NumberLessThan(), k, original_length)
-          : graph()->NewNode(simplified()->NumberLessThanOrEqual(),
-                             jsgraph()->ZeroConstant(), k);
-
-  Node* continue_branch = graph()->NewNode(common()->Branch(BranchHint::kNone),
-                                           continue_test, control);
-
-  Node* if_true = graph()->NewNode(common()->IfTrue(), continue_branch);
-  Node* if_false = graph()->NewNode(common()->IfFalse(), continue_branch);
-  control = if_true;
-
-  {
-    Builtins::Name builtin_eager =
-        left ? Builtins::kArrayReduceLoopEagerDeoptContinuation
-             : Builtins::kArrayReduceRightLoopEagerDeoptContinuation;
-    Node* checkpoint_params[] = {receiver, fncallback, k, original_length,
-                                 curloop};
-    const int stack_parameters = arraysize(checkpoint_params);
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, builtin_eager, node->InputAt(0), context,
-        &checkpoint_params[0], stack_parameters, outer_frame_state,
-        ContinuationFrameStateMode::EAGER);
-    effect =
-        graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
-    inference.InsertMapChecks(jsgraph(), &effect, control, p.feedback());
-  }
-
-  // Deopt if the map has changed during the iteration.
-  if (!stability_dependency) {
-    inference.InsertMapChecks(jsgraph(), &effect, control, p.feedback());
-  }
-
-  Node* element =
-      SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
-  Node* next_k = graph()->NewNode(next_op, k, jsgraph()->OneConstant());
-
-  Node* hole_true = nullptr;
-  Node* hole_false = nullptr;
-  Node* effect_true = effect;
-
-  if (IsHoleyElementsKind(kind)) {
-    // Holey elements kind require a hole check and skipping of the element in
-    // the case of a hole.
-    Node* branch = graph()->NewNode(common()->Branch(BranchHint::kFalse),
-                                    hole_check(element), control);
-    hole_true = graph()->NewNode(common()->IfTrue(), branch);
-    hole_false = graph()->NewNode(common()->IfFalse(), branch);
-    control = hole_false;
-
-    // The contract is that we don't leak "the hole" into "user JavaScript",
-    // so we must rename the {element} here to explicitly exclude "the hole"
-    // from the type of {element}.
-    element = effect = graph()->NewNode(
-        common()->TypeGuard(Type::NonInternal()), element, effect, control);
-  }
 
-  Node* next_cur;
-  {
-    Builtins::Name builtin_lazy =
-        left ? Builtins::kArrayReduceLoopLazyDeoptContinuation
-             : Builtins::kArrayReduceRightLoopLazyDeoptContinuation;
-    Node* checkpoint_params[] = {receiver, fncallback, next_k, original_length,
-                                 curloop};
-    const int stack_parameters = arraysize(checkpoint_params);
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, builtin_lazy, node->InputAt(0), context,
-        &checkpoint_params[0], stack_parameters - 1, outer_frame_state,
-        ContinuationFrameStateMode::LAZY);
-
-    next_cur = control = effect =
-        graph()->NewNode(javascript()->Call(6, p.frequency()), fncallback,
-                         jsgraph()->UndefinedConstant(), cur, element, k,
-                         receiver, context, frame_state, effect, control);
-  }
+    // Check for consistency among the {receiver_maps}.
+    STATIC_ASSERT(LAST_TYPE == LAST_FUNCTION_TYPE);
+    if (!receiver_map.prototype().equals(prototype) ||
+        receiver_map.is_constructor() != is_constructor ||
+        receiver_map.instance_type() < FIRST_FUNCTION_TYPE) {
+      return inference.NoChange();
+    }
 
-  // Rewire potential exception edges.
-  Node* on_exception = nullptr;
-  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
-    RewirePostCallbackExceptionEdges(check_throw, on_exception, effect,
-                                     &check_fail, &control);
-  }
+    // Disallow binding of slow-mode functions. We need to figure out
+    // whether the length and name property are in the original state.
+    if (receiver_map.is_dictionary_map()) return inference.NoChange();
 
-  if (IsHoleyElementsKind(kind)) {
-    Node* after_call_control = control;
-    Node* after_call_effect = effect;
-    control = hole_true;
-    effect = effect_true;
+    // Check whether the length and name properties are still present
+    // as AccessorInfo objects. In that case, their values can be
+    // recomputed even if the actual value of the object changes.
+    // This mirrors the checks done in builtins-function-gen.cc at
+    // runtime otherwise.
+    int minimum_nof_descriptors = i::Max(JSFunction::kLengthDescriptorIndex,
+                                           JSFunction::kNameDescriptorIndex) +
+                                  1;
+    if (receiver_map.NumberOfOwnDescriptors() < minimum_nof_descriptors) {
+      return inference.NoChange();
+    }
+    const InternalIndex kLengthIndex(JSFunction::kLengthDescriptorIndex);
+    const InternalIndex kNameIndex(JSFunction::kNameDescriptorIndex);
+    if (!receiver_map.serialized_own_descriptor(kLengthIndex) ||
+        !receiver_map.serialized_own_descriptor(kNameIndex)) {
+      TRACE_BROKER_MISSING(broker(),
+                           "serialized descriptors on map " << receiver_map);
+      return inference.NoChange();
+    }
+    ReadOnlyRoots roots(isolate());
+    StringRef length_string(broker(), roots.length_string_handle());
+    StringRef name_string(broker(), roots.name_string_handle());
 
-    control = graph()->NewNode(common()->Merge(2), control, after_call_control);
-    effect = graph()->NewNode(common()->EffectPhi(2), effect, after_call_effect,
-                              control);
-    next_cur =
-        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2), cur,
-                         next_cur, control);
+    base::Optional<ObjectRef> length_value(
+        receiver_map.GetStrongValue(kLengthIndex));
+    base::Optional<ObjectRef> name_value(
+        receiver_map.GetStrongValue(kNameIndex));
+    if (!length_value || !name_value) {
+      TRACE_BROKER_MISSING(
+          broker(), "name or length descriptors on map " << receiver_map);
+      return inference.NoChange();
+    }
+    if (!receiver_map.GetPropertyKey(kLengthIndex).equals(length_string) ||
+        !length_value->IsAccessorInfo() ||
+        !receiver_map.GetPropertyKey(kNameIndex).equals(name_string) ||
+        !name_value->IsAccessorInfo()) {
+      return inference.NoChange();
+    }
   }
 
-  k = next_k;
-  cur = next_cur;
-
-  loop->ReplaceInput(1, control);
-  kloop->ReplaceInput(1, k);
-  curloop->ReplaceInput(1, cur);
-  eloop->ReplaceInput(1, effect);
-
-  control = if_false;
-  effect = eloop;
+  // Choose the map for the resulting JSBoundFunction (but bail out in case of a
+  // custom prototype).
+  MapRef map = is_constructor
+                   ? native_context().bound_function_with_constructor_map()
+                   : native_context().bound_function_without_constructor_map();
+  if (!map.prototype().equals(prototype)) return inference.NoChange();
 
-  // Wire up the branch for the case when IsCallable fails for the callback.
-  // Since {check_throw} is an unconditional throw, it's impossible to
-  // return a successful completion. Therefore, we simply connect the
-  // successful completion to the graph end.
-  Node* throw_node =
-      graph()->NewNode(common()->Throw(), check_throw, check_fail);
-  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
+  inference.RelyOnMapsPreferStability(dependencies(), jsgraph(), &effect,
+                                      control, p.feedback());
 
-  ReplaceWithValue(node, curloop, effect, control);
-  return Replace(curloop);
+  // Replace the {node} with a JSCreateBoundFunction.
+  int const arity = std::max(0, node->op()->ValueInputCount() - 3);
+  int const input_count = 2 + arity + 3;
+  Node** inputs = graph()->zone()->NewArray<Node*>(input_count);
+  inputs[0] = receiver;
+  inputs[1] = bound_this;
+  for (int i = 0; i < arity; ++i) {
+    inputs[2 + i] = NodeProperties::GetValueInput(node, 3 + i);
+  }
+  inputs[2 + arity + 0] = context;
+  inputs[2 + arity + 1] = effect;
+  inputs[2 + arity + 2] = control;
+  Node* value = effect =
+      graph()->NewNode(javascript()->CreateBoundFunction(arity, map.object()),
+                       input_count, inputs);
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
 }
 
-Reduction JSCallReducer::ReduceArrayMap(Node* node,
-                                        const SharedFunctionInfoRef& shared) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+// ES6 section 19.2.3.3 Function.prototype.call (thisArg, ...args)
+Reduction JSCallReducer::ReduceFunctionPrototypeCall(Node* node) {
+  DisallowHeapAccessIf no_heap_acess(should_disallow_heap_access());
 
-  if (!FLAG_turbo_inline_array_builtins) return NoChange();
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
-
-  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* target = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* fncallback = node->op()->ValueInputCount() > 2
-                         ? NodeProperties::GetValueInput(node, 2)
-                         : jsgraph()->UndefinedConstant();
-  Node* this_arg = node->op()->ValueInputCount() > 3
-                       ? NodeProperties::GetValueInput(node, 3)
-                       : jsgraph()->UndefinedConstant();
-
-  // Try to determine the {receiver} map.
-  MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return NoChange();
-  MapHandles const& receiver_maps = inference.GetMaps();
 
-  ElementsKind kind;
-  if (!CanInlineArrayIteratingBuiltin(broker(), receiver_maps, &kind)) {
-    return inference.NoChange();
-  }
-  if (!dependencies()->DependOnArraySpeciesProtector())
-    return inference.NoChange();
-  if (IsHoleyElementsKind(kind)) {
-    if (!dependencies()->DependOnNoElementsProtector()) UNREACHABLE();
+  // Change context of {node} to the Function.prototype.call context,
+  // to ensure any exception is thrown in the correct context.
+  Node* context;
+  HeapObjectMatcher m(target);
+  if (m.HasValue()) {
+    JSFunctionRef function = m.Ref(broker()).AsJSFunction();
+    if (should_disallow_heap_access() && !function.serialized()) {
+      TRACE_BROKER_MISSING(broker(), "Serialize call on function " << function);
+      return NoChange();
+    }
+    context = jsgraph()->Constant(function.context());
+  } else {
+    context = effect = graph()->NewNode(
+        simplified()->LoadField(AccessBuilder::ForJSFunctionContext()), target,
+        effect, control);
   }
-  bool const stability_dependency = inference.RelyOnMapsPreferStability(
-      dependencies(), jsgraph(), &effect, control, p.feedback());
+  NodeProperties::ReplaceContextInput(node, context);
+  NodeProperties::ReplaceEffectInput(node, effect);
 
-  Node* array_constructor = jsgraph()->Constant(
-      native_context().GetInitialJSArrayMap(kind).GetConstructor());
-  Node* k = jsgraph()->ZeroConstant();
-  Node* original_length = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSArrayLength(kind)), receiver,
-      effect, control);
+  // Remove the target from {node} and use the receiver as target instead, and
+  // the thisArg becomes the new target.  If thisArg was not provided, insert
+  // undefined instead.
+  size_t arity = p.arity();
+  DCHECK_LE(2u, arity);
+  ConvertReceiverMode convert_mode;
+  if (arity == 2) {
+    // The thisArg was not provided, use undefined as receiver.
+    convert_mode = ConvertReceiverMode::kNullOrUndefined;
+    node->ReplaceInput(0, node->InputAt(1));
+    node->ReplaceInput(1, jsgraph()->UndefinedConstant());
+  } else {
+    // Just remove the target, which is the first value input.
+    convert_mode = ConvertReceiverMode::kAny;
+    node->RemoveInput(0);
+    --arity;
+  }
+  NodeProperties::ChangeOp(
+      node, javascript()->Call(arity, p.frequency(), p.feedback(), convert_mode,
+                               p.speculation_mode(),
+                               CallFeedbackRelation::kUnrelated));
+  // Try to further reduce the JSCall {node}.
+  Reduction const reduction = ReduceJSCall(node);
+  return reduction.Changed() ? reduction : Changed(node);
+}
 
-  // If the array length >= kMaxFastArrayLength, then CreateArray
-  // will create a dictionary. We should deopt in this case, and make sure
-  // not to attempt inlining again.
-  original_length = effect = graph()->NewNode(
-      simplified()->CheckBounds(p.feedback()), original_length,
-      jsgraph()->Constant(JSArray::kMaxFastArrayLength), effect, control);
+// ES6 section 19.2.3.6 Function.prototype [ @@hasInstance ] (V)
+Reduction JSCallReducer::ReduceFunctionPrototypeHasInstance(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* object = (node->op()->ValueInputCount() >= 3)
+                     ? NodeProperties::GetValueInput(node, 2)
+                     : jsgraph()->UndefinedConstant();
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
 
-  // Even though {JSCreateArray} is not marked as {kNoThrow}, we can elide the
-  // exceptional projections because it cannot throw with the given
-  // parameters.
-  Node* a = control = effect = graph()->NewNode(
-      javascript()->CreateArray(1, MaybeHandle<AllocationSite>()),
-      array_constructor, array_constructor, original_length, context,
-      outer_frame_state, effect, control);
-
-  Node* checkpoint_params[] = {receiver, fncallback, this_arg,
-                               a,        k,          original_length};
-  const int stack_parameters = arraysize(checkpoint_params);
-
-  // Check whether the given callback function is callable. Note that this has
-  // to happen outside the loop to make sure we also throw on empty arrays.
-  Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), shared, Builtins::kArrayMapLoopLazyDeoptContinuation,
-      node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-      outer_frame_state, ContinuationFrameStateMode::LAZY);
-  Node* check_fail = nullptr;
-  Node* check_throw = nullptr;
-  WireInCallbackIsCallableCheck(fncallback, context, check_frame_state, effect,
-                                &control, &check_fail, &check_throw);
-
-  // Start the loop.
-  Node* vloop = k = WireInLoopStart(k, &control, &effect);
-  Node *loop = control, *eloop = effect;
-  checkpoint_params[4] = k;
-
-  Node* continue_test =
-      graph()->NewNode(simplified()->NumberLessThan(), k, original_length);
-  Node* continue_branch = graph()->NewNode(common()->Branch(BranchHint::kNone),
-                                           continue_test, control);
-
-  Node* if_true = graph()->NewNode(common()->IfTrue(), continue_branch);
-  Node* if_false = graph()->NewNode(common()->IfFalse(), continue_branch);
-  control = if_true;
+  // TODO(turbofan): If JSOrdinaryToInstance raises an exception, the
+  // stack trace doesn't contain the @@hasInstance call; we have the
+  // corresponding bug in the baseline case. Some massaging of the frame
+  // state would be necessary here.
 
-  {
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, Builtins::kArrayMapLoopEagerDeoptContinuation,
-        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-        outer_frame_state, ContinuationFrameStateMode::EAGER);
-    effect =
-        graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
-  }
+  // Morph this {node} into a JSOrdinaryHasInstance node.
+  node->ReplaceInput(0, receiver);
+  node->ReplaceInput(1, object);
+  node->ReplaceInput(2, context);
+  node->ReplaceInput(3, frame_state);
+  node->ReplaceInput(4, effect);
+  node->ReplaceInput(5, control);
+  node->TrimInputCount(6);
+  NodeProperties::ChangeOp(node, javascript()->OrdinaryHasInstance());
+  return Changed(node);
+}
 
-  // Deopt if the map has changed during the iteration.
-  if (!stability_dependency) {
-    inference.InsertMapChecks(jsgraph(), &effect, control, p.feedback());
-  }
+Reduction JSCallReducer::ReduceObjectGetPrototype(Node* node, Node* object) {
+  Node* effect = NodeProperties::GetEffectInput(node);
 
-  Node* element =
-      SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
-  Node* next_k =
-      graph()->NewNode(simplified()->NumberAdd(), k, jsgraph()->OneConstant());
+  // Try to determine the {object} map.
+  MapInference inference(broker(), object, effect);
+  if (!inference.HaveMaps()) return NoChange();
+  MapHandles const& object_maps = inference.GetMaps();
 
-  Node* hole_true = nullptr;
-  Node* hole_false = nullptr;
-  Node* effect_true = effect;
+  MapRef candidate_map(broker(), object_maps[0]);
+  if (should_disallow_heap_access() && !candidate_map.serialized_prototype()) {
+    TRACE_BROKER_MISSING(broker(), "prototype for map " << candidate_map);
+    return inference.NoChange();
+  }
+  ObjectRef candidate_prototype = candidate_map.prototype();
 
-  if (IsHoleyElementsKind(kind)) {
-    // Holey elements kind require a hole check and skipping of the element in
-    // the case of a hole.
-    Node* check;
-    if (IsDoubleElementsKind(kind)) {
-      check = graph()->NewNode(simplified()->NumberIsFloat64Hole(), element);
-    } else {
-      check = graph()->NewNode(simplified()->ReferenceEqual(), element,
-                               jsgraph()->TheHoleConstant());
+  // Check if we can constant-fold the {candidate_prototype}.
+  for (size_t i = 0; i < object_maps.size(); ++i) {
+    MapRef object_map(broker(), object_maps[i]);
+    if (should_disallow_heap_access() && !object_map.serialized_prototype()) {
+      TRACE_BROKER_MISSING(broker(), "prototype for map " << object_map);
+      return inference.NoChange();
     }
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-    hole_true = graph()->NewNode(common()->IfTrue(), branch);
-    hole_false = graph()->NewNode(common()->IfFalse(), branch);
-    control = hole_false;
-
-    // The contract is that we don't leak "the hole" into "user JavaScript",
-    // so we must rename the {element} here to explicitly exclude "the hole"
-    // from the type of {element}.
-    element = effect = graph()->NewNode(
-        common()->TypeGuard(Type::NonInternal()), element, effect, control);
+    if (IsSpecialReceiverInstanceType(object_map.instance_type()) ||
+        !object_map.prototype().equals(candidate_prototype)) {
+      // We exclude special receivers, like JSProxy or API objects that
+      // might require access checks here; we also don't want to deal
+      // with hidden prototypes at this point.
+      return inference.NoChange();
+    }
+    // The above check also excludes maps for primitive values, which is
+    // important because we are not applying [[ToObject]] here as expected.
+    DCHECK(!object_map.IsPrimitiveMap() && object_map.IsJSReceiverMap());
   }
+  if (!inference.RelyOnMapsViaStability(dependencies())) {
+    return inference.NoChange();
+  }
+  Node* value = jsgraph()->Constant(candidate_prototype);
+  ReplaceWithValue(node, value);
+  return Replace(value);
+}
 
-  // This frame state is dealt with by hand in
-  // ArrayMapLoopLazyDeoptContinuation.
-  Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), shared, Builtins::kArrayMapLoopLazyDeoptContinuation,
-      node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-      outer_frame_state, ContinuationFrameStateMode::LAZY);
+// ES6 section 19.1.2.11 Object.getPrototypeOf ( O )
+Reduction JSCallReducer::ReduceObjectGetPrototypeOf(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* object = (node->op()->ValueInputCount() >= 3)
+                     ? NodeProperties::GetValueInput(node, 2)
+                     : jsgraph()->UndefinedConstant();
+  return ReduceObjectGetPrototype(node, object);
+}
 
-  Node* callback_value = control = effect = graph()->NewNode(
-      javascript()->Call(5, p.frequency()), fncallback, this_arg, element, k,
-      receiver, context, frame_state, effect, control);
+// ES section #sec-object.is
+Reduction JSCallReducer::ReduceObjectIs(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& params = CallParametersOf(node->op());
+  int const argc = static_cast<int>(params.arity() - 2);
+  Node* lhs = (argc >= 1) ? NodeProperties::GetValueInput(node, 2)
+                          : jsgraph()->UndefinedConstant();
+  Node* rhs = (argc >= 2) ? NodeProperties::GetValueInput(node, 3)
+                          : jsgraph()->UndefinedConstant();
+  Node* value = graph()->NewNode(simplified()->SameValue(), lhs, rhs);
+  ReplaceWithValue(node, value);
+  return Replace(value);
+}
 
-  // Rewire potential exception edges.
-  Node* on_exception = nullptr;
-  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
-    RewirePostCallbackExceptionEdges(check_throw, on_exception, effect,
-                                     &check_fail, &control);
-  }
+// ES6 section B.2.2.1.1 get Object.prototype.__proto__
+Reduction JSCallReducer::ReduceObjectPrototypeGetProto(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  return ReduceObjectGetPrototype(node, receiver);
+}
 
-  // The array {a} should be HOLEY_SMI_ELEMENTS because we'd only come into
-  // this loop if the input array length is non-zero, and "new Array({x > 0})"
-  // always produces a HOLEY array.
-  MapRef holey_double_map =
-      native_context().GetInitialJSArrayMap(HOLEY_DOUBLE_ELEMENTS);
-  MapRef holey_map = native_context().GetInitialJSArrayMap(HOLEY_ELEMENTS);
-  effect = graph()->NewNode(simplified()->TransitionAndStoreElement(
-                                holey_double_map.object(), holey_map.object()),
-                            a, k, callback_value, effect, control);
+// ES #sec-object.prototype.hasownproperty
+Reduction JSCallReducer::ReduceObjectPrototypeHasOwnProperty(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& params = CallParametersOf(node->op());
+  int const argc = static_cast<int>(params.arity() - 2);
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* name = (argc >= 1) ? NodeProperties::GetValueInput(node, 2)
+                           : jsgraph()->UndefinedConstant();
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
 
-  if (IsHoleyElementsKind(kind)) {
-    Node* after_call_and_store_control = control;
-    Node* after_call_and_store_effect = effect;
-    control = hole_true;
-    effect = effect_true;
+  // We can optimize a call to Object.prototype.hasOwnProperty if it's being
+  // used inside a fast-mode for..in, so for code like this:
+  //
+  //   for (name in receiver) {
+  //     if (receiver.hasOwnProperty(name)) {
+  //        ...
+  //     }
+  //   }
+  //
+  // If the for..in is in fast-mode, we know that the {receiver} has {name}
+  // as own property, otherwise the enumeration wouldn't include it. The graph
+  // constructed by the BytecodeGraphBuilder in this case looks like this:
+
+  // receiver
+  //  ^    ^
+  //  |    |
+  //  |    +-+
+  //  |      |
+  //  |   JSToObject
+  //  |      ^
+  //  |      |
+  //  |   JSForInNext
+  //  |      ^
+  //  +----+ |
+  //       | |
+  //  JSCall[hasOwnProperty]
 
-    control = graph()->NewNode(common()->Merge(2), control,
-                               after_call_and_store_control);
-    effect = graph()->NewNode(common()->EffectPhi(2), effect,
-                              after_call_and_store_effect, control);
+  // We can constant-fold the {node} to True in this case, and insert
+  // a (potentially redundant) map check to guard the fact that the
+  // {receiver} map didn't change since the dominating JSForInNext. This
+  // map check is only necessary when TurboFan cannot prove that there
+  // is no observable side effect between the {JSForInNext} and the
+  // {JSCall} to Object.prototype.hasOwnProperty.
+  //
+  // Also note that it's safe to look through the {JSToObject}, since the
+  // Object.prototype.hasOwnProperty does an implicit ToObject anyway, and
+  // these operations are not observable.
+  if (name->opcode() == IrOpcode::kJSForInNext) {
+    ForInMode const mode = ForInModeOf(name->op());
+    if (mode != ForInMode::kGeneric) {
+      Node* object = NodeProperties::GetValueInput(name, 0);
+      Node* cache_type = NodeProperties::GetValueInput(name, 2);
+      if (object->opcode() == IrOpcode::kJSToObject) {
+        object = NodeProperties::GetValueInput(object, 0);
+      }
+      if (object == receiver) {
+        // No need to repeat the map check if we can prove that there's no
+        // observable side effect between {effect} and {name].
+        if (!NodeProperties::NoObservableSideEffectBetween(effect, name)) {
+          Node* receiver_map = effect =
+              graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
+                               receiver, effect, control);
+          Node* check = graph()->NewNode(simplified()->ReferenceEqual(),
+                                         receiver_map, cache_type);
+          effect = graph()->NewNode(
+              simplified()->CheckIf(DeoptimizeReason::kWrongMap), check, effect,
+              control);
+        }
+        Node* value = jsgraph()->TrueConstant();
+        ReplaceWithValue(node, value, effect, control);
+        return Replace(value);
+      }
+    }
   }
 
-  WireInLoopEnd(loop, eloop, vloop, next_k, control, effect);
-
-  control = if_false;
-  effect = eloop;
-
-  // Wire up the branch for the case when IsCallable fails for the callback.
-  // Since {check_throw} is an unconditional throw, it's impossible to
-  // return a successful completion. Therefore, we simply connect the
-  // successful completion to the graph end.
-  Node* throw_node =
-      graph()->NewNode(common()->Throw(), check_throw, check_fail);
-  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
-
-  ReplaceWithValue(node, a, effect, control);
-  return Replace(a);
+  return NoChange();
 }
 
-Reduction JSCallReducer::ReduceArrayFilter(
-    Node* node, const SharedFunctionInfoRef& shared) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+// ES #sec-object.prototype.isprototypeof
+Reduction JSCallReducer::ReduceObjectPrototypeIsPrototypeOf(Node* node) {
+  DisallowHeapAccessIf no_heap_access(should_disallow_heap_access());
 
-  if (!FLAG_turbo_inline_array_builtins) return NoChange();
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
-
-  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* context = NodeProperties::GetContextInput(node);
   Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* fncallback = node->op()->ValueInputCount() > 2
-                         ? NodeProperties::GetValueInput(node, 2)
-                         : jsgraph()->UndefinedConstant();
-  Node* this_arg = node->op()->ValueInputCount() > 3
-                       ? NodeProperties::GetValueInput(node, 3)
-                       : jsgraph()->UndefinedConstant();
+  Node* value = node->op()->ValueInputCount() > 2
+                    ? NodeProperties::GetValueInput(node, 2)
+                    : jsgraph()->UndefinedConstant();
+  Node* effect = NodeProperties::GetEffectInput(node);
 
-  // Try to determine the {receiver} map.
+  // Ensure that the {receiver} is known to be a JSReceiver (so that
+  // the ToObject step of Object.prototype.isPrototypeOf is a no-op).
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return NoChange();
-  MapHandles const& receiver_maps = inference.GetMaps();
-
-  ElementsKind kind;
-  if (!CanInlineArrayIteratingBuiltin(broker(), receiver_maps, &kind)) {
-    return inference.NoChange();
-  }
-  if (!dependencies()->DependOnArraySpeciesProtector())
-    return inference.NoChange();
-  if (IsHoleyElementsKind(kind)) {
-    if (!dependencies()->DependOnNoElementsProtector()) UNREACHABLE();
-  }
-  bool const stability_dependency = inference.RelyOnMapsPreferStability(
-      dependencies(), jsgraph(), &effect, control, p.feedback());
-
-  // The output array is packed (filter doesn't visit holes).
-  const ElementsKind packed_kind = GetPackedElementsKind(kind);
-  MapRef initial_map = native_context().GetInitialJSArrayMap(packed_kind);
-
-  Node* k = jsgraph()->ZeroConstant();
-  Node* to = jsgraph()->ZeroConstant();
-
-  Node* a;  // Construct the output array.
-  {
-    AllocationBuilder ab(jsgraph(), effect, control);
-    ab.Allocate(initial_map.instance_size(), AllocationType::kYoung,
-                Type::Array());
-    ab.Store(AccessBuilder::ForMap(), initial_map);
-    Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
-    ab.Store(AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer(),
-             empty_fixed_array);
-    ab.Store(AccessBuilder::ForJSObjectElements(), empty_fixed_array);
-    ab.Store(AccessBuilder::ForJSArrayLength(packed_kind),
-             jsgraph()->ZeroConstant());
-    for (int i = 0; i < initial_map.GetInObjectProperties(); ++i) {
-      ab.Store(AccessBuilder::ForJSObjectInObjectProperty(initial_map, i),
-               jsgraph()->UndefinedConstant());
-    }
-    a = effect = ab.Finish();
-  }
-
-  Node* original_length = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSArrayLength(kind)), receiver,
-      effect, control);
-
-  // Check whether the given callback function is callable. Note that this has
-  // to happen outside the loop to make sure we also throw on empty arrays.
-  Node* check_fail = nullptr;
-  Node* check_throw = nullptr;
-  {
-    // This frame state doesn't ever call the deopt continuation, it's only
-    // necessary to specifiy a continuation in order to handle the exceptional
-    // case. We don't have all the values available to completely fill out
-    // checkpoint_params yet, but that's okay because it'll never be called.
-    // Therefore, "to" is mentioned twice, once standing in for the k_value
-    // value.
-    Node* checkpoint_params[] = {receiver, fncallback,      this_arg, a,
-                                 k,        original_length, to,       to};
-    const int stack_parameters = arraysize(checkpoint_params);
-
-    Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, Builtins::kArrayFilterLoopLazyDeoptContinuation,
-        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-        outer_frame_state, ContinuationFrameStateMode::LAZY);
-    WireInCallbackIsCallableCheck(fncallback, context, check_frame_state,
-                                  effect, &control, &check_fail, &check_throw);
-  }
-
-  // Start the loop.
-  Node* vloop = k = WireInLoopStart(k, &control, &effect);
-  Node *loop = control, *eloop = effect;
-  Node* v_to_loop = to = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTaggedSigned, 2), to, to, loop);
-
-  Node* continue_test =
-      graph()->NewNode(simplified()->NumberLessThan(), k, original_length);
-  Node* continue_branch = graph()->NewNode(common()->Branch(BranchHint::kNone),
-                                           continue_test, control);
-
-  Node* if_true = graph()->NewNode(common()->IfTrue(), continue_branch);
-  Node* if_false = graph()->NewNode(common()->IfFalse(), continue_branch);
-  control = if_true;
-
-  {
-    Node* checkpoint_params[] = {receiver, fncallback,      this_arg, a,
-                                 k,        original_length, to};
-    const int stack_parameters = arraysize(checkpoint_params);
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, Builtins::kArrayFilterLoopEagerDeoptContinuation,
-        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-        outer_frame_state, ContinuationFrameStateMode::EAGER);
-    effect =
-        graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
+  if (!inference.HaveMaps() || !inference.AllOfInstanceTypesAreJSReceiver()) {
+    return NoChange();
   }
 
-  // Deopt if the map has changed during the iteration.
-  if (!stability_dependency) {
-    inference.InsertMapChecks(jsgraph(), &effect, control, p.feedback());
+  // We don't check whether {value} is a proper JSReceiver here explicitly,
+  // and don't explicitly rule out Primitive {value}s, since all of them
+  // have null as their prototype, so the prototype chain walk inside the
+  // JSHasInPrototypeChain operator immediately aborts and yields false.
+  NodeProperties::ReplaceValueInput(node, value, 0);
+  NodeProperties::ReplaceValueInput(node, receiver, 1);
+  for (int i = node->op()->ValueInputCount(); i-- > 2;) {
+    node->RemoveInput(i);
   }
+  NodeProperties::ChangeOp(node, javascript()->HasInPrototypeChain());
+  return Changed(node);
+}
 
-  Node* element =
-      SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
-  Node* next_k =
-      graph()->NewNode(simplified()->NumberAdd(), k, jsgraph()->OneConstant());
-
-  Node* hole_true = nullptr;
-  Node* hole_false = nullptr;
-  Node* effect_true = effect;
-  Node* hole_true_vto = to;
-
-  if (IsHoleyElementsKind(kind)) {
-    // Holey elements kind require a hole check and skipping of the element in
-    // the case of a hole.
-    Node* check;
-    if (IsDoubleElementsKind(kind)) {
-      check = graph()->NewNode(simplified()->NumberIsFloat64Hole(), element);
-    } else {
-      check = graph()->NewNode(simplified()->ReferenceEqual(), element,
-                               jsgraph()->TheHoleConstant());
-    }
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-    hole_true = graph()->NewNode(common()->IfTrue(), branch);
-    hole_false = graph()->NewNode(common()->IfFalse(), branch);
-    control = hole_false;
-
-    // The contract is that we don't leak "the hole" into "user JavaScript",
-    // so we must rename the {element} here to explicitly exclude "the hole"
-    // from the type of {element}.
-    element = effect = graph()->NewNode(
-        common()->TypeGuard(Type::NonInternal()), element, effect, control);
+// ES6 section 26.1.1 Reflect.apply ( target, thisArgument, argumentsList )
+Reduction JSCallReducer::ReduceReflectApply(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  int arity = static_cast<int>(p.arity() - 2);
+  DCHECK_LE(0, arity);
+  // Massage value inputs appropriately.
+  node->RemoveInput(0);
+  node->RemoveInput(0);
+  while (arity < 3) {
+    node->InsertInput(graph()->zone(), arity++, jsgraph()->UndefinedConstant());
   }
-
-  Node* callback_value = nullptr;
-  {
-    // This frame state is dealt with by hand in
-    // Builtins::kArrayFilterLoopLazyDeoptContinuation.
-    Node* checkpoint_params[] = {receiver, fncallback,      this_arg, a,
-                                 k,        original_length, element,  to};
-    const int stack_parameters = arraysize(checkpoint_params);
-
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, Builtins::kArrayFilterLoopLazyDeoptContinuation,
-        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-        outer_frame_state, ContinuationFrameStateMode::LAZY);
-
-    callback_value = control = effect = graph()->NewNode(
-        javascript()->Call(5, p.frequency()), fncallback, this_arg, element, k,
-        receiver, context, frame_state, effect, control);
+  while (arity-- > 3) {
+    node->RemoveInput(arity);
   }
+  NodeProperties::ChangeOp(
+      node, javascript()->CallWithArrayLike(p.frequency(), p.feedback(),
+                                            p.speculation_mode(),
+                                            CallFeedbackRelation::kUnrelated));
+  Reduction const reduction = ReduceJSCallWithArrayLike(node);
+  return reduction.Changed() ? reduction : Changed(node);
+}
 
-  // Rewire potential exception edges.
-  Node* on_exception = nullptr;
-  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
-    RewirePostCallbackExceptionEdges(check_throw, on_exception, effect,
-                                     &check_fail, &control);
+// ES6 section 26.1.2 Reflect.construct ( target, argumentsList [, newTarget] )
+Reduction JSCallReducer::ReduceReflectConstruct(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  int arity = static_cast<int>(p.arity() - 2);
+  DCHECK_LE(0, arity);
+  // Massage value inputs appropriately.
+  node->RemoveInput(0);
+  node->RemoveInput(0);
+  while (arity < 2) {
+    node->InsertInput(graph()->zone(), arity++, jsgraph()->UndefinedConstant());
   }
-
-  // We need an eager frame state for right after the callback function
-  // returned, just in case an attempt to grow the output array fails.
-  //
-  // Note that we are intentionally reusing the
-  // Builtins::kArrayFilterLoopLazyDeoptContinuation as an *eager* entry
-  // point in this case. This is safe, because re-evaluating a [ToBoolean]
-  // coercion is safe.
-  {
-    Node* checkpoint_params[] = {receiver, fncallback, this_arg,
-                                 a,        k,          original_length,
-                                 element,  to,         callback_value};
-    const int stack_parameters = arraysize(checkpoint_params);
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, Builtins::kArrayFilterLoopLazyDeoptContinuation,
-        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-        outer_frame_state, ContinuationFrameStateMode::EAGER);
-
-    effect =
-        graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
+  if (arity < 3) {
+    node->InsertInput(graph()->zone(), arity++, node->InputAt(0));
   }
-
-  // We have to coerce callback_value to boolean, and only store the element
-  // in a if it's true. The checkpoint above protects against the case that
-  // growing {a} fails.
-  to = DoFilterPostCallbackWork(packed_kind, &control, &effect, a, to, element,
-                                callback_value);
-
-  if (IsHoleyElementsKind(kind)) {
-    Node* after_call_control = control;
-    Node* after_call_effect = effect;
-    control = hole_true;
-    effect = effect_true;
-
-    control = graph()->NewNode(common()->Merge(2), control, after_call_control);
-    effect = graph()->NewNode(common()->EffectPhi(2), effect, after_call_effect,
-                              control);
-    to =
-        graph()->NewNode(common()->Phi(MachineRepresentation::kTaggedSigned, 2),
-                         hole_true_vto, to, control);
+  while (arity-- > 3) {
+    node->RemoveInput(arity);
   }
-
-  WireInLoopEnd(loop, eloop, vloop, next_k, control, effect);
-  v_to_loop->ReplaceInput(1, to);
-
-  control = if_false;
-  effect = eloop;
-
-  // Wire up the branch for the case when IsCallable fails for the callback.
-  // Since {check_throw} is an unconditional throw, it's impossible to
-  // return a successful completion. Therefore, we simply connect the
-  // successful completion to the graph end.
-  Node* throw_node =
-      graph()->NewNode(common()->Throw(), check_throw, check_fail);
-  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
-
-  ReplaceWithValue(node, a, effect, control);
-  return Replace(a);
+  NodeProperties::ChangeOp(node,
+                           javascript()->ConstructWithArrayLike(p.frequency()));
+  Reduction const reduction = ReduceJSConstructWithArrayLike(node);
+  return reduction.Changed() ? reduction : Changed(node);
 }
 
-Reduction JSCallReducer::ReduceArrayFind(Node* node, ArrayFindVariant variant,
-                                         const SharedFunctionInfoRef& shared) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
-
-  if (!FLAG_turbo_inline_array_builtins) return NoChange();
+// ES6 section 26.1.7 Reflect.getPrototypeOf ( target )
+Reduction JSCallReducer::ReduceReflectGetPrototypeOf(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
+  Node* target = (node->op()->ValueInputCount() >= 3)
+                     ? NodeProperties::GetValueInput(node, 2)
+                     : jsgraph()->UndefinedConstant();
+  return ReduceObjectGetPrototype(node, target);
+}
 
-  Builtins::Name eager_continuation_builtin;
-  Builtins::Name lazy_continuation_builtin;
-  Builtins::Name after_callback_lazy_continuation_builtin;
-  if (variant == ArrayFindVariant::kFind) {
-    eager_continuation_builtin = Builtins::kArrayFindLoopEagerDeoptContinuation;
-    lazy_continuation_builtin = Builtins::kArrayFindLoopLazyDeoptContinuation;
-    after_callback_lazy_continuation_builtin =
-        Builtins::kArrayFindLoopAfterCallbackLazyDeoptContinuation;
-  } else {
-    DCHECK_EQ(ArrayFindVariant::kFindIndex, variant);
-    eager_continuation_builtin =
-        Builtins::kArrayFindIndexLoopEagerDeoptContinuation;
-    lazy_continuation_builtin =
-        Builtins::kArrayFindIndexLoopLazyDeoptContinuation;
-    after_callback_lazy_continuation_builtin =
-        Builtins::kArrayFindIndexLoopAfterCallbackLazyDeoptContinuation;
-  }
+// ES6 section #sec-object.create Object.create(proto, properties)
+Reduction JSCallReducer::ReduceObjectCreate(Node* node) {
+  int arg_count = node->op()->ValueInputCount();
+  Node* properties = arg_count >= 4 ? NodeProperties::GetValueInput(node, 3)
+                                    : jsgraph()->UndefinedConstant();
+  if (properties != jsgraph()->UndefinedConstant()) return NoChange();
 
-  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* context = NodeProperties::GetContextInput(node);
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* fncallback = node->op()->ValueInputCount() > 2
-                         ? NodeProperties::GetValueInput(node, 2)
-                         : jsgraph()->UndefinedConstant();
-  Node* this_arg = node->op()->ValueInputCount() > 3
-                       ? NodeProperties::GetValueInput(node, 3)
-                       : jsgraph()->UndefinedConstant();
-
-  // Try to determine the {receiver} map.
-  MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return NoChange();
-  MapHandles const& receiver_maps = inference.GetMaps();
-
-  ElementsKind kind;
-  if (!CanInlineArrayIteratingBuiltin(broker(), receiver_maps, &kind)) {
-    return inference.NoChange();
-  }
-  if (!dependencies()->DependOnNoElementsProtector()) UNREACHABLE();
-  bool const stability_dependency = inference.RelyOnMapsPreferStability(
-      dependencies(), jsgraph(), &effect, control, p.feedback());
-
-  Node* k = jsgraph()->ZeroConstant();
-  Node* original_length = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSArrayLength(kind)), receiver,
-      effect, control);
-  Node* checkpoint_params[] = {receiver, fncallback, this_arg, k,
-                               original_length};
-  const int stack_parameters = arraysize(checkpoint_params);
-
-  // Check whether the given callback function is callable. Note that this has
-  // to happen outside the loop to make sure we also throw on empty arrays.
-  Node* check_fail = nullptr;
-  Node* check_throw = nullptr;
-  {
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, lazy_continuation_builtin, node->InputAt(0), context,
-        &checkpoint_params[0], stack_parameters, outer_frame_state,
-        ContinuationFrameStateMode::LAZY);
-    WireInCallbackIsCallableCheck(fncallback, context, frame_state, effect,
-                                  &control, &check_fail, &check_throw);
-  }
-
-  // Start the loop.
-  Node* vloop = k = WireInLoopStart(k, &control, &effect);
-  Node *loop = control, *eloop = effect;
-  checkpoint_params[3] = k;
-
-  // Check if we've iterated past the last element of the array.
-  Node* if_false = nullptr;
-  {
-    Node* continue_test =
-        graph()->NewNode(simplified()->NumberLessThan(), k, original_length);
-    Node* continue_branch = graph()->NewNode(
-        common()->Branch(BranchHint::kNone), continue_test, control);
-    control = graph()->NewNode(common()->IfTrue(), continue_branch);
-    if_false = graph()->NewNode(common()->IfFalse(), continue_branch);
-  }
-
-  {
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, eager_continuation_builtin, node->InputAt(0),
-        context, &checkpoint_params[0], stack_parameters, outer_frame_state,
-        ContinuationFrameStateMode::EAGER);
-    effect =
-        graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
-  }
-
-  // Deopt if the map has changed during the iteration.
-  if (!stability_dependency) {
-    inference.InsertMapChecks(jsgraph(), &effect, control, p.feedback());
-  }
-
-  Node* element =
-      SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
-  Node* next_k = checkpoint_params[3] =
-      graph()->NewNode(simplified()->NumberAdd(), k, jsgraph()->OneConstant());
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* prototype = arg_count >= 3 ? NodeProperties::GetValueInput(node, 2)
+                                   : jsgraph()->UndefinedConstant();
+  node->ReplaceInput(0, prototype);
+  node->ReplaceInput(1, context);
+  node->ReplaceInput(2, frame_state);
+  node->ReplaceInput(3, effect);
+  node->ReplaceInput(4, control);
+  node->TrimInputCount(5);
+  NodeProperties::ChangeOp(node, javascript()->CreateObject());
+  return Changed(node);
+}
 
-  // Replace holes with undefined.
-  if (kind == HOLEY_DOUBLE_ELEMENTS) {
-    // TODO(7409): avoid deopt if not all uses of value are truncated.
-    CheckFloat64HoleMode mode = CheckFloat64HoleMode::kAllowReturnHole;
-    element = effect =
-        graph()->NewNode(simplified()->CheckFloat64Hole(mode, p.feedback()),
-                         element, effect, control);
-  } else if (IsHoleyElementsKind(kind)) {
-    element =
-        graph()->NewNode(simplified()->ConvertTaggedHoleToUndefined(), element);
-  }
+// ES section #sec-reflect.get
+Reduction JSCallReducer::ReduceReflectGet(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  int arity = static_cast<int>(p.arity() - 2);
+  if (arity != 2) return NoChange();
+  Node* target = NodeProperties::GetValueInput(node, 2);
+  Node* key = NodeProperties::GetValueInput(node, 3);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
 
-  Node* if_found_return_value =
-      (variant == ArrayFindVariant::kFind) ? element : k;
+  // Check whether {target} is a JSReceiver.
+  Node* check = graph()->NewNode(simplified()->ObjectIsReceiver(), target);
+  Node* branch =
+      graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
 
-  // Call the callback.
-  Node* callback_value = nullptr;
+  // Throw an appropriate TypeError if the {target} is not a JSReceiver.
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+  Node* efalse = effect;
   {
-    Node* call_checkpoint_params[] = {receiver,        fncallback,
-                                      this_arg,        next_k,
-                                      original_length, if_found_return_value};
-    const int call_stack_parameters = arraysize(call_checkpoint_params);
-
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, after_callback_lazy_continuation_builtin,
-        node->InputAt(0), context, &call_checkpoint_params[0],
-        call_stack_parameters, outer_frame_state,
-        ContinuationFrameStateMode::LAZY);
-
-    callback_value = control = effect = graph()->NewNode(
-        javascript()->Call(5, p.frequency()), fncallback, this_arg, element, k,
-        receiver, context, frame_state, effect, control);
-  }
-
-  // Rewire potential exception edges.
-  Node* on_exception = nullptr;
-  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
-    RewirePostCallbackExceptionEdges(check_throw, on_exception, effect,
-                                     &check_fail, &control);
+    if_false = efalse = graph()->NewNode(
+        javascript()->CallRuntime(Runtime::kThrowTypeError, 2),
+        jsgraph()->Constant(
+            static_cast<int>(MessageTemplate::kCalledOnNonObject)),
+        jsgraph()->HeapConstant(factory()->ReflectGet_string()), context,
+        frame_state, efalse, if_false);
   }
 
-  // Check whether the given callback function returned a truthy value.
-  Node* boolean_result =
-      graph()->NewNode(simplified()->ToBoolean(), callback_value);
-  Node* efound_branch = effect;
-  Node* found_branch = graph()->NewNode(common()->Branch(BranchHint::kFalse),
-                                        boolean_result, control);
-  Node* if_found = graph()->NewNode(common()->IfTrue(), found_branch);
-  Node* if_notfound = graph()->NewNode(common()->IfFalse(), found_branch);
-  control = if_notfound;
-
-  // Close the loop.
-  WireInLoopEnd(loop, eloop, vloop, next_k, control, effect);
-
-  control = graph()->NewNode(common()->Merge(2), if_found, if_false);
-  effect =
-      graph()->NewNode(common()->EffectPhi(2), efound_branch, eloop, control);
-
-  Node* if_not_found_value = (variant == ArrayFindVariant::kFind)
-                                 ? jsgraph()->UndefinedConstant()
-                                 : jsgraph()->MinusOneConstant();
-  Node* value =
-      graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                       if_found_return_value, if_not_found_value, control);
-
-  // Introduce proper LoopExit/LoopExitEffect/LoopExitValue to mark
-  // {loop} as a candidate for loop peeling (crbug.com/v8/8273).
-  control = graph()->NewNode(common()->LoopExit(), control, loop);
-  effect = graph()->NewNode(common()->LoopExitEffect(), effect, control);
-  value = graph()->NewNode(common()->LoopExitValue(), value, control);
-
-  // Wire up the branch for the case when IsCallable fails for the callback.
-  // Since {check_throw} is an unconditional throw, it's impossible to
-  // return a successful completion. Therefore, we simply connect the
-  // successful completion to the graph end.
-  Node* throw_node =
-      graph()->NewNode(common()->Throw(), check_throw, check_fail);
-  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
-
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
-}
-
-Node* JSCallReducer::DoFilterPostCallbackWork(ElementsKind kind, Node** control,
-                                              Node** effect, Node* a, Node* to,
-                                              Node* element,
-                                              Node* callback_value) {
-  Node* boolean_result =
-      graph()->NewNode(simplified()->ToBoolean(), callback_value);
-  Node* boolean_branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                          boolean_result, *control);
-
-  Node* if_true = graph()->NewNode(common()->IfTrue(), boolean_branch);
-  Node* etrue = *effect;
+  // Otherwise just use the existing GetPropertyStub.
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  Node* etrue = effect;
   Node* vtrue;
   {
-    // Load the elements backing store of the {receiver}.
-    Node* elements = etrue = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForJSObjectElements()), a, etrue,
-        if_true);
-
-    DCHECK(TypeCache::Get()->kFixedDoubleArrayLengthType.Is(
-        TypeCache::Get()->kFixedArrayLengthType));
-    Node* checked_to = etrue = graph()->NewNode(
-        common()->TypeGuard(TypeCache::Get()->kFixedArrayLengthType), to, etrue,
-        if_true);
-    Node* elements_length = etrue = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForFixedArrayLength()), elements,
-        etrue, if_true);
+    Callable callable =
+        Builtins::CallableFor(isolate(), Builtins::kGetProperty);
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        graph()->zone(), callable.descriptor(),
+        callable.descriptor().GetStackParameterCount(),
+        CallDescriptor::kNeedsFrameState, Operator::kNoProperties);
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+    vtrue = etrue = if_true =
+        graph()->NewNode(common()->Call(call_descriptor), stub_code, target,
+                         key, context, frame_state, etrue, if_true);
+  }
 
-    GrowFastElementsMode mode =
-        IsDoubleElementsKind(kind) ? GrowFastElementsMode::kDoubleElements
-                                   : GrowFastElementsMode::kSmiOrObjectElements;
-    elements = etrue = graph()->NewNode(
-        simplified()->MaybeGrowFastElements(mode, FeedbackSource()), a,
-        elements, checked_to, elements_length, etrue, if_true);
+  // Rewire potential exception edges.
+  Node* on_exception = nullptr;
+  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
+    // Create appropriate {IfException} and {IfSuccess} nodes.
+    Node* extrue = graph()->NewNode(common()->IfException(), etrue, if_true);
+    if_true = graph()->NewNode(common()->IfSuccess(), if_true);
+    Node* exfalse = graph()->NewNode(common()->IfException(), efalse, if_false);
+    if_false = graph()->NewNode(common()->IfSuccess(), if_false);
 
-    // Update the length of {a}.
-    Node* new_length_a = graph()->NewNode(simplified()->NumberAdd(), checked_to,
-                                          jsgraph()->OneConstant());
+    // Join the exception edges.
+    Node* merge = graph()->NewNode(common()->Merge(2), extrue, exfalse);
+    Node* ephi =
+        graph()->NewNode(common()->EffectPhi(2), extrue, exfalse, merge);
+    Node* phi =
+        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                         extrue, exfalse, merge);
+    ReplaceWithValue(on_exception, phi, ephi, merge);
+  }
 
-    etrue = graph()->NewNode(
-        simplified()->StoreField(AccessBuilder::ForJSArrayLength(kind)), a,
-        new_length_a, etrue, if_true);
+  // Connect the throwing path to end.
+  if_false = graph()->NewNode(common()->Throw(), efalse, if_false);
+  NodeProperties::MergeControlToEnd(graph(), common(), if_false);
 
-    // Append the value to the {elements}.
-    etrue = graph()->NewNode(
-        simplified()->StoreElement(AccessBuilder::ForFixedArrayElement(kind)),
-        elements, checked_to, element, etrue, if_true);
-
-    vtrue = new_length_a;
-  }
-
-  Node* if_false = graph()->NewNode(common()->IfFalse(), boolean_branch);
-  Node* efalse = *effect;
-  Node* vfalse = to;
-
-  *control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-  *effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, *control);
-  to = graph()->NewNode(common()->Phi(MachineRepresentation::kTaggedSigned, 2),
-                        vtrue, vfalse, *control);
-  return to;
-}
-
-void JSCallReducer::WireInCallbackIsCallableCheck(
-    Node* fncallback, Node* context, Node* check_frame_state, Node* effect,
-    Node** control, Node** check_fail, Node** check_throw) {
-  Node* check = graph()->NewNode(simplified()->ObjectIsCallable(), fncallback);
-  Node* check_branch =
-      graph()->NewNode(common()->Branch(BranchHint::kTrue), check, *control);
-  *check_fail = graph()->NewNode(common()->IfFalse(), check_branch);
-  *check_throw = *check_fail = graph()->NewNode(
-      javascript()->CallRuntime(Runtime::kThrowTypeError, 2),
-      jsgraph()->Constant(
-          static_cast<int>(MessageTemplate::kCalledNonCallable)),
-      fncallback, context, check_frame_state, effect, *check_fail);
-  *control = graph()->NewNode(common()->IfTrue(), check_branch);
-}
-
-void JSCallReducer::RewirePostCallbackExceptionEdges(Node* check_throw,
-                                                     Node* on_exception,
-                                                     Node* effect,
-                                                     Node** check_fail,
-                                                     Node** control) {
-  // Create appropriate {IfException} and {IfSuccess} nodes.
-  Node* if_exception0 =
-      graph()->NewNode(common()->IfException(), check_throw, *check_fail);
-  *check_fail = graph()->NewNode(common()->IfSuccess(), *check_fail);
-  Node* if_exception1 =
-      graph()->NewNode(common()->IfException(), effect, *control);
-  *control = graph()->NewNode(common()->IfSuccess(), *control);
-
-  // Join the exception edges.
-  Node* merge =
-      graph()->NewNode(common()->Merge(2), if_exception0, if_exception1);
-  Node* ephi = graph()->NewNode(common()->EffectPhi(2), if_exception0,
-                                if_exception1, merge);
-  Node* phi = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                               if_exception0, if_exception1, merge);
-  ReplaceWithValue(on_exception, phi, ephi, merge);
-}
-
-Node* JSCallReducer::SafeLoadElement(ElementsKind kind, Node* receiver,
-                                     Node* control, Node** effect, Node** k,
-                                     const FeedbackSource& feedback) {
-  // Make sure that the access is still in bounds, since the callback could
-  // have changed the array's size.
-  Node* length = *effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSArrayLength(kind)), receiver,
-      *effect, control);
-  *k = *effect = graph()->NewNode(simplified()->CheckBounds(feedback), *k,
-                                  length, *effect, control);
-
-  // Reload the elements pointer before calling the callback, since the
-  // previous callback might have resized the array causing the elements
-  // buffer to be re-allocated.
-  Node* elements = *effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSObjectElements()), receiver,
-      *effect, control);
-
-  Node* element = *effect = graph()->NewNode(
-      simplified()->LoadElement(AccessBuilder::ForFixedArrayElement(
-          kind, LoadSensitivity::kCritical)),
-      elements, *k, *effect, control);
-  return element;
+  // Continue on the regular path.
+  ReplaceWithValue(node, vtrue, etrue, if_true);
+  return Changed(vtrue);
 }
 
-Reduction JSCallReducer::ReduceArrayEvery(Node* node,
-                                          const SharedFunctionInfoRef& shared) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
-
-  if (!FLAG_turbo_inline_array_builtins) return NoChange();
+// ES section #sec-reflect.has
+Reduction JSCallReducer::ReduceReflectHas(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
-
-  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
+  int arity = static_cast<int>(p.arity() - 2);
+  DCHECK_LE(0, arity);
+  Node* target = (arity >= 1) ? NodeProperties::GetValueInput(node, 2)
+                              : jsgraph()->UndefinedConstant();
+  Node* key = (arity >= 2) ? NodeProperties::GetValueInput(node, 3)
+                           : jsgraph()->UndefinedConstant();
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* fncallback = node->op()->ValueInputCount() > 2
-                         ? NodeProperties::GetValueInput(node, 2)
-                         : jsgraph()->UndefinedConstant();
-  Node* this_arg = node->op()->ValueInputCount() > 3
-                       ? NodeProperties::GetValueInput(node, 3)
-                       : jsgraph()->UndefinedConstant();
-
-  // Try to determine the {receiver} map.
-  MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return NoChange();
-  MapHandles const& receiver_maps = inference.GetMaps();
-
-  ElementsKind kind;
-  if (!CanInlineArrayIteratingBuiltin(broker(), receiver_maps, &kind)) {
-    return inference.NoChange();
-  }
-  if (!dependencies()->DependOnArraySpeciesProtector())
-    return inference.NoChange();
-  if (IsHoleyElementsKind(kind)) {
-    if (!dependencies()->DependOnNoElementsProtector()) UNREACHABLE();
-  }
-  bool const stability_dependency = inference.RelyOnMapsPreferStability(
-      dependencies(), jsgraph(), &effect, control, p.feedback());
-
-  Node* k = jsgraph()->ZeroConstant();
-  Node* original_length = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSArrayLength(kind)), receiver,
-      effect, control);
 
-  // Check whether the given callback function is callable. Note that this has
-  // to happen outside the loop to make sure we also throw on empty arrays.
-  Node* check_fail = nullptr;
-  Node* check_throw = nullptr;
-  {
-    // This frame state doesn't ever call the deopt continuation, it's only
-    // necessary to specifiy a continuation in order to handle the exceptional
-    // case.
-    Node* checkpoint_params[] = {receiver, fncallback, this_arg, k,
-                                 original_length};
-    const int stack_parameters = arraysize(checkpoint_params);
-
-    Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, Builtins::kArrayEveryLoopLazyDeoptContinuation,
-        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-        outer_frame_state, ContinuationFrameStateMode::LAZY);
-    WireInCallbackIsCallableCheck(fncallback, context, check_frame_state,
-                                  effect, &control, &check_fail, &check_throw);
-  }
-
-  // Start the loop.
-  Node* vloop = k = WireInLoopStart(k, &control, &effect);
-  Node *loop = control, *eloop = effect;
-
-  Node* continue_test =
-      graph()->NewNode(simplified()->NumberLessThan(), k, original_length);
-  Node* continue_branch = graph()->NewNode(common()->Branch(BranchHint::kNone),
-                                           continue_test, control);
-
-  Node* if_true = graph()->NewNode(common()->IfTrue(), continue_branch);
-  Node* if_false = graph()->NewNode(common()->IfFalse(), continue_branch);
-  control = if_true;
+  // Check whether {target} is a JSReceiver.
+  Node* check = graph()->NewNode(simplified()->ObjectIsReceiver(), target);
+  Node* branch =
+      graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
 
+  // Throw an appropriate TypeError if the {target} is not a JSReceiver.
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+  Node* efalse = effect;
   {
-    Node* checkpoint_params[] = {receiver, fncallback, this_arg, k,
-                                 original_length};
-    const int stack_parameters = arraysize(checkpoint_params);
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, Builtins::kArrayEveryLoopEagerDeoptContinuation,
-        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-        outer_frame_state, ContinuationFrameStateMode::EAGER);
-    effect =
-        graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
-  }
-
-  // Deopt if the map has changed during the iteration.
-  if (!stability_dependency) {
-    inference.InsertMapChecks(jsgraph(), &effect, control, p.feedback());
-  }
-
-  Node* element =
-      SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
-  Node* next_k =
-      graph()->NewNode(simplified()->NumberAdd(), k, jsgraph()->OneConstant());
-
-  Node* hole_true = nullptr;
-  Node* hole_false = nullptr;
-  Node* effect_true = effect;
-
-  if (IsHoleyElementsKind(kind)) {
-    // Holey elements kind require a hole check and skipping of the element in
-    // the case of a hole.
-    Node* check;
-    if (IsDoubleElementsKind(kind)) {
-      check = graph()->NewNode(simplified()->NumberIsFloat64Hole(), element);
-    } else {
-      check = graph()->NewNode(simplified()->ReferenceEqual(), element,
-                               jsgraph()->TheHoleConstant());
-    }
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-    hole_true = graph()->NewNode(common()->IfTrue(), branch);
-    hole_false = graph()->NewNode(common()->IfFalse(), branch);
-    control = hole_false;
-
-    // The contract is that we don't leak "the hole" into "user JavaScript",
-    // so we must rename the {element} here to explicitly exclude "the hole"
-    // from the type of {element}.
-    element = effect = graph()->NewNode(
-        common()->TypeGuard(Type::NonInternal()), element, effect, control);
+    if_false = efalse = graph()->NewNode(
+        javascript()->CallRuntime(Runtime::kThrowTypeError, 2),
+        jsgraph()->Constant(
+            static_cast<int>(MessageTemplate::kCalledOnNonObject)),
+        jsgraph()->HeapConstant(factory()->ReflectHas_string()), context,
+        frame_state, efalse, if_false);
   }
 
-  Node* callback_value = nullptr;
+  // Otherwise just use the existing {JSHasProperty} logic.
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  Node* etrue = effect;
+  Node* vtrue;
   {
-    // This frame state is dealt with by hand in
-    // Builtins::kArrayEveryLoopLazyDeoptContinuation.
-    Node* checkpoint_params[] = {receiver, fncallback, this_arg, k,
-                                 original_length};
-    const int stack_parameters = arraysize(checkpoint_params);
-
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, Builtins::kArrayEveryLoopLazyDeoptContinuation,
-        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-        outer_frame_state, ContinuationFrameStateMode::LAZY);
-
-    callback_value = control = effect = graph()->NewNode(
-        javascript()->Call(5, p.frequency()), fncallback, this_arg, element, k,
-        receiver, context, frame_state, effect, control);
+    // TODO(magardn): collect feedback so this can be optimized
+    vtrue = etrue = if_true =
+        graph()->NewNode(javascript()->HasProperty(FeedbackSource()), target,
+                         key, context, frame_state, etrue, if_true);
   }
 
   // Rewire potential exception edges.
   Node* on_exception = nullptr;
   if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
-    RewirePostCallbackExceptionEdges(check_throw, on_exception, effect,
-                                     &check_fail, &control);
-  }
-
-  // We have to coerce callback_value to boolean.
-  Node* if_false_callback;
-  Node* efalse_callback;
-  {
-    Node* boolean_result =
-        graph()->NewNode(simplified()->ToBoolean(), callback_value);
-    Node* boolean_branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                            boolean_result, control);
-    if_false_callback = graph()->NewNode(common()->IfFalse(), boolean_branch);
-    efalse_callback = effect;
-
-    // Nothing to do in the true case.
-    control = graph()->NewNode(common()->IfTrue(), boolean_branch);
-  }
-
-  if (IsHoleyElementsKind(kind)) {
-    Node* after_call_control = control;
-    Node* after_call_effect = effect;
-    control = hole_true;
-    effect = effect_true;
+    // Create appropriate {IfException} and {IfSuccess} nodes.
+    Node* extrue = graph()->NewNode(common()->IfException(), etrue, if_true);
+    if_true = graph()->NewNode(common()->IfSuccess(), if_true);
+    Node* exfalse = graph()->NewNode(common()->IfException(), efalse, if_false);
+    if_false = graph()->NewNode(common()->IfSuccess(), if_false);
 
-    control = graph()->NewNode(common()->Merge(2), control, after_call_control);
-    effect = graph()->NewNode(common()->EffectPhi(2), effect, after_call_effect,
-                              control);
+    // Join the exception edges.
+    Node* merge = graph()->NewNode(common()->Merge(2), extrue, exfalse);
+    Node* ephi =
+        graph()->NewNode(common()->EffectPhi(2), extrue, exfalse, merge);
+    Node* phi =
+        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                         extrue, exfalse, merge);
+    ReplaceWithValue(on_exception, phi, ephi, merge);
   }
 
-  WireInLoopEnd(loop, eloop, vloop, next_k, control, effect);
-
-  control = graph()->NewNode(common()->Merge(2), if_false, if_false_callback);
-  effect =
-      graph()->NewNode(common()->EffectPhi(2), eloop, efalse_callback, control);
-  Node* value = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTagged, 2),
-      jsgraph()->TrueConstant(), jsgraph()->FalseConstant(), control);
-
-  // Introduce proper LoopExit/LoopExitEffect/LoopExitValue to mark
-  // {loop} as a candidate for loop peeling (crbug.com/v8/8273).
-  control = graph()->NewNode(common()->LoopExit(), control, loop);
-  effect = graph()->NewNode(common()->LoopExitEffect(), effect, control);
-  value = graph()->NewNode(common()->LoopExitValue(), value, control);
-
-  // Wire up the branch for the case when IsCallable fails for the callback.
-  // Since {check_throw} is an unconditional throw, it's impossible to
-  // return a successful completion. Therefore, we simply connect the
-  // successful completion to the graph end.
-  Node* throw_node =
-      graph()->NewNode(common()->Throw(), check_throw, check_fail);
-  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
+  // Connect the throwing path to end.
+  if_false = graph()->NewNode(common()->Throw(), efalse, if_false);
+  NodeProperties::MergeControlToEnd(graph(), common(), if_false);
 
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
+  // Continue on the regular path.
+  ReplaceWithValue(node, vtrue, etrue, if_true);
+  return Changed(vtrue);
 }
 
 namespace {
+bool CanInlineArrayIteratingBuiltin(JSHeapBroker* broker,
+                                    MapHandles const& receiver_maps,
+                                    ElementsKind* kind_return) {
+  DCHECK_NE(0, receiver_maps.size());
+  *kind_return = MapRef(broker, receiver_maps[0]).elements_kind();
+  for (auto receiver_map : receiver_maps) {
+    MapRef map(broker, receiver_map);
+    if (!map.supports_fast_array_iteration() ||
+        !UnionElementsKindUptoSize(kind_return, map.elements_kind())) {
+      return false;
+    }
+  }
+  return true;
+}
 
-// Returns the correct Callable for Array's indexOf based on the receiver's
-// |elements_kind| and |isolate|. Assumes that |elements_kind| is a fast one.
-Callable GetCallableForArrayIndexOf(ElementsKind elements_kind,
-                                    Isolate* isolate) {
-  switch (elements_kind) {
-    case PACKED_SMI_ELEMENTS:
-    case HOLEY_SMI_ELEMENTS:
-    case PACKED_ELEMENTS:
-    case HOLEY_ELEMENTS:
-      return Builtins::CallableFor(isolate, Builtins::kArrayIndexOfSmiOrObject);
-    case PACKED_DOUBLE_ELEMENTS:
-      return Builtins::CallableFor(isolate,
-                                   Builtins::kArrayIndexOfPackedDoubles);
-    default:
-      DCHECK_EQ(HOLEY_DOUBLE_ELEMENTS, elements_kind);
-      return Builtins::CallableFor(isolate,
-                                   Builtins::kArrayIndexOfHoleyDoubles);
-  }
-}
-
-// Returns the correct Callable for Array's includes based on the receiver's
-// |elements_kind| and |isolate|. Assumes that |elements_kind| is a fast one.
-Callable GetCallableForArrayIncludes(ElementsKind elements_kind,
-                                     Isolate* isolate) {
-  switch (elements_kind) {
-    case PACKED_SMI_ELEMENTS:
-    case HOLEY_SMI_ELEMENTS:
-    case PACKED_ELEMENTS:
-    case HOLEY_ELEMENTS:
-      return Builtins::CallableFor(isolate,
-                                   Builtins::kArrayIncludesSmiOrObject);
-    case PACKED_DOUBLE_ELEMENTS:
-      return Builtins::CallableFor(isolate,
-                                   Builtins::kArrayIncludesPackedDoubles);
-    default:
-      DCHECK_EQ(HOLEY_DOUBLE_ELEMENTS, elements_kind);
-      return Builtins::CallableFor(isolate,
-                                   Builtins::kArrayIncludesHoleyDoubles);
+bool CanInlineArrayResizingBuiltin(JSHeapBroker* broker,
+                                   MapHandles const& receiver_maps,
+                                   std::vector<ElementsKind>* kinds,
+                                   bool builtin_is_push = false) {
+  DCHECK_NE(0, receiver_maps.size());
+  for (auto receiver_map : receiver_maps) {
+    MapRef map(broker, receiver_map);
+    if (!map.supports_fast_array_resize()) return false;
+    // TODO(turbofan): We should also handle fast holey double elements once
+    // we got the hole NaN mess sorted out in TurboFan/V8.
+    if (map.elements_kind() == HOLEY_DOUBLE_ELEMENTS && !builtin_is_push) {
+      return false;
+    }
+    ElementsKind current_kind = map.elements_kind();
+    auto kind_ptr = kinds->data();
+    size_t i;
+    for (i = 0; i < kinds->size(); i++, kind_ptr++) {
+      if (UnionElementsKindUptoPackedness(kind_ptr, current_kind)) {
+        break;
+      }
+    }
+    if (i == kinds->size()) kinds->push_back(current_kind);
   }
+  return true;
 }
 
-}  // namespace
+// Wraps common setup code for iterating array builtins.
+class IteratingArrayBuiltinHelper {
+ public:
+  IteratingArrayBuiltinHelper(Node* node, JSHeapBroker* broker,
+                              JSGraph* jsgraph,
+                              CompilationDependencies* dependencies)
+      : receiver_(NodeProperties::GetValueInput(node, 1)),
+        effect_(NodeProperties::GetEffectInput(node)),
+        control_(NodeProperties::GetControlInput(node)),
+        inference_(broker, receiver_, effect_) {
+    if (!FLAG_turbo_inline_array_builtins) return;
+
+    DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+    const CallParameters& p = CallParametersOf(node->op());
+    if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+      return;
+    }
 
-// For search_variant == kIndexOf:
-// ES6 Array.prototype.indexOf(searchElement[, fromIndex])
-// #sec-array.prototype.indexof
-// For search_variant == kIncludes:
-// ES7 Array.prototype.inludes(searchElement[, fromIndex])
-// #sec-array.prototype.includes
-Reduction JSCallReducer::ReduceArrayIndexOfIncludes(
-    SearchVariant search_variant, Node* node) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+    // Try to determine the {receiver} map.
+    if (!inference_.HaveMaps()) return;
+    MapHandles const& receiver_maps = inference_.GetMaps();
 
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
+    if (!CanInlineArrayIteratingBuiltin(broker, receiver_maps,
+                                        &elements_kind_)) {
+      return;
+    }
+
+    // TODO(jgruber): May only be needed for holey elements kinds.
+    if (!dependencies->DependOnNoElementsProtector()) UNREACHABLE();
+    has_stability_dependency_ = inference_.RelyOnMapsPreferStability(
+        dependencies, jsgraph, &effect_, control_, p.feedback());
+
+    can_reduce_ = true;
   }
 
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
+  bool can_reduce() const { return can_reduce_; }
+  bool has_stability_dependency() const { return has_stability_dependency_; }
+  Node* effect() const { return effect_; }
+  Node* control() const { return control_; }
+  MapInference* inference() { return &inference_; }
+  ElementsKind elements_kind() const { return elements_kind_; }
 
-  MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return NoChange();
-  MapHandles const& receiver_maps = inference.GetMaps();
+ private:
+  bool can_reduce_ = false;
+  bool has_stability_dependency_ = false;
+  Node* receiver_;
+  Node* effect_;
+  Node* control_;
+  MapInference inference_;
+  ElementsKind elements_kind_;
+};
 
-  ElementsKind kind;
-  if (!CanInlineArrayIteratingBuiltin(broker(), receiver_maps, &kind)) {
-    return inference.NoChange();
-  }
-  if (IsHoleyElementsKind(kind)) {
-    if (!dependencies()->DependOnNoElementsProtector()) UNREACHABLE();
-  }
-  inference.RelyOnMapsPreferStability(dependencies(), jsgraph(), &effect,
-                                      control, p.feedback());
+}  // namespace
 
-  Callable const callable = search_variant == SearchVariant::kIndexOf
-                                ? GetCallableForArrayIndexOf(kind, isolate())
-                                : GetCallableForArrayIncludes(kind, isolate());
-  CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
-      graph()->zone(), callable.descriptor(),
-      callable.descriptor().GetStackParameterCount(), CallDescriptor::kNoFlags,
-      Operator::kEliminatable);
-  // The stub expects the following arguments: the receiver array, its
-  // elements, the search_element, the array length, and the index to start
-  // searching from.
-  Node* elements = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSObjectElements()), receiver,
-      effect, control);
-  Node* search_element = (node->op()->ValueInputCount() >= 3)
-                             ? NodeProperties::GetValueInput(node, 2)
-                             : jsgraph()->UndefinedConstant();
-  Node* length = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSArrayLength(kind)), receiver,
-      effect, control);
-  Node* new_from_index = jsgraph()->ZeroConstant();
-  if (node->op()->ValueInputCount() >= 4) {
-    Node* from_index = NodeProperties::GetValueInput(node, 3);
-    from_index = effect = graph()->NewNode(simplified()->CheckSmi(p.feedback()),
-                                           from_index, effect, control);
-    // If the index is negative, it means the offset from the end and
-    // therefore needs to be added to the length. If the result is still
-    // negative, it needs to be clamped to 0.
-    new_from_index = graph()->NewNode(
-        common()->Select(MachineRepresentation::kTagged, BranchHint::kFalse),
-        graph()->NewNode(simplified()->NumberLessThan(), from_index,
-                         jsgraph()->ZeroConstant()),
-        graph()->NewNode(
-            simplified()->NumberMax(),
-            graph()->NewNode(simplified()->NumberAdd(), length, from_index),
-            jsgraph()->ZeroConstant()),
-        from_index);
-  }
+Reduction JSCallReducer::ReduceArrayForEach(
+    Node* node, const SharedFunctionInfoRef& shared) {
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
+  IteratingArrayBuiltinHelper h(node, broker(), jsgraph(), dependencies());
+  if (!h.can_reduce()) return h.inference()->NoChange();
+
+  IteratingArrayBuiltinReducerAssembler a(jsgraph(), temp_zone(), node);
+  a.InitializeEffectControl(h.effect(), h.control());
+  TNode<Object> subgraph = a.ReduceArrayPrototypeForEach(
+      h.inference(), h.has_stability_dependency(), h.elements_kind(), shared);
+  return ReplaceWithSubgraph(&a, subgraph);
+}
 
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* replacement_node = effect = graph()->NewNode(
-      common()->Call(desc), jsgraph()->HeapConstant(callable.code()), elements,
-      search_element, length, new_from_index, context, effect);
-  ReplaceWithValue(node, replacement_node, effect);
-  return Replace(replacement_node);
+Reduction JSCallReducer::ReduceArrayReduce(
+    Node* node, const SharedFunctionInfoRef& shared) {
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
+  IteratingArrayBuiltinHelper h(node, broker(), jsgraph(), dependencies());
+  if (!h.can_reduce()) return h.inference()->NoChange();
+
+  IteratingArrayBuiltinReducerAssembler a(jsgraph(), temp_zone(), node);
+  a.InitializeEffectControl(h.effect(), h.control());
+  TNode<Object> subgraph = a.ReduceArrayPrototypeReduce(
+      h.inference(), h.has_stability_dependency(), h.elements_kind(),
+      ArrayReduceDirection::kLeft, shared);
+  return ReplaceWithSubgraph(&a, subgraph);
 }
 
-Reduction JSCallReducer::ReduceArraySome(Node* node,
-                                         const SharedFunctionInfoRef& shared) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+Reduction JSCallReducer::ReduceArrayReduceRight(
+    Node* node, const SharedFunctionInfoRef& shared) {
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
+  IteratingArrayBuiltinHelper h(node, broker(), jsgraph(), dependencies());
+  if (!h.can_reduce()) return h.inference()->NoChange();
+
+  IteratingArrayBuiltinReducerAssembler a(jsgraph(), temp_zone(), node);
+  a.InitializeEffectControl(h.effect(), h.control());
+  TNode<Object> subgraph = a.ReduceArrayPrototypeReduce(
+      h.inference(), h.has_stability_dependency(), h.elements_kind(),
+      ArrayReduceDirection::kRight, shared);
+  return ReplaceWithSubgraph(&a, subgraph);
+}
 
-  if (!FLAG_turbo_inline_array_builtins) return NoChange();
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
+Reduction JSCallReducer::ReduceArrayMap(Node* node,
+                                        const SharedFunctionInfoRef& shared) {
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
+  IteratingArrayBuiltinHelper h(node, broker(), jsgraph(), dependencies());
+  if (!h.can_reduce()) return h.inference()->NoChange();
+
+  // Calls CreateArray and thus requires this additional protector dependency.
+  if (!dependencies()->DependOnArraySpeciesProtector()) {
+    return h.inference()->NoChange();
   }
 
-  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* fncallback = node->op()->ValueInputCount() > 2
-                         ? NodeProperties::GetValueInput(node, 2)
-                         : jsgraph()->UndefinedConstant();
-  Node* this_arg = node->op()->ValueInputCount() > 3
-                       ? NodeProperties::GetValueInput(node, 3)
-                       : jsgraph()->UndefinedConstant();
+  IteratingArrayBuiltinReducerAssembler a(jsgraph(), temp_zone(), node);
+  a.InitializeEffectControl(h.effect(), h.control());
 
-  // Try to determine the {receiver} map.
-  MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return NoChange();
-  MapHandles const& receiver_maps = inference.GetMaps();
+  TNode<Object> subgraph =
+      a.ReduceArrayPrototypeMap(h.inference(), h.has_stability_dependency(),
+                                h.elements_kind(), shared, native_context());
+  return ReplaceWithSubgraph(&a, subgraph);
+}
 
-  ElementsKind kind;
-  if (!CanInlineArrayIteratingBuiltin(broker(), receiver_maps, &kind)) {
-    return inference.NoChange();
-  }
-  if (!dependencies()->DependOnArraySpeciesProtector())
-    return inference.NoChange();
-  if (IsHoleyElementsKind(kind)) {
-    if (!dependencies()->DependOnNoElementsProtector()) UNREACHABLE();
+Reduction JSCallReducer::ReduceArrayFilter(
+    Node* node, const SharedFunctionInfoRef& shared) {
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
+  IteratingArrayBuiltinHelper h(node, broker(), jsgraph(), dependencies());
+  if (!h.can_reduce()) return h.inference()->NoChange();
+
+  // Calls CreateArray and thus requires this additional protector dependency.
+  if (!dependencies()->DependOnArraySpeciesProtector()) {
+    return h.inference()->NoChange();
   }
-  bool const stability_dependency = inference.RelyOnMapsPreferStability(
-      dependencies(), jsgraph(), &effect, control, p.feedback());
 
-  Node* k = jsgraph()->ZeroConstant();
-  Node* original_length = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSArrayLength(kind)), receiver,
-      effect, control);
+  IteratingArrayBuiltinReducerAssembler a(jsgraph(), temp_zone(), node);
+  a.InitializeEffectControl(h.effect(), h.control());
 
-  // Check whether the given callback function is callable. Note that this has
-  // to happen outside the loop to make sure we also throw on empty arrays.
-  Node* check_fail = nullptr;
-  Node* check_throw = nullptr;
-  {
-    // This frame state doesn't ever call the deopt continuation, it's only
-    // necessary to specifiy a continuation in order to handle the exceptional
-    // case.
-    Node* checkpoint_params[] = {receiver, fncallback, this_arg, k,
-                                 original_length};
-    const int stack_parameters = arraysize(checkpoint_params);
-
-    Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, Builtins::kArraySomeLoopLazyDeoptContinuation,
-        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-        outer_frame_state, ContinuationFrameStateMode::LAZY);
-    WireInCallbackIsCallableCheck(fncallback, context, check_frame_state,
-                                  effect, &control, &check_fail, &check_throw);
-  }
-
-  // Start the loop.
-  Node* loop = control = graph()->NewNode(common()->Loop(2), control, control);
-  Node* eloop = effect =
-      graph()->NewNode(common()->EffectPhi(2), effect, effect, loop);
-  Node* terminate = graph()->NewNode(common()->Terminate(), eloop, loop);
-  NodeProperties::MergeControlToEnd(graph(), common(), terminate);
-  Node* vloop = k = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTagged, 2), k, k, loop);
-
-  Node* continue_test =
-      graph()->NewNode(simplified()->NumberLessThan(), k, original_length);
-  Node* continue_branch = graph()->NewNode(common()->Branch(BranchHint::kNone),
-                                           continue_test, control);
-
-  Node* if_true = graph()->NewNode(common()->IfTrue(), continue_branch);
-  Node* if_false = graph()->NewNode(common()->IfFalse(), continue_branch);
-  control = if_true;
+  TNode<Object> subgraph =
+      a.ReduceArrayPrototypeFilter(h.inference(), h.has_stability_dependency(),
+                                   h.elements_kind(), shared, native_context());
+  return ReplaceWithSubgraph(&a, subgraph);
+}
 
-  {
-    Node* checkpoint_params[] = {receiver, fncallback, this_arg, k,
-                                 original_length};
-    const int stack_parameters = arraysize(checkpoint_params);
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, Builtins::kArraySomeLoopEagerDeoptContinuation,
-        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-        outer_frame_state, ContinuationFrameStateMode::EAGER);
-    effect =
-        graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
-  }
+Reduction JSCallReducer::ReduceArrayFind(Node* node,
+                                         const SharedFunctionInfoRef& shared) {
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
+  IteratingArrayBuiltinHelper h(node, broker(), jsgraph(), dependencies());
+  if (!h.can_reduce()) return h.inference()->NoChange();
 
-  // Deopt if the map has changed during the iteration.
-  if (!stability_dependency) {
-    inference.InsertMapChecks(jsgraph(), &effect, control, p.feedback());
-  }
+  IteratingArrayBuiltinReducerAssembler a(jsgraph(), temp_zone(), node);
+  a.InitializeEffectControl(h.effect(), h.control());
+
+  TNode<Object> subgraph = a.ReduceArrayPrototypeFind(
+      h.inference(), h.has_stability_dependency(), h.elements_kind(), shared,
+      native_context(), ArrayFindVariant::kFind);
+  return ReplaceWithSubgraph(&a, subgraph);
+}
 
-  Node* element =
-      SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
-  Node* next_k =
-      graph()->NewNode(simplified()->NumberAdd(), k, jsgraph()->OneConstant());
+Reduction JSCallReducer::ReduceArrayFindIndex(
+    Node* node, const SharedFunctionInfoRef& shared) {
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
+  IteratingArrayBuiltinHelper h(node, broker(), jsgraph(), dependencies());
+  if (!h.can_reduce()) return h.inference()->NoChange();
 
-  Node* hole_true = nullptr;
-  Node* hole_false = nullptr;
-  Node* effect_true = effect;
+  IteratingArrayBuiltinReducerAssembler a(jsgraph(), temp_zone(), node);
+  a.InitializeEffectControl(h.effect(), h.control());
 
-  if (IsHoleyElementsKind(kind)) {
-    // Holey elements kind require a hole check and skipping of the element in
-    // the case of a hole.
-    Node* check;
-    if (IsDoubleElementsKind(kind)) {
-      check = graph()->NewNode(simplified()->NumberIsFloat64Hole(), element);
-    } else {
-      check = graph()->NewNode(simplified()->ReferenceEqual(), element,
-                               jsgraph()->TheHoleConstant());
-    }
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-    hole_true = graph()->NewNode(common()->IfTrue(), branch);
-    hole_false = graph()->NewNode(common()->IfFalse(), branch);
-    control = hole_false;
+  TNode<Object> subgraph = a.ReduceArrayPrototypeFind(
+      h.inference(), h.has_stability_dependency(), h.elements_kind(), shared,
+      native_context(), ArrayFindVariant::kFindIndex);
+  return ReplaceWithSubgraph(&a, subgraph);
+}
 
-    // The contract is that we don't leak "the hole" into "user JavaScript",
-    // so we must rename the {element} here to explicitly exclude "the hole"
-    // from the type of {element}.
-    element = effect = graph()->NewNode(
-        common()->TypeGuard(Type::NonInternal()), element, effect, control);
-  }
+Reduction JSCallReducer::ReduceArrayEvery(Node* node,
+                                          const SharedFunctionInfoRef& shared) {
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
+  IteratingArrayBuiltinHelper h(node, broker(), jsgraph(), dependencies());
+  if (!h.can_reduce()) return h.inference()->NoChange();
 
-  Node* callback_value = nullptr;
-  {
-    // This frame state is dealt with by hand in
-    // Builtins::kArrayEveryLoopLazyDeoptContinuation.
-    Node* checkpoint_params[] = {receiver, fncallback, this_arg, k,
-                                 original_length};
-    const int stack_parameters = arraysize(checkpoint_params);
+  IteratingArrayBuiltinReducerAssembler a(jsgraph(), temp_zone(), node);
+  a.InitializeEffectControl(h.effect(), h.control());
 
-    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), shared, Builtins::kArraySomeLoopLazyDeoptContinuation,
-        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-        outer_frame_state, ContinuationFrameStateMode::LAZY);
+  TNode<Object> subgraph = a.ReduceArrayPrototypeEverySome(
+      h.inference(), h.has_stability_dependency(), h.elements_kind(), shared,
+      native_context(), ArrayEverySomeVariant::kEvery);
+  return ReplaceWithSubgraph(&a, subgraph);
+}
 
-    callback_value = control = effect = graph()->NewNode(
-        javascript()->Call(5, p.frequency()), fncallback, this_arg, element, k,
-        receiver, context, frame_state, effect, control);
-  }
+// ES7 Array.prototype.inludes(searchElement[, fromIndex])
+// #sec-array.prototype.includes
+Reduction JSCallReducer::ReduceArrayIncludes(Node* node) {
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
+  IteratingArrayBuiltinHelper h(node, broker(), jsgraph(), dependencies());
+  if (!h.can_reduce()) return h.inference()->NoChange();
 
-  // Rewire potential exception edges.
-  Node* on_exception = nullptr;
-  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
-    RewirePostCallbackExceptionEdges(check_throw, on_exception, effect,
-                                     &check_fail, &control);
-  }
+  IteratingArrayBuiltinReducerAssembler a(jsgraph(), temp_zone(), node);
+  a.InitializeEffectControl(h.effect(), h.control());
 
-  // We have to coerce callback_value to boolean.
-  Node* if_true_callback;
-  Node* etrue_callback;
-  {
-    Node* boolean_result =
-        graph()->NewNode(simplified()->ToBoolean(), callback_value);
-    Node* boolean_branch = graph()->NewNode(
-        common()->Branch(BranchHint::kFalse), boolean_result, control);
-    if_true_callback = graph()->NewNode(common()->IfTrue(), boolean_branch);
-    etrue_callback = effect;
+  TNode<Object> subgraph = a.ReduceArrayPrototypeIndexOfIncludes(
+      h.elements_kind(), ArrayIndexOfIncludesVariant::kIncludes);
+  return ReplaceWithSubgraph(&a, subgraph);
+}
 
-    // Nothing to do in the false case.
-    control = graph()->NewNode(common()->IfFalse(), boolean_branch);
-  }
+// ES6 Array.prototype.indexOf(searchElement[, fromIndex])
+// #sec-array.prototype.indexof
+Reduction JSCallReducer::ReduceArrayIndexOf(Node* node) {
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
+  IteratingArrayBuiltinHelper h(node, broker(), jsgraph(), dependencies());
+  if (!h.can_reduce()) return h.inference()->NoChange();
 
-  if (IsHoleyElementsKind(kind)) {
-    Node* after_call_control = control;
-    Node* after_call_effect = effect;
-    control = hole_true;
-    effect = effect_true;
+  IteratingArrayBuiltinReducerAssembler a(jsgraph(), temp_zone(), node);
+  a.InitializeEffectControl(h.effect(), h.control());
 
-    control = graph()->NewNode(common()->Merge(2), control, after_call_control);
-    effect = graph()->NewNode(common()->EffectPhi(2), effect, after_call_effect,
-                              control);
-  }
+  TNode<Object> subgraph = a.ReduceArrayPrototypeIndexOfIncludes(
+      h.elements_kind(), ArrayIndexOfIncludesVariant::kIndexOf);
+  return ReplaceWithSubgraph(&a, subgraph);
+}
 
-  loop->ReplaceInput(1, control);
-  vloop->ReplaceInput(1, next_k);
-  eloop->ReplaceInput(1, effect);
+Reduction JSCallReducer::ReduceArraySome(Node* node,
+                                         const SharedFunctionInfoRef& shared) {
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
+  IteratingArrayBuiltinHelper h(node, broker(), jsgraph(), dependencies());
+  if (!h.can_reduce()) return h.inference()->NoChange();
 
-  control = graph()->NewNode(common()->Merge(2), if_false, if_true_callback);
-  effect =
-      graph()->NewNode(common()->EffectPhi(2), eloop, etrue_callback, control);
-  Node* value = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTagged, 2),
-      jsgraph()->FalseConstant(), jsgraph()->TrueConstant(), control);
-
-  // Introduce proper LoopExit/LoopExitEffect/LoopExitValue to mark
-  // {loop} as a candidate for loop peeling (crbug.com/v8/8273).
-  control = graph()->NewNode(common()->LoopExit(), control, loop);
-  effect = graph()->NewNode(common()->LoopExitEffect(), effect, control);
-  value = graph()->NewNode(common()->LoopExitValue(), value, control);
-
-  // Wire up the branch for the case when IsCallable fails for the callback.
-  // Since {check_throw} is an unconditional throw, it's impossible to
-  // return a successful completion. Therefore, we simply connect the
-  // successful completion to the graph end.
-  Node* throw_node =
-      graph()->NewNode(common()->Throw(), check_throw, check_fail);
-  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
+  IteratingArrayBuiltinReducerAssembler a(jsgraph(), temp_zone(), node);
+  a.InitializeEffectControl(h.effect(), h.control());
 
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
+  TNode<Object> subgraph = a.ReduceArrayPrototypeEverySome(
+      h.inference(), h.has_stability_dependency(), h.elements_kind(), shared,
+      native_context(), ArrayEverySomeVariant::kSome);
+  return ReplaceWithSubgraph(&a, subgraph);
 }
 
 Reduction JSCallReducer::ReduceCallApiFunction(
     Node* node, const SharedFunctionInfoRef& shared) {
-  DisallowHeapAccessIf no_heap_acess(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_acess(should_disallow_heap_access());
 
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
@@ -3003,11 +3518,14 @@ bool IsSafeArgumentsElements(Node* node) {
 
 Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
     Node* node, int arity, CallFrequency const& frequency,
-    FeedbackSource const& feedback) {
+    FeedbackSource const& feedback, SpeculationMode speculation_mode,
+    CallFeedbackRelation feedback_relation) {
   DCHECK(node->opcode() == IrOpcode::kJSCallWithArrayLike ||
          node->opcode() == IrOpcode::kJSCallWithSpread ||
          node->opcode() == IrOpcode::kJSConstructWithArrayLike ||
          node->opcode() == IrOpcode::kJSConstructWithSpread);
+  DCHECK_IMPLIES(speculation_mode == SpeculationMode::kAllowSpeculation,
+                 feedback.IsValid());
 
   Node* arguments_list = NodeProperties::GetValueInput(node, arity);
   if (arguments_list->opcode() != IrOpcode::kJSCreateArguments) {
@@ -3034,7 +3552,10 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
           // Ignore uses for arguments#length.
           STATIC_ASSERT(
               static_cast<int>(JSArray::kLengthOffset) ==
-              static_cast<int>(JSArgumentsObjectWithLength::kLengthOffset));
+              static_cast<int>(JSStrictArgumentsObject::kLengthOffset));
+          STATIC_ASSERT(
+              static_cast<int>(JSArray::kLengthOffset) ==
+              static_cast<int>(JSSloppyArgumentsObject::kLengthOffset));
           continue;
         } else if (access.offset == JSObject::kElementsOffset) {
           // Ignore safe uses for arguments#elements.
@@ -3145,7 +3666,9 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
   if (node->opcode() == IrOpcode::kJSCallWithArrayLike ||
       node->opcode() == IrOpcode::kJSCallWithSpread) {
     NodeProperties::ChangeOp(
-        node, javascript()->Call(arity + 1, frequency, feedback));
+        node, javascript()->Call(arity + 1, frequency, feedback,
+                                 ConvertReceiverMode::kAny, speculation_mode,
+                                 CallFeedbackRelation::kUnrelated));
     Reduction const reduction = ReduceJSCall(node);
     return reduction.Changed() ? reduction : Changed(node);
   } else {
@@ -3247,7 +3770,7 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
     ObjectRef target_ref = m.Ref(broker());
     if (target_ref.IsJSFunction()) {
       JSFunctionRef function = target_ref.AsJSFunction();
-      if (FLAG_concurrent_inlining && !function.serialized()) {
+      if (should_disallow_heap_access() && !function.serialized()) {
         TRACE_BROKER_MISSING(broker(), "data for function " << function);
         return NoChange();
       }
@@ -3260,7 +3783,7 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
       return ReduceJSCall(node, function.shared());
     } else if (target_ref.IsJSBoundFunction()) {
       JSBoundFunctionRef function = target_ref.AsJSBoundFunction();
-      if (FLAG_concurrent_inlining && !function.serialized()) {
+      if (should_disallow_heap_access() && !function.serialized()) {
         TRACE_BROKER_MISSING(broker(), "data for function " << function);
         return NoChange();
       }
@@ -3286,8 +3809,9 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
       }
 
       NodeProperties::ChangeOp(
-          node, javascript()->Call(arity, p.frequency(), FeedbackSource(),
-                                   convert_mode));
+          node, javascript()->Call(arity, p.frequency(), p.feedback(),
+                                   convert_mode, p.speculation_mode(),
+                                   CallFeedbackRelation::kUnrelated));
 
       // Try to further reduce the JSCall {node}.
       Reduction const reduction = ReduceJSCall(node);
@@ -3334,25 +3858,30 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
             ? ConvertReceiverMode::kAny
             : ConvertReceiverMode::kNotNullOrUndefined;
     NodeProperties::ChangeOp(
-        node, javascript()->Call(arity, p.frequency(), FeedbackSource(),
-                                 convert_mode));
+        node, javascript()->Call(arity, p.frequency(), p.feedback(),
+                                 convert_mode, p.speculation_mode(),
+                                 CallFeedbackRelation::kUnrelated));
 
     // Try to further reduce the JSCall {node}.
     Reduction const reduction = ReduceJSCall(node);
     return reduction.Changed() ? reduction : Changed(node);
   }
 
-  if (!p.feedback().IsValid()) return NoChange();
+  if (!ShouldUseCallICFeedback(target) ||
+      p.feedback_relation() != CallFeedbackRelation::kRelated ||
+      !p.feedback().IsValid()) {
+    return NoChange();
+  }
+
   ProcessedFeedback const& feedback =
-      broker()->GetFeedbackForCall(FeedbackSource(p.feedback()));
+      broker()->GetFeedbackForCall(p.feedback());
   if (feedback.IsInsufficient()) {
     return ReduceSoftDeoptimize(
         node, DeoptimizeReason::kInsufficientTypeFeedbackForCall);
   }
 
   base::Optional<HeapObjectRef> feedback_target = feedback.AsCall().target();
-  if (feedback_target.has_value() && ShouldUseCallICFeedback(target) &&
-      feedback_target->map().is_callable()) {
+  if (feedback_target.has_value() && feedback_target->map().is_callable()) {
     Node* target_function = jsgraph()->Constant(*feedback_target);
 
     // Check that the {target} is still the {target_function}.
@@ -3439,19 +3968,19 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
     case Builtins::kArrayFilter:
       return ReduceArrayFilter(node, shared);
     case Builtins::kArrayReduce:
-      return ReduceArrayReduce(node, ArrayReduceDirection::kLeft, shared);
+      return ReduceArrayReduce(node, shared);
     case Builtins::kArrayReduceRight:
-      return ReduceArrayReduce(node, ArrayReduceDirection::kRight, shared);
+      return ReduceArrayReduceRight(node, shared);
     case Builtins::kArrayPrototypeFind:
-      return ReduceArrayFind(node, ArrayFindVariant::kFind, shared);
+      return ReduceArrayFind(node, shared);
     case Builtins::kArrayPrototypeFindIndex:
-      return ReduceArrayFind(node, ArrayFindVariant::kFindIndex, shared);
+      return ReduceArrayFindIndex(node, shared);
     case Builtins::kArrayEvery:
       return ReduceArrayEvery(node, shared);
     case Builtins::kArrayIndexOf:
-      return ReduceArrayIndexOfIncludes(SearchVariant::kIndexOf, node);
+      return ReduceArrayIndexOf(node);
     case Builtins::kArrayIncludes:
-      return ReduceArrayIndexOfIncludes(SearchVariant::kIncludes, node);
+      return ReduceArrayIncludes(node);
     case Builtins::kArraySome:
       return ReduceArraySome(node, shared);
     case Builtins::kArrayPrototypePush:
@@ -3673,12 +4202,6 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
       return ReduceArrayIterator(node, IterationKind::kKeys);
     case Builtins::kTypedArrayPrototypeValues:
       return ReduceArrayIterator(node, IterationKind::kValues);
-    case Builtins::kPromiseInternalConstructor:
-      return ReducePromiseInternalConstructor(node);
-    case Builtins::kPromiseInternalReject:
-      return ReducePromiseInternalReject(node);
-    case Builtins::kPromiseInternalResolve:
-      return ReducePromiseInternalResolve(node);
     case Builtins::kPromisePrototypeCatch:
       return ReducePromisePrototypeCatch(node);
     case Builtins::kPromisePrototypeFinally:
@@ -3734,9 +4257,12 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
 
 Reduction JSCallReducer::ReduceJSCallWithArrayLike(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCallWithArrayLike, node->opcode());
-  CallFrequency frequency = CallFrequencyOf(node->op());
-  return ReduceCallOrConstructWithArrayLikeOrSpread(node, 2, frequency,
-                                                    FeedbackSource());
+  const CallParameters& p = CallParametersOf(node->op());
+  int arity = static_cast<int>(p.arity());
+  DCHECK_EQ(arity, 2);
+  return ReduceCallOrConstructWithArrayLikeOrSpread(
+      node, arity, p.frequency(), p.feedback(), p.speculation_mode(),
+      p.feedback_relation());
 }
 
 Reduction JSCallReducer::ReduceJSCallWithSpread(Node* node) {
@@ -3746,8 +4272,9 @@ Reduction JSCallReducer::ReduceJSCallWithSpread(Node* node) {
   int arity = static_cast<int>(p.arity() - 1);
   CallFrequency frequency = p.frequency();
   FeedbackSource feedback = p.feedback();
-  return ReduceCallOrConstructWithArrayLikeOrSpread(node, arity, frequency,
-                                                    feedback);
+  return ReduceCallOrConstructWithArrayLikeOrSpread(
+      node, arity, frequency, feedback, p.speculation_mode(),
+      p.feedback_relation());
 }
 
 Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
@@ -3837,7 +4364,7 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
 
     if (target_ref.IsJSFunction()) {
       JSFunctionRef function = target_ref.AsJSFunction();
-      if (FLAG_concurrent_inlining && !function.serialized()) {
+      if (should_disallow_heap_access() && !function.serialized()) {
         TRACE_BROKER_MISSING(broker(),
                              "function, not serialized: " << function);
         return NoChange();
@@ -3876,9 +4403,9 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
             return Changed(node);
           }
 
-          // Otherwise we can only lower to JSCreate if we know that
-          // the value parameter is ignored, which is only the case if
-          // the {new_target} and {target} are definitely not identical.
+          // If {target} is not the same as {new_target} (i.e. the Object
+          // constructor), {value} will be ignored and therefore we can lower
+          // to {JSCreate}. See https://tc39.es/ecma262/#sec-object-value.
           HeapObjectMatcher mnew_target(new_target);
           if (mnew_target.HasValue() &&
               !mnew_target.Ref(broker()).equals(function)) {
@@ -3898,7 +4425,7 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
       }
     } else if (target_ref.IsJSBoundFunction()) {
       JSBoundFunctionRef function = target_ref.AsJSBoundFunction();
-      if (FLAG_concurrent_inlining && !function.serialized()) {
+      if (should_disallow_heap_access() && !function.serialized()) {
         TRACE_BROKER_MISSING(broker(),
                              "function, not serialized: " << function);
         return NoChange();
@@ -4030,59 +4557,9 @@ Reduction JSCallReducer::ReduceStringPrototypeSubstring(Node* node) {
     return NoChange();
   }
 
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* start = NodeProperties::GetValueInput(node, 2);
-  Node* end = node->op()->ValueInputCount() > 3
-                  ? NodeProperties::GetValueInput(node, 3)
-                  : jsgraph()->UndefinedConstant();
-
-  receiver = effect = graph()->NewNode(simplified()->CheckString(p.feedback()),
-                                       receiver, effect, control);
-
-  start = effect = graph()->NewNode(simplified()->CheckSmi(p.feedback()), start,
-                                    effect, control);
-
-  Node* length = graph()->NewNode(simplified()->StringLength(), receiver);
-
-  Node* check = graph()->NewNode(simplified()->ReferenceEqual(), end,
-                                 jsgraph()->UndefinedConstant());
-  Node* branch =
-      graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-
-  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-  Node* etrue = effect;
-  Node* vtrue = length;
-
-  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-  Node* efalse = effect;
-  Node* vfalse = efalse = graph()->NewNode(simplified()->CheckSmi(p.feedback()),
-                                           end, efalse, if_false);
-
-  control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-  effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
-  end = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                         vtrue, vfalse, control);
-  Node* finalStart =
-      graph()->NewNode(simplified()->NumberMin(),
-                       graph()->NewNode(simplified()->NumberMax(), start,
-                                        jsgraph()->ZeroConstant()),
-                       length);
-  Node* finalEnd =
-      graph()->NewNode(simplified()->NumberMin(),
-                       graph()->NewNode(simplified()->NumberMax(), end,
-                                        jsgraph()->ZeroConstant()),
-                       length);
-
-  Node* from =
-      graph()->NewNode(simplified()->NumberMin(), finalStart, finalEnd);
-  Node* to = graph()->NewNode(simplified()->NumberMax(), finalStart, finalEnd);
-
-  Node* value = effect = graph()->NewNode(simplified()->StringSubstring(),
-                                          receiver, from, to, effect, control);
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
+  JSCallReducerAssembler a(jsgraph(), temp_zone(), node);
+  Node* subgraph = a.ReduceStringPrototypeSubstring();
+  return ReplaceWithSubgraph(&a, subgraph);
 }
 
 // ES #sec-string.prototype.slice
@@ -4093,98 +4570,9 @@ Reduction JSCallReducer::ReduceStringPrototypeSlice(Node* node) {
     return NoChange();
   }
 
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* start = NodeProperties::GetValueInput(node, 2);
-  Node* end = node->op()->ValueInputCount() > 3
-                  ? NodeProperties::GetValueInput(node, 3)
-                  : jsgraph()->UndefinedConstant();
-
-  receiver = effect = graph()->NewNode(simplified()->CheckString(p.feedback()),
-                                       receiver, effect, control);
-
-  start = effect = graph()->NewNode(simplified()->CheckSmi(p.feedback()), start,
-                                    effect, control);
-
-  Node* length = graph()->NewNode(simplified()->StringLength(), receiver);
-
-  // Replace {end} argument with {length} if it is undefined.
-  {
-    Node* check = graph()->NewNode(simplified()->ReferenceEqual(), end,
-                                   jsgraph()->UndefinedConstant());
-
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-
-    Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-    Node* etrue = effect;
-    Node* vtrue = length;
-
-    Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-    Node* efalse = effect;
-    Node* vfalse = efalse = graph()->NewNode(
-        simplified()->CheckSmi(p.feedback()), end, efalse, if_false);
-
-    control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-    effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
-    end = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                           vtrue, vfalse, control);
-  }
-
-  Node* from = graph()->NewNode(
-      common()->Select(MachineRepresentation::kTagged, BranchHint::kFalse),
-      graph()->NewNode(simplified()->NumberLessThan(), start,
-                       jsgraph()->ZeroConstant()),
-      graph()->NewNode(
-          simplified()->NumberMax(),
-          graph()->NewNode(simplified()->NumberAdd(), length, start),
-          jsgraph()->ZeroConstant()),
-      graph()->NewNode(simplified()->NumberMin(), start, length));
-  // {from} is always in non-negative Smi range, but our typer cannot
-  // figure that out yet.
-  from = effect = graph()->NewNode(common()->TypeGuard(Type::UnsignedSmall()),
-                                   from, effect, control);
-
-  Node* to = graph()->NewNode(
-      common()->Select(MachineRepresentation::kTagged, BranchHint::kFalse),
-      graph()->NewNode(simplified()->NumberLessThan(), end,
-                       jsgraph()->ZeroConstant()),
-      graph()->NewNode(simplified()->NumberMax(),
-                       graph()->NewNode(simplified()->NumberAdd(), length, end),
-                       jsgraph()->ZeroConstant()),
-      graph()->NewNode(simplified()->NumberMin(), end, length));
-  // {to} is always in non-negative Smi range, but our typer cannot
-  // figure that out yet.
-  to = effect = graph()->NewNode(common()->TypeGuard(Type::UnsignedSmall()), to,
-                                 effect, control);
-
-  Node* result_string = nullptr;
-  // Return empty string if {from} is smaller than {to}.
-  {
-    Node* check = graph()->NewNode(simplified()->NumberLessThan(), from, to);
-
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
-
-    Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-    Node* etrue = effect;
-    Node* vtrue = etrue = graph()->NewNode(simplified()->StringSubstring(),
-                                           receiver, from, to, etrue, if_true);
-
-    Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-    Node* efalse = effect;
-    Node* vfalse = jsgraph()->EmptyStringConstant();
-
-    control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-    effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
-    result_string =
-        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                         vtrue, vfalse, control);
-  }
-
-  ReplaceWithValue(node, result_string, effect, control);
-  return Replace(result_string);
+  JSCallReducerAssembler a(jsgraph(), temp_zone(), node);
+  Node* subgraph = a.ReduceStringPrototypeSlice();
+  return ReplaceWithSubgraph(&a, subgraph);
 }
 
 // ES #sec-string.prototype.substr
@@ -4293,8 +4681,9 @@ Reduction JSCallReducer::ReduceStringPrototypeSubstr(Node* node) {
 Reduction JSCallReducer::ReduceJSConstructWithArrayLike(Node* node) {
   DCHECK_EQ(IrOpcode::kJSConstructWithArrayLike, node->opcode());
   CallFrequency frequency = CallFrequencyOf(node->op());
-  return ReduceCallOrConstructWithArrayLikeOrSpread(node, 1, frequency,
-                                                    FeedbackSource());
+  return ReduceCallOrConstructWithArrayLikeOrSpread(
+      node, 1, frequency, FeedbackSource(),
+      SpeculationMode::kDisallowSpeculation, CallFeedbackRelation::kRelated);
 }
 
 Reduction JSCallReducer::ReduceJSConstructWithSpread(Node* node) {
@@ -4304,8 +4693,9 @@ Reduction JSCallReducer::ReduceJSConstructWithSpread(Node* node) {
   int arity = static_cast<int>(p.arity() - 2);
   CallFrequency frequency = p.frequency();
   FeedbackSource feedback = p.feedback();
-  return ReduceCallOrConstructWithArrayLikeOrSpread(node, arity, frequency,
-                                                    feedback);
+  return ReduceCallOrConstructWithArrayLikeOrSpread(
+      node, arity, frequency, feedback, SpeculationMode::kDisallowSpeculation,
+      CallFeedbackRelation::kRelated);
 }
 
 Reduction JSCallReducer::ReduceReturnReceiver(Node* node) {
@@ -4344,9 +4734,10 @@ Node* JSCallReducer::LoadReceiverElementsKind(Node* receiver, Node** effect,
       *effect, *control);
   Node* receiver_elements_kind = graph()->NewNode(
       simplified()->NumberShiftRightLogical(),
-      graph()->NewNode(simplified()->NumberBitwiseAnd(), receiver_bit_field2,
-                       jsgraph()->Constant(Map::ElementsKindBits::kMask)),
-      jsgraph()->Constant(Map::ElementsKindBits::kShift));
+      graph()->NewNode(
+          simplified()->NumberBitwiseAnd(), receiver_bit_field2,
+          jsgraph()->Constant(Map::Bits2::ElementsKindBits::kMask)),
+      jsgraph()->Constant(Map::Bits2::ElementsKindBits::kShift));
   return receiver_elements_kind;
 }
 
@@ -4382,7 +4773,7 @@ void JSCallReducer::CheckIfElementsKind(Node* receiver_elements_kind,
 
 // ES6 section 22.1.3.18 Array.prototype.push ( )
 Reduction JSCallReducer::ReduceArrayPrototypePush(Node* node) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
 
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
@@ -4518,7 +4909,7 @@ Reduction JSCallReducer::ReduceArrayPrototypePush(Node* node) {
 
 // ES6 section 22.1.3.17 Array.prototype.pop ( )
 Reduction JSCallReducer::ReduceArrayPrototypePop(Node* node) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
 
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
@@ -4653,7 +5044,7 @@ Reduction JSCallReducer::ReduceArrayPrototypePop(Node* node) {
 
 // ES6 section 22.1.3.22 Array.prototype.shift ( )
 Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
 
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
@@ -4871,7 +5262,7 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
 
 // ES6 section 22.1.3.23 Array.prototype.slice ( )
 Reduction JSCallReducer::ReduceArrayPrototypeSlice(Node* node) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
 
   if (!FLAG_turbo_inline_array_builtins) return NoChange();
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
@@ -4949,7 +5340,7 @@ Reduction JSCallReducer::ReduceArrayPrototypeSlice(Node* node) {
 
 // ES6 section 22.1.2.2 Array.isArray ( arg )
 Reduction JSCallReducer::ReduceArrayIsArray(Node* node) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
 
   // We certainly know that undefined is not an array.
   if (node->op()->ValueInputCount() < 3) {
@@ -4974,7 +5365,7 @@ Reduction JSCallReducer::ReduceArrayIsArray(Node* node) {
 }
 
 Reduction JSCallReducer::ReduceArrayIterator(Node* node, IterationKind kind) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
 
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   Node* receiver = NodeProperties::GetValueInput(node, 1);
@@ -5001,7 +5392,7 @@ Reduction JSCallReducer::ReduceArrayIterator(Node* node, IterationKind kind) {
 
 // ES #sec-%arrayiteratorprototype%.next
 Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
 
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
@@ -5085,8 +5476,6 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
   FieldAccess index_access = AccessBuilder::ForJSArrayIteratorNextIndex();
   if (IsTypedArrayElementsKind(elements_kind)) {
     index_access.type = TypeCache::Get()->kJSTypedArrayLengthType;
-    index_access.machine_type = MachineType::TypeCompressedTaggedSigned();
-    index_access.write_barrier_kind = kNoWriteBarrier;
   } else {
     index_access.type = TypeCache::Get()->kJSArrayLengthType;
   }
@@ -5625,256 +6014,18 @@ Reduction JSCallReducer::ReduceStringPrototypeConcat(Node* node) {
   return Replace(value);
 }
 
-Node* JSCallReducer::CreateArtificialFrameState(
-    Node* node, Node* outer_frame_state, int parameter_count,
-    BailoutId bailout_id, FrameStateType frame_state_type,
-    const SharedFunctionInfoRef& shared, Node* context) {
-  const FrameStateFunctionInfo* state_info =
-      common()->CreateFrameStateFunctionInfo(
-          frame_state_type, parameter_count + 1, 0, shared.object());
-
-  const Operator* op = common()->FrameState(
-      bailout_id, OutputFrameStateCombine::Ignore(), state_info);
-  const Operator* op0 = common()->StateValues(0, SparseInputMask::Dense());
-  Node* node0 = graph()->NewNode(op0);
-
-  static constexpr int kTargetInputIndex = 0;
-  static constexpr int kReceiverInputIndex = 1;
-  const int parameter_count_with_receiver = parameter_count + 1;
-  std::vector<Node*> params;
-  params.reserve(parameter_count_with_receiver);
-  for (int i = 0; i < parameter_count_with_receiver; i++) {
-    params.push_back(node->InputAt(kReceiverInputIndex + i));
-  }
-  const Operator* op_param = common()->StateValues(
-      static_cast<int>(params.size()), SparseInputMask::Dense());
-  Node* params_node = graph()->NewNode(
-      op_param, static_cast<int>(params.size()), &params.front());
-  if (!context) {
-    context = jsgraph()->UndefinedConstant();
-  }
-  return graph()->NewNode(op, params_node, node0, node0, context,
-                          node->InputAt(kTargetInputIndex), outer_frame_state);
-}
-
 Reduction JSCallReducer::ReducePromiseConstructor(Node* node) {
-  DisallowHeapAccessIf no_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_access(should_disallow_heap_access());
+  PromiseBuiltinReducerAssembler a(jsgraph(), temp_zone(), node);
 
-  DCHECK_EQ(IrOpcode::kJSConstruct, node->opcode());
-  ConstructParameters const& p = ConstructParametersOf(node->op());
-  int arity = static_cast<int>(p.arity() - 2);
   // We only inline when we have the executor.
-  if (arity < 1) return NoChange();
-  Node* target = NodeProperties::GetValueInput(node, 0);
-  Node* executor = NodeProperties::GetValueInput(node, 1);
-  Node* new_target = NodeProperties::GetValueInput(node, arity + 1);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-
+  if (a.ConstructArity() < 1) return NoChange();
   // Only handle builtins Promises, not subclasses.
-  if (target != new_target) return NoChange();
-
-  if (!dependencies()->DependOnPromiseHookProtector()) return NoChange();
-
-  SharedFunctionInfoRef promise_shared =
-      native_context().promise_function().shared();
-
-  // Insert a construct stub frame into the chain of frame states. This will
-  // reconstruct the proper frame when deoptimizing within the constructor.
-  // For the frame state, we only provide the executor parameter, even if more
-  // arugments were passed. This is not observable from JS.
-  DCHECK_EQ(1, promise_shared.internal_formal_parameter_count());
-  Node* constructor_frame_state = CreateArtificialFrameState(
-      node, outer_frame_state, 1, BailoutId::ConstructStubInvoke(),
-      FrameStateType::kConstructStub, promise_shared, context);
-
-  // The deopt continuation of this frame state is never called; the frame state
-  // is only necessary to obtain the right stack trace.
-  const std::vector<Node*> checkpoint_parameters({
-      jsgraph()->UndefinedConstant(), /* receiver */
-      jsgraph()->UndefinedConstant(), /* promise */
-      jsgraph()->UndefinedConstant(), /* reject function */
-      jsgraph()->TheHoleConstant()    /* exception */
-  });
-  int checkpoint_parameters_size =
-      static_cast<int>(checkpoint_parameters.size());
-  Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), promise_shared,
-      Builtins::kPromiseConstructorLazyDeoptContinuation, target, context,
-      checkpoint_parameters.data(), checkpoint_parameters_size,
-      constructor_frame_state, ContinuationFrameStateMode::LAZY);
-
-  // Check if executor is callable
-  Node* check_fail = nullptr;
-  Node* check_throw = nullptr;
-  WireInCallbackIsCallableCheck(executor, context, frame_state, effect,
-                                &control, &check_fail, &check_throw);
-
-  // Create the resulting JSPromise.
-  Node* promise = effect =
-      graph()->NewNode(javascript()->CreatePromise(), context, effect);
-
-  // 8. CreatePromiseResolvingFunctions
-  // Allocate a promise context for the closures below.
-  Node* promise_context = effect = graph()->NewNode(
-      javascript()->CreateFunctionContext(
-          native_context().scope_info().object(),
-          PromiseBuiltins::kPromiseContextLength - Context::MIN_CONTEXT_SLOTS,
-          FUNCTION_SCOPE),
-      context, effect, control);
-  effect = graph()->NewNode(
-      simplified()->StoreField(
-          AccessBuilder::ForContextSlot(PromiseBuiltins::kPromiseSlot)),
-      promise_context, promise, effect, control);
-  effect = graph()->NewNode(
-      simplified()->StoreField(
-          AccessBuilder::ForContextSlot(PromiseBuiltins::kAlreadyResolvedSlot)),
-      promise_context, jsgraph()->FalseConstant(), effect, control);
-  effect = graph()->NewNode(
-      simplified()->StoreField(
-          AccessBuilder::ForContextSlot(PromiseBuiltins::kDebugEventSlot)),
-      promise_context, jsgraph()->TrueConstant(), effect, control);
-
-  // Allocate the closure for the resolve case.
-  Node* resolve = effect = CreateClosureFromBuiltinSharedFunctionInfo(
-      native_context().promise_capability_default_resolve_shared_fun(),
-      promise_context, effect, control);
-
-  // Allocate the closure for the reject case.
-  Node* reject = effect = CreateClosureFromBuiltinSharedFunctionInfo(
-      native_context().promise_capability_default_reject_shared_fun(),
-      promise_context, effect, control);
-
-  const std::vector<Node*> checkpoint_parameters_continuation(
-      {jsgraph()->UndefinedConstant() /* receiver */, promise, reject});
-  int checkpoint_parameters_continuation_size =
-      static_cast<int>(checkpoint_parameters_continuation.size());
-  // This continuation just returns the created promise and takes care of
-  // exceptions thrown by the executor.
-  frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), promise_shared,
-      Builtins::kPromiseConstructorLazyDeoptContinuation, target, context,
-      checkpoint_parameters_continuation.data(),
-      checkpoint_parameters_continuation_size, constructor_frame_state,
-      ContinuationFrameStateMode::LAZY_WITH_CATCH);
-
-  // 9. Call executor with both resolving functions
-  effect = control = graph()->NewNode(
-      javascript()->Call(4, p.frequency(), FeedbackSource(),
-                         ConvertReceiverMode::kNullOrUndefined,
-                         SpeculationMode::kDisallowSpeculation),
-      executor, jsgraph()->UndefinedConstant(), resolve, reject, context,
-      frame_state, effect, control);
-
-  Node* exception_effect = effect;
-  Node* exception_control = control;
-  {
-    Node* reason = exception_effect = exception_control = graph()->NewNode(
-        common()->IfException(), exception_control, exception_effect);
-    // 10a. Call reject if the call to executor threw.
-    exception_effect = exception_control = graph()->NewNode(
-        javascript()->Call(3, p.frequency(), FeedbackSource(),
-                           ConvertReceiverMode::kNullOrUndefined,
-                           SpeculationMode::kDisallowSpeculation),
-        reject, jsgraph()->UndefinedConstant(), reason, context, frame_state,
-        exception_effect, exception_control);
-
-    // Rewire potential exception edges.
-    Node* on_exception = nullptr;
-    if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
-      RewirePostCallbackExceptionEdges(check_throw, on_exception,
-                                       exception_effect, &check_fail,
-                                       &exception_control);
-    }
-  }
-
-  Node* success_effect = effect;
-  Node* success_control = control;
-  {
-    success_control = graph()->NewNode(common()->IfSuccess(), success_control);
-  }
-
-  control =
-      graph()->NewNode(common()->Merge(2), success_control, exception_control);
-  effect = graph()->NewNode(common()->EffectPhi(2), success_effect,
-                            exception_effect, control);
-
-  // Wire up the branch for the case when IsCallable fails for the executor.
-  // Since {check_throw} is an unconditional throw, it's impossible to
-  // return a successful completion. Therefore, we simply connect the successful
-  // completion to the graph end.
-  Node* throw_node =
-      graph()->NewNode(common()->Throw(), check_throw, check_fail);
-  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
-
-  ReplaceWithValue(node, promise, effect, control);
-  return Replace(promise);
-}
-
-// V8 Extras: v8.createPromise(parent)
-Reduction JSCallReducer::ReducePromiseInternalConstructor(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-
-  // Check that promises aren't being observed through (debug) hooks.
+  if (a.TargetInput() != a.NewTargetInput()) return NoChange();
   if (!dependencies()->DependOnPromiseHookProtector()) return NoChange();
 
-  // Create a new pending promise.
-  Node* value = effect =
-      graph()->NewNode(javascript()->CreatePromise(), context, effect);
-
-  ReplaceWithValue(node, value, effect);
-  return Replace(value);
-}
-
-// V8 Extras: v8.rejectPromise(promise, reason)
-Reduction JSCallReducer::ReducePromiseInternalReject(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  Node* promise = node->op()->ValueInputCount() >= 2
-                      ? NodeProperties::GetValueInput(node, 2)
-                      : jsgraph()->UndefinedConstant();
-  Node* reason = node->op()->ValueInputCount() >= 3
-                     ? NodeProperties::GetValueInput(node, 3)
-                     : jsgraph()->UndefinedConstant();
-  Node* debug_event = jsgraph()->TrueConstant();
-  Node* frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-
-  // Reject the {promise} using the given {reason}, and trigger debug logic.
-  Node* value = effect =
-      graph()->NewNode(javascript()->RejectPromise(), promise, reason,
-                       debug_event, context, frame_state, effect, control);
-
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
-}
-
-// V8 Extras: v8.resolvePromise(promise, resolution)
-Reduction JSCallReducer::ReducePromiseInternalResolve(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  Node* promise = node->op()->ValueInputCount() >= 2
-                      ? NodeProperties::GetValueInput(node, 2)
-                      : jsgraph()->UndefinedConstant();
-  Node* resolution = node->op()->ValueInputCount() >= 3
-                         ? NodeProperties::GetValueInput(node, 3)
-                         : jsgraph()->UndefinedConstant();
-  Node* frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-
-  // Resolve the {promise} using the given {resolution}.
-  Node* value = effect =
-      graph()->NewNode(javascript()->ResolvePromise(), promise, resolution,
-                       context, frame_state, effect, control);
-
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
+  TNode<Object> subgraph = a.ReducePromiseConstructor(native_context());
+  return ReplaceWithSubgraph(&a, subgraph);
 }
 
 bool JSCallReducer::DoPromiseChecks(MapInference* inference) {
@@ -5886,7 +6037,7 @@ bool JSCallReducer::DoPromiseChecks(MapInference* inference) {
   for (Handle<Map> map : receiver_maps) {
     MapRef receiver_map(broker(), map);
     if (!receiver_map.IsJSPromiseMap()) return false;
-    if (FLAG_concurrent_inlining && !receiver_map.serialized_prototype()) {
+    if (should_disallow_heap_access() && !receiver_map.serialized_prototype()) {
       TRACE_BROKER_MISSING(broker(), "prototype for map " << receiver_map);
       return false;
     }
@@ -5932,7 +6083,8 @@ Reduction JSCallReducer::ReducePromisePrototypeCatch(Node* node) {
   NodeProperties::ChangeOp(
       node, javascript()->Call(2 + arity, p.frequency(), p.feedback(),
                                ConvertReceiverMode::kNotNullOrUndefined,
-                               p.speculation_mode()));
+                               p.speculation_mode(),
+                               CallFeedbackRelation::kUnrelated));
   Reduction const reduction = ReducePromisePrototypeThen(node);
   return reduction.Changed() ? reduction : Changed(node);
 }
@@ -5950,7 +6102,7 @@ Node* JSCallReducer::CreateClosureFromBuiltinSharedFunctionInfo(
 
 // ES section #sec-promise.prototype.finally
 Reduction JSCallReducer::ReducePromisePrototypeFinally(Node* node) {
-  DisallowHeapAccessIf no_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_access(should_disallow_heap_access());
 
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
@@ -6059,13 +6211,14 @@ Reduction JSCallReducer::ReducePromisePrototypeFinally(Node* node) {
   NodeProperties::ChangeOp(
       node, javascript()->Call(2 + arity, p.frequency(), p.feedback(),
                                ConvertReceiverMode::kNotNullOrUndefined,
-                               p.speculation_mode()));
+                               p.speculation_mode(),
+                               CallFeedbackRelation::kUnrelated));
   Reduction const reduction = ReducePromisePrototypeThen(node);
   return reduction.Changed() ? reduction : Changed(node);
 }
 
 Reduction JSCallReducer::ReducePromisePrototypeThen(Node* node) {
-  DisallowHeapAccessIf no_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_access(should_disallow_heap_access());
 
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
@@ -6133,7 +6286,7 @@ Reduction JSCallReducer::ReducePromisePrototypeThen(Node* node) {
 
 // ES section #sec-promise.resolve
 Reduction JSCallReducer::ReducePromiseResolveTrampoline(Node* node) {
-  DisallowHeapAccessIf no_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_access(should_disallow_heap_access());
 
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   Node* receiver = NodeProperties::GetValueInput(node, 1);
@@ -6186,7 +6339,7 @@ Reduction JSCallReducer::ReduceTypedArrayConstructor(
   // reconstruct the proper frame when deoptimizing within the constructor.
   frame_state = CreateArtificialFrameState(
       node, frame_state, arity, BailoutId::ConstructStubInvoke(),
-      FrameStateType::kConstructStub, shared, context);
+      FrameStateType::kConstructStub, shared, context, common(), graph());
 
   // This continuation just returns the newly created JSTypedArray. We
   // pass the_hole as the receiver, just like the builtin construct stub
@@ -6231,9 +6384,10 @@ Reduction JSCallReducer::ReduceTypedArrayPrototypeToStringTag(Node* node) {
       effect, control);
   Node* receiver_elements_kind = graph()->NewNode(
       simplified()->NumberShiftRightLogical(),
-      graph()->NewNode(simplified()->NumberBitwiseAnd(), receiver_bit_field2,
-                       jsgraph()->Constant(Map::ElementsKindBits::kMask)),
-      jsgraph()->Constant(Map::ElementsKindBits::kShift));
+      graph()->NewNode(
+          simplified()->NumberBitwiseAnd(), receiver_bit_field2,
+          jsgraph()->Constant(Map::Bits2::ElementsKindBits::kMask)),
+      jsgraph()->Constant(Map::Bits2::ElementsKindBits::kShift));
 
   // Offset the elements kind by FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND,
   // so that the branch cascade below is turned into a simple table
@@ -6249,7 +6403,7 @@ Reduction JSCallReducer::ReduceTypedArrayPrototypeToStringTag(Node* node) {
         jsgraph()->Constant(TYPE##_ELEMENTS -                          \
                             FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND));   \
     control = graph()->NewNode(common()->Branch(), check, control);    \
-    if (FLAG_concurrent_inlining) {                                    \
+    if (should_disallow_heap_access()) {                               \
       values.push_back(jsgraph()->Constant(                            \
           broker()->GetTypedArrayStringTag(TYPE##_ELEMENTS)));         \
     } else {                                                           \
@@ -6761,7 +6915,7 @@ Reduction JSCallReducer::ReduceCollectionIteratorPrototypeNext(
 }
 
 Reduction JSCallReducer::ReduceArrayBufferIsView(Node* node) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
 
   Node* value = node->op()->ValueInputCount() >= 3
                     ? NodeProperties::GetValueInput(node, 2)
@@ -6775,7 +6929,7 @@ Reduction JSCallReducer::ReduceArrayBufferIsView(Node* node) {
 
 Reduction JSCallReducer::ReduceArrayBufferViewAccessor(
     Node* node, InstanceType instance_type, FieldAccess const& access) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
 
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
@@ -7084,7 +7238,7 @@ Reduction JSCallReducer::ReduceNumberParseInt(Node* node) {
 }
 
 Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
 
   if (FLAG_force_slow_path) return NoChange();
   if (node->op()->ValueInputCount() < 3) return NoChange();
@@ -7111,7 +7265,7 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
   ZoneVector<PropertyAccessInfo> access_infos(graph()->zone());
   AccessInfoFactory access_info_factory(broker(), dependencies(),
                                         graph()->zone());
-  if (FLAG_concurrent_inlining) {
+  if (should_disallow_heap_access()) {
     // Obtain precomputed access infos from the broker.
     for (auto map : regexp_maps) {
       MapRef map_ref(broker(), map);
@@ -7228,7 +7382,7 @@ Reduction JSCallReducer::ReduceBigIntAsUintN(Node* node) {
   if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
     return NoChange();
   }
-  if (node->op()->ValueInputCount() < 3) {
+  if (node->op()->ValueInputCount() < 4) {
     return NoChange();
   }
 
diff --git a/deps/v8/src/compiler/js-call-reducer.h b/deps/v8/src/compiler/js-call-reducer.h
index 66c42cfb63dbd9..09e8159cfec191 100644
--- a/deps/v8/src/compiler/js-call-reducer.h
+++ b/deps/v8/src/compiler/js-call-reducer.h
@@ -7,6 +7,7 @@
 
 #include "src/base/flags.h"
 #include "src/compiler/frame-states.h"
+#include "src/compiler/globals.h"
 #include "src/compiler/graph-reducer.h"
 #include "src/compiler/node-properties.h"
 #include "src/deoptimizer/deoptimize-reason.h"
@@ -26,6 +27,7 @@ class CommonOperatorBuilder;
 class CompilationDependencies;
 struct FeedbackSource;
 struct FieldAccess;
+class JSCallReducerAssembler;
 class JSGraph;
 class JSHeapBroker;
 class JSOperatorBuilder;
@@ -38,14 +40,19 @@ class SimplifiedOperatorBuilder;
 class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
  public:
   // Flags that control the mode of operation.
-  enum Flag { kNoFlags = 0u, kBailoutOnUninitialized = 1u << 0 };
+  enum Flag {
+    kNoFlags = 0u,
+    kBailoutOnUninitialized = 1u << 0,
+  };
   using Flags = base::Flags<Flag>;
 
   JSCallReducer(Editor* editor, JSGraph* jsgraph, JSHeapBroker* broker,
-                Flags flags, CompilationDependencies* dependencies)
+                Zone* temp_zone, Flags flags,
+                CompilationDependencies* dependencies)
       : AdvancedReducer(editor),
         jsgraph_(jsgraph),
         broker_(broker),
+        temp_zone_(temp_zone),
         flags_(flags),
         dependencies_(dependencies) {}
 
@@ -58,7 +65,6 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   void Finalize() final;
 
  private:
-  Reduction ReduceArrayConstructor(Node* node);
   Reduction ReduceBooleanConstructor(Node* node);
   Reduction ReduceCallApiFunction(Node* node,
                                   const SharedFunctionInfoRef& shared);
@@ -79,25 +85,27 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   Reduction ReduceReflectGet(Node* node);
   Reduction ReduceReflectGetPrototypeOf(Node* node);
   Reduction ReduceReflectHas(Node* node);
+
+  Reduction ReduceArrayConstructor(Node* node);
+  Reduction ReduceArrayEvery(Node* node, const SharedFunctionInfoRef& shared);
+  Reduction ReduceArrayFilter(Node* node, const SharedFunctionInfoRef& shared);
+  Reduction ReduceArrayFindIndex(Node* node,
+                                 const SharedFunctionInfoRef& shared);
+  Reduction ReduceArrayFind(Node* node, const SharedFunctionInfoRef& shared);
   Reduction ReduceArrayForEach(Node* node, const SharedFunctionInfoRef& shared);
-  enum class ArrayReduceDirection { kLeft, kRight };
-  Reduction ReduceArrayReduce(Node* node, ArrayReduceDirection direction,
-                              const SharedFunctionInfoRef& shared);
+  Reduction ReduceArrayIncludes(Node* node);
+  Reduction ReduceArrayIndexOf(Node* node);
+  Reduction ReduceArrayIsArray(Node* node);
   Reduction ReduceArrayMap(Node* node, const SharedFunctionInfoRef& shared);
-  Reduction ReduceArrayFilter(Node* node, const SharedFunctionInfoRef& shared);
-  enum class ArrayFindVariant { kFind, kFindIndex };
-  Reduction ReduceArrayFind(Node* node, ArrayFindVariant variant,
-                            const SharedFunctionInfoRef& shared);
-  Reduction ReduceArrayEvery(Node* node, const SharedFunctionInfoRef& shared);
-  enum class SearchVariant { kIncludes, kIndexOf };
-  Reduction ReduceArrayIndexOfIncludes(SearchVariant search_variant,
-                                       Node* node);
-  Reduction ReduceArraySome(Node* node, const SharedFunctionInfoRef& shared);
-  Reduction ReduceArrayPrototypePush(Node* node);
   Reduction ReduceArrayPrototypePop(Node* node);
+  Reduction ReduceArrayPrototypePush(Node* node);
   Reduction ReduceArrayPrototypeShift(Node* node);
   Reduction ReduceArrayPrototypeSlice(Node* node);
-  Reduction ReduceArrayIsArray(Node* node);
+  Reduction ReduceArrayReduce(Node* node, const SharedFunctionInfoRef& shared);
+  Reduction ReduceArrayReduceRight(Node* node,
+                                   const SharedFunctionInfoRef& shared);
+  Reduction ReduceArraySome(Node* node, const SharedFunctionInfoRef& shared);
+
   enum class ArrayIteratorKind { kArray, kTypedArray };
   Reduction ReduceArrayIterator(Node* node, IterationKind kind);
   Reduction ReduceArrayIteratorPrototypeNext(Node* node);
@@ -106,7 +114,8 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
 
   Reduction ReduceCallOrConstructWithArrayLikeOrSpread(
       Node* node, int arity, CallFrequency const& frequency,
-      FeedbackSource const& feedback);
+      FeedbackSource const& feedback, SpeculationMode speculation_mode,
+      CallFeedbackRelation feedback_relation);
   Reduction ReduceJSConstruct(Node* node);
   Reduction ReduceJSConstructWithArrayLike(Node* node);
   Reduction ReduceJSConstructWithSpread(Node* node);
@@ -193,6 +202,9 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   Reduction ReduceNumberConstructor(Node* node);
   Reduction ReduceBigIntAsUintN(Node* node);
 
+  // The pendant to ReplaceWithValue when using GraphAssembler-based reductions.
+  Reduction ReplaceWithSubgraph(JSCallReducerAssembler* gasm, Node* subgraph);
+
   // Helper to verify promise receiver maps are as expected.
   // On bailout from a reduction, be sure to return inference.NoChange().
   bool DoPromiseChecks(MapInference* inference);
@@ -201,46 +213,6 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
                                                    Node* context, Node* effect,
                                                    Node* control);
 
-  // Returns the updated {to} node, and updates control and effect along the
-  // way.
-  Node* DoFilterPostCallbackWork(ElementsKind kind, Node** control,
-                                 Node** effect, Node* a, Node* to,
-                                 Node* element, Node* callback_value);
-
-  // If {fncallback} is not callable, throw a TypeError.
-  // {control} is altered, and new nodes {check_fail} and {check_throw} are
-  // returned. {check_fail} is the control branch where IsCallable failed,
-  // and {check_throw} is the call to throw a TypeError in that
-  // branch.
-  void WireInCallbackIsCallableCheck(Node* fncallback, Node* context,
-                                     Node* check_frame_state, Node* effect,
-                                     Node** control, Node** check_fail,
-                                     Node** check_throw);
-  void RewirePostCallbackExceptionEdges(Node* check_throw, Node* on_exception,
-                                        Node* effect, Node** check_fail,
-                                        Node** control);
-
-  // Begin the central loop of a higher-order array builtin. A Loop is wired
-  // into {control}, an EffectPhi into {effect}, and the array index {k} is
-  // threaded into a Phi, which is returned. It's helpful to save the
-  // value of {control} as the loop node, and of {effect} as the corresponding
-  // EffectPhi after function return.
-  Node* WireInLoopStart(Node* k, Node** control, Node** effect);
-  void WireInLoopEnd(Node* loop, Node* eloop, Node* vloop, Node* k,
-                     Node* control, Node* effect);
-
-  // Load receiver[k], first bounding k by receiver array length.
-  // k is thusly changed, and the effect is changed as well.
-  Node* SafeLoadElement(ElementsKind kind, Node* receiver, Node* control,
-                        Node** effect, Node** k,
-                        const FeedbackSource& feedback);
-
-  Node* CreateArtificialFrameState(Node* node, Node* outer_frame_state,
-                                   int parameter_count, BailoutId bailout_id,
-                                   FrameStateType frame_state_type,
-                                   const SharedFunctionInfoRef& shared,
-                                   Node* context = nullptr);
-
   void CheckIfElementsKind(Node* receiver_elements_kind, ElementsKind kind,
                            Node* control, Node** if_true, Node** if_false);
   Node* LoadReceiverElementsKind(Node* receiver, Node** effect, Node** control);
@@ -248,6 +220,7 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   Graph* graph() const;
   JSGraph* jsgraph() const { return jsgraph_; }
   JSHeapBroker* broker() const { return broker_; }
+  Zone* temp_zone() const { return temp_zone_; }
   Isolate* isolate() const;
   Factory* factory() const;
   NativeContextRef native_context() const;
@@ -256,9 +229,11 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   SimplifiedOperatorBuilder* simplified() const;
   Flags flags() const { return flags_; }
   CompilationDependencies* dependencies() const { return dependencies_; }
+  bool should_disallow_heap_access() const;
 
   JSGraph* const jsgraph_;
   JSHeapBroker* const broker_;
+  Zone* const temp_zone_;
   Flags const flags_;
   CompilationDependencies* const dependencies_;
   std::set<Node*> waitlist_;
diff --git a/deps/v8/src/compiler/js-context-specialization.cc b/deps/v8/src/compiler/js-context-specialization.cc
index 409fc6c9a143f2..c64b61746b3288 100644
--- a/deps/v8/src/compiler/js-context-specialization.cc
+++ b/deps/v8/src/compiler/js-context-specialization.cc
@@ -160,7 +160,15 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
   // This will hold the final value, if we can figure it out.
   base::Optional<ObjectRef> maybe_value;
   maybe_value = concrete.get(static_cast<int>(access.index()));
-  if (maybe_value.has_value() && !maybe_value->IsSmi()) {
+
+  if (!maybe_value.has_value()) {
+    TRACE_BROKER_MISSING(broker(), "slot value " << access.index()
+                                                 << " for context "
+                                                 << concrete);
+    return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
+  }
+
+  if (!maybe_value->IsSmi()) {
     // Even though the context slot is immutable, the context might have escaped
     // before the function to which it belongs has initialized the slot.
     // We must be conservative and check if the value in the slot is currently
@@ -169,21 +177,11 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
     OddballType oddball_type = maybe_value->AsHeapObject().map().oddball_type();
     if (oddball_type == OddballType::kUndefined ||
         oddball_type == OddballType::kHole) {
-      maybe_value.reset();
+      return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
     }
   }
 
-  if (!maybe_value.has_value()) {
-    TRACE_BROKER_MISSING(broker(), "slot value " << access.index()
-                                                 << " for context "
-                                                 << concrete);
-    return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
-  }
-
   // Success. The context load can be replaced with the constant.
-  // TODO(titzer): record the specialization for sharing code across
-  // multiple contexts that have the same value in the corresponding context
-  // slot.
   Node* constant = jsgraph_->Constant(*maybe_value);
   ReplaceWithValue(node, constant);
   return Replace(constant);
diff --git a/deps/v8/src/compiler/js-create-lowering.cc b/deps/v8/src/compiler/js-create-lowering.cc
index 6ab54d793a8e46..6f76cb7c78be73 100644
--- a/deps/v8/src/compiler/js-create-lowering.cc
+++ b/deps/v8/src/compiler/js-create-lowering.cc
@@ -161,7 +161,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
   if (outer_state->opcode() != IrOpcode::kFrameState) {
     switch (type) {
       case CreateArgumentsType::kMappedArguments: {
-        // TODO(mstarzinger): Duplicate parameters are not handled yet.
+        // TODO(turbofan): Duplicate parameters are not handled yet.
         if (shared.has_duplicate_parameters()) return NoChange();
         Node* const callee = NodeProperties::GetValueInput(node, 0);
         Node* const context = NodeProperties::GetContextInput(node);
@@ -243,8 +243,8 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
             native_context().js_array_packed_elements_map());
         // Actually allocate and initialize the jsarray.
         AllocationBuilder a(jsgraph(), effect, control);
-        STATIC_ASSERT(JSArray::kSize == 4 * kTaggedSize);
-        a.Allocate(JSArray::kSize);
+        STATIC_ASSERT(JSArray::kHeaderSize == 4 * kTaggedSize);
+        a.Allocate(JSArray::kHeaderSize);
         a.Store(AccessBuilder::ForMap(), jsarray_map);
         a.Store(AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer(),
                 jsgraph()->EmptyFixedArrayConstant());
@@ -263,7 +263,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
       Node* const callee = NodeProperties::GetValueInput(node, 0);
       Node* const context = NodeProperties::GetContextInput(node);
       Node* effect = NodeProperties::GetEffectInput(node);
-      // TODO(mstarzinger): Duplicate parameters are not handled yet.
+      // TODO(turbofan): Duplicate parameters are not handled yet.
       if (shared.has_duplicate_parameters()) return NoChange();
       // Choose the correct frame state and frame state info depending on
       // whether there conceptually is an arguments adaptor frame in the call
@@ -365,8 +365,8 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
       // -1 to minus receiver
       int argument_count = args_state_info.parameter_count() - 1;
       int length = std::max(0, argument_count - start_index);
-      STATIC_ASSERT(JSArray::kSize == 4 * kTaggedSize);
-      a.Allocate(JSArray::kSize);
+      STATIC_ASSERT(JSArray::kHeaderSize == 4 * kTaggedSize);
+      a.Allocate(JSArray::kHeaderSize);
       a.Store(AccessBuilder::ForMap(), jsarray_map);
       a.Store(AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer(),
               jsgraph()->EmptyFixedArrayConstant());
@@ -471,6 +471,12 @@ Reduction JSCreateLowering::ReduceNewArray(
       initial_map,
       initial_map.AsElementsKind(GetHoleyElementsKind(elements_kind)));
 
+  // Because CheckBounds performs implicit conversion from string to number, an
+  // additional CheckNumber is required to behave correctly for calls with a
+  // single string argument.
+  length = effect = graph()->NewNode(
+      simplified()->CheckNumber(FeedbackSource{}), length, effect, control);
+
   // Check that the {limit} is an unsigned integer in the valid range.
   // This has to be kept in sync with src/runtime/runtime-array.cc,
   // where this limit is protected.
@@ -512,6 +518,7 @@ Reduction JSCreateLowering::ReduceNewArray(
     const SlackTrackingPrediction& slack_tracking_prediction) {
   DCHECK(node->opcode() == IrOpcode::kJSCreateArray ||
          node->opcode() == IrOpcode::kJSCreateEmptyLiteralArray);
+  DCHECK(NodeProperties::GetType(length).Is(Type::Number()));
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
@@ -672,6 +679,9 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
         length_type.Max() <= kElementLoopUnrollLimit &&
         length_type.Min() == length_type.Max()) {
       int capacity = static_cast<int>(length_type.Max());
+      // Replace length with a constant in order to protect against a potential
+      // typer bug leading to length > capacity.
+      length = jsgraph()->Constant(capacity);
       return ReduceNewArray(node, length, capacity, *initial_map, elements_kind,
                             allocation, slack_tracking_prediction);
     }
@@ -736,7 +746,7 @@ Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
 
   // Create the JSArrayIterator result.
   AllocationBuilder a(jsgraph(), effect, control);
-  a.Allocate(JSArrayIterator::kSize, AllocationType::kYoung,
+  a.Allocate(JSArrayIterator::kHeaderSize, AllocationType::kYoung,
              Type::OtherObject());
   a.Store(AccessBuilder::ForMap(),
           native_context().initial_array_iterator_map());
@@ -776,7 +786,7 @@ Reduction JSCreateLowering::ReduceJSCreateAsyncFunctionObject(Node* node) {
 
   // Create the JSAsyncFunctionObject result.
   AllocationBuilder a(jsgraph(), effect, control);
-  a.Allocate(JSAsyncFunctionObject::kSize);
+  a.Allocate(JSAsyncFunctionObject::kHeaderSize);
   a.Store(AccessBuilder::ForMap(),
           native_context().async_function_object_map());
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer(),
@@ -846,7 +856,7 @@ Reduction JSCreateLowering::ReduceJSCreateCollectionIterator(Node* node) {
 
   // Create the JSCollectionIterator result.
   AllocationBuilder a(jsgraph(), effect, control);
-  a.Allocate(JSCollectionIterator::kSize, AllocationType::kYoung,
+  a.Allocate(JSCollectionIterator::kHeaderSize, AllocationType::kYoung,
              Type::OtherObject());
   a.Store(AccessBuilder::ForMap(),
           MapForCollectionIterationKind(native_context(), p.collection_kind(),
@@ -888,7 +898,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
 
   // Create the JSBoundFunction result.
   AllocationBuilder a(jsgraph(), effect, control);
-  a.Allocate(JSBoundFunction::kSize, AllocationType::kYoung,
+  a.Allocate(JSBoundFunction::kHeaderSize, AllocationType::kYoung,
              Type::BoundFunction());
   a.Store(AccessBuilder::ForMap(), map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer(),
@@ -999,7 +1009,7 @@ Reduction JSCreateLowering::ReduceJSCreateStringIterator(Node* node) {
       jsgraph()->Constant(native_context().initial_string_iterator_map());
   // Allocate new iterator and attach the iterator to this string.
   AllocationBuilder a(jsgraph(), effect, graph()->start());
-  a.Allocate(JSStringIterator::kSize, AllocationType::kYoung,
+  a.Allocate(JSStringIterator::kHeaderSize, AllocationType::kYoung,
              Type::OtherObject());
   a.Store(AccessBuilder::ForMap(), map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer(),
@@ -1032,13 +1042,13 @@ Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
   Node* elements = aa.Finish();
 
   AllocationBuilder a(jsgraph(), elements, graph()->start());
-  a.Allocate(JSArray::kSize);
+  a.Allocate(JSArray::kHeaderSize);
   a.Store(AccessBuilder::ForMap(), array_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer(),
           jsgraph()->EmptyFixedArrayConstant());
   a.Store(AccessBuilder::ForJSObjectElements(), elements);
   a.Store(AccessBuilder::ForJSArrayLength(PACKED_ELEMENTS), length);
-  STATIC_ASSERT(JSArray::kSize == 4 * kTaggedSize);
+  STATIC_ASSERT(JSArray::kHeaderSize == 4 * kTaggedSize);
   a.FinishAndChange(node);
   return Changed(node);
 }
@@ -1061,8 +1071,8 @@ Reduction JSCreateLowering::ReduceJSCreatePromise(Node* node) {
   STATIC_ASSERT(v8::Promise::kPending == 0);
   a.Store(AccessBuilder::ForJSObjectOffset(JSPromise::kFlagsOffset),
           jsgraph()->ZeroConstant());
-  STATIC_ASSERT(JSPromise::kSize == 5 * kTaggedSize);
-  for (int offset = JSPromise::kSize;
+  STATIC_ASSERT(JSPromise::kHeaderSize == 5 * kTaggedSize);
+  for (int offset = JSPromise::kHeaderSize;
        offset < JSPromise::kSizeWithEmbedderFields; offset += kTaggedSize) {
     a.Store(AccessBuilder::ForJSObjectOffset(offset),
             jsgraph()->ZeroConstant());
@@ -1196,28 +1206,23 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
     Node* context = NodeProperties::GetContextInput(node);
-    Node* extension = jsgraph()->TheHoleConstant();
     AllocationBuilder a(jsgraph(), effect, control);
-    STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
+    STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 2);  // Ensure fully covered.
     int context_length = slot_count + Context::MIN_CONTEXT_SLOTS;
-    Handle<Map> map;
     switch (scope_type) {
       case EVAL_SCOPE:
-        map = factory()->eval_context_map();
+        a.AllocateContext(context_length, native_context().eval_context_map());
         break;
       case FUNCTION_SCOPE:
-        map = factory()->function_context_map();
+        a.AllocateContext(context_length,
+                          native_context().function_context_map());
         break;
       default:
         UNREACHABLE();
     }
-    a.AllocateContext(context_length, MapRef(broker(), map));
     a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX),
             scope_info);
     a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
-    a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
-    a.Store(AccessBuilder::ForContextSlot(Context::NATIVE_CONTEXT_INDEX),
-            jsgraph()->Constant(native_context()));
     for (int i = Context::MIN_CONTEXT_SLOTS; i < context_length; ++i) {
       a.Store(AccessBuilder::ForContextSlot(i), jsgraph()->UndefinedConstant());
     }
@@ -1238,14 +1243,13 @@ Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
   Node* context = NodeProperties::GetContextInput(node);
 
   AllocationBuilder a(jsgraph(), effect, control);
-  STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
-  a.AllocateContext(Context::MIN_CONTEXT_SLOTS,
-                    MapRef(broker(), factory()->with_context_map()));
+  STATIC_ASSERT(Context::MIN_CONTEXT_EXTENDED_SLOTS ==
+                3);  // Ensure fully covered.
+  a.AllocateContext(Context::MIN_CONTEXT_EXTENDED_SLOTS,
+                    native_context().with_context_map());
   a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX), scope_info);
   a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
   a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
-  a.Store(AccessBuilder::ForContextSlot(Context::NATIVE_CONTEXT_INDEX),
-          jsgraph()->Constant(native_context()));
   RelaxControls(node);
   a.FinishAndChange(node);
   return Changed(node);
@@ -1258,17 +1262,13 @@ Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* context = NodeProperties::GetContextInput(node);
-  Node* extension = jsgraph()->TheHoleConstant();
 
   AllocationBuilder a(jsgraph(), effect, control);
-  STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
+  STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 2);  // Ensure fully covered.
   a.AllocateContext(Context::MIN_CONTEXT_SLOTS + 1,
-                    MapRef(broker(), factory()->catch_context_map()));
+                    native_context().catch_context_map());
   a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX), scope_info);
   a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
-  a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
-  a.Store(AccessBuilder::ForContextSlot(Context::NATIVE_CONTEXT_INDEX),
-          jsgraph()->Constant(native_context()));
   a.Store(AccessBuilder::ForContextSlot(Context::THROWN_OBJECT_INDEX),
           exception);
   RelaxControls(node);
@@ -1287,18 +1287,13 @@ Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
     Node* context = NodeProperties::GetContextInput(node);
-    Node* extension = jsgraph()->TheHoleConstant();
 
     AllocationBuilder a(jsgraph(), effect, control);
-    STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
-    a.AllocateContext(context_length,
-                      MapRef(broker(), factory()->block_context_map()));
+    STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 2);  // Ensure fully covered.
+    a.AllocateContext(context_length, native_context().block_context_map());
     a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX),
             scope_info);
     a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
-    a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
-    a.Store(AccessBuilder::ForContextSlot(Context::NATIVE_CONTEXT_INDEX),
-            jsgraph()->Constant(native_context()));
     for (int i = Context::MIN_CONTEXT_SLOTS; i < context_length; ++i) {
       a.Store(AccessBuilder::ForContextSlot(i), jsgraph()->UndefinedConstant());
     }
@@ -1350,7 +1345,7 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
     int capacity =
         NameDictionary::ComputeCapacity(NameDictionary::kInitialCapacity);
     DCHECK(base::bits::IsPowerOfTwo(capacity));
-    int length = NameDictionary::EntryToIndex(capacity);
+    int length = NameDictionary::EntryToIndex(InternalIndex(capacity));
     int size = NameDictionary::SizeFor(length);
 
     AllocationBuilder a(jsgraph(), effect, control);
@@ -1516,7 +1511,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
   a.Store(AccessBuilder::ForFixedArrayElement(), jsgraph()->Constant(1),
           arguments);
   for (int i = 0; i < mapped_count; ++i) {
-    int idx = Context::MIN_CONTEXT_SLOTS + parameter_count - 1 - i;
+    int idx = shared.context_header_size() + parameter_count - 1 - i;
     a.Store(AccessBuilder::ForFixedArrayElement(), jsgraph()->Constant(i + 2),
             jsgraph()->Constant(idx));
   }
@@ -1549,12 +1544,12 @@ Node* JSCreateLowering::AllocateAliasedArguments(
   // The unmapped argument values are stored yet another indirection away and
   // then linked into the parameter map below, whereas mapped argument values
   // (i.e. the first {mapped_count} elements) are replaced with a hole instead.
-  Node* arguments =
+  Node* arguments = effect =
       graph()->NewNode(simplified()->NewArgumentsElements(mapped_count),
                        arguments_frame, arguments_length, effect);
 
   // Actually allocate the backing store.
-  AllocationBuilder a(jsgraph(), arguments, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   a.AllocateArray(mapped_count + 2,
                   MapRef(broker(), factory()->sloppy_arguments_elements_map()));
   a.Store(AccessBuilder::ForFixedArrayElement(), jsgraph()->Constant(0),
@@ -1562,7 +1557,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
   a.Store(AccessBuilder::ForFixedArrayElement(), jsgraph()->Constant(1),
           arguments);
   for (int i = 0; i < mapped_count; ++i) {
-    int idx = Context::MIN_CONTEXT_SLOTS + parameter_count - 1 - i;
+    int idx = shared.context_header_size() + parameter_count - 1 - i;
     Node* value = graph()->NewNode(
         common()->Select(MachineRepresentation::kTagged),
         graph()->NewNode(simplified()->NumberLessThan(), jsgraph()->Constant(i),
@@ -1645,7 +1640,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
                           property_name.object(),
                           MaybeHandle<Map>(),
                           Type::Any(),
-                          MachineType::TypeCompressedTagged(),
+                          MachineType::AnyTagged(),
                           kFullWriteBarrier,
                           LoadSensitivity::kUnsafe,
                           const_field_info};
@@ -1797,13 +1792,13 @@ Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control,
   STATIC_ASSERT(JSRegExp::kSourceOffset == JSRegExp::kDataOffset + kTaggedSize);
   STATIC_ASSERT(JSRegExp::kFlagsOffset ==
                 JSRegExp::kSourceOffset + kTaggedSize);
-  STATIC_ASSERT(JSRegExp::kSize == JSRegExp::kFlagsOffset + kTaggedSize);
-  STATIC_ASSERT(JSRegExp::kLastIndexOffset == JSRegExp::kSize);
+  STATIC_ASSERT(JSRegExp::kHeaderSize == JSRegExp::kFlagsOffset + kTaggedSize);
+  STATIC_ASSERT(JSRegExp::kLastIndexOffset == JSRegExp::kHeaderSize);
   STATIC_ASSERT(JSRegExp::kInObjectFieldCount == 1);  // LastIndex.
 
   const AllocationType allocation = AllocationType::kYoung;
   const int size =
-      JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kTaggedSize;
+      JSRegExp::kHeaderSize + JSRegExp::kInObjectFieldCount * kTaggedSize;
 
   AllocationBuilder builder(jsgraph(), effect, control);
   builder.Allocate(size, allocation, Type::For(boilerplate_map));
diff --git a/deps/v8/src/compiler/js-generic-lowering.cc b/deps/v8/src/compiler/js-generic-lowering.cc
index d419a804a57953..e565d9ee40dad1 100644
--- a/deps/v8/src/compiler/js-generic-lowering.cc
+++ b/deps/v8/src/compiler/js-generic-lowering.cc
@@ -378,6 +378,10 @@ void JSGenericLowering::LowerJSOrdinaryHasInstance(Node* node) {
   ReplaceWithStubCall(node, callable, flags);
 }
 
+void JSGenericLowering::LowerJSHasContextExtension(Node* node) {
+  UNREACHABLE();  // Eliminated in typed lowering.
+}
+
 void JSGenericLowering::LowerJSLoadContext(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
@@ -844,6 +848,15 @@ void JSGenericLowering::LowerJSGeneratorRestoreRegister(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
 
+namespace {
+
+StackCheckKind StackCheckKindOfJSStackCheck(const Operator* op) {
+  DCHECK(op->opcode() == IrOpcode::kJSStackCheck);
+  return OpParameter<StackCheckKind>(op);
+}
+
+}  // namespace
+
 void JSGenericLowering::LowerJSStackCheck(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
@@ -854,7 +867,9 @@ void JSGenericLowering::LowerJSStackCheck(Node* node) {
                            ExternalReference::address_of_jslimit(isolate())),
                        jsgraph()->IntPtrConstant(0), effect, control);
 
-  Node* check = graph()->NewNode(machine()->StackPointerGreaterThan(), limit);
+  StackCheckKind stack_check_kind = StackCheckKindOfJSStackCheck(node->op());
+  Node* check = effect = graph()->NewNode(
+      machine()->StackPointerGreaterThan(stack_check_kind), limit, effect);
   Node* branch =
       graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
 
@@ -890,8 +905,17 @@ void JSGenericLowering::LowerJSStackCheck(Node* node) {
     }
   }
 
-  // Turn the stack check into a runtime call.
-  ReplaceWithRuntimeCall(node, Runtime::kStackGuard);
+  // Turn the stack check into a runtime call. At function entry, the runtime
+  // function takes an offset argument which is subtracted from the stack
+  // pointer prior to the stack check (i.e. the check is `sp - offset >=
+  // limit`).
+  if (stack_check_kind == StackCheckKind::kJSFunctionEntry) {
+    node->InsertInput(zone(), 0,
+                      graph()->NewNode(machine()->LoadStackCheckOffset()));
+    ReplaceWithRuntimeCall(node, Runtime::kStackGuardWithGap);
+  } else {
+    ReplaceWithRuntimeCall(node, Runtime::kStackGuard);
+  }
 }
 
 void JSGenericLowering::LowerJSDebugger(Node* node) {
diff --git a/deps/v8/src/compiler/js-heap-broker.cc b/deps/v8/src/compiler/js-heap-broker.cc
index 529fb8e9c128ed..b675d590c8e6ab 100644
--- a/deps/v8/src/compiler/js-heap-broker.cc
+++ b/deps/v8/src/compiler/js-heap-broker.cc
@@ -60,7 +60,72 @@ HEAP_BROKER_OBJECT_LIST(FORWARD_DECL)
 //   data is an instance of the base class (ObjectData), i.e. it basically
 //   carries no information other than the handle.
 //
-enum ObjectDataKind { kSmi, kSerializedHeapObject, kUnserializedHeapObject };
+// kUnserializedReadOnlyHeapObject: The underlying V8 object is a read-only
+//   HeapObject and the data is an instance of ObjectData. For
+//   ReadOnlyHeapObjects, it is OK to access heap even from off-thread, so
+//   these objects need not be serialized.
+enum ObjectDataKind {
+  kSmi,
+  kSerializedHeapObject,
+  kUnserializedHeapObject,
+  kUnserializedReadOnlyHeapObject
+};
+
+class AllowHandleAllocationIf {
+ public:
+  explicit AllowHandleAllocationIf(ObjectDataKind kind,
+                                   JSHeapBroker::BrokerMode mode) {
+    DCHECK_IMPLIES(mode == JSHeapBroker::BrokerMode::kSerialized,
+                   kind == kUnserializedReadOnlyHeapObject);
+    if (kind == kUnserializedHeapObject) maybe_allow_handle_.emplace();
+  }
+
+ private:
+  base::Optional<AllowHandleAllocation> maybe_allow_handle_;
+};
+
+class AllowHandleDereferenceIf {
+ public:
+  explicit AllowHandleDereferenceIf(ObjectDataKind kind,
+                                    JSHeapBroker::BrokerMode mode) {
+    DCHECK_IMPLIES(mode == JSHeapBroker::BrokerMode::kSerialized,
+                   kind == kUnserializedReadOnlyHeapObject);
+    if (kind == kUnserializedHeapObject ||
+        kind == kUnserializedReadOnlyHeapObject)
+      maybe_allow_handle_.emplace();
+  }
+
+  explicit AllowHandleDereferenceIf(ObjectDataKind kind) {
+    if (kind == kUnserializedHeapObject ||
+        kind == kUnserializedReadOnlyHeapObject)
+      maybe_allow_handle_.emplace();
+  }
+
+ private:
+  base::Optional<AllowHandleDereference> maybe_allow_handle_;
+};
+
+class AllowHeapAllocationIf {
+ public:
+  explicit AllowHeapAllocationIf(ObjectDataKind kind,
+                                 JSHeapBroker::BrokerMode mode) {
+    DCHECK_IMPLIES(mode == JSHeapBroker::BrokerMode::kSerialized,
+                   kind == kUnserializedReadOnlyHeapObject);
+    if (kind == kUnserializedHeapObject) maybe_allow_handle_.emplace();
+  }
+
+ private:
+  base::Optional<AllowHeapAllocation> maybe_allow_handle_;
+};
+
+namespace {
+bool IsReadOnlyHeapObject(Object object) {
+  DisallowHeapAllocation no_gc;
+  return (object.IsCode() && Code::cast(object).is_builtin()) ||
+         (object.IsHeapObject() &&
+          ReadOnlyHeap::Contains(HeapObject::cast(object)));
+}
+}  // namespace
 
 class ObjectData : public ZoneObject {
  public:
@@ -74,7 +139,19 @@ class ObjectData : public ZoneObject {
     TRACE(broker, "Creating data " << this << " for handle " << object.address()
                                    << " (" << Brief(*object) << ")");
 
-    CHECK_NOT_NULL(broker->isolate()->handle_scope_data()->canonical_scope);
+    // It is safe to access read only heap objects and builtins from a
+    // background thread. When we read fileds of these objects, we may create
+    // ObjectData on the background thread even without a canonical handle
+    // scope. This is safe too since we don't create handles but just get
+    // handles from read only root table or builtins table which is what
+    // canonical scope uses as well. For all other objects we should have
+    // created ObjectData in canonical handle scope on the main thread.
+    CHECK_IMPLIES(
+        broker->mode() == JSHeapBroker::kDisabled ||
+            broker->mode() == JSHeapBroker::kSerializing,
+        broker->isolate()->handle_scope_data()->canonical_scope != nullptr);
+    CHECK_IMPLIES(broker->mode() == JSHeapBroker::kSerialized,
+                  IsReadOnlyHeapObject(*object));
   }
 
 #define DECLARE_IS_AND_AS(Name) \
@@ -86,6 +163,10 @@ class ObjectData : public ZoneObject {
   Handle<Object> object() const { return object_; }
   ObjectDataKind kind() const { return kind_; }
   bool is_smi() const { return kind_ == kSmi; }
+  bool should_access_heap() const {
+    return kind_ == kUnserializedHeapObject ||
+           kind_ == kUnserializedReadOnlyHeapObject;
+  }
 
 #ifdef DEBUG
   enum class Usage{kUnused, kOnlyIdentityUsed, kDataUsed};
@@ -103,14 +184,15 @@ class HeapObjectData : public ObjectData {
                  Handle<HeapObject> object);
 
   bool boolean_value() const { return boolean_value_; }
-  MapData* map() const { return map_; }
+  ObjectData* map() const { return map_; }
+  InstanceType GetMapInstanceType() const;
 
   static HeapObjectData* Serialize(JSHeapBroker* broker,
                                    Handle<HeapObject> object);
 
  private:
   bool const boolean_value_;
-  MapData* const map_;
+  ObjectData* const map_;
 };
 
 class PropertyCellData : public HeapObjectData {
@@ -126,7 +208,6 @@ class PropertyCellData : public HeapObjectData {
  private:
   PropertyDetails const property_details_;
 
-  bool serialized_ = false;
   ObjectData* value_ = nullptr;
 };
 
@@ -148,12 +229,11 @@ class FunctionTemplateInfoData : public HeapObjectData {
   KnownReceiversMap& known_receivers() { return known_receivers_; }
 
  private:
-  bool serialized_call_code_ = false;
-  CallHandlerInfoData* call_code_ = nullptr;
   bool is_signature_undefined_ = false;
   bool accept_any_receiver_ = false;
   bool has_call_code_ = false;
 
+  CallHandlerInfoData* call_code_ = nullptr;
   KnownReceiversMap known_receivers_;
 };
 
@@ -170,7 +250,6 @@ class CallHandlerInfoData : public HeapObjectData {
  private:
   Address const callback_;
 
-  bool serialized_ = false;
   ObjectData* data_ = nullptr;
 };
 
@@ -204,35 +283,29 @@ PropertyCellData::PropertyCellData(JSHeapBroker* broker, ObjectData** storage,
       property_details_(object->property_details()) {}
 
 void PropertyCellData::Serialize(JSHeapBroker* broker) {
-  if (serialized_) return;
-  serialized_ = true;
+  if (value_ != nullptr) return;
 
   TraceScope tracer(broker, this, "PropertyCellData::Serialize");
   auto cell = Handle<PropertyCell>::cast(object());
-  DCHECK_NULL(value_);
   value_ = broker->GetOrCreateData(cell->value());
 }
 
 void FunctionTemplateInfoData::SerializeCallCode(JSHeapBroker* broker) {
-  if (serialized_call_code_) return;
-  serialized_call_code_ = true;
+  if (call_code_ != nullptr) return;
 
   TraceScope tracer(broker, this,
                     "FunctionTemplateInfoData::SerializeCallCode");
   auto function_template_info = Handle<FunctionTemplateInfo>::cast(object());
-  DCHECK_NULL(call_code_);
   call_code_ = broker->GetOrCreateData(function_template_info->call_code())
                    ->AsCallHandlerInfo();
   call_code_->Serialize(broker);
 }
 
 void CallHandlerInfoData::Serialize(JSHeapBroker* broker) {
-  if (serialized_) return;
-  serialized_ = true;
+  if (data_ != nullptr) return;
 
   TraceScope tracer(broker, this, "CallHandlerInfoData::Serialize");
   auto call_handler_info = Handle<CallHandlerInfo>::cast(object());
-  DCHECK_NULL(data_);
   data_ = broker->GetOrCreateData(call_handler_info->data());
 }
 
@@ -281,11 +354,12 @@ class JSObjectData : public JSReceiverData {
   // Shallow serialization of {elements}.
   void SerializeElements(JSHeapBroker* broker);
   bool serialized_elements() const { return serialized_elements_; }
-  FixedArrayBaseData* elements() const;
+  ObjectData* elements() const;
 
   void SerializeObjectCreateMap(JSHeapBroker* broker);
 
-  MapData* object_create_map(JSHeapBroker* broker) const {  // Can be nullptr.
+  ObjectData* object_create_map(
+      JSHeapBroker* broker) const {  // Can be nullptr.
     if (!serialized_object_create_map_) {
       DCHECK_NULL(object_create_map_);
       TRACE_MISSING(broker, "object_create_map on " << this);
@@ -307,7 +381,7 @@ class JSObjectData : public JSReceiverData {
  private:
   void SerializeRecursiveAsBoilerplate(JSHeapBroker* broker, int max_depths);
 
-  FixedArrayBaseData* elements_ = nullptr;
+  ObjectData* elements_ = nullptr;
   bool cow_or_empty_elements_tenured_ = false;
   // The {serialized_as_boilerplate} flag is set when all recursively
   // reachable JSObjects are serialized.
@@ -317,7 +391,7 @@ class JSObjectData : public JSReceiverData {
   ZoneVector<JSObjectField> inobject_fields_;
 
   bool serialized_object_create_map_ = false;
-  MapData* object_create_map_ = nullptr;
+  ObjectData* object_create_map_ = nullptr;
 
   // Elements (indexed properties) that either
   // (1) are known to exist directly on the object as non-writable and
@@ -349,7 +423,7 @@ void JSObjectData::SerializeObjectCreateMap(JSHeapBroker* broker) {
       if (proto_info->HasObjectCreateMap()) {
         DCHECK_NULL(object_create_map_);
         object_create_map_ =
-            broker->GetOrCreateData(proto_info->ObjectCreateMap())->AsMap();
+            broker->GetOrCreateData(proto_info->ObjectCreateMap());
       }
     }
   }
@@ -510,14 +584,14 @@ class JSBoundFunctionData : public JSObjectData {
 
   ObjectData* bound_target_function() const { return bound_target_function_; }
   ObjectData* bound_this() const { return bound_this_; }
-  FixedArrayData* bound_arguments() const { return bound_arguments_; }
+  ObjectData* bound_arguments() const { return bound_arguments_; }
 
  private:
   bool serialized_ = false;
 
   ObjectData* bound_target_function_ = nullptr;
   ObjectData* bound_this_ = nullptr;
-  FixedArrayData* bound_arguments_ = nullptr;
+  ObjectData* bound_arguments_ = nullptr;
 };
 
 class JSFunctionData : public JSObjectData {
@@ -537,7 +611,7 @@ class JSFunctionData : public JSObjectData {
 
   ContextData* context() const { return context_; }
   NativeContextData* native_context() const { return native_context_; }
-  MapData* initial_map() const { return initial_map_; }
+  ObjectData* initial_map() const { return initial_map_; }
   ObjectData* prototype() const { return prototype_; }
   SharedFunctionInfoData* shared() const { return shared_; }
   FeedbackVectorData* feedback_vector() const { return feedback_vector_; }
@@ -556,7 +630,7 @@ class JSFunctionData : public JSObjectData {
 
   ContextData* context_ = nullptr;
   NativeContextData* native_context_ = nullptr;
-  MapData* initial_map_ = nullptr;
+  ObjectData* initial_map_ = nullptr;
   ObjectData* prototype_ = nullptr;
   SharedFunctionInfoData* shared_ = nullptr;
   FeedbackVectorData* feedback_vector_ = nullptr;
@@ -1102,10 +1176,19 @@ HeapObjectData::HeapObjectData(JSHeapBroker* broker, ObjectData** storage,
       // instance_type_ member. In the case of constructing the MapData for the
       // meta map (whose map is itself), this member has not yet been
       // initialized.
-      map_(static_cast<MapData*>(broker->GetOrCreateData(object->map()))) {
+      map_(broker->GetOrCreateData(object->map())) {
   CHECK(broker->SerializingAllowed());
 }
 
+InstanceType HeapObjectData::GetMapInstanceType() const {
+  ObjectData* map_data = map();
+  if (map_data->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(kind());
+    return Handle<Map>::cast(map_data->object())->instance_type();
+  }
+  return map_data->AsMap()->instance_type();
+}
+
 namespace {
 bool IsReadOnlyLengthDescriptor(Isolate* isolate, Handle<Map> jsarray_map) {
   DCHECK(!jsarray_map->is_dictionary_map());
@@ -1201,14 +1284,16 @@ void JSFunctionData::Serialize(JSHeapBroker* broker) {
   if (initial_map_ != nullptr) {
     initial_map_instance_size_with_min_slack_ =
         function->ComputeInstanceSizeWithMinSlack(broker->isolate());
-    if (initial_map_->instance_type() == JS_ARRAY_TYPE) {
-      initial_map_->SerializeElementsKindGeneralizations(broker);
+  }
+  if (initial_map_ != nullptr && !initial_map_->should_access_heap()) {
+    if (initial_map_->AsMap()->instance_type() == JS_ARRAY_TYPE) {
+      initial_map_->AsMap()->SerializeElementsKindGeneralizations(broker);
     }
-    initial_map_->SerializeConstructor(broker);
+    initial_map_->AsMap()->SerializeConstructor(broker);
     // TODO(neis): This is currently only needed for native_context's
     // object_function, as used by GetObjectCreateMap. If no further use sites
     // show up, we should move this into NativeContextData::Serialize.
-    initial_map_->SerializePrototype(broker);
+    initial_map_->AsMap()->SerializePrototype(broker);
   }
 }
 
@@ -1373,9 +1458,10 @@ void JSBoundFunctionData::Serialize(JSHeapBroker* broker) {
   }
 
   DCHECK_NULL(bound_arguments_);
-  bound_arguments_ =
-      broker->GetOrCreateData(function->bound_arguments())->AsFixedArray();
-  bound_arguments_->SerializeContents(broker);
+  bound_arguments_ = broker->GetOrCreateData(function->bound_arguments());
+  if (!bound_arguments_->should_access_heap()) {
+    bound_arguments_->AsFixedArray()->SerializeContents(broker);
+  }
 
   DCHECK_NULL(bound_this_);
   bound_this_ = broker->GetOrCreateData(function->bound_this());
@@ -1613,15 +1699,38 @@ class ScopeInfoData : public HeapObjectData {
                 Handle<ScopeInfo> object);
 
   int context_length() const { return context_length_; }
+  bool has_outer_scope_info() const { return has_outer_scope_info_; }
+  int flags() const { return flags_; }
+
+  ScopeInfoData* outer_scope_info() const { return outer_scope_info_; }
+  void SerializeScopeInfoChain(JSHeapBroker* broker);
 
  private:
   int const context_length_;
+  bool const has_outer_scope_info_;
+  int const flags_;
+
+  // Only serialized via SerializeScopeInfoChain.
+  ScopeInfoData* outer_scope_info_;
 };
 
 ScopeInfoData::ScopeInfoData(JSHeapBroker* broker, ObjectData** storage,
                              Handle<ScopeInfo> object)
     : HeapObjectData(broker, storage, object),
-      context_length_(object->ContextLength()) {}
+      context_length_(object->ContextLength()),
+      has_outer_scope_info_(object->HasOuterScopeInfo()),
+      flags_(object->Flags()),
+      outer_scope_info_(nullptr) {}
+
+void ScopeInfoData::SerializeScopeInfoChain(JSHeapBroker* broker) {
+  if (outer_scope_info_) return;
+  if (!has_outer_scope_info_) return;
+  outer_scope_info_ =
+      broker
+          ->GetOrCreateData(Handle<ScopeInfo>::cast(object())->OuterScopeInfo())
+          ->AsScopeInfo();
+  outer_scope_info_->SerializeScopeInfoChain(broker);
+}
 
 class SharedFunctionInfoData : public HeapObjectData {
  public:
@@ -1629,11 +1738,11 @@ class SharedFunctionInfoData : public HeapObjectData {
                          Handle<SharedFunctionInfo> object);
 
   int builtin_id() const { return builtin_id_; }
+  int context_header_size() const { return context_header_size_; }
   BytecodeArrayData* GetBytecodeArray() const { return GetBytecodeArray_; }
-  void SetSerializedForCompilation(JSHeapBroker* broker,
-                                   FeedbackVectorRef feedback);
-  bool IsSerializedForCompilation(FeedbackVectorRef feedback) const;
   void SerializeFunctionTemplateInfo(JSHeapBroker* broker);
+  ScopeInfoData* scope_info() const { return scope_info_; }
+  void SerializeScopeInfoChain(JSHeapBroker* broker);
   FunctionTemplateInfoData* function_template_info() const {
     return function_template_info_;
   }
@@ -1656,15 +1765,14 @@ class SharedFunctionInfoData : public HeapObjectData {
 
  private:
   int const builtin_id_;
+  int context_header_size_;
   BytecodeArrayData* const GetBytecodeArray_;
-  ZoneUnorderedSet<Handle<FeedbackVector>, Handle<FeedbackVector>::hash,
-                   Handle<FeedbackVector>::equal_to>
-      serialized_for_compilation_;
 #define DECL_MEMBER(type, name) type const name##_;
   BROKER_SFI_FIELDS(DECL_MEMBER)
 #undef DECL_MEMBER
   FunctionTemplateInfoData* function_template_info_;
   ZoneMap<int, JSArrayData*> template_objects_;
+  ScopeInfoData* scope_info_;
 };
 
 SharedFunctionInfoData::SharedFunctionInfoData(
@@ -1673,29 +1781,23 @@ SharedFunctionInfoData::SharedFunctionInfoData(
     : HeapObjectData(broker, storage, object),
       builtin_id_(object->HasBuiltinId() ? object->builtin_id()
                                          : Builtins::kNoBuiltinId),
+      context_header_size_(object->scope_info().ContextHeaderLength()),
       GetBytecodeArray_(
           object->HasBytecodeArray()
               ? broker->GetOrCreateData(object->GetBytecodeArray())
                     ->AsBytecodeArray()
-              : nullptr),
-      serialized_for_compilation_(broker->zone())
+              : nullptr)
 #define INIT_MEMBER(type, name) , name##_(object->name())
           BROKER_SFI_FIELDS(INIT_MEMBER)
 #undef INIT_MEMBER
       ,
       function_template_info_(nullptr),
-      template_objects_(broker->zone()) {
+      template_objects_(broker->zone()),
+      scope_info_(nullptr) {
   DCHECK_EQ(HasBuiltinId_, builtin_id_ != Builtins::kNoBuiltinId);
   DCHECK_EQ(HasBytecodeArray_, GetBytecodeArray_ != nullptr);
 }
 
-void SharedFunctionInfoData::SetSerializedForCompilation(
-    JSHeapBroker* broker, FeedbackVectorRef feedback) {
-  CHECK(serialized_for_compilation_.insert(feedback.object()).second);
-  TRACE(broker, "Set function " << this << " with " << feedback
-                                << " as serialized for compilation");
-}
-
 void SharedFunctionInfoData::SerializeFunctionTemplateInfo(
     JSHeapBroker* broker) {
   if (function_template_info_) return;
@@ -1708,10 +1810,14 @@ void SharedFunctionInfoData::SerializeFunctionTemplateInfo(
           ->AsFunctionTemplateInfo();
 }
 
-bool SharedFunctionInfoData::IsSerializedForCompilation(
-    FeedbackVectorRef feedback) const {
-  return serialized_for_compilation_.find(feedback.object()) !=
-         serialized_for_compilation_.end();
+void SharedFunctionInfoData::SerializeScopeInfoChain(JSHeapBroker* broker) {
+  if (scope_info_) return;
+  scope_info_ =
+      broker
+          ->GetOrCreateData(
+              Handle<SharedFunctionInfo>::cast(object())->scope_info())
+          ->AsScopeInfo();
+  scope_info_->SerializeScopeInfoChain(broker);
 }
 
 class SourceTextModuleData : public HeapObjectData {
@@ -1795,7 +1901,6 @@ class CellData : public HeapObjectData {
   ObjectData* value() { return value_; }
 
  private:
-  bool serialized_ = false;
   ObjectData* value_ = nullptr;
 };
 
@@ -1804,12 +1909,10 @@ CellData::CellData(JSHeapBroker* broker, ObjectData** storage,
     : HeapObjectData(broker, storage, object) {}
 
 void CellData::Serialize(JSHeapBroker* broker) {
-  if (serialized_) return;
-  serialized_ = true;
+  if (value_ != nullptr) return;
 
   TraceScope tracer(broker, this, "CellData::Serialize");
   auto cell = Handle<Cell>::cast(object());
-  DCHECK_NULL(value_);
   value_ = broker->GetOrCreateData(cell->value());
 }
 
@@ -1903,21 +2006,20 @@ class CodeData : public HeapObjectData {
       : HeapObjectData(broker, storage, object) {}
 };
 
-#define DEFINE_IS_AND_AS(Name)                                            \
-  bool ObjectData::Is##Name() const {                                     \
-    if (kind() == kUnserializedHeapObject) {                              \
-      AllowHandleDereference allow_handle_dereference;                    \
-      return object()->Is##Name();                                        \
-    }                                                                     \
-    if (is_smi()) return false;                                           \
-    InstanceType instance_type =                                          \
-        static_cast<const HeapObjectData*>(this)->map()->instance_type(); \
-    return InstanceTypeChecker::Is##Name(instance_type);                  \
-  }                                                                       \
-  Name##Data* ObjectData::As##Name() {                                    \
-    CHECK_EQ(kind(), kSerializedHeapObject);                              \
-    CHECK(Is##Name());                                                    \
-    return static_cast<Name##Data*>(this);                                \
+#define DEFINE_IS_AND_AS(Name)                                          \
+  bool ObjectData::Is##Name() const {                                   \
+    if (should_access_heap()) {                                         \
+      AllowHandleDereferenceIf allow_handle_dereference(kind());        \
+      return object()->Is##Name();                                      \
+    }                                                                   \
+    if (is_smi()) return false;                                         \
+    InstanceType instance_type =                                        \
+        static_cast<const HeapObjectData*>(this)->GetMapInstanceType(); \
+    return InstanceTypeChecker::Is##Name(instance_type);                \
+  }                                                                     \
+  Name##Data* ObjectData::As##Name() {                                  \
+    CHECK(Is##Name());                                                  \
+    return static_cast<Name##Data*>(this);                              \
   }
 HEAP_BROKER_OBJECT_LIST(DEFINE_IS_AND_AS)
 #undef DEFINE_IS_AND_AS
@@ -1931,7 +2033,7 @@ bool JSObjectData::cow_or_empty_elements_tenured() const {
   return cow_or_empty_elements_tenured_;
 }
 
-FixedArrayBaseData* JSObjectData::elements() const { return elements_; }
+ObjectData* JSObjectData::elements() const { return elements_; }
 
 void JSObjectData::SerializeAsBoilerplate(JSHeapBroker* broker) {
   SerializeRecursiveAsBoilerplate(broker, kMaxFastLiteralDepth);
@@ -1946,7 +2048,8 @@ void JSObjectData::SerializeElements(JSHeapBroker* broker) {
   Handle<FixedArrayBase> elements_object(boilerplate->elements(),
                                          broker->isolate());
   DCHECK_NULL(elements_);
-  elements_ = broker->GetOrCreateData(elements_object)->AsFixedArrayBase();
+  elements_ = broker->GetOrCreateData(elements_object);
+  DCHECK(elements_->IsFixedArrayBase());
 }
 
 void MapData::SerializeConstructor(JSHeapBroker* broker) {
@@ -1955,6 +2058,7 @@ void MapData::SerializeConstructor(JSHeapBroker* broker) {
 
   TraceScope tracer(broker, this, "MapData::SerializeConstructor");
   Handle<Map> map = Handle<Map>::cast(object());
+  DCHECK(!map->IsContextMap());
   DCHECK_NULL(constructor_);
   constructor_ = broker->GetOrCreateData(map->GetConstructor());
 }
@@ -1966,6 +2070,7 @@ void MapData::SerializeBackPointer(JSHeapBroker* broker) {
   TraceScope tracer(broker, this, "MapData::SerializeBackPointer");
   Handle<Map> map = Handle<Map>::cast(object());
   DCHECK_NULL(backpointer_);
+  DCHECK(!map->IsContextMap());
   backpointer_ = broker->GetOrCreateData(map->GetBackPointer())->AsHeapObject();
 }
 
@@ -1986,8 +2091,7 @@ void MapData::SerializeOwnDescriptors(JSHeapBroker* broker) {
   TraceScope tracer(broker, this, "MapData::SerializeOwnDescriptors");
   Handle<Map> map = Handle<Map>::cast(object());
 
-  int const number_of_own = map->NumberOfOwnDescriptors();
-  for (InternalIndex i : InternalIndex::Range(number_of_own)) {
+  for (InternalIndex i : map->IterateOwnDescriptors()) {
     SerializeOwnDescriptor(broker, i);
   }
 }
@@ -2099,9 +2203,10 @@ void JSObjectData::SerializeRecursiveAsBoilerplate(JSHeapBroker* broker,
   }
 
   DCHECK_NULL(elements_);
-  elements_ = broker->GetOrCreateData(elements_object)->AsFixedArrayBase();
+  elements_ = broker->GetOrCreateData(elements_object);
+  DCHECK(elements_->IsFixedArrayBase());
 
-  if (empty_or_cow) {
+  if (empty_or_cow || elements_->should_access_heap()) {
     // No need to do anything here. Empty or copy-on-write elements
     // do not need to be serialized because we only need to store the elements
     // reference to the allocated object.
@@ -2172,7 +2277,9 @@ void JSObjectData::SerializeRecursiveAsBoilerplate(JSHeapBroker* broker,
   }
   TRACE(broker, "Copied " << inobject_fields_.size() << " in-object fields");
 
-  map()->SerializeOwnDescriptors(broker);
+  if (!map()->should_access_heap()) {
+    map()->AsMap()->SerializeOwnDescriptors(broker);
+  }
 
   if (IsJSArray()) AsJSArray()->Serialize(broker);
 }
@@ -2209,9 +2316,11 @@ Isolate* ObjectRef::isolate() const { return broker()->isolate(); }
 ContextRef ContextRef::previous(size_t* depth,
                                 SerializationPolicy policy) const {
   DCHECK_NOT_NULL(depth);
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     Context current = *object();
     while (*depth != 0 && current.unchecked_previous().IsContext()) {
       current = Context::cast(current.unchecked_previous());
@@ -2225,9 +2334,11 @@ ContextRef ContextRef::previous(size_t* depth,
 
 base::Optional<ObjectRef> ContextRef::get(int index,
                                           SerializationPolicy policy) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     Handle<Object> value(object()->get(index), broker()->isolate());
     return ObjectRef(broker(), value);
   }
@@ -2240,18 +2351,20 @@ base::Optional<ObjectRef> ContextRef::get(int index,
 }
 
 JSHeapBroker::JSHeapBroker(Isolate* isolate, Zone* broker_zone,
-                           bool tracing_enabled)
+                           bool tracing_enabled, bool is_concurrent_inlining)
     : isolate_(isolate),
-      broker_zone_(broker_zone),
-      current_zone_(broker_zone),
+      zone_(broker_zone),
       refs_(new (zone())
                 RefsMap(kMinimalRefsBucketCount, AddressMatcher(), zone())),
+      root_index_map_(isolate),
       array_and_object_prototypes_(zone()),
       tracing_enabled_(tracing_enabled),
+      is_concurrent_inlining_(is_concurrent_inlining),
       feedback_(zone()),
       bytecode_analyses_(zone()),
       property_access_infos_(zone()),
-      typed_array_string_tags_(zone()) {
+      typed_array_string_tags_(zone()),
+      serialized_functions_(zone()) {
   // Note that this initialization of {refs_} with the minimal initial capacity
   // is redundant in the normal use case (concurrent compilation enabled,
   // standard objects to be serialized), as the map is going to be replaced
@@ -2314,10 +2427,14 @@ void JSHeapBroker::PrintRefsAnalysis() const {
           break;
       }
     } else {
-      InstanceType instance_type =
-          static_cast<const HeapObjectData*>(ref->value)
-              ->map()
-              ->instance_type();
+      InstanceType instance_type;
+      if (ref->value->should_access_heap()) {
+        instance_type = Handle<HeapObject>::cast(ref->value->object())
+                            ->map()
+                            .instance_type();
+      } else {
+        instance_type = ref->value->AsHeapObject()->GetMapInstanceType();
+      }
       CHECK_LE(FIRST_TYPE, instance_type);
       CHECK_LE(instance_type, LAST_TYPE);
       switch (ref->value->used_status) {
@@ -2374,96 +2491,6 @@ void JSHeapBroker::SetTargetNativeContextRef(
   target_native_context_ = NativeContextRef(this, native_context);
 }
 
-bool IsShareable(Handle<Object> object, Isolate* isolate) {
-  int index;
-  RootIndex root_index;
-  bool is_builtin_handle =
-      object->IsHeapObject() && isolate->builtins()->IsBuiltinHandle(
-                                    Handle<HeapObject>::cast(object), &index);
-  return is_builtin_handle ||
-         isolate->roots_table().IsRootHandle(object, &root_index);
-}
-
-void JSHeapBroker::InitializeRefsMap() {
-  TraceScope tracer(this, "JSHeapBroker::InitializeRefsMap");
-
-  DCHECK_NULL(compiler_cache_);
-  PerIsolateCompilerCache::Setup(isolate());
-  compiler_cache_ = isolate()->compiler_cache();
-
-  if (compiler_cache_->HasSnapshot()) {
-    TRACE(this, "Importing existing RefsMap snapshot");
-    DCHECK_NULL(refs_);
-    refs_ = new (zone()) RefsMap(compiler_cache_->GetSnapshot(), zone());
-    return;
-  }
-
-  TRACE(this, "Building RefsMap snapshot");
-  DCHECK_NULL(refs_);
-  refs_ =
-      new (zone()) RefsMap(kInitialRefsBucketCount, AddressMatcher(), zone());
-
-  // Temporarily use the "compiler zone" for serialization, such that the
-  // serialized data survives this compilation.
-  DCHECK_EQ(current_zone_, broker_zone_);
-  current_zone_ = compiler_cache_->zone();
-
-  // Serialize various builtins.
-  Builtins* const b = isolate()->builtins();
-  {
-    Builtins::Name builtins[] = {
-        Builtins::kAllocateInYoungGeneration,
-        Builtins::kAllocateRegularInYoungGeneration,
-        Builtins::kAllocateInOldGeneration,
-        Builtins::kAllocateRegularInOldGeneration,
-        Builtins::kArgumentsAdaptorTrampoline,
-        Builtins::kArrayConstructorImpl,
-        Builtins::kArrayIncludesHoleyDoubles,
-        Builtins::kArrayIncludesPackedDoubles,
-        Builtins::kArrayIncludesSmiOrObject,
-        Builtins::kArrayIndexOfHoleyDoubles,
-        Builtins::kArrayIndexOfPackedDoubles,
-        Builtins::kArrayIndexOfSmiOrObject,
-        Builtins::kCallApiCallback,
-        Builtins::kCallFunctionForwardVarargs,
-        Builtins::kCallFunction_ReceiverIsAny,
-        Builtins::kCallFunction_ReceiverIsNotNullOrUndefined,
-        Builtins::kCallFunction_ReceiverIsNullOrUndefined,
-        Builtins::kCloneFastJSArray,
-        Builtins::kCompileLazy,
-        Builtins::kConstructFunctionForwardVarargs,
-        Builtins::kForInFilter,
-        Builtins::kGetProperty,
-        Builtins::kIncBlockCounter,
-        Builtins::kJSBuiltinsConstructStub,
-        Builtins::kJSConstructStubGeneric,
-        Builtins::kStringAdd_CheckNone,
-        Builtins::kStringAddConvertLeft,
-        Builtins::kStringAddConvertRight,
-        Builtins::kToNumber,
-        Builtins::kToObject,
-    };
-    for (auto id : builtins) {
-      GetOrCreateData(b->builtin_handle(id));
-    }
-  }
-  for (int32_t id = 0; id < Builtins::builtin_count; ++id) {
-    if (Builtins::KindOf(id) == Builtins::TFJ) {
-      GetOrCreateData(b->builtin_handle(id));
-    }
-  }
-
-  // TODO(mslekova): Serialize root objects (from factory).
-
-  // Verify.
-  for (RefsMap::Entry* p = refs_->Start(); p != nullptr; p = refs_->Next(p)) {
-    CHECK(IsShareable(p->value->object(), isolate()));
-  }
-
-  compiler_cache()->SetSnapshot(refs_);
-  current_zone_ = broker_zone_;
-}
-
 void JSHeapBroker::CollectArrayAndObjectPrototypes() {
   DisallowHeapAllocation no_gc;
   CHECK_EQ(mode(), kSerializing);
@@ -2502,6 +2529,40 @@ StringRef JSHeapBroker::GetTypedArrayStringTag(ElementsKind kind) {
   return StringRef(this, typed_array_string_tags_[idx]);
 }
 
+bool JSHeapBroker::ShouldBeSerializedForCompilation(
+    const SharedFunctionInfoRef& shared, const FeedbackVectorRef& feedback,
+    const HintsVector& arguments) const {
+  if (serialized_functions_.size() >= kMaxSerializedFunctionsCacheSize) {
+    TRACE_BROKER_MISSING(this,
+                         "opportunity - serialized functions cache is full.");
+    return false;
+  }
+  SerializedFunction function{shared, feedback};
+  auto matching_functions = serialized_functions_.equal_range(function);
+  return std::find_if(matching_functions.first, matching_functions.second,
+                      [&arguments](const auto& entry) {
+                        return entry.second == arguments;
+                      }) == matching_functions.second;
+}
+
+void JSHeapBroker::SetSerializedForCompilation(
+    const SharedFunctionInfoRef& shared, const FeedbackVectorRef& feedback,
+    const HintsVector& arguments) {
+  SerializedFunction function{shared, feedback};
+  serialized_functions_.insert({function, arguments});
+  TRACE(this, "Set function " << shared << " with " << feedback
+                              << " as serialized for compilation");
+}
+
+bool JSHeapBroker::IsSerializedForCompilation(
+    const SharedFunctionInfoRef& shared,
+    const FeedbackVectorRef& feedback) const {
+  if (mode() == kDisabled) return true;
+
+  SerializedFunction function = {shared, feedback};
+  return serialized_functions_.find(function) != serialized_functions_.end();
+}
+
 bool JSHeapBroker::IsArrayOrObjectPrototype(const JSObjectRef& object) const {
   if (mode() == kDisabled) {
     return isolate()->IsInAnyContext(*object.object(),
@@ -2525,7 +2586,8 @@ void JSHeapBroker::InitializeAndStartSerializing(
   refs_->Clear();
   refs_ = nullptr;
 
-  InitializeRefsMap();
+  refs_ =
+      new (zone()) RefsMap(kInitialRefsBucketCount, AddressMatcher(), zone());
 
   SetTargetNativeContextRef(native_context);
   target_native_context().Serialize();
@@ -2533,65 +2595,8 @@ void JSHeapBroker::InitializeAndStartSerializing(
   CollectArrayAndObjectPrototypes();
   SerializeTypedArrayStringTags();
 
-  // Serialize standard objects.
-  //
-  // - Maps, strings, oddballs
+  // Serialize Cells
   Factory* const f = isolate()->factory();
-  GetOrCreateData(f->arguments_marker_map());
-  GetOrCreateData(f->bigint_string());
-  GetOrCreateData(f->block_context_map());
-  GetOrCreateData(f->boolean_map());
-  GetOrCreateData(f->boolean_string());
-  GetOrCreateData(f->catch_context_map());
-  GetOrCreateData(f->empty_fixed_array());
-  GetOrCreateData(f->empty_string());
-  GetOrCreateData(f->eval_context_map());
-  GetOrCreateData(f->exec_string());
-  GetOrCreateData(f->false_string());
-  GetOrCreateData(f->false_value());
-  GetOrCreateData(f->fixed_array_map());
-  GetOrCreateData(f->fixed_cow_array_map());
-  GetOrCreateData(f->fixed_double_array_map());
-  GetOrCreateData(f->function_context_map());
-  GetOrCreateData(f->function_string());
-  GetOrCreateData(f->has_instance_symbol());
-  GetOrCreateData(f->heap_number_map());
-  GetOrCreateData(f->length_string());
-  GetOrCreateData(f->many_closures_cell_map());
-  GetOrCreateData(f->minus_zero_value());
-  GetOrCreateData(f->name_dictionary_map());
-  GetOrCreateData(f->name_string());
-  GetOrCreateData(f->NaN_string());
-  GetOrCreateData(f->null_map());
-  GetOrCreateData(f->null_string());
-  GetOrCreateData(f->null_value());
-  GetOrCreateData(f->number_string());
-  GetOrCreateData(f->object_string());
-  GetOrCreateData(f->one_pointer_filler_map());
-  GetOrCreateData(f->optimized_out());
-  GetOrCreateData(f->optimized_out_map());
-  GetOrCreateData(f->property_array_map());
-  GetOrCreateData(f->prototype_string());
-  GetOrCreateData(f->ReflectHas_string());
-  GetOrCreateData(f->ReflectGet_string());
-  GetOrCreateData(f->sloppy_arguments_elements_map());
-  GetOrCreateData(f->stale_register());
-  GetOrCreateData(f->stale_register_map());
-  GetOrCreateData(f->string_string());
-  GetOrCreateData(f->symbol_string());
-  GetOrCreateData(f->termination_exception_map());
-  GetOrCreateData(f->the_hole_map());
-  GetOrCreateData(f->the_hole_value());
-  GetOrCreateData(f->then_string());
-  GetOrCreateData(f->true_string());
-  GetOrCreateData(f->true_value());
-  GetOrCreateData(f->undefined_map());
-  GetOrCreateData(f->undefined_string());
-  GetOrCreateData(f->undefined_value());
-  GetOrCreateData(f->uninitialized_map());
-  GetOrCreateData(f->with_context_map());
-  GetOrCreateData(f->zero_string());
-  // - Cells
   GetOrCreateData(f->array_buffer_detaching_protector())
       ->AsPropertyCell()
       ->Serialize(this);
@@ -2627,24 +2632,22 @@ void JSHeapBroker::InitializeAndStartSerializing(
   TRACE(this, "Finished serializing standard objects");
 }
 
-ObjectData* JSHeapBroker::GetData(Handle<Object> object) const {
-  RefsMap::Entry* entry = refs_->Lookup(object.address());
-  return entry ? entry->value : nullptr;
-}
-
 // clang-format off
 ObjectData* JSHeapBroker::GetOrCreateData(Handle<Object> object) {
-  CHECK(SerializingAllowed());
   RefsMap::Entry* entry = refs_->LookupOrInsert(object.address(), zone());
   ObjectData** data_storage = &(entry->value);
   if (*data_storage == nullptr) {
     // TODO(neis): Remove these Allow* once we serialize everything upfront.
-    AllowHandleAllocation handle_allocation;
     AllowHandleDereference handle_dereference;
     if (object->IsSmi()) {
       new (zone()) ObjectData(this, data_storage, object, kSmi);
+    } else if (IsReadOnlyHeapObject(*object)) {
+      new (zone()) ObjectData(this, data_storage, object,
+                              kUnserializedReadOnlyHeapObject);
 #define CREATE_DATA_IF_MATCH(name)                                             \
     } else if (object->Is##name()) {                                           \
+      CHECK(SerializingAllowed());                                             \
+      AllowHandleAllocation handle_allocation;                                 \
       new (zone()) name##Data(this, data_storage, Handle<name>::cast(object));
     HEAP_BROKER_OBJECT_LIST(CREATE_DATA_IF_MATCH)
 #undef CREATE_DATA_IF_MATCH
@@ -2679,10 +2682,14 @@ int ObjectRef::AsSmi() const {
 }
 
 base::Optional<MapRef> JSObjectRef::GetObjectCreateMap() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
-    AllowHeapAllocation heap_allocation;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
+    AllowHeapAllocationIf allow_heap_allocation(data()->kind(),
+                                                broker()->mode());
     Handle<Map> instance_map;
     if (Map::TryGetObjectCreateMap(broker()->isolate(), object())
             .ToHandle(&instance_map)) {
@@ -2691,9 +2698,12 @@ base::Optional<MapRef> JSObjectRef::GetObjectCreateMap() const {
       return base::Optional<MapRef>();
     }
   }
-  MapData* map_data = data()->AsJSObject()->object_create_map(broker());
-  return map_data != nullptr ? MapRef(broker(), map_data)
-                             : base::Optional<MapRef>();
+  ObjectData* map_data = data()->AsJSObject()->object_create_map(broker());
+  if (map_data == nullptr) return base::Optional<MapRef>();
+  if (map_data->should_access_heap()) {
+    return MapRef(broker(), map_data->object());
+  }
+  return MapRef(broker(), map_data->AsMap());
 }
 
 #define DEF_TESTER(Type, ...)                              \
@@ -2704,10 +2714,13 @@ INSTANCE_TYPE_CHECKERS(DEF_TESTER)
 #undef DEF_TESTER
 
 base::Optional<MapRef> MapRef::AsElementsKind(ElementsKind kind) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHeapAllocation heap_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHeapAllocationIf allow_heap_allocation(data()->kind(),
+                                                broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return MapRef(broker(),
                   Map::AsElementsKind(broker()->isolate(), object(), kind));
   }
@@ -2723,11 +2736,13 @@ base::Optional<MapRef> MapRef::AsElementsKind(ElementsKind kind) const {
 
 void MapRef::SerializeForElementLoad() {
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
+  if (data()->kind() == ObjectDataKind::kUnserializedReadOnlyHeapObject) return;
   data()->AsMap()->SerializeForElementLoad(broker());
 }
 
 void MapRef::SerializeForElementStore() {
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
+  if (data()->kind() == ObjectDataKind::kUnserializedReadOnlyHeapObject) return;
   data()->AsMap()->SerializeForElementStore(broker());
 }
 
@@ -2784,27 +2799,34 @@ bool MapRef::HasOnlyStablePrototypesWithFastElements(
 }
 
 bool MapRef::supports_fast_array_iteration() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
-    AllowHandleAllocation handle_allocation;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
     return SupportsFastArrayIteration(broker()->isolate(), object());
   }
   return data()->AsMap()->supports_fast_array_iteration();
 }
 
 bool MapRef::supports_fast_array_resize() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
-    AllowHandleAllocation handle_allocation;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
     return SupportsFastArrayResize(broker()->isolate(), object());
   }
   return data()->AsMap()->supports_fast_array_resize();
 }
 
 int JSFunctionRef::InitialMapInstanceSizeWithMinSlack() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
-    AllowHandleAllocation handle_allocation;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
     return object()->ComputeInstanceSizeWithMinSlack(broker()->isolate());
   }
   return data()->AsJSFunction()->initial_map_instance_size_with_min_slack();
@@ -2813,8 +2835,10 @@ int JSFunctionRef::InitialMapInstanceSizeWithMinSlack() const {
 // Not needed for TypedLowering.
 base::Optional<ScriptContextTableRef::LookupResult>
 ScriptContextTableRef::lookup(const NameRef& name) const {
-  AllowHandleAllocation handle_allocation;
-  AllowHandleDereference handle_dereference;
+  AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                  broker()->mode());
+  AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                    broker()->mode());
   if (!name.IsString()) return {};
   ScriptContextTable::LookupResult lookup_result;
   auto table = object();
@@ -2858,9 +2882,12 @@ OddballType MapRef::oddball_type() const {
 }
 
 FeedbackCellRef FeedbackVectorRef::GetClosureFeedbackCell(int index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return FeedbackCellRef(broker(), object()->GetClosureFeedbackCell(index));
   }
 
@@ -2870,8 +2897,10 @@ FeedbackCellRef FeedbackVectorRef::GetClosureFeedbackCell(int index) const {
 }
 
 double JSObjectRef::RawFastDoublePropertyAt(FieldIndex index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->RawFastDoublePropertyAt(index);
   }
   JSObjectData* object_data = data()->AsJSObject();
@@ -2880,8 +2909,10 @@ double JSObjectRef::RawFastDoublePropertyAt(FieldIndex index) const {
 }
 
 uint64_t JSObjectRef::RawFastDoublePropertyAsBitsAt(FieldIndex index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->RawFastDoublePropertyAsBitsAt(index);
   }
   JSObjectData* object_data = data()->AsJSObject();
@@ -2890,9 +2921,12 @@ uint64_t JSObjectRef::RawFastDoublePropertyAsBitsAt(FieldIndex index) const {
 }
 
 ObjectRef JSObjectRef::RawFastPropertyAt(FieldIndex index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return ObjectRef(broker(), handle(object()->RawFastPropertyAt(index),
                                       broker()->isolate()));
   }
@@ -2904,10 +2938,14 @@ ObjectRef JSObjectRef::RawFastPropertyAt(FieldIndex index) const {
 }
 
 bool AllocationSiteRef::IsFastLiteral() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHeapAllocation allow_heap_allocation;  // For TryMigrateInstance.
-    AllowHandleAllocation allow_handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHeapAllocationIf allow_heap_allocation(
+        data()->kind(), broker()->mode());  // For TryMigrateInstance.
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return IsInlinableFastLiteral(
         handle(object()->boilerplate(), broker()->isolate()));
   }
@@ -2925,10 +2963,14 @@ void JSObjectRef::SerializeElements() {
 }
 
 void JSObjectRef::EnsureElementsTenured() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation allow_handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
-    AllowHeapAllocation allow_heap_allocation;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
+    AllowHeapAllocationIf allow_heap_allocation(data()->kind(),
+                                                broker()->mode());
 
     Handle<FixedArrayBase> object_elements = elements().object();
     if (ObjectInYoungGeneration(*object_elements)) {
@@ -2946,8 +2988,9 @@ void JSObjectRef::EnsureElementsTenured() {
 }
 
 FieldIndex MapRef::GetFieldIndexFor(InternalIndex descriptor_index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return FieldIndex::ForDescriptor(*object(), descriptor_index);
   }
   DescriptorArrayData* descriptors = data()->AsMap()->instance_descriptors();
@@ -2955,8 +2998,9 @@ FieldIndex MapRef::GetFieldIndexFor(InternalIndex descriptor_index) const {
 }
 
 int MapRef::GetInObjectPropertyOffset(int i) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->GetInObjectPropertyOffset(i);
   }
   return (GetInObjectPropertiesStartInWords() + i) * kTaggedSize;
@@ -2964,8 +3008,9 @@ int MapRef::GetInObjectPropertyOffset(int i) const {
 
 PropertyDetails MapRef::GetPropertyDetails(
     InternalIndex descriptor_index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->instance_descriptors().GetDetails(descriptor_index);
   }
   DescriptorArrayData* descriptors = data()->AsMap()->instance_descriptors();
@@ -2973,9 +3018,11 @@ PropertyDetails MapRef::GetPropertyDetails(
 }
 
 NameRef MapRef::GetPropertyKey(InternalIndex descriptor_index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return NameRef(
         broker(),
         handle(object()->instance_descriptors().GetKey(descriptor_index),
@@ -2997,9 +3044,11 @@ bool MapRef::IsPrimitiveMap() const {
 }
 
 MapRef MapRef::FindFieldOwner(InternalIndex descriptor_index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     Handle<Map> owner(
         object()->FindFieldOwner(broker()->isolate(), descriptor_index),
         broker()->isolate());
@@ -3012,9 +3061,11 @@ MapRef MapRef::FindFieldOwner(InternalIndex descriptor_index) const {
 }
 
 ObjectRef MapRef::GetFieldType(InternalIndex descriptor_index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     Handle<FieldType> field_type(
         object()->instance_descriptors().GetFieldType(descriptor_index),
         broker()->isolate());
@@ -3027,8 +3078,9 @@ ObjectRef MapRef::GetFieldType(InternalIndex descriptor_index) const {
 }
 
 bool MapRef::IsUnboxedDoubleField(InternalIndex descriptor_index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->IsUnboxedDoubleField(
         FieldIndex::ForDescriptor(*object(), descriptor_index));
   }
@@ -3039,18 +3091,22 @@ bool MapRef::IsUnboxedDoubleField(InternalIndex descriptor_index) const {
 }
 
 uint16_t StringRef::GetFirstChar() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->Get(0);
   }
   return data()->AsString()->first_char();
 }
 
 base::Optional<double> StringRef::ToNumber() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
-    AllowHandleAllocation allow_handle_allocation;
-    AllowHeapAllocation allow_heap_allocation;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHeapAllocationIf allow_heap_allocation(data()->kind(),
+                                                broker()->mode());
     int flags = ALLOW_HEX | ALLOW_OCTAL | ALLOW_BINARY;
     return StringToDouble(broker()->isolate(), object(), flags);
   }
@@ -3058,41 +3114,47 @@ base::Optional<double> StringRef::ToNumber() {
 }
 
 int ArrayBoilerplateDescriptionRef::constants_elements_length() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->constant_elements().length();
   }
   return data()->AsArrayBoilerplateDescription()->constants_elements_length();
 }
 
 int ObjectBoilerplateDescriptionRef::size() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->size();
   }
   return data()->AsObjectBoilerplateDescription()->size();
 }
 
 ObjectRef FixedArrayRef::get(int i) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return ObjectRef(broker(), handle(object()->get(i), broker()->isolate()));
   }
   return ObjectRef(broker(), data()->AsFixedArray()->Get(i));
 }
 
 bool FixedDoubleArrayRef::is_the_hole(int i) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->is_the_hole(i);
   }
   return data()->AsFixedDoubleArray()->Get(i).is_hole_nan();
 }
 
 double FixedDoubleArrayRef::get_scalar(int i) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->get_scalar(i);
   }
   CHECK(!data()->AsFixedDoubleArray()->Get(i).is_hole_nan());
@@ -3100,27 +3162,36 @@ double FixedDoubleArrayRef::get_scalar(int i) const {
 }
 
 uint8_t BytecodeArrayRef::get(int index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->get(index);
   }
   return data()->AsBytecodeArray()->get(index);
 }
 
 Address BytecodeArrayRef::GetFirstBytecodeAddress() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->GetFirstBytecodeAddress();
   }
   return data()->AsBytecodeArray()->GetFirstBytecodeAddress();
 }
 
 Handle<Object> BytecodeArrayRef::GetConstantAtIndex(int index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return handle(object()->constant_pool().get(index), broker()->isolate());
   }
   return data()->AsBytecodeArray()->GetConstantAtIndex(index,
@@ -3128,47 +3199,60 @@ Handle<Object> BytecodeArrayRef::GetConstantAtIndex(int index) const {
 }
 
 bool BytecodeArrayRef::IsConstantAtIndexSmi(int index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->constant_pool().get(index).IsSmi();
   }
   return data()->AsBytecodeArray()->IsConstantAtIndexSmi(index);
 }
 
 Smi BytecodeArrayRef::GetConstantAtIndexAsSmi(int index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return Smi::cast(object()->constant_pool().get(index));
   }
   return data()->AsBytecodeArray()->GetConstantAtIndexAsSmi(index);
 }
 
 void BytecodeArrayRef::SerializeForCompilation() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+  if (data_->should_access_heap()) return;
   data()->AsBytecodeArray()->SerializeForCompilation(broker());
 }
 
 const byte* BytecodeArrayRef::source_positions_address() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->SourcePositionTableIfCollected().GetDataStartAddress();
   }
   return data()->AsBytecodeArray()->source_positions_address();
 }
 
 int BytecodeArrayRef::source_positions_size() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->SourcePositionTableIfCollected().length();
   }
   return static_cast<int>(data()->AsBytecodeArray()->source_positions_size());
 }
 
 Address BytecodeArrayRef::handler_table_address() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return reinterpret_cast<Address>(
         object()->handler_table().GetDataStartAddress());
   }
@@ -3176,47 +3260,71 @@ Address BytecodeArrayRef::handler_table_address() const {
 }
 
 int BytecodeArrayRef::handler_table_size() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->handler_table().length();
   }
   return data()->AsBytecodeArray()->handler_table_size();
 }
 
-#define IF_BROKER_DISABLED_ACCESS_HANDLE_C(holder, name) \
-  if (broker()->mode() == JSHeapBroker::kDisabled) {     \
-    AllowHandleAllocation handle_allocation;             \
-    AllowHandleDereference allow_handle_dereference;     \
-    return object()->name();                             \
-  }
-
-#define IF_BROKER_DISABLED_ACCESS_HANDLE(holder, result, name)         \
-  if (broker()->mode() == JSHeapBroker::kDisabled) {                   \
-    AllowHandleAllocation handle_allocation;                           \
-    AllowHandleDereference allow_handle_dereference;                   \
-    return result##Ref(broker(),                                       \
-                       handle(object()->name(), broker()->isolate())); \
+Handle<Object> JSHeapBroker::GetRootHandle(Object object) {
+  RootIndex root_index;
+  CHECK(root_index_map().Lookup(object.ptr(), &root_index));
+  return Handle<Object>(isolate()->root_handle(root_index).location());
+}
+
+#define IF_ACCESS_FROM_HEAP_C(holder, name)                              \
+  if (data_->should_access_heap()) {                                     \
+    CHECK(broker()->mode() == JSHeapBroker::kDisabled ||                 \
+          ReadOnlyHeap::Contains(HeapObject::cast(*object())));          \
+    AllowHandleAllocationIf handle_allocation(data_->kind(),             \
+                                              broker()->mode());         \
+    AllowHandleDereferenceIf allow_handle_dereference(data_->kind(),     \
+                                                      broker()->mode()); \
+    return object()->name();                                             \
+  }
+
+#define IF_ACCESS_FROM_HEAP(holder, result, name)                            \
+  if (data_->kind() == ObjectDataKind::kUnserializedHeapObject) {            \
+    AllowHandleAllocationIf handle_allocation(data_->kind(),                 \
+                                              broker()->mode());             \
+    AllowHandleDereferenceIf handle_dereference(data_->kind(),               \
+                                                broker()->mode());           \
+    return result##Ref(broker(),                                             \
+                       handle(object()->name(), broker()->isolate()));       \
+  } else if (data_->kind() ==                                                \
+             ObjectDataKind::kUnserializedReadOnlyHeapObject) {              \
+    AllowHandleDereferenceIf handle_dereference(data_->kind(),               \
+                                                broker()->mode());           \
+    return result##Ref(broker(), broker()->GetRootHandle(object()->name())); \
   }
 
 // Macros for definining a const getter that, depending on the broker mode,
 // either looks into the handle or into the serialized data.
-#define BIMODAL_ACCESSOR(holder, result, name)                             \
-  result##Ref holder##Ref::name() const {                                  \
-    IF_BROKER_DISABLED_ACCESS_HANDLE(holder, result, name);                \
-    return result##Ref(broker(), ObjectRef::data()->As##holder()->name()); \
+#define BIMODAL_ACCESSOR(holder, result, name)                               \
+  result##Ref holder##Ref::name() const {                                    \
+    IF_ACCESS_FROM_HEAP(holder, result, name);                               \
+    ObjectData* data = ObjectRef::data()->As##holder()->name();              \
+    if (data->kind() == ObjectDataKind::kUnserializedHeapObject) {           \
+      return result##Ref(broker(), data->object());                          \
+    } else {                                                                 \
+      return result##Ref(broker(), ObjectRef::data()->As##holder()->name()); \
+    }                                                                        \
   }
 
 // Like above except that the result type is not an XYZRef.
-#define BIMODAL_ACCESSOR_C(holder, result, name)      \
-  result holder##Ref::name() const {                  \
-    IF_BROKER_DISABLED_ACCESS_HANDLE_C(holder, name); \
-    return ObjectRef::data()->As##holder()->name();   \
+#define BIMODAL_ACCESSOR_C(holder, result, name)    \
+  result holder##Ref::name() const {                \
+    IF_ACCESS_FROM_HEAP_C(holder, name);            \
+    return ObjectRef::data()->As##holder()->name(); \
   }
 
 // Like above but for BitFields.
 #define BIMODAL_ACCESSOR_B(holder, field, name, BitField)              \
   typename BitField::FieldType holder##Ref::name() const {             \
-    IF_BROKER_DISABLED_ACCESS_HANDLE_C(holder, name);                  \
+    IF_ACCESS_FROM_HEAP_C(holder, name);                               \
     return BitField::decode(ObjectRef::data()->As##holder()->field()); \
   }
 
@@ -3263,22 +3371,25 @@ BIMODAL_ACCESSOR_C(JSTypedArray, bool, is_on_heap)
 BIMODAL_ACCESSOR_C(JSTypedArray, size_t, length)
 BIMODAL_ACCESSOR(JSTypedArray, HeapObject, buffer)
 
-BIMODAL_ACCESSOR_B(Map, bit_field2, elements_kind, Map::ElementsKindBits)
-BIMODAL_ACCESSOR_B(Map, bit_field3, is_dictionary_map, Map::IsDictionaryMapBit)
-BIMODAL_ACCESSOR_B(Map, bit_field3, is_deprecated, Map::IsDeprecatedBit)
+BIMODAL_ACCESSOR_B(Map, bit_field2, elements_kind, Map::Bits2::ElementsKindBits)
+BIMODAL_ACCESSOR_B(Map, bit_field3, is_dictionary_map,
+                   Map::Bits3::IsDictionaryMapBit)
+BIMODAL_ACCESSOR_B(Map, bit_field3, is_deprecated, Map::Bits3::IsDeprecatedBit)
 BIMODAL_ACCESSOR_B(Map, bit_field3, NumberOfOwnDescriptors,
-                   Map::NumberOfOwnDescriptorsBits)
+                   Map::Bits3::NumberOfOwnDescriptorsBits)
 BIMODAL_ACCESSOR_B(Map, bit_field3, is_migration_target,
-                   Map::IsMigrationTargetBit)
-BIMODAL_ACCESSOR_B(Map, bit_field3, is_extensible, Map::IsExtensibleBit)
-BIMODAL_ACCESSOR_B(Map, bit_field, has_prototype_slot, Map::HasPrototypeSlotBit)
+                   Map::Bits3::IsMigrationTargetBit)
+BIMODAL_ACCESSOR_B(Map, bit_field3, is_extensible, Map::Bits3::IsExtensibleBit)
+BIMODAL_ACCESSOR_B(Map, bit_field, has_prototype_slot,
+                   Map::Bits1::HasPrototypeSlotBit)
 BIMODAL_ACCESSOR_B(Map, bit_field, is_access_check_needed,
-                   Map::IsAccessCheckNeededBit)
-BIMODAL_ACCESSOR_B(Map, bit_field, is_callable, Map::IsCallableBit)
+                   Map::Bits1::IsAccessCheckNeededBit)
+BIMODAL_ACCESSOR_B(Map, bit_field, is_callable, Map::Bits1::IsCallableBit)
 BIMODAL_ACCESSOR_B(Map, bit_field, has_indexed_interceptor,
-                   Map::HasIndexedInterceptorBit)
-BIMODAL_ACCESSOR_B(Map, bit_field, is_constructor, Map::IsConstructorBit)
-BIMODAL_ACCESSOR_B(Map, bit_field, is_undetectable, Map::IsUndetectableBit)
+                   Map::Bits1::HasIndexedInterceptorBit)
+BIMODAL_ACCESSOR_B(Map, bit_field, is_constructor, Map::Bits1::IsConstructorBit)
+BIMODAL_ACCESSOR_B(Map, bit_field, is_undetectable,
+                   Map::Bits1::IsUndetectableBit)
 BIMODAL_ACCESSOR_C(Map, int, instance_size)
 BIMODAL_ACCESSOR_C(Map, int, NextFreePropertyIndex)
 BIMODAL_ACCESSOR_C(Map, int, UnusedPropertyFields)
@@ -3297,7 +3408,8 @@ BIMODAL_ACCESSOR(PropertyCell, Object, value)
 BIMODAL_ACCESSOR_C(PropertyCell, PropertyDetails, property_details)
 
 base::Optional<CallHandlerInfoRef> FunctionTemplateInfoRef::call_code() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
     return CallHandlerInfoRef(
         broker(), handle(object()->call_code(), broker()->isolate()));
   }
@@ -3308,9 +3420,12 @@ base::Optional<CallHandlerInfoRef> FunctionTemplateInfoRef::call_code() const {
 }
 
 bool FunctionTemplateInfoRef::is_signature_undefined() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
-    AllowHandleAllocation allow_handle_allocation;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
 
     return object()->signature().IsUndefined(broker()->isolate());
   }
@@ -3318,9 +3433,12 @@ bool FunctionTemplateInfoRef::is_signature_undefined() const {
 }
 
 bool FunctionTemplateInfoRef::has_call_code() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
-    AllowHandleAllocation allow_handle_allocation;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
 
     CallOptimization call_optimization(broker()->isolate(), object());
     return call_optimization.is_simple_api_call();
@@ -3334,9 +3452,12 @@ HolderLookupResult FunctionTemplateInfoRef::LookupHolderOfExpectedType(
     MapRef receiver_map, SerializationPolicy policy) {
   const HolderLookupResult not_found;
 
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
-    AllowHandleAllocation allow_handle_allocation;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
 
     CallOptimization call_optimization(broker()->isolate(), object());
     Handle<Map> receiver_map_ref(receiver_map.object());
@@ -3413,28 +3534,43 @@ BIMODAL_ACCESSOR_C(String, int, length)
 
 BIMODAL_ACCESSOR(FeedbackCell, HeapObject, value)
 
-ObjectRef MapRef::GetStrongValue(InternalIndex descriptor_index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
-    return ObjectRef(broker(),
-                     handle(object()->instance_descriptors().GetStrongValue(
-                                descriptor_index),
-                            broker()->isolate()));
+base::Optional<ObjectRef> MapRef::GetStrongValue(
+    InternalIndex descriptor_index) const {
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
+    MaybeObject value =
+        object()->instance_descriptors().GetValue(descriptor_index);
+    HeapObject object;
+    if (value.GetHeapObjectIfStrong(&object)) {
+      return ObjectRef(broker(), handle(object, broker()->isolate()));
+    }
+    return base::nullopt;
   }
-  return ObjectRef(broker(), data()->AsMap()->GetStrongValue(descriptor_index));
+  ObjectData* value = data()->AsMap()->GetStrongValue(descriptor_index);
+  if (!value) {
+    return base::nullopt;
+  }
+  return ObjectRef(broker(), value);
 }
 
 void MapRef::SerializeRootMap() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsMap()->SerializeRootMap(broker());
 }
 
 base::Optional<MapRef> MapRef::FindRootMap() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->kind() == ObjectDataKind::kUnserializedHeapObject) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return MapRef(broker(), handle(object()->FindRootMap(broker()->isolate()),
                                    broker()->isolate()));
+  } else if (data_->kind() == ObjectDataKind::kUnserializedReadOnlyHeapObject) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
+    return MapRef(broker(), broker()->GetRootHandle(
+                                object()->FindRootMap(broker()->isolate())));
   }
   MapData* map_data = data()->AsMap()->FindRootMap();
   if (map_data) {
@@ -3445,77 +3581,113 @@ base::Optional<MapRef> MapRef::FindRootMap() const {
 }
 
 void* JSTypedArrayRef::data_ptr() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->DataPtr();
   }
   return data()->AsJSTypedArray()->data_ptr();
 }
 
 bool MapRef::IsInobjectSlackTrackingInProgress() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE_C(Map, IsInobjectSlackTrackingInProgress);
-  return Map::ConstructionCounterBits::decode(data()->AsMap()->bit_field3()) !=
-         Map::kNoSlackTracking;
+  IF_ACCESS_FROM_HEAP_C(Map, IsInobjectSlackTrackingInProgress);
+  return Map::Bits3::ConstructionCounterBits::decode(
+             data()->AsMap()->bit_field3()) != Map::kNoSlackTracking;
 }
 
 int MapRef::constructor_function_index() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE_C(Map, GetConstructorFunctionIndex);
+  IF_ACCESS_FROM_HEAP_C(Map, GetConstructorFunctionIndex);
   CHECK(IsPrimitiveMap());
   return data()->AsMap()->constructor_function_index();
 }
 
 bool MapRef::is_stable() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE_C(Map, is_stable);
-  return !Map::IsUnstableBit::decode(data()->AsMap()->bit_field3());
+  IF_ACCESS_FROM_HEAP_C(Map, is_stable);
+  return !Map::Bits3::IsUnstableBit::decode(data()->AsMap()->bit_field3());
 }
 
 bool MapRef::CanBeDeprecated() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE_C(Map, CanBeDeprecated);
+  IF_ACCESS_FROM_HEAP_C(Map, CanBeDeprecated);
   CHECK_GT(NumberOfOwnDescriptors(), 0);
   return data()->AsMap()->can_be_deprecated();
 }
 
 bool MapRef::CanTransition() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE_C(Map, CanTransition);
+  IF_ACCESS_FROM_HEAP_C(Map, CanTransition);
   return data()->AsMap()->can_transition();
 }
 
 int MapRef::GetInObjectPropertiesStartInWords() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE_C(Map, GetInObjectPropertiesStartInWords);
+  IF_ACCESS_FROM_HEAP_C(Map, GetInObjectPropertiesStartInWords);
   return data()->AsMap()->in_object_properties_start_in_words();
 }
 
 int MapRef::GetInObjectProperties() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE_C(Map, GetInObjectProperties);
+  IF_ACCESS_FROM_HEAP_C(Map, GetInObjectProperties);
   return data()->AsMap()->in_object_properties();
 }
 
 int ScopeInfoRef::ContextLength() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE_C(ScopeInfo, ContextLength);
+  IF_ACCESS_FROM_HEAP_C(ScopeInfo, ContextLength);
   return data()->AsScopeInfo()->context_length();
 }
 
+int ScopeInfoRef::Flags() const {
+  IF_ACCESS_FROM_HEAP_C(ScopeInfo, Flags);
+  return data()->AsScopeInfo()->flags();
+}
+
+bool ScopeInfoRef::HasContextExtension() const {
+  return ScopeInfo::HasContextExtensionSlotBit::decode(Flags());
+}
+
+bool ScopeInfoRef::HasOuterScopeInfo() const {
+  IF_ACCESS_FROM_HEAP_C(ScopeInfo, HasOuterScopeInfo);
+  return data()->AsScopeInfo()->has_outer_scope_info();
+}
+
+ScopeInfoRef ScopeInfoRef::OuterScopeInfo() const {
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
+    return ScopeInfoRef(
+        broker(), handle(object()->OuterScopeInfo(), broker()->isolate()));
+  }
+  return ScopeInfoRef(broker(), data()->AsScopeInfo()->outer_scope_info());
+}
+
+void ScopeInfoRef::SerializeScopeInfoChain() {
+  CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
+  data()->AsScopeInfo()->SerializeScopeInfoChain(broker());
+}
+
 bool StringRef::IsExternalString() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE_C(String, IsExternalString);
+  IF_ACCESS_FROM_HEAP_C(String, IsExternalString);
   return data()->AsString()->is_external_string();
 }
 
 Address CallHandlerInfoRef::callback() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
+  if (data_->should_access_heap()) {
     return v8::ToCData<Address>(object()->callback());
   }
   return HeapObjectRef::data()->AsCallHandlerInfo()->callback();
 }
 
 bool StringRef::IsSeqString() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE_C(String, IsSeqString);
+  IF_ACCESS_FROM_HEAP_C(String, IsSeqString);
   return data()->AsString()->is_seq_string();
 }
 
 ScopeInfoRef NativeContextRef::scope_info() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return ScopeInfoRef(broker(),
                         handle(object()->scope_info(), broker()->isolate()));
   }
@@ -3525,7 +3697,7 @@ ScopeInfoRef NativeContextRef::scope_info() const {
 MapRef NativeContextRef::GetFunctionMapFromIndex(int index) const {
   DCHECK_GE(index, Context::FIRST_FUNCTION_MAP_INDEX);
   DCHECK_LE(index, Context::LAST_FUNCTION_MAP_INDEX);
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
+  if (data_->should_access_heap()) {
     return get(index).value().AsMap();
   }
   return MapRef(broker(), data()->AsNativeContext()->function_maps().at(
@@ -3579,8 +3751,9 @@ bool ObjectRef::IsNullOrUndefined() const {
 }
 
 bool ObjectRef::BooleanValue() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return object()->BooleanValue(broker()->isolate());
   }
   return IsSmi() ? (AsSmi() != 0) : data()->AsHeapObject()->boolean_value();
@@ -3613,10 +3786,18 @@ Maybe<double> ObjectRef::OddballToNumber() const {
 
 base::Optional<ObjectRef> ObjectRef::GetOwnConstantElement(
     uint32_t index, SerializationPolicy policy) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
+  if (data_->kind() == ObjectDataKind::kUnserializedHeapObject) {
     return (IsJSObject() || IsString())
                ? GetOwnElementFromHeap(broker(), object(), index, true)
                : base::nullopt;
+  } else if (data_->kind() == ObjectDataKind::kUnserializedReadOnlyHeapObject) {
+    DCHECK(!IsJSObject());
+    // TODO(mythria): For ReadOnly strings, currently we cannot access data from
+    // heap without creating handles since we use LookupIterator. We should have
+    // a custom implementation for read only strings that doesn't create
+    // handles. Till then it is OK to disable this optimization since this only
+    // impacts keyed accesses on read only strings.
+    return base::nullopt;
   }
   ObjectData* element = nullptr;
   if (IsJSObject()) {
@@ -3632,7 +3813,8 @@ base::Optional<ObjectRef> ObjectRef::GetOwnConstantElement(
 base::Optional<ObjectRef> JSObjectRef::GetOwnDataProperty(
     Representation field_representation, FieldIndex index,
     SerializationPolicy policy) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
     return GetOwnDataPropertyFromHeap(broker(),
                                       Handle<JSObject>::cast(object()),
                                       field_representation, index);
@@ -3645,7 +3827,7 @@ base::Optional<ObjectRef> JSObjectRef::GetOwnDataProperty(
 
 base::Optional<ObjectRef> JSArrayRef::GetOwnCowElement(
     uint32_t index, SerializationPolicy policy) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
+  if (data_->should_access_heap()) {
     if (!object()->elements().IsCowArray()) return base::nullopt;
     return GetOwnElementFromHeap(broker(), object(), index, false);
   }
@@ -3665,19 +3847,22 @@ base::Optional<ObjectRef> JSArrayRef::GetOwnCowElement(
 }
 
 double HeapNumberRef::value() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE_C(HeapNumber, value);
+  IF_ACCESS_FROM_HEAP_C(HeapNumber, value);
   return data()->AsHeapNumber()->value();
 }
 
 uint64_t BigIntRef::AsUint64() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE_C(BigInt, AsUint64);
+  IF_ACCESS_FROM_HEAP_C(BigInt, AsUint64);
   return data()->AsBigInt()->AsUint64();
 }
 
 base::Optional<CellRef> SourceTextModuleRef::GetCell(int cell_index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return CellRef(broker(),
                    handle(object()->GetCell(cell_index), broker()->isolate()));
   }
@@ -3690,9 +3875,10 @@ ObjectRef::ObjectRef(JSHeapBroker* broker, Handle<Object> object,
                      bool check_type)
     : broker_(broker) {
   switch (broker->mode()) {
+    // We may have to create data in JSHeapBroker::kSerialized as well since we
+    // read the data from read only heap objects directly instead of serializing
+    // them.
     case JSHeapBroker::kSerialized:
-      data_ = broker->GetData(object);
-      break;
     case JSHeapBroker::kSerializing:
       data_ = broker->GetOrCreateData(object);
       break;
@@ -3701,7 +3887,8 @@ ObjectRef::ObjectRef(JSHeapBroker* broker, Handle<Object> object,
           broker->refs_->LookupOrInsert(object.address(), broker->zone());
       ObjectData** storage = &(entry->value);
       if (*storage == nullptr) {
-        AllowHandleDereference handle_dereference;
+        AllowHandleDereferenceIf allow_handle_dereference(
+            kUnserializedHeapObject, broker->mode());
         entry->value = new (broker->zone())
             ObjectData(broker, storage, object,
                        object->IsSmi() ? kSmi : kUnserializedHeapObject);
@@ -3713,7 +3900,8 @@ ObjectRef::ObjectRef(JSHeapBroker* broker, Handle<Object> object,
       UNREACHABLE();
   }
   if (!data_) {  // TODO(mslekova): Remove once we're on the background thread.
-    AllowHandleDereference handle_dereference;
+    AllowHandleDereferenceIf allow_handle_dereference(data_->kind(),
+                                                      broker->mode());
     object->Print();
   }
   CHECK_WITH_MSG(data_ != nullptr, "Object is not known to the heap broker");
@@ -3748,8 +3936,9 @@ OddballType GetOddballType(Isolate* isolate, Map map) {
 }  // namespace
 
 HeapObjectType HeapObjectRef::GetHeapObjectType() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference handle_dereference;
+  if (data_->should_access_heap()) {
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     Map map = Handle<HeapObject>::cast(object())->map();
     HeapObjectType::Flags flags(0);
     if (map.is_undetectable()) flags |= HeapObjectType::kUndetectable;
@@ -3763,9 +3952,12 @@ HeapObjectType HeapObjectRef::GetHeapObjectType() const {
   return HeapObjectType(map().instance_type(), flags, map().oddball_type());
 }
 base::Optional<JSObjectRef> AllocationSiteRef::boilerplate() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return JSObjectRef(broker(),
                        handle(object()->boilerplate(), broker()->isolate()));
   }
@@ -3782,17 +3974,25 @@ ElementsKind JSObjectRef::GetElementsKind() const {
 }
 
 FixedArrayBaseRef JSObjectRef::elements() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     return FixedArrayBaseRef(broker(),
                              handle(object()->elements(), broker()->isolate()));
   }
-  return FixedArrayBaseRef(broker(), data()->AsJSObject()->elements());
+  ObjectData* elements_data = data()->AsJSObject()->elements();
+  if (elements_data->kind() ==
+      ObjectDataKind::kUnserializedReadOnlyHeapObject) {
+    return FixedArrayBaseRef(broker(), elements_data->object());
+  }
+  return FixedArrayBaseRef(broker(), elements_data->AsFixedArrayBase());
 }
 
 int FixedArrayBaseRef::length() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE_C(FixedArrayBase, length);
+  IF_ACCESS_FROM_HEAP_C(FixedArrayBase, length);
   return data()->AsFixedArrayBase()->length();
 }
 
@@ -3817,28 +4017,28 @@ bool NameRef::IsUniqueName() const {
 }
 
 ObjectRef JSRegExpRef::data() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE(JSRegExp, Object, data);
+  IF_ACCESS_FROM_HEAP(JSRegExp, Object, data);
   return ObjectRef(broker(), ObjectRef::data()->AsJSRegExp()->data());
 }
 
 ObjectRef JSRegExpRef::flags() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE(JSRegExp, Object, flags);
+  IF_ACCESS_FROM_HEAP(JSRegExp, Object, flags);
   return ObjectRef(broker(), ObjectRef::data()->AsJSRegExp()->flags());
 }
 
 ObjectRef JSRegExpRef::last_index() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE(JSRegExp, Object, last_index);
+  IF_ACCESS_FROM_HEAP(JSRegExp, Object, last_index);
   return ObjectRef(broker(), ObjectRef::data()->AsJSRegExp()->last_index());
 }
 
 ObjectRef JSRegExpRef::raw_properties_or_hash() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE(JSRegExp, Object, raw_properties_or_hash);
+  IF_ACCESS_FROM_HEAP(JSRegExp, Object, raw_properties_or_hash);
   return ObjectRef(broker(),
                    ObjectRef::data()->AsJSRegExp()->raw_properties_or_hash());
 }
 
 ObjectRef JSRegExpRef::source() const {
-  IF_BROKER_DISABLED_ACCESS_HANDLE(JSRegExp, Object, source);
+  IF_ACCESS_FROM_HEAP(JSRegExp, Object, source);
   return ObjectRef(broker(), ObjectRef::data()->AsJSRegExp()->source());
 }
 
@@ -3914,11 +4114,14 @@ void NativeContextData::Serialize(JSHeapBroker* broker) {
   TraceScope tracer(broker, this, "NativeContextData::Serialize");
   Handle<NativeContext> context = Handle<NativeContext>::cast(object());
 
-#define SERIALIZE_MEMBER(type, name)                                       \
-  DCHECK_NULL(name##_);                                                    \
-  name##_ = broker->GetOrCreateData(context->name())->As##type();          \
-  if (name##_->IsJSFunction()) name##_->AsJSFunction()->Serialize(broker); \
-  if (name##_->IsMap()) name##_->AsMap()->SerializeConstructor(broker);
+#define SERIALIZE_MEMBER(type, name)                                        \
+  DCHECK_NULL(name##_);                                                     \
+  name##_ = broker->GetOrCreateData(context->name())->As##type();           \
+  if (name##_->IsJSFunction()) name##_->AsJSFunction()->Serialize(broker);  \
+  if (name##_->IsMap() &&                                                   \
+      !InstanceTypeChecker::IsContext(name##_->AsMap()->instance_type())) { \
+    name##_->AsMap()->SerializeConstructor(broker);                         \
+  }
   BROKER_COMPULSORY_NATIVE_CONTEXT_FIELDS(SERIALIZE_MEMBER)
   if (!broker->isolate()->bootstrapper()->IsActive()) {
     BROKER_OPTIONAL_NATIVE_CONTEXT_FIELDS(SERIALIZE_MEMBER)
@@ -3940,18 +4143,21 @@ void NativeContextData::Serialize(JSHeapBroker* broker) {
 }
 
 void JSFunctionRef::Serialize() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+  if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsJSFunction()->Serialize(broker());
 }
 
 bool JSBoundFunctionRef::serialized() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return true;
+  DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+  if (data_->should_access_heap()) return true;
   return data()->AsJSBoundFunction()->serialized();
 }
 
 bool JSFunctionRef::serialized() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return true;
+  DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+  if (data_->should_access_heap()) return true;
   return data()->AsJSFunction()->serialized();
 }
 
@@ -3969,9 +4175,12 @@ JSArrayRef SharedFunctionInfoRef::GetTemplateObject(
     return feedback.AsTemplateObject().value();
   }
 
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleAllocation handle_allocation;
-    AllowHandleDereference allow_handle_dereference;
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
     Handle<JSArray> template_object =
         TemplateObjectDescription::GetTemplateObject(
             isolate(), broker()->target_native_context().object(),
@@ -3995,22 +4204,20 @@ JSArrayRef SharedFunctionInfoRef::GetTemplateObject(
   return JSArrayRef(broker(), array);
 }
 
-void SharedFunctionInfoRef::SetSerializedForCompilation(
-    FeedbackVectorRef feedback) {
+void SharedFunctionInfoRef::SerializeFunctionTemplateInfo() {
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
-  CHECK(HasBytecodeArray());
-  data()->AsSharedFunctionInfo()->SetSerializedForCompilation(broker(),
-                                                              feedback);
+  data()->AsSharedFunctionInfo()->SerializeFunctionTemplateInfo(broker());
 }
 
-void SharedFunctionInfoRef::SerializeFunctionTemplateInfo() {
+void SharedFunctionInfoRef::SerializeScopeInfoChain() {
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
-  data()->AsSharedFunctionInfo()->SerializeFunctionTemplateInfo(broker());
+  data()->AsSharedFunctionInfo()->SerializeScopeInfoChain(broker());
 }
 
 base::Optional<FunctionTemplateInfoRef>
 SharedFunctionInfoRef::function_template_info() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
     if (object()->IsApiFunction()) {
       return FunctionTemplateInfoRef(
           broker(), handle(object()->function_data(), broker()->isolate()));
@@ -4023,33 +4230,46 @@ SharedFunctionInfoRef::function_template_info() const {
   return FunctionTemplateInfoRef(broker(), function_template_info);
 }
 
-bool SharedFunctionInfoRef::IsSerializedForCompilation(
-    FeedbackVectorRef feedback) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return HasBytecodeArray();
-  return data()->AsSharedFunctionInfo()->IsSerializedForCompilation(feedback);
+int SharedFunctionInfoRef::context_header_size() const {
+  IF_ACCESS_FROM_HEAP_C(SharedFunctionInfo, scope_info().ContextHeaderLength);
+  return data()->AsSharedFunctionInfo()->context_header_size();
+}
+
+ScopeInfoRef SharedFunctionInfoRef::scope_info() const {
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+    AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
+                                                    broker()->mode());
+    AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
+                                                      broker()->mode());
+    return ScopeInfoRef(broker(),
+                        handle(object()->scope_info(), broker()->isolate()));
+  }
+  return ScopeInfoRef(broker(), data()->AsSharedFunctionInfo()->scope_info());
 }
 
 void JSObjectRef::SerializeObjectCreateMap() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+  if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsJSObject()->SerializeObjectCreateMap(broker());
 }
 
 void MapRef::SerializeOwnDescriptors() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsMap()->SerializeOwnDescriptors(broker());
 }
 
 void MapRef::SerializeOwnDescriptor(InternalIndex descriptor_index) {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsMap()->SerializeOwnDescriptor(broker(), descriptor_index);
 }
 
 bool MapRef::serialized_own_descriptor(InternalIndex descriptor_index) const {
   CHECK_LT(descriptor_index.as_int(), NumberOfOwnDescriptors());
-  if (broker()->mode() == JSHeapBroker::kDisabled) return true;
+  if (data_->should_access_heap()) return true;
   DescriptorArrayData* desc_array_data =
       data()->AsMap()->instance_descriptors();
   if (!desc_array_data) return false;
@@ -4058,36 +4278,39 @@ bool MapRef::serialized_own_descriptor(InternalIndex descriptor_index) const {
 }
 
 void MapRef::SerializeBackPointer() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsMap()->SerializeBackPointer(broker());
 }
 
 void MapRef::SerializePrototype() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsMap()->SerializePrototype(broker());
 }
 
 bool MapRef::serialized_prototype() const {
   CHECK_NE(broker()->mode(), JSHeapBroker::kDisabled);
+  if (data_->should_access_heap()) return true;
   return data()->AsMap()->serialized_prototype();
 }
 
 void SourceTextModuleRef::Serialize() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+  if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsSourceTextModule()->Serialize(broker());
 }
 
 void NativeContextRef::Serialize() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+  if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsNativeContext()->Serialize(broker());
 }
 
 void JSTypedArrayRef::Serialize() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsJSTypedArray()->Serialize(broker());
 }
@@ -4098,26 +4321,30 @@ bool JSTypedArrayRef::serialized() const {
 }
 
 void JSBoundFunctionRef::Serialize() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+  if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsJSBoundFunction()->Serialize(broker());
 }
 
 void PropertyCellRef::Serialize() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+  if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsPropertyCell()->Serialize(broker());
 }
 
 void FunctionTemplateInfoRef::SerializeCallCode() {
-  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
+  if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsFunctionTemplateInfo()->SerializeCallCode(broker());
 }
 
 base::Optional<PropertyCellRef> JSGlobalObjectRef::GetPropertyCell(
     NameRef const& name, SerializationPolicy policy) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
+  if (data_->should_access_heap()) {
+    DCHECK(data_->kind() != ObjectDataKind::kUnserializedReadOnlyHeapObject);
     return GetPropertyCellFromHeap(broker(), name.object());
   }
   PropertyCellData* property_cell_data =
@@ -4203,7 +4430,6 @@ GlobalAccessFeedback::GlobalAccessFeedback(PropertyCellRef cell,
 
 GlobalAccessFeedback::GlobalAccessFeedback(FeedbackSlotKind slot_kind)
     : ProcessedFeedback(kGlobalAccess, slot_kind),
-      cell_or_context_(base::nullopt),
       index_and_immutable_(0 /* doesn't matter */) {
   DCHECK(IsGlobalICKind(slot_kind));
 }
@@ -4367,7 +4593,7 @@ ProcessedFeedback const& JSHeapBroker::GetFeedback(
 
 FeedbackSlotKind JSHeapBroker::GetFeedbackSlotKind(
     FeedbackSource const& source) const {
-  if (FLAG_concurrent_inlining) {
+  if (is_concurrent_inlining_) {
     ProcessedFeedback const& processed = GetFeedback(source);
     return processed.slot_kind();
   }
@@ -4376,7 +4602,7 @@ FeedbackSlotKind JSHeapBroker::GetFeedbackSlotKind(
 }
 
 bool JSHeapBroker::FeedbackIsInsufficient(FeedbackSource const& source) const {
-  return FLAG_concurrent_inlining
+  return is_concurrent_inlining_
              ? GetFeedback(source).IsInsufficient()
              : FeedbackNexus(source.vector, source.slot).IsUninitialized();
 }
@@ -4575,8 +4801,8 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForCall(
 BinaryOperationHint JSHeapBroker::GetFeedbackForBinaryOperation(
     FeedbackSource const& source) {
   ProcessedFeedback const& feedback =
-      FLAG_concurrent_inlining ? GetFeedback(source)
-                               : ProcessFeedbackForBinaryOperation(source);
+      is_concurrent_inlining_ ? GetFeedback(source)
+                              : ProcessFeedbackForBinaryOperation(source);
   return feedback.IsInsufficient() ? BinaryOperationHint::kNone
                                    : feedback.AsBinaryOperation().value();
 }
@@ -4584,14 +4810,14 @@ BinaryOperationHint JSHeapBroker::GetFeedbackForBinaryOperation(
 CompareOperationHint JSHeapBroker::GetFeedbackForCompareOperation(
     FeedbackSource const& source) {
   ProcessedFeedback const& feedback =
-      FLAG_concurrent_inlining ? GetFeedback(source)
-                               : ProcessFeedbackForCompareOperation(source);
+      is_concurrent_inlining_ ? GetFeedback(source)
+                              : ProcessFeedbackForCompareOperation(source);
   return feedback.IsInsufficient() ? CompareOperationHint::kNone
                                    : feedback.AsCompareOperation().value();
 }
 
 ForInHint JSHeapBroker::GetFeedbackForForIn(FeedbackSource const& source) {
-  ProcessedFeedback const& feedback = FLAG_concurrent_inlining
+  ProcessedFeedback const& feedback = is_concurrent_inlining_
                                           ? GetFeedback(source)
                                           : ProcessFeedbackForForIn(source);
   return feedback.IsInsufficient() ? ForInHint::kNone
@@ -4601,46 +4827,46 @@ ForInHint JSHeapBroker::GetFeedbackForForIn(FeedbackSource const& source) {
 ProcessedFeedback const& JSHeapBroker::GetFeedbackForPropertyAccess(
     FeedbackSource const& source, AccessMode mode,
     base::Optional<NameRef> static_name) {
-  return FLAG_concurrent_inlining
+  return is_concurrent_inlining_
              ? GetFeedback(source)
              : ProcessFeedbackForPropertyAccess(source, mode, static_name);
 }
 
 ProcessedFeedback const& JSHeapBroker::GetFeedbackForInstanceOf(
     FeedbackSource const& source) {
-  return FLAG_concurrent_inlining ? GetFeedback(source)
-                                  : ProcessFeedbackForInstanceOf(source);
+  return is_concurrent_inlining_ ? GetFeedback(source)
+                                 : ProcessFeedbackForInstanceOf(source);
 }
 
 ProcessedFeedback const& JSHeapBroker::GetFeedbackForCall(
     FeedbackSource const& source) {
-  return FLAG_concurrent_inlining ? GetFeedback(source)
-                                  : ProcessFeedbackForCall(source);
+  return is_concurrent_inlining_ ? GetFeedback(source)
+                                 : ProcessFeedbackForCall(source);
 }
 
 ProcessedFeedback const& JSHeapBroker::GetFeedbackForGlobalAccess(
     FeedbackSource const& source) {
-  return FLAG_concurrent_inlining ? GetFeedback(source)
-                                  : ProcessFeedbackForGlobalAccess(source);
+  return is_concurrent_inlining_ ? GetFeedback(source)
+                                 : ProcessFeedbackForGlobalAccess(source);
 }
 
 ProcessedFeedback const& JSHeapBroker::GetFeedbackForArrayOrObjectLiteral(
     FeedbackSource const& source) {
-  return FLAG_concurrent_inlining
+  return is_concurrent_inlining_
              ? GetFeedback(source)
              : ProcessFeedbackForArrayOrObjectLiteral(source);
 }
 
 ProcessedFeedback const& JSHeapBroker::GetFeedbackForRegExpLiteral(
     FeedbackSource const& source) {
-  return FLAG_concurrent_inlining ? GetFeedback(source)
-                                  : ProcessFeedbackForRegExpLiteral(source);
+  return is_concurrent_inlining_ ? GetFeedback(source)
+                                 : ProcessFeedbackForRegExpLiteral(source);
 }
 
 ProcessedFeedback const& JSHeapBroker::GetFeedbackForTemplateObject(
     FeedbackSource const& source) {
-  return FLAG_concurrent_inlining ? GetFeedback(source)
-                                  : ProcessFeedbackForTemplateObject(source);
+  return is_concurrent_inlining_ ? GetFeedback(source)
+                                 : ProcessFeedbackForTemplateObject(source);
 }
 
 ProcessedFeedback const& JSHeapBroker::ProcessFeedbackForArrayOrObjectLiteral(
@@ -4823,11 +5049,16 @@ void ElementAccessFeedback::AddGroup(TransitionGroup&& group) {
 }
 
 std::ostream& operator<<(std::ostream& os, const ObjectRef& ref) {
-  if (ref.broker()->mode() == JSHeapBroker::kDisabled ||
+  if (ref.data_->kind() == ObjectDataKind::kUnserializedHeapObject ||
       !FLAG_concurrent_recompilation) {
     // We cannot be in a background thread so it's safe to read the heap.
     AllowHandleDereference allow_handle_dereference;
     return os << ref.data() << " {" << ref.object() << "}";
+  } else if (ref.data_->kind() ==
+             ObjectDataKind::kUnserializedReadOnlyHeapObject) {
+    AllowHandleDereferenceIf allow_handle_dereference(ref.data()->kind(),
+                                                      ref.broker()->mode());
+    return os << ref.data() << " {" << ref.object() << "}";
   } else {
     return os << ref.data();
   }
@@ -4858,7 +5089,7 @@ PropertyAccessInfo JSHeapBroker::GetPropertyAccessInfo(
   AccessInfoFactory factory(this, dependencies, zone());
   PropertyAccessInfo access_info = factory.ComputePropertyAccessInfo(
       map.object(), name.object(), access_mode);
-  if (FLAG_concurrent_inlining) {
+  if (is_concurrent_inlining_) {
     CHECK(SerializingAllowed());
     TRACE(this, "Storing PropertyAccessInfo for "
                     << access_mode << " of property " << name << " on map "
@@ -4926,7 +5157,7 @@ TemplateObjectFeedback const& ProcessedFeedback::AsTemplateObject() const {
 BytecodeAnalysis const& JSHeapBroker::GetBytecodeAnalysis(
     Handle<BytecodeArray> bytecode_array, BailoutId osr_bailout_id,
     bool analyze_liveness, SerializationPolicy policy) {
-  ObjectData* bytecode_array_data = GetData(bytecode_array);
+  ObjectData* bytecode_array_data = GetOrCreateData(bytecode_array);
   CHECK_NOT_NULL(bytecode_array_data);
 
   auto it = bytecode_analyses_.find(bytecode_array_data);
@@ -4986,8 +5217,8 @@ Smi OffHeapBytecodeArray::GetConstantAtIndexAsSmi(int index) const {
 #undef BIMODAL_ACCESSOR
 #undef BIMODAL_ACCESSOR_B
 #undef BIMODAL_ACCESSOR_C
-#undef IF_BROKER_DISABLED_ACCESS_HANDLE
-#undef IF_BROKER_DISABLED_ACCESS_HANDLE_C
+#undef IF_ACCESS_FROM_HEAP
+#undef IF_ACCESS_FROM_HEAP_C
 #undef TRACE
 #undef TRACE_MISSING
 
diff --git a/deps/v8/src/compiler/js-heap-broker.h b/deps/v8/src/compiler/js-heap-broker.h
index c9667a2fedf093..0cd5df294419fd 100644
--- a/deps/v8/src/compiler/js-heap-broker.h
+++ b/deps/v8/src/compiler/js-heap-broker.h
@@ -12,11 +12,13 @@
 #include "src/compiler/feedback-source.h"
 #include "src/compiler/processed-feedback.h"
 #include "src/compiler/refs-map.h"
+#include "src/compiler/serializer-hints.h"
 #include "src/handles/handles.h"
 #include "src/interpreter/bytecode-array-accessor.h"
 #include "src/objects/feedback-vector.h"
 #include "src/objects/function-kind.h"
 #include "src/objects/objects.h"
+#include "src/utils/address-map.h"
 #include "src/utils/ostreams.h"
 #include "src/zone/zone-containers.h"
 
@@ -71,7 +73,8 @@ struct PropertyAccessTarget {
 
 class V8_EXPORT_PRIVATE JSHeapBroker {
  public:
-  JSHeapBroker(Isolate* isolate, Zone* broker_zone, bool tracing_enabled);
+  JSHeapBroker(Isolate* isolate, Zone* broker_zone, bool tracing_enabled,
+               bool is_concurrent_inlining);
 
   // The compilation target's native context. We need the setter because at
   // broker construction time we don't yet have the canonical handle.
@@ -83,8 +86,9 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   void InitializeAndStartSerializing(Handle<NativeContext> native_context);
 
   Isolate* isolate() const { return isolate_; }
-  Zone* zone() const { return current_zone_; }
+  Zone* zone() const { return zone_; }
   bool tracing_enabled() const { return tracing_enabled_; }
+  bool is_concurrent_inlining() const { return is_concurrent_inlining_; }
 
   enum BrokerMode { kDisabled, kSerializing, kSerialized, kRetired };
   BrokerMode mode() const { return mode_; }
@@ -96,8 +100,9 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   void PrintRefsAnalysis() const;
 #endif  // DEBUG
 
-  // Returns nullptr iff handle unknown.
-  ObjectData* GetData(Handle<Object>) const;
+  // Retruns the handle from root index table for read only heap objects.
+  Handle<Object> GetRootHandle(Object object);
+
   // Never returns nullptr.
   ObjectData* GetOrCreateData(Handle<Object>);
   // Like the previous but wraps argument in handle first (for convenience).
@@ -179,10 +184,21 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
 
   StringRef GetTypedArrayStringTag(ElementsKind kind);
 
+  bool ShouldBeSerializedForCompilation(const SharedFunctionInfoRef& shared,
+                                        const FeedbackVectorRef& feedback,
+                                        const HintsVector& arguments) const;
+  void SetSerializedForCompilation(const SharedFunctionInfoRef& shared,
+                                   const FeedbackVectorRef& feedback,
+                                   const HintsVector& arguments);
+  bool IsSerializedForCompilation(const SharedFunctionInfoRef& shared,
+                                  const FeedbackVectorRef& feedback) const;
+
   std::ostream& Trace() const;
   void IncrementTracingIndentation();
   void DecrementTracingIndentation();
 
+  RootIndexMap const& root_index_map() { return root_index_map_; }
+
  private:
   friend class HeapObjectRef;
   friend class ObjectRef;
@@ -211,22 +227,22 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   ProcessedFeedback const& ReadFeedbackForTemplateObject(
       FeedbackSource const& source);
 
-  void InitializeRefsMap();
   void CollectArrayAndObjectPrototypes();
   void SerializeTypedArrayStringTags();
 
   PerIsolateCompilerCache* compiler_cache() const { return compiler_cache_; }
 
   Isolate* const isolate_;
-  Zone* const broker_zone_;
-  Zone* current_zone_ = nullptr;
+  Zone* const zone_ = nullptr;
   base::Optional<NativeContextRef> target_native_context_;
   RefsMap* refs_;
+  RootIndexMap root_index_map_;
   ZoneUnorderedSet<Handle<JSObject>, Handle<JSObject>::hash,
                    Handle<JSObject>::equal_to>
       array_and_object_prototypes_;
   BrokerMode mode_ = kDisabled;
   bool const tracing_enabled_;
+  bool const is_concurrent_inlining_;
   mutable StdoutStream trace_out_;
   unsigned trace_indentation_ = 0;
   PerIsolateCompilerCache* compiler_cache_ = nullptr;
@@ -240,6 +256,23 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
 
   ZoneVector<ObjectData*> typed_array_string_tags_;
 
+  struct SerializedFunction {
+    SharedFunctionInfoRef shared;
+    FeedbackVectorRef feedback;
+
+    bool operator<(const SerializedFunction& other) const {
+      if (shared.object().address() < other.shared.object().address()) {
+        return true;
+      }
+      if (shared.object().address() == other.shared.object().address()) {
+        return feedback.object().address() < other.feedback.object().address();
+      }
+      return false;
+    }
+  };
+  ZoneMultimap<SerializedFunction, HintsVector> serialized_functions_;
+
+  static const size_t kMaxSerializedFunctionsCacheSize = 200;
   static const size_t kMinimalRefsBucketCount = 8;     // must be power of 2
   static const size_t kInitialRefsBucketCount = 1024;  // must be power of 2
 };
diff --git a/deps/v8/src/compiler/js-inlining-heuristic.cc b/deps/v8/src/compiler/js-inlining-heuristic.cc
index cc3f321d6b2993..89233d3feac4d1 100644
--- a/deps/v8/src/compiler/js-inlining-heuristic.cc
+++ b/deps/v8/src/compiler/js-inlining-heuristic.cc
@@ -16,9 +16,9 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-#define TRACE(...)                                      \
-  do {                                                  \
-    if (FLAG_trace_turbo_inlining) PrintF(__VA_ARGS__); \
+#define TRACE(...)                                                             \
+  do {                                                                         \
+    if (FLAG_trace_turbo_inlining) StdoutStream{} << __VA_ARGS__ << std::endl; \
   } while (false)
 
 namespace {
@@ -29,22 +29,38 @@ bool IsSmall(BytecodeArrayRef const& bytecode) {
 bool CanConsiderForInlining(JSHeapBroker* broker,
                             SharedFunctionInfoRef const& shared,
                             FeedbackVectorRef const& feedback_vector) {
-  if (!shared.IsInlineable()) return false;
+  SharedFunctionInfo::Inlineability inlineability = shared.GetInlineability();
+  if (inlineability != SharedFunctionInfo::kIsInlineable) {
+    TRACE("Cannot consider "
+          << shared << " for inlining (reason: " << inlineability << ")");
+    return false;
+  }
+
   DCHECK(shared.HasBytecodeArray());
-  if (!shared.IsSerializedForCompilation(feedback_vector)) {
+  if (!broker->IsSerializedForCompilation(shared, feedback_vector)) {
     TRACE_BROKER_MISSING(
         broker, "data for " << shared << " (not serialized for compilation)");
+    TRACE("Cannot consider " << shared << " for inlining with "
+                             << feedback_vector << " (missing data)");
     return false;
   }
+
+  TRACE("Considering " << shared << " for inlining with " << feedback_vector);
   return true;
 }
 
 bool CanConsiderForInlining(JSHeapBroker* broker,
                             JSFunctionRef const& function) {
-  if (!function.has_feedback_vector()) return false;
+  if (!function.has_feedback_vector()) {
+    TRACE("Cannot consider " << function
+                             << " for inlining (no feedback vector)");
+    return false;
+  }
+
   if (!function.serialized()) {
     TRACE_BROKER_MISSING(
         broker, "data for " << function << " (cannot consider for inlining)");
+    TRACE("Cannot consider " << function << " for inlining (missing data)");
     return false;
   }
   return CanConsiderForInlining(broker, function.shared(),
@@ -111,12 +127,11 @@ JSInliningHeuristic::Candidate JSInliningHeuristic::CollectFunctions(
 }
 
 Reduction JSInliningHeuristic::Reduce(Node* node) {
-  DisallowHeapAccessIf no_heap_acess(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_acess(broker()->is_concurrent_inlining());
 
   if (!IrOpcode::IsInlineeOpcode(node->opcode())) return NoChange();
 
-  if (total_inlined_bytecode_size_ >= FLAG_max_inlined_bytecode_size_absolute &&
-      mode_ != kStressInlining) {
+  if (total_inlined_bytecode_size_ >= FLAG_max_inlined_bytecode_size_absolute) {
     return NoChange();
   }
 
@@ -129,10 +144,9 @@ Reduction JSInliningHeuristic::Reduce(Node* node) {
   if (candidate.num_functions == 0) {
     return NoChange();
   } else if (candidate.num_functions > 1 && !FLAG_polymorphic_inlining) {
-    TRACE(
-        "Not considering call site #%d:%s, because polymorphic inlining "
-        "is disabled\n",
-        node->id(), node->op()->mnemonic());
+    TRACE("Not considering call site #"
+          << node->id() << ":" << node->op()->mnemonic()
+          << ", because polymorphic inlining is disabled");
     return NoChange();
   }
 
@@ -143,20 +157,6 @@ Reduction JSInliningHeuristic::Reduce(Node* node) {
   Handle<SharedFunctionInfo> frame_shared_info;
   for (int i = 0; i < candidate.num_functions; ++i) {
     if (!candidate.bytecode[i].has_value()) {
-      // Can't inline without bytecode.
-      // TODO(neis): Should this even be a broker message?
-      if (candidate.functions[i].has_value()) {
-        TRACE_BROKER(broker(),
-                     "Missing bytecode array trying to inline JSFunction "
-                         << *candidate.functions[i]);
-      } else {
-        TRACE_BROKER(
-            broker(),
-            "Missing bytecode array trying to inline SharedFunctionInfo "
-                << *candidate.shared_info);
-      }
-      // Those functions that don't have their bytecode serialized probably
-      // don't have the SFI either, so we exit the loop early.
       candidate.can_inline_function[i] = false;
       continue;
     }
@@ -177,8 +177,9 @@ Reduction JSInliningHeuristic::Reduce(Node* node) {
     // not obvious if such an anlysis is needed.
     if (frame_info.shared_info().ToHandle(&frame_shared_info) &&
         frame_shared_info.equals(shared.object())) {
-      TRACE("Not considering call site #%d:%s, because of recursive inlining\n",
-            node->id(), node->op()->mnemonic());
+      TRACE("Not considering call site #" << node->id() << ":"
+                                          << node->op()->mnemonic()
+                                          << ", because of recursive inlining");
       candidate.can_inline_function[i] = false;
     }
     if (candidate.can_inline_function[i]) {
@@ -199,18 +200,6 @@ Reduction JSInliningHeuristic::Reduce(Node* node) {
     candidate.frequency = p.frequency();
   }
 
-  // Handling of special inlining modes right away:
-  //  - For restricted inlining: stop all handling at this point.
-  //  - For stressing inlining: immediately handle all functions.
-  switch (mode_) {
-    case kRestrictedInlining:
-      return NoChange();
-    case kStressInlining:
-      return InlineCandidate(candidate, false);
-    case kGeneralInlining:
-      break;
-  }
-
   // Don't consider a {candidate} whose frequency is below the
   // threshold, i.e. a call site that is only hit once every N
   // invocations of the caller.
@@ -222,8 +211,8 @@ Reduction JSInliningHeuristic::Reduce(Node* node) {
   // Forcibly inline small functions here. In the case of polymorphic inlining
   // candidate_is_small is set only when all functions are small.
   if (candidate_is_small) {
-    TRACE("Inlining small function(s) at call site #%d:%s\n", node->id(),
-          node->op()->mnemonic());
+    TRACE("Inlining small function(s) at call site #"
+          << node->id() << ":" << node->op()->mnemonic());
     return InlineCandidate(candidate, true);
   }
 
@@ -233,7 +222,7 @@ Reduction JSInliningHeuristic::Reduce(Node* node) {
 }
 
 void JSInliningHeuristic::Finalize() {
-  DisallowHeapAccessIf no_heap_acess(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_acess(broker()->is_concurrent_inlining());
 
   if (candidates_.empty()) return;  // Nothing to do without candidates.
   if (FLAG_trace_turbo_inlining) PrintCandidates();
diff --git a/deps/v8/src/compiler/js-inlining-heuristic.h b/deps/v8/src/compiler/js-inlining-heuristic.h
index b143e9b67fd846..3830be44454e54 100644
--- a/deps/v8/src/compiler/js-inlining-heuristic.h
+++ b/deps/v8/src/compiler/js-inlining-heuristic.h
@@ -13,13 +13,11 @@ namespace compiler {
 
 class JSInliningHeuristic final : public AdvancedReducer {
  public:
-  enum Mode { kGeneralInlining, kRestrictedInlining, kStressInlining };
-  JSInliningHeuristic(Editor* editor, Mode mode, Zone* local_zone,
+  JSInliningHeuristic(Editor* editor, Zone* local_zone,
                       OptimizedCompilationInfo* info, JSGraph* jsgraph,
                       JSHeapBroker* broker,
                       SourcePositionTable* source_positions)
       : AdvancedReducer(editor),
-        mode_(mode),
         inliner_(editor, local_zone, info, jsgraph, broker, source_positions),
         candidates_(local_zone),
         seen_(local_zone),
@@ -90,7 +88,6 @@ class JSInliningHeuristic final : public AdvancedReducer {
   Isolate* isolate() const { return jsgraph_->isolate(); }
   SimplifiedOperatorBuilder* simplified() const;
 
-  Mode const mode_;
   JSInliner inliner_;
   Candidates candidates_;
   ZoneSet<NodeId> seen_;
diff --git a/deps/v8/src/compiler/js-inlining.cc b/deps/v8/src/compiler/js-inlining.cc
index 6c071438cc5b65..60c7626067cf25 100644
--- a/deps/v8/src/compiler/js-inlining.cc
+++ b/deps/v8/src/compiler/js-inlining.cc
@@ -268,7 +268,6 @@ Node* JSInliner::CreateArtificialFrameState(Node* node, Node* outer_frame_state,
 
 namespace {
 
-// TODO(mstarzinger,verwaest): Move this predicate onto SharedFunctionInfo?
 bool NeedsImplicitReceiver(SharedFunctionInfoRef shared_info) {
   DisallowHeapAllocation no_gc;
   return !shared_info.construct_as_builtin() &&
@@ -414,13 +413,14 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
   NodeProperties::IsExceptionalCall(node, &exception_target);
 
   // JSInliningHeuristic has already filtered candidates without a BytecodeArray
-  // by calling SharedFunctionInfoRef::IsInlineable. For the ones passing the
-  // IsInlineable check, the broker holds a reference to the bytecode array,
-  // which prevents it from getting flushed.  Therefore, the following check
-  // should always hold true.
+  // based on SharedFunctionInfoRef::GetInlineability. For the inlineable ones
+  // (kIsInlineable), the broker holds a reference to the bytecode array, which
+  // prevents it from getting flushed.  Therefore, the following check should
+  // always hold true.
   CHECK(shared_info->is_compiled());
 
-  if (!FLAG_concurrent_inlining && info_->is_source_positions_enabled()) {
+  if (!broker()->is_concurrent_inlining() &&
+      info_->is_source_positions_enabled()) {
     SharedFunctionInfo::EnsureSourcePositionsAvailable(isolate(),
                                                        shared_info->object());
   }
@@ -431,7 +431,7 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
   // Determine the target's feedback vector and its context.
   Node* context;
   FeedbackVectorRef feedback_vector = DetermineCallContext(node, &context);
-  CHECK(shared_info->IsSerializedForCompilation(feedback_vector));
+  CHECK(broker()->IsSerializedForCompilation(*shared_info, feedback_vector));
 
   // ----------------------------------------------------------------
   // After this point, we've made a decision to inline this function.
diff --git a/deps/v8/src/compiler/js-intrinsic-lowering.cc b/deps/v8/src/compiler/js-intrinsic-lowering.cc
index ccb0622017d46b..9d6f071aacc7b6 100644
--- a/deps/v8/src/compiler/js-intrinsic-lowering.cc
+++ b/deps/v8/src/compiler/js-intrinsic-lowering.cc
@@ -9,6 +9,7 @@
 #include "src/codegen/code-factory.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
+#include "src/compiler/js-heap-broker.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
@@ -26,13 +27,17 @@ JSIntrinsicLowering::JSIntrinsicLowering(Editor* editor, JSGraph* jsgraph,
     : AdvancedReducer(editor), jsgraph_(jsgraph), broker_(broker) {}
 
 Reduction JSIntrinsicLowering::Reduce(Node* node) {
-  DisallowHeapAccessIf no_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf no_heap_access(broker()->is_concurrent_inlining());
 
   if (node->opcode() != IrOpcode::kJSCallRuntime) return NoChange();
   const Runtime::Function* const f =
       Runtime::FunctionForId(CallRuntimeParametersOf(node->op()).id());
-  if (f->function_id == Runtime::kTurbofanStaticAssert)
+  if (f->function_id == Runtime::kTurbofanStaticAssert) {
     return ReduceTurbofanStaticAssert(node);
+  }
+  if (f->function_id == Runtime::kIsBeingInterpreted) {
+    return ReduceIsBeingInterpreted(node);
+  }
   if (f->intrinsic_type != Runtime::IntrinsicType::INLINE) return NoChange();
   switch (f->function_id) {
     case Runtime::kInlineCopyDataProperties:
@@ -284,6 +289,11 @@ Reduction JSIntrinsicLowering::ReduceTurbofanStaticAssert(Node* node) {
   return Changed(jsgraph_->UndefinedConstant());
 }
 
+Reduction JSIntrinsicLowering::ReduceIsBeingInterpreted(Node* node) {
+  RelaxEffectsAndControls(node);
+  return Changed(jsgraph_->FalseConstant());
+}
+
 Reduction JSIntrinsicLowering::Change(Node* node, const Operator* op) {
   // Replace all effect uses of {node} with the effect dependency.
   RelaxEffectsAndControls(node);
diff --git a/deps/v8/src/compiler/js-intrinsic-lowering.h b/deps/v8/src/compiler/js-intrinsic-lowering.h
index f32b53b5863766..2331446c123a49 100644
--- a/deps/v8/src/compiler/js-intrinsic-lowering.h
+++ b/deps/v8/src/compiler/js-intrinsic-lowering.h
@@ -58,6 +58,7 @@ class V8_EXPORT_PRIVATE JSIntrinsicLowering final
   Reduction ReduceIsInstanceType(Node* node, InstanceType instance_type);
   Reduction ReduceIsJSReceiver(Node* node);
   Reduction ReduceIsSmi(Node* node);
+  Reduction ReduceIsBeingInterpreted(Node* node);
   Reduction ReduceTurbofanStaticAssert(Node* node);
   Reduction ReduceToLength(Node* node);
   Reduction ReduceToObject(Node* node);
diff --git a/deps/v8/src/compiler/js-native-context-specialization.cc b/deps/v8/src/compiler/js-native-context-specialization.cc
index 80c620034b2bf8..3d730a07ef6d8a 100644
--- a/deps/v8/src/compiler/js-native-context-specialization.cc
+++ b/deps/v8/src/compiler/js-native-context-specialization.cc
@@ -53,6 +53,10 @@ bool HasOnlyJSArrayMaps(JSHeapBroker* broker,
 
 }  // namespace
 
+bool JSNativeContextSpecialization::should_disallow_heap_access() const {
+  return broker()->is_concurrent_inlining();
+}
+
 JSNativeContextSpecialization::JSNativeContextSpecialization(
     Editor* editor, JSGraph* jsgraph, JSHeapBroker* broker, Flags flags,
     CompilationDependencies* dependencies, Zone* zone, Zone* shared_zone)
@@ -69,7 +73,7 @@ JSNativeContextSpecialization::JSNativeContextSpecialization(
       type_cache_(TypeCache::Get()) {}
 
 Reduction JSNativeContextSpecialization::Reduce(Node* node) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
 
   switch (node->opcode()) {
     case IrOpcode::kJSAdd:
@@ -92,8 +96,6 @@ Reduction JSNativeContextSpecialization::Reduce(Node* node) {
       return ReduceJSPromiseResolve(node);
     case IrOpcode::kJSResolvePromise:
       return ReduceJSResolvePromise(node);
-    case IrOpcode::kJSLoadContext:
-      return ReduceJSLoadContext(node);
     case IrOpcode::kJSLoadGlobal:
       return ReduceJSLoadGlobal(node);
     case IrOpcode::kJSStoreGlobal:
@@ -353,7 +355,7 @@ Reduction JSNativeContextSpecialization::ReduceJSGetSuperConstructor(
   if (!m.HasValue()) return NoChange();
   JSFunctionRef function = m.Ref(broker()).AsJSFunction();
   MapRef function_map = function.map();
-  if (FLAG_concurrent_inlining && !function_map.serialized_prototype()) {
+  if (should_disallow_heap_access() && !function_map.serialized_prototype()) {
     TRACE_BROKER_MISSING(broker(), "data for map " << function_map);
     return NoChange();
   }
@@ -405,7 +407,7 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
   MapRef receiver_map = receiver_ref.map();
 
   PropertyAccessInfo access_info = PropertyAccessInfo::Invalid(graph()->zone());
-  if (FLAG_concurrent_inlining) {
+  if (should_disallow_heap_access()) {
     access_info = broker()->GetPropertyAccessInfo(
         receiver_map,
         NameRef(broker(), isolate()->factory()->has_instance_symbol()),
@@ -531,7 +533,7 @@ JSNativeContextSpecialization::InferHasInPrototypeChain(
         all = false;
         break;
       }
-      if (FLAG_concurrent_inlining && !map.serialized_prototype()) {
+      if (should_disallow_heap_access() && !map.serialized_prototype()) {
         TRACE_BROKER_MISSING(broker(), "prototype data for map " << map);
         return kMayBeInPrototypeChain;
       }
@@ -610,7 +612,7 @@ Reduction JSNativeContextSpecialization::ReduceJSOrdinaryHasInstance(
     // OrdinaryHasInstance on bound functions turns into a recursive invocation
     // of the instanceof operator again.
     JSBoundFunctionRef function = m.Ref(broker()).AsJSBoundFunction();
-    if (FLAG_concurrent_inlining && !function.serialized()) {
+    if (should_disallow_heap_access() && !function.serialized()) {
       TRACE_BROKER_MISSING(broker(), "data for JSBoundFunction " << function);
       return NoChange();
     }
@@ -629,7 +631,7 @@ Reduction JSNativeContextSpecialization::ReduceJSOrdinaryHasInstance(
     // Optimize if we currently know the "prototype" property.
 
     JSFunctionRef function = m.Ref(broker()).AsJSFunction();
-    if (FLAG_concurrent_inlining && !function.serialized()) {
+    if (should_disallow_heap_access() && !function.serialized()) {
       TRACE_BROKER_MISSING(broker(), "data for JSFunction " << function);
       return NoChange();
     }
@@ -708,7 +710,7 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
   ZoneVector<PropertyAccessInfo> access_infos(graph()->zone());
   AccessInfoFactory access_info_factory(broker(), dependencies(),
                                         graph()->zone());
-  if (!FLAG_concurrent_inlining) {
+  if (!should_disallow_heap_access()) {
     access_info_factory.ComputePropertyAccessInfos(
         resolution_maps, factory()->then_string(), AccessMode::kLoad,
         &access_infos);
@@ -744,31 +746,15 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
   return Replace(value);
 }
 
-Reduction JSNativeContextSpecialization::ReduceJSLoadContext(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSLoadContext, node->opcode());
-  ContextAccess const& access = ContextAccessOf(node->op());
-  // Specialize JSLoadContext(NATIVE_CONTEXT_INDEX) to the known native
-  // context (if any), so we can constant-fold those fields, which is
-  // safe, since the NATIVE_CONTEXT_INDEX slot is always immutable.
-  if (access.index() == Context::NATIVE_CONTEXT_INDEX) {
-    Node* value = jsgraph()->Constant(native_context());
-    ReplaceWithValue(node, value);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
 namespace {
 
 FieldAccess ForPropertyCellValue(MachineRepresentation representation,
                                  Type type, MaybeHandle<Map> map,
                                  NameRef const& name) {
   WriteBarrierKind kind = kFullWriteBarrier;
-  if (representation == MachineRepresentation::kTaggedSigned ||
-      representation == MachineRepresentation::kCompressedSigned) {
+  if (representation == MachineRepresentation::kTaggedSigned) {
     kind = kNoWriteBarrier;
-  } else if (representation == MachineRepresentation::kTaggedPointer ||
-             representation == MachineRepresentation::kCompressedPointer) {
+  } else if (representation == MachineRepresentation::kTaggedPointer) {
     kind = kPointerWriteBarrier;
   }
   MachineType r = MachineType::TypeForRepresentation(representation);
@@ -884,21 +870,20 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
         // Load from constant type cell can benefit from type feedback.
         MaybeHandle<Map> map;
         Type property_cell_value_type = Type::NonInternal();
-        MachineRepresentation representation =
-            MachineType::RepCompressedTagged();
+        MachineRepresentation representation = MachineRepresentation::kTagged;
         if (property_details.cell_type() == PropertyCellType::kConstantType) {
           // Compute proper type based on the current value in the cell.
           if (property_cell_value.IsSmi()) {
             property_cell_value_type = Type::SignedSmall();
-            representation = MachineType::RepCompressedTaggedSigned();
+            representation = MachineRepresentation::kTaggedSigned;
           } else if (property_cell_value.IsHeapNumber()) {
             property_cell_value_type = Type::Number();
-            representation = MachineType::RepCompressedTaggedPointer();
+            representation = MachineRepresentation::kTaggedPointer;
           } else {
             MapRef property_cell_value_map =
                 property_cell_value.AsHeapObject().map();
             property_cell_value_type = Type::For(property_cell_value_map);
-            representation = MachineType::RepCompressedTaggedPointer();
+            representation = MachineRepresentation::kTaggedPointer;
 
             // We can only use the property cell value map for map check
             // elimination if it's stable, i.e. the HeapObject wasn't
@@ -941,8 +926,7 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
         // cell.
         dependencies()->DependOnGlobalProperty(property_cell);
         Type property_cell_value_type;
-        MachineRepresentation representation =
-            MachineType::RepCompressedTagged();
+        MachineRepresentation representation = MachineRepresentation::kTagged;
         if (property_cell_value.IsHeapObject()) {
           // We cannot do anything if the {property_cell_value}s map is no
           // longer stable.
@@ -961,13 +945,13 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
                   ZoneHandleSet<Map>(property_cell_value_map.object())),
               value, effect, control);
           property_cell_value_type = Type::OtherInternal();
-          representation = MachineType::RepCompressedTaggedPointer();
+          representation = MachineRepresentation::kTaggedPointer;
         } else {
           // Check that the {value} is a Smi.
           value = effect = graph()->NewNode(
               simplified()->CheckSmi(FeedbackSource()), value, effect, control);
           property_cell_value_type = Type::SignedSmall();
-          representation = MachineType::RepCompressedTaggedSigned();
+          representation = MachineRepresentation::kTaggedSigned;
         }
         effect = graph()->NewNode(simplified()->StoreField(ForPropertyCellValue(
                                       representation, property_cell_value_type,
@@ -982,7 +966,7 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
         dependencies()->DependOnGlobalProperty(property_cell);
         effect = graph()->NewNode(
             simplified()->StoreField(ForPropertyCellValue(
-                MachineType::RepCompressedTagged(), Type::NonInternal(),
+                MachineRepresentation::kTagged, Type::NonInternal(),
                 MaybeHandle<Map>(), name)),
             jsgraph()->Constant(property_cell), value, effect, control);
         break;
@@ -1098,8 +1082,9 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
       if (map.is_deprecated()) continue;
       PropertyAccessInfo access_info = broker()->GetPropertyAccessInfo(
           map, feedback.name(), access_mode, dependencies(),
-          FLAG_concurrent_inlining ? SerializationPolicy::kAssumeSerialized
-                                   : SerializationPolicy::kSerializeIfNeeded);
+          should_disallow_heap_access()
+              ? SerializationPolicy::kAssumeSerialized
+              : SerializationPolicy::kSerializeIfNeeded);
       access_infos_for_feedback.push_back(access_info);
     }
 
@@ -1346,7 +1331,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
         name.equals(ObjectRef(broker(), factory()->prototype_string()))) {
       // Optimize "prototype" property of functions.
       JSFunctionRef function = object.AsJSFunction();
-      if (FLAG_concurrent_inlining && !function.serialized()) {
+      if (should_disallow_heap_access() && !function.serialized()) {
         TRACE_BROKER_MISSING(broker(), "data for function " << function);
         return NoChange();
       }
@@ -1384,35 +1369,6 @@ Reduction JSNativeContextSpecialization::ReduceJSGetIterator(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
-  Node* iterator_exception_node = nullptr;
-  Node* if_exception_merge = nullptr;
-  Node* if_exception_effect_phi = nullptr;
-  Node* if_exception_phi = nullptr;
-  bool has_exception_node =
-      NodeProperties::IsExceptionalCall(node, &iterator_exception_node);
-  if (has_exception_node) {
-    // If there exists an IfException node for the current {node}, we need
-    // exception handling for all the desugared nodes. Create a combination
-    // of Merge+Phi+EffectPhi nodes that consumes the exception paths from
-    // from all the desugared nodes including the original exception node.
-    // Usages of the original exception node are then rewired to the newly
-    // created combination of Merge+Phi+EffectPhi. Here, use dead_node as a
-    // placeholder for the original exception node until its uses are rewired.
-
-    Node* dead_node = jsgraph()->Dead();
-    if_exception_merge = graph()->NewNode(common()->Merge(1), dead_node);
-    if_exception_effect_phi =
-        graph()->NewNode(common()->EffectPhi(1), dead_node, if_exception_merge);
-    if_exception_phi =
-        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 1),
-                         dead_node, if_exception_merge);
-    ReplaceWithValue(iterator_exception_node, if_exception_phi,
-                     if_exception_effect_phi, if_exception_merge);
-    if_exception_merge->ReplaceInput(0, iterator_exception_node);
-    if_exception_effect_phi->ReplaceInput(0, iterator_exception_node);
-    if_exception_phi->ReplaceInput(0, iterator_exception_node);
-  }
-
   // Load iterator property operator
   Handle<Name> iterator_symbol = factory()->iterator_symbol();
   const Operator* load_op =
@@ -1432,10 +1388,31 @@ Reduction JSNativeContextSpecialization::ReduceJSGetIterator(Node* node) {
   control = load_property;
 
   // Handle exception path for the load named property
-  if (has_exception_node) {
-    control =
-        AppendExceptionHandling(effect, control, if_exception_merge,
-                                if_exception_phi, if_exception_effect_phi);
+  Node* iterator_exception_node = nullptr;
+  if (NodeProperties::IsExceptionalCall(node, &iterator_exception_node)) {
+    // If there exists an exception node for the given iterator_node, create a
+    // pair of IfException/IfSuccess nodes on the current control path. The uses
+    // of new exception node are merged with the original exception node. The
+    // IfSuccess node is returned as a control path for further reduction.
+    Node* exception_node =
+        graph()->NewNode(common()->IfException(), effect, control);
+    Node* if_success = graph()->NewNode(common()->IfSuccess(), control);
+
+    // Use dead_node as a placeholder for the original exception node until
+    // its uses are rewired to the nodes merging the exceptions
+    Node* dead_node = jsgraph()->Dead();
+    Node* merge_node =
+        graph()->NewNode(common()->Merge(2), dead_node, exception_node);
+    Node* effect_phi = graph()->NewNode(common()->EffectPhi(2), dead_node,
+                                        exception_node, merge_node);
+    Node* phi =
+        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                         dead_node, exception_node, merge_node);
+    ReplaceWithValue(iterator_exception_node, phi, effect_phi, merge_node);
+    phi->ReplaceInput(0, iterator_exception_node);
+    effect_phi->ReplaceInput(0, iterator_exception_node);
+    merge_node->ReplaceInput(0, iterator_exception_node);
+    control = if_success;
   }
 
   // Eager deopt of call iterator property
@@ -1455,49 +1432,12 @@ Reduction JSNativeContextSpecialization::ReduceJSGetIterator(Node* node) {
                              : feedback.AsCall().speculation_mode();
   const Operator* call_op =
       javascript()->Call(2, CallFrequency(), p.callFeedback(),
-                         ConvertReceiverMode::kNotNullOrUndefined, mode);
+                         ConvertReceiverMode::kNotNullOrUndefined, mode,
+                         CallFeedbackRelation::kRelated);
   Node* call_property = graph()->NewNode(call_op, load_property, receiver,
                                          context, frame_state, effect, control);
-  effect = call_property;
-  control = call_property;
-  if (has_exception_node) {
-    control =
-        AppendExceptionHandling(effect, control, if_exception_merge,
-                                if_exception_phi, if_exception_effect_phi);
-  }
-
-  // Check if the call property returns a valid JSReceiver else throw an invalid
-  // iterator runtime exception
-  Node* is_receiver =
-      graph()->NewNode(simplified()->ObjectIsReceiver(), call_property);
-  Node* branch_node = graph()->NewNode(
-      common()->Branch(BranchHint::kNone, IsSafetyCheck::kNoSafetyCheck),
-      is_receiver, control);
-  {
-    // Create a version of effect and control for the false path of the branch
-    Node* effect = call_property;
-    Node* control = call_property;
-    Node* if_not_receiver = graph()->NewNode(common()->IfFalse(), branch_node);
-    control = if_not_receiver;
-    const Operator* call_runtime_op =
-        javascript()->CallRuntime(Runtime::kThrowSymbolIteratorInvalid, 0);
-    Node* call_runtime = graph()->NewNode(call_runtime_op, context, frame_state,
-                                          effect, control);
-    control = call_runtime;
-    effect = call_runtime;
-    if (has_exception_node) {
-      control =
-          AppendExceptionHandling(effect, control, if_exception_merge,
-                                  if_exception_phi, if_exception_effect_phi);
-    }
-    Node* throw_node =
-        graph()->NewNode(common()->Throw(), call_runtime, control);
-    NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
-  }
 
-  Node* if_receiver = graph()->NewNode(common()->IfTrue(), branch_node);
-  ReplaceWithValue(node, call_property, effect, if_receiver);
-  return Replace(if_receiver);
+  return Replace(call_property);
 }
 
 Reduction JSNativeContextSpecialization::ReduceJSStoreNamed(Node* node) {
@@ -1687,7 +1627,7 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
     base::Optional<JSTypedArrayRef> typed_array =
         GetTypedArrayConstant(broker(), receiver);
     if (typed_array.has_value()) {
-      if (FLAG_concurrent_inlining && !typed_array->serialized()) {
+      if (should_disallow_heap_access() && !typed_array->serialized()) {
         TRACE_BROKER_MISSING(broker(), "data for typed array " << *typed_array);
         return NoChange();
       }
@@ -1904,7 +1844,7 @@ Reduction JSNativeContextSpecialization::ReduceElementLoadFromHeapConstant(
 Reduction JSNativeContextSpecialization::ReducePropertyAccess(
     Node* node, Node* key, base::Optional<NameRef> static_name, Node* value,
     FeedbackSource const& source, AccessMode access_mode) {
-  DisallowHeapAccessIf disallow_heap_access(FLAG_concurrent_inlining);
+  DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
 
   DCHECK_EQ(key == nullptr, static_name.has_value());
   DCHECK(node->opcode() == IrOpcode::kJSLoadProperty ||
@@ -2371,8 +2311,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
             value = effect = a.Finish();
 
             field_access.type = Type::Any();
-            field_access.machine_type =
-                MachineType::TypeCompressedTaggedPointer();
+            field_access.machine_type = MachineType::TaggedPointer();
             field_access.write_barrier_kind = kPointerWriteBarrier;
           } else {
             // We just store directly to the HeapNumber.
@@ -2382,7 +2321,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
                 name.object(),
                 MaybeHandle<Map>(),
                 Type::OtherInternal(),
-                MachineType::TypeCompressedTaggedPointer(),
+                MachineType::TaggedPointer(),
                 kPointerWriteBarrier,
                 LoadSensitivity::kUnsafe,
                 access_info.GetConstFieldInfo(),
@@ -2414,9 +2353,6 @@ JSNativeContextSpecialization::BuildPropertyStore(
       case MachineRepresentation::kTaggedSigned:
       case MachineRepresentation::kTaggedPointer:
       case MachineRepresentation::kTagged:
-      case MachineRepresentation::kCompressedSigned:
-      case MachineRepresentation::kCompressedPointer:
-      case MachineRepresentation::kCompressed:
         if (store_to_existing_constant_field) {
           DCHECK(!access_info.HasTransitionMap());
           // If the field is constant check that the value we are going
@@ -2432,16 +2368,13 @@ JSNativeContextSpecialization::BuildPropertyStore(
           return ValueEffectControl(value, effect, control);
         }
 
-        if (field_representation == MachineRepresentation::kTaggedSigned ||
-            field_representation == MachineRepresentation::kCompressedSigned) {
+        if (field_representation == MachineRepresentation::kTaggedSigned) {
           value = effect = graph()->NewNode(
               simplified()->CheckSmi(FeedbackSource()), value, effect, control);
           field_access.write_barrier_kind = kNoWriteBarrier;
 
         } else if (field_representation ==
-                       MachineRepresentation::kTaggedPointer ||
-                   field_representation ==
-                       MachineRepresentation::kCompressedPointer) {
+                   MachineRepresentation::kTaggedPointer) {
           Handle<Map> field_map;
           if (access_info.field_map().ToHandle(&field_map)) {
             // Emit a map check for the value.
@@ -2457,12 +2390,13 @@ JSNativeContextSpecialization::BuildPropertyStore(
           field_access.write_barrier_kind = kPointerWriteBarrier;
 
         } else {
-          DCHECK(field_representation == MachineRepresentation::kTagged ||
-                 field_representation == MachineRepresentation::kCompressed);
+          DCHECK(field_representation == MachineRepresentation::kTagged);
         }
         break;
       case MachineRepresentation::kNone:
       case MachineRepresentation::kBit:
+      case MachineRepresentation::kCompressedPointer:
+      case MachineRepresentation::kCompressed:
       case MachineRepresentation::kWord8:
       case MachineRepresentation::kWord16:
       case MachineRepresentation::kWord32:
@@ -2658,6 +2592,8 @@ JSNativeContextSpecialization::BuildElementAccess(
       buffer_or_receiver = buffer;
     }
 
+    enum Situation { kBoundsCheckDone, kHandleOOB_SmiCheckDone };
+    Situation situation;
     if ((keyed_mode.IsLoad() &&
          keyed_mode.load_mode() == LOAD_IGNORE_OUT_OF_BOUNDS) ||
         (keyed_mode.IsStore() &&
@@ -2672,11 +2608,13 @@ JSNativeContextSpecialization::BuildElementAccess(
       // below are performed on unsigned values, which means that all the
       // Negative32 values are treated as out-of-bounds.
       index = graph()->NewNode(simplified()->NumberToUint32(), index);
+      situation = kHandleOOB_SmiCheckDone;
     } else {
       // Check that the {index} is in the valid range for the {receiver}.
       index = effect =
           graph()->NewNode(simplified()->CheckBounds(FeedbackSource()), index,
                            length, effect, control);
+      situation = kBoundsCheckDone;
     }
 
     // Access the actual element.
@@ -2685,7 +2623,7 @@ JSNativeContextSpecialization::BuildElementAccess(
     switch (keyed_mode.access_mode()) {
       case AccessMode::kLoad: {
         // Check if we can return undefined for out-of-bounds loads.
-        if (keyed_mode.load_mode() == LOAD_IGNORE_OUT_OF_BOUNDS) {
+        if (situation == kHandleOOB_SmiCheckDone) {
           Node* check =
               graph()->NewNode(simplified()->NumberLessThan(), index, length);
           Node* branch = graph()->NewNode(
@@ -2720,6 +2658,7 @@ JSNativeContextSpecialization::BuildElementAccess(
                                vtrue, vfalse, control);
         } else {
           // Perform the actual load.
+          DCHECK_EQ(kBoundsCheckDone, situation);
           value = effect = graph()->NewNode(
               simplified()->LoadTypedElement(external_array_type),
               buffer_or_receiver, base_pointer, external_pointer, index, effect,
@@ -2746,8 +2685,9 @@ JSNativeContextSpecialization::BuildElementAccess(
           value = graph()->NewNode(simplified()->NumberToUint8Clamped(), value);
         }
 
-        // Check if we can skip the out-of-bounds store.
-        if (keyed_mode.store_mode() == STORE_IGNORE_OUT_OF_BOUNDS) {
+        if (situation == kHandleOOB_SmiCheckDone) {
+          // We have to detect OOB stores and handle them without deopt (by
+          // simply not performing them).
           Node* check =
               graph()->NewNode(simplified()->NumberLessThan(), index, length);
           Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
@@ -2774,6 +2714,7 @@ JSNativeContextSpecialization::BuildElementAccess(
               graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
         } else {
           // Perform the actual store
+          DCHECK_EQ(kBoundsCheckDone, situation);
           effect = graph()->NewNode(
               simplified()->StoreTypedElement(external_array_type),
               buffer_or_receiver, base_pointer, external_pointer, index, value,
@@ -2782,11 +2723,16 @@ JSNativeContextSpecialization::BuildElementAccess(
         break;
       }
       case AccessMode::kHas:
-        // For has property on a typed array, all we need is a bounds check.
-        value = effect =
-            graph()->NewNode(simplified()->SpeculativeNumberLessThan(
-                                 NumberOperationHint::kSignedSmall),
-                             index, length, effect, control);
+        if (situation == kHandleOOB_SmiCheckDone) {
+          value = effect =
+              graph()->NewNode(simplified()->SpeculativeNumberLessThan(
+                                   NumberOperationHint::kSignedSmall),
+                               index, length, effect, control);
+        } else {
+          DCHECK_EQ(kBoundsCheckDone, situation);
+          // For has-property on a typed array, all we need is a bounds check.
+          value = jsgraph()->TrueConstant();
+        }
         break;
     }
   } else {
@@ -2842,13 +2788,13 @@ JSNativeContextSpecialization::BuildElementAccess(
 
     // Compute the element access.
     Type element_type = Type::NonInternal();
-    MachineType element_machine_type = MachineType::TypeCompressedTagged();
+    MachineType element_machine_type = MachineType::AnyTagged();
     if (IsDoubleElementsKind(elements_kind)) {
       element_type = Type::Number();
       element_machine_type = MachineType::Float64();
     } else if (IsSmiElementsKind(elements_kind)) {
       element_type = Type::SignedSmall();
-      element_machine_type = MachineType::TypeCompressedTaggedSigned();
+      element_machine_type = MachineType::TaggedSigned();
     }
     ElementAccess element_access = {
         kTaggedBase,       FixedArray::kHeaderSize,
@@ -2865,7 +2811,7 @@ JSNativeContextSpecialization::BuildElementAccess(
       }
       if (elements_kind == HOLEY_ELEMENTS ||
           elements_kind == HOLEY_SMI_ELEMENTS) {
-        element_access.machine_type = MachineType::TypeCompressedTagged();
+        element_access.machine_type = MachineType::AnyTagged();
       }
 
       // Check if we can return undefined for out-of-bounds loads.
@@ -2973,7 +2919,7 @@ JSNativeContextSpecialization::BuildElementAccess(
 
         if (elements_kind == HOLEY_ELEMENTS ||
             elements_kind == HOLEY_SMI_ELEMENTS) {
-          element_access.machine_type = MachineType::TypeCompressedTagged();
+          element_access.machine_type = MachineType::AnyTagged();
         }
 
         Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
@@ -3264,22 +3210,6 @@ Node* JSNativeContextSpecialization::BuildCheckEqualsName(NameRef const& name,
                           control);
 }
 
-Node* JSNativeContextSpecialization::AppendExceptionHandling(
-    Node* effect, Node* control, Node* merge, Node* phi, Node* effect_phi) {
-  DCHECK_EQ(effect, control);
-  int input_count = merge->InputCount() + 1;
-  Node* if_exception =
-      graph()->NewNode(common()->IfException(), effect, control);
-  merge->InsertInput(graph()->zone(), 0, if_exception);
-  NodeProperties::ChangeOp(merge, common()->Merge(input_count));
-  phi->InsertInput(graph()->zone(), 0, if_exception);
-  NodeProperties::ChangeOp(
-      phi, common()->Phi(MachineRepresentation::kTagged, input_count));
-  effect_phi->InsertInput(graph()->zone(), 0, if_exception);
-  NodeProperties::ChangeOp(effect_phi, common()->EffectPhi(input_count));
-  return graph()->NewNode(common()->IfSuccess(), control);
-}
-
 bool JSNativeContextSpecialization::CanTreatHoleAsUndefined(
     ZoneVector<Handle<Map>> const& receiver_maps) {
   // Check if all {receiver_maps} have one of the initial Array.prototype
diff --git a/deps/v8/src/compiler/js-native-context-specialization.h b/deps/v8/src/compiler/js-native-context-specialization.h
index 429be0bb242636..dda7cfc8180eb8 100644
--- a/deps/v8/src/compiler/js-native-context-specialization.h
+++ b/deps/v8/src/compiler/js-native-context-specialization.h
@@ -46,8 +46,7 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
   // Flags that control the mode of operation.
   enum Flag {
     kNoFlags = 0u,
-    kAccessorInliningEnabled = 1u << 0,
-    kBailoutOnUninitialized = 1u << 1
+    kBailoutOnUninitialized = 1u << 0,
   };
   using Flags = base::Flags<Flag>;
 
@@ -79,7 +78,6 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
   Reduction ReduceJSOrdinaryHasInstance(Node* node);
   Reduction ReduceJSPromiseResolve(Node* node);
   Reduction ReduceJSResolvePromise(Node* node);
-  Reduction ReduceJSLoadContext(Node* node);
   Reduction ReduceJSLoadGlobal(Node* node);
   Reduction ReduceJSStoreGlobal(Node* node);
   Reduction ReduceJSLoadNamed(Node* node);
@@ -203,12 +201,6 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
   Node* BuildCheckEqualsName(NameRef const& name, Node* value, Node* effect,
                              Node* control);
 
-  // Attach a pair of success and exception paths on a given control path.
-  // The exception is joined to the Merge+Phi+EffectPhi nodes while the success
-  // path is returned.
-  Node* AppendExceptionHandling(Node* effect, Node* control, Node* merge,
-                                Node* phi, Node* effect_phi);
-
   // Checks if we can turn the hole into undefined when loading an element
   // from an object with one of the {receiver_maps}; sets up appropriate
   // code dependencies and might use the array protector cell.
@@ -258,6 +250,7 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
   CompilationDependencies* dependencies() const { return dependencies_; }
   Zone* zone() const { return zone_; }
   Zone* shared_zone() const { return shared_zone_; }
+  bool should_disallow_heap_access() const;
 
   JSGraph* const jsgraph_;
   JSHeapBroker* const broker_;
diff --git a/deps/v8/src/compiler/js-operator.cc b/deps/v8/src/compiler/js-operator.cc
index 42e5f900576bd0..45e144094b9a29 100644
--- a/deps/v8/src/compiler/js-operator.cc
+++ b/deps/v8/src/compiler/js-operator.cc
@@ -23,8 +23,7 @@ std::ostream& operator<<(std::ostream& os, CallFrequency const& f) {
 }
 
 CallFrequency CallFrequencyOf(Operator const* op) {
-  DCHECK(op->opcode() == IrOpcode::kJSCallWithArrayLike ||
-         op->opcode() == IrOpcode::kJSConstructWithArrayLike);
+  DCHECK_EQ(op->opcode(), IrOpcode::kJSConstructWithArrayLike);
   return OpParameter<CallFrequency>(op);
 }
 
@@ -66,11 +65,13 @@ ConstructParameters const& ConstructParametersOf(Operator const* op) {
 }
 
 std::ostream& operator<<(std::ostream& os, CallParameters const& p) {
-  return os << p.arity() << ", " << p.frequency() << ", " << p.convert_mode();
+  return os << p.arity() << ", " << p.frequency() << ", " << p.convert_mode()
+            << ", " << p.speculation_mode() << ", " << p.feedback_relation();
 }
 
 const CallParameters& CallParametersOf(const Operator* op) {
   DCHECK(op->opcode() == IrOpcode::kJSCall ||
+         op->opcode() == IrOpcode::kJSCallWithArrayLike ||
          op->opcode() == IrOpcode::kJSCallWithSpread);
   return OpParameter<CallParameters>(op);
 }
@@ -225,7 +226,7 @@ size_t hash_value(FeedbackParameter const& p) {
 }
 
 std::ostream& operator<<(std::ostream& os, FeedbackParameter const& p) {
-  return os;
+  return os << p.feedback();
 }
 
 FeedbackParameter const& FeedbackParameterOf(const Operator* op) {
@@ -436,7 +437,7 @@ size_t hash_value(CreateCollectionIteratorParameters const& p) {
 
 std::ostream& operator<<(std::ostream& os,
                          CreateCollectionIteratorParameters const& p) {
-  return os << p.collection_kind() << " " << p.iteration_kind();
+  return os << p.collection_kind() << ", " << p.iteration_kind();
 }
 
 const CreateCollectionIteratorParameters& CreateCollectionIteratorParametersOf(
@@ -692,7 +693,6 @@ CompareOperationHint CompareOperationHintOf(const Operator* op) {
   V(GeneratorRestoreContinuation, Operator::kNoThrow, 1, 1)              \
   V(GeneratorRestoreContext, Operator::kNoThrow, 1, 1)                   \
   V(GeneratorRestoreInputOrDebugPos, Operator::kNoThrow, 1, 1)           \
-  V(StackCheck, Operator::kNoWrite, 0, 0)                                \
   V(Debugger, Operator::kNoProperties, 0, 0)                             \
   V(FulfillPromise, Operator::kNoDeopt | Operator::kNoThrow, 2, 1)       \
   V(PerformPromiseThen, Operator::kNoDeopt | Operator::kNoThrow, 4, 1)   \
@@ -883,15 +883,12 @@ const Operator* JSOperatorBuilder::CallForwardVarargs(size_t arity,
       parameters);                                               // parameter
 }
 
-const Operator* JSOperatorBuilder::Call(size_t arity,
-                                        CallFrequency const& frequency,
-                                        FeedbackSource const& feedback,
-                                        ConvertReceiverMode convert_mode,
-                                        SpeculationMode speculation_mode) {
-  DCHECK_IMPLIES(speculation_mode == SpeculationMode::kAllowSpeculation,
-                 feedback.IsValid());
+const Operator* JSOperatorBuilder::Call(
+    size_t arity, CallFrequency const& frequency,
+    FeedbackSource const& feedback, ConvertReceiverMode convert_mode,
+    SpeculationMode speculation_mode, CallFeedbackRelation feedback_relation) {
   CallParameters parameters(arity, frequency, feedback, convert_mode,
-                            speculation_mode);
+                            speculation_mode, feedback_relation);
   return new (zone()) Operator1<CallParameters>(   // --
       IrOpcode::kJSCall, Operator::kNoProperties,  // opcode
       "JSCall",                                    // name
@@ -900,21 +897,26 @@ const Operator* JSOperatorBuilder::Call(size_t arity,
 }
 
 const Operator* JSOperatorBuilder::CallWithArrayLike(
-    CallFrequency const& frequency) {
-  return new (zone()) Operator1<CallFrequency>(                 // --
+    const CallFrequency& frequency, const FeedbackSource& feedback,
+    SpeculationMode speculation_mode, CallFeedbackRelation feedback_relation) {
+  CallParameters parameters(2, frequency, feedback, ConvertReceiverMode::kAny,
+                            speculation_mode, feedback_relation);
+  return new (zone()) Operator1<CallParameters>(                // --
       IrOpcode::kJSCallWithArrayLike, Operator::kNoProperties,  // opcode
       "JSCallWithArrayLike",                                    // name
       3, 1, 1, 1, 1, 2,                                         // counts
-      frequency);                                               // parameter
+      parameters);                                              // parameter
 }
 
 const Operator* JSOperatorBuilder::CallWithSpread(
     uint32_t arity, CallFrequency const& frequency,
-    FeedbackSource const& feedback, SpeculationMode speculation_mode) {
+    FeedbackSource const& feedback, SpeculationMode speculation_mode,
+    CallFeedbackRelation feedback_relation) {
   DCHECK_IMPLIES(speculation_mode == SpeculationMode::kAllowSpeculation,
                  feedback.IsValid());
   CallParameters parameters(arity, frequency, feedback,
-                            ConvertReceiverMode::kAny, speculation_mode);
+                            ConvertReceiverMode::kAny, speculation_mode,
+                            feedback_relation);
   return new (zone()) Operator1<CallParameters>(             // --
       IrOpcode::kJSCallWithSpread, Operator::kNoProperties,  // opcode
       "JSCallWithSpread",                                    // name
@@ -1153,6 +1155,15 @@ const Operator* JSOperatorBuilder::StoreGlobal(LanguageMode language_mode,
       parameters);                                        // parameter
 }
 
+const Operator* JSOperatorBuilder::HasContextExtension(size_t depth) {
+  return new (zone()) Operator1<size_t>(        // --
+      IrOpcode::kJSHasContextExtension,         // opcode
+      Operator::kNoWrite | Operator::kNoThrow,  // flags
+      "JSHasContextExtension",                  // name
+      0, 1, 0, 1, 1, 0,                         // counts
+      depth);                                   // parameter
+}
+
 const Operator* JSOperatorBuilder::LoadContext(size_t depth, size_t index,
                                                bool immutable) {
   ContextAccess access(depth, index, immutable);
@@ -1334,6 +1345,15 @@ const Operator* JSOperatorBuilder::CloneObject(FeedbackSource const& feedback,
       parameters);                                       // parameter
 }
 
+const Operator* JSOperatorBuilder::StackCheck(StackCheckKind kind) {
+  return new (zone()) Operator1<StackCheckKind>(  // --
+      IrOpcode::kJSStackCheck,                    // opcode
+      Operator::kNoWrite,                         // properties
+      "JSStackCheck",                             // name
+      0, 1, 1, 0, 1, 2,                           // counts
+      kind);                                      // parameter
+}
+
 const Operator* JSOperatorBuilder::CreateEmptyLiteralObject() {
   return new (zone()) Operator(               // --
       IrOpcode::kJSCreateEmptyLiteralObject,  // opcode
diff --git a/deps/v8/src/compiler/js-operator.h b/deps/v8/src/compiler/js-operator.h
index 47b0fff05a6eef..1f9230d22b6425 100644
--- a/deps/v8/src/compiler/js-operator.h
+++ b/deps/v8/src/compiler/js-operator.h
@@ -6,8 +6,8 @@
 #define V8_COMPILER_JS_OPERATOR_H_
 
 #include "src/base/compiler-specific.h"
-#include "src/common/globals.h"
 #include "src/compiler/feedback-source.h"
+#include "src/compiler/globals.h"
 #include "src/handles/maybe-handles.h"
 #include "src/objects/type-hints.h"
 #include "src/runtime/runtime.h"
@@ -85,8 +85,8 @@ class ConstructForwardVarargsParameters final {
     return p.bit_field_;
   }
 
-  using ArityField = BitField<size_t, 0, 16>;
-  using StartIndexField = BitField<uint32_t, 16, 16>;
+  using ArityField = base::BitField<size_t, 0, 16>;
+  using StartIndexField = base::BitField<uint32_t, 16, 16>;
 
   uint32_t const bit_field_;
 };
@@ -147,8 +147,8 @@ class CallForwardVarargsParameters final {
     return p.bit_field_;
   }
 
-  using ArityField = BitField<size_t, 0, 15>;
-  using StartIndexField = BitField<uint32_t, 15, 15>;
+  using ArityField = base::BitField<size_t, 0, 15>;
+  using StartIndexField = base::BitField<uint32_t, 15, 15>;
 
   uint32_t const bit_field_;
 };
@@ -165,12 +165,20 @@ class CallParameters final {
   CallParameters(size_t arity, CallFrequency const& frequency,
                  FeedbackSource const& feedback,
                  ConvertReceiverMode convert_mode,
-                 SpeculationMode speculation_mode)
+                 SpeculationMode speculation_mode,
+                 CallFeedbackRelation feedback_relation)
       : bit_field_(ArityField::encode(arity) |
+                   CallFeedbackRelationField::encode(feedback_relation) |
                    SpeculationModeField::encode(speculation_mode) |
                    ConvertReceiverModeField::encode(convert_mode)),
         frequency_(frequency),
-        feedback_(feedback) {}
+        feedback_(feedback) {
+    // CallFeedbackRelation is ignored if the feedback slot is invalid.
+    DCHECK_IMPLIES(speculation_mode == SpeculationMode::kAllowSpeculation,
+                   feedback.IsValid());
+    DCHECK_IMPLIES(!feedback.IsValid(),
+                   feedback_relation == CallFeedbackRelation::kUnrelated);
+  }
 
   size_t arity() const { return ArityField::decode(bit_field_); }
   CallFrequency const& frequency() const { return frequency_; }
@@ -183,6 +191,10 @@ class CallParameters final {
     return SpeculationModeField::decode(bit_field_);
   }
 
+  CallFeedbackRelation feedback_relation() const {
+    return CallFeedbackRelationField::decode(bit_field_);
+  }
+
   bool operator==(CallParameters const& that) const {
     return this->bit_field_ == that.bit_field_ &&
            this->frequency_ == that.frequency_ &&
@@ -197,9 +209,10 @@ class CallParameters final {
                               feedback_hash(p.feedback_));
   }
 
-  using ArityField = BitField<size_t, 0, 28>;
-  using SpeculationModeField = BitField<SpeculationMode, 28, 1>;
-  using ConvertReceiverModeField = BitField<ConvertReceiverMode, 29, 2>;
+  using ArityField = base::BitField<size_t, 0, 27>;
+  using CallFeedbackRelationField = base::BitField<CallFeedbackRelation, 27, 1>;
+  using SpeculationModeField = base::BitField<SpeculationMode, 28, 1>;
+  using ConvertReceiverModeField = base::BitField<ConvertReceiverMode, 29, 2>;
 
   uint32_t const bit_field_;
   CallFrequency const frequency_;
@@ -815,12 +828,19 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
       size_t arity, CallFrequency const& frequency = CallFrequency(),
       FeedbackSource const& feedback = FeedbackSource(),
       ConvertReceiverMode convert_mode = ConvertReceiverMode::kAny,
-      SpeculationMode speculation_mode = SpeculationMode::kDisallowSpeculation);
-  const Operator* CallWithArrayLike(CallFrequency const& frequency);
+      SpeculationMode speculation_mode = SpeculationMode::kDisallowSpeculation,
+      CallFeedbackRelation feedback_relation =
+          CallFeedbackRelation::kUnrelated);
+  const Operator* CallWithArrayLike(
+      CallFrequency const& frequency,
+      const FeedbackSource& feedback = FeedbackSource{},
+      SpeculationMode speculation_mode = SpeculationMode::kDisallowSpeculation,
+      CallFeedbackRelation feedback_relation = CallFeedbackRelation::kRelated);
   const Operator* CallWithSpread(
       uint32_t arity, CallFrequency const& frequency = CallFrequency(),
       FeedbackSource const& feedback = FeedbackSource(),
-      SpeculationMode speculation_mode = SpeculationMode::kDisallowSpeculation);
+      SpeculationMode speculation_mode = SpeculationMode::kDisallowSpeculation,
+      CallFeedbackRelation feedback_relation = CallFeedbackRelation::kRelated);
   const Operator* CallRuntime(Runtime::FunctionId id);
   const Operator* CallRuntime(Runtime::FunctionId id, size_t arity);
   const Operator* CallRuntime(const Runtime::Function* function, size_t arity);
@@ -862,6 +882,7 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
                               const Handle<Name>& name,
                               const FeedbackSource& feedback);
 
+  const Operator* HasContextExtension(size_t depth);
   const Operator* LoadContext(size_t depth, size_t index, bool immutable);
   const Operator* StoreContext(size_t depth, size_t index);
 
@@ -894,7 +915,7 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
   const Operator* GeneratorRestoreRegister(int index);
   const Operator* GeneratorRestoreInputOrDebugPos();
 
-  const Operator* StackCheck();
+  const Operator* StackCheck(StackCheckKind kind);
   const Operator* Debugger();
 
   const Operator* FulfillPromise();
diff --git a/deps/v8/src/compiler/js-type-hint-lowering.cc b/deps/v8/src/compiler/js-type-hint-lowering.cc
index 9a6b367ddf17bb..5be5f2148aa6e1 100644
--- a/deps/v8/src/compiler/js-type-hint-lowering.cc
+++ b/deps/v8/src/compiler/js-type-hint-lowering.cc
@@ -157,6 +157,8 @@ class JSSpeculativeBinopBuilder final {
     switch (op_->opcode()) {
       case IrOpcode::kJSAdd:
         return simplified()->SpeculativeBigIntAdd(hint);
+      case IrOpcode::kJSSubtract:
+        return simplified()->SpeculativeBigIntSubtract(hint);
       default:
         break;
     }
@@ -397,7 +399,8 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceBinaryOperation(
       if (Node* node = b.TryBuildNumberBinop()) {
         return LoweringResult::SideEffectFree(node, node, control);
       }
-      if (op->opcode() == IrOpcode::kJSAdd) {
+      if (op->opcode() == IrOpcode::kJSAdd ||
+          op->opcode() == IrOpcode::kJSSubtract) {
         if (Node* node = b.TryBuildBigIntBinop()) {
           return LoweringResult::SideEffectFree(node, node, control);
         }
diff --git a/deps/v8/src/compiler/js-typed-lowering.cc b/deps/v8/src/compiler/js-typed-lowering.cc
index 035457c62bee18..c5ebc2f6a1be11 100644
--- a/deps/v8/src/compiler/js-typed-lowering.cc
+++ b/deps/v8/src/compiler/js-typed-lowering.cc
@@ -1313,6 +1313,36 @@ Reduction JSTypedLowering::ReduceJSOrdinaryHasInstance(Node* node) {
   return NoChange();
 }
 
+Reduction JSTypedLowering::ReduceJSHasContextExtension(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSHasContextExtension, node->opcode());
+  size_t depth = OpParameter<size_t>(node->op());
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* control = graph()->start();
+  for (size_t i = 0; i < depth; ++i) {
+    context = effect = graph()->NewNode(
+        simplified()->LoadField(
+            AccessBuilder::ForContextSlotKnownPointer(Context::PREVIOUS_INDEX)),
+        context, effect, control);
+  }
+  Node* const scope_info = effect = graph()->NewNode(
+      simplified()->LoadField(
+          AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX)),
+      context, effect, control);
+  Node* scope_info_flags = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForScopeInfoFlags()), scope_info,
+      effect, control);
+  Node* flags_masked = graph()->NewNode(
+      simplified()->NumberBitwiseAnd(), scope_info_flags,
+      jsgraph()->SmiConstant(ScopeInfo::HasContextExtensionSlotBit::kMask));
+  Node* no_extension = graph()->NewNode(
+      simplified()->NumberEqual(), flags_masked, jsgraph()->SmiConstant(0));
+  Node* has_extension =
+      graph()->NewNode(simplified()->BooleanNot(), no_extension);
+  ReplaceWithValue(node, has_extension, effect, control);
+  return Changed(node);
+}
+
 Reduction JSTypedLowering::ReduceJSLoadContext(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadContext, node->opcode());
   ContextAccess const& access = ContextAccessOf(node->op());
@@ -1729,8 +1759,8 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
     } else if (shared.HasBuiltinId() && Builtins::IsCpp(shared.builtin_id())) {
       // Patch {node} to a direct CEntry call.
       ReduceBuiltin(jsgraph(), node, shared.builtin_id(), arity, flags);
-    } else if (shared.HasBuiltinId() &&
-               Builtins::KindOf(shared.builtin_id()) == Builtins::TFJ) {
+    } else if (shared.HasBuiltinId()) {
+      DCHECK(Builtins::HasJSLinkage(shared.builtin_id()));
       // Patch {node} to a direct code object call.
       Callable callable = Builtins::CallableFor(
           isolate(), static_cast<Builtins::Name>(shared.builtin_id()));
@@ -1774,8 +1804,9 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
   // Maybe we did at least learn something about the {receiver}.
   if (p.convert_mode() != convert_mode) {
     NodeProperties::ChangeOp(
-        node, javascript()->Call(p.arity(), p.frequency(), p.feedback(),
-                                 convert_mode, p.speculation_mode()));
+        node,
+        javascript()->Call(p.arity(), p.frequency(), p.feedback(), convert_mode,
+                           p.speculation_mode(), p.feedback_relation()));
     return Changed(node);
   }
 
@@ -1926,10 +1957,10 @@ Reduction JSTypedLowering::ReduceJSForInPrepare(Node* node) {
       Node* bit_field3 = effect = graph()->NewNode(
           simplified()->LoadField(AccessBuilder::ForMapBitField3()), enumerator,
           effect, control);
-      STATIC_ASSERT(Map::EnumLengthBits::kShift == 0);
-      cache_length =
-          graph()->NewNode(simplified()->NumberBitwiseAnd(), bit_field3,
-                           jsgraph()->Constant(Map::EnumLengthBits::kMask));
+      STATIC_ASSERT(Map::Bits3::EnumLengthBits::kShift == 0);
+      cache_length = graph()->NewNode(
+          simplified()->NumberBitwiseAnd(), bit_field3,
+          jsgraph()->Constant(Map::Bits3::EnumLengthBits::kMask));
       break;
     }
     case ForInMode::kGeneric: {
@@ -1961,10 +1992,10 @@ Reduction JSTypedLowering::ReduceJSForInPrepare(Node* node) {
         Node* bit_field3 = etrue = graph()->NewNode(
             simplified()->LoadField(AccessBuilder::ForMapBitField3()),
             enumerator, etrue, if_true);
-        STATIC_ASSERT(Map::EnumLengthBits::kShift == 0);
-        cache_length_true =
-            graph()->NewNode(simplified()->NumberBitwiseAnd(), bit_field3,
-                             jsgraph()->Constant(Map::EnumLengthBits::kMask));
+        STATIC_ASSERT(Map::Bits3::EnumLengthBits::kShift == 0);
+        cache_length_true = graph()->NewNode(
+            simplified()->NumberBitwiseAnd(), bit_field3,
+            jsgraph()->Constant(Map::Bits3::EnumLengthBits::kMask));
       }
 
       Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
@@ -2371,6 +2402,8 @@ Reduction JSTypedLowering::Reduce(Node* node) {
       return ReduceJSForInPrepare(node);
     case IrOpcode::kJSForInNext:
       return ReduceJSForInNext(node);
+    case IrOpcode::kJSHasContextExtension:
+      return ReduceJSHasContextExtension(node);
     case IrOpcode::kJSLoadMessage:
       return ReduceJSLoadMessage(node);
     case IrOpcode::kJSStoreMessage:
diff --git a/deps/v8/src/compiler/js-typed-lowering.h b/deps/v8/src/compiler/js-typed-lowering.h
index bcbc3aa16f8c11..9fa6e01a93635f 100644
--- a/deps/v8/src/compiler/js-typed-lowering.h
+++ b/deps/v8/src/compiler/js-typed-lowering.h
@@ -51,6 +51,7 @@ class V8_EXPORT_PRIVATE JSTypedLowering final
   Reduction ReduceJSLoadNamed(Node* node);
   Reduction ReduceJSHasInPrototypeChain(Node* node);
   Reduction ReduceJSOrdinaryHasInstance(Node* node);
+  Reduction ReduceJSHasContextExtension(Node* node);
   Reduction ReduceJSLoadContext(Node* node);
   Reduction ReduceJSStoreContext(Node* node);
   Reduction ReduceJSLoadModule(Node* node);
diff --git a/deps/v8/src/compiler/linkage.h b/deps/v8/src/compiler/linkage.h
index 5458d1eb6f6924..17a419bab3b5cd 100644
--- a/deps/v8/src/compiler/linkage.h
+++ b/deps/v8/src/compiler/linkage.h
@@ -157,7 +157,7 @@ class LinkageLocation {
  private:
   enum LocationType { REGISTER, STACK_SLOT };
 
-  using TypeField = BitField<LocationType, 0, 1>;
+  using TypeField = base::BitField<LocationType, 0, 1>;
   using LocationField = TypeField::Next<int32_t, 31>;
 
   static constexpr int32_t ANY_REGISTER = -1;
@@ -210,8 +210,13 @@ class V8_EXPORT_PRIVATE CallDescriptor final
     // Use the kJavaScriptCallCodeStartRegister (fixed) register for the
     // indirect target address when calling.
     kFixedTargetRegister = 1u << 7,
-    kAllowCallThroughSlot = 1u << 8,
-    kCallerSavedRegisters = 1u << 9
+    kCallerSavedRegisters = 1u << 8,
+    // The kCallerSavedFPRegisters only matters (and set) when the more general
+    // flag for kCallerSavedRegisters above is also set.
+    kCallerSavedFPRegisters = 1u << 9,
+    // AIX has a function descriptor by default but it can be disabled for a
+    // certain CFunction call (only used for Kind::kCallAddress).
+    kNoFunctionDescriptor = 1u << 10,
   };
   using Flags = base::Flags<Flag>;
 
@@ -293,6 +298,10 @@ class V8_EXPORT_PRIVATE CallDescriptor final
   bool NeedsCallerSavedRegisters() const {
     return flags() & kCallerSavedRegisters;
   }
+  bool NeedsCallerSavedFPRegisters() const {
+    return flags() & kCallerSavedFPRegisters;
+  }
+  bool NoFunctionDescriptor() const { return flags() & kNoFunctionDescriptor; }
 
   LinkageLocation GetReturnLocation(size_t index) const {
     return location_sig_->GetReturn(index);
@@ -348,22 +357,8 @@ class V8_EXPORT_PRIVATE CallDescriptor final
     return allocatable_registers_ != 0;
   }
 
-  void set_save_fp_mode(SaveFPRegsMode mode) { save_fp_mode_ = mode; }
-
-  SaveFPRegsMode get_save_fp_mode() const { return save_fp_mode_; }
-
-  void set_has_function_descriptor(bool has_function_descriptor) {
-    has_function_descriptor_ = has_function_descriptor;
-  }
-
-  bool HasFunctionDescriptor() const { return has_function_descriptor_; }
-
  private:
   friend class Linkage;
-  SaveFPRegsMode save_fp_mode_ = kSaveFPRegs;
-  // AIX has a function descriptor which we will set to true by default
-  // for all CFunction Calls.
-  bool has_function_descriptor_ = kHasFunctionDescriptor;
 
   const Kind kind_;
   const MachineType target_type_;
diff --git a/deps/v8/src/compiler/load-elimination.cc b/deps/v8/src/compiler/load-elimination.cc
index 3778775e9bca1c..ff79da8c86f60e 100644
--- a/deps/v8/src/compiler/load-elimination.cc
+++ b/deps/v8/src/compiler/load-elimination.cc
@@ -139,7 +139,7 @@ namespace {
 
 bool IsCompatible(MachineRepresentation r1, MachineRepresentation r2) {
   if (r1 == r2) return true;
-  return IsAnyCompressedTagged(r1) && IsAnyCompressedTagged(r2);
+  return IsAnyTagged(r1) && IsAnyTagged(r2);
 }
 
 }  // namespace
@@ -661,15 +661,13 @@ LoadElimination::FieldInfo const* LoadElimination::AbstractState::LookupField(
     }
     if (!result.has_value()) {
       result = info;
-    } else {
-      // We detected a partially overlapping access here.
-      // We currently don't seem to have such accesses, so this code path is
-      // unreachable, but if we eventually have them, it is safe to return
-      // nullptr and continue the analysis. But store-store elimination is
-      // currently unsafe for such overlapping accesses, so when we remove
-      // this check, we should double-check that store-store elimination can
-      // handle it too.
-      DCHECK_EQ(**result, *info);
+    } else if (**result != *info) {
+      // We detected inconsistent information for a field here.
+      // This can happen when incomplete alias information makes an unrelated
+      // write invalidate part of a field and then we re-combine this partial
+      // information.
+      // This is probably OK, but since it's rare, we better bail out here.
+      return nullptr;
     }
   }
   return *result;
@@ -807,7 +805,7 @@ Reduction LoadElimination::ReduceEnsureWritableFastElements(Node* node) {
   // Add the new elements on {object}.
   state = state->AddField(
       object, FieldIndexOf(JSObject::kElementsOffset, kTaggedSize),
-      {node, MachineType::RepCompressedTaggedPointer()}, zone());
+      {node, MachineRepresentation::kTaggedPointer}, zone());
   return UpdateState(node, state);
 }
 
@@ -835,7 +833,7 @@ Reduction LoadElimination::ReduceMaybeGrowFastElements(Node* node) {
   // Add the new elements on {object}.
   state = state->AddField(
       object, FieldIndexOf(JSObject::kElementsOffset, kTaggedSize),
-      {node, MachineType::RepCompressedTaggedPointer()}, zone());
+      {node, MachineRepresentation::kTaggedPointer}, zone());
   return UpdateState(node, state);
 }
 
@@ -913,7 +911,7 @@ Reduction LoadElimination::ReduceLoadField(Node* node,
   if (state == nullptr) return NoChange();
   if (access.offset == HeapObject::kMapOffset &&
       access.base_is_tagged == kTaggedBase) {
-    DCHECK(IsAnyCompressedTagged(access.machine_type.representation()));
+    DCHECK(IsAnyTagged(access.machine_type.representation()));
     ZoneHandleSet<Map> object_maps;
     if (state->LookupMaps(object, &object_maps) && object_maps.size() == 1) {
       Node* value = jsgraph()->HeapConstant(object_maps[0]);
@@ -977,7 +975,7 @@ Reduction LoadElimination::ReduceStoreField(Node* node,
   if (state == nullptr) return NoChange();
   if (access.offset == HeapObject::kMapOffset &&
       access.base_is_tagged == kTaggedBase) {
-    DCHECK(IsAnyCompressedTagged(access.machine_type.representation()));
+    DCHECK(IsAnyTagged(access.machine_type.representation()));
     // Kill all potential knowledge about the {object}s map.
     state = state->KillMaps(object, zone());
     Type const new_value_type = NodeProperties::GetType(new_value);
@@ -1069,6 +1067,8 @@ Reduction LoadElimination::ReduceLoadElement(Node* node) {
     case MachineRepresentation::kWord32:
     case MachineRepresentation::kWord64:
     case MachineRepresentation::kFloat32:
+    case MachineRepresentation::kCompressedPointer:
+    case MachineRepresentation::kCompressed:
       // TODO(turbofan): Add support for doing the truncations.
       break;
     case MachineRepresentation::kFloat64:
@@ -1076,9 +1076,6 @@ Reduction LoadElimination::ReduceLoadElement(Node* node) {
     case MachineRepresentation::kTaggedSigned:
     case MachineRepresentation::kTaggedPointer:
     case MachineRepresentation::kTagged:
-    case MachineRepresentation::kCompressedSigned:
-    case MachineRepresentation::kCompressedPointer:
-    case MachineRepresentation::kCompressed:
       if (Node* replacement = state->LookupElement(
               object, index, access.machine_type.representation())) {
         // Make sure we don't resurrect dead {replacement} nodes.
@@ -1124,6 +1121,8 @@ Reduction LoadElimination::ReduceStoreElement(Node* node) {
     case MachineRepresentation::kWord32:
     case MachineRepresentation::kWord64:
     case MachineRepresentation::kFloat32:
+    case MachineRepresentation::kCompressedPointer:
+    case MachineRepresentation::kCompressed:
       // TODO(turbofan): Add support for doing the truncations.
       break;
     case MachineRepresentation::kFloat64:
@@ -1131,9 +1130,6 @@ Reduction LoadElimination::ReduceStoreElement(Node* node) {
     case MachineRepresentation::kTaggedSigned:
     case MachineRepresentation::kTaggedPointer:
     case MachineRepresentation::kTagged:
-    case MachineRepresentation::kCompressedSigned:
-    case MachineRepresentation::kCompressedPointer:
-    case MachineRepresentation::kCompressed:
       state = state->AddElement(object, index, new_value,
                                 access.machine_type.representation(), zone());
       break;
@@ -1427,7 +1423,6 @@ LoadElimination::IndexRange LoadElimination::FieldIndexOf(
     case MachineRepresentation::kTaggedSigned:
     case MachineRepresentation::kTaggedPointer:
     case MachineRepresentation::kTagged:
-    case MachineRepresentation::kCompressedSigned:
     case MachineRepresentation::kCompressedPointer:
     case MachineRepresentation::kCompressed:
       break;
diff --git a/deps/v8/src/compiler/machine-graph-verifier.cc b/deps/v8/src/compiler/machine-graph-verifier.cc
index f6b747c04daa9c..8b318d1430b349 100644
--- a/deps/v8/src/compiler/machine-graph-verifier.cc
+++ b/deps/v8/src/compiler/machine-graph-verifier.cc
@@ -194,6 +194,9 @@ class MachineRepresentationInferrer {
                 UnalignedStoreRepresentationOf(node->op()));
             break;
           case IrOpcode::kHeapConstant:
+            representation_vector_[node->id()] =
+                MachineRepresentation::kTaggedPointer;
+            break;
           case IrOpcode::kNumberConstant:
           case IrOpcode::kDelayedStringConstant:
           case IrOpcode::kChangeBitToTagged:
@@ -203,29 +206,8 @@ class MachineRepresentationInferrer {
           case IrOpcode::kChangeUint32ToTagged:
           case IrOpcode::kBitcastWordToTagged:
           case IrOpcode::kTaggedPoisonOnSpeculation:
-          case IrOpcode::kChangeCompressedToTagged:
             representation_vector_[node->id()] = MachineRepresentation::kTagged;
             break;
-          case IrOpcode::kChangeCompressedPointerToTaggedPointer:
-            representation_vector_[node->id()] =
-                MachineRepresentation::kTaggedPointer;
-            break;
-          case IrOpcode::kChangeCompressedSignedToTaggedSigned:
-            representation_vector_[node->id()] =
-                MachineRepresentation::kTaggedSigned;
-            break;
-          case IrOpcode::kChangeTaggedToCompressed:
-            representation_vector_[node->id()] =
-                MachineRepresentation::kCompressed;
-            break;
-          case IrOpcode::kChangeTaggedPointerToCompressedPointer:
-            representation_vector_[node->id()] =
-                MachineRepresentation::kCompressedPointer;
-            break;
-          case IrOpcode::kChangeTaggedSignedToCompressedSigned:
-            representation_vector_[node->id()] =
-                MachineRepresentation::kCompressedSigned;
-            break;
           case IrOpcode::kWord32PoisonOnSpeculation:
             representation_vector_[node->id()] = MachineRepresentation::kWord32;
             break;
@@ -249,13 +231,6 @@ class MachineRepresentationInferrer {
             representation_vector_[node->id()] =
                 MachineRepresentation::kTaggedSigned;
             break;
-          case IrOpcode::kBitcastWord32ToCompressedSigned:
-            representation_vector_[node->id()] =
-                MachineRepresentation::kCompressedSigned;
-            break;
-          case IrOpcode::kBitcastCompressedSignedToWord32:
-            representation_vector_[node->id()] = MachineRepresentation::kWord32;
-            break;
           case IrOpcode::kWord32Equal:
           case IrOpcode::kInt32LessThan:
           case IrOpcode::kInt32LessThanOrEqual:
@@ -282,8 +257,10 @@ class MachineRepresentationInferrer {
           case IrOpcode::kTruncateFloat32ToUint32:
           case IrOpcode::kBitcastFloat32ToInt32:
           case IrOpcode::kI32x4ExtractLane:
-          case IrOpcode::kI16x8ExtractLane:
-          case IrOpcode::kI8x16ExtractLane:
+          case IrOpcode::kI16x8ExtractLaneU:
+          case IrOpcode::kI16x8ExtractLaneS:
+          case IrOpcode::kI8x16ExtractLaneU:
+          case IrOpcode::kI8x16ExtractLaneS:
           case IrOpcode::kInt32Constant:
           case IrOpcode::kRelocatableInt32Constant:
           case IrOpcode::kTruncateFloat64ToWord32:
@@ -304,6 +281,7 @@ class MachineRepresentationInferrer {
           case IrOpcode::kInt64Constant:
           case IrOpcode::kRelocatableInt64Constant:
           case IrOpcode::kBitcastFloat64ToInt64:
+          case IrOpcode::kChangeFloat64ToInt64:
           case IrOpcode::kChangeFloat64ToUint64:
             MACHINE_BINOP_64_LIST(LABEL) {
               representation_vector_[node->id()] =
@@ -393,29 +371,6 @@ class MachineRepresentationChecker {
             CHECK_EQ(MachineRepresentation::kTagged,
                      inferrer_->GetRepresentation(node->InputAt(0)));
             break;
-          case IrOpcode::kChangeCompressedToTagged:
-            CHECK(IsAnyCompressed(
-                inferrer_->GetRepresentation(node->InputAt(0))));
-            break;
-          case IrOpcode::kChangeCompressedPointerToTaggedPointer:
-            CHECK(CanBeCompressedPointer(
-                inferrer_->GetRepresentation(node->InputAt(0))));
-            break;
-          case IrOpcode::kChangeCompressedSignedToTaggedSigned:
-            CHECK(CanBeCompressedSigned(
-                inferrer_->GetRepresentation(node->InputAt(0))));
-            break;
-          case IrOpcode::kChangeTaggedToCompressed:
-            CHECK(IsAnyTagged(inferrer_->GetRepresentation(node->InputAt(0))));
-            break;
-          case IrOpcode::kChangeTaggedPointerToCompressedPointer:
-            CHECK(CanBeTaggedPointer(
-                inferrer_->GetRepresentation(node->InputAt(0))));
-            break;
-          case IrOpcode::kChangeTaggedSignedToCompressedSigned:
-            CHECK(CanBeTaggedSigned(
-                inferrer_->GetRepresentation(node->InputAt(0))));
-            break;
           case IrOpcode::kRoundInt64ToFloat64:
           case IrOpcode::kRoundUint64ToFloat64:
           case IrOpcode::kRoundInt64ToFloat32:
@@ -438,16 +393,15 @@ class MachineRepresentationChecker {
             break;
           case IrOpcode::kBitcastTaggedToWord:
           case IrOpcode::kBitcastTaggedToWordForTagAndSmiBits:
+            if (COMPRESS_POINTERS_BOOL) {
+              CheckValueInputIsCompressedOrTagged(node, 0);
+            } else {
+              CheckValueInputIsTagged(node, 0);
+            }
+            break;
           case IrOpcode::kTaggedPoisonOnSpeculation:
             CheckValueInputIsTagged(node, 0);
             break;
-          case IrOpcode::kBitcastWord32ToCompressedSigned:
-            CheckValueInputRepresentationIs(node, 0,
-                                            MachineRepresentation::kWord32);
-            break;
-          case IrOpcode::kBitcastCompressedSignedToWord32:
-            CheckValueInputIsCompressed(node, 0);
-            break;
           case IrOpcode::kTruncateFloat64ToWord32:
           case IrOpcode::kTruncateFloat64ToUint32:
           case IrOpcode::kTruncateFloat64ToFloat32:
@@ -481,8 +435,10 @@ class MachineRepresentationChecker {
             CheckValueInputForInt64Op(node, 1);
             break;
           case IrOpcode::kI32x4ExtractLane:
-          case IrOpcode::kI16x8ExtractLane:
-          case IrOpcode::kI8x16ExtractLane:
+          case IrOpcode::kI16x8ExtractLaneU:
+          case IrOpcode::kI16x8ExtractLaneS:
+          case IrOpcode::kI8x16ExtractLaneU:
+          case IrOpcode::kI8x16ExtractLaneS:
             CheckValueInputRepresentationIs(node, 0,
                                             MachineRepresentation::kSimd128);
             break;
@@ -502,6 +458,7 @@ class MachineRepresentationChecker {
           case IrOpcode::kRoundInt32ToFloat32:
           case IrOpcode::kRoundUint32ToFloat32:
           case IrOpcode::kBitcastInt32ToFloat32:
+          case IrOpcode::kBitcastWord32ToWord64:
           case IrOpcode::kChangeInt32ToInt64:
           case IrOpcode::kChangeUint32ToUint64:
             MACHINE_UNOP_32_LIST(LABEL) { CheckValueInputForInt32Op(node, 0); }
@@ -515,8 +472,13 @@ class MachineRepresentationChecker {
                     node, 1, inferrer_->GetRepresentation(node->InputAt(0)));
               }
             } else {
-              CheckValueIsCompressedOrInt32(node, 0);
-              CheckValueIsCompressedOrInt32(node, 1);
+              if (COMPRESS_POINTERS_BOOL) {
+                CheckValueInputIsCompressedOrTaggedOrInt32(node, 0);
+                CheckValueInputIsCompressedOrTaggedOrInt32(node, 1);
+              } else {
+                CheckValueIsTaggedOrInt32(node, 0);
+                CheckValueIsTaggedOrInt32(node, 1);
+              }
             }
             break;
 
@@ -559,6 +521,7 @@ class MachineRepresentationChecker {
             }
             break;
           case IrOpcode::kFloat64SilenceNaN:
+          case IrOpcode::kChangeFloat64ToInt64:
           case IrOpcode::kChangeFloat64ToUint64:
             MACHINE_FLOAT64_UNOP_LIST(LABEL) {
               CheckValueInputForFloat64Op(node, 0);
@@ -617,12 +580,14 @@ class MachineRepresentationChecker {
               case MachineRepresentation::kTagged:
               case MachineRepresentation::kTaggedPointer:
               case MachineRepresentation::kTaggedSigned:
-                CheckValueInputIsTagged(node, 2);
-                break;
-              case MachineRepresentation::kCompressed:
-              case MachineRepresentation::kCompressedPointer:
-              case MachineRepresentation::kCompressedSigned:
-                CheckValueInputIsCompressed(node, 2);
+                if (COMPRESS_POINTERS_BOOL &&
+                    node->opcode() == IrOpcode::kStore &&
+                    CanBeTaggedPointer(
+                        StoreRepresentationOf(node->op()).representation())) {
+                  CheckValueInputIsCompressedOrTagged(node, 2);
+                } else {
+                  CheckValueInputIsTagged(node, 2);
+                }
                 break;
               default:
                 CheckValueInputRepresentationIs(
@@ -658,16 +623,23 @@ class MachineRepresentationChecker {
             switch (inferrer_->GetRepresentation(node)) {
               case MachineRepresentation::kTagged:
               case MachineRepresentation::kTaggedPointer:
-              case MachineRepresentation::kTaggedSigned:
                 for (int i = 0; i < node->op()->ValueInputCount(); ++i) {
                   CheckValueInputIsTagged(node, i);
                 }
                 break;
+              case MachineRepresentation::kTaggedSigned:
+                for (int i = 0; i < node->op()->ValueInputCount(); ++i) {
+                  if (COMPRESS_POINTERS_BOOL) {
+                    CheckValueInputIsCompressedOrTagged(node, i);
+                  } else {
+                    CheckValueInputIsTagged(node, i);
+                  }
+                }
+                break;
               case MachineRepresentation::kCompressed:
               case MachineRepresentation::kCompressedPointer:
-              case MachineRepresentation::kCompressedSigned:
                 for (int i = 0; i < node->op()->ValueInputCount(); ++i) {
-                  CheckValueInputIsCompressed(node, i);
+                    CheckValueInputIsCompressedOrTagged(node, i);
                 }
                 break;
               case MachineRepresentation::kWord32:
@@ -768,7 +740,6 @@ class MachineRepresentationChecker {
     switch (inferrer_->GetRepresentation(input)) {
       case MachineRepresentation::kCompressed:
       case MachineRepresentation::kCompressedPointer:
-      case MachineRepresentation::kCompressedSigned:
         return;
       default:
         break;
@@ -799,6 +770,52 @@ class MachineRepresentationChecker {
     FATAL("%s", str.str().c_str());
   }
 
+  void CheckValueInputIsCompressedOrTagged(Node const* node, int index) {
+    Node const* input = node->InputAt(index);
+    switch (inferrer_->GetRepresentation(input)) {
+      case MachineRepresentation::kCompressed:
+      case MachineRepresentation::kCompressedPointer:
+      case MachineRepresentation::kTagged:
+      case MachineRepresentation::kTaggedPointer:
+      case MachineRepresentation::kTaggedSigned:
+        return;
+      default:
+        break;
+    }
+    std::ostringstream str;
+    str << "TypeError: node #" << node->id() << ":" << *node->op()
+        << " uses node #" << input->id() << ":" << *input->op()
+        << " which doesn't have a compressed or tagged representation.";
+    PrintDebugHelp(str, node);
+    FATAL("%s", str.str().c_str());
+  }
+
+  void CheckValueInputIsCompressedOrTaggedOrInt32(Node const* node, int index) {
+    Node const* input = node->InputAt(index);
+    switch (inferrer_->GetRepresentation(input)) {
+      case MachineRepresentation::kCompressed:
+      case MachineRepresentation::kCompressedPointer:
+        return;
+      case MachineRepresentation::kTagged:
+      case MachineRepresentation::kTaggedPointer:
+      case MachineRepresentation::kTaggedSigned:
+        return;
+      case MachineRepresentation::kBit:
+      case MachineRepresentation::kWord8:
+      case MachineRepresentation::kWord16:
+      case MachineRepresentation::kWord32:
+        return;
+      default:
+        break;
+    }
+    std::ostringstream str;
+    str << "TypeError: node #" << node->id() << ":" << *node->op()
+        << " uses node #" << input->id() << ":" << *input->op()
+        << " which doesn't have a compressed, tagged, or int32 representation.";
+    PrintDebugHelp(str, node);
+    FATAL("%s", str.str().c_str());
+  }
+
   void CheckValueInputIsTaggedOrPointer(Node const* node, int index) {
     Node const* input = node->InputAt(index);
     switch (inferrer_->GetRepresentation(input)) {
@@ -860,7 +877,7 @@ class MachineRepresentationChecker {
     FATAL("%s", str.str().c_str());
   }
 
-  void CheckValueIsCompressedOrInt32(Node const* node, int index) {
+  void CheckValueIsTaggedOrInt32(Node const* node, int index) {
     Node const* input = node->InputAt(index);
     switch (inferrer_->GetRepresentation(input)) {
       case MachineRepresentation::kBit:
@@ -868,9 +885,8 @@ class MachineRepresentationChecker {
       case MachineRepresentation::kWord16:
       case MachineRepresentation::kWord32:
         return;
-      case MachineRepresentation::kCompressed:
-      case MachineRepresentation::kCompressedSigned:
-      case MachineRepresentation::kCompressedPointer:
+      case MachineRepresentation::kTagged:
+      case MachineRepresentation::kTaggedPointer:
         return;
       default:
         break;
@@ -878,7 +894,7 @@ class MachineRepresentationChecker {
     std::ostringstream str;
     str << "TypeError: node #" << node->id() << ":" << *node->op()
         << " uses node #" << input->id() << ":" << *input->op()
-        << " which doesn't have a compressed or int32-compatible "
+        << " which doesn't have a tagged or int32-compatible "
            "representation.";
     PrintDebugHelp(str, node);
     FATAL("%s", str.str().c_str());
@@ -1014,7 +1030,6 @@ class MachineRepresentationChecker {
         // kTaggedPointer and the other way around, but at the moment, this
         // happens in dead code.
         return IsAnyTagged(actual);
-      case MachineRepresentation::kCompressedSigned:
       case MachineRepresentation::kCompressedPointer:
       case MachineRepresentation::kFloat32:
       case MachineRepresentation::kFloat64:
diff --git a/deps/v8/src/compiler/machine-operator-reducer.cc b/deps/v8/src/compiler/machine-operator-reducer.cc
index 38013d228c5053..4a192cd3e1acfa 100644
--- a/deps/v8/src/compiler/machine-operator-reducer.cc
+++ b/deps/v8/src/compiler/machine-operator-reducer.cc
@@ -20,6 +20,111 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
+// Some optimizations performed by the MachineOperatorReducer can be applied
+// to both Word32 and Word64 operations. Those are implemented in a generic
+// way to be reused for different word sizes.
+// This class adapts a generic algorithm to Word32 operations.
+class Word32Adapter {
+ public:
+  using IntNBinopMatcher = Int32BinopMatcher;
+  using UintNBinopMatcher = Uint32BinopMatcher;
+  using intN_t = int32_t;
+  // WORD_SIZE refers to the N for which this adapter specializes.
+  static constexpr std::size_t WORD_SIZE = 32;
+
+  explicit Word32Adapter(MachineOperatorReducer* reducer) : r_(reducer) {}
+
+  template <typename T>
+  static bool IsWordNAnd(const T& x) {
+    return x.IsWord32And();
+  }
+  template <typename T>
+  static bool IsWordNShl(const T& x) {
+    return x.IsWord32Shl();
+  }
+  template <typename T>
+  static bool IsWordNXor(const T& x) {
+    return x.IsWord32Xor();
+  }
+  template <typename T>
+  static bool IsIntNAdd(const T& x) {
+    return x.IsInt32Add();
+  }
+  template <typename T>
+  static bool IsIntNMul(const T& x) {
+    return x.IsInt32Mul();
+  }
+
+  const Operator* IntNAdd(MachineOperatorBuilder* machine) {
+    return machine->Int32Add();
+  }
+
+  Reduction ReplaceIntN(int32_t value) { return r_->ReplaceInt32(value); }
+  Reduction ReduceWordNAnd(Node* node) { return r_->ReduceWord32And(node); }
+  Reduction ReduceIntNAdd(Node* node) { return r_->ReduceInt32Add(node); }
+  Reduction TryMatchWordNRor(Node* node) { return r_->TryMatchWord32Ror(node); }
+
+  Node* IntNConstant(int32_t value) { return r_->Int32Constant(value); }
+  Node* WordNAnd(Node* lhs, Node* rhs) { return r_->Word32And(lhs, rhs); }
+
+ private:
+  MachineOperatorReducer* r_;
+};
+
+// Some optimizations performed by the MachineOperatorReducer can be applied
+// to both Word32 and Word64 operations. Those are implemented in a generic
+// way to be reused for different word sizes.
+// This class adapts a generic algorithm to Word64 operations.
+class Word64Adapter {
+ public:
+  using IntNBinopMatcher = Int64BinopMatcher;
+  using UintNBinopMatcher = Uint64BinopMatcher;
+  using intN_t = int64_t;
+  // WORD_SIZE refers to the N for which this adapter specializes.
+  static constexpr std::size_t WORD_SIZE = 64;
+
+  explicit Word64Adapter(MachineOperatorReducer* reducer) : r_(reducer) {}
+
+  template <typename T>
+  static bool IsWordNAnd(const T& x) {
+    return x.IsWord64And();
+  }
+  template <typename T>
+  static bool IsWordNShl(const T& x) {
+    return x.IsWord64Shl();
+  }
+  template <typename T>
+  static bool IsWordNXor(const T& x) {
+    return x.IsWord64Xor();
+  }
+  template <typename T>
+  static bool IsIntNAdd(const T& x) {
+    return x.IsInt64Add();
+  }
+  template <typename T>
+  static bool IsIntNMul(const T& x) {
+    return x.IsInt64Mul();
+  }
+
+  static const Operator* IntNAdd(MachineOperatorBuilder* machine) {
+    return machine->Int64Add();
+  }
+
+  Reduction ReplaceIntN(int64_t value) { return r_->ReplaceInt64(value); }
+  Reduction ReduceWordNAnd(Node* node) { return r_->ReduceWord64And(node); }
+  Reduction ReduceIntNAdd(Node* node) { return r_->ReduceInt64Add(node); }
+  Reduction TryMatchWordNRor(Node* node) {
+    // TODO(nicohartmann@): Add a MachineOperatorReducer::TryMatchWord64Ror.
+    return r_->NoChange();
+  }
+
+  Node* IntNConstant(int64_t value) { return r_->Int64Constant(value); }
+  Node* WordNAnd(Node* lhs, Node* rhs) { return r_->Word64And(lhs, rhs); }
+
+ private:
+  MachineOperatorReducer* r_;
+};
+
 MachineOperatorReducer::MachineOperatorReducer(Editor* editor,
                                                MachineGraph* mcgraph,
                                                bool allow_signalling_nan)
@@ -81,12 +186,10 @@ Node* MachineOperatorReducer::Word32Equal(Node* lhs, Node* rhs) {
   return graph()->NewNode(machine()->Word32Equal(), lhs, rhs);
 }
 
-Node* MachineOperatorReducer::BitcastWord32ToCompressedSigned(Node* value) {
-  return graph()->NewNode(machine()->BitcastWord32ToCompressedSigned(), value);
-}
-
-Node* MachineOperatorReducer::BitcastCompressedSignedToWord32(Node* value) {
-  return graph()->NewNode(machine()->BitcastCompressedSignedToWord32(), value);
+Node* MachineOperatorReducer::Word64And(Node* lhs, Node* rhs) {
+  Node* const node = graph()->NewNode(machine()->Word64And(), lhs, rhs);
+  Reduction const reduction = ReduceWord64And(node);
+  return reduction.Changed() ? reduction.replacement() : node;
 }
 
 Node* MachineOperatorReducer::Int32Add(Node* lhs, Node* rhs) {
@@ -150,10 +253,16 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
       return ReduceProjection(ProjectionIndexOf(node->op()), node->InputAt(0));
     case IrOpcode::kWord32And:
       return ReduceWord32And(node);
+    case IrOpcode::kWord64And:
+      return ReduceWord64And(node);
     case IrOpcode::kWord32Or:
       return ReduceWord32Or(node);
+    case IrOpcode::kWord64Or:
+      return ReduceWord64Or(node);
     case IrOpcode::kWord32Xor:
       return ReduceWord32Xor(node);
+    case IrOpcode::kWord64Xor:
+      return ReduceWord64Xor(node);
     case IrOpcode::kWord32Shl:
       return ReduceWord32Shl(node);
     case IrOpcode::kWord64Shl:
@@ -228,7 +337,8 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
         return Changed(node);
       }
       if (m.right().IsPowerOf2()) {  // x * 2^n => x << n
-        node->ReplaceInput(1, Int32Constant(WhichPowerOf2(m.right().Value())));
+        node->ReplaceInput(
+            1, Int32Constant(base::bits::WhichPowerOfTwo(m.right().Value())));
         NodeProperties::ChangeOp(node, machine()->Word32Shl());
         Reduction reduction = ReduceWord32Shl(node);
         return reduction.Changed() ? reduction : Changed(node);
@@ -250,6 +360,8 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
       }
       break;
     }
+    case IrOpcode::kInt64Mul:
+      return ReduceInt64Mul(node);
     case IrOpcode::kInt32Div:
       return ReduceInt32Div(node);
     case IrOpcode::kUint32Div:
@@ -639,6 +751,11 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
       if (m.HasValue()) return ReplaceFloat64(FastI2D(m.Value()));
       break;
     }
+    case IrOpcode::kBitcastWord32ToWord64: {
+      Int32Matcher m(node->InputAt(0));
+      if (m.HasValue()) return ReplaceInt64(m.Value());
+      break;
+    }
     case IrOpcode::kChangeInt32ToInt64: {
       Int32Matcher m(node->InputAt(0));
       if (m.HasValue()) return ReplaceInt64(m.Value());
@@ -660,17 +777,6 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
       if (m.HasValue()) return ReplaceInt64(static_cast<uint64_t>(m.Value()));
       break;
     }
-    case IrOpcode::kChangeTaggedToCompressed: {
-      Int64Matcher m(node->InputAt(0));
-      if (m.IsBitcastWordToTaggedSigned()) {
-        Int64Matcher n(m.node()->InputAt(0));
-        if (n.IsChangeInt32ToInt64()) {
-          DCHECK(machine()->Is64() && SmiValuesAre31Bits());
-          return Replace(BitcastWord32ToCompressedSigned(n.node()->InputAt(0)));
-        }
-      }
-      break;
-    }
     case IrOpcode::kTruncateFloat64ToWord32: {
       Float64Matcher m(node->InputAt(0));
       if (m.HasValue()) return ReplaceInt32(DoubleToInt32(m.Value()));
@@ -681,13 +787,6 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
       Int64Matcher m(node->InputAt(0));
       if (m.HasValue()) return ReplaceInt32(static_cast<int32_t>(m.Value()));
       if (m.IsChangeInt32ToInt64()) return Replace(m.node()->InputAt(0));
-      if (m.IsBitcastTaggedToWordForTagAndSmiBits()) {
-        Int64Matcher n(m.node()->InputAt(0));
-        if (n.IsChangeCompressedToTagged()) {
-          DCHECK(machine()->Is64() && SmiValuesAre31Bits());
-          return Replace(BitcastCompressedSignedToWord32(n.node()->InputAt(0)));
-        }
-      }
       break;
     }
     case IrOpcode::kTruncateFloat64ToFloat32: {
@@ -776,6 +875,7 @@ Reduction MachineOperatorReducer::ReduceInt32Add(Node* node) {
       return Changed(node);
     }
   }
+
   return NoChange();
 }
 
@@ -838,6 +938,31 @@ Reduction MachineOperatorReducer::ReduceInt64Sub(Node* node) {
   return NoChange();
 }
 
+Reduction MachineOperatorReducer::ReduceInt64Mul(Node* node) {
+  DCHECK_EQ(IrOpcode::kInt64Mul, node->opcode());
+  Int64BinopMatcher m(node);
+  if (m.right().Is(0)) return Replace(m.right().node());  // x * 0 => 0
+  if (m.right().Is(1)) return Replace(m.left().node());   // x * 1 => x
+  if (m.IsFoldable()) {                                   // K * K => K
+    return ReplaceInt64(
+        base::MulWithWraparound(m.left().Value(), m.right().Value()));
+  }
+  if (m.right().Is(-1)) {  // x * -1 => 0 - x
+    node->ReplaceInput(0, Int64Constant(0));
+    node->ReplaceInput(1, m.left().node());
+    NodeProperties::ChangeOp(node, machine()->Int64Sub());
+    return Changed(node);
+  }
+  if (m.right().IsPowerOf2()) {  // x * 2^n => x << n
+    node->ReplaceInput(
+        1, Int64Constant(base::bits::WhichPowerOfTwo(m.right().Value())));
+    NodeProperties::ChangeOp(node, machine()->Word64Shl());
+    Reduction reduction = ReduceWord64Shl(node);
+    return reduction.Changed() ? reduction : Changed(node);
+  }
+  return NoChange();
+}
+
 Reduction MachineOperatorReducer::ReduceInt32Div(Node* node) {
   Int32BinopMatcher m(node);
   if (m.left().Is(0)) return Replace(m.left().node());    // 0 / x => 0
@@ -863,7 +988,7 @@ Reduction MachineOperatorReducer::ReduceInt32Div(Node* node) {
     Node* const dividend = m.left().node();
     Node* quotient = dividend;
     if (base::bits::IsPowerOfTwo(Abs(divisor))) {
-      uint32_t const shift = WhichPowerOf2(Abs(divisor));
+      uint32_t const shift = base::bits::WhichPowerOfTwo(Abs(divisor));
       DCHECK_NE(0u, shift);
       if (shift > 1) {
         quotient = Word32Sar(quotient, 31);
@@ -902,7 +1027,8 @@ Reduction MachineOperatorReducer::ReduceUint32Div(Node* node) {
     Node* const dividend = m.left().node();
     uint32_t const divisor = m.right().Value();
     if (base::bits::IsPowerOfTwo(divisor)) {  // x / 2^n => x >> n
-      node->ReplaceInput(1, Uint32Constant(WhichPowerOf2(m.right().Value())));
+      node->ReplaceInput(
+          1, Uint32Constant(base::bits::WhichPowerOfTwo(m.right().Value())));
       node->TrimInputCount(2);
       NodeProperties::ChangeOp(node, machine()->Word32Shr());
       return Changed(node);
@@ -1208,100 +1334,104 @@ Reduction MachineOperatorReducer::ReduceWord64Sar(Node* node) {
   return NoChange();
 }
 
-Reduction MachineOperatorReducer::ReduceWord32And(Node* node) {
-  DCHECK_EQ(IrOpcode::kWord32And, node->opcode());
-  Int32BinopMatcher m(node);
+template <typename WordNAdapter>
+Reduction MachineOperatorReducer::ReduceWordNAnd(Node* node) {
+  using A = WordNAdapter;
+  A a(this);
+
+  typename A::IntNBinopMatcher m(node);
   if (m.right().Is(0)) return Replace(m.right().node());  // x & 0  => 0
   if (m.right().Is(-1)) return Replace(m.left().node());  // x & -1 => x
   if (m.left().IsComparison() && m.right().Is(1)) {       // CMP & 1 => CMP
     return Replace(m.left().node());
   }
   if (m.IsFoldable()) {                                   // K & K  => K
-    return ReplaceInt32(m.left().Value() & m.right().Value());
+    return a.ReplaceIntN(m.left().Value() & m.right().Value());
   }
   if (m.LeftEqualsRight()) return Replace(m.left().node());  // x & x => x
-  if (m.left().IsWord32And() && m.right().HasValue()) {
-    Int32BinopMatcher mleft(m.left().node());
+  if (A::IsWordNAnd(m.left()) && m.right().HasValue()) {
+    typename A::IntNBinopMatcher mleft(m.left().node());
     if (mleft.right().HasValue()) {  // (x & K) & K => x & K
       node->ReplaceInput(0, mleft.left().node());
       node->ReplaceInput(
-          1, Int32Constant(m.right().Value() & mleft.right().Value()));
-      Reduction const reduction = ReduceWord32And(node);
+          1, a.IntNConstant(m.right().Value() & mleft.right().Value()));
+      Reduction const reduction = a.ReduceWordNAnd(node);
       return reduction.Changed() ? reduction : Changed(node);
     }
   }
   if (m.right().IsNegativePowerOf2()) {
-    int32_t const mask = m.right().Value();
-    int32_t const neg_mask = base::NegateWithWraparound(mask);
-    if (m.left().IsWord32Shl()) {
-      Uint32BinopMatcher mleft(m.left().node());
+    typename A::intN_t const mask = m.right().Value();
+    typename A::intN_t const neg_mask = base::NegateWithWraparound(mask);
+    if (A::IsWordNShl(m.left())) {
+      typename A::UintNBinopMatcher mleft(m.left().node());
       if (mleft.right().HasValue() &&
-          (mleft.right().Value() & 0x1F) >=
+          (mleft.right().Value() & (A::WORD_SIZE - 1)) >=
               base::bits::CountTrailingZeros(mask)) {
         // (x << L) & (-1 << K) => x << L iff L >= K
         return Replace(mleft.node());
       }
-    } else if (m.left().IsInt32Add()) {
-      Int32BinopMatcher mleft(m.left().node());
+    } else if (A::IsIntNAdd(m.left())) {
+      typename A::IntNBinopMatcher mleft(m.left().node());
       if (mleft.right().HasValue() &&
           (mleft.right().Value() & mask) == mleft.right().Value()) {
         // (x + (K << L)) & (-1 << L) => (x & (-1 << L)) + (K << L)
-        node->ReplaceInput(0, Word32And(mleft.left().node(), m.right().node()));
+        node->ReplaceInput(0,
+                           a.WordNAnd(mleft.left().node(), m.right().node()));
         node->ReplaceInput(1, mleft.right().node());
-        NodeProperties::ChangeOp(node, machine()->Int32Add());
-        Reduction const reduction = ReduceInt32Add(node);
+        NodeProperties::ChangeOp(node, a.IntNAdd(machine()));
+        Reduction const reduction = a.ReduceIntNAdd(node);
         return reduction.Changed() ? reduction : Changed(node);
       }
-      if (mleft.left().IsInt32Mul()) {
-        Int32BinopMatcher mleftleft(mleft.left().node());
+      if (A::IsIntNMul(mleft.left())) {
+        typename A::IntNBinopMatcher mleftleft(mleft.left().node());
         if (mleftleft.right().IsMultipleOf(neg_mask)) {
           // (y * (K << L) + x) & (-1 << L) => (x & (-1 << L)) + y * (K << L)
-          node->ReplaceInput(0,
-                             Word32And(mleft.right().node(), m.right().node()));
+          node->ReplaceInput(
+              0, a.WordNAnd(mleft.right().node(), m.right().node()));
           node->ReplaceInput(1, mleftleft.node());
-          NodeProperties::ChangeOp(node, machine()->Int32Add());
-          Reduction const reduction = ReduceInt32Add(node);
+          NodeProperties::ChangeOp(node, a.IntNAdd(machine()));
+          Reduction const reduction = a.ReduceIntNAdd(node);
           return reduction.Changed() ? reduction : Changed(node);
         }
       }
-      if (mleft.right().IsInt32Mul()) {
-        Int32BinopMatcher mleftright(mleft.right().node());
+      if (A::IsIntNMul(mleft.right())) {
+        typename A::IntNBinopMatcher mleftright(mleft.right().node());
         if (mleftright.right().IsMultipleOf(neg_mask)) {
           // (x + y * (K << L)) & (-1 << L) => (x & (-1 << L)) + y * (K << L)
           node->ReplaceInput(0,
-                             Word32And(mleft.left().node(), m.right().node()));
+                             a.WordNAnd(mleft.left().node(), m.right().node()));
           node->ReplaceInput(1, mleftright.node());
-          NodeProperties::ChangeOp(node, machine()->Int32Add());
-          Reduction const reduction = ReduceInt32Add(node);
+          NodeProperties::ChangeOp(node, a.IntNAdd(machine()));
+          Reduction const reduction = a.ReduceIntNAdd(node);
           return reduction.Changed() ? reduction : Changed(node);
         }
       }
-      if (mleft.left().IsWord32Shl()) {
-        Int32BinopMatcher mleftleft(mleft.left().node());
+      if (A::IsWordNShl(mleft.left())) {
+        typename A::IntNBinopMatcher mleftleft(mleft.left().node());
         if (mleftleft.right().Is(base::bits::CountTrailingZeros(mask))) {
           // (y << L + x) & (-1 << L) => (x & (-1 << L)) + y << L
-          node->ReplaceInput(0,
-                             Word32And(mleft.right().node(), m.right().node()));
+          node->ReplaceInput(
+              0, a.WordNAnd(mleft.right().node(), m.right().node()));
           node->ReplaceInput(1, mleftleft.node());
-          NodeProperties::ChangeOp(node, machine()->Int32Add());
-          Reduction const reduction = ReduceInt32Add(node);
+          NodeProperties::ChangeOp(node, a.IntNAdd(machine()));
+          Reduction const reduction = a.ReduceIntNAdd(node);
           return reduction.Changed() ? reduction : Changed(node);
         }
       }
-      if (mleft.right().IsWord32Shl()) {
-        Int32BinopMatcher mleftright(mleft.right().node());
+      if (A::IsWordNShl(mleft.right())) {
+        typename A::IntNBinopMatcher mleftright(mleft.right().node());
         if (mleftright.right().Is(base::bits::CountTrailingZeros(mask))) {
           // (x + y << L) & (-1 << L) => (x & (-1 << L)) + y << L
           node->ReplaceInput(0,
-                             Word32And(mleft.left().node(), m.right().node()));
+                             a.WordNAnd(mleft.left().node(), m.right().node()));
           node->ReplaceInput(1, mleftright.node());
-          NodeProperties::ChangeOp(node, machine()->Int32Add());
-          Reduction const reduction = ReduceInt32Add(node);
+          NodeProperties::ChangeOp(node, a.IntNAdd(machine()));
+          Reduction const reduction = a.ReduceIntNAdd(node);
           return reduction.Changed() ? reduction : Changed(node);
         }
       }
-    } else if (m.left().IsInt32Mul()) {
-      Int32BinopMatcher mleft(m.left().node());
+    } else if (A::IsIntNMul(m.left())) {
+      typename A::IntNBinopMatcher mleft(m.left().node());
       if (mleft.right().IsMultipleOf(neg_mask)) {
         // (x * (K << L)) & (-1 << L) => x * (K << L)
         return Replace(mleft.node());
@@ -1311,6 +1441,16 @@ Reduction MachineOperatorReducer::ReduceWord32And(Node* node) {
   return NoChange();
 }
 
+Reduction MachineOperatorReducer::ReduceWord32And(Node* node) {
+  DCHECK_EQ(IrOpcode::kWord32And, node->opcode());
+  return ReduceWordNAnd<Word32Adapter>(node);
+}
+
+Reduction MachineOperatorReducer::ReduceWord64And(Node* node) {
+  DCHECK_EQ(IrOpcode::kWord64And, node->opcode());
+  return ReduceWordNAnd<Word64Adapter>(node);
+}
+
 Reduction MachineOperatorReducer::TryMatchWord32Ror(Node* node) {
   DCHECK(IrOpcode::kWord32Or == node->opcode() ||
          IrOpcode::kWord32Xor == node->opcode());
@@ -1363,35 +1503,61 @@ Reduction MachineOperatorReducer::TryMatchWord32Ror(Node* node) {
   return Changed(node);
 }
 
-Reduction MachineOperatorReducer::ReduceWord32Or(Node* node) {
-  DCHECK_EQ(IrOpcode::kWord32Or, node->opcode());
-  Int32BinopMatcher m(node);
+template <typename WordNAdapter>
+Reduction MachineOperatorReducer::ReduceWordNOr(Node* node) {
+  using A = WordNAdapter;
+  A a(this);
+
+  typename A::IntNBinopMatcher m(node);
   if (m.right().Is(0)) return Replace(m.left().node());    // x | 0  => x
   if (m.right().Is(-1)) return Replace(m.right().node());  // x | -1 => -1
   if (m.IsFoldable()) {                                    // K | K  => K
-    return ReplaceInt32(m.left().Value() | m.right().Value());
+    return a.ReplaceIntN(m.left().Value() | m.right().Value());
   }
   if (m.LeftEqualsRight()) return Replace(m.left().node());  // x | x => x
 
-  return TryMatchWord32Ror(node);
+  return a.TryMatchWordNRor(node);
 }
 
-Reduction MachineOperatorReducer::ReduceWord32Xor(Node* node) {
-  DCHECK_EQ(IrOpcode::kWord32Xor, node->opcode());
-  Int32BinopMatcher m(node);
+Reduction MachineOperatorReducer::ReduceWord32Or(Node* node) {
+  DCHECK_EQ(IrOpcode::kWord32Or, node->opcode());
+  return ReduceWordNOr<Word32Adapter>(node);
+}
+
+Reduction MachineOperatorReducer::ReduceWord64Or(Node* node) {
+  DCHECK_EQ(IrOpcode::kWord64Or, node->opcode());
+  return ReduceWordNOr<Word64Adapter>(node);
+}
+
+template <typename WordNAdapter>
+Reduction MachineOperatorReducer::ReduceWordNXor(Node* node) {
+  using A = WordNAdapter;
+  A a(this);
+
+  typename A::IntNBinopMatcher m(node);
   if (m.right().Is(0)) return Replace(m.left().node());  // x ^ 0 => x
   if (m.IsFoldable()) {                                  // K ^ K => K
-    return ReplaceInt32(m.left().Value() ^ m.right().Value());
+    return a.ReplaceIntN(m.left().Value() ^ m.right().Value());
   }
   if (m.LeftEqualsRight()) return ReplaceInt32(0);  // x ^ x => 0
-  if (m.left().IsWord32Xor() && m.right().Is(-1)) {
-    Int32BinopMatcher mleft(m.left().node());
+  if (A::IsWordNXor(m.left()) && m.right().Is(-1)) {
+    typename A::IntNBinopMatcher mleft(m.left().node());
     if (mleft.right().Is(-1)) {  // (x ^ -1) ^ -1 => x
       return Replace(mleft.left().node());
     }
   }
 
-  return TryMatchWord32Ror(node);
+  return a.TryMatchWordNRor(node);
+}
+
+Reduction MachineOperatorReducer::ReduceWord32Xor(Node* node) {
+  DCHECK_EQ(IrOpcode::kWord32Xor, node->opcode());
+  return ReduceWordNXor<Word32Adapter>(node);
+}
+
+Reduction MachineOperatorReducer::ReduceWord64Xor(Node* node) {
+  DCHECK_EQ(IrOpcode::kWord64Xor, node->opcode());
+  return ReduceWordNXor<Word64Adapter>(node);
 }
 
 Reduction MachineOperatorReducer::ReduceFloat64InsertLowWord32(Node* node) {
diff --git a/deps/v8/src/compiler/machine-operator-reducer.h b/deps/v8/src/compiler/machine-operator-reducer.h
index 6eab08653e6031..2e869c9062fc74 100644
--- a/deps/v8/src/compiler/machine-operator-reducer.h
+++ b/deps/v8/src/compiler/machine-operator-reducer.h
@@ -17,6 +17,8 @@ namespace compiler {
 // Forward declarations.
 class CommonOperatorBuilder;
 class MachineGraph;
+class Word32Adapter;
+class Word64Adapter;
 
 // Performs constant folding and strength reduction on nodes that have
 // machine operators.
@@ -32,6 +34,9 @@ class V8_EXPORT_PRIVATE MachineOperatorReducer final
   Reduction Reduce(Node* node) override;
 
  private:
+  friend class Word32Adapter;
+  friend class Word64Adapter;
+
   Node* Float32Constant(volatile float value);
   Node* Float64Constant(volatile double value);
   Node* Int32Constant(int32_t value);
@@ -51,8 +56,7 @@ class V8_EXPORT_PRIVATE MachineOperatorReducer final
   Node* Word32Sar(Node* lhs, uint32_t rhs);
   Node* Word32Shr(Node* lhs, uint32_t rhs);
   Node* Word32Equal(Node* lhs, Node* rhs);
-  Node* BitcastWord32ToCompressedSigned(Node* value);
-  Node* BitcastCompressedSignedToWord32(Node* value);
+  Node* Word64And(Node* lhs, Node* rhs);
   Node* Int32Add(Node* lhs, Node* rhs);
   Node* Int32Sub(Node* lhs, Node* rhs);
   Node* Int32Mul(Node* lhs, Node* rhs);
@@ -80,6 +84,7 @@ class V8_EXPORT_PRIVATE MachineOperatorReducer final
   Reduction ReduceInt64Add(Node* node);
   Reduction ReduceInt32Sub(Node* node);
   Reduction ReduceInt64Sub(Node* node);
+  Reduction ReduceInt64Mul(Node* node);
   Reduction ReduceInt32Div(Node* node);
   Reduction ReduceUint32Div(Node* node);
   Reduction ReduceInt32Mod(Node* node);
@@ -94,9 +99,12 @@ class V8_EXPORT_PRIVATE MachineOperatorReducer final
   Reduction ReduceWord32Sar(Node* node);
   Reduction ReduceWord64Sar(Node* node);
   Reduction ReduceWord32And(Node* node);
+  Reduction ReduceWord64And(Node* node);
   Reduction TryMatchWord32Ror(Node* node);
   Reduction ReduceWord32Or(Node* node);
+  Reduction ReduceWord64Or(Node* node);
   Reduction ReduceWord32Xor(Node* node);
+  Reduction ReduceWord64Xor(Node* node);
   Reduction ReduceFloat64InsertLowWord32(Node* node);
   Reduction ReduceFloat64InsertHighWord32(Node* node);
   Reduction ReduceFloat64Compare(Node* node);
@@ -107,6 +115,15 @@ class V8_EXPORT_PRIVATE MachineOperatorReducer final
   CommonOperatorBuilder* common() const;
   MachineOperatorBuilder* machine() const;
 
+  // These reductions can be applied to operations of different word sizes.
+  // Use Word32Adapter or Word64Adapter to specialize for a particular one.
+  template <typename WordNAdapter>
+  Reduction ReduceWordNAnd(Node* node);
+  template <typename WordNAdapter>
+  Reduction ReduceWordNOr(Node* node);
+  template <typename WordNAdapter>
+  Reduction ReduceWordNXor(Node* node);
+
   MachineGraph* mcgraph_;
   bool allow_signalling_nan_;
 };
diff --git a/deps/v8/src/compiler/machine-operator.cc b/deps/v8/src/compiler/machine-operator.cc
index b450fb60da8b78..aadf48c5b97d66 100644
--- a/deps/v8/src/compiler/machine-operator.cc
+++ b/deps/v8/src/compiler/machine-operator.cc
@@ -29,10 +29,71 @@ size_t hash_value(StoreRepresentation rep) {
 
 
 std::ostream& operator<<(std::ostream& os, StoreRepresentation rep) {
-  return os << "(" << rep.representation() << " : " << rep.write_barrier_kind()
-            << ")";
+  return os << rep.representation() << ", " << rep.write_barrier_kind();
 }
 
+size_t hash_value(LoadKind kind) { return static_cast<size_t>(kind); }
+
+std::ostream& operator<<(std::ostream& os, LoadKind kind) {
+  switch (kind) {
+    case LoadKind::kNormal:
+      return os << "kNormal";
+    case LoadKind::kUnaligned:
+      return os << "kUnaligned";
+    case LoadKind::kProtected:
+      return os << "kProtected";
+  }
+  UNREACHABLE();
+}
+
+size_t hash_value(LoadTransformation rep) { return static_cast<size_t>(rep); }
+
+std::ostream& operator<<(std::ostream& os, LoadTransformation rep) {
+  switch (rep) {
+    case LoadTransformation::kS8x16LoadSplat:
+      return os << "kS8x16LoadSplat";
+    case LoadTransformation::kS16x8LoadSplat:
+      return os << "kS16x8LoadSplat";
+    case LoadTransformation::kS32x4LoadSplat:
+      return os << "kS32x4LoadSplat";
+    case LoadTransformation::kS64x2LoadSplat:
+      return os << "kS64x2LoadSplat";
+    case LoadTransformation::kI16x8Load8x8S:
+      return os << "kI16x8Load8x8S";
+    case LoadTransformation::kI16x8Load8x8U:
+      return os << "kI16x8Load8x8U";
+    case LoadTransformation::kI32x4Load16x4S:
+      return os << "kI32x4Load16x4S";
+    case LoadTransformation::kI32x4Load16x4U:
+      return os << "kI32x4Load16x4U";
+    case LoadTransformation::kI64x2Load32x2S:
+      return os << "kI64x2Load32x2S";
+    case LoadTransformation::kI64x2Load32x2U:
+      return os << "kI64x2Load32x2U";
+  }
+  UNREACHABLE();
+}
+
+size_t hash_value(LoadTransformParameters params) {
+  return base::hash_combine(params.kind, params.transformation);
+}
+
+std::ostream& operator<<(std::ostream& os, LoadTransformParameters params) {
+  return os << "(" << params.kind << " " << params.transformation << ")";
+}
+
+LoadTransformParameters const& LoadTransformParametersOf(Operator const* op) {
+  DCHECK_EQ(IrOpcode::kLoadTransform, op->opcode());
+  return OpParameter<LoadTransformParameters>(op);
+}
+
+bool operator==(LoadTransformParameters lhs, LoadTransformParameters rhs) {
+  return lhs.transformation == rhs.transformation && lhs.kind == rhs.kind;
+}
+
+bool operator!=(LoadTransformParameters lhs, LoadTransformParameters rhs) {
+  return !(lhs == rhs);
+}
 
 LoadRepresentation LoadRepresentationOf(Operator const* op) {
   DCHECK(IrOpcode::kLoad == op->opcode() ||
@@ -71,7 +132,7 @@ size_t hash_value(StackSlotRepresentation rep) {
 }
 
 std::ostream& operator<<(std::ostream& os, StackSlotRepresentation rep) {
-  return os << "(" << rep.size() << " : " << rep.alignment() << ")";
+  return os << rep.size() << ", " << rep.alignment();
 }
 
 StackSlotRepresentation const& StackSlotRepresentationOf(Operator const* op) {
@@ -139,271 +200,268 @@ MachineType AtomicOpType(Operator const* op) {
 
 // The format is:
 // V(Name, properties, value_input_count, control_input_count, output_count)
-#define MACHINE_PURE_OP_LIST(V)                                               \
-  PURE_BINARY_OP_LIST_32(V)                                                   \
-  PURE_BINARY_OP_LIST_64(V)                                                   \
-  V(Word32Clz, Operator::kNoProperties, 1, 0, 1)                              \
-  V(Word64Clz, Operator::kNoProperties, 1, 0, 1)                              \
-  V(Word32ReverseBytes, Operator::kNoProperties, 1, 0, 1)                     \
-  V(Word64ReverseBytes, Operator::kNoProperties, 1, 0, 1)                     \
-  V(Simd128ReverseBytes, Operator::kNoProperties, 1, 0, 1)                    \
-  V(BitcastTaggedToWordForTagAndSmiBits, Operator::kNoProperties, 1, 0, 1)    \
-  V(BitcastWordToTaggedSigned, Operator::kNoProperties, 1, 0, 1)              \
-  V(BitcastWord32ToCompressedSigned, Operator::kNoProperties, 1, 0, 1)        \
-  V(BitcastCompressedSignedToWord32, Operator::kNoProperties, 1, 0, 1)        \
-  V(TruncateFloat64ToWord32, Operator::kNoProperties, 1, 0, 1)                \
-  V(ChangeFloat32ToFloat64, Operator::kNoProperties, 1, 0, 1)                 \
-  V(ChangeFloat64ToInt32, Operator::kNoProperties, 1, 0, 1)                   \
-  V(ChangeFloat64ToInt64, Operator::kNoProperties, 1, 0, 1)                   \
-  V(ChangeFloat64ToUint32, Operator::kNoProperties, 1, 0, 1)                  \
-  V(ChangeFloat64ToUint64, Operator::kNoProperties, 1, 0, 1)                  \
-  V(TruncateFloat64ToInt64, Operator::kNoProperties, 1, 0, 1)                 \
-  V(TruncateFloat64ToUint32, Operator::kNoProperties, 1, 0, 1)                \
-  V(TruncateFloat32ToInt32, Operator::kNoProperties, 1, 0, 1)                 \
-  V(TruncateFloat32ToUint32, Operator::kNoProperties, 1, 0, 1)                \
-  V(TryTruncateFloat32ToInt64, Operator::kNoProperties, 1, 0, 2)              \
-  V(TryTruncateFloat64ToInt64, Operator::kNoProperties, 1, 0, 2)              \
-  V(TryTruncateFloat32ToUint64, Operator::kNoProperties, 1, 0, 2)             \
-  V(TryTruncateFloat64ToUint64, Operator::kNoProperties, 1, 0, 2)             \
-  V(ChangeInt32ToFloat64, Operator::kNoProperties, 1, 0, 1)                   \
-  V(ChangeInt64ToFloat64, Operator::kNoProperties, 1, 0, 1)                   \
-  V(Float64SilenceNaN, Operator::kNoProperties, 1, 0, 1)                      \
-  V(RoundFloat64ToInt32, Operator::kNoProperties, 1, 0, 1)                    \
-  V(RoundInt32ToFloat32, Operator::kNoProperties, 1, 0, 1)                    \
-  V(RoundInt64ToFloat32, Operator::kNoProperties, 1, 0, 1)                    \
-  V(RoundInt64ToFloat64, Operator::kNoProperties, 1, 0, 1)                    \
-  V(RoundUint32ToFloat32, Operator::kNoProperties, 1, 0, 1)                   \
-  V(RoundUint64ToFloat32, Operator::kNoProperties, 1, 0, 1)                   \
-  V(RoundUint64ToFloat64, Operator::kNoProperties, 1, 0, 1)                   \
-  V(ChangeInt32ToInt64, Operator::kNoProperties, 1, 0, 1)                     \
-  V(ChangeUint32ToFloat64, Operator::kNoProperties, 1, 0, 1)                  \
-  V(ChangeUint32ToUint64, Operator::kNoProperties, 1, 0, 1)                   \
-  V(ChangeTaggedToCompressed, Operator::kNoProperties, 1, 0, 1)               \
-  V(ChangeTaggedPointerToCompressedPointer, Operator::kNoProperties, 1, 0, 1) \
-  V(ChangeTaggedSignedToCompressedSigned, Operator::kNoProperties, 1, 0, 1)   \
-  V(ChangeCompressedToTagged, Operator::kNoProperties, 1, 0, 1)               \
-  V(ChangeCompressedPointerToTaggedPointer, Operator::kNoProperties, 1, 0, 1) \
-  V(ChangeCompressedSignedToTaggedSigned, Operator::kNoProperties, 1, 0, 1)   \
-  V(TruncateFloat64ToFloat32, Operator::kNoProperties, 1, 0, 1)               \
-  V(TruncateInt64ToInt32, Operator::kNoProperties, 1, 0, 1)                   \
-  V(BitcastFloat32ToInt32, Operator::kNoProperties, 1, 0, 1)                  \
-  V(BitcastFloat64ToInt64, Operator::kNoProperties, 1, 0, 1)                  \
-  V(BitcastInt32ToFloat32, Operator::kNoProperties, 1, 0, 1)                  \
-  V(BitcastInt64ToFloat64, Operator::kNoProperties, 1, 0, 1)                  \
-  V(SignExtendWord8ToInt32, Operator::kNoProperties, 1, 0, 1)                 \
-  V(SignExtendWord16ToInt32, Operator::kNoProperties, 1, 0, 1)                \
-  V(SignExtendWord8ToInt64, Operator::kNoProperties, 1, 0, 1)                 \
-  V(SignExtendWord16ToInt64, Operator::kNoProperties, 1, 0, 1)                \
-  V(SignExtendWord32ToInt64, Operator::kNoProperties, 1, 0, 1)                \
-  V(Float32Abs, Operator::kNoProperties, 1, 0, 1)                             \
-  V(Float32Add, Operator::kCommutative, 2, 0, 1)                              \
-  V(Float32Sub, Operator::kNoProperties, 2, 0, 1)                             \
-  V(Float32Mul, Operator::kCommutative, 2, 0, 1)                              \
-  V(Float32Div, Operator::kNoProperties, 2, 0, 1)                             \
-  V(Float32Neg, Operator::kNoProperties, 1, 0, 1)                             \
-  V(Float32Sqrt, Operator::kNoProperties, 1, 0, 1)                            \
-  V(Float32Max, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)     \
-  V(Float32Min, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)     \
-  V(Float64Abs, Operator::kNoProperties, 1, 0, 1)                             \
-  V(Float64Acos, Operator::kNoProperties, 1, 0, 1)                            \
-  V(Float64Acosh, Operator::kNoProperties, 1, 0, 1)                           \
-  V(Float64Asin, Operator::kNoProperties, 1, 0, 1)                            \
-  V(Float64Asinh, Operator::kNoProperties, 1, 0, 1)                           \
-  V(Float64Atan, Operator::kNoProperties, 1, 0, 1)                            \
-  V(Float64Atan2, Operator::kNoProperties, 2, 0, 1)                           \
-  V(Float64Atanh, Operator::kNoProperties, 1, 0, 1)                           \
-  V(Float64Cbrt, Operator::kNoProperties, 1, 0, 1)                            \
-  V(Float64Cos, Operator::kNoProperties, 1, 0, 1)                             \
-  V(Float64Cosh, Operator::kNoProperties, 1, 0, 1)                            \
-  V(Float64Exp, Operator::kNoProperties, 1, 0, 1)                             \
-  V(Float64Expm1, Operator::kNoProperties, 1, 0, 1)                           \
-  V(Float64Log, Operator::kNoProperties, 1, 0, 1)                             \
-  V(Float64Log1p, Operator::kNoProperties, 1, 0, 1)                           \
-  V(Float64Log2, Operator::kNoProperties, 1, 0, 1)                            \
-  V(Float64Log10, Operator::kNoProperties, 1, 0, 1)                           \
-  V(Float64Max, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)     \
-  V(Float64Min, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)     \
-  V(Float64Neg, Operator::kNoProperties, 1, 0, 1)                             \
-  V(Float64Add, Operator::kCommutative, 2, 0, 1)                              \
-  V(Float64Sub, Operator::kNoProperties, 2, 0, 1)                             \
-  V(Float64Mul, Operator::kCommutative, 2, 0, 1)                              \
-  V(Float64Div, Operator::kNoProperties, 2, 0, 1)                             \
-  V(Float64Mod, Operator::kNoProperties, 2, 0, 1)                             \
-  V(Float64Pow, Operator::kNoProperties, 2, 0, 1)                             \
-  V(Float64Sin, Operator::kNoProperties, 1, 0, 1)                             \
-  V(Float64Sinh, Operator::kNoProperties, 1, 0, 1)                            \
-  V(Float64Sqrt, Operator::kNoProperties, 1, 0, 1)                            \
-  V(Float64Tan, Operator::kNoProperties, 1, 0, 1)                             \
-  V(Float64Tanh, Operator::kNoProperties, 1, 0, 1)                            \
-  V(Float32Equal, Operator::kCommutative, 2, 0, 1)                            \
-  V(Float32LessThan, Operator::kNoProperties, 2, 0, 1)                        \
-  V(Float32LessThanOrEqual, Operator::kNoProperties, 2, 0, 1)                 \
-  V(Float64Equal, Operator::kCommutative, 2, 0, 1)                            \
-  V(Float64LessThan, Operator::kNoProperties, 2, 0, 1)                        \
-  V(Float64LessThanOrEqual, Operator::kNoProperties, 2, 0, 1)                 \
-  V(Float64ExtractLowWord32, Operator::kNoProperties, 1, 0, 1)                \
-  V(Float64ExtractHighWord32, Operator::kNoProperties, 1, 0, 1)               \
-  V(Float64InsertLowWord32, Operator::kNoProperties, 2, 0, 1)                 \
-  V(Float64InsertHighWord32, Operator::kNoProperties, 2, 0, 1)                \
-  V(LoadFramePointer, Operator::kNoProperties, 0, 0, 1)                       \
-  V(LoadParentFramePointer, Operator::kNoProperties, 0, 0, 1)                 \
-  V(Int32PairAdd, Operator::kNoProperties, 4, 0, 2)                           \
-  V(Int32PairSub, Operator::kNoProperties, 4, 0, 2)                           \
-  V(Int32PairMul, Operator::kNoProperties, 4, 0, 2)                           \
-  V(Word32PairShl, Operator::kNoProperties, 3, 0, 2)                          \
-  V(Word32PairShr, Operator::kNoProperties, 3, 0, 2)                          \
-  V(Word32PairSar, Operator::kNoProperties, 3, 0, 2)                          \
-  V(F64x2Splat, Operator::kNoProperties, 1, 0, 1)                             \
-  V(F64x2Abs, Operator::kNoProperties, 1, 0, 1)                               \
-  V(F64x2Neg, Operator::kNoProperties, 1, 0, 1)                               \
-  V(F64x2Sqrt, Operator::kNoProperties, 1, 0, 1)                              \
-  V(F64x2Add, Operator::kCommutative, 2, 0, 1)                                \
-  V(F64x2Sub, Operator::kNoProperties, 2, 0, 1)                               \
-  V(F64x2Mul, Operator::kCommutative, 2, 0, 1)                                \
-  V(F64x2Div, Operator::kNoProperties, 2, 0, 1)                               \
-  V(F64x2Min, Operator::kCommutative, 2, 0, 1)                                \
-  V(F64x2Max, Operator::kCommutative, 2, 0, 1)                                \
-  V(F64x2Eq, Operator::kCommutative, 2, 0, 1)                                 \
-  V(F64x2Ne, Operator::kCommutative, 2, 0, 1)                                 \
-  V(F64x2Lt, Operator::kNoProperties, 2, 0, 1)                                \
-  V(F64x2Le, Operator::kNoProperties, 2, 0, 1)                                \
-  V(F64x2Qfma, Operator::kNoProperties, 3, 0, 1)                              \
-  V(F64x2Qfms, Operator::kNoProperties, 3, 0, 1)                              \
-  V(F32x4Splat, Operator::kNoProperties, 1, 0, 1)                             \
-  V(F32x4SConvertI32x4, Operator::kNoProperties, 1, 0, 1)                     \
-  V(F32x4UConvertI32x4, Operator::kNoProperties, 1, 0, 1)                     \
-  V(F32x4Abs, Operator::kNoProperties, 1, 0, 1)                               \
-  V(F32x4Neg, Operator::kNoProperties, 1, 0, 1)                               \
-  V(F32x4Sqrt, Operator::kNoProperties, 1, 0, 1)                              \
-  V(F32x4RecipApprox, Operator::kNoProperties, 1, 0, 1)                       \
-  V(F32x4RecipSqrtApprox, Operator::kNoProperties, 1, 0, 1)                   \
-  V(F32x4Add, Operator::kCommutative, 2, 0, 1)                                \
-  V(F32x4AddHoriz, Operator::kNoProperties, 2, 0, 1)                          \
-  V(F32x4Sub, Operator::kNoProperties, 2, 0, 1)                               \
-  V(F32x4Mul, Operator::kCommutative, 2, 0, 1)                                \
-  V(F32x4Div, Operator::kNoProperties, 2, 0, 1)                               \
-  V(F32x4Min, Operator::kCommutative, 2, 0, 1)                                \
-  V(F32x4Max, Operator::kCommutative, 2, 0, 1)                                \
-  V(F32x4Eq, Operator::kCommutative, 2, 0, 1)                                 \
-  V(F32x4Ne, Operator::kCommutative, 2, 0, 1)                                 \
-  V(F32x4Lt, Operator::kNoProperties, 2, 0, 1)                                \
-  V(F32x4Le, Operator::kNoProperties, 2, 0, 1)                                \
-  V(F32x4Qfma, Operator::kNoProperties, 3, 0, 1)                              \
-  V(F32x4Qfms, Operator::kNoProperties, 3, 0, 1)                              \
-  V(I64x2Splat, Operator::kNoProperties, 1, 0, 1)                             \
-  V(I64x2Neg, Operator::kNoProperties, 1, 0, 1)                               \
-  V(I64x2Shl, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I64x2ShrS, Operator::kNoProperties, 2, 0, 1)                              \
-  V(I64x2Add, Operator::kCommutative, 2, 0, 1)                                \
-  V(I64x2Sub, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I64x2Mul, Operator::kCommutative, 2, 0, 1)                                \
-  V(I64x2MinS, Operator::kCommutative, 2, 0, 1)                               \
-  V(I64x2MaxS, Operator::kCommutative, 2, 0, 1)                               \
-  V(I64x2Eq, Operator::kCommutative, 2, 0, 1)                                 \
-  V(I64x2Ne, Operator::kCommutative, 2, 0, 1)                                 \
-  V(I64x2GtS, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I64x2GeS, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I64x2ShrU, Operator::kNoProperties, 2, 0, 1)                              \
-  V(I64x2MinU, Operator::kCommutative, 2, 0, 1)                               \
-  V(I64x2MaxU, Operator::kCommutative, 2, 0, 1)                               \
-  V(I64x2GtU, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I64x2GeU, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I32x4Splat, Operator::kNoProperties, 1, 0, 1)                             \
-  V(I32x4SConvertF32x4, Operator::kNoProperties, 1, 0, 1)                     \
-  V(I32x4SConvertI16x8Low, Operator::kNoProperties, 1, 0, 1)                  \
-  V(I32x4SConvertI16x8High, Operator::kNoProperties, 1, 0, 1)                 \
-  V(I32x4Neg, Operator::kNoProperties, 1, 0, 1)                               \
-  V(I32x4Shl, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I32x4ShrS, Operator::kNoProperties, 2, 0, 1)                              \
-  V(I32x4Add, Operator::kCommutative, 2, 0, 1)                                \
-  V(I32x4AddHoriz, Operator::kNoProperties, 2, 0, 1)                          \
-  V(I32x4Sub, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I32x4Mul, Operator::kCommutative, 2, 0, 1)                                \
-  V(I32x4MinS, Operator::kCommutative, 2, 0, 1)                               \
-  V(I32x4MaxS, Operator::kCommutative, 2, 0, 1)                               \
-  V(I32x4Eq, Operator::kCommutative, 2, 0, 1)                                 \
-  V(I32x4Ne, Operator::kCommutative, 2, 0, 1)                                 \
-  V(I32x4GtS, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I32x4GeS, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I32x4UConvertF32x4, Operator::kNoProperties, 1, 0, 1)                     \
-  V(I32x4UConvertI16x8Low, Operator::kNoProperties, 1, 0, 1)                  \
-  V(I32x4UConvertI16x8High, Operator::kNoProperties, 1, 0, 1)                 \
-  V(I32x4ShrU, Operator::kNoProperties, 2, 0, 1)                              \
-  V(I32x4MinU, Operator::kCommutative, 2, 0, 1)                               \
-  V(I32x4MaxU, Operator::kCommutative, 2, 0, 1)                               \
-  V(I32x4GtU, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I32x4GeU, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I16x8Splat, Operator::kNoProperties, 1, 0, 1)                             \
-  V(I16x8SConvertI8x16Low, Operator::kNoProperties, 1, 0, 1)                  \
-  V(I16x8SConvertI8x16High, Operator::kNoProperties, 1, 0, 1)                 \
-  V(I16x8Neg, Operator::kNoProperties, 1, 0, 1)                               \
-  V(I16x8Shl, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I16x8ShrS, Operator::kNoProperties, 2, 0, 1)                              \
-  V(I16x8SConvertI32x4, Operator::kNoProperties, 2, 0, 1)                     \
-  V(I16x8Add, Operator::kCommutative, 2, 0, 1)                                \
-  V(I16x8AddSaturateS, Operator::kCommutative, 2, 0, 1)                       \
-  V(I16x8AddHoriz, Operator::kNoProperties, 2, 0, 1)                          \
-  V(I16x8Sub, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I16x8SubSaturateS, Operator::kNoProperties, 2, 0, 1)                      \
-  V(I16x8Mul, Operator::kCommutative, 2, 0, 1)                                \
-  V(I16x8MinS, Operator::kCommutative, 2, 0, 1)                               \
-  V(I16x8MaxS, Operator::kCommutative, 2, 0, 1)                               \
-  V(I16x8Eq, Operator::kCommutative, 2, 0, 1)                                 \
-  V(I16x8Ne, Operator::kCommutative, 2, 0, 1)                                 \
-  V(I16x8GtS, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I16x8GeS, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I16x8UConvertI8x16Low, Operator::kNoProperties, 1, 0, 1)                  \
-  V(I16x8UConvertI8x16High, Operator::kNoProperties, 1, 0, 1)                 \
-  V(I16x8ShrU, Operator::kNoProperties, 2, 0, 1)                              \
-  V(I16x8UConvertI32x4, Operator::kNoProperties, 2, 0, 1)                     \
-  V(I16x8AddSaturateU, Operator::kCommutative, 2, 0, 1)                       \
-  V(I16x8SubSaturateU, Operator::kNoProperties, 2, 0, 1)                      \
-  V(I16x8MinU, Operator::kCommutative, 2, 0, 1)                               \
-  V(I16x8MaxU, Operator::kCommutative, 2, 0, 1)                               \
-  V(I16x8GtU, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I16x8GeU, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I8x16Splat, Operator::kNoProperties, 1, 0, 1)                             \
-  V(I8x16Neg, Operator::kNoProperties, 1, 0, 1)                               \
-  V(I8x16Shl, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I8x16ShrS, Operator::kNoProperties, 2, 0, 1)                              \
-  V(I8x16SConvertI16x8, Operator::kNoProperties, 2, 0, 1)                     \
-  V(I8x16Add, Operator::kCommutative, 2, 0, 1)                                \
-  V(I8x16AddSaturateS, Operator::kCommutative, 2, 0, 1)                       \
-  V(I8x16Sub, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I8x16SubSaturateS, Operator::kNoProperties, 2, 0, 1)                      \
-  V(I8x16Mul, Operator::kCommutative, 2, 0, 1)                                \
-  V(I8x16MinS, Operator::kCommutative, 2, 0, 1)                               \
-  V(I8x16MaxS, Operator::kCommutative, 2, 0, 1)                               \
-  V(I8x16Eq, Operator::kCommutative, 2, 0, 1)                                 \
-  V(I8x16Ne, Operator::kCommutative, 2, 0, 1)                                 \
-  V(I8x16GtS, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I8x16GeS, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I8x16ShrU, Operator::kNoProperties, 2, 0, 1)                              \
-  V(I8x16UConvertI16x8, Operator::kNoProperties, 2, 0, 1)                     \
-  V(I8x16AddSaturateU, Operator::kCommutative, 2, 0, 1)                       \
-  V(I8x16SubSaturateU, Operator::kNoProperties, 2, 0, 1)                      \
-  V(I8x16MinU, Operator::kCommutative, 2, 0, 1)                               \
-  V(I8x16MaxU, Operator::kCommutative, 2, 0, 1)                               \
-  V(I8x16GtU, Operator::kNoProperties, 2, 0, 1)                               \
-  V(I8x16GeU, Operator::kNoProperties, 2, 0, 1)                               \
-  V(S128Load, Operator::kNoProperties, 2, 0, 1)                               \
-  V(S128Store, Operator::kNoProperties, 3, 0, 1)                              \
-  V(S128Zero, Operator::kNoProperties, 0, 0, 1)                               \
-  V(S128And, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)        \
-  V(S128Or, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)         \
-  V(S128Xor, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)        \
-  V(S128Not, Operator::kNoProperties, 1, 0, 1)                                \
-  V(S128Select, Operator::kNoProperties, 3, 0, 1)                             \
-  V(S1x2AnyTrue, Operator::kNoProperties, 1, 0, 1)                            \
-  V(S1x2AllTrue, Operator::kNoProperties, 1, 0, 1)                            \
-  V(S1x4AnyTrue, Operator::kNoProperties, 1, 0, 1)                            \
-  V(S1x4AllTrue, Operator::kNoProperties, 1, 0, 1)                            \
-  V(S1x8AnyTrue, Operator::kNoProperties, 1, 0, 1)                            \
-  V(S1x8AllTrue, Operator::kNoProperties, 1, 0, 1)                            \
-  V(S1x16AnyTrue, Operator::kNoProperties, 1, 0, 1)                           \
-  V(S1x16AllTrue, Operator::kNoProperties, 1, 0, 1)                           \
-  V(S8x16Swizzle, Operator::kNoProperties, 2, 0, 1)                           \
-  V(StackPointerGreaterThan, Operator::kNoProperties, 1, 0, 1)
+#define MACHINE_PURE_OP_LIST(V)                                            \
+  PURE_BINARY_OP_LIST_32(V)                                                \
+  PURE_BINARY_OP_LIST_64(V)                                                \
+  V(Word32Clz, Operator::kNoProperties, 1, 0, 1)                           \
+  V(Word64Clz, Operator::kNoProperties, 1, 0, 1)                           \
+  V(Word32ReverseBytes, Operator::kNoProperties, 1, 0, 1)                  \
+  V(Word64ReverseBytes, Operator::kNoProperties, 1, 0, 1)                  \
+  V(Simd128ReverseBytes, Operator::kNoProperties, 1, 0, 1)                 \
+  V(BitcastTaggedToWordForTagAndSmiBits, Operator::kNoProperties, 1, 0, 1) \
+  V(BitcastWordToTaggedSigned, Operator::kNoProperties, 1, 0, 1)           \
+  V(TruncateFloat64ToWord32, Operator::kNoProperties, 1, 0, 1)             \
+  V(ChangeFloat32ToFloat64, Operator::kNoProperties, 1, 0, 1)              \
+  V(ChangeFloat64ToInt32, Operator::kNoProperties, 1, 0, 1)                \
+  V(ChangeFloat64ToInt64, Operator::kNoProperties, 1, 0, 1)                \
+  V(ChangeFloat64ToUint32, Operator::kNoProperties, 1, 0, 1)               \
+  V(ChangeFloat64ToUint64, Operator::kNoProperties, 1, 0, 1)               \
+  V(TruncateFloat64ToInt64, Operator::kNoProperties, 1, 0, 1)              \
+  V(TruncateFloat64ToUint32, Operator::kNoProperties, 1, 0, 1)             \
+  V(TruncateFloat32ToInt32, Operator::kNoProperties, 1, 0, 1)              \
+  V(TruncateFloat32ToUint32, Operator::kNoProperties, 1, 0, 1)             \
+  V(TryTruncateFloat32ToInt64, Operator::kNoProperties, 1, 0, 2)           \
+  V(TryTruncateFloat64ToInt64, Operator::kNoProperties, 1, 0, 2)           \
+  V(TryTruncateFloat32ToUint64, Operator::kNoProperties, 1, 0, 2)          \
+  V(TryTruncateFloat64ToUint64, Operator::kNoProperties, 1, 0, 2)          \
+  V(ChangeInt32ToFloat64, Operator::kNoProperties, 1, 0, 1)                \
+  V(ChangeInt64ToFloat64, Operator::kNoProperties, 1, 0, 1)                \
+  V(Float64SilenceNaN, Operator::kNoProperties, 1, 0, 1)                   \
+  V(RoundFloat64ToInt32, Operator::kNoProperties, 1, 0, 1)                 \
+  V(RoundInt32ToFloat32, Operator::kNoProperties, 1, 0, 1)                 \
+  V(RoundInt64ToFloat32, Operator::kNoProperties, 1, 0, 1)                 \
+  V(RoundInt64ToFloat64, Operator::kNoProperties, 1, 0, 1)                 \
+  V(RoundUint32ToFloat32, Operator::kNoProperties, 1, 0, 1)                \
+  V(RoundUint64ToFloat32, Operator::kNoProperties, 1, 0, 1)                \
+  V(RoundUint64ToFloat64, Operator::kNoProperties, 1, 0, 1)                \
+  V(BitcastWord32ToWord64, Operator::kNoProperties, 1, 0, 1)               \
+  V(ChangeInt32ToInt64, Operator::kNoProperties, 1, 0, 1)                  \
+  V(ChangeUint32ToFloat64, Operator::kNoProperties, 1, 0, 1)               \
+  V(ChangeUint32ToUint64, Operator::kNoProperties, 1, 0, 1)                \
+  V(TruncateFloat64ToFloat32, Operator::kNoProperties, 1, 0, 1)            \
+  V(TruncateInt64ToInt32, Operator::kNoProperties, 1, 0, 1)                \
+  V(BitcastFloat32ToInt32, Operator::kNoProperties, 1, 0, 1)               \
+  V(BitcastFloat64ToInt64, Operator::kNoProperties, 1, 0, 1)               \
+  V(BitcastInt32ToFloat32, Operator::kNoProperties, 1, 0, 1)               \
+  V(BitcastInt64ToFloat64, Operator::kNoProperties, 1, 0, 1)               \
+  V(SignExtendWord8ToInt32, Operator::kNoProperties, 1, 0, 1)              \
+  V(SignExtendWord16ToInt32, Operator::kNoProperties, 1, 0, 1)             \
+  V(SignExtendWord8ToInt64, Operator::kNoProperties, 1, 0, 1)              \
+  V(SignExtendWord16ToInt64, Operator::kNoProperties, 1, 0, 1)             \
+  V(SignExtendWord32ToInt64, Operator::kNoProperties, 1, 0, 1)             \
+  V(Float32Abs, Operator::kNoProperties, 1, 0, 1)                          \
+  V(Float32Add, Operator::kCommutative, 2, 0, 1)                           \
+  V(Float32Sub, Operator::kNoProperties, 2, 0, 1)                          \
+  V(Float32Mul, Operator::kCommutative, 2, 0, 1)                           \
+  V(Float32Div, Operator::kNoProperties, 2, 0, 1)                          \
+  V(Float32Neg, Operator::kNoProperties, 1, 0, 1)                          \
+  V(Float32Sqrt, Operator::kNoProperties, 1, 0, 1)                         \
+  V(Float32Max, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)  \
+  V(Float32Min, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)  \
+  V(Float64Abs, Operator::kNoProperties, 1, 0, 1)                          \
+  V(Float64Acos, Operator::kNoProperties, 1, 0, 1)                         \
+  V(Float64Acosh, Operator::kNoProperties, 1, 0, 1)                        \
+  V(Float64Asin, Operator::kNoProperties, 1, 0, 1)                         \
+  V(Float64Asinh, Operator::kNoProperties, 1, 0, 1)                        \
+  V(Float64Atan, Operator::kNoProperties, 1, 0, 1)                         \
+  V(Float64Atan2, Operator::kNoProperties, 2, 0, 1)                        \
+  V(Float64Atanh, Operator::kNoProperties, 1, 0, 1)                        \
+  V(Float64Cbrt, Operator::kNoProperties, 1, 0, 1)                         \
+  V(Float64Cos, Operator::kNoProperties, 1, 0, 1)                          \
+  V(Float64Cosh, Operator::kNoProperties, 1, 0, 1)                         \
+  V(Float64Exp, Operator::kNoProperties, 1, 0, 1)                          \
+  V(Float64Expm1, Operator::kNoProperties, 1, 0, 1)                        \
+  V(Float64Log, Operator::kNoProperties, 1, 0, 1)                          \
+  V(Float64Log1p, Operator::kNoProperties, 1, 0, 1)                        \
+  V(Float64Log2, Operator::kNoProperties, 1, 0, 1)                         \
+  V(Float64Log10, Operator::kNoProperties, 1, 0, 1)                        \
+  V(Float64Max, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)  \
+  V(Float64Min, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)  \
+  V(Float64Neg, Operator::kNoProperties, 1, 0, 1)                          \
+  V(Float64Add, Operator::kCommutative, 2, 0, 1)                           \
+  V(Float64Sub, Operator::kNoProperties, 2, 0, 1)                          \
+  V(Float64Mul, Operator::kCommutative, 2, 0, 1)                           \
+  V(Float64Div, Operator::kNoProperties, 2, 0, 1)                          \
+  V(Float64Mod, Operator::kNoProperties, 2, 0, 1)                          \
+  V(Float64Pow, Operator::kNoProperties, 2, 0, 1)                          \
+  V(Float64Sin, Operator::kNoProperties, 1, 0, 1)                          \
+  V(Float64Sinh, Operator::kNoProperties, 1, 0, 1)                         \
+  V(Float64Sqrt, Operator::kNoProperties, 1, 0, 1)                         \
+  V(Float64Tan, Operator::kNoProperties, 1, 0, 1)                          \
+  V(Float64Tanh, Operator::kNoProperties, 1, 0, 1)                         \
+  V(Float32Equal, Operator::kCommutative, 2, 0, 1)                         \
+  V(Float32LessThan, Operator::kNoProperties, 2, 0, 1)                     \
+  V(Float32LessThanOrEqual, Operator::kNoProperties, 2, 0, 1)              \
+  V(Float64Equal, Operator::kCommutative, 2, 0, 1)                         \
+  V(Float64LessThan, Operator::kNoProperties, 2, 0, 1)                     \
+  V(Float64LessThanOrEqual, Operator::kNoProperties, 2, 0, 1)              \
+  V(Float64ExtractLowWord32, Operator::kNoProperties, 1, 0, 1)             \
+  V(Float64ExtractHighWord32, Operator::kNoProperties, 1, 0, 1)            \
+  V(Float64InsertLowWord32, Operator::kNoProperties, 2, 0, 1)              \
+  V(Float64InsertHighWord32, Operator::kNoProperties, 2, 0, 1)             \
+  V(LoadStackCheckOffset, Operator::kNoProperties, 0, 0, 1)                \
+  V(LoadFramePointer, Operator::kNoProperties, 0, 0, 1)                    \
+  V(LoadParentFramePointer, Operator::kNoProperties, 0, 0, 1)              \
+  V(Int32PairAdd, Operator::kNoProperties, 4, 0, 2)                        \
+  V(Int32PairSub, Operator::kNoProperties, 4, 0, 2)                        \
+  V(Int32PairMul, Operator::kNoProperties, 4, 0, 2)                        \
+  V(Word32PairShl, Operator::kNoProperties, 3, 0, 2)                       \
+  V(Word32PairShr, Operator::kNoProperties, 3, 0, 2)                       \
+  V(Word32PairSar, Operator::kNoProperties, 3, 0, 2)                       \
+  V(F64x2Splat, Operator::kNoProperties, 1, 0, 1)                          \
+  V(F64x2Abs, Operator::kNoProperties, 1, 0, 1)                            \
+  V(F64x2Neg, Operator::kNoProperties, 1, 0, 1)                            \
+  V(F64x2Sqrt, Operator::kNoProperties, 1, 0, 1)                           \
+  V(F64x2Add, Operator::kCommutative, 2, 0, 1)                             \
+  V(F64x2Sub, Operator::kNoProperties, 2, 0, 1)                            \
+  V(F64x2Mul, Operator::kCommutative, 2, 0, 1)                             \
+  V(F64x2Div, Operator::kNoProperties, 2, 0, 1)                            \
+  V(F64x2Min, Operator::kCommutative, 2, 0, 1)                             \
+  V(F64x2Max, Operator::kCommutative, 2, 0, 1)                             \
+  V(F64x2Eq, Operator::kCommutative, 2, 0, 1)                              \
+  V(F64x2Ne, Operator::kCommutative, 2, 0, 1)                              \
+  V(F64x2Lt, Operator::kNoProperties, 2, 0, 1)                             \
+  V(F64x2Le, Operator::kNoProperties, 2, 0, 1)                             \
+  V(F64x2Qfma, Operator::kNoProperties, 3, 0, 1)                           \
+  V(F64x2Qfms, Operator::kNoProperties, 3, 0, 1)                           \
+  V(F32x4Splat, Operator::kNoProperties, 1, 0, 1)                          \
+  V(F32x4SConvertI32x4, Operator::kNoProperties, 1, 0, 1)                  \
+  V(F32x4UConvertI32x4, Operator::kNoProperties, 1, 0, 1)                  \
+  V(F32x4Abs, Operator::kNoProperties, 1, 0, 1)                            \
+  V(F32x4Neg, Operator::kNoProperties, 1, 0, 1)                            \
+  V(F32x4Sqrt, Operator::kNoProperties, 1, 0, 1)                           \
+  V(F32x4RecipApprox, Operator::kNoProperties, 1, 0, 1)                    \
+  V(F32x4RecipSqrtApprox, Operator::kNoProperties, 1, 0, 1)                \
+  V(F32x4Add, Operator::kCommutative, 2, 0, 1)                             \
+  V(F32x4AddHoriz, Operator::kNoProperties, 2, 0, 1)                       \
+  V(F32x4Sub, Operator::kNoProperties, 2, 0, 1)                            \
+  V(F32x4Mul, Operator::kCommutative, 2, 0, 1)                             \
+  V(F32x4Div, Operator::kNoProperties, 2, 0, 1)                            \
+  V(F32x4Min, Operator::kCommutative, 2, 0, 1)                             \
+  V(F32x4Max, Operator::kCommutative, 2, 0, 1)                             \
+  V(F32x4Eq, Operator::kCommutative, 2, 0, 1)                              \
+  V(F32x4Ne, Operator::kCommutative, 2, 0, 1)                              \
+  V(F32x4Lt, Operator::kNoProperties, 2, 0, 1)                             \
+  V(F32x4Le, Operator::kNoProperties, 2, 0, 1)                             \
+  V(F32x4Qfma, Operator::kNoProperties, 3, 0, 1)                           \
+  V(F32x4Qfms, Operator::kNoProperties, 3, 0, 1)                           \
+  V(I64x2Splat, Operator::kNoProperties, 1, 0, 1)                          \
+  V(I64x2SplatI32Pair, Operator::kNoProperties, 2, 0, 1)                   \
+  V(I64x2Neg, Operator::kNoProperties, 1, 0, 1)                            \
+  V(I64x2Shl, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I64x2ShrS, Operator::kNoProperties, 2, 0, 1)                           \
+  V(I64x2Add, Operator::kCommutative, 2, 0, 1)                             \
+  V(I64x2Sub, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I64x2Mul, Operator::kCommutative, 2, 0, 1)                             \
+  V(I64x2MinS, Operator::kCommutative, 2, 0, 1)                            \
+  V(I64x2MaxS, Operator::kCommutative, 2, 0, 1)                            \
+  V(I64x2Eq, Operator::kCommutative, 2, 0, 1)                              \
+  V(I64x2Ne, Operator::kCommutative, 2, 0, 1)                              \
+  V(I64x2GtS, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I64x2GeS, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I64x2ShrU, Operator::kNoProperties, 2, 0, 1)                           \
+  V(I64x2MinU, Operator::kCommutative, 2, 0, 1)                            \
+  V(I64x2MaxU, Operator::kCommutative, 2, 0, 1)                            \
+  V(I64x2GtU, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I64x2GeU, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I32x4Splat, Operator::kNoProperties, 1, 0, 1)                          \
+  V(I32x4SConvertF32x4, Operator::kNoProperties, 1, 0, 1)                  \
+  V(I32x4SConvertI16x8Low, Operator::kNoProperties, 1, 0, 1)               \
+  V(I32x4SConvertI16x8High, Operator::kNoProperties, 1, 0, 1)              \
+  V(I32x4Neg, Operator::kNoProperties, 1, 0, 1)                            \
+  V(I32x4Shl, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I32x4ShrS, Operator::kNoProperties, 2, 0, 1)                           \
+  V(I32x4Add, Operator::kCommutative, 2, 0, 1)                             \
+  V(I32x4AddHoriz, Operator::kNoProperties, 2, 0, 1)                       \
+  V(I32x4Sub, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I32x4Mul, Operator::kCommutative, 2, 0, 1)                             \
+  V(I32x4MinS, Operator::kCommutative, 2, 0, 1)                            \
+  V(I32x4MaxS, Operator::kCommutative, 2, 0, 1)                            \
+  V(I32x4Eq, Operator::kCommutative, 2, 0, 1)                              \
+  V(I32x4Ne, Operator::kCommutative, 2, 0, 1)                              \
+  V(I32x4GtS, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I32x4GeS, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I32x4UConvertF32x4, Operator::kNoProperties, 1, 0, 1)                  \
+  V(I32x4UConvertI16x8Low, Operator::kNoProperties, 1, 0, 1)               \
+  V(I32x4UConvertI16x8High, Operator::kNoProperties, 1, 0, 1)              \
+  V(I32x4ShrU, Operator::kNoProperties, 2, 0, 1)                           \
+  V(I32x4MinU, Operator::kCommutative, 2, 0, 1)                            \
+  V(I32x4MaxU, Operator::kCommutative, 2, 0, 1)                            \
+  V(I32x4GtU, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I32x4GeU, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I16x8Splat, Operator::kNoProperties, 1, 0, 1)                          \
+  V(I16x8SConvertI8x16Low, Operator::kNoProperties, 1, 0, 1)               \
+  V(I16x8SConvertI8x16High, Operator::kNoProperties, 1, 0, 1)              \
+  V(I16x8Neg, Operator::kNoProperties, 1, 0, 1)                            \
+  V(I16x8Shl, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I16x8ShrS, Operator::kNoProperties, 2, 0, 1)                           \
+  V(I16x8SConvertI32x4, Operator::kNoProperties, 2, 0, 1)                  \
+  V(I16x8Add, Operator::kCommutative, 2, 0, 1)                             \
+  V(I16x8AddSaturateS, Operator::kCommutative, 2, 0, 1)                    \
+  V(I16x8AddHoriz, Operator::kNoProperties, 2, 0, 1)                       \
+  V(I16x8Sub, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I16x8SubSaturateS, Operator::kNoProperties, 2, 0, 1)                   \
+  V(I16x8Mul, Operator::kCommutative, 2, 0, 1)                             \
+  V(I16x8MinS, Operator::kCommutative, 2, 0, 1)                            \
+  V(I16x8MaxS, Operator::kCommutative, 2, 0, 1)                            \
+  V(I16x8Eq, Operator::kCommutative, 2, 0, 1)                              \
+  V(I16x8Ne, Operator::kCommutative, 2, 0, 1)                              \
+  V(I16x8GtS, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I16x8GeS, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I16x8UConvertI8x16Low, Operator::kNoProperties, 1, 0, 1)               \
+  V(I16x8UConvertI8x16High, Operator::kNoProperties, 1, 0, 1)              \
+  V(I16x8ShrU, Operator::kNoProperties, 2, 0, 1)                           \
+  V(I16x8UConvertI32x4, Operator::kNoProperties, 2, 0, 1)                  \
+  V(I16x8AddSaturateU, Operator::kCommutative, 2, 0, 1)                    \
+  V(I16x8SubSaturateU, Operator::kNoProperties, 2, 0, 1)                   \
+  V(I16x8MinU, Operator::kCommutative, 2, 0, 1)                            \
+  V(I16x8MaxU, Operator::kCommutative, 2, 0, 1)                            \
+  V(I16x8GtU, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I16x8GeU, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I16x8RoundingAverageU, Operator::kCommutative, 2, 0, 1)                \
+  V(I8x16Splat, Operator::kNoProperties, 1, 0, 1)                          \
+  V(I8x16Neg, Operator::kNoProperties, 1, 0, 1)                            \
+  V(I8x16Shl, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I8x16ShrS, Operator::kNoProperties, 2, 0, 1)                           \
+  V(I8x16SConvertI16x8, Operator::kNoProperties, 2, 0, 1)                  \
+  V(I8x16Add, Operator::kCommutative, 2, 0, 1)                             \
+  V(I8x16AddSaturateS, Operator::kCommutative, 2, 0, 1)                    \
+  V(I8x16Sub, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I8x16SubSaturateS, Operator::kNoProperties, 2, 0, 1)                   \
+  V(I8x16Mul, Operator::kCommutative, 2, 0, 1)                             \
+  V(I8x16MinS, Operator::kCommutative, 2, 0, 1)                            \
+  V(I8x16MaxS, Operator::kCommutative, 2, 0, 1)                            \
+  V(I8x16Eq, Operator::kCommutative, 2, 0, 1)                              \
+  V(I8x16Ne, Operator::kCommutative, 2, 0, 1)                              \
+  V(I8x16GtS, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I8x16GeS, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I8x16ShrU, Operator::kNoProperties, 2, 0, 1)                           \
+  V(I8x16UConvertI16x8, Operator::kNoProperties, 2, 0, 1)                  \
+  V(I8x16AddSaturateU, Operator::kCommutative, 2, 0, 1)                    \
+  V(I8x16SubSaturateU, Operator::kNoProperties, 2, 0, 1)                   \
+  V(I8x16MinU, Operator::kCommutative, 2, 0, 1)                            \
+  V(I8x16MaxU, Operator::kCommutative, 2, 0, 1)                            \
+  V(I8x16GtU, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I8x16GeU, Operator::kNoProperties, 2, 0, 1)                            \
+  V(I8x16RoundingAverageU, Operator::kCommutative, 2, 0, 1)                \
+  V(S128Load, Operator::kNoProperties, 2, 0, 1)                            \
+  V(S128Store, Operator::kNoProperties, 3, 0, 1)                           \
+  V(S128Zero, Operator::kNoProperties, 0, 0, 1)                            \
+  V(S128And, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)     \
+  V(S128Or, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)      \
+  V(S128Xor, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)     \
+  V(S128Not, Operator::kNoProperties, 1, 0, 1)                             \
+  V(S128Select, Operator::kNoProperties, 3, 0, 1)                          \
+  V(S128AndNot, Operator::kNoProperties, 2, 0, 1)                          \
+  V(S1x2AnyTrue, Operator::kNoProperties, 1, 0, 1)                         \
+  V(S1x2AllTrue, Operator::kNoProperties, 1, 0, 1)                         \
+  V(S1x4AnyTrue, Operator::kNoProperties, 1, 0, 1)                         \
+  V(S1x4AllTrue, Operator::kNoProperties, 1, 0, 1)                         \
+  V(S1x8AnyTrue, Operator::kNoProperties, 1, 0, 1)                         \
+  V(S1x8AllTrue, Operator::kNoProperties, 1, 0, 1)                         \
+  V(S1x16AnyTrue, Operator::kNoProperties, 1, 0, 1)                        \
+  V(S1x16AllTrue, Operator::kNoProperties, 1, 0, 1)                        \
+  V(S8x16Swizzle, Operator::kNoProperties, 2, 0, 1)
 
 // The format is:
 // V(Name, properties, value_input_count, control_input_count, output_count)
@@ -451,7 +509,6 @@ MachineType AtomicOpType(Operator const* op) {
   V(TaggedSigned)            \
   V(TaggedPointer)           \
   V(AnyTagged)               \
-  V(CompressedSigned)        \
   V(CompressedPointer)       \
   V(AnyCompressed)
 
@@ -466,10 +523,21 @@ MachineType AtomicOpType(Operator const* op) {
   V(kTaggedSigned)                     \
   V(kTaggedPointer)                    \
   V(kTagged)                           \
-  V(kCompressedSigned)                 \
   V(kCompressedPointer)                \
   V(kCompressed)
 
+#define LOAD_TRANSFORM_LIST(V) \
+  V(S8x16LoadSplat)            \
+  V(S16x8LoadSplat)            \
+  V(S32x4LoadSplat)            \
+  V(S64x2LoadSplat)            \
+  V(I16x8Load8x8S)             \
+  V(I16x8Load8x8U)             \
+  V(I32x4Load16x4S)            \
+  V(I32x4Load16x4U)            \
+  V(I64x2Load32x2S)            \
+  V(I64x2Load32x2U)
+
 #define ATOMIC_U32_TYPE_LIST(V) \
   V(Uint8)                      \
   V(Uint16)                     \
@@ -585,6 +653,28 @@ struct MachineOperatorGlobalCache {
   MACHINE_TYPE_LIST(LOAD)
 #undef LOAD
 
+#define LOAD_TRANSFORM_KIND(TYPE, KIND)                                     \
+  struct KIND##LoadTransform##TYPE##Operator final                          \
+      : public Operator1<LoadTransformParameters> {                         \
+    KIND##LoadTransform##TYPE##Operator()                                   \
+        : Operator1<LoadTransformParameters>(                               \
+              IrOpcode::kLoadTransform,                                     \
+              Operator::kNoDeopt | Operator::kNoThrow | Operator::kNoWrite, \
+              #KIND "LoadTransform", 2, 1, 1, 1, 1, 0,                      \
+              LoadTransformParameters{LoadKind::k##KIND,                    \
+                                      LoadTransformation::k##TYPE}) {}      \
+  };                                                                        \
+  KIND##LoadTransform##TYPE##Operator k##KIND##LoadTransform##TYPE;
+
+#define LOAD_TRANSFORM(TYPE)           \
+  LOAD_TRANSFORM_KIND(TYPE, Normal)    \
+  LOAD_TRANSFORM_KIND(TYPE, Unaligned) \
+  LOAD_TRANSFORM_KIND(TYPE, Protected)
+
+  LOAD_TRANSFORM_LIST(LOAD_TRANSFORM)
+#undef LOAD_TRANSFORM
+#undef LOAD_TRANSFORM_KIND
+
 #define STACKSLOT(Size, Alignment)                                     \
   struct StackSlotOfSize##Size##OfAlignment##Alignment##Operator final \
       : public StackSlotOperator {                                     \
@@ -896,6 +986,26 @@ struct MachineOperatorGlobalCache {
                    "UnsafePointerAdd", 2, 1, 1, 1, 1, 0) {}
   };
   UnsafePointerAddOperator kUnsafePointerAdd;
+
+  struct StackPointerGreaterThanOperator : public Operator1<StackCheckKind> {
+    explicit StackPointerGreaterThanOperator(StackCheckKind kind)
+        : Operator1<StackCheckKind>(
+              IrOpcode::kStackPointerGreaterThan, Operator::kEliminatable,
+              "StackPointerGreaterThan", 1, 1, 0, 1, 1, 0, kind) {}
+  };
+#define STACK_POINTER_GREATER_THAN(Kind)                              \
+  struct StackPointerGreaterThan##Kind##Operator final                \
+      : public StackPointerGreaterThanOperator {                      \
+    StackPointerGreaterThan##Kind##Operator()                         \
+        : StackPointerGreaterThanOperator(StackCheckKind::k##Kind) {} \
+  };                                                                  \
+  StackPointerGreaterThan##Kind##Operator kStackPointerGreaterThan##Kind;
+
+  STACK_POINTER_GREATER_THAN(JSFunctionEntry)
+  STACK_POINTER_GREATER_THAN(JSIterationBody)
+  STACK_POINTER_GREATER_THAN(CodeStubAssembler)
+  STACK_POINTER_GREATER_THAN(Wasm)
+#undef STACK_POINTER_GREATER_THAN
 };
 
 struct CommentOperator : public Operator1<const char*> {
@@ -995,6 +1105,23 @@ const Operator* MachineOperatorBuilder::ProtectedLoad(LoadRepresentation rep) {
   UNREACHABLE();
 }
 
+const Operator* MachineOperatorBuilder::LoadTransform(
+    LoadKind kind, LoadTransformation transform) {
+#define LOAD_TRANSFORM_KIND(TYPE, KIND)                                        \
+  if (kind == LoadKind::k##KIND && transform == LoadTransformation::k##TYPE) { \
+    return &cache_.k##KIND##LoadTransform##TYPE;                               \
+  }
+#define LOAD_TRANSFORM(TYPE)           \
+  LOAD_TRANSFORM_KIND(TYPE, Normal)    \
+  LOAD_TRANSFORM_KIND(TYPE, Unaligned) \
+  LOAD_TRANSFORM_KIND(TYPE, Protected)
+
+  LOAD_TRANSFORM_LIST(LOAD_TRANSFORM)
+#undef LOAD_TRANSFORM
+#undef LOAD_TRANSFORM_KIND
+  UNREACHABLE();
+}
+
 const Operator* MachineOperatorBuilder::StackSlot(int size, int alignment) {
   DCHECK_LE(0, size);
   DCHECK(alignment == 0 || alignment == 4 || alignment == 8 || alignment == 16);
@@ -1062,6 +1189,21 @@ const Operator* MachineOperatorBuilder::UnsafePointerAdd() {
   return &cache_.kUnsafePointerAdd;
 }
 
+const Operator* MachineOperatorBuilder::StackPointerGreaterThan(
+    StackCheckKind kind) {
+  switch (kind) {
+    case StackCheckKind::kJSFunctionEntry:
+      return &cache_.kStackPointerGreaterThanJSFunctionEntry;
+    case StackCheckKind::kJSIterationBody:
+      return &cache_.kStackPointerGreaterThanJSIterationBody;
+    case StackCheckKind::kCodeStubAssembler:
+      return &cache_.kStackPointerGreaterThanCodeStubAssembler;
+    case StackCheckKind::kWasm:
+      return &cache_.kStackPointerGreaterThanWasm;
+  }
+  UNREACHABLE();
+}
+
 const Operator* MachineOperatorBuilder::BitcastWordToTagged() {
   return &cache_.kBitcastWordToTagged;
 }
@@ -1324,14 +1466,25 @@ const Operator* MachineOperatorBuilder::Word64PoisonOnSpeculation() {
   return &cache_.kWord64PoisonOnSpeculation;
 }
 
-#define SIMD_LANE_OPS(Type, lane_count)                                     \
-  const Operator* MachineOperatorBuilder::Type##ExtractLane(                \
-      int32_t lane_index) {                                                 \
-    DCHECK(0 <= lane_index && lane_index < lane_count);                     \
-    return new (zone_)                                                      \
-        Operator1<int32_t>(IrOpcode::k##Type##ExtractLane, Operator::kPure, \
-                           "Extract lane", 1, 0, 0, 1, 0, 0, lane_index);   \
-  }                                                                         \
+#define EXTRACT_LANE_OP(Type, Sign, lane_count)                                \
+  const Operator* MachineOperatorBuilder::Type##ExtractLane##Sign(             \
+      int32_t lane_index) {                                                    \
+    DCHECK(0 <= lane_index && lane_index < lane_count);                        \
+    return new (zone_) Operator1<int32_t>(                                     \
+        IrOpcode::k##Type##ExtractLane##Sign, Operator::kPure, "Extract lane", \
+        1, 0, 0, 1, 0, 0, lane_index);                                         \
+  }
+EXTRACT_LANE_OP(F64x2, , 2)
+EXTRACT_LANE_OP(F32x4, , 4)
+EXTRACT_LANE_OP(I64x2, , 2)
+EXTRACT_LANE_OP(I32x4, , 4)
+EXTRACT_LANE_OP(I16x8, U, 8)
+EXTRACT_LANE_OP(I16x8, S, 8)
+EXTRACT_LANE_OP(I8x16, U, 16)
+EXTRACT_LANE_OP(I8x16, S, 16)
+#undef EXTRACT_LANE_OP
+
+#define REPLACE_LANE_OP(Type, lane_count)                                   \
   const Operator* MachineOperatorBuilder::Type##ReplaceLane(                \
       int32_t lane_index) {                                                 \
     DCHECK(0 <= lane_index && lane_index < lane_count);                     \
@@ -1339,21 +1492,54 @@ const Operator* MachineOperatorBuilder::Word64PoisonOnSpeculation() {
         Operator1<int32_t>(IrOpcode::k##Type##ReplaceLane, Operator::kPure, \
                            "Replace lane", 2, 0, 0, 1, 0, 0, lane_index);   \
   }
-SIMD_LANE_OP_LIST(SIMD_LANE_OPS)
-#undef SIMD_LANE_OPS
+SIMD_LANE_OP_LIST(REPLACE_LANE_OP)
+#undef REPLACE_LANE_OP
 
-const Operator* MachineOperatorBuilder::S8x16Shuffle(
-    const uint8_t shuffle[16]) {
-  uint8_t* array = zone_->NewArray<uint8_t>(16);
-  memcpy(array, shuffle, 16);
+const Operator* MachineOperatorBuilder::I64x2ReplaceLaneI32Pair(
+    int32_t lane_index) {
+  DCHECK(0 <= lane_index && lane_index < 2);
   return new (zone_)
-      Operator1<uint8_t*>(IrOpcode::kS8x16Shuffle, Operator::kPure, "Shuffle",
-                          2, 0, 0, 1, 0, 0, array);
+      Operator1<int32_t>(IrOpcode::kI64x2ReplaceLaneI32Pair, Operator::kPure,
+                         "Replace lane", 3, 0, 0, 1, 0, 0, lane_index);
+}
+
+bool operator==(S8x16ShuffleParameter const& lhs,
+                S8x16ShuffleParameter const& rhs) {
+  return (lhs.shuffle() == rhs.shuffle());
 }
 
-const uint8_t* S8x16ShuffleOf(Operator const* op) {
+bool operator!=(S8x16ShuffleParameter const& lhs,
+                S8x16ShuffleParameter const& rhs) {
+  return !(lhs == rhs);
+}
+
+size_t hash_value(S8x16ShuffleParameter const& p) {
+  return base::hash_range(p.shuffle().begin(), p.shuffle().end());
+}
+
+std::ostream& operator<<(std::ostream& os, S8x16ShuffleParameter const& p) {
+  for (int i = 0; i < 16; i++) {
+    const char* separator = (i < 15) ? "," : "";
+    os << static_cast<uint32_t>(p[i]) << separator;
+  }
+  return os;
+}
+
+S8x16ShuffleParameter const& S8x16ShuffleParameterOf(Operator const* op) {
   DCHECK_EQ(IrOpcode::kS8x16Shuffle, op->opcode());
-  return OpParameter<uint8_t*>(op);
+  return OpParameter<S8x16ShuffleParameter>(op);
+}
+
+const Operator* MachineOperatorBuilder::S8x16Shuffle(
+    const uint8_t shuffle[16]) {
+  return new (zone_) Operator1<S8x16ShuffleParameter>(
+      IrOpcode::kS8x16Shuffle, Operator::kPure, "Shuffle", 2, 0, 0, 1, 0, 0,
+      S8x16ShuffleParameter(shuffle));
+}
+
+StackCheckKind StackCheckKindOf(Operator const* op) {
+  DCHECK_EQ(IrOpcode::kStackPointerGreaterThan, op->opcode());
+  return OpParameter<StackCheckKind>(op);
 }
 
 #undef PURE_BINARY_OP_LIST_32
@@ -1370,6 +1556,7 @@ const uint8_t* S8x16ShuffleOf(Operator const* op) {
 #undef ATOMIC64_REPRESENTATION_LIST
 #undef SIMD_LANE_OP_LIST
 #undef STACK_SLOT_CACHED_SIZES_ALIGNMENTS_LIST
+#undef LOAD_TRANSFORM_LIST
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/machine-operator.h b/deps/v8/src/compiler/machine-operator.h
index 1bd806eefbe3cd..d3792be559ad80 100644
--- a/deps/v8/src/compiler/machine-operator.h
+++ b/deps/v8/src/compiler/machine-operator.h
@@ -9,6 +9,7 @@
 #include "src/base/enum-set.h"
 #include "src/base/flags.h"
 #include "src/codegen/machine-type.h"
+#include "src/compiler/globals.h"
 #include "src/compiler/write-barrier-kind.h"
 #include "src/zone/zone.h"
 
@@ -49,6 +50,46 @@ using LoadRepresentation = MachineType;
 V8_EXPORT_PRIVATE LoadRepresentation LoadRepresentationOf(Operator const*)
     V8_WARN_UNUSED_RESULT;
 
+enum class LoadKind {
+  kNormal,
+  kUnaligned,
+  kProtected,
+};
+
+size_t hash_value(LoadKind);
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, LoadKind);
+
+enum class LoadTransformation {
+  kS8x16LoadSplat,
+  kS16x8LoadSplat,
+  kS32x4LoadSplat,
+  kS64x2LoadSplat,
+  kI16x8Load8x8S,
+  kI16x8Load8x8U,
+  kI32x4Load16x4S,
+  kI32x4Load16x4U,
+  kI64x2Load32x2S,
+  kI64x2Load32x2U,
+};
+
+size_t hash_value(LoadTransformation);
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, LoadTransformation);
+
+struct LoadTransformParameters {
+  LoadKind kind;
+  LoadTransformation transformation;
+};
+
+size_t hash_value(LoadTransformParameters);
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&,
+                                           LoadTransformParameters);
+
+V8_EXPORT_PRIVATE LoadTransformParameters const& LoadTransformParametersOf(
+    Operator const*) V8_WARN_UNUSED_RESULT;
+
 // A Store needs a MachineType and a WriteBarrierKind in order to emit the
 // correct write barrier.
 class StoreRepresentation final {
@@ -112,8 +153,33 @@ MachineRepresentation AtomicStoreRepresentationOf(Operator const* op)
 
 MachineType AtomicOpType(Operator const* op) V8_WARN_UNUSED_RESULT;
 
-V8_EXPORT_PRIVATE const uint8_t* S8x16ShuffleOf(Operator const* op)
-    V8_WARN_UNUSED_RESULT;
+class S8x16ShuffleParameter {
+ public:
+  explicit S8x16ShuffleParameter(const uint8_t shuffle[16]) {
+    std::copy(shuffle, shuffle + 16, shuffle_.begin());
+  }
+  const std::array<uint8_t, 16>& shuffle() const { return shuffle_; }
+  const uint8_t* data() const { return shuffle_.data(); }
+  uint8_t operator[](int x) const { return shuffle_[x]; }
+
+ private:
+  std::array<uint8_t, 16> shuffle_;
+};
+
+V8_EXPORT_PRIVATE bool operator==(S8x16ShuffleParameter const& lhs,
+                                  S8x16ShuffleParameter const& rhs);
+bool operator!=(S8x16ShuffleParameter const& lhs,
+                S8x16ShuffleParameter const& rhs);
+
+size_t hash_value(S8x16ShuffleParameter const& p);
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&,
+                                           S8x16ShuffleParameter const&);
+
+V8_EXPORT_PRIVATE S8x16ShuffleParameter const& S8x16ShuffleParameterOf(
+    Operator const* op) V8_WARN_UNUSED_RESULT;
+
+StackCheckKind StackCheckKindOf(Operator const* op) V8_WARN_UNUSED_RESULT;
 
 // Interface for building machine-level operators. These operators are
 // machine-level but machine-independent and thus define a language suitable
@@ -320,12 +386,6 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   // This operator reinterprets the bits of a word as a Smi.
   const Operator* BitcastWordToTaggedSigned();
 
-  // This operator reinterprets the bits of a word32 as a Compressed Smi.
-  const Operator* BitcastWord32ToCompressedSigned();
-
-  // This operator reinterprets the bits of a Compressed Smi as a word32.
-  const Operator* BitcastCompressedSignedToWord32();
-
   // JavaScript float64 to int32/uint32 truncation.
   const Operator* TruncateFloat64ToWord32();
 
@@ -348,16 +408,11 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* TryTruncateFloat32ToUint64();
   const Operator* TryTruncateFloat64ToUint64();
   const Operator* ChangeInt32ToFloat64();
+  const Operator* BitcastWord32ToWord64();
   const Operator* ChangeInt32ToInt64();
   const Operator* ChangeInt64ToFloat64();
   const Operator* ChangeUint32ToFloat64();
   const Operator* ChangeUint32ToUint64();
-  const Operator* ChangeTaggedToCompressed();
-  const Operator* ChangeTaggedPointerToCompressedPointer();
-  const Operator* ChangeTaggedSignedToCompressedSigned();
-  const Operator* ChangeCompressedToTagged();
-  const Operator* ChangeCompressedPointerToTaggedPointer();
-  const Operator* ChangeCompressedSignedToTaggedSigned();
 
   // These operators truncate or round numbers, both changing the representation
   // of the number and mapping multiple input values onto the same output value.
@@ -524,8 +579,10 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* F32x4Qfms();
 
   const Operator* I64x2Splat();
+  const Operator* I64x2SplatI32Pair();
   const Operator* I64x2ExtractLane(int32_t);
   const Operator* I64x2ReplaceLane(int32_t);
+  const Operator* I64x2ReplaceLaneI32Pair(int32_t);
   const Operator* I64x2Neg();
   const Operator* I64x2Shl();
   const Operator* I64x2ShrS();
@@ -574,7 +631,8 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* I32x4GeU();
 
   const Operator* I16x8Splat();
-  const Operator* I16x8ExtractLane(int32_t);
+  const Operator* I16x8ExtractLaneU(int32_t);
+  const Operator* I16x8ExtractLaneS(int32_t);
   const Operator* I16x8ReplaceLane(int32_t);
   const Operator* I16x8SConvertI8x16Low();
   const Operator* I16x8SConvertI8x16High();
@@ -605,9 +663,11 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* I16x8MaxU();
   const Operator* I16x8GtU();
   const Operator* I16x8GeU();
+  const Operator* I16x8RoundingAverageU();
 
   const Operator* I8x16Splat();
-  const Operator* I8x16ExtractLane(int32_t);
+  const Operator* I8x16ExtractLaneU(int32_t);
+  const Operator* I8x16ExtractLaneS(int32_t);
   const Operator* I8x16ReplaceLane(int32_t);
   const Operator* I8x16Neg();
   const Operator* I8x16Shl();
@@ -633,6 +693,7 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* I8x16MaxU();
   const Operator* I8x16GtU();
   const Operator* I8x16GeU();
+  const Operator* I8x16RoundingAverageU();
 
   const Operator* S128Load();
   const Operator* S128Store();
@@ -643,6 +704,7 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* S128Xor();
   const Operator* S128Not();
   const Operator* S128Select();
+  const Operator* S128AndNot();
 
   const Operator* S8x16Swizzle();
   const Operator* S8x16Shuffle(const uint8_t shuffle[16]);
@@ -661,6 +723,8 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* PoisonedLoad(LoadRepresentation rep);
   const Operator* ProtectedLoad(LoadRepresentation rep);
 
+  const Operator* LoadTransform(LoadKind kind, LoadTransformation transform);
+
   // store [base + index], value
   const Operator* Store(StoreRepresentation rep);
   const Operator* ProtectedStore(MachineRepresentation rep);
@@ -683,8 +747,14 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* LoadFramePointer();
   const Operator* LoadParentFramePointer();
 
-  // Compares: stack_pointer > value.
-  const Operator* StackPointerGreaterThan();
+  // Compares: stack_pointer [- offset] > value. The offset is optionally
+  // applied for kFunctionEntry stack checks.
+  const Operator* StackPointerGreaterThan(StackCheckKind kind);
+
+  // Loads the offset that should be applied to the current stack
+  // pointer before a stack check. Used as input to the
+  // Runtime::kStackGuardWithGap call.
+  const Operator* LoadStackCheckOffset();
 
   // Memory barrier.
   const Operator* MemBarrier();
diff --git a/deps/v8/src/compiler/memory-lowering.cc b/deps/v8/src/compiler/memory-lowering.cc
index 1e112e8e824aaf..6012ae62c575ad 100644
--- a/deps/v8/src/compiler/memory-lowering.cc
+++ b/deps/v8/src/compiler/memory-lowering.cc
@@ -44,13 +44,17 @@ class MemoryLowering::AllocationGroup final : public ZoneObject {
 };
 
 MemoryLowering::MemoryLowering(JSGraph* jsgraph, Zone* zone,
+                               JSGraphAssembler* graph_assembler,
                                PoisoningMitigationLevel poisoning_level,
                                AllocationFolding allocation_folding,
                                WriteBarrierAssertFailedCallback callback,
                                const char* function_debug_name)
-    : jsgraph_(jsgraph),
+    : isolate_(jsgraph->isolate()),
       zone_(zone),
-      graph_assembler_(jsgraph, nullptr, nullptr, zone),
+      graph_zone_(jsgraph->graph()->zone()),
+      common_(jsgraph->common()),
+      machine_(jsgraph->machine()),
+      graph_assembler_(graph_assembler),
       allocation_folding_(allocation_folding),
       poisoning_level_(poisoning_level),
       write_barrier_assert_failed_(callback),
@@ -96,7 +100,7 @@ Reduction MemoryLowering::ReduceAllocateRaw(
   Node* effect = node->InputAt(1);
   Node* control = node->InputAt(2);
 
-  gasm()->Reset(effect, control);
+  gasm()->InitializeEffectControl(effect, control);
 
   Node* allocate_builtin;
   if (allocation_type == AllocationType::kYoung) {
@@ -162,8 +166,8 @@ Reduction MemoryLowering::ReduceAllocateRaw(
       // Compute the effective inner allocated address.
       value = __ BitcastWordToTagged(
           __ IntAdd(state->top(), __ IntPtrConstant(kHeapObjectTag)));
-      effect = __ ExtractCurrentEffect();
-      control = __ ExtractCurrentControl();
+      effect = gasm()->effect();
+      control = gasm()->control();
 
       // Extend the allocation {group}.
       group->Add(value);
@@ -195,7 +199,7 @@ Reduction MemoryLowering::ReduceAllocateRaw(
         if (!allocate_operator_.is_set()) {
           auto descriptor = AllocateDescriptor{};
           auto call_descriptor = Linkage::GetStubCallDescriptor(
-              graph()->zone(), descriptor, descriptor.GetStackParameterCount(),
+              graph_zone(), descriptor, descriptor.GetStackParameterCount(),
               CallDescriptor::kCanUseRoots, Operator::kNoThrow);
           allocate_operator_.set(common()->Call(call_descriptor));
         }
@@ -216,8 +220,8 @@ Reduction MemoryLowering::ReduceAllocateRaw(
       // Compute the initial object address.
       value = __ BitcastWordToTagged(
           __ IntAdd(done.PhiAt(0), __ IntPtrConstant(kHeapObjectTag)));
-      effect = __ ExtractCurrentEffect();
-      control = __ ExtractCurrentControl();
+      effect = gasm()->effect();
+      control = gasm()->control();
 
       // Start a new allocation group.
       AllocationGroup* group =
@@ -256,7 +260,7 @@ Reduction MemoryLowering::ReduceAllocateRaw(
     if (!allocate_operator_.is_set()) {
       auto descriptor = AllocateDescriptor{};
       auto call_descriptor = Linkage::GetStubCallDescriptor(
-          graph()->zone(), descriptor, descriptor.GetStackParameterCount(),
+          graph_zone(), descriptor, descriptor.GetStackParameterCount(),
           CallDescriptor::kCanUseRoots, Operator::kNoThrow);
       allocate_operator_.set(common()->Call(call_descriptor));
     }
@@ -264,8 +268,8 @@ Reduction MemoryLowering::ReduceAllocateRaw(
 
     __ Bind(&done);
     value = done.PhiAt(0);
-    effect = __ ExtractCurrentEffect();
-    control = __ ExtractCurrentControl();
+    effect = gasm()->effect();
+    control = gasm()->control();
 
     if (state_ptr) {
       // Create an unfoldable allocation group.
@@ -275,22 +279,6 @@ Reduction MemoryLowering::ReduceAllocateRaw(
     }
   }
 
-  // Replace all effect uses of {node} with the {effect} and replace
-  // all value uses of {node} with the {value}.
-  for (Edge edge : node->use_edges()) {
-    if (NodeProperties::IsEffectEdge(edge)) {
-      edge.UpdateTo(effect);
-    } else if (NodeProperties::IsValueEdge(edge)) {
-      edge.UpdateTo(value);
-    } else {
-      DCHECK(NodeProperties::IsControlEdge(edge));
-      edge.UpdateTo(control);
-    }
-  }
-
-  // Kill the {node} to make sure we don't leave dangling dead uses.
-  node->Kill();
-
   return Replace(value);
 }
 
@@ -318,8 +306,8 @@ Reduction MemoryLowering::ReduceLoadElement(Node* node) {
 Reduction MemoryLowering::ReduceLoadField(Node* node) {
   DCHECK_EQ(IrOpcode::kLoadField, node->opcode());
   FieldAccess const& access = FieldAccessOf(node->op());
-  Node* offset = jsgraph()->IntPtrConstant(access.offset - access.tag());
-  node->InsertInput(graph()->zone(), 1, offset);
+  Node* offset = __ IntPtrConstant(access.offset - access.tag());
+  node->InsertInput(graph_zone(), 1, offset);
   MachineType type = access.machine_type;
   if (NeedsPoisoning(access.load_sensitivity)) {
     NodeProperties::ChangeOp(node, machine()->PoisonedLoad(type));
@@ -367,8 +355,8 @@ Reduction MemoryLowering::ReduceStoreField(Node* node,
   Node* value = node->InputAt(1);
   WriteBarrierKind write_barrier_kind = ComputeWriteBarrierKind(
       node, object, value, state, access.write_barrier_kind);
-  Node* offset = jsgraph()->IntPtrConstant(access.offset - access.tag());
-  node->InsertInput(graph()->zone(), 1, offset);
+  Node* offset = __ IntPtrConstant(access.offset - access.tag());
+  node->InsertInput(graph_zone(), 1, offset);
   NodeProperties::ChangeOp(
       node, machine()->Store(StoreRepresentation(
                 access.machine_type.representation(), write_barrier_kind)));
@@ -413,13 +401,7 @@ bool ValueNeedsWriteBarrier(Node* value, Isolate* isolate) {
   while (true) {
     switch (value->opcode()) {
       case IrOpcode::kBitcastWordToTaggedSigned:
-      case IrOpcode::kChangeTaggedSignedToCompressedSigned:
-      case IrOpcode::kChangeTaggedToCompressedSigned:
         return false;
-      case IrOpcode::kChangeTaggedPointerToCompressedPointer:
-      case IrOpcode::kChangeTaggedToCompressed:
-        value = NodeProperties::GetValueInput(value, 0);
-        continue;
       case IrOpcode::kHeapConstant: {
         RootIndex root_index;
         if (isolate->roots_table().IsRootHandle(HeapConstantOf(value->op()),
@@ -534,18 +516,6 @@ bool MemoryLowering::AllocationState::IsYoungGenerationAllocation() const {
   return group() && group()->IsYoungGenerationAllocation();
 }
 
-Graph* MemoryLowering::graph() const { return jsgraph()->graph(); }
-
-Isolate* MemoryLowering::isolate() const { return jsgraph()->isolate(); }
-
-CommonOperatorBuilder* MemoryLowering::common() const {
-  return jsgraph()->common();
-}
-
-MachineOperatorBuilder* MemoryLowering::machine() const {
-  return jsgraph()->machine();
-}
-
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/memory-lowering.h b/deps/v8/src/compiler/memory-lowering.h
index a1f1fc186185d8..2c9a0accdbad53 100644
--- a/deps/v8/src/compiler/memory-lowering.h
+++ b/deps/v8/src/compiler/memory-lowering.h
@@ -71,7 +71,8 @@ class MemoryLowering final : public Reducer {
       Node* node, Node* object, const char* name, Zone* temp_zone)>;
 
   MemoryLowering(
-      JSGraph* jsgraph, Zone* zone, PoisoningMitigationLevel poisoning_level,
+      JSGraph* jsgraph, Zone* zone, JSGraphAssembler* graph_assembler,
+      PoisoningMitigationLevel poisoning_level,
       AllocationFolding allocation_folding =
           AllocationFolding::kDontAllocationFolding,
       WriteBarrierAssertFailedCallback callback = [](Node*, Node*, const char*,
@@ -110,17 +111,20 @@ class MemoryLowering final : public Reducer {
   bool NeedsPoisoning(LoadSensitivity load_sensitivity) const;
 
   Graph* graph() const;
-  Isolate* isolate() const;
+  Isolate* isolate() const { return isolate_; }
   Zone* zone() const { return zone_; }
-  JSGraph* jsgraph() const { return jsgraph_; }
-  CommonOperatorBuilder* common() const;
-  MachineOperatorBuilder* machine() const;
-  GraphAssembler* gasm() { return &graph_assembler_; }
+  Zone* graph_zone() const { return graph_zone_; }
+  CommonOperatorBuilder* common() const { return common_; }
+  MachineOperatorBuilder* machine() const { return machine_; }
+  JSGraphAssembler* gasm() const { return graph_assembler_; }
 
   SetOncePointer<const Operator> allocate_operator_;
-  JSGraph* const jsgraph_;
+  Isolate* isolate_;
   Zone* zone_;
-  GraphAssembler graph_assembler_;
+  Zone* graph_zone_;
+  CommonOperatorBuilder* common_;
+  MachineOperatorBuilder* machine_;
+  JSGraphAssembler* graph_assembler_;
   AllocationFolding allocation_folding_;
   PoisoningMitigationLevel poisoning_level_;
   WriteBarrierAssertFailedCallback write_barrier_assert_failed_;
diff --git a/deps/v8/src/compiler/memory-optimizer.cc b/deps/v8/src/compiler/memory-optimizer.cc
index 6527dfb2877f4b..c335b815aa059e 100644
--- a/deps/v8/src/compiler/memory-optimizer.cc
+++ b/deps/v8/src/compiler/memory-optimizer.cc
@@ -21,16 +21,10 @@ namespace {
 
 bool CanAllocate(const Node* node) {
   switch (node->opcode()) {
+    case IrOpcode::kAbortCSAAssert:
     case IrOpcode::kBitcastTaggedToWord:
     case IrOpcode::kBitcastWordToTagged:
-    case IrOpcode::kChangeCompressedToTagged:
-    case IrOpcode::kChangeCompressedSignedToTaggedSigned:
-    case IrOpcode::kChangeCompressedPointerToTaggedPointer:
-    case IrOpcode::kChangeTaggedToCompressed:
-    case IrOpcode::kChangeTaggedSignedToCompressedSigned:
-    case IrOpcode::kChangeTaggedPointerToCompressedPointer:
     case IrOpcode::kComment:
-    case IrOpcode::kAbortCSAAssert:
     case IrOpcode::kDebugBreak:
     case IrOpcode::kDeoptimizeIf:
     case IrOpcode::kDeoptimizeUnless:
@@ -44,6 +38,8 @@ bool CanAllocate(const Node* node) {
     case IrOpcode::kProtectedLoad:
     case IrOpcode::kProtectedStore:
     case IrOpcode::kRetain:
+    case IrOpcode::kStackPointerGreaterThan:
+    case IrOpcode::kStaticAssert:
     // TODO(tebbi): Store nodes might do a bump-pointer allocation.
     //              We should introduce a special bump-pointer store node to
     //              differentiate that.
@@ -54,9 +50,8 @@ bool CanAllocate(const Node* node) {
     case IrOpcode::kTaggedPoisonOnSpeculation:
     case IrOpcode::kUnalignedLoad:
     case IrOpcode::kUnalignedStore:
-    case IrOpcode::kUnsafePointerAdd:
     case IrOpcode::kUnreachable:
-    case IrOpcode::kStaticAssert:
+    case IrOpcode::kUnsafePointerAdd:
     case IrOpcode::kWord32AtomicAdd:
     case IrOpcode::kWord32AtomicAnd:
     case IrOpcode::kWord32AtomicCompareExchange:
@@ -184,8 +179,10 @@ MemoryOptimizer::MemoryOptimizer(
     JSGraph* jsgraph, Zone* zone, PoisoningMitigationLevel poisoning_level,
     MemoryLowering::AllocationFolding allocation_folding,
     const char* function_debug_name, TickCounter* tick_counter)
-    : memory_lowering_(jsgraph, zone, poisoning_level, allocation_folding,
-                       WriteBarrierAssertFailed, function_debug_name),
+    : graph_assembler_(jsgraph, zone),
+      memory_lowering_(jsgraph, zone, &graph_assembler_, poisoning_level,
+                       allocation_folding, WriteBarrierAssertFailed,
+                       function_debug_name),
       jsgraph_(jsgraph),
       empty_state_(AllocationState::Empty(zone)),
       pending_(zone),
@@ -242,21 +239,6 @@ void MemoryOptimizer::VisitNode(Node* node, AllocationState const* state) {
 
 bool MemoryOptimizer::AllocationTypeNeedsUpdateToOld(Node* const node,
                                                      const Edge edge) {
-  if (COMPRESS_POINTERS_BOOL && IrOpcode::IsCompressOpcode(node->opcode())) {
-    // In Pointer Compression we might have a Compress node between an
-    // AllocateRaw and the value used as input. This case is trickier since we
-    // have to check all of the Compress node edges to test for a StoreField.
-    for (Edge const new_edge : node->use_edges()) {
-      if (AllocationTypeNeedsUpdateToOld(new_edge.from(), new_edge)) {
-        return true;
-      }
-    }
-
-    // If we arrived here, we tested all the edges of the Compress node and
-    // didn't find it necessary to update the AllocationType.
-    return false;
-  }
-
   // Test to see if we need to update the AllocationType.
   if (node->opcode() == IrOpcode::kStoreField && edge.index() == 1) {
     Node* parent = node->InputAt(0);
@@ -284,14 +266,6 @@ void MemoryOptimizer::VisitAllocateRaw(Node* node,
       Node* const user = edge.from();
       if (user->opcode() == IrOpcode::kStoreField && edge.index() == 0) {
         Node* child = user->InputAt(1);
-        // In Pointer Compression we might have a Compress node between an
-        // AllocateRaw and the value used as input. If so, we need to update
-        // child to point to the StoreField.
-        if (COMPRESS_POINTERS_BOOL &&
-            IrOpcode::IsCompressOpcode(child->opcode())) {
-          child = child->InputAt(0);
-        }
-
         if (child->opcode() == IrOpcode::kAllocateRaw &&
             AllocationTypeOf(child->op()) == AllocationType::kYoung) {
           NodeProperties::ChangeOp(child, node->op());
@@ -310,8 +284,17 @@ void MemoryOptimizer::VisitAllocateRaw(Node* node,
     }
   }
 
-  memory_lowering()->ReduceAllocateRaw(
+  Reduction reduction = memory_lowering()->ReduceAllocateRaw(
       node, allocation_type, allocation.allow_large_objects(), &state);
+  CHECK(reduction.Changed() && reduction.replacement() != node);
+
+  // Replace all uses of node and kill the node to make sure we don't leave
+  // dangling dead uses.
+  NodeProperties::ReplaceUses(node, reduction.replacement(),
+                              graph_assembler_.effect(),
+                              graph_assembler_.control());
+  node->Kill();
+
   EnqueueUses(state->effect(), state);
 }
 
diff --git a/deps/v8/src/compiler/memory-optimizer.h b/deps/v8/src/compiler/memory-optimizer.h
index 0e0fc5684c09b3..0f85fea1910b93 100644
--- a/deps/v8/src/compiler/memory-optimizer.h
+++ b/deps/v8/src/compiler/memory-optimizer.h
@@ -5,6 +5,7 @@
 #ifndef V8_COMPILER_MEMORY_OPTIMIZER_H_
 #define V8_COMPILER_MEMORY_OPTIMIZER_H_
 
+#include "src/compiler/graph-assembler.h"
 #include "src/compiler/memory-lowering.h"
 #include "src/zone/zone-containers.h"
 
@@ -78,6 +79,7 @@ class MemoryOptimizer final {
   JSGraph* jsgraph() const { return jsgraph_; }
   Zone* zone() const { return zone_; }
 
+  JSGraphAssembler graph_assembler_;
   MemoryLowering memory_lowering_;
   JSGraph* jsgraph_;
   AllocationState const* const empty_state_;
diff --git a/deps/v8/src/compiler/node-properties.cc b/deps/v8/src/compiler/node-properties.cc
index 7ba3a59f6f98d5..ab4ced69ab60d6 100644
--- a/deps/v8/src/compiler/node-properties.cc
+++ b/deps/v8/src/compiler/node-properties.cc
@@ -21,71 +21,6 @@ namespace internal {
 namespace compiler {
 
 // static
-int NodeProperties::PastValueIndex(Node* node) {
-  return FirstValueIndex(node) + node->op()->ValueInputCount();
-}
-
-
-// static
-int NodeProperties::PastContextIndex(Node* node) {
-  return FirstContextIndex(node) +
-         OperatorProperties::GetContextInputCount(node->op());
-}
-
-
-// static
-int NodeProperties::PastFrameStateIndex(Node* node) {
-  return FirstFrameStateIndex(node) +
-         OperatorProperties::GetFrameStateInputCount(node->op());
-}
-
-
-// static
-int NodeProperties::PastEffectIndex(Node* node) {
-  return FirstEffectIndex(node) + node->op()->EffectInputCount();
-}
-
-
-// static
-int NodeProperties::PastControlIndex(Node* node) {
-  return FirstControlIndex(node) + node->op()->ControlInputCount();
-}
-
-
-// static
-Node* NodeProperties::GetValueInput(Node* node, int index) {
-  DCHECK(0 <= index && index < node->op()->ValueInputCount());
-  return node->InputAt(FirstValueIndex(node) + index);
-}
-
-
-// static
-Node* NodeProperties::GetContextInput(Node* node) {
-  DCHECK(OperatorProperties::HasContextInput(node->op()));
-  return node->InputAt(FirstContextIndex(node));
-}
-
-
-// static
-Node* NodeProperties::GetFrameStateInput(Node* node) {
-  DCHECK_EQ(1, OperatorProperties::GetFrameStateInputCount(node->op()));
-  return node->InputAt(FirstFrameStateIndex(node));
-}
-
-
-// static
-Node* NodeProperties::GetEffectInput(Node* node, int index) {
-  DCHECK(0 <= index && index < node->op()->EffectInputCount());
-  return node->InputAt(FirstEffectIndex(node) + index);
-}
-
-
-// static
-Node* NodeProperties::GetControlInput(Node* node, int index) {
-  DCHECK(0 <= index && index < node->op()->ControlInputCount());
-  return node->InputAt(FirstControlIndex(node) + index);
-}
-
 
 // static
 bool NodeProperties::IsValueEdge(Edge edge) {
@@ -142,7 +77,7 @@ bool NodeProperties::IsExceptionalCall(Node* node, Node** out_exception) {
 
 // static
 Node* NodeProperties::FindSuccessfulControlProjection(Node* node) {
-  DCHECK_GT(node->op()->ControlOutputCount(), 0);
+  CHECK_GT(node->op()->ControlOutputCount(), 0);
   if (node->op()->HasProperty(Operator::kNoThrow)) return node;
   for (Edge const edge : node->use_edges()) {
     if (!NodeProperties::IsControlEdge(edge)) continue;
@@ -155,7 +90,8 @@ Node* NodeProperties::FindSuccessfulControlProjection(Node* node) {
 
 // static
 void NodeProperties::ReplaceValueInput(Node* node, Node* value, int index) {
-  DCHECK(index < node->op()->ValueInputCount());
+  CHECK_LE(0, index);
+  CHECK_LT(index, node->op()->ValueInputCount());
   node->ReplaceInput(FirstValueIndex(node) + index, value);
 }
 
@@ -163,7 +99,7 @@ void NodeProperties::ReplaceValueInput(Node* node, Node* value, int index) {
 // static
 void NodeProperties::ReplaceValueInputs(Node* node, Node* value) {
   int value_input_count = node->op()->ValueInputCount();
-  DCHECK_LE(1, value_input_count);
+  CHECK_GT(value_input_count, 0);
   node->ReplaceInput(0, value);
   while (--value_input_count > 0) {
     node->RemoveInput(value_input_count);
@@ -173,31 +109,33 @@ void NodeProperties::ReplaceValueInputs(Node* node, Node* value) {
 
 // static
 void NodeProperties::ReplaceContextInput(Node* node, Node* context) {
+  CHECK(OperatorProperties::HasContextInput(node->op()));
   node->ReplaceInput(FirstContextIndex(node), context);
 }
 
 
 // static
 void NodeProperties::ReplaceControlInput(Node* node, Node* control, int index) {
-  DCHECK(index < node->op()->ControlInputCount());
+  CHECK_LE(0, index);
+  CHECK_LT(index, node->op()->ControlInputCount());
   node->ReplaceInput(FirstControlIndex(node) + index, control);
 }
 
 
 // static
 void NodeProperties::ReplaceEffectInput(Node* node, Node* effect, int index) {
-  DCHECK(index < node->op()->EffectInputCount());
+  CHECK_LE(0, index);
+  CHECK_LT(index, node->op()->EffectInputCount());
   return node->ReplaceInput(FirstEffectIndex(node) + index, effect);
 }
 
 
 // static
 void NodeProperties::ReplaceFrameStateInput(Node* node, Node* frame_state) {
-  DCHECK_EQ(1, OperatorProperties::GetFrameStateInputCount(node->op()));
+  CHECK(OperatorProperties::HasFrameStateInput(node->op()));
   node->ReplaceInput(FirstFrameStateIndex(node), frame_state);
 }
 
-
 // static
 void NodeProperties::RemoveNonValueInputs(Node* node) {
   node->TrimInputCount(node->op()->ValueInputCount());
@@ -448,6 +386,7 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMapsUnsafe(
           // We reached the allocation of the {receiver}.
           return kNoReceiverMaps;
         }
+        result = kUnreliableReceiverMaps;  // JSCreate can have side-effect.
         break;
       }
       case IrOpcode::kJSCreatePromise: {
diff --git a/deps/v8/src/compiler/node-properties.h b/deps/v8/src/compiler/node-properties.h
index a660fe70220670..1d6e957d04523a 100644
--- a/deps/v8/src/compiler/node-properties.h
+++ b/deps/v8/src/compiler/node-properties.h
@@ -7,6 +7,7 @@
 
 #include "src/common/globals.h"
 #include "src/compiler/node.h"
+#include "src/compiler/operator-properties.h"
 #include "src/compiler/types.h"
 #include "src/objects/map.h"
 #include "src/zone/zone-handle-set.h"
@@ -32,22 +33,59 @@ class V8_EXPORT_PRIVATE NodeProperties final {
   static int FirstFrameStateIndex(Node* node) { return PastContextIndex(node); }
   static int FirstEffectIndex(Node* node) { return PastFrameStateIndex(node); }
   static int FirstControlIndex(Node* node) { return PastEffectIndex(node); }
-  static int PastValueIndex(Node* node);
-  static int PastContextIndex(Node* node);
-  static int PastFrameStateIndex(Node* node);
-  static int PastEffectIndex(Node* node);
-  static int PastControlIndex(Node* node);
 
+  static int PastValueIndex(Node* node) {
+    return FirstValueIndex(node) + node->op()->ValueInputCount();
+  }
+
+  static int PastContextIndex(Node* node) {
+    return FirstContextIndex(node) +
+           OperatorProperties::GetContextInputCount(node->op());
+  }
+
+  static int PastFrameStateIndex(Node* node) {
+    return FirstFrameStateIndex(node) +
+           OperatorProperties::GetFrameStateInputCount(node->op());
+  }
+
+  static int PastEffectIndex(Node* node) {
+    return FirstEffectIndex(node) + node->op()->EffectInputCount();
+  }
+
+  static int PastControlIndex(Node* node) {
+    return FirstControlIndex(node) + node->op()->ControlInputCount();
+  }
 
   // ---------------------------------------------------------------------------
   // Input accessors.
 
-  static Node* GetValueInput(Node* node, int index);
-  static Node* GetContextInput(Node* node);
-  static Node* GetFrameStateInput(Node* node);
-  static Node* GetEffectInput(Node* node, int index = 0);
-  static Node* GetControlInput(Node* node, int index = 0);
+  static Node* GetValueInput(Node* node, int index) {
+    CHECK_LE(0, index);
+    CHECK_LT(index, node->op()->ValueInputCount());
+    return node->InputAt(FirstValueIndex(node) + index);
+  }
 
+  static Node* GetContextInput(Node* node) {
+    CHECK(OperatorProperties::HasContextInput(node->op()));
+    return node->InputAt(FirstContextIndex(node));
+  }
+
+  static Node* GetFrameStateInput(Node* node) {
+    CHECK(OperatorProperties::HasFrameStateInput(node->op()));
+    return node->InputAt(FirstFrameStateIndex(node));
+  }
+
+  static Node* GetEffectInput(Node* node, int index = 0) {
+    CHECK_LE(0, index);
+    CHECK_LT(index, node->op()->EffectInputCount());
+    return node->InputAt(FirstEffectIndex(node) + index);
+  }
+
+  static Node* GetControlInput(Node* node, int index = 0) {
+    CHECK_LE(0, index);
+    CHECK_LT(index, node->op()->ControlInputCount());
+    return node->InputAt(FirstControlIndex(node) + index);
+  }
 
   // ---------------------------------------------------------------------------
   // Edge kinds.
@@ -58,7 +96,6 @@ class V8_EXPORT_PRIVATE NodeProperties final {
   static bool IsEffectEdge(Edge edge);
   static bool IsControlEdge(Edge edge);
 
-
   // ---------------------------------------------------------------------------
   // Miscellaneous predicates.
 
diff --git a/deps/v8/src/compiler/node.cc b/deps/v8/src/compiler/node.cc
index 525ce33c84b1ce..1bff71495cc75d 100644
--- a/deps/v8/src/compiler/node.cc
+++ b/deps/v8/src/compiler/node.cc
@@ -287,6 +287,17 @@ void Node::ReplaceUses(Node* that) {
   first_use_ = nullptr;
 }
 
+bool Node::OwnedBy(Node const* owner) const {
+  unsigned mask = 0;
+  for (Use* use = first_use_; use; use = use->next) {
+    if (use->from() == owner) {
+      mask |= 1;
+    } else {
+      return false;
+    }
+  }
+  return mask == 1;
+}
 
 bool Node::OwnedBy(Node const* owner1, Node const* owner2) const {
   unsigned mask = 0;
diff --git a/deps/v8/src/compiler/node.h b/deps/v8/src/compiler/node.h
index b4ff5f7185f0e7..41dca441f20785 100644
--- a/deps/v8/src/compiler/node.h
+++ b/deps/v8/src/compiler/node.h
@@ -63,28 +63,19 @@ class V8_EXPORT_PRIVATE Node final {
 
 #ifdef DEBUG
   void Verify();
-#define BOUNDS_CHECK(index)                                                   \
-  do {                                                                        \
-    if (index < 0 || index >= InputCount()) {                                 \
-      FATAL("Node #%d:%s->InputAt(%d) out of bounds", id(), op()->mnemonic(), \
-            index);                                                           \
-    }                                                                         \
-  } while (false)
 #else
-  // No bounds checks or verification in release mode.
   inline void Verify() {}
-#define BOUNDS_CHECK(index) \
-  do {                      \
-  } while (false)
 #endif
 
   Node* InputAt(int index) const {
-    BOUNDS_CHECK(index);
+    CHECK_LE(0, index);
+    CHECK_LT(index, InputCount());
     return *GetInputPtrConst(index);
   }
 
   void ReplaceInput(int index, Node* new_to) {
-    BOUNDS_CHECK(index);
+    CHECK_LE(0, index);
+    CHECK_LT(index, InputCount());
     Node** input_ptr = GetInputPtr(index);
     Node* old_to = *input_ptr;
     if (old_to != new_to) {
@@ -95,8 +86,6 @@ class V8_EXPORT_PRIVATE Node final {
     }
   }
 
-#undef BOUNDS_CHECK
-
   void AppendInput(Zone* zone, Node* new_to);
   void InsertInput(Zone* zone, int index, Node* new_to);
   void InsertInputs(Zone* zone, int index, int count);
@@ -150,9 +139,7 @@ class V8_EXPORT_PRIVATE Node final {
   Uses uses() { return Uses(this); }
 
   // Returns true if {owner} is the only user of {this} node.
-  bool OwnedBy(Node* owner) const {
-    return first_use_ && first_use_->from() == owner && !first_use_->next;
-  }
+  bool OwnedBy(Node const* owner) const;
 
   // Returns true if {owner1} and {owner2} are the only users of {this} node.
   bool OwnedBy(Node const* owner1, Node const* owner2) const;
@@ -200,8 +187,8 @@ class V8_EXPORT_PRIVATE Node final {
                              : reinterpret_cast<OutOfLineInputs*>(start)->node_;
     }
 
-    using InlineField = BitField<bool, 0, 1>;
-    using InputIndexField = BitField<unsigned, 1, 31>;
+    using InlineField = base::BitField<bool, 0, 1>;
+    using InputIndexField = base::BitField<unsigned, 1, 31>;
   };
 
   //============================================================================
@@ -285,9 +272,9 @@ class V8_EXPORT_PRIVATE Node final {
 
   void ClearInputs(int start, int count);
 
-  using IdField = BitField<NodeId, 0, 24>;
-  using InlineCountField = BitField<unsigned, 24, 4>;
-  using InlineCapacityField = BitField<unsigned, 28, 4>;
+  using IdField = base::BitField<NodeId, 0, 24>;
+  using InlineCountField = base::BitField<unsigned, 24, 4>;
+  using InlineCapacityField = base::BitField<unsigned, 28, 4>;
   static const int kOutlineMarker = InlineCountField::kMax;
   static const int kMaxInlineCapacity = InlineCapacityField::kMax - 1;
 
diff --git a/deps/v8/src/compiler/opcodes.h b/deps/v8/src/compiler/opcodes.h
index 76c6bfec2fee2d..7836c4425da61a 100644
--- a/deps/v8/src/compiler/opcodes.h
+++ b/deps/v8/src/compiler/opcodes.h
@@ -175,6 +175,7 @@
   V(JSGetSuperConstructor)
 
 #define JS_CONTEXT_OP_LIST(V) \
+  V(JSHasContextExtension)    \
   V(JSLoadContext)            \
   V(JSStoreContext)           \
   V(JSCreateFunctionContext)  \
@@ -233,7 +234,6 @@
 
 // Opcodes for VirtuaMachine-level operators.
 #define SIMPLIFIED_CHANGE_OP_LIST(V) \
-  V(ChangeCompressedSignedToInt32)   \
   V(ChangeTaggedSignedToInt32)       \
   V(ChangeTaggedSignedToInt64)       \
   V(ChangeTaggedToInt32)             \
@@ -241,9 +241,6 @@
   V(ChangeTaggedToUint32)            \
   V(ChangeTaggedToFloat64)           \
   V(ChangeTaggedToTaggedSigned)      \
-  V(ChangeCompressedToTaggedSigned)  \
-  V(ChangeTaggedToCompressedSigned)  \
-  V(ChangeInt31ToCompressedSigned)   \
   V(ChangeInt31ToTaggedSigned)       \
   V(ChangeInt32ToTagged)             \
   V(ChangeInt64ToTagged)             \
@@ -268,7 +265,6 @@
   V(CheckedUint32Div)                 \
   V(CheckedUint32Mod)                 \
   V(CheckedInt32Mul)                  \
-  V(CheckedInt32ToCompressedSigned)   \
   V(CheckedInt32ToTaggedSigned)       \
   V(CheckedInt64ToInt32)              \
   V(CheckedInt64ToTaggedSigned)       \
@@ -282,15 +278,12 @@
   V(CheckedFloat64ToInt64)            \
   V(CheckedTaggedSignedToInt32)       \
   V(CheckedTaggedToInt32)             \
+  V(CheckedTaggedToArrayIndex)        \
   V(CheckedTruncateTaggedToWord32)    \
   V(CheckedTaggedToFloat64)           \
   V(CheckedTaggedToInt64)             \
   V(CheckedTaggedToTaggedSigned)      \
-  V(CheckedTaggedToTaggedPointer)     \
-  V(CheckedCompressedToTaggedSigned)  \
-  V(CheckedCompressedToTaggedPointer) \
-  V(CheckedTaggedToCompressedSigned)  \
-  V(CheckedTaggedToCompressedPointer)
+  V(CheckedTaggedToTaggedPointer)
 
 #define SIMPLIFIED_COMPARE_BINOP_LIST(V) \
   V(NumberEqual)                         \
@@ -325,7 +318,9 @@
   V(NumberMin)                          \
   V(NumberPow)
 
-#define SIMPLIFIED_BIGINT_BINOP_LIST(V) V(BigIntAdd)
+#define SIMPLIFIED_BIGINT_BINOP_LIST(V) \
+  V(BigIntAdd)                          \
+  V(BigIntSubtract)
 
 #define SIMPLIFIED_SPECULATIVE_NUMBER_BINOP_LIST(V) \
   V(SpeculativeNumberAdd)                           \
@@ -482,7 +477,10 @@
   V(AssertType)                         \
   V(DateNow)
 
-#define SIMPLIFIED_SPECULATIVE_BIGINT_BINOP_LIST(V) V(SpeculativeBigIntAdd)
+#define SIMPLIFIED_SPECULATIVE_BIGINT_BINOP_LIST(V) \
+  V(SpeculativeBigIntAdd)                           \
+  V(SpeculativeBigIntSubtract)
+
 #define SIMPLIFIED_SPECULATIVE_BIGINT_UNOP_LIST(V) V(SpeculativeBigIntNegate)
 
 #define SIMPLIFIED_OP_LIST(V)                 \
@@ -650,102 +648,96 @@
   V(Word64AtomicExchange)            \
   V(Word64AtomicCompareExchange)
 
-#define MACHINE_OP_LIST(V)                  \
-  MACHINE_UNOP_32_LIST(V)                   \
-  MACHINE_BINOP_32_LIST(V)                  \
-  MACHINE_BINOP_64_LIST(V)                  \
-  MACHINE_COMPARE_BINOP_LIST(V)             \
-  MACHINE_FLOAT32_BINOP_LIST(V)             \
-  MACHINE_FLOAT32_UNOP_LIST(V)              \
-  MACHINE_FLOAT64_BINOP_LIST(V)             \
-  MACHINE_FLOAT64_UNOP_LIST(V)              \
-  MACHINE_ATOMIC_OP_LIST(V)                 \
-  V(AbortCSAAssert)                         \
-  V(DebugBreak)                             \
-  V(Comment)                                \
-  V(Load)                                   \
-  V(PoisonedLoad)                           \
-  V(Store)                                  \
-  V(StackSlot)                              \
-  V(Word32Popcnt)                           \
-  V(Word64Popcnt)                           \
-  V(Word64Clz)                              \
-  V(Word64Ctz)                              \
-  V(Word64ReverseBits)                      \
-  V(Word64ReverseBytes)                     \
-  V(Simd128ReverseBytes)                    \
-  V(Int64AbsWithOverflow)                   \
-  V(BitcastTaggedToWord)                    \
-  V(BitcastTaggedToWordForTagAndSmiBits)    \
-  V(BitcastWordToTagged)                    \
-  V(BitcastWordToTaggedSigned)              \
-  V(BitcastWord32ToCompressedSigned)        \
-  V(BitcastCompressedSignedToWord32)        \
-  V(TruncateFloat64ToWord32)                \
-  V(ChangeFloat32ToFloat64)                 \
-  V(ChangeFloat64ToInt32)                   \
-  V(ChangeFloat64ToInt64)                   \
-  V(ChangeFloat64ToUint32)                  \
-  V(ChangeFloat64ToUint64)                  \
-  V(Float64SilenceNaN)                      \
-  V(TruncateFloat64ToInt64)                 \
-  V(TruncateFloat64ToUint32)                \
-  V(TruncateFloat32ToInt32)                 \
-  V(TruncateFloat32ToUint32)                \
-  V(TryTruncateFloat32ToInt64)              \
-  V(TryTruncateFloat64ToInt64)              \
-  V(TryTruncateFloat32ToUint64)             \
-  V(TryTruncateFloat64ToUint64)             \
-  V(ChangeInt32ToFloat64)                   \
-  V(ChangeInt32ToInt64)                     \
-  V(ChangeInt64ToFloat64)                   \
-  V(ChangeUint32ToFloat64)                  \
-  V(ChangeUint32ToUint64)                   \
-  V(ChangeTaggedToCompressed)               \
-  V(ChangeTaggedPointerToCompressedPointer) \
-  V(ChangeTaggedSignedToCompressedSigned)   \
-  V(ChangeCompressedToTagged)               \
-  V(ChangeCompressedPointerToTaggedPointer) \
-  V(ChangeCompressedSignedToTaggedSigned)   \
-  V(TruncateFloat64ToFloat32)               \
-  V(TruncateInt64ToInt32)                   \
-  V(RoundFloat64ToInt32)                    \
-  V(RoundInt32ToFloat32)                    \
-  V(RoundInt64ToFloat32)                    \
-  V(RoundInt64ToFloat64)                    \
-  V(RoundUint32ToFloat32)                   \
-  V(RoundUint64ToFloat32)                   \
-  V(RoundUint64ToFloat64)                   \
-  V(BitcastFloat32ToInt32)                  \
-  V(BitcastFloat64ToInt64)                  \
-  V(BitcastInt32ToFloat32)                  \
-  V(BitcastInt64ToFloat64)                  \
-  V(Float64ExtractLowWord32)                \
-  V(Float64ExtractHighWord32)               \
-  V(Float64InsertLowWord32)                 \
-  V(Float64InsertHighWord32)                \
-  V(TaggedPoisonOnSpeculation)              \
-  V(Word32PoisonOnSpeculation)              \
-  V(Word64PoisonOnSpeculation)              \
-  V(LoadFramePointer)                       \
-  V(LoadParentFramePointer)                 \
-  V(UnalignedLoad)                          \
-  V(UnalignedStore)                         \
-  V(Int32PairAdd)                           \
-  V(Int32PairSub)                           \
-  V(Int32PairMul)                           \
-  V(Word32PairShl)                          \
-  V(Word32PairShr)                          \
-  V(Word32PairSar)                          \
-  V(ProtectedLoad)                          \
-  V(ProtectedStore)                         \
-  V(MemoryBarrier)                          \
-  V(SignExtendWord8ToInt32)                 \
-  V(SignExtendWord16ToInt32)                \
-  V(SignExtendWord8ToInt64)                 \
-  V(SignExtendWord16ToInt64)                \
-  V(SignExtendWord32ToInt64)                \
-  V(UnsafePointerAdd)                       \
+#define MACHINE_OP_LIST(V)               \
+  MACHINE_UNOP_32_LIST(V)                \
+  MACHINE_BINOP_32_LIST(V)               \
+  MACHINE_BINOP_64_LIST(V)               \
+  MACHINE_COMPARE_BINOP_LIST(V)          \
+  MACHINE_FLOAT32_BINOP_LIST(V)          \
+  MACHINE_FLOAT32_UNOP_LIST(V)           \
+  MACHINE_FLOAT64_BINOP_LIST(V)          \
+  MACHINE_FLOAT64_UNOP_LIST(V)           \
+  MACHINE_ATOMIC_OP_LIST(V)              \
+  V(AbortCSAAssert)                      \
+  V(DebugBreak)                          \
+  V(Comment)                             \
+  V(Load)                                \
+  V(PoisonedLoad)                        \
+  V(Store)                               \
+  V(StackSlot)                           \
+  V(Word32Popcnt)                        \
+  V(Word64Popcnt)                        \
+  V(Word64Clz)                           \
+  V(Word64Ctz)                           \
+  V(Word64ReverseBits)                   \
+  V(Word64ReverseBytes)                  \
+  V(Simd128ReverseBytes)                 \
+  V(Int64AbsWithOverflow)                \
+  V(BitcastTaggedToWord)                 \
+  V(BitcastTaggedToWordForTagAndSmiBits) \
+  V(BitcastWordToTagged)                 \
+  V(BitcastWordToTaggedSigned)           \
+  V(TruncateFloat64ToWord32)             \
+  V(ChangeFloat32ToFloat64)              \
+  V(ChangeFloat64ToInt32)                \
+  V(ChangeFloat64ToInt64)                \
+  V(ChangeFloat64ToUint32)               \
+  V(ChangeFloat64ToUint64)               \
+  V(Float64SilenceNaN)                   \
+  V(TruncateFloat64ToInt64)              \
+  V(TruncateFloat64ToUint32)             \
+  V(TruncateFloat32ToInt32)              \
+  V(TruncateFloat32ToUint32)             \
+  V(TryTruncateFloat32ToInt64)           \
+  V(TryTruncateFloat64ToInt64)           \
+  V(TryTruncateFloat32ToUint64)          \
+  V(TryTruncateFloat64ToUint64)          \
+  V(ChangeInt32ToFloat64)                \
+  V(BitcastWord32ToWord64)               \
+  V(ChangeInt32ToInt64)                  \
+  V(ChangeInt64ToFloat64)                \
+  V(ChangeUint32ToFloat64)               \
+  V(ChangeUint32ToUint64)                \
+  V(TruncateFloat64ToFloat32)            \
+  V(TruncateInt64ToInt32)                \
+  V(RoundFloat64ToInt32)                 \
+  V(RoundInt32ToFloat32)                 \
+  V(RoundInt64ToFloat32)                 \
+  V(RoundInt64ToFloat64)                 \
+  V(RoundUint32ToFloat32)                \
+  V(RoundUint64ToFloat32)                \
+  V(RoundUint64ToFloat64)                \
+  V(BitcastFloat32ToInt32)               \
+  V(BitcastFloat64ToInt64)               \
+  V(BitcastInt32ToFloat32)               \
+  V(BitcastInt64ToFloat64)               \
+  V(Float64ExtractLowWord32)             \
+  V(Float64ExtractHighWord32)            \
+  V(Float64InsertLowWord32)              \
+  V(Float64InsertHighWord32)             \
+  V(TaggedPoisonOnSpeculation)           \
+  V(Word32PoisonOnSpeculation)           \
+  V(Word64PoisonOnSpeculation)           \
+  V(LoadStackCheckOffset)                \
+  V(LoadFramePointer)                    \
+  V(LoadParentFramePointer)              \
+  V(UnalignedLoad)                       \
+  V(UnalignedStore)                      \
+  V(Int32PairAdd)                        \
+  V(Int32PairSub)                        \
+  V(Int32PairMul)                        \
+  V(Word32PairShl)                       \
+  V(Word32PairShr)                       \
+  V(Word32PairSar)                       \
+  V(ProtectedLoad)                       \
+  V(ProtectedStore)                      \
+  V(MemoryBarrier)                       \
+  V(SignExtendWord8ToInt32)              \
+  V(SignExtendWord16ToInt32)             \
+  V(SignExtendWord8ToInt64)              \
+  V(SignExtendWord16ToInt64)             \
+  V(SignExtendWord32ToInt64)             \
+  V(UnsafePointerAdd)                    \
   V(StackPointerGreaterThan)
 
 #define MACHINE_SIMD_OP_LIST(V) \
@@ -793,8 +785,10 @@
   V(F32x4Qfma)                  \
   V(F32x4Qfms)                  \
   V(I64x2Splat)                 \
+  V(I64x2SplatI32Pair)          \
   V(I64x2ExtractLane)           \
   V(I64x2ReplaceLane)           \
+  V(I64x2ReplaceLaneI32Pair)    \
   V(I64x2Neg)                   \
   V(I64x2Shl)                   \
   V(I64x2ShrS)                  \
@@ -844,7 +838,8 @@
   V(I32x4GtU)                   \
   V(I32x4GeU)                   \
   V(I16x8Splat)                 \
-  V(I16x8ExtractLane)           \
+  V(I16x8ExtractLaneU)          \
+  V(I16x8ExtractLaneS)          \
   V(I16x8ReplaceLane)           \
   V(I16x8SConvertI8x16Low)      \
   V(I16x8SConvertI8x16High)     \
@@ -878,8 +873,10 @@
   V(I16x8LeU)                   \
   V(I16x8GtU)                   \
   V(I16x8GeU)                   \
+  V(I16x8RoundingAverageU)      \
   V(I8x16Splat)                 \
-  V(I8x16ExtractLane)           \
+  V(I8x16ExtractLaneU)          \
+  V(I8x16ExtractLaneS)          \
   V(I8x16ReplaceLane)           \
   V(I8x16SConvertI16x8)         \
   V(I8x16Neg)                   \
@@ -908,6 +905,7 @@
   V(I8x16LeU)                   \
   V(I8x16GtU)                   \
   V(I8x16GeU)                   \
+  V(I8x16RoundingAverageU)      \
   V(S128Load)                   \
   V(S128Store)                  \
   V(S128Zero)                   \
@@ -916,6 +914,7 @@
   V(S128Or)                     \
   V(S128Xor)                    \
   V(S128Select)                 \
+  V(S128AndNot)                 \
   V(S8x16Swizzle)               \
   V(S8x16Shuffle)               \
   V(S1x2AnyTrue)                \
@@ -925,7 +924,8 @@
   V(S1x8AnyTrue)                \
   V(S1x8AllTrue)                \
   V(S1x16AnyTrue)               \
-  V(S1x16AllTrue)
+  V(S1x16AllTrue)               \
+  V(LoadTransform)
 
 #define VALUE_OP_LIST(V)  \
   COMMON_OP_LIST(V)       \
@@ -1011,18 +1011,6 @@ class V8_EXPORT_PRIVATE IrOpcode {
            (kWord32Equal <= value && value <= kFloat64LessThanOrEqual);
   }
 
-  // Returns true if opcode for decompress operator.
-  static bool IsDecompressOpcode(Value value) {
-    return kChangeCompressedToTagged <= value &&
-           value <= kChangeCompressedSignedToTaggedSigned;
-  }
-
-  // Returns true if opcode for compress operator.
-  static bool IsCompressOpcode(Value value) {
-    return kChangeTaggedToCompressed <= value &&
-           value <= kChangeTaggedSignedToCompressedSigned;
-  }
-
   static bool IsContextChainExtendingOpcode(Value value) {
     return kJSCreateFunctionContext <= value && value <= kJSCreateBlockContext;
   }
diff --git a/deps/v8/src/compiler/operation-typer.cc b/deps/v8/src/compiler/operation-typer.cc
index 8cb991ceb73c5c..3745d1021431cc 100644
--- a/deps/v8/src/compiler/operation-typer.cc
+++ b/deps/v8/src/compiler/operation-typer.cc
@@ -1125,6 +1125,11 @@ Type OperationTyper::BigIntAdd(Type lhs, Type rhs) {
   return Type::BigInt();
 }
 
+Type OperationTyper::BigIntSubtract(Type lhs, Type rhs) {
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
+  return Type::BigInt();
+}
+
 Type OperationTyper::BigIntNegate(Type type) {
   if (type.IsNone()) return type;
   return Type::BigInt();
@@ -1135,6 +1140,11 @@ Type OperationTyper::SpeculativeBigIntAdd(Type lhs, Type rhs) {
   return Type::BigInt();
 }
 
+Type OperationTyper::SpeculativeBigIntSubtract(Type lhs, Type rhs) {
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
+  return Type::BigInt();
+}
+
 Type OperationTyper::SpeculativeBigIntNegate(Type type) {
   if (type.IsNone()) return type;
   return Type::BigInt();
@@ -1250,6 +1260,9 @@ Type OperationTyper::CheckBounds(Type index, Type length) {
   if (index.Maybe(Type::MinusZero())) {
     index = Type::Union(index, cache_->kSingletonZero, zone());
   }
+  if (index.Maybe(Type::String())) {
+    index = Type::Union(index, cache_->kIntPtr, zone());
+  }
   return Type::Intersect(index, mask, zone());
 }
 
diff --git a/deps/v8/src/compiler/operator-properties.cc b/deps/v8/src/compiler/operator-properties.cc
index 731a6c8496c985..6b2fb8bf5792c9 100644
--- a/deps/v8/src/compiler/operator-properties.cc
+++ b/deps/v8/src/compiler/operator-properties.cc
@@ -76,6 +76,7 @@ bool OperatorProperties::NeedsExactContext(const Operator* op) {
     case IrOpcode::kJSDeleteProperty:
     case IrOpcode::kJSGeneratorStore:
     case IrOpcode::kJSHasProperty:
+    case IrOpcode::kJSHasContextExtension:
     case IrOpcode::kJSLoadContext:
     case IrOpcode::kJSLoadModule:
     case IrOpcode::kJSLoadNamed:
diff --git a/deps/v8/src/compiler/pipeline.cc b/deps/v8/src/compiler/pipeline.cc
index b9648d91955a08..e7285f00749cfd 100644
--- a/deps/v8/src/compiler/pipeline.cc
+++ b/deps/v8/src/compiler/pipeline.cc
@@ -36,7 +36,7 @@
 #include "src/compiler/control-flow-optimizer.h"
 #include "src/compiler/csa-load-elimination.h"
 #include "src/compiler/dead-code-elimination.h"
-#include "src/compiler/decompression-elimination.h"
+#include "src/compiler/decompression-optimizer.h"
 #include "src/compiler/effect-control-linearizer.h"
 #include "src/compiler/escape-analysis-reducer.h"
 #include "src/compiler/escape-analysis.h"
@@ -64,6 +64,7 @@
 #include "src/compiler/pipeline-statistics.h"
 #include "src/compiler/redundancy-elimination.h"
 #include "src/compiler/schedule.h"
+#include "src/compiler/scheduled-machine-lowering.h"
 #include "src/compiler/scheduler.h"
 #include "src/compiler/select-lowering.h"
 #include "src/compiler/serializer-for-background-compilation.h"
@@ -82,6 +83,7 @@
 #include "src/diagnostics/disassembler.h"
 #include "src/execution/isolate-inl.h"
 #include "src/init/bootstrapper.h"
+#include "src/logging/counters.h"
 #include "src/objects/shared-function-info.h"
 #include "src/parsing/parse-info.h"
 #include "src/tracing/trace-event.h"
@@ -130,7 +132,8 @@ class PipelineData {
   // For main entry point.
   PipelineData(ZoneStats* zone_stats, Isolate* isolate,
                OptimizedCompilationInfo* info,
-               PipelineStatistics* pipeline_statistics)
+               PipelineStatistics* pipeline_statistics,
+               bool is_concurrent_inlining)
       : isolate_(isolate),
         allocator_(isolate->allocator()),
         info_(info),
@@ -148,7 +151,8 @@ class PipelineData {
         codegen_zone_scope_(zone_stats_, kCodegenZoneName),
         codegen_zone_(codegen_zone_scope_.zone()),
         broker_(new JSHeapBroker(isolate_, info_->zone(),
-                                 info_->trace_heap_broker_enabled())),
+                                 info_->trace_heap_broker_enabled(),
+                                 is_concurrent_inlining)),
         register_allocation_zone_scope_(zone_stats_,
                                         kRegisterAllocationZoneName),
         register_allocation_zone_(register_allocation_zone_scope_.zone()),
@@ -207,10 +211,12 @@ class PipelineData {
   // For CodeStubAssembler and machine graph testing entry point.
   PipelineData(ZoneStats* zone_stats, OptimizedCompilationInfo* info,
                Isolate* isolate, AccountingAllocator* allocator, Graph* graph,
-               Schedule* schedule, SourcePositionTable* source_positions,
+               JSGraph* jsgraph, Schedule* schedule,
+               SourcePositionTable* source_positions,
                NodeOriginTable* node_origins, JumpOptimizationInfo* jump_opt,
                const AssemblerOptions& assembler_options)
       : isolate_(isolate),
+        wasm_engine_(isolate_->wasm_engine()),
         allocator_(allocator),
         info_(info),
         debug_name_(info_->GetDebugName()),
@@ -230,15 +236,23 @@ class PipelineData {
         register_allocation_zone_(register_allocation_zone_scope_.zone()),
         jump_optimization_info_(jump_opt),
         assembler_options_(assembler_options) {
-    simplified_ = new (graph_zone_) SimplifiedOperatorBuilder(graph_zone_);
-    machine_ = new (graph_zone_) MachineOperatorBuilder(
-        graph_zone_, MachineType::PointerRepresentation(),
-        InstructionSelector::SupportedMachineOperatorFlags(),
-        InstructionSelector::AlignmentRequirements());
-    common_ = new (graph_zone_) CommonOperatorBuilder(graph_zone_);
-    javascript_ = new (graph_zone_) JSOperatorBuilder(graph_zone_);
-    jsgraph_ = new (graph_zone_)
-        JSGraph(isolate_, graph_, common_, javascript_, simplified_, machine_);
+    if (jsgraph) {
+      jsgraph_ = jsgraph;
+      simplified_ = jsgraph->simplified();
+      machine_ = jsgraph->machine();
+      common_ = jsgraph->common();
+      javascript_ = jsgraph->javascript();
+    } else {
+      simplified_ = new (graph_zone_) SimplifiedOperatorBuilder(graph_zone_);
+      machine_ = new (graph_zone_) MachineOperatorBuilder(
+          graph_zone_, MachineType::PointerRepresentation(),
+          InstructionSelector::SupportedMachineOperatorFlags(),
+          InstructionSelector::AlignmentRequirements());
+      common_ = new (graph_zone_) CommonOperatorBuilder(graph_zone_);
+      javascript_ = new (graph_zone_) JSOperatorBuilder(graph_zone_);
+      jsgraph_ = new (graph_zone_) JSGraph(isolate_, graph_, common_,
+                                           javascript_, simplified_, machine_);
+    }
   }
 
   // For register allocation testing entry point.
@@ -375,6 +389,12 @@ class PipelineData {
   size_t max_unoptimized_frame_height() const {
     return max_unoptimized_frame_height_;
   }
+  size_t* address_of_max_pushed_argument_count() {
+    return &max_pushed_argument_count_;
+  }
+  size_t max_pushed_argument_count() const {
+    return max_pushed_argument_count_;
+  }
 
   CodeTracer* GetCodeTracer() const {
     return wasm_engine_ == nullptr ? isolate_->GetCodeTracer()
@@ -491,7 +511,7 @@ class PipelineData {
         osr_helper_, start_source_position_, jump_optimization_info_,
         info()->GetPoisoningMitigationLevel(), assembler_options_,
         info_->builtin_index(), max_unoptimized_frame_height(),
-        std::move(buffer));
+        max_pushed_argument_count(), std::move(buffer));
   }
 
   void BeginPhaseKind(const char* phase_kind_name) {
@@ -512,6 +532,16 @@ class PipelineData {
     return roots_relative_addressing_enabled_;
   }
 
+  // RuntimeCallStats that is only available during job execution but not
+  // finalization.
+  // TODO(delphick): Currently even during execution this can be nullptr, due to
+  // JSToWasmWrapperCompilationUnit::Execute. Once a table can be extracted
+  // there, this method can DCHECK that it is never nullptr.
+  RuntimeCallStats* runtime_call_stats() const { return runtime_call_stats_; }
+  void set_runtime_call_stats(RuntimeCallStats* stats) {
+    runtime_call_stats_ = stats;
+  }
+
  private:
   Isolate* const isolate_;
   wasm::WasmEngine* const wasm_engine_ = nullptr;
@@ -580,9 +610,12 @@ class PipelineData {
   Maybe<OuterContext> specialization_context_ = Nothing<OuterContext>();
 
   // The maximal combined height of all inlined frames in their unoptimized
-  // state. Calculated during instruction selection, applied during code
-  // generation.
+  // state, and the maximal number of arguments pushed during function calls.
+  // Calculated during instruction selection, applied during code generation.
   size_t max_unoptimized_frame_height_ = 0;
+  size_t max_pushed_argument_count_ = 0;
+
+  RuntimeCallStats* runtime_call_stats_ = nullptr;
 
   DISALLOW_COPY_AND_ASSIGN(PipelineData);
 };
@@ -760,8 +793,8 @@ void PrintCode(Isolate* isolate, Handle<Code> code,
 #endif  // ENABLE_DISASSEMBLER
 }
 
-void TraceSchedule(OptimizedCompilationInfo* info, PipelineData* data,
-                   Schedule* schedule, const char* phase_name) {
+void TraceScheduleAndVerify(OptimizedCompilationInfo* info, PipelineData* data,
+                            Schedule* schedule, const char* phase_name) {
   if (info->trace_turbo_json_enabled()) {
     AllowHandleDereference allow_deref;
     TurboJsonFile json_of(info, std::ios_base::app);
@@ -781,8 +814,9 @@ void TraceSchedule(OptimizedCompilationInfo* info, PipelineData* data,
     OFStream os(tracing_scope.file());
     os << "-- Schedule --------------------------------------\n" << *schedule;
   }
-}
 
+  if (FLAG_turbo_verify) ScheduleVerifier::Run(schedule);
+}
 
 class SourcePositionWrapper final : public Reducer {
  public:
@@ -849,10 +883,15 @@ void AddReducer(PipelineData* data, GraphReducer* graph_reducer,
 
 class PipelineRunScope {
  public:
-  PipelineRunScope(PipelineData* data, const char* phase_name)
+  PipelineRunScope(
+      PipelineData* data, const char* phase_name,
+      RuntimeCallCounterId runtime_call_counter_id,
+      RuntimeCallStats::CounterMode counter_mode = RuntimeCallStats::kExact)
       : phase_scope_(data->pipeline_statistics(), phase_name),
         zone_scope_(data->zone_stats(), phase_name),
-        origin_scope_(data->node_origins(), phase_name) {
+        origin_scope_(data->node_origins(), phase_name),
+        runtime_call_timer_scope(data->runtime_call_stats(),
+                                 runtime_call_counter_id, counter_mode) {
     DCHECK_NOT_NULL(phase_name);
   }
 
@@ -862,6 +901,7 @@ class PipelineRunScope {
   PhaseScope phase_scope_;
   ZoneStats::Scope zone_scope_;
   NodeOriginTable::PhaseScope origin_scope_;
+  RuntimeCallTimerScope runtime_call_timer_scope;
 };
 
 PipelineStatistics* CreatePipelineStatistics(Handle<Script> script,
@@ -938,12 +978,13 @@ class PipelineCompilationJob final : public OptimizedCompilationJob {
  public:
   PipelineCompilationJob(Isolate* isolate,
                          Handle<SharedFunctionInfo> shared_info,
-                         Handle<JSFunction> function);
+                         Handle<JSFunction> function, BailoutId osr_offset,
+                         JavaScriptFrame* osr_frame);
   ~PipelineCompilationJob() final;
 
  protected:
   Status PrepareJobImpl(Isolate* isolate) final;
-  Status ExecuteJobImpl() final;
+  Status ExecuteJobImpl(RuntimeCallStats* stats) final;
   Status FinalizeJobImpl(Isolate* isolate) final;
 
   // Registers weak object to optimized code dependencies.
@@ -963,7 +1004,8 @@ class PipelineCompilationJob final : public OptimizedCompilationJob {
 
 PipelineCompilationJob::PipelineCompilationJob(
     Isolate* isolate, Handle<SharedFunctionInfo> shared_info,
-    Handle<JSFunction> function)
+    Handle<JSFunction> function, BailoutId osr_offset,
+    JavaScriptFrame* osr_frame)
     // Note that the OptimizedCompilationInfo is not initialized at the time
     // we pass it to the CompilationJob constructor, but it is not
     // dereferenced there.
@@ -976,27 +1018,39 @@ PipelineCompilationJob::PipelineCompilationJob(
           handle(Script::cast(shared_info->script()), isolate),
           compilation_info(), function->GetIsolate(), &zone_stats_)),
       data_(&zone_stats_, function->GetIsolate(), compilation_info(),
-            pipeline_statistics_.get()),
+            pipeline_statistics_.get(),
+            FLAG_concurrent_inlining && osr_offset.IsNone()),
       pipeline_(&data_),
       linkage_(nullptr) {
-  TRACE_EVENT_WITH_FLOW1(
-      TRACE_DISABLED_BY_DEFAULT("v8.compile"), "v8.optimizingCompile.start",
-      this, TRACE_EVENT_FLAG_FLOW_OUT, "function", shared_info->TraceIDRef());
+  compilation_info_.SetOptimizingForOsr(osr_offset, osr_frame);
 }
 
-PipelineCompilationJob::~PipelineCompilationJob() {
-  TRACE_EVENT_WITH_FLOW1(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-                         "v8.optimizingCompile.end", this,
-                         TRACE_EVENT_FLAG_FLOW_IN, "compilationInfo",
-                         compilation_info()->ToTracedValue());
-}
+PipelineCompilationJob::~PipelineCompilationJob() {}
+
+namespace {
+// Ensure that the RuntimeStats table is set on the PipelineData for
+// duration of the job phase and unset immediately afterwards. Each job
+// needs to set the correct RuntimeCallStats table depending on whether it
+// is running on a background or foreground thread.
+class PipelineJobScope {
+ public:
+  PipelineJobScope(PipelineData* data, RuntimeCallStats* stats) : data_(data) {
+    data_->set_runtime_call_stats(stats);
+  }
+
+  ~PipelineJobScope() { data_->set_runtime_call_stats(nullptr); }
+
+ private:
+  PipelineData* data_;
+};
+}  // namespace
 
 PipelineCompilationJob::Status PipelineCompilationJob::PrepareJobImpl(
     Isolate* isolate) {
-  TRACE_EVENT_WITH_FLOW1(
-      TRACE_DISABLED_BY_DEFAULT("v8.compile"), "v8.optimizingCompile.prepare",
-      this, TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "function",
-      compilation_info()->shared_info()->TraceIDRef());
+  // Ensure that the RuntimeCallStats table of main thread is available for
+  // phases happening during PrepareJob.
+  PipelineJobScope scope(&data_, isolate->counters()->runtime_call_stats());
+
   if (compilation_info()->bytecode_array()->length() >
       FLAG_max_optimized_bytecode_size) {
     return AbortOptimization(BailoutReason::kFunctionTooBig);
@@ -1011,9 +1065,6 @@ PipelineCompilationJob::Status PipelineCompilationJob::PrepareJobImpl(
   if (FLAG_turbo_inlining) {
     compilation_info()->MarkAsInliningEnabled();
   }
-  if (FLAG_inline_accessors) {
-    compilation_info()->MarkAsAccessorInliningEnabled();
-  }
 
   // This is the bottleneck for computing and setting poisoning level in the
   // optimizing compiler.
@@ -1062,7 +1113,7 @@ PipelineCompilationJob::Status PipelineCompilationJob::PrepareJobImpl(
 
   pipeline_.Serialize();
 
-  if (!FLAG_concurrent_inlining) {
+  if (!data_.broker()->is_concurrent_inlining()) {
     if (!pipeline_.CreateGraph()) {
       CHECK(!isolate->has_pending_exception());
       return AbortOptimization(BailoutReason::kGraphBuildingFailed);
@@ -1072,13 +1123,12 @@ PipelineCompilationJob::Status PipelineCompilationJob::PrepareJobImpl(
   return SUCCEEDED;
 }
 
-PipelineCompilationJob::Status PipelineCompilationJob::ExecuteJobImpl() {
-  TRACE_EVENT_WITH_FLOW1(
-      TRACE_DISABLED_BY_DEFAULT("v8.compile"), "v8.optimizingCompile.execute",
-      this, TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "function",
-      compilation_info()->shared_info()->TraceIDRef());
-
-  if (FLAG_concurrent_inlining) {
+PipelineCompilationJob::Status PipelineCompilationJob::ExecuteJobImpl(
+    RuntimeCallStats* stats) {
+  // Ensure that the RuntimeCallStats table is only available during execution
+  // and not during finalization as that might be on a different thread.
+  PipelineJobScope scope(&data_, stats);
+  if (data_.broker()->is_concurrent_inlining()) {
     if (!pipeline_.CreateGraph()) {
       return AbortOptimization(BailoutReason::kGraphBuildingFailed);
     }
@@ -1093,15 +1143,17 @@ PipelineCompilationJob::Status PipelineCompilationJob::ExecuteJobImpl() {
   if (!success) return FAILED;
 
   pipeline_.AssembleCode(linkage_);
+
   return SUCCEEDED;
 }
 
 PipelineCompilationJob::Status PipelineCompilationJob::FinalizeJobImpl(
     Isolate* isolate) {
-  TRACE_EVENT_WITH_FLOW1(
-      TRACE_DISABLED_BY_DEFAULT("v8.compile"), "v8.optimizingCompile.finalize",
-      this, TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "function",
-      compilation_info()->shared_info()->TraceIDRef());
+  // Ensure that the RuntimeCallStats table of main thread is available for
+  // phases happening during PrepareJob.
+  PipelineJobScope scope(&data_, isolate->counters()->runtime_call_stats());
+  RuntimeCallTimerScope runtimeTimer(
+      isolate, RuntimeCallCounterId::kOptimizeFinalizePipelineJob);
   MaybeHandle<Code> maybe_code = pipeline_.FinalizeCode();
   Handle<Code> code;
   if (!maybe_code.ToHandle(&code)) {
@@ -1165,14 +1217,14 @@ class WasmHeapStubCompilationJob final : public OptimizedCompilationJob {
         zone_(std::move(zone)),
         graph_(graph),
         data_(&zone_stats_, &info_, isolate, wasm_engine->allocator(), graph_,
-              nullptr, source_positions,
+              nullptr, nullptr, source_positions,
               new (zone_.get()) NodeOriginTable(graph_), nullptr, options),
         pipeline_(&data_),
         wasm_engine_(wasm_engine) {}
 
  protected:
   Status PrepareJobImpl(Isolate* isolate) final;
-  Status ExecuteJobImpl() final;
+  Status ExecuteJobImpl(RuntimeCallStats* stats) final;
   Status FinalizeJobImpl(Isolate* isolate) final;
 
  private:
@@ -1206,7 +1258,8 @@ CompilationJob::Status WasmHeapStubCompilationJob::PrepareJobImpl(
   UNREACHABLE();
 }
 
-CompilationJob::Status WasmHeapStubCompilationJob::ExecuteJobImpl() {
+CompilationJob::Status WasmHeapStubCompilationJob::ExecuteJobImpl(
+    RuntimeCallStats* stats) {
   std::unique_ptr<PipelineStatistics> pipeline_statistics;
   if (FLAG_turbo_stats || FLAG_turbo_stats_nvp) {
     pipeline_statistics.reset(new PipelineStatistics(
@@ -1262,13 +1315,26 @@ CompilationJob::Status WasmHeapStubCompilationJob::FinalizeJobImpl(
 
 template <typename Phase, typename... Args>
 void PipelineImpl::Run(Args&&... args) {
-  PipelineRunScope scope(this->data_, Phase::phase_name());
+  PipelineRunScope scope(this->data_, Phase::phase_name(),
+                         Phase::kRuntimeCallCounterId, Phase::kCounterMode);
   Phase phase;
   phase.Run(this->data_, scope.zone(), std::forward<Args>(args)...);
 }
 
+#define DECL_PIPELINE_PHASE_CONSTANTS_HELPER(Name, Mode)        \
+  static const char* phase_name() { return "V8.TF" #Name; }     \
+  static constexpr RuntimeCallCounterId kRuntimeCallCounterId = \
+      RuntimeCallCounterId::kOptimize##Name;                    \
+  static constexpr RuntimeCallStats::CounterMode kCounterMode = Mode;
+
+#define DECL_PIPELINE_PHASE_CONSTANTS(Name) \
+  DECL_PIPELINE_PHASE_CONSTANTS_HELPER(Name, RuntimeCallStats::kThreadSpecific)
+
+#define DECL_MAIN_THREAD_PIPELINE_PHASE_CONSTANTS(Name) \
+  DECL_PIPELINE_PHASE_CONSTANTS_HELPER(Name, RuntimeCallStats::kExact)
+
 struct GraphBuilderPhase {
-  static const char* phase_name() { return "V8.TFBytecodeGraphBuilder"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(BytecodeGraphBuilder)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     BytecodeGraphBuilderFlags flags;
@@ -1290,7 +1356,7 @@ struct GraphBuilderPhase {
 };
 
 struct InliningPhase {
-  static const char* phase_name() { return "V8.TFInlining"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(Inlining)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     OptimizedCompilationInfo* info = data->info();
@@ -1302,10 +1368,12 @@ struct InliningPhase {
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
                                          data->broker(), data->common(),
                                          data->machine(), temp_zone);
+    JSCallReducer::Flags call_reducer_flags = JSCallReducer::kNoFlags;
+    if (data->info()->is_bailout_on_uninitialized()) {
+      call_reducer_flags |= JSCallReducer::kBailoutOnUninitialized;
+    }
     JSCallReducer call_reducer(&graph_reducer, data->jsgraph(), data->broker(),
-                               data->info()->is_bailout_on_uninitialized()
-                                   ? JSCallReducer::kBailoutOnUninitialized
-                                   : JSCallReducer::kNoFlags,
+                               temp_zone, call_reducer_flags,
                                data->dependencies());
     JSContextSpecialization context_specialization(
         &graph_reducer, data->jsgraph(), data->broker(),
@@ -1315,9 +1383,6 @@ struct InliningPhase {
             : MaybeHandle<JSFunction>());
     JSNativeContextSpecialization::Flags flags =
         JSNativeContextSpecialization::kNoFlags;
-    if (data->info()->is_accessor_inlining_enabled()) {
-      flags |= JSNativeContextSpecialization::kAccessorInliningEnabled;
-    }
     if (data->info()->is_bailout_on_uninitialized()) {
       flags |= JSNativeContextSpecialization::kBailoutOnUninitialized;
     }
@@ -1328,11 +1393,9 @@ struct InliningPhase {
         &graph_reducer, data->jsgraph(), data->broker(), flags,
         data->dependencies(), temp_zone, info->zone());
     JSInliningHeuristic inlining(&graph_reducer,
-                                 data->info()->is_inlining_enabled()
-                                     ? JSInliningHeuristic::kGeneralInlining
-                                     : JSInliningHeuristic::kRestrictedInlining,
                                  temp_zone, data->info(), data->jsgraph(),
                                  data->broker(), data->source_positions());
+
     JSIntrinsicLowering intrinsic_lowering(&graph_reducer, data->jsgraph(),
                                            data->broker());
     AddReducer(data, &graph_reducer, &dead_code_elimination);
@@ -1342,14 +1405,16 @@ struct InliningPhase {
     AddReducer(data, &graph_reducer, &context_specialization);
     AddReducer(data, &graph_reducer, &intrinsic_lowering);
     AddReducer(data, &graph_reducer, &call_reducer);
-    AddReducer(data, &graph_reducer, &inlining);
+    if (data->info()->is_inlining_enabled()) {
+      AddReducer(data, &graph_reducer, &inlining);
+    }
     graph_reducer.ReduceGraph();
   }
 };
 
 
 struct TyperPhase {
-  static const char* phase_name() { return "V8.TFTyper"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(Typer)
 
   void Run(PipelineData* data, Zone* temp_zone, Typer* typer) {
     NodeVector roots(temp_zone);
@@ -1367,7 +1432,7 @@ struct TyperPhase {
 };
 
 struct UntyperPhase {
-  static const char* phase_name() { return "V8.TFUntyper"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(Untyper)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     class RemoveTypeReducer final : public Reducer {
@@ -1398,7 +1463,7 @@ struct UntyperPhase {
 };
 
 struct HeapBrokerInitializationPhase {
-  static const char* phase_name() { return "V8.TFHeapBrokerInitialization"; }
+  DECL_MAIN_THREAD_PIPELINE_PHASE_CONSTANTS(HeapBrokerInitialization)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     data->broker()->InitializeAndStartSerializing(data->native_context());
@@ -1406,7 +1471,7 @@ struct HeapBrokerInitializationPhase {
 };
 
 struct CopyMetadataForConcurrentCompilePhase {
-  static const char* phase_name() { return "V8.TFSerializeMetadata"; }
+  DECL_MAIN_THREAD_PIPELINE_PHASE_CONSTANTS(SerializeMetadata)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphReducer graph_reducer(temp_zone, data->graph(),
@@ -1424,7 +1489,7 @@ struct CopyMetadataForConcurrentCompilePhase {
 };
 
 struct SerializationPhase {
-  static const char* phase_name() { return "V8.TFSerialization"; }
+  DECL_MAIN_THREAD_PIPELINE_PHASE_CONSTANTS(Serialization)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     SerializerForBackgroundCompilationFlags flags;
@@ -1438,6 +1503,9 @@ struct SerializationPhase {
       flags |=
           SerializerForBackgroundCompilationFlag::kAnalyzeEnvironmentLiveness;
     }
+    if (data->info()->is_inlining_enabled()) {
+      flags |= SerializerForBackgroundCompilationFlag::kEnableTurboInlining;
+    }
     RunSerializerForBackgroundCompilation(
         data->zone_stats(), data->broker(), data->dependencies(),
         data->info()->closure(), flags, data->info()->osr_offset());
@@ -1449,7 +1517,7 @@ struct SerializationPhase {
 };
 
 struct TypedLoweringPhase {
-  static const char* phase_name() { return "V8.TFTypedLowering"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(TypedLowering)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphReducer graph_reducer(temp_zone, data->graph(),
@@ -1486,7 +1554,7 @@ struct TypedLoweringPhase {
 
 
 struct EscapeAnalysisPhase {
-  static const char* phase_name() { return "V8.TFEscapeAnalysis"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(EscapeAnalysis)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     EscapeAnalysis escape_analysis(data->jsgraph(),
@@ -1506,7 +1574,7 @@ struct EscapeAnalysisPhase {
 };
 
 struct TypeAssertionsPhase {
-  static const char* phase_name() { return "V8.TFTypeAssertions"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(TypeAssertions)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphReducer graph_reducer(temp_zone, data->graph(),
@@ -1520,7 +1588,7 @@ struct TypeAssertionsPhase {
 };
 
 struct SimplifiedLoweringPhase {
-  static const char* phase_name() { return "V8.TFSimplifiedLowering"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(SimplifiedLowering)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     SimplifiedLowering lowering(data->jsgraph(), data->broker(), temp_zone,
@@ -1532,7 +1600,7 @@ struct SimplifiedLoweringPhase {
 };
 
 struct LoopPeelingPhase {
-  static const char* phase_name() { return "V8.TFLoopPeeling"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(LoopPeeling)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphTrimmer trimmer(temp_zone, data->graph());
@@ -1549,7 +1617,7 @@ struct LoopPeelingPhase {
 };
 
 struct LoopExitEliminationPhase {
-  static const char* phase_name() { return "V8.TFLoopExitElimination"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(LoopExitElimination)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     LoopPeeler::EliminateLoopExits(data->graph(), temp_zone);
@@ -1557,7 +1625,7 @@ struct LoopExitEliminationPhase {
 };
 
 struct GenericLoweringPhase {
-  static const char* phase_name() { return "V8.TFGenericLowering"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(GenericLowering)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphReducer graph_reducer(temp_zone, data->graph(),
@@ -1571,7 +1639,7 @@ struct GenericLoweringPhase {
 };
 
 struct EarlyOptimizationPhase {
-  static const char* phase_name() { return "V8.TFEarlyOptimization"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(EarlyOptimization)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphReducer graph_reducer(temp_zone, data->graph(),
@@ -1598,7 +1666,7 @@ struct EarlyOptimizationPhase {
 };
 
 struct ControlFlowOptimizationPhase {
-  static const char* phase_name() { return "V8.TFControlFlowOptimization"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(ControlFlowOptimization)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     ControlFlowOptimizer optimizer(data->graph(), data->common(),
@@ -1609,7 +1677,7 @@ struct ControlFlowOptimizationPhase {
 };
 
 struct EffectControlLinearizationPhase {
-  static const char* phase_name() { return "V8.TFEffectLinearization"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(EffectLinearization)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     {
@@ -1628,9 +1696,8 @@ struct EffectControlLinearizationPhase {
       Schedule* schedule = Scheduler::ComputeSchedule(
           temp_zone, data->graph(), Scheduler::kTempSchedule,
           &data->info()->tick_counter());
-      if (FLAG_turbo_verify) ScheduleVerifier::Run(schedule);
-      TraceSchedule(data->info(), data, schedule,
-                    "effect linearization schedule");
+      TraceScheduleAndVerify(data->info(), data, schedule,
+                             "effect linearization schedule");
 
       MaskArrayIndexEnable mask_array_index =
           (data->info()->GetPoisoningMitigationLevel() !=
@@ -1644,7 +1711,7 @@ struct EffectControlLinearizationPhase {
       // - introduce effect phis and rewire effects to get SSA again.
       LinearizeEffectControl(data->jsgraph(), schedule, temp_zone,
                              data->source_positions(), data->node_origins(),
-                             mask_array_index);
+                             mask_array_index, MaintainSchedule::kDiscard);
     }
     {
       // The {EffectControlLinearizer} might leave {Dead} nodes behind, so we
@@ -1668,7 +1735,7 @@ struct EffectControlLinearizationPhase {
 };
 
 struct StoreStoreEliminationPhase {
-  static const char* phase_name() { return "V8.TFStoreStoreElimination"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(StoreStoreElimination)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphTrimmer trimmer(temp_zone, data->graph());
@@ -1682,7 +1749,7 @@ struct StoreStoreEliminationPhase {
 };
 
 struct LoadEliminationPhase {
-  static const char* phase_name() { return "V8.TFLoadElimination"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(LoadElimination)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphReducer graph_reducer(temp_zone, data->graph(),
@@ -1722,7 +1789,7 @@ struct LoadEliminationPhase {
 };
 
 struct MemoryOptimizationPhase {
-  static const char* phase_name() { return "V8.TFMemoryOptimization"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(MemoryOptimization)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     // The memory optimizer requires the graphs to be trimmed, so trim now.
@@ -1743,7 +1810,7 @@ struct MemoryOptimizationPhase {
 };
 
 struct LateOptimizationPhase {
-  static const char* phase_name() { return "V8.TFLateOptimization"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(LateOptimization)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphReducer graph_reducer(temp_zone, data->graph(),
@@ -1758,15 +1825,8 @@ struct LateOptimizationPhase {
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
                                          data->broker(), data->common(),
                                          data->machine(), temp_zone);
-    SelectLowering select_lowering(data->jsgraph(), temp_zone);
-    // TODO(v8:7703, solanes): go back to using #if guards once
-    // FLAG_turbo_decompression_elimination gets removed.
-    DecompressionElimination decompression_elimination(
-        &graph_reducer, data->graph(), data->machine(), data->common());
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      AddReducer(data, &graph_reducer, &decompression_elimination);
-    }
-    USE(decompression_elimination);
+    JSGraphAssembler graph_assembler(data->jsgraph(), temp_zone);
+    SelectLowering select_lowering(&graph_assembler, data->graph());
     AddReducer(data, &graph_reducer, &branch_condition_elimination);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &machine_reducer);
@@ -1778,7 +1838,7 @@ struct LateOptimizationPhase {
 };
 
 struct MachineOperatorOptimizationPhase {
-  static const char* phase_name() { return "V8.TFMachineOperatorOptimization"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(MachineOperatorOptimization)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphReducer graph_reducer(temp_zone, data->graph(),
@@ -1793,30 +1853,69 @@ struct MachineOperatorOptimizationPhase {
   }
 };
 
-struct MidTierMachineLoweringPhase {
-  static const char* phase_name() { return "V8.TFMidTierMachineLoweringPhase"; }
+struct DecompressionOptimizationPhase {
+  DECL_PIPELINE_PHASE_CONSTANTS(DecompressionOptimization)
 
   void Run(PipelineData* data, Zone* temp_zone) {
-    GraphReducer graph_reducer(temp_zone, data->graph(),
-                               &data->info()->tick_counter(),
-                               data->jsgraph()->Dead());
-    SelectLowering select_lowering(data->jsgraph(), temp_zone);
-    MemoryLowering memory_lowering(data->jsgraph(), temp_zone,
-                                   data->info()->GetPoisoningMitigationLevel());
+    if (COMPRESS_POINTERS_BOOL) {
+      DecompressionOptimizer decompression_optimizer(
+          temp_zone, data->graph(), data->common(), data->machine());
+      decompression_optimizer.Reduce();
+    }
+  }
+};
 
-    AddReducer(data, &graph_reducer, &memory_lowering);
-    AddReducer(data, &graph_reducer, &select_lowering);
-    graph_reducer.ReduceGraph();
+struct ScheduledEffectControlLinearizationPhase {
+  DECL_PIPELINE_PHASE_CONSTANTS(ScheduledEffectControlLinearization)
+
+  void Run(PipelineData* data, Zone* temp_zone) {
+    MaskArrayIndexEnable mask_array_index =
+        (data->info()->GetPoisoningMitigationLevel() !=
+         PoisoningMitigationLevel::kDontPoison)
+            ? MaskArrayIndexEnable::kMaskArrayIndex
+            : MaskArrayIndexEnable::kDoNotMaskArrayIndex;
+    // Post-pass for wiring the control/effects
+    // - connect allocating representation changes into the control&effect
+    //   chains and lower them,
+    // - get rid of the region markers,
+    // - introduce effect phis and rewire effects to get SSA again.
+    LinearizeEffectControl(data->jsgraph(), data->schedule(), temp_zone,
+                           data->source_positions(), data->node_origins(),
+                           mask_array_index, MaintainSchedule::kMaintain);
+
+    // TODO(rmcilroy) Avoid having to rebuild rpo_order on schedule each time.
+    Scheduler::ComputeSpecialRPO(temp_zone, data->schedule());
+    if (FLAG_turbo_verify) Scheduler::GenerateDominatorTree(data->schedule());
+    TraceScheduleAndVerify(data->info(), data, data->schedule(),
+                           "effect linearization schedule");
+  }
+};
+
+struct ScheduledMachineLoweringPhase {
+  DECL_PIPELINE_PHASE_CONSTANTS(ScheduledMachineLowering)
+
+  void Run(PipelineData* data, Zone* temp_zone) {
+    ScheduledMachineLowering machine_lowering(
+        data->jsgraph(), data->schedule(), temp_zone, data->source_positions(),
+        data->node_origins(), data->info()->GetPoisoningMitigationLevel());
+    machine_lowering.Run();
+
+    // TODO(rmcilroy) Avoid having to rebuild rpo_order on schedule each time.
+    Scheduler::ComputeSpecialRPO(temp_zone, data->schedule());
+    if (FLAG_turbo_verify) Scheduler::GenerateDominatorTree(data->schedule());
+    TraceScheduleAndVerify(data->info(), data, data->schedule(),
+                           "machine lowered schedule");
   }
 };
 
 struct CsaEarlyOptimizationPhase {
-  static const char* phase_name() { return "V8.CSAEarlyOptimization"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(CSAEarlyOptimization)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphReducer graph_reducer(temp_zone, data->graph(),
                                &data->info()->tick_counter(),
                                data->jsgraph()->Dead());
+    MachineOperatorReducer machine_reducer(&graph_reducer, data->jsgraph());
     BranchElimination branch_condition_elimination(&graph_reducer,
                                                    data->jsgraph(), temp_zone);
     DeadCodeElimination dead_code_elimination(&graph_reducer, data->graph(),
@@ -1827,6 +1926,7 @@ struct CsaEarlyOptimizationPhase {
     ValueNumberingReducer value_numbering(temp_zone, data->graph()->zone());
     CsaLoadElimination load_elimination(&graph_reducer, data->jsgraph(),
                                         temp_zone);
+    AddReducer(data, &graph_reducer, &machine_reducer);
     AddReducer(data, &graph_reducer, &branch_condition_elimination);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &common_reducer);
@@ -1837,7 +1937,7 @@ struct CsaEarlyOptimizationPhase {
 };
 
 struct CsaOptimizationPhase {
-  static const char* phase_name() { return "V8.CSAOptimization"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(CSAOptimization)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphReducer graph_reducer(temp_zone, data->graph(),
@@ -1851,14 +1951,6 @@ struct CsaOptimizationPhase {
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
                                          data->broker(), data->common(),
                                          data->machine(), temp_zone);
-    // TODO(v8:7703, solanes): go back to using #if guards once
-    // FLAG_turbo_decompression_elimination gets removed.
-    DecompressionElimination decompression_elimination(
-        &graph_reducer, data->graph(), data->machine(), data->common());
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      AddReducer(data, &graph_reducer, &decompression_elimination);
-    }
-    USE(decompression_elimination);
     AddReducer(data, &graph_reducer, &branch_condition_elimination);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &machine_reducer);
@@ -1868,7 +1960,8 @@ struct CsaOptimizationPhase {
 };
 
 struct EarlyGraphTrimmingPhase {
-  static const char* phase_name() { return "V8.TFEarlyTrimming"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(EarlyTrimming)
+
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphTrimmer trimmer(temp_zone, data->graph());
     NodeVector roots(temp_zone);
@@ -1879,7 +1972,8 @@ struct EarlyGraphTrimmingPhase {
 
 
 struct LateGraphTrimmingPhase {
-  static const char* phase_name() { return "V8.TFLateGraphTrimming"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(LateGraphTrimming)
+
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphTrimmer trimmer(temp_zone, data->graph());
     NodeVector roots(temp_zone);
@@ -1892,7 +1986,7 @@ struct LateGraphTrimmingPhase {
 
 
 struct ComputeSchedulePhase {
-  static const char* phase_name() { return "V8.TFScheduling"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(Scheduling)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     Schedule* schedule = Scheduler::ComputeSchedule(
@@ -1900,7 +1994,6 @@ struct ComputeSchedulePhase {
         data->info()->is_splitting_enabled() ? Scheduler::kSplitNodes
                                              : Scheduler::kNoFlags,
         &data->info()->tick_counter());
-    if (FLAG_turbo_verify) ScheduleVerifier::Run(schedule);
     data->set_schedule(schedule);
   }
 };
@@ -1938,7 +2031,7 @@ std::ostream& operator<<(std::ostream& out, const InstructionRangesAsJSON& s) {
 }
 
 struct InstructionSelectionPhase {
-  static const char* phase_name() { return "V8.TFSelectInstructions"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(SelectInstructions)
 
   void Run(PipelineData* data, Zone* temp_zone, Linkage* linkage) {
     InstructionSelector selector(
@@ -1949,6 +2042,7 @@ struct InstructionSelectionPhase {
             : InstructionSelector::kDisableSwitchJumpTable,
         &data->info()->tick_counter(),
         data->address_of_max_unoptimized_frame_height(),
+        data->address_of_max_pushed_argument_count(),
         data->info()->is_source_positions_enabled()
             ? InstructionSelector::kAllSourcePositions
             : InstructionSelector::kCallSourcePositions,
@@ -1979,8 +2073,7 @@ struct InstructionSelectionPhase {
 
 
 struct MeetRegisterConstraintsPhase {
-  static const char* phase_name() { return "V8.TFMeetRegisterConstraints"; }
-
+  DECL_PIPELINE_PHASE_CONSTANTS(MeetRegisterConstraints)
   void Run(PipelineData* data, Zone* temp_zone) {
     ConstraintBuilder builder(data->register_allocation_data());
     builder.MeetRegisterConstraints();
@@ -1989,7 +2082,7 @@ struct MeetRegisterConstraintsPhase {
 
 
 struct ResolvePhisPhase {
-  static const char* phase_name() { return "V8.TFResolvePhis"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(ResolvePhis)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     ConstraintBuilder builder(data->register_allocation_data());
@@ -1999,7 +2092,7 @@ struct ResolvePhisPhase {
 
 
 struct BuildLiveRangesPhase {
-  static const char* phase_name() { return "V8.TFBuildLiveRanges"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(BuildLiveRanges)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     LiveRangeBuilder builder(data->register_allocation_data(), temp_zone);
@@ -2008,7 +2101,7 @@ struct BuildLiveRangesPhase {
 };
 
 struct BuildBundlesPhase {
-  static const char* phase_name() { return "V8.TFBuildLiveRangeBundles"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(BuildLiveRangeBundles)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     BundleBuilder builder(data->register_allocation_data());
@@ -2017,7 +2110,7 @@ struct BuildBundlesPhase {
 };
 
 struct SplinterLiveRangesPhase {
-  static const char* phase_name() { return "V8.TFSplinterLiveRanges"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(SplinterLiveRanges)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     LiveRangeSeparator live_range_splinterer(data->register_allocation_data(),
@@ -2029,7 +2122,7 @@ struct SplinterLiveRangesPhase {
 
 template <typename RegAllocator>
 struct AllocateGeneralRegistersPhase {
-  static const char* phase_name() { return "V8.TFAllocateGeneralRegisters"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(AllocateGeneralRegisters)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     RegAllocator allocator(data->register_allocation_data(), GENERAL_REGISTERS,
@@ -2040,7 +2133,7 @@ struct AllocateGeneralRegistersPhase {
 
 template <typename RegAllocator>
 struct AllocateFPRegistersPhase {
-  static const char* phase_name() { return "V8.TFAllocateFPRegisters"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(AllocateFPRegisters)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     RegAllocator allocator(data->register_allocation_data(), FP_REGISTERS,
@@ -2051,7 +2144,8 @@ struct AllocateFPRegistersPhase {
 
 
 struct MergeSplintersPhase {
-  static const char* phase_name() { return "V8.TFMergeSplinteredRanges"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(MergeSplinteredRanges)
+
   void Run(PipelineData* pipeline_data, Zone* temp_zone) {
     RegisterAllocationData* data = pipeline_data->register_allocation_data();
     LiveRangeMerger live_range_merger(data, temp_zone);
@@ -2061,7 +2155,7 @@ struct MergeSplintersPhase {
 
 
 struct LocateSpillSlotsPhase {
-  static const char* phase_name() { return "V8.TFLocateSpillSlots"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(LocateSpillSlots)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     SpillSlotLocator locator(data->register_allocation_data());
@@ -2070,7 +2164,7 @@ struct LocateSpillSlotsPhase {
 };
 
 struct DecideSpillingModePhase {
-  static const char* phase_name() { return "V8.TFDecideSpillingMode"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(DecideSpillingMode)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     OperandAssigner assigner(data->register_allocation_data());
@@ -2079,7 +2173,7 @@ struct DecideSpillingModePhase {
 };
 
 struct AssignSpillSlotsPhase {
-  static const char* phase_name() { return "V8.TFAssignSpillSlots"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(AssignSpillSlots)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     OperandAssigner assigner(data->register_allocation_data());
@@ -2089,7 +2183,7 @@ struct AssignSpillSlotsPhase {
 
 
 struct CommitAssignmentPhase {
-  static const char* phase_name() { return "V8.TFCommitAssignment"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(CommitAssignment)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     OperandAssigner assigner(data->register_allocation_data());
@@ -2099,7 +2193,7 @@ struct CommitAssignmentPhase {
 
 
 struct PopulateReferenceMapsPhase {
-  static const char* phase_name() { return "V8.TFPopulatePointerMaps"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(PopulatePointerMaps)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     ReferenceMapPopulator populator(data->register_allocation_data());
@@ -2109,7 +2203,7 @@ struct PopulateReferenceMapsPhase {
 
 
 struct ConnectRangesPhase {
-  static const char* phase_name() { return "V8.TFConnectRanges"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(ConnectRanges)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     LiveRangeConnector connector(data->register_allocation_data());
@@ -2119,7 +2213,7 @@ struct ConnectRangesPhase {
 
 
 struct ResolveControlFlowPhase {
-  static const char* phase_name() { return "V8.TFResolveControlFlow"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(ResolveControlFlow)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     LiveRangeConnector connector(data->register_allocation_data());
@@ -2129,7 +2223,7 @@ struct ResolveControlFlowPhase {
 
 
 struct OptimizeMovesPhase {
-  static const char* phase_name() { return "V8.TFOptimizeMoves"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(OptimizeMoves)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     MoveOptimizer move_optimizer(temp_zone, data->sequence());
@@ -2139,7 +2233,7 @@ struct OptimizeMovesPhase {
 
 
 struct FrameElisionPhase {
-  static const char* phase_name() { return "V8.TFFrameElision"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(FrameElision)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     FrameElider(data->sequence()).Run();
@@ -2148,7 +2242,7 @@ struct FrameElisionPhase {
 
 
 struct JumpThreadingPhase {
-  static const char* phase_name() { return "V8.TFJumpThreading"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(JumpThreading)
 
   void Run(PipelineData* data, Zone* temp_zone, bool frame_at_start) {
     ZoneVector<RpoNumber> result(temp_zone);
@@ -2160,7 +2254,7 @@ struct JumpThreadingPhase {
 };
 
 struct AssembleCodePhase {
-  static const char* phase_name() { return "V8.TFAssembleCode"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(AssembleCode)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     data->code_generator()->AssembleCode();
@@ -2168,7 +2262,7 @@ struct AssembleCodePhase {
 };
 
 struct FinalizeCodePhase {
-  static const char* phase_name() { return "V8.TFFinalizeCode"; }
+  DECL_MAIN_THREAD_PIPELINE_PHASE_CONSTANTS(FinalizeCode)
 
   void Run(PipelineData* data, Zone* temp_zone) {
     data->set_code(data->code_generator()->FinalizeCode());
@@ -2177,7 +2271,7 @@ struct FinalizeCodePhase {
 
 
 struct PrintGraphPhase {
-  static const char* phase_name() { return "V8.TFPrintGraph"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(PrintGraph)
 
   void Run(PipelineData* data, Zone* temp_zone, const char* phase) {
     OptimizedCompilationInfo* info = data->info();
@@ -2218,7 +2312,7 @@ struct PrintGraphPhase {
 
 
 struct VerifyGraphPhase {
-  static const char* phase_name() { return "V8.TFVerifyGraph"; }
+  DECL_PIPELINE_PHASE_CONSTANTS(VerifyGraph)
 
   void Run(PipelineData* data, Zone* temp_zone, const bool untyped,
            bool values_only = false) {
@@ -2241,6 +2335,10 @@ struct VerifyGraphPhase {
   }
 };
 
+#undef DECL_MAIN_THREAD_PIPELINE_PHASE_CONSTANTS
+#undef DECL_PIPELINE_PHASE_CONSTANTS
+#undef DECL_PIPELINE_PHASE_CONSTANTS_HELPER
+
 void PipelineImpl::RunPrintAndVerify(const char* phase, bool untyped) {
   if (info()->trace_turbo_json_enabled() ||
       info()->trace_turbo_graph_enabled()) {
@@ -2275,7 +2373,7 @@ void PipelineImpl::Serialize() {
   }
 
   data->broker()->SetTargetNativeContextRef(data->native_context());
-  if (FLAG_concurrent_inlining) {
+  if (data->broker()->is_concurrent_inlining()) {
     Run<HeapBrokerInitializationPhase>();
     Run<SerializationPhase>();
     data->broker()->StopSerializing();
@@ -2315,7 +2413,7 @@ bool PipelineImpl::CreateGraph() {
 
   // Run the type-sensitive lowerings and optimizations on the graph.
   {
-    if (!FLAG_concurrent_inlining) {
+    if (!data->broker()->is_concurrent_inlining()) {
       Run<HeapBrokerInitializationPhase>();
       Run<CopyMetadataForConcurrentCompilePhase>();
       data->broker()->StopSerializing();
@@ -2424,6 +2522,9 @@ bool PipelineImpl::OptimizeGraph(Linkage* linkage) {
   Run<MachineOperatorOptimizationPhase>();
   RunPrintAndVerify(MachineOperatorOptimizationPhase::phase_name(), true);
 
+  Run<DecompressionOptimizationPhase>();
+  RunPrintAndVerify(DecompressionOptimizationPhase::phase_name(), true);
+
   data->source_positions()->RemoveDecorator();
   if (data->info()->trace_turbo_json_enabled()) {
     data->node_origins()->RemoveDecorator();
@@ -2482,25 +2583,26 @@ bool PipelineImpl::OptimizeGraphForMidTier(Linkage* linkage) {
 
   data->BeginPhaseKind("V8.TFBlockBuilding");
 
-  Run<EffectControlLinearizationPhase>();
-  RunPrintAndVerify(EffectControlLinearizationPhase::phase_name(), true);
+  ComputeScheduledGraph();
+
+  Run<ScheduledEffectControlLinearizationPhase>();
+  RunPrintAndVerify(ScheduledEffectControlLinearizationPhase::phase_name(),
+                    true);
 
-  Run<MidTierMachineLoweringPhase>();
-  RunPrintAndVerify(MidTierMachineLoweringPhase::phase_name(), true);
+  Run<ScheduledMachineLoweringPhase>();
+  RunPrintAndVerify(ScheduledMachineLoweringPhase::phase_name(), true);
 
   data->source_positions()->RemoveDecorator();
   if (data->info()->trace_turbo_json_enabled()) {
     data->node_origins()->RemoveDecorator();
   }
 
-  ComputeScheduledGraph();
-
   return SelectInstructions(linkage);
 }
 
 MaybeHandle<Code> Pipeline::GenerateCodeForCodeStub(
     Isolate* isolate, CallDescriptor* call_descriptor, Graph* graph,
-    SourcePositionTable* source_positions, Code::Kind kind,
+    JSGraph* jsgraph, SourcePositionTable* source_positions, Code::Kind kind,
     const char* debug_name, int32_t builtin_index,
     PoisoningMitigationLevel poisoning_level, const AssemblerOptions& options) {
   OptimizedCompilationInfo info(CStrVector(debug_name), graph->zone(), kind);
@@ -2517,7 +2619,7 @@ MaybeHandle<Code> Pipeline::GenerateCodeForCodeStub(
   bool should_optimize_jumps =
       isolate->serializer_enabled() && FLAG_turbo_rewrite_far_jumps;
   PipelineData data(&zone_stats, &info, isolate, isolate->allocator(), graph,
-                    nullptr, source_positions, &node_origins,
+                    jsgraph, nullptr, source_positions, &node_origins,
                     should_optimize_jumps ? &jump_opt : nullptr, options);
   data.set_verify_graph(FLAG_verify_csa);
   std::unique_ptr<PipelineStatistics> pipeline_statistics;
@@ -2555,6 +2657,10 @@ MaybeHandle<Code> Pipeline::GenerateCodeForCodeStub(
   pipeline.Run<CsaOptimizationPhase>();
   pipeline.RunPrintAndVerify(CsaOptimizationPhase::phase_name(), true);
 
+  pipeline.Run<DecompressionOptimizationPhase>();
+  pipeline.RunPrintAndVerify(DecompressionOptimizationPhase::phase_name(),
+                             true);
+
   pipeline.Run<VerifyGraphPhase>(true);
   pipeline.ComputeScheduledGraph();
   DCHECK_NOT_NULL(data.schedule());
@@ -2563,7 +2669,7 @@ MaybeHandle<Code> Pipeline::GenerateCodeForCodeStub(
   // repeat it for jump optimization. The first run has to happen on a temporary
   // pipeline to avoid deletion of zones on the main pipeline.
   PipelineData second_data(&zone_stats, &info, isolate, isolate->allocator(),
-                           data.graph(), data.schedule(),
+                           data.graph(), data.jsgraph(), data.schedule(),
                            data.source_positions(), data.node_origins(),
                            data.jump_optimization_info(), options);
   second_data.set_verify_graph(FLAG_verify_csa);
@@ -2704,7 +2810,9 @@ MaybeHandle<Code> Pipeline::GenerateCodeForTesting(
   std::unique_ptr<PipelineStatistics> pipeline_statistics(
       CreatePipelineStatistics(Handle<Script>::null(), info, isolate,
                                &zone_stats));
-  PipelineData data(&zone_stats, isolate, info, pipeline_statistics.get());
+
+  PipelineData data(&zone_stats, isolate, info, pipeline_statistics.get(),
+                    i::FLAG_concurrent_inlining);
   PipelineImpl pipeline(&data);
 
   Linkage linkage(Linkage::ComputeIncoming(data.instruction_zone(), info));
@@ -2732,7 +2840,8 @@ MaybeHandle<Code> Pipeline::GenerateCodeForTesting(
   ZoneStats zone_stats(isolate->allocator());
   NodeOriginTable* node_positions = new (info->zone()) NodeOriginTable(graph);
   PipelineData data(&zone_stats, info, isolate, isolate->allocator(), graph,
-                    schedule, nullptr, node_positions, nullptr, options);
+                    nullptr, schedule, nullptr, node_positions, nullptr,
+                    options);
   std::unique_ptr<PipelineStatistics> pipeline_statistics;
   if (FLAG_turbo_stats || FLAG_turbo_stats_nvp) {
     pipeline_statistics.reset(new PipelineStatistics(
@@ -2765,10 +2874,12 @@ MaybeHandle<Code> Pipeline::GenerateCodeForTesting(
 
 // static
 std::unique_ptr<OptimizedCompilationJob> Pipeline::NewCompilationJob(
-    Isolate* isolate, Handle<JSFunction> function, bool has_script) {
+    Isolate* isolate, Handle<JSFunction> function, bool has_script,
+    BailoutId osr_offset, JavaScriptFrame* osr_frame) {
   Handle<SharedFunctionInfo> shared =
       handle(function->shared(), function->GetIsolate());
-  return std::make_unique<PipelineCompilationJob>(isolate, shared, function);
+  return std::make_unique<PipelineCompilationJob>(isolate, shared, function,
+                                                  osr_offset, osr_frame);
 }
 
 // static
@@ -2810,7 +2921,8 @@ void Pipeline::GenerateCodeForWasmFunction(
     data.info()->MarkAsSplittingEnabled();
   }
   if (FLAG_wasm_opt || is_asm_js) {
-    PipelineRunScope scope(&data, "V8.WasmFullOptimization");
+    PipelineRunScope scope(&data, "V8.WasmFullOptimization",
+                           RuntimeCallCounterId::kOptimizeWasmFullOptimization);
     GraphReducer graph_reducer(scope.zone(), data.graph(),
                                &data.info()->tick_counter(),
                                data.mcgraph()->Dead());
@@ -2829,7 +2941,8 @@ void Pipeline::GenerateCodeForWasmFunction(
     AddReducer(&data, &graph_reducer, &value_numbering);
     graph_reducer.ReduceGraph();
   } else {
-    PipelineRunScope scope(&data, "V8.WasmBaseOptimization");
+    PipelineRunScope scope(&data, "V8.OptimizeWasmBaseOptimization",
+                           RuntimeCallCounterId::kOptimizeWasmBaseOptimization);
     GraphReducer graph_reducer(scope.zone(), data.graph(),
                                &data.info()->tick_counter(),
                                data.mcgraph()->Dead());
@@ -2917,7 +3030,7 @@ void PipelineImpl::ComputeScheduledGraph() {
   RunPrintAndVerify(LateGraphTrimmingPhase::phase_name(), true);
 
   Run<ComputeSchedulePhase>();
-  TraceSchedule(data->info(), data, data->schedule(), "schedule");
+  TraceScheduleAndVerify(data->info(), data, data->schedule(), "schedule");
 }
 
 bool PipelineImpl::SelectInstructions(Linkage* linkage) {
@@ -2933,7 +3046,11 @@ bool PipelineImpl::SelectInstructions(Linkage* linkage) {
         info(), data->graph(), data->schedule(), data->isolate()));
   }
 
-  bool verify_stub_graph = data->verify_graph();
+  bool verify_stub_graph =
+      data->verify_graph() ||
+      (FLAG_turbo_verify_machine_graph != nullptr &&
+       (!strcmp(FLAG_turbo_verify_machine_graph, "*") ||
+        !strcmp(FLAG_turbo_verify_machine_graph, data->debug_name())));
   // Jump optimization runs instruction selection twice, but the instruction
   // selector mutates nodes like swapping the inputs of a load, which can
   // violate the machine graph verification rules. So we skip the second
@@ -2942,10 +3059,7 @@ bool PipelineImpl::SelectInstructions(Linkage* linkage) {
   if (jump_opt && jump_opt->is_optimizing()) {
     verify_stub_graph = false;
   }
-  if (verify_stub_graph ||
-      (FLAG_turbo_verify_machine_graph != nullptr &&
-       (!strcmp(FLAG_turbo_verify_machine_graph, "*") ||
-        !strcmp(FLAG_turbo_verify_machine_graph, data->debug_name())))) {
+  if (verify_stub_graph) {
     if (FLAG_trace_verify_csa) {
       AllowHandleDereference allow_deref;
       CodeTracer::Scope tracing_scope(data->GetCodeTracer());
@@ -3245,7 +3359,7 @@ void PipelineImpl::AllocateRegisters(const RegisterConfiguration* config,
     verifier_zone.reset(
         new Zone(data->allocator(), kRegisterAllocatorVerifierZoneName));
     verifier = new (verifier_zone.get()) RegisterAllocatorVerifier(
-        verifier_zone.get(), config, data->sequence());
+        verifier_zone.get(), config, data->sequence(), data->frame());
   }
 
 #ifdef DEBUG
diff --git a/deps/v8/src/compiler/pipeline.h b/deps/v8/src/compiler/pipeline.h
index 42f31472a9be36..d0b3d98b0b02fa 100644
--- a/deps/v8/src/compiler/pipeline.h
+++ b/deps/v8/src/compiler/pipeline.h
@@ -34,6 +34,7 @@ namespace compiler {
 class CallDescriptor;
 class Graph;
 class InstructionSequence;
+class JSGraph;
 class JSHeapBroker;
 class MachineGraph;
 class NodeOriginTable;
@@ -44,7 +45,9 @@ class Pipeline : public AllStatic {
  public:
   // Returns a new compilation job for the given JavaScript function.
   static std::unique_ptr<OptimizedCompilationJob> NewCompilationJob(
-      Isolate* isolate, Handle<JSFunction> function, bool has_script);
+      Isolate* isolate, Handle<JSFunction> function, bool has_script,
+      BailoutId osr_offset = BailoutId::None(),
+      JavaScriptFrame* osr_frame = nullptr);
 
   // Run the pipeline for the WebAssembly compilation info.
   static void GenerateCodeForWasmFunction(
@@ -72,7 +75,7 @@ class Pipeline : public AllStatic {
   // Run the pipeline on a machine graph and generate code.
   static MaybeHandle<Code> GenerateCodeForCodeStub(
       Isolate* isolate, CallDescriptor* call_descriptor, Graph* graph,
-      SourcePositionTable* source_positions, Code::Kind kind,
+      JSGraph* jsgraph, SourcePositionTable* source_positions, Code::Kind kind,
       const char* debug_name, int32_t builtin_index,
       PoisoningMitigationLevel poisoning_level,
       const AssemblerOptions& options);
diff --git a/deps/v8/src/compiler/property-access-builder.cc b/deps/v8/src/compiler/property-access-builder.cc
index 6c33ae227fdc00..4ad52c32059ac3 100644
--- a/deps/v8/src/compiler/property-access-builder.cc
+++ b/deps/v8/src/compiler/property-access-builder.cc
@@ -136,13 +136,13 @@ MachineRepresentation PropertyAccessBuilder::ConvertRepresentation(
     Representation representation) {
   switch (representation.kind()) {
     case Representation::kSmi:
-      return MachineType::RepCompressedTaggedSigned();
+      return MachineRepresentation::kTaggedSigned;
     case Representation::kDouble:
       return MachineRepresentation::kFloat64;
     case Representation::kHeapObject:
-      return MachineType::RepCompressedTaggedPointer();
+      return MachineRepresentation::kTaggedPointer;
     case Representation::kTagged:
-      return MachineType::RepCompressedTagged();
+      return MachineRepresentation::kTagged;
     default:
       UNREACHABLE();
   }
@@ -215,16 +215,15 @@ Node* PropertyAccessBuilder::BuildLoadDataField(
       access_info.GetConstFieldInfo()};
   if (field_representation == MachineRepresentation::kFloat64) {
     if (!field_index.is_inobject() || !FLAG_unbox_double_fields) {
-      FieldAccess const storage_access = {
-          kTaggedBase,
-          field_index.offset(),
-          name.object(),
-          MaybeHandle<Map>(),
-          Type::OtherInternal(),
-          MachineType::TypeCompressedTaggedPointer(),
-          kPointerWriteBarrier,
-          LoadSensitivity::kCritical,
-          access_info.GetConstFieldInfo()};
+      FieldAccess const storage_access = {kTaggedBase,
+                                          field_index.offset(),
+                                          name.object(),
+                                          MaybeHandle<Map>(),
+                                          Type::OtherInternal(),
+                                          MachineType::TaggedPointer(),
+                                          kPointerWriteBarrier,
+                                          LoadSensitivity::kCritical,
+                                          access_info.GetConstFieldInfo()};
       storage = *effect = graph()->NewNode(
           simplified()->LoadField(storage_access), storage, *effect, *control);
       field_access.offset = HeapNumber::kValueOffset;
diff --git a/deps/v8/src/compiler/raw-machine-assembler.cc b/deps/v8/src/compiler/raw-machine-assembler.cc
index 7031437cc20bd7..2bc2e400b12127 100644
--- a/deps/v8/src/compiler/raw-machine-assembler.cc
+++ b/deps/v8/src/compiler/raw-machine-assembler.cc
@@ -702,25 +702,26 @@ void RawMachineAssembler::TailCallN(CallDescriptor* call_descriptor,
 
 namespace {
 
+enum FunctionDescriptorMode { kHasFunctionDescriptor, kNoFunctionDescriptor };
+
 Node* CallCFunctionImpl(
     RawMachineAssembler* rasm, Node* function, MachineType return_type,
     std::initializer_list<RawMachineAssembler::CFunctionArg> args,
     bool caller_saved_regs, SaveFPRegsMode mode,
-    bool has_function_descriptor = kHasFunctionDescriptor) {
+    FunctionDescriptorMode no_function_descriptor) {
   static constexpr std::size_t kNumCArgs = 10;
 
   MachineSignature::Builder builder(rasm->zone(), 1, args.size());
   builder.AddReturn(return_type);
   for (const auto& arg : args) builder.AddParam(arg.first);
 
-  auto call_descriptor = Linkage::GetSimplifiedCDescriptor(
-      rasm->zone(), builder.Build(),
-      caller_saved_regs ? CallDescriptor::kCallerSavedRegisters
-                        : CallDescriptor::kNoFlags);
-
-  if (caller_saved_regs) call_descriptor->set_save_fp_mode(mode);
-
-  call_descriptor->set_has_function_descriptor(has_function_descriptor);
+  bool caller_saved_fp_regs = caller_saved_regs && (mode == kSaveFPRegs);
+  CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
+  if (caller_saved_regs) flags |= CallDescriptor::kCallerSavedRegisters;
+  if (caller_saved_fp_regs) flags |= CallDescriptor::kCallerSavedFPRegisters;
+  if (no_function_descriptor) flags |= CallDescriptor::kNoFunctionDescriptor;
+  auto call_descriptor =
+      Linkage::GetSimplifiedCDescriptor(rasm->zone(), builder.Build(), flags);
 
   base::SmallVector<Node*, kNumCArgs> nodes(args.size() + 1);
   nodes[0] = function;
@@ -739,7 +740,7 @@ Node* RawMachineAssembler::CallCFunction(
     Node* function, MachineType return_type,
     std::initializer_list<RawMachineAssembler::CFunctionArg> args) {
   return CallCFunctionImpl(this, function, return_type, args, false,
-                           kDontSaveFPRegs);
+                           kDontSaveFPRegs, kHasFunctionDescriptor);
 }
 
 Node* RawMachineAssembler::CallCFunctionWithoutFunctionDescriptor(
@@ -752,7 +753,8 @@ Node* RawMachineAssembler::CallCFunctionWithoutFunctionDescriptor(
 Node* RawMachineAssembler::CallCFunctionWithCallerSavedRegisters(
     Node* function, MachineType return_type, SaveFPRegsMode mode,
     std::initializer_list<RawMachineAssembler::CFunctionArg> args) {
-  return CallCFunctionImpl(this, function, return_type, args, true, mode);
+  return CallCFunctionImpl(this, function, return_type, args, true, mode,
+                           kHasFunctionDescriptor);
 }
 
 BasicBlock* RawMachineAssembler::Use(RawMachineLabel* label) {
diff --git a/deps/v8/src/compiler/raw-machine-assembler.h b/deps/v8/src/compiler/raw-machine-assembler.h
index c0bfd84a617a6f..6298513f55e0e4 100644
--- a/deps/v8/src/compiler/raw-machine-assembler.h
+++ b/deps/v8/src/compiler/raw-machine-assembler.h
@@ -128,37 +128,12 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
   }
 
   // Memory Operations.
-  std::pair<MachineType, const Operator*> InsertDecompressionIfNeeded(
-      MachineType type) {
-    const Operator* decompress_op = nullptr;
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      switch (type.representation()) {
-        case MachineRepresentation::kTaggedPointer:
-          type = MachineType::CompressedPointer();
-          decompress_op = machine()->ChangeCompressedPointerToTaggedPointer();
-          break;
-        case MachineRepresentation::kTaggedSigned:
-          type = MachineType::CompressedSigned();
-          decompress_op = machine()->ChangeCompressedSignedToTaggedSigned();
-          break;
-        case MachineRepresentation::kTagged:
-          type = MachineType::AnyCompressed();
-          decompress_op = machine()->ChangeCompressedToTagged();
-          break;
-        default:
-          break;
-      }
-    }
-    return std::make_pair(type, decompress_op);
-  }
   Node* Load(MachineType type, Node* base,
              LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
     return Load(type, base, IntPtrConstant(0), needs_poisoning);
   }
   Node* Load(MachineType type, Node* base, Node* index,
              LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
-    const Operator* decompress_op;
-    std::tie(type, decompress_op) = InsertDecompressionIfNeeded(type);
     const Operator* op = machine()->Load(type);
     CHECK_NE(PoisoningMitigationLevel::kPoisonAll, poisoning_level_);
     if (needs_poisoning == LoadSensitivity::kCritical &&
@@ -167,69 +142,34 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
     }
 
     Node* load = AddNode(op, base, index);
-    if (decompress_op != nullptr) {
-      load = AddNode(decompress_op, load);
-    }
     return load;
   }
   Node* LoadFromObject(
       MachineType type, Node* base, Node* offset,
       LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
-    const Operator* decompress_op;
-    std::tie(type, decompress_op) = InsertDecompressionIfNeeded(type);
     CHECK_EQ(needs_poisoning, LoadSensitivity::kSafe);
     ObjectAccess access = {type, WriteBarrierKind::kNoWriteBarrier};
     Node* load = AddNode(simplified()->LoadFromObject(access), base, offset);
-    if (decompress_op != nullptr) {
-      load = AddNode(decompress_op, load);
-    }
     return load;
   }
 
-  std::pair<MachineRepresentation, Node*> InsertCompressionIfNeeded(
-      MachineRepresentation rep, Node* value) {
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      switch (rep) {
-        case MachineRepresentation::kTaggedPointer:
-          rep = MachineRepresentation::kCompressedPointer;
-          value = AddNode(machine()->ChangeTaggedPointerToCompressedPointer(),
-                          value);
-          break;
-        case MachineRepresentation::kTaggedSigned:
-          rep = MachineRepresentation::kCompressedSigned;
-          value =
-              AddNode(machine()->ChangeTaggedSignedToCompressedSigned(), value);
-          break;
-        case MachineRepresentation::kTagged:
-          rep = MachineRepresentation::kCompressed;
-          value = AddNode(machine()->ChangeTaggedToCompressed(), value);
-          break;
-        default:
-          break;
-      }
-    }
-    return std::make_pair(rep, value);
-  }
   Node* Store(MachineRepresentation rep, Node* base, Node* value,
               WriteBarrierKind write_barrier) {
     return Store(rep, base, IntPtrConstant(0), value, write_barrier);
   }
   Node* Store(MachineRepresentation rep, Node* base, Node* index, Node* value,
               WriteBarrierKind write_barrier) {
-    std::tie(rep, value) = InsertCompressionIfNeeded(rep, value);
     return AddNode(machine()->Store(StoreRepresentation(rep, write_barrier)),
                    base, index, value);
   }
   void StoreToObject(MachineRepresentation rep, Node* object, Node* offset,
                      Node* value, WriteBarrierKind write_barrier) {
-    std::tie(rep, value) = InsertCompressionIfNeeded(rep, value);
     ObjectAccess access = {MachineType::TypeForRepresentation(rep),
                            write_barrier};
     AddNode(simplified()->StoreToObject(access), object, offset, value);
   }
   void OptimizedStoreField(MachineRepresentation rep, Node* object, int offset,
                            Node* value, WriteBarrierKind write_barrier) {
-    std::tie(rep, value) = InsertCompressionIfNeeded(rep, value);
     AddNode(simplified()->StoreField(FieldAccess(
                 BaseTaggedness::kTaggedBase, offset, MaybeHandle<Name>(),
                 MaybeHandle<Map>(), Type::Any(),
@@ -237,11 +177,6 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
             object, value);
   }
   void OptimizedStoreMap(Node* object, Node* value) {
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      DCHECK(AccessBuilder::ForMap().machine_type.IsCompressedPointer());
-      value =
-          AddNode(machine()->ChangeTaggedPointerToCompressedPointer(), value);
-    }
     AddNode(simplified()->StoreField(AccessBuilder::ForMap()), object, value);
   }
   Node* Retain(Node* value) { return AddNode(common()->Retain(), value); }
@@ -579,7 +514,9 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
     return AddNode(machine()->Word32PairSar(), low_word, high_word, shift);
   }
   Node* StackPointerGreaterThan(Node* value) {
-    return AddNode(machine()->StackPointerGreaterThan(), value);
+    return AddNode(
+        machine()->StackPointerGreaterThan(StackCheckKind::kCodeStubAssembler),
+        value);
   }
 
 #define INTPTR_BINOP(prefix, name)                           \
@@ -802,24 +739,6 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
   Node* ChangeUint32ToUint64(Node* a) {
     return AddNode(machine()->ChangeUint32ToUint64(), a);
   }
-  Node* ChangeTaggedToCompressed(Node* a) {
-    return AddNode(machine()->ChangeTaggedToCompressed(), a);
-  }
-  Node* ChangeTaggedPointerToCompressedPointer(Node* a) {
-    return AddNode(machine()->ChangeTaggedPointerToCompressedPointer(), a);
-  }
-  Node* ChangeTaggedSignedToCompressedSigned(Node* a) {
-    return AddNode(machine()->ChangeTaggedSignedToCompressedSigned(), a);
-  }
-  Node* ChangeCompressedToTagged(Node* a) {
-    return AddNode(machine()->ChangeCompressedToTagged(), a);
-  }
-  Node* ChangeCompressedPointerToTaggedPointer(Node* a) {
-    return AddNode(machine()->ChangeCompressedPointerToTaggedPointer(), a);
-  }
-  Node* ChangeCompressedSignedToTaggedSigned(Node* a) {
-    return AddNode(machine()->ChangeCompressedSignedToTaggedSigned(), a);
-  }
   Node* TruncateFloat64ToFloat32(Node* a) {
     return AddNode(machine()->TruncateFloat64ToFloat32(), a);
   }
diff --git a/deps/v8/src/compiler/redundancy-elimination.cc b/deps/v8/src/compiler/redundancy-elimination.cc
index 9b401bcf43f786..62f1ca739c2758 100644
--- a/deps/v8/src/compiler/redundancy-elimination.cc
+++ b/deps/v8/src/compiler/redundancy-elimination.cc
@@ -137,6 +137,13 @@ bool CheckSubsumes(Node const* a, Node const* b) {
     } else if (a->opcode() == IrOpcode::kCheckedTaggedSignedToInt32 &&
                b->opcode() == IrOpcode::kCheckedTaggedToInt32) {
       // CheckedTaggedSignedToInt32(node) implies CheckedTaggedToInt32(node)
+    } else if (a->opcode() == IrOpcode::kCheckedTaggedSignedToInt32 &&
+               b->opcode() == IrOpcode::kCheckedTaggedToArrayIndex) {
+      // CheckedTaggedSignedToInt32(node) implies
+      // CheckedTaggedToArrayIndex(node)
+    } else if (a->opcode() == IrOpcode::kCheckedTaggedToInt32 &&
+               b->opcode() == IrOpcode::kCheckedTaggedToArrayIndex) {
+      // CheckedTaggedToInt32(node) implies CheckedTaggedToArrayIndex(node)
     } else if (a->opcode() == IrOpcode::kCheckReceiver &&
                b->opcode() == IrOpcode::kCheckReceiverOrNullOrUndefined) {
       // CheckReceiver(node) implies CheckReceiverOrNullOrUndefined(node)
@@ -150,17 +157,13 @@ bool CheckSubsumes(Node const* a, Node const* b) {
         case IrOpcode::kCheckNumber:
         case IrOpcode::kCheckBigInt:
           break;
-        case IrOpcode::kCheckedInt32ToCompressedSigned:
         case IrOpcode::kCheckedInt32ToTaggedSigned:
         case IrOpcode::kCheckedInt64ToInt32:
         case IrOpcode::kCheckedInt64ToTaggedSigned:
         case IrOpcode::kCheckedTaggedSignedToInt32:
         case IrOpcode::kCheckedTaggedToTaggedPointer:
         case IrOpcode::kCheckedTaggedToTaggedSigned:
-        case IrOpcode::kCheckedCompressedToTaggedPointer:
-        case IrOpcode::kCheckedCompressedToTaggedSigned:
-        case IrOpcode::kCheckedTaggedToCompressedPointer:
-        case IrOpcode::kCheckedTaggedToCompressedSigned:
+        case IrOpcode::kCheckedTaggedToArrayIndex:
         case IrOpcode::kCheckedUint32Bounds:
         case IrOpcode::kCheckedUint32ToInt32:
         case IrOpcode::kCheckedUint32ToTaggedSigned:
@@ -234,7 +237,7 @@ Node* RedundancyElimination::EffectPathChecks::LookupBoundsCheckFor(
     Node* node) const {
   for (Check const* check = head_; check != nullptr; check = check->next) {
     if (check->node->opcode() == IrOpcode::kCheckBounds &&
-        check->node->InputAt(0) == node) {
+        check->node->InputAt(0) == node && TypeSubsumes(node, check->node)) {
       return check->node;
     }
   }
diff --git a/deps/v8/src/compiler/representation-change.cc b/deps/v8/src/compiler/representation-change.cc
index ca1b1e221f3fbf..2c0cb76708a65b 100644
--- a/deps/v8/src/compiler/representation-change.cc
+++ b/deps/v8/src/compiler/representation-change.cc
@@ -159,6 +159,15 @@ Node* RepresentationChanger::GetRepresentationFor(
     return TypeError(node, output_rep, output_type, use_info.representation());
   }
 
+  // Rematerialize any truncated BigInt if user is not expecting a BigInt.
+  if (output_type.Is(Type::BigInt()) &&
+      output_rep == MachineRepresentation::kWord64 &&
+      use_info.type_check() != TypeCheckKind::kBigInt) {
+    node =
+        InsertConversion(node, simplified()->ChangeUint64ToBigInt(), use_node);
+    output_rep = MachineRepresentation::kTaggedPointer;
+  }
+
   // Handle the no-op shortcuts when no checking is necessary.
   if (use_info.type_check() == TypeCheckKind::kNone ||
       output_rep != MachineRepresentation::kWord32) {
@@ -191,20 +200,6 @@ Node* RepresentationChanger::GetRepresentationFor(
       DCHECK_EQ(TypeCheckKind::kNone, use_info.type_check());
       return GetTaggedRepresentationFor(node, output_rep, output_type,
                                         use_info.truncation());
-    case MachineRepresentation::kCompressedSigned:
-      DCHECK(use_info.type_check() == TypeCheckKind::kNone ||
-             use_info.type_check() == TypeCheckKind::kSignedSmall);
-      return GetCompressedSignedRepresentationFor(node, output_rep, output_type,
-                                                  use_node, use_info);
-    case MachineRepresentation::kCompressedPointer:
-      DCHECK(use_info.type_check() == TypeCheckKind::kNone ||
-             use_info.type_check() == TypeCheckKind::kHeapObject);
-      return GetCompressedPointerRepresentationFor(
-          node, output_rep, output_type, use_node, use_info);
-    case MachineRepresentation::kCompressed:
-      DCHECK_EQ(TypeCheckKind::kNone, use_info.type_check());
-      return GetCompressedRepresentationFor(node, output_rep, output_type,
-                                            use_info.truncation());
     case MachineRepresentation::kFloat32:
       DCHECK_EQ(TypeCheckKind::kNone, use_info.type_check());
       return GetFloat32RepresentationFor(node, output_rep, output_type,
@@ -223,12 +218,16 @@ Node* RepresentationChanger::GetRepresentationFor(
     case MachineRepresentation::kWord64:
       DCHECK(use_info.type_check() == TypeCheckKind::kNone ||
              use_info.type_check() == TypeCheckKind::kSigned64 ||
-             use_info.type_check() == TypeCheckKind::kBigInt);
+             use_info.type_check() == TypeCheckKind::kBigInt ||
+             use_info.type_check() == TypeCheckKind::kArrayIndex);
       return GetWord64RepresentationFor(node, output_rep, output_type, use_node,
                                         use_info);
     case MachineRepresentation::kSimd128:
     case MachineRepresentation::kNone:
       return node;
+    case MachineRepresentation::kCompressed:
+    case MachineRepresentation::kCompressedPointer:
+      UNREACHABLE();
   }
   UNREACHABLE();
 }
@@ -368,17 +367,6 @@ Node* RepresentationChanger::GetTaggedSignedRepresentationFor(
       return TypeError(node, output_rep, output_type,
                        MachineRepresentation::kTaggedSigned);
     }
-  } else if (output_rep == MachineRepresentation::kCompressedSigned) {
-    op = machine()->ChangeCompressedSignedToTaggedSigned();
-  } else if (CanBeCompressedPointer(output_rep)) {
-    if (use_info.type_check() == TypeCheckKind::kSignedSmall) {
-      op = simplified()->CheckedCompressedToTaggedSigned(use_info.feedback());
-    } else if (output_type.Is(Type::SignedSmall())) {
-      op = simplified()->ChangeCompressedToTaggedSigned();
-    } else {
-      return TypeError(node, output_rep, output_type,
-                       MachineRepresentation::kTaggedSigned);
-    }
   } else {
     return TypeError(node, output_rep, output_type,
                      MachineRepresentation::kTaggedSigned);
@@ -471,30 +459,6 @@ Node* RepresentationChanger::GetTaggedPointerRepresentationFor(
       return node;
     }
     op = simplified()->CheckBigInt(use_info.feedback());
-  } else if (output_rep == MachineRepresentation::kCompressedPointer) {
-    if (use_info.type_check() == TypeCheckKind::kBigInt &&
-        !output_type.Is(Type::BigInt())) {
-      node = InsertChangeCompressedPointerToTaggedPointer(node);
-      op = simplified()->CheckBigInt(use_info.feedback());
-    } else {
-      op = machine()->ChangeCompressedPointerToTaggedPointer();
-    }
-  } else if (output_rep == MachineRepresentation::kCompressed &&
-             output_type.Is(Type::BigInt())) {
-    op = machine()->ChangeCompressedPointerToTaggedPointer();
-  } else if (output_rep == MachineRepresentation::kCompressed &&
-             use_info.type_check() == TypeCheckKind::kBigInt) {
-    node = InsertChangeCompressedToTagged(node);
-    op = simplified()->CheckBigInt(use_info.feedback());
-  } else if (CanBeCompressedSigned(output_rep) &&
-             use_info.type_check() == TypeCheckKind::kHeapObject) {
-    if (!output_type.Maybe(Type::SignedSmall())) {
-      op = machine()->ChangeCompressedPointerToTaggedPointer();
-    } else {
-      // TODO(turbofan): Consider adding a Bailout operator that just deopts
-      // for CompressedSigned output representation.
-      op = simplified()->CheckedCompressedToTaggedPointer(use_info.feedback());
-    }
   } else {
     return TypeError(node, output_rep, output_type,
                      MachineRepresentation::kTaggedPointer);
@@ -610,12 +574,6 @@ Node* RepresentationChanger::GetTaggedRepresentationFor(
       return TypeError(node, output_rep, output_type,
                        MachineRepresentation::kTagged);
     }
-  } else if (output_rep == MachineRepresentation::kCompressedSigned) {
-    op = machine()->ChangeCompressedSignedToTaggedSigned();
-  } else if (output_rep == MachineRepresentation::kCompressedPointer) {
-    op = machine()->ChangeCompressedPointerToTaggedPointer();
-  } else if (output_rep == MachineRepresentation::kCompressed) {
-    op = machine()->ChangeCompressedToTagged();
   } else {
     return TypeError(node, output_rep, output_type,
                      MachineRepresentation::kTagged);
@@ -623,197 +581,6 @@ Node* RepresentationChanger::GetTaggedRepresentationFor(
   return jsgraph()->graph()->NewNode(op, node);
 }
 
-Node* RepresentationChanger::GetCompressedSignedRepresentationFor(
-    Node* node, MachineRepresentation output_rep, Type output_type,
-    Node* use_node, UseInfo use_info) {
-  // Select the correct X -> Compressed operator.
-  const Operator* op;
-  if (output_type.Is(Type::None())) {
-    // This is an impossible value; it should not be used at runtime.
-    return jsgraph()->graph()->NewNode(
-        jsgraph()->common()->DeadValue(
-            MachineRepresentation::kCompressedSigned),
-        node);
-  } else if (output_rep == MachineRepresentation::kTaggedSigned) {
-    op = machine()->ChangeTaggedSignedToCompressedSigned();
-  } else if (CanBeTaggedPointer(output_rep)) {
-    if (use_info.type_check() == TypeCheckKind::kSignedSmall) {
-      op = simplified()->CheckedTaggedToCompressedSigned(use_info.feedback());
-    } else if (output_type.Is(Type::SignedSmall())) {
-      op = simplified()->ChangeTaggedToCompressedSigned();
-    } else {
-      return TypeError(node, output_rep, output_type,
-                       MachineRepresentation::kTaggedSigned);
-    }
-  } else if (output_rep == MachineRepresentation::kBit) {
-    // TODO(v8:8977): specialize here and below
-    node = GetTaggedSignedRepresentationFor(node, output_rep, output_type,
-                                            use_node, use_info);
-    op = machine()->ChangeTaggedSignedToCompressedSigned();
-  } else if (IsWord(output_rep)) {
-    if (output_type.Is(Type::Signed31())) {
-      op = simplified()->ChangeInt31ToCompressedSigned();
-    } else if (output_type.Is(Type::Signed32())) {
-      if (use_info.type_check() == TypeCheckKind::kSignedSmall) {
-        op = simplified()->CheckedInt32ToCompressedSigned(use_info.feedback());
-      } else {
-        return TypeError(node, output_rep, output_type,
-                         MachineRepresentation::kCompressedSigned);
-      }
-    } else {
-      node = GetTaggedSignedRepresentationFor(node, output_rep, output_type,
-                                              use_node, use_info);
-      op = machine()->ChangeTaggedSignedToCompressedSigned();
-    }
-  } else if (output_rep == MachineRepresentation::kWord64) {
-    node = GetTaggedSignedRepresentationFor(node, output_rep, output_type,
-                                            use_node, use_info);
-    op = machine()->ChangeTaggedSignedToCompressedSigned();
-  } else if (output_rep == MachineRepresentation::kFloat32) {
-    // float 32 -> float64 -> int32 -> Compressed signed
-    if (use_info.type_check() == TypeCheckKind::kSignedSmall) {
-      node = InsertChangeFloat32ToFloat64(node);
-      node = InsertCheckedFloat64ToInt32(
-          node,
-          output_type.Maybe(Type::MinusZero())
-              ? CheckForMinusZeroMode::kCheckForMinusZero
-              : CheckForMinusZeroMode::kDontCheckForMinusZero,
-          use_info.feedback(), use_node);
-      op = simplified()->CheckedInt32ToCompressedSigned(use_info.feedback());
-    } else {
-      return TypeError(node, output_rep, output_type,
-                       MachineRepresentation::kCompressedSigned);
-    }
-  } else if (output_rep == MachineRepresentation::kFloat64) {
-    if (output_type.Is(Type::Signed31())) {
-      // float64 -> int32 -> compressed signed
-      node = InsertChangeFloat64ToInt32(node);
-      op = simplified()->ChangeInt31ToCompressedSigned();
-    } else if (output_type.Is(Type::Signed32())) {
-      // float64 -> int32 -> compressed signed
-      node = InsertChangeFloat64ToInt32(node);
-      if (use_info.type_check() == TypeCheckKind::kSignedSmall) {
-        op = simplified()->CheckedInt32ToCompressedSigned(use_info.feedback());
-      } else {
-        return TypeError(node, output_rep, output_type,
-                         MachineRepresentation::kCompressedSigned);
-      }
-    } else if (use_info.type_check() == TypeCheckKind::kSignedSmall) {
-      node = InsertCheckedFloat64ToInt32(
-          node,
-          output_type.Maybe(Type::MinusZero())
-              ? CheckForMinusZeroMode::kCheckForMinusZero
-              : CheckForMinusZeroMode::kDontCheckForMinusZero,
-          use_info.feedback(), use_node);
-      op = simplified()->CheckedInt32ToCompressedSigned(use_info.feedback());
-    } else {
-      // TODO(v8:8977): specialize here and below. Missing the unsigned case.
-      node = GetTaggedSignedRepresentationFor(node, output_rep, output_type,
-                                              use_node, use_info);
-      op = machine()->ChangeTaggedSignedToCompressedSigned();
-    }
-  } else {
-    return TypeError(node, output_rep, output_type,
-                     MachineRepresentation::kCompressedSigned);
-  }
-  return InsertConversion(node, op, use_node);
-}
-
-Node* RepresentationChanger::GetCompressedPointerRepresentationFor(
-    Node* node, MachineRepresentation output_rep, Type output_type,
-    Node* use_node, UseInfo use_info) {
-  // Select the correct X -> CompressedPointer operator.
-  Operator const* op;
-  if (output_type.Is(Type::None())) {
-    // This is an impossible value; it should not be used at runtime.
-    return jsgraph()->graph()->NewNode(
-        jsgraph()->common()->DeadValue(
-            MachineRepresentation::kCompressedPointer),
-        node);
-  } else if (output_rep == MachineRepresentation::kTaggedPointer) {
-    op = machine()->ChangeTaggedPointerToCompressedPointer();
-  } else if (CanBeTaggedSigned(output_rep) &&
-             use_info.type_check() == TypeCheckKind::kHeapObject) {
-    if (!output_type.Maybe(Type::SignedSmall())) {
-      op = machine()->ChangeTaggedPointerToCompressedPointer();
-    } else {
-      // TODO(turbofan): Consider adding a Bailout operator that just deopts
-      // for TaggedSigned output representation.
-      op = simplified()->CheckedTaggedToCompressedPointer(use_info.feedback());
-    }
-  } else if (output_rep == MachineRepresentation::kBit) {
-    // TODO(v8:8977): specialize here and below
-    node = GetTaggedPointerRepresentationFor(node, output_rep, output_type,
-                                             use_node, use_info);
-    op = machine()->ChangeTaggedPointerToCompressedPointer();
-  } else if (IsWord(output_rep)) {
-    node = GetTaggedPointerRepresentationFor(node, output_rep, output_type,
-                                             use_node, use_info);
-    op = machine()->ChangeTaggedPointerToCompressedPointer();
-  } else if (output_rep == MachineRepresentation::kWord64) {
-    node = GetTaggedPointerRepresentationFor(node, output_rep, output_type,
-                                             use_node, use_info);
-    op = machine()->ChangeTaggedPointerToCompressedPointer();
-  } else if (output_rep == MachineRepresentation::kFloat32) {
-    node = GetTaggedPointerRepresentationFor(node, output_rep, output_type,
-                                             use_node, use_info);
-    op = machine()->ChangeTaggedPointerToCompressedPointer();
-  } else if (output_rep == MachineRepresentation::kFloat64) {
-    node = GetTaggedPointerRepresentationFor(node, output_rep, output_type,
-                                             use_node, use_info);
-    op = machine()->ChangeTaggedPointerToCompressedPointer();
-  } else {
-    return TypeError(node, output_rep, output_type,
-                     MachineRepresentation::kCompressedPointer);
-  }
-  return InsertConversion(node, op, use_node);
-}
-
-Node* RepresentationChanger::GetCompressedRepresentationFor(
-    Node* node, MachineRepresentation output_rep, Type output_type,
-    Truncation truncation) {
-  if (output_rep == MachineRepresentation::kCompressedSigned ||
-      output_rep == MachineRepresentation::kCompressedPointer) {
-    // this is a no-op.
-    return node;
-  }
-  // Select the correct X -> Compressed operator.
-  const Operator* op;
-  if (output_type.Is(Type::None())) {
-    // This is an impossible value; it should not be used at runtime.
-    return jsgraph()->graph()->NewNode(
-        jsgraph()->common()->DeadValue(MachineRepresentation::kCompressed),
-        node);
-  } else if (output_rep == MachineRepresentation::kBit) {
-    // TODO(v8:8977): specialize here and below
-    node =
-        GetTaggedRepresentationFor(node, output_rep, output_type, truncation);
-    op = machine()->ChangeTaggedToCompressed();
-  } else if (IsWord(output_rep)) {
-    node =
-        GetTaggedRepresentationFor(node, output_rep, output_type, truncation);
-    op = machine()->ChangeTaggedToCompressed();
-  } else if (output_rep == MachineRepresentation::kWord64) {
-    node =
-        GetTaggedRepresentationFor(node, output_rep, output_type, truncation);
-    op = machine()->ChangeTaggedToCompressed();
-  } else if (output_rep == MachineRepresentation::kFloat32) {
-    node =
-        GetTaggedRepresentationFor(node, output_rep, output_type, truncation);
-    op = machine()->ChangeTaggedToCompressed();
-  } else if (output_rep == MachineRepresentation::kFloat64) {
-    node =
-        GetTaggedRepresentationFor(node, output_rep, output_type, truncation);
-    op = machine()->ChangeTaggedToCompressed();
-  } else if (IsAnyTagged(output_rep)) {
-    op = machine()->ChangeTaggedToCompressed();
-  } else {
-    return TypeError(node, output_rep, output_type,
-                     MachineRepresentation::kCompressed);
-  }
-  return jsgraph()->graph()->NewNode(op, node);
-}
-
 Node* RepresentationChanger::GetFloat32RepresentationFor(
     Node* node, MachineRepresentation output_rep, Type output_type,
     Truncation truncation) {
@@ -862,21 +629,6 @@ Node* RepresentationChanger::GetFloat32RepresentationFor(
       node = jsgraph()->graph()->NewNode(op, node);
       op = machine()->TruncateFloat64ToFloat32();
     }
-  } else if (output_rep == MachineRepresentation::kCompressed) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedToTagged(node);
-    return GetFloat32RepresentationFor(node, MachineRepresentation::kTagged,
-                                       output_type, truncation);
-  } else if (output_rep == MachineRepresentation::kCompressedSigned) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedSignedToTaggedSigned(node);
-    return GetFloat32RepresentationFor(
-        node, MachineRepresentation::kTaggedSigned, output_type, truncation);
-  } else if (output_rep == MachineRepresentation::kCompressedPointer) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedPointerToTaggedPointer(node);
-    return GetFloat32RepresentationFor(
-        node, MachineRepresentation::kTaggedPointer, output_type, truncation);
   } else if (output_rep == MachineRepresentation::kFloat64) {
     op = machine()->TruncateFloat64ToFloat32();
   } else if (output_rep == MachineRepresentation::kWord64) {
@@ -911,6 +663,7 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
       case TypeCheckKind::kSigned32:
       case TypeCheckKind::kSigned64:
       case TypeCheckKind::kSignedSmall:
+      case TypeCheckKind::kArrayIndex:
         break;
     }
   }
@@ -977,23 +730,6 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
       op = simplified()->CheckedTaggedToFloat64(
           CheckTaggedInputMode::kNumberOrOddball, use_info.feedback());
     }
-  } else if (output_rep == MachineRepresentation::kCompressed) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedToTagged(node);
-    return GetFloat64RepresentationFor(node, MachineRepresentation::kTagged,
-                                       output_type, use_node, use_info);
-  } else if (output_rep == MachineRepresentation::kCompressedSigned) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedSignedToTaggedSigned(node);
-    return GetFloat64RepresentationFor(node,
-                                       MachineRepresentation::kTaggedSigned,
-                                       output_type, use_node, use_info);
-  } else if (output_rep == MachineRepresentation::kCompressedPointer) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedPointerToTaggedPointer(node);
-    return GetFloat64RepresentationFor(node,
-                                       MachineRepresentation::kTaggedPointer,
-                                       output_type, use_node, use_info);
   } else if (output_rep == MachineRepresentation::kFloat32) {
     op = machine()->ChangeFloat32ToFloat64();
   } else if (output_rep == MachineRepresentation::kWord64) {
@@ -1041,7 +777,8 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
           ((use_info.type_check() == TypeCheckKind::kSignedSmall ||
             use_info.type_check() == TypeCheckKind::kSigned32 ||
             use_info.type_check() == TypeCheckKind::kNumber ||
-            use_info.type_check() == TypeCheckKind::kNumberOrOddball) &&
+            use_info.type_check() == TypeCheckKind::kNumberOrOddball ||
+            use_info.type_check() == TypeCheckKind::kArrayIndex) &&
            IsInt32Double(fv))) {
         return MakeTruncatedInt32Constant(fv);
       }
@@ -1076,7 +813,8 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
     if (output_type.Is(Type::Signed32())) {
       op = machine()->ChangeFloat64ToInt32();
     } else if (use_info.type_check() == TypeCheckKind::kSignedSmall ||
-               use_info.type_check() == TypeCheckKind::kSigned32) {
+               use_info.type_check() == TypeCheckKind::kSigned32 ||
+               use_info.type_check() == TypeCheckKind::kArrayIndex) {
       op = simplified()->CheckedFloat64ToInt32(
           output_type.Maybe(Type::MinusZero())
               ? use_info.minus_zero_check()
@@ -1095,7 +833,8 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
     if (output_type.Is(Type::Signed32())) {
       op = machine()->ChangeFloat64ToInt32();
     } else if (use_info.type_check() == TypeCheckKind::kSignedSmall ||
-               use_info.type_check() == TypeCheckKind::kSigned32) {
+               use_info.type_check() == TypeCheckKind::kSigned32 ||
+               use_info.type_check() == TypeCheckKind::kArrayIndex) {
       op = simplified()->CheckedFloat64ToInt32(
           output_type.Maybe(Type::MinusZero())
               ? use_info.minus_zero_check()
@@ -1123,6 +862,8 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
               ? use_info.minus_zero_check()
               : CheckForMinusZeroMode::kDontCheckForMinusZero,
           use_info.feedback());
+    } else if (use_info.type_check() == TypeCheckKind::kArrayIndex) {
+      op = simplified()->CheckedTaggedToArrayIndex(use_info.feedback());
     } else if (output_type.Is(Type::Unsigned32())) {
       op = simplified()->ChangeTaggedToUint32();
     } else if (use_info.truncation().IsUsedAsWord32()) {
@@ -1142,32 +883,12 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
       return TypeError(node, output_rep, output_type,
                        MachineRepresentation::kWord32);
     }
-  } else if (output_rep == MachineRepresentation::kCompressed) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedToTagged(node);
-    return GetWord32RepresentationFor(node, MachineRepresentation::kTagged,
-                                      output_type, use_node, use_info);
-  } else if (output_rep == MachineRepresentation::kCompressedSigned) {
-    // TODO(v8:8977): Specialise here
-    if (output_type.Is(Type::SignedSmall())) {
-      op = simplified()->ChangeCompressedSignedToInt32();
-    } else {
-      node = InsertChangeCompressedSignedToTaggedSigned(node);
-      return GetWord32RepresentationFor(node,
-                                        MachineRepresentation::kTaggedSigned,
-                                        output_type, use_node, use_info);
-    }
-  } else if (output_rep == MachineRepresentation::kCompressedPointer) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedPointerToTaggedPointer(node);
-    return GetWord32RepresentationFor(node,
-                                      MachineRepresentation::kTaggedPointer,
-                                      output_type, use_node, use_info);
   } else if (output_rep == MachineRepresentation::kWord32) {
     // Only the checked case should get here, the non-checked case is
     // handled in GetRepresentationFor.
     if (use_info.type_check() == TypeCheckKind::kSignedSmall ||
-        use_info.type_check() == TypeCheckKind::kSigned32) {
+        use_info.type_check() == TypeCheckKind::kSigned32 ||
+        use_info.type_check() == TypeCheckKind::kArrayIndex) {
       bool indentify_zeros = use_info.truncation().IdentifiesZeroAndMinusZero();
       if (output_type.Is(Type::Signed32()) ||
           (indentify_zeros && output_type.Is(Type::Signed32OrMinusZero()))) {
@@ -1198,7 +919,8 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
                use_info.truncation().IsUsedAsWord32()) {
       op = machine()->TruncateInt64ToInt32();
     } else if (use_info.type_check() == TypeCheckKind::kSignedSmall ||
-               use_info.type_check() == TypeCheckKind::kSigned32) {
+               use_info.type_check() == TypeCheckKind::kSigned32 ||
+               use_info.type_check() == TypeCheckKind::kArrayIndex) {
       if (output_type.Is(cache_->kPositiveSafeInteger)) {
         op = simplified()->CheckedUint64ToInt32(use_info.feedback());
       } else if (output_type.Is(cache_->kSafeInteger)) {
@@ -1281,21 +1003,6 @@ Node* RepresentationChanger::GetBitRepresentationFor(
     }
     return jsgraph()->graph()->NewNode(machine()->Word32Equal(), node,
                                        jsgraph()->Int32Constant(0));
-  } else if (output_rep == MachineRepresentation::kCompressed) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedToTagged(node);
-    return GetBitRepresentationFor(node, MachineRepresentation::kTagged,
-                                   output_type);
-  } else if (output_rep == MachineRepresentation::kCompressedSigned) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedSignedToTaggedSigned(node);
-    return GetBitRepresentationFor(node, MachineRepresentation::kTaggedSigned,
-                                   output_type);
-  } else if (output_rep == MachineRepresentation::kCompressedPointer) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedPointerToTaggedPointer(node);
-    return GetBitRepresentationFor(node, MachineRepresentation::kTaggedPointer,
-                                   output_type);
   } else if (IsWord(output_rep)) {
     node = jsgraph()->graph()->NewNode(machine()->Word32Equal(), node,
                                        jsgraph()->Int32Constant(0));
@@ -1344,7 +1051,8 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
     }
     case IrOpcode::kHeapConstant: {
       HeapObjectMatcher m(node);
-      if (m.HasValue() && m.Ref(broker_).IsBigInt()) {
+      if (m.HasValue() && m.Ref(broker_).IsBigInt() &&
+          use_info.truncation().IsUsedAsWord64()) {
         auto bigint = m.Ref(broker_).AsBigInt();
         return jsgraph()->Int64Constant(
             static_cast<int64_t>(bigint.AsUint64()));
@@ -1394,7 +1102,8 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
       // float32 -> float64 -> uint64
       node = InsertChangeFloat32ToFloat64(node);
       op = machine()->ChangeFloat64ToUint64();
-    } else if (use_info.type_check() == TypeCheckKind::kSigned64) {
+    } else if (use_info.type_check() == TypeCheckKind::kSigned64 ||
+               use_info.type_check() == TypeCheckKind::kArrayIndex) {
       // float32 -> float64 -> int64
       node = InsertChangeFloat32ToFloat64(node);
       op = simplified()->CheckedFloat64ToInt64(
@@ -1411,7 +1120,8 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
       op = machine()->ChangeFloat64ToInt64();
     } else if (output_type.Is(cache_->kUint64)) {
       op = machine()->ChangeFloat64ToUint64();
-    } else if (use_info.type_check() == TypeCheckKind::kSigned64) {
+    } else if (use_info.type_check() == TypeCheckKind::kSigned64 ||
+               use_info.type_check() == TypeCheckKind::kArrayIndex) {
       op = simplified()->CheckedFloat64ToInt64(
           output_type.Maybe(Type::MinusZero())
               ? use_info.minus_zero_check()
@@ -1444,27 +1154,12 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
               ? use_info.minus_zero_check()
               : CheckForMinusZeroMode::kDontCheckForMinusZero,
           use_info.feedback());
+    } else if (use_info.type_check() == TypeCheckKind::kArrayIndex) {
+      op = simplified()->CheckedTaggedToArrayIndex(use_info.feedback());
     } else {
       return TypeError(node, output_rep, output_type,
                        MachineRepresentation::kWord64);
     }
-  } else if (output_rep == MachineRepresentation::kCompressed) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedToTagged(node);
-    return GetWord64RepresentationFor(node, MachineRepresentation::kTagged,
-                                      output_type, use_node, use_info);
-  } else if (output_rep == MachineRepresentation::kCompressedSigned) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedSignedToTaggedSigned(node);
-    return GetWord64RepresentationFor(node,
-                                      MachineRepresentation::kTaggedSigned,
-                                      output_type, use_node, use_info);
-  } else if (output_rep == MachineRepresentation::kCompressedPointer) {
-    // TODO(v8:8977): Specialise here
-    node = InsertChangeCompressedPointerToTaggedPointer(node);
-    return GetWord64RepresentationFor(node,
-                                      MachineRepresentation::kTaggedPointer,
-                                      output_type, use_node, use_info);
   } else {
     return TypeError(node, output_rep, output_type,
                      MachineRepresentation::kWord64);
@@ -1768,23 +1463,6 @@ Node* RepresentationChanger::InsertTruncateInt64ToInt32(Node* node) {
   return jsgraph()->graph()->NewNode(machine()->TruncateInt64ToInt32(), node);
 }
 
-Node* RepresentationChanger::InsertChangeCompressedPointerToTaggedPointer(
-    Node* node) {
-  return jsgraph()->graph()->NewNode(
-      machine()->ChangeCompressedPointerToTaggedPointer(), node);
-}
-
-Node* RepresentationChanger::InsertChangeCompressedSignedToTaggedSigned(
-    Node* node) {
-  return jsgraph()->graph()->NewNode(
-      machine()->ChangeCompressedSignedToTaggedSigned(), node);
-}
-
-Node* RepresentationChanger::InsertChangeCompressedToTagged(Node* node) {
-  return jsgraph()->graph()->NewNode(machine()->ChangeCompressedToTagged(),
-                                     node);
-}
-
 Node* RepresentationChanger::InsertCheckedFloat64ToInt32(
     Node* node, CheckForMinusZeroMode check, const FeedbackSource& feedback,
     Node* use_node) {
diff --git a/deps/v8/src/compiler/representation-change.h b/deps/v8/src/compiler/representation-change.h
index 43e85085badc9b..ad9e1d6041a0f9 100644
--- a/deps/v8/src/compiler/representation-change.h
+++ b/deps/v8/src/compiler/representation-change.h
@@ -122,6 +122,7 @@ enum class TypeCheckKind : uint8_t {
   kNumberOrOddball,
   kHeapObject,
   kBigInt,
+  kArrayIndex
 };
 
 inline std::ostream& operator<<(std::ostream& os, TypeCheckKind type_check) {
@@ -142,6 +143,8 @@ inline std::ostream& operator<<(std::ostream& os, TypeCheckKind type_check) {
       return os << "HeapObject";
     case TypeCheckKind::kBigInt:
       return os << "BigInt";
+    case TypeCheckKind::kArrayIndex:
+      return os << "ArrayIndex";
   }
   UNREACHABLE();
 }
@@ -207,18 +210,13 @@ class UseInfo {
   static UseInfo TaggedPointer() {
     return UseInfo(MachineRepresentation::kTaggedPointer, Truncation::Any());
   }
-  static UseInfo AnyCompressed() {
-    return UseInfo(MachineRepresentation::kCompressed, Truncation::Any());
-  }
-  static UseInfo CompressedSigned() {
-    return UseInfo(MachineRepresentation::kCompressedSigned, Truncation::Any());
-  }
-  static UseInfo CompressedPointer() {
-    return UseInfo(MachineRepresentation::kCompressedPointer,
-                   Truncation::Any());
-  }
 
   // Possibly deoptimizing conversions.
+  static UseInfo CheckedTaggedAsArrayIndex(const FeedbackSource& feedback) {
+    return UseInfo(MachineType::PointerRepresentation(),
+                   Truncation::Any(kIdentifyZeros), TypeCheckKind::kArrayIndex,
+                   feedback);
+  }
   static UseInfo CheckedHeapObjectAsTaggedPointer(
       const FeedbackSource& feedback) {
     return UseInfo(MachineRepresentation::kTaggedPointer, Truncation::Any(),
@@ -359,17 +357,6 @@ class V8_EXPORT_PRIVATE RepresentationChanger final {
                                           UseInfo use_info);
   Node* GetTaggedRepresentationFor(Node* node, MachineRepresentation output_rep,
                                    Type output_type, Truncation truncation);
-  Node* GetCompressedSignedRepresentationFor(Node* node,
-                                             MachineRepresentation output_rep,
-                                             Type output_type, Node* use_node,
-                                             UseInfo use_info);
-  Node* GetCompressedPointerRepresentationFor(Node* node,
-                                              MachineRepresentation output_rep,
-                                              Type output_type, Node* use_node,
-                                              UseInfo use_info);
-  Node* GetCompressedRepresentationFor(Node* node,
-                                       MachineRepresentation output_rep,
-                                       Type output_type, Truncation truncation);
   Node* GetFloat32RepresentationFor(Node* node,
                                     MachineRepresentation output_rep,
                                     Type output_type, Truncation truncation);
@@ -396,9 +383,6 @@ class V8_EXPORT_PRIVATE RepresentationChanger final {
   Node* InsertChangeTaggedSignedToInt32(Node* node);
   Node* InsertChangeTaggedToFloat64(Node* node);
   Node* InsertChangeUint32ToFloat64(Node* node);
-  Node* InsertChangeCompressedPointerToTaggedPointer(Node* node);
-  Node* InsertChangeCompressedSignedToTaggedSigned(Node* node);
-  Node* InsertChangeCompressedToTagged(Node* node);
   Node* InsertCheckedFloat64ToInt32(Node* node, CheckForMinusZeroMode check,
                                     const FeedbackSource& feedback,
                                     Node* use_node);
diff --git a/deps/v8/src/compiler/schedule.cc b/deps/v8/src/compiler/schedule.cc
index 3b335f9712f5c4..8bdcef511b6ad9 100644
--- a/deps/v8/src/compiler/schedule.cc
+++ b/deps/v8/src/compiler/schedule.cc
@@ -50,6 +50,10 @@ void BasicBlock::AddPredecessor(BasicBlock* predecessor) {
   predecessors_.push_back(predecessor);
 }
 
+void BasicBlock::RemovePredecessor(size_t index) {
+  predecessors_.erase(predecessors_.begin() + index);
+}
+
 void BasicBlock::AddNode(Node* node) { nodes_.push_back(node); }
 
 void BasicBlock::set_control(Control control) { control_ = control; }
@@ -75,6 +79,19 @@ void BasicBlock::set_loop_header(BasicBlock* loop_header) {
   loop_header_ = loop_header;
 }
 
+void BasicBlock::TrimNodes(iterator new_end) { nodes_.erase(new_end, end()); }
+
+void BasicBlock::ResetRPOInfo() {
+  loop_number_ = -1;
+  rpo_number_ = -1;
+  dominator_depth_ = -1;
+  dominator_ = nullptr;
+  rpo_next_ = nullptr;
+  loop_header_ = nullptr;
+  loop_end_ = nullptr;
+  loop_depth_ = 0;
+}
+
 // static
 BasicBlock* BasicBlock::GetCommonDominator(BasicBlock* b1, BasicBlock* b2) {
   while (b1 != b2) {
diff --git a/deps/v8/src/compiler/schedule.h b/deps/v8/src/compiler/schedule.h
index ea42951d50db3c..499a326f202e09 100644
--- a/deps/v8/src/compiler/schedule.h
+++ b/deps/v8/src/compiler/schedule.h
@@ -74,6 +74,7 @@ class V8_EXPORT_PRIVATE BasicBlock final
   BasicBlock* PredecessorAt(size_t index) { return predecessors_[index]; }
   void ClearPredecessors() { predecessors_.clear(); }
   void AddPredecessor(BasicBlock* predecessor);
+  void RemovePredecessor(size_t index);
 
   // Successors.
   BasicBlockVector& successors() { return successors_; }
@@ -114,6 +115,11 @@ class V8_EXPORT_PRIVATE BasicBlock final
     nodes_.insert(insertion_point, insertion_start, insertion_end);
   }
 
+  // Trim basic block to end at {new_end}.
+  void TrimNodes(iterator new_end);
+
+  void ResetRPOInfo();
+
   // Accessors.
   Control control() const { return control_; }
   void set_control(Control control);
@@ -148,6 +154,8 @@ class V8_EXPORT_PRIVATE BasicBlock final
   int32_t rpo_number() const { return rpo_number_; }
   void set_rpo_number(int32_t rpo_number);
 
+  NodeVector* nodes() { return &nodes_; }
+
   // Loop membership helpers.
   inline bool IsLoopHeader() const { return loop_end_ != nullptr; }
   bool LoopContains(BasicBlock* block) const;
@@ -268,6 +276,7 @@ class V8_EXPORT_PRIVATE Schedule final : public NON_EXPORTED_BASE(ZoneObject) {
   Zone* zone() const { return zone_; }
 
  private:
+  friend class GraphAssembler;
   friend class Scheduler;
   friend class BasicBlockInstrumentor;
   friend class RawMachineAssembler;
diff --git a/deps/v8/src/compiler/scheduled-machine-lowering.cc b/deps/v8/src/compiler/scheduled-machine-lowering.cc
new file mode 100644
index 00000000000000..9395c83e57c5d7
--- /dev/null
+++ b/deps/v8/src/compiler/scheduled-machine-lowering.cc
@@ -0,0 +1,68 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/scheduled-machine-lowering.h"
+
+#include "src/compiler/compiler-source-position-table.h"
+#include "src/compiler/js-graph.h"
+#include "src/compiler/node-origin-table.h"
+#include "src/compiler/node-properties.h"
+#include "src/compiler/schedule.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+ScheduledMachineLowering::ScheduledMachineLowering(
+    JSGraph* js_graph, Schedule* schedule, Zone* temp_zone,
+    SourcePositionTable* source_positions, NodeOriginTable* node_origins,
+    PoisoningMitigationLevel poison_level)
+    : schedule_(schedule),
+      graph_assembler_(js_graph, temp_zone, schedule),
+      select_lowering_(&graph_assembler_, js_graph->graph()),
+      memory_lowering_(js_graph, temp_zone, &graph_assembler_, poison_level),
+      reducers_({&select_lowering_, &memory_lowering_}, temp_zone),
+      source_positions_(source_positions),
+      node_origins_(node_origins) {}
+
+void ScheduledMachineLowering::Run() {
+  // TODO(rmcilroy) We should not depend on having rpo_order on schedule, and
+  // instead just do our own RPO walk here.
+  for (BasicBlock* block : *(schedule()->rpo_order())) {
+    BasicBlock::iterator instr = block->begin();
+    BasicBlock::iterator end_instr = block->end();
+    gasm()->Reset(block);
+
+    for (; instr != end_instr; instr++) {
+      Node* node = *instr;
+      Reduction reduction;
+      for (auto reducer : reducers_) {
+        reduction = reducer->Reduce(node);
+        if (reduction.Changed()) break;
+      }
+      if (reduction.Changed()) {
+        Node* replacement = reduction.replacement();
+        if (replacement != node) {
+          // Replace all uses of node and kill the node to make sure we don't
+          // leave dangling dead uses.
+          NodeProperties::ReplaceUses(node, replacement, gasm()->effect(),
+                                      gasm()->control());
+          node->Kill();
+        } else {
+          gasm()->AddNode(replacement);
+        }
+      } else {
+        gasm()->AddNode(node);
+      }
+    }
+
+    gasm()->FinalizeCurrentBlock(block);
+  }
+
+  schedule_->rpo_order()->clear();
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/compiler/scheduled-machine-lowering.h b/deps/v8/src/compiler/scheduled-machine-lowering.h
new file mode 100644
index 00000000000000..ca078a2a5345ac
--- /dev/null
+++ b/deps/v8/src/compiler/scheduled-machine-lowering.h
@@ -0,0 +1,51 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_SCHEDULED_MACHINE_LOWERING_H_
+#define V8_COMPILER_SCHEDULED_MACHINE_LOWERING_H_
+
+#include "src/compiler/graph-assembler.h"
+#include "src/compiler/memory-lowering.h"
+#include "src/compiler/select-lowering.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+class NodeOriginTable;
+class Schedule;
+class SourcePositionTable;
+
+// Performs machine lowering on an already scheduled graph.
+class ScheduledMachineLowering final {
+ public:
+  ScheduledMachineLowering(JSGraph* js_graph, Schedule* schedule,
+                           Zone* temp_zone,
+                           SourcePositionTable* source_positions,
+                           NodeOriginTable* node_origins,
+                           PoisoningMitigationLevel poison_level);
+  ~ScheduledMachineLowering() = default;
+
+  void Run();
+
+ private:
+  bool LowerNode(Node* node);
+
+  JSGraphAssembler* gasm() { return &graph_assembler_; }
+  Schedule* schedule() { return schedule_; }
+
+  Schedule* schedule_;
+  JSGraphAssembler graph_assembler_;
+  SelectLowering select_lowering_;
+  MemoryLowering memory_lowering_;
+  ZoneVector<Reducer*> reducers_;
+  SourcePositionTable* source_positions_;
+  NodeOriginTable* node_origins_;
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_SCHEDULED_MACHINE_LOWERING_H_
diff --git a/deps/v8/src/compiler/scheduler.cc b/deps/v8/src/compiler/scheduler.cc
index 2999cbfcd6e5b0..0b0a5484117afc 100644
--- a/deps/v8/src/compiler/scheduler.cc
+++ b/deps/v8/src/compiler/scheduler.cc
@@ -58,7 +58,7 @@ Schedule* Scheduler::ComputeSchedule(Zone* zone, Graph* graph, Flags flags,
 
   scheduler.BuildCFG();
   scheduler.ComputeSpecialRPONumbering();
-  scheduler.GenerateImmediateDominatorTree();
+  scheduler.GenerateDominatorTree();
 
   scheduler.PrepareUses();
   scheduler.ScheduleEarly();
@@ -754,9 +754,8 @@ class SpecialRPONumberer : public ZoneObject {
     return block->loop_number() >= 0;
   }
 
-  // TODO(mstarzinger): We only need this special sentinel because some tests
-  // use the schedule's end block in actual control flow (e.g. with end having
-  // successors). Once this has been cleaned up we can use the end block here.
+  // We only need this special sentinel because some tests use the schedule's
+  // end block in actual control flow (e.g. with end having successors).
   BasicBlock* BeyondEndSentinel() {
     if (beyond_end_ == nullptr) {
       BasicBlock::Id id = BasicBlock::Id::FromInt(-1);
@@ -1165,17 +1164,18 @@ void Scheduler::PropagateImmediateDominators(BasicBlock* block) {
   }
 }
 
-
-void Scheduler::GenerateImmediateDominatorTree() {
-  TRACE("--- IMMEDIATE BLOCK DOMINATORS -----------------------------\n");
-
+void Scheduler::GenerateDominatorTree(Schedule* schedule) {
   // Seed start block to be the first dominator.
-  schedule_->start()->set_dominator_depth(0);
+  schedule->start()->set_dominator_depth(0);
 
   // Build the block dominator tree resulting from the above seed.
-  PropagateImmediateDominators(schedule_->start()->rpo_next());
+  PropagateImmediateDominators(schedule->start()->rpo_next());
 }
 
+void Scheduler::GenerateDominatorTree() {
+  TRACE("--- IMMEDIATE BLOCK DOMINATORS -----------------------------\n");
+  GenerateDominatorTree(schedule_);
+}
 
 // -----------------------------------------------------------------------------
 // Phase 3: Prepare use counts for nodes.
@@ -1756,7 +1756,7 @@ void Scheduler::FuseFloatingControl(BasicBlock* block, Node* node) {
 
   // Iterate on phase 2: Compute special RPO and dominator tree.
   special_rpo_->UpdateSpecialRPO(block, schedule_->block(node));
-  // TODO(mstarzinger): Currently "iterate on" means "re-run". Fix that.
+  // TODO(turbofan): Currently "iterate on" means "re-run". Fix that.
   for (BasicBlock* b = block->rpo_next(); b != nullptr; b = b->rpo_next()) {
     b->set_dominator_depth(-1);
     b->set_dominator(nullptr);
@@ -1764,7 +1764,7 @@ void Scheduler::FuseFloatingControl(BasicBlock* block, Node* node) {
   PropagateImmediateDominators(block->rpo_next());
 
   // Iterate on phase 4: Schedule nodes early.
-  // TODO(mstarzinger): The following loop gathering the propagation roots is a
+  // TODO(turbofan): The following loop gathering the propagation roots is a
   // temporary solution and should be merged into the rest of the scheduler as
   // soon as the approach settled for all floating loops.
   NodeVector propagation_roots(control_flow_builder_->control_);
@@ -1786,7 +1786,7 @@ void Scheduler::FuseFloatingControl(BasicBlock* block, Node* node) {
   schedule_early_visitor.Run(&propagation_roots);
 
   // Move previously planned nodes.
-  // TODO(mstarzinger): Improve that by supporting bulk moves.
+  // TODO(turbofan): Improve that by supporting bulk moves.
   scheduled_nodes_.resize(schedule_->BasicBlockCount());
   MovePlannedNodes(block, schedule_->block(node));
 
diff --git a/deps/v8/src/compiler/scheduler.h b/deps/v8/src/compiler/scheduler.h
index 3d1fa40025b10a..291b53db6734e6 100644
--- a/deps/v8/src/compiler/scheduler.h
+++ b/deps/v8/src/compiler/scheduler.h
@@ -42,6 +42,9 @@ class V8_EXPORT_PRIVATE Scheduler {
   // Compute the RPO of blocks in an existing schedule.
   static BasicBlockVector* ComputeSpecialRPO(Zone* zone, Schedule* schedule);
 
+  // Computes the dominator tree on an existing schedule that has RPO computed.
+  static void GenerateDominatorTree(Schedule* schedule);
+
  private:
   // Placement of a node changes during scheduling. The placement state
   // transitions over time while the scheduler is choosing a position:
@@ -98,7 +101,7 @@ class V8_EXPORT_PRIVATE Scheduler {
   void IncrementUnscheduledUseCount(Node* node, int index, Node* from);
   void DecrementUnscheduledUseCount(Node* node, int index, Node* from);
 
-  void PropagateImmediateDominators(BasicBlock* block);
+  static void PropagateImmediateDominators(BasicBlock* block);
 
   // Phase 1: Build control-flow graph.
   friend class CFGBuilder;
@@ -107,7 +110,7 @@ class V8_EXPORT_PRIVATE Scheduler {
   // Phase 2: Compute special RPO and dominator tree.
   friend class SpecialRPONumberer;
   void ComputeSpecialRPONumbering();
-  void GenerateImmediateDominatorTree();
+  void GenerateDominatorTree();
 
   // Phase 3: Prepare use counts for nodes.
   friend class PrepareUsesVisitor;
diff --git a/deps/v8/src/compiler/select-lowering.cc b/deps/v8/src/compiler/select-lowering.cc
index 290306a966bf5f..590df6ae1f0990 100644
--- a/deps/v8/src/compiler/select-lowering.cc
+++ b/deps/v8/src/compiler/select-lowering.cc
@@ -6,35 +6,35 @@
 
 #include "src/compiler/common-operator.h"
 #include "src/compiler/diamond.h"
+#include "src/compiler/graph-assembler.h"
 #include "src/compiler/graph.h"
-#include "src/compiler/node.h"
 #include "src/compiler/node-properties.h"
+#include "src/compiler/node.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
-SelectLowering::SelectLowering(JSGraph* jsgraph, Zone* zone)
-    : graph_assembler_(jsgraph, nullptr, nullptr, zone),
-      start_(jsgraph->graph()->start()) {}
+SelectLowering::SelectLowering(JSGraphAssembler* graph_assembler, Graph* graph)
+    : graph_assembler_(graph_assembler), start_(graph->start()) {}
 
 SelectLowering::~SelectLowering() = default;
 
 Reduction SelectLowering::Reduce(Node* node) {
   if (node->opcode() != IrOpcode::kSelect) return NoChange();
-  return Changed(LowerSelect(node));
+  return LowerSelect(node);
 }
 
 #define __ gasm()->
 
-Node* SelectLowering::LowerSelect(Node* node) {
+Reduction SelectLowering::LowerSelect(Node* node) {
   SelectParameters const p = SelectParametersOf(node->op());
 
   Node* condition = node->InputAt(0);
   Node* vtrue = node->InputAt(1);
   Node* vfalse = node->InputAt(2);
 
-  gasm()->Reset(start(), start());
+  gasm()->InitializeEffectControl(start(), start());
 
   auto done = __ MakeLabel(p.representation());
 
@@ -42,7 +42,7 @@ Node* SelectLowering::LowerSelect(Node* node) {
   __ Goto(&done, vfalse);
   __ Bind(&done);
 
-  return done.PhiAt(0);
+  return Changed(done.PhiAt(0));
 }
 
 #undef __
diff --git a/deps/v8/src/compiler/select-lowering.h b/deps/v8/src/compiler/select-lowering.h
index 53890a7898152d..bbe14e92ffac4b 100644
--- a/deps/v8/src/compiler/select-lowering.h
+++ b/deps/v8/src/compiler/select-lowering.h
@@ -5,30 +5,32 @@
 #ifndef V8_COMPILER_SELECT_LOWERING_H_
 #define V8_COMPILER_SELECT_LOWERING_H_
 
-#include "src/compiler/graph-assembler.h"
 #include "src/compiler/graph-reducer.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
+// Forward declarations.
+class JSGraphAssembler;
+
 // Lowers Select nodes to diamonds.
 class SelectLowering final : public Reducer {
  public:
-  SelectLowering(JSGraph* jsgraph, Zone* zone);
+  SelectLowering(JSGraphAssembler* graph_assembler, Graph* graph);
   ~SelectLowering() override;
 
   const char* reducer_name() const override { return "SelectLowering"; }
 
   Reduction Reduce(Node* node) override;
 
-  Node* LowerSelect(Node* node);
-
  private:
-  GraphAssembler* gasm() { return &graph_assembler_; }
-  Node* start() { return start_; }
+  Reduction LowerSelect(Node* node);
+
+  JSGraphAssembler* gasm() const { return graph_assembler_; }
+  Node* start() const { return start_; }
 
-  GraphAssembler graph_assembler_;
+  JSGraphAssembler* graph_assembler_;
   Node* start_;
 };
 
diff --git a/deps/v8/src/compiler/serializer-for-background-compilation.cc b/deps/v8/src/compiler/serializer-for-background-compilation.cc
index ebf3dbd482e7fe..8ae19bc0c52881 100644
--- a/deps/v8/src/compiler/serializer-for-background-compilation.cc
+++ b/deps/v8/src/compiler/serializer-for-background-compilation.cc
@@ -10,8 +10,8 @@
 #include "src/compiler/access-info.h"
 #include "src/compiler/bytecode-analysis.h"
 #include "src/compiler/compilation-dependencies.h"
-#include "src/compiler/functional-list.h"
 #include "src/compiler/js-heap-broker.h"
+#include "src/compiler/serializer-hints.h"
 #include "src/compiler/zone-stats.h"
 #include "src/handles/handles-inl.h"
 #include "src/ic/call-optimization.h"
@@ -28,12 +28,6 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-#define CLEAR_ENVIRONMENT_LIST(V) \
-  V(CallRuntimeForPair)           \
-  V(Debugger)                     \
-  V(ResumeGenerator)              \
-  V(SuspendGenerator)
-
 #define KILL_ENVIRONMENT_LIST(V) \
   V(Abort)                       \
   V(ReThrow)                     \
@@ -224,7 +218,6 @@ namespace compiler {
   BINARY_OP_LIST(V)                   \
   COMPARE_OP_LIST(V)                  \
   CLEAR_ACCUMULATOR_LIST(V)           \
-  CLEAR_ENVIRONMENT_LIST(V)           \
   CONDITIONAL_JUMPS_LIST(V)           \
   IGNORED_BYTECODE_LIST(V)            \
   KILL_ENVIRONMENT_LIST(V)            \
@@ -232,189 +225,130 @@ namespace compiler {
   UNCONDITIONAL_JUMPS_LIST(V)         \
   UNREACHABLE_BYTECODE_LIST(V)
 
-template <typename T, typename EqualTo>
-class FunctionalSet {
- public:
-  void Add(T const& elem, Zone* zone) {
-    for (auto const& l : data_) {
-      if (equal_to(l, elem)) return;
-    }
-    data_.PushFront(elem, zone);
-  }
-
-  bool Includes(FunctionalSet<T, EqualTo> const& other) const {
-    return std::all_of(other.begin(), other.end(), [&](T const& other_elem) {
-      return std::any_of(this->begin(), this->end(), [&](T const& this_elem) {
-        return equal_to(this_elem, other_elem);
-      });
-    });
-  }
-
-  bool IsEmpty() const { return data_.begin() == data_.end(); }
-
-  void Clear() { data_.Clear(); }
+struct HintsImpl : public ZoneObject {
+  explicit HintsImpl(Zone* zone) : zone_(zone) {}
 
-  using iterator = typename FunctionalList<T>::iterator;
-
-  iterator begin() const { return data_.begin(); }
-  iterator end() const { return data_.end(); }
+  ConstantsSet constants_;
+  MapsSet maps_;
+  VirtualClosuresSet virtual_closures_;
+  VirtualContextsSet virtual_contexts_;
+  VirtualBoundFunctionsSet virtual_bound_functions_;
 
- private:
-  static EqualTo equal_to;
-  FunctionalList<T> data_;
+  Zone* const zone_;
 };
 
-template <typename T, typename EqualTo>
-EqualTo FunctionalSet<T, EqualTo>::equal_to;
-
-struct VirtualContext {
-  unsigned int distance;
-  Handle<Context> context;
-
-  VirtualContext(unsigned int distance_in, Handle<Context> context_in)
-      : distance(distance_in), context(context_in) {
-    CHECK_GT(distance, 0);
-  }
-  bool operator==(const VirtualContext& other) const {
-    return context.equals(other.context) && distance == other.distance;
+void Hints::EnsureAllocated(Zone* zone, bool check_zone_equality) {
+  if (IsAllocated()) {
+    if (check_zone_equality) CHECK_EQ(zone, impl_->zone_);
+    // ... else {zone} lives no longer than {impl_->zone_} but we have no way of
+    // checking that.
+  } else {
+    impl_ = new (zone) HintsImpl(zone);
   }
-};
-
-class FunctionBlueprint;
-using ConstantsSet = FunctionalSet<Handle<Object>, Handle<Object>::equal_to>;
-using VirtualContextsSet =
-    FunctionalSet<VirtualContext, std::equal_to<VirtualContext>>;
-using MapsSet = FunctionalSet<Handle<Map>, Handle<Map>::equal_to>;
-using BlueprintsSet =
-    FunctionalSet<FunctionBlueprint, std::equal_to<FunctionBlueprint>>;
-
-class Hints {
- public:
-  Hints() = default;
-
-  static Hints SingleConstant(Handle<Object> constant, Zone* zone);
-
-  const ConstantsSet& constants() const;
-  const MapsSet& maps() const;
-  const BlueprintsSet& function_blueprints() const;
-  const VirtualContextsSet& virtual_contexts() const;
-
-  void AddConstant(Handle<Object> constant, Zone* zone);
-  void AddMap(Handle<Map> map, Zone* zone);
-  void AddFunctionBlueprint(FunctionBlueprint function_blueprint, Zone* zone);
-  void AddVirtualContext(VirtualContext virtual_context, Zone* zone);
+  DCHECK(IsAllocated());
+}
 
-  void Add(const Hints& other, Zone* zone);
-  void AddFromChildSerializer(const Hints& other, Zone* zone);
+struct VirtualBoundFunction {
+  Hints const bound_target;
+  HintsVector const bound_arguments;
 
-  void Clear();
-  bool IsEmpty() const;
+  VirtualBoundFunction(Hints const& target, const HintsVector& arguments)
+      : bound_target(target), bound_arguments(arguments) {}
 
-#ifdef ENABLE_SLOW_DCHECKS
-  bool Includes(Hints const& other) const;
-  bool Equals(Hints const& other) const;
-#endif
+  bool operator==(const VirtualBoundFunction& other) const {
+    if (bound_arguments.size() != other.bound_arguments.size()) return false;
+    if (bound_target != other.bound_target) return false;
 
- private:
-  VirtualContextsSet virtual_contexts_;
-  ConstantsSet constants_;
-  MapsSet maps_;
-  BlueprintsSet function_blueprints_;
+    for (size_t i = 0; i < bound_arguments.size(); ++i) {
+      if (bound_arguments[i] != other.bound_arguments[i]) return false;
+    }
+    return true;
+  }
 };
 
-using HintsVector = ZoneVector<Hints>;
-
-// A FunctionBlueprint is a SharedFunctionInfo and a FeedbackVector, plus
+// A VirtualClosure is a SharedFunctionInfo and a FeedbackVector, plus
 // Hints about the context in which a closure will be created from them.
-class FunctionBlueprint {
+class VirtualClosure {
  public:
-  FunctionBlueprint(Handle<JSFunction> function, Isolate* isolate, Zone* zone);
+  VirtualClosure(Handle<JSFunction> function, Isolate* isolate, Zone* zone);
 
-  FunctionBlueprint(Handle<SharedFunctionInfo> shared,
-                    Handle<FeedbackVector> feedback_vector,
-                    const Hints& context_hints);
+  VirtualClosure(Handle<SharedFunctionInfo> shared,
+                 Handle<FeedbackVector> feedback_vector,
+                 Hints const& context_hints);
 
   Handle<SharedFunctionInfo> shared() const { return shared_; }
   Handle<FeedbackVector> feedback_vector() const { return feedback_vector_; }
-  const Hints& context_hints() const { return context_hints_; }
-
-  bool operator==(const FunctionBlueprint& other) const {
-    // A feedback vector is never used for more than one SFI. Moreover, we can
-    // never have two blueprints with identical feedback vector (and SFI) but
-    // different hints, because:
-    // (1) A blueprint originates either (i) from the data associated with a
-    //     CreateClosure bytecode, in which case two different CreateClosure
-    //     bytecodes never have the same feedback vector, or (ii) from a
-    //     JSFunction, in which case the hints are determined by the closure.
-    // (2) We never extend a blueprint's hints after construction.
-    //
-    // It is therefore sufficient to look at the feedback vector in order to
-    // decide equality.
+  Hints const& context_hints() const { return context_hints_; }
+
+  bool operator==(const VirtualClosure& other) const {
+    // A feedback vector is never used for more than one SFI.  There might,
+    // however, be two virtual closures with the same SFI and vector, but
+    // different context hints. crbug.com/1024282 has a link to a document
+    // describing why the context_hints_ might be different in that case.
     DCHECK_IMPLIES(feedback_vector_.equals(other.feedback_vector_),
                    shared_.equals(other.shared_));
-    SLOW_DCHECK(!feedback_vector_.equals(other.feedback_vector_) ||
-                context_hints_.Equals(other.context_hints_));
-    return feedback_vector_.equals(other.feedback_vector_);
+    return feedback_vector_.equals(other.feedback_vector_) &&
+           context_hints_ == other.context_hints_;
   }
 
  private:
-  Handle<SharedFunctionInfo> shared_;
-  Handle<FeedbackVector> feedback_vector_;
-  Hints context_hints_;
+  Handle<SharedFunctionInfo> const shared_;
+  Handle<FeedbackVector> const feedback_vector_;
+  Hints const context_hints_;
 };
 
-// A CompilationSubject is a FunctionBlueprint, optionally with a matching
-// closure.
+// A CompilationSubject is a VirtualClosure, optionally with a matching
+// concrete closure.
 class CompilationSubject {
  public:
-  explicit CompilationSubject(FunctionBlueprint blueprint)
-      : blueprint_(blueprint) {}
+  explicit CompilationSubject(VirtualClosure virtual_closure)
+      : virtual_closure_(virtual_closure), closure_() {}
 
-  // The zone parameter is to correctly initialize the blueprint,
+  // The zone parameter is to correctly initialize the virtual closure,
   // which contains zone-allocated context information.
   CompilationSubject(Handle<JSFunction> closure, Isolate* isolate, Zone* zone);
 
-  const FunctionBlueprint& blueprint() const { return blueprint_; }
+  const VirtualClosure& virtual_closure() const { return virtual_closure_; }
   MaybeHandle<JSFunction> closure() const { return closure_; }
 
  private:
-  FunctionBlueprint blueprint_;
-  MaybeHandle<JSFunction> closure_;
+  VirtualClosure const virtual_closure_;
+  MaybeHandle<JSFunction> const closure_;
 };
 
 // A Callee is either a JSFunction (which may not have a feedback vector), or a
-// FunctionBlueprint. Note that this is different from CompilationSubject, which
-// always has a FunctionBlueprint.
+// VirtualClosure. Note that this is different from CompilationSubject, which
+// always has a VirtualClosure.
 class Callee {
  public:
   explicit Callee(Handle<JSFunction> jsfunction)
-      : jsfunction_(jsfunction), blueprint_() {}
-  explicit Callee(FunctionBlueprint const& blueprint)
-      : jsfunction_(), blueprint_(blueprint) {}
+      : jsfunction_(jsfunction), virtual_closure_() {}
+  explicit Callee(VirtualClosure const& virtual_closure)
+      : jsfunction_(), virtual_closure_(virtual_closure) {}
 
   Handle<SharedFunctionInfo> shared(Isolate* isolate) const {
-    return blueprint_.has_value()
-               ? blueprint_->shared()
+    return virtual_closure_.has_value()
+               ? virtual_closure_->shared()
                : handle(jsfunction_.ToHandleChecked()->shared(), isolate);
   }
 
   bool HasFeedbackVector() const {
     Handle<JSFunction> function;
-    return blueprint_.has_value() ||
+    return virtual_closure_.has_value() ||
            jsfunction_.ToHandleChecked()->has_feedback_vector();
   }
 
   CompilationSubject ToCompilationSubject(Isolate* isolate, Zone* zone) const {
     CHECK(HasFeedbackVector());
-    return blueprint_.has_value()
-               ? CompilationSubject(*blueprint_)
+    return virtual_closure_.has_value()
+               ? CompilationSubject(*virtual_closure_)
                : CompilationSubject(jsfunction_.ToHandleChecked(), isolate,
                                     zone);
   }
 
  private:
   MaybeHandle<JSFunction> const jsfunction_;
-  base::Optional<FunctionBlueprint> const blueprint_;
+  base::Optional<VirtualClosure> const virtual_closure_;
 };
 
 // If a list of arguments (hints) is shorter than the function's parameter
@@ -433,7 +367,8 @@ class SerializerForBackgroundCompilation {
       ZoneStats* zone_stats, JSHeapBroker* broker,
       CompilationDependencies* dependencies, Handle<JSFunction> closure,
       SerializerForBackgroundCompilationFlags flags, BailoutId osr_offset);
-  Hints Run();  // NOTE: Returns empty for an already-serialized function.
+  Hints Run();  // NOTE: Returns empty for an
+                // already-serialized function.
 
   class Environment;
 
@@ -443,7 +378,7 @@ class SerializerForBackgroundCompilation {
       CompilationDependencies* dependencies, CompilationSubject function,
       base::Optional<Hints> new_target, const HintsVector& arguments,
       MissingArgumentsPolicy padding,
-      SerializerForBackgroundCompilationFlags flags);
+      SerializerForBackgroundCompilationFlags flags, int nesting_level);
 
   bool BailoutOnUninitialized(ProcessedFeedback const& feedback);
 
@@ -454,19 +389,40 @@ class SerializerForBackgroundCompilation {
   SUPPORTED_BYTECODE_LIST(DECLARE_VISIT_BYTECODE)
 #undef DECLARE_VISIT_BYTECODE
 
-  void ProcessSFIForCallOrConstruct(Callee const& callee,
-                                    base::Optional<Hints> new_target,
-                                    const HintsVector& arguments,
-                                    SpeculationMode speculation_mode,
-                                    MissingArgumentsPolicy padding);
+  Hints& register_hints(interpreter::Register reg);
+
+  // Return a vector containing the hints for the given register range (in
+  // order). Also prepare these hints for feedback backpropagation by allocating
+  // any that aren't yet allocated.
+  HintsVector PrepareArgumentsHints(interpreter::Register first, size_t count);
+
+  // Like above except that the hints have to be given directly.
+  template <typename... MoreHints>
+  HintsVector PrepareArgumentsHints(Hints* hints, MoreHints... more);
+
+  void ProcessCalleeForCallOrConstruct(Callee const& callee,
+                                       base::Optional<Hints> new_target,
+                                       const HintsVector& arguments,
+                                       SpeculationMode speculation_mode,
+                                       MissingArgumentsPolicy padding,
+                                       Hints* result_hints);
   void ProcessCalleeForCallOrConstruct(Handle<Object> callee,
                                        base::Optional<Hints> new_target,
                                        const HintsVector& arguments,
                                        SpeculationMode speculation_mode,
-                                       MissingArgumentsPolicy padding);
+                                       MissingArgumentsPolicy padding,
+                                       Hints* result_hints);
   void ProcessCallOrConstruct(Hints callee, base::Optional<Hints> new_target,
-                              const HintsVector& arguments, FeedbackSlot slot,
+                              HintsVector* arguments, FeedbackSlot slot,
                               MissingArgumentsPolicy padding);
+  void ProcessCallOrConstructRecursive(Hints const& callee,
+                                       base::Optional<Hints> new_target,
+                                       const HintsVector& arguments,
+                                       SpeculationMode speculation_mode,
+                                       MissingArgumentsPolicy padding,
+                                       Hints* result_hints);
+  void ProcessNewTargetForConstruct(Hints const& new_target,
+                                    Hints* result_hints);
   void ProcessCallVarArgs(
       ConvertReceiverMode receiver_mode, Hints const& callee,
       interpreter::Register first_reg, int reg_count, FeedbackSlot slot,
@@ -479,18 +435,18 @@ class SerializerForBackgroundCompilation {
                           base::Optional<Hints> new_target,
                           const HintsVector& arguments,
                           SpeculationMode speculation_mode,
-                          MissingArgumentsPolicy padding);
+                          MissingArgumentsPolicy padding, Hints* result_hints);
 
   void ProcessJump(interpreter::BytecodeArrayIterator* iterator);
 
-  void ProcessKeyedPropertyAccess(Hints const& receiver, Hints const& key,
+  void ProcessKeyedPropertyAccess(Hints* receiver, Hints const& key,
                                   FeedbackSlot slot, AccessMode access_mode,
                                   bool honor_bailout_on_uninitialized);
-  void ProcessNamedPropertyAccess(Hints const& receiver, NameRef const& name,
+  void ProcessNamedPropertyAccess(Hints* receiver, NameRef const& name,
                                   FeedbackSlot slot, AccessMode access_mode);
-  void ProcessNamedAccess(Hints receiver, NamedAccessFeedback const& feedback,
-                          AccessMode access_mode, Hints* new_accumulator_hints);
-  void ProcessElementAccess(Hints receiver, Hints key,
+  void ProcessNamedAccess(Hints* receiver, NamedAccessFeedback const& feedback,
+                          AccessMode access_mode, Hints* result_hints);
+  void ProcessElementAccess(Hints const& receiver, Hints const& key,
                             ElementAccessFeedback const& feedback,
                             AccessMode access_mode);
 
@@ -520,8 +476,9 @@ class SerializerForBackgroundCompilation {
                                      bool honor_bailout_on_uninitialized);
 
   PropertyAccessInfo ProcessMapForNamedPropertyAccess(
-      MapRef receiver_map, NameRef const& name, AccessMode access_mode,
-      base::Optional<JSObjectRef> receiver, Hints* new_accumulator_hints);
+      Hints* receiver, MapRef receiver_map, NameRef const& name,
+      AccessMode access_mode, base::Optional<JSObjectRef> concrete_receiver,
+      Hints* result_hints);
 
   void ProcessCreateContext(interpreter::BytecodeArrayIterator* iterator,
                             int scopeinfo_operand_index);
@@ -560,6 +517,10 @@ class SerializerForBackgroundCompilation {
   void ContributeToJumpTargetEnvironment(int target_offset);
   void IncorporateJumpTargetEnvironment(int target_offset);
 
+  VirtualClosure function() const { return function_; }
+
+  Hints& return_value_hints() { return return_value_hints_; }
+
   Handle<FeedbackVector> feedback_vector() const;
   Handle<BytecodeArray> bytecode_array() const;
   BytecodeAnalysis const& GetBytecodeAnalysis(
@@ -575,10 +536,18 @@ class SerializerForBackgroundCompilation {
   JSHeapBroker* const broker_;
   CompilationDependencies* const dependencies_;
   ZoneStats::Scope zone_scope_;
-  Environment* const environment_;
-  ZoneUnorderedMap<int, Environment*> jump_target_environments_;
   SerializerForBackgroundCompilationFlags const flags_;
+  // Instead of storing the virtual_closure here, we could extract it from the
+  // {closure_hints_} but that would be cumbersome.
+  VirtualClosure const function_;
   BailoutId const osr_offset_;
+  ZoneUnorderedMap<int, Environment*> jump_target_environments_;
+  Environment* const environment_;
+  HintsVector const arguments_;
+  Hints return_value_hints_;
+  Hints closure_hints_;
+
+  int nesting_level_ = 0;
 };
 
 void RunSerializerForBackgroundCompilation(
@@ -592,104 +561,199 @@ void RunSerializerForBackgroundCompilation(
 
 using BytecodeArrayIterator = interpreter::BytecodeArrayIterator;
 
-FunctionBlueprint::FunctionBlueprint(Handle<SharedFunctionInfo> shared,
-                                     Handle<FeedbackVector> feedback_vector,
-                                     const Hints& context_hints)
+VirtualClosure::VirtualClosure(Handle<SharedFunctionInfo> shared,
+                               Handle<FeedbackVector> feedback_vector,
+                               Hints const& context_hints)
     : shared_(shared),
       feedback_vector_(feedback_vector),
       context_hints_(context_hints) {
   // The checked invariant rules out recursion and thus avoids complexity.
-  CHECK(context_hints_.function_blueprints().IsEmpty());
+  CHECK(context_hints_.virtual_closures().IsEmpty());
 }
 
-FunctionBlueprint::FunctionBlueprint(Handle<JSFunction> function,
-                                     Isolate* isolate, Zone* zone)
+VirtualClosure::VirtualClosure(Handle<JSFunction> function, Isolate* isolate,
+                               Zone* zone)
     : shared_(handle(function->shared(), isolate)),
       feedback_vector_(function->feedback_vector(), isolate),
-      context_hints_() {
-  context_hints_.AddConstant(handle(function->context(), isolate), zone);
+      context_hints_(
+          Hints::SingleConstant(handle(function->context(), isolate), zone)) {
   // The checked invariant rules out recursion and thus avoids complexity.
-  CHECK(context_hints_.function_blueprints().IsEmpty());
+  CHECK(context_hints_.virtual_closures().IsEmpty());
 }
 
 CompilationSubject::CompilationSubject(Handle<JSFunction> closure,
                                        Isolate* isolate, Zone* zone)
-    : blueprint_(closure, isolate, zone), closure_(closure) {
+    : virtual_closure_(closure, isolate, zone), closure_(closure) {
   CHECK(closure->has_feedback_vector());
 }
 
+Hints Hints::Copy(Zone* zone) const {
+  if (!IsAllocated()) return *this;
+  Hints result;
+  result.EnsureAllocated(zone);
+  result.impl_->constants_ = impl_->constants_;
+  result.impl_->maps_ = impl_->maps_;
+  result.impl_->virtual_contexts_ = impl_->virtual_contexts_;
+  result.impl_->virtual_closures_ = impl_->virtual_closures_;
+  result.impl_->virtual_bound_functions_ = impl_->virtual_bound_functions_;
+  return result;
+}
+
+bool Hints::operator==(Hints const& other) const {
+  if (impl_ == other.impl_) return true;
+  if (IsEmpty() && other.IsEmpty()) return true;
+  return IsAllocated() && other.IsAllocated() &&
+         constants() == other.constants() &&
+         virtual_closures() == other.virtual_closures() &&
+         maps() == other.maps() &&
+         virtual_contexts() == other.virtual_contexts() &&
+         virtual_bound_functions() == other.virtual_bound_functions();
+}
+
+bool Hints::operator!=(Hints const& other) const { return !(*this == other); }
+
 #ifdef ENABLE_SLOW_DCHECKS
 bool Hints::Includes(Hints const& other) const {
-  return constants().Includes(other.constants()) &&
-         function_blueprints().Includes(other.function_blueprints()) &&
+  if (impl_ == other.impl_ || other.IsEmpty()) return true;
+  return IsAllocated() && constants().Includes(other.constants()) &&
+         virtual_closures().Includes(other.virtual_closures()) &&
          maps().Includes(other.maps());
 }
-bool Hints::Equals(Hints const& other) const {
-  return this->Includes(other) && other.Includes(*this);
-}
 #endif
 
 Hints Hints::SingleConstant(Handle<Object> constant, Zone* zone) {
   Hints result;
-  result.AddConstant(constant, zone);
+  result.AddConstant(constant, zone, nullptr);
+  return result;
+}
+
+Hints Hints::SingleMap(Handle<Map> map, Zone* zone) {
+  Hints result;
+  result.AddMap(map, zone, nullptr);
   return result;
 }
 
-const ConstantsSet& Hints::constants() const { return constants_; }
+ConstantsSet Hints::constants() const {
+  return IsAllocated() ? impl_->constants_ : ConstantsSet();
+}
 
-const MapsSet& Hints::maps() const { return maps_; }
+MapsSet Hints::maps() const { return IsAllocated() ? impl_->maps_ : MapsSet(); }
 
-const BlueprintsSet& Hints::function_blueprints() const {
-  return function_blueprints_;
+VirtualClosuresSet Hints::virtual_closures() const {
+  return IsAllocated() ? impl_->virtual_closures_ : VirtualClosuresSet();
 }
 
-const VirtualContextsSet& Hints::virtual_contexts() const {
-  return virtual_contexts_;
+VirtualContextsSet Hints::virtual_contexts() const {
+  return IsAllocated() ? impl_->virtual_contexts_ : VirtualContextsSet();
 }
 
-void Hints::AddVirtualContext(VirtualContext virtual_context, Zone* zone) {
-  virtual_contexts_.Add(virtual_context, zone);
+VirtualBoundFunctionsSet Hints::virtual_bound_functions() const {
+  return IsAllocated() ? impl_->virtual_bound_functions_
+                       : VirtualBoundFunctionsSet();
 }
 
-void Hints::AddConstant(Handle<Object> constant, Zone* zone) {
-  constants_.Add(constant, zone);
+void Hints::AddVirtualContext(VirtualContext const& virtual_context, Zone* zone,
+                              JSHeapBroker* broker) {
+  EnsureAllocated(zone);
+  if (impl_->virtual_contexts_.Size() >= kMaxHintsSize) {
+    TRACE_BROKER_MISSING(broker,
+                         "opportunity - limit for virtual contexts reached.");
+    return;
+  }
+  impl_->virtual_contexts_.Add(virtual_context, impl_->zone_);
 }
 
-void Hints::AddMap(Handle<Map> map, Zone* zone) { maps_.Add(map, zone); }
+void Hints::AddConstant(Handle<Object> constant, Zone* zone,
+                        JSHeapBroker* broker) {
+  EnsureAllocated(zone);
+  if (impl_->constants_.Size() >= kMaxHintsSize) {
+    TRACE_BROKER_MISSING(broker, "opportunity - limit for constants reached.");
+    return;
+  }
+  impl_->constants_.Add(constant, impl_->zone_);
+}
 
-void Hints::AddFunctionBlueprint(FunctionBlueprint function_blueprint,
-                                 Zone* zone) {
-  function_blueprints_.Add(function_blueprint, zone);
+void Hints::AddMap(Handle<Map> map, Zone* zone, JSHeapBroker* broker,
+                   bool check_zone_equality) {
+  EnsureAllocated(zone, check_zone_equality);
+  if (impl_->maps_.Size() >= kMaxHintsSize) {
+    TRACE_BROKER_MISSING(broker, "opportunity - limit for maps reached.");
+    return;
+  }
+  impl_->maps_.Add(map, impl_->zone_);
 }
 
-void Hints::Add(const Hints& other, Zone* zone) {
-  for (auto x : other.constants()) AddConstant(x, zone);
-  for (auto x : other.maps()) AddMap(x, zone);
-  for (auto x : other.function_blueprints()) AddFunctionBlueprint(x, zone);
-  for (auto x : other.virtual_contexts()) AddVirtualContext(x, zone);
+void Hints::AddVirtualClosure(VirtualClosure const& virtual_closure, Zone* zone,
+                              JSHeapBroker* broker) {
+  EnsureAllocated(zone);
+  if (impl_->virtual_closures_.Size() >= kMaxHintsSize) {
+    TRACE_BROKER_MISSING(broker,
+                         "opportunity - limit for virtual closures reached.");
+    return;
+  }
+  impl_->virtual_closures_.Add(virtual_closure, impl_->zone_);
 }
 
-void Hints::AddFromChildSerializer(const Hints& other, Zone* zone) {
-  for (auto x : other.constants()) AddConstant(x, zone);
-  for (auto x : other.maps()) AddMap(x, zone);
-  for (auto x : other.virtual_contexts()) AddVirtualContext(x, zone);
+void Hints::AddVirtualBoundFunction(VirtualBoundFunction const& bound_function,
+                                    Zone* zone, JSHeapBroker* broker) {
+  EnsureAllocated(zone);
+  if (impl_->virtual_bound_functions_.Size() >= kMaxHintsSize) {
+    TRACE_BROKER_MISSING(
+        broker, "opportunity - limit for virtual bound functions reached.");
+    return;
+  }
+  // TODO(mslekova): Consider filtering the hints in the added bound function,
+  // for example: a) Remove any non-JS(Bound)Function constants, b) Truncate the
+  // argument vector the formal parameter count.
+  impl_->virtual_bound_functions_.Add(bound_function, impl_->zone_);
+}
+
+void Hints::Add(Hints const& other, Zone* zone, JSHeapBroker* broker) {
+  if (impl_ == other.impl_ || other.IsEmpty()) return;
+  EnsureAllocated(zone);
+  if (!Union(other)) {
+    TRACE_BROKER_MISSING(broker, "opportunity - hints limit reached.");
+  }
+}
+
+Hints Hints::CopyToParentZone(Zone* zone, JSHeapBroker* broker) const {
+  if (!IsAllocated()) return *this;
+
+  Hints result;
+
+  for (auto const& x : constants()) result.AddConstant(x, zone, broker);
+  for (auto const& x : maps()) result.AddMap(x, zone, broker);
+  for (auto const& x : virtual_contexts())
+    result.AddVirtualContext(x, zone, broker);
 
   // Adding hints from a child serializer run means copying data out from
-  // a zone that's being destroyed. FunctionBlueprints have zone allocated
-  // data, so we've got to make a deep copy to eliminate traces of the
-  // dying zone.
-  for (auto x : other.function_blueprints()) {
-    Hints new_blueprint_hints;
-    new_blueprint_hints.AddFromChildSerializer(x.context_hints(), zone);
-    FunctionBlueprint new_blueprint(x.shared(), x.feedback_vector(),
-                                    new_blueprint_hints);
-    AddFunctionBlueprint(new_blueprint, zone);
+  // a zone that's being destroyed. VirtualClosures and VirtualBoundFunction
+  // have zone allocated data, so we've got to make a deep copy to eliminate
+  // traces of the dying zone.
+  for (auto const& x : virtual_closures()) {
+    VirtualClosure new_virtual_closure(
+        x.shared(), x.feedback_vector(),
+        x.context_hints().CopyToParentZone(zone, broker));
+    result.AddVirtualClosure(new_virtual_closure, zone, broker);
+  }
+  for (auto const& x : virtual_bound_functions()) {
+    HintsVector new_arguments_hints(zone);
+    for (auto hint : x.bound_arguments) {
+      new_arguments_hints.push_back(hint.CopyToParentZone(zone, broker));
+    }
+    VirtualBoundFunction new_bound_function(
+        x.bound_target.CopyToParentZone(zone, broker), new_arguments_hints);
+    result.AddVirtualBoundFunction(new_bound_function, zone, broker);
   }
+
+  return result;
 }
 
 bool Hints::IsEmpty() const {
+  if (!IsAllocated()) return true;
   return constants().IsEmpty() && maps().IsEmpty() &&
-         function_blueprints().IsEmpty() && virtual_contexts().IsEmpty();
+         virtual_closures().IsEmpty() && virtual_contexts().IsEmpty() &&
+         virtual_bound_functions().IsEmpty();
 }
 
 std::ostream& operator<<(std::ostream& out,
@@ -702,36 +766,49 @@ std::ostream& operator<<(std::ostream& out,
 std::ostream& operator<<(std::ostream& out, const Hints& hints);
 
 std::ostream& operator<<(std::ostream& out,
-                         const FunctionBlueprint& blueprint) {
-  out << Brief(*blueprint.shared()) << std::endl;
-  out << Brief(*blueprint.feedback_vector()) << std::endl;
-  !blueprint.context_hints().IsEmpty() && out << blueprint.context_hints()
-                                              << "):" << std::endl;
+                         const VirtualClosure& virtual_closure) {
+  out << Brief(*virtual_closure.shared()) << std::endl;
+  out << Brief(*virtual_closure.feedback_vector()) << std::endl;
+  !virtual_closure.context_hints().IsEmpty() &&
+      out << virtual_closure.context_hints() << "):" << std::endl;
+  return out;
+}
+
+std::ostream& operator<<(std::ostream& out,
+                         const VirtualBoundFunction& virtual_bound_function) {
+  out << std::endl << "    Target: " << virtual_bound_function.bound_target;
+  out << "    Arguments:" << std::endl;
+  for (auto hint : virtual_bound_function.bound_arguments) {
+    out << "    " << hint;
+  }
   return out;
 }
 
 std::ostream& operator<<(std::ostream& out, const Hints& hints) {
+  out << "(impl_ = " << hints.impl_ << ")\n";
   for (Handle<Object> constant : hints.constants()) {
     out << "  constant " << Brief(*constant) << std::endl;
   }
   for (Handle<Map> map : hints.maps()) {
     out << "  map " << Brief(*map) << std::endl;
   }
-  for (FunctionBlueprint const& blueprint : hints.function_blueprints()) {
-    out << "  blueprint " << blueprint << std::endl;
+  for (VirtualClosure const& virtual_closure : hints.virtual_closures()) {
+    out << "  virtual closure " << virtual_closure << std::endl;
   }
   for (VirtualContext const& virtual_context : hints.virtual_contexts()) {
     out << "  virtual context " << virtual_context << std::endl;
   }
+  for (VirtualBoundFunction const& virtual_bound_function :
+       hints.virtual_bound_functions()) {
+    out << "  virtual bound function " << virtual_bound_function << std::endl;
+  }
   return out;
 }
 
-void Hints::Clear() {
-  virtual_contexts_.Clear();
-  constants_.Clear();
-  maps_.Clear();
-  function_blueprints_.Clear();
-  DCHECK(IsEmpty());
+void Hints::Reset(Hints* other, Zone* zone) {
+  other->EnsureShareable(zone);
+  *this = *other;
+  DCHECK(IsAllocated());
 }
 
 class SerializerForBackgroundCompilation::Environment : public ZoneObject {
@@ -741,102 +818,56 @@ class SerializerForBackgroundCompilation::Environment : public ZoneObject {
               base::Optional<Hints> new_target, const HintsVector& arguments,
               MissingArgumentsPolicy padding);
 
-  bool IsDead() const { return ephemeral_hints_.empty(); }
+  bool IsDead() const { return !alive_; }
 
   void Kill() {
     DCHECK(!IsDead());
-    ephemeral_hints_.clear();
+    alive_ = false;
     DCHECK(IsDead());
   }
 
-  void Revive() {
+  void Resurrect() {
     DCHECK(IsDead());
-    ephemeral_hints_.resize(ephemeral_hints_size(), Hints());
+    alive_ = true;
     DCHECK(!IsDead());
   }
 
   // Merge {other} into {this} environment (leaving {other} unmodified).
-  void Merge(Environment* other);
-
-  FunctionBlueprint function() const { return function_; }
+  void Merge(Environment* other, Zone* zone, JSHeapBroker* broker);
 
-  Hints const& closure_hints() const { return closure_hints_; }
   Hints const& current_context_hints() const { return current_context_hints_; }
-  Hints& current_context_hints() { return current_context_hints_; }
-  Hints const& return_value_hints() const { return return_value_hints_; }
-  Hints& return_value_hints() { return return_value_hints_; }
+  Hints const& accumulator_hints() const { return accumulator_hints_; }
 
-  Hints& accumulator_hints() {
-    CHECK_LT(accumulator_index(), ephemeral_hints_.size());
-    return ephemeral_hints_[accumulator_index()];
-  }
-
-  Hints& register_hints(interpreter::Register reg) {
-    if (reg.is_function_closure()) return closure_hints_;
-    if (reg.is_current_context()) return current_context_hints_;
-    int local_index = RegisterToLocalIndex(reg);
-    CHECK_LT(local_index, ephemeral_hints_.size());
-    return ephemeral_hints_[local_index];
-  }
-
-  // Clears all hints except those for the context, return value, and the
-  // closure.
-  void ClearEphemeralHints() {
-    for (auto& hints : ephemeral_hints_) hints.Clear();
-  }
-
-  // Appends the hints for the given register range to {dst} (in order).
-  void ExportRegisterHints(interpreter::Register first, size_t count,
-                           HintsVector* dst);
+  Hints& current_context_hints() { return current_context_hints_; }
+  Hints& accumulator_hints() { return accumulator_hints_; }
+  Hints& register_hints(interpreter::Register reg);
 
  private:
   friend std::ostream& operator<<(std::ostream& out, const Environment& env);
 
-  int RegisterToLocalIndex(interpreter::Register reg) const;
-
-  int parameter_count() const { return parameter_count_; }
-  int register_count() const { return register_count_; }
-
-  Zone* const zone_;
-  // Instead of storing the blueprint here, we could extract it from the
-  // (closure) hints but that would be cumbersome.
-  FunctionBlueprint const function_;
-  int const parameter_count_;
-  int const register_count_;
-
-  Hints closure_hints_;
   Hints current_context_hints_;
-  Hints return_value_hints_;
+  Hints accumulator_hints_;
 
-  // ephemeral_hints_ contains hints for the contents of the registers,
-  // the accumulator and the parameters. The layout is as follows:
-  // [ parameters | registers | accumulator ]
-  // The first parameter is the receiver.
-  HintsVector ephemeral_hints_;
-  int accumulator_index() const { return parameter_count() + register_count(); }
-  int ephemeral_hints_size() const { return accumulator_index() + 1; }
+  HintsVector parameters_hints_;  // First parameter is the receiver.
+  HintsVector locals_hints_;
+
+  bool alive_ = true;
 };
 
 SerializerForBackgroundCompilation::Environment::Environment(
     Zone* zone, CompilationSubject function)
-    : zone_(zone),
-      function_(function.blueprint()),
-      parameter_count_(
-          function_.shared()->GetBytecodeArray().parameter_count()),
-      register_count_(function_.shared()->GetBytecodeArray().register_count()),
-      closure_hints_(),
-      current_context_hints_(),
-      return_value_hints_(),
-      ephemeral_hints_(ephemeral_hints_size(), Hints(), zone) {
-  Handle<JSFunction> closure;
-  if (function.closure().ToHandle(&closure)) {
-    closure_hints_.AddConstant(closure, zone);
-  } else {
-    closure_hints_.AddFunctionBlueprint(function.blueprint(), zone);
-  }
-
-  // Consume blueprint context hint information.
-  current_context_hints().Add(function.blueprint().context_hints(), zone);
+    : parameters_hints_(function.virtual_closure()
+                            .shared()
+                            ->GetBytecodeArray()
+                            .parameter_count(),
+                        Hints(), zone),
+      locals_hints_(function.virtual_closure()
+                        .shared()
+                        ->GetBytecodeArray()
+                        .register_count(),
+                    Hints(), zone) {
+  // Consume the virtual_closure's context hint information.
+  current_context_hints_ = function.virtual_closure().context_hints();
 }
 
 SerializerForBackgroundCompilation::Environment::Environment(
@@ -844,112 +875,158 @@ SerializerForBackgroundCompilation::Environment::Environment(
     base::Optional<Hints> new_target, const HintsVector& arguments,
     MissingArgumentsPolicy padding)
     : Environment(zone, function) {
-  // Copy the hints for the actually passed arguments, at most up to
+  // Set the hints for the actually passed arguments, at most up to
   // the parameter_count.
-  size_t param_count = static_cast<size_t>(parameter_count());
-  for (size_t i = 0; i < std::min(arguments.size(), param_count); ++i) {
-    ephemeral_hints_[i] = arguments[i];
+  for (size_t i = 0; i < std::min(arguments.size(), parameters_hints_.size());
+       ++i) {
+    parameters_hints_[i] = arguments[i];
   }
 
   if (padding == kMissingArgumentsAreUndefined) {
-    Hints undefined_hint =
+    Hints const undefined_hint =
         Hints::SingleConstant(isolate->factory()->undefined_value(), zone);
-    for (size_t i = arguments.size(); i < param_count; ++i) {
-      ephemeral_hints_[i] = undefined_hint;
+    for (size_t i = arguments.size(); i < parameters_hints_.size(); ++i) {
+      parameters_hints_[i] = undefined_hint;
     }
   } else {
     DCHECK_EQ(padding, kMissingArgumentsAreUnknown);
   }
 
+  // Set hints for new_target.
   interpreter::Register new_target_reg =
-      function_.shared()
+      function.virtual_closure()
+          .shared()
           ->GetBytecodeArray()
           .incoming_new_target_or_generator_register();
   if (new_target_reg.is_valid()) {
-    DCHECK(register_hints(new_target_reg).IsEmpty());
-    if (new_target.has_value()) {
-      register_hints(new_target_reg).Add(*new_target, zone);
-    }
+    Hints& hints = register_hints(new_target_reg);
+    CHECK(hints.IsEmpty());
+    if (new_target.has_value()) hints = *new_target;
   }
 }
 
+Hints& SerializerForBackgroundCompilation::register_hints(
+    interpreter::Register reg) {
+  if (reg.is_function_closure()) return closure_hints_;
+  return environment()->register_hints(reg);
+}
+
+Hints& SerializerForBackgroundCompilation::Environment::register_hints(
+    interpreter::Register reg) {
+  if (reg.is_current_context()) return current_context_hints_;
+  if (reg.is_parameter()) {
+    return parameters_hints_[reg.ToParameterIndex(
+        static_cast<int>(parameters_hints_.size()))];
+  }
+  DCHECK(!reg.is_function_closure());
+  CHECK_LT(reg.index(), locals_hints_.size());
+  return locals_hints_[reg.index()];
+}
+
 void SerializerForBackgroundCompilation::Environment::Merge(
-    Environment* other) {
+    Environment* other, Zone* zone, JSHeapBroker* broker) {
   // {other} is guaranteed to have the same layout because it comes from an
   // earlier bytecode in the same function.
-  CHECK_EQ(parameter_count(), other->parameter_count());
-  CHECK_EQ(register_count(), other->register_count());
-
-  SLOW_DCHECK(closure_hints_.Equals(other->closure_hints_));
+  DCHECK_EQ(parameters_hints_.size(), other->parameters_hints_.size());
+  DCHECK_EQ(locals_hints_.size(), other->locals_hints_.size());
 
   if (IsDead()) {
-    ephemeral_hints_ = other->ephemeral_hints_;
-    SLOW_DCHECK(return_value_hints_.Includes(other->return_value_hints_));
-    CHECK(!IsDead());
-    return;
+    parameters_hints_ = other->parameters_hints_;
+    locals_hints_ = other->locals_hints_;
+    current_context_hints_ = other->current_context_hints_;
+    accumulator_hints_ = other->accumulator_hints_;
+    Resurrect();
+  } else {
+    for (size_t i = 0; i < parameters_hints_.size(); ++i) {
+      parameters_hints_[i].Merge(other->parameters_hints_[i], zone, broker);
+    }
+    for (size_t i = 0; i < locals_hints_.size(); ++i) {
+      locals_hints_[i].Merge(other->locals_hints_[i], zone, broker);
+    }
+    current_context_hints_.Merge(other->current_context_hints_, zone, broker);
+    accumulator_hints_.Merge(other->accumulator_hints_, zone, broker);
   }
 
-  CHECK_EQ(ephemeral_hints_.size(), other->ephemeral_hints_.size());
-  for (size_t i = 0; i < ephemeral_hints_.size(); ++i) {
-    ephemeral_hints_[i].Add(other->ephemeral_hints_[i], zone_);
+  CHECK(!IsDead());
+}
+
+bool Hints::Union(Hints const& other) {
+  CHECK(IsAllocated());
+  if (impl_->constants_.Size() + other.constants().Size() > kMaxHintsSize ||
+      impl_->maps_.Size() + other.maps().Size() > kMaxHintsSize ||
+      impl_->virtual_closures_.Size() + other.virtual_closures().Size() >
+          kMaxHintsSize ||
+      impl_->virtual_contexts_.Size() + other.virtual_contexts().Size() >
+          kMaxHintsSize ||
+      impl_->virtual_bound_functions_.Size() +
+              other.virtual_bound_functions().Size() >
+          kMaxHintsSize) {
+    return false;
   }
+  Zone* zone = impl_->zone_;
+  impl_->constants_.Union(other.constants(), zone);
+  impl_->maps_.Union(other.maps(), zone);
+  impl_->virtual_closures_.Union(other.virtual_closures(), zone);
+  impl_->virtual_contexts_.Union(other.virtual_contexts(), zone);
+  impl_->virtual_bound_functions_.Union(other.virtual_bound_functions(), zone);
+  return true;
+}
 
-  return_value_hints_.Add(other->return_value_hints_, zone_);
+void Hints::Merge(Hints const& other, Zone* zone, JSHeapBroker* broker) {
+  if (impl_ == other.impl_) {
+    return;
+  }
+  if (!IsAllocated()) {
+    *this = other.Copy(zone);
+    DCHECK(IsAllocated());
+    return;
+  }
+  *this = this->Copy(zone);
+  if (!Union(other)) {
+    TRACE_BROKER_MISSING(broker, "opportunity - hints limit reached.");
+  }
+  DCHECK(IsAllocated());
 }
 
 std::ostream& operator<<(
     std::ostream& out,
     const SerializerForBackgroundCompilation::Environment& env) {
   std::ostringstream output_stream;
-  output_stream << "Function ";
-  env.function_.shared()->Name().Print(output_stream);
 
   if (env.IsDead()) {
     output_stream << "dead\n";
   } else {
     output_stream << "alive\n";
-    for (int i = 0; i < static_cast<int>(env.ephemeral_hints_.size()); ++i) {
-      Hints const& hints = env.ephemeral_hints_[i];
+    for (size_t i = 0; i < env.parameters_hints_.size(); ++i) {
+      Hints const& hints = env.parameters_hints_[i];
       if (!hints.IsEmpty()) {
-        if (i < env.parameter_count()) {
-          output_stream << "Hints for a" << i << ":\n";
-        } else if (i < env.parameter_count() + env.register_count()) {
-          int local_register = i - env.parameter_count();
-          output_stream << "Hints for r" << local_register << ":\n";
-        } else if (i == env.accumulator_index()) {
-          output_stream << "Hints for <accumulator>:\n";
+        if (i == 0) {
+          output_stream << "Hints for <this>: ";
         } else {
-          UNREACHABLE();
+          output_stream << "Hints for a" << i - 1 << ": ";
         }
         output_stream << hints;
       }
     }
+    for (size_t i = 0; i < env.locals_hints_.size(); ++i) {
+      Hints const& hints = env.locals_hints_[i];
+      if (!hints.IsEmpty()) {
+        output_stream << "Hints for r" << i << ": " << hints;
+      }
+    }
   }
 
-  if (!env.closure_hints().IsEmpty()) {
-    output_stream << "Hints for <closure>:\n" << env.closure_hints();
-  }
   if (!env.current_context_hints().IsEmpty()) {
-    output_stream << "Hints for <context>:\n" << env.current_context_hints();
+    output_stream << "Hints for <context>: " << env.current_context_hints();
   }
-  if (!env.return_value_hints().IsEmpty()) {
-    output_stream << "Hints for {return value}:\n" << env.return_value_hints();
+  if (!env.accumulator_hints().IsEmpty()) {
+    output_stream << "Hints for <accumulator>: " << env.accumulator_hints();
   }
 
   out << output_stream.str();
   return out;
 }
 
-int SerializerForBackgroundCompilation::Environment::RegisterToLocalIndex(
-    interpreter::Register reg) const {
-  if (reg.is_parameter()) {
-    return reg.ToParameterIndex(parameter_count());
-  } else {
-    DCHECK(!reg.is_function_closure());
-    return parameter_count() + reg.index();
-  }
-}
-
 SerializerForBackgroundCompilation::SerializerForBackgroundCompilation(
     ZoneStats* zone_stats, JSHeapBroker* broker,
     CompilationDependencies* dependencies, Handle<JSFunction> closure,
@@ -957,12 +1034,18 @@ SerializerForBackgroundCompilation::SerializerForBackgroundCompilation(
     : broker_(broker),
       dependencies_(dependencies),
       zone_scope_(zone_stats, ZONE_NAME),
+      flags_(flags),
+      function_(closure, broker->isolate(), zone()),
+      osr_offset_(osr_offset),
+      jump_target_environments_(zone()),
       environment_(new (zone()) Environment(
           zone(), CompilationSubject(closure, broker_->isolate(), zone()))),
-      jump_target_environments_(zone()),
-      flags_(flags),
-      osr_offset_(osr_offset) {
+      arguments_(zone()) {
+  closure_hints_.AddConstant(closure, zone(), broker_);
   JSFunctionRef(broker, closure).Serialize();
+
+  TRACE_BROKER(broker_, "Hints for <closure>: " << closure_hints_);
+  TRACE_BROKER(broker_, "Initial environment:\n" << *environment_);
 }
 
 SerializerForBackgroundCompilation::SerializerForBackgroundCompilation(
@@ -970,24 +1053,30 @@ SerializerForBackgroundCompilation::SerializerForBackgroundCompilation(
     CompilationDependencies* dependencies, CompilationSubject function,
     base::Optional<Hints> new_target, const HintsVector& arguments,
     MissingArgumentsPolicy padding,
-    SerializerForBackgroundCompilationFlags flags)
+    SerializerForBackgroundCompilationFlags flags, int nesting_level)
     : broker_(broker),
       dependencies_(dependencies),
       zone_scope_(zone_stats, ZONE_NAME),
+      flags_(flags),
+      function_(function.virtual_closure()),
+      osr_offset_(BailoutId::None()),
+      jump_target_environments_(zone()),
       environment_(new (zone())
                        Environment(zone(), broker_->isolate(), function,
                                    new_target, arguments, padding)),
-      jump_target_environments_(zone()),
-      flags_(flags),
-      osr_offset_(BailoutId::None()) {
-  TraceScope tracer(
-      broker_, this,
-      "SerializerForBackgroundCompilation::SerializerForBackgroundCompilation");
-  TRACE_BROKER(broker_, "Initial environment:\n" << *environment_);
+      arguments_(arguments),
+      nesting_level_(nesting_level) {
   Handle<JSFunction> closure;
   if (function.closure().ToHandle(&closure)) {
+    closure_hints_.AddConstant(closure, zone(), broker);
     JSFunctionRef(broker, closure).Serialize();
+  } else {
+    closure_hints_.AddVirtualClosure(function.virtual_closure(), zone(),
+                                     broker);
   }
+
+  TRACE_BROKER(broker_, "Hints for <closure>: " << closure_hints_);
+  TRACE_BROKER(broker_, "Initial environment:\n" << *environment_);
 }
 
 bool SerializerForBackgroundCompilation::BailoutOnUninitialized(
@@ -1011,17 +1100,35 @@ bool SerializerForBackgroundCompilation::BailoutOnUninitialized(
 
 Hints SerializerForBackgroundCompilation::Run() {
   TraceScope tracer(broker(), this, "SerializerForBackgroundCompilation::Run");
+  if (nesting_level_ >= FLAG_max_serializer_nesting) {
+    TRACE_BROKER_MISSING(
+        broker(),
+        "opportunity - Reached max nesting level for "
+        "SerializerForBackgroundCompilation::Run, bailing out.\n");
+    return Hints();
+  }
+
   TRACE_BROKER_MEMORY(broker(), "[serializer start] Broker zone usage: "
                                     << broker()->zone()->allocation_size());
-  SharedFunctionInfoRef shared(broker(), environment()->function().shared());
+  SharedFunctionInfoRef shared(broker(), function().shared());
   FeedbackVectorRef feedback_vector_ref(broker(), feedback_vector());
-  if (shared.IsSerializedForCompilation(feedback_vector_ref)) {
-    TRACE_BROKER(broker(), "Already ran serializer for SharedFunctionInfo "
-                               << Brief(*shared.object())
-                               << ", bailing out.\n");
+  if (!broker()->ShouldBeSerializedForCompilation(shared, feedback_vector_ref,
+                                                  arguments_)) {
+    TRACE_BROKER(broker(),
+                 "opportunity - Already ran serializer for SharedFunctionInfo "
+                     << Brief(*shared.object()) << ", bailing out.\n");
     return Hints();
   }
-  shared.SetSerializedForCompilation(feedback_vector_ref);
+
+  {
+    HintsVector arguments_copy_in_broker_zone(broker()->zone());
+    for (auto const& hints : arguments_) {
+      arguments_copy_in_broker_zone.push_back(
+          hints.CopyToParentZone(broker()->zone(), broker()));
+    }
+    broker()->SetSerializedForCompilation(shared, feedback_vector_ref,
+                                          arguments_copy_in_broker_zone);
+  }
 
   // We eagerly call the {EnsureSourcePositionsAvailable} for all serialized
   // SFIs while still on the main thread. Source positions will later be used
@@ -1035,49 +1142,91 @@ Hints SerializerForBackgroundCompilation::Run() {
   feedback_vector_ref.Serialize();
   TraverseBytecode();
 
+  if (return_value_hints().IsEmpty()) {
+    TRACE_BROKER(broker(), "Return value hints: none");
+  } else {
+    TRACE_BROKER(broker(), "Return value hints: " << return_value_hints());
+  }
   TRACE_BROKER_MEMORY(broker(), "[serializer end] Broker zone usage: "
                                     << broker()->zone()->allocation_size());
-  return environment()->return_value_hints();
+  return return_value_hints();
 }
 
-class ExceptionHandlerMatcher {
+class HandlerRangeMatcher {
  public:
-  explicit ExceptionHandlerMatcher(
-      BytecodeArrayIterator const& bytecode_iterator,
-      Handle<BytecodeArray> bytecode_array)
+  HandlerRangeMatcher(BytecodeArrayIterator const& bytecode_iterator,
+                      Handle<BytecodeArray> bytecode_array)
       : bytecode_iterator_(bytecode_iterator) {
     HandlerTable table(*bytecode_array);
     for (int i = 0, n = table.NumberOfRangeEntries(); i < n; ++i) {
-      handlers_.insert(table.GetRangeHandler(i));
+      ranges_.insert({table.GetRangeStart(i), table.GetRangeEnd(i),
+                      table.GetRangeHandler(i)});
     }
-    handlers_iterator_ = handlers_.cbegin();
+    ranges_iterator_ = ranges_.cbegin();
   }
 
-  bool CurrentBytecodeIsExceptionHandlerStart() {
+  using OffsetReporter = std::function<void(int handler_offset)>;
+
+  void HandlerOffsetForCurrentPosition(const OffsetReporter& offset_reporter) {
     CHECK(!bytecode_iterator_.done());
-    while (handlers_iterator_ != handlers_.cend() &&
-           *handlers_iterator_ < bytecode_iterator_.current_offset()) {
-      handlers_iterator_++;
+    const int current_offset = bytecode_iterator_.current_offset();
+
+    // Remove outdated try ranges from the stack.
+    while (!stack_.empty()) {
+      const int end = stack_.top().end;
+      if (end < current_offset) {
+        stack_.pop();
+      } else {
+        break;
+      }
+    }
+
+    // Advance the iterator and maintain the stack.
+    while (ranges_iterator_ != ranges_.cend() &&
+           ranges_iterator_->start <= current_offset) {
+      if (ranges_iterator_->end >= current_offset) {
+        stack_.push(*ranges_iterator_);
+        if (ranges_iterator_->start == current_offset) {
+          offset_reporter(ranges_iterator_->handler);
+        }
+      }
+      ranges_iterator_++;
+    }
+
+    if (!stack_.empty() && stack_.top().start < current_offset) {
+      offset_reporter(stack_.top().handler);
     }
-    return handlers_iterator_ != handlers_.cend() &&
-           *handlers_iterator_ == bytecode_iterator_.current_offset();
   }
 
  private:
   BytecodeArrayIterator const& bytecode_iterator_;
-  std::set<int> handlers_;
-  std::set<int>::const_iterator handlers_iterator_;
+
+  struct Range {
+    int start;
+    int end;
+    int handler;
+    friend bool operator<(const Range& a, const Range& b) {
+      if (a.start < b.start) return true;
+      if (a.start == b.start) {
+        if (a.end < b.end) return true;
+        CHECK_GT(a.end, b.end);
+      }
+      return false;
+    }
+  };
+  std::set<Range> ranges_;
+  std::set<Range>::const_iterator ranges_iterator_;
+  std::stack<Range> stack_;
 };
 
 Handle<FeedbackVector> SerializerForBackgroundCompilation::feedback_vector()
     const {
-  return environment()->function().feedback_vector();
+  return function().feedback_vector();
 }
 
 Handle<BytecodeArray> SerializerForBackgroundCompilation::bytecode_array()
     const {
-  return handle(environment()->function().shared()->GetBytecodeArray(),
-                broker()->isolate());
+  return handle(function().shared()->GetBytecodeArray(), broker()->isolate());
 }
 
 BytecodeAnalysis const& SerializerForBackgroundCompilation::GetBytecodeAnalysis(
@@ -1095,7 +1244,7 @@ void SerializerForBackgroundCompilation::TraverseBytecode() {
   BytecodeArrayRef(broker(), bytecode_array()).SerializeForCompilation();
 
   BytecodeArrayIterator iterator(bytecode_array());
-  ExceptionHandlerMatcher handler_matcher(iterator, bytecode_array());
+  HandlerRangeMatcher try_start_matcher(iterator, bytecode_array());
 
   bool has_one_shot_bytecode = false;
   for (; !iterator.done(); iterator.Advance()) {
@@ -1104,6 +1253,9 @@ void SerializerForBackgroundCompilation::TraverseBytecode() {
         interpreter::Bytecodes::IsOneShotBytecode(iterator.current_bytecode());
 
     int const current_offset = iterator.current_offset();
+
+    // TODO(mvstanton): we might want to ignore the current environment if we
+    // are at the start of a catch handler.
     IncorporateJumpTargetEnvironment(current_offset);
 
     TRACE_BROKER(broker(),
@@ -1112,13 +1264,20 @@ void SerializerForBackgroundCompilation::TraverseBytecode() {
     TRACE_BROKER(broker(), "Current environment: " << *environment());
 
     if (environment()->IsDead()) {
-      if (handler_matcher.CurrentBytecodeIsExceptionHandlerStart()) {
-        environment()->Revive();
-      } else {
-        continue;  // Skip this bytecode since TF won't generate code for it.
-      }
+      continue;  // Skip this bytecode since TF won't generate code for it.
     }
 
+    auto save_handler_environments = [&](int handler_offset) {
+      auto it = jump_target_environments_.find(handler_offset);
+      if (it == jump_target_environments_.end()) {
+        ContributeToJumpTargetEnvironment(handler_offset);
+        TRACE_BROKER(broker(),
+                     "Handler offset for current pos: " << handler_offset);
+      }
+    };
+    try_start_matcher.HandlerOffsetForCurrentPosition(
+        save_handler_environments);
+
     if (bytecode_analysis.IsLoopHeader(current_offset)) {
       // Graph builder might insert jumps to resume targets in the loop body.
       LoopInfo const& loop_info =
@@ -1135,10 +1294,8 @@ void SerializerForBackgroundCompilation::TraverseBytecode() {
     break;
       SUPPORTED_BYTECODE_LIST(DEFINE_BYTECODE_CASE)
 #undef DEFINE_BYTECODE_CASE
-      default: {
-        environment()->ClearEphemeralHints();
+      default:
         break;
-      }
     }
   }
 
@@ -1150,26 +1307,26 @@ void SerializerForBackgroundCompilation::TraverseBytecode() {
 
 void SerializerForBackgroundCompilation::VisitGetIterator(
     BytecodeArrayIterator* iterator) {
-  Hints const& receiver =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
-  Handle<Name> name = broker()->isolate()->factory()->iterator_symbol();
+  Hints* receiver = &register_hints(iterator->GetRegisterOperand(0));
   FeedbackSlot load_slot = iterator->GetSlotOperand(1);
+  FeedbackSlot call_slot = iterator->GetSlotOperand(2);
+
+  Handle<Name> name = broker()->isolate()->factory()->iterator_symbol();
   ProcessNamedPropertyAccess(receiver, NameRef(broker(), name), load_slot,
                              AccessMode::kLoad);
   if (environment()->IsDead()) return;
 
-  const Hints& callee = Hints();
-  FeedbackSlot call_slot = iterator->GetSlotOperand(2);
-  HintsVector parameters({receiver}, zone());
-  ProcessCallOrConstruct(callee, base::nullopt, parameters, call_slot,
+  Hints callee;
+  HintsVector args = PrepareArgumentsHints(receiver);
+
+  ProcessCallOrConstruct(callee, base::nullopt, &args, call_slot,
                          kMissingArgumentsAreUndefined);
 }
 
 void SerializerForBackgroundCompilation::VisitGetSuperConstructor(
     BytecodeArrayIterator* iterator) {
   interpreter::Register dst = iterator->GetRegisterOperand(0);
-  environment()->register_hints(dst).Clear();
-
+  Hints result_hints;
   for (auto constant : environment()->accumulator_hints().constants()) {
     // For JSNativeContextSpecialization::ReduceJSGetSuperConstructor.
     if (!constant->IsJSFunction()) continue;
@@ -1178,9 +1335,10 @@ void SerializerForBackgroundCompilation::VisitGetSuperConstructor(
     map.SerializePrototype();
     ObjectRef proto = map.prototype();
     if (proto.IsHeapObject() && proto.AsHeapObject().map().is_constructor()) {
-      environment()->register_hints(dst).AddConstant(proto.object(), zone());
+      result_hints.AddConstant(proto.object(), zone(), broker());
     }
   }
+  register_hints(dst) = result_hints;
 }
 
 void SerializerForBackgroundCompilation::VisitGetTemplateObject(
@@ -1189,63 +1347,54 @@ void SerializerForBackgroundCompilation::VisitGetTemplateObject(
       broker(), iterator->GetConstantForIndexOperand(0, broker()->isolate()));
   FeedbackSlot slot = iterator->GetSlotOperand(1);
   FeedbackSource source(feedback_vector(), slot);
-  SharedFunctionInfoRef shared(broker(), environment()->function().shared());
+  SharedFunctionInfoRef shared(broker(), function().shared());
   JSArrayRef template_object = shared.GetTemplateObject(
       description, source, SerializationPolicy::kSerializeIfNeeded);
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().AddConstant(template_object.object(),
-                                                 zone());
+  environment()->accumulator_hints() =
+      Hints::SingleConstant(template_object.object(), zone());
 }
 
 void SerializerForBackgroundCompilation::VisitLdaTrue(
     BytecodeArrayIterator* iterator) {
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().AddConstant(
+  environment()->accumulator_hints() = Hints::SingleConstant(
       broker()->isolate()->factory()->true_value(), zone());
 }
 
 void SerializerForBackgroundCompilation::VisitLdaFalse(
     BytecodeArrayIterator* iterator) {
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().AddConstant(
+  environment()->accumulator_hints() = Hints::SingleConstant(
       broker()->isolate()->factory()->false_value(), zone());
 }
 
 void SerializerForBackgroundCompilation::VisitLdaTheHole(
     BytecodeArrayIterator* iterator) {
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().AddConstant(
+  environment()->accumulator_hints() = Hints::SingleConstant(
       broker()->isolate()->factory()->the_hole_value(), zone());
 }
 
 void SerializerForBackgroundCompilation::VisitLdaUndefined(
     BytecodeArrayIterator* iterator) {
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().AddConstant(
+  environment()->accumulator_hints() = Hints::SingleConstant(
       broker()->isolate()->factory()->undefined_value(), zone());
 }
 
 void SerializerForBackgroundCompilation::VisitLdaNull(
     BytecodeArrayIterator* iterator) {
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().AddConstant(
+  environment()->accumulator_hints() = Hints::SingleConstant(
       broker()->isolate()->factory()->null_value(), zone());
 }
 
 void SerializerForBackgroundCompilation::VisitLdaZero(
     BytecodeArrayIterator* iterator) {
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().AddConstant(
+  environment()->accumulator_hints() = Hints::SingleConstant(
       handle(Smi::FromInt(0), broker()->isolate()), zone());
 }
 
 void SerializerForBackgroundCompilation::VisitLdaSmi(
     BytecodeArrayIterator* iterator) {
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().AddConstant(
-      handle(Smi::FromInt(iterator->GetImmediateOperand(0)),
-             broker()->isolate()),
-      zone());
+  Handle<Smi> smi(Smi::FromInt(iterator->GetImmediateOperand(0)),
+                  broker()->isolate());
+  environment()->accumulator_hints() = Hints::SingleConstant(smi, zone());
 }
 
 void SerializerForBackgroundCompilation::VisitInvokeIntrinsic(
@@ -1260,11 +1409,9 @@ void SerializerForBackgroundCompilation::VisitInvokeIntrinsic(
       interpreter::Register first_reg = iterator->GetRegisterOperand(1);
       size_t reg_count = iterator->GetRegisterCountOperand(2);
       CHECK_EQ(reg_count, 3);
-      HintsVector arguments(zone());
-      environment()->ExportRegisterHints(first_reg, reg_count, &arguments);
-      Hints const& resolution_hints = arguments[1];  // The resolution object.
+      HintsVector args = PrepareArgumentsHints(first_reg, reg_count);
+      Hints const& resolution_hints = args[1];  // The resolution object.
       ProcessHintsForPromiseResolve(resolution_hints);
-      environment()->accumulator_hints().Clear();
       return;
     }
     case Runtime::kInlineAsyncGeneratorReject:
@@ -1330,39 +1477,29 @@ void SerializerForBackgroundCompilation::VisitInvokeIntrinsic(
       break;
     }
   }
-  environment()->ClearEphemeralHints();
+  environment()->accumulator_hints() = Hints();
 }
 
 void SerializerForBackgroundCompilation::VisitLdaConstant(
     BytecodeArrayIterator* iterator) {
   ObjectRef object(
       broker(), iterator->GetConstantForIndexOperand(0, broker()->isolate()));
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().AddConstant(object.object(), zone());
+  environment()->accumulator_hints() =
+      Hints::SingleConstant(object.object(), zone());
 }
 
 void SerializerForBackgroundCompilation::VisitPushContext(
     BytecodeArrayIterator* iterator) {
-  // Transfer current context hints to the destination register hints.
-  Hints& current_context_hints = environment()->current_context_hints();
-  Hints& saved_context_hints =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
-  saved_context_hints.Clear();
-  saved_context_hints.Add(current_context_hints, zone());
-
-  // New context is in the accumulator. Put those hints into the current context
-  // register hints.
-  current_context_hints.Clear();
-  current_context_hints.Add(environment()->accumulator_hints(), zone());
+  register_hints(iterator->GetRegisterOperand(0))
+      .Reset(&environment()->current_context_hints(), zone());
+  environment()->current_context_hints().Reset(
+      &environment()->accumulator_hints(), zone());
 }
 
 void SerializerForBackgroundCompilation::VisitPopContext(
     BytecodeArrayIterator* iterator) {
-  // Replace current context hints with hints given in the argument register.
-  Hints& new_context_hints =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
-  environment()->current_context_hints().Clear();
-  environment()->current_context_hints().Add(new_context_hints, zone());
+  environment()->current_context_hints().Reset(
+      &register_hints(iterator->GetRegisterOperand(0)), zone());
 }
 
 void SerializerForBackgroundCompilation::ProcessImmutableLoad(
@@ -1374,7 +1511,7 @@ void SerializerForBackgroundCompilation::ProcessImmutableLoad(
 
   // If requested, record the object as a hint for the result value.
   if (result_hints != nullptr && slot_value.has_value()) {
-    result_hints->AddConstant(slot_value.value().object(), zone());
+    result_hints->AddConstant(slot_value.value().object(), zone(), broker());
   }
 }
 
@@ -1413,15 +1550,13 @@ void SerializerForBackgroundCompilation::ProcessContextAccess(
 
 void SerializerForBackgroundCompilation::VisitLdaContextSlot(
     BytecodeArrayIterator* iterator) {
-  Hints const& context_hints =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints const& context_hints = register_hints(iterator->GetRegisterOperand(0));
   const int slot = iterator->GetIndexOperand(1);
   const int depth = iterator->GetUnsignedImmediateOperand(2);
   Hints new_accumulator_hints;
   ProcessContextAccess(context_hints, slot, depth, kIgnoreSlot,
                        &new_accumulator_hints);
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().Add(new_accumulator_hints, zone());
+  environment()->accumulator_hints() = new_accumulator_hints;
 }
 
 void SerializerForBackgroundCompilation::VisitLdaCurrentContextSlot(
@@ -1432,21 +1567,18 @@ void SerializerForBackgroundCompilation::VisitLdaCurrentContextSlot(
   Hints new_accumulator_hints;
   ProcessContextAccess(context_hints, slot, depth, kIgnoreSlot,
                        &new_accumulator_hints);
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().Add(new_accumulator_hints, zone());
+  environment()->accumulator_hints() = new_accumulator_hints;
 }
 
 void SerializerForBackgroundCompilation::VisitLdaImmutableContextSlot(
     BytecodeArrayIterator* iterator) {
   const int slot = iterator->GetIndexOperand(1);
   const int depth = iterator->GetUnsignedImmediateOperand(2);
-  Hints const& context_hints =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints const& context_hints = register_hints(iterator->GetRegisterOperand(0));
   Hints new_accumulator_hints;
   ProcessContextAccess(context_hints, slot, depth, kSerializeSlot,
                        &new_accumulator_hints);
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().Add(new_accumulator_hints, zone());
+  environment()->accumulator_hints() = new_accumulator_hints;
 }
 
 void SerializerForBackgroundCompilation::VisitLdaImmutableCurrentContextSlot(
@@ -1457,8 +1589,7 @@ void SerializerForBackgroundCompilation::VisitLdaImmutableCurrentContextSlot(
   Hints new_accumulator_hints;
   ProcessContextAccess(context_hints, slot, depth, kSerializeSlot,
                        &new_accumulator_hints);
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().Add(new_accumulator_hints, zone());
+  environment()->accumulator_hints() = new_accumulator_hints;
 }
 
 void SerializerForBackgroundCompilation::ProcessModuleVariableAccess(
@@ -1491,16 +1622,15 @@ void SerializerForBackgroundCompilation::VisitStaLookupSlot(
     BytecodeArrayIterator* iterator) {
   ObjectRef(broker(),
             iterator->GetConstantForIndexOperand(0, broker()->isolate()));
-  environment()->accumulator_hints().Clear();
+  environment()->accumulator_hints() = Hints();
 }
 
 void SerializerForBackgroundCompilation::VisitStaContextSlot(
     BytecodeArrayIterator* iterator) {
   const int slot = iterator->GetIndexOperand(1);
   const int depth = iterator->GetUnsignedImmediateOperand(2);
-  Hints const& register_hints =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
-  ProcessContextAccess(register_hints, slot, depth, kIgnoreSlot);
+  Hints const& hints = register_hints(iterator->GetRegisterOperand(0));
+  ProcessContextAccess(hints, slot, depth, kIgnoreSlot);
 }
 
 void SerializerForBackgroundCompilation::VisitStaCurrentContextSlot(
@@ -1513,26 +1643,21 @@ void SerializerForBackgroundCompilation::VisitStaCurrentContextSlot(
 
 void SerializerForBackgroundCompilation::VisitLdar(
     BytecodeArrayIterator* iterator) {
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().Add(
-      environment()->register_hints(iterator->GetRegisterOperand(0)), zone());
+  environment()->accumulator_hints().Reset(
+      &register_hints(iterator->GetRegisterOperand(0)), zone());
 }
 
 void SerializerForBackgroundCompilation::VisitStar(
     BytecodeArrayIterator* iterator) {
   interpreter::Register reg = iterator->GetRegisterOperand(0);
-  environment()->register_hints(reg).Clear();
-  environment()->register_hints(reg).Add(environment()->accumulator_hints(),
-                                         zone());
+  register_hints(reg).Reset(&environment()->accumulator_hints(), zone());
 }
 
 void SerializerForBackgroundCompilation::VisitMov(
     BytecodeArrayIterator* iterator) {
   interpreter::Register src = iterator->GetRegisterOperand(0);
   interpreter::Register dst = iterator->GetRegisterOperand(1);
-  environment()->register_hints(dst).Clear();
-  environment()->register_hints(dst).Add(environment()->register_hints(src),
-                                         zone());
+  register_hints(dst).Reset(&register_hints(src), zone());
 }
 
 void SerializerForBackgroundCompilation::VisitCreateRegExpLiteral(
@@ -1543,7 +1668,7 @@ void SerializerForBackgroundCompilation::VisitCreateRegExpLiteral(
   FeedbackSlot slot = iterator->GetSlotOperand(1);
   FeedbackSource source(feedback_vector(), slot);
   broker()->ProcessFeedbackForRegExpLiteral(source);
-  environment()->accumulator_hints().Clear();
+  environment()->accumulator_hints() = Hints();
 }
 
 void SerializerForBackgroundCompilation::VisitCreateArrayLiteral(
@@ -1556,7 +1681,7 @@ void SerializerForBackgroundCompilation::VisitCreateArrayLiteral(
   FeedbackSlot slot = iterator->GetSlotOperand(1);
   FeedbackSource source(feedback_vector(), slot);
   broker()->ProcessFeedbackForArrayOrObjectLiteral(source);
-  environment()->accumulator_hints().Clear();
+  environment()->accumulator_hints() = Hints();
 }
 
 void SerializerForBackgroundCompilation::VisitCreateEmptyArrayLiteral(
@@ -1564,7 +1689,7 @@ void SerializerForBackgroundCompilation::VisitCreateEmptyArrayLiteral(
   FeedbackSlot slot = iterator->GetSlotOperand(0);
   FeedbackSource source(feedback_vector(), slot);
   broker()->ProcessFeedbackForArrayOrObjectLiteral(source);
-  environment()->accumulator_hints().Clear();
+  environment()->accumulator_hints() = Hints();
 }
 
 void SerializerForBackgroundCompilation::VisitCreateObjectLiteral(
@@ -1576,7 +1701,7 @@ void SerializerForBackgroundCompilation::VisitCreateObjectLiteral(
   FeedbackSlot slot = iterator->GetSlotOperand(1);
   FeedbackSource source(feedback_vector(), slot);
   broker()->ProcessFeedbackForArrayOrObjectLiteral(source);
-  environment()->accumulator_hints().Clear();
+  environment()->accumulator_hints() = Hints();
 }
 
 void SerializerForBackgroundCompilation::VisitCreateFunctionContext(
@@ -1622,33 +1747,33 @@ void SerializerForBackgroundCompilation::ProcessCreateContext(
       Handle<ScopeInfo>::cast(iterator->GetConstantForIndexOperand(
           scopeinfo_operand_index, broker()->isolate()));
   ScopeInfoRef scope_info_ref(broker(), scope_info);
+  scope_info_ref.SerializeScopeInfoChain();
 
   Hints const& current_context_hints = environment()->current_context_hints();
-  Hints& accumulator_hints = environment()->accumulator_hints();
-  accumulator_hints.Clear();
+  Hints result_hints;
 
   // For each constant context, we must create a virtual context from
   // it of distance one.
   for (auto x : current_context_hints.constants()) {
     if (x->IsContext()) {
       Handle<Context> as_context(Handle<Context>::cast(x));
-      accumulator_hints.AddVirtualContext(VirtualContext(1, as_context),
-                                          zone());
+      result_hints.AddVirtualContext(VirtualContext(1, as_context), zone(),
+                                     broker());
     }
   }
 
   // For each virtual context, we must create a virtual context from
   // it of distance {existing distance} + 1.
   for (auto x : current_context_hints.virtual_contexts()) {
-    accumulator_hints.AddVirtualContext(
-        VirtualContext(x.distance + 1, x.context), zone());
+    result_hints.AddVirtualContext(VirtualContext(x.distance + 1, x.context),
+                                   zone(), broker());
   }
+
+  environment()->accumulator_hints() = result_hints;
 }
 
 void SerializerForBackgroundCompilation::VisitCreateClosure(
     BytecodeArrayIterator* iterator) {
-  environment()->accumulator_hints().Clear();
-
   Handle<SharedFunctionInfo> shared = Handle<SharedFunctionInfo>::cast(
       iterator->GetConstantForIndexOperand(0, broker()->isolate()));
   Handle<FeedbackCell> feedback_cell =
@@ -1657,18 +1782,19 @@ void SerializerForBackgroundCompilation::VisitCreateClosure(
   Handle<Object> cell_value(feedback_cell->value(), broker()->isolate());
   ObjectRef cell_value_ref(broker(), cell_value);
 
+  Hints result_hints;
   if (cell_value->IsFeedbackVector()) {
-    FunctionBlueprint blueprint(shared,
-                                Handle<FeedbackVector>::cast(cell_value),
-                                environment()->current_context_hints());
-    environment()->accumulator_hints().AddFunctionBlueprint(blueprint, zone());
+    VirtualClosure virtual_closure(shared,
+                                   Handle<FeedbackVector>::cast(cell_value),
+                                   environment()->current_context_hints());
+    result_hints.AddVirtualClosure(virtual_closure, zone(), broker());
   }
+  environment()->accumulator_hints() = result_hints;
 }
 
 void SerializerForBackgroundCompilation::VisitCallUndefinedReceiver(
     BytecodeArrayIterator* iterator) {
-  const Hints& callee =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints const& callee = register_hints(iterator->GetRegisterOperand(0));
   interpreter::Register first_reg = iterator->GetRegisterOperand(1);
   int reg_count = static_cast<int>(iterator->GetRegisterCountOperand(2));
   FeedbackSlot slot = iterator->GetSlotOperand(3);
@@ -1678,53 +1804,81 @@ void SerializerForBackgroundCompilation::VisitCallUndefinedReceiver(
 
 void SerializerForBackgroundCompilation::VisitCallUndefinedReceiver0(
     BytecodeArrayIterator* iterator) {
-  const Hints& callee =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints const& callee = register_hints(iterator->GetRegisterOperand(0));
   FeedbackSlot slot = iterator->GetSlotOperand(1);
 
-  Hints receiver = Hints::SingleConstant(
+  Hints const receiver = Hints::SingleConstant(
       broker()->isolate()->factory()->undefined_value(), zone());
   HintsVector parameters({receiver}, zone());
-  ProcessCallOrConstruct(callee, base::nullopt, parameters, slot,
+
+  ProcessCallOrConstruct(callee, base::nullopt, &parameters, slot,
                          kMissingArgumentsAreUndefined);
 }
 
+namespace {
+void PrepareArgumentsHintsInternal(Zone* zone, HintsVector* args) {}
+
+template <typename... MoreHints>
+void PrepareArgumentsHintsInternal(Zone* zone, HintsVector* args, Hints* hints,
+                                   MoreHints... more) {
+  hints->EnsureShareable(zone);
+  args->push_back(*hints);
+  PrepareArgumentsHintsInternal(zone, args, more...);
+}
+}  // namespace
+
+template <typename... MoreHints>
+HintsVector SerializerForBackgroundCompilation::PrepareArgumentsHints(
+    Hints* hints, MoreHints... more) {
+  HintsVector args(zone());
+  PrepareArgumentsHintsInternal(zone(), &args, hints, more...);
+  return args;
+}
+
+HintsVector SerializerForBackgroundCompilation::PrepareArgumentsHints(
+    interpreter::Register first, size_t count) {
+  HintsVector result(zone());
+  const int reg_base = first.index();
+  for (int i = 0; i < static_cast<int>(count); ++i) {
+    Hints& hints = register_hints(interpreter::Register(reg_base + i));
+    hints.EnsureShareable(zone());
+    result.push_back(hints);
+  }
+  return result;
+}
+
 void SerializerForBackgroundCompilation::VisitCallUndefinedReceiver1(
     BytecodeArrayIterator* iterator) {
-  const Hints& callee =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
-  const Hints& arg0 =
-      environment()->register_hints(iterator->GetRegisterOperand(1));
+  Hints const& callee = register_hints(iterator->GetRegisterOperand(0));
+  Hints* arg0 = &register_hints(iterator->GetRegisterOperand(1));
   FeedbackSlot slot = iterator->GetSlotOperand(2);
 
   Hints receiver = Hints::SingleConstant(
       broker()->isolate()->factory()->undefined_value(), zone());
-  HintsVector parameters({receiver, arg0}, zone());
-  ProcessCallOrConstruct(callee, base::nullopt, parameters, slot,
+  HintsVector args = PrepareArgumentsHints(&receiver, arg0);
+
+  ProcessCallOrConstruct(callee, base::nullopt, &args, slot,
                          kMissingArgumentsAreUndefined);
 }
 
 void SerializerForBackgroundCompilation::VisitCallUndefinedReceiver2(
     BytecodeArrayIterator* iterator) {
-  const Hints& callee =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
-  const Hints& arg0 =
-      environment()->register_hints(iterator->GetRegisterOperand(1));
-  const Hints& arg1 =
-      environment()->register_hints(iterator->GetRegisterOperand(2));
+  Hints const& callee = register_hints(iterator->GetRegisterOperand(0));
+  Hints* arg0 = &register_hints(iterator->GetRegisterOperand(1));
+  Hints* arg1 = &register_hints(iterator->GetRegisterOperand(2));
   FeedbackSlot slot = iterator->GetSlotOperand(3);
 
   Hints receiver = Hints::SingleConstant(
       broker()->isolate()->factory()->undefined_value(), zone());
-  HintsVector parameters({receiver, arg0, arg1}, zone());
-  ProcessCallOrConstruct(callee, base::nullopt, parameters, slot,
+  HintsVector args = PrepareArgumentsHints(&receiver, arg0, arg1);
+
+  ProcessCallOrConstruct(callee, base::nullopt, &args, slot,
                          kMissingArgumentsAreUndefined);
 }
 
 void SerializerForBackgroundCompilation::VisitCallAnyReceiver(
     BytecodeArrayIterator* iterator) {
-  const Hints& callee =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints const& callee = register_hints(iterator->GetRegisterOperand(0));
   interpreter::Register first_reg = iterator->GetRegisterOperand(1);
   int reg_count = static_cast<int>(iterator->GetRegisterCountOperand(2));
   FeedbackSlot slot = iterator->GetSlotOperand(3);
@@ -1734,8 +1888,7 @@ void SerializerForBackgroundCompilation::VisitCallAnyReceiver(
 
 void SerializerForBackgroundCompilation::VisitCallNoFeedback(
     BytecodeArrayIterator* iterator) {
-  const Hints& callee =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints const& callee = register_hints(iterator->GetRegisterOperand(0));
   interpreter::Register first_reg = iterator->GetRegisterOperand(1);
   int reg_count = static_cast<int>(iterator->GetRegisterCountOperand(2));
   ProcessCallVarArgs(ConvertReceiverMode::kAny, callee, first_reg, reg_count,
@@ -1744,8 +1897,7 @@ void SerializerForBackgroundCompilation::VisitCallNoFeedback(
 
 void SerializerForBackgroundCompilation::VisitCallProperty(
     BytecodeArrayIterator* iterator) {
-  const Hints& callee =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints const& callee = register_hints(iterator->GetRegisterOperand(0));
   interpreter::Register first_reg = iterator->GetRegisterOperand(1);
   int reg_count = static_cast<int>(iterator->GetRegisterCountOperand(2));
   FeedbackSlot slot = iterator->GetSlotOperand(3);
@@ -1755,53 +1907,46 @@ void SerializerForBackgroundCompilation::VisitCallProperty(
 
 void SerializerForBackgroundCompilation::VisitCallProperty0(
     BytecodeArrayIterator* iterator) {
-  const Hints& callee =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
-  const Hints& receiver =
-      environment()->register_hints(iterator->GetRegisterOperand(1));
+  Hints const& callee = register_hints(iterator->GetRegisterOperand(0));
+  Hints* receiver = &register_hints(iterator->GetRegisterOperand(1));
   FeedbackSlot slot = iterator->GetSlotOperand(2);
 
-  HintsVector parameters({receiver}, zone());
-  ProcessCallOrConstruct(callee, base::nullopt, parameters, slot,
+  HintsVector args = PrepareArgumentsHints(receiver);
+
+  ProcessCallOrConstruct(callee, base::nullopt, &args, slot,
                          kMissingArgumentsAreUndefined);
 }
 
 void SerializerForBackgroundCompilation::VisitCallProperty1(
     BytecodeArrayIterator* iterator) {
-  const Hints& callee =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
-  const Hints& receiver =
-      environment()->register_hints(iterator->GetRegisterOperand(1));
-  const Hints& arg0 =
-      environment()->register_hints(iterator->GetRegisterOperand(2));
+  Hints const& callee = register_hints(iterator->GetRegisterOperand(0));
+  Hints* receiver = &register_hints(iterator->GetRegisterOperand(1));
+  Hints* arg0 = &register_hints(iterator->GetRegisterOperand(2));
   FeedbackSlot slot = iterator->GetSlotOperand(3);
 
-  HintsVector parameters({receiver, arg0}, zone());
-  ProcessCallOrConstruct(callee, base::nullopt, parameters, slot,
+  HintsVector args = PrepareArgumentsHints(receiver, arg0);
+
+  ProcessCallOrConstruct(callee, base::nullopt, &args, slot,
                          kMissingArgumentsAreUndefined);
 }
 
 void SerializerForBackgroundCompilation::VisitCallProperty2(
     BytecodeArrayIterator* iterator) {
-  const Hints& callee =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
-  const Hints& receiver =
-      environment()->register_hints(iterator->GetRegisterOperand(1));
-  const Hints& arg0 =
-      environment()->register_hints(iterator->GetRegisterOperand(2));
-  const Hints& arg1 =
-      environment()->register_hints(iterator->GetRegisterOperand(3));
+  Hints const& callee = register_hints(iterator->GetRegisterOperand(0));
+  Hints* receiver = &register_hints(iterator->GetRegisterOperand(1));
+  Hints* arg0 = &register_hints(iterator->GetRegisterOperand(2));
+  Hints* arg1 = &register_hints(iterator->GetRegisterOperand(3));
   FeedbackSlot slot = iterator->GetSlotOperand(4);
 
-  HintsVector parameters({receiver, arg0, arg1}, zone());
-  ProcessCallOrConstruct(callee, base::nullopt, parameters, slot,
+  HintsVector args = PrepareArgumentsHints(receiver, arg0, arg1);
+
+  ProcessCallOrConstruct(callee, base::nullopt, &args, slot,
                          kMissingArgumentsAreUndefined);
 }
 
 void SerializerForBackgroundCompilation::VisitCallWithSpread(
     BytecodeArrayIterator* iterator) {
-  const Hints& callee =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints const& callee = register_hints(iterator->GetRegisterOperand(0));
   interpreter::Register first_reg = iterator->GetRegisterOperand(1);
   int reg_count = static_cast<int>(iterator->GetRegisterCountOperand(2));
   FeedbackSlot slot = iterator->GetSlotOperand(3);
@@ -1817,7 +1962,7 @@ void SerializerForBackgroundCompilation::VisitCallJSRuntime(
           ->target_native_context()
           .get(runtime_index, SerializationPolicy::kSerializeIfNeeded)
           .value();
-  Hints callee = Hints::SingleConstant(constant.object(), zone());
+  Hints const callee = Hints::SingleConstant(constant.object(), zone());
   interpreter::Register first_reg = iterator->GetRegisterOperand(1);
   int reg_count = static_cast<int>(iterator->GetRegisterCountOperand(2));
   ProcessCallVarArgs(ConvertReceiverMode::kNullOrUndefined, callee, first_reg,
@@ -1829,32 +1974,35 @@ Hints SerializerForBackgroundCompilation::RunChildSerializer(
     const HintsVector& arguments, MissingArgumentsPolicy padding) {
   SerializerForBackgroundCompilation child_serializer(
       zone_scope_.zone_stats(), broker(), dependencies(), function, new_target,
-      arguments, padding, flags());
+      arguments, padding, flags(), nesting_level_ + 1);
+  Hints result = child_serializer.Run();
   // The Hints returned by the call to Run are allocated in the zone
   // created by the child serializer. Adding those hints to a hints
   // object created in our zone will preserve the information.
-  Hints hints;
-  hints.AddFromChildSerializer(child_serializer.Run(), zone());
-  return hints;
+  return result.CopyToParentZone(zone(), broker());
 }
 
-void SerializerForBackgroundCompilation::ProcessSFIForCallOrConstruct(
+void SerializerForBackgroundCompilation::ProcessCalleeForCallOrConstruct(
     Callee const& callee, base::Optional<Hints> new_target,
     const HintsVector& arguments, SpeculationMode speculation_mode,
-    MissingArgumentsPolicy padding) {
+    MissingArgumentsPolicy padding, Hints* result_hints) {
   Handle<SharedFunctionInfo> shared = callee.shared(broker()->isolate());
   if (shared->IsApiFunction()) {
     ProcessApiCall(shared, arguments);
-    DCHECK(!shared->IsInlineable());
+    DCHECK_NE(shared->GetInlineability(), SharedFunctionInfo::kIsInlineable);
   } else if (shared->HasBuiltinId()) {
-    ProcessBuiltinCall(shared, new_target, arguments, speculation_mode,
-                       padding);
-    DCHECK(!shared->IsInlineable());
-  } else if (shared->IsInlineable() && callee.HasFeedbackVector()) {
+    ProcessBuiltinCall(shared, new_target, arguments, speculation_mode, padding,
+                       result_hints);
+    DCHECK_NE(shared->GetInlineability(), SharedFunctionInfo::kIsInlineable);
+  } else if ((flags() &
+              SerializerForBackgroundCompilationFlag::kEnableTurboInlining) &&
+             shared->GetInlineability() == SharedFunctionInfo::kIsInlineable &&
+             callee.HasFeedbackVector()) {
     CompilationSubject subject =
         callee.ToCompilationSubject(broker()->isolate(), zone());
-    environment()->accumulator_hints().Add(
-        RunChildSerializer(subject, new_target, arguments, padding), zone());
+    result_hints->Add(
+        RunChildSerializer(subject, new_target, arguments, padding), zone(),
+        broker());
   }
 }
 
@@ -1864,22 +2012,21 @@ namespace {
 JSReceiverRef UnrollBoundFunction(JSBoundFunctionRef const& bound_function,
                                   JSHeapBroker* broker,
                                   const HintsVector& original_arguments,
-                                  HintsVector* expanded_arguments) {
+                                  HintsVector* expanded_arguments, Zone* zone) {
   DCHECK(expanded_arguments->empty());
 
   JSReceiverRef target = bound_function.AsJSReceiver();
-  HintsVector reversed_bound_arguments(broker->zone());
+  HintsVector reversed_bound_arguments(zone);
   for (; target.IsJSBoundFunction();
        target = target.AsJSBoundFunction().bound_target_function()) {
     for (int i = target.AsJSBoundFunction().bound_arguments().length() - 1;
          i >= 0; --i) {
-      Hints arg = Hints::SingleConstant(
-          target.AsJSBoundFunction().bound_arguments().get(i).object(),
-          broker->zone());
+      Hints const arg = Hints::SingleConstant(
+          target.AsJSBoundFunction().bound_arguments().get(i).object(), zone);
       reversed_bound_arguments.push_back(arg);
     }
-    Hints arg = Hints::SingleConstant(
-        target.AsJSBoundFunction().bound_this().object(), broker->zone());
+    Hints const arg = Hints::SingleConstant(
+        target.AsJSBoundFunction().bound_this().object(), zone);
     reversed_bound_arguments.push_back(arg);
   }
 
@@ -1897,7 +2044,7 @@ JSReceiverRef UnrollBoundFunction(JSBoundFunctionRef const& bound_function,
 void SerializerForBackgroundCompilation::ProcessCalleeForCallOrConstruct(
     Handle<Object> callee, base::Optional<Hints> new_target,
     const HintsVector& arguments, SpeculationMode speculation_mode,
-    MissingArgumentsPolicy padding) {
+    MissingArgumentsPolicy padding, Hints* result_hints) {
   const HintsVector* actual_arguments = &arguments;
   HintsVector expanded_arguments(zone());
   if (callee->IsJSBoundFunction()) {
@@ -1905,7 +2052,7 @@ void SerializerForBackgroundCompilation::ProcessCalleeForCallOrConstruct(
                                       Handle<JSBoundFunction>::cast(callee));
     bound_function.Serialize();
     callee = UnrollBoundFunction(bound_function, broker(), arguments,
-                                 &expanded_arguments)
+                                 &expanded_arguments, zone())
                  .object();
     actual_arguments = &expanded_arguments;
   }
@@ -1914,52 +2061,114 @@ void SerializerForBackgroundCompilation::ProcessCalleeForCallOrConstruct(
   JSFunctionRef function(broker(), Handle<JSFunction>::cast(callee));
   function.Serialize();
   Callee new_callee(function.object());
-  ProcessSFIForCallOrConstruct(new_callee, new_target, *actual_arguments,
-                               speculation_mode, padding);
+  ProcessCalleeForCallOrConstruct(new_callee, new_target, *actual_arguments,
+                                  speculation_mode, padding, result_hints);
 }
 
 void SerializerForBackgroundCompilation::ProcessCallOrConstruct(
-    Hints callee, base::Optional<Hints> new_target,
-    const HintsVector& arguments, FeedbackSlot slot,
-    MissingArgumentsPolicy padding) {
+    Hints callee, base::Optional<Hints> new_target, HintsVector* arguments,
+    FeedbackSlot slot, MissingArgumentsPolicy padding) {
   SpeculationMode speculation_mode = SpeculationMode::kDisallowSpeculation;
+
   if (!slot.IsInvalid()) {
     FeedbackSource source(feedback_vector(), slot);
     ProcessedFeedback const& feedback =
         broker()->ProcessFeedbackForCall(source);
     if (BailoutOnUninitialized(feedback)) return;
 
-    // Incorporate feedback into hints copy to simplify processing.
     if (!feedback.IsInsufficient()) {
+      // Incorporate feedback into hints copy to simplify processing.
+      // TODO(neis): Modify the original hints instead?
       speculation_mode = feedback.AsCall().speculation_mode();
+      // Incorporate target feedback into hints copy to simplify processing.
       base::Optional<HeapObjectRef> target = feedback.AsCall().target();
       if (target.has_value() && target->map().is_callable()) {
+        callee = callee.Copy(zone());
         // TODO(mvstanton): if the map isn't callable then we have an allocation
         // site, and it may make sense to add the Array JSFunction constant.
         if (new_target.has_value()) {
           // Construct; feedback is new_target, which often is also the callee.
-          new_target->AddConstant(target->object(), zone());
-          callee.AddConstant(target->object(), zone());
+          new_target = new_target->Copy(zone());
+          new_target->AddConstant(target->object(), zone(), broker());
+          callee.AddConstant(target->object(), zone(), broker());
         } else {
           // Call; target is callee.
-          callee.AddConstant(target->object(), zone());
+          callee.AddConstant(target->object(), zone(), broker());
         }
       }
     }
   }
 
-  environment()->accumulator_hints().Clear();
+  Hints result_hints_from_new_target;
+  if (new_target.has_value()) {
+    ProcessNewTargetForConstruct(*new_target, &result_hints_from_new_target);
+    // These hints are a good guess at the resulting object, so they are useful
+    // for both the accumulator and the constructor call's receiver. The latter
+    // is still missing completely in {arguments} so add it now.
+    arguments->insert(arguments->begin(), result_hints_from_new_target);
+  }
+
+  // For JSNativeContextSpecialization::InferReceiverRootMap
+  Hints new_accumulator_hints = result_hints_from_new_target.Copy(zone());
 
+  ProcessCallOrConstructRecursive(callee, new_target, *arguments,
+                                  speculation_mode, padding,
+                                  &new_accumulator_hints);
+  environment()->accumulator_hints() = new_accumulator_hints;
+}
+
+void SerializerForBackgroundCompilation::ProcessCallOrConstructRecursive(
+    Hints const& callee, base::Optional<Hints> new_target,
+    const HintsVector& arguments, SpeculationMode speculation_mode,
+    MissingArgumentsPolicy padding, Hints* result_hints) {
   // For JSCallReducer::ReduceJSCall and JSCallReducer::ReduceJSConstruct.
   for (auto constant : callee.constants()) {
     ProcessCalleeForCallOrConstruct(constant, new_target, arguments,
-                                    speculation_mode, padding);
+                                    speculation_mode, padding, result_hints);
   }
 
   // For JSCallReducer::ReduceJSCall and JSCallReducer::ReduceJSConstruct.
-  for (auto hint : callee.function_blueprints()) {
-    ProcessSFIForCallOrConstruct(Callee(hint), new_target, arguments,
-                                 speculation_mode, padding);
+  for (auto hint : callee.virtual_closures()) {
+    ProcessCalleeForCallOrConstruct(Callee(hint), new_target, arguments,
+                                    speculation_mode, padding, result_hints);
+  }
+
+  for (auto hint : callee.virtual_bound_functions()) {
+    HintsVector new_arguments = hint.bound_arguments;
+    new_arguments.insert(new_arguments.end(), arguments.begin(),
+                         arguments.end());
+    ProcessCallOrConstructRecursive(hint.bound_target, new_target,
+                                    new_arguments, speculation_mode, padding,
+                                    result_hints);
+  }
+}
+
+void SerializerForBackgroundCompilation::ProcessNewTargetForConstruct(
+    Hints const& new_target_hints, Hints* result_hints) {
+  for (Handle<Object> target : new_target_hints.constants()) {
+    if (target->IsJSBoundFunction()) {
+      // Unroll the bound function.
+      while (target->IsJSBoundFunction()) {
+        target = handle(
+            Handle<JSBoundFunction>::cast(target)->bound_target_function(),
+            broker()->isolate());
+      }
+    }
+    if (target->IsJSFunction()) {
+      Handle<JSFunction> new_target(Handle<JSFunction>::cast(target));
+      if (new_target->has_prototype_slot(broker()->isolate()) &&
+          new_target->has_initial_map()) {
+        result_hints->AddMap(
+            handle(new_target->initial_map(), broker()->isolate()), zone(),
+            broker());
+      }
+    }
+  }
+
+  for (auto const& virtual_bound_function :
+       new_target_hints.virtual_bound_functions()) {
+    ProcessNewTargetForConstruct(virtual_bound_function.bound_target,
+                                 result_hints);
   }
 }
 
@@ -1967,16 +2176,15 @@ void SerializerForBackgroundCompilation::ProcessCallVarArgs(
     ConvertReceiverMode receiver_mode, Hints const& callee,
     interpreter::Register first_reg, int reg_count, FeedbackSlot slot,
     MissingArgumentsPolicy padding) {
-  HintsVector arguments(zone());
+  HintsVector args = PrepareArgumentsHints(first_reg, reg_count);
   // The receiver is either given in the first register or it is implicitly
   // the {undefined} value.
   if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
-    arguments.push_back(Hints::SingleConstant(
-        broker()->isolate()->factory()->undefined_value(), zone()));
+    args.insert(args.begin(),
+                Hints::SingleConstant(
+                    broker()->isolate()->factory()->undefined_value(), zone()));
   }
-  environment()->ExportRegisterHints(first_reg, reg_count, &arguments);
-
-  ProcessCallOrConstruct(callee, base::nullopt, arguments, slot, padding);
+  ProcessCallOrConstruct(callee, base::nullopt, &args, slot, padding);
 }
 
 void SerializerForBackgroundCompilation::ProcessApiCall(
@@ -2033,7 +2241,7 @@ void SerializerForBackgroundCompilation::ProcessReceiverMapForApiCall(
     FunctionTemplateInfoRef target, Handle<Map> receiver) {
   if (!receiver->is_access_check_needed()) {
     MapRef receiver_map(broker(), receiver);
-    TRACE_BROKER(broker(), "Serializing holder for target:" << target);
+    TRACE_BROKER(broker(), "Serializing holder for target: " << target);
     target.LookupHolderOfExpectedType(receiver_map,
                                       SerializationPolicy::kSerializeIfNeeded);
   }
@@ -2050,7 +2258,7 @@ void SerializerForBackgroundCompilation::ProcessHintsForObjectCreate(
 void SerializerForBackgroundCompilation::ProcessBuiltinCall(
     Handle<SharedFunctionInfo> target, base::Optional<Hints> new_target,
     const HintsVector& arguments, SpeculationMode speculation_mode,
-    MissingArgumentsPolicy padding) {
+    MissingArgumentsPolicy padding, Hints* result_hints) {
   DCHECK(target->HasBuiltinId());
   const int builtin_id = target->builtin_id();
   const char* name = Builtins::name(builtin_id);
@@ -2068,24 +2276,27 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
     case Builtins::kPromisePrototypeCatch: {
       // For JSCallReducer::ReducePromisePrototypeCatch.
       if (speculation_mode != SpeculationMode::kDisallowSpeculation) {
-        CHECK_GE(arguments.size(), 1);
-        ProcessMapHintsForPromises(arguments[0]);
+        if (arguments.size() >= 1) {
+          ProcessMapHintsForPromises(arguments[0]);
+        }
       }
       break;
     }
     case Builtins::kPromisePrototypeFinally: {
       // For JSCallReducer::ReducePromisePrototypeFinally.
       if (speculation_mode != SpeculationMode::kDisallowSpeculation) {
-        CHECK_GE(arguments.size(), 1);
-        ProcessMapHintsForPromises(arguments[0]);
+        if (arguments.size() >= 1) {
+          ProcessMapHintsForPromises(arguments[0]);
+        }
       }
       break;
     }
     case Builtins::kPromisePrototypeThen: {
       // For JSCallReducer::ReducePromisePrototypeThen.
       if (speculation_mode != SpeculationMode::kDisallowSpeculation) {
-        CHECK_GE(arguments.size(), 1);
-        ProcessMapHintsForPromises(arguments[0]);
+        if (arguments.size() >= 1) {
+          ProcessMapHintsForPromises(arguments[0]);
+        }
       }
       break;
     }
@@ -2093,7 +2304,7 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
       // For JSCallReducer::ReducePromiseInternalResolve and
       // JSNativeContextSpecialization::ReduceJSResolvePromise.
       if (arguments.size() >= 1) {
-        Hints const& resolution_hints =
+        Hints const resolution_hints =
             arguments.size() >= 2
                 ? arguments[1]
                 : Hints::SingleConstant(
@@ -2102,19 +2313,6 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
         ProcessHintsForPromiseResolve(resolution_hints);
       }
       break;
-    case Builtins::kPromiseInternalResolve:
-      // For JSCallReducer::ReducePromiseInternalResolve and
-      // JSNativeContextSpecialization::ReduceJSResolvePromise.
-      if (arguments.size() >= 2) {
-        Hints const& resolution_hints =
-            arguments.size() >= 3
-                ? arguments[2]
-                : Hints::SingleConstant(
-                      broker()->isolate()->factory()->undefined_value(),
-                      zone());
-        ProcessHintsForPromiseResolve(resolution_hints);
-      }
-      break;
     case Builtins::kRegExpPrototypeTest:
     case Builtins::kRegExpPrototypeTestFast:
       // For JSCallReducer::ReduceRegExpPrototypeTest.
@@ -2145,10 +2343,14 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
         new_arguments.push_back(Hints());       // k
         new_arguments.push_back(arguments[0]);  // O
         for (auto constant : callback.constants()) {
-          ProcessCalleeForCallOrConstruct(constant, base::nullopt,
-                                          new_arguments,
-                                          SpeculationMode::kDisallowSpeculation,
-                                          kMissingArgumentsAreUndefined);
+          ProcessCalleeForCallOrConstruct(
+              constant, base::nullopt, new_arguments, speculation_mode,
+              kMissingArgumentsAreUndefined, result_hints);
+        }
+        for (auto virtual_closure : callback.virtual_closures()) {
+          ProcessCalleeForCallOrConstruct(
+              Callee(virtual_closure), base::nullopt, new_arguments,
+              speculation_mode, kMissingArgumentsAreUndefined, result_hints);
         }
       }
       break;
@@ -2166,20 +2368,21 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
         new_arguments.push_back(Hints());       // k
         new_arguments.push_back(arguments[0]);  // O
         for (auto constant : callback.constants()) {
-          ProcessCalleeForCallOrConstruct(constant, base::nullopt,
-                                          new_arguments,
-                                          SpeculationMode::kDisallowSpeculation,
-                                          kMissingArgumentsAreUndefined);
+          ProcessCalleeForCallOrConstruct(
+              constant, base::nullopt, new_arguments, speculation_mode,
+              kMissingArgumentsAreUndefined, result_hints);
+        }
+        for (auto virtual_closure : callback.virtual_closures()) {
+          ProcessCalleeForCallOrConstruct(
+              Callee(virtual_closure), base::nullopt, new_arguments,
+              speculation_mode, kMissingArgumentsAreUndefined, result_hints);
         }
       }
       break;
-    // TODO(neis): At least for Array* we should look at blueprints too.
-    // TODO(neis): Might need something like a FunctionBlueprint but for
-    // creating bound functions rather than creating closures.
     case Builtins::kFunctionPrototypeApply:
       if (arguments.size() >= 1) {
         // Drop hints for all arguments except the user-given receiver.
-        Hints new_receiver =
+        Hints const new_receiver =
             arguments.size() >= 2
                 ? arguments[1]
                 : Hints::SingleConstant(
@@ -2187,10 +2390,14 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
                       zone());
         HintsVector new_arguments({new_receiver}, zone());
         for (auto constant : arguments[0].constants()) {
-          ProcessCalleeForCallOrConstruct(constant, base::nullopt,
-                                          new_arguments,
-                                          SpeculationMode::kDisallowSpeculation,
-                                          kMissingArgumentsAreUnknown);
+          ProcessCalleeForCallOrConstruct(
+              constant, base::nullopt, new_arguments, speculation_mode,
+              kMissingArgumentsAreUnknown, result_hints);
+        }
+        for (auto const& virtual_closure : arguments[0].virtual_closures()) {
+          ProcessCalleeForCallOrConstruct(
+              Callee(virtual_closure), base::nullopt, new_arguments,
+              speculation_mode, kMissingArgumentsAreUnknown, result_hints);
         }
       }
       break;
@@ -2203,10 +2410,16 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
                 broker()->isolate()->factory()->undefined_value(), zone())},
             zone());
         for (auto constant : arguments[0].constants()) {
-          ProcessCalleeForCallOrConstruct(constant, base::nullopt,
-                                          new_arguments,
-                                          SpeculationMode::kDisallowSpeculation,
-                                          kMissingArgumentsAreUnknown);
+          ProcessCalleeForCallOrConstruct(
+              constant, base::nullopt, new_arguments,
+              SpeculationMode::kDisallowSpeculation,
+              kMissingArgumentsAreUnknown, result_hints);
+        }
+        for (auto const& virtual_closure : arguments[0].virtual_closures()) {
+          ProcessCalleeForCallOrConstruct(
+              Callee(virtual_closure), base::nullopt, new_arguments,
+              SpeculationMode::kDisallowSpeculation,
+              kMissingArgumentsAreUnknown, result_hints);
         }
       }
       break;
@@ -2215,9 +2428,14 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
         HintsVector new_arguments(arguments.begin() + 1, arguments.end(),
                                   zone());
         for (auto constant : arguments[0].constants()) {
+          ProcessCalleeForCallOrConstruct(constant, base::nullopt,
+                                          new_arguments, speculation_mode,
+                                          padding, result_hints);
+        }
+        for (auto const& virtual_closure : arguments[0].virtual_closures()) {
           ProcessCalleeForCallOrConstruct(
-              constant, base::nullopt, new_arguments,
-              SpeculationMode::kDisallowSpeculation, padding);
+              Callee(virtual_closure), base::nullopt, new_arguments,
+              speculation_mode, padding, result_hints);
         }
       }
       break;
@@ -2245,7 +2463,13 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
     case Builtins::kFastFunctionPrototypeBind:
       if (arguments.size() >= 1 &&
           speculation_mode != SpeculationMode::kDisallowSpeculation) {
-        ProcessHintsForFunctionBind(arguments[0]);
+        Hints const& bound_target = arguments[0];
+        ProcessHintsForFunctionBind(bound_target);
+        HintsVector new_arguments(arguments.begin() + 1, arguments.end(),
+                                  zone());
+        result_hints->AddVirtualBoundFunction(
+            VirtualBoundFunction(bound_target, new_arguments), zone(),
+            broker());
       }
       break;
     case Builtins::kObjectGetPrototypeOf:
@@ -2253,7 +2477,7 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
       if (arguments.size() >= 2) {
         ProcessHintsForObjectGetPrototype(arguments[1]);
       } else {
-        Hints undefined_hint = Hints::SingleConstant(
+        Hints const undefined_hint = Hints::SingleConstant(
             broker()->isolate()->factory()->undefined_value(), zone());
         ProcessHintsForObjectGetPrototype(undefined_hint);
       }
@@ -2325,9 +2549,9 @@ void SerializerForBackgroundCompilation::ProcessHintsForPromiseResolve(
   };
 
   for (auto hint : resolution_hints.constants()) {
-    if (!hint->IsJSReceiver()) continue;
-    Handle<JSReceiver> receiver(Handle<JSReceiver>::cast(hint));
-    processMap(handle(receiver->map(), broker()->isolate()));
+    if (!hint->IsHeapObject()) continue;
+    Handle<HeapObject> resolution(Handle<HeapObject>::cast(hint));
+    processMap(handle(resolution->map(), broker()->isolate()));
   }
   for (auto map_hint : resolution_hints.maps()) {
     processMap(map_hint);
@@ -2442,7 +2666,7 @@ void SerializerForBackgroundCompilation::ContributeToJumpTargetEnvironment(
     jump_target_environments_[target_offset] =
         new (zone()) Environment(*environment());
   } else {
-    it->second->Merge(environment());
+    it->second->Merge(environment(), zone(), broker());
   }
 }
 
@@ -2450,7 +2674,7 @@ void SerializerForBackgroundCompilation::IncorporateJumpTargetEnvironment(
     int target_offset) {
   auto it = jump_target_environments_.find(target_offset);
   if (it != jump_target_environments_.end()) {
-    environment()->Merge(it->second);
+    environment()->Merge(it->second, zone(), broker());
     jump_target_environments_.erase(it);
   }
 }
@@ -2465,9 +2689,9 @@ void SerializerForBackgroundCompilation::ProcessJump(
 
 void SerializerForBackgroundCompilation::VisitReturn(
     BytecodeArrayIterator* iterator) {
-  environment()->return_value_hints().Add(environment()->accumulator_hints(),
-                                          zone());
-  environment()->ClearEphemeralHints();
+  return_value_hints().Add(environment()->accumulator_hints(), zone(),
+                           broker());
+  environment()->Kill();
 }
 
 void SerializerForBackgroundCompilation::VisitSwitchOnSmiNoFeedback(
@@ -2486,44 +2710,33 @@ void SerializerForBackgroundCompilation::VisitSwitchOnGeneratorState(
   }
 }
 
-void SerializerForBackgroundCompilation::Environment::ExportRegisterHints(
-    interpreter::Register first, size_t count, HintsVector* dst) {
-  const int reg_base = first.index();
-  for (int i = 0; i < static_cast<int>(count); ++i) {
-    dst->push_back(register_hints(interpreter::Register(reg_base + i)));
-  }
-}
-
 void SerializerForBackgroundCompilation::VisitConstruct(
     BytecodeArrayIterator* iterator) {
-  Hints const& new_target = environment()->accumulator_hints();
-  Hints const& callee =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints& new_target = environment()->accumulator_hints();
+  Hints const& callee = register_hints(iterator->GetRegisterOperand(0));
   interpreter::Register first_reg = iterator->GetRegisterOperand(1);
   size_t reg_count = iterator->GetRegisterCountOperand(2);
   FeedbackSlot slot = iterator->GetSlotOperand(3);
 
-  HintsVector arguments(zone());
-  environment()->ExportRegisterHints(first_reg, reg_count, &arguments);
+  HintsVector args = PrepareArgumentsHints(first_reg, reg_count);
 
-  ProcessCallOrConstruct(callee, new_target, arguments, slot,
+  ProcessCallOrConstruct(callee, new_target, &args, slot,
                          kMissingArgumentsAreUndefined);
 }
 
 void SerializerForBackgroundCompilation::VisitConstructWithSpread(
     BytecodeArrayIterator* iterator) {
   Hints const& new_target = environment()->accumulator_hints();
-  Hints const& callee =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints const& callee = register_hints(iterator->GetRegisterOperand(0));
   interpreter::Register first_reg = iterator->GetRegisterOperand(1);
   size_t reg_count = iterator->GetRegisterCountOperand(2);
   FeedbackSlot slot = iterator->GetSlotOperand(3);
 
-  HintsVector arguments(zone());
-  environment()->ExportRegisterHints(first_reg, reg_count, &arguments);
-  DCHECK(!arguments.empty());
-  arguments.pop_back();  // Remove the spread element.
-  ProcessCallOrConstruct(callee, new_target, arguments, slot,
+  DCHECK_GT(reg_count, 0);
+  reg_count--;  // Pop the spread element.
+  HintsVector args = PrepareArgumentsHints(first_reg, reg_count);
+
+  ProcessCallOrConstruct(callee, new_target, &args, slot,
                          kMissingArgumentsAreUnknown);
 }
 
@@ -2535,17 +2748,18 @@ void SerializerForBackgroundCompilation::ProcessGlobalAccess(FeedbackSlot slot,
       broker()->ProcessFeedbackForGlobalAccess(source);
 
   if (is_load) {
-    environment()->accumulator_hints().Clear();
+    Hints result_hints;
     if (feedback.kind() == ProcessedFeedback::kGlobalAccess) {
       // We may be able to contribute to accumulator constant hints.
       base::Optional<ObjectRef> value =
           feedback.AsGlobalAccess().GetConstantHint();
       if (value.has_value()) {
-        environment()->accumulator_hints().AddConstant(value->object(), zone());
+        result_hints.AddConstant(value->object(), zone(), broker());
       }
     } else {
       DCHECK(feedback.IsInsufficient());
     }
+    environment()->accumulator_hints() = result_hints;
   }
 }
 
@@ -2566,24 +2780,26 @@ void SerializerForBackgroundCompilation::VisitLdaLookupSlot(
     BytecodeArrayIterator* iterator) {
   ObjectRef(broker(),
             iterator->GetConstantForIndexOperand(0, broker()->isolate()));
-  environment()->accumulator_hints().Clear();
+  environment()->accumulator_hints() = Hints();
 }
 
 void SerializerForBackgroundCompilation::VisitLdaLookupSlotInsideTypeof(
     BytecodeArrayIterator* iterator) {
   ObjectRef(broker(),
             iterator->GetConstantForIndexOperand(0, broker()->isolate()));
-  environment()->accumulator_hints().Clear();
+  environment()->accumulator_hints() = Hints();
 }
 
 void SerializerForBackgroundCompilation::ProcessCheckContextExtensions(
     int depth) {
   // for BytecodeGraphBuilder::CheckContextExtensions.
-  Hints& context_hints = environment()->current_context_hints();
+  Hints const& context_hints = environment()->current_context_hints();
   for (int i = 0; i < depth; i++) {
     ProcessContextAccess(context_hints, Context::EXTENSION_INDEX, i,
                          kSerializeSlot);
   }
+  SharedFunctionInfoRef shared(broker(), function().shared());
+  shared.SerializeScopeInfoChain();
 }
 
 void SerializerForBackgroundCompilation::ProcessLdaLookupGlobalSlot(
@@ -2618,7 +2834,7 @@ void SerializerForBackgroundCompilation::ProcessLdaLookupContextSlot(
   NameRef(broker(),
           iterator->GetConstantForIndexOperand(0, broker()->isolate()));
   ProcessCheckContextExtensions(depth);
-  environment()->accumulator_hints().Clear();
+  environment()->accumulator_hints() = Hints();
   ProcessContextAccess(environment()->current_context_hints(), slot_index,
                        depth, kIgnoreSlot);
 }
@@ -2652,11 +2868,11 @@ MapHandles GetRelevantReceiverMaps(Isolate* isolate, MapContainer const& maps) {
 void SerializerForBackgroundCompilation::ProcessCompareOperation(
     FeedbackSlot slot) {
   if (slot.IsInvalid() || feedback_vector().is_null()) return;
-  FeedbackSource source(environment()->function().feedback_vector(), slot);
+  FeedbackSource source(function().feedback_vector(), slot);
   ProcessedFeedback const& feedback =
       broker()->ProcessFeedbackForCompareOperation(source);
   if (BailoutOnUninitialized(feedback)) return;
-  environment()->accumulator_hints().Clear();
+  environment()->accumulator_hints() = Hints();
 }
 
 void SerializerForBackgroundCompilation::ProcessForIn(FeedbackSlot slot) {
@@ -2664,7 +2880,7 @@ void SerializerForBackgroundCompilation::ProcessForIn(FeedbackSlot slot) {
   FeedbackSource source(feedback_vector(), slot);
   ProcessedFeedback const& feedback = broker()->ProcessFeedbackForForIn(source);
   if (BailoutOnUninitialized(feedback)) return;
-  environment()->accumulator_hints().Clear();
+  environment()->accumulator_hints() = Hints();
 }
 
 void SerializerForBackgroundCompilation::ProcessUnaryOrBinaryOperation(
@@ -2677,13 +2893,14 @@ void SerializerForBackgroundCompilation::ProcessUnaryOrBinaryOperation(
   if (honor_bailout_on_uninitialized && BailoutOnUninitialized(feedback)) {
     return;
   }
-  environment()->accumulator_hints().Clear();
+  environment()->accumulator_hints() = Hints();
 }
 
 PropertyAccessInfo
 SerializerForBackgroundCompilation::ProcessMapForNamedPropertyAccess(
-    MapRef receiver_map, NameRef const& name, AccessMode access_mode,
-    base::Optional<JSObjectRef> receiver, Hints* new_accumulator_hints) {
+    Hints* receiver, MapRef receiver_map, NameRef const& name,
+    AccessMode access_mode, base::Optional<JSObjectRef> concrete_receiver,
+    Hints* result_hints) {
   // For JSNativeContextSpecialization::InferReceiverRootMap
   receiver_map.SerializeRootMap();
 
@@ -2696,7 +2913,7 @@ SerializerForBackgroundCompilation::ProcessMapForNamedPropertyAccess(
     base::Optional<PropertyCellRef> cell = global_object.GetPropertyCell(
         name, SerializationPolicy::kSerializeIfNeeded);
     if (access_mode == AccessMode::kLoad && cell.has_value()) {
-      new_accumulator_hints->AddConstant(cell->value().object(), zone());
+      result_hints->AddConstant(cell->value().object(), zone(), broker());
     }
   }
 
@@ -2710,16 +2927,26 @@ SerializerForBackgroundCompilation::ProcessMapForNamedPropertyAccess(
     if (access_info.constant()->IsJSFunction()) {
       JSFunctionRef function(broker(), access_info.constant());
 
-      // For JSCallReducer::ReduceJSCall.
-      function.Serialize();
+      // For JSCallReducer and JSInlining(Heuristic).
+      HintsVector arguments({Hints::SingleMap(receiver_map.object(), zone())},
+                            zone());
+      // In the case of a setter any added result hints won't make sense, but
+      // they will be ignored anyways by Process*PropertyAccess due to the
+      // access mode not being kLoad.
+      ProcessCalleeForCallOrConstruct(
+          function.object(), base::nullopt, arguments,
+          SpeculationMode::kDisallowSpeculation, kMissingArgumentsAreUndefined,
+          result_hints);
 
       // For JSCallReducer::ReduceCallApiFunction.
       Handle<SharedFunctionInfo> sfi = function.shared().object();
       if (sfi->IsApiFunction()) {
         FunctionTemplateInfoRef fti_ref(
             broker(), handle(sfi->get_api_func_data(), broker()->isolate()));
-        if (fti_ref.has_call_code()) fti_ref.SerializeCallCode();
-        ProcessReceiverMapForApiCall(fti_ref, receiver_map.object());
+        if (fti_ref.has_call_code()) {
+          fti_ref.SerializeCallCode();
+          ProcessReceiverMapForApiCall(fti_ref, receiver_map.object());
+        }
       }
     } else if (access_info.constant()->IsJSBoundFunction()) {
       JSBoundFunctionRef function(broker(), access_info.constant());
@@ -2736,28 +2963,45 @@ SerializerForBackgroundCompilation::ProcessMapForNamedPropertyAccess(
     CellRef(broker(), access_info.constant());
   }
 
-  // For PropertyAccessBuilder::TryBuildLoadConstantDataField
-  if (access_mode == AccessMode::kLoad) {
-    if (access_info.IsDataConstant()) {
-      base::Optional<JSObjectRef> holder;
-      Handle<JSObject> prototype;
-      if (access_info.holder().ToHandle(&prototype)) {
-        holder = JSObjectRef(broker(), prototype);
-      } else {
-        CHECK_IMPLIES(receiver.has_value(),
-                      receiver->map().equals(receiver_map));
-        holder = receiver;
-      }
+  switch (access_mode) {
+    case AccessMode::kLoad:
+      // For PropertyAccessBuilder::TryBuildLoadConstantDataField
+      if (access_info.IsDataConstant()) {
+        base::Optional<JSObjectRef> holder;
+        Handle<JSObject> prototype;
+        if (access_info.holder().ToHandle(&prototype)) {
+          holder = JSObjectRef(broker(), prototype);
+        } else {
+          CHECK_IMPLIES(concrete_receiver.has_value(),
+                        concrete_receiver->map().equals(receiver_map));
+          holder = concrete_receiver;
+        }
 
-      if (holder.has_value()) {
-        base::Optional<ObjectRef> constant(holder->GetOwnDataProperty(
-            access_info.field_representation(), access_info.field_index(),
-            SerializationPolicy::kSerializeIfNeeded));
-        if (constant.has_value()) {
-          new_accumulator_hints->AddConstant(constant->object(), zone());
+        if (holder.has_value()) {
+          base::Optional<ObjectRef> constant(holder->GetOwnDataProperty(
+              access_info.field_representation(), access_info.field_index(),
+              SerializationPolicy::kSerializeIfNeeded));
+          if (constant.has_value()) {
+            result_hints->AddConstant(constant->object(), zone(), broker());
+          }
         }
       }
-    }
+      break;
+    case AccessMode::kStore:
+    case AccessMode::kStoreInLiteral:
+      // For MapInference (StoreField case).
+      if (access_info.IsDataField() || access_info.IsDataConstant()) {
+        Handle<Map> transition_map;
+        if (access_info.transition_map().ToHandle(&transition_map)) {
+          MapRef map_ref(broker(), transition_map);
+          TRACE_BROKER(broker(), "Propagating transition map "
+                                     << map_ref << " to receiver hints.");
+          receiver->AddMap(transition_map, zone(), broker_, false);
+        }
+      }
+      break;
+    case AccessMode::kHas:
+      break;
   }
 
   return access_info;
@@ -2766,14 +3010,13 @@ SerializerForBackgroundCompilation::ProcessMapForNamedPropertyAccess(
 void SerializerForBackgroundCompilation::VisitLdaKeyedProperty(
     BytecodeArrayIterator* iterator) {
   Hints const& key = environment()->accumulator_hints();
-  Hints const& receiver =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints* receiver = &register_hints(iterator->GetRegisterOperand(0));
   FeedbackSlot slot = iterator->GetSlotOperand(1);
   ProcessKeyedPropertyAccess(receiver, key, slot, AccessMode::kLoad, true);
 }
 
 void SerializerForBackgroundCompilation::ProcessKeyedPropertyAccess(
-    Hints const& receiver, Hints const& key, FeedbackSlot slot,
+    Hints* receiver, Hints const& key, FeedbackSlot slot,
     AccessMode access_mode, bool honor_bailout_on_uninitialized) {
   if (slot.IsInvalid() || feedback_vector().is_null()) return;
   FeedbackSource source(feedback_vector(), slot);
@@ -2787,7 +3030,7 @@ void SerializerForBackgroundCompilation::ProcessKeyedPropertyAccess(
   Hints new_accumulator_hints;
   switch (feedback.kind()) {
     case ProcessedFeedback::kElementAccess:
-      ProcessElementAccess(receiver, key, feedback.AsElementAccess(),
+      ProcessElementAccess(*receiver, key, feedback.AsElementAccess(),
                            access_mode);
       break;
     case ProcessedFeedback::kNamedAccess:
@@ -2801,15 +3044,12 @@ void SerializerForBackgroundCompilation::ProcessKeyedPropertyAccess(
   }
 
   if (access_mode == AccessMode::kLoad) {
-    environment()->accumulator_hints().Clear();
-    environment()->accumulator_hints().Add(new_accumulator_hints, zone());
-  } else {
-    DCHECK(new_accumulator_hints.IsEmpty());
+    environment()->accumulator_hints() = new_accumulator_hints;
   }
 }
 
 void SerializerForBackgroundCompilation::ProcessNamedPropertyAccess(
-    Hints const& receiver, NameRef const& name, FeedbackSlot slot,
+    Hints* receiver, NameRef const& name, FeedbackSlot slot,
     AccessMode access_mode) {
   if (slot.IsInvalid() || feedback_vector().is_null()) return;
   FeedbackSource source(feedback_vector(), slot);
@@ -2823,7 +3063,6 @@ void SerializerForBackgroundCompilation::ProcessNamedPropertyAccess(
       DCHECK(name.equals(feedback.AsNamedAccess().name()));
       ProcessNamedAccess(receiver, feedback.AsNamedAccess(), access_mode,
                          &new_accumulator_hints);
-      // TODO(neis): Propagate feedback maps to receiver hints.
       break;
     case ProcessedFeedback::kInsufficient:
       break;
@@ -2832,36 +3071,34 @@ void SerializerForBackgroundCompilation::ProcessNamedPropertyAccess(
   }
 
   if (access_mode == AccessMode::kLoad) {
-    environment()->accumulator_hints().Clear();
-    environment()->accumulator_hints().Add(new_accumulator_hints, zone());
-  } else {
-    DCHECK(new_accumulator_hints.IsEmpty());
+    environment()->accumulator_hints() = new_accumulator_hints;
   }
 }
 
 void SerializerForBackgroundCompilation::ProcessNamedAccess(
-    Hints receiver, NamedAccessFeedback const& feedback, AccessMode access_mode,
-    Hints* new_accumulator_hints) {
+    Hints* receiver, NamedAccessFeedback const& feedback,
+    AccessMode access_mode, Hints* result_hints) {
   for (Handle<Map> map : feedback.maps()) {
     MapRef map_ref(broker(), map);
-    ProcessMapForNamedPropertyAccess(map_ref, feedback.name(), access_mode,
-                                     base::nullopt, new_accumulator_hints);
+    TRACE_BROKER(broker(), "Propagating feedback map "
+                               << map_ref << " to receiver hints.");
+    receiver->AddMap(map, zone(), broker_, false);
   }
 
   for (Handle<Map> map :
-       GetRelevantReceiverMaps(broker()->isolate(), receiver.maps())) {
+       GetRelevantReceiverMaps(broker()->isolate(), receiver->maps())) {
     MapRef map_ref(broker(), map);
-    ProcessMapForNamedPropertyAccess(map_ref, feedback.name(), access_mode,
-                                     base::nullopt, new_accumulator_hints);
+    ProcessMapForNamedPropertyAccess(receiver, map_ref, feedback.name(),
+                                     access_mode, base::nullopt, result_hints);
   }
 
-  for (Handle<Object> hint : receiver.constants()) {
+  for (Handle<Object> hint : receiver->constants()) {
     ObjectRef object(broker(), hint);
     if (access_mode == AccessMode::kLoad && object.IsJSObject()) {
       MapRef map_ref = object.AsJSObject().map();
-      ProcessMapForNamedPropertyAccess(map_ref, feedback.name(), access_mode,
-                                       object.AsJSObject(),
-                                       new_accumulator_hints);
+      ProcessMapForNamedPropertyAccess(receiver, map_ref, feedback.name(),
+                                       access_mode, object.AsJSObject(),
+                                       result_hints);
     }
     // For JSNativeContextSpecialization::ReduceJSLoadNamed.
     if (access_mode == AccessMode::kLoad && object.IsJSFunction() &&
@@ -2869,9 +3106,9 @@ void SerializerForBackgroundCompilation::ProcessNamedAccess(
             broker(), broker()->isolate()->factory()->prototype_string()))) {
       JSFunctionRef function = object.AsJSFunction();
       function.Serialize();
-      if (new_accumulator_hints != nullptr && function.has_prototype()) {
-        new_accumulator_hints->AddConstant(function.prototype().object(),
-                                           zone());
+      if (result_hints != nullptr && function.has_prototype()) {
+        result_hints->AddConstant(function.prototype().object(), zone(),
+                                  broker());
       }
     }
     // TODO(neis): Also record accumulator hint for string.length and maybe
@@ -2880,8 +3117,8 @@ void SerializerForBackgroundCompilation::ProcessNamedAccess(
 }
 
 void SerializerForBackgroundCompilation::ProcessElementAccess(
-    Hints receiver, Hints key, ElementAccessFeedback const& feedback,
-    AccessMode access_mode) {
+    Hints const& receiver, Hints const& key,
+    ElementAccessFeedback const& feedback, AccessMode access_mode) {
   for (auto const& group : feedback.transition_groups()) {
     for (Handle<Map> map_handle : group) {
       MapRef map(broker(), map_handle);
@@ -2943,8 +3180,7 @@ void SerializerForBackgroundCompilation::ProcessElementAccess(
 
 void SerializerForBackgroundCompilation::VisitLdaNamedProperty(
     BytecodeArrayIterator* iterator) {
-  Hints const& receiver =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints* receiver = &register_hints(iterator->GetRegisterOperand(0));
   NameRef name(broker(),
                iterator->GetConstantForIndexOperand(1, broker()->isolate()));
   FeedbackSlot slot = iterator->GetSlotOperand(2);
@@ -2961,8 +3197,7 @@ void SerializerForBackgroundCompilation::VisitLdaNamedPropertyNoFeedback(
 
 void SerializerForBackgroundCompilation::VisitStaNamedProperty(
     BytecodeArrayIterator* iterator) {
-  Hints const& receiver =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints* receiver = &register_hints(iterator->GetRegisterOperand(0));
   NameRef name(broker(),
                iterator->GetConstantForIndexOperand(1, broker()->isolate()));
   FeedbackSlot slot = iterator->GetSlotOperand(2);
@@ -2977,8 +3212,7 @@ void SerializerForBackgroundCompilation::VisitStaNamedPropertyNoFeedback(
 
 void SerializerForBackgroundCompilation::VisitStaNamedOwnProperty(
     BytecodeArrayIterator* iterator) {
-  Hints const& receiver =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints* receiver = &register_hints(iterator->GetRegisterOperand(0));
   NameRef name(broker(),
                iterator->GetConstantForIndexOperand(1, broker()->isolate()));
   FeedbackSlot slot = iterator->GetSlotOperand(2);
@@ -2987,9 +3221,8 @@ void SerializerForBackgroundCompilation::VisitStaNamedOwnProperty(
 
 void SerializerForBackgroundCompilation::VisitTestIn(
     BytecodeArrayIterator* iterator) {
-  Hints const& receiver = environment()->accumulator_hints();
-  Hints const& key =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints* receiver = &environment()->accumulator_hints();
+  Hints const& key = register_hints(iterator->GetRegisterOperand(0));
   FeedbackSlot slot = iterator->GetSlotOperand(1);
   ProcessKeyedPropertyAccess(receiver, key, slot, AccessMode::kHas, false);
 }
@@ -3051,11 +3284,9 @@ void SerializerForBackgroundCompilation::ProcessConstantForInstanceOf(
 
 void SerializerForBackgroundCompilation::VisitTestInstanceOf(
     BytecodeArrayIterator* iterator) {
-  Hints const& lhs =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
+  Hints const& lhs = register_hints(iterator->GetRegisterOperand(0));
   Hints rhs = environment()->accumulator_hints();
   FeedbackSlot slot = iterator->GetSlotOperand(1);
-  Hints new_accumulator_hints;
 
   if (slot.IsInvalid() || feedback_vector().is_null()) return;
   FeedbackSource source(feedback_vector(), slot);
@@ -3063,11 +3294,13 @@ void SerializerForBackgroundCompilation::VisitTestInstanceOf(
       broker()->ProcessFeedbackForInstanceOf(source);
 
   // Incorporate feedback (about rhs) into hints copy to simplify processing.
+  // TODO(neis): Propagate into original hints?
   if (!feedback.IsInsufficient()) {
     InstanceOfFeedback const& rhs_feedback = feedback.AsInstanceOf();
     if (rhs_feedback.value().has_value()) {
+      rhs = rhs.Copy(zone());
       Handle<JSObject> constructor = rhs_feedback.value()->object();
-      rhs.AddConstant(constructor, zone());
+      rhs.AddConstant(constructor, zone(), broker());
     }
   }
 
@@ -3078,8 +3311,7 @@ void SerializerForBackgroundCompilation::VisitTestInstanceOf(
   }
   if (walk_prototypes) ProcessHintsForHasInPrototypeChain(lhs);
 
-  environment()->accumulator_hints().Clear();
-  environment()->accumulator_hints().Add(new_accumulator_hints, zone());
+  environment()->accumulator_hints() = Hints();
 }
 
 void SerializerForBackgroundCompilation::VisitToNumeric(
@@ -3102,20 +3334,16 @@ void SerializerForBackgroundCompilation::VisitThrowReferenceErrorIfHole(
 
 void SerializerForBackgroundCompilation::VisitStaKeyedProperty(
     BytecodeArrayIterator* iterator) {
-  Hints const& receiver =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
-  Hints const& key =
-      environment()->register_hints(iterator->GetRegisterOperand(1));
+  Hints* receiver = &register_hints(iterator->GetRegisterOperand(0));
+  Hints const& key = register_hints(iterator->GetRegisterOperand(1));
   FeedbackSlot slot = iterator->GetSlotOperand(2);
   ProcessKeyedPropertyAccess(receiver, key, slot, AccessMode::kStore, true);
 }
 
 void SerializerForBackgroundCompilation::VisitStaInArrayLiteral(
     BytecodeArrayIterator* iterator) {
-  Hints const& receiver =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
-  Hints const& key =
-      environment()->register_hints(iterator->GetRegisterOperand(1));
+  Hints* receiver = &register_hints(iterator->GetRegisterOperand(0));
+  Hints const& key = register_hints(iterator->GetRegisterOperand(1));
   FeedbackSlot slot = iterator->GetSlotOperand(2);
   ProcessKeyedPropertyAccess(receiver, key, slot, AccessMode::kStoreInLiteral,
                              true);
@@ -3123,27 +3351,17 @@ void SerializerForBackgroundCompilation::VisitStaInArrayLiteral(
 
 void SerializerForBackgroundCompilation::VisitStaDataPropertyInLiteral(
     BytecodeArrayIterator* iterator) {
-  Hints const& receiver =
-      environment()->register_hints(iterator->GetRegisterOperand(0));
-  Hints const& key =
-      environment()->register_hints(iterator->GetRegisterOperand(1));
+  Hints* receiver = &register_hints(iterator->GetRegisterOperand(0));
+  Hints const& key = register_hints(iterator->GetRegisterOperand(1));
   FeedbackSlot slot = iterator->GetSlotOperand(3);
   ProcessKeyedPropertyAccess(receiver, key, slot, AccessMode::kStoreInLiteral,
                              false);
 }
 
-#define DEFINE_CLEAR_ENVIRONMENT(name, ...)             \
-  void SerializerForBackgroundCompilation::Visit##name( \
-      BytecodeArrayIterator* iterator) {                \
-    environment()->ClearEphemeralHints();               \
-  }
-CLEAR_ENVIRONMENT_LIST(DEFINE_CLEAR_ENVIRONMENT)
-#undef DEFINE_CLEAR_ENVIRONMENT
-
 #define DEFINE_CLEAR_ACCUMULATOR(name, ...)             \
   void SerializerForBackgroundCompilation::Visit##name( \
       BytecodeArrayIterator* iterator) {                \
-    environment()->accumulator_hints().Clear();         \
+    environment()->accumulator_hints() = Hints();       \
   }
 CLEAR_ACCUMULATOR_LIST(DEFINE_CLEAR_ACCUMULATOR)
 #undef DEFINE_CLEAR_ACCUMULATOR
@@ -3160,7 +3378,7 @@ CONDITIONAL_JUMPS_LIST(DEFINE_CONDITIONAL_JUMP)
   void SerializerForBackgroundCompilation::Visit##name( \
       BytecodeArrayIterator* iterator) {                \
     ProcessJump(iterator);                              \
-    environment()->ClearEphemeralHints();               \
+    environment()->Kill();                              \
   }
 UNCONDITIONAL_JUMPS_LIST(DEFINE_UNCONDITIONAL_JUMP)
 #undef DEFINE_UNCONDITIONAL_JUMP
@@ -3216,7 +3434,6 @@ UNARY_OP_LIST(DEFINE_UNARY_OP)
 
 #undef BINARY_OP_LIST
 #undef CLEAR_ACCUMULATOR_LIST
-#undef CLEAR_ENVIRONMENT_LIST
 #undef COMPARE_OP_LIST
 #undef CONDITIONAL_JUMPS_LIST
 #undef IGNORED_BYTECODE_LIST
diff --git a/deps/v8/src/compiler/serializer-for-background-compilation.h b/deps/v8/src/compiler/serializer-for-background-compilation.h
index 8f7883eeba7397..f2330332d8baaf 100644
--- a/deps/v8/src/compiler/serializer-for-background-compilation.h
+++ b/deps/v8/src/compiler/serializer-for-background-compilation.h
@@ -23,6 +23,7 @@ enum class SerializerForBackgroundCompilationFlag : uint8_t {
   kBailoutOnUninitialized = 1 << 0,
   kCollectSourcePositions = 1 << 1,
   kAnalyzeEnvironmentLiveness = 1 << 2,
+  kEnableTurboInlining = 1 << 3,
 };
 using SerializerForBackgroundCompilationFlags =
     base::Flags<SerializerForBackgroundCompilationFlag>;
diff --git a/deps/v8/src/compiler/serializer-hints.h b/deps/v8/src/compiler/serializer-hints.h
new file mode 100644
index 00000000000000..4cb1309832a109
--- /dev/null
+++ b/deps/v8/src/compiler/serializer-hints.h
@@ -0,0 +1,175 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This file defines the hints classed gathered temporarily by the
+// SerializerForBackgroundCompilation while it's analysing the bytecode
+// and copying the necessary data to the JSHeapBroker for further usage
+// by the reducers that run on the background thread.
+
+#ifndef V8_COMPILER_SERIALIZER_HINTS_H_
+#define V8_COMPILER_SERIALIZER_HINTS_H_
+
+#include "src/compiler/functional-list.h"
+#include "src/handles/handles.h"
+#include "src/zone/zone-containers.h"
+
+namespace v8 {
+namespace internal {
+
+class Context;
+class Object;
+class Map;
+
+namespace compiler {
+
+template <typename T, typename EqualTo>
+class FunctionalSet {
+ public:
+  void Add(T const& elem, Zone* zone) {
+    for (auto const& l : data_) {
+      if (equal_to(l, elem)) return;
+    }
+    data_.PushFront(elem, zone);
+  }
+
+  void Union(FunctionalSet<T, EqualTo> other, Zone* zone) {
+    if (!data_.TriviallyEquals(other.data_)) {
+      // Choose the larger side as tail.
+      if (data_.Size() < other.data_.Size()) std::swap(data_, other.data_);
+      for (auto const& elem : other.data_) Add(elem, zone);
+    }
+  }
+
+  bool IsEmpty() const { return data_.begin() == data_.end(); }
+
+  // Warning: quadratic time complexity.
+  bool Includes(FunctionalSet<T, EqualTo> const& other) const {
+    return std::all_of(other.begin(), other.end(), [&](T const& other_elem) {
+      return std::any_of(this->begin(), this->end(), [&](T const& this_elem) {
+        return equal_to(this_elem, other_elem);
+      });
+    });
+  }
+  bool operator==(const FunctionalSet<T, EqualTo>& other) const {
+    return this->data_.TriviallyEquals(other.data_) ||
+           (this->data_.Size() == other.data_.Size() && this->Includes(other) &&
+            other.Includes(*this));
+  }
+  bool operator!=(const FunctionalSet<T, EqualTo>& other) const {
+    return !(*this == other);
+  }
+
+  size_t Size() const { return data_.Size(); }
+
+  using iterator = typename FunctionalList<T>::iterator;
+
+  iterator begin() const { return data_.begin(); }
+  iterator end() const { return data_.end(); }
+
+ private:
+  static EqualTo equal_to;
+  FunctionalList<T> data_;
+};
+
+template <typename T, typename EqualTo>
+EqualTo FunctionalSet<T, EqualTo>::equal_to;
+
+struct VirtualContext {
+  unsigned int distance;
+  Handle<Context> context;
+
+  VirtualContext(unsigned int distance_in, Handle<Context> context_in)
+      : distance(distance_in), context(context_in) {
+    CHECK_GT(distance, 0);
+  }
+  bool operator==(const VirtualContext& other) const {
+    return context.equals(other.context) && distance == other.distance;
+  }
+};
+
+class VirtualClosure;
+struct VirtualBoundFunction;
+
+using ConstantsSet = FunctionalSet<Handle<Object>, Handle<Object>::equal_to>;
+using VirtualContextsSet =
+    FunctionalSet<VirtualContext, std::equal_to<VirtualContext>>;
+using MapsSet = FunctionalSet<Handle<Map>, Handle<Map>::equal_to>;
+using VirtualClosuresSet =
+    FunctionalSet<VirtualClosure, std::equal_to<VirtualClosure>>;
+using VirtualBoundFunctionsSet =
+    FunctionalSet<VirtualBoundFunction, std::equal_to<VirtualBoundFunction>>;
+
+struct HintsImpl;
+class JSHeapBroker;
+
+class Hints {
+ public:
+  Hints() = default;  // Empty.
+  static Hints SingleConstant(Handle<Object> constant, Zone* zone);
+  static Hints SingleMap(Handle<Map> map, Zone* zone);
+
+  // For inspection only.
+  ConstantsSet constants() const;
+  MapsSet maps() const;
+  VirtualClosuresSet virtual_closures() const;
+  VirtualContextsSet virtual_contexts() const;
+  VirtualBoundFunctionsSet virtual_bound_functions() const;
+
+  bool IsEmpty() const;
+  bool operator==(Hints const& other) const;
+  bool operator!=(Hints const& other) const;
+
+#ifdef ENABLE_SLOW_DCHECKS
+  bool Includes(Hints const& other) const;
+#endif
+
+  Hints Copy(Zone* zone) const;              // Shallow.
+  Hints CopyToParentZone(Zone* zone, JSHeapBroker* broker) const;  // Deep.
+
+  // As an optimization, empty hints can be represented as {impl_} being
+  // {nullptr}, i.e., as not having allocated a {HintsImpl} object. As a
+  // consequence, some operations need to force allocation prior to doing their
+  // job. In particular, backpropagation from a child serialization
+  // can only work if the hints were already allocated in the parent zone.
+  bool IsAllocated() const { return impl_ != nullptr; }
+  void EnsureShareable(Zone* zone) { EnsureAllocated(zone, false); }
+
+  // Make {this} an alias of {other}.
+  void Reset(Hints* other, Zone* zone);
+
+  void Merge(Hints const& other, Zone* zone, JSHeapBroker* broker);
+
+  // Destructive updates: if the hints are shared by several registers,
+  // then the following updates will be seen by all of them:
+  void AddConstant(Handle<Object> constant, Zone* zone, JSHeapBroker* broker);
+  void AddMap(Handle<Map> map, Zone* zone, JSHeapBroker* broker,
+              bool check_zone_equality = true);
+  void AddVirtualClosure(VirtualClosure const& virtual_closure, Zone* zone,
+                         JSHeapBroker* broker);
+  void AddVirtualContext(VirtualContext const& virtual_context, Zone* zone,
+                         JSHeapBroker* broker);
+  void AddVirtualBoundFunction(VirtualBoundFunction const& bound_function,
+                               Zone* zone, JSHeapBroker* broker);
+  void Add(Hints const& other, Zone* zone, JSHeapBroker* broker);
+
+ private:
+  friend std::ostream& operator<<(std::ostream&, const Hints& hints);
+  HintsImpl* impl_ = nullptr;
+
+  void EnsureAllocated(Zone* zone, bool check_zone_equality = true);
+
+  // Helper for Add and Merge.
+  bool Union(Hints const& other);
+
+  static const size_t kMaxHintsSize = 50;
+  static_assert(kMaxHintsSize >= 1, "must allow for at least one hint");
+};
+
+using HintsVector = ZoneVector<Hints>;
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_SERIALIZER_HINTS_H_
diff --git a/deps/v8/src/compiler/simd-scalar-lowering.cc b/deps/v8/src/compiler/simd-scalar-lowering.cc
index 2781cc248f08f2..9d13bbfa987493 100644
--- a/deps/v8/src/compiler/simd-scalar-lowering.cc
+++ b/deps/v8/src/compiler/simd-scalar-lowering.cc
@@ -153,7 +153,8 @@ void SimdScalarLowering::LowerGraph() {
 
 #define FOREACH_INT16X8_OPCODE(V) \
   V(I16x8Splat)                   \
-  V(I16x8ExtractLane)             \
+  V(I16x8ExtractLaneU)            \
+  V(I16x8ExtractLaneS)            \
   V(I16x8ReplaceLane)             \
   V(I16x8SConvertI8x16Low)        \
   V(I16x8SConvertI8x16High)       \
@@ -186,7 +187,8 @@ void SimdScalarLowering::LowerGraph() {
 
 #define FOREACH_INT8X16_OPCODE(V) \
   V(I8x16Splat)                   \
-  V(I8x16ExtractLane)             \
+  V(I8x16ExtractLaneU)            \
+  V(I8x16ExtractLaneS)            \
   V(I8x16ReplaceLane)             \
   V(I8x16SConvertI16x8)           \
   V(I8x16Neg)                     \
@@ -779,11 +781,9 @@ void SimdScalarLowering::LowerPack(Node* node, SimdType input_rep_type,
   DCHECK_EQ(2, node->InputCount());
   Node** rep_left = GetReplacementsWithType(node->InputAt(0), input_rep_type);
   Node** rep_right = GetReplacementsWithType(node->InputAt(1), input_rep_type);
-  const Operator* less_op =
-      is_signed ? machine()->Int32LessThan() : machine()->Uint32LessThan();
+  const Operator* less_op = machine()->Int32LessThan();
   Node* min = nullptr;
   Node* max = nullptr;
-  int32_t shift_val = 0;
   MachineRepresentation phi_rep;
   if (output_rep_type == SimdType::kInt16x8) {
     DCHECK(input_rep_type == SimdType::kInt32x4);
@@ -791,8 +791,8 @@ void SimdScalarLowering::LowerPack(Node* node, SimdType input_rep_type,
       min = mcgraph_->Int32Constant(std::numeric_limits<int16_t>::min());
       max = mcgraph_->Int32Constant(std::numeric_limits<int16_t>::max());
     } else {
+      min = mcgraph_->Int32Constant(std::numeric_limits<uint16_t>::min());
       max = mcgraph_->Uint32Constant(std::numeric_limits<uint16_t>::max());
-      shift_val = kShift16;
     }
     phi_rep = MachineRepresentation::kWord16;
   } else {
@@ -802,8 +802,8 @@ void SimdScalarLowering::LowerPack(Node* node, SimdType input_rep_type,
       min = mcgraph_->Int32Constant(std::numeric_limits<int8_t>::min());
       max = mcgraph_->Int32Constant(std::numeric_limits<int8_t>::max());
     } else {
+      min = mcgraph_->Int32Constant(std::numeric_limits<uint8_t>::min());
       max = mcgraph_->Uint32Constant(std::numeric_limits<uint8_t>::max());
-      shift_val = kShift8;
     }
     phi_rep = MachineRepresentation::kWord8;
   }
@@ -815,14 +815,10 @@ void SimdScalarLowering::LowerPack(Node* node, SimdType input_rep_type,
       input = rep_left[i];
     else
       input = rep_right[i - num_lanes / 2];
-    if (is_signed) {
-      Diamond d_min(graph(), common(), graph()->NewNode(less_op, input, min));
-      input = d_min.Phi(phi_rep, min, input);
-    }
+    Diamond d_min(graph(), common(), graph()->NewNode(less_op, input, min));
+    input = d_min.Phi(phi_rep, min, input);
     Diamond d_max(graph(), common(), graph()->NewNode(less_op, max, input));
     rep_node[i] = d_max.Phi(phi_rep, max, input);
-    rep_node[i] =
-        is_signed ? rep_node[i] : FixUpperBits(rep_node[i], shift_val);
   }
   ReplaceNode(node, rep_node, num_lanes);
 }
@@ -1144,6 +1140,22 @@ void SimdScalarLowering::LowerNode(Node* node) {
       ReplaceNode(node, rep_node, kNumLanes32);
       break;
     }
+    case IrOpcode::kS128AndNot: {
+      DCHECK_EQ(2, node->InputCount());
+      Node** rep_left = GetReplacementsWithType(node->InputAt(0), rep_type);
+      Node** rep_right = GetReplacementsWithType(node->InputAt(1), rep_type);
+      int num_lanes = NumLanes(rep_type);
+      Node** rep_node = zone()->NewArray<Node*>(num_lanes);
+      Node* mask = graph()->NewNode(common()->Int32Constant(0xFFFFFFFF));
+      for (int i = 0; i < num_lanes; ++i) {
+        Node* not_rep_right =
+            graph()->NewNode(machine()->Word32Xor(), rep_right[i], mask);
+        rep_node[i] = graph()->NewNode(machine()->Word32And(), rep_left[i],
+                                       not_rep_right);
+      }
+      ReplaceNode(node, rep_node, num_lanes);
+      break;
+    }
     case IrOpcode::kI32x4SConvertF32x4: {
       LowerConvertFromFloat(node, true);
       break;
@@ -1288,8 +1300,10 @@ void SimdScalarLowering::LowerNode(Node* node) {
     }
     case IrOpcode::kI32x4ExtractLane:
     case IrOpcode::kF32x4ExtractLane:
-    case IrOpcode::kI16x8ExtractLane:
-    case IrOpcode::kI8x16ExtractLane: {
+    case IrOpcode::kI16x8ExtractLaneU:
+    case IrOpcode::kI16x8ExtractLaneS:
+    case IrOpcode::kI8x16ExtractLaneU:
+    case IrOpcode::kI8x16ExtractLaneS: {
       int32_t lane = OpParameter<int32_t>(node->op());
       Node** rep_node = zone()->NewArray<Node*>(num_lanes);
       rep_node[0] = GetReplacementsWithType(node->InputAt(0), rep_type)[lane];
@@ -1434,7 +1448,7 @@ void SimdScalarLowering::LowerNode(Node* node) {
     }
     case IrOpcode::kS8x16Shuffle: {
       DCHECK_EQ(2, node->InputCount());
-      const uint8_t* shuffle = S8x16ShuffleOf(node->op());
+      S8x16ShuffleParameter shuffle = S8x16ShuffleParameterOf(node->op());
       Node** rep_left = GetReplacementsWithType(node->InputAt(0), rep_type);
       Node** rep_right = GetReplacementsWithType(node->InputAt(1), rep_type);
       Node** rep_node = zone()->NewArray<Node*>(16);
diff --git a/deps/v8/src/compiler/simplified-lowering.cc b/deps/v8/src/compiler/simplified-lowering.cc
index fadc9bf6d99491..8997a5a83166e8 100644
--- a/deps/v8/src/compiler/simplified-lowering.cc
+++ b/deps/v8/src/compiler/simplified-lowering.cc
@@ -132,11 +132,6 @@ UseInfo TruncatingUseInfoFromRepresentation(MachineRepresentation rep) {
     case MachineRepresentation::kTaggedPointer:
     case MachineRepresentation::kTagged:
       return UseInfo::AnyTagged();
-    case MachineRepresentation::kCompressedSigned:
-      return UseInfo::CompressedSigned();
-    case MachineRepresentation::kCompressedPointer:
-    case MachineRepresentation::kCompressed:
-      return UseInfo::AnyCompressed();
     case MachineRepresentation::kFloat64:
       return UseInfo::TruncatingFloat64();
     case MachineRepresentation::kFloat32:
@@ -149,6 +144,8 @@ UseInfo TruncatingUseInfoFromRepresentation(MachineRepresentation rep) {
       return UseInfo::Word64();
     case MachineRepresentation::kBit:
       return UseInfo::Bool();
+    case MachineRepresentation::kCompressedPointer:
+    case MachineRepresentation::kCompressed:
     case MachineRepresentation::kSimd128:
     case MachineRepresentation::kNone:
       break;
@@ -1151,10 +1148,6 @@ class RepresentationSelector {
     if (IsAnyTagged(rep)) {
       return MachineType::AnyTagged();
     }
-    // Do not distinguish between various Compressed variations.
-    if (IsAnyCompressed(rep)) {
-      return MachineType::AnyCompressed();
-    }
     if (rep == MachineRepresentation::kWord64) {
       if (type.Is(Type::BigInt())) {
         return MachineType::AnyTagged();
@@ -1261,7 +1254,13 @@ class RepresentationSelector {
   void VisitObjectState(Node* node) {
     if (propagate()) {
       for (int i = 0; i < node->InputCount(); i++) {
-        EnqueueInput(node, i, UseInfo::Any());
+        // TODO(nicohartmann): Remove, once the deoptimizer can rematerialize
+        // truncated BigInts.
+        if (TypeOf(node->InputAt(i)).Is(Type::BigInt())) {
+          EnqueueInput(node, i, UseInfo::AnyTagged());
+        } else {
+          EnqueueInput(node, i, UseInfo::Any());
+        }
       }
     } else if (lower()) {
       Zone* zone = jsgraph_->zone();
@@ -1272,6 +1271,11 @@ class RepresentationSelector {
         Node* input = node->InputAt(i);
         (*types)[i] =
             DeoptMachineTypeOf(GetInfo(input)->representation(), TypeOf(input));
+        // TODO(nicohartmann): Remove, once the deoptimizer can rematerialize
+        // truncated BigInts.
+        if (TypeOf(node->InputAt(i)).Is(Type::BigInt())) {
+          ConvertInput(node, i, UseInfo::AnyTagged());
+        }
       }
       NodeProperties::ChangeOp(node, jsgraph_->common()->TypedObjectState(
                                          ObjectIdOf(node->op()), types));
@@ -1308,10 +1312,9 @@ class RepresentationSelector {
       MachineRepresentation field_representation, Type field_type,
       MachineRepresentation value_representation, Node* value) {
     if (base_taggedness == kTaggedBase &&
-        CanBeTaggedOrCompressedPointer(field_representation)) {
+        CanBeTaggedPointer(field_representation)) {
       Type value_type = NodeProperties::GetType(value);
-      if (value_representation == MachineRepresentation::kTaggedSigned ||
-          value_representation == MachineRepresentation::kCompressedSigned) {
+      if (value_representation == MachineRepresentation::kTaggedSigned) {
         // Write barriers are only for stores of heap objects.
         return kNoWriteBarrier;
       }
@@ -1333,9 +1336,7 @@ class RepresentationSelector {
         }
       }
       if (field_representation == MachineRepresentation::kTaggedPointer ||
-          value_representation == MachineRepresentation::kTaggedPointer ||
-          field_representation == MachineRepresentation::kCompressedPointer ||
-          value_representation == MachineRepresentation::kCompressedPointer) {
+          value_representation == MachineRepresentation::kTaggedPointer) {
         // Write barriers for heap objects are cheaper.
         return kPointerWriteBarrier;
       }
@@ -1564,7 +1565,7 @@ class RepresentationSelector {
       } else if (BothInputsAre(node, Type::Unsigned32OrMinusZeroOrNaN())) {
         VisitBinop(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
                    Type::Unsigned32());
-        if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
+        if (lower()) ChangeToUint32OverflowOp(node);
       } else {
         VisitBinop(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
                    Type::Signed32());
@@ -1668,15 +1669,18 @@ class RepresentationSelector {
               node, simplified()->CheckedUint32Bounds(p.feedback(), mode));
         }
       } else {
-        VisitBinop(
-            node,
-            UseInfo::CheckedSigned32AsWord32(kIdentifyZeros, p.feedback()),
-            UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
+        VisitBinop(node, UseInfo::CheckedTaggedAsArrayIndex(p.feedback()),
+                   UseInfo::Word(), MachineType::PointerRepresentation());
         if (lower()) {
-          NodeProperties::ChangeOp(
-              node,
-              simplified()->CheckedUint32Bounds(
-                  p.feedback(), CheckBoundsParameters::kDeoptOnOutOfBounds));
+          if (jsgraph_->machine()->Is64()) {
+            NodeProperties::ChangeOp(
+                node, simplified()->CheckedUint64Bounds(p.feedback()));
+          } else {
+            NodeProperties::ChangeOp(
+                node,
+                simplified()->CheckedUint32Bounds(
+                    p.feedback(), CheckBoundsParameters::kDeoptOnOutOfBounds));
+          }
         }
       }
     } else {
@@ -1823,10 +1827,6 @@ class RepresentationSelector {
             // BooleanNot(x: kRepTagged) => WordEqual(x, #false)
             node->AppendInput(jsgraph_->zone(), jsgraph_->FalseConstant());
             NodeProperties::ChangeOp(node, lowering->machine()->WordEqual());
-          } else if (CanBeCompressedPointer(input_info->representation())) {
-            // BooleanNot(x: kRepCompressed) => Word32Equal(x, #false)
-            node->AppendInput(jsgraph_->zone(), jsgraph_->FalseConstant());
-            NodeProperties::ChangeOp(node, lowering->machine()->Word32Equal());
           } else {
             DCHECK(TypeOf(node->InputAt(0)).IsNone());
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
@@ -2735,6 +2735,25 @@ class RepresentationSelector {
         }
         return;
       }
+      case IrOpcode::kSpeculativeBigIntSubtract: {
+        if (truncation.IsUsedAsWord64()) {
+          VisitBinop(node,
+                     UseInfo::CheckedBigIntTruncatingWord64(FeedbackSource{}),
+                     MachineRepresentation::kWord64);
+          if (lower()) {
+            ChangeToPureOp(node, lowering->machine()->Int64Sub());
+          }
+        } else {
+          VisitBinop(node,
+                     UseInfo::CheckedBigIntAsTaggedPointer(FeedbackSource{}),
+                     MachineRepresentation::kTaggedPointer);
+          if (lower()) {
+            NodeProperties::ChangeOp(node,
+                                     lowering->simplified()->BigIntSubtract());
+          }
+        }
+        return;
+      }
       case IrOpcode::kSpeculativeBigIntNegate: {
         if (truncation.IsUsedAsWord64()) {
           VisitUnop(node,
@@ -2943,9 +2962,9 @@ class RepresentationSelector {
             access.machine_type.representation();
 
         // Convert to Smi if possible, such that we can avoid a write barrier.
-        if (field_representation == MachineType::RepCompressedTagged() &&
+        if (field_representation == MachineRepresentation::kTagged &&
             TypeOf(value_node).Is(Type::SignedSmall())) {
-          field_representation = MachineType::RepCompressedTaggedSigned();
+          field_representation = MachineRepresentation::kTaggedSigned;
         }
         WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
             access.base_is_tagged, field_representation, access.offset,
@@ -2985,9 +3004,9 @@ class RepresentationSelector {
             access.machine_type.representation();
 
         // Convert to Smi if possible, such that we can avoid a write barrier.
-        if (element_representation == MachineType::RepCompressedTagged() &&
+        if (element_representation == MachineRepresentation::kTagged &&
             TypeOf(value_node).Is(Type::SignedSmall())) {
-          element_representation = MachineType::RepCompressedTaggedSigned();
+          element_representation = MachineRepresentation::kTaggedSigned;
         }
         WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
             access.base_is_tagged, element_representation, access.type,
diff --git a/deps/v8/src/compiler/simplified-operator-reducer.cc b/deps/v8/src/compiler/simplified-operator-reducer.cc
index 0f293d2b38b6a8..e2f87b674e887d 100644
--- a/deps/v8/src/compiler/simplified-operator-reducer.cc
+++ b/deps/v8/src/compiler/simplified-operator-reducer.cc
@@ -106,11 +106,6 @@ Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
       if (m.IsChangeInt31ToTaggedSigned() || m.IsChangeInt32ToTagged()) {
         return Replace(m.InputAt(0));
       }
-      if (m.IsChangeCompressedSignedToTaggedSigned()) {
-        Node* new_node = graph()->NewNode(
-            simplified()->ChangeCompressedSignedToInt32(), m.InputAt(0));
-        return Replace(new_node);
-      }
       break;
     }
     case IrOpcode::kChangeTaggedToUint32: {
@@ -148,23 +143,7 @@ Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
       }
       break;
     }
-    case IrOpcode::kChangeTaggedSignedToCompressedSigned: {
-      DCHECK(COMPRESS_POINTERS_BOOL);
-      NodeMatcher m(node->InputAt(0));
-      if (m.IsChangeInt31ToTaggedSigned()) {
-        Node* new_node = graph()->NewNode(
-            simplified()->ChangeInt31ToCompressedSigned(), m.InputAt(0));
-        return Replace(new_node);
-      }
-      break;
-    }
-    case IrOpcode::kChangeCompressedSignedToInt32: {
-      NodeMatcher m(node->InputAt(0));
-      if (m.IsCheckedInt32ToCompressedSigned()) {
-        return Replace(m.InputAt(0));
-      }
-      break;
-    }
+    case IrOpcode::kCheckedTaggedToArrayIndex:
     case IrOpcode::kCheckedTaggedToInt32:
     case IrOpcode::kCheckedTaggedSignedToInt32: {
       NodeMatcher m(node->InputAt(0));
@@ -174,14 +153,6 @@ Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
       }
       break;
     }
-    case IrOpcode::kCheckedTaggedToTaggedPointer: {
-      NodeMatcher m(node->InputAt(0));
-      if (m.IsChangeCompressedPointerToTaggedPointer()) {
-        RelaxEffectsAndControls(node);
-        return Replace(m.node());
-      }
-      break;
-    }
     case IrOpcode::kCheckIf: {
       HeapObjectMatcher m(node->InputAt(0));
       if (m.Is(factory()->true_value())) {
diff --git a/deps/v8/src/compiler/simplified-operator-reducer.h b/deps/v8/src/compiler/simplified-operator-reducer.h
index 4344f87dc907dc..b7069b44f37f6f 100644
--- a/deps/v8/src/compiler/simplified-operator-reducer.h
+++ b/deps/v8/src/compiler/simplified-operator-reducer.h
@@ -37,8 +37,6 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorReducer final
   Reduction Reduce(Node* node) final;
 
  private:
-  Reduction ReduceReferenceEqual(Node* node);
-
   Reduction Change(Node* node, const Operator* op, Node* a);
   Reduction ReplaceBoolean(bool value);
   Reduction ReplaceFloat64(double value);
diff --git a/deps/v8/src/compiler/simplified-operator.cc b/deps/v8/src/compiler/simplified-operator.cc
index 63d24274ece34f..41547fd132480e 100644
--- a/deps/v8/src/compiler/simplified-operator.cc
+++ b/deps/v8/src/compiler/simplified-operator.cc
@@ -218,9 +218,7 @@ CheckFloat64HoleParameters const& CheckFloat64HoleParametersOf(
 
 std::ostream& operator<<(std::ostream& os,
                          CheckFloat64HoleParameters const& params) {
-  os << params.mode();
-  if (params.feedback().IsValid()) os << "; " << params.feedback();
-  return os;
+  return os << params.mode() << ", " << params.feedback();
 }
 
 size_t hash_value(const CheckFloat64HoleParameters& params) {
@@ -259,13 +257,11 @@ std::ostream& operator<<(std::ostream& os, CheckForMinusZeroMode mode) {
 }
 
 std::ostream& operator<<(std::ostream& os, CheckMapsFlags flags) {
-  bool empty = true;
   if (flags & CheckMapsFlag::kTryMigrateInstance) {
-    os << "TryMigrateInstance";
-    empty = false;
+    return os << "TryMigrateInstance";
+  } else {
+    return os << "None";
   }
-  if (empty) os << "None";
-  return os;
 }
 
 bool operator==(CheckMapsParameters const& lhs,
@@ -280,11 +276,7 @@ size_t hash_value(CheckMapsParameters const& p) {
 }
 
 std::ostream& operator<<(std::ostream& os, CheckMapsParameters const& p) {
-  os << p.flags() << p.maps();
-  if (p.feedback().IsValid()) {
-    os << "; " << p.feedback();
-  }
-  return os;
+  return os << p.flags() << ", " << p.maps() << ", " << p.feedback();
 }
 
 CheckMapsParameters const& CheckMapsParametersOf(Operator const* op) {
@@ -338,11 +330,7 @@ inline size_t hash_value(const GrowFastElementsParameters& params) {
 
 std::ostream& operator<<(std::ostream& os,
                          const GrowFastElementsParameters& params) {
-  os << params.mode();
-  if (params.feedback().IsValid()) {
-    os << params.feedback();
-  }
-  return os;
+  return os << params.mode() << ", " << params.feedback();
 }
 
 const GrowFastElementsParameters& GrowFastElementsParametersOf(
@@ -583,7 +571,7 @@ size_t hash_value(NumberOperationParameters const& p) {
 }
 
 std::ostream& operator<<(std::ostream& os, NumberOperationParameters const& p) {
-  return os << p.hint() << " " << p.feedback();
+  return os << p.hint() << ", " << p.feedback();
 }
 
 NumberOperationParameters const& NumberOperationParametersOf(
@@ -640,11 +628,7 @@ const CheckTaggedInputParameters& CheckTaggedInputParametersOf(
 
 std::ostream& operator<<(std::ostream& os,
                          const CheckTaggedInputParameters& params) {
-  os << params.mode();
-  if (params.feedback().IsValid()) {
-    os << "; " << params.feedback();
-  }
-  return os;
+  return os << params.mode() << ", " << params.feedback();
 }
 
 size_t hash_value(const CheckTaggedInputParameters& params) {
@@ -667,11 +651,7 @@ const CheckMinusZeroParameters& CheckMinusZeroParametersOf(const Operator* op) {
 
 std::ostream& operator<<(std::ostream& os,
                          const CheckMinusZeroParameters& params) {
-  os << params.mode();
-  if (params.feedback().IsValid()) {
-    os << "; " << params.feedback();
-  }
-  return os;
+  return os << params.mode() << ", " << params.feedback();
 }
 
 size_t hash_value(const CheckMinusZeroParameters& params) {
@@ -752,7 +732,6 @@ bool operator==(CheckMinusZeroParameters const& lhs,
   V(PlainPrimitiveToNumber, Operator::kNoProperties, 1, 0)         \
   V(PlainPrimitiveToWord32, Operator::kNoProperties, 1, 0)         \
   V(PlainPrimitiveToFloat64, Operator::kNoProperties, 1, 0)        \
-  V(ChangeCompressedSignedToInt32, Operator::kNoProperties, 1, 0)  \
   V(ChangeTaggedSignedToInt32, Operator::kNoProperties, 1, 0)      \
   V(ChangeTaggedSignedToInt64, Operator::kNoProperties, 1, 0)      \
   V(ChangeTaggedToInt32, Operator::kNoProperties, 1, 0)            \
@@ -760,10 +739,7 @@ bool operator==(CheckMinusZeroParameters const& lhs,
   V(ChangeTaggedToUint32, Operator::kNoProperties, 1, 0)           \
   V(ChangeTaggedToFloat64, Operator::kNoProperties, 1, 0)          \
   V(ChangeTaggedToTaggedSigned, Operator::kNoProperties, 1, 0)     \
-  V(ChangeCompressedToTaggedSigned, Operator::kNoProperties, 1, 0) \
-  V(ChangeTaggedToCompressedSigned, Operator::kNoProperties, 1, 0) \
   V(ChangeFloat64ToTaggedPointer, Operator::kNoProperties, 1, 0)   \
-  V(ChangeInt31ToCompressedSigned, Operator::kNoProperties, 1, 0)  \
   V(ChangeInt31ToTaggedSigned, Operator::kNoProperties, 1, 0)      \
   V(ChangeInt32ToTagged, Operator::kNoProperties, 1, 0)            \
   V(ChangeInt64ToTagged, Operator::kNoProperties, 1, 0)            \
@@ -814,6 +790,7 @@ bool operator==(CheckMinusZeroParameters const& lhs,
 
 #define EFFECT_DEPENDENT_OP_LIST(V)                       \
   V(BigIntAdd, Operator::kNoProperties, 2, 1)             \
+  V(BigIntSubtract, Operator::kNoProperties, 2, 1)        \
   V(StringCharCodeAt, Operator::kNoProperties, 2, 1)      \
   V(StringCodePointAt, Operator::kNoProperties, 2, 1)     \
   V(StringFromCodePointAt, Operator::kNoProperties, 2, 1) \
@@ -848,17 +825,13 @@ bool operator==(CheckMinusZeroParameters const& lhs,
   V(CheckSmi, 1, 1)                         \
   V(CheckString, 1, 1)                      \
   V(CheckBigInt, 1, 1)                      \
-  V(CheckedInt32ToCompressedSigned, 1, 1)   \
   V(CheckedInt32ToTaggedSigned, 1, 1)       \
   V(CheckedInt64ToInt32, 1, 1)              \
   V(CheckedInt64ToTaggedSigned, 1, 1)       \
+  V(CheckedTaggedToArrayIndex, 1, 1)        \
   V(CheckedTaggedSignedToInt32, 1, 1)       \
   V(CheckedTaggedToTaggedPointer, 1, 1)     \
   V(CheckedTaggedToTaggedSigned, 1, 1)      \
-  V(CheckedCompressedToTaggedPointer, 1, 1) \
-  V(CheckedCompressedToTaggedSigned, 1, 1)  \
-  V(CheckedTaggedToCompressedPointer, 1, 1) \
-  V(CheckedTaggedToCompressedSigned, 1, 1)  \
   V(CheckedUint32ToInt32, 1, 1)             \
   V(CheckedUint32ToTaggedSigned, 1, 1)      \
   V(CheckedUint64Bounds, 2, 1)              \
@@ -1487,6 +1460,14 @@ const Operator* SimplifiedOperatorBuilder::SpeculativeBigIntAdd(
       "SpeculativeBigIntAdd", 2, 1, 1, 1, 1, 0, hint);
 }
 
+const Operator* SimplifiedOperatorBuilder::SpeculativeBigIntSubtract(
+    BigIntOperationHint hint) {
+  return new (zone()) Operator1<BigIntOperationHint>(
+      IrOpcode::kSpeculativeBigIntSubtract,
+      Operator::kFoldable | Operator::kNoThrow, "SpeculativeBigIntSubtract", 2,
+      1, 1, 1, 1, 0, hint);
+}
+
 const Operator* SimplifiedOperatorBuilder::SpeculativeBigIntNegate(
     BigIntOperationHint hint) {
   return new (zone()) Operator1<BigIntOperationHint>(
@@ -1628,7 +1609,7 @@ size_t hash_value(CheckBoundsParameters const& p) {
 }
 
 std::ostream& operator<<(std::ostream& os, CheckBoundsParameters const& p) {
-  os << p.check_parameters() << ",";
+  os << p.check_parameters() << ", ";
   switch (p.mode()) {
     case CheckBoundsParameters::kDeoptOnOutOfBounds:
       os << "deopt";
@@ -1655,7 +1636,7 @@ size_t hash_value(CheckIfParameters const& p) {
 }
 
 std::ostream& operator<<(std::ostream& os, CheckIfParameters const& p) {
-  return os << p.reason() << p.feedback();
+  return os << p.reason() << ", " << p.feedback();
 }
 
 CheckIfParameters const& CheckIfParametersOf(Operator const* op) {
diff --git a/deps/v8/src/compiler/simplified-operator.h b/deps/v8/src/compiler/simplified-operator.h
index a1438cdce0a81f..4fc9a4be780ea7 100644
--- a/deps/v8/src/compiler/simplified-operator.h
+++ b/deps/v8/src/compiler/simplified-operator.h
@@ -666,6 +666,7 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* NumberSilenceNaN();
 
   const Operator* BigIntAdd();
+  const Operator* BigIntSubtract();
   const Operator* BigIntNegate();
 
   const Operator* SpeculativeSafeIntegerAdd(NumberOperationHint hint);
@@ -688,6 +689,7 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* SpeculativeNumberEqual(NumberOperationHint hint);
 
   const Operator* SpeculativeBigIntAdd(BigIntOperationHint hint);
+  const Operator* SpeculativeBigIntSubtract(BigIntOperationHint hint);
   const Operator* SpeculativeBigIntNegate(BigIntOperationHint hint);
   const Operator* BigIntAsUintN(int bits);
 
@@ -725,7 +727,6 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* PlainPrimitiveToWord32();
   const Operator* PlainPrimitiveToFloat64();
 
-  const Operator* ChangeCompressedSignedToInt32();
   const Operator* ChangeTaggedSignedToInt32();
   const Operator* ChangeTaggedSignedToInt64();
   const Operator* ChangeTaggedToInt32();
@@ -733,9 +734,6 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* ChangeTaggedToUint32();
   const Operator* ChangeTaggedToFloat64();
   const Operator* ChangeTaggedToTaggedSigned();
-  const Operator* ChangeCompressedToTaggedSigned();
-  const Operator* ChangeTaggedToCompressedSigned();
-  const Operator* ChangeInt31ToCompressedSigned();
   const Operator* ChangeInt31ToTaggedSigned();
   const Operator* ChangeInt32ToTagged();
   const Operator* ChangeInt64ToTagged();
@@ -783,8 +781,6 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* CheckedInt32Mod();
   const Operator* CheckedInt32Mul(CheckForMinusZeroMode);
   const Operator* CheckedInt32Sub();
-  const Operator* CheckedInt32ToCompressedSigned(
-      const FeedbackSource& feedback);
   const Operator* CheckedInt32ToTaggedSigned(const FeedbackSource& feedback);
   const Operator* CheckedInt64ToInt32(const FeedbackSource& feedback);
   const Operator* CheckedInt64ToTaggedSigned(const FeedbackSource& feedback);
@@ -793,19 +789,12 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
                                          const FeedbackSource& feedback);
   const Operator* CheckedTaggedToInt32(CheckForMinusZeroMode,
                                        const FeedbackSource& feedback);
+  const Operator* CheckedTaggedToArrayIndex(const FeedbackSource& feedback);
   const Operator* CheckedTaggedToInt64(CheckForMinusZeroMode,
                                        const FeedbackSource& feedback);
   const Operator* CheckedTaggedToTaggedPointer(const FeedbackSource& feedback);
   const Operator* CheckedTaggedToTaggedSigned(const FeedbackSource& feedback);
   const Operator* CheckBigInt(const FeedbackSource& feedback);
-  const Operator* CheckedCompressedToTaggedPointer(
-      const FeedbackSource& feedback);
-  const Operator* CheckedCompressedToTaggedSigned(
-      const FeedbackSource& feedback);
-  const Operator* CheckedTaggedToCompressedPointer(
-      const FeedbackSource& feedback);
-  const Operator* CheckedTaggedToCompressedSigned(
-      const FeedbackSource& feedback);
   const Operator* CheckedTruncateTaggedToWord32(CheckTaggedInputMode,
                                                 const FeedbackSource& feedback);
   const Operator* CheckedUint32Div();
diff --git a/deps/v8/src/compiler/type-cache.h b/deps/v8/src/compiler/type-cache.h
index 3d053484e0d8cc..3329154dbd10b1 100644
--- a/deps/v8/src/compiler/type-cache.h
+++ b/deps/v8/src/compiler/type-cache.h
@@ -33,10 +33,12 @@ class V8_EXPORT_PRIVATE TypeCache final {
       Type::Union(kUint8, Type::MinusZeroOrNaN(), zone());
   Type const kInt16 = CreateRange<int16_t>();
   Type const kUint16 = CreateRange<uint16_t>();
+  Type const kUnsigned31 = Type::Unsigned31();
   Type const kInt32 = Type::Signed32();
   Type const kUint32 = Type::Unsigned32();
   Type const kInt64 = CreateRange<int64_t>();
   Type const kUint64 = CreateRange<uint64_t>();
+  Type const kIntPtr = CreateRange<intptr_t>();
   Type const kFloat32 = Type::Number();
   Type const kFloat64 = Type::Number();
   Type const kBigInt64 = Type::BigInt();
diff --git a/deps/v8/src/compiler/typer.cc b/deps/v8/src/compiler/typer.cc
index e5ee0aa733689a..eacec942713d5f 100644
--- a/deps/v8/src/compiler/typer.cc
+++ b/deps/v8/src/compiler/typer.cc
@@ -850,15 +850,21 @@ Type Typer::Visitor::TypeInductionVariablePhi(Node* node) {
   Type initial_type = Operand(node, 0);
   Type increment_type = Operand(node, 2);
 
-  // We only handle integer induction variables (otherwise ranges
-  // do not apply and we cannot do anything).
-  if (!initial_type.Is(typer_->cache_->kInteger) ||
-      !increment_type.Is(typer_->cache_->kInteger)) {
-    // Fallback to normal phi typing, but ensure monotonicity.
-    // (Unfortunately, without baking in the previous type, monotonicity might
-    // be violated because we might not yet have retyped the incrementing
-    // operation even though the increment's type might been already reflected
-    // in the induction variable phi.)
+  // Fallback to normal phi typing in a variety of cases: when the induction
+  // variable is not initially of type Integer (we want to work with ranges
+  // below), when the increment is zero (in that case, phi typing will generally
+  // yield a better type), and when the induction variable can become NaN
+  // (through addition/subtraction of opposing infinities).
+  if (initial_type.IsNone() ||
+      increment_type.Is(typer_->cache_->kSingletonZero) ||
+      !initial_type.Is(typer_->cache_->kInteger) ||
+      !increment_type.Is(typer_->cache_->kInteger) ||
+      increment_type.Min() == -V8_INFINITY ||
+      increment_type.Max() == +V8_INFINITY) {
+    // Unfortunately, without baking in the previous type, monotonicity might be
+    // violated because we might not yet have retyped the incrementing operation
+    // even though the increment's type might been already reflected in the
+    // induction variable phi.
     Type type = NodeProperties::IsTyped(node) ? NodeProperties::GetType(node)
                                               : Type::None();
     for (int i = 0; i < arity; ++i) {
@@ -866,18 +872,11 @@ Type Typer::Visitor::TypeInductionVariablePhi(Node* node) {
     }
     return type;
   }
-  // If we do not have enough type information for the initial value or
-  // the increment, just return the initial value's type.
-  if (initial_type.IsNone() ||
-      increment_type.Is(typer_->cache_->kSingletonZero)) {
-    return initial_type;
-  }
 
   // Now process the bounds.
   auto res = induction_vars_->induction_variables().find(node->id());
   DCHECK(res != induction_vars_->induction_variables().end());
   InductionVariable* induction_var = res->second;
-
   InductionVariable::ArithmeticType arithmetic_type = induction_var->Type();
 
   double min = -V8_INFINITY;
@@ -935,8 +934,8 @@ Type Typer::Visitor::TypeInductionVariablePhi(Node* node) {
     // The lower bound must be at most the initial value's lower bound.
     min = std::min(min, initial_type.Min());
   } else {
-    // Shortcut: If the increment can be both positive and negative,
-    // the variable can go arbitrarily far, so just return integer.
+    // If the increment can be both positive and negative, the variable can go
+    // arbitrarily far.
     return typer_->cache_->kInteger;
   }
   if (FLAG_trace_turbo_loop) {
@@ -1475,12 +1474,14 @@ Type Typer::Visitor::TypeJSGetSuperConstructor(Node* node) {
 }
 
 // JS context operators.
+Type Typer::Visitor::TypeJSHasContextExtension(Node* node) {
+  return Type::Boolean();
+}
 
 Type Typer::Visitor::TypeJSLoadContext(Node* node) {
   ContextAccess const& access = ContextAccessOf(node->op());
   switch (access.index()) {
     case Context::PREVIOUS_INDEX:
-    case Context::NATIVE_CONTEXT_INDEX:
     case Context::SCOPE_INFO_INDEX:
       return Type::OtherInternal();
     default:
@@ -1883,7 +1884,7 @@ Type Typer::Visitor::TypeJSForInNext(Node* node) {
 }
 
 Type Typer::Visitor::TypeJSForInPrepare(Node* node) {
-  STATIC_ASSERT(Map::EnumLengthBits::kMax <= FixedArray::kMaxLength);
+  STATIC_ASSERT(Map::Bits3::EnumLengthBits::kMax <= FixedArray::kMaxLength);
   Type const cache_type =
       Type::Union(Type::SignedSmall(), Type::OtherInternal(), zone());
   Type const cache_array = Type::OtherInternal();
diff --git a/deps/v8/src/compiler/types.cc b/deps/v8/src/compiler/types.cc
index caa086bbd3bfc6..40adc606992755 100644
--- a/deps/v8/src/compiler/types.cc
+++ b/deps/v8/src/compiler/types.cc
@@ -210,6 +210,7 @@ Type::bitset BitsetType::Lub(const MapRefLike& map) {
     case JS_V8_BREAK_ITERATOR_TYPE:
     case JS_COLLATOR_TYPE:
     case JS_DATE_TIME_FORMAT_TYPE:
+    case JS_DISPLAY_NAMES_TYPE:
     case JS_LIST_FORMAT_TYPE:
     case JS_LOCALE_TYPE:
     case JS_NUMBER_FORMAT_TYPE:
@@ -273,6 +274,7 @@ Type::bitset BitsetType::Lub(const MapRefLike& map) {
     case ACCESSOR_PAIR_TYPE:
     case EMBEDDER_DATA_ARRAY_TYPE:
     case FIXED_ARRAY_TYPE:
+    case PROPERTY_DESCRIPTOR_OBJECT_TYPE:
     case HASH_TABLE_TYPE:
     case ORDERED_HASH_MAP_TYPE:
     case ORDERED_HASH_SET_TYPE:
@@ -346,9 +348,10 @@ Type::bitset BitsetType::Lub(const MapRefLike& map) {
     case INTERPRETER_DATA_TYPE:
     case TEMPLATE_OBJECT_DESCRIPTION_TYPE:
     case TUPLE2_TYPE:
-    case TUPLE3_TYPE:
+    case BREAK_POINT_TYPE:
+    case BREAK_POINT_INFO_TYPE:
+    case CACHED_TEMPLATE_OBJECT_TYPE:
     case ENUM_CACHE_TYPE:
-    case SOURCE_POSITION_TABLE_WITH_FRAME_CACHE_TYPE:
     case WASM_CAPI_FUNCTION_DATA_TYPE:
     case WASM_INDIRECT_FUNCTION_TABLE_TYPE:
     case WASM_DEBUG_INFO_TYPE:
@@ -1022,7 +1025,7 @@ void Type::PrintTo(std::ostream& os) const {
   if (this->IsBitset()) {
     BitsetType::Print(os, this->AsBitset());
   } else if (this->IsHeapConstant()) {
-    os << "HeapConstant(" << Brief(*this->AsHeapConstant()->Value()) << ")";
+    os << "HeapConstant(" << this->AsHeapConstant()->Ref() << ")";
   } else if (this->IsOtherNumberConstant()) {
     os << "OtherNumberConstant(" << this->AsOtherNumberConstant()->Value()
        << ")";
diff --git a/deps/v8/src/compiler/verifier.cc b/deps/v8/src/compiler/verifier.cc
index d7fdd4269ebf50..4384c1c066c76e 100644
--- a/deps/v8/src/compiler/verifier.cc
+++ b/deps/v8/src/compiler/verifier.cc
@@ -38,6 +38,7 @@ class Verifier::Visitor {
         check_inputs(check_inputs),
         code_type(code_type) {}
 
+  void CheckSwitch(Node* node, const AllNodes& all);
   void Check(Node* node, const AllNodes& all);
 
   Zone* zone;
@@ -92,6 +93,46 @@ class Verifier::Visitor {
   }
 };
 
+void Verifier::Visitor::CheckSwitch(Node* node, const AllNodes& all) {
+  // Count the number of {kIfValue} uses.
+  int case_count = 0;
+  bool expect_default = true;
+
+  // Data structure to check that each {kIfValue} has a unique value.
+  std::unordered_set<int32_t> if_value_parameters;
+
+  Node::Uses uses = node->uses();
+  for (const Node* use : uses) {
+    CHECK(all.IsLive(use));
+    switch (use->opcode()) {
+      case IrOpcode::kIfValue: {
+        // Check if each value is unique.
+        CHECK(
+            if_value_parameters.emplace(IfValueParametersOf(use->op()).value())
+                .second);
+        ++case_count;
+        break;
+      }
+      case IrOpcode::kIfDefault: {
+        // We expect exactly one {kIfDefault}.
+        CHECK(expect_default);
+        expect_default = false;
+        break;
+      }
+      default: {
+        FATAL("Switch #%d illegally used by #%d:%s", node->id(), use->id(),
+              use->op()->mnemonic());
+        break;
+      }
+    }
+  }
+
+  CHECK(!expect_default);
+  // + 1 because of the one {kIfDefault}.
+  CHECK_EQ(node->op()->ControlOutputCount(), case_count + 1);
+  CheckNotTyped(node);
+}
+
 void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
   int value_count = node->op()->ValueInputCount();
   int context_count = OperatorProperties::GetContextInputCount(node->op());
@@ -226,7 +267,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       for (const Node* input : node->inputs()) {
         CHECK(IrOpcode::IsGraphTerminator(input->opcode()));
       }
-      // Type is empty.
       CheckNotTyped(node);
       break;
     case IrOpcode::kDead:
@@ -260,7 +300,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CHECK_EQ(1, count_false);
       // The condition must be a Boolean.
       CheckValueInputIs(node, 0, Type::Boolean());
-      // Type is empty.
       CheckNotTyped(node);
       break;
     }
@@ -268,7 +307,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kIfFalse: {
       Node* control = NodeProperties::GetControlInput(node, 0);
       CHECK_EQ(IrOpcode::kBranch, control->opcode());
-      // Type is empty.
       CheckNotTyped(node);
       break;
     }
@@ -276,7 +314,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       // IfSuccess and IfException continuation only on throwing nodes.
       Node* input = NodeProperties::GetControlInput(node, 0);
       CHECK(!input->op()->HasProperty(Operator::kNoThrow));
-      // Type is empty.
       CheckNotTyped(node);
       break;
     }
@@ -284,53 +321,21 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       // IfSuccess and IfException continuation only on throwing nodes.
       Node* input = NodeProperties::GetControlInput(node, 0);
       CHECK(!input->op()->HasProperty(Operator::kNoThrow));
-      // Type can be anything.
       CheckTypeIs(node, Type::Any());
       break;
     }
     case IrOpcode::kSwitch: {
-      // Switch uses are Case and Default.
-      int count_case = 0, count_default = 0;
-      for (const Node* use : node->uses()) {
-        CHECK(all.IsLive(use));
-        switch (use->opcode()) {
-          case IrOpcode::kIfValue: {
-            for (const Node* user : node->uses()) {
-              if (user != use && user->opcode() == IrOpcode::kIfValue) {
-                CHECK_NE(IfValueParametersOf(use->op()).value(),
-                         IfValueParametersOf(user->op()).value());
-              }
-            }
-            ++count_case;
-            break;
-          }
-          case IrOpcode::kIfDefault: {
-            ++count_default;
-            break;
-          }
-          default: {
-            FATAL("Switch #%d illegally used by #%d:%s", node->id(), use->id(),
-                  use->op()->mnemonic());
-            break;
-          }
-        }
-      }
-      CHECK_EQ(1, count_default);
-      CHECK_EQ(node->op()->ControlOutputCount(), count_case + count_default);
-      // Type is empty.
-      CheckNotTyped(node);
+      CheckSwitch(node, all);
       break;
     }
     case IrOpcode::kIfValue:
     case IrOpcode::kIfDefault:
       CHECK_EQ(IrOpcode::kSwitch,
                NodeProperties::GetControlInput(node)->opcode());
-      // Type is empty.
       CheckNotTyped(node);
       break;
     case IrOpcode::kLoop: {
       CHECK_EQ(control_count, input_count);
-      // Type is empty.
       CheckNotTyped(node);
       // All loops need to be connected to a {Terminate} node to ensure they
       // stay connected to the graph end.
@@ -346,17 +351,14 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     }
     case IrOpcode::kMerge:
       CHECK_EQ(control_count, input_count);
-      // Type is empty.
       CheckNotTyped(node);
       break;
     case IrOpcode::kDeoptimizeIf:
     case IrOpcode::kDeoptimizeUnless:
-      // Type is empty.
       CheckNotTyped(node);
       break;
     case IrOpcode::kTrapIf:
     case IrOpcode::kTrapUnless:
-      // Type is empty.
       CheckNotTyped(node);
       break;
     case IrOpcode::kDeoptimize:
@@ -368,7 +370,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
           CHECK_EQ(IrOpcode::kEnd, use->opcode());
         }
       }
-      // Type is empty.
       CheckNotTyped(node);
       break;
     case IrOpcode::kTerminate:
@@ -384,7 +385,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
           CHECK_EQ(IrOpcode::kEnd, use->opcode());
         }
       }
-      // Type is empty.
       CheckNotTyped(node);
       break;
     case IrOpcode::kOsrNormalEntry:
@@ -393,7 +393,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CHECK_EQ(1, control_count);
       CHECK_EQ(1, effect_count);
       CHECK_EQ(2, input_count);
-      // Type is empty.
       CheckNotTyped(node);
       break;
 
@@ -409,7 +408,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       // Currently, parameter indices start at -1 instead of 0.
       CHECK_LE(-1, index);
       CHECK_LT(index + 1, start->op()->ValueOutputCount());
-      // Type can be anything.
       CheckTypeIs(node, Type::Any());
       break;
     }
@@ -421,27 +419,23 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kRelocatableInt64Constant:
       // Constants have no inputs.
       CHECK_EQ(0, input_count);
-      // Type is empty.
       CheckNotTyped(node);
       break;
     case IrOpcode::kNumberConstant:
       // Constants have no inputs.
       CHECK_EQ(0, input_count);
-      // Type is a number.
       CheckTypeIs(node, Type::Number());
       break;
     case IrOpcode::kHeapConstant:
     case IrOpcode::kCompressedHeapConstant:
       // Constants have no inputs.
       CHECK_EQ(0, input_count);
-      // Type is anything.
       CheckTypeIs(node, Type::Any());
       break;
     case IrOpcode::kExternalConstant:
     case IrOpcode::kPointerConstant:
       // Constants have no inputs.
       CHECK_EQ(0, input_count);
-      // Type is an external pointer.
       CheckTypeIs(node, Type::ExternalPointer());
       break;
     case IrOpcode::kOsrValue:
@@ -456,9 +450,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       int index = static_cast<int>(ProjectionIndexOf(node->op()));
       Node* input = NodeProperties::GetValueInput(node, 0);
       CHECK_GT(input->op()->ValueOutputCount(), index);
-      // Type can be anything.
-      // TODO(rossberg): Introduce tuple types for this.
-      // TODO(titzer): Convince rossberg not to.
       CheckTypeIs(node, Type::Any());
       break;
     }
@@ -468,7 +459,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CHECK_EQ(3, value_count);
       // The condition must be a Boolean.
       CheckValueInputIs(node, 0, Type::Boolean());
-      // Type can be anything.
       CheckTypeIs(node, Type::Any());
       break;
     }
@@ -532,7 +522,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       break;
     }
     case IrOpcode::kCheckpoint:
-      // Type is empty.
       CheckNotTyped(node);
       break;
     case IrOpcode::kBeginRegion:
@@ -594,7 +583,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kJSGreaterThan:
     case IrOpcode::kJSLessThanOrEqual:
     case IrOpcode::kJSGreaterThanOrEqual:
-      // Type is Boolean.
       CheckTypeIs(node, Type::Boolean());
       break;
 
@@ -620,31 +608,25 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       break;
 
     case IrOpcode::kToBoolean:
-      // Type is Boolean.
       CheckTypeIs(node, Type::Boolean());
       break;
     case IrOpcode::kJSToLength:
       CheckTypeIs(node, Type::Range(0, kMaxSafeInteger, zone));
       break;
     case IrOpcode::kJSToName:
-      // Type is Name.
       CheckTypeIs(node, Type::Name());
       break;
     case IrOpcode::kJSToNumber:
     case IrOpcode::kJSToNumberConvertBigInt:
-      // Type is Number.
       CheckTypeIs(node, Type::Number());
       break;
     case IrOpcode::kJSToNumeric:
-      // Type is Numeric.
       CheckTypeIs(node, Type::Numeric());
       break;
     case IrOpcode::kJSToString:
-      // Type is String.
       CheckTypeIs(node, Type::String());
       break;
     case IrOpcode::kJSToObject:
-      // Type is Receiver.
       CheckTypeIs(node, Type::Receiver());
       break;
     case IrOpcode::kJSParseInt:
@@ -658,125 +640,97 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::Boolean());
       break;
     case IrOpcode::kJSCreate:
-      // Type is Object.
       CheckTypeIs(node, Type::Object());
       break;
     case IrOpcode::kJSCreateArguments:
-      // Type is Array \/ OtherObject.
       CheckTypeIs(node, Type::ArrayOrOtherObject());
       break;
     case IrOpcode::kJSCreateArray:
-      // Type is Array.
       CheckTypeIs(node, Type::Array());
       break;
     case IrOpcode::kJSCreateArrayIterator:
-      // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateAsyncFunctionObject:
-      // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateCollectionIterator:
-      // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateBoundFunction:
-      // Type is BoundFunction.
       CheckTypeIs(node, Type::BoundFunction());
       break;
     case IrOpcode::kJSCreateClosure:
-      // Type is Function.
       CheckTypeIs(node, Type::Function());
       break;
     case IrOpcode::kJSCreateIterResultObject:
-      // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateStringIterator:
-      // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateKeyValueArray:
-      // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateObject:
-      // Type is Object.
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreatePromise:
-      // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateTypedArray:
-      // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateLiteralArray:
-      // Type is Array.
       CheckTypeIs(node, Type::Array());
       break;
     case IrOpcode::kJSCreateEmptyLiteralArray:
-      // Type is Array.
       CheckTypeIs(node, Type::Array());
       break;
     case IrOpcode::kJSCreateArrayFromIterable:
-      // Type is Array.
       CheckTypeIs(node, Type::Array());
       break;
     case IrOpcode::kJSCreateLiteralObject:
     case IrOpcode::kJSCreateEmptyLiteralObject:
     case IrOpcode::kJSCloneObject:
     case IrOpcode::kJSCreateLiteralRegExp:
-      // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSGetTemplateObject:
-      // Type is Array
       CheckTypeIs(node, Type::Array());
       break;
     case IrOpcode::kJSLoadProperty:
-      // Type can be anything.
       CheckTypeIs(node, Type::Any());
       CHECK(PropertyAccessOf(node->op()).feedback().IsValid());
       break;
     case IrOpcode::kJSLoadNamed:
-      // Type can be anything.
       CheckTypeIs(node, Type::Any());
       break;
     case IrOpcode::kJSLoadGlobal:
-      // Type can be anything.
       CheckTypeIs(node, Type::Any());
       CHECK(LoadGlobalParametersOf(node->op()).feedback().IsValid());
       break;
     case IrOpcode::kJSStoreProperty:
-      // Type is empty.
       CheckNotTyped(node);
       CHECK(PropertyAccessOf(node->op()).feedback().IsValid());
       break;
     case IrOpcode::kJSStoreNamed:
-      // Type is empty.
       CheckNotTyped(node);
       break;
     case IrOpcode::kJSStoreGlobal:
-      // Type is empty.
       CheckNotTyped(node);
       CHECK(StoreGlobalParametersOf(node->op()).feedback().IsValid());
       break;
     case IrOpcode::kJSStoreNamedOwn:
-      // Type is empty.
       CheckNotTyped(node);
       CHECK(StoreNamedOwnParametersOf(node->op()).feedback().IsValid());
       break;
     case IrOpcode::kJSGetIterator:
-      // Type can be anything
       CheckValueInputIs(node, 0, Type::Any());
       CheckTypeIs(node, Type::Any());
       break;
     case IrOpcode::kJSStoreDataPropertyInLiteral:
     case IrOpcode::kJSStoreInArrayLiteral:
-      // Type is empty.
       CheckNotTyped(node);
       CHECK(FeedbackParameterOf(node->op()).feedback().IsValid());
       break;
@@ -785,38 +739,31 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kJSHasInPrototypeChain:
     case IrOpcode::kJSInstanceOf:
     case IrOpcode::kJSOrdinaryHasInstance:
-      // Type is Boolean.
       CheckTypeIs(node, Type::Boolean());
       break;
     case IrOpcode::kTypeOf:
-      // Type is InternalizedString.
       CheckTypeIs(node, Type::InternalizedString());
       break;
     case IrOpcode::kJSGetSuperConstructor:
-      // We don't check the input for Type::Function because
-      // this_function can be context-allocated.
-      // Any -> Callable.
+      // We don't check the input for Type::Function because this_function can
+      // be context-allocated.
       CheckValueInputIs(node, 0, Type::Any());
       CheckTypeIs(node, Type::Callable());
       break;
 
+    case IrOpcode::kJSHasContextExtension:
+      CheckTypeIs(node, Type::Boolean());
+      break;
     case IrOpcode::kJSLoadContext:
-      // Type can be anything.
       CheckTypeIs(node, Type::Any());
       break;
     case IrOpcode::kJSStoreContext:
-      // Type is empty.
       CheckNotTyped(node);
       break;
     case IrOpcode::kJSCreateFunctionContext:
     case IrOpcode::kJSCreateCatchContext:
     case IrOpcode::kJSCreateWithContext:
     case IrOpcode::kJSCreateBlockContext: {
-      // Type is Context, and operand is Internal.
-      Node* context = NodeProperties::GetContextInput(node);
-      // TODO(bmeurer): This should say CheckTypeIs, but we don't have type
-      // OtherInternal on certain contexts, i.e. those from OsrValue inputs.
-      CheckTypeMaybe(context, Type::OtherInternal());
       CheckTypeIs(node, Type::OtherInternal());
       break;
     }
@@ -825,7 +772,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kJSConstruct:
     case IrOpcode::kJSConstructWithArrayLike:
     case IrOpcode::kJSConstructWithSpread:
-      // Type is Receiver.
       CheckTypeIs(node, Type::Receiver());
       break;
     case IrOpcode::kJSCallForwardVarargs:
@@ -833,17 +779,14 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kJSCallWithArrayLike:
     case IrOpcode::kJSCallWithSpread:
     case IrOpcode::kJSCallRuntime:
-      // Type can be anything.
       CheckTypeIs(node, Type::Any());
       break;
 
     case IrOpcode::kJSForInEnumerate:
-      // Any -> OtherInternal.
       CheckValueInputIs(node, 0, Type::Any());
       CheckTypeIs(node, Type::OtherInternal());
       break;
     case IrOpcode::kJSForInPrepare:
-      // TODO(bmeurer): What are the constraints on thse?
       CheckTypeIs(node, Type::Any());
       break;
     case IrOpcode::kJSForInNext:
@@ -887,7 +830,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
 
     case IrOpcode::kJSStackCheck:
     case IrOpcode::kJSDebugger:
-      // Type is empty.
       CheckNotTyped(node);
       break;
 
@@ -953,19 +895,16 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     // Simplified operators
     // -------------------------------
     case IrOpcode::kBooleanNot:
-      // Boolean -> Boolean
       CheckValueInputIs(node, 0, Type::Boolean());
       CheckTypeIs(node, Type::Boolean());
       break;
     case IrOpcode::kNumberEqual:
-      // (Number, Number) -> Boolean
       CheckValueInputIs(node, 0, Type::Number());
       CheckValueInputIs(node, 1, Type::Number());
       CheckTypeIs(node, Type::Boolean());
       break;
     case IrOpcode::kNumberLessThan:
     case IrOpcode::kNumberLessThanOrEqual:
-      // (Number, Number) -> Boolean
       CheckValueInputIs(node, 0, Type::Number());
       CheckValueInputIs(node, 1, Type::Number());
       CheckTypeIs(node, Type::Boolean());
@@ -985,6 +924,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::Boolean());
       break;
     case IrOpcode::kSpeculativeBigIntAdd:
+    case IrOpcode::kSpeculativeBigIntSubtract:
       CheckTypeIs(node, Type::BigInt());
       break;
     case IrOpcode::kSpeculativeBigIntNegate:
@@ -995,6 +935,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::BigInt());
       break;
     case IrOpcode::kBigIntAdd:
+    case IrOpcode::kBigIntSubtract:
       CheckValueInputIs(node, 0, Type::BigInt());
       CheckValueInputIs(node, 1, Type::BigInt());
       CheckTypeIs(node, Type::BigInt());
@@ -1007,13 +948,11 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kNumberSubtract:
     case IrOpcode::kNumberMultiply:
     case IrOpcode::kNumberDivide:
-      // (Number, Number) -> Number
       CheckValueInputIs(node, 0, Type::Number());
       CheckValueInputIs(node, 1, Type::Number());
       CheckTypeIs(node, Type::Number());
       break;
     case IrOpcode::kNumberModulus:
-      // (Number, Number) -> Number
       CheckValueInputIs(node, 0, Type::Number());
       CheckValueInputIs(node, 1, Type::Number());
       CheckTypeIs(node, Type::Number());
@@ -1021,7 +960,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kNumberBitwiseOr:
     case IrOpcode::kNumberBitwiseXor:
     case IrOpcode::kNumberBitwiseAnd:
-      // (Signed32, Signed32) -> Signed32
       CheckValueInputIs(node, 0, Type::Signed32());
       CheckValueInputIs(node, 1, Type::Signed32());
       CheckTypeIs(node, Type::Signed32());
@@ -1033,7 +971,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       break;
     case IrOpcode::kNumberShiftLeft:
     case IrOpcode::kNumberShiftRight:
-      // (Signed32, Unsigned32) -> Signed32
       CheckValueInputIs(node, 0, Type::Signed32());
       CheckValueInputIs(node, 1, Type::Unsigned32());
       CheckTypeIs(node, Type::Signed32());
@@ -1043,7 +980,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::Signed32());
       break;
     case IrOpcode::kNumberShiftRightLogical:
-      // (Unsigned32, Unsigned32) -> Unsigned32
       CheckValueInputIs(node, 0, Type::Unsigned32());
       CheckValueInputIs(node, 1, Type::Unsigned32());
       CheckTypeIs(node, Type::Unsigned32());
@@ -1052,13 +988,11 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::Unsigned32());
       break;
     case IrOpcode::kNumberImul:
-      // (Unsigned32, Unsigned32) -> Signed32
       CheckValueInputIs(node, 0, Type::Unsigned32());
       CheckValueInputIs(node, 1, Type::Unsigned32());
       CheckTypeIs(node, Type::Signed32());
       break;
     case IrOpcode::kNumberClz32:
-      // Unsigned32 -> Unsigned32
       CheckValueInputIs(node, 0, Type::Unsigned32());
       CheckTypeIs(node, Type::Unsigned32());
       break;
@@ -1066,7 +1000,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kNumberMax:
     case IrOpcode::kNumberMin:
     case IrOpcode::kNumberPow:
-      // (Number, Number) -> Number
       CheckValueInputIs(node, 0, Type::Number());
       CheckValueInputIs(node, 1, Type::Number());
       CheckTypeIs(node, Type::Number());
@@ -1098,48 +1031,39 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kNumberTan:
     case IrOpcode::kNumberTanh:
     case IrOpcode::kNumberTrunc:
-      // Number -> Number
       CheckValueInputIs(node, 0, Type::Number());
       CheckTypeIs(node, Type::Number());
       break;
     case IrOpcode::kNumberToBoolean:
-      // Number -> Boolean
       CheckValueInputIs(node, 0, Type::Number());
       CheckTypeIs(node, Type::Boolean());
       break;
     case IrOpcode::kNumberToInt32:
-      // Number -> Signed32
       CheckValueInputIs(node, 0, Type::Number());
       CheckTypeIs(node, Type::Signed32());
       break;
     case IrOpcode::kNumberToString:
-      // Number -> String
       CheckValueInputIs(node, 0, Type::Number());
       CheckTypeIs(node, Type::String());
       break;
     case IrOpcode::kNumberToUint32:
     case IrOpcode::kNumberToUint8Clamped:
-      // Number -> Unsigned32
       CheckValueInputIs(node, 0, Type::Number());
       CheckTypeIs(node, Type::Unsigned32());
       break;
     case IrOpcode::kSpeculativeToNumber:
-      // Any -> Number
       CheckValueInputIs(node, 0, Type::Any());
       CheckTypeIs(node, Type::Number());
       break;
     case IrOpcode::kPlainPrimitiveToNumber:
-      // PlainPrimitive -> Number
       CheckValueInputIs(node, 0, Type::PlainPrimitive());
       CheckTypeIs(node, Type::Number());
       break;
     case IrOpcode::kPlainPrimitiveToWord32:
-      // PlainPrimitive -> Integral32
       CheckValueInputIs(node, 0, Type::PlainPrimitive());
       CheckTypeIs(node, Type::Integral32());
       break;
     case IrOpcode::kPlainPrimitiveToFloat64:
-      // PlainPrimitive -> Number
       CheckValueInputIs(node, 0, Type::PlainPrimitive());
       CheckTypeIs(node, Type::Number());
       break;
@@ -1152,46 +1076,38 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kStringEqual:
     case IrOpcode::kStringLessThan:
     case IrOpcode::kStringLessThanOrEqual:
-      // (String, String) -> Boolean
       CheckValueInputIs(node, 0, Type::String());
       CheckValueInputIs(node, 1, Type::String());
       CheckTypeIs(node, Type::Boolean());
       break;
     case IrOpcode::kStringToNumber:
-      // String -> Number
       CheckValueInputIs(node, 0, Type::String());
       CheckTypeIs(node, Type::Number());
       break;
     case IrOpcode::kStringCharCodeAt:
-      // (String, Unsigned32) -> UnsignedSmall
       CheckValueInputIs(node, 0, Type::String());
       CheckValueInputIs(node, 1, Type::Unsigned32());
       CheckTypeIs(node, Type::UnsignedSmall());
       break;
     case IrOpcode::kStringCodePointAt:
-      // (String, Unsigned32) -> UnsignedSmall
       CheckValueInputIs(node, 0, Type::String());
       CheckValueInputIs(node, 1, Type::Unsigned32());
       CheckTypeIs(node, Type::UnsignedSmall());
       break;
     case IrOpcode::kStringFromSingleCharCode:
-      // Number -> String
       CheckValueInputIs(node, 0, Type::Number());
       CheckTypeIs(node, Type::String());
       break;
     case IrOpcode::kStringFromSingleCodePoint:
-      // (Unsigned32) -> String
       CheckValueInputIs(node, 0, Type::Number());
       CheckTypeIs(node, Type::String());
       break;
     case IrOpcode::kStringFromCodePointAt:
-      // (String, Unsigned32) -> UnsignedSmall
       CheckValueInputIs(node, 0, Type::String());
       CheckValueInputIs(node, 1, Type::Unsigned32());
       CheckTypeIs(node, Type::String());
       break;
     case IrOpcode::kStringIndexOf:
-      // (String, String, SignedSmall) -> SignedSmall
       CheckValueInputIs(node, 0, Type::String());
       CheckValueInputIs(node, 1, Type::String());
       CheckValueInputIs(node, 2, Type::SignedSmall());
@@ -1213,19 +1129,15 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::String());
       break;
     case IrOpcode::kReferenceEqual:
-      // (Unique, Any) -> Boolean  and
-      // (Any, Unique) -> Boolean
       CheckTypeIs(node, Type::Boolean());
       break;
     case IrOpcode::kSameValue:
     case IrOpcode::kSameValueNumbersOnly:
-      // (Any, Any) -> Boolean
       CheckValueInputIs(node, 0, Type::Any());
       CheckValueInputIs(node, 1, Type::Any());
       CheckTypeIs(node, Type::Boolean());
       break;
     case IrOpcode::kNumberSameValue:
-      // (Number, Number) -> Boolean
       CheckValueInputIs(node, 0, Type::Number());
       CheckValueInputIs(node, 1, Type::Number());
       CheckTypeIs(node, Type::Boolean());
@@ -1340,7 +1252,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckNotTyped(node);
       break;
 
-    case IrOpcode::kChangeCompressedSignedToInt32:
     case IrOpcode::kChangeTaggedSignedToInt32: {
       // Signed32 /\ Tagged -> Signed32 /\ UntaggedInt32
       // TODO(neis): Activate once ChangeRepresentation works in typer.
@@ -1382,8 +1293,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       break;
     }
     case IrOpcode::kChangeTaggedToTaggedSigned:      // Fall through.
-    case IrOpcode::kChangeCompressedToTaggedSigned:  // Fall through.
-    case IrOpcode::kChangeTaggedToCompressedSigned:
       break;
     case IrOpcode::kTruncateTaggedToFloat64: {
       // NumberOrUndefined /\ Tagged -> Number /\ UntaggedFloat64
@@ -1395,7 +1304,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       // CheckTypeIs(node, to));
       break;
     }
-    case IrOpcode::kChangeInt31ToCompressedSigned:
     case IrOpcode::kChangeInt31ToTaggedSigned: {
       // Signed31 /\ UntaggedInt32 -> Signed31 /\ Tagged
       // TODO(neis): Activate once ChangeRepresentation works in typer.
@@ -1529,7 +1437,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::Symbol());
       break;
     case IrOpcode::kConvertReceiver:
-      // (Any, Any) -> Receiver
       CheckValueInputIs(node, 0, Type::Any());
       CheckValueInputIs(node, 1, Type::Any());
       CheckTypeIs(node, Type::Receiver());
@@ -1542,7 +1449,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kCheckedUint32Div:
     case IrOpcode::kCheckedUint32Mod:
     case IrOpcode::kCheckedInt32Mul:
-    case IrOpcode::kCheckedInt32ToCompressedSigned:
     case IrOpcode::kCheckedInt32ToTaggedSigned:
     case IrOpcode::kCheckedInt64ToInt32:
     case IrOpcode::kCheckedInt64ToTaggedSigned:
@@ -1556,14 +1462,11 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kCheckedFloat64ToInt64:
     case IrOpcode::kCheckedTaggedSignedToInt32:
     case IrOpcode::kCheckedTaggedToInt32:
+    case IrOpcode::kCheckedTaggedToArrayIndex:
     case IrOpcode::kCheckedTaggedToInt64:
     case IrOpcode::kCheckedTaggedToFloat64:
     case IrOpcode::kCheckedTaggedToTaggedSigned:
     case IrOpcode::kCheckedTaggedToTaggedPointer:
-    case IrOpcode::kCheckedCompressedToTaggedSigned:
-    case IrOpcode::kCheckedCompressedToTaggedPointer:
-    case IrOpcode::kCheckedTaggedToCompressedSigned:
-    case IrOpcode::kCheckedTaggedToCompressedPointer:
     case IrOpcode::kCheckedTruncateTaggedToWord32:
     case IrOpcode::kAssertType:
       break;
@@ -1812,16 +1715,9 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kBitcastTaggedToWordForTagAndSmiBits:
     case IrOpcode::kBitcastWordToTagged:
     case IrOpcode::kBitcastWordToTaggedSigned:
-    case IrOpcode::kBitcastWord32ToCompressedSigned:
-    case IrOpcode::kBitcastCompressedSignedToWord32:
+    case IrOpcode::kBitcastWord32ToWord64:
     case IrOpcode::kChangeInt32ToInt64:
     case IrOpcode::kChangeUint32ToUint64:
-    case IrOpcode::kChangeTaggedToCompressed:
-    case IrOpcode::kChangeTaggedPointerToCompressedPointer:
-    case IrOpcode::kChangeTaggedSignedToCompressedSigned:
-    case IrOpcode::kChangeCompressedToTagged:
-    case IrOpcode::kChangeCompressedPointerToTaggedPointer:
-    case IrOpcode::kChangeCompressedSignedToTaggedSigned:
     case IrOpcode::kChangeInt32ToFloat64:
     case IrOpcode::kChangeInt64ToFloat64:
     case IrOpcode::kChangeUint32ToFloat64:
@@ -1852,6 +1748,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kTaggedPoisonOnSpeculation:
     case IrOpcode::kWord32PoisonOnSpeculation:
     case IrOpcode::kWord64PoisonOnSpeculation:
+    case IrOpcode::kLoadStackCheckOffset:
     case IrOpcode::kLoadFramePointer:
     case IrOpcode::kLoadParentFramePointer:
     case IrOpcode::kUnalignedLoad:
diff --git a/deps/v8/src/compiler/wasm-compiler.cc b/deps/v8/src/compiler/wasm-compiler.cc
index ddc97ce5031161..55cb950cffe3a3 100644
--- a/deps/v8/src/compiler/wasm-compiler.cc
+++ b/deps/v8/src/compiler/wasm-compiler.cc
@@ -9,6 +9,7 @@
 #include "src/base/optional.h"
 #include "src/base/platform/elapsed-timer.h"
 #include "src/base/platform/platform.h"
+#include "src/base/small-vector.h"
 #include "src/base/v8-fallthrough.h"
 #include "src/builtins/builtins.h"
 #include "src/codegen/assembler-inl.h"
@@ -22,6 +23,7 @@
 #include "src/compiler/common-operator.h"
 #include "src/compiler/compiler-source-position-table.h"
 #include "src/compiler/diamond.h"
+#include "src/compiler/graph-assembler.h"
 #include "src/compiler/graph-visualizer.h"
 #include "src/compiler/graph.h"
 #include "src/compiler/int64-lowering.h"
@@ -53,7 +55,6 @@
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-objects-inl.h"
 #include "src/wasm/wasm-opcodes.h"
-#include "src/wasm/wasm-text.h"
 
 namespace v8 {
 namespace internal {
@@ -84,66 +85,59 @@ MachineType assert_size(int expected_size, MachineType type) {
 #define WASM_INSTANCE_OBJECT_OFFSET(name) \
   wasm::ObjectAccess::ToTagged(WasmInstanceObject::k##name##Offset)
 
-#define LOAD_RAW(base_pointer, byte_offset, type)               \
-  InsertDecompressionIfNeeded(                                  \
-      type, SetEffect(graph()->NewNode(                         \
-                mcgraph()->machine()->Load(type), base_pointer, \
-                mcgraph()->Int32Constant(byte_offset), Effect(), Control())))
+#define LOAD_RAW(base_pointer, byte_offset, type)                             \
+  SetEffect(graph()->NewNode(mcgraph()->machine()->Load(type), base_pointer,  \
+                             mcgraph()->Int32Constant(byte_offset), effect(), \
+                             control()))
 
-#define LOAD_RAW_NODE_OFFSET(base_pointer, node_offset, type)               \
-  InsertDecompressionIfNeeded(                                              \
-      type, SetEffect(graph()->NewNode(mcgraph()->machine()->Load(type),    \
-                                       base_pointer, node_offset, Effect(), \
-                                       Control())))
+#define LOAD_RAW_NODE_OFFSET(base_pointer, node_offset, type)                \
+  SetEffect(graph()->NewNode(mcgraph()->machine()->Load(type), base_pointer, \
+                             node_offset, effect(), control()))
 
 #define LOAD_INSTANCE_FIELD(name, type)                             \
   LOAD_RAW(instance_node_.get(), WASM_INSTANCE_OBJECT_OFFSET(name), \
            assert_size(WASM_INSTANCE_OBJECT_SIZE(name), type))
 
 #define LOAD_TAGGED_POINTER(base_pointer, byte_offset) \
-  LOAD_RAW(base_pointer, byte_offset,                  \
-           MachineType::TypeCompressedTaggedPointer())
+  LOAD_RAW(base_pointer, byte_offset, MachineType::TaggedPointer())
 
 #define LOAD_TAGGED_ANY(base_pointer, byte_offset) \
-  LOAD_RAW(base_pointer, byte_offset, MachineType::TypeCompressedTagged())
+  LOAD_RAW(base_pointer, byte_offset, MachineType::AnyTagged())
 
 #define LOAD_FIXED_ARRAY_SLOT(array_node, index, type) \
   LOAD_RAW(array_node,                                 \
            wasm::ObjectAccess::ElementOffsetInTaggedFixedArray(index), type)
 
 #define LOAD_FIXED_ARRAY_SLOT_SMI(array_node, index) \
-  LOAD_FIXED_ARRAY_SLOT(array_node, index,           \
-                        MachineType::TypeCompressedTaggedSigned())
+  LOAD_FIXED_ARRAY_SLOT(array_node, index, MachineType::TaggedSigned())
 
 #define LOAD_FIXED_ARRAY_SLOT_PTR(array_node, index) \
-  LOAD_FIXED_ARRAY_SLOT(array_node, index,           \
-                        MachineType::TypeCompressedTaggedPointer())
+  LOAD_FIXED_ARRAY_SLOT(array_node, index, MachineType::TaggedPointer())
 
 #define LOAD_FIXED_ARRAY_SLOT_ANY(array_node, index) \
-  LOAD_FIXED_ARRAY_SLOT(array_node, index, MachineType::TypeCompressedTagged())
+  LOAD_FIXED_ARRAY_SLOT(array_node, index, MachineType::AnyTagged())
 
-#define STORE_RAW(base, offset, val, rep, barrier)                           \
-  SetEffect(graph()->NewNode(                                                \
-      mcgraph()->machine()->Store(StoreRepresentation(rep, barrier)), base,  \
-      mcgraph()->Int32Constant(offset), InsertCompressionIfNeeded(rep, val), \
-      Effect(), Control()))
+#define STORE_RAW(base, offset, val, rep, barrier)                          \
+  SetEffect(graph()->NewNode(                                               \
+      mcgraph()->machine()->Store(StoreRepresentation(rep, barrier)), base, \
+      mcgraph()->Int32Constant(offset), val, effect(), control()))
 
 #define STORE_RAW_NODE_OFFSET(base, node_offset, val, rep, barrier)         \
   SetEffect(graph()->NewNode(                                               \
       mcgraph()->machine()->Store(StoreRepresentation(rep, barrier)), base, \
-      node_offset, InsertCompressionIfNeeded(rep, val), Effect(), Control()))
+      node_offset, val, effect(), control()))
 
 // This can be used to store tagged Smi values only.
 #define STORE_FIXED_ARRAY_SLOT_SMI(array_node, index, value)                   \
   STORE_RAW(array_node,                                                        \
             wasm::ObjectAccess::ElementOffsetInTaggedFixedArray(index), value, \
-            MachineType::RepCompressedTaggedSigned(), kNoWriteBarrier)
+            MachineRepresentation::kTaggedSigned, kNoWriteBarrier)
 
 // This can be used to store any tagged (Smi and HeapObject) value.
 #define STORE_FIXED_ARRAY_SLOT_ANY(array_node, index, value)                   \
   STORE_RAW(array_node,                                                        \
             wasm::ObjectAccess::ElementOffsetInTaggedFixedArray(index), value, \
-            MachineType::RepCompressedTagged(), kFullWriteBarrier)
+            MachineRepresentation::kTagged, kFullWriteBarrier)
 
 void MergeControlToEnd(MachineGraph* mcgraph, Node* node) {
   Graph* g = mcgraph->graph();
@@ -169,11 +163,18 @@ bool ContainsInt64(wasm::FunctionSig* sig) {
 }
 }  // namespace
 
+class WasmGraphAssembler : public GraphAssembler {
+ public:
+  WasmGraphAssembler(MachineGraph* mcgraph, Zone* zone)
+      : GraphAssembler(mcgraph, zone) {}
+};
+
 WasmGraphBuilder::WasmGraphBuilder(
     wasm::CompilationEnv* env, Zone* zone, MachineGraph* mcgraph,
     wasm::FunctionSig* sig,
     compiler::SourcePositionTable* source_position_table)
-    : zone_(zone),
+    : gasm_(std::make_unique<WasmGraphAssembler>(mcgraph, zone)),
+      zone_(zone),
       mcgraph_(mcgraph),
       env_(env),
       has_simd_(ContainsSimd(sig)),
@@ -184,6 +185,10 @@ WasmGraphBuilder::WasmGraphBuilder(
   DCHECK_NOT_NULL(mcgraph_);
 }
 
+// Destructor define here where the definition of {WasmGraphAssembler} is
+// available.
+WasmGraphBuilder::~WasmGraphBuilder() = default;
+
 Node* WasmGraphBuilder::Error() { return mcgraph()->Dead(); }
 
 Node* WasmGraphBuilder::Start(unsigned params) {
@@ -310,29 +315,26 @@ Node* WasmGraphBuilder::IntPtrConstant(intptr_t value) {
   return mcgraph()->IntPtrConstant(value);
 }
 
-void WasmGraphBuilder::StackCheck(wasm::WasmCodePosition position,
-                                  Node** effect, Node** control) {
+void WasmGraphBuilder::StackCheck(wasm::WasmCodePosition position) {
   DCHECK_NOT_NULL(env_);  // Wrappers don't get stack checks.
-  if (FLAG_wasm_no_stack_checks || !env_->runtime_exception_support) {
+  if (!FLAG_wasm_stack_checks || !env_->runtime_exception_support) {
     return;
   }
-  if (effect == nullptr) effect = effect_;
-  if (control == nullptr) control = control_;
 
   Node* limit_address = graph()->NewNode(
       mcgraph()->machine()->Load(MachineType::Pointer()), instance_node_.get(),
       mcgraph()->Int32Constant(WASM_INSTANCE_OBJECT_OFFSET(StackLimitAddress)),
-      *effect, *control);
-  Node* limit = graph()->NewNode(
+      effect(), control());
+  Node* limit = SetEffect(graph()->NewNode(
       mcgraph()->machine()->Load(MachineType::Pointer()), limit_address,
-      mcgraph()->IntPtrConstant(0), limit_address, *control);
-  *effect = limit;
+      mcgraph()->IntPtrConstant(0), limit_address, control()));
 
-  Node* check =
-      graph()->NewNode(mcgraph()->machine()->StackPointerGreaterThan(), limit);
+  Node* check = SetEffect(graph()->NewNode(
+      mcgraph()->machine()->StackPointerGreaterThan(StackCheckKind::kWasm),
+      limit, effect()));
 
   Diamond stack_check(graph(), mcgraph()->common(), check, BranchHint::kTrue);
-  stack_check.Chain(*control);
+  stack_check.Chain(control());
 
   if (stack_check_call_operator_ == nullptr) {
     // Build and cache the stack check call operator and the constant
@@ -352,65 +354,14 @@ void WasmGraphBuilder::StackCheck(wasm::WasmCodePosition position,
   }
 
   Node* call = graph()->NewNode(stack_check_call_operator_.get(),
-                                stack_check_code_node_.get(), *effect,
+                                stack_check_code_node_.get(), effect(),
                                 stack_check.if_false);
 
   SetSourcePosition(call, position);
 
-  Node* ephi = stack_check.EffectPhi(*effect, call);
+  Node* ephi = stack_check.EffectPhi(effect(), call);
 
-  *control = stack_check.merge;
-  *effect = ephi;
-}
-
-Node* WasmGraphBuilder::InsertDecompressionIfNeeded(MachineType type,
-                                                    Node* value) {
-  if (COMPRESS_POINTERS_BOOL) {
-    switch (type.representation()) {
-      case MachineRepresentation::kCompressedPointer:
-        value = graph()->NewNode(
-            mcgraph()->machine()->ChangeCompressedPointerToTaggedPointer(),
-            value);
-        break;
-      case MachineRepresentation::kCompressedSigned:
-        value = graph()->NewNode(
-            mcgraph()->machine()->ChangeCompressedSignedToTaggedSigned(),
-            value);
-        break;
-      case MachineRepresentation::kCompressed:
-        value = graph()->NewNode(
-            mcgraph()->machine()->ChangeCompressedToTagged(), value);
-        break;
-      default:
-        break;
-    }
-  }
-  return value;
-}
-
-Node* WasmGraphBuilder::InsertCompressionIfNeeded(MachineRepresentation rep,
-                                                  Node* value) {
-  if (COMPRESS_POINTERS_BOOL) {
-    switch (rep) {
-      case MachineRepresentation::kCompressedPointer:
-        value = graph()->NewNode(
-            mcgraph()->machine()->ChangeTaggedPointerToCompressedPointer(),
-            value);
-        break;
-      case MachineRepresentation::kCompressedSigned:
-        value = graph()->NewNode(
-            mcgraph()->machine()->ChangeTaggedSignedToCompressedSigned(),
-            value);
-        break;
-      case MachineRepresentation::kCompressed:
-        value = graph()->NewNode(
-            mcgraph()->machine()->ChangeTaggedToCompressed(), value);
-        break;
-      default:
-        break;
-    }
-  }
-  return value;
+  SetEffectControl(ephi, stack_check.merge);
 }
 
 void WasmGraphBuilder::PatchInStackCheckIfNeeded() {
@@ -419,18 +370,17 @@ void WasmGraphBuilder::PatchInStackCheckIfNeeded() {
   Node* start = graph()->start();
   // Place a stack check which uses a dummy node as control and effect.
   Node* dummy = graph()->NewNode(mcgraph()->common()->Dead());
-  Node* control = dummy;
-  Node* effect = dummy;
+  SetEffectControl(dummy);
   // The function-prologue stack check is associated with position 0, which
   // is never a position of any instruction in the function.
-  StackCheck(0, &effect, &control);
+  StackCheck(0);
 
   // In testing, no steck checks were emitted. Nothing to rewire then.
-  if (effect == dummy) return;
+  if (effect() == dummy) return;
 
   // Now patch all control uses of {start} to use {control} and all effect uses
   // to use {effect} instead. Then rewire the dummy node to use start instead.
-  NodeProperties::ReplaceUses(start, start, effect, control);
+  NodeProperties::ReplaceUses(start, start, effect(), control());
   NodeProperties::ReplaceUses(dummy, nullptr, start, start);
 }
 
@@ -1008,19 +958,19 @@ Node* Branch(MachineGraph* mcgraph, Node* cond, Node** true_node,
 
 Node* WasmGraphBuilder::BranchNoHint(Node* cond, Node** true_node,
                                      Node** false_node) {
-  return Branch(mcgraph(), cond, true_node, false_node, Control(),
+  return Branch(mcgraph(), cond, true_node, false_node, control(),
                 BranchHint::kNone);
 }
 
 Node* WasmGraphBuilder::BranchExpectTrue(Node* cond, Node** true_node,
                                          Node** false_node) {
-  return Branch(mcgraph(), cond, true_node, false_node, Control(),
+  return Branch(mcgraph(), cond, true_node, false_node, control(),
                 BranchHint::kTrue);
 }
 
 Node* WasmGraphBuilder::BranchExpectFalse(Node* cond, Node** true_node,
                                           Node** false_node) {
-  return Branch(mcgraph(), cond, true_node, false_node, Control(),
+  return Branch(mcgraph(), cond, true_node, false_node, control(),
                 BranchHint::kFalse);
 }
 
@@ -1052,7 +1002,7 @@ Node* WasmGraphBuilder::TrapIfTrue(wasm::TrapReason reason, Node* cond,
                                    wasm::WasmCodePosition position) {
   TrapId trap_id = GetTrapIdForTrap(reason);
   Node* node = SetControl(graph()->NewNode(mcgraph()->common()->TrapIf(trap_id),
-                                           cond, Effect(), Control()));
+                                           cond, effect(), control()));
   SetSourcePosition(node, position);
   return node;
 }
@@ -1061,7 +1011,7 @@ Node* WasmGraphBuilder::TrapIfFalse(wasm::TrapReason reason, Node* cond,
                                     wasm::WasmCodePosition position) {
   TrapId trap_id = GetTrapIdForTrap(reason);
   Node* node = SetControl(graph()->NewNode(
-      mcgraph()->common()->TrapUnless(trap_id), cond, Effect(), Control()));
+      mcgraph()->common()->TrapUnless(trap_id), cond, effect(), control()));
   SetSourcePosition(node, position);
   return node;
 }
@@ -1111,7 +1061,7 @@ Node* WasmGraphBuilder::Switch(unsigned count, Node* key) {
   // which has limited input count, see {InstructionSelector::EmitTableSwitch}.
   DCHECK_LE(count, Instruction::kMaxInputCount - 2);          // value_range + 2
   DCHECK_LE(count, wasm::kV8MaxWasmFunctionBrTableSize + 1);  // plus IfDefault
-  return graph()->NewNode(mcgraph()->common()->Switch(count), key, Control());
+  return graph()->NewNode(mcgraph()->common()->Switch(count), key, control());
 }
 
 Node* WasmGraphBuilder::IfValue(int32_t value, Node* sw) {
@@ -1125,25 +1075,17 @@ Node* WasmGraphBuilder::IfDefault(Node* sw) {
 }
 
 Node* WasmGraphBuilder::Return(Vector<Node*> vals) {
-  static const int kStackAllocatedNodeBufferSize = 8;
-  Node* stack_buffer[kStackAllocatedNodeBufferSize];
-  std::vector<Node*> heap_buffer;
-
-  Node** buf = stack_buffer;
   unsigned count = static_cast<unsigned>(vals.size());
-  if (count + 3 > kStackAllocatedNodeBufferSize) {
-    heap_buffer.resize(count + 3);
-    buf = heap_buffer.data();
-  }
+  base::SmallVector<Node*, 8> buf(count + 3);
 
   buf[0] = mcgraph()->Int32Constant(0);
   if (count > 0) {
-    memcpy(buf + 1, vals.begin(), sizeof(void*) * count);
+    memcpy(buf.data() + 1, vals.begin(), sizeof(void*) * count);
   }
-  buf[count + 1] = Effect();
-  buf[count + 2] = Control();
-  Node* ret =
-      graph()->NewNode(mcgraph()->common()->Return(count), count + 3, buf);
+  buf[count + 1] = effect();
+  buf[count + 2] = control();
+  Node* ret = graph()->NewNode(mcgraph()->common()->Return(count), count + 3,
+                               buf.data());
 
   MergeControlToEnd(mcgraph(), ret);
   return ret;
@@ -1779,7 +1721,7 @@ Node* WasmGraphBuilder::BuildIntConvertFloat(Node* input,
   Node* test = ConvertSaturateTest(this, opcode, int_ty, float_ty, trunc,
                                    converted_value);
   Diamond tl_d(graph(), mcgraph()->common(), test, BranchHint::kFalse);
-  tl_d.Chain(Control());
+  tl_d.Chain(control());
   Node* nan_test = Binop(NeOp(float_ty), input, input);
   Diamond nan_d(graph(), mcgraph()->common(), nan_test, BranchHint::kFalse);
   nan_d.Nest(tl_d, true);
@@ -1827,8 +1769,8 @@ Node* WasmGraphBuilder::BuildBitCountingCall(Node* input, ExternalReference ref,
   const Operator* store_op = mcgraph()->machine()->Store(
       StoreRepresentation(input_type, kNoWriteBarrier));
   SetEffect(graph()->NewNode(store_op, stack_slot_param,
-                             mcgraph()->Int32Constant(0), input, Effect(),
-                             Control()));
+                             mcgraph()->Int32Constant(0), input, effect(),
+                             control()));
 
   MachineType sig_types[] = {MachineType::Int32(), MachineType::Pointer()};
   MachineSignature sig(1, 1, sig_types);
@@ -1952,14 +1894,14 @@ Node* WasmGraphBuilder::BuildCFuncInstruction(ExternalReference ref,
   const Operator* store_op = mcgraph()->machine()->Store(
       StoreRepresentation(type.representation(), kNoWriteBarrier));
   SetEffect(graph()->NewNode(store_op, stack_slot, mcgraph()->Int32Constant(0),
-                             input0, Effect(), Control()));
+                             input0, effect(), control()));
 
   Node* function = graph()->NewNode(mcgraph()->common()->ExternalConstant(ref));
 
   if (input1 != nullptr) {
     SetEffect(graph()->NewNode(store_op, stack_slot,
                                mcgraph()->Int32Constant(type_size), input1,
-                               Effect(), Control()));
+                               effect(), control()));
   }
 
   MachineType sig_types[] = {MachineType::Pointer()};
@@ -1968,7 +1910,7 @@ Node* WasmGraphBuilder::BuildCFuncInstruction(ExternalReference ref,
 
   return SetEffect(graph()->NewNode(mcgraph()->machine()->Load(type),
                                     stack_slot, mcgraph()->Int32Constant(0),
-                                    Effect(), Control()));
+                                    effect(), control()));
 }
 
 Node* WasmGraphBuilder::BuildF32SConvertI64(Node* input) {
@@ -2006,14 +1948,14 @@ Node* WasmGraphBuilder::BuildIntToFloatConversionInstruction(
   const Operator* store_op = mcgraph()->machine()->Store(
       StoreRepresentation(parameter_representation, kNoWriteBarrier));
   SetEffect(graph()->NewNode(store_op, stack_slot, mcgraph()->Int32Constant(0),
-                             input, Effect(), Control()));
+                             input, effect(), control()));
   MachineType sig_types[] = {MachineType::Pointer()};
   MachineSignature sig(0, 1, sig_types);
   Node* function = graph()->NewNode(mcgraph()->common()->ExternalConstant(ref));
   BuildCCall(&sig, function, stack_slot);
   return SetEffect(graph()->NewNode(mcgraph()->machine()->Load(result_type),
                                     stack_slot, mcgraph()->Int32Constant(0),
-                                    Effect(), Control()));
+                                    effect(), control()));
 }
 
 namespace {
@@ -2053,7 +1995,7 @@ Node* WasmGraphBuilder::BuildCcallConvertFloat(Node* input,
   const Operator* store_op = mcgraph()->machine()->Store(
       StoreRepresentation(float_ty.representation(), kNoWriteBarrier));
   SetEffect(graph()->NewNode(store_op, stack_slot, Int32Constant(0), input,
-                             Effect(), Control()));
+                             effect(), control()));
   MachineType sig_types[] = {MachineType::Int32(), MachineType::Pointer()};
   MachineSignature sig(1, 1, sig_types);
   Node* function =
@@ -2062,12 +2004,12 @@ Node* WasmGraphBuilder::BuildCcallConvertFloat(Node* input,
   if (IsTrappingConvertOp(opcode)) {
     ZeroCheck32(wasm::kTrapFloatUnrepresentable, overflow, position);
     return SetEffect(graph()->NewNode(mcgraph()->machine()->Load(int_ty),
-                                      stack_slot, Int32Constant(0), Effect(),
-                                      Control()));
+                                      stack_slot, Int32Constant(0), effect(),
+                                      control()));
   }
   Node* test = Binop(wasm::kExprI32Eq, overflow, Int32Constant(0), position);
   Diamond tl_d(graph(), mcgraph()->common(), test, BranchHint::kFalse);
-  tl_d.Chain(Control());
+  tl_d.Chain(control());
   Node* nan_test = Binop(NeOp(float_ty), input, input);
   Diamond nan_d(graph(), mcgraph()->common(), nan_test, BranchHint::kFalse);
   nan_d.Nest(tl_d, true);
@@ -2078,7 +2020,7 @@ Node* WasmGraphBuilder::BuildCcallConvertFloat(Node* input,
       sat_d.Phi(int_ty.representation(), Min(this, int_ty), Max(this, int_ty));
   Node* load =
       SetEffect(graph()->NewNode(mcgraph()->machine()->Load(int_ty), stack_slot,
-                                 Int32Constant(0), Effect(), Control()));
+                                 Int32Constant(0), effect(), control()));
   Node* nan_val =
       nan_d.Phi(int_ty.representation(), Zero(this, int_ty), sat_val);
   return tl_d.Phi(int_ty.representation(), nan_val, load);
@@ -2099,9 +2041,9 @@ Node* WasmGraphBuilder::MemoryGrow(Node* input) {
   // Just encode the stub index. This will be patched at relocation.
   Node* call_target = mcgraph()->RelocatableIntPtrConstant(
       wasm::WasmCode::kWasmMemoryGrow, RelocInfo::WASM_STUB_CALL);
-  return SetEffect(
-      SetControl(graph()->NewNode(mcgraph()->common()->Call(call_descriptor),
-                                  call_target, input, Effect(), Control())));
+  return SetEffectControl(
+      graph()->NewNode(mcgraph()->common()->Call(call_descriptor), call_target,
+                       input, effect(), control()));
 }
 
 Node* WasmGraphBuilder::Throw(uint32_t exception_index,
@@ -2159,6 +2101,7 @@ Node* WasmGraphBuilder::Throw(uint32_t exception_index,
         break;
       case wasm::kWasmAnyRef:
       case wasm::kWasmFuncRef:
+      case wasm::kWasmNullRef:
       case wasm::kWasmExnRef:
         STORE_FIXED_ARRAY_SLOT_ANY(values_array, index, value);
         ++index;
@@ -2175,9 +2118,9 @@ Node* WasmGraphBuilder::Throw(uint32_t exception_index,
       Operator::kNoProperties, StubCallMode::kCallWasmRuntimeStub);
   Node* call_target = mcgraph()->RelocatableIntPtrConstant(
       wasm::WasmCode::kWasmThrow, RelocInfo::WASM_STUB_CALL);
-  Node* call = SetEffect(SetControl(
+  Node* call = SetEffectControl(
       graph()->NewNode(mcgraph()->common()->Call(call_descriptor), call_target,
-                       except_obj, Effect(), Control())));
+                       except_obj, effect(), control()));
   SetSourcePosition(call, position);
   return call;
 }
@@ -2233,9 +2176,9 @@ Node* WasmGraphBuilder::Rethrow(Node* except_obj) {
       Operator::kNoProperties, StubCallMode::kCallWasmRuntimeStub);
   Node* call_target = mcgraph()->RelocatableIntPtrConstant(
       wasm::WasmCode::kWasmRethrow, RelocInfo::WASM_STUB_CALL);
-  return SetEffect(SetControl(
+  return SetEffectControl(
       graph()->NewNode(mcgraph()->common()->Call(call_descriptor), call_target,
-                       except_obj, Effect(), Control())));
+                       except_obj, effect(), control()));
 }
 
 Node* WasmGraphBuilder::ExceptionTagEqual(Node* caught_tag,
@@ -2245,8 +2188,8 @@ Node* WasmGraphBuilder::ExceptionTagEqual(Node* caught_tag,
 }
 
 Node* WasmGraphBuilder::LoadExceptionTagFromTable(uint32_t exception_index) {
-  Node* exceptions_table = LOAD_INSTANCE_FIELD(
-      ExceptionsTable, MachineType::TypeCompressedTaggedPointer());
+  Node* exceptions_table =
+      LOAD_INSTANCE_FIELD(ExceptionsTable, MachineType::TaggedPointer());
   Node* tag = LOAD_FIXED_ARRAY_SLOT_PTR(exceptions_table, exception_index);
   return tag;
 }
@@ -2299,6 +2242,7 @@ Node* WasmGraphBuilder::GetExceptionValues(Node* except_obj,
         break;
       case wasm::kWasmAnyRef:
       case wasm::kWasmFuncRef:
+      case wasm::kWasmNullRef:
       case wasm::kWasmExnRef:
         value = LOAD_FIXED_ARRAY_SLOT_ANY(values_array, index);
         ++index;
@@ -2316,7 +2260,7 @@ Node* WasmGraphBuilder::BuildI32DivS(Node* left, Node* right,
                                      wasm::WasmCodePosition position) {
   MachineOperatorBuilder* m = mcgraph()->machine();
   ZeroCheck32(wasm::kTrapDivByZero, right, position);
-  Node* before = Control();
+  Node* before = control();
   Node* denom_is_m1;
   Node* denom_is_not_m1;
   BranchExpectFalse(
@@ -2324,13 +2268,13 @@ Node* WasmGraphBuilder::BuildI32DivS(Node* left, Node* right,
       &denom_is_m1, &denom_is_not_m1);
   SetControl(denom_is_m1);
   TrapIfEq32(wasm::kTrapDivUnrepresentable, left, kMinInt, position);
-  if (Control() != denom_is_m1) {
+  if (control() != denom_is_m1) {
     SetControl(graph()->NewNode(mcgraph()->common()->Merge(2), denom_is_not_m1,
-                                Control()));
+                                control()));
   } else {
     SetControl(before);
   }
-  return graph()->NewNode(m->Int32Div(), left, right, Control());
+  return graph()->NewNode(m->Int32Div(), left, right, control());
 }
 
 Node* WasmGraphBuilder::BuildI32RemS(Node* left, Node* right,
@@ -2343,7 +2287,7 @@ Node* WasmGraphBuilder::BuildI32RemS(Node* left, Node* right,
       graph(), mcgraph()->common(),
       graph()->NewNode(m->Word32Equal(), right, mcgraph()->Int32Constant(-1)),
       BranchHint::kFalse);
-  d.Chain(Control());
+  d.Chain(control());
 
   return d.Phi(MachineRepresentation::kWord32, mcgraph()->Int32Constant(0),
                graph()->NewNode(m->Int32Mod(), left, right, d.if_false));
@@ -2374,7 +2318,7 @@ Node* WasmGraphBuilder::BuildI32AsmjsDivS(Node* left, Node* right) {
       // The result is the negation of the left input.
       return graph()->NewNode(m->Int32Sub(), mcgraph()->Int32Constant(0), left);
     }
-    return graph()->NewNode(m->Int32Div(), left, right, Control());
+    return graph()->NewNode(m->Int32Div(), left, right, control());
   }
 
   // asm.js semantics return 0 on divide or mod by zero.
@@ -2414,7 +2358,7 @@ Node* WasmGraphBuilder::BuildI32AsmjsRemS(Node* left, Node* right) {
     if (mr.Value() == 0 || mr.Value() == -1) {
       return zero;
     }
-    return graph()->NewNode(m->Int32Mod(), left, right, Control());
+    return graph()->NewNode(m->Int32Mod(), left, right, control());
   }
 
   // General case for signed integer modulus, with optimization for (unknown)
@@ -2543,7 +2487,7 @@ Node* WasmGraphBuilder::BuildI64DivS(Node* left, Node* right,
                           MachineType::Int64(), wasm::kTrapDivByZero, position);
   }
   ZeroCheck64(wasm::kTrapDivByZero, right, position);
-  Node* before = Control();
+  Node* before = control();
   Node* denom_is_m1;
   Node* denom_is_not_m1;
   BranchExpectFalse(graph()->NewNode(mcgraph()->machine()->Word64Equal(), right,
@@ -2552,14 +2496,14 @@ Node* WasmGraphBuilder::BuildI64DivS(Node* left, Node* right,
   SetControl(denom_is_m1);
   TrapIfEq64(wasm::kTrapDivUnrepresentable, left,
              std::numeric_limits<int64_t>::min(), position);
-  if (Control() != denom_is_m1) {
+  if (control() != denom_is_m1) {
     SetControl(graph()->NewNode(mcgraph()->common()->Merge(2), denom_is_not_m1,
-                                Control()));
+                                control()));
   } else {
     SetControl(before);
   }
   return graph()->NewNode(mcgraph()->machine()->Int64Div(), left, right,
-                          Control());
+                          control());
 }
 
 Node* WasmGraphBuilder::BuildI64RemS(Node* left, Node* right,
@@ -2573,7 +2517,7 @@ Node* WasmGraphBuilder::BuildI64RemS(Node* left, Node* right,
             graph()->NewNode(mcgraph()->machine()->Word64Equal(), right,
                              mcgraph()->Int64Constant(-1)));
 
-  d.Chain(Control());
+  d.Chain(control());
 
   Node* rem = graph()->NewNode(mcgraph()->machine()->Int64Mod(), left, right,
                                d.if_false);
@@ -2612,10 +2556,10 @@ Node* WasmGraphBuilder::BuildDiv64Call(Node* left, Node* right,
   const Operator* store_op = mcgraph()->machine()->Store(
       StoreRepresentation(MachineRepresentation::kWord64, kNoWriteBarrier));
   SetEffect(graph()->NewNode(store_op, stack_slot, mcgraph()->Int32Constant(0),
-                             left, Effect(), Control()));
+                             left, effect(), control()));
   SetEffect(graph()->NewNode(store_op, stack_slot,
                              mcgraph()->Int32Constant(sizeof(double)), right,
-                             Effect(), Control()));
+                             effect(), control()));
 
   MachineType sig_types[] = {MachineType::Int32(), MachineType::Pointer()};
   MachineSignature sig(1, 1, sig_types);
@@ -2627,7 +2571,7 @@ Node* WasmGraphBuilder::BuildDiv64Call(Node* left, Node* right,
   TrapIfEq32(wasm::kTrapDivUnrepresentable, call, -1, position);
   return SetEffect(graph()->NewNode(mcgraph()->machine()->Load(result_type),
                                     stack_slot, mcgraph()->Int32Constant(0),
-                                    Effect(), Control()));
+                                    effect(), control()));
 }
 
 template <typename... Args>
@@ -2635,7 +2579,7 @@ Node* WasmGraphBuilder::BuildCCall(MachineSignature* sig, Node* function,
                                    Args... args) {
   DCHECK_LE(sig->return_count(), 1);
   DCHECK_EQ(sizeof...(args), sig->parameter_count());
-  Node* const call_args[] = {function, args..., Effect(), Control()};
+  Node* const call_args[] = {function, args..., effect(), control()};
 
   auto call_descriptor =
       Linkage::GetSimplifiedCDescriptor(mcgraph()->zone(), sig);
@@ -2667,11 +2611,12 @@ Node* WasmGraphBuilder::BuildCallNode(wasm::FunctionSig* sig,
   if (params > 0) memcpy(&inputs[2], &args[1], params * sizeof(Node*));
 
   // Add effect and control inputs.
-  inputs[params + 2] = Effect();
-  inputs[params + 3] = Control();
+  inputs[params + 2] = effect();
+  inputs[params + 3] = control();
 
-  Node* call =
-      SetEffect(graph()->NewNode(op, static_cast<int>(count), inputs.begin()));
+  Node* call = graph()->NewNode(op, static_cast<int>(count), inputs.begin());
+  // Return calls have no effect output. Other calls are the new effect node.
+  if (op->EffectOutputCount() > 0) SetEffect(call);
   DCHECK(position == wasm::kNoCodePosition || position > 0);
   if (position > 0) SetSourcePosition(call, position);
 
@@ -2726,8 +2671,8 @@ Node* WasmGraphBuilder::BuildImportCall(wasm::FunctionSig* sig,
                                         int func_index,
                                         IsReturnCall continuation) {
   // Load the imported function refs array from the instance.
-  Node* imported_function_refs = LOAD_INSTANCE_FIELD(
-      ImportedFunctionRefs, MachineType::TypeCompressedTaggedPointer());
+  Node* imported_function_refs =
+      LOAD_INSTANCE_FIELD(ImportedFunctionRefs, MachineType::TaggedPointer());
   Node* ref_node =
       LOAD_FIXED_ARRAY_SLOT_PTR(imported_function_refs, func_index);
 
@@ -2736,8 +2681,8 @@ Node* WasmGraphBuilder::BuildImportCall(wasm::FunctionSig* sig,
       LOAD_INSTANCE_FIELD(ImportedFunctionTargets, MachineType::Pointer());
   Node* target_node = SetEffect(graph()->NewNode(
       mcgraph()->machine()->Load(MachineType::Pointer()), imported_targets,
-      mcgraph()->Int32Constant(func_index * kSystemPointerSize), Effect(),
-      Control()));
+      mcgraph()->Int32Constant(func_index * kSystemPointerSize), effect(),
+      control()));
   args[0] = target_node;
   const UseRetpoline use_retpoline =
       untrusted_code_mitigations_ ? kRetpoline : kNoRetpoline;
@@ -2757,8 +2702,8 @@ Node* WasmGraphBuilder::BuildImportCall(wasm::FunctionSig* sig,
                                         Node* func_index,
                                         IsReturnCall continuation) {
   // Load the imported function refs array from the instance.
-  Node* imported_function_refs = LOAD_INSTANCE_FIELD(
-      ImportedFunctionRefs, MachineType::TypeCompressedTaggedPointer());
+  Node* imported_function_refs =
+      LOAD_INSTANCE_FIELD(ImportedFunctionRefs, MachineType::TaggedPointer());
   // Access fixed array at {header_size - tag + func_index * kTaggedSize}.
   Node* imported_instances_data = graph()->NewNode(
       mcgraph()->machine()->IntAdd(), imported_function_refs,
@@ -2767,9 +2712,9 @@ Node* WasmGraphBuilder::BuildImportCall(wasm::FunctionSig* sig,
   Node* func_index_times_tagged_size = graph()->NewNode(
       mcgraph()->machine()->IntMul(), Uint32ToUintptr(func_index),
       mcgraph()->Int32Constant(kTaggedSize));
-  Node* ref_node = LOAD_RAW_NODE_OFFSET(
-      imported_instances_data, func_index_times_tagged_size,
-      MachineType::TypeCompressedTaggedPointer());
+  Node* ref_node = LOAD_RAW_NODE_OFFSET(imported_instances_data,
+                                        func_index_times_tagged_size,
+                                        MachineType::TaggedPointer());
 
   // Load the target from the imported_targets array at the offset of
   // {func_index}.
@@ -2787,7 +2732,7 @@ Node* WasmGraphBuilder::BuildImportCall(wasm::FunctionSig* sig,
       LOAD_INSTANCE_FIELD(ImportedFunctionTargets, MachineType::Pointer());
   Node* target_node = SetEffect(graph()->NewNode(
       mcgraph()->machine()->Load(MachineType::Pointer()), imported_targets,
-      func_index_times_pointersize, Effect(), Control()));
+      func_index_times_pointersize, effect(), control()));
   args[0] = target_node;
   const UseRetpoline use_retpoline =
       untrusted_code_mitigations_ ? kRetpoline : kNoRetpoline;
@@ -2839,13 +2784,13 @@ void WasmGraphBuilder::LoadIndirectFunctionTable(uint32_t table_index,
                                        MachineType::Pointer());
     *ift_targets = LOAD_INSTANCE_FIELD(IndirectFunctionTableTargets,
                                        MachineType::Pointer());
-    *ift_instances = LOAD_INSTANCE_FIELD(
-        IndirectFunctionTableRefs, MachineType::TypeCompressedTaggedPointer());
+    *ift_instances = LOAD_INSTANCE_FIELD(IndirectFunctionTableRefs,
+                                         MachineType::TaggedPointer());
     return;
   }
 
-  Node* ift_tables = LOAD_INSTANCE_FIELD(
-      IndirectFunctionTables, MachineType::TypeCompressedTaggedPointer());
+  Node* ift_tables =
+      LOAD_INSTANCE_FIELD(IndirectFunctionTables, MachineType::TaggedPointer());
   Node* ift_table = LOAD_FIXED_ARRAY_SLOT_ANY(ift_tables, table_index);
 
   *ift_size = LOAD_RAW(
@@ -2866,7 +2811,7 @@ void WasmGraphBuilder::LoadIndirectFunctionTable(uint32_t table_index,
   *ift_instances = LOAD_RAW(
       ift_table,
       wasm::ObjectAccess::ToTagged(WasmIndirectFunctionTable::kRefsOffset),
-      MachineType::TypeCompressedTaggedPointer());
+      MachineType::TaggedPointer());
 }
 
 Node* WasmGraphBuilder::BuildIndirectCall(uint32_t table_index,
@@ -2915,7 +2860,7 @@ Node* WasmGraphBuilder::BuildIndirectCall(uint32_t table_index,
 
   Node* loaded_sig = SetEffect(
       graph()->NewNode(machine->Load(MachineType::Int32()), ift_sig_ids,
-                       int32_scaled_key, Effect(), Control()));
+                       int32_scaled_key, effect(), control()));
   Node* sig_match = graph()->NewNode(machine->WordEqual(), loaded_sig,
                                      Int32Constant(expected_sig_id));
 
@@ -2933,7 +2878,7 @@ Node* WasmGraphBuilder::BuildIndirectCall(uint32_t table_index,
   Node* target_instance = LOAD_RAW(
       graph()->NewNode(machine->IntAdd(), ift_instances, tagged_scaled_key),
       wasm::ObjectAccess::ElementOffsetInTaggedFixedArray(0),
-      MachineType::TypeCompressedTaggedPointer());
+      MachineType::TaggedPointer());
 
   Node* intptr_scaled_key;
   if (kSystemPointerSize == kTaggedSize) {
@@ -2946,7 +2891,7 @@ Node* WasmGraphBuilder::BuildIndirectCall(uint32_t table_index,
 
   Node* target = SetEffect(
       graph()->NewNode(machine->Load(MachineType::Pointer()), ift_targets,
-                       intptr_scaled_key, Effect(), Control()));
+                       intptr_scaled_key, effect(), control()));
 
   args[0] = target;
   const UseRetpoline use_retpoline =
@@ -3006,13 +2951,11 @@ Node* WasmGraphBuilder::BuildI64Rol(Node* left, Node* right) {
   // Implement Rol by Ror since TurboFan does not have Rol opcode.
   // TODO(weiliang): support Word64Rol opcode in TurboFan.
   Int64Matcher m(right);
-  if (m.HasValue()) {
-    return Binop(wasm::kExprI64Ror, left,
-                 mcgraph()->Int64Constant(64 - (m.Value() & 0x3F)));
-  } else {
-    return Binop(wasm::kExprI64Ror, left,
-                 Binop(wasm::kExprI64Sub, mcgraph()->Int64Constant(64), right));
-  }
+  Node* inv_right =
+      m.HasValue()
+          ? mcgraph()->Int64Constant(64 - (m.Value() & 0x3F))
+          : Binop(wasm::kExprI64Sub, mcgraph()->Int64Constant(64), right);
+  return Binop(wasm::kExprI64Ror, left, inv_right);
 }
 
 Node* WasmGraphBuilder::Invert(Node* node) {
@@ -3105,7 +3048,7 @@ Node* WasmGraphBuilder::BuildConvertUint32ToSmiWithSaturation(Node* value,
   Node* valsmi = BuildChangeUint31ToSmi(value);
   Node* maxsmi = graph()->NewNode(mcgraph()->common()->NumberConstant(maxval));
   Diamond d(graph(), mcgraph()->common(), check, BranchHint::kTrue);
-  d.Chain(Control());
+  d.Chain(control());
   return d.Phi(MachineRepresentation::kTagged, valsmi, maxsmi);
 }
 
@@ -3218,6 +3161,24 @@ Node* WasmGraphBuilder::CreateOrMergeIntoEffectPhi(Node* merge, Node* tnode,
   return tnode;
 }
 
+Node* WasmGraphBuilder::effect() { return gasm_->effect(); }
+
+Node* WasmGraphBuilder::control() { return gasm_->control(); }
+
+Node* WasmGraphBuilder::SetEffect(Node* node) {
+  SetEffectControl(node, control());
+  return node;
+}
+
+Node* WasmGraphBuilder::SetControl(Node* node) {
+  SetEffectControl(effect(), node);
+  return node;
+}
+
+void WasmGraphBuilder::SetEffectControl(Node* effect, Node* control) {
+  gasm_->InitializeEffectControl(effect, control);
+}
+
 Node* WasmGraphBuilder::GetImportedMutableGlobals() {
   if (imported_mutable_globals_ == nullptr) {
     // Load imported_mutable_globals_ from the instance object at runtime.
@@ -3240,8 +3201,8 @@ void WasmGraphBuilder::GetGlobalBaseAndOffset(MachineType mem_type,
     *base_node = SetEffect(graph()->NewNode(
         mcgraph()->machine()->Load(MachineType::UintPtr()),
         GetImportedMutableGlobals(),
-        mcgraph()->Int32Constant(global.index * sizeof(Address)), Effect(),
-        Control()));
+        mcgraph()->Int32Constant(global.index * sizeof(Address)), effect(),
+        control()));
     *offset_node = mcgraph()->Int32Constant(0);
   } else {
     if (globals_start_ == nullptr) {
@@ -3275,9 +3236,8 @@ void WasmGraphBuilder::GetGlobalBaseAndOffset(MachineType mem_type,
 void WasmGraphBuilder::GetBaseAndOffsetForImportedMutableAnyRefGlobal(
     const wasm::WasmGlobal& global, Node** base, Node** offset) {
   // Load the base from the ImportedMutableGlobalsBuffer of the instance.
-  Node* buffers =
-      LOAD_INSTANCE_FIELD(ImportedMutableGlobalsBuffers,
-                          MachineType::TypeCompressedTaggedPointer());
+  Node* buffers = LOAD_INSTANCE_FIELD(ImportedMutableGlobalsBuffers,
+                                      MachineType::TaggedPointer());
   *base = LOAD_FIXED_ARRAY_SLOT_ANY(buffers, global.index);
 
   // For the offset we need the index of the global in the buffer, and then
@@ -3287,7 +3247,7 @@ void WasmGraphBuilder::GetBaseAndOffsetForImportedMutableAnyRefGlobal(
       graph()->NewNode(mcgraph()->machine()->Load(MachineType::UintPtr()),
                        GetImportedMutableGlobals(),
                        mcgraph()->Int32Constant(global.index * sizeof(Address)),
-                       Effect(), Control()));
+                       effect(), control()));
 
   // From the index, calculate the actual offset in the FixeArray. This
   // is kHeaderSize + (index * kTaggedSize). kHeaderSize can be acquired with
@@ -3325,9 +3285,10 @@ Node* WasmGraphBuilder::CurrentMemoryPages() {
 
 // Only call this function for code which is not reused across instantiations,
 // as we do not patch the embedded js_context.
-Node* WasmGraphBuilder::BuildCallToRuntimeWithContext(
-    Runtime::FunctionId f, Node* js_context, Node** parameters,
-    int parameter_count, Node** effect, Node* control) {
+Node* WasmGraphBuilder::BuildCallToRuntimeWithContext(Runtime::FunctionId f,
+                                                      Node* js_context,
+                                                      Node** parameters,
+                                                      int parameter_count) {
   const Runtime::Function* fun = Runtime::FunctionForId(f);
   auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
       mcgraph()->zone(), f, fun->nargs, Operator::kNoProperties,
@@ -3355,12 +3316,12 @@ Node* WasmGraphBuilder::BuildCallToRuntimeWithContext(
       mcgraph()->ExternalConstant(ExternalReference::Create(f));  // ref
   inputs[count++] = mcgraph()->Int32Constant(fun->nargs);         // arity
   inputs[count++] = js_context;                                   // js_context
-  inputs[count++] = *effect;
-  inputs[count++] = control;
+  inputs[count++] = effect();
+  inputs[count++] = control();
 
   Node* call = mcgraph()->graph()->NewNode(
       mcgraph()->common()->Call(call_descriptor), count, inputs);
-  *effect = call;
+  SetEffect(call);
   return call;
 }
 
@@ -3368,7 +3329,7 @@ Node* WasmGraphBuilder::BuildCallToRuntime(Runtime::FunctionId f,
                                            Node** parameters,
                                            int parameter_count) {
   return BuildCallToRuntimeWithContext(f, NoContextConstant(), parameters,
-                                       parameter_count, effect_, Control());
+                                       parameter_count);
 }
 
 Node* WasmGraphBuilder::GlobalGet(uint32_t index) {
@@ -3378,22 +3339,24 @@ Node* WasmGraphBuilder::GlobalGet(uint32_t index) {
       Node* base = nullptr;
       Node* offset = nullptr;
       GetBaseAndOffsetForImportedMutableAnyRefGlobal(global, &base, &offset);
-      return LOAD_RAW_NODE_OFFSET(base, offset,
-                                  MachineType::TypeCompressedTagged());
+      return LOAD_RAW_NODE_OFFSET(base, offset, MachineType::AnyTagged());
     }
-    Node* globals_buffer = LOAD_INSTANCE_FIELD(
-        TaggedGlobalsBuffer, MachineType::TypeCompressedTaggedPointer());
+    Node* globals_buffer =
+        LOAD_INSTANCE_FIELD(TaggedGlobalsBuffer, MachineType::TaggedPointer());
     return LOAD_FIXED_ARRAY_SLOT_ANY(globals_buffer, global.offset);
   }
 
   MachineType mem_type =
       wasm::ValueTypes::MachineTypeFor(env_->module->globals[index].type);
+  if (mem_type.representation() == MachineRepresentation::kSimd128) {
+    has_simd_ = true;
+  }
   Node* base = nullptr;
   Node* offset = nullptr;
   GetGlobalBaseAndOffset(mem_type, env_->module->globals[index], &base,
                          &offset);
   Node* result = SetEffect(graph()->NewNode(
-      mcgraph()->machine()->Load(mem_type), base, offset, Effect(), Control()));
+      mcgraph()->machine()->Load(mem_type), base, offset, effect(), control()));
 #if defined(V8_TARGET_BIG_ENDIAN)
   result = BuildChangeEndiannessLoad(result, mem_type,
                                      env_->module->globals[index].type);
@@ -3412,14 +3375,17 @@ Node* WasmGraphBuilder::GlobalSet(uint32_t index, Node* val) {
       return STORE_RAW_NODE_OFFSET(
           base, offset, val, MachineRepresentation::kTagged, kFullWriteBarrier);
     }
-    Node* globals_buffer = LOAD_INSTANCE_FIELD(
-        TaggedGlobalsBuffer, MachineType::TypeCompressedTaggedPointer());
+    Node* globals_buffer =
+        LOAD_INSTANCE_FIELD(TaggedGlobalsBuffer, MachineType::TaggedPointer());
     return STORE_FIXED_ARRAY_SLOT_ANY(globals_buffer,
                                       env_->module->globals[index].offset, val);
   }
 
   MachineType mem_type =
       wasm::ValueTypes::MachineTypeFor(env_->module->globals[index].type);
+  if (mem_type.representation() == MachineRepresentation::kSimd128) {
+    has_simd_ = true;
+  }
   Node* base = nullptr;
   Node* offset = nullptr;
   GetGlobalBaseAndOffset(mem_type, env_->module->globals[index], &base,
@@ -3431,39 +3397,35 @@ Node* WasmGraphBuilder::GlobalSet(uint32_t index, Node* val) {
                                    env_->module->globals[index].type);
 #endif
   return SetEffect(
-      graph()->NewNode(op, base, offset, val, Effect(), Control()));
+      graph()->NewNode(op, base, offset, val, effect(), control()));
 }
 
 void WasmGraphBuilder::BoundsCheckTable(uint32_t table_index, Node* entry_index,
                                         wasm::WasmCodePosition position,
                                         wasm::TrapReason trap_reason,
                                         Node** base_node) {
-  Node* tables =
-      LOAD_INSTANCE_FIELD(Tables, MachineType::TypeCompressedTaggedPointer());
+  Node* tables = LOAD_INSTANCE_FIELD(Tables, MachineType::TaggedPointer());
   Node* table = LOAD_FIXED_ARRAY_SLOT_ANY(tables, table_index);
 
-  int storage_field_size =
-      WasmTableObject::kEntriesOffsetEnd - WasmTableObject::kEntriesOffset + 1;
-  Node* storage = LOAD_RAW(
-      table, wasm::ObjectAccess::ToTagged(WasmTableObject::kEntriesOffset),
-      assert_size(storage_field_size,
-                  MachineType::TypeCompressedTaggedPointer()));
-
-  int length_field_size =
-      FixedArray::kLengthOffsetEnd - FixedArray::kLengthOffset + 1;
-  Node* storage_size =
-      LOAD_RAW(storage, wasm::ObjectAccess::ToTagged(FixedArray::kLengthOffset),
-               assert_size(length_field_size,
-                           MachineType::TypeCompressedTaggedSigned()));
-
-  storage_size = BuildChangeSmiToInt32(storage_size);
+  int length_field_size = WasmTableObject::kCurrentLengthOffsetEnd -
+                          WasmTableObject::kCurrentLengthOffset + 1;
+  Node* length_smi = LOAD_RAW(
+      table,
+      wasm::ObjectAccess::ToTagged(WasmTableObject::kCurrentLengthOffset),
+      assert_size(length_field_size, MachineType::TaggedSigned()));
+  Node* length = BuildChangeSmiToInt32(length_smi);
+
   // Bounds check against the table size.
   Node* in_bounds = graph()->NewNode(mcgraph()->machine()->Uint32LessThan(),
-                                     entry_index, storage_size);
+                                     entry_index, length);
   TrapIfFalse(trap_reason, in_bounds, position);
 
   if (base_node) {
-    *base_node = storage;
+    int storage_field_size = WasmTableObject::kEntriesOffsetEnd -
+                             WasmTableObject::kEntriesOffset + 1;
+    *base_node = LOAD_RAW(
+        table, wasm::ObjectAccess::ToTagged(WasmTableObject::kEntriesOffset),
+        assert_size(storage_field_size, MachineType::TaggedPointer()));
   }
 }
 
@@ -3489,12 +3451,13 @@ void WasmGraphBuilder::GetTableBaseAndOffset(uint32_t table_index,
 
 Node* WasmGraphBuilder::TableGet(uint32_t table_index, Node* index,
                                  wasm::WasmCodePosition position) {
-  if (env_->module->tables[table_index].type == wasm::kWasmAnyRef) {
+  if (env_->module->tables[table_index].type == wasm::kWasmAnyRef ||
+      env_->module->tables[table_index].type == wasm::kWasmNullRef ||
+      env_->module->tables[table_index].type == wasm::kWasmExnRef) {
     Node* base = nullptr;
     Node* offset = nullptr;
     GetTableBaseAndOffset(table_index, index, position, &base, &offset);
-    return LOAD_RAW_NODE_OFFSET(base, offset,
-                                MachineType::TypeCompressedTagged());
+    return LOAD_RAW_NODE_OFFSET(base, offset, MachineType::AnyTagged());
   }
   // We access funcref tables through runtime calls.
   WasmTableGetDescriptor interface_descriptor;
@@ -3510,15 +3473,17 @@ Node* WasmGraphBuilder::TableGet(uint32_t table_index, Node* index,
   Node* call_target = mcgraph()->RelocatableIntPtrConstant(
       wasm::WasmCode::kWasmTableGet, RelocInfo::WASM_STUB_CALL);
 
-  return SetEffect(SetControl(graph()->NewNode(
+  return SetEffectControl(graph()->NewNode(
       mcgraph()->common()->Call(call_descriptor), call_target,
       graph()->NewNode(mcgraph()->common()->NumberConstant(table_index)), index,
-      Effect(), Control())));
+      effect(), control()));
 }
 
 Node* WasmGraphBuilder::TableSet(uint32_t table_index, Node* index, Node* val,
                                  wasm::WasmCodePosition position) {
-  if (env_->module->tables[table_index].type == wasm::kWasmAnyRef) {
+  if (env_->module->tables[table_index].type == wasm::kWasmAnyRef ||
+      env_->module->tables[table_index].type == wasm::kWasmNullRef ||
+      env_->module->tables[table_index].type == wasm::kWasmExnRef) {
     Node* base = nullptr;
     Node* offset = nullptr;
     GetTableBaseAndOffset(table_index, index, position, &base, &offset);
@@ -3539,10 +3504,10 @@ Node* WasmGraphBuilder::TableSet(uint32_t table_index, Node* index, Node* val,
     Node* call_target = mcgraph()->RelocatableIntPtrConstant(
         wasm::WasmCode::kWasmTableSet, RelocInfo::WASM_STUB_CALL);
 
-    return SetEffect(SetControl(graph()->NewNode(
+    return SetEffectControl(graph()->NewNode(
         mcgraph()->common()->Call(call_descriptor), call_target,
         graph()->NewNode(mcgraph()->common()->NumberConstant(table_index)),
-        index, val, Effect(), Control())));
+        index, val, effect(), control()));
   }
 }
 
@@ -3592,13 +3557,13 @@ Node* WasmGraphBuilder::BoundsCheckMem(uint8_t access_size, Node* index,
                                        EnforceBoundsCheck enforce_check) {
   DCHECK_LE(1, access_size);
   index = Uint32ToUintptr(index);
-  if (FLAG_wasm_no_bounds_checks) return index;
+  if (!FLAG_wasm_bounds_checks) return index;
 
   if (use_trap_handler() && enforce_check == kCanOmitBoundsCheck) {
     return index;
   }
 
-  if (!IsInBounds(offset, access_size, env_->max_memory_size)) {
+  if (!base::IsInBounds(offset, access_size, env_->max_memory_size)) {
     // The access will be out of bounds, even for the largest memory.
     TrapIfEq32(wasm::kTrapMemOutOfBounds, Int32Constant(0), 0, position);
     return mcgraph()->IntPtrConstant(0);
@@ -3666,7 +3631,7 @@ Node* WasmGraphBuilder::BoundsCheckRange(Node* start, Node** size, Node* max,
   Node* sub = graph()->NewNode(m->Int32Sub(), max, start);
   Node* fail = graph()->NewNode(m->Uint32LessThan(), sub, *size);
   Diamond d(graph(), mcgraph()->common(), fail, BranchHint::kFalse);
-  d.Chain(Control());
+  d.Chain(control());
   *size = d.Phi(MachineRepresentation::kWord32, sub, *size);
   return fail;
 }
@@ -3727,7 +3692,7 @@ Node* WasmGraphBuilder::TraceMemoryOperation(bool is_store,
   auto store = [&](int offset, MachineRepresentation rep, Node* data) {
     SetEffect(graph()->NewNode(
         mcgraph()->machine()->Store(StoreRepresentation(rep, kNoWriteBarrier)),
-        info, mcgraph()->Int32Constant(offset), data, Effect(), Control()));
+        info, mcgraph()->Int32Constant(offset), data, effect(), control()));
   };
   // Store address, is_store, and mem_rep.
   store(offsetof(wasm::MemoryTracingInfo, address),
@@ -3744,12 +3709,103 @@ Node* WasmGraphBuilder::TraceMemoryOperation(bool is_store,
   return call;
 }
 
+namespace {
+LoadTransformation GetLoadTransformation(
+    MachineType memtype, wasm::LoadTransformationKind transform) {
+  switch (transform) {
+    case wasm::LoadTransformationKind::kSplat: {
+      if (memtype == MachineType::Int8()) {
+        return LoadTransformation::kS8x16LoadSplat;
+      } else if (memtype == MachineType::Int16()) {
+        return LoadTransformation::kS16x8LoadSplat;
+      } else if (memtype == MachineType::Int32()) {
+        return LoadTransformation::kS32x4LoadSplat;
+      } else if (memtype == MachineType::Int64()) {
+        return LoadTransformation::kS64x2LoadSplat;
+      }
+      break;
+    }
+    case wasm::LoadTransformationKind::kExtend: {
+      if (memtype == MachineType::Int8()) {
+        return LoadTransformation::kI16x8Load8x8S;
+      } else if (memtype == MachineType::Uint8()) {
+        return LoadTransformation::kI16x8Load8x8U;
+      } else if (memtype == MachineType::Int16()) {
+        return LoadTransformation::kI32x4Load16x4S;
+      } else if (memtype == MachineType::Uint16()) {
+        return LoadTransformation::kI32x4Load16x4U;
+      } else if (memtype == MachineType::Int32()) {
+        return LoadTransformation::kI64x2Load32x2S;
+      } else if (memtype == MachineType::Uint32()) {
+        return LoadTransformation::kI64x2Load32x2U;
+      }
+      break;
+    }
+  }
+  UNREACHABLE();
+}
+
+LoadKind GetLoadKind(MachineGraph* mcgraph, MachineType memtype,
+                     bool use_trap_handler) {
+  if (memtype.representation() == MachineRepresentation::kWord8 ||
+      mcgraph->machine()->UnalignedLoadSupported(memtype.representation())) {
+    if (use_trap_handler) {
+      return LoadKind::kProtected;
+    }
+    return LoadKind::kNormal;
+  }
+  // TODO(eholk): Support unaligned loads with trap handlers.
+  DCHECK(!use_trap_handler);
+  return LoadKind::kUnaligned;
+}
+}  // namespace
+
+Node* WasmGraphBuilder::LoadTransform(MachineType memtype,
+                                      wasm::LoadTransformationKind transform,
+                                      Node* index, uint32_t offset,
+                                      uint32_t alignment,
+                                      wasm::WasmCodePosition position) {
+  if (memtype.representation() == MachineRepresentation::kSimd128) {
+    has_simd_ = true;
+  }
+
+  // Wasm semantics throw on OOB. Introduce explicit bounds check and
+  // conditioning when not using the trap handler.
+  index = BoundsCheckMem(wasm::ValueTypes::MemSize(memtype), index, offset,
+                         position, kCanOmitBoundsCheck);
+
+  LoadTransformation transformation = GetLoadTransformation(memtype, transform);
+  LoadKind load_kind = GetLoadKind(mcgraph(), memtype, use_trap_handler());
+
+  Node* load = SetEffect(graph()->NewNode(
+      mcgraph()->machine()->LoadTransform(load_kind, transformation),
+      MemBuffer(offset), index, effect(), control()));
+
+  if (load_kind == LoadKind::kProtected) {
+    SetSourcePosition(load, position);
+  }
+
+#if defined(V8_TARGET_BIG_ENDIAN)
+  load = BuildChangeEndiannessLoad(load, memtype, wasm::ValueType::kWasmS128);
+#endif
+
+  if (FLAG_trace_wasm_memory) {
+    TraceMemoryOperation(false, memtype.representation(), index, offset,
+                         position);
+  }
+  return load;
+}
+
 Node* WasmGraphBuilder::LoadMem(wasm::ValueType type, MachineType memtype,
                                 Node* index, uint32_t offset,
                                 uint32_t alignment,
                                 wasm::WasmCodePosition position) {
   Node* load;
 
+  if (memtype.representation() == MachineRepresentation::kSimd128) {
+    has_simd_ = true;
+  }
+
   // Wasm semantics throw on OOB. Introduce explicit bounds check and
   // conditioning when not using the trap handler.
   index = BoundsCheckMem(wasm::ValueTypes::MemSize(memtype), index, offset,
@@ -3759,17 +3815,17 @@ Node* WasmGraphBuilder::LoadMem(wasm::ValueType type, MachineType memtype,
       mcgraph()->machine()->UnalignedLoadSupported(memtype.representation())) {
     if (use_trap_handler()) {
       load = graph()->NewNode(mcgraph()->machine()->ProtectedLoad(memtype),
-                              MemBuffer(offset), index, Effect(), Control());
+                              MemBuffer(offset), index, effect(), control());
       SetSourcePosition(load, position);
     } else {
       load = graph()->NewNode(mcgraph()->machine()->Load(memtype),
-                              MemBuffer(offset), index, Effect(), Control());
+                              MemBuffer(offset), index, effect(), control());
     }
   } else {
     // TODO(eholk): Support unaligned loads with trap handlers.
     DCHECK(!use_trap_handler());
     load = graph()->NewNode(mcgraph()->machine()->UnalignedLoad(memtype),
-                            MemBuffer(offset), index, Effect(), Control());
+                            MemBuffer(offset), index, effect(), control());
   }
 
   SetEffect(load);
@@ -3805,6 +3861,10 @@ Node* WasmGraphBuilder::StoreMem(MachineRepresentation mem_rep, Node* index,
                                  wasm::ValueType type) {
   Node* store;
 
+  if (mem_rep == MachineRepresentation::kSimd128) {
+    has_simd_ = true;
+  }
+
   index = BoundsCheckMem(i::ElementSizeInBytes(mem_rep), index, offset,
                          position, kCanOmitBoundsCheck);
 
@@ -3817,13 +3877,13 @@ Node* WasmGraphBuilder::StoreMem(MachineRepresentation mem_rep, Node* index,
     if (use_trap_handler()) {
       store =
           graph()->NewNode(mcgraph()->machine()->ProtectedStore(mem_rep),
-                           MemBuffer(offset), index, val, Effect(), Control());
+                           MemBuffer(offset), index, val, effect(), control());
       SetSourcePosition(store, position);
     } else {
       StoreRepresentation rep(mem_rep, kNoWriteBarrier);
       store =
           graph()->NewNode(mcgraph()->machine()->Store(rep), MemBuffer(offset),
-                           index, val, Effect(), Control());
+                           index, val, effect(), control());
     }
   } else {
     // TODO(eholk): Support unaligned stores with trap handlers.
@@ -3831,7 +3891,7 @@ Node* WasmGraphBuilder::StoreMem(MachineRepresentation mem_rep, Node* index,
     UnalignedStoreRepresentation rep(mem_rep);
     store =
         graph()->NewNode(mcgraph()->machine()->UnalignedStore(rep),
-                         MemBuffer(offset), index, val, Effect(), Control());
+                         MemBuffer(offset), index, val, effect(), control());
   }
 
   SetEffect(store);
@@ -3880,7 +3940,7 @@ Node* WasmGraphBuilder::BuildAsmjsLoadMem(MachineType type, Node* index) {
       graph(), mcgraph()->common(),
       graph()->NewNode(mcgraph()->machine()->UintLessThan(), index, mem_size),
       BranchHint::kTrue);
-  bounds_check.Chain(Control());
+  bounds_check.Chain(control());
 
   if (untrusted_code_mitigations_) {
     // Condition the index with the memory mask.
@@ -3890,9 +3950,8 @@ Node* WasmGraphBuilder::BuildAsmjsLoadMem(MachineType type, Node* index) {
   }
 
   Node* load = graph()->NewNode(mcgraph()->machine()->Load(type), mem_start,
-                                index, Effect(), bounds_check.if_true);
-  SetEffect(bounds_check.EffectPhi(load, Effect()));
-  SetControl(bounds_check.merge);
+                                index, effect(), bounds_check.if_true);
+  SetEffectControl(bounds_check.EffectPhi(load, effect()), bounds_check.merge);
   return bounds_check.Phi(type.representation(), load,
                           GetAsmJsOOBValue(type.representation(), mcgraph()));
 }
@@ -3924,7 +3983,7 @@ Node* WasmGraphBuilder::BuildAsmjsStoreMem(MachineType type, Node* index,
       graph(), mcgraph()->common(),
       graph()->NewNode(mcgraph()->machine()->Uint32LessThan(), index, mem_size),
       BranchHint::kTrue);
-  bounds_check.Chain(Control());
+  bounds_check.Chain(control());
 
   if (untrusted_code_mitigations_) {
     // Condition the index with the memory mask.
@@ -3937,10 +3996,9 @@ Node* WasmGraphBuilder::BuildAsmjsStoreMem(MachineType type, Node* index,
   index = Uint32ToUintptr(index);
   const Operator* store_op = mcgraph()->machine()->Store(StoreRepresentation(
       type.representation(), WriteBarrierKind::kNoWriteBarrier));
-  Node* store = graph()->NewNode(store_op, mem_start, index, val, Effect(),
+  Node* store = graph()->NewNode(store_op, mem_start, index, val, effect(),
                                  bounds_check.if_true);
-  SetEffect(bounds_check.EffectPhi(store, Effect()));
-  SetControl(bounds_check.merge);
+  SetEffectControl(bounds_check.EffectPhi(store, effect()), bounds_check.merge);
   return val;
 }
 
@@ -4369,6 +4427,9 @@ Node* WasmGraphBuilder::SimdOp(wasm::WasmOpcode opcode, Node* const* inputs) {
     case wasm::kExprI16x8GeU:
       return graph()->NewNode(mcgraph()->machine()->I16x8GeU(), inputs[0],
                               inputs[1]);
+    case wasm::kExprI16x8RoundingAverageU:
+      return graph()->NewNode(mcgraph()->machine()->I16x8RoundingAverageU(),
+                              inputs[0], inputs[1]);
     case wasm::kExprI8x16Splat:
       return graph()->NewNode(mcgraph()->machine()->I8x16Splat(), inputs[0]);
     case wasm::kExprI8x16Neg:
@@ -4451,6 +4512,9 @@ Node* WasmGraphBuilder::SimdOp(wasm::WasmOpcode opcode, Node* const* inputs) {
     case wasm::kExprI8x16GeU:
       return graph()->NewNode(mcgraph()->machine()->I8x16GeU(), inputs[0],
                               inputs[1]);
+    case wasm::kExprI8x16RoundingAverageU:
+      return graph()->NewNode(mcgraph()->machine()->I8x16RoundingAverageU(),
+                              inputs[0], inputs[1]);
     case wasm::kExprS128And:
       return graph()->NewNode(mcgraph()->machine()->S128And(), inputs[0],
                               inputs[1]);
@@ -4465,6 +4529,9 @@ Node* WasmGraphBuilder::SimdOp(wasm::WasmOpcode opcode, Node* const* inputs) {
     case wasm::kExprS128Select:
       return graph()->NewNode(mcgraph()->machine()->S128Select(), inputs[2],
                               inputs[0], inputs[1]);
+    case wasm::kExprS128AndNot:
+      return graph()->NewNode(mcgraph()->machine()->S128AndNot(), inputs[0],
+                              inputs[1]);
     case wasm::kExprS1x2AnyTrue:
       return graph()->NewNode(mcgraph()->machine()->S1x2AnyTrue(), inputs[0]);
     case wasm::kExprS1x2AllTrue:
@@ -4518,23 +4585,19 @@ Node* WasmGraphBuilder::SimdLaneOp(wasm::WasmOpcode opcode, uint8_t lane,
       return graph()->NewNode(mcgraph()->machine()->I32x4ReplaceLane(lane),
                               inputs[0], inputs[1]);
     case wasm::kExprI16x8ExtractLaneS:
-      return graph()->NewNode(
-          mcgraph()->machine()->SignExtendWord16ToInt32(),
-          graph()->NewNode(mcgraph()->machine()->I16x8ExtractLane(lane),
-                           inputs[0]));
+      return graph()->NewNode(mcgraph()->machine()->I16x8ExtractLaneS(lane),
+                              inputs[0]);
     case wasm::kExprI16x8ExtractLaneU:
-      return graph()->NewNode(mcgraph()->machine()->I16x8ExtractLane(lane),
+      return graph()->NewNode(mcgraph()->machine()->I16x8ExtractLaneU(lane),
                               inputs[0]);
     case wasm::kExprI16x8ReplaceLane:
       return graph()->NewNode(mcgraph()->machine()->I16x8ReplaceLane(lane),
                               inputs[0], inputs[1]);
     case wasm::kExprI8x16ExtractLaneS:
-      return graph()->NewNode(
-          mcgraph()->machine()->SignExtendWord8ToInt32(),
-          graph()->NewNode(mcgraph()->machine()->I8x16ExtractLane(lane),
-                           inputs[0]));
+      return graph()->NewNode(mcgraph()->machine()->I8x16ExtractLaneS(lane),
+                              inputs[0]);
     case wasm::kExprI8x16ExtractLaneU:
-      return graph()->NewNode(mcgraph()->machine()->I8x16ExtractLane(lane),
+      return graph()->NewNode(mcgraph()->machine()->I8x16ExtractLaneU(lane),
                               inputs[0]);
     case wasm::kExprI8x16ReplaceLane:
       return graph()->NewNode(mcgraph()->machine()->I8x16ReplaceLane(lane),
@@ -4634,7 +4697,7 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
         position);                                                            \
     node = graph()->NewNode(                                                  \
         mcgraph()->machine()->Prefix##Atomic##Operation(MachineType::Type()), \
-        MemBuffer(offset), index, inputs[1], Effect(), Control());            \
+        MemBuffer(offset), index, inputs[1], effect(), control());            \
     break;                                                                    \
   }
     ATOMIC_BINOP_LIST(BUILD_ATOMIC_BINOP)
@@ -4648,7 +4711,7 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
     node = graph()->NewNode(                                                  \
         mcgraph()->machine()->Prefix##AtomicCompareExchange(                  \
             MachineType::Type()),                                             \
-        MemBuffer(offset), index, inputs[1], inputs[2], Effect(), Control()); \
+        MemBuffer(offset), index, inputs[1], inputs[2], effect(), control()); \
     break;                                                                    \
   }
     ATOMIC_CMP_EXCHG_LIST(BUILD_ATOMIC_CMP_EXCHG)
@@ -4661,7 +4724,7 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
         position);                                                         \
     node = graph()->NewNode(                                               \
         mcgraph()->machine()->Prefix##AtomicLoad(MachineType::Type()),     \
-        MemBuffer(offset), index, Effect(), Control());                    \
+        MemBuffer(offset), index, effect(), control());                    \
     break;                                                                 \
   }
     ATOMIC_LOAD_LIST(BUILD_ATOMIC_LOAD_OP)
@@ -4674,7 +4737,7 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
         position);                                                             \
     node = graph()->NewNode(                                                   \
         mcgraph()->machine()->Prefix##AtomicStore(MachineRepresentation::Rep), \
-        MemBuffer(offset), index, inputs[1], Effect(), Control());             \
+        MemBuffer(offset), index, inputs[1], effect(), control());             \
     break;                                                                     \
   }
     ATOMIC_STORE_LIST(BUILD_ATOMIC_STORE_OP)
@@ -4695,8 +4758,8 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
       Node* call_target = mcgraph()->RelocatableIntPtrConstant(
           wasm::WasmCode::kWasmAtomicNotify, RelocInfo::WASM_STUB_CALL);
       node = graph()->NewNode(mcgraph()->common()->Call(call_descriptor),
-                              call_target, address, inputs[1], Effect(),
-                              Control());
+                              call_target, address, inputs[1], effect(),
+                              control());
       break;
     }
 
@@ -4724,7 +4787,7 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
           wasm::WasmCode::kWasmI32AtomicWait, RelocInfo::WASM_STUB_CALL);
       node = graph()->NewNode(mcgraph()->common()->Call(call_descriptor),
                               call_target, address, inputs[1], timeout,
-                              Effect(), Control());
+                              effect(), control());
       break;
     }
 
@@ -4758,7 +4821,7 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
           wasm::WasmCode::kWasmI64AtomicWait, RelocInfo::WASM_STUB_CALL);
       node = graph()->NewNode(mcgraph()->common()->Call(call_descriptor),
                               call_target, address, expected_value_high,
-                              expected_value_low, timeout, Effect(), Control());
+                              expected_value_low, timeout, effect(), control());
       break;
     }
 
@@ -4770,7 +4833,7 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
 
 Node* WasmGraphBuilder::AtomicFence() {
   return SetEffect(graph()->NewNode(mcgraph()->machine()->MemBarrier(),
-                                    Effect(), Control()));
+                                    effect(), control()));
 }
 
 #undef ATOMIC_BINOP_LIST
@@ -4778,41 +4841,18 @@ Node* WasmGraphBuilder::AtomicFence() {
 #undef ATOMIC_LOAD_LIST
 #undef ATOMIC_STORE_LIST
 
-Node* WasmGraphBuilder::CheckDataSegmentIsPassiveAndNotDropped(
-    uint32_t data_segment_index, wasm::WasmCodePosition position) {
-  // The data segment index must be in bounds since it is required by
-  // validation.
-  DCHECK_LT(data_segment_index, env_->module->num_declared_data_segments);
-
-  Node* dropped_data_segments =
-      LOAD_INSTANCE_FIELD(DroppedDataSegments, MachineType::Pointer());
-  Node* is_segment_dropped = SetEffect(graph()->NewNode(
-      mcgraph()->machine()->Load(MachineType::Uint8()), dropped_data_segments,
-      mcgraph()->IntPtrConstant(data_segment_index), Effect(), Control()));
-  TrapIfTrue(wasm::kTrapDataSegmentDropped, is_segment_dropped, position);
-  return dropped_data_segments;
-}
-
 Node* WasmGraphBuilder::MemoryInit(uint32_t data_segment_index, Node* dst,
                                    Node* src, Node* size,
                                    wasm::WasmCodePosition position) {
-  CheckDataSegmentIsPassiveAndNotDropped(data_segment_index, position);
-  auto m = mcgraph()->machine();
-  auto common = mcgraph()->common();
-  Node* size_null_check =
-      graph()->NewNode(m->Word32Equal(), size, mcgraph()->Int32Constant(0));
-  Node* size_null_branch = graph()->NewNode(common->Branch(BranchHint::kFalse),
-                                            size_null_check, Control());
-
-  Node* size_null_etrue = Effect();
-  Node* size_null_if_false =
-      graph()->NewNode(common->IfFalse(), size_null_branch);
-  SetControl(size_null_if_false);
+  // The data segment index must be in bounds since it is required by
+  // validation.
+  DCHECK_LT(data_segment_index, env_->module->num_declared_data_segments);
 
   Node* dst_fail = BoundsCheckMemRange(&dst, &size, position);
+  TrapIfTrue(wasm::kTrapMemOutOfBounds, dst_fail, position);
 
   Node* seg_index = Uint32Constant(data_segment_index);
-  Node* src_fail;
+  auto m = mcgraph()->machine();
 
   {
     // Load segment size from WasmInstanceObject::data_segment_sizes.
@@ -4823,10 +4863,11 @@ Node* WasmGraphBuilder::MemoryInit(uint32_t data_segment_index, Node* dst,
         graph()->NewNode(m->Word32Shl(), seg_index, Int32Constant(2)));
     Node* seg_size = SetEffect(graph()->NewNode(m->Load(MachineType::Uint32()),
                                                 seg_size_array, scaled_index,
-                                                Effect(), Control()));
+                                                effect(), control()));
 
     // Bounds check the src index against the segment size.
-    src_fail = BoundsCheckRange(src, &size, seg_size, position);
+    Node* src_fail = BoundsCheckRange(src, &size, seg_size, position);
+    TrapIfTrue(wasm::kTrapMemOutOfBounds, src_fail, position);
   }
 
   {
@@ -4839,7 +4880,7 @@ Node* WasmGraphBuilder::MemoryInit(uint32_t data_segment_index, Node* dst,
         m->Word32Shl(), seg_index, Int32Constant(kSystemPointerSizeLog2)));
     Node* seg_start = SetEffect(
         graph()->NewNode(m->Load(MachineType::Pointer()), seg_start_array,
-                         scaled_index, Effect(), Control()));
+                         scaled_index, effect(), control()));
 
     // Convert src index to pointer.
     src = graph()->NewNode(m->IntAdd(), seg_start, Uint32ToUintptr(src));
@@ -4850,152 +4891,85 @@ Node* WasmGraphBuilder::MemoryInit(uint32_t data_segment_index, Node* dst,
   MachineType sig_types[] = {MachineType::Pointer(), MachineType::Pointer(),
                              MachineType::Uint32()};
   MachineSignature sig(0, 3, sig_types);
-  BuildCCall(&sig, function, dst, src, size);
-  TrapIfTrue(wasm::kTrapMemOutOfBounds,
-             graph()->NewNode(m->Word32Or(), dst_fail, src_fail), position);
-  Node* size_null_if_true =
-      graph()->NewNode(common->IfTrue(), size_null_branch);
-
-  Node* merge = SetControl(
-      graph()->NewNode(common->Merge(2), size_null_if_true, Control()));
-  SetEffect(
-      graph()->NewNode(common->EffectPhi(2), size_null_etrue, Effect(), merge));
-  return merge;
+  return SetEffect(BuildCCall(&sig, function, dst, src, size));
 }
 
 Node* WasmGraphBuilder::DataDrop(uint32_t data_segment_index,
                                  wasm::WasmCodePosition position) {
-  Node* dropped_data_segments =
-      CheckDataSegmentIsPassiveAndNotDropped(data_segment_index, position);
+  DCHECK_LT(data_segment_index, env_->module->num_declared_data_segments);
+
+  Node* seg_size_array =
+      LOAD_INSTANCE_FIELD(DataSegmentSizes, MachineType::Pointer());
+  STATIC_ASSERT(wasm::kV8MaxWasmDataSegments <= kMaxUInt32 >> 2);
   const Operator* store_op = mcgraph()->machine()->Store(
-      StoreRepresentation(MachineRepresentation::kWord8, kNoWriteBarrier));
+      StoreRepresentation(MachineRepresentation::kWord32, kNoWriteBarrier));
   return SetEffect(
-      graph()->NewNode(store_op, dropped_data_segments,
-                       mcgraph()->IntPtrConstant(data_segment_index),
-                       mcgraph()->Int32Constant(1), Effect(), Control()));
+      graph()->NewNode(store_op, seg_size_array,
+                       mcgraph()->IntPtrConstant(data_segment_index << 2),
+                       mcgraph()->Int32Constant(0), effect(), control()));
 }
 
 Node* WasmGraphBuilder::MemoryCopy(Node* dst, Node* src, Node* size,
                                    wasm::WasmCodePosition position) {
-  auto m = mcgraph()->machine();
-  auto common = mcgraph()->common();
-  // If size == 0, then memory.copy is a no-op.
-  Node* size_null_check =
-      graph()->NewNode(m->Word32Equal(), size, mcgraph()->Int32Constant(0));
-  Node* size_null_branch = graph()->NewNode(common->Branch(BranchHint::kFalse),
-                                            size_null_check, Control());
-
-  Node* size_null_etrue = Effect();
-  Node* size_null_if_false =
-      graph()->NewNode(common->IfFalse(), size_null_branch);
-  SetControl(size_null_if_false);
-  // The data must be copied backward if src < dst.
-  Node* copy_backward = graph()->NewNode(m->Uint32LessThan(), src, dst);
-
   Node* dst_fail = BoundsCheckMemRange(&dst, &size, position);
-
-  // Trap without copying any bytes if we are copying backward and the copy is
-  // partially out-of-bounds. We only need to check that the dst region is
-  // out-of-bounds, because we know that {src < dst}, so the src region is
-  // always out of bounds if the dst region is.
-  TrapIfTrue(wasm::kTrapMemOutOfBounds,
-             graph()->NewNode(m->Word32And(), dst_fail, copy_backward),
-             position);
-
+  TrapIfTrue(wasm::kTrapMemOutOfBounds, dst_fail, position);
   Node* src_fail = BoundsCheckMemRange(&src, &size, position);
+  TrapIfTrue(wasm::kTrapMemOutOfBounds, src_fail, position);
 
   Node* function = graph()->NewNode(mcgraph()->common()->ExternalConstant(
       ExternalReference::wasm_memory_copy()));
   MachineType sig_types[] = {MachineType::Pointer(), MachineType::Pointer(),
                              MachineType::Uint32()};
   MachineSignature sig(0, 3, sig_types);
-  BuildCCall(&sig, function, dst, src, size);
-  TrapIfTrue(wasm::kTrapMemOutOfBounds,
-             graph()->NewNode(m->Word32Or(), dst_fail, src_fail), position);
-  Node* size_null_if_true =
-      graph()->NewNode(common->IfTrue(), size_null_branch);
-
-  Node* merge = SetControl(
-      graph()->NewNode(common->Merge(2), size_null_if_true, Control()));
-  SetEffect(
-      graph()->NewNode(common->EffectPhi(2), size_null_etrue, Effect(), merge));
-  return merge;
+  return SetEffect(BuildCCall(&sig, function, dst, src, size));
 }
 
 Node* WasmGraphBuilder::MemoryFill(Node* dst, Node* value, Node* size,
                                    wasm::WasmCodePosition position) {
-  auto machine = mcgraph()->machine();
-  auto common = mcgraph()->common();
-  // If size == 0, then memory.copy is a no-op.
-  Node* size_null_check = graph()->NewNode(machine->Word32Equal(), size,
-                                           mcgraph()->Int32Constant(0));
-  Node* size_null_branch = graph()->NewNode(common->Branch(BranchHint::kFalse),
-                                            size_null_check, Control());
-
-  Node* size_null_etrue = Effect();
-  Node* size_null_if_false =
-      graph()->NewNode(common->IfFalse(), size_null_branch);
-  SetControl(size_null_if_false);
   Node* fail = BoundsCheckMemRange(&dst, &size, position);
+  TrapIfTrue(wasm::kTrapMemOutOfBounds, fail, position);
+
   Node* function = graph()->NewNode(mcgraph()->common()->ExternalConstant(
       ExternalReference::wasm_memory_fill()));
   MachineType sig_types[] = {MachineType::Pointer(), MachineType::Uint32(),
                              MachineType::Uint32()};
   MachineSignature sig(0, 3, sig_types);
-  BuildCCall(&sig, function, dst, value, size);
-  TrapIfTrue(wasm::kTrapMemOutOfBounds, fail, position);
-  Node* size_null_if_true =
-      graph()->NewNode(common->IfTrue(), size_null_branch);
-
-  Node* merge = SetControl(
-      graph()->NewNode(common->Merge(2), size_null_if_true, Control()));
-  SetEffect(
-      graph()->NewNode(common->EffectPhi(2), size_null_etrue, Effect(), merge));
-  return merge;
-}
-
-Node* WasmGraphBuilder::CheckElemSegmentIsPassiveAndNotDropped(
-    uint32_t elem_segment_index, wasm::WasmCodePosition position) {
-  // The elem segment index must be in bounds since it is required by
-  // validation.
-  DCHECK_LT(elem_segment_index, env_->module->elem_segments.size());
-
-  Node* dropped_elem_segments =
-      LOAD_INSTANCE_FIELD(DroppedElemSegments, MachineType::Pointer());
-  Node* is_segment_dropped = SetEffect(graph()->NewNode(
-      mcgraph()->machine()->Load(MachineType::Uint8()), dropped_elem_segments,
-      mcgraph()->IntPtrConstant(elem_segment_index), Effect(), Control()));
-  TrapIfTrue(wasm::kTrapElemSegmentDropped, is_segment_dropped, position);
-  return dropped_elem_segments;
+  return SetEffect(BuildCCall(&sig, function, dst, value, size));
 }
 
 Node* WasmGraphBuilder::TableInit(uint32_t table_index,
                                   uint32_t elem_segment_index, Node* dst,
                                   Node* src, Node* size,
                                   wasm::WasmCodePosition position) {
-  CheckElemSegmentIsPassiveAndNotDropped(elem_segment_index, position);
+  DCHECK_LT(table_index, env_->module->tables.size());
+  // The elem segment index must be in bounds since it is required by
+  // validation.
+  DCHECK_LT(elem_segment_index, env_->module->elem_segments.size());
+
   Node* args[] = {
       graph()->NewNode(mcgraph()->common()->NumberConstant(table_index)),
       graph()->NewNode(mcgraph()->common()->NumberConstant(elem_segment_index)),
       BuildConvertUint32ToSmiWithSaturation(dst, FLAG_wasm_max_table_size),
       BuildConvertUint32ToSmiWithSaturation(src, FLAG_wasm_max_table_size),
       BuildConvertUint32ToSmiWithSaturation(size, FLAG_wasm_max_table_size)};
-  Node* result =
-      BuildCallToRuntime(Runtime::kWasmTableInit, args, arraysize(args));
-
-  return result;
+  return SetEffect(
+      BuildCallToRuntime(Runtime::kWasmTableInit, args, arraysize(args)));
 }
 
 Node* WasmGraphBuilder::ElemDrop(uint32_t elem_segment_index,
                                  wasm::WasmCodePosition position) {
+  // The elem segment index must be in bounds since it is required by
+  // validation.
+  DCHECK_LT(elem_segment_index, env_->module->elem_segments.size());
+
   Node* dropped_elem_segments =
-      CheckElemSegmentIsPassiveAndNotDropped(elem_segment_index, position);
+      LOAD_INSTANCE_FIELD(DroppedElemSegments, MachineType::Pointer());
   const Operator* store_op = mcgraph()->machine()->Store(
       StoreRepresentation(MachineRepresentation::kWord8, kNoWriteBarrier));
   return SetEffect(
       graph()->NewNode(store_op, dropped_elem_segments,
                        mcgraph()->IntPtrConstant(elem_segment_index),
-                       mcgraph()->Int32Constant(1), Effect(), Control()));
+                       mcgraph()->Int32Constant(1), effect(), control()));
 }
 
 Node* WasmGraphBuilder::TableCopy(uint32_t table_dst_index,
@@ -5025,25 +4999,17 @@ Node* WasmGraphBuilder::TableGrow(uint32_t table_index, Node* value,
 }
 
 Node* WasmGraphBuilder::TableSize(uint32_t table_index) {
-  Node* tables =
-      LOAD_INSTANCE_FIELD(Tables, MachineType::TypeCompressedTaggedPointer());
+  Node* tables = LOAD_INSTANCE_FIELD(Tables, MachineType::TaggedPointer());
   Node* table = LOAD_FIXED_ARRAY_SLOT_ANY(tables, table_index);
 
-  int storage_field_size = WasmTableObject::kElementsOffsetEnd -
-                           WasmTableObject::kElementsOffset + 1;
-  Node* storage = LOAD_RAW(
-      table, wasm::ObjectAccess::ToTagged(WasmTableObject::kEntriesOffset),
-      assert_size(storage_field_size,
-                  MachineType::TypeCompressedTaggedPointer()));
+  int length_field_size = WasmTableObject::kCurrentLengthOffsetEnd -
+                          WasmTableObject::kCurrentLengthOffset + 1;
+  Node* length_smi = LOAD_RAW(
+      table,
+      wasm::ObjectAccess::ToTagged(WasmTableObject::kCurrentLengthOffset),
+      assert_size(length_field_size, MachineType::TaggedSigned()));
 
-  int length_field_size =
-      FixedArray::kLengthOffsetEnd - FixedArray::kLengthOffset + 1;
-  Node* table_size =
-      LOAD_RAW(storage, wasm::ObjectAccess::ToTagged(FixedArray::kLengthOffset),
-               assert_size(length_field_size,
-                           MachineType::TypeCompressedTaggedSigned()));
-
-  return BuildChangeSmiToInt32(table_size);
+  return BuildChangeSmiToInt32(length_smi);
 }
 
 Node* WasmGraphBuilder::TableFill(uint32_t table_index, Node* start,
@@ -5169,15 +5135,24 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     return call_descriptor;
   }
 
+  Node* GetBuiltinPointerTarget(Builtins::Name builtin_id) {
+    static_assert(std::is_same<Smi, BuiltinPtr>(), "BuiltinPtr must be Smi");
+    return graph()->NewNode(mcgraph()->common()->NumberConstant(builtin_id));
+  }
+
+  Node* GetTargetForBuiltinCall(wasm::WasmCode::RuntimeStubId wasm_stub,
+                                Builtins::Name builtin_id) {
+    return (stub_mode_ == StubCallMode::kCallWasmRuntimeStub)
+               ? mcgraph()->RelocatableIntPtrConstant(wasm_stub,
+                                                      RelocInfo::WASM_STUB_CALL)
+               : GetBuiltinPointerTarget(builtin_id);
+  }
+
   Node* BuildAllocateHeapNumberWithValue(Node* value, Node* control) {
     MachineOperatorBuilder* machine = mcgraph()->machine();
     CommonOperatorBuilder* common = mcgraph()->common();
-    Node* target =
-        (stub_mode_ == StubCallMode::kCallWasmRuntimeStub)
-            ? mcgraph()->RelocatableIntPtrConstant(
-                  wasm::WasmCode::kWasmAllocateHeapNumber,
-                  RelocInfo::WASM_STUB_CALL)
-            : BuildLoadBuiltinFromIsolateRoot(Builtins::kAllocateHeapNumber);
+    Node* target = GetTargetForBuiltinCall(wasm::WasmCode::kAllocateHeapNumber,
+                                           Builtins::kAllocateHeapNumber);
     if (!allocate_heap_number_operator_.is_set()) {
       auto call_descriptor = Linkage::GetStubCallDescriptor(
           mcgraph()->zone(), AllocateHeapNumberDescriptor(), 0,
@@ -5185,7 +5160,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       allocate_heap_number_operator_.set(common->Call(call_descriptor));
     }
     Node* heap_number = graph()->NewNode(allocate_heap_number_operator_.get(),
-                                         target, Effect(), control);
+                                         target, effect(), control);
     SetEffect(
         graph()->NewNode(machine->Store(StoreRepresentation(
                              MachineRepresentation::kFloat64, kNoWriteBarrier)),
@@ -5194,6 +5169,11 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     return heap_number;
   }
 
+  Node* BuildChangeSmiToFloat32(Node* value) {
+    return graph()->NewNode(mcgraph()->machine()->RoundInt32ToFloat32(),
+                            BuildChangeSmiToInt32(value));
+  }
+
   Node* BuildChangeSmiToFloat64(Node* value) {
     return graph()->NewNode(mcgraph()->machine()->ChangeInt32ToFloat64(),
                             BuildChangeSmiToInt32(value));
@@ -5207,7 +5187,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
   Node* BuildLoadHeapNumberValue(Node* value) {
     return SetEffect(graph()->NewNode(
         mcgraph()->machine()->Load(MachineType::Float64()), value,
-        BuildHeapNumberValueIndexConstant(), Effect(), Control()));
+        BuildHeapNumberValueIndexConstant(), effect(), control()));
   }
 
   Node* BuildHeapNumberValueIndexConstant() {
@@ -5221,26 +5201,16 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
           instance_node_.get(),
           mcgraph()->Int32Constant(WASM_INSTANCE_OBJECT_OFFSET(IsolateRoot)),
           graph()->start(), graph()->start());
-      undefined_value_node_ = InsertDecompressionIfNeeded(
-          MachineType::TypeCompressedTaggedPointer(),
-          graph()->NewNode(
-              mcgraph()->machine()->Load(
-                  MachineType::TypeCompressedTaggedPointer()),
-              isolate_root,
-              mcgraph()->Int32Constant(
-                  IsolateData::root_slot_offset(RootIndex::kUndefinedValue)),
-              isolate_root, graph()->start()));
+      undefined_value_node_ = graph()->NewNode(
+          mcgraph()->machine()->Load(MachineType::TaggedPointer()),
+          isolate_root,
+          mcgraph()->Int32Constant(
+              IsolateData::root_slot_offset(RootIndex::kUndefinedValue)),
+          isolate_root, graph()->start());
     }
     return undefined_value_node_.get();
   }
 
-  Node* BuildLoadBuiltinFromIsolateRoot(int builtin_index) {
-    DCHECK(Builtins::IsBuiltinId(builtin_index));
-    Node* isolate_root = BuildLoadIsolateRoot();
-    return LOAD_TAGGED_POINTER(isolate_root,
-                               IsolateData::builtin_slot_offset(builtin_index));
-  }
-
   Node* BuildChangeInt32ToTagged(Node* value) {
     MachineOperatorBuilder* machine = mcgraph()->machine();
     CommonOperatorBuilder* common = mcgraph()->common();
@@ -5250,19 +5220,19 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     }
     DCHECK(SmiValuesAre31Bits());
 
-    Node* effect = Effect();
-    Node* control = Control();
+    Node* old_effect = effect();
+    Node* old_control = control();
     Node* add = graph()->NewNode(machine->Int32AddWithOverflow(), value, value,
                                  graph()->start());
 
     Node* ovf = graph()->NewNode(common->Projection(1), add, graph()->start());
     Node* branch =
-        graph()->NewNode(common->Branch(BranchHint::kFalse), ovf, control);
+        graph()->NewNode(common->Branch(BranchHint::kFalse), ovf, old_control);
 
     Node* if_true = graph()->NewNode(common->IfTrue(), branch);
     Node* vtrue = BuildAllocateHeapNumberWithValue(
         graph()->NewNode(machine->ChangeInt32ToFloat64(), value), if_true);
-    Node* etrue = Effect();
+    Node* etrue = effect();
 
     Node* if_false = graph()->NewNode(common->IfFalse(), branch);
     Node* vfalse = graph()->NewNode(common->Projection(0), add, if_false);
@@ -5270,7 +5240,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
 
     Node* merge =
         SetControl(graph()->NewNode(common->Merge(2), if_true, if_false));
-    SetEffect(graph()->NewNode(common->EffectPhi(2), etrue, effect, merge));
+    SetEffect(graph()->NewNode(common->EffectPhi(2), etrue, old_effect, merge));
     return graph()->NewNode(common->Phi(MachineRepresentation::kTagged, 2),
                             vtrue, vfalse, merge);
   }
@@ -5290,13 +5260,14 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     // For potential Smi values, depending on whether Smis are 31 or 32 bit, we
     // still need to check whether the value fits in a Smi.
 
-    Node* effect = Effect();
-    Node* control = Control();
+    Node* old_effect = effect();
+    Node* old_control = control();
     Node* value32 = graph()->NewNode(machine->RoundFloat64ToInt32(), value);
     Node* check_i32 = graph()->NewNode(
         machine->Float64Equal(), value,
         graph()->NewNode(machine->ChangeInt32ToFloat64(), value32));
-    Node* branch_i32 = graph()->NewNode(common->Branch(), check_i32, control);
+    Node* branch_i32 =
+        graph()->NewNode(common->Branch(), check_i32, old_control);
 
     Node* if_i32 = graph()->NewNode(common->IfTrue(), branch_i32);
     Node* if_not_i32 = graph()->NewNode(common->IfFalse(), branch_i32);
@@ -5353,11 +5324,11 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
 
     // Allocate the box for the {value}.
     Node* vbox = BuildAllocateHeapNumberWithValue(value, if_box);
-    Node* ebox = Effect();
+    Node* ebox = effect();
 
     Node* merge =
         SetControl(graph()->NewNode(common->Merge(2), if_smi, if_box));
-    SetEffect(graph()->NewNode(common->EffectPhi(2), effect, ebox, merge));
+    SetEffect(graph()->NewNode(common->EffectPhi(2), old_effect, ebox, merge));
     return graph()->NewNode(common->Phi(MachineRepresentation::kTagged, 2),
                             vsmi, vbox, merge);
   }
@@ -5373,71 +5344,27 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     return pos;
   }
 
-  Node* BuildJavaScriptToNumber(Node* node, Node* js_context) {
-    auto call_descriptor = Linkage::GetStubCallDescriptor(
-        mcgraph()->zone(), TypeConversionDescriptor{}, 0,
-        CallDescriptor::kNoFlags, Operator::kNoProperties, stub_mode_);
-    Node* stub_code =
-        (stub_mode_ == StubCallMode::kCallWasmRuntimeStub)
-            ? mcgraph()->RelocatableIntPtrConstant(
-                  wasm::WasmCode::kWasmToNumber, RelocInfo::WASM_STUB_CALL)
-            : BuildLoadBuiltinFromIsolateRoot(Builtins::kToNumber);
-
-    Node* result = SetEffect(
-        graph()->NewNode(mcgraph()->common()->Call(call_descriptor), stub_code,
-                         node, js_context, Effect(), Control()));
-
-    SetSourcePosition(result, 1);
-
-    return result;
-  }
-
-  Node* BuildChangeTaggedToFloat64(Node* value) {
-    MachineOperatorBuilder* machine = mcgraph()->machine();
-    CommonOperatorBuilder* common = mcgraph()->common();
-
-    // Implement the following decision tree:
-    //  heap object?
-    //  ├─ true: undefined?
-    //  │        ├─ true: f64 const
-    //  │        └─ false: load heap number value
-    //  └─ false: smi to float64
-
+  // Converts a number (Smi or HeapNumber) to float64.
+  Node* BuildChangeNumberToFloat64(Node* value) {
+    // If the input is a HeapNumber, we load the value from it.
     Node* check_heap_object = BuildTestHeapObject(value);
-    Diamond is_heap_object(graph(), common, check_heap_object,
-                           BranchHint::kFalse);
-    is_heap_object.Chain(Control());
-
-    SetControl(is_heap_object.if_true);
-    Node* orig_effect = Effect();
-
-    Node* undefined_node = BuildLoadUndefinedValueFromInstance();
-    Node* check_undefined =
-        graph()->NewNode(machine->WordEqual(), value, undefined_node);
-    Node* effect_tagged = Effect();
-
-    Diamond is_undefined(graph(), common, check_undefined, BranchHint::kFalse);
-    is_undefined.Nest(is_heap_object, true);
-
-    SetControl(is_undefined.if_false);
-    Node* vheap_number = BuildLoadHeapNumberValue(value);
-    Node* effect_undefined = Effect();
+    Diamond is_heapnumber(graph(), mcgraph()->common(), check_heap_object,
+                          BranchHint::kFalse);
+    is_heapnumber.Chain(control());
 
-    SetControl(is_undefined.merge);
-    Node* vundefined =
-        mcgraph()->Float64Constant(std::numeric_limits<double>::quiet_NaN());
-    Node* vtagged = is_undefined.Phi(MachineRepresentation::kFloat64,
-                                     vundefined, vheap_number);
+    SetControl(is_heapnumber.if_true);
+    Node* effect_orig = effect();
+    Node* v_heapnumber = BuildLoadHeapNumberValue(value);
+    Node* effect_heapnumber = effect();
 
-    effect_tagged = is_undefined.EffectPhi(effect_tagged, effect_undefined);
+    SetControl(is_heapnumber.merge);
+    // If the input is Smi, just convert to float64.
+    Node* v_smi = BuildChangeSmiToFloat64(value);
 
-    // If input is Smi: just convert to float64.
-    Node* vfrom_smi = BuildChangeSmiToFloat64(value);
+    SetEffect(is_heapnumber.EffectPhi(effect_heapnumber, effect_orig));
 
-    SetControl(is_heap_object.merge);
-    SetEffect(is_heap_object.EffectPhi(effect_tagged, orig_effect));
-    return is_heap_object.Phi(MachineRepresentation::kFloat64, vtagged,
-                              vfrom_smi);
+    return is_heapnumber.Phi(MachineRepresentation::kFloat64, v_heapnumber,
+                             v_smi);
   }
 
   Node* ToJS(Node* node, wasm::ValueType type) {
@@ -5447,7 +5374,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       case wasm::kWasmS128:
         UNREACHABLE();
       case wasm::kWasmI64: {
-        DCHECK(enabled_features_.bigint);
+        DCHECK(enabled_features_.has_bigint());
         return BuildChangeInt64ToBigInt(node);
       }
       case wasm::kWasmF32:
@@ -5458,6 +5385,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         return BuildChangeFloat64ToTagged(node);
       case wasm::kWasmAnyRef:
       case wasm::kWasmFuncRef:
+      case wasm::kWasmNullRef:
       case wasm::kWasmExnRef:
         return node;
       default:
@@ -5471,26 +5399,19 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
 
     Node* target;
     if (mcgraph()->machine()->Is64()) {
-      target =
-          (stub_mode_ == StubCallMode::kCallWasmRuntimeStub)
-              ? mcgraph()->RelocatableIntPtrConstant(
-                    wasm::WasmCode::kWasmI64ToBigInt, RelocInfo::WASM_STUB_CALL)
-              : BuildLoadBuiltinFromIsolateRoot(Builtins::kI64ToBigInt);
+      target = GetTargetForBuiltinCall(wasm::WasmCode::kI64ToBigInt,
+                                       Builtins::kI64ToBigInt);
     } else {
       DCHECK(mcgraph()->machine()->Is32());
       // On 32-bit platforms we already set the target to the
       // I32PairToBigInt builtin here, so that we don't have to replace the
       // target in the int64-lowering.
-      target =
-          (stub_mode_ == StubCallMode::kCallWasmRuntimeStub)
-              ? mcgraph()->RelocatableIntPtrConstant(
-                    wasm::WasmCode::kWasmI32PairToBigInt,
-                    RelocInfo::WASM_STUB_CALL)
-              : BuildLoadBuiltinFromIsolateRoot(Builtins::kI32PairToBigInt);
+      target = GetTargetForBuiltinCall(wasm::WasmCode::kI32PairToBigInt,
+                                       Builtins::kI32PairToBigInt);
     }
 
-    return SetEffect(
-        SetControl(graph()->NewNode(call, target, input, Effect(), Control())));
+    return SetEffectControl(
+        graph()->NewNode(call, target, input, effect(), control()));
   }
 
   Node* BuildChangeBigIntToInt64(Node* input, Node* context) {
@@ -5499,91 +5420,161 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
 
     Node* target;
     if (mcgraph()->machine()->Is64()) {
-      target =
-          (stub_mode_ == StubCallMode::kCallWasmRuntimeStub)
-              ? mcgraph()->RelocatableIntPtrConstant(
-                    wasm::WasmCode::kWasmBigIntToI64, RelocInfo::WASM_STUB_CALL)
-              : BuildLoadBuiltinFromIsolateRoot(Builtins::kBigIntToI64);
+      target = GetTargetForBuiltinCall(wasm::WasmCode::kBigIntToI64,
+                                       Builtins::kBigIntToI64);
     } else {
       DCHECK(mcgraph()->machine()->Is32());
       // On 32-bit platforms we already set the target to the
       // BigIntToI32Pair builtin here, so that we don't have to replace the
       // target in the int64-lowering.
-      target =
-          (stub_mode_ == StubCallMode::kCallWasmRuntimeStub)
-              ? mcgraph()->RelocatableIntPtrConstant(
-                    wasm::WasmCode::kWasmBigIntToI32Pair,
-                    RelocInfo::WASM_STUB_CALL)
-              : BuildLoadBuiltinFromIsolateRoot(Builtins::kBigIntToI32Pair);
+      target = GetTargetForBuiltinCall(wasm::WasmCode::kBigIntToI32Pair,
+                                       Builtins::kBigIntToI32Pair);
     }
 
-    return SetEffect(SetControl(
-        graph()->NewNode(call, target, input, context, Effect(), Control())));
+    return SetEffectControl(
+        graph()->NewNode(call, target, input, context, effect(), control()));
   }
 
-  Node* FromJS(Node* node, Node* js_context, wasm::ValueType type) {
-    DCHECK_NE(wasm::kWasmStmt, type);
+  Node* BuildTestSmi(Node* value) {
+    MachineOperatorBuilder* machine = mcgraph()->machine();
+    return graph()->NewNode(machine->Word32Equal(),
+                            graph()->NewNode(machine->Word32And(),
+                                             BuildTruncateIntPtrToInt32(value),
+                                             Int32Constant(kSmiTagMask)),
+                            Int32Constant(0));
+  }
 
-    // The parameter is of type anyref or exnref, we take it as is.
-    if (type == wasm::kWasmAnyRef || type == wasm::kWasmExnRef) {
-      return node;
+  Node* BuildFloat64ToWasm(Node* value, wasm::ValueType type) {
+    switch (type) {
+      case wasm::kWasmI32:
+        return graph()->NewNode(mcgraph()->machine()->TruncateFloat64ToWord32(),
+                                value);
+      case wasm::kWasmF32:
+        return graph()->NewNode(
+            mcgraph()->machine()->TruncateFloat64ToFloat32(), value);
+      case wasm::kWasmF64:
+        return value;
+      default:
+        UNREACHABLE();
     }
+  }
 
-    if (type == wasm::kWasmFuncRef) {
-      Node* check =
-          BuildChangeSmiToInt32(SetEffect(BuildCallToRuntimeWithContext(
-              Runtime::kWasmIsValidFuncRefValue, js_context, &node, 1, effect_,
-              Control())));
+  Node* BuildSmiToWasm(Node* smi, wasm::ValueType type) {
+    switch (type) {
+      case wasm::kWasmI32:
+        return BuildChangeSmiToInt32(smi);
+      case wasm::kWasmF32:
+        return BuildChangeSmiToFloat32(smi);
+      case wasm::kWasmF64:
+        return BuildChangeSmiToFloat64(smi);
+      default:
+        UNREACHABLE();
+    }
+  }
 
-      Diamond type_check(graph(), mcgraph()->common(), check,
-                         BranchHint::kTrue);
-      type_check.Chain(Control());
+  Node* FromJS(Node* input, Node* js_context, wasm::ValueType type) {
+    switch (type) {
+      case wasm::kWasmAnyRef:
+      case wasm::kWasmExnRef:
+        return input;
 
-      Node* effect = Effect();
-      BuildCallToRuntimeWithContext(Runtime::kWasmThrowTypeError, js_context,
-                                    nullptr, 0, &effect, type_check.if_false);
+      case wasm::kWasmNullRef: {
+        Node* check = graph()->NewNode(mcgraph()->machine()->WordEqual(), input,
+                                       RefNull());
 
-      SetEffect(type_check.EffectPhi(Effect(), effect));
+        Diamond null_check(graph(), mcgraph()->common(), check,
+                           BranchHint::kTrue);
+        null_check.Chain(control());
+        SetControl(null_check.if_false);
 
-      SetControl(type_check.merge);
+        Node* old_effect = effect();
+        BuildCallToRuntimeWithContext(Runtime::kWasmThrowTypeError, js_context,
+                                      nullptr, 0);
 
-      return node;
-    }
-    Node* num = nullptr;
+        SetEffectControl(null_check.EffectPhi(old_effect, effect()),
+                         null_check.merge);
 
-    if (type != wasm::kWasmI64) {
-      // Do a JavaScript ToNumber.
-      num = BuildJavaScriptToNumber(node, js_context);
+        return input;
+      }
 
-      // Change representation.
-      num = BuildChangeTaggedToFloat64(num);
-    }
+      case wasm::kWasmFuncRef: {
+        Node* check =
+            BuildChangeSmiToInt32(SetEffect(BuildCallToRuntimeWithContext(
+                Runtime::kWasmIsValidFuncRefValue, js_context, &input, 1)));
 
-    switch (type) {
-      case wasm::kWasmI32: {
-        num = graph()->NewNode(mcgraph()->machine()->TruncateFloat64ToWord32(),
-                               num);
-        break;
-      }
-      case wasm::kWasmI64: {
-        DCHECK(enabled_features_.bigint);
-        num = BuildChangeBigIntToInt64(node, js_context);
-        break;
+        Diamond type_check(graph(), mcgraph()->common(), check,
+                           BranchHint::kTrue);
+        type_check.Chain(control());
+        SetControl(type_check.if_false);
+
+        Node* old_effect = effect();
+        BuildCallToRuntimeWithContext(Runtime::kWasmThrowTypeError, js_context,
+                                      nullptr, 0);
+
+        SetEffectControl(type_check.EffectPhi(old_effect, effect()),
+                         type_check.merge);
+
+        return input;
       }
-      case wasm::kWasmF32:
-        num = graph()->NewNode(mcgraph()->machine()->TruncateFloat64ToFloat32(),
-                               num);
-        break;
-      case wasm::kWasmF64:
-        break;
-      case wasm::kWasmS128:
-        UNREACHABLE();
+
+      case wasm::kWasmI64:
+        // i64 values can only come from BigInt.
+        DCHECK(enabled_features_.has_bigint());
+        return BuildChangeBigIntToInt64(input, js_context);
+
       default:
-        UNREACHABLE();
+        break;
     }
-    DCHECK_NOT_NULL(num);
 
-    return num;
+    gasm_->InitializeEffectControl(effect(), control());
+
+    // Handle Smis first. The rest goes through the ToNumber stub.
+    // TODO(clemensb): Also handle HeapNumbers specially.
+    STATIC_ASSERT(kSmiTagMask < kMaxUInt32);
+
+    // Build a graph implementing this diagram:
+    //   input smi?
+    //    ├─ true: ───────────────────────┬─ smi-to-wasm ──────┬─ result
+    //    └─ false: ToNumber -> smi?      │                    │
+    //                          ├─ true: ─┘                    │
+    //                          └─ false: load -> f64-to-wasm ─┘
+
+    auto smi_to_wasm = gasm_->MakeLabel(MachineRepresentation::kTaggedSigned);
+    auto done =
+        gasm_->MakeLabel(wasm::ValueTypes::MachineRepresentationFor(type));
+
+    // If the input is Smi, directly convert to the wasm type.
+    gasm_->GotoIf(BuildTestSmi(input), &smi_to_wasm, input);
+
+    // Otherwise, call ToNumber which returns a Smi or HeapNumber.
+    auto to_number_descriptor = Linkage::GetStubCallDescriptor(
+        mcgraph()->zone(), TypeConversionDescriptor{}, 0,
+        CallDescriptor::kNoFlags, Operator::kNoProperties, stub_mode_);
+    Node* to_number_target =
+        GetTargetForBuiltinCall(wasm::WasmCode::kToNumber, Builtins::kToNumber);
+
+    Node* number =
+        gasm_->Call(to_number_descriptor, to_number_target, input, js_context);
+    SetSourcePosition(number, 1);
+
+    // If the ToNumber result is Smi, convert to wasm.
+    gasm_->GotoIf(BuildTestSmi(number), &smi_to_wasm, number);
+
+    // Otherwise the ToNumber result is a HeapNumber. Load its value and convert
+    // to wasm.
+    Node* heap_number_value = gasm_->LoadHeapNumberValue(number);
+    Node* converted_heap_number_value =
+        BuildFloat64ToWasm(heap_number_value, type);
+    gasm_->Goto(&done, converted_heap_number_value);
+
+    // Now implement the smi to wasm conversion.
+    gasm_->Bind(&smi_to_wasm);
+    Node* smi_to_wasm_result = BuildSmiToWasm(smi_to_wasm.PhiAt(0), type);
+    gasm_->Goto(&done, smi_to_wasm_result);
+
+    // Done. Update effect and control and return the final Phi.
+    gasm_->Bind(&done);
+    return done.PhiAt(0);
   }
 
   void BuildModifyThreadInWasmFlag(bool new_value) {
@@ -5598,57 +5589,56 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       Node* flag_value = SetEffect(
           graph()->NewNode(mcgraph()->machine()->Load(MachineType::Pointer()),
                            thread_in_wasm_flag_address,
-                           mcgraph()->Int32Constant(0), Effect(), Control()));
+                           mcgraph()->Int32Constant(0), effect(), control()));
       Node* check =
           graph()->NewNode(mcgraph()->machine()->Word32Equal(), flag_value,
                            mcgraph()->Int32Constant(new_value ? 0 : 1));
 
       Diamond flag_check(graph(), mcgraph()->common(), check,
                          BranchHint::kTrue);
-      flag_check.Chain(Control());
+      flag_check.Chain(control());
+      SetControl(flag_check.if_false);
       Node* message_id = graph()->NewNode(
           mcgraph()->common()->NumberConstant(static_cast<int32_t>(
               new_value ? AbortReason::kUnexpectedThreadInWasmSet
                         : AbortReason::kUnexpectedThreadInWasmUnset)));
 
-      Node* effect = Effect();
+      Node* old_effect = effect();
       BuildCallToRuntimeWithContext(Runtime::kAbort, NoContextConstant(),
-                                    &message_id, 1, &effect,
-                                    flag_check.if_false);
-
-      SetEffect(flag_check.EffectPhi(Effect(), effect));
+                                    &message_id, 1);
 
-      SetControl(flag_check.merge);
+      SetEffectControl(flag_check.EffectPhi(old_effect, effect()),
+                       flag_check.merge);
     }
 
     SetEffect(graph()->NewNode(
         mcgraph()->machine()->Store(StoreRepresentation(
             MachineRepresentation::kWord32, kNoWriteBarrier)),
         thread_in_wasm_flag_address, mcgraph()->Int32Constant(0),
-        mcgraph()->Int32Constant(new_value ? 1 : 0), Effect(), Control()));
+        mcgraph()->Int32Constant(new_value ? 1 : 0), effect(), control()));
   }
 
   Node* BuildLoadFunctionDataFromExportedFunction(Node* closure) {
     Node* shared = LOAD_RAW(
         closure,
         wasm::ObjectAccess::SharedFunctionInfoOffsetInTaggedJSFunction(),
-        MachineType::TypeCompressedTagged());
+        MachineType::AnyTagged());
     return LOAD_RAW(shared,
                     SharedFunctionInfo::kFunctionDataOffset - kHeapObjectTag,
-                    MachineType::TypeCompressedTagged());
+                    MachineType::AnyTagged());
   }
 
   Node* BuildLoadInstanceFromExportedFunctionData(Node* function_data) {
     return LOAD_RAW(function_data,
                     WasmExportedFunctionData::kInstanceOffset - kHeapObjectTag,
-                    MachineType::TypeCompressedTagged());
+                    MachineType::AnyTagged());
   }
 
   Node* BuildLoadFunctionIndexFromExportedFunctionData(Node* function_data) {
     Node* function_index_smi = LOAD_RAW(
         function_data,
         WasmExportedFunctionData::kFunctionIndexOffset - kHeapObjectTag,
-        MachineType::TypeCompressedTaggedSigned());
+        MachineType::TaggedSigned());
     Node* function_index = BuildChangeSmiToInt32(function_index_smi);
     return function_index;
   }
@@ -5657,7 +5647,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     Node* jump_table_offset_smi = LOAD_RAW(
         function_data,
         WasmExportedFunctionData::kJumpTableOffsetOffset - kHeapObjectTag,
-        MachineType::TypeCompressedTaggedSigned());
+        MachineType::TaggedSigned());
     Node* jump_table_offset = BuildChangeSmiToIntPtr(jump_table_offset_smi);
     return jump_table_offset;
   }
@@ -5665,17 +5655,17 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
   Node* BuildMultiReturnFixedArrayFromIterable(const wasm::FunctionSig* sig,
                                                Node* iterable, Node* context) {
     Node* iterable_to_fixed_array =
-        BuildLoadBuiltinFromIsolateRoot(Builtins::kIterableToFixedArrayForWasm);
+        GetBuiltinPointerTarget(Builtins::kIterableToFixedArrayForWasm);
     IterableToFixedArrayForWasmDescriptor interface_descriptor;
     Node* length = BuildChangeUint31ToSmi(
         Uint32Constant(static_cast<uint32_t>(sig->return_count())));
     auto call_descriptor = Linkage::GetStubCallDescriptor(
         mcgraph()->zone(), interface_descriptor,
         interface_descriptor.GetStackParameterCount(), CallDescriptor::kNoFlags,
-        Operator::kNoProperties, StubCallMode::kCallCodeObject);
+        Operator::kNoProperties, StubCallMode::kCallBuiltinPointer);
     return SetEffect(graph()->NewNode(
         mcgraph()->common()->Call(call_descriptor), iterable_to_fixed_array,
-        iterable, length, context, Effect(), Control()));
+        iterable, length, context, effect(), control()));
   }
 
   void BuildJSToWasmWrapper(bool is_import) {
@@ -5683,7 +5673,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     const int rets_count = static_cast<int>(sig_->return_count());
 
     // Build the start and the JS parameter nodes.
-    SetEffect(SetControl(Start(wasm_count + 5)));
+    SetEffectControl(Start(wasm_count + 5));
 
     // Create the js_closure and js_context parameters.
     Node* js_closure =
@@ -5708,8 +5698,8 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       // function (passed as a parameter), such that the generated code is
       // js_context independent.
       BuildCallToRuntimeWithContext(Runtime::kWasmThrowTypeError, js_context,
-                                    nullptr, 0, effect_, Control());
-      TerminateThrow(Effect(), Control());
+                                    nullptr, 0);
+      TerminateThrow(effect(), control());
       return;
     }
 
@@ -5769,32 +5759,59 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         STORE_FIXED_ARRAY_SLOT_ANY(fixed_array, i, value);
       }
       jsval = BuildCallToRuntimeWithContext(Runtime::kWasmNewMultiReturnJSArray,
-                                            js_context, &fixed_array, 1,
-                                            effect_, Control());
+                                            js_context, &fixed_array, 1);
     }
     Return(jsval);
     if (ContainsInt64(sig_)) LowerInt64(kCalledFromJS);
   }
 
+  Node* BuildReceiverNode(Node* callable_node, Node* native_context,
+                          Node* undefined_node) {
+    // Check function strict bit.
+    Node* shared_function_info = LOAD_RAW(
+        callable_node,
+        wasm::ObjectAccess::SharedFunctionInfoOffsetInTaggedJSFunction(),
+        MachineType::TaggedPointer());
+    Node* flags =
+        LOAD_RAW(shared_function_info,
+                 wasm::ObjectAccess::FlagsOffsetInSharedFunctionInfo(),
+                 MachineType::Int32());
+    Node* strict_check =
+        Binop(wasm::kExprI32And, flags,
+              mcgraph()->Int32Constant(SharedFunctionInfo::IsNativeBit::kMask |
+                                       SharedFunctionInfo::IsStrictBit::kMask));
+
+    // Load global receiver if sloppy else use undefined.
+    Diamond strict_d(graph(), mcgraph()->common(), strict_check,
+                     BranchHint::kNone);
+    Node* old_effect = effect();
+    SetControl(strict_d.if_false);
+    Node* global_proxy =
+        LOAD_FIXED_ARRAY_SLOT_PTR(native_context, Context::GLOBAL_PROXY_INDEX);
+    SetEffectControl(strict_d.EffectPhi(old_effect, global_proxy),
+                     strict_d.merge);
+    return strict_d.Phi(MachineRepresentation::kTagged, undefined_node,
+                        global_proxy);
+  }
+
   bool BuildWasmImportCallWrapper(WasmImportCallKind kind) {
     int wasm_count = static_cast<int>(sig_->parameter_count());
 
     // Build the start and the parameter nodes.
-    SetEffect(SetControl(Start(wasm_count + 4)));
+    SetEffectControl(Start(wasm_count + 4));
 
     instance_node_.set(Param(wasm::kWasmInstanceParameterIndex));
 
-    Node* native_context = LOAD_INSTANCE_FIELD(
-        NativeContext, MachineType::TypeCompressedTaggedPointer());
+    Node* native_context =
+        LOAD_INSTANCE_FIELD(NativeContext, MachineType::TaggedPointer());
 
     if (kind == WasmImportCallKind::kRuntimeTypeError) {
       // =======================================================================
       // === Runtime TypeError =================================================
       // =======================================================================
       BuildCallToRuntimeWithContext(Runtime::kWasmThrowTypeError,
-                                    native_context, nullptr, 0, effect_,
-                                    Control());
-      TerminateThrow(Effect(), Control());
+                                    native_context, nullptr, 0);
+      TerminateThrow(effect(), control());
       return false;
     }
 
@@ -5804,7 +5821,6 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     Node* undefined_node = BuildLoadUndefinedValueFromInstance();
 
     Node* call = nullptr;
-    bool sloppy_receiver = true;
 
     // Clear the ThreadInWasm flag.
     BuildModifyThreadInWasmFlag(false);
@@ -5813,25 +5829,18 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       // =======================================================================
       // === JS Functions with matching arity ==================================
       // =======================================================================
-      case WasmImportCallKind::kJSFunctionArityMatch:
-        sloppy_receiver = false;
-        V8_FALLTHROUGH;  // fallthru
-      case WasmImportCallKind::kJSFunctionArityMatchSloppy: {
+      case WasmImportCallKind::kJSFunctionArityMatch: {
         base::SmallVector<Node*, 16> args(wasm_count + 7);
         int pos = 0;
         Node* function_context =
             LOAD_RAW(callable_node,
                      wasm::ObjectAccess::ContextOffsetInTaggedJSFunction(),
-                     MachineType::TypeCompressedTaggedPointer());
+                     MachineType::TaggedPointer());
         args[pos++] = callable_node;  // target callable.
-        // Receiver.
-        if (sloppy_receiver) {
-          Node* global_proxy = LOAD_FIXED_ARRAY_SLOT_PTR(
-              native_context, Context::GLOBAL_PROXY_INDEX);
-          args[pos++] = global_proxy;
-        } else {
-          args[pos++] = undefined_node;
-        }
+
+        // Determine receiver at runtime.
+        args[pos++] =
+            BuildReceiverNode(callable_node, native_context, undefined_node);
 
         auto call_descriptor = Linkage::GetJSCallDescriptor(
             graph()->zone(), false, wasm_count + 1, CallDescriptor::kNoFlags);
@@ -5842,8 +5851,8 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         args[pos++] = undefined_node;                        // new target
         args[pos++] = mcgraph()->Int32Constant(wasm_count);  // argument count
         args[pos++] = function_context;
-        args[pos++] = Effect();
-        args[pos++] = Control();
+        args[pos++] = effect();
+        args[pos++] = control();
 
         DCHECK_EQ(pos, args.size());
         call = graph()->NewNode(mcgraph()->common()->Call(call_descriptor), pos,
@@ -5853,18 +5862,16 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       // =======================================================================
       // === JS Functions with arguments adapter ===============================
       // =======================================================================
-      case WasmImportCallKind::kJSFunctionArityMismatch:
-        sloppy_receiver = false;
-        V8_FALLTHROUGH;  // fallthru
-      case WasmImportCallKind::kJSFunctionArityMismatchSloppy: {
+      case WasmImportCallKind::kJSFunctionArityMismatch: {
         base::SmallVector<Node*, 16> args(wasm_count + 9);
         int pos = 0;
         Node* function_context =
             LOAD_RAW(callable_node,
                      wasm::ObjectAccess::ContextOffsetInTaggedJSFunction(),
-                     MachineType::TypeCompressedTaggedPointer());
-        args[pos++] = BuildLoadBuiltinFromIsolateRoot(
-            Builtins::kArgumentsAdaptorTrampoline);
+                     MachineType::TaggedPointer());
+        args[pos++] = mcgraph()->RelocatableIntPtrConstant(
+            wasm::WasmCode::kArgumentsAdaptorTrampoline,
+            RelocInfo::WASM_STUB_CALL);
         args[pos++] = callable_node;                         // target callable
         args[pos++] = undefined_node;                        // new target
         args[pos++] = mcgraph()->Int32Constant(wasm_count);  // argument count
@@ -5873,41 +5880,30 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         Node* shared_function_info = LOAD_RAW(
             callable_node,
             wasm::ObjectAccess::SharedFunctionInfoOffsetInTaggedJSFunction(),
-            MachineType::TypeCompressedTaggedPointer());
+            MachineType::TaggedPointer());
         Node* formal_param_count = SetEffect(graph()->NewNode(
             mcgraph()->machine()->Load(MachineType::Uint16()),
             shared_function_info,
             mcgraph()->Int32Constant(
                 wasm::ObjectAccess::
                     FormalParameterCountOffsetInSharedFunctionInfo()),
-            Effect(), Control()));
+            effect(), control()));
         args[pos++] = formal_param_count;
 
-        // Receiver.
-        if (sloppy_receiver) {
-          Node* global_proxy = LOAD_FIXED_ARRAY_SLOT_PTR(
-              native_context, Context::GLOBAL_PROXY_INDEX);
-          args[pos++] = global_proxy;
-        } else {
-          args[pos++] = undefined_node;
-        }
-
-#ifdef V8_TARGET_ARCH_IA32
-        // TODO(v8:6666): Remove kAllowCallThroughSlot and use a pc-relative
-        // call instead once builtins are embedded in every build configuration.
-        CallDescriptor::Flags flags = CallDescriptor::kAllowCallThroughSlot;
-#else
-        CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-#endif
+        // Determine receiver at runtime.
+        args[pos++] =
+            BuildReceiverNode(callable_node, native_context, undefined_node);
+
         auto call_descriptor = Linkage::GetStubCallDescriptor(
             mcgraph()->zone(), ArgumentsAdaptorDescriptor{}, 1 + wasm_count,
-            flags, Operator::kNoProperties);
+            CallDescriptor::kNoFlags, Operator::kNoProperties,
+            StubCallMode::kCallWasmRuntimeStub);
 
         // Convert wasm numbers to JS values.
         pos = AddArgumentNodes(VectorOf(args), pos, wasm_count, sig_);
         args[pos++] = function_context;
-        args[pos++] = Effect();
-        args[pos++] = Control();
+        args[pos++] = effect();
+        args[pos++] = control();
 
         DCHECK_EQ(pos, args.size());
         call = graph()->NewNode(mcgraph()->common()->Call(call_descriptor), pos,
@@ -5920,15 +5916,15 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       case WasmImportCallKind::kUseCallBuiltin: {
         base::SmallVector<Node*, 16> args(wasm_count + 7);
         int pos = 0;
-        args[pos++] =
-            BuildLoadBuiltinFromIsolateRoot(Builtins::kCall_ReceiverIsAny);
+        args[pos++] = GetBuiltinPointerTarget(Builtins::kCall_ReceiverIsAny);
         args[pos++] = callable_node;
         args[pos++] = mcgraph()->Int32Constant(wasm_count);  // argument count
         args[pos++] = undefined_node;                        // receiver
 
         auto call_descriptor = Linkage::GetStubCallDescriptor(
             graph()->zone(), CallTrampolineDescriptor{}, wasm_count + 1,
-            CallDescriptor::kNoFlags, Operator::kNoProperties);
+            CallDescriptor::kNoFlags, Operator::kNoProperties,
+            StubCallMode::kCallBuiltinPointer);
 
         // Convert wasm numbers to JS values.
         pos = AddArgumentNodes(VectorOf(args), pos, wasm_count, sig_);
@@ -5939,8 +5935,8 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         // TypeError, if the target is a native function, or if the target is a
         // callable JSObject, which can only be constructed by the runtime.
         args[pos++] = native_context;
-        args[pos++] = Effect();
-        args[pos++] = Control();
+        args[pos++] = effect();
+        args[pos++] = control();
 
         DCHECK_EQ(pos, args.size());
         call = graph()->NewNode(mcgraph()->common()->Call(call_descriptor), pos,
@@ -6003,8 +5999,8 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       // TODO(jkummerow): When a values is a reference type, we should pass it
       // in a GC-safe way, not just as a raw pointer.
       SetEffect(graph()->NewNode(GetSafeStoreOperator(offset, type), values,
-                                 Int32Constant(offset), Param(i + 1), Effect(),
-                                 Control()));
+                                 Int32Constant(offset), Param(i + 1), effect(),
+                                 control()));
       offset += wasm::ValueTypes::ElementSizeInBytes(type);
     }
     // The function is passed as the last parameter, after WASM arguments.
@@ -6012,13 +6008,13 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     Node* shared = LOAD_RAW(
         function_node,
         wasm::ObjectAccess::SharedFunctionInfoOffsetInTaggedJSFunction(),
-        MachineType::TypeCompressedTagged());
+        MachineType::AnyTagged());
     Node* sfi_data = LOAD_RAW(
         shared, SharedFunctionInfo::kFunctionDataOffset - kHeapObjectTag,
-        MachineType::TypeCompressedTagged());
+        MachineType::AnyTagged());
     Node* host_data_foreign = LOAD_RAW(
         sfi_data, WasmCapiFunctionData::kEmbedderDataOffset - kHeapObjectTag,
-        MachineType::TypeCompressedTagged());
+        MachineType::AnyTagged());
 
     BuildModifyThreadInWasmFlag(false);
     Node* isolate_root = BuildLoadIsolateRoot();
@@ -6045,7 +6041,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         graph()->NewNode(mcgraph()->common()->Branch(BranchHint::kTrue),
                          graph()->NewNode(mcgraph()->machine()->WordEqual(),
                                           return_value, IntPtrConstant(0)),
-                         Control());
+                         control());
     SetControl(
         graph()->NewNode(mcgraph()->common()->IfFalse(), exception_branch));
     WasmThrowDescriptor interface_descriptor;
@@ -6057,8 +6053,8 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         wasm::WasmCode::kWasmRethrow, RelocInfo::WASM_STUB_CALL);
     Node* throw_effect =
         graph()->NewNode(mcgraph()->common()->Call(call_descriptor),
-                         call_target, return_value, Effect(), Control());
-    TerminateThrow(throw_effect, Control());
+                         call_target, return_value, effect(), control());
+    TerminateThrow(throw_effect, control());
 
     SetControl(
         graph()->NewNode(mcgraph()->common()->IfTrue(), exception_branch));
@@ -6073,7 +6069,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         wasm::ValueType type = sig_->GetReturn(i);
         Node* val = SetEffect(
             graph()->NewNode(GetSafeLoadOperator(offset, type), values,
-                             Int32Constant(offset), Effect(), Control()));
+                             Int32Constant(offset), effect(), control()));
         returns[i] = val;
         offset += wasm::ValueTypes::ElementSizeInBytes(type);
       }
@@ -6087,7 +6083,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     int param_count = static_cast<int>(sig_->parameter_count());
 
     // Build the start and the parameter nodes.
-    SetEffect(SetControl(Start(param_count + 3)));
+    SetEffectControl(Start(param_count + 3));
 
     // Create the instance_node from the passed parameter.
     instance_node_.set(Param(wasm::kWasmInstanceParameterIndex));
@@ -6118,8 +6114,8 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       wasm::ValueType type = sig_->GetParam(i);
       // Start from the parameter with index 1 to drop the instance_node.
       SetEffect(graph()->NewNode(GetSafeStoreOperator(offset, type), arg_buffer,
-                                 Int32Constant(offset), Param(i + 1), Effect(),
-                                 Control()));
+                                 Int32Constant(offset), Param(i + 1), effect(),
+                                 control()));
       offset += wasm::ValueTypes::ElementSizeInBytes(type);
     }
     DCHECK_EQ(args_size_bytes, offset);
@@ -6145,7 +6141,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         wasm::ValueType type = sig_->GetReturn(i);
         Node* val = SetEffect(
             graph()->NewNode(GetSafeLoadOperator(offset, type), arg_buffer,
-                             Int32Constant(offset), Effect(), Control()));
+                             Int32Constant(offset), effect(), control()));
         returns[i] = val;
         offset += wasm::ValueTypes::ElementSizeInBytes(type);
       }
@@ -6161,7 +6157,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     // Build the start and the parameter nodes.
     int param_count = 1 /* closure */ + 1 /* receiver */ + wasm_count +
                       1 /* new.target */ + 1 /* #arg */ + 1 /* context */;
-    SetEffect(SetControl(Start(param_count)));
+    SetEffectControl(Start(param_count));
     Node* closure = Param(Linkage::kJSCallClosureParamIndex);
     Node* context = Param(Linkage::GetJSCallContextParamIndex(wasm_count + 1));
 
@@ -6174,8 +6170,8 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     // Throw a TypeError if the signature is incompatible with JavaScript.
     if (!wasm::IsJSCompatibleSignature(sig_, enabled_features_)) {
       BuildCallToRuntimeWithContext(Runtime::kWasmThrowTypeError, context,
-                                    nullptr, 0, effect_, Control());
-      TerminateThrow(Effect(), Control());
+                                    nullptr, 0);
+      TerminateThrow(effect(), control());
       return;
     }
 
@@ -6193,8 +6189,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     // Call the underlying closure.
     base::SmallVector<Node*, 16> args(wasm_count + 7);
     int pos = 0;
-    args[pos++] =
-        BuildLoadBuiltinFromIsolateRoot(Builtins::kCall_ReceiverIsAny);
+    args[pos++] = GetBuiltinPointerTarget(Builtins::kCall_ReceiverIsAny);
     args[pos++] = callable;
     args[pos++] = mcgraph()->Int32Constant(wasm_count);   // argument count
     args[pos++] = BuildLoadUndefinedValueFromInstance();  // receiver
@@ -6202,7 +6197,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     auto call_descriptor = Linkage::GetStubCallDescriptor(
         graph()->zone(), CallTrampolineDescriptor{}, wasm_count + 1,
         CallDescriptor::kNoFlags, Operator::kNoProperties,
-        StubCallMode::kCallCodeObject);
+        StubCallMode::kCallBuiltinPointer);
 
     // Convert parameter JS values to wasm numbers and back to JS values.
     for (int i = 0; i < wasm_count; ++i) {
@@ -6212,8 +6207,8 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     }
 
     args[pos++] = context;
-    args[pos++] = Effect();
-    args[pos++] = Control();
+    args[pos++] = effect();
+    args[pos++] = control();
 
     DCHECK_EQ(pos, args.size());
     Node* call = SetEffect(graph()->NewNode(
@@ -6240,15 +6235,14 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         STORE_FIXED_ARRAY_SLOT_ANY(result_fixed_array, i, cast);
       }
       jsval = BuildCallToRuntimeWithContext(Runtime::kWasmNewMultiReturnJSArray,
-                                            context, &result_fixed_array, 1,
-                                            effect_, Control());
+                                            context, &result_fixed_array, 1);
     }
     Return(jsval);
   }
 
   void BuildCWasmEntry() {
     // +1 offset for first parameter index being -1.
-    SetEffect(SetControl(Start(CWasmEntryParameters::kNumParameters + 1)));
+    SetEffectControl(Start(CWasmEntryParameters::kNumParameters + 1));
 
     Node* code_entry = Param(CWasmEntryParameters::kCodeEntry);
     Node* object_ref = Param(CWasmEntryParameters::kObjectRef);
@@ -6271,13 +6265,13 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     for (wasm::ValueType type : sig_->parameters()) {
       Node* arg_load = SetEffect(
           graph()->NewNode(GetSafeLoadOperator(offset, type), arg_buffer,
-                           Int32Constant(offset), Effect(), Control()));
+                           Int32Constant(offset), effect(), control()));
       args[pos++] = arg_load;
       offset += wasm::ValueTypes::ElementSizeInBytes(type);
     }
 
-    args[pos++] = Effect();
-    args[pos++] = Control();
+    args[pos++] = effect();
+    args[pos++] = control();
 
     // Call the wasm code.
     auto call_descriptor = GetWasmCallDescriptor(mcgraph()->zone(), sig_);
@@ -6302,10 +6296,10 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       Node* value = sig_->return_count() == 1
                         ? call
                         : graph()->NewNode(mcgraph()->common()->Projection(pos),
-                                           call, Control());
+                                           call, control());
       SetEffect(graph()->NewNode(GetSafeStoreOperator(offset, type), arg_buffer,
-                                 Int32Constant(offset), value,
-                                 Effect(), Control()));
+                                 Int32Constant(offset), value, effect(),
+                                 control()));
       offset += wasm::ValueTypes::ElementSizeInBytes(type);
       pos++;
     }
@@ -6337,22 +6331,6 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
   wasm::WasmFeatures enabled_features_;
 };
 
-void AppendSignature(char* buffer, size_t max_name_len,
-                     wasm::FunctionSig* sig) {
-  size_t name_len = strlen(buffer);
-  auto append_name_char = [&](char c) {
-    if (name_len + 1 < max_name_len) buffer[name_len++] = c;
-  };
-  for (wasm::ValueType t : sig->parameters()) {
-    append_name_char(wasm::ValueTypes::ShortNameOf(t));
-  }
-  append_name_char(':');
-  for (wasm::ValueType t : sig->returns()) {
-    append_name_char(wasm::ValueTypes::ShortNameOf(t));
-  }
-  buffer[name_len] = '\0';
-}
-
 }  // namespace
 
 std::unique_ptr<OptimizedCompilationJob> NewJSToWasmCompilationJob(
@@ -6371,23 +6349,20 @@ std::unique_ptr<OptimizedCompilationJob> NewJSToWasmCompilationJob(
       InstructionSelector::AlignmentRequirements());
   MachineGraph mcgraph(graph, &common, &machine);
 
-  Node* control = nullptr;
-  Node* effect = nullptr;
-
   WasmWrapperGraphBuilder builder(zone.get(), &mcgraph, sig, nullptr,
-                                  StubCallMode::kCallCodeObject,
+                                  StubCallMode::kCallBuiltinPointer,
                                   enabled_features);
-  builder.set_control_ptr(&control);
-  builder.set_effect_ptr(&effect);
   builder.BuildJSToWasmWrapper(is_import);
 
   //----------------------------------------------------------------------------
   // Create the compilation job.
   //----------------------------------------------------------------------------
-  static constexpr size_t kMaxNameLen = 128;
-  auto debug_name = std::unique_ptr<char[]>(new char[kMaxNameLen]);
-  memcpy(debug_name.get(), "js_to_wasm:", 12);
-  AppendSignature(debug_name.get(), kMaxNameLen, sig);
+  constexpr size_t kMaxNameLen = 128;
+  constexpr size_t kNamePrefixLen = 11;
+  auto name_buffer = std::unique_ptr<char[]>(new char[kMaxNameLen]);
+  memcpy(name_buffer.get(), "js-to-wasm:", kNamePrefixLen);
+  PrintSignature(VectorOf(name_buffer.get(), kMaxNameLen) + kNamePrefixLen,
+                 sig);
 
   int params = static_cast<int>(sig->parameter_count());
   CallDescriptor* incoming = Linkage::GetJSCallDescriptor(
@@ -6395,7 +6370,8 @@ std::unique_ptr<OptimizedCompilationJob> NewJSToWasmCompilationJob(
 
   return Pipeline::NewWasmHeapStubCompilationJob(
       isolate, wasm_engine, incoming, std::move(zone), graph,
-      Code::JS_TO_WASM_FUNCTION, std::move(debug_name), WasmAssemblerOptions());
+      Code::JS_TO_WASM_FUNCTION, std::move(name_buffer),
+      WasmAssemblerOptions());
 }
 
 std::pair<WasmImportCallKind, Handle<JSReceiver>> ResolveWasmImportCall(
@@ -6438,8 +6414,7 @@ std::pair<WasmImportCallKind, Handle<JSReceiver>> ResolveWasmImportCall(
   if (!wasm::IsJSCompatibleSignature(expected_sig, enabled_features)) {
     return std::make_pair(WasmImportCallKind::kRuntimeTypeError, callable);
   }
-  // For JavaScript calls, determine whether the target has an arity match
-  // and whether it has a sloppy receiver.
+  // For JavaScript calls, determine whether the target has an arity match.
   if (callable->IsJSFunction()) {
     Handle<JSFunction> function = Handle<JSFunction>::cast(callable);
     SharedFunctionInfo shared = function->shared();
@@ -6498,18 +6473,13 @@ std::pair<WasmImportCallKind, Handle<JSReceiver>> ResolveWasmImportCall(
       // Class constructor will throw anyway.
       return std::make_pair(WasmImportCallKind::kUseCallBuiltin, callable);
     }
-    bool sloppy = is_sloppy(shared.language_mode()) && !shared.native();
     if (shared.internal_formal_parameter_count() ==
         expected_sig->parameter_count()) {
-      return std::make_pair(
-          sloppy ? WasmImportCallKind::kJSFunctionArityMatchSloppy
-                 : WasmImportCallKind::kJSFunctionArityMatch,
-          callable);
+      return std::make_pair(WasmImportCallKind::kJSFunctionArityMatch,
+                            callable);
     }
-    return std::make_pair(
-        sloppy ? WasmImportCallKind::kJSFunctionArityMismatchSloppy
-               : WasmImportCallKind::kJSFunctionArityMismatch,
-        callable);
+    return std::make_pair(WasmImportCallKind::kJSFunctionArityMismatch,
+                          callable);
   }
   // Unknown case. Use the call builtin.
   return std::make_pair(WasmImportCallKind::kUseCallBuiltin, callable);
@@ -6575,17 +6545,14 @@ wasm::WasmCompilationResult CompileWasmMathIntrinsic(
   wasm::CompilationEnv env(
       nullptr, wasm::UseTrapHandler::kNoTrapHandler,
       wasm::RuntimeExceptionSupport::kNoRuntimeExceptionSupport,
-      wasm::kAllWasmFeatures, wasm::LowerSimd::kNoLowerSimd);
+      wasm::WasmFeatures::All(), wasm::LowerSimd::kNoLowerSimd);
 
   WasmGraphBuilder builder(&env, mcgraph->zone(), mcgraph, sig,
                            source_positions);
 
   // Set up the graph start.
   Node* start = builder.Start(static_cast<int>(sig->parameter_count() + 1 + 1));
-  Node* effect = start;
-  Node* control = start;
-  builder.set_effect_ptr(&effect);
-  builder.set_control_ptr(&control);
+  builder.SetEffectControl(start);
   builder.set_instance_node(builder.Param(wasm::kWasmInstanceParameterIndex));
 
   // Generate either a unop or a binop.
@@ -6645,17 +6612,12 @@ wasm::WasmCompilationResult CompileWasmImportCallWrapper(
       InstructionSelector::AlignmentRequirements());
   MachineGraph mcgraph(&graph, &common, &machine);
 
-  Node* control = nullptr;
-  Node* effect = nullptr;
-
   SourcePositionTable* source_position_table =
       source_positions ? new (&zone) SourcePositionTable(&graph) : nullptr;
 
   WasmWrapperGraphBuilder builder(&zone, &mcgraph, sig, source_position_table,
                                   StubCallMode::kCallWasmRuntimeStub,
                                   env->enabled_features);
-  builder.set_control_ptr(&control);
-  builder.set_effect_ptr(&effect);
   builder.BuildWasmImportCallWrapper(kind);
 
   const char* func_name = "wasm-to-js";
@@ -6701,10 +6663,7 @@ wasm::WasmCode* CompileWasmCapiCallWrapper(wasm::WasmEngine* wasm_engine,
                     1 /* offset for first parameter index being -1 */ +
                     1 /* Wasm instance */ + 1 /* kExtraCallableParam */;
   Node* start = builder.Start(param_count);
-  Node* effect = start;
-  Node* control = start;
-  builder.set_effect_ptr(&effect);
-  builder.set_control_ptr(&control);
+  builder.SetEffectControl(start);
   builder.set_instance_node(builder.Param(wasm::kWasmInstanceParameterIndex));
   builder.BuildCapiCallWrapper(address);
 
@@ -6744,14 +6703,9 @@ wasm::WasmCompilationResult CompileWasmInterpreterEntry(
       InstructionSelector::AlignmentRequirements());
   MachineGraph mcgraph(&graph, &common, &machine);
 
-  Node* control = nullptr;
-  Node* effect = nullptr;
-
   WasmWrapperGraphBuilder builder(&zone, &mcgraph, sig, nullptr,
                                   StubCallMode::kCallWasmRuntimeStub,
                                   enabled_features);
-  builder.set_control_ptr(&control);
-  builder.set_effect_ptr(&effect);
   builder.BuildWasmInterpreterEntry(func_index);
 
   // Schedule and compile to machine code.
@@ -6786,34 +6740,32 @@ MaybeHandle<Code> CompileJSToJSWrapper(Isolate* isolate,
       InstructionSelector::AlignmentRequirements());
   MachineGraph mcgraph(graph, &common, &machine);
 
-  Node* control = nullptr;
-  Node* effect = nullptr;
-
   WasmWrapperGraphBuilder builder(zone.get(), &mcgraph, sig, nullptr,
-                                  StubCallMode::kCallCodeObject,
-                                  wasm::WasmFeaturesFromIsolate(isolate));
-  builder.set_control_ptr(&control);
-  builder.set_effect_ptr(&effect);
+                                  StubCallMode::kCallBuiltinPointer,
+                                  wasm::WasmFeatures::FromIsolate(isolate));
   builder.BuildJSToJSWrapper(isolate);
 
   int wasm_count = static_cast<int>(sig->parameter_count());
   CallDescriptor* incoming = Linkage::GetJSCallDescriptor(
       zone.get(), false, wasm_count + 1, CallDescriptor::kNoFlags);
 
-  // Build a name in the form "js-to-js-wrapper:<params>:<returns>".
-  static constexpr size_t kMaxNameLen = 128;
-  auto debug_name = std::unique_ptr<char[]>(new char[kMaxNameLen]);
-  memcpy(debug_name.get(), "js-to-js-wrapper:", 18);
-  AppendSignature(debug_name.get(), kMaxNameLen, sig);
+  // Build a name in the form "js-to-js:<params>:<returns>".
+  constexpr size_t kMaxNameLen = 128;
+  constexpr size_t kNamePrefixLen = 9;
+  auto name_buffer = std::unique_ptr<char[]>(new char[kMaxNameLen]);
+  memcpy(name_buffer.get(), "js-to-js:", kNamePrefixLen);
+  PrintSignature(VectorOf(name_buffer.get(), kMaxNameLen) + kNamePrefixLen,
+                 sig);
 
   // Run the compilation job synchronously.
   std::unique_ptr<OptimizedCompilationJob> job(
       Pipeline::NewWasmHeapStubCompilationJob(
           isolate, isolate->wasm_engine(), incoming, std::move(zone), graph,
-          Code::JS_TO_JS_FUNCTION, std::move(debug_name),
+          Code::JS_TO_JS_FUNCTION, std::move(name_buffer),
           AssemblerOptions::Default(isolate)));
 
-  if (job->ExecuteJob() == CompilationJob::FAILED ||
+  if (job->ExecuteJob(isolate->counters()->runtime_call_stats()) ==
+          CompilationJob::FAILED ||
       job->FinalizeJob(isolate) == CompilationJob::FAILED) {
     return {};
   }
@@ -6833,14 +6785,9 @@ MaybeHandle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig) {
       InstructionSelector::AlignmentRequirements());
   MachineGraph mcgraph(graph, &common, &machine);
 
-  Node* control = nullptr;
-  Node* effect = nullptr;
-
   WasmWrapperGraphBuilder builder(zone.get(), &mcgraph, sig, nullptr,
-                                  StubCallMode::kCallCodeObject,
-                                  wasm::WasmFeaturesFromIsolate(isolate));
-  builder.set_control_ptr(&control);
-  builder.set_effect_ptr(&effect);
+                                  StubCallMode::kCallBuiltinPointer,
+                                  wasm::WasmFeatures::FromIsolate(isolate));
   builder.BuildCWasmEntry();
 
   // Schedule and compile to machine code.
@@ -6850,26 +6797,29 @@ MaybeHandle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig) {
                              MachineType::Pointer(),    // argv
                              MachineType::Pointer()};   // c_entry_fp
   MachineSignature incoming_sig(1, 4, sig_types);
-  // Traps need the root register, for TailCallRuntimeWithCEntry to call
+  // Traps need the root register, for TailCallRuntime to call
   // Runtime::kThrowWasmError.
   CallDescriptor::Flags flags = CallDescriptor::kInitializeRootRegister;
   CallDescriptor* incoming =
       Linkage::GetSimplifiedCDescriptor(zone.get(), &incoming_sig, flags);
 
   // Build a name in the form "c-wasm-entry:<params>:<returns>".
-  static constexpr size_t kMaxNameLen = 128;
-  auto debug_name = std::unique_ptr<char[]>(new char[kMaxNameLen]);
-  memcpy(debug_name.get(), "c-wasm-entry:", 14);
-  AppendSignature(debug_name.get(), kMaxNameLen, sig);
+  constexpr size_t kMaxNameLen = 128;
+  constexpr size_t kNamePrefixLen = 13;
+  auto name_buffer = std::unique_ptr<char[]>(new char[kMaxNameLen]);
+  memcpy(name_buffer.get(), "c-wasm-entry:", kNamePrefixLen);
+  PrintSignature(VectorOf(name_buffer.get(), kMaxNameLen) + kNamePrefixLen,
+                 sig);
 
   // Run the compilation job synchronously.
   std::unique_ptr<OptimizedCompilationJob> job(
       Pipeline::NewWasmHeapStubCompilationJob(
           isolate, isolate->wasm_engine(), incoming, std::move(zone), graph,
-          Code::C_WASM_ENTRY, std::move(debug_name),
+          Code::C_WASM_ENTRY, std::move(name_buffer),
           AssemblerOptions::Default(isolate)));
 
-  if (job->ExecuteJob() == CompilationJob::FAILED ||
+  if (job->ExecuteJob(isolate->counters()->runtime_call_stats()) ==
+          CompilationJob::FAILED ||
       job->FinalizeJob(isolate) == CompilationJob::FAILED) {
     return {};
   }
@@ -6940,8 +6890,7 @@ wasm::WasmCompilationResult ExecuteTurbofanWasmCompilation(
     wasm::WasmFeatures* detected) {
   TRACE_EVENT2(TRACE_DISABLED_BY_DEFAULT("v8.wasm"),
                "ExecuteTurbofanCompilation", "func_index", func_index,
-               "body_size",
-               static_cast<uint32_t>(func_body.end - func_body.start));
+               "body_size", func_body.end - func_body.start);
   Zone zone(wasm_engine->allocator(), ZONE_NAME);
   MachineGraph* mcgraph = new (&zone) MachineGraph(
       new (&zone) Graph(&zone), new (&zone) CommonOperatorBuilder(&zone),
diff --git a/deps/v8/src/compiler/wasm-compiler.h b/deps/v8/src/compiler/wasm-compiler.h
index de0ca58c23a3db..7782ebfdecf53f 100644
--- a/deps/v8/src/compiler/wasm-compiler.h
+++ b/deps/v8/src/compiler/wasm-compiler.h
@@ -33,6 +33,7 @@ class NodeOriginTable;
 class Operator;
 class SourcePositionTable;
 class WasmDecorator;
+class WasmGraphAssembler;
 enum class TrapId : uint32_t;
 struct Int64LoweringSpecialCase;
 }  // namespace compiler
@@ -43,7 +44,8 @@ struct DecodeStruct;
 using TFNode = compiler::Node;
 using TFGraph = compiler::MachineGraph;
 class WasmCode;
-struct WasmFeatures;
+class WasmFeatures;
+enum class LoadTransformationKind : uint8_t;
 }  // namespace wasm
 
 namespace compiler {
@@ -65,9 +67,7 @@ enum class WasmImportCallKind : uint8_t {
   kWasmToCapi,                     // fast WASM->C-API call
   kWasmToWasm,                     // fast WASM->WASM call
   kJSFunctionArityMatch,           // fast WASM->JS call
-  kJSFunctionArityMatchSloppy,     // fast WASM->JS call, sloppy receiver
   kJSFunctionArityMismatch,        // WASM->JS, needs adapter frame
-  kJSFunctionArityMismatchSloppy,  // WASM->JS, needs adapter frame, sloppy
   // Math functions imported from JavaScript that are intrinsified
   kFirstMathIntrinsic,
   kF64Acos = kFirstMathIntrinsic,
@@ -98,11 +98,8 @@ enum class WasmImportCallKind : uint8_t {
   kUseCallBuiltin
 };
 
-// TODO(wasm): There should be only one import kind for sloppy and strict in
-// order to reduce wrapper cache misses. The mode can be checked at runtime
-// instead.
 constexpr WasmImportCallKind kDefaultImportCallKind =
-    WasmImportCallKind::kJSFunctionArityMatchSloppy;
+    WasmImportCallKind::kJSFunctionArityMatch;
 
 // Resolves which import call wrapper is required for the given JS callable.
 // Returns the kind of wrapper need and the ultimate target callable. Note that
@@ -179,6 +176,8 @@ class WasmGraphBuilder {
       wasm::CompilationEnv* env, Zone* zone, MachineGraph* mcgraph,
       wasm::FunctionSig* sig, compiler::SourcePositionTable* spt = nullptr);
 
+  V8_EXPORT_PRIVATE ~WasmGraphBuilder();
+
   //-----------------------------------------------------------------------
   // Operations independent of {control} or {effect}.
   //-----------------------------------------------------------------------
@@ -221,20 +220,10 @@ class WasmGraphBuilder {
   void AppendToMerge(Node* merge, Node* from);
   void AppendToPhi(Node* phi, Node* from);
 
-  void StackCheck(wasm::WasmCodePosition position, Node** effect = nullptr,
-                  Node** control = nullptr);
+  void StackCheck(wasm::WasmCodePosition);
 
   void PatchInStackCheckIfNeeded();
 
-  // TODO(v8:8977, v8:7703): move this somewhere? This should be where it
-  // can be used in many places (e.g graph assembler, wasm compiler).
-  // Adds a decompression node if pointer compression is enabled and the type
-  // loaded is a compressed one. To be used after loads.
-  Node* InsertDecompressionIfNeeded(MachineType type, Node* value);
-  // Adds a compression node if pointer compression is enabled and the
-  // representation to be stored is a compressed one. To be used before stores.
-  Node* InsertCompressionIfNeeded(MachineRepresentation rep, Node* value);
-
   //-----------------------------------------------------------------------
   // Operations that read and/or write {control} and {effect}.
   //-----------------------------------------------------------------------
@@ -294,6 +283,10 @@ class WasmGraphBuilder {
   Node* LoadMem(wasm::ValueType type, MachineType memtype, Node* index,
                 uint32_t offset, uint32_t alignment,
                 wasm::WasmCodePosition position);
+  Node* LoadTransform(MachineType memtype,
+                      wasm::LoadTransformationKind transform, Node* index,
+                      uint32_t offset, uint32_t alignment,
+                      wasm::WasmCodePosition position);
   Node* StoreMem(MachineRepresentation mem_rep, Node* index, uint32_t offset,
                  uint32_t alignment, Node* val, wasm::WasmCodePosition position,
                  wasm::ValueType type);
@@ -303,26 +296,15 @@ class WasmGraphBuilder {
     this->instance_node_ = instance_node;
   }
 
-  Node* Control() {
-    DCHECK_NOT_NULL(*control_);
-    return *control_;
-  }
-  Node* Effect() {
-    DCHECK_NOT_NULL(*effect_);
-    return *effect_;
-  }
-  Node* SetControl(Node* node) {
-    *control_ = node;
-    return node;
+  Node* effect();
+  Node* control();
+  Node* SetEffect(Node* node);
+  Node* SetControl(Node* node);
+  void SetEffectControl(Node* effect, Node* control);
+  Node* SetEffectControl(Node* effect_and_control) {
+    SetEffectControl(effect_and_control, effect_and_control);
+    return effect_and_control;
   }
-  Node* SetEffect(Node* node) {
-    *effect_ = node;
-    return node;
-  }
-
-  void set_control_ptr(Node** control) { this->control_ = control; }
-
-  void set_effect_ptr(Node** effect) { this->effect_ = effect; }
 
   Node* GetImportedMutableGlobals();
 
@@ -379,12 +361,6 @@ class WasmGraphBuilder {
                  wasm::WasmCodePosition position);
   Node* AtomicFence();
 
-  // Returns a pointer to the dropped_data_segments array. Traps if the data
-  // segment is active or has been dropped.
-  Node* CheckDataSegmentIsPassiveAndNotDropped(uint32_t data_segment_index,
-                                               wasm::WasmCodePosition position);
-  Node* CheckElemSegmentIsPassiveAndNotDropped(uint32_t elem_segment_index,
-                                               wasm::WasmCodePosition position);
   Node* MemoryInit(uint32_t data_segment_index, Node* dst, Node* src,
                    Node* size, wasm::WasmCodePosition position);
   Node* MemoryCopy(Node* dst, Node* src, Node* size,
@@ -404,8 +380,6 @@ class WasmGraphBuilder {
 
   bool has_simd() const { return has_simd_; }
 
-  const wasm::WasmModule* module() { return env_ ? env_->module : nullptr; }
-
   wasm::UseTrapHandler use_trap_handler() const {
     return env_ ? env_->use_trap_handler : wasm::kNoTrapHandler;
   }
@@ -419,33 +393,6 @@ class WasmGraphBuilder {
   void RemoveBytecodePositionDecorator();
 
  protected:
-  Zone* const zone_;
-  MachineGraph* const mcgraph_;
-  wasm::CompilationEnv* const env_;
-
-  Node** control_ = nullptr;
-  Node** effect_ = nullptr;
-  WasmInstanceCacheNodes* instance_cache_ = nullptr;
-
-  SetOncePointer<Node> instance_node_;
-  SetOncePointer<Node> globals_start_;
-  SetOncePointer<Node> imported_mutable_globals_;
-  SetOncePointer<Node> stack_check_code_node_;
-  SetOncePointer<Node> isolate_root_node_;
-  SetOncePointer<const Operator> stack_check_call_operator_;
-
-  bool has_simd_ = false;
-  bool needs_stack_check_ = false;
-  const bool untrusted_code_mitigations_ = true;
-
-  wasm::FunctionSig* const sig_;
-
-  compiler::WasmDecorator* decorator_ = nullptr;
-
-  compiler::SourcePositionTable* const source_position_table_ = nullptr;
-
-  std::unique_ptr<Int64LoweringSpecialCase> lowering_special_case_;
-
   Node* NoContextConstant();
 
   Node* BuildLoadIsolateRoot();
@@ -601,9 +548,34 @@ class WasmGraphBuilder {
                            int parameter_count);
 
   Node* BuildCallToRuntimeWithContext(Runtime::FunctionId f, Node* js_context,
-                                      Node** parameters, int parameter_count,
-                                      Node** effect, Node* control);
+                                      Node** parameters, int parameter_count);
   TrapId GetTrapIdForTrap(wasm::TrapReason reason);
+
+  std::unique_ptr<WasmGraphAssembler> gasm_;
+  Zone* const zone_;
+  MachineGraph* const mcgraph_;
+  wasm::CompilationEnv* const env_;
+
+  WasmInstanceCacheNodes* instance_cache_ = nullptr;
+
+  SetOncePointer<Node> instance_node_;
+  SetOncePointer<Node> globals_start_;
+  SetOncePointer<Node> imported_mutable_globals_;
+  SetOncePointer<Node> stack_check_code_node_;
+  SetOncePointer<Node> isolate_root_node_;
+  SetOncePointer<const Operator> stack_check_call_operator_;
+
+  bool has_simd_ = false;
+  bool needs_stack_check_ = false;
+  const bool untrusted_code_mitigations_ = true;
+
+  wasm::FunctionSig* const sig_;
+
+  compiler::WasmDecorator* decorator_ = nullptr;
+
+  compiler::SourcePositionTable* const source_position_table_ = nullptr;
+
+  std::unique_ptr<Int64LoweringSpecialCase> lowering_special_case_;
 };
 
 enum WasmCallKind { kWasmFunction, kWasmImportWrapper, kWasmCapiFunction };
diff --git a/deps/v8/src/d8/OWNERS b/deps/v8/src/d8/OWNERS
index 0f3e3d8e5cdee7..a548e5a5099929 100644
--- a/deps/v8/src/d8/OWNERS
+++ b/deps/v8/src/d8/OWNERS
@@ -2,4 +2,3 @@ binji@chromium.org
 bmeurer@chromium.org
 clemensb@chromium.org
 verwaest@chromium.org
-yangguo@chromium.org
diff --git a/deps/v8/src/d8/async-hooks-wrapper.cc b/deps/v8/src/d8/async-hooks-wrapper.cc
index a3fc9dba1f5d8a..cb00dd521a761b 100644
--- a/deps/v8/src/d8/async-hooks-wrapper.cc
+++ b/deps/v8/src/d8/async-hooks-wrapper.cc
@@ -285,10 +285,6 @@ void AsyncHooks::PromiseHookDispatch(PromiseHookType type,
       result = wrap->promiseResolve_function()->Call(context, rcv, 1, args);
     }
   }
-
-  if (try_catch.HasCaught()) {
-    Shell::ReportException(hooks->isolate_, &try_catch);
-  }
 }
 
 }  // namespace v8
diff --git a/deps/v8/src/d8/d8-console.cc b/deps/v8/src/d8/d8-console.cc
index 8175d608b48cd1..9c133b60f4a47d 100644
--- a/deps/v8/src/d8/d8-console.cc
+++ b/deps/v8/src/d8/d8-console.cc
@@ -19,7 +19,7 @@ void WriteToFile(const char* prefix, FILE* file, Isolate* isolate,
     Local<Value> arg = args[i];
     Local<String> str_obj;
 
-    if (arg->IsSymbol()) arg = Local<Symbol>::Cast(arg)->Name();
+    if (arg->IsSymbol()) arg = Local<Symbol>::Cast(arg)->Description();
     if (!arg->ToString(isolate->GetCurrentContext()).ToLocal(&str_obj)) return;
 
     v8::String::Utf8Value str(isolate, str_obj);
@@ -76,6 +76,7 @@ void D8Console::Debug(const debug::ConsoleCallArguments& args,
 
 void D8Console::Time(const debug::ConsoleCallArguments& args,
                      const v8::debug::ConsoleContext&) {
+  if (internal::FLAG_correctness_fuzzer_suppressions) return;
   if (args.Length() == 0) {
     default_timer_ = base::TimeTicks::HighResolutionNow();
   } else {
@@ -97,6 +98,7 @@ void D8Console::Time(const debug::ConsoleCallArguments& args,
 
 void D8Console::TimeEnd(const debug::ConsoleCallArguments& args,
                         const v8::debug::ConsoleContext&) {
+  if (internal::FLAG_correctness_fuzzer_suppressions) return;
   base::TimeDelta delta;
   if (args.Length() == 0) {
     delta = base::TimeTicks::HighResolutionNow() - default_timer_;
@@ -119,6 +121,7 @@ void D8Console::TimeEnd(const debug::ConsoleCallArguments& args,
 
 void D8Console::TimeStamp(const debug::ConsoleCallArguments& args,
                           const v8::debug::ConsoleContext&) {
+  if (internal::FLAG_correctness_fuzzer_suppressions) return;
   base::TimeDelta delta = base::TimeTicks::HighResolutionNow() - default_timer_;
   if (args.Length() == 0) {
     printf("console.timeStamp: default, %f\n", delta.InMillisecondsF());
@@ -135,6 +138,7 @@ void D8Console::TimeStamp(const debug::ConsoleCallArguments& args,
 
 void D8Console::Trace(const debug::ConsoleCallArguments& args,
                       const v8::debug::ConsoleContext&) {
+  if (internal::FLAG_correctness_fuzzer_suppressions) return;
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate_);
   i_isolate->PrintStack(stderr, i::Isolate::kPrintStackConcise);
 }
diff --git a/deps/v8/src/d8/d8-platforms.cc b/deps/v8/src/d8/d8-platforms.cc
index 8faf893c803ac6..48ea3c94814eaf 100644
--- a/deps/v8/src/d8/d8-platforms.cc
+++ b/deps/v8/src/d8/d8-platforms.cc
@@ -53,21 +53,6 @@ class PredictablePlatform : public Platform {
     // Never run delayed tasks.
   }
 
-  void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override {
-    // This is a deprecated function and should not be called anymore.
-    UNREACHABLE();
-  }
-
-  void CallDelayedOnForegroundThread(v8::Isolate* isolate, Task* task,
-                                     double delay_in_seconds) override {
-    // This is a deprecated function and should not be called anymore.
-    UNREACHABLE();
-  }
-
-  void CallIdleOnForegroundThread(Isolate* isolate, IdleTask* task) override {
-    UNREACHABLE();
-  }
-
   bool IdleTasksEnabled(Isolate* isolate) override { return false; }
 
   double MonotonicallyIncreasingTime() override {
@@ -162,22 +147,6 @@ class DelayedTasksPlatform : public Platform {
                                          delay_in_seconds);
   }
 
-  void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override {
-    // This is a deprecated function and should not be called anymore.
-    UNREACHABLE();
-  }
-
-  void CallDelayedOnForegroundThread(v8::Isolate* isolate, Task* task,
-                                     double delay_in_seconds) override {
-    // This is a deprecated function and should not be called anymore.
-    UNREACHABLE();
-  }
-
-  void CallIdleOnForegroundThread(Isolate* isolate, IdleTask* task) override {
-    // This is a deprecated function and should not be called anymore.
-    UNREACHABLE();
-  }
-
   bool IdleTasksEnabled(Isolate* isolate) override {
     return platform_->IdleTasksEnabled(isolate);
   }
@@ -206,6 +175,11 @@ class DelayedTasksPlatform : public Platform {
       task_runner_->PostTask(platform_->MakeDelayedTask(std::move(task)));
     }
 
+    void PostNonNestableTask(std::unique_ptr<Task> task) final {
+      task_runner_->PostNonNestableTask(
+          platform_->MakeDelayedTask(std::move(task)));
+    }
+
     void PostDelayedTask(std::unique_ptr<Task> task,
                          double delay_in_seconds) final {
       task_runner_->PostDelayedTask(platform_->MakeDelayedTask(std::move(task)),
@@ -219,6 +193,10 @@ class DelayedTasksPlatform : public Platform {
 
     bool IdleTasksEnabled() final { return task_runner_->IdleTasksEnabled(); }
 
+    bool NonNestableTasksEnabled() const final {
+      return task_runner_->NonNestableTasksEnabled();
+    }
+
    private:
     friend class DelayedTaskRunnerDeleter;
     std::shared_ptr<TaskRunner> task_runner_;
diff --git a/deps/v8/src/d8/d8.cc b/deps/v8/src/d8/d8.cc
index 33f2b70b1425c4..d6d21bf5fa19ce 100644
--- a/deps/v8/src/d8/d8.cc
+++ b/deps/v8/src/d8/d8.cc
@@ -21,6 +21,7 @@
 #include "include/libplatform/libplatform.h"
 #include "include/libplatform/v8-tracing.h"
 #include "include/v8-inspector.h"
+#include "include/v8-profiler.h"
 #include "src/api/api-inl.h"
 #include "src/base/cpu.h"
 #include "src/base/logging.h"
@@ -31,6 +32,7 @@
 #include "src/d8/d8-platforms.h"
 #include "src/d8/d8.h"
 #include "src/debug/debug-interface.h"
+#include "src/deoptimizer/deoptimizer.h"
 #include "src/diagnostics/basic-block-profiler.h"
 #include "src/execution/vm-state-inl.h"
 #include "src/init/v8.h"
@@ -42,8 +44,8 @@
 #include "src/parsing/parse-info.h"
 #include "src/parsing/parsing.h"
 #include "src/parsing/scanner-character-streams.h"
+#include "src/profiler/profile-generator.h"
 #include "src/sanitizer/msan.h"
-#include "src/snapshot/natives.h"
 #include "src/trap-handler/trap-handler.h"
 #include "src/utils/ostreams.h"
 #include "src/utils/utils.h"
@@ -57,6 +59,10 @@
 #include "unicode/locid.h"
 #endif  // V8_INTL_SUPPORT
 
+#ifdef V8_OS_LINUX
+#include <sys/mman.h>  // For MultiMappedAllocator.
+#endif
+
 #if !defined(_WIN32) && !defined(_WIN64)
 #include <unistd.h>  // NOLINT
 #else
@@ -129,19 +135,12 @@ class ShellArrayBufferAllocator : public ArrayBufferAllocatorBase {
 
  private:
   static constexpr size_t kVMThreshold = 65536;
-  static constexpr size_t kTwoGB = 2u * 1024u * 1024u * 1024u;
 
   void* AllocateVM(size_t length) {
     DCHECK_LE(kVMThreshold, length);
-    // TODO(titzer): allocations should fail if >= 2gb because array buffers
-    // store their lengths as a SMI internally.
-    if (length >= kTwoGB) return nullptr;
-
     v8::PageAllocator* page_allocator = i::GetPlatformPageAllocator();
     size_t page_size = page_allocator->AllocatePageSize();
     size_t allocated = RoundUp(length, page_size);
-    // Rounding up could go over the limit.
-    if (allocated >= kTwoGB) return nullptr;
     return i::AllocatePages(page_allocator, nullptr, allocated, page_size,
                             PageAllocator::kReadWrite);
   }
@@ -209,6 +208,101 @@ class MockArrayBufferAllocatiorWithLimit : public MockArrayBufferAllocator {
   std::atomic<size_t> space_left_;
 };
 
+#ifdef V8_OS_LINUX
+
+// This is a mock allocator variant that provides a huge virtual allocation
+// backed by a small real allocation that is repeatedly mapped. If you create an
+// array on memory allocated by this allocator, you will observe that elements
+// will alias each other as if their indices were modulo-divided by the real
+// allocation length.
+// The purpose is to allow stability-testing of huge (typed) arrays without
+// actually consuming huge amounts of physical memory.
+// This is currently only available on Linux because it relies on {mremap}.
+class MultiMappedAllocator : public ArrayBufferAllocatorBase {
+ protected:
+  void* Allocate(size_t length) override {
+    if (length < kChunkSize) {
+      return ArrayBufferAllocatorBase::Allocate(length);
+    }
+    // We use mmap, which initializes pages to zero anyway.
+    return AllocateUninitialized(length);
+  }
+
+  void* AllocateUninitialized(size_t length) override {
+    if (length < kChunkSize) {
+      return ArrayBufferAllocatorBase::AllocateUninitialized(length);
+    }
+    size_t rounded_length = RoundUp(length, kChunkSize);
+    int prot = PROT_READ | PROT_WRITE;
+    // We have to specify MAP_SHARED to make {mremap} below do what we want.
+    int flags = MAP_SHARED | MAP_ANONYMOUS;
+    void* real_alloc = mmap(nullptr, kChunkSize, prot, flags, -1, 0);
+    if (reinterpret_cast<intptr_t>(real_alloc) == -1) {
+      // If we ran into some limit (physical or virtual memory, or number
+      // of mappings, etc), return {nullptr}, which callers can handle.
+      if (errno == ENOMEM) {
+        return nullptr;
+      }
+      // Other errors may be bugs which we want to learn about.
+      FATAL("mmap (real) failed with error %d: %s", errno, strerror(errno));
+    }
+    void* virtual_alloc =
+        mmap(nullptr, rounded_length, prot, flags | MAP_NORESERVE, -1, 0);
+    if (reinterpret_cast<intptr_t>(virtual_alloc) == -1) {
+      if (errno == ENOMEM) {
+        // Undo earlier, successful mappings.
+        munmap(real_alloc, kChunkSize);
+        return nullptr;
+      }
+      FATAL("mmap (virtual) failed with error %d: %s", errno, strerror(errno));
+    }
+    i::Address virtual_base = reinterpret_cast<i::Address>(virtual_alloc);
+    i::Address virtual_end = virtual_base + rounded_length;
+    for (i::Address to_map = virtual_base; to_map < virtual_end;
+         to_map += kChunkSize) {
+      // Specifying 0 as the "old size" causes the existing map entry to not
+      // get deleted, which is important so that we can remap it again in the
+      // next iteration of this loop.
+      void* result =
+          mremap(real_alloc, 0, kChunkSize, MREMAP_MAYMOVE | MREMAP_FIXED,
+                 reinterpret_cast<void*>(to_map));
+      if (reinterpret_cast<intptr_t>(result) == -1) {
+        if (errno == ENOMEM) {
+          // Undo earlier, successful mappings.
+          munmap(real_alloc, kChunkSize);
+          munmap(virtual_alloc, (to_map - virtual_base));
+          return nullptr;
+        }
+        FATAL("mremap failed with error %d: %s", errno, strerror(errno));
+      }
+    }
+    base::MutexGuard lock_guard(&regions_mutex_);
+    regions_[virtual_alloc] = real_alloc;
+    return virtual_alloc;
+  }
+
+  void Free(void* data, size_t length) override {
+    if (length < kChunkSize) {
+      return ArrayBufferAllocatorBase::Free(data, length);
+    }
+    base::MutexGuard lock_guard(&regions_mutex_);
+    void* real_alloc = regions_[data];
+    munmap(real_alloc, kChunkSize);
+    size_t rounded_length = RoundUp(length, kChunkSize);
+    munmap(data, rounded_length);
+    regions_.erase(data);
+  }
+
+ private:
+  // Aiming for a "Huge Page" (2M on Linux x64) to go easy on the TLB.
+  static constexpr size_t kChunkSize = 2 * 1024 * 1024;
+
+  std::unordered_map<void*, void*> regions_;
+  base::Mutex regions_mutex_;
+};
+
+#endif  // V8_OS_LINUX
+
 v8::Platform* g_default_platform;
 std::unique_ptr<v8::Platform> g_platform;
 
@@ -455,10 +549,10 @@ bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
     parse_info.set_allow_lazy_parsing();
     parse_info.set_language_mode(
         i::construct_language_mode(i::FLAG_use_strict));
-    parse_info.set_script(
-        parse_info.CreateScript(i_isolate, str, options.compile_options));
 
-    if (!i::parsing::ParseProgram(&parse_info, i_isolate)) {
+    i::Handle<i::Script> script =
+        parse_info.CreateScript(i_isolate, str, options.compile_options);
+    if (!i::parsing::ParseProgram(&parse_info, script, i_isolate)) {
       fprintf(stderr, "Failed parsing\n");
       return false;
     }
@@ -467,7 +561,7 @@ bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
 
   HandleScope handle_scope(isolate);
   TryCatch try_catch(isolate);
-  try_catch.SetVerbose(true);
+  try_catch.SetVerbose(report_exceptions == kReportExceptions);
 
   MaybeLocal<Value> maybe_result;
   bool success = true;
@@ -518,8 +612,6 @@ bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
 
     Local<Script> script;
     if (!maybe_script.ToLocal(&script)) {
-      // Print errors that happened during compilation.
-      if (report_exceptions) ReportException(isolate, &try_catch);
       return false;
     }
 
@@ -546,11 +638,10 @@ bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
   Local<Value> result;
   if (!maybe_result.ToLocal(&result)) {
     DCHECK(try_catch.HasCaught());
-    // Print errors that happened during execution.
-    if (report_exceptions) ReportException(isolate, &try_catch);
     return false;
   }
-  DCHECK(!try_catch.HasCaught());
+  // It's possible that a FinalizationGroup cleanup task threw an error.
+  if (try_catch.HasCaught()) success = false;
   if (print_result) {
     if (options.test_shell) {
       if (!result->IsUndefined()) {
@@ -942,8 +1033,11 @@ bool Shell::ExecuteModule(Isolate* isolate, const char* file_name) {
 
   std::string absolute_path = NormalizePath(file_name, GetWorkingDirectory());
 
+  // Use a non-verbose TryCatch and report exceptions manually using
+  // Shell::ReportException, because some errors (such as file errors) are
+  // thrown without entering JS and thus do not trigger
+  // isolate->ReportPendingMessages().
   TryCatch try_catch(isolate);
-  try_catch.SetVerbose(true);
 
   Local<Module> root_module;
 
@@ -963,7 +1057,6 @@ bool Shell::ExecuteModule(Isolate* isolate, const char* file_name) {
   Local<Value> result;
   if (!maybe_result.ToLocal(&result)) {
     DCHECK(try_catch.HasCaught());
-    // Print errors that happened during execution.
     ReportException(isolate, &try_catch);
     return false;
   }
@@ -1113,9 +1206,13 @@ void Shell::PerformanceMeasureMemory(
       mode = v8::MeasureMemoryMode::kDetailed;
     }
   }
-  v8::MaybeLocal<v8::Promise> result =
-      args.GetIsolate()->MeasureMemory(context, mode);
-  args.GetReturnValue().Set(result.FromMaybe(v8::Local<v8::Promise>()));
+  Local<v8::Promise::Resolver> promise_resolver =
+      v8::Promise::Resolver::New(context).ToLocalChecked();
+  args.GetIsolate()->MeasureMemory(
+      v8::MeasureMemoryDelegate::Default(isolate, context, promise_resolver,
+                                         mode),
+      v8::MeasureMemoryExecution::kEager);
+  args.GetReturnValue().Set(promise_resolver->GetPromise());
 }
 
 // Realm.current() returns the index of the currently active realm.
@@ -1367,7 +1464,7 @@ void WriteToFile(FILE* file, const v8::FunctionCallbackInfo<v8::Value>& args) {
     Local<String> str_obj;
 
     if (arg->IsSymbol()) {
-      arg = Local<Symbol>::Cast(arg)->Name();
+      arg = Local<Symbol>::Cast(arg)->Description();
     }
     if (!arg->ToString(args.GetIsolate()->GetCurrentContext())
              .ToLocal(&str_obj)) {
@@ -1659,7 +1756,8 @@ void Shell::Version(const v8::FunctionCallbackInfo<v8::Value>& args) {
                                 .ToLocalChecked());
 }
 
-void Shell::ReportException(Isolate* isolate, v8::TryCatch* try_catch) {
+void Shell::ReportException(Isolate* isolate, Local<v8::Message> message,
+                            Local<v8::Value> exception_obj) {
   HandleScope handle_scope(isolate);
   Local<Context> context = isolate->GetCurrentContext();
   bool enter_context = context.IsEmpty();
@@ -1672,18 +1770,17 @@ void Shell::ReportException(Isolate* isolate, v8::TryCatch* try_catch) {
     return *value ? *value : "<string conversion failed>";
   };
 
-  v8::String::Utf8Value exception(isolate, try_catch->Exception());
+  v8::String::Utf8Value exception(isolate, exception_obj);
   const char* exception_string = ToCString(exception);
-  Local<Message> message = try_catch->Message();
   if (message.IsEmpty()) {
     // V8 didn't provide any extra information about this error; just
     // print the exception.
     printf("%s\n", exception_string);
   } else if (message->GetScriptOrigin().Options().IsWasm()) {
     // Print wasm-function[(function index)]:(offset): (message).
-    int function_index = message->GetLineNumber(context).FromJust() - 1;
+    int function_index = message->GetWasmFunctionIndex();
     int offset = message->GetStartColumn(context).FromJust();
-    printf("wasm-function[%d]:%d: %s\n", function_index, offset,
+    printf("wasm-function[%d]:0x%x: %s\n", function_index, offset,
            exception_string);
   } else {
     // Print (filename):(line number): (message).
@@ -1711,7 +1808,8 @@ void Shell::ReportException(Isolate* isolate, v8::TryCatch* try_catch) {
     }
   }
   Local<Value> stack_trace_string;
-  if (try_catch->StackTrace(context).ToLocal(&stack_trace_string) &&
+  if (v8::TryCatch::StackTrace(context, exception_obj)
+          .ToLocal(&stack_trace_string) &&
       stack_trace_string->IsString()) {
     v8::String::Utf8Value stack_trace(isolate,
                                       Local<String>::Cast(stack_trace_string));
@@ -1721,6 +1819,10 @@ void Shell::ReportException(Isolate* isolate, v8::TryCatch* try_catch) {
   if (enter_context) context->Exit();
 }
 
+void Shell::ReportException(v8::Isolate* isolate, v8::TryCatch* try_catch) {
+  ReportException(isolate, try_catch->Message(), try_catch->Exception());
+}
+
 int32_t* Counter::Bind(const char* name, bool is_histogram) {
   int i;
   for (i = 0; i < kMaxNameSize - 1 && name[i]; i++)
@@ -2022,12 +2124,7 @@ Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
   return global_template;
 }
 
-static void PrintNonErrorsMessageCallback(Local<Message> message,
-                                          Local<Value> error) {
-  // Nothing to do here for errors, exceptions thrown up to the shell will be
-  // reported
-  // separately by {Shell::ReportException} after they are caught.
-  // Do print other kinds of messages.
+static void PrintMessageCallback(Local<Message> message, Local<Value> error) {
   switch (message->ErrorLevel()) {
     case v8::Isolate::kMessageWarning:
     case v8::Isolate::kMessageLog:
@@ -2037,7 +2134,7 @@ static void PrintNonErrorsMessageCallback(Local<Message> message,
     }
 
     case v8::Isolate::kMessageError: {
-      // Ignore errors, printed elsewhere.
+      Shell::ReportException(message->GetIsolate(), message, error);
       return;
     }
 
@@ -2068,7 +2165,7 @@ void Shell::Initialize(Isolate* isolate) {
   }
   // Disable default message reporting.
   isolate->AddMessageListenerWithErrorLevel(
-      PrintNonErrorsMessageCallback,
+      PrintMessageCallback,
       v8::Isolate::kMessageError | v8::Isolate::kMessageWarning |
           v8::Isolate::kMessageInfo | v8::Isolate::kMessageDebug |
           v8::Isolate::kMessageLog);
@@ -2082,7 +2179,7 @@ Local<Context> Shell::CreateEvaluationContext(Isolate* isolate) {
   EscapableHandleScope handle_scope(isolate);
   Local<Context> context = Context::New(isolate, nullptr, global_template);
   DCHECK(!context.IsEmpty());
-  if (i::FLAG_perf_prof_annotate_wasm) {
+  if (i::FLAG_perf_prof_annotate_wasm || i::FLAG_vtune_prof_annotate_wasm) {
     isolate->SetWasmLoadSourceMapCallback(ReadFile);
   }
   InitializeModuleEmbedderData(context);
@@ -2318,23 +2415,6 @@ static char* ReadChars(const char* name, int* size_out) {
   return chars;
 }
 
-struct DataAndPersistent {
-  uint8_t* data;
-  int byte_length;
-  Global<ArrayBuffer> handle;
-};
-
-static void ReadBufferWeakCallback(
-    const v8::WeakCallbackInfo<DataAndPersistent>& data) {
-  int byte_length = data.GetParameter()->byte_length;
-  data.GetIsolate()->AdjustAmountOfExternalAllocatedMemory(
-      -static_cast<intptr_t>(byte_length));
-
-  delete[] data.GetParameter()->data;
-  data.GetParameter()->handle.Reset();
-  delete data.GetParameter();
-}
-
 void Shell::ReadBuffer(const v8::FunctionCallbackInfo<v8::Value>& args) {
   static_assert(sizeof(char) == sizeof(uint8_t),
                 "char and uint8_t should both have 1 byte");
@@ -2346,19 +2426,20 @@ void Shell::ReadBuffer(const v8::FunctionCallbackInfo<v8::Value>& args) {
     return;
   }
 
-  DataAndPersistent* data = new DataAndPersistent;
-  data->data = reinterpret_cast<uint8_t*>(ReadChars(*filename, &length));
-  if (data->data == nullptr) {
-    delete data;
+  uint8_t* data = reinterpret_cast<uint8_t*>(ReadChars(*filename, &length));
+  if (data == nullptr) {
     Throw(isolate, "Error reading file");
     return;
   }
-  data->byte_length = length;
-  Local<v8::ArrayBuffer> buffer = ArrayBuffer::New(isolate, data->data, length);
-  data->handle.Reset(isolate, buffer);
-  data->handle.SetWeak(data, ReadBufferWeakCallback,
-                       v8::WeakCallbackType::kParameter);
-  isolate->AdjustAmountOfExternalAllocatedMemory(length);
+  std::unique_ptr<v8::BackingStore> backing_store =
+      ArrayBuffer::NewBackingStore(
+          data, length,
+          [](void* data, size_t length, void*) {
+            delete[] reinterpret_cast<uint8_t*>(data);
+          },
+          nullptr);
+  Local<v8::ArrayBuffer> buffer =
+      ArrayBuffer::New(isolate, std::move(backing_store));
 
   args.GetReturnValue().Set(buffer);
 }
@@ -2515,13 +2596,13 @@ class InspectorClient : public v8_inspector::V8InspectorClient {
     if (!callback->IsFunction()) return;
 
     v8::TryCatch try_catch(isolate_);
+    try_catch.SetVerbose(true);
     is_paused = true;
 
     while (is_paused) {
       USE(Local<Function>::Cast(callback)->Call(context, Undefined(isolate_), 0,
                                                 {}));
       if (try_catch.HasCaught()) {
-        Shell::ReportException(isolate_, &try_catch);
         is_paused = false;
       }
     }
@@ -2872,6 +2953,7 @@ void Worker::ExecuteInThread() {
                 break;
               }
               v8::TryCatch try_catch(isolate);
+              try_catch.SetVerbose(true);
               HandleScope scope(isolate);
               Local<Value> value;
               if (Shell::DeserializeValue(isolate, std::move(data))
@@ -2881,9 +2963,6 @@ void Worker::ExecuteInThread() {
                     onmessage_fun->Call(context, global, 1, argv);
                 USE(result);
               }
-              if (try_catch.HasCaught()) {
-                Shell::ReportException(isolate, &try_catch);
-              }
             }
           }
         }
@@ -2941,9 +3020,6 @@ bool Shell::SetOptions(int argc, char* argv[]) {
                strcmp(argv[i], "--no-stress-opt") == 0) {
       options.stress_opt = false;
       argv[i] = nullptr;
-    } else if (strcmp(argv[i], "--stress-deopt") == 0) {
-      options.stress_deopt = true;
-      argv[i] = nullptr;
     } else if (strcmp(argv[i], "--stress-background-compile") == 0) {
       options.stress_background_compile = true;
       argv[i] = nullptr;
@@ -2955,7 +3031,6 @@ bool Shell::SetOptions(int argc, char* argv[]) {
                strcmp(argv[i], "--no-always-opt") == 0) {
       // No support for stressing if we can't use --always-opt.
       options.stress_opt = false;
-      options.stress_deopt = false;
     } else if (strcmp(argv[i], "--logfile-per-isolate") == 0) {
       logfile_per_isolate = true;
       argv[i] = nullptr;
@@ -3065,6 +3140,13 @@ bool Shell::SetOptions(int argc, char* argv[]) {
       // Delay execution of tasks by 0-100ms randomly (based on --random-seed).
       options.stress_delay_tasks = true;
       argv[i] = nullptr;
+    } else if (strcmp(argv[i], "--cpu-profiler") == 0) {
+      options.cpu_profiler = true;
+      argv[i] = nullptr;
+    } else if (strcmp(argv[i], "--cpu-profiler-print") == 0) {
+      options.cpu_profiler = true;
+      options.cpu_profiler_print = true;
+      argv[i] = nullptr;
     }
   }
 
@@ -3072,6 +3154,9 @@ bool Shell::SetOptions(int argc, char* argv[]) {
   options.mock_arraybuffer_allocator = i::FLAG_mock_arraybuffer_allocator;
   options.mock_arraybuffer_allocator_limit =
       i::FLAG_mock_arraybuffer_allocator_limit;
+#if V8_OS_LINUX
+  options.multi_mapped_mock_allocator = i::FLAG_multi_mapped_mock_allocator;
+#endif
 
   // Set up isolated source groups.
   options.isolate_sources = new SourceGroup[options.num_isolates];
@@ -3181,7 +3266,6 @@ bool RunSetTimeoutCallback(Isolate* isolate, bool* did_run) {
   try_catch.SetVerbose(true);
   Context::Scope context_scope(context);
   if (callback->Call(context, Undefined(isolate), 0, nullptr).IsEmpty()) {
-    Shell::ReportException(isolate, &try_catch);
     return false;
   }
   *did_run = true;
@@ -3198,7 +3282,6 @@ bool RunCleanupFinalizationGroupCallback(Isolate* isolate, bool* did_run) {
     TryCatch try_catch(isolate);
     try_catch.SetVerbose(true);
     if (FinalizationGroup::Cleanup(fg).IsNothing()) {
-      Shell::ReportException(isolate, &try_catch);
       return false;
     }
   }
@@ -3395,9 +3478,6 @@ class Serializer : public ValueSerializer::Delegate {
       }
 
       auto backing_store = array_buffer->GetBackingStore();
-      if (!array_buffer->IsExternal()) {
-        array_buffer->Externalize(backing_store);
-      }
       data_->backing_stores_.push_back(std::move(backing_store));
       array_buffer->Detach();
     }
@@ -3468,6 +3548,52 @@ class Deserializer : public ValueDeserializer::Delegate {
   DISALLOW_COPY_AND_ASSIGN(Deserializer);
 };
 
+class D8Testing {
+ public:
+  /**
+   * Get the number of runs of a given test that is required to get the full
+   * stress coverage.
+   */
+  static int GetStressRuns() {
+    if (internal::FLAG_stress_runs != 0) return internal::FLAG_stress_runs;
+#ifdef DEBUG
+    // In debug mode the code runs much slower so stressing will only make two
+    // runs.
+    return 2;
+#else
+    return 5;
+#endif
+  }
+
+  /**
+   * Indicate the number of the run which is about to start. The value of run
+   * should be between 0 and one less than the result from GetStressRuns()
+   */
+  static void PrepareStressRun(int run) {
+    static const char* kLazyOptimizations =
+        "--prepare-always-opt "
+        "--max-inlined-bytecode-size=999999 "
+        "--max-inlined-bytecode-size-cumulative=999999 "
+        "--noalways-opt";
+    static const char* kForcedOptimizations = "--always-opt";
+
+    if (run == GetStressRuns() - 1) {
+      V8::SetFlagsFromString(kForcedOptimizations);
+    } else {
+      V8::SetFlagsFromString(kLazyOptimizations);
+    }
+  }
+
+  /**
+   * Force deoptimization of all functions.
+   */
+  static void DeoptimizeAll(Isolate* isolate) {
+    i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+    i::HandleScope scope(i_isolate);
+    i::Deoptimizer::DeoptimizeAll(i_isolate);
+  }
+};
+
 std::unique_ptr<SerializationData> Shell::SerializeValue(
     Isolate* isolate, Local<Value> value, Local<Value> transfer) {
   bool ok;
@@ -3602,12 +3728,19 @@ int Shell::Main(int argc, char* argv[]) {
       memory_limit >= options.mock_arraybuffer_allocator_limit
           ? memory_limit
           : std::numeric_limits<size_t>::max());
+#if V8_OS_LINUX
+  MultiMappedAllocator multi_mapped_mock_allocator;
+#endif  // V8_OS_LINUX
   if (options.mock_arraybuffer_allocator) {
     if (memory_limit) {
       Shell::array_buffer_allocator = &mock_arraybuffer_allocator_with_limit;
     } else {
       Shell::array_buffer_allocator = &mock_arraybuffer_allocator;
     }
+#if V8_OS_LINUX
+  } else if (options.multi_mapped_mock_allocator) {
+    Shell::array_buffer_allocator = &multi_mapped_mock_allocator;
+#endif  // V8_OS_LINUX
   } else {
     Shell::array_buffer_allocator = &shell_array_buffer_allocator;
   }
@@ -3664,19 +3797,24 @@ int Shell::Main(int argc, char* argv[]) {
       tracing_controller->StartTracing(trace_config);
     }
 
-    if (options.stress_opt || options.stress_deopt) {
-      Testing::SetStressRunType(options.stress_opt ? Testing::kStressTypeOpt
-                                                   : Testing::kStressTypeDeopt);
-      options.stress_runs = Testing::GetStressRuns();
+    CpuProfiler* cpu_profiler;
+    if (options.cpu_profiler) {
+      cpu_profiler = CpuProfiler::New(isolate);
+      CpuProfilingOptions profile_options;
+      cpu_profiler->StartProfiling(String::Empty(isolate), profile_options);
+    }
+
+    if (options.stress_opt) {
+      options.stress_runs = D8Testing::GetStressRuns();
       for (int i = 0; i < options.stress_runs && result == 0; i++) {
         printf("============ Stress %d/%d ============\n", i + 1,
                options.stress_runs);
-        Testing::PrepareStressRun(i);
+        D8Testing::PrepareStressRun(i);
         bool last_run = i == options.stress_runs - 1;
         result = RunMain(isolate, argc, argv, last_run);
       }
       printf("======== Full Deoptimization =======\n");
-      Testing::DeoptimizeAll(isolate);
+      D8Testing::DeoptimizeAll(isolate);
     } else if (i::FLAG_stress_runs > 0) {
       options.stress_runs = i::FLAG_stress_runs;
       for (int i = 0; i < options.stress_runs && result == 0; i++) {
@@ -3738,6 +3876,18 @@ int Shell::Main(int argc, char* argv[]) {
       WriteIgnitionDispatchCountersFile(isolate);
     }
 
+    if (options.cpu_profiler) {
+      CpuProfile* profile = cpu_profiler->StopProfiling(String::Empty(isolate));
+      if (options.cpu_profiler_print) {
+        const internal::ProfileNode* root =
+            reinterpret_cast<const internal::ProfileNode*>(
+                profile->GetTopDownRoot());
+        root->Print(0);
+      }
+      profile->Delete();
+      cpu_profiler->Dispose();
+    }
+
     // Shut down contexts and collect garbage.
     cached_code_map_.clear();
     evaluation_context_.Reset();
diff --git a/deps/v8/src/d8/d8.h b/deps/v8/src/d8/d8.h
index 458bad858ab17a..435eb6dbd8a966 100644
--- a/deps/v8/src/d8/d8.h
+++ b/deps/v8/src/d8/d8.h
@@ -268,13 +268,13 @@ class ShellOptions {
   bool omit_quit = false;
   bool wait_for_wasm = true;
   bool stress_opt = false;
-  bool stress_deopt = false;
   int stress_runs = 1;
   bool interactive_shell = false;
   bool test_shell = false;
   bool expected_to_throw = false;
   bool mock_arraybuffer_allocator = false;
   size_t mock_arraybuffer_allocator_limit = 0;
+  bool multi_mapped_mock_allocator = false;
   bool enable_inspector = false;
   int num_isolates = 1;
   v8::ScriptCompiler::CompileOptions compile_options =
@@ -297,6 +297,8 @@ class ShellOptions {
   bool stress_delay_tasks = false;
   std::vector<const char*> arguments;
   bool include_arguments = true;
+  bool cpu_profiler = false;
+  bool cpu_profiler_print = false;
 };
 
 class Shell : public i::AllStatic {
@@ -316,6 +318,8 @@ class Shell : public i::AllStatic {
                             ReportExceptions report_exceptions,
                             ProcessMessageQueue process_message_queue);
   static bool ExecuteModule(Isolate* isolate, const char* file_name);
+  static void ReportException(Isolate* isolate, Local<Message> message,
+                              Local<Value> exception);
   static void ReportException(Isolate* isolate, TryCatch* try_catch);
   static Local<String> ReadFile(Isolate* isolate, const char* name);
   static Local<Context> CreateEvaluationContext(Isolate* isolate);
diff --git a/deps/v8/src/date/date.cc b/deps/v8/src/date/date.cc
index 928e3279dbd43a..825c5040d3ad3f 100644
--- a/deps/v8/src/date/date.cc
+++ b/deps/v8/src/date/date.cc
@@ -128,8 +128,8 @@ void DateCache::YearMonthDayFromDays(int days, int* year, int* month,
   days += is_leap;
 
   // Check if the date is after February.
-  if (days >= 31 + 28 + BoolToInt(is_leap)) {
-    days -= 31 + 28 + BoolToInt(is_leap);
+  if (days >= 31 + 28 + (is_leap ? 1 : 0)) {
+    days -= 31 + 28 + (is_leap ? 1 : 0);
     // Find the date starting from March.
     for (int i = 2; i < 12; i++) {
       if (days < kDaysInMonths[i]) {
diff --git a/deps/v8/src/date/dateparser.h b/deps/v8/src/date/dateparser.h
index a32db8f9c8cea2..c74a663e1e7efd 100644
--- a/deps/v8/src/date/dateparser.h
+++ b/deps/v8/src/date/dateparser.h
@@ -7,6 +7,7 @@
 
 #include "src/strings/char-predicates.h"
 #include "src/utils/allocation.h"
+#include "src/utils/vector.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/src/debug/OWNERS b/deps/v8/src/debug/OWNERS
index 220aa1ce26b153..6c13c38e480549 100644
--- a/deps/v8/src/debug/OWNERS
+++ b/deps/v8/src/debug/OWNERS
@@ -1,6 +1,7 @@
 bmeurer@chromium.org
 jgruber@chromium.org
 mvstanton@chromium.org
+szuend@chromium.org
 verwaest@chromium.org
 yangguo@chromium.org
 
diff --git a/deps/v8/src/debug/arm/debug-arm.cc b/deps/v8/src/debug/arm/debug-arm.cc
index 542ff5c4dff393..23460d67675957 100644
--- a/deps/v8/src/debug/arm/debug-arm.cc
+++ b/deps/v8/src/debug/arm/debug-arm.cc
@@ -36,7 +36,7 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   // - Leave the frame.
   // - Restart the frame by calling the function.
   __ mov(fp, r1);
-  __ ldr(r1, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+  __ ldr(r1, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
   __ LeaveFrame(StackFrame::INTERNAL);
 
   __ ldr(r0, FieldMemOperand(r1, JSFunction::kSharedFunctionInfoOffset));
@@ -44,9 +44,7 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
           FieldMemOperand(r0, SharedFunctionInfo::kFormalParameterCountOffset));
   __ mov(r2, r0);
 
-  ParameterCount dummy1(r2);
-  ParameterCount dummy2(r0);
-  __ InvokeFunction(r1, dummy1, dummy2, JUMP_FUNCTION);
+  __ InvokeFunction(r1, r2, r0, JUMP_FUNCTION);
 }
 
 
diff --git a/deps/v8/src/debug/arm64/debug-arm64.cc b/deps/v8/src/debug/arm64/debug-arm64.cc
index de72ce68e840ab..96cd8a7b743418 100644
--- a/deps/v8/src/debug/arm64/debug-arm64.cc
+++ b/deps/v8/src/debug/arm64/debug-arm64.cc
@@ -35,7 +35,7 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   // - Leave the frame.
   // - Restart the frame by calling the function.
   __ Mov(fp, x1);
-  __ Ldr(x1, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+  __ Ldr(x1, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
 
   __ Mov(sp, fp);
   __ Pop(fp, lr);  // Frame, Return address.
@@ -44,11 +44,9 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
       x0, FieldMemOperand(x1, JSFunction::kSharedFunctionInfoOffset));
   __ Ldrh(x0,
           FieldMemOperand(x0, SharedFunctionInfo::kFormalParameterCountOffset));
-  __ mov(x2, x0);
+  __ mov(x3, x0);
 
-  ParameterCount dummy1(x2);
-  ParameterCount dummy2(x0);
-  __ InvokeFunction(x1, dummy1, dummy2, JUMP_FUNCTION);
+  __ InvokeFunctionWithNewTarget(x1, x3, x0, JUMP_FUNCTION);
 }
 
 
diff --git a/deps/v8/src/debug/debug-evaluate.cc b/deps/v8/src/debug/debug-evaluate.cc
index 3568860e7d253a..5a8b68305b4d88 100644
--- a/deps/v8/src/debug/debug-evaluate.cc
+++ b/deps/v8/src/debug/debug-evaluate.cc
@@ -23,7 +23,8 @@ namespace internal {
 
 MaybeHandle<Object> DebugEvaluate::Global(Isolate* isolate,
                                           Handle<String> source,
-                                          debug::EvaluateGlobalMode mode) {
+                                          debug::EvaluateGlobalMode mode,
+                                          REPLMode repl_mode) {
   // Disable breaks in side-effect free mode.
   DisableBreak disable_break_scope(
       isolate->debug(),
@@ -32,13 +33,14 @@ MaybeHandle<Object> DebugEvaluate::Global(Isolate* isolate,
               debug::EvaluateGlobalMode::kDisableBreaksAndThrowOnSideEffect);
 
   Handle<Context> context = isolate->native_context();
+  Compiler::ScriptDetails script_details(isolate->factory()->empty_string());
+  script_details.repl_mode = repl_mode;
   ScriptOriginOptions origin_options(false, true);
   MaybeHandle<SharedFunctionInfo> maybe_function_info =
       Compiler::GetSharedFunctionInfoForScript(
-          isolate, source,
-          Compiler::ScriptDetails(isolate->factory()->empty_string()),
-          origin_options, nullptr, nullptr, ScriptCompiler::kNoCompileOptions,
-          ScriptCompiler::kNoCacheNoReason, NOT_NATIVES_CODE);
+          isolate, source, script_details, origin_options, nullptr, nullptr,
+          ScriptCompiler::kNoCompileOptions, ScriptCompiler::kNoCacheNoReason,
+          NOT_NATIVES_CODE);
 
   Handle<SharedFunctionInfo> shared_info;
   if (!maybe_function_info.ToHandle(&shared_info)) return MaybeHandle<Object>();
@@ -169,7 +171,7 @@ DebugEvaluate::ContextBuilder::ContextBuilder(Isolate* isolate,
     : isolate_(isolate),
       frame_inspector_(frame, inlined_jsframe_index, isolate),
       scope_iterator_(isolate, &frame_inspector_,
-                      ScopeIterator::COLLECT_NON_LOCALS) {
+                      ScopeIterator::ReparseStrategy::kScript) {
   Handle<Context> outer_context(frame_inspector_.GetFunction()->context(),
                                 isolate);
   evaluation_context_ = outer_context;
@@ -346,6 +348,9 @@ bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
   V(NewObject)                                \
   V(StringMaxLength)                          \
   V(StringToArray)                            \
+  V(AsyncFunctionEnter)                       \
+  V(AsyncFunctionReject)                      \
+  V(AsyncFunctionResolve)                     \
   /* Test */                                  \
   V(GetOptimizationStatus)                    \
   V(OptimizeFunctionOnNextCall)               \
@@ -355,7 +360,10 @@ bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
 // Intrinsics with inline versions have to be whitelisted here a second time.
 #define INLINE_INTRINSIC_WHITELIST(V) \
   V(Call)                             \
-  V(IsJSReceiver)
+  V(IsJSReceiver)                     \
+  V(AsyncFunctionEnter)               \
+  V(AsyncFunctionReject)              \
+  V(AsyncFunctionResolve)
 
 #define CASE(Name) case Runtime::k##Name:
 #define INLINE_CASE(Name) case Runtime::kInline##Name:
@@ -857,6 +865,7 @@ DebugInfo::SideEffectState DebugEvaluate::FunctionGetSideEffectState(
   }
 
   DCHECK(info->is_compiled());
+  DCHECK(!info->needs_script_context());
   if (info->HasBytecodeArray()) {
     // Check bytecodes against whitelist.
     Handle<BytecodeArray> bytecode_array(info->GetBytecodeArray(), isolate);
diff --git a/deps/v8/src/debug/debug-evaluate.h b/deps/v8/src/debug/debug-evaluate.h
index b04bd76e22f547..516a0dac7c256e 100644
--- a/deps/v8/src/debug/debug-evaluate.h
+++ b/deps/v8/src/debug/debug-evaluate.h
@@ -24,7 +24,8 @@ class FrameInspector;
 class DebugEvaluate : public AllStatic {
  public:
   static MaybeHandle<Object> Global(Isolate* isolate, Handle<String> source,
-                                    debug::EvaluateGlobalMode mode);
+                                    debug::EvaluateGlobalMode mode,
+                                    REPLMode repl_mode = REPLMode::kNo);
 
   // Evaluate a piece of JavaScript in the context of a stack frame for
   // debugging.  Things that need special attention are:
diff --git a/deps/v8/src/debug/debug-interface.h b/deps/v8/src/debug/debug-interface.h
index 5f10e2a55a1f7c..732001327f0737 100644
--- a/deps/v8/src/debug/debug-interface.h
+++ b/deps/v8/src/debug/debug-interface.h
@@ -52,12 +52,20 @@ V8_EXPORT_PRIVATE void ClearBreakOnNextFunctionCall(Isolate* isolate);
 MaybeLocal<Array> GetInternalProperties(Isolate* isolate, Local<Value> value);
 
 /**
- * Returns array of private fields specific to the value type. Result has
- * the following format: [<name>, <value>,...,<name>, <value>]. Result array
- * will be allocated in the current context.
+ * Returns through the out parameters names_out a vector of names
+ * in v8::String for private members, including fields, methods,
+ * accessors specific to the value type.
+ * The values are returned through the out parameter values_out in the
+ * corresponding indices. Private fields and methods are returned directly
+ * while accessors are returned as v8::debug::AccessorPair. Missing components
+ * in the accessor pairs are null.
+ * If an exception occurs, false is returned. Otherwise true is returned.
+ * Results will be allocated in the current context and handle scope.
  */
-V8_EXPORT_PRIVATE MaybeLocal<Array> GetPrivateFields(Local<Context> context,
-                                                     Local<Object> value);
+V8_EXPORT_PRIVATE bool GetPrivateMembers(Local<Context> context,
+                                         Local<Object> value,
+                                         std::vector<Local<Value>>* names_out,
+                                         std::vector<Local<Value>>* values_out);
 
 /**
  * Forwards to v8::Object::CreationContext, but with special handling for
@@ -149,6 +157,7 @@ class V8_EXPORT_PRIVATE Script {
                        LiveEditResult* result) const;
   bool SetBreakpoint(v8::Local<v8::String> condition, debug::Location* location,
                      BreakpointId* id) const;
+  void RemoveWasmBreakpoint(BreakpointId id);
   bool SetBreakpointOnScriptEntry(BreakpointId* id) const;
 };
 
@@ -162,8 +171,8 @@ class WasmScript : public Script {
   MemorySpan<const uint8_t> Bytecode() const;
 
   std::pair<int, int> GetFunctionRange(int function_index) const;
+  int GetContainingFunction(int byte_offset) const;
 
-  debug::WasmDisassembly DisassembleFunction(int function_index) const;
   uint32_t GetFunctionHash(int function_index);
 };
 
@@ -478,8 +487,8 @@ enum class EvaluateGlobalMode {
 };
 
 V8_EXPORT_PRIVATE v8::MaybeLocal<v8::Value> EvaluateGlobal(
-    v8::Isolate* isolate, v8::Local<v8::String> source,
-    EvaluateGlobalMode mode);
+    v8::Isolate* isolate, v8::Local<v8::String> source, EvaluateGlobalMode mode,
+    bool repl_mode = false);
 
 int GetDebuggingId(v8::Local<v8::Function> function);
 
@@ -512,6 +521,25 @@ class WeakMap : public v8::Object {
   WeakMap();
 };
 
+/**
+ * Pairs of accessors.
+ *
+ * In the case of private accessors, getters and setters are either null or
+ * Functions.
+ */
+class V8_EXPORT_PRIVATE AccessorPair : public v8::Value {
+ public:
+  v8::Local<v8::Value> getter();
+  v8::Local<v8::Value> setter();
+
+  static bool IsAccessorPair(v8::Local<v8::Value> obj);
+  V8_INLINE static AccessorPair* Cast(v8::Value* obj);
+
+ private:
+  AccessorPair();
+  static void CheckCast(v8::Value* obj);
+};
+
 struct PropertyDescriptor {
   bool enumerable : 1;
   bool has_enumerable : 1;
@@ -544,6 +572,16 @@ class PropertyIterator {
   virtual bool is_own() = 0;
   virtual bool is_array_index() = 0;
 };
+
+AccessorPair* AccessorPair::Cast(v8::Value* value) {
+#ifdef V8_ENABLE_CHECKS
+  CheckCast(value);
+#endif
+  return static_cast<AccessorPair*>(value);
+}
+
+MaybeLocal<Message> GetMessageFromPromise(Local<Promise> promise);
+
 }  // namespace debug
 }  // namespace v8
 
diff --git a/deps/v8/src/debug/debug-property-iterator.cc b/deps/v8/src/debug/debug-property-iterator.cc
index a445f55f6dc5a6..a3605df55c7070 100644
--- a/deps/v8/src/debug/debug-property-iterator.cc
+++ b/deps/v8/src/debug/debug-property-iterator.cc
@@ -86,10 +86,10 @@ bool DebugPropertyIterator::has_native_setter() {
 Handle<Name> DebugPropertyIterator::raw_name() const {
   DCHECK(!Done());
   if (stage_ == kExoticIndices) {
-    return isolate_->factory()->Uint32ToString(current_key_index_);
+    return isolate_->factory()->SizeToString(current_key_index_);
   } else {
-    return Handle<Name>::cast(
-        FixedArray::get(*keys_, current_key_index_, isolate_));
+    return Handle<Name>::cast(FixedArray::get(
+        *keys_, static_cast<int>(current_key_index_), isolate_));
   }
 }
 
@@ -149,12 +149,7 @@ void DebugPropertyIterator::FillKeysForCurrentPrototypeAndStage() {
   if (stage_ == kExoticIndices) {
     if (!has_exotic_indices) return;
     Handle<JSTypedArray> typed_array = Handle<JSTypedArray>::cast(receiver);
-    if (typed_array->WasDetached()) {
-      exotic_length_ = 0;
-    } else {
-      // TODO(bmeurer, v8:4153): Change this to size_t later.
-      exotic_length_ = static_cast<uint32_t>(typed_array->length());
-    }
+    exotic_length_ = typed_array->WasDetached() ? 0 : typed_array->length();
     return;
   }
   bool skip_indices = has_exotic_indices;
@@ -172,29 +167,28 @@ bool DebugPropertyIterator::should_move_to_next_stage() const {
   if (prototype_iterator_.IsAtEnd()) return false;
   if (stage_ == kExoticIndices) return current_key_index_ >= exotic_length_;
   return keys_.is_null() ||
-         current_key_index_ >= static_cast<uint32_t>(keys_->length());
+         current_key_index_ >= static_cast<size_t>(keys_->length());
 }
 
 namespace {
 base::Flags<debug::NativeAccessorType, int> GetNativeAccessorDescriptorInternal(
     Handle<JSReceiver> object, Handle<Name> name) {
-  uint32_t index;
-  if (name->AsArrayIndex(&index)) return debug::NativeAccessorType::None;
-  LookupIterator it =
-      LookupIterator(object->GetIsolate(), object, name, LookupIterator::OWN);
+  Isolate* isolate = object->GetIsolate();
+  LookupIterator::Key key(isolate, name);
+  if (key.is_element()) return debug::NativeAccessorType::None;
+  LookupIterator it(isolate, object, key, LookupIterator::OWN);
   if (!it.IsFound()) return debug::NativeAccessorType::None;
   if (it.state() != LookupIterator::ACCESSOR) {
     return debug::NativeAccessorType::None;
   }
   Handle<Object> structure = it.GetAccessors();
   if (!structure->IsAccessorInfo()) return debug::NativeAccessorType::None;
-  auto isolate = object->GetIsolate();
   base::Flags<debug::NativeAccessorType, int> result;
-#define IS_BUILTIN_ACESSOR(_, name, ...)                    \
+#define IS_BUILTIN_ACCESSOR(_, name, ...)                   \
   if (*structure == *isolate->factory()->name##_accessor()) \
     return debug::NativeAccessorType::None;
-  ACCESSOR_INFO_LIST_GENERATOR(IS_BUILTIN_ACESSOR, /* not used */)
-#undef IS_BUILTIN_ACESSOR
+  ACCESSOR_INFO_LIST_GENERATOR(IS_BUILTIN_ACCESSOR, /* not used */)
+#undef IS_BUILTIN_ACCESSOR
   Handle<AccessorInfo> accessor_info = Handle<AccessorInfo>::cast(structure);
   if (accessor_info->getter() != Object()) {
     result |= debug::NativeAccessorType::HasGetter;
diff --git a/deps/v8/src/debug/debug-property-iterator.h b/deps/v8/src/debug/debug-property-iterator.h
index 822260afb64faa..67d3cb85cb1d98 100644
--- a/deps/v8/src/debug/debug-property-iterator.h
+++ b/deps/v8/src/debug/debug-property-iterator.h
@@ -46,9 +46,9 @@ class DebugPropertyIterator final : public debug::PropertyIterator {
   enum Stage { kExoticIndices = 0, kEnumerableStrings = 1, kAllProperties = 2 };
   Stage stage_ = kExoticIndices;
 
-  uint32_t current_key_index_ = 0;
+  size_t current_key_index_ = 0;
   Handle<FixedArray> keys_;
-  uint32_t exotic_length_ = 0;
+  size_t exotic_length_ = 0;
 
   bool calculated_native_accessor_flags_ = false;
   int native_accessor_flags_ = 0;
diff --git a/deps/v8/src/debug/debug-scope-iterator.cc b/deps/v8/src/debug/debug-scope-iterator.cc
index 72e7dc2e4526a8..1f6d9e0fd1d857 100644
--- a/deps/v8/src/debug/debug-scope-iterator.cc
+++ b/deps/v8/src/debug/debug-scope-iterator.cc
@@ -10,6 +10,7 @@
 #include "src/execution/frames-inl.h"
 #include "src/execution/isolate.h"
 #include "src/objects/js-generator-inl.h"
+#include "src/wasm/wasm-debug.h"
 #include "src/wasm/wasm-objects-inl.h"
 
 namespace v8 {
@@ -49,7 +50,9 @@ namespace internal {
 
 DebugScopeIterator::DebugScopeIterator(Isolate* isolate,
                                        FrameInspector* frame_inspector)
-    : iterator_(isolate, frame_inspector) {
+    : iterator_(
+          isolate, frame_inspector,
+          ::v8::internal::ScopeIterator::ReparseStrategy::kFunctionLiteral) {
   if (!Done() && ShouldIgnore()) Advance();
 }
 
@@ -155,19 +158,29 @@ v8::debug::ScopeIterator::ScopeType DebugWasmScopeIterator::GetType() {
 
 v8::Local<v8::Object> DebugWasmScopeIterator::GetObject() {
   DCHECK(!Done());
-  Handle<WasmDebugInfo> debug_info(
-      WasmInterpreterEntryFrame::cast(frame_)->debug_info(), isolate_);
   switch (type_) {
-    case debug::ScopeIterator::ScopeTypeGlobal:
-      return Utils::ToLocal(WasmDebugInfo::GetGlobalScopeObject(
-          debug_info, frame_->fp(), inlined_frame_index_));
-    case debug::ScopeIterator::ScopeTypeLocal:
-      return Utils::ToLocal(WasmDebugInfo::GetLocalScopeObject(
-          debug_info, frame_->fp(), inlined_frame_index_));
+    case debug::ScopeIterator::ScopeTypeGlobal: {
+      Handle<WasmInstanceObject> instance =
+          FrameSummary::GetTop(frame_).AsWasm().wasm_instance();
+      return Utils::ToLocal(wasm::GetGlobalScopeObject(instance));
+    }
+    case debug::ScopeIterator::ScopeTypeLocal: {
+      if (frame_->is_wasm_interpreter_entry()) {
+        Handle<WasmDebugInfo> debug_info(
+            WasmInterpreterEntryFrame::cast(frame_)->debug_info(), isolate_);
+        return Utils::ToLocal(WasmDebugInfo::GetLocalScopeObject(
+            debug_info, frame_->fp(), inlined_frame_index_));
+      }
+      // Compiled code.
+      DCHECK(frame_->is_wasm_compiled());
+      wasm::DebugInfo* debug_info =
+          WasmCompiledFrame::cast(frame_)->native_module()->GetDebugInfo();
+      return Utils::ToLocal(debug_info->GetLocalScopeObject(
+          isolate_, frame_->pc(), frame_->fp()));
+    }
     default:
-      return v8::Local<v8::Object>();
+      return {};
   }
-  return v8::Local<v8::Object>();
 }
 
 int DebugWasmScopeIterator::GetScriptId() {
diff --git a/deps/v8/src/debug/debug-scopes.cc b/deps/v8/src/debug/debug-scopes.cc
index 512b85fb096d73..58182941c83ad7 100644
--- a/deps/v8/src/debug/debug-scopes.cc
+++ b/deps/v8/src/debug/debug-scopes.cc
@@ -23,7 +23,7 @@ namespace v8 {
 namespace internal {
 
 ScopeIterator::ScopeIterator(Isolate* isolate, FrameInspector* frame_inspector,
-                             ScopeIterator::Option option)
+                             ReparseStrategy strategy)
     : isolate_(isolate),
       frame_inspector_(frame_inspector),
       function_(frame_inspector_->GetFunction()),
@@ -37,7 +37,7 @@ ScopeIterator::ScopeIterator(Isolate* isolate, FrameInspector* frame_inspector,
   // We should not instantiate a ScopeIterator for wasm frames.
   DCHECK_NE(Script::TYPE_WASM, frame_inspector->GetScript()->type());
 
-  TryParseAndRetrieveScopes(option);
+  TryParseAndRetrieveScopes(strategy);
 }
 
 ScopeIterator::~ScopeIterator() { delete info_; }
@@ -72,7 +72,7 @@ ScopeIterator::ScopeIterator(Isolate* isolate,
       context_(generator->context(), isolate),
       script_(Script::cast(function_->shared().script()), isolate) {
   CHECK(function_->shared().IsSubjectToDebugging());
-  TryParseAndRetrieveScopes(DEFAULT);
+  TryParseAndRetrieveScopes(ReparseStrategy::kFunctionLiteral);
 }
 
 void ScopeIterator::Restart() {
@@ -195,7 +195,7 @@ class ScopeChainRetriever {
 
 }  // namespace
 
-void ScopeIterator::TryParseAndRetrieveScopes(ScopeIterator::Option option) {
+void ScopeIterator::TryParseAndRetrieveScopes(ReparseStrategy strategy) {
   // Catch the case when the debugger stops in an internal function.
   Handle<SharedFunctionInfo> shared_info(function_->shared(), isolate_);
   Handle<ScopeInfo> scope_info(shared_info->scope_info(), isolate_);
@@ -233,9 +233,17 @@ void ScopeIterator::TryParseAndRetrieveScopes(ScopeIterator::Option option) {
   }
 
   // Reparse the code and analyze the scopes.
+  // Depending on the choosen strategy, the whole script or just
+  // the closure is re-parsed for function scopes.
   Handle<Script> script(Script::cast(shared_info->script()), isolate_);
-  info_ = new ParseInfo(isolate_, script);
-  info_->set_eager();
+  if (scope_info->scope_type() == FUNCTION_SCOPE &&
+      strategy == ReparseStrategy::kFunctionLiteral) {
+    info_ = new ParseInfo(isolate_, *shared_info);
+  } else {
+    info_ = new ParseInfo(isolate_, *script);
+    info_->set_eager();
+  }
+
   if (scope_info->scope_type() == EVAL_SCOPE || script->is_wrapped()) {
     info_->set_eval();
     if (!context_->IsNativeContext()) {
@@ -253,7 +261,7 @@ void ScopeIterator::TryParseAndRetrieveScopes(ScopeIterator::Option option) {
 
   if (parsing::ParseAny(info_, shared_info, isolate_) &&
       Rewriter::Rewrite(info_)) {
-    info_->ast_value_factory()->Internalize(isolate_);
+    info_->ast_value_factory()->Internalize(isolate_->factory());
     DeclarationScope* literal_scope = info_->literal()->scope();
 
     ScopeChainRetriever scope_chain_retriever(literal_scope, function_,
@@ -292,7 +300,7 @@ void ScopeIterator::TryParseAndRetrieveScopes(ScopeIterator::Option option) {
 }
 
 void ScopeIterator::UnwrapEvaluationContext() {
-  if (!context_->IsDebugEvaluateContext()) return;
+  if (context_->is_null() || !context_->IsDebugEvaluateContext()) return;
   Context current = *context_;
   do {
     Object wrapped = current.get(Context::WRAPPED_CONTEXT_INDEX);
@@ -435,7 +443,6 @@ void ScopeIterator::Next() {
   UnwrapEvaluationContext();
 }
 
-
 // Return the type of the current scope.
 ScopeIterator::ScopeType ScopeIterator::Type() const {
   DCHECK(!Done());
@@ -722,7 +729,7 @@ bool ScopeIterator::VisitContextLocals(const Visitor& visitor,
   for (int i = 0; i < scope_info->ContextLocalCount(); ++i) {
     Handle<String> name(scope_info->ContextLocalName(i), isolate_);
     if (ScopeInfo::VariableIsSynthetic(*name)) continue;
-    int context_index = Context::MIN_CONTEXT_SLOTS + i;
+    int context_index = scope_info->ContextHeaderLength() + i;
     Handle<Object> value(context->get(context_index), isolate_);
     // Reflect variables under TDZ as undefined in scope object.
     if (value->IsTheHole(isolate_)) continue;
@@ -771,6 +778,8 @@ bool ScopeIterator::VisitLocals(const Visitor& visitor, Mode mode) const {
         UNREACHABLE();
         break;
 
+      case VariableLocation::REPL_GLOBAL:
+        // REPL declared variables are ignored for now.
       case VariableLocation::UNALLOCATED:
         continue;
 
@@ -929,6 +938,10 @@ bool ScopeIterator::SetLocalVariableValue(Handle<String> variable_name,
                  *variable_name == ReadOnlyRoots(isolate_).arguments_string());
           return false;
 
+        case VariableLocation::REPL_GLOBAL:
+          // Assignments to REPL declared variables are ignored for now.
+          return false;
+
         case VariableLocation::PARAMETER: {
           if (var->is_this()) return false;
           if (frame_inspector_ == nullptr) {
@@ -992,7 +1005,7 @@ bool ScopeIterator::SetContextExtensionValue(Handle<String> variable_name,
   DCHECK(context_->extension_object().IsJSContextExtensionObject());
   Handle<JSObject> ext(context_->extension_object(), isolate_);
   LookupIterator it(isolate_, ext, variable_name, LookupIterator::OWN);
-  Maybe<bool> maybe = JSReceiver::HasOwnProperty(ext, variable_name);
+  Maybe<bool> maybe = JSReceiver::HasProperty(&it);
   DCHECK(maybe.IsJust());
   if (!maybe.FromJust()) return false;
 
diff --git a/deps/v8/src/debug/debug-scopes.h b/deps/v8/src/debug/debug-scopes.h
index 29d84ed6406327..f53457ef46e251 100644
--- a/deps/v8/src/debug/debug-scopes.h
+++ b/deps/v8/src/debug/debug-scopes.h
@@ -41,10 +41,13 @@ class ScopeIterator {
   static const int kScopeDetailsFunctionIndex = 5;
   static const int kScopeDetailsSize = 6;
 
-  enum Option { DEFAULT, COLLECT_NON_LOCALS };
+  enum class ReparseStrategy {
+    kScript,
+    kFunctionLiteral,
+  };
 
   ScopeIterator(Isolate* isolate, FrameInspector* frame_inspector,
-                Option options = DEFAULT);
+                ReparseStrategy strategy);
 
   ScopeIterator(Isolate* isolate, Handle<JSFunction> function);
   ScopeIterator(Isolate* isolate, Handle<JSGeneratorObject> generator);
@@ -129,7 +132,7 @@ class ScopeIterator {
 
   int GetSourcePosition();
 
-  void TryParseAndRetrieveScopes(ScopeIterator::Option option);
+  void TryParseAndRetrieveScopes(ReparseStrategy strategy);
 
   void UnwrapEvaluationContext();
 
diff --git a/deps/v8/src/debug/debug-stack-trace-iterator.cc b/deps/v8/src/debug/debug-stack-trace-iterator.cc
index 12f492dbd2f286..04a2e63ae52ad5 100644
--- a/deps/v8/src/debug/debug-stack-trace-iterator.cc
+++ b/deps/v8/src/debug/debug-stack-trace-iterator.cc
@@ -87,7 +87,9 @@ v8::MaybeLocal<v8::Value> DebugStackTraceIterator::GetReceiver() const {
     // Arrow function defined in top level function without references to
     // variables may have NativeContext as context.
     if (!context->IsFunctionContext()) return v8::MaybeLocal<v8::Value>();
-    ScopeIterator scope_iterator(isolate_, frame_inspector_.get());
+    ScopeIterator scope_iterator(
+        isolate_, frame_inspector_.get(),
+        ScopeIterator::ReparseStrategy::kFunctionLiteral);
     // We lookup this variable in function context only when it is used in arrow
     // function otherwise V8 can optimize it out.
     if (!scope_iterator.ClosureScopeHasThisReference()) {
@@ -115,10 +117,11 @@ v8::MaybeLocal<v8::Value> DebugStackTraceIterator::GetReceiver() const {
 }
 
 v8::Local<v8::Value> DebugStackTraceIterator::GetReturnValue() const {
-  DCHECK(!Done());
+  CHECK(!Done());
   if (frame_inspector_ && frame_inspector_->IsWasm()) {
     return v8::Local<v8::Value>();
   }
+  CHECK_NOT_NULL(iterator_.frame());
   bool is_optimized = iterator_.frame()->is_optimized();
   if (is_optimized || !is_top_frame_ ||
       !isolate_->debug()->IsBreakAtReturn(iterator_.javascript_frame())) {
@@ -156,12 +159,11 @@ std::unique_ptr<v8::debug::ScopeIterator>
 DebugStackTraceIterator::GetScopeIterator() const {
   DCHECK(!Done());
   StandardFrame* frame = iterator_.frame();
-  if (frame->is_wasm_interpreter_entry()) {
-    return std::unique_ptr<v8::debug::ScopeIterator>(new DebugWasmScopeIterator(
-        isolate_, iterator_.frame(), inlined_frame_index_));
+  if (frame->is_wasm()) {
+    return std::make_unique<DebugWasmScopeIterator>(isolate_, iterator_.frame(),
+                                                    inlined_frame_index_);
   }
-  return std::unique_ptr<v8::debug::ScopeIterator>(
-      new DebugScopeIterator(isolate_, frame_inspector_.get()));
+  return std::make_unique<DebugScopeIterator>(isolate_, frame_inspector_.get());
 }
 
 bool DebugStackTraceIterator::Restart() {
diff --git a/deps/v8/src/debug/debug.cc b/deps/v8/src/debug/debug.cc
index 27f30d8c058960..449ac490d0895d 100644
--- a/deps/v8/src/debug/debug.cc
+++ b/deps/v8/src/debug/debug.cc
@@ -36,7 +36,6 @@
 #include "src/objects/js-generator-inl.h"
 #include "src/objects/js-promise-inl.h"
 #include "src/objects/slots.h"
-#include "src/snapshot/natives.h"
 #include "src/snapshot/snapshot.h"
 #include "src/wasm/wasm-objects-inl.h"
 
@@ -341,9 +340,9 @@ void Debug::ThreadInit() {
   thread_local_.last_statement_position_ = kNoSourcePosition;
   thread_local_.last_frame_count_ = -1;
   thread_local_.fast_forward_to_return_ = false;
-  thread_local_.ignore_step_into_function_ = Smi::kZero;
+  thread_local_.ignore_step_into_function_ = Smi::zero();
   thread_local_.target_frame_count_ = -1;
-  thread_local_.return_value_ = Smi::kZero;
+  thread_local_.return_value_ = Smi::zero();
   thread_local_.last_breakpoint_id_ = 0;
   clear_suspended_generator();
   thread_local_.restart_fp_ = kNullAddress;
@@ -622,8 +621,7 @@ bool Debug::SetBreakPointForScript(Handle<Script> script,
   Handle<BreakPoint> break_point =
       isolate_->factory()->NewBreakPoint(*id, condition);
   if (script->type() == Script::TYPE_WASM) {
-    return WasmModuleObject::SetBreakPoint(script, source_position,
-                                           break_point);
+    return WasmScript::SetBreakPoint(script, source_position, break_point);
   }
 
   HandleScope scope(isolate_);
@@ -753,6 +751,16 @@ bool Debug::SetBreakpointForFunction(Handle<SharedFunctionInfo> shared,
   Handle<BreakPoint> breakpoint =
       isolate_->factory()->NewBreakPoint(*id, condition);
   int source_position = 0;
+  // Handle wasm function.
+  if (shared->HasWasmExportedFunctionData()) {
+    int func_index = shared->wasm_exported_function_data().function_index();
+    Handle<WasmInstanceObject> wasm_instance(
+        shared->wasm_exported_function_data().instance(), isolate_);
+    Handle<Script> script(Script::cast(wasm_instance->module_object().script()),
+                          isolate_);
+    return WasmScript::SetBreakPointOnFirstBreakableForFunction(
+        script, func_index, breakpoint);
+  }
   return SetBreakpoint(shared, breakpoint, &source_position);
 }
 
@@ -762,6 +770,12 @@ void Debug::RemoveBreakpoint(int id) {
   ClearBreakPoint(breakpoint);
 }
 
+void Debug::RemoveBreakpointForWasmScript(Handle<Script> script, int id) {
+  if (script->type() == Script::TYPE_WASM) {
+    WasmScript::ClearBreakPointById(script, id);
+  }
+}
+
 // Clear out all the debug break code.
 void Debug::ClearAllBreakPoints() {
   ClearAllDebugInfos([=](Handle<DebugInfo> info) {
@@ -857,9 +871,22 @@ void Debug::PrepareStepIn(Handle<JSFunction> function) {
   if (in_debug_scope()) return;
   if (break_disabled()) return;
   Handle<SharedFunctionInfo> shared(function->shared(), isolate_);
+  // If stepping from JS into Wasm, prepare for it.
+  if (shared->HasWasmExportedFunctionData()) {
+    auto imported_function = Handle<WasmExportedFunction>::cast(function);
+    Handle<WasmInstanceObject> wasm_instance(imported_function->instance(),
+                                             isolate_);
+    Handle<WasmDebugInfo> wasm_debug_info =
+        WasmInstanceObject::GetOrCreateDebugInfo(wasm_instance);
+    int func_index = shared->wasm_exported_function_data().function_index();
+    WasmDebugInfo::PrepareStepIn(wasm_debug_info, func_index);
+    // We need to reset all of this since break would be
+    // handled in Wasm Interpreter now. Otherwise it would be a loop here.
+    ClearStepping();
+  }
   if (IsBlackboxed(shared)) return;
   if (*function == thread_local_.ignore_step_into_function_) return;
-  thread_local_.ignore_step_into_function_ = Smi::kZero;
+  thread_local_.ignore_step_into_function_ = Smi::zero();
   FloodWithOneShot(Handle<SharedFunctionInfo>(function->shared(), isolate_));
 }
 
@@ -948,7 +975,6 @@ void Debug::PrepareStepOnThrow() {
   }
 }
 
-
 void Debug::PrepareStep(StepAction step_action) {
   HandleScope scope(isolate_);
 
@@ -970,53 +996,62 @@ void Debug::PrepareStep(StepAction step_action) {
   StandardFrame* frame = frames_it.frame();
 
   // Handle stepping in wasm functions via the wasm interpreter.
-  if (frame->is_wasm()) {
-    // If the top frame is compiled, we cannot step.
-    if (frame->is_wasm_compiled()) return;
+  if (frame->is_wasm_interpreter_entry()) {
     WasmInterpreterEntryFrame* wasm_frame =
         WasmInterpreterEntryFrame::cast(frame);
-    wasm_frame->debug_info().PrepareStep(step_action);
-    return;
+    if (wasm_frame->NumberOfActiveFrames() > 0) {
+      wasm_frame->debug_info().PrepareStep(step_action);
+      return;
+    }
   }
+  // If this is wasm, but there are no interpreted frames on top, all we can do
+  // is step out.
+  if (frame->is_wasm()) step_action = StepOut;
 
-  JavaScriptFrame* js_frame = JavaScriptFrame::cast(frame);
-  DCHECK(js_frame->function().IsJSFunction());
+  BreakLocation location = BreakLocation::Invalid();
+  Handle<SharedFunctionInfo> shared;
+  int current_frame_count = CurrentFrameCount();
 
-  // Get the debug info (create it if it does not exist).
-  auto summary = FrameSummary::GetTop(frame).AsJavaScript();
-  Handle<JSFunction> function(summary.function());
-  Handle<SharedFunctionInfo> shared(function->shared(), isolate_);
-  if (!EnsureBreakInfo(shared)) return;
-  PrepareFunctionForDebugExecution(shared);
+  if (frame->is_java_script()) {
+    JavaScriptFrame* js_frame = JavaScriptFrame::cast(frame);
+    DCHECK(js_frame->function().IsJSFunction());
 
-  Handle<DebugInfo> debug_info(shared->GetDebugInfo(), isolate_);
+    // Get the debug info (create it if it does not exist).
+    auto summary = FrameSummary::GetTop(frame).AsJavaScript();
+    Handle<JSFunction> function(summary.function());
+    shared = Handle<SharedFunctionInfo>(function->shared(), isolate_);
+    if (!EnsureBreakInfo(shared)) return;
+    PrepareFunctionForDebugExecution(shared);
 
-  BreakLocation location = BreakLocation::FromFrame(debug_info, js_frame);
+    Handle<DebugInfo> debug_info(shared->GetDebugInfo(), isolate_);
+
+    location = BreakLocation::FromFrame(debug_info, js_frame);
 
-  // Any step at a return is a step-out, and a step-out at a suspend behaves
-  // like a return.
-  if (location.IsReturn() || (location.IsSuspend() && step_action == StepOut)) {
-    // On StepOut we'll ignore our further calls to current function in
-    // PrepareStepIn callback.
-    if (last_step_action() == StepOut) {
-      thread_local_.ignore_step_into_function_ = *function;
+    // Any step at a return is a step-out, and a step-out at a suspend behaves
+    // like a return.
+    if (location.IsReturn() ||
+        (location.IsSuspend() && step_action == StepOut)) {
+      // On StepOut we'll ignore our further calls to current function in
+      // PrepareStepIn callback.
+      if (last_step_action() == StepOut) {
+        thread_local_.ignore_step_into_function_ = *function;
+      }
+      step_action = StepOut;
+      thread_local_.last_step_action_ = StepIn;
     }
-    step_action = StepOut;
-    thread_local_.last_step_action_ = StepIn;
-  }
 
-  // We need to schedule DebugOnFunction call callback
-  UpdateHookOnFunctionCall();
+    // We need to schedule DebugOnFunction call callback
+    UpdateHookOnFunctionCall();
 
-  // A step-next in blackboxed function is a step-out.
-  if (step_action == StepNext && IsBlackboxed(shared)) step_action = StepOut;
+    // A step-next in blackboxed function is a step-out.
+    if (step_action == StepNext && IsBlackboxed(shared)) step_action = StepOut;
 
-  thread_local_.last_statement_position_ =
-      summary.abstract_code()->SourceStatementPosition(summary.code_offset());
-  int current_frame_count = CurrentFrameCount();
-  thread_local_.last_frame_count_ = current_frame_count;
-  // No longer perform the current async step.
-  clear_suspended_generator();
+    thread_local_.last_statement_position_ =
+        summary.abstract_code()->SourceStatementPosition(summary.code_offset());
+    thread_local_.last_frame_count_ = current_frame_count;
+    // No longer perform the current async step.
+    clear_suspended_generator();
+  }
 
   switch (step_action) {
     case StepNone:
@@ -1025,7 +1060,8 @@ void Debug::PrepareStep(StepAction step_action) {
       // Clear last position info. For stepping out it does not matter.
       thread_local_.last_statement_position_ = kNoSourcePosition;
       thread_local_.last_frame_count_ = -1;
-      if (!location.IsReturnOrSuspend() && !IsBlackboxed(shared)) {
+      if (!shared.is_null() && !location.IsReturnOrSuspend() &&
+          !IsBlackboxed(shared)) {
         // At not return position we flood return positions with one shots and
         // will repeat StepOut automatically at next break.
         thread_local_.target_frame_count_ = current_frame_count;
@@ -1037,8 +1073,10 @@ void Debug::PrepareStep(StepAction step_action) {
       // and deoptimize every frame along the way.
       bool in_current_frame = true;
       for (; !frames_it.done(); frames_it.Advance()) {
-        // TODO(clemensb): Implement stepping out from JS to wasm.
-        if (frames_it.frame()->is_wasm()) continue;
+        if (frames_it.frame()->is_wasm()) {
+          in_current_frame = false;
+          continue;
+        }
         JavaScriptFrame* frame = JavaScriptFrame::cast(frames_it.frame());
         if (last_step_action() == StepIn) {
           // Deoptimize frame to ensure calls are checked for step-in.
@@ -1108,7 +1146,7 @@ void Debug::ClearStepping() {
 
   thread_local_.last_step_action_ = StepNone;
   thread_local_.last_statement_position_ = kNoSourcePosition;
-  thread_local_.ignore_step_into_function_ = Smi::kZero;
+  thread_local_.ignore_step_into_function_ = Smi::zero();
   thread_local_.fast_forward_to_return_ = false;
   thread_local_.last_frame_count_ = -1;
   thread_local_.target_frame_count_ = -1;
@@ -1137,10 +1175,6 @@ void Debug::DeoptimizeFunction(Handle<SharedFunctionInfo> shared) {
   // inlining.
   isolate_->AbortConcurrentOptimization(BlockingBehavior::kBlock);
 
-  // TODO(mlippautz): Try to remove this call.
-  isolate_->heap()->PreciseCollectAllGarbage(
-      Heap::kNoGCFlags, GarbageCollectionReason::kDebugger);
-
   bool found_something = false;
   Code::OptimizedCodeIterator iterator(isolate_);
   do {
@@ -1391,22 +1425,6 @@ bool Debug::GetPossibleBreakpoints(Handle<Script> script, int start_position,
   UNREACHABLE();
 }
 
-MaybeHandle<JSArray> Debug::GetPrivateFields(Handle<JSReceiver> receiver) {
-  Factory* factory = isolate_->factory();
-
-  Handle<FixedArray> internal_fields;
-  ASSIGN_RETURN_ON_EXCEPTION(isolate_, internal_fields,
-                             JSReceiver::GetPrivateEntries(isolate_, receiver),
-                             JSArray);
-
-  int nof_internal_fields = internal_fields->length();
-  if (nof_internal_fields == 0) {
-    return factory->NewJSArray(0);
-  }
-
-  return factory->NewJSArrayWithElements(internal_fields);
-}
-
 class SharedFunctionInfoFinder {
  public:
   explicit SharedFunctionInfoFinder(int target_position)
@@ -2033,6 +2051,7 @@ void Debug::PrintBreakLocation() {
   if (iterator.done()) return;
   StandardFrame* frame = iterator.frame();
   FrameSummary summary = FrameSummary::GetTop(frame);
+  summary.EnsureSourcePositionsAvailable();
   int source_position = summary.SourcePosition();
   Handle<Object> script_obj = summary.script();
   PrintF("[debug] break in function '");
diff --git a/deps/v8/src/debug/debug.h b/deps/v8/src/debug/debug.h
index 73bcceb4a235d3..8a63b1044e2866 100644
--- a/deps/v8/src/debug/debug.h
+++ b/deps/v8/src/debug/debug.h
@@ -61,6 +61,7 @@ enum IgnoreBreakMode {
 
 class BreakLocation {
  public:
+  static BreakLocation Invalid() { return BreakLocation(-1, NOT_DEBUG_BREAK); }
   static BreakLocation FromFrame(Handle<DebugInfo> debug_info,
                                  JavaScriptFrame* frame);
 
@@ -242,6 +243,7 @@ class V8_EXPORT_PRIVATE Debug {
   bool SetBreakpointForFunction(Handle<SharedFunctionInfo> shared,
                                 Handle<String> condition, int* id);
   void RemoveBreakpoint(int id);
+  void RemoveBreakpointForWasmScript(Handle<Script> script, int id);
 
   // Find breakpoints from the debug info and the break location and check
   // whether they are hit. Return an empty handle if not, or a FixedArray with
@@ -266,8 +268,6 @@ class V8_EXPORT_PRIVATE Debug {
                               int end_position, bool restrict_to_function,
                               std::vector<BreakLocation>* locations);
 
-  MaybeHandle<JSArray> GetPrivateFields(Handle<JSReceiver> receiver);
-
   bool IsBlackboxed(Handle<SharedFunctionInfo> shared);
 
   bool CanBreakAtEntry(Handle<SharedFunctionInfo> shared);
@@ -404,11 +404,11 @@ class V8_EXPORT_PRIVATE Debug {
   }
 
   void clear_suspended_generator() {
-    thread_local_.suspended_generator_ = Smi::kZero;
+    thread_local_.suspended_generator_ = Smi::zero();
   }
 
   bool has_suspended_generator() const {
-    return thread_local_.suspended_generator_ != Smi::kZero;
+    return thread_local_.suspended_generator_ != Smi::zero();
   }
 
   bool IsExceptionBlackboxed(bool uncaught);
diff --git a/deps/v8/src/debug/ia32/debug-ia32.cc b/deps/v8/src/debug/ia32/debug-ia32.cc
index e438f3a6407197..309614c5751988 100644
--- a/deps/v8/src/debug/ia32/debug-ia32.cc
+++ b/deps/v8/src/debug/ia32/debug-ia32.cc
@@ -33,7 +33,7 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   // - Leave the frame.
   // - Restart the frame by calling the function.
   __ mov(ebp, eax);
-  __ mov(edi, Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
+  __ mov(edi, Operand(ebp, StandardFrameConstants::kFunctionOffset));
   __ leave();
 
   __ mov(eax, FieldOperand(edi, JSFunction::kSharedFunctionInfoOffset));
@@ -42,9 +42,8 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
 
   // The expected and actual argument counts don't matter as long as they match
   // and we don't enter the ArgumentsAdaptorTrampoline.
-  ParameterCount dummy(0);
   __ mov(esi, FieldOperand(edi, JSFunction::kContextOffset));
-  __ InvokeFunctionCode(edi, no_reg, dummy, dummy, JUMP_FUNCTION);
+  __ InvokeFunctionCode(edi, no_reg, eax, eax, JUMP_FUNCTION);
 }
 
 const bool LiveEdit::kFrameDropperSupported = true;
diff --git a/deps/v8/src/debug/interface-types.h b/deps/v8/src/debug/interface-types.h
index a4204bb739c553..9c1657e4b991e0 100644
--- a/deps/v8/src/debug/interface-types.h
+++ b/deps/v8/src/debug/interface-types.h
@@ -42,33 +42,6 @@ class V8_EXPORT_PRIVATE Location {
   bool is_empty_;
 };
 
-/**
- * The result of disassembling a wasm function.
- * Consists of the disassembly string and an offset table mapping wasm byte
- * offsets to line and column in the disassembly.
- * The offset table entries are ordered by the byte_offset.
- * All numbers are 0-based.
- */
-struct WasmDisassemblyOffsetTableEntry {
-  WasmDisassemblyOffsetTableEntry(uint32_t byte_offset, int line, int column)
-      : byte_offset(byte_offset), line(line), column(column) {}
-
-  uint32_t byte_offset;
-  int line;
-  int column;
-};
-
-struct WasmDisassembly {
-  using OffsetTable = std::vector<WasmDisassemblyOffsetTableEntry>;
-  WasmDisassembly() = default;
-  WasmDisassembly(std::string disassembly, OffsetTable offset_table)
-      : disassembly(std::move(disassembly)),
-        offset_table(std::move(offset_table)) {}
-
-  std::string disassembly;
-  OffsetTable offset_table;
-};
-
 enum DebugAsyncActionType {
   kDebugPromiseThen,
   kDebugPromiseCatch,
diff --git a/deps/v8/src/debug/liveedit.cc b/deps/v8/src/debug/liveedit.cc
index 6e8a349a7d6f80..99063ba8f6a757 100644
--- a/deps/v8/src/debug/liveedit.cc
+++ b/deps/v8/src/debug/liveedit.cc
@@ -747,21 +747,21 @@ class CollectFunctionLiterals final
   std::vector<FunctionLiteral*>* literals_;
 };
 
-bool ParseScript(Isolate* isolate, ParseInfo* parse_info, bool compile_as_well,
-                 std::vector<FunctionLiteral*>* literals,
+bool ParseScript(Isolate* isolate, Handle<Script> script, ParseInfo* parse_info,
+                 bool compile_as_well, std::vector<FunctionLiteral*>* literals,
                  debug::LiveEditResult* result) {
   parse_info->set_eager();
   v8::TryCatch try_catch(reinterpret_cast<v8::Isolate*>(isolate));
   Handle<SharedFunctionInfo> shared;
   bool success = false;
   if (compile_as_well) {
-    success =
-        Compiler::CompileForLiveEdit(parse_info, isolate).ToHandle(&shared);
+    success = Compiler::CompileForLiveEdit(parse_info, script, isolate)
+                  .ToHandle(&shared);
   } else {
-    success = parsing::ParseProgram(parse_info, isolate);
+    success = parsing::ParseProgram(parse_info, script, isolate);
     if (success) {
       success = Compiler::Analyze(parse_info);
-      parse_info->ast_value_factory()->Internalize(isolate);
+      parse_info->ast_value_factory()->Internalize(isolate->factory());
     }
   }
   if (!success) {
@@ -1058,15 +1058,17 @@ void LiveEdit::PatchScript(Isolate* isolate, Handle<Script> script,
     return;
   }
 
-  ParseInfo parse_info(isolate, script);
+  ParseInfo parse_info(isolate, *script);
   std::vector<FunctionLiteral*> literals;
-  if (!ParseScript(isolate, &parse_info, false, &literals, result)) return;
+  if (!ParseScript(isolate, script, &parse_info, false, &literals, result))
+    return;
 
   Handle<Script> new_script = isolate->factory()->CloneScript(script);
   new_script->set_source(*new_source);
   std::vector<FunctionLiteral*> new_literals;
-  ParseInfo new_parse_info(isolate, new_script);
-  if (!ParseScript(isolate, &new_parse_info, true, &new_literals, result)) {
+  ParseInfo new_parse_info(isolate, *new_script);
+  if (!ParseScript(isolate, new_script, &new_parse_info, true, &new_literals,
+                   result)) {
     return;
   }
 
diff --git a/deps/v8/src/debug/mips/debug-mips.cc b/deps/v8/src/debug/mips/debug-mips.cc
index cc1adc2328e545..30bf2159bc3c88 100644
--- a/deps/v8/src/debug/mips/debug-mips.cc
+++ b/deps/v8/src/debug/mips/debug-mips.cc
@@ -33,7 +33,7 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   // - Leave the frame.
   // - Restart the frame by calling the function.
   __ mov(fp, a1);
-  __ lw(a1, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+  __ lw(a1, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
 
   // Pop return address and frame.
   __ LeaveFrame(StackFrame::INTERNAL);
@@ -43,9 +43,7 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
          FieldMemOperand(a0, SharedFunctionInfo::kFormalParameterCountOffset));
   __ mov(a2, a0);
 
-  ParameterCount dummy1(a2);
-  ParameterCount dummy2(a0);
-  __ InvokeFunction(a1, dummy1, dummy2, JUMP_FUNCTION);
+  __ InvokeFunction(a1, a2, a0, JUMP_FUNCTION);
 }
 
 
diff --git a/deps/v8/src/debug/mips64/debug-mips64.cc b/deps/v8/src/debug/mips64/debug-mips64.cc
index b93eb39c52fc8c..f677a38ee25088 100644
--- a/deps/v8/src/debug/mips64/debug-mips64.cc
+++ b/deps/v8/src/debug/mips64/debug-mips64.cc
@@ -33,7 +33,7 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   // - Leave the frame.
   // - Restart the frame by calling the function.
   __ mov(fp, a1);
-  __ Ld(a1, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+  __ Ld(a1, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
 
   // Pop return address and frame.
   __ LeaveFrame(StackFrame::INTERNAL);
@@ -43,9 +43,7 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
          FieldMemOperand(a0, SharedFunctionInfo::kFormalParameterCountOffset));
   __ mov(a2, a0);
 
-  ParameterCount dummy1(a2);
-  ParameterCount dummy2(a0);
-  __ InvokeFunction(a1, dummy1, dummy2, JUMP_FUNCTION);
+  __ InvokeFunction(a1, a2, a0, JUMP_FUNCTION);
 }
 
 
diff --git a/deps/v8/src/debug/ppc/debug-ppc.cc b/deps/v8/src/debug/ppc/debug-ppc.cc
index a5b41c46fe842a..d06aa67bb8c620 100644
--- a/deps/v8/src/debug/ppc/debug-ppc.cc
+++ b/deps/v8/src/debug/ppc/debug-ppc.cc
@@ -34,16 +34,14 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   // - Restart the frame by calling the function.
 
   __ mr(fp, r4);
-  __ LoadP(r4, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+  __ LoadP(r4, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
   __ LeaveFrame(StackFrame::INTERNAL);
   __ LoadP(r3, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
   __ lhz(r3,
          FieldMemOperand(r3, SharedFunctionInfo::kFormalParameterCountOffset));
   __ mr(r5, r3);
 
-  ParameterCount dummy1(r5);
-  ParameterCount dummy2(r3);
-  __ InvokeFunction(r4, dummy1, dummy2, JUMP_FUNCTION);
+  __ InvokeFunction(r4, r5, r3, JUMP_FUNCTION);
 }
 
 const bool LiveEdit::kFrameDropperSupported = true;
diff --git a/deps/v8/src/debug/s390/debug-s390.cc b/deps/v8/src/debug/s390/debug-s390.cc
index b85b2cc219f2d4..0230fcaa837791 100644
--- a/deps/v8/src/debug/s390/debug-s390.cc
+++ b/deps/v8/src/debug/s390/debug-s390.cc
@@ -36,16 +36,14 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   // - Restart the frame by calling the function.
 
   __ LoadRR(fp, r3);
-  __ LoadP(r3, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+  __ LoadP(r3, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
   __ LeaveFrame(StackFrame::INTERNAL);
   __ LoadP(r2, FieldMemOperand(r3, JSFunction::kSharedFunctionInfoOffset));
   __ LoadLogicalHalfWordP(
       r2, FieldMemOperand(r2, SharedFunctionInfo::kFormalParameterCountOffset));
   __ LoadRR(r4, r2);
 
-  ParameterCount dummy1(r4);
-  ParameterCount dummy2(r2);
-  __ InvokeFunction(r3, dummy1, dummy2, JUMP_FUNCTION);
+  __ InvokeFunction(r3, r4, r2, JUMP_FUNCTION);
 }
 
 const bool LiveEdit::kFrameDropperSupported = true;
diff --git a/deps/v8/src/debug/x64/debug-x64.cc b/deps/v8/src/debug/x64/debug-x64.cc
index a8b018d99fe024..3d25c5f19fba27 100644
--- a/deps/v8/src/debug/x64/debug-x64.cc
+++ b/deps/v8/src/debug/x64/debug-x64.cc
@@ -36,7 +36,7 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   // - Restart the frame by calling the function.
 
   __ movq(rbp, rbx);
-  __ movq(rdi, Operand(rbp, JavaScriptFrameConstants::kFunctionOffset));
+  __ movq(rdi, Operand(rbp, StandardFrameConstants::kFunctionOffset));
   __ leave();
 
   __ LoadTaggedPointerField(
@@ -44,8 +44,7 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   __ movzxwq(
       rbx, FieldOperand(rbx, SharedFunctionInfo::kFormalParameterCountOffset));
 
-  ParameterCount dummy(rbx);
-  __ InvokeFunction(rdi, no_reg, dummy, dummy, JUMP_FUNCTION);
+  __ InvokeFunction(rdi, no_reg, rbx, rbx, JUMP_FUNCTION);
 }
 
 const bool LiveEdit::kFrameDropperSupported = true;
diff --git a/deps/v8/src/deoptimizer/OWNERS b/deps/v8/src/deoptimizer/OWNERS
index 632607a95255d2..b8d344ab4c3b56 100644
--- a/deps/v8/src/deoptimizer/OWNERS
+++ b/deps/v8/src/deoptimizer/OWNERS
@@ -1,6 +1,5 @@
 bmeurer@chromium.org
 jarin@chromium.org
-mstarzinger@chromium.org
 sigurds@chromium.org
 tebbi@chromium.org
 
diff --git a/deps/v8/src/deoptimizer/arm/deoptimizer-arm.cc b/deps/v8/src/deoptimizer/arm/deoptimizer-arm.cc
index 45ff06eb70195f..becdc93a4cd872 100644
--- a/deps/v8/src/deoptimizer/arm/deoptimizer-arm.cc
+++ b/deps/v8/src/deoptimizer/arm/deoptimizer-arm.cc
@@ -85,7 +85,7 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
   Label context_check;
   __ ldr(r1, MemOperand(fp, CommonFrameConstants::kContextOrFrameTypeOffset));
   __ JumpIfSmi(r1, &context_check);
-  __ ldr(r0, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+  __ ldr(r0, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
   __ bind(&context_check);
   __ mov(r1, Operand(static_cast<int>(deopt_kind)));
   // r2: bailout id already loaded.
diff --git a/deps/v8/src/deoptimizer/arm64/deoptimizer-arm64.cc b/deps/v8/src/deoptimizer/arm64/deoptimizer-arm64.cc
index 17091259d6e535..300e65ab004797 100644
--- a/deps/v8/src/deoptimizer/arm64/deoptimizer-arm64.cc
+++ b/deps/v8/src/deoptimizer/arm64/deoptimizer-arm64.cc
@@ -154,9 +154,8 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
   __ Ldr(x1, MemOperand(fp, CommonFrameConstants::kContextOrFrameTypeOffset));
 
   // Ensure we can safely load from below fp.
-  DCHECK_GT(kSavedRegistersAreaSize,
-            -JavaScriptFrameConstants::kFunctionOffset);
-  __ Ldr(x0, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+  DCHECK_GT(kSavedRegistersAreaSize, -StandardFrameConstants::kFunctionOffset);
+  __ Ldr(x0, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
 
   // If x1 is a smi, zero x0.
   __ Tst(x1, kSmiTagMask);
diff --git a/deps/v8/src/deoptimizer/deoptimize-reason.h b/deps/v8/src/deoptimizer/deoptimize-reason.h
index 71eaa8b6267551..cfb07248dc19a8 100644
--- a/deps/v8/src/deoptimizer/deoptimize-reason.h
+++ b/deps/v8/src/deoptimizer/deoptimize-reason.h
@@ -43,9 +43,11 @@ namespace internal {
   V(NotAJavaScriptObjectOrNullOrUndefined,                                     \
     "not a JavaScript object, Null or Undefined")                              \
   V(NotANumberOrOddball, "not a Number or Oddball")                            \
+  V(NotAnArrayIndex, "not an array index")                                     \
   V(NotASmi, "not a Smi")                                                      \
   V(NotAString, "not a String")                                                \
   V(NotASymbol, "not a Symbol")                                                \
+  V(NotInt32, "not int32")                                                     \
   V(OutOfBounds, "out of bounds")                                              \
   V(Overflow, "overflow")                                                      \
   V(Smi, "Smi")                                                                \
diff --git a/deps/v8/src/deoptimizer/deoptimizer.cc b/deps/v8/src/deoptimizer/deoptimizer.cc
index fcb4c27d0b76cd..56431d4eea3ab8 100644
--- a/deps/v8/src/deoptimizer/deoptimizer.cc
+++ b/deps/v8/src/deoptimizer/deoptimizer.cc
@@ -519,8 +519,9 @@ Deoptimizer::Deoptimizer(Isolate* isolate, JSFunction function,
   }
   if (compiled_code_.kind() == Code::OPTIMIZED_FUNCTION) {
     compiled_code_.set_deopt_already_counted(true);
-    PROFILE(isolate_,
-            CodeDeoptEvent(compiled_code_, kind, from_, fp_to_sp_delta_));
+    HandleScope scope(isolate_);
+    PROFILE(isolate_, CodeDeoptEvent(handle(compiled_code_, isolate_), kind,
+                                     from_, fp_to_sp_delta_));
   }
   unsigned size = ComputeInputFrameSize();
   const int parameter_count =
@@ -698,6 +699,10 @@ void Deoptimizer::DoComputeOutputFrames() {
     }
   }
 
+  StackGuard* const stack_guard = isolate()->stack_guard();
+  CHECK_GT(static_cast<uintptr_t>(caller_frame_top_),
+           stack_guard->real_jslimit());
+
   if (trace_scope_ != nullptr) {
     timer.Start();
     PrintF(trace_scope_->file(), "[deoptimizing (DEOPT %s): begin ",
@@ -755,6 +760,7 @@ void Deoptimizer::DoComputeOutputFrames() {
 
   // Translate each output frame.
   int frame_index = 0;  // output_frame_index
+  size_t total_output_frame_size = 0;
   for (size_t i = 0; i < count; ++i, ++frame_index) {
     // Read the ast node id, function, and frame height for this output frame.
     TranslatedFrame* translated_frame = &(translated_state_.frames()[i]);
@@ -790,6 +796,7 @@ void Deoptimizer::DoComputeOutputFrames() {
         FATAL("invalid frame");
         break;
     }
+    total_output_frame_size += output_[frame_index]->GetFrameSize();
   }
 
   FrameDescription* topmost = output_[count - 1];
@@ -809,6 +816,18 @@ void Deoptimizer::DoComputeOutputFrames() {
            bailout_id_, node_id.ToInt(), output_[index]->GetPc(),
            caller_frame_top_, ms);
   }
+
+  // The following invariant is fairly tricky to guarantee, since the size of
+  // an optimized frame and its deoptimized counterparts usually differs. We
+  // thus need to consider the case in which deoptimized frames are larger than
+  // the optimized frame in stack checks in optimized code. We do this by
+  // applying an offset to stack checks (see kArchStackPointerGreaterThan in the
+  // code generator).
+  // Note that we explicitly allow deopts to exceed the limit by a certain
+  // number of slack bytes.
+  CHECK_GT(
+      static_cast<uintptr_t>(caller_frame_top_) - total_output_frame_size,
+      stack_guard->real_jslimit() - kStackLimitSlackForDeoptimizationInBytes);
 }
 
 void Deoptimizer::DoComputeInterpretedFrame(TranslatedFrame* translated_frame,
diff --git a/deps/v8/src/deoptimizer/ia32/deoptimizer-ia32.cc b/deps/v8/src/deoptimizer/ia32/deoptimizer-ia32.cc
index 6c82512d40db44..2fd424a66782ef 100644
--- a/deps/v8/src/deoptimizer/ia32/deoptimizer-ia32.cc
+++ b/deps/v8/src/deoptimizer/ia32/deoptimizer-ia32.cc
@@ -61,7 +61,7 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
   Label context_check;
   __ mov(edi, Operand(ebp, CommonFrameConstants::kContextOrFrameTypeOffset));
   __ JumpIfSmi(edi, &context_check);
-  __ mov(eax, Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
+  __ mov(eax, Operand(ebp, StandardFrameConstants::kFunctionOffset));
   __ bind(&context_check);
   __ mov(Operand(esp, 0 * kSystemPointerSize), eax);  // Function.
   __ mov(Operand(esp, 1 * kSystemPointerSize),
diff --git a/deps/v8/src/deoptimizer/mips/deoptimizer-mips.cc b/deps/v8/src/deoptimizer/mips/deoptimizer-mips.cc
index 6f4edee46c7077..bf82e2631b50f0 100644
--- a/deps/v8/src/deoptimizer/mips/deoptimizer-mips.cc
+++ b/deps/v8/src/deoptimizer/mips/deoptimizer-mips.cc
@@ -74,7 +74,7 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
   Label context_check;
   __ lw(a1, MemOperand(fp, CommonFrameConstants::kContextOrFrameTypeOffset));
   __ JumpIfSmi(a1, &context_check);
-  __ lw(a0, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+  __ lw(a0, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
   __ bind(&context_check);
   __ li(a1, Operand(static_cast<int>(deopt_kind)));
   // a2: bailout id already loaded.
diff --git a/deps/v8/src/deoptimizer/mips64/deoptimizer-mips64.cc b/deps/v8/src/deoptimizer/mips64/deoptimizer-mips64.cc
index 8f8183b4923a82..a1138d202fb59c 100644
--- a/deps/v8/src/deoptimizer/mips64/deoptimizer-mips64.cc
+++ b/deps/v8/src/deoptimizer/mips64/deoptimizer-mips64.cc
@@ -75,7 +75,7 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
   Label context_check;
   __ Ld(a1, MemOperand(fp, CommonFrameConstants::kContextOrFrameTypeOffset));
   __ JumpIfSmi(a1, &context_check);
-  __ Ld(a0, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+  __ Ld(a0, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
   __ bind(&context_check);
   __ li(a1, Operand(static_cast<int>(deopt_kind)));
   // a2: bailout id already loaded.
diff --git a/deps/v8/src/deoptimizer/ppc/deoptimizer-ppc.cc b/deps/v8/src/deoptimizer/ppc/deoptimizer-ppc.cc
index 4036b73443b365..1d05968806de2c 100644
--- a/deps/v8/src/deoptimizer/ppc/deoptimizer-ppc.cc
+++ b/deps/v8/src/deoptimizer/ppc/deoptimizer-ppc.cc
@@ -77,7 +77,7 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
   Label context_check;
   __ LoadP(r4, MemOperand(fp, CommonFrameConstants::kContextOrFrameTypeOffset));
   __ JumpIfSmi(r4, &context_check);
-  __ LoadP(r3, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+  __ LoadP(r3, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
   __ bind(&context_check);
   __ li(r4, Operand(static_cast<int>(deopt_kind)));
   // r5: bailout id already loaded.
diff --git a/deps/v8/src/deoptimizer/s390/deoptimizer-s390.cc b/deps/v8/src/deoptimizer/s390/deoptimizer-s390.cc
index 7ea6e56b8cf29a..63ea22f71af829 100644
--- a/deps/v8/src/deoptimizer/s390/deoptimizer-s390.cc
+++ b/deps/v8/src/deoptimizer/s390/deoptimizer-s390.cc
@@ -71,7 +71,7 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
   Label context_check;
   __ LoadP(r3, MemOperand(fp, CommonFrameConstants::kContextOrFrameTypeOffset));
   __ JumpIfSmi(r3, &context_check);
-  __ LoadP(r2, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+  __ LoadP(r2, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
   __ bind(&context_check);
   __ LoadImmP(r3, Operand(static_cast<int>(deopt_kind)));
   // r4: bailout id already loaded.
diff --git a/deps/v8/src/deoptimizer/x64/deoptimizer-x64.cc b/deps/v8/src/deoptimizer/x64/deoptimizer-x64.cc
index 03d7c759c09a7c..724062c506a7bf 100644
--- a/deps/v8/src/deoptimizer/x64/deoptimizer-x64.cc
+++ b/deps/v8/src/deoptimizer/x64/deoptimizer-x64.cc
@@ -73,7 +73,7 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
   Label context_check;
   __ movq(rdi, Operand(rbp, CommonFrameConstants::kContextOrFrameTypeOffset));
   __ JumpIfSmi(rdi, &context_check);
-  __ movq(rax, Operand(rbp, JavaScriptFrameConstants::kFunctionOffset));
+  __ movq(rax, Operand(rbp, StandardFrameConstants::kFunctionOffset));
   __ bind(&context_check);
   __ movq(arg_reg_1, rax);
   __ Set(arg_reg_2, static_cast<int>(deopt_kind));
diff --git a/deps/v8/src/diagnostics/arm/disasm-arm.cc b/deps/v8/src/diagnostics/arm/disasm-arm.cc
index 891ab0662e008b..e17936d8d2d184 100644
--- a/deps/v8/src/diagnostics/arm/disasm-arm.cc
+++ b/deps/v8/src/diagnostics/arm/disasm-arm.cc
@@ -1861,6 +1861,11 @@ void Decoder::DecodeSpecialCondition(Instruction* instr) {
               out_buffer_pos_ += SNPrintF(out_buffer_ + out_buffer_pos_,
                                           "vorr q%d, q%d, q%d", Vd, Vn, Vm);
             }
+          } else if (instr->Bits(21, 20) == 1 && instr->Bit(6) == 1 &&
+                     instr->Bit(4) == 1) {
+            // vbic Qd, Qn, Qm
+            out_buffer_pos_ += SNPrintF(out_buffer_ + out_buffer_pos_,
+                                        "vbic q%d, q%d, q%d", Vd, Vn, Vm);
           } else if (instr->Bits(21, 20) == 0 && instr->Bit(6) == 1 &&
                      instr->Bit(4) == 1) {
             // vand Qd, Qm, Qn.
@@ -1991,8 +1996,27 @@ void Decoder::DecodeSpecialCondition(Instruction* instr) {
       break;
     }
     case 5:
-      if ((instr->Bits(18, 16) == 0) && (instr->Bits(11, 6) == 0x28) &&
-          (instr->Bit(4) == 1)) {
+      if (instr->Bit(23) == 1 && instr->Bits(21, 19) == 0 &&
+          instr->Bit(7) == 0 && instr->Bit(4) == 1) {
+        // One register and a modified immediate value, see ARM DDI 0406C.d
+        // A7.4.6.
+        byte cmode = instr->Bits(11, 8);
+        switch (cmode) {
+          case 0: {
+            int vd = instr->VFPDRegValue(kSimd128Precision);
+            int a = instr->Bit(24);
+            int bcd = instr->Bits(18, 16);
+            int efgh = instr->Bits(3, 0);
+            int imm64 = a << 7 | bcd << 4 | efgh;
+            out_buffer_pos_ += SNPrintF(out_buffer_ + out_buffer_pos_,
+                                        "vmov.i32 q%d, %d", vd, imm64);
+            break;
+          }
+          default:
+            Unknown(instr);
+        }
+      } else if ((instr->Bits(18, 16) == 0) && (instr->Bits(11, 6) == 0x28) &&
+                 (instr->Bit(4) == 1)) {
         // vmovl signed
         if ((instr->VdValue() & 1) != 0) Unknown(instr);
         int Vd = (instr->Bit(22) << 3) | (instr->VdValue() >> 1);
@@ -2009,19 +2033,23 @@ void Decoder::DecodeSpecialCondition(Instruction* instr) {
         out_buffer_pos_ +=
             SNPrintF(out_buffer_ + out_buffer_pos_, "vext.8 q%d, q%d, q%d, #%d",
                      Vd, Vn, Vm, imm4);
-      } else if (instr->Bits(11, 7) == 0xA && instr->Bit(4) == 1) {
+      } else if (instr->Bits(11, 8) == 5 && instr->Bit(4) == 1) {
         // vshl.i<size> Qd, Qm, shift
-        int size = base::bits::RoundDownToPowerOfTwo32(instr->Bits(21, 16));
-        int shift = instr->Bits(21, 16) - size;
+        int imm7 = instr->Bits(21, 16);
+        if (instr->Bit(7) != 0) imm7 += 64;
+        int size = base::bits::RoundDownToPowerOfTwo32(imm7);
+        int shift = imm7 - size;
         int Vd = instr->VFPDRegValue(kSimd128Precision);
         int Vm = instr->VFPMRegValue(kSimd128Precision);
         out_buffer_pos_ +=
             SNPrintF(out_buffer_ + out_buffer_pos_, "vshl.i%d q%d, q%d, #%d",
                      size, Vd, Vm, shift);
-      } else if (instr->Bits(11, 7) == 0 && instr->Bit(4) == 1) {
+      } else if (instr->Bits(11, 8) == 0 && instr->Bit(4) == 1) {
         // vshr.s<size> Qd, Qm, shift
-        int size = base::bits::RoundDownToPowerOfTwo32(instr->Bits(21, 16));
-        int shift = 2 * size - instr->Bits(21, 16);
+        int imm7 = instr->Bits(21, 16);
+        if (instr->Bit(7) != 0) imm7 += 64;
+        int size = base::bits::RoundDownToPowerOfTwo32(imm7);
+        int shift = 2 * size - imm7;
         int Vd = instr->VFPDRegValue(kSimd128Precision);
         int Vm = instr->VFPMRegValue(kSimd128Precision);
         out_buffer_pos_ +=
@@ -2070,6 +2098,16 @@ void Decoder::DecodeSpecialCondition(Instruction* instr) {
               out_buffer_pos_ += SNPrintF(out_buffer_ + out_buffer_pos_,
                                           "veor q%d, q%d, q%d", Vd, Vn, Vm);
             }
+          } else if (instr->Bit(4) == 0) {
+            if (instr->Bit(6) == 1) {
+              // vrhadd.u<size> Qd, Qm, Qn.
+              out_buffer_pos_ +=
+                  SNPrintF(out_buffer_ + out_buffer_pos_,
+                           "vrhadd.u%d q%d, q%d, q%d", size, Vd, Vn, Vm);
+            } else {
+              // vrhadd.u<size> Dd, Dm, Dn.
+              Unknown(instr);
+            }
           } else {
             Unknown(instr);
           }
@@ -2216,13 +2254,15 @@ void Decoder::DecodeSpecialCondition(Instruction* instr) {
           PrintDRegister(Vm);
         } else if (instr->Bits(17, 16) == 0x2 && instr->Bits(11, 8) == 0x2 &&
                    instr->Bits(7, 6) != 0) {
-          // vqmovn.<type><size> Dd, Qm.
+          // vqmov{u}n.<type><size> Dd, Qm.
           int Vd = instr->VFPDRegValue(kDoublePrecision);
           int Vm = instr->VFPMRegValue(kSimd128Precision);
-          char type = instr->Bit(6) != 0 ? 'u' : 's';
+          int op = instr->Bits(7, 6);
+          const char* name = op == 0b01 ? "vqmovun" : "vqmovn";
+          char type = op == 0b11 ? 'u' : 's';
           int size = 2 * kBitsPerByte * (1 << instr->Bits(19, 18));
           out_buffer_pos_ +=
-              SNPrintF(out_buffer_ + out_buffer_pos_, "vqmovn.%c%i d%d, q%d",
+              SNPrintF(out_buffer_ + out_buffer_pos_, "%s.%c%i d%d, q%d", name,
                        type, size, Vd, Vm);
         } else {
           int Vd, Vm;
@@ -2322,11 +2362,13 @@ void Decoder::DecodeSpecialCondition(Instruction* instr) {
             Unknown(instr);
           }
         }
-      } else if (instr->Bits(11, 7) == 0 && instr->Bit(4) == 1 &&
+      } else if (instr->Bits(11, 8) == 0 && instr->Bit(4) == 1 &&
                  instr->Bit(6) == 1) {
         // vshr.u<size> Qd, Qm, shift
-        int size = base::bits::RoundDownToPowerOfTwo32(instr->Bits(21, 16));
-        int shift = 2 * size - instr->Bits(21, 16);
+        int imm7 = instr->Bits(21, 16);
+        if (instr->Bit(7) != 0) imm7 += 64;
+        int size = base::bits::RoundDownToPowerOfTwo32(imm7);
+        int shift = 2 * size - imm7;
         int Vd = instr->VFPDRegValue(kSimd128Precision);
         int Vm = instr->VFPMRegValue(kSimd128Precision);
         out_buffer_pos_ +=
@@ -2353,6 +2395,26 @@ void Decoder::DecodeSpecialCondition(Instruction* instr) {
         out_buffer_pos_ +=
             SNPrintF(out_buffer_ + out_buffer_pos_, "vs%ci.%d d%d, d%d, #%d",
                      direction, size, Vd, Vm, shift);
+      } else if (instr->Bits(11, 8) == 0x8 && instr->Bit(6) == 0 &&
+                 instr->Bit(4) == 0) {
+        // vmlal.u<size> <Qd>, <Dn>, <Dm>
+        int Vd = instr->VFPDRegValue(kSimd128Precision);
+        int Vn = instr->VFPNRegValue(kDoublePrecision);
+        int Vm = instr->VFPMRegValue(kDoublePrecision);
+        int size = 8 << instr->Bits(21, 20);
+        out_buffer_pos_ +=
+            SNPrintF(out_buffer_ + out_buffer_pos_, "vmlal.u%d q%d, d%d, d%d",
+                     size, Vd, Vn, Vm);
+      } else if (instr->Bits(11, 8) == 0xC && instr->Bit(6) == 0 &&
+                 instr->Bit(4) == 0) {
+        // vmull.u<size> <Qd>, <Dn>, <Dm>
+        int Vd = instr->VFPDRegValue(kSimd128Precision);
+        int Vn = instr->VFPNRegValue(kDoublePrecision);
+        int Vm = instr->VFPMRegValue(kDoublePrecision);
+        int size = 8 << instr->Bits(21, 20);
+        out_buffer_pos_ +=
+            SNPrintF(out_buffer_ + out_buffer_pos_, "vmull.u%d q%d, d%d, d%d",
+                     size, Vd, Vn, Vm);
       } else {
         Unknown(instr);
       }
diff --git a/deps/v8/src/diagnostics/arm64/disasm-arm64.cc b/deps/v8/src/diagnostics/arm64/disasm-arm64.cc
index db14689ad1c596..5a87f73529033a 100644
--- a/deps/v8/src/diagnostics/arm64/disasm-arm64.cc
+++ b/deps/v8/src/diagnostics/arm64/disasm-arm64.cc
@@ -3563,7 +3563,7 @@ void DisassemblingDecoder::ProcessOutput(Instruction* /*instr*/) {
 }
 
 void DisassemblingDecoder::AppendRegisterNameToOutput(const CPURegister& reg) {
-  DCHECK(reg.IsValid());
+  DCHECK(reg.is_valid());
   char reg_char;
 
   if (reg.IsRegister()) {
diff --git a/deps/v8/src/diagnostics/disassembler.cc b/deps/v8/src/diagnostics/disassembler.cc
index 8307ef3ff4d624..785c535e0ac602 100644
--- a/deps/v8/src/diagnostics/disassembler.cc
+++ b/deps/v8/src/diagnostics/disassembler.cc
@@ -8,6 +8,7 @@
 #include <unordered_map>
 #include <vector>
 
+#include "src/base/memory.h"
 #include "src/codegen/assembler-inl.h"
 #include "src/codegen/code-comments.h"
 #include "src/codegen/code-reference.h"
@@ -291,23 +292,26 @@ static int DecodeIt(Isolate* isolate, ExternalReferenceEncoder* ref_encoder,
     // First decode instruction so that we know its length.
     byte* prev_pc = pc;
     if (constants > 0) {
-      SNPrintF(decode_buffer, "%08x       constant",
-               *reinterpret_cast<int32_t*>(pc));
+      SNPrintF(
+          decode_buffer, "%08x       constant",
+          base::ReadUnalignedValue<int32_t>(reinterpret_cast<Address>(pc)));
       constants--;
       pc += 4;
     } else {
       int num_const = d.ConstantPoolSizeAt(pc);
       if (num_const >= 0) {
-        SNPrintF(decode_buffer,
-                 "%08x       constant pool begin (num_const = %d)",
-                 *reinterpret_cast<int32_t*>(pc), num_const);
+        SNPrintF(
+            decode_buffer, "%08x       constant pool begin (num_const = %d)",
+            base::ReadUnalignedValue<int32_t>(reinterpret_cast<Address>(pc)),
+            num_const);
         constants = num_const;
         pc += 4;
       } else if (it != nullptr && !it->done() &&
                  it->rinfo()->pc() == reinterpret_cast<Address>(pc) &&
                  it->rinfo()->rmode() == RelocInfo::INTERNAL_REFERENCE) {
         // raw pointer embedded in code stream, e.g., jump table
-        byte* ptr = *reinterpret_cast<byte**>(pc);
+        byte* ptr =
+            base::ReadUnalignedValue<byte*>(reinterpret_cast<Address>(pc));
         SNPrintF(decode_buffer, "%08" V8PRIxPTR "      jump table entry %4zu",
                  reinterpret_cast<intptr_t>(ptr),
                  static_cast<size_t>(ptr - begin));
diff --git a/deps/v8/src/diagnostics/eh-frame.cc b/deps/v8/src/diagnostics/eh-frame.cc
index 45d693a4764a9b..35cb529f09458f 100644
--- a/deps/v8/src/diagnostics/eh-frame.cc
+++ b/deps/v8/src/diagnostics/eh-frame.cc
@@ -9,8 +9,9 @@
 
 #include "src/codegen/code-desc.h"
 
-#if !defined(V8_TARGET_ARCH_X64) && !defined(V8_TARGET_ARCH_ARM) && \
-    !defined(V8_TARGET_ARCH_ARM64)
+#if !defined(V8_TARGET_ARCH_X64) && !defined(V8_TARGET_ARCH_ARM) &&     \
+    !defined(V8_TARGET_ARCH_ARM64) && !defined(V8_TARGET_ARCH_S390X) && \
+    !defined(V8_TARGET_ARCH_PPC64)
 
 // Placeholders for unsupported architectures.
 
@@ -303,36 +304,48 @@ void EhFrameWriter::SetBaseAddressRegisterAndOffset(Register base_register,
   base_register_ = base_register;
 }
 
-void EhFrameWriter::RecordRegisterSavedToStack(int register_code, int offset) {
+void EhFrameWriter::RecordRegisterSavedToStack(int dwarf_register_code,
+                                               int offset) {
   DCHECK_EQ(writer_state_, InternalState::kInitialized);
   DCHECK_EQ(offset % EhFrameConstants::kDataAlignmentFactor, 0);
   int factored_offset = offset / EhFrameConstants::kDataAlignmentFactor;
   if (factored_offset >= 0) {
-    DCHECK_LE(register_code, EhFrameConstants::kSavedRegisterMask);
+    DCHECK_LE(dwarf_register_code, EhFrameConstants::kSavedRegisterMask);
     WriteByte((EhFrameConstants::kSavedRegisterTag
                << EhFrameConstants::kSavedRegisterMaskSize) |
-              (register_code & EhFrameConstants::kSavedRegisterMask));
+              (dwarf_register_code & EhFrameConstants::kSavedRegisterMask));
     WriteULeb128(factored_offset);
   } else {
     WriteOpcode(EhFrameConstants::DwarfOpcodes::kOffsetExtendedSf);
-    WriteULeb128(register_code);
+    WriteULeb128(dwarf_register_code);
     WriteSLeb128(factored_offset);
   }
 }
 
 void EhFrameWriter::RecordRegisterNotModified(Register name) {
+  RecordRegisterNotModified(RegisterToDwarfCode(name));
+}
+
+void EhFrameWriter::RecordRegisterNotModified(int dwarf_register_code) {
   DCHECK_EQ(writer_state_, InternalState::kInitialized);
   WriteOpcode(EhFrameConstants::DwarfOpcodes::kSameValue);
-  WriteULeb128(RegisterToDwarfCode(name));
+  WriteULeb128(dwarf_register_code);
 }
 
 void EhFrameWriter::RecordRegisterFollowsInitialRule(Register name) {
+  RecordRegisterFollowsInitialRule(RegisterToDwarfCode(name));
+}
+
+void EhFrameWriter::RecordRegisterFollowsInitialRule(int dwarf_register_code) {
   DCHECK_EQ(writer_state_, InternalState::kInitialized);
-  int code = RegisterToDwarfCode(name);
-  DCHECK_LE(code, EhFrameConstants::kFollowInitialRuleMask);
-  WriteByte((EhFrameConstants::kFollowInitialRuleTag
-             << EhFrameConstants::kFollowInitialRuleMaskSize) |
-            (code & EhFrameConstants::kFollowInitialRuleMask));
+  if (dwarf_register_code <= EhFrameConstants::kFollowInitialRuleMask) {
+    WriteByte((EhFrameConstants::kFollowInitialRuleTag
+               << EhFrameConstants::kFollowInitialRuleMaskSize) |
+              (dwarf_register_code & EhFrameConstants::kFollowInitialRuleMask));
+  } else {
+    WriteOpcode(EhFrameConstants::DwarfOpcodes::kRestoreExtended);
+    WriteULeb128(dwarf_register_code);
+  }
 }
 
 void EhFrameWriter::Finish(int code_size) {
diff --git a/deps/v8/src/diagnostics/eh-frame.h b/deps/v8/src/diagnostics/eh-frame.h
index a9d76a27436d76..17ef8c0ad5be28 100644
--- a/deps/v8/src/diagnostics/eh-frame.h
+++ b/deps/v8/src/diagnostics/eh-frame.h
@@ -24,6 +24,7 @@ class V8_EXPORT_PRIVATE EhFrameConstants final
     kAdvanceLoc1 = 0x02,
     kAdvanceLoc2 = 0x03,
     kAdvanceLoc4 = 0x04,
+    kRestoreExtended = 0x06,
     kSameValue = 0x08,
     kDefCfa = 0x0c,
     kDefCfaRegister = 0x0d,
@@ -102,11 +103,17 @@ class V8_EXPORT_PRIVATE EhFrameWriter {
     RecordRegisterSavedToStack(RegisterToDwarfCode(name), offset);
   }
 
+  // Directly accepts a DWARF register code, needed for
+  // handling pseudo-registers on some platforms.
+  void RecordRegisterSavedToStack(int dwarf_register_code, int offset);
+
   // The register has not been modified from the previous frame.
   void RecordRegisterNotModified(Register name);
+  void RecordRegisterNotModified(int dwarf_register_code);
 
   // The register follows the rule defined in the CIE.
   void RecordRegisterFollowsInitialRule(Register name);
+  void RecordRegisterFollowsInitialRule(int dwarf_register_code);
 
   void Finish(int code_size);
 
@@ -169,10 +176,6 @@ class V8_EXPORT_PRIVATE EhFrameWriter {
   // Write nops until the size reaches a multiple of 8 bytes.
   void WritePaddingToAlignedSize(int unpadded_size);
 
-  // Internal version that directly accepts a DWARF register code, needed for
-  // handling pseudo-registers on some platforms.
-  void RecordRegisterSavedToStack(int register_code, int offset);
-
   int GetProcedureAddressOffset() const {
     return fde_offset() + EhFrameConstants::kProcedureAddressOffsetInFde;
   }
diff --git a/deps/v8/src/diagnostics/gdb-jit.cc b/deps/v8/src/diagnostics/gdb-jit.cc
index e1290bae4e3d46..5f364373027266 100644
--- a/deps/v8/src/diagnostics/gdb-jit.cc
+++ b/deps/v8/src/diagnostics/gdb-jit.cc
@@ -16,7 +16,6 @@
 #include "src/handles/global-handles.h"
 #include "src/init/bootstrapper.h"
 #include "src/objects/objects.h"
-#include "src/snapshot/natives.h"
 #include "src/utils/ostreams.h"
 #include "src/utils/vector.h"
 #include "src/zone/zone-chunk-list.h"
@@ -220,7 +219,7 @@ class MachOSection : public DebugSectionBase<MachOSectionHeader> {
       : name_(name), segment_(segment), align_(align), flags_(flags) {
     if (align_ != 0) {
       DCHECK(base::bits::IsPowerOfTwo(align));
-      align_ = WhichPowerOf2(align_);
+      align_ = base::bits::WhichPowerOfTwo(align_);
     }
   }
 
@@ -1105,25 +1104,22 @@ class DebugInfoSection : public DebugSection {
         Writer::Slot<uint32_t> block_size = w->CreateSlotHere<uint32_t>();
         uintptr_t block_start = w->position();
         w->Write<uint8_t>(DW_OP_fbreg);
-        w->WriteSLEB128(JavaScriptFrameConstants::kLastParameterOffset +
+        w->WriteSLEB128(StandardFrameConstants::kFixedFrameSizeAboveFp +
                         kSystemPointerSize * (params - param - 1));
         block_size.set(static_cast<uint32_t>(w->position() - block_start));
       }
 
       // See contexts.h for more information.
-      DCHECK_EQ(Context::MIN_CONTEXT_SLOTS, 4);
+      DCHECK_EQ(Context::MIN_CONTEXT_SLOTS, 3);
       DCHECK_EQ(Context::SCOPE_INFO_INDEX, 0);
       DCHECK_EQ(Context::PREVIOUS_INDEX, 1);
       DCHECK_EQ(Context::EXTENSION_INDEX, 2);
-      DCHECK_EQ(Context::NATIVE_CONTEXT_INDEX, 3);
       w->WriteULEB128(current_abbreviation++);
       w->WriteString(".scope_info");
       w->WriteULEB128(current_abbreviation++);
       w->WriteString(".previous");
       w->WriteULEB128(current_abbreviation++);
       w->WriteString(".extension");
-      w->WriteULEB128(current_abbreviation++);
-      w->WriteString(".native_context");
 
       for (int context_slot = 0; context_slot < context_slots; ++context_slot) {
         w->WriteULEB128(current_abbreviation++);
@@ -1139,7 +1135,7 @@ class DebugInfoSection : public DebugSection {
         Writer::Slot<uint32_t> block_size = w->CreateSlotHere<uint32_t>();
         uintptr_t block_start = w->position();
         w->Write<uint8_t>(DW_OP_fbreg);
-        w->WriteSLEB128(JavaScriptFrameConstants::kFunctionOffset);
+        w->WriteSLEB128(StandardFrameConstants::kFunctionOffset);
         block_size.set(static_cast<uint32_t>(w->position() - block_start));
       }
 
diff --git a/deps/v8/src/diagnostics/ia32/disasm-ia32.cc b/deps/v8/src/diagnostics/ia32/disasm-ia32.cc
index ead0a5a7094af1..0cb36d122838c2 100644
--- a/deps/v8/src/diagnostics/ia32/disasm-ia32.cc
+++ b/deps/v8/src/diagnostics/ia32/disasm-ia32.cc
@@ -692,6 +692,10 @@ int DisassemblerIA32::AVXInstruction(byte* data) {
     int mod, regop, rm, vvvv = vex_vreg();
     get_modrm(*current, &mod, &regop, &rm);
     switch (opcode) {
+      case 0x18:
+        AppendToBuffer("vbroadcastss %s,", NameOfXMMRegister(regop));
+        current += PrintRightXMMOperand(current);
+        break;
       case 0x99:
         AppendToBuffer("vfmadd132s%c %s,%s,", float_size_code(),
                        NameOfXMMRegister(regop), NameOfXMMRegister(vvvv));
@@ -846,6 +850,10 @@ int DisassemblerIA32::AVXInstruction(byte* data) {
     int mod, regop, rm, vvvv = vex_vreg();
     get_modrm(*current, &mod, &regop, &rm);
     switch (opcode) {
+      case 0x12:
+        AppendToBuffer("vmovddup %s,", NameOfXMMRegister(regop));
+        current += PrintRightXMMOperand(current);
+        break;
       case 0x51:
         AppendToBuffer("vsqrtsd %s,%s,", NameOfXMMRegister(regop),
                        NameOfXMMRegister(vvvv));
@@ -2259,13 +2267,6 @@ int DisassemblerIA32::InstructionDecode(v8::internal::Vector<char> out_buffer,
           } else if (*data == 0x90) {
             data++;
             AppendToBuffer("nop");  // 2 byte nop.
-          } else if (*data == 0xF3) {
-            data++;
-            int mod, regop, rm;
-            get_modrm(*data, &mod, &regop, &rm);
-            AppendToBuffer("psllq %s,%s", NameOfXMMRegister(regop),
-                           NameOfXMMRegister(rm));
-            data++;
           } else if (*data == 0x71) {
             data++;
             int mod, regop, rm;
@@ -2291,13 +2292,6 @@ int DisassemblerIA32::InstructionDecode(v8::internal::Vector<char> out_buffer,
             AppendToBuffer("ps%sq %s,%d", sf_str[regop / 2],
                            NameOfXMMRegister(rm), static_cast<int>(imm8));
             data += 2;
-          } else if (*data == 0xD3) {
-            data++;
-            int mod, regop, rm;
-            get_modrm(*data, &mod, &regop, &rm);
-            AppendToBuffer("psrlq %s,%s", NameOfXMMRegister(regop),
-                           NameOfXMMRegister(rm));
-            data++;
           } else if (*data == 0x7F) {
             AppendToBuffer("movdqa ");
             data++;
@@ -2444,6 +2438,12 @@ int DisassemblerIA32::InstructionDecode(v8::internal::Vector<char> out_buffer,
             get_modrm(*data, &mod, &regop, &rm);
             AppendToBuffer("movsd %s,", NameOfXMMRegister(regop));
             data += PrintRightXMMOperand(data);
+          } else if (b2 == 0x12) {
+            data += 3;
+            int mod, regop, rm;
+            get_modrm(*data, &mod, &regop, &rm);
+            AppendToBuffer("movddup %s,", NameOfXMMRegister(regop));
+            data += PrintRightXMMOperand(data);
           } else if (b2 == 0x5A) {
             data += 3;
             int mod, regop, rm;
diff --git a/deps/v8/src/diagnostics/objects-debug.cc b/deps/v8/src/diagnostics/objects-debug.cc
index 9c4b176dc65c75..d087a6d21d16e7 100644
--- a/deps/v8/src/diagnostics/objects-debug.cc
+++ b/deps/v8/src/diagnostics/objects-debug.cc
@@ -10,6 +10,7 @@
 #include "src/diagnostics/disassembler.h"
 #include "src/heap/combined-heap.h"
 #include "src/heap/heap-write-barrier-inl.h"
+#include "src/heap/read-only-heap.h"
 #include "src/ic/handler-configuration-inl.h"
 #include "src/init/bootstrapper.h"
 #include "src/logging/counters.h"
@@ -38,6 +39,7 @@
 #include "src/objects/js-collection-inl.h"
 #ifdef V8_INTL_SUPPORT
 #include "src/objects/js-date-time-format-inl.h"
+#include "src/objects/js-display-names-inl.h"
 #endif  // V8_INTL_SUPPORT
 #include "src/objects/js-generator-inl.h"
 #ifdef V8_INTL_SUPPORT
@@ -60,6 +62,7 @@
 #include "src/objects/module-inl.h"
 #include "src/objects/oddball-inl.h"
 #include "src/objects/promise-inl.h"
+#include "src/objects/property-descriptor-object-inl.h"
 #include "src/objects/stack-frame-info-inl.h"
 #include "src/objects/struct-inl.h"
 #include "src/objects/template-objects-inl.h"
@@ -156,28 +159,10 @@ void HeapObject::HeapObjectVerify(Isolate* isolate) {
       String::cast(*this).StringVerify(isolate);
     }
     break;
-    case SYMBOL_TYPE:
-      Symbol::cast(*this).SymbolVerify(isolate);
-      break;
-    case MAP_TYPE:
-      Map::cast(*this).MapVerify(isolate);
-      break;
-    case HEAP_NUMBER_TYPE:
-      CHECK(IsHeapNumber());
-      break;
-    case BIGINT_TYPE:
-      BigInt::cast(*this).BigIntVerify(isolate);
-      break;
-    case CALL_HANDLER_INFO_TYPE:
-      CallHandlerInfo::cast(*this).CallHandlerInfoVerify(isolate);
-      break;
     case OBJECT_BOILERPLATE_DESCRIPTION_TYPE:
       ObjectBoilerplateDescription::cast(*this)
           .ObjectBoilerplateDescriptionVerify(isolate);
       break;
-    case EMBEDDER_DATA_ARRAY_TYPE:
-      EmbedderDataArray::cast(*this).EmbedderDataArrayVerify(isolate);
-      break;
     // FixedArray types
     case CLOSURE_FEEDBACK_CELL_ARRAY_TYPE:
     case HASH_TABLE_TYPE:
@@ -212,46 +197,16 @@ void HeapObject::HeapObjectVerify(Isolate* isolate) {
     case WEAK_FIXED_ARRAY_TYPE:
       WeakFixedArray::cast(*this).WeakFixedArrayVerify(isolate);
       break;
-    case WEAK_ARRAY_LIST_TYPE:
-      WeakArrayList::cast(*this).WeakArrayListVerify(isolate);
-      break;
-    case FIXED_DOUBLE_ARRAY_TYPE:
-      FixedDoubleArray::cast(*this).FixedDoubleArrayVerify(isolate);
-      break;
     case FEEDBACK_METADATA_TYPE:
       FeedbackMetadata::cast(*this).FeedbackMetadataVerify(isolate);
       break;
-    case BYTE_ARRAY_TYPE:
-      ByteArray::cast(*this).ByteArrayVerify(isolate);
-      break;
-    case BYTECODE_ARRAY_TYPE:
-      BytecodeArray::cast(*this).BytecodeArrayVerify(isolate);
-      break;
-    case DESCRIPTOR_ARRAY_TYPE:
-      DescriptorArray::cast(*this).DescriptorArrayVerify(isolate);
-      break;
     case TRANSITION_ARRAY_TYPE:
       TransitionArray::cast(*this).TransitionArrayVerify(isolate);
       break;
-    case PROPERTY_ARRAY_TYPE:
-      PropertyArray::cast(*this).PropertyArrayVerify(isolate);
-      break;
-    case FREE_SPACE_TYPE:
-      FreeSpace::cast(*this).FreeSpaceVerify(isolate);
-      break;
-    case FEEDBACK_CELL_TYPE:
-      FeedbackCell::cast(*this).FeedbackCellVerify(isolate);
-      break;
-    case FEEDBACK_VECTOR_TYPE:
-      FeedbackVector::cast(*this).FeedbackVectorVerify(isolate);
-      break;
 
     case CODE_TYPE:
       Code::cast(*this).CodeVerify(isolate);
       break;
-    case ODDBALL_TYPE:
-      Oddball::cast(*this).OddballVerify(isolate);
-      break;
     case JS_OBJECT_TYPE:
     case JS_ERROR_TYPE:
     case JS_API_OBJECT_TYPE:
@@ -259,72 +214,12 @@ void HeapObject::HeapObjectVerify(Isolate* isolate) {
     case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
       JSObject::cast(*this).JSObjectVerify(isolate);
       break;
-    case WASM_MODULE_OBJECT_TYPE:
-      WasmModuleObject::cast(*this).WasmModuleObjectVerify(isolate);
-      break;
-    case WASM_TABLE_OBJECT_TYPE:
-      WasmTableObject::cast(*this).WasmTableObjectVerify(isolate);
-      break;
-    case WASM_MEMORY_OBJECT_TYPE:
-      WasmMemoryObject::cast(*this).WasmMemoryObjectVerify(isolate);
-      break;
-    case WASM_GLOBAL_OBJECT_TYPE:
-      WasmGlobalObject::cast(*this).WasmGlobalObjectVerify(isolate);
-      break;
-    case WASM_EXCEPTION_OBJECT_TYPE:
-      WasmExceptionObject::cast(*this).WasmExceptionObjectVerify(isolate);
-      break;
     case WASM_INSTANCE_OBJECT_TYPE:
       WasmInstanceObject::cast(*this).WasmInstanceObjectVerify(isolate);
       break;
-    case JS_ARGUMENTS_OBJECT_TYPE:
-      JSArgumentsObject::cast(*this).JSArgumentsObjectVerify(isolate);
-      break;
     case JS_GENERATOR_OBJECT_TYPE:
       JSGeneratorObject::cast(*this).JSGeneratorObjectVerify(isolate);
       break;
-    case JS_ASYNC_FUNCTION_OBJECT_TYPE:
-      JSAsyncFunctionObject::cast(*this).JSAsyncFunctionObjectVerify(isolate);
-      break;
-    case JS_ASYNC_GENERATOR_OBJECT_TYPE:
-      JSAsyncGeneratorObject::cast(*this).JSAsyncGeneratorObjectVerify(isolate);
-      break;
-    case JS_PRIMITIVE_WRAPPER_TYPE:
-      JSPrimitiveWrapper::cast(*this).JSPrimitiveWrapperVerify(isolate);
-      break;
-    case JS_DATE_TYPE:
-      JSDate::cast(*this).JSDateVerify(isolate);
-      break;
-    case JS_BOUND_FUNCTION_TYPE:
-      JSBoundFunction::cast(*this).JSBoundFunctionVerify(isolate);
-      break;
-    case JS_FUNCTION_TYPE:
-      JSFunction::cast(*this).JSFunctionVerify(isolate);
-      break;
-    case JS_GLOBAL_PROXY_TYPE:
-      JSGlobalProxy::cast(*this).JSGlobalProxyVerify(isolate);
-      break;
-    case JS_GLOBAL_OBJECT_TYPE:
-      JSGlobalObject::cast(*this).JSGlobalObjectVerify(isolate);
-      break;
-    case CELL_TYPE:
-      Cell::cast(*this).CellVerify(isolate);
-      break;
-    case PROPERTY_CELL_TYPE:
-      PropertyCell::cast(*this).PropertyCellVerify(isolate);
-      break;
-    case JS_ARRAY_TYPE:
-      JSArray::cast(*this).JSArrayVerify(isolate);
-      break;
-    case JS_MODULE_NAMESPACE_TYPE:
-      JSModuleNamespace::cast(*this).JSModuleNamespaceVerify(isolate);
-      break;
-    case JS_SET_TYPE:
-      JSSet::cast(*this).JSSetVerify(isolate);
-      break;
-    case JS_MAP_TYPE:
-      JSMap::cast(*this).JSMapVerify(isolate);
-      break;
     case JS_SET_KEY_VALUE_ITERATOR_TYPE:
     case JS_SET_VALUE_ITERATOR_TYPE:
       JSSetIterator::cast(*this).JSSetIteratorVerify(isolate);
@@ -334,136 +229,20 @@ void HeapObject::HeapObjectVerify(Isolate* isolate) {
     case JS_MAP_VALUE_ITERATOR_TYPE:
       JSMapIterator::cast(*this).JSMapIteratorVerify(isolate);
       break;
-    case JS_ARRAY_ITERATOR_TYPE:
-      JSArrayIterator::cast(*this).JSArrayIteratorVerify(isolate);
-      break;
-    case JS_STRING_ITERATOR_TYPE:
-      JSStringIterator::cast(*this).JSStringIteratorVerify(isolate);
-      break;
-    case JS_ASYNC_FROM_SYNC_ITERATOR_TYPE:
-      JSAsyncFromSyncIterator::cast(*this).JSAsyncFromSyncIteratorVerify(
-          isolate);
-      break;
-    case WEAK_CELL_TYPE:
-      WeakCell::cast(*this).WeakCellVerify(isolate);
-      break;
-    case JS_WEAK_REF_TYPE:
-      JSWeakRef::cast(*this).JSWeakRefVerify(isolate);
-      break;
-    case JS_FINALIZATION_GROUP_TYPE:
-      JSFinalizationGroup::cast(*this).JSFinalizationGroupVerify(isolate);
-      break;
-    case JS_FINALIZATION_GROUP_CLEANUP_ITERATOR_TYPE:
-      JSFinalizationGroupCleanupIterator::cast(*this)
-          .JSFinalizationGroupCleanupIteratorVerify(isolate);
-      break;
-    case JS_WEAK_MAP_TYPE:
-      JSWeakMap::cast(*this).JSWeakMapVerify(isolate);
-      break;
-    case JS_WEAK_SET_TYPE:
-      JSWeakSet::cast(*this).JSWeakSetVerify(isolate);
-      break;
-    case JS_PROMISE_TYPE:
-      JSPromise::cast(*this).JSPromiseVerify(isolate);
-      break;
-    case JS_REG_EXP_TYPE:
-      JSRegExp::cast(*this).JSRegExpVerify(isolate);
-      break;
-    case JS_REG_EXP_STRING_ITERATOR_TYPE:
-      JSRegExpStringIterator::cast(*this).JSRegExpStringIteratorVerify(isolate);
-      break;
     case FILLER_TYPE:
       break;
-    case JS_PROXY_TYPE:
-      JSProxy::cast(*this).JSProxyVerify(isolate);
-      break;
-    case FOREIGN_TYPE:
-      Foreign::cast(*this).ForeignVerify(isolate);
-      break;
-    case PREPARSE_DATA_TYPE:
-      PreparseData::cast(*this).PreparseDataVerify(isolate);
-      break;
-    case UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE:
-      UncompiledDataWithoutPreparseData::cast(*this)
-          .UncompiledDataWithoutPreparseDataVerify(isolate);
-      break;
-    case UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE:
-      UncompiledDataWithPreparseData::cast(*this)
-          .UncompiledDataWithPreparseDataVerify(isolate);
-      break;
-    case SHARED_FUNCTION_INFO_TYPE:
-      SharedFunctionInfo::cast(*this).SharedFunctionInfoVerify(isolate);
-      break;
-    case JS_MESSAGE_OBJECT_TYPE:
-      JSMessageObject::cast(*this).JSMessageObjectVerify(isolate);
-      break;
-    case JS_ARRAY_BUFFER_TYPE:
-      JSArrayBuffer::cast(*this).JSArrayBufferVerify(isolate);
-      break;
-    case JS_TYPED_ARRAY_TYPE:
-      JSTypedArray::cast(*this).JSTypedArrayVerify(isolate);
-      break;
-    case JS_DATA_VIEW_TYPE:
-      JSDataView::cast(*this).JSDataViewVerify(isolate);
-      break;
-    case SMALL_ORDERED_HASH_SET_TYPE:
-      SmallOrderedHashSet::cast(*this).SmallOrderedHashSetVerify(isolate);
-      break;
-    case SMALL_ORDERED_HASH_MAP_TYPE:
-      SmallOrderedHashMap::cast(*this).SmallOrderedHashMapVerify(isolate);
-      break;
-    case SMALL_ORDERED_NAME_DICTIONARY_TYPE:
-      SmallOrderedNameDictionary::cast(*this).SmallOrderedNameDictionaryVerify(
-          isolate);
-      break;
-    case SOURCE_TEXT_MODULE_TYPE:
-      SourceTextModule::cast(*this).SourceTextModuleVerify(isolate);
-      break;
-    case SYNTHETIC_MODULE_TYPE:
-      SyntheticModule::cast(*this).SyntheticModuleVerify(isolate);
-      break;
     case CODE_DATA_CONTAINER_TYPE:
       CodeDataContainer::cast(*this).CodeDataContainerVerify(isolate);
       break;
-#ifdef V8_INTL_SUPPORT
-    case JS_V8_BREAK_ITERATOR_TYPE:
-      JSV8BreakIterator::cast(*this).JSV8BreakIteratorVerify(isolate);
-      break;
-    case JS_COLLATOR_TYPE:
-      JSCollator::cast(*this).JSCollatorVerify(isolate);
-      break;
-    case JS_DATE_TIME_FORMAT_TYPE:
-      JSDateTimeFormat::cast(*this).JSDateTimeFormatVerify(isolate);
-      break;
-    case JS_LIST_FORMAT_TYPE:
-      JSListFormat::cast(*this).JSListFormatVerify(isolate);
-      break;
-    case JS_LOCALE_TYPE:
-      JSLocale::cast(*this).JSLocaleVerify(isolate);
-      break;
-    case JS_NUMBER_FORMAT_TYPE:
-      JSNumberFormat::cast(*this).JSNumberFormatVerify(isolate);
-      break;
-    case JS_PLURAL_RULES_TYPE:
-      JSPluralRules::cast(*this).JSPluralRulesVerify(isolate);
-      break;
-    case JS_RELATIVE_TIME_FORMAT_TYPE:
-      JSRelativeTimeFormat::cast(*this).JSRelativeTimeFormatVerify(isolate);
-      break;
-    case JS_SEGMENT_ITERATOR_TYPE:
-      JSSegmentIterator::cast(*this).JSSegmentIteratorVerify(isolate);
-      break;
-    case JS_SEGMENTER_TYPE:
-      JSSegmenter::cast(*this).JSSegmenterVerify(isolate);
-      break;
-#endif  // V8_INTL_SUPPORT
 
-#define MAKE_STRUCT_CASE(TYPE, Name, name)   \
+#define MAKE_TORQUE_CASE(Name, TYPE)         \
   case TYPE:                                 \
     Name::cast(*this).Name##Verify(isolate); \
     break;
-      STRUCT_LIST(MAKE_STRUCT_CASE)
-#undef MAKE_STRUCT_CASE
+      // Every class that has its fields defined in a .tq file and corresponds
+      // to exactly one InstanceType value is included in the following list.
+      TORQUE_INSTANCE_CHECKERS_SINGLE_FULLY_DEFINED(MAKE_TORQUE_CASE)
+#undef MAKE_TORQUE_CASE
 
     case ALLOCATION_SITE_TYPE:
       AllocationSite::cast(*this).AllocationSiteVerify(isolate);
@@ -489,8 +268,9 @@ void Symbol::SymbolVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::SymbolVerify(*this, isolate);
   CHECK(HasHashCode());
   CHECK_GT(Hash(), 0);
-  CHECK(name().IsUndefined(isolate) || name().IsString());
+  CHECK(description().IsUndefined(isolate) || description().IsString());
   CHECK_IMPLIES(IsPrivateName(), IsPrivate());
+  CHECK_IMPLIES(IsPrivateBrand(), IsPrivateName());
 }
 
 USE_TORQUE_VERIFIER(ByteArray)
@@ -506,23 +286,19 @@ void BytecodeArray::BytecodeArrayVerify(Isolate* isolate) {
   VerifyHeapPointer(isolate, constant_pool());
   CHECK(source_position_table().IsUndefined() ||
         source_position_table().IsException() ||
-        source_position_table().IsByteArray() ||
-        source_position_table().IsSourcePositionTableWithFrameCache());
+        source_position_table().IsByteArray());
   CHECK(handler_table().IsByteArray());
 }
 
 USE_TORQUE_VERIFIER(FreeSpace)
 
-void FeedbackVector::FeedbackVectorVerify(Isolate* isolate) {
-  TorqueGeneratedClassVerifiers::FeedbackVectorVerify(*this, isolate);
-  MaybeObject code = optimized_code_weak_or_smi();
-  MaybeObject::VerifyMaybeObjectPointer(isolate, code);
-  CHECK(code->IsSmi() || code->IsWeakOrCleared());
-}
+USE_TORQUE_VERIFIER(HeapNumber)
+
+USE_TORQUE_VERIFIER(FeedbackVector)
 
 USE_TORQUE_VERIFIER(JSReceiver)
 
-bool JSObject::ElementsAreSafeToExamine(Isolate* isolate) const {
+bool JSObject::ElementsAreSafeToExamine(const Isolate* isolate) const {
   // If a GC was caused while constructing this object, the elements
   // pointer may point to a one pointer filler map.
   return elements(isolate) !=
@@ -652,8 +428,37 @@ void Map::MapVerify(Isolate* isolate) {
   CHECK(instance_size() == kVariableSizeSentinel ||
         (kTaggedSize <= instance_size() &&
          static_cast<size_t>(instance_size()) < heap->Capacity()));
-  CHECK(GetBackPointer().IsUndefined(isolate) ||
-        !Map::cast(GetBackPointer()).is_stable());
+  if (IsContextMap()) {
+    CHECK(native_context().IsNativeContext());
+  } else {
+    if (GetBackPointer().IsUndefined(isolate)) {
+      // Root maps must not have descriptors in the descriptor array that do not
+      // belong to the map.
+      CHECK_EQ(NumberOfOwnDescriptors(),
+               instance_descriptors().number_of_descriptors());
+    } else {
+      // If there is a parent map it must be non-stable.
+      Map parent = Map::cast(GetBackPointer());
+      CHECK(!parent.is_stable());
+      DescriptorArray descriptors = instance_descriptors();
+      if (descriptors == parent.instance_descriptors()) {
+        if (NumberOfOwnDescriptors() == parent.NumberOfOwnDescriptors() + 1) {
+          // Descriptors sharing through property transitions takes over
+          // ownership from the parent map.
+          CHECK(!parent.owns_descriptors());
+        } else {
+          CHECK_EQ(NumberOfOwnDescriptors(), parent.NumberOfOwnDescriptors());
+          // Descriptors sharing through special transitions properly takes over
+          // ownership from the parent map unless it uses the canonical empty
+          // descriptor array.
+          if (descriptors != ReadOnlyRoots(isolate).empty_descriptor_array()) {
+            CHECK_IMPLIES(owns_descriptors(), !parent.owns_descriptors());
+            CHECK_IMPLIES(parent.owns_descriptors(), !owns_descriptors());
+          }
+        }
+      }
+    }
+  }
   SLOW_DCHECK(instance_descriptors().IsSortedNoDuplicates());
   DisallowHeapAllocation no_gc;
   SLOW_DCHECK(
@@ -662,6 +467,9 @@ void Map::MapVerify(Isolate* isolate) {
                   .IsConsistentWithBackPointers());
   SLOW_DCHECK(!FLAG_unbox_double_fields ||
               layout_descriptor().IsConsistentWithMap(*this));
+  // Only JSFunction maps have has_prototype_slot() bit set and constructible
+  // JSFunction objects must have prototype slot.
+  CHECK_IMPLIES(has_prototype_slot(), instance_type() == JS_FUNCTION_TYPE);
   if (!may_have_interesting_symbols()) {
     CHECK(!has_named_interceptor());
     CHECK(!is_dictionary_map());
@@ -680,7 +488,7 @@ void Map::MapVerify(Isolate* isolate) {
                     IsAnyHoleyNonextensibleElementsKind(elements_kind()));
   CHECK_IMPLIES(is_deprecated(), !is_stable());
   if (is_prototype_map()) {
-    DCHECK(prototype_info() == Smi::kZero ||
+    DCHECK(prototype_info() == Smi::zero() ||
            prototype_info().IsPrototypeInfo());
   }
 }
@@ -716,13 +524,7 @@ void WeakFixedArray::WeakFixedArrayVerify(Isolate* isolate) {
   }
 }
 
-void WeakArrayList::WeakArrayListVerify(Isolate* isolate) {
-  VerifySmiField(kCapacityOffset);
-  VerifySmiField(kLengthOffset);
-  for (int i = 0; i < length(); i++) {
-    MaybeObject::VerifyMaybeObjectPointer(isolate, Get(i));
-  }
-}
+USE_TORQUE_VERIFIER(WeakArrayList)
 
 void PropertyArray::PropertyArrayVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::PropertyArrayVerify(*this, isolate);
@@ -783,13 +585,6 @@ void FeedbackMetadata::FeedbackMetadataVerify(Isolate* isolate) {
 
 void DescriptorArray::DescriptorArrayVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::DescriptorArrayVerify(*this, isolate);
-  for (int i = 0; i < number_of_all_descriptors(); i++) {
-    MaybeObjectSlot slot(GetDescriptorSlot(i));
-    MaybeObject::VerifyMaybeObjectPointer(isolate, *(slot + kEntryKeyIndex));
-    MaybeObject::VerifyMaybeObjectPointer(isolate,
-                                          *(slot + kEntryDetailsIndex));
-    MaybeObject::VerifyMaybeObjectPointer(isolate, *(slot + kEntryValueIndex));
-  }
   if (number_of_all_descriptors() == 0) {
     CHECK_EQ(ReadOnlyRoots(isolate).empty_descriptor_array(), *this);
     CHECK_EQ(0, number_of_all_descriptors());
@@ -1148,7 +943,13 @@ void Code::CodeVerify(Isolate* isolate) {
   CHECK_LE(handler_table_offset(), constant_pool_offset());
   CHECK_LE(constant_pool_offset(), code_comments_offset());
   CHECK_LE(code_comments_offset(), InstructionSize());
-  CHECK(IsAligned(raw_instruction_start(), kCodeAlignment));
+  CHECK_IMPLIES(!ReadOnlyHeap::Contains(*this),
+                IsAligned(raw_instruction_start(), kCodeAlignment));
+  // TODO(delphick): Refactor Factory::CodeBuilder::BuildInternal, so that the
+  // following CHECK works builtin trampolines. It currently fails because
+  // CodeVerify is called halfway through constructing the trampoline and so not
+  // everything is set up.
+  // CHECK_EQ(ReadOnlyHeap::Contains(*this), !IsExecutable());
   relocation_info().ObjectVerify(isolate);
   CHECK(Code::SizeFor(body_size()) <= kMaxRegularHeapObjectSize ||
         isolate->heap()->InSpace(*this, CODE_LO_SPACE));
@@ -1247,9 +1048,9 @@ void WeakCell::WeakCellVerify(Isolate* isolate) {
     CHECK_EQ(WeakCell::cast(next()).prev(), *this);
   }
 
-  CHECK_IMPLIES(key().IsUndefined(isolate),
+  CHECK_IMPLIES(unregister_token().IsUndefined(isolate),
                 key_list_prev().IsUndefined(isolate));
-  CHECK_IMPLIES(key().IsUndefined(isolate),
+  CHECK_IMPLIES(unregister_token().IsUndefined(isolate),
                 key_list_next().IsUndefined(isolate));
 
   CHECK(key_list_prev().IsWeakCell() || key_list_prev().IsUndefined(isolate));
@@ -1449,6 +1250,7 @@ void JSRegExp::JSRegExpVerify(Isolate* isolate) {
       CHECK(arr.get(JSRegExp::kIrregexpCaptureCountIndex).IsSmi());
       CHECK(arr.get(JSRegExp::kIrregexpMaxRegisterCountIndex).IsSmi());
       CHECK(arr.get(JSRegExp::kIrregexpTicksUntilTierUpIndex).IsSmi());
+      CHECK(arr.get(JSRegExp::kIrregexpBacktrackLimit).IsSmi());
       break;
     }
     default:
@@ -1509,8 +1311,8 @@ void AsyncGeneratorRequest::AsyncGeneratorRequestVerify(Isolate* isolate) {
   next().ObjectVerify(isolate);
 }
 
-void BigInt::BigIntVerify(Isolate* isolate) {
-  CHECK(IsBigInt());
+void BigIntBase::BigIntBaseVerify(Isolate* isolate) {
+  TorqueGeneratedClassVerifiers::BigIntBaseVerify(*this, isolate);
   CHECK_GE(length(), 0);
   CHECK_IMPLIES(is_zero(), !sign());  // There is no -0n.
 }
@@ -1706,7 +1508,7 @@ void AllocationSite::AllocationSiteVerify(Isolate* isolate) {
   CHECK(dependent_code().IsDependentCode());
   CHECK(transition_info_or_boilerplate().IsSmi() ||
         transition_info_or_boilerplate().IsJSObject());
-  CHECK(nested_site().IsAllocationSite() || nested_site() == Smi::kZero);
+  CHECK(nested_site().IsAllocationSite() || nested_site() == Smi::zero());
 }
 
 USE_TORQUE_VERIFIER(AllocationMemento)
@@ -1762,6 +1564,8 @@ USE_TORQUE_VERIFIER(JSCollator)
 
 USE_TORQUE_VERIFIER(JSDateTimeFormat)
 
+USE_TORQUE_VERIFIER(JSDisplayNames)
+
 USE_TORQUE_VERIFIER(JSListFormat)
 
 USE_TORQUE_VERIFIER(JSLocale)
diff --git a/deps/v8/src/diagnostics/objects-printer.cc b/deps/v8/src/diagnostics/objects-printer.cc
index 20afb9e5204d84..9dae2881b9e781 100644
--- a/deps/v8/src/diagnostics/objects-printer.cc
+++ b/deps/v8/src/diagnostics/objects-printer.cc
@@ -35,6 +35,7 @@
 #include "src/objects/js-collection-inl.h"
 #ifdef V8_INTL_SUPPORT
 #include "src/objects/js-date-time-format-inl.h"
+#include "src/objects/js-display-names-inl.h"
 #endif  // V8_INTL_SUPPORT
 #include "src/objects/js-generator-inl.h"
 #ifdef V8_INTL_SUPPORT
@@ -57,6 +58,7 @@
 #include "src/objects/module-inl.h"
 #include "src/objects/oddball-inl.h"
 #include "src/objects/promise-inl.h"
+#include "src/objects/property-descriptor-object-inl.h"
 #include "src/objects/stack-frame-info-inl.h"
 #include "src/objects/struct-inl.h"
 #include "src/objects/template-objects-inl.h"
@@ -120,26 +122,6 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
   }
 
   switch (instance_type) {
-    case SYMBOL_TYPE:
-      Symbol::cast(*this).SymbolPrint(os);
-      break;
-    case MAP_TYPE:
-      Map::cast(*this).MapPrint(os);
-      break;
-    case HEAP_NUMBER_TYPE:
-      HeapNumber::cast(*this).HeapNumberPrint(os);
-      os << "\n";
-      break;
-    case BIGINT_TYPE:
-      BigInt::cast(*this).BigIntPrint(os);
-      os << "\n";
-      break;
-    case EMBEDDER_DATA_ARRAY_TYPE:
-      EmbedderDataArray::cast(*this).EmbedderDataArrayPrint(os);
-      break;
-    case FIXED_DOUBLE_ARRAY_TYPE:
-      FixedDoubleArray::cast(*this).FixedDoubleArrayPrint(os);
-      break;
     case FIXED_ARRAY_TYPE:
       FixedArray::cast(*this).FixedArrayPrint(os);
       break;
@@ -180,33 +162,12 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
       ObjectBoilerplateDescription::cast(*this)
           .ObjectBoilerplateDescriptionPrint(os);
       break;
-    case PROPERTY_ARRAY_TYPE:
-      PropertyArray::cast(*this).PropertyArrayPrint(os);
-      break;
-    case BYTE_ARRAY_TYPE:
-      ByteArray::cast(*this).ByteArrayPrint(os);
-      break;
-    case BYTECODE_ARRAY_TYPE:
-      BytecodeArray::cast(*this).BytecodeArrayPrint(os);
-      break;
-    case DESCRIPTOR_ARRAY_TYPE:
-      DescriptorArray::cast(*this).DescriptorArrayPrint(os);
-      break;
     case TRANSITION_ARRAY_TYPE:
       TransitionArray::cast(*this).TransitionArrayPrint(os);
       break;
-    case FEEDBACK_CELL_TYPE:
-      FeedbackCell::cast(*this).FeedbackCellPrint(os);
-      break;
     case CLOSURE_FEEDBACK_CELL_ARRAY_TYPE:
       ClosureFeedbackCellArray::cast(*this).ClosureFeedbackCellArrayPrint(os);
       break;
-    case FEEDBACK_VECTOR_TYPE:
-      FeedbackVector::cast(*this).FeedbackVectorPrint(os);
-      break;
-    case FREE_SPACE_TYPE:
-      FreeSpace::cast(*this).FreeSpacePrint(os);
-      break;
 
     case FILLER_TYPE:
       os << "filler";
@@ -215,80 +176,21 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
     case JS_API_OBJECT_TYPE:
     case JS_SPECIAL_API_OBJECT_TYPE:
     case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
-    case JS_ARGUMENTS_OBJECT_TYPE:
     case JS_ERROR_TYPE:
-    // TODO(titzer): debug printing for more wasm objects
-    case WASM_EXCEPTION_OBJECT_TYPE:
       JSObject::cast(*this).JSObjectPrint(os);
       break;
-    case WASM_MODULE_OBJECT_TYPE:
-      WasmModuleObject::cast(*this).WasmModuleObjectPrint(os);
-      break;
-    case WASM_MEMORY_OBJECT_TYPE:
-      WasmMemoryObject::cast(*this).WasmMemoryObjectPrint(os);
-      break;
-    case WASM_TABLE_OBJECT_TYPE:
-      WasmTableObject::cast(*this).WasmTableObjectPrint(os);
-      break;
-    case WASM_GLOBAL_OBJECT_TYPE:
-      WasmGlobalObject::cast(*this).WasmGlobalObjectPrint(os);
-      break;
     case WASM_INSTANCE_OBJECT_TYPE:
       WasmInstanceObject::cast(*this).WasmInstanceObjectPrint(os);
       break;
-    case JS_ASYNC_FUNCTION_OBJECT_TYPE:
-    case JS_ASYNC_GENERATOR_OBJECT_TYPE:
     case JS_GENERATOR_OBJECT_TYPE:
       JSGeneratorObject::cast(*this).JSGeneratorObjectPrint(os);
       break;
-    case JS_PROMISE_TYPE:
-      JSPromise::cast(*this).JSPromisePrint(os);
-      break;
-    case JS_ARRAY_TYPE:
-      JSArray::cast(*this).JSArrayPrint(os);
-      break;
-    case JS_REG_EXP_TYPE:
-      JSRegExp::cast(*this).JSRegExpPrint(os);
-      break;
-    case JS_REG_EXP_STRING_ITERATOR_TYPE:
-      JSRegExpStringIterator::cast(*this).JSRegExpStringIteratorPrint(os);
-      break;
-    case ODDBALL_TYPE:
-      Oddball::cast(*this).to_string().Print(os);
-      break;
-    case JS_BOUND_FUNCTION_TYPE:
-      JSBoundFunction::cast(*this).JSBoundFunctionPrint(os);
-      break;
-    case JS_FUNCTION_TYPE:
-      JSFunction::cast(*this).JSFunctionPrint(os);
-      break;
-    case JS_GLOBAL_PROXY_TYPE:
-      JSGlobalProxy::cast(*this).JSGlobalProxyPrint(os);
-      break;
-    case JS_GLOBAL_OBJECT_TYPE:
-      JSGlobalObject::cast(*this).JSGlobalObjectPrint(os);
-      break;
-    case JS_PRIMITIVE_WRAPPER_TYPE:
-      JSPrimitiveWrapper::cast(*this).JSPrimitiveWrapperPrint(os);
-      break;
-    case JS_DATE_TYPE:
-      JSDate::cast(*this).JSDatePrint(os);
-      break;
     case CODE_TYPE:
       Code::cast(*this).CodePrint(os);
       break;
     case CODE_DATA_CONTAINER_TYPE:
       CodeDataContainer::cast(*this).CodeDataContainerPrint(os);
       break;
-    case JS_PROXY_TYPE:
-      JSProxy::cast(*this).JSProxyPrint(os);
-      break;
-    case JS_SET_TYPE:
-      JSSet::cast(*this).JSSetPrint(os);
-      break;
-    case JS_MAP_TYPE:
-      JSMap::cast(*this).JSMapPrint(os);
-      break;
     case JS_SET_KEY_VALUE_ITERATOR_TYPE:
     case JS_SET_VALUE_ITERATOR_TYPE:
       JSSetIterator::cast(*this).JSSetIteratorPrint(os);
@@ -298,107 +200,14 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
     case JS_MAP_VALUE_ITERATOR_TYPE:
       JSMapIterator::cast(*this).JSMapIteratorPrint(os);
       break;
-    case WEAK_CELL_TYPE:
-      WeakCell::cast(*this).WeakCellPrint(os);
-      break;
-    case JS_WEAK_REF_TYPE:
-      JSWeakRef::cast(*this).JSWeakRefPrint(os);
-      break;
-    case JS_FINALIZATION_GROUP_TYPE:
-      JSFinalizationGroup::cast(*this).JSFinalizationGroupPrint(os);
-      break;
-    case JS_FINALIZATION_GROUP_CLEANUP_ITERATOR_TYPE:
-      JSFinalizationGroupCleanupIterator::cast(*this)
-          .JSFinalizationGroupCleanupIteratorPrint(os);
-      break;
-    case JS_WEAK_MAP_TYPE:
-      JSWeakMap::cast(*this).JSWeakMapPrint(os);
-      break;
-    case JS_WEAK_SET_TYPE:
-      JSWeakSet::cast(*this).JSWeakSetPrint(os);
-      break;
-    case JS_MODULE_NAMESPACE_TYPE:
-      JSModuleNamespace::cast(*this).JSModuleNamespacePrint(os);
-      break;
-    case FOREIGN_TYPE:
-      Foreign::cast(*this).ForeignPrint(os);
-      break;
-    case CALL_HANDLER_INFO_TYPE:
-      CallHandlerInfo::cast(*this).CallHandlerInfoPrint(os);
-      break;
-    case PREPARSE_DATA_TYPE:
-      PreparseData::cast(*this).PreparseDataPrint(os);
-      break;
-    case UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE:
-      UncompiledDataWithoutPreparseData::cast(*this)
-          .UncompiledDataWithoutPreparseDataPrint(os);
-      break;
-    case UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE:
-      UncompiledDataWithPreparseData::cast(*this)
-          .UncompiledDataWithPreparseDataPrint(os);
-      break;
-    case SHARED_FUNCTION_INFO_TYPE:
-      SharedFunctionInfo::cast(*this).SharedFunctionInfoPrint(os);
-      break;
-    case JS_MESSAGE_OBJECT_TYPE:
-      JSMessageObject::cast(*this).JSMessageObjectPrint(os);
-      break;
-    case CELL_TYPE:
-      Cell::cast(*this).CellPrint(os);
-      break;
-    case PROPERTY_CELL_TYPE:
-      PropertyCell::cast(*this).PropertyCellPrint(os);
-      break;
-    case JS_ARRAY_BUFFER_TYPE:
-      JSArrayBuffer::cast(*this).JSArrayBufferPrint(os);
-      break;
-    case JS_ARRAY_ITERATOR_TYPE:
-      JSArrayIterator::cast(*this).JSArrayIteratorPrint(os);
-      break;
-    case JS_TYPED_ARRAY_TYPE:
-      JSTypedArray::cast(*this).JSTypedArrayPrint(os);
-      break;
-    case JS_DATA_VIEW_TYPE:
-      JSDataView::cast(*this).JSDataViewPrint(os);
-      break;
-#ifdef V8_INTL_SUPPORT
-    case JS_V8_BREAK_ITERATOR_TYPE:
-      JSV8BreakIterator::cast(*this).JSV8BreakIteratorPrint(os);
-      break;
-    case JS_COLLATOR_TYPE:
-      JSCollator::cast(*this).JSCollatorPrint(os);
-      break;
-    case JS_DATE_TIME_FORMAT_TYPE:
-      JSDateTimeFormat::cast(*this).JSDateTimeFormatPrint(os);
-      break;
-    case JS_LIST_FORMAT_TYPE:
-      JSListFormat::cast(*this).JSListFormatPrint(os);
-      break;
-    case JS_LOCALE_TYPE:
-      JSLocale::cast(*this).JSLocalePrint(os);
-      break;
-    case JS_NUMBER_FORMAT_TYPE:
-      JSNumberFormat::cast(*this).JSNumberFormatPrint(os);
-      break;
-    case JS_PLURAL_RULES_TYPE:
-      JSPluralRules::cast(*this).JSPluralRulesPrint(os);
-      break;
-    case JS_RELATIVE_TIME_FORMAT_TYPE:
-      JSRelativeTimeFormat::cast(*this).JSRelativeTimeFormatPrint(os);
-      break;
-    case JS_SEGMENT_ITERATOR_TYPE:
-      JSSegmentIterator::cast(*this).JSSegmentIteratorPrint(os);
-      break;
-    case JS_SEGMENTER_TYPE:
-      JSSegmenter::cast(*this).JSSegmenterPrint(os);
-      break;
-#endif  // V8_INTL_SUPPORT
-#define MAKE_STRUCT_CASE(TYPE, Name, name) \
-  case TYPE:                               \
-    Name::cast(*this).Name##Print(os);     \
+#define MAKE_TORQUE_CASE(Name, TYPE)   \
+  case TYPE:                           \
+    Name::cast(*this).Name##Print(os); \
     break;
-      STRUCT_LIST(MAKE_STRUCT_CASE)
-#undef MAKE_STRUCT_CASE
+      // Every class that has its fields defined in a .tq file and corresponds
+      // to exactly one InstanceType value is included in the following list.
+      TORQUE_INSTANCE_CHECKERS_SINGLE_FULLY_DEFINED(MAKE_TORQUE_CASE)
+#undef MAKE_TORQUE_CASE
 
     case ALLOCATION_SITE_TYPE:
       AllocationSite::cast(*this).AllocationSitePrint(os);
@@ -412,21 +221,12 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
     case SCOPE_INFO_TYPE:
       ScopeInfo::cast(*this).ScopeInfoPrint(os);
       break;
-    case SOURCE_TEXT_MODULE_TYPE:
-      SourceTextModule::cast(*this).SourceTextModulePrint(os);
-      break;
-    case SYNTHETIC_MODULE_TYPE:
-      SyntheticModule::cast(*this).SyntheticModulePrint(os);
-      break;
     case FEEDBACK_METADATA_TYPE:
       FeedbackMetadata::cast(*this).FeedbackMetadataPrint(os);
       break;
     case WEAK_FIXED_ARRAY_TYPE:
       WeakFixedArray::cast(*this).WeakFixedArrayPrint(os);
       break;
-    case WEAK_ARRAY_LIST_TYPE:
-      WeakArrayList::cast(*this).WeakArrayListPrint(os);
-      break;
     case INTERNALIZED_STRING_TYPE:
     case EXTERNAL_INTERNALIZED_STRING_TYPE:
     case ONE_BYTE_INTERNALIZED_STRING_TYPE:
@@ -445,11 +245,6 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
     case THIN_ONE_BYTE_STRING_TYPE:
     case UNCACHED_EXTERNAL_STRING_TYPE:
     case UNCACHED_EXTERNAL_ONE_BYTE_STRING_TYPE:
-    case SMALL_ORDERED_HASH_MAP_TYPE:
-    case SMALL_ORDERED_HASH_SET_TYPE:
-    case SMALL_ORDERED_NAME_DICTIONARY_TYPE:
-    case JS_ASYNC_FROM_SYNC_ITERATOR_TYPE:
-    case JS_STRING_ITERATOR_TYPE:
       // TODO(all): Handle these types too.
       os << "UNKNOWN TYPE " << map().instance_type();
       UNREACHABLE();
@@ -477,8 +272,7 @@ bool JSObject::PrintProperties(std::ostream& os) {  // NOLINT
   if (HasFastProperties()) {
     DescriptorArray descs = map().instance_descriptors();
     int nof_inobject_properties = map().GetInObjectProperties();
-    for (InternalIndex i :
-         InternalIndex::Range(map().NumberOfOwnDescriptors())) {
+    for (InternalIndex i : map().IterateOwnDescriptors()) {
       os << "\n    ";
       descs.GetKey(i).NamePrint(os);
       os << ": ";
@@ -570,9 +364,15 @@ void DoPrintElements(std::ostream& os, Object object, int length) {  // NOLINT
 
 template <typename ElementType>
 void PrintTypedArrayElements(std::ostream& os, const ElementType* data_ptr,
-                             size_t length) {
+                             size_t length, bool is_on_heap) {
   if (length == 0) return;
   size_t previous_index = 0;
+  if (i::FLAG_mock_arraybuffer_allocator && !is_on_heap) {
+    // Don't try to print data that's not actually allocated.
+    os << "\n    0-" << length << ": <mocked array buffer bytes>";
+    return;
+  }
+
   ElementType previous_value = data_ptr[0];
   ElementType value = 0;
   for (size_t i = 1; i <= length; i++) {
@@ -586,7 +386,7 @@ void PrintTypedArrayElements(std::ostream& os, const ElementType* data_ptr,
     if (previous_index != i - 1) {
       ss << '-' << (i - 1);
     }
-    os << std::setw(12) << ss.str() << ": " << previous_value;
+    os << std::setw(12) << ss.str() << ": " << +previous_value;
     previous_index = i;
     previous_value = value;
   }
@@ -696,9 +496,10 @@ void JSObject::PrintElements(std::ostream& os) {  // NOLINT
 #define PRINT_ELEMENTS(Type, type, TYPE, elementType)                         \
   case TYPE##_ELEMENTS: {                                                     \
     size_t length = JSTypedArray::cast(*this).length();                       \
+    bool is_on_heap = JSTypedArray::cast(*this).is_on_heap();                 \
     const elementType* data_ptr =                                             \
         static_cast<const elementType*>(JSTypedArray::cast(*this).DataPtr()); \
-    PrintTypedArrayElements<elementType>(os, data_ptr, length);               \
+    PrintTypedArrayElements<elementType>(os, data_ptr, length, is_on_heap);   \
     break;                                                                    \
   }
       TYPED_ARRAYS(PRINT_ELEMENTS)
@@ -852,6 +653,7 @@ void JSPromise::JSPromisePrint(std::ostream& os) {  // NOLINT
     os << "\n - result: " << Brief(result());
   }
   os << "\n - has_handler: " << has_handler();
+  os << "\n - handled_hint: " << handled_hint();
   JSObjectPrintBody(os, *this);
 }
 
@@ -876,8 +678,8 @@ void JSRegExpStringIterator::JSRegExpStringIteratorPrint(
 void Symbol::SymbolPrint(std::ostream& os) {  // NOLINT
   PrintHeader(os, "Symbol");
   os << "\n - hash: " << Hash();
-  os << "\n - name: " << Brief(name());
-  if (name().IsUndefined()) {
+  os << "\n - description: " << Brief(description());
+  if (description().IsUndefined()) {
     os << " (" << PrivateSymbolToName() << ")";
   }
   os << "\n - private: " << is_private();
@@ -926,9 +728,9 @@ void PrintHashTableWithHeader(std::ostream& os, T table, const char* type) {
   os << "\n - capacity: " << table.Capacity();
 
   os << "\n - elements: {";
-  for (int i = 0; i < table.Capacity(); i++) {
+  for (InternalIndex i : table.IterateEntries()) {
     os << '\n'
-       << std::setw(12) << i << ": " << Brief(table.KeyAt(i)) << " -> "
+       << std::setw(12) << i.as_int() << ": " << Brief(table.KeyAt(i)) << " -> "
        << Brief(table.ValueAt(i));
   }
   os << "\n }\n";
@@ -984,7 +786,6 @@ void PrintContextWithHeader(std::ostream& os, Context context,
   os << "\n - length: " << context.length();
   os << "\n - scope_info: " << Brief(context.scope_info());
   os << "\n - previous: " << Brief(context.unchecked_previous());
-  os << "\n - extension: " << Brief(context.extension());
   os << "\n - native_context: " << Brief(context.native_context());
   PrintFixedArrayElements(os, context);
   os << "\n";
@@ -1197,6 +998,39 @@ void FeedbackNexus::Print(std::ostream& os) {  // NOLINT
   }
 }
 
+void Oddball::OddballPrint(std::ostream& os) {  // NOLINT
+  to_string().Print(os);
+}
+
+void JSAsyncFunctionObject::JSAsyncFunctionObjectPrint(
+    std::ostream& os) {  // NOLINT
+  JSGeneratorObjectPrint(os);
+}
+
+void JSAsyncGeneratorObject::JSAsyncGeneratorObjectPrint(
+    std::ostream& os) {  // NOLINT
+  JSGeneratorObjectPrint(os);
+}
+
+void JSArgumentsObject::JSArgumentsObjectPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrint(os);
+}
+
+void JSStringIterator::JSStringIteratorPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, *this, "JSStringIterator");
+  os << "\n - string: " << Brief(string());
+  os << "\n - index: " << index();
+  JSObjectPrintBody(os, *this);
+}
+
+void JSAsyncFromSyncIterator::JSAsyncFromSyncIteratorPrint(
+    std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, *this, "JSAsyncFromSyncIterator");
+  os << "\n - sync_iterator: " << Brief(sync_iterator());
+  os << "\n - next: " << Brief(next());
+  JSObjectPrintBody(os, *this);
+}
+
 void JSPrimitiveWrapper::JSPrimitiveWrapperPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, *this, "JSPrimitiveWrapper");
   os << "\n - value: " << Brief(value());
@@ -1321,7 +1155,7 @@ void WeakCell::WeakCellPrint(std::ostream& os) {
   os << "\n - holdings: " << Brief(holdings());
   os << "\n - prev: " << Brief(prev());
   os << "\n - next: " << Brief(next());
-  os << "\n - key: " << Brief(key());
+  os << "\n - unregister_token: " << Brief(unregister_token());
   os << "\n - key_list_prev: " << Brief(key_list_prev());
   os << "\n - key_list_next: " << Brief(key_list_next());
 }
@@ -1503,6 +1337,22 @@ void SharedFunctionInfo::PrintSourceCode(std::ostream& os) {
   }
 }
 
+void SmallOrderedHashSet::SmallOrderedHashSetPrint(std::ostream& os) {
+  PrintHeader(os, "SmallOrderedHashSet");
+  // TODO(tebbi): Print all fields.
+}
+
+void SmallOrderedHashMap::SmallOrderedHashMapPrint(std::ostream& os) {
+  PrintHeader(os, "SmallOrderedHashMap");
+  // TODO(tebbi): Print all fields.
+}
+
+void SmallOrderedNameDictionary::SmallOrderedNameDictionaryPrint(
+    std::ostream& os) {
+  PrintHeader(os, "SmallOrderedNameDictionary");
+  // TODO(tebbi): Print all fields.
+}
+
 void SharedFunctionInfo::SharedFunctionInfoPrint(std::ostream& os) {  // NOLINT
   PrintHeader(os, "SharedFunctionInfo");
   os << "\n - name: ";
@@ -1529,9 +1379,8 @@ void SharedFunctionInfo::SharedFunctionInfoPrint(std::ostream& os) {  // NOLINT
   os << "\n - data: " << Brief(function_data());
   os << "\n - code (from data): " << Brief(GetCode());
   PrintSourceCode(os);
-  // Script files are often large, hard to read.
-  // os << "\n - script =";
-  // script()->Print(os);
+  // Script files are often large, thus only print their {Brief} representation.
+  os << "\n - script: " << Brief(script());
   os << "\n - function token position: " << function_token_position();
   os << "\n - start position: " << StartPosition();
   os << "\n - end position: " << EndPosition();
@@ -1824,7 +1673,6 @@ void AsmWasmData::AsmWasmDataPrint(std::ostream& os) {  // NOLINT
   PrintHeader(os, "AsmWasmData");
   os << "\n - native module: " << Brief(managed_native_module());
   os << "\n - export_wrappers: " << Brief(export_wrappers());
-  os << "\n - offset table: " << Brief(asm_js_offset_table());
   os << "\n - uses bitset: " << uses_bitset().value();
   os << "\n";
 }
@@ -1913,9 +1761,6 @@ void WasmModuleObject::WasmModuleObjectPrint(std::ostream& os) {  // NOLINT
   os << "\n - native module: " << native_module();
   os << "\n - export wrappers: " << Brief(export_wrappers());
   os << "\n - script: " << Brief(script());
-  if (has_asm_js_offset_table()) {
-    os << "\n - asm_js_offset_table: " << Brief(asm_js_offset_table());
-  }
   os << "\n";
 }
 
@@ -2179,6 +2024,7 @@ void JSCollator::JSCollatorPrint(std::ostream& os) {  // NOLINT
 
 void JSDateTimeFormat::JSDateTimeFormatPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, *this, "JSDateTimeFormat");
+  os << "\n - locale: " << Brief(locale());
   os << "\n - icu locale: " << Brief(icu_locale());
   os << "\n - icu simple date format: " << Brief(icu_simple_date_format());
   os << "\n - icu date interval format: " << Brief(icu_date_interval_format());
@@ -2187,6 +2033,14 @@ void JSDateTimeFormat::JSDateTimeFormatPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintBody(os, *this);
 }
 
+void JSDisplayNames::JSDisplayNamesPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, *this, "JSDisplayNames");
+  os << "\n - internal: " << Brief(internal());
+  os << "\n - style: " << StyleAsString();
+  os << "\n - fallback: " << FallbackAsString();
+  JSObjectPrintBody(os, *this);
+}
+
 void JSListFormat::JSListFormatPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, *this, "JSListFormat");
   os << "\n - locale: " << Brief(locale());
@@ -2205,6 +2059,7 @@ void JSLocale::JSLocalePrint(std::ostream& os) {  // NOLINT
 void JSNumberFormat::JSNumberFormatPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, *this, "JSNumberFormat");
   os << "\n - locale: " << Brief(locale());
+  os << "\n - numberingSystem: " << Brief(numberingSystem());
   os << "\n - icu_number_formatter: " << Brief(icu_number_formatter());
   os << "\n - bound_format: " << Brief(bound_format());
   JSObjectPrintBody(os, *this);
@@ -2223,6 +2078,7 @@ void JSRelativeTimeFormat::JSRelativeTimeFormatPrint(
     std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, *this, "JSRelativeTimeFormat");
   os << "\n - locale: " << Brief(locale());
+  os << "\n - numberingSystem: " << Brief(numberingSystem());
   os << "\n - style: " << StyleAsString();
   os << "\n - numeric: " << NumericAsString();
   os << "\n - icu formatter: " << Brief(icu_formatter());
@@ -2282,14 +2138,13 @@ void ScopeInfo::ScopeInfoPrint(std::ostream& os) {  // NOLINT
   os << "\n - language mode: " << language_mode();
   if (is_declaration_scope()) os << "\n - declaration scope";
   if (HasReceiver()) {
-    os << "\n - receiver: " << ReceiverVariableField::decode(flags);
+    os << "\n - receiver: " << ReceiverVariableBits::decode(flags);
   }
   if (HasClassBrand()) os << "\n - has class brand";
   if (HasSavedClassVariableIndex()) os << "\n - has saved class variable index";
   if (HasNewTarget()) os << "\n - needs new target";
   if (HasFunctionName()) {
-    os << "\n - function name(" << FunctionVariableField::decode(flags)
-       << "): ";
+    os << "\n - function name(" << FunctionVariableBits::decode(flags) << "): ";
     FunctionName().ShortPrint(os);
   }
   if (IsAsmModule()) os << "\n - asm module";
@@ -2298,12 +2153,18 @@ void ScopeInfo::ScopeInfoPrint(std::ostream& os) {  // NOLINT
   if (HasOuterScopeInfo()) {
     os << "\n - outer scope info: " << Brief(OuterScopeInfo());
   }
+  if (HasLocalsBlackList()) {
+    os << "\n - locals blacklist: " << Brief(LocalsBlackList());
+  }
   if (HasFunctionName()) {
     os << "\n - function name: " << Brief(FunctionName());
   }
   if (HasInferredFunctionName()) {
     os << "\n - inferred function name: " << Brief(InferredFunctionName());
   }
+  if (HasContextExtensionSlot()) {
+    os << "\n - has context extension slot";
+  }
 
   if (HasPositionInfo()) {
     os << "\n - start position: " << StartPosition();
@@ -2460,9 +2321,31 @@ void TaggedImpl<kRefType, StorageType>::Print(std::ostream& os) {
   }
 }
 
+void HeapNumber::HeapNumberPrint(std::ostream& os) {
+  HeapNumberShortPrint(os);
+  os << "\n";
+}
+
 #endif  // OBJECT_PRINT
 
-void HeapNumber::HeapNumberPrint(std::ostream& os) { os << value(); }
+void HeapNumber::HeapNumberShortPrint(std::ostream& os) {
+  static constexpr uint64_t kUint64AllBitsSet =
+      static_cast<uint64_t>(int64_t{-1});
+  // Min/max integer values representable by 52 bits of mantissa and 1 sign bit.
+  static constexpr int64_t kMinSafeInteger =
+      static_cast<int64_t>(kUint64AllBitsSet << 53);
+  static constexpr int64_t kMaxSafeInteger = -(kMinSafeInteger + 1);
+
+  double val = value();
+  if (val == DoubleToInteger(val) &&
+      val >= static_cast<double>(kMinSafeInteger) &&
+      val <= static_cast<double>(kMaxSafeInteger)) {
+    int64_t i = static_cast<int64_t>(val);
+    os << i << ".0";
+  } else {
+    os << val;
+  }
+}
 
 // TODO(cbruni): remove once the new maptracer is in place.
 void Name::NameShortPrint() {
@@ -2471,10 +2354,10 @@ void Name::NameShortPrint() {
   } else {
     DCHECK(this->IsSymbol());
     Symbol s = Symbol::cast(*this);
-    if (s.name().IsUndefined()) {
+    if (s.description().IsUndefined()) {
       PrintF("#<%s>", s.PrivateSymbolToName());
     } else {
-      PrintF("<%s>", String::cast(s.name()).ToCString().get());
+      PrintF("<%s>", String::cast(s.description()).ToCString().get());
     }
   }
 }
@@ -2486,10 +2369,11 @@ int Name::NameShortPrint(Vector<char> str) {
   } else {
     DCHECK(this->IsSymbol());
     Symbol s = Symbol::cast(*this);
-    if (s.name().IsUndefined()) {
+    if (s.description().IsUndefined()) {
       return SNPrintF(str, "#<%s>", s.PrivateSymbolToName());
     } else {
-      return SNPrintF(str, "<%s>", String::cast(s.name()).ToCString().get());
+      return SNPrintF(str, "<%s>",
+                      String::cast(s.description()).ToCString().get());
     }
   }
 }
@@ -2540,7 +2424,9 @@ void Map::MapPrint(std::ostream& os) {  // NOLINT
   }
   if (is_access_check_needed()) os << "\n - access_check_needed";
   if (!is_extensible()) os << "\n - non-extensible";
-  if (is_prototype_map()) {
+  if (IsContextMap()) {
+    os << "\n - native context: " << Brief(native_context());
+  } else if (is_prototype_map()) {
     os << "\n - prototype_map";
     os << "\n - prototype info: " << Brief(prototype_info());
   } else {
@@ -2577,7 +2463,9 @@ void Map::MapPrint(std::ostream& os) {  // NOLINT
     }
   }
   os << "\n - prototype: " << Brief(prototype());
-  os << "\n - constructor: " << Brief(GetConstructor());
+  if (!IsContextMap()) {
+    os << "\n - constructor: " << Brief(GetConstructor());
+  }
   os << "\n - dependent code: " << Brief(dependent_code());
   os << "\n - construction counter: " << construction_counter();
   os << "\n";
@@ -2808,10 +2696,11 @@ V8_EXPORT_PRIVATE extern void _v8_internal_Print_Code(void* object) {
 
   if (!isolate->heap()->InSpaceSlow(address, i::CODE_SPACE) &&
       !isolate->heap()->InSpaceSlow(address, i::LO_SPACE) &&
-      !i::InstructionStream::PcIsOffHeap(isolate, address)) {
+      !i::InstructionStream::PcIsOffHeap(isolate, address) &&
+      !i::ReadOnlyHeap::Contains(address)) {
     i::PrintF(
-        "%p is not within the current isolate's large object, code or embedded "
-        "spaces\n",
+        "%p is not within the current isolate's large object, code, read_only "
+        "or embedded spaces\n",
         object);
     return;
   }
diff --git a/deps/v8/src/diagnostics/perf-jit.cc b/deps/v8/src/diagnostics/perf-jit.cc
index d84c2e4f53406a..9b42d68037cfe7 100644
--- a/deps/v8/src/diagnostics/perf-jit.cc
+++ b/deps/v8/src/diagnostics/perf-jit.cc
@@ -27,29 +27,26 @@
 
 #include "src/diagnostics/perf-jit.h"
 
+// Only compile the {PerfJitLogger} on Linux.
+#if V8_OS_LINUX
+
+#include <fcntl.h>
+#include <sys/mman.h>
+#include <unistd.h>
 #include <memory>
 
 #include "src/codegen/assembler.h"
 #include "src/codegen/source-position-table.h"
 #include "src/diagnostics/eh-frame.h"
 #include "src/objects/objects-inl.h"
+#include "src/objects/shared-function-info.h"
 #include "src/snapshot/embedded/embedded-data.h"
 #include "src/utils/ostreams.h"
 #include "src/wasm/wasm-code-manager.h"
 
-#if V8_OS_LINUX
-#include <fcntl.h>
-#include <sys/mman.h>
-// jumbo: conflicts with v8::internal::InstanceType::MAP_TYPE
-#undef MAP_TYPE  // NOLINT
-#include <unistd.h>
-#endif  // V8_OS_LINUX
-
 namespace v8 {
 namespace internal {
 
-#if V8_OS_LINUX
-
 struct PerfJitHeader {
   uint32_t magic_;
   uint32_t version_;
@@ -132,6 +129,11 @@ void PerfJitLogger::OpenJitDumpFile() {
   int fd = open(perf_dump_name.begin(), O_CREAT | O_TRUNC | O_RDWR, 0666);
   if (fd == -1) return;
 
+  // If --perf-prof-delete-file is given, unlink the file right after opening
+  // it. This keeps the file handle to the file valid. This only works on Linux,
+  // which is the only platform supported for --perf-prof anyway.
+  if (FLAG_perf_prof_delete_file) CHECK_EQ(0, unlink(perf_dump_name.begin()));
+
   marker_address_ = OpenMarkerFile(fd);
   if (marker_address_ == nullptr) return;
 
@@ -197,12 +199,13 @@ uint64_t PerfJitLogger::GetTimestamp() {
   return (ts.tv_sec * kNsecPerSec) + ts.tv_nsec;
 }
 
-void PerfJitLogger::LogRecordedBuffer(AbstractCode abstract_code,
-                                      SharedFunctionInfo shared,
-                                      const char* name, int length) {
+void PerfJitLogger::LogRecordedBuffer(
+    Handle<AbstractCode> abstract_code,
+    MaybeHandle<SharedFunctionInfo> maybe_shared, const char* name,
+    int length) {
   if (FLAG_perf_basic_prof_only_functions &&
-      (abstract_code.kind() != AbstractCode::INTERPRETED_FUNCTION &&
-       abstract_code.kind() != AbstractCode::OPTIMIZED_FUNCTION)) {
+      (abstract_code->kind() != AbstractCode::INTERPRETED_FUNCTION &&
+       abstract_code->kind() != AbstractCode::OPTIMIZED_FUNCTION)) {
     return;
   }
 
@@ -211,28 +214,29 @@ void PerfJitLogger::LogRecordedBuffer(AbstractCode abstract_code,
   if (perf_output_handle_ == nullptr) return;
 
   // We only support non-interpreted functions.
-  if (!abstract_code.IsCode()) return;
-  Code code = abstract_code.GetCode();
-  DCHECK(code.raw_instruction_start() == code.address() + Code::kHeaderSize);
+  if (!abstract_code->IsCode()) return;
+  Handle<Code> code = Handle<Code>::cast(abstract_code);
+  DCHECK(code->raw_instruction_start() == code->address() + Code::kHeaderSize);
 
   // Debug info has to be emitted first.
-  if (FLAG_perf_prof && !shared.is_null()) {
+  Handle<SharedFunctionInfo> shared;
+  if (FLAG_perf_prof && !maybe_shared.ToHandle(&shared)) {
     // TODO(herhut): This currently breaks for js2wasm/wasm2js functions.
-    if (code.kind() != Code::JS_TO_WASM_FUNCTION &&
-        code.kind() != Code::WASM_TO_JS_FUNCTION) {
+    if (code->kind() != Code::JS_TO_WASM_FUNCTION &&
+        code->kind() != Code::WASM_TO_JS_FUNCTION) {
       LogWriteDebugInfo(code, shared);
     }
   }
 
   const char* code_name = name;
-  uint8_t* code_pointer = reinterpret_cast<uint8_t*>(code.InstructionStart());
+  uint8_t* code_pointer = reinterpret_cast<uint8_t*>(code->InstructionStart());
 
   // Code generated by Turbofan will have the safepoint table directly after
   // instructions. There is no need to record the safepoint table itself.
-  uint32_t code_size = code.ExecutableInstructionSize();
+  uint32_t code_size = code->ExecutableInstructionSize();
 
   // Unwinding info comes right after debug info.
-  if (FLAG_perf_prof_unwinding_info) LogWriteUnwindingInfo(code);
+  if (FLAG_perf_prof_unwinding_info) LogWriteUnwindingInfo(*code);
 
   WriteJitCodeLoadEntry(code_pointer, code_size, code_name, length);
 }
@@ -328,24 +332,24 @@ SourcePositionInfo GetSourcePositionInfo(Handle<Code> code,
 
 }  // namespace
 
-void PerfJitLogger::LogWriteDebugInfo(Code code, SharedFunctionInfo shared) {
+void PerfJitLogger::LogWriteDebugInfo(Handle<Code> code,
+                                      Handle<SharedFunctionInfo> shared) {
   // Compute the entry count and get the name of the script.
   uint32_t entry_count = 0;
-  for (SourcePositionTableIterator iterator(code.SourcePositionTable());
+  for (SourcePositionTableIterator iterator(code->SourcePositionTable());
        !iterator.done(); iterator.Advance()) {
     entry_count++;
   }
   if (entry_count == 0) return;
   // The WasmToJS wrapper stubs have source position entries.
-  if (!shared.HasSourceCode()) return;
-  Isolate* isolate = shared.GetIsolate();
-  Handle<Script> script(Script::cast(shared.script()), isolate);
+  if (!shared->HasSourceCode()) return;
+  Handle<Script> script(Script::cast(shared->script()), isolate_);
 
   PerfJitCodeDebugInfo debug_info;
 
   debug_info.event_ = PerfJitCodeLoad::kDebugInfo;
   debug_info.time_stamp_ = GetTimestamp();
-  debug_info.address_ = code.InstructionStart();
+  debug_info.address_ = code->InstructionStart();
   debug_info.entry_count_ = entry_count;
 
   uint32_t size = sizeof(debug_info);
@@ -353,12 +357,10 @@ void PerfJitLogger::LogWriteDebugInfo(Code code, SharedFunctionInfo shared) {
   size += entry_count * sizeof(PerfJitDebugEntry);
   // Add the size of the name after each entry.
 
-  Handle<Code> code_handle(code, isolate);
-  Handle<SharedFunctionInfo> function_handle(shared, isolate);
-  for (SourcePositionTableIterator iterator(code.SourcePositionTable());
+  for (SourcePositionTableIterator iterator(code->SourcePositionTable());
        !iterator.done(); iterator.Advance()) {
-    SourcePositionInfo info(GetSourcePositionInfo(code_handle, function_handle,
-                                                  iterator.source_position()));
+    SourcePositionInfo info(
+        GetSourcePositionInfo(code, shared, iterator.source_position()));
     size += GetScriptNameLength(info) + 1;
   }
 
@@ -366,12 +368,12 @@ void PerfJitLogger::LogWriteDebugInfo(Code code, SharedFunctionInfo shared) {
   debug_info.size_ = size + padding;
   LogWriteBytes(reinterpret_cast<const char*>(&debug_info), sizeof(debug_info));
 
-  Address code_start = code.InstructionStart();
+  Address code_start = code->InstructionStart();
 
-  for (SourcePositionTableIterator iterator(code.SourcePositionTable());
+  for (SourcePositionTableIterator iterator(code->SourcePositionTable());
        !iterator.done(); iterator.Advance()) {
-    SourcePositionInfo info(GetSourcePositionInfo(code_handle, function_handle,
-                                                  iterator.source_position()));
+    SourcePositionInfo info(
+        GetSourcePositionInfo(code, shared, iterator.source_position()));
     PerfJitDebugEntry entry;
     // The entry point of the function will be placed straight after the ELF
     // header when processed by "perf inject". Adjust the position addresses
@@ -523,6 +525,7 @@ void PerfJitLogger::LogWriteHeader() {
   LogWriteBytes(reinterpret_cast<const char*>(&header), sizeof(header));
 }
 
-#endif  // V8_OS_LINUX
 }  // namespace internal
 }  // namespace v8
+
+#endif  // V8_OS_LINUX
diff --git a/deps/v8/src/diagnostics/perf-jit.h b/deps/v8/src/diagnostics/perf-jit.h
index 36ab844110038d..21920635082f57 100644
--- a/deps/v8/src/diagnostics/perf-jit.h
+++ b/deps/v8/src/diagnostics/perf-jit.h
@@ -28,22 +28,25 @@
 #ifndef V8_DIAGNOSTICS_PERF_JIT_H_
 #define V8_DIAGNOSTICS_PERF_JIT_H_
 
+#include "include/v8config.h"
+
+// {PerfJitLogger} is only implemented on Linux.
+#if V8_OS_LINUX
+
 #include "src/logging/log.h"
 
 namespace v8 {
 namespace internal {
 
-#if V8_OS_LINUX
-
-// Linux perf tool logging support
+// Linux perf tool logging support.
 class PerfJitLogger : public CodeEventLogger {
  public:
   explicit PerfJitLogger(Isolate* isolate);
   ~PerfJitLogger() override;
 
   void CodeMoveEvent(AbstractCode from, AbstractCode to) override;
-  void CodeDisableOptEvent(AbstractCode code,
-                           SharedFunctionInfo shared) override {}
+  void CodeDisableOptEvent(Handle<AbstractCode> code,
+                           Handle<SharedFunctionInfo> shared) override {}
 
  private:
   void OpenJitDumpFile();
@@ -52,7 +55,8 @@ class PerfJitLogger : public CodeEventLogger {
   void CloseMarkerFile(void* marker_address);
 
   uint64_t GetTimestamp();
-  void LogRecordedBuffer(AbstractCode code, SharedFunctionInfo shared,
+  void LogRecordedBuffer(Handle<AbstractCode> code,
+                         MaybeHandle<SharedFunctionInfo> maybe_shared,
                          const char* name, int length) override;
   void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
                          int length) override;
@@ -70,7 +74,7 @@ class PerfJitLogger : public CodeEventLogger {
 
   void LogWriteBytes(const char* bytes, int size);
   void LogWriteHeader();
-  void LogWriteDebugInfo(Code code, SharedFunctionInfo shared);
+  void LogWriteDebugInfo(Handle<Code> code, Handle<SharedFunctionInfo> shared);
   void LogWriteDebugInfo(const wasm::WasmCode* code);
   void LogWriteUnwindingInfo(Code code);
 
@@ -79,6 +83,8 @@ class PerfJitLogger : public CodeEventLogger {
   static const uint32_t kElfMachARM = 40;
   static const uint32_t kElfMachMIPS = 10;
   static const uint32_t kElfMachARM64 = 183;
+  static const uint32_t kElfMachS390x = 22;
+  static const uint32_t kElfMachPPC64 = 21;
 
   uint32_t GetElfMach() {
 #if V8_TARGET_ARCH_IA32
@@ -91,6 +97,10 @@ class PerfJitLogger : public CodeEventLogger {
     return kElfMachMIPS;
 #elif V8_TARGET_ARCH_ARM64
     return kElfMachARM64;
+#elif V8_TARGET_ARCH_S390X
+    return kElfMachS390x;
+#elif V8_TARGET_ARCH_PPC64
+    return kElfMachPPC64;
 #else
     UNIMPLEMENTED();
     return 0;
@@ -114,35 +124,9 @@ class PerfJitLogger : public CodeEventLogger {
   static uint64_t code_index_;
 };
 
-#else
-
-// PerfJitLogger is only implemented on Linux
-class PerfJitLogger : public CodeEventLogger {
- public:
-  explicit PerfJitLogger(Isolate* isolate) : CodeEventLogger(isolate) {}
-
-  void CodeMoveEvent(AbstractCode from, AbstractCode to) override {
-    UNIMPLEMENTED();
-  }
-
-  void CodeDisableOptEvent(AbstractCode code,
-                           SharedFunctionInfo shared) override {
-    UNIMPLEMENTED();
-  }
-
-  void LogRecordedBuffer(AbstractCode code, SharedFunctionInfo shared,
-                         const char* name, int length) override {
-    UNIMPLEMENTED();
-  }
-
-  void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
-                         int length) override {
-    UNIMPLEMENTED();
-  }
-};
-
-#endif  // V8_OS_LINUX
 }  // namespace internal
 }  // namespace v8
 
+#endif  // V8_OS_LINUX
+
 #endif  // V8_DIAGNOSTICS_PERF_JIT_H_
diff --git a/deps/v8/src/diagnostics/ppc/eh-frame-ppc.cc b/deps/v8/src/diagnostics/ppc/eh-frame-ppc.cc
new file mode 100644
index 00000000000000..148d01116dfb03
--- /dev/null
+++ b/deps/v8/src/diagnostics/ppc/eh-frame-ppc.cc
@@ -0,0 +1,57 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/codegen/ppc/constants-ppc.h"
+#include "src/diagnostics/eh-frame.h"
+
+namespace v8 {
+namespace internal {
+
+const int EhFrameConstants::kCodeAlignmentFactor = 4;
+// all PPC are 4 bytes instruction
+const int EhFrameConstants::kDataAlignmentFactor = -8;  // 64-bit always -8
+
+void EhFrameWriter::WriteReturnAddressRegisterCode() {
+  WriteULeb128(kLrDwarfCode);
+}
+
+void EhFrameWriter::WriteInitialStateInCie() {
+  SetBaseAddressRegisterAndOffset(fp, 0);
+  RecordRegisterNotModified(kLrDwarfCode);
+}
+
+// static
+int EhFrameWriter::RegisterToDwarfCode(Register name) {
+  switch (name.code()) {
+    case kRegCode_fp:
+      return kFpDwarfCode;
+    case kRegCode_sp:
+      return kSpDwarfCode;
+    case kRegCode_r0:
+      return kR0DwarfCode;
+    default:
+      UNIMPLEMENTED();
+      return -1;
+  }
+}
+
+#ifdef ENABLE_DISASSEMBLER
+
+// static
+const char* EhFrameDisassembler::DwarfRegisterCodeToString(int code) {
+  switch (code) {
+    case kFpDwarfCode:
+      return "fp";
+    case kSpDwarfCode:
+      return "sp";
+    default:
+      UNIMPLEMENTED();
+      return nullptr;
+  }
+}
+
+#endif
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/diagnostics/s390/disasm-s390.cc b/deps/v8/src/diagnostics/s390/disasm-s390.cc
index 9b10e236cec800..5bb771fc37c006 100644
--- a/deps/v8/src/diagnostics/s390/disasm-s390.cc
+++ b/deps/v8/src/diagnostics/s390/disasm-s390.cc
@@ -827,6 +827,13 @@ bool Decoder::DecodeGeneric(Instruction* instr) {
     S390_VRR_E_OPCODE_LIST(DECODE_VRR_E_INSTRUCTIONS)
 #undef DECODE_VRR_E_INSTRUCTIONS
 
+#define DECODE_VRR_F_INSTRUCTIONS(name, opcode_name, opcode_value) \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'f1,'r1,'r2");                          \
+    break;
+    S390_VRR_F_OPCODE_LIST(DECODE_VRR_F_INSTRUCTIONS)
+#undef DECODE_VRR_F_INSTRUCTIONS
+
 #define DECODE_VRX_INSTRUCTIONS(name, opcode_name, opcode_value) \
   case opcode_name:                                              \
     Format(instr, #name "\t'f1,'d1('r2d,'r3),'m4");              \
diff --git a/deps/v8/src/diagnostics/s390/eh-frame-s390.cc b/deps/v8/src/diagnostics/s390/eh-frame-s390.cc
new file mode 100644
index 00000000000000..4f5994c8dab06f
--- /dev/null
+++ b/deps/v8/src/diagnostics/s390/eh-frame-s390.cc
@@ -0,0 +1,65 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/codegen/s390/assembler-s390-inl.h"
+#include "src/diagnostics/eh-frame.h"
+
+namespace v8 {
+namespace internal {
+
+static const int kR0DwarfCode = 0;
+static const int kFpDwarfCode = 11;   // frame-pointer
+static const int kR14DwarfCode = 14;  // return-address(lr)
+static const int kSpDwarfCode = 15;   // stack-pointer
+
+const int EhFrameConstants::kCodeAlignmentFactor = 2;  // 1 or 2 in s390
+const int EhFrameConstants::kDataAlignmentFactor = -8;
+
+void EhFrameWriter::WriteReturnAddressRegisterCode() {
+  WriteULeb128(kR14DwarfCode);
+}
+
+void EhFrameWriter::WriteInitialStateInCie() {
+  SetBaseAddressRegisterAndOffset(fp, 0);
+  RecordRegisterNotModified(r14);
+}
+
+// static
+int EhFrameWriter::RegisterToDwarfCode(Register name) {
+  switch (name.code()) {
+    case kRegCode_fp:
+      return kFpDwarfCode;
+    case kRegCode_r14:
+      return kR14DwarfCode;
+    case kRegCode_sp:
+      return kSpDwarfCode;
+    case kRegCode_r0:
+      return kR0DwarfCode;
+    default:
+      UNIMPLEMENTED();
+      return -1;
+  }
+}
+
+#ifdef ENABLE_DISASSEMBLER
+
+// static
+const char* EhFrameDisassembler::DwarfRegisterCodeToString(int code) {
+  switch (code) {
+    case kFpDwarfCode:
+      return "fp";
+    case kR14DwarfCode:
+      return "lr";
+    case kSpDwarfCode:
+      return "sp";
+    default:
+      UNIMPLEMENTED();
+      return nullptr;
+  }
+}
+
+#endif
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/diagnostics/unwinder.cc b/deps/v8/src/diagnostics/unwinder.cc
index 84097c288f27e1..64adf17b82b12c 100644
--- a/deps/v8/src/diagnostics/unwinder.cc
+++ b/deps/v8/src/diagnostics/unwinder.cc
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <algorithm>
+
 #include "include/v8.h"
 #include "src/common/globals.h"
 #include "src/execution/frame-constants.h"
@@ -10,17 +12,62 @@ namespace v8 {
 
 namespace {
 
-bool PCIsInCodeRange(const v8::MemoryRange& code_range, void* pc) {
+const i::byte* CalculateEnd(const void* start, size_t length_in_bytes) {
   // Given that the length of the memory range is in bytes and it is not
   // necessarily aligned, we need to do the pointer arithmetic in byte* here.
-  const i::byte* pc_as_byte = reinterpret_cast<i::byte*>(pc);
-  const i::byte* start = reinterpret_cast<const i::byte*>(code_range.start);
-  const i::byte* end = start + code_range.length_in_bytes;
-  return pc_as_byte >= start && pc_as_byte < end;
+  const i::byte* start_as_byte = reinterpret_cast<const i::byte*>(start);
+  return start_as_byte + length_in_bytes;
+}
+
+bool PCIsInCodeRange(const v8::MemoryRange& code_range, void* pc) {
+  return pc >= code_range.start &&
+         pc < CalculateEnd(code_range.start, code_range.length_in_bytes);
+}
+
+// This relies on the fact that the code pages are ordered, and that they don't
+// overlap.
+bool PCIsInCodePages(size_t code_pages_length, const MemoryRange* code_pages,
+                     void* pc) {
+  DCHECK(std::is_sorted(code_pages, code_pages + code_pages_length,
+                        [](const MemoryRange& a, const MemoryRange& b) {
+                          return a.start < b.start;
+                        }));
+
+  MemoryRange fake_range{pc, 1};
+  auto it =
+      std::upper_bound(code_pages, code_pages + code_pages_length, fake_range,
+                       [](const MemoryRange& a, const MemoryRange& b) {
+                         return a.start < b.start;
+                       });
+  DCHECK_IMPLIES(it != code_pages + code_pages_length, pc < it->start);
+  if (it == code_pages) return false;
+  --it;
+  return it->start <= pc && pc < CalculateEnd(it->start, it->length_in_bytes);
+}
+
+bool IsInJSEntryRange(const UnwindState& unwind_state, void* pc) {
+  return PCIsInCodeRange(unwind_state.js_entry_stub.code, pc) ||
+         PCIsInCodeRange(unwind_state.js_construct_entry_stub.code, pc) ||
+         PCIsInCodeRange(unwind_state.js_run_microtasks_entry_stub.code, pc);
 }
 
-bool IsInUnsafeJSEntryRange(const v8::JSEntryStub& js_entry_stub, void* pc) {
-  return PCIsInCodeRange(js_entry_stub.code, pc);
+bool IsInUnsafeJSEntryRange(const UnwindState& unwind_state, void* pc) {
+  return IsInJSEntryRange(unwind_state, pc);
+
+  // TODO(petermarshall): We can be more precise by checking whether we are
+  // in JSEntry but after frame setup and before frame teardown, in which case
+  // we are safe to unwind the stack. For now, we bail out if the PC is anywhere
+  // within JSEntry.
+}
+
+bool IsInJSEntryRange(const JSEntryStubs& entry_stubs, void* pc) {
+  return PCIsInCodeRange(entry_stubs.js_entry_stub.code, pc) ||
+         PCIsInCodeRange(entry_stubs.js_construct_entry_stub.code, pc) ||
+         PCIsInCodeRange(entry_stubs.js_run_microtasks_entry_stub.code, pc);
+}
+
+bool IsInUnsafeJSEntryRange(const JSEntryStubs& entry_stubs, void* pc) {
+  return IsInJSEntryRange(entry_stubs, pc);
 
   // TODO(petermarshall): We can be more precise by checking whether we are
   // in JSEntry but after frame setup and before frame teardown, in which case
@@ -32,21 +79,74 @@ i::Address Load(i::Address address) {
   return *reinterpret_cast<i::Address*>(address);
 }
 
-void* GetReturnAddressFromFP(void* fp) {
+void* GetReturnAddressFromFP(void* fp, void* pc,
+                             const v8::UnwindState& unwind_state) {
+  int caller_pc_offset = i::CommonFrameConstants::kCallerPCOffset;
+#ifdef V8_TARGET_ARCH_ARM64
+  if (IsInJSEntryRange(unwind_state, pc)) {
+    caller_pc_offset = i::EntryFrameConstants::kDirectCallerPCOffset;
+  }
+#endif
+  return reinterpret_cast<void*>(
+      Load(reinterpret_cast<i::Address>(fp) + caller_pc_offset));
+}
+
+void* GetReturnAddressFromFP(void* fp, void* pc,
+                             const JSEntryStubs& entry_stubs) {
+  int caller_pc_offset = i::CommonFrameConstants::kCallerPCOffset;
+#ifdef V8_TARGET_ARCH_ARM64
+  if (IsInJSEntryRange(entry_stubs, pc)) {
+    caller_pc_offset = i::EntryFrameConstants::kDirectCallerPCOffset;
+  }
+#endif
+  return reinterpret_cast<void*>(
+      Load(reinterpret_cast<i::Address>(fp) + caller_pc_offset));
+}
+
+void* GetCallerFPFromFP(void* fp, void* pc,
+                        const v8::UnwindState& unwind_state) {
+  int caller_fp_offset = i::CommonFrameConstants::kCallerFPOffset;
+#ifdef V8_TARGET_ARCH_ARM64
+  if (IsInJSEntryRange(unwind_state, pc)) {
+    caller_fp_offset = i::EntryFrameConstants::kDirectCallerFPOffset;
+  }
+#endif
   return reinterpret_cast<void*>(
-      Load(reinterpret_cast<i::Address>(fp) +
-           i::CommonFrameConstants::kCallerPCOffset));
+      Load(reinterpret_cast<i::Address>(fp) + caller_fp_offset));
 }
 
-void* GetCallerFPFromFP(void* fp) {
+void* GetCallerFPFromFP(void* fp, void* pc, const JSEntryStubs& entry_stubs) {
+  int caller_fp_offset = i::CommonFrameConstants::kCallerFPOffset;
+#ifdef V8_TARGET_ARCH_ARM64
+  if (IsInJSEntryRange(entry_stubs, pc)) {
+    caller_fp_offset = i::EntryFrameConstants::kDirectCallerFPOffset;
+  }
+#endif
   return reinterpret_cast<void*>(
-      Load(reinterpret_cast<i::Address>(fp) +
-           i::CommonFrameConstants::kCallerFPOffset));
+      Load(reinterpret_cast<i::Address>(fp) + caller_fp_offset));
+}
+
+void* GetCallerSPFromFP(void* fp, void* pc,
+                        const v8::UnwindState& unwind_state) {
+  int caller_sp_offset = i::CommonFrameConstants::kCallerSPOffset;
+#ifdef V8_TARGET_ARCH_ARM64
+  if (IsInJSEntryRange(unwind_state, pc)) {
+    caller_sp_offset = i::EntryFrameConstants::kDirectCallerSPOffset;
+  }
+#endif
+  return reinterpret_cast<void*>(reinterpret_cast<i::Address>(fp) +
+                                 caller_sp_offset);
 }
 
-void* GetCallerSPFromFP(void* fp) {
+void* GetCallerSPFromFP(void* fp, void* pc, const JSEntryStubs& entry_stubs) {
+  int caller_sp_offset = i::CommonFrameConstants::kCallerSPOffset;
+#ifdef V8_TARGET_ARCH_ARM64
+  if (IsInJSEntryRange(entry_stubs, pc)) {
+    caller_sp_offset = i::EntryFrameConstants::kDirectCallerSPOffset;
+  }
+#endif
   return reinterpret_cast<void*>(reinterpret_cast<i::Address>(fp) +
-                                 i::CommonFrameConstants::kCallerSPOffset);
+                                 caller_sp_offset);
 }
 
 bool AddressIsInStack(const void* address, const void* stack_base,
@@ -62,21 +162,21 @@ bool Unwinder::TryUnwindV8Frames(const UnwindState& unwind_state,
   const void* stack_top = register_state->sp;
 
   void* pc = register_state->pc;
-  if (PCIsInV8(unwind_state, pc) &&
-      !IsInUnsafeJSEntryRange(unwind_state.js_entry_stub, pc)) {
+  if (PCIsInV8(unwind_state, pc) && !IsInUnsafeJSEntryRange(unwind_state, pc)) {
     void* current_fp = register_state->fp;
     if (!AddressIsInStack(current_fp, stack_base, stack_top)) return false;
 
     // Peek at the return address that the caller pushed. If it's in V8, then we
     // assume the caller frame is a JS frame and continue to unwind.
-    void* next_pc = GetReturnAddressFromFP(current_fp);
+    void* next_pc = GetReturnAddressFromFP(current_fp, pc, unwind_state);
     while (PCIsInV8(unwind_state, next_pc)) {
-      current_fp = GetCallerFPFromFP(current_fp);
+      current_fp = GetCallerFPFromFP(current_fp, pc, unwind_state);
       if (!AddressIsInStack(current_fp, stack_base, stack_top)) return false;
-      next_pc = GetReturnAddressFromFP(current_fp);
+      pc = next_pc;
+      next_pc = GetReturnAddressFromFP(current_fp, pc, unwind_state);
     }
 
-    void* final_sp = GetCallerSPFromFP(current_fp);
+    void* final_sp = GetCallerSPFromFP(current_fp, pc, unwind_state);
     if (!AddressIsInStack(final_sp, stack_base, stack_top)) return false;
     register_state->sp = final_sp;
 
@@ -84,7 +184,50 @@ bool Unwinder::TryUnwindV8Frames(const UnwindState& unwind_state,
     // this is just the rbp value that JSEntryStub pushed. On platforms like
     // Win64 this is not used as a dedicated FP register, and could contain
     // anything.
-    void* final_fp = GetCallerFPFromFP(current_fp);
+    void* final_fp = GetCallerFPFromFP(current_fp, pc, unwind_state);
+    register_state->fp = final_fp;
+
+    register_state->pc = next_pc;
+
+    // Link register no longer valid after unwinding.
+    register_state->lr = nullptr;
+    return true;
+  }
+  return false;
+}
+
+bool Unwinder::TryUnwindV8Frames(const JSEntryStubs& entry_stubs,
+                                 size_t code_pages_length,
+                                 const MemoryRange* code_pages,
+                                 RegisterState* register_state,
+                                 const void* stack_base) {
+  const void* stack_top = register_state->sp;
+
+  void* pc = register_state->pc;
+  if (PCIsInV8(code_pages_length, code_pages, pc) &&
+      !IsInUnsafeJSEntryRange(entry_stubs, pc)) {
+    void* current_fp = register_state->fp;
+    if (!AddressIsInStack(current_fp, stack_base, stack_top)) return false;
+
+    // Peek at the return address that the caller pushed. If it's in V8, then we
+    // assume the caller frame is a JS frame and continue to unwind.
+    void* next_pc = GetReturnAddressFromFP(current_fp, pc, entry_stubs);
+    while (PCIsInV8(code_pages_length, code_pages, next_pc)) {
+      current_fp = GetCallerFPFromFP(current_fp, pc, entry_stubs);
+      if (!AddressIsInStack(current_fp, stack_base, stack_top)) return false;
+      pc = next_pc;
+      next_pc = GetReturnAddressFromFP(current_fp, pc, entry_stubs);
+    }
+
+    void* final_sp = GetCallerSPFromFP(current_fp, pc, entry_stubs);
+    if (!AddressIsInStack(final_sp, stack_base, stack_top)) return false;
+    register_state->sp = final_sp;
+
+    // We don't check that the final FP value is within the stack bounds because
+    // this is just the rbp value that JSEntryStub pushed. On platforms like
+    // Win64 this is not used as a dedicated FP register, and could contain
+    // anything.
+    void* final_fp = GetCallerFPFromFP(current_fp, pc, entry_stubs);
     register_state->fp = final_fp;
 
     register_state->pc = next_pc;
@@ -101,4 +244,9 @@ bool Unwinder::PCIsInV8(const UnwindState& unwind_state, void* pc) {
                 PCIsInCodeRange(unwind_state.embedded_code_range, pc));
 }
 
+bool Unwinder::PCIsInV8(size_t code_pages_length, const MemoryRange* code_pages,
+                        void* pc) {
+  return pc && PCIsInCodePages(code_pages_length, code_pages, pc);
+}
+
 }  // namespace v8
diff --git a/deps/v8/src/diagnostics/unwinding-info-win64.cc b/deps/v8/src/diagnostics/unwinding-info-win64.cc
index 5a2fc73631839e..19b03af5227c76 100644
--- a/deps/v8/src/diagnostics/unwinding-info-win64.cc
+++ b/deps/v8/src/diagnostics/unwinding-info-win64.cc
@@ -16,37 +16,6 @@
 #error "Unsupported OS"
 #endif  // V8_OS_WIN_X64
 
-// Forward declaration to keep this independent of Win8
-NTSYSAPI
-DWORD
-NTAPI
-RtlAddGrowableFunctionTable(
-    _Out_ PVOID* DynamicTable,
-    _In_reads_(MaximumEntryCount) PRUNTIME_FUNCTION FunctionTable,
-    _In_ DWORD EntryCount,
-    _In_ DWORD MaximumEntryCount,
-    _In_ ULONG_PTR RangeBase,
-    _In_ ULONG_PTR RangeEnd
-    );
-
-
-NTSYSAPI
-void
-NTAPI
-RtlGrowFunctionTable(
-    _Inout_ PVOID DynamicTable,
-    _In_ DWORD NewEntryCount
-    );
-
-
-NTSYSAPI
-void
-NTAPI
-RtlDeleteGrowableFunctionTable(
-    _In_ PVOID DynamicTable
-    );
-
-
 namespace v8 {
 namespace internal {
 namespace win64_unwindinfo {
@@ -213,15 +182,17 @@ void InitUnwindingRecord(Record* record, size_t code_size_in_bytes) {
 // https://docs.microsoft.com/en-us/cpp/build/arm64-exception-handling#unwind-codes
 enum UnwindOp8Bit {
   OpNop = 0xE3,
+  OpAllocS = 0x00,
   OpSaveFpLr = 0x40,
   OpSaveFpLrX = 0x80,
   OpSetFp = 0xE1,
+  OpAddFp = 0xE2,
   OpEnd = 0xE4,
 };
 
 typedef uint32_t UNWIND_CODE;
 
-constexpr UNWIND_CODE Combine8BitUnwindCodes(uint8_t code0,
+constexpr UNWIND_CODE Combine8BitUnwindCodes(uint8_t code0 = OpNop,
                                              uint8_t code1 = OpNop,
                                              uint8_t code2 = OpNop,
                                              uint8_t code3 = OpNop) {
@@ -242,39 +213,97 @@ struct UNWIND_INFO {
   uint32_t CodeWords : 5;
 };
 
-static constexpr int kNumberOfUnwindCodes = 1;
+static constexpr int kDefaultNumberOfUnwindCodeWords = 1;
 static constexpr int kMaxExceptionThunkSize = 16;
 static constexpr int kFunctionLengthShiftSize = 2;
 static constexpr int kFunctionLengthMask = (1 << kFunctionLengthShiftSize) - 1;
-static constexpr int kFramePointerAdjustmentShiftSize = 3;
-static constexpr int kFramePointerAdjustmentShiftMask =
-    (1 << kFramePointerAdjustmentShiftSize) - 1;
+static constexpr int kAllocStackShiftSize = 4;
+static constexpr int kAllocStackShiftMask = (1 << kAllocStackShiftSize) - 1;
 
+// Generate an unwind code for "stp fp, lr, [sp, #pre_index_offset]!".
+uint8_t MakeOpSaveFpLrX(int pre_index_offset) {
+  // See unwind code save_fplr_x in
+  // https://docs.microsoft.com/en-us/cpp/build/arm64-exception-handling#unwind-codes
+  DCHECK_LE(pre_index_offset, -8);
+  DCHECK_GE(pre_index_offset, -512);
+  constexpr int kShiftSize = 3;
+  constexpr int kShiftMask = (1 << kShiftSize) - 1;
+  DCHECK_EQ(pre_index_offset & kShiftMask, 0);
+  USE(kShiftMask);
+  // Solve for Z where -(Z+1)*8 = pre_index_offset.
+  int encoded_value = (-pre_index_offset >> kShiftSize) - 1;
+  return OpSaveFpLrX | encoded_value;
+}
+
+// Generate an unwind code for "sub sp, sp, #stack_space".
+uint8_t MakeOpAllocS(int stack_space) {
+  // See unwind code alloc_s in
+  // https://docs.microsoft.com/en-us/cpp/build/arm64-exception-handling#unwind-codes
+  DCHECK_GE(stack_space, 0);
+  DCHECK_LT(stack_space, 512);
+  DCHECK_EQ(stack_space & kAllocStackShiftMask, 0);
+  return OpAllocS | (stack_space >> kAllocStackShiftSize);
+}
+
+// Generate the second byte of the unwind code for "add fp, sp, #offset".
+uint8_t MakeOpAddFpArgument(int offset) {
+  // See unwind code add_fp in
+  // https://docs.microsoft.com/en-us/cpp/build/arm64-exception-handling#unwind-codes
+  DCHECK_GE(offset, 0);
+  constexpr int kShiftSize = 3;
+  constexpr int kShiftMask = (1 << kShiftSize) - 1;
+  DCHECK_EQ(offset & kShiftMask, 0);
+  USE(kShiftMask);
+  int encoded_value = offset >> kShiftSize;
+  // Encoded value must fit in 8 bits.
+  DCHECK_LE(encoded_value, 0xff);
+  return encoded_value;
+}
+
+template <int kNumberOfUnwindCodeWords = kDefaultNumberOfUnwindCodeWords>
 struct V8UnwindData {
   UNWIND_INFO unwind_info;
-  UNWIND_CODE unwind_codes[kNumberOfUnwindCodes];
+  UNWIND_CODE unwind_codes[kNumberOfUnwindCodeWords];
 
   V8UnwindData() {
     memset(&unwind_info, 0, sizeof(UNWIND_INFO));
     unwind_info.X = 1;  // has exception handler after unwind-codes.
-    unwind_info.CodeWords = 1;
-
-    // stp fp, lr, [sp, #offset]!
-    unwind_codes[0] = Combine8BitUnwindCodes(OpSetFp, OpSaveFpLrX, OpEnd);
+    unwind_info.CodeWords = kNumberOfUnwindCodeWords;
+
+    // Generate unwind codes for the following prolog:
+    //
+    // stp fp, lr, [sp, #-kCallerSPOffset]!
+    // mov fp, sp
+    //
+    // This is a very rough approximation of the actual function prologs used in
+    // V8. In particular, we often push other data before the (fp, lr) pair,
+    // meaning the stack pointer computed for the caller frame is wrong. That
+    // error is acceptable when the unwinding info for the caller frame also
+    // depends on fp rather than sp, as is the case for V8 builtins and runtime-
+    // generated code.
+    STATIC_ASSERT(kNumberOfUnwindCodeWords >= 1);
+    unwind_codes[0] = Combine8BitUnwindCodes(
+        OpSetFp, MakeOpSaveFpLrX(-CommonFrameConstants::kCallerSPOffset),
+        OpEnd);
+
+    // Fill the rest with nops.
+    for (int i = 1; i < kNumberOfUnwindCodeWords; ++i) {
+      unwind_codes[i] = Combine8BitUnwindCodes();
+    }
   }
 };
 
 struct CodeRangeUnwindingRecord {
   void* dynamic_table;
   uint32_t runtime_function_count;
-  V8UnwindData unwind_info;
+  V8UnwindData<> unwind_info;
   uint32_t exception_handler;
 
   // For Windows ARM64 unwinding, register 2 unwind_info for each code range,
   // unwind_info for all full size ranges (1MB - 4 bytes) and unwind_info1 for
   // the remaining non full size range. There is at most 1 range which is less
   // than full size.
-  V8UnwindData unwind_info1;
+  V8UnwindData<> unwind_info1;
   uint32_t exception_handler1;
   uint8_t exception_thunk[kMaxExceptionThunkSize];
 
@@ -286,33 +315,66 @@ struct CodeRangeUnwindingRecord {
 
 #pragma pack(pop)
 
-std::vector<uint8_t> GetUnwindInfoForBuiltinFunction(uint32_t func_len,
-                                                     int32_t fp_adjustment) {
+FrameOffsets::FrameOffsets()
+    : fp_to_saved_caller_fp(CommonFrameConstants::kCallerFPOffset),
+      fp_to_caller_sp(CommonFrameConstants::kCallerSPOffset) {}
+bool FrameOffsets::IsDefault() const {
+  FrameOffsets other;
+  return fp_to_saved_caller_fp == other.fp_to_saved_caller_fp &&
+         fp_to_caller_sp == other.fp_to_caller_sp;
+}
+
+std::vector<uint8_t> GetUnwindInfoForBuiltinFunction(
+    uint32_t func_len, FrameOffsets fp_adjustment) {
   DCHECK_LE(func_len, kMaxFunctionLength);
   DCHECK_EQ((func_len & kFunctionLengthMask), 0);
   USE(kFunctionLengthMask);
 
-  // Unwind code save_fplr requires the offset to be within range [0, 504].
-  // This range is defined in below doc for unwind code save_fplr.
-  // https://docs.microsoft.com/en-us/cpp/build/arm64-exception-handling#unwind-codes
-  DCHECK_GE(fp_adjustment, 0);
-  DCHECK_LE(fp_adjustment, 504);
-  DCHECK_EQ((fp_adjustment & kFramePointerAdjustmentShiftMask), 0);
-  USE(kFramePointerAdjustmentShiftMask);
+  // The largest size of unwind data required for all options below.
+  constexpr int kMaxNumberOfUnwindCodeWords = 2;
 
-  V8UnwindData xdata;
+  V8UnwindData<kMaxNumberOfUnwindCodeWords> xdata;
   // FunctionLength is ensured to be aligned at instruction size and Windows
   // ARM64 doesn't encoding its 2 LSB.
   xdata.unwind_info.FunctionLength = func_len >> kFunctionLengthShiftSize;
-  xdata.unwind_info.CodeWords = 1;
-  xdata.unwind_codes[0] = Combine8BitUnwindCodes(
-      OpSetFp,
-      (OpSaveFpLr | (fp_adjustment >> kFramePointerAdjustmentShiftSize)),
-      OpEnd);
+
+  if (fp_adjustment.IsDefault()) {
+    // One code word is plenty.
+    STATIC_ASSERT(kDefaultNumberOfUnwindCodeWords <
+                  kMaxNumberOfUnwindCodeWords);
+    xdata.unwind_info.CodeWords = kDefaultNumberOfUnwindCodeWords;
+  } else {
+    // We want to convey the following facts:
+    // 1. The caller's fp is found at [fp + fp_to_saved_caller_fp].
+    // 2. The caller's pc is found at [fp + fp_to_saved_caller_fp + 8].
+    // 3. The caller's sp is equal to fp + fp_to_caller_sp.
+    //
+    // An imaginary prolog that would establish those relationships might look
+    // like the following, with appropriate values for the various constants:
+    //
+    // stp fp, lr, [sp, #pre_index_amount]!
+    // sub sp, sp, #stack_space
+    // add fp, sp, offset_from_stack_top
+    //
+    // Why do we need offset_from_stack_top? The unwinding encoding for
+    // allocating stack space has 16-byte granularity, and the frame pointer has
+    // only 8-byte alignment.
+    int pre_index_amount =
+        fp_adjustment.fp_to_saved_caller_fp - fp_adjustment.fp_to_caller_sp;
+    int stack_space = fp_adjustment.fp_to_saved_caller_fp;
+    int offset_from_stack_top = stack_space & kAllocStackShiftMask;
+    stack_space += offset_from_stack_top;
+
+    xdata.unwind_codes[0] = Combine8BitUnwindCodes(
+        OpAddFp, MakeOpAddFpArgument(offset_from_stack_top),
+        MakeOpAllocS(stack_space), MakeOpSaveFpLrX(pre_index_amount));
+    xdata.unwind_codes[1] = Combine8BitUnwindCodes(OpEnd);
+  }
 
   return std::vector<uint8_t>(
       reinterpret_cast<uint8_t*>(&xdata),
-      reinterpret_cast<uint8_t*>(&xdata) + sizeof(xdata));
+      reinterpret_cast<uint8_t*>(
+          &xdata.unwind_codes[xdata.unwind_info.CodeWords]));
 }
 
 template <typename Record>
@@ -542,17 +604,13 @@ void XdataEncoder::onSaveFpLr() {
   current_frame_code_offset_ = assembler_.pc_offset() - 4;
   fp_offsets_.push_back(current_frame_code_offset_);
   fp_adjustments_.push_back(current_frame_adjustment_);
-  if (current_frame_adjustment_ != 0) {
-    current_frame_adjustment_ = 0;
-  }
+  current_frame_adjustment_ = FrameOffsets();
 }
 
-void XdataEncoder::onFramePointerAdjustment(int bytes) {
-  // According to below doc, offset for save_fplr is aligned to pointer size.
-  // https://docs.microsoft.com/en-us/cpp/build/arm64-exception-handling#unwind-codes
-  DCHECK_EQ((bytes & kPointerAlignmentMask), 0);
-
-  current_frame_adjustment_ = bytes;
+void XdataEncoder::onFramePointerAdjustment(int fp_to_saved_caller_fp,
+                                            int fp_to_caller_sp) {
+  current_frame_adjustment_.fp_to_saved_caller_fp = fp_to_saved_caller_fp;
+  current_frame_adjustment_.fp_to_caller_sp = fp_to_caller_sp;
 }
 
 #endif  // V8_OS_WIN_X64
diff --git a/deps/v8/src/diagnostics/unwinding-info-win64.h b/deps/v8/src/diagnostics/unwinding-info-win64.h
index 8f8c9469ebf92c..102df1559028a4 100644
--- a/deps/v8/src/diagnostics/unwinding-info-win64.h
+++ b/deps/v8/src/diagnostics/unwinding-info-win64.h
@@ -114,6 +114,13 @@ class XdataEncoder {
  */
 static const int kMaxFunctionLength = ((1 << 18) - 1) << 2;
 
+struct FrameOffsets {
+  FrameOffsets();
+  bool IsDefault() const;
+  int fp_to_saved_caller_fp;
+  int fp_to_caller_sp;
+};
+
 /**
  * Returns a vector of bytes that contains the Win ARM64 unwind data used for
  * all V8 builtin functions.
@@ -123,18 +130,20 @@ static const int kMaxFunctionLength = ((1 << 18) - 1) << 2;
  *                this is necessary to encode unwind data for Windows stack
  *                unwinder to find correct caller's fp.
  */
-std::vector<uint8_t> GetUnwindInfoForBuiltinFunction(uint32_t func_len,
-                                                     int32_t fp_adjustment);
+std::vector<uint8_t> GetUnwindInfoForBuiltinFunction(
+    uint32_t func_len, FrameOffsets fp_adjustment);
 class BuiltinUnwindInfo {
  public:
   BuiltinUnwindInfo() : is_leaf_function_(true) {}
   explicit BuiltinUnwindInfo(const std::vector<int>& fp_offsets,
-                             const std::vector<int>& fp_adjustments)
+                             const std::vector<FrameOffsets>& fp_adjustments)
       : is_leaf_function_(false),
         fp_offsets_(fp_offsets),
         fp_adjustments_(fp_adjustments) {}
 
-  const std::vector<int>& fp_adjustments() const { return fp_adjustments_; }
+  const std::vector<FrameOffsets>& fp_adjustments() const {
+    return fp_adjustments_;
+  }
 
   bool is_leaf_function() const { return is_leaf_function_; }
   const std::vector<int>& fp_offsets() const { return fp_offsets_; }
@@ -142,18 +151,16 @@ class BuiltinUnwindInfo {
  private:
   bool is_leaf_function_;
   std::vector<int> fp_offsets_;
-  std::vector<int> fp_adjustments_;
+  std::vector<FrameOffsets> fp_adjustments_;
 };
 
 class XdataEncoder {
  public:
   explicit XdataEncoder(const Assembler& assembler)
-      : assembler_(assembler),
-        current_frame_code_offset_(-1),
-        current_frame_adjustment_(0) {}
+      : assembler_(assembler), current_frame_code_offset_(-1) {}
 
   void onSaveFpLr();
-  void onFramePointerAdjustment(int bytes);
+  void onFramePointerAdjustment(int fp_to_saved_caller_fp, int fp_to_caller_sp);
 
   BuiltinUnwindInfo unwinding_info() const {
     return BuiltinUnwindInfo(fp_offsets_, fp_adjustments_);
@@ -163,8 +170,8 @@ class XdataEncoder {
   const Assembler& assembler_;
   std::vector<int> fp_offsets_;
   int current_frame_code_offset_;
-  int current_frame_adjustment_;
-  std::vector<int> fp_adjustments_;
+  FrameOffsets current_frame_adjustment_;
+  std::vector<FrameOffsets> fp_adjustments_;
 };
 
 #endif
diff --git a/deps/v8/src/diagnostics/x64/disasm-x64.cc b/deps/v8/src/diagnostics/x64/disasm-x64.cc
index 2195556af7a94e..a1331784a394ef 100644
--- a/deps/v8/src/diagnostics/x64/disasm-x64.cc
+++ b/deps/v8/src/diagnostics/x64/disasm-x64.cc
@@ -11,6 +11,7 @@
 
 #include "src/base/compiler-specific.h"
 #include "src/base/lazy-instance.h"
+#include "src/base/memory.h"
 #include "src/base/v8-fallthrough.h"
 #include "src/codegen/x64/register-x64.h"
 #include "src/codegen/x64/sse-instr.h"
@@ -245,19 +246,24 @@ uint8_t Imm8_U(const uint8_t* data) {
   return *reinterpret_cast<const uint8_t*>(data);
 }
 int16_t Imm16(const uint8_t* data) {
-  return *reinterpret_cast<const int16_t*>(data);
+  return v8::base::ReadUnalignedValue<int16_t>(
+      reinterpret_cast<v8::internal::Address>(data));
 }
 uint16_t Imm16_U(const uint8_t* data) {
-  return *reinterpret_cast<const uint16_t*>(data);
+  return v8::base::ReadUnalignedValue<uint16_t>(
+      reinterpret_cast<v8::internal::Address>(data));
 }
 int32_t Imm32(const uint8_t* data) {
-  return *reinterpret_cast<const int32_t*>(data);
+  return v8::base::ReadUnalignedValue<int32_t>(
+      reinterpret_cast<v8::internal::Address>(data));
 }
 uint32_t Imm32_U(const uint8_t* data) {
-  return *reinterpret_cast<const uint32_t*>(data);
+  return v8::base::ReadUnalignedValue<uint32_t>(
+      reinterpret_cast<v8::internal::Address>(data));
 }
 int64_t Imm64(const uint8_t* data) {
-  return *reinterpret_cast<const int64_t*>(data);
+  return v8::base::ReadUnalignedValue<int64_t>(
+      reinterpret_cast<v8::internal::Address>(data));
 }
 }  // namespace
 
@@ -673,7 +679,7 @@ int DisassemblerX64::F6F7Instruction(byte* data) {
   byte modrm = *(data + 1);
   int mod, regop, rm;
   get_modrm(modrm, &mod, &regop, &rm);
-  if (mod == 3 && regop != 0) {
+  if (regop != 0) {
     const char* mnem = nullptr;
     switch (regop) {
       case 2:
@@ -697,8 +703,18 @@ int DisassemblerX64::F6F7Instruction(byte* data) {
       default:
         UnimplementedInstruction();
     }
-    AppendToBuffer("%s%c %s", mnem, operand_size_code(), NameOfCPURegister(rm));
-    return 2;
+    if (mod == 3) {
+      AppendToBuffer("%s%c %s", mnem, operand_size_code(),
+                     NameOfCPURegister(rm));
+      return 2;
+    } else if (mod == 1) {
+      AppendToBuffer("%s%c ", mnem, operand_size_code());
+      int count = PrintRightOperand(data + 1);  // Use name of 64-bit register.
+      return 1 + count;
+    } else {
+      UnimplementedInstruction();
+      return 2;
+    }
   } else if (regop == 0) {
     AppendToBuffer("test%c ", operand_size_code());
     int count = PrintRightOperand(data + 1);  // Use name of 64-bit register.
@@ -819,6 +835,10 @@ int DisassemblerX64::AVXInstruction(byte* data) {
     int mod, regop, rm, vvvv = vex_vreg();
     get_modrm(*current, &mod, &regop, &rm);
     switch (opcode) {
+      case 0x18:
+        AppendToBuffer("vbroadcastss %s,", NameOfXMMRegister(regop));
+        current += PrintRightXMMOperand(current);
+        break;
       case 0x99:
         AppendToBuffer("vfmadd132s%c %s,%s,", float_size_code(),
                        NameOfXMMRegister(regop), NameOfXMMRegister(vvvv));
@@ -829,6 +849,11 @@ int DisassemblerX64::AVXInstruction(byte* data) {
                        NameOfXMMRegister(regop), NameOfXMMRegister(vvvv));
         current += PrintRightXMMOperand(current);
         break;
+      case 0xB8:
+        AppendToBuffer("vfmadd231p%c %s,%s,", float_size_code(),
+                       NameOfXMMRegister(regop), NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        break;
       case 0xB9:
         AppendToBuffer("vfmadd231s%c %s,%s,", float_size_code(),
                        NameOfXMMRegister(regop), NameOfXMMRegister(vvvv));
@@ -849,6 +874,11 @@ int DisassemblerX64::AVXInstruction(byte* data) {
                        NameOfXMMRegister(regop), NameOfXMMRegister(vvvv));
         current += PrintRightXMMOperand(current);
         break;
+      case 0xBC:
+        AppendToBuffer("vfnmadd231p%c %s,%s,", float_size_code(),
+                       NameOfXMMRegister(regop), NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        break;
       case 0x9D:
         AppendToBuffer("vfnmadd132s%c %s,%s,", float_size_code(),
                        NameOfXMMRegister(regop), NameOfXMMRegister(vvvv));
@@ -896,7 +926,19 @@ int DisassemblerX64::AVXInstruction(byte* data) {
 
         SSSE3_INSTRUCTION_LIST(DECLARE_SSE_AVX_DIS_CASE)
         SSE4_INSTRUCTION_LIST(DECLARE_SSE_AVX_DIS_CASE)
+        SSE4_2_INSTRUCTION_LIST(DECLARE_SSE_AVX_DIS_CASE)
 #undef DECLARE_SSE_AVX_DIS_CASE
+
+#define DECLARE_SSE_PMOV_AVX_DIS_CASE(instruction, notUsed1, notUsed2, \
+                                      notUsed3, opcode)                \
+  case 0x##opcode: {                                                   \
+    AppendToBuffer("v" #instruction " %s,", NameOfXMMRegister(regop)); \
+    current += PrintRightXMMOperand(current);                          \
+    break;                                                             \
+  }
+        SSE4_PMOV_INSTRUCTION_LIST(DECLARE_SSE_PMOV_AVX_DIS_CASE)
+#undef DECLARE_SSE_PMOV_AVX_DIS_CASE
+
       default:
         UnimplementedInstruction();
     }
@@ -916,6 +958,18 @@ int DisassemblerX64::AVXInstruction(byte* data) {
         current += PrintRightXMMOperand(current);
         AppendToBuffer(",0x%x", *current++);
         break;
+      case 0x0E:
+        AppendToBuffer("vpblendw %s,%s,", NameOfXMMRegister(regop),
+                       NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        AppendToBuffer(",0x%x", *current++);
+        break;
+      case 0x0F:
+        AppendToBuffer("vpalignr %s,%s,", NameOfXMMRegister(regop),
+                       NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        AppendToBuffer(",0x%x", *current++);
+        break;
       case 0x14:
         AppendToBuffer("vpextrb ");
         current += PrintRightByteOperand(current);
@@ -927,7 +981,12 @@ int DisassemblerX64::AVXInstruction(byte* data) {
         AppendToBuffer(",%s,0x%x,", NameOfXMMRegister(regop), *current++);
         break;
       case 0x16:
-        AppendToBuffer("vpextrd ");
+        AppendToBuffer("vpextr%c ", rex_w() ? 'q' : 'd');
+        current += PrintRightOperand(current);
+        AppendToBuffer(",%s,0x%x,", NameOfXMMRegister(regop), *current++);
+        break;
+      case 0x17:
+        AppendToBuffer("vextractps ");
         current += PrintRightOperand(current);
         AppendToBuffer(",%s,0x%x,", NameOfXMMRegister(regop), *current++);
         break;
@@ -937,12 +996,25 @@ int DisassemblerX64::AVXInstruction(byte* data) {
         current += PrintRightByteOperand(current);
         AppendToBuffer(",0x%x", *current++);
         break;
-      case 0x22:
-        AppendToBuffer("vpinsrd %s,%s,", NameOfXMMRegister(regop),
+      case 0x21:
+        AppendToBuffer("vinsertps %s,%s,", NameOfXMMRegister(regop),
                        NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        AppendToBuffer(",0x%x", *current++);
+        break;
+      case 0x22:
+        AppendToBuffer("vpinsr%c %s,%s,", rex_w() ? 'q' : 'd',
+                       NameOfXMMRegister(regop), NameOfXMMRegister(vvvv));
         current += PrintRightOperand(current);
         AppendToBuffer(",0x%x", *current++);
         break;
+      case 0x4B: {
+        AppendToBuffer("vblendvpd %s,%s,", NameOfXMMRegister(regop),
+                       NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        AppendToBuffer(",%s", NameOfXMMRegister((*current++) >> 4));
+        break;
+      }
       default:
         UnimplementedInstruction();
     }
@@ -1015,6 +1087,15 @@ int DisassemblerX64::AVXInstruction(byte* data) {
                        NameOfXMMRegister(vvvv));
         current += PrintRightXMMOperand(current);
         break;
+      case 0x6F:
+        AppendToBuffer("vmovdqu %s,", NameOfXMMRegister(regop));
+        current += PrintRightXMMOperand(current);
+        break;
+      case 0x7F:
+        AppendToBuffer("vmovdqu ");
+        current += PrintRightXMMOperand(current);
+        AppendToBuffer(",%s", NameOfXMMRegister(regop));
+        break;
       default:
         UnimplementedInstruction();
     }
@@ -1037,6 +1118,10 @@ int DisassemblerX64::AVXInstruction(byte* data) {
         }
         AppendToBuffer(",%s", NameOfXMMRegister(regop));
         break;
+      case 0x12:
+        AppendToBuffer("vmovddup %s,", NameOfXMMRegister(regop));
+        current += PrintRightXMMOperand(current);
+        break;
       case 0x2A:
         AppendToBuffer("%s %s,%s,", vex_w() ? "vcvtqsi2sd" : "vcvtlsi2sd",
                        NameOfXMMRegister(regop), NameOfXMMRegister(vvvv));
@@ -1096,6 +1181,11 @@ int DisassemblerX64::AVXInstruction(byte* data) {
         AppendToBuffer("vlddqu %s,", NameOfXMMRegister(regop));
         current += PrintRightXMMOperand(current);
         break;
+      case 0x70:
+        AppendToBuffer("vpshuflw %s,", NameOfXMMRegister(regop));
+        current += PrintRightXMMOperand(current);
+        AppendToBuffer(",0x%x", *current++);
+        break;
       case 0x7C:
         AppendToBuffer("vhaddps %s,%s,", NameOfXMMRegister(regop),
                        NameOfXMMRegister(vvvv));
@@ -1225,6 +1315,11 @@ int DisassemblerX64::AVXInstruction(byte* data) {
         current += PrintRightXMMOperand(current);
         AppendToBuffer(",%s", NameOfXMMRegister(regop));
         break;
+      case 0x16:
+        AppendToBuffer("vmovlhps %s,%s,", NameOfXMMRegister(regop),
+                       NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        break;
       case 0x28:
         AppendToBuffer("vmovaps %s,", NameOfXMMRegister(regop));
         current += PrintRightXMMOperand(current);
@@ -1242,21 +1337,45 @@ int DisassemblerX64::AVXInstruction(byte* data) {
         AppendToBuffer("vmovmskps %s,", NameOfCPURegister(regop));
         current += PrintRightXMMOperand(current);
         break;
-      case 0x54:
-        AppendToBuffer("vandps %s,%s,", NameOfXMMRegister(regop),
-                       NameOfXMMRegister(vvvv));
+      case 0x51:
+      case 0x52:
+      case 0x53: {
+        const char* const pseudo_op[] = {"vsqrtps", "vrsqrtps", "vrcpps"};
+
+        AppendToBuffer("%s %s,", pseudo_op[opcode - 0x51],
+                       NameOfXMMRegister(regop));
         current += PrintRightXMMOperand(current);
         break;
-      case 0x55:
-        AppendToBuffer("vandnps %s,%s,", NameOfXMMRegister(regop),
-                       NameOfXMMRegister(vvvv));
+      }
+      case 0x5A:
+      case 0x5B: {
+        const char* const pseudo_op[] = {"vcvtps2pd", "vcvtdq2ps"};
+
+        AppendToBuffer("%s %s,", pseudo_op[opcode - 0x5A],
+                       NameOfXMMRegister(regop));
         current += PrintRightXMMOperand(current);
         break;
+      }
+      case 0x54:
+      case 0x55:
+      case 0x56:
       case 0x57:
-        AppendToBuffer("vxorps %s,%s,", NameOfXMMRegister(regop),
-                       NameOfXMMRegister(vvvv));
+      case 0x58:
+      case 0x59:
+      case 0x5C:
+      case 0x5D:
+      case 0x5E:
+      case 0x5F: {
+        const char* const pseudo_op[] = {
+            "vandps", "vandnps", "vorps",  "vxorps", "vaddps", "vmulps",
+            "",       "",        "vsubps", "vminps", "vdivps", "vmaxps",
+        };
+
+        AppendToBuffer("%s %s,%s,", pseudo_op[opcode - 0x54],
+                       NameOfXMMRegister(regop), NameOfXMMRegister(vvvv));
         current += PrintRightXMMOperand(current);
         break;
+      }
       case 0xC2: {
         AppendToBuffer("vcmpps %s,%s,", NameOfXMMRegister(regop),
                        NameOfXMMRegister(vvvv));
@@ -1267,6 +1386,13 @@ int DisassemblerX64::AVXInstruction(byte* data) {
         current += 1;
         break;
       }
+      case 0xC6: {
+        AppendToBuffer("vshufps %s,%s,", NameOfXMMRegister(regop),
+                       NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        AppendToBuffer(",0x%x", *current++);
+        break;
+      }
       default:
         UnimplementedInstruction();
     }
@@ -1675,6 +1801,12 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
       current = data + 3;
       get_modrm(*current, &mod, &regop, &rm);
       switch (third_byte) {
+        case 0x15: {
+          AppendToBuffer("blendvpd %s,", NameOfXMMRegister(regop));
+          current += PrintRightXMMOperand(current);
+          AppendToBuffer(",<xmm0>");
+          break;
+        }
 #define SSE34_DIS_CASE(instruction, notUsed1, notUsed2, notUsed3, opcode) \
   case 0x##opcode: {                                                      \
     AppendToBuffer(#instruction " %s,", NameOfXMMRegister(regop));        \
@@ -1684,6 +1816,7 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
 
         SSSE3_INSTRUCTION_LIST(SSE34_DIS_CASE)
         SSE4_INSTRUCTION_LIST(SSE34_DIS_CASE)
+        SSE4_PMOV_INSTRUCTION_LIST(SSE34_DIS_CASE)
         SSE4_2_INSTRUCTION_LIST(SSE34_DIS_CASE)
 #undef SSE34_DIS_CASE
         default:
@@ -1714,14 +1847,14 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
       } else if (third_byte == 0x0E) {
         get_modrm(*current, &mod, &regop, &rm);
         AppendToBuffer("pblendw %s,", NameOfXMMRegister(regop));
-        current += PrintRightXMMOperand(data);
-        AppendToBuffer(",0x%x", (*current) & 3);
+        current += PrintRightXMMOperand(current);
+        AppendToBuffer(",0x%x", *current);
         current += 1;
       } else if (third_byte == 0x0F) {
-        get_modrm(*data, &mod, &regop, &rm);
+        get_modrm(*current, &mod, &regop, &rm);
         AppendToBuffer("palignr %s,", NameOfXMMRegister(regop));
-        current += PrintRightXMMOperand(data);
-        AppendToBuffer(",0x%x", (*current) & 3);
+        current += PrintRightXMMOperand(current);
+        AppendToBuffer(",0x%x", (*current));
         current += 1;
       } else if (third_byte == 0x14) {
         get_modrm(*current, &mod, &regop, &rm);
@@ -1754,7 +1887,7 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
         // insertps xmm, xmm/m32, imm8
         AppendToBuffer("insertps %s,", NameOfXMMRegister(regop));
         current += PrintRightXMMOperand(current);
-        AppendToBuffer(",0x%x", (*current) & 3);
+        AppendToBuffer(",0x%x", (*current));
         current += 1;
       } else if (third_byte == 0x22) {
         get_modrm(*current, &mod, &regop, &rm);
@@ -1767,6 +1900,8 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
       } else {
         UnimplementedInstruction();
       }
+    } else if (opcode == 0xC1) {
+      current += PrintOperands("xadd", OPER_REG_OP_ORDER, current);
     } else {
       get_modrm(*current, &mod, &regop, &rm);
       if (opcode == 0x1F) {
@@ -1907,6 +2042,8 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
           mnemonic = "pcmpeqw";
         } else if (opcode == 0x76) {
           mnemonic = "pcmpeqd";
+        } else if (opcode == 0xC2) {
+          mnemonic = "cmppd";
         } else if (opcode == 0xD1) {
           mnemonic = "psrlw";
         } else if (opcode == 0xD2) {
@@ -1933,10 +2070,14 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
           mnemonic = "paddusw";
         } else if (opcode == 0xDE) {
           mnemonic = "pmaxub";
+        } else if (opcode == 0xE0) {
+          mnemonic = "pavgb";
         } else if (opcode == 0xE1) {
           mnemonic = "psraw";
         } else if (opcode == 0xE2) {
           mnemonic = "psrad";
+        } else if (opcode == 0xE3) {
+          mnemonic = "pavgw";
         } else if (opcode == 0xE8) {
           mnemonic = "psubsb";
         } else if (opcode == 0xE9) {
@@ -1975,8 +2116,6 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
           mnemonic = "paddw";
         } else if (opcode == 0xFE) {
           mnemonic = "paddd";
-        } else if (opcode == 0xC2) {
-          mnemonic = "cmppd";
         } else {
           UnimplementedInstruction();
         }
@@ -2176,6 +2315,12 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
       AppendToBuffer("%s,", NameOfXMMRegister(regop));
       current += PrintRightXMMOperand(current);
     }
+  } else if (opcode == 0x16) {
+    // movlhps xmm1, xmm2
+    int mod, regop, rm;
+    get_modrm(*current, &mod, &regop, &rm);
+    AppendToBuffer("movlhps %s,", NameOfXMMRegister(regop));
+    current += PrintRightXMMOperand(current);
   } else if (opcode == 0x1F) {
     // NOP
     int mod, regop, rm;
@@ -2233,6 +2378,11 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
                    NameOfXMMRegister(regop));
     current += PrintRightXMMOperand(current);
 
+  } else if (opcode == 0xC0) {
+    byte_size_operand_ = true;
+    current += PrintOperands("xadd", OPER_REG_OP_ORDER, current);
+  } else if (opcode == 0xC1) {
+    current += PrintOperands("xadd", OPER_REG_OP_ORDER, current);
   } else if (opcode == 0xC2) {
     // cmpps xmm, xmm/m128, imm8
     int mod, regop, rm;
@@ -2261,13 +2411,6 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
     get_modrm(*current, &mod, &regop, &rm);
     AppendToBuffer("movmskps %s,", NameOfCPURegister(regop));
     current += PrintRightXMMOperand(current);
-  } else if (opcode == 0x70) {
-    int mod, regop, rm;
-    get_modrm(*current, &mod, &regop, &rm);
-    AppendToBuffer("pshufw %s, ", NameOfXMMRegister(regop));
-    current += PrintRightXMMOperand(current);
-    AppendToBuffer(", %d", (*current) & 3);
-    current += 1;
   } else if ((opcode & 0xF0) == 0x80) {
     // Jcc: Conditional jump (branch).
     current = data + JumpConditional(data);
@@ -2345,6 +2488,8 @@ const char* DisassemblerX64::TwoByteMnemonic(byte opcode) {
       return (group_1_prefix_ == 0xF2) ? "mulsd" : "mulss";
     case 0x5A:  // F2/F3 prefix.
       return (group_1_prefix_ == 0xF2) ? "cvtsd2ss" : "cvtss2sd";
+    case 0x5B:  // F2/F3 prefix.
+      return "cvttps2dq";
     case 0x5D:  // F2/F3 prefix.
       return (group_1_prefix_ == 0xF2) ? "minsd" : "minss";
     case 0x5C:  // F2/F3 prefix.
diff --git a/deps/v8/src/execution/OWNERS b/deps/v8/src/execution/OWNERS
index 75c1a1b30effc9..9437c656a12984 100644
--- a/deps/v8/src/execution/OWNERS
+++ b/deps/v8/src/execution/OWNERS
@@ -2,12 +2,10 @@ bmeurer@chromium.org
 ishell@chromium.org
 jgruber@chromium.org
 jkummerow@chromium.org
-mstarzinger@chromium.org
 mythria@chromium.org
 delphick@chromium.org
 petermarshall@chromium.org
 szuend@chromium.org
 verwaest@chromium.org
-yangguo@chromium.org
 
 # COMPONENT: Blink>JavaScript>Runtime
diff --git a/deps/v8/src/execution/arm/frame-constants-arm.h b/deps/v8/src/execution/arm/frame-constants-arm.h
index 10b4aa28fc1cff..faa3cc8ab76db6 100644
--- a/deps/v8/src/execution/arm/frame-constants-arm.h
+++ b/deps/v8/src/execution/arm/frame-constants-arm.h
@@ -23,21 +23,6 @@ class EntryFrameConstants : public AllStatic {
   static constexpr int kArgvOffset = +1 * kSystemPointerSize;
 };
 
-class ExitFrameConstants : public TypedFrameConstants {
- public:
-  static constexpr int kSPOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
-  DEFINE_TYPED_FRAME_SIZES(1);
-
-  // The caller fields are below the frame pointer on the stack.
-  static constexpr int kCallerFPOffset = 0 * kPointerSize;
-  // The calling JS function is below FP.
-  static constexpr int kCallerPCOffset = 1 * kPointerSize;
-
-  // FP-relative displacement of the caller's SP.  It points just
-  // below the saved PC.
-  static constexpr int kCallerSPDisplacement = 2 * kPointerSize;
-};
-
 class WasmCompileLazyFrameConstants : public TypedFrameConstants {
  public:
   static constexpr int kNumberOfSavedGpParamRegs = 4;
@@ -51,20 +36,6 @@ class WasmCompileLazyFrameConstants : public TypedFrameConstants {
       kNumberOfSavedFpParamRegs * kDoubleSize;
 };
 
-class JavaScriptFrameConstants : public AllStatic {
- public:
-  // FP-relative.
-  static constexpr int kLocal0Offset =
-      StandardFrameConstants::kExpressionsOffset;
-  static constexpr int kLastParameterOffset = +2 * kPointerSize;
-  static constexpr int kFunctionOffset =
-      StandardFrameConstants::kFunctionOffset;
-
-  // Caller SP-relative.
-  static constexpr int kParam0Offset = -2 * kPointerSize;
-  static constexpr int kReceiverOffset = -1 * kPointerSize;
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/execution/arm/simulator-arm.cc b/deps/v8/src/execution/arm/simulator-arm.cc
index 841ff4bfd4f573..193a9966762250 100644
--- a/deps/v8/src/execution/arm/simulator-arm.cc
+++ b/deps/v8/src/execution/arm/simulator-arm.cc
@@ -3912,6 +3912,18 @@ void SaturatingNarrow(Simulator* simulator, int Vd, int Vm) {
   simulator->set_neon_register<U, kDoubleSize>(Vd, dst);
 }
 
+template <typename T, typename U>
+void SaturatingUnsignedNarrow(Simulator* simulator, int Vd, int Vm) {
+  static const int kLanes = 16 / sizeof(T);
+  T src[kLanes];
+  U dst[kLanes];
+  simulator->get_neon_register(Vm, src);
+  for (int i = 0; i < kLanes; i++) {
+    dst[i] = Clamp<U>(src[i]);
+  }
+  simulator->set_neon_register<U, kDoubleSize>(Vd, dst);
+}
+
 template <typename T>
 void AddSaturate(Simulator* simulator, int Vd, int Vm, int Vn) {
   static const int kLanes = 16 / sizeof(T);
@@ -3931,7 +3943,7 @@ void SubSaturate(Simulator* simulator, int Vd, int Vm, int Vn) {
   simulator->get_neon_register(Vn, src1);
   simulator->get_neon_register(Vm, src2);
   for (int i = 0; i < kLanes; i++) {
-    src1[i] = Clamp<T>(Widen<T, int64_t>(src1[i]) - Widen<T, int64_t>(src2[i]));
+    src1[i] = SaturateSub<T>(src1[i], src2[i]);
   }
   simulator->set_neon_register(Vd, src1);
 }
@@ -4213,6 +4225,20 @@ void PairwiseAdd(Simulator* simulator, int Vd, int Vm, int Vn) {
   simulator->set_neon_register<T, kDoubleSize>(Vd, dst);
 }
 
+template <typename T, int SIZE = kSimd128Size>
+void RoundingAverageUnsigned(Simulator* simulator, int Vd, int Vm, int Vn) {
+  static_assert(std::is_unsigned<T>::value,
+                "Implemented only for unsigned types.");
+  static const int kElems = SIZE / sizeof(T);
+  T src1[kElems], src2[kElems];
+  simulator->get_neon_register<T, SIZE>(Vn, src1);
+  simulator->get_neon_register<T, SIZE>(Vm, src2);
+  for (int i = 0; i < kElems; i++) {
+    src1[i] = base::RoundingAverageUnsigned(src1[i], src2[i]);
+  }
+  simulator->set_neon_register<T, SIZE>(Vd, src1);
+}
+
 void Simulator::DecodeSpecialCondition(Instruction* instr) {
   switch (instr->SpecialValue()) {
     case 4: {
@@ -4275,6 +4301,16 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
               src1[i] = src1[i] & src2[i];
             }
             set_neon_register(Vd, src1);
+          } else if (instr->Bits(21, 20) == 1 && instr->Bit(6) == 1 &&
+                     instr->Bit(4) == 1) {
+            // vbic Qd, Qm, Qn.
+            uint32_t src1[4], src2[4];
+            get_neon_register(Vn, src1);
+            get_neon_register(Vm, src2);
+            for (int i = 0; i < 4; i++) {
+              src1[i] = src1[i] & ~src2[i];
+            }
+            set_neon_register(Vd, src1);
           } else {
             UNIMPLEMENTED();
           }
@@ -4294,6 +4330,9 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
               case Neon32:
                 SubSaturate<int32_t>(this, Vd, Vm, Vn);
                 break;
+              case Neon64:
+                SubSaturate<int64_t>(this, Vd, Vm, Vn);
+                break;
               default:
                 UNREACHABLE();
                 break;
@@ -4336,6 +4375,9 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
             case Neon32:
               ShiftByRegister<int32_t, int32_t, kSimd128Size>(this, Vd, Vm, Vn);
               break;
+            case Neon64:
+              ShiftByRegister<int64_t, int64_t, kSimd128Size>(this, Vd, Vm, Vn);
+              break;
             default:
               UNREACHABLE();
               break;
@@ -4377,8 +4419,8 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
               case Neon32:
                 Add<uint32_t, kSimd128Size>(this, Vd, Vm, Vn);
                 break;
-              default:
-                UNREACHABLE();
+              case Neon64:
+                Add<uint64_t, kSimd128Size>(this, Vd, Vm, Vn);
                 break;
             }
           } else {
@@ -4535,8 +4577,28 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
       break;
     }
     case 5:
-      if ((instr->Bits(18, 16) == 0) && (instr->Bits(11, 6) == 0x28) &&
-          (instr->Bit(4) == 1)) {
+      if (instr->Bit(23) == 1 && instr->Bits(21, 19) == 0 &&
+          instr->Bit(7) == 0 && instr->Bit(4) == 1) {
+        // One register and a modified immediate value, see ARM DDI 0406C.d
+        // A7.4.6. Handles vmov, vorr, vmvn, vbic.
+        // Only handle vmov.i32 for now.
+        byte cmode = instr->Bits(11, 8);
+        switch (cmode) {
+          case 0: {
+            // vmov.i32 Qd, #<imm>
+            int vd = instr->VFPDRegValue(kSimd128Precision);
+            uint64_t imm = instr->Bit(24, 24) << 7;  // i
+            imm |= instr->Bits(18, 16) << 4;         // imm3
+            imm |= instr->Bits(3, 0);                // imm4
+            imm |= imm << 32;
+            set_neon_register(vd, {imm, imm});
+            break;
+          }
+          default:
+            UNIMPLEMENTED();
+        }
+      } else if ((instr->Bits(18, 16) == 0) && (instr->Bits(11, 6) == 0x28) &&
+                 (instr->Bit(4) == 1)) {
         // vmovl signed
         if ((instr->VdValue() & 1) != 0) UNIMPLEMENTED();
         int Vd = instr->VFPDRegValue(kSimd128Precision);
@@ -4574,13 +4636,16 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
           dst[i] = src2[i - boundary];
         }
         set_neon_register(Vd, dst);
-      } else if (instr->Bits(11, 7) == 0xA && instr->Bit(4) == 1) {
+      } else if (instr->Bits(11, 8) == 5 && instr->Bit(4) == 1) {
         // vshl.i<size> Qd, Qm, shift
-        int size = base::bits::RoundDownToPowerOfTwo32(instr->Bits(21, 16));
-        int shift = instr->Bits(21, 16) - size;
+        int imm7 = instr->Bits(21, 16);
+        if (instr->Bit(7) != 0) imm7 += 64;
+        int size = base::bits::RoundDownToPowerOfTwo32(imm7);
+        int shift = imm7 - size;
         int Vd = instr->VFPDRegValue(kSimd128Precision);
         int Vm = instr->VFPMRegValue(kSimd128Precision);
-        NeonSize ns = static_cast<NeonSize>(size / 16);
+        NeonSize ns =
+            static_cast<NeonSize>(base::bits::WhichPowerOfTwo(size >> 3));
         switch (ns) {
           case Neon8:
             ShiftLeft<uint8_t, kSimd128Size>(this, Vd, Vm, shift);
@@ -4591,17 +4656,20 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
           case Neon32:
             ShiftLeft<uint32_t, kSimd128Size>(this, Vd, Vm, shift);
             break;
-          default:
-            UNREACHABLE();
+          case Neon64:
+            ShiftLeft<uint64_t, kSimd128Size>(this, Vd, Vm, shift);
             break;
         }
-      } else if (instr->Bits(11, 7) == 0 && instr->Bit(4) == 1) {
+      } else if (instr->Bits(11, 8) == 0 && instr->Bit(4) == 1) {
         // vshr.s<size> Qd, Qm, shift
-        int size = base::bits::RoundDownToPowerOfTwo32(instr->Bits(21, 16));
-        int shift = 2 * size - instr->Bits(21, 16);
+        int imm7 = instr->Bits(21, 16);
+        if (instr->Bit(7) != 0) imm7 += 64;
+        int size = base::bits::RoundDownToPowerOfTwo32(imm7);
+        int shift = 2 * size - imm7;
         int Vd = instr->VFPDRegValue(kSimd128Precision);
         int Vm = instr->VFPMRegValue(kSimd128Precision);
-        NeonSize ns = static_cast<NeonSize>(size / 16);
+        NeonSize ns =
+            static_cast<NeonSize>(base::bits::WhichPowerOfTwo(size >> 3));
         switch (ns) {
           case Neon8:
             ArithmeticShiftRight<int8_t, kSimd128Size>(this, Vd, Vm, shift);
@@ -4612,8 +4680,8 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
           case Neon32:
             ArithmeticShiftRight<int32_t, kSimd128Size>(this, Vd, Vm, shift);
             break;
-          default:
-            UNREACHABLE();
+          case Neon64:
+            ArithmeticShiftRight<int64_t, kSimd128Size>(this, Vd, Vm, shift);
             break;
         }
       } else {
@@ -4683,6 +4751,27 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
               for (int i = 0; i < 4; i++) src1[i] ^= src2[i];
               set_neon_register(Vd, src1);
             }
+          } else if (instr->Bit(4) == 0) {
+            if (instr->Bit(6) == 0) {
+              // vrhadd.u<size> Dd, Dm, Dn.
+              UNIMPLEMENTED();
+            }
+            // vrhadd.u<size> Qd, Qm, Qn.
+            NeonSize size = static_cast<NeonSize>(instr->Bits(21, 20));
+            switch (size) {
+              case Neon8:
+                RoundingAverageUnsigned<uint8_t>(this, Vd, Vm, Vn);
+                break;
+              case Neon16:
+                RoundingAverageUnsigned<uint16_t>(this, Vd, Vm, Vn);
+                break;
+              case Neon32:
+                RoundingAverageUnsigned<uint32_t>(this, Vd, Vm, Vn);
+                break;
+              default:
+                UNREACHABLE();
+                break;
+            }
           } else {
             UNIMPLEMENTED();
           }
@@ -4746,6 +4835,10 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
               ShiftByRegister<uint32_t, int32_t, kSimd128Size>(this, Vd, Vm,
                                                                Vn);
               break;
+            case Neon64:
+              ShiftByRegister<uint64_t, int64_t, kSimd128Size>(this, Vd, Vm,
+                                                               Vn);
+              break;
             default:
               UNREACHABLE();
               break;
@@ -4786,8 +4879,8 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
               case Neon32:
                 Sub<uint32_t, kSimd128Size>(this, Vd, Vm, Vn);
                 break;
-              default:
-                UNREACHABLE();
+              case Neon64:
+                Sub<uint64_t, kSimd128Size>(this, Vd, Vm, Vn);
                 break;
             }
           } else {
@@ -5309,27 +5402,35 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
           int Vd = instr->VFPDRegValue(kDoublePrecision);
           int Vm = instr->VFPMRegValue(kSimd128Precision);
           NeonSize size = static_cast<NeonSize>(instr->Bits(19, 18));
-          bool is_unsigned = instr->Bit(6) != 0;
+          bool dst_unsigned = instr->Bit(6) != 0;
+          bool src_unsigned = instr->Bit(7, 6) == 0b11;
+          DCHECK_IMPLIES(src_unsigned, dst_unsigned);
           switch (size) {
             case Neon8: {
-              if (is_unsigned) {
+              if (src_unsigned) {
                 SaturatingNarrow<uint16_t, uint8_t>(this, Vd, Vm);
+              } else if (dst_unsigned) {
+                SaturatingUnsignedNarrow<int16_t, uint8_t>(this, Vd, Vm);
               } else {
                 SaturatingNarrow<int16_t, int8_t>(this, Vd, Vm);
               }
               break;
             }
             case Neon16: {
-              if (is_unsigned) {
+              if (src_unsigned) {
                 SaturatingNarrow<uint32_t, uint16_t>(this, Vd, Vm);
+              } else if (dst_unsigned) {
+                SaturatingUnsignedNarrow<int32_t, uint16_t>(this, Vd, Vm);
               } else {
                 SaturatingNarrow<int32_t, int16_t>(this, Vd, Vm);
               }
               break;
             }
             case Neon32: {
-              if (is_unsigned) {
+              if (src_unsigned) {
                 SaturatingNarrow<uint64_t, uint32_t>(this, Vd, Vm);
+              } else if (dst_unsigned) {
+                SaturatingUnsignedNarrow<int64_t, uint32_t>(this, Vd, Vm);
               } else {
                 SaturatingNarrow<int64_t, int32_t>(this, Vd, Vm);
               }
@@ -5342,13 +5443,16 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
         } else {
           UNIMPLEMENTED();
         }
-      } else if (instr->Bits(11, 7) == 0 && instr->Bit(4) == 1) {
+      } else if (instr->Bits(11, 8) == 0 && instr->Bit(4) == 1) {
         // vshr.u<size> Qd, Qm, shift
-        int size = base::bits::RoundDownToPowerOfTwo32(instr->Bits(21, 16));
-        int shift = 2 * size - instr->Bits(21, 16);
+        int imm7 = instr->Bits(21, 16);
+        if (instr->Bit(7) != 0) imm7 += 64;
+        int size = base::bits::RoundDownToPowerOfTwo32(imm7);
+        int shift = 2 * size - imm7;
         int Vd = instr->VFPDRegValue(kSimd128Precision);
         int Vm = instr->VFPMRegValue(kSimd128Precision);
-        NeonSize ns = static_cast<NeonSize>(size / 16);
+        NeonSize ns =
+            static_cast<NeonSize>(base::bits::WhichPowerOfTwo(size >> 3));
         switch (ns) {
           case Neon8:
             ShiftRight<uint8_t, kSimd128Size>(this, Vd, Vm, shift);
@@ -5359,8 +5463,8 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
           case Neon32:
             ShiftRight<uint32_t, kSimd128Size>(this, Vd, Vm, shift);
             break;
-          default:
-            UNREACHABLE();
+          case Neon64:
+            ShiftRight<uint64_t, kSimd128Size>(this, Vd, Vm, shift);
             break;
         }
       } else if (instr->Bits(11, 8) == 0x5 && instr->Bit(6) == 0 &&
@@ -5415,6 +5519,39 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
             UNREACHABLE();
             break;
         }
+      } else if (instr->Bits(11, 8) == 0x8 && instr->Bit(6) == 0 &&
+                 instr->Bit(4) == 0) {
+        // vmlal.u<size> Qd, Dn, Dm
+        NeonSize size = static_cast<NeonSize>(instr->Bits(21, 20));
+        if (size != Neon32) UNIMPLEMENTED();
+
+        int Vd = instr->VFPDRegValue(kSimd128Precision);
+        int Vn = instr->VFPNRegValue(kDoublePrecision);
+        int Vm = instr->VFPMRegValue(kDoublePrecision);
+        uint64_t src1, src2, dst[2];
+
+        get_neon_register<uint64_t>(Vd, dst);
+        get_d_register(Vn, &src1);
+        get_d_register(Vm, &src2);
+        dst[0] += (src1 & 0xFFFFFFFFULL) * (src2 & 0xFFFFFFFFULL);
+        dst[1] += (src1 >> 32) * (src2 >> 32);
+        set_neon_register<uint64_t>(Vd, dst);
+      } else if (instr->Bits(11, 8) == 0xC && instr->Bit(6) == 0 &&
+                 instr->Bit(4) == 0) {
+        // vmull.u<size> Qd, Dn, Dm
+        NeonSize size = static_cast<NeonSize>(instr->Bits(21, 20));
+        if (size != Neon32) UNIMPLEMENTED();
+
+        int Vd = instr->VFPDRegValue(kSimd128Precision);
+        int Vn = instr->VFPNRegValue(kDoublePrecision);
+        int Vm = instr->VFPMRegValue(kDoublePrecision);
+        uint64_t src1, src2, dst[2];
+
+        get_d_register(Vn, &src1);
+        get_d_register(Vm, &src2);
+        dst[0] = (src1 & 0xFFFFFFFFULL) * (src2 & 0xFFFFFFFFULL);
+        dst[1] = (src1 >> 32) * (src2 >> 32);
+        set_neon_register<uint64_t>(Vd, dst);
       } else {
         UNIMPLEMENTED();
       }
@@ -5506,6 +5643,63 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
         UNIMPLEMENTED();
       }
       break;
+    case 9: {
+      if (instr->Bits(21, 20) == 2) {
+        // Bits(11, 8) is the B field in A7.7 Advanced SIMD element or structure
+        // load/store instructions.
+        if (instr->Bits(11, 8) == 0xC) {
+          // vld1 (single element to all lanes).
+          DCHECK_EQ(instr->Bits(11, 8), 0b1100);  // Type field.
+          int Vd = (instr->Bit(22) << 4) | instr->VdValue();
+          int Rn = instr->VnValue();
+          int Rm = instr->VmValue();
+          int32_t address = get_register(Rn);
+          int regs = instr->Bit(5) + 1;
+          int size = instr->Bits(7, 6);
+          uint32_t q_data[4];
+          switch (size) {
+            case Neon8: {
+              uint8_t data = ReadBU(address);
+              uint8_t* dst = reinterpret_cast<uint8_t*>(q_data);
+              for (int i = 0; i < 16; i++) {
+                dst[i] = data;
+              }
+              break;
+            }
+            case Neon16: {
+              uint16_t data = ReadHU(address);
+              uint16_t* dst = reinterpret_cast<uint16_t*>(q_data);
+              for (int i = 0; i < 8; i++) {
+                dst[i] = data;
+              }
+              break;
+            }
+            case Neon32: {
+              uint32_t data = ReadW(address);
+              for (int i = 0; i < 4; i++) {
+                q_data[i] = data;
+              }
+              break;
+            }
+          }
+          for (int r = 0; r < regs; r++) {
+            set_neon_register(Vd + r, q_data);
+          }
+          if (Rm != 15) {
+            if (Rm == 13) {
+              set_register(Rn, address);
+            } else {
+              set_register(Rn, get_register(Rn) + get_register(Rm));
+            }
+          }
+        } else {
+          UNIMPLEMENTED();
+        }
+      } else {
+        UNIMPLEMENTED();
+      }
+      break;
+    }
     case 0xA:
     case 0xB:
       if ((instr->Bits(22, 20) == 5) && (instr->Bits(15, 12) == 0xF)) {
diff --git a/deps/v8/src/execution/arm64/frame-constants-arm64.h b/deps/v8/src/execution/arm64/frame-constants-arm64.h
index d35ed2e75a9dad..4617d48d71df64 100644
--- a/deps/v8/src/execution/arm64/frame-constants-arm64.h
+++ b/deps/v8/src/execution/arm64/frame-constants-arm64.h
@@ -16,6 +16,18 @@ namespace internal {
 //
 //  slot      Entry frame
 //       +---------------------+-----------------------
+// -20   | saved register d15  |
+// ...   |        ...          |
+// -13   | saved register d8   |
+//       |- - - - - - - - - - -|
+// -12   |   saved lr (x30)    |
+//       |- - - - - - - - - - -|
+// -11   |   saved fp (x29)    |
+//       |- - - - - - - - - - -|
+// -10   | saved register x28  |
+// ...   |        ...          |
+//  -1   | saved register x19  |
+//       |- - - - - - - - - - -|
 //   0   |  bad frame pointer  |  <-- frame ptr
 //       |   (0xFFF.. FF)      |
 //       |- - - - - - - - - - -|
@@ -39,15 +51,26 @@ class EntryFrameConstants : public AllStatic {
   // Isolate::c_entry_fp onto the stack.
   static constexpr int kCallerFPOffset = -3 * kSystemPointerSize;
   static constexpr int kFixedFrameSize = 6 * kSystemPointerSize;
-};
 
-class ExitFrameConstants : public TypedFrameConstants {
- public:
-  static constexpr int kSPOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
-  DEFINE_TYPED_FRAME_SIZES(1);
-  static constexpr int kLastExitFrameField = kSPOffset;
+  // The following constants are defined so we can static-assert their values
+  // near the relevant JSEntry assembly code, not because they're actually very
+  // useful.
+  static constexpr int kCalleeSavedRegisterBytesPushedBeforeFpLrPair =
+      8 * kSystemPointerSize;
+  static constexpr int kCalleeSavedRegisterBytesPushedAfterFpLrPair =
+      10 * kSystemPointerSize;
+  static constexpr int kOffsetToCalleeSavedRegisters = 1 * kSystemPointerSize;
 
-  static constexpr int kConstantPoolOffset = 0;  // Not used
+  // These offsets refer to the immediate caller (a native frame), not to the
+  // previous JS exit frame like kCallerFPOffset above.
+  static constexpr int kDirectCallerFPOffset =
+      kCalleeSavedRegisterBytesPushedAfterFpLrPair +
+      kOffsetToCalleeSavedRegisters;
+  static constexpr int kDirectCallerPCOffset =
+      kDirectCallerFPOffset + 1 * kSystemPointerSize;
+  static constexpr int kDirectCallerSPOffset =
+      kDirectCallerPCOffset + 1 * kSystemPointerSize +
+      kCalleeSavedRegisterBytesPushedBeforeFpLrPair;
 };
 
 class WasmCompileLazyFrameConstants : public TypedFrameConstants {
@@ -64,20 +87,6 @@ class WasmCompileLazyFrameConstants : public TypedFrameConstants {
       kNumberOfSavedFpParamRegs * kDoubleSize;
 };
 
-class JavaScriptFrameConstants : public AllStatic {
- public:
-  // FP-relative.
-  static constexpr int kLocal0Offset =
-      StandardFrameConstants::kExpressionsOffset;
-
-  // There are two words on the stack (saved fp and saved lr) between fp and
-  // the arguments.
-  static constexpr int kLastParameterOffset = 2 * kSystemPointerSize;
-
-  static constexpr int kFunctionOffset =
-      StandardFrameConstants::kFunctionOffset;
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/execution/arm64/pointer-auth-arm64.cc b/deps/v8/src/execution/arm64/pointer-auth-arm64.cc
index cb8ff2c7401955..36e792b752e58f 100644
--- a/deps/v8/src/execution/arm64/pointer-auth-arm64.cc
+++ b/deps/v8/src/execution/arm64/pointer-auth-arm64.cc
@@ -226,7 +226,7 @@ uint64_t Simulator::AuthPAC(uint64_t ptr, uint64_t context, PACKey key,
 
   uint64_t pac = ComputePAC(original_ptr, context, key);
 
-  uint64_t error_code = 1 << key.number;
+  uint64_t error_code = UINT64_C(1) << key.number;
   if ((pac & pac_mask) == (ptr & pac_mask)) {
     return original_ptr;
   } else {
diff --git a/deps/v8/src/execution/arm64/simulator-arm64.cc b/deps/v8/src/execution/arm64/simulator-arm64.cc
index d3a73cbad87218..8ee43c07e8f25b 100644
--- a/deps/v8/src/execution/arm64/simulator-arm64.cc
+++ b/deps/v8/src/execution/arm64/simulator-arm64.cc
@@ -102,7 +102,7 @@ Simulator* Simulator::current(Isolate* isolate) {
 
   Simulator* sim = isolate_data->simulator();
   if (sim == nullptr) {
-    if (FLAG_trace_sim || FLAG_log_instruction_stats || FLAG_debug_sim) {
+    if (FLAG_trace_sim || FLAG_debug_sim) {
       sim = new Simulator(new Decoder<DispatchingDecoderVisitor>(), isolate);
     } else {
       sim = new Decoder<Simulator>();
@@ -310,12 +310,6 @@ Simulator::Simulator(Decoder<DispatchingDecoderVisitor>* decoder,
     decoder_->InsertVisitorBefore(print_disasm_, this);
     log_parameters_ = LOG_ALL;
   }
-
-  if (FLAG_log_instruction_stats) {
-    instrument_ =
-        new Instrument(FLAG_log_instruction_file, FLAG_log_instruction_period);
-    decoder_->AppendVisitor(instrument_);
-  }
 }
 
 Simulator::Simulator()
@@ -324,7 +318,7 @@ Simulator::Simulator()
       log_parameters_(NO_PARAM),
       isolate_(nullptr) {
   Init(stdout);
-  CHECK(!FLAG_trace_sim && !FLAG_log_instruction_stats);
+  CHECK(!FLAG_trace_sim);
 }
 
 void Simulator::Init(FILE* stream) {
@@ -372,9 +366,6 @@ void Simulator::ResetState() {
 Simulator::~Simulator() {
   GlobalMonitor::Get()->RemoveProcessor(&global_monitor_processor_);
   delete[] reinterpret_cast<byte*>(stack_);
-  if (FLAG_log_instruction_stats) {
-    delete instrument_;
-  }
   delete disassembler_decoder_;
   delete print_disasm_;
   DeleteArray(last_debugger_input_);
diff --git a/deps/v8/src/execution/arm64/simulator-arm64.h b/deps/v8/src/execution/arm64/simulator-arm64.h
index 4a493ec6963335..ae3b6867a9379a 100644
--- a/deps/v8/src/execution/arm64/simulator-arm64.h
+++ b/deps/v8/src/execution/arm64/simulator-arm64.h
@@ -16,7 +16,6 @@
 #include "src/base/compiler-specific.h"
 #include "src/codegen/arm64/assembler-arm64.h"
 #include "src/codegen/arm64/decoder-arm64.h"
-#include "src/codegen/arm64/instrument-arm64.h"
 #include "src/codegen/assembler.h"
 #include "src/diagnostics/arm64/disasm-arm64.h"
 #include "src/execution/simulator-base.h"
@@ -1304,13 +1303,16 @@ class Simulator : public DecoderVisitor, public SimulatorBase {
   }
 
   // Armv8.3 Pointer authentication helpers.
-  static uint64_t CalculatePACMask(uint64_t ptr, PointerType type, int ext_bit);
-  static uint64_t ComputePAC(uint64_t data, uint64_t context, PACKey key);
-  static uint64_t AuthPAC(uint64_t ptr, uint64_t context, PACKey key,
-                          PointerType type);
-  static uint64_t AddPAC(uint64_t ptr, uint64_t context, PACKey key,
-                         PointerType type);
-  static uint64_t StripPAC(uint64_t ptr, PointerType type);
+  V8_EXPORT_PRIVATE static uint64_t CalculatePACMask(uint64_t ptr,
+                                                     PointerType type,
+                                                     int ext_bit);
+  V8_EXPORT_PRIVATE static uint64_t ComputePAC(uint64_t data, uint64_t context,
+                                               PACKey key);
+  V8_EXPORT_PRIVATE static uint64_t AuthPAC(uint64_t ptr, uint64_t context,
+                                            PACKey key, PointerType type);
+  V8_EXPORT_PRIVATE static uint64_t AddPAC(uint64_t ptr, uint64_t context,
+                                           PACKey key, PointerType type);
+  V8_EXPORT_PRIVATE static uint64_t StripPAC(uint64_t ptr, PointerType type);
 
  protected:
   // Simulation helpers ------------------------------------
@@ -2138,9 +2140,6 @@ class Simulator : public DecoderVisitor, public SimulatorBase {
   PrintDisassembler* print_disasm_;
   void PRINTF_FORMAT(2, 3) TraceSim(const char* format, ...);
 
-  // Instrumentation.
-  Instrument* instrument_;
-
   // General purpose registers. Register 31 is the stack pointer.
   SimRegister registers_[kNumberOfRegisters];
 
diff --git a/deps/v8/src/execution/execution.cc b/deps/v8/src/execution/execution.cc
index 06c4e3a6cc9df8..61219a21d7a165 100644
--- a/deps/v8/src/execution/execution.cc
+++ b/deps/v8/src/execution/execution.cc
@@ -40,7 +40,7 @@ struct InvokeParams {
       Isolate* isolate, Handle<Object> callable, Handle<Object> receiver,
       int argc, Handle<Object>* argv,
       Execution::MessageHandling message_handling,
-      MaybeHandle<Object>* exception_out);
+      MaybeHandle<Object>* exception_out, bool reschedule_terminate);
 
   static InvokeParams SetUpForRunMicrotasks(Isolate* isolate,
                                             MicrotaskQueue* microtask_queue,
@@ -59,6 +59,7 @@ struct InvokeParams {
 
   bool is_construct;
   Execution::Target execution_target;
+  bool reschedule_terminate;
 };
 
 // static
@@ -77,6 +78,7 @@ InvokeParams InvokeParams::SetUpForNew(Isolate* isolate,
   params.exception_out = nullptr;
   params.is_construct = true;
   params.execution_target = Execution::Target::kCallable;
+  params.reschedule_terminate = true;
   return params;
 }
 
@@ -96,6 +98,7 @@ InvokeParams InvokeParams::SetUpForCall(Isolate* isolate,
   params.exception_out = nullptr;
   params.is_construct = false;
   params.execution_target = Execution::Target::kCallable;
+  params.reschedule_terminate = true;
   return params;
 }
 
@@ -103,7 +106,7 @@ InvokeParams InvokeParams::SetUpForCall(Isolate* isolate,
 InvokeParams InvokeParams::SetUpForTryCall(
     Isolate* isolate, Handle<Object> callable, Handle<Object> receiver,
     int argc, Handle<Object>* argv, Execution::MessageHandling message_handling,
-    MaybeHandle<Object>* exception_out) {
+    MaybeHandle<Object>* exception_out, bool reschedule_terminate) {
   InvokeParams params;
   params.target = callable;
   params.receiver = NormalizeReceiver(isolate, receiver);
@@ -115,6 +118,7 @@ InvokeParams InvokeParams::SetUpForTryCall(
   params.exception_out = exception_out;
   params.is_construct = false;
   params.execution_target = Execution::Target::kCallable;
+  params.reschedule_terminate = reschedule_terminate;
   return params;
 }
 
@@ -134,6 +138,7 @@ InvokeParams InvokeParams::SetUpForRunMicrotasks(
   params.exception_out = exception_out;
   params.is_construct = false;
   params.execution_target = Execution::Target::kRunMicrotasks;
+  params.reschedule_terminate = true;
   return params;
 }
 
@@ -152,6 +157,91 @@ Handle<Code> JSEntry(Isolate* isolate, Execution::Target execution_target,
   UNREACHABLE();
 }
 
+MaybeHandle<Context> NewScriptContext(Isolate* isolate,
+                                      Handle<JSFunction> function) {
+  // Creating a script context is a side effect, so abort if that's not
+  // allowed.
+  if (isolate->debug_execution_mode() == DebugInfo::kSideEffects) {
+    isolate->Throw(*isolate->factory()->NewEvalError(
+        MessageTemplate::kNoSideEffectDebugEvaluate));
+    return MaybeHandle<Context>();
+  }
+  SaveAndSwitchContext save(isolate, function->context());
+  SharedFunctionInfo sfi = function->shared();
+  Handle<Script> script(Script::cast(sfi.script()), isolate);
+  Handle<ScopeInfo> scope_info(sfi.scope_info(), isolate);
+  Handle<NativeContext> native_context(NativeContext::cast(function->context()),
+                                       isolate);
+  Handle<JSGlobalObject> global_object(native_context->global_object(),
+                                       isolate);
+  Handle<ScriptContextTable> script_context(
+      native_context->script_context_table(), isolate);
+
+  // Find name clashes.
+  for (int var = 0; var < scope_info->ContextLocalCount(); var++) {
+    Handle<String> name(scope_info->ContextLocalName(var), isolate);
+    VariableMode mode = scope_info->ContextLocalMode(var);
+    ScriptContextTable::LookupResult lookup;
+    if (ScriptContextTable::Lookup(isolate, *script_context, *name, &lookup)) {
+      if (IsLexicalVariableMode(mode) || IsLexicalVariableMode(lookup.mode)) {
+        Handle<Context> context = ScriptContextTable::GetContext(
+            isolate, script_context, lookup.context_index);
+        // If we are trying to re-declare a REPL-mode let as a let, allow it.
+        if (!(mode == VariableMode::kLet && lookup.mode == VariableMode::kLet &&
+              scope_info->IsReplModeScope() &&
+              context->scope_info().IsReplModeScope())) {
+          // ES#sec-globaldeclarationinstantiation 5.b:
+          // If envRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+          // exception.
+          MessageLocation location(script, 0, 1);
+          isolate->ThrowAt(isolate->factory()->NewSyntaxError(
+                               MessageTemplate::kVarRedeclaration, name),
+                           &location);
+          return MaybeHandle<Context>();
+        }
+      }
+    }
+
+    if (IsLexicalVariableMode(mode)) {
+      LookupIterator it(isolate, global_object, name, global_object,
+                        LookupIterator::OWN_SKIP_INTERCEPTOR);
+      Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
+      // Can't fail since the we looking up own properties on the global object
+      // skipping interceptors.
+      CHECK(!maybe.IsNothing());
+      if ((maybe.FromJust() & DONT_DELETE) != 0) {
+        // ES#sec-globaldeclarationinstantiation 5.a:
+        // If envRec.HasVarDeclaration(name) is true, throw a SyntaxError
+        // exception.
+        // ES#sec-globaldeclarationinstantiation 5.d:
+        // If hasRestrictedGlobal is true, throw a SyntaxError exception.
+        MessageLocation location(script, 0, 1);
+        isolate->ThrowAt(isolate->factory()->NewSyntaxError(
+                             MessageTemplate::kVarRedeclaration, name),
+                         &location);
+        return MaybeHandle<Context>();
+      }
+
+      JSGlobalObject::InvalidatePropertyCell(global_object, name);
+    }
+  }
+
+  Handle<Context> result =
+      isolate->factory()->NewScriptContext(native_context, scope_info);
+
+  int header = scope_info->ContextHeaderLength();
+  for (int var = 0; var < scope_info->ContextLocalCount(); var++) {
+    if (scope_info->ContextLocalInitFlag(var) == kNeedsInitialization) {
+      result->set(header + var, ReadOnlyRoots(isolate).the_hole_value());
+    }
+  }
+
+  Handle<ScriptContextTable> new_script_context_table =
+      ScriptContextTable::Extend(script_context, result);
+  native_context->set_script_context_table(*new_script_context_table);
+  return result;
+}
+
 V8_WARN_UNUSED_RESULT MaybeHandle<Object> Invoke(Isolate* isolate,
                                                  const InvokeParams& params) {
   RuntimeCallTimerScope timer(isolate, RuntimeCallCounterId::kInvoke);
@@ -201,6 +291,22 @@ V8_WARN_UNUSED_RESULT MaybeHandle<Object> Invoke(Isolate* isolate,
       }
       return value;
     }
+
+    // Set up a ScriptContext when running scripts that need it.
+    if (function->shared().needs_script_context()) {
+      Handle<Context> context;
+      if (!NewScriptContext(isolate, function).ToHandle(&context)) {
+        if (params.message_handling == Execution::MessageHandling::kReport) {
+          isolate->ReportPendingMessages();
+        }
+        return MaybeHandle<Object>();
+      }
+
+      // We mutate the context if we allocate a script context. This is
+      // guaranteed to only happen once in a native context since scripts will
+      // always produce name clashes with themselves.
+      function->set_context(*context);
+    }
   }
 
   // Entering JavaScript.
@@ -336,15 +442,17 @@ MaybeHandle<Object> InvokeWithTryCatch(Isolate* isolate,
           DCHECK(isolate->external_caught_exception());
           *params.exception_out = v8::Utils::OpenHandle(*catcher.Exception());
         }
-      }
-      if (params.message_handling == Execution::MessageHandling::kReport) {
-        isolate->OptionalRescheduleException(true);
+        if (params.message_handling == Execution::MessageHandling::kReport) {
+          isolate->OptionalRescheduleException(true);
+        }
       }
     }
   }
 
-  // Re-request terminate execution interrupt to trigger later.
-  if (is_termination) isolate->stack_guard()->RequestTerminateExecution();
+  if (is_termination && params.reschedule_terminate) {
+    // Reschedule terminate execution exception.
+    isolate->OptionalRescheduleException(false);
+  }
 
   return maybe_result;
 }
@@ -384,16 +492,14 @@ MaybeHandle<Object> Execution::New(Isolate* isolate, Handle<Object> constructor,
 }
 
 // static
-MaybeHandle<Object> Execution::TryCall(Isolate* isolate,
-                                       Handle<Object> callable,
-                                       Handle<Object> receiver, int argc,
-                                       Handle<Object> argv[],
-                                       MessageHandling message_handling,
-                                       MaybeHandle<Object>* exception_out) {
+MaybeHandle<Object> Execution::TryCall(
+    Isolate* isolate, Handle<Object> callable, Handle<Object> receiver,
+    int argc, Handle<Object> argv[], MessageHandling message_handling,
+    MaybeHandle<Object>* exception_out, bool reschedule_terminate) {
   return InvokeWithTryCatch(
-      isolate,
-      InvokeParams::SetUpForTryCall(isolate, callable, receiver, argc, argv,
-                                    message_handling, exception_out));
+      isolate, InvokeParams::SetUpForTryCall(
+                   isolate, callable, receiver, argc, argv, message_handling,
+                   exception_out, reschedule_terminate));
 }
 
 // static
diff --git a/deps/v8/src/execution/execution.h b/deps/v8/src/execution/execution.h
index 3b8ecf038d78f8..f1f175521ed36f 100644
--- a/deps/v8/src/execution/execution.h
+++ b/deps/v8/src/execution/execution.h
@@ -54,7 +54,7 @@ class Execution final : public AllStatic {
   V8_EXPORT_PRIVATE static MaybeHandle<Object> TryCall(
       Isolate* isolate, Handle<Object> callable, Handle<Object> receiver,
       int argc, Handle<Object> argv[], MessageHandling message_handling,
-      MaybeHandle<Object>* exception_out);
+      MaybeHandle<Object>* exception_out, bool reschedule_terminate = true);
   // Convenience method for performing RunMicrotasks
   static MaybeHandle<Object> TryRunMicrotasks(
       Isolate* isolate, MicrotaskQueue* microtask_queue,
diff --git a/deps/v8/src/execution/frame-constants.h b/deps/v8/src/execution/frame-constants.h
index a6e5c9522cc350..c215bbaeab2e48 100644
--- a/deps/v8/src/execution/frame-constants.h
+++ b/deps/v8/src/execution/frame-constants.h
@@ -292,6 +292,17 @@ class BuiltinContinuationFrameConstants : public TypedFrameConstants {
   static int PaddingSlotCount(int register_count);
 };
 
+class ExitFrameConstants : public TypedFrameConstants {
+ public:
+  static constexpr int kSPOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
+  static constexpr int kLastExitFrameField = kSPOffset;
+  DEFINE_TYPED_FRAME_SIZES(1);
+
+  // FP-relative displacement of the caller's SP.  It points just
+  // below the saved PC.
+  static constexpr int kCallerSPDisplacement = kCallerSPOffset;
+};
+
 // Behaves like an exit frame but with target and new target args.
 class BuiltinExitFrameConstants : public CommonFrameConstants {
  public:
diff --git a/deps/v8/src/execution/frames-inl.h b/deps/v8/src/execution/frames-inl.h
index 52f38857cca8b8..f1b979b7be3561 100644
--- a/deps/v8/src/execution/frames-inl.h
+++ b/deps/v8/src/execution/frames-inl.h
@@ -196,7 +196,7 @@ inline bool JavaScriptFrame::has_adapted_arguments() const {
 }
 
 inline Object JavaScriptFrame::function_slot_object() const {
-  const int offset = JavaScriptFrameConstants::kFunctionOffset;
+  const int offset = StandardFrameConstants::kFunctionOffset;
   return Object(base::Memory<Address>(fp() + offset));
 }
 
@@ -307,7 +307,8 @@ JavaScriptFrame* StackTraceFrameIterator::javascript_frame() const {
 inline StackFrame* SafeStackFrameIterator::frame() const {
   DCHECK(!done());
   DCHECK(frame_->is_java_script() || frame_->is_exit() ||
-         frame_->is_builtin_exit() || frame_->is_wasm());
+         frame_->is_builtin_exit() || frame_->is_wasm() ||
+         frame_->is_wasm_to_js());
   return frame_;
 }
 
diff --git a/deps/v8/src/execution/frames.cc b/deps/v8/src/execution/frames.cc
index 04768a365c24bc..8337a63e179e1e 100644
--- a/deps/v8/src/execution/frames.cc
+++ b/deps/v8/src/execution/frames.cc
@@ -455,7 +455,10 @@ void SafeStackFrameIterator::Advance() {
       last_callback_scope = external_callback_scope_;
       external_callback_scope_ = external_callback_scope_->previous();
     }
-    if (frame_->is_java_script() || frame_->is_wasm()) break;
+    if (frame_->is_java_script() || frame_->is_wasm() ||
+        frame_->is_wasm_to_js()) {
+      break;
+    }
     if (frame_->is_exit() || frame_->is_builtin_exit()) {
       // Some of the EXIT frames may have ExternalCallbackScope allocated on
       // top of them. In that case the scope corresponds to the first EXIT
@@ -489,7 +492,8 @@ Code StackFrame::LookupCode() const {
 void StackFrame::IteratePc(RootVisitor* v, Address* pc_address,
                            Address* constant_pool_address, Code holder) {
   Address pc = *pc_address;
-  DCHECK(holder.GetHeap()->GcSafeCodeContains(holder, pc));
+  DCHECK(ReadOnlyHeap::Contains(holder) ||
+         holder.GetHeap()->GcSafeCodeContains(holder, pc));
   unsigned pc_offset = static_cast<unsigned>(pc - holder.InstructionStart());
   Object code = holder;
   v->VisitRootPointer(Root::kTop, nullptr, FullObjectSlot(&code));
@@ -1316,7 +1320,7 @@ Object JavaScriptBuiltinContinuationFrame::context() const {
 void JavaScriptBuiltinContinuationWithCatchFrame::SetException(
     Object exception) {
   Address exception_argument_slot =
-      fp() + JavaScriptFrameConstants::kLastParameterOffset +
+      fp() + BuiltinContinuationFrameConstants::kFixedFrameSizeAboveFp +
       kSystemPointerSize;  // Skip over return value slot.
 
   // Only allow setting exception if previous value was the hole.
@@ -1413,11 +1417,9 @@ WASM_SUMMARY_DISPATCH(int, byte_offset)
 #undef WASM_SUMMARY_DISPATCH
 
 int FrameSummary::WasmFrameSummary::SourcePosition() const {
-  Handle<WasmModuleObject> module_object(wasm_instance()->module_object(),
-                                         isolate());
-  return WasmModuleObject::GetSourcePosition(module_object, function_index(),
-                                             byte_offset(),
-                                             at_to_number_conversion());
+  const wasm::WasmModule* module = wasm_instance()->module_object().module();
+  return GetSourcePosition(module, function_index(), byte_offset(),
+                           at_to_number_conversion());
 }
 
 Handle<Script> FrameSummary::WasmFrameSummary::script() const {
@@ -1899,6 +1901,10 @@ WasmInstanceObject WasmCompiledFrame::wasm_instance() const {
   return WasmInstanceObject::cast(instance);
 }
 
+wasm::NativeModule* WasmCompiledFrame::native_module() const {
+  return module_object().native_module();
+}
+
 WasmModuleObject WasmCompiledFrame::module_object() const {
   return wasm_instance().module_object();
 }
@@ -1913,6 +1919,10 @@ int WasmCompiledFrame::position() const {
   return FrameSummary::GetSingle(this).SourcePosition();
 }
 
+Object WasmCompiledFrame::context() const {
+  return wasm_instance().native_context();
+}
+
 void WasmCompiledFrame::Summarize(std::vector<FrameSummary>* functions) const {
   DCHECK(functions->empty());
   // The {WasmCode*} escapes this scope via the {FrameSummary}, which is fine,
@@ -1983,6 +1993,11 @@ void WasmInterpreterEntryFrame::Summarize(
 
 Code WasmInterpreterEntryFrame::unchecked_code() const { return Code(); }
 
+int WasmInterpreterEntryFrame::NumberOfActiveFrames() const {
+  Handle<WasmInstanceObject> instance(wasm_instance(), isolate());
+  return instance->debug_info().NumberOfActiveFrames(fp());
+}
+
 WasmInstanceObject WasmInterpreterEntryFrame::wasm_instance() const {
   const int offset = WasmCompiledFrameConstants::kWasmInstanceOffset;
   Object instance(Memory<Address>(fp() + offset));
diff --git a/deps/v8/src/execution/frames.h b/deps/v8/src/execution/frames.h
index 165ff854647960..3ffdee4b057761 100644
--- a/deps/v8/src/execution/frames.h
+++ b/deps/v8/src/execution/frames.h
@@ -210,6 +210,7 @@ class StackFrame {
     Type type = this->type();
     return type == WASM_COMPILED || type == WASM_INTERPRETER_ENTRY;
   }
+  bool is_wasm_to_js() const { return type() == WASM_TO_JS; }
 
   // Accessors.
   Address sp() const { return state_.sp; }
@@ -949,10 +950,12 @@ class WasmCompiledFrame : public StandardFrame {
 
   // Accessors.
   WasmInstanceObject wasm_instance() const;
+  wasm::NativeModule* native_module() const;
   wasm::WasmCode* wasm_code() const;
   uint32_t function_index() const;
   Script script() const override;
   int position() const override;
+  Object context() const override;
   bool at_to_number_conversion() const;
 
   void Summarize(std::vector<FrameSummary>* frames) const override;
@@ -1001,6 +1004,7 @@ class WasmInterpreterEntryFrame final : public StandardFrame {
   Code unchecked_code() const override;
 
   // Accessors.
+  int NumberOfActiveFrames() const;
   WasmDebugInfo debug_info() const;
   WasmInstanceObject wasm_instance() const;
 
diff --git a/deps/v8/src/execution/ia32/frame-constants-ia32.h b/deps/v8/src/execution/ia32/frame-constants-ia32.h
index 6d2125e83e8487..e579fa7352f920 100644
--- a/deps/v8/src/execution/ia32/frame-constants-ia32.h
+++ b/deps/v8/src/execution/ia32/frame-constants-ia32.h
@@ -32,21 +32,6 @@ class EntryFrameConstants : public AllStatic {
   static constexpr int kMicrotaskQueueArgOffset = +3 * kSystemPointerSize;
 };
 
-class ExitFrameConstants : public TypedFrameConstants {
- public:
-  static constexpr int kSPOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
-  DEFINE_TYPED_FRAME_SIZES(1);
-
-  static constexpr int kCallerFPOffset = 0 * kSystemPointerSize;
-  static constexpr int kCallerPCOffset = +1 * kSystemPointerSize;
-
-  // FP-relative displacement of the caller's SP.  It points just
-  // below the saved PC.
-  static constexpr int kCallerSPDisplacement = +2 * kSystemPointerSize;
-
-  static constexpr int kConstantPoolOffset = 0;  // Not used
-};
-
 class WasmCompileLazyFrameConstants : public TypedFrameConstants {
  public:
   static constexpr int kNumberOfSavedGpParamRegs = 4;
@@ -60,20 +45,6 @@ class WasmCompileLazyFrameConstants : public TypedFrameConstants {
       kNumberOfSavedFpParamRegs * kSimd128Size;
 };
 
-class JavaScriptFrameConstants : public AllStatic {
- public:
-  // FP-relative.
-  static constexpr int kLocal0Offset =
-      StandardFrameConstants::kExpressionsOffset;
-  static constexpr int kLastParameterOffset = +2 * kSystemPointerSize;
-  static constexpr int kFunctionOffset =
-      StandardFrameConstants::kFunctionOffset;
-
-  // Caller SP-relative.
-  static constexpr int kParam0Offset = -2 * kSystemPointerSize;
-  static constexpr int kReceiverOffset = -1 * kSystemPointerSize;
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/execution/isolate-data.h b/deps/v8/src/execution/isolate-data.h
index 6eb23db2a22adb..f402296ab54c22 100644
--- a/deps/v8/src/execution/isolate-data.h
+++ b/deps/v8/src/execution/isolate-data.h
@@ -74,11 +74,6 @@ class IsolateData final {
     return builtins_table_offset() + id * kSystemPointerSize;
   }
 
-  // Root-register-relative offset of the virtual call target register value.
-  static constexpr int virtual_call_target_register_offset() {
-    return kVirtualCallTargetRegisterOffset - kIsolateRootBias;
-  }
-
   // The FP and PC that are saved right before TurboAssembler::CallCFunction.
   Address* fast_c_call_caller_fp_address() { return &fast_c_call_caller_fp_; }
   Address* fast_c_call_caller_pc_address() { return &fast_c_call_caller_pc_; }
@@ -131,7 +126,6 @@ class IsolateData final {
   V(kThreadLocalTopOffset, ThreadLocalTop::kSizeInBytes)                      \
   V(kBuiltinEntryTableOffset, Builtins::builtin_count* kSystemPointerSize)    \
   V(kBuiltinsTableOffset, Builtins::builtin_count* kSystemPointerSize)        \
-  V(kVirtualCallTargetRegisterOffset, kSystemPointerSize)                     \
   V(kStackIsIterableOffset, kUInt8Size)                                       \
   /* This padding aligns IsolateData size by 8 bytes. */                      \
   V(kPaddingOffset,                                                           \
@@ -184,11 +178,6 @@ class IsolateData final {
   // The entries in this array are tagged pointers to Code objects.
   Address builtins_[Builtins::builtin_count] = {};
 
-  // For isolate-independent calls on ia32.
-  // TODO(v8:6666): Remove once wasm supports pc-relative jumps to builtins on
-  // ia32 (otherwise the arguments adaptor call runs out of registers).
-  void* virtual_call_target_register_ = nullptr;
-
   // Whether the SafeStackFrameIterator can successfully iterate the current
   // stack. Only valid values are 0 or 1.
   uint8_t stack_is_iterable_ = 1;
@@ -227,8 +216,6 @@ void IsolateData::AssertPredictableLayout() {
   STATIC_ASSERT(offsetof(IsolateData, thread_local_top_) ==
                 kThreadLocalTopOffset);
   STATIC_ASSERT(offsetof(IsolateData, builtins_) == kBuiltinsTableOffset);
-  STATIC_ASSERT(offsetof(IsolateData, virtual_call_target_register_) ==
-                kVirtualCallTargetRegisterOffset);
   STATIC_ASSERT(offsetof(IsolateData, external_memory_) ==
                 kExternalMemoryOffset);
   STATIC_ASSERT(offsetof(IsolateData, external_memory_limit_) ==
diff --git a/deps/v8/src/execution/isolate-inl.h b/deps/v8/src/execution/isolate-inl.h
index 091b185a302fff..ae786f00d59ec1 100644
--- a/deps/v8/src/execution/isolate-inl.h
+++ b/deps/v8/src/execution/isolate-inl.h
@@ -26,10 +26,12 @@ void Isolate::set_context(Context context) {
 }
 
 Handle<NativeContext> Isolate::native_context() {
+  DCHECK(!context().is_null());
   return handle(context().native_context(), this);
 }
 
 NativeContext Isolate::raw_native_context() {
+  DCHECK(!context().is_null());
   return context().native_context();
 }
 
diff --git a/deps/v8/src/execution/isolate-utils-inl.h b/deps/v8/src/execution/isolate-utils-inl.h
index 6095970a31442e..16bc1da8fa195f 100644
--- a/deps/v8/src/execution/isolate-utils-inl.h
+++ b/deps/v8/src/execution/isolate-utils-inl.h
@@ -14,7 +14,7 @@
 namespace v8 {
 namespace internal {
 
-inline Isolate* GetIsolateForPtrCompr(HeapObject object) {
+inline const Isolate* GetIsolateForPtrCompr(HeapObject object) {
 #ifdef V8_COMPRESS_POINTERS
   return Isolate::FromRoot(GetIsolateRoot(object.ptr()));
 #else
@@ -23,27 +23,32 @@ inline Isolate* GetIsolateForPtrCompr(HeapObject object) {
 }
 
 V8_INLINE Heap* GetHeapFromWritableObject(HeapObject object) {
-#ifdef V8_COMPRESS_POINTERS
+#if defined V8_COMPRESS_POINTERS || defined V8_ENABLE_THIRD_PARTY_HEAP
   return GetIsolateFromWritableObject(object)->heap();
 #else
   heap_internals::MemoryChunk* chunk =
       heap_internals::MemoryChunk::FromHeapObject(object);
   return chunk->GetHeap();
-#endif  // V8_COMPRESS_POINTERS
+#endif  // V8_COMPRESS_POINTERS || V8_ENABLE_THIRD_PARTY_HEAP
 }
 
 V8_INLINE Isolate* GetIsolateFromWritableObject(HeapObject object) {
-#ifdef V8_COMPRESS_POINTERS
+#ifdef V8_ENABLE_THIRD_PARTY_HEAP
+  return Heap::GetIsolateFromWritableObject(object);
+#elif defined V8_COMPRESS_POINTERS
   Isolate* isolate = Isolate::FromRoot(GetIsolateRoot(object.ptr()));
   DCHECK_NOT_NULL(isolate);
   return isolate;
 #else
   return Isolate::FromHeap(GetHeapFromWritableObject(object));
-#endif  // V8_COMPRESS_POINTERS
+#endif  // V8_COMPRESS_POINTERS, V8_ENABLE_THIRD_PARTY_HEAP
 }
 
 V8_INLINE bool GetIsolateFromHeapObject(HeapObject object, Isolate** isolate) {
-#ifdef V8_COMPRESS_POINTERS
+#ifdef V8_ENABLE_THIRD_PARTY_HEAP
+  *isolate = Heap::GetIsolateFromWritableObject(object);
+  return true;
+#elif defined V8_COMPRESS_POINTERS
   *isolate = GetIsolateFromWritableObject(object);
   return true;
 #else
@@ -55,7 +60,7 @@ V8_INLINE bool GetIsolateFromHeapObject(HeapObject object, Isolate** isolate) {
   }
   *isolate = Isolate::FromHeap(chunk->GetHeap());
   return true;
-#endif  // V8_COMPRESS_POINTERS
+#endif  // V8_COMPRESS_POINTERS, V8_ENABLE_THIRD_PARTY_HEAP
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/execution/isolate-utils.h b/deps/v8/src/execution/isolate-utils.h
index 31c154e7a48dac..3b5505f765405b 100644
--- a/deps/v8/src/execution/isolate-utils.h
+++ b/deps/v8/src/execution/isolate-utils.h
@@ -14,7 +14,7 @@ namespace internal {
 // value is intended to be used only as a hoisted computation of isolate root
 // inside trivial accessors for optmizing value decompression.
 // When pointer compression is disabled this function always returns nullptr.
-V8_INLINE Isolate* GetIsolateForPtrCompr(HeapObject object);
+V8_INLINE const Isolate* GetIsolateForPtrCompr(HeapObject object);
 
 V8_INLINE Heap* GetHeapFromWritableObject(HeapObject object);
 
diff --git a/deps/v8/src/execution/isolate.cc b/deps/v8/src/execution/isolate.cc
index e2d5ce8a40af0f..3da8963c53fb32 100644
--- a/deps/v8/src/execution/isolate.cc
+++ b/deps/v8/src/execution/isolate.cc
@@ -265,7 +265,6 @@ uint32_t Isolate::CurrentEmbeddedBlobSize() {
 
 size_t Isolate::HashIsolateForEmbeddedBlob() {
   DCHECK(builtins_.is_initialized());
-  DCHECK(FLAG_embedded_builtins);
   DCHECK(Builtins::AllBuiltinsAreIsolateIndependent());
 
   DisallowHeapAllocation no_gc;
@@ -530,46 +529,6 @@ StackTraceFailureMessage::StackTraceFailureMessage(Isolate* isolate, void* ptr1,
   }
 }
 
-namespace {
-
-class StackFrameCacheHelper : public AllStatic {
- public:
-  static MaybeHandle<StackTraceFrame> LookupCachedFrame(
-      Isolate* isolate, Handle<AbstractCode> code, int code_offset) {
-    if (FLAG_optimize_for_size) return MaybeHandle<StackTraceFrame>();
-
-    const auto maybe_cache = handle(code->stack_frame_cache(), isolate);
-    if (!maybe_cache->IsSimpleNumberDictionary())
-      return MaybeHandle<StackTraceFrame>();
-
-    const auto cache = Handle<SimpleNumberDictionary>::cast(maybe_cache);
-    const int entry = cache->FindEntry(isolate, code_offset);
-    if (entry != NumberDictionary::kNotFound) {
-      return handle(StackTraceFrame::cast(cache->ValueAt(entry)), isolate);
-    }
-    return MaybeHandle<StackTraceFrame>();
-  }
-
-  static void CacheFrameAndUpdateCache(Isolate* isolate,
-                                       Handle<AbstractCode> code,
-                                       int code_offset,
-                                       Handle<StackTraceFrame> frame) {
-    if (FLAG_optimize_for_size) return;
-
-    const auto maybe_cache = handle(code->stack_frame_cache(), isolate);
-    const auto cache = maybe_cache->IsSimpleNumberDictionary()
-                           ? Handle<SimpleNumberDictionary>::cast(maybe_cache)
-                           : SimpleNumberDictionary::New(isolate, 1);
-    Handle<SimpleNumberDictionary> new_cache =
-        SimpleNumberDictionary::Set(isolate, cache, code_offset, frame);
-    if (*new_cache != *cache || !maybe_cache->IsSimpleNumberDictionary()) {
-      AbstractCode::SetStackFrameCache(code, new_cache);
-    }
-  }
-};
-
-}  // anonymous namespace
-
 class FrameArrayBuilder {
  public:
   enum FrameFilterMode { ALL, CURRENT_SECURITY_CONTEXT };
@@ -678,7 +637,7 @@ class FrameArrayBuilder {
         flags |= FrameArray::kAsmJsAtNumberConversion;
       }
     } else {
-      flags |= FrameArray::kIsWasmFrame;
+      flags |= FrameArray::kIsWasmCompiledFrame;
     }
 
     elements_ = FrameArray::AppendWasmFrame(
@@ -740,39 +699,16 @@ class FrameArrayBuilder {
   }
 
   // Creates a StackTraceFrame object for each frame in the FrameArray.
-  Handle<FixedArray> GetElementsAsStackTraceFrameArray(
-      bool enable_frame_caching) {
+  Handle<FixedArray> GetElementsAsStackTraceFrameArray() {
     elements_->ShrinkToFit(isolate_);
     const int frame_count = elements_->FrameCount();
     Handle<FixedArray> stack_trace =
         isolate_->factory()->NewFixedArray(frame_count);
 
     for (int i = 0; i < frame_count; ++i) {
-      // Caching stack frames only happens for user JS frames.
-      const bool cache_frame =
-          enable_frame_caching && !elements_->IsAnyWasmFrame(i) &&
-          elements_->Function(i).shared().IsUserJavaScript();
-      if (cache_frame) {
-        MaybeHandle<StackTraceFrame> maybe_frame =
-            StackFrameCacheHelper::LookupCachedFrame(
-                isolate_, handle(elements_->Code(i), isolate_),
-                Smi::ToInt(elements_->Offset(i)));
-        if (!maybe_frame.is_null()) {
-          Handle<StackTraceFrame> frame = maybe_frame.ToHandleChecked();
-          stack_trace->set(i, *frame);
-          continue;
-        }
-      }
-
       Handle<StackTraceFrame> frame =
           isolate_->factory()->NewStackTraceFrame(elements_, i);
       stack_trace->set(i, *frame);
-
-      if (cache_frame) {
-        StackFrameCacheHelper::CacheFrameAndUpdateCache(
-            isolate_, handle(elements_->Code(i), isolate_),
-            Smi::ToInt(elements_->Offset(i)), frame);
-      }
     }
     return stack_trace;
   }
@@ -989,7 +925,6 @@ struct CaptureStackTraceOptions {
   bool capture_builtin_exit_frames;
   bool capture_only_frames_subject_to_debugging;
   bool async_stack_trace;
-  bool enable_frame_caching;
 };
 
 Handle<Object> CaptureStackTrace(Isolate* isolate, Handle<Object> caller,
@@ -1076,7 +1011,11 @@ Handle<Object> CaptureStackTrace(Isolate* isolate, Handle<Object> caller,
           IsBuiltinFunction(isolate, promise_reaction_job_task->handler(),
                             Builtins::kAsyncGeneratorAwaitResolveClosure) ||
           IsBuiltinFunction(isolate, promise_reaction_job_task->handler(),
-                            Builtins::kAsyncGeneratorYieldResolveClosure)) {
+                            Builtins::kAsyncGeneratorYieldResolveClosure) ||
+          IsBuiltinFunction(isolate, promise_reaction_job_task->handler(),
+                            Builtins::kAsyncFunctionAwaitRejectClosure) ||
+          IsBuiltinFunction(isolate, promise_reaction_job_task->handler(),
+                            Builtins::kAsyncGeneratorAwaitRejectClosure)) {
         // Now peak into the handlers' AwaitContext to get to
         // the JSGeneratorObject for the async function.
         Handle<Context> context(
@@ -1121,8 +1060,7 @@ Handle<Object> CaptureStackTrace(Isolate* isolate, Handle<Object> caller,
   }
 
   // TODO(yangguo): Queue this structured stack trace for preprocessing on GC.
-  return builder.GetElementsAsStackTraceFrameArray(
-      options.enable_frame_caching);
+  return builder.GetElementsAsStackTraceFrameArray();
 }
 
 }  // namespace
@@ -1140,7 +1078,6 @@ Handle<Object> Isolate::CaptureSimpleStackTrace(Handle<JSReceiver> error_object,
   options.async_stack_trace = FLAG_async_stack_traces;
   options.filter_mode = FrameArrayBuilder::CURRENT_SECURITY_CONTEXT;
   options.capture_only_frames_subject_to_debugging = false;
-  options.enable_frame_caching = false;
 
   return CaptureStackTrace(this, caller, options);
 }
@@ -1236,7 +1173,6 @@ Handle<FixedArray> Isolate::CaptureCurrentStackTrace(
           ? FrameArrayBuilder::ALL
           : FrameArrayBuilder::CURRENT_SECURITY_CONTEXT;
   options.capture_only_frames_subject_to_debugging = true;
-  options.enable_frame_caching = true;
 
   return Handle<FixedArray>::cast(
       CaptureStackTrace(this, factory()->undefined_value(), options));
@@ -1406,6 +1342,30 @@ Object Isolate::StackOverflow() {
   return ReadOnlyRoots(heap()).exception();
 }
 
+void Isolate::ThrowAt(Handle<JSObject> exception, MessageLocation* location) {
+  Handle<Name> key_start_pos = factory()->error_start_pos_symbol();
+  Object::SetProperty(this, exception, key_start_pos,
+                      handle(Smi::FromInt(location->start_pos()), this),
+                      StoreOrigin::kMaybeKeyed,
+                      Just(ShouldThrow::kThrowOnError))
+      .Check();
+
+  Handle<Name> key_end_pos = factory()->error_end_pos_symbol();
+  Object::SetProperty(this, exception, key_end_pos,
+                      handle(Smi::FromInt(location->end_pos()), this),
+                      StoreOrigin::kMaybeKeyed,
+                      Just(ShouldThrow::kThrowOnError))
+      .Check();
+
+  Handle<Name> key_script = factory()->error_script_symbol();
+  Object::SetProperty(this, exception, key_script, location->script(),
+                      StoreOrigin::kMaybeKeyed,
+                      Just(ShouldThrow::kThrowOnError))
+      .Check();
+
+  Throw(*exception, location);
+}
+
 Object Isolate::TerminateExecution() {
   return Throw(ReadOnlyRoots(this).termination_exception(), nullptr);
 }
@@ -1914,6 +1874,7 @@ Isolate::CatchType ToCatchType(HandlerTable::CatchPrediction prediction) {
       return Isolate::CAUGHT_BY_PROMISE;
     case HandlerTable::DESUGARING:
       return Isolate::CAUGHT_BY_DESUGARING;
+    case HandlerTable::UNCAUGHT_ASYNC_AWAIT:
     case HandlerTable::ASYNC_AWAIT:
       return Isolate::CAUGHT_BY_ASYNC_AWAIT;
     default:
@@ -2046,7 +2007,6 @@ void Isolate::PrintCurrentStackTrace(FILE* out) {
   options.async_stack_trace = FLAG_async_stack_traces;
   options.filter_mode = FrameArrayBuilder::CURRENT_SECURITY_CONTEXT;
   options.capture_only_frames_subject_to_debugging = false;
-  options.enable_frame_caching = false;
 
   Handle<FixedArray> frames = Handle<FixedArray>::cast(
       CaptureStackTrace(this, this->factory()->undefined_value(), options));
@@ -2134,24 +2094,24 @@ bool Isolate::ComputeLocationFromStackTrace(MessageLocation* target,
   const int frame_count = elements->FrameCount();
   for (int i = 0; i < frame_count; i++) {
     if (elements->IsWasmFrame(i) || elements->IsAsmJsWasmFrame(i)) {
-      Handle<WasmInstanceObject> instance(elements->WasmInstance(i), this);
-      uint32_t func_index =
-          static_cast<uint32_t>(elements->WasmFunctionIndex(i).value());
-      int code_offset = elements->Offset(i).value();
+      int func_index = elements->WasmFunctionIndex(i).value();
+      int offset = elements->Offset(i).value();
       bool is_at_number_conversion =
           elements->IsAsmJsWasmFrame(i) &&
           elements->Flags(i).value() & FrameArray::kAsmJsAtNumberConversion;
-      // WasmCode* held alive by the {GlobalWasmCodeRef}.
-      wasm::WasmCode* code =
-          Managed<wasm::GlobalWasmCodeRef>::cast(elements->WasmCodeObject(i))
-              .get()
-              ->code();
-      int byte_offset =
-          FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
-              code, code_offset);
-      int pos = WasmModuleObject::GetSourcePosition(
-          handle(instance->module_object(), this), func_index, byte_offset,
-          is_at_number_conversion);
+      if (elements->IsWasmCompiledFrame(i)) {
+        // WasmCode* held alive by the {GlobalWasmCodeRef}.
+        wasm::WasmCode* code =
+            Managed<wasm::GlobalWasmCodeRef>::cast(elements->WasmCodeObject(i))
+                .get()
+                ->code();
+        offset = FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
+            code, offset);
+      }
+      Handle<WasmInstanceObject> instance(elements->WasmInstance(i), this);
+      const wasm::WasmModule* module = elements->WasmInstance(i).module();
+      int pos = GetSourcePosition(module, func_index, offset,
+                                  is_at_number_conversion);
       Handle<Script> script(instance->module_object().script(), this);
 
       *target = MessageLocation(script, pos, pos + 1);
@@ -2304,6 +2264,14 @@ void Isolate::ReportPendingMessagesImpl(bool report_externally) {
   }
 }
 
+std::vector<MemoryRange>* Isolate::GetCodePages() const {
+  return code_pages_.load(std::memory_order_acquire);
+}
+
+void Isolate::SetCodePages(std::vector<MemoryRange>* new_code_pages) {
+  code_pages_.store(new_code_pages, std::memory_order_release);
+}
+
 void Isolate::ReportPendingMessages() {
   DCHECK(AllowExceptions::IsAllowed(this));
 
@@ -2572,6 +2540,7 @@ Handle<Object> Isolate::GetPromiseOnStackOnThrow() {
         return promise_on_stack
                    ? Handle<Object>::cast(promise_on_stack->promise())
                    : undefined;
+      case HandlerTable::UNCAUGHT_ASYNC_AWAIT:
       case HandlerTable::ASYNC_AWAIT: {
         // If in the initial portion of async/await, continue the loop to pop up
         // successive async/await stack frames until an asynchronous one with
@@ -3047,6 +3016,8 @@ void Isolate::Deinit() {
   compiler_zone_ = nullptr;
   compiler_cache_ = nullptr;
 
+  SetCodePages(nullptr);
+
   ClearSerializerData();
 
   {
@@ -3222,7 +3193,6 @@ void CreateOffHeapTrampolines(Isolate* isolate) {
 
 #ifdef DEBUG
 bool IsolateIsCompatibleWithEmbeddedBlob(Isolate* isolate) {
-  if (!FLAG_embedded_builtins) return true;
   EmbeddedData d = EmbeddedData::FromBlob(isolate);
   return (d.IsolateHash() == isolate->HashIsolateForEmbeddedBlob());
 }
@@ -3337,6 +3307,14 @@ void Isolate::AddCrashKeysForIsolateAndHeapPointers() {
                           AddressToString(code_space_firstpage_address));
 }
 
+void Isolate::InitializeCodeRanges() {
+  DCHECK_NULL(GetCodePages());
+  MemoryRange embedded_range{reinterpret_cast<const void*>(embedded_blob()),
+                             embedded_blob_size()};
+  code_pages_buffer1_.push_back(embedded_range);
+  SetCodePages(&code_pages_buffer1_);
+}
+
 bool Isolate::Init(ReadOnlyDeserializer* read_only_deserializer,
                    StartupDeserializer* startup_deserializer) {
   TRACE_ISOLATE(init);
@@ -3363,6 +3341,10 @@ bool Isolate::Init(ReadOnlyDeserializer* read_only_deserializer,
   FOR_EACH_ISOLATE_ADDRESS_NAME(ASSIGN_ELEMENT)
 #undef ASSIGN_ELEMENT
 
+  // We need to initialize code_pages_ before any on-heap code is allocated to
+  // make sure we record all code allocations.
+  InitializeCodeRanges();
+
   compilation_cache_ = new CompilationCache(this);
   descriptor_lookup_cache_ = new DescriptorLookupCache();
   inner_pointer_to_code_cache_ = new InnerPointerToCodeCache(this);
@@ -3433,12 +3415,12 @@ bool Isolate::Init(ReadOnlyDeserializer* read_only_deserializer,
 
   bootstrapper_->Initialize(create_heap_objects);
 
-  if (FLAG_embedded_builtins && create_heap_objects) {
+  if (create_heap_objects) {
     builtins_constants_table_builder_ = new BuiltinsConstantsTableBuilder(this);
-  }
-  setup_delegate_->SetupBuiltins(this);
+
+    setup_delegate_->SetupBuiltins(this);
+
 #ifndef V8_TARGET_ARCH_ARM
-  if (create_heap_objects) {
     // Store the interpreter entry trampoline on the root list. It is used as a
     // template for further copies that may later be created to help profile
     // interpreted code.
@@ -3449,14 +3431,15 @@ bool Isolate::Init(ReadOnlyDeserializer* read_only_deserializer,
     // See also: https://crbug.com/v8/8713.
     heap_.SetInterpreterEntryTrampolineForProfiling(
         heap_.builtin(Builtins::kInterpreterEntryTrampoline));
-  }
 #endif
-  if (FLAG_embedded_builtins && create_heap_objects) {
+
     builtins_constants_table_builder_->Finalize();
     delete builtins_constants_table_builder_;
     builtins_constants_table_builder_ = nullptr;
 
     CreateAndSetEmbeddedBlob();
+  } else {
+    setup_delegate_->SetupBuiltins(this);
   }
 
   // Initialize custom memcopy and memmove functions (must happen after
@@ -3503,7 +3486,7 @@ bool Isolate::Init(ReadOnlyDeserializer* read_only_deserializer,
   delete setup_delegate_;
   setup_delegate_ = nullptr;
 
-  Builtins::UpdateBuiltinEntryTable(this);
+  Builtins::InitializeBuiltinEntryTable(this);
   Builtins::EmitCodeCreateEvents(this);
 
 #ifdef DEBUG
@@ -3518,7 +3501,6 @@ bool Isolate::Init(ReadOnlyDeserializer* read_only_deserializer,
         "snapshots, embedders must ensure they pass the same flags as during "
         "the V8 build process (e.g.: --turbo-instruction-scheduling).");
   }
-  DCHECK_IMPLIES(FLAG_jitless, FLAG_embedded_builtins);
 #endif  // DEBUG
 
 #ifndef V8_TARGET_ARCH_ARM
@@ -3867,12 +3849,12 @@ Handle<Symbol> Isolate::SymbolFor(RootIndex dictionary_index,
   Handle<String> key = factory()->InternalizeString(name);
   Handle<NameDictionary> dictionary =
       Handle<NameDictionary>::cast(root_handle(dictionary_index));
-  int entry = dictionary->FindEntry(this, key);
+  InternalIndex entry = dictionary->FindEntry(this, key);
   Handle<Symbol> symbol;
-  if (entry == NameDictionary::kNotFound) {
+  if (entry.is_not_found()) {
     symbol =
         private_symbol ? factory()->NewPrivateSymbol() : factory()->NewSymbol();
-    symbol->set_name(*key);
+    symbol->set_description(*key);
     dictionary = NameDictionary::Add(this, dictionary, key, symbol,
                                      PropertyDetails::Empty(), &entry);
     switch (dictionary_index) {
@@ -4274,7 +4256,7 @@ void Isolate::AddDetachedContext(Handle<Context> context) {
   HandleScope scope(this);
   Handle<WeakArrayList> detached_contexts = factory()->detached_contexts();
   detached_contexts = WeakArrayList::AddToEnd(
-      this, detached_contexts, MaybeObjectHandle(Smi::kZero, this),
+      this, detached_contexts, MaybeObjectHandle(Smi::zero(), this),
       MaybeObjectHandle::Weak(context));
   heap()->set_detached_contexts(*detached_contexts);
 }
@@ -4451,6 +4433,85 @@ AssertNoContextChange::AssertNoContextChange(Isolate* isolate)
     : isolate_(isolate), context_(isolate->context(), isolate) {}
 #endif  // DEBUG
 
+void Isolate::AddCodeMemoryRange(MemoryRange range) {
+  std::vector<MemoryRange>* old_code_pages = GetCodePages();
+  DCHECK_NOT_NULL(old_code_pages);
+
+  std::vector<MemoryRange>* new_code_pages;
+  if (old_code_pages == &code_pages_buffer1_) {
+    new_code_pages = &code_pages_buffer2_;
+  } else {
+    new_code_pages = &code_pages_buffer1_;
+  }
+
+  // Copy all existing data from the old vector to the new vector and insert the
+  // new page.
+  new_code_pages->clear();
+  new_code_pages->reserve(old_code_pages->size() + 1);
+  std::merge(old_code_pages->begin(), old_code_pages->end(), &range, &range + 1,
+             std::back_inserter(*new_code_pages),
+             [](const MemoryRange& a, const MemoryRange& b) {
+               return a.start < b.start;
+             });
+
+  // Atomically switch out the pointer
+  SetCodePages(new_code_pages);
+}
+
+// |chunk| is either a Page or an executable LargePage.
+void Isolate::AddCodeMemoryChunk(MemoryChunk* chunk) {
+  // We only keep track of individual code pages/allocations if we are on arm32,
+  // because on x64 and arm64 we have a code range which makes this unnecessary.
+#if !defined(V8_TARGET_ARCH_ARM)
+  return;
+#else
+  void* new_page_start = reinterpret_cast<void*>(chunk->area_start());
+  size_t new_page_size = chunk->area_size();
+
+  MemoryRange new_range{new_page_start, new_page_size};
+
+  AddCodeMemoryRange(new_range);
+#endif  // !defined(V8_TARGET_ARCH_ARM)
+}
+
+void Isolate::AddCodeRange(Address begin, size_t length_in_bytes) {
+  AddCodeMemoryRange(
+      MemoryRange{reinterpret_cast<void*>(begin), length_in_bytes});
+}
+
+// |chunk| is either a Page or an executable LargePage.
+void Isolate::RemoveCodeMemoryChunk(MemoryChunk* chunk) {
+  // We only keep track of individual code pages/allocations if we are on arm32,
+  // because on x64 and arm64 we have a code range which makes this unnecessary.
+#if !defined(V8_TARGET_ARCH_ARM)
+  return;
+#else
+  void* removed_page_start = reinterpret_cast<void*>(chunk->area_start());
+  std::vector<MemoryRange>* old_code_pages = GetCodePages();
+  DCHECK_NOT_NULL(old_code_pages);
+
+  std::vector<MemoryRange>* new_code_pages;
+  if (old_code_pages == &code_pages_buffer1_) {
+    new_code_pages = &code_pages_buffer2_;
+  } else {
+    new_code_pages = &code_pages_buffer1_;
+  }
+
+  // Copy all existing data from the old vector to the new vector except the
+  // removed page.
+  new_code_pages->clear();
+  new_code_pages->reserve(old_code_pages->size() - 1);
+  std::remove_copy_if(old_code_pages->begin(), old_code_pages->end(),
+                      std::back_inserter(*new_code_pages),
+                      [removed_page_start](const MemoryRange& range) {
+                        return range.start == removed_page_start;
+                      });
+
+  // Atomically switch out the pointer
+  SetCodePages(new_code_pages);
+#endif  // !defined(V8_TARGET_ARCH_ARM)
+}
+
 #undef TRACE_ISOLATE
 
 }  // namespace internal
diff --git a/deps/v8/src/execution/isolate.h b/deps/v8/src/execution/isolate.h
index ef16dfa5140c05..913249dfe596f0 100644
--- a/deps/v8/src/execution/isolate.h
+++ b/deps/v8/src/execution/isolate.h
@@ -676,6 +676,10 @@ class Isolate final : private HiddenFactory {
     return &thread_local_top()->js_entry_sp_;
   }
 
+  V8_EXPORT_PRIVATE std::vector<MemoryRange>* GetCodePages() const;
+
+  V8_EXPORT_PRIVATE void SetCodePages(std::vector<MemoryRange>* new_code_pages);
+
   // Returns the global object of the current context. It could be
   // a builtin object, or a JS global object.
   inline Handle<JSGlobalObject> global_object();
@@ -768,6 +772,8 @@ class Isolate final : private HiddenFactory {
     return MaybeHandle<T>();
   }
 
+  void ThrowAt(Handle<JSObject> exception, MessageLocation* location);
+
   void set_console_delegate(debug::ConsoleDelegate* delegate) {
     console_delegate_ = delegate;
   }
@@ -1315,11 +1321,8 @@ class Isolate final : private HiddenFactory {
     return &partial_snapshot_cache_;
   }
 
-  // Off-heap builtins cannot embed constants within the code object itself,
-  // and thus need to load them from the root list.
   bool IsGeneratingEmbeddedBuiltins() const {
-    return FLAG_embedded_builtins &&
-           builtins_constants_table_builder() != nullptr;
+    return builtins_constants_table_builder() != nullptr;
   }
 
   BuiltinsConstantsTableBuilder* builtins_constants_table_builder() const {
@@ -1337,8 +1340,8 @@ class Isolate final : private HiddenFactory {
 
   // These always return the same result as static methods above, but don't
   // access the global atomic variable (and thus *might be* slightly faster).
-  const uint8_t* embedded_blob() const;
-  uint32_t embedded_blob_size() const;
+  V8_EXPORT_PRIVATE const uint8_t* embedded_blob() const;
+  V8_EXPORT_PRIVATE uint32_t embedded_blob_size() const;
 
   void set_array_buffer_allocator(v8::ArrayBuffer::Allocator* allocator) {
     array_buffer_allocator_ = allocator;
@@ -1487,6 +1490,10 @@ class Isolate final : private HiddenFactory {
   // before such a mode change to ensure that this cannot happen.
   V8_EXPORT_PRIVATE void CollectSourcePositionsForAllBytecodeArrays();
 
+  void AddCodeMemoryChunk(MemoryChunk* chunk);
+  void RemoveCodeMemoryChunk(MemoryChunk* chunk);
+  V8_EXPORT_PRIVATE void AddCodeRange(Address begin, size_t length_in_bytes);
+
  private:
   explicit Isolate(std::unique_ptr<IsolateAllocator> isolate_allocator);
   ~Isolate();
@@ -1496,6 +1503,9 @@ class Isolate final : private HiddenFactory {
 
   void CheckIsolateLayout();
 
+  void InitializeCodeRanges();
+  void AddCodeMemoryRange(MemoryRange range);
+
   class ThreadDataTable {
    public:
     ThreadDataTable() = default;
@@ -1810,6 +1820,12 @@ class Isolate final : private HiddenFactory {
   base::Mutex thread_data_table_mutex_;
   ThreadDataTable thread_data_table_;
 
+  // A signal-safe vector of heap pages containing code. Used with the
+  // v8::Unwinder API.
+  std::atomic<std::vector<MemoryRange>*> code_pages_{nullptr};
+  std::vector<MemoryRange> code_pages_buffer1_;
+  std::vector<MemoryRange> code_pages_buffer2_;
+
   // Enables the host application to provide a mechanism for recording a
   // predefined set of data as crash keys to be used in postmortem debugging
   // in case of a crash.
diff --git a/deps/v8/src/execution/messages.cc b/deps/v8/src/execution/messages.cc
index 96fb94cd4e64b8..f11ab238487409 100644
--- a/deps/v8/src/execution/messages.cc
+++ b/deps/v8/src/execution/messages.cc
@@ -320,6 +320,8 @@ Handle<Object> StackFrameBase::GetWasmModuleName() {
   return isolate_->factory()->undefined_value();
 }
 
+int StackFrameBase::GetWasmFunctionIndex() { return StackFrameBase::kNone; }
+
 Handle<Object> StackFrameBase::GetWasmInstance() {
   return isolate_->factory()->undefined_value();
 }
@@ -389,8 +391,8 @@ namespace {
 bool CheckMethodName(Isolate* isolate, Handle<JSReceiver> receiver,
                      Handle<Name> name, Handle<JSFunction> fun,
                      LookupIterator::Configuration config) {
-  LookupIterator iter =
-      LookupIterator::PropertyOrElement(isolate, receiver, name, config);
+  LookupIterator::Key key(isolate, name);
+  LookupIterator iter(isolate, receiver, key, config);
   if (iter.state() == LookupIterator::DATA) {
     return iter.GetDataValue().is_identical_to(fun);
   } else if (iter.state() == LookupIterator::ACCESSOR) {
@@ -652,12 +654,9 @@ int AsmJsWasmStackFrame::GetPosition() const {
   int byte_offset =
       FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(code_,
                                                                     offset_);
-  Handle<WasmModuleObject> module_object(wasm_instance_->module_object(),
-                                         isolate_);
-  DCHECK_LE(0, byte_offset);
-  return WasmModuleObject::GetSourcePosition(module_object, wasm_func_index_,
-                                             static_cast<uint32_t>(byte_offset),
-                                             is_at_number_conversion_);
+  const wasm::WasmModule* module = wasm_instance_->module();
+  return GetSourcePosition(module, wasm_func_index_, byte_offset,
+                           is_at_number_conversion_);
 }
 
 int AsmJsWasmStackFrame::GetLineNumber() {
@@ -687,7 +686,7 @@ void FrameArrayIterator::Advance() { frame_ix_++; }
 StackFrameBase* FrameArrayIterator::Frame() {
   DCHECK(HasFrame());
   const int flags = array_->Flags(frame_ix_).value();
-  int flag_mask = FrameArray::kIsWasmFrame |
+  int flag_mask = FrameArray::kIsWasmCompiledFrame |
                   FrameArray::kIsWasmInterpretedFrame |
                   FrameArray::kIsAsmJsWasmFrame;
   switch (flags & flag_mask) {
@@ -695,7 +694,7 @@ StackFrameBase* FrameArrayIterator::Frame() {
       // JavaScript Frame.
       js_frame_.FromFrameArray(isolate_, array_, frame_ix_);
       return &js_frame_;
-    case FrameArray::kIsWasmFrame:
+    case FrameArray::kIsWasmCompiledFrame:
     case FrameArray::kIsWasmInterpretedFrame:
       // Wasm Frame:
       wasm_frame_.FromFrameArray(isolate_, array_, frame_ix_);
@@ -991,7 +990,7 @@ MaybeHandle<String> MessageFormatter::Format(Isolate* isolate,
   return builder.Finish();
 }
 
-MaybeHandle<Object> ErrorUtils::Construct(
+MaybeHandle<JSObject> ErrorUtils::Construct(
     Isolate* isolate, Handle<JSFunction> target, Handle<Object> new_target,
     Handle<Object> message, FrameSkipMode mode, Handle<Object> caller,
     StackTraceCollection stack_trace_collection) {
@@ -1008,7 +1007,7 @@ MaybeHandle<Object> ErrorUtils::Construct(
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, err,
       JSObject::New(target, new_target_recv, Handle<AllocationSite>::null()),
-      Object);
+      JSObject);
 
   // 3. If message is not undefined, then
   //  a. Let msg be ? ToString(message).
@@ -1020,23 +1019,23 @@ MaybeHandle<Object> ErrorUtils::Construct(
   if (!message->IsUndefined(isolate)) {
     Handle<String> msg_string;
     ASSIGN_RETURN_ON_EXCEPTION(isolate, msg_string,
-                               Object::ToString(isolate, message), Object);
+                               Object::ToString(isolate, message), JSObject);
     RETURN_ON_EXCEPTION(
         isolate,
         JSObject::SetOwnPropertyIgnoreAttributes(
             err, isolate->factory()->message_string(), msg_string, DONT_ENUM),
-        Object);
+        JSObject);
   }
 
   switch (stack_trace_collection) {
     case StackTraceCollection::kDetailed:
       RETURN_ON_EXCEPTION(
-          isolate, isolate->CaptureAndSetDetailedStackTrace(err), Object);
+          isolate, isolate->CaptureAndSetDetailedStackTrace(err), JSObject);
       V8_FALLTHROUGH;
     case StackTraceCollection::kSimple:
       RETURN_ON_EXCEPTION(
           isolate, isolate->CaptureAndSetSimpleStackTrace(err, mode, caller),
-          Object);
+          JSObject);
       break;
     case StackTraceCollection::kNone:
       break;
@@ -1145,7 +1144,7 @@ Handle<String> DoFormatMessage(Isolate* isolate, MessageTemplate index,
 }  // namespace
 
 // static
-MaybeHandle<Object> ErrorUtils::MakeGenericError(
+Handle<JSObject> ErrorUtils::MakeGenericError(
     Isolate* isolate, Handle<JSFunction> constructor, MessageTemplate index,
     Handle<Object> arg0, Handle<Object> arg1, Handle<Object> arg2,
     FrameSkipMode mode) {
@@ -1168,8 +1167,11 @@ MaybeHandle<Object> ErrorUtils::MakeGenericError(
   DCHECK(mode != SKIP_UNTIL_SEEN);
 
   Handle<Object> no_caller;
+  // The call below can't fail because constructor is a builtin.
+  DCHECK(constructor->shared().HasBuiltinId());
   return ErrorUtils::Construct(isolate, constructor, constructor, msg, mode,
-                               no_caller, StackTraceCollection::kDetailed);
+                               no_caller, StackTraceCollection::kDetailed)
+      .ToHandleChecked();
 }
 
 namespace {
@@ -1226,9 +1228,9 @@ Handle<String> RenderCallSite(Isolate* isolate, Handle<Object> object,
                               MessageLocation* location,
                               CallPrinter::ErrorHint* hint) {
   if (ComputeLocation(isolate, location)) {
-    ParseInfo info(isolate, location->shared());
+    ParseInfo info(isolate, *location->shared());
     if (parsing::ParseAny(&info, location->shared(), isolate)) {
-      info.ast_value_factory()->Internalize(isolate);
+      info.ast_value_factory()->Internalize(isolate->factory());
       CallPrinter printer(isolate, location->shared()->IsUserJavaScript());
       Handle<String> str = printer.Print(info.literal(), location->start_pos());
       *hint = printer.GetErrorHint();
@@ -1327,9 +1329,9 @@ Object ErrorUtils::ThrowLoadFromNullOrUndefined(Isolate* isolate,
   if (ComputeLocation(isolate, &location)) {
     location_computed = true;
 
-    ParseInfo info(isolate, location.shared());
+    ParseInfo info(isolate, *location.shared());
     if (parsing::ParseAny(&info, location.shared(), isolate)) {
-      info.ast_value_factory()->Internalize(isolate);
+      info.ast_value_factory()->Internalize(isolate->factory());
       CallPrinter printer(isolate, location.shared()->IsUserJavaScript());
       Handle<String> str = printer.Print(info.literal(), location.start_pos());
 
@@ -1346,7 +1348,8 @@ Object ErrorUtils::ThrowLoadFromNullOrUndefined(Isolate* isolate,
           maybe_property_name = destructuring_prop->key()
                                     ->AsLiteral()
                                     ->AsRawPropertyName()
-                                    ->string();
+                                    ->string()
+                                    .get<Factory>();
           // Change the message location to point at the property name.
           pos = destructuring_prop->key()->position();
         }
diff --git a/deps/v8/src/execution/messages.h b/deps/v8/src/execution/messages.h
index 5da2d3a9ebda3c..cc6a233138e38f 100644
--- a/deps/v8/src/execution/messages.h
+++ b/deps/v8/src/execution/messages.h
@@ -83,6 +83,8 @@ class StackFrameBase {
   virtual int GetLineNumber() = 0;
   // Return 1-based column number, including column offset if first line.
   virtual int GetColumnNumber() = 0;
+  // Return 0-based Wasm function index. Returns -1 for non-Wasm frames.
+  virtual int GetWasmFunctionIndex();
 
   // Returns index for Promise.all() async frames, or -1 for other frames.
   virtual int GetPromiseIndex() const = 0;
@@ -174,8 +176,9 @@ class WasmStackFrame : public StackFrameBase {
   Handle<Object> GetWasmInstance() override;
 
   int GetPosition() const override;
-  int GetLineNumber() override { return wasm_func_index_; }
+  int GetLineNumber() override { return 0; }
   int GetColumnNumber() override;
+  int GetWasmFunctionIndex() override { return wasm_func_index_; }
 
   int GetPromiseIndex() const override { return GetPosition(); }
 
@@ -266,14 +269,14 @@ class ErrorUtils : public AllStatic {
   // |kNone| is useful when you don't need the stack information at all, for
   // example when creating a deserialized error.
   enum class StackTraceCollection { kDetailed, kSimple, kNone };
-  static MaybeHandle<Object> Construct(
+  static MaybeHandle<JSObject> Construct(
       Isolate* isolate, Handle<JSFunction> target, Handle<Object> new_target,
       Handle<Object> message, FrameSkipMode mode, Handle<Object> caller,
       StackTraceCollection stack_trace_collection);
 
   static MaybeHandle<String> ToString(Isolate* isolate, Handle<Object> recv);
 
-  static MaybeHandle<Object> MakeGenericError(
+  static Handle<JSObject> MakeGenericError(
       Isolate* isolate, Handle<JSFunction> constructor, MessageTemplate index,
       Handle<Object> arg0, Handle<Object> arg1, Handle<Object> arg2,
       FrameSkipMode mode);
diff --git a/deps/v8/src/execution/microtask-queue.cc b/deps/v8/src/execution/microtask-queue.cc
index ed76e9d79c50c6..fca9d2d3f4bd9e 100644
--- a/deps/v8/src/execution/microtask-queue.cc
+++ b/deps/v8/src/execution/microtask-queue.cc
@@ -177,6 +177,7 @@ int MicrotaskQueue::RunMicrotasks(Isolate* isolate) {
     capacity_ = 0;
     size_ = 0;
     start_ = 0;
+    DCHECK(isolate->has_scheduled_exception());
     isolate->SetTerminationOnExternalTryCatch();
     OnCompleted(isolate);
     return -1;
diff --git a/deps/v8/src/execution/mips/frame-constants-mips.h b/deps/v8/src/execution/mips/frame-constants-mips.h
index 2043d12e89d740..08c9c789ac30f8 100644
--- a/deps/v8/src/execution/mips/frame-constants-mips.h
+++ b/deps/v8/src/execution/mips/frame-constants-mips.h
@@ -23,25 +23,6 @@ class EntryFrameConstants : public AllStatic {
   static constexpr int kArgvOffset = +1 * kSystemPointerSize;
 };
 
-class ExitFrameConstants : public TypedFrameConstants {
- public:
-  static constexpr int kSPOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
-  DEFINE_TYPED_FRAME_SIZES(1);
-
-  // The caller fields are below the frame pointer on the stack.
-  static constexpr int kCallerFPOffset = +0 * kPointerSize;
-  // The calling JS function is between FP and PC.
-  static constexpr int kCallerPCOffset = +1 * kPointerSize;
-
-  // MIPS-specific: a pointer to the old sp to avoid unnecessary calculations.
-  static constexpr int kCallerSPOffset = +2 * kPointerSize;
-
-  // FP-relative displacement of the caller's SP.
-  static constexpr int kCallerSPDisplacement = +2 * kPointerSize;
-
-  static constexpr int kConstantPoolOffset = 0;  // Not used.
-};
-
 class WasmCompileLazyFrameConstants : public TypedFrameConstants {
  public:
   static constexpr int kNumberOfSavedGpParamRegs = 3;
@@ -55,20 +36,6 @@ class WasmCompileLazyFrameConstants : public TypedFrameConstants {
       kNumberOfSavedFpParamRegs * kDoubleSize;
 };
 
-class JavaScriptFrameConstants : public AllStatic {
- public:
-  // FP-relative.
-  static constexpr int kLocal0Offset =
-      StandardFrameConstants::kExpressionsOffset;
-  static constexpr int kLastParameterOffset = +2 * kPointerSize;
-  static constexpr int kFunctionOffset =
-      StandardFrameConstants::kFunctionOffset;
-
-  // Caller SP-relative.
-  static constexpr int kParam0Offset = -2 * kPointerSize;
-  static constexpr int kReceiverOffset = -1 * kPointerSize;
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/execution/mips/simulator-mips.h b/deps/v8/src/execution/mips/simulator-mips.h
index 28e38fd0a5e135..5ba813c1422708 100644
--- a/deps/v8/src/execution/mips/simulator-mips.h
+++ b/deps/v8/src/execution/mips/simulator-mips.h
@@ -15,6 +15,23 @@
 // globals.h defines USE_SIMULATOR.
 #include "src/common/globals.h"
 
+template <typename T>
+int Compare(const T& a, const T& b) {
+  if (a == b)
+    return 0;
+  else if (a < b)
+    return -1;
+  else
+    return 1;
+}
+
+// Returns the negative absolute value of its argument.
+template <typename T,
+          typename = typename std::enable_if<std::is_signed<T>::value>::type>
+T Nabs(T a) {
+  return a < 0 ? a : -a;
+}
+
 #if defined(USE_SIMULATOR)
 // Running with a simulator.
 
diff --git a/deps/v8/src/execution/mips64/frame-constants-mips64.h b/deps/v8/src/execution/mips64/frame-constants-mips64.h
index c7791f6f7ca980..58bb82a153a3fc 100644
--- a/deps/v8/src/execution/mips64/frame-constants-mips64.h
+++ b/deps/v8/src/execution/mips64/frame-constants-mips64.h
@@ -19,25 +19,6 @@ class EntryFrameConstants : public AllStatic {
       -(StandardFrameConstants::kFixedFrameSizeFromFp + kPointerSize);
 };
 
-class ExitFrameConstants : public TypedFrameConstants {
- public:
-  static constexpr int kSPOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
-  DEFINE_TYPED_FRAME_SIZES(1);
-
-  // The caller fields are below the frame pointer on the stack.
-  static constexpr int kCallerFPOffset = +0 * kPointerSize;
-  // The calling JS function is between FP and PC.
-  static constexpr int kCallerPCOffset = +1 * kPointerSize;
-
-  // MIPS-specific: a pointer to the old sp to avoid unnecessary calculations.
-  static constexpr int kCallerSPOffset = +2 * kPointerSize;
-
-  // FP-relative displacement of the caller's SP.
-  static constexpr int kCallerSPDisplacement = +2 * kPointerSize;
-
-  static constexpr int kConstantPoolOffset = 0;  // Not used.
-};
-
 class WasmCompileLazyFrameConstants : public TypedFrameConstants {
  public:
   static constexpr int kNumberOfSavedGpParamRegs = 7;
@@ -51,20 +32,6 @@ class WasmCompileLazyFrameConstants : public TypedFrameConstants {
       kNumberOfSavedFpParamRegs * kDoubleSize;
 };
 
-class JavaScriptFrameConstants : public AllStatic {
- public:
-  // FP-relative.
-  static constexpr int kLocal0Offset =
-      StandardFrameConstants::kExpressionsOffset;
-  static constexpr int kLastParameterOffset = +2 * kPointerSize;
-  static constexpr int kFunctionOffset =
-      StandardFrameConstants::kFunctionOffset;
-
-  // Caller SP-relative.
-  static constexpr int kParam0Offset = -2 * kPointerSize;
-  static constexpr int kReceiverOffset = -1 * kPointerSize;
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/execution/mips64/simulator-mips64.h b/deps/v8/src/execution/mips64/simulator-mips64.h
index 2bfcbe9d98a861..56e25ef2134d43 100644
--- a/deps/v8/src/execution/mips64/simulator-mips64.h
+++ b/deps/v8/src/execution/mips64/simulator-mips64.h
@@ -15,6 +15,23 @@
 // globals.h defines USE_SIMULATOR.
 #include "src/common/globals.h"
 
+template <typename T>
+int Compare(const T& a, const T& b) {
+  if (a == b)
+    return 0;
+  else if (a < b)
+    return -1;
+  else
+    return 1;
+}
+
+// Returns the negative absolute value of its argument.
+template <typename T,
+          typename = typename std::enable_if<std::is_signed<T>::value>::type>
+T Nabs(T a) {
+  return a < 0 ? a : -a;
+}
+
 #if defined(USE_SIMULATOR)
 // Running with a simulator.
 
diff --git a/deps/v8/src/execution/ppc/frame-constants-ppc.h b/deps/v8/src/execution/ppc/frame-constants-ppc.h
index 07cc2715b1b066..c987d48c27f76d 100644
--- a/deps/v8/src/execution/ppc/frame-constants-ppc.h
+++ b/deps/v8/src/execution/ppc/frame-constants-ppc.h
@@ -17,21 +17,6 @@ class EntryFrameConstants : public AllStatic {
       -(StandardFrameConstants::kFixedFrameSizeFromFp + kPointerSize);
 };
 
-class ExitFrameConstants : public TypedFrameConstants {
- public:
-  static constexpr int kSPOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
-  DEFINE_TYPED_FRAME_SIZES(1);
-
-  // The caller fields are below the frame pointer on the stack.
-  static constexpr int kCallerFPOffset = 0 * kPointerSize;
-  // The calling JS function is below FP.
-  static constexpr int kCallerPCOffset = 1 * kPointerSize;
-
-  // FP-relative displacement of the caller's SP.  It points just
-  // below the saved PC.
-  static constexpr int kCallerSPDisplacement = 2 * kPointerSize;
-};
-
 class WasmCompileLazyFrameConstants : public TypedFrameConstants {
  public:
   static constexpr int kNumberOfSavedGpParamRegs = 7;
@@ -45,20 +30,6 @@ class WasmCompileLazyFrameConstants : public TypedFrameConstants {
       kNumberOfSavedFpParamRegs * kDoubleSize;
 };
 
-class JavaScriptFrameConstants : public AllStatic {
- public:
-  // FP-relative.
-  static constexpr int kLocal0Offset =
-      StandardFrameConstants::kExpressionsOffset;
-  static constexpr int kLastParameterOffset = +2 * kPointerSize;
-  static constexpr int kFunctionOffset =
-      StandardFrameConstants::kFunctionOffset;
-
-  // Caller SP-relative.
-  static constexpr int kParam0Offset = -2 * kPointerSize;
-  static constexpr int kReceiverOffset = -1 * kPointerSize;
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/execution/protectors.cc b/deps/v8/src/execution/protectors.cc
index b5b4c47a1bb81f..c8ba05a8f91b6a 100644
--- a/deps/v8/src/execution/protectors.cc
+++ b/deps/v8/src/execution/protectors.cc
@@ -36,7 +36,6 @@ void TraceProtectorInvalidation(const char* protector_name) {
 #define INVALIDATE_PROTECTOR_ON_NATIVE_CONTEXT_DEFINITION(name, cell)       \
   void Protectors::Invalidate##name(Isolate* isolate,                       \
                                     Handle<NativeContext> native_context) { \
-    DCHECK_EQ(*native_context, isolate->raw_native_context());              \
     DCHECK(native_context->cell().value().IsSmi());                         \
     DCHECK(Is##name##Intact(native_context));                               \
     if (FLAG_trace_protector_invalidation) {                                \
diff --git a/deps/v8/src/execution/runtime-profiler.cc b/deps/v8/src/execution/runtime-profiler.cc
index 65476e346f25c7..c1bdf021ebac7e 100644
--- a/deps/v8/src/execution/runtime-profiler.cc
+++ b/deps/v8/src/execution/runtime-profiler.cc
@@ -172,6 +172,7 @@ bool RuntimeProfiler::MaybeOSR(JSFunction function, InterpretedFrame* frame) {
 
 OptimizationReason RuntimeProfiler::ShouldOptimize(JSFunction function,
                                                    BytecodeArray bytecode) {
+  if (function.HasOptimizedCode()) return OptimizationReason::kDoNotOptimize;
   int ticks = function.feedback_vector().profiler_ticks();
   int ticks_for_optimization =
       kProfilerTicksBeforeOptimization +
diff --git a/deps/v8/src/execution/s390/frame-constants-s390.h b/deps/v8/src/execution/s390/frame-constants-s390.h
index 34ae136aadad57..efa03f6e018040 100644
--- a/deps/v8/src/execution/s390/frame-constants-s390.h
+++ b/deps/v8/src/execution/s390/frame-constants-s390.h
@@ -19,21 +19,6 @@ class EntryFrameConstants : public AllStatic {
   static constexpr int kArgvOffset = 20 * kSystemPointerSize;
 };
 
-class ExitFrameConstants : public TypedFrameConstants {
- public:
-  static constexpr int kSPOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
-  DEFINE_TYPED_FRAME_SIZES(1);
-
-  // The caller fields are below the frame pointer on the stack.
-  static constexpr int kCallerFPOffset = 0 * kSystemPointerSize;
-  // The calling JS function is below FP.
-  static constexpr int kCallerPCOffset = 1 * kSystemPointerSize;
-
-  // FP-relative displacement of the caller's SP.  It points just
-  // below the saved PC.
-  static constexpr int kCallerSPDisplacement = 2 * kSystemPointerSize;
-};
-
 class WasmCompileLazyFrameConstants : public TypedFrameConstants {
  public:
   static constexpr int kNumberOfSavedGpParamRegs = 4;
@@ -51,20 +36,6 @@ class WasmCompileLazyFrameConstants : public TypedFrameConstants {
       kNumberOfSavedFpParamRegs * kDoubleSize;
 };
 
-class JavaScriptFrameConstants : public AllStatic {
- public:
-  // FP-relative.
-  static constexpr int kLocal0Offset =
-      StandardFrameConstants::kExpressionsOffset;
-  static constexpr int kLastParameterOffset = +2 * kSystemPointerSize;
-  static constexpr int kFunctionOffset =
-      StandardFrameConstants::kFunctionOffset;
-
-  // Caller SP-relative.
-  static constexpr int kParam0Offset = -2 * kSystemPointerSize;
-  static constexpr int kReceiverOffset = -1 * kSystemPointerSize;
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/execution/x64/frame-constants-x64.h b/deps/v8/src/execution/x64/frame-constants-x64.h
index 49d69829f0302a..409880cc7bdb08 100644
--- a/deps/v8/src/execution/x64/frame-constants-x64.h
+++ b/deps/v8/src/execution/x64/frame-constants-x64.h
@@ -41,21 +41,6 @@ class EntryFrameConstants : public AllStatic {
 #endif
 };
 
-class ExitFrameConstants : public TypedFrameConstants {
- public:
-  static constexpr int kSPOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
-  DEFINE_TYPED_FRAME_SIZES(1);
-
-  static constexpr int kCallerFPOffset = +0 * kSystemPointerSize;
-  static constexpr int kCallerPCOffset = kFPOnStackSize;
-
-  // FP-relative displacement of the caller's SP.  It points just
-  // below the saved PC.
-  static constexpr int kCallerSPDisplacement = kCallerPCOffset + kPCOnStackSize;
-
-  static constexpr int kConstantPoolOffset = 0;  // Not used
-};
-
 class WasmCompileLazyFrameConstants : public TypedFrameConstants {
  public:
   static constexpr int kNumberOfSavedGpParamRegs = 6;
@@ -69,20 +54,6 @@ class WasmCompileLazyFrameConstants : public TypedFrameConstants {
       kNumberOfSavedFpParamRegs * kSimd128Size;
 };
 
-class JavaScriptFrameConstants : public AllStatic {
- public:
-  // FP-relative.
-  static constexpr int kLocal0Offset =
-      StandardFrameConstants::kExpressionsOffset;
-  static constexpr int kLastParameterOffset = kFPOnStackSize + kPCOnStackSize;
-  static constexpr int kFunctionOffset =
-      StandardFrameConstants::kFunctionOffset;
-
-  // Caller SP-relative.
-  static constexpr int kParam0Offset = -2 * kSystemPointerSize;
-  static constexpr int kReceiverOffset = -1 * kSystemPointerSize;
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/extensions/free-buffer-extension.cc b/deps/v8/src/extensions/free-buffer-extension.cc
deleted file mode 100644
index 9fdfe920eb8802..00000000000000
--- a/deps/v8/src/extensions/free-buffer-extension.cc
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/extensions/free-buffer-extension.h"
-
-#include "src/base/platform/platform.h"
-#include "src/execution/isolate.h"
-
-namespace v8 {
-namespace internal {
-
-
-v8::Local<v8::FunctionTemplate> FreeBufferExtension::GetNativeFunctionTemplate(
-    v8::Isolate* isolate, v8::Local<v8::String> str) {
-  return v8::FunctionTemplate::New(isolate, FreeBufferExtension::FreeBuffer);
-}
-
-
-void FreeBufferExtension::FreeBuffer(
-    const v8::FunctionCallbackInfo<v8::Value>& args) {
-  v8::Local<v8::ArrayBuffer> arrayBuffer = args[0].As<v8::ArrayBuffer>();
-  v8::ArrayBuffer::Contents contents = arrayBuffer->Externalize();
-  contents.Deleter()(contents.Data(), contents.ByteLength(),
-                     contents.DeleterData());
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/extensions/free-buffer-extension.h b/deps/v8/src/extensions/free-buffer-extension.h
deleted file mode 100644
index 51c620d1715e4e..00000000000000
--- a/deps/v8/src/extensions/free-buffer-extension.h
+++ /dev/null
@@ -1,25 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_EXTENSIONS_FREE_BUFFER_EXTENSION_H_
-#define V8_EXTENSIONS_FREE_BUFFER_EXTENSION_H_
-
-#include "include/v8.h"
-
-namespace v8 {
-namespace internal {
-
-class FreeBufferExtension : public v8::Extension {
- public:
-  FreeBufferExtension()
-      : v8::Extension("v8/free-buffer", "native function freeBuffer();") {}
-  v8::Local<v8::FunctionTemplate> GetNativeFunctionTemplate(
-      v8::Isolate* isolate, v8::Local<v8::String> name) override;
-  static void FreeBuffer(const v8::FunctionCallbackInfo<v8::Value>& args);
-};
-
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_EXTENSIONS_FREE_BUFFER_EXTENSION_H_
diff --git a/deps/v8/src/extensions/vtunedomain-support-extension.cc b/deps/v8/src/extensions/vtunedomain-support-extension.cc
new file mode 100644
index 00000000000000..e5b68ff63d8ac8
--- /dev/null
+++ b/deps/v8/src/extensions/vtunedomain-support-extension.cc
@@ -0,0 +1,144 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/extensions/vtunedomain-support-extension.h"
+#include <string>
+#include <vector>
+
+namespace v8 {
+namespace internal {
+
+namespace libvtune {
+
+int startTask(const std::vector<std::string>& vparams);
+int endTask(const std::vector<std::string>& vparams);
+
+const auto& function_map =
+    *new std::map<std::string, int (*)(const std::vector<std::string>&)>{
+        {"start", startTask}, {"end", endTask}};
+
+void split(const std::string& str, char delimiter,
+           std::vector<std::string>* vparams) {
+  std::string::size_type baseindex = 0;
+  std::string::size_type offindex = str.find(delimiter);
+
+  while (offindex != std::string::npos) {
+    (*vparams).push_back(str.substr(baseindex, offindex - baseindex));
+    baseindex = ++offindex;
+    offindex = str.find(delimiter, offindex);
+
+    if (offindex == std::string::npos)
+      (*vparams).push_back(str.substr(baseindex, str.length()));
+  }
+}
+
+int startTask(const std::vector<std::string>& vparams) {
+  int errcode = 0;
+
+  if (const char* domain_name = vparams[1].c_str()) {
+    if (const char* task_name = vparams[2].c_str()) {
+      if (std::shared_ptr<VTuneDomain> domainptr =
+              VTuneDomain::createDomain(domain_name)) {
+        if (!domainptr->beginTask(task_name)) {
+          errcode += TASK_BEGIN_FAILED;
+        }
+      } else {
+        errcode += CREATE_DOMAIN_FAILED;
+      }
+    } else {
+      errcode += NO_TASK_NAME;
+    }
+
+  } else {
+    errcode = NO_DOMAIN_NAME;
+  }
+
+  return errcode;
+}
+
+int endTask(const std::vector<std::string>& vparams) {
+  int errcode = 0;
+
+  if (const char* domain_name = vparams[1].c_str()) {
+    if (std::shared_ptr<VTuneDomain> domainptr =
+            VTuneDomain::createDomain(domain_name)) {
+      domainptr->endTask();
+    } else {
+      errcode += CREATE_DOMAIN_FAILED;
+    }
+  } else {
+    errcode = NO_DOMAIN_NAME;
+  }
+
+  return errcode;
+}
+
+int invoke(const char* params) {
+  int errcode = 0;
+  std::vector<std::string> vparams;
+
+  split(*(new std::string(params)), ' ', &vparams);
+
+  auto it = function_map.find(vparams[0]);
+  if (it != function_map.end()) {
+    (it->second)(vparams);
+  } else {
+    errcode += UNKNOWN_PARAMS;
+  }
+
+  return errcode;
+}
+
+}  // namespace libvtune
+
+v8::Local<v8::FunctionTemplate>
+VTuneDomainSupportExtension::GetNativeFunctionTemplate(
+    v8::Isolate* isolate, v8::Local<v8::String> str) {
+  return v8::FunctionTemplate::New(isolate, VTuneDomainSupportExtension::Mark);
+}
+
+// args should take three parameters
+// %0 : string, which is the domain name. Domain is used to tagging trace data
+// for different modules or libraryies in a program
+// %1 : string, which is the task name. Task is a logical unit of work performed
+// by a particular thread statement. Task can nest.
+// %2 : string, "start" / "end". Action to be taken on a task in a particular
+// domain
+void VTuneDomainSupportExtension::Mark(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  if (args.Length() != 3 || !args[0]->IsString() || !args[1]->IsString() ||
+      !args[2]->IsString()) {
+    args.GetIsolate()->ThrowException(
+        v8::String::NewFromUtf8(
+            args.GetIsolate(),
+            "Parameter number should be exactly three, first domain name"
+            "second task name, third start/end",
+            NewStringType::kNormal)
+            .ToLocalChecked());
+    return;
+  }
+
+  v8::Isolate* isolate = args.GetIsolate();
+  v8::String::Utf8Value domainName(isolate, args[0]);
+  v8::String::Utf8Value taskName(isolate, args[1]);
+  v8::String::Utf8Value statName(isolate, args[2]);
+
+  char* cdomainName = *domainName;
+  char* ctaskName = *taskName;
+  char* cstatName = *statName;
+
+  std::stringstream params;
+  params << cstatName << " " << cdomainName << " " << ctaskName;
+
+  int r = 0;
+  if ((r = libvtune::invoke(params.str().c_str())) != 0) {
+    args.GetIsolate()->ThrowException(
+        v8::String::NewFromUtf8(args.GetIsolate(), std::to_string(r).c_str(),
+                                NewStringType::kNormal)
+            .ToLocalChecked());
+  }
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/extensions/vtunedomain-support-extension.h b/deps/v8/src/extensions/vtunedomain-support-extension.h
new file mode 100644
index 00000000000000..394cc3fb217ea2
--- /dev/null
+++ b/deps/v8/src/extensions/vtunedomain-support-extension.h
@@ -0,0 +1,47 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_EXTENSIONS_VTUNEDOMAIN_SUPPORT_EXTENSION_H_
+#define V8_EXTENSIONS_VTUNEDOMAIN_SUPPORT_EXTENSION_H_
+
+#include "include/v8.h"
+#include "src/third_party/vtune/vtuneapi.h"
+#include "src/utils/utils.h"
+
+#define UNKNOWN_PARAMS 1 << 0
+#define NO_DOMAIN_NAME 1 << 1
+#define CREATE_DOMAIN_FAILED 1 << 2
+#define NO_TASK_NAME 1 << 3
+#define CREATE_TASK_FAILED 1 << 4
+#define TASK_BEGIN_FAILED 1 << 5
+#define TASK_END_FAILED 1 << 6
+
+namespace v8 {
+namespace internal {
+
+class VTuneDomainSupportExtension : public v8::Extension {
+ public:
+  explicit VTuneDomainSupportExtension(const char* fun_name = "test")
+      : v8::Extension("v8/vtunedomain",
+                      BuildSource(buffer_, sizeof(buffer_), fun_name)) {}
+
+  v8::Local<v8::FunctionTemplate> GetNativeFunctionTemplate(
+      v8::Isolate* isolate, v8::Local<v8::String> name) override;
+
+ private:
+  static void Mark(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  static const char* BuildSource(char* buf, size_t size, const char* fun_name) {
+    SNPrintF(Vector<char>(buf, static_cast<int>(size)), "native function %s();",
+             fun_name);
+    return buf;
+  }
+
+  char buffer_[50];
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_EXTENSIONS_VTUNEDOMAIN_SUPPORT_EXTENSION_H_
diff --git a/deps/v8/src/flags/flag-definitions.h b/deps/v8/src/flags/flag-definitions.h
index b05c36ccdd1f5f..2eb2bbc80e6a20 100644
--- a/deps/v8/src/flags/flag-definitions.h
+++ b/deps/v8/src/flags/flag-definitions.h
@@ -203,50 +203,55 @@ DEFINE_IMPLICATION(harmony_import_meta, harmony_dynamic_import)
 // Update bootstrapper.cc whenever adding a new feature flag.
 
 // Features that are still work in progress (behind individual flags).
-#define HARMONY_INPROGRESS_BASE(V)                                        \
-  V(harmony_regexp_sequence, "RegExp Unicode sequence properties")        \
-  V(harmony_weak_refs, "harmony weak references")                         \
-  V(harmony_regexp_match_indices, "harmony regexp match indices")         \
+#define HARMONY_INPROGRESS_BASE(V)                                    \
+  V(harmony_string_replaceall, "harmony String.prototype.replaceAll") \
+  V(harmony_regexp_sequence, "RegExp Unicode sequence properties")    \
+  V(harmony_weak_refs, "harmony weak references")                     \
+  V(harmony_regexp_match_indices, "harmony regexp match indices")     \
   V(harmony_top_level_await, "harmony top level await")
 
 #ifdef V8_INTL_SUPPORT
-#define HARMONY_INPROGRESS(V) HARMONY_INPROGRESS_BASE(V)
+#define HARMONY_INPROGRESS(V)                       \
+  HARMONY_INPROGRESS_BASE(V)                        \
+  V(harmony_intl_displaynames_date_types, "Intl.DisplayNames date types")
 #else
 #define HARMONY_INPROGRESS(V) HARMONY_INPROGRESS_BASE(V)
 #endif
 
 // Features that are complete (but still behind --harmony/es-staging flag).
 #define HARMONY_STAGED_BASE(V)                                     \
-  V(harmony_optional_chaining, "harmony optional chaining syntax") \
-  V(harmony_nullish, "harmony nullish operator")                   \
   V(harmony_private_methods, "harmony private methods in class literals")
 
 #ifdef V8_INTL_SUPPORT
-#define HARMONY_STAGED(V)                                           \
-  HARMONY_STAGED_BASE(V)                                            \
-  V(harmony_intl_add_calendar_numbering_system,                     \
-    "Add calendar and numberingSystem to DateTimeFormat")           \
-  V(harmony_intl_dateformat_day_period,                             \
-    "Add dayPeriod option to DateTimeFormat")                       \
-  V(harmony_intl_dateformat_fractional_second_digits,               \
-    "Add fractionalSecondDigits option to DateTimeFormat")          \
-  V(harmony_intl_other_calendars, "DateTimeFormat other calendars") \
+#define HARMONY_STAGED(V)                                  \
+  HARMONY_STAGED_BASE(V)                                   \
+  V(harmony_intl_dateformat_day_period,                    \
+    "Add dayPeriod option to DateTimeFormat")              \
+  V(harmony_intl_dateformat_fractional_second_digits,      \
+    "Add fractionalSecondDigits option to DateTimeFormat") \
   V(harmony_intl_segmenter, "Intl.Segmenter")
 #else
 #define HARMONY_STAGED(V) HARMONY_STAGED_BASE(V)
 #endif
 
 // Features that are shipping (turned on by default, but internal flag remains).
-#define HARMONY_SHIPPING_BASE(V)                                           \
-  V(harmony_namespace_exports,                                             \
-    "harmony namespace exports (export * as foo from 'bar')")              \
-  V(harmony_sharedarraybuffer, "harmony sharedarraybuffer")                \
-  V(harmony_import_meta, "harmony import.meta property")                   \
-  V(harmony_dynamic_import, "harmony dynamic import")                      \
-  V(harmony_promise_all_settled, "harmony Promise.allSettled")
+#define HARMONY_SHIPPING_BASE(V)                               \
+  V(harmony_namespace_exports,                                 \
+    "harmony namespace exports (export * as foo from 'bar')")  \
+  V(harmony_sharedarraybuffer, "harmony sharedarraybuffer")    \
+  V(harmony_import_meta, "harmony import.meta property")       \
+  V(harmony_dynamic_import, "harmony dynamic import")          \
+  V(harmony_promise_all_settled, "harmony Promise.allSettled") \
+  V(harmony_nullish, "harmony nullish operator")               \
+  V(harmony_optional_chaining, "harmony optional chaining syntax")
 
 #ifdef V8_INTL_SUPPORT
-#define HARMONY_SHIPPING(V) HARMONY_SHIPPING_BASE(V)
+#define HARMONY_SHIPPING(V)                               \
+  HARMONY_SHIPPING_BASE(V)                                \
+  V(harmony_intl_add_calendar_numbering_system,           \
+    "Add calendar and numberingSystem to DateTimeFormat") \
+  V(harmony_intl_displaynames, "Intl.DisplayNames")       \
+  V(harmony_intl_other_calendars, "DateTimeFormat other calendars")
 #else
 #define HARMONY_SHIPPING(V) HARMONY_SHIPPING_BASE(V)
 #endif
@@ -277,12 +282,6 @@ HARMONY_SHIPPING(FLAG_SHIPPING_FEATURES)
 DEFINE_BOOL(icu_timezone_data, true, "get information about timezones from ICU")
 #endif
 
-#ifdef V8_ENABLE_RAW_HEAP_SNAPSHOTS
-#define V8_ENABLE_RAW_HEAP_SNAPSHOTS_BOOL true
-#else
-#define V8_ENABLE_RAW_HEAP_SNAPSHOTS_BOOL false
-#endif  // V8_ENABLE_RAW_HEAP_SNAPSHOTS
-
 #ifdef V8_ENABLE_DOUBLE_CONST_STORE_CHECK
 #define V8_ENABLE_DOUBLE_CONST_STORE_CHECK_BOOL true
 #else
@@ -301,6 +300,12 @@ DEFINE_BOOL(icu_timezone_data, true, "get information about timezones from ICU")
 #define V8_LAZY_SOURCE_POSITIONS_BOOL false
 #endif
 
+#ifdef V8_SHARED_RO_HEAP
+#define V8_SHARED_RO_HEAP_BOOL true
+#else
+#define V8_SHARED_RO_HEAP_BOOL false
+#endif
+
 DEFINE_BOOL(lite_mode, V8_LITE_BOOL,
             "enables trade-off of performance for memory savings")
 
@@ -309,6 +314,15 @@ DEFINE_IMPLICATION(lite_mode, jitless)
 DEFINE_IMPLICATION(lite_mode, lazy_feedback_allocation)
 DEFINE_IMPLICATION(lite_mode, optimize_for_size)
 
+#ifdef V8_ENABLE_THIRD_PARTY_HEAP
+#define V8_ENABLE_THIRD_PARTY_HEAP_BOOL true
+#else
+#define V8_ENABLE_THIRD_PARTY_HEAP_BOOL false
+#endif
+
+DEFINE_BOOL_READONLY(enable_third_party_heap, V8_ENABLE_THIRD_PARTY_HEAP_BOOL,
+                     "Use third-party heap")
+
 #ifdef V8_DISABLE_WRITE_BARRIERS
 #define V8_DISABLE_WRITE_BARRIERS_BOOL true
 #else
@@ -354,6 +368,8 @@ DEFINE_BOOL(assert_types, false,
 DEFINE_BOOL(allocation_site_pretenuring, true,
             "pretenure with allocation sites")
 DEFINE_BOOL(page_promotion, true, "promote pages based on utilization")
+DEFINE_BOOL(always_promote_young_mc, false,
+            "always promote young objects during mark-compact")
 DEFINE_INT(page_promotion_threshold, 70,
            "min percentage of live bytes on a page to enable fast evacuation")
 DEFINE_BOOL(trace_pretenuring, false,
@@ -469,7 +485,8 @@ DEFINE_BOOL(trace_generalization, false, "trace map generalization")
 DEFINE_BOOL(turboprop, false,
             "enable experimental turboprop mid-tier compiler.")
 DEFINE_NEG_IMPLICATION(turboprop, turbo_inlining)
-DEFINE_NEG_IMPLICATION(turboprop, inline_accessors)
+DEFINE_IMPLICATION(turboprop, concurrent_inlining)
+DEFINE_VALUE_IMPLICATION(turboprop, interrupt_budget, 10 * KB)
 
 // Flags for concurrent recompilation.
 DEFINE_BOOL(concurrent_recompilation, true,
@@ -484,6 +501,8 @@ DEFINE_BOOL(block_concurrent_recompilation, false,
             "block queued jobs until released")
 DEFINE_BOOL(concurrent_inlining, false,
             "run optimizing compiler's inlining phase on a separate thread")
+DEFINE_INT(max_serializer_nesting, 25,
+           "maximum levels for nesting child serializers")
 DEFINE_IMPLICATION(future, concurrent_inlining)
 DEFINE_BOOL(trace_heap_broker_verbose, false,
             "trace the heap broker verbosely (all reports)")
@@ -579,9 +598,8 @@ DEFINE_VALUE_IMPLICATION(stress_inline, max_inlined_bytecode_size_cumulative,
 DEFINE_VALUE_IMPLICATION(stress_inline, max_inlined_bytecode_size_absolute,
                          999999)
 DEFINE_VALUE_IMPLICATION(stress_inline, min_inlining_frequency, 0)
-DEFINE_VALUE_IMPLICATION(stress_inline, polymorphic_inlining, true)
+DEFINE_IMPLICATION(stress_inline, polymorphic_inlining)
 DEFINE_BOOL(trace_turbo_inlining, false, "trace TurboFan inlining")
-DEFINE_BOOL(inline_accessors, true, "inline JavaScript accessors")
 DEFINE_BOOL(turbo_inline_array_builtins, true,
             "inline array builtins in TurboFan code")
 DEFINE_BOOL(use_osr, true, "use on-stack replacement")
@@ -608,6 +626,8 @@ DEFINE_BOOL(turbo_instruction_scheduling, false,
             "enable instruction scheduling in TurboFan")
 DEFINE_BOOL(turbo_stress_instruction_scheduling, false,
             "randomly schedule instructions to stress dependency tracking")
+DEFINE_IMPLICATION(turbo_stress_instruction_scheduling,
+                   turbo_instruction_scheduling)
 DEFINE_BOOL(turbo_store_elimination, true,
             "enable store-store elimination in TurboFan")
 DEFINE_BOOL(trace_store_elimination, false, "trace store elimination")
@@ -636,39 +656,28 @@ DEFINE_BOOL(untrusted_code_mitigations, V8_DEFAULT_UNTRUSTED_CODE_MITIGATIONS,
 DEFINE_BOOL(expose_wasm, true, "expose wasm interface to JavaScript")
 DEFINE_BOOL(assume_asmjs_origin, false,
             "force wasm decoder to assume input is internal asm-wasm format")
-DEFINE_BOOL(wasm_disable_structured_cloning, false,
-            "disable wasm structured cloning")
-DEFINE_INT(wasm_num_compilation_tasks, 10,
-           "number of parallel compilation tasks for wasm")
+DEFINE_INT(wasm_num_compilation_tasks, 128,
+           "maximum number of parallel compilation tasks for wasm")
 DEFINE_DEBUG_BOOL(trace_wasm_native_heap, false,
                   "trace wasm native heap events")
 DEFINE_BOOL(wasm_write_protect_code_memory, false,
             "write protect code memory on the wasm native heap")
-DEFINE_BOOL(trace_wasm_serialization, false,
-            "trace serialization/deserialization")
+DEFINE_DEBUG_BOOL(trace_wasm_serialization, false,
+                  "trace serialization/deserialization")
 DEFINE_BOOL(wasm_async_compilation, true,
             "enable actual asynchronous compilation for WebAssembly.compile")
 DEFINE_BOOL(wasm_test_streaming, false,
             "use streaming compilation instead of async compilation for tests")
-DEFINE_UINT(wasm_max_mem_pages, v8::internal::wasm::kV8MaxWasmMemoryPages,
+// TODO(4153): Set this back to v8::internal::wasm::kV8MaxWasmMemoryPages
+DEFINE_UINT(wasm_max_mem_pages, 32767,
             "maximum number of 64KiB memory pages of a wasm instance")
 DEFINE_UINT(wasm_max_table_size, v8::internal::wasm::kV8MaxWasmTableSize,
             "maximum table size of a wasm instance")
 DEFINE_UINT(wasm_max_code_space, v8::internal::kMaxWasmCodeMB,
             "maximum committed code space for wasm (in MB)")
-// Enable Liftoff by default on ia32 and x64. More architectures will follow
-// once they are implemented and sufficiently tested.
-#if V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_X64
-DEFINE_BOOL(
-    wasm_tier_up, true,
-    "enable wasm baseline compilation and tier up to the optimizing compiler")
-#else
-DEFINE_BOOL(
-    wasm_tier_up, false,
-    "enable wasm baseline compilation and tier up to the optimizing compiler")
-DEFINE_IMPLICATION(future, wasm_tier_up)
-#endif
-DEFINE_IMPLICATION(wasm_tier_up, liftoff)
+DEFINE_BOOL(wasm_tier_up, true,
+            "enable tier up to the optimizing compiler (requires --liftoff to "
+            "have an effect)")
 DEFINE_DEBUG_BOOL(trace_wasm_decoder, false, "trace decoding of wasm code")
 DEFINE_DEBUG_BOOL(trace_wasm_compiler, false, "trace compiling of wasm code")
 DEFINE_DEBUG_BOOL(trace_wasm_interpreter, false,
@@ -678,12 +687,18 @@ DEFINE_DEBUG_BOOL(trace_wasm_streaming, false,
 DEFINE_INT(trace_wasm_ast_start, 0,
            "start function for wasm AST trace (inclusive)")
 DEFINE_INT(trace_wasm_ast_end, 0, "end function for wasm AST trace (exclusive)")
+// Enable Liftoff by default on ia32 and x64. More architectures will follow
+// once they are implemented and sufficiently tested.
+#if V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_X64
+DEFINE_BOOL(liftoff, true,
+            "enable Liftoff, the baseline compiler for WebAssembly")
+#else
 DEFINE_BOOL(liftoff, false,
             "enable Liftoff, the baseline compiler for WebAssembly")
+DEFINE_IMPLICATION(future, liftoff)
+#endif
 DEFINE_DEBUG_BOOL(trace_liftoff, false,
                   "trace Liftoff, the baseline compiler for WebAssembly")
-DEFINE_DEBUG_BOOL(wasm_break_on_decoder_error, false,
-                  "debug break when wasm decoder encounters an error")
 DEFINE_BOOL(trace_wasm_memory, false,
             "print all memory updates performed in wasm code")
 // Fuzzers use {wasm_tier_mask_for_testing} together with {liftoff} and
@@ -691,6 +706,10 @@ DEFINE_BOOL(trace_wasm_memory, false,
 DEFINE_INT(wasm_tier_mask_for_testing, 0,
            "bitmask of functions to compile with TurboFan instead of Liftoff")
 
+DEFINE_BOOL(debug_in_liftoff, false,
+            "use Liftoff instead of the C++ interpreter for debugging "
+            "WebAssembly (experimental)")
+
 DEFINE_BOOL(validate_asm, true, "validate asm.js modules before compiling")
 DEFINE_BOOL(suppress_asm_messages, false,
             "don't emit asm.js related messages (for golden file testing)")
@@ -723,16 +742,14 @@ FOREACH_WASM_STAGING_FEATURE_FLAG(WASM_STAGING_IMPLICATION)
 #undef WASM_STAGING_IMPLICATION
 
 DEFINE_BOOL(wasm_opt, false, "enable wasm optimization")
-DEFINE_BOOL(wasm_no_bounds_checks, false,
-            "disable bounds checks (performance testing only)")
-DEFINE_BOOL(wasm_no_stack_checks, false,
-            "disable stack checks (performance testing only)")
+DEFINE_BOOL(
+    wasm_bounds_checks, true,
+    "enable bounds checks (disable for performance testing only)")
+DEFINE_BOOL(wasm_stack_checks, true,
+            "enable stack checks (disable for performance testing only)")
 DEFINE_BOOL(wasm_math_intrinsics, true,
             "intrinsify some Math imports into wasm")
 
-DEFINE_BOOL(wasm_shared_engine, true,
-            "shares one wasm engine between all isolates within a process")
-DEFINE_IMPLICATION(future, wasm_shared_engine)
 DEFINE_BOOL(wasm_trap_handler, true,
             "use signal handlers to catch out of bounds memory access in wasm"
             " (currently Linux x86_64 only)")
@@ -752,6 +769,8 @@ DEFINE_DEBUG_BOOL(trace_wasm_lazy_compilation, false,
                   "trace lazy compilation of wasm functions")
 DEFINE_BOOL(wasm_grow_shared_memory, true,
             "allow growing shared WebAssembly memory objects")
+DEFINE_BOOL(wasm_atomics_on_non_shared_memory, false,
+            "allow atomic operations on non-shared WebAssembly memory")
 DEFINE_BOOL(wasm_lazy_validation, false,
             "enable lazy validation for lazily compiled wasm functions")
 // wasm-interpret-all resets {asm-,}wasm-lazy-compilation.
@@ -866,6 +885,16 @@ DEFINE_BOOL(write_protect_code_memory, true, "write protect code memory")
 #endif
 DEFINE_BOOL(concurrent_marking, V8_CONCURRENT_MARKING_BOOL,
             "use concurrent marking")
+#ifdef V8_ARRAY_BUFFER_EXTENSION
+#define V8_ARRAY_BUFFER_EXTENSION_BOOL true
+#else
+#define V8_ARRAY_BUFFER_EXTENSION_BOOL false
+#endif
+DEFINE_BOOL_READONLY(array_buffer_extension, V8_ARRAY_BUFFER_EXTENSION_BOOL,
+                     "enable array buffer tracking using extension objects")
+DEFINE_IMPLICATION(array_buffer_extension, always_promote_young_mc)
+DEFINE_BOOL(concurrent_array_buffer_sweeping, true,
+            "concurrently sweep array buffers")
 DEFINE_BOOL(parallel_marking, true, "use parallel marking in atomic pause")
 DEFINE_INT(ephemeron_fixpoint_iterations, 10,
            "number of fixpoint iterations it takes to switch to linear "
@@ -935,6 +964,8 @@ DEFINE_IMPLICATION(stress_flush_bytecode, flush_bytecode)
 DEFINE_BOOL(use_marking_progress_bar, true,
             "Use a progress bar to scan large objects in increments when "
             "incremental marking is active.")
+DEFINE_BOOL(stress_per_context_marking_worklist, false,
+            "Use per-context worklist for marking")
 DEFINE_BOOL(force_marking_deque_overflows, false,
             "force overflows of marking deque by reducing it's size "
             "to 64 words")
@@ -1038,7 +1069,6 @@ DEFINE_BOOL(disable_old_api_accessors, false,
             "prototype chain")
 
 // bootstrapper.cc
-DEFINE_BOOL(expose_free_buffer, false, "expose freeBuffer extension")
 DEFINE_BOOL(expose_gc, false, "expose gc extension")
 DEFINE_STRING(expose_gc_as, nullptr,
               "expose gc extension under the specified name")
@@ -1056,6 +1086,9 @@ DEFINE_BOOL(disallow_code_generation_from_strings, false,
 DEFINE_BOOL(expose_async_hooks, false, "expose async_hooks object")
 DEFINE_STRING(expose_cputracemark_as, nullptr,
               "expose cputracemark extension under the specified name")
+#ifdef ENABLE_VTUNE_TRACEMARK
+DEFINE_BOOL(enable_vtune_domain_support, true, "enable vtune domain support")
+#endif  // ENABLE_VTUNE_TRACEMARK
 
 // builtins.cc
 DEFINE_BOOL(allow_unsafe_function_constructor, false,
@@ -1248,13 +1281,6 @@ DEFINE_GENERIC_IMPLICATION(
         v8::tracing::TracingCategoryObserver::ENABLED_BY_NATIVE))
 
 // snapshot-common.cc
-#ifdef V8_EMBEDDED_BUILTINS
-#define V8_EMBEDDED_BUILTINS_BOOL true
-#else
-#define V8_EMBEDDED_BUILTINS_BOOL false
-#endif
-DEFINE_BOOL_READONLY(embedded_builtins, V8_EMBEDDED_BUILTINS_BOOL,
-                     "Embed builtin code into the binary.")
 DEFINE_BOOL(profile_deserialization, false,
             "Print the time it takes to deserialize the snapshot.")
 DEFINE_BOOL(serialization_statistics, false,
@@ -1314,6 +1340,10 @@ DEFINE_STRING(startup_blob, nullptr,
 DEFINE_STRING(target_arch, nullptr,
               "The mksnapshot target arch. (mksnapshot only)")
 DEFINE_STRING(target_os, nullptr, "The mksnapshot target os. (mksnapshot only)")
+DEFINE_BOOL(target_is_simulator, false,
+            "Instruct mksnapshot that the target is meant to run in the "
+            "simulator and it can generate simulator-specific instructions. "
+            "(mksnapshot only)")
 
 //
 // Minor mark compact collector flags.
@@ -1324,6 +1354,9 @@ DEFINE_BOOL(minor_mc_parallel_marking, true,
 DEFINE_BOOL(trace_minor_mc_parallel_marking, false,
             "trace parallel marking for the young generation")
 DEFINE_BOOL(minor_mc, false, "perform young generation mark compact GCs")
+#else
+DEFINE_BOOL_READONLY(minor_mc, false,
+                     "perform young generation mark compact GCs")
 #endif  // ENABLE_MINOR_MC
 
 //
@@ -1342,6 +1375,10 @@ DEFINE_BOOL(mock_arraybuffer_allocator, false,
 DEFINE_SIZE_T(mock_arraybuffer_allocator_limit, 0,
               "Memory limit for mock ArrayBuffer allocator used to simulate "
               "OOM for testing.")
+#if V8_OS_LINUX
+DEFINE_BOOL(multi_mapped_mock_allocator, false,
+            "Use a multi-mapped mock ArrayBuffer allocator for testing.")
+#endif
 
 //
 // GDB JIT integration flags.
@@ -1471,33 +1508,57 @@ DEFINE_BOOL(prof_browser_mode, true,
 DEFINE_STRING(logfile, "v8.log", "Specify the name of the log file.")
 DEFINE_BOOL(logfile_per_isolate, true, "Separate log files for each isolate.")
 DEFINE_BOOL(ll_prof, false, "Enable low-level linux profiler.")
-DEFINE_BOOL(perf_basic_prof, false,
-            "Enable perf linux profiler (basic support).")
+
+#if V8_OS_LINUX
+#define DEFINE_PERF_PROF_BOOL(nam, cmt) DEFINE_BOOL(nam, false, cmt)
+#define DEFINE_PERF_PROF_IMPLICATION DEFINE_IMPLICATION
+#else
+#define DEFINE_PERF_PROF_BOOL(nam, cmt) DEFINE_BOOL_READONLY(nam, false, cmt)
+#define DEFINE_PERF_PROF_IMPLICATION(...)
+#endif
+
+DEFINE_PERF_PROF_BOOL(perf_basic_prof,
+                      "Enable perf linux profiler (basic support).")
 DEFINE_NEG_IMPLICATION(perf_basic_prof, compact_code_space)
-DEFINE_BOOL(perf_basic_prof_only_functions, false,
-            "Only report function code ranges to perf (i.e. no stubs).")
-DEFINE_IMPLICATION(perf_basic_prof_only_functions, perf_basic_prof)
-DEFINE_BOOL(perf_prof, false,
-            "Enable perf linux profiler (experimental annotate support).")
-DEFINE_BOOL(perf_prof_annotate_wasm, false,
-            "Used with --perf-prof, load wasm source map and provide annotate "
-            "support (experimental).")
+DEFINE_PERF_PROF_BOOL(
+    perf_basic_prof_only_functions,
+    "Only report function code ranges to perf (i.e. no stubs).")
+DEFINE_PERF_PROF_IMPLICATION(perf_basic_prof_only_functions, perf_basic_prof)
+DEFINE_PERF_PROF_BOOL(
+    perf_prof, "Enable perf linux profiler (experimental annotate support).")
+DEFINE_PERF_PROF_BOOL(
+    perf_prof_annotate_wasm,
+    "Used with --perf-prof, load wasm source map and provide annotate "
+    "support (experimental).")
+DEFINE_PERF_PROF_BOOL(
+    perf_prof_delete_file,
+    "Remove the perf file right after creating it (for testing only).")
 DEFINE_NEG_IMPLICATION(perf_prof, compact_code_space)
 // TODO(v8:8462) Remove implication once perf supports remapping.
 DEFINE_NEG_IMPLICATION(perf_prof, write_protect_code_memory)
 DEFINE_NEG_IMPLICATION(perf_prof, wasm_write_protect_code_memory)
-DEFINE_BOOL(perf_prof_unwinding_info, false,
-            "Enable unwinding info for perf linux profiler (experimental).")
-DEFINE_IMPLICATION(perf_prof, perf_prof_unwinding_info)
+
+// --perf-prof-unwinding-info is available only on selected architectures.
+#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_X64 && \
+    !V8_TARGET_ARCH_S390X && !V8_TARGET_ARCH_PPC64
+#undef DEFINE_PERF_PROF_BOOL
+#define DEFINE_PERF_PROF_BOOL(nam, cmt) DEFINE_BOOL_READONLY(nam, false, cmt)
+#undef DEFINE_PERF_PROF_IMPLICATION
+#define DEFINE_PERF_PROF_IMPLICATION(...)
+#endif
+
+DEFINE_PERF_PROF_BOOL(
+    perf_prof_unwinding_info,
+    "Enable unwinding info for perf linux profiler (experimental).")
+DEFINE_PERF_PROF_IMPLICATION(perf_prof, perf_prof_unwinding_info)
+
+#undef DEFINE_PERF_PROF_BOOL
+#undef DEFINE_PERF_PROF_IMPLICATION
+
 DEFINE_STRING(gc_fake_mmap, "/tmp/__v8_gc__",
               "Specify the name of the file for fake gc mmap used in ll_prof")
 DEFINE_BOOL(log_internal_timer_events, false, "Time internal events.")
 DEFINE_IMPLICATION(log_internal_timer_events, prof)
-DEFINE_BOOL(log_instruction_stats, false, "Log AArch64 instruction statistics.")
-DEFINE_STRING(log_instruction_file, "arm64_inst.csv",
-              "AArch64 instruction statistics log file.")
-DEFINE_INT(log_instruction_period, 1 << 22,
-           "AArch64 instruction statistics logging period.")
 
 DEFINE_BOOL(redirect_code_traces, false,
             "output deopt information and disassembly into file "
@@ -1508,6 +1569,10 @@ DEFINE_STRING(redirect_code_traces_to, nullptr,
 DEFINE_BOOL(print_opt_source, false,
             "print source code of optimized and inlined functions")
 
+DEFINE_BOOL(vtune_prof_annotate_wasm, false,
+            "Used when v8_enable_vtunejit is enabled, load wasm source map and "
+            "provide annotate support (experimental).")
+
 DEFINE_BOOL(win64_unwinding_info, true, "Enable unwinding info for Windows/x64")
 
 #ifdef V8_TARGET_ARCH_ARM
@@ -1522,11 +1587,6 @@ DEFINE_BOOL(interpreted_frames_native_stack, false,
             "profilers).")
 #endif
 
-// TODO(v8:9206, solanes): remove this when smi-corrupting reducer is fully on.
-DEFINE_BOOL_READONLY(turbo_decompression_elimination, true,
-                     "enable the decompression elimination system when "
-                     "pointer compression is enabled.")
-
 //
 // Disassembler only flags
 //
@@ -1618,6 +1678,7 @@ DEFINE_NEG_IMPLICATION(single_threaded_gc, concurrent_store_buffer)
 DEFINE_NEG_IMPLICATION(single_threaded_gc, minor_mc_parallel_marking)
 #endif  // ENABLE_MINOR_MC
 DEFINE_NEG_IMPLICATION(single_threaded_gc, concurrent_array_buffer_freeing)
+DEFINE_NEG_IMPLICATION(single_threaded_gc, concurrent_array_buffer_sweeping)
 
 #undef FLAG
 
@@ -1646,9 +1707,6 @@ DEFINE_BOOL(unbox_double_fields, V8_DOUBLE_FIELDS_UNBOXING,
             "enable in-object double fields unboxing (64-bit only)")
 DEFINE_IMPLICATION(unbox_double_fields, track_double_fields)
 
-DEFINE_BOOL(raw_heap_snapshots, V8_ENABLE_RAW_HEAP_SNAPSHOTS_BOOL,
-            "enable raw heap snapshots contain garbage collection internals")
-
 // Cleanup...
 #undef FLAG_FULL
 #undef FLAG_READONLY
diff --git a/deps/v8/src/flags/flags.cc b/deps/v8/src/flags/flags.cc
index 147e8b20ceb5e8..15f87b0b74951c 100644
--- a/deps/v8/src/flags/flags.cc
+++ b/deps/v8/src/flags/flags.cc
@@ -597,9 +597,6 @@ void ComputeFlagListHash() {
 #ifdef DEBUG
   modified_args_as_string << "debug";
 #endif  // DEBUG
-  if (FLAG_embedded_builtins) {
-    modified_args_as_string << "embedded";
-  }
   for (size_t i = 0; i < num_flags; ++i) {
     Flag* current = &flags[i];
     if (current->type() == Flag::TYPE_BOOL &&
diff --git a/deps/v8/src/handles/OWNERS b/deps/v8/src/handles/OWNERS
index 57f0b54262ed22..1a020a093aeec6 100644
--- a/deps/v8/src/handles/OWNERS
+++ b/deps/v8/src/handles/OWNERS
@@ -2,6 +2,5 @@ ishell@chromium.org
 jkummerow@chromium.org
 mlippautz@chromium.org
 ulan@chromium.org
-yangguo@chromium.org
 
 # COMPONENT: Blink>JavaScript>GC
diff --git a/deps/v8/src/handles/factory-handles.h b/deps/v8/src/handles/factory-handles.h
new file mode 100644
index 00000000000000..312ced8b7cb078
--- /dev/null
+++ b/deps/v8/src/handles/factory-handles.h
@@ -0,0 +1,23 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HANDLES_FACTORY_HANDLES_H_
+#define V8_HANDLES_FACTORY_HANDLES_H_
+
+namespace v8 {
+namespace internal {
+
+template <typename Impl>
+struct FactoryTraits;
+
+template <typename Impl, typename T>
+using FactoryHandle = typename FactoryTraits<Impl>::template HandleType<T>;
+template <typename Impl, typename T>
+using FactoryMaybeHandle =
+    typename FactoryTraits<Impl>::template MaybeHandleType<T>;
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HANDLES_FACTORY_HANDLES_H_
diff --git a/deps/v8/src/handles/global-handles.cc b/deps/v8/src/handles/global-handles.cc
index 416c65fabd4e48..fcec0ca761a89a 100644
--- a/deps/v8/src/handles/global-handles.cc
+++ b/deps/v8/src/handles/global-handles.cc
@@ -4,6 +4,9 @@
 
 #include "src/handles/global-handles.h"
 
+#include <algorithm>
+#include <map>
+
 #include "src/api/api-inl.h"
 #include "src/base/compiler-specific.h"
 #include "src/execution/vm-state-inl.h"
@@ -14,8 +17,10 @@
 #include "src/objects/objects-inl.h"
 #include "src/objects/slots.h"
 #include "src/objects/visitors.h"
+#include "src/sanitizer/asan.h"
 #include "src/tasks/cancelable-task.h"
 #include "src/tasks/task-utils.h"
+#include "src/utils/utils.h"
 
 namespace v8 {
 namespace internal {
@@ -600,7 +605,7 @@ class GlobalHandles::Node final : public NodeBase<GlobalHandles::Node> {
 
   // This stores three flags (independent, partially_dependent and
   // in_young_list) and a State.
-  using NodeState = BitField8<State, 0, 3>;
+  using NodeState = base::BitField8<State, 0, 3>;
   using IsInYoungList = NodeState::Next<bool, 1>;
   using NodeWeaknessType = IsInYoungList::Next<WeaknessType, 2>;
 
@@ -617,6 +622,12 @@ class GlobalHandles::TracedNode final
  public:
   TracedNode() { set_in_young_list(false); }
 
+  // Copy and move ctors are used when constructing a TracedNode when recording
+  // a node for on-stack data structures. (Older compilers may refer to copy
+  // instead of move ctor.)
+  TracedNode(TracedNode&& other) V8_NOEXCEPT = default;
+  TracedNode(const TracedNode& other) V8_NOEXCEPT = default;
+
   enum State { FREE = 0, NORMAL, NEAR_DEATH };
 
   State state() const { return NodeState::decode(flags_); }
@@ -637,6 +648,13 @@ class GlobalHandles::TracedNode final
   bool has_destructor() const { return HasDestructor::decode(flags_); }
   void set_has_destructor(bool v) { flags_ = HasDestructor::update(flags_, v); }
 
+  bool markbit() const { return Markbit::decode(flags_); }
+  void clear_markbit() { flags_ = Markbit::update(flags_, false); }
+  void set_markbit() { flags_ = Markbit::update(flags_, true); }
+
+  bool is_on_stack() const { return IsOnStack::decode(flags_); }
+  void set_is_on_stack(bool v) { flags_ = IsOnStack::update(flags_, v); }
+
   void SetFinalizationCallback(void* parameter,
                                WeakCallbackInfo<void>::Callback callback) {
     set_parameter(parameter);
@@ -644,6 +662,8 @@ class GlobalHandles::TracedNode final
   }
   bool HasFinalizationCallback() const { return callback_ != nullptr; }
 
+  void CopyObjectReference(const TracedNode& other) { object_ = other.object_; }
+
   void CollectPhantomCallbackData(
       std::vector<std::pair<TracedNode*, PendingPhantomCallback>>*
           pending_phantom_callbacks) {
@@ -673,33 +693,201 @@ class GlobalHandles::TracedNode final
     DCHECK(!IsInUse());
   }
 
+  static void Verify(GlobalHandles* global_handles, const Address* const* slot);
+
  protected:
-  using NodeState = BitField8<State, 0, 2>;
+  using NodeState = base::BitField8<State, 0, 2>;
   using IsInYoungList = NodeState::Next<bool, 1>;
   using IsRoot = IsInYoungList::Next<bool, 1>;
   using HasDestructor = IsRoot::Next<bool, 1>;
+  using Markbit = HasDestructor::Next<bool, 1>;
+  using IsOnStack = Markbit::Next<bool, 1>;
 
   void ClearImplFields() {
     set_root(true);
+    // Nodes are black allocated for simplicity.
+    set_markbit();
     callback_ = nullptr;
+    set_is_on_stack(false);
+    set_has_destructor(false);
   }
 
   void CheckImplFieldsAreCleared() const {
     DCHECK(is_root());
+    DCHECK(markbit());
     DCHECK_NULL(callback_);
   }
 
   WeakCallbackInfo<void>::Callback callback_;
 
   friend class NodeBase<GlobalHandles::TracedNode>;
+};
+
+// Space to keep track of on-stack handles (e.g. TracedReference). Such
+// references are treated as root for any V8 garbage collection. The data
+// structure is self healing and pessimistally filters outdated entries on
+// insertion and iteration.
+//
+// Design doc: http://bit.ly/on-stack-traced-reference
+class GlobalHandles::OnStackTracedNodeSpace final {
+ public:
+  static GlobalHandles* GetGlobalHandles(const TracedNode* on_stack_node) {
+    DCHECK(on_stack_node->is_on_stack());
+    return reinterpret_cast<const NodeEntry*>(on_stack_node)->global_handles;
+  }
+
+  explicit OnStackTracedNodeSpace(GlobalHandles* global_handles)
+      : global_handles_(global_handles) {}
+
+  void SetStackStart(void* stack_start) {
+    CHECK(on_stack_nodes_.empty());
+    stack_start_ =
+        GetStackAddressForSlot(reinterpret_cast<uintptr_t>(stack_start));
+  }
+
+  bool IsOnStack(uintptr_t slot) const {
+    const uintptr_t address = GetStackAddressForSlot(slot);
+    return stack_start_ >= address && address > GetCurrentStackPosition();
+  }
+
+  void Iterate(RootVisitor* v);
+  TracedNode* Acquire(Object value, uintptr_t address);
+  void CleanupBelowCurrentStackPosition();
+  void NotifyEmptyEmbedderStack();
+
+  size_t NumberOfHandlesForTesting() const { return on_stack_nodes_.size(); }
+
+ private:
+  struct NodeEntry {
+    TracedNode node;
+    // Used to find back to GlobalHandles from a Node on copy. Needs to follow
+    // node.
+    GlobalHandles* global_handles;
+  };
 
-  DISALLOW_COPY_AND_ASSIGN(TracedNode);
+  uintptr_t GetStackAddressForSlot(uintptr_t slot) const;
+
+  // Keeps track of registered handles and their stack address. The data
+  // structure is cleaned on iteration and when adding new references using the
+  // current stack address.
+  std::map<uintptr_t, NodeEntry> on_stack_nodes_;
+  uintptr_t stack_start_ = 0;
+  GlobalHandles* global_handles_ = nullptr;
+  size_t acquire_count_ = 0;
 };
 
+uintptr_t GlobalHandles::OnStackTracedNodeSpace::GetStackAddressForSlot(
+    uintptr_t slot) const {
+#ifdef V8_USE_ADDRESS_SANITIZER
+  void* fake_stack = __asan_get_current_fake_stack();
+  if (fake_stack) {
+    void* fake_frame_start;
+    void* real_frame = __asan_addr_is_in_fake_stack(
+        fake_stack, reinterpret_cast<void*>(slot), &fake_frame_start, nullptr);
+    if (real_frame) {
+      return reinterpret_cast<uintptr_t>(real_frame) +
+             (slot - reinterpret_cast<uintptr_t>(fake_frame_start));
+    }
+  }
+#endif  // V8_USE_ADDRESS_SANITIZER
+  return slot;
+}
+
+void GlobalHandles::OnStackTracedNodeSpace::NotifyEmptyEmbedderStack() {
+  on_stack_nodes_.clear();
+}
+
+void GlobalHandles::OnStackTracedNodeSpace::Iterate(RootVisitor* v) {
+  // Handles have been cleaned from the GC entry point which is higher up the
+  // stack.
+  for (auto& pair : on_stack_nodes_) {
+    TracedNode& node = pair.second.node;
+    if (node.IsRetainer()) {
+      v->VisitRootPointer(Root::kGlobalHandles, "on-stack TracedReference",
+                          node.location());
+    }
+  }
+}
+
+GlobalHandles::TracedNode* GlobalHandles::OnStackTracedNodeSpace::Acquire(
+    Object value, uintptr_t slot) {
+  constexpr size_t kAcquireCleanupThresholdLog2 = 8;
+  constexpr size_t kAcquireCleanupThresholdMask =
+      (size_t{1} << kAcquireCleanupThresholdLog2) - 1;
+  DCHECK(IsOnStack(slot));
+  if (((acquire_count_++) & kAcquireCleanupThresholdMask) == 0) {
+    CleanupBelowCurrentStackPosition();
+  }
+  NodeEntry entry;
+  entry.node.Free(nullptr);
+  entry.global_handles = global_handles_;
+  auto pair =
+      on_stack_nodes_.insert({GetStackAddressForSlot(slot), std::move(entry)});
+  if (!pair.second) {
+    // Insertion failed because there already was an entry present for that
+    // stack address. This can happen because cleanup is conservative in which
+    // stack limits it used. Reusing the entry is fine as there's no aliasing of
+    // different references with the same stack slot.
+    pair.first->second.node.Free(nullptr);
+  }
+  TracedNode* result = &(pair.first->second.node);
+  result->Acquire(value);
+  result->set_is_on_stack(true);
+  return result;
+}
+
+void GlobalHandles::OnStackTracedNodeSpace::CleanupBelowCurrentStackPosition() {
+  if (on_stack_nodes_.empty()) return;
+  const auto it = on_stack_nodes_.upper_bound(GetCurrentStackPosition());
+  on_stack_nodes_.erase(on_stack_nodes_.begin(), it);
+}
+
+// static
+void GlobalHandles::TracedNode::Verify(GlobalHandles* global_handles,
+                                       const Address* const* slot) {
+#ifdef DEBUG
+  const TracedNode* node = FromLocation(*slot);
+  DCHECK(node->IsInUse());
+  DCHECK_IMPLIES(!node->has_destructor(), nullptr == node->parameter());
+  DCHECK_IMPLIES(node->has_destructor() && !node->HasFinalizationCallback(),
+                 node->parameter());
+  bool slot_on_stack = global_handles->on_stack_nodes_->IsOnStack(
+      reinterpret_cast<uintptr_t>(slot));
+  DCHECK_EQ(slot_on_stack, node->is_on_stack());
+  if (!node->is_on_stack()) {
+    // On-heap nodes have seprate lists for young generation processing.
+    bool is_young_gen_object = ObjectInYoungGeneration(node->object());
+    DCHECK_IMPLIES(is_young_gen_object, node->is_in_young_list());
+  }
+  bool in_young_list =
+      std::find(global_handles->traced_young_nodes_.begin(),
+                global_handles->traced_young_nodes_.end(),
+                node) != global_handles->traced_young_nodes_.end();
+  DCHECK_EQ(in_young_list, node->is_in_young_list());
+#endif  // DEBUG
+}
+
+void GlobalHandles::CleanupOnStackReferencesBelowCurrentStackPosition() {
+  on_stack_nodes_->CleanupBelowCurrentStackPosition();
+}
+
+size_t GlobalHandles::NumberOfOnStackHandlesForTesting() {
+  return on_stack_nodes_->NumberOfHandlesForTesting();
+}
+
+void GlobalHandles::SetStackStart(void* stack_start) {
+  on_stack_nodes_->SetStackStart(stack_start);
+}
+
+void GlobalHandles::NotifyEmptyEmbedderStack() {
+  on_stack_nodes_->NotifyEmptyEmbedderStack();
+}
+
 GlobalHandles::GlobalHandles(Isolate* isolate)
     : isolate_(isolate),
       regular_nodes_(new NodeSpace<GlobalHandles::Node>(this)),
-      traced_nodes_(new NodeSpace<GlobalHandles::TracedNode>(this)) {}
+      traced_nodes_(new NodeSpace<GlobalHandles::TracedNode>(this)),
+      on_stack_nodes_(new OnStackTracedNodeSpace(this)) {}
 
 GlobalHandles::~GlobalHandles() { regular_nodes_.reset(nullptr); }
 
@@ -718,13 +906,26 @@ Handle<Object> GlobalHandles::Create(Address value) {
 
 Handle<Object> GlobalHandles::CreateTraced(Object value, Address* slot,
                                            bool has_destructor) {
-  GlobalHandles::TracedNode* result = traced_nodes_->Acquire(value);
-  if (ObjectInYoungGeneration(value) && !result->is_in_young_list()) {
-    traced_young_nodes_.push_back(result);
-    result->set_in_young_list(true);
+  return CreateTraced(
+      value, slot, has_destructor,
+      on_stack_nodes_->IsOnStack(reinterpret_cast<uintptr_t>(slot)));
+}
+
+Handle<Object> GlobalHandles::CreateTraced(Object value, Address* slot,
+                                           bool has_destructor,
+                                           bool is_on_stack) {
+  GlobalHandles::TracedNode* result;
+  if (is_on_stack) {
+    result = on_stack_nodes_->Acquire(value, reinterpret_cast<uintptr_t>(slot));
+  } else {
+    result = traced_nodes_->Acquire(value);
+    if (ObjectInYoungGeneration(value) && !result->is_in_young_list()) {
+      traced_young_nodes_.push_back(result);
+      result->set_in_young_list(true);
+    }
   }
-  result->set_parameter(slot);
   result->set_has_destructor(has_destructor);
+  result->set_parameter(has_destructor ? slot : nullptr);
   return result->handle();
 }
 
@@ -753,12 +954,17 @@ void GlobalHandles::CopyTracedGlobal(const Address* const* from, Address** to) {
   // Copying a traced handle with finalization callback is prohibited because
   // the callback may require knowing about multiple copies of the traced
   // handle.
-  CHECK(!node->HasFinalizationCallback());
+  CHECK_WITH_MSG(!node->HasFinalizationCallback(),
+                 "Copying of references is not supported when "
+                 "SetFinalizationCallback is set.");
+
   GlobalHandles* global_handles =
-      NodeBlock<TracedNode>::From(node)->global_handles();
+      GlobalHandles::From(const_cast<TracedNode*>(node));
   Handle<Object> o = global_handles->CreateTraced(
       node->object(), reinterpret_cast<Address*>(to), node->has_destructor());
   *to = o.location();
+  TracedNode::Verify(global_handles, from);
+  TracedNode::Verify(global_handles, to);
 #ifdef VERIFY_HEAP
   if (i::FLAG_verify_heap) {
     Object(**to).ObjectVerify(global_handles->isolate());
@@ -781,16 +987,94 @@ void GlobalHandles::MoveGlobal(Address** from, Address** to) {
 }
 
 void GlobalHandles::MoveTracedGlobal(Address** from, Address** to) {
-  DCHECK_NOT_NULL(*from);
-  DCHECK_NOT_NULL(*to);
-  DCHECK_EQ(*from, *to);
-  TracedNode* node = TracedNode::FromLocation(*from);
-  // Only set the backpointer for clearing a phantom handle when there is no
-  // finalization callback attached. As soon as a callback is attached to a node
-  // the embedder is on its own when resetting a handle.
-  if (!node->HasFinalizationCallback()) {
-    node->set_parameter(to);
+  // Fast path for moving from an empty reference.
+  if (!*from) {
+    DestroyTraced(*to);
+    *to = nullptr;
+    return;
+  }
+
+  // Determining whether from or to are on stack.
+  TracedNode* from_node = TracedNode::FromLocation(*from);
+  DCHECK(from_node->IsInUse());
+  TracedNode* to_node = TracedNode::FromLocation(*to);
+  GlobalHandles* global_handles = nullptr;
+#ifdef DEBUG
+  global_handles = GlobalHandles::From(from_node);
+#endif  // DEBUG
+  bool from_on_stack = from_node->is_on_stack();
+  bool to_on_stack = false;
+  if (!to_node) {
+    // Figure out whether stack or heap to allow fast path for heap->heap move.
+    global_handles = GlobalHandles::From(from_node);
+    to_on_stack = global_handles->on_stack_nodes_->IsOnStack(
+        reinterpret_cast<uintptr_t>(to));
+  } else {
+    to_on_stack = to_node->is_on_stack();
+  }
+
+  // Moving a traced handle with finalization callback is prohibited because
+  // the callback may require knowing about multiple copies of the traced
+  // handle.
+  CHECK_WITH_MSG(!from_node->HasFinalizationCallback(),
+                 "Moving of references is not supported when "
+                 "SetFinalizationCallback is set.");
+  // Types in v8.h ensure that we only copy/move handles that have the same
+  // destructor behavior.
+  DCHECK_IMPLIES(to_node,
+                 to_node->has_destructor() == from_node->has_destructor());
+
+  // Moving.
+  if (from_on_stack || to_on_stack) {
+    // Move involving a stack slot.
+    if (!to_node) {
+      DCHECK(global_handles);
+      Handle<Object> o = global_handles->CreateTraced(
+          from_node->object(), reinterpret_cast<Address*>(to),
+          from_node->has_destructor(), to_on_stack);
+      *to = o.location();
+      to_node = TracedNode::FromLocation(*to);
+      DCHECK(to_node->markbit());
+    } else {
+      DCHECK(to_node->IsInUse());
+      to_node->CopyObjectReference(*from_node);
+      if (!to_node->is_on_stack() && !to_node->is_in_young_list() &&
+          ObjectInYoungGeneration(to_node->object())) {
+        global_handles = GlobalHandles::From(from_node);
+        global_handles->traced_young_nodes_.push_back(to_node);
+        to_node->set_in_young_list(true);
+      }
+    }
+    DestroyTraced(*from);
+    *from = nullptr;
+  } else {
+    // Pure heap move.
+    DestroyTraced(*to);
+    *to = *from;
+    to_node = from_node;
+    DCHECK_NOT_NULL(*from);
+    DCHECK_NOT_NULL(*to);
+    DCHECK_EQ(*from, *to);
+    // Fixup back reference for destructor.
+    if (to_node->has_destructor()) {
+      to_node->set_parameter(to);
+    }
+    *from = nullptr;
   }
+  TracedNode::Verify(global_handles, to);
+}
+
+// static
+GlobalHandles* GlobalHandles::From(const TracedNode* node) {
+  return node->is_on_stack()
+             ? OnStackTracedNodeSpace::GetGlobalHandles(node)
+             : NodeBlock<TracedNode>::From(node)->global_handles();
+}
+
+void GlobalHandles::MarkTraced(Address* location) {
+  TracedNode* node = TracedNode::FromLocation(location);
+  node->set_markbit();
+  DCHECK(node->IsInUse());
 }
 
 void GlobalHandles::Destroy(Address* location) {
@@ -801,7 +1085,12 @@ void GlobalHandles::Destroy(Address* location) {
 
 void GlobalHandles::DestroyTraced(Address* location) {
   if (location != nullptr) {
-    NodeSpace<TracedNode>::Release(TracedNode::FromLocation(location));
+    TracedNode* node = TracedNode::FromLocation(location);
+    if (node->is_on_stack()) {
+      node->Release(nullptr);
+    } else {
+      NodeSpace<TracedNode>::Release(node);
+    }
   }
 }
 
@@ -867,8 +1156,26 @@ void GlobalHandles::IterateWeakRootsForPhantomHandles(
     }
   }
   for (TracedNode* node : *traced_nodes_) {
-    if (node->IsInUse() &&
-        should_reset_handle(isolate()->heap(), node->location())) {
+    if (!node->IsInUse()) continue;
+    // Detect unreachable nodes first.
+    if (!node->markbit() && node->IsPhantomResetHandle() &&
+        !node->has_destructor()) {
+      // The handle is unreachable and does not have a callback and a
+      // destructor associated with it. We can clear it even if the target V8
+      // object is alive. Note that the desctructor and the callback may
+      // access the handle, that is why we avoid clearing it.
+      node->ResetPhantomHandle(HandleHolder::kDead);
+      ++number_of_phantom_handle_resets_;
+      continue;
+    } else if (node->markbit()) {
+      // Clear the markbit for the next GC.
+      node->clear_markbit();
+    }
+    DCHECK(node->IsInUse());
+    // Detect nodes with unreachable target objects.
+    if (should_reset_handle(isolate()->heap(), node->location())) {
+      // If the node allows eager resetting, then reset it here. Otherwise,
+      // collect its callback that will reset it.
       if (node->IsPhantomResetHandle()) {
         node->ResetPhantomHandle(node->has_destructor() ? HandleHolder::kLive
                                                         : HandleHolder::kDead);
@@ -925,6 +1232,7 @@ void GlobalHandles::IterateYoungStrongAndDependentRoots(RootVisitor* v) {
       v->VisitRootPointer(Root::kGlobalHandles, nullptr, node->location());
     }
   }
+  on_stack_nodes_->Iterate(v);
 }
 
 void GlobalHandles::MarkYoungWeakUnmodifiedObjectsPending(
@@ -1015,6 +1323,8 @@ void GlobalHandles::IterateYoungWeakUnmodifiedRootsForPhantomHandles(
 void GlobalHandles::InvokeSecondPassPhantomCallbacksFromTask() {
   DCHECK(second_pass_callbacks_task_posted_);
   second_pass_callbacks_task_posted_ = false;
+  Heap::DevToolsTraceEventScope devtools_trace_event_scope(
+      isolate()->heap(), "MajorGC", "invoke weak phantom callbacks");
   TRACE_EVENT0("v8", "V8.GCPhantomHandleProcessingCallback");
   isolate()->heap()->CallGCPrologueCallbacks(
       GCType::kGCTypeProcessWeakCallbacks, kNoGCCallbackFlags);
@@ -1141,6 +1451,8 @@ void GlobalHandles::InvokeOrScheduleSecondPassPhantomCallbacks(
     bool synchronous_second_pass) {
   if (!second_pass_callbacks_.empty()) {
     if (FLAG_optimize_for_size || FLAG_predictable || synchronous_second_pass) {
+      Heap::DevToolsTraceEventScope devtools_trace_event_scope(
+          isolate()->heap(), "MajorGC", "invoke weak phantom callbacks");
       isolate()->heap()->CallGCPrologueCallbacks(
           GCType::kGCTypeProcessWeakCallbacks, kNoGCCallbackFlags);
       InvokeSecondPassPhantomCallbacks();
@@ -1205,6 +1517,7 @@ void GlobalHandles::IterateStrongRoots(RootVisitor* v) {
                           node->location());
     }
   }
+  on_stack_nodes_->Iterate(v);
 }
 
 void GlobalHandles::IterateWeakRoots(RootVisitor* v) {
@@ -1234,6 +1547,7 @@ void GlobalHandles::IterateAllRoots(RootVisitor* v) {
       v->VisitRootPointer(Root::kGlobalHandles, nullptr, node->location());
     }
   }
+  on_stack_nodes_->Iterate(v);
 }
 
 DISABLE_CFI_PERF
@@ -1249,6 +1563,7 @@ void GlobalHandles::IterateAllYoungRoots(RootVisitor* v) {
       v->VisitRootPointer(Root::kGlobalHandles, nullptr, node->location());
     }
   }
+  on_stack_nodes_->Iterate(v);
 }
 
 DISABLE_CFI_PERF
diff --git a/deps/v8/src/handles/global-handles.h b/deps/v8/src/handles/global-handles.h
index 37b42a54b7aa79..e2e733d8f2261a 100644
--- a/deps/v8/src/handles/global-handles.h
+++ b/deps/v8/src/handles/global-handles.h
@@ -87,6 +87,7 @@ class V8_EXPORT_PRIVATE GlobalHandles final {
   static void SetFinalizationCallbackForTraced(
       Address* location, void* parameter,
       WeakCallbackInfo<void>::Callback callback);
+  static void MarkTraced(Address* location);
 
   explicit GlobalHandles(Isolate* isolate);
   ~GlobalHandles();
@@ -103,6 +104,8 @@ class V8_EXPORT_PRIVATE GlobalHandles final {
     return Handle<T>::cast(Create(Object(value)));
   }
 
+  Handle<Object> CreateTraced(Object value, Address* slot, bool has_destructor,
+                              bool is_on_stack);
   Handle<Object> CreateTraced(Object value, Address* slot, bool has_destructor);
   Handle<Object> CreateTraced(Address value, Address* slot,
                               bool has_destructor);
@@ -181,6 +184,11 @@ class V8_EXPORT_PRIVATE GlobalHandles final {
     return old;
   }
 
+  void SetStackStart(void* stack_start);
+  void NotifyEmptyEmbedderStack();
+  void CleanupOnStackReferencesBelowCurrentStackPosition();
+  size_t NumberOfOnStackHandlesForTesting();
+
 #ifdef DEBUG
   void PrintStats();
   void Print();
@@ -195,6 +203,9 @@ class V8_EXPORT_PRIVATE GlobalHandles final {
   class NodeSpace;
   class PendingPhantomCallback;
   class TracedNode;
+  class OnStackTracedNodeSpace;
+
+  static GlobalHandles* From(const TracedNode*);
 
   bool InRecursiveGC(unsigned gc_processing_counter);
 
@@ -223,6 +234,7 @@ class V8_EXPORT_PRIVATE GlobalHandles final {
 
   std::unique_ptr<NodeSpace<TracedNode>> traced_nodes_;
   std::vector<TracedNode*> traced_young_nodes_;
+  std::unique_ptr<OnStackTracedNodeSpace> on_stack_nodes_;
 
   // Field always containing the number of handles to global objects.
   size_t handles_count_ = 0;
diff --git a/deps/v8/src/handles/handles-inl.h b/deps/v8/src/handles/handles-inl.h
index 5adb5fcdc64e1a..0f53edf5d6f250 100644
--- a/deps/v8/src/handles/handles-inl.h
+++ b/deps/v8/src/handles/handles-inl.h
@@ -38,6 +38,31 @@ V8_INLINE Handle<T> handle(T object, Isolate* isolate) {
   return Handle<T>(object, isolate);
 }
 
+// Convenience overloads for cases where we want to either create a Handle or an
+// OffThreadHandle, depending on whether we have a Factory or an
+// OffThreadFactory.
+template <typename T>
+V8_INLINE Handle<T> handle(T object, Factory* factory) {
+  return factory->MakeHandle<T>(object);
+}
+template <typename T>
+V8_INLINE OffThreadHandle<T> handle(T object, OffThreadFactory* factory) {
+  // Convienently, we don't actually need the factory to create this handle.
+  return OffThreadHandle<T>(object);
+}
+
+// Similar convenience overloads for when we already have a Handle, but want
+// either a Handle or an OffThreadHandle.
+template <typename T>
+V8_INLINE Handle<T> handle(Handle<T> handle, Factory* factory) {
+  return handle;
+}
+template <typename T>
+V8_INLINE OffThreadHandle<T> handle(Handle<T> handle,
+                                    OffThreadFactory* factory) {
+  return OffThreadHandle<T>(*handle);
+}
+
 template <typename T>
 inline std::ostream& operator<<(std::ostream& os, Handle<T> handle) {
   return os << Brief(*handle);
diff --git a/deps/v8/src/handles/handles.h b/deps/v8/src/handles/handles.h
index 2fea55d1a0de10..0c724ad2d9d8fb 100644
--- a/deps/v8/src/handles/handles.h
+++ b/deps/v8/src/handles/handles.h
@@ -12,6 +12,7 @@
 #include "src/base/macros.h"
 #include "src/common/checks.h"
 #include "src/common/globals.h"
+#include "src/handles/factory-handles.h"
 #include "src/zone/zone.h"
 
 namespace v8 {
@@ -126,6 +127,7 @@ class Handle final : public HandleBase {
   // Ex. Handle<JSFunction> can be passed when Handle<Object> is expected.
   template <typename S, typename = typename std::enable_if<
                             std::is_convertible<S*, T*>::value>::type>
+  // NOLINTNEXTLINE
   V8_INLINE Handle(Handle<S> handle) : HandleBase(handle) {}
 
   V8_INLINE ObjectRef operator->() const { return ObjectRef{**this}; }
@@ -173,6 +175,119 @@ class Handle final : public HandleBase {
 template <typename T>
 inline std::ostream& operator<<(std::ostream& os, Handle<T> handle);
 
+// ----------------------------------------------------------------------------
+// A fake Handle that simply wraps an object reference. This is used for
+// off-thread Objects, where we want a class that behaves like Handle for the
+// purposes of operator->, casting, etc., but isn't a GC root and doesn't
+// require access to the Isolate.
+template <typename T>
+class OffThreadHandle {
+ public:
+  OffThreadHandle() = default;
+
+  template <typename U>
+  explicit OffThreadHandle(U obj) : obj_(obj) {}
+
+  // Constructor for handling automatic up casting. We rely on the compiler
+  // making sure that the assignment to obj_ is legitimate.
+  template <typename U>
+  // NOLINTNEXTLINE
+  OffThreadHandle<T>(OffThreadHandle<U> other) : obj_(*other) {}
+
+  T operator*() const { return obj_; }
+  T* operator->() { return &obj_; }
+  const T* operator->() const { return &obj_; }
+
+  template <typename U>
+  static OffThreadHandle<T> cast(OffThreadHandle<U> other) {
+    return OffThreadHandle<T>(T::cast(*other));
+  }
+
+  bool is_null() const {
+    // TODO(leszeks): This will only work for HeapObjects, figure out a way to
+    // make is_null work for Object and Smi too.
+    return obj_.is_null();
+  }
+
+  bool ToHandle(OffThreadHandle<T>* out) {
+    if (is_null()) return false;
+
+    *out = *this;
+    return true;
+  }
+  OffThreadHandle<T> ToHandleChecked() {
+    DCHECK(!is_null());
+    return *this;
+  }
+
+ private:
+  T obj_;
+};
+
+// A helper class which wraps an normal or off-thread handle, and returns one
+// or the other depending on the factory type.
+template <typename T>
+class HandleOrOffThreadHandle {
+ public:
+  HandleOrOffThreadHandle() = default;
+
+  template <typename U>
+  HandleOrOffThreadHandle(Handle<U> handle)  // NOLINT
+      : value_(bit_cast<Address>(static_cast<Handle<T>>(handle).location())) {
+#ifdef DEBUG
+    which_ = kHandle;
+#endif
+  }
+
+  template <typename U>
+  HandleOrOffThreadHandle(OffThreadHandle<U> handle)  // NOLINT
+      : value_(static_cast<OffThreadHandle<T>>(handle)->ptr()) {
+#ifdef DEBUG
+    which_ = kOffThreadHandle;
+#endif
+  }
+
+  // To minimize the impact of these handles on main-thread callers, we allow
+  // them to implicitly convert to Handles.
+  template <typename U>
+  operator Handle<U>() {
+    return get<class Factory>();
+  }
+
+  template <typename FactoryType>
+  inline FactoryHandle<FactoryType, T> get() {
+    return get_for(Tag<FactoryType>());
+  }
+
+  inline bool is_null() const { return value_ == 0; }
+
+#ifdef DEBUG
+  inline bool is_initialized() { return which_ != kUninitialized; }
+#endif
+
+ private:
+  // Tagged overloads because we can't specialize the above getter
+  // without also specializing the class.
+  template <typename FactoryType>
+  struct Tag {};
+
+  V8_INLINE Handle<T> get_for(Tag<class Factory>) {
+    DCHECK_NE(which_, kOffThreadHandle);
+    return Handle<T>(reinterpret_cast<Address*>(value_));
+  }
+  V8_INLINE OffThreadHandle<T> get_for(Tag<class OffThreadFactory>) {
+    DCHECK_NE(which_, kHandle);
+    return OffThreadHandle<T>(T::unchecked_cast(Object(value_)));
+  }
+
+  // Either handle.location() or off_thread_handle->ptr().
+  Address value_;
+
+#ifdef DEBUG
+  enum { kUninitialized, kHandle, kOffThreadHandle } which_;
+#endif
+};
+
 // ----------------------------------------------------------------------------
 // A stack-allocated class that governs a number of local handles.
 // After a handle scope has been created, all local handles will be
diff --git a/deps/v8/src/heap/OWNERS b/deps/v8/src/heap/OWNERS
index d826296e0c9472..c5ceee075f99f7 100644
--- a/deps/v8/src/heap/OWNERS
+++ b/deps/v8/src/heap/OWNERS
@@ -1,6 +1,6 @@
+dinfuehr@chromium.org
 hpayer@chromium.org
 mlippautz@chromium.org
-mstarzinger@chromium.org
 ulan@chromium.org
 
 # COMPONENT: Blink>JavaScript>GC
diff --git a/deps/v8/src/heap/array-buffer-sweeper.cc b/deps/v8/src/heap/array-buffer-sweeper.cc
new file mode 100644
index 00000000000000..d11b08932cfbd1
--- /dev/null
+++ b/deps/v8/src/heap/array-buffer-sweeper.cc
@@ -0,0 +1,262 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/array-buffer-sweeper.h"
+#include "src/heap/gc-tracer.h"
+#include "src/heap/heap-inl.h"
+#include "src/objects/js-array-buffer.h"
+#include "src/tasks/cancelable-task.h"
+#include "src/tasks/task-utils.h"
+
+namespace v8 {
+namespace internal {
+
+void ArrayBufferList::Append(ArrayBufferExtension* extension) {
+  if (head_ == nullptr) {
+    DCHECK_NULL(tail_);
+    head_ = tail_ = extension;
+  } else {
+    tail_->set_next(extension);
+    tail_ = extension;
+  }
+
+  extension->set_next(nullptr);
+}
+
+void ArrayBufferList::Append(ArrayBufferList* list) {
+  if (head_ == nullptr) {
+    DCHECK_NULL(tail_);
+    head_ = list->head_;
+    tail_ = list->tail_;
+  } else if (list->head_) {
+    DCHECK_NOT_NULL(list->tail_);
+    tail_->set_next(list->head_);
+    tail_ = list->tail_;
+  } else {
+    DCHECK_NULL(list->tail_);
+  }
+
+  list->Reset();
+}
+
+bool ArrayBufferList::Contains(ArrayBufferExtension* extension) {
+  ArrayBufferExtension* current = head_;
+
+  while (current) {
+    if (current == extension) return true;
+    current = current->next();
+  }
+
+  return false;
+}
+
+void ArrayBufferSweeper::EnsureFinished() {
+  if (!sweeping_in_progress_) return;
+
+  TryAbortResult abort_result =
+      heap_->isolate()->cancelable_task_manager()->TryAbort(job_.id);
+
+  switch (abort_result) {
+    case TryAbortResult::kTaskAborted: {
+      job_.Sweep();
+      Merge();
+      break;
+    }
+
+    case TryAbortResult::kTaskRemoved: {
+      CHECK_NE(job_.state, SweepingState::Uninitialized);
+      if (job_.state == SweepingState::Prepared) job_.Sweep();
+      Merge();
+      break;
+    }
+
+    case TryAbortResult::kTaskRunning: {
+      base::MutexGuard guard(&sweeping_mutex_);
+      CHECK_NE(job_.state, SweepingState::Uninitialized);
+      // Wait until task is finished with its work.
+      while (job_.state != SweepingState::Swept) {
+        job_finished_.Wait(&sweeping_mutex_);
+      }
+      Merge();
+      break;
+    }
+
+    default:
+      UNREACHABLE();
+  }
+
+  sweeping_in_progress_ = false;
+}
+
+void ArrayBufferSweeper::RequestSweepYoung() {
+  RequestSweep(SweepingScope::Young);
+}
+
+void ArrayBufferSweeper::RequestSweepFull() {
+  RequestSweep(SweepingScope::Full);
+}
+
+void ArrayBufferSweeper::RequestSweep(SweepingScope scope) {
+  DCHECK(!sweeping_in_progress_);
+
+  if (young_.IsEmpty() && (old_.IsEmpty() || scope == SweepingScope::Young))
+    return;
+
+  if (!heap_->IsTearingDown() && !heap_->ShouldReduceMemory() &&
+      FLAG_concurrent_array_buffer_sweeping) {
+    Prepare(scope);
+
+    auto task = MakeCancelableTask(heap_->isolate(), [this] {
+      TRACE_BACKGROUND_GC(
+          heap_->tracer(),
+          GCTracer::BackgroundScope::BACKGROUND_ARRAY_BUFFER_SWEEP);
+      base::MutexGuard guard(&sweeping_mutex_);
+      job_.Sweep();
+      job_finished_.NotifyAll();
+    });
+    job_.id = task->id();
+    V8::GetCurrentPlatform()->CallOnWorkerThread(std::move(task));
+    sweeping_in_progress_ = true;
+  } else {
+    Prepare(scope);
+    job_.Sweep();
+    Merge();
+  }
+}
+
+void ArrayBufferSweeper::Prepare(SweepingScope scope) {
+  CHECK_EQ(job_.state, SweepingState::Uninitialized);
+
+  if (scope == SweepingScope::Young) {
+    job_ =
+        SweepingJob::Prepare(young_, ArrayBufferList(), SweepingScope::Young);
+    young_.Reset();
+  } else {
+    CHECK_EQ(scope, SweepingScope::Full);
+    job_ = SweepingJob::Prepare(young_, old_, SweepingScope::Full);
+    young_.Reset();
+    old_.Reset();
+  }
+}
+
+void ArrayBufferSweeper::Merge() {
+  CHECK_EQ(job_.state, SweepingState::Swept);
+  young_.Append(&job_.young);
+  old_.Append(&job_.old);
+  job_.state = SweepingState::Uninitialized;
+}
+
+void ArrayBufferSweeper::ReleaseAll() {
+  EnsureFinished();
+  ReleaseAll(&old_);
+  ReleaseAll(&young_);
+}
+
+void ArrayBufferSweeper::ReleaseAll(ArrayBufferList* list) {
+  ArrayBufferExtension* current = list->head_;
+
+  while (current) {
+    ArrayBufferExtension* next = current->next();
+    delete current;
+    current = next;
+  }
+
+  list->Reset();
+}
+
+void ArrayBufferSweeper::Append(JSArrayBuffer object,
+                                ArrayBufferExtension* extension) {
+  if (Heap::InYoungGeneration(object)) {
+    young_.Append(extension);
+  } else {
+    old_.Append(extension);
+  }
+}
+
+ArrayBufferSweeper::SweepingJob::SweepingJob()
+    : state(SweepingState::Uninitialized) {}
+
+ArrayBufferSweeper::SweepingJob ArrayBufferSweeper::SweepingJob::Prepare(
+    ArrayBufferList young, ArrayBufferList old, SweepingScope scope) {
+  SweepingJob job;
+  job.young = young;
+  job.old = old;
+  job.scope = scope;
+  job.id = 0;
+  job.state = SweepingState::Prepared;
+  return job;
+}
+
+void ArrayBufferSweeper::SweepingJob::Sweep() {
+  CHECK_EQ(state, SweepingState::Prepared);
+
+  if (scope == SweepingScope::Young) {
+    SweepYoung();
+  } else {
+    CHECK_EQ(scope, SweepingScope::Full);
+    SweepFull();
+  }
+  state = SweepingState::Swept;
+}
+
+void ArrayBufferSweeper::SweepingJob::SweepFull() {
+  CHECK_EQ(scope, SweepingScope::Full);
+  ArrayBufferList promoted = SweepListFull(&young);
+  ArrayBufferList survived = SweepListFull(&old);
+
+  old = promoted;
+  old.Append(&survived);
+}
+
+ArrayBufferList ArrayBufferSweeper::SweepingJob::SweepListFull(
+    ArrayBufferList* list) {
+  ArrayBufferExtension* current = list->head_;
+  ArrayBufferList survived;
+
+  while (current) {
+    ArrayBufferExtension* next = current->next();
+
+    if (!current->IsMarked()) {
+      delete current;
+    } else {
+      current->Unmark();
+      survived.Append(current);
+    }
+
+    current = next;
+  }
+
+  list->Reset();
+  return survived;
+}
+
+void ArrayBufferSweeper::SweepingJob::SweepYoung() {
+  CHECK_EQ(scope, SweepingScope::Young);
+  ArrayBufferExtension* current = young.head_;
+
+  ArrayBufferList new_young;
+  ArrayBufferList new_old;
+
+  while (current) {
+    ArrayBufferExtension* next = current->next();
+
+    if (!current->IsYoungMarked()) {
+      delete current;
+    } else if (current->IsYoungPromoted()) {
+      current->YoungUnmark();
+      new_old.Append(current);
+    } else {
+      current->YoungUnmark();
+      new_young.Append(current);
+    }
+
+    current = next;
+  }
+
+  old = new_old;
+  young = new_young;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/array-buffer-sweeper.h b/deps/v8/src/heap/array-buffer-sweeper.h
new file mode 100644
index 00000000000000..a2605a43d2e7df
--- /dev/null
+++ b/deps/v8/src/heap/array-buffer-sweeper.h
@@ -0,0 +1,102 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_ARRAY_BUFFER_SWEEPER_H_
+#define V8_HEAP_ARRAY_BUFFER_SWEEPER_H_
+
+#include "src/base/platform/mutex.h"
+#include "src/objects/js-array-buffer.h"
+#include "src/tasks/cancelable-task.h"
+
+namespace v8 {
+namespace internal {
+
+class ArrayBufferExtension;
+class Heap;
+
+// Singly linked-list of ArrayBufferExtensions that stores head and tail of the
+// list to allow for concatenation of lists.
+struct ArrayBufferList {
+  ArrayBufferList() : head_(nullptr), tail_(nullptr) {}
+
+  ArrayBufferExtension* head_;
+  ArrayBufferExtension* tail_;
+
+  bool IsEmpty() {
+    DCHECK_IMPLIES(head_, tail_);
+    return head_ == nullptr;
+  }
+
+  void Reset() { head_ = tail_ = nullptr; }
+
+  void Append(ArrayBufferExtension* extension);
+  void Append(ArrayBufferList* list);
+
+  V8_EXPORT_PRIVATE bool Contains(ArrayBufferExtension* extension);
+};
+
+// The ArrayBufferSweeper iterates and deletes ArrayBufferExtensions
+// concurrently to the application.
+class ArrayBufferSweeper {
+ public:
+  explicit ArrayBufferSweeper(Heap* heap)
+      : heap_(heap), sweeping_in_progress_(false) {}
+  ~ArrayBufferSweeper() { ReleaseAll(); }
+
+  void EnsureFinished();
+  void RequestSweepYoung();
+  void RequestSweepFull();
+
+  void Append(JSArrayBuffer object, ArrayBufferExtension* extension);
+
+  ArrayBufferList young() { return young_; }
+  ArrayBufferList old() { return old_; }
+
+ private:
+  enum class SweepingScope { Young, Full };
+
+  enum class SweepingState { Uninitialized, Prepared, Swept };
+
+  struct SweepingJob {
+    CancelableTaskManager::Id id;
+    SweepingState state;
+    ArrayBufferList young;
+    ArrayBufferList old;
+    SweepingScope scope;
+
+    SweepingJob();
+
+    void Sweep();
+    void SweepYoung();
+    void SweepFull();
+    ArrayBufferList SweepListFull(ArrayBufferList* list);
+    static SweepingJob Prepare(ArrayBufferList young, ArrayBufferList old,
+                               SweepingScope scope);
+  } job_;
+
+  void Merge();
+
+  void RequestSweep(SweepingScope sweeping_task);
+  void Prepare(SweepingScope sweeping_task);
+
+  ArrayBufferList SweepListFull(ArrayBufferList* list);
+  ArrayBufferList SweepYoungGen();
+  void SweepOldGen(ArrayBufferExtension* extension);
+
+  void ReleaseAll();
+  void ReleaseAll(ArrayBufferList* extension);
+
+  Heap* const heap_;
+  bool sweeping_in_progress_;
+  base::Mutex sweeping_mutex_;
+  base::ConditionVariable job_finished_;
+
+  ArrayBufferList young_;
+  ArrayBufferList old_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_ARRAY_BUFFER_SWEEPER_H_
diff --git a/deps/v8/src/heap/array-buffer-tracker-inl.h b/deps/v8/src/heap/array-buffer-tracker-inl.h
index 21106cee4b11a2..63d4147d411f17 100644
--- a/deps/v8/src/heap/array-buffer-tracker-inl.h
+++ b/deps/v8/src/heap/array-buffer-tracker-inl.h
@@ -32,6 +32,8 @@ void ArrayBufferTracker::RegisterNew(
     Heap* heap, JSArrayBuffer buffer,
     std::shared_ptr<BackingStore> backing_store) {
   if (!backing_store) return;
+  // If {buffer_start} is {nullptr}, we don't have to track and free it.
+  if (!backing_store->buffer_start()) return;
 
   // ArrayBuffer tracking works only for small objects.
   DCHECK(!heap->IsLargeObject(buffer));
diff --git a/deps/v8/src/heap/basic-memory-chunk.cc b/deps/v8/src/heap/basic-memory-chunk.cc
index 307f0ec973fcd8..fa94f60f4ec7da 100644
--- a/deps/v8/src/heap/basic-memory-chunk.cc
+++ b/deps/v8/src/heap/basic-memory-chunk.cc
@@ -27,23 +27,12 @@ STATIC_ASSERT(BasicMemoryChunk::kHeapOffset ==
 
 BasicMemoryChunk::BasicMemoryChunk(size_t size, Address area_start,
                                    Address area_end) {
-  const Address base = reinterpret_cast<Address>(this);
   size_ = size;
   marking_bitmap_ = static_cast<Bitmap*>(calloc(1, Bitmap::kSize));
-  header_sentinel_ = HeapObject::FromAddress(base).ptr();
-  DCHECK(HasHeaderSentinel(area_start));
   area_start_ = area_start;
   area_end_ = area_end;
 }
 
-// static
-bool BasicMemoryChunk::HasHeaderSentinel(Address slot_addr) {
-  Address base = BaseAddress(slot_addr);
-  if (slot_addr < base + kHeaderSize) return false;
-  return HeapObject::FromAddress(base) ==
-         ObjectSlot(base + kHeaderSentinelOffset).Relaxed_Load();
-}
-
 void BasicMemoryChunk::ReleaseMarkingBitmap() {
   DCHECK_NOT_NULL(marking_bitmap_);
   free(marking_bitmap_);
diff --git a/deps/v8/src/heap/basic-memory-chunk.h b/deps/v8/src/heap/basic-memory-chunk.h
index c0d4ade522b00d..205d02ce24761d 100644
--- a/deps/v8/src/heap/basic-memory-chunk.h
+++ b/deps/v8/src/heap/basic-memory-chunk.h
@@ -112,6 +112,8 @@ class BasicMemoryChunk {
   size_t size() const { return size_; }
   void set_size(size_t size) { size_ = size; }
 
+  size_t buckets() const { return SlotSet::BucketsForSize(size()); }
+
   Address area_start() const { return area_start_; }
 
   Address area_end() const { return area_end_; }
@@ -167,18 +169,13 @@ class BasicMemoryChunk {
     return addr >= area_start() && addr <= area_end();
   }
 
-  V8_EXPORT_PRIVATE static bool HasHeaderSentinel(Address slot_addr);
-
   void ReleaseMarkingBitmap();
 
   static const intptr_t kSizeOffset = 0;
   static const intptr_t kFlagsOffset = kSizeOffset + kSizetSize;
   static const intptr_t kMarkBitmapOffset = kFlagsOffset + kUIntptrSize;
   static const intptr_t kHeapOffset = kMarkBitmapOffset + kSystemPointerSize;
-  static const intptr_t kHeaderSentinelOffset =
-      kHeapOffset + kSystemPointerSize;
-  static const intptr_t kAreaStartOffset =
-      kHeaderSentinelOffset + kSystemPointerSize;
+  static const intptr_t kAreaStartOffset = kHeapOffset + kSystemPointerSize;
   static const intptr_t kAreaEndOffset = kAreaStartOffset + kSystemPointerSize;
   static const intptr_t kOldToNewSlotSetOffset =
       kAreaEndOffset + kSystemPointerSize;
@@ -188,7 +185,6 @@ class BasicMemoryChunk {
       + kUIntptrSize            // uintptr_t flags_
       + kSystemPointerSize      // Bitmap* marking_bitmap_
       + kSystemPointerSize      // Heap* heap_
-      + kSystemPointerSize      // Address header_sentinel_
       + kSystemPointerSize      // Address area_start_
       + kSystemPointerSize      // Address area_end_
       + kSystemPointerSize * NUMBER_OF_REMEMBERED_SET_TYPES;  // SlotSet* array
@@ -207,12 +203,6 @@ class BasicMemoryChunk {
   // layout under C++11.
   Heap* heap_;
 
-  // This is used to distinguish the memory chunk header from the interior of a
-  // large page. The memory chunk header stores here an impossible tagged
-  // pointer: the tagger pointer of the page start. A field in a large object is
-  // guaranteed to not contain such a pointer.
-  Address header_sentinel_;
-
   // Start and end of allocatable memory on this chunk.
   Address area_start_;
   Address area_end_;
@@ -237,8 +227,6 @@ class BasicMemoryChunkValidator {
                 offsetof(BasicMemoryChunk, marking_bitmap_));
   STATIC_ASSERT(BasicMemoryChunk::kHeapOffset ==
                 offsetof(BasicMemoryChunk, heap_));
-  STATIC_ASSERT(BasicMemoryChunk::kHeaderSentinelOffset ==
-                offsetof(BasicMemoryChunk, header_sentinel_));
   STATIC_ASSERT(BasicMemoryChunk::kOldToNewSlotSetOffset ==
                 offsetof(BasicMemoryChunk, slot_set_));
 };
diff --git a/deps/v8/src/heap/code-stats.cc b/deps/v8/src/heap/code-stats.cc
index c6c111bc0ebb18..058e48397eeea6 100644
--- a/deps/v8/src/heap/code-stats.cc
+++ b/deps/v8/src/heap/code-stats.cc
@@ -61,17 +61,17 @@ void CodeStatistics::ResetCodeAndMetadataStatistics(Isolate* isolate) {
 // - by code comment (only in debug mode)
 void CodeStatistics::CollectCodeStatistics(PagedSpace* space,
                                            Isolate* isolate) {
-  PagedSpaceObjectIterator obj_it(space);
+  PagedSpaceObjectIterator obj_it(isolate->heap(), space);
   for (HeapObject obj = obj_it.Next(); !obj.is_null(); obj = obj_it.Next()) {
     RecordCodeAndMetadataStatistics(obj, isolate);
   }
 }
 
-// Collects code size statistics in LargeObjectSpace:
+// Collects code size statistics in OldLargeObjectSpace:
 // - code and metadata size
 // - by code kind (only in debug mode)
 // - by code comment (only in debug mode)
-void CodeStatistics::CollectCodeStatistics(LargeObjectSpace* space,
+void CodeStatistics::CollectCodeStatistics(OldLargeObjectSpace* space,
                                            Isolate* isolate) {
   LargeObjectSpaceObjectIterator obj_it(space);
   for (HeapObject obj = obj_it.Next(); !obj.is_null(); obj = obj_it.Next()) {
diff --git a/deps/v8/src/heap/code-stats.h b/deps/v8/src/heap/code-stats.h
index cc28640f2a9396..9178752936610d 100644
--- a/deps/v8/src/heap/code-stats.h
+++ b/deps/v8/src/heap/code-stats.h
@@ -11,7 +11,7 @@ namespace internal {
 class CodeCommentsIterator;
 class HeapObject;
 class Isolate;
-class LargeObjectSpace;
+class OldLargeObjectSpace;
 class PagedSpace;
 
 class CodeStatistics {
@@ -20,7 +20,8 @@ class CodeStatistics {
   static void CollectCodeStatistics(PagedSpace* space, Isolate* isolate);
 
   // Collect statistics related to code size from large object space.
-  static void CollectCodeStatistics(LargeObjectSpace* space, Isolate* isolate);
+  static void CollectCodeStatistics(OldLargeObjectSpace* space,
+                                    Isolate* isolate);
 
   // Reset code size related statistics
   static void ResetCodeAndMetadataStatistics(Isolate* isolate);
diff --git a/deps/v8/src/heap/combined-heap.h b/deps/v8/src/heap/combined-heap.h
index eaa012ec18034d..d7e58dfb87caa8 100644
--- a/deps/v8/src/heap/combined-heap.h
+++ b/deps/v8/src/heap/combined-heap.h
@@ -7,6 +7,7 @@
 
 #include "src/heap/heap.h"
 #include "src/heap/read-only-heap.h"
+#include "src/heap/third-party/heap-api.h"
 #include "src/objects/objects.h"
 
 namespace v8 {
@@ -30,7 +31,10 @@ class V8_EXPORT_PRIVATE CombinedHeapObjectIterator final {
 
 V8_WARN_UNUSED_RESULT inline bool IsValidHeapObject(Heap* heap,
                                                     HeapObject object) {
-  return ReadOnlyHeap::Contains(object) || heap->Contains(object);
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL)
+    return third_party_heap::Heap::IsValidHeapObject(object);
+  else
+    return ReadOnlyHeap::Contains(object) || heap->Contains(object);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/concurrent-marking.cc b/deps/v8/src/heap/concurrent-marking.cc
index 6a155c78ea8afc..9bed2471948d63 100644
--- a/deps/v8/src/heap/concurrent-marking.cc
+++ b/deps/v8/src/heap/concurrent-marking.cc
@@ -14,7 +14,11 @@
 #include "src/heap/heap.h"
 #include "src/heap/mark-compact-inl.h"
 #include "src/heap/mark-compact.h"
+#include "src/heap/marking-visitor-inl.h"
+#include "src/heap/marking-visitor.h"
 #include "src/heap/marking.h"
+#include "src/heap/memory-measurement-inl.h"
+#include "src/heap/memory-measurement.h"
 #include "src/heap/objects-visiting-inl.h"
 #include "src/heap/objects-visiting.h"
 #include "src/heap/worklist.h"
@@ -74,137 +78,30 @@ class SlotSnapshot {
 };
 
 class ConcurrentMarkingVisitor final
-    : public HeapVisitor<int, ConcurrentMarkingVisitor> {
+    : public MarkingVisitorBase<ConcurrentMarkingVisitor,
+                                ConcurrentMarkingState> {
  public:
-  using BaseClass = HeapVisitor<int, ConcurrentMarkingVisitor>;
-
-  explicit ConcurrentMarkingVisitor(
-      ConcurrentMarking::MarkingWorklist* shared,
-      MemoryChunkDataMap* memory_chunk_data, WeakObjects* weak_objects,
-      ConcurrentMarking::EmbedderTracingWorklist* embedder_objects, int task_id,
-      bool embedder_tracing_enabled, unsigned mark_compact_epoch,
-      bool is_forced_gc)
-      : shared_(shared, task_id),
-        weak_objects_(weak_objects),
-        embedder_objects_(embedder_objects, task_id),
+  ConcurrentMarkingVisitor(int task_id, MarkingWorklists* marking_worklists,
+                           WeakObjects* weak_objects, Heap* heap,
+                           unsigned mark_compact_epoch,
+                           BytecodeFlushMode bytecode_flush_mode,
+                           bool embedder_tracing_enabled, bool is_forced_gc,
+                           MemoryChunkDataMap* memory_chunk_data)
+      : MarkingVisitorBase(task_id, marking_worklists, weak_objects, heap,
+                           mark_compact_epoch, bytecode_flush_mode,
+                           embedder_tracing_enabled, is_forced_gc),
         marking_state_(memory_chunk_data),
-        memory_chunk_data_(memory_chunk_data),
-        task_id_(task_id),
-        embedder_tracing_enabled_(embedder_tracing_enabled),
-        mark_compact_epoch_(mark_compact_epoch),
-        is_forced_gc_(is_forced_gc) {
-    // It is not safe to access flags from concurrent marking visitor. So
-    // set the bytecode flush mode based on the flags here
-    bytecode_flush_mode_ = Heap::GetBytecodeFlushMode();
-  }
+        memory_chunk_data_(memory_chunk_data) {}
 
   template <typename T>
   static V8_INLINE T Cast(HeapObject object) {
     return T::cast(object);
   }
 
-  bool ShouldVisit(HeapObject object) {
-    return marking_state_.GreyToBlack(object);
-  }
+  // HeapVisitor overrides to implement the snapshotting protocol.
 
   bool AllowDefaultJSObjectVisit() { return false; }
 
-  template <typename THeapObjectSlot>
-  void ProcessStrongHeapObject(HeapObject host, THeapObjectSlot slot,
-                               HeapObject heap_object) {
-    MarkObject(heap_object);
-    MarkCompactCollector::RecordSlot(host, slot, heap_object);
-  }
-
-  template <typename THeapObjectSlot>
-  void ProcessWeakHeapObject(HeapObject host, THeapObjectSlot slot,
-                             HeapObject heap_object) {
-#ifdef THREAD_SANITIZER
-    MemoryChunk::FromHeapObject(heap_object)->SynchronizedHeapLoad();
-#endif
-    if (marking_state_.IsBlackOrGrey(heap_object)) {
-      // Weak references with live values are directly processed here to
-      // reduce the processing time of weak cells during the main GC
-      // pause.
-      MarkCompactCollector::RecordSlot(host, slot, heap_object);
-    } else {
-      // If we do not know about liveness of the value, we have to process
-      // the reference when we know the liveness of the whole transitive
-      // closure.
-      weak_objects_->weak_references.Push(task_id_, std::make_pair(host, slot));
-    }
-  }
-
-  void VisitPointers(HeapObject host, ObjectSlot start,
-                     ObjectSlot end) override {
-    VisitPointersImpl(host, start, end);
-  }
-
-  void VisitPointers(HeapObject host, MaybeObjectSlot start,
-                     MaybeObjectSlot end) override {
-    VisitPointersImpl(host, start, end);
-  }
-
-  template <typename TSlot>
-  V8_INLINE void VisitPointersImpl(HeapObject host, TSlot start, TSlot end) {
-    using THeapObjectSlot = typename TSlot::THeapObjectSlot;
-    for (TSlot slot = start; slot < end; ++slot) {
-      typename TSlot::TObject object = slot.Relaxed_Load();
-      HeapObject heap_object;
-      if (object.GetHeapObjectIfStrong(&heap_object)) {
-        // If the reference changes concurrently from strong to weak, the write
-        // barrier will treat the weak reference as strong, so we won't miss the
-        // weak reference.
-        ProcessStrongHeapObject(host, THeapObjectSlot(slot), heap_object);
-      } else if (TSlot::kCanBeWeak &&
-                 object.GetHeapObjectIfWeak(&heap_object)) {
-        ProcessWeakHeapObject(host, THeapObjectSlot(slot), heap_object);
-      }
-    }
-  }
-
-  // Weak list pointers should be ignored during marking. The lists are
-  // reconstructed after GC.
-  void VisitCustomWeakPointers(HeapObject host, ObjectSlot start,
-                               ObjectSlot end) final {}
-
-  void VisitEmbeddedPointer(Code host, RelocInfo* rinfo) final {
-    DCHECK(RelocInfo::IsEmbeddedObjectMode(rinfo->rmode()));
-    HeapObject object = rinfo->target_object();
-    RecordRelocSlot(host, rinfo, object);
-    if (!marking_state_.IsBlackOrGrey(object)) {
-      if (host.IsWeakObject(object)) {
-        weak_objects_->weak_objects_in_code.Push(task_id_,
-                                                 std::make_pair(object, host));
-      } else {
-        MarkObject(object);
-      }
-    }
-  }
-
-  void VisitCodeTarget(Code host, RelocInfo* rinfo) final {
-    DCHECK(RelocInfo::IsCodeTargetMode(rinfo->rmode()));
-    Code target = Code::GetCodeFromTargetAddress(rinfo->target_address());
-    RecordRelocSlot(host, rinfo, target);
-    MarkObject(target);
-  }
-
-  void VisitPointersInSnapshot(HeapObject host, const SlotSnapshot& snapshot) {
-    for (int i = 0; i < snapshot.number_of_slots(); i++) {
-      ObjectSlot slot = snapshot.slot(i);
-      Object object = snapshot.value(i);
-      DCHECK(!HasWeakHeapObjectTag(object));
-      if (!object.IsHeapObject()) continue;
-      HeapObject heap_object = HeapObject::cast(object);
-      MarkObject(heap_object);
-      MarkCompactCollector::RecordSlot(host, slot, heap_object);
-    }
-  }
-
-  // ===========================================================================
-  // JS object =================================================================
-  // ===========================================================================
-
   int VisitJSObject(Map map, JSObject object) {
     return VisitJSObjectSubclass(map, object);
   }
@@ -217,78 +114,10 @@ class ConcurrentMarkingVisitor final
     return VisitJSObjectSubclass(map, object);
   }
 
-  int VisitJSWeakRef(Map map, JSWeakRef weak_ref) {
-    int size = VisitJSObjectSubclass(map, weak_ref);
-    if (size == 0) {
-      return 0;
-    }
-    if (weak_ref.target().IsHeapObject()) {
-      HeapObject target = HeapObject::cast(weak_ref.target());
-#ifdef THREAD_SANITIZER
-      MemoryChunk::FromHeapObject(target)->SynchronizedHeapLoad();
-#endif
-      if (marking_state_.IsBlackOrGrey(target)) {
-        // Record the slot inside the JSWeakRef, since the
-        // VisitJSObjectSubclass above didn't visit it.
-        ObjectSlot slot = weak_ref.RawField(JSWeakRef::kTargetOffset);
-        MarkCompactCollector::RecordSlot(weak_ref, slot, target);
-      } else {
-        // JSWeakRef points to a potentially dead object. We have to process
-        // them when we know the liveness of the whole transitive closure.
-        weak_objects_->js_weak_refs.Push(task_id_, weak_ref);
-      }
-    }
-    return size;
-  }
-
-  int VisitWeakCell(Map map, WeakCell weak_cell) {
-    if (!ShouldVisit(weak_cell)) return 0;
-
-    int size = WeakCell::BodyDescriptor::SizeOf(map, weak_cell);
-    VisitMapPointer(weak_cell);
-    WeakCell::BodyDescriptor::IterateBody(map, weak_cell, size, this);
-    if (weak_cell.target().IsHeapObject()) {
-      HeapObject target = HeapObject::cast(weak_cell.target());
-#ifdef THREAD_SANITIZER
-      MemoryChunk::FromHeapObject(target)->SynchronizedHeapLoad();
-#endif
-      if (marking_state_.IsBlackOrGrey(target)) {
-        // Record the slot inside the WeakCell, since the IterateBody above
-        // didn't visit it.
-        ObjectSlot slot = weak_cell.RawField(WeakCell::kTargetOffset);
-        MarkCompactCollector::RecordSlot(weak_cell, slot, target);
-      } else {
-        // WeakCell points to a potentially dead object. We have to process
-        // them when we know the liveness of the whole transitive closure.
-        weak_objects_->weak_cells.Push(task_id_, weak_cell);
-      }
-    }
-    return size;
-  }
-
-  // Some JS objects can carry back links to embedders that contain information
-  // relevant to the garbage collectors.
-
-  int VisitJSApiObject(Map map, JSObject object) {
-    return VisitEmbedderTracingSubclass(map, object);
-  }
-
-  int VisitJSArrayBuffer(Map map, JSArrayBuffer object) {
-    return VisitEmbedderTracingSubclass(map, object);
-  }
-
-  int VisitJSDataView(Map map, JSDataView object) {
-    return VisitEmbedderTracingSubclass(map, object);
-  }
-
-  int VisitJSTypedArray(Map map, JSTypedArray object) {
-    return VisitEmbedderTracingSubclass(map, object);
+  int VisitJSWeakCollection(Map map, JSWeakCollection object) {
+    return VisitJSObjectSubclass(map, object);
   }
 
-  // ===========================================================================
-  // Strings with pointers =====================================================
-  // ===========================================================================
-
   int VisitConsString(Map map, ConsString object) {
     return VisitFullyWithSnapshot(map, object);
   }
@@ -301,10 +130,6 @@ class ConcurrentMarkingVisitor final
     return VisitFullyWithSnapshot(map, object);
   }
 
-  // ===========================================================================
-  // Strings without pointers ==================================================
-  // ===========================================================================
-
   int VisitSeqOneByteString(Map map, SeqOneByteString object) {
     if (!ShouldVisit(object)) return 0;
     VisitMapPointer(object);
@@ -317,237 +142,24 @@ class ConcurrentMarkingVisitor final
     return SeqTwoByteString::SizeFor(object.synchronized_length());
   }
 
-  // ===========================================================================
-  // Fixed array object ========================================================
-  // ===========================================================================
-
-  int VisitFixedArrayWithProgressBar(Map map, FixedArray object,
-                                     MemoryChunk* chunk) {
-    // The concurrent marker can process larger chunks than the main thread
-    // marker.
-    const int kProgressBarScanningChunk =
-        RoundUp(kMaxRegularHeapObjectSize, kTaggedSize);
-    DCHECK(marking_state_.IsBlackOrGrey(object));
-    marking_state_.GreyToBlack(object);
-    int size = FixedArray::BodyDescriptor::SizeOf(map, object);
-    size_t current_progress_bar = chunk->ProgressBar();
-    int start = static_cast<int>(current_progress_bar);
-    if (start == 0) start = FixedArray::BodyDescriptor::kStartOffset;
-    int end = Min(size, start + kProgressBarScanningChunk);
-    if (start < end) {
-      VisitPointers(object, object.RawField(start), object.RawField(end));
-      bool success = chunk->TrySetProgressBar(current_progress_bar, end);
-      CHECK(success);
-      if (end < size) {
-        // The object can be pushed back onto the marking worklist only after
-        // progress bar was updated.
-        shared_.Push(object);
-      }
-    }
-    return end - start;
-  }
-
-  int VisitFixedArray(Map map, FixedArray object) {
-    // Arrays with the progress bar are not left-trimmable because they reside
-    // in the large object space.
-    MemoryChunk* chunk = MemoryChunk::FromHeapObject(object);
-    return chunk->IsFlagSet<AccessMode::ATOMIC>(MemoryChunk::HAS_PROGRESS_BAR)
-               ? VisitFixedArrayWithProgressBar(map, object, chunk)
-               : VisitLeftTrimmableArray(map, object);
-  }
-
-  int VisitFixedDoubleArray(Map map, FixedDoubleArray object) {
-    return VisitLeftTrimmableArray(map, object);
-  }
-
-  // ===========================================================================
-  // Side-effectful visitation.
-  // ===========================================================================
-
-  int VisitSharedFunctionInfo(Map map, SharedFunctionInfo shared_info) {
-    if (!ShouldVisit(shared_info)) return 0;
-
-    int size = SharedFunctionInfo::BodyDescriptor::SizeOf(map, shared_info);
-    VisitMapPointer(shared_info);
-    SharedFunctionInfo::BodyDescriptor::IterateBody(map, shared_info, size,
-                                                    this);
-
-    // If the SharedFunctionInfo has old bytecode, mark it as flushable,
-    // otherwise visit the function data field strongly.
-    if (shared_info.ShouldFlushBytecode(bytecode_flush_mode_)) {
-      weak_objects_->bytecode_flushing_candidates.Push(task_id_, shared_info);
-    } else {
-      VisitPointer(shared_info, shared_info.RawField(
-                                    SharedFunctionInfo::kFunctionDataOffset));
-    }
-    return size;
-  }
-
-  int VisitBytecodeArray(Map map, BytecodeArray object) {
-    if (!ShouldVisit(object)) return 0;
-    int size = BytecodeArray::BodyDescriptor::SizeOf(map, object);
-    VisitMapPointer(object);
-    BytecodeArray::BodyDescriptor::IterateBody(map, object, size, this);
-    if (!is_forced_gc_) {
-      object.MakeOlder();
-    }
-    return size;
-  }
-
-  int VisitJSFunction(Map map, JSFunction object) {
-    int size = VisitJSObjectSubclass(map, object);
-
-    // Check if the JSFunction needs reset due to bytecode being flushed.
-    if (bytecode_flush_mode_ != BytecodeFlushMode::kDoNotFlushBytecode &&
-        object.NeedsResetDueToFlushedBytecode()) {
-      weak_objects_->flushed_js_functions.Push(task_id_, object);
-    }
-
-    return size;
-  }
-
-  int VisitMap(Map meta_map, Map map) {
-    if (!ShouldVisit(map)) return 0;
-    int size = Map::BodyDescriptor::SizeOf(meta_map, map);
-    if (map.CanTransition()) {
-      // Maps that can transition share their descriptor arrays and require
-      // special visiting logic to avoid memory leaks.
-      // Since descriptor arrays are potentially shared, ensure that only the
-      // descriptors that belong to this map are marked. The first time a
-      // non-empty descriptor array is marked, its header is also visited. The
-      // slot holding the descriptor array will be implicitly recorded when the
-      // pointer fields of this map are visited.
-      DescriptorArray descriptors = map.synchronized_instance_descriptors();
-      MarkDescriptorArrayBlack(descriptors);
-      int number_of_own_descriptors = map.NumberOfOwnDescriptors();
-      if (number_of_own_descriptors) {
-        // It is possible that the concurrent marker observes the
-        // number_of_own_descriptors out of sync with the descriptors. In that
-        // case the marking write barrier for the descriptor array will ensure
-        // that all required descriptors are marked. The concurrent marker
-        // just should avoid crashing in that case. That's why we need the
-        // std::min<int>() below.
-        VisitDescriptors(descriptors,
-                         std::min<int>(number_of_own_descriptors,
-                                       descriptors.number_of_descriptors()));
-      }
-      // Mark the pointer fields of the Map. Since the transitions array has
-      // been marked already, it is fine that one of these fields contains a
-      // pointer to it.
-    }
-    Map::BodyDescriptor::IterateBody(meta_map, map, size, this);
-    return size;
-  }
-
-  void VisitDescriptors(DescriptorArray descriptor_array,
-                        int number_of_own_descriptors) {
-    int16_t new_marked = static_cast<int16_t>(number_of_own_descriptors);
-    int16_t old_marked = descriptor_array.UpdateNumberOfMarkedDescriptors(
-        mark_compact_epoch_, new_marked);
-    if (old_marked < new_marked) {
-      VisitPointers(
-          descriptor_array,
-          MaybeObjectSlot(descriptor_array.GetDescriptorSlot(old_marked)),
-          MaybeObjectSlot(descriptor_array.GetDescriptorSlot(new_marked)));
-    }
-  }
-
-  int VisitDescriptorArray(Map map, DescriptorArray array) {
-    if (!ShouldVisit(array)) return 0;
-    VisitMapPointer(array);
-    int size = DescriptorArray::BodyDescriptor::SizeOf(map, array);
-    VisitPointers(array, array.GetFirstPointerSlot(),
-                  array.GetDescriptorSlot(0));
-    VisitDescriptors(array, array.number_of_descriptors());
-    return size;
-  }
-
-  int VisitTransitionArray(Map map, TransitionArray array) {
-    if (!ShouldVisit(array)) return 0;
-    VisitMapPointer(array);
-    int size = TransitionArray::BodyDescriptor::SizeOf(map, array);
-    TransitionArray::BodyDescriptor::IterateBody(map, array, size, this);
-    weak_objects_->transition_arrays.Push(task_id_, array);
-    return size;
-  }
-
-  int VisitJSWeakCollection(Map map, JSWeakCollection object) {
-    return VisitJSObjectSubclass(map, object);
-  }
-
-  int VisitEphemeronHashTable(Map map, EphemeronHashTable table) {
-    if (!ShouldVisit(table)) return 0;
-    weak_objects_->ephemeron_hash_tables.Push(task_id_, table);
-
-    for (int i = 0; i < table.Capacity(); i++) {
-      ObjectSlot key_slot =
-          table.RawFieldOfElementAt(EphemeronHashTable::EntryToIndex(i));
-      HeapObject key = HeapObject::cast(table.KeyAt(i));
-#ifdef THREAD_SANITIZER
-      MemoryChunk::FromHeapObject(key)->SynchronizedHeapLoad();
-#endif
-      MarkCompactCollector::RecordSlot(table, key_slot, key);
-
-      ObjectSlot value_slot =
-          table.RawFieldOfElementAt(EphemeronHashTable::EntryToValueIndex(i));
-
-      if (marking_state_.IsBlackOrGrey(key)) {
-        VisitPointer(table, value_slot);
-
-      } else {
-        Object value_obj = table.ValueAt(i);
-
-        if (value_obj.IsHeapObject()) {
-          HeapObject value = HeapObject::cast(value_obj);
-#ifdef THREAD_SANITIZER
-          MemoryChunk::FromHeapObject(value)->SynchronizedHeapLoad();
-#endif
-          MarkCompactCollector::RecordSlot(table, value_slot, value);
-
-          // Revisit ephemerons with both key and value unreachable at end
-          // of concurrent marking cycle.
-          if (marking_state_.IsWhite(value)) {
-            weak_objects_->discovered_ephemerons.Push(task_id_,
-                                                      Ephemeron{key, value});
-          }
-        }
-      }
-    }
-
-    return table.SizeFromMap(map);
-  }
-
   // Implements ephemeron semantics: Marks value if key is already reachable.
   // Returns true if value was actually marked.
   bool ProcessEphemeron(HeapObject key, HeapObject value) {
     if (marking_state_.IsBlackOrGrey(key)) {
       if (marking_state_.WhiteToGrey(value)) {
-        shared_.Push(value);
+        marking_worklists_->Push(value);
         return true;
       }
 
     } else if (marking_state_.IsWhite(value)) {
       weak_objects_->next_ephemerons.Push(task_id_, Ephemeron{key, value});
     }
-
     return false;
   }
 
-  void MarkObject(HeapObject object) {
-#ifdef THREAD_SANITIZER
-    MemoryChunk::FromHeapObject(object)->SynchronizedHeapLoad();
-#endif
-    if (marking_state_.WhiteToGrey(object)) {
-      shared_.Push(object);
-    }
-  }
-
-  void MarkDescriptorArrayBlack(DescriptorArray descriptors) {
-    marking_state_.WhiteToGrey(descriptors);
-    if (marking_state_.GreyToBlack(descriptors)) {
-      VisitPointers(descriptors, descriptors.GetFirstPointerSlot(),
-                    descriptors.GetDescriptorSlot(0));
-    }
+  // HeapVisitor override.
+  bool ShouldVisit(HeapObject object) {
+    return marking_state_.GreyToBlack(object);
   }
 
  private:
@@ -607,23 +219,11 @@ class ConcurrentMarkingVisitor final
     int size = TBodyDescriptor::SizeOf(map, object);
     int used_size = map.UsedInstanceSize();
     DCHECK_LE(used_size, size);
-    DCHECK_GE(used_size, T::kHeaderSize);
+    DCHECK_GE(used_size, JSObject::GetHeaderSize(map));
     return VisitPartiallyWithSnapshot<T, TBodyDescriptor>(map, object,
                                                           used_size, size);
   }
 
-  template <typename T>
-  int VisitEmbedderTracingSubclass(Map map, T object) {
-    DCHECK(object.IsApiWrapper());
-    int size = VisitJSObjectSubclass(map, object);
-    if (size && embedder_tracing_enabled_) {
-      // Success: The object needs to be processed for embedder references on
-      // the main thread.
-      embedder_objects_.Push(object);
-    }
-    return size;
-  }
-
   template <typename T>
   int VisitLeftTrimmableArray(Map map, T object) {
     // The synchronized_length() function checks that the length is a Smi.
@@ -639,6 +239,18 @@ class ConcurrentMarkingVisitor final
     return size;
   }
 
+  void VisitPointersInSnapshot(HeapObject host, const SlotSnapshot& snapshot) {
+    for (int i = 0; i < snapshot.number_of_slots(); i++) {
+      ObjectSlot slot = snapshot.slot(i);
+      Object object = snapshot.value(i);
+      DCHECK(!HasWeakHeapObjectTag(object));
+      if (!object.IsHeapObject()) continue;
+      HeapObject heap_object = HeapObject::cast(object);
+      MarkObject(host, heap_object);
+      RecordSlot(host, slot, heap_object);
+    }
+  }
+
   template <typename T>
   int VisitFullyWithSnapshot(Map map, T object) {
     using TBodyDescriptor = typename T::BodyDescriptor;
@@ -664,6 +276,11 @@ class ConcurrentMarkingVisitor final
     return slot_snapshot_;
   }
 
+  template <typename TSlot>
+  void RecordSlot(HeapObject object, TSlot slot, HeapObject target) {
+    MarkCompactCollector::RecordSlot(object, slot, target);
+  }
+
   void RecordRelocSlot(Code host, RelocInfo* rinfo, HeapObject target) {
     MarkCompactCollector::RecordRelocSlotInfo info =
         MarkCompactCollector::PrepareRecordRelocSlot(host, rinfo, target);
@@ -676,17 +293,26 @@ class ConcurrentMarkingVisitor final
     }
   }
 
-  ConcurrentMarking::MarkingWorklist::View shared_;
-  WeakObjects* weak_objects_;
-  ConcurrentMarking::EmbedderTracingWorklist::View embedder_objects_;
+  void SynchronizePageAccess(HeapObject heap_object) {
+#ifdef THREAD_SANITIZER
+    // This is needed because TSAN does not process the memory fence
+    // emitted after page initialization.
+    MemoryChunk::FromHeapObject(heap_object)->SynchronizedHeapLoad();
+#endif
+  }
+
+  ConcurrentMarkingState* marking_state() { return &marking_state_; }
+
+  TraceRetainingPathMode retaining_path_mode() {
+    return TraceRetainingPathMode::kDisabled;
+  }
+
   ConcurrentMarkingState marking_state_;
   MemoryChunkDataMap* memory_chunk_data_;
-  int task_id_;
   SlotSnapshot slot_snapshot_;
-  bool embedder_tracing_enabled_;
-  const unsigned mark_compact_epoch_;
-  bool is_forced_gc_;
-  BytecodeFlushMode bytecode_flush_mode_;
+
+  friend class MarkingVisitorBase<ConcurrentMarkingVisitor,
+                                  ConcurrentMarkingState>;
 };
 
 // Strings can change maps due to conversion to thin string or external strings.
@@ -745,15 +371,12 @@ class ConcurrentMarking::Task : public CancelableTask {
   DISALLOW_COPY_AND_ASSIGN(Task);
 };
 
-ConcurrentMarking::ConcurrentMarking(Heap* heap, MarkingWorklist* shared,
-                                     MarkingWorklist* on_hold,
-                                     WeakObjects* weak_objects,
-                                     EmbedderTracingWorklist* embedder_objects)
+ConcurrentMarking::ConcurrentMarking(
+    Heap* heap, MarkingWorklistsHolder* marking_worklists_holder,
+    WeakObjects* weak_objects)
     : heap_(heap),
-      shared_(shared),
-      on_hold_(on_hold),
-      weak_objects_(weak_objects),
-      embedder_objects_(embedder_objects) {
+      marking_worklists_holder_(marking_worklists_holder),
+      weak_objects_(weak_objects) {
 // The runtime flag should be set only if the compile time flag was set.
 #ifndef V8_CONCURRENT_MARKING
   CHECK(!FLAG_concurrent_marking && !FLAG_parallel_marking);
@@ -765,15 +388,21 @@ void ConcurrentMarking::Run(int task_id, TaskState* task_state) {
                       GCTracer::BackgroundScope::MC_BACKGROUND_MARKING);
   size_t kBytesUntilInterruptCheck = 64 * KB;
   int kObjectsUntilInterrupCheck = 1000;
+  MarkingWorklists marking_worklists(task_id, marking_worklists_holder_);
   ConcurrentMarkingVisitor visitor(
-      shared_, &task_state->memory_chunk_data, weak_objects_, embedder_objects_,
-      task_id, heap_->local_embedder_heap_tracer()->InUse(),
-      task_state->mark_compact_epoch, task_state->is_forced_gc);
+      task_id, &marking_worklists, weak_objects_, heap_,
+      task_state->mark_compact_epoch, Heap::GetBytecodeFlushMode(),
+      heap_->local_embedder_heap_tracer()->InUse(), task_state->is_forced_gc,
+      &task_state->memory_chunk_data);
+  NativeContextInferrer& native_context_inferrer =
+      task_state->native_context_inferrer;
+  NativeContextStats& native_context_stats = task_state->native_context_stats;
   double time_ms;
   size_t marked_bytes = 0;
+  Isolate* isolate = heap_->isolate();
   if (FLAG_trace_concurrent_marking) {
-    heap_->isolate()->PrintWithTimestamp(
-        "Starting concurrent marking task %d\n", task_id);
+    isolate->PrintWithTimestamp("Starting concurrent marking task %d\n",
+                                task_id);
   }
   bool ephemeron_marked = false;
 
@@ -789,7 +418,7 @@ void ConcurrentMarking::Run(int task_id, TaskState* task_state) {
         }
       }
     }
-
+    bool is_per_context_mode = marking_worklists.IsPerContextMode();
     bool done = false;
     while (!done) {
       size_t current_marked_bytes = 0;
@@ -797,7 +426,7 @@ void ConcurrentMarking::Run(int task_id, TaskState* task_state) {
       while (current_marked_bytes < kBytesUntilInterruptCheck &&
              objects_processed < kObjectsUntilInterrupCheck) {
         HeapObject object;
-        if (!shared_->Pop(task_id, &object)) {
+        if (!marking_worklists.Pop(&object)) {
           done = true;
           break;
         }
@@ -809,10 +438,21 @@ void ConcurrentMarking::Run(int task_id, TaskState* task_state) {
         Address addr = object.address();
         if ((new_space_top <= addr && addr < new_space_limit) ||
             addr == new_large_object) {
-          on_hold_->Push(task_id, object);
+          marking_worklists.PushOnHold(object);
         } else {
-          Map map = object.synchronized_map();
-          current_marked_bytes += visitor.Visit(map, object);
+          Map map = object.synchronized_map(isolate);
+          if (is_per_context_mode) {
+            Address context;
+            if (native_context_inferrer.Infer(isolate, map, object, &context)) {
+              marking_worklists.SwitchToContext(context);
+            }
+          }
+          size_t visited_size = visitor.Visit(map, object);
+          if (is_per_context_mode) {
+            native_context_stats.IncrementSize(marking_worklists.Context(), map,
+                                               object, visited_size);
+          }
+          current_marked_bytes += visited_size;
         }
       }
       marked_bytes += current_marked_bytes;
@@ -835,10 +475,7 @@ void ConcurrentMarking::Run(int task_id, TaskState* task_state) {
       }
     }
 
-    shared_->FlushToGlobal(task_id);
-    on_hold_->FlushToGlobal(task_id);
-    embedder_objects_->FlushToGlobal(task_id);
-
+    marking_worklists.FlushToGlobal();
     weak_objects_->transition_arrays.FlushToGlobal(task_id);
     weak_objects_->ephemeron_hash_tables.FlushToGlobal(task_id);
     weak_objects_->current_ephemerons.FlushToGlobal(task_id);
@@ -926,7 +563,7 @@ void ConcurrentMarking::RescheduleTasksIfNeeded() {
       return;
     }
   }
-  if (!shared_->IsGlobalPoolEmpty() ||
+  if (!marking_worklists_holder_->shared()->IsGlobalPoolEmpty() ||
       !weak_objects_->current_ephemerons.IsGlobalPoolEmpty() ||
       !weak_objects_->discovered_ephemerons.IsGlobalPoolEmpty()) {
     ScheduleTasks();
@@ -970,6 +607,13 @@ bool ConcurrentMarking::IsStopped() {
   return pending_task_count_ == 0;
 }
 
+void ConcurrentMarking::FlushNativeContexts(NativeContextStats* main_stats) {
+  for (int i = 1; i <= total_task_count_; i++) {
+    main_stats->Merge(task_state_[i].native_context_stats);
+    task_state_[i].native_context_stats.Clear();
+  }
+}
+
 void ConcurrentMarking::FlushMemoryChunkData(
     MajorNonAtomicMarkingState* marking_state) {
   DCHECK_EQ(pending_task_count_, 0);
diff --git a/deps/v8/src/heap/concurrent-marking.h b/deps/v8/src/heap/concurrent-marking.h
index c08a9c47b05db0..24bcae20a67758 100644
--- a/deps/v8/src/heap/concurrent-marking.h
+++ b/deps/v8/src/heap/concurrent-marking.h
@@ -11,6 +11,9 @@
 #include "src/base/atomic-utils.h"
 #include "src/base/platform/condition-variable.h"
 #include "src/base/platform/mutex.h"
+#include "src/heap/marking-visitor.h"
+#include "src/heap/marking-worklist.h"
+#include "src/heap/memory-measurement.h"
 #include "src/heap/slot-set.h"
 #include "src/heap/spaces.h"
 #include "src/heap/worklist.h"
@@ -65,12 +68,10 @@ class V8_EXPORT_PRIVATE ConcurrentMarking {
   // Worklist::kMaxNumTasks being maxed at 8 (concurrent marking doesn't use
   // task 0, reserved for the main thread).
   static constexpr int kMaxTasks = 7;
-  using MarkingWorklist = Worklist<HeapObject, 64 /* segment size */>;
-  using EmbedderTracingWorklist = Worklist<HeapObject, 16 /* segment size */>;
 
-  ConcurrentMarking(Heap* heap, MarkingWorklist* shared,
-                    MarkingWorklist* on_hold, WeakObjects* weak_objects,
-                    EmbedderTracingWorklist* embedder_objects);
+  ConcurrentMarking(Heap* heap,
+                    MarkingWorklistsHolder* marking_worklists_holder,
+                    WeakObjects* weak_objects);
 
   // Schedules asynchronous tasks to perform concurrent marking. Objects in the
   // heap should not be moved while these are active (can be stopped safely via
@@ -82,6 +83,8 @@ class V8_EXPORT_PRIVATE ConcurrentMarking {
   bool Stop(StopRequest stop_request);
 
   void RescheduleTasksIfNeeded();
+  // Flushes native context sizes to the given table of the main thread.
+  void FlushNativeContexts(NativeContextStats* main_stats);
   // Flushes memory chunk data using the given marking state.
   void FlushMemoryChunkData(MajorNonAtomicMarkingState* marking_state);
   // This function is called for a new space page that was cleared after
@@ -103,19 +106,19 @@ class V8_EXPORT_PRIVATE ConcurrentMarking {
     // The main thread sets this flag to true when it wants the concurrent
     // marker to give up the worker thread.
     std::atomic<bool> preemption_request;
-    MemoryChunkDataMap memory_chunk_data;
     size_t marked_bytes = 0;
     unsigned mark_compact_epoch;
     bool is_forced_gc;
+    MemoryChunkDataMap memory_chunk_data;
+    NativeContextInferrer native_context_inferrer;
+    NativeContextStats native_context_stats;
     char cache_line_padding[64];
   };
   class Task;
   void Run(int task_id, TaskState* task_state);
   Heap* const heap_;
-  MarkingWorklist* const shared_;
-  MarkingWorklist* const on_hold_;
+  MarkingWorklistsHolder* const marking_worklists_holder_;
   WeakObjects* const weak_objects_;
-  EmbedderTracingWorklist* const embedder_objects_;
   TaskState task_state_[kMaxTasks + 1];
   std::atomic<size_t> total_marked_bytes_{0};
   std::atomic<bool> ephemeron_marked_{false};
diff --git a/deps/v8/src/heap/embedder-tracing.cc b/deps/v8/src/heap/embedder-tracing.cc
index ab91367bc606a9..e3317b1379ab81 100644
--- a/deps/v8/src/heap/embedder-tracing.cc
+++ b/deps/v8/src/heap/embedder-tracing.cc
@@ -69,6 +69,9 @@ void LocalEmbedderHeapTracer::SetEmbedderStackStateForNextFinalization(
   if (!InUse()) return;
 
   embedder_stack_state_ = stack_state;
+  if (EmbedderHeapTracer::EmbedderStackState::kEmpty == stack_state) {
+    remote_tracer()->NotifyEmptyEmbedderStack();
+  }
 }
 
 LocalEmbedderHeapTracer::ProcessingScope::ProcessingScope(
@@ -112,7 +115,7 @@ void LocalEmbedderHeapTracer::ProcessingScope::AddWrapperInfoForTesting(
 }
 
 void LocalEmbedderHeapTracer::StartIncrementalMarkingIfNeeded() {
-  if (!FLAG_global_gc_scheduling) return;
+  if (!FLAG_global_gc_scheduling || !FLAG_incremental_marking) return;
 
   Heap* heap = isolate_->heap();
   heap->StartIncrementalMarkingIfAllocationLimitIsReached(
diff --git a/deps/v8/src/heap/embedder-tracing.h b/deps/v8/src/heap/embedder-tracing.h
index a150f2c26a3e39..05932ea141af61 100644
--- a/deps/v8/src/heap/embedder-tracing.h
+++ b/deps/v8/src/heap/embedder-tracing.h
@@ -145,6 +145,10 @@ class V8_EXPORT_PRIVATE EmbedderStackStateScope final {
       : local_tracer_(local_tracer),
         old_stack_state_(local_tracer_->embedder_stack_state_) {
     local_tracer_->embedder_stack_state_ = stack_state;
+    if (EmbedderHeapTracer::EmbedderStackState::kEmpty == stack_state) {
+      if (local_tracer->remote_tracer())
+        local_tracer->remote_tracer()->NotifyEmptyEmbedderStack();
+    }
   }
 
   ~EmbedderStackStateScope() {
diff --git a/deps/v8/src/heap/factory-base.cc b/deps/v8/src/heap/factory-base.cc
new file mode 100644
index 00000000000000..bdd1ccf2e223ad
--- /dev/null
+++ b/deps/v8/src/heap/factory-base.cc
@@ -0,0 +1,247 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/factory-base.h"
+
+#include "src/ast/ast.h"
+#include "src/handles/handles-inl.h"
+#include "src/heap/factory.h"
+#include "src/heap/off-thread-factory.h"
+#include "src/objects/string-inl.h"
+#include "src/utils/memcopy.h"
+
+namespace v8 {
+namespace internal {
+
+template <typename Impl>
+FactoryHandle<Impl, SeqOneByteString>
+FactoryBase<Impl>::NewOneByteInternalizedString(
+    const Vector<const uint8_t>& str, uint32_t hash_field) {
+  FactoryHandle<Impl, SeqOneByteString> result =
+      AllocateRawOneByteInternalizedString(str.length(), hash_field);
+  DisallowHeapAllocation no_gc;
+  MemCopy(result->GetChars(no_gc), str.begin(), str.length());
+  return result;
+}
+
+template <typename Impl>
+FactoryHandle<Impl, SeqTwoByteString>
+FactoryBase<Impl>::NewTwoByteInternalizedString(const Vector<const uc16>& str,
+                                                uint32_t hash_field) {
+  FactoryHandle<Impl, SeqTwoByteString> result =
+      AllocateRawTwoByteInternalizedString(str.length(), hash_field);
+  DisallowHeapAllocation no_gc;
+  MemCopy(result->GetChars(no_gc), str.begin(), str.length() * kUC16Size);
+  return result;
+}
+
+template <typename Impl>
+FactoryMaybeHandle<Impl, SeqOneByteString>
+FactoryBase<Impl>::NewRawOneByteString(int length, AllocationType allocation) {
+  if (length > String::kMaxLength || length < 0) {
+    return impl()->template Throw<SeqOneByteString>(
+        impl()->NewInvalidStringLengthError());
+  }
+  DCHECK_GT(length, 0);  // Use Factory::empty_string() instead.
+  int size = SeqOneByteString::SizeFor(length);
+  DCHECK_GE(SeqOneByteString::kMaxSize, size);
+
+  HeapObject result = AllocateRawWithImmortalMap(
+      size, allocation, read_only_roots().one_byte_string_map());
+  FactoryHandle<Impl, SeqOneByteString> string =
+      handle(SeqOneByteString::cast(result), impl());
+  string->set_length(length);
+  string->set_hash_field(String::kEmptyHashField);
+  DCHECK_EQ(size, string->Size());
+  return string;
+}
+
+template <typename Impl>
+FactoryMaybeHandle<Impl, SeqTwoByteString>
+FactoryBase<Impl>::NewRawTwoByteString(int length, AllocationType allocation) {
+  if (length > String::kMaxLength || length < 0) {
+    return impl()->template Throw<SeqTwoByteString>(
+        impl()->NewInvalidStringLengthError());
+  }
+  DCHECK_GT(length, 0);  // Use Factory::empty_string() instead.
+  int size = SeqTwoByteString::SizeFor(length);
+  DCHECK_GE(SeqTwoByteString::kMaxSize, size);
+
+  HeapObject result = AllocateRawWithImmortalMap(
+      size, allocation, read_only_roots().string_map());
+  FactoryHandle<Impl, SeqTwoByteString> string =
+      handle(SeqTwoByteString::cast(result), impl());
+  string->set_length(length);
+  string->set_hash_field(String::kEmptyHashField);
+  DCHECK_EQ(size, string->Size());
+  return string;
+}
+
+template <typename Impl>
+FactoryMaybeHandle<Impl, String> FactoryBase<Impl>::NewConsString(
+    FactoryHandle<Impl, String> left, FactoryHandle<Impl, String> right,
+    AllocationType allocation) {
+  if (left->IsThinString()) {
+    left = handle(ThinString::cast(*left).actual(), impl());
+  }
+  if (right->IsThinString()) {
+    right = handle(ThinString::cast(*right).actual(), impl());
+  }
+  int left_length = left->length();
+  if (left_length == 0) return right;
+  int right_length = right->length();
+  if (right_length == 0) return left;
+
+  int length = left_length + right_length;
+
+  if (length == 2) {
+    uint16_t c1 = left->Get(0);
+    uint16_t c2 = right->Get(0);
+    return impl()->MakeOrFindTwoCharacterString(c1, c2);
+  }
+
+  // Make sure that an out of memory exception is thrown if the length
+  // of the new cons string is too large.
+  if (length > String::kMaxLength || length < 0) {
+    return impl()->template Throw<String>(
+        impl()->NewInvalidStringLengthError());
+  }
+
+  bool left_is_one_byte = left->IsOneByteRepresentation();
+  bool right_is_one_byte = right->IsOneByteRepresentation();
+  bool is_one_byte = left_is_one_byte && right_is_one_byte;
+
+  // If the resulting string is small make a flat string.
+  if (length < ConsString::kMinLength) {
+    // Note that neither of the two inputs can be a slice because:
+    STATIC_ASSERT(ConsString::kMinLength <= SlicedString::kMinLength);
+    DCHECK(left->IsFlat());
+    DCHECK(right->IsFlat());
+
+    STATIC_ASSERT(ConsString::kMinLength <= String::kMaxLength);
+    if (is_one_byte) {
+      FactoryHandle<Impl, SeqOneByteString> result =
+          NewRawOneByteString(length, allocation).ToHandleChecked();
+      DisallowHeapAllocation no_gc;
+      uint8_t* dest = result->GetChars(no_gc);
+      // Copy left part.
+      const uint8_t* src = left->template GetChars<uint8_t>(no_gc);
+      CopyChars(dest, src, left_length);
+      // Copy right part.
+      src = right->template GetChars<uint8_t>(no_gc);
+      CopyChars(dest + left_length, src, right_length);
+      return result;
+    }
+
+    FactoryHandle<Impl, SeqTwoByteString> result =
+        NewRawTwoByteString(length, allocation).ToHandleChecked();
+
+    DisallowHeapAllocation pointer_stays_valid;
+    uc16* sink = result->GetChars(pointer_stays_valid);
+    String::WriteToFlat(*left, sink, 0, left->length());
+    String::WriteToFlat(*right, sink + left->length(), 0, right->length());
+    return result;
+  }
+
+  return NewConsString(left, right, length, is_one_byte, allocation);
+}
+
+template <typename Impl>
+FactoryHandle<Impl, String> FactoryBase<Impl>::NewConsString(
+    FactoryHandle<Impl, String> left, FactoryHandle<Impl, String> right,
+    int length, bool one_byte, AllocationType allocation) {
+  DCHECK(!left->IsThinString());
+  DCHECK(!right->IsThinString());
+  DCHECK_GE(length, ConsString::kMinLength);
+  DCHECK_LE(length, String::kMaxLength);
+
+  FactoryHandle<Impl, ConsString> result = handle(
+      ConsString::cast(
+          one_byte
+              ? NewWithImmortalMap(read_only_roots().cons_one_byte_string_map(),
+                                   allocation)
+              : NewWithImmortalMap(read_only_roots().cons_string_map(),
+                                   allocation)),
+      impl());
+
+  DisallowHeapAllocation no_gc;
+  WriteBarrierMode mode = result->GetWriteBarrierMode(no_gc);
+
+  result->set_hash_field(String::kEmptyHashField);
+  result->set_length(length);
+  result->set_first(*left, mode);
+  result->set_second(*right, mode);
+  return result;
+}
+
+template <typename Impl>
+FactoryHandle<Impl, SeqOneByteString>
+FactoryBase<Impl>::AllocateRawOneByteInternalizedString(int length,
+                                                        uint32_t hash_field) {
+  CHECK_GE(String::kMaxLength, length);
+  // The canonical empty_string is the only zero-length string we allow.
+  DCHECK_IMPLIES(length == 0, !impl()->EmptyStringRootIsInitialized());
+
+  Map map = read_only_roots().one_byte_internalized_string_map();
+  int size = SeqOneByteString::SizeFor(length);
+  HeapObject result = AllocateRawWithImmortalMap(
+      size,
+      impl()->CanAllocateInReadOnlySpace() ? AllocationType::kReadOnly
+                                           : AllocationType::kOld,
+      map);
+  FactoryHandle<Impl, SeqOneByteString> answer =
+      handle(SeqOneByteString::cast(result), impl());
+  answer->set_length(length);
+  answer->set_hash_field(hash_field);
+  DCHECK_EQ(size, answer->Size());
+  return answer;
+}
+
+template <typename Impl>
+FactoryHandle<Impl, SeqTwoByteString>
+FactoryBase<Impl>::AllocateRawTwoByteInternalizedString(int length,
+                                                        uint32_t hash_field) {
+  CHECK_GE(String::kMaxLength, length);
+  DCHECK_NE(0, length);  // Use Heap::empty_string() instead.
+
+  Map map = read_only_roots().internalized_string_map();
+  int size = SeqTwoByteString::SizeFor(length);
+  HeapObject result =
+      AllocateRawWithImmortalMap(size, AllocationType::kOld, map);
+  FactoryHandle<Impl, SeqTwoByteString> answer =
+      handle(SeqTwoByteString::cast(result), impl());
+  answer->set_length(length);
+  answer->set_hash_field(hash_field);
+  DCHECK_EQ(size, result.Size());
+  return answer;
+}
+
+template <typename Impl>
+HeapObject FactoryBase<Impl>::NewWithImmortalMap(Map map,
+                                                 AllocationType allocation) {
+  return AllocateRawWithImmortalMap(map.instance_size(), allocation, map);
+}
+
+template <typename Impl>
+HeapObject FactoryBase<Impl>::AllocateRawWithImmortalMap(
+    int size, AllocationType allocation, Map map,
+    AllocationAlignment alignment) {
+  HeapObject result = AllocateRaw(size, allocation, alignment);
+  result.set_map_after_allocation(map, SKIP_WRITE_BARRIER);
+  return result;
+}
+
+template <typename Impl>
+HeapObject FactoryBase<Impl>::AllocateRaw(int size, AllocationType allocation,
+                                          AllocationAlignment alignment) {
+  return impl()->AllocateRaw(size, allocation, alignment);
+}
+
+// Instantiate FactoryBase for the two variants we want.
+template class EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE) FactoryBase<Factory>;
+template class EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
+    FactoryBase<OffThreadFactory>;
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/factory-base.h b/deps/v8/src/heap/factory-base.h
new file mode 100644
index 00000000000000..f49d9ace663f4e
--- /dev/null
+++ b/deps/v8/src/heap/factory-base.h
@@ -0,0 +1,68 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_FACTORY_BASE_H_
+#define V8_HEAP_FACTORY_BASE_H_
+
+#include "src/common/globals.h"
+#include "src/handles/factory-handles.h"
+#include "src/roots/roots.h"
+
+namespace v8 {
+namespace internal {
+
+class HeapObject;
+class SeqOneByteString;
+class SeqTwoByteString;
+
+template <typename Impl>
+class V8_EXPORT_PRIVATE FactoryBase {
+ public:
+  FactoryHandle<Impl, SeqOneByteString> NewOneByteInternalizedString(
+      const Vector<const uint8_t>& str, uint32_t hash_field);
+  FactoryHandle<Impl, SeqTwoByteString> NewTwoByteInternalizedString(
+      const Vector<const uc16>& str, uint32_t hash_field);
+
+  FactoryHandle<Impl, SeqOneByteString> AllocateRawOneByteInternalizedString(
+      int length, uint32_t hash_field);
+  FactoryHandle<Impl, SeqTwoByteString> AllocateRawTwoByteInternalizedString(
+      int length, uint32_t hash_field);
+
+  // Allocates and partially initializes an one-byte or two-byte String. The
+  // characters of the string are uninitialized. Currently used in regexp code
+  // only, where they are pretenured.
+  V8_WARN_UNUSED_RESULT FactoryMaybeHandle<Impl, SeqOneByteString>
+  NewRawOneByteString(int length,
+                      AllocationType allocation = AllocationType::kYoung);
+  V8_WARN_UNUSED_RESULT FactoryMaybeHandle<Impl, SeqTwoByteString>
+  NewRawTwoByteString(int length,
+                      AllocationType allocation = AllocationType::kYoung);
+  // Create a new cons string object which consists of a pair of strings.
+  V8_WARN_UNUSED_RESULT FactoryMaybeHandle<Impl, String> NewConsString(
+      FactoryHandle<Impl, String> left, FactoryHandle<Impl, String> right,
+      AllocationType allocation = AllocationType::kYoung);
+
+  V8_WARN_UNUSED_RESULT FactoryHandle<Impl, String> NewConsString(
+      FactoryHandle<Impl, String> left, FactoryHandle<Impl, String> right,
+      int length, bool one_byte,
+      AllocationType allocation = AllocationType::kYoung);
+
+ protected:
+  HeapObject AllocateRawWithImmortalMap(
+      int size, AllocationType allocation, Map map,
+      AllocationAlignment alignment = kWordAligned);
+  HeapObject NewWithImmortalMap(Map map, AllocationType allocation);
+
+ private:
+  Impl* impl() { return static_cast<Impl*>(this); }
+  ReadOnlyRoots read_only_roots() { return impl()->read_only_roots(); }
+
+  HeapObject AllocateRaw(int size, AllocationType allocation,
+                         AllocationAlignment alignment = kWordAligned);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_FACTORY_BASE_H_
diff --git a/deps/v8/src/heap/factory-inl.h b/deps/v8/src/heap/factory-inl.h
index f0f61bbb2c1aeb..77d03e6d47c2af 100644
--- a/deps/v8/src/heap/factory-inl.h
+++ b/deps/v8/src/heap/factory-inl.h
@@ -50,7 +50,7 @@ Handle<Object> Factory::NewNumberFromSize(size_t value) {
     return Handle<Object>(Smi::FromIntptr(static_cast<intptr_t>(value)),
                           isolate());
   }
-  return NewNumber(static_cast<double>(value));
+  return NewHeapNumber(static_cast<double>(value));
 }
 
 Handle<Object> Factory::NewNumberFromInt64(int64_t value) {
@@ -59,7 +59,7 @@ Handle<Object> Factory::NewNumberFromInt64(int64_t value) {
       Smi::IsValid(static_cast<int32_t>(value))) {
     return Handle<Object>(Smi::FromInt(static_cast<int32_t>(value)), isolate());
   }
-  return NewNumber(static_cast<double>(value));
+  return NewHeapNumber(static_cast<double>(value));
 }
 
 template <AllocationType allocation>
@@ -101,23 +101,13 @@ Handle<Object> Factory::NewURIError() {
                   MessageTemplate::kURIMalformed);
 }
 
-Handle<String> Factory::Uint32ToString(uint32_t value, bool check_cache) {
-  Handle<String> result;
-  int32_t int32v = static_cast<int32_t>(value);
-  if (int32v >= 0 && Smi::IsValid(int32v)) {
-    result = NumberToString(Smi::FromInt(int32v), check_cache);
-  } else {
-    result = NumberToString(NewNumberFromUint(value), check_cache);
-  }
-
-  if (result->length() <= String::kMaxArrayIndexSize &&
-      result->hash_field() == String::kEmptyHashField) {
-    uint32_t field = StringHasher::MakeArrayIndexHash(value, result->length());
-    result->set_hash_field(field);
-  }
-  return result;
+template <typename T>
+inline MaybeHandle<T> Factory::Throw(Handle<Object> exception) {
+  return isolate()->Throw<T>(exception);
 }
 
+ReadOnlyRoots Factory::read_only_roots() { return ReadOnlyRoots(isolate()); }
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index 7e434ea041866f..56c61b53e6b914 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -4,12 +4,18 @@
 
 #include "src/heap/factory.h"
 
+#include <algorithm>  // For copy
+#include <memory>     // For shared_ptr<>
+#include <string>
+#include <utility>  // For move
+
 #include "src/ast/ast-source-ranges.h"
 #include "src/ast/ast.h"
 #include "src/base/bits.h"
 #include "src/builtins/accessors.h"
 #include "src/builtins/constants-table-builder.h"
 #include "src/codegen/compiler.h"
+#include "src/common/globals.h"
 #include "src/execution/isolate-inl.h"
 #include "src/execution/protectors-inl.h"
 #include "src/heap/heap-inl.h"
@@ -45,11 +51,13 @@
 #include "src/objects/microtask-inl.h"
 #include "src/objects/module-inl.h"
 #include "src/objects/promise-inl.h"
+#include "src/objects/property-descriptor-object-inl.h"
 #include "src/objects/scope-info.h"
 #include "src/objects/stack-frame-info-inl.h"
 #include "src/objects/struct-inl.h"
 #include "src/objects/template-objects-inl.h"
 #include "src/objects/transitions-inl.h"
+#include "src/roots/roots.h"
 #include "src/strings/unicode-inl.h"
 
 namespace v8 {
@@ -117,12 +125,17 @@ MaybeHandle<Code> Factory::CodeBuilder::BuildInternal(
 
     CodePageCollectionMemoryModificationScope code_allocation(heap);
     HeapObject result;
+    AllocationType allocation_type =
+        is_executable_ ? AllocationType::kCode : AllocationType::kReadOnly;
+    AllocationAlignment alignment = is_executable_
+                                        ? AllocationAlignment::kCodeAligned
+                                        : AllocationAlignment::kWordAligned;
     if (retry_allocation_or_fail) {
-      result = heap->AllocateRawWith<Heap::kRetryOrFail>(object_size,
-                                                         AllocationType::kCode);
+      result = heap->AllocateRawWith<Heap::kRetryOrFail>(
+          object_size, allocation_type, AllocationOrigin::kRuntime, alignment);
     } else {
-      result = heap->AllocateRawWith<Heap::kLightRetry>(object_size,
-                                                        AllocationType::kCode);
+      result = heap->AllocateRawWith<Heap::kLightRetry>(
+          object_size, allocation_type, AllocationOrigin::kRuntime, alignment);
       // Return an empty handle if we cannot allocate the code object.
       if (result.is_null()) return MaybeHandle<Code>();
     }
@@ -137,10 +150,13 @@ MaybeHandle<Code> Factory::CodeBuilder::BuildInternal(
 
     result.set_map_after_allocation(*factory->code_map(), SKIP_WRITE_BARRIER);
     code = handle(Code::cast(result), isolate_);
-    DCHECK(IsAligned(code->address(), kCodeAlignment));
-    DCHECK_IMPLIES(
-        !heap->memory_allocator()->code_range().is_empty(),
-        heap->memory_allocator()->code_range().contains(code->address()));
+    if (is_executable_) {
+      DCHECK(IsAligned(code->address(), kCodeAlignment));
+      DCHECK_IMPLIES(
+          !V8_ENABLE_THIRD_PARTY_HEAP_BOOL &&
+              !heap->memory_allocator()->code_range().is_empty(),
+          heap->memory_allocator()->code_range().contains(code->address()));
+    }
 
     constexpr bool kIsNotOffHeapTrampoline = false;
     const bool has_unwinding_info = code_desc_.unwinding_info != nullptr;
@@ -165,10 +181,9 @@ MaybeHandle<Code> Factory::CodeBuilder::BuildInternal(
       DCHECK(self_reference->IsOddball());
       DCHECK(Oddball::cast(*self_reference).kind() ==
              Oddball::kSelfReferenceMarker);
-      if (FLAG_embedded_builtins) {
-        auto builder = isolate_->builtins_constants_table_builder();
-        if (builder != nullptr)
-          builder->PatchSelfReference(self_reference, code);
+      if (isolate_->IsGeneratingEmbeddedBuiltins()) {
+        isolate_->builtins_constants_table_builder()->PatchSelfReference(
+            self_reference, code);
       }
       *(self_reference.location()) = code->ptr();
     }
@@ -206,14 +221,14 @@ Handle<Code> Factory::CodeBuilder::Build() {
   return BuildInternal(true).ToHandleChecked();
 }
 
-HeapObject Factory::AllocateRawWithImmortalMap(int size,
-                                               AllocationType allocation,
-                                               Map map,
-                                               AllocationAlignment alignment) {
-  HeapObject result = isolate()->heap()->AllocateRawWith<Heap::kRetryOrFail>(
+void Factory::FatalProcessOutOfHeapMemory(const char* location) {
+  isolate()->heap()->FatalProcessOutOfMemory(location);
+}
+
+HeapObject Factory::AllocateRaw(int size, AllocationType allocation,
+                                AllocationAlignment alignment) {
+  return isolate()->heap()->AllocateRawWith<Heap::kRetryOrFail>(
       size, allocation, AllocationOrigin::kRuntime, alignment);
-  result.set_map_after_allocation(map, SKIP_WRITE_BARRIER);
-  return result;
 }
 
 HeapObject Factory::AllocateRawWithAllocationSite(
@@ -299,7 +314,7 @@ Handle<HeapObject> Factory::NewFillerObject(int size, bool double_align,
 Handle<PrototypeInfo> Factory::NewPrototypeInfo() {
   Handle<PrototypeInfo> result = Handle<PrototypeInfo>::cast(
       NewStruct(PROTOTYPE_INFO_TYPE, AllocationType::kOld));
-  result->set_prototype_users(Smi::kZero);
+  result->set_prototype_users(Smi::zero());
   result->set_registry_slot(PrototypeInfo::UNREGISTERED);
   result->set_bit_field(0);
   result->set_module_namespace(*undefined_value());
@@ -475,8 +490,10 @@ Handle<FixedArray> Factory::NewFixedArrayWithHoles(int length,
 }
 
 Handle<FixedArray> Factory::NewUninitializedFixedArray(int length) {
-  DCHECK_LE(0, length);
   if (length == 0) return empty_fixed_array();
+  if (length < 0 || length > FixedArray::kMaxLength) {
+    isolate()->heap()->FatalProcessOutOfMemory("invalid array length");
+  }
 
   // TODO(ulan): As an experiment this temporarily returns an initialized fixed
   // array. After getting canary/performance coverage, either remove the
@@ -492,7 +509,7 @@ Handle<ClosureFeedbackCellArray> Factory::NewClosureFeedbackCellArray(
   Handle<ClosureFeedbackCellArray> feedback_cell_array =
       NewFixedArrayWithMap<ClosureFeedbackCellArray>(
           RootIndex::kClosureFeedbackCellArrayMap, length,
-          AllocationType::kYoung);
+          AllocationType::kOld);
 
   return feedback_cell_array;
 }
@@ -622,7 +639,7 @@ Handle<FrameArray> Factory::NewFrameArray(int number_of_frames) {
   DCHECK_LE(0, number_of_frames);
   Handle<FixedArray> result =
       NewFixedArrayWithHoles(FrameArray::LengthFor(number_of_frames));
-  result->set(FrameArray::kFrameCountIndex, Smi::kZero);
+  result->set(FrameArray::kFrameCountIndex, Smi::zero());
   return Handle<FrameArray>::cast(result);
 }
 
@@ -693,6 +710,17 @@ Handle<AccessorPair> Factory::NewAccessorPair() {
   return accessors;
 }
 
+Handle<PropertyDescriptorObject> Factory::NewPropertyDescriptorObject() {
+  Handle<PropertyDescriptorObject> object =
+      Handle<PropertyDescriptorObject>::cast(
+          NewStruct(PROPERTY_DESCRIPTOR_OBJECT_TYPE, AllocationType::kYoung));
+  object->set_flags(Smi::zero());
+  object->set_value(*the_hole_value(), SKIP_WRITE_BARRIER);
+  object->set_get(*the_hole_value(), SKIP_WRITE_BARRIER);
+  object->set_set(*the_hole_value(), SKIP_WRITE_BARRIER);
+  return object;
+}
+
 // Internalized strings are created in the old generation (data space).
 Handle<String> Factory::InternalizeUtf8String(
     const Vector<const char>& string) {
@@ -744,6 +772,10 @@ template <class StringTableKey>
 Handle<String> Factory::InternalizeStringWithKey(StringTableKey* key) {
   return StringTable::LookupKey(isolate(), key);
 }
+template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
+    Handle<String> Factory::InternalizeStringWithKey(OneByteStringKey* key);
+template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
+    Handle<String> Factory::InternalizeStringWithKey(TwoByteStringKey* key);
 
 MaybeHandle<String> Factory::NewStringFromOneByte(
     const Vector<const uint8_t>& string, AllocationType allocation) {
@@ -898,57 +930,6 @@ inline void WriteTwoByteData(Handle<String> s, uint16_t* chars, int len) {
 
 }  // namespace
 
-Handle<SeqOneByteString> Factory::AllocateRawOneByteInternalizedString(
-    int length, uint32_t hash_field) {
-  CHECK_GE(String::kMaxLength, length);
-  // The canonical empty_string is the only zero-length string we allow.
-  DCHECK_IMPLIES(
-      length == 0,
-      isolate()->roots_table()[RootIndex::kempty_string] == kNullAddress);
-
-  Map map = *one_byte_internalized_string_map();
-  int size = SeqOneByteString::SizeFor(length);
-  HeapObject result =
-      AllocateRawWithImmortalMap(size,
-                                 isolate()->heap()->CanAllocateInReadOnlySpace()
-                                     ? AllocationType::kReadOnly
-                                     : AllocationType::kOld,
-                                 map);
-  Handle<SeqOneByteString> answer(SeqOneByteString::cast(result), isolate());
-  answer->set_length(length);
-  answer->set_hash_field(hash_field);
-  DCHECK_EQ(size, answer->Size());
-  return answer;
-}
-
-Handle<String> Factory::AllocateTwoByteInternalizedString(
-    const Vector<const uc16>& str, uint32_t hash_field) {
-  Handle<SeqTwoByteString> result =
-      AllocateRawTwoByteInternalizedString(str.length(), hash_field);
-  DisallowHeapAllocation no_gc;
-
-  // Fill in the characters.
-  MemCopy(result->GetChars(no_gc), str.begin(), str.length() * kUC16Size);
-
-  return result;
-}
-
-Handle<SeqTwoByteString> Factory::AllocateRawTwoByteInternalizedString(
-    int length, uint32_t hash_field) {
-  CHECK_GE(String::kMaxLength, length);
-  DCHECK_NE(0, length);  // Use Heap::empty_string() instead.
-
-  Map map = *internalized_string_map();
-  int size = SeqTwoByteString::SizeFor(length);
-  HeapObject result =
-      AllocateRawWithImmortalMap(size, AllocationType::kOld, map);
-  Handle<SeqTwoByteString> answer(SeqTwoByteString::cast(result), isolate());
-  answer->set_length(length);
-  answer->set_hash_field(hash_field);
-  DCHECK_EQ(size, result.Size());
-  return answer;
-}
-
 template <bool is_one_byte, typename T>
 Handle<String> Factory::AllocateInternalizedStringImpl(T t, int chars,
                                                        uint32_t hash_field) {
@@ -986,20 +967,6 @@ Handle<String> Factory::AllocateInternalizedStringImpl(T t, int chars,
   return answer;
 }
 
-Handle<String> Factory::NewOneByteInternalizedString(
-    const Vector<const uint8_t>& str, uint32_t hash_field) {
-  Handle<SeqOneByteString> result =
-      AllocateRawOneByteInternalizedString(str.length(), hash_field);
-  DisallowHeapAllocation no_allocation;
-  MemCopy(result->GetChars(no_allocation), str.begin(), str.length());
-  return result;
-}
-
-Handle<String> Factory::NewTwoByteInternalizedString(
-    const Vector<const uc16>& str, uint32_t hash_field) {
-  return AllocateTwoByteInternalizedString(str, hash_field);
-}
-
 Handle<String> Factory::NewInternalizedStringImpl(Handle<String> string,
                                                   int chars,
                                                   uint32_t hash_field) {
@@ -1059,42 +1026,6 @@ template Handle<ExternalOneByteString>
 template Handle<ExternalTwoByteString>
     Factory::InternalizeExternalString<ExternalTwoByteString>(Handle<String>);
 
-MaybeHandle<SeqOneByteString> Factory::NewRawOneByteString(
-    int length, AllocationType allocation) {
-  if (length > String::kMaxLength || length < 0) {
-    THROW_NEW_ERROR(isolate(), NewInvalidStringLengthError(), SeqOneByteString);
-  }
-  DCHECK_GT(length, 0);  // Use Factory::empty_string() instead.
-  int size = SeqOneByteString::SizeFor(length);
-  DCHECK_GE(SeqOneByteString::kMaxSize, size);
-
-  HeapObject result =
-      AllocateRawWithImmortalMap(size, allocation, *one_byte_string_map());
-  Handle<SeqOneByteString> string(SeqOneByteString::cast(result), isolate());
-  string->set_length(length);
-  string->set_hash_field(String::kEmptyHashField);
-  DCHECK_EQ(size, string->Size());
-  return string;
-}
-
-MaybeHandle<SeqTwoByteString> Factory::NewRawTwoByteString(
-    int length, AllocationType allocation) {
-  if (length > String::kMaxLength || length < 0) {
-    THROW_NEW_ERROR(isolate(), NewInvalidStringLengthError(), SeqTwoByteString);
-  }
-  DCHECK_GT(length, 0);  // Use Factory::empty_string() instead.
-  int size = SeqTwoByteString::SizeFor(length);
-  DCHECK_GE(SeqTwoByteString::kMaxSize, size);
-
-  HeapObject result =
-      AllocateRawWithImmortalMap(size, allocation, *string_map());
-  Handle<SeqTwoByteString> string(SeqTwoByteString::cast(result), isolate());
-  string->set_length(length);
-  string->set_hash_field(String::kEmptyHashField);
-  DCHECK_EQ(size, string->Size());
-  return string;
-}
-
 Handle<String> Factory::LookupSingleCharacterStringFromCode(uint16_t code) {
   if (code <= unibrow::Latin1::kMaxChar) {
     {
@@ -1113,116 +1044,13 @@ Handle<String> Factory::LookupSingleCharacterStringFromCode(uint16_t code) {
   return InternalizeString(Vector<const uint16_t>(buffer, 1));
 }
 
-static inline Handle<String> MakeOrFindTwoCharacterString(Isolate* isolate,
-                                                          uint16_t c1,
-                                                          uint16_t c2) {
+Handle<String> Factory::MakeOrFindTwoCharacterString(uint16_t c1, uint16_t c2) {
   if ((c1 | c2) <= unibrow::Latin1::kMaxChar) {
     uint8_t buffer[] = {static_cast<uint8_t>(c1), static_cast<uint8_t>(c2)};
-    return isolate->factory()->InternalizeString(
-        Vector<const uint8_t>(buffer, 2));
+    return InternalizeString(Vector<const uint8_t>(buffer, 2));
   }
   uint16_t buffer[] = {c1, c2};
-  return isolate->factory()->InternalizeString(
-      Vector<const uint16_t>(buffer, 2));
-}
-
-template <typename SinkChar, typename StringType>
-Handle<String> ConcatStringContent(Handle<StringType> result,
-                                   Handle<String> first,
-                                   Handle<String> second) {
-  DisallowHeapAllocation pointer_stays_valid;
-  SinkChar* sink = result->GetChars(pointer_stays_valid);
-  String::WriteToFlat(*first, sink, 0, first->length());
-  String::WriteToFlat(*second, sink + first->length(), 0, second->length());
-  return result;
-}
-
-MaybeHandle<String> Factory::NewConsString(Handle<String> left,
-                                           Handle<String> right) {
-  if (left->IsThinString()) {
-    left = handle(Handle<ThinString>::cast(left)->actual(), isolate());
-  }
-  if (right->IsThinString()) {
-    right = handle(Handle<ThinString>::cast(right)->actual(), isolate());
-  }
-  int left_length = left->length();
-  if (left_length == 0) return right;
-  int right_length = right->length();
-  if (right_length == 0) return left;
-
-  int length = left_length + right_length;
-
-  if (length == 2) {
-    uint16_t c1 = left->Get(0);
-    uint16_t c2 = right->Get(0);
-    return MakeOrFindTwoCharacterString(isolate(), c1, c2);
-  }
-
-  // Make sure that an out of memory exception is thrown if the length
-  // of the new cons string is too large.
-  if (length > String::kMaxLength || length < 0) {
-    THROW_NEW_ERROR(isolate(), NewInvalidStringLengthError(), String);
-  }
-
-  bool left_is_one_byte = left->IsOneByteRepresentation();
-  bool right_is_one_byte = right->IsOneByteRepresentation();
-  bool is_one_byte = left_is_one_byte && right_is_one_byte;
-
-  // If the resulting string is small make a flat string.
-  if (length < ConsString::kMinLength) {
-    // Note that neither of the two inputs can be a slice because:
-    STATIC_ASSERT(ConsString::kMinLength <= SlicedString::kMinLength);
-    DCHECK(left->IsFlat());
-    DCHECK(right->IsFlat());
-
-    STATIC_ASSERT(ConsString::kMinLength <= String::kMaxLength);
-    if (is_one_byte) {
-      Handle<SeqOneByteString> result =
-          NewRawOneByteString(length).ToHandleChecked();
-      DisallowHeapAllocation no_gc;
-      uint8_t* dest = result->GetChars(no_gc);
-      // Copy left part.
-      const uint8_t* src =
-          left->IsExternalString()
-              ? Handle<ExternalOneByteString>::cast(left)->GetChars()
-              : Handle<SeqOneByteString>::cast(left)->GetChars(no_gc);
-      for (int i = 0; i < left_length; i++) *dest++ = src[i];
-      // Copy right part.
-      src = right->IsExternalString()
-                ? Handle<ExternalOneByteString>::cast(right)->GetChars()
-                : Handle<SeqOneByteString>::cast(right)->GetChars(no_gc);
-      for (int i = 0; i < right_length; i++) *dest++ = src[i];
-      return result;
-    }
-
-    return ConcatStringContent<uc16>(
-        NewRawTwoByteString(length).ToHandleChecked(), left, right);
-  }
-
-  return NewConsString(left, right, length, is_one_byte);
-}
-
-Handle<String> Factory::NewConsString(Handle<String> left, Handle<String> right,
-                                      int length, bool one_byte) {
-  DCHECK(!left->IsThinString());
-  DCHECK(!right->IsThinString());
-  DCHECK_GE(length, ConsString::kMinLength);
-  DCHECK_LE(length, String::kMaxLength);
-
-  Handle<ConsString> result(
-      ConsString::cast(
-          one_byte ? New(cons_one_byte_string_map(), AllocationType::kYoung)
-                   : New(cons_string_map(), AllocationType::kYoung)),
-      isolate());
-
-  DisallowHeapAllocation no_gc;
-  WriteBarrierMode mode = result->GetWriteBarrierMode(no_gc);
-
-  result->set_hash_field(String::kEmptyHashField);
-  result->set_length(length);
-  result->set_first(*left, mode);
-  result->set_second(*right, mode);
-  return result;
+  return InternalizeString(Vector<const uint16_t>(buffer, 2));
 }
 
 Handle<String> Factory::NewSurrogatePairString(uint16_t lead, uint16_t trail) {
@@ -1260,7 +1088,7 @@ Handle<String> Factory::NewProperSubString(Handle<String> str, int begin,
     // table to prevent creation of many unnecessary strings.
     uint16_t c1 = str->Get(begin);
     uint16_t c2 = str->Get(begin + 1);
-    return MakeOrFindTwoCharacterString(isolate(), c1, c2);
+    return MakeOrFindTwoCharacterString(c1, c2);
   }
 
   if (!FLAG_string_slices || length < SlicedString::kMinLength) {
@@ -1348,22 +1176,6 @@ MaybeHandle<String> Factory::NewExternalStringFromTwoByte(
   return external_string;
 }
 
-Handle<ExternalOneByteString> Factory::NewNativeSourceString(
-    const ExternalOneByteString::Resource* resource) {
-  size_t length = resource->length();
-  DCHECK_LE(length, static_cast<size_t>(String::kMaxLength));
-
-  Handle<Map> map = native_source_string_map();
-  Handle<ExternalOneByteString> external_string(
-      ExternalOneByteString::cast(New(map, AllocationType::kOld)), isolate());
-  external_string->set_length(static_cast<int>(length));
-  external_string->set_hash_field(String::kEmptyHashField);
-  external_string->SetResource(isolate(), resource);
-  isolate()->heap()->RegisterExternalString(*external_string);
-
-  return external_string;
-}
-
 Handle<JSStringIterator> Factory::NewJSStringIterator(Handle<String> string) {
   Handle<Map> map(isolate()->native_context()->initial_string_iterator_map(),
                   isolate());
@@ -1390,7 +1202,7 @@ Handle<Symbol> Factory::NewSymbol(AllocationType allocation) {
   Handle<Symbol> symbol(Symbol::cast(result), isolate());
   symbol->set_hash_field(Name::kIsNotArrayIndexMask |
                          (hash << Name::kHashShift));
-  symbol->set_name(*undefined_value());
+  symbol->set_description(*undefined_value());
   symbol->set_flags(0);
   DCHECK(!symbol->is_private());
   return symbol;
@@ -1406,24 +1218,24 @@ Handle<Symbol> Factory::NewPrivateSymbol(AllocationType allocation) {
 Handle<Symbol> Factory::NewPrivateNameSymbol(Handle<String> name) {
   Handle<Symbol> symbol = NewSymbol();
   symbol->set_is_private_name();
-  symbol->set_name(*name);
+  symbol->set_description(*name);
   return symbol;
 }
 
-Handle<Context> Factory::NewContext(RootIndex map_root_index, int size,
+Handle<Context> Factory::NewContext(Handle<Map> map, int size,
                                     int variadic_part_length,
                                     AllocationType allocation) {
-  DCHECK(RootsTable::IsImmortalImmovable(map_root_index));
   DCHECK_LE(Context::kTodoHeaderSize, size);
   DCHECK(IsAligned(size, kTaggedSize));
   DCHECK_LE(Context::MIN_CONTEXT_SLOTS, variadic_part_length);
   DCHECK_LE(Context::SizeFor(variadic_part_length), size);
 
-  Map map = Map::cast(isolate()->root(map_root_index));
-  HeapObject result = AllocateRawWithImmortalMap(size, allocation, map);
+  HeapObject result =
+      isolate()->heap()->AllocateRawWith<Heap::kRetryOrFail>(size, allocation);
+  result.set_map_after_allocation(*map);
   Handle<Context> context(Context::cast(result), isolate());
-  context->initialize_length_and_extension_bit(variadic_part_length);
-  DCHECK_EQ(context->SizeFromMap(map), size);
+  context->set_length(variadic_part_length);
+  DCHECK_EQ(context->SizeFromMap(*map), size);
   if (size > Context::kTodoHeaderSize) {
     ObjectSlot start = context->RawField(Context::kTodoHeaderSize);
     ObjectSlot end = context->RawField(size);
@@ -1434,13 +1246,15 @@ Handle<Context> Factory::NewContext(RootIndex map_root_index, int size,
 }
 
 Handle<NativeContext> Factory::NewNativeContext() {
+  Handle<Map> map = NewMap(NATIVE_CONTEXT_TYPE, kVariableSizeSentinel);
   Handle<NativeContext> context = Handle<NativeContext>::cast(
-      NewContext(RootIndex::kNativeContextMap, NativeContext::kSize,
-                 NativeContext::NATIVE_CONTEXT_SLOTS, AllocationType::kOld));
-  context->set_scope_info(ReadOnlyRoots(isolate()).empty_scope_info());
+      NewContext(map, NativeContext::kSize, NativeContext::NATIVE_CONTEXT_SLOTS,
+                 AllocationType::kOld));
+  context->set_native_context_map(*map);
+  map->set_native_context(*context);
+  context->set_scope_info(ReadOnlyRoots(isolate()).native_scope_info());
   context->set_previous(Context::unchecked_cast(Smi::zero()));
-  context->set_extension(*the_hole_value());
-  context->set_native_context(*context);
+  context->set_extension(*undefined_value());
   context->set_errors_thrown(Smi::zero());
   context->set_math_random_index(Smi::zero());
   context->set_serialized_objects(*empty_fixed_array());
@@ -1453,13 +1267,12 @@ Handle<Context> Factory::NewScriptContext(Handle<NativeContext> outer,
                                           Handle<ScopeInfo> scope_info) {
   DCHECK_EQ(scope_info->scope_type(), SCRIPT_SCOPE);
   int variadic_part_length = scope_info->ContextLength();
-  Handle<Context> context = NewContext(
-      RootIndex::kScriptContextMap, Context::SizeFor(variadic_part_length),
-      variadic_part_length, AllocationType::kOld);
+  Handle<Context> context =
+      NewContext(handle(outer->script_context_map(), isolate()),
+                 Context::SizeFor(variadic_part_length), variadic_part_length,
+                 AllocationType::kOld);
   context->set_scope_info(*scope_info);
   context->set_previous(*outer);
-  context->set_extension(*the_hole_value());
-  context->set_native_context(*outer);
   DCHECK(context->IsScriptContext());
   return context;
 }
@@ -1478,37 +1291,34 @@ Handle<Context> Factory::NewModuleContext(Handle<SourceTextModule> module,
   DCHECK_EQ(scope_info->scope_type(), MODULE_SCOPE);
   int variadic_part_length = scope_info->ContextLength();
   Handle<Context> context = NewContext(
-      RootIndex::kModuleContextMap, Context::SizeFor(variadic_part_length),
+      isolate()->module_context_map(), Context::SizeFor(variadic_part_length),
       variadic_part_length, AllocationType::kOld);
   context->set_scope_info(*scope_info);
   context->set_previous(*outer);
   context->set_extension(*module);
-  context->set_native_context(*outer);
   DCHECK(context->IsModuleContext());
   return context;
 }
 
 Handle<Context> Factory::NewFunctionContext(Handle<Context> outer,
                                             Handle<ScopeInfo> scope_info) {
-  RootIndex mapRootIndex;
+  Handle<Map> map;
   switch (scope_info->scope_type()) {
     case EVAL_SCOPE:
-      mapRootIndex = RootIndex::kEvalContextMap;
+      map = isolate()->eval_context_map();
       break;
     case FUNCTION_SCOPE:
-      mapRootIndex = RootIndex::kFunctionContextMap;
+      map = isolate()->function_context_map();
       break;
     default:
       UNREACHABLE();
   }
   int variadic_part_length = scope_info->ContextLength();
   Handle<Context> context =
-      NewContext(mapRootIndex, Context::SizeFor(variadic_part_length),
+      NewContext(map, Context::SizeFor(variadic_part_length),
                  variadic_part_length, AllocationType::kYoung);
   context->set_scope_info(*scope_info);
   context->set_previous(*outer);
-  context->set_extension(*the_hole_value());
-  context->set_native_context(outer->native_context());
   return context;
 }
 
@@ -1520,12 +1330,10 @@ Handle<Context> Factory::NewCatchContext(Handle<Context> previous,
   // TODO(ishell): Take the details from CatchContext class.
   int variadic_part_length = Context::MIN_CONTEXT_SLOTS + 1;
   Handle<Context> context = NewContext(
-      RootIndex::kCatchContextMap, Context::SizeFor(variadic_part_length),
+      isolate()->catch_context_map(), Context::SizeFor(variadic_part_length),
       variadic_part_length, AllocationType::kYoung);
   context->set_scope_info(*scope_info);
   context->set_previous(*previous);
-  context->set_extension(*the_hole_value());
-  context->set_native_context(previous->native_context());
   context->set(Context::THROWN_OBJECT_INDEX, *thrown_object);
   return context;
 }
@@ -1535,19 +1343,19 @@ Handle<Context> Factory::NewDebugEvaluateContext(Handle<Context> previous,
                                                  Handle<JSReceiver> extension,
                                                  Handle<Context> wrapped,
                                                  Handle<StringSet> blacklist) {
-  STATIC_ASSERT(Context::BLACK_LIST_INDEX == Context::MIN_CONTEXT_SLOTS + 1);
+  STATIC_ASSERT(Context::BLACK_LIST_INDEX ==
+                Context::MIN_CONTEXT_EXTENDED_SLOTS + 1);
   DCHECK(scope_info->IsDebugEvaluateScope());
   Handle<HeapObject> ext = extension.is_null()
-                               ? Handle<HeapObject>::cast(the_hole_value())
+                               ? Handle<HeapObject>::cast(undefined_value())
                                : Handle<HeapObject>::cast(extension);
   // TODO(ishell): Take the details from DebugEvaluateContextContext class.
-  int variadic_part_length = Context::MIN_CONTEXT_SLOTS + 2;
-  Handle<Context> c = NewContext(RootIndex::kDebugEvaluateContextMap,
+  int variadic_part_length = Context::MIN_CONTEXT_EXTENDED_SLOTS + 2;
+  Handle<Context> c = NewContext(isolate()->debug_evaluate_context_map(),
                                  Context::SizeFor(variadic_part_length),
                                  variadic_part_length, AllocationType::kYoung);
   c->set_scope_info(*scope_info);
   c->set_previous(*previous);
-  c->set_native_context(previous->native_context());
   c->set_extension(*ext);
   if (!wrapped.is_null()) c->set(Context::WRAPPED_CONTEXT_INDEX, *wrapped);
   if (!blacklist.is_null()) c->set(Context::BLACK_LIST_INDEX, *blacklist);
@@ -1559,14 +1367,13 @@ Handle<Context> Factory::NewWithContext(Handle<Context> previous,
                                         Handle<JSReceiver> extension) {
   DCHECK_EQ(scope_info->scope_type(), WITH_SCOPE);
   // TODO(ishell): Take the details from WithContext class.
-  int variadic_part_length = Context::MIN_CONTEXT_SLOTS;
+  int variadic_part_length = Context::MIN_CONTEXT_EXTENDED_SLOTS;
   Handle<Context> context = NewContext(
-      RootIndex::kWithContextMap, Context::SizeFor(variadic_part_length),
+      isolate()->with_context_map(), Context::SizeFor(variadic_part_length),
       variadic_part_length, AllocationType::kYoung);
   context->set_scope_info(*scope_info);
   context->set_previous(*previous);
   context->set_extension(*extension);
-  context->set_native_context(previous->native_context());
   return context;
 }
 
@@ -1576,12 +1383,10 @@ Handle<Context> Factory::NewBlockContext(Handle<Context> previous,
                  scope_info->scope_type() == CLASS_SCOPE);
   int variadic_part_length = scope_info->ContextLength();
   Handle<Context> context = NewContext(
-      RootIndex::kBlockContextMap, Context::SizeFor(variadic_part_length),
+      isolate()->block_context_map(), Context::SizeFor(variadic_part_length),
       variadic_part_length, AllocationType::kYoung);
   context->set_scope_info(*scope_info);
   context->set_previous(*previous);
-  context->set_extension(*the_hole_value());
-  context->set_native_context(previous->native_context());
   return context;
 }
 
@@ -1589,12 +1394,10 @@ Handle<Context> Factory::NewBuiltinContext(Handle<NativeContext> native_context,
                                            int variadic_part_length) {
   DCHECK_LE(Context::MIN_CONTEXT_SLOTS, variadic_part_length);
   Handle<Context> context = NewContext(
-      RootIndex::kFunctionContextMap, Context::SizeFor(variadic_part_length),
+      isolate()->function_context_map(), Context::SizeFor(variadic_part_length),
       variadic_part_length, AllocationType::kYoung);
   context->set_scope_info(ReadOnlyRoots(isolate()).empty_scope_info());
   context->set_previous(*native_context);
-  context->set_extension(*the_hole_value());
-  context->set_native_context(*native_context);
   return context;
 }
 
@@ -1626,9 +1429,9 @@ Handle<AccessorInfo> Factory::NewAccessorInfo() {
   info->set_initial_property_attributes(NONE);
 
   // Clear some other fields that should not be undefined.
-  info->set_getter(Smi::kZero);
-  info->set_setter(Smi::kZero);
-  info->set_js_getter(Smi::kZero);
+  info->set_getter(Smi::zero());
+  info->set_setter(Smi::zero());
+  info->set_js_getter(Smi::zero());
 
   return info;
 }
@@ -1658,13 +1461,10 @@ Handle<Script> Factory::NewScriptWithId(Handle<String> source, int script_id) {
   script->set_flags(0);
   script->set_host_defined_options(*empty_fixed_array());
   Handle<WeakArrayList> scripts = script_list();
-  scripts = WeakArrayList::AddToEnd(isolate(), scripts,
-                                    MaybeObjectHandle::Weak(script));
+  scripts = WeakArrayList::Append(isolate(), scripts,
+                                  MaybeObjectHandle::Weak(script));
   heap->set_script_list(*scripts);
   LOG(isolate(), ScriptEvent(Logger::ScriptEventType::kCreate, script_id));
-  TRACE_EVENT_OBJECT_CREATED_WITH_ID(
-      TRACE_DISABLED_BY_DEFAULT("v8.compile"), "Script",
-      TRACE_ID_WITH_SCOPE(Script::kTraceScope, script_id));
   return script;
 }
 
@@ -1866,7 +1666,7 @@ Handle<TransitionArray> Factory::NewTransitionArray(int number_of_transitions,
     heap->mark_compact_collector()->AddTransitionArray(*array);
   }
   array->WeakFixedArray::Set(TransitionArray::kPrototypeTransitionsIndex,
-                             MaybeObject::FromObject(Smi::kZero));
+                             MaybeObject::FromObject(Smi::zero()));
   array->WeakFixedArray::Set(
       TransitionArray::kTransitionLengthIndex,
       MaybeObject::FromObject(Smi::FromInt(number_of_transitions)));
@@ -1934,11 +1734,12 @@ Map Factory::InitializeMap(Map map, InstanceType type, int instance_size,
   // |layout_descriptor| are set.
   map.set_visitor_id(Map::GetVisitorId(map));
   map.set_bit_field(0);
-  map.set_bit_field2(Map::NewTargetIsBaseBit::encode(true));
-  int bit_field3 = Map::EnumLengthBits::encode(kInvalidEnumCacheSentinel) |
-                   Map::OwnsDescriptorsBit::encode(true) |
-                   Map::ConstructionCounterBits::encode(Map::kNoSlackTracking) |
-                   Map::IsExtensibleBit::encode(true);
+  map.set_bit_field2(Map::Bits2::NewTargetIsBaseBit::encode(true));
+  int bit_field3 =
+      Map::Bits3::EnumLengthBits::encode(kInvalidEnumCacheSentinel) |
+      Map::Bits3::OwnsDescriptorsBit::encode(true) |
+      Map::Bits3::ConstructionCounterBits::encode(Map::kNoSlackTracking) |
+      Map::Bits3::IsExtensibleBit::encode(true);
   map.set_bit_field3(bit_field3);
   DCHECK(!map.is_in_retained_map_list());
   map.clear_padding();
@@ -2038,7 +1839,7 @@ void initialize_length<PropertyArray>(Handle<PropertyArray> array, int length) {
 inline void ZeroEmbedderFields(i::Handle<i::JSObject> obj) {
   auto count = obj->GetEmbedderFieldCount();
   for (int i = 0; i < count; i++) {
-    obj->SetEmbedderField(i, Smi::kZero);
+    obj->SetEmbedderField(i, Smi::zero());
   }
 }
 
@@ -2091,6 +1892,29 @@ Handle<FixedArray> Factory::CopyFixedArrayAndGrow(Handle<FixedArray> array,
   return CopyArrayAndGrow(array, grow_by, AllocationType::kYoung);
 }
 
+Handle<WeakArrayList> Factory::NewUninitializedWeakArrayList(
+    int capacity, AllocationType allocation) {
+  DCHECK_LE(0, capacity);
+  if (capacity == 0) return empty_weak_array_list();
+
+  HeapObject obj = AllocateRawWeakArrayList(capacity, allocation);
+  obj.set_map_after_allocation(*weak_array_list_map(), SKIP_WRITE_BARRIER);
+
+  Handle<WeakArrayList> result(WeakArrayList::cast(obj), isolate());
+  result->set_length(0);
+  result->set_capacity(capacity);
+  return result;
+}
+
+Handle<WeakArrayList> Factory::NewWeakArrayList(int capacity,
+                                                AllocationType allocation) {
+  Handle<WeakArrayList> result =
+      NewUninitializedWeakArrayList(capacity, allocation);
+  MemsetTagged(ObjectSlot(result->data_start()),
+               ReadOnlyRoots(isolate()).undefined_value(), capacity);
+  return result;
+}
+
 Handle<WeakFixedArray> Factory::CopyWeakFixedArrayAndGrow(
     Handle<WeakFixedArray> src, int grow_by) {
   DCHECK(!src->IsTransitionArray());  // Compacted by GC, this code doesn't work
@@ -2102,22 +1926,42 @@ Handle<WeakArrayList> Factory::CopyWeakArrayListAndGrow(
   int old_capacity = src->capacity();
   int new_capacity = old_capacity + grow_by;
   DCHECK_GE(new_capacity, old_capacity);
-  HeapObject obj = AllocateRawWeakArrayList(new_capacity, allocation);
-  obj.set_map_after_allocation(src->map(), SKIP_WRITE_BARRIER);
-
-  WeakArrayList result = WeakArrayList::cast(obj);
+  Handle<WeakArrayList> result =
+      NewUninitializedWeakArrayList(new_capacity, allocation);
   int old_len = src->length();
-  result.set_length(old_len);
-  result.set_capacity(new_capacity);
+  result->set_length(old_len);
 
   // Copy the content.
   DisallowHeapAllocation no_gc;
-  WriteBarrierMode mode = obj.GetWriteBarrierMode(no_gc);
-  result.CopyElements(isolate(), 0, *src, 0, old_len, mode);
-  MemsetTagged(ObjectSlot(result.data_start() + old_len),
+  WriteBarrierMode mode = result->GetWriteBarrierMode(no_gc);
+  result->CopyElements(isolate(), 0, *src, 0, old_len, mode);
+  MemsetTagged(ObjectSlot(result->data_start() + old_len),
                ReadOnlyRoots(isolate()).undefined_value(),
                new_capacity - old_len);
-  return Handle<WeakArrayList>(result, isolate());
+  return result;
+}
+
+Handle<WeakArrayList> Factory::CompactWeakArrayList(Handle<WeakArrayList> src,
+                                                    int new_capacity,
+                                                    AllocationType allocation) {
+  Handle<WeakArrayList> result =
+      NewUninitializedWeakArrayList(new_capacity, allocation);
+
+  // Copy the content.
+  DisallowHeapAllocation no_gc;
+  WriteBarrierMode mode = result->GetWriteBarrierMode(no_gc);
+  int copy_to = 0, length = src->length();
+  for (int i = 0; i < length; i++) {
+    MaybeObject element = src->Get(i);
+    if (element->IsCleared()) continue;
+    result->Set(copy_to++, element, mode);
+  }
+  result->set_length(copy_to);
+
+  MemsetTagged(ObjectSlot(result->data_start() + copy_to),
+               ReadOnlyRoots(isolate()).undefined_value(),
+               new_capacity - copy_to);
+  return result;
 }
 
 Handle<PropertyArray> Factory::CopyPropertyArrayAndGrow(
@@ -2240,51 +2084,30 @@ Handle<FreshlyAllocatedBigInt> Factory::NewBigInt(int length,
   return handle(bigint, isolate());
 }
 
-Handle<Object> Factory::NewError(Handle<JSFunction> constructor,
-                                 MessageTemplate template_index,
-                                 Handle<Object> arg0, Handle<Object> arg1,
-                                 Handle<Object> arg2) {
+Handle<JSObject> Factory::NewError(Handle<JSFunction> constructor,
+                                   MessageTemplate template_index,
+                                   Handle<Object> arg0, Handle<Object> arg1,
+                                   Handle<Object> arg2) {
   HandleScope scope(isolate());
-  if (isolate()->bootstrapper()->IsActive()) {
-    // During bootstrapping we cannot construct error objects.
-    return scope.CloseAndEscape(NewStringFromAsciiChecked(
-        MessageFormatter::TemplateString(template_index)));
-  }
 
   if (arg0.is_null()) arg0 = undefined_value();
   if (arg1.is_null()) arg1 = undefined_value();
   if (arg2.is_null()) arg2 = undefined_value();
 
-  Handle<Object> result;
-  if (!ErrorUtils::MakeGenericError(isolate(), constructor, template_index,
-                                    arg0, arg1, arg2, SKIP_NONE)
-           .ToHandle(&result)) {
-    // If an exception is thrown while
-    // running the factory method, use the exception as the result.
-    DCHECK(isolate()->has_pending_exception());
-    result = handle(isolate()->pending_exception(), isolate());
-    isolate()->clear_pending_exception();
-  }
-
-  return scope.CloseAndEscape(result);
+  return scope.CloseAndEscape(ErrorUtils::MakeGenericError(
+      isolate(), constructor, template_index, arg0, arg1, arg2, SKIP_NONE));
 }
 
-Handle<Object> Factory::NewError(Handle<JSFunction> constructor,
-                                 Handle<String> message) {
+Handle<JSObject> Factory::NewError(Handle<JSFunction> constructor,
+                                   Handle<String> message) {
   // Construct a new error object. If an exception is thrown, use the exception
   // as the result.
 
   Handle<Object> no_caller;
-  MaybeHandle<Object> maybe_error = ErrorUtils::Construct(
-      isolate(), constructor, constructor, message, SKIP_NONE, no_caller,
-      ErrorUtils::StackTraceCollection::kDetailed);
-  if (maybe_error.is_null()) {
-    DCHECK(isolate()->has_pending_exception());
-    maybe_error = handle(isolate()->pending_exception(), isolate());
-    isolate()->clear_pending_exception();
-  }
-
-  return maybe_error.ToHandleChecked();
+  return ErrorUtils::Construct(isolate(), constructor, constructor, message,
+                               SKIP_NONE, no_caller,
+                               ErrorUtils::StackTraceCollection::kDetailed)
+      .ToHandleChecked();
 }
 
 Handle<Object> Factory::NewInvalidStringLengthError() {
@@ -2299,9 +2122,9 @@ Handle<Object> Factory::NewInvalidStringLengthError() {
 }
 
 #define DEFINE_ERROR(NAME, name)                                              \
-  Handle<Object> Factory::New##NAME(MessageTemplate template_index,           \
-                                    Handle<Object> arg0, Handle<Object> arg1, \
-                                    Handle<Object> arg2) {                    \
+  Handle<JSObject> Factory::New##NAME(                                        \
+      MessageTemplate template_index, Handle<Object> arg0,                    \
+      Handle<Object> arg1, Handle<Object> arg2) {                             \
     return NewError(isolate()->name##_function(), template_index, arg0, arg1, \
                     arg2);                                                    \
   }
@@ -2575,8 +2398,7 @@ Factory::NewUncompiledDataWithoutPreparseData(Handle<String> inferred_name,
           uncompiled_data_without_preparse_data_map(), AllocationType::kOld)),
       isolate());
 
-  UncompiledData::Initialize(*result, *inferred_name, start_position,
-                             end_position);
+  result->Init(*inferred_name, start_position, end_position);
   return result;
 }
 
@@ -2590,8 +2412,7 @@ Factory::NewUncompiledDataWithPreparseData(Handle<String> inferred_name,
           New(uncompiled_data_with_preparse_data_map(), AllocationType::kOld)),
       isolate());
 
-  UncompiledDataWithPreparseData::Initialize(
-      *result, *inferred_name, start_position, end_position, *preparse_data);
+  result->Init(*inferred_name, start_position, end_position, *preparse_data);
 
   return result;
 }
@@ -2620,17 +2441,19 @@ Handle<Code> Factory::NewOffHeapTrampolineFor(Handle<Code> code,
   CHECK_NE(0, isolate()->embedded_blob_size());
   CHECK(Builtins::IsIsolateIndependentBuiltin(*code));
 
+  bool generate_jump_to_instruction_stream =
+      Builtins::CodeObjectIsExecutable(code->builtin_index());
   Handle<Code> result = Builtins::GenerateOffHeapTrampolineFor(
       isolate(), off_heap_entry,
-      code->code_data_container().kind_specific_flags());
+      code->code_data_container().kind_specific_flags(),
+      generate_jump_to_instruction_stream);
   // The CodeDataContainer should not be modified beyond this point since it's
   // now possibly canonicalized.
 
   // The trampoline code object must inherit specific flags from the original
   // builtin (e.g. the safepoint-table offset). We set them manually here.
   {
-    MemoryChunk* chunk = MemoryChunk::FromHeapObject(*result);
-    CodePageMemoryModificationScope code_allocation(chunk);
+    CodePageMemoryModificationScope code_allocation(*result);
 
     const bool set_is_off_heap_trampoline = true;
     const int stack_slots =
@@ -2648,7 +2471,9 @@ Handle<Code> Factory::NewOffHeapTrampolineFor(Handle<Code> code,
     // canonical one stored in the roots to avoid duplicating it for every
     // single builtin.
     ByteArray canonical_reloc_info =
-        ReadOnlyRoots(isolate()).off_heap_trampoline_relocation_info();
+        generate_jump_to_instruction_stream
+            ? ReadOnlyRoots(isolate()).off_heap_trampoline_relocation_info()
+            : ReadOnlyRoots(isolate()).empty_byte_array();
 #ifdef DEBUG
     // Verify that the contents are the same.
     ByteArray reloc_info = result->relocation_info();
@@ -2673,7 +2498,8 @@ Handle<Code> Factory::CopyCode(Handle<Code> code) {
     int obj_size = code->Size();
     CodePageCollectionMemoryModificationScope code_allocation(heap);
     HeapObject result = heap->AllocateRawWith<Heap::kRetryOrFail>(
-        obj_size, AllocationType::kCode);
+        obj_size, AllocationType::kCode, AllocationOrigin::kRuntime,
+        AllocationAlignment::kCodeAligned);
 
     // Copy code object.
     Address old_addr = code->address();
@@ -2770,7 +2596,7 @@ Handle<JSGlobalObject> Factory::NewJSGlobalObject(
   // The global object might be created from an object template with accessors.
   // Fill these accessors into the dictionary.
   Handle<DescriptorArray> descs(map->instance_descriptors(), isolate());
-  for (InternalIndex i : InternalIndex::Range(map->NumberOfOwnDescriptors())) {
+  for (InternalIndex i : map->IterateOwnDescriptors()) {
     PropertyDetails details = descs->GetDetails(i);
     // Only accessors are expected.
     DCHECK_EQ(kAccessor, details.kind());
@@ -2811,7 +2637,7 @@ void Factory::InitializeJSObjectFromMap(Handle<JSObject> obj,
   // TODO(1240798): Initialize the object's body using valid initial values
   // according to the object's initial map.  For example, if the map's
   // instance type is JS_ARRAY_TYPE, the length field should be initialized
-  // to a number (e.g. Smi::kZero) and the elements initialized to a
+  // to a number (e.g. Smi::zero()) and the elements initialized to a
   // fixed array (e.g. Heap::empty_fixed_array()).  Currently, the object
   // verification code has to cope with (temporarily) invalid objects.  See
   // for example, JSArray::JSArrayVerify).
@@ -2951,7 +2777,7 @@ void Factory::NewJSArrayStorage(Handle<JSArray> array, int length, int capacity,
   DCHECK(capacity >= length);
 
   if (capacity == 0) {
-    array->set_length(Smi::kZero);
+    array->set_length(Smi::zero());
     array->set_elements(*empty_fixed_array());
     return;
   }
@@ -3389,18 +3215,10 @@ Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfoForLiteral(
   FunctionKind kind = literal->kind();
   Handle<SharedFunctionInfo> shared = NewSharedFunctionInfoForBuiltin(
       literal->name(), Builtins::kCompileLazy, kind);
-  SharedFunctionInfo::InitFromFunctionLiteral(shared, literal, is_toplevel);
-  SharedFunctionInfo::SetScript(shared, script, literal->function_literal_id(),
-                                false);
-  TRACE_EVENT_OBJECT_CREATED_WITH_ID(
-      TRACE_DISABLED_BY_DEFAULT("v8.compile"), "SharedFunctionInfo",
-      TRACE_ID_WITH_SCOPE(SharedFunctionInfo::kTraceScope,
-                          shared->TraceID(literal)));
-  TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID(
-      TRACE_DISABLED_BY_DEFAULT("v8.compile"), "SharedFunctionInfo",
-      TRACE_ID_WITH_SCOPE(SharedFunctionInfo::kTraceScope,
-                          shared->TraceID(literal)),
-      shared->ToTracedValue(literal));
+  SharedFunctionInfo::InitFromFunctionLiteral(isolate(), shared, literal,
+                                              is_toplevel);
+  shared->SetScript(ReadOnlyRoots(isolate()), *script,
+                    literal->function_literal_id(), false);
   return shared;
 }
 
@@ -3466,70 +3284,59 @@ Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfoForBuiltin(
 Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfo(
     MaybeHandle<String> maybe_name, MaybeHandle<HeapObject> maybe_function_data,
     int maybe_builtin_index, FunctionKind kind) {
+  Handle<SharedFunctionInfo> shared = NewSharedFunctionInfo();
+
   // Function names are assumed to be flat elsewhere. Must flatten before
   // allocating SharedFunctionInfo to avoid GC seeing the uninitialized SFI.
   Handle<String> shared_name;
   bool has_shared_name = maybe_name.ToHandle(&shared_name);
   if (has_shared_name) {
     shared_name = String::Flatten(isolate(), shared_name, AllocationType::kOld);
+    shared->set_name_or_scope_info(*shared_name);
+  } else {
+    DCHECK_EQ(shared->name_or_scope_info(),
+              SharedFunctionInfo::kNoSharedNameSentinel);
+  }
+
+  Handle<HeapObject> function_data;
+  if (maybe_function_data.ToHandle(&function_data)) {
+    // If we pass function_data then we shouldn't pass a builtin index, and
+    // the function_data should not be code with a builtin.
+    DCHECK(!Builtins::IsBuiltinId(maybe_builtin_index));
+    DCHECK_IMPLIES(function_data->IsCode(),
+                   !Code::cast(*function_data).is_builtin());
+    shared->set_function_data(*function_data);
+  } else if (Builtins::IsBuiltinId(maybe_builtin_index)) {
+    shared->set_builtin_id(maybe_builtin_index);
+  } else {
+    shared->set_builtin_id(Builtins::kIllegal);
   }
 
+  shared->CalculateConstructAsBuiltin();
+  shared->set_kind(kind);
+
+#ifdef VERIFY_HEAP
+  shared->SharedFunctionInfoVerify(isolate());
+#endif  // VERIFY_HEAP
+  return shared;
+}
+
+Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfo() {
   Handle<Map> map = shared_function_info_map();
-  Handle<SharedFunctionInfo> share(
+
+  Handle<SharedFunctionInfo> shared(
       SharedFunctionInfo::cast(New(map, AllocationType::kOld)), isolate());
-  {
-    DisallowHeapAllocation no_allocation;
-
-    // Set pointer fields.
-    share->set_name_or_scope_info(
-        has_shared_name ? Object::cast(*shared_name)
-                        : SharedFunctionInfo::kNoSharedNameSentinel);
-    Handle<HeapObject> function_data;
-    if (maybe_function_data.ToHandle(&function_data)) {
-      // If we pass function_data then we shouldn't pass a builtin index, and
-      // the function_data should not be code with a builtin.
-      DCHECK(!Builtins::IsBuiltinId(maybe_builtin_index));
-      DCHECK_IMPLIES(function_data->IsCode(),
-                     !Code::cast(*function_data).is_builtin());
-      share->set_function_data(*function_data);
-    } else if (Builtins::IsBuiltinId(maybe_builtin_index)) {
-      share->set_builtin_id(maybe_builtin_index);
-    } else {
-      share->set_builtin_id(Builtins::kIllegal);
-    }
-    // Generally functions won't have feedback, unless they have been created
-    // from a FunctionLiteral. Those can just reset this field to keep the
-    // SharedFunctionInfo in a consistent state.
-    if (maybe_builtin_index == Builtins::kCompileLazy) {
-      share->set_raw_outer_scope_info_or_feedback_metadata(*the_hole_value(),
-                                                           SKIP_WRITE_BARRIER);
-    } else {
-      share->set_raw_outer_scope_info_or_feedback_metadata(
-          *empty_feedback_metadata(), SKIP_WRITE_BARRIER);
-    }
-    share->set_script_or_debug_info(*undefined_value(), SKIP_WRITE_BARRIER);
-    share->set_function_literal_id(kFunctionLiteralIdInvalid);
+  int unique_id = -1;
 #if V8_SFI_HAS_UNIQUE_ID
-    share->set_unique_id(isolate()->GetNextUniqueSharedFunctionInfoId());
-#endif
+  unique_id = isolate()->GetNextUniqueSharedFunctionInfoId();
+#endif  // V8_SFI_HAS_UNIQUE_ID
 
-    // Set integer fields (smi or int, depending on the architecture).
-    share->set_length(0);
-    share->set_internal_formal_parameter_count(0);
-    share->set_expected_nof_properties(0);
-    share->set_raw_function_token_offset(0);
-    // All flags default to false or 0.
-    share->set_flags(0);
-    share->CalculateConstructAsBuiltin();
-    share->set_kind(kind);
-
-    share->clear_padding();
-  }
+  shared->Init(ReadOnlyRoots(isolate()), unique_id);
 
 #ifdef VERIFY_HEAP
-  share->SharedFunctionInfoVerify(isolate());
-#endif
-  return share;
+  shared->SharedFunctionInfoVerify(isolate());
+#endif  // VERIFY_HEAP
+  return shared;
 }
 
 namespace {
@@ -3580,30 +3387,38 @@ Handle<Object> Factory::NumberToStringCacheGet(Object number, int hash) {
 
 Handle<String> Factory::NumberToString(Handle<Object> number,
                                        bool check_cache) {
-  if (number->IsSmi()) return NumberToString(Smi::cast(*number), check_cache);
+  if (number->IsSmi()) return SmiToString(Smi::cast(*number), check_cache);
 
   double double_value = Handle<HeapNumber>::cast(number)->value();
   // Try to canonicalize doubles.
   int smi_value;
   if (DoubleToSmiInteger(double_value, &smi_value)) {
-    return NumberToString(Smi::FromInt(smi_value), check_cache);
+    return SmiToString(Smi::FromInt(smi_value), check_cache);
   }
+  return HeapNumberToString(Handle<HeapNumber>::cast(number), double_value,
+                            check_cache);
+}
+
+// Must be large enough to fit any double, int, or size_t.
+static const int kNumberToStringBufferSize = 32;
 
+Handle<String> Factory::HeapNumberToString(Handle<HeapNumber> number,
+                                           double value, bool check_cache) {
   int hash = 0;
   if (check_cache) {
-    hash = NumberToStringCacheHash(number_string_cache(), double_value);
+    hash = NumberToStringCacheHash(number_string_cache(), value);
     Handle<Object> cached = NumberToStringCacheGet(*number, hash);
     if (!cached->IsUndefined(isolate())) return Handle<String>::cast(cached);
   }
 
-  char arr[100];
+  char arr[kNumberToStringBufferSize];
   Vector<char> buffer(arr, arraysize(arr));
-  const char* string = DoubleToCString(double_value, buffer);
+  const char* string = DoubleToCString(value, buffer);
 
   return NumberToStringCacheSet(number, hash, string, check_cache);
 }
 
-Handle<String> Factory::NumberToString(Smi number, bool check_cache) {
+Handle<String> Factory::SmiToString(Smi number, bool check_cache) {
   int hash = 0;
   if (check_cache) {
     hash = NumberToStringCacheHash(number_string_cache(), number);
@@ -3611,12 +3426,56 @@ Handle<String> Factory::NumberToString(Smi number, bool check_cache) {
     if (!cached->IsUndefined(isolate())) return Handle<String>::cast(cached);
   }
 
-  char arr[100];
+  char arr[kNumberToStringBufferSize];
   Vector<char> buffer(arr, arraysize(arr));
   const char* string = IntToCString(number.value(), buffer);
 
-  return NumberToStringCacheSet(handle(number, isolate()), hash, string,
-                                check_cache);
+  Handle<String> result = NumberToStringCacheSet(handle(number, isolate()),
+                                                 hash, string, check_cache);
+  // Compute the hash here (rather than letting the caller take care of it) so
+  // that the "cache hit" case above doesn't have to bother with it.
+  STATIC_ASSERT(Smi::kMaxValue <= std::numeric_limits<uint32_t>::max());
+  if (result->hash_field() == String::kEmptyHashField && number.value() >= 0) {
+    uint32_t field = StringHasher::MakeArrayIndexHash(
+        static_cast<uint32_t>(number.value()), result->length());
+    result->set_hash_field(field);
+  }
+  return result;
+}
+
+Handle<String> Factory::SizeToString(size_t value, bool check_cache) {
+  Handle<String> result;
+  if (value <= Smi::kMaxValue) {
+    int32_t int32v = static_cast<int32_t>(static_cast<uint32_t>(value));
+    // SmiToString sets the hash when needed, we can return immediately.
+    return SmiToString(Smi::FromInt(int32v), check_cache);
+  } else if (value <= kMaxSafeInteger) {
+    // TODO(jkummerow): Refactor the cache to not require Objects as keys.
+    double double_value = static_cast<double>(value);
+    result =
+        HeapNumberToString(NewHeapNumber(double_value), value, check_cache);
+  } else {
+    char arr[kNumberToStringBufferSize];
+    Vector<char> buffer(arr, arraysize(arr));
+    // Build the string backwards from the least significant digit.
+    int i = buffer.length();
+    size_t value_copy = value;
+    buffer[--i] = '\0';
+    do {
+      buffer[--i] = '0' + (value_copy % 10);
+      value_copy /= 10;
+    } while (value_copy > 0);
+    char* string = buffer.begin() + i;
+    // No way to cache this; we'd need an {Object} to use as key.
+    result = NewStringFromAsciiChecked(string);
+  }
+  if (value <= JSArray::kMaxArrayIndex &&
+      result->hash_field() == String::kEmptyHashField) {
+    uint32_t field = StringHasher::MakeArrayIndexHash(
+        static_cast<uint32_t>(value), result->length());
+    result->set_hash_field(field);
+  }
+  return result;
 }
 
 Handle<ClassPositions> Factory::NewClassPositions(int start, int end) {
@@ -3668,15 +3527,15 @@ Handle<CoverageInfo> Factory::NewCoverageInfo(
 
 Handle<BreakPointInfo> Factory::NewBreakPointInfo(int source_position) {
   Handle<BreakPointInfo> new_break_point_info = Handle<BreakPointInfo>::cast(
-      NewStruct(TUPLE2_TYPE, AllocationType::kOld));
+      NewStruct(BREAK_POINT_INFO_TYPE, AllocationType::kOld));
   new_break_point_info->set_source_position(source_position);
   new_break_point_info->set_break_points(*undefined_value());
   return new_break_point_info;
 }
 
 Handle<BreakPoint> Factory::NewBreakPoint(int id, Handle<String> condition) {
-  Handle<BreakPoint> new_break_point =
-      Handle<BreakPoint>::cast(NewStruct(TUPLE2_TYPE, AllocationType::kOld));
+  Handle<BreakPoint> new_break_point = Handle<BreakPoint>::cast(
+      NewStruct(BREAK_POINT_TYPE, AllocationType::kOld));
   new_break_point->set_id(id);
   new_break_point->set_condition(*condition);
   return new_break_point;
@@ -3706,6 +3565,7 @@ Handle<StackFrameInfo> Factory::NewStackFrameInfo(
 
   int line = frame->GetLineNumber();
   int column = frame->GetColumnNumber();
+  int wasm_function_index = frame->GetWasmFunctionIndex();
 
   const int script_id = frame->GetScriptId();
 
@@ -3757,6 +3617,7 @@ Handle<StackFrameInfo> Factory::NewStackFrameInfo(
   info->set_is_user_java_script(is_user_java_script);
   info->set_line_number(line);
   info->set_column_number(column);
+  info->set_wasm_function_index(wasm_function_index);
   info->set_script_id(script_id);
 
   info->set_script_name(*script_name);
@@ -3778,22 +3639,6 @@ Handle<StackFrameInfo> Factory::NewStackFrameInfo(
   return info;
 }
 
-Handle<SourcePositionTableWithFrameCache>
-Factory::NewSourcePositionTableWithFrameCache(
-    Handle<ByteArray> source_position_table,
-    Handle<SimpleNumberDictionary> stack_frame_cache) {
-  Handle<SourcePositionTableWithFrameCache>
-      source_position_table_with_frame_cache =
-          Handle<SourcePositionTableWithFrameCache>::cast(
-              NewStruct(SOURCE_POSITION_TABLE_WITH_FRAME_CACHE_TYPE,
-                        AllocationType::kOld));
-  source_position_table_with_frame_cache->set_source_position_table(
-      *source_position_table);
-  source_position_table_with_frame_cache->set_stack_frame_cache(
-      *stack_frame_cache);
-  return source_position_table_with_frame_cache;
-}
-
 Handle<JSObject> Factory::NewArgumentsObject(Handle<JSFunction> callee,
                                              int length) {
   bool strict_mode_callee = is_strict(callee->shared().language_mode()) ||
@@ -3912,7 +3757,9 @@ void Factory::SetRegExpAtomData(Handle<JSRegExp> regexp, JSRegExp::Type type,
 
 void Factory::SetRegExpIrregexpData(Handle<JSRegExp> regexp,
                                     JSRegExp::Type type, Handle<String> source,
-                                    JSRegExp::Flags flags, int capture_count) {
+                                    JSRegExp::Flags flags, int capture_count,
+                                    uint32_t backtrack_limit) {
+  DCHECK(Smi::IsValid(backtrack_limit));
   Handle<FixedArray> store = NewFixedArray(JSRegExp::kIrregexpDataSize);
   Smi uninitialized = Smi::FromInt(JSRegExp::kUninitializedValue);
   Smi ticks_until_tier_up = FLAG_regexp_tier_up
@@ -3925,10 +3772,11 @@ void Factory::SetRegExpIrregexpData(Handle<JSRegExp> regexp,
   store->set(JSRegExp::kIrregexpUC16CodeIndex, uninitialized);
   store->set(JSRegExp::kIrregexpLatin1BytecodeIndex, uninitialized);
   store->set(JSRegExp::kIrregexpUC16BytecodeIndex, uninitialized);
-  store->set(JSRegExp::kIrregexpMaxRegisterCountIndex, Smi::kZero);
+  store->set(JSRegExp::kIrregexpMaxRegisterCountIndex, Smi::zero());
   store->set(JSRegExp::kIrregexpCaptureCountIndex, Smi::FromInt(capture_count));
   store->set(JSRegExp::kIrregexpCaptureNameMapIndex, uninitialized);
   store->set(JSRegExp::kIrregexpTicksUntilTierUpIndex, ticks_until_tier_up);
+  store->set(JSRegExp::kIrregexpBacktrackLimit, Smi::FromInt(backtrack_limit));
   regexp->set_data(*store);
 }
 
@@ -4049,6 +3897,7 @@ Handle<Map> Factory::CreateSloppyFunctionMap(
     map->AppendDescriptor(isolate(), &d);
   }
   DCHECK_EQ(inobject_properties_count, field_index);
+  DCHECK_EQ(0, map->instance_descriptors().number_of_slack_descriptors());
   LOG(isolate(), MapDetails(*map));
   return map;
 }
@@ -4059,10 +3908,15 @@ Handle<Map> Factory::CreateStrictFunctionMap(
   int header_size = has_prototype ? JSFunction::kSizeWithPrototype
                                   : JSFunction::kSizeWithoutPrototype;
   int inobject_properties_count = 0;
-  if (IsFunctionModeWithName(function_mode)) ++inobject_properties_count;
+  // length and prototype accessors or just length accessor.
+  int descriptors_count = IsFunctionModeWithPrototype(function_mode) ? 2 : 1;
+  if (IsFunctionModeWithName(function_mode)) {
+    ++inobject_properties_count;  // name property.
+  } else {
+    ++descriptors_count;  // name accessor.
+  }
   if (IsFunctionModeWithHomeObject(function_mode)) ++inobject_properties_count;
-  int descriptors_count = (IsFunctionModeWithPrototype(function_mode) ? 3 : 2) +
-                          inobject_properties_count;
+  descriptors_count += inobject_properties_count;
 
   Handle<Map> map = NewMap(
       JS_FUNCTION_TYPE, header_size + inobject_properties_count * kTaggedSize,
@@ -4126,6 +3980,7 @@ Handle<Map> Factory::CreateStrictFunctionMap(
     map->AppendDescriptor(isolate(), &d);
   }
   DCHECK_EQ(inobject_properties_count, field_index);
+  DCHECK_EQ(0, map->instance_descriptors().number_of_slack_descriptors());
   LOG(isolate(), MapDetails(*map));
   return map;
 }
@@ -4168,7 +4023,7 @@ Handle<Map> Factory::CreateClassFunctionMap(Handle<JSFunction> empty_function) {
 Handle<JSPromise> Factory::NewJSPromiseWithoutHook() {
   Handle<JSPromise> promise =
       Handle<JSPromise>::cast(NewJSObject(isolate()->promise_function()));
-  promise->set_reactions_or_result(Smi::kZero);
+  promise->set_reactions_or_result(Smi::zero());
   promise->set_flags(0);
   ZeroEmbedderFields(promise);
   DCHECK_EQ(promise->GetEmbedderFieldCount(), v8::Promise::kEmbedderFieldCount);
@@ -4194,6 +4049,14 @@ Handle<CallHandlerInfo> Factory::NewCallHandlerInfo(bool has_no_side_effect) {
   return info;
 }
 
+bool Factory::CanAllocateInReadOnlySpace() {
+  return isolate()->heap()->CanAllocateInReadOnlySpace();
+}
+
+bool Factory::EmptyStringRootIsInitialized() {
+  return isolate()->roots_table()[RootIndex::kempty_string] != kNullAddress;
+}
+
 // static
 NewFunctionArgs NewFunctionArgs::ForWasm(
     Handle<String> name,
diff --git a/deps/v8/src/heap/factory.h b/deps/v8/src/heap/factory.h
index 35de6425c9af31..877e2f8972793f 100644
--- a/deps/v8/src/heap/factory.h
+++ b/deps/v8/src/heap/factory.h
@@ -12,6 +12,7 @@
 #include "src/execution/messages.h"
 #include "src/handles/handles.h"
 #include "src/handles/maybe-handles.h"
+#include "src/heap/factory-base.h"
 #include "src/heap/heap.h"
 #include "src/objects/code.h"
 #include "src/objects/dictionary.h"
@@ -105,9 +106,24 @@ enum FunctionMode {
       kWithReadonlyPrototypeBit | kWithNameBit,
 };
 
+class Factory;
+
+template <>
+struct FactoryTraits<Factory> {
+  template <typename T>
+  using HandleType = Handle<T>;
+  template <typename T>
+  using MaybeHandleType = v8::internal::MaybeHandle<T>;
+};
+
 // Interface for handle based allocation.
-class V8_EXPORT_PRIVATE Factory {
+class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
  public:
+  inline ReadOnlyRoots read_only_roots();
+  template <typename T>
+  Handle<T> MakeHandle(T obj) {
+    return handle(obj, isolate());
+  }
   Handle<Oddball> NewOddball(Handle<Map> map, const char* to_string,
                              Handle<Object> to_number, const char* type_of,
                              byte kind);
@@ -225,6 +241,9 @@ class V8_EXPORT_PRIVATE Factory {
   // Create a pre-tenured empty AccessorPair.
   Handle<AccessorPair> NewAccessorPair();
 
+  // Create a new PropertyDescriptorObject struct.
+  Handle<PropertyDescriptorObject> NewPropertyDescriptorObject();
+
   // Finds the internalized copy for string in the string table.
   // If not found, a new string is added to the table and returned.
   Handle<String> InternalizeUtf8String(const Vector<const char>& str);
@@ -308,18 +327,6 @@ class V8_EXPORT_PRIVATE Factory {
 
   Handle<JSStringIterator> NewJSStringIterator(Handle<String> string);
 
-  Handle<String> NewOneByteInternalizedString(const Vector<const uint8_t>& str,
-                                              uint32_t hash_field);
-
-  Handle<SeqOneByteString> AllocateRawOneByteInternalizedString(
-      int length, uint32_t hash_field);
-
-  Handle<String> NewTwoByteInternalizedString(const Vector<const uc16>& str,
-                                              uint32_t hash_field);
-
-  Handle<SeqTwoByteString> AllocateRawTwoByteInternalizedString(
-      int length, uint32_t hash_field);
-
   Handle<String> NewInternalizedStringImpl(Handle<String> string, int chars,
                                            uint32_t hash_field);
 
@@ -333,26 +340,10 @@ class V8_EXPORT_PRIVATE Factory {
   template <class StringClass>
   Handle<StringClass> InternalizeExternalString(Handle<String> string);
 
-  // Allocates and partially initializes an one-byte or two-byte String. The
-  // characters of the string are uninitialized. Currently used in regexp code
-  // only, where they are pretenured.
-  V8_WARN_UNUSED_RESULT MaybeHandle<SeqOneByteString> NewRawOneByteString(
-      int length, AllocationType allocation = AllocationType::kYoung);
-  V8_WARN_UNUSED_RESULT MaybeHandle<SeqTwoByteString> NewRawTwoByteString(
-      int length, AllocationType allocation = AllocationType::kYoung);
-
   // Creates a single character string where the character has given code.
   // A cache is used for Latin1 codes.
   Handle<String> LookupSingleCharacterStringFromCode(uint16_t code);
 
-  // Create a new cons string object which consists of a pair of strings.
-  V8_WARN_UNUSED_RESULT MaybeHandle<String> NewConsString(Handle<String> left,
-                                                          Handle<String> right);
-
-  V8_WARN_UNUSED_RESULT Handle<String> NewConsString(Handle<String> left,
-                                                     Handle<String> right,
-                                                     int length, bool one_byte);
-
   // Create or lookup a single characters tring made up of a utf16 surrogate
   // pair.
   Handle<String> NewSurrogatePairString(uint16_t lead, uint16_t trail);
@@ -372,10 +363,6 @@ class V8_EXPORT_PRIVATE Factory {
       const ExternalOneByteString::Resource* resource);
   V8_WARN_UNUSED_RESULT MaybeHandle<String> NewExternalStringFromTwoByte(
       const ExternalTwoByteString::Resource* resource);
-  // Create a new external string object for one-byte encoded native script.
-  // It does not cache the resource data pointer.
-  Handle<ExternalOneByteString> NewNativeSourceString(
-      const ExternalOneByteString::Resource* resource);
 
   // Create a symbol in old or read-only space.
   Handle<Symbol> NewSymbol(AllocationType allocation = AllocationType::kOld);
@@ -448,10 +435,6 @@ class V8_EXPORT_PRIVATE Factory {
                                              int index);
   Handle<StackFrameInfo> NewStackFrameInfo(Handle<FrameArray> frame_array,
                                            int index);
-  Handle<SourcePositionTableWithFrameCache>
-  NewSourcePositionTableWithFrameCache(
-      Handle<ByteArray> source_position_table,
-      Handle<SimpleNumberDictionary> stack_frame_cache);
 
   // Allocate various microtasks.
   Handle<CallableTask> NewCallableTask(Handle<JSReceiver> callable,
@@ -522,6 +505,9 @@ class V8_EXPORT_PRIVATE Factory {
   Handle<FixedArray> CopyFixedArrayAndGrow(Handle<FixedArray> array,
                                            int grow_by);
 
+  Handle<WeakArrayList> NewWeakArrayList(
+      int capacity, AllocationType allocation = AllocationType::kYoung);
+
   Handle<WeakFixedArray> CopyWeakFixedArrayAndGrow(Handle<WeakFixedArray> array,
                                                    int grow_by);
 
@@ -529,6 +515,10 @@ class V8_EXPORT_PRIVATE Factory {
       Handle<WeakArrayList> array, int grow_by,
       AllocationType allocation = AllocationType::kYoung);
 
+  Handle<WeakArrayList> CompactWeakArrayList(
+      Handle<WeakArrayList> array, int new_capacity,
+      AllocationType allocation = AllocationType::kYoung);
+
   Handle<PropertyArray> CopyPropertyArrayAndGrow(Handle<PropertyArray> array,
                                                  int grow_by);
 
@@ -780,24 +770,24 @@ class V8_EXPORT_PRIVATE Factory {
   Handle<BytecodeArray> CopyBytecodeArray(Handle<BytecodeArray>);
 
   // Interface for creating error objects.
-  Handle<Object> NewError(Handle<JSFunction> constructor,
-                          Handle<String> message);
+  Handle<JSObject> NewError(Handle<JSFunction> constructor,
+                            Handle<String> message);
 
   Handle<Object> NewInvalidStringLengthError();
 
   inline Handle<Object> NewURIError();
 
-  Handle<Object> NewError(Handle<JSFunction> constructor,
-                          MessageTemplate template_index,
-                          Handle<Object> arg0 = Handle<Object>(),
-                          Handle<Object> arg1 = Handle<Object>(),
-                          Handle<Object> arg2 = Handle<Object>());
-
-#define DECLARE_ERROR(NAME)                                        \
-  Handle<Object> New##NAME(MessageTemplate template_index,         \
-                           Handle<Object> arg0 = Handle<Object>(), \
-                           Handle<Object> arg1 = Handle<Object>(), \
-                           Handle<Object> arg2 = Handle<Object>());
+  Handle<JSObject> NewError(Handle<JSFunction> constructor,
+                            MessageTemplate template_index,
+                            Handle<Object> arg0 = Handle<Object>(),
+                            Handle<Object> arg1 = Handle<Object>(),
+                            Handle<Object> arg2 = Handle<Object>());
+
+#define DECLARE_ERROR(NAME)                                          \
+  Handle<JSObject> New##NAME(MessageTemplate template_index,         \
+                             Handle<Object> arg0 = Handle<Object>(), \
+                             Handle<Object> arg1 = Handle<Object>(), \
+                             Handle<Object> arg2 = Handle<Object>());
   DECLARE_ERROR(Error)
   DECLARE_ERROR(EvalError)
   DECLARE_ERROR(RangeError)
@@ -810,9 +800,15 @@ class V8_EXPORT_PRIVATE Factory {
 #undef DECLARE_ERROR
 
   Handle<String> NumberToString(Handle<Object> number, bool check_cache = true);
-  Handle<String> NumberToString(Smi number, bool check_cache = true);
-
-  inline Handle<String> Uint32ToString(uint32_t value, bool check_cache = true);
+  Handle<String> SmiToString(Smi number, bool check_cache = true);
+  Handle<String> HeapNumberToString(Handle<HeapNumber> number, double value,
+                                    bool check_cache = true);
+
+  Handle<String> SizeToString(size_t value, bool check_cache = true);
+  inline Handle<String> Uint32ToString(uint32_t value,
+                                       bool check_cache = true) {
+    return SizeToString(value, check_cache);
+  }
 
 #define ROOT_ACCESSOR(Type, name, CamelName) inline Handle<Type> name();
   ROOT_LIST(ROOT_ACCESSOR)
@@ -889,7 +885,7 @@ class V8_EXPORT_PRIVATE Factory {
   // irregexp regexp and stores it in the regexp.
   void SetRegExpIrregexpData(Handle<JSRegExp> regexp, JSRegExp::Type type,
                              Handle<String> source, JSRegExp::Flags flags,
-                             int capture_count);
+                             int capture_count, uint32_t backtrack_limit);
 
   // Returns the value for a known global constant (a property of the global
   // object which is neither configurable nor writable) like 'undefined'.
@@ -961,6 +957,11 @@ class V8_EXPORT_PRIVATE Factory {
       return *this;
     }
 
+    CodeBuilder& set_is_executable(bool executable) {
+      is_executable_ = executable;
+      return *this;
+    }
+
     // Indicates the CodeDataContainer should be allocated in read-only space.
     // As an optimization, if the kind-specific flags match that of a canonical
     // container, it will be used instead.
@@ -988,6 +989,7 @@ class V8_EXPORT_PRIVATE Factory {
     Handle<ByteArray> source_position_table_;
     Handle<DeoptimizationData> deoptimization_data_ =
         DeoptimizationData::Empty(isolate_);
+    bool is_executable_ = true;
     bool read_only_data_container_ = false;
     bool is_movable_ = true;
     bool is_turbofanned_ = false;
@@ -995,6 +997,19 @@ class V8_EXPORT_PRIVATE Factory {
   };
 
  private:
+  friend class FactoryBase<Factory>;
+
+  // ------
+  // Customization points for FactoryBase
+  HeapObject AllocateRaw(int size, AllocationType allocation,
+                         AllocationAlignment alignment = kWordAligned);
+  template <typename T>
+  inline MaybeHandle<T> Throw(Handle<Object> exception);
+  [[noreturn]] void FatalProcessOutOfHeapMemory(const char* location);
+  bool CanAllocateInReadOnlySpace();
+  bool EmptyStringRootIsInitialized();
+  // ------
+
   Isolate* isolate() {
     // Downcast to the privately inherited sub-class using c-style casts to
     // avoid undefined behavior (as static_cast cannot cast across private
@@ -1003,9 +1018,6 @@ class V8_EXPORT_PRIVATE Factory {
     return (Isolate*)this;  // NOLINT(readability/casting)
   }
 
-  HeapObject AllocateRawWithImmortalMap(
-      int size, AllocationType allocation, Map map,
-      AllocationAlignment alignment = kWordAligned);
   HeapObject AllocateRawWithAllocationSite(
       Handle<Map> map, AllocationType allocation,
       Handle<AllocationSite> allocation_site);
@@ -1025,7 +1037,7 @@ class V8_EXPORT_PRIVATE Factory {
   // Allocates new context with given map, sets length and initializes the
   // after-header part with uninitialized values and leaves the context header
   // uninitialized.
-  Handle<Context> NewContext(RootIndex map_root_index, int size,
+  Handle<Context> NewContext(Handle<Map> map, int size,
                              int variadic_part_length,
                              AllocationType allocation);
 
@@ -1053,6 +1065,8 @@ class V8_EXPORT_PRIVATE Factory {
   MaybeHandle<String> NewStringFromTwoByte(const uc16* string, int length,
                                            AllocationType allocation);
 
+  Handle<String> MakeOrFindTwoCharacterString(uint16_t c1, uint16_t c2);
+
   // Attempt to find the number in a small cache.  If we finds it, return
   // the string representation of the number.  Otherwise return undefined.
   Handle<Object> NumberToStringCacheGet(Object number, int hash);
@@ -1075,6 +1089,7 @@ class V8_EXPORT_PRIVATE Factory {
       ElementsKind elements_kind, int capacity,
       ArrayStorageAllocationMode mode = DONT_INITIALIZE_ARRAY_ELEMENTS);
 
+  Handle<SharedFunctionInfo> NewSharedFunctionInfo();
   Handle<SharedFunctionInfo> NewSharedFunctionInfo(
       MaybeHandle<String> name, MaybeHandle<HeapObject> maybe_function_data,
       int maybe_builtin_index, FunctionKind kind = kNormalFunction);
@@ -1088,6 +1103,10 @@ class V8_EXPORT_PRIVATE Factory {
   // Initializes JSObject body starting at given offset.
   void InitializeJSObjectBody(Handle<JSObject> obj, Handle<Map> map,
                               int start_offset);
+
+ private:
+  Handle<WeakArrayList> NewUninitializedWeakArrayList(
+      int capacity, AllocationType allocation = AllocationType::kYoung);
 };
 
 // Utility class to simplify argument handling around JSFunction creation.
diff --git a/deps/v8/src/heap/gc-tracer.cc b/deps/v8/src/heap/gc-tracer.cc
index 85152c7bfe2975..b165b69882b44d 100644
--- a/deps/v8/src/heap/gc-tracer.cc
+++ b/deps/v8/src/heap/gc-tracer.cc
@@ -562,14 +562,17 @@ void GCTracer::PrintNVP() const {
           "heap.external.epilogue=%.2f "
           "heap.external_weak_global_handles=%.2f "
           "fast_promote=%.2f "
+          "complete.sweep_array_buffers=%.2f "
           "scavenge=%.2f "
           "scavenge.process_array_buffers=%.2f "
+          "scavenge.free_remembered_set=%.2f "
           "scavenge.roots=%.2f "
           "scavenge.weak=%.2f "
           "scavenge.weak_global_handles.identify=%.2f "
           "scavenge.weak_global_handles.process=%.2f "
           "scavenge.parallel=%.2f "
           "scavenge.update_refs=%.2f "
+          "scavenge.sweep_array_buffers=%.2f "
           "background.scavenge.parallel=%.2f "
           "background.array_buffer_free=%.2f "
           "background.store_buffer=%.2f "
@@ -601,9 +604,11 @@ void GCTracer::PrintNVP() const {
           current_.scopes[Scope::HEAP_EXTERNAL_PROLOGUE],
           current_.scopes[Scope::HEAP_EXTERNAL_EPILOGUE],
           current_.scopes[Scope::HEAP_EXTERNAL_WEAK_GLOBAL_HANDLES],
+          current_.scopes[Scope::SCAVENGER_SWEEP_ARRAY_BUFFERS],
           current_.scopes[Scope::SCAVENGER_FAST_PROMOTE],
           current_.scopes[Scope::SCAVENGER_SCAVENGE],
           current_.scopes[Scope::SCAVENGER_PROCESS_ARRAY_BUFFERS],
+          current_.scopes[Scope::SCAVENGER_FREE_REMEMBERED_SET],
           current_.scopes[Scope::SCAVENGER_SCAVENGE_ROOTS],
           current_.scopes[Scope::SCAVENGER_SCAVENGE_WEAK],
           current_
@@ -612,6 +617,7 @@ void GCTracer::PrintNVP() const {
               .scopes[Scope::SCAVENGER_SCAVENGE_WEAK_GLOBAL_HANDLES_PROCESS],
           current_.scopes[Scope::SCAVENGER_SCAVENGE_PARALLEL],
           current_.scopes[Scope::SCAVENGER_SCAVENGE_UPDATE_REFS],
+          current_.scopes[Scope::SCAVENGER_SWEEP_ARRAY_BUFFERS],
           current_.scopes[Scope::SCAVENGER_BACKGROUND_SCAVENGE_PARALLEL],
           current_.scopes[Scope::BACKGROUND_ARRAY_BUFFER_FREE],
           current_.scopes[Scope::BACKGROUND_STORE_BUFFER],
@@ -710,6 +716,7 @@ void GCTracer::PrintNVP() const {
           "clear.weak_collections=%.1f "
           "clear.weak_lists=%.1f "
           "clear.weak_references=%.1f "
+          "complete.sweep_array_buffers=%.1f "
           "epilogue=%.1f "
           "evacuate=%.1f "
           "evacuate.candidates=%.1f "
@@ -724,6 +731,7 @@ void GCTracer::PrintNVP() const {
           "evacuate.update_pointers.slots.map_space=%.1f "
           "evacuate.update_pointers.weak=%.1f "
           "finish=%.1f "
+          "finish.sweep_array_buffers=%.1f "
           "mark=%.1f "
           "mark.finish_incremental=%.1f "
           "mark.roots=%.1f "
@@ -749,6 +757,7 @@ void GCTracer::PrintNVP() const {
           "incremental.finalize.external.epilogue=%.1f "
           "incremental.layout_change=%.1f "
           "incremental.start=%.1f "
+          "incremental.sweep_array_buffers=%.1f "
           "incremental.sweeping=%.1f "
           "incremental.embedder_prologue=%.1f "
           "incremental.embedder_tracing=%.1f "
@@ -801,6 +810,7 @@ void GCTracer::PrintNVP() const {
           current_.scopes[Scope::MC_CLEAR_WEAK_COLLECTIONS],
           current_.scopes[Scope::MC_CLEAR_WEAK_LISTS],
           current_.scopes[Scope::MC_CLEAR_WEAK_REFERENCES],
+          current_.scopes[Scope::MC_COMPLETE_SWEEP_ARRAY_BUFFERS],
           current_.scopes[Scope::MC_EPILOGUE],
           current_.scopes[Scope::MC_EVACUATE],
           current_.scopes[Scope::MC_EVACUATE_CANDIDATES],
@@ -814,7 +824,9 @@ void GCTracer::PrintNVP() const {
           current_.scopes[Scope::MC_EVACUATE_UPDATE_POINTERS_SLOTS_MAIN],
           current_.scopes[Scope::MC_EVACUATE_UPDATE_POINTERS_SLOTS_MAP_SPACE],
           current_.scopes[Scope::MC_EVACUATE_UPDATE_POINTERS_WEAK],
-          current_.scopes[Scope::MC_FINISH], current_.scopes[Scope::MC_MARK],
+          current_.scopes[Scope::MC_FINISH],
+          current_.scopes[Scope::MC_FINISH_SWEEP_ARRAY_BUFFERS],
+          current_.scopes[Scope::MC_MARK],
           current_.scopes[Scope::MC_MARK_FINISH_INCREMENTAL],
           current_.scopes[Scope::MC_MARK_ROOTS],
           current_.scopes[Scope::MC_MARK_MAIN],
@@ -838,6 +850,7 @@ void GCTracer::PrintNVP() const {
           current_.scopes[Scope::MC_INCREMENTAL_EXTERNAL_EPILOGUE],
           current_.scopes[Scope::MC_INCREMENTAL_LAYOUT_CHANGE],
           current_.scopes[Scope::MC_INCREMENTAL_START],
+          current_.scopes[Scope::MC_INCREMENTAL_SWEEP_ARRAY_BUFFERS],
           current_.scopes[Scope::MC_INCREMENTAL_SWEEPING],
           current_.scopes[Scope::MC_INCREMENTAL_EMBEDDER_PROLOGUE],
           current_.scopes[Scope::MC_INCREMENTAL_EMBEDDER_TRACING],
diff --git a/deps/v8/src/heap/heap-controller.h b/deps/v8/src/heap/heap-controller.h
index d4a3534cd7d734..82ee033684d89a 100644
--- a/deps/v8/src/heap/heap-controller.h
+++ b/deps/v8/src/heap/heap-controller.h
@@ -14,8 +14,8 @@ namespace v8 {
 namespace internal {
 
 struct BaseControllerTrait {
-  static constexpr size_t kMinSize = 128u * Heap::kPointerMultiplier * MB;
-  static constexpr size_t kMaxSize = 1024u * Heap::kPointerMultiplier * MB;
+  static constexpr size_t kMinSize = 128u * Heap::kHeapLimitMultiplier * MB;
+  static constexpr size_t kMaxSize = 1024u * Heap::kHeapLimitMultiplier * MB;
 
   static constexpr double kMinGrowingFactor = 1.1;
   static constexpr double kMaxGrowingFactor = 4.0;
diff --git a/deps/v8/src/heap/heap-inl.h b/deps/v8/src/heap/heap-inl.h
index 56f3590b8aa8da..0e5230f1e05d22 100644
--- a/deps/v8/src/heap/heap-inl.h
+++ b/deps/v8/src/heap/heap-inl.h
@@ -12,12 +12,13 @@
 // write barrier here!
 #include "src/heap/heap-write-barrier.h"
 #include "src/heap/heap.h"
+#include "src/heap/third-party/heap-api.h"
 
 #include "src/base/atomic-utils.h"
 #include "src/base/platform/platform.h"
 #include "src/objects/feedback-vector.h"
 
-// TODO(mstarzinger): There is one more include to remove in order to no longer
+// TODO(gc): There is one more include to remove in order to no longer
 // leak heap internals to users of this interface!
 #include "src/execution/isolate-data.h"
 #include "src/execution/isolate.h"
@@ -159,6 +160,8 @@ AllocationResult Heap::AllocateRaw(int size_in_bytes, AllocationType type,
                                    AllocationAlignment alignment) {
   DCHECK(AllowHandleAllocation::IsAllowed());
   DCHECK(AllowHeapAllocation::IsAllowed());
+  DCHECK_IMPLIES(type == AllocationType::kCode,
+                 alignment == AllocationAlignment::kCodeAligned);
   DCHECK_EQ(gc_state_, NOT_IN_GC);
 #ifdef V8_ENABLE_ALLOCATION_TIMEOUT
   if (FLAG_random_gc_interval > 0 || FLAG_gc_interval >= 0) {
@@ -180,47 +183,51 @@ AllocationResult Heap::AllocateRaw(int size_in_bytes, AllocationType type,
     type = AllocationType::kOld;
   }
 
-  if (AllocationType::kYoung == type) {
-    if (large_object) {
-      if (FLAG_young_generation_large_objects) {
-        allocation = new_lo_space_->AllocateRaw(size_in_bytes);
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    allocation = tp_heap_->Allocate(size_in_bytes, type, alignment);
+  } else {
+    if (AllocationType::kYoung == type) {
+      if (large_object) {
+        if (FLAG_young_generation_large_objects) {
+          allocation = new_lo_space_->AllocateRaw(size_in_bytes);
+        } else {
+          // If young generation large objects are disalbed we have to tenure
+          // the allocation and violate the given allocation type. This could be
+          // dangerous. We may want to remove
+          // FLAG_young_generation_large_objects and avoid patching.
+          allocation = lo_space_->AllocateRaw(size_in_bytes);
+        }
       } else {
-        // If young generation large objects are disalbed we have to tenure the
-        // allocation and violate the given allocation type. This could be
-        // dangerous. We may want to remove FLAG_young_generation_large_objects
-        // and avoid patching.
+        allocation = new_space_->AllocateRaw(size_in_bytes, alignment, origin);
+      }
+    } else if (AllocationType::kOld == type) {
+      if (large_object) {
         allocation = lo_space_->AllocateRaw(size_in_bytes);
+      } else {
+        allocation = old_space_->AllocateRaw(size_in_bytes, alignment, origin);
       }
+    } else if (AllocationType::kCode == type) {
+      if (size_in_bytes <= code_space()->AreaSize() && !large_object) {
+        allocation = code_space_->AllocateRawUnaligned(size_in_bytes);
+      } else {
+        allocation = code_lo_space_->AllocateRaw(size_in_bytes);
+      }
+    } else if (AllocationType::kMap == type) {
+      allocation = map_space_->AllocateRawUnaligned(size_in_bytes);
+    } else if (AllocationType::kReadOnly == type) {
+      DCHECK(isolate_->serializer_enabled());
+      DCHECK(!large_object);
+      DCHECK(CanAllocateInReadOnlySpace());
+      DCHECK_EQ(AllocationOrigin::kRuntime, origin);
+      allocation =
+          read_only_space_->AllocateRaw(size_in_bytes, alignment, origin);
     } else {
-      allocation = new_space_->AllocateRaw(size_in_bytes, alignment, origin);
-    }
-  } else if (AllocationType::kOld == type) {
-    if (large_object) {
-      allocation = lo_space_->AllocateRaw(size_in_bytes);
-    } else {
-      allocation = old_space_->AllocateRaw(size_in_bytes, alignment, origin);
-    }
-  } else if (AllocationType::kCode == type) {
-    if (size_in_bytes <= code_space()->AreaSize() && !large_object) {
-      allocation = code_space_->AllocateRawUnaligned(size_in_bytes);
-    } else {
-      allocation = code_lo_space_->AllocateRaw(size_in_bytes);
+      UNREACHABLE();
     }
-  } else if (AllocationType::kMap == type) {
-    allocation = map_space_->AllocateRawUnaligned(size_in_bytes);
-  } else if (AllocationType::kReadOnly == type) {
-    DCHECK(isolate_->serializer_enabled());
-    DCHECK(!large_object);
-    DCHECK(CanAllocateInReadOnlySpace());
-    DCHECK_EQ(AllocationOrigin::kRuntime, origin);
-    allocation =
-        read_only_space_->AllocateRaw(size_in_bytes, alignment, origin);
-  } else {
-    UNREACHABLE();
   }
 
   if (allocation.To(&object)) {
-    if (AllocationType::kCode == type) {
+    if (AllocationType::kCode == type && !V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
       // Unprotect the memory chunk of the object if it was not unprotected
       // already.
       UnprotectAndRegisterMemoryChunk(object);
@@ -241,6 +248,11 @@ template <Heap::AllocationRetryMode mode>
 HeapObject Heap::AllocateRawWith(int size, AllocationType allocation,
                                  AllocationOrigin origin,
                                  AllocationAlignment alignment) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    AllocationResult result = AllocateRaw(size, allocation, origin, alignment);
+    DCHECK(!result.IsRetry());
+    return result.ToObjectChecked();
+  }
   DCHECK(AllowHandleAllocation::IsAllowed());
   DCHECK(AllowHeapAllocation::IsAllowed());
   DCHECK_EQ(gc_state_, NOT_IN_GC);
@@ -271,6 +283,16 @@ HeapObject Heap::AllocateRawWith(int size, AllocationType allocation,
   UNREACHABLE();
 }
 
+Address Heap::DeserializerAllocate(AllocationType type, int size_in_bytes) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    AllocationResult allocation = tp_heap_->Allocate(
+        size_in_bytes, type, AllocationAlignment::kWordAligned);
+    return allocation.ToObjectChecked().ptr();
+  } else {
+    UNIMPLEMENTED();  // unimplemented
+  }
+}
+
 void Heap::OnAllocationEvent(HeapObject object, int size_in_bytes) {
   for (auto& tracker : allocation_trackers_) {
     tracker->AllocationEvent(object.address(), size_in_bytes);
@@ -356,6 +378,7 @@ bool Heap::InYoungGeneration(MaybeObject object) {
 
 // static
 bool Heap::InYoungGeneration(HeapObject heap_object) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) return false;
   bool result = MemoryChunk::FromHeapObject(heap_object)->InYoungGeneration();
 #ifdef DEBUG
   // If in the young generation, then check we're either not in the middle of
@@ -408,6 +431,9 @@ bool Heap::InOldSpace(Object object) { return old_space_->Contains(object); }
 
 // static
 Heap* Heap::FromWritableHeapObject(HeapObject obj) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    return Heap::GetIsolateFromWritableObject(obj)->heap();
+  }
   MemoryChunk* chunk = MemoryChunk::FromHeapObject(obj);
   // RO_SPACE can be shared between heaps, so we can't use RO_SPACE objects to
   // find a heap. The exception is when the ReadOnlySpace is writeable, during
@@ -640,6 +666,14 @@ CodePageCollectionMemoryModificationScope::
   }
 }
 
+#ifdef V8_ENABLE_THIRD_PARTY_HEAP
+CodePageMemoryModificationScope::CodePageMemoryModificationScope(Code code)
+    : chunk_(nullptr), scope_active_(false) {}
+#else
+CodePageMemoryModificationScope::CodePageMemoryModificationScope(Code code)
+    : CodePageMemoryModificationScope(MemoryChunk::FromHeapObject(code)) {}
+#endif
+
 CodePageMemoryModificationScope::CodePageMemoryModificationScope(
     MemoryChunk* chunk)
     : chunk_(chunk),
diff --git a/deps/v8/src/heap/heap-write-barrier-inl.h b/deps/v8/src/heap/heap-write-barrier-inl.h
index a0d9902006f553..7b1438e6a3f1a5 100644
--- a/deps/v8/src/heap/heap-write-barrier-inl.h
+++ b/deps/v8/src/heap/heap-write-barrier-inl.h
@@ -29,6 +29,10 @@ V8_EXPORT_PRIVATE void Heap_GenerationalBarrierSlow(HeapObject object,
 V8_EXPORT_PRIVATE void Heap_MarkingBarrierSlow(HeapObject object, Address slot,
                                                HeapObject value);
 V8_EXPORT_PRIVATE void Heap_WriteBarrierForCodeSlow(Code host);
+
+V8_EXPORT_PRIVATE void Heap_MarkingBarrierForArrayBufferExtensionSlow(
+    HeapObject object, ArrayBufferExtension* extension);
+
 V8_EXPORT_PRIVATE void Heap_GenerationalBarrierForCodeSlow(Code host,
                                                            RelocInfo* rinfo,
                                                            HeapObject object);
@@ -63,6 +67,7 @@ struct MemoryChunk {
   V8_INLINE bool IsMarking() const { return GetFlags() & kMarkingBit; }
 
   V8_INLINE bool InYoungGeneration() const {
+    if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) return false;
     constexpr uintptr_t kYoungGenerationMask = kFromPageBit | kToPageBit;
     return GetFlags() & kYoungGenerationMask;
   }
@@ -131,26 +136,45 @@ inline void MarkingBarrierInternal(HeapObject object, Address slot,
 inline void WriteBarrierForCode(Code host, RelocInfo* rinfo, Object value) {
   DCHECK(!HasWeakHeapObjectTag(value));
   if (!value.IsHeapObject()) return;
-  HeapObject object = HeapObject::cast(value);
-  GenerationalBarrierForCode(host, rinfo, object);
-  MarkingBarrierForCode(host, rinfo, object);
+  WriteBarrierForCode(host, rinfo, HeapObject::cast(value));
+}
+
+inline void WriteBarrierForCode(Code host, RelocInfo* rinfo, HeapObject value) {
+  GenerationalBarrierForCode(host, rinfo, value);
+  MarkingBarrierForCode(host, rinfo, value);
 }
 
 inline void WriteBarrierForCode(Code host) {
   Heap_WriteBarrierForCodeSlow(host);
 }
 
+inline void MarkingBarrierForArrayBufferExtension(
+    HeapObject object, ArrayBufferExtension* extension) {
+  heap_internals::MemoryChunk* object_chunk =
+      heap_internals::MemoryChunk::FromHeapObject(object);
+  if (!extension || !object_chunk->IsMarking()) return;
+  Heap_MarkingBarrierForArrayBufferExtensionSlow(object, extension);
+}
+
 inline void GenerationalBarrier(HeapObject object, ObjectSlot slot,
                                 Object value) {
-  DCHECK(!HasWeakHeapObjectTag(*slot));
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) return;
   DCHECK(!HasWeakHeapObjectTag(value));
   if (!value.IsHeapObject()) return;
+  GenerationalBarrier(object, slot, HeapObject::cast(value));
+}
+
+inline void GenerationalBarrier(HeapObject object, ObjectSlot slot,
+                                HeapObject value) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) return;
+  DCHECK(!HasWeakHeapObjectTag(*slot));
   heap_internals::GenerationalBarrierInternal(object, slot.address(),
                                               HeapObject::cast(value));
 }
 
 inline void GenerationalEphemeronKeyBarrier(EphemeronHashTable table,
                                             ObjectSlot slot, Object value) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) return;
   DCHECK(!HasWeakHeapObjectTag(*slot));
   DCHECK(!HasWeakHeapObjectTag(value));
   DCHECK(value.IsHeapObject());
@@ -160,6 +184,7 @@ inline void GenerationalEphemeronKeyBarrier(EphemeronHashTable table,
 
 inline void GenerationalBarrier(HeapObject object, MaybeObjectSlot slot,
                                 MaybeObject value) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) return;
   HeapObject value_heap_object;
   if (!value->GetHeapObject(&value_heap_object)) return;
   heap_internals::GenerationalBarrierInternal(object, slot.address(),
@@ -168,6 +193,7 @@ inline void GenerationalBarrier(HeapObject object, MaybeObjectSlot slot,
 
 inline void GenerationalBarrierForCode(Code host, RelocInfo* rinfo,
                                        HeapObject object) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) return;
   heap_internals::MemoryChunk* object_chunk =
       heap_internals::MemoryChunk::FromHeapObject(object);
   if (!object_chunk->InYoungGeneration()) return;
@@ -175,15 +201,23 @@ inline void GenerationalBarrierForCode(Code host, RelocInfo* rinfo,
 }
 
 inline void MarkingBarrier(HeapObject object, ObjectSlot slot, Object value) {
-  DCHECK_IMPLIES(slot.address() != kNullAddress, !HasWeakHeapObjectTag(*slot));
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) return;
   DCHECK(!HasWeakHeapObjectTag(value));
   if (!value.IsHeapObject()) return;
+  MarkingBarrier(object, slot, HeapObject::cast(value));
+}
+
+inline void MarkingBarrier(HeapObject object, ObjectSlot slot,
+                           HeapObject value) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) return;
+  DCHECK_IMPLIES(slot.address() != kNullAddress, !HasWeakHeapObjectTag(*slot));
   heap_internals::MarkingBarrierInternal(object, slot.address(),
                                          HeapObject::cast(value));
 }
 
 inline void MarkingBarrier(HeapObject object, MaybeObjectSlot slot,
                            MaybeObject value) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) return;
   HeapObject value_heap_object;
   if (!value->GetHeapObject(&value_heap_object)) return;
   heap_internals::MarkingBarrierInternal(object, slot.address(),
@@ -192,6 +226,7 @@ inline void MarkingBarrier(HeapObject object, MaybeObjectSlot slot,
 
 inline void MarkingBarrierForCode(Code host, RelocInfo* rinfo,
                                   HeapObject object) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) return;
   DCHECK(!HasWeakHeapObjectTag(object));
   heap_internals::MemoryChunk* object_chunk =
       heap_internals::MemoryChunk::FromHeapObject(object);
@@ -202,6 +237,7 @@ inline void MarkingBarrierForCode(Code host, RelocInfo* rinfo,
 inline void MarkingBarrierForDescriptorArray(Heap* heap, HeapObject host,
                                              HeapObject descriptor_array,
                                              int number_of_own_descriptors) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) return;
   heap_internals::MemoryChunk* chunk =
       heap_internals::MemoryChunk::FromHeapObject(descriptor_array);
   if (!chunk->IsMarking()) return;
diff --git a/deps/v8/src/heap/heap-write-barrier.h b/deps/v8/src/heap/heap-write-barrier.h
index 1126fd6f4be1c8..14cd51a0bb31ad 100644
--- a/deps/v8/src/heap/heap-write-barrier.h
+++ b/deps/v8/src/heap/heap-write-barrier.h
@@ -11,6 +11,7 @@
 namespace v8 {
 namespace internal {
 
+class ArrayBufferExtension;
 class Code;
 class FixedArray;
 class Heap;
@@ -22,10 +23,12 @@ class EphemeronHashTable;
 
 // Combined write barriers.
 void WriteBarrierForCode(Code host, RelocInfo* rinfo, Object value);
+void WriteBarrierForCode(Code host, RelocInfo* rinfo, HeapObject value);
 void WriteBarrierForCode(Code host);
 
 // Generational write barrier.
 void GenerationalBarrier(HeapObject object, ObjectSlot slot, Object value);
+void GenerationalBarrier(HeapObject object, ObjectSlot slot, HeapObject value);
 void GenerationalBarrier(HeapObject object, MaybeObjectSlot slot,
                          MaybeObject value);
 void GenerationalEphemeronKeyBarrier(EphemeronHashTable table, ObjectSlot slot,
@@ -34,9 +37,13 @@ void GenerationalBarrierForCode(Code host, RelocInfo* rinfo, HeapObject object);
 
 // Marking write barrier.
 void MarkingBarrier(HeapObject object, ObjectSlot slot, Object value);
+void MarkingBarrier(HeapObject object, ObjectSlot slot, HeapObject value);
 void MarkingBarrier(HeapObject object, MaybeObjectSlot slot, MaybeObject value);
 void MarkingBarrierForCode(Code host, RelocInfo* rinfo, HeapObject object);
 
+void MarkingBarrierForArrayBufferExtension(HeapObject object,
+                                           ArrayBufferExtension* extension);
+
 void MarkingBarrierForDescriptorArray(Heap* heap, HeapObject host,
                                       HeapObject descriptor_array,
                                       int number_of_own_descriptors);
diff --git a/deps/v8/src/heap/heap.cc b/deps/v8/src/heap/heap.cc
index 7cfc36662d052f..28ff2e970d15a4 100644
--- a/deps/v8/src/heap/heap.cc
+++ b/deps/v8/src/heap/heap.cc
@@ -17,6 +17,7 @@
 #include "src/builtins/accessors.h"
 #include "src/codegen/assembler-inl.h"
 #include "src/codegen/compilation-cache.h"
+#include "src/common/globals.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer/deoptimizer.h"
 #include "src/execution/microtask-queue.h"
@@ -25,6 +26,7 @@
 #include "src/execution/vm-state-inl.h"
 #include "src/handles/global-handles.h"
 #include "src/heap/array-buffer-collector.h"
+#include "src/heap/array-buffer-sweeper.h"
 #include "src/heap/array-buffer-tracker-inl.h"
 #include "src/heap/barrier.h"
 #include "src/heap/code-stats.h"
@@ -66,7 +68,6 @@
 #include "src/objects/slots-inl.h"
 #include "src/regexp/regexp.h"
 #include "src/snapshot/embedded/embedded-data.h"
-#include "src/snapshot/natives.h"
 #include "src/snapshot/serializer-common.h"
 #include "src/snapshot/snapshot.h"
 #include "src/strings/string-stream.h"
@@ -82,6 +83,13 @@
 namespace v8 {
 namespace internal {
 
+#ifdef V8_ENABLE_THIRD_PARTY_HEAP
+Isolate* Heap::GetIsolateFromWritableObject(HeapObject object) {
+  return reinterpret_cast<Isolate*>(
+      third_party_heap::Heap::GetIsolate(object.address()));
+}
+#endif
+
 // These are outside the Heap class so they can be forward-declared
 // in heap-write-barrier-inl.h.
 bool Heap_PageFlagsAreConsistent(HeapObject object) {
@@ -102,6 +110,11 @@ void Heap_WriteBarrierForCodeSlow(Code host) {
   Heap::WriteBarrierForCodeSlow(host);
 }
 
+void Heap_MarkingBarrierForArrayBufferExtensionSlow(
+    HeapObject object, ArrayBufferExtension* extension) {
+  Heap::MarkingBarrierForArrayBufferExtensionSlow(object, extension);
+}
+
 void Heap_GenerationalBarrierForCodeSlow(Code host, RelocInfo* rinfo,
                                          HeapObject object) {
   Heap::GenerationalBarrierForCodeSlow(host, rinfo, object);
@@ -126,22 +139,22 @@ void Heap_GenerationalEphemeronKeyBarrierSlow(Heap* heap,
 }
 
 void Heap::SetArgumentsAdaptorDeoptPCOffset(int pc_offset) {
-  DCHECK_EQ(Smi::kZero, arguments_adaptor_deopt_pc_offset());
+  DCHECK_EQ(Smi::zero(), arguments_adaptor_deopt_pc_offset());
   set_arguments_adaptor_deopt_pc_offset(Smi::FromInt(pc_offset));
 }
 
 void Heap::SetConstructStubCreateDeoptPCOffset(int pc_offset) {
-  DCHECK(construct_stub_create_deopt_pc_offset() == Smi::kZero);
+  DCHECK_EQ(Smi::zero(), construct_stub_create_deopt_pc_offset());
   set_construct_stub_create_deopt_pc_offset(Smi::FromInt(pc_offset));
 }
 
 void Heap::SetConstructStubInvokeDeoptPCOffset(int pc_offset) {
-  DCHECK(construct_stub_invoke_deopt_pc_offset() == Smi::kZero);
+  DCHECK_EQ(Smi::zero(), construct_stub_invoke_deopt_pc_offset());
   set_construct_stub_invoke_deopt_pc_offset(Smi::FromInt(pc_offset));
 }
 
 void Heap::SetInterpreterEntryReturnPCOffset(int pc_offset) {
-  DCHECK_EQ(Smi::kZero, interpreter_entry_return_pc_offset());
+  DCHECK_EQ(Smi::zero(), interpreter_entry_return_pc_offset());
   set_interpreter_entry_return_pc_offset(Smi::FromInt(pc_offset));
 }
 
@@ -190,8 +203,8 @@ Heap::Heap()
   // Ensure old_generation_size_ is a multiple of kPageSize.
   DCHECK_EQ(0, max_old_generation_size_ & (Page::kPageSize - 1));
 
-  set_native_contexts_list(Smi::kZero);
-  set_allocation_sites_list(Smi::kZero);
+  set_native_contexts_list(Smi::zero());
+  set_allocation_sites_list(Smi::zero());
   // Put a dummy entry in the remembered pages so we can find the list the
   // minidump even if there are no real unmapped pages.
   RememberUnmappedPage(kNullAddress, false);
@@ -222,7 +235,7 @@ size_t Heap::HeapSizeFromPhysicalMemory(uint64_t physical_memory) {
   // Compute the old generation size and cap it.
   uint64_t old_generation = physical_memory /
                             kPhysicalMemoryToOldGenerationRatio *
-                            kPointerMultiplier;
+                            kHeapLimitMultiplier;
   old_generation =
       Min<uint64_t>(old_generation, MaxOldGenerationSize(physical_memory));
   old_generation = Max<uint64_t>(old_generation, V8HeapTrait::kMinSize);
@@ -267,18 +280,28 @@ size_t Heap::MinOldGenerationSize() {
   return paged_space_count * Page::kPageSize;
 }
 
+size_t Heap::AllocatorLimitOnMaxOldGenerationSize() {
+#ifdef V8_COMPRESS_POINTERS
+  // Isolate and the young generation are also allocated on the heap.
+  return kPtrComprHeapReservationSize -
+         YoungGenerationSizeFromSemiSpaceSize(kMaxSemiSpaceSize) -
+         RoundUp(sizeof(Isolate), size_t{1} << kPageSizeBits);
+#endif
+  return std::numeric_limits<size_t>::max();
+}
+
 size_t Heap::MaxOldGenerationSize(uint64_t physical_memory) {
   size_t max_size = V8HeapTrait::kMaxSize;
   // Finch experiment: Increase the heap size from 2GB to 4GB for 64-bit
   // systems with physical memory bigger than 16GB. The physical memory
   // is rounded up to GB.
-  constexpr bool x64_bit = Heap::kPointerMultiplier >= 2;
+  constexpr bool x64_bit = Heap::kHeapLimitMultiplier >= 2;
   if (FLAG_huge_max_old_generation_size && x64_bit &&
       (physical_memory + 512 * MB) / GB >= 16) {
     DCHECK_EQ(max_size / GB, 2);
     max_size *= 2;
   }
-  return max_size;
+  return Min(max_size, AllocatorLimitOnMaxOldGenerationSize());
 }
 
 size_t Heap::YoungGenerationSizeFromSemiSpaceSize(size_t semi_space_size) {
@@ -653,7 +676,9 @@ void Heap::ReportStatisticsAfterGC() {
 
 void Heap::AddHeapObjectAllocationTracker(
     HeapObjectAllocationTracker* tracker) {
-  if (allocation_trackers_.empty()) DisableInlineAllocation();
+  if (allocation_trackers_.empty() && FLAG_inline_new) {
+    DisableInlineAllocation();
+  }
   allocation_trackers_.push_back(tracker);
 }
 
@@ -662,7 +687,9 @@ void Heap::RemoveHeapObjectAllocationTracker(
   allocation_trackers_.erase(std::remove(allocation_trackers_.begin(),
                                          allocation_trackers_.end(), tracker),
                              allocation_trackers_.end());
-  if (allocation_trackers_.empty()) EnableInlineAllocation();
+  if (allocation_trackers_.empty() && FLAG_inline_new) {
+    EnableInlineAllocation();
+  }
 }
 
 void Heap::AddRetainingPathTarget(Handle<HeapObject> object,
@@ -1055,8 +1082,7 @@ void Heap::ProcessPretenuringFeedback() {
 }
 
 void Heap::InvalidateCodeDeoptimizationData(Code code) {
-  MemoryChunk* chunk = MemoryChunk::FromHeapObject(code);
-  CodePageMemoryModificationScope modification_scope(chunk);
+  CodePageMemoryModificationScope modification_scope(code);
   code.set_deoptimization_data(ReadOnlyRoots(this).empty_fixed_array());
 }
 
@@ -1393,7 +1419,7 @@ void Heap::CollectAllAvailableGarbage(GarbageCollectionReason gc_reason) {
     PagedSpaceIterator spaces(this);
     for (PagedSpace* space = spaces.Next(); space != nullptr;
          space = spaces.Next()) {
-      PagedSpaceObjectIterator it(space);
+      PagedSpaceObjectIterator it(this, space);
       for (HeapObject obj = it.Next(); !obj.is_null(); obj = it.Next()) {
         objects_by_size[obj.Size()].push_back(obj);
       }
@@ -1477,6 +1503,19 @@ void Heap::EnsureFillerObjectAtTop() {
   }
 }
 
+Heap::DevToolsTraceEventScope::DevToolsTraceEventScope(Heap* heap,
+                                                       const char* event_name,
+                                                       const char* event_type)
+    : heap_(heap), event_name_(event_name) {
+  TRACE_EVENT_BEGIN2("devtools.timeline,v8", event_name_, "usedHeapSizeBefore",
+                     heap_->SizeOfObjects(), "type", event_type);
+}
+
+Heap::DevToolsTraceEventScope::~DevToolsTraceEventScope() {
+  TRACE_EVENT_END1("devtools.timeline,v8", event_name_, "usedHeapSizeAfter",
+                   heap_->SizeOfObjects());
+}
+
 bool Heap::CollectGarbage(AllocationSpace space,
                           GarbageCollectionReason gc_reason,
                           const v8::GCCallbackFlags gc_callback_flags) {
@@ -1484,11 +1523,20 @@ bool Heap::CollectGarbage(AllocationSpace space,
   GarbageCollector collector = SelectGarbageCollector(space, &collector_reason);
   is_current_gc_forced_ = gc_callback_flags & v8::kGCCallbackFlagForced;
 
+  DevToolsTraceEventScope devtools_trace_event_scope(
+      this, IsYoungGenerationCollector(collector) ? "MinorGC" : "MajorGC",
+      GarbageCollectionReasonToString(gc_reason));
+
   if (!CanExpandOldGeneration(new_space()->Capacity() +
                               new_lo_space()->Size())) {
     InvokeNearHeapLimitCallback();
   }
 
+  // Filter on-stack reference below this method.
+  isolate()
+      ->global_handles()
+      ->CleanupOnStackReferencesBelowCurrentStackPosition();
+
   // Ensure that all pending phantom callbacks are invoked.
   isolate()->global_handles()->InvokeSecondPassPhantomCallbacks();
 
@@ -1911,6 +1959,10 @@ bool Heap::PerformGarbageCollection(
     GarbageCollector collector, const v8::GCCallbackFlags gc_callback_flags) {
   DisallowJavascriptExecution no_js(isolate());
 
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    return tp_heap_->CollectGarbage();
+  }
+
   size_t freed_global_handles = 0;
 
   if (!IsYoungGenerationCollector(collector)) {
@@ -2502,8 +2554,8 @@ void Heap::ExternalStringTable::UpdateYoungReferences(
     Heap::ExternalStringTableUpdaterCallback updater_func) {
   if (young_strings_.empty()) return;
 
-  FullObjectSlot start(&young_strings_[0]);
-  FullObjectSlot end(&young_strings_[young_strings_.size()]);
+  FullObjectSlot start(young_strings_.data());
+  FullObjectSlot end(young_strings_.data() + young_strings_.size());
   FullObjectSlot last = start;
 
   for (FullObjectSlot p = start; p < end; ++p) {
@@ -2864,7 +2916,8 @@ HeapObject Heap::CreateFillerObjectAt(Address addr, int size,
                    (size / kTaggedSize) - 2);
     }
   }
-  if (clear_slots_mode == ClearRecordedSlots::kYes) {
+  if (clear_slots_mode == ClearRecordedSlots::kYes &&
+      !V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
     ClearRecordedSlotRange(addr, addr + size);
   }
 
@@ -2889,6 +2942,12 @@ bool Heap::CanMoveObjectStart(HeapObject object) {
 }
 
 bool Heap::IsImmovable(HeapObject object) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    // TODO(steveblackburn): For now all objects are immovable.
+    // Will need to revisit once moving is supported.
+    return true;
+  }
+
   MemoryChunk* chunk = MemoryChunk::FromHeapObject(object);
   return chunk->NeverEvacuate() || IsLargeObject(object);
 }
@@ -3302,11 +3361,12 @@ void Heap::FinalizeIncrementalMarkingIfComplete(
   if (incremental_marking()->IsMarking() &&
       (incremental_marking()->IsReadyToOverApproximateWeakClosure() ||
        (!incremental_marking()->finalize_marking_completed() &&
-        mark_compact_collector()->marking_worklist()->IsEmpty() &&
+        mark_compact_collector()->marking_worklists()->IsEmpty() &&
         local_embedder_heap_tracer()->ShouldFinalizeIncrementalMarking()))) {
     FinalizeIncrementalMarkingIncrementally(gc_reason);
   } else if (incremental_marking()->IsComplete() ||
-             (mark_compact_collector()->marking_worklist()->IsEmpty() &&
+             (incremental_marking()->IsMarking() &&
+              mark_compact_collector()->marking_worklists()->IsEmpty() &&
               local_embedder_heap_tracer()
                   ->ShouldFinalizeIncrementalMarking())) {
     CollectAllGarbage(current_gc_flags_, gc_reason, current_gc_callback_flags_);
@@ -3327,6 +3387,9 @@ void Heap::FinalizeIncrementalMarkingIncrementally(
         Heap::GarbageCollectionReasonToString(gc_reason));
   }
 
+  DevToolsTraceEventScope devtools_trace_event_scope(
+      this, "MajorGC", "incremental finalization step");
+
   HistogramTimerScope incremental_marking_scope(
       isolate()->counters()->gc_incremental_marking_finalize());
   TRACE_EVENT0("v8", "V8.GCIncrementalMarkingFinalize");
@@ -3742,6 +3805,11 @@ void Heap::RemoveNearHeapLimitCallback(v8::NearHeapLimitCallback callback,
   UNREACHABLE();
 }
 
+void Heap::AppendArrayBufferExtension(JSArrayBuffer object,
+                                      ArrayBufferExtension* extension) {
+  array_buffer_sweeper_->Append(object, extension);
+}
+
 void Heap::AutomaticallyRestoreInitialHeapLimit(double threshold_percent) {
   initial_max_old_generation_size_threshold_ =
       initial_max_old_generation_size_ * threshold_percent;
@@ -3756,16 +3824,34 @@ bool Heap::InvokeNearHeapLimitCallback() {
     size_t heap_limit = callback(data, max_old_generation_size_,
                                  initial_max_old_generation_size_);
     if (heap_limit > max_old_generation_size_) {
-      max_old_generation_size_ = heap_limit;
+      max_old_generation_size_ =
+          Min(heap_limit, AllocatorLimitOnMaxOldGenerationSize());
       return true;
     }
   }
   return false;
 }
 
-Handle<JSPromise> Heap::MeasureMemory(Handle<NativeContext> context,
-                                      v8::MeasureMemoryMode mode) {
-  return memory_measurement_->EnqueueRequest(context, mode);
+bool Heap::MeasureMemory(std::unique_ptr<v8::MeasureMemoryDelegate> delegate,
+                         v8::MeasureMemoryExecution execution) {
+  HandleScope handle_scope(isolate());
+  std::vector<Handle<NativeContext>> contexts = FindAllNativeContexts();
+  std::vector<Handle<NativeContext>> to_measure;
+  for (auto& current : contexts) {
+    if (delegate->ShouldMeasure(
+            v8::Utils::ToLocal(Handle<Context>::cast(current)))) {
+      to_measure.push_back(current);
+    }
+  }
+  return memory_measurement_->EnqueueRequest(std::move(delegate), execution,
+                                             to_measure);
+}
+
+std::unique_ptr<v8::MeasureMemoryDelegate> Heap::MeasureMemoryDelegate(
+    Handle<NativeContext> context, Handle<JSPromise> promise,
+    v8::MeasureMemoryMode mode) {
+  return i::MemoryMeasurement::DefaultDelegate(isolate_, context, promise,
+                                               mode);
 }
 
 void Heap::CollectCodeStatistics() {
@@ -3847,6 +3933,8 @@ const char* Heap::GarbageCollectionReasonToString(
       return "external finalize";
     case GarbageCollectionReason::kGlobalAllocationLimit:
       return "global allocation limit";
+    case GarbageCollectionReason::kMeasureMemory:
+      return "measure memory";
     case GarbageCollectionReason::kUnknown:
       return "unknown";
   }
@@ -3854,6 +3942,9 @@ const char* Heap::GarbageCollectionReasonToString(
 }
 
 bool Heap::Contains(HeapObject value) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    return true;
+  }
   if (ReadOnlyHeap::Contains(value)) {
     return false;
   }
@@ -3994,14 +4085,8 @@ void Heap::Verify() {
 
 void Heap::VerifyReadOnlyHeap() {
   CHECK(!read_only_space_->writable());
-  // TODO(v8:7464): Always verify read-only space once PagedSpace::Verify
-  // supports verifying shared read-only space. Currently
-  // PagedSpaceObjectIterator is explicitly disabled for read-only space when
-  // sharing is enabled, because it relies on PagedSpace::heap_ being non-null.
-#ifndef V8_SHARED_RO_HEAP
   VerifyReadOnlyPointersVisitor read_only_visitor(this);
   read_only_space_->Verify(isolate(), &read_only_visitor);
-#endif
 }
 
 class SlotVerifyingVisitor : public ObjectVisitor {
@@ -4094,8 +4179,8 @@ class OldToNewSlotVerifyingVisitor : public SlotVerifyingVisitor {
         CHECK(it != ephemeron_remembered_set_->end());
         int slot_index =
             EphemeronHashTable::SlotToIndex(table.address(), key.address());
-        int entry = EphemeronHashTable::IndexToEntry(slot_index);
-        CHECK(it->second.find(entry) != it->second.end());
+        InternalIndex entry = EphemeronHashTable::IndexToEntry(slot_index);
+        CHECK(it->second.find(entry.as_int()) != it->second.end());
       }
     }
   }
@@ -4164,7 +4249,7 @@ void Heap::VerifyCountersAfterSweeping() {
   PagedSpaceIterator spaces(this);
   for (PagedSpace* space = spaces.Next(); space != nullptr;
        space = spaces.Next()) {
-    space->VerifyCountersAfterSweeping();
+    space->VerifyCountersAfterSweeping(this);
   }
 }
 
@@ -4270,10 +4355,10 @@ class FixStaleLeftTrimmedHandlesVisitor : public RootVisitor {
     if (!(*p).IsHeapObject()) return;
     HeapObject current = HeapObject::cast(*p);
     const MapWord map_word = current.map_word();
-    if (!map_word.IsForwardingAddress() && current.IsFiller()) {
+    if (!map_word.IsForwardingAddress() && current.IsFreeSpaceOrFiller()) {
 #ifdef DEBUG
       // We need to find a FixedArrayBase map after walking the fillers.
-      while (current.IsFiller()) {
+      while (current.IsFreeSpaceOrFiller()) {
         Address next = current.ptr();
         if (current.map() == ReadOnlyRoots(heap_).one_pointer_filler_map()) {
           next += kTaggedSize;
@@ -4287,7 +4372,7 @@ class FixStaleLeftTrimmedHandlesVisitor : public RootVisitor {
       }
       DCHECK(current.IsFixedArrayBase());
 #endif  // DEBUG
-      p.store(Smi::kZero);
+      p.store(Smi::zero());
     }
   }
 
@@ -4305,8 +4390,10 @@ void Heap::IterateStrongRoots(RootVisitor* v, VisitMode mode) {
 
   isolate_->bootstrapper()->Iterate(v);
   v->Synchronize(VisitorSynchronization::kBootstrapper);
-  isolate_->Iterate(v);
-  v->Synchronize(VisitorSynchronization::kTop);
+  if (mode != VISIT_ONLY_STRONG_IGNORE_STACK) {
+    isolate_->Iterate(v);
+    v->Synchronize(VisitorSynchronization::kTop);
+  }
   Relocatable::Iterate(isolate_, v);
   v->Synchronize(VisitorSynchronization::kRelocatable);
   isolate_->debug()->Iterate(v);
@@ -4323,23 +4410,11 @@ void Heap::IterateStrongRoots(RootVisitor* v, VisitMode mode) {
   isolate_->IterateDeferredHandles(v);
   v->Synchronize(VisitorSynchronization::kHandleScope);
 
-  // Iterate over the builtin code objects and code stubs in the
-  // heap. Note that it is not necessary to iterate over code objects
-  // on scavenge collections.
+  // Iterate over the builtin code objects in the heap. Note that it is not
+  // necessary to iterate over code objects on scavenge collections.
   if (!isMinorGC) {
     IterateBuiltins(v);
     v->Synchronize(VisitorSynchronization::kBuiltins);
-
-    // The dispatch table is set up directly from the builtins using
-    // IntitializeDispatchTable so there is no need to iterate to create it.
-    if (mode != VISIT_FOR_SERIALIZATION) {
-      // Currently we iterate the dispatch table to update pointers to possibly
-      // moved Code objects for bytecode handlers.
-      // TODO(v8:6666): Remove iteration once builtins are embedded (and thus
-      // immovable) in every build configuration.
-      isolate_->interpreter()->IterateDispatchTable(v);
-      v->Synchronize(VisitorSynchronization::kDispatchTable);
-    }
   }
 
   // Iterate over global handles.
@@ -4349,6 +4424,7 @@ void Heap::IterateStrongRoots(RootVisitor* v, VisitMode mode) {
       // global handles need to be added manually.
       break;
     case VISIT_ONLY_STRONG:
+    case VISIT_ONLY_STRONG_IGNORE_STACK:
       isolate_->global_handles()->IterateStrongRoots(v);
       break;
     case VISIT_ALL_IN_SCAVENGE:
@@ -4413,15 +4489,9 @@ void Heap::IterateBuiltins(RootVisitor* v) {
     v->VisitRootPointer(Root::kBuiltins, Builtins::name(i),
                         FullObjectSlot(builtin_address(i)));
   }
-#ifdef V8_EMBEDDED_BUILTINS
-  // The entry table does not need to be updated if all builtins are embedded.
+
+  // The entry table doesn't need to be updated since all builtins are embedded.
   STATIC_ASSERT(Builtins::AllBuiltinsAreIsolateIndependent());
-#else
-  // If builtins are not embedded, they may move and thus the entry table must
-  // be updated.
-  // TODO(v8:6666): Remove once builtins are embedded unconditionally.
-  Builtins::UpdateBuiltinEntryTable(isolate());
-#endif  // V8_EMBEDDED_BUILTINS
 }
 
 namespace {
@@ -4461,14 +4531,11 @@ void Heap::ConfigureHeap(const v8::ResourceConstraints& constraints) {
       // This will cause more frequent GCs when stressing.
       max_semi_space_size_ = MB;
     }
-    // The new space size must be a power of two to support single-bit testing
-    // for containment.
-    // TODO(ulan): Rounding to a power of 2 is not longer needed. Remove it.
+    // TODO(dinfuehr): Rounding to a power of 2 is not longer needed. Remove it.
     max_semi_space_size_ =
         static_cast<size_t>(base::bits::RoundUpToPowerOfTwo64(
             static_cast<uint64_t>(max_semi_space_size_)));
     max_semi_space_size_ = Max(max_semi_space_size_, kMinSemiSpaceSize);
-    max_semi_space_size_ = Min(max_semi_space_size_, kMaxSemiSpaceSize);
     max_semi_space_size_ = RoundDown<Page::kPageSize>(max_semi_space_size_);
   }
 
@@ -4491,6 +4558,8 @@ void Heap::ConfigureHeap(const v8::ResourceConstraints& constraints) {
     }
     max_old_generation_size_ =
         Max(max_old_generation_size_, MinOldGenerationSize());
+    max_old_generation_size_ =
+        Min(max_old_generation_size_, AllocatorLimitOnMaxOldGenerationSize());
     max_old_generation_size_ =
         RoundDown<Page::kPageSize>(max_old_generation_size_);
 
@@ -4580,7 +4649,7 @@ void Heap::ConfigureHeap(const v8::ResourceConstraints& constraints) {
 
   // We rely on being able to allocate new arrays in paged spaces.
   DCHECK(kMaxRegularHeapObjectSize >=
-         (JSArray::kSize +
+         (JSArray::kHeaderSize +
           FixedArray::SizeFor(JSArray::kInitialMaxFastElementArray) +
           AllocationMemento::kSize));
 
@@ -4651,15 +4720,6 @@ void Heap::RecordStats(HeapStats* stats, bool take_snapshot) {
   }
   if (stats->last_few_messages != nullptr)
     GetFromRingBuffer(stats->last_few_messages);
-  if (stats->js_stacktrace != nullptr) {
-    FixedStringAllocator fixed(stats->js_stacktrace, kStacktraceBufferSize - 1);
-    StringStream accumulator(&fixed, StringStream::kPrintObjectConcise);
-    if (gc_state() == Heap::NOT_IN_GC) {
-      isolate()->PrintStack(&accumulator, Isolate::kPrintStackVerbose);
-    } else {
-      accumulator.Add("Cannot get stack trace in GC.");
-    }
-  }
 }
 
 size_t Heap::OldGenerationSizeOfObjects() {
@@ -4891,7 +4951,9 @@ HeapObject Heap::EnsureImmovableCode(HeapObject heap_object, int object_size) {
   // in the first page of code space, in large object space, or (during
   // snapshot creation) the containing page is marked as immovable.
   DCHECK(!heap_object.is_null());
+#ifndef V8_ENABLE_THIRD_PARTY_HEAP
   DCHECK(code_space_->Contains(heap_object));
+#endif
   DCHECK_GE(object_size, 0);
   if (!Heap::IsImmovable(heap_object)) {
     if (isolate()->serializer_enabled() ||
@@ -4995,6 +5057,11 @@ void Heap::SetUp() {
   allocation_timeout_ = NextAllocationTimeout();
 #endif
 
+#ifdef V8_ENABLE_THIRD_PARTY_HEAP
+  tp_heap_ =
+      third_party_heap::Heap::New(reinterpret_cast<v8::Isolate*>(isolate()));
+#endif
+
   // Initialize heap spaces and initial maps and objects.
   //
   // If the heap is not yet configured (e.g. through the API), configure it.
@@ -5016,18 +5083,14 @@ void Heap::SetUp() {
   scavenger_collector_.reset(new ScavengerCollector(this));
 
   incremental_marking_.reset(
-      new IncrementalMarking(this, mark_compact_collector_->marking_worklist(),
-                             mark_compact_collector_->weak_objects()));
+      new IncrementalMarking(this, mark_compact_collector_->weak_objects()));
 
   if (FLAG_concurrent_marking || FLAG_parallel_marking) {
-    MarkCompactCollector::MarkingWorklist* marking_worklist =
-        mark_compact_collector_->marking_worklist();
     concurrent_marking_.reset(new ConcurrentMarking(
-        this, marking_worklist->shared(), marking_worklist->on_hold(),
-        mark_compact_collector_->weak_objects(), marking_worklist->embedder()));
+        this, mark_compact_collector_->marking_worklists_holder(),
+        mark_compact_collector_->weak_objects()));
   } else {
-    concurrent_marking_.reset(
-        new ConcurrentMarking(this, nullptr, nullptr, nullptr, nullptr));
+    concurrent_marking_.reset(new ConcurrentMarking(this, nullptr, nullptr));
   }
 
   for (int i = FIRST_SPACE; i <= LAST_SPACE; i++) {
@@ -5051,7 +5114,7 @@ void Heap::SetUpSpaces() {
   space_[OLD_SPACE] = old_space_ = new OldSpace(this);
   space_[CODE_SPACE] = code_space_ = new CodeSpace(this);
   space_[MAP_SPACE] = map_space_ = new MapSpace(this);
-  space_[LO_SPACE] = lo_space_ = new LargeObjectSpace(this);
+  space_[LO_SPACE] = lo_space_ = new OldLargeObjectSpace(this);
   space_[NEW_LO_SPACE] = new_lo_space_ =
       new NewLargeObjectSpace(this, new_space_->Capacity());
   space_[CODE_LO_SPACE] = code_lo_space_ = new CodeLargeObjectSpace(this);
@@ -5068,6 +5131,7 @@ void Heap::SetUpSpaces() {
   minor_mark_compact_collector_ = nullptr;
 #endif  // ENABLE_MINOR_MC
   array_buffer_collector_.reset(new ArrayBufferCollector(this));
+  array_buffer_sweeper_.reset(new ArrayBufferSweeper(this));
   gc_idle_time_handler_.reset(new GCIdleTimeHandler());
   memory_measurement_.reset(new MemoryMeasurement(isolate()));
   memory_reducer_.reset(new MemoryReducer(this));
@@ -5192,6 +5256,20 @@ void Heap::NotifyOldGenerationExpansion() {
   }
 }
 
+void Heap::NotifyOffThreadSpaceMerged() {
+  // TODO(leszeks): Ideally we would do this check during off-thread page
+  // allocation too, to proactively do GC. We should also probably do this check
+  // before merging rather than after.
+  if (!CanExpandOldGeneration(0)) {
+    // TODO(leszeks): We should try to invoke the near-heap limit callback and
+    // do a last-resort GC first.
+    FatalProcessOutOfMemory("Failed to merge off-thread pages into heap.");
+  }
+  StartIncrementalMarkingIfAllocationLimitIsReached(
+      GCFlagsForIncrementalMarking(), kGCCallbackScheduleIdleGarbageCollection);
+  NotifyOldGenerationExpansion();
+}
+
 void Heap::SetEmbedderHeapTracer(EmbedderHeapTracer* tracer) {
   DCHECK_EQ(gc_state_, HeapState::NOT_IN_GC);
   local_embedder_heap_tracer()->SetRemoteTracer(tracer);
@@ -5208,10 +5286,13 @@ EmbedderHeapTracer::TraceFlags Heap::flags_for_embedder_tracer() const {
 }
 
 void Heap::RegisterExternallyReferencedObject(Address* location) {
-  // The embedder is not aware of whether numbers are materialized as heap
-  // objects are just passed around as Smis.
+  GlobalHandles::MarkTraced(location);
   Object object(*location);
-  if (!object.IsHeapObject()) return;
+  if (!object.IsHeapObject()) {
+    // The embedder is not aware of whether numbers are materialized as heap
+    // objects are just passed around as Smis.
+    return;
+  }
   HeapObject heap_object = HeapObject::cast(object);
   DCHECK(IsValidHeapObject(this, heap_object));
   if (FLAG_incremental_marking_wrappers && incremental_marking()->IsMarking()) {
@@ -5222,15 +5303,23 @@ void Heap::RegisterExternallyReferencedObject(Address* location) {
   }
 }
 
-void Heap::StartTearDown() { SetGCState(TEAR_DOWN); }
-
-void Heap::TearDown() {
-  DCHECK_EQ(gc_state_, TEAR_DOWN);
+void Heap::StartTearDown() {
+  SetGCState(TEAR_DOWN);
 #ifdef VERIFY_HEAP
+  // {StartTearDown} is called fairly early during Isolate teardown, so it's
+  // a good time to run heap verification (if requested), before starting to
+  // tear down parts of the Isolate.
   if (FLAG_verify_heap) {
     Verify();
   }
 #endif
+}
+
+void Heap::TearDown() {
+  DCHECK_EQ(gc_state_, TEAR_DOWN);
+
+  // It's too late for Heap::Verify() here, as parts of the Isolate are
+  // already gone by the time this is called.
 
   UpdateMaximumCommitted();
 
@@ -5280,11 +5369,14 @@ void Heap::TearDown() {
 
   scavenger_collector_.reset();
   array_buffer_collector_.reset();
+  array_buffer_sweeper_.reset();
   incremental_marking_.reset();
   concurrent_marking_.reset();
 
   gc_idle_time_handler_.reset();
 
+  memory_measurement_.reset();
+
   if (memory_reducer_ != nullptr) {
     memory_reducer_->TearDown();
     memory_reducer_.reset();
@@ -5427,7 +5519,9 @@ void Heap::CompactWeakArrayLists(AllocationType allocation) {
 
   // Find known WeakArrayLists and compact them.
   Handle<WeakArrayList> scripts(script_list(), isolate());
-  DCHECK_IMPLIES(allocation == AllocationType::kOld, InOldSpace(*scripts));
+  DCHECK_IMPLIES(
+      !V8_ENABLE_THIRD_PARTY_HEAP_BOOL && allocation == AllocationType::kOld,
+      InOldSpace(*scripts));
   scripts = CompactWeakArrayList(this, scripts, allocation);
   set_script_list(*scripts);
 }
@@ -5633,7 +5727,7 @@ class UnreachableObjectsFilter : public HeapObjectsFilter {
   }
 
   bool SkipObject(HeapObject object) override {
-    if (object.IsFiller()) return true;
+    if (object.IsFreeSpaceOrFiller()) return true;
     MemoryChunk* chunk = MemoryChunk::FromHeapObject(object);
     if (reachable_.count(chunk) == 0) return true;
     return reachable_[chunk]->count(object) == 0;
@@ -5745,7 +5839,7 @@ HeapObjectIterator::HeapObjectIterator(
     default:
       break;
   }
-  object_iterator_ = space_iterator_->Next()->GetObjectIterator();
+  object_iterator_ = space_iterator_->Next()->GetObjectIterator(heap_);
 }
 
 HeapObjectIterator::~HeapObjectIterator() {
@@ -5779,7 +5873,7 @@ HeapObject HeapObjectIterator::NextObject() {
   } else {
     // Go though the spaces looking for one that has objects.
     while (space_iterator_->HasNext()) {
-      object_iterator_ = space_iterator_->Next()->GetObjectIterator();
+      object_iterator_ = space_iterator_->Next()->GetObjectIterator(heap_);
       obj = object_iterator_.get()->Next();
       if (!obj.is_null()) {
         return obj;
@@ -6000,6 +6094,17 @@ size_t Heap::NumberOfNativeContexts() {
   return result;
 }
 
+std::vector<Handle<NativeContext>> Heap::FindAllNativeContexts() {
+  std::vector<Handle<NativeContext>> result;
+  Object context = native_contexts_list();
+  while (!context.IsUndefined(isolate())) {
+    NativeContext native_context = NativeContext::cast(context);
+    result.push_back(handle(native_context, isolate()));
+    context = native_context.next_context_link();
+  }
+  return result;
+}
+
 size_t Heap::NumberOfDetachedContexts() {
   // The detached_contexts() array has two entries per detached context.
   return detached_contexts().length() / 2;
@@ -6157,22 +6262,48 @@ Code Heap::GcSafeFindCodeForInnerPointer(Address inner_pointer) {
   Code code = InstructionStream::TryLookupCode(isolate(), inner_pointer);
   if (!code.is_null()) return code;
 
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    Address start = tp_heap_->GetObjectFromInnerPointer(inner_pointer);
+    return GcSafeCastToCode(HeapObject::FromAddress(start), inner_pointer);
+  }
+
   // Check if the inner pointer points into a large object chunk.
   LargePage* large_page = code_lo_space()->FindPage(inner_pointer);
   if (large_page != nullptr) {
     return GcSafeCastToCode(large_page->GetObject(), inner_pointer);
   }
 
-  DCHECK(code_space()->Contains(inner_pointer));
+  if (V8_LIKELY(code_space()->Contains(inner_pointer))) {
+    // Iterate through the page until we reach the end or find an object
+    // starting after the inner pointer.
+    Page* page = Page::FromAddress(inner_pointer);
 
-  // Iterate through the page until we reach the end or find an object starting
-  // after the inner pointer.
-  Page* page = Page::FromAddress(inner_pointer);
+    Address start =
+        page->GetCodeObjectRegistry()->GetCodeObjectStartFromInnerAddress(
+            inner_pointer);
+    return GcSafeCastToCode(HeapObject::FromAddress(start), inner_pointer);
+  }
+
+  // It can only fall through to here during debugging, where for instance "jco"
+  // was called on an address within a RO_SPACE builtin. It cannot reach here
+  // during stack iteration as RO_SPACE memory is not executable so cannot
+  // appear on the stack as an instruction address.
+  DCHECK(ReadOnlyHeap::Contains(
+      HeapObject::FromAddress(inner_pointer & ~kHeapObjectTagMask)));
 
-  Address start =
-      page->GetCodeObjectRegistry()->GetCodeObjectStartFromInnerAddress(
-          inner_pointer);
-  return GcSafeCastToCode(HeapObject::FromAddress(start), inner_pointer);
+  // TODO(delphick): Possibly optimize this as it iterates over all pages in
+  // RO_SPACE instead of just the one containing the address.
+  ReadOnlyHeapObjectIterator iterator(isolate()->read_only_heap());
+  for (HeapObject object = iterator.Next(); !object.is_null();
+       object = iterator.Next()) {
+    if (!object.IsCode()) continue;
+    Code code = Code::cast(object);
+    if (inner_pointer >= code.address() &&
+        inner_pointer < code.address() + code.Size()) {
+      return code;
+    }
+  }
+  UNREACHABLE();
 }
 
 void Heap::WriteBarrierForCodeSlow(Code code) {
@@ -6183,6 +6314,16 @@ void Heap::WriteBarrierForCodeSlow(Code code) {
   }
 }
 
+void Heap::MarkingBarrierForArrayBufferExtensionSlow(
+    HeapObject object, ArrayBufferExtension* extension) {
+  if (V8_CONCURRENT_MARKING_BOOL || GetIsolateFromWritableObject(object)
+                                        ->heap()
+                                        ->incremental_marking()
+                                        ->marking_state()
+                                        ->IsBlack(object))
+    extension->Mark();
+}
+
 void Heap::GenerationalBarrierSlow(HeapObject object, Address slot,
                                    HeapObject value) {
   MemoryChunk* chunk = MemoryChunk::FromHeapObject(object);
@@ -6192,10 +6333,10 @@ void Heap::GenerationalBarrierSlow(HeapObject object, Address slot,
 void Heap::RecordEphemeronKeyWrite(EphemeronHashTable table, Address slot) {
   DCHECK(ObjectInYoungGeneration(HeapObjectSlot(slot).ToHeapObject()));
   int slot_index = EphemeronHashTable::SlotToIndex(table.address(), slot);
-  int entry = EphemeronHashTable::IndexToEntry(slot_index);
+  InternalIndex entry = EphemeronHashTable::IndexToEntry(slot_index);
   auto it =
       ephemeron_remembered_set_.insert({table, std::unordered_set<int>()});
-  it.first->second.insert(entry);
+  it.first->second.insert(entry.as_int());
 }
 
 void Heap::EphemeronKeyWriteBarrierFromCode(Address raw_object,
@@ -6359,12 +6500,15 @@ void Heap::MarkingBarrierForDescriptorArraySlow(Heap* heap, HeapObject host,
   if (NumberOfMarkedDescriptors::decode(heap->mark_compact_collector()->epoch(),
                                         raw_marked) <
       number_of_own_descriptors) {
-    heap->incremental_marking()->VisitDescriptors(host, descriptor_array,
-                                                  number_of_own_descriptors);
+    heap->mark_compact_collector()->MarkDescriptorArrayFromWriteBarrier(
+        host, descriptor_array, number_of_own_descriptors);
   }
 }
 
 bool Heap::PageFlagsAreConsistent(HeapObject object) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    return true;
+  }
   MemoryChunk* chunk = MemoryChunk::FromHeapObject(object);
   heap_internals::MemoryChunk* slim_chunk =
       heap_internals::MemoryChunk::FromHeapObject(object);
diff --git a/deps/v8/src/heap/heap.h b/deps/v8/src/heap/heap.h
index 877aba01c09aa3..86dbab60a7a070 100644
--- a/deps/v8/src/heap/heap.h
+++ b/deps/v8/src/heap/heap.h
@@ -24,6 +24,7 @@
 #include "src/objects/allocation-site.h"
 #include "src/objects/fixed-array.h"
 #include "src/objects/heap-object.h"
+#include "src/objects/js-array-buffer.h"
 #include "src/objects/objects.h"
 #include "src/objects/smi.h"
 #include "src/objects/string-table.h"
@@ -45,6 +46,10 @@ class HeapTester;
 class TestMemoryAllocatorScope;
 }  // namespace heap
 
+namespace third_party_heap {
+class Heap;
+}
+
 class IncrementalMarking;
 class BackingStore;
 class JSArrayBuffer;
@@ -55,6 +60,7 @@ using v8::MemoryPressureLevel;
 
 class AllocationObserver;
 class ArrayBufferCollector;
+class ArrayBufferSweeper;
 class CodeLargeObjectSpace;
 class ConcurrentMarking;
 class GCIdleTimeHandler;
@@ -97,10 +103,6 @@ enum class ClearFreedMemoryMode { kClearFreedMemory, kDontClearFreedMemory };
 
 enum ExternalBackingStoreType { kArrayBuffer, kExternalString, kNumTypes };
 
-enum class FixedArrayVisitationMode { kRegular, kIncremental };
-
-enum class TraceRetainingPathMode { kEnabled, kDisabled };
-
 enum class RetainingPathOption { kDefault, kTrackEphemeronPath };
 
 enum class AllocationOrigin {
@@ -137,6 +139,7 @@ enum class GarbageCollectionReason {
   kTesting = 21,
   kExternalFinalize = 22,
   kGlobalAllocationLimit = 23,
+  kMeasureMemory = 24
   // If you add new items here, then update the incremental_marking_reason,
   // mark_compact_reason, and scavenge_reason counters in counters.h.
   // Also update src/tools/metrics/histograms/histograms.xml in chromium.
@@ -228,6 +231,18 @@ class Heap {
     TEAR_DOWN
   };
 
+  // Emits GC events for DevTools timeline.
+  class DevToolsTraceEventScope {
+   public:
+    DevToolsTraceEventScope(Heap* heap, const char* event_name,
+                            const char* event_type);
+    ~DevToolsTraceEventScope();
+
+   private:
+    Heap* heap_;
+    const char* event_name_;
+  };
+
   using PretenuringFeedbackMap =
       std::unordered_map<AllocationSite, size_t, Object::Hasher>;
 
@@ -248,19 +263,27 @@ class Heap {
   // Don't apply pointer multiplier on Android since it has no swap space and
   // should instead adapt it's heap size based on available physical memory.
   static const int kPointerMultiplier = 1;
+  static const int kHeapLimitMultiplier = 1;
 #else
-  static const int kPointerMultiplier = i::kTaggedSize / 4;
+  static const int kPointerMultiplier = kTaggedSize / 4;
+  // The heap limit needs to be computed based on the system pointer size
+  // because we want a pointer-compressed heap to have larger limit than
+  // an orinary 32-bit which that is contrained by 2GB virtual address space.
+  static const int kHeapLimitMultiplier = kSystemPointerSize / 4;
 #endif
 
   static const size_t kMaxInitialOldGenerationSize =
-      256 * MB * kPointerMultiplier;
+      256 * MB * kHeapLimitMultiplier;
 
   // These constants control heap configuration based on the physical memory.
   static constexpr size_t kPhysicalMemoryToOldGenerationRatio = 4;
-  static constexpr size_t kOldGenerationToSemiSpaceRatio = 128;
-  static constexpr size_t kOldGenerationToSemiSpaceRatioLowMemory = 256;
+  // Young generation size is the same for compressed heaps and 32-bit heaps.
+  static constexpr size_t kOldGenerationToSemiSpaceRatio =
+      128 * kHeapLimitMultiplier / kPointerMultiplier;
+  static constexpr size_t kOldGenerationToSemiSpaceRatioLowMemory =
+      256 * kHeapLimitMultiplier / kPointerMultiplier;
   static constexpr size_t kOldGenerationLowMemory =
-      128 * MB * kPointerMultiplier;
+      128 * MB * kHeapLimitMultiplier;
   static constexpr size_t kNewLargeObjectSpaceToSemiSpaceRatio = 1;
   static constexpr size_t kMinSemiSpaceSize = 512 * KB * kPointerMultiplier;
   static constexpr size_t kMaxSemiSpaceSize = 8192 * KB * kPointerMultiplier;
@@ -305,7 +328,7 @@ class Heap {
   // writable and reserved to contain unwind information.
   static size_t GetCodeRangeReservedAreaSize();
 
-  void FatalProcessOutOfMemory(const char* location);
+  [[noreturn]] void FatalProcessOutOfMemory(const char* location);
 
   // Checks whether the space is valid.
   static bool IsValidAllocationSpace(AllocationSpace space);
@@ -373,6 +396,10 @@ class Heap {
                                               TSlot end);
 
   V8_EXPORT_PRIVATE static void WriteBarrierForCodeSlow(Code host);
+
+  V8_EXPORT_PRIVATE static void MarkingBarrierForArrayBufferExtensionSlow(
+      HeapObject object, ArrayBufferExtension* extension);
+
   V8_EXPORT_PRIVATE static void GenerationalBarrierSlow(HeapObject object,
                                                         Address slot,
                                                         HeapObject value);
@@ -388,6 +415,10 @@ class Heap {
   V8_EXPORT_PRIVATE static void MarkingBarrierForCodeSlow(Code host,
                                                           RelocInfo* rinfo,
                                                           HeapObject value);
+
+  static void MarkingBarrierForArrayBufferExtension(
+      JSArrayBuffer object, ArrayBufferExtension* extension);
+
   V8_EXPORT_PRIVATE static void MarkingBarrierForDescriptorArraySlow(
       Heap* heap, HeapObject host, HeapObject descriptor_array,
       int number_of_own_descriptors);
@@ -401,6 +432,9 @@ class Heap {
 
   void NotifyOldGenerationExpansion();
 
+  // Notifies the heap that an off-thread space has been merged into it.
+  void NotifyOffThreadSpaceMerged();
+
   inline Address* NewSpaceAllocationTopAddress();
   inline Address* NewSpaceAllocationLimitAddress();
   inline Address* OldSpaceAllocationTopAddress();
@@ -437,6 +471,11 @@ class Heap {
 
   static bool IsLargeObject(HeapObject object);
 
+  // This method supports the deserialization allocator.  All allocations
+  // are word-aligned.  The method should never fail to allocate since the
+  // total space requirements of the deserializer are known at build time.
+  inline Address DeserializerAllocate(AllocationType type, int size_in_bytes);
+
   // Trim the given array from the left. Note that this relocates the object
   // start and hence is only valid if there is only a single reference to it.
   V8_EXPORT_PRIVATE FixedArrayBase LeftTrimFixedArray(FixedArrayBase obj,
@@ -563,12 +602,19 @@ class Heap {
   V8_EXPORT_PRIVATE void AutomaticallyRestoreInitialHeapLimit(
       double threshold_percent);
 
+  void AppendArrayBufferExtension(JSArrayBuffer object,
+                                  ArrayBufferExtension* extension);
+
   V8_EXPORT_PRIVATE double MonotonicallyIncreasingTimeInMs();
 
   void RecordStats(HeapStats* stats, bool take_snapshot = false);
 
-  Handle<JSPromise> MeasureMemory(Handle<NativeContext> context,
-                                  v8::MeasureMemoryMode mode);
+  bool MeasureMemory(std::unique_ptr<v8::MeasureMemoryDelegate> delegate,
+                     v8::MeasureMemoryExecution execution);
+
+  std::unique_ptr<v8::MeasureMemoryDelegate> MeasureMemoryDelegate(
+      Handle<NativeContext> context, Handle<JSPromise> promise,
+      v8::MeasureMemoryMode mode);
 
   // Check new space expansion criteria and expand semispaces if it was hit.
   void CheckNewSpaceExpansionCriteria();
@@ -680,7 +726,7 @@ class Heap {
   OldSpace* old_space() { return old_space_; }
   CodeSpace* code_space() { return code_space_; }
   MapSpace* map_space() { return map_space_; }
-  LargeObjectSpace* lo_space() { return lo_space_; }
+  OldLargeObjectSpace* lo_space() { return lo_space_; }
   CodeLargeObjectSpace* code_lo_space() { return code_lo_space_; }
   NewLargeObjectSpace* new_lo_space() { return new_lo_space_; }
   ReadOnlySpace* read_only_space() { return read_only_space_; }
@@ -713,6 +759,10 @@ class Heap {
     return array_buffer_collector_.get();
   }
 
+  ArrayBufferSweeper* array_buffer_sweeper() {
+    return array_buffer_sweeper_.get();
+  }
+
   // ===========================================================================
   // Root set access. ==========================================================
   // ===========================================================================
@@ -888,7 +938,8 @@ class Heap {
 
   void FinalizeIncrementalMarkingIfComplete(GarbageCollectionReason gc_reason);
   // Synchronously finalizes incremental marking.
-  void FinalizeIncrementalMarkingAtomically(GarbageCollectionReason gc_reason);
+  V8_EXPORT_PRIVATE void FinalizeIncrementalMarkingAtomically(
+      GarbageCollectionReason gc_reason);
 
   void RegisterDeserializedObjectsForBlackAllocation(
       Reservation* reservations, const std::vector<HeapObject>& large_objects,
@@ -1006,7 +1057,7 @@ class Heap {
 
   // Slow methods that can be used for verification as they can also be used
   // with off-heap Addresses.
-  bool InSpaceSlow(Address addr, AllocationSpace space);
+  V8_EXPORT_PRIVATE bool InSpaceSlow(Address addr, AllocationSpace space);
 
   static inline Heap* FromWritableHeapObject(HeapObject obj);
 
@@ -1052,6 +1103,9 @@ class Heap {
   size_t InitialSemiSpaceSize() { return initial_semispace_size_; }
   size_t MaxOldGenerationSize() { return max_old_generation_size_; }
 
+  // Limit on the max old generation size imposed by the underlying allocator.
+  V8_EXPORT_PRIVATE static size_t AllocatorLimitOnMaxOldGenerationSize();
+
   V8_EXPORT_PRIVATE static size_t HeapSizeFromPhysicalMemory(
       uint64_t physical_memory);
   V8_EXPORT_PRIVATE static void GenerationSizesFromHeapSize(
@@ -1369,6 +1423,8 @@ class Heap {
   // Calculates the nof entries for the full sized number to string cache.
   inline int MaxNumberToStringCacheSize() const;
 
+  static Isolate* GetIsolateFromWritableObject(HeapObject object);
+
  private:
   using ExternalStringTableUpdaterCallback = String (*)(Heap* heap,
                                                         FullObjectSlot pointer);
@@ -1811,6 +1867,9 @@ class Heap {
   V8_EXPORT_PRIVATE void IncrementObjectCounters();
 #endif  // DEBUG
 
+  std::vector<Handle<NativeContext>> FindAllNativeContexts();
+  MemoryMeasurement* memory_measurement() { return memory_measurement_.get(); }
+
   // The amount of memory that has been freed concurrently.
   std::atomic<uintptr_t> external_memory_concurrently_freed_{0};
 
@@ -1874,13 +1933,17 @@ class Heap {
   OldSpace* old_space_ = nullptr;
   CodeSpace* code_space_ = nullptr;
   MapSpace* map_space_ = nullptr;
-  LargeObjectSpace* lo_space_ = nullptr;
+  OldLargeObjectSpace* lo_space_ = nullptr;
   CodeLargeObjectSpace* code_lo_space_ = nullptr;
   NewLargeObjectSpace* new_lo_space_ = nullptr;
   ReadOnlySpace* read_only_space_ = nullptr;
   // Map from the space id to the space.
   Space* space_[LAST_SPACE + 1];
 
+  // List for tracking ArrayBufferExtensions
+  ArrayBufferExtension* old_array_buffer_extensions_ = nullptr;
+  ArrayBufferExtension* young_array_buffer_extensions_ = nullptr;
+
   // Determines whether code space is write-protected. This is essentially a
   // race-free copy of the {FLAG_write_protect_code_memory} flag.
   bool write_protect_code_memory_ = false;
@@ -1975,7 +2038,7 @@ class Heap {
   unsigned int maximum_size_scavenges_ = 0;
 
   // Total time spent in GC.
-  double total_gc_time_ms_;
+  double total_gc_time_ms_ = 0.0;
 
   // Last time an idle notification happened.
   double last_idle_notification_time_ = 0.0;
@@ -1988,6 +2051,8 @@ class Heap {
   MinorMarkCompactCollector* minor_mark_compact_collector_ = nullptr;
   std::unique_ptr<ScavengerCollector> scavenger_collector_;
   std::unique_ptr<ArrayBufferCollector> array_buffer_collector_;
+  std::unique_ptr<ArrayBufferSweeper> array_buffer_sweeper_;
+
   std::unique_ptr<MemoryAllocator> memory_allocator_;
   std::unique_ptr<IncrementalMarking> incremental_marking_;
   std::unique_ptr<ConcurrentMarking> concurrent_marking_;
@@ -2084,9 +2149,12 @@ class Heap {
 
   std::vector<HeapObjectAllocationTracker*> allocation_trackers_;
 
+  std::unique_ptr<third_party_heap::Heap> tp_heap_;
+
   // Classes in "heap" can be friends.
   friend class AlwaysAllocateScope;
   friend class ArrayBufferCollector;
+  friend class ArrayBufferSweeper;
   friend class ConcurrentMarking;
   friend class GCCallbacksScope;
   friend class GCTracer;
@@ -2094,10 +2162,9 @@ class Heap {
   friend class IdleScavengeObserver;
   friend class IncrementalMarking;
   friend class IncrementalMarkingJob;
-  friend class LargeObjectSpace;
-  template <FixedArrayVisitationMode fixed_array_mode,
-            TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-  friend class MarkingVisitor;
+  friend class OldLargeObjectSpace;
+  template <typename ConcreteVisitor, typename MarkingState>
+  friend class MarkingVisitorBase;
   friend class MarkCompactCollector;
   friend class MarkCompactCollectorBase;
   friend class MinorMarkCompactCollector;
@@ -2198,6 +2265,7 @@ class CodePageCollectionMemoryModificationScope {
 class CodePageMemoryModificationScope {
  public:
   explicit inline CodePageMemoryModificationScope(MemoryChunk* chunk);
+  explicit inline CodePageMemoryModificationScope(Code object);
   inline ~CodePageMemoryModificationScope();
 
  private:
diff --git a/deps/v8/src/heap/incremental-marking-inl.h b/deps/v8/src/heap/incremental-marking-inl.h
index 325fb07182bacb..904637551d9875 100644
--- a/deps/v8/src/heap/incremental-marking-inl.h
+++ b/deps/v8/src/heap/incremental-marking-inl.h
@@ -66,7 +66,7 @@ void IncrementalMarking::RecordWrite(HeapObject obj, TSlot slot,
 
 bool IncrementalMarking::WhiteToGreyAndPush(HeapObject obj) {
   if (marking_state()->WhiteToGrey(obj)) {
-    marking_worklist()->Push(obj);
+    marking_worklists()->Push(obj);
     return true;
   }
   return false;
diff --git a/deps/v8/src/heap/incremental-marking.cc b/deps/v8/src/heap/incremental-marking.cc
index 2980bdc8d43896..29faad471cf2b2 100644
--- a/deps/v8/src/heap/incremental-marking.cc
+++ b/deps/v8/src/heap/incremental-marking.cc
@@ -6,6 +6,7 @@
 
 #include "src/codegen/compilation-cache.h"
 #include "src/execution/vm-state-inl.h"
+#include "src/heap/array-buffer-sweeper.h"
 #include "src/heap/concurrent-marking.h"
 #include "src/heap/embedder-tracing.h"
 #include "src/heap/gc-idle-time-handler.h"
@@ -13,6 +14,8 @@
 #include "src/heap/heap-inl.h"
 #include "src/heap/incremental-marking-inl.h"
 #include "src/heap/mark-compact-inl.h"
+#include "src/heap/marking-visitor-inl.h"
+#include "src/heap/marking-visitor.h"
 #include "src/heap/object-stats.h"
 #include "src/heap/objects-visiting-inl.h"
 #include "src/heap/objects-visiting.h"
@@ -30,11 +33,6 @@
 namespace v8 {
 namespace internal {
 
-using IncrementalMarkingMarkingVisitor =
-    MarkingVisitor<FixedArrayVisitationMode::kIncremental,
-                   TraceRetainingPathMode::kDisabled,
-                   IncrementalMarking::MarkingState>;
-
 void IncrementalMarking::Observer::Step(int bytes_allocated, Address addr,
                                         size_t size) {
   Heap* heap = incremental_marking_->heap();
@@ -47,11 +45,10 @@ void IncrementalMarking::Observer::Step(int bytes_allocated, Address addr,
   incremental_marking_->EnsureBlackAllocated(addr, size);
 }
 
-IncrementalMarking::IncrementalMarking(
-    Heap* heap, MarkCompactCollector::MarkingWorklist* marking_worklist,
-    WeakObjects* weak_objects)
+IncrementalMarking::IncrementalMarking(Heap* heap,
+                                       WeakObjects* weak_objects)
     : heap_(heap),
-      marking_worklist_(marking_worklist),
+      collector_(heap->mark_compact_collector()),
       weak_objects_(weak_objects),
       initial_old_generation_size_(0),
       bytes_marked_(0),
@@ -66,7 +63,6 @@ IncrementalMarking::IncrementalMarking(
       request_type_(NONE),
       new_generation_observer_(this, kYoungGenerationAllocatedThreshold),
       old_generation_observer_(this, kOldGenerationAllocatedThreshold) {
-  DCHECK_NOT_NULL(marking_worklist_);
   SetState(STOPPED);
 }
 
@@ -74,7 +70,7 @@ void IncrementalMarking::RecordWriteSlow(HeapObject obj, HeapObjectSlot slot,
                                          HeapObject value) {
   if (BaseRecordWrite(obj, value) && slot.address() != kNullAddress) {
     // Object is not going to be rescanned we need to record the slot.
-    heap_->mark_compact_collector()->RecordSlot(obj, slot, value);
+    collector_->RecordSlot(obj, slot, value);
   }
 }
 
@@ -93,7 +89,7 @@ void IncrementalMarking::RecordWriteIntoCode(Code host, RelocInfo* rinfo,
   DCHECK(IsMarking());
   if (BaseRecordWrite(host, value)) {
     // Object is not going to be rescanned.  We need to record the slot.
-    heap_->mark_compact_collector()->RecordRelocSlot(host, rinfo, value);
+    collector_->RecordRelocSlot(host, rinfo, value);
   }
 }
 
@@ -102,9 +98,7 @@ void IncrementalMarking::MarkBlackAndVisitObjectDueToLayoutChange(
   TRACE_EVENT0("v8", "V8.GCIncrementalMarkingLayoutChange");
   TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_INCREMENTAL_LAYOUT_CHANGE);
   marking_state()->WhiteToGrey(obj);
-  if (marking_state()->GreyToBlack(obj)) {
-    RevisitObject(obj);
-  }
+  collector_->VisitObject(obj);
 }
 
 void IncrementalMarking::NotifyLeftTrimming(HeapObject from, HeapObject to) {
@@ -300,7 +294,13 @@ void IncrementalMarking::Start(GarbageCollectionReason gc_reason) {
   should_hurry_ = false;
   was_activated_ = true;
 
-  if (!heap_->mark_compact_collector()->sweeping_in_progress()) {
+  {
+    TRACE_GC(heap()->tracer(),
+             GCTracer::Scope::MC_INCREMENTAL_SWEEP_ARRAY_BUFFERS);
+    heap_->array_buffer_sweeper()->EnsureFinished();
+  }
+
+  if (!collector_->sweeping_in_progress()) {
     StartMarking();
   } else {
     if (FLAG_trace_incremental_marking) {
@@ -331,28 +331,18 @@ void IncrementalMarking::StartMarking() {
     heap()->isolate()->PrintWithTimestamp(
         "[IncrementalMarking] Start marking\n");
   }
-
-  is_compacting_ =
-      !FLAG_never_compact && heap_->mark_compact_collector()->StartCompaction();
+  is_compacting_ = !FLAG_never_compact && collector_->StartCompaction();
+  collector_->StartMarking();
 
   SetState(MARKING);
 
   ActivateIncrementalWriteBarrier();
 
-// Marking bits are cleared by the sweeper.
-#ifdef VERIFY_HEAP
-  if (FLAG_verify_heap) {
-    heap_->mark_compact_collector()->VerifyMarkbitsAreClean();
-  }
-#endif
-
   heap_->isolate()->compilation_cache()->MarkCompactPrologue();
 
   StartBlackAllocation();
 
-  // Mark strong roots grey.
-  IncrementalMarkingRootMarkingVisitor visitor(this);
-  heap_->IterateStrongRoots(&visitor, VISIT_ONLY_STRONG);
+  MarkRoots();
 
   if (FLAG_concurrent_marking && !heap_->IsTearingDown()) {
     heap_->concurrent_marking()->ScheduleTasks();
@@ -427,7 +417,7 @@ void IncrementalMarking::MarkRoots() {
   DCHECK(IsMarking());
 
   IncrementalMarkingRootMarkingVisitor visitor(this);
-  heap_->IterateStrongRoots(&visitor, VISIT_ONLY_STRONG);
+  heap_->IterateStrongRoots(&visitor, VISIT_ONLY_STRONG_IGNORE_STACK);
 }
 
 bool IncrementalMarking::ShouldRetainMap(Map map, int age) {
@@ -527,68 +517,72 @@ void IncrementalMarking::UpdateMarkingWorklistAfterScavenge() {
 #ifdef ENABLE_MINOR_MC
   MinorMarkCompactCollector::MarkingState* minor_marking_state =
       heap()->minor_mark_compact_collector()->marking_state();
-#else
-  void* minor_marking_state = nullptr;
 #endif  // ENABLE_MINOR_MC
 
-  marking_worklist()->Update([
+  collector_->marking_worklists_holder()->Update(
+      [
 #ifdef DEBUG
-                                 // this is referred inside DCHECK.
-                                 this,
+          // this is referred inside DCHECK.
+          this,
 #endif
-                                 filler_map, minor_marking_state](
-                                 HeapObject obj, HeapObject* out) -> bool {
-    DCHECK(obj.IsHeapObject());
-    // Only pointers to from space have to be updated.
-    if (Heap::InFromPage(obj)) {
-      MapWord map_word = obj.map_word();
-      if (!map_word.IsForwardingAddress()) {
-        // There may be objects on the marking deque that do not exist anymore,
-        // e.g. left trimmed objects or objects from the root set (frames).
-        // If these object are dead at scavenging time, their marking deque
-        // entries will not point to forwarding addresses. Hence, we can discard
-        // them.
-        return false;
-      }
-      HeapObject dest = map_word.ToForwardingAddress();
-      DCHECK_IMPLIES(marking_state()->IsWhite(obj), obj.IsFiller());
-      *out = dest;
-      return true;
-    } else if (Heap::InToPage(obj)) {
-      // The object may be on a large page or on a page that was moved in new
-      // space.
-      DCHECK(Heap::IsLargeObject(obj) ||
-             Page::FromHeapObject(obj)->IsFlagSet(Page::SWEEP_TO_ITERATE));
 #ifdef ENABLE_MINOR_MC
-      if (minor_marking_state->IsWhite(obj)) {
-        return false;
-      }
+          minor_marking_state,
+#endif
+          filler_map](HeapObject obj, HeapObject* out) -> bool {
+        DCHECK(obj.IsHeapObject());
+        // Only pointers to from space have to be updated.
+        if (Heap::InFromPage(obj)) {
+          MapWord map_word = obj.map_word();
+          if (!map_word.IsForwardingAddress()) {
+            // There may be objects on the marking deque that do not exist
+            // anymore, e.g. left trimmed objects or objects from the root set
+            // (frames). If these object are dead at scavenging time, their
+            // marking deque entries will not point to forwarding addresses.
+            // Hence, we can discard them.
+            return false;
+          }
+          HeapObject dest = map_word.ToForwardingAddress();
+          DCHECK_IMPLIES(marking_state()->IsWhite(obj),
+                         obj.IsFreeSpaceOrFiller());
+          *out = dest;
+          return true;
+        } else if (Heap::InToPage(obj)) {
+          // The object may be on a large page or on a page that was moved in
+          // new space.
+          DCHECK(Heap::IsLargeObject(obj) ||
+                 Page::FromHeapObject(obj)->IsFlagSet(Page::SWEEP_TO_ITERATE));
+#ifdef ENABLE_MINOR_MC
+          if (minor_marking_state->IsWhite(obj)) {
+            return false;
+          }
 #endif  // ENABLE_MINOR_MC
-      // Either a large object or an object marked by the minor mark-compactor.
-      *out = obj;
-      return true;
-    } else {
-      // The object may be on a page that was moved from new to old space. Only
-      // applicable during minor MC garbage collections.
-      if (Page::FromHeapObject(obj)->IsFlagSet(Page::SWEEP_TO_ITERATE)) {
+        // Either a large object or an object marked by the minor
+        // mark-compactor.
+          *out = obj;
+          return true;
+        } else {
+          // The object may be on a page that was moved from new to old space.
+          // Only applicable during minor MC garbage collections.
+          if (Page::FromHeapObject(obj)->IsFlagSet(Page::SWEEP_TO_ITERATE)) {
 #ifdef ENABLE_MINOR_MC
-        if (minor_marking_state->IsWhite(obj)) {
+            if (minor_marking_state->IsWhite(obj)) {
+              return false;
+            }
+#endif  // ENABLE_MINOR_MC
+            *out = obj;
+            return true;
+          }
+          DCHECK_IMPLIES(marking_state()->IsWhite(obj),
+                         obj.IsFreeSpaceOrFiller());
+          // Skip one word filler objects that appear on the
+          // stack when we perform in place array shift.
+          if (obj.map() != filler_map) {
+            *out = obj;
+            return true;
+          }
           return false;
         }
-#endif  // ENABLE_MINOR_MC
-        *out = obj;
-        return true;
-      }
-      DCHECK_IMPLIES(marking_state()->IsWhite(obj), obj.IsFiller());
-      // Skip one word filler objects that appear on the
-      // stack when we perform in place array shift.
-      if (obj.map() != filler_map) {
-        *out = obj;
-        return true;
-      }
-      return false;
-    }
-  });
+      });
 
   UpdateWeakReferencesAfterScavenge();
 }
@@ -680,84 +674,10 @@ void IncrementalMarking::UpdateMarkedBytesAfterScavenge(
   bytes_marked_ -= Min(bytes_marked_, dead_bytes_in_new_space);
 }
 
-int IncrementalMarking::VisitObject(Map map, HeapObject obj) {
-  DCHECK(marking_state()->IsGrey(obj) || marking_state()->IsBlack(obj));
-  if (!marking_state()->GreyToBlack(obj)) {
-    // The object can already be black in these cases:
-    // 1. The object is a fixed array with the progress bar.
-    // 2. The object is a JSObject that was colored black before
-    //    unsafe layout change.
-    // 3. The object is a string that was colored black before
-    //    unsafe layout change.
-    // 4. The object is materizalized by the deoptimizer.
-    // 5. The object is a descriptor array marked black by
-    //    the descriptor array marking barrier.
-    DCHECK(obj.IsHashTable() || obj.IsPropertyArray() || obj.IsFixedArray() ||
-           obj.IsContext() || obj.IsJSObject() || obj.IsString() ||
-           obj.IsDescriptorArray());
-  }
-  DCHECK(marking_state()->IsBlack(obj));
-  WhiteToGreyAndPush(map);
-  IncrementalMarkingMarkingVisitor visitor(heap()->mark_compact_collector(),
-                                           marking_state());
-  return visitor.Visit(map, obj);
-}
-
 void IncrementalMarking::ProcessBlackAllocatedObject(HeapObject obj) {
   if (IsMarking() && marking_state()->IsBlack(obj)) {
-    RevisitObject(obj);
-  }
-}
-
-void IncrementalMarking::RevisitObject(HeapObject obj) {
-  DCHECK(IsMarking());
-  DCHECK(marking_state()->IsBlack(obj));
-  DCHECK_IMPLIES(MemoryChunk::FromHeapObject(obj)->IsFlagSet(
-                     MemoryChunk::HAS_PROGRESS_BAR),
-                 0u == MemoryChunk::FromHeapObject(obj)->ProgressBar());
-  Map map = obj.map();
-  WhiteToGreyAndPush(map);
-  IncrementalMarkingMarkingVisitor visitor(heap()->mark_compact_collector(),
-                                           marking_state());
-  visitor.Visit(map, obj);
-}
-
-void IncrementalMarking::VisitDescriptors(HeapObject host,
-                                          DescriptorArray descriptors,
-                                          int number_of_own_descriptors) {
-  IncrementalMarkingMarkingVisitor visitor(heap()->mark_compact_collector(),
-                                           marking_state());
-  // This is necessary because the Scavenger records slots only for the
-  // promoted black objects and the marking visitor of DescriptorArray skips
-  // the descriptors marked by the visitor.VisitDescriptors() below.
-  visitor.MarkDescriptorArrayBlack(host, descriptors);
-  visitor.VisitDescriptors(descriptors, number_of_own_descriptors);
-}
-
-intptr_t IncrementalMarking::ProcessMarkingWorklist(
-    intptr_t bytes_to_process, ForceCompletionAction completion) {
-  intptr_t bytes_processed = 0;
-  while (bytes_processed < bytes_to_process || completion == FORCE_COMPLETION) {
-    HeapObject obj = marking_worklist()->Pop();
-    if (obj.is_null()) break;
-    // Left trimming may result in grey or black filler objects on the marking
-    // worklist. Ignore these objects.
-    if (obj.IsFiller()) {
-      // Due to copying mark bits and the fact that grey and black have their
-      // first bit set, one word fillers are always black.
-      DCHECK_IMPLIES(
-          obj.map() == ReadOnlyRoots(heap()).one_pointer_filler_map(),
-          marking_state()->IsBlack(obj));
-      // Other fillers may be black or grey depending on the color of the object
-      // that was trimmed.
-      DCHECK_IMPLIES(
-          obj.map() != ReadOnlyRoots(heap()).one_pointer_filler_map(),
-          marking_state()->IsBlackOrGrey(obj));
-      continue;
-    }
-    bytes_processed += VisitObject(obj.map(), obj);
+    collector_->RevisitObject(obj);
   }
-  return bytes_processed;
 }
 
 StepResult IncrementalMarking::EmbedderStep(double duration_ms) {
@@ -775,7 +695,7 @@ StepResult IncrementalMarking::EmbedderStep(double duration_ms) {
       HeapObject object;
       size_t cnt = 0;
       empty_worklist = true;
-      while (marking_worklist()->embedder()->Pop(0, &object)) {
+      while (marking_worklists()->PopEmbedder(&object)) {
         scope.TracePossibleWrapper(JSObject::cast(object));
         if (++cnt == kObjectsToProcessBeforeInterrupt) {
           cnt = 0;
@@ -798,7 +718,7 @@ void IncrementalMarking::Hurry() {
   // forced e.g. in tests. It should not happen when COMPLETE was set when
   // incremental marking finished and a regular GC was triggered after that
   // because should_hurry_ will force a full GC.
-  if (!marking_worklist()->IsEmpty()) {
+  if (!marking_worklists()->IsEmpty()) {
     double start = 0.0;
     if (FLAG_trace_incremental_marking) {
       start = heap_->MonotonicallyIncreasingTimeInMs();
@@ -806,9 +726,7 @@ void IncrementalMarking::Hurry() {
         heap()->isolate()->PrintWithTimestamp("[IncrementalMarking] Hurry\n");
       }
     }
-    // TODO(gc) hurry can mark objects it encounters black as mutator
-    // was stopped.
-    ProcessMarkingWorklist(0, FORCE_COMPLETION);
+    collector_->ProcessMarkingWorklist(0);
     SetState(COMPLETE);
     if (FLAG_trace_incremental_marking) {
       double end = heap_->MonotonicallyIncreasingTimeInMs();
@@ -986,12 +904,12 @@ StepResult IncrementalMarking::AdvanceWithDeadline(
 
 void IncrementalMarking::FinalizeSweeping() {
   DCHECK(state_ == SWEEPING);
-  if (heap_->mark_compact_collector()->sweeping_in_progress() &&
+  if (collector_->sweeping_in_progress() &&
       (!FLAG_concurrent_sweeping ||
-       !heap_->mark_compact_collector()->sweeper()->AreSweeperTasksRunning())) {
-    heap_->mark_compact_collector()->EnsureSweepingCompleted();
+       !collector_->sweeper()->AreSweeperTasksRunning())) {
+    collector_->EnsureSweepingCompleted();
   }
-  if (!heap_->mark_compact_collector()->sweeping_in_progress()) {
+  if (!collector_->sweeping_in_progress()) {
 #ifdef DEBUG
     heap_->VerifyCountersAfterSweeping();
 #endif
@@ -1119,15 +1037,14 @@ StepResult IncrementalMarking::V8Step(double max_step_size_in_ms,
       // It is safe to merge back all objects that were on hold to the shared
       // work list at Step because we are at a safepoint where all objects
       // are properly initialized.
-      marking_worklist()->shared()->MergeGlobalPool(
-          marking_worklist()->on_hold());
+      marking_worklists()->MergeOnHold();
     }
 
 // Only print marking worklist in debug mode to save ~40KB of code size.
 #ifdef DEBUG
     if (FLAG_trace_incremental_marking && FLAG_trace_concurrent_marking &&
         FLAG_trace_gc_verbose) {
-      marking_worklist()->Print();
+      collector_->marking_worklists_holder()->Print();
     }
 #endif
     if (FLAG_trace_incremental_marking) {
@@ -1145,12 +1062,12 @@ StepResult IncrementalMarking::V8Step(double max_step_size_in_ms,
       result = StepResult::kNoImmediateWork;
     }
 
-    bytes_processed =
-        ProcessMarkingWorklist(Max(bytes_to_process, kMinStepSizeInBytes));
+    bytes_processed = collector_->ProcessMarkingWorklist(
+        Max(bytes_to_process, kMinStepSizeInBytes));
 
     bytes_marked_ += bytes_processed;
 
-    if (marking_worklist()->IsEmpty()) {
+    if (marking_worklists()->IsEmpty()) {
       result = StepResult::kNoImmediateWork;
       if (heap_->local_embedder_heap_tracer()
               ->ShouldFinalizeIncrementalMarking()) {
@@ -1167,18 +1084,20 @@ StepResult IncrementalMarking::V8Step(double max_step_size_in_ms,
         heap_->local_embedder_heap_tracer()->NotifyV8MarkingWorklistWasEmpty();
       }
     }
-  }
-  if (FLAG_concurrent_marking) {
-    marking_worklist()->ShareWorkIfGlobalPoolIsEmpty();
-    heap_->concurrent_marking()->RescheduleTasksIfNeeded();
+    if (FLAG_concurrent_marking) {
+      marking_worklists()->ShareWorkIfGlobalPoolIsEmpty();
+      heap_->concurrent_marking()->RescheduleTasksIfNeeded();
+    }
   }
 
   double end = heap_->MonotonicallyIncreasingTimeInMs();
   double duration = (end - start);
-  // Note that we report zero bytes here when sweeping was in progress or
-  // when we just started incremental marking. In these cases we did not
-  // process the marking deque.
-  heap_->tracer()->AddIncrementalMarkingStep(duration, bytes_processed);
+  if (state_ == MARKING) {
+    // Note that we report zero bytes here when sweeping was in progress or
+    // when we just started incremental marking. In these cases we did not
+    // process the marking deque.
+    heap_->tracer()->AddIncrementalMarkingStep(duration, bytes_processed);
+  }
   if (FLAG_trace_incremental_marking) {
     heap_->isolate()->PrintWithTimestamp(
         "[IncrementalMarking] Step %s %zuKB (%zuKB) in %.1f\n",
diff --git a/deps/v8/src/heap/incremental-marking.h b/deps/v8/src/heap/incremental-marking.h
index 74bb7cfd5a0e87..bd2b93efe2897b 100644
--- a/deps/v8/src/heap/incremental-marking.h
+++ b/deps/v8/src/heap/incremental-marking.h
@@ -32,17 +32,11 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
 
   enum CompletionAction { GC_VIA_STACK_GUARD, NO_GC_VIA_STACK_GUARD };
 
-  enum ForceCompletionAction { FORCE_COMPLETION, DO_NOT_FORCE_COMPLETION };
-
   enum GCRequestType { NONE, COMPLETE_MARKING, FINALIZATION };
 
-#ifdef V8_CONCURRENT_MARKING
-  using MarkingState = IncrementalMarkingState;
-#else
-  using MarkingState = MajorNonAtomicMarkingState;
-#endif  // V8_CONCURRENT_MARKING
-  using AtomicMarkingState = MajorAtomicMarkingState;
-  using NonAtomicMarkingState = MajorNonAtomicMarkingState;
+  using MarkingState = MarkCompactCollector::MarkingState;
+  using AtomicMarkingState = MarkCompactCollector::AtomicMarkingState;
+  using NonAtomicMarkingState = MarkCompactCollector::NonAtomicMarkingState;
 
   class PauseBlackAllocationScope {
    public:
@@ -92,9 +86,7 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
   static const AccessMode kAtomicity = AccessMode::NON_ATOMIC;
 #endif
 
-  IncrementalMarking(Heap* heap,
-                     MarkCompactCollector::MarkingWorklist* marking_worklist,
-                     WeakObjects* weak_objects);
+  IncrementalMarking(Heap* heap, WeakObjects* weak_objects);
 
   MarkingState* marking_state() { return &marking_state_; }
 
@@ -204,12 +196,6 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
   template <typename TSlot>
   V8_INLINE void RecordWrite(HeapObject obj, TSlot slot,
                              typename TSlot::TObject value);
-  void RevisitObject(HeapObject obj);
-  // Ensures that all descriptors int range [0, number_of_own_descripts)
-  // are visited.
-  void VisitDescriptors(HeapObject host, DescriptorArray array,
-                        int number_of_own_descriptors);
-
   void RecordWriteSlow(HeapObject obj, HeapObjectSlot slot, HeapObject value);
   void RecordWriteIntoCode(Code host, RelocInfo* rinfo, HeapObject value);
 
@@ -240,8 +226,8 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
     }
   }
 
-  MarkCompactCollector::MarkingWorklist* marking_worklist() const {
-    return marking_worklist_;
+  MarkingWorklists* marking_worklists() const {
+    return collector_->marking_worklists();
   }
 
   void Deactivate();
@@ -285,13 +271,6 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
   void DeactivateIncrementalWriteBarrierForSpace(NewSpace* space);
   void DeactivateIncrementalWriteBarrier();
 
-  V8_INLINE intptr_t ProcessMarkingWorklist(
-      intptr_t bytes_to_process,
-      ForceCompletionAction completion = DO_NOT_FORCE_COMPLETION);
-
-  // Visits the object and returns its size.
-  V8_INLINE int VisitObject(Map map, HeapObject obj);
-
   // Updates scheduled_bytes_to_mark_ to ensure marking progress based on
   // time.
   void ScheduleBytesToMarkBasedOnTime(double time_ms);
@@ -323,7 +302,7 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
   }
 
   Heap* const heap_;
-  MarkCompactCollector::MarkingWorklist* const marking_worklist_;
+  MarkCompactCollector* const collector_;
   WeakObjects* weak_objects_;
 
   double start_time_ms_;
diff --git a/deps/v8/src/heap/local-allocator.h b/deps/v8/src/heap/local-allocator.h
index 56da76a18dab0a..5ecfe7d8c1aa76 100644
--- a/deps/v8/src/heap/local-allocator.h
+++ b/deps/v8/src/heap/local-allocator.h
@@ -19,18 +19,17 @@ class LocalAllocator {
   static const int kLabSize = 32 * KB;
   static const int kMaxLabObjectSize = 8 * KB;
 
-  explicit LocalAllocator(Heap* heap)
+  explicit LocalAllocator(Heap* heap, LocalSpaceKind local_space_kind)
       : heap_(heap),
         new_space_(heap->new_space()),
-        compaction_spaces_(heap),
+        compaction_spaces_(heap, local_space_kind),
         new_space_lab_(LocalAllocationBuffer::InvalidBuffer()),
         lab_allocation_will_fail_(false) {}
 
   // Needs to be called from the main thread to finalize this LocalAllocator.
   void Finalize() {
-    heap_->old_space()->MergeCompactionSpace(compaction_spaces_.Get(OLD_SPACE));
-    heap_->code_space()->MergeCompactionSpace(
-        compaction_spaces_.Get(CODE_SPACE));
+    heap_->old_space()->MergeLocalSpace(compaction_spaces_.Get(OLD_SPACE));
+    heap_->code_space()->MergeLocalSpace(compaction_spaces_.Get(CODE_SPACE));
     // Give back remaining LAB space if this LocalAllocator's new space LAB
     // sits right next to new space allocation top.
     const LinearAllocationArea info = new_space_lab_.Close();
diff --git a/deps/v8/src/heap/mark-compact-inl.h b/deps/v8/src/heap/mark-compact-inl.h
index ed7e251f44f291..3c90344e6895a6 100644
--- a/deps/v8/src/heap/mark-compact-inl.h
+++ b/deps/v8/src/heap/mark-compact-inl.h
@@ -21,424 +21,9 @@
 namespace v8 {
 namespace internal {
 
-template <typename ConcreteState, AccessMode access_mode>
-bool MarkingStateBase<ConcreteState, access_mode>::GreyToBlack(HeapObject obj) {
-  MemoryChunk* p = MemoryChunk::FromHeapObject(obj);
-  MarkBit markbit = MarkBitFrom(p, obj.address());
-  if (!Marking::GreyToBlack<access_mode>(markbit)) return false;
-  static_cast<ConcreteState*>(this)->IncrementLiveBytes(p, obj.Size());
-  return true;
-}
-
-template <typename ConcreteState, AccessMode access_mode>
-bool MarkingStateBase<ConcreteState, access_mode>::WhiteToGrey(HeapObject obj) {
-  return Marking::WhiteToGrey<access_mode>(MarkBitFrom(obj));
-}
-
-template <typename ConcreteState, AccessMode access_mode>
-bool MarkingStateBase<ConcreteState, access_mode>::WhiteToBlack(
-    HeapObject obj) {
-  return WhiteToGrey(obj) && GreyToBlack(obj);
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-MarkingVisitor<fixed_array_mode, retaining_path_mode,
-               MarkingState>::MarkingVisitor(MarkCompactCollector* collector,
-                                             MarkingState* marking_state)
-    : heap_(collector->heap()),
-      collector_(collector),
-      marking_state_(marking_state),
-      mark_compact_epoch_(collector->epoch()) {}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                   MarkingState>::VisitBytecodeArray(Map map,
-                                                     BytecodeArray array) {
-  int size = BytecodeArray::BodyDescriptor::SizeOf(map, array);
-  BytecodeArray::BodyDescriptor::IterateBody(map, array, size, this);
-
-  if (!heap_->is_current_gc_forced()) {
-    array.MakeOlder();
-  }
-  return size;
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                   MarkingState>::VisitDescriptorArray(Map map,
-                                                       DescriptorArray array) {
-  int size = DescriptorArray::BodyDescriptor::SizeOf(map, array);
-  VisitPointers(array, array.GetFirstPointerSlot(), array.GetDescriptorSlot(0));
-  VisitDescriptors(array, array.number_of_descriptors());
-  return size;
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode, MarkingState>::
-    VisitSharedFunctionInfo(Map map, SharedFunctionInfo shared_info) {
-  int size = SharedFunctionInfo::BodyDescriptor::SizeOf(map, shared_info);
-  SharedFunctionInfo::BodyDescriptor::IterateBody(map, shared_info, size, this);
-
-  // If the SharedFunctionInfo has old bytecode, mark it as flushable,
-  // otherwise visit the function data field strongly.
-  if (shared_info.ShouldFlushBytecode(Heap::GetBytecodeFlushMode())) {
-    collector_->AddBytecodeFlushingCandidate(shared_info);
-  } else {
-    VisitPointer(shared_info,
-                 shared_info.RawField(SharedFunctionInfo::kFunctionDataOffset));
-  }
-  return size;
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                   MarkingState>::VisitJSFunction(Map map, JSFunction object) {
-  int size = Parent::VisitJSFunction(map, object);
-
-  // Check if the JSFunction needs reset due to bytecode being flushed.
-  if (FLAG_flush_bytecode && object.NeedsResetDueToFlushedBytecode()) {
-    collector_->AddFlushedJSFunction(object);
-  }
-
-  return size;
-}
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                   MarkingState>::VisitFixedArray(Map map, FixedArray object) {
-  return (fixed_array_mode == FixedArrayVisitationMode::kRegular)
-             ? Parent::VisitFixedArray(map, object)
-             : VisitFixedArrayIncremental(map, object);
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-template <typename T>
-V8_INLINE int
-MarkingVisitor<fixed_array_mode, retaining_path_mode,
-               MarkingState>::VisitEmbedderTracingSubclass(Map map, T object) {
-  if (heap_->local_embedder_heap_tracer()->InUse()) {
-    marking_worklist()->embedder()->Push(MarkCompactCollectorBase::kMainThread,
-                                         object);
-  }
-  int size = T::BodyDescriptor::SizeOf(map, object);
-  T::BodyDescriptor::IterateBody(map, object, size, this);
-  return size;
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                   MarkingState>::VisitJSApiObject(Map map, JSObject object) {
-  return VisitEmbedderTracingSubclass(map, object);
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                   MarkingState>::VisitJSArrayBuffer(Map map,
-                                                     JSArrayBuffer object) {
-  return VisitEmbedderTracingSubclass(map, object);
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                   MarkingState>::VisitJSDataView(Map map, JSDataView object) {
-  return VisitEmbedderTracingSubclass(map, object);
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                   MarkingState>::VisitJSTypedArray(Map map,
-                                                    JSTypedArray object) {
-  return VisitEmbedderTracingSubclass(map, object);
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode, MarkingState>::
-    VisitEphemeronHashTable(Map map, EphemeronHashTable table) {
-  collector_->AddEphemeronHashTable(table);
-
-  for (int i = 0; i < table.Capacity(); i++) {
-    ObjectSlot key_slot =
-        table.RawFieldOfElementAt(EphemeronHashTable::EntryToIndex(i));
-    HeapObject key = HeapObject::cast(table.KeyAt(i));
-    collector_->RecordSlot(table, key_slot, key);
-
-    ObjectSlot value_slot =
-        table.RawFieldOfElementAt(EphemeronHashTable::EntryToValueIndex(i));
-
-    if (marking_state()->IsBlackOrGrey(key)) {
-      VisitPointer(table, value_slot);
-
-    } else {
-      Object value_obj = *value_slot;
-
-      if (value_obj.IsHeapObject()) {
-        HeapObject value = HeapObject::cast(value_obj);
-        collector_->RecordSlot(table, value_slot, value);
-
-        // Revisit ephemerons with both key and value unreachable at end
-        // of concurrent marking cycle.
-        if (marking_state()->IsWhite(value)) {
-          collector_->AddEphemeron(key, value);
-        }
-      }
-    }
-  }
-
-  return table.SizeFromMap(map);
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                   MarkingState>::VisitMap(Map meta_map, Map map) {
-  int size = Map::BodyDescriptor::SizeOf(meta_map, map);
-  if (map.CanTransition()) {
-    // Maps that can transition share their descriptor arrays and require
-    // special visiting logic to avoid memory leaks.
-    // Since descriptor arrays are potentially shared, ensure that only the
-    // descriptors that belong to this map are marked. The first time a
-    // non-empty descriptor array is marked, its header is also visited. The
-    // slot holding the descriptor array will be implicitly recorded when the
-    // pointer fields of this map are visited.
-    DescriptorArray descriptors = map.instance_descriptors();
-    MarkDescriptorArrayBlack(map, descriptors);
-    int number_of_own_descriptors = map.NumberOfOwnDescriptors();
-    if (number_of_own_descriptors) {
-      DCHECK_LE(number_of_own_descriptors, descriptors.number_of_descriptors());
-      VisitDescriptors(descriptors, number_of_own_descriptors);
-    }
-    // Mark the pointer fields of the Map. Since the transitions array has
-    // been marked already, it is fine that one of these fields contains a
-    // pointer to it.
-  }
-  Map::BodyDescriptor::IterateBody(meta_map, map, size, this);
-  return size;
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                   MarkingState>::VisitTransitionArray(Map map,
-                                                       TransitionArray array) {
-  int size = TransitionArray::BodyDescriptor::SizeOf(map, array);
-  TransitionArray::BodyDescriptor::IterateBody(map, array, size, this);
-  collector_->AddTransitionArray(array);
-  return size;
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                   MarkingState>::VisitJSWeakRef(Map map, JSWeakRef weak_ref) {
-  if (weak_ref.target().IsHeapObject()) {
-    HeapObject target = HeapObject::cast(weak_ref.target());
-    if (marking_state()->IsBlackOrGrey(target)) {
-      // Record the slot inside the JSWeakRef, since the IterateBody below
-      // won't visit it.
-      ObjectSlot slot = weak_ref.RawField(JSWeakRef::kTargetOffset);
-      collector_->RecordSlot(weak_ref, slot, target);
-    } else {
-      // JSWeakRef points to a potentially dead object. We have to process
-      // them when we know the liveness of the whole transitive closure.
-      collector_->AddWeakRef(weak_ref);
-    }
-  }
-  int size = JSWeakRef::BodyDescriptor::SizeOf(map, weak_ref);
-  JSWeakRef::BodyDescriptor::IterateBody(map, weak_ref, size, this);
-  return size;
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                   MarkingState>::VisitWeakCell(Map map, WeakCell weak_cell) {
-  if (weak_cell.target().IsHeapObject()) {
-    HeapObject target = HeapObject::cast(weak_cell.target());
-    if (marking_state()->IsBlackOrGrey(target)) {
-      // Record the slot inside the WeakCell, since the IterateBody below
-      // won't visit it.
-      ObjectSlot slot = weak_cell.RawField(WeakCell::kTargetOffset);
-      collector_->RecordSlot(weak_cell, slot, target);
-    } else {
-      // WeakCell points to a potentially dead object. We have to process
-      // them when we know the liveness of the whole transitive closure.
-      collector_->AddWeakCell(weak_cell);
-    }
-  }
-  int size = WeakCell::BodyDescriptor::SizeOf(map, weak_cell);
-  WeakCell::BodyDescriptor::IterateBody(map, weak_cell, size, this);
-  return size;
-}
-
-// class template arguments
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-// method template arguments
-template <typename TSlot>
-void MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                    MarkingState>::VisitPointerImpl(HeapObject host,
-                                                    TSlot slot) {
-  static_assert(std::is_same<TSlot, ObjectSlot>::value ||
-                    std::is_same<TSlot, MaybeObjectSlot>::value,
-                "Only ObjectSlot and MaybeObjectSlot are expected here");
-  typename TSlot::TObject object = *slot;
-  HeapObject target_object;
-  if (object.GetHeapObjectIfStrong(&target_object)) {
-    collector_->RecordSlot(host, HeapObjectSlot(slot), target_object);
-    MarkObject(host, target_object);
-  } else if (TSlot::kCanBeWeak && object.GetHeapObjectIfWeak(&target_object)) {
-    if (marking_state()->IsBlackOrGrey(target_object)) {
-      // Weak references with live values are directly processed here to reduce
-      // the processing time of weak cells during the main GC pause.
-      collector_->RecordSlot(host, HeapObjectSlot(slot), target_object);
-    } else {
-      // If we do not know about liveness of values of weak cells, we have to
-      // process them when we know the liveness of the whole transitive
-      // closure.
-      collector_->AddWeakReference(host, HeapObjectSlot(slot));
-    }
-  }
-}
-
-// class template arguments
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-// method template arguments
-template <typename TSlot>
-void MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                    MarkingState>::VisitPointersImpl(HeapObject host,
-                                                     TSlot start, TSlot end) {
-  for (TSlot p = start; p < end; ++p) {
-    VisitPointer(host, p);
-  }
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-void MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                    MarkingState>::VisitEmbeddedPointer(Code host,
-                                                        RelocInfo* rinfo) {
-  DCHECK(RelocInfo::IsEmbeddedObjectMode(rinfo->rmode()));
-  HeapObject object = HeapObject::cast(rinfo->target_object());
-  collector_->RecordRelocSlot(host, rinfo, object);
-  if (!marking_state()->IsBlackOrGrey(object)) {
-    if (host.IsWeakObject(object)) {
-      collector_->AddWeakObjectInCode(object, host);
-    } else {
-      MarkObject(host, object);
-    }
-  }
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-void MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                    MarkingState>::VisitCodeTarget(Code host,
-                                                   RelocInfo* rinfo) {
-  DCHECK(RelocInfo::IsCodeTargetMode(rinfo->rmode()));
-  Code target = Code::GetCodeFromTargetAddress(rinfo->target_address());
-  collector_->RecordRelocSlot(host, rinfo, target);
-  MarkObject(host, target);
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-void MarkingVisitor<fixed_array_mode, retaining_path_mode, MarkingState>::
-    MarkDescriptorArrayBlack(HeapObject host, DescriptorArray descriptors) {
-  // Note that WhiteToBlack is not sufficient here because it fails if the
-  // descriptor array is grey. So we need to do two steps: WhiteToGrey and
-  // GreyToBlack. Alternatively, we could check WhiteToGrey || WhiteToBlack.
-  if (marking_state()->WhiteToGrey(descriptors)) {
-    if (retaining_path_mode == TraceRetainingPathMode::kEnabled &&
-        V8_UNLIKELY(FLAG_track_retaining_path)) {
-      heap_->AddRetainer(host, descriptors);
-    }
-  }
-  if (marking_state()->GreyToBlack(descriptors)) {
-    VisitPointers(descriptors, descriptors.GetFirstPointerSlot(),
-                  descriptors.GetDescriptorSlot(0));
-  }
-  DCHECK(marking_state()->IsBlack(descriptors));
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-void MarkingVisitor<fixed_array_mode, retaining_path_mode,
-                    MarkingState>::MarkObject(HeapObject host,
-                                              HeapObject object) {
-  if (marking_state()->WhiteToGrey(object)) {
-    marking_worklist()->Push(object);
-    if (retaining_path_mode == TraceRetainingPathMode::kEnabled &&
-        V8_UNLIKELY(FLAG_track_retaining_path)) {
-      heap_->AddRetainer(host, object);
-    }
-  }
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-int MarkingVisitor<fixed_array_mode, retaining_path_mode, MarkingState>::
-    VisitFixedArrayIncremental(Map map, FixedArray object) {
-  MemoryChunk* chunk = MemoryChunk::FromHeapObject(object);
-  int size = FixedArray::BodyDescriptor::SizeOf(map, object);
-  if (chunk->IsFlagSet(MemoryChunk::HAS_PROGRESS_BAR)) {
-    DCHECK(FLAG_use_marking_progress_bar);
-    DCHECK(heap_->IsLargeObject(object));
-    size_t current_progress_bar = chunk->ProgressBar();
-    int start = static_cast<int>(current_progress_bar);
-    if (start == 0) start = FixedArray::BodyDescriptor::kStartOffset;
-    int end = Min(size, start + kProgressBarScanningChunk);
-    if (start < end) {
-      VisitPointers(object, object.RawField(start), object.RawField(end));
-      bool success = chunk->TrySetProgressBar(current_progress_bar, end);
-      CHECK(success);
-      if (end < size) {
-        DCHECK(marking_state()->IsBlack(object));
-        // The object can be pushed back onto the marking worklist only after
-        // progress bar was updated.
-        marking_worklist()->Push(object);
-      }
-    }
-    return end - start;
-  }
-
-  // Non-batched processing.
-  FixedArray::BodyDescriptor::IterateBody(map, object, size, this);
-  return size;
-}
-
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-void MarkingVisitor<fixed_array_mode, retaining_path_mode, MarkingState>::
-    VisitDescriptors(DescriptorArray descriptors,
-                     int number_of_own_descriptors) {
-  // Updating the number of marked descriptor is supported only for black
-  // descriptor arrays.
-  DCHECK(marking_state()->IsBlack(descriptors));
-  int16_t new_marked = static_cast<int16_t>(number_of_own_descriptors);
-  int16_t old_marked = descriptors.UpdateNumberOfMarkedDescriptors(
-      mark_compact_epoch_, new_marked);
-  if (old_marked < new_marked) {
-    VisitPointers(descriptors,
-                  MaybeObjectSlot(descriptors.GetDescriptorSlot(old_marked)),
-                  MaybeObjectSlot(descriptors.GetDescriptorSlot(new_marked)));
-  }
-}
-
 void MarkCompactCollector::MarkObject(HeapObject host, HeapObject obj) {
   if (marking_state()->WhiteToGrey(obj)) {
-    marking_worklist()->Push(obj);
+    marking_worklists()->Push(obj);
     if (V8_UNLIKELY(FLAG_track_retaining_path)) {
       heap_->AddRetainer(host, obj);
     }
@@ -447,7 +32,7 @@ void MarkCompactCollector::MarkObject(HeapObject host, HeapObject obj) {
 
 void MarkCompactCollector::MarkRootObject(Root root, HeapObject obj) {
   if (marking_state()->WhiteToGrey(obj)) {
-    marking_worklist()->Push(obj);
+    marking_worklists()->Push(obj);
     if (V8_UNLIKELY(FLAG_track_retaining_path)) {
       heap_->AddRetainingRoot(root, obj);
     }
@@ -459,7 +44,7 @@ void MarkCompactCollector::MarkRootObject(Root root, HeapObject obj) {
 void MinorMarkCompactCollector::MarkRootObject(HeapObject obj) {
   if (Heap::InYoungGeneration(obj) &&
       non_atomic_marking_state_.WhiteToGrey(obj)) {
-    worklist_->Push(kMainThread, obj);
+    worklist_->Push(kMainThreadTask, obj);
   }
 }
 
@@ -467,7 +52,7 @@ void MinorMarkCompactCollector::MarkRootObject(HeapObject obj) {
 
 void MarkCompactCollector::MarkExternallyReferencedObject(HeapObject obj) {
   if (marking_state()->WhiteToGrey(obj)) {
-    marking_worklist()->Push(obj);
+    marking_worklists()->Push(obj);
     if (V8_UNLIKELY(FLAG_track_retaining_path)) {
       heap_->AddRetainingRoot(Root::kWrapperTracing, obj);
     }
@@ -500,16 +85,53 @@ void MarkCompactCollector::RecordSlot(MemoryChunk* source_page,
 }
 
 void MarkCompactCollector::AddTransitionArray(TransitionArray array) {
-  weak_objects_.transition_arrays.Push(kMainThread, array);
+  weak_objects_.transition_arrays.Push(kMainThreadTask, array);
+}
+
+template <typename MarkingState>
+template <typename T, typename TBodyDescriptor>
+int MainMarkingVisitor<MarkingState>::VisitJSObjectSubclass(Map map, T object) {
+  if (!this->ShouldVisit(object)) return 0;
+  this->VisitMapPointer(object);
+  int size = TBodyDescriptor::SizeOf(map, object);
+  TBodyDescriptor::IterateBody(map, object, size, this);
+  return size;
+}
+
+template <typename MarkingState>
+template <typename T>
+int MainMarkingVisitor<MarkingState>::VisitLeftTrimmableArray(Map map,
+                                                              T object) {
+  if (!this->ShouldVisit(object)) return 0;
+  int size = T::SizeFor(object.length());
+  this->VisitMapPointer(object);
+  T::BodyDescriptor::IterateBody(map, object, size, this);
+  return size;
+}
+
+template <typename MarkingState>
+template <typename TSlot>
+void MainMarkingVisitor<MarkingState>::RecordSlot(HeapObject object, TSlot slot,
+                                                  HeapObject target) {
+  MarkCompactCollector::RecordSlot(object, slot, target);
 }
 
-void MarkCompactCollector::AddBytecodeFlushingCandidate(
-    SharedFunctionInfo flush_candidate) {
-  weak_objects_.bytecode_flushing_candidates.Push(kMainThread, flush_candidate);
+template <typename MarkingState>
+void MainMarkingVisitor<MarkingState>::RecordRelocSlot(Code host,
+                                                       RelocInfo* rinfo,
+                                                       HeapObject target) {
+  MarkCompactCollector::RecordRelocSlot(host, rinfo, target);
 }
 
-void MarkCompactCollector::AddFlushedJSFunction(JSFunction flushed_function) {
-  weak_objects_.flushed_js_functions.Push(kMainThread, flushed_function);
+template <typename MarkingState>
+void MainMarkingVisitor<MarkingState>::MarkDescriptorArrayFromWriteBarrier(
+    HeapObject host, DescriptorArray descriptors,
+    int number_of_own_descriptors) {
+  // This is necessary because the Scavenger records slots only for the
+  // promoted black objects and the marking visitor of DescriptorArray skips
+  // the descriptors marked by the visitor.VisitDescriptors() below.
+  this->MarkDescriptorArrayBlack(host, descriptors);
+  this->VisitDescriptors(descriptors, number_of_own_descriptors);
 }
 
 template <LiveObjectIterationMode mode>
@@ -617,9 +239,9 @@ void LiveObjectRange<mode>::iterator::AdvanceToNextValidObject() {
 
       // We found a live object.
       if (!object.is_null()) {
-        // Do not use IsFiller() here. This may cause a data race for reading
-        // out the instance type when a new map concurrently is written into
-        // this object while iterating over the object.
+        // Do not use IsFreeSpaceOrFiller() here. This may cause a data race for
+        // reading out the instance type when a new map concurrently is written
+        // into this object while iterating over the object.
         if (map == one_word_filler_map_ || map == two_word_filler_map_ ||
             map == free_space_map_) {
           // There are two reasons why we can get black or grey fillers:
diff --git a/deps/v8/src/heap/mark-compact.cc b/deps/v8/src/heap/mark-compact.cc
index c18b2652d7a3ed..2113f89ba67b51 100644
--- a/deps/v8/src/heap/mark-compact.cc
+++ b/deps/v8/src/heap/mark-compact.cc
@@ -14,6 +14,7 @@
 #include "src/execution/vm-state-inl.h"
 #include "src/handles/global-handles.h"
 #include "src/heap/array-buffer-collector.h"
+#include "src/heap/array-buffer-sweeper.h"
 #include "src/heap/array-buffer-tracker-inl.h"
 #include "src/heap/gc-tracer.h"
 #include "src/heap/incremental-marking-inl.h"
@@ -21,6 +22,10 @@
 #include "src/heap/item-parallel-job.h"
 #include "src/heap/local-allocator-inl.h"
 #include "src/heap/mark-compact-inl.h"
+#include "src/heap/marking-visitor-inl.h"
+#include "src/heap/marking-visitor.h"
+#include "src/heap/memory-measurement-inl.h"
+#include "src/heap/memory-measurement.h"
 #include "src/heap/object-stats.h"
 #include "src/heap/objects-visiting-inl.h"
 #include "src/heap/read-only-heap.h"
@@ -284,7 +289,7 @@ void EvacuationVerifier::VerifyEvacuationOnPage(Address start, Address end) {
   Address current = start;
   while (current < end) {
     HeapObject object = HeapObject::FromAddress(current);
-    if (!object.IsFiller()) object.Iterate(this);
+    if (!object.IsFreeSpaceOrFiller()) object.Iterate(this);
     current += object.Size();
   }
 }
@@ -368,11 +373,6 @@ class FullEvacuationVerifier : public EvacuationVerifier {
 // MarkCompactCollectorBase, MinorMarkCompactCollector, MarkCompactCollector
 // =============================================================================
 
-using MarkCompactMarkingVisitor =
-    MarkingVisitor<FixedArrayVisitationMode::kRegular,
-                   TraceRetainingPathMode::kEnabled,
-                   MarkCompactCollector::MarkingState>;
-
 namespace {
 
 int NumberOfAvailableCores() {
@@ -432,7 +432,6 @@ MarkCompactCollector::MarkCompactCollector(Heap* heap)
       compacting_(false),
       black_allocation_(false),
       have_code_to_deoptimize_(false),
-      marking_worklist_(heap),
       sweeper_(new Sweeper(heap, non_atomic_marking_state())) {
   old_to_new_slots_ = -1;
 }
@@ -450,7 +449,7 @@ void MarkCompactCollector::TearDown() {
   AbortCompaction();
   AbortWeakObjects();
   if (heap()->incremental_marking()->IsMarking()) {
-    marking_worklist()->Clear();
+    marking_worklists_holder()->Clear();
   }
 }
 
@@ -468,7 +467,6 @@ void MarkCompactCollector::AddEvacuationCandidate(Page* p) {
   evacuation_candidates_.push_back(p);
 }
 
-
 static void TraceFragmentation(PagedSpace* space) {
   int number_of_pages = space->CountTotalPages();
   intptr_t reserved = (number_of_pages * space->AreaSize());
@@ -502,6 +500,36 @@ bool MarkCompactCollector::StartCompaction() {
   return compacting_;
 }
 
+void MarkCompactCollector::StartMarking() {
+  if (FLAG_concurrent_marking || FLAG_parallel_marking) {
+    heap_->new_space()->ResetOriginalTop();
+    heap_->new_lo_space()->ResetPendingObject();
+  }
+  std::vector<Address> contexts =
+      heap()->memory_measurement()->StartProcessing();
+  if (FLAG_stress_per_context_marking_worklist) {
+    contexts.clear();
+    HandleScope handle_scope(heap()->isolate());
+    for (auto context : heap()->FindAllNativeContexts()) {
+      contexts.push_back(context->ptr());
+    }
+  }
+  marking_worklists_holder()->CreateContextWorklists(contexts);
+  marking_worklists_ = std::make_unique<MarkingWorklists>(
+      kMainThreadTask, marking_worklists_holder());
+  marking_visitor_ = std::make_unique<MarkingVisitor>(
+      marking_state(), marking_worklists(), weak_objects(), heap_, epoch(),
+      Heap::GetBytecodeFlushMode(),
+      heap_->local_embedder_heap_tracer()->InUse(),
+      heap_->is_current_gc_forced());
+// Marking bits are cleared by the sweeper.
+#ifdef VERIFY_HEAP
+  if (FLAG_verify_heap) {
+    VerifyMarkbitsAreClean();
+  }
+#endif
+}
+
 void MarkCompactCollector::CollectGarbage() {
   // Make sure that Prepare() has been called. The individual steps below will
   // update the state as they proceed.
@@ -514,7 +542,7 @@ void MarkCompactCollector::CollectGarbage() {
   MarkLiveObjects();
   ClearNonLiveReferences();
   VerifyMarking();
-
+  heap()->memory_measurement()->FinishProcessing(native_context_stats_);
   RecordObjectStats();
 
   StartSweepSpaces();
@@ -538,7 +566,6 @@ void MarkCompactCollector::VerifyMarkbitsAreClean(PagedSpace* space) {
   }
 }
 
-
 void MarkCompactCollector::VerifyMarkbitsAreClean(NewSpace* space) {
   for (Page* p : PageRange(space->first_allocatable_address(), space->top())) {
     CHECK(non_atomic_marking_state()->bitmap(p)->IsClean());
@@ -786,7 +813,6 @@ void MarkCompactCollector::CollectEvacuationCandidates(PagedSpace* space) {
   }
 }
 
-
 void MarkCompactCollector::AbortCompaction() {
   if (compacting_) {
     RememberedSet<OLD_TO_OLD>::ClearAll(heap());
@@ -799,7 +825,6 @@ void MarkCompactCollector::AbortCompaction() {
   DCHECK(evacuation_candidates_.empty());
 }
 
-
 void MarkCompactCollector::Prepare() {
   was_marked_incrementally_ = heap()->incremental_marking()->IsMarking();
 
@@ -813,20 +838,26 @@ void MarkCompactCollector::Prepare() {
   // Instead of waiting we could also abort the sweeper threads here.
   EnsureSweepingCompleted();
 
+  {
+    TRACE_GC(heap()->tracer(),
+             GCTracer::Scope::MC_COMPLETE_SWEEP_ARRAY_BUFFERS);
+    heap_->array_buffer_sweeper()->EnsureFinished();
+  }
+
   if (heap()->incremental_marking()->IsSweeping()) {
     heap()->incremental_marking()->Stop();
   }
 
   if (!was_marked_incrementally_) {
-    TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_MARK_EMBEDDER_PROLOGUE);
-    heap_->local_embedder_heap_tracer()->TracePrologue(
-        heap_->flags_for_embedder_tracer());
-  }
-
-  // Don't start compaction if we are in the middle of incremental
-  // marking cycle. We did not collect any slots.
-  if (!FLAG_never_compact && !was_marked_incrementally_) {
-    StartCompaction();
+    {
+      TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_MARK_EMBEDDER_PROLOGUE);
+      heap_->local_embedder_heap_tracer()->TracePrologue(
+          heap_->flags_for_embedder_tracer());
+    }
+    if (!FLAG_never_compact) {
+      StartCompaction();
+    }
+    StartMarking();
   }
 
   PagedSpaceIterator spaces(heap());
@@ -835,12 +866,6 @@ void MarkCompactCollector::Prepare() {
     space->PrepareForMarkCompact();
   }
   heap()->account_external_memory_concurrently_freed();
-
-#ifdef VERIFY_HEAP
-  if (!was_marked_incrementally_ && FLAG_verify_heap) {
-    VerifyMarkbitsAreClean();
-  }
-#endif
 }
 
 void MarkCompactCollector::FinishConcurrentMarking(
@@ -851,11 +876,12 @@ void MarkCompactCollector::FinishConcurrentMarking(
     heap()->concurrent_marking()->Stop(stop_request);
     heap()->concurrent_marking()->FlushMemoryChunkData(
         non_atomic_marking_state());
+    heap()->concurrent_marking()->FlushNativeContexts(&native_context_stats_);
   }
 }
 
 void MarkCompactCollector::VerifyMarking() {
-  CHECK(marking_worklist()->IsEmpty());
+  CHECK(marking_worklists()->IsEmpty());
   DCHECK(heap_->incremental_marking()->IsStopped());
 #ifdef VERIFY_HEAP
   if (FLAG_verify_heap) {
@@ -875,10 +901,17 @@ void MarkCompactCollector::VerifyMarking() {
 void MarkCompactCollector::Finish() {
   TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_FINISH);
 
+  SweepArrayBufferExtensions();
+
 #ifdef DEBUG
   heap()->VerifyCountersBeforeConcurrentSweeping();
 #endif
 
+  marking_visitor_.reset();
+  marking_worklists_.reset();
+  marking_worklists_holder_.ReleaseContextWorklists();
+  native_context_stats_.Clear();
+
   CHECK(weak_objects_.current_ephemerons.IsEmpty());
   CHECK(weak_objects_.discovered_ephemerons.IsEmpty());
   weak_objects_.next_ephemerons.Clear();
@@ -910,6 +943,11 @@ void MarkCompactCollector::Finish() {
   }
 }
 
+void MarkCompactCollector::SweepArrayBufferExtensions() {
+  TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_FINISH_SWEEP_ARRAY_BUFFERS);
+  heap_->array_buffer_sweeper()->RequestSweepFull();
+}
+
 class MarkCompactCollector::RootMarkingVisitor final : public RootVisitor {
  public:
   explicit RootMarkingVisitor(MarkCompactCollector* collector)
@@ -1024,9 +1062,7 @@ class InternalizedStringTableCleaner : public ObjectVisitor {
     UNREACHABLE();
   }
 
-  int PointersRemoved() {
-    return pointers_removed_;
-  }
+  int PointersRemoved() { return pointers_removed_; }
 
  private:
   Heap* heap_;
@@ -1178,6 +1214,8 @@ class RecordMigratedSlotVisitor : public ObjectVisitor {
   inline void VisitRuntimeEntry(Code host, RelocInfo* rinfo) final {}
   inline void VisitInternalReference(Code host, RelocInfo* rinfo) final {}
 
+  virtual void MarkArrayBufferExtensionPromoted(HeapObject object) {}
+
  protected:
   inline virtual void RecordMigratedSlot(HeapObject host, MaybeObject value,
                                          Address slot) {
@@ -1187,8 +1225,11 @@ class RecordMigratedSlotVisitor : public ObjectVisitor {
         DCHECK_IMPLIES(
             p->IsToPage(),
             p->IsFlagSet(Page::PAGE_NEW_NEW_PROMOTION) || p->IsLargePage());
-        RememberedSet<OLD_TO_NEW>::Insert<AccessMode::NON_ATOMIC>(
-            MemoryChunk::FromHeapObject(host), slot);
+
+        MemoryChunk* chunk = MemoryChunk::FromHeapObject(host);
+        DCHECK(chunk->SweepingDone());
+        DCHECK_NULL(chunk->sweeping_slot_set<AccessMode::NON_ATOMIC>());
+        RememberedSet<OLD_TO_NEW>::Insert<AccessMode::NON_ATOMIC>(chunk, slot);
       } else if (p->IsEvacuationCandidate()) {
         RememberedSet<OLD_TO_OLD>::Insert<AccessMode::NON_ATOMIC>(
             MemoryChunk::FromHeapObject(host), slot);
@@ -1261,6 +1302,9 @@ class EvacuateVisitorBase : public HeapObjectVisitor {
       if (mode != MigrationMode::kFast)
         base->ExecuteMigrationObservers(dest, src, dst, size);
       dst.IterateBodyFast(dst.map(), size, base->record_visitor_);
+      if (V8_UNLIKELY(FLAG_minor_mc)) {
+        base->record_visitor_->MarkArrayBufferExtensionPromoted(dst);
+      }
     } else if (dest == CODE_SPACE) {
       DCHECK_CODEOBJECT_SIZE(size, base->heap_->code_space());
       base->heap_->CopyBlock(dst_addr, src_addr, size);
@@ -1348,24 +1392,42 @@ class EvacuateNewSpaceVisitor final : public EvacuateVisitorBase {
   explicit EvacuateNewSpaceVisitor(
       Heap* heap, LocalAllocator* local_allocator,
       RecordMigratedSlotVisitor* record_visitor,
-      Heap::PretenuringFeedbackMap* local_pretenuring_feedback)
+      Heap::PretenuringFeedbackMap* local_pretenuring_feedback,
+      bool always_promote_young)
       : EvacuateVisitorBase(heap, local_allocator, record_visitor),
         buffer_(LocalAllocationBuffer::InvalidBuffer()),
         promoted_size_(0),
         semispace_copied_size_(0),
         local_pretenuring_feedback_(local_pretenuring_feedback),
-        is_incremental_marking_(heap->incremental_marking()->IsMarking()) {}
+        is_incremental_marking_(heap->incremental_marking()->IsMarking()),
+        always_promote_young_(always_promote_young) {}
 
   inline bool Visit(HeapObject object, int size) override {
     if (TryEvacuateWithoutCopy(object)) return true;
     HeapObject target_object;
+
+    if (always_promote_young_) {
+      heap_->UpdateAllocationSite(object.map(), object,
+                                  local_pretenuring_feedback_);
+
+      if (!TryEvacuateObject(OLD_SPACE, object, size, &target_object)) {
+        heap_->FatalProcessOutOfMemory(
+            "MarkCompactCollector: young object promotion failed");
+      }
+
+      promoted_size_ += size;
+      return true;
+    }
+
     if (heap_->ShouldBePromoted(object.address()) &&
         TryEvacuateObject(OLD_SPACE, object, size, &target_object)) {
       promoted_size_ += size;
       return true;
     }
+
     heap_->UpdateAllocationSite(object.map(), object,
                                 local_pretenuring_feedback_);
+
     HeapObject target;
     AllocationSpace space = AllocateTargetObject(object, size, &target);
     MigrateObject(HeapObject::cast(target), object, size, space);
@@ -1427,6 +1489,7 @@ class EvacuateNewSpaceVisitor final : public EvacuateVisitorBase {
   intptr_t semispace_copied_size_;
   Heap::PretenuringFeedbackMap* local_pretenuring_feedback_;
   bool is_incremental_marking_;
+  bool always_promote_young_;
 };
 
 template <PageEvacuationMode mode>
@@ -1462,6 +1525,9 @@ class EvacuateNewSpacePageVisitor final : public HeapObjectVisitor {
                                   local_pretenuring_feedback_);
     } else if (mode == NEW_TO_OLD) {
       object.IterateBodyFast(record_visitor_);
+      if (V8_UNLIKELY(FLAG_minor_mc)) {
+        record_visitor_->MarkArrayBufferExtensionPromoted(object);
+      }
     }
     return true;
   }
@@ -1523,6 +1589,11 @@ void MarkCompactCollector::MarkStringTable(
   if (marking_state()->WhiteToBlack(string_table)) {
     // Explicitly mark the prefix.
     string_table.IteratePrefix(custom_root_body_visitor);
+    if (marking_worklists()->IsPerContextMode()) {
+      native_context_stats_.IncrementSize(MarkingWorklists::kSharedContext,
+                                          string_table.map(), string_table,
+                                          string_table.Size());
+    }
   }
 }
 
@@ -1537,6 +1608,26 @@ void MarkCompactCollector::MarkRoots(RootVisitor* root_visitor,
   ProcessTopOptimizedFrame(custom_root_body_visitor);
 }
 
+void MarkCompactCollector::VisitObject(HeapObject obj) {
+  marking_visitor_->Visit(obj.map(), obj);
+}
+
+void MarkCompactCollector::RevisitObject(HeapObject obj) {
+  DCHECK(marking_state()->IsBlack(obj));
+  DCHECK_IMPLIES(MemoryChunk::FromHeapObject(obj)->IsFlagSet(
+                     MemoryChunk::HAS_PROGRESS_BAR),
+                 0u == MemoryChunk::FromHeapObject(obj)->ProgressBar());
+  MarkingVisitor::RevisitScope revisit(marking_visitor_.get());
+  marking_visitor_->Visit(obj.map(), obj);
+}
+
+void MarkCompactCollector::MarkDescriptorArrayFromWriteBarrier(
+    HeapObject host, DescriptorArray descriptors,
+    int number_of_own_descriptors) {
+  marking_visitor_->MarkDescriptorArrayFromWriteBarrier(
+      host, descriptors, number_of_own_descriptors);
+}
+
 void MarkCompactCollector::ProcessEphemeronsUntilFixpoint() {
   bool work_to_do = true;
   int iterations = 0;
@@ -1572,14 +1663,14 @@ void MarkCompactCollector::ProcessEphemeronsUntilFixpoint() {
     CHECK(weak_objects_.current_ephemerons.IsEmpty());
     CHECK(weak_objects_.discovered_ephemerons.IsEmpty());
 
-    work_to_do = work_to_do || !marking_worklist()->IsEmpty() ||
+    work_to_do = work_to_do || !marking_worklists()->IsEmpty() ||
                  heap()->concurrent_marking()->ephemeron_marked() ||
-                 !marking_worklist()->IsEmbedderEmpty() ||
+                 !marking_worklists()->IsEmbedderEmpty() ||
                  !heap()->local_embedder_heap_tracer()->IsRemoteTracingDone();
     ++iterations;
   }
 
-  CHECK(marking_worklist()->IsEmpty());
+  CHECK(marking_worklists()->IsEmpty());
   CHECK(weak_objects_.current_ephemerons.IsEmpty());
   CHECK(weak_objects_.discovered_ephemerons.IsEmpty());
 }
@@ -1590,7 +1681,7 @@ bool MarkCompactCollector::ProcessEphemerons() {
 
   // Drain current_ephemerons and push ephemerons where key and value are still
   // unreachable into next_ephemerons.
-  while (weak_objects_.current_ephemerons.Pop(kMainThread, &ephemeron)) {
+  while (weak_objects_.current_ephemerons.Pop(kMainThreadTask, &ephemeron)) {
     if (ProcessEphemeron(ephemeron.key, ephemeron.value)) {
       ephemeron_marked = true;
     }
@@ -1598,20 +1689,20 @@ bool MarkCompactCollector::ProcessEphemerons() {
 
   // Drain marking worklist and push discovered ephemerons into
   // discovered_ephemerons.
-  ProcessMarkingWorklist();
+  DrainMarkingWorklist();
 
   // Drain discovered_ephemerons (filled in the drain MarkingWorklist-phase
   // before) and push ephemerons where key and value are still unreachable into
   // next_ephemerons.
-  while (weak_objects_.discovered_ephemerons.Pop(kMainThread, &ephemeron)) {
+  while (weak_objects_.discovered_ephemerons.Pop(kMainThreadTask, &ephemeron)) {
     if (ProcessEphemeron(ephemeron.key, ephemeron.value)) {
       ephemeron_marked = true;
     }
   }
 
   // Flush local ephemerons for main task to global pool.
-  weak_objects_.ephemeron_hash_tables.FlushToGlobal(kMainThread);
-  weak_objects_.next_ephemerons.FlushToGlobal(kMainThread);
+  weak_objects_.ephemeron_hash_tables.FlushToGlobal(kMainThreadTask);
+  weak_objects_.next_ephemerons.FlushToGlobal(kMainThreadTask);
 
   return ephemeron_marked;
 }
@@ -1626,7 +1717,7 @@ void MarkCompactCollector::ProcessEphemeronsLinear() {
   DCHECK(weak_objects_.current_ephemerons.IsEmpty());
   weak_objects_.current_ephemerons.Swap(weak_objects_.next_ephemerons);
 
-  while (weak_objects_.current_ephemerons.Pop(kMainThread, &ephemeron)) {
+  while (weak_objects_.current_ephemerons.Pop(kMainThreadTask, &ephemeron)) {
     ProcessEphemeron(ephemeron.key, ephemeron.value);
 
     if (non_atomic_marking_state()->IsWhite(ephemeron.value)) {
@@ -1648,12 +1739,13 @@ void MarkCompactCollector::ProcessEphemeronsLinear() {
                GCTracer::Scope::MC_MARK_WEAK_CLOSURE_EPHEMERON_MARKING);
       // Drain marking worklist and push all discovered objects into
       // newly_discovered.
-      ProcessMarkingWorklistInternal<
+      ProcessMarkingWorklist<
           MarkCompactCollector::MarkingWorklistProcessingMode::
-              kTrackNewlyDiscoveredObjects>();
+              kTrackNewlyDiscoveredObjects>(0);
     }
 
-    while (weak_objects_.discovered_ephemerons.Pop(kMainThread, &ephemeron)) {
+    while (
+        weak_objects_.discovered_ephemerons.Pop(kMainThreadTask, &ephemeron)) {
       ProcessEphemeron(ephemeron.key, ephemeron.value);
 
       if (non_atomic_marking_state()->IsWhite(ephemeron.value)) {
@@ -1667,7 +1759,7 @@ void MarkCompactCollector::ProcessEphemeronsLinear() {
       weak_objects_.next_ephemerons.Iterate([&](Ephemeron ephemeron) {
         if (non_atomic_marking_state()->IsBlackOrGrey(ephemeron.key) &&
             non_atomic_marking_state()->WhiteToGrey(ephemeron.value)) {
-          marking_worklist()->Push(ephemeron.value);
+          marking_worklists()->Push(ephemeron.value);
         }
       });
 
@@ -1688,8 +1780,8 @@ void MarkCompactCollector::ProcessEphemeronsLinear() {
     // for work_to_do are not sufficient for determining if another iteration
     // is necessary.
 
-    work_to_do = !marking_worklist()->IsEmpty() ||
-                 !marking_worklist()->IsEmbedderEmpty() ||
+    work_to_do = !marking_worklists()->IsEmpty() ||
+                 !marking_worklists()->IsEmbedderEmpty() ||
                  !heap()->local_embedder_heap_tracer()->IsRemoteTracingDone();
     CHECK(weak_objects_.discovered_ephemerons.IsEmpty());
   }
@@ -1697,7 +1789,7 @@ void MarkCompactCollector::ProcessEphemeronsLinear() {
   ResetNewlyDiscovered();
   ephemeron_marking_.newly_discovered.shrink_to_fit();
 
-  CHECK(marking_worklist()->IsEmpty());
+  CHECK(marking_worklists()->IsEmpty());
 }
 
 void MarkCompactCollector::PerformWrapperTracing() {
@@ -1707,7 +1799,7 @@ void MarkCompactCollector::PerformWrapperTracing() {
       LocalEmbedderHeapTracer::ProcessingScope scope(
           heap_->local_embedder_heap_tracer());
       HeapObject object;
-      while (marking_worklist()->embedder()->Pop(kMainThread, &object)) {
+      while (marking_worklists()->PopEmbedder(&object)) {
         scope.TracePossibleWrapper(JSObject::cast(object));
       }
     }
@@ -1716,19 +1808,19 @@ void MarkCompactCollector::PerformWrapperTracing() {
   }
 }
 
-void MarkCompactCollector::ProcessMarkingWorklist() {
-  ProcessMarkingWorklistInternal<
-      MarkCompactCollector::MarkingWorklistProcessingMode::kDefault>();
-}
+void MarkCompactCollector::DrainMarkingWorklist() { ProcessMarkingWorklist(0); }
 
 template <MarkCompactCollector::MarkingWorklistProcessingMode mode>
-void MarkCompactCollector::ProcessMarkingWorklistInternal() {
+size_t MarkCompactCollector::ProcessMarkingWorklist(size_t bytes_to_process) {
   HeapObject object;
-  MarkCompactMarkingVisitor visitor(this, marking_state());
-  while (!(object = marking_worklist()->Pop()).is_null()) {
+  size_t bytes_processed = 0;
+  bool is_per_context_mode = marking_worklists()->IsPerContextMode();
+  Isolate* isolate = heap()->isolate();
+  while (marking_worklists()->Pop(&object) ||
+         marking_worklists()->PopOnHold(&object)) {
     // Left trimming may result in grey or black filler objects on the marking
     // worklist. Ignore these objects.
-    if (object.IsFiller()) {
+    if (object.IsFreeSpaceOrFiller()) {
       // Due to copying mark bits and the fact that grey and black have their
       // first bit set, one word fillers are always black.
       DCHECK_IMPLIES(
@@ -1744,41 +1836,62 @@ void MarkCompactCollector::ProcessMarkingWorklistInternal() {
     DCHECK(object.IsHeapObject());
     DCHECK(heap()->Contains(object));
     DCHECK(!(marking_state()->IsWhite(object)));
-    marking_state()->GreyToBlack(object);
     if (mode == MarkCompactCollector::MarkingWorklistProcessingMode::
                     kTrackNewlyDiscoveredObjects) {
       AddNewlyDiscovered(object);
     }
-    Map map = object.map();
-    MarkObject(object, map);
-    visitor.Visit(map, object);
+    Map map = object.map(isolate);
+    if (is_per_context_mode) {
+      Address context;
+      if (native_context_inferrer_.Infer(isolate, map, object, &context)) {
+        marking_worklists()->SwitchToContext(context);
+      }
+    }
+    size_t visited_size = marking_visitor_->Visit(map, object);
+    if (is_per_context_mode) {
+      native_context_stats_.IncrementSize(marking_worklists()->Context(), map,
+                                          object, visited_size);
+    }
+    bytes_processed += visited_size;
+    if (bytes_to_process && bytes_processed >= bytes_to_process) {
+      break;
+    }
   }
+  return bytes_processed;
 }
 
+// Generate definitions for use in other files.
+template size_t MarkCompactCollector::ProcessMarkingWorklist<
+    MarkCompactCollector::MarkingWorklistProcessingMode::kDefault>(
+    size_t bytes_to_process);
+template size_t MarkCompactCollector::ProcessMarkingWorklist<
+    MarkCompactCollector::MarkingWorklistProcessingMode::
+        kTrackNewlyDiscoveredObjects>(size_t bytes_to_process);
+
 bool MarkCompactCollector::ProcessEphemeron(HeapObject key, HeapObject value) {
   if (marking_state()->IsBlackOrGrey(key)) {
     if (marking_state()->WhiteToGrey(value)) {
-      marking_worklist()->Push(value);
+      marking_worklists()->Push(value);
       return true;
     }
 
   } else if (marking_state()->IsWhite(value)) {
-    weak_objects_.next_ephemerons.Push(kMainThread, Ephemeron{key, value});
+    weak_objects_.next_ephemerons.Push(kMainThreadTask, Ephemeron{key, value});
   }
 
   return false;
 }
 
 void MarkCompactCollector::ProcessEphemeronMarking() {
-  DCHECK(marking_worklist()->IsEmpty());
+  DCHECK(marking_worklists()->IsEmpty());
 
   // Incremental marking might leave ephemerons in main task's local
   // buffer, flush it into global pool.
-  weak_objects_.next_ephemerons.FlushToGlobal(kMainThread);
+  weak_objects_.next_ephemerons.FlushToGlobal(kMainThreadTask);
 
   ProcessEphemeronsUntilFixpoint();
 
-  CHECK(marking_worklist()->IsEmpty());
+  CHECK(marking_worklists()->IsEmpty());
   CHECK(heap()->local_embedder_heap_tracer()->IsRemoteTracingDone());
 }
 
@@ -1860,17 +1973,17 @@ void MarkCompactCollector::MarkLiveObjects() {
     if (FLAG_parallel_marking) {
       heap_->concurrent_marking()->RescheduleTasksIfNeeded();
     }
-    ProcessMarkingWorklist();
+    DrainMarkingWorklist();
 
     FinishConcurrentMarking(
         ConcurrentMarking::StopRequest::COMPLETE_ONGOING_TASKS);
-    ProcessMarkingWorklist();
+    DrainMarkingWorklist();
   }
 
   {
     TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_MARK_WEAK_CLOSURE);
 
-    DCHECK(marking_worklist()->IsEmpty());
+    DCHECK(marking_worklists()->IsEmpty());
 
     // Mark objects reachable through the embedder heap. This phase is
     // opportunistic as it may not discover graphs that are only reachable
@@ -1883,11 +1996,11 @@ void MarkCompactCollector::MarkLiveObjects() {
         // concurrent markers. As a result this call needs to happen at least
         // once.
         PerformWrapperTracing();
-        ProcessMarkingWorklist();
+        DrainMarkingWorklist();
       } while (!heap_->local_embedder_heap_tracer()->IsRemoteTracingDone() ||
-               !marking_worklist()->IsEmbedderEmpty());
-      DCHECK(marking_worklist()->IsEmbedderEmpty());
-      DCHECK(marking_worklist()->IsEmpty());
+               !marking_worklists()->IsEmbedderEmpty());
+      DCHECK(marking_worklists()->IsEmbedderEmpty());
+      DCHECK(marking_worklists()->IsEmpty());
     }
 
     // The objects reachable from the roots are marked, yet unreachable objects
@@ -1897,7 +2010,7 @@ void MarkCompactCollector::MarkLiveObjects() {
       TRACE_GC(heap()->tracer(),
                GCTracer::Scope::MC_MARK_WEAK_CLOSURE_EPHEMERON);
       ProcessEphemeronMarking();
-      DCHECK(marking_worklist()->IsEmpty());
+      DCHECK(marking_worklists()->IsEmpty());
     }
 
     // The objects reachable from the roots, weak maps, and embedder heap
@@ -1912,7 +2025,7 @@ void MarkCompactCollector::MarkLiveObjects() {
                GCTracer::Scope::MC_MARK_WEAK_CLOSURE_WEAK_HANDLES);
       heap()->isolate()->global_handles()->IterateWeakRootsIdentifyFinalizers(
           &IsUnmarkedHeapObject);
-      ProcessMarkingWorklist();
+      DrainMarkingWorklist();
     }
 
     // Process finalizers, effectively keeping them alive until the next
@@ -1922,15 +2035,15 @@ void MarkCompactCollector::MarkLiveObjects() {
                GCTracer::Scope::MC_MARK_WEAK_CLOSURE_WEAK_ROOTS);
       heap()->isolate()->global_handles()->IterateWeakRootsForFinalizers(
           &root_visitor);
-      ProcessMarkingWorklist();
+      DrainMarkingWorklist();
     }
 
     // Repeat ephemeron processing from the newly marked objects.
     {
       TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_MARK_WEAK_CLOSURE_HARMONY);
       ProcessEphemeronMarking();
-      DCHECK(marking_worklist()->IsEmbedderEmpty());
-      DCHECK(marking_worklist()->IsEmpty());
+      DCHECK(marking_worklists()->IsEmbedderEmpty());
+      DCHECK(marking_worklists()->IsEmpty());
     }
 
     {
@@ -2009,7 +2122,7 @@ void MarkCompactCollector::ClearNonLiveReferences() {
 
 void MarkCompactCollector::MarkDependentCodeForDeoptimization() {
   std::pair<HeapObject, Code> weak_object_in_code;
-  while (weak_objects_.weak_objects_in_code.Pop(kMainThread,
+  while (weak_objects_.weak_objects_in_code.Pop(kMainThreadTask,
                                                 &weak_object_in_code)) {
     HeapObject object = weak_object_in_code.first;
     Code code = weak_object_in_code.second;
@@ -2104,8 +2217,8 @@ void MarkCompactCollector::FlushBytecodeFromSFI(
 
   // Initialize the uncompiled data.
   UncompiledData uncompiled_data = UncompiledData::cast(compiled_data);
-  UncompiledData::Initialize(
-      uncompiled_data, inferred_name, start_position, end_position,
+  uncompiled_data.Init(
+      inferred_name, start_position, end_position,
       [](HeapObject object, ObjectSlot slot, HeapObject target) {
         RecordSlot(object, slot, target);
       });
@@ -2125,7 +2238,7 @@ void MarkCompactCollector::ClearOldBytecodeCandidates() {
   DCHECK(FLAG_flush_bytecode ||
          weak_objects_.bytecode_flushing_candidates.IsEmpty());
   SharedFunctionInfo flushing_candidate;
-  while (weak_objects_.bytecode_flushing_candidates.Pop(kMainThread,
+  while (weak_objects_.bytecode_flushing_candidates.Pop(kMainThreadTask,
                                                         &flushing_candidate)) {
     // If the BytecodeArray is dead, flush it, which will replace the field with
     // an uncompiled data object.
@@ -2145,15 +2258,19 @@ void MarkCompactCollector::ClearOldBytecodeCandidates() {
 void MarkCompactCollector::ClearFlushedJsFunctions() {
   DCHECK(FLAG_flush_bytecode || weak_objects_.flushed_js_functions.IsEmpty());
   JSFunction flushed_js_function;
-  while (weak_objects_.flushed_js_functions.Pop(kMainThread,
+  while (weak_objects_.flushed_js_functions.Pop(kMainThreadTask,
                                                 &flushed_js_function)) {
-    flushed_js_function.ResetIfBytecodeFlushed();
+    auto gc_notify_updated_slot = [](HeapObject object, ObjectSlot slot,
+                                     Object target) {
+      RecordSlot(object, slot, HeapObject::cast(target));
+    };
+    flushed_js_function.ResetIfBytecodeFlushed(gc_notify_updated_slot);
   }
 }
 
 void MarkCompactCollector::ClearFullMapTransitions() {
   TransitionArray array;
-  while (weak_objects_.transition_arrays.Pop(kMainThread, &array)) {
+  while (weak_objects_.transition_arrays.Pop(kMainThreadTask, &array)) {
     int num_transitions = array.number_of_entries();
     if (num_transitions > 0) {
       Map map;
@@ -2296,8 +2413,8 @@ void MarkCompactCollector::ClearWeakCollections() {
   TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_CLEAR_WEAK_COLLECTIONS);
   EphemeronHashTable table;
 
-  while (weak_objects_.ephemeron_hash_tables.Pop(kMainThread, &table)) {
-    for (int i = 0; i < table.Capacity(); i++) {
+  while (weak_objects_.ephemeron_hash_tables.Pop(kMainThreadTask, &table)) {
+    for (InternalIndex i : table.IterateEntries()) {
       HeapObject key = HeapObject::cast(table.KeyAt(i));
 #ifdef VERIFY_HEAP
       Object value = table.ValueAt(i);
@@ -2328,7 +2445,7 @@ void MarkCompactCollector::ClearWeakReferences() {
   std::pair<HeapObject, HeapObjectSlot> slot;
   HeapObjectReference cleared_weak_ref =
       HeapObjectReference::ClearedValue(isolate());
-  while (weak_objects_.weak_references.Pop(kMainThread, &slot)) {
+  while (weak_objects_.weak_references.Pop(kMainThreadTask, &slot)) {
     HeapObject value;
     // The slot could have been overwritten, so we have to treat it
     // as MaybeObjectSlot.
@@ -2354,7 +2471,7 @@ void MarkCompactCollector::ClearJSWeakRefs() {
     return;
   }
   JSWeakRef weak_ref;
-  while (weak_objects_.js_weak_refs.Pop(kMainThread, &weak_ref)) {
+  while (weak_objects_.js_weak_refs.Pop(kMainThreadTask, &weak_ref)) {
     HeapObject target = HeapObject::cast(weak_ref.target());
     if (!non_atomic_marking_state()->IsBlackOrGrey(target)) {
       weak_ref.set_target(ReadOnlyRoots(isolate()).undefined_value());
@@ -2365,7 +2482,13 @@ void MarkCompactCollector::ClearJSWeakRefs() {
     }
   }
   WeakCell weak_cell;
-  while (weak_objects_.weak_cells.Pop(kMainThread, &weak_cell)) {
+  while (weak_objects_.weak_cells.Pop(kMainThreadTask, &weak_cell)) {
+    auto gc_notify_updated_slot = [](HeapObject object, ObjectSlot slot,
+                                     Object target) {
+      if (target.IsHeapObject()) {
+        RecordSlot(object, slot, HeapObject::cast(target));
+      }
+    };
     HeapObject target = HeapObject::cast(weak_cell.target());
     if (!non_atomic_marking_state()->IsBlackOrGrey(target)) {
       DCHECK(!target.IsUndefined());
@@ -2373,23 +2496,13 @@ void MarkCompactCollector::ClearJSWeakRefs() {
       JSFinalizationGroup finalization_group =
           JSFinalizationGroup::cast(weak_cell.finalization_group());
       if (!finalization_group.scheduled_for_cleanup()) {
-        heap()->AddDirtyJSFinalizationGroup(
-            finalization_group,
-            [](HeapObject object, ObjectSlot slot, Object target) {
-              if (target.IsHeapObject()) {
-                RecordSlot(object, slot, HeapObject::cast(target));
-              }
-            });
+        heap()->AddDirtyJSFinalizationGroup(finalization_group,
+                                            gc_notify_updated_slot);
       }
       // We're modifying the pointers in WeakCell and JSFinalizationGroup during
       // GC; thus we need to record the slots it writes. The normal write
       // barrier is not enough, since it's disabled before GC.
-      weak_cell.Nullify(isolate(),
-                        [](HeapObject object, ObjectSlot slot, Object target) {
-                          if (target.IsHeapObject()) {
-                            RecordSlot(object, slot, HeapObject::cast(target));
-                          }
-                        });
+      weak_cell.Nullify(isolate(), gc_notify_updated_slot);
       DCHECK(finalization_group.NeedsCleanup());
       DCHECK(finalization_group.scheduled_for_cleanup());
     } else {
@@ -2397,6 +2510,29 @@ void MarkCompactCollector::ClearJSWeakRefs() {
       ObjectSlot slot = weak_cell.RawField(WeakCell::kTargetOffset);
       RecordSlot(weak_cell, slot, HeapObject::cast(*slot));
     }
+
+    HeapObject unregister_token =
+        HeapObject::cast(weak_cell.unregister_token());
+    if (!non_atomic_marking_state()->IsBlackOrGrey(unregister_token)) {
+      // The unregister token is dead. Remove any corresponding entries in the
+      // key map. Multiple WeakCell with the same token will have all their
+      // unregister_token field set to undefined when processing the first
+      // WeakCell. Like above, we're modifying pointers during GC, so record the
+      // slots.
+      HeapObject undefined = ReadOnlyRoots(isolate()).undefined_value();
+      JSFinalizationGroup finalization_group =
+          JSFinalizationGroup::cast(weak_cell.finalization_group());
+      finalization_group.RemoveUnregisterToken(
+          JSReceiver::cast(unregister_token), isolate(),
+          [undefined](WeakCell matched_cell) {
+            matched_cell.set_unregister_token(undefined);
+          },
+          gc_notify_updated_slot);
+    } else {
+      // The unregister_token is alive.
+      ObjectSlot slot = weak_cell.RawField(WeakCell::kUnregisterTokenOffset);
+      RecordSlot(weak_cell, slot, HeapObject::cast(*slot));
+    }
   }
 }
 
@@ -2663,6 +2799,8 @@ void MarkCompactCollector::EvacuatePrologue() {
   new_space->Flip();
   new_space->ResetLinearAllocationArea();
 
+  DCHECK_EQ(new_space->Size(), 0);
+
   heap()->new_lo_space()->Flip();
   heap()->new_lo_space()->ResetPendingObject();
 
@@ -2677,6 +2815,8 @@ void MarkCompactCollector::EvacuateEpilogue() {
   aborted_evacuation_candidates_.clear();
   // New space.
   heap()->new_space()->set_age_mark(heap()->new_space()->top());
+  DCHECK_IMPLIES(FLAG_always_promote_young_mc,
+                 heap()->new_space()->Size() == 0);
   // Deallocate unmarked large objects.
   heap()->lo_space()->FreeUnmarkedObjects();
   heap()->code_lo_space()->FreeUnmarkedObjects();
@@ -2724,18 +2864,19 @@ class Evacuator : public Malloced {
     return MemoryChunkLayout::AllocatableMemoryInDataPage() + kTaggedSize;
   }
 
-  Evacuator(Heap* heap, RecordMigratedSlotVisitor* record_visitor)
+  Evacuator(Heap* heap, RecordMigratedSlotVisitor* record_visitor,
+            LocalAllocator* local_allocator, bool always_promote_young)
       : heap_(heap),
-        local_allocator_(heap_),
         local_pretenuring_feedback_(kInitialLocalPretenuringFeedbackCapacity),
-        new_space_visitor_(heap_, &local_allocator_, record_visitor,
-                           &local_pretenuring_feedback_),
+        new_space_visitor_(heap_, local_allocator, record_visitor,
+                           &local_pretenuring_feedback_, always_promote_young),
         new_to_new_page_visitor_(heap_, record_visitor,
                                  &local_pretenuring_feedback_),
         new_to_old_page_visitor_(heap_, record_visitor,
                                  &local_pretenuring_feedback_),
 
-        old_space_visitor_(heap_, &local_allocator_, record_visitor),
+        old_space_visitor_(heap_, local_allocator, record_visitor),
+        local_allocator_(local_allocator),
         duration_(0.0),
         bytes_compacted_(0) {}
 
@@ -2771,8 +2912,6 @@ class Evacuator : public Malloced {
 
   Heap* heap_;
 
-  // Locally cached collector data.
-  LocalAllocator local_allocator_;
   Heap::PretenuringFeedbackMap local_pretenuring_feedback_;
 
   // Visitors for the corresponding spaces.
@@ -2783,6 +2922,9 @@ class Evacuator : public Malloced {
       new_to_old_page_visitor_;
   EvacuateOldSpaceVisitor old_space_visitor_;
 
+  // Locally cached collector data.
+  LocalAllocator* local_allocator_;
+
   // Book keeping info.
   double duration_;
   intptr_t bytes_compacted_;
@@ -2816,7 +2958,7 @@ void Evacuator::EvacuatePage(MemoryChunk* chunk) {
 }
 
 void Evacuator::Finalize() {
-  local_allocator_.Finalize();
+  local_allocator_->Finalize();
   heap()->tracer()->AddCompactionEvent(duration_, bytes_compacted_);
   heap()->IncrementPromotedObjectsSize(new_space_visitor_.promoted_size() +
                                        new_to_old_page_visitor_.moved_bytes());
@@ -2834,8 +2976,10 @@ void Evacuator::Finalize() {
 class FullEvacuator : public Evacuator {
  public:
   explicit FullEvacuator(MarkCompactCollector* collector)
-      : Evacuator(collector->heap(), &record_visitor_),
+      : Evacuator(collector->heap(), &record_visitor_, &local_allocator_,
+                  FLAG_always_promote_young_mc),
         record_visitor_(collector, &ephemeron_remembered_set_),
+        local_allocator_(heap_, LocalSpaceKind::kCompactionSpaceForMarkCompact),
         collector_(collector) {}
 
   GCTracer::BackgroundScope::ScopeId GetBackgroundTracingScope() override {
@@ -2867,6 +3011,7 @@ class FullEvacuator : public Evacuator {
   void RawEvacuatePage(MemoryChunk* chunk, intptr_t* live_bytes) override;
   EphemeronRememberedSet ephemeron_remembered_set_;
   RecordMigratedSlotVisitor record_visitor_;
+  LocalAllocator local_allocator_;
 
   MarkCompactCollector* collector_;
 };
@@ -3001,12 +3146,14 @@ void MarkCompactCollectorBase::CreateAndExecuteEvacuationTasks(
   }
 }
 
-bool MarkCompactCollectorBase::ShouldMovePage(Page* p, intptr_t live_bytes) {
+bool MarkCompactCollectorBase::ShouldMovePage(Page* p, intptr_t live_bytes,
+                                              bool always_promote_young) {
   const bool reduce_memory = heap()->ShouldReduceMemory();
   const Address age_mark = heap()->new_space()->age_mark();
   return !reduce_memory && !p->NeverEvacuate() &&
          (live_bytes > Evacuator::NewSpacePageEvacuationThreshold()) &&
-         !p->Contains(age_mark) && heap()->CanExpandOldGeneration(live_bytes);
+         (always_promote_young || !p->Contains(age_mark)) &&
+         heap()->CanExpandOldGeneration(live_bytes);
 }
 
 void MarkCompactCollector::EvacuatePagesInParallel() {
@@ -3023,8 +3170,10 @@ void MarkCompactCollector::EvacuatePagesInParallel() {
     intptr_t live_bytes_on_page = non_atomic_marking_state()->live_bytes(page);
     if (live_bytes_on_page == 0 && !page->contains_array_buffers()) continue;
     live_bytes += live_bytes_on_page;
-    if (ShouldMovePage(page, live_bytes_on_page)) {
-      if (page->IsFlagSet(MemoryChunk::NEW_SPACE_BELOW_AGE_MARK)) {
+    if (ShouldMovePage(page, live_bytes_on_page,
+                       FLAG_always_promote_young_mc)) {
+      if (page->IsFlagSet(MemoryChunk::NEW_SPACE_BELOW_AGE_MARK) ||
+          FLAG_always_promote_young_mc) {
         EvacuateNewSpacePageVisitor<NEW_TO_OLD>::Move(page);
         DCHECK_EQ(heap()->old_space(), page->owner());
         // The move added page->allocated_bytes to the old space, but we are
@@ -3059,6 +3208,14 @@ void MarkCompactCollector::EvacuatePagesInParallel() {
 
   CreateAndExecuteEvacuationTasks<FullEvacuator>(this, &evacuation_job, nullptr,
                                                  live_bytes);
+
+  // After evacuation there might still be swept pages that weren't
+  // added to one of the compaction space but still reside in the
+  // sweeper's swept_list_. Merge remembered sets for those pages as
+  // well such that after mark-compact all pages either store slots
+  // in the sweeping or old-to-new remembered set.
+  sweeper()->MergeOldToNewRememberedSetsForSweptPages();
+
   PostProcessEvacuationCandidates();
 }
 
@@ -3337,7 +3494,7 @@ class ToSpaceUpdatingItem : public UpdatingItem {
   MarkingState* marking_state_;
 };
 
-template <typename MarkingState>
+template <typename MarkingState, GarbageCollector collector>
 class RememberedSetUpdatingItem : public UpdatingItem {
  public:
   explicit RememberedSetUpdatingItem(Heap* heap, MarkingState* marking_state,
@@ -3412,25 +3569,53 @@ class RememberedSetUpdatingItem : public UpdatingItem {
 
   void UpdateUntypedPointers() {
     if (chunk_->slot_set<OLD_TO_NEW, AccessMode::NON_ATOMIC>() != nullptr) {
+      DCHECK_IMPLIES(
+          collector == MARK_COMPACTOR,
+          chunk_->SweepingDone() &&
+              chunk_->sweeping_slot_set<AccessMode::NON_ATOMIC>() == nullptr);
+
       InvalidatedSlotsFilter filter = InvalidatedSlotsFilter::OldToNew(chunk_);
-      RememberedSet<OLD_TO_NEW>::Iterate(
+      int slots = RememberedSet<OLD_TO_NEW>::Iterate(
           chunk_,
           [this, &filter](MaybeObjectSlot slot) {
             if (!filter.IsValid(slot.address())) return REMOVE_SLOT;
             return CheckAndUpdateOldToNewSlot(slot);
           },
           SlotSet::FREE_EMPTY_BUCKETS);
+
+      DCHECK_IMPLIES(
+          collector == MARK_COMPACTOR && FLAG_always_promote_young_mc,
+          slots == 0);
+
+      if (slots == 0) {
+        chunk_->ReleaseSlotSet<OLD_TO_NEW>();
+      }
     }
 
     if (chunk_->sweeping_slot_set<AccessMode::NON_ATOMIC>()) {
+      DCHECK_IMPLIES(
+          collector == MARK_COMPACTOR,
+          !chunk_->SweepingDone() &&
+              (chunk_->slot_set<OLD_TO_NEW, AccessMode::NON_ATOMIC>()) ==
+                  nullptr);
+      DCHECK(!chunk_->IsLargePage());
+
       InvalidatedSlotsFilter filter = InvalidatedSlotsFilter::OldToNew(chunk_);
-      RememberedSetSweeping::Iterate(
+      int slots = RememberedSetSweeping::Iterate(
           chunk_,
           [this, &filter](MaybeObjectSlot slot) {
             if (!filter.IsValid(slot.address())) return REMOVE_SLOT;
             return CheckAndUpdateOldToNewSlot(slot);
           },
           SlotSet::FREE_EMPTY_BUCKETS);
+
+      DCHECK_IMPLIES(
+          collector == MARK_COMPACTOR && FLAG_always_promote_young_mc,
+          slots == 0);
+
+      if (slots == 0) {
+        chunk_->ReleaseSweepingSlotSet();
+      }
     }
 
     if (chunk_->invalidated_slots<OLD_TO_NEW>() != nullptr) {
@@ -3502,7 +3687,7 @@ UpdatingItem* MarkCompactCollector::CreateToSpaceUpdatingItem(
 
 UpdatingItem* MarkCompactCollector::CreateRememberedSetUpdatingItem(
     MemoryChunk* chunk, RememberedSetUpdatingMode updating_mode) {
-  return new RememberedSetUpdatingItem<NonAtomicMarkingState>(
+  return new RememberedSetUpdatingItem<NonAtomicMarkingState, MARK_COMPACTOR>(
       heap(), non_atomic_marking_state(), chunk, updating_mode);
 }
 
@@ -3654,8 +3839,8 @@ class EphemeronTableUpdatingItem : public UpdatingItem {
       DCHECK(table.Object::IsEphemeronHashTable());
       for (auto iti = indices.begin(); iti != indices.end();) {
         // EphemeronHashTable keys must be heap objects.
-        HeapObjectSlot key_slot(
-            table.RawFieldOfElementAt(EphemeronHashTable::EntryToIndex(*iti)));
+        HeapObjectSlot key_slot(table.RawFieldOfElementAt(
+            EphemeronHashTable::EntryToIndex(InternalIndex(*iti))));
         HeapObject key = key_slot.ToHeapObject();
         MapWord map_word = key.map_word();
         if (map_word.IsForwardingAddress()) {
@@ -3915,31 +4100,6 @@ void MarkCompactCollector::StartSweepSpaces() {
   }
 }
 
-void MarkCompactCollector::MarkingWorklist::PrintWorklist(
-    const char* worklist_name, ConcurrentMarkingWorklist* worklist) {
-  std::map<InstanceType, int> count;
-  int total_count = 0;
-  worklist->IterateGlobalPool([&count, &total_count](HeapObject obj) {
-    ++total_count;
-    count[obj.map().instance_type()]++;
-  });
-  std::vector<std::pair<int, InstanceType>> rank;
-  rank.reserve(count.size());
-  for (const auto& i : count) {
-    rank.emplace_back(i.second, i.first);
-  }
-  std::map<InstanceType, std::string> instance_type_name;
-#define INSTANCE_TYPE_NAME(name) instance_type_name[name] = #name;
-  INSTANCE_TYPE_LIST(INSTANCE_TYPE_NAME)
-#undef INSTANCE_TYPE_NAME
-  std::sort(rank.begin(), rank.end(),
-            std::greater<std::pair<int, InstanceType>>());
-  PrintF("Worklist %s: %d\n", worklist_name, total_count);
-  for (auto i : rank) {
-    PrintF("  [%s]: %d\n", instance_type_name[i.second].c_str(), i.first);
-  }
-}
-
 #ifdef ENABLE_MINOR_MC
 
 namespace {
@@ -4106,6 +4266,13 @@ class YoungGenerationMarkingVisitor final
     UNREACHABLE();
   }
 
+  V8_INLINE int VisitJSArrayBuffer(Map map, JSArrayBuffer object) {
+    object.YoungMarkExtension();
+    int size = JSArrayBuffer::BodyDescriptor::SizeOf(map, object);
+    JSArrayBuffer::BodyDescriptor::IterateBody(map, object, size, this);
+    return size;
+  }
+
  private:
   template <typename TSlot>
   V8_INLINE void VisitPointersImpl(HeapObject host, TSlot start, TSlot end) {
@@ -4178,6 +4345,10 @@ void MinorMarkCompactCollector::CleanupSweepToIteratePages() {
   sweep_to_iterate_pages_.clear();
 }
 
+void MinorMarkCompactCollector::SweepArrayBufferExtensions() {
+  heap_->array_buffer_sweeper()->RequestSweepYoung();
+}
+
 class YoungGenerationMigrationObserver final : public MigrationObserver {
  public:
   YoungGenerationMigrationObserver(Heap* heap,
@@ -4213,6 +4384,11 @@ class YoungGenerationRecordMigratedSlotVisitor final
     UNREACHABLE();
   }
 
+  void MarkArrayBufferExtensionPromoted(HeapObject object) final {
+    if (!object.IsJSArrayBuffer()) return;
+    JSArrayBuffer::cast(object).YoungMarkExtensionPromoted();
+  }
+
  private:
   // Only record slots for host objects that are considered as live by the full
   // collector.
@@ -4228,8 +4404,9 @@ class YoungGenerationRecordMigratedSlotVisitor final
         DCHECK_IMPLIES(
             p->IsToPage(),
             p->IsFlagSet(Page::PAGE_NEW_NEW_PROMOTION) || p->IsLargePage());
-        RememberedSet<OLD_TO_NEW>::Insert<AccessMode::NON_ATOMIC>(
-            MemoryChunk::FromHeapObject(host), slot);
+        MemoryChunk* chunk = MemoryChunk::FromHeapObject(host);
+        DCHECK(chunk->SweepingDone());
+        RememberedSet<OLD_TO_NEW>::Insert<AccessMode::NON_ATOMIC>(chunk, slot);
       } else if (p->IsEvacuationCandidate() && IsLive(host)) {
         RememberedSet<OLD_TO_OLD>::Insert<AccessMode::NON_ATOMIC>(
             MemoryChunk::FromHeapObject(host), slot);
@@ -4334,6 +4511,8 @@ void MinorMarkCompactCollector::CollectGarbage() {
     CleanupSweepToIteratePages();
   }
 
+  heap()->array_buffer_sweeper()->EnsureFinished();
+
   MarkLiveObjects();
   ClearNonLiveReferences();
 #ifdef VERIFY_HEAP
@@ -4374,12 +4553,9 @@ void MinorMarkCompactCollector::CollectGarbage() {
     heap()->new_lo_space()->FreeDeadObjects([](HeapObject) { return true; });
   }
 
-  RememberedSet<OLD_TO_NEW>::IterateMemoryChunks(
-      heap(), [](MemoryChunk* chunk) {
-        RememberedSet<OLD_TO_NEW>::FreeEmptyBuckets(chunk);
-      });
-
   heap()->account_external_memory_concurrently_freed();
+
+  SweepArrayBufferExtensions();
 }
 
 void MinorMarkCompactCollector::MakeIterable(
@@ -4544,7 +4720,8 @@ UpdatingItem* MinorMarkCompactCollector::CreateToSpaceUpdatingItem(
 
 UpdatingItem* MinorMarkCompactCollector::CreateRememberedSetUpdatingItem(
     MemoryChunk* chunk, RememberedSetUpdatingMode updating_mode) {
-  return new RememberedSetUpdatingItem<NonAtomicMarkingState>(
+  return new RememberedSetUpdatingItem<NonAtomicMarkingState,
+                                       MINOR_MARK_COMPACTOR>(
       heap(), non_atomic_marking_state(), chunk, updating_mode);
 }
 
@@ -4771,7 +4948,7 @@ void MinorMarkCompactCollector::MarkLiveObjects() {
   // Mark rest on the main thread.
   {
     TRACE_GC(heap()->tracer(), GCTracer::Scope::MINOR_MC_MARK_WEAK);
-    ProcessMarkingWorklist();
+    DrainMarkingWorklist();
   }
 
   {
@@ -4784,15 +4961,15 @@ void MinorMarkCompactCollector::MarkLiveObjects() {
         ->global_handles()
         ->IterateYoungWeakUnmodifiedRootsForPhantomHandles(
             &root_visitor, &IsUnmarkedObjectForYoungGeneration);
-    ProcessMarkingWorklist();
+    DrainMarkingWorklist();
   }
 }
 
-void MinorMarkCompactCollector::ProcessMarkingWorklist() {
+void MinorMarkCompactCollector::DrainMarkingWorklist() {
   MarkingWorklist::View marking_worklist(worklist(), kMainMarker);
   HeapObject object;
   while (marking_worklist.Pop(&object)) {
-    DCHECK(!object.IsFiller());
+    DCHECK(!object.IsFreeSpaceOrFiller());
     DCHECK(object.IsHeapObject());
     DCHECK(heap()->Contains(object));
     DCHECK(non_atomic_marking_state()->IsGrey(object));
@@ -4849,8 +5026,11 @@ namespace {
 class YoungGenerationEvacuator : public Evacuator {
  public:
   explicit YoungGenerationEvacuator(MinorMarkCompactCollector* collector)
-      : Evacuator(collector->heap(), &record_visitor_),
+      : Evacuator(collector->heap(), &record_visitor_, &local_allocator_,
+                  false),
         record_visitor_(collector->heap()->mark_compact_collector()),
+        local_allocator_(heap_,
+                         LocalSpaceKind::kCompactionSpaceForMinorMarkCompact),
         collector_(collector) {}
 
   GCTracer::BackgroundScope::ScopeId GetBackgroundTracingScope() override {
@@ -4865,6 +5045,7 @@ class YoungGenerationEvacuator : public Evacuator {
   void RawEvacuatePage(MemoryChunk* chunk, intptr_t* live_bytes) override;
 
   YoungGenerationRecordMigratedSlotVisitor record_visitor_;
+  LocalAllocator local_allocator_;
   MinorMarkCompactCollector* collector_;
 };
 
@@ -4942,7 +5123,7 @@ void MinorMarkCompactCollector::EvacuatePagesInParallel() {
     intptr_t live_bytes_on_page = non_atomic_marking_state()->live_bytes(page);
     if (live_bytes_on_page == 0 && !page->contains_array_buffers()) continue;
     live_bytes += live_bytes_on_page;
-    if (ShouldMovePage(page, live_bytes_on_page)) {
+    if (ShouldMovePage(page, live_bytes_on_page, false)) {
       if (page->IsFlagSet(MemoryChunk::NEW_SPACE_BELOW_AGE_MARK)) {
         EvacuateNewSpacePageVisitor<NEW_TO_OLD>::Move(page);
       } else {
diff --git a/deps/v8/src/heap/mark-compact.h b/deps/v8/src/heap/mark-compact.h
index 8c6a2b4cc6fd32..7e13db214574bb 100644
--- a/deps/v8/src/heap/mark-compact.h
+++ b/deps/v8/src/heap/mark-compact.h
@@ -9,13 +9,12 @@
 #include <vector>
 
 #include "src/heap/concurrent-marking.h"
+#include "src/heap/marking-visitor.h"
+#include "src/heap/marking-worklist.h"
 #include "src/heap/marking.h"
-#include "src/heap/objects-visiting.h"
+#include "src/heap/memory-measurement.h"
 #include "src/heap/spaces.h"
 #include "src/heap/sweeper.h"
-#include "src/heap/worklist.h"
-#include "src/objects/heap-object.h"   // For Worklist<HeapObject, ...>
-#include "src/objects/js-weak-refs.h"  // For Worklist<WeakCell, ...>
 
 namespace v8 {
 namespace internal {
@@ -29,53 +28,6 @@ class RecordMigratedSlotVisitor;
 class UpdatingItem;
 class YoungGenerationMarkingVisitor;
 
-template <typename ConcreteState, AccessMode access_mode>
-class MarkingStateBase {
- public:
-  V8_INLINE MarkBit MarkBitFrom(HeapObject obj) {
-    return MarkBitFrom(MemoryChunk::FromHeapObject(obj), obj.ptr());
-  }
-
-  // {addr} may be tagged or aligned.
-  V8_INLINE MarkBit MarkBitFrom(MemoryChunk* p, Address addr) {
-    return static_cast<ConcreteState*>(this)->bitmap(p)->MarkBitFromIndex(
-        p->AddressToMarkbitIndex(addr));
-  }
-
-  Marking::ObjectColor Color(HeapObject obj) {
-    return Marking::Color(MarkBitFrom(obj));
-  }
-
-  V8_INLINE bool IsImpossible(HeapObject obj) {
-    return Marking::IsImpossible<access_mode>(MarkBitFrom(obj));
-  }
-
-  V8_INLINE bool IsBlack(HeapObject obj) {
-    return Marking::IsBlack<access_mode>(MarkBitFrom(obj));
-  }
-
-  V8_INLINE bool IsWhite(HeapObject obj) {
-    return Marking::IsWhite<access_mode>(MarkBitFrom(obj));
-  }
-
-  V8_INLINE bool IsGrey(HeapObject obj) {
-    return Marking::IsGrey<access_mode>(MarkBitFrom(obj));
-  }
-
-  V8_INLINE bool IsBlackOrGrey(HeapObject obj) {
-    return Marking::IsBlackOrGrey<access_mode>(MarkBitFrom(obj));
-  }
-
-  V8_INLINE bool WhiteToGrey(HeapObject obj);
-  V8_INLINE bool WhiteToBlack(HeapObject obj);
-  V8_INLINE bool GreyToBlack(HeapObject obj);
-
-  void ClearLiveness(MemoryChunk* chunk) {
-    static_cast<ConcreteState*>(this)->bitmap(chunk)->Clear();
-    static_cast<ConcreteState*>(this)->SetLiveBytes(chunk, 0);
-  }
-};
-
 class MarkBitCellIterator {
  public:
   MarkBitCellIterator(MemoryChunk* chunk, Bitmap* bitmap) : chunk_(chunk) {
@@ -136,11 +88,7 @@ class MarkBitCellIterator {
   Address cell_base_;
 };
 
-enum LiveObjectIterationMode {
-  kBlackObjects,
-  kGreyObjects,
-  kAllLiveObjects
-};
+enum LiveObjectIterationMode { kBlackObjects, kGreyObjects, kAllLiveObjects };
 
 template <LiveObjectIterationMode mode>
 class LiveObjectRange {
@@ -239,8 +187,6 @@ enum class RememberedSetUpdatingMode { ALL, OLD_TO_NEW_ONLY };
 // Base class for minor and full MC collectors.
 class MarkCompactCollectorBase {
  public:
-  static const int kMainThread = 0;
-
   virtual ~MarkCompactCollectorBase() = default;
 
   virtual void SetUp() = 0;
@@ -258,7 +204,7 @@ class MarkCompactCollectorBase {
   virtual void MarkLiveObjects() = 0;
   // Mark objects reachable (transitively) from objects in the marking
   // work list.
-  virtual void ProcessMarkingWorklist() = 0;
+  virtual void DrainMarkingWorklist() = 0;
   // Clear non-live references held in side data structures.
   virtual void ClearNonLiveReferences() = 0;
   virtual void EvacuatePrologue() = 0;
@@ -279,7 +225,7 @@ class MarkCompactCollectorBase {
                                        const intptr_t live_bytes);
 
   // Returns whether this page should be moved according to heuristics.
-  bool ShouldMovePage(Page* p, intptr_t live_bytes);
+  bool ShouldMovePage(Page* p, intptr_t live_bytes, bool promote_young);
 
   int CollectToSpaceUpdatingItems(ItemParallelJob* job);
   template <typename IterateableSpace>
@@ -342,9 +288,9 @@ class MinorNonAtomicMarkingState final
   }
 };
 
-// This marking state is used when concurrent marking is running.
-class IncrementalMarkingState final
-    : public MarkingStateBase<IncrementalMarkingState, AccessMode::ATOMIC> {
+// This is used by marking visitors.
+class MajorMarkingState final
+    : public MarkingStateBase<MajorMarkingState, AccessMode::ATOMIC> {
  public:
   ConcurrentBitmap<AccessMode::ATOMIC>* bitmap(const MemoryChunk* chunk) const {
     DCHECK_EQ(reinterpret_cast<intptr_t>(&chunk->marking_bitmap_) -
@@ -368,6 +314,8 @@ class IncrementalMarkingState final
   }
 };
 
+// This is used by Scavenger and Evacuator in TransferColor.
+// Live byte increments have to be atomic.
 class MajorAtomicMarkingState final
     : public MarkingStateBase<MajorAtomicMarkingState, AccessMode::ATOMIC> {
  public:
@@ -409,161 +357,97 @@ class MajorNonAtomicMarkingState final
   }
 };
 
-struct Ephemeron {
-  HeapObject key;
-  HeapObject value;
-};
+// This visitor is used for marking on the main thread. It is cheaper than
+// the concurrent marking visitor because it does not snapshot JSObjects.
+template <typename MarkingState>
+class MainMarkingVisitor final
+    : public MarkingVisitorBase<MainMarkingVisitor<MarkingState>,
+                                MarkingState> {
+ public:
+  // This is used for revisiting objects that were black allocated.
+  class RevisitScope {
+   public:
+    explicit RevisitScope(MainMarkingVisitor* visitor) : visitor_(visitor) {
+      DCHECK(!visitor->revisiting_object_);
+      visitor->revisiting_object_ = true;
+    }
+    ~RevisitScope() {
+      DCHECK(visitor_->revisiting_object_);
+      visitor_->revisiting_object_ = false;
+    }
 
-using EphemeronWorklist = Worklist<Ephemeron, 64>;
+   private:
+    MainMarkingVisitor<MarkingState>* visitor_;
+  };
 
-// Weak objects encountered during marking.
-struct WeakObjects {
-  Worklist<TransitionArray, 64> transition_arrays;
+  MainMarkingVisitor(MarkingState* marking_state,
+                     MarkingWorklists* marking_worklists,
+                     WeakObjects* weak_objects, Heap* heap,
+                     unsigned mark_compact_epoch,
+                     BytecodeFlushMode bytecode_flush_mode,
+                     bool embedder_tracing_enabled, bool is_forced_gc)
+      : MarkingVisitorBase<MainMarkingVisitor<MarkingState>, MarkingState>(
+            kMainThreadTask, marking_worklists, weak_objects, heap,
+            mark_compact_epoch, bytecode_flush_mode, embedder_tracing_enabled,
+            is_forced_gc),
+        marking_state_(marking_state),
+        revisiting_object_(false) {}
+
+  // HeapVisitor override to allow revisiting of black objects.
+  bool ShouldVisit(HeapObject object) {
+    return marking_state_->GreyToBlack(object) ||
+           V8_UNLIKELY(revisiting_object_);
+  }
+
+  void MarkDescriptorArrayFromWriteBarrier(HeapObject host,
+                                           DescriptorArray descriptors,
+                                           int number_of_own_descriptors);
 
-  // Keep track of all EphemeronHashTables in the heap to process
-  // them in the atomic pause.
-  Worklist<EphemeronHashTable, 64> ephemeron_hash_tables;
+ private:
+  // Functions required by MarkingVisitorBase.
 
-  // Keep track of all ephemerons for concurrent marking tasks. Only store
-  // ephemerons in these Worklists if both key and value are unreachable at the
-  // moment.
-  //
-  // MarkCompactCollector::ProcessEphemeronsUntilFixpoint drains and fills these
-  // worklists.
-  //
-  // current_ephemerons is used as draining worklist in the current fixpoint
-  // iteration.
-  EphemeronWorklist current_ephemerons;
+  template <typename T, typename TBodyDescriptor = typename T::BodyDescriptor>
+  int VisitJSObjectSubclass(Map map, T object);
+
+  template <typename T>
+  int VisitLeftTrimmableArray(Map map, T object);
 
-  // Stores ephemerons to visit in the next fixpoint iteration.
-  EphemeronWorklist next_ephemerons;
+  template <typename TSlot>
+  void RecordSlot(HeapObject object, TSlot slot, HeapObject target);
 
-  // When draining the marking worklist new discovered ephemerons are pushed
-  // into this worklist.
-  EphemeronWorklist discovered_ephemerons;
+  void RecordRelocSlot(Code host, RelocInfo* rinfo, HeapObject target);
 
-  // TODO(marja): For old space, we only need the slot, not the host
-  // object. Optimize this by adding a different storage for old space.
-  Worklist<std::pair<HeapObject, HeapObjectSlot>, 64> weak_references;
-  Worklist<std::pair<HeapObject, Code>, 64> weak_objects_in_code;
+  void SynchronizePageAccess(HeapObject heap_object) {
+    // Nothing to do on the main thread.
+  }
 
-  Worklist<JSWeakRef, 64> js_weak_refs;
-  Worklist<WeakCell, 64> weak_cells;
+  MarkingState* marking_state() { return marking_state_; }
 
-  Worklist<SharedFunctionInfo, 64> bytecode_flushing_candidates;
-  Worklist<JSFunction, 64> flushed_js_functions;
-};
+  TraceRetainingPathMode retaining_path_mode() {
+    return (V8_UNLIKELY(FLAG_track_retaining_path))
+               ? TraceRetainingPathMode::kEnabled
+               : TraceRetainingPathMode::kDisabled;
+  }
 
-struct EphemeronMarking {
-  std::vector<HeapObject> newly_discovered;
-  bool newly_discovered_overflowed;
-  size_t newly_discovered_limit;
+  MarkingState* const marking_state_;
+
+  friend class MarkingVisitorBase<MainMarkingVisitor<MarkingState>,
+                                  MarkingState>;
+  bool revisiting_object_;
 };
 
 // Collector for young and old generation.
 class MarkCompactCollector final : public MarkCompactCollectorBase {
  public:
 #ifdef V8_CONCURRENT_MARKING
-  using MarkingState = IncrementalMarkingState;
+  using MarkingState = MajorMarkingState;
 #else
   using MarkingState = MajorNonAtomicMarkingState;
 #endif  // V8_CONCURRENT_MARKING
-
+  using AtomicMarkingState = MajorAtomicMarkingState;
   using NonAtomicMarkingState = MajorNonAtomicMarkingState;
 
-  // Wrapper for the shared worklist.
-  class MarkingWorklist {
-   public:
-    using ConcurrentMarkingWorklist = Worklist<HeapObject, 64>;
-    using EmbedderTracingWorklist = Worklist<HeapObject, 16>;
-
-    // The heap parameter is not used but needed to match the sequential case.
-    explicit MarkingWorklist(Heap* heap) {}
-
-    void Push(HeapObject object) {
-      bool success = shared_.Push(kMainThread, object);
-      USE(success);
-      DCHECK(success);
-    }
-
-    HeapObject Pop() {
-      HeapObject result;
-      if (shared_.Pop(kMainThread, &result)) return result;
-#ifdef V8_CONCURRENT_MARKING
-      // The expectation is that this work list is empty almost all the time
-      // and we can thus avoid the emptiness checks by putting it last.
-      if (on_hold_.Pop(kMainThread, &result)) return result;
-#endif
-      return HeapObject();
-    }
-
-    void Clear() {
-      shared_.Clear();
-      on_hold_.Clear();
-      embedder_.Clear();
-    }
-
-    bool IsEmpty() {
-      return shared_.IsLocalEmpty(kMainThread) &&
-             on_hold_.IsLocalEmpty(kMainThread) &&
-             shared_.IsGlobalPoolEmpty() && on_hold_.IsGlobalPoolEmpty();
-    }
-
-    bool IsEmbedderEmpty() {
-      return embedder_.IsLocalEmpty(kMainThread) &&
-             embedder_.IsGlobalPoolEmpty();
-    }
-
-    int Size() {
-      return static_cast<int>(shared_.LocalSize(kMainThread) +
-                              on_hold_.LocalSize(kMainThread));
-    }
-
-    // Calls the specified callback on each element of the deques and replaces
-    // the element with the result of the callback. If the callback returns
-    // nullptr then the element is removed from the deque.
-    // The callback must accept HeapObject and return HeapObject.
-    template <typename Callback>
-    void Update(Callback callback) {
-      shared_.Update(callback);
-      on_hold_.Update(callback);
-      embedder_.Update(callback);
-    }
-
-    void ShareWorkIfGlobalPoolIsEmpty() {
-      if (!shared_.IsLocalEmpty(kMainThread) && shared_.IsGlobalPoolEmpty()) {
-        shared_.FlushToGlobal(kMainThread);
-      }
-    }
-
-    ConcurrentMarkingWorklist* shared() { return &shared_; }
-    ConcurrentMarkingWorklist* on_hold() { return &on_hold_; }
-    EmbedderTracingWorklist* embedder() { return &embedder_; }
-
-    void Print() {
-      PrintWorklist("shared", &shared_);
-      PrintWorklist("on_hold", &on_hold_);
-    }
-
-   private:
-    // Prints the stats about the global pool of the worklist.
-    void PrintWorklist(const char* worklist_name,
-                       ConcurrentMarkingWorklist* worklist);
-
-    // Worklist used for most objects.
-    ConcurrentMarkingWorklist shared_;
-
-    // Concurrent marking uses this worklist to bail out of marking objects
-    // in new space's linear allocation area. Used to avoid black allocation
-    // for new space. This allow the compiler to remove write barriers
-    // for freshly allocatd objects.
-    ConcurrentMarkingWorklist on_hold_;
-
-    // Worklist for objects that potentially require embedder tracing, i.e.,
-    // these objects need to be handed over to the embedder to find the full
-    // transitive closure.
-    EmbedderTracingWorklist embedder_;
-  };
+  using MarkingVisitor = MainMarkingVisitor<MarkingState>;
 
   class RootMarkingVisitor;
   class CustomRootBodyMarkingVisitor;
@@ -573,6 +457,11 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
     kClearMarkbits,
   };
 
+  enum class MarkingWorklistProcessingMode {
+    kDefault,
+    kTrackNewlyDiscoveredObjects
+  };
+
   MarkingState* marking_state() { return &marking_state_; }
 
   NonAtomicMarkingState* non_atomic_marking_state() {
@@ -600,6 +489,8 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
 
   void AbortCompaction();
 
+  void StartMarking();
+
   static inline bool IsOnEvacuationCandidate(Object obj) {
     return Page::FromAddress(obj.ptr())->IsEvacuationCandidate();
   }
@@ -640,41 +531,15 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
 
   bool evacuation() const { return evacuation_; }
 
-  MarkingWorklist* marking_worklist() { return &marking_worklist_; }
+  MarkingWorklistsHolder* marking_worklists_holder() {
+    return &marking_worklists_holder_;
+  }
+  MarkingWorklists* marking_worklists() { return marking_worklists_.get(); }
 
   WeakObjects* weak_objects() { return &weak_objects_; }
 
   inline void AddTransitionArray(TransitionArray array);
 
-  void AddEphemeronHashTable(EphemeronHashTable table) {
-    weak_objects_.ephemeron_hash_tables.Push(kMainThread, table);
-  }
-
-  void AddEphemeron(HeapObject key, HeapObject value) {
-    weak_objects_.discovered_ephemerons.Push(kMainThread,
-                                             Ephemeron{key, value});
-  }
-
-  void AddWeakReference(HeapObject host, HeapObjectSlot slot) {
-    weak_objects_.weak_references.Push(kMainThread, std::make_pair(host, slot));
-  }
-
-  void AddWeakObjectInCode(HeapObject object, Code code) {
-    weak_objects_.weak_objects_in_code.Push(kMainThread,
-                                            std::make_pair(object, code));
-  }
-
-  void AddWeakRef(JSWeakRef weak_ref) {
-    weak_objects_.js_weak_refs.Push(kMainThread, weak_ref);
-  }
-
-  void AddWeakCell(WeakCell weak_cell) {
-    weak_objects_.weak_cells.Push(kMainThread, weak_cell);
-  }
-
-  inline void AddBytecodeFlushingCandidate(SharedFunctionInfo flush_candidate);
-  inline void AddFlushedJSFunction(JSFunction flushed_function);
-
   void AddNewlyDiscovered(HeapObject object) {
     if (ephemeron_marking_.newly_discovered_overflowed) return;
 
@@ -716,6 +581,22 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
 
   // Used by wrapper tracing.
   V8_INLINE void MarkExternallyReferencedObject(HeapObject obj);
+  // Used by incremental marking for object that change their layout.
+  void VisitObject(HeapObject obj);
+  // Used by incremental marking for black-allocated objects.
+  void RevisitObject(HeapObject obj);
+  // Ensures that all descriptors int range [0, number_of_own_descripts)
+  // are visited.
+  void MarkDescriptorArrayFromWriteBarrier(HeapObject host,
+                                           DescriptorArray array,
+                                           int number_of_own_descriptors);
+
+  // Drains the main thread marking worklist until the specified number of
+  // bytes are processed. If the number of bytes is zero, then the worklist
+  // is drained until it is empty.
+  template <MarkingWorklistProcessingMode mode =
+                MarkingWorklistProcessingMode::kDefault>
+  size_t ProcessMarkingWorklist(size_t bytes_to_process);
 
  private:
   void ComputeEvacuationHeuristics(size_t area_size,
@@ -727,6 +608,9 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   // Finishes GC, performs heap verification if enabled.
   void Finish();
 
+  // Free unmarked ArrayBufferExtensions.
+  void SweepArrayBufferExtensions();
+
   void MarkLiveObjects() override;
 
   // Marks the object black and adds it to the marking work list.
@@ -755,15 +639,7 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
 
   // Drains the main thread marking work list. Will mark all pending objects
   // if no concurrent threads are running.
-  void ProcessMarkingWorklist() override;
-
-  enum class MarkingWorklistProcessingMode {
-    kDefault,
-    kTrackNewlyDiscoveredObjects
-  };
-
-  template <MarkingWorklistProcessingMode mode>
-  void ProcessMarkingWorklistInternal();
+  void DrainMarkingWorklist() override;
 
   // Implements ephemeron semantics: Marks value if key is already reachable.
   // Returns true if value was actually marked.
@@ -867,15 +743,13 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   base::Semaphore page_parallel_job_semaphore_;
 
 #ifdef DEBUG
-  enum CollectorState {
-    IDLE,
-    PREPARE_GC,
-    MARK_LIVE_OBJECTS,
-    SWEEP_SPACES,
-    ENCODE_FORWARDING_ADDRESSES,
-    UPDATE_POINTERS,
-    RELOCATE_OBJECTS
-  };
+  enum CollectorState{IDLE,
+                      PREPARE_GC,
+                      MARK_LIVE_OBJECTS,
+                      SWEEP_SPACES,
+                      ENCODE_FORWARDING_ADDRESSES,
+                      UPDATE_POINTERS,
+                      RELOCATE_OBJECTS};
 
   // The current stage of the collector.
   CollectorState state_;
@@ -893,10 +767,16 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
 
   bool have_code_to_deoptimize_;
 
-  MarkingWorklist marking_worklist_;
+  MarkingWorklistsHolder marking_worklists_holder_;
+
   WeakObjects weak_objects_;
   EphemeronMarking ephemeron_marking_;
 
+  std::unique_ptr<MarkingVisitor> marking_visitor_;
+  std::unique_ptr<MarkingWorklists> marking_worklists_;
+  NativeContextInferrer native_context_inferrer_;
+  NativeContextStats native_context_stats_;
+
   // Candidates for pages that should be evacuated.
   std::vector<Page*> evacuation_candidates_;
   // Pages that are actually processed during evacuation.
@@ -920,97 +800,6 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   friend class RecordMigratedSlotVisitor;
 };
 
-template <FixedArrayVisitationMode fixed_array_mode,
-          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
-class MarkingVisitor final
-    : public HeapVisitor<
-          int,
-          MarkingVisitor<fixed_array_mode, retaining_path_mode, MarkingState>> {
- public:
-  using Parent = HeapVisitor<
-      int, MarkingVisitor<fixed_array_mode, retaining_path_mode, MarkingState>>;
-
-  V8_INLINE MarkingVisitor(MarkCompactCollector* collector,
-                           MarkingState* marking_state);
-
-  V8_INLINE bool ShouldVisitMapPointer() { return false; }
-
-  V8_INLINE int VisitBytecodeArray(Map map, BytecodeArray object);
-  V8_INLINE int VisitDescriptorArray(Map map, DescriptorArray object);
-  V8_INLINE int VisitEphemeronHashTable(Map map, EphemeronHashTable object);
-  V8_INLINE int VisitFixedArray(Map map, FixedArray object);
-  V8_INLINE int VisitJSApiObject(Map map, JSObject object);
-  V8_INLINE int VisitJSArrayBuffer(Map map, JSArrayBuffer object);
-  V8_INLINE int VisitJSFunction(Map map, JSFunction object);
-  V8_INLINE int VisitJSDataView(Map map, JSDataView object);
-  V8_INLINE int VisitJSTypedArray(Map map, JSTypedArray object);
-  V8_INLINE int VisitMap(Map map, Map object);
-  V8_INLINE int VisitSharedFunctionInfo(Map map, SharedFunctionInfo object);
-  V8_INLINE int VisitTransitionArray(Map map, TransitionArray object);
-  V8_INLINE int VisitWeakCell(Map map, WeakCell object);
-  V8_INLINE int VisitJSWeakRef(Map map, JSWeakRef object);
-
-  // ObjectVisitor implementation.
-  V8_INLINE void VisitPointer(HeapObject host, ObjectSlot p) final {
-    VisitPointerImpl(host, p);
-  }
-  V8_INLINE void VisitPointer(HeapObject host, MaybeObjectSlot p) final {
-    VisitPointerImpl(host, p);
-  }
-  V8_INLINE void VisitPointers(HeapObject host, ObjectSlot start,
-                               ObjectSlot end) final {
-    VisitPointersImpl(host, start, end);
-  }
-  V8_INLINE void VisitPointers(HeapObject host, MaybeObjectSlot start,
-                               MaybeObjectSlot end) final {
-    VisitPointersImpl(host, start, end);
-  }
-  V8_INLINE void VisitEmbeddedPointer(Code host, RelocInfo* rinfo) final;
-  V8_INLINE void VisitCodeTarget(Code host, RelocInfo* rinfo) final;
-
-  // Weak list pointers should be ignored during marking. The lists are
-  // reconstructed after GC.
-  void VisitCustomWeakPointers(HeapObject host, ObjectSlot start,
-                               ObjectSlot end) final {}
-
-  V8_INLINE void VisitDescriptors(DescriptorArray descriptors,
-                                  int number_of_own_descriptors);
-  // Marks the descriptor array black without pushing it on the marking work
-  // list and visits its header.
-  V8_INLINE void MarkDescriptorArrayBlack(HeapObject host,
-                                          DescriptorArray descriptors);
-
- private:
-  // Granularity in which FixedArrays are scanned if |fixed_array_mode|
-  // is true.
-  static const int kProgressBarScanningChunk = 32 * KB;
-
-  template <typename TSlot>
-  V8_INLINE void VisitPointerImpl(HeapObject host, TSlot p);
-
-  template <typename TSlot>
-  V8_INLINE void VisitPointersImpl(HeapObject host, TSlot start, TSlot end);
-
-  V8_INLINE int VisitFixedArrayIncremental(Map map, FixedArray object);
-
-  template <typename T>
-  V8_INLINE int VisitEmbedderTracingSubclass(Map map, T object);
-
-  // Marks the object grey and pushes it on the marking work list.
-  V8_INLINE void MarkObject(HeapObject host, HeapObject obj);
-
-  MarkingState* marking_state() { return marking_state_; }
-
-  MarkCompactCollector::MarkingWorklist* marking_worklist() const {
-    return collector_->marking_worklist();
-  }
-
-  Heap* const heap_;
-  MarkCompactCollector* const collector_;
-  MarkingState* const marking_state_;
-  const unsigned mark_compact_epoch_;
-};
-
 class EvacuationScope {
  public:
   explicit EvacuationScope(MarkCompactCollector* collector)
@@ -1065,7 +854,7 @@ class MinorMarkCompactCollector final : public MarkCompactCollectorBase {
   void MarkLiveObjects() override;
   void MarkRootSetInParallel(RootMarkingVisitor* root_visitor);
   V8_INLINE void MarkRootObject(HeapObject obj);
-  void ProcessMarkingWorklist() override;
+  void DrainMarkingWorklist() override;
   void ClearNonLiveReferences() override;
 
   void EvacuatePrologue() override;
@@ -1083,6 +872,8 @@ class MinorMarkCompactCollector final : public MarkCompactCollectorBase {
 
   int NumberOfParallelMarkingTasks(int pages);
 
+  void SweepArrayBufferExtensions();
+
   MarkingWorklist* worklist_;
 
   YoungGenerationMarkingVisitor* main_marking_visitor_;
diff --git a/deps/v8/src/heap/marking-visitor-inl.h b/deps/v8/src/heap/marking-visitor-inl.h
new file mode 100644
index 00000000000000..e162268e303e02
--- /dev/null
+++ b/deps/v8/src/heap/marking-visitor-inl.h
@@ -0,0 +1,443 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_MARKING_VISITOR_INL_H_
+#define V8_HEAP_MARKING_VISITOR_INL_H_
+
+#include "src/heap/marking-visitor.h"
+#include "src/heap/objects-visiting-inl.h"
+#include "src/heap/objects-visiting.h"
+#include "src/heap/spaces.h"
+
+namespace v8 {
+namespace internal {
+
+// ===========================================================================
+// Visiting strong and weak pointers =========================================
+// ===========================================================================
+
+template <typename ConcreteVisitor, typename MarkingState>
+void MarkingVisitorBase<ConcreteVisitor, MarkingState>::MarkObject(
+    HeapObject host, HeapObject object) {
+  concrete_visitor()->SynchronizePageAccess(object);
+  if (concrete_visitor()->marking_state()->WhiteToGrey(object)) {
+    marking_worklists_->Push(object);
+    if (V8_UNLIKELY(concrete_visitor()->retaining_path_mode() ==
+                    TraceRetainingPathMode::kEnabled)) {
+      heap_->AddRetainer(host, object);
+    }
+  }
+}
+
+// class template arguments
+template <typename ConcreteVisitor, typename MarkingState>
+// method template arguments
+template <typename THeapObjectSlot>
+void MarkingVisitorBase<ConcreteVisitor, MarkingState>::ProcessStrongHeapObject(
+    HeapObject host, THeapObjectSlot slot, HeapObject heap_object) {
+  MarkObject(host, heap_object);
+  concrete_visitor()->RecordSlot(host, slot, heap_object);
+}
+
+// class template arguments
+template <typename ConcreteVisitor, typename MarkingState>
+// method template arguments
+template <typename THeapObjectSlot>
+void MarkingVisitorBase<ConcreteVisitor, MarkingState>::ProcessWeakHeapObject(
+    HeapObject host, THeapObjectSlot slot, HeapObject heap_object) {
+  concrete_visitor()->SynchronizePageAccess(heap_object);
+  if (concrete_visitor()->marking_state()->IsBlackOrGrey(heap_object)) {
+    // Weak references with live values are directly processed here to
+    // reduce the processing time of weak cells during the main GC
+    // pause.
+    concrete_visitor()->RecordSlot(host, slot, heap_object);
+  } else {
+    // If we do not know about liveness of the value, we have to process
+    // the reference when we know the liveness of the whole transitive
+    // closure.
+    weak_objects_->weak_references.Push(task_id_, std::make_pair(host, slot));
+  }
+}
+
+// class template arguments
+template <typename ConcreteVisitor, typename MarkingState>
+// method template arguments
+template <typename TSlot>
+V8_INLINE void
+MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitPointersImpl(
+    HeapObject host, TSlot start, TSlot end) {
+  using THeapObjectSlot = typename TSlot::THeapObjectSlot;
+  for (TSlot slot = start; slot < end; ++slot) {
+    typename TSlot::TObject object = slot.Relaxed_Load();
+    HeapObject heap_object;
+    if (object.GetHeapObjectIfStrong(&heap_object)) {
+      // If the reference changes concurrently from strong to weak, the write
+      // barrier will treat the weak reference as strong, so we won't miss the
+      // weak reference.
+      ProcessStrongHeapObject(host, THeapObjectSlot(slot), heap_object);
+    } else if (TSlot::kCanBeWeak && object.GetHeapObjectIfWeak(&heap_object)) {
+      ProcessWeakHeapObject(host, THeapObjectSlot(slot), heap_object);
+    }
+  }
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+void MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitEmbeddedPointer(
+    Code host, RelocInfo* rinfo) {
+  DCHECK(RelocInfo::IsEmbeddedObjectMode(rinfo->rmode()));
+  HeapObject object = rinfo->target_object();
+  if (!concrete_visitor()->marking_state()->IsBlackOrGrey(object)) {
+    if (host.IsWeakObject(object)) {
+      weak_objects_->weak_objects_in_code.Push(task_id_,
+                                               std::make_pair(object, host));
+    } else {
+      MarkObject(host, object);
+    }
+  }
+  concrete_visitor()->RecordRelocSlot(host, rinfo, object);
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+void MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitCodeTarget(
+    Code host, RelocInfo* rinfo) {
+  DCHECK(RelocInfo::IsCodeTargetMode(rinfo->rmode()));
+  Code target = Code::GetCodeFromTargetAddress(rinfo->target_address());
+  MarkObject(host, target);
+  concrete_visitor()->RecordRelocSlot(host, rinfo, target);
+}
+
+// ===========================================================================
+// Object participating in bytecode flushing =================================
+// ===========================================================================
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitBytecodeArray(
+    Map map, BytecodeArray object) {
+  if (!concrete_visitor()->ShouldVisit(object)) return 0;
+  int size = BytecodeArray::BodyDescriptor::SizeOf(map, object);
+  this->VisitMapPointer(object);
+  BytecodeArray::BodyDescriptor::IterateBody(map, object, size, this);
+  if (!is_forced_gc_) {
+    object.MakeOlder();
+  }
+  return size;
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitJSFunction(
+    Map map, JSFunction object) {
+  int size = concrete_visitor()->VisitJSObjectSubclass(map, object);
+  // Check if the JSFunction needs reset due to bytecode being flushed.
+  if (bytecode_flush_mode_ != BytecodeFlushMode::kDoNotFlushBytecode &&
+      object.NeedsResetDueToFlushedBytecode()) {
+    weak_objects_->flushed_js_functions.Push(task_id_, object);
+  }
+  return size;
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitSharedFunctionInfo(
+    Map map, SharedFunctionInfo shared_info) {
+  if (!concrete_visitor()->ShouldVisit(shared_info)) return 0;
+
+  int size = SharedFunctionInfo::BodyDescriptor::SizeOf(map, shared_info);
+  this->VisitMapPointer(shared_info);
+  SharedFunctionInfo::BodyDescriptor::IterateBody(map, shared_info, size, this);
+
+  // If the SharedFunctionInfo has old bytecode, mark it as flushable,
+  // otherwise visit the function data field strongly.
+  if (shared_info.ShouldFlushBytecode(bytecode_flush_mode_)) {
+    weak_objects_->bytecode_flushing_candidates.Push(task_id_, shared_info);
+  } else {
+    VisitPointer(shared_info,
+                 shared_info.RawField(SharedFunctionInfo::kFunctionDataOffset));
+  }
+  return size;
+}
+
+// ===========================================================================
+// Fixed arrays that need incremental processing and can be left-trimmed =====
+// ===========================================================================
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::
+    VisitFixedArrayWithProgressBar(Map map, FixedArray object,
+                                   MemoryChunk* chunk) {
+  const int kProgressBarScanningChunk = kMaxRegularHeapObjectSize;
+  STATIC_ASSERT(kMaxRegularHeapObjectSize % kTaggedSize == 0);
+  DCHECK(concrete_visitor()->marking_state()->IsBlackOrGrey(object));
+  concrete_visitor()->marking_state()->GreyToBlack(object);
+  int size = FixedArray::BodyDescriptor::SizeOf(map, object);
+  size_t current_progress_bar = chunk->ProgressBar();
+  int start = static_cast<int>(current_progress_bar);
+  if (start == 0) {
+    this->VisitMapPointer(object);
+    start = FixedArray::BodyDescriptor::kStartOffset;
+  }
+  int end = Min(size, start + kProgressBarScanningChunk);
+  if (start < end) {
+    VisitPointers(object, object.RawField(start), object.RawField(end));
+    bool success = chunk->TrySetProgressBar(current_progress_bar, end);
+    CHECK(success);
+    if (end < size) {
+      // The object can be pushed back onto the marking worklist only after
+      // progress bar was updated.
+      marking_worklists_->Push(object);
+    }
+  }
+  return end - start;
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitFixedArray(
+    Map map, FixedArray object) {
+  // Arrays with the progress bar are not left-trimmable because they reside
+  // in the large object space.
+  MemoryChunk* chunk = MemoryChunk::FromHeapObject(object);
+  return chunk->IsFlagSet<AccessMode::ATOMIC>(MemoryChunk::HAS_PROGRESS_BAR)
+             ? VisitFixedArrayWithProgressBar(map, object, chunk)
+             : concrete_visitor()->VisitLeftTrimmableArray(map, object);
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitFixedDoubleArray(
+    Map map, FixedDoubleArray object) {
+  return concrete_visitor()->VisitLeftTrimmableArray(map, object);
+}
+
+// ===========================================================================
+// Objects participating in embedder tracing =================================
+// ===========================================================================
+
+template <typename ConcreteVisitor, typename MarkingState>
+template <typename T>
+int MarkingVisitorBase<ConcreteVisitor,
+                       MarkingState>::VisitEmbedderTracingSubclass(Map map,
+                                                                   T object) {
+  DCHECK(object.IsApiWrapper());
+  int size = concrete_visitor()->VisitJSObjectSubclass(map, object);
+  if (size && is_embedder_tracing_enabled_) {
+    // Success: The object needs to be processed for embedder references on
+    // the main thread.
+    marking_worklists_->PushEmbedder(object);
+  }
+  return size;
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitJSApiObject(
+    Map map, JSObject object) {
+  return VisitEmbedderTracingSubclass(map, object);
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitJSArrayBuffer(
+    Map map, JSArrayBuffer object) {
+  object.MarkExtension();
+  return VisitEmbedderTracingSubclass(map, object);
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitJSDataView(
+    Map map, JSDataView object) {
+  return VisitEmbedderTracingSubclass(map, object);
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitJSTypedArray(
+    Map map, JSTypedArray object) {
+  return VisitEmbedderTracingSubclass(map, object);
+}
+
+// ===========================================================================
+// Weak JavaScript objects ===================================================
+// ===========================================================================
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitEphemeronHashTable(
+    Map map, EphemeronHashTable table) {
+  if (!concrete_visitor()->ShouldVisit(table)) return 0;
+  weak_objects_->ephemeron_hash_tables.Push(task_id_, table);
+
+  for (InternalIndex i : table.IterateEntries()) {
+    ObjectSlot key_slot =
+        table.RawFieldOfElementAt(EphemeronHashTable::EntryToIndex(i));
+    HeapObject key = HeapObject::cast(table.KeyAt(i));
+
+    concrete_visitor()->SynchronizePageAccess(key);
+    concrete_visitor()->RecordSlot(table, key_slot, key);
+
+    ObjectSlot value_slot =
+        table.RawFieldOfElementAt(EphemeronHashTable::EntryToValueIndex(i));
+
+    if (concrete_visitor()->marking_state()->IsBlackOrGrey(key)) {
+      VisitPointer(table, value_slot);
+    } else {
+      Object value_obj = table.ValueAt(i);
+
+      if (value_obj.IsHeapObject()) {
+        HeapObject value = HeapObject::cast(value_obj);
+        concrete_visitor()->SynchronizePageAccess(value);
+        concrete_visitor()->RecordSlot(table, value_slot, value);
+
+        // Revisit ephemerons with both key and value unreachable at end
+        // of concurrent marking cycle.
+        if (concrete_visitor()->marking_state()->IsWhite(value)) {
+          weak_objects_->discovered_ephemerons.Push(task_id_,
+                                                    Ephemeron{key, value});
+        }
+      }
+    }
+  }
+  return table.SizeFromMap(map);
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitJSWeakRef(
+    Map map, JSWeakRef weak_ref) {
+  int size = concrete_visitor()->VisitJSObjectSubclass(map, weak_ref);
+  if (size == 0) return 0;
+  if (weak_ref.target().IsHeapObject()) {
+    HeapObject target = HeapObject::cast(weak_ref.target());
+    concrete_visitor()->SynchronizePageAccess(target);
+    if (concrete_visitor()->marking_state()->IsBlackOrGrey(target)) {
+      // Record the slot inside the JSWeakRef, since the
+      // VisitJSObjectSubclass above didn't visit it.
+      ObjectSlot slot = weak_ref.RawField(JSWeakRef::kTargetOffset);
+      concrete_visitor()->RecordSlot(weak_ref, slot, target);
+    } else {
+      // JSWeakRef points to a potentially dead object. We have to process
+      // them when we know the liveness of the whole transitive closure.
+      weak_objects_->js_weak_refs.Push(task_id_, weak_ref);
+    }
+  }
+  return size;
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitWeakCell(
+    Map map, WeakCell weak_cell) {
+  if (!concrete_visitor()->ShouldVisit(weak_cell)) return 0;
+
+  int size = WeakCell::BodyDescriptor::SizeOf(map, weak_cell);
+  this->VisitMapPointer(weak_cell);
+  WeakCell::BodyDescriptor::IterateBody(map, weak_cell, size, this);
+  if (weak_cell.target().IsHeapObject()) {
+    HeapObject target = HeapObject::cast(weak_cell.target());
+    HeapObject unregister_token =
+        HeapObject::cast(weak_cell.unregister_token());
+    concrete_visitor()->SynchronizePageAccess(target);
+    concrete_visitor()->SynchronizePageAccess(unregister_token);
+    if (concrete_visitor()->marking_state()->IsBlackOrGrey(target) &&
+        concrete_visitor()->marking_state()->IsBlackOrGrey(unregister_token)) {
+      // Record the slots inside the WeakCell, since the IterateBody above
+      // didn't visit it.
+      ObjectSlot slot = weak_cell.RawField(WeakCell::kTargetOffset);
+      concrete_visitor()->RecordSlot(weak_cell, slot, target);
+      slot = weak_cell.RawField(WeakCell::kUnregisterTokenOffset);
+      concrete_visitor()->RecordSlot(weak_cell, slot, unregister_token);
+    } else {
+      // WeakCell points to a potentially dead object or a dead unregister
+      // token. We have to process them when we know the liveness of the whole
+      // transitive closure.
+      weak_objects_->weak_cells.Push(task_id_, weak_cell);
+    }
+  }
+  return size;
+}
+
+// ===========================================================================
+// Custom weakness in descriptor arrays and transition arrays ================
+// ===========================================================================
+
+template <typename ConcreteVisitor, typename MarkingState>
+size_t
+MarkingVisitorBase<ConcreteVisitor, MarkingState>::MarkDescriptorArrayBlack(
+    HeapObject host, DescriptorArray descriptors) {
+  concrete_visitor()->marking_state()->WhiteToGrey(descriptors);
+  if (concrete_visitor()->marking_state()->GreyToBlack(descriptors)) {
+    VisitPointer(descriptors, descriptors.map_slot());
+    VisitPointers(descriptors, descriptors.GetFirstPointerSlot(),
+                  descriptors.GetDescriptorSlot(0));
+    return DescriptorArray::BodyDescriptor::SizeOf(descriptors.map(),
+                                                   descriptors);
+  }
+  return 0;
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+void MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitDescriptors(
+    DescriptorArray descriptor_array, int number_of_own_descriptors) {
+  int16_t new_marked = static_cast<int16_t>(number_of_own_descriptors);
+  int16_t old_marked = descriptor_array.UpdateNumberOfMarkedDescriptors(
+      mark_compact_epoch_, new_marked);
+  if (old_marked < new_marked) {
+    VisitPointers(
+        descriptor_array,
+        MaybeObjectSlot(descriptor_array.GetDescriptorSlot(old_marked)),
+        MaybeObjectSlot(descriptor_array.GetDescriptorSlot(new_marked)));
+  }
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitDescriptorArray(
+    Map map, DescriptorArray array) {
+  if (!concrete_visitor()->ShouldVisit(array)) return 0;
+  this->VisitMapPointer(array);
+  int size = DescriptorArray::BodyDescriptor::SizeOf(map, array);
+  VisitPointers(array, array.GetFirstPointerSlot(), array.GetDescriptorSlot(0));
+  VisitDescriptors(array, array.number_of_descriptors());
+  return size;
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitMap(Map meta_map,
+                                                                Map map) {
+  if (!concrete_visitor()->ShouldVisit(map)) return 0;
+  int size = Map::BodyDescriptor::SizeOf(meta_map, map);
+  if (map.CanTransition()) {
+    // Maps that can transition share their descriptor arrays and require
+    // special visiting logic to avoid memory leaks.
+    // Since descriptor arrays are potentially shared, ensure that only the
+    // descriptors that belong to this map are marked. The first time a
+    // non-empty descriptor array is marked, its header is also visited. The
+    // slot holding the descriptor array will be implicitly recorded when the
+    // pointer fields of this map are visited.
+    DescriptorArray descriptors = map.synchronized_instance_descriptors();
+    size += MarkDescriptorArrayBlack(map, descriptors);
+    int number_of_own_descriptors = map.NumberOfOwnDescriptors();
+    if (number_of_own_descriptors) {
+      // It is possible that the concurrent marker observes the
+      // number_of_own_descriptors out of sync with the descriptors. In that
+      // case the marking write barrier for the descriptor array will ensure
+      // that all required descriptors are marked. The concurrent marker
+      // just should avoid crashing in that case. That's why we need the
+      // std::min<int>() below.
+      VisitDescriptors(descriptors,
+                       std::min<int>(number_of_own_descriptors,
+                                     descriptors.number_of_descriptors()));
+    }
+    // Mark the pointer fields of the Map. Since the transitions array has
+    // been marked already, it is fine that one of these fields contains a
+    // pointer to it.
+  }
+  Map::BodyDescriptor::IterateBody(meta_map, map, size, this);
+  return size;
+}
+
+template <typename ConcreteVisitor, typename MarkingState>
+int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitTransitionArray(
+    Map map, TransitionArray array) {
+  if (!concrete_visitor()->ShouldVisit(array)) return 0;
+  this->VisitMapPointer(array);
+  int size = TransitionArray::BodyDescriptor::SizeOf(map, array);
+  TransitionArray::BodyDescriptor::IterateBody(map, array, size, this);
+  weak_objects_->transition_arrays.Push(task_id_, array);
+  return size;
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_MARKING_VISITOR_INL_H_
diff --git a/deps/v8/src/heap/marking-visitor.h b/deps/v8/src/heap/marking-visitor.h
new file mode 100644
index 00000000000000..a94978a8b29a20
--- /dev/null
+++ b/deps/v8/src/heap/marking-visitor.h
@@ -0,0 +1,245 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_MARKING_VISITOR_H_
+#define V8_HEAP_MARKING_VISITOR_H_
+
+#include "src/common/globals.h"
+#include "src/heap/marking-worklist.h"
+#include "src/heap/marking.h"
+#include "src/heap/objects-visiting.h"
+#include "src/heap/spaces.h"
+#include "src/heap/worklist.h"
+#include "src/objects/heap-object.h"   // For Worklist<HeapObject, ...>
+#include "src/objects/js-weak-refs.h"  // For Worklist<WeakCell, ...>
+
+namespace v8 {
+namespace internal {
+
+struct Ephemeron {
+  HeapObject key;
+  HeapObject value;
+};
+
+using EphemeronWorklist = Worklist<Ephemeron, 64>;
+
+// Weak objects encountered during marking.
+struct WeakObjects {
+  Worklist<TransitionArray, 64> transition_arrays;
+
+  // Keep track of all EphemeronHashTables in the heap to process
+  // them in the atomic pause.
+  Worklist<EphemeronHashTable, 64> ephemeron_hash_tables;
+
+  // Keep track of all ephemerons for concurrent marking tasks. Only store
+  // ephemerons in these Worklists if both key and value are unreachable at the
+  // moment.
+  //
+  // MarkCompactCollector::ProcessEphemeronsUntilFixpoint drains and fills these
+  // worklists.
+  //
+  // current_ephemerons is used as draining worklist in the current fixpoint
+  // iteration.
+  EphemeronWorklist current_ephemerons;
+
+  // Stores ephemerons to visit in the next fixpoint iteration.
+  EphemeronWorklist next_ephemerons;
+
+  // When draining the marking worklist new discovered ephemerons are pushed
+  // into this worklist.
+  EphemeronWorklist discovered_ephemerons;
+
+  // TODO(marja): For old space, we only need the slot, not the host
+  // object. Optimize this by adding a different storage for old space.
+  Worklist<std::pair<HeapObject, HeapObjectSlot>, 64> weak_references;
+  Worklist<std::pair<HeapObject, Code>, 64> weak_objects_in_code;
+
+  Worklist<JSWeakRef, 64> js_weak_refs;
+  Worklist<WeakCell, 64> weak_cells;
+
+  Worklist<SharedFunctionInfo, 64> bytecode_flushing_candidates;
+  Worklist<JSFunction, 64> flushed_js_functions;
+};
+
+struct EphemeronMarking {
+  std::vector<HeapObject> newly_discovered;
+  bool newly_discovered_overflowed;
+  size_t newly_discovered_limit;
+};
+
+template <typename ConcreteState, AccessMode access_mode>
+class MarkingStateBase {
+ public:
+  V8_INLINE MarkBit MarkBitFrom(HeapObject obj) {
+    return MarkBitFrom(MemoryChunk::FromHeapObject(obj), obj.ptr());
+  }
+
+  // {addr} may be tagged or aligned.
+  V8_INLINE MarkBit MarkBitFrom(MemoryChunk* p, Address addr) {
+    return static_cast<ConcreteState*>(this)->bitmap(p)->MarkBitFromIndex(
+        p->AddressToMarkbitIndex(addr));
+  }
+
+  Marking::ObjectColor Color(HeapObject obj) {
+    return Marking::Color(MarkBitFrom(obj));
+  }
+
+  V8_INLINE bool IsImpossible(HeapObject obj) {
+    return Marking::IsImpossible<access_mode>(MarkBitFrom(obj));
+  }
+
+  V8_INLINE bool IsBlack(HeapObject obj) {
+    return Marking::IsBlack<access_mode>(MarkBitFrom(obj));
+  }
+
+  V8_INLINE bool IsWhite(HeapObject obj) {
+    return Marking::IsWhite<access_mode>(MarkBitFrom(obj));
+  }
+
+  V8_INLINE bool IsGrey(HeapObject obj) {
+    return Marking::IsGrey<access_mode>(MarkBitFrom(obj));
+  }
+
+  V8_INLINE bool IsBlackOrGrey(HeapObject obj) {
+    return Marking::IsBlackOrGrey<access_mode>(MarkBitFrom(obj));
+  }
+
+  V8_INLINE bool WhiteToGrey(HeapObject obj) {
+    return Marking::WhiteToGrey<access_mode>(MarkBitFrom(obj));
+  }
+
+  V8_INLINE bool WhiteToBlack(HeapObject obj) {
+    return WhiteToGrey(obj) && GreyToBlack(obj);
+  }
+
+  V8_INLINE bool GreyToBlack(HeapObject obj) {
+    MemoryChunk* p = MemoryChunk::FromHeapObject(obj);
+    MarkBit markbit = MarkBitFrom(p, obj.address());
+    if (!Marking::GreyToBlack<access_mode>(markbit)) return false;
+    static_cast<ConcreteState*>(this)->IncrementLiveBytes(p, obj.Size());
+    return true;
+  }
+
+  void ClearLiveness(MemoryChunk* chunk) {
+    static_cast<ConcreteState*>(this)->bitmap(chunk)->Clear();
+    static_cast<ConcreteState*>(this)->SetLiveBytes(chunk, 0);
+  }
+};
+
+// The base class for all marking visitors. It implements marking logic with
+// support of bytecode flushing, embedder tracing, weak and references.
+//
+// Derived classes are expected to provide the following:
+// - ConcreteVisitor::marking_state method,
+// - ConcreteVisitor::retaining_path_mode method,
+// - ConcreteVisitor::RecordSlot method,
+// - ConcreteVisitor::RecordRelocSlot method,
+// - ConcreteVisitor::SynchronizePageAccess method,
+// - ConcreteVisitor::VisitJSObjectSubclass method,
+// - ConcreteVisitor::VisitLeftTrimmableArray method.
+// These methods capture the difference between the concurrent and main thread
+// marking visitors. For example, the concurrent visitor has to use the
+// snapshotting protocol to visit JSObject and left-trimmable FixedArrays.
+
+template <typename ConcreteVisitor, typename MarkingState>
+class MarkingVisitorBase : public HeapVisitor<int, ConcreteVisitor> {
+ public:
+  MarkingVisitorBase(int task_id, MarkingWorklists* marking_worklists,
+                     WeakObjects* weak_objects, Heap* heap,
+                     unsigned mark_compact_epoch,
+                     BytecodeFlushMode bytecode_flush_mode,
+                     bool is_embedder_tracing_enabled, bool is_forced_gc)
+      : marking_worklists_(marking_worklists),
+        weak_objects_(weak_objects),
+        heap_(heap),
+        task_id_(task_id),
+        mark_compact_epoch_(mark_compact_epoch),
+        bytecode_flush_mode_(bytecode_flush_mode),
+        is_embedder_tracing_enabled_(is_embedder_tracing_enabled),
+        is_forced_gc_(is_forced_gc) {}
+
+  V8_INLINE int VisitBytecodeArray(Map map, BytecodeArray object);
+  V8_INLINE int VisitDescriptorArray(Map map, DescriptorArray object);
+  V8_INLINE int VisitEphemeronHashTable(Map map, EphemeronHashTable object);
+  V8_INLINE int VisitFixedArray(Map map, FixedArray object);
+  V8_INLINE int VisitFixedDoubleArray(Map map, FixedDoubleArray object);
+  V8_INLINE int VisitJSApiObject(Map map, JSObject object);
+  V8_INLINE int VisitJSArrayBuffer(Map map, JSArrayBuffer object);
+  V8_INLINE int VisitJSDataView(Map map, JSDataView object);
+  V8_INLINE int VisitJSFunction(Map map, JSFunction object);
+  V8_INLINE int VisitJSTypedArray(Map map, JSTypedArray object);
+  V8_INLINE int VisitJSWeakRef(Map map, JSWeakRef object);
+  V8_INLINE int VisitMap(Map map, Map object);
+  V8_INLINE int VisitSharedFunctionInfo(Map map, SharedFunctionInfo object);
+  V8_INLINE int VisitTransitionArray(Map map, TransitionArray object);
+  V8_INLINE int VisitWeakCell(Map map, WeakCell object);
+
+  // ObjectVisitor overrides.
+  V8_INLINE void VisitPointer(HeapObject host, ObjectSlot p) final {
+    VisitPointersImpl(host, p, p + 1);
+  }
+  V8_INLINE void VisitPointer(HeapObject host, MaybeObjectSlot p) final {
+    VisitPointersImpl(host, p, p + 1);
+  }
+  V8_INLINE void VisitPointers(HeapObject host, ObjectSlot start,
+                               ObjectSlot end) final {
+    VisitPointersImpl(host, start, end);
+  }
+  V8_INLINE void VisitPointers(HeapObject host, MaybeObjectSlot start,
+                               MaybeObjectSlot end) final {
+    VisitPointersImpl(host, start, end);
+  }
+  V8_INLINE void VisitEmbeddedPointer(Code host, RelocInfo* rinfo) final;
+  V8_INLINE void VisitCodeTarget(Code host, RelocInfo* rinfo) final;
+  void VisitCustomWeakPointers(HeapObject host, ObjectSlot start,
+                               ObjectSlot end) final {
+    // Weak list pointers should be ignored during marking. The lists are
+    // reconstructed after GC.
+  }
+
+ protected:
+  ConcreteVisitor* concrete_visitor() {
+    return static_cast<ConcreteVisitor*>(this);
+  }
+  template <typename THeapObjectSlot>
+  void ProcessStrongHeapObject(HeapObject host, THeapObjectSlot slot,
+                               HeapObject heap_object);
+  template <typename THeapObjectSlot>
+  void ProcessWeakHeapObject(HeapObject host, THeapObjectSlot slot,
+                             HeapObject heap_object);
+
+  template <typename TSlot>
+  V8_INLINE void VisitPointerImpl(HeapObject host, TSlot p);
+
+  template <typename TSlot>
+  V8_INLINE void VisitPointersImpl(HeapObject host, TSlot start, TSlot end);
+
+  V8_INLINE void VisitDescriptors(DescriptorArray descriptors,
+                                  int number_of_own_descriptors);
+  template <typename T>
+  int VisitEmbedderTracingSubclass(Map map, T object);
+  V8_INLINE int VisitFixedArrayWithProgressBar(Map map, FixedArray object,
+                                               MemoryChunk* chunk);
+  // Marks the descriptor array black without pushing it on the marking work
+  // list and visits its header. Returns the size of the descriptor array
+  // if it was successully marked as black.
+  V8_INLINE size_t MarkDescriptorArrayBlack(HeapObject host,
+                                            DescriptorArray descriptors);
+  // Marks the object grey and pushes it on the marking work list.
+  V8_INLINE void MarkObject(HeapObject host, HeapObject obj);
+
+  MarkingWorklists* const marking_worklists_;
+  WeakObjects* const weak_objects_;
+  Heap* const heap_;
+  const int task_id_;
+  const unsigned mark_compact_epoch_;
+  const BytecodeFlushMode bytecode_flush_mode_;
+  const bool is_embedder_tracing_enabled_;
+  const bool is_forced_gc_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_MARKING_VISITOR_H_
diff --git a/deps/v8/src/heap/marking-worklist.cc b/deps/v8/src/heap/marking-worklist.cc
new file mode 100644
index 00000000000000..577569728b08e4
--- /dev/null
+++ b/deps/v8/src/heap/marking-worklist.cc
@@ -0,0 +1,198 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/marking-worklist.h"
+
+#include <algorithm>
+#include <map>
+
+#include "src/objects/heap-object-inl.h"
+#include "src/objects/heap-object.h"
+#include "src/objects/instance-type-inl.h"
+#include "src/objects/instance-type.h"
+#include "src/objects/map.h"
+#include "src/objects/objects-definitions.h"
+
+namespace v8 {
+namespace internal {
+
+MarkingWorklistsHolder::~MarkingWorklistsHolder() {
+  DCHECK(worklists_.empty());
+  DCHECK(context_worklists_.empty());
+}
+
+void MarkingWorklistsHolder::Clear() {
+  shared_.Clear();
+  on_hold_.Clear();
+  embedder_.Clear();
+  for (auto cw : context_worklists_) {
+    cw.worklist->Clear();
+  }
+  ReleaseContextWorklists();
+}
+
+void MarkingWorklistsHolder::Print() {
+  PrintWorklist("shared", &shared_);
+  PrintWorklist("on_hold", &on_hold_);
+}
+
+void MarkingWorklistsHolder::CreateContextWorklists(
+    const std::vector<Address>& contexts) {
+  DCHECK(worklists_.empty());
+  DCHECK(context_worklists_.empty());
+  if (contexts.empty()) return;
+  worklists_.reserve(contexts.size());
+  context_worklists_.reserve(contexts.size() + 2);
+  context_worklists_.push_back({kSharedContext, &shared_});
+  context_worklists_.push_back({kOtherContext, &other_});
+  for (Address context : contexts) {
+    MarkingWorklist* worklist = new MarkingWorklist();
+    worklists_.push_back(std::unique_ptr<MarkingWorklist>(worklist));
+    context_worklists_.push_back({context, worklist});
+  }
+}
+
+void MarkingWorklistsHolder::ReleaseContextWorklists() {
+  context_worklists_.clear();
+  worklists_.clear();
+}
+
+void MarkingWorklistsHolder::PrintWorklist(const char* worklist_name,
+                                           MarkingWorklist* worklist) {
+#ifdef DEBUG
+  std::map<InstanceType, int> count;
+  int total_count = 0;
+  worklist->IterateGlobalPool([&count, &total_count](HeapObject obj) {
+    ++total_count;
+    count[obj.map().instance_type()]++;
+  });
+  std::vector<std::pair<int, InstanceType>> rank;
+  rank.reserve(count.size());
+  for (const auto& i : count) {
+    rank.emplace_back(i.second, i.first);
+  }
+  std::map<InstanceType, std::string> instance_type_name;
+#define INSTANCE_TYPE_NAME(name) instance_type_name[name] = #name;
+  INSTANCE_TYPE_LIST(INSTANCE_TYPE_NAME)
+#undef INSTANCE_TYPE_NAME
+  std::sort(rank.begin(), rank.end(),
+            std::greater<std::pair<int, InstanceType>>());
+  PrintF("Worklist %s: %d\n", worklist_name, total_count);
+  for (auto i : rank) {
+    PrintF("  [%s]: %d\n", instance_type_name[i.second].c_str(), i.first);
+  }
+#endif
+}
+
+MarkingWorklists::MarkingWorklists(int task_id, MarkingWorklistsHolder* holder)
+    : shared_(holder->shared()),
+      on_hold_(holder->on_hold()),
+      embedder_(holder->embedder()),
+      active_(shared_),
+      active_context_(kSharedContext),
+      task_id_(task_id),
+      is_per_context_mode_(false),
+      context_worklists_(holder->context_worklists()) {
+  if (!context_worklists_.empty()) {
+    is_per_context_mode_ = true;
+    worklist_by_context_.reserve(context_worklists_.size());
+    for (auto& cw : context_worklists_) {
+      worklist_by_context_[cw.context] = cw.worklist;
+    }
+  }
+}
+
+void MarkingWorklists::FlushToGlobal() {
+  shared_->FlushToGlobal(task_id_);
+  on_hold_->FlushToGlobal(task_id_);
+  embedder_->FlushToGlobal(task_id_);
+  if (is_per_context_mode_) {
+    for (auto& cw : context_worklists_) {
+      cw.worklist->FlushToGlobal(task_id_);
+    }
+  }
+}
+
+bool MarkingWorklists::IsEmpty() {
+  // This function checks the on_hold_ worklist, so it works only for the main
+  // thread.
+  DCHECK_EQ(kMainThreadTask, task_id_);
+  if (!active_->IsLocalEmpty(task_id_) || !on_hold_->IsLocalEmpty(task_id_) ||
+      !active_->IsGlobalPoolEmpty() || !on_hold_->IsGlobalPoolEmpty()) {
+    return false;
+  }
+  if (!is_per_context_mode_) {
+    DCHECK_EQ(active_, shared_);
+    return true;
+  }
+  for (auto& cw : context_worklists_) {
+    if (!cw.worklist->IsLocalEmpty(task_id_) ||
+        !cw.worklist->IsGlobalPoolEmpty()) {
+      active_ = cw.worklist;
+      active_context_ = cw.context;
+      return false;
+    }
+  }
+  return true;
+}
+
+bool MarkingWorklists::IsEmbedderEmpty() {
+  return embedder_->IsLocalEmpty(task_id_) && embedder_->IsGlobalPoolEmpty();
+}
+
+void MarkingWorklists::ShareWorkIfGlobalPoolIsEmpty() {
+  if (!shared_->IsLocalEmpty(task_id_) && shared_->IsGlobalPoolEmpty()) {
+    shared_->FlushToGlobal(task_id_);
+  }
+  if (is_per_context_mode_ && shared_ != active_) {
+    if (!active_->IsLocalEmpty(task_id_) && active_->IsGlobalPoolEmpty()) {
+      active_->FlushToGlobal(task_id_);
+    }
+  }
+}
+
+void MarkingWorklists::MergeOnHold() {
+  DCHECK_EQ(kMainThreadTask, task_id_);
+  shared_->MergeGlobalPool(on_hold_);
+}
+
+bool MarkingWorklists::PopContext(HeapObject* object) {
+  DCHECK(is_per_context_mode_);
+  // As an optimization we first check only the local segments to avoid locks.
+  for (auto& cw : context_worklists_) {
+    if (!cw.worklist->IsLocalEmpty(task_id_)) {
+      active_ = cw.worklist;
+      active_context_ = cw.context;
+      return active_->Pop(task_id_, object);
+    }
+  }
+  // All local segments are empty. Check global segments.
+  for (auto& cw : context_worklists_) {
+    if (cw.worklist->Pop(task_id_, object)) {
+      active_ = cw.worklist;
+      active_context_ = cw.context;
+      return true;
+    }
+  }
+  // All worklists are empty. Switch to the default shared worklist.
+  SwitchToShared();
+  return false;
+}
+
+Address MarkingWorklists::SwitchToContextSlow(Address context) {
+  const auto& it = worklist_by_context_.find(context);
+  if (V8_UNLIKELY(it == worklist_by_context_.end())) {
+    // This context was created during marking or is not being measured,
+    // so we don't have a specific worklist for it.
+    active_context_ = kOtherContext;
+    active_ = worklist_by_context_[active_context_];
+  } else {
+    active_ = it->second;
+    active_context_ = context;
+  }
+  return active_context_;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/marking-worklist.h b/deps/v8/src/heap/marking-worklist.h
new file mode 100644
index 00000000000000..ffa2a15fa1ff16
--- /dev/null
+++ b/deps/v8/src/heap/marking-worklist.h
@@ -0,0 +1,214 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_MARKING_WORKLIST_H_
+#define V8_HEAP_MARKING_WORKLIST_H_
+
+#include <unordered_map>
+#include <vector>
+
+#include "src/heap/marking.h"
+#include "src/heap/worklist.h"
+#include "src/objects/heap-object.h"
+
+namespace v8 {
+namespace internal {
+
+using MarkingWorklist = Worklist<HeapObject, 64>;
+using EmbedderTracingWorklist = Worklist<HeapObject, 16>;
+
+// The index of the main thread task used by concurrent/parallel GC.
+const int kMainThreadTask = 0;
+
+// We piggyback on marking to compute object sizes per native context that is
+// needed for the new memory measurement API. The algorithm works as follows:
+// 1) At the start of marking we create a marking worklist for each context.
+//    The existing shared, on_hold, and embedder worklists continue to work
+//    as they did before, but they hold objects that are not attributed to any
+//    context yet.
+// 2) Each marker has an active worklist where it pushes newly discovered
+//    objects. Initially the shared worklist is set as active for all markers.
+// 3) When a marker pops an object from the active worklist:
+//    a) It checks if the object has a known context (e.g. JSObjects, Maps,
+//       Contexts know the context they belong to). If that's the case, then
+//       the marker changes its active worklist to the worklist corresponding
+//       to the context of the object.
+//    b) It account the size of object to the active context.
+//    c) It visits all pointers in the object and pushes new objects onto the
+//       active worklist.
+// 4) When the active worklist becomes empty the marker selects any other
+//    non-empty worklist as the active worklist.
+// 5) The write barrier pushes onto the shared worklist.
+//
+// The main invariant for context worklists:
+//    If object X is in the worklist of context C, then either
+//    a) X has a context and that context is C.
+//    b) X is retained by object Y that has context C.
+//
+// The algorithm allows us to attribute context-independent objects such as
+// strings, numbers, FixedArrays to their retaining contexts. The algorithm is
+// not precise for context-independent objects that are shared between multiple
+// contexts. Such objects may be attributed to any retaining context.
+
+// Named pair of native context address and its marking worklist.
+// Since native contexts are allocated in the old generation, their addresses
+// a stable across Scavenges and stay valid throughout the marking phase.
+struct ContextWorklistPair {
+  Address context;
+  MarkingWorklist* worklist;
+};
+
+// A helper class that owns all marking worklists.
+class V8_EXPORT_PRIVATE MarkingWorklistsHolder {
+ public:
+  // Fake addresses of special contexts used for per-context accounting.
+  // - kSharedContext is for objects that are not attributed to any context.
+  // - kOtherContext is for objects that are attributed to contexts that are
+  //   not being measured.
+  static const Address kSharedContext = 0;
+  static const Address kOtherContext = 8;
+
+  ~MarkingWorklistsHolder();
+
+  // Calls the specified callback on each element of the deques and replaces
+  // the element with the result of the callback. If the callback returns
+  // nullptr then the element is removed from the deque.
+  // The callback must accept HeapObject and return HeapObject.
+  template <typename Callback>
+  void Update(Callback callback) {
+    shared_.Update(callback);
+    on_hold_.Update(callback);
+    embedder_.Update(callback);
+    for (auto cw : context_worklists_) {
+      cw.worklist->Update(callback);
+    }
+  }
+
+  MarkingWorklist* shared() { return &shared_; }
+  MarkingWorklist* on_hold() { return &on_hold_; }
+  EmbedderTracingWorklist* embedder() { return &embedder_; }
+
+  // A list of (context, worklist) pairs that was set up at the start of
+  // marking by CreateContextWorklists.
+  const std::vector<ContextWorklistPair>& context_worklists() {
+    return context_worklists_;
+  }
+  // This should be invoked at the start of marking with the list of contexts
+  // that require object size accounting.
+  void CreateContextWorklists(const std::vector<Address>& contexts);
+  // This should be invoked at the end of marking. All worklists must be
+  // empty at that point.
+  void ReleaseContextWorklists();
+
+  void Clear();
+  void Print();
+
+ private:
+  // Prints the stats about the global pool of the worklist.
+  void PrintWorklist(const char* worklist_name, MarkingWorklist* worklist);
+
+  // Worklist used for most objects.
+  MarkingWorklist shared_;
+
+  // Concurrent marking uses this worklist to bail out of marking objects
+  // in new space's linear allocation area. Used to avoid black allocation
+  // for new space. This allow the compiler to remove write barriers
+  // for freshly allocatd objects.
+  MarkingWorklist on_hold_;
+
+  // Worklist for objects that potentially require embedder tracing, i.e.,
+  // these objects need to be handed over to the embedder to find the full
+  // transitive closure.
+  EmbedderTracingWorklist embedder_;
+
+  // Per-context worklists.
+  std::vector<ContextWorklistPair> context_worklists_;
+  // This is used only for lifetime management of the per-context worklists.
+  std::vector<std::unique_ptr<MarkingWorklist>> worklists_;
+
+  // Worklist used for objects that are attributed to contexts that are
+  // not being measured.
+  MarkingWorklist other_;
+};
+
+// A thread-local view of the marking worklists.
+class V8_EXPORT_PRIVATE MarkingWorklists {
+ public:
+  static const Address kSharedContext = MarkingWorklistsHolder::kSharedContext;
+  static const Address kOtherContext = MarkingWorklistsHolder::kOtherContext;
+
+  MarkingWorklists(int task_id, MarkingWorklistsHolder* holder);
+
+  void Push(HeapObject object) {
+    bool success = active_->Push(task_id_, object);
+    USE(success);
+    DCHECK(success);
+  }
+
+  bool Pop(HeapObject* object) {
+    if (active_->Pop(task_id_, object)) return true;
+    if (!is_per_context_mode_) return false;
+    // The active worklist is empty. Find any other non-empty worklist and
+    // switch the active worklist to it.
+    return PopContext(object);
+  }
+
+  void PushOnHold(HeapObject object) {
+    bool success = on_hold_->Push(task_id_, object);
+    USE(success);
+    DCHECK(success);
+  }
+
+  bool PopOnHold(HeapObject* object) { return on_hold_->Pop(task_id_, object); }
+
+  void PushEmbedder(HeapObject object) {
+    bool success = embedder_->Push(task_id_, object);
+    USE(success);
+    DCHECK(success);
+  }
+
+  bool PopEmbedder(HeapObject* object) {
+    return embedder_->Pop(task_id_, object);
+  }
+
+  void FlushToGlobal();
+  bool IsEmpty();
+  bool IsEmbedderEmpty();
+  void MergeOnHold();
+  void ShareWorkIfGlobalPoolIsEmpty();
+
+  // Returns the context of the active worklist.
+  Address Context() { return active_context_; }
+  // Switches the active worklist to that of the given context.
+  Address SwitchToContext(Address context) {
+    if (context == active_context_) return context;
+    return SwitchToContextSlow(context);
+  }
+  // Switches the active worklist to the shared worklist.
+  void SwitchToShared() {
+    active_context_ = kSharedContext;
+    active_ = shared_;
+  }
+  bool IsPerContextMode() { return is_per_context_mode_; }
+
+ private:
+  bool PopContext(HeapObject* object);
+  Address SwitchToContextSlow(Address context);
+  MarkingWorklist* shared_;
+  MarkingWorklist* on_hold_;
+  EmbedderTracingWorklist* embedder_;
+  MarkingWorklist* active_;
+  Address active_context_;
+  int task_id_;
+  bool is_per_context_mode_;
+  // Per-context worklists. For simplicity we treat the shared worklist as
+  // the worklist of dummy kSharedContext.
+  std::vector<ContextWorklistPair> context_worklists_;
+  std::unordered_map<Address, MarkingWorklist*> worklist_by_context_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_MARKING_WORKLIST_H_
diff --git a/deps/v8/src/heap/memory-measurement-inl.h b/deps/v8/src/heap/memory-measurement-inl.h
new file mode 100644
index 00000000000000..905623e7444e1b
--- /dev/null
+++ b/deps/v8/src/heap/memory-measurement-inl.h
@@ -0,0 +1,61 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_MEMORY_MEASUREMENT_INL_H_
+#define V8_HEAP_MEMORY_MEASUREMENT_INL_H_
+
+#include "src/heap/memory-measurement.h"
+#include "src/objects/contexts-inl.h"
+#include "src/objects/contexts.h"
+#include "src/objects/instance-type-inl.h"
+#include "src/objects/instance-type.h"
+#include "src/objects/map-inl.h"
+#include "src/objects/map.h"
+
+namespace v8 {
+namespace internal {
+
+bool NativeContextInferrer::Infer(Isolate* isolate, Map map, HeapObject object,
+                                  Address* native_context) {
+  switch (map.visitor_id()) {
+    case kVisitContext:
+      *native_context = Context::cast(object).native_context().ptr();
+      return true;
+    case kVisitNativeContext:
+      *native_context = object.ptr();
+      return true;
+    case kVisitJSFunction:
+      return InferForJSFunction(JSFunction::cast(object), native_context);
+    case kVisitJSApiObject:
+    case kVisitJSArrayBuffer:
+    case kVisitJSObject:
+    case kVisitJSObjectFast:
+    case kVisitJSTypedArray:
+    case kVisitJSWeakCollection:
+      return InferForJSObject(isolate, map, JSObject::cast(object),
+                              native_context);
+    default:
+      return false;
+  }
+}
+
+V8_INLINE bool NativeContextStats::HasExternalBytes(Map map) {
+  InstanceType instance_type = map.instance_type();
+  return (instance_type == JS_ARRAY_BUFFER_TYPE ||
+          InstanceTypeChecker::IsExternalString(instance_type));
+}
+
+V8_INLINE void NativeContextStats::IncrementSize(Address context, Map map,
+                                                 HeapObject object,
+                                                 size_t size) {
+  size_by_context_[context] += size;
+  if (HasExternalBytes(map)) {
+    IncrementExternalSize(context, map, object);
+  }
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_MEMORY_MEASUREMENT_INL_H_
diff --git a/deps/v8/src/heap/memory-measurement.cc b/deps/v8/src/heap/memory-measurement.cc
index 62cd5dadb94ca0..3d2c794ca24c3e 100644
--- a/deps/v8/src/heap/memory-measurement.cc
+++ b/deps/v8/src/heap/memory-measurement.cc
@@ -4,46 +4,71 @@
 
 #include "src/heap/memory-measurement.h"
 
+#include "include/v8.h"
+#include "src/api/api-inl.h"
+#include "src/api/api.h"
 #include "src/execution/isolate-inl.h"
 #include "src/execution/isolate.h"
 #include "src/heap/factory-inl.h"
 #include "src/heap/factory.h"
+#include "src/heap/incremental-marking.h"
+#include "src/heap/marking-worklist.h"
+#include "src/objects/js-promise-inl.h"
 #include "src/objects/js-promise.h"
+#include "src/tasks/task-utils.h"
 
 namespace v8 {
 namespace internal {
 
-MemoryMeasurement::MemoryMeasurement(Isolate* isolate) : isolate_(isolate) {}
-
 namespace {
-
 class MemoryMeasurementResultBuilder {
  public:
   MemoryMeasurementResultBuilder(Isolate* isolate, Factory* factory)
       : isolate_(isolate), factory_(factory) {
     result_ = NewJSObject();
   }
+  void AddTotal(size_t estimate, size_t lower_bound, size_t upper_bound) {
+    AddProperty(result_, factory_->total_string(),
+                NewResult(estimate, lower_bound, upper_bound));
+  }
+  void AddCurrent(size_t estimate, size_t lower_bound, size_t upper_bound) {
+    detailed_ = true;
+    AddProperty(result_, factory_->current_string(),
+                NewResult(estimate, lower_bound, upper_bound));
+  }
+  void AddOther(size_t estimate, size_t lower_bound, size_t upper_bound) {
+    detailed_ = true;
+    other_.push_back(NewResult(estimate, lower_bound, upper_bound));
+  }
+  Handle<JSObject> Build() {
+    if (detailed_) {
+      int length = static_cast<int>(other_.size());
+      Handle<FixedArray> other = factory_->NewFixedArray(length);
+      for (int i = 0; i < length; i++) {
+        other->set(i, *other_[i]);
+      }
+      AddProperty(result_, factory_->other_string(),
+                  factory_->NewJSArrayWithElements(other));
+    }
+    return result_;
+  }
 
-  void AddTotals(size_t estimate, size_t lower_bound, size_t upper_bound) {
-    Handle<JSObject> total = NewJSObject();
+ private:
+  Handle<JSObject> NewResult(size_t estimate, size_t lower_bound,
+                             size_t upper_bound) {
+    Handle<JSObject> result = NewJSObject();
     Handle<Object> estimate_obj = NewNumber(estimate);
-    AddProperty(total, factory_->jsMemoryEstimate_string(), estimate_obj);
+    AddProperty(result, factory_->jsMemoryEstimate_string(), estimate_obj);
     Handle<Object> range = NewRange(lower_bound, upper_bound);
-    AddProperty(total, factory_->jsMemoryRange_string(), range);
-    AddProperty(result_, factory_->total_string(), total);
+    AddProperty(result, factory_->jsMemoryRange_string(), range);
+    return result;
   }
-
-  Handle<JSObject> Build() { return result_; }
-
- private:
   Handle<Object> NewNumber(size_t value) {
     return factory_->NewNumberFromSize(value);
   }
-
   Handle<JSObject> NewJSObject() {
     return factory_->NewJSObject(isolate_->object_function());
   }
-
   Handle<JSArray> NewRange(size_t lower_bound, size_t upper_bound) {
     Handle<Object> lower = NewNumber(lower_bound);
     Handle<Object> upper = NewNumber(upper_bound);
@@ -52,28 +77,291 @@ class MemoryMeasurementResultBuilder {
     elements->set(1, *upper);
     return factory_->NewJSArrayWithElements(elements);
   }
-
   void AddProperty(Handle<JSObject> object, Handle<String> name,
                    Handle<Object> value) {
     JSObject::AddProperty(isolate_, object, name, value, NONE);
   }
-
   Isolate* isolate_;
   Factory* factory_;
   Handle<JSObject> result_;
+  std::vector<Handle<JSObject>> other_;
+  bool detailed_ = false;
 };
-
 }  // anonymous namespace
 
-Handle<JSPromise> MemoryMeasurement::EnqueueRequest(
-    Handle<NativeContext> context, v8::MeasureMemoryMode mode) {
-  Handle<JSPromise> promise = isolate_->factory()->NewJSPromise();
+class V8_EXPORT_PRIVATE MeasureMemoryDelegate
+    : public v8::MeasureMemoryDelegate {
+ public:
+  MeasureMemoryDelegate(Isolate* isolate, Handle<NativeContext> context,
+                        Handle<JSPromise> promise, v8::MeasureMemoryMode mode);
+  ~MeasureMemoryDelegate();
+
+  // v8::MeasureMemoryDelegate overrides:
+  bool ShouldMeasure(v8::Local<v8::Context> context) override;
+  void MeasurementComplete(
+      const std::vector<std::pair<v8::Local<v8::Context>, size_t>>&
+          context_sizes_in_bytes,
+      size_t unattributed_size_in_bytes) override;
+
+ private:
+  Isolate* isolate_;
+  Handle<JSPromise> promise_;
+  Handle<NativeContext> context_;
+  v8::MeasureMemoryMode mode_;
+};
+
+MeasureMemoryDelegate::MeasureMemoryDelegate(Isolate* isolate,
+                                             Handle<NativeContext> context,
+                                             Handle<JSPromise> promise,
+                                             v8::MeasureMemoryMode mode)
+    : isolate_(isolate), mode_(mode) {
+  context_ = isolate->global_handles()->Create(*context);
+  promise_ = isolate->global_handles()->Create(*promise);
+}
+
+MeasureMemoryDelegate::~MeasureMemoryDelegate() {
+  isolate_->global_handles()->Destroy(promise_.location());
+  isolate_->global_handles()->Destroy(context_.location());
+}
+
+bool MeasureMemoryDelegate::ShouldMeasure(v8::Local<v8::Context> context) {
+  Handle<NativeContext> native_context =
+      Handle<NativeContext>::cast(Utils::OpenHandle(*context));
+  return context_->security_token() == native_context->security_token();
+}
+
+void MeasureMemoryDelegate::MeasurementComplete(
+    const std::vector<std::pair<v8::Local<v8::Context>, size_t>>&
+        context_sizes_in_bytes,
+    size_t shared_size) {
+  v8::Local<v8::Context> v8_context =
+      Utils::Convert<HeapObject, v8::Context>(context_);
+  v8::Context::Scope scope(v8_context);
+  size_t total_size = 0;
+  size_t current_size = 0;
+  for (const auto& context_and_size : context_sizes_in_bytes) {
+    total_size += context_and_size.second;
+    if (*Utils::OpenHandle(*context_and_size.first) == *context_) {
+      current_size = context_and_size.second;
+    }
+  }
   MemoryMeasurementResultBuilder result_builder(isolate_, isolate_->factory());
-  result_builder.AddTotals(isolate_->heap()->SizeOfObjects(), 0,
-                           isolate_->heap()->SizeOfObjects());
+  result_builder.AddTotal(total_size, total_size, total_size + shared_size);
+
+  if (mode_ == v8::MeasureMemoryMode::kDetailed) {
+    result_builder.AddCurrent(current_size, current_size,
+                              current_size + shared_size);
+    for (const auto& context_and_size : context_sizes_in_bytes) {
+      if (*Utils::OpenHandle(*context_and_size.first) != *context_) {
+        size_t other_size = context_and_size.second;
+        result_builder.AddOther(other_size, other_size,
+                                other_size + shared_size);
+      }
+    }
+  }
+
   Handle<JSObject> result = result_builder.Build();
-  JSPromise::Resolve(promise, result).ToHandleChecked();
-  return promise;
+  JSPromise::Resolve(promise_, result).ToHandleChecked();
+}
+
+MemoryMeasurement::MemoryMeasurement(Isolate* isolate) : isolate_(isolate) {}
+
+bool MemoryMeasurement::EnqueueRequest(
+    std::unique_ptr<v8::MeasureMemoryDelegate> delegate,
+    v8::MeasureMemoryExecution execution,
+    const std::vector<Handle<NativeContext>> contexts) {
+  int length = static_cast<int>(contexts.size());
+  Handle<WeakFixedArray> weak_contexts =
+      isolate_->factory()->NewWeakFixedArray(length);
+  for (int i = 0; i < length; ++i) {
+    weak_contexts->Set(i, HeapObjectReference::Weak(*contexts[i]));
+  }
+  Handle<WeakFixedArray> global_weak_contexts =
+      isolate_->global_handles()->Create(*weak_contexts);
+  Request request = {std::move(delegate), global_weak_contexts,
+                     std::vector<size_t>(length), 0u};
+  received_.push_back(std::move(request));
+  ScheduleGCTask(execution);
+  return true;
+}
+
+std::vector<Address> MemoryMeasurement::StartProcessing() {
+  if (received_.empty()) return {};
+  std::unordered_set<Address> unique_contexts;
+  DCHECK(processing_.empty());
+  processing_ = std::move(received_);
+  for (const auto& request : processing_) {
+    Handle<WeakFixedArray> contexts = request.contexts;
+    for (int i = 0; i < contexts->length(); i++) {
+      HeapObject context;
+      if (contexts->Get(i).GetHeapObject(&context)) {
+        unique_contexts.insert(context.ptr());
+      }
+    }
+  }
+  return std::vector<Address>(unique_contexts.begin(), unique_contexts.end());
+}
+
+void MemoryMeasurement::FinishProcessing(const NativeContextStats& stats) {
+  if (processing_.empty()) return;
+
+  while (!processing_.empty()) {
+    Request request = std::move(processing_.front());
+    processing_.pop_front();
+    for (int i = 0; i < static_cast<int>(request.sizes.size()); i++) {
+      HeapObject context;
+      if (!request.contexts->Get(i).GetHeapObject(&context)) {
+        continue;
+      }
+      request.sizes[i] = stats.Get(context.ptr());
+    }
+    request.shared = stats.Get(MarkingWorklists::kSharedContext);
+    done_.push_back(std::move(request));
+  }
+  ScheduleReportingTask();
+}
+
+void MemoryMeasurement::ScheduleReportingTask() {
+  if (reporting_task_pending_) return;
+  reporting_task_pending_ = true;
+  auto taskrunner = V8::GetCurrentPlatform()->GetForegroundTaskRunner(
+      reinterpret_cast<v8::Isolate*>(isolate_));
+  taskrunner->PostTask(MakeCancelableTask(isolate_, [this] {
+    reporting_task_pending_ = false;
+    ReportResults();
+  }));
+}
+
+bool MemoryMeasurement::IsGCTaskPending(v8::MeasureMemoryExecution execution) {
+  return execution == v8::MeasureMemoryExecution::kEager
+             ? eager_gc_task_pending_
+             : delayed_gc_task_pending_;
+}
+
+void MemoryMeasurement::SetGCTaskPending(v8::MeasureMemoryExecution execution) {
+  if (execution == v8::MeasureMemoryExecution::kEager) {
+    eager_gc_task_pending_ = true;
+  } else {
+    delayed_gc_task_pending_ = true;
+  }
+}
+
+void MemoryMeasurement::SetGCTaskDone(v8::MeasureMemoryExecution execution) {
+  if (execution == v8::MeasureMemoryExecution::kEager) {
+    eager_gc_task_pending_ = false;
+  } else {
+    delayed_gc_task_pending_ = false;
+  }
+}
+
+void MemoryMeasurement::ScheduleGCTask(v8::MeasureMemoryExecution execution) {
+  if (IsGCTaskPending(execution)) return;
+  SetGCTaskPending(execution);
+  auto taskrunner = V8::GetCurrentPlatform()->GetForegroundTaskRunner(
+      reinterpret_cast<v8::Isolate*>(isolate_));
+  auto task = MakeCancelableTask(isolate_, [this, execution] {
+    SetGCTaskDone(execution);
+    if (received_.empty()) return;
+    Heap* heap = isolate_->heap();
+    if (FLAG_incremental_marking) {
+      if (heap->incremental_marking()->IsStopped()) {
+        heap->StartIncrementalMarking(Heap::kNoGCFlags,
+                                      GarbageCollectionReason::kMeasureMemory);
+      } else {
+        if (execution == v8::MeasureMemoryExecution::kEager) {
+          heap->FinalizeIncrementalMarkingAtomically(
+              GarbageCollectionReason::kMeasureMemory);
+        }
+        ScheduleGCTask(execution);
+      }
+    } else {
+      heap->CollectGarbage(OLD_SPACE, GarbageCollectionReason::kMeasureMemory);
+    }
+  });
+  if (execution == v8::MeasureMemoryExecution::kEager) {
+    taskrunner->PostTask(std::move(task));
+  } else {
+    taskrunner->PostDelayedTask(std::move(task), kGCTaskDelayInSeconds);
+  }
+}
+
+void MemoryMeasurement::ReportResults() {
+  while (!done_.empty()) {
+    Request request = std::move(done_.front());
+    done_.pop_front();
+    HandleScope handle_scope(isolate_);
+    std::vector<std::pair<v8::Local<v8::Context>, size_t>> sizes;
+    DCHECK_EQ(request.sizes.size(),
+              static_cast<size_t>(request.contexts->length()));
+    for (int i = 0; i < request.contexts->length(); i++) {
+      HeapObject raw_context;
+      if (!request.contexts->Get(i).GetHeapObject(&raw_context)) {
+        continue;
+      }
+      v8::Local<v8::Context> context = Utils::Convert<HeapObject, v8::Context>(
+          handle(raw_context, isolate_));
+      sizes.push_back(std::make_pair(context, request.sizes[i]));
+    }
+    request.delegate->MeasurementComplete(sizes, request.shared);
+  }
+}
+
+std::unique_ptr<v8::MeasureMemoryDelegate> MemoryMeasurement::DefaultDelegate(
+    Isolate* isolate, Handle<NativeContext> context, Handle<JSPromise> promise,
+    v8::MeasureMemoryMode mode) {
+  return std::make_unique<MeasureMemoryDelegate>(isolate, context, promise,
+                                                 mode);
+}
+
+bool NativeContextInferrer::InferForJSFunction(JSFunction function,
+                                               Address* native_context) {
+  if (function.has_context()) {
+    *native_context = function.context().native_context().ptr();
+    return true;
+  }
+  return false;
+}
+
+bool NativeContextInferrer::InferForJSObject(Isolate* isolate, Map map,
+                                             JSObject object,
+                                             Address* native_context) {
+  if (map.instance_type() == JS_GLOBAL_OBJECT_TYPE) {
+    Object maybe_context =
+        JSGlobalObject::cast(object).native_context_unchecked(isolate);
+    if (maybe_context.IsNativeContext()) {
+      *native_context = maybe_context.ptr();
+      return true;
+    }
+  }
+  // The maximum number of steps to perform when looking for the context.
+  const int kMaxSteps = 3;
+  Object maybe_constructor = map.TryGetConstructor(isolate, kMaxSteps);
+  if (maybe_constructor.IsJSFunction()) {
+    return InferForJSFunction(JSFunction::cast(maybe_constructor),
+                              native_context);
+  }
+  return false;
+}
+
+void NativeContextStats::Clear() { size_by_context_.clear(); }
+
+void NativeContextStats::Merge(const NativeContextStats& other) {
+  for (const auto& it : other.size_by_context_) {
+    size_by_context_[it.first] += it.second;
+  }
+}
+
+void NativeContextStats::IncrementExternalSize(Address context, Map map,
+                                               HeapObject object) {
+  InstanceType instance_type = map.instance_type();
+  size_t external_size = 0;
+  if (instance_type == JS_ARRAY_BUFFER_TYPE) {
+    external_size = JSArrayBuffer::cast(object).allocation_length();
+  } else {
+    DCHECK(InstanceTypeChecker::IsExternalString(instance_type));
+    external_size = ExternalString::cast(object).ExternalPayloadSize();
+  }
+  size_by_context_[context] += external_size;
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/memory-measurement.h b/deps/v8/src/heap/memory-measurement.h
index 6de7c8c970c99a..e1783aa0f988db 100644
--- a/deps/v8/src/heap/memory-measurement.h
+++ b/deps/v8/src/heap/memory-measurement.h
@@ -5,22 +5,92 @@
 #ifndef V8_HEAP_MEMORY_MEASUREMENT_H_
 #define V8_HEAP_MEMORY_MEASUREMENT_H_
 
+#include <list>
+#include <unordered_map>
+
 #include "src/common/globals.h"
+#include "src/objects/contexts.h"
+#include "src/objects/map.h"
 #include "src/objects/objects.h"
 
 namespace v8 {
 namespace internal {
 
 class Heap;
+class NativeContextStats;
 
 class V8_EXPORT_PRIVATE MemoryMeasurement {
  public:
   explicit MemoryMeasurement(Isolate* isolate);
-  Handle<JSPromise> EnqueueRequest(Handle<NativeContext> context,
-                                   v8::MeasureMemoryMode mode);
+
+  bool EnqueueRequest(std::unique_ptr<v8::MeasureMemoryDelegate> delegate,
+                      v8::MeasureMemoryExecution execution,
+                      const std::vector<Handle<NativeContext>> contexts);
+  std::vector<Address> StartProcessing();
+  void FinishProcessing(const NativeContextStats& stats);
+
+  static std::unique_ptr<v8::MeasureMemoryDelegate> DefaultDelegate(
+      Isolate* isolate, Handle<NativeContext> context,
+      Handle<JSPromise> promise, v8::MeasureMemoryMode mode);
 
  private:
+  static const int kGCTaskDelayInSeconds = 60;
+  struct Request {
+    std::unique_ptr<v8::MeasureMemoryDelegate> delegate;
+    Handle<WeakFixedArray> contexts;
+    std::vector<size_t> sizes;
+    size_t shared;
+  };
+  void ScheduleReportingTask();
+  void ReportResults();
+  void ScheduleGCTask(v8::MeasureMemoryExecution execution);
+  bool IsGCTaskPending(v8::MeasureMemoryExecution execution);
+  void SetGCTaskPending(v8::MeasureMemoryExecution execution);
+  void SetGCTaskDone(v8::MeasureMemoryExecution execution);
+
+  std::list<Request> received_;
+  std::list<Request> processing_;
+  std::list<Request> done_;
   Isolate* isolate_;
+  bool reporting_task_pending_ = false;
+  bool delayed_gc_task_pending_ = false;
+  bool eager_gc_task_pending_ = false;
+};
+
+// Infers the native context for some of the heap objects.
+class V8_EXPORT_PRIVATE NativeContextInferrer {
+ public:
+  // The native_context parameter is both the input and output parameter.
+  // It should be initialized to the context that will be used for the object
+  // if the inference is not successful. The function performs more work if the
+  // context is the shared context.
+  V8_INLINE bool Infer(Isolate* isolate, Map map, HeapObject object,
+                       Address* native_context);
+
+ private:
+  bool InferForJSFunction(JSFunction function, Address* native_context);
+  bool InferForJSObject(Isolate* isolate, Map map, JSObject object,
+                        Address* native_context);
+};
+
+// Maintains mapping from native contexts to their sizes.
+class V8_EXPORT_PRIVATE NativeContextStats {
+ public:
+  V8_INLINE void IncrementSize(Address context, Map map, HeapObject object,
+                               size_t size);
+
+  size_t Get(Address context) const {
+    const auto it = size_by_context_.find(context);
+    if (it == size_by_context_.end()) return 0;
+    return it->second;
+  }
+  void Clear();
+  void Merge(const NativeContextStats& other);
+
+ private:
+  V8_INLINE bool HasExternalBytes(Map map);
+  void IncrementExternalSize(Address context, Map map, HeapObject object);
+  std::unordered_map<Address, size_t> size_by_context_;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/object-stats.cc b/deps/v8/src/heap/object-stats.cc
index 44798a392826ff..04a7cee33b5e1e 100644
--- a/deps/v8/src/heap/object-stats.cc
+++ b/deps/v8/src/heap/object-stats.cc
@@ -1047,13 +1047,7 @@ void ObjectStatsCollectorImpl::RecordVirtualCodeDetails(Code code) {
   RecordSimpleVirtualObjectStats(code, code.relocation_info(),
                                  ObjectStats::RELOC_INFO_TYPE);
   Object source_position_table = code.source_position_table();
-  if (source_position_table.IsSourcePositionTableWithFrameCache()) {
-    RecordSimpleVirtualObjectStats(
-        code,
-        SourcePositionTableWithFrameCache::cast(source_position_table)
-            .source_position_table(),
-        ObjectStats::SOURCE_POSITION_TABLE_TYPE);
-  } else if (source_position_table.IsHeapObject()) {
+  if (source_position_table.IsHeapObject()) {
     RecordSimpleVirtualObjectStats(code,
                                    HeapObject::cast(source_position_table),
                                    ObjectStats::SOURCE_POSITION_TABLE_TYPE);
diff --git a/deps/v8/src/heap/objects-visiting.h b/deps/v8/src/heap/objects-visiting.h
index 0f972737d25e4b..d197bb4fd215bb 100644
--- a/deps/v8/src/heap/objects-visiting.h
+++ b/deps/v8/src/heap/objects-visiting.h
@@ -28,6 +28,7 @@ namespace internal {
   V(EmbedderDataArray)                 \
   V(EphemeronHashTable)                \
   V(FeedbackCell)                      \
+  V(FeedbackMetadata)                  \
   V(FeedbackVector)                    \
   V(FixedArray)                        \
   V(FixedDoubleArray)                  \
diff --git a/deps/v8/src/heap/off-thread-factory-inl.h b/deps/v8/src/heap/off-thread-factory-inl.h
new file mode 100644
index 00000000000000..8352565ad5d36c
--- /dev/null
+++ b/deps/v8/src/heap/off-thread-factory-inl.h
@@ -0,0 +1,25 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_OFF_THREAD_FACTORY_INL_H_
+#define V8_HEAP_OFF_THREAD_FACTORY_INL_H_
+
+#include "src/heap/off-thread-factory.h"
+
+#include "src/roots/roots-inl.h"
+
+namespace v8 {
+namespace internal {
+
+#define ROOT_ACCESSOR(Type, name, CamelName)                \
+  OffThreadHandle<Type> OffThreadFactory::name() {          \
+    return OffThreadHandle<Type>(read_only_roots().name()); \
+  }
+READ_ONLY_ROOT_LIST(ROOT_ACCESSOR)
+#undef ROOT_ACCESSOR
+
+#endif  // V8_HEAP_OFF_THREAD_FACTORY_INL_H_
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/off-thread-factory.cc b/deps/v8/src/heap/off-thread-factory.cc
new file mode 100644
index 00000000000000..66aca9261c4ce8
--- /dev/null
+++ b/deps/v8/src/heap/off-thread-factory.cc
@@ -0,0 +1,221 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/off-thread-factory.h"
+
+#include "src/ast/ast-value-factory.h"
+#include "src/ast/ast.h"
+#include "src/base/logging.h"
+#include "src/common/globals.h"
+#include "src/execution/isolate.h"
+#include "src/handles/handles.h"
+#include "src/heap/spaces-inl.h"
+#include "src/heap/spaces.h"
+#include "src/objects/fixed-array.h"
+#include "src/objects/heap-object.h"
+#include "src/objects/map-inl.h"
+#include "src/objects/objects-body-descriptors-inl.h"
+#include "src/objects/string.h"
+#include "src/objects/visitors.h"
+#include "src/roots/roots-inl.h"
+#include "src/roots/roots.h"
+
+namespace v8 {
+namespace internal {
+
+OffThreadFactory::OffThreadFactory(Isolate* isolate)
+    : roots_(isolate), space_(isolate->heap()), lo_space_(isolate->heap()) {}
+
+namespace {
+
+class StringSlotCollectingVisitor : public ObjectVisitor {
+ public:
+  explicit StringSlotCollectingVisitor(ReadOnlyRoots roots) : roots_(roots) {}
+
+  void VisitPointers(HeapObject host, ObjectSlot start,
+                     ObjectSlot end) override {
+    for (ObjectSlot slot = start; slot != end; ++slot) {
+      Object obj = *slot;
+      if (obj.IsInternalizedString() &&
+          !ReadOnlyHeap::Contains(HeapObject::cast(obj))) {
+        string_slots.emplace_back(host.ptr(), slot.address() - host.ptr());
+      }
+    }
+  }
+  void VisitPointers(HeapObject host, MaybeObjectSlot start,
+                     MaybeObjectSlot end) override {
+    for (MaybeObjectSlot slot = start; slot != end; ++slot) {
+      MaybeObject maybe_obj = *slot;
+      HeapObject obj;
+      if (maybe_obj.GetHeapObjectIfStrong(&obj)) {
+        if (obj.IsInternalizedString() && !ReadOnlyHeap::Contains(obj)) {
+          string_slots.emplace_back(host.ptr(), slot.address() - host.ptr());
+        }
+      }
+    }
+  }
+
+  void VisitCodeTarget(Code host, RelocInfo* rinfo) override { UNREACHABLE(); }
+  void VisitEmbeddedPointer(Code host, RelocInfo* rinfo) override {
+    UNREACHABLE();
+  }
+
+  std::vector<RelativeSlot> string_slots;
+
+ private:
+  ReadOnlyRoots roots_;
+};
+
+}  // namespace
+
+void OffThreadFactory::FinishOffThread() {
+  DCHECK(!is_finished);
+
+  StringSlotCollectingVisitor string_slot_collector(read_only_roots());
+
+  // First iterate all objects in the spaces to find string slots. At this point
+  // all string slots have to point to off-thread strings or read-only strings.
+  {
+    PagedSpaceObjectIterator it(&space_);
+    for (HeapObject obj = it.Next(); !obj.is_null(); obj = it.Next()) {
+      obj.IterateBodyFast(&string_slot_collector);
+    }
+  }
+  {
+    LargeObjectSpaceObjectIterator it(&lo_space_);
+    for (HeapObject obj = it.Next(); !obj.is_null(); obj = it.Next()) {
+      obj.IterateBodyFast(&string_slot_collector);
+    }
+  }
+
+  string_slots_ = std::move(string_slot_collector.string_slots);
+
+  is_finished = true;
+}
+
+void OffThreadFactory::Publish(Isolate* isolate) {
+  DCHECK(is_finished);
+
+  HandleScope handle_scope(isolate);
+
+  // First, handlify all the string slot holder objects, so that we can keep
+  // track of them if they move.
+  //
+  // TODO(leszeks): We might be able to create a HandleScope-compatible
+  // structure off-thread and merge it into the current handle scope all in one
+  // go (DeferredHandles maybe?).
+  std::vector<Handle<HeapObject>> heap_object_handles;
+  heap_object_handles.reserve(string_slots_.size());
+  for (RelativeSlot relative_slot : string_slots_) {
+    // TODO(leszeks): Group slots in the same parent object to avoid creating
+    // multiple duplicate handles.
+    heap_object_handles.push_back(handle(
+        HeapObject::cast(Object(relative_slot.object_address)), isolate));
+
+    // De-internalize the string so that we can re-internalize it later.
+    ObjectSlot slot(relative_slot.object_address + relative_slot.slot_offset);
+    String string = String::cast(slot.Acquire_Load());
+    bool one_byte = string.IsOneByteRepresentation();
+    Map map = one_byte ? read_only_roots().one_byte_string_map()
+                       : read_only_roots().string_map();
+    string.set_map_no_write_barrier(map);
+  }
+
+  // Then merge the spaces. At this point, we are allowed to point between (no
+  // longer) off-thread pages and main-thread heap pages, and objects in the
+  // previously off-thread page can move.
+  isolate->heap()->old_space()->MergeLocalSpace(&space_);
+  isolate->heap()->lo_space()->MergeOffThreadSpace(&lo_space_);
+
+  // Iterate the string slots, as an offset from the holders we have handles to.
+  for (size_t i = 0; i < string_slots_.size(); ++i) {
+    int slot_offset = string_slots_[i].slot_offset;
+
+    // There's currently no cases where the holder object could have been
+    // resized.
+    DCHECK_LT(slot_offset, heap_object_handles[i]->Size());
+
+    ObjectSlot slot(heap_object_handles[i]->ptr() + slot_offset);
+
+    String string = String::cast(slot.Acquire_Load());
+    if (string.IsThinString()) {
+      // We may have already internalized this string via another slot.
+      slot.Release_Store(ThinString::cast(string).GetUnderlying());
+    } else {
+      HandleScope handle_scope(isolate);
+
+      Handle<String> string_handle = handle(string, isolate);
+      Handle<String> internalized_string =
+          isolate->factory()->InternalizeString(string_handle);
+
+      // Recalculate the slot in case there was GC and the holder moved.
+      ObjectSlot slot(heap_object_handles[i]->ptr() +
+                      string_slots_[i].slot_offset);
+
+      DCHECK(string_handle->IsThinString() ||
+             string_handle->IsInternalizedString());
+      if (*string_handle != *internalized_string) {
+        slot.Release_Store(*internalized_string);
+      }
+    }
+  }
+}
+
+OffThreadHandle<Object> OffThreadFactory::NewInvalidStringLengthError() {
+  // TODO(leszeks): Implement.
+  UNREACHABLE();
+}
+
+// Hacky method for creating a simple object with a slot pointing to a string.
+// TODO(leszeks): Remove once we have full FixedArray support.
+OffThreadHandle<FixedArray> OffThreadFactory::StringWrapperForTest(
+    OffThreadHandle<String> string) {
+  HeapObject wrapper =
+      AllocateRaw(FixedArray::SizeFor(1), AllocationType::kOld);
+  wrapper.set_map_after_allocation(read_only_roots().fixed_array_map());
+  FixedArray array = FixedArray::cast(wrapper);
+  array.set_length(1);
+  array.data_start().Relaxed_Store(*string);
+  return OffThreadHandle<FixedArray>(array);
+}
+
+OffThreadHandle<String> OffThreadFactory::MakeOrFindTwoCharacterString(
+    uint16_t c1, uint16_t c2) {
+  // TODO(leszeks): Do some real caching here. Also, these strings should be
+  // internalized.
+  if ((c1 | c2) <= unibrow::Latin1::kMaxChar) {
+    OffThreadHandle<SeqOneByteString> ret =
+        NewRawOneByteString(2, AllocationType::kOld);
+    ret->SeqOneByteStringSet(0, c1);
+    ret->SeqOneByteStringSet(1, c2);
+    return ret;
+  }
+  OffThreadHandle<SeqTwoByteString> ret =
+      NewRawTwoByteString(2, AllocationType::kOld);
+  ret->SeqTwoByteStringSet(0, c1);
+  ret->SeqTwoByteStringSet(1, c2);
+  return ret;
+}
+
+HeapObject OffThreadFactory::AllocateRaw(int size, AllocationType allocation,
+                                         AllocationAlignment alignment) {
+  DCHECK(!is_finished);
+
+  DCHECK_EQ(allocation, AllocationType::kOld);
+  AllocationResult result;
+  if (size > kMaxRegularHeapObjectSize) {
+    result = lo_space_.AllocateRaw(size);
+  } else {
+    result = space_.AllocateRaw(size, alignment);
+  }
+  return result.ToObjectChecked();
+}
+
+void OffThreadFactory::FatalProcessOutOfHeapMemory(const char* location) {
+  // TODO(leszeks): Do something reasonable.
+  UNREACHABLE();
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/off-thread-factory.h b/deps/v8/src/heap/off-thread-factory.h
new file mode 100644
index 00000000000000..244e04189d8c29
--- /dev/null
+++ b/deps/v8/src/heap/off-thread-factory.h
@@ -0,0 +1,96 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_OFF_THREAD_FACTORY_H_
+#define V8_HEAP_OFF_THREAD_FACTORY_H_
+
+#include <map>
+#include <vector>
+#include "src/common/globals.h"
+#include "src/handles/handles.h"
+#include "src/heap/factory-base.h"
+#include "src/heap/heap.h"
+#include "src/heap/read-only-heap.h"
+#include "src/heap/spaces.h"
+#include "src/objects/heap-object.h"
+#include "src/objects/objects.h"
+#include "src/roots/roots.h"
+
+namespace v8 {
+namespace internal {
+
+class AstValueFactory;
+class AstRawString;
+class AstConsString;
+
+class OffThreadFactory;
+
+template <>
+struct FactoryTraits<OffThreadFactory> {
+  template <typename T>
+  using HandleType = OffThreadHandle<T>;
+  template <typename T>
+  using MaybeHandleType = OffThreadHandle<T>;
+};
+
+struct RelativeSlot {
+  RelativeSlot() = default;
+  RelativeSlot(Address object_address, int slot_offset)
+      : object_address(object_address), slot_offset(slot_offset) {}
+
+  Address object_address;
+  int slot_offset;
+};
+
+class V8_EXPORT_PRIVATE OffThreadFactory
+    : public FactoryBase<OffThreadFactory> {
+ public:
+  explicit OffThreadFactory(Isolate* isolate);
+
+  ReadOnlyRoots read_only_roots() const { return roots_; }
+
+#define ROOT_ACCESSOR(Type, name, CamelName) \
+  inline OffThreadHandle<Type> name();
+  READ_ONLY_ROOT_LIST(ROOT_ACCESSOR)
+#undef ROOT_ACCESSOR
+
+  void FinishOffThread();
+  void Publish(Isolate* isolate);
+
+  OffThreadHandle<Object> NewInvalidStringLengthError();
+
+  OffThreadHandle<FixedArray> StringWrapperForTest(
+      OffThreadHandle<String> string);
+
+ private:
+  friend class FactoryBase<OffThreadFactory>;
+
+  // ------
+  // Customization points for FactoryBase.
+  HeapObject AllocateRaw(int size, AllocationType allocation,
+                         AllocationAlignment alignment = kWordAligned);
+  template <typename T>
+  OffThreadHandle<T> Throw(OffThreadHandle<Object> exception) {
+    // TODO(leszeks): Figure out what to do here.
+    return OffThreadHandle<T>();
+  }
+  [[noreturn]] void FatalProcessOutOfHeapMemory(const char* location);
+  inline bool CanAllocateInReadOnlySpace() { return false; }
+  inline bool EmptyStringRootIsInitialized() { return true; }
+  // ------
+
+  OffThreadHandle<String> MakeOrFindTwoCharacterString(uint16_t c1,
+                                                       uint16_t c2);
+
+  ReadOnlyRoots roots_;
+  OffThreadSpace space_;
+  OffThreadLargeObjectSpace lo_space_;
+  std::vector<RelativeSlot> string_slots_;
+  bool is_finished = false;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_OFF_THREAD_FACTORY_H_
diff --git a/deps/v8/src/heap/read-only-heap.cc b/deps/v8/src/heap/read-only-heap.cc
index c325aea7e6b1db..2050d3729bb892 100644
--- a/deps/v8/src/heap/read-only-heap.cc
+++ b/deps/v8/src/heap/read-only-heap.cc
@@ -29,7 +29,7 @@ void ReadOnlyHeap::SetUp(Isolate* isolate, ReadOnlyDeserializer* des) {
   DCHECK_NOT_NULL(isolate);
 #ifdef V8_SHARED_RO_HEAP
   bool call_once_ran = false;
-  base::Optional<Checksum> des_checksum;
+  base::Optional<uint32_t> des_checksum;
 #ifdef DEBUG
   if (des != nullptr) des_checksum = des->GetChecksum();
 #endif  // DEBUG
@@ -50,7 +50,7 @@ void ReadOnlyHeap::SetUp(Isolate* isolate, ReadOnlyDeserializer* des) {
   USE(call_once_ran);
   USE(des_checksum);
 #ifdef DEBUG
-  const base::Optional<Checksum> last_checksum =
+  const base::Optional<uint32_t> last_checksum =
       shared_ro_heap_->read_only_blob_checksum_;
   if (last_checksum || des_checksum) {
     // The read-only heap was set up from a snapshot. Make sure it's the always
@@ -97,6 +97,7 @@ ReadOnlyHeap* ReadOnlyHeap::CreateAndAttachToIsolate(Isolate* isolate) {
 
 void ReadOnlyHeap::InitFromIsolate(Isolate* isolate) {
   DCHECK(!init_complete_);
+  read_only_space_->ShrinkImmortalImmovablePages();
 #ifdef V8_SHARED_RO_HEAP
   void* const isolate_ro_roots = reinterpret_cast<void*>(
       isolate->roots_table().read_only_roots_begin().address());
@@ -119,6 +120,11 @@ void ReadOnlyHeap::OnHeapTearDown() {
 #endif
 }
 
+#ifdef V8_SHARED_RO_HEAP
+// static
+const ReadOnlyHeap* ReadOnlyHeap::Instance() { return shared_ro_heap_; }
+#endif
+
 // static
 void ReadOnlyHeap::ClearSharedHeapForTest() {
 #ifdef V8_SHARED_RO_HEAP
@@ -130,13 +136,24 @@ void ReadOnlyHeap::ClearSharedHeapForTest() {
 #endif
 }
 
+// static
+bool ReadOnlyHeap::Contains(Address address) {
+  return MemoryChunk::FromAddress(address)->InReadOnlySpace();
+}
+
 // static
 bool ReadOnlyHeap::Contains(HeapObject object) {
-  return MemoryChunk::FromHeapObject(object)->InReadOnlySpace();
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    // read only includes both TPH and the snapshot, so need both checks
+    return third_party_heap::Heap::InReadOnlySpace(object.address()) ||
+           MemoryChunk::FromHeapObject(object)->InReadOnlySpace();
+  } else {
+    return MemoryChunk::FromHeapObject(object)->InReadOnlySpace();
+  }
 }
 
 Object* ReadOnlyHeap::ExtendReadOnlyObjectCache() {
-  read_only_object_cache_.push_back(Smi::kZero);
+  read_only_object_cache_.push_back(Smi::zero());
   return &read_only_object_cache_.back();
 }
 
@@ -154,10 +171,17 @@ ReadOnlyHeapObjectIterator::ReadOnlyHeapObjectIterator(ReadOnlyHeap* ro_heap)
 
 ReadOnlyHeapObjectIterator::ReadOnlyHeapObjectIterator(ReadOnlySpace* ro_space)
     : ro_space_(ro_space),
-      current_page_(ro_space->first_page()),
-      current_addr_(current_page_->area_start()) {}
+      current_page_(V8_ENABLE_THIRD_PARTY_HEAP_BOOL ? nullptr
+                                                    : ro_space->first_page()),
+      current_addr_(V8_ENABLE_THIRD_PARTY_HEAP_BOOL
+                        ? Address()
+                        : current_page_->area_start()) {}
 
 HeapObject ReadOnlyHeapObjectIterator::Next() {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    return HeapObject();  // Unsupported
+  }
+
   if (current_page_ == nullptr) {
     return HeapObject();
   }
@@ -182,7 +206,7 @@ HeapObject ReadOnlyHeapObjectIterator::Next() {
     const int object_size = object.Size();
     current_addr_ += object_size;
 
-    if (object.IsFiller()) {
+    if (object.IsFreeSpaceOrFiller()) {
       continue;
     }
 
diff --git a/deps/v8/src/heap/read-only-heap.h b/deps/v8/src/heap/read-only-heap.h
index 4c1da62a15789f..27d34b4c0348d7 100644
--- a/deps/v8/src/heap/read-only-heap.h
+++ b/deps/v8/src/heap/read-only-heap.h
@@ -42,6 +42,12 @@ class ReadOnlyHeap final {
   // and it may be safely disposed of.
   void OnHeapTearDown();
 
+#ifdef V8_SHARED_RO_HEAP
+  static const ReadOnlyHeap* Instance();
+#endif
+
+  // Returns whether the address is within the read-only space.
+  V8_EXPORT_PRIVATE static bool Contains(Address address);
   // Returns whether the object resides in the read-only space.
   V8_EXPORT_PRIVATE static bool Contains(HeapObject object);
   // Gets read-only roots from an appropriate root list: shared read-only root
@@ -64,8 +70,6 @@ class ReadOnlyHeap final {
   ReadOnlySpace* read_only_space() const { return read_only_space_; }
 
  private:
-  using Checksum = std::pair<uint32_t, uint32_t>;
-
   // Creates a new read-only heap and attaches it to the provided isolate.
   static ReadOnlyHeap* CreateAndAttachToIsolate(Isolate* isolate);
   // Runs the read-only deserailizer and calls InitFromIsolate to complete
@@ -84,7 +88,7 @@ class ReadOnlyHeap final {
 #ifdef V8_SHARED_RO_HEAP
 #ifdef DEBUG
   // The checksum of the blob the read-only heap was deserialized from, if any.
-  base::Optional<Checksum> read_only_blob_checksum_;
+  base::Optional<uint32_t> read_only_blob_checksum_;
 #endif  // DEBUG
 
   Address read_only_roots_[kEntriesCount];
diff --git a/deps/v8/src/heap/remembered-set.h b/deps/v8/src/heap/remembered-set.h
index 3c8984c83a6052..b5e92d6ec61435 100644
--- a/deps/v8/src/heap/remembered-set.h
+++ b/deps/v8/src/heap/remembered-set.h
@@ -12,6 +12,7 @@
 #include "src/heap/heap.h"
 #include "src/heap/slot-set.h"
 #include "src/heap/spaces.h"
+#include "src/heap/worklist.h"
 
 namespace v8 {
 namespace internal {
@@ -26,26 +27,24 @@ class RememberedSetOperations {
   static void Insert(SlotSet* slot_set, MemoryChunk* chunk, Address slot_addr) {
     DCHECK(chunk->Contains(slot_addr));
     uintptr_t offset = slot_addr - chunk->address();
-    slot_set[offset / Page::kPageSize].Insert<access_mode>(offset %
-                                                           Page::kPageSize);
+    slot_set->Insert<access_mode>(offset);
   }
 
   template <typename Callback>
-  static void Iterate(SlotSet* slots, MemoryChunk* chunk, Callback callback,
-                      SlotSet::EmptyBucketMode mode) {
-    if (slots != nullptr) {
-      size_t pages = (chunk->size() + Page::kPageSize - 1) / Page::kPageSize;
-      for (size_t page = 0; page < pages; page++) {
-        slots[page].Iterate(chunk->address() + page * Page::kPageSize, callback,
-                            mode);
-      }
+  static int Iterate(SlotSet* slot_set, MemoryChunk* chunk, Callback callback,
+                     SlotSet::EmptyBucketMode mode) {
+    int slots = 0;
+    if (slot_set != nullptr) {
+      slots +=
+          slot_set->Iterate(chunk->address(), chunk->buckets(), callback, mode);
     }
+    return slots;
   }
 
   static void Remove(SlotSet* slot_set, MemoryChunk* chunk, Address slot_addr) {
     if (slot_set != nullptr) {
       uintptr_t offset = slot_addr - chunk->address();
-      slot_set[offset / Page::kPageSize].Remove(offset % Page::kPageSize);
+      slot_set->Remove(offset);
     }
   }
 
@@ -55,35 +54,9 @@ class RememberedSetOperations {
       uintptr_t start_offset = start - chunk->address();
       uintptr_t end_offset = end - chunk->address();
       DCHECK_LT(start_offset, end_offset);
-      if (end_offset < static_cast<uintptr_t>(Page::kPageSize)) {
-        slot_set->RemoveRange(static_cast<int>(start_offset),
-                              static_cast<int>(end_offset), mode);
-      } else {
-        // The large page has multiple slot sets.
-        // Compute slot set indicies for the range [start_offset, end_offset).
-        int start_chunk = static_cast<int>(start_offset / Page::kPageSize);
-        int end_chunk = static_cast<int>((end_offset - 1) / Page::kPageSize);
-        int offset_in_start_chunk =
-            static_cast<int>(start_offset % Page::kPageSize);
-        // Note that using end_offset % Page::kPageSize would be incorrect
-        // because end_offset is one beyond the last slot to clear.
-        int offset_in_end_chunk = static_cast<int>(
-            end_offset - static_cast<uintptr_t>(end_chunk) * Page::kPageSize);
-        if (start_chunk == end_chunk) {
-          slot_set[start_chunk].RemoveRange(offset_in_start_chunk,
-                                            offset_in_end_chunk, mode);
-        } else {
-          // Clear all slots from start_offset to the end of first chunk.
-          slot_set[start_chunk].RemoveRange(offset_in_start_chunk,
-                                            Page::kPageSize, mode);
-          // Clear all slots in intermediate chunks.
-          for (int i = start_chunk + 1; i < end_chunk; i++) {
-            slot_set[i].RemoveRange(0, Page::kPageSize, mode);
-          }
-          // Clear slots from the beginning of the last page to end_offset.
-          slot_set[end_chunk].RemoveRange(0, offset_in_end_chunk, mode);
-        }
-      }
+      slot_set->RemoveRange(static_cast<int>(start_offset),
+                            static_cast<int>(end_offset), chunk->buckets(),
+                            mode);
     }
   }
 };
@@ -113,8 +86,7 @@ class RememberedSet : public AllStatic {
       return false;
     }
     uintptr_t offset = slot_addr - chunk->address();
-    return slot_set[offset / Page::kPageSize].Contains(offset %
-                                                       Page::kPageSize);
+    return slot_set->Contains(offset);
   }
 
   // Given a page and a slot in that page, this function removes the slot from
@@ -153,12 +125,12 @@ class RememberedSet : public AllStatic {
     OldGenerationMemoryChunkIterator it(heap);
     MemoryChunk* chunk;
     while ((chunk = it.next()) != nullptr) {
-      SlotSet* slots = chunk->slot_set<type>();
-      SlotSet* sweeping_slots =
+      SlotSet* slot_set = chunk->slot_set<type>();
+      SlotSet* sweeping_slot_set =
           type == OLD_TO_NEW ? chunk->sweeping_slot_set() : nullptr;
-      TypedSlotSet* typed_slots = chunk->typed_slot_set<type>();
-      if (slots != nullptr || sweeping_slots != nullptr ||
-          typed_slots != nullptr ||
+      TypedSlotSet* typed_slot_set = chunk->typed_slot_set<type>();
+      if (slot_set != nullptr || sweeping_slot_set != nullptr ||
+          typed_slot_set != nullptr ||
           chunk->invalidated_slots<type>() != nullptr) {
         callback(chunk);
       }
@@ -172,23 +144,49 @@ class RememberedSet : public AllStatic {
   // Notice that |mode| can only be of FREE* or PREFREE* if there are no other
   // threads concurrently inserting slots.
   template <typename Callback>
-  static void Iterate(MemoryChunk* chunk, Callback callback,
-                      SlotSet::EmptyBucketMode mode) {
-    SlotSet* slots = chunk->slot_set<type>();
-    RememberedSetOperations::Iterate(slots, chunk, callback, mode);
+  static int Iterate(MemoryChunk* chunk, Callback callback,
+                     SlotSet::EmptyBucketMode mode) {
+    SlotSet* slot_set = chunk->slot_set<type>();
+    return RememberedSetOperations::Iterate(slot_set, chunk, callback, mode);
+  }
+
+  template <typename Callback>
+  static int IterateAndTrackEmptyBuckets(
+      MemoryChunk* chunk, Callback callback,
+      Worklist<MemoryChunk*, 64>::View empty_chunks) {
+    SlotSet* slot_set = chunk->slot_set<type>();
+    int slots = 0;
+    if (slot_set != nullptr) {
+      PossiblyEmptyBuckets* possibly_empty_buckets =
+          chunk->possibly_empty_buckets();
+      slots += slot_set->IterateAndTrackEmptyBuckets(
+          chunk->address(), chunk->buckets(), callback, possibly_empty_buckets);
+      if (!possibly_empty_buckets->IsEmpty()) empty_chunks.Push(chunk);
+    }
+    return slots;
   }
 
   static void FreeEmptyBuckets(MemoryChunk* chunk) {
     DCHECK(type == OLD_TO_NEW);
-    SlotSet* slots = chunk->slot_set<type>();
-    if (slots != nullptr) {
-      size_t pages = (chunk->size() + Page::kPageSize - 1) / Page::kPageSize;
-      for (size_t page = 0; page < pages; page++) {
-        slots[page].FreeEmptyBuckets();
-      }
+    SlotSet* slot_set = chunk->slot_set<type>();
+    if (slot_set != nullptr && slot_set->FreeEmptyBuckets(chunk->buckets())) {
+      chunk->ReleaseSlotSet<type>();
     }
   }
 
+  static bool CheckPossiblyEmptyBuckets(MemoryChunk* chunk) {
+    DCHECK(type == OLD_TO_NEW);
+    SlotSet* slot_set = chunk->slot_set<type, AccessMode::NON_ATOMIC>();
+    if (slot_set != nullptr &&
+        slot_set->CheckPossiblyEmptyBuckets(chunk->buckets(),
+                                            chunk->possibly_empty_buckets())) {
+      chunk->ReleaseSlotSet<type>();
+      return true;
+    }
+
+    return false;
+  }
+
   // Given a page and a typed slot in that page, this function adds the slot
   // to the remembered set.
   static void InsertTyped(MemoryChunk* memory_chunk, SlotType slot_type,
@@ -200,20 +198,20 @@ class RememberedSet : public AllStatic {
     slot_set->Insert(slot_type, offset);
   }
 
-  static void MergeTyped(MemoryChunk* page, std::unique_ptr<TypedSlots> slots) {
+  static void MergeTyped(MemoryChunk* page, std::unique_ptr<TypedSlots> other) {
     TypedSlotSet* slot_set = page->typed_slot_set<type>();
     if (slot_set == nullptr) {
       slot_set = page->AllocateTypedSlotSet<type>();
     }
-    slot_set->Merge(slots.get());
+    slot_set->Merge(other.get());
   }
 
   // Given a page and a range of typed slots in that page, this function removes
   // the slots from the remembered set.
   static void RemoveRangeTyped(MemoryChunk* page, Address start, Address end) {
-    TypedSlotSet* slots = page->typed_slot_set<type>();
-    if (slots != nullptr) {
-      slots->Iterate(
+    TypedSlotSet* slot_set = page->typed_slot_set<type>();
+    if (slot_set != nullptr) {
+      slot_set->Iterate(
           [=](SlotType slot_type, Address slot_addr) {
             return start <= slot_addr && slot_addr < end ? REMOVE_SLOT
                                                          : KEEP_SLOT;
@@ -240,9 +238,10 @@ class RememberedSet : public AllStatic {
   // and return SlotCallbackResult.
   template <typename Callback>
   static void IterateTyped(MemoryChunk* chunk, Callback callback) {
-    TypedSlotSet* slots = chunk->typed_slot_set<type>();
-    if (slots != nullptr) {
-      int new_count = slots->Iterate(callback, TypedSlotSet::KEEP_EMPTY_CHUNKS);
+    TypedSlotSet* slot_set = chunk->typed_slot_set<type>();
+    if (slot_set != nullptr) {
+      int new_count =
+          slot_set->Iterate(callback, TypedSlotSet::KEEP_EMPTY_CHUNKS);
       if (new_count == 0) {
         chunk->ReleaseTypedSlotSet<type>();
       }
@@ -378,10 +377,10 @@ class RememberedSetSweeping {
   // Notice that |mode| can only be of FREE* or PREFREE* if there are no other
   // threads concurrently inserting slots.
   template <typename Callback>
-  static void Iterate(MemoryChunk* chunk, Callback callback,
-                      SlotSet::EmptyBucketMode mode) {
-    SlotSet* slots = chunk->sweeping_slot_set();
-    RememberedSetOperations::Iterate(slots, chunk, callback, mode);
+  static int Iterate(MemoryChunk* chunk, Callback callback,
+                     SlotSet::EmptyBucketMode mode) {
+    SlotSet* slot_set = chunk->sweeping_slot_set();
+    return RememberedSetOperations::Iterate(slot_set, chunk, callback, mode);
   }
 };
 
diff --git a/deps/v8/src/heap/scavenger-inl.h b/deps/v8/src/heap/scavenger-inl.h
index 7729807a8a43b8..de80d2a29050ed 100644
--- a/deps/v8/src/heap/scavenger-inl.h
+++ b/deps/v8/src/heap/scavenger-inl.h
@@ -476,13 +476,20 @@ void ScavengeVisitor::VisitPointersImpl(HeapObject host, TSlot start,
   }
 }
 
+int ScavengeVisitor::VisitJSArrayBuffer(Map map, JSArrayBuffer object) {
+  object.YoungMarkExtension();
+  int size = JSArrayBuffer::BodyDescriptor::SizeOf(map, object);
+  JSArrayBuffer::BodyDescriptor::IterateBody(map, object, size, this);
+  return size;
+}
+
 int ScavengeVisitor::VisitEphemeronHashTable(Map map,
                                              EphemeronHashTable table) {
   // Register table with the scavenger, so it can take care of the weak keys
   // later. This allows to only iterate the tables' values, which are treated
   // as strong independetly of whether the key is live.
   scavenger_->AddEphemeronHashTable(table);
-  for (int i = 0; i < table.Capacity(); i++) {
+  for (InternalIndex i : table.IterateEntries()) {
     ObjectSlot value_slot =
         table.RawFieldOfElementAt(EphemeronHashTable::EntryToValueIndex(i));
     VisitPointer(table, value_slot);
diff --git a/deps/v8/src/heap/scavenger.cc b/deps/v8/src/heap/scavenger.cc
index 47c19d4fcc1de5..08f32e037c5e78 100644
--- a/deps/v8/src/heap/scavenger.cc
+++ b/deps/v8/src/heap/scavenger.cc
@@ -5,6 +5,7 @@
 #include "src/heap/scavenger.h"
 
 #include "src/heap/array-buffer-collector.h"
+#include "src/heap/array-buffer-sweeper.h"
 #include "src/heap/barrier.h"
 #include "src/heap/gc-tracer.h"
 #include "src/heap/heap-inl.h"
@@ -220,7 +221,29 @@ class ScavengeWeakObjectRetainer : public WeakObjectRetainer {
 ScavengerCollector::ScavengerCollector(Heap* heap)
     : isolate_(heap->isolate()), heap_(heap), parallel_scavenge_semaphore_(0) {}
 
+// Remove this crashkey after chromium:1010312 is fixed.
+class ScopedFullHeapCrashKey {
+ public:
+  explicit ScopedFullHeapCrashKey(Isolate* isolate) : isolate_(isolate) {
+    isolate_->AddCrashKey(v8::CrashKeyId::kDumpType, "heap");
+  }
+  ~ScopedFullHeapCrashKey() {
+    isolate_->AddCrashKey(v8::CrashKeyId::kDumpType, "");
+  }
+
+ private:
+  Isolate* isolate_ = nullptr;
+};
+
 void ScavengerCollector::CollectGarbage() {
+  ScopedFullHeapCrashKey collect_full_heap_dump_if_crash(isolate_);
+
+  {
+    TRACE_GC(heap_->tracer(),
+             GCTracer::Scope::SCAVENGER_COMPLETE_SWEEP_ARRAY_BUFFERS);
+    heap_->array_buffer_sweeper()->EnsureFinished();
+  }
+
   DCHECK(surviving_new_large_objects_.empty());
   ItemParallelJob job(isolate_->cancelable_task_manager(),
                       &parallel_scavenge_semaphore_);
@@ -229,12 +252,14 @@ void ScavengerCollector::CollectGarbage() {
   const bool is_logging = isolate_->LogObjectRelocation();
   const int num_scavenge_tasks = NumberOfScavengeTasks();
   OneshotBarrier barrier(base::TimeDelta::FromMilliseconds(kMaxWaitTimeMs));
+  Worklist<MemoryChunk*, 64> empty_chunks;
   Scavenger::CopiedList copied_list(num_scavenge_tasks);
   Scavenger::PromotionList promotion_list(num_scavenge_tasks);
   EphemeronTableList ephemeron_table_list(num_scavenge_tasks);
   for (int i = 0; i < num_scavenge_tasks; i++) {
-    scavengers[i] = new Scavenger(this, heap_, is_logging, &copied_list,
-                                  &promotion_list, &ephemeron_table_list, i);
+    scavengers[i] =
+        new Scavenger(this, heap_, is_logging, &empty_chunks, &copied_list,
+                      &promotion_list, &ephemeron_table_list, i);
     job.AddTask(new ScavengingTask(heap_, scavengers[i], &barrier));
   }
 
@@ -345,14 +370,35 @@ void ScavengerCollector::CollectGarbage() {
   // TODO(hpayer): Don't free all as soon as we have an intermediate generation.
   heap_->new_lo_space()->FreeDeadObjects([](HeapObject) { return true; });
 
-  RememberedSet<OLD_TO_NEW>::IterateMemoryChunks(heap_, [](MemoryChunk* chunk) {
-    RememberedSet<OLD_TO_NEW>::FreeEmptyBuckets(chunk);
-  });
+  {
+    TRACE_GC(heap_->tracer(), GCTracer::Scope::SCAVENGER_FREE_REMEMBERED_SET);
+    MemoryChunk* chunk;
+
+    while (empty_chunks.Pop(kMainThreadId, &chunk)) {
+      RememberedSet<OLD_TO_NEW>::CheckPossiblyEmptyBuckets(chunk);
+    }
+
+#ifdef DEBUG
+    RememberedSet<OLD_TO_NEW>::IterateMemoryChunks(
+        heap_, [](MemoryChunk* chunk) {
+          DCHECK(chunk->possibly_empty_buckets()->IsEmpty());
+        });
+#endif
+  }
+
+  {
+    TRACE_GC(heap_->tracer(), GCTracer::Scope::SCAVENGER_SWEEP_ARRAY_BUFFERS);
+    SweepArrayBufferExtensions();
+  }
 
   // Update how much has survived scavenge.
   heap_->IncrementYoungSurvivorsCounter(heap_->SurvivedYoungObjectSize());
 }
 
+void ScavengerCollector::SweepArrayBufferExtensions() {
+  heap_->array_buffer_sweeper()->RequestSweepYoung();
+}
+
 void ScavengerCollector::HandleSurvivingNewLargeObjects() {
   for (SurvivingNewLargeObjectMapEntry update_info :
        surviving_new_large_objects_) {
@@ -392,17 +438,19 @@ int ScavengerCollector::NumberOfScavengeTasks() {
 }
 
 Scavenger::Scavenger(ScavengerCollector* collector, Heap* heap, bool is_logging,
+                     Worklist<MemoryChunk*, 64>* empty_chunks,
                      CopiedList* copied_list, PromotionList* promotion_list,
                      EphemeronTableList* ephemeron_table_list, int task_id)
     : collector_(collector),
       heap_(heap),
+      empty_chunks_(empty_chunks, task_id),
       promotion_list_(promotion_list, task_id),
       copied_list_(copied_list, task_id),
       ephemeron_table_list_(ephemeron_table_list, task_id),
       local_pretenuring_feedback_(kInitialLocalPretenuringFeedbackCapacity),
       copied_size_(0),
       promoted_size_(0),
-      allocator_(heap),
+      allocator_(heap, LocalSpaceKind::kCompactionSpaceForScavenge),
       is_logging_(is_logging),
       is_incremental_marking_(heap->incremental_marking()->IsMarking()),
       is_compacting_(heap->incremental_marking()->IsCompacting()) {}
@@ -418,8 +466,14 @@ void Scavenger::IterateAndScavengePromotedObject(HeapObject target, Map map,
   const bool record_slots =
       is_compacting_ &&
       heap()->incremental_marking()->atomic_marking_state()->IsBlack(target);
+
   IterateAndScavengePromotedObjectsVisitor visitor(this, record_slots);
   target.IterateBodyFast(map, size, &visitor);
+
+  if (map.IsJSArrayBufferMap()) {
+    DCHECK(!MemoryChunk::FromHeapObject(target)->IsLargePage());
+    JSArrayBuffer::cast(target).YoungMarkExtensionPromoted();
+  }
 }
 
 void Scavenger::RememberPromotedEphemeron(EphemeronHashTable table, int entry) {
@@ -437,39 +491,30 @@ void Scavenger::AddPageToSweeperIfNecessary(MemoryChunk* page) {
   }
 }
 
-// Remove this crashkey after chromium:1010312 is fixed.
-class ScopedFullHeapCrashKey {
- public:
-  explicit ScopedFullHeapCrashKey(Isolate* isolate) : isolate_(isolate) {
-    isolate_->AddCrashKey(v8::CrashKeyId::kDumpType, "heap");
-  }
-  ~ScopedFullHeapCrashKey() {
-    isolate_->AddCrashKey(v8::CrashKeyId::kDumpType, "");
-  }
-
- private:
-  Isolate* isolate_ = nullptr;
-};
-
 void Scavenger::ScavengePage(MemoryChunk* page) {
-  ScopedFullHeapCrashKey collect_full_heap_dump_if_crash(heap_->isolate());
   CodePageMemoryModificationScope memory_modification_scope(page);
-  InvalidatedSlotsFilter filter = InvalidatedSlotsFilter::OldToNew(page);
-  RememberedSet<OLD_TO_NEW>::Iterate(
-      page,
-      [this, &filter](MaybeObjectSlot slot) {
-        if (!filter.IsValid(slot.address())) return REMOVE_SLOT;
-        return CheckAndScavengeObject(heap_, slot);
-      },
-      SlotSet::KEEP_EMPTY_BUCKETS);
-  filter = InvalidatedSlotsFilter::OldToNew(page);
-  RememberedSetSweeping::Iterate(
-      page,
-      [this, &filter](MaybeObjectSlot slot) {
-        if (!filter.IsValid(slot.address())) return REMOVE_SLOT;
-        return CheckAndScavengeObject(heap_, slot);
-      },
-      SlotSet::KEEP_EMPTY_BUCKETS);
+
+  if (page->slot_set<OLD_TO_NEW, AccessMode::NON_ATOMIC>() != nullptr) {
+    InvalidatedSlotsFilter filter = InvalidatedSlotsFilter::OldToNew(page);
+    RememberedSet<OLD_TO_NEW>::IterateAndTrackEmptyBuckets(
+        page,
+        [this, &filter](MaybeObjectSlot slot) {
+          if (!filter.IsValid(slot.address())) return REMOVE_SLOT;
+          return CheckAndScavengeObject(heap_, slot);
+        },
+        empty_chunks_);
+  }
+
+  if (page->sweeping_slot_set<AccessMode::NON_ATOMIC>() != nullptr) {
+    InvalidatedSlotsFilter filter = InvalidatedSlotsFilter::OldToNew(page);
+    RememberedSetSweeping::Iterate(
+        page,
+        [this, &filter](MaybeObjectSlot slot) {
+          if (!filter.IsValid(slot.address())) return REMOVE_SLOT;
+          return CheckAndScavengeObject(heap_, slot);
+        },
+        SlotSet::KEEP_EMPTY_BUCKETS);
+  }
 
   if (page->invalidated_slots<OLD_TO_NEW>() != nullptr) {
     // The invalidated slots are not needed after old-to-new slots were
@@ -535,7 +580,7 @@ void ScavengerCollector::ProcessWeakReferences(
 void ScavengerCollector::ClearYoungEphemerons(
     EphemeronTableList* ephemeron_table_list) {
   ephemeron_table_list->Iterate([this](EphemeronHashTable table) {
-    for (int i = 0; i < table.Capacity(); i++) {
+    for (InternalIndex i : table.IterateEntries()) {
       // Keys in EphemeronHashTables must be heap objects.
       HeapObjectSlot key_slot(
           table.RawFieldOfElementAt(EphemeronHashTable::EntryToIndex(i)));
@@ -560,11 +605,11 @@ void ScavengerCollector::ClearOldEphemerons() {
     auto& indices = it->second;
     for (auto iti = indices.begin(); iti != indices.end();) {
       // Keys in EphemeronHashTables must be heap objects.
-      HeapObjectSlot key_slot(
-          table.RawFieldOfElementAt(EphemeronHashTable::EntryToIndex(*iti)));
+      HeapObjectSlot key_slot(table.RawFieldOfElementAt(
+          EphemeronHashTable::EntryToIndex(InternalIndex(*iti))));
       HeapObject key = key_slot.ToHeapObject();
       if (IsUnscavengedHeapObject(heap_, key)) {
-        table.RemoveEntry(*iti);
+        table.RemoveEntry(InternalIndex(*iti));
         iti = indices.erase(iti);
       } else {
         HeapObject forwarded = ForwardingAddress(key);
@@ -591,6 +636,7 @@ void Scavenger::Finalize() {
   heap()->IncrementPromotedObjectsSize(promoted_size_);
   collector_->MergeSurvivingNewLargeObjects(surviving_new_large_objects_);
   allocator_.Finalize();
+  empty_chunks_.FlushToGlobal();
   ephemeron_table_list_.FlushToGlobal();
   for (auto it = ephemeron_remembered_set_.begin();
        it != ephemeron_remembered_set_.end(); ++it) {
diff --git a/deps/v8/src/heap/scavenger.h b/deps/v8/src/heap/scavenger.h
index 52df4cf340c3c2..189bd490ce349b 100644
--- a/deps/v8/src/heap/scavenger.h
+++ b/deps/v8/src/heap/scavenger.h
@@ -51,6 +51,8 @@ class ScavengerCollector {
   void ClearOldEphemerons();
   void HandleSurvivingNewLargeObjects();
 
+  void SweepArrayBufferExtensions();
+
   Isolate* const isolate_;
   Heap* const heap_;
   base::Semaphore parallel_scavenge_semaphore_;
@@ -117,7 +119,8 @@ class Scavenger {
 
   using CopiedList = Worklist<ObjectAndSize, kCopiedListSegmentSize>;
   Scavenger(ScavengerCollector* collector, Heap* heap, bool is_logging,
-            CopiedList* copied_list, PromotionList* promotion_list,
+            Worklist<MemoryChunk*, 64>* empty_chunks, CopiedList* copied_list,
+            PromotionList* promotion_list,
             EphemeronTableList* ephemeron_table_list, int task_id);
 
   // Entry point for scavenging an old generation page. For scavenging single
@@ -206,6 +209,7 @@ class Scavenger {
 
   ScavengerCollector* const collector_;
   Heap* const heap_;
+  Worklist<MemoryChunk*, 64>::View empty_chunks_;
   PromotionList::View promotion_list_;
   CopiedList::View copied_list_;
   EphemeronTableList::View ephemeron_table_list_;
@@ -255,6 +259,7 @@ class ScavengeVisitor final : public NewSpaceVisitor<ScavengeVisitor> {
   V8_INLINE void VisitCodeTarget(Code host, RelocInfo* rinfo) final;
   V8_INLINE void VisitEmbeddedPointer(Code host, RelocInfo* rinfo) final;
   V8_INLINE int VisitEphemeronHashTable(Map map, EphemeronHashTable object);
+  V8_INLINE int VisitJSArrayBuffer(Map map, JSArrayBuffer object);
 
  private:
   template <typename TSlot>
diff --git a/deps/v8/src/heap/setup-heap-internal.cc b/deps/v8/src/heap/setup-heap-internal.cc
index 9f94029af374ab..58929c6691f0be 100644
--- a/deps/v8/src/heap/setup-heap-internal.cc
+++ b/deps/v8/src/heap/setup-heap-internal.cc
@@ -34,6 +34,7 @@
 #include "src/objects/oddball-inl.h"
 #include "src/objects/ordered-hash-table.h"
 #include "src/objects/promise.h"
+#include "src/objects/property-descriptor-object.h"
 #include "src/objects/script.h"
 #include "src/objects/shared-function-info.h"
 #include "src/objects/smi.h"
@@ -154,9 +155,10 @@ AllocationResult Heap::AllocatePartialMap(InstanceType instance_type,
   map.SetInObjectUnusedPropertyFields(0);
   map.set_bit_field(0);
   map.set_bit_field2(0);
-  int bit_field3 = Map::EnumLengthBits::encode(kInvalidEnumCacheSentinel) |
-                   Map::OwnsDescriptorsBit::encode(true) |
-                   Map::ConstructionCounterBits::encode(Map::kNoSlackTracking);
+  int bit_field3 =
+      Map::Bits3::EnumLengthBits::encode(kInvalidEnumCacheSentinel) |
+      Map::Bits3::OwnsDescriptorsBit::encode(true) |
+      Map::Bits3::ConstructionCounterBits::encode(Map::kNoSlackTracking);
   map.set_bit_field3(bit_field3);
   DCHECK(!map.is_in_retained_map_list());
   map.clear_padding();
@@ -385,16 +387,6 @@ bool Heap::CreateInitialMaps() {
       roots_table()[entry.index] = map.ptr();
     }
 
-    {  // Create a separate external one byte string map for native sources.
-      Map map;
-      AllocationResult allocation =
-          AllocateMap(UNCACHED_EXTERNAL_ONE_BYTE_STRING_TYPE,
-                      ExternalOneByteString::kUncachedSize);
-      if (!allocation.To(&map)) return false;
-      map.SetConstructorFunctionIndex(Context::STRING_FUNCTION_INDEX);
-      set_native_source_string_map(map);
-    }
-
     ALLOCATE_VARSIZE_MAP(FIXED_DOUBLE_ARRAY_TYPE, fixed_double_array)
     roots.fixed_double_array_map().set_elements_kind(HOLEY_DOUBLE_ELEMENTS);
     ALLOCATE_VARSIZE_MAP(FEEDBACK_METADATA_TYPE, feedback_metadata)
@@ -455,16 +447,6 @@ bool Heap::CreateInitialMaps() {
 
     ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, array_list)
 
-    ALLOCATE_VARSIZE_MAP(FUNCTION_CONTEXT_TYPE, function_context)
-    ALLOCATE_VARSIZE_MAP(CATCH_CONTEXT_TYPE, catch_context)
-    ALLOCATE_VARSIZE_MAP(WITH_CONTEXT_TYPE, with_context)
-    ALLOCATE_VARSIZE_MAP(DEBUG_EVALUATE_CONTEXT_TYPE, debug_evaluate_context)
-    ALLOCATE_VARSIZE_MAP(AWAIT_CONTEXT_TYPE, await_context)
-    ALLOCATE_VARSIZE_MAP(BLOCK_CONTEXT_TYPE, block_context)
-    ALLOCATE_VARSIZE_MAP(MODULE_CONTEXT_TYPE, module_context)
-    ALLOCATE_VARSIZE_MAP(NATIVE_CONTEXT_TYPE, native_context)
-    ALLOCATE_VARSIZE_MAP(EVAL_CONTEXT_TYPE, eval_context)
-    ALLOCATE_VARSIZE_MAP(SCRIPT_CONTEXT_TYPE, script_context)
     ALLOCATE_VARSIZE_MAP(SCRIPT_CONTEXT_TABLE_TYPE, script_context_table)
 
     ALLOCATE_VARSIZE_MAP(OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
@@ -495,7 +477,8 @@ bool Heap::CreateInitialMaps() {
 
     ALLOCATE_MAP(WEAK_CELL_TYPE, WeakCell::kSize, weak_cell)
 
-    ALLOCATE_MAP(JS_MESSAGE_OBJECT_TYPE, JSMessageObject::kSize, message_object)
+    ALLOCATE_MAP(JS_MESSAGE_OBJECT_TYPE, JSMessageObject::kHeaderSize,
+                 message_object)
     ALLOCATE_MAP(JS_OBJECT_TYPE, JSObject::kHeaderSize + kEmbedderDataSlotSize,
                  external)
     external_map().set_is_extensible(false);
@@ -523,7 +506,7 @@ bool Heap::CreateInitialMaps() {
 
     FixedArray::cast(obj).set_length(1);
     FixedArray::cast(obj).set(ObjectBoilerplateDescription::kLiteralTypeOffset,
-                              Smi::kZero);
+                              Smi::zero());
   }
   set_empty_object_boilerplate_description(
       ObjectBoilerplateDescription::cast(obj));
@@ -659,7 +642,7 @@ void Heap::CreateInitialObjects() {
 
   // Initialize the null_value.
   Oddball::Initialize(isolate(), factory->null_value(), "null",
-                      handle(Smi::kZero, isolate()), "object", Oddball::kNull);
+                      handle(Smi::zero(), isolate()), "object", Oddball::kNull);
 
   // Initialize the_hole_value.
   Oddball::Initialize(isolate(), factory->the_hole_value(), "hole",
@@ -673,7 +656,7 @@ void Heap::CreateInitialObjects() {
 
   // Initialize the false_value.
   Oddball::Initialize(isolate(), factory->false_value(), "false",
-                      handle(Smi::kZero, isolate()), "boolean",
+                      handle(Smi::zero(), isolate()), "boolean",
                       Oddball::kFalse);
 
   set_uninitialized_value(
@@ -726,7 +709,7 @@ void Heap::CreateInitialObjects() {
 #define SYMBOL_INIT(_, name, description)                                \
   Handle<Symbol> name = factory->NewSymbol(AllocationType::kReadOnly);   \
   Handle<String> name##d = factory->InternalizeUtf8String(#description); \
-  name->set_name(*name##d);                                              \
+  name->set_description(*name##d);                                       \
   roots_table()[RootIndex::k##name] = name->ptr();
     PUBLIC_SYMBOL_LIST_GENERATOR(SYMBOL_INIT, /* not used */)
 #undef SYMBOL_INIT
@@ -735,7 +718,7 @@ void Heap::CreateInitialObjects() {
   Handle<Symbol> name = factory->NewSymbol(AllocationType::kReadOnly);   \
   Handle<String> name##d = factory->InternalizeUtf8String(#description); \
   name->set_is_well_known_symbol(true);                                  \
-  name->set_name(*name##d);                                              \
+  name->set_description(*name##d);                                       \
   roots_table()[RootIndex::k##name] = name->ptr();
     WELL_KNOWN_SYMBOL_LIST_GENERATOR(SYMBOL_INIT, /* not used */)
 #undef SYMBOL_INIT
@@ -803,7 +786,7 @@ void Heap::CreateInitialObjects() {
   empty_ordered_hash_map->set_map_no_write_barrier(
       *factory->ordered_hash_map_map());
   for (int i = 0; i < empty_ordered_hash_map->length(); ++i) {
-    empty_ordered_hash_map->set(i, Smi::kZero);
+    empty_ordered_hash_map->set(i, Smi::zero());
   }
   set_empty_ordered_hash_map(*empty_ordered_hash_map);
 
@@ -813,7 +796,7 @@ void Heap::CreateInitialObjects() {
   empty_ordered_hash_set->set_map_no_write_barrier(
       *factory->ordered_hash_set_map());
   for (int i = 0; i < empty_ordered_hash_set->length(); ++i) {
-    empty_ordered_hash_set->set(i, Smi::kZero);
+    empty_ordered_hash_set->set(i, Smi::zero());
   }
   set_empty_ordered_hash_set(*empty_ordered_hash_set);
 
@@ -831,6 +814,10 @@ void Heap::CreateInitialObjects() {
       ScopeInfo::CreateForEmptyFunction(isolate());
   set_empty_function_scope_info(*empty_function);
 
+  Handle<ScopeInfo> native_scope_info =
+      ScopeInfo::CreateForNativeContext(isolate());
+  set_native_scope_info(*native_scope_info);
+
   // Allocate the empty script.
   Handle<Script> script = factory->NewScript(factory->empty_string());
   script->set_type(Script::TYPE_NATIVE);
diff --git a/deps/v8/src/heap/slot-set.h b/deps/v8/src/heap/slot-set.h
index b1321b6fcaafe5..3275d6278e90f2 100644
--- a/deps/v8/src/heap/slot-set.h
+++ b/deps/v8/src/heap/slot-set.h
@@ -10,7 +10,9 @@
 #include <stack>
 
 #include "src/base/atomic-utils.h"
+#include "src/base/bit-field.h"
 #include "src/base/bits.h"
+#include "src/heap/worklist.h"
 #include "src/objects/compressed-slots.h"
 #include "src/objects/slots.h"
 #include "src/utils/allocation.h"
@@ -21,103 +23,252 @@ namespace internal {
 
 enum SlotCallbackResult { KEEP_SLOT, REMOVE_SLOT };
 
+// Possibly empty buckets (buckets that do not contain any slots) are discovered
+// by the scavenger. Buckets might become non-empty when promoting objects later
+// or in another thread, so all those buckets need to be revisited.
+// Track possibly empty buckets within a SlotSet in this data structure. The
+// class contains a word-sized bitmap, in case more bits are needed the bitmap
+// is replaced with a pointer to a malloc-allocated bitmap.
+class PossiblyEmptyBuckets {
+ public:
+  PossiblyEmptyBuckets() : bitmap_(kNullAddress) {}
+  PossiblyEmptyBuckets(PossiblyEmptyBuckets&& other) V8_NOEXCEPT
+      : bitmap_(other.bitmap_) {
+    other.bitmap_ = kNullAddress;
+  }
+
+  ~PossiblyEmptyBuckets() { Release(); }
+
+  void Initialize() {
+    bitmap_ = kNullAddress;
+    DCHECK(!IsAllocated());
+  }
+
+  void Release() {
+    if (IsAllocated()) {
+      AlignedFree(BitmapArray());
+    }
+    bitmap_ = kNullAddress;
+    DCHECK(!IsAllocated());
+  }
+
+  void Insert(size_t bucket_index, size_t buckets) {
+    if (IsAllocated()) {
+      InsertAllocated(bucket_index);
+    } else if (bucket_index + 1 < kBitsPerWord) {
+      bitmap_ |= static_cast<uintptr_t>(1) << (bucket_index + 1);
+    } else {
+      Allocate(buckets);
+      InsertAllocated(bucket_index);
+    }
+  }
+
+  bool Contains(size_t bucket_index) {
+    if (IsAllocated()) {
+      size_t word_idx = bucket_index / kBitsPerWord;
+      uintptr_t* word = BitmapArray() + word_idx;
+      return *word &
+             (static_cast<uintptr_t>(1) << (bucket_index % kBitsPerWord));
+    } else if (bucket_index + 1 < kBitsPerWord) {
+      return bitmap_ & (static_cast<uintptr_t>(1) << (bucket_index + 1));
+    } else {
+      return false;
+    }
+  }
+
+  bool IsEmpty() { return bitmap_ == kNullAddress; }
+
+ private:
+  Address bitmap_;
+  static const Address kPointerTag = 1;
+  static const int kWordSize = sizeof(uintptr_t);
+  static const int kBitsPerWord = kWordSize * kBitsPerByte;
+
+  bool IsAllocated() { return bitmap_ & kPointerTag; }
+
+  void Allocate(size_t buckets) {
+    DCHECK(!IsAllocated());
+    size_t words = WordsForBuckets(buckets);
+    uintptr_t* ptr = reinterpret_cast<uintptr_t*>(
+        AlignedAlloc(words * kWordSize, kSystemPointerSize));
+    ptr[0] = bitmap_ >> 1;
+
+    for (size_t word_idx = 1; word_idx < words; word_idx++) {
+      ptr[word_idx] = 0;
+    }
+    bitmap_ = reinterpret_cast<Address>(ptr) + kPointerTag;
+    DCHECK(IsAllocated());
+  }
+
+  void InsertAllocated(size_t bucket_index) {
+    DCHECK(IsAllocated());
+    size_t word_idx = bucket_index / kBitsPerWord;
+    uintptr_t* word = BitmapArray() + word_idx;
+    *word |= static_cast<uintptr_t>(1) << (bucket_index % kBitsPerWord);
+  }
+
+  static size_t WordsForBuckets(size_t buckets) {
+    return (buckets + kBitsPerWord - 1) / kBitsPerWord;
+  }
+
+  uintptr_t* BitmapArray() {
+    DCHECK(IsAllocated());
+    return reinterpret_cast<uintptr_t*>(bitmap_ & ~kPointerTag);
+  }
+
+  FRIEND_TEST(PossiblyEmptyBucketsTest, WordsForBuckets);
+
+  DISALLOW_COPY_AND_ASSIGN(PossiblyEmptyBuckets);
+};
+
+STATIC_ASSERT(std::is_standard_layout<PossiblyEmptyBuckets>::value);
+STATIC_ASSERT(sizeof(PossiblyEmptyBuckets) == kSystemPointerSize);
+
 // Data structure for maintaining a set of slots in a standard (non-large)
 // page.
 // The data structure assumes that the slots are pointer size aligned and
-// splits the valid slot offset range into kBuckets buckets.
+// splits the valid slot offset range into buckets.
 // Each bucket is a bitmap with a bit corresponding to a single slot offset.
-class SlotSet : public Malloced {
+class SlotSet {
  public:
   enum EmptyBucketMode {
     FREE_EMPTY_BUCKETS,  // An empty bucket will be deallocated immediately.
     KEEP_EMPTY_BUCKETS   // An empty bucket will be kept.
   };
 
-  SlotSet() {
-    for (int i = 0; i < kBuckets; i++) {
-      StoreBucket(&buckets_[i], nullptr);
+  SlotSet() = delete;
+
+  static SlotSet* Allocate(size_t buckets) {
+    //  SlotSet* slot_set --+
+    //                      |
+    //                      v
+    //    +-----------------+-------------------------+
+    //    | initial buckets |     buckets array       |
+    //    +-----------------+-------------------------+
+    //       pointer-sized    pointer-sized * buckets
+    //
+    //
+    // The SlotSet pointer points to the beginning of the buckets array for
+    // faster access in the write barrier. The number of buckets is needed for
+    // calculating the size of this data structure.
+    size_t buckets_size = buckets * sizeof(Bucket*);
+    size_t size = kInitialBucketsSize + buckets_size;
+    void* allocation = AlignedAlloc(size, kSystemPointerSize);
+    SlotSet* slot_set = reinterpret_cast<SlotSet*>(
+        reinterpret_cast<uint8_t*>(allocation) + kInitialBucketsSize);
+    DCHECK(
+        IsAligned(reinterpret_cast<uintptr_t>(slot_set), kSystemPointerSize));
+#ifdef DEBUG
+    *slot_set->initial_buckets() = buckets;
+#endif
+    for (size_t i = 0; i < buckets; i++) {
+      *slot_set->bucket(i) = nullptr;
     }
+    return slot_set;
   }
 
-  ~SlotSet() {
-    for (int i = 0; i < kBuckets; i++) {
-      ReleaseBucket(i);
+  static void Delete(SlotSet* slot_set, size_t buckets) {
+    if (slot_set == nullptr) return;
+
+    for (size_t i = 0; i < buckets; i++) {
+      slot_set->ReleaseBucket(i);
+    }
+
+#ifdef DEBUG
+    size_t initial_buckets = *slot_set->initial_buckets();
+
+    for (size_t i = buckets; i < initial_buckets; i++) {
+      DCHECK_NULL(*slot_set->bucket(i));
     }
+#endif
+
+    AlignedFree(reinterpret_cast<uint8_t*>(slot_set) - kInitialBucketsSize);
+  }
+
+  static size_t BucketsForSize(size_t size) {
+    return (size + (kTaggedSize * kBitsPerBucket) - 1) >>
+           (kTaggedSizeLog2 + kBitsPerBucketLog2);
   }
 
   // The slot offset specifies a slot at address page_start_ + slot_offset.
   // AccessMode defines whether there can be concurrent access on the buckets
   // or not.
   template <AccessMode access_mode>
-  void Insert(int slot_offset) {
-    int bucket_index, cell_index, bit_index;
+  void Insert(size_t slot_offset) {
+    size_t bucket_index;
+    int cell_index, bit_index;
     SlotToIndices(slot_offset, &bucket_index, &cell_index, &bit_index);
-    Bucket bucket = LoadBucket<access_mode>(&buckets_[bucket_index]);
+    Bucket* bucket = LoadBucket<access_mode>(bucket_index);
     if (bucket == nullptr) {
-      bucket = AllocateBucket();
-      if (!SwapInNewBucket<access_mode>(&buckets_[bucket_index], bucket)) {
-        DeleteArray<uint32_t>(bucket);
-        bucket = LoadBucket<access_mode>(&buckets_[bucket_index]);
+      bucket = new Bucket;
+      if (!SwapInNewBucket<access_mode>(bucket_index, bucket)) {
+        delete bucket;
+        bucket = LoadBucket<access_mode>(bucket_index);
       }
     }
     // Check that monotonicity is preserved, i.e., once a bucket is set we do
     // not free it concurrently.
-    DCHECK_NOT_NULL(bucket);
-    DCHECK_EQ(bucket, LoadBucket<access_mode>(&buckets_[bucket_index]));
+    DCHECK(bucket != nullptr);
+    DCHECK_EQ(bucket->cells(), LoadBucket<access_mode>(bucket_index)->cells());
     uint32_t mask = 1u << bit_index;
-    if ((LoadCell<access_mode>(&bucket[cell_index]) & mask) == 0) {
-      SetCellBits<access_mode>(&bucket[cell_index], mask);
+    if ((bucket->LoadCell<access_mode>(cell_index) & mask) == 0) {
+      bucket->SetCellBits<access_mode>(cell_index, mask);
     }
   }
 
   // The slot offset specifies a slot at address page_start_ + slot_offset.
   // Returns true if the set contains the slot.
-  bool Contains(int slot_offset) {
-    int bucket_index, cell_index, bit_index;
+  bool Contains(size_t slot_offset) {
+    size_t bucket_index;
+    int cell_index, bit_index;
     SlotToIndices(slot_offset, &bucket_index, &cell_index, &bit_index);
-    Bucket bucket = LoadBucket(&buckets_[bucket_index]);
+    Bucket* bucket = LoadBucket(bucket_index);
     if (bucket == nullptr) return false;
-    return (LoadCell(&bucket[cell_index]) & (1u << bit_index)) != 0;
+    return (bucket->LoadCell(cell_index) & (1u << bit_index)) != 0;
   }
 
   // The slot offset specifies a slot at address page_start_ + slot_offset.
-  void Remove(int slot_offset) {
-    int bucket_index, cell_index, bit_index;
+  void Remove(size_t slot_offset) {
+    size_t bucket_index;
+    int cell_index, bit_index;
     SlotToIndices(slot_offset, &bucket_index, &cell_index, &bit_index);
-    Bucket bucket = LoadBucket(&buckets_[bucket_index]);
+    Bucket* bucket = LoadBucket(bucket_index);
     if (bucket != nullptr) {
-      uint32_t cell = LoadCell(&bucket[cell_index]);
+      uint32_t cell = bucket->LoadCell(cell_index);
       uint32_t bit_mask = 1u << bit_index;
       if (cell & bit_mask) {
-        ClearCellBits(&bucket[cell_index], bit_mask);
+        bucket->ClearCellBits(cell_index, bit_mask);
       }
     }
   }
 
   // The slot offsets specify a range of slots at addresses:
   // [page_start_ + start_offset ... page_start_ + end_offset).
-  void RemoveRange(int start_offset, int end_offset, EmptyBucketMode mode) {
-    CHECK_LE(end_offset, 1 << kPageSizeBits);
+  void RemoveRange(size_t start_offset, size_t end_offset, size_t buckets,
+                   EmptyBucketMode mode) {
+    CHECK_LE(end_offset, buckets * kBitsPerBucket * kTaggedSize);
     DCHECK_LE(start_offset, end_offset);
-    int start_bucket, start_cell, start_bit;
+    size_t start_bucket;
+    int start_cell, start_bit;
     SlotToIndices(start_offset, &start_bucket, &start_cell, &start_bit);
-    int end_bucket, end_cell, end_bit;
+    size_t end_bucket;
+    int end_cell, end_bit;
     SlotToIndices(end_offset, &end_bucket, &end_cell, &end_bit);
     uint32_t start_mask = (1u << start_bit) - 1;
     uint32_t end_mask = ~((1u << end_bit) - 1);
-    Bucket bucket;
+    Bucket* bucket;
     if (start_bucket == end_bucket && start_cell == end_cell) {
-      bucket = LoadBucket(&buckets_[start_bucket]);
+      bucket = LoadBucket(start_bucket);
       if (bucket != nullptr) {
-        ClearCellBits(&bucket[start_cell], ~(start_mask | end_mask));
+        bucket->ClearCellBits(start_cell, ~(start_mask | end_mask));
       }
       return;
     }
-    int current_bucket = start_bucket;
+    size_t current_bucket = start_bucket;
     int current_cell = start_cell;
-    bucket = LoadBucket(&buckets_[current_bucket]);
+    bucket = LoadBucket(current_bucket);
     if (bucket != nullptr) {
-      ClearCellBits(&bucket[current_cell], ~start_mask);
+      bucket->ClearCellBits(current_cell, ~start_mask);
     }
     current_cell++;
     if (current_bucket < end_bucket) {
@@ -136,7 +287,7 @@ class SlotSet : public Malloced {
         ReleaseBucket(current_bucket);
       } else {
         DCHECK(mode == KEEP_EMPTY_BUCKETS);
-        bucket = LoadBucket(&buckets_[current_bucket]);
+        bucket = LoadBucket(current_bucket);
         if (bucket != nullptr) {
           ClearBucket(bucket, 0, kCellsPerBucket);
         }
@@ -145,26 +296,27 @@ class SlotSet : public Malloced {
     }
     // All buckets between start_bucket and end_bucket are cleared.
     DCHECK(current_bucket == end_bucket);
-    if (current_bucket == kBuckets) return;
-    bucket = LoadBucket(&buckets_[current_bucket]);
+    if (current_bucket == buckets) return;
+    bucket = LoadBucket(current_bucket);
     DCHECK(current_cell <= end_cell);
     if (bucket == nullptr) return;
     while (current_cell < end_cell) {
-      StoreCell(&bucket[current_cell], 0);
+      bucket->StoreCell(current_cell, 0);
       current_cell++;
     }
     // All cells between start_cell and end_cell are cleared.
     DCHECK(current_bucket == end_bucket && current_cell == end_cell);
-    ClearCellBits(&bucket[end_cell], ~end_mask);
+    bucket->ClearCellBits(end_cell, ~end_mask);
   }
 
   // The slot offset specifies a slot at address page_start_ + slot_offset.
-  bool Lookup(int slot_offset) {
-    int bucket_index, cell_index, bit_index;
+  bool Lookup(size_t slot_offset) {
+    size_t bucket_index;
+    int cell_index, bit_index;
     SlotToIndices(slot_offset, &bucket_index, &cell_index, &bit_index);
-    Bucket bucket = LoadBucket(&buckets_[bucket_index]);
+    Bucket* bucket = LoadBucket(bucket_index);
     if (bucket == nullptr) return false;
-    return (LoadCell(&bucket[cell_index]) & (1u << bit_index)) != 0;
+    return (bucket->LoadCell(cell_index) & (1u << bit_index)) != 0;
   }
 
   // Iterate over all slots in the set and for each slot invoke the callback.
@@ -180,24 +332,153 @@ class SlotSet : public Malloced {
   //    if (good(slot)) return KEEP_SLOT;
   //    else return REMOVE_SLOT;
   // });
+  //
+  // Releases memory for empty buckets with FREE_EMPTY_BUCKETS.
   template <typename Callback>
-  int Iterate(Address page_start, Callback callback, EmptyBucketMode mode) {
-    int new_count = 0;
-    for (int bucket_index = 0; bucket_index < kBuckets; bucket_index++) {
-      Bucket bucket = LoadBucket(&buckets_[bucket_index]);
+  size_t Iterate(Address chunk_start, size_t buckets, Callback callback,
+                 EmptyBucketMode mode) {
+    return Iterate(chunk_start, buckets, callback,
+                   [this, mode](size_t bucket_index) {
+                     if (mode == EmptyBucketMode::FREE_EMPTY_BUCKETS) {
+                       ReleaseBucket(bucket_index);
+                     }
+                   });
+  }
+
+  // Similar to Iterate but marks potentially empty buckets internally. Stores
+  // true in empty_bucket_found in case a potentially empty bucket was found.
+  // Assumes that the possibly empty-array was already cleared by
+  // CheckPossiblyEmptyBuckets.
+  template <typename Callback>
+  size_t IterateAndTrackEmptyBuckets(
+      Address chunk_start, size_t buckets, Callback callback,
+      PossiblyEmptyBuckets* possibly_empty_buckets) {
+    return Iterate(chunk_start, buckets, callback,
+                   [possibly_empty_buckets, buckets](size_t bucket_index) {
+                     possibly_empty_buckets->Insert(bucket_index, buckets);
+                   });
+  }
+
+  bool FreeEmptyBuckets(size_t buckets) {
+    bool empty = true;
+    for (size_t bucket_index = 0; bucket_index < buckets; bucket_index++) {
+      if (!FreeBucketIfEmpty(bucket_index)) {
+        empty = false;
+      }
+    }
+
+    return empty;
+  }
+
+  // Check whether possibly empty buckets are really empty. Empty buckets are
+  // freed and the possibly empty state is cleared for all buckets.
+  bool CheckPossiblyEmptyBuckets(size_t buckets,
+                                 PossiblyEmptyBuckets* possibly_empty_buckets) {
+    bool empty = true;
+    for (size_t bucket_index = 0; bucket_index < buckets; bucket_index++) {
+      Bucket* bucket = LoadBucket<AccessMode::NON_ATOMIC>(bucket_index);
+      if (bucket) {
+        if (possibly_empty_buckets->Contains(bucket_index)) {
+          if (bucket->IsEmpty()) {
+            ReleaseBucket<AccessMode::NON_ATOMIC>(bucket_index);
+          } else {
+            empty = false;
+          }
+        } else {
+          empty = false;
+        }
+      } else {
+        // Unfortunately we cannot DCHECK here that the corresponding bit in
+        // possibly_empty_buckets is not set. After scavenge, the
+        // MergeOldToNewRememberedSets operation might remove a recorded bucket.
+      }
+    }
+
+    possibly_empty_buckets->Release();
+
+    return empty;
+  }
+
+  static const int kCellsPerBucket = 32;
+  static const int kCellsPerBucketLog2 = 5;
+  static const int kCellSizeBytesLog2 = 2;
+  static const int kCellSizeBytes = 1 << kCellSizeBytesLog2;
+  static const int kBitsPerCell = 32;
+  static const int kBitsPerCellLog2 = 5;
+  static const int kBitsPerBucket = kCellsPerBucket * kBitsPerCell;
+  static const int kBitsPerBucketLog2 = kCellsPerBucketLog2 + kBitsPerCellLog2;
+  static const int kBucketsRegularPage =
+      (1 << kPageSizeBits) / kTaggedSize / kCellsPerBucket / kBitsPerCell;
+
+  class Bucket : public Malloced {
+    uint32_t cells_[kCellsPerBucket];
+
+   public:
+    Bucket() {
+      for (int i = 0; i < kCellsPerBucket; i++) {
+        cells_[i] = 0;
+      }
+    }
+
+    uint32_t* cells() { return cells_; }
+    uint32_t* cell(int cell_index) { return cells() + cell_index; }
+
+    template <AccessMode access_mode = AccessMode::ATOMIC>
+    uint32_t LoadCell(int cell_index) {
+      DCHECK_LT(cell_index, kCellsPerBucket);
+      if (access_mode == AccessMode::ATOMIC)
+        return base::AsAtomic32::Acquire_Load(cells() + cell_index);
+      return *(cells() + cell_index);
+    }
+
+    template <AccessMode access_mode = AccessMode::ATOMIC>
+    void SetCellBits(int cell_index, uint32_t mask) {
+      if (access_mode == AccessMode::ATOMIC) {
+        base::AsAtomic32::SetBits(cell(cell_index), mask, mask);
+      } else {
+        uint32_t* c = cell(cell_index);
+        *c = (*c & ~mask) | mask;
+      }
+    }
+
+    void ClearCellBits(int cell_index, uint32_t mask) {
+      base::AsAtomic32::SetBits(cell(cell_index), 0u, mask);
+    }
+
+    void StoreCell(int cell_index, uint32_t value) {
+      base::AsAtomic32::Release_Store(cell(cell_index), value);
+    }
+
+    bool IsEmpty() {
+      for (int i = 0; i < kCellsPerBucket; i++) {
+        if (cells_[i] != 0) {
+          return false;
+        }
+      }
+      return true;
+    }
+  };
+
+ private:
+  template <typename Callback, typename EmptyBucketCallback>
+  size_t Iterate(Address chunk_start, size_t buckets, Callback callback,
+                 EmptyBucketCallback empty_bucket_callback) {
+    size_t new_count = 0;
+    for (size_t bucket_index = 0; bucket_index < buckets; bucket_index++) {
+      Bucket* bucket = LoadBucket(bucket_index);
       if (bucket != nullptr) {
-        int in_bucket_count = 0;
-        int cell_offset = bucket_index * kBitsPerBucket;
+        size_t in_bucket_count = 0;
+        size_t cell_offset = bucket_index << kBitsPerBucketLog2;
         for (int i = 0; i < kCellsPerBucket; i++, cell_offset += kBitsPerCell) {
-          uint32_t cell = LoadCell(&bucket[i]);
+          uint32_t cell = bucket->LoadCell(i);
           if (cell) {
             uint32_t old_cell = cell;
             uint32_t mask = 0;
             while (cell) {
               int bit_offset = base::bits::CountTrailingZeros(cell);
               uint32_t bit_mask = 1u << bit_offset;
-              uint32_t slot = (cell_offset + bit_offset) << kTaggedSizeLog2;
-              if (callback(MaybeObjectSlot(page_start + slot)) == KEEP_SLOT) {
+              Address slot = (cell_offset + bit_offset) << kTaggedSizeLog2;
+              if (callback(MaybeObjectSlot(chunk_start + slot)) == KEEP_SLOT) {
                 ++in_bucket_count;
               } else {
                 mask |= bit_mask;
@@ -206,144 +487,112 @@ class SlotSet : public Malloced {
             }
             uint32_t new_cell = old_cell & ~mask;
             if (old_cell != new_cell) {
-              ClearCellBits(&bucket[i], mask);
+              bucket->ClearCellBits(i, mask);
             }
           }
         }
+        if (in_bucket_count == 0) {
+          empty_bucket_callback(bucket_index);
+        }
         new_count += in_bucket_count;
       }
     }
     return new_count;
   }
 
-  void FreeEmptyBuckets() {
-    for (int bucket_index = 0; bucket_index < kBuckets; bucket_index++) {
-      Bucket bucket = LoadBucket(&buckets_[bucket_index]);
-      if (bucket != nullptr) {
-        if (IsEmptyBucket(bucket)) {
-          ReleaseBucket(bucket_index);
-        }
+  bool FreeBucketIfEmpty(size_t bucket_index) {
+    Bucket* bucket = LoadBucket<AccessMode::NON_ATOMIC>(bucket_index);
+    if (bucket != nullptr) {
+      if (bucket->IsEmpty()) {
+        ReleaseBucket<AccessMode::NON_ATOMIC>(bucket_index);
+      } else {
+        return false;
       }
     }
-  }
-
-  static const int kMaxSlots = (1 << kPageSizeBits) / kTaggedSize;
-  static const int kCellsPerBucket = 32;
-  static const int kCellsPerBucketLog2 = 5;
-  static const int kCellSizeBytesLog2 = 2;
-  static const int kCellSizeBytes = 1 << kCellSizeBytesLog2;
-  static const int kBitsPerCell = 32;
-  static const int kBitsPerCellLog2 = 5;
-  static const int kBitsPerBucket = kCellsPerBucket * kBitsPerCell;
-  static const int kBitsPerBucketLog2 = kCellsPerBucketLog2 + kBitsPerCellLog2;
-  static const int kBuckets = kMaxSlots / kCellsPerBucket / kBitsPerCell;
-
-  static const int kSize = kBuckets * kSystemPointerSize;
 
-  using Bucket = uint32_t*;
-
- private:
-  Bucket AllocateBucket() {
-    Bucket result = NewArray<uint32_t>(kCellsPerBucket);
-    for (int i = 0; i < kCellsPerBucket; i++) {
-      result[i] = 0;
-    }
-    return result;
+    return true;
   }
 
-  void ClearBucket(Bucket bucket, int start_cell, int end_cell) {
+  void ClearBucket(Bucket* bucket, int start_cell, int end_cell) {
     DCHECK_GE(start_cell, 0);
     DCHECK_LE(end_cell, kCellsPerBucket);
     int current_cell = start_cell;
     while (current_cell < kCellsPerBucket) {
-      StoreCell(&bucket[current_cell], 0);
+      bucket->StoreCell(current_cell, 0);
       current_cell++;
     }
   }
 
-  void ReleaseBucket(int bucket_index) {
-    Bucket bucket = LoadBucket(&buckets_[bucket_index]);
-    StoreBucket(&buckets_[bucket_index], nullptr);
-    DeleteArray<uint32_t>(bucket);
+  template <AccessMode access_mode = AccessMode::ATOMIC>
+  void ReleaseBucket(size_t bucket_index) {
+    Bucket* bucket = LoadBucket<access_mode>(bucket_index);
+    StoreBucket<access_mode>(bucket_index, nullptr);
+    delete bucket;
   }
 
   template <AccessMode access_mode = AccessMode::ATOMIC>
-  Bucket LoadBucket(Bucket* bucket) {
+  Bucket* LoadBucket(Bucket** bucket) {
     if (access_mode == AccessMode::ATOMIC)
       return base::AsAtomicPointer::Acquire_Load(bucket);
     return *bucket;
   }
 
   template <AccessMode access_mode = AccessMode::ATOMIC>
-  void StoreBucket(Bucket* bucket, Bucket value) {
-    if (access_mode == AccessMode::ATOMIC) {
-      base::AsAtomicPointer::Release_Store(bucket, value);
-    } else {
-      *bucket = value;
-    }
-  }
-
-  bool IsEmptyBucket(Bucket bucket) {
-    for (int i = 0; i < kCellsPerBucket; i++) {
-      if (LoadCell(&bucket[i])) {
-        return false;
-      }
-    }
-    return true;
+  Bucket* LoadBucket(size_t bucket_index) {
+    return LoadBucket(bucket(bucket_index));
   }
 
   template <AccessMode access_mode = AccessMode::ATOMIC>
-  bool SwapInNewBucket(Bucket* bucket, Bucket value) {
+  void StoreBucket(Bucket** bucket, Bucket* value) {
     if (access_mode == AccessMode::ATOMIC) {
-      return base::AsAtomicPointer::Release_CompareAndSwap(bucket, nullptr,
-                                                           value) == nullptr;
+      base::AsAtomicPointer::Release_Store(bucket, value);
     } else {
-      DCHECK_NULL(*bucket);
       *bucket = value;
-      return true;
     }
   }
 
   template <AccessMode access_mode = AccessMode::ATOMIC>
-  uint32_t LoadCell(uint32_t* cell) {
-    if (access_mode == AccessMode::ATOMIC)
-      return base::AsAtomic32::Acquire_Load(cell);
-    return *cell;
-  }
-
-  void StoreCell(uint32_t* cell, uint32_t value) {
-    base::AsAtomic32::Release_Store(cell, value);
-  }
-
-  void ClearCellBits(uint32_t* cell, uint32_t mask) {
-    base::AsAtomic32::SetBits(cell, 0u, mask);
+  void StoreBucket(size_t bucket_index, Bucket* value) {
+    StoreBucket(bucket(bucket_index), value);
   }
 
   template <AccessMode access_mode = AccessMode::ATOMIC>
-  void SetCellBits(uint32_t* cell, uint32_t mask) {
+  bool SwapInNewBucket(size_t bucket_index, Bucket* value) {
+    Bucket** b = bucket(bucket_index);
     if (access_mode == AccessMode::ATOMIC) {
-      base::AsAtomic32::SetBits(cell, mask, mask);
+      return base::AsAtomicPointer::Release_CompareAndSwap(b, nullptr, value) ==
+             nullptr;
     } else {
-      *cell = (*cell & ~mask) | mask;
+      DCHECK_NULL(*b);
+      *b = value;
+      return true;
     }
   }
 
   // Converts the slot offset into bucket/cell/bit index.
-  void SlotToIndices(int slot_offset, int* bucket_index, int* cell_index,
-                     int* bit_index) {
+  static void SlotToIndices(size_t slot_offset, size_t* bucket_index,
+                            int* cell_index, int* bit_index) {
     DCHECK(IsAligned(slot_offset, kTaggedSize));
-    int slot = slot_offset >> kTaggedSizeLog2;
-    DCHECK(slot >= 0 && slot <= kMaxSlots);
+    size_t slot = slot_offset >> kTaggedSizeLog2;
     *bucket_index = slot >> kBitsPerBucketLog2;
-    *cell_index = (slot >> kBitsPerCellLog2) & (kCellsPerBucket - 1);
-    *bit_index = slot & (kBitsPerCell - 1);
+    *cell_index =
+        static_cast<int>((slot >> kBitsPerCellLog2) & (kCellsPerBucket - 1));
+    *bit_index = static_cast<int>(slot & (kBitsPerCell - 1));
   }
 
-  Bucket buckets_[kBuckets];
+  Bucket** buckets() { return reinterpret_cast<Bucket**>(this); }
+  Bucket** bucket(size_t bucket_index) { return buckets() + bucket_index; }
+
+#ifdef DEBUG
+  size_t* initial_buckets() { return reinterpret_cast<size_t*>(this) - 1; }
+  static const int kInitialBucketsSize = sizeof(size_t);
+#else
+  static const int kInitialBucketsSize = 0;
+#endif
 };
 
 STATIC_ASSERT(std::is_standard_layout<SlotSet>::value);
-STATIC_ASSERT(sizeof(SlotSet) == SlotSet::kSize);
+STATIC_ASSERT(std::is_standard_layout<SlotSet::Bucket>::value);
 
 enum SlotType {
   FULL_EMBEDDED_OBJECT_SLOT,
@@ -370,8 +619,8 @@ class V8_EXPORT_PRIVATE TypedSlots {
   void Merge(TypedSlots* other);
 
  protected:
-  using OffsetField = BitField<int, 0, 29>;
-  using TypeField = BitField<SlotType, 29, 3>;
+  using OffsetField = base::BitField<int, 0, 29>;
+  using TypeField = base::BitField<SlotType, 29, 3>;
   struct TypedSlot {
     uint32_t type_and_offset;
   };
diff --git a/deps/v8/src/heap/spaces-inl.h b/deps/v8/src/heap/spaces-inl.h
index 2feb47bec1bbf2..a73ea6fe0ce03d 100644
--- a/deps/v8/src/heap/spaces-inl.h
+++ b/deps/v8/src/heap/spaces-inl.h
@@ -5,6 +5,7 @@
 #ifndef V8_HEAP_SPACES_INL_H_
 #define V8_HEAP_SPACES_INL_H_
 
+#include "src/common/globals.h"
 #include "src/heap/spaces.h"
 
 #include "src/base/atomic-utils.h"
@@ -55,7 +56,7 @@ HeapObject SemiSpaceObjectIterator::Next() {
     }
     HeapObject object = HeapObject::FromAddress(current_);
     current_ += object.Size();
-    if (!object.IsFiller()) {
+    if (!object.IsFreeSpaceOrFiller()) {
       return object;
     }
   }
@@ -83,9 +84,11 @@ HeapObject PagedSpaceObjectIterator::FromCurrentPage() {
     const int obj_size = obj.Size();
     cur_addr_ += obj_size;
     DCHECK_LE(cur_addr_, cur_end_);
-    if (!obj.IsFiller()) {
+    if (!obj.IsFreeSpaceOrFiller()) {
       if (obj.IsCode()) {
-        DCHECK_EQ(space_, space_->heap()->code_space());
+        DCHECK_IMPLIES(
+            space_->identity() != CODE_SPACE,
+            space_->identity() == RO_SPACE && Code::cast(obj).is_builtin());
         DCHECK_CODEOBJECT_SIZE(obj_size, space_);
       } else {
         DCHECK_OBJECT_SIZE(obj_size);
@@ -161,7 +164,10 @@ bool NewSpace::ToSpaceContains(Object o) { return to_space_.Contains(o); }
 bool NewSpace::FromSpaceContains(Object o) { return from_space_.Contains(o); }
 
 bool PagedSpace::Contains(Address addr) {
-  return MemoryChunk::FromAnyPointerAddress(addr)->owner() == this;
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    return true;
+  }
+  return Page::FromAddress(addr)->owner() == this;
 }
 
 bool PagedSpace::Contains(Object o) {
@@ -201,23 +207,20 @@ bool PagedSpace::TryFreeLast(HeapObject object, int object_size) {
   return false;
 }
 
-MemoryChunk* MemoryChunk::FromAnyPointerAddress(Address addr) {
-  while (!HasHeaderSentinel(addr)) {
-    addr = BaseAddress(addr) - 1;
-  }
-  return FromAddress(addr);
-}
-
 void MemoryChunk::IncrementExternalBackingStoreBytes(
     ExternalBackingStoreType type, size_t amount) {
+#ifndef V8_ENABLE_THIRD_PARTY_HEAP
   base::CheckedIncrement(&external_backing_store_bytes_[type], amount);
   owner()->IncrementExternalBackingStoreBytes(type, amount);
+#endif
 }
 
 void MemoryChunk::DecrementExternalBackingStoreBytes(
     ExternalBackingStoreType type, size_t amount) {
+#ifndef V8_ENABLE_THIRD_PARTY_HEAP
   base::CheckedDecrement(&external_backing_store_bytes_[type], amount);
   owner()->DecrementExternalBackingStoreBytes(type, amount);
+#endif
 }
 
 void MemoryChunk::MoveExternalBackingStoreBytes(ExternalBackingStoreType type,
@@ -480,7 +483,7 @@ AllocationResult PagedSpace::AllocateRaw(int size_in_bytes,
   AllocationResult result = AllocateRawUnaligned(size_in_bytes, origin);
 #endif
   HeapObject heap_obj;
-  if (!result.IsRetry() && result.To(&heap_obj) && !is_local()) {
+  if (!result.IsRetry() && result.To(&heap_obj) && !is_local_space()) {
     AllocationStep(static_cast<int>(size_in_bytes + bytes_since_last),
                    heap_obj.address(), size_in_bytes);
     StartNextInlineAllocationStep();
diff --git a/deps/v8/src/heap/spaces.cc b/deps/v8/src/heap/spaces.cc
index 2c5d5c298da3f8..bfa568dd2945b3 100644
--- a/deps/v8/src/heap/spaces.cc
+++ b/deps/v8/src/heap/spaces.cc
@@ -4,6 +4,7 @@
 
 #include "src/heap/spaces.h"
 
+#include <algorithm>
 #include <cinttypes>
 #include <utility>
 
@@ -11,6 +12,7 @@
 #include "src/base/lsan.h"
 #include "src/base/macros.h"
 #include "src/base/platform/semaphore.h"
+#include "src/common/globals.h"
 #include "src/execution/vm-state-inl.h"
 #include "src/heap/array-buffer-tracker-inl.h"
 #include "src/heap/combined-heap.h"
@@ -47,29 +49,25 @@ STATIC_ASSERT(kClearedWeakHeapObjectLower32 < LargePage::kHeaderSize);
 // ----------------------------------------------------------------------------
 // PagedSpaceObjectIterator
 
-PagedSpaceObjectIterator::PagedSpaceObjectIterator(PagedSpace* space)
+PagedSpaceObjectIterator::PagedSpaceObjectIterator(Heap* heap,
+                                                   PagedSpace* space)
     : cur_addr_(kNullAddress),
       cur_end_(kNullAddress),
       space_(space),
       page_range_(space->first_page(), nullptr),
       current_page_(page_range_.begin()) {
-#ifdef V8_SHARED_RO_HEAP
-  DCHECK_NE(space->identity(), RO_SPACE);
-#endif
+  heap->mark_compact_collector()->EnsureSweepingCompleted();
 }
 
-PagedSpaceObjectIterator::PagedSpaceObjectIterator(Page* page)
+PagedSpaceObjectIterator::PagedSpaceObjectIterator(Heap* heap,
+                                                   PagedSpace* space,
+                                                   Page* page)
     : cur_addr_(kNullAddress),
       cur_end_(kNullAddress),
-      space_(reinterpret_cast<PagedSpace*>(page->owner())),
+      space_(space),
       page_range_(page),
       current_page_(page_range_.begin()) {
-#ifdef V8_SHARED_RO_HEAP
-  // TODO(v8:7464): Always enforce this once PagedSpace::Verify is no longer
-  // used to verify read-only space for non-shared builds.
-  DCHECK(!page->InReadOnlySpace());
-#endif  // V8_SHARED_RO_HEAP
-
+  heap->mark_compact_collector()->EnsureSweepingCompleted();
 #ifdef DEBUG
   AllocationSpace owner = page->owner_identity();
   DCHECK(owner == RO_SPACE || owner == OLD_SPACE || owner == MAP_SPACE ||
@@ -77,6 +75,13 @@ PagedSpaceObjectIterator::PagedSpaceObjectIterator(Page* page)
 #endif  // DEBUG
 }
 
+PagedSpaceObjectIterator::PagedSpaceObjectIterator(OffThreadSpace* space)
+    : cur_addr_(kNullAddress),
+      cur_end_(kNullAddress),
+      space_(space),
+      page_range_(space->first_page(), nullptr),
+      current_page_(page_range_.begin()) {}
+
 // We have hit the end of the page and should advance to the next block of
 // objects.  This happens at the end of the page.
 bool PagedSpaceObjectIterator::AdvanceToNextPage() {
@@ -84,18 +89,6 @@ bool PagedSpaceObjectIterator::AdvanceToNextPage() {
   if (current_page_ == page_range_.end()) return false;
   Page* cur_page = *(current_page_++);
 
-#ifdef ENABLE_MINOR_MC
-  Heap* heap = space_->heap();
-  heap->mark_compact_collector()->sweeper()->EnsurePageIsIterable(cur_page);
-  if (cur_page->IsFlagSet(Page::SWEEP_TO_ITERATE)) {
-    heap->minor_mark_compact_collector()->MakeIterable(
-        cur_page, MarkingTreatmentMode::CLEAR,
-        FreeSpaceTreatmentMode::IGNORE_FREE_SPACE);
-  }
-#else
-  DCHECK(!cur_page->IsFlagSet(Page::SWEEP_TO_ITERATE));
-#endif  // ENABLE_MINOR_MC
-
   cur_addr_ = cur_page->area_start();
   cur_end_ = cur_page->area_end();
   DCHECK(cur_page->SweepingDone());
@@ -192,6 +185,7 @@ void MemoryAllocator::InitializeCodePageAllocator(
                                 "CodeRange setup: allocate virtual memory");
   }
   code_range_ = reservation.region();
+  isolate_->AddCodeRange(code_range_.begin(), code_range_.size());
 
   // We are sure that we have mapped a block of requested addresses.
   DCHECK_GE(reservation.size(), requested);
@@ -692,7 +686,6 @@ MemoryChunk* MemoryChunk::Initialize(Heap* heap, Address base, size_t size,
   MemoryChunk* chunk = FromAddress(base);
   DCHECK_EQ(base, chunk->address());
   new (chunk) BasicMemoryChunk(size, area_start, area_end);
-  DCHECK(HasHeaderSentinel(area_start));
 
   chunk->heap_ = heap;
   chunk->set_owner(owner);
@@ -708,7 +701,7 @@ MemoryChunk* MemoryChunk::Initialize(Heap* heap, Address base, size_t size,
   chunk->invalidated_slots_[OLD_TO_OLD] = nullptr;
   chunk->progress_bar_ = 0;
   chunk->high_water_mark_ = static_cast<intptr_t>(area_start - base);
-  chunk->set_concurrent_sweeping_state(kSweepingDone);
+  chunk->set_concurrent_sweeping_state(ConcurrentSweepingState::kDone);
   chunk->page_protection_change_mutex_ = new base::Mutex();
   chunk->write_unprotect_counter_ = 0;
   chunk->mutex_ = new base::Mutex();
@@ -756,6 +749,8 @@ MemoryChunk* MemoryChunk::Initialize(Heap* heap, Address base, size_t size,
     chunk->code_object_registry_ = nullptr;
   }
 
+  chunk->possibly_empty_buckets_.Initialize();
+
   return chunk;
 }
 
@@ -803,15 +798,6 @@ LargePage* LargePage::Initialize(Heap* heap, MemoryChunk* chunk,
 
   MSAN_ALLOCATED_UNINITIALIZED_MEMORY(chunk->area_start(), chunk->area_size());
 
-  // Initialize the sentinel value for each page boundary since the mutator
-  // may initialize the object starting from its end.
-  Address sentinel = chunk->address() + MemoryChunk::kHeaderSentinelOffset +
-                     MemoryChunk::kPageSize;
-  while (sentinel < chunk->area_end()) {
-    *reinterpret_cast<intptr_t*>(sentinel) = kNullAddress;
-    sentinel += MemoryChunk::kPageSize;
-  }
-
   LargePage* page = static_cast<LargePage*>(chunk);
   page->SetFlag(MemoryChunk::LARGE_PAGE);
   page->list_node().Initialize();
@@ -866,16 +852,16 @@ void Page::MoveOldToNewRememberedSetForSweeping() {
 void Page::MergeOldToNewRememberedSets() {
   if (sweeping_slot_set_ == nullptr) return;
 
-  RememberedSet<OLD_TO_NEW>::Iterate(
-      this,
-      [this](MaybeObjectSlot slot) {
-        Address address = slot.address();
-        RememberedSetSweeping::Insert<AccessMode::NON_ATOMIC>(this, address);
-        return KEEP_SLOT;
-      },
-      SlotSet::KEEP_EMPTY_BUCKETS);
-
   if (slot_set_[OLD_TO_NEW]) {
+    RememberedSet<OLD_TO_NEW>::Iterate(
+        this,
+        [this](MaybeObjectSlot slot) {
+          Address address = slot.address();
+          RememberedSetSweeping::Insert<AccessMode::NON_ATOMIC>(this, address);
+          return KEEP_SLOT;
+        },
+        SlotSet::KEEP_EMPTY_BUCKETS);
+
     ReleaseSlotSet<OLD_TO_NEW>();
   }
 
@@ -1075,7 +1061,7 @@ Address SkipFillers(HeapObject filler, Address end) {
   Address addr = filler.address();
   while (addr < end) {
     filler = HeapObject::FromAddress(addr);
-    CHECK(filler.IsFiller());
+    CHECK(filler.IsFreeSpaceOrFiller());
     addr = filler.address() + filler.Size();
   }
   return addr;
@@ -1093,12 +1079,18 @@ size_t Page::ShrinkToHighWaterMark() {
   // or the area_end.
   HeapObject filler = HeapObject::FromAddress(HighWaterMark());
   if (filler.address() == area_end()) return 0;
-  CHECK(filler.IsFiller());
+  CHECK(filler.IsFreeSpaceOrFiller());
   // Ensure that no objects were allocated in [filler, area_end) region.
   DCHECK_EQ(area_end(), SkipFillers(filler, area_end()));
   // Ensure that no objects will be allocated on this page.
   DCHECK_EQ(0u, AvailableInFreeList());
 
+  // Ensure that slot sets are empty. Otherwise the buckets for the shrinked
+  // area would not be freed when deallocating this page.
+  DCHECK_NULL(slot_set<OLD_TO_NEW>());
+  DCHECK_NULL(slot_set<OLD_TO_OLD>());
+  DCHECK_NULL(sweeping_slot_set());
+
   size_t unused = RoundDown(static_cast<size_t>(area_end() - filler.address()),
                             MemoryAllocator::GetCommitPageSize());
   if (unused > 0) {
@@ -1116,7 +1108,7 @@ size_t Page::ShrinkToHighWaterMark() {
     heap()->memory_allocator()->PartialFreeMemory(
         this, address() + size() - unused, unused, area_end() - unused);
     if (filler.address() != area_end()) {
-      CHECK(filler.IsFiller());
+      CHECK(filler.IsFreeSpaceOrFiller());
       CHECK_EQ(filler.address() + filler.Size(), area_end());
     }
   }
@@ -1403,8 +1395,9 @@ void MemoryChunk::ReleaseAllocatedMemoryNeededForWritableChunk() {
     code_object_registry_ = nullptr;
   }
 
+  possibly_empty_buckets_.Release();
   ReleaseSlotSet<OLD_TO_NEW>();
-  ReleaseSlotSet(&sweeping_slot_set_);
+  ReleaseSweepingSlotSet();
   ReleaseSlotSet<OLD_TO_OLD>();
   ReleaseTypedSlotSet<OLD_TO_NEW>();
   ReleaseTypedSlotSet<OLD_TO_OLD>();
@@ -1425,12 +1418,6 @@ void MemoryChunk::ReleaseAllAllocatedMemory() {
   if (marking_bitmap_ != nullptr) ReleaseMarkingBitmap();
 }
 
-static SlotSet* AllocateAndInitializeSlotSet(size_t size, Address page_start) {
-  size_t pages = (size + Page::kPageSize - 1) / Page::kPageSize;
-  DCHECK_LT(0, pages);
-  return new SlotSet[pages];
-}
-
 template V8_EXPORT_PRIVATE SlotSet* MemoryChunk::AllocateSlotSet<OLD_TO_NEW>();
 template V8_EXPORT_PRIVATE SlotSet* MemoryChunk::AllocateSlotSet<OLD_TO_OLD>();
 
@@ -1444,11 +1431,11 @@ SlotSet* MemoryChunk::AllocateSweepingSlotSet() {
 }
 
 SlotSet* MemoryChunk::AllocateSlotSet(SlotSet** slot_set) {
-  SlotSet* new_slot_set = AllocateAndInitializeSlotSet(size(), address());
-  SlotSet* old_slot_set = base::AsAtomicPointer::Release_CompareAndSwap(
+  SlotSet* new_slot_set = SlotSet::Allocate(buckets());
+  SlotSet* old_slot_set = base::AsAtomicPointer::AcquireRelease_CompareAndSwap(
       slot_set, nullptr, new_slot_set);
   if (old_slot_set != nullptr) {
-    delete[] new_slot_set;
+    SlotSet::Delete(new_slot_set, buckets());
     new_slot_set = old_slot_set;
   }
   DCHECK(new_slot_set);
@@ -1463,9 +1450,13 @@ void MemoryChunk::ReleaseSlotSet() {
   ReleaseSlotSet(&slot_set_[type]);
 }
 
+void MemoryChunk::ReleaseSweepingSlotSet() {
+  ReleaseSlotSet(&sweeping_slot_set_);
+}
+
 void MemoryChunk::ReleaseSlotSet(SlotSet** slot_set) {
   if (*slot_set) {
-    delete[] * slot_set;
+    SlotSet::Delete(*slot_set, buckets());
     *slot_set = nullptr;
   }
 }
@@ -1546,13 +1537,15 @@ void MemoryChunk::RegisterObjectWithInvalidatedSlots(HeapObject object) {
 }
 
 void MemoryChunk::InvalidateRecordedSlots(HeapObject object) {
+  if (V8_DISABLE_WRITE_BARRIERS_BOOL) return;
   if (heap()->incremental_marking()->IsCompacting()) {
     // We cannot check slot_set_[OLD_TO_OLD] here, since the
     // concurrent markers might insert slots concurrently.
     RegisterObjectWithInvalidatedSlots<OLD_TO_OLD>(object);
   }
 
-  RegisterObjectWithInvalidatedSlots<OLD_TO_NEW>(object);
+  if (!FLAG_always_promote_young_mc || slot_set_[OLD_TO_NEW] != nullptr)
+    RegisterObjectWithInvalidatedSlots<OLD_TO_NEW>(object);
 }
 
 template bool MemoryChunk::RegisteredObjectWithInvalidatedSlots<OLD_TO_NEW>(
@@ -1623,6 +1616,19 @@ void Space::AllocationStep(int bytes_since_last, Address soon_object,
   heap()->set_allocation_step_in_progress(false);
 }
 
+void Space::AllocationStepAfterMerge(Address first_object_in_chunk, int size) {
+  if (!AllocationObserversActive()) {
+    return;
+  }
+
+  DCHECK(!heap()->allocation_step_in_progress());
+  heap()->set_allocation_step_in_progress(true);
+  for (AllocationObserver* observer : allocation_observers_) {
+    observer->AllocationStep(size, first_object_in_chunk, size);
+  }
+  heap()->set_allocation_step_in_progress(false);
+}
+
 intptr_t Space::GetNextInlineAllocationStepSize() {
   intptr_t next_step = 0;
   for (AllocationObserver* observer : allocation_observers_) {
@@ -1634,8 +1640,11 @@ intptr_t Space::GetNextInlineAllocationStepSize() {
 }
 
 PagedSpace::PagedSpace(Heap* heap, AllocationSpace space,
-                       Executability executable, FreeList* free_list)
-    : SpaceWithLinearArea(heap, space, free_list), executable_(executable) {
+                       Executability executable, FreeList* free_list,
+                       LocalSpaceKind local_space_kind)
+    : SpaceWithLinearArea(heap, space, free_list),
+      executable_(executable),
+      local_space_kind_(local_space_kind) {
   area_size_ = MemoryChunkLayout::AllocatableMemoryInMemoryChunk(space);
   accounting_stats_.Clear();
 }
@@ -1656,6 +1665,8 @@ void PagedSpace::RefillFreeList() {
       identity() != MAP_SPACE && identity() != RO_SPACE) {
     return;
   }
+  DCHECK_NE(local_space_kind(), LocalSpaceKind::kOffThreadSpace);
+  DCHECK_IMPLIES(is_local_space(), is_compaction_space());
   DCHECK(!IsDetached());
   MarkCompactCollector* collector = heap()->mark_compact_collector();
   size_t added = 0;
@@ -1671,18 +1682,17 @@ void PagedSpace::RefillFreeList() {
         });
       }
 
-      // Also merge old-to-new remembered sets outside of collections.
-      // Do not do this during GC, because of races during scavenges.
-      // One thread might iterate remembered set, while another thread merges
-      // them.
-      if (!is_local()) {
+      // Also merge old-to-new remembered sets if not scavenging because of
+      // data races: One thread might iterate remembered set, while another
+      // thread merges them.
+      if (local_space_kind() != LocalSpaceKind::kCompactionSpaceForScavenge) {
         p->MergeOldToNewRememberedSets();
       }
 
       // Only during compaction pages can actually change ownership. This is
       // safe because there exists no other competing action on the page links
       // during compaction.
-      if (is_local()) {
+      if (is_compaction_space()) {
         DCHECK_NE(this, p->owner());
         PagedSpace* owner = reinterpret_cast<PagedSpace*>(p->owner());
         base::MutexGuard guard(owner->mutex());
@@ -1696,15 +1706,22 @@ void PagedSpace::RefillFreeList() {
         added += RelinkFreeListCategories(p);
       }
       added += p->wasted_memory();
-      if (is_local() && (added > kCompactionMemoryWanted)) break;
+      if (is_compaction_space() && (added > kCompactionMemoryWanted)) break;
     }
   }
 }
 
-void PagedSpace::MergeCompactionSpace(CompactionSpace* other) {
+void OffThreadSpace::RefillFreeList() {
+  // We should never try to refill the free list in off-thread space, because
+  // we know it will always be fully linear.
+  UNREACHABLE();
+}
+
+void PagedSpace::MergeLocalSpace(LocalSpace* other) {
   base::MutexGuard guard(mutex());
 
   DCHECK(identity() == other->identity());
+
   // Unmerged fields:
   //   area_size_
   other->FreeLinearAllocationArea();
@@ -1718,24 +1735,48 @@ void PagedSpace::MergeCompactionSpace(CompactionSpace* other) {
   DCHECK_EQ(kNullAddress, other->top());
   DCHECK_EQ(kNullAddress, other->limit());
 
+  bool merging_from_off_thread = other->is_off_thread_space();
+
   // Move over pages.
   for (auto it = other->begin(); it != other->end();) {
     Page* p = *(it++);
 
-    p->MergeOldToNewRememberedSets();
+    if (merging_from_off_thread) {
+      DCHECK_NULL(p->sweeping_slot_set());
+      if (heap()->incremental_marking()->black_allocation()) {
+        p->CreateBlackArea(p->area_start(), p->HighWaterMark());
+      }
+    } else {
+      p->MergeOldToNewRememberedSets();
+    }
 
     // Relinking requires the category to be unlinked.
     other->RemovePage(p);
     AddPage(p);
+    // These code pages were allocated by the CompactionSpace.
+    if (identity() == CODE_SPACE) heap()->isolate()->AddCodeMemoryChunk(p);
     DCHECK_IMPLIES(
         !p->IsFlagSet(Page::NEVER_ALLOCATE_ON_PAGE),
         p->AvailableInFreeList() == p->AvailableInFreeListFromAllocatedBytes());
+
+    if (merging_from_off_thread) {
+      // TODO(leszeks): Allocation groups are currently not handled properly by
+      // the sampling allocation profiler. We'll have to come up with a better
+      // solution for allocation stepping before shipping.
+      AllocationStepAfterMerge(
+          p->area_start(),
+          static_cast<int>(p->HighWaterMark() - p->area_start()));
+    }
   }
+
+  if (merging_from_off_thread) {
+    heap()->NotifyOffThreadSpaceMerged();
+  }
+
   DCHECK_EQ(0u, other->Size());
   DCHECK_EQ(0u, other->Capacity());
 }
 
-
 size_t PagedSpace::CommittedPhysicalMemory() {
   if (!base::OS::HasLazyCommits()) return CommittedMemory();
   MemoryChunk::UpdateHighWaterMark(allocation_info_.top());
@@ -1848,6 +1889,10 @@ bool PagedSpace::Expand() {
   // Pages created during bootstrapping may contain immortal immovable objects.
   if (!heap()->deserialization_complete()) page->MarkNeverEvacuate();
   AddPage(page);
+  // If this is a non-compaction code space, this is a previously unseen page.
+  if (identity() == CODE_SPACE && !is_compaction_space()) {
+    heap()->isolate()->AddCodeMemoryChunk(page);
+  }
   Free(page->area_start(), page->area_size(),
        SpaceAccountingMode::kSpaceAccounted);
   heap()->NotifyOldGenerationExpansion();
@@ -1992,6 +2037,8 @@ void PagedSpace::ReleasePage(Page* page) {
     allocation_info_.Reset(kNullAddress, kNullAddress);
   }
 
+  heap()->isolate()->RemoveCodeMemoryChunk(page);
+
   AccountUncommitted(page->size());
   accounting_stats_.DecreaseCapacity(page->area_size());
   heap()->memory_allocator()->Free<MemoryAllocator::kPreFreeAndQueue>(page);
@@ -2021,8 +2068,9 @@ void PagedSpace::SetReadAndWritable() {
   }
 }
 
-std::unique_ptr<ObjectIterator> PagedSpace::GetObjectIterator() {
-  return std::unique_ptr<ObjectIterator>(new PagedSpaceObjectIterator(this));
+std::unique_ptr<ObjectIterator> PagedSpace::GetObjectIterator(Heap* heap) {
+  return std::unique_ptr<ObjectIterator>(
+      new PagedSpaceObjectIterator(heap, this));
 }
 
 bool PagedSpace::RefillLinearAllocationAreaFromFreeList(
@@ -2042,7 +2090,7 @@ bool PagedSpace::RefillLinearAllocationAreaFromFreeList(
   // if it is big enough.
   FreeLinearAllocationArea();
 
-  if (!is_local()) {
+  if (!is_local_space()) {
     heap()->StartIncrementalMarkingIfAllocationLimitIsReached(
         heap()->GCFlagsForIncrementalMarking(),
         kGCCallbackScheduleIdleGarbageCollection);
@@ -2096,7 +2144,15 @@ void PagedSpace::Verify(Isolate* isolate, ObjectVisitor* visitor) {
   }
 
   for (Page* page : *this) {
-    CHECK(page->owner() == this);
+#ifdef V8_SHARED_RO_HEAP
+    if (identity() == RO_SPACE) {
+      CHECK_NULL(page->owner());
+    } else {
+      CHECK_EQ(page->owner(), this);
+    }
+#else
+    CHECK_EQ(page->owner(), this);
+#endif
 
     for (int i = 0; i < kNumTypes; i++) {
       external_page_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
@@ -2106,7 +2162,7 @@ void PagedSpace::Verify(Isolate* isolate, ObjectVisitor* visitor) {
       allocation_pointer_found_in_space = true;
     }
     CHECK(page->SweepingDone());
-    PagedSpaceObjectIterator it(page);
+    PagedSpaceObjectIterator it(isolate->heap(), this, page);
     Address end_of_previous_object = page->area_start();
     Address top = page->area_end();
 
@@ -2160,16 +2216,17 @@ void PagedSpace::Verify(Isolate* isolate, ObjectVisitor* visitor) {
   }
   CHECK(allocation_pointer_found_in_space);
 #ifdef DEBUG
-  VerifyCountersAfterSweeping();
+  VerifyCountersAfterSweeping(isolate->heap());
 #endif
 }
 
 void PagedSpace::VerifyLiveBytes() {
+  DCHECK_NE(identity(), RO_SPACE);
   IncrementalMarking::MarkingState* marking_state =
       heap()->incremental_marking()->marking_state();
   for (Page* page : *this) {
     CHECK(page->SweepingDone());
-    PagedSpaceObjectIterator it(page);
+    PagedSpaceObjectIterator it(heap(), this, page);
     int black_size = 0;
     for (HeapObject object = it.Next(); !object.is_null(); object = it.Next()) {
       // All the interior pointers should be contained in the heap.
@@ -2183,16 +2240,16 @@ void PagedSpace::VerifyLiveBytes() {
 #endif  // VERIFY_HEAP
 
 #ifdef DEBUG
-void PagedSpace::VerifyCountersAfterSweeping() {
+void PagedSpace::VerifyCountersAfterSweeping(Heap* heap) {
   size_t total_capacity = 0;
   size_t total_allocated = 0;
   for (Page* page : *this) {
     DCHECK(page->SweepingDone());
     total_capacity += page->area_size();
-    PagedSpaceObjectIterator it(page);
+    PagedSpaceObjectIterator it(heap, this, page);
     size_t real_allocated = 0;
     for (HeapObject object = it.Next(); !object.is_null(); object = it.Next()) {
-      if (!object.IsFiller()) {
+      if (!object.IsFreeSpaceOrFiller()) {
         real_allocated += object.Size();
       }
     }
@@ -2240,8 +2297,6 @@ NewSpace::NewSpace(Heap* heap, v8::PageAllocator* page_allocator,
       to_space_(heap, kToSpace),
       from_space_(heap, kFromSpace) {
   DCHECK(initial_semispace_capacity <= max_semispace_capacity);
-  DCHECK(
-      base::bits::IsPowerOfTwo(static_cast<uint32_t>(max_semispace_capacity)));
 
   to_space_.SetUp(initial_semispace_capacity, max_semispace_capacity);
   from_space_.SetUp(initial_semispace_capacity, max_semispace_capacity);
@@ -2578,7 +2633,7 @@ void SpaceWithLinearArea::InlineAllocationStep(Address top,
   }
 }
 
-std::unique_ptr<ObjectIterator> NewSpace::GetObjectIterator() {
+std::unique_ptr<ObjectIterator> NewSpace::GetObjectIterator(Heap* heap) {
   return std::unique_ptr<ObjectIterator>(new SemiSpaceObjectIterator(this));
 }
 
@@ -2871,7 +2926,7 @@ void SemiSpace::set_age_mark(Address mark) {
   }
 }
 
-std::unique_ptr<ObjectIterator> SemiSpace::GetObjectIterator() {
+std::unique_ptr<ObjectIterator> SemiSpace::GetObjectIterator(Heap* heap) {
   // Use the NewSpace::NewObjectIterator to iterate the ToSpace.
   UNREACHABLE();
 }
@@ -3686,8 +3741,9 @@ size_t PagedSpace::SizeOfObjects() {
   return Size() - (limit() - top());
 }
 
-bool PagedSpace::SweepAndRetryAllocation(int size_in_bytes,
-                                         AllocationOrigin origin) {
+bool PagedSpace::EnsureSweptAndRetryAllocation(int size_in_bytes,
+                                               AllocationOrigin origin) {
+  DCHECK(!is_local_space());
   MarkCompactCollector* collector = heap()->mark_compact_collector();
   if (collector->sweeping_in_progress()) {
     // Wait for the sweeper threads here and complete the sweeping phase.
@@ -3700,17 +3756,6 @@ bool PagedSpace::SweepAndRetryAllocation(int size_in_bytes,
   return false;
 }
 
-bool CompactionSpace::SweepAndRetryAllocation(int size_in_bytes,
-                                              AllocationOrigin origin) {
-  MarkCompactCollector* collector = heap()->mark_compact_collector();
-  if (FLAG_concurrent_sweeping && collector->sweeping_in_progress()) {
-    collector->sweeper()->ParallelSweepSpace(identity(), 0);
-    RefillFreeList();
-    return RefillLinearAllocationAreaFromFreeList(size_in_bytes, origin);
-  }
-  return false;
-}
-
 bool PagedSpace::SlowRefillLinearAllocationArea(int size_in_bytes,
                                                 AllocationOrigin origin) {
   VMState<GC> state(heap()->isolate());
@@ -3724,8 +3769,26 @@ bool CompactionSpace::SlowRefillLinearAllocationArea(int size_in_bytes,
   return RawSlowRefillLinearAllocationArea(size_in_bytes, origin);
 }
 
+bool OffThreadSpace::SlowRefillLinearAllocationArea(int size_in_bytes,
+                                                    AllocationOrigin origin) {
+  if (RefillLinearAllocationAreaFromFreeList(size_in_bytes, origin))
+    return true;
+
+  if (Expand()) {
+    DCHECK((CountTotalPages() > 1) ||
+           (static_cast<size_t>(size_in_bytes) <= free_list_->Available()));
+    return RefillLinearAllocationAreaFromFreeList(
+        static_cast<size_t>(size_in_bytes), origin);
+  }
+
+  return false;
+}
+
 bool PagedSpace::RawSlowRefillLinearAllocationArea(int size_in_bytes,
                                                    AllocationOrigin origin) {
+  // Non-compaction local spaces are not supported.
+  DCHECK_IMPLIES(is_local_space(), is_compaction_space());
+
   // Allocation in this space has failed.
   DCHECK_GE(size_in_bytes, 0);
   const int kMaxPagesToSweep = 1;
@@ -3736,7 +3799,7 @@ bool PagedSpace::RawSlowRefillLinearAllocationArea(int size_in_bytes,
   MarkCompactCollector* collector = heap()->mark_compact_collector();
   // Sweeping is still in progress.
   if (collector->sweeping_in_progress()) {
-    if (FLAG_concurrent_sweeping && !is_local() &&
+    if (FLAG_concurrent_sweeping && !is_compaction_space() &&
         !collector->sweeper()->AreSweeperTasksRunning()) {
       collector->EnsureSweepingCompleted();
     }
@@ -3750,26 +3813,12 @@ bool PagedSpace::RawSlowRefillLinearAllocationArea(int size_in_bytes,
             static_cast<size_t>(size_in_bytes), origin))
       return true;
 
-    // Cleanup invalidated old-to-new refs for compaction space in the
-    // final atomic pause.
-    Sweeper::FreeSpaceMayContainInvalidatedSlots
-        invalidated_slots_in_free_space =
-            is_local() ? Sweeper::FreeSpaceMayContainInvalidatedSlots::kYes
-                       : Sweeper::FreeSpaceMayContainInvalidatedSlots::kNo;
-
-    // If sweeping is still in progress try to sweep pages.
-    int max_freed = collector->sweeper()->ParallelSweepSpace(
-        identity(), size_in_bytes, kMaxPagesToSweep,
-        invalidated_slots_in_free_space);
-    RefillFreeList();
-    if (max_freed >= size_in_bytes) {
-      if (RefillLinearAllocationAreaFromFreeList(
-              static_cast<size_t>(size_in_bytes), origin))
-        return true;
-    }
+    if (SweepAndRetryAllocation(size_in_bytes, kMaxPagesToSweep, size_in_bytes,
+                                origin))
+      return true;
   }
 
-  if (is_local()) {
+  if (is_compaction_space()) {
     // The main thread may have acquired all swept pages. Try to steal from
     // it. This can only happen during young generation evacuation.
     PagedSpace* main_space = heap()->paged_space(identity());
@@ -3789,10 +3838,36 @@ bool PagedSpace::RawSlowRefillLinearAllocationArea(int size_in_bytes,
         static_cast<size_t>(size_in_bytes), origin);
   }
 
-  // If sweeper threads are active, wait for them at that point and steal
-  // elements form their free-lists. Allocation may still fail their which
-  // would indicate that there is not enough memory for the given allocation.
-  return SweepAndRetryAllocation(size_in_bytes, origin);
+  if (is_compaction_space()) {
+    return SweepAndRetryAllocation(0, 0, size_in_bytes, origin);
+
+  } else {
+    // If sweeper threads are active, wait for them at that point and steal
+    // elements from their free-lists. Allocation may still fail here which
+    // would indicate that there is not enough memory for the given allocation.
+    return EnsureSweptAndRetryAllocation(size_in_bytes, origin);
+  }
+}
+
+bool PagedSpace::SweepAndRetryAllocation(int required_freed_bytes,
+                                         int max_pages, int size_in_bytes,
+                                         AllocationOrigin origin) {
+  // Cleanup invalidated old-to-new refs for compaction space in the
+  // final atomic pause.
+  Sweeper::FreeSpaceMayContainInvalidatedSlots invalidated_slots_in_free_space =
+      is_compaction_space() ? Sweeper::FreeSpaceMayContainInvalidatedSlots::kYes
+                            : Sweeper::FreeSpaceMayContainInvalidatedSlots::kNo;
+
+  MarkCompactCollector* collector = heap()->mark_compact_collector();
+  if (collector->sweeping_in_progress()) {
+    int max_freed = collector->sweeper()->ParallelSweepSpace(
+        identity(), required_freed_bytes, max_pages,
+        invalidated_slots_in_free_space);
+    RefillFreeList();
+    if (max_freed >= size_in_bytes)
+      return RefillLinearAllocationAreaFromFreeList(size_in_bytes, origin);
+  }
+  return false;
 }
 
 // -----------------------------------------------------------------------------
@@ -3886,7 +3961,7 @@ void ReadOnlySpace::RepairFreeListsAfterDeserialization() {
     if (start < end - size) {
       // A region at the high watermark is already in free list.
       HeapObject filler = HeapObject::FromAddress(start);
-      CHECK(filler.IsFiller());
+      CHECK(filler.IsFreeSpaceOrFiller());
       start += filler.Size();
     }
     CHECK_EQ(size, static_cast<int>(end - start));
@@ -3895,6 +3970,10 @@ void ReadOnlySpace::RepairFreeListsAfterDeserialization() {
 }
 
 void ReadOnlySpace::ClearStringPaddingIfNeeded() {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    // TODO(ulan): Revisit this once third-party heap supports iteration.
+    return;
+  }
   if (is_string_padding_cleared_) return;
 
   ReadOnlyHeapObjectIterator iterator(this);
@@ -3972,10 +4051,7 @@ HeapObject LargeObjectSpaceObjectIterator::Next() {
 }
 
 // -----------------------------------------------------------------------------
-// LargeObjectSpace
-
-LargeObjectSpace::LargeObjectSpace(Heap* heap)
-    : LargeObjectSpace(heap, LO_SPACE) {}
+// OldLargeObjectSpace
 
 LargeObjectSpace::LargeObjectSpace(Heap* heap, AllocationSpace id)
     : Space(heap, id, new NoFreeList()),
@@ -3994,12 +4070,12 @@ void LargeObjectSpace::TearDown() {
   }
 }
 
-AllocationResult LargeObjectSpace::AllocateRaw(int object_size) {
+AllocationResult OldLargeObjectSpace::AllocateRaw(int object_size) {
   return AllocateRaw(object_size, NOT_EXECUTABLE);
 }
 
-AllocationResult LargeObjectSpace::AllocateRaw(int object_size,
-                                               Executability executable) {
+AllocationResult OldLargeObjectSpace::AllocateRaw(int object_size,
+                                                  Executability executable) {
   // Check if we want to force a GC before growing the old space further.
   // If so, fail the allocation.
   if (!heap()->CanExpandOldGeneration(object_size) ||
@@ -4042,7 +4118,6 @@ LargePage* LargeObjectSpace::AllocateLargePage(int object_size,
   return page;
 }
 
-
 size_t LargeObjectSpace::CommittedPhysicalMemory() {
   // On a platform that provides lazy committing of memory, we over-account
   // the actually committed memory. There is no easy way right now to support
@@ -4061,7 +4136,7 @@ LargePage* CodeLargeObjectSpace::FindPage(Address a) {
   return nullptr;
 }
 
-void LargeObjectSpace::ClearMarkingStateOfLiveObjects() {
+void OldLargeObjectSpace::ClearMarkingStateOfLiveObjects() {
   IncrementalMarking::NonAtomicMarkingState* marking_state =
       heap()->incremental_marking()->non_atomic_marking_state();
   LargeObjectSpaceObjectIterator it(this);
@@ -4093,17 +4168,16 @@ void CodeLargeObjectSpace::RemoveChunkMapEntries(LargePage* page) {
   }
 }
 
-void LargeObjectSpace::PromoteNewLargeObject(LargePage* page) {
+void OldLargeObjectSpace::PromoteNewLargeObject(LargePage* page) {
   DCHECK_EQ(page->owner_identity(), NEW_LO_SPACE);
   DCHECK(page->IsLargePage());
   DCHECK(page->IsFlagSet(MemoryChunk::FROM_PAGE));
   DCHECK(!page->IsFlagSet(MemoryChunk::TO_PAGE));
   size_t object_size = static_cast<size_t>(page->GetObject().Size());
   static_cast<LargeObjectSpace*>(page->owner())->RemovePage(page, object_size);
-  AddPage(page, object_size);
   page->ClearFlag(MemoryChunk::FROM_PAGE);
   page->SetOldGenerationPageFlags(heap()->incremental_marking()->IsMarking());
-  page->set_owner(this);
+  AddPage(page, object_size);
 }
 
 void LargeObjectSpace::AddPage(LargePage* page, size_t object_size) {
@@ -4112,6 +4186,7 @@ void LargeObjectSpace::AddPage(LargePage* page, size_t object_size) {
   objects_size_ += object_size;
   page_count_++;
   memory_chunk_list_.PushBack(page);
+  page->set_owner(this);
 }
 
 void LargeObjectSpace::RemovePage(LargePage* page, size_t object_size) {
@@ -4120,6 +4195,7 @@ void LargeObjectSpace::RemovePage(LargePage* page, size_t object_size) {
   objects_size_ -= object_size;
   page_count_--;
   memory_chunk_list_.Remove(page);
+  page->set_owner(nullptr);
 }
 
 void LargeObjectSpace::FreeUnmarkedObjects() {
@@ -4176,7 +4252,8 @@ bool LargeObjectSpace::ContainsSlow(Address addr) {
   return false;
 }
 
-std::unique_ptr<ObjectIterator> LargeObjectSpace::GetObjectIterator() {
+std::unique_ptr<ObjectIterator> LargeObjectSpace::GetObjectIterator(
+    Heap* heap) {
   return std::unique_ptr<ObjectIterator>(
       new LargeObjectSpaceObjectIterator(this));
 }
@@ -4272,31 +4349,36 @@ void LargeObjectSpace::Print() {
     obj.Print(os);
   }
 }
+#endif  // DEBUG
+
+OldLargeObjectSpace::OldLargeObjectSpace(Heap* heap)
+    : LargeObjectSpace(heap, LO_SPACE) {}
+
+OldLargeObjectSpace::OldLargeObjectSpace(Heap* heap, AllocationSpace id)
+    : LargeObjectSpace(heap, id) {}
+
+void OldLargeObjectSpace::MergeOffThreadSpace(
+    OffThreadLargeObjectSpace* other) {
+  DCHECK(identity() == other->identity());
 
-void Page::Print() {
-  // Make a best-effort to print the objects in the page.
-  PrintF("Page@%p in %s\n", reinterpret_cast<void*>(this->address()),
-         Heap::GetSpaceName(this->owner_identity()));
-  PrintF(" --------------------------------------\n");
-  PagedSpaceObjectIterator objects(this);
-  unsigned mark_size = 0;
-  for (HeapObject object = objects.Next(); !object.is_null();
-       object = objects.Next()) {
-    bool is_marked =
-        heap()->incremental_marking()->marking_state()->IsBlackOrGrey(object);
-    PrintF(" %c ", (is_marked ? '!' : ' '));  // Indent a little.
-    if (is_marked) {
-      mark_size += object.Size();
+  while (!other->memory_chunk_list().Empty()) {
+    LargePage* page = other->first_page();
+    HeapObject object = page->GetObject();
+    int size = object.Size();
+    other->RemovePage(page, size);
+    AddPage(page, size);
+
+    AllocationStepAfterMerge(object.address(), size);
+    if (heap()->incremental_marking()->black_allocation()) {
+      heap()->incremental_marking()->marking_state()->WhiteToBlack(object);
     }
-    object.ShortPrint();
-    PrintF("\n");
+    DCHECK_IMPLIES(
+        heap()->incremental_marking()->black_allocation(),
+        heap()->incremental_marking()->marking_state()->IsBlack(object));
   }
-  PrintF(" --------------------------------------\n");
-  PrintF(" Marked: %x, LiveCount: %" V8PRIdPTR "\n", mark_size,
-         heap()->incremental_marking()->marking_state()->live_bytes(this));
-}
 
-#endif  // DEBUG
+  heap()->NotifyOffThreadSpaceMerged();
+}
 
 NewLargeObjectSpace::NewLargeObjectSpace(Heap* heap, size_t capacity)
     : LargeObjectSpace(heap, NEW_LO_SPACE),
@@ -4385,21 +4467,38 @@ void NewLargeObjectSpace::SetCapacity(size_t capacity) {
 }
 
 CodeLargeObjectSpace::CodeLargeObjectSpace(Heap* heap)
-    : LargeObjectSpace(heap, CODE_LO_SPACE),
+    : OldLargeObjectSpace(heap, CODE_LO_SPACE),
       chunk_map_(kInitialChunkMapCapacity) {}
 
 AllocationResult CodeLargeObjectSpace::AllocateRaw(int object_size) {
-  return LargeObjectSpace::AllocateRaw(object_size, EXECUTABLE);
+  return OldLargeObjectSpace::AllocateRaw(object_size, EXECUTABLE);
 }
 
 void CodeLargeObjectSpace::AddPage(LargePage* page, size_t object_size) {
-  LargeObjectSpace::AddPage(page, object_size);
+  OldLargeObjectSpace::AddPage(page, object_size);
   InsertChunkMapEntries(page);
+  heap()->isolate()->AddCodeMemoryChunk(page);
 }
 
 void CodeLargeObjectSpace::RemovePage(LargePage* page, size_t object_size) {
   RemoveChunkMapEntries(page);
-  LargeObjectSpace::RemovePage(page, object_size);
+  heap()->isolate()->RemoveCodeMemoryChunk(page);
+  OldLargeObjectSpace::RemovePage(page, object_size);
+}
+
+OffThreadLargeObjectSpace::OffThreadLargeObjectSpace(Heap* heap)
+    : LargeObjectSpace(heap, LO_SPACE) {}
+
+AllocationResult OffThreadLargeObjectSpace::AllocateRaw(int object_size) {
+  LargePage* page = AllocateLargePage(object_size, NOT_EXECUTABLE);
+  if (page == nullptr) return AllocationResult::Retry(identity());
+
+  return page->GetObject();
+}
+
+void OffThreadLargeObjectSpace::FreeUnmarkedObjects() {
+  // We should never try to free objects in this space.
+  UNREACHABLE();
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/spaces.h b/deps/v8/src/heap/spaces.h
index 5ec281ee074aee..9d0de53f829d3c 100644
--- a/deps/v8/src/heap/spaces.h
+++ b/deps/v8/src/heap/spaces.h
@@ -17,6 +17,7 @@
 #include "src/base/export-template.h"
 #include "src/base/iterator.h"
 #include "src/base/list.h"
+#include "src/base/macros.h"
 #include "src/base/platform/mutex.h"
 #include "src/common/globals.h"
 #include "src/flags/flags.h"
@@ -24,6 +25,7 @@
 #include "src/heap/heap.h"
 #include "src/heap/invalidated-slots.h"
 #include "src/heap/marking.h"
+#include "src/heap/slot-set.h"
 #include "src/objects/free-space.h"
 #include "src/objects/heap-object.h"
 #include "src/objects/map.h"
@@ -46,11 +48,14 @@ class CompactionSpace;
 class CompactionSpaceCollection;
 class FreeList;
 class Isolate;
+class LargeObjectSpace;
 class LinearAllocationArea;
 class LocalArrayBufferTracker;
+class LocalSpace;
 class MemoryAllocator;
 class MemoryChunk;
 class MemoryChunkLayout;
+class OffThreadSpace;
 class Page;
 class PagedSpace;
 class SemiSpace;
@@ -426,6 +431,11 @@ class V8_EXPORT_PRIVATE Space : public Malloced {
 
   void AllocationStep(int bytes_since_last, Address soon_object, int size);
 
+  // An AllocationStep equivalent to be called after merging a contiguous
+  // chunk of an off-thread space into this space. The chunk is treated as a
+  // single allocation-folding group.
+  void AllocationStepAfterMerge(Address first_object_in_chunk, int size);
+
   // Return the total amount committed memory for this space, i.e., allocatable
   // memory and page headers.
   virtual size_t CommittedMemory() { return committed_; }
@@ -436,7 +446,7 @@ class V8_EXPORT_PRIVATE Space : public Malloced {
   virtual size_t Size() = 0;
 
   // Returns size of objects. Can differ from the allocated size
-  // (e.g. see LargeObjectSpace).
+  // (e.g. see OldLargeObjectSpace).
   virtual size_t SizeOfObjects() { return Size(); }
 
   // Approximate amount of physical memory committed for this space.
@@ -453,7 +463,7 @@ class V8_EXPORT_PRIVATE Space : public Malloced {
     }
   }
 
-  virtual std::unique_ptr<ObjectIterator> GetObjectIterator() = 0;
+  virtual std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) = 0;
 
   void AccountCommitted(size_t bytes) {
     DCHECK_GE(committed_ + bytes, committed_);
@@ -583,15 +593,15 @@ class MemoryChunk : public BasicMemoryChunk {
   static const Flags kSkipEvacuationSlotsRecordingMask =
       kEvacuationCandidateMask | kIsInYoungGenerationMask;
 
-  // |kSweepingDone|: The page state when sweeping is complete or sweeping must
-  //   not be performed on that page. Sweeper threads that are done with their
-  //   work will set this value and not touch the page anymore.
-  // |kSweepingPending|: This page is ready for parallel sweeping.
-  // |kSweepingInProgress|: This page is currently swept by a sweeper thread.
-  enum ConcurrentSweepingState {
-    kSweepingDone,
-    kSweepingPending,
-    kSweepingInProgress,
+  // |kDone|: The page state when sweeping is complete or sweeping must not be
+  //   performed on that page. Sweeper threads that are done with their work
+  //   will set this value and not touch the page anymore.
+  // |kPending|: This page is ready for parallel sweeping.
+  // |kInProgress|: This page is currently swept by a sweeper thread.
+  enum class ConcurrentSweepingState : intptr_t {
+    kDone,
+    kPending,
+    kInProgress,
   };
 
   static const size_t kHeaderSize =
@@ -600,7 +610,7 @@ class MemoryChunk : public BasicMemoryChunk {
       + kSystemPointerSize           // Address owner_
       + kSizetSize                   // size_t progress_bar_
       + kIntptrSize                  // intptr_t live_byte_count_
-      + kSystemPointerSize  // SlotSet* sweeping_slot_set_
+      + kSystemPointerSize           // SlotSet* sweeping_slot_set_
       + kSystemPointerSize *
             NUMBER_OF_REMEMBERED_SET_TYPES  // TypedSlotSet* array
       + kSystemPointerSize *
@@ -620,7 +630,8 @@ class MemoryChunk : public BasicMemoryChunk {
       + kSystemPointerSize      // LocalArrayBufferTracker* local_tracker_
       + kIntptrSize  // std::atomic<intptr_t> young_generation_live_byte_count_
       + kSystemPointerSize   // Bitmap* young_generation_bitmap_
-      + kSystemPointerSize;  // CodeObjectRegistry* code_object_registry_
+      + kSystemPointerSize   // CodeObjectRegistry* code_object_registry_
+      + kSystemPointerSize;  // PossiblyEmptyBuckets possibly_empty_buckets_
 
   // Page size in bytes.  This must be a multiple of the OS page size.
   static const int kPageSize = 1 << kPageSizeBits;
@@ -640,8 +651,6 @@ class MemoryChunk : public BasicMemoryChunk {
   void SetOldGenerationPageFlags(bool is_marking);
   void SetYoungGenerationPageFlags(bool is_marking);
 
-  static inline MemoryChunk* FromAnyPointerAddress(Address addr);
-
   static inline void UpdateHighWaterMark(Address mark) {
     if (mark == kNullAddress) return;
     // Need to subtract one from the mark because when a chunk is full the
@@ -673,7 +682,9 @@ class MemoryChunk : public BasicMemoryChunk {
     return static_cast<ConcurrentSweepingState>(concurrent_sweeping_.load());
   }
 
-  bool SweepingDone() { return concurrent_sweeping_ == kSweepingDone; }
+  bool SweepingDone() {
+    return concurrent_sweeping_ == ConcurrentSweepingState::kDone;
+  }
 
   inline Heap* heap() const {
     DCHECK_NOT_NULL(heap_);
@@ -723,6 +734,7 @@ class MemoryChunk : public BasicMemoryChunk {
   template <RememberedSetType type>
   void ReleaseSlotSet();
   void ReleaseSlotSet(SlotSet** slot_set);
+  void ReleaseSweepingSlotSet();
   template <RememberedSetType type>
   TypedSlotSet* AllocateTypedSlotSet();
   // Not safe to be called concurrently.
@@ -792,7 +804,6 @@ class MemoryChunk : public BasicMemoryChunk {
     return this->address() + (index << kTaggedSizeLog2);
   }
 
-
   bool NeverEvacuate() { return IsFlagSet(NEVER_EVACUATE); }
 
   void MarkNeverEvacuate() { SetFlag(NEVER_EVACUATE); }
@@ -869,6 +880,10 @@ class MemoryChunk : public BasicMemoryChunk {
 
   FreeList* free_list() { return owner()->free_list(); }
 
+  PossiblyEmptyBuckets* possibly_empty_buckets() {
+    return &possibly_empty_buckets_;
+  }
+
  protected:
   static MemoryChunk* Initialize(Heap* heap, Address base, size_t size,
                                  Address area_start, Address area_end,
@@ -925,7 +940,7 @@ class MemoryChunk : public BasicMemoryChunk {
 
   base::Mutex* mutex_;
 
-  std::atomic<intptr_t> concurrent_sweeping_;
+  std::atomic<ConcurrentSweepingState> concurrent_sweeping_;
 
   base::Mutex* page_protection_change_mutex_;
 
@@ -964,11 +979,13 @@ class MemoryChunk : public BasicMemoryChunk {
 
   CodeObjectRegistry* code_object_registry_;
 
+  PossiblyEmptyBuckets possibly_empty_buckets_;
+
  private:
   void InitializeReservedMemory() { reservation_.Reset(); }
 
   friend class ConcurrentMarkingState;
-  friend class IncrementalMarkingState;
+  friend class MajorMarkingState;
   friend class MajorAtomicMarkingState;
   friend class MajorNonAtomicMarkingState;
   friend class MemoryAllocator;
@@ -1050,15 +1067,6 @@ class Page : public MemoryChunk {
     return address_in_page;
   }
 
-  // WaitUntilSweepingCompleted only works when concurrent sweeping is in
-  // progress. In particular, when we know that right before this call a
-  // sweeper thread was sweeping this page.
-  void WaitUntilSweepingCompleted() {
-    mutex_->Lock();
-    mutex_->Unlock();
-    DCHECK(SweepingDone());
-  }
-
   void AllocateLocalTracker();
   inline LocalArrayBufferTracker* local_tracker() { return local_tracker_; }
   bool contains_array_buffers();
@@ -1101,10 +1109,6 @@ class Page : public MemoryChunk {
   void MoveOldToNewRememberedSetForSweeping();
   void MergeOldToNewRememberedSets();
 
-#ifdef DEBUG
-  void Print();
-#endif  // DEBUG
-
  private:
   friend class MemoryAllocator;
 };
@@ -1619,8 +1623,11 @@ class PageRange {
 class V8_EXPORT_PRIVATE PagedSpaceObjectIterator : public ObjectIterator {
  public:
   // Creates a new object iterator in a given space.
-  explicit PagedSpaceObjectIterator(PagedSpace* space);
-  explicit PagedSpaceObjectIterator(Page* page);
+  PagedSpaceObjectIterator(Heap* heap, PagedSpace* space);
+  PagedSpaceObjectIterator(Heap* heap, PagedSpace* space, Page* page);
+
+  // Creates a new object iterator in a given off-thread space.
+  explicit PagedSpaceObjectIterator(OffThreadSpace* space);
 
   // Advance to the next object, skipping free spaces and other fillers and
   // skipping the special garbage section of which there is one per space.
@@ -1691,7 +1698,6 @@ class LinearAllocationArea {
   Address limit_;
 };
 
-
 // An abstraction of the accounting statistics of a page-structured space.
 //
 // The stats are only set by functions that ensure they stay balanced. These
@@ -1773,7 +1779,6 @@ class AllocationStats {
 #endif
 };
 
-
 // The free list is organized in categories as follows:
 // kMinBlockSize-10 words (tiniest): The tiniest blocks are only used for
 //   allocation, when categories >= small do not have entries anymore.
@@ -2285,7 +2290,8 @@ class V8_EXPORT_PRIVATE PagedSpace
 
   // Creates a space with an id.
   PagedSpace(Heap* heap, AllocationSpace id, Executability executable,
-             FreeList* free_list);
+             FreeList* free_list,
+             LocalSpaceKind local_space_kind = LocalSpaceKind::kNone);
 
   ~PagedSpace() override { TearDown(); }
 
@@ -2443,7 +2449,7 @@ class V8_EXPORT_PRIVATE PagedSpace
 #endif
 
 #ifdef DEBUG
-  void VerifyCountersAfterSweeping();
+  void VerifyCountersAfterSweeping(Heap* heap);
   void VerifyCountersBeforeConcurrentSweeping();
   // Print meta info and objects in this space.
   void Print() override;
@@ -2461,11 +2467,23 @@ class V8_EXPORT_PRIVATE PagedSpace
   // Return size of allocatable area on a page in this space.
   inline int AreaSize() { return static_cast<int>(area_size_); }
 
-  virtual bool is_local() { return false; }
+  bool is_local_space() { return local_space_kind_ != LocalSpaceKind::kNone; }
+
+  bool is_off_thread_space() {
+    return local_space_kind_ == LocalSpaceKind::kOffThreadSpace;
+  }
+
+  bool is_compaction_space() {
+    return base::IsInRange(local_space_kind_,
+                           LocalSpaceKind::kFirstCompactionSpace,
+                           LocalSpaceKind::kLastCompactionSpace);
+  }
+
+  LocalSpaceKind local_space_kind() { return local_space_kind_; }
 
   // Merges {other} into the current space. Note that this modifies {other},
   // e.g., removes its bump pointer area and resets statistics.
-  void MergeCompactionSpace(CompactionSpace* other);
+  void MergeLocalSpace(LocalSpace* other);
 
   // Refills the free list from the corresponding free list filled by the
   // sweeper.
@@ -2487,7 +2505,7 @@ class V8_EXPORT_PRIVATE PagedSpace
 
   size_t ShrinkPageToHighWaterMark(Page* page);
 
-  std::unique_ptr<ObjectIterator> GetObjectIterator() override;
+  std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) override;
 
   void SetLinearAllocationArea(Address top, Address limit);
 
@@ -2502,7 +2520,7 @@ class V8_EXPORT_PRIVATE PagedSpace
   void DecreaseLimit(Address new_limit);
   void UpdateInlineAllocationLimit(size_t min_size) override;
   bool SupportsInlineAllocation() override {
-    return identity() == OLD_SPACE && !is_local();
+    return identity() == OLD_SPACE && !is_local_space();
   }
 
  protected:
@@ -2543,9 +2561,14 @@ class V8_EXPORT_PRIVATE PagedSpace
   // not successful, wait for the sweeper threads and retry free-list
   // allocation. Returns false if there is not enough space and the caller
   // has to retry after collecting garbage.
-  V8_WARN_UNUSED_RESULT virtual bool SweepAndRetryAllocation(
+  V8_WARN_UNUSED_RESULT bool EnsureSweptAndRetryAllocation(
       int size_in_bytes, AllocationOrigin origin);
 
+  V8_WARN_UNUSED_RESULT bool SweepAndRetryAllocation(int required_freed_bytes,
+                                                     int max_pages,
+                                                     int size_in_bytes,
+                                                     AllocationOrigin origin);
+
   // Slow path of AllocateRaw. This function is space-dependent. Returns false
   // if there is not enough space and the caller has to retry after
   // collecting garbage.
@@ -2559,6 +2582,8 @@ class V8_EXPORT_PRIVATE PagedSpace
 
   Executability executable_;
 
+  LocalSpaceKind local_space_kind_;
+
   size_t area_size_;
 
   // Accounting information for this space.
@@ -2681,15 +2706,11 @@ class SemiSpace : public Space {
   // If we don't have these here then SemiSpace will be abstract.  However
   // they should never be called:
 
-  size_t Size() override {
-    UNREACHABLE();
-  }
+  size_t Size() override { UNREACHABLE(); }
 
   size_t SizeOfObjects() override { return Size(); }
 
-  size_t Available() override {
-    UNREACHABLE();
-  }
+  size_t Available() override { UNREACHABLE(); }
 
   Page* first_page() { return reinterpret_cast<Page*>(Space::first_page()); }
   Page* last_page() { return reinterpret_cast<Page*>(Space::last_page()); }
@@ -2697,7 +2718,7 @@ class SemiSpace : public Space {
   iterator begin() { return iterator(first_page()); }
   iterator end() { return iterator(nullptr); }
 
-  std::unique_ptr<ObjectIterator> GetObjectIterator() override;
+  std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) override;
 
 #ifdef DEBUG
   V8_EXPORT_PRIVATE void Print() override;
@@ -3000,7 +3021,7 @@ class V8_EXPORT_PRIVATE NewSpace
   iterator begin() { return to_space_.begin(); }
   iterator end() { return to_space_.end(); }
 
-  std::unique_ptr<ObjectIterator> GetObjectIterator() override;
+  std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) override;
 
   SemiSpace& from_space() { return from_space_; }
   SemiSpace& to_space() { return to_space_; }
@@ -3038,22 +3059,34 @@ class V8_EXPORT_PRIVATE PauseAllocationObserversScope {
 };
 
 // -----------------------------------------------------------------------------
-// Compaction space that is used temporarily during compaction.
+// Base class for compaction space and off-thread space.
 
-class V8_EXPORT_PRIVATE CompactionSpace : public PagedSpace {
+class V8_EXPORT_PRIVATE LocalSpace : public PagedSpace {
  public:
-  CompactionSpace(Heap* heap, AllocationSpace id, Executability executable)
-      : PagedSpace(heap, id, executable, FreeList::CreateFreeList()) {}
-
-  bool is_local() override { return true; }
+  LocalSpace(Heap* heap, AllocationSpace id, Executability executable,
+             LocalSpaceKind local_space_kind)
+      : PagedSpace(heap, id, executable, FreeList::CreateFreeList(),
+                   local_space_kind) {
+    DCHECK_NE(local_space_kind, LocalSpaceKind::kNone);
+  }
 
  protected:
   // The space is temporary and not included in any snapshots.
   bool snapshotable() override { return false; }
+};
 
-  V8_WARN_UNUSED_RESULT bool SweepAndRetryAllocation(
-      int size_in_bytes, AllocationOrigin origin) override;
+// -----------------------------------------------------------------------------
+// Compaction space that is used temporarily during compaction.
+
+class V8_EXPORT_PRIVATE CompactionSpace : public LocalSpace {
+ public:
+  CompactionSpace(Heap* heap, AllocationSpace id, Executability executable,
+                  LocalSpaceKind local_space_kind)
+      : LocalSpace(heap, id, executable, local_space_kind) {
+    DCHECK(is_compaction_space());
+  }
 
+ protected:
   V8_WARN_UNUSED_RESULT bool SlowRefillLinearAllocationArea(
       int size_in_bytes, AllocationOrigin origin) override;
 };
@@ -3061,9 +3094,12 @@ class V8_EXPORT_PRIVATE CompactionSpace : public PagedSpace {
 // A collection of |CompactionSpace|s used by a single compaction task.
 class CompactionSpaceCollection : public Malloced {
  public:
-  explicit CompactionSpaceCollection(Heap* heap)
-      : old_space_(heap, OLD_SPACE, Executability::NOT_EXECUTABLE),
-        code_space_(heap, CODE_SPACE, Executability::EXECUTABLE) {}
+  explicit CompactionSpaceCollection(Heap* heap,
+                                     LocalSpaceKind local_space_kind)
+      : old_space_(heap, OLD_SPACE, Executability::NOT_EXECUTABLE,
+                   local_space_kind),
+        code_space_(heap, CODE_SPACE, Executability::EXECUTABLE,
+                    local_space_kind) {}
 
   CompactionSpace* Get(AllocationSpace space) {
     switch (space) {
@@ -3117,7 +3153,6 @@ class CodeSpace : public PagedSpace {
               (info).top() <= (space).page_high() &&  \
               (info).limit() <= (space).page_high())
 
-
 // -----------------------------------------------------------------------------
 // Old space for all map objects
 
@@ -3142,6 +3177,22 @@ class MapSpace : public PagedSpace {
 #endif
 };
 
+// -----------------------------------------------------------------------------
+// Off-thread space that is used for folded allocation on a different thread.
+
+class V8_EXPORT_PRIVATE OffThreadSpace : public LocalSpace {
+ public:
+  explicit OffThreadSpace(Heap* heap)
+      : LocalSpace(heap, OLD_SPACE, NOT_EXECUTABLE,
+                   LocalSpaceKind::kOffThreadSpace) {}
+
+ protected:
+  V8_WARN_UNUSED_RESULT bool SlowRefillLinearAllocationArea(
+      int size_in_bytes, AllocationOrigin origin) override;
+
+  void RefillFreeList() override;
+};
+
 // -----------------------------------------------------------------------------
 // Read Only space for all Immortal Immovable and Immutable objects
 
@@ -3194,21 +3245,15 @@ class ReadOnlySpace : public PagedSpace {
 // managed by the large object space.
 // Large objects do not move during garbage collections.
 
-class LargeObjectSpace : public Space {
+class V8_EXPORT_PRIVATE LargeObjectSpace : public Space {
  public:
   using iterator = LargePageIterator;
 
-  explicit LargeObjectSpace(Heap* heap);
-  LargeObjectSpace(Heap* heap, AllocationSpace id);
-
   ~LargeObjectSpace() override { TearDown(); }
 
   // Releases internal resources, frees objects in this space.
   void TearDown();
 
-  V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT AllocationResult
-  AllocateRaw(int object_size);
-
   // Available bytes for objects in this space.
   size_t Available() override;
 
@@ -3220,16 +3265,11 @@ class LargeObjectSpace : public Space {
 
   int PageCount() { return page_count_; }
 
-  // Clears the marking state of live objects.
-  void ClearMarkingStateOfLiveObjects();
-
   // Frees unmarked objects.
-  void FreeUnmarkedObjects();
-
-  void PromoteNewLargeObject(LargePage* page);
+  virtual void FreeUnmarkedObjects();
 
   // Checks whether a heap object is in this space; O(1).
-  V8_EXPORT_PRIVATE bool Contains(HeapObject obj);
+  bool Contains(HeapObject obj);
   // Checks whether an address is in the object area in this space. Iterates
   // all objects in the space. May be slow.
   bool ContainsSlow(Address addr);
@@ -3244,13 +3284,10 @@ class LargeObjectSpace : public Space {
     return reinterpret_cast<LargePage*>(Space::first_page());
   }
 
-  // Collect code statistics.
-  void CollectCodeStatistics();
-
   iterator begin() { return iterator(first_page()); }
   iterator end() { return iterator(nullptr); }
 
-  std::unique_ptr<ObjectIterator> GetObjectIterator() override;
+  std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) override;
 
 #ifdef VERIFY_HEAP
   virtual void Verify(Isolate* isolate);
@@ -3261,9 +3298,9 @@ class LargeObjectSpace : public Space {
 #endif
 
  protected:
+  LargeObjectSpace(Heap* heap, AllocationSpace id);
+
   LargePage* AllocateLargePage(int object_size, Executability executable);
-  V8_WARN_UNUSED_RESULT AllocationResult AllocateRaw(int object_size,
-                                                     Executability executable);
 
   size_t size_;          // allocated bytes
   int page_count_;       // number of chunks
@@ -3273,6 +3310,28 @@ class LargeObjectSpace : public Space {
   friend class LargeObjectSpaceObjectIterator;
 };
 
+class OffThreadLargeObjectSpace;
+
+class OldLargeObjectSpace : public LargeObjectSpace {
+ public:
+  explicit OldLargeObjectSpace(Heap* heap);
+
+  V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT AllocationResult
+  AllocateRaw(int object_size);
+
+  // Clears the marking state of live objects.
+  void ClearMarkingStateOfLiveObjects();
+
+  void PromoteNewLargeObject(LargePage* page);
+
+  V8_EXPORT_PRIVATE void MergeOffThreadSpace(OffThreadLargeObjectSpace* other);
+
+ protected:
+  explicit OldLargeObjectSpace(Heap* heap, AllocationSpace id);
+  V8_WARN_UNUSED_RESULT AllocationResult AllocateRaw(int object_size,
+                                                     Executability executable);
+};
+
 class NewLargeObjectSpace : public LargeObjectSpace {
  public:
   NewLargeObjectSpace(Heap* heap, size_t capacity);
@@ -3302,7 +3361,7 @@ class NewLargeObjectSpace : public LargeObjectSpace {
   size_t capacity_;
 };
 
-class CodeLargeObjectSpace : public LargeObjectSpace {
+class CodeLargeObjectSpace : public OldLargeObjectSpace {
  public:
   explicit CodeLargeObjectSpace(Heap* heap);
 
@@ -3326,6 +3385,22 @@ class CodeLargeObjectSpace : public LargeObjectSpace {
   std::unordered_map<Address, LargePage*> chunk_map_;
 };
 
+class V8_EXPORT_PRIVATE OffThreadLargeObjectSpace : public LargeObjectSpace {
+ public:
+  explicit OffThreadLargeObjectSpace(Heap* heap);
+
+  V8_WARN_UNUSED_RESULT AllocationResult AllocateRaw(int object_size);
+
+  void FreeUnmarkedObjects() override;
+
+ protected:
+  // OldLargeObjectSpace can mess with OffThreadLargeObjectSpace during merging.
+  friend class OldLargeObjectSpace;
+
+  V8_WARN_UNUSED_RESULT AllocationResult AllocateRaw(int object_size,
+                                                     Executability executable);
+};
+
 class LargeObjectSpaceObjectIterator : public ObjectIterator {
  public:
   explicit LargeObjectSpaceObjectIterator(LargeObjectSpace* space);
diff --git a/deps/v8/src/heap/sweeper.cc b/deps/v8/src/heap/sweeper.cc
index 11be77548567b7..67062503d3ebb0 100644
--- a/deps/v8/src/heap/sweeper.cc
+++ b/deps/v8/src/heap/sweeper.cc
@@ -191,18 +191,6 @@ void Sweeper::StartSweeperTasks() {
   }
 }
 
-void Sweeper::SweepOrWaitUntilSweepingCompleted(Page* page) {
-  if (!page->SweepingDone()) {
-    ParallelSweepPage(page, page->owner_identity());
-    if (!page->SweepingDone()) {
-      // We were not able to sweep that page, i.e., a concurrent
-      // sweeper thread currently owns this page. Wait for the sweeper
-      // thread to be done with this page.
-      page->WaitUntilSweepingCompleted();
-    }
-  }
-}
-
 Page* Sweeper::GetSweptPageSafe(PagedSpace* space) {
   base::MutexGuard guard(&mutex_);
   SweptList& list = swept_list_[GetSweepSpaceIndex(space->identity())];
@@ -214,6 +202,15 @@ Page* Sweeper::GetSweptPageSafe(PagedSpace* space) {
   return nullptr;
 }
 
+void Sweeper::MergeOldToNewRememberedSetsForSweptPages() {
+  base::MutexGuard guard(&mutex_);
+
+  ForAllSweepingSpaces([this](AllocationSpace space) {
+    SweptList& swept_list = swept_list_[GetSweepSpaceIndex(space)];
+    for (Page* p : swept_list) p->MergeOldToNewRememberedSets();
+  });
+}
+
 void Sweeper::AbortAndWaitForTasks() {
   if (!FLAG_concurrent_sweeping) return;
 
@@ -253,7 +250,8 @@ bool Sweeper::AreSweeperTasksRunning() { return num_sweeping_tasks_ != 0; }
 int Sweeper::RawSweep(
     Page* p, FreeListRebuildingMode free_list_mode,
     FreeSpaceTreatmentMode free_space_mode,
-    FreeSpaceMayContainInvalidatedSlots invalidated_slots_in_free_space) {
+    FreeSpaceMayContainInvalidatedSlots invalidated_slots_in_free_space,
+    const base::MutexGuard& page_guard) {
   Space* space = p->owner();
   DCHECK_NOT_NULL(space);
   DCHECK(free_list_mode == IGNORE_FREE_LIST || space->identity() == OLD_SPACE ||
@@ -391,7 +389,7 @@ int Sweeper::RawSweep(
     // The allocated_bytes() counter is precisely the total size of objects.
     DCHECK_EQ(live_bytes, p->allocated_bytes());
   }
-  p->set_concurrent_sweeping_state(Page::kSweepingDone);
+  p->set_concurrent_sweeping_state(Page::ConcurrentSweepingState::kDone);
   if (code_object_registry) code_object_registry->Finalize();
   if (free_list_mode == IGNORE_FREE_LIST) return 0;
 
@@ -427,6 +425,7 @@ int Sweeper::ParallelSweepSpace(
   while ((page = GetSweepingPageSafe(identity)) != nullptr) {
     int freed =
         ParallelSweepPage(page, identity, invalidated_slots_in_free_space);
+    ++pages_freed;
     if (page->IsFlagSet(Page::NEVER_ALLOCATE_ON_PAGE)) {
       // Free list of a never-allocate page will be dropped later on.
       continue;
@@ -443,27 +442,27 @@ int Sweeper::ParallelSweepSpace(
 int Sweeper::ParallelSweepPage(
     Page* page, AllocationSpace identity,
     FreeSpaceMayContainInvalidatedSlots invalidated_slots_in_free_space) {
-  // Early bailout for pages that are swept outside of the regular sweeping
-  // path. This check here avoids taking the lock first, avoiding deadlocks.
+  DCHECK(IsValidSweepingSpace(identity));
+
+  // The Scavenger may add already swept pages back.
   if (page->SweepingDone()) return 0;
 
-  DCHECK(IsValidSweepingSpace(identity));
   int max_freed = 0;
   {
     base::MutexGuard guard(page->mutex());
-    // If this page was already swept in the meantime, we can return here.
-    if (page->SweepingDone()) return 0;
-
+    DCHECK(!page->SweepingDone());
     // If the page is a code page, the CodePageMemoryModificationScope changes
     // the page protection mode from rx -> rw while sweeping.
     CodePageMemoryModificationScope code_page_scope(page);
 
-    DCHECK_EQ(Page::kSweepingPending, page->concurrent_sweeping_state());
-    page->set_concurrent_sweeping_state(Page::kSweepingInProgress);
+    DCHECK_EQ(Page::ConcurrentSweepingState::kPending,
+              page->concurrent_sweeping_state());
+    page->set_concurrent_sweeping_state(
+        Page::ConcurrentSweepingState::kInProgress);
     const FreeSpaceTreatmentMode free_space_mode =
         Heap::ShouldZapGarbage() ? ZAP_FREE_SPACE : IGNORE_FREE_SPACE;
     max_freed = RawSweep(page, REBUILD_FREE_LIST, free_space_mode,
-                         invalidated_slots_in_free_space);
+                         invalidated_slots_in_free_space, guard);
     DCHECK(page->SweepingDone());
   }
 
@@ -497,7 +496,8 @@ void Sweeper::AddPage(AllocationSpace space, Page* page,
     // happened when the page was initially added, so it is skipped here.
     DCHECK_EQ(Sweeper::READD_TEMPORARY_REMOVED_PAGE, mode);
   }
-  DCHECK_EQ(Page::kSweepingPending, page->concurrent_sweeping_state());
+  DCHECK_EQ(Page::ConcurrentSweepingState::kPending,
+            page->concurrent_sweeping_state());
   sweeping_list_[GetSweepSpaceIndex(space)].push_back(page);
 }
 
@@ -505,13 +505,14 @@ void Sweeper::PrepareToBeSweptPage(AllocationSpace space, Page* page) {
 #ifdef DEBUG
   DCHECK_GE(page->area_size(),
             static_cast<size_t>(marking_state_->live_bytes(page)));
-  DCHECK_EQ(Page::kSweepingDone, page->concurrent_sweeping_state());
+  DCHECK_EQ(Page::ConcurrentSweepingState::kDone,
+            page->concurrent_sweeping_state());
   page->ForAllFreeListCategories([page](FreeListCategory* category) {
     DCHECK(!category->is_linked(page->owner()->free_list()));
   });
 #endif  // DEBUG
   page->MoveOldToNewRememberedSetForSweeping();
-  page->set_concurrent_sweeping_state(Page::kSweepingPending);
+  page->set_concurrent_sweeping_state(Page::ConcurrentSweepingState::kPending);
   heap_->paged_space(space)->IncreaseAllocatedBytes(
       marking_state_->live_bytes(page), page);
 }
@@ -528,16 +529,6 @@ Page* Sweeper::GetSweepingPageSafe(AllocationSpace space) {
   return page;
 }
 
-void Sweeper::EnsurePageIsIterable(Page* page) {
-  AllocationSpace space = page->owner_identity();
-  if (IsValidSweepingSpace(space)) {
-    SweepOrWaitUntilSweepingCompleted(page);
-  } else {
-    DCHECK(IsValidIterabilitySpace(space));
-    EnsureIterabilityCompleted();
-  }
-}
-
 void Sweeper::EnsureIterabilityCompleted() {
   if (!iterability_in_progress_) return;
 
@@ -603,18 +594,20 @@ void Sweeper::AddPageForIterability(Page* page) {
   DCHECK(iterability_in_progress_);
   DCHECK(!iterability_task_started_);
   DCHECK(IsValidIterabilitySpace(page->owner_identity()));
-  DCHECK_EQ(Page::kSweepingDone, page->concurrent_sweeping_state());
+  DCHECK_EQ(Page::ConcurrentSweepingState::kDone,
+            page->concurrent_sweeping_state());
 
   iterability_list_.push_back(page);
-  page->set_concurrent_sweeping_state(Page::kSweepingPending);
+  page->set_concurrent_sweeping_state(Page::ConcurrentSweepingState::kPending);
 }
 
 void Sweeper::MakeIterable(Page* page) {
+  base::MutexGuard guard(page->mutex());
   DCHECK(IsValidIterabilitySpace(page->owner_identity()));
   const FreeSpaceTreatmentMode free_space_mode =
       Heap::ShouldZapGarbage() ? ZAP_FREE_SPACE : IGNORE_FREE_SPACE;
   RawSweep(page, IGNORE_FREE_LIST, free_space_mode,
-           FreeSpaceMayContainInvalidatedSlots::kNo);
+           FreeSpaceMayContainInvalidatedSlots::kNo, guard);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/sweeper.h b/deps/v8/src/heap/sweeper.h
index f6ecba8450ce60..7e6757351f5947 100644
--- a/deps/v8/src/heap/sweeper.h
+++ b/deps/v8/src/heap/sweeper.h
@@ -93,7 +93,8 @@ class Sweeper {
   int RawSweep(
       Page* p, FreeListRebuildingMode free_list_mode,
       FreeSpaceTreatmentMode free_space_mode,
-      FreeSpaceMayContainInvalidatedSlots invalidated_slots_in_free_space);
+      FreeSpaceMayContainInvalidatedSlots invalidated_slots_in_free_space,
+      const base::MutexGuard& page_guard);
 
   // After calling this function sweeping is considered to be in progress
   // and the main thread can sweep lazily, but the background sweeper tasks
@@ -105,11 +106,10 @@ class Sweeper {
 
   Page* GetSweptPageSafe(PagedSpace* space);
 
-  void EnsurePageIsIterable(Page* page);
-
   void AddPageForIterability(Page* page);
   void StartIterabilityTasks();
   void EnsureIterabilityCompleted();
+  void MergeOldToNewRememberedSetsForSweptPages();
 
  private:
   class IncrementalSweeperTask;
@@ -148,8 +148,6 @@ class Sweeper {
 
   void PrepareToBeSweptPage(AllocationSpace space, Page* page);
 
-  void SweepOrWaitUntilSweepingCompleted(Page* page);
-
   void MakeIterable(Page* page);
 
   bool IsValidIterabilitySpace(AllocationSpace space) {
diff --git a/deps/v8/src/heap/third-party/heap-api.h b/deps/v8/src/heap/third-party/heap-api.h
new file mode 100644
index 00000000000000..69a84114ee257a
--- /dev/null
+++ b/deps/v8/src/heap/third-party/heap-api.h
@@ -0,0 +1,39 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_THIRD_PARTY_HEAP_API_H_
+#define V8_HEAP_THIRD_PARTY_HEAP_API_H_
+
+#include "include/v8.h"
+#include "src/heap/heap.h"
+
+namespace v8 {
+namespace internal {
+namespace third_party_heap {
+
+class Heap {
+ public:
+  static std::unique_ptr<Heap> New(v8::Isolate* isolate);
+
+  static v8::Isolate* GetIsolate(Address address);
+
+  AllocationResult Allocate(size_t size_in_bytes, AllocationType type,
+                            AllocationAlignment align);
+
+  Address GetObjectFromInnerPointer(Address inner_pointer);
+
+  static bool InCodeSpace(Address address);
+
+  static bool InReadOnlySpace(Address address);
+
+  static bool IsValidHeapObject(HeapObject object);
+
+  bool CollectGarbage();
+};
+
+}  // namespace third_party_heap
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_THIRD_PARTY_HEAP_API_H_
diff --git a/deps/v8/src/ic/accessor-assembler.cc b/deps/v8/src/ic/accessor-assembler.cc
index c9f86ed3282fbe..1fd29fe169825c 100644
--- a/deps/v8/src/ic/accessor-assembler.cc
+++ b/deps/v8/src/ic/accessor-assembler.cc
@@ -30,7 +30,7 @@ using compiler::Node;
 
 // Loads dataX field from the DataHandler object.
 TNode<MaybeObject> AccessorAssembler::LoadHandlerDataField(
-    SloppyTNode<DataHandler> handler, int data_index) {
+    TNode<DataHandler> handler, int data_index) {
 #ifdef DEBUG
   TNode<Map> handler_map = LoadMap(handler);
   TNode<Uint16T> instance_type = LoadMapInstanceType(handler_map);
@@ -139,11 +139,10 @@ void AccessorAssembler::HandleLoadICHandlerCase(
     ElementSupport support_elements, LoadAccessMode access_mode) {
   Comment("have_handler");
 
-  VARIABLE(var_holder, MachineRepresentation::kTagged, p->holder());
-  VARIABLE(var_smi_handler, MachineRepresentation::kTagged, handler);
+  TVARIABLE(Object, var_holder, p->holder());
+  TVARIABLE(Object, var_smi_handler, handler);
 
-  Variable* vars[] = {&var_holder, &var_smi_handler};
-  Label if_smi_handler(this, 2, vars);
+  Label if_smi_handler(this, {&var_holder, &var_smi_handler});
   Label try_proto_handler(this, Label::kDeferred),
       call_handler(this, Label::kDeferred);
 
@@ -161,14 +160,14 @@ void AccessorAssembler::HandleLoadICHandlerCase(
   // for the encoding format.
   BIND(&if_smi_handler);
   {
-    HandleLoadICSmiHandlerCase(p, var_holder.value(), var_smi_handler.value(),
-                               handler, miss, exit_point, ic_mode,
-                               on_nonexistent, support_elements, access_mode);
+    HandleLoadICSmiHandlerCase(
+        p, var_holder.value(), CAST(var_smi_handler.value()), handler, miss,
+        exit_point, ic_mode, on_nonexistent, support_elements, access_mode);
   }
 
   BIND(&call_handler);
   {
-    exit_point->ReturnCallStub(LoadWithVectorDescriptor{}, handler,
+    exit_point->ReturnCallStub(LoadWithVectorDescriptor{}, CAST(handler),
                                p->context(), p->receiver(), p->name(),
                                p->slot(), p->vector());
   }
@@ -205,14 +204,14 @@ void AccessorAssembler::HandleLoadAccessor(
   CSA_CHECK(this, IsNotCleared(maybe_context));
   TNode<HeapObject> context = GetHeapObjectAssumeWeak(maybe_context);
 
-  TNode<Foreign> foreign = CAST(
-      LoadObjectField(call_handler_info, CallHandlerInfo::kJsCallbackOffset));
-  TNode<WordT> callback = TNode<WordT>::UncheckedCast(LoadObjectField(
-      foreign, Foreign::kForeignAddressOffset, MachineType::Pointer()));
+  TNode<Foreign> foreign = LoadObjectField<Foreign>(
+      call_handler_info, CallHandlerInfo::kJsCallbackOffset);
+  TNode<RawPtrT> callback =
+      LoadObjectField<RawPtrT>(foreign, Foreign::kForeignAddressOffset);
   TNode<Object> data =
       LoadObjectField(call_handler_info, CallHandlerInfo::kDataOffset);
 
-  VARIABLE(api_holder, MachineRepresentation::kTagged, p->receiver());
+  TVARIABLE(HeapObject, api_holder, CAST(p->receiver()));
   Label load(this);
   GotoIf(WordEqual(handler_kind, IntPtrConstant(LoadHandler::kApiGetter)),
          &load);
@@ -222,7 +221,7 @@ void AccessorAssembler::HandleLoadAccessor(
       WordEqual(handler_kind,
                 IntPtrConstant(LoadHandler::kApiGetterHolderIsPrototype)));
 
-  api_holder.Bind(LoadMapPrototype(LoadMap(p->receiver())));
+  api_holder = LoadMapPrototype(LoadMap(CAST(p->receiver())));
   Goto(&load);
 
   BIND(&load);
@@ -232,9 +231,9 @@ void AccessorAssembler::HandleLoadAccessor(
                               api_holder.value(), p->receiver()));
 }
 
-void AccessorAssembler::HandleLoadField(SloppyTNode<JSObject> holder,
+void AccessorAssembler::HandleLoadField(TNode<JSObject> holder,
                                         TNode<WordT> handler_word,
-                                        Variable* var_double_value,
+                                        TVariable<Float64T>* var_double_value,
                                         Label* rebox_double, Label* miss,
                                         ExitPoint* exit_point) {
   Comment("field_load");
@@ -254,8 +253,7 @@ void AccessorAssembler::HandleLoadField(SloppyTNode<JSObject> holder,
 
     BIND(&is_double);
     if (FLAG_unbox_double_fields) {
-      var_double_value->Bind(
-          LoadObjectField(holder, offset, MachineType::Float64()));
+      *var_double_value = LoadObjectField<Float64T>(holder, offset);
     } else {
       TNode<Object> heap_number = LoadObjectField(holder, offset);
       // This is not an "old" Smi value from before a Smi->Double transition.
@@ -263,7 +261,7 @@ void AccessorAssembler::HandleLoadField(SloppyTNode<JSObject> holder,
       // field transitioned to a Tagged field, and was then assigned a Smi.
       GotoIf(TaggedIsSmi(heap_number), miss);
       GotoIfNot(IsHeapNumber(CAST(heap_number)), miss);
-      var_double_value->Bind(LoadHeapNumberValue(CAST(heap_number)));
+      *var_double_value = LoadHeapNumberValue(CAST(heap_number));
     }
     Goto(rebox_double);
   }
@@ -284,7 +282,7 @@ void AccessorAssembler::HandleLoadField(SloppyTNode<JSObject> holder,
       GotoIf(TaggedIsSmi(value), miss);
       GotoIfNot(IsHeapNumber(CAST(value)), miss);
     }
-    var_double_value->Bind(LoadHeapNumberValue(CAST(value)));
+    *var_double_value = LoadHeapNumberValue(CAST(value));
     Goto(rebox_double);
   }
 }
@@ -301,11 +299,11 @@ TNode<MaybeObject> AccessorAssembler::LoadDescriptorValueOrFieldType(
 }
 
 void AccessorAssembler::HandleLoadICSmiHandlerCase(
-    const LazyLoadICParameters* p, SloppyTNode<HeapObject> holder,
-    SloppyTNode<Smi> smi_handler, SloppyTNode<Object> handler, Label* miss,
-    ExitPoint* exit_point, ICMode ic_mode, OnNonExistent on_nonexistent,
-    ElementSupport support_elements, LoadAccessMode access_mode) {
-  VARIABLE(var_double_value, MachineRepresentation::kFloat64);
+    const LazyLoadICParameters* p, TNode<Object> holder, TNode<Smi> smi_handler,
+    TNode<Object> handler, Label* miss, ExitPoint* exit_point, ICMode ic_mode,
+    OnNonExistent on_nonexistent, ElementSupport support_elements,
+    LoadAccessMode access_mode) {
+  TVARIABLE(Float64T, var_double_value);
   Label rebox_double(this, &var_double_value);
 
   TNode<IntPtrT> handler_word = SmiUntag(smi_handler);
@@ -313,7 +311,11 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
       Signed(DecodeWord<LoadHandler::KindBits>(handler_word));
 
   if (support_elements == kSupportElements) {
-    Label if_element(this), if_indexed_string(this), if_property(this);
+    Label if_element(this), if_indexed_string(this), if_property(this),
+        if_hole(this), unimplemented_elements_kind(this),
+        if_oob(this, Label::kDeferred), try_string_to_array_index(this),
+        emit_element_load(this);
+    TVARIABLE(IntPtrT, var_intptr_index);
     GotoIf(WordEqual(handler_kind, IntPtrConstant(LoadHandler::kElement)),
            &if_element);
 
@@ -329,18 +331,42 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
     }
 
     BIND(&if_element);
-    Comment("element_load");
-    TNode<IntPtrT> intptr_index = TryToIntptr(p->name(), miss);
-    TNode<BoolT> is_jsarray_condition =
-        IsSetWord<LoadHandler::IsJsArrayBits>(handler_word);
-    TNode<Uint32T> elements_kind =
-        DecodeWord32FromWord<LoadHandler::ElementsKindBits>(handler_word);
-    Label if_hole(this), unimplemented_elements_kind(this),
-        if_oob(this, Label::kDeferred);
-    EmitElementLoad(holder, elements_kind, intptr_index, is_jsarray_condition,
-                    &if_hole, &rebox_double, &var_double_value,
-                    &unimplemented_elements_kind, &if_oob, miss, exit_point,
-                    access_mode);
+    {
+      Comment("element_load");
+      TVARIABLE(Int32T, var_instance_type);
+      TNode<IntPtrT> intptr_index = TryToIntptr(
+          p->name(), &try_string_to_array_index, &var_instance_type);
+      var_intptr_index = intptr_index;
+      Goto(&emit_element_load);
+
+      BIND(&try_string_to_array_index);
+      {
+        GotoIfNot(IsStringInstanceType(var_instance_type.value()), miss);
+
+        TNode<ExternalReference> function = ExternalConstant(
+            ExternalReference::string_to_array_index_function());
+        TNode<Int32T> result = UncheckedCast<Int32T>(
+            CallCFunction(function, MachineType::Int32(),
+                          std::make_pair(MachineType::AnyTagged(), p->name())));
+        GotoIf(Word32Equal(Int32Constant(-1), result), miss);
+        CSA_ASSERT(this, Int32GreaterThanOrEqual(result, Int32Constant(0)));
+        var_intptr_index = ChangeInt32ToIntPtr(result);
+
+        Goto(&emit_element_load);
+      }
+
+      BIND(&emit_element_load);
+      {
+        TNode<BoolT> is_jsarray_condition =
+            IsSetWord<LoadHandler::IsJsArrayBits>(handler_word);
+        TNode<Uint32T> elements_kind =
+            DecodeWord32FromWord<LoadHandler::ElementsKindBits>(handler_word);
+        EmitElementLoad(CAST(holder), elements_kind, var_intptr_index.value(),
+                        is_jsarray_condition, &if_hole, &rebox_double,
+                        &var_double_value, &unimplemented_elements_kind,
+                        &if_oob, miss, exit_point, access_mode);
+      }
+    }
 
     BIND(&unimplemented_elements_kind);
     {
@@ -365,12 +391,19 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
       // in V8, not elements. So we cannot handle them here, except
       // in case of typed arrays, where integer indexed properties
       // aren't looked up in the prototype chain.
-      GotoIf(IsJSTypedArray(holder), &return_undefined);
-      GotoIf(IntPtrLessThan(intptr_index, IntPtrConstant(0)), miss);
+      GotoIf(IsJSTypedArray(CAST(holder)), &return_undefined);
+      if (Is64()) {
+        GotoIfNot(UintPtrLessThan(var_intptr_index.value(),
+                                  IntPtrConstant(JSArray::kMaxArrayIndex)),
+                  miss);
+      } else {
+        GotoIf(IntPtrLessThan(var_intptr_index.value(), IntPtrConstant(0)),
+               miss);
+      }
 
       // For all other receivers we need to check that the prototype chain
       // doesn't contain any elements.
-      BranchIfPrototypesHaveNoElements(LoadMap(holder), &return_undefined,
+      BranchIfPrototypesHaveNoElements(LoadMap(CAST(holder)), &return_undefined,
                                        miss);
 
       BIND(&return_undefined);
@@ -397,10 +430,11 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
 
         Comment("indexed string");
         TNode<String> string_holder = CAST(holder);
-        TNode<IntPtrT> intptr_index = TryToIntptr(p->name(), miss);
-        TNode<IntPtrT> length = LoadStringLengthAsWord(string_holder);
-        GotoIf(UintPtrGreaterThanOrEqual(intptr_index, length), &if_oob);
-        TNode<Int32T> code = StringCharCodeAt(string_holder, intptr_index);
+        TNode<UintPtrT> index = Unsigned(TryToIntptr(p->name(), miss));
+        TNode<UintPtrT> length =
+            Unsigned(LoadStringLengthAsWord(string_holder));
+        GotoIf(UintPtrGreaterThanOrEqual(index, length), &if_oob);
+        TNode<Int32T> code = StringCharCodeAt(string_holder, index);
         TNode<String> result = StringFromSingleCharCode(code);
         Return(result);
 
@@ -428,9 +462,9 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
 }
 
 void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
-    const LazyLoadICParameters* p, TNode<HeapObject> holder,
+    const LazyLoadICParameters* p, TNode<Object> holder,
     TNode<IntPtrT> handler_kind, TNode<WordT> handler_word, Label* rebox_double,
-    Variable* var_double_value, SloppyTNode<Object> handler, Label* miss,
+    TVariable<Float64T>* var_double_value, TNode<Object> handler, Label* miss,
     ExitPoint* exit_point, ICMode ic_mode, OnNonExistent on_nonexistent,
     ElementSupport support_elements) {
   Label constant(this), field(this), normal(this, Label::kDeferred),
@@ -507,8 +541,8 @@ void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
                                          &var_name_index, miss);
     BIND(&found);
     {
-      VARIABLE(var_details, MachineRepresentation::kWord32);
-      VARIABLE(var_value, MachineRepresentation::kTagged);
+      TVARIABLE(Uint32T, var_details);
+      TVARIABLE(Object, var_value);
       LoadPropertyFromNameDictionary(properties, var_name_index.value(),
                                      &var_details, &var_value);
       TNode<Object> value =
@@ -524,7 +558,7 @@ void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
     TNode<IntPtrT> descriptor =
         Signed(DecodeWord<LoadHandler::DescriptorBits>(handler_word));
     TNode<AccessorPair> accessor_pair =
-        CAST(LoadDescriptorValue(LoadMap(holder), descriptor));
+        CAST(LoadDescriptorValue(LoadMap(CAST(holder)), descriptor));
     TNode<Object> getter =
         LoadObjectField(accessor_pair, AccessorPair::kGetterOffset);
     CSA_ASSERT(this, Word32BinaryNot(IsTheHole(getter)));
@@ -542,6 +576,14 @@ void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
 
   BIND(&proxy);
   {
+    // TODO(mythria): LoadGlobals don't use this path. LoadGlobals need special
+    // handling with proxies which is currently not supported by builtins. So
+    // for such cases, we should install a slow path and never reach here. Fix
+    // it to not generate this for LoadGlobals.
+    CSA_ASSERT(this,
+               WordNotEqual(IntPtrConstant(static_cast<int>(on_nonexistent)),
+                            IntPtrConstant(static_cast<int>(
+                                OnNonExistent::kThrowReferenceError))));
     TVARIABLE(IntPtrT, var_index);
     TVARIABLE(Name, var_unique);
 
@@ -581,11 +623,12 @@ void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
 
   BIND(&global);
   {
-    CSA_ASSERT(this, IsPropertyCell(holder));
+    CSA_ASSERT(this, IsPropertyCell(CAST(holder)));
     // Ensure the property cell doesn't contain the hole.
-    TNode<Object> value = LoadObjectField(holder, PropertyCell::kValueOffset);
-    TNode<Int32T> details = LoadAndUntagToWord32ObjectField(
-        holder, PropertyCell::kPropertyDetailsRawOffset);
+    TNode<Object> value =
+        LoadObjectField(CAST(holder), PropertyCell::kValueOffset);
+    TNode<Uint32T> details = Unsigned(LoadAndUntagToWord32ObjectField(
+        CAST(holder), PropertyCell::kPropertyDetailsRawOffset));
     GotoIf(IsTheHole(value), miss);
 
     exit_point->Return(CallGetterIfAccessor(value, details, p->context(),
@@ -617,8 +660,8 @@ void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
     Comment("module export");
     TNode<UintPtrT> index =
         DecodeWord<LoadHandler::ExportsIndexBits>(handler_word);
-    TNode<Module> module =
-        CAST(LoadObjectField(p->receiver(), JSModuleNamespace::kModuleOffset));
+    TNode<Module> module = LoadObjectField<Module>(
+        CAST(p->receiver()), JSModuleNamespace::kModuleOffset);
     TNode<ObjectHashTable> exports =
         LoadObjectField<ObjectHashTable>(module, Module::kExportsOffset);
     TNode<Cell> cell = CAST(LoadFixedArrayElement(exports, index));
@@ -641,7 +684,7 @@ void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
 }
 
 void AccessorAssembler::HandleLoadICSmiHandlerHasNamedCase(
-    const LazyLoadICParameters* p, TNode<HeapObject> holder,
+    const LazyLoadICParameters* p, TNode<Object> holder,
     TNode<IntPtrT> handler_kind, Label* miss, ExitPoint* exit_point,
     ICMode ic_mode) {
   Label return_true(this), return_false(this), return_lookup(this),
@@ -715,9 +758,10 @@ void AccessorAssembler::HandleLoadICSmiHandlerHasNamedCase(
 
   BIND(&global);
   {
-    CSA_ASSERT(this, IsPropertyCell(holder));
+    CSA_ASSERT(this, IsPropertyCell(CAST(holder)));
     // Ensure the property cell doesn't contain the hole.
-    TNode<Object> value = LoadObjectField(holder, PropertyCell::kValueOffset);
+    TNode<Object> value =
+        LoadObjectField(CAST(holder), PropertyCell::kValueOffset);
     GotoIf(IsTheHole(value), miss);
 
     exit_point->Return(TrueConstant());
@@ -810,8 +854,8 @@ TNode<Object> AccessorAssembler::HandleProtoHandler(
         CSA_ASSERT(this, IsWeakOrCleared(data2));
         TNode<Context> expected_native_context =
             CAST(GetHeapObjectAssumeWeak(data2, miss));
-        EmitAccessCheck(expected_native_context, p->context(),
-                        CAST(p->receiver()), &done, miss);
+        EmitAccessCheck(expected_native_context, p->context(), p->receiver(),
+                        &done, miss);
       }
 
       // Dictionary lookup on receiver is not necessary for Load/StoreGlobalIC
@@ -821,10 +865,10 @@ TNode<Object> AccessorAssembler::HandleProtoHandler(
       {
         DCHECK_EQ(ICMode::kNonGlobalIC, ic_mode);
         CSA_ASSERT(this, Word32BinaryNot(HasInstanceType(
-                             p->receiver(), JS_GLOBAL_OBJECT_TYPE)));
+                             CAST(p->receiver()), JS_GLOBAL_OBJECT_TYPE)));
 
         TNode<NameDictionary> properties =
-            CAST(LoadSlowProperties(p->receiver()));
+            CAST(LoadSlowProperties(CAST(p->receiver())));
         TVARIABLE(IntPtrT, var_name_index);
         Label found(this, &var_name_index);
         NameDictionaryLookup<NameDictionary>(properties, CAST(p->name()),
@@ -847,12 +891,9 @@ TNode<Object> AccessorAssembler::HandleProtoHandler(
 
 void AccessorAssembler::HandleLoadICProtoHandler(
     const LazyLoadICParameters* p, TNode<DataHandler> handler,
-    Variable* var_holder, Variable* var_smi_handler, Label* if_smi_handler,
-    Label* miss, ExitPoint* exit_point, ICMode ic_mode,
+    TVariable<Object>* var_holder, TVariable<Object>* var_smi_handler,
+    Label* if_smi_handler, Label* miss, ExitPoint* exit_point, ICMode ic_mode,
     LoadAccessMode access_mode) {
-  DCHECK_EQ(MachineRepresentation::kTagged, var_holder->rep());
-  DCHECK_EQ(MachineRepresentation::kTagged, var_smi_handler->rep());
-
   TNode<Smi> smi_handler = CAST(HandleProtoHandler<LoadHandler>(
       p, handler,
       // Code sub-handlers are not expected in LoadICs, so no |on_code_handler|.
@@ -862,8 +903,8 @@ void AccessorAssembler::HandleLoadICProtoHandler(
         if (access_mode == LoadAccessMode::kHas) {
           exit_point->Return(TrueConstant());
         } else {
-          VARIABLE(var_details, MachineRepresentation::kWord32);
-          VARIABLE(var_value, MachineRepresentation::kTagged);
+          TVARIABLE(Uint32T, var_details);
+          TVARIABLE(Object, var_value);
           LoadPropertyFromNameDictionary(properties, name_index, &var_details,
                                          &var_value);
           TNode<Object> value =
@@ -893,7 +934,7 @@ void AccessorAssembler::HandleLoadICProtoHandler(
     if (access_mode == LoadAccessMode::kHas) {
       exit_point->Return(TrueConstant());
     } else {
-      exit_point->Return(maybe_holder_or_constant);
+      exit_point->Return(CAST(maybe_holder_or_constant));
     }
   }
 
@@ -906,13 +947,13 @@ void AccessorAssembler::HandleLoadICProtoHandler(
     CSA_ASSERT(this, IsWeakOrCleared(maybe_holder_or_constant));
     TNode<HeapObject> holder =
         GetHeapObjectAssumeWeak(maybe_holder_or_constant, miss);
-    var_holder->Bind(holder);
+    *var_holder = holder;
     Goto(&done);
   }
 
   BIND(&done);
   {
-    var_smi_handler->Bind(smi_handler);
+    *var_smi_handler = smi_handler;
     Goto(if_smi_handler);
   }
 }
@@ -952,7 +993,7 @@ void AccessorAssembler::JumpIfDataProperty(TNode<Uint32T> details,
 }
 
 void AccessorAssembler::HandleStoreICNativeDataProperty(
-    const StoreICParameters* p, SloppyTNode<HeapObject> holder,
+    const StoreICParameters* p, TNode<HeapObject> holder,
     TNode<Word32T> handler_word) {
   Comment("native_data_property_store");
   TNode<IntPtrT> descriptor =
@@ -968,7 +1009,7 @@ void AccessorAssembler::HandleStoreICHandlerCase(
     const StoreICParameters* p, TNode<MaybeObject> handler, Label* miss,
     ICMode ic_mode, ElementSupport support_elements) {
   Label if_smi_handler(this), if_nonsmi_handler(this);
-  Label if_proto_handler(this), if_element_handler(this), call_handler(this),
+  Label if_proto_handler(this), call_handler(this),
       store_transition_or_global(this);
 
   Branch(TaggedIsSmi(handler), &if_smi_handler, &if_nonsmi_handler);
@@ -977,7 +1018,7 @@ void AccessorAssembler::HandleStoreICHandlerCase(
   // for the encoding format.
   BIND(&if_smi_handler);
   {
-    Node* holder = p->receiver();
+    TNode<Object> holder = p->receiver();
     TNode<Int32T> handler_word = SmiToInt32(CAST(handler));
 
     Label if_fast_smi(this), if_proxy(this), if_interceptor(this),
@@ -1002,7 +1043,7 @@ void AccessorAssembler::HandleStoreICHandlerCase(
            &if_slow);
     CSA_ASSERT(this,
                Word32Equal(handler_kind, Int32Constant(StoreHandler::kNormal)));
-    TNode<NameDictionary> properties = CAST(LoadSlowProperties(holder));
+    TNode<NameDictionary> properties = CAST(LoadSlowProperties(CAST(holder)));
 
     TVARIABLE(IntPtrT, var_name_index);
     Label dictionary_found(this, &var_name_index);
@@ -1010,8 +1051,8 @@ void AccessorAssembler::HandleStoreICHandlerCase(
         properties, CAST(p->name()), &dictionary_found, &var_name_index, miss);
     BIND(&dictionary_found);
     {
-      TNode<Uint32T> details = LoadDetailsByKeyIndex<NameDictionary>(
-          properties, var_name_index.value());
+      TNode<Uint32T> details =
+          LoadDetailsByKeyIndex(properties, var_name_index.value());
       // Check that the property is a writable data property (no accessor).
       const int kTypeAndReadOnlyMask = PropertyDetails::KindField::kMask |
                                        PropertyDetails::kAttributesReadOnlyMask;
@@ -1036,18 +1077,18 @@ void AccessorAssembler::HandleStoreICHandlerCase(
              &native_data_property, &data);
 
       BIND(&accessor);
-      HandleStoreAccessor(p, holder, handler_word);
+      HandleStoreAccessor(p, CAST(holder), handler_word);
 
       BIND(&native_data_property);
-      HandleStoreICNativeDataProperty(p, holder, handler_word);
+      HandleStoreICNativeDataProperty(p, CAST(holder), handler_word);
 
       BIND(&data);
       // Handle non-transitioning field stores.
-      HandleStoreICSmiHandlerCase(handler_word, holder, p->value(), miss);
+      HandleStoreICSmiHandlerCase(handler_word, CAST(holder), p->value(), miss);
     }
 
     BIND(&if_proxy);
-    HandleStoreToProxy(p, holder, miss, support_elements);
+    HandleStoreToProxy(p, CAST(holder), miss, support_elements);
 
     BIND(&if_interceptor);
     {
@@ -1132,12 +1173,12 @@ void AccessorAssembler::HandleStoreICTransitionMapHandlerCase(
   }
 
   TNode<Uint32T> bitfield3 = LoadMapBitField3(transition_map);
-  CSA_ASSERT(this, IsClearWord32<Map::IsDictionaryMapBit>(bitfield3));
-  GotoIf(IsSetWord32<Map::IsDeprecatedBit>(bitfield3), miss);
+  CSA_ASSERT(this, IsClearWord32<Map::Bits3::IsDictionaryMapBit>(bitfield3));
+  GotoIf(IsSetWord32<Map::Bits3::IsDeprecatedBit>(bitfield3), miss);
 
   // Load last descriptor details.
   TNode<UintPtrT> nof =
-      DecodeWordFromWord32<Map::NumberOfOwnDescriptorsBits>(bitfield3);
+      DecodeWordFromWord32<Map::Bits3::NumberOfOwnDescriptorsBits>(bitfield3);
   CSA_ASSERT(this, WordNotEqual(nof, IntPtrConstant(0)));
   TNode<DescriptorArray> descriptors = LoadMapDescriptors(transition_map);
 
@@ -1176,15 +1217,15 @@ void AccessorAssembler::HandleStoreICTransitionMapHandlerCase(
     BIND(&attributes_ok);
   }
 
-  OverwriteExistingFastDataProperty(p->receiver(), transition_map, descriptors,
-                                    last_key_index, details, p->value(), miss,
-                                    true);
+  OverwriteExistingFastDataProperty(CAST(p->receiver()), transition_map,
+                                    descriptors, last_key_index, details,
+                                    p->value(), miss, true);
 }
 
 void AccessorAssembler::CheckFieldType(TNode<DescriptorArray> descriptors,
                                        TNode<IntPtrT> name_index,
                                        TNode<Word32T> representation,
-                                       Node* value, Label* bailout) {
+                                       TNode<Object> value, Label* bailout) {
   Label r_smi(this), r_double(this), r_heapobject(this), all_fine(this);
   // Ignore FLAG_track_fields etc. and always emit code for all checks,
   // because this builtin is part of the snapshot and therefore should
@@ -1208,7 +1249,7 @@ void AccessorAssembler::CheckFieldType(TNode<DescriptorArray> descriptors,
   BIND(&r_double);
   {
     GotoIf(TaggedIsSmi(value), &all_fine);
-    Branch(IsHeapNumber(value), &all_fine, bailout);
+    Branch(IsHeapNumber(CAST(value)), &all_fine, bailout);
   }
 
   BIND(&r_heapobject);
@@ -1233,7 +1274,8 @@ void AccessorAssembler::CheckFieldType(TNode<DescriptorArray> descriptors,
     TNode<Map> field_type_map =
         CAST(GetHeapObjectAssumeWeak(field_type, bailout));
     // FieldType::Class(...) performs a map check.
-    Branch(TaggedEqual(LoadMap(value), field_type_map), &all_fine, bailout);
+    Branch(TaggedEqual(LoadMap(CAST(value)), field_type_map), &all_fine,
+           bailout);
   }
 
   BIND(&all_fine);
@@ -1245,7 +1287,7 @@ TNode<BoolT> AccessorAssembler::IsPropertyDetailsConst(TNode<Uint32T> details) {
 }
 
 void AccessorAssembler::OverwriteExistingFastDataProperty(
-    SloppyTNode<HeapObject> object, TNode<Map> object_map,
+    TNode<HeapObject> object, TNode<Map> object_map,
     TNode<DescriptorArray> descriptors, TNode<IntPtrT> descriptor_name_index,
     TNode<Uint32T> details, TNode<Object> value, Label* slow,
     bool do_transitioning_store) {
@@ -1300,8 +1342,7 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
             BranchIfSameNumberValue(current_value, double_value, &done, slow);
             BIND(&if_mutable);
           }
-          StoreObjectFieldNoWriteBarrier(object, field_offset, double_value,
-                                         MachineRepresentation::kFloat64);
+          StoreObjectFieldNoWriteBarrier(object, field_offset, double_value);
         } else {
           if (do_transitioning_store) {
             TNode<HeapNumber> heap_number =
@@ -1348,7 +1389,7 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
         // Allocate mutable heap number before extending properties backing
         // store to ensure that heap verifier will not see the heap in
         // inconsistent state.
-        VARIABLE(var_value, MachineRepresentation::kTagged, value);
+        TVARIABLE(Object, var_value, value);
         {
           Label cont(this);
           GotoIf(Word32NotEqual(representation,
@@ -1358,14 +1399,14 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
             TNode<Float64T> double_value = ChangeNumberToFloat64(CAST(value));
             TNode<HeapNumber> heap_number =
                 AllocateHeapNumberWithValue(double_value);
-            var_value.Bind(heap_number);
+            var_value = heap_number;
             Goto(&cont);
           }
           BIND(&cont);
         }
 
         TNode<PropertyArray> properties =
-            CAST(ExtendPropertiesBackingStore(object, backing_store_index));
+            ExtendPropertiesBackingStore(object, backing_store_index);
         StorePropertyArrayElement(properties, backing_store_index,
                                   var_value.value());
         StoreMap(object, object_map);
@@ -1413,8 +1454,8 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
   BIND(&if_descriptor);
   {
     // Check that constant matches value.
-    TNode<Object> constant = LoadValueByKeyIndex(
-        descriptors, UncheckedCast<IntPtrT>(descriptor_name_index));
+    TNode<Object> constant =
+        LoadValueByKeyIndex(descriptors, descriptor_name_index);
     GotoIf(TaggedNotEqual(value, constant), slow);
 
     if (do_transitioning_store) {
@@ -1442,7 +1483,7 @@ void AccessorAssembler::CheckPrototypeValidityCell(
 }
 
 void AccessorAssembler::HandleStoreAccessor(const StoreICParameters* p,
-                                            SloppyTNode<HeapObject> holder,
+                                            TNode<HeapObject> holder,
                                             TNode<Word32T> handler_word) {
   Comment("accessor_store");
   TNode<IntPtrT> descriptor =
@@ -1498,8 +1539,7 @@ void AccessorAssembler::HandleStoreICProtoHandler(
       p, handler, on_code_handler,
       // on_found_on_receiver
       [=](TNode<NameDictionary> properties, TNode<IntPtrT> name_index) {
-        TNode<Uint32T> details =
-            LoadDetailsByKeyIndex<NameDictionary>(properties, name_index);
+        TNode<Uint32T> details = LoadDetailsByKeyIndex(properties, name_index);
         // Check that the property is a writable data property (no accessor).
         const int kTypeAndReadOnlyMask =
             PropertyDetails::KindField::kMask |
@@ -1525,6 +1565,9 @@ void AccessorAssembler::HandleStoreICProtoHandler(
     GotoIf(Word32Equal(handler_kind, Int32Constant(StoreHandler::kNormal)),
            &if_add_normal);
 
+    GotoIf(Word32Equal(handler_kind, Int32Constant(StoreHandler::kSlow)),
+           &if_slow);
+
     TNode<MaybeObject> maybe_holder = LoadHandlerDataField(handler, 1);
     CSA_ASSERT(this, IsWeakOrCleared(maybe_holder));
     TNode<HeapObject> holder = GetHeapObjectAssumeWeak(maybe_holder, miss);
@@ -1542,9 +1585,6 @@ void AccessorAssembler::HandleStoreICProtoHandler(
     GotoIf(Word32Equal(handler_kind, Int32Constant(StoreHandler::kApiSetter)),
            &if_api_setter);
 
-    GotoIf(Word32Equal(handler_kind, Int32Constant(StoreHandler::kSlow)),
-           &if_slow);
-
     GotoIf(
         Word32Equal(handler_kind,
                     Int32Constant(StoreHandler::kApiSetterHolderIsPrototype)),
@@ -1552,7 +1592,7 @@ void AccessorAssembler::HandleStoreICProtoHandler(
 
     CSA_ASSERT(this,
                Word32Equal(handler_kind, Int32Constant(StoreHandler::kProxy)));
-    HandleStoreToProxy(p, holder, miss, support_elements);
+    HandleStoreToProxy(p, CAST(holder), miss, support_elements);
 
     BIND(&if_slow);
     {
@@ -1576,11 +1616,11 @@ void AccessorAssembler::HandleStoreICProtoHandler(
       // case is covered above by LookupOnReceiver bit handling of the smi
       // handler.
       Label slow(this);
-      TNode<Map> receiver_map = LoadMap(p->receiver());
+      TNode<Map> receiver_map = LoadMap(CAST(p->receiver()));
       InvalidateValidityCellIfPrototype(receiver_map);
 
       TNode<NameDictionary> properties =
-          CAST(LoadSlowProperties(p->receiver()));
+          CAST(LoadSlowProperties(CAST(p->receiver())));
       Add<NameDictionary>(properties, CAST(p->name()), p->value(), &slow);
       Return(p->value());
 
@@ -1599,7 +1639,7 @@ void AccessorAssembler::HandleStoreICProtoHandler(
     {
       Comment("api_setter");
       CSA_ASSERT(this, TaggedIsNotSmi(handler));
-      Node* call_handler_info = holder;
+      TNode<CallHandlerInfo> call_handler_info = CAST(holder);
 
       // Context is stored either in data2 or data3 field depending on whether
       // the access check is enabled for this handler or not.
@@ -1613,14 +1653,14 @@ void AccessorAssembler::HandleStoreICProtoHandler(
           IsCleared(maybe_context), [=] { return SmiConstant(0); },
           [=] { return GetHeapObjectAssumeWeak(maybe_context); });
 
-      TNode<Foreign> foreign = CAST(LoadObjectField(
-          call_handler_info, CallHandlerInfo::kJsCallbackOffset));
-      Node* callback = LoadObjectField(foreign, Foreign::kForeignAddressOffset,
-                                       MachineType::Pointer());
+      TNode<Foreign> foreign = LoadObjectField<Foreign>(
+          call_handler_info, CallHandlerInfo::kJsCallbackOffset);
+      TNode<RawPtrT> callback =
+          LoadObjectField<RawPtrT>(foreign, Foreign::kForeignAddressOffset);
       TNode<Object> data =
           LoadObjectField(call_handler_info, CallHandlerInfo::kDataOffset);
 
-      VARIABLE(api_holder, MachineRepresentation::kTagged, p->receiver());
+      TVARIABLE(Object, api_holder, p->receiver());
       Label store(this);
       GotoIf(Word32Equal(handler_kind, Int32Constant(StoreHandler::kApiSetter)),
              &store);
@@ -1630,7 +1670,7 @@ void AccessorAssembler::HandleStoreICProtoHandler(
                      handler_kind,
                      Int32Constant(StoreHandler::kApiSetterHolderIsPrototype)));
 
-      api_holder.Bind(LoadMapPrototype(LoadMap(p->receiver())));
+      api_holder = LoadMapPrototype(LoadMap(CAST(p->receiver())));
       Goto(&store);
 
       BIND(&store);
@@ -1643,13 +1683,14 @@ void AccessorAssembler::HandleStoreICProtoHandler(
     BIND(&if_store_global_proxy);
     {
       ExitPoint direct_exit(this);
-      StoreGlobalIC_PropertyCellCase(holder, p->value(), &direct_exit, miss);
+      StoreGlobalIC_PropertyCellCase(CAST(holder), p->value(), &direct_exit,
+                                     miss);
     }
   }
 }
 
 void AccessorAssembler::HandleStoreToProxy(const StoreICParameters* p,
-                                           Node* proxy, Label* miss,
+                                           TNode<JSProxy> proxy, Label* miss,
                                            ElementSupport support_elements) {
   TVARIABLE(IntPtrT, var_index);
   TVARIABLE(Name, var_unique);
@@ -1683,9 +1724,10 @@ void AccessorAssembler::HandleStoreToProxy(const StoreICParameters* p,
   }
 }
 
-void AccessorAssembler::HandleStoreICSmiHandlerCase(
-    SloppyTNode<Word32T> handler_word, SloppyTNode<JSObject> holder,
-    SloppyTNode<Object> value, Label* miss) {
+void AccessorAssembler::HandleStoreICSmiHandlerCase(TNode<Word32T> handler_word,
+                                                    TNode<JSObject> holder,
+                                                    TNode<Object> value,
+                                                    Label* miss) {
   Comment("field store");
 #ifdef DEBUG
   TNode<Uint32T> handler_kind =
@@ -1867,8 +1909,7 @@ void AccessorAssembler::HandleStoreFieldAndReturn(
   BIND(&do_store);
   // Do the store.
   if (store_value_as_double) {
-    StoreObjectFieldNoWriteBarrier(property_storage, offset, *double_value,
-                                   MachineRepresentation::kFloat64);
+    StoreObjectFieldNoWriteBarrier(property_storage, offset, *double_value);
   } else if (representation.IsSmi()) {
     TNode<Smi> value_smi = CAST(value);
     StoreObjectFieldNoWriteBarrier(property_storage, offset, value_smi);
@@ -1879,21 +1920,20 @@ void AccessorAssembler::HandleStoreFieldAndReturn(
   Return(value);
 }
 
-Node* AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
-                                                      Node* index) {
+TNode<PropertyArray> AccessorAssembler::ExtendPropertiesBackingStore(
+    TNode<HeapObject> object, TNode<IntPtrT> index) {
   Comment("[ Extend storage");
 
   ParameterMode mode = OptimalParameterMode();
 
   // TODO(gsathya): Clean up the type conversions by creating smarter
   // helpers that do the correct op based on the mode.
-  VARIABLE(var_properties, MachineRepresentation::kTaggedPointer);
-  VARIABLE(var_encoded_hash, MachineRepresentation::kWord32);
-  VARIABLE(var_length, ParameterRepresentation(mode));
+  TVARIABLE(HeapObject, var_properties);
+  TVARIABLE(Int32T, var_encoded_hash);
+  TVARIABLE(BInt, var_length);
 
   TNode<Object> properties =
       LoadObjectField(object, JSObject::kPropertiesOrHashOffset);
-  var_properties.Bind(properties);
 
   Label if_smi_hash(this), if_property_array(this), extend_store(this);
   Branch(TaggedIsSmi(properties), &if_smi_hash, &if_property_array);
@@ -1903,30 +1943,29 @@ Node* AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
     TNode<Int32T> hash = SmiToInt32(CAST(properties));
     TNode<Int32T> encoded_hash =
         Word32Shl(hash, Int32Constant(PropertyArray::HashField::kShift));
-    var_encoded_hash.Bind(encoded_hash);
-    var_length.Bind(IntPtrOrSmiConstant(0, mode));
-    var_properties.Bind(EmptyFixedArrayConstant());
+    var_encoded_hash = encoded_hash;
+    var_length = BIntConstant(0);
+    var_properties = EmptyFixedArrayConstant();
     Goto(&extend_store);
   }
 
   BIND(&if_property_array);
   {
+    var_properties = CAST(properties);
     TNode<Int32T> length_and_hash_int32 = LoadAndUntagToWord32ObjectField(
         var_properties.value(), PropertyArray::kLengthAndHashOffset);
-    var_encoded_hash.Bind(Word32And(
-        length_and_hash_int32, Int32Constant(PropertyArray::HashField::kMask)));
+    var_encoded_hash = Word32And(
+        length_and_hash_int32, Int32Constant(PropertyArray::HashField::kMask));
     TNode<IntPtrT> length_intptr = ChangeInt32ToIntPtr(
         Word32And(length_and_hash_int32,
                   Int32Constant(PropertyArray::LengthField::kMask)));
-    Node* length = IntPtrToParameter(length_intptr, mode);
-    var_length.Bind(length);
+    var_length = IntPtrToBInt(length_intptr);
     Goto(&extend_store);
   }
 
   BIND(&extend_store);
   {
-    VARIABLE(var_new_properties, MachineRepresentation::kTaggedPointer,
-             var_properties.value());
+    TVARIABLE(HeapObject, var_new_properties, var_properties.value());
     Label done(this);
     // Previous property deletion could have left behind unused backing store
     // capacity even for a map that think it doesn't have any unused fields.
@@ -1934,7 +1973,7 @@ Node* AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
     GotoIf(UintPtrLessThan(index, ParameterToIntPtr(var_length.value(), mode)),
            &done);
 
-    Node* delta = IntPtrOrSmiConstant(JSObject::kFieldsAdded, mode);
+    TNode<BInt> delta = BIntConstant(JSObject::kFieldsAdded);
     Node* new_capacity = IntPtrOrSmiAdd(var_length.value(), delta, mode);
 
     // Grow properties array.
@@ -1949,8 +1988,9 @@ Node* AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
                        kMaxNumberOfDescriptors + JSObject::kFieldsAdded, mode),
                    mode));
 
-    Node* new_properties = AllocatePropertyArray(new_capacity, mode);
-    var_new_properties.Bind(new_properties);
+    TNode<PropertyArray> new_properties =
+        CAST(AllocatePropertyArray(new_capacity, mode));
+    var_new_properties = new_properties;
 
     FillPropertyArrayWithUndefined(new_properties, var_length.value(),
                                    new_capacity, mode);
@@ -1966,33 +2006,32 @@ Node* AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
     TNode<Int32T> new_capacity_int32 =
         TruncateIntPtrToInt32(ParameterToIntPtr(new_capacity, mode));
     TNode<Int32T> new_length_and_hash_int32 =
-        Signed(Word32Or(var_encoded_hash.value(), new_capacity_int32));
+        Word32Or(var_encoded_hash.value(), new_capacity_int32);
     StoreObjectField(new_properties, PropertyArray::kLengthAndHashOffset,
                      SmiFromInt32(new_length_and_hash_int32));
     StoreObjectField(object, JSObject::kPropertiesOrHashOffset, new_properties);
     Comment("] Extend storage");
     Goto(&done);
     BIND(&done);
-    return var_new_properties.value();
+    return CAST(var_new_properties.value());
   }
 }
 
-void AccessorAssembler::EmitFastElementsBoundsCheck(Node* object,
-                                                    Node* elements,
-                                                    Node* intptr_index,
-                                                    Node* is_jsarray_condition,
-                                                    Label* miss) {
-  VARIABLE(var_length, MachineType::PointerRepresentation());
+void AccessorAssembler::EmitFastElementsBoundsCheck(
+    TNode<JSObject> object, TNode<FixedArrayBase> elements,
+    TNode<IntPtrT> intptr_index, TNode<BoolT> is_jsarray_condition,
+    Label* miss) {
+  TVARIABLE(IntPtrT, var_length);
   Comment("Fast elements bounds check");
   Label if_array(this), length_loaded(this, &var_length);
   GotoIf(is_jsarray_condition, &if_array);
   {
-    var_length.Bind(SmiUntag(LoadFixedArrayBaseLength(elements)));
+    var_length = SmiUntag(LoadFixedArrayBaseLength(elements));
     Goto(&length_loaded);
   }
   BIND(&if_array);
   {
-    var_length.Bind(SmiUntag(LoadFastJSArrayLength(object)));
+    var_length = SmiUntag(LoadFastJSArrayLength(CAST(object)));
     Goto(&length_loaded);
   }
   BIND(&length_loaded);
@@ -2000,9 +2039,9 @@ void AccessorAssembler::EmitFastElementsBoundsCheck(Node* object,
 }
 
 void AccessorAssembler::EmitElementLoad(
-    Node* object, TNode<Word32T> elements_kind,
-    SloppyTNode<IntPtrT> intptr_index, Node* is_jsarray_condition,
-    Label* if_hole, Label* rebox_double, Variable* var_double_value,
+    TNode<HeapObject> object, TNode<Word32T> elements_kind,
+    TNode<IntPtrT> intptr_index, TNode<BoolT> is_jsarray_condition,
+    Label* if_hole, Label* rebox_double, TVariable<Float64T>* var_double_value,
     Label* unimplemented_elements_kind, Label* out_of_bounds, Label* miss,
     ExitPoint* exit_point, LoadAccessMode access_mode) {
   Label if_typed_array(this), if_fast(this), if_fast_packed(this),
@@ -2015,7 +2054,7 @@ void AccessorAssembler::EmitElementLoad(
   BIND(&if_fast);
   {
     TNode<FixedArrayBase> elements = LoadJSObjectElements(CAST(object));
-    EmitFastElementsBoundsCheck(object, elements, intptr_index,
+    EmitFastElementsBoundsCheck(CAST(object), elements, intptr_index,
                                 is_jsarray_condition, out_of_bounds);
     int32_t kinds[] = {
         // Handled by if_fast_packed.
@@ -2066,8 +2105,8 @@ void AccessorAssembler::EmitElementLoad(
       if (access_mode == LoadAccessMode::kHas) {
         exit_point->Return(TrueConstant());
       } else {
-        var_double_value->Bind(LoadFixedDoubleArrayElement(
-            CAST(elements), intptr_index, MachineType::Float64()));
+        *var_double_value = LoadFixedDoubleArrayElement(
+            CAST(elements), intptr_index, MachineType::Float64());
         Goto(rebox_double);
       }
     }
@@ -2081,7 +2120,7 @@ void AccessorAssembler::EmitElementLoad(
       if (access_mode == LoadAccessMode::kHas) {
         exit_point->Return(TrueConstant());
       } else {
-        var_double_value->Bind(value);
+        *var_double_value = value;
         Goto(rebox_double);
       }
     }
@@ -2101,7 +2140,13 @@ void AccessorAssembler::EmitElementLoad(
     BIND(&if_dictionary);
     {
       Comment("dictionary elements");
-      GotoIf(IntPtrLessThan(intptr_index, IntPtrConstant(0)), out_of_bounds);
+      if (Is64()) {
+        GotoIf(UintPtrLessThan(IntPtrConstant(JSArray::kMaxArrayIndex),
+                               intptr_index),
+               out_of_bounds);
+      } else {
+        GotoIf(IntPtrLessThan(intptr_index, IntPtrConstant(0)), out_of_bounds);
+      }
 
       TNode<FixedArrayBase> elements = LoadJSObjectElements(CAST(object));
       TNode<Object> value = BasicLoadNumberDictionaryElement(
@@ -2149,98 +2194,88 @@ void AccessorAssembler::EmitElementLoad(
         BIND(&uint8_elements);
         {
           Comment("UINT8_ELEMENTS");  // Handles UINT8_CLAMPED_ELEMENTS too.
-          Node* element = Load(MachineType::Uint8(), data_ptr, intptr_index);
+          TNode<Int32T> element = Load<Uint8T>(data_ptr, intptr_index);
           exit_point->Return(SmiFromInt32(element));
         }
         BIND(&int8_elements);
         {
           Comment("INT8_ELEMENTS");
-          Node* element = Load(MachineType::Int8(), data_ptr, intptr_index);
+          TNode<Int32T> element = Load<Int8T>(data_ptr, intptr_index);
           exit_point->Return(SmiFromInt32(element));
         }
         BIND(&uint16_elements);
         {
           Comment("UINT16_ELEMENTS");
           TNode<IntPtrT> index = WordShl(intptr_index, IntPtrConstant(1));
-          Node* element = Load(MachineType::Uint16(), data_ptr, index);
+          TNode<Int32T> element = Load<Uint16T>(data_ptr, index);
           exit_point->Return(SmiFromInt32(element));
         }
         BIND(&int16_elements);
         {
           Comment("INT16_ELEMENTS");
           TNode<IntPtrT> index = WordShl(intptr_index, IntPtrConstant(1));
-          Node* element = Load(MachineType::Int16(), data_ptr, index);
+          TNode<Int32T> element = Load<Int16T>(data_ptr, index);
           exit_point->Return(SmiFromInt32(element));
         }
         BIND(&uint32_elements);
         {
           Comment("UINT32_ELEMENTS");
           TNode<IntPtrT> index = WordShl(intptr_index, IntPtrConstant(2));
-          Node* element = Load(MachineType::Uint32(), data_ptr, index);
+          TNode<Uint32T> element = Load<Uint32T>(data_ptr, index);
           exit_point->Return(ChangeUint32ToTagged(element));
         }
         BIND(&int32_elements);
         {
           Comment("INT32_ELEMENTS");
           TNode<IntPtrT> index = WordShl(intptr_index, IntPtrConstant(2));
-          Node* element = Load(MachineType::Int32(), data_ptr, index);
+          TNode<Int32T> element = Load<Int32T>(data_ptr, index);
           exit_point->Return(ChangeInt32ToTagged(element));
         }
         BIND(&float32_elements);
         {
           Comment("FLOAT32_ELEMENTS");
           TNode<IntPtrT> index = WordShl(intptr_index, IntPtrConstant(2));
-          Node* element = Load(MachineType::Float32(), data_ptr, index);
-          var_double_value->Bind(ChangeFloat32ToFloat64(element));
+          TNode<Float32T> element = Load<Float32T>(data_ptr, index);
+          *var_double_value = ChangeFloat32ToFloat64(element);
           Goto(rebox_double);
         }
         BIND(&float64_elements);
         {
           Comment("FLOAT64_ELEMENTS");
           TNode<IntPtrT> index = WordShl(intptr_index, IntPtrConstant(3));
-          Node* element = Load(MachineType::Float64(), data_ptr, index);
-          var_double_value->Bind(element);
+          TNode<Float64T> element = Load<Float64T>(data_ptr, index);
+          *var_double_value = element;
           Goto(rebox_double);
         }
         BIND(&bigint64_elements);
         {
           Comment("BIGINT64_ELEMENTS");
           exit_point->Return(LoadFixedTypedArrayElementAsTagged(
-              data_ptr, intptr_index, BIGINT64_ELEMENTS, INTPTR_PARAMETERS));
+              data_ptr, Unsigned(intptr_index), BIGINT64_ELEMENTS));
         }
         BIND(&biguint64_elements);
         {
           Comment("BIGUINT64_ELEMENTS");
           exit_point->Return(LoadFixedTypedArrayElementAsTagged(
-              data_ptr, intptr_index, BIGUINT64_ELEMENTS, INTPTR_PARAMETERS));
+              data_ptr, Unsigned(intptr_index), BIGUINT64_ELEMENTS));
         }
       }
     }
   }
 }
 
-void AccessorAssembler::NameDictionaryNegativeLookup(Node* object,
-                                                     SloppyTNode<Name> name,
-                                                     Label* miss) {
-  CSA_ASSERT(this, IsDictionaryMap(LoadMap(object)));
-  TNode<NameDictionary> properties = CAST(LoadSlowProperties(object));
-  // Ensure the property does not exist in a dictionary-mode object.
-  TVARIABLE(IntPtrT, var_name_index);
-  Label done(this);
-  NameDictionaryLookup<NameDictionary>(properties, name, miss, &var_name_index,
-                                       &done);
-  BIND(&done);
-}
-
-void AccessorAssembler::InvalidateValidityCellIfPrototype(Node* map,
-                                                          Node* bitfield3) {
+void AccessorAssembler::InvalidateValidityCellIfPrototype(
+    TNode<Map> map, base::Optional<TNode<Uint32T>> maybe_bitfield3) {
   Label is_prototype(this), cont(this);
-  if (bitfield3 == nullptr) {
+  TNode<Uint32T> bitfield3;
+  if (bitfield3) {
+    bitfield3 = maybe_bitfield3.value();
+  } else {
     bitfield3 = LoadMapBitField3(map);
   }
 
-  Branch(IsSetWord32(bitfield3, Map::IsPrototypeMapBit::kMask), &is_prototype,
-         &cont);
+  Branch(IsSetWord32(bitfield3, Map::Bits3::IsPrototypeMapBit::kMask),
+         &is_prototype, &cont);
 
   BIND(&is_prototype);
   {
@@ -2258,22 +2293,22 @@ void AccessorAssembler::InvalidateValidityCellIfPrototype(Node* map,
   BIND(&cont);
 }
 
-void AccessorAssembler::GenericElementLoad(Node* receiver,
+void AccessorAssembler::GenericElementLoad(TNode<HeapObject> receiver,
                                            TNode<Map> receiver_map,
-                                           SloppyTNode<Int32T> instance_type,
-                                           Node* index, Label* slow) {
+                                           TNode<Int32T> instance_type,
+                                           TNode<IntPtrT> index, Label* slow) {
   Comment("integer index");
 
   ExitPoint direct_exit(this);
 
   Label if_custom(this), if_element_hole(this), if_oob(this);
+  Label return_undefined(this);
   // Receivers requiring non-standard element accesses (interceptors, access
   // checks, strings and string wrappers, proxies) are handled in the runtime.
   GotoIf(IsCustomElementsReceiverInstanceType(instance_type), &if_custom);
   TNode<Int32T> elements_kind = LoadMapElementsKind(receiver_map);
-  TNode<BoolT> is_jsarray_condition =
-      InstanceTypeEqual(instance_type, JS_ARRAY_TYPE);
-  VARIABLE(var_double_value, MachineRepresentation::kFloat64);
+  TNode<BoolT> is_jsarray_condition = IsJSArrayInstanceType(instance_type);
+  TVARIABLE(Float64T, var_double_value);
   Label rebox_double(this, &var_double_value);
 
   // Unimplemented elements kinds fall back to a runtime call.
@@ -2289,22 +2324,23 @@ void AccessorAssembler::GenericElementLoad(Node* receiver,
   BIND(&if_oob);
   {
     Comment("out of bounds");
-    // Positive OOB indices are effectively the same as hole loads.
-    GotoIf(IntPtrGreaterThanOrEqual(index, IntPtrConstant(0)),
-           &if_element_hole);
-    // Negative keys can't take the fast OOB path, except for typed arrays.
-    GotoIfNot(InstanceTypeEqual(instance_type, JS_TYPED_ARRAY_TYPE), slow);
-    Return(UndefinedConstant());
+    // On TypedArrays, all OOB loads (positive and negative) return undefined
+    // without ever checking the prototype chain.
+    GotoIf(IsJSTypedArrayInstanceType(instance_type), &return_undefined);
+    // Positive OOB indices within JSArray index range are effectively the same
+    // as hole loads. Larger keys and negative keys are named loads.
+    if (Is64()) {
+      Branch(UintPtrLessThan(index, IntPtrConstant(JSArray::kMaxArrayIndex)),
+             &if_element_hole, slow);
+    } else {
+      Branch(IntPtrLessThan(index, IntPtrConstant(0)), slow, &if_element_hole);
+    }
   }
 
   BIND(&if_element_hole);
   {
     Comment("found the hole");
-    Label return_undefined(this);
     BranchIfPrototypesHaveNoElements(receiver_map, &return_undefined, slow);
-
-    BIND(&return_undefined);
-    Return(UndefinedConstant());
   }
 
   BIND(&if_custom);
@@ -2312,24 +2348,30 @@ void AccessorAssembler::GenericElementLoad(Node* receiver,
     Comment("check if string");
     GotoIfNot(IsStringInstanceType(instance_type), slow);
     Comment("load string character");
-    TNode<IntPtrT> length = LoadStringLengthAsWord(receiver);
+    TNode<IntPtrT> length = LoadStringLengthAsWord(CAST(receiver));
     GotoIfNot(UintPtrLessThan(index, length), slow);
     IncrementCounter(isolate()->counters()->ic_keyed_load_generic_smi(), 1);
     TailCallBuiltin(Builtins::kStringCharAt, NoContextConstant(), receiver,
                     index);
   }
+
+  BIND(&return_undefined);
+  Return(UndefinedConstant());
 }
 
-void AccessorAssembler::GenericPropertyLoad(
-    Node* receiver, TNode<Map> receiver_map, SloppyTNode<Int32T> instance_type,
-    const LoadICParameters* p, Label* slow, UseStubCache use_stub_cache) {
+void AccessorAssembler::GenericPropertyLoad(TNode<HeapObject> receiver,
+                                            TNode<Map> receiver_map,
+                                            TNode<Int32T> instance_type,
+                                            const LoadICParameters* p,
+                                            Label* slow,
+                                            UseStubCache use_stub_cache) {
   ExitPoint direct_exit(this);
 
   Comment("key is unique name");
   Label if_found_on_receiver(this), if_property_dictionary(this),
       lookup_prototype_chain(this), special_receiver(this);
-  VARIABLE(var_details, MachineRepresentation::kWord32);
-  VARIABLE(var_value, MachineRepresentation::kTagged);
+  TVARIABLE(Uint32T, var_details);
+  TVARIABLE(Object, var_value);
 
   TNode<Name> name = CAST(p->name());
 
@@ -2339,7 +2381,7 @@ void AccessorAssembler::GenericPropertyLoad(
 
   // Check if the receiver has fast or slow properties.
   TNode<Uint32T> bitfield3 = LoadMapBitField3(receiver_map);
-  GotoIf(IsSetWord32<Map::IsDictionaryMapBit>(bitfield3),
+  GotoIf(IsSetWord32<Map::Bits3::IsDictionaryMapBit>(bitfield3),
          &if_property_dictionary);
 
   // Try looking up the property on the receiver; if unsuccessful, look
@@ -2400,7 +2442,7 @@ void AccessorAssembler::GenericPropertyLoad(
 
     TVARIABLE(IntPtrT, var_name_index);
     Label dictionary_found(this, &var_name_index);
-    TNode<NameDictionary> properties = CAST(LoadSlowProperties(receiver));
+    TNode<NameDictionary> properties = CAST(LoadSlowProperties(CAST(receiver)));
     NameDictionaryLookup<NameDictionary>(properties, name, &dictionary_found,
                                          &var_name_index,
                                          &lookup_prototype_chain);
@@ -2423,13 +2465,12 @@ void AccessorAssembler::GenericPropertyLoad(
   BIND(&lookup_prototype_chain);
   {
     TVARIABLE(Map, var_holder_map);
-    VARIABLE(var_holder_instance_type, MachineRepresentation::kWord32);
+    TVARIABLE(Int32T, var_holder_instance_type);
     Label return_undefined(this), is_private_symbol(this);
-    Variable* merged_variables[] = {&var_holder_map, &var_holder_instance_type};
-    Label loop(this, arraysize(merged_variables), merged_variables);
+    Label loop(this, {&var_holder_map, &var_holder_instance_type});
 
     var_holder_map = receiver_map;
-    var_holder_instance_type.Bind(instance_type);
+    var_holder_instance_type = instance_type;
     GotoIf(IsPrivateSymbol(name), &is_private_symbol);
 
     Goto(&loop);
@@ -2444,9 +2485,9 @@ void AccessorAssembler::GenericPropertyLoad(
       TNode<Map> proto_map = LoadMap(proto);
       TNode<Uint16T> proto_instance_type = LoadMapInstanceType(proto_map);
       var_holder_map = proto_map;
-      var_holder_instance_type.Bind(proto_instance_type);
+      var_holder_instance_type = proto_instance_type;
       Label next_proto(this), return_value(this, &var_value), goto_slow(this);
-      TryGetOwnProperty(p->context(), receiver, proto, proto_map,
+      TryGetOwnProperty(p->context(), receiver, CAST(proto), proto_map,
                         proto_instance_type, name, &return_value, &var_value,
                         &next_proto, &goto_slow);
 
@@ -2498,7 +2539,8 @@ enum AccessorAssembler::StubCacheTable : int {
   kSecondary = static_cast<int>(StubCache::kSecondary)
 };
 
-Node* AccessorAssembler::StubCachePrimaryOffset(Node* name, Node* map) {
+TNode<IntPtrT> AccessorAssembler::StubCachePrimaryOffset(TNode<Name> name,
+                                                         TNode<Map> map) {
   // Compute the hash of the name (use entire hash field).
   TNode<Uint32T> hash_field = LoadNameHashField(name);
   CSA_ASSERT(this,
@@ -2517,10 +2559,13 @@ Node* AccessorAssembler::StubCachePrimaryOffset(Node* name, Node* map) {
   TNode<Word32T> hash = Int32Add(hash_field, map32);
   uint32_t mask = (StubCache::kPrimaryTableSize - 1)
                   << StubCache::kCacheIndexShift;
-  return ChangeUint32ToWord(Word32And(hash, Int32Constant(mask)));
+  TNode<UintPtrT> result =
+      ChangeUint32ToWord(Word32And(hash, Int32Constant(mask)));
+  return Signed(result);
 }
 
-Node* AccessorAssembler::StubCacheSecondaryOffset(Node* name, Node* seed) {
+TNode<IntPtrT> AccessorAssembler::StubCacheSecondaryOffset(
+    TNode<Name> name, TNode<IntPtrT> seed) {
   // See v8::internal::StubCache::SecondaryOffset().
 
   // Use the seed from the primary cache in the secondary cache.
@@ -2529,11 +2574,13 @@ Node* AccessorAssembler::StubCacheSecondaryOffset(Node* name, Node* seed) {
   hash = Int32Add(hash, Int32Constant(StubCache::kSecondaryMagic));
   int32_t mask = (StubCache::kSecondaryTableSize - 1)
                  << StubCache::kCacheIndexShift;
-  return ChangeUint32ToWord(Word32And(hash, Int32Constant(mask)));
+  TNode<UintPtrT> result =
+      ChangeUint32ToWord(Word32And(hash, Int32Constant(mask)));
+  return Signed(result);
 }
 
 void AccessorAssembler::TryProbeStubCacheTable(
-    StubCache* stub_cache, StubCacheTable table_id, Node* entry_offset,
+    StubCache* stub_cache, StubCacheTable table_id, TNode<IntPtrT> entry_offset,
     TNode<Object> name, TNode<Map> map, Label* if_handler,
     TVariable<MaybeObject>* var_handler, Label* if_miss) {
   StubCache::Table table = static_cast<StubCache::Table>(table_id);
@@ -2568,8 +2615,9 @@ void AccessorAssembler::TryProbeStubCacheTable(
   Goto(if_handler);
 }
 
-void AccessorAssembler::TryProbeStubCache(StubCache* stub_cache, Node* receiver,
-                                          TNode<Object> name, Label* if_handler,
+void AccessorAssembler::TryProbeStubCache(StubCache* stub_cache,
+                                          TNode<Object> receiver,
+                                          TNode<Name> name, Label* if_handler,
                                           TVariable<MaybeObject>* var_handler,
                                           Label* if_miss) {
   Label try_secondary(this), miss(this);
@@ -2580,17 +2628,18 @@ void AccessorAssembler::TryProbeStubCache(StubCache* stub_cache, Node* receiver,
   // Check that the {receiver} isn't a smi.
   GotoIf(TaggedIsSmi(receiver), &miss);
 
-  TNode<Map> receiver_map = LoadMap(receiver);
+  TNode<Map> receiver_map = LoadMap(CAST(receiver));
 
   // Probe the primary table.
-  Node* primary_offset = StubCachePrimaryOffset(name, receiver_map);
+  TNode<IntPtrT> primary_offset = StubCachePrimaryOffset(name, receiver_map);
   TryProbeStubCacheTable(stub_cache, kPrimary, primary_offset, name,
                          receiver_map, if_handler, var_handler, &try_secondary);
 
   BIND(&try_secondary);
   {
     // Probe the secondary table.
-    Node* secondary_offset = StubCacheSecondaryOffset(name, primary_offset);
+    TNode<IntPtrT> secondary_offset =
+        StubCacheSecondaryOffset(name, primary_offset);
     TryProbeStubCacheTable(stub_cache, kSecondary, secondary_offset, name,
                            receiver_map, if_handler, var_handler, &miss);
   }
@@ -2618,11 +2667,11 @@ void AccessorAssembler::LoadIC_BytecodeHandler(const LazyLoadICParameters* p,
   Label stub_call(this, Label::kDeferred), miss(this, Label::kDeferred),
       no_feedback(this, Label::kDeferred);
 
+  GotoIf(IsUndefined(p->vector()), &no_feedback);
+
   TNode<Map> recv_map = LoadReceiverMap(p->receiver());
   GotoIf(IsDeprecatedMap(recv_map), &miss);
 
-  GotoIf(IsUndefined(p->vector()), &no_feedback);
-
   // Inlined fast path.
   {
     Comment("LoadIC_BytecodeHandler_fast");
@@ -2666,7 +2715,8 @@ void AccessorAssembler::LoadIC_BytecodeHandler(const LazyLoadICParameters* p,
     // Call into the stub that implements the non-inlined parts of LoadIC.
     exit_point->ReturnCallStub(
         Builtins::CallableFor(isolate(), Builtins::kLoadIC_NoFeedback),
-        p->context(), p->receiver(), p->name(), p->slot());
+        p->context(), p->receiver(), p->name(),
+        SmiConstant(FeedbackSlotKind::kLoadProperty));
   }
 
   BIND(&miss);
@@ -2741,16 +2791,19 @@ void AccessorAssembler::LoadIC_Noninlined(const LoadICParameters* p,
     // Check megamorphic case.
     GotoIfNot(TaggedEqual(feedback, MegamorphicSymbolConstant()), miss);
 
-    TryProbeStubCache(isolate()->load_stub_cache(), p->receiver(), p->name(),
-                      if_handler, var_handler, miss);
+    TryProbeStubCache(isolate()->load_stub_cache(), p->receiver(),
+                      CAST(p->name()), if_handler, var_handler, miss);
   }
 }
 
-void AccessorAssembler::LoadIC_NoFeedback(const LoadICParameters* p) {
+void AccessorAssembler::LoadIC_NoFeedback(const LoadICParameters* p,
+                                          TNode<Smi> ic_kind) {
   Label miss(this, Label::kDeferred);
-  Node* receiver = p->receiver();
+  TNode<Object> receiver = p->receiver();
   GotoIf(TaggedIsSmi(receiver), &miss);
-  TNode<Map> receiver_map = LoadMap(receiver);
+  TNode<Map> receiver_map = LoadMap(CAST(receiver));
+  GotoIf(IsDeprecatedMap(receiver_map), &miss);
+
   TNode<Uint16T> instance_type = LoadMapInstanceType(receiver_map);
 
   {
@@ -2767,13 +2820,13 @@ void AccessorAssembler::LoadIC_NoFeedback(const LoadICParameters* p) {
     BIND(&not_function_prototype);
   }
 
-  GenericPropertyLoad(receiver, receiver_map, instance_type, p, &miss,
+  GenericPropertyLoad(CAST(receiver), receiver_map, instance_type, p, &miss,
                       kDontUseStubCache);
 
   BIND(&miss);
   {
-    TailCallRuntime(Runtime::kLoadIC_Miss, p->context(), p->receiver(),
-                    p->name(), p->slot(), p->vector());
+    TailCallRuntime(Runtime::kLoadNoFeedbackIC_Miss, p->context(),
+                    p->receiver(), p->name(), ic_kind);
   }
 }
 
@@ -2784,8 +2837,10 @@ void AccessorAssembler::LoadGlobalIC(TNode<HeapObject> maybe_feedback_vector,
                                      const LazyNode<Name>& lazy_name,
                                      TypeofMode typeof_mode,
                                      ExitPoint* exit_point) {
-  Label try_handler(this, Label::kDeferred), miss(this, Label::kDeferred);
-  GotoIf(IsUndefined(maybe_feedback_vector), &miss);
+  Label try_handler(this, Label::kDeferred), miss(this, Label::kDeferred),
+      no_feedback(this, Label::kDeferred);
+
+  GotoIf(IsUndefined(maybe_feedback_vector), &no_feedback);
   {
     TNode<FeedbackVector> vector = CAST(maybe_feedback_vector);
     TNode<UintPtrT> slot = lazy_slot();
@@ -2806,6 +2861,17 @@ void AccessorAssembler::LoadGlobalIC(TNode<HeapObject> maybe_feedback_vector,
                                   lazy_smi_slot(), maybe_feedback_vector,
                                   SmiConstant(typeof_mode));
   }
+
+  BIND(&no_feedback);
+  {
+    int ic_kind =
+        static_cast<int>((typeof_mode == INSIDE_TYPEOF)
+                             ? FeedbackSlotKind::kLoadGlobalInsideTypeof
+                             : FeedbackSlotKind::kLoadGlobalNotInsideTypeof);
+    exit_point->ReturnCallStub(
+        Builtins::CallableFor(isolate(), Builtins::kLoadGlobalIC_NoFeedback),
+        lazy_context(), lazy_name(), SmiConstant(ic_kind));
+  }
 }
 
 void AccessorAssembler::LoadGlobalIC_TryPropertyCellCase(
@@ -2877,6 +2943,81 @@ void AccessorAssembler::LoadGlobalIC_TryHandlerCase(
                           on_nonexistent);
 }
 
+void AccessorAssembler::ScriptContextTableLookup(
+    TNode<Name> name, TNode<NativeContext> native_context, Label* found_hole,
+    Label* not_found) {
+  TNode<ScriptContextTable> script_context_table = CAST(
+      LoadContextElement(native_context, Context::SCRIPT_CONTEXT_TABLE_INDEX));
+  TVARIABLE(IntPtrT, context_index, IntPtrConstant(-1));
+  Label loop(this, &context_index);
+  TNode<IntPtrT> num_script_contexts = SmiUntag(CAST(LoadFixedArrayElement(
+      script_context_table, ScriptContextTable::kUsedSlotIndex)));
+  Goto(&loop);
+
+  BIND(&loop);
+  {
+    context_index = IntPtrAdd(context_index.value(), IntPtrConstant(1));
+    GotoIf(IntPtrGreaterThanOrEqual(context_index.value(), num_script_contexts),
+           not_found);
+
+    TNode<Context> script_context = CAST(LoadFixedArrayElement(
+        script_context_table, context_index.value(),
+        ScriptContextTable::kFirstContextSlotIndex * kTaggedSize));
+    TNode<ScopeInfo> scope_info =
+        CAST(LoadContextElement(script_context, Context::SCOPE_INFO_INDEX));
+    TNode<IntPtrT> length = LoadAndUntagFixedArrayBaseLength(scope_info);
+    GotoIf(IntPtrLessThanOrEqual(length, IntPtrConstant(0)), &loop);
+
+    TVARIABLE(IntPtrT, scope_var_index,
+              IntPtrConstant(ScopeInfo::kVariablePartIndex - 1));
+    TNode<IntPtrT> num_scope_vars = SmiUntag(CAST(LoadFixedArrayElement(
+        scope_info, IntPtrConstant(ScopeInfo::Fields::kContextLocalCount))));
+    TNode<IntPtrT> end_index = IntPtrAdd(
+        num_scope_vars, IntPtrConstant(ScopeInfo::kVariablePartIndex));
+    Label loop_scope_info(this, &scope_var_index);
+    Goto(&loop_scope_info);
+
+    BIND(&loop_scope_info);
+    {
+      scope_var_index = IntPtrAdd(scope_var_index.value(), IntPtrConstant(1));
+      GotoIf(IntPtrGreaterThanOrEqual(scope_var_index.value(), end_index),
+             &loop);
+
+      TNode<Object> var_name =
+          LoadFixedArrayElement(scope_info, scope_var_index.value(), 0);
+      GotoIf(TaggedNotEqual(var_name, name), &loop_scope_info);
+
+      TNode<IntPtrT> var_index =
+          IntPtrAdd(IntPtrConstant(Context::MIN_CONTEXT_SLOTS),
+                    IntPtrSub(scope_var_index.value(),
+                              IntPtrConstant(ScopeInfo::kVariablePartIndex)));
+      TNode<Object> result = LoadContextElement(script_context, var_index);
+      GotoIf(IsTheHole(result), found_hole);
+      Return(result);
+    }
+  }
+}
+
+void AccessorAssembler::LoadGlobalIC_NoFeedback(TNode<Context> context,
+                                                TNode<Object> name,
+                                                TNode<Smi> smi_typeof_mode) {
+  TNode<NativeContext> native_context = LoadNativeContext(context);
+  Label regular_load(this), throw_reference_error(this, Label::kDeferred);
+
+  GotoIfNot(IsString(CAST(name)), &regular_load);
+  ScriptContextTableLookup(CAST(name), native_context, &throw_reference_error,
+                           &regular_load);
+
+  BIND(&throw_reference_error);
+  Return(CallRuntime(Runtime::kThrowReferenceError, context, name));
+
+  BIND(&regular_load);
+  TNode<JSGlobalObject> global_object =
+      CAST(LoadContextElement(native_context, Context::EXTENSION_INDEX));
+  TailCallStub(Builtins::CallableFor(isolate(), Builtins::kLoadIC_NoFeedback),
+               context, global_object, name, smi_typeof_mode);
+}
+
 void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p,
                                     LoadAccessMode access_mode) {
   ExitPoint direct_exit(this);
@@ -3005,7 +3146,7 @@ void AccessorAssembler::KeyedLoadICGeneric(const LoadICParameters* p) {
   TVARIABLE(Object, var_name, p->name());
 
   Label if_runtime(this, Label::kDeferred);
-  Node* receiver = p->receiver();
+  TNode<Object> receiver = p->receiver();
   GotoIf(TaggedIsSmi(receiver), &if_runtime);
   GotoIf(IsNullOrUndefined(receiver), &if_runtime);
 
@@ -3021,9 +3162,9 @@ void AccessorAssembler::KeyedLoadICGeneric(const LoadICParameters* p) {
     BIND(&if_unique_name);
     {
       LoadICParameters pp(p, var_unique.value());
-      TNode<Map> receiver_map = LoadMap(receiver);
+      TNode<Map> receiver_map = LoadMap(CAST(receiver));
       TNode<Uint16T> instance_type = LoadMapInstanceType(receiver_map);
-      GenericPropertyLoad(receiver, receiver_map, instance_type, &pp,
+      GenericPropertyLoad(CAST(receiver), receiver_map, instance_type, &pp,
                           &if_runtime);
     }
 
@@ -3054,9 +3195,9 @@ void AccessorAssembler::KeyedLoadICGeneric(const LoadICParameters* p) {
           // experiments with this have shown that it causes too much traffic
           // on the stub cache. We may want to re-evaluate that in the future.
           LoadICParameters pp(p, var_unique.value());
-          TNode<Map> receiver_map = LoadMap(receiver);
+          TNode<Map> receiver_map = LoadMap(CAST(receiver));
           TNode<Uint16T> instance_type = LoadMapInstanceType(receiver_map);
-          GenericPropertyLoad(receiver, receiver_map, instance_type, &pp,
+          GenericPropertyLoad(CAST(receiver), receiver_map, instance_type, &pp,
                               &if_runtime, kDontUseStubCache);
         }
       } else {
@@ -3066,9 +3207,9 @@ void AccessorAssembler::KeyedLoadICGeneric(const LoadICParameters* p) {
 
     BIND(&if_index);
     {
-      TNode<Map> receiver_map = LoadMap(receiver);
+      TNode<Map> receiver_map = LoadMap(CAST(receiver));
       TNode<Uint16T> instance_type = LoadMapInstanceType(receiver_map);
-      GenericElementLoad(receiver, receiver_map, instance_type,
+      GenericElementLoad(CAST(receiver), receiver_map, instance_type,
                          var_index.value(), &if_runtime);
     }
   }
@@ -3088,7 +3229,7 @@ void AccessorAssembler::KeyedLoadICPolymorphicName(const LoadICParameters* p,
   TVARIABLE(MaybeObject, var_handler);
   Label if_handler(this, &var_handler), miss(this, Label::kDeferred);
 
-  Node* receiver = p->receiver();
+  TNode<Object> receiver = p->receiver();
   TNode<Map> receiver_map = LoadReceiverMap(receiver);
   TNode<Name> name = CAST(p->name());
   TNode<FeedbackVector> vector = CAST(p->vector());
@@ -3169,8 +3310,8 @@ void AccessorAssembler::StoreIC(const StoreICParameters* p) {
     // Check megamorphic case.
     GotoIfNot(TaggedEqual(strong_feedback, MegamorphicSymbolConstant()), &miss);
 
-    TryProbeStubCache(isolate()->store_stub_cache(), p->receiver(), p->name(),
-                      &if_handler, &var_handler, &miss);
+    TryProbeStubCache(isolate()->store_stub_cache(), p->receiver(),
+                      CAST(p->name()), &if_handler, &var_handler, &miss);
   }
 
   BIND(&no_feedback);
@@ -3212,7 +3353,7 @@ void AccessorAssembler::StoreGlobalIC(const StoreICParameters* pp) {
 
       GotoIf(TaggedEqual(handler, UninitializedSymbolConstant()), &miss);
 
-      DCHECK_NULL(pp->receiver());
+      DCHECK(pp->receiver_is_null());
       TNode<NativeContext> native_context = LoadNativeContext(pp->context());
       StoreICParameters p(
           pp->context(),
@@ -3244,12 +3385,10 @@ void AccessorAssembler::StoreGlobalIC(const StoreICParameters* pp) {
   }
 }
 
-void AccessorAssembler::StoreGlobalIC_PropertyCellCase(Node* property_cell,
-                                                       TNode<Object> value,
-                                                       ExitPoint* exit_point,
-                                                       Label* miss) {
+void AccessorAssembler::StoreGlobalIC_PropertyCellCase(
+    TNode<PropertyCell> property_cell, TNode<Object> value,
+    ExitPoint* exit_point, Label* miss) {
   Comment("StoreGlobalIC_TryPropertyCellCase");
-  CSA_ASSERT(this, IsPropertyCell(property_cell));
 
   // Load the payload of the global parameter cell. A hole indicates that
   // the cell has been invalidated and that the store must be handled by the
@@ -3384,7 +3523,7 @@ void AccessorAssembler::KeyedStoreIC(const StoreICParameters* p) {
 }
 
 void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
-  Label miss(this, Label::kDeferred);
+  Label miss(this, Label::kDeferred), no_feedback(this, Label::kDeferred);
   {
     TVARIABLE(MaybeObject, var_handler);
 
@@ -3395,7 +3534,7 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
     TNode<Map> array_map = LoadReceiverMap(p->receiver());
     GotoIf(IsDeprecatedMap(array_map), &miss);
 
-    GotoIf(IsUndefined(p->vector()), &miss);
+    GotoIf(IsUndefined(p->vector()), &no_feedback);
 
     TNode<MaybeObject> feedback =
         TryMonomorphicCase(p->slot(), CAST(p->vector()), array_map, &if_handler,
@@ -3472,6 +3611,13 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
     }
   }
 
+  BIND(&no_feedback);
+  {
+    Comment("StoreInArrayLiteralIC_NoFeedback");
+    TailCallBuiltin(Builtins::kSetPropertyInLiteral, p->context(),
+                    p->receiver(), p->name(), p->value());
+  }
+
   BIND(&miss);
   {
     Comment("StoreInArrayLiteralIC_miss");
@@ -3486,10 +3632,10 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
 void AccessorAssembler::GenerateLoadIC() {
   using Descriptor = LoadWithVectorDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
-  Node* vector = Parameter(Descriptor::kVector);
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   LoadICParameters p(context, receiver, name, slot, vector);
@@ -3499,18 +3645,18 @@ void AccessorAssembler::GenerateLoadIC() {
 void AccessorAssembler::GenerateLoadIC_Megamorphic() {
   using Descriptor = LoadWithVectorDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
-  Node* vector = Parameter(Descriptor::kVector);
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   ExitPoint direct_exit(this);
   TVARIABLE(MaybeObject, var_handler);
   Label if_handler(this, &var_handler), miss(this, Label::kDeferred);
 
-  TryProbeStubCache(isolate()->load_stub_cache(), receiver, name, &if_handler,
-                    &var_handler, &miss);
+  TryProbeStubCache(isolate()->load_stub_cache(), receiver, CAST(name),
+                    &if_handler, &var_handler, &miss);
 
   BIND(&if_handler);
   LazyLoadICParameters p([=] { return context; }, receiver,
@@ -3525,7 +3671,7 @@ void AccessorAssembler::GenerateLoadIC_Megamorphic() {
 void AccessorAssembler::GenerateLoadIC_Noninlined() {
   using Descriptor = LoadWithVectorDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
   TNode<FeedbackVector> vector = CAST(Parameter(Descriptor::kVector));
@@ -3556,23 +3702,26 @@ void AccessorAssembler::GenerateLoadIC_Noninlined() {
 }
 
 void AccessorAssembler::GenerateLoadIC_NoFeedback() {
-  using Descriptor = LoadDescriptor;
+  using Descriptor = LoadNoFeedbackDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
-  TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Smi> ic_kind = CAST(Parameter(Descriptor::kICKind));
 
-  LoadICParameters p(context, receiver, name, slot, UndefinedConstant());
-  LoadIC_NoFeedback(&p);
+  LoadICParameters p(
+      context, receiver, name,
+      SmiConstant(static_cast<int>(FeedbackSlot::Invalid().ToInt())),
+      UndefinedConstant());
+  LoadIC_NoFeedback(&p, ic_kind);
 }
 
 void AccessorAssembler::GenerateLoadICTrampoline() {
   using Descriptor = LoadDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
-  Node* slot = Parameter(Descriptor::kSlot);
+  TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
 
@@ -3582,9 +3731,9 @@ void AccessorAssembler::GenerateLoadICTrampoline() {
 void AccessorAssembler::GenerateLoadICTrampoline_Megamorphic() {
   using Descriptor = LoadDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
-  Node* slot = Parameter(Descriptor::kSlot);
+  TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
 
@@ -3592,6 +3741,16 @@ void AccessorAssembler::GenerateLoadICTrampoline_Megamorphic() {
                   vector);
 }
 
+void AccessorAssembler::GenerateLoadGlobalIC_NoFeedback() {
+  using Descriptor = LoadGlobalNoFeedbackDescriptor;
+
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Smi> ic_kind = CAST(Parameter(Descriptor::kICKind));
+
+  LoadGlobalIC_NoFeedback(context, name, ic_kind);
+}
+
 void AccessorAssembler::GenerateLoadGlobalIC(TypeofMode typeof_mode) {
   using Descriptor = LoadGlobalWithVectorDescriptor;
 
@@ -3617,7 +3776,7 @@ void AccessorAssembler::GenerateLoadGlobalICTrampoline(TypeofMode typeof_mode) {
   using Descriptor = LoadGlobalDescriptor;
 
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
-  Node* slot = Parameter(Descriptor::kSlot);
+  TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
 
@@ -3629,10 +3788,10 @@ void AccessorAssembler::GenerateLoadGlobalICTrampoline(TypeofMode typeof_mode) {
 void AccessorAssembler::GenerateKeyedLoadIC() {
   using Descriptor = LoadWithVectorDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
-  Node* vector = Parameter(Descriptor::kVector);
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   LoadICParameters p(context, receiver, name, slot, vector);
@@ -3642,10 +3801,10 @@ void AccessorAssembler::GenerateKeyedLoadIC() {
 void AccessorAssembler::GenerateKeyedLoadIC_Megamorphic() {
   using Descriptor = LoadWithVectorDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
-  Node* vector = Parameter(Descriptor::kVector);
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   LoadICParameters p(context, receiver, name, slot, vector);
@@ -3655,7 +3814,7 @@ void AccessorAssembler::GenerateKeyedLoadIC_Megamorphic() {
 void AccessorAssembler::GenerateKeyedLoadICTrampoline() {
   using Descriptor = LoadDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
@@ -3668,7 +3827,7 @@ void AccessorAssembler::GenerateKeyedLoadICTrampoline() {
 void AccessorAssembler::GenerateKeyedLoadICTrampoline_Megamorphic() {
   using Descriptor = LoadDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
@@ -3681,10 +3840,10 @@ void AccessorAssembler::GenerateKeyedLoadICTrampoline_Megamorphic() {
 void AccessorAssembler::GenerateKeyedLoadIC_PolymorphicName() {
   using Descriptor = LoadWithVectorDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
-  Node* vector = Parameter(Descriptor::kVector);
+  TNode<FeedbackVector> vector = CAST(Parameter(Descriptor::kVector));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   LoadICParameters p(context, receiver, name, slot, vector);
@@ -3695,12 +3854,12 @@ void AccessorAssembler::GenerateStoreGlobalIC() {
   using Descriptor = StoreGlobalWithVectorDescriptor;
 
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
-  Node* value = Parameter(Descriptor::kValue);
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
-  Node* vector = Parameter(Descriptor::kVector);
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
-  StoreICParameters p(context, nullptr, name, value, slot, vector);
+  StoreICParameters p(context, base::nullopt, name, value, slot, vector);
   StoreGlobalIC(&p);
 }
 
@@ -3708,7 +3867,7 @@ void AccessorAssembler::GenerateStoreGlobalICTrampoline() {
   using Descriptor = StoreGlobalDescriptor;
 
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
-  Node* value = Parameter(Descriptor::kValue);
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
@@ -3719,11 +3878,11 @@ void AccessorAssembler::GenerateStoreGlobalICTrampoline() {
 void AccessorAssembler::GenerateStoreIC() {
   using Descriptor = StoreWithVectorDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
-  Node* value = Parameter(Descriptor::kValue);
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
-  Node* vector = Parameter(Descriptor::kVector);
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   StoreICParameters p(context, receiver, name, value, slot, vector);
@@ -3733,9 +3892,9 @@ void AccessorAssembler::GenerateStoreIC() {
 void AccessorAssembler::GenerateStoreICTrampoline() {
   using Descriptor = StoreDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
-  Node* value = Parameter(Descriptor::kValue);
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
@@ -3747,11 +3906,11 @@ void AccessorAssembler::GenerateStoreICTrampoline() {
 void AccessorAssembler::GenerateKeyedStoreIC() {
   using Descriptor = StoreWithVectorDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
-  Node* value = Parameter(Descriptor::kValue);
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
-  Node* vector = Parameter(Descriptor::kVector);
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   StoreICParameters p(context, receiver, name, value, slot, vector);
@@ -3761,9 +3920,9 @@ void AccessorAssembler::GenerateKeyedStoreIC() {
 void AccessorAssembler::GenerateKeyedStoreICTrampoline() {
   using Descriptor = StoreDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
-  Node* value = Parameter(Descriptor::kValue);
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
@@ -3775,11 +3934,11 @@ void AccessorAssembler::GenerateKeyedStoreICTrampoline() {
 void AccessorAssembler::GenerateStoreInArrayLiteralIC() {
   using Descriptor = StoreWithVectorDescriptor;
 
-  Node* array = Parameter(Descriptor::kReceiver);
+  TNode<Object> array = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> index = CAST(Parameter(Descriptor::kName));
-  Node* value = Parameter(Descriptor::kValue);
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
-  Node* vector = Parameter(Descriptor::kVector);
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   StoreICParameters p(context, array, index, value, slot, vector);
@@ -3896,7 +4055,7 @@ void AccessorAssembler::GenerateCloneObjectIC() {
       GotoIf(TaggedIsSmi(source_properties), &allocate_object);
       GotoIf(IsEmptyFixedArray(source_properties), &allocate_object);
 
-      // This IC requires that the source object has fast properties
+      // This IC requires that the source object has fast properties.
       CSA_SLOW_ASSERT(this, IsPropertyArray(CAST(source_properties)));
       TNode<IntPtrT> length = LoadPropertyArrayLength(
           UncheckedCast<PropertyArray>(source_properties));
@@ -4010,10 +4169,10 @@ void AccessorAssembler::GenerateCloneObjectIC() {
 void AccessorAssembler::GenerateKeyedHasIC() {
   using Descriptor = LoadWithVectorDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
-  Node* vector = Parameter(Descriptor::kVector);
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   LoadICParameters p(context, receiver, name, slot, vector);
@@ -4023,7 +4182,7 @@ void AccessorAssembler::GenerateKeyedHasIC() {
 void AccessorAssembler::GenerateKeyedHasIC_Megamorphic() {
   using Descriptor = LoadWithVectorDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   // TODO(magardn): implement HasProperty handling in KeyedLoadICGeneric
@@ -4034,10 +4193,10 @@ void AccessorAssembler::GenerateKeyedHasIC_Megamorphic() {
 void AccessorAssembler::GenerateKeyedHasIC_PolymorphicName() {
   using Descriptor = LoadWithVectorDescriptor;
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> name = CAST(Parameter(Descriptor::kName));
   TNode<Smi> slot = CAST(Parameter(Descriptor::kSlot));
-  Node* vector = Parameter(Descriptor::kVector);
+  TNode<HeapObject> vector = CAST(Parameter(Descriptor::kVector));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   LoadICParameters p(context, receiver, name, slot, vector);
diff --git a/deps/v8/src/ic/accessor-assembler.h b/deps/v8/src/ic/accessor-assembler.h
index ccc2de9323a167..3fb9a533ca6099 100644
--- a/deps/v8/src/ic/accessor-assembler.h
+++ b/deps/v8/src/ic/accessor-assembler.h
@@ -7,6 +7,7 @@
 
 #include "src/base/optional.h"
 #include "src/codegen/code-stub-assembler.h"
+#include "src/compiler/code-assembler.h"
 
 namespace v8 {
 namespace internal {
@@ -28,6 +29,7 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
   void GenerateLoadIC_Megamorphic();
   void GenerateLoadIC_Noninlined();
   void GenerateLoadIC_NoFeedback();
+  void GenerateLoadGlobalIC_NoFeedback();
   void GenerateLoadICTrampoline();
   void GenerateLoadICTrampoline_Megamorphic();
   void GenerateKeyedLoadIC();
@@ -53,26 +55,30 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
 
   void GenerateStoreInArrayLiteralIC();
 
-  void TryProbeStubCache(StubCache* stub_cache, Node* receiver,
-                         TNode<Object> name, Label* if_handler,
+  void TryProbeStubCache(StubCache* stub_cache, TNode<Object> receiver,
+                         TNode<Name> name, Label* if_handler,
                          TVariable<MaybeObject>* var_handler, Label* if_miss);
 
-  Node* StubCachePrimaryOffsetForTesting(Node* name, Node* map) {
+  TNode<IntPtrT> StubCachePrimaryOffsetForTesting(TNode<Name> name,
+                                                  TNode<Map> map) {
     return StubCachePrimaryOffset(name, map);
   }
-  Node* StubCacheSecondaryOffsetForTesting(Node* name, Node* map) {
-    return StubCacheSecondaryOffset(name, map);
+  TNode<IntPtrT> StubCacheSecondaryOffsetForTesting(TNode<Name> name,
+                                                    TNode<IntPtrT> seed) {
+    return StubCacheSecondaryOffset(name, seed);
   }
 
   struct LoadICParameters {
-    LoadICParameters(TNode<Context> context, Node* receiver, TNode<Object> name,
-                     TNode<Smi> slot, Node* vector, Node* holder = nullptr)
+    LoadICParameters(TNode<Context> context,
+                     base::Optional<TNode<Object>> receiver, TNode<Object> name,
+                     TNode<Smi> slot, TNode<HeapObject> vector,
+                     base::Optional<TNode<Object>> holder = base::nullopt)
         : context_(context),
           receiver_(receiver),
           name_(name),
           slot_(slot),
           vector_(vector),
-          holder_(holder ? holder : receiver) {}
+          holder_(holder ? holder.value() : receiver) {}
 
     LoadICParameters(const LoadICParameters* p, TNode<Object> unique_name)
         : context_(p->context_),
@@ -83,31 +89,33 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
           holder_(p->holder_) {}
 
     TNode<Context> context() const { return context_; }
-    Node* receiver() const { return receiver_; }
+    TNode<Object> receiver() const { return receiver_.value(); }
     TNode<Object> name() const { return name_; }
     TNode<Smi> slot() const { return slot_; }
-    Node* vector() const { return vector_; }
-    Node* holder() const { return holder_; }
+    TNode<HeapObject> vector() const { return vector_; }
+    TNode<Object> holder() const { return holder_.value(); }
+    bool receiver_is_null() const { return !receiver_.has_value(); }
 
    private:
     TNode<Context> context_;
-    Node* receiver_;
+    base::Optional<TNode<Object>> receiver_;
     TNode<Object> name_;
     TNode<Smi> slot_;
-    Node* vector_;
-    Node* holder_;
+    TNode<HeapObject> vector_;
+    base::Optional<TNode<Object>> holder_;
   };
 
   struct LazyLoadICParameters {
-    LazyLoadICParameters(LazyNode<Context> context, Node* receiver,
+    LazyLoadICParameters(LazyNode<Context> context, TNode<Object> receiver,
                          LazyNode<Object> name, LazyNode<Smi> slot,
-                         Node* vector, Node* holder = nullptr)
+                         TNode<HeapObject> vector,
+                         base::Optional<TNode<Object>> holder = base::nullopt)
         : context_(context),
           receiver_(receiver),
           name_(name),
           slot_(slot),
           vector_(vector),
-          holder_(holder ? holder : receiver) {}
+          holder_(holder ? holder.value() : receiver) {}
 
     explicit LazyLoadICParameters(const LoadICParameters* p)
         : receiver_(p->receiver()),
@@ -119,19 +127,19 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
     }
 
     TNode<Context> context() const { return context_(); }
-    Node* receiver() const { return receiver_; }
+    TNode<Object> receiver() const { return receiver_; }
     TNode<Object> name() const { return name_(); }
     TNode<Smi> slot() const { return slot_(); }
-    Node* vector() const { return vector_; }
-    Node* holder() const { return holder_; }
+    TNode<HeapObject> vector() const { return vector_; }
+    TNode<Object> holder() const { return holder_; }
 
    private:
     LazyNode<Context> context_;
-    Node* receiver_;
+    TNode<Object> receiver_;
     LazyNode<Object> name_;
     LazyNode<Smi> slot_;
-    Node* vector_;
-    Node* holder_;
+    TNode<HeapObject> vector_;
+    TNode<Object> holder_;
   };
 
   void LoadGlobalIC(TNode<HeapObject> maybe_feedback_vector,
@@ -147,21 +155,22 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
                               ExitPoint* exit_point);
 
   // Loads dataX field from the DataHandler object.
-  TNode<MaybeObject> LoadHandlerDataField(SloppyTNode<DataHandler> handler,
+  TNode<MaybeObject> LoadHandlerDataField(TNode<DataHandler> handler,
                                           int data_index);
 
  protected:
   struct StoreICParameters : public LoadICParameters {
-    StoreICParameters(TNode<Context> context, Node* receiver,
-                      TNode<Object> name, SloppyTNode<Object> value,
-                      TNode<Smi> slot, Node* vector)
+    StoreICParameters(TNode<Context> context,
+                      base::Optional<TNode<Object>> receiver,
+                      TNode<Object> name, TNode<Object> value, TNode<Smi> slot,
+                      TNode<HeapObject> vector)
         : LoadICParameters(context, receiver, name, slot, vector),
           value_(value) {}
 
-    SloppyTNode<Object> value() const { return value_; }
+    TNode<Object> value() const { return value_; }
 
    private:
-    SloppyTNode<Object> value_;
+    TNode<Object> value_;
   };
 
   enum class LoadAccessMode { kLoad, kHas };
@@ -184,9 +193,10 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
   void JumpIfDataProperty(TNode<Uint32T> details, Label* writable,
                           Label* readonly);
 
-  void InvalidateValidityCellIfPrototype(Node* map, Node* bitfield3 = nullptr);
+  void InvalidateValidityCellIfPrototype(
+      TNode<Map> map, base::Optional<TNode<Uint32T>> bitfield3 = base::nullopt);
 
-  void OverwriteExistingFastDataProperty(SloppyTNode<HeapObject> object,
+  void OverwriteExistingFastDataProperty(TNode<HeapObject> object,
                                          TNode<Map> object_map,
                                          TNode<DescriptorArray> descriptors,
                                          TNode<IntPtrT> descriptor_name_index,
@@ -196,7 +206,7 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
 
   void CheckFieldType(TNode<DescriptorArray> descriptors,
                       TNode<IntPtrT> name_index, TNode<Word32T> representation,
-                      Node* value, Label* bailout);
+                      TNode<Object> value, Label* bailout);
 
  private:
   // Stub generation entry points.
@@ -214,7 +224,9 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
   TNode<MaybeObject> LoadDescriptorValueOrFieldType(
       TNode<Map> map, TNode<IntPtrT> descriptor_entry);
 
-  void LoadIC_NoFeedback(const LoadICParameters* p);
+  void LoadIC_NoFeedback(const LoadICParameters* p, TNode<Smi> smi_typeof_mode);
+  void LoadGlobalIC_NoFeedback(TNode<Context> context, TNode<Object> name,
+                               TNode<Smi> smi_typeof_mode);
 
   void KeyedLoadIC(const LoadICParameters* p, LoadAccessMode access_mode);
   void KeyedLoadICGeneric(const LoadICParameters* p);
@@ -222,7 +234,8 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
                                   LoadAccessMode access_mode);
   void StoreIC(const StoreICParameters* p);
   void StoreGlobalIC(const StoreICParameters* p);
-  void StoreGlobalIC_PropertyCellCase(Node* property_cell, TNode<Object> value,
+  void StoreGlobalIC_PropertyCellCase(TNode<PropertyCell> property_cell,
+                                      TNode<Object> value,
                                       ExitPoint* exit_point, Label* miss);
   void KeyedStoreIC(const StoreICParameters* p);
   void StoreInArrayLiteralIC(const StoreICParameters* p);
@@ -246,15 +259,18 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
       ElementSupport support_elements = kOnlyProperties,
       LoadAccessMode access_mode = LoadAccessMode::kLoad);
 
-  void HandleLoadICSmiHandlerCase(
-      const LazyLoadICParameters* p, SloppyTNode<HeapObject> holder,
-      SloppyTNode<Smi> smi_handler, SloppyTNode<Object> handler, Label* miss,
-      ExitPoint* exit_point, ICMode ic_mode, OnNonExistent on_nonexistent,
-      ElementSupport support_elements, LoadAccessMode access_mode);
+  void HandleLoadICSmiHandlerCase(const LazyLoadICParameters* p,
+                                  TNode<Object> holder, TNode<Smi> smi_handler,
+                                  TNode<Object> handler, Label* miss,
+                                  ExitPoint* exit_point, ICMode ic_mode,
+                                  OnNonExistent on_nonexistent,
+                                  ElementSupport support_elements,
+                                  LoadAccessMode access_mode);
 
   void HandleLoadICProtoHandler(const LazyLoadICParameters* p,
                                 TNode<DataHandler> handler,
-                                Variable* var_holder, Variable* var_smi_handler,
+                                TVariable<Object>* var_holder,
+                                TVariable<Object>* var_smi_handler,
                                 Label* if_smi_handler, Label* miss,
                                 ExitPoint* exit_point, ICMode ic_mode,
                                 LoadAccessMode access_mode);
@@ -269,24 +285,23 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
                           TNode<WordT> handler_word, TNode<DataHandler> handler,
                           TNode<IntPtrT> handler_kind, ExitPoint* exit_point);
 
-  void HandleLoadField(SloppyTNode<JSObject> holder, TNode<WordT> handler_word,
-                       Variable* var_double_value, Label* rebox_double,
-                       Label* miss, ExitPoint* exit_point);
+  void HandleLoadField(TNode<JSObject> holder, TNode<WordT> handler_word,
+                       TVariable<Float64T>* var_double_value,
+                       Label* rebox_double, Label* miss, ExitPoint* exit_point);
 
   void EmitAccessCheck(TNode<Context> expected_native_context,
                        TNode<Context> context, TNode<Object> receiver,
                        Label* can_access, Label* miss);
 
   void HandleLoadICSmiHandlerLoadNamedCase(
-      const LazyLoadICParameters* p, TNode<HeapObject> holder,
+      const LazyLoadICParameters* p, TNode<Object> holder,
       TNode<IntPtrT> handler_kind, TNode<WordT> handler_word,
-      Label* rebox_double, Variable* var_double_value,
-      SloppyTNode<Object> handler, Label* miss, ExitPoint* exit_point,
-      ICMode ic_mode, OnNonExistent on_nonexistent,
-      ElementSupport support_elements);
+      Label* rebox_double, TVariable<Float64T>* var_double_value,
+      TNode<Object> handler, Label* miss, ExitPoint* exit_point, ICMode ic_mode,
+      OnNonExistent on_nonexistent, ElementSupport support_elements);
 
   void HandleLoadICSmiHandlerHasNamedCase(const LazyLoadICParameters* p,
-                                          TNode<HeapObject> holder,
+                                          TNode<Object> holder,
                                           TNode<IntPtrT> handler_kind,
                                           Label* miss, ExitPoint* exit_point,
                                           ICMode ic_mode);
@@ -307,15 +322,20 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
                                    TypeofMode typeof_mode,
                                    ExitPoint* exit_point, Label* miss);
 
+  // This is a copy of ScriptContextTable::Lookup. They should be kept in sync.
+  void ScriptContextTableLookup(TNode<Name> name,
+                                TNode<NativeContext> native_context,
+                                Label* found_hole, Label* not_found);
+
   // StoreIC implementation.
 
   void HandleStoreICProtoHandler(const StoreICParameters* p,
                                  TNode<StoreHandler> handler, Label* miss,
                                  ICMode ic_mode,
                                  ElementSupport support_elements);
-  void HandleStoreICSmiHandlerCase(SloppyTNode<Word32T> handler_word,
-                                   SloppyTNode<JSObject> holder,
-                                   SloppyTNode<Object> value, Label* miss);
+  void HandleStoreICSmiHandlerCase(TNode<Word32T> handler_word,
+                                   TNode<JSObject> holder, TNode<Object> value,
+                                   Label* miss);
   void HandleStoreFieldAndReturn(TNode<Word32T> handler_word,
                                  TNode<JSObject> holder, TNode<Object> value,
                                  base::Optional<TNode<Float64T>> double_value,
@@ -324,25 +344,24 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
   void CheckPrototypeValidityCell(TNode<Object> maybe_validity_cell,
                                   Label* miss);
   void HandleStoreICNativeDataProperty(const StoreICParameters* p,
-                                       SloppyTNode<HeapObject> holder,
+                                       TNode<HeapObject> holder,
                                        TNode<Word32T> handler_word);
 
-  void HandleStoreToProxy(const StoreICParameters* p, Node* proxy, Label* miss,
-                          ElementSupport support_elements);
+  void HandleStoreToProxy(const StoreICParameters* p, TNode<JSProxy> proxy,
+                          Label* miss, ElementSupport support_elements);
 
-  void HandleStoreAccessor(const StoreICParameters* p,
-                           SloppyTNode<HeapObject> holder,
+  void HandleStoreAccessor(const StoreICParameters* p, TNode<HeapObject> holder,
                            TNode<Word32T> handler_word);
 
   // KeyedLoadIC_Generic implementation.
 
-  void GenericElementLoad(Node* receiver, TNode<Map> receiver_map,
-                          SloppyTNode<Int32T> instance_type, Node* index,
+  void GenericElementLoad(TNode<HeapObject> receiver, TNode<Map> receiver_map,
+                          TNode<Int32T> instance_type, TNode<IntPtrT> index,
                           Label* slow);
 
   enum UseStubCache { kUseStubCache, kDontUseStubCache };
-  void GenericPropertyLoad(Node* receiver, TNode<Map> receiver_map,
-                           SloppyTNode<Int32T> instance_type,
+  void GenericPropertyLoad(TNode<HeapObject> receiver, TNode<Map> receiver_map,
+                           TNode<Int32T> instance_type,
                            const LoadICParameters* p, Label* slow,
                            UseStubCache use_stub_cache = kUseStubCache);
 
@@ -371,20 +390,21 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
 
   // Extends properties backing store by JSObject::kFieldsAdded elements,
   // returns updated properties backing store.
-  Node* ExtendPropertiesBackingStore(Node* object, Node* index);
-
-  void EmitFastElementsBoundsCheck(Node* object, Node* elements,
-                                   Node* intptr_index,
-                                   Node* is_jsarray_condition, Label* miss);
-  void EmitElementLoad(Node* object, TNode<Word32T> elements_kind,
-                       SloppyTNode<IntPtrT> key, Node* is_jsarray_condition,
+  TNode<PropertyArray> ExtendPropertiesBackingStore(TNode<HeapObject> object,
+                                                    TNode<IntPtrT> index);
+
+  void EmitFastElementsBoundsCheck(TNode<JSObject> object,
+                                   TNode<FixedArrayBase> elements,
+                                   TNode<IntPtrT> intptr_index,
+                                   TNode<BoolT> is_jsarray_condition,
+                                   Label* miss);
+  void EmitElementLoad(TNode<HeapObject> object, TNode<Word32T> elements_kind,
+                       TNode<IntPtrT> key, TNode<BoolT> is_jsarray_condition,
                        Label* if_hole, Label* rebox_double,
-                       Variable* var_double_value,
+                       TVariable<Float64T>* var_double_value,
                        Label* unimplemented_elements_kind, Label* out_of_bounds,
                        Label* miss, ExitPoint* exit_point,
                        LoadAccessMode access_mode = LoadAccessMode::kLoad);
-  void NameDictionaryNegativeLookup(Node* object, SloppyTNode<Name> name,
-                                    Label* miss);
   TNode<BoolT> IsPropertyDetailsConst(TNode<Uint32T> details);
 
   // Stub cache access helpers.
@@ -393,11 +413,12 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
   // including stub cache header.
   enum StubCacheTable : int;
 
-  Node* StubCachePrimaryOffset(Node* name, Node* map);
-  Node* StubCacheSecondaryOffset(Node* name, Node* seed);
+  TNode<IntPtrT> StubCachePrimaryOffset(TNode<Name> name, TNode<Map> map);
+  TNode<IntPtrT> StubCacheSecondaryOffset(TNode<Name> name,
+                                          TNode<IntPtrT> seed);
 
   void TryProbeStubCacheTable(StubCache* stub_cache, StubCacheTable table_id,
-                              Node* entry_offset, TNode<Object> name,
+                              TNode<IntPtrT> entry_offset, TNode<Object> name,
                               TNode<Map> map, Label* if_handler,
                               TVariable<MaybeObject>* var_handler,
                               Label* if_miss);
@@ -417,7 +438,7 @@ class ExitPoint {
   using CodeAssemblerVariable = compiler::CodeAssemblerVariable;
 
  public:
-  using IndirectReturnHandler = std::function<void(Node* result)>;
+  using IndirectReturnHandler = std::function<void(TNode<Object> result)>;
 
   explicit ExitPoint(CodeStubAssembler* assembler)
       : ExitPoint(assembler, nullptr) {}
@@ -427,16 +448,16 @@ class ExitPoint {
       : asm_(assembler), indirect_return_handler_(indirect_return_handler) {}
 
   ExitPoint(CodeStubAssembler* assembler, CodeAssemblerLabel* out,
-            CodeAssemblerVariable* var_result)
-      : ExitPoint(assembler, [=](Node* result) {
-          var_result->Bind(result);
+            compiler::CodeAssembler::TVariable<Object>* var_result)
+      : ExitPoint(assembler, [=](TNode<Object> result) {
+          *var_result = result;
           assembler->Goto(out);
         }) {
     DCHECK_EQ(out != nullptr, var_result != nullptr);
   }
 
   template <class... TArgs>
-  void ReturnCallRuntime(Runtime::FunctionId function, Node* context,
+  void ReturnCallRuntime(Runtime::FunctionId function, TNode<Context> context,
                          TArgs... args) {
     if (IsDirect()) {
       asm_->TailCallRuntime(function, context, args...);
@@ -446,7 +467,8 @@ class ExitPoint {
   }
 
   template <class... TArgs>
-  void ReturnCallStub(Callable const& callable, Node* context, TArgs... args) {
+  void ReturnCallStub(Callable const& callable, TNode<Context> context,
+                      TArgs... args) {
     if (IsDirect()) {
       asm_->TailCallStub(callable, context, args...);
     } else {
@@ -455,8 +477,9 @@ class ExitPoint {
   }
 
   template <class... TArgs>
-  void ReturnCallStub(const CallInterfaceDescriptor& descriptor, Node* target,
-                      Node* context, TArgs... args) {
+  void ReturnCallStub(const CallInterfaceDescriptor& descriptor,
+                      TNode<Code> target, TNode<Context> context,
+                      TArgs... args) {
     if (IsDirect()) {
       asm_->TailCallStub(descriptor, target, context, args...);
     } else {
@@ -465,7 +488,7 @@ class ExitPoint {
     }
   }
 
-  void Return(Node* const result) {
+  void Return(const TNode<Object> result) {
     if (IsDirect()) {
       asm_->Return(result);
     } else {
diff --git a/deps/v8/src/ic/binary-op-assembler.cc b/deps/v8/src/ic/binary-op-assembler.cc
index ee488100e9eb5e..25c2181ab2d5b2 100644
--- a/deps/v8/src/ic/binary-op-assembler.cc
+++ b/deps/v8/src/ic/binary-op-assembler.cc
@@ -236,7 +236,7 @@ TNode<Object> BinaryOpAssembler::Generate_BinaryOperationWithFeedback(
   Label do_float_operation(this), end(this), call_stub(this),
       check_rhsisoddball(this, Label::kDeferred), call_with_any_feedback(this),
       if_lhsisnotnumber(this, Label::kDeferred),
-      if_bigint(this, Label::kDeferred);
+      if_both_bigint(this, Label::kDeferred);
   TVARIABLE(Float64T, var_float_lhs);
   TVARIABLE(Float64T, var_float_rhs);
   TVARIABLE(Smi, var_type_feedback);
@@ -364,7 +364,7 @@ TNode<Object> BinaryOpAssembler::Generate_BinaryOperationWithFeedback(
     BIND(&if_left_bigint);
     {
       GotoIf(TaggedIsSmi(rhs), &call_with_any_feedback);
-      Branch(IsBigInt(CAST(rhs)), &if_bigint, &call_with_any_feedback);
+      Branch(IsBigInt(CAST(rhs)), &if_both_bigint, &call_with_any_feedback);
     }
   }
 
@@ -373,7 +373,6 @@ TNode<Object> BinaryOpAssembler::Generate_BinaryOperationWithFeedback(
     // Check if rhs is an oddball. At this point we know lhs is either a
     // Smi or number or oddball and rhs is not a number or Smi.
     TNode<Uint16T> rhs_instance_type = LoadInstanceType(CAST(rhs));
-    GotoIf(IsBigIntInstanceType(rhs_instance_type), &if_bigint);
     TNode<BoolT> rhs_is_oddball =
         InstanceTypeEqual(rhs_instance_type, ODDBALL_TYPE);
     GotoIfNot(rhs_is_oddball, &call_with_any_feedback);
@@ -382,17 +381,30 @@ TNode<Object> BinaryOpAssembler::Generate_BinaryOperationWithFeedback(
     Goto(&call_stub);
   }
 
-  // This handles the case where at least one input is a BigInt.
-  BIND(&if_bigint);
+  BIND(&if_both_bigint);
   {
     var_type_feedback = SmiConstant(BinaryOperationFeedback::kBigInt);
-    if (op == Operation::kAdd) {
-      var_result = CallBuiltin(Builtins::kBigIntAdd, context, lhs, rhs);
+    if (op == Operation::kSubtract) {
+      Label bigint_too_big(this);
+      var_result =
+          CallBuiltin(Builtins::kBigIntSubtractNoThrow, context, lhs, rhs);
+
+      // Check for sentinel that signals BigIntTooBig exception.
+      GotoIf(TaggedIsSmi(var_result.value()), &bigint_too_big);
+      Goto(&end);
+
+      BIND(&bigint_too_big);
+      {
+        // Update feedback to prevent deopt loop.
+        UpdateFeedback(SmiConstant(BinaryOperationFeedback::kAny),
+                       maybe_feedback_vector, slot_id);
+        ThrowRangeError(context, MessageTemplate::kBigIntTooBig);
+      }
     } else {
       var_result = CallRuntime(Runtime::kBigIntBinaryOp, context, lhs, rhs,
                                SmiConstant(op));
+      Goto(&end);
     }
-    Goto(&end);
   }
 
   BIND(&call_with_any_feedback);
@@ -551,5 +563,85 @@ TNode<Object> BinaryOpAssembler::Generate_ExponentiateWithFeedback(
   return CallBuiltin(Builtins::kExponentiate, context, base, exponent);
 }
 
+TNode<Object> BinaryOpAssembler::Generate_BitwiseBinaryOpWithOptionalFeedback(
+    Operation bitwise_op, TNode<Object> left, TNode<Object> right,
+    TNode<Context> context, TVariable<Smi>* feedback) {
+  TVARIABLE(Object, result);
+  TVARIABLE(Smi, var_left_feedback);
+  TVARIABLE(Smi, var_right_feedback);
+  TVARIABLE(Word32T, var_left_word32);
+  TVARIABLE(Word32T, var_right_word32);
+  TVARIABLE(BigInt, var_left_bigint);
+  TVARIABLE(BigInt, var_right_bigint);
+  // These are the variables that are passed to BigIntBinaryOp. They are not
+  // guaranteed to be BigInts because the Runtime call handles throwing
+  // exceptions when only one side is a BigInt.
+  TVARIABLE(Object, var_left_maybe_bigint, left);
+  TVARIABLE(Numeric, var_right_maybe_bigint);
+  Label done(this);
+  Label if_left_number(this), do_number_op(this);
+  Label if_left_bigint(this), do_bigint_op(this);
+
+  TaggedToWord32OrBigIntWithFeedback(
+      context, left, &if_left_number, &var_left_word32, &if_left_bigint,
+      &var_left_bigint, feedback ? &var_left_feedback : nullptr);
+
+  Label right_is_bigint(this);
+  BIND(&if_left_number);
+  {
+    TaggedToWord32OrBigIntWithFeedback(
+        context, right, &do_number_op, &var_right_word32, &right_is_bigint,
+        &var_right_bigint, feedback ? &var_right_feedback : nullptr);
+  }
+
+  BIND(&right_is_bigint);
+  {
+    // At this point it's guaranteed that the op will fail because the RHS is a
+    // BigInt while the LHS is not, but that's ok because the Runtime call will
+    // throw the exception.
+    var_right_maybe_bigint = var_right_bigint.value();
+    Goto(&do_bigint_op);
+  }
+
+  BIND(&do_number_op);
+  {
+    result = BitwiseOp(var_left_word32.value(), var_right_word32.value(),
+                       bitwise_op);
+
+    if (feedback) {
+      TNode<Smi> result_type = SelectSmiConstant(
+          TaggedIsSmi(result.value()), BinaryOperationFeedback::kSignedSmall,
+          BinaryOperationFeedback::kNumber);
+      TNode<Smi> input_feedback =
+          SmiOr(var_left_feedback.value(), var_right_feedback.value());
+      *feedback = SmiOr(result_type, input_feedback);
+    }
+    Goto(&done);
+  }
+
+  // BigInt cases.
+  BIND(&if_left_bigint);
+  {
+    TaggedToNumericWithFeedback(context, right, &var_right_maybe_bigint,
+                                &var_right_feedback);
+    var_left_maybe_bigint = var_left_bigint.value();
+    Goto(&do_bigint_op);
+  }
+
+  BIND(&do_bigint_op);
+  {
+    if (feedback) {
+      *feedback = SmiOr(var_left_feedback.value(), var_right_feedback.value());
+    }
+    result = CallRuntime(
+        Runtime::kBigIntBinaryOp, context, var_left_maybe_bigint.value(),
+        var_right_maybe_bigint.value(), SmiConstant(bitwise_op));
+    Goto(&done);
+  }
+
+  BIND(&done);
+  return result.value();
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/ic/binary-op-assembler.h b/deps/v8/src/ic/binary-op-assembler.h
index 37484909d42955..79b8cd221b91b9 100644
--- a/deps/v8/src/ic/binary-op-assembler.h
+++ b/deps/v8/src/ic/binary-op-assembler.h
@@ -50,6 +50,23 @@ class BinaryOpAssembler : public CodeStubAssembler {
       TNode<UintPtrT> slot, TNode<HeapObject> maybe_feedback_vector,
       bool rhs_known_smi);
 
+  TNode<Object> Generate_BitwiseBinaryOpWithFeedback(Operation bitwise_op,
+                                                     TNode<Object> left,
+                                                     TNode<Object> right,
+                                                     TNode<Context> context,
+                                                     TVariable<Smi>* feedback) {
+    return Generate_BitwiseBinaryOpWithOptionalFeedback(bitwise_op, left, right,
+                                                        context, feedback);
+  }
+
+  TNode<Object> Generate_BitwiseBinaryOp(Operation bitwise_op,
+                                         TNode<Object> left,
+                                         TNode<Object> right,
+                                         TNode<Context> context) {
+    return Generate_BitwiseBinaryOpWithOptionalFeedback(bitwise_op, left, right,
+                                                        context, nullptr);
+  }
+
  private:
   using SmiOperation =
       std::function<TNode<Object>(TNode<Smi>, TNode<Smi>, TVariable<Smi>*)>;
@@ -61,6 +78,10 @@ class BinaryOpAssembler : public CodeStubAssembler {
       TNode<UintPtrT> slot, TNode<HeapObject> maybe_feedback_vector,
       const SmiOperation& smiOperation, const FloatOperation& floatOperation,
       Operation op, bool rhs_known_smi);
+
+  TNode<Object> Generate_BitwiseBinaryOpWithOptionalFeedback(
+      Operation bitwise_op, TNode<Object> left, TNode<Object> right,
+      TNode<Context> context, TVariable<Smi>* feedback);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/ic/handler-configuration-inl.h b/deps/v8/src/ic/handler-configuration-inl.h
index 95ef3532778777..75bda11cd153a6 100644
--- a/deps/v8/src/ic/handler-configuration-inl.h
+++ b/deps/v8/src/ic/handler-configuration-inl.h
@@ -137,8 +137,10 @@ Handle<Smi> StoreHandler::StoreInterceptor(Isolate* isolate) {
   return handle(Smi::FromInt(config), isolate);
 }
 
-Handle<Smi> StoreHandler::StoreSlow(Isolate* isolate) {
-  int config = KindBits::encode(kSlow);
+Handle<Smi> StoreHandler::StoreSlow(Isolate* isolate,
+                                    KeyedAccessStoreMode store_mode) {
+  int config =
+      KindBits::encode(kSlow) | KeyedAccessStoreModeBits::encode(store_mode);
   return handle(Smi::FromInt(config), isolate);
 }
 
diff --git a/deps/v8/src/ic/handler-configuration.cc b/deps/v8/src/ic/handler-configuration.cc
index 3af5fe495377dc..3a57fc8e4f7457 100644
--- a/deps/v8/src/ic/handler-configuration.cc
+++ b/deps/v8/src/ic/handler-configuration.cc
@@ -176,6 +176,27 @@ KeyedAccessLoadMode LoadHandler::GetKeyedAccessLoadMode(MaybeObject handler) {
   return STANDARD_LOAD;
 }
 
+// static
+KeyedAccessStoreMode StoreHandler::GetKeyedAccessStoreMode(
+    MaybeObject handler) {
+  DisallowHeapAllocation no_gc;
+  if (handler->IsSmi()) {
+    int const raw_handler = handler.ToSmi().value();
+    Kind const kind = KindBits::decode(raw_handler);
+    // All the handlers except the Slow Handler that use the
+    // KeyedAccessStoreMode, compute it using KeyedAccessStoreModeForBuiltin
+    // method. Hence if any other Handler get to this path, just return
+    // STANDARD_STORE.
+    if (kind != kSlow) {
+      return STANDARD_STORE;
+    }
+    KeyedAccessStoreMode store_mode =
+        KeyedAccessStoreModeBits::decode(raw_handler);
+    return store_mode;
+  }
+  return STANDARD_STORE;
+}
+
 // static
 Handle<Object> StoreHandler::StoreElementTransition(
     Isolate* isolate, Handle<Map> receiver_map, Handle<Map> transition,
diff --git a/deps/v8/src/ic/handler-configuration.h b/deps/v8/src/ic/handler-configuration.h
index fd0cee2920602e..a0bef4bfcc666b 100644
--- a/deps/v8/src/ic/handler-configuration.h
+++ b/deps/v8/src/ic/handler-configuration.h
@@ -48,7 +48,7 @@ class LoadHandler final : public DataHandler {
     kNonExistent,
     kModuleExport
   };
-  using KindBits = BitField<Kind, 0, 4>;
+  using KindBits = base::BitField<Kind, 0, 4>;
 
   // Defines whether access rights check should be done on receiver object.
   // Applicable to named property kinds only when loading value from prototype
@@ -206,7 +206,7 @@ class StoreHandler final : public DataHandler {
     kProxy,
     kKindsNumber  // Keep last
   };
-  using KindBits = BitField<Kind, 0, 4>;
+  using KindBits = base::BitField<Kind, 0, 4>;
 
   // Applicable to kGlobalProxy, kProxy kinds.
 
@@ -224,6 +224,13 @@ class StoreHandler final : public DataHandler {
   // Index of a value entry in the descriptor array.
   using DescriptorBits =
       LookupOnReceiverBits::Next<unsigned, kDescriptorIndexBitCount>;
+
+  //
+  // Encodes the bits when StoreSlow contains KeyedAccessStoreMode.
+  //
+  using KeyedAccessStoreModeBits =
+      DescriptorBits::Next<KeyedAccessStoreMode, 2>;
+
   //
   // Encoding when KindBits contains kTransitionToConstant.
   //
@@ -291,11 +298,15 @@ class StoreHandler final : public DataHandler {
   static inline Handle<Smi> StoreInterceptor(Isolate* isolate);
 
   // Creates a Smi-handler for storing a property.
-  static inline Handle<Smi> StoreSlow(Isolate* isolate);
+  static inline Handle<Smi> StoreSlow(
+      Isolate* isolate, KeyedAccessStoreMode store_mode = STANDARD_STORE);
 
   // Creates a Smi-handler for storing a property on a proxy.
   static inline Handle<Smi> StoreProxy(Isolate* isolate);
 
+  // Decodes the KeyedAccessStoreMode from a {handler}.
+  static KeyedAccessStoreMode GetKeyedAccessStoreMode(MaybeObject handler);
+
  private:
   static inline Handle<Smi> StoreField(Isolate* isolate, Kind kind,
                                        int descriptor, FieldIndex field_index,
diff --git a/deps/v8/src/ic/handler-configuration.tq b/deps/v8/src/ic/handler-configuration.tq
new file mode 100644
index 00000000000000..1797db5ddf175e
--- /dev/null
+++ b/deps/v8/src/ic/handler-configuration.tq
@@ -0,0 +1,6 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class LoadHandler extends DataHandler;
+extern class StoreHandler extends DataHandler;
diff --git a/deps/v8/src/ic/ic.cc b/deps/v8/src/ic/ic.cc
index 1b481cd8172b6e..fcfd5a580365b2 100644
--- a/deps/v8/src/ic/ic.cc
+++ b/deps/v8/src/ic/ic.cc
@@ -370,8 +370,9 @@ void IC::ConfigureVectorState(Handle<Name> name, MapHandles const& maps,
   OnFeedbackChanged("Polymorphic");
 }
 
-MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {
-  bool use_ic = (state() != NO_FEEDBACK) && FLAG_use_ic;
+MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name,
+                                 bool update_feedback) {
+  bool use_ic = (state() != NO_FEEDBACK) && FLAG_use_ic && update_feedback;
 
   // If the object is undefined or null it's illegal to try to get any
   // of its properties; throw a TypeError in that case.
@@ -404,15 +405,16 @@ MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {
   JSObject::MakePrototypesFast(object, kStartAtReceiver, isolate());
   update_receiver_map(object);
 
-  LookupIterator it(isolate(), object, name);
+  LookupIterator::Key key(isolate(), name);
+  LookupIterator it(isolate(), object, key);
 
   // Named lookup in the object.
   LookupForRead(&it, IsAnyHas());
 
   if (name->IsPrivate()) {
     if (name->IsPrivateName() && !it.IsFound()) {
-      Handle<String> name_string(String::cast(Symbol::cast(*name).name()),
-                                 isolate());
+      Handle<String> name_string(
+          String::cast(Symbol::cast(*name).description()), isolate());
       return TypeError(MessageTemplate::kInvalidPrivateMemberRead, object,
                        name_string);
     }
@@ -426,7 +428,13 @@ MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {
 
   if (it.IsFound() || !ShouldThrowReferenceError()) {
     // Update inline cache and stub cache.
-    if (use_ic) UpdateCaches(&it);
+    if (use_ic) {
+      UpdateCaches(&it);
+    } else if (state() == NO_FEEDBACK) {
+      // Tracing IC stats
+      IsLoadGlobalIC() ? TraceIC("LoadGlobalIC", name)
+                       : TraceIC("LoadIC", name);
+    }
 
     if (IsAnyHas()) {
       // Named lookup in the object.
@@ -439,8 +447,8 @@ MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {
     // Get the property.
     Handle<Object> result;
 
-    ASSIGN_RETURN_ON_EXCEPTION(isolate(), result, Object::GetProperty(&it),
-                               Object);
+    ASSIGN_RETURN_ON_EXCEPTION(
+        isolate(), result, Object::GetProperty(&it, IsLoadGlobalIC()), Object);
     if (it.IsFound()) {
       return result;
     } else if (!ShouldThrowReferenceError()) {
@@ -451,7 +459,8 @@ MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {
   return ReferenceError(name);
 }
 
-MaybeHandle<Object> LoadGlobalIC::Load(Handle<Name> name) {
+MaybeHandle<Object> LoadGlobalIC::Load(Handle<Name> name,
+                                       bool update_feedback) {
   Handle<JSGlobalObject> global = isolate()->global_object();
 
   if (name->IsString()) {
@@ -472,10 +481,14 @@ MaybeHandle<Object> LoadGlobalIC::Load(Handle<Name> name) {
       if (result->IsTheHole(isolate())) {
         // Do not install stubs and stay pre-monomorphic for
         // uninitialized accesses.
-        return ReferenceError(name);
+        THROW_NEW_ERROR(
+            isolate(),
+            NewReferenceError(MessageTemplate::kAccessedUninitializedVariable,
+                              name),
+            Object);
       }
 
-      bool use_ic = (state() != NO_FEEDBACK) && FLAG_use_ic;
+      bool use_ic = (state() != NO_FEEDBACK) && FLAG_use_ic && update_feedback;
       if (use_ic) {
         if (nexus()->ConfigureLexicalVarMode(
                 lookup_result.context_index, lookup_result.slot_index,
@@ -487,11 +500,13 @@ MaybeHandle<Object> LoadGlobalIC::Load(Handle<Name> name) {
           SetCache(name, LoadHandler::LoadSlow(isolate()));
         }
         TraceIC("LoadGlobalIC", name);
+      } else if (state() == NO_FEEDBACK) {
+        TraceIC("LoadGlobalIC", name);
       }
       return result;
     }
   }
-  return LoadIC::Load(global, name);
+  return LoadIC::Load(global, name, update_feedback);
 }
 
 static bool AddOneReceiverMapIfMissing(MapHandles* receiver_maps,
@@ -659,6 +674,14 @@ void LoadIC::UpdateCaches(LookupIterator* lookup) {
     code = LoadHandler::LoadFullChain(
         isolate(), receiver_map(),
         MaybeObjectHandle(isolate()->factory()->null_value()), smi_handler);
+  } else if (IsLoadGlobalIC() && lookup->state() == LookupIterator::JSPROXY) {
+    // If there is proxy just install the slow stub since we need to call the
+    // HasProperty trap for global loads. The ProxyGetProperty builtin doesn't
+    // handle this case.
+    Handle<Smi> slow_handler = LoadHandler::LoadSlow(isolate());
+    Handle<JSProxy> holder = lookup->GetHolder<JSProxy>();
+    code = LoadHandler::LoadFromPrototype(isolate(), receiver_map(), holder,
+                                          slow_handler);
   } else {
     if (IsLoadGlobalIC()) {
       if (lookup->TryLookupCachedProperty()) {
@@ -675,9 +698,11 @@ void LoadIC::UpdateCaches(LookupIterator* lookup) {
     }
     code = ComputeHandler(lookup);
   }
-
-  SetCache(lookup->name(), code);
-  TraceIC("LoadIC", lookup->name());
+  // Can't use {lookup->name()} because the LookupIterator might be in
+  // "elements" mode for keys that are strings representing integers above
+  // JSArray::kMaxIndex.
+  SetCache(lookup->GetName(), code);
+  TraceIC("LoadIC", lookup->GetName());
 }
 
 StubCache* IC::stub_cache() {
@@ -704,7 +729,7 @@ Handle<Object> LoadIC::ComputeHandler(LookupIterator* lookup) {
   // `in` cannot be called on strings, and will always return true for string
   // wrapper length and function prototypes. The latter two cases are given
   // LoadHandler::LoadNativeDataProperty below.
-  if (!IsAnyHas()) {
+  if (!IsAnyHas() && !lookup->IsElement()) {
     if (receiver->IsString() && *lookup->name() == roots.length_string()) {
       TRACE_HANDLER_STATS(isolate(), LoadIC_StringLength);
       return BUILTIN_CODE(isolate(), LoadIC_StringLength);
@@ -772,10 +797,10 @@ Handle<Object> LoadIC::ComputeHandler(LookupIterator* lookup) {
         Handle<ObjectHashTable> exports(
             Handle<JSModuleNamespace>::cast(holder)->module().exports(),
             isolate());
-        int entry = exports->FindEntry(roots, lookup->name(),
-                                       Smi::ToInt(lookup->name()->GetHash()));
+        InternalIndex entry = exports->FindEntry(
+            roots, lookup->name(), Smi::ToInt(lookup->name()->GetHash()));
         // We found the accessor, so the entry must exist.
-        DCHECK_NE(entry, ObjectHashTable::kNotFound);
+        DCHECK(entry.is_found());
         int index = ObjectHashTable::EntryToValueIndex(entry);
         return LoadHandler::LoadModuleExport(isolate(), index);
       }
@@ -908,7 +933,7 @@ Handle<Object> LoadIC::ComputeHandler(LookupIterator* lookup) {
         Handle<Object> value = lookup->GetDataValue();
 
         if (value->IsThinString()) {
-          value = handle(ThinString::cast(*value)->actual(), isolate());
+          value = handle(ThinString::cast(*value).actual(), isolate());
         }
 
         // Non internalized strings could turn into thin/cons strings
@@ -953,29 +978,6 @@ Handle<Object> LoadIC::ComputeHandler(LookupIterator* lookup) {
   return Handle<Code>::null();
 }
 
-static Handle<Object> TryConvertKey(Handle<Object> key, Isolate* isolate) {
-  // This helper implements a few common fast cases for converting
-  // non-smi keys of keyed loads/stores to a smi or a string.
-  if (key->IsHeapNumber()) {
-    double value = Handle<HeapNumber>::cast(key)->value();
-    if (std::isnan(value)) {
-      key = isolate->factory()->NaN_string();
-    } else {
-      // Check bounds first to avoid undefined behavior in the conversion
-      // to int.
-      if (value <= Smi::kMaxValue && value >= Smi::kMinValue) {
-        int int_value = FastD2I(value);
-        if (value == int_value) {
-          key = handle(Smi::FromInt(int_value), isolate);
-        }
-      }
-    }
-  } else if (key->IsString()) {
-    key = isolate->factory()->InternalizeString(Handle<String>::cast(key));
-  }
-  return key;
-}
-
 bool KeyedLoadIC::CanChangeToAllowOutOfBounds(Handle<Map> receiver_map) {
   const MaybeObjectHandle& handler = nexus()->FindHandlerForMap(receiver_map);
   if (handler.is_null()) return false;
@@ -1111,13 +1113,12 @@ Handle<Object> KeyedLoadIC::LoadElementHandler(Handle<Map> receiver_map,
   InstanceType instance_type = receiver_map->instance_type();
   if (instance_type < FIRST_NONSTRING_TYPE) {
     TRACE_HANDLER_STATS(isolate(), KeyedLoadIC_LoadIndexedStringDH);
-    if (IsAnyHas()) return BUILTIN_CODE(isolate(), HasIC_Slow);
+    if (IsAnyHas()) return LoadHandler::LoadSlow(isolate());
     return LoadHandler::LoadIndexedString(isolate(), load_mode);
   }
   if (instance_type < FIRST_JS_RECEIVER_TYPE) {
     TRACE_HANDLER_STATS(isolate(), KeyedLoadIC_SlowStub);
-    return IsAnyHas() ? BUILTIN_CODE(isolate(), HasIC_Slow)
-                      : BUILTIN_CODE(isolate(), KeyedLoadIC_Slow);
+    return LoadHandler::LoadSlow(isolate());
   }
   if (instance_type == JS_PROXY_TYPE) {
     return LoadHandler::LoadProxy(isolate());
@@ -1177,33 +1178,75 @@ void KeyedLoadIC::LoadElementPolymorphicHandlers(
 
 namespace {
 
-bool ConvertKeyToIndex(Handle<Object> receiver, Handle<Object> key,
-                       uint32_t* index, InlineCacheState state) {
-  if (!FLAG_use_ic || state == NO_FEEDBACK) return false;
-  if (receiver->IsAccessCheckNeeded() || receiver->IsJSPrimitiveWrapper()) {
-    return false;
-  }
+enum KeyType { kIntPtr, kName, kBailout };
 
-  // For regular JSReceiver or String receivers, the {key} must be a positive
-  // array index.
-  if (receiver->IsJSReceiver() || receiver->IsString()) {
-    if (key->ToArrayIndex(index)) return true;
+// The cases where kIntPtr is returned must match what
+// CodeStubAssembler::TryToIntptr can handle!
+KeyType TryConvertKey(Handle<Object> key, Isolate* isolate, intptr_t* index_out,
+                      Handle<Name>* name_out) {
+  if (key->IsSmi()) {
+    *index_out = Smi::ToInt(*key);
+    return kIntPtr;
   }
-  // For JSTypedArray receivers, we can also support negative keys, which we
-  // just map into the [2**31, 2**32 - 1] range via a bit_cast. This is valid
-  // because JSTypedArray::length is always a Smi, so such keys will always
-  // be detected as OOB.
-  if (receiver->IsJSTypedArray()) {
-    int32_t signed_index;
-    if (key->ToInt32(&signed_index)) {
-      *index = bit_cast<uint32_t>(signed_index);
+  if (key->IsHeapNumber()) {
+    double num = HeapNumber::cast(*key).value();
+    if (!(num >= -kMaxSafeInteger)) return kBailout;
+    if (num > kMaxSafeInteger) return kBailout;
+    *index_out = static_cast<intptr_t>(num);
+    if (*index_out != num) return kBailout;
+    return kIntPtr;
+  }
+  if (key->IsString()) {
+    key = isolate->factory()->InternalizeString(Handle<String>::cast(key));
+    uint32_t maybe_array_index;
+    if (String::cast(*key).AsArrayIndex(&maybe_array_index)) {
+      if (maybe_array_index <= INT_MAX) {
+        *index_out = static_cast<intptr_t>(maybe_array_index);
+        return kIntPtr;
+      }
+      // {key} is a string representation of an array index beyond the range
+      // that the IC could handle. Don't try to take the named-property path.
+      return kBailout;
+    }
+    *name_out = Handle<String>::cast(key);
+    return kName;
+  }
+  if (key->IsSymbol()) {
+    *name_out = Handle<Symbol>::cast(key);
+    return kName;
+  }
+  return kBailout;
+}
+
+bool IntPtrKeyToSize(intptr_t index, Handle<HeapObject> receiver, size_t* out) {
+  if (index < 0) {
+    if (receiver->IsJSTypedArray()) {
+      // For JSTypedArray receivers, we can support negative keys, which we
+      // just map to a very large value. This is valid because all OOB accesses
+      // (negative or positive) are handled the same way, and size_t::max is
+      // guaranteed to be an OOB access.
+      *out = std::numeric_limits<size_t>::max();
       return true;
     }
+    return false;
   }
-  return false;
+#if V8_HOST_ARCH_64_BIT
+  // On 32-bit platforms, any intptr_t is less than kMaxArrayIndex.
+  if (index > JSArray::kMaxArrayIndex && !receiver->IsJSTypedArray()) {
+    return false;
+  }
+#endif
+  *out = static_cast<size_t>(index);
+  return true;
 }
 
-bool IsOutOfBoundsAccess(Handle<Object> receiver, uint32_t index) {
+bool CanCache(Handle<Object> receiver, InlineCacheState state) {
+  if (!FLAG_use_ic || state == NO_FEEDBACK) return false;
+  if (!receiver->IsJSReceiver() && !receiver->IsString()) return false;
+  return !receiver->IsAccessCheckNeeded() && !receiver->IsJSPrimitiveWrapper();
+}
+
+bool IsOutOfBoundsAccess(Handle<Object> receiver, size_t index) {
   size_t length;
   if (receiver->IsJSArray()) {
     length = JSArray::cast(*receiver).length().Number();
@@ -1220,7 +1263,7 @@ bool IsOutOfBoundsAccess(Handle<Object> receiver, uint32_t index) {
 }
 
 KeyedAccessLoadMode GetLoadMode(Isolate* isolate, Handle<Object> receiver,
-                                uint32_t index) {
+                                size_t index) {
   if (IsOutOfBoundsAccess(receiver, index)) {
     DCHECK(receiver->IsHeapObject());
     Handle<Map> receiver_map(Handle<HeapObject>::cast(receiver)->map(),
@@ -1259,18 +1302,17 @@ MaybeHandle<Object> KeyedLoadIC::Load(Handle<Object> object,
 
   Handle<Object> load_handle;
 
-  // Check for non-string values that can be converted into an
-  // internalized string directly or is representable as a smi.
-  key = TryConvertKey(key, isolate());
+  intptr_t maybe_index;
+  size_t index;
+  Handle<Name> maybe_name;
+  KeyType key_type = TryConvertKey(key, isolate(), &maybe_index, &maybe_name);
 
-  uint32_t index;
-  if ((key->IsInternalizedString() &&
-       !String::cast(*key).AsArrayIndex(&index)) ||
-      key->IsSymbol()) {
+  if (key_type == kName) {
     ASSIGN_RETURN_ON_EXCEPTION(isolate(), load_handle,
-                               LoadIC::Load(object, Handle<Name>::cast(key)),
-                               Object);
-  } else if (ConvertKeyToIndex(object, key, &index, state())) {
+                               LoadIC::Load(object, maybe_name), Object);
+  } else if (key_type == kIntPtr && CanCache(object, state()) &&
+             IntPtrKeyToSize(maybe_index, Handle<HeapObject>::cast(object),
+                             &index)) {
     KeyedAccessLoadMode load_mode = GetLoadMode(isolate(), object, index);
     UpdateLoadElement(Handle<HeapObject>::cast(object), load_mode);
     if (is_vector_set()) {
@@ -1382,7 +1424,11 @@ MaybeHandle<Object> StoreGlobalIC::Store(Handle<Name> name,
     if (previous_value->IsTheHole(isolate())) {
       // Do not install stubs and stay pre-monomorphic for
       // uninitialized accesses.
-      return ReferenceError(name);
+      THROW_NEW_ERROR(
+          isolate(),
+          NewReferenceError(MessageTemplate::kAccessedUninitializedVariable,
+                            name),
+          Object);
     }
 
     bool use_ic = (state() != NO_FEEDBACK) && FLAG_use_ic;
@@ -1397,8 +1443,9 @@ MaybeHandle<Object> StoreGlobalIC::Store(Handle<Name> name,
         SetCache(name, StoreHandler::StoreSlow(isolate()));
       }
       TraceIC("StoreGlobalIC", name);
+    } else if (state() == NO_FEEDBACK) {
+      TraceIC("StoreGlobalIC", name);
     }
-
     script_context->set(lookup_result.slot_index, *value);
     return value;
   }
@@ -1434,12 +1481,13 @@ MaybeHandle<Object> StoreIC::Store(Handle<Object> object, Handle<Name> name,
   }
 
   JSObject::MakePrototypesFast(object, kStartAtPrototype, isolate());
-  LookupIterator it(isolate(), object, name);
+  LookupIterator::Key key(isolate(), name);
+  LookupIterator it(isolate(), object, key);
 
   if (name->IsPrivate()) {
     if (name->IsPrivateName() && !it.IsFound()) {
-      Handle<String> name_string(String::cast(Symbol::cast(*name).name()),
-                                 isolate());
+      Handle<String> name_string(
+          String::cast(Symbol::cast(*name).description()), isolate());
       return TypeError(MessageTemplate::kInvalidPrivateMemberWrite, object,
                        name_string);
     }
@@ -1450,7 +1498,13 @@ MaybeHandle<Object> StoreIC::Store(Handle<Object> object, Handle<Name> name,
       use_ic = false;
     }
   }
-  if (use_ic) UpdateCaches(&it, value, store_origin);
+  if (use_ic) {
+    UpdateCaches(&it, value, store_origin);
+  } else if (state() == NO_FEEDBACK) {
+    // Tracing IC Stats for No Feedback State.
+    IsStoreGlobalIC() ? TraceIC("StoreGlobalIC", name)
+                      : TraceIC("StoreIC", name);
+  }
 
   MAYBE_RETURN_NULL(Object::SetProperty(&it, value, store_origin));
   return value;
@@ -1466,7 +1520,7 @@ void StoreIC::UpdateCaches(LookupIterator* lookup, Handle<Object> value,
         DCHECK(lookup->GetReceiver()->IsJSGlobalObject());
         // Now update the cell in the feedback vector.
         nexus()->ConfigurePropertyCellMode(lookup->GetPropertyCell());
-        TraceIC("StoreGlobalIC", lookup->name());
+        TraceIC("StoreGlobalIC", lookup->GetName());
         return;
       }
     }
@@ -1475,9 +1529,11 @@ void StoreIC::UpdateCaches(LookupIterator* lookup, Handle<Object> value,
     set_slow_stub_reason("LookupForWrite said 'false'");
     handler = MaybeObjectHandle(StoreHandler::StoreSlow(isolate()));
   }
-
-  SetCache(lookup->name(), handler);
-  TraceIC("StoreIC", lookup->name());
+  // Can't use {lookup->name()} because the LookupIterator might be in
+  // "elements" mode for keys that are strings representing integers above
+  // JSArray::kMaxIndex.
+  SetCache(lookup->GetName(), handler);
+  TraceIC("StoreIC", lookup->GetName());
 }
 
 MaybeObjectHandle StoreIC::ComputeHandler(LookupIterator* lookup) {
@@ -1516,13 +1572,13 @@ MaybeObjectHandle StoreIC::ComputeHandler(LookupIterator* lookup) {
       Handle<JSObject> holder = lookup->GetHolder<JSObject>();
       InterceptorInfo info = holder->GetNamedInterceptor();
 
-      // If the interceptor is on the receiver
+      // If the interceptor is on the receiver...
       if (lookup->HolderIsReceiverOrHiddenPrototype() && !info.non_masking()) {
-        // return a store interceptor smi handler if there is one,
+        // ...return a store interceptor Smi handler if there is one...
         if (!info.setter().IsUndefined(isolate())) {
           return MaybeObjectHandle(StoreHandler::StoreInterceptor(isolate()));
         }
-        // otherwise return a slow-case smi handler.
+        // ...otherwise return a slow-case Smi handler.
         return MaybeObjectHandle(StoreHandler::StoreSlow(isolate()));
       }
 
@@ -1835,7 +1891,7 @@ Handle<Object> KeyedStoreIC::StoreElementHandler(
   }
 
   // TODO(ishell): move to StoreHandler::StoreElement().
-  Handle<Code> code;
+  Handle<Object> code;
   if (receiver_map->has_sloppy_arguments_elements()) {
     // TODO(jgruber): Update counter name.
     TRACE_HANDLER_STATS(isolate(), KeyedStoreIC_KeyedStoreSloppyArgumentsStub);
@@ -1851,18 +1907,16 @@ Handle<Object> KeyedStoreIC::StoreElementHandler(
   } else if (IsStoreInArrayLiteralICKind(kind())) {
     // TODO(jgruber): Update counter name.
     TRACE_HANDLER_STATS(isolate(), StoreInArrayLiteralIC_SlowStub);
-    code =
-        CodeFactory::StoreInArrayLiteralIC_Slow(isolate(), store_mode).code();
+    return StoreHandler::StoreSlow(isolate(), store_mode);
   } else {
     // TODO(jgruber): Update counter name.
     TRACE_HANDLER_STATS(isolate(), KeyedStoreIC_StoreElementStub);
     DCHECK(DICTIONARY_ELEMENTS == receiver_map->elements_kind() ||
            receiver_map->has_frozen_elements());
-    code = CodeFactory::KeyedStoreIC_Slow(isolate(), store_mode).code();
+    code = StoreHandler::StoreSlow(isolate(), store_mode);
   }
 
   if (IsStoreInArrayLiteralICKind(kind())) return code;
-
   Handle<Object> validity_cell =
       Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
   if (validity_cell->IsSmi()) {
@@ -1939,12 +1993,13 @@ bool MayHaveTypedArrayInPrototypeChain(Handle<JSObject> object) {
   return false;
 }
 
-KeyedAccessStoreMode GetStoreMode(Handle<JSObject> receiver, uint32_t index) {
+KeyedAccessStoreMode GetStoreMode(Handle<JSObject> receiver, size_t index) {
   bool oob_access = IsOutOfBoundsAccess(receiver, index);
   // Don't consider this a growing store if the store would send the receiver to
   // dictionary mode.
-  bool allow_growth = receiver->IsJSArray() && oob_access &&
-                      !receiver->WouldConvertToSlowElements(index);
+  bool allow_growth =
+      receiver->IsJSArray() && oob_access && index <= JSArray::kMaxArrayIndex &&
+      !receiver->WouldConvertToSlowElements(static_cast<uint32_t>(index));
   if (allow_growth) {
     return STORE_AND_GROW_HANDLE_COW;
   }
@@ -1971,20 +2026,17 @@ MaybeHandle<Object> KeyedStoreIC::Store(Handle<Object> object,
     return result;
   }
 
-  // Check for non-string values that can be converted into an
-  // internalized string directly or is representable as a smi.
-  key = TryConvertKey(key, isolate());
-
   Handle<Object> store_handle;
 
-  uint32_t index;
-  if ((key->IsInternalizedString() &&
-       !String::cast(*key).AsArrayIndex(&index)) ||
-      key->IsSymbol()) {
-    ASSIGN_RETURN_ON_EXCEPTION(isolate(), store_handle,
-                               StoreIC::Store(object, Handle<Name>::cast(key),
-                                              value, StoreOrigin::kMaybeKeyed),
-                               Object);
+  intptr_t maybe_index;
+  Handle<Name> maybe_name;
+  KeyType key_type = TryConvertKey(key, isolate(), &maybe_index, &maybe_name);
+
+  if (key_type == kName) {
+    ASSIGN_RETURN_ON_EXCEPTION(
+        isolate(), store_handle,
+        StoreIC::Store(object, maybe_name, value, StoreOrigin::kMaybeKeyed),
+        Object);
     if (vector_needs_update()) {
       if (ConfigureVectorState(MEGAMORPHIC, key)) {
         set_slow_stub_reason("unhandled internalized string key");
@@ -1996,6 +2048,7 @@ MaybeHandle<Object> KeyedStoreIC::Store(Handle<Object> object,
 
   JSObject::MakePrototypesFast(object, kStartAtPrototype, isolate());
 
+  // TODO(jkummerow): Refactor the condition logic here and below.
   bool use_ic = (state() != NO_FEEDBACK) && FLAG_use_ic &&
                 !object->IsStringWrapper() && !object->IsAccessCheckNeeded() &&
                 !object->IsJSGlobalProxy();
@@ -2012,23 +2065,17 @@ MaybeHandle<Object> KeyedStoreIC::Store(Handle<Object> object,
 
   Handle<Map> old_receiver_map;
   bool is_arguments = false;
-  bool key_is_valid_index = false;
+  bool key_is_valid_index = (key_type == kIntPtr);
   KeyedAccessStoreMode store_mode = STANDARD_STORE;
-  if (use_ic && object->IsJSReceiver()) {
+  if (use_ic && object->IsJSReceiver() && key_is_valid_index) {
     Handle<JSReceiver> receiver = Handle<JSReceiver>::cast(object);
     old_receiver_map = handle(receiver->map(), isolate());
     is_arguments = receiver->IsJSArgumentsObject();
     bool is_proxy = receiver->IsJSProxy();
-    // For JSTypedArray {object}s we can handle negative indices as OOB
-    // accesses, since integer indexed properties are never looked up
-    // on the prototype chain. For this we simply map the negative {key}s
-    // to the [2**31,2**32-1] range, which is safe since JSTypedArray::length
-    // is always an unsigned Smi.
-    key_is_valid_index =
-        key->IsSmi() && (Smi::ToInt(*key) >= 0 || object->IsJSTypedArray());
+    size_t index;
+    key_is_valid_index = IntPtrKeyToSize(maybe_index, receiver, &index);
     if (!is_arguments && !is_proxy) {
       if (key_is_valid_index) {
-        uint32_t index = static_cast<uint32_t>(Smi::ToInt(*key));
         Handle<JSObject> receiver_object = Handle<JSObject>::cast(object);
         store_mode = GetStoreMode(receiver_object, index);
       }
@@ -2091,10 +2138,8 @@ namespace {
 void StoreOwnElement(Isolate* isolate, Handle<JSArray> array,
                      Handle<Object> index, Handle<Object> value) {
   DCHECK(index->IsNumber());
-  bool success = false;
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, array, index, &success, LookupIterator::OWN);
-  DCHECK(success);
+  LookupIterator::Key key(isolate, index);
+  LookupIterator it(isolate, array, key, LookupIterator::OWN);
 
   CHECK(JSObject::DefineOwnPropertyIgnoreAttributes(
             &it, value, NONE, Just(ShouldThrow::kThrowOnError))
@@ -2151,24 +2196,13 @@ RUNTIME_FUNCTION(Runtime_LoadIC_Miss) {
   Handle<Object> receiver = args.at(0);
   Handle<Name> key = args.at<Name>(1);
   Handle<Smi> slot = args.at<Smi>(2);
-  Handle<HeapObject> maybe_vector = args.at<HeapObject>(3);
+  Handle<FeedbackVector> vector = args.at<FeedbackVector>(3);
   FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
 
-  Handle<FeedbackVector> vector = Handle<FeedbackVector>();
-  if (!maybe_vector->IsUndefined()) {
-    DCHECK(maybe_vector->IsFeedbackVector());
-    vector = Handle<FeedbackVector>::cast(maybe_vector);
-  }
   // A monomorphic or polymorphic KeyedLoadIC with a string key can call the
   // LoadIC miss handler if the handler misses. Since the vector Nexus is
   // set up outside the IC, handle that here.
-  // The only case where we call without a vector is from the LoadNamedProperty
-  // bytecode handler. Also, when there is no feedback vector, there is no
-  // difference between LoadProperty or LoadKeyed kind.
-  FeedbackSlotKind kind = FeedbackSlotKind::kLoadProperty;
-  if (!vector.is_null()) {
-    kind = vector->GetKind(vector_slot);
-  }
+  FeedbackSlotKind kind = vector->GetKind(vector_slot);
   if (IsLoadICKind(kind)) {
     LoadIC ic(isolate, vector, vector_slot, kind);
     ic.UpdateState(receiver, key);
@@ -2189,6 +2223,24 @@ RUNTIME_FUNCTION(Runtime_LoadIC_Miss) {
   }
 }
 
+RUNTIME_FUNCTION(Runtime_LoadNoFeedbackIC_Miss) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(3, args.length());
+  // Runtime functions don't follow the IC's calling convention.
+  Handle<Object> receiver = args.at(0);
+  Handle<Name> key = args.at<Name>(1);
+  CONVERT_INT32_ARG_CHECKED(slot_kind, 2);
+  FeedbackSlotKind kind = static_cast<FeedbackSlotKind>(slot_kind);
+
+  Handle<FeedbackVector> vector = Handle<FeedbackVector>();
+  FeedbackSlot vector_slot = FeedbackSlot::Invalid();
+  // This function is only called after looking up in the ScriptContextTable so
+  // it is safe to call LoadIC::Load for global loads as well.
+  LoadIC ic(isolate, vector, vector_slot, kind);
+  ic.UpdateState(receiver, key);
+  RETURN_RESULT_OR_FAILURE(isolate, ic.Load(receiver, key));
+}
+
 RUNTIME_FUNCTION(Runtime_LoadGlobalIC_Miss) {
   HandleScope scope(isolate);
   DCHECK_EQ(4, args.length());
@@ -2223,42 +2275,14 @@ RUNTIME_FUNCTION(Runtime_LoadGlobalIC_Slow) {
   DCHECK_EQ(3, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, name, 0);
 
-  Handle<Context> native_context = isolate->native_context();
-  Handle<ScriptContextTable> script_contexts(
-      native_context->script_context_table(), isolate);
-
-  ScriptContextTable::LookupResult lookup_result;
-  if (ScriptContextTable::Lookup(isolate, *script_contexts, *name,
-                                 &lookup_result)) {
-    Handle<Context> script_context = ScriptContextTable::GetContext(
-        isolate, script_contexts, lookup_result.context_index);
-    Handle<Object> result(script_context->get(lookup_result.slot_index),
-                          isolate);
-    if (*result == ReadOnlyRoots(isolate).the_hole_value()) {
-      THROW_NEW_ERROR_RETURN_FAILURE(
-          isolate, NewReferenceError(MessageTemplate::kNotDefined, name));
-    }
-    return *result;
-  }
+  Handle<Smi> slot = args.at<Smi>(1);
+  Handle<FeedbackVector> vector = args.at<FeedbackVector>(2);
+  FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
+  FeedbackSlotKind kind = vector->GetKind(vector_slot);
 
-  Handle<JSGlobalObject> global(native_context->global_object(), isolate);
+  LoadGlobalIC ic(isolate, vector, vector_slot, kind);
   Handle<Object> result;
-  bool is_found = false;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, result,
-      Runtime::GetObjectProperty(isolate, global, name, &is_found));
-  if (!is_found) {
-    Handle<Smi> slot = args.at<Smi>(1);
-    Handle<FeedbackVector> vector = args.at<FeedbackVector>(2);
-    FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
-    FeedbackSlotKind kind = vector->GetKind(vector_slot);
-    // It is actually a LoadGlobalICs here but the predicate handles this case
-    // properly.
-    if (LoadIC::ShouldThrowReferenceError(kind)) {
-      THROW_NEW_ERROR_RETURN_FAILURE(
-          isolate, NewReferenceError(MessageTemplate::kNotDefined, name));
-    }
-  }
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result, ic.Load(name, false));
   return *result;
 }
 
@@ -2383,7 +2407,8 @@ RUNTIME_FUNCTION(Runtime_StoreGlobalIC_Slow) {
 
     if (previous_value->IsTheHole(isolate)) {
       THROW_NEW_ERROR_RETURN_FAILURE(
-          isolate, NewReferenceError(MessageTemplate::kNotDefined, name));
+          isolate, NewReferenceError(
+                       MessageTemplate::kAccessedUninitializedVariable, name));
     }
 
     script_context->set(lookup_result.slot_index, *value);
@@ -2687,7 +2712,7 @@ RUNTIME_FUNCTION(Runtime_LoadPropertyWithInterceptor) {
 
   if (!result.is_null()) return *result;
 
-  LookupIterator it(receiver, name, holder);
+  LookupIterator it(isolate, receiver, name, holder);
   // Skip any lookup work until we hit the (possibly non-masking) interceptor.
   while (it.state() != LookupIterator::INTERCEPTOR ||
          !it.GetHolder<JSObject>().is_identical_to(holder)) {
@@ -2744,7 +2769,7 @@ RUNTIME_FUNCTION(Runtime_StorePropertyWithInterceptor) {
   RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);
   if (!result.is_null()) return *value;
 
-  LookupIterator it(receiver, name, receiver);
+  LookupIterator it(isolate, receiver, name, receiver);
   // Skip past any access check on the receiver.
   if (it.state() == LookupIterator::ACCESS_CHECK) {
     DCHECK(it.HasAccess());
diff --git a/deps/v8/src/ic/ic.h b/deps/v8/src/ic/ic.h
index a3c68f4fbf991f..6e17517dcce32c 100644
--- a/deps/v8/src/ic/ic.h
+++ b/deps/v8/src/ic/ic.h
@@ -183,7 +183,8 @@ class LoadIC : public IC {
   }
 
   V8_WARN_UNUSED_RESULT MaybeHandle<Object> Load(Handle<Object> object,
-                                                 Handle<Name> name);
+                                                 Handle<Name> name,
+                                                 bool update_feedback = true);
 
  protected:
   // Update the inline cache and the global stub cache based on the
@@ -203,7 +204,8 @@ class LoadGlobalIC : public LoadIC {
                FeedbackSlot slot, FeedbackSlotKind kind)
       : LoadIC(isolate, vector, slot, kind) {}
 
-  V8_WARN_UNUSED_RESULT MaybeHandle<Object> Load(Handle<Name> name);
+  V8_WARN_UNUSED_RESULT MaybeHandle<Object> Load(Handle<Name> name,
+                                                 bool update_feedback = true);
 };
 
 class KeyedLoadIC : public LoadIC {
diff --git a/deps/v8/src/ic/keyed-store-generic.cc b/deps/v8/src/ic/keyed-store-generic.cc
index ff830a022e5b34..5d8ea71bcd9443 100644
--- a/deps/v8/src/ic/keyed-store-generic.cc
+++ b/deps/v8/src/ic/keyed-store-generic.cc
@@ -72,8 +72,8 @@ class KeyedStoreGenericAssembler : public AccessorAssembler {
                                 ExitPoint* exit_point, Label* slow,
                                 Maybe<LanguageMode> maybe_language_mode);
 
-  void EmitGenericPropertyStore(SloppyTNode<JSReceiver> receiver,
-                                SloppyTNode<Map> receiver_map,
+  void EmitGenericPropertyStore(TNode<JSReceiver> receiver,
+                                TNode<Map> receiver_map,
                                 const StoreICParameters* p, Label* slow) {
     ExitPoint direct_exit(this);
     EmitGenericPropertyStore(receiver, receiver_map, p, &direct_exit, slow,
@@ -92,9 +92,9 @@ class KeyedStoreGenericAssembler : public AccessorAssembler {
 
   void StoreElementWithCapacity(TNode<JSObject> receiver,
                                 TNode<Map> receiver_map,
-                                SloppyTNode<FixedArrayBase> elements,
+                                TNode<FixedArrayBase> elements,
                                 TNode<Word32T> elements_kind,
-                                TNode<IntPtrT> index, SloppyTNode<Object> value,
+                                TNode<IntPtrT> index, TNode<Object> value,
                                 TNode<Context> context, Label* slow,
                                 UpdateLength update_length);
 
@@ -254,8 +254,8 @@ void KeyedStoreGenericAssembler::TryChangeToHoleyMapHelper(
   if (AllocationSite::ShouldTrack(packed_kind, holey_kind)) {
     TrapAllocationMemento(receiver, bailout);
   }
-  TNode<Object> holey_map =
-      LoadContextElement(native_context, Context::ArrayMapIndex(holey_kind));
+  TNode<Map> holey_map = CAST(
+      LoadContextElement(native_context, Context::ArrayMapIndex(holey_kind)));
   StoreMap(receiver, holey_map);
   Goto(done);
 }
@@ -304,20 +304,19 @@ void KeyedStoreGenericAssembler::MaybeUpdateLengthAndReturn(
     UpdateLength update_length) {
   if (update_length != kDontChangeLength) {
     TNode<Smi> new_length = SmiTag(Signed(IntPtrAdd(index, IntPtrConstant(1))));
-    StoreObjectFieldNoWriteBarrier(receiver, JSArray::kLengthOffset, new_length,
-                                   MachineRepresentation::kTagged);
+    StoreObjectFieldNoWriteBarrier(receiver, JSArray::kLengthOffset,
+                                   new_length);
   }
   Return(value);
 }
 
 void KeyedStoreGenericAssembler::StoreElementWithCapacity(
     TNode<JSObject> receiver, TNode<Map> receiver_map,
-    SloppyTNode<FixedArrayBase> elements, TNode<Word32T> elements_kind,
-    TNode<IntPtrT> index, SloppyTNode<Object> value, TNode<Context> context,
+    TNode<FixedArrayBase> elements, TNode<Word32T> elements_kind,
+    TNode<IntPtrT> index, TNode<Object> value, TNode<Context> context,
     Label* slow, UpdateLength update_length) {
   if (update_length != kDontChangeLength) {
-    CSA_ASSERT(this, InstanceTypeEqual(LoadMapInstanceType(receiver_map),
-                                       JS_ARRAY_TYPE));
+    CSA_ASSERT(this, IsJSArrayMap(receiver_map));
     // Check if the length property is writable. The fast check is only
     // supported for fast properties.
     GotoIf(IsDictionaryMap(receiver_map), slow);
@@ -333,27 +332,28 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
 
   Label check_double_elements(this), check_cow_elements(this);
   TNode<Map> elements_map = LoadMap(elements);
-  GotoIf(TaggedNotEqual(elements_map, FixedArrayMapConstant()),
-         &check_double_elements);
+  GotoIf(IsNotFixedArrayMap(elements_map), &check_double_elements);
 
   // FixedArray backing store -> Smi or object elements.
   {
     TNode<IntPtrT> offset =
         ElementOffsetFromIndex(index, PACKED_ELEMENTS, kHeaderSize);
-    // Check if we're about to overwrite the hole. We can safely do that
-    // only if there can be no setters on the prototype chain.
-    // If we know that we're storing beyond the previous array length, we
-    // can skip the hole check (and always assume the hole).
-    {
-      Label hole_check_passed(this);
-      if (update_length == kDontChangeLength) {
-        TNode<Object> element =
-            CAST(Load(MachineType::AnyTagged(), elements, offset));
-        GotoIf(TaggedNotEqual(element, TheHoleConstant()), &hole_check_passed);
+    if (!IsStoreInLiteral()) {
+      // Check if we're about to overwrite the hole. We can safely do that
+      // only if there can be no setters on the prototype chain.
+      // If we know that we're storing beyond the previous array length, we
+      // can skip the hole check (and always assume the hole).
+      {
+        Label hole_check_passed(this);
+        if (update_length == kDontChangeLength) {
+          TNode<Object> element =
+              CAST(Load(MachineType::AnyTagged(), elements, offset));
+          GotoIf(IsNotTheHole(element), &hole_check_passed);
+        }
+        BranchIfPrototypesHaveNonFastElements(receiver_map, slow,
+                                              &hole_check_passed);
+        BIND(&hole_check_passed);
       }
-      BranchIfPrototypesHaveNonFastElements(receiver_map, slow,
-                                            &hole_check_passed);
-      BIND(&hole_check_passed);
     }
 
     // Check if the value we're storing matches the elements_kind. Smis
@@ -395,8 +395,8 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
     {
       Label transition_to_double(this), transition_to_object(this);
       TNode<NativeContext> native_context = LoadNativeContext(context);
-      Branch(TaggedEqual(LoadMap(CAST(value)), HeapNumberMapConstant()),
-             &transition_to_double, &transition_to_object);
+      Branch(IsHeapNumber(CAST(value)), &transition_to_double,
+             &transition_to_object);
       BIND(&transition_to_double);
       {
         // If we're adding holes at the end, always transition to a holey
@@ -436,29 +436,30 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
   }
 
   BIND(&check_double_elements);
-  TNode<Map> fixed_double_array_map = FixedDoubleArrayMapConstant();
-  GotoIf(TaggedNotEqual(elements_map, fixed_double_array_map),
-         &check_cow_elements);
+  GotoIf(IsNotFixedDoubleArrayMap(elements_map), &check_cow_elements);
   // FixedDoubleArray backing store -> double elements.
   {
     TNode<IntPtrT> offset =
         ElementOffsetFromIndex(index, PACKED_DOUBLE_ELEMENTS, kHeaderSize);
-    // Check if we're about to overwrite the hole. We can safely do that
-    // only if there can be no setters on the prototype chain.
-    {
-      Label hole_check_passed(this);
-      // If we know that we're storing beyond the previous array length, we
-      // can skip the hole check (and always assume the hole).
-      if (update_length == kDontChangeLength) {
-        Label found_hole(this);
-        LoadDoubleWithHoleCheck(elements, offset, &found_hole,
-                                MachineType::None());
-        Goto(&hole_check_passed);
-        BIND(&found_hole);
+    if (!IsStoreInLiteral()) {
+      // Check if we're about to overwrite the hole. We can safely do that
+      // Check if we're about to overwrite the hole. We can safely do that
+      // only if there can be no setters on the prototype chain.
+      {
+        Label hole_check_passed(this);
+        // If we know that we're storing beyond the previous array length, we
+        // can skip the hole check (and always assume the hole).
+        if (update_length == kDontChangeLength) {
+          Label found_hole(this);
+          LoadDoubleWithHoleCheck(elements, offset, &found_hole,
+                                  MachineType::None());
+          Goto(&hole_check_passed);
+          BIND(&found_hole);
+        }
+        BranchIfPrototypesHaveNonFastElements(receiver_map, slow,
+                                              &hole_check_passed);
+        BIND(&hole_check_passed);
       }
-      BranchIfPrototypesHaveNonFastElements(receiver_map, slow,
-                                            &hole_check_passed);
-      BIND(&hole_check_passed);
     }
 
     // Try to store the value as a double.
@@ -509,20 +510,19 @@ void KeyedStoreGenericAssembler::EmitGenericElementStore(
     TNode<JSObject> receiver, TNode<Map> receiver_map,
     TNode<Uint16T> instance_type, TNode<IntPtrT> index, TNode<Object> value,
     TNode<Context> context, Label* slow) {
-  Label if_fast(this), if_in_bounds(this), if_out_of_bounds(this),
-      if_increment_length_by_one(this), if_bump_length_with_gap(this),
-      if_grow(this), if_nonfast(this), if_typed_array(this),
-      if_dictionary(this);
+  Label if_fast(this), if_in_bounds(this), if_increment_length_by_one(this),
+      if_bump_length_with_gap(this), if_grow(this), if_nonfast(this),
+      if_typed_array(this), if_dictionary(this);
   TNode<FixedArrayBase> elements = LoadElements(receiver);
   TNode<Int32T> elements_kind = LoadMapElementsKind(receiver_map);
   Branch(IsFastElementsKind(elements_kind), &if_fast, &if_nonfast);
   BIND(&if_fast);
 
   Label if_array(this);
-  GotoIf(InstanceTypeEqual(instance_type, JS_ARRAY_TYPE), &if_array);
+  GotoIf(IsJSArrayInstanceType(instance_type), &if_array);
   {
     TNode<IntPtrT> capacity = SmiUntag(LoadFixedArrayBaseLength(elements));
-    Branch(UintPtrLessThan(index, capacity), &if_in_bounds, &if_out_of_bounds);
+    Branch(UintPtrLessThan(index, capacity), &if_in_bounds, &if_grow);
   }
   BIND(&if_array);
   {
@@ -540,16 +540,6 @@ void KeyedStoreGenericAssembler::EmitGenericElementStore(
                              index, value, context, slow, kDontChangeLength);
   }
 
-  BIND(&if_out_of_bounds);
-  {
-    // Integer indexed out-of-bounds accesses to typed arrays are simply
-    // ignored, since we never look up integer indexed properties on the
-    // prototypes of typed arrays. For all other types, we may need to
-    // grow the backing store.
-    GotoIfNot(InstanceTypeEqual(instance_type, JS_TYPED_ARRAY_TYPE), &if_grow);
-    Return(value);
-  }
-
   BIND(&if_increment_length_by_one);
   {
     StoreElementWithCapacity(receiver, receiver_map, elements, elements_kind,
@@ -565,8 +555,8 @@ void KeyedStoreGenericAssembler::EmitGenericElementStore(
 
   // Out-of-capacity accesses (index >= capacity) jump here. Additionally,
   // an ElementsKind transition might be necessary.
-  // The index can also be negative at this point! Jump to the runtime in that
-  // case to convert it to a named property.
+  // The index can also be negative or larger than kMaxArrayIndex at this point!
+  // Jump to the runtime in that case to convert it to a named property.
   BIND(&if_grow);
   {
     Comment("Grow backing store");
@@ -640,25 +630,22 @@ void KeyedStoreGenericAssembler::LookupPropertyOnPrototypeChain(
         // Accessor case.
         // TODO(jkummerow): Implement a trimmed-down
         // LoadAccessorFromFastObject.
-        TVARIABLE(Uint32T, var_details);
         LoadPropertyFromFastObject(holder, holder_map, descriptors, name_index,
-                                   &var_details, var_accessor_pair);
+                                   details, var_accessor_pair);
         *var_accessor_holder = holder;
         Goto(accessor);
       }
 
       BIND(&found_dict);
       {
-        TNode<HeapObject> dictionary = var_meta_storage.value();
+        TNode<NameDictionary> dictionary = CAST(var_meta_storage.value());
         TNode<IntPtrT> entry = var_entry.value();
-        TNode<Uint32T> details =
-            LoadDetailsByKeyIndex<NameDictionary>(dictionary, entry);
+        TNode<Uint32T> details = LoadDetailsByKeyIndex(dictionary, entry);
         JumpIfDataProperty(details, &ok_to_write, readonly);
 
         if (accessor != nullptr) {
           // Accessor case.
-          *var_accessor_pair =
-              LoadValueByKeyIndex<NameDictionary>(dictionary, entry);
+          *var_accessor_pair = LoadValueByKeyIndex(dictionary, entry);
           *var_accessor_holder = holder;
           Goto(accessor);
         } else {
@@ -668,10 +655,10 @@ void KeyedStoreGenericAssembler::LookupPropertyOnPrototypeChain(
 
       BIND(&found_global);
       {
-        TNode<HeapObject> dictionary = var_meta_storage.value();
+        TNode<GlobalDictionary> dictionary = CAST(var_meta_storage.value());
         TNode<IntPtrT> entry = var_entry.value();
         TNode<PropertyCell> property_cell =
-            CAST(LoadValueByKeyIndex<GlobalDictionary>(dictionary, entry));
+            CAST(LoadValueByKeyIndex(dictionary, entry));
         TNode<Object> value =
             LoadObjectField(property_cell, PropertyCell::kValueOffset);
         GotoIf(TaggedEqual(value, TheHoleConstant()), &next_proto);
@@ -692,7 +679,7 @@ void KeyedStoreGenericAssembler::LookupPropertyOnPrototypeChain(
 
     BIND(&next_proto);
     // Bailout if it can be an integer indexed exotic case.
-    GotoIf(InstanceTypeEqual(instance_type, JS_TYPED_ARRAY_TYPE), bailout);
+    GotoIf(IsJSTypedArrayInstanceType(instance_type), bailout);
     TNode<HeapObject> proto = LoadMapPrototype(holder_map);
     GotoIf(IsNull(proto), &ok_to_write);
     var_holder = proto;
@@ -780,7 +767,7 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
       readonly(this);
   TNode<Uint32T> bitfield3 = LoadMapBitField3(receiver_map);
   TNode<Name> name = CAST(p->name());
-  Branch(IsSetWord32<Map::IsDictionaryMapBit>(bitfield3),
+  Branch(IsSetWord32<Map::Bits3::IsDictionaryMapBit>(bitfield3),
          &dictionary_properties, &fast_properties);
 
   BIND(&fast_properties);
@@ -803,10 +790,8 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
       if (ShouldCallSetter()) {
         // Accessor case.
         // TODO(jkummerow): Implement a trimmed-down LoadAccessorFromFastObject.
-        TVARIABLE(Uint32T, var_details);
         LoadPropertyFromFastObject(receiver, receiver_map, descriptors,
-                                   name_index, &var_details,
-                                   &var_accessor_pair);
+                                   name_index, details, &var_accessor_pair);
         var_accessor_holder = receiver;
         Goto(&accessor);
       } else {
@@ -826,6 +811,7 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
     BIND(&lookup_transition);
     {
       Comment("lookup transition");
+      CheckForAssociatedProtector(name, slow);
       TNode<Map> transition_map =
           FindCandidateStoreICTransitionMapHandler(receiver_map, name, slow);
 
@@ -853,15 +839,15 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
     BIND(&dictionary_found);
     {
       Label overwrite(this);
-      TNode<Uint32T> details = LoadDetailsByKeyIndex<NameDictionary>(
-          properties, var_name_index.value());
+      TNode<Uint32T> details =
+          LoadDetailsByKeyIndex(properties, var_name_index.value());
       JumpIfDataProperty(details, &overwrite,
                          ShouldReconfigureExisting() ? nullptr : &readonly);
 
       if (ShouldCallSetter()) {
         // Accessor case.
-        var_accessor_pair = LoadValueByKeyIndex<NameDictionary>(
-            properties, var_name_index.value());
+        var_accessor_pair =
+            LoadValueByKeyIndex(properties, var_name_index.value());
         var_accessor_holder = receiver;
         Goto(&accessor);
       } else {
@@ -883,14 +869,13 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
     {
       // TODO(jkummerow): Also add support to correctly handle integer exotic
       // cases for typed arrays and remove this check here.
-      GotoIf(InstanceTypeEqual(LoadMapInstanceType(receiver_map),
-                               JS_TYPED_ARRAY_TYPE),
-             slow);
+      GotoIf(IsJSTypedArrayMap(receiver_map), slow);
       CheckForAssociatedProtector(name, slow);
       Label extensible(this), is_private_symbol(this);
       TNode<Uint32T> bitfield3 = LoadMapBitField3(receiver_map);
       GotoIf(IsPrivateSymbol(name), &is_private_symbol);
-      Branch(IsSetWord32<Map::IsExtensibleBit>(bitfield3), &extensible, slow);
+      Branch(IsSetWord32<Map::Bits3::IsExtensibleBit>(bitfield3), &extensible,
+             slow);
 
       BIND(&is_private_symbol);
       {
@@ -926,8 +911,8 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
     {
       Label not_callable(this);
       TNode<Struct> accessor_pair = CAST(var_accessor_pair.value());
-      GotoIf(IsAccessorInfoMap(LoadMap(accessor_pair)), slow);
-      CSA_ASSERT(this, HasInstanceType(accessor_pair, ACCESSOR_PAIR_TYPE));
+      GotoIf(IsAccessorInfo(accessor_pair), slow);
+      CSA_ASSERT(this, IsAccessorPair(accessor_pair));
       TNode<HeapObject> setter =
           CAST(LoadObjectField(accessor_pair, AccessorPair::kSetterOffset));
       TNode<Map> setter_map = LoadMap(setter);
@@ -989,8 +974,8 @@ void KeyedStoreGenericAssembler::KeyedStoreGeneric(
     TNode<Object> value, Maybe<LanguageMode> language_mode) {
   TVARIABLE(IntPtrT, var_index);
   TVARIABLE(Name, var_unique);
-  Label if_index(this), if_unique_name(this), not_internalized(this),
-      slow(this);
+  Label if_index(this, &var_index), if_unique_name(this),
+      not_internalized(this), slow(this);
 
   GotoIf(TaggedIsSmi(receiver_maybe_smi), &slow);
   TNode<HeapObject> receiver = CAST(receiver_maybe_smi);
@@ -1014,7 +999,7 @@ void KeyedStoreGenericAssembler::KeyedStoreGeneric(
   {
     Comment("key is unique name");
     StoreICParameters p(context, receiver, var_unique.value(), value, {},
-                        nullptr);
+                        UndefinedConstant());
     ExitPoint direct_exit(this);
     EmitGenericPropertyStore(CAST(receiver), receiver_map, &p, &direct_exit,
                              &slow, language_mode);
@@ -1103,10 +1088,11 @@ void KeyedStoreGenericAssembler::SetProperty(TNode<Context> context,
                                              TNode<Name> unique_name,
                                              TNode<Object> value,
                                              LanguageMode language_mode) {
-  StoreICParameters p(context, receiver, unique_name, value, {}, nullptr);
+  StoreICParameters p(context, receiver, unique_name, value, {},
+                      UndefinedConstant());
 
   Label done(this), slow(this, Label::kDeferred);
-  ExitPoint exit_point(this, [&](Node* result) { Goto(&done); });
+  ExitPoint exit_point(this, [&](TNode<Object> result) { Goto(&done); });
 
   CSA_ASSERT(this, Word32Equal(is_simple_receiver,
                                IsSimpleObjectMap(LoadMap(receiver))));
diff --git a/deps/v8/src/ic/stub-cache.cc b/deps/v8/src/ic/stub-cache.cc
index c1d9aea3748d37..8b643341430c67 100644
--- a/deps/v8/src/ic/stub-cache.cc
+++ b/deps/v8/src/ic/stub-cache.cc
@@ -15,7 +15,7 @@ namespace v8 {
 namespace internal {
 
 StubCache::StubCache(Isolate* isolate) : isolate_(isolate) {
-  // Ensure the nullptr (aka Smi::kZero) which StubCache::Get() returns
+  // Ensure the nullptr (aka Smi::zero()) which StubCache::Get() returns
   // when the entry is not found is not considered as a handler.
   DCHECK(!IC::IsHandler(MaybeObject()));
 }
diff --git a/deps/v8/src/init/OWNERS b/deps/v8/src/init/OWNERS
index aa006edd3503b2..933637e2e9a2ce 100644
--- a/deps/v8/src/init/OWNERS
+++ b/deps/v8/src/init/OWNERS
@@ -9,6 +9,5 @@ marja@chromium.org
 mathias@chromium.org
 ulan@chromium.org
 verwaest@chromium.org
-yangguo@chromium.org
 
 # COMPONENT: Blink>JavaScript>Runtime
diff --git a/deps/v8/src/init/bootstrapper.cc b/deps/v8/src/init/bootstrapper.cc
index 148c60d89d39d6..93d19a42a9cd70 100644
--- a/deps/v8/src/init/bootstrapper.cc
+++ b/deps/v8/src/init/bootstrapper.cc
@@ -15,11 +15,13 @@
 #include "src/execution/protectors.h"
 #include "src/extensions/cputracemark-extension.h"
 #include "src/extensions/externalize-string-extension.h"
-#include "src/extensions/free-buffer-extension.h"
 #include "src/extensions/gc-extension.h"
 #include "src/extensions/ignition-statistics-extension.h"
 #include "src/extensions/statistics-extension.h"
 #include "src/extensions/trigger-failure-extension.h"
+#ifdef ENABLE_VTUNE_TRACEMARK
+#include "src/extensions/vtunedomain-support-extension.h"
+#endif  // ENABLE_VTUNE_TRACEMARK
 #include "src/heap/heap-inl.h"
 #include "src/logging/counters.h"
 #include "src/numbers/math-random.h"
@@ -36,6 +38,7 @@
 #include "src/objects/js-break-iterator.h"
 #include "src/objects/js-collator.h"
 #include "src/objects/js-date-time-format.h"
+#include "src/objects/js-display-names.h"
 #include "src/objects/js-list-format.h"
 #include "src/objects/js-locale.h"
 #include "src/objects/js-number-format.h"
@@ -52,7 +55,6 @@
 #include "src/objects/property-cell.h"
 #include "src/objects/slots-inl.h"
 #include "src/objects/templates.h"
-#include "src/snapshot/natives.h"
 #include "src/snapshot/snapshot.h"
 #include "src/wasm/wasm-js.h"
 
@@ -106,15 +108,6 @@ Bootstrapper::Bootstrapper(Isolate* isolate)
       nesting_(0),
       extensions_cache_(Script::TYPE_EXTENSION) {}
 
-Handle<String> Bootstrapper::GetNativeSource(NativeType type, int index) {
-  NativesExternalStringResource* resource =
-      new NativesExternalStringResource(type, index);
-  Handle<ExternalOneByteString> source_code =
-      isolate_->factory()->NewNativeSourceString(resource);
-  DCHECK(source_code->is_uncached());
-  return source_code;
-}
-
 void Bootstrapper::Initialize(bool create_heap_objects) {
   extensions_cache_.Initialize(isolate_, create_heap_objects);
 }
@@ -131,7 +124,6 @@ static bool isValidCpuTraceMarkFunctionName() {
 }
 
 void Bootstrapper::InitializeOncePerProcess() {
-  v8::RegisterExtension(std::make_unique<FreeBufferExtension>());
   v8::RegisterExtension(std::make_unique<GCExtension>(GCFunctionName()));
   v8::RegisterExtension(std::make_unique<ExternalizeStringExtension>());
   v8::RegisterExtension(std::make_unique<StatisticsExtension>());
@@ -141,6 +133,10 @@ void Bootstrapper::InitializeOncePerProcess() {
     v8::RegisterExtension(
         std::make_unique<CpuTraceMarkExtension>(FLAG_expose_cputracemark_as));
   }
+#ifdef ENABLE_VTUNE_TRACEMARK
+  v8::RegisterExtension(
+      std::make_unique<VTuneDomainSupportExtension>("vtunedomainmark"));
+#endif  // ENABLE_VTUNE_TRACEMARK
 }
 
 void Bootstrapper::TearDown() {
@@ -216,8 +212,6 @@ class Genesis {
   void InitializeExperimentalGlobal();
   void InitializeIteratorFunctions();
   void InitializeCallSiteBuiltins();
-  // Depending on the situation, expose and/or get rid of the utils object.
-  void ConfigureUtilsObject();
 
 #define DECLARE_FEATURE_INITIALIZATION(id, descr) void InitializeGlobal_##id();
 
@@ -232,14 +226,12 @@ class Genesis {
   };
   Handle<JSFunction> CreateArrayBuffer(Handle<String> name,
                                        ArrayBufferKind array_buffer_kind);
-  void InstallInternalPackedArrayFunction(Handle<JSObject> prototype,
-                                          const char* name);
-  void InstallInternalPackedArray(Handle<JSObject> target, const char* name);
-  bool InstallNatives();
+
+  bool InstallABunchOfRandomThings();
+  bool InstallExtrasBindings();
 
   Handle<JSFunction> InstallTypedArray(const char* name,
                                        ElementsKind elements_kind);
-  bool InstallExtraNatives();
   void InitializeNormalizedMapCaches();
 
   enum ExtensionTraversalState { UNVISITED, VISITED, INSTALLED };
@@ -398,6 +390,8 @@ V8_NOINLINE Handle<JSFunction> CreateFunction(
     Isolate* isolate, Handle<String> name, InstanceType type, int instance_size,
     int inobject_properties, Handle<HeapObject> prototype,
     Builtins::Name builtin_id) {
+  DCHECK(Builtins::HasJSLinkage(builtin_id));
+
   Handle<JSFunction> result;
 
   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
@@ -428,6 +422,7 @@ V8_NOINLINE Handle<JSFunction> InstallFunction(
     Isolate* isolate, Handle<JSObject> target, Handle<String> name,
     InstanceType type, int instance_size, int inobject_properties,
     Handle<HeapObject> prototype, Builtins::Name call) {
+  DCHECK(Builtins::HasJSLinkage(call));
   Handle<JSFunction> function = CreateFunction(
       isolate, name, type, instance_size, inobject_properties, prototype, call);
   JSObject::AddProperty(isolate, target, name, function, DONT_ENUM);
@@ -447,6 +442,7 @@ V8_NOINLINE Handle<JSFunction> SimpleCreateFunction(Isolate* isolate,
                                                     Handle<String> name,
                                                     Builtins::Name call,
                                                     int len, bool adapt) {
+  DCHECK(Builtins::HasJSLinkage(call));
   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
       name, call, LanguageMode::kStrict);
   Handle<JSFunction> fun = isolate->factory()->NewFunction(args);
@@ -616,8 +612,7 @@ Handle<JSFunction> Genesis::CreateEmptyFunction() {
   empty_function->shared().set_raw_scope_info(
       ReadOnlyRoots(isolate()).empty_function_scope_info());
   empty_function->shared().DontAdaptArguments();
-  SharedFunctionInfo::SetScript(handle(empty_function->shared(), isolate()),
-                                script, 1);
+  empty_function->shared().SetScript(ReadOnlyRoots(isolate()), *script, 1);
 
   return empty_function;
 }
@@ -661,21 +656,17 @@ Handle<JSFunction> Genesis::GetThrowTypeErrorIntrinsic() {
   Handle<JSFunction> function = factory()->NewFunction(args);
   function->shared().DontAdaptArguments();
 
-  PropertyAttributes ro_attribs =
-      static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
-
-  // %ThrowTypeError% must have a name property with an empty string value.
-  // Per spec, ThrowTypeError's name must also be non-configurable, otherwise
-  // we could omit explicitly setting a property attribute here and just fall
-  // back to the default name attribute on function.
-  JSObject::SetOwnPropertyIgnoreAttributes(
-      function, factory()->name_string(), factory()->empty_string(), ro_attribs)
-      .Assert();
+  // %ThrowTypeError% must not have a name property.
+  if (JSReceiver::DeleteProperty(function, factory()->name_string())
+          .IsNothing()) {
+    DCHECK(false);
+  }
 
   // length needs to be non configurable.
   Handle<Object> value(Smi::FromInt(function->length()), isolate());
-  JSObject::SetOwnPropertyIgnoreAttributes(function, factory()->length_string(),
-                                           value, ro_attribs)
+  JSObject::SetOwnPropertyIgnoreAttributes(
+      function, factory()->length_string(), value,
+      static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY))
       .Assert();
 
   if (JSObject::PreventExtensions(function, kThrowOnError).IsNothing()) {
@@ -960,7 +951,7 @@ void Genesis::CreateAsyncIteratorMaps(Handle<JSFunction> empty) {
                               async_iterator_prototype);
 
   Handle<Map> async_from_sync_iterator_map = factory()->NewMap(
-      JS_ASYNC_FROM_SYNC_ITERATOR_TYPE, JSAsyncFromSyncIterator::kSize);
+      JS_ASYNC_FROM_SYNC_ITERATOR_TYPE, JSAsyncFromSyncIterator::kHeaderSize);
   Map::SetPrototype(isolate(), async_from_sync_iterator_map,
                     async_from_sync_iterator_prototype);
   native_context()->set_async_from_sync_iterator_map(
@@ -1170,6 +1161,7 @@ void Genesis::CreateRoots() {
   // and the global object, but in order to create those, we need the
   // native context).
   native_context_ = factory()->NewNativeContext();
+
   AddToWeakNativeContextList(isolate(), *native_context());
   isolate()->set_context(*native_context());
 
@@ -1237,7 +1229,7 @@ Handle<JSGlobalObject> Genesis::CreateNewGlobals(
     Handle<JSObject> prototype =
         factory()->NewFunctionPrototype(isolate()->object_function());
     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
-        name, prototype, JS_GLOBAL_OBJECT_TYPE, JSGlobalObject::kSize, 0,
+        name, prototype, JS_GLOBAL_OBJECT_TYPE, JSGlobalObject::kHeaderSize, 0,
         Builtins::kIllegal, MUTABLE);
     js_global_object_function = factory()->NewFunction(args);
 #ifdef DEBUG
@@ -1380,11 +1372,6 @@ static void InstallError(Isolate* isolate, Handle<JSObject> global,
       isolate->native_context()->set_error_to_string(*to_string_fun);
       isolate->native_context()->set_initial_error_prototype(*prototype);
     } else {
-      DCHECK(isolate->native_context()->error_to_string().IsJSFunction());
-
-      JSObject::AddProperty(isolate, prototype, factory->toString_string(),
-                            isolate->error_to_string(), DONT_ENUM);
-
       Handle<JSFunction> global_error = isolate->error_function();
       CHECK(JSReceiver::SetPrototype(error_fun, global_error, false,
                                      kThrowOnError)
@@ -1426,8 +1413,6 @@ void InstallMakeError(Isolate* isolate, int builtin_id, int context_index) {
 void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
                                Handle<JSFunction> empty_function) {
   // --- N a t i v e   C o n t e x t ---
-  // Use the empty scope info.
-  native_context()->set_scope_info(empty_function->shared().scope_info());
   native_context()->set_previous(Context());
   // Set extension and global object.
   native_context()->set_extension(*global_object);
@@ -1438,10 +1423,49 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   Factory* factory = isolate_->factory();
 
-  Handle<ScriptContextTable> script_context_table =
-      factory->NewScriptContextTable();
-  native_context()->set_script_context_table(*script_context_table);
-  InstallGlobalThisBinding();
+  {  // -- C o n t e x t
+    Handle<Map> map =
+        factory->NewMap(FUNCTION_CONTEXT_TYPE, kVariableSizeSentinel);
+    map->set_native_context(*native_context());
+    native_context()->set_function_context_map(*map);
+
+    map = factory->NewMap(CATCH_CONTEXT_TYPE, kVariableSizeSentinel);
+    map->set_native_context(*native_context());
+    native_context()->set_catch_context_map(*map);
+
+    map = factory->NewMap(WITH_CONTEXT_TYPE, kVariableSizeSentinel);
+    map->set_native_context(*native_context());
+    native_context()->set_with_context_map(*map);
+
+    map = factory->NewMap(DEBUG_EVALUATE_CONTEXT_TYPE, kVariableSizeSentinel);
+    map->set_native_context(*native_context());
+    native_context()->set_debug_evaluate_context_map(*map);
+
+    map = factory->NewMap(BLOCK_CONTEXT_TYPE, kVariableSizeSentinel);
+    map->set_native_context(*native_context());
+    native_context()->set_block_context_map(*map);
+
+    map = factory->NewMap(MODULE_CONTEXT_TYPE, kVariableSizeSentinel);
+    map->set_native_context(*native_context());
+    native_context()->set_module_context_map(*map);
+
+    map = factory->NewMap(AWAIT_CONTEXT_TYPE, kVariableSizeSentinel);
+    map->set_native_context(*native_context());
+    native_context()->set_await_context_map(*map);
+
+    map = factory->NewMap(SCRIPT_CONTEXT_TYPE, kVariableSizeSentinel);
+    map->set_native_context(*native_context());
+    native_context()->set_script_context_map(*map);
+
+    map = factory->NewMap(EVAL_CONTEXT_TYPE, kVariableSizeSentinel);
+    map->set_native_context(*native_context());
+    native_context()->set_eval_context_map(*map);
+
+    Handle<ScriptContextTable> script_context_table =
+        factory->NewScriptContextTable();
+    native_context()->set_script_context_table(*script_context_table);
+    InstallGlobalThisBinding();
+  }
 
   {  // --- O b j e c t ---
     Handle<String> object_name = factory->Object_string();
@@ -1639,7 +1663,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   Handle<JSFunction> array_prototype_to_string_fun;
   {  // --- A r r a y ---
     Handle<JSFunction> array_function = InstallFunction(
-        isolate_, global, "Array", JS_ARRAY_TYPE, JSArray::kSize, 0,
+        isolate_, global, "Array", JS_ARRAY_TYPE, JSArray::kHeaderSize, 0,
         isolate_->initial_object_prototype(), Builtins::kArrayConstructor);
     array_function->shared().DontAdaptArguments();
 
@@ -1804,7 +1828,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     Handle<JSFunction> array_iterator_function =
         CreateFunction(isolate_, factory->ArrayIterator_string(),
-                       JS_ARRAY_ITERATOR_TYPE, JSArrayIterator::kSize, 0,
+                       JS_ARRAY_ITERATOR_TYPE, JSArrayIterator::kHeaderSize, 0,
                        array_iterator_prototype, Builtins::kIllegal);
     array_iterator_function->shared().set_native(false);
 
@@ -1817,8 +1841,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {  // --- N u m b e r ---
     Handle<JSFunction> number_fun = InstallFunction(
         isolate_, global, "Number", JS_PRIMITIVE_WRAPPER_TYPE,
-        JSPrimitiveWrapper::kSize, 0, isolate_->initial_object_prototype(),
-        Builtins::kNumberConstructor);
+        JSPrimitiveWrapper::kHeaderSize, 0,
+        isolate_->initial_object_prototype(), Builtins::kNumberConstructor);
     number_fun->shared().DontAdaptArguments();
     number_fun->shared().set_length(1);
     InstallWithIntrinsicDefaultProto(isolate_, number_fun,
@@ -1827,7 +1851,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     // Create the %NumberPrototype%
     Handle<JSPrimitiveWrapper> prototype = Handle<JSPrimitiveWrapper>::cast(
         factory->NewJSObject(number_fun, AllocationType::kOld));
-    prototype->set_value(Smi::kZero);
+    prototype->set_value(Smi::zero());
     JSFunction::SetPrototype(number_fun, prototype);
 
     // Install the "constructor" property on the {prototype}.
@@ -1901,8 +1925,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {  // --- B o o l e a n ---
     Handle<JSFunction> boolean_fun = InstallFunction(
         isolate_, global, "Boolean", JS_PRIMITIVE_WRAPPER_TYPE,
-        JSPrimitiveWrapper::kSize, 0, isolate_->initial_object_prototype(),
-        Builtins::kBooleanConstructor);
+        JSPrimitiveWrapper::kHeaderSize, 0,
+        isolate_->initial_object_prototype(), Builtins::kBooleanConstructor);
     boolean_fun->shared().DontAdaptArguments();
     boolean_fun->shared().set_length(1);
     InstallWithIntrinsicDefaultProto(isolate_, boolean_fun,
@@ -1928,8 +1952,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {  // --- S t r i n g ---
     Handle<JSFunction> string_fun = InstallFunction(
         isolate_, global, "String", JS_PRIMITIVE_WRAPPER_TYPE,
-        JSPrimitiveWrapper::kSize, 0, isolate_->initial_object_prototype(),
-        Builtins::kStringConstructor);
+        JSPrimitiveWrapper::kHeaderSize, 0,
+        isolate_->initial_object_prototype(), Builtins::kStringConstructor);
     string_fun->shared().DontAdaptArguments();
     string_fun->shared().set_length(1);
     InstallWithIntrinsicDefaultProto(isolate_, string_fun,
@@ -2113,7 +2137,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     Handle<JSFunction> string_iterator_function = CreateFunction(
         isolate_, factory->InternalizeUtf8String("StringIterator"),
-        JS_STRING_ITERATOR_TYPE, JSStringIterator::kSize, 0,
+        JS_STRING_ITERATOR_TYPE, JSStringIterator::kHeaderSize, 0,
         string_iterator_prototype, Builtins::kIllegal);
     string_iterator_function->shared().set_native(false);
     native_context()->set_initial_string_iterator_map(
@@ -2123,10 +2147,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // --- S y m b o l ---
-    Handle<JSFunction> symbol_fun =
-        InstallFunction(isolate_, global, "Symbol", JS_PRIMITIVE_WRAPPER_TYPE,
-                        JSPrimitiveWrapper::kSize, 0, factory->the_hole_value(),
-                        Builtins::kSymbolConstructor);
+    Handle<JSFunction> symbol_fun = InstallFunction(
+        isolate_, global, "Symbol", JS_PRIMITIVE_WRAPPER_TYPE,
+        JSPrimitiveWrapper::kHeaderSize, 0, factory->the_hole_value(),
+        Builtins::kSymbolConstructor);
     symbol_fun->shared().set_length(0);
     symbol_fun->shared().DontAdaptArguments();
     native_context()->set_symbol_function(*symbol_fun);
@@ -2186,7 +2210,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {  // --- D a t e ---
     Handle<JSFunction> date_fun = InstallFunction(
-        isolate_, global, "Date", JS_DATE_TYPE, JSDate::kSize, 0,
+        isolate_, global, "Date", JS_DATE_TYPE, JSDate::kHeaderSize, 0,
         factory->the_hole_value(), Builtins::kDateConstructor);
     InstallWithIntrinsicDefaultProto(isolate_, date_fun,
                                      Context::DATE_FUNCTION_INDEX);
@@ -2460,7 +2484,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     // Builtin functions for RegExp.prototype.
     Handle<JSFunction> regexp_fun = InstallFunction(
         isolate_, global, "RegExp", JS_REG_EXP_TYPE,
-        JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kTaggedSize,
+        JSRegExp::kHeaderSize + JSRegExp::kInObjectFieldCount * kTaggedSize,
         JSRegExp::kInObjectFieldCount, factory->the_hole_value(),
         Builtins::kRegExpConstructor);
     InstallWithIntrinsicDefaultProto(isolate_, regexp_fun,
@@ -2675,8 +2699,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     Handle<JSFunction> regexp_string_iterator_function = CreateFunction(
         isolate(), "RegExpStringIterator", JS_REG_EXP_STRING_ITERATOR_TYPE,
-        JSRegExpStringIterator::kSize, 0, regexp_string_iterator_prototype,
-        Builtins::kIllegal);
+        JSRegExpStringIterator::kHeaderSize, 0,
+        regexp_string_iterator_prototype, Builtins::kIllegal);
     regexp_string_iterator_function->shared().set_native(false);
     native_context()->set_initial_regexp_string_iterator_prototype_map(
         regexp_string_iterator_function->initial_map());
@@ -2863,12 +2887,12 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
                           false, NONE);
     SimpleInstallFunction(isolate_, console, "warn", Builtins::kConsoleWarn, 0,
                           false, NONE);
-    SimpleInstallFunction(isolate_, console, "dir", Builtins::kConsoleDir, 1,
+    SimpleInstallFunction(isolate_, console, "dir", Builtins::kConsoleDir, 0,
                           false, NONE);
     SimpleInstallFunction(isolate_, console, "dirxml", Builtins::kConsoleDirXml,
                           0, false, NONE);
     SimpleInstallFunction(isolate_, console, "table", Builtins::kConsoleTable,
-                          1, false, NONE);
+                          0, false, NONE);
     SimpleInstallFunction(isolate_, console, "trace", Builtins::kConsoleTrace,
                           0, false, NONE);
     SimpleInstallFunction(isolate_, console, "group", Builtins::kConsoleGroup,
@@ -2914,7 +2938,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     {  // -- D a t e T i m e F o r m a t
       Handle<JSFunction> date_time_format_constructor = InstallFunction(
           isolate_, intl, "DateTimeFormat", JS_DATE_TIME_FORMAT_TYPE,
-          JSDateTimeFormat::kSize, 0, factory->the_hole_value(),
+          JSDateTimeFormat::kHeaderSize, 0, factory->the_hole_value(),
           Builtins::kDateTimeFormatConstructor);
       date_time_format_constructor->shared().set_length(0);
       date_time_format_constructor->shared().DontAdaptArguments();
@@ -2951,10 +2975,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     }
 
     {  // -- N u m b e r F o r m a t
-      Handle<JSFunction> number_format_constructor =
-          InstallFunction(isolate_, intl, "NumberFormat", JS_NUMBER_FORMAT_TYPE,
-                          JSNumberFormat::kSize, 0, factory->the_hole_value(),
-                          Builtins::kNumberFormatConstructor);
+      Handle<JSFunction> number_format_constructor = InstallFunction(
+          isolate_, intl, "NumberFormat", JS_NUMBER_FORMAT_TYPE,
+          JSNumberFormat::kHeaderSize, 0, factory->the_hole_value(),
+          Builtins::kNumberFormatConstructor);
       number_format_constructor->shared().set_length(0);
       number_format_constructor->shared().DontAdaptArguments();
       InstallWithIntrinsicDefaultProto(
@@ -2983,8 +3007,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     {  // -- C o l l a t o r
       Handle<JSFunction> collator_constructor = InstallFunction(
-          isolate_, intl, "Collator", JS_COLLATOR_TYPE, JSCollator::kSize, 0,
-          factory->the_hole_value(), Builtins::kCollatorConstructor);
+          isolate_, intl, "Collator", JS_COLLATOR_TYPE, JSCollator::kHeaderSize,
+          0, factory->the_hole_value(), Builtins::kCollatorConstructor);
       collator_constructor->shared().DontAdaptArguments();
       InstallWithIntrinsicDefaultProto(isolate_, collator_constructor,
                                        Context::INTL_COLLATOR_FUNCTION_INDEX);
@@ -3009,7 +3033,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     {  // -- V 8 B r e a k I t e r a t o r
       Handle<JSFunction> v8_break_iterator_constructor = InstallFunction(
           isolate_, intl, "v8BreakIterator", JS_V8_BREAK_ITERATOR_TYPE,
-          JSV8BreakIterator::kSize, 0, factory->the_hole_value(),
+          JSV8BreakIterator::kHeaderSize, 0, factory->the_hole_value(),
           Builtins::kV8BreakIteratorConstructor);
       v8_break_iterator_constructor->shared().DontAdaptArguments();
 
@@ -3043,10 +3067,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     }
 
     {  // -- P l u r a l R u l e s
-      Handle<JSFunction> plural_rules_constructor =
-          InstallFunction(isolate_, intl, "PluralRules", JS_PLURAL_RULES_TYPE,
-                          JSPluralRules::kSize, 0, factory->the_hole_value(),
-                          Builtins::kPluralRulesConstructor);
+      Handle<JSFunction> plural_rules_constructor = InstallFunction(
+          isolate_, intl, "PluralRules", JS_PLURAL_RULES_TYPE,
+          JSPluralRules::kHeaderSize, 0, factory->the_hole_value(),
+          Builtins::kPluralRulesConstructor);
       plural_rules_constructor->shared().DontAdaptArguments();
       InstallWithIntrinsicDefaultProto(
           isolate_, plural_rules_constructor,
@@ -3072,7 +3096,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     {  // -- R e l a t i v e T i m e F o r m a t
       Handle<JSFunction> relative_time_format_fun = InstallFunction(
           isolate(), intl, "RelativeTimeFormat", JS_RELATIVE_TIME_FORMAT_TYPE,
-          JSRelativeTimeFormat::kSize, 0, factory->the_hole_value(),
+          JSRelativeTimeFormat::kHeaderSize, 0, factory->the_hole_value(),
           Builtins::kRelativeTimeFormatConstructor);
       relative_time_format_fun->shared().set_length(0);
       relative_time_format_fun->shared().DontAdaptArguments();
@@ -3103,10 +3127,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     }
 
     {  // -- L i s t F o r m a t
-      Handle<JSFunction> list_format_fun =
-          InstallFunction(isolate(), intl, "ListFormat", JS_LIST_FORMAT_TYPE,
-                          JSListFormat::kSize, 0, factory->the_hole_value(),
-                          Builtins::kListFormatConstructor);
+      Handle<JSFunction> list_format_fun = InstallFunction(
+          isolate(), intl, "ListFormat", JS_LIST_FORMAT_TYPE,
+          JSListFormat::kHeaderSize, 0, factory->the_hole_value(),
+          Builtins::kListFormatConstructor);
       list_format_fun->shared().set_length(0);
       list_format_fun->shared().DontAdaptArguments();
       InstallWithIntrinsicDefaultProto(
@@ -3133,7 +3157,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     {  // -- L o c a l e
       Handle<JSFunction> locale_fun = InstallFunction(
-          isolate(), intl, "Locale", JS_LOCALE_TYPE, JSLocale::kSize, 0,
+          isolate(), intl, "Locale", JS_LOCALE_TYPE, JSLocale::kHeaderSize, 0,
           factory->the_hole_value(), Builtins::kLocaleConstructor);
       InstallWithIntrinsicDefaultProto(isolate(), locale_fun,
                                        Context::INTL_LOCALE_FUNCTION_INDEX);
@@ -3412,9 +3436,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // -- M a p
-    Handle<JSFunction> js_map_fun =
-        InstallFunction(isolate_, global, "Map", JS_MAP_TYPE, JSMap::kSize, 0,
-                        factory->the_hole_value(), Builtins::kMapConstructor);
+    Handle<JSFunction> js_map_fun = InstallFunction(
+        isolate_, global, "Map", JS_MAP_TYPE, JSMap::kHeaderSize, 0,
+        factory->the_hole_value(), Builtins::kMapConstructor);
     InstallWithIntrinsicDefaultProto(isolate_, js_map_fun,
                                      Context::JS_MAP_FUN_INDEX);
 
@@ -3470,10 +3494,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // -- B i g I n t
-    Handle<JSFunction> bigint_fun =
-        InstallFunction(isolate_, global, "BigInt", JS_PRIMITIVE_WRAPPER_TYPE,
-                        JSPrimitiveWrapper::kSize, 0, factory->the_hole_value(),
-                        Builtins::kBigIntConstructor);
+    Handle<JSFunction> bigint_fun = InstallFunction(
+        isolate_, global, "BigInt", JS_PRIMITIVE_WRAPPER_TYPE,
+        JSPrimitiveWrapper::kHeaderSize, 0, factory->the_hole_value(),
+        Builtins::kBigIntConstructor);
     bigint_fun->shared().DontAdaptArguments();
     bigint_fun->shared().set_length(1);
     InstallWithIntrinsicDefaultProto(isolate_, bigint_fun,
@@ -3508,9 +3532,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // -- S e t
-    Handle<JSFunction> js_set_fun =
-        InstallFunction(isolate_, global, "Set", JS_SET_TYPE, JSSet::kSize, 0,
-                        factory->the_hole_value(), Builtins::kSetConstructor);
+    Handle<JSFunction> js_set_fun = InstallFunction(
+        isolate_, global, "Set", JS_SET_TYPE, JSSet::kHeaderSize, 0,
+        factory->the_hole_value(), Builtins::kSetConstructor);
     InstallWithIntrinsicDefaultProto(isolate_, js_set_fun,
                                      Context::JS_SET_FUN_INDEX);
 
@@ -3613,8 +3637,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {  // -- W e a k M a p
     Handle<JSFunction> cons = InstallFunction(
-        isolate_, global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize, 0,
-        factory->the_hole_value(), Builtins::kWeakMapConstructor);
+        isolate_, global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kHeaderSize,
+        0, factory->the_hole_value(), Builtins::kWeakMapConstructor);
     InstallWithIntrinsicDefaultProto(isolate_, cons,
                                      Context::JS_WEAK_MAP_FUN_INDEX);
 
@@ -3649,8 +3673,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {  // -- W e a k S e t
     Handle<JSFunction> cons = InstallFunction(
-        isolate_, global, "WeakSet", JS_WEAK_SET_TYPE, JSWeakSet::kSize, 0,
-        factory->the_hole_value(), Builtins::kWeakSetConstructor);
+        isolate_, global, "WeakSet", JS_WEAK_SET_TYPE, JSWeakSet::kHeaderSize,
+        0, factory->the_hole_value(), Builtins::kWeakSetConstructor);
     InstallWithIntrinsicDefaultProto(isolate_, cons,
                                      Context::JS_WEAK_SET_FUN_INDEX);
 
@@ -3757,7 +3781,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {  // --- B o u n d F u n c t i o n
     Handle<Map> map =
-        factory->NewMap(JS_BOUND_FUNCTION_TYPE, JSBoundFunction::kSize,
+        factory->NewMap(JS_BOUND_FUNCTION_TYPE, JSBoundFunction::kHeaderSize,
                         TERMINAL_FAST_ELEMENTS_KIND, 0);
     map->SetConstructor(native_context()->object_function());
     map->set_is_callable(true);
@@ -3954,58 +3978,6 @@ void Genesis::InitializeExperimentalGlobal() {
 #undef FEATURE_INITIALIZE_GLOBAL
 }
 
-bool Bootstrapper::CompileExtraBuiltin(Isolate* isolate, int index) {
-  HandleScope scope(isolate);
-  Vector<const char> name = ExtraNatives::GetScriptName(index);
-  Handle<String> source_code =
-      isolate->bootstrapper()->GetNativeSource(EXTRAS, index);
-  Handle<Object> global = isolate->global_object();
-  Handle<Object> binding = isolate->extras_binding_object();
-  Handle<Object> extras_utils = isolate->extras_utils_object();
-  Handle<Object> args[] = {global, binding, extras_utils};
-  return Bootstrapper::CompileNative(isolate, name, source_code,
-                                     arraysize(args), args, EXTENSION_CODE);
-}
-
-bool Bootstrapper::CompileNative(Isolate* isolate, Vector<const char> name,
-                                 Handle<String> source, int argc,
-                                 Handle<Object> argv[],
-                                 NativesFlag natives_flag) {
-  SuppressDebug compiling_natives(isolate->debug());
-
-  Handle<Context> context(isolate->context(), isolate);
-  Handle<String> script_name =
-      isolate->factory()->NewStringFromUtf8(name).ToHandleChecked();
-  MaybeHandle<SharedFunctionInfo> maybe_function_info =
-      Compiler::GetSharedFunctionInfoForScript(
-          isolate, source, Compiler::ScriptDetails(script_name),
-          ScriptOriginOptions(), nullptr, nullptr,
-          ScriptCompiler::kNoCompileOptions, ScriptCompiler::kNoCacheNoReason,
-          natives_flag);
-  Handle<SharedFunctionInfo> function_info;
-  if (!maybe_function_info.ToHandle(&function_info)) return false;
-
-  DCHECK(context->IsNativeContext());
-
-  Handle<JSFunction> fun =
-      isolate->factory()->NewFunctionFromSharedFunctionInfo(function_info,
-                                                            context);
-  Handle<Object> receiver = isolate->factory()->undefined_value();
-
-  // For non-extension scripts, run script to get the function wrapper.
-  Handle<Object> wrapper;
-  if (!Execution::TryCall(isolate, fun, receiver, 0, nullptr,
-                          Execution::MessageHandling::kKeepPending, nullptr)
-           .ToHandle(&wrapper)) {
-    return false;
-  }
-  // Then run the function wrapper.
-  return !Execution::TryCall(isolate, Handle<JSFunction>::cast(wrapper),
-                             receiver, argc, argv,
-                             Execution::MessageHandling::kKeepPending, nullptr)
-              .is_null();
-}
-
 bool Genesis::CompileExtension(Isolate* isolate, v8::Extension* extension) {
   Factory* factory = isolate->factory();
   HandleScope scope(isolate);
@@ -4051,15 +4023,6 @@ bool Genesis::CompileExtension(Isolate* isolate, v8::Extension* extension) {
               .is_null();
 }
 
-void Genesis::ConfigureUtilsObject() {
-  // We still need the utils object after deserialization.
-  if (isolate()->serializer_enabled()) return;
-
-  // The utils object can be removed for cases that reach this point.
-  HeapObject undefined = ReadOnlyRoots(heap()).undefined_value();
-  native_context()->set_extras_utils_object(undefined);
-}
-
 void Genesis::InitializeIteratorFunctions() {
   Isolate* isolate = isolate_;
   Factory* factory = isolate->factory();
@@ -4139,9 +4102,9 @@ void Genesis::InitializeIteratorFunctions() {
     native_context->set_initial_set_iterator_prototype(*prototype);
 
     // Setup SetIterator constructor.
-    Handle<JSFunction> set_iterator_function =
-        CreateFunction(isolate, "SetIterator", JS_SET_VALUE_ITERATOR_TYPE,
-                       JSSetIterator::kSize, 0, prototype, Builtins::kIllegal);
+    Handle<JSFunction> set_iterator_function = CreateFunction(
+        isolate, "SetIterator", JS_SET_VALUE_ITERATOR_TYPE,
+        JSSetIterator::kHeaderSize, 0, prototype, Builtins::kIllegal);
     set_iterator_function->shared().set_native(false);
 
     Handle<Map> set_value_iterator_map(set_iterator_function->initial_map(),
@@ -4169,9 +4132,9 @@ void Genesis::InitializeIteratorFunctions() {
     native_context->set_initial_map_iterator_prototype(*prototype);
 
     // Setup MapIterator constructor.
-    Handle<JSFunction> map_iterator_function =
-        CreateFunction(isolate, "MapIterator", JS_MAP_KEY_ITERATOR_TYPE,
-                       JSMapIterator::kSize, 0, prototype, Builtins::kIllegal);
+    Handle<JSFunction> map_iterator_function = CreateFunction(
+        isolate, "MapIterator", JS_MAP_KEY_ITERATOR_TYPE,
+        JSMapIterator::kHeaderSize, 0, prototype, Builtins::kIllegal);
     map_iterator_function->shared().set_native(false);
 
     Handle<Map> map_key_iterator_map(map_iterator_function->initial_map(),
@@ -4223,7 +4186,7 @@ void Genesis::InitializeIteratorFunctions() {
     // async function generator objects. These objects never escape to user
     // JavaScript anyways.
     Handle<Map> async_function_object_map = factory->NewMap(
-        JS_ASYNC_FUNCTION_OBJECT_TYPE, JSAsyncFunctionObject::kSize);
+        JS_ASYNC_FUNCTION_OBJECT_TYPE, JSAsyncFunctionObject::kHeaderSize);
     native_context->set_async_function_object_map(*async_function_object_map);
 
     {
@@ -4313,6 +4276,7 @@ EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_top_level_await)
 
 #ifdef V8_INTL_SUPPORT
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_intl_add_calendar_numbering_system)
+EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_intl_displaynames_date_types)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_intl_dateformat_day_period)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(
     harmony_intl_dateformat_fractional_second_digits)
@@ -4350,7 +4314,7 @@ void Genesis::InitializeGlobal_harmony_weak_refs() {
     // Create %FinalizationGroup%
     Handle<JSFunction> finalization_group_fun = CreateFunction(
         isolate(), finalization_group_name, JS_FINALIZATION_GROUP_TYPE,
-        JSFinalizationGroup::kSize, 0, finalization_group_prototype,
+        JSFinalizationGroup::kHeaderSize, 0, finalization_group_prototype,
         Builtins::kFinalizationGroupConstructor);
     InstallWithIntrinsicDefaultProto(
         isolate(), finalization_group_fun,
@@ -4383,7 +4347,7 @@ void Genesis::InitializeGlobal_harmony_weak_refs() {
   {
     // Create %WeakRefPrototype%
     Handle<Map> weak_ref_map =
-        factory->NewMap(JS_WEAK_REF_TYPE, JSWeakRef::kSize);
+        factory->NewMap(JS_WEAK_REF_TYPE, JSWeakRef::kHeaderSize);
     DCHECK(weak_ref_map->IsJSObjectMap());
 
     Handle<JSObject> weak_ref_prototype = factory->NewJSObject(
@@ -4399,7 +4363,7 @@ void Genesis::InitializeGlobal_harmony_weak_refs() {
     // Create %WeakRef%
     Handle<String> weak_ref_name = factory->InternalizeUtf8String("WeakRef");
     Handle<JSFunction> weak_ref_fun = CreateFunction(
-        isolate(), weak_ref_name, JS_WEAK_REF_TYPE, JSWeakRef::kSize, 0,
+        isolate(), weak_ref_name, JS_WEAK_REF_TYPE, JSWeakRef::kHeaderSize, 0,
         weak_ref_prototype, Builtins::kWeakRefConstructor);
     InstallWithIntrinsicDefaultProto(isolate(), weak_ref_fun,
                                      Context::JS_WEAK_REF_FUNCTION_INDEX);
@@ -4433,7 +4397,7 @@ void Genesis::InitializeGlobal_harmony_weak_refs() {
                           true);
     Handle<Map> cleanup_iterator_map =
         factory->NewMap(JS_FINALIZATION_GROUP_CLEANUP_ITERATOR_TYPE,
-                        JSFinalizationGroupCleanupIterator::kSize);
+                        JSFinalizationGroupCleanupIterator::kHeaderSize);
     Map::SetPrototype(isolate(), cleanup_iterator_map,
                       cleanup_iterator_prototype);
     native_context()->set_js_finalization_group_cleanup_iterator_map(
@@ -4473,6 +4437,17 @@ void Genesis::InitializeGlobal_harmony_regexp_match_indices() {
   initial_map->AppendDescriptor(isolate(), &d);
 }
 
+void Genesis::InitializeGlobal_harmony_string_replaceall() {
+  if (!FLAG_harmony_string_replaceall) return;
+
+  Handle<JSFunction> string_fun(native_context()->string_function(), isolate());
+  Handle<JSObject> string_prototype(
+      JSObject::cast(string_fun->instance_prototype()), isolate());
+
+  SimpleInstallFunction(isolate(), string_prototype, "replaceAll",
+                        Builtins::kStringPrototypeReplaceAll, 2, true);
+}
+
 #ifdef V8_INTL_SUPPORT
 
 void Genesis::InitializeGlobal_harmony_intl_segmenter() {
@@ -4485,8 +4460,8 @@ void Genesis::InitializeGlobal_harmony_intl_segmenter() {
           .ToHandleChecked());
 
   Handle<JSFunction> segmenter_fun = InstallFunction(
-      isolate(), intl, "Segmenter", JS_SEGMENTER_TYPE, JSSegmenter::kSize, 0,
-      factory()->the_hole_value(), Builtins::kSegmenterConstructor);
+      isolate(), intl, "Segmenter", JS_SEGMENTER_TYPE, JSSegmenter::kHeaderSize,
+      0, factory()->the_hole_value(), Builtins::kSegmenterConstructor);
   segmenter_fun->shared().set_length(0);
   segmenter_fun->shared().DontAdaptArguments();
   InstallWithIntrinsicDefaultProto(isolate_, segmenter_fun,
@@ -4546,7 +4521,7 @@ void Genesis::InitializeGlobal_harmony_intl_segmenter() {
             .ToHandleChecked();
     Handle<JSFunction> segment_iterator_fun = CreateFunction(
         isolate(), name_string, JS_SEGMENT_ITERATOR_TYPE,
-        JSSegmentIterator::kSize, 0, prototype, Builtins::kIllegal);
+        JSSegmentIterator::kHeaderSize, 0, prototype, Builtins::kIllegal);
     segment_iterator_fun->shared().set_native(false);
 
     Handle<Map> segment_iterator_map(segment_iterator_fun->initial_map(),
@@ -4555,6 +4530,43 @@ void Genesis::InitializeGlobal_harmony_intl_segmenter() {
   }
 }
 
+void Genesis::InitializeGlobal_harmony_intl_displaynames() {
+  if (!FLAG_harmony_intl_displaynames) return;
+  Handle<JSObject> intl = Handle<JSObject>::cast(
+      JSReceiver::GetProperty(
+          isolate(),
+          Handle<JSReceiver>(native_context()->global_object(), isolate()),
+          factory()->InternalizeUtf8String("Intl"))
+          .ToHandleChecked());
+
+  Handle<JSFunction> display_names_fun = InstallFunction(
+      isolate(), intl, "DisplayNames", JS_DISPLAY_NAMES_TYPE,
+      JSDisplayNames::kHeaderSize, 0, factory()->the_hole_value(),
+      Builtins::kDisplayNamesConstructor);
+  display_names_fun->shared().set_length(0);
+  display_names_fun->shared().DontAdaptArguments();
+  InstallWithIntrinsicDefaultProto(isolate_, display_names_fun,
+                                   Context::INTL_DISPLAY_NAMES_FUNCTION_INDEX);
+
+  SimpleInstallFunction(isolate(), display_names_fun, "supportedLocalesOf",
+                        Builtins::kDisplayNamesSupportedLocalesOf, 1, false);
+
+  {
+    // Setup %DisplayNamesPrototype%.
+    Handle<JSObject> prototype(
+        JSObject::cast(display_names_fun->instance_prototype()), isolate());
+
+    InstallToStringTag(isolate(), prototype, "Intl.DisplayNames");
+
+    SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
+                          Builtins::kDisplayNamesPrototypeResolvedOptions, 0,
+                          false);
+
+    SimpleInstallFunction(isolate(), prototype, "of",
+                          Builtins::kDisplayNamesPrototypeOf, 1, false);
+  }
+}
+
 #endif  // V8_INTL_SUPPORT
 
 Handle<JSFunction> Genesis::CreateArrayBuffer(
@@ -4605,146 +4617,13 @@ Handle<JSFunction> Genesis::CreateArrayBuffer(
   return array_buffer_fun;
 }
 
-void Genesis::InstallInternalPackedArrayFunction(Handle<JSObject> prototype,
-                                                 const char* function_name) {
-  Handle<JSObject> array_prototype(native_context()->initial_array_prototype(),
-                                   isolate());
-  Handle<Object> func =
-      JSReceiver::GetProperty(isolate(), array_prototype, function_name)
-          .ToHandleChecked();
-  JSObject::AddProperty(isolate(), prototype, function_name, func,
-                        ALL_ATTRIBUTES_MASK);
-}
-
-void Genesis::InstallInternalPackedArray(Handle<JSObject> target,
-                                         const char* name) {
-  // --- I n t e r n a l   A r r a y ---
-  // An array constructor on the builtins object that works like
-  // the public Array constructor, except that its prototype
-  // doesn't inherit from Object.prototype.
-  // To be used only for internal work by builtins. Instances
-  // must not be leaked to user code.
-  Handle<JSObject> prototype = factory()->NewJSObject(
-      isolate()->object_function(), AllocationType::kOld);
-  Handle<JSFunction> array_function =
-      InstallFunction(isolate(), target, name, JS_ARRAY_TYPE, JSArray::kSize, 0,
-                      prototype, Builtins::kInternalArrayConstructor);
-
-  array_function->shared().DontAdaptArguments();
-
-  Handle<Map> original_map(array_function->initial_map(), isolate());
-  Handle<Map> initial_map = Map::Copy(isolate(), original_map, "InternalArray");
-  initial_map->set_elements_kind(PACKED_ELEMENTS);
-  JSFunction::SetInitialMap(array_function, initial_map, prototype);
-
-  // Make "length" magic on instances.
-  Map::EnsureDescriptorSlack(isolate(), initial_map, 1);
-
-  PropertyAttributes attribs =
-      static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
-
-  {  // Add length.
-    Descriptor d = Descriptor::AccessorConstant(
-        factory()->length_string(), factory()->array_length_accessor(),
-        attribs);
-    initial_map->AppendDescriptor(isolate(), &d);
-  }
-
-  JSObject::NormalizeProperties(
-      isolate(), prototype, KEEP_INOBJECT_PROPERTIES, 6,
-      "OptimizeInternalPackedArrayPrototypeForAdding");
-  InstallInternalPackedArrayFunction(prototype, "push");
-  InstallInternalPackedArrayFunction(prototype, "pop");
-  InstallInternalPackedArrayFunction(prototype, "shift");
-  InstallInternalPackedArrayFunction(prototype, "unshift");
-  InstallInternalPackedArrayFunction(prototype, "splice");
-  InstallInternalPackedArrayFunction(prototype, "slice");
-
-  JSObject::ForceSetPrototype(prototype, factory()->null_value());
-  JSObject::MigrateSlowToFast(prototype, 0, "Bootstrapping");
-}
-
-bool Genesis::InstallNatives() {
+// TODO(jgruber): Refactor this into some kind of meaningful organization. There
+// is likely no reason remaining for these objects to be installed here. For
+// example, global object setup done in this function could likely move to
+// InitializeGlobal.
+bool Genesis::InstallABunchOfRandomThings() {
   HandleScope scope(isolate());
 
-  // Set up the extras utils object as a shared container between native
-  // scripts and extras. (Extras consume things added there by native scripts.)
-  Handle<JSObject> extras_utils = factory()->NewJSObjectWithNullProto();
-  native_context()->set_extras_utils_object(*extras_utils);
-
-  InstallInternalPackedArray(extras_utils, "InternalPackedArray");
-
-  // Extras need the ability to store private state on their objects without
-  // exposing it to the outside world.
-  SimpleInstallFunction(isolate_, extras_utils, "createPrivateSymbol",
-                        Builtins::kExtrasUtilsCreatePrivateSymbol, 1, false);
-
-  SimpleInstallFunction(isolate_, extras_utils, "uncurryThis",
-                        Builtins::kExtrasUtilsUncurryThis, 1, false);
-
-  SimpleInstallFunction(isolate_, extras_utils, "markPromiseAsHandled",
-                        Builtins::kExtrasUtilsMarkPromiseAsHandled, 1, false);
-
-  SimpleInstallFunction(isolate_, extras_utils, "promiseState",
-                        Builtins::kExtrasUtilsPromiseState, 1, false);
-
-  // [[PromiseState]] values (for extrasUtils.promiseState())
-  // These values should be kept in sync with PromiseStatus in globals.h
-  JSObject::AddProperty(
-      isolate(), extras_utils, "kPROMISE_PENDING",
-      factory()->NewNumberFromInt(static_cast<int>(Promise::kPending)),
-      DONT_ENUM);
-  JSObject::AddProperty(
-      isolate(), extras_utils, "kPROMISE_FULFILLED",
-      factory()->NewNumberFromInt(static_cast<int>(Promise::kFulfilled)),
-      DONT_ENUM);
-  JSObject::AddProperty(
-      isolate(), extras_utils, "kPROMISE_REJECTED",
-      factory()->NewNumberFromInt(static_cast<int>(Promise::kRejected)),
-      DONT_ENUM);
-
-  // v8.createPromise(parent)
-  Handle<JSFunction> promise_internal_constructor =
-      SimpleCreateFunction(isolate(), factory()->empty_string(),
-                           Builtins::kPromiseInternalConstructor, 1, true);
-  promise_internal_constructor->shared().set_native(false);
-  JSObject::AddProperty(isolate(), extras_utils, "createPromise",
-                        promise_internal_constructor, DONT_ENUM);
-
-  // v8.rejectPromise(promise, reason)
-  Handle<JSFunction> promise_internal_reject =
-      SimpleCreateFunction(isolate(), factory()->empty_string(),
-                           Builtins::kPromiseInternalReject, 2, true);
-  promise_internal_reject->shared().set_native(false);
-  JSObject::AddProperty(isolate(), extras_utils, "rejectPromise",
-                        promise_internal_reject, DONT_ENUM);
-
-  // v8.resolvePromise(promise, resolution)
-  Handle<JSFunction> promise_internal_resolve =
-      SimpleCreateFunction(isolate(), factory()->empty_string(),
-                           Builtins::kPromiseInternalResolve, 2, true);
-  promise_internal_resolve->shared().set_native(false);
-  JSObject::AddProperty(isolate(), extras_utils, "resolvePromise",
-                        promise_internal_resolve, DONT_ENUM);
-
-  JSObject::AddProperty(isolate(), extras_utils, "isPromise",
-                        isolate()->is_promise(), DONT_ENUM);
-
-  JSObject::MigrateSlowToFast(Handle<JSObject>::cast(extras_utils), 0,
-                              "Bootstrapping");
-
-  {
-    // Builtin function for OpaqueReference -- a JSPrimitiveWrapper-based
-    // object, that keeps its field isolated from JavaScript code. It may store
-    // objects, that JavaScript code may not access.
-    Handle<JSObject> prototype = factory()->NewJSObject(
-        isolate()->object_function(), AllocationType::kOld);
-    Handle<JSFunction> opaque_reference_fun = CreateFunction(
-        isolate(), factory()->empty_string(), JS_PRIMITIVE_WRAPPER_TYPE,
-        JSPrimitiveWrapper::kSize, 0, prototype, Builtins::kIllegal);
-    native_context()->set_opaque_reference_function(*opaque_reference_fun);
-  }
-
   auto fast_template_instantiations_cache = isolate()->factory()->NewFixedArray(
       TemplateInfo::kFastTemplateInstantiationsCacheSize);
   native_context()->set_fast_template_instantiations_cache(
@@ -4961,14 +4840,15 @@ bool Genesis::InstallNatives() {
 
     // Private internal only fields. All of the remaining fields have special
     // symbols to prevent their use in Javascript.
-    // cached_indices_or_match_info descriptor.
     {
       PropertyAttributes attribs = DONT_ENUM;
+
+      // cached_indices_or_regexp descriptor.
       {
         Descriptor d = Descriptor::DataField(
             isolate(),
-            factory()->regexp_result_cached_indices_or_match_info_symbol(),
-            JSRegExpResult::kCachedIndicesOrMatchInfoIndex, attribs,
+            factory()->regexp_result_cached_indices_or_regexp_symbol(),
+            JSRegExpResult::kCachedIndicesOrRegExpIndex, attribs,
             Representation::Tagged());
         initial_map->AppendDescriptor(isolate(), &d);
       }
@@ -4980,6 +4860,24 @@ bool Genesis::InstallNatives() {
             JSRegExpResult::kNamesIndex, attribs, Representation::Tagged());
         initial_map->AppendDescriptor(isolate(), &d);
       }
+
+      // regexp_input_index descriptor.
+      {
+        Descriptor d = Descriptor::DataField(
+            isolate(), factory()->regexp_result_regexp_input_symbol(),
+            JSRegExpResult::kRegExpInputIndex, attribs,
+            Representation::Tagged());
+        initial_map->AppendDescriptor(isolate(), &d);
+      }
+
+      // regexp_last_index descriptor.
+      {
+        Descriptor d = Descriptor::DataField(
+            isolate(), factory()->regexp_result_regexp_last_index_symbol(),
+            JSRegExpResult::kRegExpLastIndex, attribs,
+            Representation::Tagged());
+        initial_map->AppendDescriptor(isolate(), &d);
+      }
     }
 
     native_context()->set_regexp_result_map(*initial_map);
@@ -5046,7 +4944,7 @@ bool Genesis::InstallNatives() {
   return true;
 }
 
-bool Genesis::InstallExtraNatives() {
+bool Genesis::InstallExtrasBindings() {
   HandleScope scope(isolate());
 
   Handle<JSObject> extras_binding = factory()->NewJSObjectWithNullProto();
@@ -5061,10 +4959,6 @@ bool Genesis::InstallExtraNatives() {
 
   native_context()->set_extras_binding_object(*extras_binding);
 
-  for (int i = 0; i < ExtraNatives::GetBuiltinsCount(); i++) {
-    if (!Bootstrapper::CompileExtraBuiltin(isolate(), i)) return false;
-  }
-
   return true;
 }
 
@@ -5132,8 +5026,6 @@ bool Genesis::InstallExtensions(Isolate* isolate,
                                 v8::ExtensionConfiguration* extensions) {
   ExtensionStates extension_states;  // All extensions have state UNVISITED.
   return InstallAutoExtensions(isolate, &extension_states) &&
-         (!FLAG_expose_free_buffer ||
-          InstallExtension(isolate, "v8/free-buffer", &extension_states)) &&
          (!FLAG_expose_gc ||
           InstallExtension(isolate, "v8/gc", &extension_states)) &&
          (!FLAG_expose_externalize_string ||
@@ -5147,6 +5039,10 @@ bool Genesis::InstallExtensions(Isolate* isolate,
                            &extension_states)) &&
          (!isValidCpuTraceMarkFunctionName() ||
           InstallExtension(isolate, "v8/cpumark", &extension_states)) &&
+#ifdef ENABLE_VTUNE_TRACEMARK
+         (!FLAG_enable_vtune_domain_support ||
+          InstallExtension(isolate, "v8/vtunedomain", &extension_states)) &&
+#endif  // ENABLE_VTUNE_TRACEMARK
          InstallRequestedExtensions(isolate, extensions, &extension_states);
 }
 
@@ -5345,7 +5241,7 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
     Handle<FixedArray> indices =
         GlobalDictionary::IterationIndices(isolate(), properties);
     for (int i = 0; i < indices->length(); i++) {
-      int index = Smi::ToInt(indices->get(i));
+      InternalIndex index(Smi::ToInt(indices->get(i)));
       Handle<PropertyCell> cell(properties->CellAt(index), isolate());
       Handle<Name> key(cell->name(), isolate());
       // If the property is already there we skip it.
@@ -5365,7 +5261,7 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
         NameDictionary::IterationIndices(isolate(), properties);
     ReadOnlyRoots roots(isolate());
     for (int i = 0; i < key_indices->length(); i++) {
-      int key_index = Smi::ToInt(key_indices->get(i));
+      InternalIndex key_index(Smi::ToInt(key_indices->get(i)));
       Object raw_key = properties->KeyAt(key_index);
       DCHECK(properties->IsKey(roots, raw_key));
       DCHECK(raw_key.IsName());
@@ -5515,6 +5411,8 @@ Genesis::Genesis(
     }
     DCHECK(!global_proxy->IsDetachedFrom(native_context()->global_object()));
   } else {
+    DCHECK(native_context().is_null());
+
     base::ElapsedTimer timer;
     if (FLAG_profile_deserialization) timer.Start();
     DCHECK_EQ(0u, context_snapshot_index);
@@ -5535,8 +5433,8 @@ Genesis::Genesis(
     InitializeIteratorFunctions();
     InitializeCallSiteBuiltins();
 
-    if (!InstallNatives()) return;
-    if (!InstallExtraNatives()) return;
+    if (!InstallABunchOfRandomThings()) return;
+    if (!InstallExtrasBindings()) return;
     if (!ConfigureGlobalObjects(global_proxy_template)) return;
 
     isolate->counters()->contexts_created_from_scratch()->Increment();
@@ -5573,8 +5471,6 @@ Genesis::Genesis(
         ReadOnlyRoots(isolate).false_value());
   }
 
-  ConfigureUtilsObject();
-
   // We created new functions, which may require debug instrumentation.
   if (isolate->debug()->is_active()) {
     isolate->debug()->InstallDebugBreakTrampoline();
diff --git a/deps/v8/src/init/bootstrapper.h b/deps/v8/src/init/bootstrapper.h
index 35295c3e88bbcd..aaa199727054a3 100644
--- a/deps/v8/src/init/bootstrapper.h
+++ b/deps/v8/src/init/bootstrapper.h
@@ -9,16 +9,13 @@
 #include "src/objects/fixed-array.h"
 #include "src/objects/shared-function-info.h"
 #include "src/objects/visitors.h"
-#include "src/snapshot/natives.h"
 
 namespace v8 {
 namespace internal {
 
-// A SourceCodeCache uses a FixedArray to store pairs of
-// (OneByteString, SharedFunctionInfo), mapping names of native code files
-// (array.js, etc.) to precompiled functions. Instead of mapping
-// names to functions it might make sense to let the JS2C tool
-// generate an index for each native JS file.
+// A SourceCodeCache uses a FixedArray to store pairs of (OneByteString,
+// SharedFunctionInfo), mapping names of native extensions code files to
+// precompiled functions.
 class SourceCodeCache final {
  public:
   explicit SourceCodeCache(Script::Type type) : type_(type) {}
@@ -68,9 +65,6 @@ class Bootstrapper final {
   // Traverses the pointers for memory management.
   void Iterate(RootVisitor* v);
 
-  // Accessor for the native scripts source code.
-  Handle<String> GetNativeSource(NativeType type, int index);
-
   // Tells whether bootstrapping is active.
   bool IsActive() const { return nesting_ != 0; }
 
@@ -86,12 +80,6 @@ class Bootstrapper final {
 
   SourceCodeCache* extensions_cache() { return &extensions_cache_; }
 
-  static bool CompileNative(Isolate* isolate, Vector<const char> name,
-                            Handle<String> source, int argc,
-                            Handle<Object> argv[], NativesFlag natives_flag);
-  static bool CompileExtraBuiltin(Isolate* isolate, int index);
-  static bool CompileExperimentalExtraBuiltin(Isolate* isolate, int index);
-
  private:
   // Log newly created Map objects if no snapshot was used.
   void LogAllMaps();
diff --git a/deps/v8/src/init/heap-symbols.h b/deps/v8/src/init/heap-symbols.h
index 9d630f547bd1b8..7131b808608ee0 100644
--- a/deps/v8/src/init/heap-symbols.h
+++ b/deps/v8/src/init/heap-symbols.h
@@ -15,7 +15,6 @@
   V(_, cardinal_string, "cardinal")                                 \
   V(_, caseFirst_string, "caseFirst")                               \
   V(_, compare_string, "compare")                                   \
-  V(_, current_string, "current")                                   \
   V(_, collation_string, "collation")                               \
   V(_, compact_string, "compact")                                   \
   V(_, compactDisplay_string, "compactDisplay")                     \
@@ -23,6 +22,7 @@
   V(_, currencyDisplay_string, "currencyDisplay")                   \
   V(_, currencySign_string, "currencySign")                         \
   V(_, dateStyle_string, "dateStyle")                               \
+  V(_, dateTimeField_string, "dateTimeField")                       \
   V(_, day_string, "day")                                           \
   V(_, dayPeriod_string, "dayPeriod")                               \
   V(_, decimal_string, "decimal")                                   \
@@ -33,6 +33,7 @@
   V(_, exponentInteger_string, "exponentInteger")                   \
   V(_, exponentMinusSign_string, "exponentMinusSign")               \
   V(_, exponentSeparator_string, "exponentSeparator")               \
+  V(_, fallback_string, "fallback")                                 \
   V(_, first_string, "first")                                       \
   V(_, format_string, "format")                                     \
   V(_, fraction_string, "fraction")                                 \
@@ -156,6 +157,7 @@
   V(_, conjunction_string, "conjunction")                            \
   V(_, construct_string, "construct")                                \
   V(_, constructor_string, "constructor")                            \
+  V(_, current_string, "current")                                    \
   V(_, Date_string, "Date")                                          \
   V(_, date_to_string, "[object Date]")                              \
   V(_, default_string, "default")                                    \
@@ -169,9 +171,8 @@
   V(_, dot_default_string, ".default")                               \
   V(_, dot_for_string, ".for")                                       \
   V(_, dot_generator_object_string, ".generator_object")             \
-  V(_, dot_iterator_string, ".iterator")                             \
-  V(_, dot_promise_string, ".promise")                               \
   V(_, dot_result_string, ".result")                                 \
+  V(_, dot_repl_result_string, ".repl_result")                       \
   V(_, dot_string, ".")                                              \
   V(_, dot_switch_tag_string, ".switch_tag")                         \
   V(_, dotAll_string, "dotAll")                                      \
@@ -251,6 +252,7 @@
   V(_, of_string, "of")                                              \
   V(_, ok, "ok")                                                     \
   V(_, one_string, "1")                                              \
+  V(_, other_string, "other")                                        \
   V(_, ownKeys_string, "ownKeys")                                    \
   V(_, percent_string, "percent")                                    \
   V(_, position_string, "position")                                  \
@@ -324,36 +326,39 @@
   V(_, writable_string, "writable")                                  \
   V(_, zero_string, "0")
 
-#define PRIVATE_SYMBOL_LIST_GENERATOR(V, _)               \
-  V(_, call_site_frame_array_symbol)                      \
-  V(_, call_site_frame_index_symbol)                      \
-  V(_, console_context_id_symbol)                         \
-  V(_, console_context_name_symbol)                       \
-  V(_, class_fields_symbol)                               \
-  V(_, class_positions_symbol)                            \
-  V(_, detailed_stack_trace_symbol)                       \
-  V(_, elements_transition_symbol)                        \
-  V(_, error_end_pos_symbol)                              \
-  V(_, error_script_symbol)                               \
-  V(_, error_start_pos_symbol)                            \
-  V(_, frozen_symbol)                                     \
-  V(_, generic_symbol)                                    \
-  V(_, home_object_symbol)                                \
-  V(_, interpreter_trampoline_symbol)                     \
-  V(_, megamorphic_symbol)                                \
-  V(_, native_context_index_symbol)                       \
-  V(_, nonextensible_symbol)                              \
-  V(_, not_mapped_symbol)                                 \
-  V(_, promise_debug_marker_symbol)                       \
-  V(_, promise_forwarding_handler_symbol)                 \
-  V(_, promise_handled_by_symbol)                         \
-  V(_, regexp_result_cached_indices_or_match_info_symbol) \
-  V(_, regexp_result_names_symbol)                        \
-  V(_, sealed_symbol)                                     \
-  V(_, stack_trace_symbol)                                \
-  V(_, strict_function_transition_symbol)                 \
-  V(_, wasm_exception_tag_symbol)                         \
-  V(_, wasm_exception_values_symbol)                      \
+#define PRIVATE_SYMBOL_LIST_GENERATOR(V, _)           \
+  V(_, call_site_frame_array_symbol)                  \
+  V(_, call_site_frame_index_symbol)                  \
+  V(_, console_context_id_symbol)                     \
+  V(_, console_context_name_symbol)                   \
+  V(_, class_fields_symbol)                           \
+  V(_, class_positions_symbol)                        \
+  V(_, detailed_stack_trace_symbol)                   \
+  V(_, elements_transition_symbol)                    \
+  V(_, error_end_pos_symbol)                          \
+  V(_, error_script_symbol)                           \
+  V(_, error_start_pos_symbol)                        \
+  V(_, frozen_symbol)                                 \
+  V(_, generic_symbol)                                \
+  V(_, home_object_symbol)                            \
+  V(_, interpreter_trampoline_symbol)                 \
+  V(_, megamorphic_symbol)                            \
+  V(_, native_context_index_symbol)                   \
+  V(_, nonextensible_symbol)                          \
+  V(_, not_mapped_symbol)                             \
+  V(_, promise_debug_marker_symbol)                   \
+  V(_, promise_debug_message_symbol)                  \
+  V(_, promise_forwarding_handler_symbol)             \
+  V(_, promise_handled_by_symbol)                     \
+  V(_, regexp_result_cached_indices_or_regexp_symbol) \
+  V(_, regexp_result_names_symbol)                    \
+  V(_, regexp_result_regexp_input_symbol)             \
+  V(_, regexp_result_regexp_last_index_symbol)        \
+  V(_, sealed_symbol)                                 \
+  V(_, stack_trace_symbol)                            \
+  V(_, strict_function_transition_symbol)             \
+  V(_, wasm_exception_tag_symbol)                     \
+  V(_, wasm_exception_values_symbol)                  \
   V(_, uninitialized_symbol)
 
 #define PUBLIC_SYMBOL_LIST_GENERATOR(V, _)          \
@@ -389,6 +394,7 @@
   F(MC_INCREMENTAL_FINALIZE_BODY)                                  \
   F(MC_INCREMENTAL_LAYOUT_CHANGE)                                  \
   F(MC_INCREMENTAL_START)                                          \
+  F(MC_INCREMENTAL_SWEEP_ARRAY_BUFFERS)                            \
   F(MC_INCREMENTAL_SWEEPING)
 
 #define TOP_MC_SCOPES(F) \
@@ -420,6 +426,7 @@
   F(MC_CLEAR_WEAK_COLLECTIONS)                       \
   F(MC_CLEAR_WEAK_LISTS)                             \
   F(MC_CLEAR_WEAK_REFERENCES)                        \
+  F(MC_COMPLETE_SWEEP_ARRAY_BUFFERS)                 \
   F(MC_EVACUATE_CANDIDATES)                          \
   F(MC_EVACUATE_CLEAN_UP)                            \
   F(MC_EVACUATE_COPY)                                \
@@ -433,6 +440,7 @@
   F(MC_EVACUATE_UPDATE_POINTERS_SLOTS_MAP_SPACE)     \
   F(MC_EVACUATE_UPDATE_POINTERS_TO_NEW_ROOTS)        \
   F(MC_EVACUATE_UPDATE_POINTERS_WEAK)                \
+  F(MC_FINISH_SWEEP_ARRAY_BUFFERS)                   \
   F(MC_MARK_EMBEDDER_PROLOGUE)                       \
   F(MC_MARK_EMBEDDER_TRACING)                        \
   F(MC_MARK_EMBEDDER_TRACING_CLOSURE)                \
@@ -474,7 +482,9 @@
   F(MINOR_MC_MARKING_DEQUE)                          \
   F(MINOR_MC_RESET_LIVENESS)                         \
   F(MINOR_MC_SWEEPING)                               \
+  F(SCAVENGER_COMPLETE_SWEEP_ARRAY_BUFFERS)          \
   F(SCAVENGER_FAST_PROMOTE)                          \
+  F(SCAVENGER_FREE_REMEMBERED_SET)                   \
   F(SCAVENGER_SCAVENGE)                              \
   F(SCAVENGER_PROCESS_ARRAY_BUFFERS)                 \
   F(SCAVENGER_SCAVENGE_WEAK_GLOBAL_HANDLES_IDENTIFY) \
@@ -483,10 +493,12 @@
   F(SCAVENGER_SCAVENGE_ROOTS)                        \
   F(SCAVENGER_SCAVENGE_UPDATE_REFS)                  \
   F(SCAVENGER_SCAVENGE_WEAK)                         \
-  F(SCAVENGER_SCAVENGE_FINALIZE)
+  F(SCAVENGER_SCAVENGE_FINALIZE)                     \
+  F(SCAVENGER_SWEEP_ARRAY_BUFFERS)
 
 #define TRACER_BACKGROUND_SCOPES(F)               \
   F(BACKGROUND_ARRAY_BUFFER_FREE)                 \
+  F(BACKGROUND_ARRAY_BUFFER_SWEEP)                \
   F(BACKGROUND_STORE_BUFFER)                      \
   F(BACKGROUND_UNMAPPER)                          \
   F(MC_BACKGROUND_EVACUATE_COPY)                  \
diff --git a/deps/v8/src/init/setup-isolate-deserialize.cc b/deps/v8/src/init/setup-isolate-deserialize.cc
index ff0268d3c84f91..853c3bde0b523c 100644
--- a/deps/v8/src/init/setup-isolate-deserialize.cc
+++ b/deps/v8/src/init/setup-isolate-deserialize.cc
@@ -5,9 +5,6 @@
 #include "src/init/setup-isolate.h"
 
 #include "src/base/logging.h"
-#include "src/execution/isolate.h"
-#include "src/interpreter/interpreter.h"
-#include "src/utils/ostreams.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/src/init/setup-isolate.h b/deps/v8/src/init/setup-isolate.h
index 1ae9b8d23617c2..a49e4825905dd2 100644
--- a/deps/v8/src/init/setup-isolate.h
+++ b/deps/v8/src/init/setup-isolate.h
@@ -15,10 +15,6 @@ class Code;
 class Heap;
 class Isolate;
 
-namespace interpreter {
-class Interpreter;
-}  // namespace interpreter
-
 // This class is an abstraction layer around initialization of components
 // that are either deserialized from the snapshot or generated from scratch.
 // Currently this includes builtins and interpreter bytecode handlers.
diff --git a/deps/v8/src/init/startup-data-util.cc b/deps/v8/src/init/startup-data-util.cc
index d234c152f884d7..a0f1c7bc9a363e 100644
--- a/deps/v8/src/init/startup-data-util.cc
+++ b/deps/v8/src/init/startup-data-util.cc
@@ -20,7 +20,6 @@ namespace internal {
 
 namespace {
 
-v8::StartupData g_natives;
 v8::StartupData g_snapshot;
 
 void ClearStartupData(v8::StartupData* data) {
@@ -34,14 +33,9 @@ void DeleteStartupData(v8::StartupData* data) {
 }
 
 void FreeStartupData() {
-  DeleteStartupData(&g_natives);
   DeleteStartupData(&g_snapshot);
 }
 
-// TODO(jgruber): Rename to FreeStartupData once natives support has been
-// removed (https://crbug.com/v8/7624).
-void FreeStartupDataSnapshotOnly() { DeleteStartupData(&g_snapshot); }
-
 void Load(const char* blob_file, v8::StartupData* startup_data,
           void (*setter_fn)(v8::StartupData*)) {
   ClearStartupData(startup_data);
@@ -70,10 +64,8 @@ void Load(const char* blob_file, v8::StartupData* startup_data,
   }
 }
 
-void LoadFromFiles(const char* natives_blob, const char* snapshot_blob) {
-  Load(natives_blob, &g_natives, i::V8::SetNativesBlob);
+void LoadFromFile(const char* snapshot_blob) {
   Load(snapshot_blob, &g_snapshot, v8::V8::SetSnapshotDataBlob);
-
   atexit(&FreeStartupData);
 }
 
@@ -88,25 +80,15 @@ void InitializeExternalStartupData(const char* directory_path) {
     snapshot_name = "snapshot_blob_trusted.bin";
   }
 #endif
-  std::unique_ptr<char[]> natives =
-      base::RelativePath(directory_path, "natives_blob.bin");
   std::unique_ptr<char[]> snapshot =
       base::RelativePath(directory_path, snapshot_name);
-  LoadFromFiles(natives.get(), snapshot.get());
-#endif  // V8_USE_EXTERNAL_STARTUP_DATA
-}
-
-void InitializeExternalStartupData(const char* natives_blob,
-                                   const char* snapshot_blob) {
-#ifdef V8_USE_EXTERNAL_STARTUP_DATA
-  LoadFromFiles(natives_blob, snapshot_blob);
+  LoadFromFile(snapshot.get());
 #endif  // V8_USE_EXTERNAL_STARTUP_DATA
 }
 
 void InitializeExternalStartupDataFromFile(const char* snapshot_blob) {
 #ifdef V8_USE_EXTERNAL_STARTUP_DATA
-  Load(snapshot_blob, &g_snapshot, v8::V8::SetSnapshotDataBlob);
-  atexit(&FreeStartupDataSnapshotOnly);
+  LoadFromFile(snapshot_blob);
 #endif  // V8_USE_EXTERNAL_STARTUP_DATA
 }
 
diff --git a/deps/v8/src/init/startup-data-util.h b/deps/v8/src/init/startup-data-util.h
index e4d1e540f7627f..5d49b0b1a17f6e 100644
--- a/deps/v8/src/init/startup-data-util.h
+++ b/deps/v8/src/init/startup-data-util.h
@@ -18,9 +18,6 @@ namespace internal {
 // while tools like cctest need to work in either configuration.
 
 void InitializeExternalStartupData(const char* directory_path);
-
-void InitializeExternalStartupData(const char* natives_blob,
-                                   const char* snapshot_blob);
 void InitializeExternalStartupDataFromFile(const char* snapshot_blob);
 
 }  // namespace internal
diff --git a/deps/v8/src/init/v8.cc b/deps/v8/src/init/v8.cc
index fd26c60848e7dd..edcc399f95cf78 100644
--- a/deps/v8/src/init/v8.cc
+++ b/deps/v8/src/init/v8.cc
@@ -23,7 +23,6 @@
 #include "src/objects/elements.h"
 #include "src/objects/objects-inl.h"
 #include "src/profiler/heap-profiler.h"
-#include "src/snapshot/natives.h"
 #include "src/snapshot/snapshot.h"
 #include "src/tracing/tracing-category-observer.h"
 #include "src/wasm/wasm-engine.h"
@@ -150,14 +149,6 @@ void V8::SetPlatformForTesting(v8::Platform* platform) {
                       reinterpret_cast<base::AtomicWord>(platform));
 }
 
-void V8::SetNativesBlob(StartupData* natives_blob) {
-#ifdef V8_USE_EXTERNAL_STARTUP_DATA
-  base::CallOnce(&init_natives_once, &SetNativesFromFile, natives_blob);
-#else
-  UNREACHABLE();
-#endif
-}
-
 void V8::SetSnapshotBlob(StartupData* snapshot_blob) {
 #ifdef V8_USE_EXTERNAL_STARTUP_DATA
   base::CallOnce(&init_snapshot_once, &SetSnapshotFromFile, snapshot_blob);
diff --git a/deps/v8/src/init/v8.h b/deps/v8/src/init/v8.h
index bd8331a9078e99..a8cd6832cdcbe8 100644
--- a/deps/v8/src/init/v8.h
+++ b/deps/v8/src/init/v8.h
@@ -36,7 +36,6 @@ class V8 : public AllStatic {
   // Should be used only for testing.
   V8_EXPORT_PRIVATE static void SetPlatformForTesting(v8::Platform* platform);
 
-  static void SetNativesBlob(StartupData* natives_blob);
   static void SetSnapshotBlob(StartupData* snapshot_blob);
 
  private:
diff --git a/deps/v8/src/inspector/BUILD.gn b/deps/v8/src/inspector/BUILD.gn
index d39e12c733a049..a326ab0127ce85 100644
--- a/deps/v8/src/inspector/BUILD.gn
+++ b/deps/v8/src/inspector/BUILD.gn
@@ -65,9 +65,7 @@ config("inspector_config") {
   visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
   configs = [ "../../:internal_config" ]
-  include_dirs = [
-    "../../include",
-  ]
+  include_dirs = [ "../../include" ]
 }
 
 v8_header_set("inspector_test_headers") {
@@ -97,8 +95,7 @@ v8_source_set("inspector") {
   deps = [
     ":inspector_string_conversions",
     "../..:v8_version",
-    "../../third_party/inspector_protocol:encoding",
-    "../../third_party/inspector_protocol:bindings",
+    "../../third_party/inspector_protocol:crdtp",
   ]
 
   public_deps = [
@@ -146,8 +143,6 @@ v8_source_set("inspector") {
     "v8-heap-profiler-agent-impl.h",
     "v8-inspector-impl.cc",
     "v8-inspector-impl.h",
-    "v8-inspector-protocol-encoding.cc",
-    "v8-inspector-protocol-encoding.h",
     "v8-inspector-session-impl.cc",
     "v8-inspector-session-impl.h",
     "v8-profiler-agent-impl.cc",
@@ -164,8 +159,6 @@ v8_source_set("inspector") {
     "v8-value-utils.h",
     "value-mirror.cc",
     "value-mirror.h",
-    "wasm-translation.cc",
-    "wasm-translation.h",
   ]
 }
 
diff --git a/deps/v8/src/inspector/DEPS b/deps/v8/src/inspector/DEPS
index f72dcce0a93c44..f72271a55cc670 100644
--- a/deps/v8/src/inspector/DEPS
+++ b/deps/v8/src/inspector/DEPS
@@ -7,8 +7,9 @@ include_rules = [
   "+src/base/macros.h",
   "+src/base/memory.h",
   "+src/base/optional.h",
-  "+src/base/platform/platform.h",
   "+src/base/platform/mutex.h",
+  "+src/base/platform/platform.h",
+  "+src/base/platform/time.h",
   "+src/base/safe_conversions.h",
   "+src/base/template-utils.h",
   "+src/base/v8-fallthrough.h",
@@ -18,8 +19,6 @@ include_rules = [
   "+src/debug/debug-interface.h",
   "+src/debug/interface-types.h",
   "+src/utils/vector.h",
-  "+third_party/inspector_protocol/encoding/encoding.h",
-  "+third_party/inspector_protocol/encoding/encoding.cc",
-  "+../../third_party/inspector_protocol/encoding/encoding.h",
-  "+../../third_party/inspector_protocol/encoding/encoding.cc",
+  "+third_party/inspector_protocol/crdtp",
+  "+../../third_party/inspector_protocol/crdtp",
 ]
diff --git a/deps/v8/src/inspector/OWNERS b/deps/v8/src/inspector/OWNERS
index 92422c0a88270e..faa8c326b0b2b4 100644
--- a/deps/v8/src/inspector/OWNERS
+++ b/deps/v8/src/inspector/OWNERS
@@ -3,6 +3,7 @@ caseq@chromium.org
 dgozman@chromium.org
 kozyatinskiy@chromium.org
 pfeldman@chromium.org
+szuend@chromium.org
 yangguo@chromium.org
 
 per-file PRESUBMIT.py=file:../../INFRA_OWNERS
diff --git a/deps/v8/src/inspector/custom-preview.cc b/deps/v8/src/inspector/custom-preview.cc
index 77cd6dc5f56077..aa5652a42d125e 100644
--- a/deps/v8/src/inspector/custom-preview.cc
+++ b/deps/v8/src/inspector/custom-preview.cc
@@ -4,6 +4,7 @@
 
 #include "src/inspector/custom-preview.h"
 
+#include "../../third_party/inspector_protocol/crdtp/json.h"
 #include "src/debug/debug-interface.h"
 #include "src/inspector/injected-script.h"
 #include "src/inspector/inspected-context.h"
@@ -119,8 +120,11 @@ bool substituteObjectTags(int sessionId, const String16& groupName,
       reportError(context, tryCatch, "cannot wrap value");
       return false;
     }
+    std::vector<uint8_t> cbor = std::move(*wrapper).TakeSerialized();
+    std::vector<uint8_t> json;
+    v8_crdtp::json::ConvertCBORToJSON(v8_crdtp::SpanFrom(cbor), &json);
     v8::Local<v8::Value> jsonWrapper;
-    String16 serialized = wrapper->toJSON();
+    v8_inspector::StringView serialized(json.data(), json.size());
     if (!v8::JSON::Parse(context, toV8String(isolate, serialized))
              .ToLocal(&jsonWrapper)) {
       reportError(context, tryCatch, "cannot wrap value");
diff --git a/deps/v8/src/inspector/injected-script.cc b/deps/v8/src/inspector/injected-script.cc
index 6afc6486e42ff7..fb3fa9b0696c61 100644
--- a/deps/v8/src/inspector/injected-script.cc
+++ b/deps/v8/src/inspector/injected-script.cc
@@ -33,6 +33,7 @@
 #include <cmath>
 #include <unordered_set>
 
+#include "../../third_party/inspector_protocol/crdtp/json.h"
 #include "src/inspector/custom-preview.h"
 #include "src/inspector/inspected-context.h"
 #include "src/inspector/protocol/Protocol.h"
@@ -68,7 +69,8 @@ class InjectedScript::ProtocolPromiseHandler {
   static bool add(V8InspectorSessionImpl* session,
                   v8::Local<v8::Context> context, v8::Local<v8::Value> value,
                   int executionContextId, const String16& objectGroup,
-                  WrapMode wrapMode, EvaluateCallback* callback) {
+                  WrapMode wrapMode, bool replMode,
+                  EvaluateCallback* callback) {
     v8::Local<v8::Promise::Resolver> resolver;
     if (!v8::Promise::Resolver::New(context).ToLocal(&resolver)) {
       callback->sendFailure(Response::InternalError());
@@ -79,24 +81,25 @@ class InjectedScript::ProtocolPromiseHandler {
       return false;
     }
 
-    v8::Local<v8::Promise> promise = resolver->GetPromise();
+    v8::MaybeLocal<v8::Promise> originalPromise =
+        value->IsPromise() ? v8::Local<v8::Promise>::Cast(value)
+                           : v8::MaybeLocal<v8::Promise>();
     V8InspectorImpl* inspector = session->inspector();
     ProtocolPromiseHandler* handler = new ProtocolPromiseHandler(
-        session, executionContextId, objectGroup, wrapMode, callback);
+        session, executionContextId, objectGroup, wrapMode, replMode, callback,
+        originalPromise);
     v8::Local<v8::Value> wrapper = handler->m_wrapper.Get(inspector->isolate());
     v8::Local<v8::Function> thenCallbackFunction =
         v8::Function::New(context, thenCallback, wrapper, 0,
                           v8::ConstructorBehavior::kThrow)
             .ToLocalChecked();
-    if (promise->Then(context, thenCallbackFunction).IsEmpty()) {
-      callback->sendFailure(Response::InternalError());
-      return false;
-    }
     v8::Local<v8::Function> catchCallbackFunction =
         v8::Function::New(context, catchCallback, wrapper, 0,
                           v8::ConstructorBehavior::kThrow)
             .ToLocalChecked();
-    if (promise->Catch(context, catchCallbackFunction).IsEmpty()) {
+    v8::Local<v8::Promise> promise = resolver->GetPromise();
+    if (promise->Then(context, thenCallbackFunction, catchCallbackFunction)
+            .IsEmpty()) {
       callback->sendFailure(Response::InternalError());
       return false;
     }
@@ -104,6 +107,13 @@ class InjectedScript::ProtocolPromiseHandler {
   }
 
  private:
+  static v8::Local<v8::String> GetDotReplResultString(v8::Isolate* isolate) {
+    // TODO(szuend): Cache the string in a v8::Persistent handle.
+    return v8::String::NewFromOneByte(
+               isolate, reinterpret_cast<const uint8_t*>(".repl_result"))
+        .ToLocalChecked();
+  }
+
   static void thenCallback(const v8::FunctionCallbackInfo<v8::Value>& info) {
     ProtocolPromiseHandler* handler = static_cast<ProtocolPromiseHandler*>(
         info.Data().As<v8::External>()->Value());
@@ -130,23 +140,32 @@ class InjectedScript::ProtocolPromiseHandler {
 
   ProtocolPromiseHandler(V8InspectorSessionImpl* session,
                          int executionContextId, const String16& objectGroup,
-                         WrapMode wrapMode, EvaluateCallback* callback)
+                         WrapMode wrapMode, bool replMode,
+                         EvaluateCallback* callback,
+                         v8::MaybeLocal<v8::Promise> maybeEvaluationResult)
       : m_inspector(session->inspector()),
         m_sessionId(session->sessionId()),
         m_contextGroupId(session->contextGroupId()),
         m_executionContextId(executionContextId),
         m_objectGroup(objectGroup),
         m_wrapMode(wrapMode),
+        m_replMode(replMode),
         m_callback(std::move(callback)),
         m_wrapper(m_inspector->isolate(),
                   v8::External::New(m_inspector->isolate(), this)) {
     m_wrapper.SetWeak(this, cleanup, v8::WeakCallbackType::kParameter);
+    v8::Local<v8::Promise> promise;
+    if (maybeEvaluationResult.ToLocal(&promise)) {
+      m_evaluationResult =
+          v8::Global<v8::Promise>(m_inspector->isolate(), promise);
+    }
   }
 
   static void cleanup(
       const v8::WeakCallbackInfo<ProtocolPromiseHandler>& data) {
     if (!data.GetParameter()->m_wrapper.IsEmpty()) {
       data.GetParameter()->m_wrapper.Reset();
+      data.GetParameter()->m_evaluationResult.Reset();
       data.SetSecondPassCallback(cleanup);
     } else {
       data.GetParameter()->sendPromiseCollected();
@@ -154,19 +173,40 @@ class InjectedScript::ProtocolPromiseHandler {
     }
   }
 
-  void thenCallback(v8::Local<v8::Value> result) {
+  void thenCallback(v8::Local<v8::Value> value) {
     V8InspectorSessionImpl* session =
         m_inspector->sessionById(m_contextGroupId, m_sessionId);
     if (!session) return;
     InjectedScript::ContextScope scope(session, m_executionContextId);
     Response response = scope.initialize();
     if (!response.isSuccess()) return;
-    if (m_objectGroup == "console") {
-      scope.injectedScript()->setLastEvaluationResult(result);
-    }
+
     std::unique_ptr<EvaluateCallback> callback =
         scope.injectedScript()->takeEvaluateCallback(m_callback);
     if (!callback) return;
+
+    // In REPL mode the result is additionally wrapped in an object.
+    // The evaluation result can be found at ".repl_result".
+    v8::Local<v8::Value> result = value;
+    if (m_replMode) {
+      v8::Local<v8::Object> object;
+      if (!result->ToObject(scope.context()).ToLocal(&object)) {
+        callback->sendFailure(response);
+        return;
+      }
+
+      v8::Local<v8::String> name =
+          GetDotReplResultString(m_inspector->isolate());
+      if (!object->Get(scope.context(), name).ToLocal(&result)) {
+        callback->sendFailure(response);
+        return;
+      }
+    }
+
+    if (m_objectGroup == "console") {
+      scope.injectedScript()->setLastEvaluationResult(result);
+    }
+
     std::unique_ptr<protocol::Runtime::RemoteObject> wrappedValue;
     response = scope.injectedScript()->wrapObject(result, m_objectGroup,
                                                   m_wrapMode, &wrappedValue);
@@ -195,14 +235,40 @@ class InjectedScript::ProtocolPromiseHandler {
       callback->sendFailure(response);
       return;
     }
-    String16 message;
-    std::unique_ptr<V8StackTraceImpl> stack;
     v8::Isolate* isolate = session->inspector()->isolate();
+
+    v8::MaybeLocal<v8::Message> maybeMessage =
+        m_evaluationResult.IsEmpty()
+            ? v8::MaybeLocal<v8::Message>()
+            : v8::debug::GetMessageFromPromise(m_evaluationResult.Get(isolate));
+    v8::Local<v8::Message> message;
+    // In case a MessageObject was attached to the rejected promise, we
+    // construct the exception details from the message object. Otherwise
+    // we try to capture a fresh stack trace.
+    if (maybeMessage.ToLocal(&message)) {
+      v8::Local<v8::Value> exception = result;
+      protocol::detail::PtrMaybe<protocol::Runtime::ExceptionDetails>
+          exceptionDetails;
+      response = scope.injectedScript()->createExceptionDetails(
+          message, exception, m_objectGroup, &exceptionDetails);
+      if (!response.isSuccess()) {
+        callback->sendFailure(response);
+        return;
+      }
+
+      callback->sendSuccess(std::move(wrappedValue),
+                            std::move(exceptionDetails));
+      return;
+    }
+
+    String16 messageString;
+    std::unique_ptr<V8StackTraceImpl> stack;
     if (result->IsNativeError()) {
-      message = " " + toProtocolString(
-                          isolate,
-                          result->ToDetailString(isolate->GetCurrentContext())
-                              .ToLocalChecked());
+      messageString =
+          " " +
+          toProtocolString(isolate,
+                           result->ToDetailString(isolate->GetCurrentContext())
+                               .ToLocalChecked());
       v8::Local<v8::StackTrace> stackTrace = v8::debug::GetDetailedStackTrace(
           isolate, v8::Local<v8::Object>::Cast(result));
       if (!stackTrace.IsEmpty()) {
@@ -212,10 +278,18 @@ class InjectedScript::ProtocolPromiseHandler {
     if (!stack) {
       stack = m_inspector->debugger()->captureStackTrace(true);
     }
+
+    // REPL mode implicitly handles the script like an async function.
+    // Do not prepend the '(in promise)' prefix for these exceptions since that
+    // would be confusing for the user. The stringified error is part of the
+    // exception and does not need to be added in REPL mode, otherwise it would
+    // be printed twice.
+    String16 exceptionDetailsText =
+        m_replMode ? "Uncaught" : "Uncaught (in promise)" + messageString;
     std::unique_ptr<protocol::Runtime::ExceptionDetails> exceptionDetails =
         protocol::Runtime::ExceptionDetails::create()
             .setExceptionId(m_inspector->nextExceptionId())
-            .setText("Uncaught (in promise)" + message)
+            .setText(exceptionDetailsText)
             .setLineNumber(stack && !stack->isEmpty() ? stack->topLineNumber()
                                                       : 0)
             .setColumnNumber(
@@ -254,8 +328,10 @@ class InjectedScript::ProtocolPromiseHandler {
   int m_executionContextId;
   String16 m_objectGroup;
   WrapMode m_wrapMode;
+  bool m_replMode;
   EvaluateCallback* m_callback;
   v8::Global<v8::External> m_wrapper;
+  v8::Global<v8::Promise> m_evaluationResult;
 };
 
 InjectedScript::InjectedScript(InspectedContext* context, int sessionId)
@@ -393,22 +469,53 @@ Response InjectedScript::getInternalAndPrivateProperties(
                            .setValue(std::move(remoteObject))
                            .build());
   }
+
   std::vector<PrivatePropertyMirror> privatePropertyWrappers =
-      ValueMirror::getPrivateProperties(m_context->context(), value_obj);
+      ValueMirror::getPrivateProperties(context, value_obj);
   for (const auto& privateProperty : privatePropertyWrappers) {
+    std::unique_ptr<PrivatePropertyDescriptor> descriptor =
+        PrivatePropertyDescriptor::create()
+            .setName(privateProperty.name)
+            .build();
+
     std::unique_ptr<RemoteObject> remoteObject;
-    Response response = privateProperty.value->buildRemoteObject(
-        m_context->context(), WrapMode::kNoPreview, &remoteObject);
-    if (!response.isSuccess()) return response;
-    response = bindRemoteObjectIfNeeded(sessionId, context,
-                                        privateProperty.value->v8Value(),
-                                        groupName, remoteObject.get());
-    if (!response.isSuccess()) return response;
-    (*privateProperties)
-        ->emplace_back(PrivatePropertyDescriptor::create()
-                           .setName(privateProperty.name)
-                           .setValue(std::move(remoteObject))
-                           .build());
+    Response response;
+    DCHECK((privateProperty.getter || privateProperty.setter) ^
+           (!!privateProperty.value));
+    if (privateProperty.value) {
+      response = privateProperty.value->buildRemoteObject(
+          context, WrapMode::kNoPreview, &remoteObject);
+      if (!response.isSuccess()) return response;
+      response = bindRemoteObjectIfNeeded(sessionId, context,
+                                          privateProperty.value->v8Value(),
+                                          groupName, remoteObject.get());
+      if (!response.isSuccess()) return response;
+      descriptor->setValue(std::move(remoteObject));
+    }
+
+    if (privateProperty.getter) {
+      response = privateProperty.getter->buildRemoteObject(
+          context, WrapMode::kNoPreview, &remoteObject);
+      if (!response.isSuccess()) return response;
+      response = bindRemoteObjectIfNeeded(sessionId, context,
+                                          privateProperty.getter->v8Value(),
+                                          groupName, remoteObject.get());
+      if (!response.isSuccess()) return response;
+      descriptor->setGet(std::move(remoteObject));
+    }
+
+    if (privateProperty.setter) {
+      response = privateProperty.setter->buildRemoteObject(
+          context, WrapMode::kNoPreview, &remoteObject);
+      if (!response.isSuccess()) return response;
+      response = bindRemoteObjectIfNeeded(sessionId, context,
+                                          privateProperty.setter->v8Value(),
+                                          groupName, remoteObject.get());
+      if (!response.isSuccess()) return response;
+      descriptor->setSet(std::move(remoteObject));
+    }
+
+    (*privateProperties)->emplace_back(std::move(descriptor));
   }
   return Response::OK();
 }
@@ -533,7 +640,7 @@ std::unique_ptr<protocol::Runtime::RemoteObject> InjectedScript::wrapTable(
 
 void InjectedScript::addPromiseCallback(
     V8InspectorSessionImpl* session, v8::MaybeLocal<v8::Value> value,
-    const String16& objectGroup, WrapMode wrapMode,
+    const String16& objectGroup, WrapMode wrapMode, bool replMode,
     std::unique_ptr<EvaluateCallback> callback) {
   if (value.IsEmpty()) {
     callback->sendFailure(Response::InternalError());
@@ -541,9 +648,10 @@ void InjectedScript::addPromiseCallback(
   }
   v8::MicrotasksScope microtasksScope(m_context->isolate(),
                                       v8::MicrotasksScope::kRunMicrotasks);
-  if (ProtocolPromiseHandler::add(
-          session, m_context->context(), value.ToLocalChecked(),
-          m_context->contextId(), objectGroup, wrapMode, callback.get())) {
+  if (ProtocolPromiseHandler::add(session, m_context->context(),
+                                  value.ToLocalChecked(),
+                                  m_context->contextId(), objectGroup, wrapMode,
+                                  replMode, callback.get())) {
     m_evaluateCallbacks.insert(callback.release());
   }
 }
@@ -621,7 +729,14 @@ Response InjectedScript::resolveCallArgument(
   if (callArgument->hasValue() || callArgument->hasUnserializableValue()) {
     String16 value;
     if (callArgument->hasValue()) {
-      value = "(" + callArgument->getValue(nullptr)->toJSONString() + ")";
+      std::vector<uint8_t> cbor =
+          std::move(*callArgument->getValue(nullptr)).TakeSerialized();
+      std::vector<uint8_t> json;
+      v8_crdtp::json::ConvertCBORToJSON(v8_crdtp::SpanFrom(cbor), &json);
+      value =
+          "(" +
+          String16(reinterpret_cast<const char*>(json.data()), json.size()) +
+          ")";
     } else {
       String16 unserializableValue = callArgument->getUnserializableValue("");
       // Protect against potential identifier resolution for NaN and Infinity.
@@ -664,6 +779,13 @@ Response InjectedScript::createExceptionDetails(
   if (!tryCatch.HasCaught()) return Response::InternalError();
   v8::Local<v8::Message> message = tryCatch.Message();
   v8::Local<v8::Value> exception = tryCatch.Exception();
+  return createExceptionDetails(message, exception, objectGroup, result);
+}
+
+Response InjectedScript::createExceptionDetails(
+    v8::Local<v8::Message> message, v8::Local<v8::Value> exception,
+    const String16& objectGroup,
+    Maybe<protocol::Runtime::ExceptionDetails>* result) {
   String16 messageText =
       message.IsEmpty()
           ? String16()
diff --git a/deps/v8/src/inspector/injected-script.h b/deps/v8/src/inspector/injected-script.h
index 080769f7121981..1e8381410c21c0 100644
--- a/deps/v8/src/inspector/injected-script.h
+++ b/deps/v8/src/inspector/injected-script.h
@@ -108,6 +108,7 @@ class InjectedScript final {
   void addPromiseCallback(V8InspectorSessionImpl* session,
                           v8::MaybeLocal<v8::Value> value,
                           const String16& objectGroup, WrapMode wrapMode,
+                          bool replMode,
                           std::unique_ptr<EvaluateCallback> callback);
 
   Response findObject(const RemoteObjectId&, v8::Local<v8::Value>*) const;
@@ -120,6 +121,11 @@ class InjectedScript final {
   Response createExceptionDetails(
       const v8::TryCatch&, const String16& groupName,
       Maybe<protocol::Runtime::ExceptionDetails>* result);
+  Response createExceptionDetails(
+      v8::Local<v8::Message> message, v8::Local<v8::Value> exception,
+      const String16& groupName,
+      Maybe<protocol::Runtime::ExceptionDetails>* result);
+
   Response wrapEvaluateResult(
       v8::MaybeLocal<v8::Value> maybeResultValue, const v8::TryCatch&,
       const String16& objectGroup, WrapMode wrapMode,
diff --git a/deps/v8/src/inspector/inspector_protocol_config.json b/deps/v8/src/inspector/inspector_protocol_config.json
index 684940c8859ba0..92bce2ad24590a 100644
--- a/deps/v8/src/inspector/inspector_protocol_config.json
+++ b/deps/v8/src/inspector/inspector_protocol_config.json
@@ -36,7 +36,7 @@
         "string_header": "v8-inspector.h",
         "string_in": "StringView",
         "string_out": "std::unique_ptr<StringBuffer>",
-        "to_string_out": "StringBufferImpl::adopt(%s)",
+        "to_string_out": "StringBufferFrom(std::move(%s))",
         "export_macro": "V8_EXPORT"
     },
 
@@ -46,11 +46,7 @@
         "string_header": "src/inspector/string-util.h"
     },
 
-    "encoding_lib": {
-        "namespace": "v8_inspector_protocol_encoding"
-    },
-
-    "bindings_lib": {
-        "namespace": "v8_inspector_protocol_bindings"
+    "crdtp": {
+        "namespace": "v8_crdtp"
     }
 }
diff --git a/deps/v8/src/inspector/string-16.cc b/deps/v8/src/inspector/string-16.cc
index 3adffeddf1c887..15344ee2b8388c 100644
--- a/deps/v8/src/inspector/string-16.cc
+++ b/deps/v8/src/inspector/string-16.cc
@@ -12,6 +12,7 @@
 #include <limits>
 #include <string>
 
+#include "../../third_party/inspector_protocol/crdtp/cbor.h"
 #include "src/base/platform/platform.h"
 #include "src/inspector/v8-string-conversions.h"
 #include "src/numbers/conversions.h"
@@ -229,3 +230,13 @@ std::string String16::utf8() const {
 }
 
 }  // namespace v8_inspector
+
+namespace v8_crdtp {
+void SerializerTraits<v8_inspector::String16>::Serialize(
+    const v8_inspector::String16& str, std::vector<uint8_t>* out) {
+  cbor::EncodeFromUTF16(
+      span<uint16_t>(reinterpret_cast<const uint16_t*>(str.characters16()),
+                     str.length()),
+      out);
+}
+}  // namespace v8_crdtp
diff --git a/deps/v8/src/inspector/string-16.h b/deps/v8/src/inspector/string-16.h
index 910a2e49c63c92..16d2b15527d86f 100644
--- a/deps/v8/src/inspector/string-16.h
+++ b/deps/v8/src/inspector/string-16.h
@@ -12,6 +12,7 @@
 #include <string>
 #include <vector>
 
+#include "../../third_party/inspector_protocol/crdtp/serializer_traits.h"
 #include "src/base/compiler-specific.h"
 
 namespace v8_inspector {
@@ -164,4 +165,13 @@ struct hash<v8_inspector::String16> {
 
 #endif  // !defined(__APPLE__) || defined(_LIBCPP_VERSION)
 
+// See third_party/inspector_protocol/crdtp/serializer_traits.h.
+namespace v8_crdtp {
+template <>
+struct SerializerTraits<v8_inspector::String16> {
+  static void Serialize(const v8_inspector::String16& str,
+                        std::vector<uint8_t>* out);
+};
+}  // namespace v8_crdtp
+
 #endif  // V8_INSPECTOR_STRING_16_H_
diff --git a/deps/v8/src/inspector/string-util.cc b/deps/v8/src/inspector/string-util.cc
index bae5dd91a901d5..e37b59b1c89d5c 100644
--- a/deps/v8/src/inspector/string-util.cc
+++ b/deps/v8/src/inspector/string-util.cc
@@ -73,14 +73,12 @@ String16 toString16(const StringView& string) {
   if (string.is8Bit())
     return String16(reinterpret_cast<const char*>(string.characters8()),
                     string.length());
-  return String16(reinterpret_cast<const UChar*>(string.characters16()),
-                  string.length());
+  return String16(string.characters16(), string.length());
 }
 
 StringView toStringView(const String16& string) {
   if (string.isEmpty()) return StringView();
-  return StringView(reinterpret_cast<const uint16_t*>(string.characters16()),
-                    string.length());
+  return StringView(string.characters16(), string.length());
 }
 
 bool stringViewStartsWith(const StringView& string, const char* prefix) {
@@ -124,49 +122,65 @@ std::unique_ptr<protocol::Value> StringUtil::parseJSON(const String16& string) {
   return parseJSONCharacters(string.characters16(),
                              static_cast<int>(string.length()));
 }
+}  // namespace protocol
 
-// static
-ProtocolMessage StringUtil::jsonToMessage(String message) {
-  ProtocolMessage result;
-  result.json = std::move(message);
-  return result;
-}
+namespace {
+// An empty string buffer doesn't own any string data; its ::string() returns a
+// default-constructed StringView instance.
+class EmptyStringBuffer : public StringBuffer {
+ public:
+  const StringView& string() override { return string_; }
 
-// static
-ProtocolMessage StringUtil::binaryToMessage(std::vector<uint8_t> message) {
-  ProtocolMessage result;
-  result.binary = std::move(message);
-  return result;
-}
+ private:
+  StringView string_;
+};
 
-// static
-void StringUtil::builderAppendQuotedString(StringBuilder& builder,
-                                           const String& str) {
-  builder.append('"');
-  if (!str.isEmpty()) {
-    escapeWideStringForJSON(
-        reinterpret_cast<const uint16_t*>(str.characters16()),
-        static_cast<int>(str.length()), &builder);
-  }
-  builder.append('"');
-}
+// Contains LATIN1 text data or CBOR encoded binary data in a vector.
+class StringBuffer8 : public StringBuffer {
+ public:
+  explicit StringBuffer8(std::vector<uint8_t> data)
+      : data_(std::move(data)), string_(data_.data(), data_.size()) {}
 
-}  // namespace protocol
+  const StringView& string() override { return string_; }
+
+ private:
+  std::vector<uint8_t> data_;
+  StringView string_;
+};
+
+// Contains a 16 bit string (String16).
+class StringBuffer16 : public StringBuffer {
+ public:
+  explicit StringBuffer16(String16 data)
+      : data_(std::move(data)), string_(data_.characters16(), data_.length()) {}
+
+  const StringView& string() override { return string_; }
+
+ private:
+  String16 data_;
+  StringView string_;
+};
+}  // namespace
 
 // static
 std::unique_ptr<StringBuffer> StringBuffer::create(const StringView& string) {
-  String16 owner = toString16(string);
-  return StringBufferImpl::adopt(owner);
+  if (string.length() == 0) return std::make_unique<EmptyStringBuffer>();
+  if (string.is8Bit()) {
+    return std::make_unique<StringBuffer8>(std::vector<uint8_t>(
+        string.characters8(), string.characters8() + string.length()));
+  }
+  return std::make_unique<StringBuffer16>(
+      String16(string.characters16(), string.length()));
 }
 
-// static
-std::unique_ptr<StringBufferImpl> StringBufferImpl::adopt(String16& string) {
-  return std::unique_ptr<StringBufferImpl>(new StringBufferImpl(string));
+std::unique_ptr<StringBuffer> StringBufferFrom(String16 str) {
+  if (str.isEmpty()) return std::make_unique<EmptyStringBuffer>();
+  return std::make_unique<StringBuffer16>(std::move(str));
 }
 
-StringBufferImpl::StringBufferImpl(String16& string) {
-  m_owner.swap(string);
-  m_string = toStringView(m_owner);
+std::unique_ptr<StringBuffer> StringBufferFrom(std::vector<uint8_t> str) {
+  if (str.empty()) return std::make_unique<EmptyStringBuffer>();
+  return std::make_unique<StringBuffer8>(std::move(str));
 }
 
 String16 stackTraceIdToString(uintptr_t id) {
diff --git a/deps/v8/src/inspector/string-util.h b/deps/v8/src/inspector/string-util.h
index 9b6a8bdd5d76ce..15925b663c33c0 100644
--- a/deps/v8/src/inspector/string-util.h
+++ b/deps/v8/src/inspector/string-util.h
@@ -22,10 +22,6 @@ class Value;
 
 using String = v8_inspector::String16;
 using StringBuilder = v8_inspector::String16Builder;
-struct ProtocolMessage {
-  String json;
-  std::vector<uint8_t> binary;
-};
 
 class StringUtil {
  public:
@@ -60,7 +56,6 @@ class StringUtil {
       const char* s, size_t len) {
     builder.append(s, len);
   }
-  static void builderAppendQuotedString(StringBuilder&, const String&);
   static void builderReserve(
       StringBuilder& builder,  // NOLINT(runtime/references)
       size_t capacity) {
@@ -72,17 +67,11 @@ class StringUtil {
   }
   static std::unique_ptr<protocol::Value> parseJSON(const String16& json);
   static std::unique_ptr<protocol::Value> parseJSON(const StringView& json);
-  static ProtocolMessage jsonToMessage(String message);
-  static ProtocolMessage binaryToMessage(std::vector<uint8_t> message);
 
   static String fromUTF8(const uint8_t* data, size_t length) {
     return String16::fromUTF8(reinterpret_cast<const char*>(data), length);
   }
 
-  static String fromUTF16(const uint16_t* data, size_t length) {
-    return String16(data, length);
-  }
-
   static String fromUTF16LE(const uint16_t* data, size_t length) {
     return String16::fromUTF16LE(data, length);
   }
@@ -132,32 +121,13 @@ String16 toString16(const StringView&);
 StringView toStringView(const String16&);
 bool stringViewStartsWith(const StringView&, const char*);
 
-class StringBufferImpl : public StringBuffer {
- public:
-  // Destroys string's content.
-  static std::unique_ptr<StringBufferImpl> adopt(String16&);
-  const StringView& string() override { return m_string; }
+// Creates a string buffer instance which owns |str|, a 16 bit string.
+std::unique_ptr<StringBuffer> StringBufferFrom(String16 str);
 
- private:
-  explicit StringBufferImpl(String16&);
-  String16 m_owner;
-  StringView m_string;
-
-  DISALLOW_COPY_AND_ASSIGN(StringBufferImpl);
-};
-
-class BinaryStringBuffer : public StringBuffer {
- public:
-  explicit BinaryStringBuffer(std::vector<uint8_t> data)
-      : m_data(std::move(data)), m_string(m_data.data(), m_data.size()) {}
-  const StringView& string() override { return m_string; }
-
- private:
-  std::vector<uint8_t> m_data;
-  StringView m_string;
-
-  DISALLOW_COPY_AND_ASSIGN(BinaryStringBuffer);
-};
+// Creates a string buffer instance which owns |str|, an 8 bit string.
+// 8 bit strings are used for LATIN1 text (which subsumes 7 bit ASCII, e.g.
+// our generated JSON), as well as for CBOR encoded binary messages.
+std::unique_ptr<StringBuffer> StringBufferFrom(std::vector<uint8_t> str);
 
 String16 stackTraceIdToString(uintptr_t id);
 
diff --git a/deps/v8/src/inspector/v8-console-message.cc b/deps/v8/src/inspector/v8-console-message.cc
index e4c678a272958a..6add55a76f2914 100644
--- a/deps/v8/src/inspector/v8-console-message.cc
+++ b/deps/v8/src/inspector/v8-console-message.cc
@@ -153,7 +153,7 @@ class V8ValueStringBuilder {
 
   bool append(v8::Local<v8::Symbol> symbol) {
     m_builder.append("Symbol(");
-    bool result = append(symbol->Name(), IgnoreUndefined);
+    bool result = append(symbol->Description(), IgnoreUndefined);
     m_builder.append(')');
     return result;
   }
diff --git a/deps/v8/src/inspector/v8-debugger-agent-impl.cc b/deps/v8/src/inspector/v8-debugger-agent-impl.cc
index 18bf43fbbc80f5..0176bef645fa09 100644
--- a/deps/v8/src/inspector/v8-debugger-agent-impl.cc
+++ b/deps/v8/src/inspector/v8-debugger-agent-impl.cc
@@ -64,19 +64,6 @@ static const intptr_t kBreakpointHintMaxSearchOffset = 80 * 10;
 
 namespace {
 
-void TranslateLocation(protocol::Debugger::Location* location,
-                       WasmTranslation* wasmTranslation) {
-  String16 scriptId = location->getScriptId();
-  int lineNumber = location->getLineNumber();
-  int columnNumber = location->getColumnNumber(-1);
-  if (wasmTranslation->TranslateWasmScriptLocationToProtocolLocation(
-          &scriptId, &lineNumber, &columnNumber)) {
-    location->setScriptId(std::move(scriptId));
-    location->setLineNumber(lineNumber);
-    location->setColumnNumber(columnNumber);
-  }
-}
-
 enum class BreakpointType {
   kByUrl = 1,
   kByUrlRegex,
@@ -460,8 +447,10 @@ static bool matches(V8InspectorImpl* inspector, const V8DebuggerScript& script,
       V8Regex regex(inspector, selector, true);
       return regex.match(script.sourceURL()) != -1;
     }
+    case BreakpointType::kByScriptId: {
+      return script.scriptId() == selector;
+    }
     default:
-      UNREACHABLE();
       return false;
   }
 }
@@ -646,11 +635,24 @@ Response V8DebuggerAgentImpl::removeBreakpoint(const String16& breakpointId) {
   protocol::DictionaryValue* breakpointHints =
       m_state->getObject(DebuggerAgentState::breakpointHints);
   if (breakpointHints) breakpointHints->remove(breakpointId);
-  removeBreakpointImpl(breakpointId);
+
+  // Get a list of scripts to remove breakpoints.
+  // TODO(duongn): we can do better here if from breakpoint id we can tell it is
+  // not Wasm breakpoint.
+  std::vector<V8DebuggerScript*> scripts;
+  for (const auto& scriptIter : m_scripts) {
+    if (!matches(m_inspector, *scriptIter.second, type, selector)) continue;
+    V8DebuggerScript* script = scriptIter.second.get();
+    scripts.push_back(script);
+  }
+  removeBreakpointImpl(breakpointId, scripts);
+
   return Response::OK();
 }
 
-void V8DebuggerAgentImpl::removeBreakpointImpl(const String16& breakpointId) {
+void V8DebuggerAgentImpl::removeBreakpointImpl(
+    const String16& breakpointId,
+    const std::vector<V8DebuggerScript*>& scripts) {
   DCHECK(enabled());
   BreakpointIdToDebuggerBreakpointIdsMap::iterator
       debuggerBreakpointIdsIterator =
@@ -660,6 +662,9 @@ void V8DebuggerAgentImpl::removeBreakpointImpl(const String16& breakpointId) {
     return;
   }
   for (const auto& id : debuggerBreakpointIdsIterator->second) {
+    for (auto& script : scripts) {
+      script->removeWasmBreakpoint(id);
+    }
     v8::debug::RemoveBreakpoint(m_isolate, id);
     m_debuggerBreakpointIdToBreakpointId.erase(id);
   }
@@ -952,13 +957,18 @@ Response V8DebuggerAgentImpl::restartFrame(
   return Response::OK();
 }
 
-Response V8DebuggerAgentImpl::getScriptSource(const String16& scriptId,
-                                              String16* scriptSource) {
+Response V8DebuggerAgentImpl::getScriptSource(
+    const String16& scriptId, String16* scriptSource,
+    Maybe<protocol::Binary>* bytecode) {
   if (!enabled()) return Response::Error(kDebuggerNotEnabled);
   ScriptsMap::iterator it = m_scripts.find(scriptId);
   if (it == m_scripts.end())
     return Response::Error("No script for id: " + scriptId);
   *scriptSource = it->second->source(0);
+  v8::MemorySpan<const uint8_t> span;
+  if (it->second->wasmBytecode().To(&span)) {
+    *bytecode = protocol::Binary::fromSpan(span.data(), span.size());
+  }
   return Response::OK();
 }
 
@@ -1325,7 +1335,6 @@ Response V8DebuggerAgentImpl::currentCallFrames(
             .setLineNumber(loc.GetLineNumber())
             .setColumnNumber(loc.GetColumnNumber())
             .build();
-    TranslateLocation(location.get(), m_debugger->wasmTranslation());
     String16 scriptId = String16::fromInteger(script->Id());
     ScriptsMap::iterator scriptIterator =
         m_scripts.find(location->getScriptId());
@@ -1701,7 +1710,8 @@ void V8DebuggerAgentImpl::removeBreakpointFor(v8::Local<v8::Function> function,
       source == DebugCommandBreakpointSource ? BreakpointType::kDebugCommand
                                              : BreakpointType::kMonitorCommand,
       function);
-  removeBreakpointImpl(breakpointId);
+  std::vector<V8DebuggerScript*> scripts;
+  removeBreakpointImpl(breakpointId, scripts);
 }
 
 void V8DebuggerAgentImpl::reset() {
diff --git a/deps/v8/src/inspector/v8-debugger-agent-impl.h b/deps/v8/src/inspector/v8-debugger-agent-impl.h
index e6b35b845a90bf..540d655bc2f9f5 100644
--- a/deps/v8/src/inspector/v8-debugger-agent-impl.h
+++ b/deps/v8/src/inspector/v8-debugger-agent-impl.h
@@ -93,8 +93,8 @@ class V8DebuggerAgentImpl : public protocol::Debugger::Backend {
           newCallFrames,
       Maybe<protocol::Runtime::StackTrace>* asyncStackTrace,
       Maybe<protocol::Runtime::StackTraceId>* asyncStackTraceId) override;
-  Response getScriptSource(const String16& scriptId,
-                           String16* scriptSource) override;
+  Response getScriptSource(const String16& scriptId, String16* scriptSource,
+                           Maybe<protocol::Binary>* bytecode) override;
   Response getWasmBytecode(const String16& scriptId,
                            protocol::Binary* bytecode) override;
   Response pause() override;
@@ -177,7 +177,8 @@ class V8DebuggerAgentImpl : public protocol::Debugger::Backend {
   void setBreakpointImpl(const String16& breakpointId,
                          v8::Local<v8::Function> function,
                          v8::Local<v8::String> condition);
-  void removeBreakpointImpl(const String16& breakpointId);
+  void removeBreakpointImpl(const String16& breakpointId,
+                            const std::vector<V8DebuggerScript*>& scripts);
   void clearBreakDetails();
 
   void internalSetAsyncCallStackDepth(int);
diff --git a/deps/v8/src/inspector/v8-debugger-script.cc b/deps/v8/src/inspector/v8-debugger-script.cc
index 99511fc144e8bc..f4b3f487c15f5f 100644
--- a/deps/v8/src/inspector/v8-debugger-script.cc
+++ b/deps/v8/src/inspector/v8-debugger-script.cc
@@ -9,7 +9,6 @@
 #include "src/inspector/string-util.h"
 #include "src/inspector/v8-debugger-agent-impl.h"
 #include "src/inspector/v8-inspector-impl.h"
-#include "src/inspector/wasm-translation.h"
 
 namespace v8_inspector {
 
@@ -86,32 +85,6 @@ String16 calculateHash(v8::Isolate* isolate, v8::Local<v8::String> source) {
   return hash.toString();
 }
 
-void TranslateProtocolLocationToV8Location(WasmTranslation* wasmTranslation,
-                                           v8::debug::Location* loc,
-                                           const String16& scriptId,
-                                           const String16& expectedV8ScriptId) {
-  if (loc->IsEmpty()) return;
-  int lineNumber = loc->GetLineNumber();
-  int columnNumber = loc->GetColumnNumber();
-  String16 translatedScriptId = scriptId;
-  wasmTranslation->TranslateProtocolLocationToWasmScriptLocation(
-      &translatedScriptId, &lineNumber, &columnNumber);
-  DCHECK_EQ(expectedV8ScriptId.utf8(), translatedScriptId.utf8());
-  *loc = v8::debug::Location(lineNumber, columnNumber);
-}
-
-void TranslateV8LocationToProtocolLocation(
-    WasmTranslation* wasmTranslation, v8::debug::Location* loc,
-    const String16& scriptId, const String16& expectedProtocolScriptId) {
-  int lineNumber = loc->GetLineNumber();
-  int columnNumber = loc->GetColumnNumber();
-  String16 translatedScriptId = scriptId;
-  wasmTranslation->TranslateWasmScriptLocationToProtocolLocation(
-      &translatedScriptId, &lineNumber, &columnNumber);
-  DCHECK_EQ(expectedProtocolScriptId.utf8(), translatedScriptId.utf8());
-  *loc = v8::debug::Location(lineNumber, columnNumber);
-}
-
 class ActualScript : public V8DebuggerScript {
   friend class V8DebuggerScript;
 
@@ -334,137 +307,6 @@ class ActualScript : public V8DebuggerScript {
   v8::Global<v8::debug::Script> m_script;
 };
 
-class WasmVirtualScript : public V8DebuggerScript {
-  friend class V8DebuggerScript;
-
- public:
-  WasmVirtualScript(v8::Isolate* isolate, WasmTranslation* wasmTranslation,
-                    v8::Local<v8::debug::WasmScript> script, String16 id,
-                    String16 url, int functionIndex)
-      : V8DebuggerScript(isolate, std::move(id), std::move(url)),
-        m_script(isolate, script),
-        m_wasmTranslation(wasmTranslation),
-        m_functionIndex(functionIndex) {
-    m_script.AnnotateStrongRetainer(kGlobalDebuggerScriptHandleLabel);
-    m_executionContextId = script->ContextId().ToChecked();
-  }
-
-  const String16& sourceMappingURL() const override { return emptyString(); }
-  bool isLiveEdit() const override { return false; }
-  bool isModule() const override { return false; }
-  void setSourceMappingURL(const String16&) override {}
-  void setSource(const String16&, bool, v8::debug::LiveEditResult*) override {
-    UNREACHABLE();
-  }
-  bool isSourceLoadedLazily() const override { return true; }
-  String16 source(size_t pos, size_t len) const override {
-    return m_wasmTranslation->GetSource(m_id, m_functionIndex)
-        .substring(pos, len);
-  }
-  v8::Maybe<v8::MemorySpan<const uint8_t>> wasmBytecode() const override {
-    return v8::Nothing<v8::MemorySpan<const uint8_t>>();
-  }
-  int startLine() const override {
-    return m_wasmTranslation->GetStartLine(m_id, m_functionIndex);
-  }
-  int startColumn() const override {
-    return m_wasmTranslation->GetStartColumn(m_id, m_functionIndex);
-  }
-  int endLine() const override {
-    return m_wasmTranslation->GetEndLine(m_id, m_functionIndex);
-  }
-  int endColumn() const override {
-    return m_wasmTranslation->GetEndColumn(m_id, m_functionIndex);
-  }
-  int length() const override {
-    return static_cast<int>(source(0, UINT_MAX).length());
-  }
-
-  bool getPossibleBreakpoints(
-      const v8::debug::Location& start, const v8::debug::Location& end,
-      bool restrictToFunction,
-      std::vector<v8::debug::BreakLocation>* locations) override {
-    v8::HandleScope scope(m_isolate);
-    v8::Local<v8::debug::Script> script = m_script.Get(m_isolate);
-    String16 v8ScriptId = String16::fromInteger(script->Id());
-
-    v8::debug::Location translatedStart = start;
-    TranslateProtocolLocationToV8Location(m_wasmTranslation, &translatedStart,
-                                          scriptId(), v8ScriptId);
-
-    v8::debug::Location translatedEnd = end;
-    if (translatedEnd.IsEmpty()) {
-      // Stop before the start of the next function.
-      translatedEnd =
-          v8::debug::Location(translatedStart.GetLineNumber() + 1, 0);
-    } else {
-      TranslateProtocolLocationToV8Location(m_wasmTranslation, &translatedEnd,
-                                            scriptId(), v8ScriptId);
-    }
-
-    bool success = script->GetPossibleBreakpoints(
-        translatedStart, translatedEnd, restrictToFunction, locations);
-    for (v8::debug::BreakLocation& loc : *locations) {
-      TranslateV8LocationToProtocolLocation(m_wasmTranslation, &loc, v8ScriptId,
-                                            scriptId());
-    }
-    return success;
-  }
-
-  void resetBlackboxedStateCache() override {}
-
-  int offset(int lineNumber, int columnNumber) const override {
-    return kNoOffset;
-  }
-
-  v8::debug::Location location(int offset) const override {
-    return v8::debug::Location();
-  }
-
-  bool setBreakpoint(const String16& condition, v8::debug::Location* location,
-                     int* id) const override {
-    v8::HandleScope scope(m_isolate);
-    v8::Local<v8::debug::Script> script = m_script.Get(m_isolate);
-    String16 v8ScriptId = String16::fromInteger(script->Id());
-
-    TranslateProtocolLocationToV8Location(m_wasmTranslation, location,
-                                          scriptId(), v8ScriptId);
-    if (location->IsEmpty()) return false;
-    if (!script->SetBreakpoint(toV8String(m_isolate, condition), location, id))
-      return false;
-    TranslateV8LocationToProtocolLocation(m_wasmTranslation, location,
-                                          v8ScriptId, scriptId());
-    return true;
-  }
-
-  bool setBreakpointOnRun(int*) const override { return false; }
-
-  const String16& hash() const override {
-    if (m_hash.isEmpty()) {
-      m_hash = m_wasmTranslation->GetHash(m_id, m_functionIndex);
-    }
-    return m_hash;
-  }
-
-  void MakeWeak() override {}
-
- private:
-  static const String16& emptyString() {
-    // On the heap and leaked so that no destructor needs to run at exit time.
-    static const String16* singleEmptyString = new String16;
-    return *singleEmptyString;
-  }
-
-  v8::Local<v8::debug::Script> script() const override {
-    return m_script.Get(m_isolate);
-  }
-
-  v8::Global<v8::debug::WasmScript> m_script;
-  WasmTranslation* m_wasmTranslation;
-  int m_functionIndex;
-  mutable String16 m_hash;
-};
-
 }  // namespace
 
 std::unique_ptr<V8DebuggerScript> V8DebuggerScript::Create(
@@ -474,15 +316,6 @@ std::unique_ptr<V8DebuggerScript> V8DebuggerScript::Create(
                                         client);
 }
 
-std::unique_ptr<V8DebuggerScript> V8DebuggerScript::CreateWasm(
-    v8::Isolate* isolate, WasmTranslation* wasmTranslation,
-    v8::Local<v8::debug::WasmScript> underlyingScript, String16 id,
-    String16 url, int functionIndex) {
-  return std::make_unique<WasmVirtualScript>(isolate, wasmTranslation,
-                                             underlyingScript, std::move(id),
-                                             std::move(url), functionIndex);
-}
-
 V8DebuggerScript::V8DebuggerScript(v8::Isolate* isolate, String16 id,
                                    String16 url)
     : m_id(std::move(id)), m_url(std::move(url)), m_isolate(isolate) {}
@@ -502,4 +335,9 @@ bool V8DebuggerScript::setBreakpoint(const String16& condition,
   return script()->SetBreakpoint(toV8String(m_isolate, condition), loc, id);
 }
 
+void V8DebuggerScript::removeWasmBreakpoint(int id) {
+  v8::HandleScope scope(m_isolate);
+  script()->RemoveWasmBreakpoint(id);
+}
+
 }  // namespace v8_inspector
diff --git a/deps/v8/src/inspector/v8-debugger-script.h b/deps/v8/src/inspector/v8-debugger-script.h
index b53d2c15aa80ab..164e017610cf73 100644
--- a/deps/v8/src/inspector/v8-debugger-script.h
+++ b/deps/v8/src/inspector/v8-debugger-script.h
@@ -43,17 +43,12 @@ namespace v8_inspector {
 
 class V8DebuggerAgentImpl;
 class V8InspectorClient;
-class WasmTranslation;
 
 class V8DebuggerScript {
  public:
   static std::unique_ptr<V8DebuggerScript> Create(
       v8::Isolate* isolate, v8::Local<v8::debug::Script> script,
       bool isLiveEdit, V8DebuggerAgentImpl* agent, V8InspectorClient* client);
-  static std::unique_ptr<V8DebuggerScript> CreateWasm(
-      v8::Isolate* isolate, WasmTranslation* wasmTranslation,
-      v8::Local<v8::debug::WasmScript> underlyingScript, String16 id,
-      String16 url, int functionIndex);
 
   virtual ~V8DebuggerScript();
 
@@ -92,6 +87,7 @@ class V8DebuggerScript {
 
   virtual bool setBreakpoint(const String16& condition,
                              v8::debug::Location* location, int* id) const = 0;
+  void removeWasmBreakpoint(int id);
   virtual void MakeWeak() = 0;
   virtual bool setBreakpointOnRun(int* id) const = 0;
 
diff --git a/deps/v8/src/inspector/v8-debugger.cc b/deps/v8/src/inspector/v8-debugger.cc
index bd127b2c1ce818..3bdbba80b10b0f 100644
--- a/deps/v8/src/inspector/v8-debugger.cc
+++ b/deps/v8/src/inspector/v8-debugger.cc
@@ -108,8 +108,7 @@ V8Debugger::V8Debugger(v8::Isolate* isolate, V8InspectorImpl* inspector)
       m_continueToLocationBreakpointId(kNoBreakpointId),
       m_maxAsyncCallStacks(kMaxAsyncTaskStacks),
       m_maxAsyncCallStackDepth(0),
-      m_pauseOnExceptionsState(v8::debug::NoBreakOnException),
-      m_wasmTranslation(isolate) {}
+      m_pauseOnExceptionsState(v8::debug::NoBreakOnException) {}
 
 V8Debugger::~V8Debugger() {
   m_isolate->RemoveCallCompletedCallback(
@@ -147,7 +146,6 @@ void V8Debugger::disable() {
   m_taskWithScheduledBreakPauseRequested = false;
   m_pauseOnNextCallRequested = false;
   m_pauseOnAsyncCall = false;
-  m_wasmTranslation.Clear();
   v8::debug::SetDebugDelegate(m_isolate, nullptr);
   m_isolate->RemoveNearHeapLimitCallback(&V8Debugger::nearHeapLimitCallback,
                                          m_originalHeapLimit);
@@ -297,7 +295,7 @@ bool V8Debugger::asyncStepOutOfFunction(int targetContextGroupId,
                                         bool onlyAtReturn) {
   v8::HandleScope handleScope(m_isolate);
   auto iterator = v8::debug::StackTraceIterator::Create(m_isolate);
-  DCHECK(!iterator->Done());
+  CHECK(!iterator->Done());
   bool atReturn = !iterator->GetReturnValue().IsEmpty();
   iterator->Advance();
   // Synchronous stack has more then one frame.
@@ -514,22 +512,17 @@ void V8Debugger::ScriptCompiled(v8::Local<v8::debug::Script> script,
 
   v8::Isolate* isolate = m_isolate;
   V8InspectorClient* client = m_inspector->client();
-  WasmTranslation& wasmTranslation = m_wasmTranslation;
 
   m_inspector->forEachSession(
       m_inspector->contextGroupId(contextId),
-      [isolate, &script, has_compile_error, is_live_edited, client,
-       &wasmTranslation](V8InspectorSessionImpl* session) {
+      [isolate, &script, has_compile_error, is_live_edited,
+       client](V8InspectorSessionImpl* session) {
         auto agent = session->debuggerAgent();
         if (!agent->enabled()) return;
-        if (script->IsWasm() && script->SourceMappingURL().IsEmpty()) {
-          wasmTranslation.AddScript(script.As<v8::debug::WasmScript>(), agent);
-        } else {
-          agent->didParseSource(
-              V8DebuggerScript::Create(isolate, script, is_live_edited, agent,
-                                       client),
-              !has_compile_error);
-        }
+        agent->didParseSource(
+            V8DebuggerScript::Create(isolate, script, is_live_edited, agent,
+                                     client),
+            !has_compile_error);
       });
 }
 
@@ -1008,7 +1001,6 @@ void V8Debugger::allAsyncTasksCanceled() {
   m_currentExternalParent.clear();
   m_currentTasks.clear();
 
-  m_framesCache.clear();
   m_allAsyncStacks.clear();
   m_asyncStacksCount = 0;
 }
@@ -1066,28 +1058,12 @@ void V8Debugger::collectOldAsyncStacksIfNeeded() {
       ++it;
     }
   }
-  cleanupExpiredWeakPointers(m_framesCache);
 }
 
 std::shared_ptr<StackFrame> V8Debugger::symbolize(
     v8::Local<v8::StackFrame> v8Frame) {
-  auto it = m_framesCache.end();
-  int frameId = 0;
-  if (m_maxAsyncCallStackDepth) {
-    frameId = v8::debug::GetStackFrameId(v8Frame);
-    it = m_framesCache.find(frameId);
-  }
-  if (it != m_framesCache.end() && !it->second.expired()) {
-    return std::shared_ptr<StackFrame>(it->second);
-  }
-  std::shared_ptr<StackFrame> frame(new StackFrame(isolate(), v8Frame));
-  // TODO(clemensb): Figure out a way to do this translation only right before
-  // sending the stack trace over wire.
-  if (v8Frame->IsWasm()) frame->translate(&m_wasmTranslation);
-  if (m_maxAsyncCallStackDepth) {
-    m_framesCache[frameId] = frame;
-  }
-  return frame;
+  CHECK(!v8Frame.IsEmpty());
+  return std::make_shared<StackFrame>(isolate(), v8Frame);
 }
 
 void V8Debugger::setMaxAsyncTaskStacksForTest(int limit) {
diff --git a/deps/v8/src/inspector/v8-debugger.h b/deps/v8/src/inspector/v8-debugger.h
index a078d14f3d2113..f5605818aba8ca 100644
--- a/deps/v8/src/inspector/v8-debugger.h
+++ b/deps/v8/src/inspector/v8-debugger.h
@@ -17,7 +17,6 @@
 #include "src/inspector/protocol/Forward.h"
 #include "src/inspector/protocol/Runtime.h"
 #include "src/inspector/v8-debugger-script.h"
-#include "src/inspector/wasm-translation.h"
 
 #include "include/v8-inspector.h"
 
@@ -140,8 +139,6 @@ class V8Debugger : public v8::debug::DebugDelegate,
 
   V8InspectorImpl* inspector() { return m_inspector; }
 
-  WasmTranslation* wasmTranslation() { return &m_wasmTranslation; }
-
   void setMaxAsyncTaskStacksForTest(int limit);
   void dumpAsyncTaskStacksStateForTest();
 
@@ -249,7 +246,6 @@ class V8Debugger : public v8::debug::DebugDelegate,
   // V8Debugger owns all the async stacks, while most of the other references
   // are weak, which allows to collect some stacks when there are too many.
   std::list<std::shared_ptr<AsyncStackTrace>> m_allAsyncStacks;
-  std::unordered_map<int, std::weak_ptr<StackFrame>> m_framesCache;
 
   std::unordered_map<V8DebuggerAgentImpl*, int> m_maxAsyncCallStackDepthMap;
   void* m_taskWithScheduledBreak = nullptr;
@@ -274,8 +270,6 @@ class V8Debugger : public v8::debug::DebugDelegate,
 
   std::unique_ptr<TerminateExecutionCallback> m_terminateExecutionCallback;
 
-  WasmTranslation m_wasmTranslation;
-
   DISALLOW_COPY_AND_ASSIGN(V8Debugger);
 };
 
diff --git a/deps/v8/src/inspector/v8-heap-profiler-agent-impl.cc b/deps/v8/src/inspector/v8-heap-profiler-agent-impl.cc
index 02aa1ad9feb929..8bd68cdbc643e9 100644
--- a/deps/v8/src/inspector/v8-heap-profiler-agent-impl.cc
+++ b/deps/v8/src/inspector/v8-heap-profiler-agent-impl.cc
@@ -187,9 +187,10 @@ Response V8HeapProfilerAgentImpl::startTrackingHeapObjects(
 }
 
 Response V8HeapProfilerAgentImpl::stopTrackingHeapObjects(
-    Maybe<bool> reportProgress) {
+    Maybe<bool> reportProgress, Maybe<bool> treatGlobalObjectsAsRoots) {
   requestHeapStatsUpdate();
-  takeHeapSnapshot(std::move(reportProgress));
+  takeHeapSnapshot(std::move(reportProgress),
+                   std::move(treatGlobalObjectsAsRoots));
   stopTrackingHeapObjectsInternal();
   return Response::OK();
 }
@@ -211,7 +212,8 @@ Response V8HeapProfilerAgentImpl::disable() {
   return Response::OK();
 }
 
-Response V8HeapProfilerAgentImpl::takeHeapSnapshot(Maybe<bool> reportProgress) {
+Response V8HeapProfilerAgentImpl::takeHeapSnapshot(
+    Maybe<bool> reportProgress, Maybe<bool> treatGlobalObjectsAsRoots) {
   v8::HeapProfiler* profiler = m_isolate->GetHeapProfiler();
   if (!profiler) return Response::Error("Cannot access v8 heap profiler");
   std::unique_ptr<HeapSnapshotProgress> progress;
@@ -219,8 +221,8 @@ Response V8HeapProfilerAgentImpl::takeHeapSnapshot(Maybe<bool> reportProgress) {
     progress.reset(new HeapSnapshotProgress(&m_frontend));
 
   GlobalObjectNameResolver resolver(m_session);
-  const v8::HeapSnapshot* snapshot =
-      profiler->TakeHeapSnapshot(progress.get(), &resolver);
+  const v8::HeapSnapshot* snapshot = profiler->TakeHeapSnapshot(
+      progress.get(), &resolver, treatGlobalObjectsAsRoots.fromMaybe(true));
   if (!snapshot) return Response::Error("Failed to take heap snapshot");
   HeapSnapshotOutputStream stream(&m_frontend);
   snapshot->Serialize(&stream);
diff --git a/deps/v8/src/inspector/v8-heap-profiler-agent-impl.h b/deps/v8/src/inspector/v8-heap-profiler-agent-impl.h
index 665e30be945368..c4a783fa3064e8 100644
--- a/deps/v8/src/inspector/v8-heap-profiler-agent-impl.h
+++ b/deps/v8/src/inspector/v8-heap-profiler-agent-impl.h
@@ -31,11 +31,14 @@ class V8HeapProfilerAgentImpl : public protocol::HeapProfiler::Backend {
 
   Response enable() override;
   Response startTrackingHeapObjects(Maybe<bool> trackAllocations) override;
-  Response stopTrackingHeapObjects(Maybe<bool> reportProgress) override;
+  Response stopTrackingHeapObjects(
+      Maybe<bool> reportProgress,
+      Maybe<bool> treatGlobalObjectsAsRoots) override;
 
   Response disable() override;
 
-  Response takeHeapSnapshot(Maybe<bool> reportProgress) override;
+  Response takeHeapSnapshot(Maybe<bool> reportProgress,
+                            Maybe<bool> treatGlobalObjectsAsRoots) override;
 
   Response getObjectByHeapObjectId(
       const String16& heapSnapshotObjectId, Maybe<String16> objectGroup,
diff --git a/deps/v8/src/inspector/v8-inspector-impl.cc b/deps/v8/src/inspector/v8-inspector-impl.cc
index e91dd7f7f46b1e..c767dbf09dc5b3 100644
--- a/deps/v8/src/inspector/v8-inspector-impl.cc
+++ b/deps/v8/src/inspector/v8-inspector-impl.cc
@@ -246,7 +246,6 @@ void V8InspectorImpl::resetContextGroup(int contextGroupId) {
                  [&contextIdsToClear](InspectedContext* context) {
                    contextIdsToClear.push_back(context->contextId());
                  });
-  m_debugger->wasmTranslation()->Clear(m_isolate, contextIdsToClear);
   forEachSession(contextGroupId,
                  [](V8InspectorSessionImpl* session) { session->reset(); });
   m_contexts.erase(contextGroupId);
@@ -331,6 +330,39 @@ void V8InspectorImpl::allAsyncTasksCanceled() {
   m_debugger->allAsyncTasksCanceled();
 }
 
+V8Inspector::Counters::Counters(v8::Isolate* isolate) : m_isolate(isolate) {
+  CHECK(m_isolate);
+  V8InspectorImpl* inspector =
+      static_cast<V8InspectorImpl*>(v8::debug::GetInspector(m_isolate));
+  CHECK(inspector);
+  CHECK(!inspector->m_counters);
+  inspector->m_counters = this;
+  m_isolate->SetCounterFunction(&Counters::getCounterPtr);
+}
+
+V8Inspector::Counters::~Counters() {
+  V8InspectorImpl* inspector =
+      static_cast<V8InspectorImpl*>(v8::debug::GetInspector(m_isolate));
+  CHECK(inspector);
+  inspector->m_counters = nullptr;
+  m_isolate->SetCounterFunction(nullptr);
+}
+
+int* V8Inspector::Counters::getCounterPtr(const char* name) {
+  v8::Isolate* isolate = v8::Isolate::GetCurrent();
+  DCHECK(isolate);
+  V8Inspector* inspector = v8::debug::GetInspector(isolate);
+  DCHECK(inspector);
+  auto* instance = static_cast<V8InspectorImpl*>(inspector)->m_counters;
+  DCHECK(instance);
+  return &(instance->m_countersMap[name]);
+}
+
+std::shared_ptr<V8Inspector::Counters> V8InspectorImpl::enableCounters() {
+  if (m_counters) return m_counters->shared_from_this();
+  return std::make_shared<Counters>(m_isolate);
+}
+
 v8::Local<v8::Context> V8InspectorImpl::regexContext() {
   if (m_regexContext.IsEmpty())
     m_regexContext.Reset(m_isolate, v8::Context::New(m_isolate));
diff --git a/deps/v8/src/inspector/v8-inspector-impl.h b/deps/v8/src/inspector/v8-inspector-impl.h
index 6276d6d7f6fe96..dce3db52bd481d 100644
--- a/deps/v8/src/inspector/v8-inspector-impl.h
+++ b/deps/v8/src/inspector/v8-inspector-impl.h
@@ -107,6 +107,8 @@ class V8InspectorImpl : public V8Inspector {
   void externalAsyncTaskStarted(const V8StackTraceId& parent) override;
   void externalAsyncTaskFinished(const V8StackTraceId& parent) override;
 
+  std::shared_ptr<Counters> enableCounters() override;
+
   unsigned nextExceptionId() { return ++m_lastExceptionId; }
   void enableStackCapturingIfNeeded();
   void disableStackCapturingIfNeeded();
@@ -144,6 +146,8 @@ class V8InspectorImpl : public V8Inspector {
   };
 
  private:
+  friend class Counters;
+
   v8::Isolate* m_isolate;
   V8InspectorClient* m_client;
   std::unique_ptr<V8Debugger> m_debugger;
@@ -174,6 +178,8 @@ class V8InspectorImpl : public V8Inspector {
 
   std::unique_ptr<V8Console> m_console;
 
+  Counters* m_counters = nullptr;
+
   DISALLOW_COPY_AND_ASSIGN(V8InspectorImpl);
 };
 
diff --git a/deps/v8/src/inspector/v8-inspector-protocol-encoding.cc b/deps/v8/src/inspector/v8-inspector-protocol-encoding.cc
deleted file mode 100644
index 45702e4b33e4c7..00000000000000
--- a/deps/v8/src/inspector/v8-inspector-protocol-encoding.cc
+++ /dev/null
@@ -1,51 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/inspector/v8-inspector-protocol-encoding.h"
-
-#include <cmath>
-#include "../../third_party/inspector_protocol/encoding/encoding.h"
-#include "src/numbers/conversions.h"
-#include "src/utils/vector.h"
-
-namespace v8_inspector {
-namespace {
-using IPEStatus = ::v8_inspector_protocol_encoding::Status;
-using ::v8_inspector_protocol_encoding::span;
-
-class Platform : public ::v8_inspector_protocol_encoding::json::Platform {
- public:
-  bool StrToD(const char* str, double* result) const override {
-    *result = v8::internal::StringToDouble(str, v8::internal::NO_FLAGS);
-    return !std::isnan(*result);
-  }
-  std::unique_ptr<char[]> DToStr(double value) const override {
-    v8::internal::ScopedVector<char> buffer(
-        v8::internal::kDoubleToCStringMinBufferSize);
-    const char* str = v8::internal::DoubleToCString(value, buffer);
-    if (str == nullptr) return nullptr;
-    std::unique_ptr<char[]> result(new char[strlen(str) + 1]);
-    memcpy(result.get(), str, strlen(str) + 1);
-    DCHECK_EQ(0, result[strlen(str)]);
-    return result;
-  }
-};
-}  // namespace
-
-IPEStatus ConvertCBORToJSON(span<uint8_t> cbor, std::vector<uint8_t>* json) {
-  Platform platform;
-  return ConvertCBORToJSON(platform, cbor, json);
-}
-
-IPEStatus ConvertJSONToCBOR(span<uint8_t> json, std::vector<uint8_t>* cbor) {
-  Platform platform;
-  return ConvertJSONToCBOR(platform, json, cbor);
-}
-
-IPEStatus ConvertJSONToCBOR(span<uint16_t> json, std::vector<uint8_t>* cbor) {
-  Platform platform;
-  return ConvertJSONToCBOR(platform, json, cbor);
-}
-
-}  // namespace v8_inspector
diff --git a/deps/v8/src/inspector/v8-inspector-protocol-encoding.h b/deps/v8/src/inspector/v8-inspector-protocol-encoding.h
deleted file mode 100644
index 6dcc7e84014527..00000000000000
--- a/deps/v8/src/inspector/v8-inspector-protocol-encoding.h
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_INSPECTOR_V8_INSPECTOR_PROTOCOL_ENCODING_H_
-#define V8_INSPECTOR_V8_INSPECTOR_PROTOCOL_ENCODING_H_
-
-#include "../../third_party/inspector_protocol/encoding/encoding.h"
-
-namespace v8_inspector {
-
-::v8_inspector_protocol_encoding::Status ConvertCBORToJSON(
-    ::v8_inspector_protocol_encoding::span<uint8_t> cbor,
-    std::vector<uint8_t>* json);
-
-::v8_inspector_protocol_encoding::Status ConvertJSONToCBOR(
-    ::v8_inspector_protocol_encoding::span<uint8_t> json,
-    std::vector<uint8_t>* cbor);
-
-::v8_inspector_protocol_encoding::Status ConvertJSONToCBOR(
-    ::v8_inspector_protocol_encoding::span<uint16_t> json,
-    std::vector<uint8_t>* cbor);
-
-}  // namespace v8_inspector
-
-#endif  // V8_INSPECTOR_V8_INSPECTOR_PROTOCOL_ENCODING_H_
diff --git a/deps/v8/src/inspector/v8-inspector-session-impl.cc b/deps/v8/src/inspector/v8-inspector-session-impl.cc
index fdfb41924c237f..45881a45966151 100644
--- a/deps/v8/src/inspector/v8-inspector-session-impl.cc
+++ b/deps/v8/src/inspector/v8-inspector-session-impl.cc
@@ -4,6 +4,8 @@
 
 #include "src/inspector/v8-inspector-session-impl.h"
 
+#include "../../third_party/inspector_protocol/crdtp/cbor.h"
+#include "../../third_party/inspector_protocol/crdtp/json.h"
 #include "src/base/logging.h"
 #include "src/base/macros.h"
 #include "src/inspector/injected-script.h"
@@ -17,23 +19,25 @@
 #include "src/inspector/v8-debugger.h"
 #include "src/inspector/v8-heap-profiler-agent-impl.h"
 #include "src/inspector/v8-inspector-impl.h"
-#include "src/inspector/v8-inspector-protocol-encoding.h"
 #include "src/inspector/v8-profiler-agent-impl.h"
 #include "src/inspector/v8-runtime-agent-impl.h"
 #include "src/inspector/v8-schema-agent-impl.h"
 
 namespace v8_inspector {
 namespace {
-using ::v8_inspector_protocol_encoding::span;
-using ::v8_inspector_protocol_encoding::SpanFrom;
-using IPEStatus = ::v8_inspector_protocol_encoding::Status;
+using v8_crdtp::span;
+using v8_crdtp::SpanFrom;
+using v8_crdtp::Status;
+using v8_crdtp::cbor::CheckCBORMessage;
+using v8_crdtp::json::ConvertCBORToJSON;
+using v8_crdtp::json::ConvertJSONToCBOR;
 
 bool IsCBORMessage(const StringView& msg) {
   return msg.is8Bit() && msg.length() >= 2 && msg.characters8()[0] == 0xd8 &&
          msg.characters8()[1] == 0x5a;
 }
 
-IPEStatus ConvertToCBOR(const StringView& state, std::vector<uint8_t>* cbor) {
+Status ConvertToCBOR(const StringView& state, std::vector<uint8_t>* cbor) {
   return state.is8Bit()
              ? ConvertJSONToCBOR(
                    span<uint8_t>(state.characters8(), state.length()), cbor)
@@ -163,16 +167,21 @@ protocol::DictionaryValue* V8InspectorSessionImpl::agentState(
 
 std::unique_ptr<StringBuffer> V8InspectorSessionImpl::serializeForFrontend(
     std::unique_ptr<protocol::Serializable> message) {
-  std::vector<uint8_t> cbor = message->serializeToBinary();
-  if (use_binary_protocol_)
-    return std::unique_ptr<StringBuffer>(
-        new BinaryStringBuffer(std::move(cbor)));
+  std::vector<uint8_t> cbor = std::move(*message).TakeSerialized();
+  DCHECK(CheckCBORMessage(SpanFrom(cbor)).ok());
+  if (use_binary_protocol_) return StringBufferFrom(std::move(cbor));
   std::vector<uint8_t> json;
-  IPEStatus status = ConvertCBORToJSON(SpanFrom(cbor), &json);
+  Status status = ConvertCBORToJSON(SpanFrom(cbor), &json);
   DCHECK(status.ok());
   USE(status);
+  // TODO(johannes): It should be OK to make a StringBuffer from |json|
+  // directly, since it's 7 Bit US-ASCII with anything else escaped.
+  // However it appears that the Node.js tests (or perhaps even production)
+  // assume that the StringBuffer is 16 Bit. It probably accesses
+  // characters16() somehwere without checking is8Bit. Until it's fixed
+  // we take a detour via String16 which makes the StringBuffer 16 bit.
   String16 string16(reinterpret_cast<const char*>(json.data()), json.size());
-  return StringBufferImpl::adopt(string16);
+  return StringBufferFrom(std::move(string16));
 }
 
 void V8InspectorSessionImpl::sendProtocolResponse(
@@ -185,9 +194,8 @@ void V8InspectorSessionImpl::sendProtocolNotification(
   m_channel->sendNotification(serializeForFrontend(std::move(message)));
 }
 
-void V8InspectorSessionImpl::fallThrough(
-    int callId, const String16& method,
-    const protocol::ProtocolMessage& message) {
+void V8InspectorSessionImpl::fallThrough(int callId, const String16& method,
+                                         v8_crdtp::span<uint8_t> message) {
   // There's no other layer to handle the command.
   UNREACHABLE();
 }
@@ -252,13 +260,11 @@ bool V8InspectorSessionImpl::unwrapObject(
   Response response = unwrapObject(toString16(objectId), object, context,
                                    objectGroup ? &objectGroupString : nullptr);
   if (!response.isSuccess()) {
-    if (error) {
-      String16 errorMessage = response.errorMessage();
-      *error = StringBufferImpl::adopt(errorMessage);
-    }
+    if (error) *error = StringBufferFrom(response.errorMessage());
     return false;
   }
-  if (objectGroup) *objectGroup = StringBufferImpl::adopt(objectGroupString);
+  if (objectGroup)
+    *objectGroup = StringBufferFrom(std::move(objectGroupString));
   return true;
 }
 
@@ -332,8 +338,8 @@ void V8InspectorSessionImpl::reportAllContexts(V8RuntimeAgentImpl* agent) {
 
 void V8InspectorSessionImpl::dispatchProtocolMessage(
     const StringView& message) {
-  using ::v8_inspector_protocol_encoding::span;
-  using ::v8_inspector_protocol_encoding::SpanFrom;
+  using v8_crdtp::span;
+  using v8_crdtp::SpanFrom;
   span<uint8_t> cbor;
   std::vector<uint8_t> converted_cbor;
   if (IsCBORMessage(message)) {
@@ -361,14 +367,12 @@ void V8InspectorSessionImpl::dispatchProtocolMessage(
     // Pass empty string instead of the actual message to save on a conversion.
     // We're allowed to do so because fall-through is not implemented.
     m_dispatcher.dispatch(callId, method, std::move(parsed_message),
-                          protocol::ProtocolMessage());
+                          v8_crdtp::span<uint8_t>());
   }
 }
 
 std::vector<uint8_t> V8InspectorSessionImpl::state() {
-  std::vector<uint8_t> out;
-  m_state->writeBinary(&out);
-  return out;
+  return std::move(*m_state).TakeSerialized();
 }
 
 std::vector<std::unique_ptr<protocol::Schema::API::Domain>>
@@ -462,4 +466,9 @@ V8InspectorSessionImpl::searchInTextByLines(const StringView& text,
   return result;
 }
 
+void V8InspectorSessionImpl::triggerPreciseCoverageDeltaUpdate(
+    const StringView& occassion) {
+  m_profilerAgent->triggerPreciseCoverageDeltaUpdate(toString16(occassion));
+}
+
 }  // namespace v8_inspector
diff --git a/deps/v8/src/inspector/v8-inspector-session-impl.h b/deps/v8/src/inspector/v8-inspector-session-impl.h
index 786dc2a048b512..31b822c47d5729 100644
--- a/deps/v8/src/inspector/v8-inspector-session-impl.h
+++ b/deps/v8/src/inspector/v8-inspector-session-impl.h
@@ -92,6 +92,8 @@ class V8InspectorSessionImpl : public V8InspectorSession,
   V8InspectorSession::Inspectable* inspectedObject(unsigned num);
   static const unsigned kInspectedObjectBufferSize = 5;
 
+  void triggerPreciseCoverageDeltaUpdate(const StringView& occassion) override;
+
  private:
   V8InspectorSessionImpl(V8InspectorImpl*, int contextGroupId, int sessionId,
                          V8Inspector::Channel*, const StringView& state);
@@ -103,7 +105,7 @@ class V8InspectorSessionImpl : public V8InspectorSession,
   void sendProtocolNotification(
       std::unique_ptr<protocol::Serializable> message) override;
   void fallThrough(int callId, const String16& method,
-                   const protocol::ProtocolMessage& message) override;
+                   v8_crdtp::span<uint8_t> message) override;
   void flushProtocolNotifications() override;
 
   std::unique_ptr<StringBuffer> serializeForFrontend(
diff --git a/deps/v8/src/inspector/v8-profiler-agent-impl.cc b/deps/v8/src/inspector/v8-profiler-agent-impl.cc
index 286a18a673cf1d..58d83aa9480961 100644
--- a/deps/v8/src/inspector/v8-profiler-agent-impl.cc
+++ b/deps/v8/src/inspector/v8-profiler-agent-impl.cc
@@ -7,6 +7,7 @@
 #include <vector>
 
 #include "src/base/atomicops.h"
+#include "src/base/platform/time.h"
 #include "src/debug/debug-interface.h"
 #include "src/inspector/protocol/Protocol.h"
 #include "src/inspector/string-util.h"
@@ -260,7 +261,9 @@ void V8ProfilerAgentImpl::restore() {
         ProfilerAgentState::preciseCoverageCallCount, false);
     bool detailed = m_state->booleanProperty(
         ProfilerAgentState::preciseCoverageDetailed, false);
-    startPreciseCoverage(Maybe<bool>(callCount), Maybe<bool>(detailed));
+    double timestamp;
+    startPreciseCoverage(Maybe<bool>(callCount), Maybe<bool>(detailed),
+                         &timestamp);
   }
 }
 
@@ -292,8 +295,11 @@ Response V8ProfilerAgentImpl::stop(
 }
 
 Response V8ProfilerAgentImpl::startPreciseCoverage(Maybe<bool> callCount,
-                                                   Maybe<bool> detailed) {
+                                                   Maybe<bool> detailed,
+                                                   double* out_timestamp) {
   if (!m_enabled) return Response::Error("Profiler is not enabled");
+  *out_timestamp =
+      v8::base::TimeTicks::HighResolutionNow().since_origin().InSecondsF();
   bool callCountValue = callCount.fromMaybe(false);
   bool detailedValue = detailed.fromMaybe(false);
   m_state->setBoolean(ProfilerAgentState::preciseCoverageStarted, true);
@@ -395,16 +401,35 @@ Response coverageToProtocol(
 
 Response V8ProfilerAgentImpl::takePreciseCoverage(
     std::unique_ptr<protocol::Array<protocol::Profiler::ScriptCoverage>>*
-        out_result) {
+        out_result,
+    double* out_timestamp) {
   if (!m_state->booleanProperty(ProfilerAgentState::preciseCoverageStarted,
                                 false)) {
     return Response::Error("Precise coverage has not been started.");
   }
   v8::HandleScope handle_scope(m_isolate);
   v8::debug::Coverage coverage = v8::debug::Coverage::CollectPrecise(m_isolate);
+  *out_timestamp =
+      v8::base::TimeTicks::HighResolutionNow().since_origin().InSecondsF();
   return coverageToProtocol(m_session->inspector(), coverage, out_result);
 }
 
+void V8ProfilerAgentImpl::triggerPreciseCoverageDeltaUpdate(
+    const String16& occassion) {
+  if (!m_state->booleanProperty(ProfilerAgentState::preciseCoverageStarted,
+                                false)) {
+    return;
+  }
+  v8::HandleScope handle_scope(m_isolate);
+  v8::debug::Coverage coverage = v8::debug::Coverage::CollectPrecise(m_isolate);
+  std::unique_ptr<protocol::Array<protocol::Profiler::ScriptCoverage>>
+      out_result;
+  coverageToProtocol(m_session->inspector(), coverage, &out_result);
+  double now =
+      v8::base::TimeTicks::HighResolutionNow().since_origin().InSecondsF();
+  m_frontend.preciseCoverageDeltaUpdate(now, occassion, std::move(out_result));
+}
+
 Response V8ProfilerAgentImpl::getBestEffortCoverage(
     std::unique_ptr<protocol::Array<protocol::Profiler::ScriptCoverage>>*
         out_result) {
@@ -488,6 +513,44 @@ Response V8ProfilerAgentImpl::takeTypeProfile(
   return Response::OK();
 }
 
+Response V8ProfilerAgentImpl::enableRuntimeCallStats() {
+  if (m_counters)
+    return Response::Error("RuntimeCallStats collection already enabled.");
+
+  if (V8Inspector* inspector = v8::debug::GetInspector(m_isolate))
+    m_counters = inspector->enableCounters();
+  else
+    return Response::Error("No inspector found.");
+
+  return Response::OK();
+}
+
+Response V8ProfilerAgentImpl::disableRuntimeCallStats() {
+  if (m_counters) m_counters.reset();
+  return Response::OK();
+}
+
+Response V8ProfilerAgentImpl::getRuntimeCallStats(
+    std::unique_ptr<protocol::Array<protocol::Profiler::CounterInfo>>*
+        out_result) {
+  if (!m_counters)
+    return Response::Error("RuntimeCallStats collection is not enabled.");
+
+  *out_result =
+      std::make_unique<protocol::Array<protocol::Profiler::CounterInfo>>();
+
+  for (const auto& counter : m_counters->getCountersMap()) {
+    (*out_result)
+        ->emplace_back(
+            protocol::Profiler::CounterInfo::create()
+                .setName(String16(counter.first.data(), counter.first.length()))
+                .setValue(counter.second)
+                .build());
+  }
+
+  return Response::OK();
+}
+
 String16 V8ProfilerAgentImpl::nextProfileId() {
   return String16::fromInteger(
       v8::base::Relaxed_AtomicIncrement(&s_lastProfileId, 1));
diff --git a/deps/v8/src/inspector/v8-profiler-agent-impl.h b/deps/v8/src/inspector/v8-profiler-agent-impl.h
index 832d2ce139f1e7..74d7069efc1a6b 100644
--- a/deps/v8/src/inspector/v8-profiler-agent-impl.h
+++ b/deps/v8/src/inspector/v8-profiler-agent-impl.h
@@ -39,12 +39,13 @@ class V8ProfilerAgentImpl : public protocol::Profiler::Backend {
   Response start() override;
   Response stop(std::unique_ptr<protocol::Profiler::Profile>*) override;
 
-  Response startPreciseCoverage(Maybe<bool> binary,
-                                Maybe<bool> detailed) override;
+  Response startPreciseCoverage(Maybe<bool> binary, Maybe<bool> detailed,
+                                double* out_timestamp) override;
   Response stopPreciseCoverage() override;
   Response takePreciseCoverage(
       std::unique_ptr<protocol::Array<protocol::Profiler::ScriptCoverage>>*
-          out_result) override;
+          out_result,
+      double* out_timestamp) override;
   Response getBestEffortCoverage(
       std::unique_ptr<protocol::Array<protocol::Profiler::ScriptCoverage>>*
           out_result) override;
@@ -55,9 +56,17 @@ class V8ProfilerAgentImpl : public protocol::Profiler::Backend {
       std::unique_ptr<protocol::Array<protocol::Profiler::ScriptTypeProfile>>*
           out_result) override;
 
+  Response enableRuntimeCallStats() override;
+  Response disableRuntimeCallStats() override;
+  Response getRuntimeCallStats(
+      std::unique_ptr<protocol::Array<protocol::Profiler::CounterInfo>>*
+          out_result) override;
+
   void consoleProfile(const String16& title);
   void consoleProfileEnd(const String16& title);
 
+  void triggerPreciseCoverageDeltaUpdate(const String16& occassion);
+
  private:
   String16 nextProfileId();
 
@@ -76,6 +85,7 @@ class V8ProfilerAgentImpl : public protocol::Profiler::Backend {
   std::vector<ProfileDescriptor> m_startedProfiles;
   String16 m_frontendInitiatedProfileId;
   int m_startedProfilesCount = 0;
+  std::shared_ptr<V8Inspector::Counters> m_counters;
 
   DISALLOW_COPY_AND_ASSIGN(V8ProfilerAgentImpl);
 };
diff --git a/deps/v8/src/inspector/v8-runtime-agent-impl.cc b/deps/v8/src/inspector/v8-runtime-agent-impl.cc
index 4dfc210edc4432..ed6cebea7c766e 100644
--- a/deps/v8/src/inspector/v8-runtime-agent-impl.cc
+++ b/deps/v8/src/inspector/v8-runtime-agent-impl.cc
@@ -196,7 +196,7 @@ void innerCallFunctionOn(
   }
 
   scope.injectedScript()->addPromiseCallback(
-      session, maybeResultValue, objectGroup, wrapMode,
+      session, maybeResultValue, objectGroup, wrapMode, false /* replMode */,
       EvaluateCallbackWrapper<V8RuntimeAgentImpl::CallFunctionOnCallback>::wrap(
           std::move(callback)));
 }
@@ -234,8 +234,8 @@ void V8RuntimeAgentImpl::evaluate(
     Maybe<bool> includeCommandLineAPI, Maybe<bool> silent,
     Maybe<int> executionContextId, Maybe<bool> returnByValue,
     Maybe<bool> generatePreview, Maybe<bool> userGesture,
-    Maybe<bool> awaitPromise, Maybe<bool> throwOnSideEffect,
-    Maybe<double> timeout, Maybe<bool> disableBreaks,
+    Maybe<bool> maybeAwaitPromise, Maybe<bool> throwOnSideEffect,
+    Maybe<double> timeout, Maybe<bool> disableBreaks, Maybe<bool> maybeReplMode,
     std::unique_ptr<EvaluateCallback> callback) {
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"),
                "EvaluateScript");
@@ -259,6 +259,8 @@ void V8RuntimeAgentImpl::evaluate(
 
   if (includeCommandLineAPI.fromMaybe(false)) scope.installCommandLineAPI();
 
+  const bool replMode = maybeReplMode.fromMaybe(false);
+
   // Temporarily enable allow evals for inspector.
   scope.allowCodeGenerationFromStrings();
   v8::MaybeLocal<v8::Value> maybeResultValue;
@@ -280,9 +282,10 @@ void V8RuntimeAgentImpl::evaluate(
     } else if (disableBreaks.fromMaybe(false)) {
       mode = v8::debug::EvaluateGlobalMode::kDisableBreaks;
     }
-    maybeResultValue = v8::debug::EvaluateGlobal(
-        m_inspector->isolate(), toV8String(m_inspector->isolate(), expression),
-        mode);
+    const v8::Local<v8::String> source =
+        toV8String(m_inspector->isolate(), expression);
+    maybeResultValue = v8::debug::EvaluateGlobal(m_inspector->isolate(), source,
+                                                 mode, replMode);
   }  // Run microtasks before returning result.
 
   // Re-initialize after running client's code, as it could have destroyed
@@ -296,14 +299,17 @@ void V8RuntimeAgentImpl::evaluate(
   WrapMode mode = generatePreview.fromMaybe(false) ? WrapMode::kWithPreview
                                                    : WrapMode::kNoPreview;
   if (returnByValue.fromMaybe(false)) mode = WrapMode::kForceValue;
-  if (!awaitPromise.fromMaybe(false) || scope.tryCatch().HasCaught()) {
+
+  // REPL mode always returns a promise that must be awaited.
+  const bool await = replMode || maybeAwaitPromise.fromMaybe(false);
+  if (!await || scope.tryCatch().HasCaught()) {
     wrapEvaluateResultAsync(scope.injectedScript(), maybeResultValue,
                             scope.tryCatch(), objectGroup.fromMaybe(""), mode,
                             callback.get());
     return;
   }
   scope.injectedScript()->addPromiseCallback(
-      m_session, maybeResultValue, objectGroup.fromMaybe(""), mode,
+      m_session, maybeResultValue, objectGroup.fromMaybe(""), mode, replMode,
       EvaluateCallbackWrapper<EvaluateCallback>::wrap(std::move(callback)));
 }
 
@@ -327,6 +333,7 @@ void V8RuntimeAgentImpl::awaitPromise(
   if (returnByValue.fromMaybe(false)) mode = WrapMode::kForceValue;
   scope.injectedScript()->addPromiseCallback(
       m_session, scope.object(), scope.objectGroupName(), mode,
+      false /* replMode */,
       EvaluateCallbackWrapper<AwaitPromiseCallback>::wrap(std::move(callback)));
 }
 
@@ -587,7 +594,7 @@ void V8RuntimeAgentImpl::runScript(
   }
   scope.injectedScript()->addPromiseCallback(
       m_session, maybeResultValue.ToLocalChecked(), objectGroup.fromMaybe(""),
-      mode,
+      mode, false /* replMode */,
       EvaluateCallbackWrapper<RunScriptCallback>::wrap(std::move(callback)));
 }
 
diff --git a/deps/v8/src/inspector/v8-runtime-agent-impl.h b/deps/v8/src/inspector/v8-runtime-agent-impl.h
index 7ecbafd611663e..c99cfcef19583c 100644
--- a/deps/v8/src/inspector/v8-runtime-agent-impl.h
+++ b/deps/v8/src/inspector/v8-runtime-agent-impl.h
@@ -68,6 +68,7 @@ class V8RuntimeAgentImpl : public protocol::Runtime::Backend {
                 Maybe<bool> generatePreview, Maybe<bool> userGesture,
                 Maybe<bool> awaitPromise, Maybe<bool> throwOnSideEffect,
                 Maybe<double> timeout, Maybe<bool> disableBreaks,
+                Maybe<bool> replMode,
                 std::unique_ptr<EvaluateCallback>) override;
   void awaitPromise(const String16& promiseObjectId, Maybe<bool> returnByValue,
                     Maybe<bool> generatePreview,
diff --git a/deps/v8/src/inspector/v8-stack-trace-impl.cc b/deps/v8/src/inspector/v8-stack-trace-impl.cc
index 04feca284c57c1..639ba46592f88f 100644
--- a/deps/v8/src/inspector/v8-stack-trace-impl.cc
+++ b/deps/v8/src/inspector/v8-stack-trace-impl.cc
@@ -6,9 +6,9 @@
 
 #include <algorithm>
 
+#include "../../third_party/inspector_protocol/crdtp/json.h"
 #include "src/inspector/v8-debugger.h"
 #include "src/inspector/v8-inspector-impl.h"
-#include "src/inspector/wasm-translation.h"
 
 namespace v8_inspector {
 
@@ -150,8 +150,10 @@ std::unique_ptr<StringBuffer> V8StackTraceId::ToString() {
   dict->setString(kId, String16::fromInteger64(id));
   dict->setString(kDebuggerId, V8DebuggerId(debugger_id).toString());
   dict->setBoolean(kShouldPause, should_pause);
-  String16 json = dict->toJSONString();
-  return StringBufferImpl::adopt(json);
+  std::vector<uint8_t> json;
+  std::vector<uint8_t> cbor = std::move(*dict).TakeSerialized();
+  v8_crdtp::json::ConvertCBORToJSON(v8_crdtp::SpanFrom(cbor), &json);
+  return StringBufferFrom(std::move(json));
 }
 
 StackFrame::StackFrame(v8::Isolate* isolate, v8::Local<v8::StackFrame> v8Frame)
@@ -167,11 +169,6 @@ StackFrame::StackFrame(v8::Isolate* isolate, v8::Local<v8::StackFrame> v8Frame)
   DCHECK_NE(v8::Message::kNoColumnInfo, m_columnNumber + 1);
 }
 
-void StackFrame::translate(WasmTranslation* wasmTranslation) {
-  wasmTranslation->TranslateWasmScriptLocationToProtocolLocation(
-      &m_scriptId, &m_lineNumber, &m_columnNumber);
-}
-
 const String16& StackFrame::functionName() const { return m_functionName; }
 
 const String16& StackFrame::scriptId() const { return m_scriptId; }
@@ -342,8 +339,7 @@ std::unique_ptr<StringBuffer> V8StackTraceImpl::toString() const {
     stackTrace.append(String16::fromInteger(frame.columnNumber() + 1));
     stackTrace.append(')');
   }
-  String16 string = stackTrace.toString();
-  return StringBufferImpl::adopt(string);
+  return StringBufferFrom(stackTrace.toString());
 }
 
 bool V8StackTraceImpl::isEqualIgnoringTopFrame(
diff --git a/deps/v8/src/inspector/v8-stack-trace-impl.h b/deps/v8/src/inspector/v8-stack-trace-impl.h
index 681b3c2abae171..8e3a35c9b1e908 100644
--- a/deps/v8/src/inspector/v8-stack-trace-impl.h
+++ b/deps/v8/src/inspector/v8-stack-trace-impl.h
@@ -18,7 +18,6 @@ namespace v8_inspector {
 
 class AsyncStackTrace;
 class V8Debugger;
-class WasmTranslation;
 struct V8StackTraceId;
 
 class StackFrame {
@@ -26,8 +25,6 @@ class StackFrame {
   explicit StackFrame(v8::Isolate* isolate, v8::Local<v8::StackFrame> frame);
   ~StackFrame() = default;
 
-  void translate(WasmTranslation* wasmTranslation);
-
   const String16& functionName() const;
   const String16& scriptId() const;
   const String16& sourceURL() const;
diff --git a/deps/v8/src/inspector/value-mirror.cc b/deps/v8/src/inspector/value-mirror.cc
index 903a5c6b020521..f8d1f74e7ddea5 100644
--- a/deps/v8/src/inspector/value-mirror.cc
+++ b/deps/v8/src/inspector/value-mirror.cc
@@ -153,10 +153,10 @@ String16 abbreviateString(const String16& value, AbbreviateMode mode) {
 
 String16 descriptionForSymbol(v8::Local<v8::Context> context,
                               v8::Local<v8::Symbol> symbol) {
-  return String16::concat(
-      "Symbol(",
-      toProtocolStringWithTypeCheck(context->GetIsolate(), symbol->Name()),
-      ")");
+  return String16::concat("Symbol(",
+                          toProtocolStringWithTypeCheck(context->GetIsolate(),
+                                                        symbol->Description()),
+                          ")");
 }
 
 String16 descriptionForBigInt(v8::Local<v8::Context> context,
@@ -841,7 +841,15 @@ void getPrivatePropertiesForPreview(
   std::vector<String16> whitelist;
   for (auto& mirror : mirrors) {
     std::unique_ptr<PropertyPreview> propertyPreview;
-    mirror.value->buildPropertyPreview(context, mirror.name, &propertyPreview);
+    if (mirror.value) {
+      mirror.value->buildPropertyPreview(context, mirror.name,
+                                         &propertyPreview);
+    } else {
+      propertyPreview = PropertyPreview::create()
+                            .setName(mirror.name)
+                            .setType(PropertyPreview::TypeEnum::Accessor)
+                            .build();
+    }
     if (!propertyPreview) continue;
     if (!*nameLimit) {
       *overflow = true;
@@ -1415,40 +1423,40 @@ std::vector<PrivatePropertyMirror> ValueMirror::getPrivateProperties(
   v8::TryCatch tryCatch(isolate);
   v8::Local<v8::Array> privateProperties;
 
-  if (!v8::debug::GetPrivateFields(context, object).ToLocal(&privateProperties))
+  std::vector<v8::Local<v8::Value>> names;
+  std::vector<v8::Local<v8::Value>> values;
+  if (!v8::debug::GetPrivateMembers(context, object, &names, &values))
     return mirrors;
 
-  for (uint32_t i = 0; i < privateProperties->Length(); i += 2) {
-    v8::Local<v8::Value> name;
-    if (!privateProperties->Get(context, i).ToLocal(&name)) {
-      tryCatch.Reset();
-      continue;
-    }
+  size_t len = values.size();
+  for (size_t i = 0; i < len; i++) {
+    v8::Local<v8::Value> name = names[i];
+    DCHECK(name->IsString());
+    v8::Local<v8::Value> value = values[i];
 
-    // Weirdly, v8::Private is set to be a subclass of v8::Data and
-    // not v8::Value, meaning, we first need to upcast to v8::Data
-    // and then downcast to v8::Private. Changing the hierarchy is a
-    // breaking change now. Not sure if that's possible.
-    //
-    // TODO(gsathya): Add an IsPrivate method to the v8::Private and
-    // assert here.
-    v8::Local<v8::Private> private_field = v8::Local<v8::Private>::Cast(name);
-    v8::Local<v8::Value> private_name = private_field->Name();
-    DCHECK(!private_name->IsUndefined());
-
-    v8::Local<v8::Value> value;
-    if (!privateProperties->Get(context, i + 1).ToLocal(&value)) {
-      tryCatch.Reset();
-      continue;
-    }
-    auto wrapper = ValueMirror::create(context, value);
-    if (wrapper) {
-      mirrors.emplace_back(PrivatePropertyMirror{
-          toProtocolStringWithTypeCheck(context->GetIsolate(), private_name),
-          std::move(wrapper)});
+    std::unique_ptr<ValueMirror> valueMirror;
+    std::unique_ptr<ValueMirror> getterMirror;
+    std::unique_ptr<ValueMirror> setterMirror;
+    if (v8::debug::AccessorPair::IsAccessorPair(value)) {
+      v8::Local<v8::debug::AccessorPair> accessors =
+          value.As<v8::debug::AccessorPair>();
+      v8::Local<v8::Value> getter = accessors->getter();
+      v8::Local<v8::Value> setter = accessors->setter();
+      if (!getter->IsNull()) {
+        getterMirror = ValueMirror::create(context, getter);
+      }
+      if (!setter->IsNull()) {
+        setterMirror = ValueMirror::create(context, setter);
+      }
+    } else {
+      valueMirror = ValueMirror::create(context, value);
     }
-  }
 
+    mirrors.emplace_back(PrivatePropertyMirror{
+        toProtocolStringWithTypeCheck(context->GetIsolate(), name),
+        std::move(valueMirror), std::move(getterMirror),
+        std::move(setterMirror)});
+  }
   return mirrors;
 }
 
diff --git a/deps/v8/src/inspector/value-mirror.h b/deps/v8/src/inspector/value-mirror.h
index d708bcb16c533a..da7dba8390bccf 100644
--- a/deps/v8/src/inspector/value-mirror.h
+++ b/deps/v8/src/inspector/value-mirror.h
@@ -23,6 +23,8 @@ enum class WrapMode;
 struct PrivatePropertyMirror {
   String16 name;
   std::unique_ptr<ValueMirror> value;
+  std::unique_ptr<ValueMirror> getter;
+  std::unique_ptr<ValueMirror> setter;
 };
 
 struct InternalPropertyMirror {
diff --git a/deps/v8/src/inspector/wasm-translation.cc b/deps/v8/src/inspector/wasm-translation.cc
deleted file mode 100644
index 5a1526d142b14e..00000000000000
--- a/deps/v8/src/inspector/wasm-translation.cc
+++ /dev/null
@@ -1,392 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/inspector/wasm-translation.h"
-
-#include <algorithm>
-#include <utility>
-
-#include "src/debug/debug-interface.h"
-#include "src/inspector/string-util.h"
-#include "src/inspector/v8-debugger-agent-impl.h"
-#include "src/inspector/v8-debugger-script.h"
-#include "src/inspector/v8-debugger.h"
-#include "src/inspector/v8-inspector-impl.h"
-
-namespace v8_inspector {
-
-using OffsetTable = v8::debug::WasmDisassembly::OffsetTable;
-
-struct WasmSourceInformation {
-  String16 source;
-  int end_line = 0;
-  int end_column = 0;
-
-  OffsetTable offset_table;
-  OffsetTable reverse_offset_table;
-
-  WasmSourceInformation(String16 source, OffsetTable offset_table)
-      : source(std::move(source)), offset_table(std::move(offset_table)) {
-    int num_lines = 0;
-    int last_newline = -1;
-    size_t next_newline = this->source.find('\n', last_newline + 1);
-    while (next_newline != String16::kNotFound) {
-      last_newline = static_cast<int>(next_newline);
-      next_newline = this->source.find('\n', last_newline + 1);
-      ++num_lines;
-    }
-    end_line = num_lines;
-    end_column = static_cast<int>(this->source.length()) - last_newline - 1;
-
-    reverse_offset_table = this->offset_table;
-    // Order by line, column, then byte offset.
-    auto cmp = [](OffsetTable::value_type el1, OffsetTable::value_type el2) {
-      if (el1.line != el2.line) return el1.line < el2.line;
-      if (el1.column != el2.column) return el1.column < el2.column;
-      return el1.byte_offset < el2.byte_offset;
-    };
-    std::sort(reverse_offset_table.begin(), reverse_offset_table.end(), cmp);
-  }
-
-  WasmSourceInformation() = default;
-};
-
-class WasmTranslation::TranslatorImpl {
- public:
-  struct TransLocation {
-    WasmTranslation* translation;
-    String16 script_id;
-    int line;
-    int column;
-    TransLocation(WasmTranslation* translation, String16 script_id, int line,
-                  int column)
-        : translation(translation),
-          script_id(std::move(script_id)),
-          line(line),
-          column(column) {}
-  };
-
-  TranslatorImpl(v8::Isolate* isolate, WasmTranslation* translation,
-                 v8::Local<v8::debug::WasmScript> script)
-      : script_(isolate, script) {
-    script_.AnnotateStrongRetainer(kGlobalScriptHandleLabel);
-
-    ForEachFunction(script, [this, translation](String16& script_id,
-                                                int func_idx) {
-      translation->AddFakeScript(GetFakeScriptId(script_id, func_idx), this);
-    });
-  }
-
-  template <typename Callback>
-  void ForEachFunction(v8::Local<v8::debug::WasmScript> script,
-                       Callback callback) {
-    int num_functions = script->NumFunctions();
-    int num_imported_functions = script->NumImportedFunctions();
-    DCHECK_LE(0, num_imported_functions);
-    DCHECK_LE(0, num_functions);
-    DCHECK_GE(num_functions, num_imported_functions);
-    String16 script_id = String16::fromInteger(script->Id());
-    for (int func_idx = num_imported_functions; func_idx < num_functions;
-         ++func_idx) {
-      callback(script_id, func_idx);
-    }
-  }
-
-  void ReportFakeScripts(v8::Isolate* isolate, WasmTranslation* translation,
-                         V8DebuggerAgentImpl* agent) {
-    ForEachFunction(
-        script_.Get(isolate), [=](String16& script_id, int func_idx) {
-          ReportFakeScript(isolate, script_id, func_idx, translation, agent);
-        });
-  }
-
-  void Translate(TransLocation* loc) {
-    const OffsetTable& offset_table = GetOffsetTable(loc);
-    DCHECK(!offset_table.empty());
-    uint32_t byte_offset = static_cast<uint32_t>(loc->column);
-
-    // Binary search for the given offset.
-    unsigned left = 0;                                            // inclusive
-    unsigned right = static_cast<unsigned>(offset_table.size());  // exclusive
-    while (right - left > 1) {
-      unsigned mid = (left + right) / 2;
-      if (offset_table[mid].byte_offset <= byte_offset) {
-        left = mid;
-      } else {
-        right = mid;
-      }
-    }
-
-    loc->script_id = GetFakeScriptId(loc);
-    if (offset_table[left].byte_offset == byte_offset) {
-      loc->line = offset_table[left].line;
-      loc->column = offset_table[left].column;
-    } else {
-      loc->line = 0;
-      loc->column = 0;
-    }
-  }
-
-  static bool LessThan(const v8::debug::WasmDisassemblyOffsetTableEntry& entry,
-                       const TransLocation& loc) {
-    return entry.line < loc.line ||
-           (entry.line == loc.line && entry.column < loc.column);
-  }
-
-  void TranslateBack(TransLocation* loc) {
-    v8::Isolate* isolate = loc->translation->isolate_;
-    int func_index = GetFunctionIndexFromFakeScriptId(loc->script_id);
-    const OffsetTable& reverse_table = GetReverseTable(isolate, func_index);
-    if (reverse_table.empty()) return;
-
-    // Binary search for the given line and column.
-    auto element = std::lower_bound(reverse_table.begin(), reverse_table.end(),
-                                    *loc, LessThan);
-
-    int found_byte_offset = 0;
-    // We want an entry on the same line if possible.
-    if (element == reverse_table.end()) {
-      // We did not find an element, so this points after the function.
-      std::pair<int, int> func_range =
-          script_.Get(isolate)->GetFunctionRange(func_index);
-      DCHECK_LE(func_range.first, func_range.second);
-      found_byte_offset = func_range.second - func_range.first;
-    } else if (element->line == loc->line || element == reverse_table.begin()) {
-      found_byte_offset = element->byte_offset;
-    } else {
-      auto prev = element - 1;
-      DCHECK(prev->line == loc->line);
-      found_byte_offset = prev->byte_offset;
-    }
-
-    loc->script_id = String16::fromInteger(script_.Get(isolate)->Id());
-    loc->line = func_index;
-    loc->column = found_byte_offset;
-  }
-
-  const WasmSourceInformation& GetSourceInformation(v8::Isolate* isolate,
-                                                    int index) {
-    auto it = source_informations_.find(index);
-    if (it != source_informations_.end()) return it->second;
-    v8::HandleScope scope(isolate);
-    v8::Local<v8::debug::WasmScript> script = script_.Get(isolate);
-    v8::debug::WasmDisassembly disassembly = script->DisassembleFunction(index);
-
-    auto inserted = source_informations_.insert(std::make_pair(
-        index, WasmSourceInformation({disassembly.disassembly.data(),
-                                      disassembly.disassembly.length()},
-                                     std::move(disassembly.offset_table))));
-    DCHECK(inserted.second);
-    return inserted.first->second;
-  }
-
-  const String16 GetHash(v8::Isolate* isolate, int index) {
-    v8::HandleScope scope(isolate);
-    v8::Local<v8::debug::WasmScript> script = script_.Get(isolate);
-    uint32_t hash = script->GetFunctionHash(index);
-    String16Builder builder;
-    builder.appendUnsignedAsHex(hash);
-    return builder.toString();
-  }
-
-  int GetContextId(v8::Isolate* isolate) {
-    v8::HandleScope scope(isolate);
-    v8::Local<v8::debug::WasmScript> script = script_.Get(isolate);
-    return script->ContextId().FromMaybe(0);
-  }
-
- private:
-  String16 GetFakeScriptUrl(v8::Isolate* isolate, int func_index) {
-    v8::Local<v8::debug::WasmScript> script = script_.Get(isolate);
-    String16 script_name =
-        toProtocolString(isolate, script->Name().ToLocalChecked());
-    int numFunctions = script->NumFunctions();
-    int numImported = script->NumImportedFunctions();
-    String16Builder builder;
-    builder.appendAll("wasm://wasm/", script_name, '/');
-    if (numFunctions - numImported > 300) {
-      size_t digits = String16::fromInteger(numFunctions - 1).length();
-      String16 thisCategory = String16::fromInteger((func_index / 100) * 100);
-      DCHECK_LE(thisCategory.length(), digits);
-      for (size_t i = thisCategory.length(); i < digits; ++i)
-        builder.append('0');
-      builder.appendAll(thisCategory, '/');
-    }
-    builder.appendAll(script_name, '-');
-    builder.appendNumber(func_index);
-    return builder.toString();
-  }
-
-  String16 GetFakeScriptId(const String16& script_id, int func_index) {
-    return String16::concat(script_id, '-', String16::fromInteger(func_index));
-  }
-  String16 GetFakeScriptId(const TransLocation* loc) {
-    return GetFakeScriptId(loc->script_id, loc->line);
-  }
-
-  void ReportFakeScript(v8::Isolate* isolate,
-                        const String16& underlyingScriptId, int func_idx,
-                        WasmTranslation* translation,
-                        V8DebuggerAgentImpl* agent) {
-    String16 fake_script_id = GetFakeScriptId(underlyingScriptId, func_idx);
-    String16 fake_script_url = GetFakeScriptUrl(isolate, func_idx);
-
-    std::unique_ptr<V8DebuggerScript> fake_script =
-        V8DebuggerScript::CreateWasm(isolate, translation, script_.Get(isolate),
-                                     fake_script_id, std::move(fake_script_url),
-                                     func_idx);
-
-    agent->didParseSource(std::move(fake_script), true);
-  }
-
-  int GetFunctionIndexFromFakeScriptId(const String16& fake_script_id) {
-    size_t last_dash_pos = fake_script_id.reverseFind('-');
-    DCHECK_GT(fake_script_id.length(), last_dash_pos);
-    bool ok = true;
-    int func_index = fake_script_id.substring(last_dash_pos + 1).toInteger(&ok);
-    DCHECK(ok);
-    return func_index;
-  }
-
-  const OffsetTable& GetOffsetTable(const TransLocation* loc) {
-    int func_index = loc->line;
-    return GetSourceInformation(loc->translation->isolate_, func_index)
-        .offset_table;
-  }
-
-  const OffsetTable& GetReverseTable(v8::Isolate* isolate, int func_index) {
-    return GetSourceInformation(isolate, func_index).reverse_offset_table;
-  }
-
-  static constexpr char kGlobalScriptHandleLabel[] =
-      "WasmTranslation::TranslatorImpl::script_";
-
-  v8::Global<v8::debug::WasmScript> script_;
-
-  // We assume to only disassemble a subset of the functions, so store them in a
-  // map instead of an array.
-  std::unordered_map<int, WasmSourceInformation> source_informations_;
-
-  // Disallow copies, because our pointer is registered in translation.
-  DISALLOW_COPY_AND_ASSIGN(TranslatorImpl);
-};
-
-constexpr char WasmTranslation::TranslatorImpl::kGlobalScriptHandleLabel[];
-
-WasmTranslation::WasmTranslation(v8::Isolate* isolate) : isolate_(isolate) {}
-
-WasmTranslation::~WasmTranslation() { Clear(); }
-
-void WasmTranslation::AddScript(v8::Local<v8::debug::WasmScript> script,
-                                V8DebuggerAgentImpl* agent) {
-  auto& impl = wasm_translators_[script->Id()];
-  if (impl == nullptr) {
-    impl = std::make_unique<TranslatorImpl>(isolate_, this, script);
-  }
-  impl->ReportFakeScripts(isolate_, this, agent);
-}
-
-void WasmTranslation::Clear() {
-  wasm_translators_.clear();
-  fake_scripts_.clear();
-}
-
-void WasmTranslation::Clear(v8::Isolate* isolate,
-                            const std::vector<int>& contextIdsToClear) {
-  for (auto iter = fake_scripts_.begin(); iter != fake_scripts_.end();) {
-    auto contextId = iter->second->GetContextId(isolate);
-    auto it = std::find(std::begin(contextIdsToClear),
-                        std::end(contextIdsToClear), contextId);
-    if (it != std::end(contextIdsToClear)) {
-      iter = fake_scripts_.erase(iter);
-    } else {
-      ++iter;
-    }
-  }
-
-  for (auto iter = wasm_translators_.begin();
-       iter != wasm_translators_.end();) {
-    auto contextId = iter->second->GetContextId(isolate);
-    auto it = std::find(std::begin(contextIdsToClear),
-                        std::end(contextIdsToClear), contextId);
-    if (it != std::end(contextIdsToClear)) {
-      iter = wasm_translators_.erase(iter);
-    } else {
-      ++iter;
-    }
-  }
-}
-
-const String16& WasmTranslation::GetSource(const String16& script_id,
-                                           int func_index) {
-  auto it = fake_scripts_.find(script_id);
-  DCHECK_NE(it, fake_scripts_.end());
-  return it->second->GetSourceInformation(isolate_, func_index).source;
-}
-
-int WasmTranslation::GetEndLine(const String16& script_id, int func_index) {
-  auto it = fake_scripts_.find(script_id);
-  DCHECK_NE(it, fake_scripts_.end());
-  return it->second->GetSourceInformation(isolate_, func_index).end_line;
-}
-
-int WasmTranslation::GetEndColumn(const String16& script_id, int func_index) {
-  auto it = fake_scripts_.find(script_id);
-  DCHECK_NE(it, fake_scripts_.end());
-  return it->second->GetSourceInformation(isolate_, func_index).end_column;
-}
-
-String16 WasmTranslation::GetHash(const String16& script_id, int func_index) {
-  auto it = fake_scripts_.find(script_id);
-  DCHECK_NE(it, fake_scripts_.end());
-  return it->second->GetHash(isolate_, func_index);
-}
-
-// Translation "forward" (to artificial scripts).
-bool WasmTranslation::TranslateWasmScriptLocationToProtocolLocation(
-    String16* script_id, int* line_number, int* column_number) {
-  DCHECK(script_id && line_number && column_number);
-  bool ok = true;
-  int script_id_int = script_id->toInteger(&ok);
-  if (!ok) return false;
-
-  auto it = wasm_translators_.find(script_id_int);
-  if (it == wasm_translators_.end()) return false;
-  TranslatorImpl* translator = it->second.get();
-
-  TranslatorImpl::TransLocation trans_loc(this, std::move(*script_id),
-                                          *line_number, *column_number);
-  translator->Translate(&trans_loc);
-
-  *script_id = std::move(trans_loc.script_id);
-  *line_number = trans_loc.line;
-  *column_number = trans_loc.column;
-
-  return true;
-}
-
-// Translation "backward" (from artificial to real scripts).
-bool WasmTranslation::TranslateProtocolLocationToWasmScriptLocation(
-    String16* script_id, int* line_number, int* column_number) {
-  auto it = fake_scripts_.find(*script_id);
-  if (it == fake_scripts_.end()) return false;
-  TranslatorImpl* translator = it->second;
-
-  TranslatorImpl::TransLocation trans_loc(this, std::move(*script_id),
-                                          *line_number, *column_number);
-  translator->TranslateBack(&trans_loc);
-
-  *script_id = std::move(trans_loc.script_id);
-  *line_number = trans_loc.line;
-  *column_number = trans_loc.column;
-
-  return true;
-}
-
-void WasmTranslation::AddFakeScript(const String16& scriptId,
-                                    TranslatorImpl* translator) {
-  DCHECK_EQ(0, fake_scripts_.count(scriptId));
-  fake_scripts_.insert(std::make_pair(scriptId, translator));
-}
-}  // namespace v8_inspector
diff --git a/deps/v8/src/inspector/wasm-translation.h b/deps/v8/src/inspector/wasm-translation.h
deleted file mode 100644
index a19aa852051c4d..00000000000000
--- a/deps/v8/src/inspector/wasm-translation.h
+++ /dev/null
@@ -1,80 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_INSPECTOR_WASM_TRANSLATION_H_
-#define V8_INSPECTOR_WASM_TRANSLATION_H_
-
-#include <memory>
-#include <unordered_map>
-
-#include "include/v8.h"
-#include "src/base/macros.h"
-#include "src/debug/debug-interface.h"
-#include "src/inspector/string-16.h"
-
-namespace v8_inspector {
-
-// Forward declarations.
-class V8DebuggerAgentImpl;
-
-class WasmTranslation {
- public:
-  explicit WasmTranslation(v8::Isolate* isolate);
-  ~WasmTranslation();
-
-  // Make a wasm script known to the translation. This will trigger a number of
-  // didParseScript calls to the given debugger agent.
-  // Only locations referencing a registered script will be translated by the
-  // Translate functions below.
-  void AddScript(v8::Local<v8::debug::WasmScript> script,
-                 V8DebuggerAgentImpl* agent);
-
-  // Clear all registered scripts.
-  void Clear();
-
-  // Clear all registered scripts for context group.
-  void Clear(v8::Isolate* isolate, const std::vector<int>& contextIdsToClear);
-
-  // Translate a location as generated by V8 to a location that should be sent
-  // over protocol.
-  // Does nothing for locations referencing a script which was not registered
-  // before via AddScript.
-  // Line and column are 0-based.
-  // Returns true if the location was translated, false otherwise.
-  bool TranslateWasmScriptLocationToProtocolLocation(String16* script_id,
-                                                     int* line_number,
-                                                     int* column_number);
-
-  // Translate back from protocol locations (potentially referencing artificial
-  // scripts for individual wasm functions) to locations that make sense to V8.
-  // Does nothing if the location was not generated by the translate method
-  // above.
-  // Returns true if the location was translated, false otherwise.
-  bool TranslateProtocolLocationToWasmScriptLocation(String16* script_id,
-                                                     int* line_number,
-                                                     int* column_number);
-
-  const String16& GetSource(const String16& script_id, int func_index);
-  int GetStartLine(const String16& script_id, int func_index) { return 0; }
-  int GetStartColumn(const String16& script_id, int func_index) { return 0; }
-  int GetEndLine(const String16& script_id, int func_index);
-  int GetEndColumn(const String16& script_id, int func_index);
-  String16 GetHash(const String16& script_id, int func_index);
-
- private:
-  class TranslatorImpl;
-  friend class TranslatorImpl;
-
-  void AddFakeScript(const String16& scriptId, TranslatorImpl* translator);
-
-  v8::Isolate* isolate_;
-  std::unordered_map<int, std::unique_ptr<TranslatorImpl>> wasm_translators_;
-  std::unordered_map<String16, TranslatorImpl*> fake_scripts_;
-
-  DISALLOW_COPY_AND_ASSIGN(WasmTranslation);
-};
-
-}  // namespace v8_inspector
-
-#endif  // V8_INSPECTOR_WASM_TRANSLATION_H_
diff --git a/deps/v8/src/interpreter/OWNERS b/deps/v8/src/interpreter/OWNERS
index 254e6e60d1a129..cd7c1db6d01f75 100644
--- a/deps/v8/src/interpreter/OWNERS
+++ b/deps/v8/src/interpreter/OWNERS
@@ -1,6 +1,5 @@
 bmeurer@chromium.org
 leszeks@chromium.org
-mstarzinger@chromium.org
 mythria@chromium.org
 rmcilroy@chromium.org
 
diff --git a/deps/v8/src/interpreter/bytecode-flags.h b/deps/v8/src/interpreter/bytecode-flags.h
index 40ee88d6ebceb7..e2b590645ae8ad 100644
--- a/deps/v8/src/interpreter/bytecode-flags.h
+++ b/deps/v8/src/interpreter/bytecode-flags.h
@@ -5,7 +5,8 @@
 #ifndef V8_INTERPRETER_BYTECODE_FLAGS_H_
 #define V8_INTERPRETER_BYTECODE_FLAGS_H_
 
-#include "src/utils/utils.h"
+#include "src/base/bit-field.h"
+#include "src/common/globals.h"
 
 namespace v8 {
 namespace internal {
@@ -18,7 +19,7 @@ namespace interpreter {
 
 class CreateArrayLiteralFlags {
  public:
-  using FlagsBits = BitField8<int, 0, 5>;
+  using FlagsBits = base::BitField8<int, 0, 5>;
   using FastCloneSupportedBit = FlagsBits::Next<bool, 1>;
 
   static uint8_t Encode(bool use_fast_shallow_clone, int runtime_flags);
@@ -29,7 +30,7 @@ class CreateArrayLiteralFlags {
 
 class CreateObjectLiteralFlags {
  public:
-  using FlagsBits = BitField8<int, 0, 5>;
+  using FlagsBits = base::BitField8<int, 0, 5>;
   using FastCloneSupportedBit = FlagsBits::Next<bool, 1>;
 
   static uint8_t Encode(int runtime_flags, bool fast_clone_supported);
@@ -40,7 +41,7 @@ class CreateObjectLiteralFlags {
 
 class CreateClosureFlags {
  public:
-  using PretenuredBit = BitField8<bool, 0, 1>;
+  using PretenuredBit = base::BitField8<bool, 0, 1>;
   using FastNewClosureBit = PretenuredBit::Next<bool, 1>;
 
   static uint8_t Encode(bool pretenure, bool is_function_scope,
@@ -80,7 +81,7 @@ class TestTypeOfFlags {
 
 class StoreLookupSlotFlags {
  public:
-  using LanguageModeBit = BitField8<LanguageMode, 0, 1>;
+  using LanguageModeBit = base::BitField8<LanguageMode, 0, 1>;
   using LookupHoistingModeBit = LanguageModeBit::Next<bool, 1>;
   STATIC_ASSERT(LanguageModeSize <= LanguageModeBit::kNumValues);
 
diff --git a/deps/v8/src/interpreter/bytecode-generator.cc b/deps/v8/src/interpreter/bytecode-generator.cc
index 92ae15127e4e87..196f9d881983bc 100644
--- a/deps/v8/src/interpreter/bytecode-generator.cc
+++ b/deps/v8/src/interpreter/bytecode-generator.cc
@@ -727,54 +727,44 @@ class BytecodeGenerator::TestResultScope final : public ExpressionResultScope {
 // Used to build a list of global declaration initial value pairs.
 class BytecodeGenerator::GlobalDeclarationsBuilder final : public ZoneObject {
  public:
-  explicit GlobalDeclarationsBuilder(Zone* zone)
-      : declarations_(0, zone),
-        constant_pool_entry_(0),
-        has_constant_pool_entry_(false) {}
-
-  void AddFunctionDeclaration(const AstRawString* name, FeedbackSlot slot,
-                              int feedback_cell_index, FunctionLiteral* func) {
-    DCHECK(!slot.IsInvalid());
-    declarations_.push_back(Declaration(name, slot, feedback_cell_index, func));
-  }
-
-  void AddUndefinedDeclaration(const AstRawString* name, FeedbackSlot slot) {
-    DCHECK(!slot.IsInvalid());
-    declarations_.push_back(Declaration(name, slot));
-  }
-
   Handle<FixedArray> AllocateDeclarations(UnoptimizedCompilationInfo* info,
+                                          BytecodeGenerator* generator,
                                           Handle<Script> script,
                                           Isolate* isolate) {
+    int size = 0;
+    for (Declaration* decl : *info->scope()->declarations()) {
+      Variable* var = decl->var();
+      if (!var->is_used()) continue;
+      if (var->location() != VariableLocation::UNALLOCATED) continue;
+      DCHECK_IMPLIES(decl->node_type() != AstNode::kVariableDeclaration,
+                     decl->node_type() == AstNode::kFunctionDeclaration);
+      size += decl->node_type() == AstNode::kVariableDeclaration ? 1 : 2;
+    }
+
     DCHECK(has_constant_pool_entry_);
-    int array_index = 0;
-    Handle<FixedArray> data = isolate->factory()->NewFixedArray(
-        static_cast<int>(declarations_.size() * 4), AllocationType::kOld);
-    for (const Declaration& declaration : declarations_) {
-      FunctionLiteral* func = declaration.func;
-      Handle<Object> initial_value;
-      if (func == nullptr) {
-        initial_value = isolate->factory()->undefined_value();
-      } else {
-        initial_value = Compiler::GetSharedFunctionInfo(func, script, isolate);
-      }
 
-      // Return a null handle if any initial values can't be created. Caller
-      // will set stack overflow.
-      if (initial_value.is_null()) return Handle<FixedArray>();
+    Handle<FixedArray> data =
+        isolate->factory()->NewFixedArray(size, AllocationType::kOld);
 
-      data->set(array_index++, *declaration.name->string());
-      data->set(array_index++, Smi::FromInt(declaration.slot.ToInt()));
-      Object undefined_or_literal_slot;
-      if (declaration.feedback_cell_index_for_function == -1) {
-        undefined_or_literal_slot = ReadOnlyRoots(isolate).undefined_value();
+    int array_index = 0;
+    for (Declaration* decl : *info->scope()->declarations()) {
+      Variable* var = decl->var();
+      if (!var->is_used()) continue;
+      if (var->location() != VariableLocation::UNALLOCATED) continue;
+      if (decl->node_type() == AstNode::kVariableDeclaration) {
+        data->set(array_index++, *var->raw_name()->string().get<Factory>());
       } else {
-        undefined_or_literal_slot =
-            Smi::FromInt(declaration.feedback_cell_index_for_function);
+        FunctionLiteral* f = static_cast<FunctionDeclaration*>(decl)->fun();
+        Handle<Object> sfi(Compiler::GetSharedFunctionInfo(f, script, isolate));
+        // Return a null handle if any initial values can't be created. Caller
+        // will set stack overflow.
+        if (sfi.is_null()) return Handle<FixedArray>();
+        data->set(array_index++, *sfi);
+        int literal_index = generator->GetCachedCreateClosureSlot(f);
+        data->set(array_index++, Smi::FromInt(literal_index));
       }
-      data->set(array_index++, undefined_or_literal_slot);
-      data->set(array_index++, *initial_value);
     }
+
     return data;
   }
 
@@ -784,40 +774,22 @@ class BytecodeGenerator::GlobalDeclarationsBuilder final : public ZoneObject {
   }
 
   void set_constant_pool_entry(size_t constant_pool_entry) {
-    DCHECK(!empty());
+    DCHECK(has_global_declaration());
     DCHECK(!has_constant_pool_entry_);
     constant_pool_entry_ = constant_pool_entry;
     has_constant_pool_entry_ = true;
   }
 
-  bool empty() { return declarations_.empty(); }
+  void record_global_declaration() { has_seen_global_declaration_ = true; }
+  bool has_global_declaration() { return has_seen_global_declaration_; }
+  bool processed() { return processed_; }
+  void mark_processed() { processed_ = true; }
 
  private:
-  struct Declaration {
-    Declaration() : slot(FeedbackSlot::Invalid()), func(nullptr) {}
-    Declaration(const AstRawString* name, FeedbackSlot slot,
-                int feedback_cell_index, FunctionLiteral* func)
-        : name(name),
-          slot(slot),
-          feedback_cell_index_for_function(feedback_cell_index),
-          func(func) {}
-    Declaration(const AstRawString* name, FeedbackSlot slot)
-        : name(name),
-          slot(slot),
-          feedback_cell_index_for_function(-1),
-          func(nullptr) {}
-
-    const AstRawString* name;
-    FeedbackSlot slot;
-    // Only valid for function declarations. Specifies the index into the
-    // closure_feedback_cell array used when creating closures of this
-    // function.
-    int feedback_cell_index_for_function;
-    FunctionLiteral* func;
-  };
-  ZoneVector<Declaration> declarations_;
-  size_t constant_pool_entry_;
-  bool has_constant_pool_entry_;
+  size_t constant_pool_entry_ = 0;
+  bool has_constant_pool_entry_ = false;
+  bool has_seen_global_declaration_ = false;
+  bool processed_ = false;
 };
 
 class BytecodeGenerator::CurrentScope final {
@@ -1011,9 +983,8 @@ BytecodeGenerator::BytecodeGenerator(
       current_scope_(info->scope()),
       eager_inner_literals_(eager_inner_literals),
       feedback_slot_cache_(new (zone()) FeedbackSlotCache(zone())),
-      globals_builder_(new (zone()) GlobalDeclarationsBuilder(zone())),
+      globals_builder_(new (zone()) GlobalDeclarationsBuilder()),
       block_coverage_builder_(nullptr),
-      global_declarations_(0, zone()),
       function_literals_(0, zone()),
       native_function_literals_(0, zone()),
       object_literals_(0, zone()),
@@ -1095,13 +1066,13 @@ int BytecodeGenerator::CheckBytecodeMatches(Handle<BytecodeArray> bytecode) {
 
 void BytecodeGenerator::AllocateDeferredConstants(Isolate* isolate,
                                                   Handle<Script> script) {
-  // Build global declaration pair arrays.
-  for (GlobalDeclarationsBuilder* globals_builder : global_declarations_) {
+  if (globals_builder()->has_global_declaration()) {
+    // Build global declaration pair array.
     Handle<FixedArray> declarations =
-        globals_builder->AllocateDeclarations(info(), script, isolate);
+        globals_builder()->AllocateDeclarations(info(), this, script, isolate);
     if (declarations.is_null()) return SetStackOverflow();
     builder()->SetDeferredConstantPoolEntry(
-        globals_builder->constant_pool_entry(), declarations);
+        globals_builder()->constant_pool_entry(), declarations);
   }
 
   // Find or build shared function infos.
@@ -1188,11 +1159,14 @@ void BytecodeGenerator::GenerateBytecode(uintptr_t stack_limit) {
 
   AllocateTopLevelRegisters();
 
+  // Perform a stack-check before the body.
+  builder()->StackCheck(info()->literal()->start_position());
+
   if (info()->literal()->CanSuspend()) {
     BuildGeneratorPrologue();
   }
 
-  if (closure_scope()->NeedsContext()) {
+  if (closure_scope()->NeedsContext() && !closure_scope()->is_script_scope()) {
     // Push a new inner context scope for the function.
     BuildNewLocalActivationContext();
     ContextScope local_function_context(this, closure_scope());
@@ -1247,14 +1221,15 @@ void BytecodeGenerator::GenerateBytecodeBody() {
   BuildIncrementBlockCoverageCounterIfEnabled(literal, SourceRangeKind::kBody);
 
   // Visit declarations within the function scope.
-  VisitDeclarations(closure_scope()->declarations());
+  if (closure_scope()->is_script_scope()) {
+    VisitGlobalDeclarations(closure_scope()->declarations());
+  } else {
+    VisitDeclarations(closure_scope()->declarations());
+  }
 
   // Emit initializing assignments for module namespace imports (if any).
   VisitModuleNamespaceImports();
 
-  // Perform a stack-check before the body.
-  builder()->StackCheck(literal->start_position());
-
   // The derived constructor case is handled in VisitCallSuper.
   if (IsBaseConstructor(function_kind())) {
     if (literal->requires_brand_initialization()) {
@@ -1344,13 +1319,8 @@ void BytecodeGenerator::VisitVariableDeclaration(VariableDeclaration* decl) {
   if (!variable->is_used()) return;
 
   switch (variable->location()) {
-    case VariableLocation::UNALLOCATED: {
-      DCHECK(!variable->binding_needs_init());
-      FeedbackSlot slot =
-          GetCachedLoadGlobalICSlot(NOT_INSIDE_TYPEOF, variable);
-      globals_builder()->AddUndefinedDeclaration(variable->raw_name(), slot);
-      break;
-    }
+    case VariableLocation::UNALLOCATED:
+      UNREACHABLE();
     case VariableLocation::LOCAL:
       if (variable->binding_needs_init()) {
         Register destination(builder()->Local(variable->index()));
@@ -1363,6 +1333,9 @@ void BytecodeGenerator::VisitVariableDeclaration(VariableDeclaration* decl) {
         builder()->LoadTheHole().StoreAccumulatorInRegister(destination);
       }
       break;
+    case VariableLocation::REPL_GLOBAL:
+      // REPL let's are stored in script contexts. They get initialized
+      // with the hole the same way as normal context allocated variables.
     case VariableLocation::CONTEXT:
       if (variable->binding_needs_init()) {
         DCHECK_EQ(0, execution_context()->ContextChainDepth(variable->scope()));
@@ -1401,21 +1374,15 @@ void BytecodeGenerator::VisitFunctionDeclaration(FunctionDeclaration* decl) {
   if (!variable->is_used()) return;
 
   switch (variable->location()) {
-    case VariableLocation::UNALLOCATED: {
-      FeedbackSlot slot =
-          GetCachedLoadGlobalICSlot(NOT_INSIDE_TYPEOF, variable);
-      int literal_index = GetCachedCreateClosureSlot(decl->fun());
-      globals_builder()->AddFunctionDeclaration(variable->raw_name(), slot,
-                                                literal_index, decl->fun());
-      AddToEagerLiteralsIfEager(decl->fun());
-      break;
-    }
+    case VariableLocation::UNALLOCATED:
+      UNREACHABLE();
     case VariableLocation::PARAMETER:
     case VariableLocation::LOCAL: {
       VisitFunctionLiteral(decl->fun());
       BuildVariableAssignment(variable, Token::INIT, HoleCheckMode::kElided);
       break;
     }
+    case VariableLocation::REPL_GLOBAL:
     case VariableLocation::CONTEXT: {
       DCHECK_EQ(0, execution_context()->ContextChainDepth(variable->scope()));
       VisitFunctionLiteral(decl->fun());
@@ -1463,32 +1430,49 @@ void BytecodeGenerator::VisitModuleNamespaceImports() {
   }
 }
 
-void BytecodeGenerator::VisitDeclarations(Declaration::List* declarations) {
+void BytecodeGenerator::VisitGlobalDeclarations(Declaration::List* decls) {
   RegisterAllocationScope register_scope(this);
-  DCHECK(globals_builder()->empty());
-  for (Declaration* decl : *declarations) {
-    RegisterAllocationScope register_scope(this);
-    Visit(decl);
+  bool has_global_declaration = false;
+  for (Declaration* decl : *decls) {
+    Variable* var = decl->var();
+    DCHECK(var->is_used());
+    if (var->location() == VariableLocation::UNALLOCATED) {
+      // var or function.
+      has_global_declaration = true;
+      if (decl->IsFunctionDeclaration()) {
+        FunctionDeclaration* f = static_cast<FunctionDeclaration*>(decl);
+        AddToEagerLiteralsIfEager(f->fun());
+      }
+    } else {
+      // let or const. Handled in NewScriptContext.
+      DCHECK(decl->IsVariableDeclaration());
+      DCHECK(IsLexicalVariableMode(var->mode()));
+    }
   }
-  if (globals_builder()->empty()) return;
+
+  if (!has_global_declaration) return;
+  globals_builder()->record_global_declaration();
+  DCHECK(!globals_builder()->processed());
 
   globals_builder()->set_constant_pool_entry(
       builder()->AllocateDeferredConstantPoolEntry());
-  int encoded_flags = DeclareGlobalsEvalFlag::encode(info()->is_eval());
 
   // Emit code to declare globals.
-  RegisterList args = register_allocator()->NewRegisterList(3);
+  RegisterList args = register_allocator()->NewRegisterList(2);
   builder()
       ->LoadConstantPoolEntry(globals_builder()->constant_pool_entry())
       .StoreAccumulatorInRegister(args[0])
-      .LoadLiteral(Smi::FromInt(encoded_flags))
-      .StoreAccumulatorInRegister(args[1])
-      .MoveRegister(Register::function_closure(), args[2])
+      .MoveRegister(Register::function_closure(), args[1])
       .CallRuntime(Runtime::kDeclareGlobals, args);
 
-  // Push and reset globals builder.
-  global_declarations_.push_back(globals_builder());
-  globals_builder_ = new (zone()) GlobalDeclarationsBuilder(zone());
+  globals_builder()->mark_processed();
+}
+
+void BytecodeGenerator::VisitDeclarations(Declaration::List* declarations) {
+  for (Declaration* decl : *declarations) {
+    RegisterAllocationScope register_scope(this);
+    Visit(decl);
+  }
 }
 
 void BytecodeGenerator::VisitStatements(
@@ -1640,7 +1624,7 @@ void BytecodeGenerator::BuildTryCatch(
 
   // Preserve the context in a dedicated register, so that it can be restored
   // when the handler is entered by the stack-unwinding machinery.
-  // TODO(mstarzinger): Be smarter about register allocation.
+  // TODO(ignition): Be smarter about register allocation.
   Register context = register_allocator()->NewRegister();
   builder()->MoveRegister(Register::current_context(), context);
 
@@ -1691,7 +1675,7 @@ void BytecodeGenerator::BuildTryFinally(
 
   // Preserve the context in a dedicated register, so that it can be restored
   // when the handler is entered by the stack-unwinding machinery.
-  // TODO(mstarzinger): Be smarter about register allocation.
+  // TODO(ignition): Be smarter about register allocation.
   Register context = register_allocator()->NewRegister();
   builder()->MoveRegister(Register::current_context(), context);
 
@@ -2055,7 +2039,7 @@ void BytecodeGenerator::BuildClassLiteral(ClassLiteral* expr, Register name) {
     builder()
         ->LoadLiteral(class_name)
         .StoreAccumulatorInRegister(brand)
-        .CallRuntime(Runtime::kCreatePrivateNameSymbol, brand);
+        .CallRuntime(Runtime::kCreatePrivateBrandSymbol, brand);
     BuildVariableAssignment(expr->scope()->brand(), Token::INIT,
                             HoleCheckMode::kElided);
   }
@@ -2364,13 +2348,16 @@ void BytecodeGenerator::BuildInvalidPropertyAccess(MessageTemplate tmpl,
 }
 
 void BytecodeGenerator::BuildPrivateBrandInitialization(Register receiver) {
-  RegisterList brand_args = register_allocator()->NewRegisterList(2);
+  RegisterList brand_args = register_allocator()->NewRegisterList(3);
   Variable* brand = info()->scope()->outer_scope()->AsClassScope()->brand();
-  DCHECK_NOT_NULL(brand);
+  int depth = execution_context()->ContextChainDepth(brand->scope());
+  ContextScope* class_context = execution_context()->Previous(depth);
+
   BuildVariableLoad(brand, HoleCheckMode::kElided);
   builder()
       ->StoreAccumulatorInRegister(brand_args[1])
       .MoveRegister(receiver, brand_args[0])
+      .MoveRegister(class_context->reg(), brand_args[2])
       .CallRuntime(Runtime::kAddPrivateBrand, brand_args);
 }
 
@@ -3066,6 +3053,13 @@ void BytecodeGenerator::BuildVariableLoad(Variable* variable,
       }
       break;
     }
+    case VariableLocation::REPL_GLOBAL: {
+      DCHECK(variable->IsReplGlobalLet());
+      FeedbackSlot slot = GetCachedLoadGlobalICSlot(typeof_mode, variable);
+      builder()->LoadGlobal(variable->raw_name(), feedback_index(slot),
+                            typeof_mode);
+      break;
+    }
   }
 }
 
@@ -3248,6 +3242,33 @@ void BytecodeGenerator::BuildVariableAssignment(
       builder()->StoreModuleVariable(variable->index(), depth);
       break;
     }
+    case VariableLocation::REPL_GLOBAL: {
+      // A let declaration like 'let x = 7' is effectively translated to:
+      //   <top of the script>:
+      //     ScriptContext.x = TheHole;
+      //   ...
+      //   <where the actual 'let' is>:
+      //     ScriptContextTable.x = 7; // no hole check
+      //
+      // The ScriptContext slot for 'x' that we store to here is not
+      // necessarily the ScriptContext of this script, but rather the
+      // first ScriptContext that has a slot for name 'x'.
+      DCHECK(variable->IsReplGlobalLet());
+      if (op == Token::INIT) {
+        RegisterList store_args = register_allocator()->NewRegisterList(2);
+        builder()
+            ->StoreAccumulatorInRegister(store_args[1])
+            .LoadLiteral(variable->raw_name())
+            .StoreAccumulatorInRegister(store_args[0]);
+        builder()->CallRuntime(Runtime::kStoreGlobalNoHoleCheckForReplLet,
+                               store_args);
+      } else {
+        FeedbackSlot slot =
+            GetCachedStoreGlobalICSlot(language_mode(), variable);
+        builder()->StoreGlobal(variable->raw_name(), feedback_index(slot));
+      }
+      break;
+    }
   }
 }
 
@@ -4375,7 +4396,8 @@ void BytecodeGenerator::BuildAwait(int position) {
   // multiple debug events for the same uncaught exception. There is no point
   // in the body of an async function where catch prediction is
   // HandlerTable::UNCAUGHT.
-  DCHECK(catch_prediction() != HandlerTable::UNCAUGHT);
+  DCHECK(catch_prediction() != HandlerTable::UNCAUGHT ||
+         info()->scope()->is_repl_mode_scope());
 
   {
     // Await(operand) and suspend.
@@ -4598,16 +4620,21 @@ void BytecodeGenerator::VisitKeyedSuperPropertyLoad(Property* property,
   }
 }
 
-void BytecodeGenerator::VisitOptionalChain(OptionalChain* expr) {
+template <typename ExpressionFunc>
+void BytecodeGenerator::BuildOptionalChain(ExpressionFunc expression_func) {
   BytecodeLabel done;
   OptionalChainNullLabelScope label_scope(this);
-  VisitForAccumulatorValue(expr->expression());
+  expression_func();
   builder()->Jump(&done);
   label_scope.labels()->Bind(builder());
   builder()->LoadUndefined();
   builder()->Bind(&done);
 }
 
+void BytecodeGenerator::VisitOptionalChain(OptionalChain* expr) {
+  BuildOptionalChain([&]() { VisitForAccumulatorValue(expr->expression()); });
+}
+
 void BytecodeGenerator::VisitProperty(Property* expr) {
   AssignType property_kind = Property::GetAssignType(expr);
   if (property_kind != NAMED_SUPER_PROPERTY &&
@@ -4619,11 +4646,6 @@ void BytecodeGenerator::VisitProperty(Property* expr) {
   }
 }
 
-void BytecodeGenerator::VisitResolvedProperty(ResolvedProperty* expr) {
-  // Handled by VisitCall().
-  UNREACHABLE();
-}
-
 void BytecodeGenerator::VisitArguments(const ZonePtrList<Expression>* args,
                                        RegisterList* arg_regs) {
   // Visit arguments.
@@ -4668,13 +4690,6 @@ void BytecodeGenerator::VisitCall(Call* expr) {
       VisitPropertyLoadForRegister(args.last_register(), property, callee);
       break;
     }
-    case Call::RESOLVED_PROPERTY_CALL: {
-      ResolvedProperty* resolved = callee_expr->AsResolvedProperty();
-      VisitAndPushIntoRegisterList(resolved->object(), &args);
-      VisitForAccumulatorValue(resolved->property());
-      builder()->StoreAccumulatorInRegister(callee);
-      break;
-    }
     case Call::GLOBAL_CALL: {
       // Receiver is undefined for global calls.
       if (!is_spread_call && !optimize_as_one_shot) {
@@ -4737,6 +4752,16 @@ void BytecodeGenerator::VisitCall(Call* expr) {
       builder()->StoreAccumulatorInRegister(callee);
       break;
     }
+    case Call::NAMED_OPTIONAL_CHAIN_PROPERTY_CALL:
+    case Call::KEYED_OPTIONAL_CHAIN_PROPERTY_CALL: {
+      OptionalChain* chain = callee_expr->AsOptionalChain();
+      Property* property = chain->expression()->AsProperty();
+      BuildOptionalChain([&]() {
+        VisitAndPushIntoRegisterList(property->obj(), &args);
+        VisitPropertyLoadForRegister(args.last_register(), property, callee);
+      });
+      break;
+    }
     case Call::SUPER_CALL:
       UNREACHABLE();
   }
@@ -4750,8 +4775,8 @@ void BytecodeGenerator::VisitCall(Call* expr) {
   // Evaluate all arguments to the function call and store in sequential args
   // registers.
   VisitArguments(expr->arguments(), &args);
-  int reciever_arg_count = implicit_undefined_receiver ? 0 : 1;
-  CHECK_EQ(reciever_arg_count + expr->arguments()->length(),
+  int receiver_arg_count = implicit_undefined_receiver ? 0 : 1;
+  CHECK_EQ(receiver_arg_count + expr->arguments()->length(),
            args.register_count());
 
   // Resolve callee for a potential direct eval call. This block will mutate the
@@ -4761,7 +4786,7 @@ void BytecodeGenerator::VisitCall(Call* expr) {
     // Set up arguments for ResolvePossiblyDirectEval by copying callee, source
     // strings and function closure, and loading language and
     // position.
-    Register first_arg = args[reciever_arg_count];
+    Register first_arg = args[receiver_arg_count];
     RegisterList runtime_call_args = register_allocator()->NewRegisterList(6);
     builder()
         ->MoveRegister(callee, runtime_call_args[0])
@@ -4790,8 +4815,7 @@ void BytecodeGenerator::VisitCall(Call* expr) {
     DCHECK(!implicit_undefined_receiver);
     builder()->CallNoFeedback(callee, args);
   } else if (call_type == Call::NAMED_PROPERTY_CALL ||
-             call_type == Call::KEYED_PROPERTY_CALL ||
-             call_type == Call::RESOLVED_PROPERTY_CALL) {
+             call_type == Call::KEYED_PROPERTY_CALL) {
     DCHECK(!implicit_undefined_receiver);
     builder()->CallProperty(callee, args,
                             feedback_index(feedback_spec()->AddCallICSlot()));
@@ -5040,7 +5064,8 @@ void BytecodeGenerator::VisitDelete(UnaryOperation* unary) {
     switch (variable->location()) {
       case VariableLocation::PARAMETER:
       case VariableLocation::LOCAL:
-      case VariableLocation::CONTEXT: {
+      case VariableLocation::CONTEXT:
+      case VariableLocation::REPL_GLOBAL: {
         // Deleting local var/let/const, context variables, and arguments
         // does not have any effect.
         builder()->LoadFalse();
@@ -5061,7 +5086,9 @@ void BytecodeGenerator::VisitDelete(UnaryOperation* unary) {
             .CallRuntime(Runtime::kDeleteLookupSlot, name_reg);
         break;
       }
-      default:
+      case VariableLocation::MODULE:
+        // Modules are always in strict mode and unqualified identifers are not
+        // allowed in strict mode.
         UNREACHABLE();
     }
   } else {
@@ -5474,11 +5501,16 @@ void BytecodeGenerator::BuildGetIterator(IteratorType hint) {
           feedback_index(feedback_spec()->AddCallICSlot());
 
       // Let method be GetMethod(obj, @@iterator) and
-      // iterator be Call(method, obj). If Type(iterator) is not Object,
-      // throw a SymbolIteratorInvalid exception.
+      // iterator be Call(method, obj).
       builder()->StoreAccumulatorInRegister(obj).GetIterator(
           obj, load_feedback_index, call_feedback_index);
     }
+
+    // If Type(iterator) is not Object, throw a TypeError exception.
+    BytecodeLabel no_type_error;
+    builder()->JumpIfJSReceiver(&no_type_error);
+    builder()->CallRuntime(Runtime::kThrowSymbolIteratorInvalid);
+    builder()->Bind(&no_type_error);
   }
 }
 
@@ -5967,13 +5999,7 @@ void BytecodeGenerator::BuildNewLocalActivationContext() {
   DCHECK_EQ(current_scope(), closure_scope());
 
   // Create the appropriate context.
-  if (scope->is_script_scope()) {
-    Register scope_reg = register_allocator()->NewRegister();
-    builder()
-        ->LoadLiteral(scope)
-        .StoreAccumulatorInRegister(scope_reg)
-        .CallRuntime(Runtime::kNewScriptContext, scope_reg);
-  } else if (scope->is_module_scope()) {
+  if (scope->is_module_scope()) {
     // We don't need to do anything for the outer script scope.
     DCHECK(scope->outer_scope()->is_script_scope());
 
diff --git a/deps/v8/src/interpreter/bytecode-generator.h b/deps/v8/src/interpreter/bytecode-generator.h
index ecfe50ba5a486c..15b33bcac3e7ab 100644
--- a/deps/v8/src/interpreter/bytecode-generator.h
+++ b/deps/v8/src/interpreter/bytecode-generator.h
@@ -50,6 +50,7 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
 #undef DECLARE_VISIT
 
   // Visiting function for declarations list and statements are overridden.
+  void VisitGlobalDeclarations(Declaration::List* declarations);
   void VisitDeclarations(Declaration::List* declarations);
   void VisitStatements(const ZonePtrList<Statement>* statments);
 
@@ -379,6 +380,9 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
                        HandlerTable::CatchPrediction catch_prediction,
                        TryFinallyStatement* stmt_for_coverage = nullptr);
 
+  template <typename ExpressionFunc>
+  void BuildOptionalChain(ExpressionFunc expression_func);
+
   // Visitors for obtaining expression result in the accumulator, in a
   // register, or just getting the effect. Some visitors return a TypeHint which
   // specifies the type of the result of the visited expression.
@@ -492,7 +496,6 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
 
   GlobalDeclarationsBuilder* globals_builder_;
   BlockCoverageBuilder* block_coverage_builder_;
-  ZoneVector<GlobalDeclarationsBuilder*> global_declarations_;
   ZoneVector<std::pair<FunctionLiteral*, size_t>> function_literals_;
   ZoneVector<std::pair<NativeFunctionLiteral*, size_t>>
       native_function_literals_;
diff --git a/deps/v8/src/interpreter/bytecode-operands.h b/deps/v8/src/interpreter/bytecode-operands.h
index 19acc4bcfd65bb..a5d2e6e50a78b0 100644
--- a/deps/v8/src/interpreter/bytecode-operands.h
+++ b/deps/v8/src/interpreter/bytecode-operands.h
@@ -5,8 +5,8 @@
 #ifndef V8_INTERPRETER_BYTECODE_OPERANDS_H_
 #define V8_INTERPRETER_BYTECODE_OPERANDS_H_
 
+#include "src/base/bounds.h"
 #include "src/common/globals.h"
-#include "src/utils/utils.h"
 
 namespace v8 {
 namespace internal {
@@ -149,7 +149,7 @@ class BytecodeOperands : public AllStatic {
 #undef OPERAND_SCALE_COUNT
 
   static constexpr int OperandScaleAsIndex(OperandScale operand_scale) {
-#ifdef V8_CAN_HAVE_DCHECK_IN_CONSTEXPR
+#if V8_HAS_CXX14_CONSTEXPR
 #ifdef DEBUG
     int result = static_cast<int>(operand_scale) >> 1;
     switch (operand_scale) {
@@ -182,13 +182,14 @@ class BytecodeOperands : public AllStatic {
 
   // Returns true if |operand_type| is a scalable signed byte.
   static constexpr bool IsScalableSignedByte(OperandType operand_type) {
-    return IsInRange(operand_type, OperandType::kImm,
-                     OperandType::kRegOutTriple);
+    return base::IsInRange(operand_type, OperandType::kImm,
+                           OperandType::kRegOutTriple);
   }
 
   // Returns true if |operand_type| is a scalable unsigned byte.
   static constexpr bool IsScalableUnsignedByte(OperandType operand_type) {
-    return IsInRange(operand_type, OperandType::kIdx, OperandType::kRegCount);
+    return base::IsInRange(operand_type, OperandType::kIdx,
+                           OperandType::kRegCount);
   }
 };
 
diff --git a/deps/v8/src/interpreter/constant-array-builder.cc b/deps/v8/src/interpreter/constant-array-builder.cc
index 0a4bdd62f76497..f36556f1d400b4 100644
--- a/deps/v8/src/interpreter/constant-array-builder.cc
+++ b/deps/v8/src/interpreter/constant-array-builder.cc
@@ -376,7 +376,7 @@ Handle<Object> ConstantArrayBuilder::Entry::ToHandle(Isolate* isolate) const {
       // TODO(leszeks): There's probably a better value we could use here.
       return isolate->factory()->the_hole_value();
     case Tag::kRawString:
-      return raw_string_->string();
+      return raw_string_->string().get<Factory>();
     case Tag::kHeapNumber:
       return isolate->factory()->NewNumber<AllocationType::kOld>(heap_number_);
     case Tag::kBigInt:
diff --git a/deps/v8/src/interpreter/interpreter-assembler.cc b/deps/v8/src/interpreter/interpreter-assembler.cc
index a55e074b3ae214..971642344bf259 100644
--- a/deps/v8/src/interpreter/interpreter-assembler.cc
+++ b/deps/v8/src/interpreter/interpreter-assembler.cc
@@ -157,8 +157,7 @@ TNode<Object> InterpreterAssembler::GetAccumulator() {
   return TaggedPoisonOnSpeculation(GetAccumulatorUnchecked());
 }
 
-// TODO(v8:6949): Remove sloppy-ness from SetAccumulator's value argument.
-void InterpreterAssembler::SetAccumulator(SloppyTNode<Object> value) {
+void InterpreterAssembler::SetAccumulator(TNode<Object> value) {
   DCHECK(Bytecodes::WritesAccumulator(bytecode_));
   accumulator_use_ = accumulator_use_ | AccumulatorUse::kWrite;
   accumulator_ = value;
@@ -211,15 +210,15 @@ void InterpreterAssembler::GotoIfHasContextExtensionUpToDepth(
   Goto(&context_search);
   BIND(&context_search);
   {
-    // Check if context has an extension slot
+    // Check if context has an extension slot.
     TNode<BoolT> has_extension =
-        LoadContextHasExtensionField(cur_context.value());
+        LoadScopeInfoHasExtensionField(LoadScopeInfo(cur_context.value()));
     GotoIfNot(has_extension, &no_extension);
 
-    // Jump to the target if the extension slot is not a hole.
+    // Jump to the target if the extension slot is not an undefined value.
     TNode<Object> extension_slot =
         LoadContextElement(cur_context.value(), Context::EXTENSION_INDEX);
-    Branch(TaggedNotEqual(extension_slot, TheHoleConstant()), target,
+    Branch(TaggedNotEqual(extension_slot, UndefinedConstant()), target,
            &no_extension);
 
     BIND(&no_extension);
@@ -1187,8 +1186,7 @@ void InterpreterAssembler::UpdateInterruptBudget(TNode<Int32T> weight,
 
   // Update budget.
   StoreObjectFieldNoWriteBarrier(
-      feedback_cell, FeedbackCell::kInterruptBudgetOffset, new_budget.value(),
-      MachineRepresentation::kWord32);
+      feedback_cell, FeedbackCell::kInterruptBudgetOffset, new_budget.value());
   Goto(&done);
   BIND(&done);
   Comment("] UpdateInterruptBudget");
diff --git a/deps/v8/src/interpreter/interpreter-assembler.h b/deps/v8/src/interpreter/interpreter-assembler.h
index 4a1882b82ca071..006b247794cb5d 100644
--- a/deps/v8/src/interpreter/interpreter-assembler.h
+++ b/deps/v8/src/interpreter/interpreter-assembler.h
@@ -67,7 +67,7 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   TNode<Uint32T> BytecodeOperandIntrinsicId(int operand_index);
   // Accumulator.
   TNode<Object> GetAccumulator();
-  void SetAccumulator(SloppyTNode<Object> value);
+  void SetAccumulator(TNode<Object> value);
 
   // Context.
   TNode<Context> GetContext();
diff --git a/deps/v8/src/interpreter/interpreter-generator.cc b/deps/v8/src/interpreter/interpreter-generator.cc
index 5f686f86b88c4b..50ceaf462f1c4f 100644
--- a/deps/v8/src/interpreter/interpreter-generator.cc
+++ b/deps/v8/src/interpreter/interpreter-generator.cc
@@ -7,7 +7,6 @@
 #include <array>
 #include <tuple>
 
-#include "src/builtins/builtins-arguments-gen.h"
 #include "src/builtins/builtins-constructor-gen.h"
 #include "src/builtins/builtins-iterator-gen.h"
 #include "src/codegen/code-factory.h"
@@ -26,6 +25,7 @@
 #include "src/objects/shared-function-info.h"
 #include "src/objects/source-text-module.h"
 #include "src/utils/ostreams.h"
+#include "torque-generated/exported-macros-assembler-tq.h"
 
 namespace v8 {
 namespace internal {
@@ -33,6 +33,7 @@ namespace interpreter {
 
 namespace {
 
+using compiler::CodeAssemblerState;
 using compiler::Node;
 using Label = CodeStubAssembler::Label;
 
@@ -162,7 +163,7 @@ class InterpreterLoadGlobalAssembler : public InterpreterAssembler {
     TNode<HeapObject> maybe_feedback_vector = LoadFeedbackVector();
 
     AccessorAssembler accessor_asm(state());
-    ExitPoint exit_point(this, [=](Node* result) {
+    ExitPoint exit_point(this, [=](TNode<Object> result) {
       SetAccumulator(result);
       Dispatch();
     });
@@ -794,7 +795,8 @@ IGNITION_HANDLER(StaModuleVariable, InterpreterAssembler) {
         module, SourceTextModule::kRegularExportsOffset);
     // The actual array index is (cell_index - 1).
     TNode<IntPtrT> export_index = IntPtrSub(cell_index, IntPtrConstant(1));
-    TNode<Object> cell = LoadFixedArrayElement(regular_exports, export_index);
+    TNode<HeapObject> cell =
+        CAST(LoadFixedArrayElement(regular_exports, export_index));
     StoreObjectField(cell, Cell::kValueOffset, value);
     Goto(&end);
   }
@@ -970,46 +972,14 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
     TNode<UintPtrT> slot_index = BytecodeOperandIdx(1);
     TNode<HeapObject> maybe_feedback_vector = LoadFeedbackVector();
 
-    TVARIABLE(Smi, var_left_feedback);
-    TVARIABLE(Smi, var_right_feedback);
-    TVARIABLE(Word32T, var_left_word32);
-    TVARIABLE(Word32T, var_right_word32);
-    TVARIABLE(Object, var_left_bigint, left);
-    TVARIABLE(Object, var_right_bigint);
-    Label if_left_number(this), do_number_op(this);
-    Label if_left_bigint(this), do_bigint_op(this);
-
-    TaggedToWord32OrBigIntWithFeedback(context, left, &if_left_number,
-                                       &var_left_word32, &if_left_bigint,
-                                       &var_left_bigint, &var_left_feedback);
-    BIND(&if_left_number);
-    TaggedToWord32OrBigIntWithFeedback(context, right, &do_number_op,
-                                       &var_right_word32, &do_bigint_op,
-                                       &var_right_bigint, &var_right_feedback);
-    BIND(&do_number_op);
-    TNode<Number> result = BitwiseOp(var_left_word32.value(),
-                                     var_right_word32.value(), bitwise_op);
-    TNode<Smi> result_type = SelectSmiConstant(
-        TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
-        BinaryOperationFeedback::kNumber);
-    TNode<Smi> input_feedback =
-        SmiOr(var_left_feedback.value(), var_right_feedback.value());
-    UpdateFeedback(SmiOr(result_type, input_feedback), maybe_feedback_vector,
-                   slot_index);
-    SetAccumulator(result);
-    Dispatch();
+    TVARIABLE(Smi, feedback);
 
-    // BigInt cases.
-    BIND(&if_left_bigint);
-    TaggedToNumericWithFeedback(context, right, &do_bigint_op,
-                                &var_right_bigint, &var_right_feedback);
+    BinaryOpAssembler binop_asm(state());
+    TNode<Object> result = binop_asm.Generate_BitwiseBinaryOpWithFeedback(
+        bitwise_op, left, right, context, &feedback);
 
-    BIND(&do_bigint_op);
-    SetAccumulator(
-        CallRuntime(Runtime::kBigIntBinaryOp, context, var_left_bigint.value(),
-                    var_right_bigint.value(), SmiConstant(bitwise_op)));
-    UpdateFeedback(SmiOr(var_left_feedback.value(), var_right_feedback.value()),
-                   maybe_feedback_vector, slot_index);
+    UpdateFeedback(feedback.value(), maybe_feedback_vector, slot_index);
+    SetAccumulator(result);
     Dispatch();
   }
 
@@ -1022,9 +992,7 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
 
     TVARIABLE(Smi, var_left_feedback);
     TVARIABLE(Word32T, var_left_word32);
-    // TODO(v8:6949): var_left_bigint should be BigInt, but before that we need
-    // to clean up TaggedToWord32OrBigIntWithFeedback and related methods.
-    TVARIABLE(Object, var_left_bigint);
+    TVARIABLE(BigInt, var_left_bigint);
     Label do_smi_op(this), if_bigint_mix(this);
 
     TaggedToWord32OrBigIntWithFeedback(context, left, &do_smi_op,
@@ -1131,9 +1099,7 @@ IGNITION_HANDLER(BitwiseNot, InterpreterAssembler) {
 
   TVARIABLE(Word32T, var_word32);
   TVARIABLE(Smi, var_feedback);
-  // TODO(v8:6949): var_bigint should be BigInt, but before that we need to
-  // clean up TaggedToWord32OrBigIntWithFeedback and related methods.
-  TVARIABLE(Object, var_bigint);
+  TVARIABLE(BigInt, var_bigint);
   Label if_number(this), if_bigint(this);
   TaggedToWord32OrBigIntWithFeedback(context, operand, &if_number, &var_word32,
                                      &if_bigint, &var_bigint, &var_feedback);
@@ -1597,9 +1563,9 @@ class InterpreterJSCallAssembler : public InterpreterAssembler {
     const int kFirstArgumentOperandIndex = 1;
     const int kReceiverOperandCount =
         (receiver_mode == ConvertReceiverMode::kNullOrUndefined) ? 0 : 1;
-    const int kRecieverAndArgOperandCount = kReceiverOperandCount + arg_count;
+    const int kReceiverAndArgOperandCount = kReceiverOperandCount + arg_count;
     const int kSlotOperandIndex =
-        kFirstArgumentOperandIndex + kRecieverAndArgOperandCount;
+        kFirstArgumentOperandIndex + kReceiverAndArgOperandCount;
 
     TNode<Object> function = LoadRegisterAtOperandIndex(0);
     TNode<UintPtrT> slot_id = BytecodeOperandIdx(kSlotOperandIndex);
@@ -1609,7 +1575,7 @@ class InterpreterJSCallAssembler : public InterpreterAssembler {
     // Collect the {function} feedback.
     CollectCallFeedback(function, context, maybe_feedback_vector, slot_id);
 
-    switch (kRecieverAndArgOperandCount) {
+    switch (kReceiverAndArgOperandCount) {
       case 0:
         CallJSAndDispatch(function, context, Int32Constant(arg_count),
                           receiver_mode);
@@ -1692,7 +1658,7 @@ IGNITION_HANDLER(CallRuntime, InterpreterAssembler) {
   TNode<Uint32T> function_id = BytecodeOperandRuntimeId(0);
   RegListNodePair args = GetRegisterListAtOperandIndex(1);
   TNode<Context> context = GetContext();
-  Node* result = CallRuntimeN(function_id, context, args);
+  TNode<Object> result = CAST(CallRuntimeN(function_id, context, args));
   SetAccumulator(result);
   Dispatch();
 }
@@ -2063,11 +2029,11 @@ IGNITION_HANDLER(TestTypeOf, InterpreterAssembler) {
     GotoIf(TaggedIsSmi(object), &if_false);
     // Check if callable bit is set and not undetectable.
     TNode<Int32T> map_bitfield = LoadMapBitField(LoadMap(CAST(object)));
-    TNode<Int32T> callable_undetectable =
-        Word32And(map_bitfield, Int32Constant(Map::IsUndetectableBit::kMask |
-                                              Map::IsCallableBit::kMask));
+    TNode<Int32T> callable_undetectable = Word32And(
+        map_bitfield, Int32Constant(Map::Bits1::IsUndetectableBit::kMask |
+                                    Map::Bits1::IsCallableBit::kMask));
     Branch(Word32Equal(callable_undetectable,
-                       Int32Constant(Map::IsCallableBit::kMask)),
+                       Int32Constant(Map::Bits1::IsCallableBit::kMask)),
            &if_true, &if_false);
   }
   BIND(&if_object);
@@ -2082,9 +2048,9 @@ IGNITION_HANDLER(TestTypeOf, InterpreterAssembler) {
     TNode<Map> map = LoadMap(CAST(object));
     GotoIfNot(IsJSReceiverMap(map), &if_false);
     TNode<Int32T> map_bitfield = LoadMapBitField(map);
-    TNode<Int32T> callable_undetectable =
-        Word32And(map_bitfield, Int32Constant(Map::IsUndetectableBit::kMask |
-                                              Map::IsCallableBit::kMask));
+    TNode<Int32T> callable_undetectable = Word32And(
+        map_bitfield, Int32Constant(Map::Bits1::IsUndetectableBit::kMask |
+                                    Map::Bits1::IsCallableBit::kMask));
     Branch(Word32Equal(callable_undetectable, Int32Constant(0)), &if_true,
            &if_false);
   }
@@ -2537,9 +2503,10 @@ IGNITION_HANDLER(CreateEmptyArrayLiteral, InterpreterAssembler) {
   {
     TNode<Map> array_map = LoadJSArrayElementsMap(GetInitialFastElementsKind(),
                                                   LoadNativeContext(context));
-    result =
-        AllocateJSArray(GetInitialFastElementsKind(), array_map, SmiConstant(0),
-                        SmiConstant(0), {}, ParameterMode::SMI_PARAMETERS);
+    TNode<Smi> length = SmiConstant(0);
+    TNode<IntPtrT> capacity = IntPtrConstant(0);
+    result = AllocateJSArray(GetInitialFastElementsKind(), array_map, capacity,
+                             length);
     Goto(&end);
   }
 
@@ -2829,9 +2796,7 @@ IGNITION_HANDLER(CreateMappedArguments, InterpreterAssembler) {
 
   BIND(&if_not_duplicate_parameters);
   {
-    ArgumentsBuiltinsAssembler constructor_assembler(state());
-    TNode<JSObject> result =
-        constructor_assembler.EmitFastNewSloppyArguments(context, closure);
+    TNode<JSObject> result = EmitFastNewSloppyArguments(context, closure);
     SetAccumulator(result);
     Dispatch();
   }
@@ -2851,7 +2816,7 @@ IGNITION_HANDLER(CreateMappedArguments, InterpreterAssembler) {
 IGNITION_HANDLER(CreateUnmappedArguments, InterpreterAssembler) {
   TNode<Context> context = GetContext();
   TNode<JSFunction> closure = CAST(LoadRegister(Register::function_closure()));
-  ArgumentsBuiltinsAssembler builtins_assembler(state());
+  TorqueGeneratedExportedMacrosAssembler builtins_assembler(state());
   TNode<JSObject> result =
       builtins_assembler.EmitFastNewStrictArguments(context, closure);
   SetAccumulator(result);
@@ -2864,9 +2829,9 @@ IGNITION_HANDLER(CreateUnmappedArguments, InterpreterAssembler) {
 IGNITION_HANDLER(CreateRestParameter, InterpreterAssembler) {
   TNode<JSFunction> closure = CAST(LoadRegister(Register::function_closure()));
   TNode<Context> context = GetContext();
-  ArgumentsBuiltinsAssembler builtins_assembler(state());
+  TorqueGeneratedExportedMacrosAssembler builtins_assembler(state());
   TNode<JSObject> result =
-      builtins_assembler.EmitFastNewRestParameter(context, closure);
+      builtins_assembler.EmitFastNewRestArguments(context, closure);
   SetAccumulator(result);
   Dispatch();
 }
@@ -3215,8 +3180,10 @@ IGNITION_HANDLER(ForInStep, InterpreterAssembler) {
 // GetIterator <object>
 //
 // Retrieves the object[Symbol.iterator] method, calls it and stores
-// the result in the accumulator. If the result is not a JSReceiver, throws
-// SymbolIteratorInvalid runtime exception.
+// the result in the accumulator
+// TODO(swapnilgaikwad): Extend the functionality of the bytecode to
+// check if the result is a JSReceiver else throw SymbolIteratorInvalid
+// runtime exception
 IGNITION_HANDLER(GetIterator, InterpreterAssembler) {
   TNode<Object> receiver = LoadRegisterAtOperandIndex(0);
   TNode<Context> context = GetContext();
@@ -3273,9 +3240,8 @@ IGNITION_HANDLER(SuspendGenerator, InterpreterAssembler) {
 
   TNode<SharedFunctionInfo> shared =
       CAST(LoadObjectField(closure, JSFunction::kSharedFunctionInfoOffset));
-  TNode<Int32T> formal_parameter_count = UncheckedCast<Int32T>(
-      LoadObjectField(shared, SharedFunctionInfo::kFormalParameterCountOffset,
-                      MachineType::Uint16()));
+  TNode<Int32T> formal_parameter_count = LoadObjectField<Uint16T>(
+      shared, SharedFunctionInfo::kFormalParameterCountOffset);
 
   ExportParametersAndRegisterFile(array, registers, formal_parameter_count);
   StoreObjectField(generator, JSGeneratorObject::kContextOffset, context);
@@ -3350,9 +3316,8 @@ IGNITION_HANDLER(ResumeGenerator, InterpreterAssembler) {
 
   TNode<SharedFunctionInfo> shared =
       CAST(LoadObjectField(closure, JSFunction::kSharedFunctionInfoOffset));
-  TNode<Int32T> formal_parameter_count = UncheckedCast<Int32T>(
-      LoadObjectField(shared, SharedFunctionInfo::kFormalParameterCountOffset,
-                      MachineType::Uint16()));
+  TNode<Int32T> formal_parameter_count = LoadObjectField<Uint16T>(
+      shared, SharedFunctionInfo::kFormalParameterCountOffset);
 
   ImportRegisterFile(
       CAST(LoadObjectField(generator,
diff --git a/deps/v8/src/interpreter/interpreter-intrinsics-generator.cc b/deps/v8/src/interpreter/interpreter-intrinsics-generator.cc
index f5307762f78848..f67e78b3b267db 100644
--- a/deps/v8/src/interpreter/interpreter-intrinsics-generator.cc
+++ b/deps/v8/src/interpreter/interpreter-intrinsics-generator.cc
@@ -269,13 +269,13 @@ TNode<Object> IntrinsicsGenerator::CreateAsyncFromSyncIterator(
   __ GotoIf(__ TaggedIsSmi(sync_iterator), &not_receiver);
   __ GotoIfNot(__ IsJSReceiver(__ CAST(sync_iterator)), &not_receiver);
 
-  TNode<Object> const next =
+  const TNode<Object> next =
       __ GetProperty(context, sync_iterator, factory()->next_string());
 
-  TNode<NativeContext> const native_context = __ LoadNativeContext(context);
-  TNode<Map> const map = __ CAST(__ LoadContextElement(
+  const TNode<NativeContext> native_context = __ LoadNativeContext(context);
+  const TNode<Map> map = __ CAST(__ LoadContextElement(
       native_context, Context::ASYNC_FROM_SYNC_ITERATOR_MAP_INDEX));
-  TNode<JSObject> const iterator = __ AllocateJSObjectFromMap(map);
+  const TNode<JSObject> iterator = __ AllocateJSObjectFromMap(map);
 
   __ StoreObjectFieldNoWriteBarrier(
       iterator, JSAsyncFromSyncIterator::kSyncIteratorOffset, sync_iterator);
@@ -308,7 +308,7 @@ TNode<Object> IntrinsicsGenerator::GeneratorGetResumeMode(
     const InterpreterAssembler::RegListNodePair& args, TNode<Context> context) {
   TNode<JSGeneratorObject> generator =
       __ CAST(__ LoadRegisterFromRegisterList(args, 0));
-  TNode<Object> const value =
+  const TNode<Object> value =
       __ LoadObjectField(generator, JSGeneratorObject::kResumeModeOffset);
 
   return value;
@@ -326,10 +326,10 @@ TNode<Object> IntrinsicsGenerator::GeneratorClose(
 
 TNode<Object> IntrinsicsGenerator::GetImportMetaObject(
     const InterpreterAssembler::RegListNodePair& args, TNode<Context> context) {
-  TNode<Context> const module_context = __ LoadModuleContext(context);
-  TNode<HeapObject> const module =
+  const TNode<Context> module_context = __ LoadModuleContext(context);
+  const TNode<HeapObject> module =
       __ CAST(__ LoadContextElement(module_context, Context::EXTENSION_INDEX));
-  TNode<Object> const import_meta =
+  const TNode<Object> import_meta =
       __ LoadObjectField(module, SourceTextModule::kImportMetaOffset);
 
   InterpreterAssembler::TVariable<Object> return_value(assembler_);
diff --git a/deps/v8/src/interpreter/interpreter.cc b/deps/v8/src/interpreter/interpreter.cc
index 52ce4a140866bb..93b09d22ecb810 100644
--- a/deps/v8/src/interpreter/interpreter.cc
+++ b/deps/v8/src/interpreter/interpreter.cc
@@ -43,7 +43,7 @@ class InterpreterCompilationJob final : public UnoptimizedCompilationJob {
 
  private:
   BytecodeGenerator* generator() { return &generator_; }
-  void CheckAndPrintBytecodeMismatch(Isolate* isolate,
+  void CheckAndPrintBytecodeMismatch(Isolate* isolate, Handle<Script> script,
                                      Handle<BytecodeArray> bytecode);
 
   Zone zone_;
@@ -89,6 +89,7 @@ Code Interpreter::GetBytecodeHandler(Bytecode bytecode,
 
 void Interpreter::SetBytecodeHandler(Bytecode bytecode,
                                      OperandScale operand_scale, Code handler) {
+  DCHECK(handler.is_off_heap_trampoline());
   DCHECK(handler.kind() == Code::BYTECODE_HANDLER);
   size_t index = GetDispatchTableIndex(bytecode, operand_scale);
   dispatch_table_[index] = handler.InstructionStart();
@@ -103,41 +104,6 @@ size_t Interpreter::GetDispatchTableIndex(Bytecode bytecode,
                      kEntriesPerOperandScale;
 }
 
-void Interpreter::IterateDispatchTable(RootVisitor* v) {
-  if (FLAG_embedded_builtins && !isolate_->serializer_enabled() &&
-      isolate_->embedded_blob() != nullptr) {
-// If builtins are embedded (and we're not generating a snapshot), then
-// every bytecode handler will be off-heap, so there's no point iterating
-// over them.
-#ifdef DEBUG
-    for (int i = 0; i < kDispatchTableSize; i++) {
-      Address code_entry = dispatch_table_[i];
-      CHECK(code_entry == kNullAddress ||
-            InstructionStream::PcIsOffHeap(isolate_, code_entry));
-    }
-#endif  // DEBUG
-    return;
-  }
-
-  for (int i = 0; i < kDispatchTableSize; i++) {
-    Address code_entry = dispatch_table_[i];
-    // Skip over off-heap bytecode handlers since they will never move.
-    if (InstructionStream::PcIsOffHeap(isolate_, code_entry)) continue;
-
-    // TODO(jkummerow): Would it hurt to simply do:
-    // if (code_entry == kNullAddress) continue;
-    Code code;
-    if (code_entry != kNullAddress) {
-      code = Code::GetCodeFromTargetAddress(code_entry);
-    }
-    Code old_code = code;
-    v->VisitRootPointer(Root::kDispatchTable, nullptr, FullObjectSlot(&code));
-    if (code != old_code) {
-      dispatch_table_[i] = code.entry();
-    }
-  }
-}
-
 int Interpreter::InterruptBudget() {
   return FLAG_interrupt_budget;
 }
@@ -187,9 +153,8 @@ InterpreterCompilationJob::InterpreterCompilationJob(
 InterpreterCompilationJob::Status InterpreterCompilationJob::ExecuteJobImpl() {
   RuntimeCallTimerScope runtimeTimerScope(
       parse_info()->runtime_call_stats(),
-      parse_info()->on_background_thread()
-          ? RuntimeCallCounterId::kCompileBackgroundIgnition
-          : RuntimeCallCounterId::kCompileIgnition);
+      RuntimeCallCounterId::kCompileIgnition,
+      RuntimeCallStats::kThreadSpecific);
   // TODO(lpy): add support for background compilation RCS trace.
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"), "V8.CompileIgnition");
 
@@ -207,15 +172,33 @@ InterpreterCompilationJob::Status InterpreterCompilationJob::ExecuteJobImpl() {
 
 #ifdef DEBUG
 void InterpreterCompilationJob::CheckAndPrintBytecodeMismatch(
-    Isolate* isolate, Handle<BytecodeArray> bytecode) {
+    Isolate* isolate, Handle<Script> script, Handle<BytecodeArray> bytecode) {
   int first_mismatch = generator()->CheckBytecodeMatches(bytecode);
   if (first_mismatch >= 0) {
-    parse_info()->ast_value_factory()->Internalize(isolate);
+    parse_info()->ast_value_factory()->Internalize(isolate->factory());
     DeclarationScope::AllocateScopeInfos(parse_info(), isolate);
 
     Handle<BytecodeArray> new_bytecode =
-        generator()->FinalizeBytecode(isolate, parse_info()->script());
-    std::cerr << "Bytecode mismatch\nOriginal bytecode:\n";
+        generator()->FinalizeBytecode(isolate, script);
+
+    std::cerr << "Bytecode mismatch";
+#ifdef OBJECT_PRINT
+    std::cerr << " found for function: ";
+    Handle<String> name =
+        parse_info()->function_name()->string().get<Factory>();
+    if (name->length() == 0) {
+      std::cerr << "anonymous";
+    } else {
+      name->StringPrint(std::cerr);
+    }
+    Object script_name = script->GetNameOrSourceURL();
+    if (script_name.IsString()) {
+      std::cerr << " ";
+      String::cast(script_name).StringPrint(std::cerr);
+      std::cerr << ":" << parse_info()->start_position();
+    }
+#endif
+    std::cerr << "\nOriginal bytecode:\n";
     bytecode->Disassemble(std::cerr);
     std::cerr << "\nNew bytecode:\n";
     new_bytecode->Disassemble(std::cerr);
@@ -234,7 +217,8 @@ InterpreterCompilationJob::Status InterpreterCompilationJob::FinalizeJobImpl(
 
   Handle<BytecodeArray> bytecodes = compilation_info_.bytecode_array();
   if (bytecodes.is_null()) {
-    bytecodes = generator()->FinalizeBytecode(isolate, parse_info()->script());
+    bytecodes = generator()->FinalizeBytecode(
+        isolate, handle(Script::cast(shared_info->script()), isolate));
     if (generator()->HasStackOverflow()) {
       return FAILED;
     }
@@ -259,7 +243,8 @@ InterpreterCompilationJob::Status InterpreterCompilationJob::FinalizeJobImpl(
   }
 
 #ifdef DEBUG
-  CheckAndPrintBytecodeMismatch(isolate, bytecodes);
+  CheckAndPrintBytecodeMismatch(
+      isolate, handle(Script::cast(shared_info->script()), isolate), bytecodes);
 #endif
 
   return SUCCEEDED;
@@ -280,7 +265,7 @@ Interpreter::NewSourcePositionCollectionJob(
   auto job = std::make_unique<InterpreterCompilationJob>(parse_info, literal,
                                                          allocator, nullptr);
   job->compilation_info()->SetBytecodeArray(existing_bytecode);
-  return std::unique_ptr<UnoptimizedCompilationJob> { static_cast<UnoptimizedCompilationJob*>(job.release()) };
+  return job;
 }
 
 void Interpreter::ForEachBytecode(
diff --git a/deps/v8/src/interpreter/interpreter.h b/deps/v8/src/interpreter/interpreter.h
index 002c9701a8813c..d85b872639a203 100644
--- a/deps/v8/src/interpreter/interpreter.h
+++ b/deps/v8/src/interpreter/interpreter.h
@@ -66,9 +66,6 @@ class Interpreter {
   void SetBytecodeHandler(Bytecode bytecode, OperandScale operand_scale,
                           Code handler);
 
-  // GC support.
-  void IterateDispatchTable(RootVisitor* v);
-
   // Disassembler support.
   V8_EXPORT_PRIVATE const char* LookupNameOfBytecodeHandler(const Code code);
 
diff --git a/deps/v8/src/json/OWNERS b/deps/v8/src/json/OWNERS
index bc56882a9a1d39..48b6dfd658e268 100644
--- a/deps/v8/src/json/OWNERS
+++ b/deps/v8/src/json/OWNERS
@@ -1,6 +1,5 @@
 ishell@chromium.org
 jkummerow@chromium.org
 verwaest@chromium.org
-yangguo@chromium.org
 
 # COMPONENT: Blink>JavaScript>Runtime
diff --git a/deps/v8/src/json/json-parser.cc b/deps/v8/src/json/json-parser.cc
index 3a790c210dcae9..928bca4d52cdb3 100644
--- a/deps/v8/src/json/json-parser.cc
+++ b/deps/v8/src/json/json-parser.cc
@@ -64,7 +64,7 @@ enum class EscapeKind : uint8_t {
   kUnicode
 };
 
-using EscapeKindField = BitField8<EscapeKind, 0, 3>;
+using EscapeKindField = base::BitField8<EscapeKind, 0, 3>;
 using MayTerminateStringField = EscapeKindField::Next<bool, 1>;
 using NumberPartField = MayTerminateStringField::Next<bool, 1>;
 
@@ -362,7 +362,7 @@ JsonString JsonParser<Char>::ScanJsonPropertyKey(JsonContinuation* cont) {
         uint32_t index = first - '0';
         while (true) {
           cursor_ = std::find_if(cursor_ + 1, end_, [&index](Char c) {
-            return !TryAddIndexChar(&index, c);
+            return !TryAddArrayIndexChar(&index, c);
           });
 
           if (CurrentCharacter() == '"') {
@@ -374,7 +374,7 @@ JsonString JsonParser<Char>::ScanJsonPropertyKey(JsonContinuation* cont) {
           }
 
           if (CurrentCharacter() == '\\' && NextCharacter() == 'u') {
-            if (TryAddIndexChar(&index, ScanUnicodeCharacter())) continue;
+            if (TryAddArrayIndexChar(&index, ScanUnicodeCharacter())) continue;
           }
 
           break;
@@ -840,6 +840,9 @@ MaybeHandle<Object> JsonParser<Char>::ParseJsonValue() {
             // from the transition tree.
             if (!maybe_feedback.GetBackPointer().IsUndefined(isolate_)) {
               feedback = handle(maybe_feedback, isolate_);
+              if (feedback->is_deprecated()) {
+                feedback = Map::Update(isolate_, feedback);
+              }
             }
           }
           value = BuildJsonObject(cont, property_stack, feedback);
@@ -906,7 +909,8 @@ Handle<Object> JsonParser<Char>::ParseJsonNumber() {
       // Prefix zero is only allowed if it's the only digit before
       // a decimal point or exponent.
       c = NextCharacter();
-      if (IsInRange(c, 0, static_cast<int32_t>(unibrow::Latin1::kMaxChar)) &&
+      if (base::IsInRange(c, 0,
+                          static_cast<int32_t>(unibrow::Latin1::kMaxChar)) &&
           IsNumberPart(character_json_scan_flags[c])) {
         if (V8_UNLIKELY(IsDecimalDigit(c))) {
           AllowHeapAllocation allow_before_exception;
@@ -929,7 +933,8 @@ Handle<Object> JsonParser<Char>::ParseJsonNumber() {
       STATIC_ASSERT(Smi::IsValid(999999999));
       const int kMaxSmiLength = 9;
       if ((cursor_ - smi_start) <= kMaxSmiLength &&
-          (!IsInRange(c, 0, static_cast<int32_t>(unibrow::Latin1::kMaxChar)) ||
+          (!base::IsInRange(c, 0,
+                            static_cast<int32_t>(unibrow::Latin1::kMaxChar)) ||
            !IsNumberPart(character_json_scan_flags[c]))) {
         // Smi.
         int32_t i = 0;
@@ -1149,7 +1154,7 @@ JsonString JsonParser<Char>::ScanJsonString(bool needs_internalization) {
     if (*cursor_ == '\\') {
       has_escape = true;
       uc32 c = NextCharacter();
-      if (V8_UNLIKELY(!IsInRange(
+      if (V8_UNLIKELY(!base::IsInRange(
               c, 0, static_cast<int32_t>(unibrow::Latin1::kMaxChar)))) {
         AllowHeapAllocation allow_before_exception;
         ReportUnexpectedCharacter(c);
diff --git a/deps/v8/src/libplatform/default-foreground-task-runner.cc b/deps/v8/src/libplatform/default-foreground-task-runner.cc
index 23942043481b38..cb046a9ea71cf2 100644
--- a/deps/v8/src/libplatform/default-foreground-task-runner.cc
+++ b/deps/v8/src/libplatform/default-foreground-task-runner.cc
@@ -10,6 +10,18 @@
 namespace v8 {
 namespace platform {
 
+DefaultForegroundTaskRunner::RunTaskScope::RunTaskScope(
+    std::shared_ptr<DefaultForegroundTaskRunner> task_runner)
+    : task_runner_(task_runner) {
+  DCHECK_GE(task_runner->nesting_depth_, 0);
+  task_runner->nesting_depth_++;
+}
+
+DefaultForegroundTaskRunner::RunTaskScope::~RunTaskScope() {
+  DCHECK_GT(task_runner_->nesting_depth_, 0);
+  task_runner_->nesting_depth_--;
+}
+
 DefaultForegroundTaskRunner::DefaultForegroundTaskRunner(
     IdleTaskSupport idle_task_support, TimeFunction time_function)
     : idle_task_support_(idle_task_support), time_function_(time_function) {}
@@ -19,21 +31,22 @@ void DefaultForegroundTaskRunner::Terminate() {
   terminated_ = true;
 
   // Drain the task queues.
-  while (!task_queue_.empty()) task_queue_.pop();
+  while (!task_queue_.empty()) task_queue_.pop_front();
   while (!delayed_task_queue_.empty()) delayed_task_queue_.pop();
   while (!idle_task_queue_.empty()) idle_task_queue_.pop();
 }
 
 void DefaultForegroundTaskRunner::PostTaskLocked(std::unique_ptr<Task> task,
+                                                 Nestability nestability,
                                                  const base::MutexGuard&) {
   if (terminated_) return;
-  task_queue_.push(std::move(task));
+  task_queue_.push_back(std::make_pair(nestability, std::move(task)));
   event_loop_control_.NotifyOne();
 }
 
 void DefaultForegroundTaskRunner::PostTask(std::unique_ptr<Task> task) {
   base::MutexGuard guard(&lock_);
-  PostTaskLocked(std::move(task), guard);
+  PostTaskLocked(std::move(task), kNestable, guard);
 }
 
 double DefaultForegroundTaskRunner::MonotonicallyIncreasingTime() {
@@ -62,31 +75,46 @@ bool DefaultForegroundTaskRunner::IdleTasksEnabled() {
 
 void DefaultForegroundTaskRunner::PostNonNestableTask(
     std::unique_ptr<Task> task) {
-  // Default platform does not nest tasks.
-  PostTask(std::move(task));
+  base::MutexGuard guard(&lock_);
+  PostTaskLocked(std::move(task), kNonNestable, guard);
 }
 
 bool DefaultForegroundTaskRunner::NonNestableTasksEnabled() const {
   return true;
 }
 
+bool DefaultForegroundTaskRunner::HasPoppableTaskInQueue() const {
+  if (nesting_depth_ == 0) return !task_queue_.empty();
+  for (auto it = task_queue_.cbegin(); it != task_queue_.cend(); it++) {
+    if (it->first == kNestable) return true;
+  }
+  return false;
+}
+
 std::unique_ptr<Task> DefaultForegroundTaskRunner::PopTaskFromQueue(
     MessageLoopBehavior wait_for_work) {
   base::MutexGuard guard(&lock_);
   // Move delayed tasks that hit their deadline to the main queue.
   std::unique_ptr<Task> task = PopTaskFromDelayedQueueLocked(guard);
   while (task) {
-    PostTaskLocked(std::move(task), guard);
+    PostTaskLocked(std::move(task), kNestable, guard);
     task = PopTaskFromDelayedQueueLocked(guard);
   }
 
-  while (task_queue_.empty()) {
+  while (!HasPoppableTaskInQueue()) {
     if (wait_for_work == MessageLoopBehavior::kDoNotWait) return {};
     WaitForTaskLocked(guard);
   }
 
-  task = std::move(task_queue_.front());
-  task_queue_.pop();
+  auto it = task_queue_.begin();
+  for (; it != task_queue_.end(); it++) {
+    // When the task queue is nested (i.e. popping a task from the queue from
+    // within a task), only nestable tasks may run. Otherwise, any task may run.
+    if (nesting_depth_ == 0 || it->first == kNestable) break;
+  }
+  DCHECK(it != task_queue_.end());
+  task = std::move(it->second);
+  task_queue_.erase(it);
 
   return task;
 }
diff --git a/deps/v8/src/libplatform/default-foreground-task-runner.h b/deps/v8/src/libplatform/default-foreground-task-runner.h
index 9ff30e39405001..a923f3f867aba3 100644
--- a/deps/v8/src/libplatform/default-foreground-task-runner.h
+++ b/deps/v8/src/libplatform/default-foreground-task-runner.h
@@ -20,6 +20,18 @@ class V8_PLATFORM_EXPORT DefaultForegroundTaskRunner
     : public NON_EXPORTED_BASE(TaskRunner) {
  public:
   using TimeFunction = double (*)();
+  class RunTaskScope {
+   public:
+    explicit RunTaskScope(
+        std::shared_ptr<DefaultForegroundTaskRunner> task_runner);
+    ~RunTaskScope();
+
+   private:
+    RunTaskScope(const RunTaskScope&) = delete;
+    RunTaskScope& operator=(const RunTaskScope&) = delete;
+
+    std::shared_ptr<DefaultForegroundTaskRunner> task_runner_;
+  };
 
   DefaultForegroundTaskRunner(IdleTaskSupport idle_task_support,
                               TimeFunction time_function);
@@ -46,18 +58,31 @@ class V8_PLATFORM_EXPORT DefaultForegroundTaskRunner
   bool NonNestableTasksEnabled() const override;
 
  private:
-  // The same as PostTask, but the lock is already held by the caller. The
-  // {guard} parameter should make sure that the caller is holding the lock.
-  void PostTaskLocked(std::unique_ptr<Task> task, const base::MutexGuard&);
+  enum Nestability { kNestable, kNonNestable };
+
+  // The same as PostTask or PostNonNestableTask, but the lock is already held
+  // by the caller. The {guard} parameter should make sure that the caller is
+  // holding the lock.
+  void PostTaskLocked(std::unique_ptr<Task> task, Nestability nestability,
+                      const base::MutexGuard&);
 
   // A caller of this function has to hold {lock_}. The {guard} parameter should
   // make sure that the caller is holding the lock.
   std::unique_ptr<Task> PopTaskFromDelayedQueueLocked(const base::MutexGuard&);
 
+  // A non-nestable task is poppable only if the task runner is not nested,
+  // i.e. if a task is not being run from within a task. A nestable task is
+  // always poppable.
+  bool HasPoppableTaskInQueue() const;
+
   bool terminated_ = false;
   base::Mutex lock_;
   base::ConditionVariable event_loop_control_;
-  std::queue<std::unique_ptr<Task>> task_queue_;
+  int nesting_depth_ = 0;
+
+  using TaskQueueEntry = std::pair<Nestability, std::unique_ptr<Task>>;
+  std::deque<TaskQueueEntry> task_queue_;
+
   IdleTaskSupport idle_task_support_;
   std::queue<std::unique_ptr<IdleTask>> idle_task_queue_;
 
diff --git a/deps/v8/src/libplatform/default-platform.cc b/deps/v8/src/libplatform/default-platform.cc
index af60c2bd1be5c0..ddbbd0d4be14c8 100644
--- a/deps/v8/src/libplatform/default-platform.cc
+++ b/deps/v8/src/libplatform/default-platform.cc
@@ -141,6 +141,7 @@ bool DefaultPlatform::PumpMessageLoop(v8::Isolate* isolate,
   std::unique_ptr<Task> task = task_runner->PopTaskFromQueue(wait_for_work);
   if (!task) return failed_result;
 
+  DefaultForegroundTaskRunner::RunTaskScope scope(task_runner);
   task->Run();
   return true;
 }
@@ -163,6 +164,7 @@ void DefaultPlatform::RunIdleTasks(v8::Isolate* isolate,
   while (deadline_in_seconds > MonotonicallyIncreasingTime()) {
     std::unique_ptr<IdleTask> task = task_runner->PopTaskFromIdleQueue();
     if (!task) return;
+    DefaultForegroundTaskRunner::RunTaskScope scope(task_runner);
     task->Run(deadline_in_seconds);
   }
 }
@@ -193,23 +195,6 @@ void DefaultPlatform::CallDelayedOnWorkerThread(std::unique_ptr<Task> task,
                                                delay_in_seconds);
 }
 
-void DefaultPlatform::CallOnForegroundThread(v8::Isolate* isolate, Task* task) {
-  GetForegroundTaskRunner(isolate)->PostTask(std::unique_ptr<Task>(task));
-}
-
-void DefaultPlatform::CallDelayedOnForegroundThread(Isolate* isolate,
-                                                    Task* task,
-                                                    double delay_in_seconds) {
-  GetForegroundTaskRunner(isolate)->PostDelayedTask(std::unique_ptr<Task>(task),
-                                                    delay_in_seconds);
-}
-
-void DefaultPlatform::CallIdleOnForegroundThread(Isolate* isolate,
-                                                 IdleTask* task) {
-  GetForegroundTaskRunner(isolate)->PostIdleTask(
-      std::unique_ptr<IdleTask>(task));
-}
-
 bool DefaultPlatform::IdleTasksEnabled(Isolate* isolate) {
   return idle_task_support_ == IdleTaskSupport::kEnabled;
 }
diff --git a/deps/v8/src/libplatform/default-platform.h b/deps/v8/src/libplatform/default-platform.h
index 40a945fd8a9800..f49277954cd2ad 100644
--- a/deps/v8/src/libplatform/default-platform.h
+++ b/deps/v8/src/libplatform/default-platform.h
@@ -61,10 +61,6 @@ class V8_PLATFORM_EXPORT DefaultPlatform : public NON_EXPORTED_BASE(Platform) {
   void CallOnWorkerThread(std::unique_ptr<Task> task) override;
   void CallDelayedOnWorkerThread(std::unique_ptr<Task> task,
                                  double delay_in_seconds) override;
-  void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override;
-  void CallDelayedOnForegroundThread(Isolate* isolate, Task* task,
-                                     double delay_in_seconds) override;
-  void CallIdleOnForegroundThread(Isolate* isolate, IdleTask* task) override;
   bool IdleTasksEnabled(Isolate* isolate) override;
   double MonotonicallyIncreasingTime() override;
   double CurrentClockTimeMillis() override;
diff --git a/deps/v8/src/libplatform/default-worker-threads-task-runner.cc b/deps/v8/src/libplatform/default-worker-threads-task-runner.cc
index 8cae955fd16fe6..3d57994493b6f9 100644
--- a/deps/v8/src/libplatform/default-worker-threads-task-runner.cc
+++ b/deps/v8/src/libplatform/default-worker-threads-task-runner.cc
@@ -11,9 +11,7 @@ namespace platform {
 
 DefaultWorkerThreadsTaskRunner::DefaultWorkerThreadsTaskRunner(
     uint32_t thread_pool_size, TimeFunction time_function)
-    : queue_(time_function),
-      time_function_(time_function),
-      thread_pool_size_(thread_pool_size) {
+    : queue_(time_function), time_function_(time_function) {
   for (uint32_t i = 0; i < thread_pool_size; ++i) {
     thread_pool_.push_back(std::make_unique<WorkerThread>(this));
   }
@@ -25,20 +23,12 @@ double DefaultWorkerThreadsTaskRunner::MonotonicallyIncreasingTime() {
   return time_function_();
 }
 
-bool DefaultWorkerThreadsTaskRunner::RunsTasksOnCurrentThread() const {
-  USE(thread_pool_size_);
-  DCHECK_EQ(thread_pool_size_, 1);
-  return single_worker_thread_id_.load(std::memory_order_relaxed) ==
-         base::OS::GetCurrentThreadId();
-}
-
 void DefaultWorkerThreadsTaskRunner::Terminate() {
   base::MutexGuard guard(&lock_);
   terminated_ = true;
   queue_.Terminate();
   // Clearing the thread pool lets all worker threads join.
   thread_pool_.clear();
-  single_worker_thread_id_.store(0, std::memory_order_relaxed);
 }
 
 void DefaultWorkerThreadsTaskRunner::PostTask(std::unique_ptr<Task> task) {
@@ -79,8 +69,6 @@ DefaultWorkerThreadsTaskRunner::WorkerThread::WorkerThread(
 DefaultWorkerThreadsTaskRunner::WorkerThread::~WorkerThread() { Join(); }
 
 void DefaultWorkerThreadsTaskRunner::WorkerThread::Run() {
-  runner_->single_worker_thread_id_.store(base::OS::GetCurrentThreadId(),
-                                          std::memory_order_relaxed);
   while (std::unique_ptr<Task> task = runner_->GetNext()) {
     task->Run();
   }
diff --git a/deps/v8/src/libplatform/default-worker-threads-task-runner.h b/deps/v8/src/libplatform/default-worker-threads-task-runner.h
index d761a36e1b75c8..dd3c9e694b14f4 100644
--- a/deps/v8/src/libplatform/default-worker-threads-task-runner.h
+++ b/deps/v8/src/libplatform/default-worker-threads-task-runner.h
@@ -31,10 +31,6 @@ class V8_PLATFORM_EXPORT DefaultWorkerThreadsTaskRunner
 
   double MonotonicallyIncreasingTime();
 
-  // It is only valid to call this method on a task runner with a single worker
-  // thread. True if the current thread is the worker thread.
-  bool RunsTasksOnCurrentThread() const;
-
   // v8::TaskRunner implementation.
   void PostTask(std::unique_ptr<Task> task) override;
 
@@ -69,8 +65,6 @@ class V8_PLATFORM_EXPORT DefaultWorkerThreadsTaskRunner
   DelayedTaskQueue queue_;
   std::vector<std::unique_ptr<WorkerThread>> thread_pool_;
   TimeFunction time_function_;
-  std::atomic_int single_worker_thread_id_{0};
-  uint32_t thread_pool_size_;
 };
 
 }  // namespace platform
diff --git a/deps/v8/src/libplatform/tracing/trace-writer.cc b/deps/v8/src/libplatform/tracing/trace-writer.cc
index 23dfd0cf46c679..1d3e53ac3b997f 100644
--- a/deps/v8/src/libplatform/tracing/trace-writer.cc
+++ b/deps/v8/src/libplatform/tracing/trace-writer.cc
@@ -59,7 +59,7 @@ void JSONTraceWriter::AppendArgValue(uint8_t type,
                                      TraceObject::ArgValue value) {
   switch (type) {
     case TRACE_VALUE_TYPE_BOOL:
-      stream_ << (value.as_bool ? "true" : "false");
+      stream_ << (value.as_uint ? "true" : "false");
       break;
     case TRACE_VALUE_TYPE_UINT:
       stream_ << value.as_uint;
diff --git a/deps/v8/src/libplatform/tracing/tracing-controller.cc b/deps/v8/src/libplatform/tracing/tracing-controller.cc
index d0972f93229569..fdbfdddb512449 100644
--- a/deps/v8/src/libplatform/tracing/tracing-controller.cc
+++ b/deps/v8/src/libplatform/tracing/tracing-controller.cc
@@ -129,7 +129,7 @@ void AddArgsToTraceProto(
         break;
       }
       case TRACE_VALUE_TYPE_BOOL:
-        arg->set_bool_value(arg_value.as_bool);
+        arg->set_bool_value(arg_value.as_uint);
         break;
       case TRACE_VALUE_TYPE_UINT:
         arg->set_uint_value(arg_value.as_uint);
diff --git a/deps/v8/src/libsampler/sampler.cc b/deps/v8/src/libsampler/sampler.cc
index d9f59dff74af02..9677b58c19970b 100644
--- a/deps/v8/src/libsampler/sampler.cc
+++ b/deps/v8/src/libsampler/sampler.cc
@@ -477,9 +477,9 @@ void SignalHandler::FillRegisterState(void* context, RegisterState* state) {
   state->sp = reinterpret_cast<void*>(mcontext.mc_rsp);
   state->fp = reinterpret_cast<void*>(mcontext.mc_rbp);
 #elif V8_HOST_ARCH_ARM
-  state->pc = reinterpret_cast<void*>(mcontext.mc_r15);
-  state->sp = reinterpret_cast<void*>(mcontext.mc_r13);
-  state->fp = reinterpret_cast<void*>(mcontext.mc_r11);
+  state->pc = reinterpret_cast<void*>(mcontext.__gregs[_REG_PC]);
+  state->sp = reinterpret_cast<void*>(mcontext.__gregs[_REG_SP]);
+  state->fp = reinterpret_cast<void*>(mcontext.__gregs[_REG_FP]);
 #endif  // V8_HOST_ARCH_*
 #elif V8_OS_NETBSD
 #if V8_HOST_ARCH_IA32
diff --git a/deps/v8/src/logging/code-events.h b/deps/v8/src/logging/code-events.h
index 7df135c43fa40d..5217644c827c0c 100644
--- a/deps/v8/src/logging/code-events.h
+++ b/deps/v8/src/logging/code-events.h
@@ -72,34 +72,40 @@ class CodeEventListener {
 
   virtual ~CodeEventListener() = default;
 
-  virtual void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                               const char* comment) = 0;
-  virtual void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                               Name name) = 0;
-  virtual void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                               SharedFunctionInfo shared, Name source) = 0;
-  virtual void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                               SharedFunctionInfo shared, Name source, int line,
+  virtual void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                               const char* name) = 0;
+  virtual void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                               Handle<Name> name) = 0;
+  virtual void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                               Handle<SharedFunctionInfo> shared,
+                               Handle<Name> script_name) = 0;
+  virtual void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                               Handle<SharedFunctionInfo> shared,
+                               Handle<Name> script_name, int line,
                                int column) = 0;
   virtual void CodeCreateEvent(LogEventsAndTags tag, const wasm::WasmCode* code,
                                wasm::WasmName name) = 0;
-  virtual void CallbackEvent(Name name, Address entry_point) = 0;
-  virtual void GetterCallbackEvent(Name name, Address entry_point) = 0;
-  virtual void SetterCallbackEvent(Name name, Address entry_point) = 0;
-  virtual void RegExpCodeCreateEvent(AbstractCode code, String source) = 0;
+
+  virtual void CallbackEvent(Handle<Name> name, Address entry_point) = 0;
+  virtual void GetterCallbackEvent(Handle<Name> name, Address entry_point) = 0;
+  virtual void SetterCallbackEvent(Handle<Name> name, Address entry_point) = 0;
+  virtual void RegExpCodeCreateEvent(Handle<AbstractCode> code,
+                                     Handle<String> source) = 0;
+  // Not handlified as this happens during GC. No allocation allowed.
   virtual void CodeMoveEvent(AbstractCode from, AbstractCode to) = 0;
   virtual void SharedFunctionInfoMoveEvent(Address from, Address to) = 0;
   virtual void NativeContextMoveEvent(Address from, Address to) = 0;
   virtual void CodeMovingGCEvent() = 0;
-  virtual void CodeDisableOptEvent(AbstractCode code,
-                                   SharedFunctionInfo shared) = 0;
-  virtual void CodeDeoptEvent(Code code, DeoptimizeKind kind, Address pc,
-                              int fp_to_sp_delta) = 0;
+  virtual void CodeDisableOptEvent(Handle<AbstractCode> code,
+                                   Handle<SharedFunctionInfo> shared) = 0;
+  virtual void CodeDeoptEvent(Handle<Code> code, DeoptimizeKind kind,
+                              Address pc, int fp_to_sp_delta) = 0;
 
   virtual bool is_listening_to_code_events() { return false; }
 };
 
-class CodeEventDispatcher {
+// Dispatches code events to a set of registered listeners.
+class CodeEventDispatcher : public CodeEventListener {
  public:
   using LogEventsAndTags = CodeEventListener::LogEventsAndTags;
 
@@ -122,61 +128,98 @@ class CodeEventDispatcher {
     return false;
   }
 
-#define CODE_EVENT_DISPATCH(code)  \
-  base::MutexGuard guard(&mutex_); \
-  for (auto it = listeners_.begin(); it != listeners_.end(); ++it) (*it)->code
-
-  void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                       const char* comment) {
-    CODE_EVENT_DISPATCH(CodeCreateEvent(tag, code, comment));
-  }
-  void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code, Name name) {
-    CODE_EVENT_DISPATCH(CodeCreateEvent(tag, code, name));
-  }
-  void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                       SharedFunctionInfo shared, Name name) {
-    CODE_EVENT_DISPATCH(CodeCreateEvent(tag, code, shared, name));
+  void DispatchEventToListeners(
+      std::function<void(CodeEventListener*)> callback) {
+    base::MutexGuard guard(&mutex_);
+    for (CodeEventListener* listener : listeners_) {
+      callback(listener);
+    }
   }
-  void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                       SharedFunctionInfo shared, Name source, int line,
-                       int column) {
-    CODE_EVENT_DISPATCH(
-        CodeCreateEvent(tag, code, shared, source, line, column));
+
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       const char* comment) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->CodeCreateEvent(tag, code, comment);
+    });
+  }
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<Name> name) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->CodeCreateEvent(tag, code, name);
+    });
+  }
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<SharedFunctionInfo> shared,
+                       Handle<Name> name) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->CodeCreateEvent(tag, code, shared, name);
+    });
+  }
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<SharedFunctionInfo> shared, Handle<Name> source,
+                       int line, int column) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->CodeCreateEvent(tag, code, shared, source, line, column);
+    });
   }
   void CodeCreateEvent(LogEventsAndTags tag, const wasm::WasmCode* code,
-                       wasm::WasmName name) {
-    CODE_EVENT_DISPATCH(CodeCreateEvent(tag, code, name));
-  }
-  void CallbackEvent(Name name, Address entry_point) {
-    CODE_EVENT_DISPATCH(CallbackEvent(name, entry_point));
-  }
-  void GetterCallbackEvent(Name name, Address entry_point) {
-    CODE_EVENT_DISPATCH(GetterCallbackEvent(name, entry_point));
-  }
-  void SetterCallbackEvent(Name name, Address entry_point) {
-    CODE_EVENT_DISPATCH(SetterCallbackEvent(name, entry_point));
-  }
-  void RegExpCodeCreateEvent(AbstractCode code, String source) {
-    CODE_EVENT_DISPATCH(RegExpCodeCreateEvent(code, source));
-  }
-  void CodeMoveEvent(AbstractCode from, AbstractCode to) {
-    CODE_EVENT_DISPATCH(CodeMoveEvent(from, to));
-  }
-  void SharedFunctionInfoMoveEvent(Address from, Address to) {
-    CODE_EVENT_DISPATCH(SharedFunctionInfoMoveEvent(from, to));
-  }
-  void NativeContextMoveEvent(Address from, Address to) {
-    CODE_EVENT_DISPATCH(NativeContextMoveEvent(from, to));
-  }
-  void CodeMovingGCEvent() { CODE_EVENT_DISPATCH(CodeMovingGCEvent()); }
-  void CodeDisableOptEvent(AbstractCode code, SharedFunctionInfo shared) {
-    CODE_EVENT_DISPATCH(CodeDisableOptEvent(code, shared));
-  }
-  void CodeDeoptEvent(Code code, DeoptimizeKind kind, Address pc,
-                      int fp_to_sp_delta) {
-    CODE_EVENT_DISPATCH(CodeDeoptEvent(code, kind, pc, fp_to_sp_delta));
+                       wasm::WasmName name) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->CodeCreateEvent(tag, code, name);
+    });
+  }
+  void CallbackEvent(Handle<Name> name, Address entry_point) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->CallbackEvent(name, entry_point);
+    });
+  }
+  void GetterCallbackEvent(Handle<Name> name, Address entry_point) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->GetterCallbackEvent(name, entry_point);
+    });
+  }
+  void SetterCallbackEvent(Handle<Name> name, Address entry_point) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->SetterCallbackEvent(name, entry_point);
+    });
+  }
+  void RegExpCodeCreateEvent(Handle<AbstractCode> code,
+                             Handle<String> source) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->RegExpCodeCreateEvent(code, source);
+    });
+  }
+  void CodeMoveEvent(AbstractCode from, AbstractCode to) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->CodeMoveEvent(from, to);
+    });
+  }
+  void SharedFunctionInfoMoveEvent(Address from, Address to) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->SharedFunctionInfoMoveEvent(from, to);
+    });
+  }
+  void NativeContextMoveEvent(Address from, Address to) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->NativeContextMoveEvent(from, to);
+    });
+  }
+  void CodeMovingGCEvent() override {
+    DispatchEventToListeners(
+        [](CodeEventListener* listener) { listener->CodeMovingGCEvent(); });
+  }
+  void CodeDisableOptEvent(Handle<AbstractCode> code,
+                           Handle<SharedFunctionInfo> shared) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->CodeDisableOptEvent(code, shared);
+    });
+  }
+  void CodeDeoptEvent(Handle<Code> code, DeoptimizeKind kind, Address pc,
+                      int fp_to_sp_delta) override {
+    DispatchEventToListeners([=](CodeEventListener* listener) {
+      listener->CodeDeoptEvent(code, kind, pc, fp_to_sp_delta);
+    });
   }
-#undef CODE_EVENT_DISPATCH
 
  private:
   std::unordered_set<CodeEventListener*> listeners_;
diff --git a/deps/v8/src/logging/counters-definitions.h b/deps/v8/src/logging/counters-definitions.h
index 39317121524fb4..531d8c141188d9 100644
--- a/deps/v8/src/logging/counters-definitions.h
+++ b/deps/v8/src/logging/counters-definitions.h
@@ -94,7 +94,10 @@ namespace internal {
   /* bailout reason if Liftoff failed, or {kSuccess} (per function) */         \
   HR(liftoff_bailout_reasons, V8.LiftoffBailoutReasons, 0, 20, 21)             \
   /* Ticks observed in a single Turbofan compilation, in 1K */                 \
-  HR(turbofan_ticks, V8.TurboFan1KTicks, 0, 100000, 200)
+  HR(turbofan_ticks, V8.TurboFan1KTicks, 0, 100000, 200)                       \
+  /* Backtracks observed in a single regexp interpreter execution */           \
+  /* The maximum of 100M backtracks takes roughly 2 seconds on my machine. */  \
+  HR(regexp_backtracks, V8.RegExpBacktracks, 1, 100000000, 50)
 
 #define HISTOGRAM_TIMER_LIST(HT)                                               \
   /* Timer histograms, not thread safe: HT(name, caption, max, unit) */        \
@@ -188,8 +191,8 @@ namespace internal {
      V8.WasmCompileModuleAsyncMicroSeconds, 100000000, MICROSECOND)            \
   HT(wasm_streaming_compile_wasm_module_time,                                  \
      V8.WasmCompileModuleStreamingMicroSeconds, 100000000, MICROSECOND)        \
-  HT(wasm_streaming_deserialize_wasm_module_time,                              \
-     V8.WasmDeserializeModuleStreamingMicroSeconds, 100000000, MICROSECOND)    \
+  HT(wasm_streaming_finish_wasm_module_time,                                   \
+     V8.WasmFinishModuleStreamingMicroSeconds, 100000000, MICROSECOND)         \
   HT(wasm_tier_up_module_time, V8.WasmTierUpModuleMicroSeconds, 100000000,     \
      MICROSECOND)                                                              \
   HT(wasm_compile_asm_function_time, V8.WasmCompileFunctionMicroSeconds.asm,   \
diff --git a/deps/v8/src/logging/counters-inl.h b/deps/v8/src/logging/counters-inl.h
index 11a9d92eb2c02e..3b4acf1f93dc96 100644
--- a/deps/v8/src/logging/counters-inl.h
+++ b/deps/v8/src/logging/counters-inl.h
@@ -57,11 +57,6 @@ void RuntimeCallTimer::CommitTimeToCounter() {
 
 bool RuntimeCallTimer::IsStarted() { return start_ticks_ != base::TimeTicks(); }
 
-RuntimeCallTimerScope::RuntimeCallTimerScope(Isolate* isolate,
-                                             HeapObject heap_object,
-                                             RuntimeCallCounterId counter_id)
-    : RuntimeCallTimerScope(isolate, counter_id) {}
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/logging/counters.cc b/deps/v8/src/logging/counters.cc
index a6a56fac833d5b..03b210f4d337cc 100644
--- a/deps/v8/src/logging/counters.cc
+++ b/deps/v8/src/logging/counters.cc
@@ -125,7 +125,7 @@ Counters::Counters(Isolate* isolate)
       STATS_COUNTER_TS_LIST(SC)
 #undef SC
       // clang format on
-      runtime_call_stats_(),
+      runtime_call_stats_(RuntimeCallStats::kMainIsolateThread),
       worker_thread_runtime_call_stats_() {
   static const struct {
     Histogram Counters::*member;
@@ -426,7 +426,8 @@ void RuntimeCallTimer::Snapshot() {
   Resume(now);
 }
 
-RuntimeCallStats::RuntimeCallStats() : in_use_(false) {
+RuntimeCallStats::RuntimeCallStats(ThreadType thread_type)
+    : in_use_(false), thread_type_(thread_type) {
   static const char* const kNames[] = {
 #define CALL_BUILTIN_COUNTER(name) "GC_" #name,
       FOR_EACH_GC_COUNTER(CALL_BUILTIN_COUNTER)  //
@@ -446,12 +447,47 @@ RuntimeCallStats::RuntimeCallStats() : in_use_(false) {
 #define CALL_BUILTIN_COUNTER(name) #name,
       FOR_EACH_HANDLER_COUNTER(CALL_BUILTIN_COUNTER)  //
 #undef CALL_BUILTIN_COUNTER
+#define THREAD_SPECIFIC_COUNTER(name) #name,
+      FOR_EACH_THREAD_SPECIFIC_COUNTER(THREAD_SPECIFIC_COUNTER)  //
+#undef THREAD_SPECIFIC_COUNTER
   };
   for (int i = 0; i < kNumberOfCounters; i++) {
     this->counters_[i] = RuntimeCallCounter(kNames[i]);
   }
 }
 
+namespace {
+constexpr RuntimeCallCounterId FirstCounter(RuntimeCallCounterId first, ...) {
+  return first;
+}
+
+#define THREAD_SPECIFIC_COUNTER(name) k##name,
+constexpr RuntimeCallCounterId kFirstThreadVariantCounter =
+    FirstCounter(FOR_EACH_THREAD_SPECIFIC_COUNTER(THREAD_SPECIFIC_COUNTER) 0);
+#undef THREAD_SPECIFIC_COUNTER
+
+#define THREAD_SPECIFIC_COUNTER(name) +1
+constexpr int kThreadVariantCounterCount =
+    0 FOR_EACH_THREAD_SPECIFIC_COUNTER(THREAD_SPECIFIC_COUNTER);
+#undef THREAD_SPECIFIC_COUNTER
+
+constexpr auto kLastThreadVariantCounter = static_cast<RuntimeCallCounterId>(
+    kFirstThreadVariantCounter + kThreadVariantCounterCount - 1);
+}  // namespace
+
+bool RuntimeCallStats::HasThreadSpecificCounterVariants(
+    RuntimeCallCounterId id) {
+  // Check that it's in the range of the thread-specific variant counters and
+  // also that it's one of the background counters.
+  return id >= kFirstThreadVariantCounter && id <= kLastThreadVariantCounter;
+}
+
+bool RuntimeCallStats::IsBackgroundThreadSpecificVariant(
+    RuntimeCallCounterId id) {
+  return HasThreadSpecificCounterVariants(id) &&
+         (id - kFirstThreadVariantCounter) % 2 == 1;
+}
+
 void RuntimeCallStats::Enter(RuntimeCallTimer* timer,
                              RuntimeCallCounterId counter_id) {
   DCHECK(IsCalledOnTheSameThread());
@@ -479,9 +515,14 @@ void RuntimeCallStats::Add(RuntimeCallStats* other) {
 }
 
 // static
-void RuntimeCallStats::CorrectCurrentCounterId(
-    RuntimeCallCounterId counter_id) {
+void RuntimeCallStats::CorrectCurrentCounterId(RuntimeCallCounterId counter_id,
+                                               CounterMode mode) {
   DCHECK(IsCalledOnTheSameThread());
+  if (mode == RuntimeCallStats::CounterMode::kThreadSpecific) {
+    counter_id = CounterIdForThread(counter_id);
+  }
+  DCHECK(IsCounterAppropriateForThread(counter_id));
+
   RuntimeCallTimer* timer = current_timer();
   if (timer == nullptr) return;
   RuntimeCallCounter* counter = GetCounter(counter_id);
@@ -536,7 +577,8 @@ void RuntimeCallStats::Dump(v8::tracing::TracedValue* value) {
   in_use_ = false;
 }
 
-WorkerThreadRuntimeCallStats::WorkerThreadRuntimeCallStats() {}
+WorkerThreadRuntimeCallStats::WorkerThreadRuntimeCallStats()
+    : isolate_thread_id_(ThreadId::Current()) {}
 
 WorkerThreadRuntimeCallStats::~WorkerThreadRuntimeCallStats() {
   if (tls_key_) base::Thread::DeleteThreadLocalKey(*tls_key_);
@@ -550,8 +592,10 @@ base::Thread::LocalStorageKey WorkerThreadRuntimeCallStats::GetKey() {
 
 RuntimeCallStats* WorkerThreadRuntimeCallStats::NewTable() {
   DCHECK(TracingFlags::is_runtime_stats_enabled());
+  // Never create a new worker table on the isolate's main thread.
+  DCHECK_NE(ThreadId::Current(), isolate_thread_id_);
   std::unique_ptr<RuntimeCallStats> new_table =
-      std::make_unique<RuntimeCallStats>();
+      std::make_unique<RuntimeCallStats>(RuntimeCallStats::kWorkerThread);
   RuntimeCallStats* result = new_table.get();
 
   base::MutexGuard lock(&mutex_);
diff --git a/deps/v8/src/logging/counters.h b/deps/v8/src/logging/counters.h
index d82515efbaa11d..a2c918e4c13db2 100644
--- a/deps/v8/src/logging/counters.h
+++ b/deps/v8/src/logging/counters.h
@@ -730,6 +730,7 @@ class RuntimeCallTimer final {
   TRACER_BACKGROUND_SCOPES(V)
 
 #define FOR_EACH_API_COUNTER(V)                            \
+  V(AccessorPair_New)                                      \
   V(ArrayBuffer_Cast)                                      \
   V(ArrayBuffer_Detach)                                    \
   V(ArrayBuffer_New)                                       \
@@ -749,7 +750,7 @@ class RuntimeCallTimer final {
   V(Date_New)                                              \
   V(Date_NumberValue)                                      \
   V(Debug_Call)                                            \
-  V(debug_GetPrivateFields)                                \
+  V(debug_GetPrivateMembers)                               \
   V(Error_New)                                             \
   V(External_New)                                          \
   V(Float32Array_New)                                      \
@@ -840,6 +841,7 @@ class RuntimeCallTimer final {
   V(Proxy_New)                                             \
   V(RangeError_New)                                        \
   V(ReferenceError_New)                                    \
+  V(RegExp_Exec)                                           \
   V(RegExp_New)                                            \
   V(ScriptCompiler_Compile)                                \
   V(ScriptCompiler_CompileFunctionInContext)               \
@@ -892,6 +894,79 @@ class RuntimeCallTimer final {
   V(WeakMap_New)                                           \
   V(WeakMap_Set)
 
+#define ADD_THREAD_SPECIFIC_COUNTER(V, Prefix, Suffix) \
+  V(Prefix##Suffix)                                    \
+  V(Prefix##Background##Suffix)
+
+#define FOR_EACH_THREAD_SPECIFIC_COUNTER(V)                             \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Compile, Analyse)                      \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Compile, Eval)                         \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Compile, Function)                     \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Compile, Ignition)                     \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Compile, RewriteReturnResult)          \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Compile, ScopeAnalysis)                \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Compile, Script)                       \
+                                                                        \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, AllocateFPRegisters)         \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, AllocateGeneralRegisters)    \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, AssembleCode)                \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, AssignSpillSlots)            \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, BuildLiveRangeBundles)       \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, BuildLiveRanges)             \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, CommitAssignment)            \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, ConnectRanges)               \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, ControlFlowOptimization)     \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, CSAEarlyOptimization)        \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, CSAOptimization)             \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, DecideSpillingMode)          \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, DecompressionOptimization)   \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, EarlyOptimization)           \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, EarlyTrimming)               \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, EffectLinearization)         \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, EscapeAnalysis)              \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, FinalizeCode)                \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, FrameElision)                \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, GenericLowering)             \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, BytecodeGraphBuilder)        \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, Inlining)                    \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, JumpThreading)               \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, LateGraphTrimming)           \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, LateOptimization)            \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, LoadElimination)             \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, LocateSpillSlots)            \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, LoopExitElimination)         \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, LoopPeeling)                 \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, MachineOperatorOptimization) \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, MeetRegisterConstraints)     \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, MemoryOptimization)          \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, MergeSplinteredRanges)       \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, OptimizeMoves)               \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, PopulatePointerMaps)         \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, PrintGraph)                  \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, ResolveControlFlow)          \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, ResolvePhis)                 \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize,                              \
+                              ScheduledEffectControlLinearization)      \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, ScheduledMachineLowering)    \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, Scheduling)                  \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, SelectInstructions)          \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, SimplifiedLowering)          \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, SplinterLiveRanges)          \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, StoreStoreElimination)       \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, TypeAssertions)              \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, TypedLowering)               \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, Typer)                       \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, Untyper)                     \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, VerifyGraph)                 \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, WasmBaseOptimization)        \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, WasmFullOptimization)        \
+                                                                        \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Parse, ArrowFunctionLiteral)           \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Parse, FunctionLiteral)                \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Parse, Program)                        \
+  ADD_THREAD_SPECIFIC_COUNTER(V, PreParse, ArrowFunctionLiteral)        \
+  ADD_THREAD_SPECIFIC_COUNTER(V, PreParse, WithVariableResolution)
+
 #define FOR_EACH_MANUAL_COUNTER(V)             \
   V(AccessorGetterCallback)                    \
   V(AccessorSetterCallback)                    \
@@ -900,28 +975,14 @@ class RuntimeCallTimer final {
   V(BoundFunctionLengthGetter)                 \
   V(BoundFunctionNameGetter)                   \
   V(CodeGenerationFromStringsCallbacks)        \
-  V(CompileAnalyse)                            \
-  V(CompileBackgroundAnalyse)                  \
   V(CompileBackgroundCompileTask)              \
-  V(CompileBackgroundEval)                     \
-  V(CompileBackgroundFunction)                 \
-  V(CompileBackgroundIgnition)                 \
-  V(CompileBackgroundRewriteReturnResult)      \
-  V(CompileBackgroundScopeAnalysis)            \
-  V(CompileBackgroundScript)                   \
   V(CompileCollectSourcePositions)             \
   V(CompileDeserialize)                        \
   V(CompileEnqueueOnDispatcher)                \
-  V(CompileEval)                               \
   V(CompileFinalizeBackgroundCompileTask)      \
   V(CompileFinishNowOnDispatcher)              \
-  V(CompileFunction)                           \
   V(CompileGetFromOptimizedCodeMap)            \
-  V(CompileIgnition)                           \
   V(CompileIgnitionFinalization)               \
-  V(CompileRewriteReturnResult)                \
-  V(CompileScopeAnalysis)                      \
-  V(CompileScript)                             \
   V(CompileSerialize)                          \
   V(CompileWaitForDispatcher)                  \
   V(DeoptimizeCode)                            \
@@ -962,25 +1023,21 @@ class RuntimeCallTimer final {
   V(NamedSetterCallback)                       \
   V(Object_DeleteProperty)                     \
   V(ObjectVerify)                              \
+  V(OptimizeBackgroundDispatcherJob)           \
   V(OptimizeCode)                              \
-  V(ParseArrowFunctionLiteral)                 \
-  V(ParseBackgroundArrowFunctionLiteral)       \
-  V(ParseBackgroundFunctionLiteral)            \
-  V(ParseBackgroundProgram)                    \
+  V(OptimizeConcurrentPrepare)                 \
+  V(OptimizeConcurrentFinalize)                \
+  V(OptimizeFinalizePipelineJob)               \
+  V(OptimizeHeapBrokerInitialization)          \
+  V(OptimizeNonConcurrent)                     \
+  V(OptimizeSerialization)                     \
+  V(OptimizeSerializeMetadata)                 \
   V(ParseEval)                                 \
   V(ParseFunction)                             \
-  V(ParseFunctionLiteral)                      \
-  V(ParseProgram)                              \
-  V(PreParseArrowFunctionLiteral)              \
-  V(PreParseBackgroundArrowFunctionLiteral)    \
-  V(PreParseBackgroundWithVariableResolution)  \
-  V(PreParseWithVariableResolution)            \
   V(PropertyCallback)                          \
   V(PrototypeMap_TransitionToAccessorProperty) \
   V(PrototypeMap_TransitionToDataProperty)     \
   V(PrototypeObject_DeleteProperty)            \
-  V(RecompileConcurrent)                       \
-  V(RecompileSynchronous)                      \
   V(ReconfigureToDataProperty)                 \
   V(StringLengthGetter)                        \
   V(TestCounter1)                              \
@@ -1045,29 +1102,39 @@ class RuntimeCallTimer final {
 
 enum RuntimeCallCounterId {
 #define CALL_RUNTIME_COUNTER(name) kGC_##name,
-  FOR_EACH_GC_COUNTER(CALL_RUNTIME_COUNTER)
+  FOR_EACH_GC_COUNTER(CALL_RUNTIME_COUNTER)  //
 #undef CALL_RUNTIME_COUNTER
 #define CALL_RUNTIME_COUNTER(name) k##name,
-      FOR_EACH_MANUAL_COUNTER(CALL_RUNTIME_COUNTER)
+  FOR_EACH_MANUAL_COUNTER(CALL_RUNTIME_COUNTER)  //
 #undef CALL_RUNTIME_COUNTER
 #define CALL_RUNTIME_COUNTER(name, nargs, ressize) kRuntime_##name,
-          FOR_EACH_INTRINSIC(CALL_RUNTIME_COUNTER)
+  FOR_EACH_INTRINSIC(CALL_RUNTIME_COUNTER)  //
 #undef CALL_RUNTIME_COUNTER
 #define CALL_BUILTIN_COUNTER(name) kBuiltin_##name,
-              BUILTIN_LIST_C(CALL_BUILTIN_COUNTER)
+  BUILTIN_LIST_C(CALL_BUILTIN_COUNTER)  //
 #undef CALL_BUILTIN_COUNTER
 #define CALL_BUILTIN_COUNTER(name) kAPI_##name,
-                  FOR_EACH_API_COUNTER(CALL_BUILTIN_COUNTER)
+  FOR_EACH_API_COUNTER(CALL_BUILTIN_COUNTER)  //
 #undef CALL_BUILTIN_COUNTER
 #define CALL_BUILTIN_COUNTER(name) kHandler_##name,
-                      FOR_EACH_HANDLER_COUNTER(CALL_BUILTIN_COUNTER)
+  FOR_EACH_HANDLER_COUNTER(CALL_BUILTIN_COUNTER)  //
 #undef CALL_BUILTIN_COUNTER
-                          kNumberOfCounters
+#define THREAD_SPECIFIC_COUNTER(name) k##name,
+  FOR_EACH_THREAD_SPECIFIC_COUNTER(THREAD_SPECIFIC_COUNTER)  //
+#undef THREAD_SPECIFIC_COUNTER
+  kNumberOfCounters,
 };
 
 class RuntimeCallStats final {
  public:
-  V8_EXPORT_PRIVATE RuntimeCallStats();
+  enum ThreadType { kMainIsolateThread, kWorkerThread };
+
+  // If kExact is chosen the counter will be use as given. With kThreadSpecific,
+  // if the RuntimeCallStats was created for a worker thread, then the
+  // background specific version of the counter will be used instead.
+  enum CounterMode { kExact, kThreadSpecific };
+
+  explicit V8_EXPORT_PRIVATE RuntimeCallStats(ThreadType thread_type);
 
   // Starting measuring the time for a function. This will establish the
   // connection to the parent counter for properly calculating the own times.
@@ -1082,7 +1149,7 @@ class RuntimeCallStats final {
   // Set counter id for the innermost measurement. It can be used to refine
   // event kind when a runtime entry counter is too generic.
   V8_EXPORT_PRIVATE void CorrectCurrentCounterId(
-      RuntimeCallCounterId counter_id);
+      RuntimeCallCounterId counter_id, CounterMode mode = kExact);
 
   V8_EXPORT_PRIVATE void Reset();
   // Add all entries from another stats object.
@@ -1097,6 +1164,32 @@ class RuntimeCallStats final {
   bool InUse() { return in_use_; }
   bool IsCalledOnTheSameThread();
 
+  V8_EXPORT_PRIVATE bool IsBackgroundThreadSpecificVariant(
+      RuntimeCallCounterId id);
+  V8_EXPORT_PRIVATE bool HasThreadSpecificCounterVariants(
+      RuntimeCallCounterId id);
+
+  // This should only be called for counters with a dual Background variant. If
+  // on the main thread, this just returns the counter. If on a worker thread,
+  // it returns Background variant of the counter.
+  RuntimeCallCounterId CounterIdForThread(RuntimeCallCounterId id) {
+    DCHECK(HasThreadSpecificCounterVariants(id));
+    // All thread specific counters are laid out with the main thread variant
+    // first followed by the background variant.
+    return thread_type_ == kWorkerThread
+               ? static_cast<RuntimeCallCounterId>(id + 1)
+               : id;
+  }
+
+  bool IsCounterAppropriateForThread(RuntimeCallCounterId id) {
+    // TODO(delphick): We should add background-only counters and ensure that
+    // all counters (not just the thread-specific variants) are only invoked on
+    // the correct thread.
+    if (!HasThreadSpecificCounterVariants(id)) return true;
+    return IsBackgroundThreadSpecificVariant(id) ==
+           (thread_type_ == kWorkerThread);
+  }
+
   static const int kNumberOfCounters =
       static_cast<int>(RuntimeCallCounterId::kNumberOfCounters);
   RuntimeCallCounter* GetCounter(RuntimeCallCounterId counter_id) {
@@ -1113,6 +1206,7 @@ class RuntimeCallStats final {
   base::AtomicValue<RuntimeCallCounter*> current_counter_;
   // Used to track nested tracing scopes.
   bool in_use_;
+  ThreadType thread_type_;
   ThreadId thread_id_;
   RuntimeCallCounter counters_[kNumberOfCounters];
 };
@@ -1136,6 +1230,10 @@ class WorkerThreadRuntimeCallStats final {
   base::Mutex mutex_;
   std::vector<std::unique_ptr<RuntimeCallStats>> tables_;
   base::Optional<base::Thread::LocalStorageKey> tls_key_;
+  // Since this is for creating worker thread runtime-call stats, record the
+  // main thread ID to ensure we never create a worker RCS table for the main
+  // thread.
+  ThreadId isolate_thread_id_;
 };
 
 // Creating a WorkerThreadRuntimeCallStatsScope will provide a thread-local
@@ -1172,16 +1270,20 @@ class RuntimeCallTimerScope {
  public:
   inline RuntimeCallTimerScope(Isolate* isolate,
                                RuntimeCallCounterId counter_id);
-  // This constructor is here just to avoid calling GetIsolate() when the
-  // stats are disabled and the isolate is not directly available.
-  inline RuntimeCallTimerScope(Isolate* isolate, HeapObject heap_object,
-                               RuntimeCallCounterId counter_id);
   inline RuntimeCallTimerScope(RuntimeCallStats* stats,
-                               RuntimeCallCounterId counter_id) {
+                               RuntimeCallCounterId counter_id,
+                               RuntimeCallStats::CounterMode mode =
+                                   RuntimeCallStats::CounterMode::kExact) {
     if (V8_LIKELY(!TracingFlags::is_runtime_stats_enabled() ||
-                  stats == nullptr))
+                  stats == nullptr)) {
       return;
+    }
     stats_ = stats;
+    if (mode == RuntimeCallStats::CounterMode::kThreadSpecific) {
+      counter_id = stats->CounterIdForThread(counter_id);
+    }
+
+    DCHECK(stats->IsCounterAppropriateForThread(counter_id));
     stats_->Enter(&timer_, counter_id);
   }
 
diff --git a/deps/v8/src/logging/log-utils.cc b/deps/v8/src/logging/log-utils.cc
index e5c0b027faabbd..8d21d5f32975a3 100644
--- a/deps/v8/src/logging/log-utils.cc
+++ b/deps/v8/src/logging/log-utils.cc
@@ -157,9 +157,9 @@ void Log::MessageBuilder::AppendSymbolName(Symbol symbol) {
   DCHECK(!symbol.is_null());
   OFStream& os = log_->os_;
   os << "symbol(";
-  if (!symbol.name().IsUndefined()) {
+  if (!symbol.description().IsUndefined()) {
     os << "\"";
-    AppendSymbolNameDetails(String::cast(symbol.name()), false);
+    AppendSymbolNameDetails(String::cast(symbol.description()), false);
     os << "\" ";
   }
   os << "hash " << std::hex << symbol.Hash() << std::dec << ")";
diff --git a/deps/v8/src/logging/log.cc b/deps/v8/src/logging/log.cc
index 2befcd330abc92..0343db987f267a 100644
--- a/deps/v8/src/logging/log.cc
+++ b/deps/v8/src/logging/log.cc
@@ -100,7 +100,7 @@ class CodeEventLogger::NameBuffer {
 
   void Reset() { utf8_pos_ = 0; }
 
-  void Init(CodeEventListener::LogEventsAndTags tag) {
+  void Init(LogEventsAndTags tag) {
     Reset();
     AppendBytes(kLogEventsNames[tag]);
     AppendByte(':');
@@ -112,9 +112,9 @@ class CodeEventLogger::NameBuffer {
     } else {
       Symbol symbol = Symbol::cast(name);
       AppendBytes("symbol(");
-      if (!symbol.name().IsUndefined()) {
+      if (!symbol.description().IsUndefined()) {
         AppendBytes("\"");
-        AppendString(String::cast(symbol.name()));
+        AppendString(String::cast(symbol.description()));
         AppendBytes("\" ");
       }
       AppendBytes("hash ");
@@ -184,45 +184,49 @@ CodeEventLogger::CodeEventLogger(Isolate* isolate)
 
 CodeEventLogger::~CodeEventLogger() = default;
 
-void CodeEventLogger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                                      AbstractCode code, const char* comment) {
+void CodeEventLogger::CodeCreateEvent(LogEventsAndTags tag,
+                                      Handle<AbstractCode> code,
+                                      const char* comment) {
   name_buffer_->Init(tag);
   name_buffer_->AppendBytes(comment);
-  LogRecordedBuffer(code, SharedFunctionInfo(), name_buffer_->get(),
-                    name_buffer_->size());
+  LogRecordedBuffer(code, MaybeHandle<SharedFunctionInfo>(),
+                    name_buffer_->get(), name_buffer_->size());
 }
 
-void CodeEventLogger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                                      AbstractCode code, Name name) {
+void CodeEventLogger::CodeCreateEvent(LogEventsAndTags tag,
+                                      Handle<AbstractCode> code,
+                                      Handle<Name> name) {
   name_buffer_->Init(tag);
-  name_buffer_->AppendName(name);
-  LogRecordedBuffer(code, SharedFunctionInfo(), name_buffer_->get(),
-                    name_buffer_->size());
+  name_buffer_->AppendName(*name);
+  LogRecordedBuffer(code, MaybeHandle<SharedFunctionInfo>(),
+                    name_buffer_->get(), name_buffer_->size());
 }
 
-void CodeEventLogger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                                      AbstractCode code,
-                                      SharedFunctionInfo shared, Name name) {
+void CodeEventLogger::CodeCreateEvent(LogEventsAndTags tag,
+                                      Handle<AbstractCode> code,
+                                      Handle<SharedFunctionInfo> shared,
+                                      Handle<Name> script_name) {
   name_buffer_->Init(tag);
-  name_buffer_->AppendBytes(ComputeMarker(shared, code));
+  name_buffer_->AppendBytes(ComputeMarker(*shared, *code));
   name_buffer_->AppendByte(' ');
-  name_buffer_->AppendName(name);
+  name_buffer_->AppendName(*script_name);
   LogRecordedBuffer(code, shared, name_buffer_->get(), name_buffer_->size());
 }
 
-void CodeEventLogger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                                      AbstractCode code,
-                                      SharedFunctionInfo shared, Name source,
-                                      int line, int column) {
+void CodeEventLogger::CodeCreateEvent(LogEventsAndTags tag,
+                                      Handle<AbstractCode> code,
+                                      Handle<SharedFunctionInfo> shared,
+                                      Handle<Name> script_name, int line,
+                                      int column) {
   name_buffer_->Init(tag);
-  name_buffer_->AppendBytes(ComputeMarker(shared, code));
-  name_buffer_->AppendString(shared.DebugName());
+  name_buffer_->AppendBytes(ComputeMarker(*shared, *code));
+  name_buffer_->AppendString(shared->DebugName());
   name_buffer_->AppendByte(' ');
-  if (source.IsString()) {
-    name_buffer_->AppendString(String::cast(source));
+  if (script_name->IsString()) {
+    name_buffer_->AppendString(String::cast(*script_name));
   } else {
     name_buffer_->AppendBytes("symbol(hash ");
-    name_buffer_->AppendHex(Name::cast(source).Hash());
+    name_buffer_->AppendHex(Name::cast(*script_name).Hash());
     name_buffer_->AppendByte(')');
   }
   name_buffer_->AppendByte(':');
@@ -235,7 +239,7 @@ void CodeEventLogger::CodeCreateEvent(LogEventsAndTags tag,
                                       wasm::WasmName name) {
   name_buffer_->Init(tag);
   if (name.empty()) {
-    name_buffer_->AppendBytes("<wasm-unknown>");
+    name_buffer_->AppendBytes("<wasm-unnamed>");
   } else {
     name_buffer_->AppendBytes(name.begin(), name.length());
   }
@@ -245,28 +249,33 @@ void CodeEventLogger::CodeCreateEvent(LogEventsAndTags tag,
   } else {
     name_buffer_->AppendInt(code->index());
   }
+  name_buffer_->AppendByte('-');
+  name_buffer_->AppendBytes(ExecutionTierToString(code->tier()));
   LogRecordedBuffer(code, name_buffer_->get(), name_buffer_->size());
 }
 
-void CodeEventLogger::RegExpCodeCreateEvent(AbstractCode code, String source) {
+void CodeEventLogger::RegExpCodeCreateEvent(Handle<AbstractCode> code,
+                                            Handle<String> source) {
   name_buffer_->Init(CodeEventListener::REG_EXP_TAG);
-  name_buffer_->AppendString(source);
-  LogRecordedBuffer(code, SharedFunctionInfo(), name_buffer_->get(),
-                    name_buffer_->size());
+  name_buffer_->AppendString(*source);
+  LogRecordedBuffer(code, MaybeHandle<SharedFunctionInfo>(),
+                    name_buffer_->get(), name_buffer_->size());
 }
 
-// Linux perf tool logging support
+// Linux perf tool logging support.
+#if V8_OS_LINUX
 class PerfBasicLogger : public CodeEventLogger {
  public:
   explicit PerfBasicLogger(Isolate* isolate);
   ~PerfBasicLogger() override;
 
   void CodeMoveEvent(AbstractCode from, AbstractCode to) override {}
-  void CodeDisableOptEvent(AbstractCode code,
-                           SharedFunctionInfo shared) override {}
+  void CodeDisableOptEvent(Handle<AbstractCode> code,
+                           Handle<SharedFunctionInfo> shared) override {}
 
  private:
-  void LogRecordedBuffer(AbstractCode code, SharedFunctionInfo shared,
+  void LogRecordedBuffer(Handle<AbstractCode> code,
+                         MaybeHandle<SharedFunctionInfo> maybe_shared,
                          const char* name, int length) override;
   void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
                          int length) override;
@@ -316,17 +325,18 @@ void PerfBasicLogger::WriteLogRecordedBuffer(uintptr_t address, int size,
                    size, name_length, name);
 }
 
-void PerfBasicLogger::LogRecordedBuffer(AbstractCode code, SharedFunctionInfo,
+void PerfBasicLogger::LogRecordedBuffer(Handle<AbstractCode> code,
+                                        MaybeHandle<SharedFunctionInfo>,
                                         const char* name, int length) {
   if (FLAG_perf_basic_prof_only_functions &&
-      (code.kind() != AbstractCode::INTERPRETED_FUNCTION &&
-       code.kind() != AbstractCode::BUILTIN &&
-       code.kind() != AbstractCode::OPTIMIZED_FUNCTION)) {
+      (code->kind() != AbstractCode::INTERPRETED_FUNCTION &&
+       code->kind() != AbstractCode::BUILTIN &&
+       code->kind() != AbstractCode::OPTIMIZED_FUNCTION)) {
     return;
   }
 
-  WriteLogRecordedBuffer(static_cast<uintptr_t>(code.InstructionStart()),
-                         code.InstructionSize(), name, length);
+  WriteLogRecordedBuffer(static_cast<uintptr_t>(code->InstructionStart()),
+                         code->InstructionSize(), name, length);
 }
 
 void PerfBasicLogger::LogRecordedBuffer(const wasm::WasmCode* code,
@@ -334,6 +344,7 @@ void PerfBasicLogger::LogRecordedBuffer(const wasm::WasmCode* code,
   WriteLogRecordedBuffer(static_cast<uintptr_t>(code->instruction_start()),
                          code->instructions().length(), name, length);
 }
+#endif  // V8_OS_LINUX
 
 // External CodeEventListener
 ExternalCodeEventListener::ExternalCodeEventListener(Isolate* isolate)
@@ -373,13 +384,13 @@ void ExternalCodeEventListener::StopListening() {
   is_listening_ = false;
 }
 
-void ExternalCodeEventListener::CodeCreateEvent(
-    CodeEventListener::LogEventsAndTags tag, AbstractCode code,
-    const char* comment) {
+void ExternalCodeEventListener::CodeCreateEvent(LogEventsAndTags tag,
+                                                Handle<AbstractCode> code,
+                                                const char* comment) {
   CodeEvent code_event;
   code_event.code_start_address =
-      static_cast<uintptr_t>(code.InstructionStart());
-  code_event.code_size = static_cast<size_t>(code.InstructionSize());
+      static_cast<uintptr_t>(code->InstructionStart());
+  code_event.code_size = static_cast<size_t>(code->InstructionSize());
   code_event.function_name = isolate_->factory()->empty_string();
   code_event.script_name = isolate_->factory()->empty_string();
   code_event.script_line = 0;
@@ -390,16 +401,16 @@ void ExternalCodeEventListener::CodeCreateEvent(
   code_event_handler_->Handle(reinterpret_cast<v8::CodeEvent*>(&code_event));
 }
 
-void ExternalCodeEventListener::CodeCreateEvent(
-    CodeEventListener::LogEventsAndTags tag, AbstractCode code, Name name) {
+void ExternalCodeEventListener::CodeCreateEvent(LogEventsAndTags tag,
+                                                Handle<AbstractCode> code,
+                                                Handle<Name> name) {
   Handle<String> name_string =
-      Name::ToFunctionName(isolate_, Handle<Name>(name, isolate_))
-          .ToHandleChecked();
+      Name::ToFunctionName(isolate_, name).ToHandleChecked();
 
   CodeEvent code_event;
   code_event.code_start_address =
-      static_cast<uintptr_t>(code.InstructionStart());
-  code_event.code_size = static_cast<size_t>(code.InstructionSize());
+      static_cast<uintptr_t>(code->InstructionStart());
+  code_event.code_size = static_cast<size_t>(code->InstructionSize());
   code_event.function_name = name_string;
   code_event.script_name = isolate_->factory()->empty_string();
   code_event.script_line = 0;
@@ -411,16 +422,15 @@ void ExternalCodeEventListener::CodeCreateEvent(
 }
 
 void ExternalCodeEventListener::CodeCreateEvent(
-    CodeEventListener::LogEventsAndTags tag, AbstractCode code,
-    SharedFunctionInfo shared, Name name) {
+    LogEventsAndTags tag, Handle<AbstractCode> code,
+    Handle<SharedFunctionInfo> shared, Handle<Name> name) {
   Handle<String> name_string =
-      Name::ToFunctionName(isolate_, Handle<Name>(name, isolate_))
-          .ToHandleChecked();
+      Name::ToFunctionName(isolate_, name).ToHandleChecked();
 
   CodeEvent code_event;
   code_event.code_start_address =
-      static_cast<uintptr_t>(code.InstructionStart());
-  code_event.code_size = static_cast<size_t>(code.InstructionSize());
+      static_cast<uintptr_t>(code->InstructionStart());
+  code_event.code_size = static_cast<size_t>(code->InstructionSize());
   code_event.function_name = name_string;
   code_event.script_name = isolate_->factory()->empty_string();
   code_event.script_line = 0;
@@ -432,19 +442,19 @@ void ExternalCodeEventListener::CodeCreateEvent(
 }
 
 void ExternalCodeEventListener::CodeCreateEvent(
-    CodeEventListener::LogEventsAndTags tag, AbstractCode code,
-    SharedFunctionInfo shared, Name source, int line, int column) {
+    LogEventsAndTags tag, Handle<AbstractCode> code,
+    Handle<SharedFunctionInfo> shared, Handle<Name> source, int line,
+    int column) {
   Handle<String> name_string =
-      Name::ToFunctionName(isolate_, Handle<Name>(shared.Name(), isolate_))
+      Name::ToFunctionName(isolate_, handle(shared->Name(), isolate_))
           .ToHandleChecked();
   Handle<String> source_string =
-      Name::ToFunctionName(isolate_, Handle<Name>(source, isolate_))
-          .ToHandleChecked();
+      Name::ToFunctionName(isolate_, source).ToHandleChecked();
 
   CodeEvent code_event;
   code_event.code_start_address =
-      static_cast<uintptr_t>(code.InstructionStart());
-  code_event.code_size = static_cast<size_t>(code.InstructionSize());
+      static_cast<uintptr_t>(code->InstructionStart());
+  code_event.code_size = static_cast<size_t>(code->InstructionSize());
   code_event.function_name = name_string;
   code_event.script_name = source_string;
   code_event.script_line = line;
@@ -461,13 +471,13 @@ void ExternalCodeEventListener::CodeCreateEvent(LogEventsAndTags tag,
   // TODO(mmarchini): handle later
 }
 
-void ExternalCodeEventListener::RegExpCodeCreateEvent(AbstractCode code,
-                                                      String source) {
+void ExternalCodeEventListener::RegExpCodeCreateEvent(Handle<AbstractCode> code,
+                                                      Handle<String> source) {
   CodeEvent code_event;
   code_event.code_start_address =
-      static_cast<uintptr_t>(code.InstructionStart());
-  code_event.code_size = static_cast<size_t>(code.InstructionSize());
-  code_event.function_name = Handle<String>(source, isolate_);
+      static_cast<uintptr_t>(code->InstructionStart());
+  code_event.code_size = static_cast<size_t>(code->InstructionSize());
+  code_event.function_name = source;
   code_event.script_name = isolate_->factory()->empty_string();
   code_event.script_line = 0;
   code_event.script_column = 0;
@@ -501,13 +511,14 @@ class LowLevelLogger : public CodeEventLogger {
   ~LowLevelLogger() override;
 
   void CodeMoveEvent(AbstractCode from, AbstractCode to) override;
-  void CodeDisableOptEvent(AbstractCode code,
-                           SharedFunctionInfo shared) override {}
+  void CodeDisableOptEvent(Handle<AbstractCode> code,
+                           Handle<SharedFunctionInfo> shared) override {}
   void SnapshotPositionEvent(HeapObject obj, int pos);
   void CodeMovingGCEvent() override;
 
  private:
-  void LogRecordedBuffer(AbstractCode code, SharedFunctionInfo shared,
+  void LogRecordedBuffer(Handle<AbstractCode> code,
+                         MaybeHandle<SharedFunctionInfo> maybe_shared,
                          const char* name, int length) override;
   void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
                          int length) override;
@@ -588,16 +599,17 @@ void LowLevelLogger::LogCodeInfo() {
   LogWriteBytes(arch, sizeof(arch));
 }
 
-void LowLevelLogger::LogRecordedBuffer(AbstractCode code, SharedFunctionInfo,
+void LowLevelLogger::LogRecordedBuffer(Handle<AbstractCode> code,
+                                       MaybeHandle<SharedFunctionInfo>,
                                        const char* name, int length) {
   CodeCreateStruct event;
   event.name_size = length;
-  event.code_address = code.InstructionStart();
-  event.code_size = code.InstructionSize();
+  event.code_address = code->InstructionStart();
+  event.code_size = code->InstructionSize();
   LogWriteStruct(event);
   LogWriteBytes(name, length);
-  LogWriteBytes(reinterpret_cast<const char*>(code.InstructionStart()),
-                code.InstructionSize());
+  LogWriteBytes(reinterpret_cast<const char*>(code->InstructionStart()),
+                code->InstructionSize());
 }
 
 void LowLevelLogger::LogRecordedBuffer(const wasm::WasmCode* code,
@@ -636,8 +648,8 @@ class JitLogger : public CodeEventLogger {
   JitLogger(Isolate* isolate, JitCodeEventHandler code_event_handler);
 
   void CodeMoveEvent(AbstractCode from, AbstractCode to) override;
-  void CodeDisableOptEvent(AbstractCode code,
-                           SharedFunctionInfo shared) override {}
+  void CodeDisableOptEvent(Handle<AbstractCode> code,
+                           Handle<SharedFunctionInfo> shared) override {}
   void AddCodeLinePosInfoEvent(void* jit_handler_data, int pc_offset,
                                int position,
                                JitCodeEvent::PositionType position_type);
@@ -646,7 +658,8 @@ class JitLogger : public CodeEventLogger {
   void EndCodePosInfoEvent(Address start_address, void* jit_handler_data);
 
  private:
-  void LogRecordedBuffer(AbstractCode code, SharedFunctionInfo shared,
+  void LogRecordedBuffer(Handle<AbstractCode> code,
+                         MaybeHandle<SharedFunctionInfo> maybe_shared,
                          const char* name, int length) override;
   void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
                          int length) override;
@@ -658,21 +671,22 @@ class JitLogger : public CodeEventLogger {
 JitLogger::JitLogger(Isolate* isolate, JitCodeEventHandler code_event_handler)
     : CodeEventLogger(isolate), code_event_handler_(code_event_handler) {}
 
-void JitLogger::LogRecordedBuffer(AbstractCode code, SharedFunctionInfo shared,
+void JitLogger::LogRecordedBuffer(Handle<AbstractCode> code,
+                                  MaybeHandle<SharedFunctionInfo> maybe_shared,
                                   const char* name, int length) {
   JitCodeEvent event;
   memset(static_cast<void*>(&event), 0, sizeof(event));
   event.type = JitCodeEvent::CODE_ADDED;
-  event.code_start = reinterpret_cast<void*>(code.InstructionStart());
+  event.code_start = reinterpret_cast<void*>(code->InstructionStart());
   event.code_type =
-      code.IsCode() ? JitCodeEvent::JIT_CODE : JitCodeEvent::BYTE_CODE;
-  event.code_len = code.InstructionSize();
-  Handle<SharedFunctionInfo> shared_function_handle;
-  if (!shared.is_null() && shared.script().IsScript()) {
-    shared_function_handle =
-        Handle<SharedFunctionInfo>(shared, shared.GetIsolate());
-  }
-  event.script = ToApiHandle<v8::UnboundScript>(shared_function_handle);
+      code->IsCode() ? JitCodeEvent::JIT_CODE : JitCodeEvent::BYTE_CODE;
+  event.code_len = code->InstructionSize();
+  Handle<SharedFunctionInfo> shared;
+  if (maybe_shared.ToHandle(&shared) && shared->script().IsScript()) {
+    event.script = ToApiHandle<v8::UnboundScript>(shared);
+  } else {
+    event.script = Local<v8::UnboundScript>();
+  }
   event.name.str = name;
   event.name.len = length;
   event.isolate = reinterpret_cast<v8::Isolate*>(isolate_);
@@ -690,6 +704,42 @@ void JitLogger::LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
   event.name.str = name;
   event.name.len = length;
   event.isolate = reinterpret_cast<v8::Isolate*>(isolate_);
+
+  wasm::WasmModuleSourceMap* source_map =
+      code->native_module()->GetWasmSourceMap();
+  wasm::WireBytesRef code_ref =
+      code->native_module()->module()->functions[code->index()].code;
+  uint32_t code_offset = code_ref.offset();
+  uint32_t code_end_offset = code_ref.end_offset();
+
+  std::vector<v8::JitCodeEvent::line_info_t> mapping_info;
+  std::string filename;
+  std::unique_ptr<JitCodeEvent::wasm_source_info_t> wasm_source_info;
+
+  if (source_map && source_map->IsValid() &&
+      source_map->HasSource(code_offset, code_end_offset)) {
+    size_t last_line_number = 0;
+
+    for (SourcePositionTableIterator iterator(code->source_positions());
+         !iterator.done(); iterator.Advance()) {
+      uint32_t offset = iterator.source_position().ScriptOffset() + code_offset;
+      if (!source_map->HasValidEntry(code_offset, offset)) continue;
+      if (filename.empty()) {
+        filename = source_map->GetFilename(offset);
+      }
+      mapping_info.push_back({static_cast<size_t>(iterator.code_offset()),
+                              last_line_number, JitCodeEvent::POSITION});
+      last_line_number = source_map->GetSourceLine(offset) + 1;
+    }
+
+    wasm_source_info = std::make_unique<JitCodeEvent::wasm_source_info_t>();
+    wasm_source_info->filename = filename.c_str();
+    wasm_source_info->filename_size = filename.size();
+    wasm_source_info->line_number_table_size = mapping_info.size();
+    wasm_source_info->line_number_table = mapping_info.data();
+
+    event.wasm_source_info = wasm_source_info.get();
+  }
   code_event_handler_(&event);
 }
 
@@ -813,9 +863,9 @@ class Profiler : public base::Thread {
   // Cyclic buffer for communicating profiling samples
   // between the signal handler and the worker thread.
   static const int kBufferSize = 128;
-  TickSample buffer_[kBufferSize];      // Buffer storage.
-  int head_;                            // Index to the buffer head.
-  base::Atomic32 tail_;                 // Index to the buffer tail.
+  TickSample buffer_[kBufferSize];  // Buffer storage.
+  int head_;                        // Index to the buffer head.
+  base::Atomic32 tail_;             // Index to the buffer tail.
   bool overflow_;  // Tell whether a buffer overflow has occurred.
   // Semaphore used for buffer synchronization.
   base::Semaphore buffer_semaphore_;
@@ -999,33 +1049,6 @@ void Logger::SharedLibraryEvent(const std::string& library_path,
   msg.WriteToLogFile();
 }
 
-void Logger::CodeDeoptEvent(Code code, DeoptimizeKind kind, Address pc,
-                            int fp_to_sp_delta) {
-  if (!log_->IsEnabled()) return;
-  Deoptimizer::DeoptInfo info = Deoptimizer::GetDeoptInfo(code, pc);
-  Log::MessageBuilder msg(log_.get());
-  msg << "code-deopt" << kNext << timer_.Elapsed().InMicroseconds() << kNext
-      << code.CodeSize() << kNext
-      << reinterpret_cast<void*>(code.InstructionStart());
-
-  // Deoptimization position.
-  std::ostringstream deopt_location;
-  int inlining_id = -1;
-  int script_offset = -1;
-  if (info.position.IsKnown()) {
-    info.position.Print(deopt_location, code);
-    inlining_id = info.position.InliningId();
-    script_offset = info.position.ScriptOffset();
-  } else {
-    deopt_location << "<unknown>";
-  }
-  msg << kNext << inlining_id << kNext << script_offset << kNext;
-  msg << Deoptimizer::MessageFor(kind) << kNext;
-  msg << deopt_location.str().c_str() << kNext
-      << DeoptimizeReasonToString(info.deopt_reason);
-  msg.WriteToLogFile();
-}
-
 void Logger::CurrentTimeEvent() {
   if (!log_->IsEnabled()) return;
   DCHECK(FLAG_log_internal_timer_events);
@@ -1112,30 +1135,6 @@ void Logger::DeleteEvent(const char* name, void* object) {
   msg.WriteToLogFile();
 }
 
-void Logger::CallbackEventInternal(const char* prefix, Name name,
-                                   Address entry_point) {
-  if (!FLAG_log_code || !log_->IsEnabled()) return;
-  Log::MessageBuilder msg(log_.get());
-  msg << kLogEventsNames[CodeEventListener::CODE_CREATION_EVENT] << kNext
-      << kLogEventsNames[CodeEventListener::CALLBACK_TAG] << kNext << -2
-      << kNext << timer_.Elapsed().InMicroseconds() << kNext
-      << reinterpret_cast<void*>(entry_point) << kNext << 1 << kNext << prefix
-      << name;
-  msg.WriteToLogFile();
-}
-
-void Logger::CallbackEvent(Name name, Address entry_point) {
-  CallbackEventInternal("", name, entry_point);
-}
-
-void Logger::GetterCallbackEvent(Name name, Address entry_point) {
-  CallbackEventInternal("get ", name, entry_point);
-}
-
-void Logger::SetterCallbackEvent(Name name, Address entry_point) {
-  CallbackEventInternal("set ", name, entry_point);
-}
-
 namespace {
 
 void AppendCodeCreateHeader(
@@ -1160,86 +1159,62 @@ void AppendCodeCreateHeader(
 
 }  // namespace
 
-void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                             AbstractCode code, const char* comment) {
+void Logger::CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                             const char* name) {
   if (!is_listening_to_code_events()) return;
   if (!FLAG_log_code || !log_->IsEnabled()) return;
   Log::MessageBuilder msg(log_.get());
-  AppendCodeCreateHeader(msg, tag, code, &timer_);
-  msg << comment;
+  AppendCodeCreateHeader(msg, tag, *code, &timer_);
+  msg << name;
   msg.WriteToLogFile();
 }
 
-void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                             AbstractCode code, Name name) {
+void Logger::CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                             Handle<Name> name) {
   if (!is_listening_to_code_events()) return;
   if (!FLAG_log_code || !log_->IsEnabled()) return;
   Log::MessageBuilder msg(log_.get());
-  AppendCodeCreateHeader(msg, tag, code, &timer_);
-  msg << name;
+  AppendCodeCreateHeader(msg, tag, *code, &timer_);
+  msg << *name;
   msg.WriteToLogFile();
 }
 
-void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                             AbstractCode code, SharedFunctionInfo shared,
-                             Name name) {
+void Logger::CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                             Handle<SharedFunctionInfo> shared,
+                             Handle<Name> script_name) {
   if (!is_listening_to_code_events()) return;
   if (!FLAG_log_code || !log_->IsEnabled()) return;
-  if (code == AbstractCode::cast(
-                  isolate_->builtins()->builtin(Builtins::kCompileLazy))) {
+  if (*code == AbstractCode::cast(
+                   isolate_->builtins()->builtin(Builtins::kCompileLazy))) {
     return;
   }
 
   Log::MessageBuilder msg(log_.get());
-  AppendCodeCreateHeader(msg, tag, code, &timer_);
-  msg << name << kNext << reinterpret_cast<void*>(shared.address()) << kNext
-      << ComputeMarker(shared, code);
-  msg.WriteToLogFile();
-}
-
-void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                             const wasm::WasmCode* code, wasm::WasmName name) {
-  if (!is_listening_to_code_events()) return;
-  if (!FLAG_log_code || !log_->IsEnabled()) return;
-  Log::MessageBuilder msg(log_.get());
-  AppendCodeCreateHeader(msg, tag, AbstractCode::Kind::WASM_FUNCTION,
-                         code->instructions().begin(),
-                         code->instructions().length(), &timer_);
-  if (name.empty()) {
-    msg << "<unknown wasm>";
-  } else {
-    msg.AppendString(name);
-  }
-  // We have to add two extra fields that allow the tick processor to group
-  // events for the same wasm function, even if it gets compiled again. For
-  // normal JS functions, we use the shared function info. For wasm, the pointer
-  // to the native module + function index works well enough.
-  // TODO(herhut) Clean up the tick processor code instead.
-  void* tag_ptr =
-      reinterpret_cast<byte*>(code->native_module()) + code->index();
-  msg << kNext << tag_ptr << kNext << ComputeMarker(code);
+  AppendCodeCreateHeader(msg, tag, *code, &timer_);
+  msg << *script_name << kNext << reinterpret_cast<void*>(shared->address())
+      << kNext << ComputeMarker(*shared, *code);
   msg.WriteToLogFile();
 }
 
 // Although, it is possible to extract source and line from
 // the SharedFunctionInfo object, we left it to caller
 // to leave logging functions free from heap allocations.
-void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                             AbstractCode code, SharedFunctionInfo shared,
-                             Name source, int line, int column) {
+void Logger::CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                             Handle<SharedFunctionInfo> shared,
+                             Handle<Name> script_name, int line, int column) {
   if (!is_listening_to_code_events()) return;
   if (!FLAG_log_code || !log_->IsEnabled()) return;
   {
     Log::MessageBuilder msg(log_.get());
-    AppendCodeCreateHeader(msg, tag, code, &timer_);
-    msg << shared.DebugName() << " " << source << ":" << line << ":" << column
-        << kNext << reinterpret_cast<void*>(shared.address()) << kNext
-        << ComputeMarker(shared, code);
+    AppendCodeCreateHeader(msg, tag, *code, &timer_);
+    msg << shared->DebugName() << " " << *script_name << ":" << line << ":"
+        << column << kNext << reinterpret_cast<void*>(shared->address())
+        << kNext << ComputeMarker(*shared, *code);
     msg.WriteToLogFile();
   }
 
   if (!FLAG_log_source_code) return;
-  Object script_object = shared.script();
+  Object script_object = shared->script();
   if (!script_object.IsScript()) return;
   Script script = Script::cast(script_object);
   if (!EnsureLogScriptSource(script)) return;
@@ -1267,11 +1242,11 @@ void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   //      S<shared-function-info-address>
   Log::MessageBuilder msg(log_.get());
   msg << "code-source-info" << kNext
-      << reinterpret_cast<void*>(code.InstructionStart()) << kNext
-      << script.id() << kNext << shared.StartPosition() << kNext
-      << shared.EndPosition() << kNext;
+      << reinterpret_cast<void*>(code->InstructionStart()) << kNext
+      << script.id() << kNext << shared->StartPosition() << kNext
+      << shared->EndPosition() << kNext;
 
-  SourcePositionTableIterator iterator(code.source_position_table());
+  SourcePositionTableIterator iterator(code->source_position_table());
   bool hasInlined = false;
   for (; !iterator.done(); iterator.Advance()) {
     SourcePosition pos = iterator.source_position();
@@ -1285,7 +1260,8 @@ void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   int maxInlinedId = -1;
   if (hasInlined) {
     PodArray<InliningPosition> inlining_positions =
-        DeoptimizationData::cast(Code::cast(code).deoptimization_data())
+        DeoptimizationData::cast(
+            Handle<Code>::cast(code)->deoptimization_data())
             .InliningPositions();
     for (int i = 0; i < inlining_positions.length(); i++) {
       InliningPosition inlining_pos = inlining_positions.get(i);
@@ -1305,8 +1281,8 @@ void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   }
   msg << kNext;
   if (hasInlined) {
-    DeoptimizationData deopt_data =
-        DeoptimizationData::cast(Code::cast(code).deoptimization_data());
+    DeoptimizationData deopt_data = DeoptimizationData::cast(
+        Handle<Code>::cast(code)->deoptimization_data());
 
     msg << std::hex;
     for (int i = 0; i <= maxInlinedId; i++) {
@@ -1319,28 +1295,61 @@ void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   msg.WriteToLogFile();
 }
 
-void Logger::CodeDisableOptEvent(AbstractCode code, SharedFunctionInfo shared) {
+void Logger::CodeCreateEvent(LogEventsAndTags tag, const wasm::WasmCode* code,
+                             wasm::WasmName name) {
   if (!is_listening_to_code_events()) return;
   if (!FLAG_log_code || !log_->IsEnabled()) return;
   Log::MessageBuilder msg(log_.get());
-  msg << kLogEventsNames[CodeEventListener::CODE_DISABLE_OPT_EVENT] << kNext
-      << shared.DebugName() << kNext
-      << GetBailoutReason(shared.disable_optimization_reason());
+  AppendCodeCreateHeader(msg, tag, AbstractCode::Kind::WASM_FUNCTION,
+                         code->instructions().begin(),
+                         code->instructions().length(), &timer_);
+  if (name.empty()) {
+    msg << "<unknown wasm>";
+  } else {
+    msg.AppendString(name);
+  }
+  // We have to add two extra fields that allow the tick processor to group
+  // events for the same wasm function, even if it gets compiled again. For
+  // normal JS functions, we use the shared function info. For wasm, the pointer
+  // to the native module + function index works well enough.
+  // TODO(herhut) Clean up the tick processor code instead.
+  void* tag_ptr =
+      reinterpret_cast<byte*>(code->native_module()) + code->index();
+  msg << kNext << tag_ptr << kNext << ComputeMarker(code);
   msg.WriteToLogFile();
 }
 
-void Logger::CodeMovingGCEvent() {
-  if (!is_listening_to_code_events()) return;
-  if (!log_->IsEnabled() || !FLAG_ll_prof) return;
-  base::OS::SignalCodeMovingGC();
+void Logger::CallbackEventInternal(const char* prefix, Handle<Name> name,
+                                   Address entry_point) {
+  if (!FLAG_log_code || !log_->IsEnabled()) return;
+  Log::MessageBuilder msg(log_.get());
+  msg << kLogEventsNames[CodeEventListener::CODE_CREATION_EVENT] << kNext
+      << kLogEventsNames[CodeEventListener::CALLBACK_TAG] << kNext << -2
+      << kNext << timer_.Elapsed().InMicroseconds() << kNext
+      << reinterpret_cast<void*>(entry_point) << kNext << 1 << kNext << prefix
+      << *name;
+  msg.WriteToLogFile();
+}
+
+void Logger::CallbackEvent(Handle<Name> name, Address entry_point) {
+  CallbackEventInternal("", name, entry_point);
+}
+
+void Logger::GetterCallbackEvent(Handle<Name> name, Address entry_point) {
+  CallbackEventInternal("get ", name, entry_point);
+}
+
+void Logger::SetterCallbackEvent(Handle<Name> name, Address entry_point) {
+  CallbackEventInternal("set ", name, entry_point);
 }
 
-void Logger::RegExpCodeCreateEvent(AbstractCode code, String source) {
+void Logger::RegExpCodeCreateEvent(Handle<AbstractCode> code,
+                                   Handle<String> source) {
   if (!is_listening_to_code_events()) return;
   if (!FLAG_log_code || !log_->IsEnabled()) return;
   Log::MessageBuilder msg(log_.get());
-  AppendCodeCreateHeader(msg, CodeEventListener::REG_EXP_TAG, code, &timer_);
-  msg << source;
+  AppendCodeCreateHeader(msg, CodeEventListener::REG_EXP_TAG, *code, &timer_);
+  msg << *source;
   msg.WriteToLogFile();
 }
 
@@ -1350,6 +1359,55 @@ void Logger::CodeMoveEvent(AbstractCode from, AbstractCode to) {
                     to.address());
 }
 
+void Logger::SharedFunctionInfoMoveEvent(Address from, Address to) {
+  if (!is_listening_to_code_events()) return;
+  MoveEventInternal(CodeEventListener::SHARED_FUNC_MOVE_EVENT, from, to);
+}
+
+void Logger::CodeMovingGCEvent() {
+  if (!is_listening_to_code_events()) return;
+  if (!log_->IsEnabled() || !FLAG_ll_prof) return;
+  base::OS::SignalCodeMovingGC();
+}
+
+void Logger::CodeDisableOptEvent(Handle<AbstractCode> code,
+                                 Handle<SharedFunctionInfo> shared) {
+  if (!is_listening_to_code_events()) return;
+  if (!FLAG_log_code || !log_->IsEnabled()) return;
+  Log::MessageBuilder msg(log_.get());
+  msg << kLogEventsNames[CodeEventListener::CODE_DISABLE_OPT_EVENT] << kNext
+      << shared->DebugName() << kNext
+      << GetBailoutReason(shared->disable_optimization_reason());
+  msg.WriteToLogFile();
+}
+
+void Logger::CodeDeoptEvent(Handle<Code> code, DeoptimizeKind kind, Address pc,
+                            int fp_to_sp_delta) {
+  if (!log_->IsEnabled()) return;
+  Deoptimizer::DeoptInfo info = Deoptimizer::GetDeoptInfo(*code, pc);
+  Log::MessageBuilder msg(log_.get());
+  msg << "code-deopt" << kNext << timer_.Elapsed().InMicroseconds() << kNext
+      << code->CodeSize() << kNext
+      << reinterpret_cast<void*>(code->InstructionStart());
+
+  // Deoptimization position.
+  std::ostringstream deopt_location;
+  int inlining_id = -1;
+  int script_offset = -1;
+  if (info.position.IsKnown()) {
+    info.position.Print(deopt_location, *code);
+    inlining_id = info.position.InliningId();
+    script_offset = info.position.ScriptOffset();
+  } else {
+    deopt_location << "<unknown>";
+  }
+  msg << kNext << inlining_id << kNext << script_offset << kNext;
+  msg << Deoptimizer::MessageFor(kind) << kNext;
+  msg << deopt_location.str().c_str() << kNext
+      << DeoptimizeReasonToString(info.deopt_reason);
+  msg.WriteToLogFile();
+}
+
 namespace {
 
 void CodeLinePosEvent(
@@ -1394,13 +1452,8 @@ void Logger::CodeNameEvent(Address addr, int pos, const char* code_name) {
   msg.WriteToLogFile();
 }
 
-void Logger::SharedFunctionInfoMoveEvent(Address from, Address to) {
-  if (!is_listening_to_code_events()) return;
-  MoveEventInternal(CodeEventListener::SHARED_FUNC_MOVE_EVENT, from, to);
-}
-
-void Logger::MoveEventInternal(CodeEventListener::LogEventsAndTags event,
-                               Address from, Address to) {
+void Logger::MoveEventInternal(LogEventsAndTags event, Address from,
+                               Address to) {
   if (!FLAG_log_code || !log_->IsEnabled()) return;
   Log::MessageBuilder msg(log_.get());
   msg << kLogEventsNames[event] << kNext << reinterpret_cast<void*>(from)
@@ -1767,7 +1820,8 @@ void Logger::LogAccessorCallbacks() {
     AccessorInfo ai = AccessorInfo::cast(obj);
     if (!ai.name().IsName()) continue;
     Address getter_entry = v8::ToCData<Address>(ai.getter());
-    Name name = Name::cast(ai.name());
+    HandleScope scope(isolate_);
+    Handle<Name> name(Name::cast(ai.name()), isolate_);
     if (getter_entry != 0) {
 #if USES_FUNCTION_DESCRIPTORS
       getter_entry = *FUNCTION_ENTRYPOINT_ADDRESS(getter_entry);
@@ -1859,6 +1913,7 @@ bool Logger::SetUp(Isolate* isolate) {
   PrepareLogFileName(log_file_name, isolate, FLAG_logfile);
   log_ = std::make_unique<Log>(this, log_file_name.str().c_str());
 
+#if V8_OS_LINUX
   if (FLAG_perf_basic_prof) {
     perf_basic_logger_ = std::make_unique<PerfBasicLogger>(isolate);
     AddCodeEventListener(perf_basic_logger_.get());
@@ -1868,6 +1923,14 @@ bool Logger::SetUp(Isolate* isolate) {
     perf_jit_logger_ = std::make_unique<PerfJitLogger>(isolate);
     AddCodeEventListener(perf_jit_logger_.get());
   }
+#else
+  static_assert(
+      !FLAG_perf_prof,
+      "--perf-prof should be statically disabled on non-Linux platforms");
+  static_assert(
+      !FLAG_perf_basic_prof,
+      "--perf-basic-prof should be statically disabled on non-Linux platforms");
+#endif
 
   if (FLAG_ll_prof) {
     ll_logger_ =
@@ -1935,6 +1998,7 @@ FILE* Logger::TearDown() {
 
   ticker_.reset();
 
+#if V8_OS_LINUX
   if (perf_basic_logger_) {
     RemoveCodeEventListener(perf_basic_logger_.get());
     perf_basic_logger_.reset();
@@ -1944,6 +2008,7 @@ FILE* Logger::TearDown() {
     RemoveCodeEventListener(perf_jit_logger_.get());
     perf_jit_logger_.reset();
   }
+#endif
 
   if (ll_logger_) {
     RemoveCodeEventListener(ll_logger_.get());
@@ -1959,10 +2024,11 @@ FILE* Logger::TearDown() {
 }
 
 void ExistingCodeLogger::LogCodeObject(Object object) {
-  AbstractCode abstract_code = AbstractCode::cast(object);
+  HandleScope scope(isolate_);
+  Handle<AbstractCode> abstract_code(AbstractCode::cast(object), isolate_);
   CodeEventListener::LogEventsAndTags tag = CodeEventListener::STUB_TAG;
   const char* description = "Unknown code from before profiling";
-  switch (abstract_code.kind()) {
+  switch (abstract_code->kind()) {
     case AbstractCode::INTERPRETED_FUNCTION:
     case AbstractCode::OPTIMIZED_FUNCTION:
       return;  // We log this later using LogCompiledFunctions.
@@ -1983,7 +2049,7 @@ void ExistingCodeLogger::LogCodeObject(Object object) {
         return;
       }
       description =
-          isolate_->builtins()->name(abstract_code.GetCode().builtin_index());
+          isolate_->builtins()->name(abstract_code->GetCode().builtin_index());
       tag = CodeEventListener::BUILTIN_TAG;
       break;
     case AbstractCode::WASM_FUNCTION:
@@ -2078,18 +2144,18 @@ void ExistingCodeLogger::LogExistingFunction(
       Handle<String> script_name(String::cast(script->name()), isolate_);
       if (line_num > 0) {
         CALL_CODE_EVENT_HANDLER(
-            CodeCreateEvent(Logger::ToNativeByScript(tag, *script), *code,
-                            *shared, *script_name, line_num, column_num))
+            CodeCreateEvent(Logger::ToNativeByScript(tag, *script), code,
+                            shared, script_name, line_num, column_num))
       } else {
         // Can't distinguish eval and script here, so always use Script.
         CALL_CODE_EVENT_HANDLER(CodeCreateEvent(
             Logger::ToNativeByScript(CodeEventListener::SCRIPT_TAG, *script),
-            *code, *shared, *script_name))
+            code, shared, script_name))
       }
     } else {
       CALL_CODE_EVENT_HANDLER(CodeCreateEvent(
-          Logger::ToNativeByScript(tag, *script), *code, *shared,
-          ReadOnlyRoots(isolate_).empty_string(), line_num, column_num))
+          Logger::ToNativeByScript(tag, *script), code, shared,
+          ReadOnlyRoots(isolate_).empty_string_handle(), line_num, column_num))
     }
   } else if (shared->IsApiFunction()) {
     // API function.
@@ -2102,7 +2168,8 @@ void ExistingCodeLogger::LogExistingFunction(
 #if USES_FUNCTION_DESCRIPTORS
       entry_point = *FUNCTION_ENTRYPOINT_ADDRESS(entry_point);
 #endif
-      CALL_CODE_EVENT_HANDLER(CallbackEvent(shared->DebugName(), entry_point))
+      CALL_CODE_EVENT_HANDLER(
+          CallbackEvent(handle(shared->DebugName(), isolate_), entry_point))
     }
   }
 }
diff --git a/deps/v8/src/logging/log.h b/deps/v8/src/logging/log.h
index 69760c4c6cab33..16f8f69e604c20 100644
--- a/deps/v8/src/logging/log.h
+++ b/deps/v8/src/logging/log.h
@@ -186,46 +186,42 @@ class Logger : public CodeEventListener {
   V8_EXPORT_PRIVATE void AddCodeEventListener(CodeEventListener* listener);
   V8_EXPORT_PRIVATE void RemoveCodeEventListener(CodeEventListener* listener);
 
-  // Emits a code event for a callback function.
-  void CallbackEvent(Name name, Address entry_point) override;
-  void GetterCallbackEvent(Name name, Address entry_point) override;
-  void SetterCallbackEvent(Name name, Address entry_point) override;
-  // Emits a code create event.
-  void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                       AbstractCode code, const char* source) override;
-  void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                       AbstractCode code, Name name) override;
-  void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                       AbstractCode code, SharedFunctionInfo shared,
-                       Name name) override;
-  void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                       AbstractCode code, SharedFunctionInfo shared,
-                       Name source, int line, int column) override;
-  void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                       const wasm::WasmCode* code,
+  // CodeEventListener implementation.
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       const char* name) override;
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<Name> name) override;
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<SharedFunctionInfo> shared,
+                       Handle<Name> script_name) override;
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<SharedFunctionInfo> shared,
+                       Handle<Name> script_name, int line, int column) override;
+  void CodeCreateEvent(LogEventsAndTags tag, const wasm::WasmCode* code,
                        wasm::WasmName name) override;
-  // Emits a code deoptimization event.
-  void CodeDisableOptEvent(AbstractCode code,
-                           SharedFunctionInfo shared) override;
-  void CodeMovingGCEvent() override;
-  // Emits a code create event for a RegExp.
-  void RegExpCodeCreateEvent(AbstractCode code, String source) override;
-  // Emits a code move event.
+
+  void CallbackEvent(Handle<Name> name, Address entry_point) override;
+  void GetterCallbackEvent(Handle<Name> name, Address entry_point) override;
+  void SetterCallbackEvent(Handle<Name> name, Address entry_point) override;
+  void RegExpCodeCreateEvent(Handle<AbstractCode> code,
+                             Handle<String> source) override;
   void CodeMoveEvent(AbstractCode from, AbstractCode to) override;
+  void SharedFunctionInfoMoveEvent(Address from, Address to) override;
+  void NativeContextMoveEvent(Address from, Address to) override {}
+  void CodeMovingGCEvent() override;
+  void CodeDisableOptEvent(Handle<AbstractCode> code,
+                           Handle<SharedFunctionInfo> shared) override;
+  void CodeDeoptEvent(Handle<Code> code, DeoptimizeKind kind, Address pc,
+                      int fp_to_sp_delta) override;
+
   // Emits a code line info record event.
   void CodeLinePosInfoRecordEvent(Address code_start,
                                   ByteArray source_position_table);
   void CodeLinePosInfoRecordEvent(Address code_start,
                                   Vector<const byte> source_position_table);
 
-  void SharedFunctionInfoMoveEvent(Address from, Address to) override;
-
-  void NativeContextMoveEvent(Address from, Address to) override {}
-
   void CodeNameEvent(Address addr, int pos, const char* code_name);
 
-  void CodeDeoptEvent(Code code, DeoptimizeKind kind, Address pc,
-                      int fp_to_sp_delta) override;
 
   void ICEvent(const char* type, bool keyed, Map map, Object key,
                char old_state, char new_state, const char* modifier,
@@ -281,7 +277,7 @@ class Logger : public CodeEventListener {
   void ProfilerBeginEvent();
 
   // Emits callback event messages.
-  void CallbackEventInternal(const char* prefix, Name name,
+  void CallbackEventInternal(const char* prefix, Handle<Name> name,
                              Address entry_point);
 
   // Internal configurable move event.
@@ -320,8 +316,10 @@ class Logger : public CodeEventListener {
 
   bool is_logging_;
   std::unique_ptr<Log> log_;
+#if V8_OS_LINUX
   std::unique_ptr<PerfBasicLogger> perf_basic_logger_;
   std::unique_ptr<PerfJitLogger> perf_jit_logger_;
+#endif
   std::unique_ptr<LowLevelLogger> ll_logger_;
   std::unique_ptr<JitLogger> jit_logger_;
   std::set<int> logged_source_code_;
@@ -372,31 +370,34 @@ class TimerEventScope {
   Isolate* isolate_;
 };
 
+// Abstract
 class V8_EXPORT_PRIVATE CodeEventLogger : public CodeEventListener {
  public:
   explicit CodeEventLogger(Isolate* isolate);
   ~CodeEventLogger() override;
 
-  void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                       const char* comment) override;
-  void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                       Name name) override;
-  void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                       SharedFunctionInfo shared, Name name) override;
-  void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                       SharedFunctionInfo shared, Name source, int line,
-                       int column) override;
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       const char* name) override;
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<Name> name) override;
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<SharedFunctionInfo> shared,
+                       Handle<Name> script_name) override;
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<SharedFunctionInfo> shared,
+                       Handle<Name> script_name, int line, int column) override;
   void CodeCreateEvent(LogEventsAndTags tag, const wasm::WasmCode* code,
                        wasm::WasmName name) override;
 
-  void RegExpCodeCreateEvent(AbstractCode code, String source) override;
-  void CallbackEvent(Name name, Address entry_point) override {}
-  void GetterCallbackEvent(Name name, Address entry_point) override {}
-  void SetterCallbackEvent(Name name, Address entry_point) override {}
+  void RegExpCodeCreateEvent(Handle<AbstractCode> code,
+                             Handle<String> source) override;
+  void CallbackEvent(Handle<Name> name, Address entry_point) override {}
+  void GetterCallbackEvent(Handle<Name> name, Address entry_point) override {}
+  void SetterCallbackEvent(Handle<Name> name, Address entry_point) override {}
   void SharedFunctionInfoMoveEvent(Address from, Address to) override {}
   void NativeContextMoveEvent(Address from, Address to) override {}
   void CodeMovingGCEvent() override {}
-  void CodeDeoptEvent(Code code, DeoptimizeKind kind, Address pc,
+  void CodeDeoptEvent(Handle<Code> code, DeoptimizeKind kind, Address pc,
                       int fp_to_sp_delta) override {}
 
  protected:
@@ -405,7 +406,8 @@ class V8_EXPORT_PRIVATE CodeEventLogger : public CodeEventListener {
  private:
   class NameBuffer;
 
-  virtual void LogRecordedBuffer(AbstractCode code, SharedFunctionInfo shared,
+  virtual void LogRecordedBuffer(Handle<AbstractCode> code,
+                                 MaybeHandle<SharedFunctionInfo> maybe_shared,
                                  const char* name, int length) = 0;
   virtual void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
                                  int length) = 0;
@@ -431,29 +433,31 @@ class ExternalCodeEventListener : public CodeEventListener {
   explicit ExternalCodeEventListener(Isolate* isolate);
   ~ExternalCodeEventListener() override;
 
-  void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
                        const char* comment) override;
-  void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                       Name name) override;
-  void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                       SharedFunctionInfo shared, Name name) override;
-  void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                       SharedFunctionInfo shared, Name source, int line,
-                       int column) override;
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<Name> name) override;
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<SharedFunctionInfo> shared,
+                       Handle<Name> name) override;
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<SharedFunctionInfo> shared, Handle<Name> source,
+                       int line, int column) override;
   void CodeCreateEvent(LogEventsAndTags tag, const wasm::WasmCode* code,
                        wasm::WasmName name) override;
 
-  void RegExpCodeCreateEvent(AbstractCode code, String source) override;
-  void CallbackEvent(Name name, Address entry_point) override {}
-  void GetterCallbackEvent(Name name, Address entry_point) override {}
-  void SetterCallbackEvent(Name name, Address entry_point) override {}
+  void RegExpCodeCreateEvent(Handle<AbstractCode> code,
+                             Handle<String> source) override;
+  void CallbackEvent(Handle<Name> name, Address entry_point) override {}
+  void GetterCallbackEvent(Handle<Name> name, Address entry_point) override {}
+  void SetterCallbackEvent(Handle<Name> name, Address entry_point) override {}
   void SharedFunctionInfoMoveEvent(Address from, Address to) override {}
   void NativeContextMoveEvent(Address from, Address to) override {}
   void CodeMoveEvent(AbstractCode from, AbstractCode to) override;
-  void CodeDisableOptEvent(AbstractCode code,
-                           SharedFunctionInfo shared) override {}
+  void CodeDisableOptEvent(Handle<AbstractCode> code,
+                           Handle<SharedFunctionInfo> shared) override {}
   void CodeMovingGCEvent() override {}
-  void CodeDeoptEvent(Code code, DeoptimizeKind kind, Address pc,
+  void CodeDeoptEvent(Handle<Code> code, DeoptimizeKind kind, Address pc,
                       int fp_to_sp_delta) override {}
 
   void StartListening(v8::CodeEventHandler* code_event_handler);
diff --git a/deps/v8/src/objects/allocation-site-inl.h b/deps/v8/src/objects/allocation-site-inl.h
index aaf0105e51e309..cf173719282883 100644
--- a/deps/v8/src/objects/allocation-site-inl.h
+++ b/deps/v8/src/objects/allocation-site-inl.h
@@ -59,9 +59,9 @@ bool AllocationSite::HasWeakNext() const {
 }
 
 void AllocationSite::Initialize() {
-  set_transition_info_or_boilerplate(Smi::kZero);
+  set_transition_info_or_boilerplate(Smi::zero());
   SetElementsKind(GetInitialFastElementsKind());
-  set_nested_site(Smi::kZero);
+  set_nested_site(Smi::zero());
   set_pretenure_data(0);
   set_pretenure_create_count(0);
   set_dependent_code(
diff --git a/deps/v8/src/objects/allocation-site.h b/deps/v8/src/objects/allocation-site.h
index c1b6417ae135d4..fde9b7d6026eb2 100644
--- a/deps/v8/src/objects/allocation-site.h
+++ b/deps/v8/src/objects/allocation-site.h
@@ -66,14 +66,14 @@ class AllocationSite : public Struct {
   bool IsNested();
 
   // transition_info bitfields, for constructed array transition info.
-  using ElementsKindBits = BitField<ElementsKind, 0, 5>;
-  using DoNotInlineBit = BitField<bool, 5, 1>;
+  using ElementsKindBits = base::BitField<ElementsKind, 0, 5>;
+  using DoNotInlineBit = base::BitField<bool, 5, 1>;
   // Unused bits 6-30.
 
   // Bitfields for pretenure_data
-  using MementoFoundCountBits = BitField<int, 0, 26>;
-  using PretenureDecisionBits = BitField<PretenureDecision, 26, 3>;
-  using DeoptDependentCodeBit = BitField<bool, 29, 1>;
+  using MementoFoundCountBits = base::BitField<int, 0, 26>;
+  using PretenureDecisionBits = base::BitField<PretenureDecision, 26, 3>;
+  using DeoptDependentCodeBit = base::BitField<bool, 29, 1>;
   STATIC_ASSERT(PretenureDecisionBits::kMax >= kLastPretenureDecisionValue);
 
   // Increments the mementos found counter and returns true when the first
diff --git a/deps/v8/src/objects/allocation-site.tq b/deps/v8/src/objects/allocation-site.tq
new file mode 100644
index 00000000000000..1a5f5825fb3334
--- /dev/null
+++ b/deps/v8/src/objects/allocation-site.tq
@@ -0,0 +1,8 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class AllocationSite extends Struct;
+extern class AllocationMemento extends Struct {
+  allocation_site: AllocationSite;
+}
diff --git a/deps/v8/src/objects/api-callbacks-inl.h b/deps/v8/src/objects/api-callbacks-inl.h
index d0698d13a1c813..a069e29807cc92 100644
--- a/deps/v8/src/objects/api-callbacks-inl.h
+++ b/deps/v8/src/objects/api-callbacks-inl.h
@@ -42,17 +42,17 @@ ACCESSORS(AccessorInfo, js_getter, Object, kJsGetterOffset)
 ACCESSORS(AccessorInfo, data, Object, kDataOffset)
 
 bool AccessorInfo::has_getter() {
-  bool result = getter() != Smi::kZero;
+  bool result = getter() != Smi::zero();
   DCHECK_EQ(result,
-            getter() != Smi::kZero &&
+            getter() != Smi::zero() &&
                 Foreign::cast(getter()).foreign_address() != kNullAddress);
   return result;
 }
 
 bool AccessorInfo::has_setter() {
-  bool result = setter() != Smi::kZero;
+  bool result = setter() != Smi::zero();
   DCHECK_EQ(result,
-            setter() != Smi::kZero &&
+            setter() != Smi::zero() &&
                 Foreign::cast(setter()).foreign_address() != kNullAddress);
   return result;
 }
diff --git a/deps/v8/src/objects/api-callbacks.h b/deps/v8/src/objects/api-callbacks.h
index 72be5deb8fa553..2bf1a26b9a9d30 100644
--- a/deps/v8/src/objects/api-callbacks.h
+++ b/deps/v8/src/objects/api-callbacks.h
@@ -5,6 +5,7 @@
 #ifndef V8_OBJECTS_API_CALLBACKS_H_
 #define V8_OBJECTS_API_CALLBACKS_H_
 
+#include "src/base/bit-field.h"
 #include "src/objects/struct.h"
 #include "torque-generated/class-definitions-tq.h"
 
diff --git a/deps/v8/src/objects/api-callbacks.tq b/deps/v8/src/objects/api-callbacks.tq
new file mode 100644
index 00000000000000..751acd1def680c
--- /dev/null
+++ b/deps/v8/src/objects/api-callbacks.tq
@@ -0,0 +1,41 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+extern class CallHandlerInfo extends Struct {
+  callback: NonNullForeign|Undefined|Zero;
+  js_callback: NonNullForeign|Undefined|Zero;
+  data: Object;
+}
+
+@generateCppClass
+extern class InterceptorInfo extends Struct {
+  getter: NonNullForeign|Zero|Undefined;
+  setter: NonNullForeign|Zero|Undefined;
+  query: NonNullForeign|Zero|Undefined;
+  descriptor: NonNullForeign|Zero|Undefined;
+  deleter: NonNullForeign|Zero|Undefined;
+  enumerator: NonNullForeign|Zero|Undefined;
+  definer: NonNullForeign|Zero|Undefined;
+  data: Object;
+  flags: Smi;
+}
+
+@generateCppClass
+extern class AccessCheckInfo extends Struct {
+  callback: Foreign|Zero|Undefined;
+  named_interceptor: InterceptorInfo|Zero|Undefined;
+  indexed_interceptor: InterceptorInfo|Zero|Undefined;
+  data: Object;
+}
+
+extern class AccessorInfo extends Struct {
+  name: Object;
+  flags: Smi;
+  expected_receiver_type: Object;
+  setter: NonNullForeign|Zero;
+  getter: NonNullForeign|Zero;
+  js_getter: NonNullForeign|Zero;
+  data: Object;
+}
diff --git a/deps/v8/src/objects/arguments-inl.h b/deps/v8/src/objects/arguments-inl.h
index 3de88d6a9bd68d..feeb9dd1a9de7b 100644
--- a/deps/v8/src/objects/arguments-inl.h
+++ b/deps/v8/src/objects/arguments-inl.h
@@ -52,34 +52,6 @@ void SloppyArgumentsElements::set_mapped_entry(uint32_t entry, Object object) {
   set(entry + kParameterMapStart, object);
 }
 
-// TODO(danno): This shouldn't be inline here, but to defensively avoid
-// regressions associated with the fix for the bug 778574, it's staying that way
-// until the splice implementation in builtin-arrays.cc can be removed and this
-// function can be moved into runtime-arrays.cc near its other usage.
-bool JSSloppyArgumentsObject::GetSloppyArgumentsLength(Isolate* isolate,
-                                                       Handle<JSObject> object,
-                                                       int* out) {
-  Context context = *isolate->native_context();
-  Map map = object->map();
-  if (map != context.sloppy_arguments_map() &&
-      map != context.strict_arguments_map() &&
-      map != context.fast_aliased_arguments_map()) {
-    return false;
-  }
-  DCHECK(object->HasFastElements() || object->HasFastArgumentsElements());
-  Object len_obj =
-      object->InObjectPropertyAt(JSArgumentsObjectWithLength::kLengthIndex);
-  if (!len_obj.IsSmi()) return false;
-  *out = Max(0, Smi::ToInt(len_obj));
-
-  FixedArray parameters = FixedArray::cast(object->elements());
-  if (object->HasSloppyArgumentsElements()) {
-    FixedArray arguments = FixedArray::cast(parameters.get(1));
-    return *out <= arguments.length();
-  }
-  return *out <= parameters.length();
-}
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/arguments.h b/deps/v8/src/objects/arguments.h
index 0a1e3e4ac98a0a..c69545bfda6d2a 100644
--- a/deps/v8/src/objects/arguments.h
+++ b/deps/v8/src/objects/arguments.h
@@ -21,55 +21,38 @@ class JSArgumentsObject
     : public TorqueGeneratedJSArgumentsObject<JSArgumentsObject, JSObject> {
  public:
   DECL_VERIFIER(JSArgumentsObject)
+  DECL_PRINTER(JSArgumentsObject)
   TQ_OBJECT_CONSTRUCTORS(JSArgumentsObject)
 };
 
-// Common superclass for JSSloppyArgumentsObject and JSStrictArgumentsObject.
-// Note that the instance type {JS_ARGUMENTS_OBJECT_TYPE} does _not_ guarantee
-// the below layout, the in-object properties might have transitioned to
-// dictionary mode already. Only use the below layout with the specific initial
-// maps.
-class JSArgumentsObjectWithLength : public JSArgumentsObject {
+// JSSloppyArgumentsObject is just a JSArgumentsObject with specific initial
+// map. This initial map adds in-object properties for "length" and "callee".
+class JSSloppyArgumentsObject : public JSArgumentsObject {
  public:
-  // Layout description.
   DEFINE_FIELD_OFFSET_CONSTANTS(
-      JSObject::kHeaderSize,
-      TORQUE_GENERATED_JS_ARGUMENTS_OBJECT_WITH_LENGTH_FIELDS)
-
-  // Indices of in-object properties.
-  static const int kLengthIndex = 0;
-
-  DECL_VERIFIER(JSArgumentsObjectWithLength)
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(JSArgumentsObjectWithLength);
-};
-
-// JSSloppyArgumentsObject is just a JSObject with specific initial map.
-// This initial map adds in-object properties for "length" and "callee".
-class JSSloppyArgumentsObject : public JSArgumentsObjectWithLength {
- public:
-  DEFINE_FIELD_OFFSET_CONSTANTS(
-      JSArgumentsObjectWithLength::kSize,
+      JSArgumentsObject::kHeaderSize,
       TORQUE_GENERATED_JS_SLOPPY_ARGUMENTS_OBJECT_FIELDS)
 
   // Indices of in-object properties.
+  static const int kLengthIndex = 0;
   static const int kCalleeIndex = kLengthIndex + 1;
 
-  inline static bool GetSloppyArgumentsLength(Isolate* isolate,
-                                              Handle<JSObject> object,
-                                              int* out);
-
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSSloppyArgumentsObject);
 };
 
-// JSStrictArgumentsObject is just a JSObject with specific initial map.
-// This initial map adds an in-object property for "length".
-class JSStrictArgumentsObject : public JSArgumentsObjectWithLength {
+// JSStrictArgumentsObject is just a JSArgumentsObject with specific initial
+// map. This initial map adds an in-object property for "length".
+class JSStrictArgumentsObject : public JSArgumentsObject {
  public:
   // Layout description.
-  static const int kSize = JSArgumentsObjectWithLength::kSize;
+  DEFINE_FIELD_OFFSET_CONSTANTS(
+      JSArgumentsObject::kHeaderSize,
+      TORQUE_GENERATED_JS_STRICT_ARGUMENTS_OBJECT_FIELDS)
+
+  // Indices of in-object properties.
+  static const int kLengthIndex = 0;
+  STATIC_ASSERT(kLengthIndex == JSSloppyArgumentsObject::kLengthIndex);
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSStrictArgumentsObject);
diff --git a/deps/v8/src/objects/arguments.tq b/deps/v8/src/objects/arguments.tq
new file mode 100644
index 00000000000000..e24eefe6312888
--- /dev/null
+++ b/deps/v8/src/objects/arguments.tq
@@ -0,0 +1,229 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+extern class JSArgumentsObject extends JSObject {
+}
+
+type JSArgumentsObjectWithLength =
+    JSSloppyArgumentsObject|JSStrictArgumentsObject;
+
+@export
+macro IsJSArgumentsObjectWithLength(implicit context: Context)(o: Object):
+    bool {
+  return Is<JSArgumentsObjectWithLength>(o);
+}
+
+// Just a starting shape for JSObject; properties can move after initialization.
+extern shape JSSloppyArgumentsObject extends JSArgumentsObject {
+  length: JSAny;
+  callee: JSAny;
+}
+
+// Just a starting shape for JSObject; properties can move after initialization.
+extern shape JSStrictArgumentsObject extends JSArgumentsObject {
+  length: JSAny;
+}
+
+type SloppyArgumentsElements extends FixedArray;
+
+@generateCppClass
+extern class AliasedArgumentsEntry extends Struct {
+  aliased_context_slot: Smi;
+}
+
+// TODO(danno): This should be a namespace {} once supported
+namespace arguments {
+
+  macro NewJSStrictArgumentsObject(implicit context: Context)(
+      elements: FixedArray): JSStrictArgumentsObject {
+    const map = GetStrictArgumentsMap();
+    return new JSStrictArgumentsObject{
+      map,
+      properties_or_hash: kEmptyFixedArray,
+      elements,
+      length: elements.length
+    };
+  }
+
+  macro NewJSSloppyArgumentsObject(implicit context: Context)(
+      elements: FixedArray, callee: JSFunction): JSSloppyArgumentsObject {
+    const map = GetSloppyArgumentsMap();
+    return new JSSloppyArgumentsObject{
+      map,
+      properties_or_hash: kEmptyFixedArray,
+      elements,
+      length: elements.length,
+      callee
+    };
+  }
+
+  macro NewJSFastAliasedArgumentsObject(implicit context: Context)(
+      elements: FixedArray, length: Smi,
+      callee: JSFunction): JSSloppyArgumentsObject {
+    // TODO(danno): FastAliasedArguments should really be a type for itself
+    const map = GetFastAliasedArgumentsMap();
+    return new JSSloppyArgumentsObject{
+      map,
+      properties_or_hash: kEmptyFixedArray,
+      elements,
+      length,
+      callee
+    };
+  }
+
+  struct ParameterMapIterator {
+    macro Next(): Object labels NoMore {
+      const currentMapSlotCopy = this.currentMapSlot++;
+      if (currentMapSlotCopy > 1) {
+        if (this.currentIndex == this.endInterationIndex) goto NoMore;
+        this.currentIndex--;
+        return Convert<Smi>(this.currentIndex);
+      } else if (currentMapSlotCopy == 0) {
+        return this.context;
+      } else {
+        assert(currentMapSlotCopy == 1);
+        return this.elements;
+      }
+    }
+    const context: Context;
+    const elements: FixedArray;
+    currentIndex: intptr;
+    const endInterationIndex: intptr;
+    currentMapSlot: intptr;
+  }
+
+  macro NewParameterMapIterator(
+      context: Context, elements: FixedArray, formalParameterCount: intptr,
+      mappedCount: intptr): ParameterMapIterator {
+    const flags = context.scope_info.flags;
+    let contextHeaderSize: intptr = MIN_CONTEXT_SLOTS;
+    if (flags.has_context_extension_slot) ++contextHeaderSize;
+    // Copy the parameter slots and the holes in the arguments.
+    // We need to fill in mapped_count slots. They index the context,
+    // where parameters are stored in reverse order, at
+    //   context_header_size .. context_header_size+argument_count-1
+    // The mapped parameter thus need to get indices
+    //   context_header_size+parameter_count-1 ..
+    //       context_header_size+argument_count-mapped_count
+    // We loop from right to left.
+    const afterLastContextIndex = contextHeaderSize + formalParameterCount;
+    const firstContextIndex = afterLastContextIndex - mappedCount;
+    return ParameterMapIterator{
+      context,
+      elements,
+      currentIndex: afterLastContextIndex,
+      endInterationIndex: firstContextIndex,
+      currentMapSlot: 0
+    };
+  }
+
+  struct ParameterValueIterator {
+    macro Next(): Object labels NoMore() {
+      if (this.mapped_count != 0) {
+        this.mapped_count--;
+        return TheHole;
+      }
+      if (this.current == this.arguments.length) goto NoMore;
+      return this.arguments[this.current++];
+    }
+    mapped_count: intptr;
+    const arguments: Arguments;
+    current: intptr;
+  }
+
+  macro NewParameterValueIterator(mappedCount: intptr, arguments: Arguments):
+      ParameterValueIterator {
+    return ParameterValueIterator{
+      mapped_count: mappedCount,
+      arguments,
+      current: mappedCount
+    };
+  }
+
+  macro NewAllArguments(implicit context: Context)(
+      frame: FrameWithArguments, argumentCount: intptr): JSArray {
+    const map = GetFastPackedElementsJSArrayMap();
+    const arguments = GetFrameArguments(frame, argumentCount);
+    const it = ArgumentsIterator{arguments, current: 0};
+    const elements = NewFixedArray(argumentCount, it);
+    return NewJSArray(map, elements);
+  }
+
+  macro NewRestArguments(implicit context:
+                             Context)(info: FrameWithArgumentsInfo): JSArray {
+    const argumentCount = Convert<intptr>(info.argument_count);
+    const formalParameterCount = Convert<intptr>(info.formal_parameter_count);
+    const map = GetFastPackedElementsJSArrayMap();
+    const length = (formalParameterCount >= argumentCount) ?
+        0 :
+        argumentCount - formalParameterCount;
+    const arguments = GetFrameArguments(info.frame, argumentCount);
+    const it = ArgumentsIterator{arguments, current: formalParameterCount};
+    const elements = NewFixedArray(length, it);
+    return NewJSArray(map, elements);
+  }
+
+  macro NewStrictArguments(implicit context: Context)(
+      info: FrameWithArgumentsInfo): JSStrictArgumentsObject {
+    const argumentCount = Convert<intptr>(info.argument_count);
+    const arguments = GetFrameArguments(info.frame, argumentCount);
+    const it = ArgumentsIterator{arguments, current: 0};
+    const elements = NewFixedArray(argumentCount, it);
+    return NewJSStrictArgumentsObject(elements);
+  }
+
+  macro NewSloppyArguments(implicit context: Context)(
+      info: FrameWithArgumentsInfo,
+      callee: JSFunction): JSSloppyArgumentsObject {
+    const argumentCount = Convert<intptr>(info.argument_count);
+    const arguments = GetFrameArguments(info.frame, argumentCount);
+    const formalParameterCount = Convert<intptr>(info.formal_parameter_count);
+    if (formalParameterCount == 0) {
+      const it = ArgumentsIterator{arguments, current: 0};
+      const elements = NewFixedArray(argumentCount, it);
+      return NewJSSloppyArgumentsObject(elements, callee);
+    }
+    const mappedCount = IntPtrMin(formalParameterCount, argumentCount);
+    const it = NewParameterValueIterator(mappedCount, arguments);
+    const parameterValues = NewFixedArray(argumentCount, it);
+    let paramIter = NewParameterMapIterator(
+        context, parameterValues, formalParameterCount, mappedCount);
+    const elementsLength =
+        Convert<Smi>(mappedCount + kSloppyArgumentsParameterMapStart);
+    const map = kSloppyArgumentsElementsMap;
+    const elements = new
+    FixedArray{map, length: elementsLength, objects: ...paramIter};
+    const length = Convert<Smi>(argumentCount);
+    return NewJSFastAliasedArgumentsObject(elements, length, callee);
+  }
+
+}
+
+@export
+macro EmitFastNewAllArguments(implicit context: Context)(
+    frame: FrameWithArguments, argc: intptr): JSArray {
+  return arguments::NewAllArguments(frame, argc);
+}
+
+@export
+macro EmitFastNewRestArguments(implicit context: Context)(_f: JSFunction):
+    JSArray {
+  const info = GetFrameWithArgumentsInfo();
+  return arguments::NewRestArguments(info);
+}
+
+@export
+macro EmitFastNewStrictArguments(implicit context: Context)(_f: JSFunction):
+    JSStrictArgumentsObject {
+  const info = GetFrameWithArgumentsInfo();
+  return arguments::NewStrictArguments(info);
+}
+
+@export
+macro EmitFastNewSloppyArguments(implicit context: Context)(f: JSFunction):
+    JSSloppyArgumentsObject {
+  const info = GetFrameWithArgumentsInfo();
+  return arguments::NewSloppyArguments(info, f);
+}
diff --git a/deps/v8/src/objects/backing-store.cc b/deps/v8/src/objects/backing-store.cc
index cc6741765e1962..50e83c0ccc2470 100644
--- a/deps/v8/src/objects/backing-store.cc
+++ b/deps/v8/src/objects/backing-store.cc
@@ -3,6 +3,9 @@
 // found in the LICENSE file.
 
 #include "src/objects/backing-store.h"
+
+#include <cstring>
+
 #include "src/execution/isolate.h"
 #include "src/handles/global-handles.h"
 #include "src/logging/counters.h"
@@ -37,7 +40,10 @@ constexpr size_t kAddressSpaceLimit = 0xC0000000;  // 3 GiB
 
 constexpr uint64_t kOneGiB = 1024 * 1024 * 1024;
 constexpr uint64_t kNegativeGuardSize = 2 * kOneGiB;
+
+#if V8_TARGET_ARCH_64_BIT
 constexpr uint64_t kFullGuardSize = 10 * kOneGiB;
+#endif
 
 std::atomic<uint64_t> reserved_address_space_{0};
 
@@ -55,6 +61,7 @@ enum class AllocationStatus {
   kOtherFailure  // Failed for an unknown reason
 };
 
+#if V8_TARGET_ARCH_64_BIT
 base::AddressRegion GetGuardedRegion(void* buffer_start, size_t byte_length) {
   // Guard regions always look like this:
   // |xxx(2GiB)xxx|.......(4GiB)..xxxxx|xxxxxx(4GiB)xxxxxx|
@@ -68,6 +75,29 @@ base::AddressRegion GetGuardedRegion(void* buffer_start, size_t byte_length) {
   return base::AddressRegion(start - (2 * kOneGiB),
                              static_cast<size_t>(kFullGuardSize));
 }
+#endif
+
+base::AddressRegion GetRegion(bool has_guard_regions, void* buffer_start,
+                              size_t byte_length, size_t byte_capacity) {
+#if V8_TARGET_ARCH_64_BIT
+  if (has_guard_regions) return GetGuardedRegion(buffer_start, byte_length);
+#else
+  DCHECK(!has_guard_regions);
+#endif
+
+  return base::AddressRegion(reinterpret_cast<Address>(buffer_start),
+                             byte_capacity);
+}
+
+size_t GetReservationSize(bool has_guard_regions, size_t byte_capacity) {
+#if V8_TARGET_ARCH_64_BIT
+  if (has_guard_regions) return kFullGuardSize;
+#else
+  DCHECK(!has_guard_regions);
+#endif
+
+  return byte_capacity;
+}
 
 void RecordStatus(Isolate* isolate, AllocationStatus status) {
   isolate->counters()->wasm_memory_allocation_result()->AddSample(
@@ -76,11 +106,20 @@ void RecordStatus(Isolate* isolate, AllocationStatus status) {
 
 inline void DebugCheckZero(void* start, size_t byte_length) {
 #if DEBUG
-  // Double check memory is zero-initialized.
+  // Double check memory is zero-initialized. Despite being DEBUG-only,
+  // this function is somewhat optimized for the benefit of test suite
+  // execution times (some tests allocate several gigabytes).
   const byte* bytes = reinterpret_cast<const byte*>(start);
-  for (size_t i = 0; i < byte_length; i++) {
+  const size_t kBaseCase = 32;
+  for (size_t i = 0; i < kBaseCase && i < byte_length; i++) {
     DCHECK_EQ(0, bytes[i]);
   }
+  // Having checked the first kBaseCase bytes to be zero, we can now use
+  // {memcmp} to compare the range against itself shifted by that amount,
+  // thereby inductively checking the remaining bytes.
+  if (byte_length > kBaseCase) {
+    DCHECK_EQ(0, memcmp(bytes, bytes + kBaseCase, byte_length - kBaseCase));
+  }
 #endif
 }
 }  // namespace
@@ -140,18 +179,16 @@ BackingStore::~BackingStore() {
     }
 
     // Wasm memories are always allocated through the page allocator.
-    auto region =
-        has_guard_regions_
-            ? GetGuardedRegion(buffer_start_, byte_length_)
-            : base::AddressRegion(reinterpret_cast<Address>(buffer_start_),
-                                  byte_capacity_);
+    auto region = GetRegion(has_guard_regions_, buffer_start_, byte_length_,
+                            byte_capacity_);
+
     bool pages_were_freed =
         region.size() == 0 /* no need to free any pages */ ||
         FreePages(GetPlatformPageAllocator(),
                   reinterpret_cast<void*>(region.begin()), region.size());
     CHECK(pages_were_freed);
-    BackingStore::ReleaseReservation(has_guard_regions_ ? kFullGuardSize
-                                                        : byte_capacity_);
+    BackingStore::ReleaseReservation(
+        GetReservationSize(has_guard_regions_, byte_capacity_));
     Clear();
     return;
   }
@@ -279,8 +316,7 @@ std::unique_ptr<BackingStore> BackingStore::TryAllocateWasmMemory(
   size_t engine_max_pages = wasm::max_mem_pages();
   size_t byte_capacity =
       std::min(engine_max_pages, maximum_pages) * wasm::kWasmPageSize;
-  size_t reservation_size =
-      guards ? static_cast<size_t>(kFullGuardSize) : byte_capacity;
+  size_t reservation_size = GetReservationSize(guards, byte_capacity);
 
   //--------------------------------------------------------------------------
   // 1. Enforce maximum address space reservation per engine.
@@ -518,7 +554,7 @@ std::unique_ptr<BackingStore> BackingStore::EmptyBackingStore(
                                  0,        // capacity
                                  shared,   // shared
                                  false,    // is_wasm_memory
-                                 false,    // free_on_destruct
+                                 true,     // free_on_destruct
                                  false,    // has_guard_regions
                                  false);   // custom_deleter
 
@@ -696,11 +732,9 @@ void GlobalBackingStoreRegistry::UpdateSharedWasmMemoryObjects(
     Handle<JSArrayBuffer> old_buffer(memory_object->array_buffer(), isolate);
     std::shared_ptr<BackingStore> backing_store = old_buffer->GetBackingStore();
 
-    if (old_buffer->byte_length() != backing_store->byte_length()) {
-      Handle<JSArrayBuffer> new_buffer =
-          isolate->factory()->NewJSSharedArrayBuffer(std::move(backing_store));
-      memory_object->update_instances(isolate, new_buffer);
-    }
+    Handle<JSArrayBuffer> new_buffer =
+        isolate->factory()->NewJSSharedArrayBuffer(std::move(backing_store));
+    memory_object->update_instances(isolate, new_buffer);
   }
 }
 
diff --git a/deps/v8/src/objects/bigint.cc b/deps/v8/src/objects/bigint.cc
index 6cc43a78e77f0d..a84cf08f028f3c 100644
--- a/deps/v8/src/objects/bigint.cc
+++ b/deps/v8/src/objects/bigint.cc
@@ -2695,7 +2695,7 @@ void MutableBigInt::set_64_bits(uint64_t bits) {
 }
 
 #ifdef OBJECT_PRINT
-void BigInt::BigIntPrint(std::ostream& os) {
+void BigIntBase::BigIntBasePrint(std::ostream& os) {
   DisallowHeapAllocation no_gc;
   PrintHeader(os, "BigInt");
   int len = length();
diff --git a/deps/v8/src/objects/bigint.h b/deps/v8/src/objects/bigint.h
index f50e3bcf04d93f..2247c157a8fc6c 100644
--- a/deps/v8/src/objects/bigint.h
+++ b/deps/v8/src/objects/bigint.h
@@ -41,10 +41,6 @@ class BigIntBase : public PrimitiveHeapObject {
     return LengthBits::decode(static_cast<uint32_t>(bitfield));
   }
 
-  static inline BigIntBase unchecked_cast(Object o) {
-    return bit_cast<BigIntBase>(o);
-  }
-
   // The maximum kMaxLengthBits that the current implementation supports
   // would be kMaxInt - kSystemPointerSize * kBitsPerByte - 1.
   // Since we want a platform independent limit, choose a nice round number
@@ -57,7 +53,7 @@ class BigIntBase : public PrimitiveHeapObject {
   // able to read the length concurrently, the getters and setters are atomic.
   static const int kLengthFieldBits = 30;
   STATIC_ASSERT(kMaxLength <= ((1 << kLengthFieldBits) - 1));
-  using SignBits = BitField<bool, 0, 1>;
+  using SignBits = base::BitField<bool, 0, 1>;
   using LengthBits = SignBits::Next<int, kLengthFieldBits>;
   STATIC_ASSERT(LengthBits::kLastUsedBit < 32);
 
@@ -76,6 +72,10 @@ class BigIntBase : public PrimitiveHeapObject {
     return FIELD_SIZE(kOptionalPaddingOffset) > 0;
   }
 
+  DECL_CAST(BigIntBase)
+  DECL_VERIFIER(BigIntBase)
+  DECL_PRINTER(BigIntBase)
+
  private:
   friend class ::v8::internal::BigInt;  // MSVC wants full namespace.
   friend class MutableBigInt;
@@ -102,9 +102,6 @@ class BigIntBase : public PrimitiveHeapObject {
 
   bool is_zero() const { return length() == 0; }
 
-  // Only serves to make macros happy; other code should use IsBigInt.
-  bool IsBigIntBase() const { return true; }
-
   OBJECT_CONSTRUCTORS(BigIntBase, PrimitiveHeapObject);
 };
 
@@ -217,8 +214,6 @@ class BigInt : public BigIntBase {
   void ToWordsArray64(int* sign_bit, int* words64_count, uint64_t* words);
 
   DECL_CAST(BigInt)
-  DECL_VERIFIER(BigInt)
-  DECL_PRINTER(BigInt)
   void BigIntShortPrint(std::ostream& os);
 
   inline static int SizeFor(int length) {
diff --git a/deps/v8/src/objects/cell.tq b/deps/v8/src/objects/cell.tq
new file mode 100644
index 00000000000000..9f825fc57591e8
--- /dev/null
+++ b/deps/v8/src/objects/cell.tq
@@ -0,0 +1,8 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+extern class Cell extends HeapObject {
+  value: Object;
+}
diff --git a/deps/v8/src/objects/code-inl.h b/deps/v8/src/objects/code-inl.h
index 6e00a3363cd7d1..d02ead4bbe754b 100644
--- a/deps/v8/src/objects/code-inl.h
+++ b/deps/v8/src/objects/code-inl.h
@@ -29,7 +29,6 @@ OBJECT_CONSTRUCTORS_IMPL(BytecodeArray, FixedArrayBase)
 OBJECT_CONSTRUCTORS_IMPL(AbstractCode, HeapObject)
 OBJECT_CONSTRUCTORS_IMPL(DependentCode, WeakFixedArray)
 OBJECT_CONSTRUCTORS_IMPL(CodeDataContainer, HeapObject)
-TQ_OBJECT_CONSTRUCTORS_IMPL(SourcePositionTableWithFrameCache)
 
 NEVER_READ_ONLY_SPACE_IMPL(AbstractCode)
 
@@ -64,20 +63,6 @@ ByteArray AbstractCode::source_position_table() {
   }
 }
 
-Object AbstractCode::stack_frame_cache() {
-  Object maybe_table;
-  if (IsCode()) {
-    maybe_table = GetCode().source_position_table();
-  } else {
-    maybe_table = GetBytecodeArray().source_position_table();
-  }
-  if (maybe_table.IsSourcePositionTableWithFrameCache()) {
-    return SourcePositionTableWithFrameCache::cast(maybe_table)
-        .stack_frame_cache();
-  }
-  return Smi::kZero;
-}
-
 int AbstractCode::SizeIncludingMetadata() {
   if (IsCode()) {
     return GetCode().SizeIncludingMetadata();
@@ -238,10 +223,8 @@ ByteArray Code::SourcePositionTableIfCollected() const {
 ByteArray Code::SourcePositionTable() const {
   Object maybe_table = source_position_table();
   DCHECK(!maybe_table.IsUndefined() && !maybe_table.IsException());
-  if (maybe_table.IsByteArray()) return ByteArray::cast(maybe_table);
-  DCHECK(maybe_table.IsSourcePositionTableWithFrameCache());
-  return SourcePositionTableWithFrameCache::cast(maybe_table)
-      .source_position_table();
+  DCHECK(maybe_table.IsByteArray());
+  return ByteArray::cast(maybe_table);
 }
 
 Object Code::next_code_link() const {
@@ -253,10 +236,7 @@ void Code::set_next_code_link(Object value) {
 }
 
 int Code::InstructionSize() const {
-  if (is_off_heap_trampoline()) {
-    DCHECK(FLAG_embedded_builtins);
-    return OffHeapInstructionSize();
-  }
+  if (is_off_heap_trampoline()) return OffHeapInstructionSize();
   return raw_instruction_size();
 }
 
@@ -265,10 +245,7 @@ Address Code::raw_instruction_start() const {
 }
 
 Address Code::InstructionStart() const {
-  if (is_off_heap_trampoline()) {
-    DCHECK(FLAG_embedded_builtins);
-    return OffHeapInstructionStart();
-  }
+  if (is_off_heap_trampoline()) return OffHeapInstructionStart();
   return raw_instruction_start();
 }
 
@@ -277,10 +254,7 @@ Address Code::raw_instruction_end() const {
 }
 
 Address Code::InstructionEnd() const {
-  if (is_off_heap_trampoline()) {
-    DCHECK(FLAG_embedded_builtins);
-    return OffHeapInstructionEnd();
-  }
+  if (is_off_heap_trampoline()) return OffHeapInstructionEnd();
   return raw_instruction_end();
 }
 
@@ -325,7 +299,7 @@ int Code::SizeIncludingMetadata() const {
 }
 
 ByteArray Code::unchecked_relocation_info() const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return ByteArray::unchecked_cast(
       TaggedField<HeapObject, kRelocationInfoOffset>::load(isolate, *this));
 }
@@ -346,7 +320,6 @@ Address Code::entry() const { return raw_instruction_start(); }
 
 bool Code::contains(Address inner_pointer) {
   if (is_off_heap_trampoline()) {
-    DCHECK(FLAG_embedded_builtins);
     if (OffHeapInstructionStart() <= inner_pointer &&
         inner_pointer < OffHeapInstructionEnd()) {
       return true;
@@ -597,6 +570,11 @@ bool Code::IsWeakObjectInOptimizedCode(HeapObject object) {
          InstanceTypeChecker::IsContext(instance_type);
 }
 
+bool Code::IsExecutable() {
+  return !Builtins::IsBuiltinId(builtin_index()) || !is_off_heap_trampoline() ||
+         Builtins::CodeObjectIsExecutable(builtin_index());
+}
+
 // This field has to have relaxed atomic accessors because it is accessed in the
 // concurrent marker.
 RELAXED_INT32_ACCESSORS(CodeDataContainer, kind_specific_flags,
@@ -725,12 +703,8 @@ ByteArray BytecodeArray::SourcePositionTable() const {
   Object maybe_table = source_position_table();
   if (maybe_table.IsByteArray()) return ByteArray::cast(maybe_table);
   ReadOnlyRoots roots = GetReadOnlyRoots();
-  if (maybe_table.IsException(roots)) return roots.empty_byte_array();
-
-  DCHECK(!maybe_table.IsUndefined(roots));
-  DCHECK(maybe_table.IsSourcePositionTableWithFrameCache());
-  return SourcePositionTableWithFrameCache::cast(maybe_table)
-      .source_position_table();
+  DCHECK(maybe_table.IsException(roots));
+  return roots.empty_byte_array();
 }
 
 ByteArray BytecodeArray::SourcePositionTableIfCollected() const {
@@ -739,16 +713,6 @@ ByteArray BytecodeArray::SourcePositionTableIfCollected() const {
   return SourcePositionTable();
 }
 
-void BytecodeArray::ClearFrameCacheFromSourcePositionTable() {
-  Object maybe_table = source_position_table();
-  if (maybe_table.IsUndefined() || maybe_table.IsByteArray() ||
-      maybe_table.IsException())
-    return;
-  DCHECK(maybe_table.IsSourcePositionTableWithFrameCache());
-  set_source_position_table(SourcePositionTableWithFrameCache::cast(maybe_table)
-                                .source_position_table());
-}
-
 int BytecodeArray::BytecodeArraySize() { return SizeFor(this->length()); }
 
 int BytecodeArray::SizeIncludingMetadata() {
diff --git a/deps/v8/src/objects/code.cc b/deps/v8/src/objects/code.cc
index a477a7da26fe18..7f650bebfb7251 100644
--- a/deps/v8/src/objects/code.cc
+++ b/deps/v8/src/objects/code.cc
@@ -154,63 +154,6 @@ Address Code::OffHeapInstructionEnd() const {
          d.InstructionSizeOfBuiltin(builtin_index());
 }
 
-namespace {
-template <typename Code>
-void SetStackFrameCacheCommon(Isolate* isolate, Handle<Code> code,
-                              Handle<SimpleNumberDictionary> cache) {
-  Handle<Object> maybe_table(code->source_position_table(), isolate);
-  if (maybe_table->IsException(isolate) || maybe_table->IsUndefined()) return;
-  if (maybe_table->IsSourcePositionTableWithFrameCache()) {
-    Handle<SourcePositionTableWithFrameCache>::cast(maybe_table)
-        ->set_stack_frame_cache(*cache);
-    return;
-  }
-  DCHECK(maybe_table->IsByteArray());
-  Handle<ByteArray> table(Handle<ByteArray>::cast(maybe_table));
-  Handle<SourcePositionTableWithFrameCache> table_with_cache =
-      isolate->factory()->NewSourcePositionTableWithFrameCache(table, cache);
-  code->set_source_position_table(*table_with_cache);
-}
-}  // namespace
-
-// static
-void AbstractCode::SetStackFrameCache(Handle<AbstractCode> abstract_code,
-                                      Handle<SimpleNumberDictionary> cache) {
-  if (abstract_code->IsCode()) {
-    SetStackFrameCacheCommon(
-        abstract_code->GetIsolate(),
-        handle(abstract_code->GetCode(), abstract_code->GetIsolate()), cache);
-  } else {
-    SetStackFrameCacheCommon(
-        abstract_code->GetIsolate(),
-        handle(abstract_code->GetBytecodeArray(), abstract_code->GetIsolate()),
-        cache);
-  }
-}
-
-namespace {
-template <typename Code>
-void DropStackFrameCacheCommon(Code code) {
-  i::Object maybe_table = code.source_position_table();
-  if (maybe_table.IsUndefined() || maybe_table.IsByteArray() ||
-      maybe_table.IsException()) {
-    return;
-  }
-  DCHECK(maybe_table.IsSourcePositionTableWithFrameCache());
-  code.set_source_position_table(
-      i::SourcePositionTableWithFrameCache::cast(maybe_table)
-          .source_position_table());
-}
-}  // namespace
-
-void AbstractCode::DropStackFrameCache() {
-  if (IsCode()) {
-    DropStackFrameCacheCommon(GetCode());
-  } else {
-    DropStackFrameCacheCommon(GetBytecodeArray());
-  }
-}
-
 int AbstractCode::SourcePosition(int offset) {
   Object maybe_table = source_position_table();
   if (maybe_table.IsException()) return kNoSourcePosition;
@@ -657,8 +600,6 @@ inline void DisassembleCodeRange(Isolate* isolate, std::ostream& os, Code code,
                                  Address begin, size_t size,
                                  Address current_pc) {
   Address end = begin + size;
-  // TODO(mstarzinger): Refactor CodeReference to avoid the
-  // unhandlified->handlified transition.
   AllowHandleAllocation allow_handles;
   DisallowHeapAllocation no_gc;
   HandleScope handle_scope(isolate);
@@ -871,6 +812,14 @@ void BytecodeArray::Disassemble(std::ostream& os) {
     table.HandlerTableRangePrint(os);
   }
 #endif
+
+  os << "Source Position Table (size = "
+     << SourcePositionTableIfCollected().length() << ")\n";
+#ifdef OBJECT_PRINT
+  if (SourcePositionTableIfCollected().length() > 0) {
+    os << Brief(SourcePositionTableIfCollected()) << std::endl;
+  }
+#endif
 }
 
 void BytecodeArray::CopyBytecodesTo(BytecodeArray to) {
@@ -885,8 +834,7 @@ void BytecodeArray::MakeOlder() {
   // BytecodeArray is aged in concurrent marker.
   // The word must be completely within the byte code array.
   Address age_addr = address() + kBytecodeAgeOffset;
-  DCHECK_LE(RoundDown(age_addr, kSystemPointerSize) + kSystemPointerSize,
-            address() + Size());
+  DCHECK_LE(RoundDown(age_addr, kTaggedSize) + kTaggedSize, address() + Size());
   Age age = bytecode_age();
   if (age < kLastBytecodeAge) {
     base::AsAtomic8::Release_CompareAndSwap(reinterpret_cast<byte*>(age_addr),
diff --git a/deps/v8/src/objects/code.h b/deps/v8/src/objects/code.h
index 6f8c378093a5dc..3e8de6877d7d24 100644
--- a/deps/v8/src/objects/code.h
+++ b/deps/v8/src/objects/code.h
@@ -5,6 +5,7 @@
 #ifndef V8_OBJECTS_CODE_H_
 #define V8_OBJECTS_CODE_H_
 
+#include "src/base/bit-field.h"
 #include "src/codegen/handler-table.h"
 #include "src/objects/contexts.h"
 #include "src/objects/fixed-array.h"
@@ -87,8 +88,7 @@ class Code : public HeapObject {
   // [deoptimization_data]: Array containing data for deopt.
   DECL_ACCESSORS(deoptimization_data, FixedArray)
 
-  // [source_position_table]: ByteArray for the source positions table or
-  // SourcePositionTableWithFrameCache.
+  // [source_position_table]: ByteArray for the source positions table.
   DECL_ACCESSORS(source_position_table, Object)
   inline ByteArray SourcePositionTable() const;
   inline ByteArray SourcePositionTableIfCollected() const;
@@ -370,7 +370,11 @@ class Code : public HeapObject {
 
   static inline bool IsWeakObjectInOptimizedCode(HeapObject object);
 
-  // Return true if the function is inlined in the code.
+  // Returns false if this is an embedded builtin Code object that's in
+  // read_only_space and hence doesn't have execute permissions.
+  inline bool IsExecutable();
+
+  // Returns true if the function is inlined in the code.
   bool Inlines(SharedFunctionInfo sfi);
 
   class OptimizedCodeIterator;
@@ -430,7 +434,7 @@ class Code : public HeapObject {
 
   class BodyDescriptor;
 
-  // Flags layout.  BitField<type, shift, size>.
+  // Flags layout.  base::BitField<type, shift, size>.
 #define CODE_FLAGS_BIT_FIELDS(V, _)    \
   V(HasUnwindingInfoField, bool, 1, _) \
   V(KindField, Kind, 5, _)             \
@@ -574,9 +578,6 @@ class AbstractCode : public HeapObject {
   // Return the source position table.
   inline ByteArray source_position_table();
 
-  inline Object stack_frame_cache();
-  static void SetStackFrameCache(Handle<AbstractCode> abstract_code,
-                                 Handle<SimpleNumberDictionary> cache);
   void DropStackFrameCache();
 
   // Returns the size of instructions and the metadata.
@@ -708,8 +709,8 @@ class DependentCode : public WeakFixedArray {
 
   inline int flags();
   inline void set_flags(int flags);
-  using GroupField = BitField<int, 0, 3>;
-  using CountField = BitField<int, 3, 27>;
+  using GroupField = base::BitField<int, 0, 3>;
+  using CountField = base::BitField<int, 3, 27>;
   STATIC_ASSERT(kGroupCount <= GroupField::kMax + 1);
 
   OBJECT_CONSTRUCTORS(DependentCode, WeakFixedArray);
@@ -780,7 +781,6 @@ class BytecodeArray : public FixedArrayBase {
   // * empty_byte_array (for bytecode generated for functions that will never
   // have source positions, e.g. native functions).
   // * ByteArray (when source positions have been collected for the bytecode)
-  // * SourcePositionTableWithFrameCache (as above but with a frame cache)
   // * exception (when an error occurred while explicitly collecting source
   // positions for pre-existing bytecode).
   DECL_ACCESSORS(source_position_table, Object)
@@ -794,7 +794,6 @@ class BytecodeArray : public FixedArrayBase {
   inline ByteArray SourcePositionTableIfCollected() const;
   inline bool HasSourcePositionTable() const;
   inline bool DidSourcePositionGenerationFail() const;
-  inline void ClearFrameCacheFromSourcePositionTable();
 
   // Indicates that an attempt was made to collect source positions, but that it
   // failed most likely due to stack exhaustion. When in this state
@@ -831,7 +830,6 @@ class BytecodeArray : public FixedArrayBase {
   // Layout description.
   DEFINE_FIELD_OFFSET_CONSTANTS(FixedArrayBase::kHeaderSize,
                                 TORQUE_GENERATED_BYTECODE_ARRAY_FIELDS)
-  static constexpr int kHeaderSize = kSize;
 
   // InterpreterEntryTrampoline expects these fields to be next to each other
   // and writes a 16-bit value to reset them.
@@ -937,13 +935,6 @@ class DeoptimizationData : public FixedArray {
   OBJECT_CONSTRUCTORS(DeoptimizationData, FixedArray);
 };
 
-class SourcePositionTableWithFrameCache
-    : public TorqueGeneratedSourcePositionTableWithFrameCache<
-          SourcePositionTableWithFrameCache, Struct> {
- public:
-  TQ_OBJECT_CONSTRUCTORS(SourcePositionTableWithFrameCache)
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/code.tq b/deps/v8/src/objects/code.tq
new file mode 100644
index 00000000000000..ccf7f130c82c04
--- /dev/null
+++ b/deps/v8/src/objects/code.tq
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+type DependentCode extends WeakFixedArray;
+
+extern class BytecodeArray extends FixedArrayBase {
+  // TODO(v8:8983): bytecode array object sizes vary based on their contents.
+  constant_pool: FixedArray;
+  handler_table: ByteArray;
+  source_position_table: Undefined|ByteArray|Exception;
+  frame_size: int32;
+  parameter_size: int32;
+  incoming_new_target_or_generator_register: int32;
+  osr_nesting_level: int8;
+  bytecode_age: int8;
+}
+
+extern class CodeDataContainer extends HeapObject;
diff --git a/deps/v8/src/objects/contexts-inl.h b/deps/v8/src/objects/contexts-inl.h
index 669e98591fb8d4..33df9915646a1b 100644
--- a/deps/v8/src/objects/contexts-inl.h
+++ b/deps/v8/src/objects/contexts-inl.h
@@ -49,34 +49,15 @@ OBJECT_CONSTRUCTORS_IMPL(Context, HeapObject)
 NEVER_READ_ONLY_SPACE_IMPL(Context)
 CAST_ACCESSOR(Context)
 
-SMI_ACCESSORS(Context, length_and_extension_flag, kLengthOffset)
-SYNCHRONIZED_SMI_ACCESSORS(Context, length_and_extension_flag, kLengthOffset)
-
+SMI_ACCESSORS(Context, length, kLengthOffset)
 CAST_ACCESSOR(NativeContext)
 
-int Context::length() const {
-  return LengthField::decode(length_and_extension_flag());
-}
-
-int Context::synchronized_length() const {
-  return LengthField::decode(synchronized_length_and_extension_flag());
-}
-
-void Context::initialize_length_and_extension_bit(int len,
-                                                  Context::HasExtension flag) {
-  DCHECK(LengthField::is_valid(len));
-  int value = 0;
-  value = LengthField::update(value, len);
-  value = HasExtensionField::update(value, flag == Context::HasExtension::kYes);
-  set_length_and_extension_flag(value);
-}
-
 Object Context::get(int index) const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return get(isolate, index);
 }
 
-Object Context::get(Isolate* isolate, int index) const {
+Object Context::get(const Isolate* isolate, int index) const {
   DCHECK_LT(static_cast<unsigned>(index),
             static_cast<unsigned>(this->length()));
   return TaggedField<Object>::Relaxed_Load(isolate, *this,
@@ -115,28 +96,21 @@ void Context::set_previous(Context context) { set(PREVIOUS_INDEX, context); }
 Object Context::next_context_link() { return get(Context::NEXT_CONTEXT_LINK); }
 
 bool Context::has_extension() {
-  return static_cast<bool>(
-             HasExtensionField::decode(length_and_extension_flag())) &&
-         !extension().IsTheHole();
+  return scope_info().HasContextExtensionSlot() && !extension().IsUndefined();
 }
 
 HeapObject Context::extension() {
+  DCHECK(scope_info().HasContextExtensionSlot());
   return HeapObject::cast(get(EXTENSION_INDEX));
 }
+
 void Context::set_extension(HeapObject object) {
+  DCHECK(scope_info().HasContextExtensionSlot());
   set(EXTENSION_INDEX, object);
-  synchronized_set_length_and_extension_flag(
-      HasExtensionField::update(length_and_extension_flag(), true));
 }
 
 NativeContext Context::native_context() const {
-  Object result = get(NATIVE_CONTEXT_INDEX);
-  DCHECK(IsBootstrappingOrNativeContext(this->GetIsolate(), result));
-  return NativeContext::unchecked_cast(result);
-}
-
-void Context::set_native_context(NativeContext context) {
-  set(NATIVE_CONTEXT_INDEX, context);
+  return this->map().native_context();
 }
 
 bool Context::IsFunctionContext() const {
diff --git a/deps/v8/src/objects/contexts.cc b/deps/v8/src/objects/contexts.cc
index 9dbba06a4d4c99..5aa8a78953ae20 100644
--- a/deps/v8/src/objects/contexts.cc
+++ b/deps/v8/src/objects/contexts.cc
@@ -91,7 +91,7 @@ JSObject Context::extension_object() {
   DCHECK(IsNativeContext() || IsFunctionContext() || IsBlockContext() ||
          IsEvalContext() || IsCatchContext());
   HeapObject object = extension();
-  if (object.IsTheHole()) return JSObject();
+  if (object.IsUndefined()) return JSObject();
   DCHECK(object.IsJSContextExtensionObject() ||
          (IsNativeContext() && object.IsJSGlobalObject()));
   return JSObject::cast(object);
@@ -135,11 +135,11 @@ JSGlobalProxy Context::global_proxy() {
  * Lookups a property in an object environment, taking the unscopables into
  * account. This is used For HasBinding spec algorithms for ObjectEnvironment.
  */
-static Maybe<bool> UnscopableLookup(LookupIterator* it) {
+static Maybe<bool> UnscopableLookup(LookupIterator* it, bool is_with_context) {
   Isolate* isolate = it->isolate();
 
   Maybe<bool> found = JSReceiver::HasProperty(it);
-  if (found.IsNothing() || !found.FromJust()) return found;
+  if (!is_with_context || found.IsNothing() || !found.FromJust()) return found;
 
   Handle<Object> unscopables;
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
@@ -197,11 +197,11 @@ Handle<Object> Context::Lookup(Handle<Context> context, Handle<String> name,
     }
 
     // 1. Check global objects, subjects of with, and extension objects.
-    DCHECK_IMPLIES(context->IsEvalContext(),
+    DCHECK_IMPLIES(context->IsEvalContext() && context->has_extension(),
                    context->extension().IsTheHole(isolate));
     if ((context->IsNativeContext() || context->IsWithContext() ||
          context->IsFunctionContext() || context->IsBlockContext()) &&
-        !context->extension_receiver().is_null()) {
+        context->has_extension() && !context->extension_receiver().is_null()) {
       Handle<JSReceiver> object(context->extension_receiver(), isolate);
 
       if (context->IsNativeContext()) {
@@ -234,7 +234,7 @@ Handle<Object> Context::Lookup(Handle<Context> context, Handle<String> name,
       if ((flags & FOLLOW_PROTOTYPE_CHAIN) == 0 ||
           object->IsJSContextExtensionObject()) {
         maybe = JSReceiver::GetOwnPropertyAttributes(object, name);
-      } else if (context->IsWithContext()) {
+      } else {
         // A with context will never bind "this", but debug-eval may look into
         // a with context when resolving "this". Other synthetic variables such
         // as new.target may be resolved as VariableMode::kDynamicLocal due to
@@ -243,10 +243,11 @@ Handle<Object> Context::Lookup(Handle<Context> context, Handle<String> name,
         // TODO(v8:5405): Replace this check with a DCHECK when resolution of
         // of synthetic variables does not go through this code path.
         if (ScopeInfo::VariableIsSynthetic(*name)) {
+          DCHECK(context->IsWithContext());
           maybe = Just(ABSENT);
         } else {
-          LookupIterator it(object, name, object);
-          Maybe<bool> found = UnscopableLookup(&it);
+          LookupIterator it(isolate, object, name, object);
+          Maybe<bool> found = UnscopableLookup(&it, context->IsWithContext());
           if (found.IsNothing()) {
             maybe = Nothing<PropertyAttributes>();
           } else {
@@ -256,8 +257,6 @@ Handle<Object> Context::Lookup(Handle<Context> context, Handle<String> name,
             maybe = Just(found.FromJust() ? NONE : ABSENT);
           }
         }
-      } else {
-        maybe = JSReceiver::GetPropertyAttributes(object, name);
       }
 
       if (maybe.IsNothing()) return Handle<Object>();
@@ -290,6 +289,17 @@ Handle<Object> Context::Lookup(Handle<Context> context, Handle<String> name,
                                       &maybe_assigned_flag, &is_static_flag);
       DCHECK(slot_index < 0 || slot_index >= MIN_CONTEXT_SLOTS);
       if (slot_index >= 0) {
+        // Re-direct lookup to the ScriptContextTable in case we find a hole in
+        // a REPL script context. REPL scripts allow re-declaration of
+        // script-level let bindings. The value itself is stored in the script
+        // context of the first script that declared a variable, all other
+        // script contexts will contain 'the hole' for that particular name.
+        if (scope_info.IsReplModeScope() &&
+            context->get(slot_index).IsTheHole(isolate)) {
+          context = Handle<Context>(context->previous(), isolate);
+          continue;
+        }
+
         if (FLAG_trace_contexts) {
           PrintF("=> found local in context slot %d (mode = %hhu)\n",
                  slot_index, static_cast<uint8_t>(mode));
@@ -349,7 +359,7 @@ Handle<Object> Context::Lookup(Handle<Context> context, Handle<String> name,
       Object ext = context->get(EXTENSION_INDEX);
       if (ext.IsJSReceiver()) {
         Handle<JSReceiver> extension(JSReceiver::cast(ext), isolate);
-        LookupIterator it(extension, name, extension);
+        LookupIterator it(isolate, extension, name, extension);
         Maybe<bool> found = JSReceiver::HasProperty(&it);
         if (found.FromMaybe(false)) {
           *attributes = NONE;
@@ -431,8 +441,12 @@ int Context::IntrinsicIndexForName(Handle<String> string) {
 
 #undef COMPARE_NAME
 
-#define COMPARE_NAME(index, type, name) \
-  if (strncmp(string, #name, length) == 0) return index;
+#define COMPARE_NAME(index, type, name)                                      \
+  {                                                                          \
+    const int name_length = static_cast<int>(arraysize(#name)) - 1;          \
+    if ((length == name_length) && strncmp(string, #name, name_length) == 0) \
+      return index;                                                          \
+  }
 
 int Context::IntrinsicIndexForName(const unsigned char* unsigned_string,
                                    int length) {
@@ -445,13 +459,6 @@ int Context::IntrinsicIndexForName(const unsigned char* unsigned_string,
 
 #ifdef DEBUG
 
-bool Context::IsBootstrappingOrNativeContext(Isolate* isolate, Object object) {
-  // During bootstrapping we allow all objects to pass as global
-  // objects. This is necessary to fix circular dependencies.
-  return isolate->heap()->gc_state() != Heap::NOT_IN_GC ||
-         isolate->bootstrapper()->IsActive() || object.IsNativeContext();
-}
-
 bool Context::IsBootstrappingOrValidParentContext(Object object,
                                                   Context child) {
   // During bootstrapping we allow all objects to pass as
@@ -474,15 +481,14 @@ void NativeContext::IncrementErrorsThrown() {
 
 int NativeContext::GetErrorsThrown() { return errors_thrown().value(); }
 
-STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);
+STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 2);
+STATIC_ASSERT(Context::MIN_CONTEXT_EXTENDED_SLOTS == 3);
 STATIC_ASSERT(NativeContext::kScopeInfoOffset ==
               Context::OffsetOfElementAt(NativeContext::SCOPE_INFO_INDEX));
 STATIC_ASSERT(NativeContext::kPreviousOffset ==
               Context::OffsetOfElementAt(NativeContext::PREVIOUS_INDEX));
 STATIC_ASSERT(NativeContext::kExtensionOffset ==
               Context::OffsetOfElementAt(NativeContext::EXTENSION_INDEX));
-STATIC_ASSERT(NativeContext::kNativeContextOffset ==
-              Context::OffsetOfElementAt(NativeContext::NATIVE_CONTEXT_INDEX));
 
 STATIC_ASSERT(NativeContext::kStartOfStrongFieldsOffset ==
               Context::OffsetOfElementAt(-1));
diff --git a/deps/v8/src/objects/contexts.h b/deps/v8/src/objects/contexts.h
index 7fa988be07027f..2289cd6210de09 100644
--- a/deps/v8/src/objects/contexts.h
+++ b/deps/v8/src/objects/contexts.h
@@ -119,8 +119,7 @@ enum ContextLookupFlags {
   V(ERROR_MESSAGE_FOR_CODE_GEN_FROM_STRINGS_INDEX, Object,                     \
     error_message_for_code_gen_from_strings)                                   \
   V(ERRORS_THROWN_INDEX, Smi, errors_thrown)                                   \
-  V(EXTRAS_EXPORTS_OBJECT_INDEX, JSObject, extras_binding_object)              \
-  V(EXTRAS_UTILS_OBJECT_INDEX, Object, extras_utils_object)                    \
+  V(EXTRAS_BINDING_OBJECT_INDEX, JSObject, extras_binding_object)              \
   V(FAST_ALIASED_ARGUMENTS_MAP_INDEX, Map, fast_aliased_arguments_map)         \
   V(FAST_TEMPLATE_INSTANTIATIONS_CACHE_INDEX, FixedArray,                      \
     fast_template_instantiations_cache)                                        \
@@ -161,6 +160,8 @@ enum ContextLookupFlags {
   V(INTL_COLLATOR_FUNCTION_INDEX, JSFunction, intl_collator_function)          \
   V(INTL_DATE_TIME_FORMAT_FUNCTION_INDEX, JSFunction,                          \
     intl_date_time_format_function)                                            \
+  V(INTL_DISPLAY_NAMES_FUNCTION_INDEX, JSFunction,                             \
+    intl_display_names_function)                                               \
   V(INTL_NUMBER_FORMAT_FUNCTION_INDEX, JSFunction,                             \
     intl_number_format_function)                                               \
   V(INTL_LOCALE_FUNCTION_INDEX, JSFunction, intl_locale_function)              \
@@ -194,6 +195,17 @@ enum ContextLookupFlags {
   V(JS_WEAK_REF_FUNCTION_INDEX, JSFunction, js_weak_ref_fun)                   \
   V(JS_FINALIZATION_GROUP_FUNCTION_INDEX, JSFunction,                          \
     js_finalization_group_fun)                                                 \
+  /* Context maps */                                                           \
+  V(NATIVE_CONTEXT_MAP_INDEX, Map, native_context_map)                         \
+  V(FUNCTION_CONTEXT_MAP_INDEX, Map, function_context_map)                     \
+  V(MODULE_CONTEXT_MAP_INDEX, Map, module_context_map)                         \
+  V(EVAL_CONTEXT_MAP_INDEX, Map, eval_context_map)                             \
+  V(SCRIPT_CONTEXT_MAP_INDEX, Map, script_context_map)                         \
+  V(AWAIT_CONTEXT_MAP_INDEX, Map, await_context_map)                           \
+  V(BLOCK_CONTEXT_MAP_INDEX, Map, block_context_map)                           \
+  V(CATCH_CONTEXT_MAP_INDEX, Map, catch_context_map)                           \
+  V(WITH_CONTEXT_MAP_INDEX, Map, with_context_map)                             \
+  V(DEBUG_EVALUATE_CONTEXT_MAP_INDEX, Map, debug_evaluate_context_map)         \
   V(MAP_CACHE_INDEX, Object, map_cache)                                        \
   V(MAP_KEY_ITERATOR_MAP_INDEX, Map, map_key_iterator_map)                     \
   V(MAP_KEY_VALUE_ITERATOR_MAP_INDEX, Map, map_key_value_iterator_map)         \
@@ -206,7 +218,6 @@ enum ContextLookupFlags {
   V(NUMBER_FUNCTION_INDEX, JSFunction, number_function)                        \
   V(OBJECT_FUNCTION_INDEX, JSFunction, object_function)                        \
   V(OBJECT_FUNCTION_PROTOTYPE_MAP_INDEX, Map, object_function_prototype_map)   \
-  V(OPAQUE_REFERENCE_FUNCTION_INDEX, JSFunction, opaque_reference_function)    \
   V(PROXY_CALLABLE_MAP_INDEX, Map, proxy_callable_map)                         \
   V(PROXY_CONSTRUCTOR_MAP_INDEX, Map, proxy_constructor_map)                   \
   V(PROXY_FUNCTION_INDEX, JSFunction, proxy_function)                          \
@@ -420,12 +431,14 @@ class ScriptContextTable : public FixedArray {
 //
 // [ previous       ]  A pointer to the previous context.
 //
-// [ extension      ]  Additional data.
+// [ extension      ]  Additional data. This slot is only available when
+//                     extension_bit is set. Check using has_extension.
 //
 //                     For native contexts, it contains the global object.
 //                     For module contexts, it contains the module object.
 //                     For await contexts, it contains the generator object.
-//                     For block contexts, it may contain an "extension object".
+//                     For var block contexts, it may contain an "extension
+//                     object".
 //                     For with contexts, it contains an "extension object".
 //
 //                     An "extension object" is used to dynamically extend a
@@ -436,11 +449,10 @@ class ScriptContextTable : public FixedArray {
 //                     extension object is the original purpose of this context
 //                     slot, hence the name.)
 //
-// [ native_context ]  A pointer to the native context.
-//
-// In addition, function contexts may have statically allocated context slots
-// to store local variables/functions that are accessed from inner functions
-// (via static context addresses) or through 'eval' (dynamic context lookups).
+// In addition, function contexts with sloppy eval may have statically
+// allocated context slots to store local variables/functions that are accessed
+// from inner functions (via static context addresses) or through 'eval'
+// (dynamic context lookups).
 // The native context contains additional slots for fast access to native
 // properties.
 //
@@ -454,31 +466,21 @@ class Context : public HeapObject {
   NEVER_READ_ONLY_SPACE
 
   DECL_CAST(Context)
-
-  enum class HasExtension { kYes, kNo };
-
   // [length]: length of the context.
   V8_INLINE int length() const;
-  V8_INLINE int synchronized_length() const;
-  V8_INLINE void initialize_length_and_extension_bit(
-      int len, HasExtension flag = HasExtension::kNo);
-
-  // We use the 30th bit. Otherwise if we set the 31st bit,
-  // the number would be pottentially bigger than an SMI.
-  // Any DCHECK(Smi::IsValue(...)) would fail.
-  using LengthField = BitField<int, 0, kSmiValueSize - 2>;
-  using HasExtensionField = BitField<int, kSmiValueSize - 2, 1>;
+  V8_INLINE void set_length(int value);
 
   // Setter and getter for elements.
   V8_INLINE Object get(int index) const;
-  V8_INLINE Object get(Isolate* isolate, int index) const;
+  V8_INLINE Object get(const Isolate* isolate, int index) const;
   V8_INLINE void set(int index, Object value);
   // Setter with explicit barrier mode.
   V8_INLINE void set(int index, Object value, WriteBarrierMode mode);
 
   DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
                                 TORQUE_GENERATED_CONTEXT_FIELDS)
-  // TODO(v8:8989): [torque] Support marker constants.
+
+  // TODO(v8:8989): [torque] Support marker constants
   /* TODO(ishell): remove this fixedArray-like header size. */
   static const int kFixedArrayLikeHeaderSize = kScopeInfoOffset;
   static const int kStartOfTaggedFieldsOffset = kScopeInfoOffset;
@@ -487,10 +489,11 @@ class Context : public HeapObject {
   /* is removed in favour of offset-based access to common fields. */ \
   static const int kTodoHeaderSize = kHeaderSize;
 
+  // If the extension slot exists, it is the first slot after the header.
+  static const int kExtensionOffset = kHeaderSize;
+
   // Garbage collection support.
   V8_INLINE static constexpr int SizeFor(int length) {
-    // TODO(ishell): switch to kTodoHeaderSize based approach once we no longer
-    // reference common Context fields via index
     return kFixedArrayLikeHeaderSize + length * kTaggedSize;
   }
 
@@ -512,8 +515,9 @@ class Context : public HeapObject {
     // These slots are in all contexts.
     SCOPE_INFO_INDEX,
     PREVIOUS_INDEX,
+
+    // This slot only exists if the extension_flag bit is set.
     EXTENSION_INDEX,
-    NATIVE_CONTEXT_INDEX,
 
 // These slots are only in native contexts.
 #define NATIVE_CONTEXT_SLOT(index, type, name) index,
@@ -532,16 +536,21 @@ class Context : public HeapObject {
     FIRST_JS_ARRAY_MAP_SLOT = JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX,
 
     // TODO(shell): Remove, once it becomes zero
-    MIN_CONTEXT_SLOTS = GLOBAL_PROXY_INDEX,
+    MIN_CONTEXT_SLOTS = EXTENSION_INDEX,
+    MIN_CONTEXT_EXTENDED_SLOTS = EXTENSION_INDEX + 1,
 
     // This slot holds the thrown value in catch contexts.
     THROWN_OBJECT_INDEX = MIN_CONTEXT_SLOTS,
 
     // These slots hold values in debug evaluate contexts.
-    WRAPPED_CONTEXT_INDEX = MIN_CONTEXT_SLOTS,
-    BLACK_LIST_INDEX = MIN_CONTEXT_SLOTS + 1
+    WRAPPED_CONTEXT_INDEX = MIN_CONTEXT_EXTENDED_SLOTS,
+    BLACK_LIST_INDEX = MIN_CONTEXT_EXTENDED_SLOTS + 1
   };
 
+  static const int kExtensionSize =
+      (MIN_CONTEXT_EXTENDED_SLOTS - MIN_CONTEXT_SLOTS) * kTaggedSize;
+  static const int kExtendedHeaderSize = kHeaderSize + kExtensionSize;
+
   // A region of native context entries containing maps for functions created
   // by Builtins::kFastNewClosure.
   static const int FIRST_FUNCTION_MAP_INDEX = SLOPPY_FUNCTION_MAP_INDEX;
@@ -589,7 +598,6 @@ class Context : public HeapObject {
 
   // Compute the native context.
   inline NativeContext native_context() const;
-  inline void set_native_context(NativeContext context);
 
   // Predicates for context types.  IsNativeContext is already defined on
   // Object.
@@ -667,8 +675,6 @@ class Context : public HeapObject {
  private:
 #ifdef DEBUG
   // Bootstrapping-aware type checks.
-  V8_EXPORT_PRIVATE static bool IsBootstrappingOrNativeContext(Isolate* isolate,
-                                                               Object object);
   static bool IsBootstrappingOrValidParentContext(Object object, Context kid);
 #endif
 
@@ -693,7 +699,7 @@ class NativeContext : public Context {
 #define NATIVE_CONTEXT_FIELDS_DEF(V)                                        \
   /* TODO(ishell): move definition of common context offsets to Context. */ \
   V(kStartOfNativeContextFieldsOffset,                                      \
-    (FIRST_WEAK_SLOT - MIN_CONTEXT_SLOTS) * kTaggedSize)                    \
+    (FIRST_WEAK_SLOT - MIN_CONTEXT_EXTENDED_SLOTS) * kTaggedSize)           \
   V(kEndOfStrongFieldsOffset, 0)                                            \
   V(kStartOfWeakFieldsOffset,                                               \
     (NATIVE_CONTEXT_SLOTS - FIRST_WEAK_SLOT) * kTaggedSize)                 \
@@ -705,7 +711,7 @@ class NativeContext : public Context {
   /* Total size. */                                                         \
   V(kSize, 0)
 
-  DEFINE_FIELD_OFFSET_CONSTANTS(Context::kTodoHeaderSize,
+  DEFINE_FIELD_OFFSET_CONSTANTS(Context::kExtendedHeaderSize,
                                 NATIVE_CONTEXT_FIELDS_DEF)
 #undef NATIVE_CONTEXT_FIELDS_DEF
 
diff --git a/deps/v8/src/objects/contexts.tq b/deps/v8/src/objects/contexts.tq
new file mode 100644
index 00000000000000..5af3011d515f6c
--- /dev/null
+++ b/deps/v8/src/objects/contexts.tq
@@ -0,0 +1,78 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@abstract
+extern class Context extends HeapObject {
+  length: Smi;
+  scope_info: ScopeInfo;
+  previous: Object;
+}
+extern class AwaitContext extends Context generates 'TNode<Context>';
+extern class BlockContext extends Context generates 'TNode<Context>';
+extern class CatchContext extends Context generates 'TNode<Context>';
+extern class DebugEvaluateContext extends Context
+    generates 'TNode<Context>';
+extern class EvalContext extends Context generates 'TNode<Context>';
+extern class FunctionContext extends Context generates 'TNode<Context>';
+extern class ModuleContext extends Context generates 'TNode<Context>';
+extern class NativeContext extends Context;
+extern class ScriptContext extends Context generates 'TNode<Context>';
+extern class WithContext extends Context generates 'TNode<Context>';
+
+const MIN_CONTEXT_SLOTS: constexpr int31
+    generates 'Context::MIN_CONTEXT_SLOTS';
+
+extern enum NativeContextSlot extends intptr constexpr 'Context::Field' {
+  ARRAY_BUFFER_FUN_INDEX,
+  ARRAY_BUFFER_NOINIT_FUN_INDEX,
+  ARRAY_BUFFER_MAP_INDEX,
+  ARRAY_FUNCTION_INDEX,
+  ARRAY_JOIN_STACK_INDEX,
+  OBJECT_FUNCTION_INDEX,
+  ITERATOR_RESULT_MAP_INDEX,
+  JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX,
+  JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX,
+  MATH_RANDOM_CACHE_INDEX,
+  MATH_RANDOM_INDEX_INDEX,
+  PROXY_REVOCABLE_RESULT_MAP_INDEX,
+  REFLECT_APPLY_INDEX,
+  REGEXP_FUNCTION_INDEX,
+  REGEXP_LAST_MATCH_INFO_INDEX,
+  INITIAL_STRING_ITERATOR_MAP_INDEX,
+  SLOW_OBJECT_WITH_NULL_PROTOTYPE_MAP,
+  STRICT_ARGUMENTS_MAP_INDEX,
+  SLOPPY_ARGUMENTS_MAP_INDEX,
+  FAST_ALIASED_ARGUMENTS_MAP_INDEX,
+
+  PROMISE_FUNCTION_INDEX,
+  PROMISE_THEN_INDEX,
+  PROMISE_ALL_RESOLVE_ELEMENT_SHARED_FUN,
+  PROMISE_ALL_SETTLED_REJECT_ELEMENT_SHARED_FUN,
+  PROMISE_ALL_SETTLED_RESOLVE_ELEMENT_SHARED_FUN,
+  PROMISE_CAPABILITY_DEFAULT_RESOLVE_SHARED_FUN_INDEX,
+  PROMISE_CAPABILITY_DEFAULT_REJECT_SHARED_FUN_INDEX,
+  PROMISE_CATCH_FINALLY_SHARED_FUN,
+  PROMISE_GET_CAPABILITIES_EXECUTOR_SHARED_FUN,
+  PROMISE_PROTOTYPE_INDEX,
+  PROMISE_THROWER_FINALLY_SHARED_FUN,
+  PROMISE_THEN_FINALLY_SHARED_FUN,
+  PROMISE_VALUE_THUNK_FINALLY_SHARED_FUN,
+  STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX,
+  ...
+}
+
+extern operator '[]' macro LoadContextElement(
+    NativeContext, NativeContextSlot): Object;
+extern operator '[]=' macro StoreContextElement(
+    NativeContext, NativeContextSlot, Object): void;
+
+type ContextSlot generates 'TNode<IntPtrT>' constexpr 'int32_t';
+const PROXY_SLOT: constexpr ContextSlot
+    generates 'Context::MIN_CONTEXT_SLOTS';
+extern operator '[]' macro LoadContextElement(Context, ContextSlot): Object;
+extern operator '[]=' macro StoreContextElement(
+    Context, ContextSlot, Object): void;
+
+extern operator '[]' macro LoadContextElement(Context, intptr): Object;
+extern operator '[]' macro LoadContextElement(Context, Smi): Object;
diff --git a/deps/v8/src/objects/data-handler.tq b/deps/v8/src/objects/data-handler.tq
new file mode 100644
index 00000000000000..aacccc137719c6
--- /dev/null
+++ b/deps/v8/src/objects/data-handler.tq
@@ -0,0 +1,14 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@abstract
+extern class DataHandler extends Struct {
+  smi_handler: Smi|Code;
+  validity_cell: Smi|Cell;
+
+  // Space for the following fields may or may not be allocated.
+  @noVerifier data_1: MaybeObject;
+  @noVerifier data_2: MaybeObject;
+  @noVerifier data_3: MaybeObject;
+}
diff --git a/deps/v8/src/objects/debug-objects-inl.h b/deps/v8/src/objects/debug-objects-inl.h
index 8189481394b7a6..6a0dc76f649a60 100644
--- a/deps/v8/src/objects/debug-objects-inl.h
+++ b/deps/v8/src/objects/debug-objects-inl.h
@@ -18,16 +18,14 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(BreakPoint, Tuple2)
-OBJECT_CONSTRUCTORS_IMPL(BreakPointInfo, Tuple2)
+TQ_OBJECT_CONSTRUCTORS_IMPL(BreakPoint)
+TQ_OBJECT_CONSTRUCTORS_IMPL(BreakPointInfo)
 OBJECT_CONSTRUCTORS_IMPL(CoverageInfo, FixedArray)
 TQ_OBJECT_CONSTRUCTORS_IMPL(DebugInfo)
 
 NEVER_READ_ONLY_SPACE_IMPL(DebugInfo)
 
-CAST_ACCESSOR(BreakPointInfo)
 CAST_ACCESSOR(CoverageInfo)
-CAST_ACCESSOR(BreakPoint)
 
 TQ_SMI_ACCESSORS(DebugInfo, flags)
 TQ_SMI_ACCESSORS(DebugInfo, debugger_hints)
@@ -41,11 +39,9 @@ BIT_FIELD_ACCESSORS(DebugInfo, debugger_hints, computed_debug_is_blackboxed,
 BIT_FIELD_ACCESSORS(DebugInfo, debugger_hints, debugging_id,
                     DebugInfo::DebuggingIdBits)
 
-SMI_ACCESSORS(BreakPointInfo, source_position, kSourcePositionOffset)
-ACCESSORS(BreakPointInfo, break_points, Object, kBreakPointsOffset)
+TQ_SMI_ACCESSORS(BreakPointInfo, source_position)
 
-SMI_ACCESSORS(BreakPoint, id, kIdOffset)
-ACCESSORS(BreakPoint, condition, String, kConditionOffset)
+TQ_SMI_ACCESSORS(BreakPoint, id)
 
 bool DebugInfo::HasInstrumentedBytecodeArray() {
   DCHECK_EQ(debug_bytecode_array().IsBytecodeArray(),
diff --git a/deps/v8/src/objects/debug-objects.cc b/deps/v8/src/objects/debug-objects.cc
index 5087918e75147f..3f7f55f8526119 100644
--- a/deps/v8/src/objects/debug-objects.cc
+++ b/deps/v8/src/objects/debug-objects.cc
@@ -321,6 +321,32 @@ bool BreakPointInfo::HasBreakPoint(Isolate* isolate,
   return false;
 }
 
+MaybeHandle<BreakPoint> BreakPointInfo::GetBreakPointById(
+    Isolate* isolate, Handle<BreakPointInfo> break_point_info,
+    int breakpoint_id) {
+  // No break point.
+  if (break_point_info->break_points().IsUndefined(isolate)) {
+    return MaybeHandle<BreakPoint>();
+  }
+  // Single break point.
+  if (!break_point_info->break_points().IsFixedArray()) {
+    BreakPoint breakpoint = BreakPoint::cast(break_point_info->break_points());
+    if (breakpoint.id() == breakpoint_id) {
+      return handle(breakpoint, isolate);
+    }
+  } else {
+    // Multiple break points.
+    FixedArray array = FixedArray::cast(break_point_info->break_points());
+    for (int i = 0; i < array.length(); i++) {
+      BreakPoint breakpoint = BreakPoint::cast(array.get(i));
+      if (breakpoint.id() == breakpoint_id) {
+        return handle(breakpoint, isolate);
+      }
+    }
+  }
+  return MaybeHandle<BreakPoint>();
+}
+
 // Get the number of break points.
 int BreakPointInfo::GetBreakPointCount(Isolate* isolate) {
   // No break point.
@@ -359,7 +385,7 @@ void CoverageInfo::InitializeSlot(int slot_index, int from_pos, int to_pos) {
   const int slot_start = CoverageInfo::FirstIndexForSlot(slot_index);
   set(slot_start + kSlotStartSourcePositionIndex, Smi::FromInt(from_pos));
   set(slot_start + kSlotEndSourcePositionIndex, Smi::FromInt(to_pos));
-  set(slot_start + kSlotBlockCountIndex, Smi::kZero);
+  set(slot_start + kSlotBlockCountIndex, Smi::zero());
 }
 
 void CoverageInfo::IncrementBlockCount(int slot_index) {
@@ -372,7 +398,7 @@ void CoverageInfo::IncrementBlockCount(int slot_index) {
 void CoverageInfo::ResetBlockCount(int slot_index) {
   DCHECK_LT(slot_index, SlotCount());
   const int slot_start = CoverageInfo::FirstIndexForSlot(slot_index);
-  set(slot_start + kSlotBlockCountIndex, Smi::kZero);
+  set(slot_start + kSlotBlockCountIndex, Smi::zero());
 }
 
 void CoverageInfo::Print(std::unique_ptr<char[]> function_name) {
diff --git a/deps/v8/src/objects/debug-objects.h b/deps/v8/src/objects/debug-objects.h
index 39f42c11688608..321ac11cdaae25 100644
--- a/deps/v8/src/objects/debug-objects.h
+++ b/deps/v8/src/objects/debug-objects.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "src/base/bit-field.h"
 #include "src/objects/fixed-array.h"
 #include "src/objects/objects.h"
 #include "src/objects/struct.h"
@@ -161,12 +162,11 @@ class DebugInfo : public TorqueGeneratedDebugInfo<DebugInfo, Struct> {
 // The BreakPointInfo class holds information for break points set in a
 // function. The DebugInfo object holds a BreakPointInfo object for each code
 // position with one or more break points.
-class BreakPointInfo : public Tuple2 {
+class BreakPointInfo
+    : public TorqueGeneratedBreakPointInfo<BreakPointInfo, Struct> {
  public:
   // The position in the source for the break position.
   DECL_INT_ACCESSORS(source_position)
-  // List of related JavaScript break points.
-  DECL_ACCESSORS(break_points, Object)
 
   // Removes a break point.
   static void ClearBreakPoint(Isolate* isolate, Handle<BreakPointInfo> info,
@@ -177,17 +177,16 @@ class BreakPointInfo : public Tuple2 {
   // Check if break point info has this break point.
   static bool HasBreakPoint(Isolate* isolate, Handle<BreakPointInfo> info,
                             Handle<BreakPoint> break_point);
+  // Check if break point info has break point with this id.
+  static MaybeHandle<BreakPoint> GetBreakPointById(Isolate* isolate,
+                                                   Handle<BreakPointInfo> info,
+                                                   int breakpoint_id);
   // Get the number of break points for this code offset.
   int GetBreakPointCount(Isolate* isolate);
 
   int GetStatementPosition(Handle<DebugInfo> debug_info);
 
-  DECL_CAST(BreakPointInfo)
-
-  static const int kSourcePositionOffset = kValue1Offset;
-  static const int kBreakPointsOffset = kValue2Offset;
-
-  OBJECT_CONSTRUCTORS(BreakPointInfo, Tuple2);
+  TQ_OBJECT_CONSTRUCTORS(BreakPointInfo)
 };
 
 // Holds information related to block code coverage.
@@ -235,17 +234,11 @@ class CoverageInfo : public FixedArray {
 };
 
 // Holds breakpoint related information. This object is used by inspector.
-class BreakPoint : public Tuple2 {
+class BreakPoint : public TorqueGeneratedBreakPoint<BreakPoint, Struct> {
  public:
   DECL_INT_ACCESSORS(id)
-  DECL_ACCESSORS(condition, String)
-
-  DECL_CAST(BreakPoint)
-
-  static const int kIdOffset = kValue1Offset;
-  static const int kConditionOffset = kValue2Offset;
 
-  OBJECT_CONSTRUCTORS(BreakPoint, Tuple2);
+  TQ_OBJECT_CONSTRUCTORS(BreakPoint)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/debug-objects.tq b/deps/v8/src/objects/debug-objects.tq
new file mode 100644
index 00000000000000..fb52af5a51b482
--- /dev/null
+++ b/deps/v8/src/objects/debug-objects.tq
@@ -0,0 +1,39 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+@generatePrint
+extern class BreakPoint extends Struct {
+  id: Smi;
+  condition: String;
+}
+
+@generateCppClass
+@generatePrint
+extern class BreakPointInfo extends Struct {
+  // The position in the source for the break position.
+  source_position: Smi;
+  // List of related JavaScript break points.
+  break_points: FixedArray|BreakPoint|Undefined;
+}
+
+type CoverageInfo extends FixedArray;
+
+@generateCppClass
+extern class DebugInfo extends Struct {
+  shared: SharedFunctionInfo;
+  debugger_hints: Smi;
+  // Script field from shared function info.
+  script: Undefined|Script;
+  // The original uninstrumented bytecode array for functions with break
+  // points - the instrumented bytecode is held in the shared function info.
+  original_bytecode_array: Undefined|BytecodeArray;
+  // The debug instrumented bytecode array for functions with break points
+  // - also pointed to by the shared function info.
+  debug_bytecode_array: Undefined|BytecodeArray;
+  // Fixed array holding status information for each active break point.
+  break_points: FixedArray;
+  flags: Smi;
+  coverage_info: CoverageInfo|Undefined;
+}
diff --git a/deps/v8/src/objects/descriptor-array-inl.h b/deps/v8/src/objects/descriptor-array-inl.h
index 5ea14c1e6003c7..cfbc4f7ec81465 100644
--- a/deps/v8/src/objects/descriptor-array-inl.h
+++ b/deps/v8/src/objects/descriptor-array-inl.h
@@ -105,11 +105,11 @@ ObjectSlot DescriptorArray::GetDescriptorSlot(int descriptor) {
 }
 
 Name DescriptorArray::GetKey(InternalIndex descriptor_number) const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return GetKey(isolate, descriptor_number);
 }
 
-Name DescriptorArray::GetKey(Isolate* isolate,
+Name DescriptorArray::GetKey(const Isolate* isolate,
                              InternalIndex descriptor_number) const {
   DCHECK_LT(descriptor_number.as_int(), number_of_descriptors());
   int entry_offset = OffsetOfDescriptorAt(descriptor_number.as_int());
@@ -128,11 +128,12 @@ int DescriptorArray::GetSortedKeyIndex(int descriptor_number) {
 }
 
 Name DescriptorArray::GetSortedKey(int descriptor_number) {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return GetSortedKey(isolate, descriptor_number);
 }
 
-Name DescriptorArray::GetSortedKey(Isolate* isolate, int descriptor_number) {
+Name DescriptorArray::GetSortedKey(const Isolate* isolate,
+                                   int descriptor_number) {
   return GetKey(isolate, InternalIndex(GetSortedKeyIndex(descriptor_number)));
 }
 
@@ -142,11 +143,11 @@ void DescriptorArray::SetSortedKey(int descriptor_number, int pointer) {
 }
 
 Object DescriptorArray::GetStrongValue(InternalIndex descriptor_number) {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return GetStrongValue(isolate, descriptor_number);
 }
 
-Object DescriptorArray::GetStrongValue(Isolate* isolate,
+Object DescriptorArray::GetStrongValue(const Isolate* isolate,
                                        InternalIndex descriptor_number) {
   return GetValue(isolate, descriptor_number).cast<Object>();
 }
@@ -160,11 +161,11 @@ void DescriptorArray::SetValue(InternalIndex descriptor_number,
 }
 
 MaybeObject DescriptorArray::GetValue(InternalIndex descriptor_number) {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return GetValue(isolate, descriptor_number);
 }
 
-MaybeObject DescriptorArray::GetValue(Isolate* isolate,
+MaybeObject DescriptorArray::GetValue(const Isolate* isolate,
                                       InternalIndex descriptor_number) {
   DCHECK_LT(descriptor_number.as_int(), number_of_descriptors());
   int entry_offset = OffsetOfDescriptorAt(descriptor_number.as_int());
@@ -191,11 +192,11 @@ int DescriptorArray::GetFieldIndex(InternalIndex descriptor_number) {
 }
 
 FieldType DescriptorArray::GetFieldType(InternalIndex descriptor_number) {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return GetFieldType(isolate, descriptor_number);
 }
 
-FieldType DescriptorArray::GetFieldType(Isolate* isolate,
+FieldType DescriptorArray::GetFieldType(const Isolate* isolate,
                                         InternalIndex descriptor_number) {
   DCHECK_EQ(GetDetails(descriptor_number).location(), kField);
   MaybeObject wrapped_type = GetValue(isolate, descriptor_number);
diff --git a/deps/v8/src/objects/descriptor-array.h b/deps/v8/src/objects/descriptor-array.h
index 73b94b7cfa2c69..0085a1d78dc698 100644
--- a/deps/v8/src/objects/descriptor-array.h
+++ b/deps/v8/src/objects/descriptor-array.h
@@ -7,6 +7,7 @@
 
 #include "src/objects/fixed-array.h"
 // TODO(jkummerow): Consider forward-declaring instead.
+#include "src/base/bit-field.h"
 #include "src/objects/internal-index.h"
 #include "src/objects/objects.h"
 #include "src/objects/struct.h"
@@ -65,21 +66,22 @@ class DescriptorArray : public HeapObject {
 
   // Accessors for fetching instance descriptor at descriptor number.
   inline Name GetKey(InternalIndex descriptor_number) const;
-  inline Name GetKey(Isolate* isolate, InternalIndex descriptor_number) const;
+  inline Name GetKey(const Isolate* isolate,
+                     InternalIndex descriptor_number) const;
   inline Object GetStrongValue(InternalIndex descriptor_number);
-  inline Object GetStrongValue(Isolate* isolate,
+  inline Object GetStrongValue(const Isolate* isolate,
                                InternalIndex descriptor_number);
   inline MaybeObject GetValue(InternalIndex descriptor_number);
-  inline MaybeObject GetValue(Isolate* isolate,
+  inline MaybeObject GetValue(const Isolate* isolate,
                               InternalIndex descriptor_number);
   inline PropertyDetails GetDetails(InternalIndex descriptor_number);
   inline int GetFieldIndex(InternalIndex descriptor_number);
   inline FieldType GetFieldType(InternalIndex descriptor_number);
-  inline FieldType GetFieldType(Isolate* isolate,
+  inline FieldType GetFieldType(const Isolate* isolate,
                                 InternalIndex descriptor_number);
 
   inline Name GetSortedKey(int descriptor_number);
-  inline Name GetSortedKey(Isolate* isolate, int descriptor_number);
+  inline Name GetSortedKey(const Isolate* isolate, int descriptor_number);
   inline int GetSortedKeyIndex(int descriptor_number);
 
   // Accessor for complete descriptor.
@@ -154,7 +156,7 @@ class DescriptorArray : public HeapObject {
     return OffsetOfDescriptorAt(number_of_all_descriptors);
   }
   static constexpr int OffsetOfDescriptorAt(int descriptor) {
-    return kHeaderSize + descriptor * kEntrySize * kTaggedSize;
+    return kDescriptorsOffset + descriptor * kEntrySize * kTaggedSize;
   }
   inline ObjectSlot GetFirstPointerSlot();
   inline ObjectSlot GetDescriptorSlot(int descriptor);
@@ -163,6 +165,8 @@ class DescriptorArray : public HeapObject {
                 "Weak fields follow strong fields.");
   static_assert(kEndOfWeakFieldsOffset == kHeaderSize,
                 "Weak fields extend up to the end of the header.");
+  static_assert(kDescriptorsOffset == kHeaderSize,
+                "Variable-size array follows header.");
   // We use this visitor to also visitor to also visit the enum_cache, which is
   // the only tagged field in the header, and placed at the end of the header.
   using BodyDescriptor = FlexibleWeakBodyDescriptor<kStartOfStrongFieldsOffset>;
diff --git a/deps/v8/src/objects/descriptor-array.tq b/deps/v8/src/objects/descriptor-array.tq
new file mode 100644
index 00000000000000..ac512235c068d1
--- /dev/null
+++ b/deps/v8/src/objects/descriptor-array.tq
@@ -0,0 +1,26 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generatePrint
+@generateCppClass
+extern class EnumCache extends Struct {
+  keys: FixedArray;
+  indices: FixedArray;
+}
+
+@export
+struct DescriptorEntry {
+  key: Name|Undefined;
+  details: Smi|Undefined;
+  value: JSAny|Weak<Map>|AccessorInfo|AccessorPair|ClassPositions;
+}
+
+extern class DescriptorArray extends HeapObject {
+  number_of_all_descriptors: uint16;
+  number_of_descriptors: uint16;
+  raw_number_of_marked_descriptors: uint16;
+  filler16_bits: uint16;
+  enum_cache: EnumCache;
+  descriptors[number_of_all_descriptors]: DescriptorEntry;
+}
diff --git a/deps/v8/src/objects/dictionary-inl.h b/deps/v8/src/objects/dictionary-inl.h
index 3a5b8cb3c7e201..965fcb989c5407 100644
--- a/deps/v8/src/objects/dictionary-inl.h
+++ b/deps/v8/src/objects/dictionary-inl.h
@@ -30,28 +30,32 @@ Dictionary<Derived, Shape>::Dictionary(Address ptr)
     : HashTable<Derived, Shape>(ptr) {}
 
 template <typename Derived, typename Shape>
-Object Dictionary<Derived, Shape>::ValueAt(int entry) {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+Object Dictionary<Derived, Shape>::ValueAt(InternalIndex entry) {
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return ValueAt(isolate, entry);
 }
 
 template <typename Derived, typename Shape>
-Object Dictionary<Derived, Shape>::ValueAt(Isolate* isolate, int entry) {
-  return this->get(isolate, DerivedHashTable::EntryToIndex(entry) + 1);
+Object Dictionary<Derived, Shape>::ValueAt(const Isolate* isolate,
+                                           InternalIndex entry) {
+  return this->get(isolate, DerivedHashTable::EntryToIndex(entry) +
+                                Derived::kEntryValueIndex);
 }
 
 template <typename Derived, typename Shape>
-void Dictionary<Derived, Shape>::ValueAtPut(int entry, Object value) {
-  this->set(DerivedHashTable::EntryToIndex(entry) + 1, value);
+void Dictionary<Derived, Shape>::ValueAtPut(InternalIndex entry, Object value) {
+  this->set(DerivedHashTable::EntryToIndex(entry) + Derived::kEntryValueIndex,
+            value);
 }
 
 template <typename Derived, typename Shape>
-PropertyDetails Dictionary<Derived, Shape>::DetailsAt(int entry) {
+PropertyDetails Dictionary<Derived, Shape>::DetailsAt(InternalIndex entry) {
   return Shape::DetailsAt(Derived::cast(*this), entry);
 }
 
 template <typename Derived, typename Shape>
-void Dictionary<Derived, Shape>::DetailsAtPut(Isolate* isolate, int entry,
+void Dictionary<Derived, Shape>::DetailsAtPut(Isolate* isolate,
+                                              InternalIndex entry,
                                               PropertyDetails value) {
   Shape::DetailsAtPut(isolate, Derived::cast(*this), entry, value);
 }
@@ -124,14 +128,15 @@ void NumberDictionary::set_requires_slow_elements() {
 }
 
 template <typename Derived, typename Shape>
-void Dictionary<Derived, Shape>::ClearEntry(Isolate* isolate, int entry) {
+void Dictionary<Derived, Shape>::ClearEntry(Isolate* isolate,
+                                            InternalIndex entry) {
   Object the_hole = this->GetReadOnlyRoots().the_hole_value();
   PropertyDetails details = PropertyDetails::Empty();
   Derived::cast(*this).SetEntry(isolate, entry, the_hole, the_hole, details);
 }
 
 template <typename Derived, typename Shape>
-void Dictionary<Derived, Shape>::SetEntry(Isolate* isolate, int entry,
+void Dictionary<Derived, Shape>::SetEntry(Isolate* isolate, InternalIndex entry,
                                           Object key, Object value,
                                           PropertyDetails details) {
   DCHECK(Dictionary::kEntrySize == 2 || Dictionary::kEntrySize == 3);
@@ -144,12 +149,18 @@ void Dictionary<Derived, Shape>::SetEntry(Isolate* isolate, int entry,
   if (Shape::kHasDetails) DetailsAtPut(isolate, entry, details);
 }
 
+template <typename Derived, typename Shape>
+ObjectSlot Dictionary<Derived, Shape>::RawFieldOfValueAt(InternalIndex entry) {
+  return this->RawFieldOfElementAt(DerivedHashTable::EntryToIndex(entry) +
+                                   Derived::kEntryValueIndex);
+}
+
 template <typename Key>
 template <typename Dictionary>
 PropertyDetails BaseDictionaryShape<Key>::DetailsAt(Dictionary dict,
-                                                    int entry) {
+                                                    InternalIndex entry) {
   STATIC_ASSERT(Dictionary::kEntrySize == 3);
-  DCHECK_GE(entry, 0);  // Not found is -1, which is not caught by get().
+  DCHECK(entry.is_found());
   return PropertyDetails(Smi::cast(dict.get(Dictionary::EntryToIndex(entry) +
                                             Dictionary::kEntryDetailsIndex)));
 }
@@ -157,11 +168,12 @@ PropertyDetails BaseDictionaryShape<Key>::DetailsAt(Dictionary dict,
 template <typename Key>
 template <typename Dictionary>
 void BaseDictionaryShape<Key>::DetailsAtPut(Isolate* isolate, Dictionary dict,
-                                            int entry, PropertyDetails value) {
-    STATIC_ASSERT(Dictionary::kEntrySize == 3);
-    dict.set(Dictionary::EntryToIndex(entry) + Dictionary::kEntryDetailsIndex,
-             value.AsSmi());
-  }
+                                            InternalIndex entry,
+                                            PropertyDetails value) {
+  STATIC_ASSERT(Dictionary::kEntrySize == 3);
+  dict.set(Dictionary::EntryToIndex(entry) + Dictionary::kEntryDetailsIndex,
+           value.AsSmi());
+}
 
 Object GlobalDictionaryShape::Unwrap(Object object) {
   return PropertyCell::cast(object).name();
@@ -171,12 +183,12 @@ RootIndex GlobalDictionaryShape::GetMapRootIndex() {
   return RootIndex::kGlobalDictionaryMap;
 }
 
-Name NameDictionary::NameAt(int entry) {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+Name NameDictionary::NameAt(InternalIndex entry) {
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return NameAt(isolate, entry);
 }
 
-Name NameDictionary::NameAt(Isolate* isolate, int entry) {
+Name NameDictionary::NameAt(const Isolate* isolate, InternalIndex entry) {
   return Name::cast(KeyAt(isolate, entry));
 }
 
@@ -184,12 +196,13 @@ RootIndex NameDictionaryShape::GetMapRootIndex() {
   return RootIndex::kNameDictionaryMap;
 }
 
-PropertyCell GlobalDictionary::CellAt(int entry) {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+PropertyCell GlobalDictionary::CellAt(InternalIndex entry) {
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return CellAt(isolate, entry);
 }
 
-PropertyCell GlobalDictionary::CellAt(Isolate* isolate, int entry) {
+PropertyCell GlobalDictionary::CellAt(const Isolate* isolate,
+                                      InternalIndex entry) {
   DCHECK(KeyAt(isolate, entry).IsPropertyCell(isolate));
   return PropertyCell::cast(KeyAt(isolate, entry));
 }
@@ -203,32 +216,33 @@ bool GlobalDictionaryShape::IsKey(ReadOnlyRoots roots, Object k) {
   return IsLive(roots, k) && !PropertyCell::cast(k).value().IsTheHole(roots);
 }
 
-Name GlobalDictionary::NameAt(int entry) {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+Name GlobalDictionary::NameAt(InternalIndex entry) {
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return NameAt(isolate, entry);
 }
 
-Name GlobalDictionary::NameAt(Isolate* isolate, int entry) {
+Name GlobalDictionary::NameAt(const Isolate* isolate, InternalIndex entry) {
   return CellAt(isolate, entry).name(isolate);
 }
 
-Object GlobalDictionary::ValueAt(int entry) {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+Object GlobalDictionary::ValueAt(InternalIndex entry) {
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return ValueAt(isolate, entry);
 }
 
-Object GlobalDictionary::ValueAt(Isolate* isolate, int entry) {
+Object GlobalDictionary::ValueAt(const Isolate* isolate, InternalIndex entry) {
   return CellAt(isolate, entry).value(isolate);
 }
 
-void GlobalDictionary::SetEntry(Isolate* isolate, int entry, Object key,
-                                Object value, PropertyDetails details) {
+void GlobalDictionary::SetEntry(Isolate* isolate, InternalIndex entry,
+                                Object key, Object value,
+                                PropertyDetails details) {
   DCHECK_EQ(key, PropertyCell::cast(value).name());
   set(EntryToIndex(entry) + kEntryKeyIndex, value);
   DetailsAtPut(isolate, entry, details);
 }
 
-void GlobalDictionary::ValueAtPut(int entry, Object value) {
+void GlobalDictionary::ValueAtPut(InternalIndex entry, Object value) {
   set(EntryToIndex(entry), value);
 }
 
@@ -292,15 +306,17 @@ Handle<Object> NameDictionaryShape::AsHandle(Isolate* isolate,
 }
 
 template <typename Dictionary>
-PropertyDetails GlobalDictionaryShape::DetailsAt(Dictionary dict, int entry) {
-  DCHECK_LE(0, entry);  // Not found is -1, which is not caught by get().
+PropertyDetails GlobalDictionaryShape::DetailsAt(Dictionary dict,
+                                                 InternalIndex entry) {
+  DCHECK(entry.is_found());
   return dict.CellAt(entry).property_details();
 }
 
 template <typename Dictionary>
 void GlobalDictionaryShape::DetailsAtPut(Isolate* isolate, Dictionary dict,
-                                         int entry, PropertyDetails value) {
-  DCHECK_LE(0, entry);  // Not found is -1, which is not caught by get().
+                                         InternalIndex entry,
+                                         PropertyDetails value) {
+  DCHECK(entry.is_found());
   PropertyCell cell = dict.CellAt(entry);
   if (cell.property_details().IsReadOnly() != value.IsReadOnly()) {
     cell.dependent_code().DeoptimizeDependentCodeGroup(
diff --git a/deps/v8/src/objects/dictionary.h b/deps/v8/src/objects/dictionary.h
index eb15a77e33e63b..66b601dbca09eb 100644
--- a/deps/v8/src/objects/dictionary.h
+++ b/deps/v8/src/objects/dictionary.h
@@ -31,21 +31,22 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) Dictionary
  public:
   using Key = typename Shape::Key;
   // Returns the value at entry.
-  inline Object ValueAt(int entry);
-  inline Object ValueAt(Isolate* isolate, int entry);
+  inline Object ValueAt(InternalIndex entry);
+  inline Object ValueAt(const Isolate* isolate, InternalIndex entry);
 
   // Set the value for entry.
-  inline void ValueAtPut(int entry, Object value);
+  inline void ValueAtPut(InternalIndex entry, Object value);
 
   // Returns the property details for the property at entry.
-  inline PropertyDetails DetailsAt(int entry);
+  inline PropertyDetails DetailsAt(InternalIndex entry);
 
   // Set the details for entry.
-  inline void DetailsAtPut(Isolate* isolate, int entry, PropertyDetails value);
+  inline void DetailsAtPut(Isolate* isolate, InternalIndex entry,
+                           PropertyDetails value);
 
   // Delete a property from the dictionary.
   V8_WARN_UNUSED_RESULT static Handle<Derived> DeleteEntry(
-      Isolate* isolate, Handle<Derived> dictionary, int entry);
+      Isolate* isolate, Handle<Derived> dictionary, InternalIndex entry);
 
   // Attempt to shrink the dictionary after deletion of key.
   V8_WARN_UNUSED_RESULT static inline Handle<Derived> Shrink(
@@ -65,13 +66,17 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) Dictionary
   Object SlowReverseLookup(Object value);
 
   // Sets the entry to (key, value) pair.
-  inline void ClearEntry(Isolate* isolate, int entry);
-  inline void SetEntry(Isolate* isolate, int entry, Object key, Object value,
-                       PropertyDetails details);
+  inline void ClearEntry(Isolate* isolate, InternalIndex entry);
+  inline void SetEntry(Isolate* isolate, InternalIndex entry, Object key,
+                       Object value, PropertyDetails details);
+
+  // Garbage collection support.
+  inline ObjectSlot RawFieldOfValueAt(InternalIndex entry);
 
   V8_WARN_UNUSED_RESULT static Handle<Derived> Add(
       Isolate* isolate, Handle<Derived> dictionary, Key key,
-      Handle<Object> value, PropertyDetails details, int* entry_out = nullptr);
+      Handle<Object> value, PropertyDetails details,
+      InternalIndex* entry_out = nullptr);
 
  protected:
   // Generic at put operation.
@@ -89,11 +94,11 @@ class BaseDictionaryShape : public BaseShape<Key> {
  public:
   static const bool kHasDetails = true;
   template <typename Dictionary>
-  static inline PropertyDetails DetailsAt(Dictionary dict, int entry);
+  static inline PropertyDetails DetailsAt(Dictionary dict, InternalIndex entry);
 
   template <typename Dictionary>
-  static inline void DetailsAtPut(Isolate* isolate, Dictionary dict, int entry,
-                                  PropertyDetails value);
+  static inline void DetailsAtPut(Isolate* isolate, Dictionary dict,
+                                  InternalIndex entry, PropertyDetails value);
 };
 
 class NameDictionaryShape : public BaseDictionaryShape<Handle<Name>> {
@@ -154,11 +159,13 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) BaseNameDictionary
 
   V8_WARN_UNUSED_RESULT static Handle<Derived> AddNoUpdateNextEnumerationIndex(
       Isolate* isolate, Handle<Derived> dictionary, Key key,
-      Handle<Object> value, PropertyDetails details, int* entry_out = nullptr);
+      Handle<Object> value, PropertyDetails details,
+      InternalIndex* entry_out = nullptr);
 
   V8_WARN_UNUSED_RESULT static Handle<Derived> Add(
       Isolate* isolate, Handle<Derived> dictionary, Key key,
-      Handle<Object> value, PropertyDetails details, int* entry_out = nullptr);
+      Handle<Object> value, PropertyDetails details,
+      InternalIndex* entry_out = nullptr);
 
   OBJECT_CONSTRUCTORS(BaseNameDictionary, Dictionary<Derived, Shape>);
 };
@@ -173,11 +180,12 @@ class V8_EXPORT_PRIVATE NameDictionary
  public:
   DECL_CAST(NameDictionary)
 
+  static const int kEntryValueIndex = 1;
   static const int kEntryDetailsIndex = 2;
   static const int kInitialCapacity = 2;
 
-  inline Name NameAt(int entry);
-  inline Name NameAt(Isolate* isolate, int entry);
+  inline Name NameAt(InternalIndex entry);
+  inline Name NameAt(const Isolate* isolate, InternalIndex entry);
 
   inline void set_hash(int hash);
   inline int hash() const;
@@ -186,7 +194,7 @@ class V8_EXPORT_PRIVATE NameDictionary
                       BaseNameDictionary<NameDictionary, NameDictionaryShape>);
 };
 
-class GlobalDictionaryShape : public NameDictionaryShape {
+class V8_EXPORT_PRIVATE GlobalDictionaryShape : public NameDictionaryShape {
  public:
   static inline bool IsMatch(Handle<Name> key, Object other);
   static inline uint32_t HashForObject(ReadOnlyRoots roots, Object object);
@@ -194,11 +202,11 @@ class GlobalDictionaryShape : public NameDictionaryShape {
   static const int kEntrySize = 1;  // Overrides NameDictionaryShape::kEntrySize
 
   template <typename Dictionary>
-  static inline PropertyDetails DetailsAt(Dictionary dict, int entry);
+  static inline PropertyDetails DetailsAt(Dictionary dict, InternalIndex entry);
 
   template <typename Dictionary>
-  static inline void DetailsAtPut(Isolate* isolate, Dictionary dict, int entry,
-                                  PropertyDetails value);
+  static inline void DetailsAtPut(Isolate* isolate, Dictionary dict,
+                                  InternalIndex entry, PropertyDetails value);
 
   static inline Object Unwrap(Object key);
   static inline bool IsKey(ReadOnlyRoots roots, Object k);
@@ -216,15 +224,15 @@ class V8_EXPORT_PRIVATE GlobalDictionary
  public:
   DECL_CAST(GlobalDictionary)
 
-  inline Object ValueAt(int entry);
-  inline Object ValueAt(Isolate* isolate, int entry);
-  inline PropertyCell CellAt(int entry);
-  inline PropertyCell CellAt(Isolate* isolate, int entry);
-  inline void SetEntry(Isolate* isolate, int entry, Object key, Object value,
-                       PropertyDetails details);
-  inline Name NameAt(int entry);
-  inline Name NameAt(Isolate* isolate, int entry);
-  inline void ValueAtPut(int entry, Object value);
+  inline Object ValueAt(InternalIndex entry);
+  inline Object ValueAt(const Isolate* isolate, InternalIndex entry);
+  inline PropertyCell CellAt(InternalIndex entry);
+  inline PropertyCell CellAt(const Isolate* isolate, InternalIndex entry);
+  inline void SetEntry(Isolate* isolate, InternalIndex entry, Object key,
+                       Object value, PropertyDetails details);
+  inline Name NameAt(InternalIndex entry);
+  inline Name NameAt(const Isolate* isolate, InternalIndex entry);
+  inline void ValueAtPut(InternalIndex entry, Object value);
 
   OBJECT_CONSTRUCTORS(
       GlobalDictionary,
@@ -255,13 +263,14 @@ class SimpleNumberDictionaryShape : public NumberDictionaryBaseShape {
   static const int kEntrySize = 2;
 
   template <typename Dictionary>
-  static inline PropertyDetails DetailsAt(Dictionary dict, int entry) {
+  static inline PropertyDetails DetailsAt(Dictionary dict,
+                                          InternalIndex entry) {
     UNREACHABLE();
   }
 
   template <typename Dictionary>
-  static inline void DetailsAtPut(Isolate* isolate, Dictionary dict, int entry,
-                                  PropertyDetails value) {
+  static inline void DetailsAtPut(Isolate* isolate, Dictionary dict,
+                                  InternalIndex entry, PropertyDetails value) {
     UNREACHABLE();
   }
 
@@ -280,8 +289,8 @@ class SimpleNumberDictionary
  public:
   DECL_CAST(SimpleNumberDictionary)
   // Type specific at put (default NONE attributes is used when adding).
-  V8_WARN_UNUSED_RESULT static Handle<SimpleNumberDictionary> Set(
-      Isolate* isolate, Handle<SimpleNumberDictionary> dictionary, uint32_t key,
+  V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT static Handle<SimpleNumberDictionary>
+  Set(Isolate* isolate, Handle<SimpleNumberDictionary> dictionary, uint32_t key,
       Handle<Object> value);
 
   static const int kEntryValueIndex = 1;
diff --git a/deps/v8/src/objects/elements-kind.cc b/deps/v8/src/objects/elements-kind.cc
index ec2b79d10b830d..78670f25bd0af2 100644
--- a/deps/v8/src/objects/elements-kind.cc
+++ b/deps/v8/src/objects/elements-kind.cc
@@ -115,7 +115,7 @@ const char* ElementsKindToString(ElementsKind kind) {
   }
 }
 
-ElementsKind kFastElementsKindSequence[kFastElementsKindCount] = {
+const ElementsKind kFastElementsKindSequence[kFastElementsKindCount] = {
     PACKED_SMI_ELEMENTS,     // 0
     HOLEY_SMI_ELEMENTS,      // 1
     PACKED_DOUBLE_ELEMENTS,  // 2
diff --git a/deps/v8/src/objects/elements-kind.h b/deps/v8/src/objects/elements-kind.h
index e1335fa3c0a89a..a09eada629e21b 100644
--- a/deps/v8/src/objects/elements-kind.h
+++ b/deps/v8/src/objects/elements-kind.h
@@ -5,10 +5,11 @@
 #ifndef V8_OBJECTS_ELEMENTS_KIND_H_
 #define V8_OBJECTS_ELEMENTS_KIND_H_
 
+#include "src/base/bits.h"
+#include "src/base/bounds.h"
 #include "src/base/macros.h"
 #include "src/common/checks.h"
 #include "src/flags/flags.h"
-#include "src/utils/utils.h"
 
 namespace v8 {
 namespace internal {
@@ -102,6 +103,14 @@ constexpr int kFastElementsKindCount =
 constexpr int kFastElementsKindPackedToHoley =
     HOLEY_SMI_ELEMENTS - PACKED_SMI_ELEMENTS;
 
+constexpr int kElementsKindBits = 5;
+STATIC_ASSERT((1 << kElementsKindBits) > LAST_ELEMENTS_KIND);
+STATIC_ASSERT((1 << (kElementsKindBits - 1)) <= LAST_ELEMENTS_KIND);
+
+constexpr int kFastElementsKindBits = 3;
+STATIC_ASSERT((1 << kFastElementsKindBits) > LAST_FAST_ELEMENTS_KIND);
+STATIC_ASSERT((1 << (kFastElementsKindBits - 1)) <= LAST_FAST_ELEMENTS_KIND);
+
 V8_EXPORT_PRIVATE int ElementsKindToShiftSize(ElementsKind elements_kind);
 V8_EXPORT_PRIVATE int ElementsKindToByteSize(ElementsKind elements_kind);
 int GetDefaultHeaderSizeForElementsKind(ElementsKind elements_kind);
@@ -119,18 +128,18 @@ inline bool IsDictionaryElementsKind(ElementsKind kind) {
 }
 
 inline bool IsSloppyArgumentsElementsKind(ElementsKind kind) {
-  return IsInRange(kind, FAST_SLOPPY_ARGUMENTS_ELEMENTS,
-                   SLOW_SLOPPY_ARGUMENTS_ELEMENTS);
+  return base::IsInRange(kind, FAST_SLOPPY_ARGUMENTS_ELEMENTS,
+                         SLOW_SLOPPY_ARGUMENTS_ELEMENTS);
 }
 
 inline bool IsStringWrapperElementsKind(ElementsKind kind) {
-  return IsInRange(kind, FAST_STRING_WRAPPER_ELEMENTS,
-                   SLOW_STRING_WRAPPER_ELEMENTS);
+  return base::IsInRange(kind, FAST_STRING_WRAPPER_ELEMENTS,
+                         SLOW_STRING_WRAPPER_ELEMENTS);
 }
 
 inline bool IsTypedArrayElementsKind(ElementsKind kind) {
-  return IsInRange(kind, FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND,
-                   LAST_FIXED_TYPED_ARRAY_ELEMENTS_KIND);
+  return base::IsInRange(kind, FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND,
+                         LAST_FIXED_TYPED_ARRAY_ELEMENTS_KIND);
 }
 
 inline bool IsTerminalElementsKind(ElementsKind kind) {
@@ -149,7 +158,7 @@ inline bool IsTransitionElementsKind(ElementsKind kind) {
 }
 
 inline bool IsDoubleElementsKind(ElementsKind kind) {
-  return IsInRange(kind, PACKED_DOUBLE_ELEMENTS, HOLEY_DOUBLE_ELEMENTS);
+  return base::IsInRange(kind, PACKED_DOUBLE_ELEMENTS, HOLEY_DOUBLE_ELEMENTS);
 }
 
 inline bool IsFixedFloatElementsKind(ElementsKind kind) {
@@ -162,8 +171,8 @@ inline bool IsDoubleOrFloatElementsKind(ElementsKind kind) {
 
 // This predicate is used for disabling respective functionality in builtins.
 inline bool IsAnyNonextensibleElementsKindUnchecked(ElementsKind kind) {
-  return IsInRange(kind, FIRST_ANY_NONEXTENSIBLE_ELEMENTS_KIND,
-                   LAST_ANY_NONEXTENSIBLE_ELEMENTS_KIND);
+  return base::IsInRange(kind, FIRST_ANY_NONEXTENSIBLE_ELEMENTS_KIND,
+                         LAST_ANY_NONEXTENSIBLE_ELEMENTS_KIND);
 }
 
 inline bool IsAnyNonextensibleElementsKind(ElementsKind kind) {
@@ -173,31 +182,33 @@ inline bool IsAnyNonextensibleElementsKind(ElementsKind kind) {
 }
 
 inline bool IsNonextensibleElementsKind(ElementsKind kind) {
-  DCHECK_IMPLIES(IsInRange(kind, PACKED_NONEXTENSIBLE_ELEMENTS,
-                           HOLEY_NONEXTENSIBLE_ELEMENTS),
+  DCHECK_IMPLIES(base::IsInRange(kind, PACKED_NONEXTENSIBLE_ELEMENTS,
+                                 HOLEY_NONEXTENSIBLE_ELEMENTS),
                  FLAG_enable_sealed_frozen_elements_kind);
-  return IsInRange(kind, PACKED_NONEXTENSIBLE_ELEMENTS,
-                   HOLEY_NONEXTENSIBLE_ELEMENTS);
+  return base::IsInRange(kind, PACKED_NONEXTENSIBLE_ELEMENTS,
+                         HOLEY_NONEXTENSIBLE_ELEMENTS);
 }
 
 inline bool IsSealedElementsKind(ElementsKind kind) {
-  DCHECK_IMPLIES(IsInRange(kind, PACKED_SEALED_ELEMENTS, HOLEY_SEALED_ELEMENTS),
-                 FLAG_enable_sealed_frozen_elements_kind);
-  return IsInRange(kind, PACKED_SEALED_ELEMENTS, HOLEY_SEALED_ELEMENTS);
+  DCHECK_IMPLIES(
+      base::IsInRange(kind, PACKED_SEALED_ELEMENTS, HOLEY_SEALED_ELEMENTS),
+      FLAG_enable_sealed_frozen_elements_kind);
+  return base::IsInRange(kind, PACKED_SEALED_ELEMENTS, HOLEY_SEALED_ELEMENTS);
 }
 
 inline bool IsFrozenElementsKind(ElementsKind kind) {
-  DCHECK_IMPLIES(IsInRange(kind, PACKED_FROZEN_ELEMENTS, HOLEY_FROZEN_ELEMENTS),
-                 FLAG_enable_sealed_frozen_elements_kind);
-  return IsInRange(kind, PACKED_FROZEN_ELEMENTS, HOLEY_FROZEN_ELEMENTS);
+  DCHECK_IMPLIES(
+      base::IsInRange(kind, PACKED_FROZEN_ELEMENTS, HOLEY_FROZEN_ELEMENTS),
+      FLAG_enable_sealed_frozen_elements_kind);
+  return base::IsInRange(kind, PACKED_FROZEN_ELEMENTS, HOLEY_FROZEN_ELEMENTS);
 }
 
 inline bool IsSmiOrObjectElementsKind(ElementsKind kind) {
-  return IsInRange(kind, PACKED_SMI_ELEMENTS, HOLEY_ELEMENTS);
+  return base::IsInRange(kind, PACKED_SMI_ELEMENTS, HOLEY_ELEMENTS);
 }
 
 inline bool IsSmiElementsKind(ElementsKind kind) {
-  return IsInRange(kind, PACKED_SMI_ELEMENTS, HOLEY_SMI_ELEMENTS);
+  return base::IsInRange(kind, PACKED_SMI_ELEMENTS, HOLEY_SMI_ELEMENTS);
 }
 
 inline bool IsFastNumberElementsKind(ElementsKind kind) {
@@ -205,7 +216,7 @@ inline bool IsFastNumberElementsKind(ElementsKind kind) {
 }
 
 inline bool IsObjectElementsKind(ElementsKind kind) {
-  return IsInRange(kind, PACKED_ELEMENTS, HOLEY_ELEMENTS);
+  return base::IsInRange(kind, PACKED_ELEMENTS, HOLEY_ELEMENTS);
 }
 
 inline bool IsAnyHoleyNonextensibleElementsKind(ElementsKind kind) {
diff --git a/deps/v8/src/objects/elements.cc b/deps/v8/src/objects/elements.cc
index 686f1a9b1aeb51..4be8e0f0bdbf86 100644
--- a/deps/v8/src/objects/elements.cc
+++ b/deps/v8/src/objects/elements.cc
@@ -228,8 +228,8 @@ void CopyDictionaryToObjectElements(Isolate* isolate, FixedArrayBase from_base,
   }
   WriteBarrierMode write_barrier_mode = GetWriteBarrierMode(to_kind);
   for (int i = 0; i < copy_size; i++) {
-    int entry = from.FindEntry(isolate, i + from_start);
-    if (entry != NumberDictionary::kNotFound) {
+    InternalIndex entry = from.FindEntry(isolate, i + from_start);
+    if (entry.is_found()) {
       Object value = from.ValueAt(entry);
       DCHECK(!value.IsTheHole(isolate));
       to.set(i + to_start, value, write_barrier_mode);
@@ -432,8 +432,8 @@ void CopyDictionaryToDoubleElements(Isolate* isolate, FixedArrayBase from_base,
     copy_size = to_length - to_start;
   }
   for (int i = 0; i < copy_size; i++) {
-    int entry = from.FindEntry(isolate, i + from_start);
-    if (entry != NumberDictionary::kNotFound) {
+    InternalIndex entry = from.FindEntry(isolate, i + from_start);
+    if (entry.is_found()) {
       to.set(i + to_start, from.ValueAt(entry).Number());
     } else {
       to.set_the_hole(i + to_start);
@@ -468,10 +468,10 @@ void SortIndices(Isolate* isolate, Handle<FixedArray> indices,
 }
 
 Maybe<bool> IncludesValueSlowPath(Isolate* isolate, Handle<JSObject> receiver,
-                                  Handle<Object> value, uint32_t start_from,
-                                  uint32_t length) {
+                                  Handle<Object> value, size_t start_from,
+                                  size_t length) {
   bool search_for_hole = value->IsUndefined(isolate);
-  for (uint32_t k = start_from; k < length; ++k) {
+  for (size_t k = start_from; k < length; ++k) {
     LookupIterator it(isolate, receiver, k);
     if (!it.IsFound()) {
       if (search_for_hole) return Just(true);
@@ -488,9 +488,9 @@ Maybe<bool> IncludesValueSlowPath(Isolate* isolate, Handle<JSObject> receiver,
 }
 
 Maybe<int64_t> IndexOfValueSlowPath(Isolate* isolate, Handle<JSObject> receiver,
-                                    Handle<Object> value, uint32_t start_from,
-                                    uint32_t length) {
-  for (uint32_t k = start_from; k < length; ++k) {
+                                    Handle<Object> value, size_t start_from,
+                                    size_t length) {
+  for (size_t k = start_from; k < length; ++k) {
     LookupIterator it(isolate, receiver, k);
     if (!it.IsFound()) {
       continue;
@@ -512,7 +512,7 @@ class InternalElementsAccessor : public ElementsAccessor {
  public:
   InternalIndex GetEntryForIndex(Isolate* isolate, JSObject holder,
                                  FixedArrayBase backing_store,
-                                 uint32_t index) override = 0;
+                                 size_t index) override = 0;
 
   PropertyDetails GetDetails(JSObject holder, InternalIndex entry) override = 0;
 };
@@ -544,22 +544,21 @@ class ElementsAccessorBase : public InternalElementsAccessor {
 
   static ElementsKind kind() { return ElementsTraits::Kind; }
 
-  static void ValidateContents(JSObject holder, int length) {}
+  static void ValidateContents(JSObject holder, size_t length) {}
 
   static void ValidateImpl(JSObject holder) {
     FixedArrayBase fixed_array_base = holder.elements();
     if (!fixed_array_base.IsHeapObject()) return;
     // Arrays that have been shifted in place can't be verified.
-    if (fixed_array_base.IsFiller()) return;
-    int length = 0;
+    if (fixed_array_base.IsFreeSpaceOrFiller()) return;
+    size_t length = 0;
     if (holder.IsJSArray()) {
       Object length_obj = JSArray::cast(holder).length();
       if (length_obj.IsSmi()) {
         length = Smi::ToInt(length_obj);
       }
     } else if (holder.IsJSTypedArray()) {
-      // TODO(bmeurer, v8:4153): Change this to size_t later.
-      length = static_cast<int>(JSTypedArray::cast(holder).length());
+      length = JSTypedArray::cast(holder).length();
     } else {
       length = fixed_array_base.length();
     }
@@ -571,27 +570,13 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     Subclass::ValidateImpl(holder);
   }
 
-  static bool IsPackedImpl(JSObject holder, FixedArrayBase backing_store,
-                           uint32_t start, uint32_t end) {
-    DisallowHeapAllocation no_gc;
-    if (IsFastPackedElementsKind(kind())) return true;
-    Isolate* isolate = holder.GetIsolate();
-    for (uint32_t i = start; i < end; i++) {
-      if (!Subclass::HasElementImpl(isolate, holder, i, backing_store,
-                                    ALL_PROPERTIES)) {
-        return false;
-      }
-    }
-    return true;
-  }
-
   bool HasElement(JSObject holder, uint32_t index, FixedArrayBase backing_store,
                   PropertyFilter filter) final {
     return Subclass::HasElementImpl(holder.GetIsolate(), holder, index,
                                     backing_store, filter);
   }
 
-  static bool HasElementImpl(Isolate* isolate, JSObject holder, uint32_t index,
+  static bool HasElementImpl(Isolate* isolate, JSObject holder, size_t index,
                              FixedArrayBase backing_store,
                              PropertyFilter filter = ALL_PROPERTIES) {
     return Subclass::GetEntryForIndexImpl(isolate, holder, backing_store, index,
@@ -628,8 +613,8 @@ class ElementsAccessorBase : public InternalElementsAccessor {
 
   static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase backing_store,
                                 InternalIndex entry) {
-    uint32_t index = GetIndexForEntryImpl(backing_store, entry);
-    return handle(BackingStore::cast(backing_store).get(index), isolate);
+    return handle(BackingStore::cast(backing_store).get(entry.as_int()),
+                  isolate);
   }
 
   void Set(Handle<JSObject> holder, InternalIndex entry, Object value) final {
@@ -752,7 +737,7 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     JSObject::ValidateElements(*array);
   }
 
-  uint32_t NumberOfElements(JSObject receiver) final {
+  size_t NumberOfElements(JSObject receiver) final {
     return Subclass::NumberOfElementsImpl(receiver, receiver.elements());
   }
 
@@ -761,7 +746,7 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     UNREACHABLE();
   }
 
-  static uint32_t GetMaxIndex(JSObject receiver, FixedArrayBase elements) {
+  static size_t GetMaxIndex(JSObject receiver, FixedArrayBase elements) {
     if (receiver.IsJSArray()) {
       DCHECK(JSArray::cast(receiver).length().IsSmi());
       return static_cast<uint32_t>(
@@ -770,8 +755,8 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     return Subclass::GetCapacityImpl(receiver, elements);
   }
 
-  static uint32_t GetMaxNumberOfEntries(JSObject receiver,
-                                        FixedArrayBase elements) {
+  static size_t GetMaxNumberOfEntries(JSObject receiver,
+                                      FixedArrayBase elements) {
     return Subclass::GetMaxIndex(receiver, elements);
   }
 
@@ -976,14 +961,14 @@ class ElementsAccessorBase : public InternalElementsAccessor {
   }
 
   Object CopyElements(Handle<Object> source, Handle<JSObject> destination,
-                      size_t length, uint32_t offset) final {
+                      size_t length, size_t offset) final {
     return Subclass::CopyElementsHandleImpl(source, destination, length,
                                             offset);
   }
 
   static Object CopyElementsHandleImpl(Handle<Object> source,
                                        Handle<JSObject> destination,
-                                       size_t length, uint32_t offset) {
+                                       size_t length, size_t offset) {
     UNREACHABLE();
   }
 
@@ -1087,15 +1072,15 @@ class ElementsAccessorBase : public InternalElementsAccessor {
       KeyAccumulator* keys) {
     DCHECK_NE(DICTIONARY_ELEMENTS, kind());
     // Non-dictionary elements can't have all-can-read accessors.
-    uint32_t length = Subclass::GetMaxIndex(*object, *backing_store);
+    size_t length = Subclass::GetMaxIndex(*object, *backing_store);
     PropertyFilter filter = keys->filter();
     Isolate* isolate = keys->isolate();
     Factory* factory = isolate->factory();
-    for (uint32_t i = 0; i < length; i++) {
+    for (size_t i = 0; i < length; i++) {
       if (Subclass::HasElementImpl(isolate, *object, i, *backing_store,
                                    filter)) {
         RETURN_FAILURE_IF_NOT_SUCCESSFUL(
-            keys->AddKey(factory->NewNumberFromUint(i)));
+            keys->AddKey(factory->NewNumberFromSize(i)));
       }
     }
     return ExceptionStatus::kSuccess;
@@ -1106,19 +1091,20 @@ class ElementsAccessorBase : public InternalElementsAccessor {
       Handle<FixedArrayBase> backing_store, GetKeysConversion convert,
       PropertyFilter filter, Handle<FixedArray> list, uint32_t* nof_indices,
       uint32_t insertion_index = 0) {
-    uint32_t length = Subclass::GetMaxIndex(*object, *backing_store);
+    size_t length = Subclass::GetMaxIndex(*object, *backing_store);
     uint32_t const kMaxStringTableEntries =
         isolate->heap()->MaxNumberToStringCacheSize();
-    for (uint32_t i = 0; i < length; i++) {
+    for (size_t i = 0; i < length; i++) {
       if (Subclass::HasElementImpl(isolate, *object, i, *backing_store,
                                    filter)) {
         if (convert == GetKeysConversion::kConvertToString) {
           bool use_cache = i < kMaxStringTableEntries;
           Handle<String> index_string =
-              isolate->factory()->Uint32ToString(i, use_cache);
+              isolate->factory()->SizeToString(i, use_cache);
           list->set(insertion_index, *index_string);
         } else {
-          list->set(insertion_index, Smi::FromInt(i));
+          Handle<Object> number = isolate->factory()->NewNumberFromSize(i);
+          list->set(insertion_index, *number);
         }
         insertion_index++;
       }
@@ -1141,19 +1127,19 @@ class ElementsAccessorBase : public InternalElementsAccessor {
       PropertyFilter filter) {
     Isolate* isolate = object->GetIsolate();
     uint32_t nof_property_keys = keys->length();
-    uint32_t initial_list_length =
+    size_t initial_list_length =
         Subclass::GetMaxNumberOfEntries(*object, *backing_store);
 
-    initial_list_length += nof_property_keys;
-    if (initial_list_length > FixedArray::kMaxLength ||
-        initial_list_length < nof_property_keys) {
+    if (initial_list_length > FixedArray::kMaxLength - nof_property_keys) {
       return isolate->Throw<FixedArray>(isolate->factory()->NewRangeError(
           MessageTemplate::kInvalidArrayLength));
     }
+    initial_list_length += nof_property_keys;
 
     // Collect the element indices into a new list.
-    MaybeHandle<FixedArray> raw_array =
-        isolate->factory()->TryNewFixedArray(initial_list_length);
+    DCHECK_LE(initial_list_length, std::numeric_limits<int>::max());
+    MaybeHandle<FixedArray> raw_array = isolate->factory()->TryNewFixedArray(
+        static_cast<int>(initial_list_length));
     Handle<FixedArray> combined_keys;
 
     // If we have a holey backing store try to precisely estimate the backing
@@ -1169,7 +1155,9 @@ class ElementsAccessorBase : public InternalElementsAccessor {
             Subclass::NumberOfElementsImpl(*object, *backing_store);
         initial_list_length += nof_property_keys;
       }
-      combined_keys = isolate->factory()->NewFixedArray(initial_list_length);
+      DCHECK_LE(initial_list_length, std::numeric_limits<int>::max());
+      combined_keys = isolate->factory()->NewFixedArray(
+          static_cast<int>(initial_list_length));
     }
 
     uint32_t nof_indices = 0;
@@ -1223,30 +1211,30 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     return backing_store.length();
   }
 
-  uint32_t GetCapacity(JSObject holder, FixedArrayBase backing_store) final {
+  size_t GetCapacity(JSObject holder, FixedArrayBase backing_store) final {
     return Subclass::GetCapacityImpl(holder, backing_store);
   }
 
   static Object FillImpl(Handle<JSObject> receiver, Handle<Object> obj_value,
-                         uint32_t start, uint32_t end) {
+                         size_t start, size_t end) {
     UNREACHABLE();
   }
 
-  Object Fill(Handle<JSObject> receiver, Handle<Object> obj_value,
-              uint32_t start, uint32_t end) override {
+  Object Fill(Handle<JSObject> receiver, Handle<Object> obj_value, size_t start,
+              size_t end) override {
     return Subclass::FillImpl(receiver, obj_value, start, end);
   }
 
   static Maybe<bool> IncludesValueImpl(Isolate* isolate,
                                        Handle<JSObject> receiver,
-                                       Handle<Object> value,
-                                       uint32_t start_from, uint32_t length) {
+                                       Handle<Object> value, size_t start_from,
+                                       size_t length) {
     return IncludesValueSlowPath(isolate, receiver, value, start_from, length);
   }
 
   Maybe<bool> IncludesValue(Isolate* isolate, Handle<JSObject> receiver,
-                            Handle<Object> value, uint32_t start_from,
-                            uint32_t length) final {
+                            Handle<Object> value, size_t start_from,
+                            size_t length) final {
     return Subclass::IncludesValueImpl(isolate, receiver, value, start_from,
                                        length);
   }
@@ -1254,26 +1242,26 @@ class ElementsAccessorBase : public InternalElementsAccessor {
   static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                          Handle<JSObject> receiver,
                                          Handle<Object> value,
-                                         uint32_t start_from, uint32_t length) {
+                                         size_t start_from, size_t length) {
     return IndexOfValueSlowPath(isolate, receiver, value, start_from, length);
   }
 
   Maybe<int64_t> IndexOfValue(Isolate* isolate, Handle<JSObject> receiver,
-                              Handle<Object> value, uint32_t start_from,
-                              uint32_t length) final {
+                              Handle<Object> value, size_t start_from,
+                              size_t length) final {
     return Subclass::IndexOfValueImpl(isolate, receiver, value, start_from,
                                       length);
   }
 
   static Maybe<int64_t> LastIndexOfValueImpl(Handle<JSObject> receiver,
                                              Handle<Object> value,
-                                             uint32_t start_from) {
+                                             size_t start_from) {
     UNREACHABLE();
   }
 
   Maybe<int64_t> LastIndexOfValue(Handle<JSObject> receiver,
                                   Handle<Object> value,
-                                  uint32_t start_from) final {
+                                  size_t start_from) final {
     return Subclass::LastIndexOfValueImpl(receiver, value, start_from);
   }
 
@@ -1281,21 +1269,20 @@ class ElementsAccessorBase : public InternalElementsAccessor {
 
   void Reverse(JSObject receiver) final { Subclass::ReverseImpl(receiver); }
 
-  static uint32_t GetIndexForEntryImpl(FixedArrayBase backing_store,
-                                       InternalIndex entry) {
-    return entry.as_uint32();
-  }
-
   static InternalIndex GetEntryForIndexImpl(Isolate* isolate, JSObject holder,
                                             FixedArrayBase backing_store,
-                                            uint32_t index,
+                                            size_t index,
                                             PropertyFilter filter) {
     DCHECK(IsFastElementsKind(kind()) ||
            IsAnyNonextensibleElementsKind(kind()));
-    uint32_t length = Subclass::GetMaxIndex(holder, backing_store);
+    size_t length = Subclass::GetMaxIndex(holder, backing_store);
     if (IsHoleyElementsKindForRead(kind())) {
-      return index < length && !BackingStore::cast(backing_store)
-                                    .is_the_hole(isolate, index)
+      DCHECK_IMPLIES(
+          index < length,
+          index <= static_cast<size_t>(std::numeric_limits<int>::max()));
+      return index < length &&
+                     !BackingStore::cast(backing_store)
+                          .is_the_hole(isolate, static_cast<int>(index))
                  ? InternalIndex(index)
                  : InternalIndex::NotFound();
     } else {
@@ -1305,7 +1292,7 @@ class ElementsAccessorBase : public InternalElementsAccessor {
 
   InternalIndex GetEntryForIndex(Isolate* isolate, JSObject holder,
                                  FixedArrayBase backing_store,
-                                 uint32_t index) final {
+                                 size_t index) final {
     return Subclass::GetEntryForIndexImpl(isolate, holder, backing_store, index,
                                           ALL_PROPERTIES);
   }
@@ -1364,7 +1351,6 @@ class DictionaryElementsAccessor
                             Handle<FixedArrayBase> backing_store) {
     Handle<NumberDictionary> dict =
         Handle<NumberDictionary>::cast(backing_store);
-    int capacity = dict->Capacity();
     uint32_t old_length = 0;
     CHECK(array->length().ToArrayLength(&old_length));
     {
@@ -1374,7 +1360,7 @@ class DictionaryElementsAccessor
         if (dict->requires_slow_elements()) {
           // Find last non-deletable element in range of elements to be
           // deleted and adjust range accordingly.
-          for (int entry = 0; entry < capacity; entry++) {
+          for (InternalIndex entry : dict->IterateEntries()) {
             Object index = dict->KeyAt(entry);
             if (dict->IsKey(roots, index)) {
               uint32_t number = static_cast<uint32_t>(index.Number());
@@ -1392,7 +1378,7 @@ class DictionaryElementsAccessor
         } else {
           // Remove elements that should be deleted.
           int removed_entries = 0;
-          for (int entry = 0; entry < capacity; entry++) {
+          for (InternalIndex entry : dict->IterateEntries()) {
             Object index = dict->KeyAt(entry);
             if (dict->IsKey(roots, index)) {
               uint32_t number = static_cast<uint32_t>(index.Number());
@@ -1425,8 +1411,7 @@ class DictionaryElementsAccessor
   static void DeleteImpl(Handle<JSObject> obj, InternalIndex entry) {
     Handle<NumberDictionary> dict(NumberDictionary::cast(obj->elements()),
                                   obj->GetIsolate());
-    dict =
-        NumberDictionary::DeleteEntry(obj->GetIsolate(), dict, entry.as_int());
+    dict = NumberDictionary::DeleteEntry(obj->GetIsolate(), dict, entry);
     obj->set_elements(*dict);
   }
 
@@ -1434,9 +1419,8 @@ class DictionaryElementsAccessor
     DisallowHeapAllocation no_gc;
     NumberDictionary dict = NumberDictionary::cast(backing_store);
     if (!dict.requires_slow_elements()) return false;
-    int capacity = dict.Capacity();
     ReadOnlyRoots roots = holder.GetReadOnlyRoots();
-    for (int i = 0; i < capacity; i++) {
+    for (InternalIndex i : dict.IterateEntries()) {
       Object key = dict.KeyAt(i);
       if (!dict.IsKey(roots, key)) continue;
       PropertyDetails details = dict.DetailsAt(i);
@@ -1447,7 +1431,7 @@ class DictionaryElementsAccessor
 
   static Object GetRaw(FixedArrayBase store, InternalIndex entry) {
     NumberDictionary backing_store = NumberDictionary::cast(store);
-    return backing_store.ValueAt(entry.as_int());
+    return backing_store.ValueAt(entry);
   }
 
   static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase backing_store,
@@ -1462,7 +1446,7 @@ class DictionaryElementsAccessor
 
   static inline void SetImpl(FixedArrayBase backing_store, InternalIndex entry,
                              Object value) {
-    NumberDictionary::cast(backing_store).ValueAtPut(entry.as_int(), value);
+    NumberDictionary::cast(backing_store).ValueAtPut(entry, value);
   }
 
   static void ReconfigureImpl(Handle<JSObject> object,
@@ -1471,12 +1455,12 @@ class DictionaryElementsAccessor
                               PropertyAttributes attributes) {
     NumberDictionary dictionary = NumberDictionary::cast(*store);
     if (attributes != NONE) object->RequireSlowElements(dictionary);
-    dictionary.ValueAtPut(entry.as_int(), *value);
-    PropertyDetails details = dictionary.DetailsAt(entry.as_int());
+    dictionary.ValueAtPut(entry, *value);
+    PropertyDetails details = dictionary.DetailsAt(entry);
     details = PropertyDetails(kData, attributes, PropertyCellType::kNoCell,
                               details.dictionary_index());
 
-    dictionary.DetailsAtPut(object->GetIsolate(), entry.as_int(), details);
+    dictionary.DetailsAtPut(object->GetIsolate(), entry, details);
   }
 
   static void AddImpl(Handle<JSObject> object, uint32_t index,
@@ -1500,35 +1484,26 @@ class DictionaryElementsAccessor
                            InternalIndex entry) {
     DisallowHeapAllocation no_gc;
     NumberDictionary dict = NumberDictionary::cast(store);
-    Object index = dict.KeyAt(entry.as_int());
+    Object index = dict.KeyAt(entry);
     return !index.IsTheHole(isolate);
   }
 
-  static uint32_t GetIndexForEntryImpl(FixedArrayBase store,
-                                       InternalIndex entry) {
-    DisallowHeapAllocation no_gc;
-    NumberDictionary dict = NumberDictionary::cast(store);
-    uint32_t result = 0;
-    CHECK(dict.KeyAt(entry.as_int()).ToArrayIndex(&result));
-    return result;
-  }
-
   static InternalIndex GetEntryForIndexImpl(Isolate* isolate, JSObject holder,
-                                            FixedArrayBase store,
-                                            uint32_t index,
+                                            FixedArrayBase store, size_t index,
                                             PropertyFilter filter) {
     DisallowHeapAllocation no_gc;
     NumberDictionary dictionary = NumberDictionary::cast(store);
-    int entry = dictionary.FindEntry(isolate, index);
-    if (entry == NumberDictionary::kNotFound) {
-      return InternalIndex::NotFound();
-    }
+    DCHECK_LE(index, std::numeric_limits<uint32_t>::max());
+    InternalIndex entry =
+        dictionary.FindEntry(isolate, static_cast<uint32_t>(index));
+    if (entry.is_not_found()) return entry;
+
     if (filter != ALL_PROPERTIES) {
       PropertyDetails details = dictionary.DetailsAt(entry);
       PropertyAttributes attr = details.attributes();
       if ((attr & filter) != 0) return InternalIndex::NotFound();
     }
-    return InternalIndex(entry);
+    return entry;
   }
 
   static PropertyDetails GetDetailsImpl(JSObject holder, InternalIndex entry) {
@@ -1537,11 +1512,12 @@ class DictionaryElementsAccessor
 
   static PropertyDetails GetDetailsImpl(FixedArrayBase backing_store,
                                         InternalIndex entry) {
-    return NumberDictionary::cast(backing_store).DetailsAt(entry.as_int());
+    return NumberDictionary::cast(backing_store).DetailsAt(entry);
   }
 
-  static uint32_t FilterKey(Handle<NumberDictionary> dictionary, int entry,
-                            Object raw_key, PropertyFilter filter) {
+  static uint32_t FilterKey(Handle<NumberDictionary> dictionary,
+                            InternalIndex entry, Object raw_key,
+                            PropertyFilter filter) {
     DCHECK(raw_key.IsNumber());
     DCHECK_LE(raw_key.Number(), kMaxUInt32);
     PropertyDetails details = dictionary->DetailsAt(entry);
@@ -1552,7 +1528,8 @@ class DictionaryElementsAccessor
 
   static uint32_t GetKeyForEntryImpl(Isolate* isolate,
                                      Handle<NumberDictionary> dictionary,
-                                     int entry, PropertyFilter filter) {
+                                     InternalIndex entry,
+                                     PropertyFilter filter) {
     DisallowHeapAllocation no_gc;
     Object raw_key = dictionary->KeyAt(entry);
     if (!dictionary->IsKey(ReadOnlyRoots(isolate), raw_key)) return kMaxUInt32;
@@ -1566,18 +1543,19 @@ class DictionaryElementsAccessor
     Isolate* isolate = keys->isolate();
     Handle<NumberDictionary> dictionary =
         Handle<NumberDictionary>::cast(backing_store);
-    int capacity = dictionary->Capacity();
     Handle<FixedArray> elements = isolate->factory()->NewFixedArray(
         GetMaxNumberOfEntries(*object, *backing_store));
     int insertion_index = 0;
     PropertyFilter filter = keys->filter();
     ReadOnlyRoots roots(isolate);
-    for (int i = 0; i < capacity; i++) {
+    for (InternalIndex i : dictionary->IterateEntries()) {
+      AllowHeapAllocation allow_gc;
       Object raw_key = dictionary->KeyAt(i);
       if (!dictionary->IsKey(roots, raw_key)) continue;
       uint32_t key = FilterKey(dictionary, i, raw_key, filter);
       if (key == kMaxUInt32) {
-        keys->AddShadowingKey(raw_key);
+        // This might allocate, but {raw_key} is not used afterwards.
+        keys->AddShadowingKey(raw_key, &allow_gc);
         continue;
       }
       elements->set(insertion_index, raw_key);
@@ -1600,8 +1578,7 @@ class DictionaryElementsAccessor
 
     Handle<NumberDictionary> dictionary =
         Handle<NumberDictionary>::cast(backing_store);
-    uint32_t capacity = dictionary->Capacity();
-    for (uint32_t i = 0; i < capacity; i++) {
+    for (InternalIndex i : dictionary->IterateEntries()) {
       uint32_t key = GetKeyForEntryImpl(isolate, dictionary, i, filter);
       if (key == kMaxUInt32) continue;
       Handle<Object> index = isolate->factory()->NewNumberFromUint(key);
@@ -1618,9 +1595,8 @@ class DictionaryElementsAccessor
     Isolate* isolate = accumulator->isolate();
     Handle<NumberDictionary> dictionary(
         NumberDictionary::cast(receiver->elements()), isolate);
-    int capacity = dictionary->Capacity();
     ReadOnlyRoots roots(isolate);
-    for (int i = 0; i < capacity; i++) {
+    for (InternalIndex i : dictionary->IterateEntries()) {
       Object k = dictionary->KeyAt(i);
       if (!dictionary->IsKey(roots, k)) continue;
       Object value = dictionary->ValueAt(i);
@@ -1633,18 +1609,17 @@ class DictionaryElementsAccessor
   }
 
   static bool IncludesValueFastPath(Isolate* isolate, Handle<JSObject> receiver,
-                                    Handle<Object> value, uint32_t start_from,
-                                    uint32_t length, Maybe<bool>* result) {
+                                    Handle<Object> value, size_t start_from,
+                                    size_t length, Maybe<bool>* result) {
     DisallowHeapAllocation no_gc;
     NumberDictionary dictionary = NumberDictionary::cast(receiver->elements());
-    int capacity = dictionary.Capacity();
     Object the_hole = ReadOnlyRoots(isolate).the_hole_value();
     Object undefined = ReadOnlyRoots(isolate).undefined_value();
 
     // Scan for accessor properties. If accessors are present, then elements
     // must be accessed in order via the slow path.
     bool found = false;
-    for (int i = 0; i < capacity; ++i) {
+    for (InternalIndex i : dictionary.IterateEntries()) {
       Object k = dictionary.KeyAt(i);
       if (k == the_hole) continue;
       if (k == undefined) continue;
@@ -1670,8 +1645,8 @@ class DictionaryElementsAccessor
 
   static Maybe<bool> IncludesValueImpl(Isolate* isolate,
                                        Handle<JSObject> receiver,
-                                       Handle<Object> value,
-                                       uint32_t start_from, uint32_t length) {
+                                       Handle<Object> value, size_t start_from,
+                                       size_t length) {
     DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
     bool search_for_hole = value->IsUndefined(isolate);
 
@@ -1686,18 +1661,18 @@ class DictionaryElementsAccessor
     USE(original_elements_kind);
     Handle<NumberDictionary> dictionary(
         NumberDictionary::cast(receiver->elements()), isolate);
-    // Iterate through entire range, as accessing elements out of order is
-    // observable
-    for (uint32_t k = start_from; k < length; ++k) {
+    // Iterate through the entire range, as accessing elements out of order is
+    // observable.
+    for (size_t k = start_from; k < length; ++k) {
       DCHECK_EQ(receiver->GetElementsKind(), original_elements_kind);
-      int entry = dictionary->FindEntry(isolate, k);
-      if (entry == NumberDictionary::kNotFound) {
+      InternalIndex entry =
+          dictionary->FindEntry(isolate, static_cast<uint32_t>(k));
+      if (entry.is_not_found()) {
         if (search_for_hole) return Just(true);
         continue;
       }
 
-      PropertyDetails details =
-          GetDetailsImpl(*dictionary, InternalIndex(entry));
+      PropertyDetails details = GetDetailsImpl(*dictionary, entry);
       switch (details.kind()) {
         case kData: {
           Object element_k = dictionary->ValueAt(entry);
@@ -1752,7 +1727,7 @@ class DictionaryElementsAccessor
   static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                          Handle<JSObject> receiver,
                                          Handle<Object> value,
-                                         uint32_t start_from, uint32_t length) {
+                                         size_t start_from, size_t length) {
     DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
 
     ElementsKind original_elements_kind = receiver->GetElementsKind();
@@ -1761,10 +1736,12 @@ class DictionaryElementsAccessor
         NumberDictionary::cast(receiver->elements()), isolate);
     // Iterate through entire range, as accessing elements out of order is
     // observable.
-    for (uint32_t k = start_from; k < length; ++k) {
+    for (size_t k = start_from; k < length; ++k) {
       DCHECK_EQ(receiver->GetElementsKind(), original_elements_kind);
-      int entry = dictionary->FindEntry(isolate, k);
-      if (entry == NumberDictionary::kNotFound) continue;
+      DCHECK_LE(k, std::numeric_limits<uint32_t>::max());
+      InternalIndex entry =
+          dictionary->FindEntry(isolate, static_cast<uint32_t>(k));
+      if (entry.is_not_found()) continue;
 
       PropertyDetails details =
           GetDetailsImpl(*dictionary, InternalIndex(entry));
@@ -1813,7 +1790,7 @@ class DictionaryElementsAccessor
     return Just<int64_t>(-1);
   }
 
-  static void ValidateContents(JSObject holder, int length) {
+  static void ValidateContents(JSObject holder, size_t length) {
     DisallowHeapAllocation no_gc;
 #if DEBUG
     DCHECK_EQ(holder.map().elements_kind(), DICTIONARY_ELEMENTS);
@@ -1821,10 +1798,9 @@ class DictionaryElementsAccessor
     ReadOnlyRoots roots = holder.GetReadOnlyRoots();
     NumberDictionary dictionary = NumberDictionary::cast(holder.elements());
     // Validate the requires_slow_elements and max_number_key values.
-    int capacity = dictionary.Capacity();
     bool requires_slow_elements = false;
     int max_key = 0;
-    for (int i = 0; i < capacity; ++i) {
+    for (InternalIndex i : dictionary.IterateEntries()) {
       Object k;
       if (!dictionary.ToKey(roots, i, &k)) continue;
       DCHECK_LE(0.0, k.Number());
@@ -2037,11 +2013,14 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
 
   static uint32_t NumberOfElementsImpl(JSObject receiver,
                                        FixedArrayBase backing_store) {
-    uint32_t max_index = Subclass::GetMaxIndex(receiver, backing_store);
-    if (IsFastPackedElementsKind(Subclass::kind())) return max_index;
+    size_t max_index = Subclass::GetMaxIndex(receiver, backing_store);
+    DCHECK_LE(max_index, std::numeric_limits<uint32_t>::max());
+    if (IsFastPackedElementsKind(Subclass::kind())) {
+      return static_cast<uint32_t>(max_index);
+    }
     Isolate* isolate = receiver.GetIsolate();
     uint32_t count = 0;
-    for (uint32_t i = 0; i < max_index; i++) {
+    for (size_t i = 0; i < max_index; i++) {
       if (Subclass::HasEntryImpl(isolate, backing_store, InternalIndex(i))) {
         count++;
       }
@@ -2054,8 +2033,8 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
       AddKeyConversion convert) {
     Isolate* isolate = accumulator->isolate();
     Handle<FixedArrayBase> elements(receiver->elements(), isolate);
-    uint32_t length = Subclass::GetMaxNumberOfEntries(*receiver, *elements);
-    for (uint32_t i = 0; i < length; i++) {
+    size_t length = Subclass::GetMaxNumberOfEntries(*receiver, *elements);
+    for (size_t i = 0; i < length; i++) {
       if (IsFastPackedElementsKind(KindTraits::Kind) ||
           HasEntryImpl(isolate, *elements, InternalIndex(i))) {
         RETURN_FAILURE_IF_NOT_SUCCESSFUL(accumulator->AddKey(
@@ -2065,7 +2044,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     return ExceptionStatus::kSuccess;
   }
 
-  static void ValidateContents(JSObject holder, int length) {
+  static void ValidateContents(JSObject holder, size_t length) {
 #if DEBUG
     Isolate* isolate = holder.GetIsolate();
     Heap* heap = isolate->heap();
@@ -2075,24 +2054,26 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
       DCHECK_NE(map, ReadOnlyRoots(heap).fixed_double_array_map());
     } else if (IsDoubleElementsKind(KindTraits::Kind)) {
       DCHECK_NE(map, ReadOnlyRoots(heap).fixed_cow_array_map());
-      if (map == ReadOnlyRoots(heap).fixed_array_map()) DCHECK_EQ(0, length);
+      if (map == ReadOnlyRoots(heap).fixed_array_map()) DCHECK_EQ(0u, length);
     } else {
       UNREACHABLE();
     }
-    if (length == 0) return;  // nothing to do!
+    if (length == 0u) return;  // nothing to do!
 #if ENABLE_SLOW_DCHECKS
     DisallowHeapAllocation no_gc;
     BackingStore backing_store = BackingStore::cast(elements);
+    DCHECK(length <= std::numeric_limits<int>::max());
+    int length_int = static_cast<int>(length);
     if (IsSmiElementsKind(KindTraits::Kind)) {
       HandleScope scope(isolate);
-      for (int i = 0; i < length; i++) {
+      for (int i = 0; i < length_int; i++) {
         DCHECK(BackingStore::get(backing_store, i, isolate)->IsSmi() ||
                (IsHoleyElementsKind(KindTraits::Kind) &&
                 backing_store.is_the_hole(isolate, i)));
       }
     } else if (KindTraits::Kind == PACKED_ELEMENTS ||
                KindTraits::Kind == PACKED_DOUBLE_ELEMENTS) {
-      for (int i = 0; i < length; i++) {
+      for (int i = 0; i < length_int; i++) {
         DCHECK(!backing_store.is_the_hole(isolate, i));
       }
     } else {
@@ -2153,7 +2134,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
   }
 
   static Object FillImpl(Handle<JSObject> receiver, Handle<Object> obj_value,
-                         uint32_t start, uint32_t end) {
+                         size_t start, size_t end) {
     // Ensure indexes are within array bounds
     DCHECK_LE(0, start);
     DCHECK_LE(start, end);
@@ -2164,15 +2145,15 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     }
 
     // Make sure we have enough space.
-    uint32_t capacity =
-        Subclass::GetCapacityImpl(*receiver, receiver->elements());
-    if (end > capacity) {
-      Subclass::GrowCapacityAndConvertImpl(receiver, end);
+    DCHECK_LE(end, std::numeric_limits<uint32_t>::max());
+    if (end > Subclass::GetCapacityImpl(*receiver, receiver->elements())) {
+      Subclass::GrowCapacityAndConvertImpl(receiver,
+                                           static_cast<uint32_t>(end));
       CHECK_EQ(Subclass::kind(), receiver->GetElementsKind());
     }
     DCHECK_LE(end, Subclass::GetCapacityImpl(*receiver, receiver->elements()));
 
-    for (uint32_t index = start; index < end; ++index) {
+    for (size_t index = start; index < end; ++index) {
       Subclass::SetImpl(receiver, InternalIndex(index), *obj_value);
     }
     return *receiver;
@@ -2181,7 +2162,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
   static Maybe<bool> IncludesValueImpl(Isolate* isolate,
                                        Handle<JSObject> receiver,
                                        Handle<Object> search_value,
-                                       uint32_t start_from, uint32_t length) {
+                                       size_t start_from, size_t length) {
     DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
     DisallowHeapAllocation no_gc;
     FixedArrayBase elements_base = receiver->elements();
@@ -2192,7 +2173,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     if (start_from >= length) return Just(false);
 
     // Elements beyond the capacity of the backing store treated as undefined.
-    uint32_t elements_length = static_cast<uint32_t>(elements_base.length());
+    size_t elements_length = static_cast<size_t>(elements_base.length());
     if (value == undefined && elements_length < length) return Just(true);
     if (elements_length == 0) {
       DCHECK_NE(value, undefined);
@@ -2200,6 +2181,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     }
 
     length = std::min(elements_length, length);
+    DCHECK_LE(length, std::numeric_limits<int>::max());
 
     if (!value.IsNumber()) {
       if (value == undefined) {
@@ -2209,10 +2191,10 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
         // JSArray::length.
         if (IsSmiOrObjectElementsKind(Subclass::kind()) ||
             IsAnyNonextensibleElementsKind(Subclass::kind())) {
-          auto elements = FixedArray::cast(receiver->elements());
+          FixedArray elements = FixedArray::cast(receiver->elements());
 
-          for (uint32_t k = start_from; k < length; ++k) {
-            Object element_k = elements.get(k);
+          for (size_t k = start_from; k < length; ++k) {
+            Object element_k = elements.get(static_cast<int>(k));
 
             if (element_k == the_hole || element_k == undefined) {
               return Just(true);
@@ -2223,12 +2205,11 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
           // Search for The Hole in HOLEY_DOUBLE_ELEMENTS or
           // PACKED_DOUBLE_ELEMENTS.
           DCHECK(IsDoubleElementsKind(Subclass::kind()));
-          auto elements = FixedDoubleArray::cast(receiver->elements());
+          FixedDoubleArray elements =
+              FixedDoubleArray::cast(receiver->elements());
 
-          for (uint32_t k = start_from; k < length; ++k) {
-            if (elements.is_the_hole(k)) {
-              return Just(true);
-            }
+          for (size_t k = start_from; k < length; ++k) {
+            if (elements.is_the_hole(static_cast<int>(k))) return Just(true);
           }
           return Just(false);
         }
@@ -2244,14 +2225,11 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
         // PACKED_ELEMENTS or HOLEY_ELEMENTS.
         DCHECK(IsObjectElementsKind(Subclass::kind()) ||
                IsAnyNonextensibleElementsKind(Subclass::kind()));
-        auto elements = FixedArray::cast(receiver->elements());
-
-        for (uint32_t k = start_from; k < length; ++k) {
-          Object element_k = elements.get(k);
-          if (element_k == the_hole) {
-            continue;
-          }
+        FixedArray elements = FixedArray::cast(receiver->elements());
 
+        for (size_t k = start_from; k < length; ++k) {
+          Object element_k = elements.get(static_cast<int>(k));
+          if (element_k == the_hole) continue;
           if (value.SameValueZero(element_k)) return Just(true);
         }
         return Just(false);
@@ -2263,23 +2241,24 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
           // Search for non-NaN Number in PACKED_DOUBLE_ELEMENTS or
           // HOLEY_DOUBLE_ELEMENTS --- Skip TheHole, and trust UCOMISD or
           // similar operation for result.
-          auto elements = FixedDoubleArray::cast(receiver->elements());
+          FixedDoubleArray elements =
+              FixedDoubleArray::cast(receiver->elements());
 
-          for (uint32_t k = start_from; k < length; ++k) {
-            if (elements.is_the_hole(k)) {
-              continue;
+          for (size_t k = start_from; k < length; ++k) {
+            if (elements.is_the_hole(static_cast<int>(k))) continue;
+            if (elements.get_scalar(static_cast<int>(k)) == search_value) {
+              return Just(true);
             }
-            if (elements.get_scalar(k) == search_value) return Just(true);
           }
           return Just(false);
         } else {
           // Search for non-NaN Number in PACKED_ELEMENTS, HOLEY_ELEMENTS,
           // PACKED_SMI_ELEMENTS or HOLEY_SMI_ELEMENTS --- Skip non-Numbers,
           // and trust UCOMISD or similar operation for result
-          auto elements = FixedArray::cast(receiver->elements());
+          FixedArray elements = FixedArray::cast(receiver->elements());
 
-          for (uint32_t k = start_from; k < length; ++k) {
-            Object element_k = elements.get(k);
+          for (size_t k = start_from; k < length; ++k) {
+            Object element_k = elements.get(static_cast<int>(k));
             if (element_k.IsNumber() && element_k.Number() == search_value) {
               return Just(true);
             }
@@ -2295,25 +2274,25 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
           // Search for NaN in PACKED_DOUBLE_ELEMENTS or
           // HOLEY_DOUBLE_ELEMENTS --- Skip The Hole and trust
           // std::isnan(elementK) for result
-          auto elements = FixedDoubleArray::cast(receiver->elements());
+          FixedDoubleArray elements =
+              FixedDoubleArray::cast(receiver->elements());
 
-          for (uint32_t k = start_from; k < length; ++k) {
-            if (elements.is_the_hole(k)) {
-              continue;
+          for (size_t k = start_from; k < length; ++k) {
+            if (elements.is_the_hole(static_cast<int>(k))) continue;
+            if (std::isnan(elements.get_scalar(static_cast<int>(k)))) {
+              return Just(true);
             }
-            if (std::isnan(elements.get_scalar(k))) return Just(true);
           }
           return Just(false);
         } else {
-          // Search for NaN in PACKED_ELEMENTS, HOLEY_ELEMENTS,
-          // PACKED_SMI_ELEMENTS or HOLEY_SMI_ELEMENTS. Return true if
-          // elementK->IsHeapNumber() && std::isnan(elementK->Number())
-          DCHECK(IsSmiOrObjectElementsKind(Subclass::kind()) ||
+          // Search for NaN in PACKED_ELEMENTS or HOLEY_ELEMENTS. Return true
+          // if elementK->IsHeapNumber() && std::isnan(elementK->Number())
+          DCHECK(IsObjectElementsKind(Subclass::kind()) ||
                  IsAnyNonextensibleElementsKind(Subclass::kind()));
-          auto elements = FixedArray::cast(receiver->elements());
+          FixedArray elements = FixedArray::cast(receiver->elements());
 
-          for (uint32_t k = start_from; k < length; ++k) {
-            if (elements.get(k).IsNaN()) return Just(true);
+          for (size_t k = start_from; k < length; ++k) {
+            if (elements.get(static_cast<int>(k)).IsNaN()) return Just(true);
           }
           return Just(false);
         }
@@ -2439,8 +2418,7 @@ class FastSmiOrObjectElementsAccessor
   }
 
   static Object GetRaw(FixedArray backing_store, InternalIndex entry) {
-    uint32_t index = Subclass::GetIndexForEntryImpl(backing_store, entry);
-    return backing_store.get(index);
+    return backing_store.get(entry.as_int());
   }
 
   // NOTE: this method violates the handlified function signature convention:
@@ -2531,7 +2509,7 @@ class FastSmiOrObjectElementsAccessor
   static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                          Handle<JSObject> receiver,
                                          Handle<Object> search_value,
-                                         uint32_t start_from, uint32_t length) {
+                                         size_t start_from, size_t length) {
     DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
     DisallowHeapAllocation no_gc;
     FixedArrayBase elements_base = receiver->elements();
@@ -2539,7 +2517,7 @@ class FastSmiOrObjectElementsAccessor
 
     if (start_from >= length) return Just<int64_t>(-1);
 
-    length = std::min(static_cast<uint32_t>(elements_base.length()), length);
+    length = std::min(static_cast<size_t>(elements_base.length()), length);
 
     // Only FAST_{,HOLEY_}ELEMENTS can store non-numbers.
     if (!value.IsNumber() && !IsObjectElementsKind(Subclass::kind()) &&
@@ -2554,8 +2532,12 @@ class FastSmiOrObjectElementsAccessor
     // elements->get(k) can return the hole, for which the StrictEquals will
     // always fail.
     FixedArray elements = FixedArray::cast(receiver->elements());
-    for (uint32_t k = start_from; k < length; ++k) {
-      if (value.StrictEquals(elements.get(k))) return Just<int64_t>(k);
+    STATIC_ASSERT(FixedArray::kMaxLength <=
+                  std::numeric_limits<uint32_t>::max());
+    for (size_t k = start_from; k < length; ++k) {
+      if (value.StrictEquals(elements.get(static_cast<uint32_t>(k)))) {
+        return Just<int64_t>(k);
+      }
     }
     return Just<int64_t>(-1);
   }
@@ -2925,13 +2907,13 @@ class FastDoubleElementsAccessor
   static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                          Handle<JSObject> receiver,
                                          Handle<Object> search_value,
-                                         uint32_t start_from, uint32_t length) {
+                                         size_t start_from, size_t length) {
     DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
     DisallowHeapAllocation no_gc;
     FixedArrayBase elements_base = receiver->elements();
     Object value = *search_value;
 
-    length = std::min(static_cast<uint32_t>(elements_base.length()), length);
+    length = std::min(static_cast<size_t>(elements_base.length()), length);
 
     if (start_from >= length) return Just<int64_t>(-1);
 
@@ -2944,11 +2926,14 @@ class FastDoubleElementsAccessor
     double numeric_search_value = value.Number();
     FixedDoubleArray elements = FixedDoubleArray::cast(receiver->elements());
 
-    for (uint32_t k = start_from; k < length; ++k) {
-      if (elements.is_the_hole(k)) {
+    STATIC_ASSERT(FixedDoubleArray::kMaxLength <=
+                  std::numeric_limits<int>::max());
+    for (size_t k = start_from; k < length; ++k) {
+      int k_int = static_cast<int>(k);
+      if (elements.is_the_hole(k_int)) {
         continue;
       }
-      if (elements.get_scalar(k) == numeric_search_value) {
+      if (elements.get_scalar(k_int) == numeric_search_value) {
         return Just<int64_t>(k);
       }
     }
@@ -3090,7 +3075,7 @@ class TypedElementsAccessor
     return PropertyDetails(kData, DONT_DELETE, PropertyCellType::kNoCell);
   }
 
-  static bool HasElementImpl(Isolate* isolate, JSObject holder, uint32_t index,
+  static bool HasElementImpl(Isolate* isolate, JSObject holder, size_t index,
                              FixedArrayBase backing_store,
                              PropertyFilter filter) {
     return index < AccessorClass::GetCapacityImpl(holder, backing_store);
@@ -3111,30 +3096,23 @@ class TypedElementsAccessor
     UNREACHABLE();
   }
 
-  static uint32_t GetIndexForEntryImpl(FixedArrayBase backing_store,
-                                       InternalIndex entry) {
-    return entry.as_uint32();
-  }
-
   static InternalIndex GetEntryForIndexImpl(Isolate* isolate, JSObject holder,
                                             FixedArrayBase backing_store,
-                                            uint32_t index,
+                                            size_t index,
                                             PropertyFilter filter) {
     return index < AccessorClass::GetCapacityImpl(holder, backing_store)
                ? InternalIndex(index)
                : InternalIndex::NotFound();
   }
 
-  static uint32_t GetCapacityImpl(JSObject holder,
-                                  FixedArrayBase backing_store) {
+  static size_t GetCapacityImpl(JSObject holder, FixedArrayBase backing_store) {
     JSTypedArray typed_array = JSTypedArray::cast(holder);
     if (typed_array.WasDetached()) return 0;
-    // TODO(bmeurer, v8:4153): We need to support arbitrary size_t here.
-    return static_cast<uint32_t>(typed_array.length());
+    return typed_array.length();
   }
 
-  static uint32_t NumberOfElementsImpl(JSObject receiver,
-                                       FixedArrayBase backing_store) {
+  static size_t NumberOfElementsImpl(JSObject receiver,
+                                     FixedArrayBase backing_store) {
     return AccessorClass::GetCapacityImpl(receiver, backing_store);
   }
 
@@ -3143,8 +3121,8 @@ class TypedElementsAccessor
       AddKeyConversion convert) {
     Isolate* isolate = receiver->GetIsolate();
     Handle<FixedArrayBase> elements(receiver->elements(), isolate);
-    uint32_t length = AccessorClass::GetCapacityImpl(*receiver, *elements);
-    for (uint32_t i = 0; i < length; i++) {
+    size_t length = AccessorClass::GetCapacityImpl(*receiver, *elements);
+    for (size_t i = 0; i < length; i++) {
       Handle<Object> value =
           AccessorClass::GetInternalImpl(receiver, InternalIndex(i));
       RETURN_FAILURE_IF_NOT_SUCCESSFUL(accumulator->AddKey(value, convert));
@@ -3159,8 +3137,8 @@ class TypedElementsAccessor
     int count = 0;
     if ((filter & ONLY_CONFIGURABLE) == 0) {
       Handle<FixedArrayBase> elements(object->elements(), isolate);
-      uint32_t length = AccessorClass::GetCapacityImpl(*object, *elements);
-      for (uint32_t index = 0; index < length; ++index) {
+      size_t length = AccessorClass::GetCapacityImpl(*object, *elements);
+      for (size_t index = 0; index < length; ++index) {
         Handle<Object> value =
             AccessorClass::GetInternalImpl(object, InternalIndex(index));
         if (get_entries) {
@@ -3174,10 +3152,9 @@ class TypedElementsAccessor
   }
 
   static Object FillImpl(Handle<JSObject> receiver, Handle<Object> value,
-                         uint32_t start, uint32_t end) {
+                         size_t start, size_t end) {
     Handle<JSTypedArray> typed_array = Handle<JSTypedArray>::cast(receiver);
     DCHECK(!typed_array->WasDetached());
-    DCHECK_LE(0, start);
     DCHECK_LE(start, end);
     DCHECK_LE(end, typed_array->length());
     DisallowHeapAllocation no_gc;
@@ -3195,8 +3172,8 @@ class TypedElementsAccessor
 
   static Maybe<bool> IncludesValueImpl(Isolate* isolate,
                                        Handle<JSObject> receiver,
-                                       Handle<Object> value,
-                                       uint32_t start_from, uint32_t length) {
+                                       Handle<Object> value, size_t start_from,
+                                       size_t length) {
     DisallowHeapAllocation no_gc;
     JSTypedArray typed_array = JSTypedArray::cast(*receiver);
 
@@ -3213,8 +3190,7 @@ class TypedElementsAccessor
     // Prototype has no elements, and not searching for the hole --- limit
     // search to backing store length.
     if (typed_array.length() < length) {
-      // TODO(bmeurer, v8:4153): Don't cast to uint32_t here.
-      length = static_cast<uint32_t>(typed_array.length());
+      length = typed_array.length();
     }
 
     ElementType typed_search_value;
@@ -3234,7 +3210,7 @@ class TypedElementsAccessor
           return Just(false);
         }
         if (std::isnan(search_value)) {
-          for (uint32_t k = start_from; k < length; ++k) {
+          for (size_t k = start_from; k < length; ++k) {
             double elem_k =
                 static_cast<double>(AccessorClass::GetImpl(data_ptr, k));
             if (std::isnan(elem_k)) return Just(true);
@@ -3252,7 +3228,7 @@ class TypedElementsAccessor
       }
     }
 
-    for (uint32_t k = start_from; k < length; ++k) {
+    for (size_t k = start_from; k < length; ++k) {
       ElementType elem_k = AccessorClass::GetImpl(data_ptr, k);
       if (elem_k == typed_search_value) return Just(true);
     }
@@ -3262,7 +3238,7 @@ class TypedElementsAccessor
   static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                          Handle<JSObject> receiver,
                                          Handle<Object> value,
-                                         uint32_t start_from, uint32_t length) {
+                                         size_t start_from, size_t length) {
     DisallowHeapAllocation no_gc;
     JSTypedArray typed_array = JSTypedArray::cast(*receiver);
 
@@ -3302,11 +3278,10 @@ class TypedElementsAccessor
     // Prototype has no elements, and not searching for the hole --- limit
     // search to backing store length.
     if (typed_array.length() < length) {
-      // TODO(bmeurer, v8:4153): Don't cast to uint32_t here.
-      length = static_cast<uint32_t>(typed_array.length());
+      length = typed_array.length();
     }
 
-    for (uint32_t k = start_from; k < length; ++k) {
+    for (size_t k = start_from; k < length; ++k) {
       ElementType elem_k = AccessorClass::GetImpl(data_ptr, k);
       if (elem_k == typed_search_value) return Just<int64_t>(k);
     }
@@ -3315,7 +3290,7 @@ class TypedElementsAccessor
 
   static Maybe<int64_t> LastIndexOfValueImpl(Handle<JSObject> receiver,
                                              Handle<Object> value,
-                                             uint32_t start_from) {
+                                             size_t start_from) {
     DisallowHeapAllocation no_gc;
     JSTypedArray typed_array = JSTypedArray::cast(*receiver);
 
@@ -3353,7 +3328,7 @@ class TypedElementsAccessor
     }
 
     DCHECK_LT(start_from, typed_array.length());
-    uint32_t k = start_from;
+    size_t k = start_from;
     do {
       ElementType elem_k = AccessorClass::GetImpl(data_ptr, k);
       if (elem_k == typed_search_value) return Just<int64_t>(k);
@@ -3444,7 +3419,7 @@ class TypedElementsAccessor
 
   static void CopyElementsFromTypedArray(JSTypedArray source,
                                          JSTypedArray destination,
-                                         size_t length, uint32_t offset) {
+                                         size_t length, size_t offset) {
     // The source is a typed array, so we know we don't need to do ToNumber
     // side-effects, as the source elements will always be a number.
     DisallowHeapAllocation no_gc;
@@ -3530,7 +3505,7 @@ class TypedElementsAccessor
 
   static bool TryCopyElementsFastNumber(Context context, JSArray source,
                                         JSTypedArray destination, size_t length,
-                                        uint32_t offset) {
+                                        size_t offset) {
     if (Kind == BIGINT64_ELEMENTS || Kind == BIGUINT64_ELEMENTS) return false;
     Isolate* isolate = source.GetIsolate();
     DisallowHeapAllocation no_gc;
@@ -3610,24 +3585,13 @@ class TypedElementsAccessor
 
   static Object CopyElementsHandleSlow(Handle<Object> source,
                                        Handle<JSTypedArray> destination,
-                                       size_t length, uint32_t offset) {
+                                       size_t length, size_t offset) {
     Isolate* isolate = destination->GetIsolate();
     for (size_t i = 0; i < length; i++) {
       Handle<Object> elem;
-      // TODO(4153): This if-branch will subsume its else-branch.
-      if (i <= JSArray::kMaxArrayIndex) {
-        LookupIterator it(isolate, source, static_cast<uint32_t>(i));
-        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, elem,
-                                           Object::GetProperty(&it));
-      } else {
-        char buffer[kDoubleToCStringMinBufferSize];
-        Vector<char> string(buffer, arraysize(buffer));
-        DoubleToCString(static_cast<double>(i), string);
-        Handle<Name> name = isolate->factory()->InternalizeUtf8String(string);
-        LookupIterator it(isolate, source, name);
-        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, elem,
-                                           Object::GetProperty(&it));
-      }
+      LookupIterator it(isolate, source, i);
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, elem,
+                                         Object::GetProperty(&it));
       if (Kind == BIGINT64_ELEMENTS || Kind == BIGUINT64_ELEMENTS) {
         ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, elem,
                                            BigInt::FromObject(isolate, elem));
@@ -3656,7 +3620,7 @@ class TypedElementsAccessor
   // that is required.
   static Object CopyElementsHandleImpl(Handle<Object> source,
                                        Handle<JSObject> destination,
-                                       size_t length, uint32_t offset) {
+                                       size_t length, size_t offset) {
     Isolate* isolate = destination->GetIsolate();
     Handle<JSTypedArray> destination_ta =
         Handle<JSTypedArray>::cast(destination);
@@ -3684,14 +3648,13 @@ class TypedElementsAccessor
       // Fast cases for packed numbers kinds where we don't need to allocate.
       Handle<JSArray> source_js_array = Handle<JSArray>::cast(source);
       size_t current_length;
-      if (source_js_array->length().IsNumber() &&
-          TryNumberToSize(source_js_array->length(), &current_length)) {
-        if (length <= current_length) {
-          Handle<JSArray> source_array = Handle<JSArray>::cast(source);
-          if (TryCopyElementsFastNumber(isolate->context(), *source_array,
-                                        *destination_ta, length, offset)) {
-            return *isolate->factory()->undefined_value();
-          }
+      DCHECK(source_js_array->length().IsNumber());
+      if (TryNumberToSize(source_js_array->length(), &current_length) &&
+          length <= current_length) {
+        Handle<JSArray> source_array = Handle<JSArray>::cast(source);
+        if (TryCopyElementsFastNumber(isolate->context(), *source_array,
+                                      *destination_ta, length, offset)) {
+          return *isolate->factory()->undefined_value();
         }
       }
     }
@@ -4004,8 +3967,10 @@ class SloppyArgumentsElementsAccessor
     SloppyArgumentsElements elements =
         SloppyArgumentsElements::cast(backing_store);
     FixedArrayBase arguments = elements.arguments();
-    return elements.parameter_map_length() +
-           ArgumentsAccessor::GetMaxNumberOfEntries(holder, arguments);
+    size_t max_entries =
+        ArgumentsAccessor::GetMaxNumberOfEntries(holder, arguments);
+    DCHECK_LE(max_entries, std::numeric_limits<uint32_t>::max());
+    return elements.parameter_map_length() + static_cast<uint32_t>(max_entries);
   }
 
   static uint32_t NumberOfElementsImpl(JSObject receiver,
@@ -4043,8 +4008,8 @@ class SloppyArgumentsElementsAccessor
     SloppyArgumentsElements elements =
         SloppyArgumentsElements::cast(parameters);
     uint32_t length = elements.parameter_map_length();
-    if (entry.as_uint32() < length) {
-      return HasParameterMapArg(isolate, elements, entry.as_uint32());
+    if (entry.raw_value() < length) {
+      return HasParameterMapArg(isolate, elements, entry.raw_value());
     }
     FixedArrayBase arguments = elements.arguments();
     return ArgumentsAccessor::HasEntryImpl(isolate, arguments,
@@ -4058,21 +4023,9 @@ class SloppyArgumentsElementsAccessor
     return ArgumentsAccessor::HasAccessorsImpl(holder, arguments);
   }
 
-  static uint32_t GetIndexForEntryImpl(FixedArrayBase parameters,
-                                       InternalIndex entry) {
-    SloppyArgumentsElements elements =
-        SloppyArgumentsElements::cast(parameters);
-    uint32_t length = elements.parameter_map_length();
-    uint32_t index = entry.as_uint32();
-    if (index < length) return index;
-    FixedArray arguments = elements.arguments();
-    return ArgumentsAccessor::GetIndexForEntryImpl(arguments,
-                                                   entry.adjust_down(length));
-  }
-
   static InternalIndex GetEntryForIndexImpl(Isolate* isolate, JSObject holder,
                                             FixedArrayBase parameters,
-                                            uint32_t index,
+                                            size_t index,
                                             PropertyFilter filter) {
     SloppyArgumentsElements elements =
         SloppyArgumentsElements::cast(parameters);
@@ -4102,10 +4055,11 @@ class SloppyArgumentsElementsAccessor
 
   static bool HasParameterMapArg(Isolate* isolate,
                                  SloppyArgumentsElements elements,
-                                 uint32_t index) {
+                                 size_t index) {
     uint32_t length = elements.parameter_map_length();
     if (index >= length) return false;
-    return !elements.get_mapped_entry(index).IsTheHole(isolate);
+    return !elements.get_mapped_entry(static_cast<uint32_t>(index))
+                .IsTheHole(isolate);
   }
 
   static void DeleteImpl(Handle<JSObject> obj, InternalIndex entry) {
@@ -4177,15 +4131,15 @@ class SloppyArgumentsElementsAccessor
 
   static Maybe<bool> IncludesValueImpl(Isolate* isolate,
                                        Handle<JSObject> object,
-                                       Handle<Object> value,
-                                       uint32_t start_from, uint32_t length) {
+                                       Handle<Object> value, size_t start_from,
+                                       size_t length) {
     DCHECK(JSObject::PrototypeHasNoElements(isolate, *object));
     Handle<Map> original_map(object->map(), isolate);
     Handle<SloppyArgumentsElements> elements(
         SloppyArgumentsElements::cast(object->elements()), isolate);
     bool search_for_hole = value->IsUndefined(isolate);
 
-    for (uint32_t k = start_from; k < length; ++k) {
+    for (size_t k = start_from; k < length; ++k) {
       DCHECK_EQ(object->map(), *original_map);
       InternalIndex entry =
           GetEntryForIndexImpl(isolate, *object, *elements, k, ALL_PROPERTIES);
@@ -4220,13 +4174,13 @@ class SloppyArgumentsElementsAccessor
   static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                          Handle<JSObject> object,
                                          Handle<Object> value,
-                                         uint32_t start_from, uint32_t length) {
+                                         size_t start_from, size_t length) {
     DCHECK(JSObject::PrototypeHasNoElements(isolate, *object));
     Handle<Map> original_map(object->map(), isolate);
     Handle<SloppyArgumentsElements> elements(
         SloppyArgumentsElements::cast(object->elements()), isolate);
 
-    for (uint32_t k = start_from; k < length; ++k) {
+    for (size_t k = start_from; k < length; ++k) {
       DCHECK_EQ(object->map(), *original_map);
       InternalIndex entry =
           GetEntryForIndexImpl(isolate, *object, *elements, k, ALL_PROPERTIES);
@@ -4288,8 +4242,8 @@ class SlowSloppyArgumentsElementsAccessor
     Handle<NumberDictionary> dict(NumberDictionary::cast(elements->arguments()),
                                   isolate);
     uint32_t length = elements->parameter_map_length();
-    dict = NumberDictionary::DeleteEntry(isolate, dict,
-                                         entry.as_uint32() - length);
+    dict =
+        NumberDictionary::DeleteEntry(isolate, dict, entry.adjust_down(length));
     elements->set_arguments(*dict);
   }
   static void AddImpl(Handle<JSObject> object, uint32_t index,
@@ -4391,9 +4345,9 @@ class FastSloppyArgumentsElementsAccessor
     uint32_t length = elements->parameter_map_length();
     if (entry->as_uint32() >= length) {
       *entry =
-          InternalIndex(dictionary->FindEntry(object->GetIsolate(),
-                                              entry->as_uint32() - length) +
-                        length);
+          dictionary
+              ->FindEntry(object->GetIsolate(), entry->as_uint32() - length)
+              .adjust_up(length);
     }
     return dictionary;
   }
@@ -4516,7 +4470,7 @@ class StringWrapperElementsAccessor
 
   static InternalIndex GetEntryForIndexImpl(Isolate* isolate, JSObject holder,
                                             FixedArrayBase backing_store,
-                                            uint32_t index,
+                                            size_t index,
                                             PropertyFilter filter) {
     uint32_t length = static_cast<uint32_t>(GetString(holder).length());
     if (index < length) return InternalIndex(index);
@@ -4777,10 +4731,10 @@ void CopyFastNumberJSArrayElementsToTypedArray(Address raw_context,
   JSTypedArray destination = JSTypedArray::cast(Object(raw_destination));
 
   switch (destination.GetElementsKind()) {
-#define TYPED_ARRAYS_CASE(Type, type, TYPE, ctype)                             \
-  case TYPE##_ELEMENTS:                                                        \
-    CHECK(Type##ElementsAccessor::TryCopyElementsFastNumber(                   \
-        context, source, destination, length, static_cast<uint32_t>(offset))); \
+#define TYPED_ARRAYS_CASE(Type, type, TYPE, ctype)           \
+  case TYPE##_ELEMENTS:                                      \
+    CHECK(Type##ElementsAccessor::TryCopyElementsFastNumber( \
+        context, source, destination, length, offset));      \
     break;
     TYPED_ARRAYS(TYPED_ARRAYS_CASE)
 #undef TYPED_ARRAYS_CASE
@@ -4796,10 +4750,10 @@ void CopyTypedArrayElementsToTypedArray(Address raw_source,
   JSTypedArray destination = JSTypedArray::cast(Object(raw_destination));
 
   switch (destination.GetElementsKind()) {
-#define TYPED_ARRAYS_CASE(Type, type, TYPE, ctype)                   \
-  case TYPE##_ELEMENTS:                                              \
-    Type##ElementsAccessor::CopyElementsFromTypedArray(              \
-        source, destination, length, static_cast<uint32_t>(offset)); \
+#define TYPED_ARRAYS_CASE(Type, type, TYPE, ctype)                          \
+  case TYPE##_ELEMENTS:                                                     \
+    Type##ElementsAccessor::CopyElementsFromTypedArray(source, destination, \
+                                                       length, offset);     \
     break;
     TYPED_ARRAYS(TYPED_ARRAYS_CASE)
 #undef TYPED_ARRAYS_CASE
diff --git a/deps/v8/src/objects/elements.h b/deps/v8/src/objects/elements.h
index 219a9ad73a0bf7..a5d8103e68d0fa 100644
--- a/deps/v8/src/objects/elements.h
+++ b/deps/v8/src/objects/elements.h
@@ -33,13 +33,13 @@ class ElementsAccessor {
   virtual void Validate(JSObject obj) = 0;
 
   // Returns true if a holder contains an element with the specified index
-  // without iterating up the prototype chain.  The caller can optionally pass
-  // in the backing store to use for the check, which must be compatible with
-  // the ElementsKind of the ElementsAccessor. If backing_store is nullptr, the
-  // holder->elements() is used as the backing store. If a |filter| is
-  // specified the PropertyAttributes of the element at the given index
-  // are compared to the given |filter|. If they match/overlap the given
-  // index is ignored. Note that only Dictionary elements have custom
+  // without iterating up the prototype chain. The first version takes the
+  // backing store to use for the check, which must be compatible with the
+  // ElementsKind of the ElementsAccessor; the second version uses
+  // holder->elements() as the backing store. If a |filter| is specified,
+  // the PropertyAttributes of the element at the given index are compared
+  // to the given |filter|. If they match/overlap, the given index is ignored.
+  // Note that only Dictionary elements have custom
   // PropertyAttributes associated, hence the |filter| argument is ignored for
   // all but DICTIONARY_ELEMENTS and SLOW_SLOPPY_ARGUMENTS_ELEMENTS.
   virtual bool HasElement(JSObject holder, uint32_t index,
@@ -56,7 +56,7 @@ class ElementsAccessor {
   virtual Handle<Object> Get(Handle<JSObject> holder, InternalIndex entry) = 0;
 
   virtual bool HasAccessors(JSObject holder) = 0;
-  virtual uint32_t NumberOfElements(JSObject holder) = 0;
+  virtual size_t NumberOfElements(JSObject holder) = 0;
 
   // Modifies the length data property as specified for JSArrays and resizes the
   // underlying backing store accordingly. The method honors the semantics of
@@ -126,28 +126,27 @@ class ElementsAccessor {
 
   virtual Handle<NumberDictionary> Normalize(Handle<JSObject> object) = 0;
 
-  virtual uint32_t GetCapacity(JSObject holder,
-                               FixedArrayBase backing_store) = 0;
+  virtual size_t GetCapacity(JSObject holder, FixedArrayBase backing_store) = 0;
 
   virtual Object Fill(Handle<JSObject> receiver, Handle<Object> obj_value,
-                      uint32_t start, uint32_t end) = 0;
+                      size_t start, size_t end) = 0;
 
   // Check an Object's own elements for an element (using SameValueZero
   // semantics)
   virtual Maybe<bool> IncludesValue(Isolate* isolate, Handle<JSObject> receiver,
-                                    Handle<Object> value, uint32_t start,
-                                    uint32_t length) = 0;
+                                    Handle<Object> value, size_t start,
+                                    size_t length) = 0;
 
   // Check an Object's own elements for the index of an element (using SameValue
   // semantics)
   virtual Maybe<int64_t> IndexOfValue(Isolate* isolate,
                                       Handle<JSObject> receiver,
-                                      Handle<Object> value, uint32_t start,
-                                      uint32_t length) = 0;
+                                      Handle<Object> value, size_t start,
+                                      size_t length) = 0;
 
   virtual Maybe<int64_t> LastIndexOfValue(Handle<JSObject> receiver,
                                           Handle<Object> value,
-                                          uint32_t start) = 0;
+                                          size_t start) = 0;
 
   virtual void Reverse(JSObject receiver) = 0;
 
@@ -157,7 +156,7 @@ class ElementsAccessor {
 
   virtual Object CopyElements(Handle<Object> source,
                               Handle<JSObject> destination, size_t length,
-                              uint32_t offset = 0) = 0;
+                              size_t offset) = 0;
 
   virtual Handle<FixedArray> CreateListFromArrayLike(Isolate* isolate,
                                                      Handle<JSObject> object,
@@ -180,7 +179,7 @@ class ElementsAccessor {
   // the NumberDictionary.
   virtual InternalIndex GetEntryForIndex(Isolate* isolate, JSObject holder,
                                          FixedArrayBase backing_store,
-                                         uint32_t index) = 0;
+                                         size_t index) = 0;
 
   virtual PropertyDetails GetDetails(JSObject holder, InternalIndex entry) = 0;
   virtual void Reconfigure(Handle<JSObject> object,
diff --git a/deps/v8/src/objects/embedder-data-array.tq b/deps/v8/src/objects/embedder-data-array.tq
new file mode 100644
index 00000000000000..c576a068680713
--- /dev/null
+++ b/deps/v8/src/objects/embedder-data-array.tq
@@ -0,0 +1,8 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+extern class EmbedderDataArray extends HeapObject {
+  length: Smi;
+}
diff --git a/deps/v8/src/objects/embedder-data-slot-inl.h b/deps/v8/src/objects/embedder-data-slot-inl.h
index 78189ba38129ec..8222575aa30fa3 100644
--- a/deps/v8/src/objects/embedder-data-slot-inl.h
+++ b/deps/v8/src/objects/embedder-data-slot-inl.h
@@ -35,7 +35,7 @@ void EmbedderDataSlot::store_smi(Smi value) {
   ObjectSlot(address() + kTaggedPayloadOffset).Relaxed_Store(value);
 #ifdef V8_COMPRESS_POINTERS
   // See gc_safe_store() for the reasons behind two stores.
-  ObjectSlot(address() + kRawPayloadOffset).Relaxed_Store(Smi::kZero);
+  ObjectSlot(address() + kRawPayloadOffset).Relaxed_Store(Smi::zero());
 #endif
 }
 
@@ -49,7 +49,7 @@ void EmbedderDataSlot::store_tagged(EmbedderDataArray array, int entry_index,
 #ifdef V8_COMPRESS_POINTERS
   // See gc_safe_store() for the reasons behind two stores.
   ObjectSlot(FIELD_ADDR(array, slot_offset + kRawPayloadOffset))
-      .Relaxed_Store(Smi::kZero);
+      .Relaxed_Store(Smi::zero());
 #endif
 }
 
@@ -63,7 +63,7 @@ void EmbedderDataSlot::store_tagged(JSObject object, int embedder_field_index,
 #ifdef V8_COMPRESS_POINTERS
   // See gc_safe_store() for the reasons behind two stores.
   ObjectSlot(FIELD_ADDR(object, slot_offset + kRawPayloadOffset))
-      .Relaxed_Store(Smi::kZero);
+      .Relaxed_Store(Smi::zero());
 #endif
 }
 
diff --git a/deps/v8/src/objects/feedback-cell-inl.h b/deps/v8/src/objects/feedback-cell-inl.h
index 188666d4626220..9a570092e8cdb1 100644
--- a/deps/v8/src/objects/feedback-cell-inl.h
+++ b/deps/v8/src/objects/feedback-cell-inl.h
@@ -26,9 +26,21 @@ void FeedbackCell::clear_padding() {
          FeedbackCell::kAlignedSize - FeedbackCell::kUnalignedSize);
 }
 
-void FeedbackCell::reset() {
-  set_value(GetReadOnlyRoots().undefined_value());
+void FeedbackCell::reset_feedback_vector(
+    base::Optional<std::function<void(HeapObject object, ObjectSlot slot,
+                                      HeapObject target)>>
+        gc_notify_updated_slot) {
   set_interrupt_budget(FeedbackCell::GetInitialInterruptBudget());
+  if (value().IsUndefined() || value().IsClosureFeedbackCellArray()) return;
+
+  CHECK(value().IsFeedbackVector());
+  ClosureFeedbackCellArray closure_feedback_cell_array =
+      FeedbackVector::cast(value()).closure_feedback_cell_array();
+  set_value(closure_feedback_cell_array);
+  if (gc_notify_updated_slot) {
+    (*gc_notify_updated_slot)(*this, RawField(FeedbackCell::kValueOffset),
+                              closure_feedback_cell_array);
+  }
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/feedback-cell.h b/deps/v8/src/objects/feedback-cell.h
index 669efaeaeca8b2..29304f709ddc7e 100644
--- a/deps/v8/src/objects/feedback-cell.h
+++ b/deps/v8/src/objects/feedback-cell.h
@@ -34,7 +34,10 @@ class FeedbackCell : public TorqueGeneratedFeedbackCell<FeedbackCell, Struct> {
   static const int kAlignedSize = RoundUp<kObjectAlignment>(int{kSize});
 
   inline void clear_padding();
-  inline void reset();
+  inline void reset_feedback_vector(
+      base::Optional<std::function<void(HeapObject object, ObjectSlot slot,
+                                        HeapObject target)>>
+          gc_notify_updated_slot = base::nullopt);
 
   using BodyDescriptor =
       FixedBodyDescriptor<kValueOffset, kInterruptBudgetOffset, kAlignedSize>;
diff --git a/deps/v8/src/objects/feedback-cell.tq b/deps/v8/src/objects/feedback-cell.tq
new file mode 100644
index 00000000000000..426bd1cb4e06af
--- /dev/null
+++ b/deps/v8/src/objects/feedback-cell.tq
@@ -0,0 +1,9 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+extern class FeedbackCell extends Struct {
+  value: Undefined|FeedbackVector|FixedArray;
+  interrupt_budget: int32;
+}
diff --git a/deps/v8/src/objects/feedback-vector-inl.h b/deps/v8/src/objects/feedback-vector-inl.h
index 024b92165dea13..79382bb4d1b2de 100644
--- a/deps/v8/src/objects/feedback-vector-inl.h
+++ b/deps/v8/src/objects/feedback-vector-inl.h
@@ -155,20 +155,21 @@ FeedbackSlot FeedbackVector::ToSlot(int index) {
 }
 
 MaybeObject FeedbackVector::Get(FeedbackSlot slot) const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return Get(isolate, slot);
 }
 
-MaybeObject FeedbackVector::Get(Isolate* isolate, FeedbackSlot slot) const {
+MaybeObject FeedbackVector::Get(const Isolate* isolate,
+                                FeedbackSlot slot) const {
   return get(isolate, GetIndex(slot));
 }
 
 MaybeObject FeedbackVector::get(int index) const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return get(isolate, index);
 }
 
-MaybeObject FeedbackVector::get(Isolate* isolate, int index) const {
+MaybeObject FeedbackVector::get(const Isolate* isolate, int index) const {
   DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
   int offset = OffsetOfElementAt(index);
   return RELAXED_READ_WEAK_FIELD(*this, offset);
diff --git a/deps/v8/src/objects/feedback-vector.cc b/deps/v8/src/objects/feedback-vector.cc
index 4fe75ab325e322..732c1e9cd5f786 100644
--- a/deps/v8/src/objects/feedback-vector.cc
+++ b/deps/v8/src/objects/feedback-vector.cc
@@ -268,14 +268,14 @@ Handle<FeedbackVector> FeedbackVector::New(
       case FeedbackSlotKind::kForIn:
       case FeedbackSlotKind::kCompareOp:
       case FeedbackSlotKind::kBinaryOp:
-        vector->set(index, Smi::kZero, SKIP_WRITE_BARRIER);
+        vector->set(index, Smi::zero(), SKIP_WRITE_BARRIER);
         break;
       case FeedbackSlotKind::kLiteral:
-        vector->set(index, Smi::kZero, SKIP_WRITE_BARRIER);
+        vector->set(index, Smi::zero(), SKIP_WRITE_BARRIER);
         break;
       case FeedbackSlotKind::kCall:
         vector->set(index, *uninitialized_sentinel, SKIP_WRITE_BARRIER);
-        extra_value = Smi::kZero;
+        extra_value = Smi::zero();
         break;
       case FeedbackSlotKind::kCloneObject:
       case FeedbackSlotKind::kLoadProperty:
@@ -445,7 +445,7 @@ void FeedbackNexus::ConfigureUninitialized() {
     case FeedbackSlotKind::kCall: {
       SetFeedback(*FeedbackVector::UninitializedSentinel(isolate),
                   SKIP_WRITE_BARRIER);
-      SetFeedbackExtra(Smi::kZero, SKIP_WRITE_BARRIER);
+      SetFeedbackExtra(Smi::zero(), SKIP_WRITE_BARRIER);
       break;
     }
     case FeedbackSlotKind::kInstanceOf: {
@@ -489,7 +489,7 @@ bool FeedbackNexus::Clear() {
       break;
 
     case FeedbackSlotKind::kLiteral:
-      SetFeedback(Smi::kZero, SKIP_WRITE_BARRIER);
+      SetFeedback(Smi::zero(), SKIP_WRITE_BARRIER);
       feedback_updated = true;
       break;
 
@@ -764,11 +764,15 @@ void FeedbackNexus::ConfigureHandlerMode(const MaybeObjectHandle& handler) {
 void FeedbackNexus::ConfigureCloneObject(Handle<Map> source_map,
                                          Handle<Map> result_map) {
   Isolate* isolate = GetIsolate();
-  MaybeObject maybe_feedback = GetFeedback();
-  Handle<HeapObject> feedback(maybe_feedback->IsStrongOrWeak()
-                                  ? maybe_feedback->GetHeapObject()
-                                  : HeapObject(),
-                              isolate);
+  Handle<HeapObject> feedback;
+  {
+    MaybeObject maybe_feedback = GetFeedback();
+    if (maybe_feedback->IsStrongOrWeak()) {
+      feedback = handle(maybe_feedback->GetHeapObject(), isolate);
+    } else {
+      DCHECK(maybe_feedback->IsCleared());
+    }
+  }
   switch (ic_state()) {
     case UNINITIALIZED:
       // Cache the first map seen which meets the fast case requirements.
@@ -776,16 +780,15 @@ void FeedbackNexus::ConfigureCloneObject(Handle<Map> source_map,
       SetFeedbackExtra(*result_map);
       break;
     case MONOMORPHIC:
-      if (maybe_feedback->IsCleared() || feedback.is_identical_to(source_map) ||
+      if (feedback.is_null() || feedback.is_identical_to(source_map) ||
           Map::cast(*feedback).is_deprecated()) {
-        // Remain in MONOMORPHIC state if previous feedback has been collected.
         SetFeedback(HeapObjectReference::Weak(*source_map));
         SetFeedbackExtra(*result_map);
       } else {
         // Transition to POLYMORPHIC.
         Handle<WeakFixedArray> array =
             EnsureArrayOfSize(2 * kCloneObjectPolymorphicEntrySize);
-        array->Set(0, maybe_feedback);
+        array->Set(0, HeapObjectReference::Weak(*feedback));
         array->Set(1, GetFeedbackExtra());
         array->Set(2, HeapObjectReference::Weak(*source_map));
         array->Set(3, MaybeObject::FromObject(*result_map));
@@ -798,9 +801,10 @@ void FeedbackNexus::ConfigureCloneObject(Handle<Map> source_map,
       Handle<WeakFixedArray> array = Handle<WeakFixedArray>::cast(feedback);
       int i = 0;
       for (; i < array->length(); i += kCloneObjectPolymorphicEntrySize) {
-        MaybeObject feedback = array->Get(i);
-        if (feedback->IsCleared()) break;
-        Handle<Map> cached_map(Map::cast(feedback->GetHeapObject()), isolate);
+        MaybeObject feedback_map = array->Get(i);
+        if (feedback_map->IsCleared()) break;
+        Handle<Map> cached_map(Map::cast(feedback_map->GetHeapObject()),
+                               isolate);
         if (cached_map.is_identical_to(source_map) ||
             cached_map->is_deprecated())
           break;
@@ -1105,14 +1109,6 @@ bool BuiltinHasKeyedAccessStoreMode(int builtin_index) {
     case Builtins::kStoreFastElementIC_GrowNoTransitionHandleCOW:
     case Builtins::kStoreFastElementIC_NoTransitionIgnoreOOB:
     case Builtins::kStoreFastElementIC_NoTransitionHandleCOW:
-    case Builtins::kStoreInArrayLiteralIC_Slow_Standard:
-    case Builtins::kStoreInArrayLiteralIC_Slow_GrowNoTransitionHandleCOW:
-    case Builtins::kStoreInArrayLiteralIC_Slow_NoTransitionIgnoreOOB:
-    case Builtins::kStoreInArrayLiteralIC_Slow_NoTransitionHandleCOW:
-    case Builtins::kKeyedStoreIC_Slow_Standard:
-    case Builtins::kKeyedStoreIC_Slow_GrowNoTransitionHandleCOW:
-    case Builtins::kKeyedStoreIC_Slow_NoTransitionIgnoreOOB:
-    case Builtins::kKeyedStoreIC_Slow_NoTransitionHandleCOW:
     case Builtins::kElementsTransitionAndStore_Standard:
     case Builtins::kElementsTransitionAndStore_GrowNoTransitionHandleCOW:
     case Builtins::kElementsTransitionAndStore_NoTransitionIgnoreOOB:
@@ -1128,26 +1124,18 @@ KeyedAccessStoreMode KeyedAccessStoreModeForBuiltin(int builtin_index) {
   DCHECK(BuiltinHasKeyedAccessStoreMode(builtin_index));
   switch (builtin_index) {
     case Builtins::kKeyedStoreIC_SloppyArguments_Standard:
-    case Builtins::kStoreInArrayLiteralIC_Slow_Standard:
-    case Builtins::kKeyedStoreIC_Slow_Standard:
     case Builtins::kStoreFastElementIC_Standard:
     case Builtins::kElementsTransitionAndStore_Standard:
       return STANDARD_STORE;
     case Builtins::kKeyedStoreIC_SloppyArguments_GrowNoTransitionHandleCOW:
-    case Builtins::kStoreInArrayLiteralIC_Slow_GrowNoTransitionHandleCOW:
-    case Builtins::kKeyedStoreIC_Slow_GrowNoTransitionHandleCOW:
     case Builtins::kStoreFastElementIC_GrowNoTransitionHandleCOW:
     case Builtins::kElementsTransitionAndStore_GrowNoTransitionHandleCOW:
       return STORE_AND_GROW_HANDLE_COW;
     case Builtins::kKeyedStoreIC_SloppyArguments_NoTransitionIgnoreOOB:
-    case Builtins::kStoreInArrayLiteralIC_Slow_NoTransitionIgnoreOOB:
-    case Builtins::kKeyedStoreIC_Slow_NoTransitionIgnoreOOB:
     case Builtins::kStoreFastElementIC_NoTransitionIgnoreOOB:
     case Builtins::kElementsTransitionAndStore_NoTransitionIgnoreOOB:
       return STORE_IGNORE_OUT_OF_BOUNDS;
     case Builtins::kKeyedStoreIC_SloppyArguments_NoTransitionHandleCOW:
-    case Builtins::kStoreInArrayLiteralIC_Slow_NoTransitionHandleCOW:
-    case Builtins::kKeyedStoreIC_Slow_NoTransitionHandleCOW:
     case Builtins::kStoreFastElementIC_NoTransitionHandleCOW:
     case Builtins::kElementsTransitionAndStore_NoTransitionHandleCOW:
       return STORE_HANDLE_COW;
@@ -1174,14 +1162,26 @@ KeyedAccessStoreMode FeedbackNexus::GetKeyedAccessStoreMode() const {
     if (maybe_code_handler.object()->IsStoreHandler()) {
       Handle<StoreHandler> data_handler =
           Handle<StoreHandler>::cast(maybe_code_handler.object());
-      handler = handle(Code::cast(data_handler->smi_handler()),
-                       vector().GetIsolate());
+
+      if ((data_handler->smi_handler()).IsSmi()) {
+        // Decode the KeyedAccessStoreMode information from the Handler.
+        mode = StoreHandler::GetKeyedAccessStoreMode(
+            MaybeObject::FromObject(data_handler->smi_handler()));
+        if (mode != STANDARD_STORE) return mode;
+        continue;
+      } else {
+        handler = handle(Code::cast(data_handler->smi_handler()),
+                         vector().GetIsolate());
+      }
+
     } else if (maybe_code_handler.object()->IsSmi()) {
-      // Skip proxy handlers and the slow handler.
-      DCHECK(*(maybe_code_handler.object()) ==
-                 *StoreHandler::StoreProxy(GetIsolate()) ||
-             *(maybe_code_handler.object()) ==
-                 *StoreHandler::StoreSlow(GetIsolate()));
+      // Skip for Proxy Handlers.
+      if (*(maybe_code_handler.object()) ==
+          *StoreHandler::StoreProxy(GetIsolate()))
+        continue;
+      // Decode the KeyedAccessStoreMode information from the Handler.
+      mode = StoreHandler::GetKeyedAccessStoreMode(*maybe_code_handler);
+      if (mode != STANDARD_STORE) return mode;
       continue;
     } else {
       // Element store without prototype chain check.
@@ -1278,8 +1278,8 @@ void FeedbackNexus::Collect(Handle<String> type, int position) {
 
   Handle<ArrayList> position_specific_types;
 
-  int entry = types->FindEntry(isolate, position);
-  if (entry == SimpleNumberDictionary::kNotFound) {
+  InternalIndex entry = types->FindEntry(isolate, position);
+  if (entry.is_not_found()) {
     position_specific_types = ArrayList::New(isolate, 1);
     types = SimpleNumberDictionary::Set(
         isolate, types, position,
@@ -1341,10 +1341,9 @@ std::vector<Handle<String>> FeedbackNexus::GetTypesForSourcePositions(
       SimpleNumberDictionary::cast(feedback->GetHeapObjectAssumeStrong()),
       isolate);
 
-  int entry = types->FindEntry(isolate, position);
-  if (entry == SimpleNumberDictionary::kNotFound) {
-    return types_for_position;
-  }
+  InternalIndex entry = types->FindEntry(isolate, position);
+  if (entry.is_not_found()) return types_for_position;
+
   DCHECK(types->ValueAt(entry).IsArrayList());
   Handle<ArrayList> position_specific_types =
       Handle<ArrayList>(ArrayList::cast(types->ValueAt(entry)), isolate);
diff --git a/deps/v8/src/objects/feedback-vector.h b/deps/v8/src/objects/feedback-vector.h
index 1c34266dc830e3..207ced2a95b0e8 100644
--- a/deps/v8/src/objects/feedback-vector.h
+++ b/deps/v8/src/objects/feedback-vector.h
@@ -7,6 +7,7 @@
 
 #include <vector>
 
+#include "src/base/bit-field.h"
 #include "src/base/logging.h"
 #include "src/base/macros.h"
 #include "src/common/globals.h"
@@ -233,9 +234,9 @@ class FeedbackVector : public HeapObject {
   // Conversion from an integer index to the underlying array to a slot.
   static inline FeedbackSlot ToSlot(int index);
   inline MaybeObject Get(FeedbackSlot slot) const;
-  inline MaybeObject Get(Isolate* isolate, FeedbackSlot slot) const;
+  inline MaybeObject Get(const Isolate* isolate, FeedbackSlot slot) const;
   inline MaybeObject get(int index) const;
-  inline MaybeObject get(Isolate* isolate, int index) const;
+  inline MaybeObject get(const Isolate* isolate, int index) const;
   inline void Set(FeedbackSlot slot, MaybeObject value,
                   WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
   inline void set(int index, MaybeObject value,
@@ -313,8 +314,6 @@ class FeedbackVector : public HeapObject {
   DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
                                 TORQUE_GENERATED_FEEDBACK_VECTOR_FIELDS)
 
-  static const int kHeaderSize = kSize;
-
   static_assert(kSize % kObjectAlignment == 0,
                 "Header must be padded for alignment");
   static const int kFeedbackSlotsOffset = kHeaderSize;
@@ -554,8 +553,8 @@ class FeedbackMetadata : public HeapObject {
   void SetKind(FeedbackSlot slot, FeedbackSlotKind kind);
 
   using VectorICComputer =
-      BitSetComputer<FeedbackSlotKind, kFeedbackSlotKindBits,
-                     kInt32Size * kBitsPerByte, uint32_t>;
+      base::BitSetComputer<FeedbackSlotKind, kFeedbackSlotKindBits,
+                           kInt32Size * kBitsPerByte, uint32_t>;
 
   OBJECT_CONSTRUCTORS(FeedbackMetadata, HeapObject);
 };
@@ -699,8 +698,8 @@ class V8_EXPORT_PRIVATE FeedbackNexus final {
   // count (taken from the type feedback vector).
   float ComputeCallFrequency();
 
-  using SpeculationModeField = BitField<SpeculationMode, 0, 1>;
-  using CallCountField = BitField<uint32_t, 1, 31>;
+  using SpeculationModeField = base::BitField<SpeculationMode, 0, 1>;
+  using CallCountField = base::BitField<uint32_t, 1, 31>;
 
   // For InstanceOf ICs.
   MaybeHandle<JSObject> GetConstructorFeedback() const;
diff --git a/deps/v8/src/objects/feedback-vector.tq b/deps/v8/src/objects/feedback-vector.tq
new file mode 100644
index 00000000000000..c981b8f57c46e7
--- /dev/null
+++ b/deps/v8/src/objects/feedback-vector.tq
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class FeedbackVector extends HeapObject {
+  shared_function_info: SharedFunctionInfo;
+  optimized_code_weak_or_smi: Weak<Code>|Smi;
+  closure_feedback_cell_array: FixedArray;
+  length: int32;
+  invocation_count: int32;
+  profiler_ticks: int32;
+  // TODO(v8:9287) The padding is not necessary on platforms with 4 bytes
+  // tagged pointers, we should make it conditional; however, platform-specific
+  // interacts badly with GCMole, so we need to address that first.
+  padding: uint32;
+}
+
+extern class FeedbackMetadata extends HeapObject;
diff --git a/deps/v8/src/objects/field-index-inl.h b/deps/v8/src/objects/field-index-inl.h
index 93ffc59c724647..ee1f875104b0e0 100644
--- a/deps/v8/src/objects/field-index-inl.h
+++ b/deps/v8/src/objects/field-index-inl.h
@@ -61,11 +61,11 @@ int FieldIndex::GetLoadByFieldIndex() const {
 }
 
 FieldIndex FieldIndex::ForDescriptor(Map map, InternalIndex descriptor_index) {
-  Isolate* isolate = GetIsolateForPtrCompr(map);
+  const Isolate* isolate = GetIsolateForPtrCompr(map);
   return ForDescriptor(isolate, map, descriptor_index);
 }
 
-FieldIndex FieldIndex::ForDescriptor(Isolate* isolate, Map map,
+FieldIndex FieldIndex::ForDescriptor(const Isolate* isolate, Map map,
                                      InternalIndex descriptor_index) {
   PropertyDetails details =
       map.instance_descriptors(isolate).GetDetails(descriptor_index);
diff --git a/deps/v8/src/objects/field-index.h b/deps/v8/src/objects/field-index.h
index fbde0bc60918b3..930f12bcda9cde 100644
--- a/deps/v8/src/objects/field-index.h
+++ b/deps/v8/src/objects/field-index.h
@@ -31,7 +31,7 @@ class FieldIndex final {
   static inline FieldIndex ForInObjectOffset(int offset, Encoding encoding);
   static inline FieldIndex ForDescriptor(Map map,
                                          InternalIndex descriptor_index);
-  static inline FieldIndex ForDescriptor(Isolate* isolate, Map map,
+  static inline FieldIndex ForDescriptor(const Isolate* isolate, Map map,
                                          InternalIndex descriptor_index);
 
   inline int GetLoadByFieldIndex() const;
@@ -110,7 +110,7 @@ class FieldIndex final {
       (kDescriptorIndexBitCount + 1 + kTaggedSizeLog2);
 
   // Index from beginning of object.
-  using OffsetBits = BitField64<int, 0, kOffsetBitsSize>;
+  using OffsetBits = base::BitField64<int, 0, kOffsetBitsSize>;
   using IsInObjectBits = OffsetBits::Next<bool, 1>;
   using EncodingBits = IsInObjectBits::Next<Encoding, 2>;
   // Number of inobject properties.
diff --git a/deps/v8/src/objects/field-type.h b/deps/v8/src/objects/field-type.h
index 3c22692307db92..566994b43ecf91 100644
--- a/deps/v8/src/objects/field-type.h
+++ b/deps/v8/src/objects/field-type.h
@@ -43,9 +43,6 @@ class FieldType : public Object {
 
   V8_EXPORT_PRIVATE void PrintTo(std::ostream& os) const;
 
-  FieldType* operator->() { return this; }
-  const FieldType* operator->() const { return this; }
-
  private:
   explicit constexpr FieldType(Address ptr) : Object(ptr) {}
 };
diff --git a/deps/v8/src/objects/fixed-array-inl.h b/deps/v8/src/objects/fixed-array-inl.h
index 9701f8ef095438..4608f2ea21a019 100644
--- a/deps/v8/src/objects/fixed-array-inl.h
+++ b/deps/v8/src/objects/fixed-array-inl.h
@@ -90,11 +90,11 @@ bool FixedArray::ContainsOnlySmisOrHoles() {
 }
 
 Object FixedArray::get(int index) const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return get(isolate, index);
 }
 
-Object FixedArray::get(Isolate* isolate, int index) const {
+Object FixedArray::get(const Isolate* isolate, int index) const {
   DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
   return TaggedField<Object>::Relaxed_Load(isolate, *this,
                                            OffsetOfElementAt(index));
@@ -183,9 +183,7 @@ void FixedArray::FillWithHoles(int from, int to) {
   }
 }
 
-ObjectSlot FixedArray::data_start() {
-  return RawField(OffsetOfElementAt(0));
-}
+ObjectSlot FixedArray::data_start() { return RawField(OffsetOfElementAt(0)); }
 
 ObjectSlot FixedArray::RawFieldOfElementAt(int index) {
   return RawField(OffsetOfElementAt(index));
@@ -388,11 +386,11 @@ void FixedDoubleArray::FillWithHoles(int from, int to) {
 }
 
 MaybeObject WeakFixedArray::Get(int index) const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return Get(isolate, index);
 }
 
-MaybeObject WeakFixedArray::Get(Isolate* isolate, int index) const {
+MaybeObject WeakFixedArray::Get(const Isolate* isolate, int index) const {
   DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
   return TaggedField<MaybeObject>::Relaxed_Load(isolate, *this,
                                                 OffsetOfElementAt(index));
@@ -436,11 +434,11 @@ void WeakFixedArray::CopyElements(Isolate* isolate, int dst_index,
 }
 
 MaybeObject WeakArrayList::Get(int index) const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return Get(isolate, index);
 }
 
-MaybeObject WeakArrayList::Get(Isolate* isolate, int index) const {
+MaybeObject WeakArrayList::Get(const Isolate* isolate, int index) const {
   DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(capacity()));
   return TaggedField<MaybeObject>::Relaxed_Load(isolate, *this,
                                                 OffsetOfElementAt(index));
@@ -496,7 +494,7 @@ Object ArrayList::Get(int index) const {
   return FixedArray::cast(*this).get(kFirstIndex + index);
 }
 
-Object ArrayList::Get(Isolate* isolate, int index) const {
+Object ArrayList::Get(const Isolate* isolate, int index) const {
   return FixedArray::cast(*this).get(isolate, kFirstIndex + index);
 }
 
@@ -621,7 +619,7 @@ Object TemplateList::get(int index) const {
   return FixedArray::cast(*this).get(kFirstElementIndex + index);
 }
 
-Object TemplateList::get(Isolate* isolate, int index) const {
+Object TemplateList::get(const Isolate* isolate, int index) const {
   return FixedArray::cast(*this).get(isolate, kFirstElementIndex + index);
 }
 
diff --git a/deps/v8/src/objects/fixed-array.h b/deps/v8/src/objects/fixed-array.h
index b9d644b4923bd8..c706fbd2174d8e 100644
--- a/deps/v8/src/objects/fixed-array.h
+++ b/deps/v8/src/objects/fixed-array.h
@@ -112,7 +112,7 @@ class FixedArray : public FixedArrayBase {
  public:
   // Setter and getter for elements.
   inline Object get(int index) const;
-  inline Object get(Isolate* isolate, int index) const;
+  inline Object get(const Isolate* isolate, int index) const;
 
   static inline Handle<Object> get(FixedArray array, int index,
                                    Isolate* isolate);
@@ -271,7 +271,7 @@ class WeakFixedArray : public HeapObject {
   DECL_CAST(WeakFixedArray)
 
   inline MaybeObject Get(int index) const;
-  inline MaybeObject Get(Isolate* isolate, int index) const;
+  inline MaybeObject Get(const Isolate* isolate, int index) const;
 
   // Setter that uses write barrier.
   inline void Set(int index, MaybeObject value);
@@ -344,8 +344,19 @@ class WeakArrayList : public HeapObject {
       Isolate* isolate, Handle<WeakArrayList> array,
       const MaybeObjectHandle& value1, const MaybeObjectHandle& value2);
 
+  // Appends an element to the array and possibly compacts and shrinks live weak
+  // references to the start of the collection. Only use this method when
+  // indices to elements can change.
+  static Handle<WeakArrayList> Append(
+      Isolate* isolate, Handle<WeakArrayList> array,
+      const MaybeObjectHandle& value,
+      AllocationType allocation = AllocationType::kYoung);
+
+  // Compact weak references to the beginning of the array.
+  V8_EXPORT_PRIVATE void Compact(Isolate* isolate);
+
   inline MaybeObject Get(int index) const;
-  inline MaybeObject Get(Isolate* isolate, int index) const;
+  inline MaybeObject Get(const Isolate* isolate, int index) const;
 
   // Set the element at index to obj. The underlying array must be large enough.
   // If you need to grow the WeakArrayList, use the static AddToEnd() method
@@ -357,6 +368,10 @@ class WeakArrayList : public HeapObject {
     return kHeaderSize + capacity * kTaggedSize;
   }
 
+  static constexpr int CapacityForLength(int length) {
+    return length + Max(length / 2, 2);
+  }
+
   // Gives access to raw memory which stores the array's data.
   inline MaybeObjectSlot data_start();
 
@@ -374,7 +389,6 @@ class WeakArrayList : public HeapObject {
   // Layout description.
   DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
                                 TORQUE_GENERATED_WEAK_ARRAY_LIST_FIELDS)
-  static constexpr int kHeaderSize = kSize;
 
   using BodyDescriptor = WeakArrayBodyDescriptor;
 
@@ -388,6 +402,9 @@ class WeakArrayList : public HeapObject {
   // Returns the number of non-cleaned weak references in the array.
   int CountLiveWeakReferences() const;
 
+  // Returns the number of non-cleaned elements in the array.
+  int CountLiveElements() const;
+
   // Returns whether an entry was found and removed. Will move the elements
   // around in the array - this method can only be used in cases where the user
   // doesn't care about the indices! Users should make sure there are no
@@ -445,7 +462,7 @@ class ArrayList : public FixedArray {
   // storage capacity, i.e., length().
   inline void SetLength(int length);
   inline Object Get(int index) const;
-  inline Object Get(Isolate* isolate, int index) const;
+  inline Object Get(const Isolate* isolate, int index) const;
   inline ObjectSlot Slot(int index);
 
   // Set the element at index to obj. The underlying array must be large enough.
@@ -593,7 +610,7 @@ class TemplateList : public FixedArray {
   static Handle<TemplateList> New(Isolate* isolate, int size);
   inline int length() const;
   inline Object get(int index) const;
-  inline Object get(Isolate* isolate, int index) const;
+  inline Object get(const Isolate* isolate, int index) const;
   inline void set(int index, Object value);
   static Handle<TemplateList> Add(Isolate* isolate, Handle<TemplateList> list,
                                   Handle<Object> value);
diff --git a/deps/v8/src/objects/fixed-array.tq b/deps/v8/src/objects/fixed-array.tq
new file mode 100644
index 00000000000000..a0cd748b41d67d
--- /dev/null
+++ b/deps/v8/src/objects/fixed-array.tq
@@ -0,0 +1,137 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@abstract
+extern class FixedArrayBase extends HeapObject {
+  length: Smi;
+}
+
+extern class FixedArray extends FixedArrayBase { objects[length]: Object; }
+
+type EmptyFixedArray extends FixedArray;
+
+extern class FixedDoubleArray extends FixedArrayBase {
+  floats[length]: float64_or_hole;
+}
+
+extern class WeakFixedArray extends HeapObject { length: Smi; }
+
+extern class ByteArray extends FixedArrayBase {}
+
+@hasSameInstanceTypeAsParent
+extern class ArrayList extends FixedArray {
+}
+
+@hasSameInstanceTypeAsParent
+@noVerifier
+extern class TemplateList extends FixedArray {
+}
+
+extern class WeakArrayList extends HeapObject {
+  capacity: Smi;
+  length: Smi;
+  objects[length]: MaybeObject;
+}
+
+extern operator '.length_intptr' macro LoadAndUntagFixedArrayBaseLength(
+    FixedArrayBase): intptr;
+
+extern operator '.objects[]' macro LoadFixedArrayElement(
+    FixedArray, intptr): Object;
+extern operator '.objects[]' macro LoadFixedArrayElement(
+    FixedArray, Smi): Object;
+extern operator '.objects[]' macro LoadFixedArrayElement(
+    FixedArray, constexpr int31): Object;
+extern operator '.objects[]=' macro StoreFixedArrayElement(
+    FixedArray, intptr, Smi): void;
+extern operator '.objects[]=' macro StoreFixedArrayElement(
+    FixedArray, Smi, Smi): void;
+extern operator '.objects[]=' macro StoreFixedArrayElement(
+    FixedArray, intptr, HeapObject): void;
+extern operator '.objects[]=' macro StoreFixedArrayElement(
+    FixedArray, intptr, Object): void;
+extern operator '.objects[]=' macro StoreFixedArrayElement(
+    FixedArray, constexpr int31, Smi): void;
+extern operator '.objects[]=' macro StoreFixedArrayElement(
+    FixedArray, constexpr int31, HeapObject): void;
+extern operator '.objects[]=' macro StoreFixedArrayElement(
+    FixedArray, Smi, Object): void;
+extern macro StoreFixedArrayElement(
+    FixedArray, Smi, Object, constexpr WriteBarrierMode): void;
+extern macro StoreFixedArrayElement(
+    FixedArray, Smi, Smi, constexpr WriteBarrierMode): void;
+extern macro StoreFixedArrayElement(
+    FixedArray, constexpr int31, Object, constexpr WriteBarrierMode): void;
+extern macro StoreFixedArrayElement(
+    FixedArray, constexpr int31, Smi, constexpr WriteBarrierMode): void;
+extern macro StoreFixedArrayElement(
+    FixedArray, intptr, Object, constexpr WriteBarrierMode): void;
+extern macro StoreFixedArrayElement(
+    FixedArray, intptr, Smi, constexpr WriteBarrierMode): void;
+extern operator '.floats[]=' macro StoreFixedDoubleArrayElement(
+    FixedDoubleArray, intptr, float64): void;
+extern operator '.floats[]=' macro StoreFixedDoubleArrayElementSmi(
+    FixedDoubleArray, Smi, float64): void;
+extern operator '.floats[]' macro LoadFixedDoubleArrayElement(
+    FixedDoubleArray, intptr): float64;
+operator '[]=' macro StoreFixedDoubleArrayDirect(
+    a: FixedDoubleArray, i: Smi, v: Number) {
+  a.floats[i] = Convert<float64_or_hole>(Convert<float64>(v));
+}
+operator '[]=' macro StoreFixedArrayDirect(a: FixedArray, i: Smi, v: Object) {
+  a.objects[i] = v;
+}
+
+extern macro AllocateZeroedFixedArray(intptr): FixedArray;
+extern macro AllocateZeroedFixedDoubleArray(intptr): FixedDoubleArray;
+extern macro CalculateNewElementsCapacity(Smi): Smi;
+extern macro CalculateNewElementsCapacity(intptr): intptr;
+
+extern macro AllocateFixedArrayWithHoles(
+    intptr, constexpr AllocationFlag): FixedArray;
+extern macro AllocateFixedDoubleArrayWithHoles(
+    intptr, constexpr AllocationFlag): FixedDoubleArray;
+extern macro CopyFixedArrayElements(
+    constexpr ElementsKind, FixedArray, constexpr ElementsKind, FixedArray,
+    intptr, intptr): void;
+extern macro CopyFixedArrayElements(
+    constexpr ElementsKind, FixedArray, constexpr ElementsKind, FixedArray,
+    intptr, intptr, intptr): void;
+
+macro ExtractFixedArray(
+    source: FixedArray, first: intptr, count: intptr,
+    capacity: intptr): FixedArray {
+  // TODO(tebbi): This should be optimized to use memcpy for initialization.
+  return NewFixedArray(
+      capacity,
+      IteratorSequence<Object>(
+          (& source.objects).Iterator(first, first + count),
+          ConstantIterator(TheHole)));
+}
+macro ExtractFixedDoubleArray(
+    source: FixedDoubleArray, first: intptr, count: intptr,
+    capacity: intptr): FixedDoubleArray|EmptyFixedArray {
+  // TODO(tebbi): This should be optimized to use memcpy for initialization.
+  return NewFixedDoubleArray(
+      capacity,
+      IteratorSequence<float64_or_hole>(
+          (& source.floats).Iterator(first, first + count),
+          ConstantIterator(kDoubleHole)));
+}
+
+macro NewFixedArray<Iterator: type>(length: intptr, it: Iterator): FixedArray {
+  if (length == 0) return kEmptyFixedArray;
+  return new
+  FixedArray{map: kFixedArrayMap, length: Convert<Smi>(length), objects: ...it};
+}
+
+macro NewFixedDoubleArray<Iterator: type>(
+    length: intptr, it: Iterator): FixedDoubleArray|EmptyFixedArray {
+  if (length == 0) return kEmptyFixedArray;
+  return new FixedDoubleArray{
+    map: kFixedDoubleArrayMap,
+    length: Convert<Smi>(length),
+    floats: ...it
+  };
+}
diff --git a/deps/v8/src/objects/foreign-inl.h b/deps/v8/src/objects/foreign-inl.h
index fc93b66a0abb70..d2f3a6df726124 100644
--- a/deps/v8/src/objects/foreign-inl.h
+++ b/deps/v8/src/objects/foreign-inl.h
@@ -22,7 +22,7 @@ CAST_ACCESSOR(Foreign)
 
 // static
 bool Foreign::IsNormalized(Object value) {
-  if (value == Smi::kZero) return true;
+  if (value == Smi::zero()) return true;
   return Foreign::cast(value).foreign_address() != kNullAddress;
 }
 
diff --git a/deps/v8/src/objects/foreign.tq b/deps/v8/src/objects/foreign.tq
new file mode 100644
index 00000000000000..3204635070bd65
--- /dev/null
+++ b/deps/v8/src/objects/foreign.tq
@@ -0,0 +1,8 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@apiExposedInstanceTypeValue(0x46)
+extern class Foreign extends HeapObject {
+  foreign_address: RawPtr;
+}
diff --git a/deps/v8/src/objects/frame-array-inl.h b/deps/v8/src/objects/frame-array-inl.h
index 5b342c64c0536f..e4b395488d8fe7 100644
--- a/deps/v8/src/objects/frame-array-inl.h
+++ b/deps/v8/src/objects/frame-array-inl.h
@@ -33,8 +33,12 @@ FRAME_ARRAY_FIELD_LIST(DEFINE_FRAME_ARRAY_ACCESSORS)
 #undef DEFINE_FRAME_ARRAY_ACCESSORS
 
 bool FrameArray::IsWasmFrame(int frame_ix) const {
+  return IsWasmCompiledFrame(frame_ix) || IsWasmInterpretedFrame(frame_ix);
+}
+
+bool FrameArray::IsWasmCompiledFrame(int frame_ix) const {
   const int flags = Flags(frame_ix).value();
-  return (flags & kIsWasmFrame) != 0;
+  return (flags & kIsWasmCompiledFrame) != 0;
 }
 
 bool FrameArray::IsWasmInterpretedFrame(int frame_ix) const {
diff --git a/deps/v8/src/objects/frame-array.h b/deps/v8/src/objects/frame-array.h
index 42750cf69c2e13..b82a7a60be6fde 100644
--- a/deps/v8/src/objects/frame-array.h
+++ b/deps/v8/src/objects/frame-array.h
@@ -38,6 +38,7 @@ class FrameArray : public FixedArray {
 #undef DECL_FRAME_ARRAY_ACCESSORS
 
   inline bool IsWasmFrame(int frame_ix) const;
+  inline bool IsWasmCompiledFrame(int frame_ix) const;
   inline bool IsWasmInterpretedFrame(int frame_ix) const;
   inline bool IsAsmJsWasmFrame(int frame_ix) const;
   inline bool IsAnyWasmFrame(int frame_ix) const;
@@ -47,7 +48,7 @@ class FrameArray : public FixedArray {
 
   // Flags.
   enum Flag {
-    kIsWasmFrame = 1 << 0,
+    kIsWasmCompiledFrame = 1 << 0,
     kIsWasmInterpretedFrame = 1 << 1,
     kIsAsmJsWasmFrame = 1 << 2,
     kIsStrict = 1 << 3,
diff --git a/deps/v8/src/objects/free-space.tq b/deps/v8/src/objects/free-space.tq
new file mode 100644
index 00000000000000..5fc8767a58accb
--- /dev/null
+++ b/deps/v8/src/objects/free-space.tq
@@ -0,0 +1,8 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class FreeSpace extends HeapObject {
+  size: Smi;
+  next: FreeSpace|Uninitialized;
+}
diff --git a/deps/v8/src/objects/function-kind.h b/deps/v8/src/objects/function-kind.h
index 9b0de76126b27d..dda576fd8a0a6f 100644
--- a/deps/v8/src/objects/function-kind.h
+++ b/deps/v8/src/objects/function-kind.h
@@ -5,7 +5,7 @@
 #ifndef V8_OBJECTS_FUNCTION_KIND_H_
 #define V8_OBJECTS_FUNCTION_KIND_H_
 
-#include "src/utils/utils.h"
+#include "src/base/bounds.h"
 
 namespace v8 {
 namespace internal {
@@ -57,12 +57,13 @@ enum FunctionKind : uint8_t {
 };
 
 inline bool IsArrowFunction(FunctionKind kind) {
-  return IsInRange(kind, FunctionKind::kArrowFunction,
-                   FunctionKind::kAsyncArrowFunction);
+  return base::IsInRange(kind, FunctionKind::kArrowFunction,
+                         FunctionKind::kAsyncArrowFunction);
 }
 
 inline bool IsModule(FunctionKind kind) {
-  return IsInRange(kind, FunctionKind::kModule, FunctionKind::kAsyncModule);
+  return base::IsInRange(kind, FunctionKind::kModule,
+                         FunctionKind::kAsyncModule);
 }
 
 inline bool IsAsyncModule(FunctionKind kind) {
@@ -70,18 +71,18 @@ inline bool IsAsyncModule(FunctionKind kind) {
 }
 
 inline bool IsAsyncGeneratorFunction(FunctionKind kind) {
-  return IsInRange(kind, FunctionKind::kAsyncConciseGeneratorMethod,
-                   FunctionKind::kAsyncGeneratorFunction);
+  return base::IsInRange(kind, FunctionKind::kAsyncConciseGeneratorMethod,
+                         FunctionKind::kAsyncGeneratorFunction);
 }
 
 inline bool IsGeneratorFunction(FunctionKind kind) {
-  return IsInRange(kind, FunctionKind::kAsyncConciseGeneratorMethod,
-                   FunctionKind::kConciseGeneratorMethod);
+  return base::IsInRange(kind, FunctionKind::kAsyncConciseGeneratorMethod,
+                         FunctionKind::kConciseGeneratorMethod);
 }
 
 inline bool IsAsyncFunction(FunctionKind kind) {
-  return IsInRange(kind, FunctionKind::kAsyncArrowFunction,
-                   FunctionKind::kAsyncGeneratorFunction);
+  return base::IsInRange(kind, FunctionKind::kAsyncArrowFunction,
+                         FunctionKind::kAsyncGeneratorFunction);
 }
 
 inline bool IsResumableFunction(FunctionKind kind) {
@@ -89,19 +90,19 @@ inline bool IsResumableFunction(FunctionKind kind) {
 }
 
 inline bool IsConciseMethod(FunctionKind kind) {
-  return IsInRange(kind, FunctionKind::kAsyncConciseMethod,
-                   FunctionKind::kAsyncConciseGeneratorMethod) ||
-         IsInRange(kind, FunctionKind::kConciseGeneratorMethod,
-                   FunctionKind::kClassMembersInitializerFunction);
+  return base::IsInRange(kind, FunctionKind::kAsyncConciseMethod,
+                         FunctionKind::kAsyncConciseGeneratorMethod) ||
+         base::IsInRange(kind, FunctionKind::kConciseGeneratorMethod,
+                         FunctionKind::kClassMembersInitializerFunction);
 }
 
 inline bool IsStrictFunctionWithoutPrototype(FunctionKind kind) {
-  return IsInRange(kind, FunctionKind::kGetterFunction,
-                   FunctionKind::kAsyncArrowFunction) ||
-         IsInRange(kind, FunctionKind::kAsyncConciseMethod,
-                   FunctionKind::kAsyncConciseGeneratorMethod) ||
-         IsInRange(kind, FunctionKind::kConciseGeneratorMethod,
-                   FunctionKind::kClassMembersInitializerFunction);
+  return base::IsInRange(kind, FunctionKind::kGetterFunction,
+                         FunctionKind::kAsyncArrowFunction) ||
+         base::IsInRange(kind, FunctionKind::kAsyncConciseMethod,
+                         FunctionKind::kAsyncConciseGeneratorMethod) ||
+         base::IsInRange(kind, FunctionKind::kConciseGeneratorMethod,
+                         FunctionKind::kClassMembersInitializerFunction);
 }
 
 inline bool IsGetterFunction(FunctionKind kind) {
@@ -113,28 +114,28 @@ inline bool IsSetterFunction(FunctionKind kind) {
 }
 
 inline bool IsAccessorFunction(FunctionKind kind) {
-  return IsInRange(kind, FunctionKind::kGetterFunction,
-                   FunctionKind::kSetterFunction);
+  return base::IsInRange(kind, FunctionKind::kGetterFunction,
+                         FunctionKind::kSetterFunction);
 }
 
 inline bool IsDefaultConstructor(FunctionKind kind) {
-  return IsInRange(kind, FunctionKind::kDefaultBaseConstructor,
-                   FunctionKind::kDefaultDerivedConstructor);
+  return base::IsInRange(kind, FunctionKind::kDefaultBaseConstructor,
+                         FunctionKind::kDefaultDerivedConstructor);
 }
 
 inline bool IsBaseConstructor(FunctionKind kind) {
-  return IsInRange(kind, FunctionKind::kBaseConstructor,
-                   FunctionKind::kDefaultBaseConstructor);
+  return base::IsInRange(kind, FunctionKind::kBaseConstructor,
+                         FunctionKind::kDefaultBaseConstructor);
 }
 
 inline bool IsDerivedConstructor(FunctionKind kind) {
-  return IsInRange(kind, FunctionKind::kDefaultDerivedConstructor,
-                   FunctionKind::kDerivedConstructor);
+  return base::IsInRange(kind, FunctionKind::kDefaultDerivedConstructor,
+                         FunctionKind::kDerivedConstructor);
 }
 
 inline bool IsClassConstructor(FunctionKind kind) {
-  return IsInRange(kind, FunctionKind::kBaseConstructor,
-                   FunctionKind::kDerivedConstructor);
+  return base::IsInRange(kind, FunctionKind::kBaseConstructor,
+                         FunctionKind::kDerivedConstructor);
 }
 
 inline bool IsClassMembersInitializerFunction(FunctionKind kind) {
@@ -142,8 +143,8 @@ inline bool IsClassMembersInitializerFunction(FunctionKind kind) {
 }
 
 inline bool IsConstructable(FunctionKind kind) {
-  return IsInRange(kind, FunctionKind::kNormalFunction,
-                   FunctionKind::kDerivedConstructor);
+  return base::IsInRange(kind, FunctionKind::kNormalFunction,
+                         FunctionKind::kDerivedConstructor);
 }
 
 inline const char* FunctionKind2String(FunctionKind kind) {
diff --git a/deps/v8/src/objects/hash-table-inl.h b/deps/v8/src/objects/hash-table-inl.h
index d4c96f4df49ab9..6a30ee142522ea 100644
--- a/deps/v8/src/objects/hash-table-inl.h
+++ b/deps/v8/src/objects/hash-table-inl.h
@@ -86,6 +86,10 @@ int HashTableBase::Capacity() const {
   return TaggedField<Smi>::load(*this, offset).value();
 }
 
+InternalIndex::Range HashTableBase::IterateEntries() const {
+  return InternalIndex::Range(Capacity());
+}
+
 void HashTableBase::ElementAdded() {
   SetNumberOfElements(NumberOfElements() + 1);
 }
@@ -128,16 +132,16 @@ RootIndex EphemeronHashTableShape::GetMapRootIndex() {
 }
 
 template <typename Derived, typename Shape>
-int HashTable<Derived, Shape>::FindEntry(Isolate* isolate, Key key) {
+InternalIndex HashTable<Derived, Shape>::FindEntry(Isolate* isolate, Key key) {
   return FindEntry(ReadOnlyRoots(isolate), key, Shape::Hash(isolate, key));
 }
 
 // Find entry for key otherwise return kNotFound.
 template <typename Derived, typename Shape>
-int HashTable<Derived, Shape>::FindEntry(ReadOnlyRoots roots, Key key,
-                                         int32_t hash) {
+InternalIndex HashTable<Derived, Shape>::FindEntry(ReadOnlyRoots roots, Key key,
+                                                   int32_t hash) {
   uint32_t capacity = Capacity();
-  uint32_t entry = FirstProbe(hash, capacity);
+  InternalIndex entry = FirstProbe(hash, capacity);
   uint32_t count = 1;
   // EnsureCapacity will guarantee the hash table is never full.
   Object undefined = roots.undefined_value();
@@ -153,16 +157,11 @@ int HashTable<Derived, Shape>::FindEntry(ReadOnlyRoots roots, Key key,
     }
     entry = NextProbe(entry, count++, capacity);
   }
-  return kNotFound;
-}
-
-template <typename Derived, typename Shape>
-bool HashTable<Derived, Shape>::IsKey(ReadOnlyRoots roots, Object k) {
-  return Shape::IsKey(roots, k);
+  return InternalIndex::NotFound();
 }
 
 template <typename Derived, typename Shape>
-bool HashTable<Derived, Shape>::ToKey(ReadOnlyRoots roots, int entry,
+bool HashTable<Derived, Shape>::ToKey(ReadOnlyRoots roots, InternalIndex entry,
                                       Object* out_k) {
   Object k = KeyAt(entry);
   if (!IsKey(roots, k)) return false;
@@ -171,7 +170,7 @@ bool HashTable<Derived, Shape>::ToKey(ReadOnlyRoots roots, int entry,
 }
 
 template <typename Derived, typename Shape>
-bool HashTable<Derived, Shape>::ToKey(Isolate* isolate, int entry,
+bool HashTable<Derived, Shape>::ToKey(Isolate* isolate, InternalIndex entry,
                                       Object* out_k) {
   Object k = KeyAt(isolate, entry);
   if (!IsKey(GetReadOnlyRoots(isolate), k)) return false;
@@ -180,13 +179,14 @@ bool HashTable<Derived, Shape>::ToKey(Isolate* isolate, int entry,
 }
 
 template <typename Derived, typename Shape>
-Object HashTable<Derived, Shape>::KeyAt(int entry) {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+Object HashTable<Derived, Shape>::KeyAt(InternalIndex entry) {
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return KeyAt(isolate, entry);
 }
 
 template <typename Derived, typename Shape>
-Object HashTable<Derived, Shape>::KeyAt(Isolate* isolate, int entry) {
+Object HashTable<Derived, Shape>::KeyAt(const Isolate* isolate,
+                                        InternalIndex entry) {
   return get(isolate, EntryToIndex(entry) + kEntryKeyIndex);
 }
 
@@ -224,13 +224,13 @@ bool BaseShape<KeyT>::IsLive(ReadOnlyRoots roots, Object k) {
 }
 
 bool ObjectHashSet::Has(Isolate* isolate, Handle<Object> key, int32_t hash) {
-  return FindEntry(ReadOnlyRoots(isolate), key, hash) != kNotFound;
+  return FindEntry(ReadOnlyRoots(isolate), key, hash).is_found();
 }
 
 bool ObjectHashSet::Has(Isolate* isolate, Handle<Object> key) {
   Object hash = key->GetHash();
   if (!hash.IsSmi()) return false;
-  return FindEntry(ReadOnlyRoots(isolate), key, Smi::ToInt(hash)) != kNotFound;
+  return FindEntry(ReadOnlyRoots(isolate), key, Smi::ToInt(hash)).is_found();
 }
 
 bool ObjectHashTableShape::IsMatch(Handle<Object> key, Object other) {
diff --git a/deps/v8/src/objects/hash-table.h b/deps/v8/src/objects/hash-table.h
index 32013e58e56a6d..a2d3221719018e 100644
--- a/deps/v8/src/objects/hash-table.h
+++ b/deps/v8/src/objects/hash-table.h
@@ -57,7 +57,7 @@ namespace internal {
 // information by subclasses.
 
 template <typename KeyT>
-class BaseShape {
+class V8_EXPORT_PRIVATE BaseShape {
  public:
   using Key = KeyT;
   static inline RootIndex GetMapRootIndex();
@@ -78,6 +78,8 @@ class V8_EXPORT_PRIVATE HashTableBase : public NON_EXPORTED_BASE(FixedArray) {
   // Returns the capacity of the hash table.
   inline int Capacity() const;
 
+  inline InternalIndex::Range IterateEntries() const;
+
   // ElementAdded should be called whenever an element is added to a
   // hash table.
   inline void ElementAdded();
@@ -91,19 +93,11 @@ class V8_EXPORT_PRIVATE HashTableBase : public NON_EXPORTED_BASE(FixedArray) {
   // number of elements. May be more than HashTable::kMaxCapacity.
   static inline int ComputeCapacity(int at_least_space_for);
 
-  // Compute the probe offset (quadratic probing).
-  V8_INLINE static uint32_t GetProbeOffset(uint32_t n) {
-    return (n + n * n) >> 1;
-  }
-
   static const int kNumberOfElementsIndex = 0;
   static const int kNumberOfDeletedElementsIndex = 1;
   static const int kCapacityIndex = 2;
   static const int kPrefixStartIndex = 3;
 
-  // Constant used for denoting a absent entry.
-  static const int kNotFound = -1;
-
   // Minimum capacity for newly created hash tables.
   static const int kMinCapacity = 4;
 
@@ -115,18 +109,13 @@ class V8_EXPORT_PRIVATE HashTableBase : public NON_EXPORTED_BASE(FixedArray) {
   inline void SetNumberOfDeletedElements(int nod);
 
   // Returns probe entry.
-  static uint32_t GetProbe(uint32_t hash, uint32_t number, uint32_t size) {
-    DCHECK(base::bits::IsPowerOfTwo(size));
-    return (hash + GetProbeOffset(number)) & (size - 1);
+  inline static InternalIndex FirstProbe(uint32_t hash, uint32_t size) {
+    return InternalIndex(hash & (size - 1));
   }
 
-  inline static uint32_t FirstProbe(uint32_t hash, uint32_t size) {
-    return hash & (size - 1);
-  }
-
-  inline static uint32_t NextProbe(uint32_t last, uint32_t number,
-                                   uint32_t size) {
-    return (last + number) & (size - 1);
+  inline static InternalIndex NextProbe(InternalIndex last, uint32_t number,
+                                        uint32_t size) {
+    return InternalIndex((last.as_uint32() + number) & (size - 1));
   }
 
   OBJECT_CONSTRUCTORS(HashTableBase, FixedArray);
@@ -150,22 +139,24 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) HashTable
   void IterateElements(ObjectVisitor* visitor);
 
   // Find entry for key otherwise return kNotFound.
-  inline int FindEntry(ReadOnlyRoots roots, Key key, int32_t hash);
-  inline int FindEntry(Isolate* isolate, Key key);
+  inline InternalIndex FindEntry(ReadOnlyRoots roots, Key key, int32_t hash);
+  inline InternalIndex FindEntry(Isolate* isolate, Key key);
 
   // Rehashes the table in-place.
   void Rehash(ReadOnlyRoots roots);
 
-  // Tells whether k is a real key.  The hole and undefined are not allowed
-  // as keys and can be used to indicate missing or deleted elements.
-  static bool IsKey(ReadOnlyRoots roots, Object k);
+  // Returns whether k is a real key.  The hole and undefined are not allowed as
+  // keys and can be used to indicate missing or deleted elements.
+  static bool IsKey(ReadOnlyRoots roots, Object k) {
+    return Shape::IsKey(roots, k);
+  }
 
-  inline bool ToKey(ReadOnlyRoots roots, int entry, Object* out_k);
-  inline bool ToKey(Isolate* isolate, int entry, Object* out_k);
+  inline bool ToKey(ReadOnlyRoots roots, InternalIndex entry, Object* out_k);
+  inline bool ToKey(Isolate* isolate, InternalIndex entry, Object* out_k);
 
   // Returns the key at entry.
-  inline Object KeyAt(int entry);
-  inline Object KeyAt(Isolate* isolate, int entry);
+  inline Object KeyAt(InternalIndex entry);
+  inline Object KeyAt(const Isolate* isolate, InternalIndex entry);
 
   static const int kElementsStartIndex = kPrefixStartIndex + Shape::kPrefixSize;
   static const int kEntrySize = Shape::kEntrySize;
@@ -185,13 +176,13 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) HashTable
   static const int kMaxRegularCapacity = kMaxRegularHeapObjectSize / 32;
 
   // Returns the index for an entry (of the key)
-  static constexpr inline int EntryToIndex(int entry) {
-    return (entry * kEntrySize) + kElementsStartIndex;
+  static constexpr inline int EntryToIndex(InternalIndex entry) {
+    return (entry.as_int() * kEntrySize) + kElementsStartIndex;
   }
 
-  // Returns the index for an entry (of the key)
-  static constexpr inline int IndexToEntry(int index) {
-    return (index - kElementsStartIndex) / kEntrySize;
+  // Returns the entry for an index (of the key)
+  static constexpr inline InternalIndex IndexToEntry(int index) {
+    return InternalIndex((index - kElementsStartIndex) / kEntrySize);
   }
 
   // Returns the index for a slot address in the object.
@@ -215,7 +206,7 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) HashTable
 
   // Find the entry at which to insert element with the given key that
   // has the given hash value.
-  uint32_t FindInsertionEntry(uint32_t hash);
+  InternalIndex FindInsertionEntry(uint32_t hash);
 
   // Attempt to shrink hash table after removal of key.
   V8_WARN_UNUSED_RESULT static Handle<Derived> Shrink(
@@ -226,10 +217,12 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) HashTable
 
  private:
   // Ensure that kMaxRegularCapacity yields a non-large object dictionary.
-  STATIC_ASSERT(EntryToIndex(kMaxRegularCapacity) < kMaxRegularLength);
+  STATIC_ASSERT(EntryToIndex(InternalIndex(kMaxRegularCapacity)) <
+                kMaxRegularLength);
   STATIC_ASSERT(v8::base::bits::IsPowerOfTwo(kMaxRegularCapacity));
   static const int kMaxRegularEntry = kMaxRegularCapacity / kEntrySize;
-  static const int kMaxRegularIndex = EntryToIndex(kMaxRegularEntry);
+  static const int kMaxRegularIndex =
+      EntryToIndex(InternalIndex(kMaxRegularEntry));
   STATIC_ASSERT(OffsetOfElementAt(kMaxRegularIndex) <
                 kMaxRegularHeapObjectSize);
 
@@ -239,10 +232,10 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) HashTable
   // Returns _expected_ if one of entries given by the first _probe_ probes is
   // equal to  _expected_. Otherwise, returns the entry given by the probe
   // number _probe_.
-  uint32_t EntryForProbe(ReadOnlyRoots roots, Object k, int probe,
-                         uint32_t expected);
+  InternalIndex EntryForProbe(ReadOnlyRoots roots, Object k, int probe,
+                              InternalIndex expected);
 
-  void Swap(uint32_t entry1, uint32_t entry2, WriteBarrierMode mode);
+  void Swap(InternalIndex entry1, InternalIndex entry2, WriteBarrierMode mode);
 
   // Rehashes this hash-table into the new table.
   void Rehash(ReadOnlyRoots roots, Derived new_table);
@@ -296,7 +289,7 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) ObjectHashTableBase
   Object Lookup(ReadOnlyRoots roots, Handle<Object> key, int32_t hash);
 
   // Returns the value at entry.
-  Object ValueAt(int entry);
+  Object ValueAt(InternalIndex entry);
 
   // Overwrite all keys and values with the hole value.
   static void FillEntriesWithHoles(Handle<Derived>);
@@ -316,14 +309,14 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) ObjectHashTableBase
                                 int32_t hash);
 
   // Returns the index to the value of an entry.
-  static inline int EntryToValueIndex(int entry) {
+  static inline int EntryToValueIndex(InternalIndex entry) {
     return HashTable<Derived, Shape>::EntryToIndex(entry) +
            Shape::kEntryValueIndex;
   }
 
  protected:
-  void AddEntry(int entry, Object key, Object value);
-  void RemoveEntry(int entry);
+  void AddEntry(InternalIndex entry, Object key, Object value);
+  void RemoveEntry(InternalIndex entry);
 
   OBJECT_CONSTRUCTORS(ObjectHashTableBase, HashTable<Derived, Shape>);
 };
diff --git a/deps/v8/src/objects/heap-number.h b/deps/v8/src/objects/heap-number.h
index 0982cc232ea0c3..259e23a41d75bb 100644
--- a/deps/v8/src/objects/heap-number.h
+++ b/deps/v8/src/objects/heap-number.h
@@ -57,7 +57,9 @@ class HeapNumber : public PrimitiveHeapObject {
   static const int kNonMantissaBitsInTopWord = 12;
 
   DECL_CAST(HeapNumber)
-  V8_EXPORT_PRIVATE void HeapNumberPrint(std::ostream& os);
+  DECL_VERIFIER(HeapNumber)
+  DECL_PRINTER(HeapNumber)
+  V8_EXPORT_PRIVATE void HeapNumberShortPrint(std::ostream& os);
 
   OBJECT_CONSTRUCTORS(HeapNumber, PrimitiveHeapObject);
 };
diff --git a/deps/v8/src/objects/heap-number.tq b/deps/v8/src/objects/heap-number.tq
new file mode 100644
index 00000000000000..478e861bc2f7e8
--- /dev/null
+++ b/deps/v8/src/objects/heap-number.tq
@@ -0,0 +1,8 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class HeapNumber extends PrimitiveHeapObject { value: float64; }
+
+// The HeapNumber value NaN
+type NaN extends HeapNumber;
diff --git a/deps/v8/src/objects/heap-object.h b/deps/v8/src/objects/heap-object.h
index ad5475c9e80e9f..fcbb0ce8336bb7 100644
--- a/deps/v8/src/objects/heap-object.h
+++ b/deps/v8/src/objects/heap-object.h
@@ -70,11 +70,11 @@ class HeapObject : public Object {
   inline ReadOnlyRoots GetReadOnlyRoots() const;
   // This version is intended to be used for the isolate values produced by
   // i::GetIsolateForPtrCompr(HeapObject) function which may return nullptr.
-  inline ReadOnlyRoots GetReadOnlyRoots(Isolate* isolate) const;
+  inline ReadOnlyRoots GetReadOnlyRoots(const Isolate* isolate) const;
 
 #define IS_TYPE_FUNCTION_DECL(Type) \
   V8_INLINE bool Is##Type() const;  \
-  V8_INLINE bool Is##Type(Isolate* isolate) const;
+  V8_INLINE bool Is##Type(const Isolate* isolate) const;
   HEAP_OBJECT_TYPE_LIST(IS_TYPE_FUNCTION_DECL)
   IS_TYPE_FUNCTION_DECL(HashTableBase)
   IS_TYPE_FUNCTION_DECL(SmallOrderedHashTable)
@@ -94,7 +94,7 @@ class HeapObject : public Object {
 
 #define DECL_STRUCT_PREDICATE(NAME, Name, name) \
   V8_INLINE bool Is##Name() const;              \
-  V8_INLINE bool Is##Name(Isolate* isolate) const;
+  V8_INLINE bool Is##Name(const Isolate* isolate) const;
   STRUCT_LIST(DECL_STRUCT_PREDICATE)
 #undef DECL_STRUCT_PREDICATE
 
diff --git a/deps/v8/src/objects/heap-object.tq b/deps/v8/src/objects/heap-object.tq
new file mode 100644
index 00000000000000..da80d0f944e548
--- /dev/null
+++ b/deps/v8/src/objects/heap-object.tq
@@ -0,0 +1,8 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@abstract
+extern class HeapObject extends StrongTagged {
+  map: Map;
+}
diff --git a/deps/v8/src/objects/instance-type-inl.h b/deps/v8/src/objects/instance-type-inl.h
index 2f867411f283a6..45b858209d3903 100644
--- a/deps/v8/src/objects/instance-type-inl.h
+++ b/deps/v8/src/objects/instance-type-inl.h
@@ -19,25 +19,43 @@ namespace InstanceTypeChecker {
 // Define type checkers for classes with single instance type.
 INSTANCE_TYPE_CHECKERS_SINGLE(INSTANCE_TYPE_CHECKER)
 
-#define STRUCT_INSTANCE_TYPE_CHECKER(TYPE, Name, name) \
-  INSTANCE_TYPE_CHECKER(Name, TYPE)
-STRUCT_LIST(STRUCT_INSTANCE_TYPE_CHECKER)
-#undef STRUCT_INSTANCE_TYPE_CHECKER
+// Checks if value is in range [lower_limit, higher_limit] using a single
+// branch. Assumes that the input instance type is valid.
+template <InstanceType lower_limit, InstanceType upper_limit>
+struct InstanceRangeChecker {
+  static constexpr bool Check(InstanceType value) {
+    return base::IsInRange(value, lower_limit, upper_limit);
+  }
+};
+template <InstanceType upper_limit>
+struct InstanceRangeChecker<FIRST_TYPE, upper_limit> {
+  static constexpr bool Check(InstanceType value) {
+#if V8_HAS_CXX14_CONSTEXPR
+    DCHECK_LE(FIRST_TYPE, value);
+#endif
+    return value <= upper_limit;
+  }
+};
+template <InstanceType lower_limit>
+struct InstanceRangeChecker<lower_limit, LAST_TYPE> {
+  static constexpr bool Check(InstanceType value) {
+#if V8_HAS_CXX14_CONSTEXPR
+    DCHECK_GE(LAST_TYPE, value);
+#endif
+    return value >= lower_limit;
+  }
+};
 
 // Define type checkers for classes with ranges of instance types.
-#define INSTANCE_TYPE_CHECKER_RANGE(type, first_instance_type,                \
-                                    last_instance_type)                       \
-  V8_INLINE bool Is##type(InstanceType instance_type) {                       \
-    return IsInRange(instance_type, first_instance_type, last_instance_type); \
+#define INSTANCE_TYPE_CHECKER_RANGE(type, first_instance_type,             \
+                                    last_instance_type)                    \
+  V8_INLINE bool Is##type(InstanceType instance_type) {                    \
+    return InstanceRangeChecker<first_instance_type,                       \
+                                last_instance_type>::Check(instance_type); \
   }
 INSTANCE_TYPE_CHECKERS_RANGE(INSTANCE_TYPE_CHECKER_RANGE)
 #undef INSTANCE_TYPE_CHECKER_RANGE
 
-V8_INLINE bool IsFixedArrayBase(InstanceType instance_type) {
-  return IsFixedArray(instance_type) || IsFixedDoubleArray(instance_type) ||
-         IsByteArray(instance_type) || IsBytecodeArray(instance_type);
-}
-
 V8_INLINE bool IsHeapObject(InstanceType instance_type) { return true; }
 
 V8_INLINE bool IsInternalizedString(InstanceType instance_type) {
@@ -46,14 +64,9 @@ V8_INLINE bool IsInternalizedString(InstanceType instance_type) {
          (kStringTag | kInternalizedTag);
 }
 
-V8_INLINE bool IsJSObject(InstanceType instance_type) {
-  STATIC_ASSERT(LAST_TYPE == LAST_JS_OBJECT_TYPE);
-  return instance_type >= FIRST_JS_OBJECT_TYPE;
-}
-
-V8_INLINE bool IsJSReceiver(InstanceType instance_type) {
-  STATIC_ASSERT(LAST_TYPE == LAST_JS_RECEIVER_TYPE);
-  return instance_type >= FIRST_JS_RECEIVER_TYPE;
+V8_INLINE bool IsExternalString(InstanceType instance_type) {
+  return (instance_type & (kIsNotStringMask | kStringRepresentationMask)) ==
+         kExternalStringTag;
 }
 
 }  // namespace InstanceTypeChecker
diff --git a/deps/v8/src/objects/instance-type.h b/deps/v8/src/objects/instance-type.h
index f9931972049f86..acfb8759bfa5ce 100644
--- a/deps/v8/src/objects/instance-type.h
+++ b/deps/v8/src/objects/instance-type.h
@@ -210,150 +210,20 @@ V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
                                            InstanceType instance_type);
 
 // List of object types that have a single unique instance type.
-#define INSTANCE_TYPE_CHECKERS_SINGLE_BASE(V)                                \
-  V(AllocationSite, ALLOCATION_SITE_TYPE)                                    \
-  V(BigInt, BIGINT_TYPE)                                                     \
-  V(ObjectBoilerplateDescription, OBJECT_BOILERPLATE_DESCRIPTION_TYPE)       \
-  V(BreakPoint, TUPLE2_TYPE)                                                 \
-  V(BreakPointInfo, TUPLE2_TYPE)                                             \
-  V(ByteArray, BYTE_ARRAY_TYPE)                                              \
-  V(BytecodeArray, BYTECODE_ARRAY_TYPE)                                      \
-  V(CallHandlerInfo, CALL_HANDLER_INFO_TYPE)                                 \
-  V(Cell, CELL_TYPE)                                                         \
-  V(Code, CODE_TYPE)                                                         \
-  V(CachedTemplateObject, TUPLE3_TYPE)                                       \
-  V(CodeDataContainer, CODE_DATA_CONTAINER_TYPE)                             \
-  V(CoverageInfo, FIXED_ARRAY_TYPE)                                          \
-  V(ClosureFeedbackCellArray, CLOSURE_FEEDBACK_CELL_ARRAY_TYPE)              \
-  V(DescriptorArray, DESCRIPTOR_ARRAY_TYPE)                                  \
-  V(EmbedderDataArray, EMBEDDER_DATA_ARRAY_TYPE)                             \
-  V(EphemeronHashTable, EPHEMERON_HASH_TABLE_TYPE)                           \
-  V(FeedbackCell, FEEDBACK_CELL_TYPE)                                        \
-  V(FeedbackMetadata, FEEDBACK_METADATA_TYPE)                                \
-  V(FeedbackVector, FEEDBACK_VECTOR_TYPE)                                    \
-  V(FixedArrayExact, FIXED_ARRAY_TYPE)                                       \
-  V(FixedDoubleArray, FIXED_DOUBLE_ARRAY_TYPE)                               \
-  V(Foreign, FOREIGN_TYPE)                                                   \
-  V(FreeSpace, FREE_SPACE_TYPE)                                              \
-  V(GlobalDictionary, GLOBAL_DICTIONARY_TYPE)                                \
-  V(HeapNumber, HEAP_NUMBER_TYPE)                                            \
-  V(JSArgumentsObject, JS_ARGUMENTS_OBJECT_TYPE)                             \
-  V(JSArgumentsObjectWithLength, JS_ARGUMENTS_OBJECT_TYPE)                   \
-  V(JSArray, JS_ARRAY_TYPE)                                                  \
-  V(JSArrayBuffer, JS_ARRAY_BUFFER_TYPE)                                     \
-  V(JSArrayIterator, JS_ARRAY_ITERATOR_TYPE)                                 \
-  V(JSAsyncFromSyncIterator, JS_ASYNC_FROM_SYNC_ITERATOR_TYPE)               \
-  V(JSAsyncFunctionObject, JS_ASYNC_FUNCTION_OBJECT_TYPE)                    \
-  V(JSAsyncGeneratorObject, JS_ASYNC_GENERATOR_OBJECT_TYPE)                  \
-  V(JSBoundFunction, JS_BOUND_FUNCTION_TYPE)                                 \
-  V(JSContextExtensionObject, JS_CONTEXT_EXTENSION_OBJECT_TYPE)              \
-  V(JSDataView, JS_DATA_VIEW_TYPE)                                           \
-  V(JSDate, JS_DATE_TYPE)                                                    \
-  V(JSError, JS_ERROR_TYPE)                                                  \
-  V(JSFinalizationGroup, JS_FINALIZATION_GROUP_TYPE)                         \
-  V(JSFinalizationGroupCleanupIterator,                                      \
-    JS_FINALIZATION_GROUP_CLEANUP_ITERATOR_TYPE)                             \
-  V(JSFunction, JS_FUNCTION_TYPE)                                            \
-  V(JSGlobalObject, JS_GLOBAL_OBJECT_TYPE)                                   \
-  V(JSGlobalProxy, JS_GLOBAL_PROXY_TYPE)                                     \
-  V(JSMap, JS_MAP_TYPE)                                                      \
-  V(JSMessageObject, JS_MESSAGE_OBJECT_TYPE)                                 \
-  V(JSModuleNamespace, JS_MODULE_NAMESPACE_TYPE)                             \
-  V(JSPrimitiveWrapper, JS_PRIMITIVE_WRAPPER_TYPE)                           \
-  V(JSPromise, JS_PROMISE_TYPE)                                              \
-  V(JSProxy, JS_PROXY_TYPE)                                                  \
-  V(JSRegExp, JS_REG_EXP_TYPE)                                               \
-  V(JSRegExpResult, JS_ARRAY_TYPE)                                           \
-  V(JSRegExpResultIndices, JS_ARRAY_TYPE)                                    \
-  V(JSRegExpStringIterator, JS_REG_EXP_STRING_ITERATOR_TYPE)                 \
-  V(JSSet, JS_SET_TYPE)                                                      \
-  V(JSStringIterator, JS_STRING_ITERATOR_TYPE)                               \
-  V(JSTypedArray, JS_TYPED_ARRAY_TYPE)                                       \
-  V(JSWeakMap, JS_WEAK_MAP_TYPE)                                             \
-  V(JSWeakRef, JS_WEAK_REF_TYPE)                                             \
-  V(JSWeakSet, JS_WEAK_SET_TYPE)                                             \
-  V(LoadHandler, LOAD_HANDLER_TYPE)                                          \
-  V(Map, MAP_TYPE)                                                           \
-  V(NameDictionary, NAME_DICTIONARY_TYPE)                                    \
-  V(NativeContext, NATIVE_CONTEXT_TYPE)                                      \
-  V(NumberDictionary, NUMBER_DICTIONARY_TYPE)                                \
-  V(Oddball, ODDBALL_TYPE)                                                   \
-  V(OrderedHashMap, ORDERED_HASH_MAP_TYPE)                                   \
-  V(OrderedHashSet, ORDERED_HASH_SET_TYPE)                                   \
-  V(OrderedNameDictionary, ORDERED_NAME_DICTIONARY_TYPE)                     \
-  V(PreparseData, PREPARSE_DATA_TYPE)                                        \
-  V(PropertyArray, PROPERTY_ARRAY_TYPE)                                      \
-  V(PropertyCell, PROPERTY_CELL_TYPE)                                        \
-  V(PropertyDescriptorObject, FIXED_ARRAY_TYPE)                              \
-  V(ScopeInfo, SCOPE_INFO_TYPE)                                              \
-  V(ScriptContextTable, SCRIPT_CONTEXT_TABLE_TYPE)                           \
-  V(SharedFunctionInfo, SHARED_FUNCTION_INFO_TYPE)                           \
-  V(SimpleNumberDictionary, SIMPLE_NUMBER_DICTIONARY_TYPE)                   \
-  V(SmallOrderedHashMap, SMALL_ORDERED_HASH_MAP_TYPE)                        \
-  V(SmallOrderedHashSet, SMALL_ORDERED_HASH_SET_TYPE)                        \
-  V(SmallOrderedNameDictionary, SMALL_ORDERED_NAME_DICTIONARY_TYPE)          \
-  V(SourceTextModule, SOURCE_TEXT_MODULE_TYPE)                               \
-  V(StoreHandler, STORE_HANDLER_TYPE)                                        \
-  V(StringTable, STRING_TABLE_TYPE)                                          \
-  V(Symbol, SYMBOL_TYPE)                                                     \
-  V(SyntheticModule, SYNTHETIC_MODULE_TYPE)                                  \
-  V(TransitionArray, TRANSITION_ARRAY_TYPE)                                  \
-  V(UncompiledDataWithoutPreparseData,                                       \
-    UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE)                              \
-  V(UncompiledDataWithPreparseData, UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE) \
-  V(WasmExceptionObject, WASM_EXCEPTION_OBJECT_TYPE)                         \
-  V(WasmGlobalObject, WASM_GLOBAL_OBJECT_TYPE)                               \
-  V(WasmInstanceObject, WASM_INSTANCE_OBJECT_TYPE)                           \
-  V(WasmMemoryObject, WASM_MEMORY_OBJECT_TYPE)                               \
-  V(WasmModuleObject, WASM_MODULE_OBJECT_TYPE)                               \
-  V(WasmTableObject, WASM_TABLE_OBJECT_TYPE)                                 \
-  V(WeakArrayList, WEAK_ARRAY_LIST_TYPE)                                     \
-  V(WeakCell, WEAK_CELL_TYPE)
-#ifdef V8_INTL_SUPPORT
-
-#define INSTANCE_TYPE_CHECKERS_SINGLE(V)                \
-  INSTANCE_TYPE_CHECKERS_SINGLE_BASE(V)                 \
-  V(JSV8BreakIterator, JS_V8_BREAK_ITERATOR_TYPE)       \
-  V(JSCollator, JS_COLLATOR_TYPE)                       \
-  V(JSDateTimeFormat, JS_DATE_TIME_FORMAT_TYPE)         \
-  V(JSListFormat, JS_LIST_FORMAT_TYPE)                  \
-  V(JSLocale, JS_LOCALE_TYPE)                           \
-  V(JSNumberFormat, JS_NUMBER_FORMAT_TYPE)              \
-  V(JSPluralRules, JS_PLURAL_RULES_TYPE)                \
-  V(JSRelativeTimeFormat, JS_RELATIVE_TIME_FORMAT_TYPE) \
-  V(JSSegmentIterator, JS_SEGMENT_ITERATOR_TYPE)        \
-  V(JSSegmenter, JS_SEGMENTER_TYPE)
-
-#else
-
-#define INSTANCE_TYPE_CHECKERS_SINGLE(V) INSTANCE_TYPE_CHECKERS_SINGLE_BASE(V)
-
-#endif  // V8_INTL_SUPPORT
-
-#define INSTANCE_TYPE_CHECKERS_RANGE(V)                                   \
-  V(Context, FIRST_CONTEXT_TYPE, LAST_CONTEXT_TYPE)                       \
-  V(FixedArray, FIRST_FIXED_ARRAY_TYPE, LAST_FIXED_ARRAY_TYPE)            \
-  V(HashTable, FIRST_HASH_TABLE_TYPE, LAST_HASH_TABLE_TYPE)               \
-  V(JSCustomElementsObject, FIRST_JS_CUSTOM_ELEMENTS_OBJECT_TYPE,         \
-    LAST_JS_CUSTOM_ELEMENTS_OBJECT_TYPE)                                  \
-  V(JSFunctionOrBoundFunction, FIRST_FUNCTION_TYPE, LAST_FUNCTION_TYPE)   \
-  V(JSMapIterator, FIRST_JS_MAP_ITERATOR_TYPE, LAST_JS_MAP_ITERATOR_TYPE) \
-  V(JSSetIterator, FIRST_JS_SET_ITERATOR_TYPE, LAST_JS_SET_ITERATOR_TYPE) \
-  V(JSSpecialObject, FIRST_JS_SPECIAL_OBJECT_TYPE,                        \
-    LAST_JS_SPECIAL_OBJECT_TYPE)                                          \
-  V(Microtask, FIRST_MICROTASK_TYPE, LAST_MICROTASK_TYPE)                 \
-  V(Module, FIRST_MODULE_TYPE, LAST_MODULE_TYPE)                          \
-  V(Name, FIRST_NAME_TYPE, LAST_NAME_TYPE)                                \
-  V(PrimitiveHeapObject, FIRST_PRIMITIVE_HEAP_OBJECT_TYPE,                \
-    LAST_PRIMITIVE_HEAP_OBJECT_TYPE)                                      \
-  V(String, FIRST_STRING_TYPE, LAST_STRING_TYPE)                          \
-  V(WeakFixedArray, FIRST_WEAK_FIXED_ARRAY_TYPE, LAST_WEAK_FIXED_ARRAY_TYPE)
+#define INSTANCE_TYPE_CHECKERS_SINGLE(V)           \
+  TORQUE_INSTANCE_CHECKERS_SINGLE_FULLY_DEFINED(V) \
+  TORQUE_INSTANCE_CHECKERS_SINGLE_ONLY_DECLARED(V) \
+  V(BigInt, BIGINT_TYPE)                           \
+  V(CoverageInfo, FIXED_ARRAY_TYPE)                \
+  V(FixedArrayExact, FIXED_ARRAY_TYPE)
+
+#define INSTANCE_TYPE_CHECKERS_RANGE(V)           \
+  TORQUE_INSTANCE_CHECKERS_RANGE_FULLY_DEFINED(V) \
+  TORQUE_INSTANCE_CHECKERS_RANGE_ONLY_DECLARED(V)
 
 #define INSTANCE_TYPE_CHECKERS_CUSTOM(V) \
-  V(FixedArrayBase)                      \
-  V(InternalizedString)                  \
-  V(JSObject)                            \
-  V(JSReceiver)
+  V(ExternalString)                      \
+  V(InternalizedString)
 
 #define INSTANCE_TYPE_CHECKERS(V)  \
   INSTANCE_TYPE_CHECKERS_SINGLE(V) \
@@ -371,11 +241,6 @@ INSTANCE_TYPE_CHECKERS(IS_TYPE_FUNCTION_DECL)
 TYPED_ARRAYS(TYPED_ARRAY_IS_TYPE_FUNCTION_DECL)
 #undef TYPED_ARRAY_IS_TYPE_FUNCTION_DECL
 
-#define STRUCT_IS_TYPE_FUNCTION_DECL(NAME, Name, name) \
-  IS_TYPE_FUNCTION_DECL(Name)
-STRUCT_LIST(STRUCT_IS_TYPE_FUNCTION_DECL)
-#undef STRUCT_IS_TYPE_FUNCTION_DECL
-
 #undef IS_TYPE_FUNCTION_DECL
 }  // namespace InstanceTypeChecker
 
diff --git a/deps/v8/src/objects/internal-index.h b/deps/v8/src/objects/internal-index.h
index ce7378a9017d2c..f00c65bbdd7266 100644
--- a/deps/v8/src/objects/internal-index.h
+++ b/deps/v8/src/objects/internal-index.h
@@ -19,14 +19,14 @@ namespace internal {
 // wrapper: get it via GetEntryForIndex, pass it on to consumers.
 class InternalIndex {
  public:
-  explicit InternalIndex(size_t raw) : entry_(raw) {}
+  explicit constexpr InternalIndex(size_t raw) : entry_(raw) {}
   static InternalIndex NotFound() { return InternalIndex(kNotFound); }
 
-  InternalIndex adjust_down(size_t subtract) {
+  V8_WARN_UNUSED_RESULT InternalIndex adjust_down(size_t subtract) const {
     DCHECK_GE(entry_, subtract);
     return InternalIndex(entry_ - subtract);
   }
-  InternalIndex adjust_up(size_t add) {
+  V8_WARN_UNUSED_RESULT InternalIndex adjust_up(size_t add) const {
     DCHECK_LT(entry_, std::numeric_limits<size_t>::max() - add);
     return InternalIndex(entry_ + add);
   }
@@ -39,8 +39,10 @@ class InternalIndex {
     DCHECK_LE(entry_, std::numeric_limits<uint32_t>::max());
     return static_cast<uint32_t>(entry_);
   }
-  int as_int() const {
-    DCHECK(entry_ >= 0 && entry_ <= std::numeric_limits<int>::max());
+  constexpr int as_int() const {
+#if V8_HAS_CXX14_CONSTEXPR
+    DCHECK_LE(entry_, std::numeric_limits<int>::max());
+#endif
     return static_cast<int>(entry_);
   }
 
diff --git a/deps/v8/src/objects/intl-objects.cc b/deps/v8/src/objects/intl-objects.cc
index a6a2fdd22997f1..b201f7fb1e035f 100644
--- a/deps/v8/src/objects/intl-objects.cc
+++ b/deps/v8/src/objects/intl-objects.cc
@@ -34,6 +34,7 @@
 #include "unicode/decimfmt.h"
 #include "unicode/formattedvalue.h"
 #include "unicode/localebuilder.h"
+#include "unicode/localematcher.h"
 #include "unicode/locid.h"
 #include "unicode/normalizer2.h"
 #include "unicode/numberformatter.h"
@@ -88,7 +89,7 @@ inline constexpr uint16_t ToLatin1Lower(uint16_t ch) {
 
 // Does not work for U+00DF (sharp-s), U+00B5 (micron), U+00FF.
 inline constexpr uint16_t ToLatin1Upper(uint16_t ch) {
-#if V8_CAN_HAVE_DCHECK_IN_CONSTEXPR
+#if V8_HAS_CXX14_CONSTEXPR
   DCHECK(ch != 0xDF && ch != 0xB5 && ch != 0xFF);
 #endif
   return ch &
@@ -1440,12 +1441,114 @@ std::vector<std::string> LookupSupportedLocales(
   return subset;
 }
 
+icu::LocaleMatcher BuildLocaleMatcher(
+    Isolate* isolate, const std::set<std::string>& available_locales,
+    UErrorCode* status) {
+  icu::Locale default_locale =
+      icu::Locale::forLanguageTag(DefaultLocale(isolate), *status);
+  CHECK(U_SUCCESS(*status));
+  icu::LocaleMatcher::Builder builder;
+  builder.setDefaultLocale(&default_locale);
+  for (auto it = available_locales.begin(); it != available_locales.end();
+       ++it) {
+    builder.addSupportedLocale(
+        icu::Locale::forLanguageTag(it->c_str(), *status));
+  }
+
+  return builder.build(*status);
+}
+
+class Iterator : public icu::Locale::Iterator {
+ public:
+  Iterator(std::vector<std::string>::const_iterator begin,
+           std::vector<std::string>::const_iterator end)
+      : iter_(begin), end_(end) {}
+  virtual ~Iterator() {}
+
+  UBool hasNext() const override { return iter_ != end_; }
+
+  const icu::Locale& next() override {
+    UErrorCode status = U_ZERO_ERROR;
+    locale_ = icu::Locale::forLanguageTag(iter_->c_str(), status);
+    CHECK(U_SUCCESS(status));
+    ++iter_;
+    return locale_;
+  }
+
+ private:
+  std::vector<std::string>::const_iterator iter_;
+  std::vector<std::string>::const_iterator end_;
+  icu::Locale locale_;
+};
+
+// ecma402/#sec-bestfitmatcher
+// The BestFitMatcher abstract operation compares requestedLocales, which must
+// be a List as returned by CanonicalizeLocaleList, against the locales in
+// availableLocales and determines the best available language to meet the
+// request. The algorithm is implementation dependent, but should produce
+// results that a typical user of the requested locales would perceive
+// as at least as good as those produced by the LookupMatcher abstract
+// operation. Options specified through Unicode locale extension sequences must
+// be ignored by the algorithm. Information about such subsequences is returned
+// separately. The abstract operation returns a record with a [[locale]] field,
+// whose value is the language tag of the selected locale, which must be an
+// element of availableLocales. If the language tag of the request locale that
+// led to the selected locale contained a Unicode locale extension sequence,
+// then the returned record also contains an [[extension]] field whose value is
+// the first Unicode locale extension sequence within the request locale
+// language tag.
+std::string BestFitMatcher(Isolate* isolate,
+                           const std::set<std::string>& available_locales,
+                           const std::vector<std::string>& requested_locales) {
+  UErrorCode status = U_ZERO_ERROR;
+  icu::LocaleMatcher matcher =
+      BuildLocaleMatcher(isolate, available_locales, &status);
+  CHECK(U_SUCCESS(status));
+
+  Iterator iter(requested_locales.cbegin(), requested_locales.cend());
+  std::string bestfit =
+      matcher.getBestMatch(iter, status)->toLanguageTag<std::string>(status);
+  if (U_FAILURE(status)) {
+    return DefaultLocale(isolate);
+  }
+  // We need to return the extensions with it.
+  for (auto it = requested_locales.begin(); it != requested_locales.end();
+       ++it) {
+    if (it->find(bestfit) == 0) {
+      return *it;
+    }
+  }
+  return bestfit;
+}
+
 // ECMA 402 9.2.8 BestFitSupportedLocales(availableLocales, requestedLocales)
 // https://tc39.github.io/ecma402/#sec-bestfitsupportedlocales
 std::vector<std::string> BestFitSupportedLocales(
-    const std::set<std::string>& available_locales,
+    Isolate* isolate, const std::set<std::string>& available_locales,
     const std::vector<std::string>& requested_locales) {
-  return LookupSupportedLocales(available_locales, requested_locales);
+  UErrorCode status = U_ZERO_ERROR;
+  icu::LocaleMatcher matcher =
+      BuildLocaleMatcher(isolate, available_locales, &status);
+  CHECK(U_SUCCESS(status));
+
+  std::string default_locale = DefaultLocale(isolate);
+  std::vector<std::string> result;
+  for (auto it = requested_locales.cbegin(); it != requested_locales.cend();
+       it++) {
+    if (*it == default_locale) {
+      result.push_back(*it);
+    } else {
+      status = U_ZERO_ERROR;
+      icu::Locale desired = icu::Locale::forLanguageTag(it->c_str(), status);
+      std::string bestfit = matcher.getBestMatch(desired, status)
+                                ->toLanguageTag<std::string>(status);
+      // We need to return the extensions with it.
+      if (U_SUCCESS(status) && it->find(bestfit) == 0) {
+        result.push_back(*it);
+      }
+    }
+  }
+  return result;
 }
 
 // ecma262 #sec-createarrayfromlist
@@ -1470,6 +1573,10 @@ Handle<JSArray> CreateArrayFromList(Isolate* isolate,
   return array;
 }
 
+// To mitigate the risk of bestfit locale matcher, we first check in without
+// turnning it on.
+static bool implement_bestfit = false;
+
 // ECMA 402 9.2.9 SupportedLocales(availableLocales, requestedLocales, options)
 // https://tc39.github.io/ecma402/#sec-supportedlocales
 MaybeHandle<JSObject> SupportedLocales(
@@ -1499,14 +1606,13 @@ MaybeHandle<JSObject> SupportedLocales(
   // 3. If matcher is "best fit", then
   //    a. Let supportedLocales be BestFitSupportedLocales(availableLocales,
   //       requestedLocales).
-  if (matcher == Intl::MatcherOption::kBestFit) {
+  if (matcher == Intl::MatcherOption::kBestFit && implement_bestfit) {
     supported_locales =
-        BestFitSupportedLocales(available_locales, requested_locales);
+        BestFitSupportedLocales(isolate, available_locales, requested_locales);
   } else {
     // 4. Else,
     //    a. Let supportedLocales be LookupSupportedLocales(availableLocales,
     //       requestedLocales).
-    DCHECK_EQ(matcher, Intl::MatcherOption::kLookup);
     supported_locales =
         LookupSupportedLocales(available_locales, requested_locales);
   }
@@ -1587,6 +1693,11 @@ bool Intl::IsWellFormedCalendar(const std::string& value) {
   return JSLocale::Is38AlphaNumList(value);
 }
 
+// ecma402/#sec-iswellformedcurrencycode
+bool Intl::IsWellFormedCurrency(const std::string& currency) {
+  return JSLocale::Is3Alpha(currency);
+}
+
 bool Intl::IsValidCalendar(const icu::Locale& locale,
                            const std::string& value) {
   return IsValidExtension<icu::Calendar>(locale, "calendar", value);
@@ -1751,10 +1862,9 @@ Intl::ResolvedLocale Intl::ResolveLocale(
     const std::vector<std::string>& requested_locales, MatcherOption matcher,
     const std::set<std::string>& relevant_extension_keys) {
   std::string locale;
-  if (matcher == Intl::MatcherOption::kLookup) {
-    locale = LookupMatcher(isolate, available_locales, requested_locales);
-  } else if (matcher == Intl::MatcherOption::kBestFit) {
-    // TODO(intl): Implement better lookup algorithm.
+  if (matcher == Intl::MatcherOption::kBestFit && implement_bestfit) {
+    locale = BestFitMatcher(isolate, available_locales, requested_locales);
+  } else {
     locale = LookupMatcher(isolate, available_locales, requested_locales);
   }
 
@@ -1977,8 +2087,8 @@ Maybe<Intl::MatcherOption> Intl::GetLocaleMatcher(Isolate* isolate,
                                                   const char* method) {
   return Intl::GetStringOption<Intl::MatcherOption>(
       isolate, options, "localeMatcher", method, {"best fit", "lookup"},
-      {Intl::MatcherOption::kLookup, Intl::MatcherOption::kBestFit},
-      Intl::MatcherOption::kLookup);
+      {Intl::MatcherOption::kBestFit, Intl::MatcherOption::kLookup},
+      Intl::MatcherOption::kBestFit);
 }
 
 Maybe<bool> Intl::GetNumberingSystem(Isolate* isolate,
diff --git a/deps/v8/src/objects/intl-objects.h b/deps/v8/src/objects/intl-objects.h
index 0c4a77b745f92f..3ae098f661fa9a 100644
--- a/deps/v8/src/objects/intl-objects.h
+++ b/deps/v8/src/objects/intl-objects.h
@@ -21,7 +21,7 @@
 #include "unicode/locid.h"
 #include "unicode/uversion.h"
 
-#define V8_MINIMUM_ICU_VERSION 64
+#define V8_MINIMUM_ICU_VERSION 65
 
 namespace U_ICU_NAMESPACE {
 class BreakIterator;
@@ -277,6 +277,9 @@ class Intl {
   // Check the calendar is well formed.
   static bool IsWellFormedCalendar(const std::string& value);
 
+  // Check the currency is well formed.
+  static bool IsWellFormedCurrency(const std::string& value);
+
   struct ResolvedLocale {
     std::string locale;
     icu::Locale icu_locale;
diff --git a/deps/v8/src/objects/intl-objects.tq b/deps/v8/src/objects/intl-objects.tq
index d91df566c35e03..f47c0f4adca7c1 100644
--- a/deps/v8/src/objects/intl-objects.tq
+++ b/deps/v8/src/objects/intl-objects.tq
@@ -4,21 +4,28 @@
 
 #include 'src/objects/js-break-iterator.h'
 #include 'src/objects/js-collator.h'
+#include 'src/objects/js-date-time-format.h'
+#include 'src/objects/js-display-names.h'
+#include 'src/objects/js-list-format.h'
+#include 'src/objects/js-locale.h'
 #include 'src/objects/js-number-format.h'
 #include 'src/objects/js-objects.h'
 #include 'src/objects/js-plural-rules.h'
 #include 'src/objects/js-relative-time-format.h'
-#include 'src/objects/js-date-time-format.h'
-#include 'src/objects/js-list-format.h'
-#include 'src/objects/js-locale.h'
 #include 'src/objects/js-segment-iterator.h'
 #include 'src/objects/js-segmenter.h'
 
 extern class JSDateTimeFormat extends JSObject {
+  locale: String;
   icu_locale: Foreign;                // Managed<icu::Locale>
   icu_simple_date_format: Foreign;    // Managed<icu::SimpleDateFormat>
   icu_date_interval_format: Foreign;  // Managed<icu::DateIntervalFormat>
-  bound_format: JSFunction | Undefined;
+  bound_format: JSFunction|Undefined;
+  flags: Smi;
+}
+
+extern class JSDisplayNames extends JSObject {
+  internal: Foreign;  // Managed<DisplayNamesInternal>
   flags: Smi;
 }
 
@@ -30,9 +37,10 @@ extern class JSListFormat extends JSObject {
 
 extern class JSNumberFormat extends JSObject {
   locale: String;
+  numberingSystem: String;
   icu_number_formatter:
       Foreign;  // Managed<icu::number::LocalizedNumberFormatter>
-  bound_format: JSFunction | Undefined;
+  bound_format: JSFunction|Undefined;
   flags: Smi;
 }
 
@@ -46,6 +54,7 @@ extern class JSPluralRules extends JSObject {
 
 extern class JSRelativeTimeFormat extends JSObject {
   locale: String;
+  numberingSystem: String;
   icu_formatter: Foreign;  // Managed<icu::RelativeDateTimeFormatter>
   flags: Smi;
 }
@@ -70,15 +79,15 @@ extern class JSV8BreakIterator extends JSObject {
   locale: String;
   break_iterator: Foreign;  // Managed<icu::BreakIterator>;
   unicode_string: Foreign;  // Managed<icu::UnicodeString>;
-  bound_adopt_text: Undefined | JSFunction;
-  bound_first: Undefined | JSFunction;
-  bound_next: Undefined | JSFunction;
-  bound_current: Undefined | JSFunction;
-  bound_break_type: Undefined | JSFunction;
+  bound_adopt_text: Undefined|JSFunction;
+  bound_first: Undefined|JSFunction;
+  bound_next: Undefined|JSFunction;
+  bound_current: Undefined|JSFunction;
+  bound_break_type: Undefined|JSFunction;
   break_iterator_type: Smi;
 }
 
 extern class JSCollator extends JSObject {
   icu_collator: Foreign;  // Managed<icu::Collator>
-  bound_compare: Undefined | JSFunction;
+  bound_compare: Undefined|JSFunction;
 }
diff --git a/deps/v8/src/objects/js-array-buffer-inl.h b/deps/v8/src/objects/js-array-buffer-inl.h
index 4ed347baa80967..45b9d8c8b000fc 100644
--- a/deps/v8/src/objects/js-array-buffer-inl.h
+++ b/deps/v8/src/objects/js-array-buffer-inl.h
@@ -40,10 +40,32 @@ void* JSArrayBuffer::backing_store() const {
   return reinterpret_cast<void*>(ReadField<Address>(kBackingStoreOffset));
 }
 
-void JSArrayBuffer::set_backing_store(void* value, WriteBarrierMode mode) {
+void JSArrayBuffer::set_backing_store(void* value) {
   WriteField<Address>(kBackingStoreOffset, reinterpret_cast<Address>(value));
 }
 
+ArrayBufferExtension* JSArrayBuffer::extension() const {
+  if (V8_ARRAY_BUFFER_EXTENSION_BOOL) {
+    return base::AsAtomicPointer::Acquire_Load(extension_location());
+  } else {
+    return nullptr;
+  }
+}
+
+ArrayBufferExtension** JSArrayBuffer::extension_location() const {
+  Address location = field_address(kExtensionOffset);
+  return reinterpret_cast<ArrayBufferExtension**>(location);
+}
+
+void JSArrayBuffer::set_extension(ArrayBufferExtension* value) {
+  if (V8_ARRAY_BUFFER_EXTENSION_BOOL) {
+    base::AsAtomicPointer::Release_Store(extension_location(), value);
+    MarkingBarrierForArrayBufferExtension(*this, value);
+  } else {
+    CHECK_EQ(value, nullptr);
+  }
+}
+
 size_t JSArrayBuffer::allocation_length() const {
   if (backing_store() == nullptr) {
     return 0;
@@ -123,7 +145,7 @@ void JSTypedArray::set_external_pointer(Address value) {
 }
 
 Address JSTypedArray::ExternalPointerCompensationForOnHeapArray(
-    Isolate* isolate) {
+    const Isolate* isolate) {
 #ifdef V8_COMPRESS_POINTERS
   return GetIsolateRoot(isolate);
 #else
@@ -133,7 +155,7 @@ Address JSTypedArray::ExternalPointerCompensationForOnHeapArray(
 
 void JSTypedArray::RemoveExternalPointerCompensationForSerialization() {
   DCHECK(is_on_heap());
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   set_external_pointer(external_pointer() -
                        ExternalPointerCompensationForOnHeapArray(isolate));
 }
@@ -150,7 +172,7 @@ void* JSTypedArray::DataPtr() {
 }
 
 void JSTypedArray::SetOffHeapDataPtr(void* base, Address offset) {
-  set_base_pointer(Smi::kZero, SKIP_WRITE_BARRIER);
+  set_base_pointer(Smi::zero(), SKIP_WRITE_BARRIER);
   Address address = reinterpret_cast<Address>(base) + offset;
   set_external_pointer(address);
   DCHECK_EQ(address, reinterpret_cast<Address>(DataPtr()));
@@ -158,7 +180,7 @@ void JSTypedArray::SetOffHeapDataPtr(void* base, Address offset) {
 
 void JSTypedArray::SetOnHeapDataPtr(HeapObject base, Address offset) {
   set_base_pointer(base);
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   set_external_pointer(offset +
                        ExternalPointerCompensationForOnHeapArray(isolate));
   DCHECK_EQ(base.ptr() + offset, reinterpret_cast<Address>(DataPtr()));
diff --git a/deps/v8/src/objects/js-array-buffer.cc b/deps/v8/src/objects/js-array-buffer.cc
index d3f5a0a9520b2d..f4f43205373550 100644
--- a/deps/v8/src/objects/js-array-buffer.cc
+++ b/deps/v8/src/objects/js-array-buffer.cc
@@ -41,14 +41,19 @@ void JSArrayBuffer::Setup(SharedFlag shared,
   set_is_shared(shared == SharedFlag::kShared);
   set_is_detachable(shared != SharedFlag::kShared);
   for (int i = 0; i < v8::ArrayBuffer::kEmbedderFieldCount; i++) {
-    SetEmbedderField(i, Smi::kZero);
+    SetEmbedderField(i, Smi::zero());
   }
+  set_extension(nullptr);
   if (!backing_store) {
     set_backing_store(nullptr);
     set_byte_length(0);
   } else {
     Attach(std::move(backing_store));
   }
+  if (shared == SharedFlag::kShared) {
+    GetIsolate()->CountUsage(
+        v8::Isolate::UseCounterFeature::kSharedArrayBufferConstructed);
+  }
 }
 
 void JSArrayBuffer::Attach(std::shared_ptr<BackingStore> backing_store) {
@@ -58,7 +63,13 @@ void JSArrayBuffer::Attach(std::shared_ptr<BackingStore> backing_store) {
   set_byte_length(backing_store->byte_length());
   if (backing_store->is_wasm_memory()) set_is_detachable(false);
   if (!backing_store->free_on_destruct()) set_is_external(true);
-  GetIsolate()->heap()->RegisterBackingStore(*this, std::move(backing_store));
+  if (V8_ARRAY_BUFFER_EXTENSION_BOOL) {
+    Heap* heap = GetIsolate()->heap();
+    EnsureExtension(heap);
+    extension()->set_backing_store(std::move(backing_store));
+  } else {
+    GetIsolate()->heap()->RegisterBackingStore(*this, std::move(backing_store));
+  }
 }
 
 void JSArrayBuffer::Detach(bool force_for_wasm_memory) {
@@ -73,7 +84,12 @@ void JSArrayBuffer::Detach(bool force_for_wasm_memory) {
 
   Isolate* const isolate = GetIsolate();
   if (backing_store()) {
-    auto backing_store = isolate->heap()->UnregisterBackingStore(*this);
+    std::shared_ptr<BackingStore> backing_store;
+    if (V8_ARRAY_BUFFER_EXTENSION_BOOL) {
+      backing_store = RemoveExtension();
+    } else {
+      backing_store = isolate->heap()->UnregisterBackingStore(*this);
+    }
     CHECK_IMPLIES(force_for_wasm_memory, backing_store->is_wasm_memory());
   }
 
@@ -89,7 +105,54 @@ void JSArrayBuffer::Detach(bool force_for_wasm_memory) {
 }
 
 std::shared_ptr<BackingStore> JSArrayBuffer::GetBackingStore() {
-  return GetIsolate()->heap()->LookupBackingStore(*this);
+  if (V8_ARRAY_BUFFER_EXTENSION_BOOL) {
+    if (!extension()) return nullptr;
+    return extension()->backing_store();
+  } else {
+    return GetIsolate()->heap()->LookupBackingStore(*this);
+  }
+}
+
+ArrayBufferExtension* JSArrayBuffer::EnsureExtension(Heap* heap) {
+  DCHECK(V8_ARRAY_BUFFER_EXTENSION_BOOL);
+  if (extension() != nullptr) return extension();
+
+  ArrayBufferExtension* extension =
+      new ArrayBufferExtension(std::shared_ptr<BackingStore>());
+  set_extension(extension);
+  heap->AppendArrayBufferExtension(*this, extension);
+  return extension;
+}
+
+std::shared_ptr<BackingStore> JSArrayBuffer::RemoveExtension() {
+  ArrayBufferExtension* extension = this->extension();
+  DCHECK_NOT_NULL(extension);
+  auto result = extension->RemoveBackingStore();
+  // Remove pointer to extension such that the next GC will free it
+  // automatically.
+  set_extension(nullptr);
+  return result;
+}
+
+void JSArrayBuffer::MarkExtension() {
+  ArrayBufferExtension* extension = this->extension();
+  if (extension) {
+    extension->Mark();
+  }
+}
+
+void JSArrayBuffer::YoungMarkExtension() {
+  ArrayBufferExtension* extension = this->extension();
+  if (extension) {
+    extension->YoungMark();
+  }
+}
+
+void JSArrayBuffer::YoungMarkExtensionPromoted() {
+  ArrayBufferExtension* extension = this->extension();
+  if (extension) {
+    extension->YoungMarkPromoted();
+  }
 }
 
 Handle<JSArrayBuffer> JSTypedArray::GetBuffer() {
@@ -152,9 +215,9 @@ Maybe<bool> JSTypedArray::DefineOwnProperty(Isolate* isolate,
       // 3b i. If IsInteger(numericIndex) is false, return false.
       // 3b ii. If numericIndex = -0, return false.
       // 3b iii. If numericIndex < 0, return false.
-      // FIXME: the standard allows up to 2^53 elements.
-      uint32_t index;
-      if (numeric_index->IsMinusZero() || !numeric_index->ToUint32(&index)) {
+      size_t index;
+      if (numeric_index->IsMinusZero() ||
+          !numeric_index->ToIntegerIndex(&index)) {
         RETURN_FAILURE(isolate, GetShouldThrow(isolate, should_throw),
                        NewTypeError(MessageTemplate::kInvalidTypedArrayIndex));
       }
@@ -190,10 +253,11 @@ Maybe<bool> JSTypedArray::DefineOwnProperty(Isolate* isolate,
         if (!desc->has_enumerable()) desc->set_enumerable(true);
         if (!desc->has_writable()) desc->set_writable(true);
         Handle<Object> value = desc->value();
-        RETURN_ON_EXCEPTION_VALUE(isolate,
-                                  SetOwnElementIgnoreAttributes(
-                                      o, index, value, desc->ToAttributes()),
-                                  Nothing<bool>());
+        LookupIterator it(isolate, o, index, LookupIterator::OWN);
+        RETURN_ON_EXCEPTION_VALUE(
+            isolate,
+            DefineOwnPropertyIgnoreAttributes(&it, value, desc->ToAttributes()),
+            Nothing<bool>());
       }
       // 3b xi. Return true.
       return Just(true);
diff --git a/deps/v8/src/objects/js-array-buffer.h b/deps/v8/src/objects/js-array-buffer.h
index 71adb42ae84196..1f3024ef6a4acb 100644
--- a/deps/v8/src/objects/js-array-buffer.h
+++ b/deps/v8/src/objects/js-array-buffer.h
@@ -5,6 +5,7 @@
 #ifndef V8_OBJECTS_JS_ARRAY_BUFFER_H_
 #define V8_OBJECTS_JS_ARRAY_BUFFER_H_
 
+#include "src/base/bit-field.h"
 #include "src/objects/backing-store.h"
 #include "src/objects/js-objects.h"
 
@@ -14,6 +15,8 @@
 namespace v8 {
 namespace internal {
 
+class ArrayBufferExtension;
+
 class JSArrayBuffer : public JSObject {
  public:
 // The maximum length for JSArrayBuffer's supported by V8.
@@ -30,7 +33,10 @@ class JSArrayBuffer : public JSObject {
   DECL_PRIMITIVE_ACCESSORS(byte_length, size_t)
 
   // [backing_store]: backing memory for this array
-  DECL_ACCESSORS(backing_store, void*)
+  DECL_PRIMITIVE_ACCESSORS(backing_store, void*)
+
+  // [extension]: extension object used for GC
+  DECL_PRIMITIVE_ACCESSORS(extension, ArrayBufferExtension*)
 
   // For non-wasm, allocation_length and allocation_base are byte_length and
   // backing_store, respectively.
@@ -99,6 +105,18 @@ class JSArrayBuffer : public JSObject {
   // or a zero-length array buffer).
   std::shared_ptr<BackingStore> GetBackingStore();
 
+  // Allocates an ArrayBufferExtension for this array buffer, unless it is
+  // already associated with an extension.
+  ArrayBufferExtension* EnsureExtension(Heap* heap);
+
+  // Frees the associated ArrayBufferExtension and returns its backing store.
+  std::shared_ptr<BackingStore> RemoveExtension();
+
+  // Marks ArrayBufferExtension
+  void MarkExtension();
+  void YoungMarkExtension();
+  void YoungMarkExtensionPromoted();
+
   // Dispatched behavior.
   DECL_PRINTER(JSArrayBuffer)
   DECL_VERIFIER(JSArrayBuffer)
@@ -109,6 +127,8 @@ class JSArrayBuffer : public JSObject {
   /* Raw data fields. */                                                    \
   V(kByteLengthOffset, kUIntptrSize)                                        \
   V(kBackingStoreOffset, kSystemPointerSize)                                \
+  V(kExtensionOffset,                                                       \
+    (V8_ARRAY_BUFFER_EXTENSION_BOOL ? kSystemPointerSize : 0))              \
   V(kBitFieldOffset, kInt32Size)                                            \
   /* Pads header size to be a multiple of kTaggedSize. */                   \
   V(kOptionalPaddingOffset, OBJECT_POINTER_PADDING(kOptionalPaddingOffset)) \
@@ -125,6 +145,71 @@ class JSArrayBuffer : public JSObject {
   class BodyDescriptor;
 
   OBJECT_CONSTRUCTORS(JSArrayBuffer, JSObject);
+
+ private:
+  inline ArrayBufferExtension** extension_location() const;
+};
+
+// Each JSArrayBuffer (with a backing store) has a corresponding native-heap
+// allocated ArrayBufferExtension for GC purposes and storing the backing store.
+// When marking a JSArrayBuffer, the GC also marks the native
+// extension-object. The GC periodically iterates all extensions concurrently
+// and frees unmarked ones.
+// https://docs.google.com/document/d/1-ZrLdlFX1nXT3z-FAgLbKal1gI8Auiaya_My-a0UJ28/edit
+class ArrayBufferExtension : public Malloced {
+  enum class GcState : uint8_t { Dead = 0, Copied, Promoted };
+
+  std::atomic<bool> marked_;
+  std::atomic<GcState> young_gc_state_;
+  std::shared_ptr<BackingStore> backing_store_;
+  ArrayBufferExtension* next_;
+
+  GcState young_gc_state() {
+    return young_gc_state_.load(std::memory_order_relaxed);
+  }
+
+  void set_young_gc_state(GcState value) {
+    young_gc_state_.store(value, std::memory_order_relaxed);
+  }
+
+ public:
+  ArrayBufferExtension()
+      : marked_(false),
+        young_gc_state_(GcState::Dead),
+        backing_store_(std::shared_ptr<BackingStore>()),
+        next_(nullptr) {}
+  explicit ArrayBufferExtension(std::shared_ptr<BackingStore> backing_store)
+      : marked_(false),
+        young_gc_state_(GcState::Dead),
+        backing_store_(backing_store),
+        next_(nullptr) {}
+
+  void Mark() { marked_.store(true, std::memory_order_relaxed); }
+  void Unmark() { marked_.store(false, std::memory_order_relaxed); }
+  bool IsMarked() { return marked_.load(std::memory_order_relaxed); }
+
+  void YoungMark() { set_young_gc_state(GcState::Copied); }
+  void YoungMarkPromoted() { set_young_gc_state(GcState::Promoted); }
+  void YoungUnmark() { set_young_gc_state(GcState::Dead); }
+  bool IsYoungMarked() { return young_gc_state() != GcState::Dead; }
+
+  bool IsYoungPromoted() { return young_gc_state() == GcState::Promoted; }
+
+  std::shared_ptr<BackingStore> backing_store() { return backing_store_; }
+  BackingStore* backing_store_raw() { return backing_store_.get(); }
+
+  std::shared_ptr<BackingStore> RemoveBackingStore() {
+    return std::move(backing_store_);
+  }
+
+  void set_backing_store(std::shared_ptr<BackingStore> backing_store) {
+    backing_store_ = std::move(backing_store);
+  }
+
+  void reset_backing_store() { backing_store_.reset(); }
+
+  ArrayBufferExtension* next() { return next_; }
+  void set_next(ArrayBufferExtension* extension) { next_ = extension; }
 };
 
 class JSArrayBufferView : public JSObject {
@@ -204,7 +289,7 @@ class JSTypedArray : public JSArrayBufferView {
   // as Tagged_t value and an |external_pointer| value.
   // For full-pointer mode the compensation value is zero.
   static inline Address ExternalPointerCompensationForOnHeapArray(
-      Isolate* isolate);
+      const Isolate* isolate);
 
   // Subtracts external pointer compensation from the external pointer value.
   inline void RemoveExternalPointerCompensationForSerialization();
diff --git a/deps/v8/src/objects/js-array-buffer.tq b/deps/v8/src/objects/js-array-buffer.tq
new file mode 100644
index 00000000000000..92c004d653012a
--- /dev/null
+++ b/deps/v8/src/objects/js-array-buffer.tq
@@ -0,0 +1,23 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class JSArrayBuffer extends JSObject {
+  byte_length: uintptr;
+  backing_store: RawPtr;
+}
+
+@abstract
+extern class JSArrayBufferView extends JSObject {
+  buffer: JSArrayBuffer;
+  byte_offset: uintptr;
+  byte_length: uintptr;
+}
+
+extern class JSTypedArray extends JSArrayBufferView {
+  length: uintptr;
+  external_pointer: RawPtr;
+  base_pointer: ByteArray|Smi;
+}
+
+extern class JSDataView extends JSArrayBufferView { data_pointer: RawPtr; }
diff --git a/deps/v8/src/objects/js-array.h b/deps/v8/src/objects/js-array.h
index c990151b2758ab..86d14f1924bb2d 100644
--- a/deps/v8/src/objects/js-array.h
+++ b/deps/v8/src/objects/js-array.h
@@ -122,7 +122,7 @@ class JSArray : public JSObject {
   static const uint32_t kMinJoinStackSize = 2;
 
   static const int kInitialMaxFastElementArray =
-      (kMaxRegularHeapObjectSize - FixedArray::kHeaderSize - kSize -
+      (kMaxRegularHeapObjectSize - FixedArray::kHeaderSize - kHeaderSize -
        AllocationMemento::kSize) >>
       kDoubleSizeLog2;
 
diff --git a/deps/v8/src/objects/js-array.tq b/deps/v8/src/objects/js-array.tq
new file mode 100644
index 00000000000000..b14e794d4d5a3e
--- /dev/null
+++ b/deps/v8/src/objects/js-array.tq
@@ -0,0 +1,296 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class JSArrayIterator extends JSObject {
+  iterated_object: JSReceiver;
+  next_index: Number;
+  kind: Smi;
+}
+
+extern class JSArray extends JSObject {
+  macro IsEmpty(): bool {
+    return this.length == 0;
+  }
+  length: Number;
+}
+
+macro NewJSArray(implicit context: Context)(
+    map: Map, elements: FixedArrayBase): JSArray {
+  return new JSArray{
+    map,
+    properties_or_hash: kEmptyFixedArray,
+    elements,
+    length: elements.length
+  };
+}
+
+macro NewJSArray(implicit context: Context)(): JSArray {
+  return new JSArray{
+    map: GetFastPackedSmiElementsJSArrayMap(),
+    properties_or_hash: kEmptyFixedArray,
+    elements: kEmptyFixedArray,
+    length: 0
+  };
+}
+
+// A HeapObject with a JSArray map, and either fast packed elements, or fast
+// holey elements when the global NoElementsProtector is not invalidated.
+transient type FastJSArray extends JSArray;
+
+// A HeapObject with a JSArray map, and either fast packed elements, or fast
+// holey elements or frozen, sealed elements when the global NoElementsProtector
+// is not invalidated.
+transient type FastJSArrayForRead extends JSArray;
+
+// A FastJSArray when the global ArraySpeciesProtector is not invalidated.
+transient type FastJSArrayForCopy extends FastJSArray;
+
+// A FastJSArray when the global ArrayIteratorProtector is not invalidated.
+transient type FastJSArrayWithNoCustomIteration extends FastJSArray;
+
+// A FastJSArrayForRead when the global ArrayIteratorProtector is not
+// invalidated.
+transient type FastJSArrayForReadWithNoCustomIteration extends
+    FastJSArrayForRead;
+
+extern macro AllocateJSArray(
+    constexpr ElementsKind, Map, intptr, Smi,
+    constexpr AllocationFlag): JSArray;
+extern macro AllocateJSArray(constexpr ElementsKind, Map, intptr, Smi): JSArray;
+extern macro AllocateJSArray(constexpr ElementsKind, Map, Smi, Smi): JSArray;
+extern macro AllocateJSArray(Map, FixedArrayBase, Smi): JSArray;
+
+macro LoadElementNoHole<T : type extends FixedArrayBase>(
+    a: JSArray, index: Smi): JSAny
+    labels IfHole;
+
+LoadElementNoHole<FixedArray>(implicit context: Context)(
+    a: JSArray, index: Smi): JSAny
+    labels IfHole {
+  const elements: FixedArray =
+      Cast<FixedArray>(a.elements) otherwise unreachable;
+  const e = UnsafeCast<(JSAny | TheHole)>(elements.objects[index]);
+  typeswitch (e) {
+    case (TheHole): {
+      goto IfHole;
+    }
+    case (e: JSAny): {
+      return e;
+    }
+  }
+}
+
+LoadElementNoHole<FixedDoubleArray>(implicit context: Context)(
+    a: JSArray, index: Smi): JSAny
+    labels IfHole {
+  const elements: FixedDoubleArray =
+      Cast<FixedDoubleArray>(a.elements) otherwise unreachable;
+  const e: float64 = elements.floats[index].Value() otherwise IfHole;
+  return AllocateHeapNumberWithValue(e);
+}
+
+extern builtin ExtractFastJSArray(Context, JSArray, Smi, Smi): JSArray;
+
+extern macro MoveElements(
+    constexpr ElementsKind, FixedArrayBase, intptr, intptr, intptr): void;
+macro TorqueMoveElementsSmi(
+    elements: FixedArray, dstIndex: intptr, srcIndex: intptr,
+    count: intptr): void {
+  MoveElements(
+      ElementsKind::HOLEY_SMI_ELEMENTS, elements, dstIndex, srcIndex, count);
+}
+macro TorqueMoveElements(
+    elements: FixedArray, dstIndex: intptr, srcIndex: intptr,
+    count: intptr): void {
+  MoveElements(
+      ElementsKind::HOLEY_ELEMENTS, elements, dstIndex, srcIndex, count);
+}
+macro TorqueMoveElements(
+    elements: FixedDoubleArray, dstIndex: intptr, srcIndex: intptr,
+    count: intptr): void {
+  MoveElements(
+      ElementsKind::HOLEY_DOUBLE_ELEMENTS, elements, dstIndex, srcIndex, count);
+}
+
+extern macro CopyElements(
+    constexpr ElementsKind, FixedArrayBase, intptr, FixedArrayBase, intptr,
+    intptr): void;
+macro TorqueCopyElements(
+    dstElements: FixedArray, dstIndex: intptr, srcElements: FixedArray,
+    srcIndex: intptr, count: intptr): void {
+  CopyElements(
+      ElementsKind::HOLEY_ELEMENTS, dstElements, dstIndex, srcElements,
+      srcIndex, count);
+}
+macro TorqueCopyElements(
+    dstElements: FixedDoubleArray, dstIndex: intptr,
+    srcElements: FixedDoubleArray, srcIndex: intptr, count: intptr): void {
+  CopyElements(
+      ElementsKind::HOLEY_DOUBLE_ELEMENTS, dstElements, dstIndex, srcElements,
+      srcIndex, count);
+}
+
+extern builtin CloneFastJSArray(Context, FastJSArrayForCopy): JSArray;
+
+struct FastJSArrayWitness {
+  macro Get(): FastJSArray {
+    return this.unstable;
+  }
+
+  macro Recheck() labels CastError {
+    if (this.stable.map != this.map) goto CastError;
+    // We don't need to check elements kind or whether the prototype
+    // has changed away from the default JSArray prototype, because
+    // if the map remains the same then those properties hold.
+    //
+    // However, we have to make sure there are no elements in the
+    // prototype chain.
+    if (IsNoElementsProtectorCellInvalid()) goto CastError;
+    this.unstable = %RawDownCast<FastJSArray>(this.stable);
+  }
+
+  macro LoadElementNoHole(implicit context: Context)(k: Smi): JSAny
+      labels FoundHole {
+    if (this.hasDoubles) {
+      return LoadElementNoHole<FixedDoubleArray>(this.unstable, k)
+          otherwise FoundHole;
+    } else {
+      return LoadElementNoHole<FixedArray>(this.unstable, k)
+          otherwise FoundHole;
+    }
+  }
+
+  macro StoreHole(k: Smi) {
+    if (this.hasDoubles) {
+      const elements = Cast<FixedDoubleArray>(this.unstable.elements)
+          otherwise unreachable;
+      elements.floats[k] = kDoubleHole;
+    } else {
+      const elements = Cast<FixedArray>(this.unstable.elements)
+          otherwise unreachable;
+      elements.objects[k] = TheHole;
+    }
+  }
+
+  macro LoadElementOrUndefined(implicit context: Context)(k: Smi): JSAny {
+    try {
+      return this.LoadElementNoHole(k) otherwise FoundHole;
+    }
+    label FoundHole {
+      return Undefined;
+    }
+  }
+
+  macro EnsureArrayPushable(implicit context: Context)() labels Failed {
+    EnsureArrayPushable(this.map) otherwise Failed;
+    array::EnsureWriteableFastElements(this.unstable);
+    this.arrayIsPushable = true;
+  }
+
+  macro ChangeLength(newLength: Smi) {
+    assert(this.arrayIsPushable);
+    this.unstable.length = newLength;
+  }
+
+  macro Push(value: JSAny) labels Failed {
+    assert(this.arrayIsPushable);
+    if (this.hasDoubles) {
+      BuildAppendJSArray(
+          ElementsKind::HOLEY_DOUBLE_ELEMENTS, this.unstable, value)
+          otherwise Failed;
+    } else if (this.hasSmis) {
+      BuildAppendJSArray(ElementsKind::HOLEY_SMI_ELEMENTS, this.unstable, value)
+          otherwise Failed;
+    } else {
+      assert(
+          this.map.elements_kind == ElementsKind::HOLEY_ELEMENTS ||
+          this.map.elements_kind == ElementsKind::PACKED_ELEMENTS);
+      BuildAppendJSArray(ElementsKind::HOLEY_ELEMENTS, this.unstable, value)
+          otherwise Failed;
+    }
+  }
+
+  macro MoveElements(dst: intptr, src: intptr, length: intptr) {
+    assert(this.arrayIsPushable);
+    if (this.hasDoubles) {
+      const elements: FixedDoubleArray =
+          Cast<FixedDoubleArray>(this.unstable.elements)
+          otherwise unreachable;
+      TorqueMoveElements(elements, dst, src, length);
+    } else {
+      const elements: FixedArray = Cast<FixedArray>(this.unstable.elements)
+          otherwise unreachable;
+      if (this.hasSmis) {
+        TorqueMoveElementsSmi(elements, dst, src, length);
+      } else {
+        TorqueMoveElements(elements, dst, src, length);
+      }
+    }
+  }
+
+  const stable: JSArray;
+  unstable: FastJSArray;
+  const map: Map;
+  const hasDoubles: bool;
+  const hasSmis: bool;
+  arrayIsPushable: bool;
+}
+
+macro NewFastJSArrayWitness(array: FastJSArray): FastJSArrayWitness {
+  const kind = array.map.elements_kind;
+  return FastJSArrayWitness{
+    stable: array,
+    unstable: array,
+    map: array.map,
+    hasDoubles: IsDoubleElementsKind(kind),
+    hasSmis:
+        IsElementsKindLessThanOrEqual(kind, ElementsKind::HOLEY_SMI_ELEMENTS),
+    arrayIsPushable: false
+  };
+}
+
+struct FastJSArrayForReadWitness {
+  macro Get(): FastJSArrayForRead {
+    return this.unstable;
+  }
+
+  macro Recheck() labels CastError {
+    if (this.stable.map != this.map) goto CastError;
+    // We don't need to check elements kind or whether the prototype
+    // has changed away from the default JSArray prototype, because
+    // if the map remains the same then those properties hold.
+    //
+    // However, we have to make sure there are no elements in the
+    // prototype chain.
+    if (IsNoElementsProtectorCellInvalid()) goto CastError;
+    this.unstable = %RawDownCast<FastJSArrayForRead>(this.stable);
+  }
+
+  macro LoadElementNoHole(implicit context: Context)(k: Smi): JSAny
+      labels FoundHole {
+    if (this.hasDoubles) {
+      return LoadElementNoHole<FixedDoubleArray>(this.unstable, k)
+          otherwise FoundHole;
+    } else {
+      return LoadElementNoHole<FixedArray>(this.unstable, k)
+          otherwise FoundHole;
+    }
+  }
+
+  const stable: JSArray;
+  unstable: FastJSArrayForRead;
+  const map: Map;
+  const hasDoubles: bool;
+}
+
+macro NewFastJSArrayForReadWitness(array: FastJSArrayForRead):
+    FastJSArrayForReadWitness {
+  const kind = array.map.elements_kind;
+  return FastJSArrayForReadWitness{
+    stable: array,
+    unstable: array,
+    map: array.map,
+    hasDoubles: IsDoubleElementsKind(kind)
+  };
+}
diff --git a/deps/v8/src/objects/js-collection-iterator.h b/deps/v8/src/objects/js-collection-iterator.h
index 0a4083767760e5..b193aa84cdde68 100644
--- a/deps/v8/src/objects/js-collection-iterator.h
+++ b/deps/v8/src/objects/js-collection-iterator.h
@@ -22,10 +22,6 @@ class JSCollectionIterator
  public:
   void JSCollectionIteratorPrint(std::ostream& os, const char* name);
 
-  // JSCollectionIterator is abstract, but also defines the size for all of its
-  // concrete subclasses.
-  static constexpr int kSize = kHeaderSize;
-
   TQ_OBJECT_CONSTRUCTORS(JSCollectionIterator)
 };
 
diff --git a/deps/v8/src/objects/js-collection-iterator.tq b/deps/v8/src/objects/js-collection-iterator.tq
new file mode 100644
index 00000000000000..f047d97ff61745
--- /dev/null
+++ b/deps/v8/src/objects/js-collection-iterator.tq
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+@abstract
+extern class JSCollectionIterator extends JSObject {
+  // The backing hash table mapping keys to values.
+  table: Object;
+  // The index into the data table.
+  index: Object;
+}
diff --git a/deps/v8/src/objects/js-collection.h b/deps/v8/src/objects/js-collection.h
index d1b2ae862a151e..17f9c3e198ba8b 100644
--- a/deps/v8/src/objects/js-collection.h
+++ b/deps/v8/src/objects/js-collection.h
@@ -102,7 +102,7 @@ class JSWeakCollection
   // Visit the whole object.
   using BodyDescriptor = BodyDescriptorImpl;
 
-  static const int kSizeOfAllWeakCollections = kHeaderSize;
+  static const int kHeaderSizeOfAllWeakCollections = kHeaderSize;
 
   TQ_OBJECT_CONSTRUCTORS(JSWeakCollection)
 };
@@ -114,7 +114,7 @@ class JSWeakMap : public TorqueGeneratedJSWeakMap<JSWeakMap, JSWeakCollection> {
   DECL_PRINTER(JSWeakMap)
   DECL_VERIFIER(JSWeakMap)
 
-  STATIC_ASSERT(kSize == kSizeOfAllWeakCollections);
+  STATIC_ASSERT(kHeaderSize == kHeaderSizeOfAllWeakCollections);
   TQ_OBJECT_CONSTRUCTORS(JSWeakMap)
 };
 
@@ -125,7 +125,7 @@ class JSWeakSet : public TorqueGeneratedJSWeakSet<JSWeakSet, JSWeakCollection> {
   DECL_PRINTER(JSWeakSet)
   DECL_VERIFIER(JSWeakSet)
 
-  STATIC_ASSERT(kSize == kSizeOfAllWeakCollections);
+  STATIC_ASSERT(kHeaderSize == kHeaderSizeOfAllWeakCollections);
   TQ_OBJECT_CONSTRUCTORS(JSWeakSet)
 };
 
diff --git a/deps/v8/src/objects/js-collection.tq b/deps/v8/src/objects/js-collection.tq
new file mode 100644
index 00000000000000..7839b5947a9b54
--- /dev/null
+++ b/deps/v8/src/objects/js-collection.tq
@@ -0,0 +1,43 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@abstract
+@generateCppClass
+extern class JSCollection extends JSObject {
+  // The backing hash table.
+  table: Object;
+}
+@generateCppClass
+extern class JSSet extends JSCollection {
+}
+@generateCppClass
+extern class JSMap extends JSCollection {
+}
+
+@abstract
+@generateCppClass
+extern class JSWeakCollection extends JSObject {
+  // The backing hash table mapping keys to values.
+  table: Object;
+}
+@generateCppClass
+extern class JSWeakSet extends JSWeakCollection {
+}
+@generateCppClass
+extern class JSWeakMap extends JSWeakCollection {
+}
+
+@abstract extern class JSMapIterator extends JSCollectionIterator;
+extern class JSMapKeyIterator extends JSMapIterator
+    generates 'TNode<JSMapIterator>';
+extern class JSMapKeyValueIterator extends JSMapIterator
+    generates 'TNode<JSMapIterator>';
+extern class JSMapValueIterator extends JSMapIterator
+    generates 'TNode<JSMapIterator>';
+
+@abstract extern class JSSetIterator extends JSCollectionIterator;
+extern class JSSetKeyValueIterator extends JSSetIterator
+    generates 'TNode<JSSetIterator>';
+extern class JSSetValueIterator extends JSSetIterator
+    generates 'TNode<JSSetIterator>';
diff --git a/deps/v8/src/objects/js-date-time-format-inl.h b/deps/v8/src/objects/js-date-time-format-inl.h
index 8947ea7b4c7a4e..3603a8ff4b0660 100644
--- a/deps/v8/src/objects/js-date-time-format-inl.h
+++ b/deps/v8/src/objects/js-date-time-format-inl.h
@@ -20,6 +20,7 @@ namespace internal {
 
 OBJECT_CONSTRUCTORS_IMPL(JSDateTimeFormat, JSObject)
 
+ACCESSORS(JSDateTimeFormat, locale, String, kLocaleOffset)
 ACCESSORS(JSDateTimeFormat, icu_locale, Managed<icu::Locale>, kIcuLocaleOffset)
 ACCESSORS(JSDateTimeFormat, icu_simple_date_format,
           Managed<icu::SimpleDateFormat>, kIcuSimpleDateFormatOffset)
diff --git a/deps/v8/src/objects/js-date-time-format.cc b/deps/v8/src/objects/js-date-time-format.cc
index 835f3dc43ab905..06925c68d22b66 100644
--- a/deps/v8/src/objects/js-date-time-format.cc
+++ b/deps/v8/src/objects/js-date-time-format.cc
@@ -250,13 +250,13 @@ std::string GetGMTTzID(Isolate* isolate, const std::string& input) {
       break;
     case 9:
       if ((input[7] == '+' || input[7] == '-') &&
-          IsInRange(input[8], '0', '9')) {
+          base::IsInRange(input[8], '0', '9')) {
         return ret + input[7] + input[8];
       }
       break;
     case 10:
       if ((input[7] == '+' || input[7] == '-') && (input[8] == '1') &&
-          IsInRange(input[9], '0', '4')) {
+          base::IsInRange(input[9], '0', '4')) {
         return ret + input[7] + input[8] + input[9];
       }
       break;
@@ -267,18 +267,18 @@ std::string GetGMTTzID(Isolate* isolate, const std::string& input) {
 // Locale independenty version of isalpha for ascii range. This will return
 // false if the ch is alpha but not in ascii range.
 bool IsAsciiAlpha(char ch) {
-  return IsInRange(ch, 'A', 'Z') || IsInRange(ch, 'a', 'z');
+  return base::IsInRange(ch, 'A', 'Z') || base::IsInRange(ch, 'a', 'z');
 }
 
 // Locale independent toupper for ascii range. This will not return İ (dotted I)
 // for i under Turkish locale while std::toupper may.
 char LocaleIndependentAsciiToUpper(char ch) {
-  return (IsInRange(ch, 'a', 'z')) ? (ch - 'a' + 'A') : ch;
+  return (base::IsInRange(ch, 'a', 'z')) ? (ch - 'a' + 'A') : ch;
 }
 
 // Locale independent tolower for ascii range.
 char LocaleIndependentAsciiToLower(char ch) {
-  return (IsInRange(ch, 'A', 'Z')) ? (ch - 'A' + 'a') : ch;
+  return (base::IsInRange(ch, 'A', 'Z')) ? (ch - 'A' + 'a') : ch;
 }
 
 // Returns titlecased location, bueNos_airES -> Buenos_Aires
@@ -383,14 +383,10 @@ MaybeHandle<JSObject> JSDateTimeFormat::ResolvedOptions(
 
   Handle<Object> resolved_obj;
 
+  Handle<String> locale = Handle<String>(date_time_format->locale(), isolate);
   CHECK(!date_time_format->icu_locale().is_null());
   CHECK_NOT_NULL(date_time_format->icu_locale().raw());
   icu::Locale* icu_locale = date_time_format->icu_locale().raw();
-  Maybe<std::string> maybe_locale_str = Intl::ToLanguageTag(*icu_locale);
-  MAYBE_RETURN(maybe_locale_str, MaybeHandle<JSObject>());
-  std::string locale_str = maybe_locale_str.FromJust();
-  Handle<String> locale =
-      factory->NewStringFromAsciiChecked(locale_str.c_str());
 
   icu::SimpleDateFormat* icu_simple_date_format =
       date_time_format->icu_simple_date_format().raw();
@@ -928,9 +924,54 @@ icu::Calendar* CreateCalendar(Isolate* isolate, const icu::Locale& icu_locale,
   return calendar_cache.Pointer()->CreateCalendar(icu_locale, tz);
 }
 
+icu::UnicodeString ReplaceHourCycleInPattern(icu::UnicodeString pattern,
+                                             Intl::HourCycle hc) {
+  char16_t replacement;
+  switch (hc) {
+    case Intl::HourCycle::kUndefined:
+      return pattern;
+    case Intl::HourCycle::kH11:
+      replacement = 'K';
+      break;
+    case Intl::HourCycle::kH12:
+      replacement = 'h';
+      break;
+    case Intl::HourCycle::kH23:
+      replacement = 'H';
+      break;
+    case Intl::HourCycle::kH24:
+      replacement = 'k';
+      break;
+  }
+  bool replace = true;
+  icu::UnicodeString result;
+  for (int32_t i = 0; i < pattern.length(); i++) {
+    char16_t ch = pattern.charAt(i);
+    switch (ch) {
+      case '\'':
+        replace = !replace;
+        result.append(ch);
+        break;
+      case 'H':
+        V8_FALLTHROUGH;
+      case 'h':
+        V8_FALLTHROUGH;
+      case 'K':
+        V8_FALLTHROUGH;
+      case 'k':
+        result.append(replace ? replacement : ch);
+        break;
+      default:
+        result.append(ch);
+        break;
+    }
+  }
+  return result;
+}
+
 std::unique_ptr<icu::SimpleDateFormat> CreateICUDateFormat(
     const icu::Locale& icu_locale, const icu::UnicodeString& skeleton,
-    icu::DateTimePatternGenerator* generator) {
+    icu::DateTimePatternGenerator* generator, Intl::HourCycle hc) {
   // See https://github.com/tc39/ecma402/issues/225 . The best pattern
   // generation needs to be done in the base locale according to the
   // current spec however odd it may be. See also crbug.com/826549 .
@@ -945,6 +986,7 @@ std::unique_ptr<icu::SimpleDateFormat> CreateICUDateFormat(
   UErrorCode status = U_ZERO_ERROR;
   pattern = generator->getBestPattern(skeleton, UDATPG_MATCH_HOUR_FIELD_LENGTH,
                                       status);
+  pattern = ReplaceHourCycleInPattern(pattern, hc);
   CHECK(U_SUCCESS(status));
 
   // Make formatter from skeleton. Calendar and numbering system are added
@@ -962,7 +1004,8 @@ class DateFormatCache {
  public:
   icu::SimpleDateFormat* Create(const icu::Locale& icu_locale,
                                 const icu::UnicodeString& skeleton,
-                                icu::DateTimePatternGenerator* generator) {
+                                icu::DateTimePatternGenerator* generator,
+                                Intl::HourCycle hc) {
     std::string key;
     skeleton.toUTF8String<std::string>(key);
     key += ":";
@@ -978,7 +1021,7 @@ class DateFormatCache {
       map_.clear();
     }
     std::unique_ptr<icu::SimpleDateFormat> instance(
-        CreateICUDateFormat(icu_locale, skeleton, generator));
+        CreateICUDateFormat(icu_locale, skeleton, generator, hc));
     if (instance.get() == nullptr) return nullptr;
     map_[key] = std::move(instance);
     return static_cast<icu::SimpleDateFormat*>(map_[key]->clone());
@@ -991,11 +1034,11 @@ class DateFormatCache {
 
 std::unique_ptr<icu::SimpleDateFormat> CreateICUDateFormatFromCache(
     const icu::Locale& icu_locale, const icu::UnicodeString& skeleton,
-    icu::DateTimePatternGenerator* generator) {
+    icu::DateTimePatternGenerator* generator, Intl::HourCycle hc) {
   static base::LazyInstance<DateFormatCache>::type cache =
       LAZY_INSTANCE_INITIALIZER;
   return std::unique_ptr<icu::SimpleDateFormat>(
-      cache.Pointer()->Create(icu_locale, skeleton, generator));
+      cache.Pointer()->Create(icu_locale, skeleton, generator, hc));
 }
 
 icu::UnicodeString SkeletonFromDateFormat(
@@ -1196,7 +1239,7 @@ std::unique_ptr<icu::SimpleDateFormat> DateTimeStylePattern(
   }
 
   return CreateICUDateFormatFromCache(icu_locale, ReplaceSkeleton(skeleton, hc),
-                                      generator);
+                                      generator, hc);
 }
 
 class DateTimePatternGeneratorCache {
@@ -1327,6 +1370,27 @@ MaybeHandle<JSDateTimeFormat> JSDateTimeFormat::New(
   DCHECK(!icu_locale.isBogus());
 
   UErrorCode status = U_ZERO_ERROR;
+  if (calendar_str != nullptr) {
+    auto ca_extension_it = r.extensions.find("ca");
+    if (ca_extension_it != r.extensions.end() &&
+        ca_extension_it->second != calendar_str.get()) {
+      icu_locale.setUnicodeKeywordValue("ca", nullptr, status);
+      CHECK(U_SUCCESS(status));
+    }
+  }
+  if (numbering_system_str != nullptr) {
+    auto nu_extension_it = r.extensions.find("nu");
+    if (nu_extension_it != r.extensions.end() &&
+        nu_extension_it->second != numbering_system_str.get()) {
+      icu_locale.setUnicodeKeywordValue("nu", nullptr, status);
+      CHECK(U_SUCCESS(status));
+    }
+  }
+
+  // Need to keep a copy of icu_locale which not changing "ca", "nu", "hc"
+  // by option.
+  icu::Locale resolved_locale(icu_locale);
+
   if (calendar_str != nullptr &&
       Intl::IsValidCalendar(icu_locale, calendar_str.get())) {
     icu_locale.setUnicodeKeywordValue("ca", calendar_str.get(), status);
@@ -1512,12 +1576,12 @@ MaybeHandle<JSDateTimeFormat> JSDateTimeFormat::New(
 
     icu::UnicodeString skeleton_ustr(skeleton.c_str());
     icu_date_format = CreateICUDateFormatFromCache(icu_locale, skeleton_ustr,
-                                                   generator.get());
+                                                   generator.get(), hc);
     if (icu_date_format.get() == nullptr) {
       // Remove extensions and try again.
       icu_locale = icu::Locale(icu_locale.getBaseName());
       icu_date_format = CreateICUDateFormatFromCache(icu_locale, skeleton_ustr,
-                                                     generator.get());
+                                                     generator.get(), hc);
       if (icu_date_format.get() == nullptr) {
         FATAL("Failed to create ICU date format, are ICU data files missing?");
       }
@@ -1555,12 +1619,17 @@ MaybeHandle<JSDateTimeFormat> JSDateTimeFormat::New(
       if (hc != Intl::ToHourCycle(hc_extension_it->second.c_str())) {
         // Remove -hc- if it does not agree with what we used.
         UErrorCode status = U_ZERO_ERROR;
-        icu_locale.setUnicodeKeywordValue("hc", nullptr, status);
+        resolved_locale.setUnicodeKeywordValue("hc", nullptr, status);
         CHECK(U_SUCCESS(status));
       }
     }
   }
 
+  Maybe<std::string> maybe_locale_str = Intl::ToLanguageTag(resolved_locale);
+  MAYBE_RETURN(maybe_locale_str, MaybeHandle<JSDateTimeFormat>());
+  Handle<String> locale_str = isolate->factory()->NewStringFromAsciiChecked(
+      maybe_locale_str.FromJust().c_str());
+
   Handle<Managed<icu::Locale>> managed_locale =
       Managed<icu::Locale>::FromRawPtr(isolate, 0, icu_locale.clone());
 
@@ -1587,6 +1656,7 @@ MaybeHandle<JSDateTimeFormat> JSDateTimeFormat::New(
       (time_style == DateTimeStyle::kUndefined)) {
     date_time_format->set_hour_cycle(hc);
   }
+  date_time_format->set_locale(*locale_str);
   date_time_format->set_icu_locale(*managed_locale);
   date_time_format->set_icu_simple_date_format(*managed_format);
   date_time_format->set_icu_date_interval_format(*managed_interval_format);
@@ -1874,7 +1944,6 @@ MaybeHandle<T> FormatRangeCommon(
     THROW_NEW_ERROR(isolate, NewRangeError(MessageTemplate::kInvalidTimeValue),
                     T);
   }
-  icu::DateInterval interval(x, y);
 
   icu::DateIntervalFormat* format =
       LazyCreateDateIntervalFormat(isolate, date_time_format);
@@ -1883,8 +1952,19 @@ MaybeHandle<T> FormatRangeCommon(
   }
 
   UErrorCode status = U_ZERO_ERROR;
+
+  icu::SimpleDateFormat* date_format =
+      date_time_format->icu_simple_date_format().raw();
+  const icu::Calendar* calendar = date_format->getCalendar();
+  std::unique_ptr<icu::Calendar> c1(calendar->clone());
+  std::unique_ptr<icu::Calendar> c2(calendar->clone());
+  c1->setTime(x, status);
+  c2->setTime(y, status);
+  // We need to format by Calendar because we need the Gregorian change
+  // adjustment already in the SimpleDateFormat to set the correct value of date
+  // older than Oct 15, 1582.
   icu::FormattedDateInterval formatted =
-      format->formatToValue(interval, status);
+      format->formatToValue(*c1, *c2, status);
   if (U_FAILURE(status)) {
     THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kIcuError), T);
   }
diff --git a/deps/v8/src/objects/js-date-time-format.h b/deps/v8/src/objects/js-date-time-format.h
index acf99b361850e8..ae3783f2462c19 100644
--- a/deps/v8/src/objects/js-date-time-format.h
+++ b/deps/v8/src/objects/js-date-time-format.h
@@ -12,6 +12,7 @@
 #include <set>
 #include <string>
 
+#include "src/base/bit-field.h"
 #include "src/execution/isolate.h"
 #include "src/objects/intl-objects.h"
 #include "src/objects/managed.h"
@@ -133,6 +134,7 @@ class JSDateTimeFormat : public JSObject {
   STATIC_ASSERT(DateTimeStyle::kMedium <= TimeStyleBits::kMax);
   STATIC_ASSERT(DateTimeStyle::kShort <= TimeStyleBits::kMax);
 
+  DECL_ACCESSORS(locale, String)
   DECL_ACCESSORS(icu_locale, Managed<icu::Locale>)
   DECL_ACCESSORS(icu_simple_date_format, Managed<icu::SimpleDateFormat>)
   DECL_ACCESSORS(icu_date_interval_format, Managed<icu::DateIntervalFormat>)
diff --git a/deps/v8/src/objects/js-display-names-inl.h b/deps/v8/src/objects/js-display-names-inl.h
new file mode 100644
index 00000000000000..08ad7c0838dce2
--- /dev/null
+++ b/deps/v8/src/objects/js-display-names-inl.h
@@ -0,0 +1,55 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_INTL_SUPPORT
+#error Internationalization is expected to be enabled.
+#endif  // V8_INTL_SUPPORT
+
+#ifndef V8_OBJECTS_JS_DISPLAY_NAMES_INL_H_
+#define V8_OBJECTS_JS_DISPLAY_NAMES_INL_H_
+
+#include "src/objects/js-display-names.h"
+#include "src/objects/objects-inl.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+ACCESSORS(JSDisplayNames, internal, Managed<DisplayNamesInternal>,
+          kInternalOffset)
+OBJECT_CONSTRUCTORS_IMPL(JSDisplayNames, JSObject)
+
+// Base display names accessors.
+SMI_ACCESSORS(JSDisplayNames, flags, kFlagsOffset)
+
+CAST_ACCESSOR(JSDisplayNames)
+
+inline void JSDisplayNames::set_style(Style style) {
+  DCHECK_GE(StyleBits::kMax, style);
+  set_flags(StyleBits::update(flags(), style));
+}
+
+inline JSDisplayNames::Style JSDisplayNames::style() const {
+  return StyleBits::decode(flags());
+}
+
+inline void JSDisplayNames::set_fallback(Fallback fallback) {
+  DCHECK_GE(FallbackBits::kMax, fallback);
+  int hints = flags();
+  hints = FallbackBits::update(hints, fallback);
+  set_flags(hints);
+}
+
+inline JSDisplayNames::Fallback JSDisplayNames::fallback() const {
+  return FallbackBits::decode(flags());
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_JS_DISPLAY_NAMES_INL_H_
diff --git a/deps/v8/src/objects/js-display-names.cc b/deps/v8/src/objects/js-display-names.cc
new file mode 100644
index 00000000000000..6350d5e98bac14
--- /dev/null
+++ b/deps/v8/src/objects/js-display-names.cc
@@ -0,0 +1,769 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_INTL_SUPPORT
+#error Internationalization is expected to be enabled.
+#endif  // V8_INTL_SUPPORT
+
+#include <memory>
+#include <vector>
+
+#include "src/objects/js-display-names-inl.h"
+#include "src/objects/js-display-names.h"
+
+#include "src/execution/isolate.h"
+#include "src/heap/factory.h"
+#include "src/objects/intl-objects.h"
+#include "src/objects/managed.h"
+#include "src/objects/objects-inl.h"
+
+#include "unicode/dtfmtsym.h"
+#include "unicode/dtptngen.h"
+#include "unicode/localebuilder.h"
+#include "unicode/locdspnm.h"
+#include "unicode/timezone.h"
+#include "unicode/tznames.h"
+#include "unicode/uloc.h"
+#include "unicode/unistr.h"
+#include "unicode/uscript.h"
+
+namespace v8 {
+namespace internal {
+
+// Type: identifying the types of the display names.
+//
+// ecma402/#sec-properties-of-intl-displaynames-instances
+enum class Type {
+  kLanguage,
+  kRegion,
+  kScript,
+  kCurrency,
+  kWeekday,
+  kMonth,
+  kQuarter,
+  kDayPeriod,
+  kDateTimeField
+};
+
+bool IsUnicodeScriptSubtag(const std::string& value) {
+  UErrorCode status = U_ZERO_ERROR;
+  icu::LocaleBuilder builder;
+  builder.setScript(value).build(status);
+  return U_SUCCESS(status);
+}
+
+bool IsUnicodeRegionSubtag(const std::string& value) {
+  UErrorCode status = U_ZERO_ERROR;
+  icu::LocaleBuilder builder;
+  builder.setRegion(value).build(status);
+  return U_SUCCESS(status);
+}
+
+UDisplayContext ToUDisplayContext(JSDisplayNames::Style style) {
+  switch (style) {
+    case JSDisplayNames::Style::kLong:
+      return UDISPCTX_LENGTH_FULL;
+    case JSDisplayNames::Style::kShort:
+    case JSDisplayNames::Style::kNarrow:
+      return UDISPCTX_LENGTH_SHORT;
+  }
+}
+
+// Abstract class for all different types.
+class DisplayNamesInternal {
+ public:
+  DisplayNamesInternal() {}
+  virtual ~DisplayNamesInternal() {}
+  virtual const char* type() const = 0;
+  virtual icu::Locale locale() const = 0;
+  virtual Maybe<icu::UnicodeString> of(Isolate* isolate,
+                                       const char* code) const = 0;
+  virtual const char* calendar() const { return nullptr; }
+};
+
+class LocaleDisplayNamesCommon : public DisplayNamesInternal {
+ public:
+  LocaleDisplayNamesCommon(const icu::Locale& locale,
+                           JSDisplayNames::Style style, bool fallback)
+      : style_(style) {
+    UDisplayContext sub =
+        fallback ? UDISPCTX_SUBSTITUTE : UDISPCTX_NO_SUBSTITUTE;
+    UDisplayContext display_context[] = {ToUDisplayContext(style_),
+                                         UDISPCTX_DIALECT_NAMES,
+                                         UDISPCTX_CAPITALIZATION_NONE, sub};
+    ldn_.reset(
+        icu::LocaleDisplayNames::createInstance(locale, display_context, 4));
+  }
+
+  virtual ~LocaleDisplayNamesCommon() {}
+
+  icu::Locale locale() const override { return ldn_->getLocale(); }
+
+ protected:
+  icu::LocaleDisplayNames* locale_display_names() const { return ldn_.get(); }
+
+ private:
+  std::unique_ptr<icu::LocaleDisplayNames> ldn_;
+  JSDisplayNames::Style style_;
+};
+
+class LanguageNames : public LocaleDisplayNamesCommon {
+ public:
+  LanguageNames(const icu::Locale& locale, JSDisplayNames::Style style,
+                bool fallback)
+      : LocaleDisplayNamesCommon(locale, style, fallback) {}
+  virtual ~LanguageNames() {}
+  const char* type() const override { return "language"; }
+  Maybe<icu::UnicodeString> of(Isolate* isolate,
+                               const char* code) const override {
+    UErrorCode status = U_ZERO_ERROR;
+    icu::Locale l =
+        icu::Locale(icu::Locale::forLanguageTag(code, status).getBaseName());
+    std::string checked = l.toLanguageTag<std::string>(status);
+
+    if (U_FAILURE(status)) {
+      THROW_NEW_ERROR_RETURN_VALUE(
+          isolate, NewRangeError(MessageTemplate::kInvalidArgument),
+          Nothing<icu::UnicodeString>());
+    }
+
+    icu::UnicodeString result;
+    locale_display_names()->localeDisplayName(checked.c_str(), result);
+
+    return Just(result);
+  }
+};
+
+class RegionNames : public LocaleDisplayNamesCommon {
+ public:
+  RegionNames(const icu::Locale& locale, JSDisplayNames::Style style,
+              bool fallback)
+      : LocaleDisplayNamesCommon(locale, style, fallback) {}
+  virtual ~RegionNames() {}
+  const char* type() const override { return "region"; }
+  Maybe<icu::UnicodeString> of(Isolate* isolate,
+                               const char* code) const override {
+    std::string code_str(code);
+    if (!IsUnicodeRegionSubtag(code_str)) {
+      THROW_NEW_ERROR_RETURN_VALUE(
+          isolate, NewRangeError(MessageTemplate::kInvalidArgument),
+          Nothing<icu::UnicodeString>());
+    }
+
+    icu::UnicodeString result;
+    locale_display_names()->regionDisplayName(code_str.c_str(), result);
+    return Just(result);
+  }
+};
+
+class ScriptNames : public LocaleDisplayNamesCommon {
+ public:
+  ScriptNames(const icu::Locale& locale, JSDisplayNames::Style style,
+              bool fallback)
+      : LocaleDisplayNamesCommon(locale, style, fallback) {}
+  virtual ~ScriptNames() {}
+  const char* type() const override { return "script"; }
+  Maybe<icu::UnicodeString> of(Isolate* isolate,
+                               const char* code) const override {
+    std::string code_str(code);
+    if (!IsUnicodeScriptSubtag(code_str)) {
+      THROW_NEW_ERROR_RETURN_VALUE(
+          isolate, NewRangeError(MessageTemplate::kInvalidArgument),
+          Nothing<icu::UnicodeString>());
+    }
+
+    icu::UnicodeString result;
+    locale_display_names()->scriptDisplayName(code_str.c_str(), result);
+    return Just(result);
+  }
+};
+
+class CurrencyNames : public LocaleDisplayNamesCommon {
+ public:
+  CurrencyNames(const icu::Locale& locale, JSDisplayNames::Style style,
+                bool fallback)
+      : LocaleDisplayNamesCommon(locale, style, fallback) {}
+  virtual ~CurrencyNames() {}
+  const char* type() const override { return "currency"; }
+  Maybe<icu::UnicodeString> of(Isolate* isolate,
+                               const char* code) const override {
+    std::string code_str(code);
+    if (!Intl::IsWellFormedCurrency(code_str)) {
+      THROW_NEW_ERROR_RETURN_VALUE(
+          isolate, NewRangeError(MessageTemplate::kInvalidArgument),
+          Nothing<icu::UnicodeString>());
+    }
+
+    icu::UnicodeString result;
+    locale_display_names()->keyValueDisplayName("currency", code_str.c_str(),
+                                                result);
+
+    return Just(result);
+  }
+};
+
+UDateTimePGDisplayWidth StyleToUDateTimePGDisplayWidth(
+    JSDisplayNames::Style style) {
+  switch (style) {
+    case JSDisplayNames::Style::kLong:
+      return UDATPG_WIDE;
+    case JSDisplayNames::Style::kShort:
+      return UDATPG_ABBREVIATED;
+    case JSDisplayNames::Style::kNarrow:
+      return UDATPG_NARROW;
+  }
+}
+
+UDateTimePatternField StringToUDateTimePatternField(const char* code) {
+  switch (code[0]) {
+    case 'd':
+      if (strcmp(code, "day") == 0) return UDATPG_DAY_FIELD;
+      if (strcmp(code, "dayPeriod") == 0) return UDATPG_DAYPERIOD_FIELD;
+      break;
+    case 'e':
+      if (strcmp(code, "era") == 0) return UDATPG_ERA_FIELD;
+      break;
+    case 'h':
+      if (strcmp(code, "hour") == 0) return UDATPG_HOUR_FIELD;
+      break;
+    case 'm':
+      if (strcmp(code, "minute") == 0) return UDATPG_MINUTE_FIELD;
+      if (strcmp(code, "month") == 0) return UDATPG_MONTH_FIELD;
+      break;
+    case 'q':
+      if (strcmp(code, "quarter") == 0) return UDATPG_QUARTER_FIELD;
+      break;
+    case 's':
+      if (strcmp(code, "second") == 0) return UDATPG_SECOND_FIELD;
+      break;
+    case 't':
+      if (strcmp(code, "timeZoneName") == 0) return UDATPG_ZONE_FIELD;
+      break;
+    case 'w':
+      if (strcmp(code, "weekOfYear") == 0) return UDATPG_WEEK_OF_YEAR_FIELD;
+      if (strcmp(code, "weekday") == 0) return UDATPG_WEEKDAY_FIELD;
+      break;
+    case 'y':
+      if (strcmp(code, "year") == 0) return UDATPG_YEAR_FIELD;
+      break;
+    default:
+      break;
+  }
+  UNREACHABLE();
+}
+
+class DateTimeFieldNames : public DisplayNamesInternal {
+ public:
+  DateTimeFieldNames(const icu::Locale& locale, JSDisplayNames::Style style)
+      : locale_(locale), width_(StyleToUDateTimePGDisplayWidth(style)) {
+    UErrorCode status = U_ZERO_ERROR;
+    generator_.reset(
+        icu::DateTimePatternGenerator::createInstance(locale_, status));
+    CHECK(U_SUCCESS(status));
+  }
+  virtual ~DateTimeFieldNames() {}
+  const char* type() const override { return "dateTimeField"; }
+  icu::Locale locale() const override { return locale_; }
+  Maybe<icu::UnicodeString> of(Isolate* isolate,
+                               const char* code) const override {
+    UDateTimePatternField field = StringToUDateTimePatternField(code);
+    if (field == UDATPG_FIELD_COUNT) {
+      THROW_NEW_ERROR_RETURN_VALUE(
+          isolate, NewRangeError(MessageTemplate::kInvalidArgument),
+          Nothing<icu::UnicodeString>());
+    }
+    return Just(generator_->getFieldDisplayName(field, width_));
+  }
+
+ private:
+  icu::Locale locale_;
+  UDateTimePGDisplayWidth width_;
+  std::unique_ptr<icu::DateTimePatternGenerator> generator_;
+};
+
+icu::DateFormatSymbols::DtWidthType StyleToDtWidthType(
+    JSDisplayNames::Style style, Type type) {
+  switch (style) {
+    case JSDisplayNames::Style::kLong:
+      return icu::DateFormatSymbols::WIDE;
+    case JSDisplayNames::Style::kShort:
+      return icu::DateFormatSymbols::SHORT;
+    case JSDisplayNames::Style::kNarrow:
+      if (type == Type::kQuarter) {
+        return icu::DateFormatSymbols::ABBREVIATED;
+      } else {
+        return icu::DateFormatSymbols::NARROW;
+      }
+  }
+}
+
+class DateFormatSymbolsNames : public DisplayNamesInternal {
+ public:
+  DateFormatSymbolsNames(const char* type, const icu::Locale& locale,
+                         const icu::UnicodeString* array, int32_t length,
+                         const char* calendar)
+      : type_(type),
+        locale_(locale),
+        array_(array),
+        length_(length),
+        calendar_(calendar) {}
+
+  virtual ~DateFormatSymbolsNames() {}
+
+  const char* type() const override { return type_; }
+
+  icu::Locale locale() const override { return locale_; }
+
+  const char* calendar() const override {
+    if (calendar_.empty()) {
+      return nullptr;
+    }
+    return calendar_.c_str();
+  }
+
+  virtual int32_t ComputeIndex(const char* code) const = 0;
+
+  Maybe<icu::UnicodeString> of(Isolate* isolate,
+                               const char* code) const override {
+    int32_t index = ComputeIndex(code);
+    if (index < 0 || index >= length_) {
+      THROW_NEW_ERROR_RETURN_VALUE(
+          isolate, NewRangeError(MessageTemplate::kInvalidArgument),
+          Nothing<icu::UnicodeString>());
+    }
+    return Just(array_[index]);
+  }
+
+ private:
+  const char* type_;
+  icu::Locale locale_;
+  const icu::UnicodeString* array_;
+  int32_t length_;
+  std::string calendar_;
+};
+
+class WeekdayNames : public DateFormatSymbolsNames {
+ public:
+  WeekdayNames(const char* type, const icu::Locale& locale,
+               const icu::UnicodeString* array, int32_t length,
+               const char* calendar)
+      : DateFormatSymbolsNames(type, locale, array, length, calendar) {}
+  virtual ~WeekdayNames() {}
+
+  int32_t ComputeIndex(const char* code) const override {
+    int32_t i = atoi(code);
+    if (i == 7) return 1;
+    if (i > 0 && i < 7) return i + 1;
+    return -1;
+  }
+};
+
+class MonthNames : public DateFormatSymbolsNames {
+ public:
+  MonthNames(const char* type, const icu::Locale& locale,
+             const icu::UnicodeString* array, int32_t length,
+             const char* calendar)
+      : DateFormatSymbolsNames(type, locale, array, length, calendar) {}
+  virtual ~MonthNames() {}
+
+  int32_t ComputeIndex(const char* code) const override {
+    return atoi(code) - 1;
+  }
+};
+
+class QuarterNames : public DateFormatSymbolsNames {
+ public:
+  QuarterNames(const char* type, const icu::Locale& locale,
+               const icu::UnicodeString* array, int32_t length,
+               const char* calendar)
+      : DateFormatSymbolsNames(type, locale, array, length, calendar) {}
+  virtual ~QuarterNames() {}
+
+  int32_t ComputeIndex(const char* code) const override {
+    return atoi(code) - 1;
+  }
+};
+
+class DayPeriodNames : public DateFormatSymbolsNames {
+ public:
+  DayPeriodNames(const char* type, const icu::Locale& locale,
+                 const icu::UnicodeString* array, int32_t length,
+                 const char* calendar)
+      : DateFormatSymbolsNames(type, locale, array, length, calendar) {}
+  virtual ~DayPeriodNames() {}
+
+  int32_t ComputeIndex(const char* code) const override {
+    if (strcmp("am", code) == 0) {
+      return 0;
+    } else if (strcmp("pm", code) == 0) {
+      return 1;
+    } else {
+      return -1;
+    }
+  }
+};
+
+const char* gWeekday = "weekday";
+const char* gMonth = "month";
+const char* gQuarter = "quarter";
+const char* gDayPeriod = "dayPeriod";
+
+DateFormatSymbolsNames* CreateDateFormatSymbolsNames(
+    const icu::Locale& locale, JSDisplayNames::Style style, Type type) {
+  UErrorCode status = U_ZERO_ERROR;
+  std::unique_ptr<icu::DateFormatSymbols> symbols(
+      icu::DateFormatSymbols::createForLocale(locale, status));
+  if (U_FAILURE(status)) {
+    return nullptr;
+  }
+  icu::DateFormatSymbols::DtWidthType width_type =
+      StyleToDtWidthType(style, type);
+  int32_t count = 0;
+  std::string calendar =
+      locale.getUnicodeKeywordValue<std::string>("ca", status);
+
+  switch (type) {
+    case Type::kMonth:
+      return new MonthNames(
+          gMonth, locale,
+          symbols->getMonths(count, icu::DateFormatSymbols::STANDALONE,
+                             width_type),
+          count, calendar.c_str());
+    case Type::kWeekday:
+      return new WeekdayNames(
+          gWeekday, locale,
+          symbols->getWeekdays(count, icu::DateFormatSymbols::STANDALONE,
+                               width_type),
+          count, calendar.c_str());
+    case Type::kQuarter:
+      return new QuarterNames(
+          gQuarter, locale,
+          symbols->getQuarters(count, icu::DateFormatSymbols::STANDALONE,
+                               width_type),
+          count, calendar.c_str());
+    case Type::kDayPeriod:
+      return new DayPeriodNames(gDayPeriod, locale,
+                                symbols->getAmPmStrings(count), count,
+                                calendar.c_str());
+    default:
+      UNREACHABLE();
+  }
+}
+
+DisplayNamesInternal* CreateInternal(const icu::Locale& locale,
+                                     JSDisplayNames::Style style, Type type,
+                                     bool fallback) {
+  switch (type) {
+    case Type::kLanguage:
+      return new LanguageNames(locale, style, fallback);
+    case Type::kRegion:
+      return new RegionNames(locale, style, fallback);
+    case Type::kScript:
+      return new ScriptNames(locale, style, fallback);
+    case Type::kCurrency:
+      return new CurrencyNames(locale, style, fallback);
+    case Type::kDateTimeField:
+      return new DateTimeFieldNames(locale, style);
+    case Type::kMonth:
+    case Type::kWeekday:
+    case Type::kQuarter:
+    case Type::kDayPeriod:
+      return CreateDateFormatSymbolsNames(locale, style, type);
+    default:
+      UNREACHABLE();
+  }
+}
+// ecma402 #sec-Intl.DisplayNames
+MaybeHandle<JSDisplayNames> JSDisplayNames::New(Isolate* isolate,
+                                                Handle<Map> map,
+                                                Handle<Object> locales,
+                                                Handle<Object> input_options) {
+  const char* service = "Intl.DisplayNames";
+  Factory* factory = isolate->factory();
+
+  Handle<JSReceiver> options;
+  // 3. Let requestedLocales be ? CanonicalizeLocaleList(locales).
+  Maybe<std::vector<std::string>> maybe_requested_locales =
+      Intl::CanonicalizeLocaleList(isolate, locales);
+  MAYBE_RETURN(maybe_requested_locales, Handle<JSDisplayNames>());
+  std::vector<std::string> requested_locales =
+      maybe_requested_locales.FromJust();
+
+  // 4. If options is undefined, then
+  if (input_options->IsUndefined(isolate)) {
+    // 4. a. Let options be ObjectCreate(null).
+    options = factory->NewJSObjectWithNullProto();
+    // 5. Else
+  } else {
+    // 5. a. Let options be ? ToObject(options).
+    ASSIGN_RETURN_ON_EXCEPTION(isolate, options,
+                               Object::ToObject(isolate, input_options),
+                               JSDisplayNames);
+  }
+
+  // Note: No need to create a record. It's not observable.
+  // 6. Let opt be a new Record.
+
+  // 7. Let localeData be %DisplayNames%.[[LocaleData]].
+
+  // 8. Let matcher be ? GetOption(options, "localeMatcher", "string", «
+  // "lookup", "best fit" », "best fit").
+  Maybe<Intl::MatcherOption> maybe_locale_matcher =
+      Intl::GetLocaleMatcher(isolate, options, "Intl.DisplayNames");
+  MAYBE_RETURN(maybe_locale_matcher, MaybeHandle<JSDisplayNames>());
+
+  // 9. Set opt.[[localeMatcher]] to matcher.
+  Intl::MatcherOption matcher = maybe_locale_matcher.FromJust();
+
+  std::unique_ptr<char[]> calendar_str = nullptr;
+  if (FLAG_harmony_intl_displaynames_date_types) {
+    const std::vector<const char*> empty_values = {};
+    // 10. Let calendar be ? GetOption(options, "calendar",
+    //    "string", undefined, undefined).
+    Maybe<bool> maybe_calendar = Intl::GetStringOption(
+        isolate, options, "calendar", empty_values, service, &calendar_str);
+    MAYBE_RETURN(maybe_calendar, MaybeHandle<JSDisplayNames>());
+    // 11. If calendar is not undefined, then
+    if (maybe_calendar.FromJust() && calendar_str != nullptr) {
+      // a. If calendar does not match the (3*8alphanum) *("-" (3*8alphanum))
+      //    sequence, throw a RangeError exception.
+      if (!Intl::IsWellFormedCalendar(calendar_str.get())) {
+        THROW_NEW_ERROR(
+            isolate,
+            NewRangeError(
+                MessageTemplate::kInvalid, factory->calendar_string(),
+                factory->NewStringFromAsciiChecked(calendar_str.get())),
+            JSDisplayNames);
+      }
+    }
+  }
+
+  // 12. Set opt.[[ca]] to calendar.
+
+  // ecma402/#sec-Intl.DisplayNames-internal-slots
+  // The value of the [[RelevantExtensionKeys]] internal slot is
+  // « "ca" ».
+  std::set<std::string> relevant_extension_keys_ca = {"ca"};
+  std::set<std::string> relevant_extension_keys = {};
+  // 13. Let r be ResolveLocale(%DisplayNames%.[[AvailableLocales]],
+  //     requestedLocales, opt, %DisplayNames%.[[RelevantExtensionKeys]]).
+  Intl::ResolvedLocale r = Intl::ResolveLocale(
+      isolate, JSDisplayNames::GetAvailableLocales(), requested_locales,
+      matcher,
+      FLAG_harmony_intl_displaynames_date_types ? relevant_extension_keys_ca
+                                                : relevant_extension_keys);
+
+  icu::Locale icu_locale = r.icu_locale;
+  UErrorCode status = U_ZERO_ERROR;
+  if (calendar_str != nullptr &&
+      Intl::IsValidCalendar(icu_locale, calendar_str.get())) {
+    icu_locale.setUnicodeKeywordValue("ca", calendar_str.get(), status);
+    CHECK(U_SUCCESS(status));
+  }
+
+  // 14. Let s be ? GetOption(options, "style", "string",
+  //                          «"long", "short", "narrow"», "long").
+  Maybe<Style> maybe_style = Intl::GetStringOption<Style>(
+      isolate, options, "style", "Intl.DisplayNames",
+      {"long", "short", "narrow"},
+      {Style::kLong, Style::kShort, Style::kNarrow}, Style::kLong);
+  MAYBE_RETURN(maybe_style, MaybeHandle<JSDisplayNames>());
+  Style style_enum = maybe_style.FromJust();
+
+  // 15. Set displayNames.[[Style]] to style.
+
+  // 16. Let type be ? GetOption(options, "type", "string", « "language",
+  //     "region", "script", "currency", "weekday", "month", "quarter",
+  //     "dayPeriod", "dateTimeField" », "language").
+  Maybe<Type> maybe_type =
+      FLAG_harmony_intl_displaynames_date_types
+          ? Intl::GetStringOption<Type>(
+                isolate, options, "type", "Intl.DisplayNames",
+                {"language", "region", "script", "currency", "weekday", "month",
+                 "quarter", "dayPeriod", "dateTimeField"},
+                {
+                    Type::kLanguage,
+                    Type::kRegion,
+                    Type::kScript,
+                    Type::kCurrency,
+                    Type::kWeekday,
+                    Type::kMonth,
+                    Type::kQuarter,
+                    Type::kDayPeriod,
+                    Type::kDateTimeField,
+                },
+                Type::kLanguage)
+          : Intl::GetStringOption<Type>(
+                isolate, options, "type", "Intl.DisplayNames",
+                {"language", "region", "script", "currency"},
+                {
+                    Type::kLanguage,
+                    Type::kRegion,
+                    Type::kScript,
+                    Type::kCurrency,
+                },
+                Type::kLanguage);
+  MAYBE_RETURN(maybe_type, MaybeHandle<JSDisplayNames>());
+  Type type_enum = maybe_type.FromJust();
+
+  // 17. Set displayNames.[[Type]] to type.
+
+  // 18. Let fallback be ? GetOption(options, "fallback", "string",
+  //     « "code", "none" », "code").
+  Maybe<Fallback> maybe_fallback = Intl::GetStringOption<Fallback>(
+      isolate, options, "fallback", "Intl.DisplayNames", {"code", "none"},
+      {Fallback::kCode, Fallback::kNone}, Fallback::kCode);
+  MAYBE_RETURN(maybe_fallback, MaybeHandle<JSDisplayNames>());
+  Fallback fallback_enum = maybe_fallback.FromJust();
+
+  // 19. Set displayNames.[[Fallback]] to fallback.
+
+  // 20. Set displayNames.[[Locale]] to the value of r.[[Locale]].
+
+  // Let calendar be r.[[ca]].
+
+  // Set displayNames.[[Calendar]] to calendar.
+
+  // Let dataLocale be r.[[dataLocale]].
+
+  // Let dataLocaleData be localeData.[[<dataLocale>]].
+
+  // Let types be dataLocaleData.[[types]].
+
+  // Assert: types is a Record (see 1.3.3).
+
+  // Let typeFields be types.[[<type>]].
+
+  // Assert: typeFields is a Record (see 1.3.3).
+
+  // Let styleFields be typeFields.[[<style>]].
+
+  // Assert: styleFields is a Record (see 1.3.3).
+
+  // Set displayNames.[[Fields]] to styleFields.
+
+  DisplayNamesInternal* internal = CreateInternal(
+      icu_locale, style_enum, type_enum, fallback_enum == Fallback::kCode);
+  if (internal == nullptr) {
+    THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kIcuError),
+                    JSDisplayNames);
+  }
+
+  Handle<Managed<DisplayNamesInternal>> managed_internal =
+      Managed<DisplayNamesInternal>::FromRawPtr(isolate, 0, internal);
+
+  Handle<JSDisplayNames> display_names =
+      Handle<JSDisplayNames>::cast(factory->NewFastOrSlowJSObjectFromMap(map));
+  display_names->set_flags(0);
+  display_names->set_style(style_enum);
+  display_names->set_fallback(fallback_enum);
+
+  DisallowHeapAllocation no_gc;
+  display_names->set_internal(*managed_internal);
+
+  // Return displayNames.
+  return display_names;
+}
+
+// ecma402 #sec-Intl.DisplayNames.prototype.resolvedOptions
+Handle<JSObject> JSDisplayNames::ResolvedOptions(
+    Isolate* isolate, Handle<JSDisplayNames> display_names) {
+  Factory* factory = isolate->factory();
+  // 4. Let options be ! ObjectCreate(%ObjectPrototype%).
+  Handle<JSObject> options = factory->NewJSObject(isolate->object_function());
+
+  DisplayNamesInternal* internal = display_names->internal().raw();
+
+  Maybe<std::string> maybe_locale = Intl::ToLanguageTag(internal->locale());
+  CHECK(maybe_locale.IsJust());
+  Handle<String> locale = isolate->factory()->NewStringFromAsciiChecked(
+      maybe_locale.FromJust().c_str());
+  Handle<String> style = display_names->StyleAsString();
+  Handle<String> type = factory->NewStringFromAsciiChecked(internal->type());
+  Handle<String> fallback = display_names->FallbackAsString();
+
+  CHECK(JSReceiver::CreateDataProperty(isolate, options,
+                                       factory->locale_string(), locale,
+                                       Just(kDontThrow))
+            .FromJust());
+  if (internal->calendar() != nullptr) {
+    CHECK(JSReceiver::CreateDataProperty(
+              isolate, options, factory->calendar_string(),
+              factory->NewStringFromAsciiChecked(internal->calendar()),
+              Just(kDontThrow))
+              .FromJust());
+  }
+  CHECK(JSReceiver::CreateDataProperty(
+            isolate, options, factory->style_string(), style, Just(kDontThrow))
+            .FromJust());
+
+  CHECK(JSReceiver::CreateDataProperty(isolate, options, factory->type_string(),
+                                       type, Just(kDontThrow))
+            .FromJust());
+  CHECK(JSReceiver::CreateDataProperty(isolate, options,
+                                       factory->fallback_string(), fallback,
+                                       Just(kDontThrow))
+            .FromJust());
+
+  return options;
+}
+
+// ecma402 #sec-Intl.DisplayNames.prototype.of
+MaybeHandle<Object> JSDisplayNames::Of(Isolate* isolate,
+                                       Handle<JSDisplayNames> display_names,
+                                       Handle<Object> code_obj) {
+  Handle<String> code;
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, code, Object::ToString(isolate, code_obj),
+                             Object);
+  DisplayNamesInternal* internal = display_names->internal().raw();
+  Maybe<icu::UnicodeString> maybe_result =
+      internal->of(isolate, code->ToCString().get());
+  MAYBE_RETURN(maybe_result, Handle<Object>());
+  icu::UnicodeString result = maybe_result.FromJust();
+  if (result.isBogus()) {
+    return isolate->factory()->undefined_value();
+  }
+  return Intl::ToString(isolate, result).ToHandleChecked();
+}
+
+namespace {
+
+struct CheckCalendar {
+  static const char* key() { return "calendar"; }
+  static const char* path() { return nullptr; }
+};
+
+}  // namespace
+
+const std::set<std::string>& JSDisplayNames::GetAvailableLocales() {
+  static base::LazyInstance<
+      Intl::AvailableLocales<icu::Locale, CheckCalendar>>::type
+      available_locales = LAZY_INSTANCE_INITIALIZER;
+  return available_locales.Pointer()->Get();
+}
+
+Handle<String> JSDisplayNames::StyleAsString() const {
+  switch (style()) {
+    case Style::kLong:
+      return GetReadOnlyRoots().long_string_handle();
+    case Style::kShort:
+      return GetReadOnlyRoots().short_string_handle();
+    case Style::kNarrow:
+      return GetReadOnlyRoots().narrow_string_handle();
+  }
+  UNREACHABLE();
+}
+
+Handle<String> JSDisplayNames::FallbackAsString() const {
+  switch (fallback()) {
+    case Fallback::kCode:
+      return GetReadOnlyRoots().code_string_handle();
+    case Fallback::kNone:
+      return GetReadOnlyRoots().none_string_handle();
+  }
+  UNREACHABLE();
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/objects/js-display-names.h b/deps/v8/src/objects/js-display-names.h
new file mode 100644
index 00000000000000..f3fc9c9282e215
--- /dev/null
+++ b/deps/v8/src/objects/js-display-names.h
@@ -0,0 +1,103 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_INTL_SUPPORT
+#error Internationalization is expected to be enabled.
+#endif  // V8_INTL_SUPPORT
+
+#ifndef V8_OBJECTS_JS_DISPLAY_NAMES_H_
+#define V8_OBJECTS_JS_DISPLAY_NAMES_H_
+
+#include <set>
+#include <string>
+
+#include "src/execution/isolate.h"
+#include "src/heap/factory.h"
+#include "src/objects/managed.h"
+#include "src/objects/objects.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+class DisplayNamesInternal;
+
+class JSDisplayNames : public JSObject {
+ public:
+  // Creates display names object with properties derived from input
+  // locales and options.
+  static MaybeHandle<JSDisplayNames> New(Isolate* isolate, Handle<Map> map,
+                                         Handle<Object> locales,
+                                         Handle<Object> options);
+
+  static Handle<JSObject> ResolvedOptions(Isolate* isolate,
+                                          Handle<JSDisplayNames> format_holder);
+
+  static MaybeHandle<Object> Of(Isolate* isolate, Handle<JSDisplayNames> holder,
+                                Handle<Object> code_obj);
+
+  V8_EXPORT_PRIVATE static const std::set<std::string>& GetAvailableLocales();
+
+  Handle<String> StyleAsString() const;
+  Handle<String> FallbackAsString() const;
+
+  // Style: identifying the display names style used.
+  //
+  // ecma402/#sec-properties-of-intl-displaynames-instances
+  enum class Style {
+    kLong,   // Everything spelled out.
+    kShort,  // Abbreviations used when possible.
+    kNarrow  // Use the shortest possible form.
+  };
+  inline void set_style(Style style);
+  inline Style style() const;
+
+  // Type: identifying the fallback of the display names.
+  //
+  // ecma402/#sec-properties-of-intl-displaynames-instances
+  enum class Fallback {
+    kCode,
+    kNone,
+  };
+  inline void set_fallback(Fallback fallback);
+  inline Fallback fallback() const;
+
+  DECL_CAST(JSDisplayNames)
+
+// Bit positions in |flags|.
+#define FLAGS_BIT_FIELDS(V, _) \
+  V(StyleBits, Style, 2, _)    \
+  V(FallbackBits, Fallback, 1, _)
+  DEFINE_BIT_FIELDS(FLAGS_BIT_FIELDS)
+#undef FLAGS_BIT_FIELDS
+
+  STATIC_ASSERT(Style::kLong <= StyleBits::kMax);
+  STATIC_ASSERT(Style::kShort <= StyleBits::kMax);
+  STATIC_ASSERT(Style::kNarrow <= StyleBits::kMax);
+  STATIC_ASSERT(Fallback::kCode <= FallbackBits::kMax);
+  STATIC_ASSERT(Fallback::kNone <= FallbackBits::kMax);
+
+  // [flags] Bit field containing various flags about the function.
+  DECL_INT_ACCESSORS(flags)
+
+  DECL_ACCESSORS(internal, Managed<DisplayNamesInternal>)
+
+  DECL_PRINTER(JSDisplayNames)
+  DECL_VERIFIER(JSDisplayNames)
+
+  // Layout description.
+  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
+                                TORQUE_GENERATED_JS_DISPLAY_NAMES_FIELDS)
+
+  OBJECT_CONSTRUCTORS(JSDisplayNames, JSObject);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_JS_DISPLAY_NAMES_H_
diff --git a/deps/v8/src/objects/js-generator.h b/deps/v8/src/objects/js-generator.h
index a56ea917ebdc7b..12063c73354b9e 100644
--- a/deps/v8/src/objects/js-generator.h
+++ b/deps/v8/src/objects/js-generator.h
@@ -55,6 +55,7 @@ class JSAsyncFunctionObject
  public:
   // Dispatched behavior.
   DECL_VERIFIER(JSAsyncFunctionObject)
+  DECL_PRINTER(JSAsyncFunctionObject)
 
   TQ_OBJECT_CONSTRUCTORS(JSAsyncFunctionObject)
 };
@@ -65,6 +66,7 @@ class JSAsyncGeneratorObject
  public:
   // Dispatched behavior.
   DECL_VERIFIER(JSAsyncGeneratorObject)
+  DECL_PRINTER(JSAsyncGeneratorObject)
 
   // [is_awaiting]
   // Whether or not the generator is currently awaiting.
diff --git a/deps/v8/src/objects/js-generator.tq b/deps/v8/src/objects/js-generator.tq
new file mode 100644
index 00000000000000..bb8df21f0a28ab
--- /dev/null
+++ b/deps/v8/src/objects/js-generator.tq
@@ -0,0 +1,43 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+extern class JSGeneratorObject extends JSObject {
+  function: JSFunction;
+  context: Context;
+  receiver: JSAny;
+
+  // For executing generators: the most recent input value.
+  // For suspended generators: debug information (bytecode offset).
+  // There is currently no need to remember the most recent input value for a
+  // suspended generator.
+  input_or_debug_pos: Object;
+
+  resume_mode: Smi;
+  continuation: Smi;
+
+  // Saved interpreter register file.
+  parameters_and_registers: FixedArray;
+}
+
+@generateCppClass
+extern class JSAsyncFunctionObject extends JSGeneratorObject {
+  promise: JSPromise;
+}
+
+@generateCppClass
+extern class JSAsyncGeneratorObject extends JSGeneratorObject {
+  // Pointer to the head of a singly linked list of AsyncGeneratorRequest, or
+  // undefined.
+  queue: HeapObject;
+  is_awaiting: Smi;
+}
+
+@generateCppClass
+extern class AsyncGeneratorRequest extends Struct {
+  next: AsyncGeneratorRequest|Undefined;
+  resume_mode: Smi;
+  value: Object;
+  promise: JSPromise;
+}
diff --git a/deps/v8/src/objects/js-list-format.cc b/deps/v8/src/objects/js-list-format.cc
index 90b93e308adc4e..90ab9ebc43f661 100644
--- a/deps/v8/src/objects/js-list-format.cc
+++ b/deps/v8/src/objects/js-list-format.cc
@@ -256,11 +256,10 @@ Maybe<std::vector<icu::UnicodeString>> ToUnicodeStringArray(
   // arrays here, so the loop below can construct an entry from the index.
   DCHECK(array->HasFastElements(isolate));
   auto* accessor = array->GetElementsAccessor();
-  uint32_t length = accessor->NumberOfElements(*array);
+  size_t length = accessor->NumberOfElements(*array);
 
   std::vector<icu::UnicodeString> result;
-  for (uint32_t i = 0; i < length; i++) {
-    InternalIndex entry(i);
+  for (InternalIndex entry : InternalIndex::Range(length)) {
     DCHECK(accessor->HasEntry(*array, entry));
     Handle<Object> item = accessor->Get(array, entry);
     DCHECK(item->IsString());
diff --git a/deps/v8/src/objects/js-list-format.h b/deps/v8/src/objects/js-list-format.h
index 1ff76790f951cb..c2392969d317e9 100644
--- a/deps/v8/src/objects/js-list-format.h
+++ b/deps/v8/src/objects/js-list-format.h
@@ -12,6 +12,7 @@
 #include <set>
 #include <string>
 
+#include "src/base/bit-field.h"
 #include "src/execution/isolate.h"
 #include "src/heap/factory.h"
 #include "src/objects/managed.h"
diff --git a/deps/v8/src/objects/js-locale.cc b/deps/v8/src/objects/js-locale.cc
index 9e8053b1dc81d8..6bbb86a0b19032 100644
--- a/deps/v8/src/objects/js-locale.cc
+++ b/deps/v8/src/objects/js-locale.cc
@@ -179,6 +179,10 @@ bool JSLocale::Is38AlphaNumList(const std::string& value) {
          JSLocale::Is38AlphaNumList(value.substr(found + 1));
 }
 
+bool JSLocale::Is3Alpha(const std::string& value) {
+  return IsAlpha(value, 3, 3);
+}
+
 // TODO(ftang) Replace the following check w/ icu::LocaleBuilder
 // once ICU64 land in March 2019.
 bool JSLocale::StartsWithUnicodeLanguageId(const std::string& value) {
diff --git a/deps/v8/src/objects/js-locale.h b/deps/v8/src/objects/js-locale.h
index f2fca3ce14aca5..4e73b0499ffaa6 100644
--- a/deps/v8/src/objects/js-locale.h
+++ b/deps/v8/src/objects/js-locale.h
@@ -56,6 +56,9 @@ class JSLocale : public JSObject {
   // "(3*8alphanum) *("-" (3*8alphanum)) sequence" sequence
   static bool Is38AlphaNumList(const std::string& value);
 
+  // Help function to check well-formed "3alpha"
+  static bool Is3Alpha(const std::string& value);
+
   DECL_CAST(JSLocale)
 
   DECL_ACCESSORS(icu_locale, Managed<icu::Locale>)
diff --git a/deps/v8/src/objects/js-number-format-inl.h b/deps/v8/src/objects/js-number-format-inl.h
index f68252ab0b8da6..f373013e61bfb1 100644
--- a/deps/v8/src/objects/js-number-format-inl.h
+++ b/deps/v8/src/objects/js-number-format-inl.h
@@ -21,6 +21,7 @@ namespace internal {
 OBJECT_CONSTRUCTORS_IMPL(JSNumberFormat, JSObject)
 
 ACCESSORS(JSNumberFormat, locale, String, kLocaleOffset)
+ACCESSORS(JSNumberFormat, numberingSystem, String, kNumberingSystemOffset)
 ACCESSORS(JSNumberFormat, icu_number_formatter,
           Managed<icu::number::LocalizedNumberFormatter>,
           kIcuNumberFormatterOffset)
diff --git a/deps/v8/src/objects/js-number-format.cc b/deps/v8/src/objects/js-number-format.cc
index c065a3f725d67f..92d3e2fb82eaed 100644
--- a/deps/v8/src/objects/js-number-format.cc
+++ b/deps/v8/src/objects/js-number-format.cc
@@ -282,7 +282,9 @@ int CurrencyDigits(const icu::UnicodeString& currency) {
   return U_SUCCESS(status) ? fraction_digits : 2;
 }
 
-bool IsAToZ(char ch) { return IsInRange(AsciiAlphaToLower(ch), 'a', 'z'); }
+bool IsAToZ(char ch) {
+  return base::IsInRange(AsciiAlphaToLower(ch), 'a', 'z');
+}
 
 // ecma402/#sec-iswellformedcurrencycode
 bool IsWellFormedCurrencyCode(const std::string& currency) {
@@ -654,12 +656,8 @@ Handle<JSObject> JSNumberFormat::ResolvedOptions(
   Handle<JSObject> options = factory->NewJSObject(isolate->object_function());
 
   Handle<String> locale = Handle<String>(number_format->locale(), isolate);
-
-  std::unique_ptr<char[]> locale_str = locale->ToCString();
-  icu::Locale icu_locale = Intl::CreateICULocale(locale_str.get());
-
-  std::string numbering_system = Intl::GetNumberingSystem(icu_locale);
-
+  Handle<String> numberingSystem =
+      Handle<String>(number_format->numberingSystem(), isolate);
   // 5. For each row of Table 4, except the header row, in table order, do
   // Table 4: Resolved Options of NumberFormat Instances
   //  Internal Slot                    Property
@@ -678,13 +676,10 @@ Handle<JSObject> JSNumberFormat::ResolvedOptions(
                                        factory->locale_string(), locale,
                                        Just(kDontThrow))
             .FromJust());
-  if (!numbering_system.empty()) {
-    CHECK(JSReceiver::CreateDataProperty(
-              isolate, options, factory->numberingSystem_string(),
-              factory->NewStringFromAsciiChecked(numbering_system.c_str()),
-              Just(kDontThrow))
-              .FromJust());
-  }
+  CHECK(JSReceiver::CreateDataProperty(isolate, options,
+                                       factory->numberingSystem_string(),
+                                       numberingSystem, Just(kDontThrow))
+            .FromJust());
   JSNumberFormat::Style style = number_format->style();
   CHECK(JSReceiver::CreateDataProperty(
             isolate, options, factory->style_string(),
@@ -866,23 +861,37 @@ MaybeHandle<JSNumberFormat> JSNumberFormat::New(Isolate* isolate,
       Intl::ResolveLocale(isolate, JSNumberFormat::GetAvailableLocales(),
                           requested_locales, matcher, relevant_extension_keys);
 
+  icu::Locale icu_locale = r.icu_locale;
   UErrorCode status = U_ZERO_ERROR;
+  if (numbering_system_str != nullptr) {
+    auto nu_extension_it = r.extensions.find("nu");
+    if (nu_extension_it != r.extensions.end() &&
+        nu_extension_it->second != numbering_system_str.get()) {
+      icu_locale.setUnicodeKeywordValue("nu", nullptr, status);
+      CHECK(U_SUCCESS(status));
+    }
+  }
+
+  // 9. Set numberFormat.[[Locale]] to r.[[locale]].
+  Maybe<std::string> maybe_locale_str = Intl::ToLanguageTag(icu_locale);
+  MAYBE_RETURN(maybe_locale_str, MaybeHandle<JSNumberFormat>());
+  Handle<String> locale_str = isolate->factory()->NewStringFromAsciiChecked(
+      maybe_locale_str.FromJust().c_str());
+
   if (numbering_system_str != nullptr &&
       Intl::IsValidNumberingSystem(numbering_system_str.get())) {
-    r.icu_locale.setUnicodeKeywordValue("nu", numbering_system_str.get(),
-                                        status);
+    icu_locale.setUnicodeKeywordValue("nu", numbering_system_str.get(), status);
     CHECK(U_SUCCESS(status));
-    r.locale = Intl::ToLanguageTag(r.icu_locale).FromJust();
   }
 
-  // 9. Set numberFormat.[[Locale]] to r.[[locale]].
-  Handle<String> locale_str =
-      isolate->factory()->NewStringFromAsciiChecked(r.locale.c_str());
+  Handle<String> numberingSystem_str =
+      isolate->factory()->NewStringFromAsciiChecked(
+          Intl::GetNumberingSystem(icu_locale).c_str());
 
   // 11. Let dataLocale be r.[[dataLocale]].
 
   icu::number::LocalizedNumberFormatter icu_number_formatter =
-      icu::number::NumberFormatter::withLocale(r.icu_locale)
+      icu::number::NumberFormatter::withLocale(icu_locale)
           .roundingMode(UNUM_ROUND_HALFUP);
 
   // 12. Let style be ? GetOption(options, "style", "string",  « "decimal",
@@ -1178,6 +1187,7 @@ MaybeHandle<JSNumberFormat> JSNumberFormat::New(Isolate* isolate,
   number_format->set_flags(0);
   number_format->set_style(style);
   number_format->set_locale(*locale_str);
+  number_format->set_numberingSystem(*numberingSystem_str);
 
   number_format->set_icu_number_formatter(*managed_number_formatter);
   number_format->set_bound_format(*factory->undefined_value());
diff --git a/deps/v8/src/objects/js-number-format.h b/deps/v8/src/objects/js-number-format.h
index a5196f8d517587..dd1156418899b6 100644
--- a/deps/v8/src/objects/js-number-format.h
+++ b/deps/v8/src/objects/js-number-format.h
@@ -12,6 +12,7 @@
 #include <set>
 #include <string>
 
+#include "src/base/bit-field.h"
 #include "src/execution/isolate.h"
 #include "src/heap/factory.h"
 #include "src/objects/intl-objects.h"
@@ -97,6 +98,7 @@ class JSNumberFormat : public JSObject {
   STATIC_ASSERT(Style::UNIT <= StyleBits::kMax);
 
   DECL_ACCESSORS(locale, String)
+  DECL_ACCESSORS(numberingSystem, String)
   DECL_ACCESSORS(icu_number_formatter,
                  Managed<icu::number::LocalizedNumberFormatter>)
   DECL_ACCESSORS(bound_format, Object)
diff --git a/deps/v8/src/objects/js-objects-inl.h b/deps/v8/src/objects/js-objects-inl.h
index a6b9e9ad83daf8..849aae4dc965d2 100644
--- a/deps/v8/src/objects/js-objects-inl.h
+++ b/deps/v8/src/objects/js-objects-inl.h
@@ -71,7 +71,7 @@ MaybeHandle<Object> JSReceiver::GetElement(Isolate* isolate,
 
 Handle<Object> JSReceiver::GetDataProperty(Handle<JSReceiver> object,
                                            Handle<Name> name) {
-  LookupIterator it(object, name, object,
+  LookupIterator it(object->GetIsolate(), object, name, object,
                     LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
   if (!it.IsFound()) return it.factory()->undefined_value();
   return GetDataProperty(&it);
@@ -302,11 +302,12 @@ void JSObject::SetEmbedderField(int index, Smi value) {
 }
 
 bool JSObject::IsUnboxedDoubleField(FieldIndex index) const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return IsUnboxedDoubleField(isolate, index);
 }
 
-bool JSObject::IsUnboxedDoubleField(Isolate* isolate, FieldIndex index) const {
+bool JSObject::IsUnboxedDoubleField(const Isolate* isolate,
+                                    FieldIndex index) const {
   if (!FLAG_unbox_double_fields) return false;
   return map(isolate).IsUnboxedDoubleField(isolate, index);
 }
@@ -315,11 +316,12 @@ bool JSObject::IsUnboxedDoubleField(Isolate* isolate, FieldIndex index) const {
 // is needed to correctly distinguish between properties stored in-object and
 // properties stored in the properties array.
 Object JSObject::RawFastPropertyAt(FieldIndex index) const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return RawFastPropertyAt(isolate, index);
 }
 
-Object JSObject::RawFastPropertyAt(Isolate* isolate, FieldIndex index) const {
+Object JSObject::RawFastPropertyAt(const Isolate* isolate,
+                                   FieldIndex index) const {
   DCHECK(!IsUnboxedDoubleField(isolate, index));
   if (index.is_inobject()) {
     return TaggedField<Object>::load(isolate, *this, index.offset());
@@ -454,6 +456,10 @@ ACCESSORS(JSFunction, raw_feedback_cell, FeedbackCell, kFeedbackCellOffset)
 ACCESSORS(JSGlobalObject, native_context, NativeContext, kNativeContextOffset)
 ACCESSORS(JSGlobalObject, global_proxy, JSGlobalProxy, kGlobalProxyOffset)
 
+DEF_GETTER(JSGlobalObject, native_context_unchecked, Object) {
+  return TaggedField<Object, kNativeContextOffset>::load(isolate, *this);
+}
+
 FeedbackVector JSFunction::feedback_vector() const {
   DCHECK(has_feedback_vector());
   return FeedbackVector::cast(raw_feedback_cell().value());
@@ -699,12 +705,15 @@ bool JSFunction::NeedsResetDueToFlushedBytecode() {
          code.builtin_index() != Builtins::kCompileLazy;
 }
 
-void JSFunction::ResetIfBytecodeFlushed() {
+void JSFunction::ResetIfBytecodeFlushed(
+    base::Optional<std::function<void(HeapObject object, ObjectSlot slot,
+                                      HeapObject target)>>
+        gc_notify_updated_slot) {
   if (FLAG_flush_bytecode && NeedsResetDueToFlushedBytecode()) {
     // Bytecode was flushed and function is now uncompiled, reset JSFunction
     // by setting code to CompileLazy and clearing the feedback vector.
     set_code(GetIsolate()->builtins()->builtin(i::Builtins::kCompileLazy));
-    raw_feedback_cell().reset();
+    raw_feedback_cell().reset_feedback_vector(gc_notify_updated_slot);
   }
 }
 
@@ -933,8 +942,9 @@ DEF_GETTER(JSReceiver, property_array, PropertyArray) {
 
 Maybe<bool> JSReceiver::HasProperty(Handle<JSReceiver> object,
                                     Handle<Name> name) {
-  LookupIterator it = LookupIterator::PropertyOrElement(object->GetIsolate(),
-                                                        object, name, object);
+  Isolate* isolate = object->GetIsolate();
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, object, key, object);
   return HasProperty(&it);
 }
 
@@ -956,15 +966,17 @@ Maybe<bool> JSReceiver::HasOwnProperty(Handle<JSReceiver> object,
 
 Maybe<PropertyAttributes> JSReceiver::GetPropertyAttributes(
     Handle<JSReceiver> object, Handle<Name> name) {
-  LookupIterator it = LookupIterator::PropertyOrElement(object->GetIsolate(),
-                                                        object, name, object);
+  Isolate* isolate = object->GetIsolate();
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, object, key, object);
   return GetPropertyAttributes(&it);
 }
 
 Maybe<PropertyAttributes> JSReceiver::GetOwnPropertyAttributes(
     Handle<JSReceiver> object, Handle<Name> name) {
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      object->GetIsolate(), object, name, object, LookupIterator::OWN);
+  Isolate* isolate = object->GetIsolate();
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, object, key, object, LookupIterator::OWN);
   return GetPropertyAttributes(&it);
 }
 
@@ -1005,7 +1017,7 @@ bool JSGlobalProxy::IsDetachedFrom(JSGlobalObject global) const {
 
 inline int JSGlobalProxy::SizeWithEmbedderFields(int embedder_field_count) {
   DCHECK_GE(embedder_field_count, 0);
-  return kSize + embedder_field_count * kEmbedderDataSlotSize;
+  return kHeaderSize + embedder_field_count * kEmbedderDataSlotSize;
 }
 
 ACCESSORS(JSIteratorResult, value, Object, kValueOffset)
diff --git a/deps/v8/src/objects/js-objects.cc b/deps/v8/src/objects/js-objects.cc
index 4b1d9a4c862246..e3ea25269343b3 100644
--- a/deps/v8/src/objects/js-objects.cc
+++ b/deps/v8/src/objects/js-objects.cc
@@ -37,6 +37,7 @@
 #include "src/objects/js-collection.h"
 #ifdef V8_INTL_SUPPORT
 #include "src/objects/js-date-time-format.h"
+#include "src/objects/js-display-names.h"
 #endif  // V8_INTL_SUPPORT
 #include "src/objects/js-generator-inl.h"
 #ifdef V8_INTL_SUPPORT
@@ -117,8 +118,9 @@ Maybe<bool> JSReceiver::HasOwnProperty(Handle<JSReceiver> object,
   }
 
   if (object->IsJSObject()) {  // Shortcut.
-    LookupIterator it = LookupIterator::PropertyOrElement(
-        object->GetIsolate(), object, name, object, LookupIterator::OWN);
+    Isolate* isolate = object->GetIsolate();
+    LookupIterator::Key key(isolate, name);
+    LookupIterator it(isolate, object, key, LookupIterator::OWN);
     return HasProperty(&it);
   }
 
@@ -128,7 +130,8 @@ Maybe<bool> JSReceiver::HasOwnProperty(Handle<JSReceiver> object,
   return Just(attributes.FromJust() != ABSENT);
 }
 
-Handle<Object> JSReceiver::GetDataProperty(LookupIterator* it) {
+Handle<Object> JSReceiver::GetDataProperty(LookupIterator* it,
+                                           AllocationPolicy allocation_policy) {
   for (; it->IsFound(); it->Next()) {
     switch (it->state()) {
       case LookupIterator::INTERCEPTOR:
@@ -151,7 +154,7 @@ Handle<Object> JSReceiver::GetDataProperty(LookupIterator* it) {
       case LookupIterator::INTEGER_INDEXED_EXOTIC:
         return it->isolate()->factory()->undefined_value();
       case LookupIterator::DATA:
-        return it->GetDataValue();
+        return it->GetDataValue(allocation_policy);
     }
   }
   return it->isolate()->factory()->undefined_value();
@@ -241,16 +244,17 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastAssign(
           prop_value = JSObject::FastPropertyAt(from, representation, index);
         }
       } else {
+        LookupIterator it(isolate, from, next_key,
+                          LookupIterator::OWN_SKIP_INTERCEPTOR);
         ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-            isolate, prop_value,
-            JSReceiver::GetProperty(isolate, from, next_key), Nothing<bool>());
+            isolate, prop_value, Object::GetProperty(&it), Nothing<bool>());
         stable = from->map() == *map;
         *descriptors.location() = map->instance_descriptors().ptr();
       }
     } else {
       // If the map did change, do a slower lookup. We are still guaranteed that
       // the object has a simple shape, and that the key is a name.
-      LookupIterator it(from, next_key, from,
+      LookupIterator it(isolate, from, next_key, from,
                         LookupIterator::OWN_SKIP_INTERCEPTOR);
       if (!it.IsFound()) continue;
       DCHECK(it.state() == LookupIterator::DATA ||
@@ -261,7 +265,10 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastAssign(
     }
 
     if (use_set) {
-      LookupIterator it(target, next_key, target);
+      // The lookup will walk the prototype chain, so we have to be careful
+      // to treat any key correctly for any receiver/holder.
+      LookupIterator::Key key(isolate, next_key);
+      LookupIterator it(isolate, target, key);
       Maybe<bool> result =
           Object::SetProperty(&it, prop_value, StoreOrigin::kNamed,
                               Just(ShouldThrow::kThrowOnError));
@@ -277,10 +284,9 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastAssign(
       }
 
       // 4a ii 2. Perform ? CreateDataProperty(target, nextKey, propValue).
-      bool success;
-      LookupIterator it = LookupIterator::PropertyOrElement(
-          isolate, target, next_key, &success, LookupIterator::OWN);
-      CHECK(success);
+      // This is an OWN lookup, so constructing a named-mode LookupIterator
+      // from {next_key} is safe.
+      LookupIterator it(isolate, target, next_key, LookupIterator::OWN);
       CHECK(JSObject::CreateDataProperty(&it, prop_value, Just(kThrowOnError))
                 .FromJust());
     }
@@ -340,10 +346,8 @@ Maybe<bool> JSReceiver::SetOrCopyDataProperties(
         }
 
         // 4a ii 2. Perform ! CreateDataProperty(target, nextKey, propValue).
-        bool success;
-        LookupIterator it = LookupIterator::PropertyOrElement(
-            isolate, target, next_key, &success, LookupIterator::OWN);
-        CHECK(success);
+        LookupIterator::Key key(isolate, next_key);
+        LookupIterator it(isolate, target, key, LookupIterator::OWN);
         CHECK(JSObject::CreateDataProperty(&it, prop_value, Just(kThrowOnError))
                   .FromJust());
       }
@@ -444,11 +448,15 @@ std::pair<MaybeHandle<JSFunction>, Handle<String>> GetConstructorHelper(
     }
   }
 
+  LookupIterator it_tag(isolate, receiver,
+                        isolate->factory()->to_string_tag_symbol(), receiver,
+                        LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
   Handle<Object> maybe_tag = JSReceiver::GetDataProperty(
-      receiver, isolate->factory()->to_string_tag_symbol());
-  if (maybe_tag->IsString())
+      &it_tag, AllocationPolicy::kAllocationDisallowed);
+  if (maybe_tag->IsString()) {
     return std::make_pair(MaybeHandle<JSFunction>(),
                           Handle<String>::cast(maybe_tag));
+  }
 
   PrototypeIterator iter(isolate, receiver);
   if (iter.IsAtEnd()) {
@@ -457,9 +465,10 @@ std::pair<MaybeHandle<JSFunction>, Handle<String>> GetConstructorHelper(
   }
 
   Handle<JSReceiver> start = PrototypeIterator::GetCurrent<JSReceiver>(iter);
-  LookupIterator it(receiver, isolate->factory()->constructor_string(), start,
-                    LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
-  Handle<Object> maybe_constructor = JSReceiver::GetDataProperty(&it);
+  LookupIterator it(isolate, receiver, isolate->factory()->constructor_string(),
+                    start, LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
+  Handle<Object> maybe_constructor =
+      JSReceiver::GetDataProperty(&it, AllocationPolicy::kAllocationDisallowed);
   if (maybe_constructor->IsJSFunction()) {
     JSFunction constructor = JSFunction::cast(*maybe_constructor);
     String name = constructor.shared().DebugName();
@@ -705,15 +714,15 @@ Smi JSReceiver::GetOrCreateIdentityHash(Isolate* isolate) {
 }
 
 void JSReceiver::DeleteNormalizedProperty(Handle<JSReceiver> object,
-                                          int entry) {
+                                          InternalIndex entry) {
   DCHECK(!object->HasFastProperties());
   Isolate* isolate = object->GetIsolate();
+  DCHECK(entry.is_found());
 
   if (object->IsJSGlobalObject()) {
     // If we have a global object, invalidate the cell and swap in a new one.
     Handle<GlobalDictionary> dictionary(
         JSGlobalObject::cast(*object).global_dictionary(), isolate);
-    DCHECK_NE(GlobalDictionary::kNotFound, entry);
 
     auto cell = PropertyCell::InvalidateEntry(isolate, dictionary, entry);
     cell->set_value(ReadOnlyRoots(isolate).the_hole_value());
@@ -721,7 +730,6 @@ void JSReceiver::DeleteNormalizedProperty(Handle<JSReceiver> object,
         PropertyDetails::Empty(PropertyCellType::kUninitialized));
   } else {
     Handle<NameDictionary> dictionary(object->property_dictionary(), isolate);
-    DCHECK_NE(NameDictionary::kNotFound, entry);
 
     dictionary = NameDictionary::DeleteEntry(isolate, dictionary, entry);
     object->SetProperties(*dictionary);
@@ -813,15 +821,17 @@ Maybe<bool> JSReceiver::DeleteElement(Handle<JSReceiver> object, uint32_t index,
 Maybe<bool> JSReceiver::DeleteProperty(Handle<JSReceiver> object,
                                        Handle<Name> name,
                                        LanguageMode language_mode) {
-  LookupIterator it(object, name, object, LookupIterator::OWN);
+  LookupIterator it(object->GetIsolate(), object, name, object,
+                    LookupIterator::OWN);
   return DeleteProperty(&it, language_mode);
 }
 
 Maybe<bool> JSReceiver::DeletePropertyOrElement(Handle<JSReceiver> object,
                                                 Handle<Name> name,
                                                 LanguageMode language_mode) {
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      object->GetIsolate(), object, name, object, LookupIterator::OWN);
+  Isolate* isolate = object->GetIsolate();
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, object, key, object, LookupIterator::OWN);
   return DeleteProperty(&it, language_mode);
 }
 
@@ -894,10 +904,8 @@ MaybeHandle<Object> JSReceiver::DefineProperties(Isolate* isolate,
     Handle<Object> next_key(keys->get(i), isolate);
     // 7a. Let propDesc be props.[[GetOwnProperty]](nextKey).
     // 7b. ReturnIfAbrupt(propDesc).
-    bool success = false;
-    LookupIterator it = LookupIterator::PropertyOrElement(
-        isolate, props, next_key, &success, LookupIterator::OWN);
-    DCHECK(success);
+    LookupIterator::Key key(isolate, next_key);
+    LookupIterator it(isolate, props, key, LookupIterator::OWN);
     Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
     if (maybe.IsNothing()) return MaybeHandle<Object>();
     PropertyAttributes attrs = maybe.FromJust();
@@ -910,7 +918,7 @@ MaybeHandle<Object> JSReceiver::DefineProperties(Isolate* isolate,
     ASSIGN_RETURN_ON_EXCEPTION(isolate, desc_obj, Object::GetProperty(&it),
                                Object);
     // 7c iii. Let desc be ToPropertyDescriptor(descObj).
-    success = PropertyDescriptor::ToPropertyDescriptor(
+    bool success = PropertyDescriptor::ToPropertyDescriptor(
         isolate, desc_obj, &descriptors[descriptors_index]);
     // 7c iv. ReturnIfAbrupt(desc).
     if (!success) return MaybeHandle<Object>();
@@ -966,11 +974,9 @@ Maybe<bool> JSReceiver::DefineOwnProperty(Isolate* isolate,
 Maybe<bool> JSReceiver::OrdinaryDefineOwnProperty(
     Isolate* isolate, Handle<JSObject> object, Handle<Object> key,
     PropertyDescriptor* desc, Maybe<ShouldThrow> should_throw) {
-  bool success = false;
-  DCHECK(key->IsName() || key->IsNumber());  // |key| is a PropertyKey...
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, object, key, &success, LookupIterator::OWN);
-  DCHECK(success);  // ...so creating a LookupIterator can't fail.
+  DCHECK(key->IsName() || key->IsNumber());  // |key| is a PropertyKey.
+  LookupIterator::Key lookup_key(isolate, key);
+  LookupIterator it(isolate, object, lookup_key, LookupIterator::OWN);
 
   // Deal with access checks first.
   if (it.state() == LookupIterator::ACCESS_CHECK) {
@@ -1009,8 +1015,8 @@ MaybeHandle<Object> GetPropertyWithInterceptorInternal(
   PropertyCallbackArguments args(isolate, interceptor->data(), *receiver,
                                  *holder, Just(kDontThrow));
 
-  if (it->IsElement()) {
-    result = args.CallIndexedGetter(interceptor, it->index());
+  if (it->IsElement(*holder)) {
+    result = args.CallIndexedGetter(interceptor, it->array_index());
   } else {
     result = args.CallNamedGetter(interceptor, it->name());
   }
@@ -1031,7 +1037,7 @@ Maybe<PropertyAttributes> GetPropertyAttributesWithInterceptorInternal(
   HandleScope scope(isolate);
 
   Handle<JSObject> holder = it->GetHolder<JSObject>();
-  DCHECK_IMPLIES(!it->IsElement() && it->name()->IsSymbol(),
+  DCHECK_IMPLIES(!it->IsElement(*holder) && it->name()->IsSymbol(),
                  interceptor->can_intercept_symbols());
   Handle<Object> receiver = it->GetReceiver();
   if (!receiver->IsJSReceiver()) {
@@ -1043,8 +1049,8 @@ Maybe<PropertyAttributes> GetPropertyAttributesWithInterceptorInternal(
                                  *holder, Just(kDontThrow));
   if (!interceptor->query().IsUndefined(isolate)) {
     Handle<Object> result;
-    if (it->IsElement()) {
-      result = args.CallIndexedQuery(interceptor, it->index());
+    if (it->IsElement(*holder)) {
+      result = args.CallIndexedQuery(interceptor, it->array_index());
     } else {
       result = args.CallNamedQuery(interceptor, it->name());
     }
@@ -1056,8 +1062,8 @@ Maybe<PropertyAttributes> GetPropertyAttributesWithInterceptorInternal(
   } else if (!interceptor->getter().IsUndefined(isolate)) {
     // TODO(verwaest): Use GetPropertyWithInterceptor?
     Handle<Object> result;
-    if (it->IsElement()) {
-      result = args.CallIndexedGetter(interceptor, it->index());
+    if (it->IsElement(*holder)) {
+      result = args.CallIndexedGetter(interceptor, it->array_index());
     } else {
       result = args.CallNamedGetter(interceptor, it->name());
     }
@@ -1089,10 +1095,11 @@ Maybe<bool> SetPropertyWithInterceptorInternal(
   PropertyCallbackArguments args(isolate, interceptor->data(), *receiver,
                                  *holder, should_throw);
 
-  if (it->IsElement()) {
+  if (it->IsElement(*holder)) {
     // TODO(neis): In the future, we may want to actually return the
     // interceptor's result, which then should be a boolean.
-    result = !args.CallIndexedSetter(interceptor, it->index(), value).is_null();
+    result = !args.CallIndexedSetter(interceptor, it->array_index(), value)
+                  .is_null();
   } else {
     result = !args.CallNamedSetter(interceptor, it->name(), value).is_null();
   }
@@ -1143,9 +1150,10 @@ Maybe<bool> DefinePropertyWithInterceptorInternal(
     descriptor->set_configurable(desc->configurable());
   }
 
-  if (it->IsElement()) {
-    result = !args.CallIndexedDefiner(interceptor, it->index(), *descriptor)
-                  .is_null();
+  if (it->IsElement(*holder)) {
+    result =
+        !args.CallIndexedDefiner(interceptor, it->array_index(), *descriptor)
+             .is_null();
   } else {
     result =
         !args.CallNamedDefiner(interceptor, it->name(), *descriptor).is_null();
@@ -1473,8 +1481,8 @@ Maybe<bool> JSReceiver::CreateDataProperty(Isolate* isolate,
                                            Handle<Name> key,
                                            Handle<Object> value,
                                            Maybe<ShouldThrow> should_throw) {
-  LookupIterator it = LookupIterator::PropertyOrElement(isolate, object, key,
-                                                        LookupIterator::OWN);
+  LookupIterator::Key lookup_key(isolate, key);
+  LookupIterator it(isolate, object, lookup_key, LookupIterator::OWN);
   return CreateDataProperty(&it, value, should_throw);
 }
 
@@ -1505,11 +1513,9 @@ Maybe<bool> JSReceiver::GetOwnPropertyDescriptor(Isolate* isolate,
                                                  Handle<JSReceiver> object,
                                                  Handle<Object> key,
                                                  PropertyDescriptor* desc) {
-  bool success = false;
-  DCHECK(key->IsName() || key->IsNumber());  // |key| is a PropertyKey...
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, object, key, &success, LookupIterator::OWN);
-  DCHECK(success);  // ...so creating a LookupIterator can't fail.
+  DCHECK(key->IsName() || key->IsNumber());  // |key| is a PropertyKey.
+  LookupIterator::Key lookup_key(isolate, key);
+  LookupIterator it(isolate, object, lookup_key, LookupIterator::OWN);
   return GetOwnPropertyDescriptor(&it, desc);
 }
 
@@ -1552,8 +1558,8 @@ Maybe<bool> GetPropertyDescriptorWithInterceptor(LookupIterator* it,
 
   PropertyCallbackArguments args(isolate, interceptor->data(), *receiver,
                                  *holder, Just(kDontThrow));
-  if (it->IsElement()) {
-    result = args.CallIndexedDescriptor(interceptor, it->index());
+  if (it->IsElement(*holder)) {
+    result = args.CallIndexedDescriptor(interceptor, it->array_index());
   } else {
     result = args.CallNamedDescriptor(interceptor, it->name());
   }
@@ -1562,8 +1568,8 @@ Maybe<bool> GetPropertyDescriptorWithInterceptor(LookupIterator* it,
     // descriptor.
     Utils::ApiCheck(
         PropertyDescriptor::ToPropertyDescriptor(isolate, result, desc),
-        it->IsElement() ? "v8::IndexedPropertyDescriptorCallback"
-                        : "v8::NamedPropertyDescriptorCallback",
+        it->IsElement(*holder) ? "v8::IndexedPropertyDescriptorCallback"
+                               : "v8::NamedPropertyDescriptorCallback",
         "Invalid property descriptor.");
 
     return Just(true);
@@ -1845,17 +1851,18 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastGetOwnValuesOrEntries(
   Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate);
 
   int number_of_own_descriptors = map->NumberOfOwnDescriptors();
-  int number_of_own_elements =
+  size_t number_of_own_elements =
       object->GetElementsAccessor()->GetCapacity(*object, object->elements());
 
   if (number_of_own_elements >
-      FixedArray::kMaxLength - number_of_own_descriptors) {
+      static_cast<size_t>(FixedArray::kMaxLength - number_of_own_descriptors)) {
     isolate->Throw(*isolate->factory()->NewRangeError(
         MessageTemplate::kInvalidArrayLength));
     return Nothing<bool>();
   }
+  // The static cast is safe after the range check right above.
   Handle<FixedArray> values_or_entries = isolate->factory()->NewFixedArray(
-      number_of_own_descriptors + number_of_own_elements);
+      static_cast<int>(number_of_own_descriptors + number_of_own_elements));
   int count = 0;
 
   if (object->elements() != ReadOnlyRoots(isolate).empty_fixed_array()) {
@@ -1897,10 +1904,11 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastGetOwnValuesOrEntries(
               JSObject::FastPropertyAt(object, representation, field_index);
         }
       } else {
+        LookupIterator it(isolate, object, next_key,
+                          LookupIterator::OWN_SKIP_INTERCEPTOR);
+        DCHECK_EQ(LookupIterator::ACCESSOR, it.state());
         ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-            isolate, prop_value,
-            JSReceiver::GetProperty(isolate, object, next_key),
-            Nothing<bool>());
+            isolate, prop_value, Object::GetProperty(&it), Nothing<bool>());
         stable = object->map() == *map;
         *descriptors.location() = map->instance_descriptors().ptr();
       }
@@ -2087,110 +2095,110 @@ int JSObject::GetHeaderSize(InstanceType type,
     case JS_SPECIAL_API_OBJECT_TYPE:
       return JSObject::kHeaderSize;
     case JS_GENERATOR_OBJECT_TYPE:
-      return JSGeneratorObject::kSize;
+      return JSGeneratorObject::kHeaderSize;
     case JS_ASYNC_FUNCTION_OBJECT_TYPE:
-      return JSAsyncFunctionObject::kSize;
+      return JSAsyncFunctionObject::kHeaderSize;
     case JS_ASYNC_GENERATOR_OBJECT_TYPE:
-      return JSAsyncGeneratorObject::kSize;
+      return JSAsyncGeneratorObject::kHeaderSize;
     case JS_ASYNC_FROM_SYNC_ITERATOR_TYPE:
-      return JSAsyncFromSyncIterator::kSize;
+      return JSAsyncFromSyncIterator::kHeaderSize;
     case JS_GLOBAL_PROXY_TYPE:
-      return JSGlobalProxy::kSize;
+      return JSGlobalProxy::kHeaderSize;
     case JS_GLOBAL_OBJECT_TYPE:
-      return JSGlobalObject::kSize;
+      return JSGlobalObject::kHeaderSize;
     case JS_BOUND_FUNCTION_TYPE:
-      return JSBoundFunction::kSize;
+      return JSBoundFunction::kHeaderSize;
     case JS_FUNCTION_TYPE:
       return JSFunction::GetHeaderSize(function_has_prototype_slot);
     case JS_PRIMITIVE_WRAPPER_TYPE:
-      return JSPrimitiveWrapper::kSize;
+      return JSPrimitiveWrapper::kHeaderSize;
     case JS_DATE_TYPE:
-      return JSDate::kSize;
+      return JSDate::kHeaderSize;
     case JS_ARRAY_TYPE:
-      return JSArray::kSize;
+      return JSArray::kHeaderSize;
     case JS_ARRAY_BUFFER_TYPE:
       return JSArrayBuffer::kHeaderSize;
     case JS_ARRAY_ITERATOR_TYPE:
-      return JSArrayIterator::kSize;
+      return JSArrayIterator::kHeaderSize;
     case JS_TYPED_ARRAY_TYPE:
       return JSTypedArray::kHeaderSize;
     case JS_DATA_VIEW_TYPE:
       return JSDataView::kHeaderSize;
     case JS_SET_TYPE:
-      return JSSet::kSize;
+      return JSSet::kHeaderSize;
     case JS_MAP_TYPE:
-      return JSMap::kSize;
+      return JSMap::kHeaderSize;
     case JS_SET_KEY_VALUE_ITERATOR_TYPE:
     case JS_SET_VALUE_ITERATOR_TYPE:
-      return JSSetIterator::kSize;
+      return JSSetIterator::kHeaderSize;
     case JS_MAP_KEY_ITERATOR_TYPE:
     case JS_MAP_KEY_VALUE_ITERATOR_TYPE:
     case JS_MAP_VALUE_ITERATOR_TYPE:
-      return JSMapIterator::kSize;
-    case WEAK_CELL_TYPE:
-      return WeakCell::kSize;
+      return JSMapIterator::kHeaderSize;
     case JS_WEAK_REF_TYPE:
-      return JSWeakRef::kSize;
+      return JSWeakRef::kHeaderSize;
     case JS_FINALIZATION_GROUP_TYPE:
-      return JSFinalizationGroup::kSize;
+      return JSFinalizationGroup::kHeaderSize;
     case JS_FINALIZATION_GROUP_CLEANUP_ITERATOR_TYPE:
-      return JSFinalizationGroupCleanupIterator::kSize;
+      return JSFinalizationGroupCleanupIterator::kHeaderSize;
     case JS_WEAK_MAP_TYPE:
-      return JSWeakMap::kSize;
+      return JSWeakMap::kHeaderSize;
     case JS_WEAK_SET_TYPE:
-      return JSWeakSet::kSize;
+      return JSWeakSet::kHeaderSize;
     case JS_PROMISE_TYPE:
-      return JSPromise::kSize;
+      return JSPromise::kHeaderSize;
     case JS_REG_EXP_TYPE:
-      return JSRegExp::kSize;
+      return JSRegExp::kHeaderSize;
     case JS_REG_EXP_STRING_ITERATOR_TYPE:
-      return JSRegExpStringIterator::kSize;
+      return JSRegExpStringIterator::kHeaderSize;
     case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
       return JSObject::kHeaderSize;
     case JS_MESSAGE_OBJECT_TYPE:
-      return JSMessageObject::kSize;
+      return JSMessageObject::kHeaderSize;
     case JS_ARGUMENTS_OBJECT_TYPE:
       return JSObject::kHeaderSize;
     case JS_ERROR_TYPE:
       return JSObject::kHeaderSize;
     case JS_STRING_ITERATOR_TYPE:
-      return JSStringIterator::kSize;
+      return JSStringIterator::kHeaderSize;
     case JS_MODULE_NAMESPACE_TYPE:
       return JSModuleNamespace::kHeaderSize;
 #ifdef V8_INTL_SUPPORT
     case JS_V8_BREAK_ITERATOR_TYPE:
-      return JSV8BreakIterator::kSize;
+      return JSV8BreakIterator::kHeaderSize;
     case JS_COLLATOR_TYPE:
-      return JSCollator::kSize;
+      return JSCollator::kHeaderSize;
     case JS_DATE_TIME_FORMAT_TYPE:
-      return JSDateTimeFormat::kSize;
+      return JSDateTimeFormat::kHeaderSize;
+    case JS_DISPLAY_NAMES_TYPE:
+      return JSDisplayNames::kHeaderSize;
     case JS_LIST_FORMAT_TYPE:
-      return JSListFormat::kSize;
+      return JSListFormat::kHeaderSize;
     case JS_LOCALE_TYPE:
-      return JSLocale::kSize;
+      return JSLocale::kHeaderSize;
     case JS_NUMBER_FORMAT_TYPE:
-      return JSNumberFormat::kSize;
+      return JSNumberFormat::kHeaderSize;
     case JS_PLURAL_RULES_TYPE:
-      return JSPluralRules::kSize;
+      return JSPluralRules::kHeaderSize;
     case JS_RELATIVE_TIME_FORMAT_TYPE:
-      return JSRelativeTimeFormat::kSize;
+      return JSRelativeTimeFormat::kHeaderSize;
     case JS_SEGMENT_ITERATOR_TYPE:
-      return JSSegmentIterator::kSize;
+      return JSSegmentIterator::kHeaderSize;
     case JS_SEGMENTER_TYPE:
-      return JSSegmenter::kSize;
+      return JSSegmenter::kHeaderSize;
 #endif  // V8_INTL_SUPPORT
     case WASM_GLOBAL_OBJECT_TYPE:
-      return WasmGlobalObject::kSize;
+      return WasmGlobalObject::kHeaderSize;
     case WASM_INSTANCE_OBJECT_TYPE:
-      return WasmInstanceObject::kSize;
+      return WasmInstanceObject::kHeaderSize;
     case WASM_MEMORY_OBJECT_TYPE:
-      return WasmMemoryObject::kSize;
+      return WasmMemoryObject::kHeaderSize;
     case WASM_MODULE_OBJECT_TYPE:
-      return WasmModuleObject::kSize;
+      return WasmModuleObject::kHeaderSize;
     case WASM_TABLE_OBJECT_TYPE:
-      return WasmTableObject::kSize;
+      return WasmTableObject::kHeaderSize;
     case WASM_EXCEPTION_OBJECT_TYPE:
-      return WasmExceptionObject::kSize;
+      return WasmExceptionObject::kHeaderSize;
     default:
       UNREACHABLE();
   }
@@ -2332,9 +2340,10 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object, Handle<Name> name,
     Handle<JSGlobalObject> global_obj = Handle<JSGlobalObject>::cast(object);
     Handle<GlobalDictionary> dictionary(global_obj->global_dictionary(),
                                         isolate);
-    int entry = dictionary->FindEntry(ReadOnlyRoots(isolate), name, hash);
+    InternalIndex entry =
+        dictionary->FindEntry(ReadOnlyRoots(isolate), name, hash);
 
-    if (entry == GlobalDictionary::kNotFound) {
+    if (entry.is_not_found()) {
       DCHECK_IMPLIES(global_obj->map().is_prototype_map(),
                      Map::IsPrototypeChainInvalidated(global_obj->map()));
       auto cell = isolate->factory()->NewPropertyCell(name);
@@ -2355,8 +2364,8 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object, Handle<Name> name,
   } else {
     Handle<NameDictionary> dictionary(object->property_dictionary(), isolate);
 
-    int entry = dictionary->FindEntry(isolate, name);
-    if (entry == NameDictionary::kNotFound) {
+    InternalIndex entry = dictionary->FindEntry(isolate, name);
+    if (entry.is_not_found()) {
       DCHECK_IMPLIES(object->map().is_prototype_map(),
                      Map::IsPrototypeChainInvalidated(object->map()));
       dictionary =
@@ -2575,7 +2584,7 @@ void JSObject::UpdatePrototypeUserRegistration(Handle<Map> old_map,
   DCHECK(new_map->is_prototype_map());
   bool was_registered = JSObject::UnregisterPrototypeUser(old_map, isolate);
   new_map->set_prototype_info(old_map->prototype_info());
-  old_map->set_prototype_info(Smi::kZero);
+  old_map->set_prototype_info(Smi::zero());
   if (FLAG_trace_prototype_users) {
     PrintF("Moving prototype_info %p from map %p to map %p.\n",
            reinterpret_cast<void*>(new_map->prototype_info().ptr()),
@@ -2947,7 +2956,7 @@ void MigrateFastToSlow(Isolate* isolate, Handle<JSObject> object,
 
     for (int i = 0; i < inobject_properties; i++) {
       FieldIndex index = FieldIndex::ForPropertyIndex(*new_map, i);
-      object->RawFastPropertyAtPut(index, Smi::kZero);
+      object->RawFastPropertyAtPut(index, Smi::zero());
     }
   }
 
@@ -3268,13 +3277,15 @@ MaybeHandle<Object> JSObject::SetOwnPropertyIgnoreAttributes(
     Handle<JSObject> object, Handle<Name> name, Handle<Object> value,
     PropertyAttributes attributes) {
   DCHECK(!value->IsTheHole());
-  LookupIterator it(object, name, object, LookupIterator::OWN);
+  LookupIterator it(object->GetIsolate(), object, name, object,
+                    LookupIterator::OWN);
   return DefineOwnPropertyIgnoreAttributes(&it, value, attributes);
 }
 
 MaybeHandle<Object> JSObject::SetOwnElementIgnoreAttributes(
-    Handle<JSObject> object, uint32_t index, Handle<Object> value,
+    Handle<JSObject> object, size_t index, Handle<Object> value,
     PropertyAttributes attributes) {
+  DCHECK(!object->IsJSTypedArray());
   Isolate* isolate = object->GetIsolate();
   LookupIterator it(isolate, object, index, object, LookupIterator::OWN);
   return DefineOwnPropertyIgnoreAttributes(&it, value, attributes);
@@ -3284,8 +3295,8 @@ MaybeHandle<Object> JSObject::DefinePropertyOrElementIgnoreAttributes(
     Handle<JSObject> object, Handle<Name> name, Handle<Object> value,
     PropertyAttributes attributes) {
   Isolate* isolate = object->GetIsolate();
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, object, name, object, LookupIterator::OWN);
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, object, key, object, LookupIterator::OWN);
   return DefineOwnPropertyIgnoreAttributes(&it, value, attributes);
 }
 
@@ -3331,7 +3342,7 @@ void JSObject::MigrateSlowToFast(Handle<JSObject> object,
   // Compute the length of the instance descriptor.
   ReadOnlyRoots roots(isolate);
   for (int i = 0; i < instance_descriptor_length; i++) {
-    int index = Smi::ToInt(iteration_order->get(i));
+    InternalIndex index(Smi::ToInt(iteration_order->get(i)));
     DCHECK(dictionary->IsKey(roots, dictionary->KeyAt(index)));
 
     PropertyKind kind = dictionary->DetailsAt(index).kind();
@@ -3391,7 +3402,7 @@ void JSObject::MigrateSlowToFast(Handle<JSObject> object,
   // Fill in the instance descriptor and the fields.
   int current_offset = 0;
   for (int i = 0; i < instance_descriptor_length; i++) {
-    int index = Smi::ToInt(iteration_order->get(i));
+    InternalIndex index(Smi::ToInt(iteration_order->get(i)));
     Name k = dictionary->NameAt(index);
     // Dictionary keys are internalized upon insertion.
     // TODO(jkummerow): Turn this into a DCHECK if it's not hit in the wild.
@@ -3558,8 +3569,8 @@ Maybe<bool> JSObject::DeletePropertyWithInterceptor(LookupIterator* it,
   PropertyCallbackArguments args(isolate, interceptor->data(), *receiver,
                                  *holder, Just(should_throw));
   Handle<Object> result;
-  if (it->IsElement()) {
-    result = args.CallIndexedDeleter(interceptor, it->index());
+  if (it->IsElement(*holder)) {
+    result = args.CallIndexedDeleter(interceptor, it->array_index());
   } else {
     result = args.CallNamedDeleter(interceptor, it->name());
   }
@@ -3611,8 +3622,7 @@ bool TestDictionaryPropertiesIntegrityLevel(Dictionary dict,
                                             PropertyAttributes level) {
   DCHECK(level == SEALED || level == FROZEN);
 
-  uint32_t capacity = dict.Capacity();
-  for (uint32_t i = 0; i < capacity; i++) {
+  for (InternalIndex i : dict.IterateEntries()) {
     Object key;
     if (!dict.ToKey(roots, i, &key)) continue;
     if (key.FilterKey(ALL_PROPERTIES)) continue;
@@ -3664,8 +3674,9 @@ bool TestElementsIntegrityLevel(JSObject object, PropertyAttributes level) {
         level);
   }
   if (IsTypedArrayElementsKind(kind)) {
-    if (level == FROZEN && JSArrayBufferView::cast(object).byte_length() > 0)
+    if (level == FROZEN && JSArrayBufferView::cast(object).byte_length() > 0) {
       return false;  // TypedArrays with elements can't be frozen.
+    }
     return TestPropertiesIntegrityLevel(object, level);
   }
   if (IsFrozenElementsKind(kind)) return true;
@@ -3773,8 +3784,7 @@ template <typename Dictionary>
 void JSObject::ApplyAttributesToDictionary(
     Isolate* isolate, ReadOnlyRoots roots, Handle<Dictionary> dictionary,
     const PropertyAttributes attributes) {
-  int capacity = dictionary->Capacity();
-  for (int i = 0; i < capacity; i++) {
+  for (InternalIndex i : dictionary->IterateEntries()) {
     Object k;
     if (!dictionary->ToKey(roots, i, &k)) continue;
     if (k.FilterKey(ALL_PROPERTIES)) continue;
@@ -4085,8 +4095,8 @@ MaybeHandle<Object> JSObject::DefineAccessor(Handle<JSObject> object,
                                              PropertyAttributes attributes) {
   Isolate* isolate = object->GetIsolate();
 
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, object, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
   return DefineAccessor(&it, getter, setter, attributes);
 }
 
@@ -4128,8 +4138,8 @@ MaybeHandle<Object> JSObject::SetAccessor(Handle<JSObject> object,
                                           PropertyAttributes attributes) {
   Isolate* isolate = object->GetIsolate();
 
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, object, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
 
   // Duplicate ACCESS_CHECK outside of GetPropertyAttributes for the case that
   // the FailedAccessCheckCallbackFunction doesn't throw an exception.
@@ -4394,6 +4404,11 @@ void InvalidateOnePrototypeValidityCellInternal(Map map) {
     Cell cell = Cell::cast(maybe_cell);
     cell.set_value(Smi::FromInt(Map::kPrototypeChainInvalid));
   }
+  Object maybe_prototype_info = map.prototype_info();
+  if (maybe_prototype_info.IsPrototypeInfo()) {
+    PrototypeInfo prototype_info = PrototypeInfo::cast(maybe_prototype_info);
+    prototype_info.set_prototype_chain_enum_cache(Object());
+  }
 }
 
 void InvalidatePrototypeChainsInternal(Map map) {
@@ -4588,7 +4603,7 @@ static bool ShouldConvertToFastElements(JSObject object,
     Object length = JSArray::cast(object).length();
     if (!length.IsSmi()) return false;
     *new_capacity = static_cast<uint32_t>(Smi::ToInt(length));
-  } else if (object.IsJSSloppyArgumentsObject()) {
+  } else if (object.IsJSArgumentsObject()) {
     return false;
   } else {
     *new_capacity = dictionary.max_number_key() + 1;
@@ -4615,7 +4630,7 @@ static ElementsKind BestFittingFastElementsKind(JSObject object) {
   DCHECK(object.HasDictionaryElements());
   NumberDictionary dictionary = object.element_dictionary();
   ElementsKind kind = HOLEY_SMI_ELEMENTS;
-  for (int i = 0; i < dictionary.Capacity(); i++) {
+  for (InternalIndex i : dictionary.IterateEntries()) {
     Object key = dictionary.KeyAt(i);
     if (key.IsNumber()) {
       Object value = dictionary.ValueAt(i);
@@ -4810,8 +4825,9 @@ MaybeHandle<Object> JSObject::GetPropertyWithInterceptor(LookupIterator* it,
 
 Maybe<bool> JSObject::HasRealNamedProperty(Handle<JSObject> object,
                                            Handle<Name> name) {
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      object->GetIsolate(), object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
+  Isolate* isolate = object->GetIsolate();
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, object, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
   return HasProperty(&it);
 }
 
@@ -4825,8 +4841,9 @@ Maybe<bool> JSObject::HasRealElementProperty(Handle<JSObject> object,
 
 Maybe<bool> JSObject::HasRealNamedCallbackProperty(Handle<JSObject> object,
                                                    Handle<Name> name) {
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      object->GetIsolate(), object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
+  Isolate* isolate = object->GetIsolate();
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, object, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
   Maybe<PropertyAttributes> maybe_result = GetPropertyAttributes(&it);
   return maybe_result.IsJust() ? Just(it.state() == LookupIterator::ACCESSOR)
                                : Nothing<bool>();
@@ -5217,6 +5234,7 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
 #ifdef V8_INTL_SUPPORT
     case JS_COLLATOR_TYPE:
     case JS_DATE_TIME_FORMAT_TYPE:
+    case JS_DISPLAY_NAMES_TYPE:
     case JS_LIST_FORMAT_TYPE:
     case JS_LOCALE_TYPE:
     case JS_NUMBER_FORMAT_TYPE:
@@ -5523,6 +5541,23 @@ Handle<String> JSFunction::ToString(Handle<JSFunction> function) {
     return NativeCodeFunctionSourceString(shared_info);
   }
 
+  // If this function was compiled from asm.js, use the recorded offset
+  // information.
+  if (shared_info->HasWasmExportedFunctionData()) {
+    Handle<WasmExportedFunctionData> function_data(
+        shared_info->wasm_exported_function_data(), isolate);
+    const wasm::WasmModule* module = function_data->instance().module();
+    if (is_asmjs_module(module)) {
+      std::pair<int, int> offsets =
+          module->asm_js_offset_information->GetFunctionOffsets(
+              declared_function_index(module, function_data->function_index()));
+      Handle<String> source(
+          String::cast(Script::cast(shared_info->script()).source()), isolate);
+      return isolate->factory()->NewSubString(source, offsets.first,
+                                              offsets.second);
+    }
+  }
+
   if (shared_info->function_token_position() == kNoSourcePosition) {
     // If the function token position isn't valid, return [native code] to
     // ensure calling eval on the returned source code throws rather than
@@ -5632,20 +5667,20 @@ void JSGlobalObject::InvalidatePropertyCell(Handle<JSGlobalObject> global,
 
   DCHECK(!global->HasFastProperties());
   auto dictionary = handle(global->global_dictionary(), global->GetIsolate());
-  int entry = dictionary->FindEntry(global->GetIsolate(), name);
-  if (entry == GlobalDictionary::kNotFound) return;
+  InternalIndex entry = dictionary->FindEntry(global->GetIsolate(), name);
+  if (entry.is_not_found()) return;
   PropertyCell::InvalidateEntry(global->GetIsolate(), dictionary, entry);
 }
 
 Handle<PropertyCell> JSGlobalObject::EnsureEmptyPropertyCell(
     Handle<JSGlobalObject> global, Handle<Name> name,
-    PropertyCellType cell_type, int* entry_out) {
+    PropertyCellType cell_type, InternalIndex* entry_out) {
   Isolate* isolate = global->GetIsolate();
   DCHECK(!global->HasFastProperties());
   Handle<GlobalDictionary> dictionary(global->global_dictionary(), isolate);
-  int entry = dictionary->FindEntry(isolate, name);
+  InternalIndex entry = dictionary->FindEntry(isolate, name);
   Handle<PropertyCell> cell;
-  if (entry != GlobalDictionary::kNotFound) {
+  if (entry.is_found()) {
     if (entry_out) *entry_out = entry;
     cell = handle(dictionary->CellAt(entry), isolate);
     PropertyCellType original_cell_type = cell->property_details().cell_type();
diff --git a/deps/v8/src/objects/js-objects.h b/deps/v8/src/objects/js-objects.h
index f38cbe16e69fea..e59179cb67af96 100644
--- a/deps/v8/src/objects/js-objects.h
+++ b/deps/v8/src/objects/js-objects.h
@@ -19,6 +19,10 @@
 namespace v8 {
 namespace internal {
 
+// Enum for functions that offer a second mode that does not cause allocations.
+// Used in conjunction with LookupIterator and unboxed double fields.
+enum class AllocationPolicy { kAllocationAllowed, kAllocationDisallowed };
+
 enum InstanceType : uint16_t;
 class JSGlobalObject;
 class JSGlobalProxy;
@@ -68,7 +72,8 @@ class JSReceiver : public HeapObject {
   inline void initialize_properties(Isolate* isolate);
 
   // Deletes an existing named property in a normalized object.
-  static void DeleteNormalizedProperty(Handle<JSReceiver> object, int entry);
+  static void DeleteNormalizedProperty(Handle<JSReceiver> object,
+                                       InternalIndex entry);
 
   DECL_CAST(JSReceiver)
   DECL_VERIFIER(JSReceiver)
@@ -236,7 +241,9 @@ class JSReceiver : public HeapObject {
 
   inline static Handle<Object> GetDataProperty(Handle<JSReceiver> object,
                                                Handle<Name> name);
-  V8_EXPORT_PRIVATE static Handle<Object> GetDataProperty(LookupIterator* it);
+  V8_EXPORT_PRIVATE static Handle<Object> GetDataProperty(
+      LookupIterator* it, AllocationPolicy allocation_policy =
+                              AllocationPolicy::kAllocationAllowed);
 
   // Retrieves a permanent object identity hash code. The undefined value might
   // be returned in case no hash was created yet.
@@ -269,9 +276,6 @@ class JSReceiver : public HeapObject {
                                 TORQUE_GENERATED_JS_RECEIVER_FIELDS)
   bool HasProxyInPrototype(Isolate* isolate);
 
-  V8_WARN_UNUSED_RESULT static MaybeHandle<FixedArray> GetPrivateEntries(
-      Isolate* isolate, Handle<JSReceiver> receiver);
-
   OBJECT_CONSTRUCTORS(JSReceiver, HeapObject);
 };
 
@@ -381,7 +385,7 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
                                  PropertyAttributes attributes);
 
   V8_WARN_UNUSED_RESULT static MaybeHandle<Object>
-  SetOwnElementIgnoreAttributes(Handle<JSObject> object, uint32_t index,
+  SetOwnElementIgnoreAttributes(Handle<JSObject> object, size_t index,
                                 Handle<Object> value,
                                 PropertyAttributes attributes);
 
@@ -476,7 +480,6 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
   GetPropertyAttributesWithFailedAccessCheck(LookupIterator* it);
 
   // Defines an AccessorPair property on the given object.
-  // TODO(mstarzinger): Rename to SetAccessor().
   V8_EXPORT_PRIVATE static MaybeHandle<Object> DefineAccessor(
       Handle<JSObject> object, Handle<Name> name, Handle<Object> getter,
       Handle<Object> setter, PropertyAttributes attributes);
@@ -614,14 +617,16 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
                                                   const char* reason);
 
   inline bool IsUnboxedDoubleField(FieldIndex index) const;
-  inline bool IsUnboxedDoubleField(Isolate* isolate, FieldIndex index) const;
+  inline bool IsUnboxedDoubleField(const Isolate* isolate,
+                                   FieldIndex index) const;
 
   // Access fast-case object properties at index.
   static Handle<Object> FastPropertyAt(Handle<JSObject> object,
                                        Representation representation,
                                        FieldIndex index);
   inline Object RawFastPropertyAt(FieldIndex index) const;
-  inline Object RawFastPropertyAt(Isolate* isolate, FieldIndex index) const;
+  inline Object RawFastPropertyAt(const Isolate* isolate,
+                                  FieldIndex index) const;
   inline double RawFastDoublePropertyAt(FieldIndex index) const;
   inline uint64_t RawFastDoublePropertyAsBitsAt(FieldIndex index) const;
 
@@ -716,7 +721,7 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
   // If a GC was caused while constructing this object, the elements pointer
   // may point to a one pointer filler map. The object won't be rooted, but
   // our heap verification code could stumble across it.
-  V8_EXPORT_PRIVATE bool ElementsAreSafeToExamine(Isolate* isolate) const;
+  V8_EXPORT_PRIVATE bool ElementsAreSafeToExamine(const Isolate* isolate) const;
 #endif
 
   Object SlowReverseLookup(Object value);
@@ -1076,7 +1081,10 @@ class JSFunction : public JSFunctionOrBoundFunction {
 
   // Resets function to clear compiled data after bytecode has been flushed.
   inline bool NeedsResetDueToFlushedBytecode();
-  inline void ResetIfBytecodeFlushed();
+  inline void ResetIfBytecodeFlushed(
+      base::Optional<std::function<void(HeapObject object, ObjectSlot slot,
+                                        HeapObject target)>>
+          gc_notify_updated_slot = base::nullopt);
 
   DECL_GETTER(has_prototype_slot, bool)
 
@@ -1156,11 +1164,26 @@ class JSFunction : public JSFunctionOrBoundFunction {
   // ES6 section 19.2.3.5 Function.prototype.toString ( ).
   static Handle<String> ToString(Handle<JSFunction> function);
 
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSFunctionOrBoundFunction::kHeaderSize,
-                                TORQUE_GENERATED_JS_FUNCTION_FIELDS)
+  struct FieldOffsets {
+    DEFINE_FIELD_OFFSET_CONSTANTS(JSFunctionOrBoundFunction::kHeaderSize,
+                                  TORQUE_GENERATED_JS_FUNCTION_FIELDS)
+  };
+  static constexpr int kSharedFunctionInfoOffset =
+      FieldOffsets::kSharedFunctionInfoOffset;
+  static constexpr int kContextOffset = FieldOffsets::kContextOffset;
+  static constexpr int kFeedbackCellOffset = FieldOffsets::kFeedbackCellOffset;
+  static constexpr int kCodeOffset = FieldOffsets::kCodeOffset;
+  static constexpr int kPrototypeOrInitialMapOffset =
+      FieldOffsets::kPrototypeOrInitialMapOffset;
+
+ private:
+  // JSFunction doesn't have a fixed header size:
+  // Hide JSFunctionOrBoundFunction::kHeaderSize to avoid confusion.
+  static const int kHeaderSize;
 
+ public:
   static constexpr int kSizeWithoutPrototype = kPrototypeOrInitialMapOffset;
-  static constexpr int kSizeWithPrototype = kSize;
+  static constexpr int kSizeWithPrototype = FieldOffsets::kHeaderSize;
 
   OBJECT_CONSTRUCTORS(JSFunction, JSFunctionOrBoundFunction);
 };
@@ -1205,12 +1228,16 @@ class JSGlobalObject : public JSSpecialObject {
   // Ensure that the global object has a cell for the given property name.
   static Handle<PropertyCell> EnsureEmptyPropertyCell(
       Handle<JSGlobalObject> global, Handle<Name> name,
-      PropertyCellType cell_type, int* entry_out = nullptr);
+      PropertyCellType cell_type, InternalIndex* entry_out = nullptr);
 
   DECL_CAST(JSGlobalObject)
 
   inline bool IsDetached();
 
+  // May be called by the concurrent GC when the global object is not
+  // fully initialized.
+  DECL_GETTER(native_context_unchecked, Object)
+
   // Dispatched behavior.
   DECL_PRINTER(JSGlobalObject)
   DECL_VERIFIER(JSGlobalObject)
@@ -1361,8 +1388,9 @@ class JSMessageObject : public JSObject {
   // TODO(v8:8989): [torque] Support marker constants.
   static const int kPointerFieldsEndOffset = kStartPositionOffset;
 
-  using BodyDescriptor = FixedBodyDescriptor<HeapObject::kMapOffset,
-                                             kPointerFieldsEndOffset, kSize>;
+  using BodyDescriptor =
+      FixedBodyDescriptor<HeapObject::kMapOffset, kPointerFieldsEndOffset,
+                          kHeaderSize>;
 
  private:
   friend class Factory;
@@ -1415,7 +1443,7 @@ class JSStringIterator
   DECL_PRINTER(JSStringIterator)
   DECL_VERIFIER(JSStringIterator)
 
-  // [index]: The [[StringIteratorNextIndex]] inobject property.
+  // [index]: The [[StringIteratorNextIndex]] slot.
   inline int index() const;
   inline void set_index(int value);
 
diff --git a/deps/v8/src/objects/js-objects.tq b/deps/v8/src/objects/js-objects.tq
new file mode 100644
index 00000000000000..823fef1e940262
--- /dev/null
+++ b/deps/v8/src/objects/js-objects.tq
@@ -0,0 +1,192 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// JSReceiver corresponds to objects in the JS sense.
+@abstract
+@highestInstanceTypeWithinParentClassRange
+extern class JSReceiver extends HeapObject {
+  properties_or_hash: FixedArrayBase|PropertyArray|Smi;
+}
+
+type Constructor extends JSReceiver;
+
+@generateCppClass
+@apiExposedInstanceTypeValue(0x421)
+@highestInstanceTypeWithinParentClassRange
+extern class JSObject extends JSReceiver {
+  // [elements]: The elements (properties with names that are integers).
+  //
+  // Elements can be in two general modes: fast and slow. Each mode
+  // corresponds to a set of object representations of elements that
+  // have something in common.
+  //
+  // In the fast mode elements is a FixedArray and so each element can be
+  // quickly accessed. The elements array can have one of several maps in this
+  // mode: fixed_array_map, fixed_double_array_map,
+  // sloppy_arguments_elements_map or fixed_cow_array_map (for copy-on-write
+  // arrays). In the latter case the elements array may be shared by a few
+  // objects and so before writing to any element the array must be copied. Use
+  // EnsureWritableFastElements in this case.
+  //
+  // In the slow mode the elements is either a NumberDictionary or a
+  // FixedArray parameter map for a (sloppy) arguments object.
+  elements: FixedArrayBase;
+}
+
+macro NewJSObject(implicit context: Context)(): JSObject {
+  const objectFunction: JSFunction = GetObjectFunction();
+  const map: Map = Cast<Map>(objectFunction.prototype_or_initial_map)
+      otherwise unreachable;
+  return AllocateJSObjectFromMap(map);
+}
+
+@abstract
+@generateCppClass
+@lowestInstanceTypeWithinParentClassRange
+extern class JSCustomElementsObject extends JSObject {
+}
+
+@abstract
+@generateCppClass
+@lowestInstanceTypeWithinParentClassRange
+extern class JSSpecialObject extends JSCustomElementsObject {
+}
+
+@highestInstanceTypeWithinParentClassRange
+extern class JSFunction extends JSFunctionOrBoundFunction {
+  shared_function_info: SharedFunctionInfo;
+  context: Context;
+  feedback_cell: FeedbackCell;
+  weak code: Code;
+
+  // Space for the following field may or may not be allocated.
+  @noVerifier weak prototype_or_initial_map: JSReceiver|Map;
+}
+
+type JSFunctionWithPrototypeSlot extends JSFunction;
+
+macro GetDerivedMap(implicit context: Context)(
+    target: JSFunction, newTarget: JSReceiver): Map {
+  try {
+    const constructor =
+        Cast<JSFunctionWithPrototypeSlot>(newTarget) otherwise SlowPath;
+    assert(IsConstructor(constructor));
+    const map =
+        Cast<Map>(constructor.prototype_or_initial_map) otherwise SlowPath;
+    if (LoadConstructorOrBackPointer(map) != target) {
+      goto SlowPath;
+    }
+
+    return map;
+  }
+  label SlowPath {
+    return runtime::GetDerivedMap(context, target, newTarget);
+  }
+}
+
+macro AllocateFastOrSlowJSObjectFromMap(implicit context: Context)(map: Map):
+    JSObject {
+  let properties: EmptyFixedArray|NameDictionary = kEmptyFixedArray;
+  if (IsDictionaryMap(map)) {
+    properties = AllocateNameDictionary(kNameDictionaryInitialCapacity);
+  }
+  return AllocateJSObjectFromMap(
+      map, properties, kEmptyFixedArray, AllocationFlag::kNone,
+      SlackTrackingMode::kWithSlackTracking);
+}
+
+@generateCppClass
+extern class JSGlobalProxy extends JSSpecialObject {
+  // [native_context]: the owner native context of this global proxy object.
+  // It is null value if this object is not used by any context.
+  native_context: Object;
+}
+
+extern class JSGlobalObject extends JSSpecialObject {
+  native_context: NativeContext;
+  global_proxy: JSGlobalProxy;
+}
+
+@generateCppClass
+extern class JSPrimitiveWrapper extends JSCustomElementsObject {
+  value: JSAny;
+}
+
+extern class JSMessageObject extends JSObject {
+  // Tagged fields.
+  message_type: Smi;
+  arguments: Object;
+  script: Script;
+  stack_frames: Object;
+  shared_info: SharedFunctionInfo|Undefined;
+
+  // Raw data fields.
+  // TODO(ishell): store as int32 instead of Smi.
+  bytecode_offset: Smi;
+  start_position: Smi;
+  end_position: Smi;
+  error_level: Smi;
+}
+
+@abstract
+@generateCppClass
+@highestInstanceTypeWithinParentClassRange
+extern class JSFunctionOrBoundFunction extends JSObject {
+}
+
+@generateCppClass
+extern class JSBoundFunction extends JSFunctionOrBoundFunction {
+  // The wrapped function object.
+  bound_target_function: Callable;
+  // The value that is always passed as the this value when calling the wrapped
+  // function.
+  bound_this: JSAny|SourceTextModule;
+  // A list of values whose elements are used as the first arguments to any call
+  // to the wrapped function.
+  bound_arguments: FixedArray;
+}
+
+@generateCppClass
+extern class JSDate extends JSObject {
+  // If one component is NaN, all of them are, indicating a NaN time value.
+
+  // The time value.
+  value: NumberOrUndefined;
+
+  // Cached values:
+  year: Undefined|Smi|NaN;
+  month: Undefined|Smi|NaN;
+  day: Undefined|Smi|NaN;
+  weekday: Undefined|Smi|NaN;
+  hour: Undefined|Smi|NaN;
+  min: Undefined|Smi|NaN;
+  sec: Undefined|Smi|NaN;
+
+  // Sample of the date cache stamp at the moment when chached fields were
+  // cached.
+  cache_stamp: Undefined|Smi|NaN;
+}
+
+@generateCppClass
+extern class JSAsyncFromSyncIterator extends JSObject {
+  sync_iterator: JSReceiver;
+  // The "next" method is loaded during GetIterator, and is not reloaded for
+  // subsequent "next" invocations.
+  next: Object;
+}
+
+@generateCppClass
+extern class JSStringIterator extends JSObject {
+  // The [[IteratedString]] slot.
+  string: String;
+  // The [[StringIteratorNextIndex]] slot.
+  index: Smi;
+}
+
+extern macro AllocateJSObjectFromMap(Map): JSObject;
+extern macro AllocateJSObjectFromMap(
+    Map, NameDictionary | EmptyFixedArray | PropertyArray): JSObject;
+extern macro AllocateJSObjectFromMap(
+    Map, NameDictionary | EmptyFixedArray | PropertyArray, FixedArray,
+    constexpr AllocationFlag, constexpr SlackTrackingMode): JSObject;
diff --git a/deps/v8/src/objects/js-plural-rules.h b/deps/v8/src/objects/js-plural-rules.h
index 0303266894ceb5..0b2b91ef2b17f1 100644
--- a/deps/v8/src/objects/js-plural-rules.h
+++ b/deps/v8/src/objects/js-plural-rules.h
@@ -12,6 +12,7 @@
 #include <set>
 #include <string>
 
+#include "src/base/bit-field.h"
 #include "src/execution/isolate.h"
 #include "src/heap/factory.h"
 #include "src/objects/intl-objects.h"
diff --git a/deps/v8/src/objects/js-promise.h b/deps/v8/src/objects/js-promise.h
index 06569a3fcd9c74..66413bb6513c95 100644
--- a/deps/v8/src/objects/js-promise.h
+++ b/deps/v8/src/objects/js-promise.h
@@ -63,17 +63,18 @@ class JSPromise : public TorqueGeneratedJSPromise<JSPromise, JSObject> {
   DECL_VERIFIER(JSPromise)
 
   static const int kSizeWithEmbedderFields =
-      kSize + v8::Promise::kEmbedderFieldCount * kEmbedderDataSlotSize;
+      kHeaderSize + v8::Promise::kEmbedderFieldCount * kEmbedderDataSlotSize;
 
   // Flags layout.
   // The first two bits store the v8::Promise::PromiseState.
   static const int kStatusBits = 2;
   static const int kHasHandlerBit = 2;
   static const int kHandledHintBit = 3;
-  using AsyncTaskIdField = BitField<int, kHandledHintBit + 1, 22>;
+  using AsyncTaskIdField = base::BitField<int, kHandledHintBit + 1, 22>;
 
   static const int kStatusShift = 0;
   static const int kStatusMask = 0x3;
+  static const int kHasHandlerMask = 0x4;
   STATIC_ASSERT(v8::Promise::kPending == 0);
   STATIC_ASSERT(v8::Promise::kFulfilled == 1);
   STATIC_ASSERT(v8::Promise::kRejected == 2);
diff --git a/deps/v8/src/objects/js-promise.tq b/deps/v8/src/objects/js-promise.tq
new file mode 100644
index 00000000000000..515dedcb9b0fec
--- /dev/null
+++ b/deps/v8/src/objects/js-promise.tq
@@ -0,0 +1,41 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// JSPromise constants
+const kJSPromiseStatusMask: constexpr int31
+    generates 'JSPromise::kStatusMask';
+const kJSPromiseStatusShift: constexpr int31
+    generates 'JSPromise::kStatusShift';
+const kJSPromiseHasHandlerMask: constexpr int31
+    generates 'JSPromise::kHasHandlerMask';
+
+@generateCppClass
+extern class JSPromise extends JSObject {
+  macro Status(): PromiseState {
+    StaticAssert(kJSPromiseStatusShift == 0);
+    const status: int32 = Convert<int32>(this.flags) & kJSPromiseStatusMask;
+    return Convert<PromiseState>(status);
+  }
+
+  macro SetStatus(status: constexpr PromiseState): void {
+    assert(this.Status() == PromiseState::kPending);
+    assert(status != PromiseState::kPending);
+
+    const mask: Smi = SmiConstant(status);
+    this.flags = this.flags | mask;
+  }
+
+  macro HasHandler(): bool {
+    return (this.flags & kJSPromiseHasHandlerMask) != 0;
+  }
+
+  macro SetHasHandler(): void {
+    this.flags |= kJSPromiseHasHandlerMask;
+  }
+
+  // Smi 0 terminated list of PromiseReaction objects in case the JSPromise was
+  // not settled yet, otherwise the result.
+  reactions_or_result: Zero|PromiseReaction|JSAny;
+  flags: Smi;
+}
diff --git a/deps/v8/src/objects/js-proxy.tq b/deps/v8/src/objects/js-proxy.tq
new file mode 100644
index 00000000000000..a7d8a12030b081
--- /dev/null
+++ b/deps/v8/src/objects/js-proxy.tq
@@ -0,0 +1,25 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+extern class JSProxy extends JSReceiver {
+  target: JSReceiver|Null;
+  handler: JSReceiver|Null;
+}
+
+extern shape JSProxyRevocableResult extends JSObject {
+  proxy: JSAny;
+  revoke: JSAny;
+}
+
+macro NewJSProxyRevocableResult(implicit context: Context)(
+    proxy: JSProxy, revoke: JSFunction): JSProxyRevocableResult {
+  return new JSProxyRevocableResult{
+    map: GetProxyRevocableResultMap(),
+    properties_or_hash: kEmptyFixedArray,
+    elements: kEmptyFixedArray,
+    proxy,
+    revoke
+  };
+}
diff --git a/deps/v8/src/objects/js-regexp-inl.h b/deps/v8/src/objects/js-regexp-inl.h
index 885bc4804d703c..a6f59468fd2bea 100644
--- a/deps/v8/src/objects/js-regexp-inl.h
+++ b/deps/v8/src/objects/js-regexp-inl.h
@@ -19,18 +19,14 @@ namespace v8 {
 namespace internal {
 
 TQ_OBJECT_CONSTRUCTORS_IMPL(JSRegExp)
-OBJECT_CONSTRUCTORS_IMPL(JSRegExpResult, JSArray)
-OBJECT_CONSTRUCTORS_IMPL(JSRegExpResultIndices, JSArray)
+OBJECT_CONSTRUCTORS_IMPL_CHECK_SUPER(JSRegExpResult, JSArray)
+OBJECT_CONSTRUCTORS_IMPL_CHECK_SUPER(JSRegExpResultIndices, JSArray)
 
 CAST_ACCESSOR(JSRegExpResult)
 CAST_ACCESSOR(JSRegExpResultIndices)
 
 ACCESSORS(JSRegExp, last_index, Object, kLastIndexOffset)
 
-ACCESSORS(JSRegExpResult, cached_indices_or_match_info, Object,
-          kCachedIndicesOrMatchInfoOffset)
-ACCESSORS(JSRegExpResult, names, Object, kNamesOffset)
-
 JSRegExp::Type JSRegExp::TypeTag() const {
   Object data = this->data();
   if (data.IsUndefined()) return JSRegExp::NOT_COMPILED;
diff --git a/deps/v8/src/objects/js-regexp-string-iterator.tq b/deps/v8/src/objects/js-regexp-string-iterator.tq
new file mode 100644
index 00000000000000..3ab1679699c9f0
--- /dev/null
+++ b/deps/v8/src/objects/js-regexp-string-iterator.tq
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+extern class JSRegExpStringIterator extends JSObject {
+  // The [[IteratingRegExp]] internal property.
+  iterating_reg_exp: JSReceiver;
+  // The [[IteratedString]] internal property.
+  iterated_string: String;
+  flags: Smi;
+}
diff --git a/deps/v8/src/objects/js-regexp.cc b/deps/v8/src/objects/js-regexp.cc
index c7f96fe278c065..e800dae5c0f514 100644
--- a/deps/v8/src/objects/js-regexp.cc
+++ b/deps/v8/src/objects/js-regexp.cc
@@ -6,32 +6,80 @@
 
 #include "src/objects/js-array-inl.h"
 #include "src/objects/js-regexp-inl.h"
+#include "src/regexp/regexp.h"
 
 namespace v8 {
 namespace internal {
-Handle<JSArray> JSRegExpResult::GetAndCacheIndices(
+MaybeHandle<JSArray> JSRegExpResult::GetAndCacheIndices(
     Isolate* isolate, Handle<JSRegExpResult> regexp_result) {
-  // Check for cached indices.
-  Handle<Object> indices_or_match_info(
-      regexp_result->cached_indices_or_match_info(), isolate);
-  if (indices_or_match_info->IsRegExpMatchInfo()) {
+  // Check for cached indices. We do a slow lookup and set of
+  // the cached_indices_or_match_info and names fields just in
+  // case they have been migrated to dictionaries.
+  Handle<Object> indices_or_regexp(
+      GetProperty(
+          isolate, regexp_result,
+          isolate->factory()->regexp_result_cached_indices_or_regexp_symbol())
+          .ToHandleChecked());
+  if (indices_or_regexp->IsJSRegExp()) {
     // Build and cache indices for next lookup.
     // TODO(joshualitt): Instead of caching the indices, we could call
     // ReconfigureToDataProperty on 'indices' setting its value to this
     // newly created array. However, care would have to be taken to ensure
     // a new map is not created each time.
-    Handle<RegExpMatchInfo> match_info(
-        RegExpMatchInfo::cast(regexp_result->cached_indices_or_match_info()),
-        isolate);
-    Handle<Object> maybe_names(regexp_result->names(), isolate);
-    indices_or_match_info =
+
+    // Grab regexp, its last_index, and the original subject string from the
+    // result and the re-execute the regexp to generate a new MatchInfo.
+    Handle<JSRegExp> regexp(JSRegExp::cast(*indices_or_regexp), isolate);
+    Handle<Object> input_object(
+        GetProperty(isolate, regexp_result,
+                    isolate->factory()->regexp_result_regexp_input_symbol())
+            .ToHandleChecked());
+    Handle<String> subject(String::cast(*input_object), isolate);
+    Handle<Object> last_index_object(
+        GetProperty(
+            isolate, regexp_result,
+            isolate->factory()->regexp_result_regexp_last_index_symbol())
+            .ToHandleChecked());
+
+    int capture_count = regexp->CaptureCount();
+    Handle<RegExpMatchInfo> match_info =
+        RegExpMatchInfo::New(isolate, capture_count);
+
+    int last_index = Smi::ToInt(*last_index_object);
+    Handle<Object> result;
+    ASSIGN_RETURN_ON_EXCEPTION(
+        isolate, result,
+        RegExp::Exec(isolate, regexp, subject, last_index, match_info),
+        JSArray);
+    DCHECK_EQ(*result, *match_info);
+
+    Handle<Object> maybe_names(
+        GetProperty(isolate, regexp_result,
+                    isolate->factory()->regexp_result_names_symbol())
+            .ToHandleChecked());
+    indices_or_regexp =
         JSRegExpResultIndices::BuildIndices(isolate, match_info, maybe_names);
 
-    // Cache the result and clear the names array.
-    regexp_result->set_cached_indices_or_match_info(*indices_or_match_info);
-    regexp_result->set_names(ReadOnlyRoots(isolate).undefined_value());
+    // Cache the result and clear the names array, last_index and subject.
+    SetProperty(
+        isolate, regexp_result,
+        isolate->factory()->regexp_result_cached_indices_or_regexp_symbol(),
+        indices_or_regexp)
+        .ToHandleChecked();
+    SetProperty(isolate, regexp_result,
+                isolate->factory()->regexp_result_names_symbol(),
+                isolate->factory()->undefined_value())
+        .ToHandleChecked();
+    SetProperty(isolate, regexp_result,
+                isolate->factory()->regexp_result_regexp_last_index_symbol(),
+                isolate->factory()->undefined_value())
+        .ToHandleChecked();
+    SetProperty(isolate, regexp_result,
+                isolate->factory()->regexp_result_regexp_input_symbol(),
+                isolate->factory()->undefined_value())
+        .ToHandleChecked();
   }
-  return Handle<JSArray>::cast(indices_or_match_info);
+  return Handle<JSArray>::cast(indices_or_regexp);
 }
 
 Handle<JSRegExpResultIndices> JSRegExpResultIndices::BuildIndices(
@@ -43,7 +91,7 @@ Handle<JSRegExpResultIndices> JSRegExpResultIndices::BuildIndices(
 
   // Initialize indices length to avoid having a partially initialized object
   // should GC be triggered by creating a NewFixedArray.
-  indices->set_length(Smi::kZero);
+  indices->set_length(Smi::zero());
 
   // Build indices array from RegExpMatchInfo.
   int num_indices = match_info->NumberOfCaptureRegisters();
@@ -114,5 +162,10 @@ Handle<JSRegExpResultIndices> JSRegExpResultIndices::BuildIndices(
   return indices;
 }
 
+uint32_t JSRegExp::BacktrackLimit() const {
+  CHECK_EQ(TypeTag(), IRREGEXP);
+  return static_cast<uint32_t>(Smi::ToInt(DataAt(kIrregexpBacktrackLimit)));
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/js-regexp.h b/deps/v8/src/objects/js-regexp.h
index 03efd4913c0b53..07236e5ba8fcc7 100644
--- a/deps/v8/src/objects/js-regexp.h
+++ b/deps/v8/src/objects/js-regexp.h
@@ -84,17 +84,24 @@ class JSRegExp : public TorqueGeneratedJSRegExp<JSRegExp, JSObject> {
 
   DECL_ACCESSORS(last_index, Object)
 
-  V8_EXPORT_PRIVATE static MaybeHandle<JSRegExp> New(Isolate* isolate,
-                                                     Handle<String> source,
-                                                     Flags flags);
+  // If the backtrack limit is set to this marker value, no limit is applied.
+  static constexpr uint32_t kNoBacktrackLimit = 0;
+
+  V8_EXPORT_PRIVATE static MaybeHandle<JSRegExp> New(
+      Isolate* isolate, Handle<String> source, Flags flags,
+      uint32_t backtrack_limit = kNoBacktrackLimit);
   static Handle<JSRegExp> Copy(Handle<JSRegExp> regexp);
 
-  static MaybeHandle<JSRegExp> Initialize(Handle<JSRegExp> regexp,
-                                          Handle<String> source, Flags flags);
+  static MaybeHandle<JSRegExp> Initialize(
+      Handle<JSRegExp> regexp, Handle<String> source, Flags flags,
+      uint32_t backtrack_limit = kNoBacktrackLimit);
   static MaybeHandle<JSRegExp> Initialize(Handle<JSRegExp> regexp,
                                           Handle<String> source,
                                           Handle<String> flags_string);
 
+  static Flags FlagsFromString(Isolate* isolate, Handle<String> flags,
+                               bool* success);
+
   bool MarkedForTierUp();
   void ResetLastTierUpTick();
   void TierUpTick();
@@ -131,13 +138,15 @@ class JSRegExp : public TorqueGeneratedJSRegExp<JSRegExp, JSObject> {
   inline bool HasCompiledCode() const;
   inline void DiscardCompiledCodeForSerialization();
 
+  uint32_t BacktrackLimit() const;
+
   // Dispatched behavior.
   DECL_PRINTER(JSRegExp)
   DECL_VERIFIER(JSRegExp)
 
   /* This is already an in-object field. */
   // TODO(v8:8944): improve handling of in-object fields
-  static constexpr int kLastIndexOffset = kSize;
+  static constexpr int kLastIndexOffset = kHeaderSize;
 
   // Indices in the data array.
   static const int kTagIndex = 0;
@@ -182,8 +191,11 @@ class JSRegExp : public TorqueGeneratedJSRegExp<JSRegExp, JSObject> {
   // happens once the ticks reach zero.
   // This value is ignored if the regexp-tier-up flag isn't turned on.
   static const int kIrregexpTicksUntilTierUpIndex = kDataIndex + 7;
-
-  static const int kIrregexpDataSize = kIrregexpTicksUntilTierUpIndex + 1;
+  // A smi containing either the backtracking limit or kNoBacktrackLimit.
+  // TODO(jgruber): If needed, this limit could be packed into other fields
+  // above to save space.
+  static const int kIrregexpBacktrackLimit = kDataIndex + 8;
+  static const int kIrregexpDataSize = kDataIndex + 9;
 
   // In-object fields.
   static const int kLastIndexFieldIndex = 0;
@@ -223,16 +235,11 @@ class JSRegExpResult : public JSArray {
   // JSRegExpResult, and maybe JSRegExpResultIndices, but both have the same
   // instance type as JSArray.
 
-  // cached_indices_or_match_info and names, are used to construct the
-  // JSRegExpResultIndices returned from the indices property lazily.
-  DECL_ACCESSORS(cached_indices_or_match_info, Object)
-  DECL_ACCESSORS(names, Object)
-
   // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSArray::kSize,
+  DEFINE_FIELD_OFFSET_CONSTANTS(JSArray::kHeaderSize,
                                 TORQUE_GENERATED_JS_REG_EXP_RESULT_FIELDS)
 
-  static Handle<JSArray> GetAndCacheIndices(
+  static MaybeHandle<JSArray> GetAndCacheIndices(
       Isolate* isolate, Handle<JSRegExpResult> regexp_result);
 
   // Indices of in-object properties.
@@ -241,9 +248,11 @@ class JSRegExpResult : public JSArray {
   static const int kGroupsIndex = 2;
 
   // Private internal only fields.
-  static const int kCachedIndicesOrMatchInfoIndex = 3;
+  static const int kCachedIndicesOrRegExpIndex = 3;
   static const int kNamesIndex = 4;
-  static const int kInObjectPropertyCount = 5;
+  static const int kRegExpInputIndex = 5;
+  static const int kRegExpLastIndex = 6;
+  static const int kInObjectPropertyCount = 7;
 
   OBJECT_CONSTRUCTORS(JSRegExpResult, JSArray);
 };
@@ -260,7 +269,7 @@ class JSRegExpResultIndices : public JSArray {
 
   // Layout description.
   DEFINE_FIELD_OFFSET_CONSTANTS(
-      JSArray::kSize, TORQUE_GENERATED_JS_REG_EXP_RESULT_INDICES_FIELDS)
+      JSArray::kHeaderSize, TORQUE_GENERATED_JS_REG_EXP_RESULT_INDICES_FIELDS)
 
   static Handle<JSRegExpResultIndices> BuildIndices(
       Isolate* isolate, Handle<RegExpMatchInfo> match_info,
diff --git a/deps/v8/src/objects/js-regexp.tq b/deps/v8/src/objects/js-regexp.tq
new file mode 100644
index 00000000000000..f2e216f282dd35
--- /dev/null
+++ b/deps/v8/src/objects/js-regexp.tq
@@ -0,0 +1,45 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+extern class JSRegExp extends JSObject {
+  data: FixedArray|Undefined;
+  source: String|Undefined;
+  flags: Smi|Undefined;
+}
+
+// Note: Although a condition for a FastJSRegExp is having a positive smi
+// lastIndex (see RegExpBuiltinsAssembler::BranchIfFastRegExp), it is possible
+// for this to change without transitioning the transient type. As a precaution,
+// validate the lastIndex is positive smi when used in fast paths.
+transient type FastJSRegExp extends JSRegExp;
+
+extern operator '.global' macro
+RegExpBuiltinsAssembler::FastFlagGetterGlobal(FastJSRegExp): bool;
+extern operator '.unicode' macro
+RegExpBuiltinsAssembler::FastFlagGetterUnicode(FastJSRegExp): bool;
+extern operator '.lastIndex' macro
+RegExpBuiltinsAssembler::FastLoadLastIndex(FastJSRegExp): Smi;
+extern operator '.lastIndex=' macro
+RegExpBuiltinsAssembler::FastStoreLastIndex(FastJSRegExp, Smi): void;
+
+extern shape JSRegExpResult extends JSArray {
+  // In-object properties:
+  // The below fields are externally exposed.
+  index: JSAny;
+  input: JSAny;
+  groups: JSAny;
+
+  // The below fields are for internal use only.
+  cached_indices_or_regexp: JSRegExpResultIndices|JSRegExp;
+  names: FixedArray|Undefined;
+  regexp_input: String;
+  regexp_last_index: Smi;
+}
+
+extern shape JSRegExpResultIndices extends JSArray {
+  // In-object properties:
+  // The groups field is externally exposed.
+  groups: JSAny;
+}
diff --git a/deps/v8/src/objects/js-relative-time-format-inl.h b/deps/v8/src/objects/js-relative-time-format-inl.h
index fac3439b31f75a..1ac0e4733e9bf4 100644
--- a/deps/v8/src/objects/js-relative-time-format-inl.h
+++ b/deps/v8/src/objects/js-relative-time-format-inl.h
@@ -22,6 +22,7 @@ OBJECT_CONSTRUCTORS_IMPL(JSRelativeTimeFormat, JSObject)
 
 // Base relative time format accessors.
 ACCESSORS(JSRelativeTimeFormat, locale, String, kLocaleOffset)
+ACCESSORS(JSRelativeTimeFormat, numberingSystem, String, kNumberingSystemOffset)
 ACCESSORS(JSRelativeTimeFormat, icu_formatter,
           Managed<icu::RelativeDateTimeFormatter>, kIcuFormatterOffset)
 SMI_ACCESSORS(JSRelativeTimeFormat, flags, kFlagsOffset)
diff --git a/deps/v8/src/objects/js-relative-time-format.cc b/deps/v8/src/objects/js-relative-time-format.cc
index edf3e26c2250c3..8768560c39fcaa 100644
--- a/deps/v8/src/objects/js-relative-time-format.cc
+++ b/deps/v8/src/objects/js-relative-time-format.cc
@@ -107,24 +107,38 @@ MaybeHandle<JSRelativeTimeFormat> JSRelativeTimeFormat::New(
       Intl::ResolveLocale(isolate, JSRelativeTimeFormat::GetAvailableLocales(),
                           requested_locales, matcher, {"nu"});
 
+  UErrorCode status = U_ZERO_ERROR;
+
+  icu::Locale icu_locale = r.icu_locale;
+  if (numbering_system_str != nullptr) {
+    auto nu_extension_it = r.extensions.find("nu");
+    if (nu_extension_it != r.extensions.end() &&
+        nu_extension_it->second != numbering_system_str.get()) {
+      icu_locale.setUnicodeKeywordValue("nu", nullptr, status);
+      CHECK(U_SUCCESS(status));
+    }
+  }
   // 12. Let locale be r.[[Locale]].
+  Maybe<std::string> maybe_locale_str = Intl::ToLanguageTag(icu_locale);
+  MAYBE_RETURN(maybe_locale_str, MaybeHandle<JSRelativeTimeFormat>());
+
   // 13. Set relativeTimeFormat.[[Locale]] to locale.
-  // 14. Let dataLocale be r.[[DataLocale]].
-  icu::Locale icu_locale = r.icu_locale;
-  UErrorCode status = U_ZERO_ERROR;
+  Handle<String> locale_str = isolate->factory()->NewStringFromAsciiChecked(
+      maybe_locale_str.FromJust().c_str());
+
+  // 14. Set relativeTimeFormat.[[NumberingSystem]] to r.[[nu]].
   if (numbering_system_str != nullptr &&
       Intl::IsValidNumberingSystem(numbering_system_str.get())) {
     icu_locale.setUnicodeKeywordValue("nu", numbering_system_str.get(), status);
     CHECK(U_SUCCESS(status));
   }
+  Handle<String> numbering_system_string =
+      isolate->factory()->NewStringFromAsciiChecked(
+          Intl::GetNumberingSystem(icu_locale).c_str());
 
-  Maybe<std::string> maybe_locale_str = Intl::ToLanguageTag(icu_locale);
-  MAYBE_RETURN(maybe_locale_str, MaybeHandle<JSRelativeTimeFormat>());
-
-  Handle<String> locale_str = isolate->factory()->NewStringFromAsciiChecked(
-      maybe_locale_str.FromJust().c_str());
+  // 15. Let dataLocale be r.[[DataLocale]].
 
-  // 15. Let s be ? GetOption(options, "style", "string",
+  // 16. Let s be ? GetOption(options, "style", "string",
   //                          «"long", "short", "narrow"», "long").
   Maybe<Style> maybe_style = Intl::GetStringOption<Style>(
       isolate, options, "style", "Intl.RelativeTimeFormat",
@@ -133,7 +147,9 @@ MaybeHandle<JSRelativeTimeFormat> JSRelativeTimeFormat::New(
   MAYBE_RETURN(maybe_style, MaybeHandle<JSRelativeTimeFormat>());
   Style style_enum = maybe_style.FromJust();
 
-  // 17. Let numeric be ? GetOption(options, "numeric", "string",
+  // 17. Set relativeTimeFormat.[[Style]] to s.
+
+  // 18. Let numeric be ? GetOption(options, "numeric", "string",
   //                                «"always", "auto"», "always").
   Maybe<Numeric> maybe_numeric = Intl::GetStringOption<Numeric>(
       isolate, options, "numeric", "Intl.RelativeTimeFormat",
@@ -141,7 +157,9 @@ MaybeHandle<JSRelativeTimeFormat> JSRelativeTimeFormat::New(
   MAYBE_RETURN(maybe_numeric, MaybeHandle<JSRelativeTimeFormat>());
   Numeric numeric_enum = maybe_numeric.FromJust();
 
-  // 19. Let relativeTimeFormat.[[NumberFormat]] be
+  // 19. Set relativeTimeFormat.[[Numeric]] to numeric.
+
+  // 23. Let relativeTimeFormat.[[NumberFormat]] be
   //     ? Construct(%NumberFormat%, « nfLocale, nfOptions »).
   icu::NumberFormat* number_format =
       icu::NumberFormat::createInstance(icu_locale, UNUM_DECIMAL, status);
@@ -170,25 +188,18 @@ MaybeHandle<JSRelativeTimeFormat> JSRelativeTimeFormat::New(
       Managed<icu::RelativeDateTimeFormatter>::FromRawPtr(isolate, 0,
                                                           icu_formatter);
 
-  // Now all properties are ready, so we can allocate the result object.
   Handle<JSRelativeTimeFormat> relative_time_format_holder =
       Handle<JSRelativeTimeFormat>::cast(
           isolate->factory()->NewFastOrSlowJSObjectFromMap(map));
   DisallowHeapAllocation no_gc;
   relative_time_format_holder->set_flags(0);
-
   relative_time_format_holder->set_locale(*locale_str);
-
-  // 16. Set relativeTimeFormat.[[Style]] to s.
+  relative_time_format_holder->set_numberingSystem(*numbering_system_string);
   relative_time_format_holder->set_style(style_enum);
-
-  // 18. Set relativeTimeFormat.[[Numeric]] to numeric.
   relative_time_format_holder->set_numeric(numeric_enum);
-
-  // 21. Set relativeTimeFormat.[[InitializedRelativeTimeFormat]] to true.
   relative_time_format_holder->set_icu_formatter(*managed_formatter);
 
-  // 22. Return relativeTimeFormat.
+  // 25. Return relativeTimeFormat.
   return relative_time_format_holder;
 }
 
@@ -197,18 +208,15 @@ Handle<JSObject> JSRelativeTimeFormat::ResolvedOptions(
   Factory* factory = isolate->factory();
   Handle<JSObject> result = factory->NewJSObject(isolate->object_function());
   Handle<String> locale(format_holder->locale(), isolate);
+  Handle<String> numberingSystem(format_holder->numberingSystem(), isolate);
   JSObject::AddProperty(isolate, result, factory->locale_string(), locale,
                         NONE);
   JSObject::AddProperty(isolate, result, factory->style_string(),
                         format_holder->StyleAsString(), NONE);
   JSObject::AddProperty(isolate, result, factory->numeric_string(),
                         format_holder->NumericAsString(), NONE);
-  std::string locale_str(format_holder->locale().ToCString().get());
-  icu::Locale icu_locale = Intl::CreateICULocale(locale_str);
-  std::string numbering_system = Intl::GetNumberingSystem(icu_locale);
-  JSObject::AddProperty(
-      isolate, result, factory->numberingSystem_string(),
-      factory->NewStringFromAsciiChecked(numbering_system.c_str()), NONE);
+  JSObject::AddProperty(isolate, result, factory->numberingSystem_string(),
+                        numberingSystem, NONE);
   return result;
 }
 
diff --git a/deps/v8/src/objects/js-relative-time-format.h b/deps/v8/src/objects/js-relative-time-format.h
index c642367988523c..99d09e5c3c89d9 100644
--- a/deps/v8/src/objects/js-relative-time-format.h
+++ b/deps/v8/src/objects/js-relative-time-format.h
@@ -12,6 +12,7 @@
 #include <set>
 #include <string>
 
+#include "src/base/bit-field.h"
 #include "src/execution/isolate.h"
 #include "src/heap/factory.h"
 #include "src/objects/managed.h"
@@ -58,6 +59,7 @@ class JSRelativeTimeFormat : public JSObject {
 
   // RelativeTimeFormat accessors.
   DECL_ACCESSORS(locale, String)
+  DECL_ACCESSORS(numberingSystem, String)
 
   DECL_ACCESSORS(icu_formatter, Managed<icu::RelativeDateTimeFormatter>)
 
diff --git a/deps/v8/src/objects/js-segment-iterator.h b/deps/v8/src/objects/js-segment-iterator.h
index 1c71af886495d4..01fc268298f941 100644
--- a/deps/v8/src/objects/js-segment-iterator.h
+++ b/deps/v8/src/objects/js-segment-iterator.h
@@ -9,6 +9,7 @@
 #ifndef V8_OBJECTS_JS_SEGMENT_ITERATOR_H_
 #define V8_OBJECTS_JS_SEGMENT_ITERATOR_H_
 
+#include "src/base/bit-field.h"
 #include "src/execution/isolate.h"
 #include "src/heap/factory.h"
 #include "src/objects/js-segmenter.h"
diff --git a/deps/v8/src/objects/js-segmenter.h b/deps/v8/src/objects/js-segmenter.h
index 209c4682b37fe1..b683e95bf17209 100644
--- a/deps/v8/src/objects/js-segmenter.h
+++ b/deps/v8/src/objects/js-segmenter.h
@@ -12,6 +12,7 @@
 #include <set>
 #include <string>
 
+#include "src/base/bit-field.h"
 #include "src/execution/isolate.h"
 #include "src/heap/factory.h"
 #include "src/objects/managed.h"
diff --git a/deps/v8/src/objects/js-weak-refs-inl.h b/deps/v8/src/objects/js-weak-refs-inl.h
index 06351536112bd4..477b88cdd14ca2 100644
--- a/deps/v8/src/objects/js-weak-refs-inl.h
+++ b/deps/v8/src/objects/js-weak-refs-inl.h
@@ -34,14 +34,15 @@ CAST_ACCESSOR(JSFinalizationGroup)
 
 void JSFinalizationGroup::Register(
     Handle<JSFinalizationGroup> finalization_group, Handle<JSReceiver> target,
-    Handle<Object> holdings, Handle<Object> key, Isolate* isolate) {
+    Handle<Object> holdings, Handle<Object> unregister_token,
+    Isolate* isolate) {
   Handle<WeakCell> weak_cell = isolate->factory()->NewWeakCell();
   weak_cell->set_finalization_group(*finalization_group);
   weak_cell->set_target(*target);
   weak_cell->set_holdings(*holdings);
   weak_cell->set_prev(ReadOnlyRoots(isolate).undefined_value());
   weak_cell->set_next(ReadOnlyRoots(isolate).undefined_value());
-  weak_cell->set_key(*key);
+  weak_cell->set_unregister_token(*unregister_token);
   weak_cell->set_key_list_prev(ReadOnlyRoots(isolate).undefined_value());
   weak_cell->set_key_list_next(ReadOnlyRoots(isolate).undefined_value());
 
@@ -52,24 +53,27 @@ void JSFinalizationGroup::Register(
   }
   finalization_group->set_active_cells(*weak_cell);
 
-  if (!key->IsUndefined(isolate)) {
-    Handle<ObjectHashTable> key_map;
+  if (!unregister_token->IsUndefined(isolate)) {
+    Handle<SimpleNumberDictionary> key_map;
     if (finalization_group->key_map().IsUndefined(isolate)) {
-      key_map = ObjectHashTable::New(isolate, 1);
+      key_map = SimpleNumberDictionary::New(isolate, 1);
     } else {
-      key_map =
-          handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
+      key_map = handle(
+          SimpleNumberDictionary::cast(finalization_group->key_map()), isolate);
     }
 
-    Object value = key_map->Lookup(key);
-    if (value.IsWeakCell()) {
+    // Unregister tokens are held weakly as objects are often their own
+    // unregister token. To avoid using an ephemeron map, the map for token
+    // lookup is keyed on the token's identity hash instead of the token itself.
+    uint32_t key = unregister_token->GetOrCreateHash(isolate).value();
+    InternalIndex entry = key_map->FindEntry(isolate, key);
+    if (entry.is_found()) {
+      Object value = key_map->ValueAt(entry);
       WeakCell existing_weak_cell = WeakCell::cast(value);
       existing_weak_cell.set_key_list_prev(*weak_cell);
       weak_cell->set_key_list_next(existing_weak_cell);
-    } else {
-      DCHECK(value.IsTheHole(isolate));
     }
-    key_map = ObjectHashTable::Put(key_map, key, weak_cell);
+    key_map = SimpleNumberDictionary::Set(isolate, key_map, key, weak_cell);
     finalization_group->set_key_map(*key_map);
   }
 }
@@ -80,26 +84,89 @@ bool JSFinalizationGroup::Unregister(
   // Iterate through the doubly linked list of WeakCells associated with the
   // key. Each WeakCell will be in the "active_cells" or "cleared_cells" list of
   // its FinalizationGroup; remove it from there.
-  if (!finalization_group->key_map().IsUndefined(isolate)) {
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    Object value = key_map->Lookup(unregister_token);
-    HeapObject undefined = ReadOnlyRoots(isolate).undefined_value();
-    while (value.IsWeakCell()) {
-      WeakCell weak_cell = WeakCell::cast(value);
-      weak_cell.RemoveFromFinalizationGroupCells(isolate);
-      value = weak_cell.key_list_next();
+  return finalization_group->RemoveUnregisterToken(
+      *unregister_token, isolate,
+      [isolate](WeakCell matched_cell) {
+        matched_cell.RemoveFromFinalizationGroupCells(isolate);
+      },
+      [](HeapObject, ObjectSlot, Object) {});
+}
+
+template <typename MatchCallback, typename GCNotifyUpdatedSlotCallback>
+bool JSFinalizationGroup::RemoveUnregisterToken(
+    JSReceiver unregister_token, Isolate* isolate, MatchCallback match_callback,
+    GCNotifyUpdatedSlotCallback gc_notify_updated_slot) {
+  // This method is called from both FinalizationGroup#unregister and for
+  // removing weakly-held dead unregister tokens. The latter is during GC so
+  // this function cannot GC.
+  DisallowHeapAllocation no_gc;
+  if (key_map().IsUndefined(isolate)) {
+    return false;
+  }
+
+  SimpleNumberDictionary key_map =
+      SimpleNumberDictionary::cast(this->key_map());
+  // If the token doesn't have a hash, it was not used as a key inside any hash
+  // tables.
+  Object hash = unregister_token.GetHash();
+  if (hash.IsUndefined(isolate)) {
+    return false;
+  }
+  uint32_t key = Smi::ToInt(hash);
+  InternalIndex entry = key_map.FindEntry(isolate, key);
+  if (entry.is_not_found()) {
+    return false;
+  }
+
+  Object value = key_map.ValueAt(entry);
+  bool was_present = false;
+  HeapObject undefined = ReadOnlyRoots(isolate).undefined_value();
+  HeapObject new_key_list_head = undefined;
+  HeapObject new_key_list_prev = undefined;
+  // Compute a new key list that doesn't have unregister_token. Because
+  // unregister tokens are held weakly, key_map is keyed using the tokens'
+  // identity hashes, and identity hashes may collide.
+  while (!value.IsUndefined(isolate)) {
+    WeakCell weak_cell = WeakCell::cast(value);
+    DCHECK(!ObjectInYoungGeneration(weak_cell));
+    value = weak_cell.key_list_next();
+    if (weak_cell.unregister_token() == unregister_token) {
+      // weak_cell has the same unregister token; remove it from the key list.
+      match_callback(weak_cell);
       weak_cell.set_key_list_prev(undefined);
       weak_cell.set_key_list_next(undefined);
+      was_present = true;
+    } else {
+      // weak_cell has a different unregister token with the same key (hash
+      // collision); fix up the list.
+      weak_cell.set_key_list_prev(new_key_list_prev);
+      gc_notify_updated_slot(weak_cell,
+                             weak_cell.RawField(WeakCell::kKeyListPrevOffset),
+                             new_key_list_prev);
+      weak_cell.set_key_list_next(undefined);
+      if (new_key_list_prev.IsUndefined(isolate)) {
+        new_key_list_head = weak_cell;
+      } else {
+        DCHECK(new_key_list_head.IsWeakCell());
+        WeakCell prev_cell = WeakCell::cast(new_key_list_prev);
+        prev_cell.set_key_list_next(weak_cell);
+        gc_notify_updated_slot(prev_cell,
+                               prev_cell.RawField(WeakCell::kKeyListNextOffset),
+                               weak_cell);
+      }
+      new_key_list_prev = weak_cell;
     }
-    bool was_present;
-    key_map = ObjectHashTable::Remove(isolate, key_map, unregister_token,
-                                      &was_present);
-    finalization_group->set_key_map(*key_map);
-    return was_present;
   }
-
-  return false;
+  if (new_key_list_head.IsUndefined(isolate)) {
+    DCHECK(was_present);
+    key_map.ClearEntry(isolate, entry);
+    key_map.ElementRemoved();
+  } else {
+    key_map.ValueAtPut(entry, new_key_list_head);
+    gc_notify_updated_slot(key_map, key_map.RawFieldOfValueAt(entry),
+                           new_key_list_head);
+  }
+  return was_present;
 }
 
 bool JSFinalizationGroup::NeedsCleanup() const {
@@ -133,31 +200,32 @@ Object JSFinalizationGroup::PopClearedCellHoldings(
   }
 
   // Also remove the WeakCell from the key_map (if it's there).
-  if (!weak_cell->key().IsUndefined(isolate)) {
-    if (weak_cell->key_list_prev().IsUndefined(isolate) &&
-        weak_cell->key_list_next().IsUndefined(isolate)) {
-      // weak_cell is the only one associated with its key; remove the key
-      // from the hash table.
-      Handle<ObjectHashTable> key_map =
-          handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-      Handle<Object> key = handle(weak_cell->key(), isolate);
-      bool was_present;
-      key_map = ObjectHashTable::Remove(isolate, key_map, key, &was_present);
-      DCHECK(was_present);
-      finalization_group->set_key_map(*key_map);
-    } else if (weak_cell->key_list_prev().IsUndefined()) {
-      // weak_cell is the list head for its key; we need to change the value of
-      // the key in the hash table.
-      Handle<ObjectHashTable> key_map =
-          handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-      Handle<Object> key = handle(weak_cell->key(), isolate);
-      Handle<WeakCell> next =
-          handle(WeakCell::cast(weak_cell->key_list_next()), isolate);
-      DCHECK_EQ(next->key_list_prev(), *weak_cell);
-      next->set_key_list_prev(ReadOnlyRoots(isolate).undefined_value());
-      weak_cell->set_key_list_next(ReadOnlyRoots(isolate).undefined_value());
-      key_map = ObjectHashTable::Put(key_map, key, next);
-      finalization_group->set_key_map(*key_map);
+  if (!weak_cell->unregister_token().IsUndefined(isolate)) {
+    if (weak_cell->key_list_prev().IsUndefined(isolate)) {
+      Handle<SimpleNumberDictionary> key_map = handle(
+          SimpleNumberDictionary::cast(finalization_group->key_map()), isolate);
+      Handle<Object> unregister_token =
+          handle(weak_cell->unregister_token(), isolate);
+      uint32_t key = Smi::ToInt(unregister_token->GetHash());
+      InternalIndex entry = key_map->FindEntry(isolate, key);
+
+      if (weak_cell->key_list_next().IsUndefined(isolate)) {
+        // weak_cell is the only one associated with its key; remove the key
+        // from the hash table.
+        DCHECK(entry.is_found());
+        key_map = SimpleNumberDictionary::DeleteEntry(isolate, key_map, entry);
+        finalization_group->set_key_map(*key_map);
+      } else {
+        // weak_cell is the list head for its key; we need to change the value
+        // of the key in the hash table.
+        Handle<WeakCell> next =
+            handle(WeakCell::cast(weak_cell->key_list_next()), isolate);
+        DCHECK_EQ(next->key_list_prev(), *weak_cell);
+        next->set_key_list_prev(ReadOnlyRoots(isolate).undefined_value());
+        weak_cell->set_key_list_next(ReadOnlyRoots(isolate).undefined_value());
+        key_map = SimpleNumberDictionary::Set(isolate, key_map, key, next);
+        finalization_group->set_key_map(*key_map);
+      }
     } else {
       // weak_cell is somewhere in the middle of its key list.
       WeakCell prev = WeakCell::cast(weak_cell->key_list_prev());
@@ -172,10 +240,9 @@ Object JSFinalizationGroup::PopClearedCellHoldings(
   return weak_cell->holdings();
 }
 
-void WeakCell::Nullify(
-    Isolate* isolate,
-    std::function<void(HeapObject object, ObjectSlot slot, Object target)>
-        gc_notify_updated_slot) {
+template <typename GCNotifyUpdatedSlotCallback>
+void WeakCell::Nullify(Isolate* isolate,
+                       GCNotifyUpdatedSlotCallback gc_notify_updated_slot) {
   // Remove from the WeakCell from the "active_cells" list of its
   // JSFinalizationGroup and insert it into the "cleared_cells" list. This is
   // only called for WeakCells which haven't been unregistered yet, so they will
diff --git a/deps/v8/src/objects/js-weak-refs.h b/deps/v8/src/objects/js-weak-refs.h
index 8d61b125a1ffd7..0b18240e707a68 100644
--- a/deps/v8/src/objects/js-weak-refs.h
+++ b/deps/v8/src/objects/js-weak-refs.h
@@ -45,6 +45,16 @@ class JSFinalizationGroup : public JSObject {
                                 Handle<JSReceiver> unregister_token,
                                 Isolate* isolate);
 
+  // RemoveUnregisterToken is called from both Unregister and during GC. Since
+  // it modifies slots in key_map and WeakCells and the normal write barrier is
+  // disabled during GC, we need to tell the GC about the modified slots via the
+  // gc_notify_updated_slot function.
+  template <typename MatchCallback, typename GCNotifyUpdatedSlotCallback>
+  inline bool RemoveUnregisterToken(
+      JSReceiver unregister_token, Isolate* isolate,
+      MatchCallback match_callback,
+      GCNotifyUpdatedSlotCallback gc_notify_updated_slot);
+
   // Returns true if the cleared_cells list is non-empty.
   inline bool NeedsCleanup() const;
 
@@ -69,7 +79,7 @@ class JSFinalizationGroup : public JSObject {
                                 TORQUE_GENERATED_JS_FINALIZATION_GROUP_FIELDS)
 
   // Bitfields in flags.
-  using ScheduledForCleanupField = BitField<bool, 0, 1>;
+  using ScheduledForCleanupField = base::BitField<bool, 0, 1>;
 
   OBJECT_CONSTRUCTORS(JSFinalizationGroup, JSObject);
 };
@@ -86,10 +96,9 @@ class WeakCell : public TorqueGeneratedWeakCell<WeakCell, HeapObject> {
   // JSFinalizationGroup. Thus we need to tell the GC about the modified slots
   // via the gc_notify_updated_slot function. The normal write barrier is not
   // enough, since it's disabled before GC.
-  inline void Nullify(
-      Isolate* isolate,
-      std::function<void(HeapObject object, ObjectSlot slot, Object target)>
-          gc_notify_updated_slot);
+  template <typename GCNotifyUpdatedSlotCallback>
+  inline void Nullify(Isolate* isolate,
+                      GCNotifyUpdatedSlotCallback gc_notify_updated_slot);
 
   inline void RemoveFromFinalizationGroupCells(Isolate* isolate);
 
diff --git a/deps/v8/src/objects/js-weak-refs.tq b/deps/v8/src/objects/js-weak-refs.tq
new file mode 100644
index 00000000000000..879ee6024fe32e
--- /dev/null
+++ b/deps/v8/src/objects/js-weak-refs.tq
@@ -0,0 +1,45 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class JSFinalizationGroup extends JSObject {
+  native_context: NativeContext;
+  cleanup: Object;
+  active_cells: Undefined|WeakCell;
+  cleared_cells: Undefined|WeakCell;
+  key_map: Object;
+  next: Undefined|JSFinalizationGroup;
+  flags: Smi;
+}
+
+@generateCppClass
+extern class JSFinalizationGroupCleanupIterator extends JSObject {
+  finalization_group: JSFinalizationGroup;
+}
+
+@generateCppClass
+extern class WeakCell extends HeapObject {
+  finalization_group: Undefined|JSFinalizationGroup;
+  target: Undefined|JSReceiver;
+  unregister_token: Object;
+  holdings: Object;
+
+  // For storing doubly linked lists of WeakCells in JSFinalizationGroup's
+  // "active_cells" and "cleared_cells" lists.
+  prev: Undefined|WeakCell;
+  next: Undefined|WeakCell;
+
+  // For storing doubly linked lists of WeakCells per key in
+  // JSFinalizationGroup's key-based hashmap. The key is the identity hash of
+  // unregister_token. WeakCell also needs to know its token, so that we can
+  // remove its corresponding key from the key_map when we remove the last
+  // WeakCell associated with it or when the unregister_token dies. The
+  // unregister token is stored above, after target, as both are weak.
+  key_list_prev: Undefined|WeakCell;
+  key_list_next: Undefined|WeakCell;
+}
+
+@generateCppClass
+extern class JSWeakRef extends JSObject {
+  target: Undefined|JSReceiver;
+}
diff --git a/deps/v8/src/objects/keys.cc b/deps/v8/src/objects/keys.cc
index 0231df18d35bb8..99258e695c4ad7 100644
--- a/deps/v8/src/objects/keys.cc
+++ b/deps/v8/src/objects/keys.cc
@@ -44,6 +44,42 @@ static bool ContainsOnlyValidKeys(Handle<FixedArray> array) {
   return true;
 }
 
+static int AddKey(Object key, Handle<FixedArray> combined_keys,
+                  Handle<DescriptorArray> descs, int nof_descriptors,
+                  int target) {
+  for (InternalIndex i : InternalIndex::Range(nof_descriptors)) {
+    if (descs->GetKey(i) == key) return 0;
+  }
+  combined_keys->set(target, key);
+  return 1;
+}
+
+static Handle<FixedArray> CombineKeys(Isolate* isolate,
+                                      Handle<FixedArray> own_keys,
+                                      Handle<FixedArray> prototype_chain_keys,
+                                      Handle<JSReceiver> receiver) {
+  int prototype_chain_keys_length = prototype_chain_keys->length();
+  if (prototype_chain_keys_length == 0) return own_keys;
+
+  Map map = receiver->map();
+  int nof_descriptors = map.NumberOfOwnDescriptors();
+  if (nof_descriptors == 0) return prototype_chain_keys;
+
+  Handle<DescriptorArray> descs(map.instance_descriptors(), isolate);
+  int own_keys_length = own_keys.is_null() ? 0 : own_keys->length();
+  Handle<FixedArray> combined_keys = isolate->factory()->NewFixedArray(
+      own_keys_length + prototype_chain_keys_length);
+  if (own_keys_length != 0) {
+    own_keys->CopyTo(0, *combined_keys, 0, own_keys_length);
+  }
+  int target_keys_length = own_keys_length;
+  for (int i = 0; i < prototype_chain_keys_length; i++) {
+    target_keys_length += AddKey(prototype_chain_keys->get(i), combined_keys,
+                                 descs, nof_descriptors, target_keys_length);
+  }
+  return FixedArray::ShrinkOrEmpty(isolate, combined_keys, target_keys_length);
+}
+
 }  // namespace
 
 // static
@@ -68,6 +104,14 @@ Handle<FixedArray> KeyAccumulator::GetKeys(GetKeysConversion convert) {
   Handle<FixedArray> result =
       OrderedHashSet::ConvertToKeysArray(isolate(), keys(), convert);
   DCHECK(ContainsOnlyValidKeys(result));
+
+  if (try_prototype_info_cache_ && !first_prototype_map_.is_null()) {
+    PrototypeInfo::cast(first_prototype_map_->prototype_info())
+        .set_prototype_chain_enum_cache(*result);
+    Map::GetOrCreatePrototypeChainValidityCell(
+        Handle<Map>(receiver_->map(), isolate_), isolate_);
+    DCHECK(first_prototype_map_->IsPrototypeValidityCellValid());
+  }
   return result;
 }
 
@@ -112,7 +156,7 @@ ExceptionStatus KeyAccumulator::AddKey(Handle<Object> key,
     // The keys_ Set is converted directly to a FixedArray in GetKeys which can
     // be left-trimmer. Hence the previous Set should not keep a pointer to the
     // new one.
-    keys_->set(OrderedHashSet::NextTableIndex(), Smi::kZero);
+    keys_->set(OrderedHashSet::NextTableIndex(), Smi::zero());
     keys_ = new_set;
   }
   return ExceptionStatus::kSuccess;
@@ -237,7 +281,8 @@ bool KeyAccumulator::IsShadowed(Handle<Object> key) {
   return shadowing_keys_->Has(isolate_, key);
 }
 
-void KeyAccumulator::AddShadowingKey(Object key) {
+void KeyAccumulator::AddShadowingKey(Object key,
+                                     AllowHeapAllocation* allow_gc) {
   if (mode_ == KeyCollectionMode::kOwnOnly) return;
   AddShadowingKey(handle(key, isolate_));
 }
@@ -291,6 +336,9 @@ void FastKeyAccumulator::Prepare() {
     last_prototype = current;
     has_empty_prototype_ = false;
   }
+  // Check if we should try to create/use prototype info cache.
+  try_prototype_info_cache_ = TryPrototypeInfoCache(receiver_);
+  if (has_prototype_info_cache_) return;
   if (has_empty_prototype_) {
     is_receiver_simple_enum_ =
         receiver_->map().EnumLength() != kInvalidEnumCacheSentinel &&
@@ -432,6 +480,9 @@ MaybeHandle<FixedArray> FastKeyAccumulator::GetKeys(
     if (isolate_->has_pending_exception()) return MaybeHandle<FixedArray>();
   }
 
+  if (try_prototype_info_cache_) {
+    return GetKeysWithPrototypeInfoCache(keys_conversion);
+  }
   return GetKeysSlow(keys_conversion);
 }
 
@@ -503,12 +554,48 @@ MaybeHandle<FixedArray> FastKeyAccumulator::GetKeysSlow(
   accumulator.set_skip_indices(skip_indices_);
   accumulator.set_last_non_empty_prototype(last_non_empty_prototype_);
   accumulator.set_may_have_elements(may_have_elements_);
+  accumulator.set_first_prototype_map(first_prototype_map_);
+  accumulator.set_try_prototype_info_cache(try_prototype_info_cache_);
 
   MAYBE_RETURN(accumulator.CollectKeys(receiver_, receiver_),
                MaybeHandle<FixedArray>());
   return accumulator.GetKeys(keys_conversion);
 }
 
+MaybeHandle<FixedArray> FastKeyAccumulator::GetKeysWithPrototypeInfoCache(
+    GetKeysConversion keys_conversion) {
+  Handle<FixedArray> own_keys = KeyAccumulator::GetOwnEnumPropertyKeys(
+      isolate_, Handle<JSObject>::cast(receiver_));
+  Handle<FixedArray> prototype_chain_keys;
+  if (has_prototype_info_cache_) {
+    prototype_chain_keys =
+        handle(FixedArray::cast(
+                   PrototypeInfo::cast(first_prototype_map_->prototype_info())
+                       .prototype_chain_enum_cache()),
+               isolate_);
+  } else {
+    KeyAccumulator accumulator(isolate_, mode_, filter_);
+    accumulator.set_is_for_in(is_for_in_);
+    accumulator.set_skip_indices(skip_indices_);
+    accumulator.set_last_non_empty_prototype(last_non_empty_prototype_);
+    accumulator.set_may_have_elements(may_have_elements_);
+    accumulator.set_receiver(receiver_);
+    accumulator.set_first_prototype_map(first_prototype_map_);
+    accumulator.set_try_prototype_info_cache(try_prototype_info_cache_);
+    MAYBE_RETURN(accumulator.CollectKeys(first_prototype_, first_prototype_),
+                 MaybeHandle<FixedArray>());
+    prototype_chain_keys = accumulator.GetKeys(keys_conversion);
+  }
+  Handle<FixedArray> result = CombineKeys(
+      isolate_, own_keys, prototype_chain_keys, receiver_);
+  if (is_for_in_ && own_keys.is_identical_to(result)) {
+    // Don't leak the enumeration cache without the receiver since it might get
+    // trimmed otherwise.
+    return isolate_->factory()->CopyFixedArrayUpTo(result, result->length());
+  }
+  return result;
+}
+
 bool FastKeyAccumulator::MayHaveElements(JSReceiver receiver) {
   if (!receiver.IsJSObject()) return true;
   JSObject object = JSObject::cast(receiver);
@@ -517,6 +604,31 @@ bool FastKeyAccumulator::MayHaveElements(JSReceiver receiver) {
   return false;
 }
 
+bool FastKeyAccumulator::TryPrototypeInfoCache(Handle<JSReceiver> receiver) {
+  if (may_have_elements_) return false;
+  Handle<JSObject> object = Handle<JSObject>::cast(receiver);
+  if (!object->HasFastProperties()) return false;
+  if (object->HasNamedInterceptor()) return false;
+  if (object->IsAccessCheckNeeded() &&
+      !isolate_->MayAccess(handle(isolate_->context(), isolate_), object)) {
+    return false;
+  }
+  HeapObject prototype = receiver->map().prototype();
+  if (prototype.is_null()) return false;
+  if (!prototype.map().is_prototype_map() ||
+      !prototype.map().prototype_info().IsPrototypeInfo()) {
+    return false;
+  }
+  first_prototype_ = handle(JSReceiver::cast(prototype), isolate_);
+  Handle<Map> map(prototype.map(), isolate_);
+  first_prototype_map_ = map;
+  has_prototype_info_cache_ = map->IsPrototypeValidityCellValid() &&
+                              PrototypeInfo::cast(map->prototype_info())
+                                  .prototype_chain_enum_cache()
+                                  .IsFixedArray();
+  return true;
+}
+
 namespace {
 
 enum IndexedOrNamed { kIndexed, kNamed };
@@ -528,9 +640,8 @@ V8_WARN_UNUSED_RESULT ExceptionStatus FilterForEnumerableProperties(
   DCHECK(result->IsJSArray() || result->HasSloppyArgumentsElements());
   ElementsAccessor* accessor = result->GetElementsAccessor();
 
-  uint32_t length = accessor->GetCapacity(*result, result->elements());
-  for (uint32_t i = 0; i < length; i++) {
-    InternalIndex entry(i);
+  size_t length = accessor->GetCapacity(*result, result->elements());
+  for (InternalIndex entry : InternalIndex::Range(length)) {
     if (!accessor->HasEntry(*result, entry)) continue;
 
     // args are invalid after args.Call(), create a new one in every iteration.
@@ -634,6 +745,7 @@ template <bool skip_symbols>
 base::Optional<int> CollectOwnPropertyNamesInternal(
     Handle<JSObject> object, KeyAccumulator* keys,
     Handle<DescriptorArray> descs, int start_index, int limit) {
+  AllowHeapAllocation allow_gc;
   int first_skipped = -1;
   PropertyFilter filter = keys->filter();
   KeyCollectionMode mode = keys->mode();
@@ -664,7 +776,9 @@ base::Optional<int> CollectOwnPropertyNamesInternal(
     if (key.FilterKey(keys->filter())) continue;
 
     if (is_shadowing_key) {
-      keys->AddShadowingKey(key);
+      // This might allocate, but {key} is not used afterwards.
+      keys->AddShadowingKey(key, &allow_gc);
+      continue;
     } else {
       if (keys->AddKey(key, DO_NOT_CONVERT) != ExceptionStatus::kSuccess) {
         return base::Optional<int>();
@@ -703,13 +817,13 @@ Maybe<bool> KeyAccumulator::CollectOwnPropertyNames(Handle<JSReceiver> receiver,
       int nof_descriptors = map.NumberOfOwnDescriptors();
       if (enum_keys->length() != nof_descriptors) {
         if (map.prototype(isolate_) != ReadOnlyRoots(isolate_).null_value()) {
+          AllowHeapAllocation allow_gc;
           Handle<DescriptorArray> descs =
               Handle<DescriptorArray>(map.instance_descriptors(), isolate_);
           for (InternalIndex i : InternalIndex::Range(nof_descriptors)) {
             PropertyDetails details = descs->GetDetails(i);
             if (!details.IsDontEnum()) continue;
-            Object key = descs->GetKey(i);
-            this->AddShadowingKey(key);
+            this->AddShadowingKey(descs->GetKey(i), &allow_gc);
           }
         }
       }
@@ -763,6 +877,7 @@ Maybe<bool> KeyAccumulator::CollectOwnPropertyNames(Handle<JSReceiver> receiver,
 
 ExceptionStatus KeyAccumulator::CollectPrivateNames(Handle<JSReceiver> receiver,
                                                     Handle<JSObject> object) {
+  DCHECK_EQ(mode_, KeyCollectionMode::kOwnOnly);
   if (object->HasFastProperties()) {
     int limit = object->map().NumberOfOwnDescriptors();
     Handle<DescriptorArray> descs(object->map().instance_descriptors(),
@@ -983,7 +1098,7 @@ Maybe<bool> KeyAccumulator::CollectOwnJSProxyKeys(Handle<JSReceiver> receiver,
                                        target_keys->get(i));
       nonconfigurable_keys_length++;
       // The key was moved, null it out in the original list.
-      target_keys->set(i, Smi::kZero);
+      target_keys->set(i, Smi::zero());
     } else {
       // 16c. Else,
       // 16c i. Append key as an element of targetConfigurableKeys.
diff --git a/deps/v8/src/objects/keys.h b/deps/v8/src/objects/keys.h
index 4c2307a20b4af5..fd8b3937c8c48a 100644
--- a/deps/v8/src/objects/keys.h
+++ b/deps/v8/src/objects/keys.h
@@ -87,6 +87,13 @@ class KeyAccumulator final {
   // indices.
   void set_is_for_in(bool value) { is_for_in_ = value; }
   void set_skip_indices(bool value) { skip_indices_ = value; }
+  void set_first_prototype_map(Handle<Map> value) {
+    first_prototype_map_ = value;
+  }
+  void set_try_prototype_info_cache(bool value) {
+    try_prototype_info_cache_ = value;
+  }
+  void set_receiver(Handle<JSReceiver> object) { receiver_ = object; }
   // The last_non_empty_prototype is used to limit the prototypes for which
   // we have to keep track of non-enumerable keys that can shadow keys
   // repeated on the prototype chain.
@@ -96,7 +103,7 @@ class KeyAccumulator final {
   void set_may_have_elements(bool value) { may_have_elements_ = value; }
   // Shadowing keys are used to filter keys. This happens when non-enumerable
   // keys appear again on the prototype chain.
-  void AddShadowingKey(Object key);
+  void AddShadowingKey(Object key, AllowHeapAllocation* allow_gc);
   void AddShadowingKey(Handle<Object> key);
 
  private:
@@ -117,6 +124,8 @@ class KeyAccumulator final {
   // keys a Handle<FixedArray>. The OrderedHashSet is in-place converted to the
   // result list, a FixedArray containing all collected keys.
   Handle<FixedArray> keys_;
+  Handle<Map> first_prototype_map_;
+  Handle<JSReceiver> receiver_;
   Handle<JSReceiver> last_non_empty_prototype_;
   Handle<ObjectHashSet> shadowing_keys_;
   KeyCollectionMode mode_;
@@ -127,6 +136,7 @@ class KeyAccumulator final {
   // the shadow check.
   bool skip_shadow_check_ = true;
   bool may_have_elements_ = true;
+  bool try_prototype_info_cache_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(KeyAccumulator);
 };
@@ -160,13 +170,18 @@ class FastKeyAccumulator {
   void Prepare();
   MaybeHandle<FixedArray> GetKeysFast(GetKeysConversion convert);
   MaybeHandle<FixedArray> GetKeysSlow(GetKeysConversion convert);
+  MaybeHandle<FixedArray> GetKeysWithPrototypeInfoCache(
+      GetKeysConversion convert);
 
   MaybeHandle<FixedArray> GetOwnKeysWithUninitializedEnumCache();
 
   bool MayHaveElements(JSReceiver receiver);
+  bool TryPrototypeInfoCache(Handle<JSReceiver> receiver);
 
   Isolate* isolate_;
   Handle<JSReceiver> receiver_;
+  Handle<Map> first_prototype_map_;
+  Handle<JSReceiver> first_prototype_;
   Handle<JSReceiver> last_non_empty_prototype_;
   KeyCollectionMode mode_;
   PropertyFilter filter_;
@@ -175,6 +190,8 @@ class FastKeyAccumulator {
   bool is_receiver_simple_enum_ = false;
   bool has_empty_prototype_ = false;
   bool may_have_elements_ = true;
+  bool has_prototype_info_cache_ = false;
+  bool try_prototype_info_cache_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(FastKeyAccumulator);
 };
diff --git a/deps/v8/src/objects/literal-objects-inl.h b/deps/v8/src/objects/literal-objects-inl.h
index 96aa8d8c8bf1ca..7f0fb6d335958b 100644
--- a/deps/v8/src/objects/literal-objects-inl.h
+++ b/deps/v8/src/objects/literal-objects-inl.h
@@ -27,11 +27,12 @@ SMI_ACCESSORS(ObjectBoilerplateDescription, flags,
               FixedArray::OffsetOfElementAt(kLiteralTypeOffset))
 
 Object ObjectBoilerplateDescription::name(int index) const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return name(isolate, index);
 }
 
-Object ObjectBoilerplateDescription::name(Isolate* isolate, int index) const {
+Object ObjectBoilerplateDescription::name(const Isolate* isolate,
+                                          int index) const {
   // get() already checks for out of bounds access, but we do not want to allow
   // access to the last element, if it is the number of properties.
   DCHECK_NE(size(), index);
@@ -39,11 +40,12 @@ Object ObjectBoilerplateDescription::name(Isolate* isolate, int index) const {
 }
 
 Object ObjectBoilerplateDescription::value(int index) const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return value(isolate, index);
 }
 
-Object ObjectBoilerplateDescription::value(Isolate* isolate, int index) const {
+Object ObjectBoilerplateDescription::value(const Isolate* isolate,
+                                           int index) const {
   return get(isolate, 2 * index + 1 + kDescriptionStartIndex);
 }
 
diff --git a/deps/v8/src/objects/literal-objects.cc b/deps/v8/src/objects/literal-objects.cc
index 827a8b10219290..c441f05a522f7d 100644
--- a/deps/v8/src/objects/literal-objects.cc
+++ b/deps/v8/src/objects/literal-objects.cc
@@ -81,14 +81,16 @@ void AddToDescriptorArrayTemplate(
 
 Handle<NameDictionary> DictionaryAddNoUpdateNextEnumerationIndex(
     Isolate* isolate, Handle<NameDictionary> dictionary, Handle<Name> name,
-    Handle<Object> value, PropertyDetails details, int* entry_out = nullptr) {
+    Handle<Object> value, PropertyDetails details,
+    InternalIndex* entry_out = nullptr) {
   return NameDictionary::AddNoUpdateNextEnumerationIndex(
       isolate, dictionary, name, value, details, entry_out);
 }
 
 Handle<NumberDictionary> DictionaryAddNoUpdateNextEnumerationIndex(
     Isolate* isolate, Handle<NumberDictionary> dictionary, uint32_t element,
-    Handle<Object> value, PropertyDetails details, int* entry_out = nullptr) {
+    Handle<Object> value, PropertyDetails details,
+    InternalIndex* entry_out = nullptr) {
   // NumberDictionary does not maintain the enumeration order, so it's
   // a normal Add().
   return NumberDictionary::Add(isolate, dictionary, element, value, details,
@@ -122,10 +124,10 @@ template <typename Dictionary, typename Key>
 void AddToDictionaryTemplate(Isolate* isolate, Handle<Dictionary> dictionary,
                              Key key, int key_index,
                              ClassBoilerplate::ValueKind value_kind,
-                             Object value) {
-  int entry = dictionary->FindEntry(isolate, key);
+                             Smi value) {
+  InternalIndex entry = dictionary->FindEntry(isolate, key);
 
-  if (entry == kNotFound) {
+  if (entry.is_not_found()) {
     // Entry not found, add new one.
     const bool is_elements_dictionary =
         std::is_same<Dictionary, NumberDictionary>::value;
@@ -302,7 +304,7 @@ class ObjectDescriptor {
                                      ClassBoilerplate::kFullComputedEntrySize)
             : factory->empty_fixed_array();
 
-    temp_handle_ = handle(Smi::kZero, isolate);
+    temp_handle_ = handle(Smi::zero(), isolate);
   }
 
   void AddConstant(Isolate* isolate, Handle<Name> name, Handle<Object> value,
@@ -390,14 +392,14 @@ class ObjectDescriptor {
 
 void ClassBoilerplate::AddToPropertiesTemplate(
     Isolate* isolate, Handle<NameDictionary> dictionary, Handle<Name> name,
-    int key_index, ClassBoilerplate::ValueKind value_kind, Object value) {
+    int key_index, ClassBoilerplate::ValueKind value_kind, Smi value) {
   AddToDictionaryTemplate(isolate, dictionary, name, key_index, value_kind,
                           value);
 }
 
 void ClassBoilerplate::AddToElementsTemplate(
     Isolate* isolate, Handle<NumberDictionary> dictionary, uint32_t key,
-    int key_index, ClassBoilerplate::ValueKind value_kind, Object value) {
+    int key_index, ClassBoilerplate::ValueKind value_kind, Smi value) {
   AddToDictionaryTemplate(isolate, dictionary, key, key_index, value_kind,
                           value);
 }
@@ -514,7 +516,8 @@ Handle<ClassBoilerplate> ClassBoilerplate::BuildClassBoilerplate(
       desc.AddIndexedProperty(isolate, index, value_kind, value_index);
 
     } else {
-      Handle<String> name = key_literal->AsRawPropertyName()->string();
+      Handle<String> name =
+          key_literal->AsRawPropertyName()->string().get<Factory>();
       DCHECK(name->IsInternalizedString());
       desc.AddNamedProperty(isolate, name, value_kind, value_index);
     }
@@ -522,7 +525,8 @@ Handle<ClassBoilerplate> ClassBoilerplate::BuildClassBoilerplate(
 
   // Add name accessor to the class object if necessary.
   bool install_class_name_accessor = false;
-  if (!expr->has_name_static_property()) {
+  if (!expr->has_name_static_property() &&
+      expr->constructor()->has_shared_name()) {
     if (static_desc.HasDictionaryProperties()) {
       // Install class name accessor if necessary during class literal
       // instantiation.
diff --git a/deps/v8/src/objects/literal-objects.h b/deps/v8/src/objects/literal-objects.h
index cf551ea576ae61..c3b5c914e9e7aa 100644
--- a/deps/v8/src/objects/literal-objects.h
+++ b/deps/v8/src/objects/literal-objects.h
@@ -5,6 +5,7 @@
 #ifndef V8_OBJECTS_LITERAL_OBJECTS_H_
 #define V8_OBJECTS_LITERAL_OBJECTS_H_
 
+#include "src/base/bit-field.h"
 #include "src/objects/fixed-array.h"
 #include "src/objects/struct.h"
 
@@ -25,10 +26,10 @@ class ClassLiteral;
 class ObjectBoilerplateDescription : public FixedArray {
  public:
   inline Object name(int index) const;
-  inline Object name(Isolate* isolate, int index) const;
+  inline Object name(const Isolate* isolate, int index) const;
 
   inline Object value(int index) const;
-  inline Object value(Isolate* isolate, int index) const;
+  inline Object value(const Isolate* isolate, int index) const;
 
   inline void set_key_value(int index, Object key, Object value);
 
@@ -119,12 +120,12 @@ class ClassBoilerplate : public FixedArray {
   static void AddToPropertiesTemplate(Isolate* isolate,
                                       Handle<NameDictionary> dictionary,
                                       Handle<Name> name, int key_index,
-                                      ValueKind value_kind, Object value);
+                                      ValueKind value_kind, Smi value);
 
   static void AddToElementsTemplate(Isolate* isolate,
                                     Handle<NumberDictionary> dictionary,
                                     uint32_t key, int key_index,
-                                    ValueKind value_kind, Object value);
+                                    ValueKind value_kind, Smi value);
 
   static Handle<ClassBoilerplate> BuildClassBoilerplate(Isolate* isolate,
                                                         ClassLiteral* expr);
diff --git a/deps/v8/src/objects/literal-objects.tq b/deps/v8/src/objects/literal-objects.tq
new file mode 100644
index 00000000000000..1e2b80d2dd689b
--- /dev/null
+++ b/deps/v8/src/objects/literal-objects.tq
@@ -0,0 +1,9 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+extern class ArrayBoilerplateDescription extends Struct {
+  flags: Smi;
+  constant_elements: FixedArrayBase;
+}
diff --git a/deps/v8/src/objects/lookup-inl.h b/deps/v8/src/objects/lookup-inl.h
index 49a42e71313724..1fdfde6a05be8a 100644
--- a/deps/v8/src/objects/lookup-inl.h
+++ b/deps/v8/src/objects/lookup-inl.h
@@ -20,76 +20,152 @@ namespace internal {
 
 LookupIterator::LookupIterator(Isolate* isolate, Handle<Object> receiver,
                                Handle<Name> name, Configuration configuration)
-    : LookupIterator(isolate, receiver, name, GetRoot(isolate, receiver),
+    : LookupIterator(isolate, receiver, name, kInvalidIndex,
+                     GetRoot(isolate, receiver, kInvalidIndex), configuration) {
+}
+
+LookupIterator::LookupIterator(Isolate* isolate, Handle<Object> receiver,
+                               Handle<Name> name, Handle<JSReceiver> holder,
+                               Configuration configuration)
+    : LookupIterator(isolate, receiver, name, kInvalidIndex, holder,
                      configuration) {}
 
-LookupIterator::LookupIterator(Handle<Object> receiver, Handle<Name> name,
-                               Handle<JSReceiver> holder,
+LookupIterator::LookupIterator(Isolate* isolate, Handle<Object> receiver,
+                               size_t index, Configuration configuration)
+    : LookupIterator(isolate, receiver, Handle<Name>(), index,
+                     GetRoot(isolate, receiver, index), configuration) {
+  DCHECK_NE(index, kInvalidIndex);
+}
+
+LookupIterator::LookupIterator(Isolate* isolate, Handle<Object> receiver,
+                               size_t index, Handle<JSReceiver> holder,
                                Configuration configuration)
-    : LookupIterator(holder->GetIsolate(), receiver, name, holder,
+    : LookupIterator(isolate, receiver, Handle<Name>(), index, holder,
+                     configuration) {
+  DCHECK_NE(index, kInvalidIndex);
+}
+
+LookupIterator::LookupIterator(Isolate* isolate, Handle<Object> receiver,
+                               const Key& key, Configuration configuration)
+    : LookupIterator(isolate, receiver, key.name(), key.index(),
+                     GetRoot(isolate, receiver, key.index()), configuration) {}
+
+LookupIterator::LookupIterator(Isolate* isolate, Handle<Object> receiver,
+                               const Key& key, Handle<JSReceiver> holder,
+                               Configuration configuration)
+    : LookupIterator(isolate, receiver, key.name(), key.index(), holder,
                      configuration) {}
 
+// This private constructor is the central bottleneck that all the other
+// constructors use.
 LookupIterator::LookupIterator(Isolate* isolate, Handle<Object> receiver,
-                               Handle<Name> name, Handle<JSReceiver> holder,
+                               Handle<Name> name, size_t index,
+                               Handle<JSReceiver> holder,
                                Configuration configuration)
     : configuration_(ComputeConfiguration(isolate, configuration, name)),
-      interceptor_state_(InterceptorState::kUninitialized),
-      property_details_(PropertyDetails::Empty()),
       isolate_(isolate),
-      name_(isolate_->factory()->InternalizeName(name)),
+      name_(name),
       receiver_(receiver),
       initial_holder_(holder),
-      // kMaxUInt32 isn't a valid index.
-      index_(kMaxUInt32),
-      number_(static_cast<uint32_t>(DescriptorArray::kNotFound)) {
+      index_(index) {
+  if (IsElement()) {
+    // If we're not looking at a TypedArray, we will need the key represented
+    // as an internalized string.
+    if (index_ > JSArray::kMaxArrayIndex && !holder->IsJSTypedArray()) {
+      if (name_.is_null()) {
+        name_ = isolate->factory()->SizeToString(index_);
+      }
+      name_ = isolate->factory()->InternalizeName(name_);
+    } else if (!name_.is_null() && !name_->IsInternalizedString()) {
+      // Maintain the invariant that if name_ is present, it is internalized.
+      name_ = Handle<Name>();
+    }
+    Start<true>();
+  } else {
+    name_ = isolate->factory()->InternalizeName(name_);
 #ifdef DEBUG
-  uint32_t index;  // Assert that the name is not an array index.
-  DCHECK(!name->AsArrayIndex(&index));
+    // Assert that the name is not an index.
+    // If we're not looking at the prototype chain and the initial holder is
+    // not a typed array, then this means "array index", otherwise we need to
+    // ensure the full generality so that typed arrays are handled correctly.
+    if (!check_prototype_chain() && !holder->IsJSTypedArray()) {
+      uint32_t index;
+      DCHECK(!name_->AsArrayIndex(&index));
+    } else {
+      size_t index;
+      DCHECK(!name_->AsIntegerIndex(&index));
+    }
 #endif  // DEBUG
-  Start<false>();
+    Start<false>();
+  }
 }
 
-LookupIterator::LookupIterator(Isolate* isolate, Handle<Object> receiver,
-                               uint32_t index, Configuration configuration)
-    : LookupIterator(isolate, receiver, index,
-                     GetRoot(isolate, receiver, index), configuration) {}
-
-LookupIterator LookupIterator::PropertyOrElement(Isolate* isolate,
-                                                 Handle<Object> receiver,
-                                                 Handle<Name> name,
-                                                 Handle<JSReceiver> holder,
-                                                 Configuration configuration) {
-  uint32_t index;
-  if (name->AsArrayIndex(&index)) {
-    LookupIterator it =
-        LookupIterator(isolate, receiver, index, holder, configuration);
-    it.name_ = name;
-    return it;
+LookupIterator::Key::Key(Isolate* isolate, double index) {
+  DCHECK_EQ(index, static_cast<uint64_t>(index));
+#if V8_TARGET_ARCH_32_BIT
+  if (index <= JSArray::kMaxArrayIndex) {
+    index_ = static_cast<size_t>(index);
+  } else {
+    index_ = LookupIterator::kInvalidIndex;
+    name_ = isolate->factory()->InternalizeString(
+        isolate->factory()->HeapNumberToString(
+            isolate->factory()->NewHeapNumber(index), index));
   }
-  return LookupIterator(isolate, receiver, name, holder, configuration);
-}
-
-LookupIterator LookupIterator::PropertyOrElement(Isolate* isolate,
-                                                 Handle<Object> receiver,
-                                                 Handle<Name> name,
-                                                 Configuration configuration) {
-  uint32_t index;
-  if (name->AsArrayIndex(&index)) {
-    LookupIterator it = LookupIterator(isolate, receiver, index, configuration);
-    it.name_ = name;
-    return it;
+#else
+  index_ = static_cast<size_t>(index);
+#endif
+}
+
+LookupIterator::Key::Key(Isolate* isolate, Handle<Name> name) {
+  if (name->AsIntegerIndex(&index_)) {
+    name_ = name;
+  } else {
+    index_ = LookupIterator::kInvalidIndex;
+    name_ = isolate->factory()->InternalizeName(name);
   }
-  return LookupIterator(isolate, receiver, name, configuration);
+}
+
+LookupIterator::Key::Key(Isolate* isolate, Handle<Object> valid_key) {
+  DCHECK(valid_key->IsName() || valid_key->IsNumber());
+  if (valid_key->ToIntegerIndex(&index_)) return;
+  if (valid_key->IsNumber()) {
+    // Negative or out of range -> treat as named property.
+    valid_key = isolate->factory()->NumberToString(valid_key);
+  }
+  DCHECK(valid_key->IsName());
+  name_ = Handle<Name>::cast(valid_key);
+  if (!name_->AsIntegerIndex(&index_)) {
+    index_ = LookupIterator::kInvalidIndex;
+    name_ = isolate->factory()->InternalizeName(name_);
+  }
+}
+
+Handle<Name> LookupIterator::Key::GetName(Isolate* isolate) {
+  if (name_.is_null()) {
+    DCHECK(is_element());
+    name_ = isolate->factory()->SizeToString(index_);
+  }
+  return name_;
+}
+
+Handle<Name> LookupIterator::name() const {
+  DCHECK(!IsElement(*holder_));
+  return name_;
 }
 
 Handle<Name> LookupIterator::GetName() {
   if (name_.is_null()) {
     DCHECK(IsElement());
-    name_ = factory()->Uint32ToString(index_);
+    name_ = factory()->SizeToString(index_);
   }
   return name_;
 }
 
+bool LookupIterator::IsElement(JSReceiver object) const {
+  return index_ <= JSArray::kMaxArrayIndex ||
+         (index_ != kInvalidIndex && object.map().has_typed_array_elements());
+}
+
 bool LookupIterator::is_dictionary_holder() const {
   return !holder_->HasFastProperties(isolate_);
 }
@@ -124,28 +200,34 @@ bool LookupIterator::IsCacheableTransition() {
          transition_map()->GetBackPointer(isolate_).IsMap(isolate_);
 }
 
-void LookupIterator::UpdateProtector() {
-  if (IsElement()) return;
+// static
+void LookupIterator::UpdateProtector(Isolate* isolate, Handle<Object> receiver,
+                                     Handle<Name> name) {
   // This list must be kept in sync with
   // CodeStubAssembler::CheckForAssociatedProtector!
-  ReadOnlyRoots roots(isolate_);
-  if (*name_ == roots.is_concat_spreadable_symbol() ||
-      *name_ == roots.constructor_string() || *name_ == roots.next_string() ||
-      *name_ == roots.species_symbol() || *name_ == roots.iterator_symbol() ||
-      *name_ == roots.resolve_string() || *name_ == roots.then_string()) {
-    InternalUpdateProtector();
+  ReadOnlyRoots roots(isolate);
+  if (*name == roots.is_concat_spreadable_symbol() ||
+      *name == roots.constructor_string() || *name == roots.next_string() ||
+      *name == roots.species_symbol() || *name == roots.iterator_symbol() ||
+      *name == roots.resolve_string() || *name == roots.then_string()) {
+    InternalUpdateProtector(isolate, receiver, name);
   }
 }
 
+void LookupIterator::UpdateProtector() {
+  if (IsElement()) return;
+  UpdateProtector(isolate_, receiver_, name_);
+}
+
 InternalIndex LookupIterator::descriptor_number() const {
-  DCHECK(!IsElement());
+  DCHECK(!IsElement(*holder_));
   DCHECK(has_property_);
   DCHECK(holder_->HasFastProperties(isolate_));
-  return InternalIndex(number_);
+  return number_;
 }
 
-int LookupIterator::dictionary_entry() const {
-  DCHECK(!IsElement());
+InternalIndex LookupIterator::dictionary_entry() const {
+  DCHECK(!IsElement(*holder_));
   DCHECK(has_property_);
   DCHECK(!holder_->HasFastProperties(isolate_));
   return number_;
@@ -154,15 +236,17 @@ int LookupIterator::dictionary_entry() const {
 // static
 LookupIterator::Configuration LookupIterator::ComputeConfiguration(
     Isolate* isolate, Configuration configuration, Handle<Name> name) {
-  return name->IsPrivate(isolate) ? OWN_SKIP_INTERCEPTOR : configuration;
+  return (!name.is_null() && name->IsPrivate(isolate)) ? OWN_SKIP_INTERCEPTOR
+                                                       : configuration;
 }
 
 // static
 Handle<JSReceiver> LookupIterator::GetRoot(Isolate* isolate,
                                            Handle<Object> receiver,
-                                           uint32_t index) {
-  if (receiver->IsJSReceiver(isolate))
+                                           size_t index) {
+  if (receiver->IsJSReceiver(isolate)) {
     return Handle<JSReceiver>::cast(receiver);
+  }
   return GetRootForNonJSReceiver(isolate, receiver, index);
 }
 
@@ -179,20 +263,20 @@ Handle<T> LookupIterator::GetStoreTarget() const {
   return Handle<T>::cast(receiver_);
 }
 
-// static
 template <bool is_element>
-InterceptorInfo LookupIterator::GetInterceptor(Isolate* isolate,
-                                               JSObject holder) {
-  return is_element ? holder.GetIndexedInterceptor(isolate)
-                    : holder.GetNamedInterceptor(isolate);
+InterceptorInfo LookupIterator::GetInterceptor(JSObject holder) const {
+  if (is_element && index_ <= JSArray::kMaxArrayIndex) {
+    return holder.GetIndexedInterceptor(isolate_);
+  } else {
+    return holder.GetNamedInterceptor(isolate_);
+  }
 }
 
 inline Handle<InterceptorInfo> LookupIterator::GetInterceptor() const {
   DCHECK_EQ(INTERCEPTOR, state_);
   JSObject holder = JSObject::cast(*holder_);
-  InterceptorInfo result = IsElement()
-                               ? GetInterceptor<true>(isolate_, holder)
-                               : GetInterceptor<false>(isolate_, holder);
+  InterceptorInfo result = IsElement(holder) ? GetInterceptor<true>(holder)
+                                             : GetInterceptor<false>(holder);
   return handle(result, isolate_);
 }
 
diff --git a/deps/v8/src/objects/lookup.cc b/deps/v8/src/objects/lookup.cc
index 0700a6fc921b73..5fe8889779618f 100644
--- a/deps/v8/src/objects/lookup.cc
+++ b/deps/v8/src/objects/lookup.cc
@@ -19,67 +19,21 @@
 namespace v8 {
 namespace internal {
 
-// static
-LookupIterator LookupIterator::PropertyOrElement(
-    Isolate* isolate, Handle<Object> receiver, Handle<Object> key,
-    bool* success, Handle<JSReceiver> holder, Configuration configuration) {
-  uint32_t index = 0;
-  if (key->ToArrayIndex(&index)) {
+LookupIterator::Key::Key(Isolate* isolate, Handle<Object> key, bool* success) {
+  if (key->ToIntegerIndex(&index_)) {
     *success = true;
-    return LookupIterator(isolate, receiver, index, holder, configuration);
-  }
-
-  Handle<Name> name;
-  *success = Object::ToName(isolate, key).ToHandle(&name);
-  if (!*success) {
-    DCHECK(isolate->has_pending_exception());
-    // Return an unusable dummy.
-    return LookupIterator(isolate, receiver,
-                          isolate->factory()->empty_string());
-  }
-
-  if (name->AsArrayIndex(&index)) {
-    LookupIterator it(isolate, receiver, index, holder, configuration);
-    // Here we try to avoid having to rebuild the string later
-    // by storing it on the indexed LookupIterator.
-    it.name_ = name;
-    return it;
-  }
-
-  return LookupIterator(receiver, name, holder, configuration);
-}
-
-// static
-LookupIterator LookupIterator::PropertyOrElement(Isolate* isolate,
-                                                 Handle<Object> receiver,
-                                                 Handle<Object> key,
-                                                 bool* success,
-                                                 Configuration configuration) {
-  // TODO(mslekova): come up with better way to avoid duplication
-  uint32_t index = 0;
-  if (key->ToArrayIndex(&index)) {
-    *success = true;
-    return LookupIterator(isolate, receiver, index, configuration);
+    return;
   }
-
-  Handle<Name> name;
-  *success = Object::ToName(isolate, key).ToHandle(&name);
+  *success = Object::ToName(isolate, key).ToHandle(&name_);
   if (!*success) {
     DCHECK(isolate->has_pending_exception());
-    // Return an unusable dummy.
-    return LookupIterator(isolate, receiver,
-                          isolate->factory()->empty_string());
+    index_ = kInvalidIndex;
+    return;
   }
-
-  if (name->AsArrayIndex(&index)) {
-    LookupIterator it(isolate, receiver, index, configuration);
-    // Here we try to avoid having to rebuild the string later
-    // by storing it on the indexed LookupIterator.
-    it.name_ = name;
-    return it;
+  if (!name_->AsIntegerIndex(&index_)) {
+    // {AsIntegerIndex} may modify {index_} before deciding to fail.
+    index_ = LookupIterator::kInvalidIndex;
   }
-
-  return LookupIterator(isolate, receiver, name, configuration);
 }
 
 LookupIterator::LookupIterator(Isolate* isolate, Handle<Object> receiver,
@@ -95,8 +49,7 @@ LookupIterator::LookupIterator(Isolate* isolate, Handle<Object> receiver,
       transition_(transition_map),
       receiver_(receiver),
       initial_holder_(GetRoot(isolate, receiver)),
-      index_(kMaxUInt32),
-      number_(static_cast<uint32_t>(DescriptorArray::kNotFound)) {
+      index_(kInvalidIndex) {
   holder_ = initial_holder_;
 }
 
@@ -164,7 +117,7 @@ template <bool is_element>
 void LookupIterator::RestartInternal(InterceptorState interceptor_state) {
   interceptor_state_ = interceptor_state;
   property_details_ = PropertyDetails::Empty();
-  number_ = static_cast<uint32_t>(DescriptorArray::kNotFound);
+  number_ = InternalIndex::NotFound();
   Start<is_element>();
 }
 
@@ -173,11 +126,11 @@ template void LookupIterator::RestartInternal<false>(InterceptorState);
 
 // static
 Handle<JSReceiver> LookupIterator::GetRootForNonJSReceiver(
-    Isolate* isolate, Handle<Object> receiver, uint32_t index) {
+    Isolate* isolate, Handle<Object> receiver, size_t index) {
   // Strings are the only objects with properties (only elements) directly on
   // the wrapper. Hence we can skip generating the wrapper for all other cases.
   if (receiver->IsString(isolate) &&
-      index < static_cast<uint32_t>(String::cast(*receiver).length())) {
+      index < static_cast<size_t>(String::cast(*receiver).length())) {
     // TODO(verwaest): Speed this up. Perhaps use a cached wrapper on the native
     // context, ensuring that we don't leak it into JS?
     Handle<JSFunction> constructor = isolate->string_function();
@@ -185,7 +138,7 @@ Handle<JSReceiver> LookupIterator::GetRootForNonJSReceiver(
     Handle<JSPrimitiveWrapper>::cast(result)->set_value(*receiver);
     return result;
   }
-  auto root = handle(
+  Handle<HeapObject> root(
       receiver->GetPrototypeChainRootMap(isolate).prototype(isolate), isolate);
   if (root->IsNull(isolate)) {
     isolate->PushStackTraceAndDie(reinterpret_cast<void*>(receiver->ptr()));
@@ -232,195 +185,198 @@ bool IsTypedArrayFunctionInAnyContext(Isolate* isolate, HeapObject object) {
 
 }  // namespace
 
-void LookupIterator::InternalUpdateProtector() {
-  if (isolate_->bootstrapper()->IsActive()) return;
-  if (!receiver_->IsHeapObject()) return;
-  Handle<HeapObject> receiver = Handle<HeapObject>::cast(receiver_);
+// static
+void LookupIterator::InternalUpdateProtector(Isolate* isolate,
+                                             Handle<Object> receiver_generic,
+                                             Handle<Name> name) {
+  if (isolate->bootstrapper()->IsActive()) return;
+  if (!receiver_generic->IsHeapObject()) return;
+  Handle<HeapObject> receiver = Handle<HeapObject>::cast(receiver_generic);
 
   // Getting the native_context from the isolate as a fallback. If possible, we
   // use the receiver's creation context instead.
-  Handle<NativeContext> native_context = isolate_->native_context();
+  Handle<NativeContext> native_context = isolate->native_context();
 
-  ReadOnlyRoots roots(isolate_);
-  if (*name_ == roots.constructor_string()) {
+  ReadOnlyRoots roots(isolate);
+  if (*name == roots.constructor_string()) {
     // Fetching the context in here since the operation is rather expensive.
     if (receiver->IsJSReceiver()) {
       native_context = Handle<JSReceiver>::cast(receiver)->GetCreationContext();
     }
 
-    if (!Protectors::IsArraySpeciesLookupChainIntact(isolate_) &&
-        !Protectors::IsPromiseSpeciesLookupChainIntact(isolate_) &&
+    if (!Protectors::IsArraySpeciesLookupChainIntact(isolate) &&
+        !Protectors::IsPromiseSpeciesLookupChainIntact(isolate) &&
         !Protectors::IsRegExpSpeciesLookupChainProtectorIntact(
             native_context) &&
-        !Protectors::IsTypedArraySpeciesLookupChainIntact(isolate_)) {
+        !Protectors::IsTypedArraySpeciesLookupChainIntact(isolate)) {
       return;
     }
     // Setting the constructor property could change an instance's @@species
-    if (receiver->IsJSArray(isolate_)) {
-      if (!Protectors::IsArraySpeciesLookupChainIntact(isolate_)) return;
-      isolate_->CountUsage(
+    if (receiver->IsJSArray(isolate)) {
+      if (!Protectors::IsArraySpeciesLookupChainIntact(isolate)) return;
+      isolate->CountUsage(
           v8::Isolate::UseCounterFeature::kArrayInstanceConstructorModified);
-      Protectors::InvalidateArraySpeciesLookupChain(isolate_);
+      Protectors::InvalidateArraySpeciesLookupChain(isolate);
       return;
-    } else if (receiver->IsJSPromise(isolate_)) {
-      if (!Protectors::IsPromiseSpeciesLookupChainIntact(isolate_)) return;
-      Protectors::InvalidatePromiseSpeciesLookupChain(isolate_);
+    } else if (receiver->IsJSPromise(isolate)) {
+      if (!Protectors::IsPromiseSpeciesLookupChainIntact(isolate)) return;
+      Protectors::InvalidatePromiseSpeciesLookupChain(isolate);
       return;
-    } else if (receiver->IsJSRegExp(isolate_)) {
+    } else if (receiver->IsJSRegExp(isolate)) {
       if (!Protectors::IsRegExpSpeciesLookupChainProtectorIntact(
               native_context)) {
         return;
       }
-      Protectors::InvalidateRegExpSpeciesLookupChainProtector(isolate_,
+      Protectors::InvalidateRegExpSpeciesLookupChainProtector(isolate,
                                                               native_context);
       return;
-    } else if (receiver->IsJSTypedArray(isolate_)) {
-      if (!Protectors::IsTypedArraySpeciesLookupChainIntact(isolate_)) return;
-      Protectors::InvalidateTypedArraySpeciesLookupChain(isolate_);
+    } else if (receiver->IsJSTypedArray(isolate)) {
+      if (!Protectors::IsTypedArraySpeciesLookupChainIntact(isolate)) return;
+      Protectors::InvalidateTypedArraySpeciesLookupChain(isolate);
       return;
     }
-    if (receiver->map(isolate_).is_prototype_map()) {
+    if (receiver->map(isolate).is_prototype_map()) {
       DisallowHeapAllocation no_gc;
       // Setting the constructor of any prototype with the @@species protector
       // (of any realm) also needs to invalidate the protector.
       // For typed arrays, we check a prototype of this receiver since
       // TypedArrays have different prototypes for each type, and their parent
       // prototype is pointing the same TYPED_ARRAY_PROTOTYPE.
-      if (isolate_->IsInAnyContext(*receiver,
-                                   Context::INITIAL_ARRAY_PROTOTYPE_INDEX)) {
-        if (!Protectors::IsArraySpeciesLookupChainIntact(isolate_)) return;
-        isolate_->CountUsage(
+      if (isolate->IsInAnyContext(*receiver,
+                                  Context::INITIAL_ARRAY_PROTOTYPE_INDEX)) {
+        if (!Protectors::IsArraySpeciesLookupChainIntact(isolate)) return;
+        isolate->CountUsage(
             v8::Isolate::UseCounterFeature::kArrayPrototypeConstructorModified);
-        Protectors::InvalidateArraySpeciesLookupChain(isolate_);
-      } else if (isolate_->IsInAnyContext(*receiver,
-                                          Context::PROMISE_PROTOTYPE_INDEX)) {
-        if (!Protectors::IsPromiseSpeciesLookupChainIntact(isolate_)) return;
-        Protectors::InvalidatePromiseSpeciesLookupChain(isolate_);
-      } else if (isolate_->IsInAnyContext(*receiver,
-                                          Context::REGEXP_PROTOTYPE_INDEX)) {
+        Protectors::InvalidateArraySpeciesLookupChain(isolate);
+      } else if (isolate->IsInAnyContext(*receiver,
+                                         Context::PROMISE_PROTOTYPE_INDEX)) {
+        if (!Protectors::IsPromiseSpeciesLookupChainIntact(isolate)) return;
+        Protectors::InvalidatePromiseSpeciesLookupChain(isolate);
+      } else if (isolate->IsInAnyContext(*receiver,
+                                         Context::REGEXP_PROTOTYPE_INDEX)) {
         if (!Protectors::IsRegExpSpeciesLookupChainProtectorIntact(
                 native_context)) {
           return;
         }
-        Protectors::InvalidateRegExpSpeciesLookupChainProtector(isolate_,
+        Protectors::InvalidateRegExpSpeciesLookupChainProtector(isolate,
                                                                 native_context);
-      } else if (isolate_->IsInAnyContext(
-                     receiver->map(isolate_).prototype(isolate_),
+      } else if (isolate->IsInAnyContext(
+                     receiver->map(isolate).prototype(isolate),
                      Context::TYPED_ARRAY_PROTOTYPE_INDEX)) {
-        if (!Protectors::IsTypedArraySpeciesLookupChainIntact(isolate_)) return;
-        Protectors::InvalidateTypedArraySpeciesLookupChain(isolate_);
+        if (!Protectors::IsTypedArraySpeciesLookupChainIntact(isolate)) return;
+        Protectors::InvalidateTypedArraySpeciesLookupChain(isolate);
       }
     }
-  } else if (*name_ == roots.next_string()) {
+  } else if (*name == roots.next_string()) {
     if (receiver->IsJSArrayIterator() ||
-        isolate_->IsInAnyContext(
+        isolate->IsInAnyContext(
             *receiver, Context::INITIAL_ARRAY_ITERATOR_PROTOTYPE_INDEX)) {
       // Setting the next property of %ArrayIteratorPrototype% also needs to
       // invalidate the array iterator protector.
-      if (!Protectors::IsArrayIteratorLookupChainIntact(isolate_)) return;
-      Protectors::InvalidateArrayIteratorLookupChain(isolate_);
+      if (!Protectors::IsArrayIteratorLookupChainIntact(isolate)) return;
+      Protectors::InvalidateArrayIteratorLookupChain(isolate);
     } else if (receiver->IsJSMapIterator() ||
-               isolate_->IsInAnyContext(
+               isolate->IsInAnyContext(
                    *receiver, Context::INITIAL_MAP_ITERATOR_PROTOTYPE_INDEX)) {
-      if (!Protectors::IsMapIteratorLookupChainIntact(isolate_)) return;
-      Protectors::InvalidateMapIteratorLookupChain(isolate_);
+      if (!Protectors::IsMapIteratorLookupChainIntact(isolate)) return;
+      Protectors::InvalidateMapIteratorLookupChain(isolate);
     } else if (receiver->IsJSSetIterator() ||
-               isolate_->IsInAnyContext(
+               isolate->IsInAnyContext(
                    *receiver, Context::INITIAL_SET_ITERATOR_PROTOTYPE_INDEX)) {
-      if (!Protectors::IsSetIteratorLookupChainIntact(isolate_)) return;
-      Protectors::InvalidateSetIteratorLookupChain(isolate_);
+      if (!Protectors::IsSetIteratorLookupChainIntact(isolate)) return;
+      Protectors::InvalidateSetIteratorLookupChain(isolate);
     } else if (receiver->IsJSStringIterator() ||
-               isolate_->IsInAnyContext(
+               isolate->IsInAnyContext(
                    *receiver,
                    Context::INITIAL_STRING_ITERATOR_PROTOTYPE_INDEX)) {
       // Setting the next property of %StringIteratorPrototype% invalidates the
       // string iterator protector.
-      if (!Protectors::IsStringIteratorLookupChainIntact(isolate_)) return;
-      Protectors::InvalidateStringIteratorLookupChain(isolate_);
+      if (!Protectors::IsStringIteratorLookupChainIntact(isolate)) return;
+      Protectors::InvalidateStringIteratorLookupChain(isolate);
     }
-  } else if (*name_ == roots.species_symbol()) {
+  } else if (*name == roots.species_symbol()) {
     // Fetching the context in here since the operation is rather expensive.
     if (receiver->IsJSReceiver()) {
       native_context = Handle<JSReceiver>::cast(receiver)->GetCreationContext();
     }
 
-    if (!Protectors::IsArraySpeciesLookupChainIntact(isolate_) &&
-        !Protectors::IsPromiseSpeciesLookupChainIntact(isolate_) &&
+    if (!Protectors::IsArraySpeciesLookupChainIntact(isolate) &&
+        !Protectors::IsPromiseSpeciesLookupChainIntact(isolate) &&
         !Protectors::IsRegExpSpeciesLookupChainProtectorIntact(
             native_context) &&
-        !Protectors::IsTypedArraySpeciesLookupChainIntact(isolate_)) {
+        !Protectors::IsTypedArraySpeciesLookupChainIntact(isolate)) {
       return;
     }
     // Setting the Symbol.species property of any Array, Promise or TypedArray
     // constructor invalidates the @@species protector
-    if (isolate_->IsInAnyContext(*receiver, Context::ARRAY_FUNCTION_INDEX)) {
-      if (!Protectors::IsArraySpeciesLookupChainIntact(isolate_)) return;
-      isolate_->CountUsage(
+    if (isolate->IsInAnyContext(*receiver, Context::ARRAY_FUNCTION_INDEX)) {
+      if (!Protectors::IsArraySpeciesLookupChainIntact(isolate)) return;
+      isolate->CountUsage(
           v8::Isolate::UseCounterFeature::kArraySpeciesModified);
-      Protectors::InvalidateArraySpeciesLookupChain(isolate_);
-    } else if (isolate_->IsInAnyContext(*receiver,
-                                        Context::PROMISE_FUNCTION_INDEX)) {
-      if (!Protectors::IsPromiseSpeciesLookupChainIntact(isolate_)) return;
-      Protectors::InvalidatePromiseSpeciesLookupChain(isolate_);
-    } else if (isolate_->IsInAnyContext(*receiver,
-                                        Context::REGEXP_FUNCTION_INDEX)) {
+      Protectors::InvalidateArraySpeciesLookupChain(isolate);
+    } else if (isolate->IsInAnyContext(*receiver,
+                                       Context::PROMISE_FUNCTION_INDEX)) {
+      if (!Protectors::IsPromiseSpeciesLookupChainIntact(isolate)) return;
+      Protectors::InvalidatePromiseSpeciesLookupChain(isolate);
+    } else if (isolate->IsInAnyContext(*receiver,
+                                       Context::REGEXP_FUNCTION_INDEX)) {
       if (!Protectors::IsRegExpSpeciesLookupChainProtectorIntact(
               native_context)) {
         return;
       }
-      Protectors::InvalidateRegExpSpeciesLookupChainProtector(isolate_,
+      Protectors::InvalidateRegExpSpeciesLookupChainProtector(isolate,
                                                               native_context);
-    } else if (IsTypedArrayFunctionInAnyContext(isolate_, *receiver)) {
-      if (!Protectors::IsTypedArraySpeciesLookupChainIntact(isolate_)) return;
-      Protectors::InvalidateTypedArraySpeciesLookupChain(isolate_);
+    } else if (IsTypedArrayFunctionInAnyContext(isolate, *receiver)) {
+      if (!Protectors::IsTypedArraySpeciesLookupChainIntact(isolate)) return;
+      Protectors::InvalidateTypedArraySpeciesLookupChain(isolate);
     }
-  } else if (*name_ == roots.is_concat_spreadable_symbol()) {
-    if (!Protectors::IsIsConcatSpreadableLookupChainIntact(isolate_)) return;
-    Protectors::InvalidateIsConcatSpreadableLookupChain(isolate_);
-  } else if (*name_ == roots.iterator_symbol()) {
-    if (receiver->IsJSArray(isolate_)) {
-      if (!Protectors::IsArrayIteratorLookupChainIntact(isolate_)) return;
-      Protectors::InvalidateArrayIteratorLookupChain(isolate_);
-    } else if (receiver->IsJSSet(isolate_) || receiver->IsJSSetIterator() ||
-               isolate_->IsInAnyContext(
+  } else if (*name == roots.is_concat_spreadable_symbol()) {
+    if (!Protectors::IsIsConcatSpreadableLookupChainIntact(isolate)) return;
+    Protectors::InvalidateIsConcatSpreadableLookupChain(isolate);
+  } else if (*name == roots.iterator_symbol()) {
+    if (receiver->IsJSArray(isolate)) {
+      if (!Protectors::IsArrayIteratorLookupChainIntact(isolate)) return;
+      Protectors::InvalidateArrayIteratorLookupChain(isolate);
+    } else if (receiver->IsJSSet(isolate) || receiver->IsJSSetIterator() ||
+               isolate->IsInAnyContext(
                    *receiver, Context::INITIAL_SET_ITERATOR_PROTOTYPE_INDEX) ||
-               isolate_->IsInAnyContext(*receiver,
-                                        Context::INITIAL_SET_PROTOTYPE_INDEX)) {
-      if (Protectors::IsSetIteratorLookupChainIntact(isolate_)) {
-        Protectors::InvalidateSetIteratorLookupChain(isolate_);
+               isolate->IsInAnyContext(*receiver,
+                                       Context::INITIAL_SET_PROTOTYPE_INDEX)) {
+      if (Protectors::IsSetIteratorLookupChainIntact(isolate)) {
+        Protectors::InvalidateSetIteratorLookupChain(isolate);
       }
     } else if (receiver->IsJSMapIterator() ||
-               isolate_->IsInAnyContext(
+               isolate->IsInAnyContext(
                    *receiver, Context::INITIAL_MAP_ITERATOR_PROTOTYPE_INDEX)) {
-      if (Protectors::IsMapIteratorLookupChainIntact(isolate_)) {
-        Protectors::InvalidateMapIteratorLookupChain(isolate_);
+      if (Protectors::IsMapIteratorLookupChainIntact(isolate)) {
+        Protectors::InvalidateMapIteratorLookupChain(isolate);
       }
-    } else if (isolate_->IsInAnyContext(
+    } else if (isolate->IsInAnyContext(
                    *receiver, Context::INITIAL_ITERATOR_PROTOTYPE_INDEX)) {
-      if (Protectors::IsMapIteratorLookupChainIntact(isolate_)) {
-        Protectors::InvalidateMapIteratorLookupChain(isolate_);
+      if (Protectors::IsMapIteratorLookupChainIntact(isolate)) {
+        Protectors::InvalidateMapIteratorLookupChain(isolate);
       }
-      if (Protectors::IsSetIteratorLookupChainIntact(isolate_)) {
-        Protectors::InvalidateSetIteratorLookupChain(isolate_);
+      if (Protectors::IsSetIteratorLookupChainIntact(isolate)) {
+        Protectors::InvalidateSetIteratorLookupChain(isolate);
       }
-    } else if (isolate_->IsInAnyContext(
+    } else if (isolate->IsInAnyContext(
                    *receiver, Context::INITIAL_STRING_PROTOTYPE_INDEX)) {
       // Setting the Symbol.iterator property of String.prototype invalidates
       // the string iterator protector. Symbol.iterator can also be set on a
       // String wrapper, but not on a primitive string. We only support
       // protector for primitive strings.
-      if (!Protectors::IsStringIteratorLookupChainIntact(isolate_)) return;
-      Protectors::InvalidateStringIteratorLookupChain(isolate_);
+      if (!Protectors::IsStringIteratorLookupChainIntact(isolate)) return;
+      Protectors::InvalidateStringIteratorLookupChain(isolate);
     }
-  } else if (*name_ == roots.resolve_string()) {
-    if (!Protectors::IsPromiseResolveLookupChainIntact(isolate_)) return;
+  } else if (*name == roots.resolve_string()) {
+    if (!Protectors::IsPromiseResolveLookupChainIntact(isolate)) return;
     // Setting the "resolve" property on any %Promise% intrinsic object
     // invalidates the Promise.resolve protector.
-    if (isolate_->IsInAnyContext(*receiver, Context::PROMISE_FUNCTION_INDEX)) {
-      Protectors::InvalidatePromiseResolveLookupChain(isolate_);
+    if (isolate->IsInAnyContext(*receiver, Context::PROMISE_FUNCTION_INDEX)) {
+      Protectors::InvalidatePromiseResolveLookupChain(isolate);
     }
-  } else if (*name_ == roots.then_string()) {
-    if (!Protectors::IsPromiseThenLookupChainIntact(isolate_)) return;
+  } else if (*name == roots.then_string()) {
+    if (!Protectors::IsPromiseThenLookupChainIntact(isolate)) return;
     // Setting the "then" property on any JSPromise instance or on the
     // initial %PromisePrototype% invalidates the Promise#then protector.
     // Also setting the "then" property on the initial %ObjectPrototype%
@@ -428,11 +384,11 @@ void LookupIterator::InternalUpdateProtector() {
     // to guard the fast-path in AsyncGeneratorResolve, where we can skip
     // the ResolvePromise step and go directly to FulfillPromise if we
     // know that the Object.prototype doesn't contain a "then" method.
-    if (receiver->IsJSPromise(isolate_) ||
-        isolate_->IsInAnyContext(*receiver,
-                                 Context::INITIAL_OBJECT_PROTOTYPE_INDEX) ||
-        isolate_->IsInAnyContext(*receiver, Context::PROMISE_PROTOTYPE_INDEX)) {
-      Protectors::InvalidatePromiseThenLookupChain(isolate_);
+    if (receiver->IsJSPromise(isolate) ||
+        isolate->IsInAnyContext(*receiver,
+                                Context::INITIAL_OBJECT_PROTOTYPE_INDEX) ||
+        isolate->IsInAnyContext(*receiver, Context::PROMISE_PROTOTYPE_INDEX)) {
+      Protectors::InvalidatePromiseThenLookupChain(isolate);
     }
   }
 }
@@ -450,7 +406,7 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
 
   Handle<JSObject> holder_obj = Handle<JSObject>::cast(holder);
 
-  if (IsElement()) {
+  if (IsElement(*holder)) {
     ElementsKind kind = holder_obj->GetElementsKind(isolate_);
     ElementsKind to = value->OptimalElementsKind(isolate_);
     if (IsHoleyElementsKind(kind)) to = GetHoleyElementsKind(to);
@@ -529,12 +485,12 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
   }
 
   Handle<JSObject> holder_obj = Handle<JSObject>::cast(holder);
-  if (IsElement()) {
+  if (IsElement(*holder)) {
     DCHECK(!holder_obj->HasTypedArrayElements(isolate_));
     DCHECK(attributes != NONE || !holder_obj->HasFastElements(isolate_));
     Handle<FixedArrayBase> elements(holder_obj->elements(isolate_), isolate());
     holder_obj->GetElementsAccessor(isolate_)->Reconfigure(
-        holder_obj, elements, InternalIndex(number_), value, attributes);
+        holder_obj, elements, number_, value, attributes);
     ReloadPropertyInformation<true>();
   } else if (holder_obj->HasFastProperties(isolate_)) {
     Handle<Map> old_map(holder_obj->map(isolate_), isolate_);
@@ -554,7 +510,7 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
     ReloadPropertyInformation<false>();
   }
 
-  if (!IsElement() && !holder_obj->HasFastProperties(isolate_)) {
+  if (!IsElement(*holder) && !holder_obj->HasFastProperties(isolate_)) {
     PropertyDetails details(kData, attributes, PropertyCellType::kMutable);
     if (holder_obj->map(isolate_).is_prototype_map() &&
         (property_details_.attributes() & READ_ONLY) == 0 &&
@@ -624,9 +580,8 @@ void LookupIterator::PrepareTransitionToDataProperty(
     if (map->IsJSGlobalObjectMap()) {
       // Install a property cell.
       Handle<JSGlobalObject> global = Handle<JSGlobalObject>::cast(receiver);
-      int entry;
       Handle<PropertyCell> cell = JSGlobalObject::EnsureEmptyPropertyCell(
-          global, name(), PropertyCellType::kUninitialized, &entry);
+          global, name(), PropertyCellType::kUninitialized, &number_);
       Handle<GlobalDictionary> dictionary(global->global_dictionary(isolate_),
                                           isolate_);
       DCHECK(cell->value(isolate_).IsTheHole(isolate_));
@@ -642,7 +597,6 @@ void LookupIterator::PrepareTransitionToDataProperty(
           PropertyCell::UpdatedType(isolate(), cell, value, property_details_);
       property_details_ = property_details_.set_cell_type(new_type);
       cell->set_property_details(property_details_);
-      number_ = entry;
       has_property_ = true;
     } else {
       // Don't set enumeration index (it will be set during value store).
@@ -699,24 +653,22 @@ void LookupIterator::ApplyTransitionToDataProperty(
   }
 
   if (simple_transition) {
-    number_ = transition->LastAdded().as_uint32();
+    number_ = transition->LastAdded();
     property_details_ = transition->GetLastDescriptorDetails(isolate_);
     state_ = DATA;
   } else if (receiver->map(isolate_).is_dictionary_map()) {
     Handle<NameDictionary> dictionary(receiver->property_dictionary(isolate_),
                                       isolate_);
-    int entry;
     if (receiver->map(isolate_).is_prototype_map() &&
         receiver->IsJSObject(isolate_)) {
       JSObject::InvalidatePrototypeChains(receiver->map(isolate_));
     }
     dictionary = NameDictionary::Add(isolate(), dictionary, name(),
                                      isolate_->factory()->uninitialized_value(),
-                                     property_details_, &entry);
+                                     property_details_, &number_);
     receiver->SetProperties(*dictionary);
     // Reload details containing proper enumeration index value.
-    property_details_ = dictionary->DetailsAt(entry);
-    number_ = entry;
+    property_details_ = dictionary->DetailsAt(number_);
     has_property_ = true;
     state_ = DATA;
 
@@ -727,10 +679,10 @@ void LookupIterator::ApplyTransitionToDataProperty(
 
 void LookupIterator::Delete() {
   Handle<JSReceiver> holder = Handle<JSReceiver>::cast(holder_);
-  if (IsElement()) {
+  if (IsElement(*holder)) {
     Handle<JSObject> object = Handle<JSObject>::cast(holder);
     ElementsAccessor* accessor = object->GetElementsAccessor(isolate_);
-    accessor->Delete(object, InternalIndex(number_));
+    accessor->Delete(object, number_);
   } else {
     DCHECK(!name()->IsPrivateName(isolate_));
     bool is_prototype_map = holder->map(isolate_).is_prototype_map();
@@ -747,7 +699,7 @@ void LookupIterator::Delete() {
                                     mode, 0, "DeletingProperty");
       ReloadPropertyInformation<false>();
     }
-    JSReceiver::DeleteNormalizedProperty(holder, number_);
+    JSReceiver::DeleteNormalizedProperty(holder, dictionary_entry());
     if (holder->IsJSObject(isolate_)) {
       JSObject::ReoptimizeIfPrototype(Handle<JSObject>::cast(holder));
     }
@@ -767,7 +719,7 @@ void LookupIterator::TransitionToAccessorProperty(
     attributes = static_cast<PropertyAttributes>(attributes | DONT_ENUM);
   }
 
-  if (!IsElement() && !receiver->map(isolate_).is_dictionary_map()) {
+  if (!IsElement(*receiver) && !receiver->map(isolate_).is_dictionary_map()) {
     Handle<Map> old_map(receiver->map(isolate_), isolate_);
 
     if (!holder_.is_identical_to(receiver)) {
@@ -776,20 +728,18 @@ void LookupIterator::TransitionToAccessorProperty(
     } else if (state_ == INTERCEPTOR) {
       LookupInRegularHolder<false>(*old_map, *holder_);
     }
-    // TODO(jkummerow): {IsFound()} should be enough once {number_} has type
-    // {InternalIndex}.
-    InternalIndex descriptor = (IsFound() && number_ != kMaxUInt32)
-                                   ? InternalIndex(number_)
-                                   : InternalIndex::NotFound();
+    // The case of IsFound() && number_.is_not_found() can occur for
+    // interceptors.
+    DCHECK_IMPLIES(!IsFound(), number_.is_not_found());
 
     Handle<Map> new_map = Map::TransitionToAccessorProperty(
-        isolate_, old_map, name_, descriptor, getter, setter, attributes);
+        isolate_, old_map, name_, number_, getter, setter, attributes);
     bool simple_transition =
         new_map->GetBackPointer(isolate_) == receiver->map(isolate_);
     JSObject::MigrateToMap(isolate_, receiver, new_map);
 
     if (simple_transition) {
-      number_ = new_map->LastAdded().as_uint32();
+      number_ = new_map->LastAdded();
       property_details_ = new_map->GetLastDescriptorDetails(isolate_);
       state_ = ACCESSOR;
       return;
@@ -805,7 +755,7 @@ void LookupIterator::TransitionToAccessorProperty(
     // If the component and attributes are identical, nothing has to be done.
     if (pair->Equals(*getter, *setter)) {
       if (property_details().attributes() == attributes) {
-        if (!IsElement()) JSObject::ReoptimizeIfPrototype(receiver);
+        if (!IsElement(*receiver)) JSObject::ReoptimizeIfPrototype(receiver);
         return;
       }
     } else {
@@ -833,20 +783,20 @@ void LookupIterator::TransitionToAccessorPair(Handle<Object> pair,
 
   PropertyDetails details(kAccessor, attributes, PropertyCellType::kMutable);
 
-  if (IsElement()) {
+  if (IsElement(*receiver)) {
     // TODO(verwaest): Move code into the element accessor.
     isolate_->CountUsage(v8::Isolate::kIndexAccessor);
     Handle<NumberDictionary> dictionary = JSObject::NormalizeElements(receiver);
 
-    dictionary = NumberDictionary::Set(isolate_, dictionary, index_, pair,
-                                       receiver, details);
+    dictionary = NumberDictionary::Set(isolate_, dictionary, array_index(),
+                                       pair, receiver, details);
     receiver->RequireSlowElements(*dictionary);
 
     if (receiver->HasSlowArgumentsElements(isolate_)) {
       FixedArray parameter_map = FixedArray::cast(receiver->elements(isolate_));
       uint32_t length = parameter_map.length() - 2;
-      if (number_ < length) {
-        parameter_map.set(number_ + 2,
+      if (number_.is_found() && number_.as_uint32() < length) {
+        parameter_map.set(number_.as_int() + 2,
                           ReadOnlyRoots(isolate_).the_hole_value());
       }
       FixedArray::cast(receiver->elements(isolate_)).set(1, *dictionary);
@@ -890,15 +840,17 @@ bool LookupIterator::HolderIsReceiverOrHiddenPrototype() const {
              isolate_) == *holder_;
 }
 
-Handle<Object> LookupIterator::FetchValue() const {
+Handle<Object> LookupIterator::FetchValue(
+    AllocationPolicy allocation_policy) const {
   Object result;
-  if (IsElement()) {
+  if (IsElement(*holder_)) {
     Handle<JSObject> holder = GetHolder<JSObject>();
     ElementsAccessor* accessor = holder->GetElementsAccessor(isolate_);
-    return accessor->Get(holder, InternalIndex(number_));
+    return accessor->Get(holder, number_);
   } else if (holder_->IsJSGlobalObject(isolate_)) {
     Handle<JSGlobalObject> holder = GetHolder<JSGlobalObject>();
-    result = holder->global_dictionary(isolate_).ValueAt(isolate_, number_);
+    result = holder->global_dictionary(isolate_).ValueAt(isolate_,
+                                                         dictionary_entry());
   } else if (!holder_->HasFastProperties(isolate_)) {
     result = holder_->property_dictionary(isolate_).ValueAt(isolate_,
                                                             dictionary_entry());
@@ -907,6 +859,10 @@ Handle<Object> LookupIterator::FetchValue() const {
     Handle<JSObject> holder = GetHolder<JSObject>();
     FieldIndex field_index =
         FieldIndex::ForDescriptor(holder->map(isolate_), descriptor_number());
+    if (allocation_policy == AllocationPolicy::kAllocationDisallowed &&
+        field_index.is_inobject() && field_index.is_double()) {
+      return isolate_->factory()->undefined_value();
+    }
     return JSObject::FastPropertyAt(holder, property_details_.representation(),
                                     field_index);
   } else {
@@ -918,10 +874,16 @@ Handle<Object> LookupIterator::FetchValue() const {
 }
 
 bool LookupIterator::IsConstFieldValueEqualTo(Object value) const {
-  DCHECK(!IsElement());
+  DCHECK(!IsElement(*holder_));
   DCHECK(holder_->HasFastProperties(isolate_));
   DCHECK_EQ(kField, property_details_.location());
   DCHECK_EQ(PropertyConstness::kConst, property_details_.constness());
+  if (value.IsUninitialized(isolate())) {
+    // Storing uninitialized value means that we are preparing for a computed
+    // property value in an object literal. The initializing store will follow
+    // and it will properly update constness based on the actual value.
+    return true;
+  }
   Handle<JSObject> holder = GetHolder<JSObject>();
   FieldIndex field_index =
       FieldIndex::ForDescriptor(holder->map(isolate_), descriptor_number());
@@ -935,7 +897,7 @@ bool LookupIterator::IsConstFieldValueEqualTo(Object value) const {
       DCHECK(current_value.IsHeapNumber(isolate_));
       bits = HeapNumber::cast(current_value).value_as_bits();
     }
-    // Use bit representation of double to to check for hole double, since
+    // Use bit representation of double to check for hole double, since
     // manipulating the signaling NaN used for the hole in C++, e.g. with
     // bit_cast or value(), will change its value on ia32 (the x87 stack is
     // used to return values and stores to the stack silently clear the
@@ -976,7 +938,7 @@ Handle<Map> LookupIterator::GetFieldOwnerMap() const {
   DCHECK(has_property_);
   DCHECK(holder_->HasFastProperties(isolate_));
   DCHECK_EQ(kField, property_details_.location());
-  DCHECK(!IsElement());
+  DCHECK(!IsElement(*holder_));
   Map holder_map = holder_->map(isolate_);
   return handle(holder_map.FindFieldOwner(isolate(), descriptor_number()),
                 isolate_);
@@ -991,7 +953,7 @@ LookupIterator::GetFieldIndex() const {
   DCHECK(has_property_);
   DCHECK(holder_->HasFastProperties(isolate_));
   DCHECK_EQ(kField, property_details_.location());
-  DCHECK(!IsElement());
+  DCHECK(!IsElement(*holder_));
   return FieldIndex::ForDescriptor(holder_->map(isolate_), descriptor_number());
 }
 
@@ -1006,7 +968,7 @@ Handle<FieldType> LookupIterator::GetFieldType() const {
 }
 
 Handle<PropertyCell> LookupIterator::GetPropertyCell() const {
-  DCHECK(!IsElement());
+  DCHECK(!IsElement(*holder_));
   Handle<JSGlobalObject> holder = GetHolder<JSGlobalObject>();
   return handle(
       holder->global_dictionary(isolate_).CellAt(isolate_, dictionary_entry()),
@@ -1018,9 +980,10 @@ Handle<Object> LookupIterator::GetAccessors() const {
   return FetchValue();
 }
 
-Handle<Object> LookupIterator::GetDataValue() const {
+Handle<Object> LookupIterator::GetDataValue(
+    AllocationPolicy allocation_policy) const {
   DCHECK_EQ(DATA, state_);
-  Handle<Object> value = FetchValue();
+  Handle<Object> value = FetchValue(allocation_policy);
   return value;
 }
 
@@ -1028,10 +991,10 @@ void LookupIterator::WriteDataValue(Handle<Object> value,
                                     bool initializing_store) {
   DCHECK_EQ(DATA, state_);
   Handle<JSReceiver> holder = GetHolder<JSReceiver>();
-  if (IsElement()) {
+  if (IsElement(*holder)) {
     Handle<JSObject> object = Handle<JSObject>::cast(holder);
     ElementsAccessor* accessor = object->GetElementsAccessor(isolate_);
-    accessor->Set(object, InternalIndex(number_), *value);
+    accessor->Set(object, number_, *value);
   } else if (holder->HasFastProperties(isolate_)) {
     if (property_details_.location() == kField) {
       // Check that in case of VariableMode::kConst field the existing value is
@@ -1058,7 +1021,7 @@ void LookupIterator::WriteDataValue(Handle<Object> value,
 
 template <bool is_element>
 bool LookupIterator::SkipInterceptor(JSObject holder) {
-  InterceptorInfo info = GetInterceptor<is_element>(isolate_, holder);
+  InterceptorInfo info = GetInterceptor<is_element>(holder);
   if (!is_element && name_->IsSymbol(isolate_) &&
       !info.can_intercept_symbols()) {
     return true;
@@ -1089,9 +1052,9 @@ JSReceiver LookupIterator::NextHolder(Map map) {
 }
 
 LookupIterator::State LookupIterator::NotFound(JSReceiver const holder) const {
-  DCHECK(!IsElement());
-  if (!holder.IsJSTypedArray(isolate_) || !name_->IsString(isolate_))
-    return NOT_FOUND;
+  if (!holder.IsJSTypedArray(isolate_)) return NOT_FOUND;
+  if (IsElement()) return INTEGER_INDEXED_EXOTIC;
+  if (!name_->IsString(isolate_)) return NOT_FOUND;
   return IsSpecialIndex(String::cast(*name_)) ? INTEGER_INDEXED_EXOTIC
                                               : NOT_FOUND;
 }
@@ -1099,9 +1062,18 @@ LookupIterator::State LookupIterator::NotFound(JSReceiver const holder) const {
 namespace {
 
 template <bool is_element>
-bool HasInterceptor(Map map) {
-  return is_element ? map.has_indexed_interceptor()
-                    : map.has_named_interceptor();
+bool HasInterceptor(Map map, size_t index) {
+  if (is_element) {
+    if (index > JSArray::kMaxArrayIndex) {
+      // There is currently no way to install interceptors on an object with
+      // typed array elements.
+      DCHECK(!map.has_typed_array_elements());
+      return map.has_named_interceptor();
+    }
+    return map.has_indexed_interceptor();
+  } else {
+    return map.has_named_interceptor();
+  }
 }
 
 }  // namespace
@@ -1120,18 +1092,17 @@ LookupIterator::State LookupIterator::LookupInSpecialHolder(
       }
       V8_FALLTHROUGH;
     case ACCESS_CHECK:
-      if (check_interceptor() && HasInterceptor<is_element>(map) &&
+      if (check_interceptor() && HasInterceptor<is_element>(map, index_) &&
           !SkipInterceptor<is_element>(JSObject::cast(holder))) {
         if (is_element || !name_->IsPrivate(isolate_)) return INTERCEPTOR;
       }
       V8_FALLTHROUGH;
     case INTERCEPTOR:
-      if (!is_element && map.IsJSGlobalObjectMap()) {
+      if (map.IsJSGlobalObjectMap() && !is_js_array_element(is_element)) {
         GlobalDictionary dict =
             JSGlobalObject::cast(holder).global_dictionary(isolate_);
-        int number = dict.FindEntry(isolate(), name_);
-        if (number == GlobalDictionary::kNotFound) return NOT_FOUND;
-        number_ = static_cast<uint32_t>(number);
+        number_ = dict.FindEntry(isolate(), name_);
+        if (number_.is_not_found()) return NOT_FOUND;
         PropertyCell cell = dict.CellAt(isolate_, number_);
         if (cell.value(isolate_).IsTheHole(isolate_)) return NOT_FOUND;
         property_details_ = cell.property_details();
@@ -1163,19 +1134,17 @@ LookupIterator::State LookupIterator::LookupInRegularHolder(
     return NOT_FOUND;
   }
 
-  if (is_element) {
+  if (is_element && IsElement(holder)) {
     JSObject js_object = JSObject::cast(holder);
     ElementsAccessor* accessor = js_object.GetElementsAccessor(isolate_);
     FixedArrayBase backing_store = js_object.elements(isolate_);
-    // TODO(jkummerow): {number_} should have type InternalIndex.
-    InternalIndex entry =
+    number_ =
         accessor->GetEntryForIndex(isolate_, js_object, backing_store, index_);
-    number_ = entry.is_found() ? entry.as_uint32() : kMaxUInt32;
-    if (number_ == kMaxUInt32) {
+    if (number_.is_not_found()) {
       return holder.IsJSTypedArray(isolate_) ? INTEGER_INDEXED_EXOTIC
                                              : NOT_FOUND;
     }
-    property_details_ = accessor->GetDetails(js_object, InternalIndex(number_));
+    property_details_ = accessor->GetDetails(js_object, number_);
     if (map.has_frozen_elements()) {
       property_details_ = property_details_.CopyAddAttributes(FROZEN);
     } else if (map.has_sealed_elements()) {
@@ -1183,16 +1152,14 @@ LookupIterator::State LookupIterator::LookupInRegularHolder(
     }
   } else if (!map.is_dictionary_map()) {
     DescriptorArray descriptors = map.instance_descriptors(isolate_);
-    InternalIndex number = descriptors.SearchWithCache(isolate_, *name_, map);
-    if (number.is_not_found()) return NotFound(holder);
-    number_ = number.as_uint32();
-    property_details_ = descriptors.GetDetails(InternalIndex(number_));
+    number_ = descriptors.SearchWithCache(isolate_, *name_, map);
+    if (number_.is_not_found()) return NotFound(holder);
+    property_details_ = descriptors.GetDetails(number_);
   } else {
     DCHECK_IMPLIES(holder.IsJSProxy(isolate_), name()->IsPrivate(isolate_));
     NameDictionary dict = holder.property_dictionary(isolate_);
-    int number = dict.FindEntry(isolate(), name_);
-    if (number == NameDictionary::kNotFound) return NotFound(holder);
-    number_ = static_cast<uint32_t>(number);
+    number_ = dict.FindEntry(isolate(), name_);
+    if (number_.is_not_found()) return NotFound(holder);
     property_details_ = dict.DetailsAt(number_);
   }
   has_property_ = true;
@@ -1213,8 +1180,12 @@ Handle<InterceptorInfo> LookupIterator::GetInterceptorForFailedAccessCheck()
   AccessCheckInfo access_check_info =
       AccessCheckInfo::Get(isolate_, Handle<JSObject>::cast(holder_));
   if (!access_check_info.is_null()) {
-    Object interceptor = IsElement() ? access_check_info.indexed_interceptor()
-                                     : access_check_info.named_interceptor();
+    // There is currently no way to create objects with typed array elements
+    // and access checks.
+    DCHECK(!holder_->map().has_typed_array_elements());
+    Object interceptor = is_js_array_element(IsElement())
+                             ? access_check_info.indexed_interceptor()
+                             : access_check_info.named_interceptor();
     if (interceptor != Object()) {
       return handle(InterceptorInfo::cast(interceptor), isolate_);
     }
diff --git a/deps/v8/src/objects/lookup.h b/deps/v8/src/objects/lookup.h
index 2a1f0e2f1bbb19..8ae05f073b36eb 100644
--- a/deps/v8/src/objects/lookup.h
+++ b/deps/v8/src/objects/lookup.h
@@ -45,53 +45,45 @@ class V8_EXPORT_PRIVATE LookupIterator final {
     BEFORE_PROPERTY = INTERCEPTOR
   };
 
+  class Key {
+   public:
+    inline Key(Isolate* isolate, double index);
+    // {name} might be a string representation of an element index.
+    inline Key(Isolate* isolate, Handle<Name> name);
+    // {valid_key} is a Name or Number.
+    inline Key(Isolate* isolate, Handle<Object> valid_key);
+    // {key} could be anything.
+    Key(Isolate* isolate, Handle<Object> key, bool* success);
+
+    bool is_element() { return index_ != LookupIterator::kInvalidIndex; }
+    Handle<Name> name() const { return name_; }
+    size_t index() const { return index_; }
+    inline Handle<Name> GetName(Isolate* isolate);
+
+   private:
+    Handle<Name> name_;
+    size_t index_;
+  };
+
+  // {name} is guaranteed to be a property name (and not e.g. "123").
   inline LookupIterator(Isolate* isolate, Handle<Object> receiver,
                         Handle<Name> name,
                         Configuration configuration = DEFAULT);
+  inline LookupIterator(Isolate* isolate, Handle<Object> receiver,
+                        Handle<Name> name, Handle<JSReceiver> holder,
+                        Configuration configuration = DEFAULT);
 
-  inline LookupIterator(Handle<Object> receiver, Handle<Name> name,
+  inline LookupIterator(Isolate* isolate, Handle<Object> receiver, size_t index,
+                        Configuration configuration = DEFAULT);
+  inline LookupIterator(Isolate* isolate, Handle<Object> receiver, size_t index,
                         Handle<JSReceiver> holder,
                         Configuration configuration = DEFAULT);
 
   inline LookupIterator(Isolate* isolate, Handle<Object> receiver,
-                        Handle<Name> name, Handle<JSReceiver> holder,
-                        Configuration configuration = DEFAULT);
-
+                        const Key& key, Configuration configuration = DEFAULT);
   inline LookupIterator(Isolate* isolate, Handle<Object> receiver,
-                        uint32_t index, Configuration configuration = DEFAULT);
-
-  LookupIterator(Isolate* isolate, Handle<Object> receiver, uint32_t index,
-                 Handle<JSReceiver> holder,
-                 Configuration configuration = DEFAULT)
-      : configuration_(configuration),
-        interceptor_state_(InterceptorState::kUninitialized),
-        property_details_(PropertyDetails::Empty()),
-        isolate_(isolate),
-        receiver_(receiver),
-        initial_holder_(holder),
-        index_(index),
-        number_(static_cast<uint32_t>(DescriptorArray::kNotFound)) {
-    // kMaxUInt32 isn't a valid index.
-    DCHECK_NE(kMaxUInt32, index_);
-    Start<true>();
-  }
-
-  static inline LookupIterator PropertyOrElement(
-      Isolate* isolate, Handle<Object> receiver, Handle<Name> name,
-      Configuration configuration = DEFAULT);
-
-  static inline LookupIterator PropertyOrElement(
-      Isolate* isolate, Handle<Object> receiver, Handle<Name> name,
-      Handle<JSReceiver> holder, Configuration configuration = DEFAULT);
-
-  static LookupIterator PropertyOrElement(
-      Isolate* isolate, Handle<Object> receiver, Handle<Object> key,
-      bool* success, Handle<JSReceiver> holder,
-      Configuration configuration = DEFAULT);
-
-  static LookupIterator PropertyOrElement(
-      Isolate* isolate, Handle<Object> receiver, Handle<Object> key,
-      bool* success, Configuration configuration = DEFAULT);
+                        const Key& key, Handle<JSReceiver> holder,
+                        Configuration configuration = DEFAULT);
 
   void Restart() {
     InterceptorState state = InterceptorState::kUninitialized;
@@ -101,14 +93,21 @@ class V8_EXPORT_PRIVATE LookupIterator final {
   Isolate* isolate() const { return isolate_; }
   State state() const { return state_; }
 
-  Handle<Name> name() const {
-    DCHECK(!IsElement());
-    return name_;
-  }
+  inline Handle<Name> name() const;
   inline Handle<Name> GetName();
-  uint32_t index() const { return index_; }
+  size_t index() const { return index_; }
+  uint32_t array_index() const {
+    DCHECK_LE(index_, JSArray::kMaxArrayIndex);
+    return static_cast<uint32_t>(index_);
+  }
 
-  bool IsElement() const { return index_ != kMaxUInt32; }
+  // Returns true if this LookupIterator has an index in the range
+  // [0, size_t::max).
+  bool IsElement() const { return index_ != kInvalidIndex; }
+  // Returns true if this LookupIterator has an index that counts as an
+  // element for the given object (up to kMaxArrayIndex for JSArrays,
+  // any integer for JSTypedArrays).
+  inline bool IsElement(JSReceiver object) const;
 
   bool IsFound() const { return state_ != NOT_FOUND; }
   void Next();
@@ -180,9 +179,12 @@ class V8_EXPORT_PRIVATE LookupIterator final {
   Handle<Object> GetAccessors() const;
   inline Handle<InterceptorInfo> GetInterceptor() const;
   Handle<InterceptorInfo> GetInterceptorForFailedAccessCheck() const;
-  Handle<Object> GetDataValue() const;
+  Handle<Object> GetDataValue(AllocationPolicy allocation_policy =
+                                  AllocationPolicy::kAllocationAllowed) const;
   void WriteDataValue(Handle<Object> value, bool initializing_store);
   inline void UpdateProtector();
+  static inline void UpdateProtector(Isolate* isolate, Handle<Object> receiver,
+                                     Handle<Name> name);
 
   // Lookup a 'cached' private property for an accessor.
   // If not found returns false and leaves the LookupIterator unmodified.
@@ -190,12 +192,19 @@ class V8_EXPORT_PRIVATE LookupIterator final {
   bool LookupCachedProperty();
 
  private:
+  static const size_t kInvalidIndex = std::numeric_limits<size_t>::max();
+
+  inline LookupIterator(Isolate* isolate, Handle<Object> receiver,
+                        Handle<Name> name, size_t index,
+                        Handle<JSReceiver> holder, Configuration configuration);
+
   // For |ForTransitionHandler|.
   LookupIterator(Isolate* isolate, Handle<Object> receiver, Handle<Name> name,
                  Handle<Map> transition_map, PropertyDetails details,
                  bool has_property);
 
-  void InternalUpdateProtector();
+  static void InternalUpdateProtector(Isolate* isolate, Handle<Object> receiver,
+                                      Handle<Name> name);
 
   enum class InterceptorState {
     kUninitialized,
@@ -207,6 +216,9 @@ class V8_EXPORT_PRIVATE LookupIterator final {
 
   V8_WARN_UNUSED_RESULT inline JSReceiver NextHolder(Map map);
 
+  bool is_js_array_element(bool is_element) const {
+    return is_element && index_ <= JSArray::kMaxArrayIndex;
+  }
   template <bool is_element>
   V8_EXPORT_PRIVATE void Start();
   template <bool is_element>
@@ -227,7 +239,8 @@ class V8_EXPORT_PRIVATE LookupIterator final {
   }
   template <bool is_element>
   void RestartInternal(InterceptorState interceptor_state);
-  Handle<Object> FetchValue() const;
+  Handle<Object> FetchValue(AllocationPolicy allocation_policy =
+                                AllocationPolicy::kAllocationAllowed) const;
   bool IsConstFieldValueEqualTo(Object value) const;
   template <bool is_element>
   void ReloadPropertyInformation();
@@ -235,42 +248,41 @@ class V8_EXPORT_PRIVATE LookupIterator final {
   template <bool is_element>
   bool SkipInterceptor(JSObject holder);
   template <bool is_element>
-  static inline InterceptorInfo GetInterceptor(Isolate* isolate,
-                                               JSObject holder);
+  inline InterceptorInfo GetInterceptor(JSObject holder) const;
 
   bool check_interceptor() const {
     return (configuration_ & kInterceptor) != 0;
   }
   inline InternalIndex descriptor_number() const;
-  inline int dictionary_entry() const;
+  inline InternalIndex dictionary_entry() const;
 
   static inline Configuration ComputeConfiguration(Isolate* isolate,
                                                    Configuration configuration,
                                                    Handle<Name> name);
 
   static Handle<JSReceiver> GetRootForNonJSReceiver(
-      Isolate* isolate, Handle<Object> receiver, uint32_t index = kMaxUInt32);
+      Isolate* isolate, Handle<Object> receiver, size_t index = kInvalidIndex);
   static inline Handle<JSReceiver> GetRoot(Isolate* isolate,
                                            Handle<Object> receiver,
-                                           uint32_t index = kMaxUInt32);
+                                           size_t index = kInvalidIndex);
 
   State NotFound(JSReceiver const holder) const;
 
   // If configuration_ becomes mutable, update
   // HolderIsReceiverOrHiddenPrototype.
   const Configuration configuration_;
-  State state_;
-  bool has_property_;
-  InterceptorState interceptor_state_;
-  PropertyDetails property_details_;
+  State state_ = NOT_FOUND;
+  bool has_property_ = false;
+  InterceptorState interceptor_state_ = InterceptorState::kUninitialized;
+  PropertyDetails property_details_ = PropertyDetails::Empty();
   Isolate* const isolate_;
   Handle<Name> name_;
   Handle<Object> transition_;
   const Handle<Object> receiver_;
   Handle<JSReceiver> holder_;
   const Handle<JSReceiver> initial_holder_;
-  const uint32_t index_;
-  uint32_t number_;
+  const size_t index_;
+  InternalIndex number_ = InternalIndex::NotFound();
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/managed.h b/deps/v8/src/objects/managed.h
index 9653efa1c2949a..c3203df8a571aa 100644
--- a/deps/v8/src/objects/managed.h
+++ b/deps/v8/src/objects/managed.h
@@ -51,7 +51,6 @@ class Managed : public Foreign {
  public:
   Managed() : Foreign() {}
   explicit Managed(Address ptr) : Foreign(ptr) {}
-  Managed* operator->() { return this; }
 
   // Get a raw pointer to the C++ object.
   V8_INLINE CppType* raw() { return GetSharedPtrPtr()->get(); }
diff --git a/deps/v8/src/objects/map-inl.h b/deps/v8/src/objects/map-inl.h
index 557c004401820e..ba37b98fbefbb4 100644
--- a/deps/v8/src/objects/map-inl.h
+++ b/deps/v8/src/objects/map-inl.h
@@ -59,38 +59,42 @@ ACCESSORS_CHECKED(Map, prototype_info, Object,
 // is setup but it's being read by concurrent marker when pointer compression
 // is enabled. The latter bit can be modified on a live objects.
 BIT_FIELD_ACCESSORS(Map, relaxed_bit_field, has_non_instance_prototype,
-                    Map::HasNonInstancePrototypeBit)
-BIT_FIELD_ACCESSORS(Map, bit_field, is_callable, Map::IsCallableBit)
+                    Map::Bits1::HasNonInstancePrototypeBit)
+BIT_FIELD_ACCESSORS(Map, bit_field, is_callable, Map::Bits1::IsCallableBit)
 BIT_FIELD_ACCESSORS(Map, bit_field, has_named_interceptor,
-                    Map::HasNamedInterceptorBit)
+                    Map::Bits1::HasNamedInterceptorBit)
 BIT_FIELD_ACCESSORS(Map, bit_field, has_indexed_interceptor,
-                    Map::HasIndexedInterceptorBit)
-BIT_FIELD_ACCESSORS(Map, bit_field, is_undetectable, Map::IsUndetectableBit)
+                    Map::Bits1::HasIndexedInterceptorBit)
+BIT_FIELD_ACCESSORS(Map, bit_field, is_undetectable,
+                    Map::Bits1::IsUndetectableBit)
 BIT_FIELD_ACCESSORS(Map, bit_field, is_access_check_needed,
-                    Map::IsAccessCheckNeededBit)
-BIT_FIELD_ACCESSORS(Map, bit_field, is_constructor, Map::IsConstructorBit)
+                    Map::Bits1::IsAccessCheckNeededBit)
+BIT_FIELD_ACCESSORS(Map, bit_field, is_constructor,
+                    Map::Bits1::IsConstructorBit)
 BIT_FIELD_ACCESSORS(Map, relaxed_bit_field, has_prototype_slot,
-                    Map::HasPrototypeSlotBit)
+                    Map::Bits1::HasPrototypeSlotBit)
 
 // |bit_field2| fields.
 BIT_FIELD_ACCESSORS(Map, bit_field2, new_target_is_base,
-                    Map::NewTargetIsBaseBit)
+                    Map::Bits2::NewTargetIsBaseBit)
 BIT_FIELD_ACCESSORS(Map, bit_field2, is_immutable_proto,
-                    Map::IsImmutablePrototypeBit)
+                    Map::Bits2::IsImmutablePrototypeBit)
 
 // |bit_field3| fields.
-BIT_FIELD_ACCESSORS(Map, bit_field3, owns_descriptors, Map::OwnsDescriptorsBit)
-BIT_FIELD_ACCESSORS(Map, bit_field3, is_deprecated, Map::IsDeprecatedBit)
+BIT_FIELD_ACCESSORS(Map, bit_field3, owns_descriptors,
+                    Map::Bits3::OwnsDescriptorsBit)
+BIT_FIELD_ACCESSORS(Map, bit_field3, is_deprecated, Map::Bits3::IsDeprecatedBit)
 BIT_FIELD_ACCESSORS(Map, bit_field3, is_in_retained_map_list,
-                    Map::IsInRetainedMapListBit)
-BIT_FIELD_ACCESSORS(Map, bit_field3, is_prototype_map, Map::IsPrototypeMapBit)
+                    Map::Bits3::IsInRetainedMapListBit)
+BIT_FIELD_ACCESSORS(Map, bit_field3, is_prototype_map,
+                    Map::Bits3::IsPrototypeMapBit)
 BIT_FIELD_ACCESSORS(Map, bit_field3, is_migration_target,
-                    Map::IsMigrationTargetBit)
-BIT_FIELD_ACCESSORS(Map, bit_field3, is_extensible, Map::IsExtensibleBit)
+                    Map::Bits3::IsMigrationTargetBit)
+BIT_FIELD_ACCESSORS(Map, bit_field3, is_extensible, Map::Bits3::IsExtensibleBit)
 BIT_FIELD_ACCESSORS(Map, bit_field3, may_have_interesting_symbols,
-                    Map::MayHaveInterestingSymbolsBit)
+                    Map::Bits3::MayHaveInterestingSymbolsBit)
 BIT_FIELD_ACCESSORS(Map, bit_field3, construction_counter,
-                    Map::ConstructionCounterBits)
+                    Map::Bits3::ConstructionCounterBits)
 
 DEF_GETTER(Map, GetNamedInterceptor, InterceptorInfo) {
   DCHECK(has_named_interceptor());
@@ -145,11 +149,11 @@ bool Map::EquivalentToForNormalization(const Map other,
 }
 
 bool Map::IsUnboxedDoubleField(FieldIndex index) const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return IsUnboxedDoubleField(isolate, index);
 }
 
-bool Map::IsUnboxedDoubleField(Isolate* isolate, FieldIndex index) const {
+bool Map::IsUnboxedDoubleField(const Isolate* isolate, FieldIndex index) const {
   if (!FLAG_unbox_double_fields) return false;
   if (!index.is_inobject()) return false;
   return !layout_descriptor(isolate).IsTagged(index.property_index());
@@ -184,21 +188,24 @@ InternalIndex Map::LastAdded() const {
 }
 
 int Map::NumberOfOwnDescriptors() const {
-  return NumberOfOwnDescriptorsBits::decode(bit_field3());
+  return Bits3::NumberOfOwnDescriptorsBits::decode(bit_field3());
 }
 
 void Map::SetNumberOfOwnDescriptors(int number) {
   DCHECK_LE(number, instance_descriptors().number_of_descriptors());
   CHECK_LE(static_cast<unsigned>(number),
            static_cast<unsigned>(kMaxNumberOfDescriptors));
-  set_bit_field3(NumberOfOwnDescriptorsBits::update(bit_field3(), number));
+  set_bit_field3(
+      Bits3::NumberOfOwnDescriptorsBits::update(bit_field3(), number));
 }
 
 InternalIndex::Range Map::IterateOwnDescriptors() const {
   return InternalIndex::Range(NumberOfOwnDescriptors());
 }
 
-int Map::EnumLength() const { return EnumLengthBits::decode(bit_field3()); }
+int Map::EnumLength() const {
+  return Bits3::EnumLengthBits::decode(bit_field3());
+}
 
 void Map::SetEnumLength(int length) {
   if (length != kInvalidEnumCacheSentinel) {
@@ -206,7 +213,7 @@ void Map::SetEnumLength(int length) {
     CHECK_LE(static_cast<unsigned>(length),
              static_cast<unsigned>(kMaxNumberOfDescriptors));
   }
-  set_bit_field3(EnumLengthBits::update(bit_field3(), length));
+  set_bit_field3(Bits3::EnumLengthBits::update(bit_field3(), length));
 }
 
 FixedArrayBase Map::GetInitialElements() const {
@@ -465,11 +472,12 @@ bool Map::should_be_fast_prototype_map() const {
 
 void Map::set_elements_kind(ElementsKind elements_kind) {
   CHECK_LT(static_cast<int>(elements_kind), kElementsKindCount);
-  set_bit_field2(Map::ElementsKindBits::update(bit_field2(), elements_kind));
+  set_bit_field2(
+      Map::Bits2::ElementsKindBits::update(bit_field2(), elements_kind));
 }
 
 ElementsKind Map::elements_kind() const {
-  return Map::ElementsKindBits::decode(bit_field2());
+  return Map::Bits2::ElementsKindBits::decode(bit_field2());
 }
 
 bool Map::has_fast_smi_elements() const {
@@ -529,20 +537,23 @@ bool Map::has_frozen_elements() const {
 }
 
 void Map::set_is_dictionary_map(bool value) {
-  uint32_t new_bit_field3 = IsDictionaryMapBit::update(bit_field3(), value);
-  new_bit_field3 = IsUnstableBit::update(new_bit_field3, value);
+  uint32_t new_bit_field3 =
+      Bits3::IsDictionaryMapBit::update(bit_field3(), value);
+  new_bit_field3 = Bits3::IsUnstableBit::update(new_bit_field3, value);
   set_bit_field3(new_bit_field3);
 }
 
 bool Map::is_dictionary_map() const {
-  return IsDictionaryMapBit::decode(bit_field3());
+  return Bits3::IsDictionaryMapBit::decode(bit_field3());
 }
 
 void Map::mark_unstable() {
-  set_bit_field3(IsUnstableBit::update(bit_field3(), true));
+  set_bit_field3(Bits3::IsUnstableBit::update(bit_field3(), true));
 }
 
-bool Map::is_stable() const { return !IsUnstableBit::decode(bit_field3()); }
+bool Map::is_stable() const {
+  return !Bits3::IsUnstableBit::decode(bit_field3());
+}
 
 bool Map::CanBeDeprecated() const {
   for (InternalIndex i : IterateOwnDescriptors()) {
@@ -626,7 +637,7 @@ void Map::UpdateDescriptors(Isolate* isolate, DescriptorArray descriptors,
       CHECK_EQ(Map::GetVisitorId(*this), visitor_id());
     }
 #else
-    SLOW_DCHECK(layout_descriptor()->IsConsistentWithMap(*this));
+    SLOW_DCHECK(layout_descriptor().IsConsistentWithMap(*this));
     DCHECK(visitor_id() == Map::GetVisitorId(*this));
 #endif
   }
@@ -645,7 +656,7 @@ void Map::InitializeDescriptors(Isolate* isolate, DescriptorArray descriptors,
       CHECK(layout_descriptor().IsConsistentWithMap(*this));
     }
 #else
-    SLOW_DCHECK(layout_descriptor()->IsConsistentWithMap(*this));
+    SLOW_DCHECK(layout_descriptor().IsConsistentWithMap(*this));
 #endif
     set_visitor_id(Map::GetVisitorId(*this));
   }
@@ -730,8 +741,12 @@ Map Map::ElementsTransitionMap(Isolate* isolate) {
 
 ACCESSORS(Map, dependent_code, DependentCode, kDependentCodeOffset)
 ACCESSORS(Map, prototype_validity_cell, Object, kPrototypeValidityCellOffset)
-ACCESSORS(Map, constructor_or_backpointer, Object,
-          kConstructorOrBackPointerOffset)
+ACCESSORS_CHECKED2(Map, constructor_or_backpointer, Object,
+                   kConstructorOrBackPointerOrNativeContextOffset,
+                   !IsContextMap(), value.IsNull() || !IsContextMap())
+ACCESSORS_CHECKED(Map, native_context, NativeContext,
+                  kConstructorOrBackPointerOrNativeContextOffset,
+                  IsContextMap())
 
 bool Map::IsPrototypeValidityCellValid() const {
   Object validity_cell = prototype_validity_cell();
@@ -750,6 +765,17 @@ DEF_GETTER(Map, GetConstructor, Object) {
   return maybe_constructor;
 }
 
+Object Map::TryGetConstructor(Isolate* isolate, int max_steps) {
+  Object maybe_constructor = constructor_or_backpointer(isolate);
+  // Follow any back pointers.
+  while (maybe_constructor.IsMap(isolate)) {
+    if (max_steps-- == 0) return Smi::FromInt(0);
+    maybe_constructor =
+        Map::cast(maybe_constructor).constructor_or_backpointer(isolate);
+  }
+  return maybe_constructor;
+}
+
 DEF_GETTER(Map, GetFunctionTemplateInfo, FunctionTemplateInfo) {
   Object constructor = GetConstructor(isolate);
   if (constructor.IsJSFunction(isolate)) {
diff --git a/deps/v8/src/objects/map.cc b/deps/v8/src/objects/map.cc
index 0f448922ebddf4..d2adfd106013ab 100644
--- a/deps/v8/src/objects/map.cc
+++ b/deps/v8/src/objects/map.cc
@@ -180,6 +180,9 @@ VisitorId Map::GetVisitorId(Map map) {
     case FEEDBACK_CELL_TYPE:
       return kVisitFeedbackCell;
 
+    case FEEDBACK_METADATA_TYPE:
+      return kVisitFeedbackMetadata;
+
     case FEEDBACK_VECTOR_TYPE:
       return kVisitFeedbackVector;
 
@@ -287,6 +290,7 @@ VisitorId Map::GetVisitorId(Map map) {
     case JS_V8_BREAK_ITERATOR_TYPE:
     case JS_COLLATOR_TYPE:
     case JS_DATE_TIME_FORMAT_TYPE:
+    case JS_DISPLAY_NAMES_TYPE:
     case JS_LIST_FORMAT_TYPE:
     case JS_LOCALE_TYPE:
     case JS_NUMBER_FORMAT_TYPE:
@@ -321,7 +325,6 @@ VisitorId Map::GetVisitorId(Map map) {
     case FILLER_TYPE:
     case FOREIGN_TYPE:
     case HEAP_NUMBER_TYPE:
-    case FEEDBACK_METADATA_TYPE:
       return kVisitDataObject;
 
     case BIGINT_TYPE:
@@ -633,9 +636,8 @@ Map Map::FindRootMap(Isolate* isolate) const {
   while (true) {
     Object back = result.GetBackPointer(isolate);
     if (back.IsUndefined(isolate)) {
-      // Initial map always owns descriptors and doesn't have unused entries
-      // in the descriptor array.
-      DCHECK(result.owns_descriptors());
+      // Initial map must not contain descriptors in the descriptors array
+      // that do not belong to the map.
       DCHECK_EQ(result.NumberOfOwnDescriptors(),
                 result.instance_descriptors().number_of_descriptors());
       return result;
@@ -1427,14 +1429,14 @@ Handle<Map> Map::RawCopy(Isolate* isolate, Handle<Map> map, int instance_size,
   result->set_bit_field(map->bit_field());
   result->set_bit_field2(map->bit_field2());
   int new_bit_field3 = map->bit_field3();
-  new_bit_field3 = OwnsDescriptorsBit::update(new_bit_field3, true);
-  new_bit_field3 = NumberOfOwnDescriptorsBits::update(new_bit_field3, 0);
+  new_bit_field3 = Bits3::OwnsDescriptorsBit::update(new_bit_field3, true);
+  new_bit_field3 = Bits3::NumberOfOwnDescriptorsBits::update(new_bit_field3, 0);
   new_bit_field3 =
-      EnumLengthBits::update(new_bit_field3, kInvalidEnumCacheSentinel);
-  new_bit_field3 = IsDeprecatedBit::update(new_bit_field3, false);
-  new_bit_field3 = IsInRetainedMapListBit::update(new_bit_field3, false);
+      Bits3::EnumLengthBits::update(new_bit_field3, kInvalidEnumCacheSentinel);
+  new_bit_field3 = Bits3::IsDeprecatedBit::update(new_bit_field3, false);
+  new_bit_field3 = Bits3::IsInRetainedMapListBit::update(new_bit_field3, false);
   if (!map->is_dictionary_map()) {
-    new_bit_field3 = IsUnstableBit::update(new_bit_field3, false);
+    new_bit_field3 = Bits3::IsUnstableBit::update(new_bit_field3, false);
   }
   result->set_bit_field3(new_bit_field3);
   result->clear_padding();
@@ -1478,7 +1480,8 @@ Handle<Map> Map::Normalize(Isolate* isolate, Handle<Map> fast_map,
       // The IsMigrationTargetBit might be different if the {new_map} from
       // {cache} has already been marked as a migration target.
       constexpr int ignored_bit_field3_bits =
-          IsInRetainedMapListBit::kMask | IsMigrationTargetBit::kMask;
+          Bits3::IsInRetainedMapListBit::kMask |
+          Bits3::IsMigrationTargetBit::kMask;
       DCHECK_EQ(fresh->bit_field3() & ~ignored_bit_field3_bits,
                 new_map->bit_field3() & ~ignored_bit_field3_bits);
       int offset = Map::kBitField3Offset + kInt32Size;
@@ -1492,7 +1495,7 @@ Handle<Map> Map::Normalize(Isolate* isolate, Handle<Map> fast_map,
                       Map::kPrototypeValidityCellOffset + kTaggedSize);
         offset = kTransitionsOrPrototypeInfoOffset + kTaggedSize;
         DCHECK_EQ(fresh->raw_transitions(),
-                  MaybeObject::FromObject(Smi::kZero));
+                  MaybeObject::FromObject(Smi::zero()));
       }
       DCHECK_EQ(0, memcmp(reinterpret_cast<void*>(fresh->address() + offset),
                           reinterpret_cast<void*>(new_map->address() + offset),
@@ -1571,9 +1574,8 @@ void EnsureInitialMap(Isolate* isolate, Handle<Map> map) {
          *map == *isolate->async_function_with_home_object_map() ||
          *map == *isolate->async_function_with_name_and_home_object_map());
 #endif
-  // Initial maps must always own their descriptors and it's descriptor array
-  // does not contain descriptors that do not belong to the map.
-  DCHECK(map->owns_descriptors());
+  // Initial maps must not contain descriptors in the descriptors array
+  // that do not belong to the map.
   DCHECK_EQ(map->NumberOfOwnDescriptors(),
             map->instance_descriptors().number_of_descriptors());
 }
@@ -1591,6 +1593,11 @@ Handle<Map> Map::CopyInitialMap(Isolate* isolate, Handle<Map> map,
                                 int instance_size, int inobject_properties,
                                 int unused_property_fields) {
   EnsureInitialMap(isolate, map);
+  // Initial map must not contain descriptors in the descriptors array
+  // that do not belong to the map.
+  DCHECK_EQ(map->NumberOfOwnDescriptors(),
+            map->instance_descriptors().number_of_descriptors());
+
   Handle<Map> result =
       RawCopy(isolate, map, instance_size, inobject_properties);
 
@@ -1599,9 +1606,10 @@ Handle<Map> Map::CopyInitialMap(Isolate* isolate, Handle<Map> map,
 
   int number_of_own_descriptors = map->NumberOfOwnDescriptors();
   if (number_of_own_descriptors > 0) {
-    // The copy will use the same descriptors array.
-    result->UpdateDescriptors(isolate, map->instance_descriptors(),
-                              map->GetLayoutDescriptor(),
+    // The copy will use the same descriptors array without ownership.
+    DescriptorArray descriptors = map->instance_descriptors();
+    result->set_owns_descriptors(false);
+    result->UpdateDescriptors(isolate, descriptors, map->GetLayoutDescriptor(),
                               number_of_own_descriptors);
 
     DCHECK_EQ(result->NumberOfFields(),
@@ -1681,9 +1689,8 @@ void Map::ConnectTransition(Isolate* isolate, Handle<Map> parent,
   if (!parent->GetBackPointer().IsUndefined(isolate)) {
     parent->set_owns_descriptors(false);
   } else {
-    // |parent| is initial map and it must keep the ownership, there must be no
-    // descriptors in the descriptors array that do not belong to the map.
-    DCHECK(parent->owns_descriptors());
+    // |parent| is initial map and it must not contain descriptors in the
+    // descriptors array that do not belong to the map.
     DCHECK_EQ(parent->NumberOfOwnDescriptors(),
               parent->instance_descriptors().number_of_descriptors());
   }
@@ -1822,7 +1829,7 @@ void Map::InstallDescriptors(Isolate* isolate, Handle<Map> parent,
       CHECK(child->layout_descriptor().IsConsistentWithMap(*child));
     }
 #else
-    SLOW_DCHECK(child->layout_descriptor()->IsConsistentWithMap(*child));
+    SLOW_DCHECK(child->layout_descriptor().IsConsistentWithMap(*child));
 #endif
     child->set_visitor_id(Map::GetVisitorId(*child));
   }
@@ -1927,6 +1934,7 @@ Handle<Map> Map::CopyForElementsTransition(Isolate* isolate, Handle<Map> map) {
     // In case the map owned its own descriptors, share the descriptors and
     // transfer ownership to the new map.
     // The properties did not change, so reuse descriptors.
+    map->set_owns_descriptors(false);
     new_map->InitializeDescriptors(isolate, map->instance_descriptors(),
                                    map->GetLayoutDescriptor());
   } else {
@@ -2119,7 +2127,7 @@ Handle<Map> Map::TransitionToDataProperty(Isolate* isolate, Handle<Map> map,
                                           PropertyConstness constness,
                                           StoreOrigin store_origin) {
   RuntimeCallTimerScope stats_scope(
-      isolate, *map,
+      isolate,
       map->is_prototype_map()
           ? RuntimeCallCounterId::kPrototypeMap_TransitionToDataProperty
           : RuntimeCallCounterId::kMap_TransitionToDataProperty);
@@ -2478,9 +2486,10 @@ bool Map::EquivalentToForNormalization(const Map other,
   int properties =
       mode == CLEAR_INOBJECT_PROPERTIES ? 0 : other.GetInObjectProperties();
   // Make sure the elements_kind bits are in bit_field2.
-  DCHECK_EQ(this->elements_kind(), Map::ElementsKindBits::decode(bit_field2()));
+  DCHECK_EQ(this->elements_kind(),
+            Map::Bits2::ElementsKindBits::decode(bit_field2()));
   int adjusted_other_bit_field2 =
-      Map::ElementsKindBits::update(other.bit_field2(), elements_kind);
+      Map::Bits2::ElementsKindBits::update(other.bit_field2(), elements_kind);
   return CheckEquivalent(*this, other) &&
          bit_field2() == adjusted_other_bit_field2 &&
          GetInObjectProperties() == properties &&
@@ -2634,7 +2643,7 @@ bool Map::IsPrototypeChainInvalidated(Map map) {
 void Map::SetPrototype(Isolate* isolate, Handle<Map> map,
                        Handle<HeapObject> prototype,
                        bool enable_prototype_setup_mode) {
-  RuntimeCallTimerScope stats_scope(isolate, *map,
+  RuntimeCallTimerScope stats_scope(isolate,
                                     RuntimeCallCounterId::kMap_SetPrototype);
 
   if (prototype->IsJSObject()) {
diff --git a/deps/v8/src/objects/map.h b/deps/v8/src/objects/map.h
index 0daadbee088bb7..60f1fb6e9c2714 100644
--- a/deps/v8/src/objects/map.h
+++ b/deps/v8/src/objects/map.h
@@ -5,11 +5,13 @@
 #ifndef V8_OBJECTS_MAP_H_
 #define V8_OBJECTS_MAP_H_
 
+#include "src/base/bit-field.h"
 #include "src/common/globals.h"
 #include "src/objects/code.h"
 #include "src/objects/heap-object.h"
 #include "src/objects/internal-index.h"
 #include "src/objects/objects.h"
+#include "torque-generated/bit-fields-tq.h"
 #include "torque-generated/field-offsets-tq.h"
 
 // Has to be the last include (doesn't have include guards):
@@ -24,6 +26,7 @@ enum InstanceType : uint16_t;
   V(BigInt)                          \
   V(ByteArray)                       \
   V(DataObject)                      \
+  V(FeedbackMetadata)                \
   V(FixedDoubleArray)                \
   V(SeqOneByteString)                \
   V(SeqTwoByteString)
@@ -105,86 +108,86 @@ using MapHandles = std::vector<Handle<Map>>;
 //  - How to iterate over an object (for garbage collection)
 //
 // Map layout:
-// +---------------+---------------------------------------------+
-// |   _ Type _    | _ Description _                             |
-// +---------------+---------------------------------------------+
-// | TaggedPointer | map - Always a pointer to the MetaMap root  |
-// +---------------+---------------------------------------------+
-// | Int           | The first int field                         |
-//  `---+----------+---------------------------------------------+
-//      | Byte     | [instance_size]                             |
-//      +----------+---------------------------------------------+
-//      | Byte     | If Map for a primitive type:                |
-//      |          |   native context index for constructor fn   |
-//      |          | If Map for an Object type:                  |
-//      |          |   inobject properties start offset in words |
-//      +----------+---------------------------------------------+
-//      | Byte     | [used_or_unused_instance_size_in_words]     |
-//      |          | For JSObject in fast mode this byte encodes |
-//      |          | the size of the object that includes only   |
-//      |          | the used property fields or the slack size  |
-//      |          | in properties backing store.                |
-//      +----------+---------------------------------------------+
-//      | Byte     | [visitor_id]                                |
-// +----+----------+---------------------------------------------+
-// | Int           | The second int field                        |
-//  `---+----------+---------------------------------------------+
-//      | Short    | [instance_type]                             |
-//      +----------+---------------------------------------------+
-//      | Byte     | [bit_field]                                 |
-//      |          |   - has_non_instance_prototype (bit 0)      |
-//      |          |   - is_callable (bit 1)                     |
-//      |          |   - has_named_interceptor (bit 2)           |
-//      |          |   - has_indexed_interceptor (bit 3)         |
-//      |          |   - is_undetectable (bit 4)                 |
-//      |          |   - is_access_check_needed (bit 5)          |
-//      |          |   - is_constructor (bit 6)                  |
-//      |          |   - has_prototype_slot (bit 7)              |
-//      +----------+---------------------------------------------+
-//      | Byte     | [bit_field2]                                |
-//      |          |   - new_target_is_base (bit 0)              |
-//      |          |   - is_immutable_proto (bit 1)              |
-//      |          |   - unused bit (bit 2)                      |
-//      |          |   - elements_kind (bits 3..7)               |
-// +----+----------+---------------------------------------------+
-// | Int           | [bit_field3]                                |
-// |               |   - enum_length (bit 0..9)                  |
-// |               |   - number_of_own_descriptors (bit 10..19)  |
-// |               |   - is_prototype_map (bit 20)               |
-// |               |   - is_dictionary_map (bit 21)              |
-// |               |   - owns_descriptors (bit 22)               |
-// |               |   - is_in_retained_map_list (bit 23)        |
-// |               |   - is_deprecated (bit 24)                  |
-// |               |   - is_unstable (bit 25)                    |
-// |               |   - is_migration_target (bit 26)            |
-// |               |   - is_extensible (bit 28)                  |
-// |               |   - may_have_interesting_symbols (bit 28)   |
-// |               |   - construction_counter (bit 29..31)       |
-// |               |                                             |
-// +*************************************************************+
-// | Int           | On systems with 64bit pointer types, there  |
-// |               | is an unused 32bits after bit_field3        |
-// +*************************************************************+
-// | TaggedPointer | [prototype]                                 |
-// +---------------+---------------------------------------------+
-// | TaggedPointer | [constructor_or_backpointer]                |
-// +---------------+---------------------------------------------+
-// | TaggedPointer | [instance_descriptors]                      |
-// +*************************************************************+
-// ! TaggedPointer ! [layout_descriptors]                        !
-// !               ! Field is only present if compile-time flag  !
-// !               ! FLAG_unbox_double_fields is enabled         !
-// !               ! (basically on 64 bit architectures)         !
-// +*************************************************************+
-// | TaggedPointer | [dependent_code]                            |
-// +---------------+---------------------------------------------+
-// | TaggedPointer | [prototype_validity_cell]                   |
-// +---------------+---------------------------------------------+
-// | TaggedPointer | If Map is a prototype map:                  |
-// |               |   [prototype_info]                          |
-// |               | Else:                                       |
-// |               |   [raw_transitions]                         |
-// +---------------+---------------------------------------------+
+// +---------------+------------------------------------------------+
+// |   _ Type _    | _ Description _                                |
+// +---------------+------------------------------------------------+
+// | TaggedPointer | map - Always a pointer to the MetaMap root     |
+// +---------------+------------------------------------------------+
+// | Int           | The first int field                            |
+//  `---+----------+------------------------------------------------+
+//      | Byte     | [instance_size]                                |
+//      +----------+------------------------------------------------+
+//      | Byte     | If Map for a primitive type:                   |
+//      |          |   native context index for constructor fn      |
+//      |          | If Map for an Object type:                     |
+//      |          |   inobject properties start offset in words    |
+//      +----------+------------------------------------------------+
+//      | Byte     | [used_or_unused_instance_size_in_words]        |
+//      |          | For JSObject in fast mode this byte encodes    |
+//      |          | the size of the object that includes only      |
+//      |          | the used property fields or the slack size     |
+//      |          | in properties backing store.                   |
+//      +----------+------------------------------------------------+
+//      | Byte     | [visitor_id]                                   |
+// +----+----------+------------------------------------------------+
+// | Int           | The second int field                           |
+//  `---+----------+------------------------------------------------+
+//      | Short    | [instance_type]                                |
+//      +----------+------------------------------------------------+
+//      | Byte     | [bit_field]                                    |
+//      |          |   - has_non_instance_prototype (bit 0)         |
+//      |          |   - is_callable (bit 1)                        |
+//      |          |   - has_named_interceptor (bit 2)              |
+//      |          |   - has_indexed_interceptor (bit 3)            |
+//      |          |   - is_undetectable (bit 4)                    |
+//      |          |   - is_access_check_needed (bit 5)             |
+//      |          |   - is_constructor (bit 6)                     |
+//      |          |   - has_prototype_slot (bit 7)                 |
+//      +----------+------------------------------------------------+
+//      | Byte     | [bit_field2]                                   |
+//      |          |   - new_target_is_base (bit 0)                 |
+//      |          |   - is_immutable_proto (bit 1)                 |
+//      |          |   - unused bit (bit 2)                         |
+//      |          |   - elements_kind (bits 3..7)                  |
+// +----+----------+------------------------------------------------+
+// | Int           | [bit_field3]                                   |
+// |               |   - enum_length (bit 0..9)                     |
+// |               |   - number_of_own_descriptors (bit 10..19)     |
+// |               |   - is_prototype_map (bit 20)                  |
+// |               |   - is_dictionary_map (bit 21)                 |
+// |               |   - owns_descriptors (bit 22)                  |
+// |               |   - is_in_retained_map_list (bit 23)           |
+// |               |   - is_deprecated (bit 24)                     |
+// |               |   - is_unstable (bit 25)                       |
+// |               |   - is_migration_target (bit 26)               |
+// |               |   - is_extensible (bit 28)                     |
+// |               |   - may_have_interesting_symbols (bit 28)      |
+// |               |   - construction_counter (bit 29..31)          |
+// |               |                                                |
+// +****************************************************************+
+// | Int           | On systems with 64bit pointer types, there     |
+// |               | is an unused 32bits after bit_field3           |
+// +****************************************************************+
+// | TaggedPointer | [prototype]                                    |
+// +---------------+------------------------------------------------+
+// | TaggedPointer | [constructor_or_backpointer_or_native_context] |
+// +---------------+------------------------------------------------+
+// | TaggedPointer | [instance_descriptors]                         |
+// +****************************************************************+
+// ! TaggedPointer ! [layout_descriptors]                           !
+// !               ! Field is only present if compile-time flag     !
+// !               ! FLAG_unbox_double_fields is enabled            !
+// !               ! (basically on 64 bit architectures)            !
+// +****************************************************************+
+// | TaggedPointer | [dependent_code]                               |
+// +---------------+------------------------------------------------+
+// | TaggedPointer | [prototype_validity_cell]                      |
+// +---------------+------------------------------------------------+
+// | TaggedPointer | If Map is a prototype map:                     |
+// |               |   [prototype_info]                             |
+// |               | Else:                                          |
+// |               |   [raw_transitions]                            |
+// +---------------+------------------------------------------------+
 
 class Map : public HeapObject {
  public:
@@ -249,34 +252,16 @@ class Map : public HeapObject {
   // Atomic accessors, used for whitelisting legitimate concurrent accesses.
   DECL_PRIMITIVE_ACCESSORS(relaxed_bit_field, byte)
 
-// Bit positions for |bit_field|.
-#define MAP_BIT_FIELD_FIELDS(V, _)          \
-  V(HasNonInstancePrototypeBit, bool, 1, _) \
-  V(IsCallableBit, bool, 1, _)              \
-  V(HasNamedInterceptorBit, bool, 1, _)     \
-  V(HasIndexedInterceptorBit, bool, 1, _)   \
-  V(IsUndetectableBit, bool, 1, _)          \
-  V(IsAccessCheckNeededBit, bool, 1, _)     \
-  V(IsConstructorBit, bool, 1, _)           \
-  V(HasPrototypeSlotBit, bool, 1, _)
-
-  DEFINE_BIT_FIELDS(MAP_BIT_FIELD_FIELDS)
-#undef MAP_BIT_FIELD_FIELDS
+  // Bit positions for |bit_field|.
+  using Bits1 = TorqueGeneratedMapBitFields1Fields;
 
   //
   // Bit field 2.
   //
   DECL_PRIMITIVE_ACCESSORS(bit_field2, byte)
 
-// Bit positions for |bit_field2|.
-#define MAP_BIT_FIELD2_FIELDS(V, _)      \
-  V(NewTargetIsBaseBit, bool, 1, _)      \
-  V(IsImmutablePrototypeBit, bool, 1, _) \
-  V(UnusedBit, bool, 1, _)               \
-  V(ElementsKindBits, ElementsKind, 5, _)
-
-  DEFINE_BIT_FIELDS(MAP_BIT_FIELD2_FIELDS)
-#undef MAP_BIT_FIELD2_FIELDS
+  // Bit positions for |bit_field2|.
+  using Bits2 = TorqueGeneratedMapBitFields2Fields;
 
   //
   // Bit field 3.
@@ -287,30 +272,22 @@ class Map : public HeapObject {
   // is deterministic. Depending on the V8 build mode there could be no padding.
   V8_INLINE void clear_padding();
 
-// Bit positions for |bit_field3|.
-#define MAP_BIT_FIELD3_FIELDS(V, _)                               \
-  V(EnumLengthBits, int, kDescriptorIndexBitCount, _)             \
-  V(NumberOfOwnDescriptorsBits, int, kDescriptorIndexBitCount, _) \
-  V(IsPrototypeMapBit, bool, 1, _)                                \
-  V(IsDictionaryMapBit, bool, 1, _)                               \
-  V(OwnsDescriptorsBit, bool, 1, _)                               \
-  V(IsInRetainedMapListBit, bool, 1, _)                           \
-  V(IsDeprecatedBit, bool, 1, _)                                  \
-  V(IsUnstableBit, bool, 1, _)                                    \
-  V(IsMigrationTargetBit, bool, 1, _)                             \
-  V(IsExtensibleBit, bool, 1, _)                                  \
-  V(MayHaveInterestingSymbolsBit, bool, 1, _)                     \
-  V(ConstructionCounterBits, int, 3, _)
-
-  DEFINE_BIT_FIELDS(MAP_BIT_FIELD3_FIELDS)
-#undef MAP_BIT_FIELD3_FIELDS
-
-  STATIC_ASSERT(NumberOfOwnDescriptorsBits::kMax >= kMaxNumberOfDescriptors);
+  // Bit positions for |bit_field3|.
+  using Bits3 = TorqueGeneratedMapBitFields3Fields;
+
+  // Ensure that Torque-defined bit widths for |bit_field3| are as expected.
+  STATIC_ASSERT(Bits3::EnumLengthBits::kSize == kDescriptorIndexBitCount);
+  STATIC_ASSERT(Bits3::NumberOfOwnDescriptorsBits::kSize ==
+                kDescriptorIndexBitCount);
+
+  STATIC_ASSERT(Bits3::NumberOfOwnDescriptorsBits::kMax >=
+                kMaxNumberOfDescriptors);
 
   static const int kSlackTrackingCounterStart = 7;
   static const int kSlackTrackingCounterEnd = 1;
   static const int kNoSlackTracking = 0;
-  STATIC_ASSERT(kSlackTrackingCounterStart <= ConstructionCounterBits::kMax);
+  STATIC_ASSERT(kSlackTrackingCounterStart <=
+                Bits3::ConstructionCounterBits::kMax);
 
   // Inobject slack tracking is the way to reclaim unused inobject space.
   //
@@ -581,11 +558,17 @@ class Map : public HeapObject {
   // back pointer chain until they find the map holding their constructor.
   // Returns null_value if there's neither a constructor function nor a
   // FunctionTemplateInfo available.
+  // The field also overlaps with the native context pointer for context maps.
   DECL_ACCESSORS(constructor_or_backpointer, Object)
+  DECL_ACCESSORS(native_context, NativeContext)
   DECL_GETTER(GetConstructor, Object)
   DECL_GETTER(GetFunctionTemplateInfo, FunctionTemplateInfo)
   inline void SetConstructor(Object constructor,
                              WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  // Constructor getter that performs at most the given number of steps
+  // in the transition tree. Returns either the constructor or the map at
+  // which the walk has stopped.
+  inline Object TryGetConstructor(Isolate* isolate, int max_steps);
   // [back pointer]: points back to the parent map from which a transition
   // leads to this map. The field overlaps with the constructor (see above).
   DECL_GETTER(GetBackPointer, HeapObject)
@@ -860,7 +843,8 @@ class Map : public HeapObject {
 
   // Returns true if given field is unboxed double.
   inline bool IsUnboxedDoubleField(FieldIndex index) const;
-  inline bool IsUnboxedDoubleField(Isolate* isolate, FieldIndex index) const;
+  inline bool IsUnboxedDoubleField(const Isolate* isolate,
+                                   FieldIndex index) const;
 
   void PrintMapDetails(std::ostream& os);
 
@@ -980,7 +964,8 @@ class Map : public HeapObject {
   static const int kMaxFastProperties = 128;
 
   friend class MapUpdater;
-  friend class ConcurrentMarkingVisitor;
+  template <typename ConcreteVisitor, typename MarkingState>
+  friend class MarkingVisitorBase;
 
   OBJECT_CONSTRUCTORS(Map, HeapObject);
 };
@@ -1002,7 +987,7 @@ class NormalizedMapCache : public WeakFixedArray {
   DECL_VERIFIER(NormalizedMapCache)
 
  private:
-  friend bool HeapObject::IsNormalizedMapCache(Isolate* isolate) const;
+  friend bool HeapObject::IsNormalizedMapCache(const Isolate* isolate) const;
 
   static const int kEntries = 64;
 
diff --git a/deps/v8/src/objects/map.tq b/deps/v8/src/objects/map.tq
new file mode 100644
index 00000000000000..93c56278955985
--- /dev/null
+++ b/deps/v8/src/objects/map.tq
@@ -0,0 +1,82 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+bitfield struct MapBitFields1 extends uint8 {
+  has_non_instance_prototype: bool: 1 bit;
+  is_callable: bool: 1 bit;
+  has_named_interceptor: bool: 1 bit;
+  has_indexed_interceptor: bool: 1 bit;
+  is_undetectable: bool: 1 bit;
+  is_access_check_needed: bool: 1 bit;
+  is_constructor: bool: 1 bit;
+  has_prototype_slot: bool: 1 bit;
+}
+
+bitfield struct MapBitFields2 extends uint8 {
+  new_target_is_base: bool: 1 bit;
+  is_immutable_prototype: bool: 1 bit;
+  unused: bool: 1 bit;
+  elements_kind: ElementsKind: 5 bit;
+}
+
+bitfield struct MapBitFields3 extends uint32 {
+  enum_length: int32: 10 bit;
+  number_of_own_descriptors: int32: 10 bit;
+  is_prototype_map: bool: 1 bit;
+  is_dictionary_map: bool: 1 bit;
+  owns_descriptors: bool: 1 bit;
+  is_in_retained_map_list: bool: 1 bit;
+  is_deprecated: bool: 1 bit;
+  is_unstable: bool: 1 bit;
+  is_migration_target: bool: 1 bit;
+  is_extensible: bool: 1 bit;
+  may_have_interesting_symbols: bool: 1 bit;
+  construction_counter: int32: 3 bit;
+}
+
+extern class Map extends HeapObject {
+  macro PrototypeInfo(): PrototypeInfo labels HasNoPrototypeInfo {
+    typeswitch (this.transitions_or_prototype_info) {
+      case (Weak<Map>): {
+        goto HasNoPrototypeInfo;
+      }
+      case (Smi): {
+        goto HasNoPrototypeInfo;
+      }
+      case (info: PrototypeInfo): {
+        return info;
+      }
+      case (Map | TransitionArray): {
+        goto HasNoPrototypeInfo;
+      }
+    }
+  }
+
+  instance_size_in_words: uint8;
+  in_object_properties_start_or_constructor_function_index: uint8;
+  used_or_unused_instance_size_in_words: uint8;
+  visitor_id: uint8;
+  instance_type: InstanceType;
+  bit_field: MapBitFields1;
+  bit_field2: MapBitFields2;
+  bit_field3: MapBitFields3;
+
+  @if(TAGGED_SIZE_8_BYTES) optional_padding: uint32;
+  @ifnot(TAGGED_SIZE_8_BYTES) optional_padding: void;
+
+  prototype: JSReceiver|Null;
+  constructor_or_back_pointer_or_native_context: Object;
+  instance_descriptors: DescriptorArray;
+  @if(V8_DOUBLE_FIELDS_UNBOXING) layout_descriptor: LayoutDescriptor;
+  @ifnot(V8_DOUBLE_FIELDS_UNBOXING) layout_descriptor: void;
+  dependent_code: DependentCode;
+  prototype_validity_cell: Smi|Cell;
+  weak transitions_or_prototype_info: Map|Weak<Map>|TransitionArray|
+      PrototypeInfo|Smi;
+}
+
+@export
+macro LoadMapPrototypeInfo(m: Map): PrototypeInfo labels HasNoPrototypeInfo {
+  return m.PrototypeInfo() otherwise HasNoPrototypeInfo;
+}
diff --git a/deps/v8/src/objects/microtask.tq b/deps/v8/src/objects/microtask.tq
new file mode 100644
index 00000000000000..72c9cb5d2a47a7
--- /dev/null
+++ b/deps/v8/src/objects/microtask.tq
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@abstract
+@generateCppClass
+extern class Microtask extends Struct {
+}
+
+@generateCppClass
+extern class CallbackTask extends Microtask {
+  callback: Foreign;
+  data: Foreign;
+}
+
+@generateCppClass
+extern class CallableTask extends Microtask {
+  callable: JSReceiver;
+  context: Context;
+}
diff --git a/deps/v8/src/objects/module.cc b/deps/v8/src/objects/module.cc
index 9c37de0c855dd0..2101589f602861 100644
--- a/deps/v8/src/objects/module.cc
+++ b/deps/v8/src/objects/module.cc
@@ -67,13 +67,20 @@ void Module::RecordError(Isolate* isolate, Handle<Object> error) {
   PrintStatusTransition(Module::kErrored);
 #endif  // DEBUG
   set_status(Module::kErrored);
-  set_exception(*error);
+  if (isolate->is_catchable_by_javascript(*error)) {
+    set_exception(*error);
+  } else {
+    // v8::TryCatch uses `null` for termination exceptions.
+    set_exception(*isolate->factory()->null_value());
+  }
 }
 
 void Module::ResetGraph(Isolate* isolate, Handle<Module> module) {
-  DCHECK_NE(module->status(), kInstantiating);
   DCHECK_NE(module->status(), kEvaluating);
-  if (module->status() != kPreInstantiating) return;
+  if (module->status() != kPreInstantiating &&
+      module->status() != kInstantiating) {
+    return;
+  }
 
   Handle<FixedArray> requested_modules =
       module->IsSourceTextModule()
@@ -175,15 +182,14 @@ bool Module::Instantiate(Isolate* isolate, Handle<Module> module,
 
   if (!PrepareInstantiate(isolate, module, context, callback)) {
     ResetGraph(isolate, module);
+    DCHECK_EQ(module->status(), kUninstantiated);
     return false;
   }
   Zone zone(isolate->allocator(), ZONE_NAME);
   ZoneForwardList<Handle<SourceTextModule>> stack(&zone);
   unsigned dfs_index = 0;
   if (!FinishInstantiate(isolate, module, &stack, &dfs_index, &zone)) {
-    for (auto& descendant : stack) {
-      Reset(isolate, descendant);
-    }
+    ResetGraph(isolate, module);
     DCHECK_EQ(module->status(), kUninstantiated);
     return false;
   }
@@ -303,7 +309,7 @@ Handle<JSModuleNamespace> Module::GetModuleNamespace(Isolate* isolate,
   Handle<ObjectHashTable> exports(module->exports(), isolate);
   ZoneVector<Handle<String>> names(&zone);
   names.reserve(exports->NumberOfElements());
-  for (int i = 0, n = exports->Capacity(); i < n; ++i) {
+  for (InternalIndex i : exports->IterateEntries()) {
     Object key;
     if (!exports->ToKey(roots, i, &key)) continue;
     names.push_back(handle(String::cast(key), isolate));
diff --git a/deps/v8/src/objects/module.h b/deps/v8/src/objects/module.h
index d0ea22e6e58235..3907ea32dff942 100644
--- a/deps/v8/src/objects/module.h
+++ b/deps/v8/src/objects/module.h
@@ -80,8 +80,8 @@ class Module : public HeapObject {
   static Handle<JSModuleNamespace> GetModuleNamespace(Isolate* isolate,
                                                       Handle<Module> module);
 
-// Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(Struct::kHeaderSize,
+  // Layout description.
+  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
                                 TORQUE_GENERATED_MODULE_FIELDS)
 
   using BodyDescriptor =
diff --git a/deps/v8/src/objects/module.tq b/deps/v8/src/objects/module.tq
new file mode 100644
index 00000000000000..c581e8d052e00d
--- /dev/null
+++ b/deps/v8/src/objects/module.tq
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@abstract
+extern class Module extends HeapObject {
+  exports: ObjectHashTable;
+  hash: Smi;
+  status: Smi;
+  module_namespace: JSModuleNamespace|Undefined;
+  exception: Object;
+}
+
+@generateCppClass
+extern class JSModuleNamespace extends JSSpecialObject {
+  module: Module;
+}
diff --git a/deps/v8/src/objects/name-inl.h b/deps/v8/src/objects/name-inl.h
index 88ae2feea58b61..0735b4e506fbcb 100644
--- a/deps/v8/src/objects/name-inl.h
+++ b/deps/v8/src/objects/name-inl.h
@@ -28,6 +28,18 @@ BIT_FIELD_ACCESSORS(Symbol, flags, is_in_public_symbol_table,
 BIT_FIELD_ACCESSORS(Symbol, flags, is_interesting_symbol,
                     Symbol::IsInterestingSymbolBit)
 
+bool Symbol::is_private_brand() const {
+  bool value = Symbol::IsPrivateBrandBit::decode(flags());
+  DCHECK_IMPLIES(value, is_private());
+  return value;
+}
+
+void Symbol::set_is_private_brand() {
+  set_flags(Symbol::IsPrivateBit::update(flags(), true));
+  set_flags(Symbol::IsPrivateNameBit::update(flags(), true));
+  set_flags(Symbol::IsPrivateBrandBit::update(flags(), true));
+}
+
 bool Symbol::is_private_name() const {
   bool value = Symbol::IsPrivateNameBit::decode(flags());
   DCHECK_IMPLIES(value, is_private());
@@ -97,6 +109,13 @@ DEF_GETTER(Name, IsPrivateName, bool) {
   return is_private_name;
 }
 
+DEF_GETTER(Name, IsPrivateBrand, bool) {
+  bool is_private_brand =
+      this->IsSymbol(isolate) && Symbol::cast(*this).is_private_brand();
+  DCHECK_IMPLIES(is_private_brand, IsPrivateName());
+  return is_private_brand;
+}
+
 bool Name::AsArrayIndex(uint32_t* index) {
   return IsString() && String::cast(*this).AsArrayIndex(index);
 }
diff --git a/deps/v8/src/objects/name.h b/deps/v8/src/objects/name.h
index 386b9ec0556033..783beb12a514a7 100644
--- a/deps/v8/src/objects/name.h
+++ b/deps/v8/src/objects/name.h
@@ -5,8 +5,10 @@
 #ifndef V8_OBJECTS_NAME_H_
 #define V8_OBJECTS_NAME_H_
 
+#include "src/base/bit-field.h"
 #include "src/objects/objects.h"
 #include "src/objects/primitive-heap-object.h"
+#include "torque-generated/bit-fields-tq.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -38,20 +40,20 @@ class Name : public TorqueGeneratedName<Name, PrimitiveHeapObject> {
   // We optimize this by setting a flag on the object's map when such
   // symbol properties are added, so we can optimize lookups on objects
   // that don't have the flag.
-  inline bool IsInterestingSymbol() const;
-  inline bool IsInterestingSymbol(Isolate* isolate) const;
+  DECL_GETTER(IsInterestingSymbol, bool)
 
   // If the name is private, it can only name own properties.
-  inline bool IsPrivate() const;
-  inline bool IsPrivate(Isolate* isolate) const;
+  DECL_GETTER(IsPrivate, bool)
 
   // If the name is a private name, it should behave like a private
   // symbol but also throw on property access miss.
-  inline bool IsPrivateName() const;
-  inline bool IsPrivateName(Isolate* isolate) const;
+  DECL_GETTER(IsPrivateName, bool)
 
-  inline bool IsUniqueName() const;
-  inline bool IsUniqueName(Isolate* isolate) const;
+  // If the name is a private brand, it should behave like a private name
+  // symbol but is filtered out when generating list of private fields.
+  DECL_GETTER(IsPrivateBrand, bool)
+
+  DECL_GETTER(IsUniqueName, bool)
 
   static inline bool ContainsCachedArrayIndex(uint32_t hash);
 
@@ -89,14 +91,13 @@ class Name : public TorqueGeneratedName<Name, PrimitiveHeapObject> {
   // Maximum number of characters to consider when trying to convert a string
   // value into an array index.
   static const int kMaxArrayIndexSize = 10;
-  // Maximum number of characters that might be parsed into a size_t:
-  // 10 characters per 32 bits of size_t width.
-  // We choose this as large as possible (rather than MAX_SAFE_INTEGER range)
-  // because TypedArray accesses will treat all string keys that are
-  // canonical representations of numbers in the range [MAX_SAFE_INTEGER ..
-  // size_t::max] as out-of-bounds accesses, and we can handle those in the
-  // fast path if we tag them as such (see kIsNotIntegerIndexMask).
-  static const int kMaxIntegerIndexSize = 10 * (sizeof(size_t) / 4);
+  // Maximum number of characters in a string that can possibly be an
+  // "integer index" in the spec sense, i.e. a canonical representation of a
+  // number in the range up to MAX_SAFE_INTEGER. We parse these into a size_t,
+  // so the size of that type also factors in as a limit: 10 characters per
+  // 32 bits of size_t width.
+  static const int kMaxIntegerIndexSize =
+      std::min(16, int{10 * (sizeof(size_t) / 4)});
 
   // For strings which are array indexes the hash value has the string length
   // mixed into the hash, mainly to avoid a hash value of zero which would be
@@ -109,10 +110,10 @@ class Name : public TorqueGeneratedName<Name, PrimitiveHeapObject> {
   STATIC_ASSERT(kMaxArrayIndexSize < (1 << kArrayIndexLengthBits));
 
   using ArrayIndexValueBits =
-      BitField<unsigned int, kNofHashBitFields, kArrayIndexValueBits>;
+      base::BitField<unsigned int, kNofHashBitFields, kArrayIndexValueBits>;
   using ArrayIndexLengthBits =
-      BitField<unsigned int, kNofHashBitFields + kArrayIndexValueBits,
-               kArrayIndexLengthBits>;
+      base::BitField<unsigned int, kNofHashBitFields + kArrayIndexValueBits,
+                     kArrayIndexLengthBits>;
 
   // Check that kMaxCachedArrayIndexLength + 1 is a power of two so we
   // could use a mask to test if the length of string is less than or equal to
@@ -138,7 +139,8 @@ class Name : public TorqueGeneratedName<Name, PrimitiveHeapObject> {
 };
 
 // ES6 symbols.
-class Symbol : public TorqueGeneratedSymbol<Symbol, Name> {
+class Symbol : public TorqueGeneratedSymbol<Symbol, Name>,
+               public TorqueGeneratedSymbolFlagsFields {
  public:
   // [is_private]: Whether this is a private symbol.  Private symbols can only
   // be used to designate own properties of objects.
@@ -168,22 +170,19 @@ class Symbol : public TorqueGeneratedSymbol<Symbol, Name> {
   inline bool is_private_name() const;
   inline void set_is_private_name();
 
+  // [is_private_name]: Whether this is a brand symbol.  Brand symbols are
+  // private name symbols that are used for validating access to
+  // private methods and storing information about the private methods.
+  //
+  // This also sets the is_private bit.
+  inline bool is_private_brand() const;
+  inline void set_is_private_brand();
+
   // Dispatched behavior.
   DECL_PRINTER(Symbol)
   DECL_VERIFIER(Symbol)
 
-// Flags layout.
-#define FLAGS_BIT_FIELDS(V, _)            \
-  V(IsPrivateBit, bool, 1, _)             \
-  V(IsWellKnownSymbolBit, bool, 1, _)     \
-  V(IsInPublicSymbolTableBit, bool, 1, _) \
-  V(IsInterestingSymbolBit, bool, 1, _)   \
-  V(IsPrivateNameBit, bool, 1, _)
-
-  DEFINE_BIT_FIELDS(FLAGS_BIT_FIELDS)
-#undef FLAGS_BIT_FIELDS
-
-  using BodyDescriptor = FixedBodyDescriptor<kNameOffset, kSize, kSize>;
+  using BodyDescriptor = FixedBodyDescriptor<kDescriptionOffset, kSize, kSize>;
 
   void SymbolShortPrint(std::ostream& os);
 
diff --git a/deps/v8/src/objects/name.tq b/deps/v8/src/objects/name.tq
new file mode 100644
index 00000000000000..70bb6aea1842d4
--- /dev/null
+++ b/deps/v8/src/objects/name.tq
@@ -0,0 +1,33 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@abstract
+@generateCppClass
+extern class Name extends PrimitiveHeapObject {
+  hash_field: uint32;
+}
+// This is the same as Name, but with the information that there are no other
+// kinds of names.
+type AnyName = PrivateSymbol|PublicSymbol|String;
+
+bitfield struct SymbolFlags extends uint32 {
+  is_private: bool: 1 bit;
+  is_well_known_symbol: bool: 1 bit;
+  is_in_public_symbol_table: bool: 1 bit;
+  is_interesting_symbol: bool: 1 bit;
+  is_private_name: bool: 1 bit;
+  is_private_brand: bool: 1 bit;
+}
+
+@generateCppClass
+extern class Symbol extends Name {
+  flags: SymbolFlags;
+  description: String|Undefined;
+}
+
+type PublicSymbol extends Symbol;
+type PrivateSymbol extends Symbol;
+
+const kNameEmptyHashField:
+    constexpr uint32 generates 'Name::kEmptyHashField';
diff --git a/deps/v8/src/objects/object-list-macros.h b/deps/v8/src/objects/object-list-macros.h
index 09b1bdc5f05a36..2110ad772bf32b 100644
--- a/deps/v8/src/objects/object-list-macros.h
+++ b/deps/v8/src/objects/object-list-macros.h
@@ -80,15 +80,13 @@ class ZoneForwardList;
   V(AllocationSite)                            \
   V(ArrayList)                                 \
   V(BigInt)                                    \
+  V(BigIntBase)                                \
   V(BigIntWrapper)                             \
   V(ObjectBoilerplateDescription)              \
   V(Boolean)                                   \
   V(BooleanWrapper)                            \
-  V(BreakPoint)                                \
-  V(BreakPointInfo)                            \
   V(ByteArray)                                 \
   V(BytecodeArray)                             \
-  V(CachedTemplateObject)                      \
   V(CallHandlerInfo)                           \
   V(Callable)                                  \
   V(Cell)                                      \
@@ -127,7 +125,6 @@ class ZoneForwardList;
   V(HeapNumber)                                \
   V(InternalizedString)                        \
   V(JSArgumentsObject)                         \
-  V(JSArgumentsObjectWithLength)               \
   V(JSArray)                                   \
   V(JSArrayBuffer)                             \
   V(JSArrayBufferView)                         \
@@ -160,12 +157,9 @@ class ZoneForwardList;
   V(JSProxy)                                   \
   V(JSReceiver)                                \
   V(JSRegExp)                                  \
-  V(JSRegExpResult)                            \
-  V(JSRegExpResultIndices)                     \
   V(JSRegExpStringIterator)                    \
   V(JSSet)                                     \
   V(JSSetIterator)                             \
-  V(JSSloppyArgumentsObject)                   \
   V(JSSpecialObject)                           \
   V(JSStringIterator)                          \
   V(JSTypedArray)                              \
@@ -196,7 +190,6 @@ class ZoneForwardList;
   V(PromiseReactionJobTask)                    \
   V(PropertyArray)                             \
   V(PropertyCell)                              \
-  V(PropertyDescriptorObject)                  \
   V(RegExpMatchInfo)                           \
   V(ScopeInfo)                                 \
   V(ScriptContextTable)                        \
@@ -248,6 +241,7 @@ class ZoneForwardList;
   V(JSV8BreakIterator)                    \
   V(JSCollator)                           \
   V(JSDateTimeFormat)                     \
+  V(JSDisplayNames)                       \
   V(JSListFormat)                         \
   V(JSLocale)                             \
   V(JSNumberFormat)                       \
@@ -264,9 +258,26 @@ class ZoneForwardList;
 // Logical sub-types of heap objects that don't correspond to a C++ class but
 // represent some specialization in terms of additional constraints.
 #define HEAP_OBJECT_SPECIALIZED_TYPE_LIST(V) \
+  V(AwaitContext)                            \
+  V(BlockContext)                            \
   V(CallableApiObject)                       \
   V(CallableJSProxy)                         \
-  V(NonNullForeign)
+  V(CatchContext)                            \
+  V(DebugEvaluateContext)                    \
+  V(EvalContext)                             \
+  V(FreeSpaceOrFiller)                       \
+  V(FunctionContext)                         \
+  V(JSApiObject)                             \
+  V(JSMapKeyIterator)                        \
+  V(JSMapKeyValueIterator)                   \
+  V(JSMapValueIterator)                      \
+  V(JSSetKeyValueIterator)                   \
+  V(JSSetValueIterator)                      \
+  V(JSSpecialApiObject)                      \
+  V(ModuleContext)                           \
+  V(NonNullForeign)                          \
+  V(ScriptContext)                           \
+  V(WithContext)
 
 #define HEAP_OBJECT_TYPE_LIST(V)    \
   HEAP_OBJECT_ORDINARY_TYPE_LIST(V) \
diff --git a/deps/v8/src/objects/object-macros.h b/deps/v8/src/objects/object-macros.h
index da8c404c1445a6..518f59507bf9b8 100644
--- a/deps/v8/src/objects/object-macros.h
+++ b/deps/v8/src/objects/object-macros.h
@@ -30,6 +30,11 @@
 
 #define OBJECT_CONSTRUCTORS_IMPL(Type, Super) \
   inline Type::Type(Address ptr) : Super(ptr) { SLOW_DCHECK(Is##Type()); }
+// In these cases, we don't have our own instance type to check, so check the
+// supertype instead. This happens for types denoting a NativeContext-dependent
+// set of maps.
+#define OBJECT_CONSTRUCTORS_IMPL_CHECK_SUPER(Type, Super) \
+  inline Type::Type(Address ptr) : Super(ptr) { SLOW_DCHECK(Is##Super()); }
 
 #define NEVER_READ_ONLY_SPACE   \
   inline Heap* GetHeap() const; \
@@ -77,14 +82,14 @@
 // parameter.
 #define DECL_GETTER(name, type) \
   inline type name() const;     \
-  inline type name(Isolate* isolate) const;
-
-#define DEF_GETTER(holder, name, type)               \
-  type holder::name() const {                        \
-    Isolate* isolate = GetIsolateForPtrCompr(*this); \
-    return holder::name(isolate);                    \
-  }                                                  \
-  type holder::name(Isolate* isolate) const
+  inline type name(const Isolate* isolate) const;
+
+#define DEF_GETTER(holder, name, type)                     \
+  type holder::name() const {                              \
+    const Isolate* isolate = GetIsolateForPtrCompr(*this); \
+    return holder::name(isolate);                          \
+  }                                                        \
+  type holder::name(const Isolate* isolate) const
 
 #define DECL_ACCESSORS(name, type)   \
   DECL_GETTER(name, type)            \
diff --git a/deps/v8/src/objects/objects-body-descriptors-inl.h b/deps/v8/src/objects/objects-body-descriptors-inl.h
index 68164fdce67ffe..872acdec22443d 100644
--- a/deps/v8/src/objects/objects-body-descriptors-inl.h
+++ b/deps/v8/src/objects/objects-body-descriptors-inl.h
@@ -18,7 +18,7 @@
 #include "src/objects/js-collection.h"
 #include "src/objects/js-weak-refs.h"
 #include "src/objects/oddball.h"
-#include "src/objects/ordered-hash-table.h"
+#include "src/objects/ordered-hash-table-inl.h"
 #include "src/objects/source-text-module.h"
 #include "src/objects/synthetic-module.h"
 #include "src/objects/transitions.h"
@@ -219,7 +219,8 @@ class WeakCell::BodyDescriptor final : public BodyDescriptorBase {
                                  ObjectVisitor* v) {
     IteratePointers(obj, HeapObject::kHeaderSize, kTargetOffset, v);
     IterateCustomWeakPointer(obj, kTargetOffset, v);
-    IteratePointers(obj, kTargetOffset + kTaggedSize, object_size, v);
+    IterateCustomWeakPointer(obj, kUnregisterTokenOffset, v);
+    IteratePointers(obj, kUnregisterTokenOffset + kTaggedSize, object_size, v);
   }
 
   static inline int SizeOf(Map map, HeapObject object) {
@@ -545,7 +546,7 @@ class PrototypeInfo::BodyDescriptor final : public BodyDescriptorBase {
 
 class JSWeakCollection::BodyDescriptorImpl final : public BodyDescriptorBase {
  public:
-  STATIC_ASSERT(kTableOffset + kTaggedSize == kSizeOfAllWeakCollections);
+  STATIC_ASSERT(kTableOffset + kTaggedSize == kHeaderSizeOfAllWeakCollections);
 
   static bool IsValidSlot(Map map, HeapObject obj, int offset) {
     return IsValidJSObjectSlotImpl(map, obj, offset);
@@ -695,7 +696,7 @@ class WasmInstanceObject::BodyDescriptor final : public BodyDescriptorBase {
     for (uint16_t offset : kTaggedFieldOffsets) {
       IteratePointer(obj, offset, v);
     }
-    IterateJSObjectBodyImpl(map, obj, kSize, object_size, v);
+    IterateJSObjectBodyImpl(map, obj, kHeaderSize, object_size, v);
   }
 
   static inline int SizeOf(Map map, HeapObject object) {
@@ -947,6 +948,7 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
     case JS_V8_BREAK_ITERATOR_TYPE:
     case JS_COLLATOR_TYPE:
     case JS_DATE_TIME_FORMAT_TYPE:
+    case JS_DISPLAY_NAMES_TYPE:
     case JS_LIST_FORMAT_TYPE:
     case JS_LOCALE_TYPE:
     case JS_NUMBER_FORMAT_TYPE:
@@ -1106,11 +1108,10 @@ class EphemeronHashTable::BodyDescriptor final : public BodyDescriptorBase {
                         EphemeronHashTable::kElementsStartIndex * kTaggedSize;
     IteratePointers(obj, EphemeronHashTable::kHeaderSize, entries_start, v);
     EphemeronHashTable table = EphemeronHashTable::unchecked_cast(obj);
-    int entries = table.Capacity();
-    for (int i = 0; i < entries; ++i) {
+    for (InternalIndex i : table.IterateEntries()) {
       const int key_index = EphemeronHashTable::EntryToIndex(i);
       const int value_index = EphemeronHashTable::EntryToValueIndex(i);
-      IterateEphemeron(obj, i, OffsetOfElementAt(key_index),
+      IterateEphemeron(obj, i.as_int(), OffsetOfElementAt(key_index),
                        OffsetOfElementAt(value_index), v);
     }
   }
diff --git a/deps/v8/src/objects/objects-definitions.h b/deps/v8/src/objects/objects-definitions.h
index 53354014e9c197..24176ac65cb9ea 100644
--- a/deps/v8/src/objects/objects-definitions.h
+++ b/deps/v8/src/objects/objects-definitions.h
@@ -102,58 +102,61 @@ namespace internal {
 // code for the class including allocation and garbage collection routines,
 // casts and predicates.  All you need to define is the class, methods and
 // object verification routines.  Easy, no?
-#define STRUCT_LIST_GENERATOR_BASE(V, _)                                       \
-  V(_, PROMISE_FULFILL_REACTION_JOB_TASK_TYPE, PromiseFulfillReactionJobTask,  \
-    promise_fulfill_reaction_job_task)                                         \
-  V(_, PROMISE_REJECT_REACTION_JOB_TASK_TYPE, PromiseRejectReactionJobTask,    \
-    promise_reject_reaction_job_task)                                          \
-  V(_, CALLABLE_TASK_TYPE, CallableTask, callable_task)                        \
-  V(_, CALLBACK_TASK_TYPE, CallbackTask, callback_task)                        \
-  V(_, PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE, PromiseResolveThenableJobTask,  \
-    promise_resolve_thenable_job_task)                                         \
-  V(_, FUNCTION_TEMPLATE_INFO_TYPE, FunctionTemplateInfo,                      \
-    function_template_info)                                                    \
-  V(_, OBJECT_TEMPLATE_INFO_TYPE, ObjectTemplateInfo, object_template_info)    \
-  V(_, TUPLE2_TYPE, Tuple2, tuple2)                                            \
-  V(_, TUPLE3_TYPE, Tuple3, tuple3)                                            \
-  V(_, ACCESS_CHECK_INFO_TYPE, AccessCheckInfo, access_check_info)             \
-  V(_, ACCESSOR_INFO_TYPE, AccessorInfo, accessor_info)                        \
-  V(_, ACCESSOR_PAIR_TYPE, AccessorPair, accessor_pair)                        \
-  V(_, ALIASED_ARGUMENTS_ENTRY_TYPE, AliasedArgumentsEntry,                    \
-    aliased_arguments_entry)                                                   \
-  V(_, ALLOCATION_MEMENTO_TYPE, AllocationMemento, allocation_memento)         \
-  V(_, ARRAY_BOILERPLATE_DESCRIPTION_TYPE, ArrayBoilerplateDescription,        \
-    array_boilerplate_description)                                             \
-  V(_, ASM_WASM_DATA_TYPE, AsmWasmData, asm_wasm_data)                         \
-  V(_, ASYNC_GENERATOR_REQUEST_TYPE, AsyncGeneratorRequest,                    \
-    async_generator_request)                                                   \
-  V(_, CLASS_POSITIONS_TYPE, ClassPositions, class_positions)                  \
-  V(_, DEBUG_INFO_TYPE, DebugInfo, debug_info)                                 \
-  V(_, ENUM_CACHE_TYPE, EnumCache, enum_cache)                                 \
-  V(_, FUNCTION_TEMPLATE_RARE_DATA_TYPE, FunctionTemplateRareData,             \
-    function_template_rare_data)                                               \
-  V(_, INTERCEPTOR_INFO_TYPE, InterceptorInfo, interceptor_info)               \
-  V(_, INTERPRETER_DATA_TYPE, InterpreterData, interpreter_data)               \
-  V(_, PROMISE_CAPABILITY_TYPE, PromiseCapability, promise_capability)         \
-  V(_, PROMISE_REACTION_TYPE, PromiseReaction, promise_reaction)               \
-  V(_, PROTOTYPE_INFO_TYPE, PrototypeInfo, prototype_info)                     \
-  V(_, SCRIPT_TYPE, Script, script)                                            \
-  V(_, SOURCE_POSITION_TABLE_WITH_FRAME_CACHE_TYPE,                            \
-    SourcePositionTableWithFrameCache, source_position_table_with_frame_cache) \
-  V(_, SOURCE_TEXT_MODULE_INFO_ENTRY_TYPE, SourceTextModuleInfoEntry,          \
-    module_info_entry)                                                         \
-  V(_, STACK_FRAME_INFO_TYPE, StackFrameInfo, stack_frame_info)                \
-  V(_, STACK_TRACE_FRAME_TYPE, StackTraceFrame, stack_trace_frame)             \
-  V(_, TEMPLATE_OBJECT_DESCRIPTION_TYPE, TemplateObjectDescription,            \
-    template_object_description)                                               \
-  V(_, WASM_CAPI_FUNCTION_DATA_TYPE, WasmCapiFunctionData,                     \
-    wasm_capi_function_data)                                                   \
-  V(_, WASM_DEBUG_INFO_TYPE, WasmDebugInfo, wasm_debug_info)                   \
-  V(_, WASM_EXCEPTION_TAG_TYPE, WasmExceptionTag, wasm_exception_tag)          \
-  V(_, WASM_EXPORTED_FUNCTION_DATA_TYPE, WasmExportedFunctionData,             \
-    wasm_exported_function_data)                                               \
-  V(_, WASM_INDIRECT_FUNCTION_TABLE_TYPE, WasmIndirectFunctionTable,           \
-    wasm_indirect_function_table)                                              \
+#define STRUCT_LIST_GENERATOR_BASE(V, _)                                      \
+  V(_, PROMISE_FULFILL_REACTION_JOB_TASK_TYPE, PromiseFulfillReactionJobTask, \
+    promise_fulfill_reaction_job_task)                                        \
+  V(_, PROMISE_REJECT_REACTION_JOB_TASK_TYPE, PromiseRejectReactionJobTask,   \
+    promise_reject_reaction_job_task)                                         \
+  V(_, CALLABLE_TASK_TYPE, CallableTask, callable_task)                       \
+  V(_, CALLBACK_TASK_TYPE, CallbackTask, callback_task)                       \
+  V(_, PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE, PromiseResolveThenableJobTask, \
+    promise_resolve_thenable_job_task)                                        \
+  V(_, FUNCTION_TEMPLATE_INFO_TYPE, FunctionTemplateInfo,                     \
+    function_template_info)                                                   \
+  V(_, OBJECT_TEMPLATE_INFO_TYPE, ObjectTemplateInfo, object_template_info)   \
+  V(_, ACCESS_CHECK_INFO_TYPE, AccessCheckInfo, access_check_info)            \
+  V(_, ACCESSOR_INFO_TYPE, AccessorInfo, accessor_info)                       \
+  V(_, ACCESSOR_PAIR_TYPE, AccessorPair, accessor_pair)                       \
+  V(_, ALIASED_ARGUMENTS_ENTRY_TYPE, AliasedArgumentsEntry,                   \
+    aliased_arguments_entry)                                                  \
+  V(_, ALLOCATION_MEMENTO_TYPE, AllocationMemento, allocation_memento)        \
+  V(_, ARRAY_BOILERPLATE_DESCRIPTION_TYPE, ArrayBoilerplateDescription,       \
+    array_boilerplate_description)                                            \
+  V(_, ASM_WASM_DATA_TYPE, AsmWasmData, asm_wasm_data)                        \
+  V(_, ASYNC_GENERATOR_REQUEST_TYPE, AsyncGeneratorRequest,                   \
+    async_generator_request)                                                  \
+  V(_, BREAK_POINT_TYPE, BreakPoint, break_point)                             \
+  V(_, BREAK_POINT_INFO_TYPE, BreakPointInfo, break_point_info)               \
+  V(_, CACHED_TEMPLATE_OBJECT_TYPE, CachedTemplateObject,                     \
+    cached_template_object)                                                   \
+  V(_, CLASS_POSITIONS_TYPE, ClassPositions, class_positions)                 \
+  V(_, DEBUG_INFO_TYPE, DebugInfo, debug_info)                                \
+  V(_, ENUM_CACHE_TYPE, EnumCache, enum_cache)                                \
+  V(_, FUNCTION_TEMPLATE_RARE_DATA_TYPE, FunctionTemplateRareData,            \
+    function_template_rare_data)                                              \
+  V(_, INTERCEPTOR_INFO_TYPE, InterceptorInfo, interceptor_info)              \
+  V(_, INTERPRETER_DATA_TYPE, InterpreterData, interpreter_data)              \
+  V(_, PROMISE_CAPABILITY_TYPE, PromiseCapability, promise_capability)        \
+  V(_, PROMISE_REACTION_TYPE, PromiseReaction, promise_reaction)              \
+  V(_, PROPERTY_DESCRIPTOR_OBJECT_TYPE, PropertyDescriptorObject,             \
+    property_descriptor_object)                                               \
+  V(_, PROTOTYPE_INFO_TYPE, PrototypeInfo, prototype_info)                    \
+  V(_, SCRIPT_TYPE, Script, script)                                           \
+  V(_, SOURCE_TEXT_MODULE_INFO_ENTRY_TYPE, SourceTextModuleInfoEntry,         \
+    module_info_entry)                                                        \
+  V(_, STACK_FRAME_INFO_TYPE, StackFrameInfo, stack_frame_info)               \
+  V(_, STACK_TRACE_FRAME_TYPE, StackTraceFrame, stack_trace_frame)            \
+  V(_, TEMPLATE_OBJECT_DESCRIPTION_TYPE, TemplateObjectDescription,           \
+    template_object_description)                                              \
+  V(_, TUPLE2_TYPE, Tuple2, tuple2)                                           \
+  V(_, WASM_CAPI_FUNCTION_DATA_TYPE, WasmCapiFunctionData,                    \
+    wasm_capi_function_data)                                                  \
+  V(_, WASM_DEBUG_INFO_TYPE, WasmDebugInfo, wasm_debug_info)                  \
+  V(_, WASM_EXCEPTION_TAG_TYPE, WasmExceptionTag, wasm_exception_tag)         \
+  V(_, WASM_EXPORTED_FUNCTION_DATA_TYPE, WasmExportedFunctionData,            \
+    wasm_exported_function_data)                                              \
+  V(_, WASM_INDIRECT_FUNCTION_TABLE_TYPE, WasmIndirectFunctionTable,          \
+    wasm_indirect_function_table)                                             \
   V(_, WASM_JS_FUNCTION_DATA_TYPE, WasmJSFunctionData, wasm_js_function_data)
 
 #define STRUCT_LIST_GENERATOR(V, _) \
diff --git a/deps/v8/src/objects/objects-inl.h b/deps/v8/src/objects/objects-inl.h
index 08f4a2b6f0943e..fdfb25182335be 100644
--- a/deps/v8/src/objects/objects-inl.h
+++ b/deps/v8/src/objects/objects-inl.h
@@ -70,19 +70,6 @@ DEF_GETTER(HeapObject, IsSloppyArgumentsElements, bool) {
   return IsFixedArrayExact(isolate);
 }
 
-DEF_GETTER(HeapObject, IsJSSloppyArgumentsObject, bool) {
-  return IsJSArgumentsObject(isolate);
-}
-
-DEF_GETTER(HeapObject, IsJSGeneratorObject, bool) {
-  return map(isolate).instance_type() == JS_GENERATOR_OBJECT_TYPE ||
-         IsJSAsyncFunctionObject(isolate) || IsJSAsyncGeneratorObject(isolate);
-}
-
-DEF_GETTER(HeapObject, IsDataHandler, bool) {
-  return IsLoadHandler(isolate) || IsStoreHandler(isolate);
-}
-
 DEF_GETTER(HeapObject, IsClassBoilerplate, bool) {
   return IsFixedArrayExact(isolate);
 }
@@ -91,7 +78,7 @@ DEF_GETTER(HeapObject, IsClassBoilerplate, bool) {
   bool Object::Is##type_() const {                                       \
     return IsHeapObject() && HeapObject::cast(*this).Is##type_();        \
   }                                                                      \
-  bool Object::Is##type_(Isolate* isolate) const {                       \
+  bool Object::Is##type_(const Isolate* isolate) const {                 \
     return IsHeapObject() && HeapObject::cast(*this).Is##type_(isolate); \
   }
 HEAP_OBJECT_TYPE_LIST(IS_TYPE_FUNCTION_DEF)
@@ -101,7 +88,7 @@ IS_TYPE_FUNCTION_DEF(SmallOrderedHashTable)
 
 #define IS_TYPE_FUNCTION_DEF(Type, Value)                        \
   bool Object::Is##Type(Isolate* isolate) const {                \
-    return Is##Type(ReadOnlyRoots(isolate->heap()));             \
+    return Is##Type(ReadOnlyRoots(isolate));                     \
   }                                                              \
   bool Object::Is##Type(ReadOnlyRoots roots) const {             \
     return *this == roots.Value();                               \
@@ -145,7 +132,7 @@ bool Object::IsNoSharedNameSentinel() const {
 }
 
 bool HeapObject::IsNullOrUndefined(Isolate* isolate) const {
-  return Object::IsNullOrUndefined(isolate);
+  return IsNullOrUndefined(ReadOnlyRoots(isolate));
 }
 
 bool HeapObject::IsNullOrUndefined(ReadOnlyRoots roots) const {
@@ -192,10 +179,6 @@ DEF_GETTER(HeapObject, IsSourceTextModuleInfo, bool) {
   return map(isolate) == GetReadOnlyRoots(isolate).module_info_map();
 }
 
-DEF_GETTER(HeapObject, IsTemplateInfo, bool) {
-  return IsObjectTemplateInfo(isolate) || IsFunctionTemplateInfo(isolate);
-}
-
 DEF_GETTER(HeapObject, IsConsString, bool) {
   if (!IsString(isolate)) return false;
   return StringShape(String::cast(*this).map(isolate)).IsCons();
@@ -228,11 +211,6 @@ DEF_GETTER(HeapObject, IsSeqTwoByteString, bool) {
          String::cast(*this).IsTwoByteRepresentation(isolate);
 }
 
-DEF_GETTER(HeapObject, IsExternalString, bool) {
-  if (!IsString(isolate)) return false;
-  return StringShape(String::cast(*this).map(isolate)).IsExternal();
-}
-
 DEF_GETTER(HeapObject, IsExternalOneByteString, bool) {
   if (!IsString(isolate)) return false;
   return StringShape(String::cast(*this).map(isolate)).IsExternal() &&
@@ -248,44 +226,31 @@ DEF_GETTER(HeapObject, IsExternalTwoByteString, bool) {
 bool Object::IsNumber() const {
   if (IsSmi()) return true;
   HeapObject this_heap_object = HeapObject::cast(*this);
-  Isolate* isolate = GetIsolateForPtrCompr(this_heap_object);
+  const Isolate* isolate = GetIsolateForPtrCompr(this_heap_object);
   return this_heap_object.IsHeapNumber(isolate);
 }
 
-bool Object::IsNumber(Isolate* isolate) const {
+bool Object::IsNumber(const Isolate* isolate) const {
   return IsSmi() || IsHeapNumber(isolate);
 }
 
 bool Object::IsNumeric() const {
   if (IsSmi()) return true;
   HeapObject this_heap_object = HeapObject::cast(*this);
-  Isolate* isolate = GetIsolateForPtrCompr(this_heap_object);
+  const Isolate* isolate = GetIsolateForPtrCompr(this_heap_object);
   return this_heap_object.IsHeapNumber(isolate) ||
          this_heap_object.IsBigInt(isolate);
 }
 
-bool Object::IsNumeric(Isolate* isolate) const {
+bool Object::IsNumeric(const Isolate* isolate) const {
   return IsNumber(isolate) || IsBigInt(isolate);
 }
 
-DEF_GETTER(HeapObject, IsFiller, bool) {
+DEF_GETTER(HeapObject, IsFreeSpaceOrFiller, bool) {
   InstanceType instance_type = map(isolate).instance_type();
   return instance_type == FREE_SPACE_TYPE || instance_type == FILLER_TYPE;
 }
 
-DEF_GETTER(HeapObject, IsJSWeakCollection, bool) {
-  return IsJSWeakMap(isolate) || IsJSWeakSet(isolate);
-}
-
-DEF_GETTER(HeapObject, IsJSCollection, bool) {
-  return IsJSMap(isolate) || IsJSSet(isolate);
-}
-
-DEF_GETTER(HeapObject, IsPromiseReactionJobTask, bool) {
-  return IsPromiseFulfillReactionJobTask(isolate) ||
-         IsPromiseRejectReactionJobTask(isolate);
-}
-
 DEF_GETTER(HeapObject, IsFrameArray, bool) {
   return IsFixedArrayExact(isolate);
 }
@@ -305,11 +270,11 @@ DEF_GETTER(HeapObject, IsRegExpMatchInfo, bool) {
 bool Object::IsLayoutDescriptor() const {
   if (IsSmi()) return true;
   HeapObject this_heap_object = HeapObject::cast(*this);
-  Isolate* isolate = GetIsolateForPtrCompr(this_heap_object);
+  const Isolate* isolate = GetIsolateForPtrCompr(this_heap_object);
   return this_heap_object.IsByteArray(isolate);
 }
 
-bool Object::IsLayoutDescriptor(Isolate* isolate) const {
+bool Object::IsLayoutDescriptor(const Isolate* isolate) const {
   return IsSmi() || IsByteArray(isolate);
 }
 
@@ -391,14 +356,6 @@ DEF_GETTER(HeapObject, IsSymbolWrapper, bool) {
          JSPrimitiveWrapper::cast(*this).value().IsSymbol(isolate);
 }
 
-DEF_GETTER(HeapObject, IsJSArrayBufferView, bool) {
-  return IsJSDataView(isolate) || IsJSTypedArray(isolate);
-}
-
-DEF_GETTER(HeapObject, IsJSCollectionIterator, bool) {
-  return IsJSMapIterator(isolate) || IsJSSetIterator(isolate);
-}
-
 DEF_GETTER(HeapObject, IsStringSet, bool) { return IsHashTable(isolate); }
 
 DEF_GETTER(HeapObject, IsObjectHashSet, bool) { return IsHashTable(isolate); }
@@ -413,11 +370,6 @@ DEF_GETTER(HeapObject, IsObjectHashTable, bool) { return IsHashTable(isolate); }
 
 DEF_GETTER(HeapObject, IsHashTableBase, bool) { return IsHashTable(isolate); }
 
-DEF_GETTER(HeapObject, IsSmallOrderedHashTable, bool) {
-  return IsSmallOrderedHashSet(isolate) || IsSmallOrderedHashMap(isolate) ||
-         IsSmallOrderedNameDictionary(isolate);
-}
-
 DEF_GETTER(HeapObject, IsWasmExceptionPackage, bool) {
   // It is not possible to check for the existence of certain properties on the
   // underlying {JSReceiver} here because that requires calling handlified code.
@@ -427,11 +379,11 @@ DEF_GETTER(HeapObject, IsWasmExceptionPackage, bool) {
 bool Object::IsPrimitive() const {
   if (IsSmi()) return true;
   HeapObject this_heap_object = HeapObject::cast(*this);
-  Isolate* isolate = GetIsolateForPtrCompr(this_heap_object);
+  const Isolate* isolate = GetIsolateForPtrCompr(this_heap_object);
   return this_heap_object.map(isolate).IsPrimitiveMap();
 }
 
-bool Object::IsPrimitive(Isolate* isolate) const {
+bool Object::IsPrimitive(const Isolate* isolate) const {
   return IsSmi() || HeapObject::cast(*this).map(isolate).IsPrimitiveMap();
 }
 
@@ -457,38 +409,13 @@ DEF_GETTER(HeapObject, IsAccessCheckNeeded, bool) {
   return map(isolate).is_access_check_needed();
 }
 
-DEF_GETTER(HeapObject, IsStruct, bool) {
-  switch (map(isolate).instance_type()) {
-#define MAKE_STRUCT_CASE(TYPE, Name, name) \
-  case TYPE:                               \
-    return true;
-    STRUCT_LIST(MAKE_STRUCT_CASE)
-#undef MAKE_STRUCT_CASE
-    // It is hard to include ALLOCATION_SITE_TYPE in STRUCT_LIST because
-    // that macro is used for many things and AllocationSite needs a few
-    // special cases.
-    case ALLOCATION_SITE_TYPE:
-      return true;
-    case LOAD_HANDLER_TYPE:
-    case STORE_HANDLER_TYPE:
-      return true;
-    case FEEDBACK_CELL_TYPE:
-      return true;
-    case CALL_HANDLER_INFO_TYPE:
-      return true;
-    default:
-      return false;
-  }
-}
-
 #define MAKE_STRUCT_PREDICATE(NAME, Name, name)                         \
   bool Object::Is##Name() const {                                       \
     return IsHeapObject() && HeapObject::cast(*this).Is##Name();        \
   }                                                                     \
-  bool Object::Is##Name(Isolate* isolate) const {                       \
+  bool Object::Is##Name(const Isolate* isolate) const {                 \
     return IsHeapObject() && HeapObject::cast(*this).Is##Name(isolate); \
-  }                                                                     \
-  TYPE_CHECKER(Name)
+  }
 STRUCT_LIST(MAKE_STRUCT_PREDICATE)
 #undef MAKE_STRUCT_PREDICATE
 
@@ -526,6 +453,7 @@ OBJECT_CONSTRUCTORS_IMPL(FreshlyAllocatedBigInt, BigIntBase)
 // ------------------------------------
 // Cast operations
 
+CAST_ACCESSOR(BigIntBase)
 CAST_ACCESSOR(BigInt)
 CAST_ACCESSOR(RegExpMatchInfo)
 CAST_ACCESSOR(ScopeInfo)
@@ -551,7 +479,7 @@ bool Object::FilterKey(PropertyFilter filter) {
   return false;
 }
 
-Representation Object::OptimalRepresentation(Isolate* isolate) const {
+Representation Object::OptimalRepresentation(const Isolate* isolate) const {
   if (!FLAG_track_fields) return Representation::Tagged();
   if (IsSmi()) {
     return Representation::Smi();
@@ -570,7 +498,7 @@ Representation Object::OptimalRepresentation(Isolate* isolate) const {
   }
 }
 
-ElementsKind Object::OptimalElementsKind(Isolate* isolate) const {
+ElementsKind Object::OptimalElementsKind(const Isolate* isolate) const {
   if (IsSmi()) return PACKED_SMI_ELEMENTS;
   if (IsNumber(isolate)) return PACKED_DOUBLE_ELEMENTS;
   return PACKED_ELEMENTS;
@@ -752,9 +680,10 @@ ReadOnlyRoots HeapObject::GetReadOnlyRoots() const {
   return ReadOnlyHeap::GetReadOnlyRoots(*this);
 }
 
-ReadOnlyRoots HeapObject::GetReadOnlyRoots(Isolate* isolate) const {
+ReadOnlyRoots HeapObject::GetReadOnlyRoots(const Isolate* isolate) const {
 #ifdef V8_COMPRESS_POINTERS
-  return ReadOnlyRoots(isolate);
+  DCHECK_NOT_NULL(isolate);
+  return ReadOnlyRoots(const_cast<Isolate*>(isolate));
 #else
   return GetReadOnlyRoots();
 #endif
@@ -880,6 +809,29 @@ bool Object::ToArrayIndex(uint32_t* index) const {
   return Object::ToUint32(index) && *index != kMaxUInt32;
 }
 
+bool Object::ToIntegerIndex(size_t* index) const {
+  if (IsSmi()) {
+    int num = Smi::ToInt(*this);
+    if (num < 0) return false;
+    *index = static_cast<size_t>(num);
+    return true;
+  }
+  if (IsHeapNumber()) {
+    double num = HeapNumber::cast(*this).value();
+    if (!(num >= 0)) return false;  // Negation to catch NaNs.
+    constexpr double max =
+        std::min(kMaxSafeInteger,
+                 // The maximum size_t is reserved as "invalid" sentinel.
+                 static_cast<double>(std::numeric_limits<size_t>::max() - 1));
+    if (num > max) return false;
+    size_t result = static_cast<size_t>(num);
+    if (num != result) return false;  // Conversion lost fractional precision.
+    *index = result;
+    return true;
+  }
+  return false;
+}
+
 int RegExpMatchInfo::NumberOfCaptureRegisters() {
   DCHECK_GE(length(), kLastMatchOverhead);
   Object obj = get(kNumberOfCapturesIndex);
@@ -1021,7 +973,8 @@ Maybe<bool> Object::LessThanOrEqual(Isolate* isolate, Handle<Object> x,
 MaybeHandle<Object> Object::GetPropertyOrElement(Isolate* isolate,
                                                  Handle<Object> object,
                                                  Handle<Name> name) {
-  LookupIterator it = LookupIterator::PropertyOrElement(isolate, object, name);
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, object, key);
   return GetProperty(&it);
 }
 
@@ -1029,7 +982,8 @@ MaybeHandle<Object> Object::SetPropertyOrElement(
     Isolate* isolate, Handle<Object> object, Handle<Name> name,
     Handle<Object> value, Maybe<ShouldThrow> should_throw,
     StoreOrigin store_origin) {
-  LookupIterator it = LookupIterator::PropertyOrElement(isolate, object, name);
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, object, key);
   MAYBE_RETURN_NULL(SetProperty(&it, value, store_origin, should_throw));
   return value;
 }
@@ -1037,8 +991,9 @@ MaybeHandle<Object> Object::SetPropertyOrElement(
 MaybeHandle<Object> Object::GetPropertyOrElement(Handle<Object> receiver,
                                                  Handle<Name> name,
                                                  Handle<JSReceiver> holder) {
-  LookupIterator it = LookupIterator::PropertyOrElement(holder->GetIsolate(),
-                                                        receiver, name, holder);
+  Isolate* isolate = holder->GetIsolate();
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, receiver, key, holder);
   return GetProperty(&it);
 }
 
@@ -1115,9 +1070,9 @@ static inline uint32_t ObjectAddressForHashing(Address object) {
   return value & kPageAlignmentMask;
 }
 
-static inline Handle<Object> MakeEntryPair(Isolate* isolate, uint32_t index,
+static inline Handle<Object> MakeEntryPair(Isolate* isolate, size_t index,
                                            Handle<Object> value) {
-  Handle<Object> key = isolate->factory()->Uint32ToString(index);
+  Handle<Object> key = isolate->factory()->SizeToString(index);
   Handle<FixedArray> entry_storage =
       isolate->factory()->NewUninitializedFixedArray(2);
   {
@@ -1140,12 +1095,10 @@ static inline Handle<Object> MakeEntryPair(Isolate* isolate, Handle<Object> key,
                                                     PACKED_ELEMENTS, 2);
 }
 
-bool ScopeInfo::IsAsmModule() const {
-  return IsAsmModuleField::decode(Flags());
-}
+bool ScopeInfo::IsAsmModule() const { return IsAsmModuleBit::decode(Flags()); }
 
 bool ScopeInfo::HasSimpleParameters() const {
-  return HasSimpleParametersField::decode(Flags());
+  return HasSimpleParametersBit::decode(Flags());
 }
 
 #define FIELD_ACCESSORS(name)                                                 \
diff --git a/deps/v8/src/objects/objects.cc b/deps/v8/src/objects/objects.cc
index 1328b517e8ba01..cf1a3dcc20484e 100644
--- a/deps/v8/src/objects/objects.cc
+++ b/deps/v8/src/objects/objects.cc
@@ -66,6 +66,7 @@
 #include "src/objects/map-updater.h"
 #include "src/objects/objects-body-descriptors-inl.h"
 #include "src/objects/property-details.h"
+#include "src/roots/roots.h"
 #include "src/utils/identity-map.h"
 #ifdef V8_INTL_SUPPORT
 #include "src/objects/js-break-iterator.h"
@@ -97,6 +98,7 @@
 #include "src/objects/microtask-inl.h"
 #include "src/objects/module-inl.h"
 #include "src/objects/promise-inl.h"
+#include "src/objects/property-descriptor-object-inl.h"
 #include "src/objects/property-descriptor.h"
 #include "src/objects/prototype.h"
 #include "src/objects/slots-atomic-inl.h"
@@ -404,15 +406,13 @@ Handle<String> AsStringOrEmpty(Isolate* isolate, Handle<Object> object) {
 }
 
 Handle<String> NoSideEffectsErrorToString(Isolate* isolate,
-                                          Handle<Object> input) {
-  Handle<JSReceiver> receiver = Handle<JSReceiver>::cast(input);
-
+                                          Handle<JSReceiver> error) {
   Handle<Name> name_key = isolate->factory()->name_string();
-  Handle<Object> name = JSReceiver::GetDataProperty(receiver, name_key);
+  Handle<Object> name = JSReceiver::GetDataProperty(error, name_key);
   Handle<String> name_str = AsStringOrEmpty(isolate, name);
 
   Handle<Name> msg_key = isolate->factory()->message_string();
-  Handle<Object> msg = JSReceiver::GetDataProperty(receiver, msg_key);
+  Handle<Object> msg = JSReceiver::GetDataProperty(error, msg_key);
   Handle<String> msg_str = AsStringOrEmpty(isolate, msg);
 
   if (name_str->length() == 0) return msg_str;
@@ -421,7 +421,12 @@ Handle<String> NoSideEffectsErrorToString(Isolate* isolate,
   IncrementalStringBuilder builder(isolate);
   builder.AppendString(name_str);
   builder.AppendCString(": ");
-  builder.AppendString(msg_str);
+
+  if (builder.Length() + msg_str->length() <= String::kMaxLength) {
+    builder.AppendString(msg_str);
+  } else {
+    builder.AppendCString("<a very large string>");
+  }
 
   return builder.Finish().ToHandleChecked();
 }
@@ -469,13 +474,14 @@ Handle<String> Object::NoSideEffectsToString(Isolate* isolate,
     Handle<Symbol> symbol = Handle<Symbol>::cast(input);
 
     if (symbol->is_private_name()) {
-      return Handle<String>(String::cast(symbol->name()), isolate);
+      return Handle<String>(String::cast(symbol->description()), isolate);
     }
 
     IncrementalStringBuilder builder(isolate);
     builder.AppendCString("Symbol(");
-    if (symbol->name().IsString()) {
-      builder.AppendString(handle(String::cast(symbol->name()), isolate));
+    if (symbol->description().IsString()) {
+      builder.AppendString(
+          handle(String::cast(symbol->description()), isolate));
     }
     builder.AppendCharacter(')');
 
@@ -491,7 +497,8 @@ Handle<String> Object::NoSideEffectsToString(Isolate* isolate,
       // When internally formatting error objects, use a side-effects-free
       // version of Error.prototype.toString independent of the actually
       // installed toString method.
-      return NoSideEffectsErrorToString(isolate, input);
+      return NoSideEffectsErrorToString(isolate,
+                                        Handle<JSReceiver>::cast(input));
     } else if (*to_string == *isolate->object_to_string()) {
       Handle<Object> ctor = JSReceiver::GetDataProperty(
           receiver, isolate->factory()->constructor_string());
@@ -560,7 +567,7 @@ MaybeHandle<Object> Object::ConvertToLength(Isolate* isolate,
   }
   double len = DoubleToInteger(input->Number());
   if (len <= 0.0) {
-    return handle(Smi::kZero, isolate);
+    return handle(Smi::zero(), isolate);
   } else if (len >= kMaxSafeInteger) {
     len = kMaxSafeInteger;
   }
@@ -571,7 +578,7 @@ MaybeHandle<Object> Object::ConvertToLength(Isolate* isolate,
 MaybeHandle<Object> Object::ConvertToIndex(Isolate* isolate,
                                            Handle<Object> input,
                                            MessageTemplate error_index) {
-  if (input->IsUndefined(isolate)) return handle(Smi::kZero, isolate);
+  if (input->IsUndefined(isolate)) return handle(Smi::zero(), isolate);
   ASSIGN_RETURN_ON_EXCEPTION(isolate, input, ToNumber(isolate, input), Object);
   if (input->IsSmi() && Smi::ToInt(*input) >= 0) return input;
   double len = DoubleToInteger(input->Number()) + 0.0;
@@ -964,6 +971,8 @@ MaybeHandle<FixedArray> CreateListFromArrayLikeFastPath(
           length > static_cast<size_t>(FixedArray::kMaxLength)) {
         return MaybeHandle<FixedArray>();
       }
+      STATIC_ASSERT(FixedArray::kMaxLength <=
+                    std::numeric_limits<uint32_t>::max());
       return array->GetElementsAccessor()->CreateListFromArrayLike(
           isolate, array, static_cast<uint32_t>(length));
     }
@@ -1052,7 +1061,7 @@ MaybeHandle<Object> Object::GetLengthFromArrayLike(Isolate* isolate,
 
 // static
 MaybeHandle<Object> Object::GetProperty(LookupIterator* it,
-                                        OnNonExistent on_non_existent) {
+                                        bool is_global_reference) {
   for (; it->IsFound(); it->Next()) {
     switch (it->state()) {
       case LookupIterator::NOT_FOUND:
@@ -1067,10 +1076,19 @@ MaybeHandle<Object> Object::GetProperty(LookupIterator* it,
           receiver = handle(JSGlobalObject::cast(*receiver).global_proxy(),
                             it->isolate());
         }
+        if (is_global_reference) {
+          Maybe<bool> maybe = JSProxy::HasProperty(
+              it->isolate(), it->GetHolder<JSProxy>(), it->GetName());
+          if (maybe.IsNothing()) return MaybeHandle<Object>();
+          if (!maybe.FromJust()) {
+            it->NotFound();
+            return it->isolate()->factory()->undefined_value();
+          }
+        }
         MaybeHandle<Object> result =
             JSProxy::GetProperty(it->isolate(), it->GetHolder<JSProxy>(),
                                  it->GetName(), receiver, &was_found);
-        if (!was_found) it->NotFound();
+        if (!was_found && !is_global_reference) it->NotFound();
         return result;
       }
       case LookupIterator::INTERCEPTOR: {
@@ -1094,11 +1112,6 @@ MaybeHandle<Object> Object::GetProperty(LookupIterator* it,
     }
   }
 
-  if (on_non_existent == OnNonExistent::kThrowReferenceError) {
-    THROW_NEW_ERROR(it->isolate(),
-                    NewReferenceError(MessageTemplate::kNotDefined, it->name()),
-                    Object);
-  }
   return it->isolate()->factory()->undefined_value();
 }
 
@@ -1133,8 +1146,8 @@ MaybeHandle<Object> JSProxy::GetProperty(Isolate* isolate,
   // 7. If trap is undefined, then
   if (trap->IsUndefined(isolate)) {
     // 7.a Return target.[[Get]](P, Receiver).
-    LookupIterator it =
-        LookupIterator::PropertyOrElement(isolate, receiver, name, target);
+    LookupIterator::Key key(isolate, name);
+    LookupIterator it(isolate, receiver, key, target);
     MaybeHandle<Object> result = Object::GetProperty(&it);
     *was_found = it.IsFound();
     return result;
@@ -1236,10 +1249,7 @@ bool Object::ToInt32(int32_t* value) {
   return false;
 }
 
-// static constexpr object declarations need a definition to make the
-// compiler happy.
-constexpr Object Smi::kZero;
-V8_EXPORT_PRIVATE constexpr Object SharedFunctionInfo::kNoSharedNameSentinel;
+V8_EXPORT_PRIVATE constexpr Smi SharedFunctionInfo::kNoSharedNameSentinel;
 
 Handle<SharedFunctionInfo> FunctionTemplateInfo::GetOrCreateSharedFunctionInfo(
     Isolate* isolate, Handle<FunctionTemplateInfo> info,
@@ -1315,7 +1325,7 @@ FunctionTemplateRareData FunctionTemplateInfo::AllocateFunctionTemplateRareData(
 Handle<TemplateList> TemplateList::New(Isolate* isolate, int size) {
   Handle<FixedArray> list =
       isolate->factory()->NewFixedArray(kLengthIndex + size);
-  list->set(kLengthIndex, Smi::kZero);
+  list->set(kLengthIndex, Smi::zero());
   return Handle<TemplateList>::cast(list);
 }
 
@@ -2075,7 +2085,7 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
     }
     case HEAP_NUMBER_TYPE: {
       os << "<HeapNumber ";
-      HeapNumber::cast(*this).HeapNumberPrint(os);
+      HeapNumber::cast(*this).HeapNumberShortPrint(os);
       os << ">";
       break;
     }
@@ -2137,11 +2147,6 @@ void Tuple2::BriefPrintDetails(std::ostream& os) {
   os << " " << Brief(value1()) << ", " << Brief(value2());
 }
 
-void Tuple3::BriefPrintDetails(std::ostream& os) {
-  os << " " << Brief(value1()) << ", " << Brief(value2()) << ", "
-     << Brief(value3());
-}
-
 void ClassPositions::BriefPrintDetails(std::ostream& os) {
   os << " " << start() << ", " << end();
 }
@@ -2183,14 +2188,14 @@ int HeapObject::SizeFromMap(Map map) const {
   if (instance_size != kVariableSizeSentinel) return instance_size;
   // Only inline the most frequent cases.
   InstanceType instance_type = map.instance_type();
-  if (IsInRange(instance_type, FIRST_FIXED_ARRAY_TYPE, LAST_FIXED_ARRAY_TYPE)) {
+  if (base::IsInRange(instance_type, FIRST_FIXED_ARRAY_TYPE,
+                      LAST_FIXED_ARRAY_TYPE)) {
     return FixedArray::SizeFor(
         FixedArray::unchecked_cast(*this).synchronized_length());
   }
-  if (IsInRange(instance_type, FIRST_CONTEXT_TYPE, LAST_CONTEXT_TYPE)) {
+  if (base::IsInRange(instance_type, FIRST_CONTEXT_TYPE, LAST_CONTEXT_TYPE)) {
     if (instance_type == NATIVE_CONTEXT_TYPE) return NativeContext::kSize;
-    return Context::SizeFor(
-        Context::unchecked_cast(*this).synchronized_length());
+    return Context::SizeFor(Context::unchecked_cast(*this).length());
   }
   if (instance_type == ONE_BYTE_STRING_TYPE ||
       instance_type == ONE_BYTE_INTERNALIZED_STRING_TYPE) {
@@ -2229,8 +2234,8 @@ int HeapObject::SizeFromMap(Map map) const {
     return DescriptorArray::SizeFor(
         DescriptorArray::unchecked_cast(*this).number_of_all_descriptors());
   }
-  if (IsInRange(instance_type, FIRST_WEAK_FIXED_ARRAY_TYPE,
-                LAST_WEAK_FIXED_ARRAY_TYPE)) {
+  if (base::IsInRange(instance_type, FIRST_WEAK_FIXED_ARRAY_TYPE,
+                      LAST_WEAK_FIXED_ARRAY_TYPE)) {
     return WeakFixedArray::SizeFor(
         WeakFixedArray::unchecked_cast(*this).synchronized_length());
   }
@@ -2761,10 +2766,10 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it, Handle<Object> value,
         NewTypeError(MessageTemplate::kObjectNotExtensible, it->GetName()));
   }
 
-  if (it->IsElement()) {
+  if (it->IsElement(*receiver)) {
     if (receiver->IsJSArray()) {
       Handle<JSArray> array = Handle<JSArray>::cast(receiver);
-      if (JSArray::WouldChangeReadOnlyLength(array, it->index())) {
+      if (JSArray::WouldChangeReadOnlyLength(array, it->array_index())) {
         RETURN_FAILURE(isolate, GetShouldThrow(it->isolate(), should_throw),
                        NewTypeError(MessageTemplate::kStrictReadOnlyProperty,
                                     isolate->factory()->length_string(),
@@ -2773,7 +2778,8 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it, Handle<Object> value,
     }
 
     Handle<JSObject> receiver_obj = Handle<JSObject>::cast(receiver);
-    JSObject::AddDataElement(receiver_obj, it->index(), value, attributes);
+    JSObject::AddDataElement(receiver_obj, it->array_index(), value,
+                             attributes);
     JSObject::ValidateElements(*receiver_obj);
     return Just(true);
   } else {
@@ -2975,8 +2981,8 @@ Maybe<bool> JSProxy::SetProperty(Handle<JSProxy> proxy, Handle<Name> name,
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
       isolate, trap, Object::GetMethod(handler, trap_name), Nothing<bool>());
   if (trap->IsUndefined(isolate)) {
-    LookupIterator it =
-        LookupIterator::PropertyOrElement(isolate, receiver, name, target);
+    LookupIterator::Key key(isolate, name);
+    LookupIterator it(isolate, receiver, key, target);
 
     return Object::SetSuperProperty(&it, value, StoreOrigin::kMaybeKeyed,
                                     should_throw);
@@ -3468,7 +3474,7 @@ Maybe<bool> JSProxy::SetPrivateSymbol(Isolate* isolate, Handle<JSProxy> proxy,
           ? desc->value()
           : Handle<Object>::cast(isolate->factory()->undefined_value());
 
-  LookupIterator it(proxy, private_name, proxy);
+  LookupIterator it(isolate, proxy, private_name, proxy);
 
   if (it.IsFound()) {
     DCHECK_EQ(LookupIterator::DATA, it.state());
@@ -3965,6 +3971,65 @@ Handle<WeakArrayList> WeakArrayList::AddToEnd(Isolate* isolate,
   return array;
 }
 
+// static
+Handle<WeakArrayList> WeakArrayList::Append(Isolate* isolate,
+                                            Handle<WeakArrayList> array,
+                                            const MaybeObjectHandle& value,
+                                            AllocationType allocation) {
+  int length = array->length();
+
+  if (length < array->capacity()) {
+    array->Set(length, *value);
+    array->set_length(length + 1);
+    return array;
+  }
+
+  // Not enough space in the array left, either grow, shrink or
+  // compact the array.
+  int new_length = array->CountLiveElements() + 1;
+
+  bool shrink = new_length < length / 4;
+  bool grow = 3 * (length / 4) < new_length;
+
+  if (shrink || grow) {
+    // Grow or shrink array and compact out-of-place.
+    int new_capacity = CapacityForLength(new_length);
+    array = isolate->factory()->CompactWeakArrayList(array, new_capacity,
+                                                     allocation);
+
+  } else {
+    // Perform compaction in the current array.
+    array->Compact(isolate);
+  }
+
+  // Now append value to the array, there should always be enough space now.
+  DCHECK_LT(array->length(), array->capacity());
+
+  // Reload length, allocation might have killed some weak refs.
+  int index = array->length();
+  array->Set(index, *value);
+  array->set_length(index + 1);
+  return array;
+}
+
+void WeakArrayList::Compact(Isolate* isolate) {
+  int length = this->length();
+  int new_length = 0;
+
+  for (int i = 0; i < length; i++) {
+    MaybeObject value = Get(isolate, i);
+
+    if (!value->IsCleared()) {
+      if (new_length != i) {
+        Set(new_length, value);
+      }
+      ++new_length;
+    }
+  }
+
+  set_length(new_length);
+}
+
 bool WeakArrayList::IsFull() { return length() == capacity(); }
 
 // static
@@ -3974,9 +4039,7 @@ Handle<WeakArrayList> WeakArrayList::EnsureSpace(Isolate* isolate,
                                                  AllocationType allocation) {
   int capacity = array->capacity();
   if (capacity < length) {
-    int new_capacity = length;
-    new_capacity = new_capacity + Max(new_capacity / 2, 2);
-    int grow_by = new_capacity - capacity;
+    int grow_by = CapacityForLength(length) - capacity;
     array = isolate->factory()->CopyWeakArrayListAndGrow(array, grow_by,
                                                          allocation);
   }
@@ -3993,6 +4056,16 @@ int WeakArrayList::CountLiveWeakReferences() const {
   return live_weak_references;
 }
 
+int WeakArrayList::CountLiveElements() const {
+  int non_cleared_objects = 0;
+  for (int i = 0; i < length(); i++) {
+    if (!Get(i)->IsCleared()) {
+      ++non_cleared_objects;
+    }
+  }
+  return non_cleared_objects;
+}
+
 bool WeakArrayList::RemoveOne(const MaybeObjectHandle& value) {
   if (length() == 0) return false;
   // Optimize for the most recently added element to be removed again.
@@ -4109,12 +4182,22 @@ WeakArrayList PrototypeUsers::Compact(Handle<WeakArrayList> array, Heap* heap,
   return *new_array;
 }
 
+Handle<RegExpMatchInfo> RegExpMatchInfo::New(Isolate* isolate,
+                                             int capture_count) {
+  Handle<RegExpMatchInfo> match_info = isolate->factory()->NewRegExpMatchInfo();
+  return ReserveCaptures(isolate, match_info, capture_count);
+}
+
 Handle<RegExpMatchInfo> RegExpMatchInfo::ReserveCaptures(
     Isolate* isolate, Handle<RegExpMatchInfo> match_info, int capture_count) {
   DCHECK_GE(match_info->length(), kLastMatchOverhead);
-  const int required_length = kFirstCaptureIndex + capture_count;
-  return Handle<RegExpMatchInfo>::cast(
+
+  int capture_register_count = (capture_count + 1) * 2;
+  const int required_length = kFirstCaptureIndex + capture_register_count;
+  Handle<RegExpMatchInfo> result = Handle<RegExpMatchInfo>::cast(
       EnsureSpaceInFixedArray(isolate, match_info, required_length));
+  result->SetNumberOfCaptureRegisters(capture_register_count);
+  return result;
 }
 
 // static
@@ -4142,6 +4225,11 @@ Handle<FrameArray> FrameArray::AppendJSFrame(Handle<FrameArray> in,
 Handle<FrameArray> FrameArray::AppendWasmFrame(
     Handle<FrameArray> in, Handle<WasmInstanceObject> wasm_instance,
     int wasm_function_index, wasm::WasmCode* code, int offset, int flags) {
+  // This must be either a compiled or interpreted wasm frame, or an asm.js
+  // frame (which is always compiled).
+  DCHECK_EQ(1, ((flags & kIsWasmInterpretedFrame) != 0) +
+                   ((flags & kIsWasmCompiledFrame) != 0) +
+                   ((flags & kIsAsmJsWasmFrame) != 0));
   Isolate* isolate = wasm_instance->GetIsolate();
   const int frame_count = in->FrameCount();
   const int new_length = LengthFor(frame_count + 1);
@@ -4344,7 +4432,8 @@ bool DescriptorArray::IsEqualTo(DescriptorArray other) {
 MaybeHandle<String> Name::ToFunctionName(Isolate* isolate, Handle<Name> name) {
   if (name->IsString()) return Handle<String>::cast(name);
   // ES6 section 9.2.11 SetFunctionName, step 4.
-  Handle<Object> description(Handle<Symbol>::cast(name)->name(), isolate);
+  Handle<Object> description(Handle<Symbol>::cast(name)->description(),
+                             isolate);
   if (description->IsUndefined(isolate)) {
     return isolate->factory()->empty_string();
   }
@@ -4639,7 +4728,7 @@ bool Script::GetPositionInfo(Handle<Script> script, int position,
   return script->GetPositionInfo(position, info, offset_flag);
 }
 
-bool Script::IsUserJavaScript() { return type() == Script::TYPE_NORMAL; }
+bool Script::IsUserJavaScript() const { return type() == Script::TYPE_NORMAL; }
 
 bool Script::ContainsAsmModule() {
   DisallowHeapAllocation no_gc;
@@ -4678,34 +4767,20 @@ bool GetPositionInfoSlow(const Script script, int position,
 }
 }  // namespace
 
-#define SMI_VALUE(x) (Smi::ToInt(x))
 bool Script::GetPositionInfo(int position, PositionInfo* info,
                              OffsetFlag offset_flag) const {
   DisallowHeapAllocation no_allocation;
 
-  // For wasm, we do not rely on the line_ends array, but do the translation
-  // directly.
+  // For wasm, we use the byte offset as the column.
   if (type() == Script::TYPE_WASM) {
     DCHECK_LE(0, position);
     wasm::NativeModule* native_module = wasm_native_module();
     const wasm::WasmModule* module = native_module->module();
-    if (source_mapping_url().IsString()) {
-      if (module->functions.size() == 0) return false;
-      info->line = 0;
-      info->column = position;
-      info->line_start = module->functions[0].code.offset();
-      info->line_end = module->functions.back().code.end_offset();
-      return true;
-    }
-    int func_index = GetContainingWasmFunction(module, position);
-    if (func_index < 0) return false;
-
-    const wasm::WasmFunction& function = module->functions[func_index];
-
-    info->line = func_index;
-    info->column = position - function.code.offset();
-    info->line_start = function.code.offset();
-    info->line_end = function.code.end_offset();
+    if (module->functions.size() == 0) return false;
+    info->line = 0;
+    info->column = position;
+    info->line_start = module->functions[0].code.offset();
+    info->line_end = module->functions.back().code.end_offset();
     return true;
   }
 
@@ -4723,12 +4798,12 @@ bool Script::GetPositionInfo(int position, PositionInfo* info,
     // passed, and positions beyond the end of the script return as failure.
     if (position < 0) {
       position = 0;
-    } else if (position > SMI_VALUE(ends.get(ends_len - 1))) {
+    } else if (position > Smi::ToInt(ends.get(ends_len - 1))) {
       return false;
     }
 
     // Determine line number by doing a binary search on the line ends array.
-    if (SMI_VALUE(ends.get(0)) >= position) {
+    if (Smi::ToInt(ends.get(0)) >= position) {
       info->line = 0;
       info->line_start = 0;
       info->column = position;
@@ -4739,23 +4814,23 @@ bool Script::GetPositionInfo(int position, PositionInfo* info,
       while (right > 0) {
         DCHECK_LE(left, right);
         const int mid = (left + right) / 2;
-        if (position > SMI_VALUE(ends.get(mid))) {
+        if (position > Smi::ToInt(ends.get(mid))) {
           left = mid + 1;
-        } else if (position <= SMI_VALUE(ends.get(mid - 1))) {
+        } else if (position <= Smi::ToInt(ends.get(mid - 1))) {
           right = mid - 1;
         } else {
           info->line = mid;
           break;
         }
       }
-      DCHECK(SMI_VALUE(ends.get(info->line)) >= position &&
-             SMI_VALUE(ends.get(info->line - 1)) < position);
-      info->line_start = SMI_VALUE(ends.get(info->line - 1)) + 1;
+      DCHECK(Smi::ToInt(ends.get(info->line)) >= position &&
+             Smi::ToInt(ends.get(info->line - 1)) < position);
+      info->line_start = Smi::ToInt(ends.get(info->line - 1)) + 1;
       info->column = position - info->line_start;
     }
 
     // Line end is position of the linebreak character.
-    info->line_end = SMI_VALUE(ends.get(info->line));
+    info->line_end = Smi::ToInt(ends.get(info->line));
     if (info->line_end > 0) {
       DCHECK(source().IsString());
       String src = String::cast(source());
@@ -4776,7 +4851,6 @@ bool Script::GetPositionInfo(int position, PositionInfo* info,
 
   return true;
 }
-#undef SMI_VALUE
 
 int Script::GetColumnNumber(Handle<Script> script, int code_pos) {
   PositionInfo info;
@@ -4825,37 +4899,6 @@ MaybeHandle<SharedFunctionInfo> Script::FindSharedFunctionInfo(
   return handle(SharedFunctionInfo::cast(heap_object), isolate);
 }
 
-std::unique_ptr<v8::tracing::TracedValue> Script::ToTracedValue() {
-  auto value = v8::tracing::TracedValue::Create();
-  if (name().IsString()) {
-    value->SetString("name", String::cast(name()).ToCString());
-  }
-  value->SetInteger("lineOffset", line_offset());
-  value->SetInteger("columnOffset", column_offset());
-  if (source_mapping_url().IsString()) {
-    value->SetString("sourceMappingURL",
-                     String::cast(source_mapping_url()).ToCString());
-  }
-  if (source().IsString()) {
-    value->SetString("source", String::cast(source()).ToCString());
-  }
-  return value;
-}
-
-// static
-const char* Script::kTraceScope = "v8::internal::Script";
-
-uint64_t Script::TraceID() const { return id(); }
-
-std::unique_ptr<v8::tracing::TracedValue> Script::TraceIDRef() const {
-  auto value = v8::tracing::TracedValue::Create();
-  std::ostringstream ost;
-  ost << "0x" << std::hex << TraceID();
-  value->SetString("id_ref", ost.str());
-  value->SetString("scope", kTraceScope);
-  return value;
-}
-
 Script::Iterator::Iterator(Isolate* isolate)
     : iterator_(isolate->heap()->script_list()) {}
 
@@ -4876,59 +4919,42 @@ uint32_t SharedFunctionInfo::Hash() {
   return static_cast<uint32_t>(base::hash_combine(start_pos, script_id));
 }
 
-std::unique_ptr<v8::tracing::TracedValue> SharedFunctionInfo::ToTracedValue(
-    FunctionLiteral* literal) {
-  auto value = v8::tracing::TracedValue::Create();
-  if (HasSharedName()) {
-    value->SetString("name", Name().ToCString());
-  }
-  if (HasInferredName()) {
-    value->SetString("inferredName", inferred_name().ToCString());
-  }
-  if (is_toplevel()) {
-    value->SetBoolean("isToplevel", true);
-  }
-  value->SetInteger("formalParameterCount", internal_formal_parameter_count());
-  value->SetString("languageMode", LanguageMode2String(language_mode()));
-  value->SetString("kind", FunctionKind2String(kind()));
-  if (script().IsScript()) {
-    value->SetValue("script", Script::cast(script()).TraceIDRef());
-    value->BeginDictionary("sourcePosition");
-    Script::PositionInfo info;
-    // We get the start position from the {literal} here, because the
-    // SharedFunctionInfo itself might not have a way to get to the
-    // start position early on (currently that's the case when it's
-    // marked for eager compilation).
-    if (Script::cast(script()).GetPositionInfo(literal->start_position(), &info,
-                                               Script::WITH_OFFSET)) {
-      value->SetInteger("line", info.line + 1);
-      value->SetInteger("column", info.column + 1);
-    }
-    value->EndDictionary();
-  }
-  return value;
-}
+void SharedFunctionInfo::Init(ReadOnlyRoots ro_roots, int unique_id) {
+  DisallowHeapAllocation no_allocation;
 
-// static
-const char* SharedFunctionInfo::kTraceScope =
-    "v8::internal::SharedFunctionInfo";
+  // Set the function data to the "illegal" builtin. Ideally we'd use some sort
+  // of "uninitialized" marker here, but it's cheaper to use a valid buitin and
+  // avoid having to do uninitialized checks elsewhere.
+  set_builtin_id(Builtins::kIllegal);
+
+  // Set the name to the no-name sentinel, this can be updated later.
+  set_name_or_scope_info(SharedFunctionInfo::kNoSharedNameSentinel,
+                         SKIP_WRITE_BARRIER);
+
+  // Generally functions won't have feedback, unless they have been created
+  // from a FunctionLiteral. Those can just reset this field to keep the
+  // SharedFunctionInfo in a consistent state.
+  set_raw_outer_scope_info_or_feedback_metadata(ro_roots.the_hole_value(),
+                                                SKIP_WRITE_BARRIER);
+  set_script_or_debug_info(ro_roots.undefined_value(), SKIP_WRITE_BARRIER);
+  set_function_literal_id(kFunctionLiteralIdInvalid);
+#if V8_SFI_HAS_UNIQUE_ID
+  set_unique_id(unique_id);
+#endif
 
-uint64_t SharedFunctionInfo::TraceID(FunctionLiteral* literal) const {
-  int literal_id =
-      literal ? literal->function_literal_id() : function_literal_id();
-  Script script = Script::cast(this->script());
-  return (static_cast<uint64_t>(script.id() + 1) << 32) |
-         (static_cast<uint64_t>(literal_id));
-}
+  // Set integer fields (smi or int, depending on the architecture).
+  set_length(0);
+  set_internal_formal_parameter_count(0);
+  set_expected_nof_properties(0);
+  set_raw_function_token_offset(0);
 
-std::unique_ptr<v8::tracing::TracedValue> SharedFunctionInfo::TraceIDRef()
-    const {
-  auto value = v8::tracing::TracedValue::Create();
-  std::ostringstream ost;
-  ost << "0x" << std::hex << TraceID();
-  value->SetString("id_ref", ost.str());
-  value->SetString("scope", kTraceScope);
-  return value;
+  // All flags default to false or 0, except ConstructAsBuiltinBit just because
+  // we're using the kIllegal builtin.
+  set_flags(ConstructAsBuiltinBit::encode(true));
+
+  UpdateFunctionMapIndex();
+
+  clear_padding();
 }
 
 Code SharedFunctionInfo::GetCode() const {
@@ -5018,59 +5044,58 @@ void SharedFunctionInfo::ScriptIterator::Reset(Isolate* isolate,
   index_ = 0;
 }
 
-void SharedFunctionInfo::SetScript(Handle<SharedFunctionInfo> shared,
-                                   Handle<HeapObject> script_object,
+void SharedFunctionInfo::SetScript(ReadOnlyRoots roots,
+                                   HeapObject script_object,
                                    int function_literal_id,
                                    bool reset_preparsed_scope_data) {
-  if (shared->script() == *script_object) return;
-  Isolate* isolate = shared->GetIsolate();
+  DisallowHeapAllocation no_gc;
+
+  if (script() == script_object) return;
 
-  if (reset_preparsed_scope_data &&
-      shared->HasUncompiledDataWithPreparseData()) {
-    shared->ClearPreparseData();
+  if (reset_preparsed_scope_data && HasUncompiledDataWithPreparseData()) {
+    ClearPreparseData();
   }
 
   // Add shared function info to new script's list. If a collection occurs,
   // the shared function info may be temporarily in two lists.
   // This is okay because the gc-time processing of these lists can tolerate
   // duplicates.
-  if (script_object->IsScript()) {
-    DCHECK(!shared->script().IsScript());
-    Handle<Script> script = Handle<Script>::cast(script_object);
-    Handle<WeakFixedArray> list =
-        handle(script->shared_function_infos(), isolate);
+  if (script_object.IsScript()) {
+    DCHECK(!script().IsScript());
+    Script script = Script::cast(script_object);
+    WeakFixedArray list = script.shared_function_infos();
 #ifdef DEBUG
-    DCHECK_LT(function_literal_id, list->length());
-    MaybeObject maybe_object = list->Get(function_literal_id);
+    DCHECK_LT(function_literal_id, list.length());
+    MaybeObject maybe_object = list.Get(function_literal_id);
     HeapObject heap_object;
     if (maybe_object->GetHeapObjectIfWeak(&heap_object)) {
-      DCHECK_EQ(heap_object, *shared);
+      DCHECK_EQ(heap_object, *this);
     }
 #endif
-    list->Set(function_literal_id, HeapObjectReference::Weak(*shared));
+    list.Set(function_literal_id, HeapObjectReference::Weak(*this));
   } else {
-    DCHECK(shared->script().IsScript());
+    DCHECK(script().IsScript());
 
     // Remove shared function info from old script's list.
-    Script old_script = Script::cast(shared->script());
+    Script old_script = Script::cast(script());
 
     // Due to liveedit, it might happen that the old_script doesn't know
     // about the SharedFunctionInfo, so we have to guard against that.
-    Handle<WeakFixedArray> infos(old_script.shared_function_infos(), isolate);
-    if (function_literal_id < infos->length()) {
+    WeakFixedArray infos = old_script.shared_function_infos();
+    if (function_literal_id < infos.length()) {
       MaybeObject raw =
           old_script.shared_function_infos().Get(function_literal_id);
       HeapObject heap_object;
-      if (raw->GetHeapObjectIfWeak(&heap_object) && heap_object == *shared) {
+      if (raw->GetHeapObjectIfWeak(&heap_object) && heap_object == *this) {
         old_script.shared_function_infos().Set(
-            function_literal_id, HeapObjectReference::Strong(
-                                     ReadOnlyRoots(isolate).undefined_value()));
+            function_literal_id,
+            HeapObjectReference::Strong(roots.undefined_value()));
       }
     }
   }
 
   // Finally set new script.
-  shared->set_script(*script_object);
+  set_script(script_object);
 }
 
 bool SharedFunctionInfo::HasBreakInfo() const {
@@ -5215,64 +5240,34 @@ Handle<Object> SharedFunctionInfo::GetSourceCodeHarmony(
   return builder.Finish().ToHandleChecked();
 }
 
-namespace {
-void TraceInlining(SharedFunctionInfo shared, const char* msg) {
-  if (FLAG_trace_turbo_inlining) {
-    StdoutStream os;
-    os << Brief(shared) << ": IsInlineable? " << msg << "\n";
-  }
-}
-}  // namespace
-
-bool SharedFunctionInfo::IsInlineable() {
-  if (!script().IsScript()) {
-    TraceInlining(*this, "false (no Script associated with it)");
-    return false;
-  }
+SharedFunctionInfo::Inlineability SharedFunctionInfo::GetInlineability() const {
+  if (!script().IsScript()) return kHasNoScript;
 
   if (GetIsolate()->is_precise_binary_code_coverage() &&
       !has_reported_binary_coverage()) {
     // We may miss invocations if this function is inlined.
-    TraceInlining(*this, "false (requires reported binary coverage)");
-    return false;
+    return kNeedsBinaryCoverage;
   }
 
-  if (optimization_disabled()) {
-    TraceInlining(*this, "false (optimization disabled)");
-    return false;
-  }
+  if (optimization_disabled()) return kHasOptimizationDisabled;
 
   // Built-in functions are handled by the JSCallReducer.
-  if (HasBuiltinId()) {
-    TraceInlining(*this, "false (is a builtin)");
-    return false;
-  }
+  if (HasBuiltinId()) return kIsBuiltin;
 
-  if (!IsUserJavaScript()) {
-    TraceInlining(*this, "false (is not user code)");
-    return false;
-  }
+  if (!IsUserJavaScript()) return kIsNotUserCode;
 
   // If there is no bytecode array, it is either not compiled or it is compiled
   // with WebAssembly for the asm.js pipeline. In either case we don't want to
   // inline.
-  if (!HasBytecodeArray()) {
-    TraceInlining(*this, "false (has no BytecodeArray)");
-    return false;
-  }
+  if (!HasBytecodeArray()) return kHasNoBytecode;
 
   if (GetBytecodeArray().length() > FLAG_max_inlined_bytecode_size) {
-    TraceInlining(*this, "false (length > FLAG_max_inlined_bytecode_size)");
-    return false;
+    return kExceedsBytecodeLimit;
   }
 
-  if (HasBreakInfo()) {
-    TraceInlining(*this, "false (may contain break points)");
-    return false;
-  }
+  if (HasBreakInfo()) return kMayContainBreakPoints;
 
-  TraceInlining(*this, "true");
-  return true;
+  return kIsInlineable;
 }
 
 int SharedFunctionInfo::SourceSize() { return EndPosition() - StartPosition(); }
@@ -5317,7 +5312,9 @@ void SharedFunctionInfo::DisableOptimization(BailoutReason reason) {
   // Code should be the lazy compilation stub or else interpreted.
   DCHECK(abstract_code().kind() == AbstractCode::INTERPRETED_FUNCTION ||
          abstract_code().kind() == AbstractCode::BUILTIN);
-  PROFILE(GetIsolate(), CodeDisableOptEvent(abstract_code(), *this));
+  PROFILE(GetIsolate(),
+          CodeDisableOptEvent(handle(abstract_code(), GetIsolate()),
+                              handle(*this, GetIsolate())));
   if (FLAG_trace_opt) {
     PrintF("[disabled optimization for ");
     ShortPrint();
@@ -5325,27 +5322,21 @@ void SharedFunctionInfo::DisableOptimization(BailoutReason reason) {
   }
 }
 
+// static
 void SharedFunctionInfo::InitFromFunctionLiteral(
-    Handle<SharedFunctionInfo> shared_info, FunctionLiteral* lit,
-    bool is_toplevel) {
-  Isolate* isolate = shared_info->GetIsolate();
-  bool needs_position_info = true;
+    Isolate* isolate, Handle<SharedFunctionInfo> shared_info,
+    FunctionLiteral* lit, bool is_toplevel) {
+  DCHECK(!shared_info->name_or_scope_info().IsScopeInfo());
 
   // When adding fields here, make sure DeclarationScope::AnalyzePartially is
   // updated accordingly.
   shared_info->set_internal_formal_parameter_count(lit->parameter_count());
   shared_info->SetFunctionTokenPosition(lit->function_token_position(),
                                         lit->start_position());
-  if (shared_info->scope_info().HasPositionInfo()) {
-    shared_info->scope_info().SetPositionInfo(lit->start_position(),
-                                              lit->end_position());
-    needs_position_info = false;
-  }
   shared_info->set_syntax_kind(lit->syntax_kind());
   shared_info->set_allows_lazy_compilation(lit->AllowsLazyCompilation());
   shared_info->set_language_mode(lit->language_mode());
   shared_info->set_function_literal_id(lit->function_literal_id());
-  //  shared_info->set_kind(lit->kind());
   // FunctionKind must have already been set.
   DCHECK(lit->kind() == shared_info->kind());
   shared_info->set_needs_home_object(lit->scope()->NeedsHomeObject());
@@ -5377,32 +5368,31 @@ void SharedFunctionInfo::InitFromFunctionLiteral(
     shared_info->set_is_safe_to_skip_arguments_adaptor(
         lit->SafeToSkipArgumentsAdaptor());
     DCHECK_NULL(lit->produced_preparse_data());
+
     // If we're about to eager compile, we'll have the function literal
     // available, so there's no need to wastefully allocate an uncompiled data.
-    // TODO(leszeks): This should be explicitly passed as a parameter, rather
-    // than relying on a property of the literal.
-    needs_position_info = false;
+    return;
+  }
+
+  shared_info->set_is_safe_to_skip_arguments_adaptor(false);
+  shared_info->UpdateExpectedNofPropertiesFromEstimate(lit);
+
+  Handle<UncompiledData> data;
+
+  ProducedPreparseData* scope_data = lit->produced_preparse_data();
+  if (scope_data != nullptr) {
+    Handle<PreparseData> preparse_data =
+        scope_data->Serialize(shared_info->GetIsolate());
+
+    data = isolate->factory()->NewUncompiledDataWithPreparseData(
+        lit->inferred_name(), lit->start_position(), lit->end_position(),
+        preparse_data);
   } else {
-    shared_info->set_is_safe_to_skip_arguments_adaptor(false);
-    ProducedPreparseData* scope_data = lit->produced_preparse_data();
-    if (scope_data != nullptr) {
-      Handle<PreparseData> preparse_data =
-          scope_data->Serialize(shared_info->GetIsolate());
-      Handle<UncompiledData> data =
-          isolate->factory()->NewUncompiledDataWithPreparseData(
-              lit->inferred_name(), lit->start_position(), lit->end_position(),
-              preparse_data);
-      shared_info->set_uncompiled_data(*data);
-      needs_position_info = false;
-    }
-    shared_info->UpdateExpectedNofPropertiesFromEstimate(lit);
-  }
-  if (needs_position_info) {
-    Handle<UncompiledData> data =
-        isolate->factory()->NewUncompiledDataWithoutPreparseData(
-            lit->inferred_name(), lit->start_position(), lit->end_position());
-    shared_info->set_uncompiled_data(*data);
+    data = isolate->factory()->NewUncompiledDataWithoutPreparseData(
+        lit->inferred_name(), lit->start_position(), lit->end_position());
   }
+
+  shared_info->set_uncompiled_data(*data);
 }
 
 uint16_t SharedFunctionInfo::get_property_estimate_from_literal(
@@ -5684,7 +5674,7 @@ bool JSArray::HasReadOnlyLength(Handle<JSArray> array) {
   }
 
   Isolate* isolate = array->GetIsolate();
-  LookupIterator it(array, isolate->factory()->length_string(), array,
+  LookupIterator it(isolate, array, isolate->factory()->length_string(), array,
                     LookupIterator::OWN_SKIP_INTERCEPTOR);
   CHECK_EQ(LookupIterator::ACCESSOR, it.state());
   return it.IsReadOnly();
@@ -5708,8 +5698,7 @@ void Dictionary<Derived, Shape>::Print(std::ostream& os) {
   DisallowHeapAllocation no_gc;
   ReadOnlyRoots roots = this->GetReadOnlyRoots();
   Derived dictionary = Derived::cast(*this);
-  int capacity = dictionary.Capacity();
-  for (int i = 0; i < capacity; i++) {
+  for (InternalIndex i : dictionary.IterateEntries()) {
     Object k = dictionary.KeyAt(i);
     if (!dictionary.ToKey(roots, i, &k)) continue;
     os << "\n   ";
@@ -5750,11 +5739,11 @@ const char* Symbol::PrivateSymbolToName() const {
 
 void Symbol::SymbolShortPrint(std::ostream& os) {
   os << "<Symbol:";
-  if (!name().IsUndefined()) {
+  if (!description().IsUndefined()) {
     os << " ";
     HeapStringAllocator allocator;
     StringStream accumulator(&allocator);
-    String::cast(name()).StringShortPrint(&accumulator, false);
+    String::cast(description()).StringShortPrint(&accumulator, false);
     os << accumulator.ToCString().get();
   } else {
     os << " (" << PrivateSymbolToName() << ")";
@@ -5877,11 +5866,30 @@ Handle<Object> JSPromise::Fulfill(Handle<JSPromise> promise,
                                  PromiseReaction::kFulfill);
 }
 
+static void MoveMessageToPromise(Isolate* isolate, Handle<JSPromise> promise) {
+  if (isolate->thread_local_top()->pending_message_obj_.IsTheHole(isolate)) {
+    return;
+  }
+
+  Handle<Object> message =
+      handle(isolate->thread_local_top()->pending_message_obj_, isolate);
+  Handle<Symbol> key = isolate->factory()->promise_debug_message_symbol();
+  Object::SetProperty(isolate, promise, key, message, StoreOrigin::kMaybeKeyed,
+                      Just(ShouldThrow::kThrowOnError))
+      .Assert();
+
+  // The message object for a rejected promise was only stored for this purpose.
+  // Clear it, otherwise we might leak memory.
+  isolate->clear_pending_message();
+}
+
 // static
 Handle<Object> JSPromise::Reject(Handle<JSPromise> promise,
                                  Handle<Object> reason, bool debug_event) {
   Isolate* const isolate = promise->GetIsolate();
 
+  if (isolate->debug()->is_active()) MoveMessageToPromise(isolate, promise);
+
   if (debug_event) isolate->debug()->OnPromiseReject(promise, reason);
   isolate->RunPromiseHook(PromiseHookType::kResolve, promise,
                           isolate->factory()->undefined_value());
@@ -6006,7 +6014,7 @@ Handle<Object> JSPromise::TriggerPromiseReactions(Isolate* isolate,
   {
     DisallowHeapAllocation no_gc;
     Object current = *reactions;
-    Object reversed = Smi::kZero;
+    Object reversed = Smi::zero();
     while (!current.IsSmi()) {
       Object next = PromiseReaction::cast(current).next();
       PromiseReaction::cast(current).set_next(reversed);
@@ -6090,10 +6098,9 @@ Handle<Object> JSPromise::TriggerPromiseReactions(Isolate* isolate,
   return isolate->factory()->undefined_value();
 }
 
-namespace {
-
-JSRegExp::Flags RegExpFlagsFromString(Isolate* isolate, Handle<String> flags,
-                                      bool* success) {
+// static
+JSRegExp::Flags JSRegExp::FlagsFromString(Isolate* isolate,
+                                          Handle<String> flags, bool* success) {
   STATIC_ASSERT(JSRegExp::FlagFromChar('g') == JSRegExp::kGlobal);
   STATIC_ASSERT(JSRegExp::FlagFromChar('i') == JSRegExp::kIgnoreCase);
   STATIC_ASSERT(JSRegExp::FlagFromChar('m') == JSRegExp::kMultiline);
@@ -6136,16 +6143,14 @@ JSRegExp::Flags RegExpFlagsFromString(Isolate* isolate, Handle<String> flags,
   return value;
 }
 
-}  // namespace
-
 // static
 MaybeHandle<JSRegExp> JSRegExp::New(Isolate* isolate, Handle<String> pattern,
-                                    Flags flags) {
+                                    Flags flags, uint32_t backtrack_limit) {
   Handle<JSFunction> constructor = isolate->regexp_function();
   Handle<JSRegExp> regexp =
       Handle<JSRegExp>::cast(isolate->factory()->NewJSObject(constructor));
 
-  return JSRegExp::Initialize(regexp, pattern, flags);
+  return JSRegExp::Initialize(regexp, pattern, flags, backtrack_limit);
 }
 
 // static
@@ -6155,10 +6160,12 @@ Handle<JSRegExp> JSRegExp::Copy(Handle<JSRegExp> regexp) {
 }
 
 Object JSRegExp::Code(bool is_latin1) const {
+  DCHECK_EQ(TypeTag(), JSRegExp::IRREGEXP);
   return DataAt(code_index(is_latin1));
 }
 
 Object JSRegExp::Bytecode(bool is_latin1) const {
+  DCHECK_EQ(TypeTag(), JSRegExp::IRREGEXP);
   return DataAt(bytecode_index(is_latin1));
 }
 
@@ -6201,7 +6208,7 @@ void JSRegExp::MarkTierUpForNextExec() {
   DCHECK(FLAG_regexp_tier_up);
   DCHECK_EQ(TypeTag(), JSRegExp::IRREGEXP);
   FixedArray::cast(data()).set(JSRegExp::kIrregexpTicksUntilTierUpIndex,
-                               Smi::kZero);
+                               Smi::zero());
 }
 
 namespace {
@@ -6323,7 +6330,7 @@ MaybeHandle<JSRegExp> JSRegExp::Initialize(Handle<JSRegExp> regexp,
                                            Handle<String> flags_string) {
   Isolate* isolate = regexp->GetIsolate();
   bool success = false;
-  Flags flags = RegExpFlagsFromString(isolate, flags_string, &success);
+  Flags flags = JSRegExp::FlagsFromString(isolate, flags_string, &success);
   if (!success) {
     THROW_NEW_ERROR(
         isolate,
@@ -6335,7 +6342,8 @@ MaybeHandle<JSRegExp> JSRegExp::Initialize(Handle<JSRegExp> regexp,
 
 // static
 MaybeHandle<JSRegExp> JSRegExp::Initialize(Handle<JSRegExp> regexp,
-                                           Handle<String> source, Flags flags) {
+                                           Handle<String> source, Flags flags,
+                                           uint32_t backtrack_limit) {
   Isolate* isolate = regexp->GetIsolate();
   Factory* factory = isolate->factory();
   // If source is the empty string we set it to "(?:)" instead as
@@ -6344,8 +6352,9 @@ MaybeHandle<JSRegExp> JSRegExp::Initialize(Handle<JSRegExp> regexp,
 
   source = String::Flatten(isolate, source);
 
-  RETURN_ON_EXCEPTION(isolate, RegExp::Compile(isolate, regexp, source, flags),
-                      JSRegExp);
+  RETURN_ON_EXCEPTION(
+      isolate, RegExp::Compile(isolate, regexp, source, flags, backtrack_limit),
+      JSRegExp);
 
   Handle<String> escaped_source;
   ASSIGN_RETURN_ON_EXCEPTION(isolate, escaped_source,
@@ -6359,7 +6368,7 @@ MaybeHandle<JSRegExp> JSRegExp::Initialize(Handle<JSRegExp> regexp,
   if (constructor.IsJSFunction() &&
       JSFunction::cast(constructor).initial_map() == map) {
     // If we still have the original map, set in-object properties directly.
-    regexp->InObjectPropertyAtPut(JSRegExp::kLastIndexFieldIndex, Smi::kZero,
+    regexp->InObjectPropertyAtPut(JSRegExp::kLastIndexFieldIndex, Smi::zero(),
                                   SKIP_WRITE_BARRIER);
   } else {
     // Map has changed, so use generic, but slower, method.
@@ -6472,7 +6481,7 @@ template <typename Derived, typename Shape>
 Handle<Derived> HashTable<Derived, Shape>::NewInternal(
     Isolate* isolate, int capacity, AllocationType allocation) {
   Factory* factory = isolate->factory();
-  int length = EntryToIndex(capacity);
+  int length = EntryToIndex(InternalIndex(capacity));
   RootIndex map_root_index = Shape::GetMapRootIndex();
   Handle<FixedArray> array =
       factory->NewFixedArrayWithMap(map_root_index, length, allocation);
@@ -6497,8 +6506,7 @@ void HashTable<Derived, Shape>::Rehash(ReadOnlyRoots roots, Derived new_table) {
   }
 
   // Rehash the elements.
-  int capacity = this->Capacity();
-  for (int i = 0; i < capacity; i++) {
+  for (InternalIndex i : this->IterateEntries()) {
     uint32_t from_index = EntryToIndex(i);
     Object k = this->get(from_index);
     if (!Shape::IsLive(roots, k)) continue;
@@ -6514,12 +6522,12 @@ void HashTable<Derived, Shape>::Rehash(ReadOnlyRoots roots, Derived new_table) {
 }
 
 template <typename Derived, typename Shape>
-uint32_t HashTable<Derived, Shape>::EntryForProbe(ReadOnlyRoots roots, Object k,
-                                                  int probe,
-                                                  uint32_t expected) {
+InternalIndex HashTable<Derived, Shape>::EntryForProbe(ReadOnlyRoots roots,
+                                                       Object k, int probe,
+                                                       InternalIndex expected) {
   uint32_t hash = Shape::HashForObject(roots, k);
   uint32_t capacity = this->Capacity();
-  uint32_t entry = FirstProbe(hash, capacity);
+  InternalIndex entry = FirstProbe(hash, capacity);
   for (int i = 1; i < probe; i++) {
     if (entry == expected) return expected;
     entry = NextProbe(entry, i, capacity);
@@ -6528,7 +6536,7 @@ uint32_t HashTable<Derived, Shape>::EntryForProbe(ReadOnlyRoots roots, Object k,
 }
 
 template <typename Derived, typename Shape>
-void HashTable<Derived, Shape>::Swap(uint32_t entry1, uint32_t entry2,
+void HashTable<Derived, Shape>::Swap(InternalIndex entry1, InternalIndex entry2,
                                      WriteBarrierMode mode) {
   int index1 = EntryToIndex(entry1);
   int index2 = EntryToIndex(entry2);
@@ -6557,22 +6565,30 @@ void HashTable<Derived, Shape>::Rehash(ReadOnlyRoots roots) {
     // All elements at entries given by one of the first _probe_ probes
     // are placed correctly. Other elements might need to be moved.
     done = true;
-    for (uint32_t current = 0; current < capacity; current++) {
+    for (InternalIndex current(0); current.raw_value() < capacity;
+         /* {current} is advanced manually below, when appropriate.*/) {
       Object current_key = KeyAt(current);
-      if (!Shape::IsLive(roots, current_key)) continue;
-      uint32_t target = EntryForProbe(roots, current_key, probe, current);
-      if (current == target) continue;
+      if (!Shape::IsLive(roots, current_key)) {
+        ++current;  // Advance to next entry.
+        continue;
+      }
+      InternalIndex target = EntryForProbe(roots, current_key, probe, current);
+      if (current == target) {
+        ++current;  // Advance to next entry.
+        continue;
+      }
       Object target_key = KeyAt(target);
       if (!Shape::IsLive(roots, target_key) ||
           EntryForProbe(roots, target_key, probe, target) != target) {
         // Put the current element into the correct position.
         Swap(current, target, mode);
-        // The other element will be processed on the next iteration.
-        current--;
+        // The other element will be processed on the next iteration,
+        // so don't advance {current} here!
       } else {
         // The place for the current element is occupied. Leave the element
         // for the next probe.
         done = false;
+        ++current;  // Advance to next entry.
       }
     }
   }
@@ -6580,7 +6596,7 @@ void HashTable<Derived, Shape>::Rehash(ReadOnlyRoots roots) {
   Object the_hole = roots.the_hole_value();
   HeapObject undefined = roots.undefined_value();
   Derived* self = static_cast<Derived*>(this);
-  for (uint32_t current = 0; current < capacity; current++) {
+  for (InternalIndex current : InternalIndex::Range(capacity)) {
     if (KeyAt(current) == the_hole) {
       self->set_key(EntryToIndex(current) + kEntryKeyIndex, undefined,
                     SKIP_WRITE_BARRIER);
@@ -6660,9 +6676,9 @@ Handle<Derived> HashTable<Derived, Shape>::Shrink(Isolate* isolate,
 }
 
 template <typename Derived, typename Shape>
-uint32_t HashTable<Derived, Shape>::FindInsertionEntry(uint32_t hash) {
+InternalIndex HashTable<Derived, Shape>::FindInsertionEntry(uint32_t hash) {
   uint32_t capacity = Capacity();
-  uint32_t entry = FirstProbe(hash, capacity);
+  InternalIndex entry = FirstProbe(hash, capacity);
   uint32_t count = 1;
   // EnsureCapacity will guarantee the hash table is never full.
   ReadOnlyRoots roots = GetReadOnlyRoots();
@@ -6720,10 +6736,10 @@ Handle<String> StringTable::LookupString(Isolate* isolate,
 template <typename StringTableKey>
 Handle<String> StringTable::LookupKey(Isolate* isolate, StringTableKey* key) {
   Handle<StringTable> table = isolate->factory()->string_table();
-  int entry = table->FindEntry(isolate, key);
+  InternalIndex entry = table->FindEntry(isolate, key);
 
   // String already in table.
-  if (entry != kNotFound) {
+  if (entry.is_found()) {
     return handle(String::cast(table->KeyAt(entry)), isolate);
   }
 
@@ -6754,10 +6770,10 @@ Handle<String> StringTable::AddKeyNoResize(Isolate* isolate,
   // InvalidStringLength error.
   CHECK(!string.is_null());
   DCHECK(string->HasHashCode());
-  DCHECK_EQ(table->FindEntry(isolate, key), kNotFound);
+  DCHECK(table->FindEntry(isolate, key).is_not_found());
 
   // Add the new string and return it along with the string table.
-  int entry = table->FindInsertionEntry(key->hash());
+  InternalIndex entry = table->FindInsertionEntry(key->hash());
   table->set(EntryToIndex(entry), *string);
   table->ElementAdded();
 
@@ -6813,8 +6829,9 @@ Address LookupString(Isolate* isolate, String string, String source,
     return Smi::FromInt(ResultSentinel::kUnsupported).ptr();
   }
 
-  int entry = table.FindEntry(ReadOnlyRoots(isolate), &key, key.hash());
-  if (entry == kNotFound) {
+  InternalIndex entry =
+      table.FindEntry(ReadOnlyRoots(isolate), &key, key.hash());
+  if (entry.is_not_found()) {
     // A string that's not an array index, and not in the string table,
     // cannot have been used as a property name before.
     return Smi::FromInt(ResultSentinel::kNotFound).ptr();
@@ -6872,7 +6889,7 @@ Handle<StringSet> StringSet::Add(Isolate* isolate, Handle<StringSet> stringset,
   if (!stringset->Has(isolate, name)) {
     stringset = EnsureCapacity(isolate, stringset);
     uint32_t hash = ShapeT::Hash(isolate, *name);
-    int entry = stringset->FindInsertionEntry(hash);
+    InternalIndex entry = stringset->FindInsertionEntry(hash);
     stringset->set(EntryToIndex(entry), *name);
     stringset->ElementAdded();
   }
@@ -6880,7 +6897,7 @@ Handle<StringSet> StringSet::Add(Isolate* isolate, Handle<StringSet> stringset,
 }
 
 bool StringSet::Has(Isolate* isolate, Handle<String> name) {
-  return FindEntry(isolate, *name) != kNotFound;
+  return FindEntry(isolate, *name).is_found();
 }
 
 Handle<ObjectHashSet> ObjectHashSet::Add(Isolate* isolate,
@@ -6889,7 +6906,7 @@ Handle<ObjectHashSet> ObjectHashSet::Add(Isolate* isolate,
   int32_t hash = key->GetOrCreateHash(isolate).value();
   if (!set->Has(isolate, key, hash)) {
     set = EnsureCapacity(isolate, set);
-    int entry = set->FindInsertionEntry(hash);
+    InternalIndex entry = set->FindInsertionEntry(hash);
     set->set(EntryToIndex(entry), *key);
     set->ElementAdded();
   }
@@ -7026,8 +7043,8 @@ MaybeHandle<SharedFunctionInfo> CompilationCacheTable::LookupScript(
   Isolate* isolate = native_context->GetIsolate();
   src = String::Flatten(isolate, src);
   StringSharedKey key(src, shared, language_mode, kNoSourcePosition);
-  int entry = table->FindEntry(isolate, &key);
-  if (entry == kNotFound) return MaybeHandle<SharedFunctionInfo>();
+  InternalIndex entry = table->FindEntry(isolate, &key);
+  if (entry.is_not_found()) return MaybeHandle<SharedFunctionInfo>();
   int index = EntryToIndex(entry);
   if (!table->get(index).IsFixedArray()) {
     return MaybeHandle<SharedFunctionInfo>();
@@ -7047,14 +7064,14 @@ InfoCellPair CompilationCacheTable::LookupEval(
   Isolate* isolate = native_context->GetIsolate();
   src = String::Flatten(isolate, src);
   StringSharedKey key(src, outer_info, language_mode, position);
-  int entry = table->FindEntry(isolate, &key);
-  if (entry == kNotFound) return empty_result;
+  InternalIndex entry = table->FindEntry(isolate, &key);
+  if (entry.is_not_found()) return empty_result;
   int index = EntryToIndex(entry);
   if (!table->get(index).IsFixedArray()) return empty_result;
-  Object obj = table->get(EntryToIndex(entry) + 1);
+  Object obj = table->get(index + 1);
   if (obj.IsSharedFunctionInfo()) {
     FeedbackCell feedback_cell =
-        SearchLiteralsMap(*table, EntryToIndex(entry) + 2, *native_context);
+        SearchLiteralsMap(*table, index + 2, *native_context);
     return InfoCellPair(SharedFunctionInfo::cast(obj), feedback_cell);
   }
   return empty_result;
@@ -7065,8 +7082,8 @@ Handle<Object> CompilationCacheTable::LookupRegExp(Handle<String> src,
   Isolate* isolate = GetIsolate();
   DisallowHeapAllocation no_allocation;
   RegExpKey key(src, flags);
-  int entry = FindEntry(isolate, &key);
-  if (entry == kNotFound) return isolate->factory()->undefined_value();
+  InternalIndex entry = FindEntry(isolate, &key);
+  if (entry.is_not_found()) return isolate->factory()->undefined_value();
   return Handle<Object>(get(EntryToIndex(entry) + 1), isolate);
 }
 
@@ -7085,7 +7102,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutScript(
   StringSharedKey key(src, shared, language_mode, kNoSourcePosition);
   Handle<Object> k = key.AsHandle(isolate);
   cache = EnsureCapacity(isolate, cache);
-  int entry = cache->FindInsertionEntry(key.Hash());
+  InternalIndex entry = cache->FindInsertionEntry(key.Hash());
   cache->set(EntryToIndex(entry), *k);
   cache->set(EntryToIndex(entry) + 1, *value);
   cache->ElementAdded();
@@ -7102,8 +7119,8 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutEval(
   StringSharedKey key(src, outer_info, value->language_mode(), position);
   {
     Handle<Object> k = key.AsHandle(isolate);
-    int entry = cache->FindEntry(isolate, &key);
-    if (entry != kNotFound) {
+    InternalIndex entry = cache->FindEntry(isolate, &key);
+    if (entry.is_found()) {
       cache->set(EntryToIndex(entry), *k);
       cache->set(EntryToIndex(entry) + 1, *value);
       // AddToFeedbackCellsMap may allocate a new sub-array to live in the
@@ -7117,7 +7134,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutEval(
   }
 
   cache = EnsureCapacity(isolate, cache);
-  int entry = cache->FindInsertionEntry(key.Hash());
+  InternalIndex entry = cache->FindInsertionEntry(key.Hash());
   Handle<Object> k =
       isolate->factory()->NewNumber(static_cast<double>(key.Hash()));
   cache->set(EntryToIndex(entry), *k);
@@ -7131,7 +7148,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutRegExp(
     JSRegExp::Flags flags, Handle<FixedArray> value) {
   RegExpKey key(src, flags);
   cache = EnsureCapacity(isolate, cache);
-  int entry = cache->FindInsertionEntry(key.Hash());
+  InternalIndex entry = cache->FindInsertionEntry(key.Hash());
   // We store the value in the key slot, and compare the search key
   // to the stored value with a custon IsMatch function during lookups.
   cache->set(EntryToIndex(entry), *value);
@@ -7143,7 +7160,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutRegExp(
 void CompilationCacheTable::Age() {
   DisallowHeapAllocation no_allocation;
   Object the_hole_value = GetReadOnlyRoots().the_hole_value();
-  for (int entry = 0, size = Capacity(); entry < size; entry++) {
+  for (InternalIndex entry : IterateEntries()) {
     int entry_index = EntryToIndex(entry);
     int value_index = entry_index + 1;
 
@@ -7172,7 +7189,7 @@ void CompilationCacheTable::Age() {
 void CompilationCacheTable::Remove(Object value) {
   DisallowHeapAllocation no_allocation;
   Object the_hole_value = GetReadOnlyRoots().the_hole_value();
-  for (int entry = 0, size = Capacity(); entry < size; entry++) {
+  for (InternalIndex entry : IterateEntries()) {
     int entry_index = EntryToIndex(entry);
     int value_index = entry_index + 1;
     if (get(value_index) == value) {
@@ -7211,7 +7228,7 @@ int BaseNameDictionary<Derived, Shape>::NextEnumerationIndex(
     // Iterate over the dictionary using the enumeration order and update
     // the dictionary with new enumeration indices.
     for (int i = 0; i < length; i++) {
-      int index = Smi::ToInt(iteration_order->get(i));
+      InternalIndex index(Smi::ToInt(iteration_order->get(i)));
       DCHECK(dictionary->IsKey(dictionary->GetReadOnlyRoots(),
                                dictionary->KeyAt(index)));
 
@@ -7232,7 +7249,7 @@ int BaseNameDictionary<Derived, Shape>::NextEnumerationIndex(
 
 template <typename Derived, typename Shape>
 Handle<Derived> Dictionary<Derived, Shape>::DeleteEntry(
-    Isolate* isolate, Handle<Derived> dictionary, int entry) {
+    Isolate* isolate, Handle<Derived> dictionary, InternalIndex entry) {
   DCHECK(Shape::kEntrySize != 3 ||
          dictionary->DetailsAt(entry).IsConfigurable());
   dictionary->ClearEntry(isolate, entry);
@@ -7245,10 +7262,10 @@ Handle<Derived> Dictionary<Derived, Shape>::AtPut(Isolate* isolate,
                                                   Handle<Derived> dictionary,
                                                   Key key, Handle<Object> value,
                                                   PropertyDetails details) {
-  int entry = dictionary->FindEntry(isolate, key);
+  InternalIndex entry = dictionary->FindEntry(isolate, key);
 
   // If the entry is present set the value;
-  if (entry == Dictionary::kNotFound) {
+  if (entry.is_not_found()) {
     return Derived::Add(isolate, dictionary, key, value, details);
   }
 
@@ -7262,8 +7279,8 @@ template <typename Derived, typename Shape>
 Handle<Derived>
 BaseNameDictionary<Derived, Shape>::AddNoUpdateNextEnumerationIndex(
     Isolate* isolate, Handle<Derived> dictionary, Key key, Handle<Object> value,
-    PropertyDetails details, int* entry_out) {
-  // Insert element at empty or deleted entry
+    PropertyDetails details, InternalIndex* entry_out) {
+  // Insert element at empty or deleted entry.
   return Dictionary<Derived, Shape>::Add(isolate, dictionary, key, value,
                                          details, entry_out);
 }
@@ -7271,7 +7288,7 @@ BaseNameDictionary<Derived, Shape>::AddNoUpdateNextEnumerationIndex(
 template <typename Derived, typename Shape>
 Handle<Derived> BaseNameDictionary<Derived, Shape>::Add(
     Isolate* isolate, Handle<Derived> dictionary, Key key, Handle<Object> value,
-    PropertyDetails details, int* entry_out) {
+    PropertyDetails details, InternalIndex* entry_out) {
   // Insert element at empty or deleted entry
   DCHECK_EQ(0, details.dictionary_index());
   // Assign an enumeration index to the property and update
@@ -7291,17 +7308,17 @@ Handle<Derived> Dictionary<Derived, Shape>::Add(Isolate* isolate,
                                                 Handle<Derived> dictionary,
                                                 Key key, Handle<Object> value,
                                                 PropertyDetails details,
-                                                int* entry_out) {
+                                                InternalIndex* entry_out) {
   uint32_t hash = Shape::Hash(isolate, key);
-  // Valdate key is absent.
-  SLOW_DCHECK((dictionary->FindEntry(isolate, key) == Dictionary::kNotFound));
+  // Validate that the key is absent.
+  SLOW_DCHECK(dictionary->FindEntry(isolate, key).is_not_found());
   // Check whether the dictionary should be extended.
   dictionary = Derived::EnsureCapacity(isolate, dictionary);
 
   // Compute the key object.
   Handle<Object> k = Shape::AsHandle(isolate, key);
 
-  uint32_t entry = dictionary->FindInsertionEntry(hash);
+  InternalIndex entry = dictionary->FindInsertionEntry(hash);
   dictionary->SetEntry(isolate, entry, *k, *value, details);
   DCHECK(dictionary->KeyAt(entry).IsNumber() ||
          Shape::Unwrap(dictionary->KeyAt(entry)).IsUniqueName());
@@ -7356,10 +7373,9 @@ Handle<NumberDictionary> NumberDictionary::Set(
 void NumberDictionary::CopyValuesTo(FixedArray elements) {
   ReadOnlyRoots roots = GetReadOnlyRoots();
   int pos = 0;
-  int capacity = this->Capacity();
   DisallowHeapAllocation no_gc;
   WriteBarrierMode mode = elements.GetWriteBarrierMode(no_gc);
-  for (int i = 0; i < capacity; i++) {
+  for (InternalIndex i : this->IterateEntries()) {
     Object k;
     if (this->ToKey(roots, i, &k)) {
       elements.set(pos++, this->ValueAt(i), mode);
@@ -7371,9 +7387,8 @@ void NumberDictionary::CopyValuesTo(FixedArray elements) {
 template <typename Derived, typename Shape>
 int Dictionary<Derived, Shape>::NumberOfEnumerableProperties() {
   ReadOnlyRoots roots = this->GetReadOnlyRoots();
-  int capacity = this->Capacity();
   int result = 0;
-  for (int i = 0; i < capacity; i++) {
+  for (InternalIndex i : this->IterateEntries()) {
     Object k;
     if (!this->ToKey(roots, i, &k)) continue;
     if (k.FilterKey(ENUMERABLE_STRINGS)) continue;
@@ -7388,8 +7403,10 @@ template <typename Dictionary>
 struct EnumIndexComparator {
   explicit EnumIndexComparator(Dictionary dict) : dict(dict) {}
   bool operator()(Tagged_t a, Tagged_t b) {
-    PropertyDetails da(dict.DetailsAt(Smi(static_cast<Address>(a)).value()));
-    PropertyDetails db(dict.DetailsAt(Smi(static_cast<Address>(b)).value()));
+    PropertyDetails da(
+        dict.DetailsAt(InternalIndex(Smi(static_cast<Address>(a)).value())));
+    PropertyDetails db(
+        dict.DetailsAt(InternalIndex(Smi(static_cast<Address>(b)).value())));
     return da.dictionary_index() < db.dictionary_index();
   }
   Dictionary dict;
@@ -7401,51 +7418,55 @@ void BaseNameDictionary<Derived, Shape>::CopyEnumKeysTo(
     KeyCollectionMode mode, KeyAccumulator* accumulator) {
   DCHECK_IMPLIES(mode != KeyCollectionMode::kOwnOnly, accumulator != nullptr);
   int length = storage->length();
-  int capacity = dictionary->Capacity();
   int properties = 0;
   ReadOnlyRoots roots(isolate);
-  for (int i = 0; i < capacity; i++) {
-    Object key;
-    if (!dictionary->ToKey(roots, i, &key)) continue;
-    bool is_shadowing_key = false;
-    if (key.IsSymbol()) continue;
-    PropertyDetails details = dictionary->DetailsAt(i);
-    if (details.IsDontEnum()) {
-      if (mode == KeyCollectionMode::kIncludePrototypes) {
-        is_shadowing_key = true;
-      } else {
+  {
+    AllowHeapAllocation allow_gc;
+    for (InternalIndex i : dictionary->IterateEntries()) {
+      Object key;
+      if (!dictionary->ToKey(roots, i, &key)) continue;
+      bool is_shadowing_key = false;
+      if (key.IsSymbol()) continue;
+      PropertyDetails details = dictionary->DetailsAt(i);
+      if (details.IsDontEnum()) {
+        if (mode == KeyCollectionMode::kIncludePrototypes) {
+          is_shadowing_key = true;
+        } else {
+          continue;
+        }
+      }
+      if (is_shadowing_key) {
+        // This might allocate, but {key} is not used afterwards.
+        accumulator->AddShadowingKey(key, &allow_gc);
         continue;
+      } else {
+        storage->set(properties, Smi::FromInt(i.as_int()));
       }
+      properties++;
+      if (mode == KeyCollectionMode::kOwnOnly && properties == length) break;
     }
-    if (is_shadowing_key) {
-      accumulator->AddShadowingKey(key);
-      continue;
-    } else {
-      storage->set(properties, Smi::FromInt(i));
-    }
-    properties++;
-    if (mode == KeyCollectionMode::kOwnOnly && properties == length) break;
   }
 
   CHECK_EQ(length, properties);
-  DisallowHeapAllocation no_gc;
-  Derived raw_dictionary = *dictionary;
-  FixedArray raw_storage = *storage;
-  EnumIndexComparator<Derived> cmp(raw_dictionary);
-  // Use AtomicSlot wrapper to ensure that std::sort uses atomic load and
-  // store operations that are safe for concurrent marking.
-  AtomicSlot start(storage->GetFirstElementAddress());
-  std::sort(start, start + length, cmp);
-  for (int i = 0; i < length; i++) {
-    int index = Smi::ToInt(raw_storage.get(i));
-    raw_storage.set(i, raw_dictionary.NameAt(index));
+  {
+    DisallowHeapAllocation no_gc;
+    Derived raw_dictionary = *dictionary;
+    FixedArray raw_storage = *storage;
+    EnumIndexComparator<Derived> cmp(raw_dictionary);
+    // Use AtomicSlot wrapper to ensure that std::sort uses atomic load and
+    // store operations that are safe for concurrent marking.
+    AtomicSlot start(storage->GetFirstElementAddress());
+    std::sort(start, start + length, cmp);
+    for (int i = 0; i < length; i++) {
+      InternalIndex index(Smi::ToInt(raw_storage.get(i)));
+      raw_storage.set(i, raw_dictionary.NameAt(index));
+    }
   }
 }
 
 template <typename Derived, typename Shape>
 Handle<FixedArray> BaseNameDictionary<Derived, Shape>::IterationIndices(
     Isolate* isolate, Handle<Derived> dictionary) {
-  int capacity = dictionary->Capacity();
   int length = dictionary->NumberOfElements();
   Handle<FixedArray> array = isolate->factory()->NewFixedArray(length);
   ReadOnlyRoots roots(isolate);
@@ -7453,10 +7474,10 @@ Handle<FixedArray> BaseNameDictionary<Derived, Shape>::IterationIndices(
   {
     DisallowHeapAllocation no_gc;
     Derived raw_dictionary = *dictionary;
-    for (int i = 0; i < capacity; i++) {
+    for (InternalIndex i : dictionary->IterateEntries()) {
       Object k;
       if (!raw_dictionary.ToKey(roots, i, &k)) continue;
-      array->set(array_size++, Smi::FromInt(i));
+      array->set(array_size++, Smi::FromInt(i.as_int()));
     }
 
     DCHECK_EQ(array_size, length);
@@ -7475,21 +7496,25 @@ ExceptionStatus BaseNameDictionary<Derived, Shape>::CollectKeysTo(
     Handle<Derived> dictionary, KeyAccumulator* keys) {
   Isolate* isolate = keys->isolate();
   ReadOnlyRoots roots(isolate);
-  int capacity = dictionary->Capacity();
+  // TODO(jkummerow): Consider using a std::unique_ptr<InternalIndex[]> instead.
   Handle<FixedArray> array =
       isolate->factory()->NewFixedArray(dictionary->NumberOfElements());
   int array_size = 0;
   PropertyFilter filter = keys->filter();
+  // Handle enumerable strings in CopyEnumKeysTo.
+  DCHECK_NE(keys->filter(), ENUMERABLE_STRINGS);
   {
     DisallowHeapAllocation no_gc;
-    Derived raw_dictionary = *dictionary;
-    for (int i = 0; i < capacity; i++) {
-      Object k;
-      if (!raw_dictionary.ToKey(roots, i, &k)) continue;
-      if (k.FilterKey(filter)) continue;
+    for (InternalIndex i : dictionary->IterateEntries()) {
+      Object key;
+      Derived raw_dictionary = *dictionary;
+      if (!raw_dictionary.ToKey(roots, i, &key)) continue;
+      if (key.FilterKey(filter)) continue;
       PropertyDetails details = raw_dictionary.DetailsAt(i);
       if ((details.attributes() & filter) != 0) {
-        keys->AddShadowingKey(k);
+        AllowHeapAllocation gc;
+        // This might allocate, but {key} is not used afterwards.
+        keys->AddShadowingKey(key, &gc);
         continue;
       }
       if (filter & ONLY_ALL_CAN_READ) {
@@ -7498,10 +7523,10 @@ ExceptionStatus BaseNameDictionary<Derived, Shape>::CollectKeysTo(
         if (!accessors.IsAccessorInfo()) continue;
         if (!AccessorInfo::cast(accessors).all_can_read()) continue;
       }
-      array->set(array_size++, Smi::FromInt(i));
+      array->set(array_size++, Smi::FromInt(i.as_int()));
     }
 
-    EnumIndexComparator<Derived> cmp(raw_dictionary);
+    EnumIndexComparator<Derived> cmp(*dictionary);
     // Use AtomicSlot wrapper to ensure that std::sort uses atomic load and
     // store operations that are safe for concurrent marking.
     AtomicSlot start(array->GetFirstElementAddress());
@@ -7510,7 +7535,7 @@ ExceptionStatus BaseNameDictionary<Derived, Shape>::CollectKeysTo(
 
   bool has_seen_symbol = false;
   for (int i = 0; i < array_size; i++) {
-    int index = Smi::ToInt(array->get(i));
+    InternalIndex index(Smi::ToInt(array->get(i)));
     Object key = dictionary->NameAt(index);
     if (key.IsSymbol()) {
       has_seen_symbol = true;
@@ -7521,7 +7546,7 @@ ExceptionStatus BaseNameDictionary<Derived, Shape>::CollectKeysTo(
   }
   if (has_seen_symbol) {
     for (int i = 0; i < array_size; i++) {
-      int index = Smi::ToInt(array->get(i));
+      InternalIndex index(Smi::ToInt(array->get(i)));
       Object key = dictionary->NameAt(index);
       if (!key.IsSymbol()) continue;
       ExceptionStatus status = keys->AddKey(key, DO_NOT_CONVERT);
@@ -7536,8 +7561,7 @@ template <typename Derived, typename Shape>
 Object Dictionary<Derived, Shape>::SlowReverseLookup(Object value) {
   Derived dictionary = Derived::cast(*this);
   ReadOnlyRoots roots = dictionary.GetReadOnlyRoots();
-  int capacity = dictionary.Capacity();
-  for (int i = 0; i < capacity; i++) {
+  for (InternalIndex i : dictionary.IterateEntries()) {
     Object k;
     if (!dictionary.ToKey(roots, i, &k)) continue;
     Object e = dictionary.ValueAt(i);
@@ -7550,7 +7574,7 @@ template <typename Derived, typename Shape>
 void ObjectHashTableBase<Derived, Shape>::FillEntriesWithHoles(
     Handle<Derived> table) {
   int length = table->length();
-  for (int i = Derived::EntryToIndex(0); i < length; i++) {
+  for (int i = Derived::EntryToIndex(InternalIndex(0)); i < length; i++) {
     table->set_the_hole(i);
   }
 }
@@ -7562,8 +7586,8 @@ Object ObjectHashTableBase<Derived, Shape>::Lookup(ReadOnlyRoots roots,
   DisallowHeapAllocation no_gc;
   DCHECK(this->IsKey(roots, *key));
 
-  int entry = this->FindEntry(roots, key, hash);
-  if (entry == kNotFound) return roots.the_hole_value();
+  InternalIndex entry = this->FindEntry(roots, key, hash);
+  if (entry.is_not_found()) return roots.the_hole_value();
   return this->get(Derived::EntryToIndex(entry) + 1);
 }
 
@@ -7589,7 +7613,7 @@ Object ObjectHashTableBase<Derived, Shape>::Lookup(Handle<Object> key,
 }
 
 template <typename Derived, typename Shape>
-Object ObjectHashTableBase<Derived, Shape>::ValueAt(int entry) {
+Object ObjectHashTableBase<Derived, Shape>::ValueAt(InternalIndex entry) {
   return this->get(EntryToValueIndex(entry));
 }
 
@@ -7618,10 +7642,10 @@ Handle<Derived> ObjectHashTableBase<Derived, Shape>::Put(Isolate* isolate,
   DCHECK(table->IsKey(roots, *key));
   DCHECK(!value->IsTheHole(roots));
 
-  int entry = table->FindEntry(roots, key, hash);
+  InternalIndex entry = table->FindEntry(roots, key, hash);
 
   // Key is already in table, just overwrite value.
-  if (entry != kNotFound) {
+  if (entry.is_found()) {
     table->set(Derived::EntryToValueIndex(entry), *value);
     return table;
   }
@@ -7673,8 +7697,8 @@ Handle<Derived> ObjectHashTableBase<Derived, Shape>::Remove(
   ReadOnlyRoots roots = table->GetReadOnlyRoots();
   DCHECK(table->IsKey(roots, *key));
 
-  int entry = table->FindEntry(roots, key, hash);
-  if (entry == kNotFound) {
+  InternalIndex entry = table->FindEntry(roots, key, hash);
+  if (entry.is_not_found()) {
     *was_present = false;
     return table;
   }
@@ -7685,8 +7709,8 @@ Handle<Derived> ObjectHashTableBase<Derived, Shape>::Remove(
 }
 
 template <typename Derived, typename Shape>
-void ObjectHashTableBase<Derived, Shape>::AddEntry(int entry, Object key,
-                                                   Object value) {
+void ObjectHashTableBase<Derived, Shape>::AddEntry(InternalIndex entry,
+                                                   Object key, Object value) {
   Derived* self = static_cast<Derived*>(this);
   self->set_key(Derived::EntryToIndex(entry), key);
   self->set(Derived::EntryToValueIndex(entry), value);
@@ -7694,7 +7718,7 @@ void ObjectHashTableBase<Derived, Shape>::AddEntry(int entry, Object key,
 }
 
 template <typename Derived, typename Shape>
-void ObjectHashTableBase<Derived, Shape>::RemoveEntry(int entry) {
+void ObjectHashTableBase<Derived, Shape>::RemoveEntry(InternalIndex entry) {
   this->set_the_hole(Derived::EntryToIndex(entry));
   this->set_the_hole(Derived::EntryToValueIndex(entry));
   this->ElementRemoved();
@@ -7786,7 +7810,7 @@ Handle<JSArray> JSWeakCollection::GetEntries(Handle<JSWeakCollection> holder,
     for (int i = 0;
          count / values_per_entry < max_entries && i < table->Capacity(); i++) {
       Object key;
-      if (table->ToKey(roots, i, &key)) {
+      if (table->ToKey(roots, InternalIndex(i), &key)) {
         entries->set(count++, key);
         if (values_per_entry > 1) {
           Object value = table->Lookup(handle(key, isolate));
@@ -7800,7 +7824,8 @@ Handle<JSArray> JSWeakCollection::GetEntries(Handle<JSWeakCollection> holder,
 }
 
 Handle<PropertyCell> PropertyCell::InvalidateEntry(
-    Isolate* isolate, Handle<GlobalDictionary> dictionary, int entry) {
+    Isolate* isolate, Handle<GlobalDictionary> dictionary,
+    InternalIndex entry) {
   // Swap with a copy.
   Handle<PropertyCell> cell(dictionary->CellAt(entry), isolate);
   Handle<Name> name(cell->name(), isolate);
@@ -7810,6 +7835,7 @@ Handle<PropertyCell> PropertyCell::InvalidateEntry(
   bool is_the_hole = cell->value().IsTheHole(isolate);
   // Cell is officially mutable henceforth.
   PropertyDetails details = cell->property_details();
+  DCHECK(details.IsConfigurable());
   details = details.set_cell_type(is_the_hole ? PropertyCellType::kUninitialized
                                               : PropertyCellType::kMutable);
   new_cell->set_property_details(details);
@@ -7880,15 +7906,14 @@ PropertyCellType PropertyCell::UpdatedType(Isolate* isolate,
 }
 
 Handle<PropertyCell> PropertyCell::PrepareForValue(
-    Isolate* isolate, Handle<GlobalDictionary> dictionary, int entry,
+    Isolate* isolate, Handle<GlobalDictionary> dictionary, InternalIndex entry,
     Handle<Object> value, PropertyDetails details) {
   DCHECK(!value->IsTheHole(isolate));
   Handle<PropertyCell> cell(dictionary->CellAt(entry), isolate);
   const PropertyDetails original_details = cell->property_details();
   // Data accesses could be cached in ics or optimized code.
   bool invalidate =
-      (original_details.kind() == kData && details.kind() == kAccessor) ||
-      (!original_details.IsReadOnly() && details.IsReadOnly());
+      original_details.kind() == kData && details.kind() == kAccessor;
   int index;
   PropertyCellType old_type = original_details.cell_type();
   // Preserve the enumeration index unless the property was deleted or never
@@ -8140,6 +8165,15 @@ Maybe<bool> JSFinalizationGroup::Cleanup(
     Isolate* isolate, Handle<JSFinalizationGroup> finalization_group,
     Handle<Object> cleanup) {
   DCHECK(cleanup->IsCallable());
+  // Attempt to shrink key_map now, as unregister tokens are held weakly and the
+  // map is not shrinkable when sweeping dead tokens during GC itself.
+  if (!finalization_group->key_map().IsUndefined(isolate)) {
+    Handle<SimpleNumberDictionary> key_map = handle(
+        SimpleNumberDictionary::cast(finalization_group->key_map()), isolate);
+    key_map = SimpleNumberDictionary::Shrink(isolate, key_map);
+    finalization_group->set_key_map(*key_map);
+  }
+
   // It's possible that the cleared_cells list is empty, since
   // FinalizationGroup.unregister() removed all its elements before this task
   // ran. In that case, don't call the cleanup function.
@@ -8170,36 +8204,5 @@ Maybe<bool> JSFinalizationGroup::Cleanup(
   return Just(true);
 }
 
-MaybeHandle<FixedArray> JSReceiver::GetPrivateEntries(
-    Isolate* isolate, Handle<JSReceiver> receiver) {
-  PropertyFilter key_filter = static_cast<PropertyFilter>(PRIVATE_NAMES_ONLY);
-
-  Handle<FixedArray> keys;
-  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-      isolate, keys,
-      KeyAccumulator::GetKeys(receiver, KeyCollectionMode::kOwnOnly, key_filter,
-                              GetKeysConversion::kConvertToString),
-      MaybeHandle<FixedArray>());
-
-  Handle<FixedArray> entries =
-      isolate->factory()->NewFixedArray(keys->length() * 2);
-  int length = 0;
-
-  for (int i = 0; i < keys->length(); ++i) {
-    Handle<Object> obj_key = handle(keys->get(i), isolate);
-    Handle<Symbol> key(Symbol::cast(*obj_key), isolate);
-    CHECK(key->is_private_name());
-    Handle<Object> value;
-    ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-        isolate, value, Object::GetProperty(isolate, receiver, key),
-        MaybeHandle<FixedArray>());
-
-    entries->set(length++, *key);
-    entries->set(length++, *value);
-  }
-  DCHECK_EQ(length, entries->length());
-  return FixedArray::ShrinkOrEmpty(isolate, entries, length);
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/objects.h b/deps/v8/src/objects/objects.h
index f66023456c3ca0..1fa1dde37a8630 100644
--- a/deps/v8/src/objects/objects.h
+++ b/deps/v8/src/objects/objects.h
@@ -70,6 +70,7 @@
 //           - JSWeakSet
 //         - JSCollator            // If V8_INTL_SUPPORT enabled.
 //         - JSDateTimeFormat      // If V8_INTL_SUPPORT enabled.
+//         - JSDisplayNames        // If V8_INTL_SUPPORT enabled.
 //         - JSListFormat          // If V8_INTL_SUPPORT enabled.
 //         - JSLocale              // If V8_INTL_SUPPORT enabled.
 //         - JSNumberFormat        // If V8_INTL_SUPPORT enabled.
@@ -162,10 +163,11 @@
 //       - DebugInfo
 //       - BreakPoint
 //       - BreakPointInfo
+//       - CachedTemplateObject
 //       - StackFrameInfo
 //       - StackTraceFrame
-//       - SourcePositionTableWithFrameCache
 //       - CodeCache
+//       - PropertyDescriptorObject
 //       - PrototypeInfo
 //       - Microtask
 //         - CallbackTask
@@ -274,7 +276,7 @@ class Object : public TaggedImpl<HeapObjectReferenceType::STRONG, Address> {
 
 #define IS_TYPE_FUNCTION_DECL(Type) \
   V8_INLINE bool Is##Type() const;  \
-  V8_INLINE bool Is##Type(Isolate* isolate) const;
+  V8_INLINE bool Is##Type(const Isolate* isolate) const;
   OBJECT_TYPE_LIST(IS_TYPE_FUNCTION_DECL)
   HEAP_OBJECT_TYPE_LIST(IS_TYPE_FUNCTION_DECL)
   IS_TYPE_FUNCTION_DECL(HashTableBase)
@@ -300,7 +302,7 @@ class Object : public TaggedImpl<HeapObjectReferenceType::STRONG, Address> {
 
 #define DECL_STRUCT_PREDICATE(NAME, Name, name) \
   V8_INLINE bool Is##Name() const;              \
-  V8_INLINE bool Is##Name(Isolate* isolate) const;
+  V8_INLINE bool Is##Name(const Isolate* isolate) const;
   STRUCT_LIST(DECL_STRUCT_PREDICATE)
 #undef DECL_STRUCT_PREDICATE
 
@@ -315,9 +317,9 @@ class Object : public TaggedImpl<HeapObjectReferenceType::STRONG, Address> {
   V8_EXPORT_PRIVATE bool ToInt32(int32_t* value);
   inline bool ToUint32(uint32_t* value) const;
 
-  inline Representation OptimalRepresentation(Isolate* isolate) const;
+  inline Representation OptimalRepresentation(const Isolate* isolate) const;
 
-  inline ElementsKind OptimalElementsKind(Isolate* isolate) const;
+  inline ElementsKind OptimalElementsKind(const Isolate* isolate) const;
 
   inline bool FitsRepresentation(Representation representation);
 
@@ -456,8 +458,7 @@ class Object : public TaggedImpl<HeapObjectReferenceType::STRONG, Address> {
       Isolate* isolate, Handle<Object> object, Handle<Object> callable);
 
   V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT static MaybeHandle<Object>
-  GetProperty(LookupIterator* it,
-              OnNonExistent on_non_existent = OnNonExistent::kReturnUndefined);
+  GetProperty(LookupIterator* it, bool is_global_reference = false);
 
   // ES6 [[Set]] (when passed kDontThrow)
   // Invariants for this and related functions (unless stated otherwise):
@@ -569,6 +570,10 @@ class Object : public TaggedImpl<HeapObjectReferenceType::STRONG, Address> {
   // allow kMaxUInt32.
   V8_WARN_UNUSED_RESULT inline bool ToArrayIndex(uint32_t* index) const;
 
+  // Tries to convert an object to an index (in the range 0..size_t::max).
+  // Returns true and sets the output parameter if it succeeds.
+  inline bool ToIntegerIndex(size_t* index) const;
+
   // Returns true if the result of iterating over the object is the same
   // (including observable effects) as simply accessing the properties between 0
   // and length.
diff --git a/deps/v8/src/objects/oddball.h b/deps/v8/src/objects/oddball.h
index e88d96624e9bbb..4f32e157941ee8 100644
--- a/deps/v8/src/objects/oddball.h
+++ b/deps/v8/src/objects/oddball.h
@@ -57,6 +57,8 @@ class Oddball : public TorqueGeneratedOddball<Oddball, PrimitiveHeapObject> {
   STATIC_ASSERT(kNull == Internals::kNullOddballKind);
   STATIC_ASSERT(kUndefined == Internals::kUndefinedOddballKind);
 
+  DECL_PRINTER(Oddball)
+
   TQ_OBJECT_CONSTRUCTORS(Oddball)
 };
 
diff --git a/deps/v8/src/objects/oddball.tq b/deps/v8/src/objects/oddball.tq
new file mode 100644
index 00000000000000..44a3d2aa5171c6
--- /dev/null
+++ b/deps/v8/src/objects/oddball.tq
@@ -0,0 +1,14 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+@apiExposedInstanceTypeValue(0x43)
+@highestInstanceTypeWithinParentClassRange
+extern class Oddball extends PrimitiveHeapObject {
+  to_number_raw: float64;
+  to_string: String;
+  to_number: Number;
+  type_of: String;
+  kind: Smi;
+}
diff --git a/deps/v8/src/objects/ordered-hash-table.tq b/deps/v8/src/objects/ordered-hash-table.tq
new file mode 100644
index 00000000000000..7c40cb204eda43
--- /dev/null
+++ b/deps/v8/src/objects/ordered-hash-table.tq
@@ -0,0 +1,113 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/objects/ordered-hash-table.h'
+
+// Using int as a dummy type-parameter to get access to these constants which
+// don't actually depend on the derived class. This avoids accidentially
+// depending on something from a concrete derived class.
+const kSmallOrderedHashTableMaxCapacity: constexpr int31
+    generates 'SmallOrderedHashTable<int>::kMaxCapacity';
+const kSmallOrderedHashTableNotFound: constexpr int31
+    generates 'SmallOrderedHashTable<int>::kNotFound';
+const kSmallOrderedHashTableLoadFactor: constexpr int31
+    generates 'SmallOrderedHashTable<int>::kLoadFactor';
+
+@noVerifier
+@abstract
+extern class SmallOrderedHashTable extends HeapObject
+    generates 'TNode<HeapObject>' {
+}
+
+extern macro SmallOrderedHashSetMapConstant(): Map;
+const kSmallOrderedHashSetMap: Map = SmallOrderedHashSetMapConstant();
+
+@noVerifier
+extern class SmallOrderedHashSet extends SmallOrderedHashTable {
+  number_of_elements: uint8;
+  number_of_deleted_elements: uint8;
+  number_of_buckets: uint8;
+  @if(TAGGED_SIZE_8_BYTES) padding[5]: uint8;
+  @ifnot(TAGGED_SIZE_8_BYTES) padding[1]: uint8;
+  data_table[Convert<intptr>(number_of_buckets) * kSmallOrderedHashTableLoadFactor]:
+      JSAny|TheHole;
+  hash_table[number_of_buckets]: uint8;
+  chain_table[Convert<intptr>(number_of_buckets) * kSmallOrderedHashTableLoadFactor]:
+      uint8;
+}
+
+@export
+macro AllocateSmallOrderedHashSet(capacity: intptr): SmallOrderedHashSet {
+  const hashTableSize = capacity / kSmallOrderedHashTableLoadFactor;
+  assert(
+      0 <= hashTableSize && hashTableSize <= kSmallOrderedHashTableMaxCapacity);
+  return new SmallOrderedHashSet{
+    map: kSmallOrderedHashSetMap,
+    number_of_elements: 0,
+    number_of_deleted_elements: 0,
+    number_of_buckets: (Convert<uint8>(hashTableSize)),
+    padding: ...ConstantIterator<uint8>(0),
+    data_table: ...ConstantIterator(TheHole),
+    hash_table: ...ConstantIterator<uint8>(kSmallOrderedHashTableNotFound),
+    chain_table: ...ConstantIterator<uint8>(kSmallOrderedHashTableNotFound)
+  };
+}
+
+struct HashMapEntry {
+  key: JSAny|TheHole;
+  value: JSAny|TheHole;
+}
+
+extern macro SmallOrderedHashMapMapConstant(): Map;
+const kSmallOrderedHashMapMap: Map = SmallOrderedHashMapMapConstant();
+
+@noVerifier
+extern class SmallOrderedHashMap extends SmallOrderedHashTable {
+  number_of_elements: uint8;
+  number_of_deleted_elements: uint8;
+  number_of_buckets: uint8;
+  @if(TAGGED_SIZE_8_BYTES) padding[5]: uint8;
+  @ifnot(TAGGED_SIZE_8_BYTES) padding[1]: uint8;
+  data_table[Convert<intptr>(number_of_buckets) * kSmallOrderedHashTableLoadFactor]:
+      HashMapEntry;
+  hash_table[number_of_buckets]: uint8;
+  chain_table[Convert<intptr>(number_of_buckets) * kSmallOrderedHashTableLoadFactor]:
+      uint8;
+}
+
+@export
+macro AllocateSmallOrderedHashMap(capacity: intptr): SmallOrderedHashMap {
+  const hashTableSize = capacity / kSmallOrderedHashTableLoadFactor;
+  assert(
+      0 <= hashTableSize && hashTableSize <= kSmallOrderedHashTableMaxCapacity);
+  return new SmallOrderedHashMap{
+    map: kSmallOrderedHashMapMap,
+    number_of_elements: 0,
+    number_of_deleted_elements: 0,
+    number_of_buckets: (Convert<uint8>(hashTableSize)),
+    padding: ...ConstantIterator<uint8>(0),
+    data_table: ...ConstantIterator(HashMapEntry{key: TheHole, value: TheHole}),
+    hash_table: ...ConstantIterator<uint8>(kSmallOrderedHashTableNotFound),
+    chain_table: ...ConstantIterator<uint8>(kSmallOrderedHashTableNotFound)
+  };
+}
+
+struct NameDictionaryEntry {
+  key: JSAny|TheHole;
+  value: JSAny|TheHole;
+  property_details: Smi|TheHole;
+}
+
+@noVerifier
+extern class SmallOrderedNameDictionary extends SmallOrderedHashTable {
+  hash: int32;
+  number_of_elements: uint8;
+  number_of_deleted_elements: uint8;
+  number_of_buckets: uint8;
+  padding: uint8;
+  data_table[Convert<intptr>(number_of_buckets) * kSmallOrderedHashTableLoadFactor]:
+      NameDictionaryEntry;
+  hash_table[number_of_buckets]: uint8;
+  chain_table[number_of_buckets]: uint8;
+}
diff --git a/deps/v8/src/objects/primitive-heap-object.tq b/deps/v8/src/objects/primitive-heap-object.tq
new file mode 100644
index 00000000000000..244e5072339739
--- /dev/null
+++ b/deps/v8/src/objects/primitive-heap-object.tq
@@ -0,0 +1,8 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+@abstract
+extern class PrimitiveHeapObject extends HeapObject {
+}
diff --git a/deps/v8/src/objects/promise.tq b/deps/v8/src/objects/promise.tq
new file mode 100644
index 00000000000000..a1638e221a9a6d
--- /dev/null
+++ b/deps/v8/src/objects/promise.tq
@@ -0,0 +1,69 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+extern class PromiseCapability extends Struct {
+  promise: JSReceiver|Undefined;
+  // TODO(joshualitt): Can these be typed more specifically.
+  resolve: Object;
+  reject: Object;
+}
+
+// PromiseReaction constants
+type PromiseReactionType extends int31 constexpr 'PromiseReaction::Type';
+const kPromiseReactionFulfill: constexpr PromiseReactionType
+    generates 'PromiseReaction::kFulfill';
+const kPromiseReactionReject: constexpr PromiseReactionType
+    generates 'PromiseReaction::kReject';
+const kPromiseReactionSize:
+    constexpr int31 generates 'PromiseReaction::kSize';
+const kPromiseReactionFulfillHandlerOffset: constexpr int31
+    generates 'PromiseReaction::kFulfillHandlerOffset';
+const kPromiseReactionPromiseOrCapabilityOffset: constexpr int31
+    generates 'PromiseReaction::kPromiseOrCapabilityOffset';
+
+@generateCppClass
+extern class PromiseReaction extends Struct {
+  next: PromiseReaction|Zero;
+  reject_handler: Callable|Undefined;
+  fulfill_handler: Callable|Undefined;
+  // Either a JSPromise (in case of native promises), a PromiseCapability
+  // (general case), or undefined (in case of await).
+  promise_or_capability: JSPromise|PromiseCapability|Undefined;
+}
+
+// PromiseReactionJobTask constants
+const kPromiseReactionJobTaskSizeOfAllPromiseReactionJobTasks: constexpr int31
+    generates 'PromiseReactionJobTask::kSizeOfAllPromiseReactionJobTasks';
+const kPromiseReactionJobTaskHandlerOffset: constexpr int31
+    generates 'PromiseReactionJobTask::kHandlerOffset';
+const kPromiseReactionJobTaskPromiseOrCapabilityOffset: constexpr int31
+    generates 'PromiseReactionJobTask::kPromiseOrCapabilityOffset';
+
+@abstract
+@generateCppClass
+extern class PromiseReactionJobTask extends Microtask {
+  argument: Object;
+  context: Context;
+  handler: Callable|Undefined;
+  // Either a JSPromise (in case of native promises), a PromiseCapability
+  // (general case), or undefined (in case of await).
+  promise_or_capability: JSPromise|PromiseCapability|Undefined;
+}
+
+@generateCppClass
+extern class PromiseFulfillReactionJobTask extends PromiseReactionJobTask {
+}
+
+@generateCppClass
+extern class PromiseRejectReactionJobTask extends PromiseReactionJobTask {
+}
+
+@generateCppClass
+extern class PromiseResolveThenableJobTask extends Microtask {
+  context: Context;
+  promise_to_resolve: JSPromise;
+  then: JSReceiver;
+  thenable: JSReceiver;
+}
diff --git a/deps/v8/src/objects/property-array-inl.h b/deps/v8/src/objects/property-array-inl.h
index e9365c03a4e535..c942177554ff4c 100644
--- a/deps/v8/src/objects/property-array-inl.h
+++ b/deps/v8/src/objects/property-array-inl.h
@@ -25,11 +25,11 @@ SMI_ACCESSORS(PropertyArray, length_and_hash, kLengthAndHashOffset)
 SYNCHRONIZED_SMI_ACCESSORS(PropertyArray, length_and_hash, kLengthAndHashOffset)
 
 Object PropertyArray::get(int index) const {
-  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   return get(isolate, index);
 }
 
-Object PropertyArray::get(Isolate* isolate, int index) const {
+Object PropertyArray::get(const Isolate* isolate, int index) const {
   DCHECK_LT(static_cast<unsigned>(index),
             static_cast<unsigned>(this->length()));
   return TaggedField<Object>::Relaxed_Load(isolate, *this,
diff --git a/deps/v8/src/objects/property-array.h b/deps/v8/src/objects/property-array.h
index 62a472aa901eec..c8e9041c6ed73d 100644
--- a/deps/v8/src/objects/property-array.h
+++ b/deps/v8/src/objects/property-array.h
@@ -30,7 +30,7 @@ class PropertyArray : public HeapObject {
   inline int Hash() const;
 
   inline Object get(int index) const;
-  inline Object get(Isolate* isolate, int index) const;
+  inline Object get(const Isolate* isolate, int index) const;
 
   inline void set(int index, Object value);
   // Setter with explicit barrier mode.
@@ -55,16 +55,15 @@ class PropertyArray : public HeapObject {
 
   DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
                                 TORQUE_GENERATED_PROPERTY_ARRAY_FIELDS)
-  static const int kHeaderSize = kSize;
 
   // Garbage collection support.
   using BodyDescriptor = FlexibleBodyDescriptor<kHeaderSize>;
 
   static const int kLengthFieldSize = 10;
-  using LengthField = BitField<int, 0, kLengthFieldSize>;
+  using LengthField = base::BitField<int, 0, kLengthFieldSize>;
   static const int kMaxLength = LengthField::kMax;
-  using HashField =
-      BitField<int, kLengthFieldSize, kSmiValueSize - kLengthFieldSize - 1>;
+  using HashField = base::BitField<int, kLengthFieldSize,
+                                   kSmiValueSize - kLengthFieldSize - 1>;
 
   static const int kNoHashSentinel = 0;
 
diff --git a/deps/v8/src/objects/property-array.tq b/deps/v8/src/objects/property-array.tq
new file mode 100644
index 00000000000000..d1dd1425513e0a
--- /dev/null
+++ b/deps/v8/src/objects/property-array.tq
@@ -0,0 +1,5 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class PropertyArray extends HeapObject { length_and_hash: Smi; }
diff --git a/deps/v8/src/objects/property-cell.h b/deps/v8/src/objects/property-cell.h
index b336986f621980..e6902f4f7cba5a 100644
--- a/deps/v8/src/objects/property-cell.h
+++ b/deps/v8/src/objects/property-cell.h
@@ -41,11 +41,12 @@ class PropertyCell : public HeapObject {
   // As a result the old cell could be invalidated and/or dependent code could
   // be deoptimized. Returns the prepared property cell.
   static Handle<PropertyCell> PrepareForValue(
-      Isolate* isolate, Handle<GlobalDictionary> dictionary, int entry,
-      Handle<Object> value, PropertyDetails details);
+      Isolate* isolate, Handle<GlobalDictionary> dictionary,
+      InternalIndex entry, Handle<Object> value, PropertyDetails details);
 
   static Handle<PropertyCell> InvalidateEntry(
-      Isolate* isolate, Handle<GlobalDictionary> dictionary, int entry);
+      Isolate* isolate, Handle<GlobalDictionary> dictionary,
+      InternalIndex entry);
 
   static void SetValueWithInvalidation(Isolate* isolate, const char* cell_name,
                                        Handle<PropertyCell> cell,
diff --git a/deps/v8/src/objects/property-cell.tq b/deps/v8/src/objects/property-cell.tq
new file mode 100644
index 00000000000000..0b6e0ad1066bd4
--- /dev/null
+++ b/deps/v8/src/objects/property-cell.tq
@@ -0,0 +1,10 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class PropertyCell extends HeapObject {
+  name: AnyName;
+  property_details_raw: Smi;
+  value: Object;
+  dependent_code: DependentCode;
+}
diff --git a/deps/v8/src/objects/property-descriptor-object-inl.h b/deps/v8/src/objects/property-descriptor-object-inl.h
index 7754de5964ba04..524018d2ff9938 100644
--- a/deps/v8/src/objects/property-descriptor-object-inl.h
+++ b/deps/v8/src/objects/property-descriptor-object-inl.h
@@ -14,8 +14,7 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(PropertyDescriptorObject, FixedArray)
-CAST_ACCESSOR(PropertyDescriptorObject)
+TQ_OBJECT_CONSTRUCTORS_IMPL(PropertyDescriptorObject)
 }
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/property-descriptor-object.h b/deps/v8/src/objects/property-descriptor-object.h
index f4930c4a31cbd7..2172c0002e1d6a 100644
--- a/deps/v8/src/objects/property-descriptor-object.h
+++ b/deps/v8/src/objects/property-descriptor-object.h
@@ -5,8 +5,8 @@
 #ifndef V8_OBJECTS_PROPERTY_DESCRIPTOR_OBJECT_H_
 #define V8_OBJECTS_PROPERTY_DESCRIPTOR_OBJECT_H_
 
-#include "src/objects/fixed-array.h"
-#include "src/objects/objects.h"
+#include "src/base/bit-field.h"
+#include "src/objects/struct.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -14,7 +14,9 @@
 namespace v8 {
 namespace internal {
 
-class PropertyDescriptorObject : public FixedArray {
+class PropertyDescriptorObject
+    : public TorqueGeneratedPropertyDescriptorObject<PropertyDescriptorObject,
+                                                     Struct> {
  public:
 #define FLAGS_BIT_FIELDS(V, _)      \
   V(IsEnumerableBit, bool, 1, _)    \
@@ -30,10 +32,6 @@ class PropertyDescriptorObject : public FixedArray {
   DEFINE_BIT_FIELDS(FLAGS_BIT_FIELDS)
 #undef FLAGS_BIT_FIELDS
 
-  enum { kFlagsIndex, kValueIndex, kGetIndex, kSetIndex, kLength };
-
-  DECL_CAST(PropertyDescriptorObject)
-
   static const int kRegularAccessorPropertyBits =
       HasEnumerableBit::kMask | HasConfigurableBit::kMask | HasGetBit::kMask |
       HasSetBit::kMask;
@@ -47,16 +45,7 @@ class PropertyDescriptorObject : public FixedArray {
                               HasWritableBit::kMask | HasValueBit::kMask |
                               HasGetBit::kMask | HasSetBit::kMask;
 
-  static const int kValueOffset =
-      FixedArray::OffsetOfElementAt(PropertyDescriptorObject::kValueIndex);
-  static const int kFlagsOffset =
-      FixedArray::OffsetOfElementAt(PropertyDescriptorObject::kFlagsIndex);
-  static const int kGetOffset =
-      FixedArray::OffsetOfElementAt(PropertyDescriptorObject::kGetIndex);
-  static const int kSetOffset =
-      FixedArray::OffsetOfElementAt(PropertyDescriptorObject::kSetIndex);
-
-  OBJECT_CONSTRUCTORS(PropertyDescriptorObject, FixedArray);
+  TQ_OBJECT_CONSTRUCTORS(PropertyDescriptorObject)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/property-descriptor-object.tq b/deps/v8/src/objects/property-descriptor-object.tq
new file mode 100644
index 00000000000000..b71a1e887865b7
--- /dev/null
+++ b/deps/v8/src/objects/property-descriptor-object.tq
@@ -0,0 +1,14 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/objects/property-descriptor-object.h'
+
+@generateCppClass
+@generatePrint
+extern class PropertyDescriptorObject extends Struct {
+  flags: Smi;
+  value: JSAny|TheHole;
+  get: JSAny|TheHole;
+  set: JSAny|TheHole;
+}
diff --git a/deps/v8/src/objects/property-descriptor.cc b/deps/v8/src/objects/property-descriptor.cc
index c5cfe8c9a9ddc7..325de41c2b8691 100644
--- a/deps/v8/src/objects/property-descriptor.cc
+++ b/deps/v8/src/objects/property-descriptor.cc
@@ -22,7 +22,7 @@ namespace {
 // Returns false if an exception was thrown.
 bool GetPropertyIfPresent(Handle<JSReceiver> receiver, Handle<String> name,
                           Handle<Object>* value) {
-  LookupIterator it(receiver, name, receiver);
+  LookupIterator it(receiver->GetIsolate(), receiver, name, receiver);
   // 4. Let hasEnumerable be HasProperty(Obj, "enumerable").
   Maybe<bool> has_property = JSReceiver::HasProperty(&it);
   // 5. ReturnIfAbrupt(hasEnumerable).
@@ -112,7 +112,8 @@ bool ToPropertyDescriptorFastPath(Isolate* isolate, Handle<JSReceiver> obj,
 
 void CreateDataProperty(Handle<JSObject> object, Handle<String> name,
                         Handle<Object> value) {
-  LookupIterator it(object, name, object, LookupIterator::OWN_SKIP_INTERCEPTOR);
+  LookupIterator it(object->GetIsolate(), object, name, object,
+                    LookupIterator::OWN_SKIP_INTERCEPTOR);
   Maybe<bool> result = JSObject::CreateDataProperty(&it, value);
   CHECK(result.IsJust() && result.FromJust());
 }
@@ -340,8 +341,8 @@ void PropertyDescriptor::CompletePropertyDescriptor(Isolate* isolate,
 
 Handle<PropertyDescriptorObject> PropertyDescriptor::ToPropertyDescriptorObject(
     Isolate* isolate) {
-  Handle<PropertyDescriptorObject> obj = Handle<PropertyDescriptorObject>::cast(
-      isolate->factory()->NewFixedArray(PropertyDescriptorObject::kLength));
+  Handle<PropertyDescriptorObject> obj =
+      isolate->factory()->NewPropertyDescriptorObject();
 
   int flags =
       PropertyDescriptorObject::IsEnumerableBit::encode(enumerable_) |
@@ -354,14 +355,11 @@ Handle<PropertyDescriptorObject> PropertyDescriptor::ToPropertyDescriptorObject(
       PropertyDescriptorObject::HasGetBit::encode(has_get()) |
       PropertyDescriptorObject::HasSetBit::encode(has_set());
 
-  obj->set(PropertyDescriptorObject::kFlagsIndex, Smi::FromInt(flags));
+  obj->set_flags(Smi::FromInt(flags));
 
-  obj->set(PropertyDescriptorObject::kValueIndex,
-           has_value() ? *value_ : ReadOnlyRoots(isolate).the_hole_value());
-  obj->set(PropertyDescriptorObject::kGetIndex,
-           has_get() ? *get_ : ReadOnlyRoots(isolate).the_hole_value());
-  obj->set(PropertyDescriptorObject::kSetIndex,
-           has_set() ? *set_ : ReadOnlyRoots(isolate).the_hole_value());
+  if (has_value()) obj->set_value(*value_);
+  if (has_get()) obj->set_get(*get_);
+  if (has_set()) obj->set_set(*set_);
 
   return obj;
 }
diff --git a/deps/v8/src/objects/property-details.h b/deps/v8/src/objects/property-details.h
index 51318f475af552..a23a1e3a0ece90 100644
--- a/deps/v8/src/objects/property-details.h
+++ b/deps/v8/src/objects/property-details.h
@@ -8,8 +8,8 @@
 #include "include/v8.h"
 #include "src/utils/allocation.h"
 // TODO(bmeurer): Remove once FLAG_modify_field_representation_inplace is gone.
+#include "src/base/bit-field.h"
 #include "src/flags/flags.h"
-#include "src/utils/utils.h"
 
 namespace v8 {
 namespace internal {
@@ -322,7 +322,7 @@ class PropertyDetails {
 
   // Bit fields in value_ (type, shift, size). Must be public so the
   // constants can be embedded in generated code.
-  using KindField = BitField<PropertyKind, 0, 1>;
+  using KindField = base::BitField<PropertyKind, 0, 1>;
   using LocationField = KindField::Next<PropertyLocation, 1>;
   using ConstnessField = LocationField::Next<PropertyConstness, 1>;
   using AttributesField = ConstnessField::Next<PropertyAttributes, 3>;
diff --git a/deps/v8/src/objects/property.cc b/deps/v8/src/objects/property.cc
index fba6fe34057af5..9b94739bf23776 100644
--- a/deps/v8/src/objects/property.cc
+++ b/deps/v8/src/objects/property.cc
@@ -75,7 +75,7 @@ Descriptor Descriptor::DataField(Handle<Name> key, int field_index,
 
 Descriptor Descriptor::DataConstant(Handle<Name> key, Handle<Object> value,
                                     PropertyAttributes attributes) {
-  Isolate* isolate = GetIsolateForPtrCompr(*key);
+  const Isolate* isolate = GetIsolateForPtrCompr(*key);
   return Descriptor(key, MaybeObjectHandle(value), kData, attributes,
                     kDescriptor, PropertyConstness::kConst,
                     value->OptimalRepresentation(isolate), 0);
diff --git a/deps/v8/src/objects/prototype-info-inl.h b/deps/v8/src/objects/prototype-info-inl.h
index b83bb1346a4da6..80efa862c283f2 100644
--- a/deps/v8/src/objects/prototype-info-inl.h
+++ b/deps/v8/src/objects/prototype-info-inl.h
@@ -41,6 +41,8 @@ bool PrototypeInfo::HasObjectCreateMap() {
 
 ACCESSORS(PrototypeInfo, module_namespace, Object, kJsModuleNamespaceOffset)
 ACCESSORS(PrototypeInfo, prototype_users, Object, kPrototypeUsersOffset)
+ACCESSORS(PrototypeInfo, prototype_chain_enum_cache, Object,
+          kPrototypeChainEnumCacheOffset)
 WEAK_ACCESSORS(PrototypeInfo, object_create_map, kObjectCreateMapOffset)
 SMI_ACCESSORS(PrototypeInfo, registry_slot, kRegistrySlotOffset)
 SMI_ACCESSORS(PrototypeInfo, bit_field, kBitFieldOffset)
diff --git a/deps/v8/src/objects/prototype-info.h b/deps/v8/src/objects/prototype-info.h
index 6f777eda8936c8..ab238bd9c2fb01 100644
--- a/deps/v8/src/objects/prototype-info.h
+++ b/deps/v8/src/objects/prototype-info.h
@@ -30,6 +30,8 @@ class PrototypeInfo : public Struct {
   // this prototype, or Smi(0) if uninitialized.
   DECL_ACCESSORS(prototype_users, Object)
 
+  DECL_ACCESSORS(prototype_chain_enum_cache, Object)
+
   // [object_create_map]: A field caching the map for Object.create(prototype).
   static inline void SetObjectCreateMap(Handle<PrototypeInfo> info,
                                         Handle<Map> map);
diff --git a/deps/v8/src/objects/prototype-info.tq b/deps/v8/src/objects/prototype-info.tq
new file mode 100644
index 00000000000000..77ffa4358d7f06
--- /dev/null
+++ b/deps/v8/src/objects/prototype-info.tq
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class PrototypeInfo extends Struct {
+  js_module_namespace: JSModuleNamespace|Undefined;
+  prototype_users: WeakArrayList|Zero;
+  prototype_chain_enum_cache: FixedArray|Object|Undefined;
+  registry_slot: Smi;
+  validity_cell: Object;
+  object_create_map: Weak<Map>|Undefined;
+  bit_field: Smi;
+}
+
+extern macro PrototypeInfoMapConstant(): Map;
+const kPrototypeInfoMap: Map = PrototypeInfoMapConstant();
+
+Cast<PrototypeInfo>(o: HeapObject): PrototypeInfo labels CastError {
+  if (o.map != kPrototypeInfoMap) goto CastError;
+  return %RawDownCast<PrototypeInfo>(o);
+}
diff --git a/deps/v8/src/objects/regexp-match-info.h b/deps/v8/src/objects/regexp-match-info.h
index 859dc4a09a62f2..e862f687c6adf7 100644
--- a/deps/v8/src/objects/regexp-match-info.h
+++ b/deps/v8/src/objects/regexp-match-info.h
@@ -45,6 +45,9 @@ class V8_EXPORT_PRIVATE RegExpMatchInfo : NON_EXPORTED_BASE(public FixedArray) {
   inline int Capture(int i);
   inline void SetCapture(int i, int value);
 
+  // Creates a new RegExpMatchInfo with space for capture_count captures.
+  static Handle<RegExpMatchInfo> New(Isolate* isolate, int capture_count);
+
   // Reserves space for captures.
   static Handle<RegExpMatchInfo> ReserveCaptures(
       Isolate* isolate, Handle<RegExpMatchInfo> match_info, int capture_count);
diff --git a/deps/v8/src/objects/regexp-match-info.tq b/deps/v8/src/objects/regexp-match-info.tq
new file mode 100644
index 00000000000000..6940ce4583688c
--- /dev/null
+++ b/deps/v8/src/objects/regexp-match-info.tq
@@ -0,0 +1,29 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@hasSameInstanceTypeAsParent
+extern class RegExpMatchInfo extends FixedArray {
+  macro GetStartOfCapture(implicit context: Context)(captureIndex:
+                                                         constexpr int31): Smi {
+    const index: constexpr int31 = GetStartOfCaptureIndex(captureIndex);
+    return UnsafeCast<Smi>(this.objects[index]);
+  }
+  macro GetEndOfCapture(implicit context: Context)(captureIndex:
+                                                       constexpr int31): Smi {
+    const index: constexpr int31 = GetStartOfCaptureIndex(captureIndex) + 1;
+    return UnsafeCast<Smi>(this.objects[index]);
+  }
+  macro NumberOfCaptures(implicit context: Context)(): Smi {
+    return UnsafeCast<Smi>(this.objects[kRegExpMatchInfoNumberOfCapturesIndex]);
+  }
+}
+
+const kRegExpMatchInfoFirstCaptureIndex:
+    constexpr int31 generates 'RegExpMatchInfo::kFirstCaptureIndex';
+const kRegExpMatchInfoNumberOfCapturesIndex:
+    constexpr int31 generates 'RegExpMatchInfo::kNumberOfCapturesIndex';
+
+macro GetStartOfCaptureIndex(captureIndex: constexpr int31): constexpr int31 {
+  return kRegExpMatchInfoFirstCaptureIndex + (captureIndex * 2);
+}
diff --git a/deps/v8/src/objects/scope-info.cc b/deps/v8/src/objects/scope-info.cc
index 65a26e5d98feba..f1112332ad703d 100644
--- a/deps/v8/src/objects/scope-info.cc
+++ b/deps/v8/src/objects/scope-info.cc
@@ -72,6 +72,7 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
   for (Variable* var : *scope->locals()) {
     switch (var->location()) {
       case VariableLocation::CONTEXT:
+      case VariableLocation::REPL_GLOBAL:
         context_local_count++;
         break;
       case VariableLocation::MODULE:
@@ -87,16 +88,16 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
       scope->AsDeclarationScope()->has_this_declaration()) {
     Variable* var = scope->AsDeclarationScope()->receiver();
     if (!var->is_used()) {
-      receiver_info = UNUSED;
+      receiver_info = VariableAllocationInfo::UNUSED;
     } else if (var->IsContextSlot()) {
-      receiver_info = CONTEXT;
+      receiver_info = VariableAllocationInfo::CONTEXT;
       context_local_count++;
     } else {
       DCHECK(var->IsParameter());
-      receiver_info = STACK;
+      receiver_info = VariableAllocationInfo::STACK;
     }
   } else {
-    receiver_info = NONE;
+    receiver_info = VariableAllocationInfo::NONE;
   }
 
   DCHECK(module_vars_count == 0 || scope->is_module_scope());
@@ -116,23 +117,23 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
     if (scope->AsDeclarationScope()->function_var() != nullptr) {
       Variable* var = scope->AsDeclarationScope()->function_var();
       if (!var->is_used()) {
-        function_name_info = UNUSED;
+        function_name_info = VariableAllocationInfo::UNUSED;
       } else if (var->IsContextSlot()) {
-        function_name_info = CONTEXT;
+        function_name_info = VariableAllocationInfo::CONTEXT;
       } else {
         DCHECK(var->IsStackLocal());
-        function_name_info = STACK;
+        function_name_info = VariableAllocationInfo::STACK;
       }
     } else {
       // Always reserve space for the debug name in the scope info.
-      function_name_info = UNUSED;
+      function_name_info = VariableAllocationInfo::UNUSED;
     }
   } else if (scope->is_module_scope() || scope->is_script_scope() ||
              scope->is_eval_scope()) {
     // Always reserve space for the debug name in the scope info.
-    function_name_info = UNUSED;
+    function_name_info = VariableAllocationInfo::UNUSED;
   } else {
-    function_name_info = NONE;
+    function_name_info = VariableAllocationInfo::NONE;
   }
 
   const bool has_brand = scope->is_class_scope()
@@ -142,9 +143,11 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
       scope->is_class_scope()
           ? scope->AsClassScope()->should_save_class_variable_index()
           : false;
-  const bool has_function_name = function_name_info != NONE;
+  const bool has_function_name =
+      function_name_info != VariableAllocationInfo::NONE;
   const bool has_position_info = NeedsPositionInfo(scope->scope_type());
-  const bool has_receiver = receiver_info == STACK || receiver_info == CONTEXT;
+  const bool has_receiver = receiver_info == VariableAllocationInfo::STACK ||
+                            receiver_info == VariableAllocationInfo::CONTEXT;
   const int parameter_count =
       scope->is_declaration_scope()
           ? scope->AsDeclarationScope()->num_parameters()
@@ -187,26 +190,29 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
 
     // Encode the flags.
     int flags =
-        ScopeTypeField::encode(scope->scope_type()) |
-        SloppyEvalCanExtendVarsField::encode(sloppy_eval_can_extend_vars) |
-        LanguageModeField::encode(scope->language_mode()) |
-        DeclarationScopeField::encode(scope->is_declaration_scope()) |
-        ReceiverVariableField::encode(receiver_info) |
-        HasClassBrandField::encode(has_brand) |
-        HasSavedClassVariableIndexField::encode(
+        ScopeTypeBits::encode(scope->scope_type()) |
+        SloppyEvalCanExtendVarsBit::encode(sloppy_eval_can_extend_vars) |
+        LanguageModeBit::encode(scope->language_mode()) |
+        DeclarationScopeBit::encode(scope->is_declaration_scope()) |
+        ReceiverVariableBits::encode(receiver_info) |
+        HasClassBrandBit::encode(has_brand) |
+        HasSavedClassVariableIndexBit::encode(
             should_save_class_variable_index) |
-        HasNewTargetField::encode(has_new_target) |
-        FunctionVariableField::encode(function_name_info) |
-        HasInferredFunctionNameField::encode(has_inferred_function_name) |
-        IsAsmModuleField::encode(is_asm_module) |
-        HasSimpleParametersField::encode(has_simple_parameters) |
-        FunctionKindField::encode(function_kind) |
-        HasOuterScopeInfoField::encode(has_outer_scope_info) |
-        IsDebugEvaluateScopeField::encode(scope->is_debug_evaluate_scope()) |
-        ForceContextAllocationField::encode(
+        HasNewTargetBit::encode(has_new_target) |
+        FunctionVariableBits::encode(function_name_info) |
+        HasInferredFunctionNameBit::encode(has_inferred_function_name) |
+        IsAsmModuleBit::encode(is_asm_module) |
+        HasSimpleParametersBit::encode(has_simple_parameters) |
+        FunctionKindBits::encode(function_kind) |
+        HasOuterScopeInfoBit::encode(has_outer_scope_info) |
+        IsDebugEvaluateScopeBit::encode(scope->is_debug_evaluate_scope()) |
+        ForceContextAllocationBit::encode(
             scope->ForceContextForLanguageMode()) |
-        PrivateNameLookupSkipsOuterClassField::encode(
-            scope->private_name_lookup_skips_outer_class());
+        PrivateNameLookupSkipsOuterClassBit::encode(
+            scope->private_name_lookup_skips_outer_class()) |
+        HasContextExtensionSlotBit::encode(scope->HasContextExtensionSlot()) |
+        IsReplModeScopeBit::encode(scope->is_repl_mode_scope()) |
+        HasLocalsBlackListBit::encode(false);
     scope_info.SetFlags(flags);
 
     scope_info.SetParameterCount(parameter_count);
@@ -220,10 +226,11 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
 
     for (Variable* var : *scope->locals()) {
       switch (var->location()) {
-        case VariableLocation::CONTEXT: {
+        case VariableLocation::CONTEXT:
+        case VariableLocation::REPL_GLOBAL: {
           // Due to duplicate parameters, context locals aren't guaranteed to
           // come in order.
-          int local_index = var->index() - Context::MIN_CONTEXT_SLOTS;
+          int local_index = var->index() - scope->ContextHeaderLength();
           DCHECK_LE(0, local_index);
           DCHECK_LT(local_index, context_local_count);
           uint32_t info =
@@ -269,7 +276,7 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
       for (int i = 0; i < parameter_count; i++) {
         Variable* parameter = scope->AsDeclarationScope()->parameter(i);
         if (parameter->location() != VariableLocation::CONTEXT) continue;
-        int index = parameter->index() - Context::MIN_CONTEXT_SLOTS;
+        int index = parameter->index() - scope->ContextHeaderLength();
         int info_index = context_local_info_base + index;
         int info = Smi::ToInt(scope_info.get(info_index));
         info = ParameterNumberField::update(info, i);
@@ -280,7 +287,7 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
       if (scope->AsDeclarationScope()->has_this_declaration()) {
         Variable* var = scope->AsDeclarationScope()->receiver();
         if (var->location() == VariableLocation::CONTEXT) {
-          int local_index = var->index() - Context::MIN_CONTEXT_SLOTS;
+          int local_index = var->index() - scope->ContextHeaderLength();
           uint32_t info =
               VariableModeField::encode(var->mode()) |
               InitFlagField::encode(var->initialization_flag()) |
@@ -320,14 +327,14 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
     if (has_function_name) {
       Variable* var = scope->AsDeclarationScope()->function_var();
       int var_index = -1;
-      Object name = Smi::kZero;
+      Object name = Smi::zero();
       if (var != nullptr) {
         var_index = var->index();
         name = *var->name();
       }
       scope_info.set(index++, name, mode);
       scope_info.set(index++, Smi::FromInt(var_index));
-      DCHECK(function_name_info != CONTEXT ||
+      DCHECK(function_name_info != VariableAllocationInfo::CONTEXT ||
              var_index == scope_info.ContextLength() - 1);
     }
 
@@ -380,19 +387,23 @@ Handle<ScopeInfo> ScopeInfo::CreateForWithScope(
 
   // Encode the flags.
   int flags =
-      ScopeTypeField::encode(WITH_SCOPE) |
-      SloppyEvalCanExtendVarsField::encode(false) |
-      LanguageModeField::encode(LanguageMode::kSloppy) |
-      DeclarationScopeField::encode(false) |
-      ReceiverVariableField::encode(NONE) | HasClassBrandField::encode(false) |
-      HasSavedClassVariableIndexField::encode(false) |
-      HasNewTargetField::encode(false) | FunctionVariableField::encode(NONE) |
-      IsAsmModuleField::encode(false) | HasSimpleParametersField::encode(true) |
-      FunctionKindField::encode(kNormalFunction) |
-      HasOuterScopeInfoField::encode(has_outer_scope_info) |
-      IsDebugEvaluateScopeField::encode(false) |
-      ForceContextAllocationField::encode(false) |
-      PrivateNameLookupSkipsOuterClassField::encode(false);
+      ScopeTypeBits::encode(WITH_SCOPE) |
+      SloppyEvalCanExtendVarsBit::encode(false) |
+      LanguageModeBit::encode(LanguageMode::kSloppy) |
+      DeclarationScopeBit::encode(false) |
+      ReceiverVariableBits::encode(VariableAllocationInfo::NONE) |
+      HasClassBrandBit::encode(false) |
+      HasSavedClassVariableIndexBit::encode(false) |
+      HasNewTargetBit::encode(false) |
+      FunctionVariableBits::encode(VariableAllocationInfo::NONE) |
+      IsAsmModuleBit::encode(false) | HasSimpleParametersBit::encode(true) |
+      FunctionKindBits::encode(kNormalFunction) |
+      HasOuterScopeInfoBit::encode(has_outer_scope_info) |
+      IsDebugEvaluateScopeBit::encode(false) |
+      ForceContextAllocationBit::encode(false) |
+      PrivateNameLookupSkipsOuterClassBit::encode(false) |
+      HasContextExtensionSlotBit::encode(true) |
+      IsReplModeScopeBit::encode(false) | HasLocalsBlackListBit::encode(false);
   scope_info->SetFlags(flags);
 
   scope_info->SetParameterCount(0);
@@ -409,29 +420,35 @@ Handle<ScopeInfo> ScopeInfo::CreateForWithScope(
   }
   DCHECK_EQ(index, scope_info->length());
   DCHECK_EQ(0, scope_info->ParameterCount());
-  DCHECK_EQ(Context::MIN_CONTEXT_SLOTS, scope_info->ContextLength());
+  DCHECK_EQ(scope_info->ContextHeaderLength(), scope_info->ContextLength());
   return scope_info;
 }
 
 // static
 Handle<ScopeInfo> ScopeInfo::CreateGlobalThisBinding(Isolate* isolate) {
-  return CreateForBootstrapping(isolate, SCRIPT_SCOPE);
+  return CreateForBootstrapping(isolate, BootstrappingType::kScript);
 }
 
 // static
 Handle<ScopeInfo> ScopeInfo::CreateForEmptyFunction(Isolate* isolate) {
-  return CreateForBootstrapping(isolate, FUNCTION_SCOPE);
+  return CreateForBootstrapping(isolate, BootstrappingType::kFunction);
 }
 
 // static
-Handle<ScopeInfo> ScopeInfo::CreateForBootstrapping(Isolate* isolate,
-                                                    ScopeType type) {
-  DCHECK(type == SCRIPT_SCOPE || type == FUNCTION_SCOPE);
+Handle<ScopeInfo> ScopeInfo::CreateForNativeContext(Isolate* isolate) {
+  return CreateForBootstrapping(isolate, BootstrappingType::kNative);
+}
 
+// static
+Handle<ScopeInfo> ScopeInfo::CreateForBootstrapping(Isolate* isolate,
+                                                    BootstrappingType type) {
   const int parameter_count = 0;
-  const bool is_empty_function = type == FUNCTION_SCOPE;
-  const int context_local_count = is_empty_function ? 0 : 1;
-  const bool has_receiver = !is_empty_function;
+  const bool is_empty_function = type == BootstrappingType::kFunction;
+  const bool is_native_context = type == BootstrappingType::kNative;
+  const bool is_script = type == BootstrappingType::kScript;
+  const int context_local_count =
+      is_empty_function || is_native_context ? 0 : 1;
+  const bool has_receiver = is_script;
   const bool has_inferred_function_name = is_empty_function;
   const bool has_position_info = true;
   const int length = kVariablePartIndex + 2 * context_local_count +
@@ -446,22 +463,27 @@ Handle<ScopeInfo> ScopeInfo::CreateForBootstrapping(Isolate* isolate,
 
   // Encode the flags.
   int flags =
-      ScopeTypeField::encode(type) |
-      SloppyEvalCanExtendVarsField::encode(false) |
-      LanguageModeField::encode(LanguageMode::kSloppy) |
-      DeclarationScopeField::encode(true) |
-      ReceiverVariableField::encode(is_empty_function ? UNUSED : CONTEXT) |
-      HasClassBrandField::encode(false) |
-      HasSavedClassVariableIndexField::encode(false) |
-      HasNewTargetField::encode(false) |
-      FunctionVariableField::encode(is_empty_function ? UNUSED : NONE) |
-      HasInferredFunctionNameField::encode(has_inferred_function_name) |
-      IsAsmModuleField::encode(false) | HasSimpleParametersField::encode(true) |
-      FunctionKindField::encode(FunctionKind::kNormalFunction) |
-      HasOuterScopeInfoField::encode(false) |
-      IsDebugEvaluateScopeField::encode(false) |
-      ForceContextAllocationField::encode(false) |
-      PrivateNameLookupSkipsOuterClassField::encode(false);
+      ScopeTypeBits::encode(is_empty_function ? FUNCTION_SCOPE : SCRIPT_SCOPE) |
+      SloppyEvalCanExtendVarsBit::encode(false) |
+      LanguageModeBit::encode(LanguageMode::kSloppy) |
+      DeclarationScopeBit::encode(true) |
+      ReceiverVariableBits::encode(is_script ? VariableAllocationInfo::CONTEXT
+                                             : VariableAllocationInfo::UNUSED) |
+      HasClassBrandBit::encode(false) |
+      HasSavedClassVariableIndexBit::encode(false) |
+      HasNewTargetBit::encode(false) |
+      FunctionVariableBits::encode(is_empty_function
+                                       ? VariableAllocationInfo::UNUSED
+                                       : VariableAllocationInfo::NONE) |
+      HasInferredFunctionNameBit::encode(has_inferred_function_name) |
+      IsAsmModuleBit::encode(false) | HasSimpleParametersBit::encode(true) |
+      FunctionKindBits::encode(FunctionKind::kNormalFunction) |
+      HasOuterScopeInfoBit::encode(false) |
+      IsDebugEvaluateScopeBit::encode(false) |
+      ForceContextAllocationBit::encode(false) |
+      PrivateNameLookupSkipsOuterClassBit::encode(false) |
+      HasContextExtensionSlotBit::encode(is_native_context) |
+      IsReplModeScopeBit::encode(false) | HasLocalsBlackListBit::encode(false);
   scope_info->SetFlags(flags);
   scope_info->SetParameterCount(parameter_count);
   scope_info->SetContextLocalCount(context_local_count);
@@ -474,7 +496,7 @@ Handle<ScopeInfo> ScopeInfo::CreateForBootstrapping(Isolate* isolate,
     scope_info->set(index++, ReadOnlyRoots(isolate).this_string());
   }
   DCHECK_EQ(index, scope_info->ContextLocalInfosIndex());
-  if (context_local_count) {
+  if (context_local_count > 0) {
     const uint32_t value =
         VariableModeField::encode(VariableMode::kConst) |
         InitFlagField::encode(kCreatedInitialized) |
@@ -486,15 +508,15 @@ Handle<ScopeInfo> ScopeInfo::CreateForBootstrapping(Isolate* isolate,
 
   // And here we record that this scopeinfo binds a receiver.
   DCHECK_EQ(index, scope_info->ReceiverInfoIndex());
-  const int receiver_index = Context::MIN_CONTEXT_SLOTS + 0;
-  if (!is_empty_function) {
+  if (has_receiver) {
+    const int receiver_index = scope_info->ContextHeaderLength();
     scope_info->set(index++, Smi::FromInt(receiver_index));
   }
 
   DCHECK_EQ(index, scope_info->FunctionNameInfoIndex());
   if (is_empty_function) {
     scope_info->set(index++, *isolate->factory()->empty_string());
-    scope_info->set(index++, Smi::kZero);
+    scope_info->set(index++, Smi::zero());
   }
   DCHECK_EQ(index, scope_info->InferredFunctionNameIndex());
   if (has_inferred_function_name) {
@@ -502,52 +524,90 @@ Handle<ScopeInfo> ScopeInfo::CreateForBootstrapping(Isolate* isolate,
   }
   DCHECK_EQ(index, scope_info->PositionInfoIndex());
   // Store dummy position to be in sync with the {scope_type}.
-  scope_info->set(index++, Smi::kZero);
-  scope_info->set(index++, Smi::kZero);
+  scope_info->set(index++, Smi::zero());
+  scope_info->set(index++, Smi::zero());
   DCHECK_EQ(index, scope_info->OuterScopeInfoIndex());
   DCHECK_EQ(index, scope_info->length());
   DCHECK_EQ(scope_info->ParameterCount(), parameter_count);
-  if (type == FUNCTION_SCOPE) {
+  if (is_empty_function || is_native_context) {
     DCHECK_EQ(scope_info->ContextLength(), 0);
   } else {
-    DCHECK_EQ(scope_info->ContextLength(), Context::MIN_CONTEXT_SLOTS + 1);
+    DCHECK_EQ(scope_info->ContextLength(),
+              scope_info->ContextHeaderLength() + 1);
   }
 
   return scope_info;
 }
 
+// static
+Handle<ScopeInfo> ScopeInfo::RecreateWithBlackList(
+    Isolate* isolate, Handle<ScopeInfo> original, Handle<StringSet> blacklist) {
+  DCHECK(!original.is_null());
+  if (original->HasLocalsBlackList()) return original;
+
+  Handle<ScopeInfo> scope_info =
+      isolate->factory()->NewScopeInfo(original->length() + 1);
+
+  // Copy the static part first and update the flags to include the
+  // blacklist field, so {LocalsBlackListIndex} returns the correct value.
+  scope_info->CopyElements(isolate, 0, *original, 0, kVariablePartIndex,
+                           WriteBarrierMode::UPDATE_WRITE_BARRIER);
+  scope_info->SetFlags(
+      HasLocalsBlackListBit::update(scope_info->Flags(), true));
+
+  // Copy the dynamic part including the provided blacklist:
+  //   1) copy all the fields up to the blacklist index
+  //   2) add the blacklist
+  //   3) copy the remaining fields
+  scope_info->CopyElements(
+      isolate, kVariablePartIndex, *original, kVariablePartIndex,
+      scope_info->LocalsBlackListIndex() - kVariablePartIndex,
+      WriteBarrierMode::UPDATE_WRITE_BARRIER);
+  scope_info->set(scope_info->LocalsBlackListIndex(), *blacklist);
+  scope_info->CopyElements(
+      isolate, scope_info->LocalsBlackListIndex() + 1, *original,
+      scope_info->LocalsBlackListIndex(),
+      scope_info->length() - scope_info->LocalsBlackListIndex() - 1,
+      WriteBarrierMode::UPDATE_WRITE_BARRIER);
+  return scope_info;
+}
+
 ScopeInfo ScopeInfo::Empty(Isolate* isolate) {
   return ReadOnlyRoots(isolate).empty_scope_info();
 }
 
 ScopeType ScopeInfo::scope_type() const {
   DCHECK_LT(0, length());
-  return ScopeTypeField::decode(Flags());
+  return ScopeTypeBits::decode(Flags());
+}
+
+bool ScopeInfo::is_script_scope() const {
+  return length() > 0 && scope_type() == SCRIPT_SCOPE;
 }
 
 bool ScopeInfo::SloppyEvalCanExtendVars() const {
   bool sloppy_eval_can_extend_vars =
-      length() > 0 && SloppyEvalCanExtendVarsField::decode(Flags());
+      length() > 0 && SloppyEvalCanExtendVarsBit::decode(Flags());
   DCHECK_IMPLIES(sloppy_eval_can_extend_vars, is_sloppy(language_mode()));
   DCHECK_IMPLIES(sloppy_eval_can_extend_vars, is_declaration_scope());
   return sloppy_eval_can_extend_vars;
 }
 
 LanguageMode ScopeInfo::language_mode() const {
-  return length() > 0 ? LanguageModeField::decode(Flags())
+  return length() > 0 ? LanguageModeBit::decode(Flags())
                       : LanguageMode::kSloppy;
 }
 
 bool ScopeInfo::is_declaration_scope() const {
-  return DeclarationScopeField::decode(Flags());
+  return DeclarationScopeBit::decode(Flags());
 }
 
 int ScopeInfo::ContextLength() const {
   if (length() > 0) {
     int context_locals = ContextLocalCount();
-    bool function_name_context_slot =
-        FunctionVariableField::decode(Flags()) == CONTEXT;
-    bool force_context = ForceContextAllocationField::decode(Flags());
+    bool function_name_context_slot = FunctionVariableBits::decode(Flags()) ==
+                                      VariableAllocationInfo::CONTEXT;
+    bool force_context = ForceContextAllocationBit::decode(Flags());
     bool has_context =
         context_locals > 0 || force_context || function_name_context_slot ||
         scope_type() == WITH_SCOPE || scope_type() == CLASS_SCOPE ||
@@ -558,44 +618,54 @@ int ScopeInfo::ContextLength() const {
         scope_type() == MODULE_SCOPE;
 
     if (has_context) {
-      return Context::MIN_CONTEXT_SLOTS + context_locals +
+      return ContextHeaderLength() + context_locals +
              (function_name_context_slot ? 1 : 0);
     }
   }
   return 0;
 }
 
+bool ScopeInfo::HasContextExtensionSlot() const {
+  return HasContextExtensionSlotBit::decode(Flags());
+}
+
+int ScopeInfo::ContextHeaderLength() const {
+  return HasContextExtensionSlot() ? Context::MIN_CONTEXT_EXTENDED_SLOTS
+                                   : Context::MIN_CONTEXT_SLOTS;
+}
+
 bool ScopeInfo::HasReceiver() const {
   if (length() == 0) return false;
-  return NONE != ReceiverVariableField::decode(Flags());
+  return VariableAllocationInfo::NONE != ReceiverVariableBits::decode(Flags());
 }
 
 bool ScopeInfo::HasAllocatedReceiver() const {
   if (length() == 0) return false;
-  VariableAllocationInfo allocation = ReceiverVariableField::decode(Flags());
-  return allocation == STACK || allocation == CONTEXT;
+  VariableAllocationInfo allocation = ReceiverVariableBits::decode(Flags());
+  return allocation == VariableAllocationInfo::STACK ||
+         allocation == VariableAllocationInfo::CONTEXT;
 }
 
 bool ScopeInfo::HasClassBrand() const {
-  return HasClassBrandField::decode(Flags());
+  return HasClassBrandBit::decode(Flags());
 }
 
 bool ScopeInfo::HasSavedClassVariableIndex() const {
-  return HasSavedClassVariableIndexField::decode(Flags());
+  return HasSavedClassVariableIndexBit::decode(Flags());
 }
 
 bool ScopeInfo::HasNewTarget() const {
-  return HasNewTargetField::decode(Flags());
+  return HasNewTargetBit::decode(Flags());
 }
 
 bool ScopeInfo::HasFunctionName() const {
   if (length() == 0) return false;
-  return NONE != FunctionVariableField::decode(Flags());
+  return VariableAllocationInfo::NONE != FunctionVariableBits::decode(Flags());
 }
 
 bool ScopeInfo::HasInferredFunctionName() const {
   if (length() == 0) return false;
-  return HasInferredFunctionNameField::decode(Flags());
+  return HasInferredFunctionNameBit::decode(Flags());
 }
 
 bool ScopeInfo::HasPositionInfo() const {
@@ -626,18 +696,18 @@ void ScopeInfo::SetInferredFunctionName(String name) {
 
 bool ScopeInfo::HasOuterScopeInfo() const {
   if (length() == 0) return false;
-  return HasOuterScopeInfoField::decode(Flags());
+  return HasOuterScopeInfoBit::decode(Flags());
 }
 
 bool ScopeInfo::IsDebugEvaluateScope() const {
   if (length() == 0) return false;
-  return IsDebugEvaluateScopeField::decode(Flags());
+  return IsDebugEvaluateScopeBit::decode(Flags());
 }
 
 void ScopeInfo::SetIsDebugEvaluateScope() {
   if (length() > 0) {
     DCHECK_EQ(scope_type(), WITH_SCOPE);
-    SetFlags(Flags() | IsDebugEvaluateScopeField::encode(true));
+    SetFlags(Flags() | IsDebugEvaluateScopeBit::encode(true));
   } else {
     UNREACHABLE();
   }
@@ -645,7 +715,22 @@ void ScopeInfo::SetIsDebugEvaluateScope() {
 
 bool ScopeInfo::PrivateNameLookupSkipsOuterClass() const {
   if (length() == 0) return false;
-  return PrivateNameLookupSkipsOuterClassField::decode(Flags());
+  return PrivateNameLookupSkipsOuterClassBit::decode(Flags());
+}
+
+bool ScopeInfo::IsReplModeScope() const {
+  if (length() == 0) return false;
+  return IsReplModeScopeBit::decode(Flags());
+}
+
+bool ScopeInfo::HasLocalsBlackList() const {
+  if (length() == 0) return false;
+  return HasLocalsBlackListBit::decode(Flags());
+}
+
+StringSet ScopeInfo::LocalsBlackList() const {
+  DCHECK(HasLocalsBlackList());
+  return StringSet::cast(get(LocalsBlackListIndex()));
 }
 
 bool ScopeInfo::HasContext() const { return ContextLength() > 0; }
@@ -661,6 +746,7 @@ Object ScopeInfo::InferredFunctionName() const {
 }
 
 String ScopeInfo::FunctionDebugName() const {
+  if (!HasFunctionName()) return GetReadOnlyRoots().empty_string();
   Object name = FunctionName();
   if (name.IsString() && String::cast(name).length() > 0) {
     return String::cast(name);
@@ -811,7 +897,7 @@ int ScopeInfo::ContextSlotIndex(ScopeInfo scope_info, String name,
     *is_static_flag = scope_info.ContextLocalIsStaticFlag(var);
     *init_flag = scope_info.ContextLocalInitFlag(var);
     *maybe_assigned_flag = scope_info.ContextLocalMaybeAssignedFlag(var);
-    int result = Context::MIN_CONTEXT_SLOTS + var;
+    int result = scope_info.ContextHeaderLength() + var;
 
     DCHECK_LT(result, scope_info.ContextLength());
     return result;
@@ -821,7 +907,7 @@ int ScopeInfo::ContextSlotIndex(ScopeInfo scope_info, String name,
 }
 
 int ScopeInfo::SavedClassVariableContextLocalIndex() const {
-  if (length() > 0 && HasSavedClassVariableIndexField::decode(Flags())) {
+  if (length() > 0 && HasSavedClassVariableIndexBit::decode(Flags())) {
     int index = Smi::ToInt(get(SavedClassVariableInfoIndex()));
     return index - Context::MIN_CONTEXT_SLOTS;
   }
@@ -829,7 +915,8 @@ int ScopeInfo::SavedClassVariableContextLocalIndex() const {
 }
 
 int ScopeInfo::ReceiverContextSlotIndex() const {
-  if (length() > 0 && ReceiverVariableField::decode(Flags()) == CONTEXT) {
+  if (length() > 0 && ReceiverVariableBits::decode(Flags()) ==
+                          VariableAllocationInfo::CONTEXT) {
     return Smi::ToInt(get(ReceiverInfoIndex()));
   }
   return -1;
@@ -838,7 +925,8 @@ int ScopeInfo::ReceiverContextSlotIndex() const {
 int ScopeInfo::FunctionContextSlotIndex(String name) const {
   DCHECK(name.IsInternalizedString());
   if (length() > 0) {
-    if (FunctionVariableField::decode(Flags()) == CONTEXT &&
+    if (FunctionVariableBits::decode(Flags()) ==
+            VariableAllocationInfo::CONTEXT &&
         FunctionName() == name) {
       return Smi::ToInt(get(FunctionNameInfoIndex() + 1));
     }
@@ -847,7 +935,7 @@ int ScopeInfo::FunctionContextSlotIndex(String name) const {
 }
 
 FunctionKind ScopeInfo::function_kind() const {
-  return FunctionKindField::decode(Flags());
+  return FunctionKindBits::decode(Flags());
 }
 
 int ScopeInfo::ContextLocalNamesIndex() const {
@@ -884,10 +972,14 @@ int ScopeInfo::OuterScopeInfoIndex() const {
   return PositionInfoIndex() + (HasPositionInfo() ? kPositionInfoEntries : 0);
 }
 
-int ScopeInfo::ModuleInfoIndex() const {
+int ScopeInfo::LocalsBlackListIndex() const {
   return OuterScopeInfoIndex() + (HasOuterScopeInfo() ? 1 : 0);
 }
 
+int ScopeInfo::ModuleInfoIndex() const {
+  return LocalsBlackListIndex() + (HasLocalsBlackList() ? 1 : 0);
+}
+
 int ScopeInfo::ModuleVariableCountIndex() const {
   return ModuleInfoIndex() + 1;
 }
@@ -924,16 +1016,15 @@ void ScopeInfo::ModuleVariable(int i, String* name, int* index,
   }
 }
 
-std::ostream& operator<<(std::ostream& os,
-                         ScopeInfo::VariableAllocationInfo var_info) {
+std::ostream& operator<<(std::ostream& os, VariableAllocationInfo var_info) {
   switch (var_info) {
-    case ScopeInfo::VariableAllocationInfo::NONE:
+    case VariableAllocationInfo::NONE:
       return os << "NONE";
-    case ScopeInfo::VariableAllocationInfo::STACK:
+    case VariableAllocationInfo::STACK:
       return os << "STACK";
-    case ScopeInfo::VariableAllocationInfo::CONTEXT:
+    case VariableAllocationInfo::CONTEXT:
       return os << "CONTEXT";
-    case ScopeInfo::VariableAllocationInfo::UNUSED:
+    case VariableAllocationInfo::UNUSED:
       return os << "UNUSED";
   }
   UNREACHABLE();
@@ -966,7 +1057,8 @@ Handle<SourceTextModuleInfo> SourceTextModuleInfo::New(
   Handle<FixedArray> module_request_positions =
       isolate->factory()->NewFixedArray(size);
   for (const auto& elem : descr->module_requests()) {
-    module_requests->set(elem.second.index, *elem.first->string());
+    module_requests->set(elem.second.index,
+                         *elem.first->string().get<Factory>());
     module_request_positions->set(elem.second.index,
                                   Smi::FromInt(elem.second.position));
   }
diff --git a/deps/v8/src/objects/scope-info.h b/deps/v8/src/objects/scope-info.h
index aa63cf2998eb70..1eff2c411f08cf 100644
--- a/deps/v8/src/objects/scope-info.h
+++ b/deps/v8/src/objects/scope-info.h
@@ -10,6 +10,8 @@
 #include "src/objects/function-kind.h"
 #include "src/objects/objects.h"
 #include "src/utils/utils.h"
+#include "testing/gtest/include/gtest/gtest_prod.h"  // nogncheck
+#include "torque-generated/bit-fields-tq.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -24,6 +26,7 @@ template <typename T>
 class MaybeHandle;
 class SourceTextModuleInfo;
 class Scope;
+class StringSet;
 class Zone;
 
 // ScopeInfo represents information about different scopes of a source
@@ -33,7 +36,7 @@ class Zone;
 
 // This object provides quick access to scope info details for runtime
 // routines.
-class ScopeInfo : public FixedArray {
+class ScopeInfo : public FixedArray, public TorqueGeneratedScopeFlagsFields {
  public:
   DECL_CAST(ScopeInfo)
   DECL_PRINTER(ScopeInfo)
@@ -55,12 +58,15 @@ class ScopeInfo : public FixedArray {
 
   // Return the number of context slots for code if a context is allocated. This
   // number consists of three parts:
-  //  1. Size of fixed header for every context: Context::MIN_CONTEXT_SLOTS
+  //  1. Size of header for every context.
   //  2. One context slot per context allocated local.
   //  3. One context slot for the function name if it is context allocated.
   // Parameters allocated in the context count as context allocated locals. If
   // no contexts are allocated for this scope ContextLength returns 0.
   int ContextLength() const;
+  int ContextHeaderLength() const;
+
+  bool HasContextExtensionSlot() const;
 
   // Does this scope declare a "this" binding?
   bool HasReceiver() const;
@@ -190,10 +196,24 @@ class ScopeInfo : public FixedArray {
   // Return the outer ScopeInfo if present.
   ScopeInfo OuterScopeInfo() const;
 
+  bool is_script_scope() const;
+
+  // Returns true if this ScopeInfo has a black list attached containing
+  // stack allocated local variables.
+  V8_EXPORT_PRIVATE bool HasLocalsBlackList() const;
+  // Returns a list of stack-allocated locals of parent scopes.
+  // Used during local debug-evalute to decide whether a context lookup
+  // can continue upwards after checking this scope.
+  V8_EXPORT_PRIVATE StringSet LocalsBlackList() const;
+
   // Returns true if this ScopeInfo was created for a scope that skips the
   // closest outer class when resolving private names.
   bool PrivateNameLookupSkipsOuterClass() const;
 
+  // REPL mode scopes allow re-declaraction of let variables. They come from
+  // debug evaluate but are different to IsDebugEvaluateScope().
+  bool IsReplModeScope() const;
+
 #ifdef DEBUG
   bool Equals(ScopeInfo other) const;
 #endif
@@ -204,8 +224,16 @@ class ScopeInfo : public FixedArray {
       Isolate* isolate, MaybeHandle<ScopeInfo> outer_scope);
   V8_EXPORT_PRIVATE static Handle<ScopeInfo> CreateForEmptyFunction(
       Isolate* isolate);
+  static Handle<ScopeInfo> CreateForNativeContext(Isolate* isolate);
   static Handle<ScopeInfo> CreateGlobalThisBinding(Isolate* isolate);
 
+  // Creates a copy of a {ScopeInfo} but with the provided locals blacklist
+  // attached. Does nothing if the original {ScopeInfo} already has a field
+  // for a blacklist reserved.
+  V8_EXPORT_PRIVATE static Handle<ScopeInfo> RecreateWithBlackList(
+      Isolate* isolate, Handle<ScopeInfo> original,
+      Handle<StringSet> blacklist);
+
   // Serializes empty scope info.
   V8_EXPORT_PRIVATE static ScopeInfo Empty(Isolate* isolate);
 
@@ -233,36 +261,10 @@ class ScopeInfo : public FixedArray {
         kVariablePartIndex
   };
 
-  // Used for the function name variable for named function expressions, and for
-  // the receiver.
-  enum VariableAllocationInfo { NONE, STACK, CONTEXT, UNUSED };
-
-  // Properties of scopes.
-  using ScopeTypeField = BitField<ScopeType, 0, 4>;
-  using SloppyEvalCanExtendVarsField = ScopeTypeField::Next<bool, 1>;
-  STATIC_ASSERT(LanguageModeSize == 2);
-  using LanguageModeField = SloppyEvalCanExtendVarsField::Next<LanguageMode, 1>;
-  using DeclarationScopeField = LanguageModeField::Next<bool, 1>;
-  using ReceiverVariableField =
-      DeclarationScopeField::Next<VariableAllocationInfo, 2>;
-  using HasClassBrandField = ReceiverVariableField::Next<bool, 1>;
-  using HasSavedClassVariableIndexField = HasClassBrandField::Next<bool, 1>;
-  using HasNewTargetField = HasSavedClassVariableIndexField::Next<bool, 1>;
-  using FunctionVariableField =
-      HasNewTargetField::Next<VariableAllocationInfo, 2>;
-  // TODO(cbruni): Combine with function variable field when only storing the
-  // function name.
-  using HasInferredFunctionNameField = FunctionVariableField::Next<bool, 1>;
-  using IsAsmModuleField = HasInferredFunctionNameField::Next<bool, 1>;
-  using HasSimpleParametersField = IsAsmModuleField::Next<bool, 1>;
-  using FunctionKindField = HasSimpleParametersField::Next<FunctionKind, 5>;
-  using HasOuterScopeInfoField = FunctionKindField::Next<bool, 1>;
-  using IsDebugEvaluateScopeField = HasOuterScopeInfoField::Next<bool, 1>;
-  using ForceContextAllocationField = IsDebugEvaluateScopeField::Next<bool, 1>;
-  using PrivateNameLookupSkipsOuterClassField =
-      ForceContextAllocationField::Next<bool, 1>;
-
-  STATIC_ASSERT(kLastFunctionKind <= FunctionKindField::kMax);
+  static const int kFlagsOffset = OffsetOfElementAt(Fields::kFlags);
+
+  STATIC_ASSERT(LanguageModeSize == 1 << LanguageModeBit::kSize);
+  STATIC_ASSERT(kLastFunctionKind <= FunctionKindBits::kMax);
 
  private:
   // The layout of the variable part of a ScopeInfo is as follows:
@@ -296,10 +298,13 @@ class ScopeInfo : public FixedArray {
   //    the scope belongs to a function or script.
   // 8. OuterScopeInfoIndex:
   //    The outer scope's ScopeInfo or the hole if there's none.
-  // 9. SourceTextModuleInfo, ModuleVariableCount, and ModuleVariables:
-  //    For a module scope, this part contains the SourceTextModuleInfo, the
-  //    number of MODULE-allocated variables, and the metadata of those
-  //    variables.  For non-module scopes it is empty.
+  // 9. LocalsBlackList: List of stack allocated local variables. Used by
+  //    debug evaluate to properly abort variable lookup when a name clashes
+  //    with a stack allocated local that can't be materialized.
+  // 10. SourceTextModuleInfo, ModuleVariableCount, and ModuleVariables:
+  //     For a module scope, this part contains the SourceTextModuleInfo, the
+  //     number of MODULE-allocated variables, and the metadata of those
+  //     variables.  For non-module scopes it is empty.
   int ContextLocalNamesIndex() const;
   int ContextLocalInfosIndex() const;
   int SavedClassVariableInfoIndex() const;
@@ -308,13 +313,16 @@ class ScopeInfo : public FixedArray {
   int InferredFunctionNameIndex() const;
   int PositionInfoIndex() const;
   int OuterScopeInfoIndex() const;
+  V8_EXPORT_PRIVATE int LocalsBlackListIndex() const;
   int ModuleInfoIndex() const;
   int ModuleVariableCountIndex() const;
   int ModuleVariablesIndex() const;
 
   static bool NeedsPositionInfo(ScopeType type);
+
+  enum class BootstrappingType { kScript, kFunction, kNative };
   static Handle<ScopeInfo> CreateForBootstrapping(Isolate* isolate,
-                                                  ScopeType type);
+                                                  BootstrappingType type);
 
   int Lookup(Handle<String> name, int start, int end, VariableMode* mode,
              VariableLocation* location, InitializationFlag* init_flag,
@@ -332,21 +340,20 @@ class ScopeInfo : public FixedArray {
   static const int kPositionInfoEntries = 2;
 
   // Properties of variables.
-  using VariableModeField = BitField<VariableMode, 0, 4>;
+  using VariableModeField = base::BitField<VariableMode, 0, 4>;
   using InitFlagField = VariableModeField::Next<InitializationFlag, 1>;
   using MaybeAssignedFlagField = InitFlagField::Next<MaybeAssignedFlag, 1>;
   using ParameterNumberField = MaybeAssignedFlagField::Next<uint32_t, 16>;
   using IsStaticFlagField = ParameterNumberField::Next<IsStaticFlag, 1>;
 
   friend class ScopeIterator;
-  friend std::ostream& operator<<(std::ostream& os,
-                                  ScopeInfo::VariableAllocationInfo var);
+  friend std::ostream& operator<<(std::ostream& os, VariableAllocationInfo var);
 
   OBJECT_CONSTRUCTORS(ScopeInfo, FixedArray);
+  FRIEND_TEST(TestWithNativeContext, RecreateScopeInfoWithLocalsBlacklistWorks);
 };
 
-std::ostream& operator<<(std::ostream& os,
-                         ScopeInfo::VariableAllocationInfo var);
+std::ostream& operator<<(std::ostream& os, VariableAllocationInfo var);
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/scope-info.tq b/deps/v8/src/objects/scope-info.tq
new file mode 100644
index 00000000000000..cb8ead30abb9c8
--- /dev/null
+++ b/deps/v8/src/objects/scope-info.tq
@@ -0,0 +1,44 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class ScopeInfo extends FixedArray;
+
+const kScopeInfoFlagsIndex:
+    constexpr int32 generates 'ScopeInfo::Fields::kFlags';
+
+operator '.flags' macro LoadScopeInfoFlags(implicit context: Context)(
+    scopeInfo: ScopeInfo): ScopeFlags {
+  return Convert<ScopeFlags>(
+      UnsafeCast<Smi>(scopeInfo.objects[kScopeInfoFlagsIndex]));
+}
+
+type ScopeType extends uint32 constexpr 'ScopeType';
+type VariableAllocationInfo extends uint32
+constexpr 'VariableAllocationInfo';
+
+// Properties of scopes.
+bitfield struct ScopeFlags extends uint32 {
+  scope_type: ScopeType: 4 bit;
+  sloppy_eval_can_extend_vars: bool: 1 bit;
+  language_mode: LanguageMode: 1 bit;
+  declaration_scope: bool: 1 bit;
+  receiver_variable: VariableAllocationInfo: 2 bit;
+  has_class_brand: bool: 1 bit;
+  has_saved_class_variable_index: bool: 1 bit;
+  has_new_target: bool: 1 bit;
+  // TODO(cbruni): Combine with function variable field when only storing the
+  // function name.
+  function_variable: VariableAllocationInfo: 2 bit;
+  has_inferred_function_name: bool: 1 bit;
+  is_asm_module: bool: 1 bit;
+  has_simple_parameters: bool: 1 bit;
+  function_kind: FunctionKind: 5 bit;
+  has_outer_scope_info: bool: 1 bit;
+  is_debug_evaluate_scope: bool: 1 bit;
+  force_context_allocation: bool: 1 bit;
+  private_name_lookup_skips_outer_class: bool: 1 bit;
+  has_context_extension_slot: bool: 1 bit;
+  is_repl_mode_scope: bool: 1 bit;
+  has_locals_black_list: bool: 1 bit;
+}
diff --git a/deps/v8/src/objects/script-inl.h b/deps/v8/src/objects/script-inl.h
index c306c2c092b097..1e8b83798cb653 100644
--- a/deps/v8/src/objects/script-inl.h
+++ b/deps/v8/src/objects/script-inl.h
@@ -116,6 +116,15 @@ void Script::set_compilation_state(CompilationState state) {
   set_flags(BooleanBit::set(flags(), kCompilationStateBit,
                             state == COMPILATION_STATE_COMPILED));
 }
+
+bool Script::is_repl_mode() const {
+  return BooleanBit::get(flags(), kREPLModeBit);
+}
+
+void Script::set_is_repl_mode(bool value) {
+  set_flags(BooleanBit::set(flags(), kREPLModeBit, value));
+}
+
 ScriptOriginOptions Script::origin_options() {
   return ScriptOriginOptions((flags() & kOriginOptionsMask) >>
                              kOriginOptionsShift);
diff --git a/deps/v8/src/objects/script.h b/deps/v8/src/objects/script.h
index 935241a1492ef8..3a038c1c38af88 100644
--- a/deps/v8/src/objects/script.h
+++ b/deps/v8/src/objects/script.h
@@ -16,10 +16,6 @@
 
 namespace v8 {
 
-namespace tracing {
-class TracedValue;
-}
-
 namespace internal {
 
 // Script describes a script which has been added to the VM.
@@ -132,6 +128,11 @@ class Script : public Struct {
   inline CompilationState compilation_state();
   inline void set_compilation_state(CompilationState state);
 
+  // [is_repl_mode]: whether this script originated from a REPL via debug
+  // evaluate and therefore has different semantics, e.g. re-declaring let.
+  inline bool is_repl_mode() const;
+  inline void set_is_repl_mode(bool value);
+
   // [origin_options]: optional attributes set by the embedder via ScriptOrigin,
   // and used by the embedder to make decisions about the script. V8 just passes
   // this through. Encoded in the 'flags' field.
@@ -180,7 +181,7 @@ class Script : public Struct {
   V8_EXPORT_PRIVATE bool GetPositionInfo(int position, PositionInfo* info,
                                          OffsetFlag offset_flag) const;
 
-  bool IsUserJavaScript();
+  bool IsUserJavaScript() const;
 
   // Wrappers for GetPositionInfo
   static int GetColumnNumber(Handle<Script> script, int code_offset);
@@ -194,18 +195,6 @@ class Script : public Struct {
   MaybeHandle<SharedFunctionInfo> FindSharedFunctionInfo(
       Isolate* isolate, const FunctionLiteral* fun);
 
-  // Returns the Script in a format tracing can support.
-  std::unique_ptr<v8::tracing::TracedValue> ToTracedValue();
-
-  // The tracing scope for Script objects.
-  static const char* kTraceScope;
-
-  // Returns the unique TraceID for this Script (within the kTraceScope).
-  uint64_t TraceID() const;
-
-  // Returns the unique trace ID reference for this Script.
-  std::unique_ptr<v8::tracing::TracedValue> TraceIDRef() const;
-
   // Iterate over all script objects on the heap.
   class V8_EXPORT_PRIVATE Iterator {
    public:
@@ -228,7 +217,8 @@ class Script : public Struct {
   // Bit positions in the flags field.
   static const int kCompilationTypeBit = 0;
   static const int kCompilationStateBit = 1;
-  static const int kOriginOptionsShift = 2;
+  static const int kREPLModeBit = 2;
+  static const int kOriginOptionsShift = 3;
   static const int kOriginOptionsSize = 4;
   static const int kOriginOptionsMask = ((1 << kOriginOptionsSize) - 1)
                                         << kOriginOptionsShift;
diff --git a/deps/v8/src/objects/script.tq b/deps/v8/src/objects/script.tq
new file mode 100644
index 00000000000000..5e68c870239c83
--- /dev/null
+++ b/deps/v8/src/objects/script.tq
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class Script extends Struct {
+  source: Object;
+  name: Object;
+  line_offset: Smi;
+  column_offset: Smi;
+  context: Object;
+  script_type: Smi;
+  line_ends: Object;
+  id: Smi;
+  eval_from_shared_or_wrapped_arguments: Object;
+  eval_from_position: Smi|Foreign;  // Smi or Managed<wasm::NativeModule>
+  shared_function_infos: Object;
+  flags: Smi;
+  source_url: Object;
+  source_mapping_url: Object;
+  host_defined_options: Object;
+}
diff --git a/deps/v8/src/objects/shared-function-info-inl.h b/deps/v8/src/objects/shared-function-info-inl.h
index 4f12bc4324a516..9beba6d63bfc68 100644
--- a/deps/v8/src/objects/shared-function-info-inl.h
+++ b/deps/v8/src/objects/shared-function-info-inl.h
@@ -84,11 +84,6 @@ TQ_OBJECT_CONSTRUCTORS_IMPL(UncompiledData)
 TQ_OBJECT_CONSTRUCTORS_IMPL(UncompiledDataWithoutPreparseData)
 TQ_OBJECT_CONSTRUCTORS_IMPL(UncompiledDataWithPreparseData)
 
-DEF_GETTER(HeapObject, IsUncompiledData, bool) {
-  return IsUncompiledDataWithoutPreparseData(isolate) ||
-         IsUncompiledDataWithPreparseData(isolate);
-}
-
 OBJECT_CONSTRUCTORS_IMPL(InterpreterData, Struct)
 
 CAST_ACCESSOR(InterpreterData)
@@ -153,6 +148,16 @@ void SharedFunctionInfo::SetName(String name) {
   UpdateFunctionMapIndex();
 }
 
+bool SharedFunctionInfo::is_script() const {
+  return scope_info().is_script_scope() &&
+         Script::cast(script()).compilation_type() ==
+             Script::COMPILATION_TYPE_HOST;
+}
+
+bool SharedFunctionInfo::needs_script_context() const {
+  return is_script() && scope_info().ContextLocalCount() > 0;
+}
+
 AbstractCode SharedFunctionInfo::abstract_code() {
   if (HasBytecodeArray()) {
     return AbstractCode::cast(GetBytecodeArray());
@@ -193,7 +198,7 @@ BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, is_asm_wasm_broken,
                     SharedFunctionInfo::IsAsmWasmBrokenBit)
 BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags,
                     requires_instance_members_initializer,
-                    SharedFunctionInfo::RequiresInstanceMembersInitializer)
+                    SharedFunctionInfo::RequiresInstanceMembersInitializerBit)
 
 BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, name_should_print_as_anonymous,
                     SharedFunctionInfo::NameShouldPrintAsAnonymousBit)
@@ -204,7 +209,7 @@ BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, is_toplevel,
                     SharedFunctionInfo::IsTopLevelBit)
 BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags,
                     is_oneshot_iife_or_properties_are_final,
-                    SharedFunctionInfo::IsOneshotIIFEOrPropertiesAreFinalBit)
+                    SharedFunctionInfo::IsOneshotIifeOrPropertiesAreFinalBit)
 BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags,
                     is_safe_to_skip_arguments_adaptor,
                     SharedFunctionInfo::IsSafeToSkipArgumentsAdaptorBit)
@@ -614,29 +619,27 @@ void SharedFunctionInfo::ClearPreparseData() {
   DCHECK(HasUncompiledDataWithoutPreparseData());
 }
 
-// static
-void UncompiledData::Initialize(
-    UncompiledData data, String inferred_name, int start_position,
-    int end_position,
+void UncompiledData::Init(
+    String inferred_name, int start_position, int end_position,
     std::function<void(HeapObject object, ObjectSlot slot, HeapObject target)>
         gc_notify_updated_slot) {
-  data.set_inferred_name(inferred_name);
-  gc_notify_updated_slot(
-      data, data.RawField(UncompiledData::kInferredNameOffset), inferred_name);
-  data.set_start_position(start_position);
-  data.set_end_position(end_position);
+  set_inferred_name(inferred_name);
+  gc_notify_updated_slot(*this, RawField(UncompiledData::kInferredNameOffset),
+                         inferred_name);
+  set_start_position(start_position);
+  set_end_position(end_position);
 }
 
-void UncompiledDataWithPreparseData::Initialize(
-    UncompiledDataWithPreparseData data, String inferred_name,
-    int start_position, int end_position, PreparseData scope_data,
+void UncompiledDataWithPreparseData::Init(
+    String inferred_name, int start_position, int end_position,
+    PreparseData scope_data,
     std::function<void(HeapObject object, ObjectSlot slot, HeapObject target)>
         gc_notify_updated_slot) {
-  UncompiledData::Initialize(data, inferred_name, start_position, end_position,
+  this->UncompiledData::Init(inferred_name, start_position, end_position,
                              gc_notify_updated_slot);
-  data.set_preparse_data(scope_data);
+  set_preparse_data(scope_data);
   gc_notify_updated_slot(
-      data, data.RawField(UncompiledDataWithPreparseData::kPreparseDataOffset),
+      *this, RawField(UncompiledDataWithPreparseData::kPreparseDataOffset),
       scope_data);
 }
 
@@ -669,6 +672,10 @@ void SharedFunctionInfo::set_script(HeapObject script) {
   }
 }
 
+bool SharedFunctionInfo::is_repl_mode() const {
+  return script().IsScript() && Script::cast(script()).is_repl_mode();
+}
+
 bool SharedFunctionInfo::HasDebugInfo() const {
   return script_or_debug_info().IsDebugInfo();
 }
@@ -706,14 +713,14 @@ String SharedFunctionInfo::inferred_name() {
   return GetReadOnlyRoots().empty_string();
 }
 
-bool SharedFunctionInfo::IsUserJavaScript() {
+bool SharedFunctionInfo::IsUserJavaScript() const {
   Object script_obj = script();
   if (script_obj.IsUndefined()) return false;
   Script script = Script::cast(script_obj);
   return script.IsUserJavaScript();
 }
 
-bool SharedFunctionInfo::IsSubjectToDebugging() {
+bool SharedFunctionInfo::IsSubjectToDebugging() const {
   return IsUserJavaScript() && !HasAsmWasmData();
 }
 
diff --git a/deps/v8/src/objects/shared-function-info.h b/deps/v8/src/objects/shared-function-info.h
index 9c57d3669781bc..0a0ed81f3f89b8 100644
--- a/deps/v8/src/objects/shared-function-info.h
+++ b/deps/v8/src/objects/shared-function-info.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "src/base/bit-field.h"
 #include "src/codegen/bailout-reason.h"
 #include "src/objects/compressed-slots.h"
 #include "src/objects/function-kind.h"
@@ -16,7 +17,9 @@
 #include "src/objects/slots.h"
 #include "src/objects/smi.h"
 #include "src/objects/struct.h"
+#include "src/roots/roots.h"
 #include "testing/gtest/include/gtest/gtest_prod.h"
+#include "torque-generated/bit-fields-tq.h"
 #include "torque-generated/field-offsets-tq.h"
 
 // Has to be the last include (doesn't have include guards):
@@ -24,10 +27,6 @@
 
 namespace v8 {
 
-namespace tracing {
-class TracedValue;
-}
-
 namespace internal {
 
 class AsmWasmData;
@@ -100,9 +99,8 @@ class PreparseData
 class UncompiledData
     : public TorqueGeneratedUncompiledData<UncompiledData, HeapObject> {
  public:
-  inline static void Initialize(
-      UncompiledData data, String inferred_name, int start_position,
-      int end_position,
+  inline void Init(
+      String inferred_name, int start_position, int end_position,
       std::function<void(HeapObject object, ObjectSlot slot, HeapObject target)>
           gc_notify_updated_slot =
               [](HeapObject object, ObjectSlot slot, HeapObject target) {});
@@ -137,9 +135,9 @@ class UncompiledDataWithPreparseData
  public:
   DECL_PRINTER(UncompiledDataWithPreparseData)
 
-  inline static void Initialize(
-      UncompiledDataWithPreparseData data, String inferred_name,
-      int start_position, int end_position, PreparseData scope_data,
+  inline void Init(
+      String inferred_name, int start_position, int end_position,
+      PreparseData scope_data,
       std::function<void(HeapObject object, ObjectSlot slot, HeapObject target)>
           gc_notify_updated_slot =
               [](HeapObject object, ObjectSlot slot, HeapObject target) {});
@@ -169,12 +167,20 @@ class InterpreterData : public Struct {
 
 // SharedFunctionInfo describes the JSFunction information that can be
 // shared by multiple instances of the function.
-class SharedFunctionInfo : public HeapObject {
+class SharedFunctionInfo : public HeapObject,
+                           public TorqueGeneratedSharedFunctionInfoFlagsFields {
  public:
   NEVER_READ_ONLY_SPACE
 
-  V8_EXPORT_PRIVATE static constexpr Object const kNoSharedNameSentinel =
-      Smi::kZero;
+  // This initializes the SharedFunctionInfo after allocation. It must
+  // initialize all fields, and leave the SharedFunctionInfo in a state where
+  // it is safe for the GC to visit it.
+  //
+  // Important: This function MUST not allocate.
+  void Init(ReadOnlyRoots roots, int unique_id);
+
+  V8_EXPORT_PRIVATE static constexpr Smi const kNoSharedNameSentinel =
+      Smi::zero();
 
   // [name]: Returns shared name if it exists or an empty string otherwise.
   inline String Name() const;
@@ -196,9 +202,10 @@ class SharedFunctionInfo : public HeapObject {
 
   // Set up the link between shared function info and the script. The shared
   // function info is added to the list on the script.
-  V8_EXPORT_PRIVATE static void SetScript(
-      Handle<SharedFunctionInfo> shared, Handle<HeapObject> script_object,
-      int function_literal_id, bool reset_preparsed_scope_data = true);
+  V8_EXPORT_PRIVATE void SetScript(ReadOnlyRoots roots,
+                                   HeapObject script_object,
+                                   int function_literal_id,
+                                   bool reset_preparsed_scope_data = true);
 
   // Layout description of the optimized code map.
   static const int kEntriesStart = 0;
@@ -216,6 +223,9 @@ class SharedFunctionInfo : public HeapObject {
   inline void set_raw_scope_info(ScopeInfo scope_info,
                                  WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
+  inline bool is_script() const;
+  inline bool needs_script_context() const;
+
   // End position of this function in the script source.
   V8_EXPORT_PRIVATE int EndPosition() const;
 
@@ -368,6 +378,9 @@ class SharedFunctionInfo : public HeapObject {
   inline HeapObject script() const;
   inline void set_script(HeapObject script);
 
+  // True if the underlying script was parsed and compiled in REPL mode.
+  inline bool is_repl_mode() const;
+
   // The function is subject to debugging if a debug info is attached.
   inline bool HasDebugInfo() const;
   inline DebugInfo GetDebugInfo() const;
@@ -490,10 +503,10 @@ class SharedFunctionInfo : public HeapObject {
   // - internal break points
   // - coverage and type profile
   // - error stack trace
-  inline bool IsSubjectToDebugging();
+  inline bool IsSubjectToDebugging() const;
 
   // Whether this function is defined in user-provided JavaScript code.
-  inline bool IsUserJavaScript();
+  inline bool IsUserJavaScript() const;
 
   // True if one can flush compiled code from this function, in such a way that
   // it can later be re-compiled.
@@ -517,8 +530,19 @@ class SharedFunctionInfo : public HeapObject {
   // Hence it takes the mode as an argument.
   inline bool ShouldFlushBytecode(BytecodeFlushMode mode);
 
-  // Check whether or not this function is inlineable.
-  bool IsInlineable();
+  enum Inlineability {
+    kIsInlineable,
+    // Different reasons for not being inlineable:
+    kHasNoScript,
+    kNeedsBinaryCoverage,
+    kHasOptimizationDisabled,
+    kIsBuiltin,
+    kIsNotUserCode,
+    kHasNoBytecode,
+    kExceedsBytecodeLimit,
+    kMayContainBreakPoints,
+  };
+  Inlineability GetInlineability() const;
 
   // Source size of this function.
   int SourceSize();
@@ -529,7 +553,8 @@ class SharedFunctionInfo : public HeapObject {
   inline bool has_simple_parameters();
 
   // Initialize a SharedFunctionInfo from a parsed function literal.
-  static void InitFromFunctionLiteral(Handle<SharedFunctionInfo> shared_info,
+  static void InitFromFunctionLiteral(Isolate* isolate,
+                                      Handle<SharedFunctionInfo> shared_info,
                                       FunctionLiteral* lit, bool is_toplevel);
 
   // Updates the expected number of properties based on estimate from parser.
@@ -545,7 +570,7 @@ class SharedFunctionInfo : public HeapObject {
   static void EnsureSourcePositionsAvailable(
       Isolate* isolate, Handle<SharedFunctionInfo> shared_info);
 
-  bool AreSourcePositionsAvailable() const;
+  V8_EXPORT_PRIVATE bool AreSourcePositionsAvailable() const;
 
   // Hash based on function literal id and script id.
   V8_EXPORT_PRIVATE uint32_t Hash();
@@ -566,22 +591,6 @@ class SharedFunctionInfo : public HeapObject {
   void PrintSourceCode(std::ostream& os);
 #endif
 
-  // Returns the SharedFunctionInfo in a format tracing can support.
-  std::unique_ptr<v8::tracing::TracedValue> ToTracedValue(
-      FunctionLiteral* literal);
-
-  // The tracing scope for SharedFunctionInfo objects.
-  static const char* kTraceScope;
-
-  // Returns the unique TraceID for this SharedFunctionInfo (within the
-  // kTraceScope, works only for functions that have a Script and start/end
-  // position).
-  uint64_t TraceID(FunctionLiteral* literal = nullptr) const;
-
-  // Returns the unique trace ID reference for this SharedFunctionInfo
-  // (based on the |TraceID()| above).
-  std::unique_ptr<v8::tracing::TracedValue> TraceIDRef() const;
-
   // Iterate over all shared function infos in a given script.
   class ScriptIterator {
    public:
@@ -615,31 +624,6 @@ class SharedFunctionInfo : public HeapObject {
 
   class BodyDescriptor;
 
-// Bit positions in |flags|.
-#define FLAGS_BIT_FIELDS(V, _)                               \
-  /* Have FunctionKind first to make it cheaper to access */ \
-  V(FunctionKindBits, FunctionKind, 5, _)                    \
-  V(IsNativeBit, bool, 1, _)                                 \
-  V(IsStrictBit, bool, 1, _)                                 \
-  V(FunctionSyntaxKindBits, FunctionSyntaxKind, 3, _)        \
-  V(IsClassConstructorBit, bool, 1, _)                       \
-  V(HasDuplicateParametersBit, bool, 1, _)                   \
-  V(AllowLazyCompilationBit, bool, 1, _)                     \
-  V(NeedsHomeObjectBit, bool, 1, _)                          \
-  V(IsAsmWasmBrokenBit, bool, 1, _)                          \
-  V(FunctionMapIndexBits, int, 5, _)                         \
-  V(DisabledOptimizationReasonBits, BailoutReason, 4, _)     \
-  V(RequiresInstanceMembersInitializer, bool, 1, _)          \
-  V(ConstructAsBuiltinBit, bool, 1, _)                       \
-  V(NameShouldPrintAsAnonymousBit, bool, 1, _)               \
-  V(HasReportedBinaryCoverageBit, bool, 1, _)                \
-  V(IsTopLevelBit, bool, 1, _)                               \
-  V(IsOneshotIIFEOrPropertiesAreFinalBit, bool, 1, _)        \
-  V(IsSafeToSkipArgumentsAdaptorBit, bool, 1, _)             \
-  V(PrivateNameLookupSkipsOuterClassBit, bool, 1, _)
-  DEFINE_BIT_FIELDS(FLAGS_BIT_FIELDS)
-#undef FLAGS_BIT_FIELDS
-
   // Bailout reasons must fit in the DisabledOptimizationReason bitfield.
   STATIC_ASSERT(BailoutReason::kLastErrorMessage <=
                 DisabledOptimizationReasonBits::kMax);
diff --git a/deps/v8/src/objects/shared-function-info.tq b/deps/v8/src/objects/shared-function-info.tq
new file mode 100644
index 00000000000000..2eda70da5d78fc
--- /dev/null
+++ b/deps/v8/src/objects/shared-function-info.tq
@@ -0,0 +1,75 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+extern class PreparseData extends HeapObject {
+  // TODO(v8:8983): Add declaration for variable-sized region.
+  data_length: int32;
+  children_length: int32;
+}
+
+extern class InterpreterData extends Struct {
+  bytecode_array: BytecodeArray;
+  interpreter_trampoline: Code;
+}
+
+type FunctionKind extends uint8 constexpr 'v8::internal::FunctionKind';
+type FunctionSyntaxKind extends uint8
+constexpr 'v8::internal::FunctionSyntaxKind';
+type BailoutReason extends uint8 constexpr 'v8::internal::BailoutReason';
+
+bitfield struct SharedFunctionInfoFlags extends uint32 {
+  // Have FunctionKind first to make it cheaper to access.
+  function_kind: FunctionKind: 5 bit;
+  is_native: bool: 1 bit;
+  is_strict: bool: 1 bit;
+  function_syntax_kind: FunctionSyntaxKind: 3 bit;
+  is_class_constructor: bool: 1 bit;
+  has_duplicate_parameters: bool: 1 bit;
+  allow_lazy_compilation: bool: 1 bit;
+  needs_home_object: bool: 1 bit;
+  is_asm_wasm_broken: bool: 1 bit;
+  function_map_index: uint32: 5 bit;
+  disabled_optimization_reason: BailoutReason: 4 bit;
+  requires_instance_members_initializer: bool: 1 bit;
+  construct_as_builtin: bool: 1 bit;
+  name_should_print_as_anonymous: bool: 1 bit;
+  has_reported_binary_coverage: bool: 1 bit;
+  is_top_level: bool: 1 bit;
+  is_oneshot_iife_or_properties_are_final: bool: 1 bit;
+  is_safe_to_skip_arguments_adaptor: bool: 1 bit;
+  private_name_lookup_skips_outer_class: bool: 1 bit;
+}
+
+extern class SharedFunctionInfo extends HeapObject {
+  weak function_data: Object;
+  name_or_scope_info: String|NoSharedNameSentinel|ScopeInfo;
+  outer_scope_info_or_feedback_metadata: HeapObject;
+  script_or_debug_info: Script|DebugInfo|Undefined;
+  length: int16;
+  formal_parameter_count: uint16;
+  // Currently set to uint16, can be set to uint8 to save space.
+  expected_nof_properties: uint16;
+  function_token_offset: int16;
+  flags: SharedFunctionInfoFlags;
+  function_literal_id: int32;
+  @if(V8_SFI_HAS_UNIQUE_ID) unique_id: int32;
+}
+
+@abstract
+@generateCppClass
+extern class UncompiledData extends HeapObject {
+  inferred_name: String;
+  start_position: int32;
+  end_position: int32;
+}
+
+@generateCppClass
+extern class UncompiledDataWithoutPreparseData extends UncompiledData {
+}
+
+@generateCppClass
+extern class UncompiledDataWithPreparseData extends UncompiledData {
+  preparse_data: PreparseData;
+}
diff --git a/deps/v8/src/objects/smi.h b/deps/v8/src/objects/smi.h
index 0f93f374585bf5..9468f56e527d5b 100644
--- a/deps/v8/src/objects/smi.h
+++ b/deps/v8/src/objects/smi.h
@@ -26,12 +26,10 @@ class Smi : public Object {
   // in that we want them to be constexprs.
   constexpr Smi() : Object() {}
   explicit constexpr Smi(Address ptr) : Object(ptr) {
-#if V8_CAN_HAVE_DCHECK_IN_CONSTEXPR
+#if V8_HAS_CXX14_CONSTEXPR
     DCHECK(HAS_SMI_TAG(ptr));
 #endif
   }
-  Smi* operator->() { return this; }
-  const Smi* operator->() const { return this; }
 
   // Returns the integer value.
   inline int value() const { return Internals::SmiValue(ptr()); }
@@ -47,7 +45,7 @@ class Smi : public Object {
 
   // Convert a value to a Smi object.
   static inline constexpr Smi FromInt(int value) {
-#if V8_CAN_HAVE_DCHECK_IN_CONSTEXPR
+#if V8_HAS_CXX14_CONSTEXPR
     DCHECK(Smi::IsValid(value));
 #endif
     return Smi(Internals::IntToSmi(value));
@@ -75,9 +73,9 @@ class Smi : public Object {
 
   // Returns whether value can be represented in a Smi.
   static inline bool constexpr IsValid(intptr_t value) {
-#if V8_CAN_HAVE_DCHECK_IN_CONSTEXPR
-    DCHECK(Internals::IsValidSmi(value) ==
-           (value >= kMinValue && value <= kMaxValue));
+#if V8_HAS_CXX14_CONSTEXPR
+    DCHECK_EQ(Internals::IsValidSmi(value),
+              value >= kMinValue && value <= kMaxValue);
 #endif
     return Internals::IsValidSmi(value);
   }
@@ -98,12 +96,8 @@ class Smi : public Object {
   V8_EXPORT_PRIVATE void SmiPrint(std::ostream& os) const;  // NOLINT
   DECL_VERIFIER(Smi)
 
-  // C++ does not allow us to have an object of type Smi within class Smi,
-  // so the kZero value has type Object. Consider it deprecated; new code
-  // should use zero() instead.
-  V8_EXPORT_PRIVATE static constexpr Object kZero = Object(0);
-  // If you need something with type Smi, call zero() instead. Since it is
-  // a constexpr, "calling" it is just as efficient as reading kZero.
+  // Since this is a constexpr, "calling" it is just as efficient
+  // as reading a constant.
   static inline constexpr Smi zero() { return Smi::FromInt(0); }
   static constexpr int kMinValue = kSmiMinValue;
   static constexpr int kMaxValue = kSmiMaxValue;
diff --git a/deps/v8/src/objects/source-text-module.cc b/deps/v8/src/objects/source-text-module.cc
index 2959e1b8542e6c..6ffdd06f45248b 100644
--- a/deps/v8/src/objects/source-text-module.cc
+++ b/deps/v8/src/objects/source-text-module.cc
@@ -536,7 +536,7 @@ void SourceTextModule::FetchStarExports(Isolate* isolate,
     // the name to undefined instead of a Cell.
     Handle<ObjectHashTable> requested_exports(requested_module->exports(),
                                               isolate);
-    for (int i = 0, n = requested_exports->Capacity(); i < n; ++i) {
+    for (InternalIndex i : requested_exports->IterateEntries()) {
       Object key;
       if (!requested_exports->ToKey(roots, i, &key)) continue;
       Handle<String> name(String::cast(key), isolate);
@@ -624,6 +624,16 @@ MaybeHandle<Object> SourceTextModule::EvaluateMaybeAsync(
   // 9. If result is an abrupt completion, then
   Handle<Object> unused_result;
   if (!Evaluate(isolate, module).ToHandle(&unused_result)) {
+    // If the exception was a termination exception, rejecting the promise
+    // would resume execution, and our API contract is to return an empty
+    // handle. The module's status should be set to kErrored and the
+    // exception field should be set to `null`.
+    if (!isolate->is_catchable_by_javascript(isolate->pending_exception())) {
+      DCHECK_EQ(module->status(), kErrored);
+      DCHECK_EQ(module->exception(), *isolate->factory()->null_value());
+      return {};
+    }
+
     //  d. Perform ! Call(capability.[[Reject]], undefined,
     //                    «result.[[Value]]»).
     isolate->clear_pending_exception();
@@ -669,7 +679,14 @@ MaybeHandle<Object> SourceTextModule::Evaluate(
       // iii. Set m.[[EvaluationError]] to result.
       descendant->RecordErrorUsingPendingException(isolate);
     }
-    DCHECK_EQ(module->exception(), isolate->pending_exception());
+
+#ifdef DEBUG
+    if (isolate->is_catchable_by_javascript(isolate->pending_exception())) {
+      CHECK_EQ(module->exception(), isolate->pending_exception());
+    } else {
+      CHECK_EQ(module->exception(), *isolate->factory()->null_value());
+    }
+#endif  // DEBUG
   } else {
     // 10. Otherwise,
     //  c. Assert: stack is empty.
@@ -770,6 +787,8 @@ void SourceTextModule::AsyncModuleExecutionFulfilled(
 void SourceTextModule::AsyncModuleExecutionRejected(
     Isolate* isolate, Handle<SourceTextModule> module,
     Handle<Object> exception) {
+  DCHECK(isolate->is_catchable_by_javascript(*exception));
+
   // 1. Assert: module.[[Status]] is "evaluated".
   CHECK(module->status() == kEvaluated || module->status() == kErrored);
 
@@ -887,7 +906,9 @@ MaybeHandle<Object> SourceTextModule::InnerExecuteAsyncModule(
   Handle<Object> result;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, result,
-      Execution::Call(isolate, resume, async_function_object, 0, nullptr),
+      Execution::TryCall(isolate, resume, async_function_object, 0, nullptr,
+                         Execution::MessageHandling::kKeepPending, nullptr,
+                         false),
       Object);
   return result;
 }
@@ -900,9 +921,21 @@ MaybeHandle<Object> SourceTextModule::ExecuteModule(
   Handle<JSFunction> resume(
       isolate->native_context()->generator_next_internal(), isolate);
   Handle<Object> result;
-  ASSIGN_RETURN_ON_EXCEPTION(
-      isolate, result, Execution::Call(isolate, resume, generator, 0, nullptr),
-      Object);
+
+  // With top_level_await, we need to catch any exceptions and reject
+  // the top level capability.
+  if (FLAG_harmony_top_level_await) {
+    ASSIGN_RETURN_ON_EXCEPTION(
+        isolate, result,
+        Execution::TryCall(isolate, resume, generator, 0, nullptr,
+                           Execution::MessageHandling::kKeepPending, nullptr,
+                           false),
+        Object);
+  } else {
+    ASSIGN_RETURN_ON_EXCEPTION(
+        isolate, result,
+        Execution::Call(isolate, resume, generator, 0, nullptr), Object);
+  }
   DCHECK(JSIteratorResult::cast(*result).done().BooleanValue(isolate));
   return handle(JSIteratorResult::cast(*result).value(), isolate);
 }
diff --git a/deps/v8/src/objects/source-text-module.tq b/deps/v8/src/objects/source-text-module.tq
new file mode 100644
index 00000000000000..0f747976bb3e6a
--- /dev/null
+++ b/deps/v8/src/objects/source-text-module.tq
@@ -0,0 +1,48 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+type SourceTextModuleInfo extends FixedArray;
+
+@generateCppClass
+extern class SourceTextModule extends Module {
+  // The code representing this module, or an abstraction thereof.
+  code: SharedFunctionInfo|JSFunction|JSGeneratorObject|SourceTextModuleInfo;
+
+  // Arrays of cells corresponding to regular exports and regular imports.
+  // A cell's position in the array is determined by the cell index of the
+  // associated module entry (which coincides with the variable index of the
+  // associated variable).
+  regular_exports: FixedArray;
+  regular_imports: FixedArray;
+
+  // Modules imported or re-exported by this module.
+  // Corresponds 1-to-1 to the module specifier strings in
+  // SourceTextModuleInfo::module_requests.
+  requested_modules: FixedArray;
+
+  // Script from which the module originates.
+  script: Script;
+
+  // The value of import.meta inside of this module.
+  // Lazily initialized on first access. It's the hole before first access and
+  // a JSObject afterwards.
+  import_meta: TheHole|JSObject;
+  async_parent_modules: ArrayList;
+  top_level_capability: JSPromise|Undefined;
+  dfs_index: Smi;
+  dfs_ancestor_index: Smi;
+  pending_async_dependencies: Smi;
+  flags: Smi;
+}
+
+@generateCppClass
+extern class SourceTextModuleInfoEntry extends Struct {
+  export_name: String|Undefined;
+  local_name: String|Undefined;
+  import_name: String|Undefined;
+  module_request: Smi;
+  cell_index: Smi;
+  beg_pos: Smi;
+  end_pos: Smi;
+}
diff --git a/deps/v8/src/objects/stack-frame-info-inl.h b/deps/v8/src/objects/stack-frame-info-inl.h
index 42e3a4a10a87fb..ee3b83c12f1619 100644
--- a/deps/v8/src/objects/stack-frame-info-inl.h
+++ b/deps/v8/src/objects/stack-frame-info-inl.h
@@ -27,6 +27,7 @@ CAST_ACCESSOR(StackFrameInfo)
 SMI_ACCESSORS(StackFrameInfo, line_number, kLineNumberOffset)
 SMI_ACCESSORS(StackFrameInfo, column_number, kColumnNumberOffset)
 SMI_ACCESSORS(StackFrameInfo, script_id, kScriptIdOffset)
+SMI_ACCESSORS(StackFrameInfo, wasm_function_index, kWasmFunctionIndexOffset)
 SMI_ACCESSORS(StackFrameInfo, promise_all_index, kPromiseAllIndexOffset)
 SMI_ACCESSORS_CHECKED(StackFrameInfo, function_offset, kPromiseAllIndexOffset,
                       is_wasm())
diff --git a/deps/v8/src/objects/stack-frame-info.cc b/deps/v8/src/objects/stack-frame-info.cc
index 040c6f7b326dca..ac2913ebeddb05 100644
--- a/deps/v8/src/objects/stack-frame-info.cc
+++ b/deps/v8/src/objects/stack-frame-info.cc
@@ -57,6 +57,11 @@ int StackTraceFrame::GetFunctionOffset(Handle<StackTraceFrame> frame) {
   return GetFrameInfo(frame)->function_offset();
 }
 
+// static
+int StackTraceFrame::GetWasmFunctionIndex(Handle<StackTraceFrame> frame) {
+  return GetFrameInfo(frame)->wasm_function_index();
+}
+
 // static
 Handle<Object> StackTraceFrame::GetFileName(Handle<StackTraceFrame> frame) {
   auto name = GetFrameInfo(frame)->script_name();
@@ -381,7 +386,7 @@ void SerializeWasmStackFrame(Isolate* isolate, Handle<StackTraceFrame> frame,
     builder->AppendCString(" (");
   }
 
-  const int wasm_func_index = StackTraceFrame::GetLineNumber(frame);
+  const int wasm_func_index = StackTraceFrame::GetWasmFunctionIndex(frame);
 
   builder->AppendCString("wasm-function[");
   builder->AppendInt(wasm_func_index);
diff --git a/deps/v8/src/objects/stack-frame-info.h b/deps/v8/src/objects/stack-frame-info.h
index 54b64b611858a5..2ede430f116ea9 100644
--- a/deps/v8/src/objects/stack-frame-info.h
+++ b/deps/v8/src/objects/stack-frame-info.h
@@ -22,6 +22,7 @@ class StackFrameInfo : public Struct {
   DECL_INT_ACCESSORS(line_number)
   DECL_INT_ACCESSORS(column_number)
   DECL_INT_ACCESSORS(script_id)
+  DECL_INT_ACCESSORS(wasm_function_index)
   DECL_INT_ACCESSORS(promise_all_index)
   // Wasm frames only: function_offset instead of promise_all_index.
   DECL_INT_ACCESSORS(function_offset)
@@ -88,6 +89,7 @@ class StackTraceFrame
   static int GetScriptId(Handle<StackTraceFrame> frame);
   static int GetPromiseAllIndex(Handle<StackTraceFrame> frame);
   static int GetFunctionOffset(Handle<StackTraceFrame> frame);
+  static int GetWasmFunctionIndex(Handle<StackTraceFrame> frame);
 
   static Handle<Object> GetFileName(Handle<StackTraceFrame> frame);
   static Handle<Object> GetScriptNameOrSourceUrl(Handle<StackTraceFrame> frame);
diff --git a/deps/v8/src/objects/stack-frame-info.tq b/deps/v8/src/objects/stack-frame-info.tq
new file mode 100644
index 00000000000000..801e2bc5a0d278
--- /dev/null
+++ b/deps/v8/src/objects/stack-frame-info.tq
@@ -0,0 +1,28 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class StackFrameInfo extends Struct {
+  line_number: Smi;
+  column_number: Smi;
+  promise_all_index: Smi;
+  script_id: Smi;
+  wasm_function_index: Smi;
+  script_name: String|Null|Undefined;
+  script_name_or_source_url: String|Null|Undefined;
+  function_name: String|Null|Undefined;
+  method_name: String|Null|Undefined;
+  type_name: String|Null|Undefined;
+  eval_origin: String|Null|Undefined;
+  wasm_module_name: String|Null|Undefined;
+  wasm_instance: WasmInstanceObject|Null|Undefined;
+  flag: Smi;
+}
+
+@generateCppClass
+extern class StackTraceFrame extends Struct {
+  frame_array: FrameArray|Undefined;
+  frame_index: Smi;
+  frame_info: StackFrameInfo|Undefined;
+  id: Smi;
+}
diff --git a/deps/v8/src/objects/string-inl.h b/deps/v8/src/objects/string-inl.h
index b4aea68cb16bb2..93453eee219f2d 100644
--- a/deps/v8/src/objects/string-inl.h
+++ b/deps/v8/src/objects/string-inl.h
@@ -771,7 +771,16 @@ void StringCharacterStream::VisitTwoByteString(const uint16_t* chars,
 }
 
 bool String::AsArrayIndex(uint32_t* index) {
+  DisallowHeapAllocation no_gc;
   uint32_t field = hash_field();
+  // The {IsHashFieldComputed} check is not functionally necessary as the
+  // subsequent mask includes it; it's here to make the logic more obvious,
+  // and the compile will fold it away so it doesn't hurt performance.
+  if (IsHashFieldComputed(field) &&
+      (field & kDoesNotContainCachedArrayIndexMask) == 0) {
+    *index = ArrayIndexValueBits::decode(field);
+    return true;
+  }
   if (IsHashFieldComputed(field) && (field & kIsNotArrayIndexMask)) {
     return false;
   }
@@ -780,6 +789,14 @@ bool String::AsArrayIndex(uint32_t* index) {
 
 bool String::AsIntegerIndex(size_t* index) {
   uint32_t field = hash_field();
+  // The {IsHashFieldComputed} check is not functionally necessary as the
+  // subsequent mask includes it; it's here to make the logic more obvious,
+  // and the compile will fold it away so it doesn't hurt performance.
+  if (IsHashFieldComputed(field) &&
+      (field & kDoesNotContainCachedArrayIndexMask) == 0) {
+    *index = ArrayIndexValueBits::decode(field);
+    return true;
+  }
   if (IsHashFieldComputed(field) && (field & kIsNotIntegerIndexMask)) {
     return false;
   }
diff --git a/deps/v8/src/objects/string-table.h b/deps/v8/src/objects/string-table.h
index 6279137b1f4bc0..e6619db4ba0805 100644
--- a/deps/v8/src/objects/string-table.h
+++ b/deps/v8/src/objects/string-table.h
@@ -37,7 +37,7 @@ class StringTableKey {
   int length_;
 };
 
-class StringTableShape : public BaseShape<StringTableKey*> {
+class V8_EXPORT_PRIVATE StringTableShape : public BaseShape<StringTableKey*> {
  public:
   static inline bool IsMatch(Key key, Object value);
 
@@ -59,17 +59,17 @@ class SeqOneByteString;
 //
 // No special elements in the prefix and the element size is 1
 // because only the string itself (the key) needs to be stored.
-class StringTable : public HashTable<StringTable, StringTableShape> {
+class V8_EXPORT_PRIVATE StringTable
+    : public HashTable<StringTable, StringTableShape> {
  public:
   // Find string in the string table. If it is not there yet, it is
   // added. The return value is the string found.
-  V8_EXPORT_PRIVATE static Handle<String> LookupString(Isolate* isolate,
-                                                       Handle<String> key);
+  static Handle<String> LookupString(Isolate* isolate, Handle<String> key);
   template <typename StringTableKey>
   static Handle<String> LookupKey(Isolate* isolate, StringTableKey* key);
   static Handle<String> AddKeyNoResize(Isolate* isolate, StringTableKey* key);
 
-  // Shink the StringTable if it's very empty (kMaxEmptyFactor) to avoid the
+  // Shrink the StringTable if it's very empty (kMaxEmptyFactor) to avoid the
   // performance overhead of re-allocating the StringTable over and over again.
   static Handle<StringTable> CautiousShrink(Isolate* isolate,
                                             Handle<StringTable> table);
@@ -77,8 +77,8 @@ class StringTable : public HashTable<StringTable, StringTableShape> {
   // {raw_string} must be a tagged String pointer.
   // Returns a tagged pointer: either an internalized string, or a Smi
   // sentinel.
-  V8_EXPORT_PRIVATE static Address LookupStringIfExists_NoAllocate(
-      Isolate* isolate, Address raw_string);
+  static Address LookupStringIfExists_NoAllocate(Isolate* isolate,
+                                                 Address raw_string);
 
   static void EnsureCapacityForDeserialization(Isolate* isolate, int expected);
 
@@ -107,10 +107,11 @@ class StringSetShape : public BaseShape<String> {
 
 class StringSet : public HashTable<StringSet, StringSetShape> {
  public:
-  static Handle<StringSet> New(Isolate* isolate);
-  static Handle<StringSet> Add(Isolate* isolate, Handle<StringSet> blacklist,
-                               Handle<String> name);
-  bool Has(Isolate* isolate, Handle<String> name);
+  V8_EXPORT_PRIVATE static Handle<StringSet> New(Isolate* isolate);
+  V8_EXPORT_PRIVATE static Handle<StringSet> Add(Isolate* isolate,
+                                                 Handle<StringSet> blacklist,
+                                                 Handle<String> name);
+  V8_EXPORT_PRIVATE bool Has(Isolate* isolate, Handle<String> name);
 
   DECL_CAST(StringSet)
   OBJECT_CONSTRUCTORS(StringSet, HashTable<StringSet, StringSetShape>);
diff --git a/deps/v8/src/objects/string.cc b/deps/v8/src/objects/string.cc
index a1eb7f43102f00..cf91a10bd0eec5 100644
--- a/deps/v8/src/objects/string.cc
+++ b/deps/v8/src/objects/string.cc
@@ -395,6 +395,16 @@ Handle<String> String::Trim(Isolate* isolate, Handle<String> string,
   return isolate->factory()->NewSubString(string, left, right);
 }
 
+int32_t String::ToArrayIndex(Address addr) {
+  DisallowHeapAllocation no_gc;
+  String key(addr);
+
+  uint32_t index;
+  if (!key.AsArrayIndex(&index)) return -1;
+  if (index <= INT_MAX) return index;
+  return -1;
+}
+
 bool String::LooksValid() {
   // TODO(leszeks): Maybe remove this check entirely, Heap::Contains uses
   // basically the same logic as the way we access the heap in the first place.
@@ -443,7 +453,7 @@ Handle<Object> String::ToNumber(Isolate* isolate, Handle<String> subject) {
   // Fast case: short integer or some sorts of junk values.
   if (subject->IsSeqOneByteString()) {
     int len = subject->length();
-    if (len == 0) return handle(Smi::kZero, isolate);
+    if (len == 0) return handle(Smi::zero(), isolate);
 
     DisallowHeapAllocation no_gc;
     uint8_t const* data =
@@ -1367,7 +1377,7 @@ bool String::SlowAsArrayIndex(uint32_t* index) {
   }
   if (length == 0 || length > kMaxArrayIndexSize) return false;
   StringCharacterStream stream(*this);
-  return StringToArrayIndex(&stream, index);
+  return StringToIndex(&stream, index);
 }
 
 bool String::SlowAsIntegerIndex(size_t* index) {
@@ -1387,7 +1397,8 @@ bool String::SlowAsIntegerIndex(size_t* index) {
   }
   if (length == 0 || length > kMaxIntegerIndexSize) return false;
   StringCharacterStream stream(*this);
-  return StringToArrayIndex(&stream, index);
+  return StringToIndex<StringCharacterStream, size_t, kToIntegerIndex>(&stream,
+                                                                       index);
 }
 
 void String::PrintOn(FILE* file) {
diff --git a/deps/v8/src/objects/string.h b/deps/v8/src/objects/string.h
index fcdf75a96862e9..941d5f3c7c90e1 100644
--- a/deps/v8/src/objects/string.h
+++ b/deps/v8/src/objects/string.h
@@ -169,10 +169,8 @@ class String : public TorqueGeneratedString<String, Name> {
   // be one-byte encoded.  This might be the case even if the string is
   // two-byte.  Such strings may appear when the embedder prefers
   // two-byte external representations even for one-byte data.
-  inline bool IsOneByteRepresentation() const;
-  inline bool IsOneByteRepresentation(Isolate* isolate) const;
-  inline bool IsTwoByteRepresentation() const;
-  inline bool IsTwoByteRepresentation(Isolate* isolate) const;
+  DECL_GETTER(IsOneByteRepresentation, bool)
+  DECL_GETTER(IsTwoByteRepresentation, bool)
 
   // Cons and slices have an encoding flag that may not represent the actual
   // encoding of the underlying string.  This is taken into account here.
@@ -318,6 +316,19 @@ class String : public TorqueGeneratedString<String, Name> {
   // Conversion.
   // "array index": an index allowed by the ES spec for JSArrays.
   inline bool AsArrayIndex(uint32_t* index);
+
+  // This is used for calculating array indices but differs from an
+  // Array Index in the regard that this does not support the full
+  // array index range. This only supports positive numbers less than
+  // or equal to INT_MAX.
+  //
+  // String::AsArrayIndex might be a better fit if you're looking to
+  // calculate the array index.
+  //
+  // if val < 0 or val > INT_MAX, returns -1
+  // if 0 <= val <= INT_MAX, returns val
+  static int32_t ToArrayIndex(Address addr);
+
   uint32_t inline ToValidIndex(Object number);
   // "integer index": the string is the decimal representation of an
   // integer in the range of a size_t. Useful for TypedArray accesses.
@@ -352,16 +363,28 @@ class String : public TorqueGeneratedString<String, Name> {
   static const uc32 kMaxCodePoint = 0x10ffff;
 
   // Maximal string length.
-  // The max length is different on 32 and 64 bit platforms. Max length for a
-  // 32-bit platform is ~268.4M chars. On 64-bit platforms, max length is
-  // ~1.073B chars. The limit on 64-bit is so that SeqTwoByteString::kMaxSize
-  // can fit in a 32bit int: 2^31 - 1 is the max positive int, minus one bit as
-  // each char needs two bytes, subtract 24 bytes for the string header size.
-
+  // The max length is different on 32 and 64 bit platforms. Max length for
+  // 32-bit platforms is ~268.4M chars. On 64-bit platforms, max length is
+  // ~536.8M chars.
   // See include/v8.h for the definition.
   static const int kMaxLength = v8::String::kMaxLength;
-  static_assert(kMaxLength <= (Smi::kMaxValue / 2 - kHeaderSize),
-                "Unexpected max String length");
+  // There are several defining limits imposed by our current implementation:
+  // - any string's length must fit into a Smi.
+  static_assert(kMaxLength <= kSmiMaxValue,
+                "String length must fit into a Smi");
+  // - adding two string lengths must still fit into a 32-bit int without
+  //   overflow
+  static_assert(kMaxLength * 2 <= kMaxInt,
+                "String::kMaxLength * 2 must fit into an int32");
+  // - any heap object's size in bytes must be able to fit into a Smi, because
+  //   its space on the heap might be filled with a Filler; for strings this
+  //   means SeqTwoByteString::kMaxSize must be able to fit into a Smi.
+  static_assert(kMaxLength * 2 + kHeaderSize <= kSmiMaxValue,
+                "String object size in bytes must fit into a Smi");
+  // - any heap object's size in bytes must be able to fit into an int, because
+  //   that's what our object handling code uses almost everywhere.
+  static_assert(kMaxLength * 2 + kHeaderSize <= kMaxInt,
+                "String object size in bytes must fit into an int");
 
   // Max length for computing hash. For strings longer than this limit the
   // string length is used as the hash value.
@@ -623,8 +646,7 @@ class ConsString : public TorqueGeneratedConsString<ConsString, String> {
 // ThinStrings can be thought of as "one-part cons strings".
 class ThinString : public TorqueGeneratedThinString<ThinString, String> {
  public:
-  inline HeapObject unchecked_actual() const;
-  inline HeapObject unchecked_actual(Isolate* isolate) const;
+  DECL_GETTER(unchecked_actual, HeapObject)
 
   V8_EXPORT_PRIVATE uint16_t Get(int index);
 
diff --git a/deps/v8/src/objects/string.tq b/deps/v8/src/objects/string.tq
new file mode 100644
index 00000000000000..b7d297d9a15045
--- /dev/null
+++ b/deps/v8/src/objects/string.tq
@@ -0,0 +1,82 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@abstract
+@generateCppClass
+@reserveBitsInInstanceType(6)
+extern class String extends Name {
+  length: int32;
+}
+
+@generateCppClass
+extern class ConsString extends String {
+  first: String;
+  second: String;
+}
+
+@abstract
+extern class ExternalString extends String {
+  resource: RawPtr;
+  resource_data: RawPtr;
+}
+
+extern class ExternalOneByteString extends ExternalString {}
+extern class ExternalTwoByteString extends ExternalString {}
+
+@generateCppClass
+extern class InternalizedString extends String {
+}
+
+// TODO(v8:8983): Add declaration for variable-sized region.
+@abstract
+@generateCppClass
+extern class SeqString extends String {
+}
+@generateCppClass
+extern class SeqOneByteString extends SeqString {
+  chars[length]: char8;
+}
+@generateCppClass
+extern class SeqTwoByteString extends SeqString {
+  chars[length]: char16;
+}
+
+@generateCppClass
+extern class SlicedString extends String {
+  parent: String;
+  offset: Smi;
+}
+
+@generateCppClass
+extern class ThinString extends String {
+  actual: String;
+}
+
+// A direct string can be accessed directly through CSA without going into the
+// C++ runtime. See also: ToDirectStringAssembler.
+type DirectString extends String;
+
+@export
+macro AllocateSeqOneByteString(length: uint32): String {
+  assert(length <= kStringMaxLength);
+  if (length == 0) return kEmptyString;
+  return new SeqOneByteString{
+    map: kOneByteStringMap,
+    hash_field: kNameEmptyHashField,
+    length: Signed(length),
+    chars: ...UninitializedIterator {}
+  };
+}
+
+@export
+macro AllocateSeqTwoByteString(length: uint32): String {
+  assert(length <= kStringMaxLength);
+  if (length == 0) return kEmptyString;
+  return new SeqTwoByteString{
+    map: kStringMap,
+    hash_field: kNameEmptyHashField,
+    length: Signed(length),
+    chars: ...UninitializedIterator {}
+  };
+}
diff --git a/deps/v8/src/objects/struct-inl.h b/deps/v8/src/objects/struct-inl.h
index 34de8897861a7f..a7bbc77f55c9e8 100644
--- a/deps/v8/src/objects/struct-inl.h
+++ b/deps/v8/src/objects/struct-inl.h
@@ -21,9 +21,10 @@ namespace internal {
 
 TQ_OBJECT_CONSTRUCTORS_IMPL(Struct)
 TQ_OBJECT_CONSTRUCTORS_IMPL(Tuple2)
-TQ_OBJECT_CONSTRUCTORS_IMPL(Tuple3)
 TQ_OBJECT_CONSTRUCTORS_IMPL(AccessorPair)
 
+NEVER_READ_ONLY_SPACE_IMPL(AccessorPair)
+
 TQ_OBJECT_CONSTRUCTORS_IMPL(ClassPositions)
 
 void Struct::InitializeBody(int object_size) {
diff --git a/deps/v8/src/objects/struct.h b/deps/v8/src/objects/struct.h
index f786c4711af711..8ee84a59cc277c 100644
--- a/deps/v8/src/objects/struct.h
+++ b/deps/v8/src/objects/struct.h
@@ -34,13 +34,6 @@ class Tuple2 : public TorqueGeneratedTuple2<Tuple2, Struct> {
   TQ_OBJECT_CONSTRUCTORS(Tuple2)
 };
 
-class Tuple3 : public TorqueGeneratedTuple3<Tuple3, Tuple2> {
- public:
-  void BriefPrintDetails(std::ostream& os);
-
-  TQ_OBJECT_CONSTRUCTORS(Tuple3)
-};
-
 // Support for JavaScript accessors: A pair of a getter and a setter. Each
 // accessor can either be
 //   * a JavaScript function or proxy: a real accessor
@@ -49,6 +42,7 @@ class Tuple3 : public TorqueGeneratedTuple3<Tuple3, Tuple2> {
 //   * null: an accessor which has not been set
 class AccessorPair : public TorqueGeneratedAccessorPair<AccessorPair, Struct> {
  public:
+  NEVER_READ_ONLY_SPACE
   static Handle<AccessorPair> Copy(Isolate* isolate, Handle<AccessorPair> pair);
 
   inline Object get(AccessorComponent component);
diff --git a/deps/v8/src/objects/struct.tq b/deps/v8/src/objects/struct.tq
new file mode 100644
index 00000000000000..ffd83e33a57c31
--- /dev/null
+++ b/deps/v8/src/objects/struct.tq
@@ -0,0 +1,28 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@abstract
+@generatePrint
+@generateCppClass
+extern class Struct extends HeapObject {
+}
+
+@generatePrint
+@generateCppClass
+extern class Tuple2 extends Struct {
+  value1: Object;
+  value2: Object;
+}
+
+@generateCppClass
+extern class ClassPositions extends Struct {
+  start: Smi;
+  end: Smi;
+}
+
+@generateCppClass
+extern class AccessorPair extends Struct {
+  getter: Object;
+  setter: Object;
+}
diff --git a/deps/v8/src/objects/synthetic-module.h b/deps/v8/src/objects/synthetic-module.h
index 77a6eed2761da6..8ac6668170fac0 100644
--- a/deps/v8/src/objects/synthetic-module.h
+++ b/deps/v8/src/objects/synthetic-module.h
@@ -40,9 +40,9 @@ class SyntheticModule
                               Handle<String> export_name,
                               Handle<Object> export_value);
 
-  using BodyDescriptor = SubclassBodyDescriptor<
-      Module::BodyDescriptor,
-      FixedBodyDescriptor<kExportNamesOffset, kSize, kSize>>;
+  using BodyDescriptor =
+      SubclassBodyDescriptor<Module::BodyDescriptor,
+                             FixedBodyDescriptor<kNameOffset, kSize, kSize>>;
 
  private:
   friend class Module;
diff --git a/deps/v8/src/objects/synthetic-module.tq b/deps/v8/src/objects/synthetic-module.tq
new file mode 100644
index 00000000000000..69f66ebb4bd61c
--- /dev/null
+++ b/deps/v8/src/objects/synthetic-module.tq
@@ -0,0 +1,10 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generateCppClass
+extern class SyntheticModule extends Module {
+  name: String;
+  export_names: FixedArray;
+  evaluation_steps: Foreign;
+}
diff --git a/deps/v8/src/objects/tagged-field-inl.h b/deps/v8/src/objects/tagged-field-inl.h
index 3cce536a14283c..1ebd313bba498f 100644
--- a/deps/v8/src/objects/tagged-field-inl.h
+++ b/deps/v8/src/objects/tagged-field-inl.h
@@ -61,7 +61,7 @@ T TaggedField<T, kFieldOffset>::load(HeapObject host, int offset) {
 
 // static
 template <typename T, int kFieldOffset>
-T TaggedField<T, kFieldOffset>::load(Isolate* isolate, HeapObject host,
+T TaggedField<T, kFieldOffset>::load(const Isolate* isolate, HeapObject host,
                                      int offset) {
   Tagged_t value = *location(host, offset);
   return T(tagged_to_full(isolate, value));
@@ -96,8 +96,8 @@ T TaggedField<T, kFieldOffset>::Relaxed_Load(HeapObject host, int offset) {
 
 // static
 template <typename T, int kFieldOffset>
-T TaggedField<T, kFieldOffset>::Relaxed_Load(Isolate* isolate, HeapObject host,
-                                             int offset) {
+T TaggedField<T, kFieldOffset>::Relaxed_Load(const Isolate* isolate,
+                                             HeapObject host, int offset) {
   AtomicTagged_t value = AsAtomicTagged::Relaxed_Load(location(host, offset));
   return T(tagged_to_full(isolate, value));
 }
@@ -125,8 +125,8 @@ T TaggedField<T, kFieldOffset>::Acquire_Load(HeapObject host, int offset) {
 
 // static
 template <typename T, int kFieldOffset>
-T TaggedField<T, kFieldOffset>::Acquire_Load(Isolate* isolate, HeapObject host,
-                                             int offset) {
+T TaggedField<T, kFieldOffset>::Acquire_Load(const Isolate* isolate,
+                                             HeapObject host, int offset) {
   AtomicTagged_t value = AsAtomicTagged::Acquire_Load(location(host, offset));
   return T(tagged_to_full(isolate, value));
 }
diff --git a/deps/v8/src/objects/tagged-field.h b/deps/v8/src/objects/tagged-field.h
index fbaaee59308b18..f3cb835525e8d5 100644
--- a/deps/v8/src/objects/tagged-field.h
+++ b/deps/v8/src/objects/tagged-field.h
@@ -38,20 +38,20 @@ class TaggedField : public AllStatic {
   static inline Address address(HeapObject host, int offset = 0);
 
   static inline T load(HeapObject host, int offset = 0);
-  static inline T load(Isolate* isolate, HeapObject host, int offset = 0);
+  static inline T load(const Isolate* isolate, HeapObject host, int offset = 0);
 
   static inline void store(HeapObject host, T value);
   static inline void store(HeapObject host, int offset, T value);
 
   static inline T Relaxed_Load(HeapObject host, int offset = 0);
-  static inline T Relaxed_Load(Isolate* isolate, HeapObject host,
+  static inline T Relaxed_Load(const Isolate* isolate, HeapObject host,
                                int offset = 0);
 
   static inline void Relaxed_Store(HeapObject host, T value);
   static inline void Relaxed_Store(HeapObject host, int offset, T value);
 
   static inline T Acquire_Load(HeapObject host, int offset = 0);
-  static inline T Acquire_Load(Isolate* isolate, HeapObject host,
+  static inline T Acquire_Load(const Isolate* isolate, HeapObject host,
                                int offset = 0);
 
   static inline void Release_Store(HeapObject host, T value);
diff --git a/deps/v8/src/objects/tagged-impl.h b/deps/v8/src/objects/tagged-impl.h
index 111eabae2f470c..036075fc2d6f5e 100644
--- a/deps/v8/src/objects/tagged-impl.h
+++ b/deps/v8/src/objects/tagged-impl.h
@@ -88,7 +88,7 @@ class TaggedImpl {
 
   // Returns true if this tagged value is a strong pointer to a HeapObject.
   constexpr inline bool IsStrong() const {
-#ifdef V8_CAN_HAVE_DCHECK_IN_CONSTEXPR
+#if V8_HAS_CXX14_CONSTEXPR
     DCHECK_IMPLIES(!kCanBeWeak, !IsSmi() == HAS_STRONG_HEAP_OBJECT_TAG(ptr_));
 #endif
     return kCanBeWeak ? HAS_STRONG_HEAP_OBJECT_TAG(ptr_) : !IsSmi();
diff --git a/deps/v8/src/objects/template-objects-inl.h b/deps/v8/src/objects/template-objects-inl.h
index b0f73e873b999a..3f84f536876d48 100644
--- a/deps/v8/src/objects/template-objects-inl.h
+++ b/deps/v8/src/objects/template-objects-inl.h
@@ -16,13 +16,9 @@ namespace v8 {
 namespace internal {
 
 TQ_OBJECT_CONSTRUCTORS_IMPL(TemplateObjectDescription)
-OBJECT_CONSTRUCTORS_IMPL(CachedTemplateObject, Tuple3)
+TQ_OBJECT_CONSTRUCTORS_IMPL(CachedTemplateObject)
 
-CAST_ACCESSOR(CachedTemplateObject)
-
-SMI_ACCESSORS(CachedTemplateObject, slot_id, kSlotIdOffset)
-ACCESSORS(CachedTemplateObject, template_object, JSArray, kTemplateObjectOffset)
-ACCESSORS(CachedTemplateObject, next, HeapObject, kNextOffset)
+TQ_SMI_ACCESSORS(CachedTemplateObject, slot_id)
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/template-objects.cc b/deps/v8/src/objects/template-objects.cc
index d5b6293afe18ec..85f19ad4875407 100644
--- a/deps/v8/src/objects/template-objects.cc
+++ b/deps/v8/src/objects/template-objects.cc
@@ -85,7 +85,7 @@ Handle<CachedTemplateObject> CachedTemplateObject::New(
   DCHECK(next->IsCachedTemplateObject() || next->IsTheHole());
   Factory* factory = isolate->factory();
   Handle<CachedTemplateObject> result = Handle<CachedTemplateObject>::cast(
-      factory->NewStruct(TUPLE3_TYPE, AllocationType::kOld));
+      factory->NewStruct(CACHED_TEMPLATE_OBJECT_TYPE, AllocationType::kOld));
   result->set_slot_id(slot_id);
   result->set_template_object(*template_object);
   result->set_next(*next);
diff --git a/deps/v8/src/objects/template-objects.h b/deps/v8/src/objects/template-objects.h
index 7bac29206b9ab0..085727ecb5ad14 100644
--- a/deps/v8/src/objects/template-objects.h
+++ b/deps/v8/src/objects/template-objects.h
@@ -17,23 +17,16 @@ namespace internal {
 // CachedTemplateObject is a tuple used to cache a TemplateObject that has been
 // created. All the CachedTemplateObject's for a given SharedFunctionInfo form a
 // linked list via the next fields.
-class CachedTemplateObject final : public Tuple3 {
+class CachedTemplateObject final
+    : public TorqueGeneratedCachedTemplateObject<CachedTemplateObject, Struct> {
  public:
   DECL_INT_ACCESSORS(slot_id)
-  DECL_ACCESSORS(template_object, JSArray)
-  DECL_ACCESSORS(next, HeapObject)
 
   static Handle<CachedTemplateObject> New(Isolate* isolate, int slot_id,
                                           Handle<JSArray> template_object,
                                           Handle<HeapObject> next);
 
-  DECL_CAST(CachedTemplateObject)
-
-  static constexpr int kSlotIdOffset = kValue1Offset;
-  static constexpr int kTemplateObjectOffset = kValue2Offset;
-  static constexpr int kNextOffset = kValue3Offset;
-
-  OBJECT_CONSTRUCTORS(CachedTemplateObject, Tuple3);
+  TQ_OBJECT_CONSTRUCTORS(CachedTemplateObject)
 };
 
 // TemplateObjectDescription is a tuple of raw strings and cooked strings for
diff --git a/deps/v8/src/objects/template-objects.tq b/deps/v8/src/objects/template-objects.tq
new file mode 100644
index 00000000000000..38da71d616f69a
--- /dev/null
+++ b/deps/v8/src/objects/template-objects.tq
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@generatePrint
+@generateCppClass
+extern class CachedTemplateObject extends Struct {
+  slot_id: Smi;
+  template_object: JSArray;
+  next: CachedTemplateObject|TheHole;
+}
+
+@generatePrint
+@generateCppClass
+extern class TemplateObjectDescription extends Struct {
+  raw_strings: FixedArray;
+  cooked_strings: FixedArray;
+}
diff --git a/deps/v8/src/objects/template.tq b/deps/v8/src/objects/template.tq
new file mode 100644
index 00000000000000..472d968855ad76
--- /dev/null
+++ b/deps/v8/src/objects/template.tq
@@ -0,0 +1,56 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@abstract
+@generateCppClass
+extern class TemplateInfo extends Struct {
+  tag: Object;
+  serial_number: Object;
+  number_of_properties: Smi;
+  property_list: Object;
+  property_accessors: Object;
+}
+
+@generateCppClass
+extern class FunctionTemplateRareData extends Struct {
+  // See DECL_RARE_ACCESSORS in FunctionTemplateInfo.
+  prototype_template: Object;
+  prototype_provider_template: Object;
+  parent_template: Object;
+  named_property_handler: Object;
+  indexed_property_handler: Object;
+  instance_template: Object;
+  instance_call_handler: Object;
+  access_check_info: Object;
+}
+
+@generateCppClass
+extern class FunctionTemplateInfo extends TemplateInfo {
+  // Handler invoked when calling an instance of this FunctionTemplateInfo.
+  // Either CallHandlerInfo or Undefined.
+  call_code: Object;
+  class_name: Object;
+  // If the signature is a FunctionTemplateInfo it is used to check whether the
+  // receiver calling the associated JSFunction is a compatible receiver, i.e.
+  // it is an instance of the signature FunctionTemplateInfo or any of the
+  // receiver's prototypes are.
+  signature: Object;
+  // If any of the setters declared by DECL_RARE_ACCESSORS are used then a
+  // FunctionTemplateRareData will be stored here. Until then this contains
+  // undefined.
+  rare_data: HeapObject;
+  shared_function_info: Object;
+  flag: Smi;
+  length: Smi;
+  // Either the_hole or a private symbol. Used to cache the result on
+  // the receiver under the the cached_property_name when this
+  // FunctionTemplateInfo is used as a getter.
+  cached_property_name: Object;
+}
+
+@generateCppClass
+extern class ObjectTemplateInfo extends TemplateInfo {
+  constructor: Object;
+  data: Object;
+}
diff --git a/deps/v8/src/objects/templates.h b/deps/v8/src/objects/templates.h
index 29671db83cf044..c2cc0855a78e90 100644
--- a/deps/v8/src/objects/templates.h
+++ b/deps/v8/src/objects/templates.h
@@ -166,7 +166,7 @@ class ObjectTemplateInfo
   inline ObjectTemplateInfo GetParent(Isolate* isolate);
 
  private:
-  using IsImmutablePrototype = BitField<bool, 0, 1>;
+  using IsImmutablePrototype = base::BitField<bool, 0, 1>;
   using EmbedderFieldCount = IsImmutablePrototype::Next<int, 29>;
 
   TQ_OBJECT_CONSTRUCTORS(ObjectTemplateInfo)
diff --git a/deps/v8/src/objects/value-serializer.cc b/deps/v8/src/objects/value-serializer.cc
index af5cdc57eaf1e0..58b1db67492857 100644
--- a/deps/v8/src/objects/value-serializer.cc
+++ b/deps/v8/src/objects/value-serializer.cc
@@ -144,11 +144,6 @@ enum class SerializationTag : uint8_t {
   kArrayBufferView = 'V',
   // Shared array buffer. transferID:uint32_t
   kSharedArrayBuffer = 'u',
-  // Compiled WebAssembly module. encodingType:(one-byte tag).
-  // If encodingType == 'y' (raw bytes):
-  //  wasmWireByteLength:uint32_t, then raw data
-  //  compiledDataLength:uint32_t, then raw data
-  kWasmModule = 'W',
   // A wasm module object transfer. next value is its index.
   kWasmModuleTransfer = 'w',
   // The delegate is responsible for processing all following data.
@@ -210,10 +205,6 @@ enum class ArrayBufferViewTag : uint8_t {
   kDataView = '?',
 };
 
-enum class WasmEncodingTag : uint8_t {
-  kRawBytes = 'y',
-};
-
 // Sub-tags only meaningful for error serialization.
 enum class ErrorTag : uint8_t {
   // The error is a EvalError. No accompanying data.
@@ -553,7 +544,7 @@ Maybe<bool> ValueSerializer::WriteJSReceiver(Handle<JSReceiver> receiver) {
       return WriteJSPrimitiveWrapper(
           Handle<JSPrimitiveWrapper>::cast(receiver));
     case JS_REG_EXP_TYPE:
-      WriteJSRegExp(JSRegExp::cast(*receiver));
+      WriteJSRegExp(Handle<JSRegExp>::cast(receiver));
       return ThrowIfOutOfMemory();
     case JS_MAP_TYPE:
       return WriteJSMap(Handle<JSMap>::cast(receiver));
@@ -566,17 +557,11 @@ Maybe<bool> ValueSerializer::WriteJSReceiver(Handle<JSReceiver> receiver) {
       return WriteJSArrayBufferView(JSArrayBufferView::cast(*receiver));
     case JS_ERROR_TYPE:
       return WriteJSError(Handle<JSObject>::cast(receiver));
-    case WASM_MODULE_OBJECT_TYPE: {
-      auto enabled_features = wasm::WasmFeaturesFromIsolate(isolate_);
-      if (!FLAG_wasm_disable_structured_cloning || enabled_features.threads) {
-        // Only write WebAssembly modules if not disabled by a flag.
-        return WriteWasmModule(Handle<WasmModuleObject>::cast(receiver));
-      }
-      break;
-    }
+    case WASM_MODULE_OBJECT_TYPE:
+      return WriteWasmModule(Handle<WasmModuleObject>::cast(receiver));
     case WASM_MEMORY_OBJECT_TYPE: {
-      auto enabled_features = wasm::WasmFeaturesFromIsolate(isolate_);
-      if (enabled_features.threads) {
+      auto enabled_features = wasm::WasmFeatures::FromIsolate(isolate_);
+      if (enabled_features.has_threads()) {
         return WriteWasmMemory(Handle<WasmMemoryObject>::cast(receiver));
       }
       break;
@@ -791,10 +776,10 @@ Maybe<bool> ValueSerializer::WriteJSPrimitiveWrapper(
   return ThrowIfOutOfMemory();
 }
 
-void ValueSerializer::WriteJSRegExp(JSRegExp regexp) {
+void ValueSerializer::WriteJSRegExp(Handle<JSRegExp> regexp) {
   WriteTag(SerializationTag::kRegExp);
-  WriteString(handle(regexp.Pattern(), isolate_));
-  WriteVarint(static_cast<uint32_t>(regexp.GetFlags()));
+  WriteString(handle(regexp->Pattern(), isolate_));
+  WriteVarint(static_cast<uint32_t>(regexp->GetFlags()));
 }
 
 Maybe<bool> ValueSerializer::WriteJSMap(Handle<JSMap> map) {
@@ -931,22 +916,26 @@ Maybe<bool> ValueSerializer::WriteJSError(Handle<JSObject> error) {
 
   WriteTag(SerializationTag::kError);
 
-  Handle<HeapObject> prototype;
-  if (!JSObject::GetPrototype(isolate_, error).ToHandle(&prototype)) {
+  Handle<Object> name_object;
+  if (!JSObject::GetProperty(isolate_, error, "name").ToHandle(&name_object)) {
+    return Nothing<bool>();
+  }
+  Handle<String> name;
+  if (!Object::ToString(isolate_, name_object).ToHandle(&name)) {
     return Nothing<bool>();
   }
 
-  if (*prototype == isolate_->eval_error_function()->prototype()) {
+  if (name->IsOneByteEqualTo(CStrVector("EvalError"))) {
     WriteVarint(static_cast<uint8_t>(ErrorTag::kEvalErrorPrototype));
-  } else if (*prototype == isolate_->range_error_function()->prototype()) {
+  } else if (name->IsOneByteEqualTo(CStrVector("RangeError"))) {
     WriteVarint(static_cast<uint8_t>(ErrorTag::kRangeErrorPrototype));
-  } else if (*prototype == isolate_->reference_error_function()->prototype()) {
+  } else if (name->IsOneByteEqualTo(CStrVector("ReferenceError"))) {
     WriteVarint(static_cast<uint8_t>(ErrorTag::kReferenceErrorPrototype));
-  } else if (*prototype == isolate_->syntax_error_function()->prototype()) {
+  } else if (name->IsOneByteEqualTo(CStrVector("SyntaxError"))) {
     WriteVarint(static_cast<uint8_t>(ErrorTag::kSyntaxErrorPrototype));
-  } else if (*prototype == isolate_->type_error_function()->prototype()) {
+  } else if (name->IsOneByteEqualTo(CStrVector("TypeError"))) {
     WriteVarint(static_cast<uint8_t>(ErrorTag::kTypeErrorPrototype));
-  } else if (*prototype == isolate_->uri_error_function()->prototype()) {
+  } else if (name->IsOneByteEqualTo(CStrVector("URIError"))) {
     WriteVarint(static_cast<uint8_t>(ErrorTag::kUriErrorPrototype));
   } else {
     // The default prototype in the deserialization side is Error.prototype, so
@@ -977,42 +966,22 @@ Maybe<bool> ValueSerializer::WriteJSError(Handle<JSObject> error) {
 }
 
 Maybe<bool> ValueSerializer::WriteWasmModule(Handle<WasmModuleObject> object) {
-  if (delegate_ != nullptr) {
-    // TODO(titzer): introduce a Utils::ToLocal for WasmModuleObject.
-    Maybe<uint32_t> transfer_id = delegate_->GetWasmModuleTransferId(
-        reinterpret_cast<v8::Isolate*>(isolate_),
-        v8::Local<v8::WasmModuleObject>::Cast(
-            Utils::ToLocal(Handle<JSObject>::cast(object))));
-    RETURN_VALUE_IF_SCHEDULED_EXCEPTION(isolate_, Nothing<bool>());
-    uint32_t id = 0;
-    if (transfer_id.To(&id)) {
-      WriteTag(SerializationTag::kWasmModuleTransfer);
-      WriteVarint<uint32_t>(id);
-      return Just(true);
-    }
-  }
-
-  WasmEncodingTag encoding_tag = WasmEncodingTag::kRawBytes;
-  WriteTag(SerializationTag::kWasmModule);
-  WriteRawBytes(&encoding_tag, sizeof(encoding_tag));
-
-  wasm::NativeModule* native_module = object->native_module();
-  Vector<const uint8_t> wire_bytes = native_module->wire_bytes();
-  WriteVarint<uint32_t>(static_cast<uint32_t>(wire_bytes.size()));
-  uint8_t* destination;
-  if (ReserveRawBytes(wire_bytes.size()).To(&destination)) {
-    memcpy(destination, wire_bytes.begin(), wire_bytes.size());
+  if (delegate_ == nullptr) {
+    ThrowDataCloneError(MessageTemplate::kDataCloneError, object);
+    return Nothing<bool>();
   }
 
-  wasm::WasmSerializer wasm_serializer(native_module);
-  size_t module_size = wasm_serializer.GetSerializedNativeModuleSize();
-  CHECK_GE(std::numeric_limits<uint32_t>::max(), module_size);
-  WriteVarint<uint32_t>(static_cast<uint32_t>(module_size));
-  uint8_t* module_buffer;
-  if (ReserveRawBytes(module_size).To(&module_buffer)) {
-    if (!wasm_serializer.SerializeNativeModule({module_buffer, module_size})) {
-      return Nothing<bool>();
-    }
+  // TODO(titzer): introduce a Utils::ToLocal for WasmModuleObject.
+  Maybe<uint32_t> transfer_id = delegate_->GetWasmModuleTransferId(
+      reinterpret_cast<v8::Isolate*>(isolate_),
+      v8::Local<v8::WasmModuleObject>::Cast(
+          Utils::ToLocal(Handle<JSObject>::cast(object))));
+  RETURN_VALUE_IF_SCHEDULED_EXCEPTION(isolate_, Nothing<bool>());
+  uint32_t id = 0;
+  if (transfer_id.To(&id)) {
+    WriteTag(SerializationTag::kWasmModuleTransfer);
+    WriteVarint<uint32_t>(id);
+    return Just(true);
   }
   return ThrowIfOutOfMemory();
 }
@@ -1055,10 +1024,8 @@ Maybe<uint32_t> ValueSerializer::WriteJSObjectPropertiesSlow(
   for (int i = 0; i < length; i++) {
     Handle<Object> key(keys->get(i), isolate_);
 
-    bool success;
-    LookupIterator it = LookupIterator::PropertyOrElement(
-        isolate_, object, key, &success, LookupIterator::OWN);
-    DCHECK(success);
+    LookupIterator::Key lookup_key(isolate_, key);
+    LookupIterator it(isolate_, object, lookup_key, LookupIterator::OWN);
     Handle<Object> value;
     if (!Object::GetProperty(&it).ToHandle(&value)) return Nothing<uint32_t>();
 
@@ -1356,8 +1323,6 @@ MaybeHandle<Object> ValueDeserializer::ReadObjectInternal() {
     }
     case SerializationTag::kError:
       return ReadJSError();
-    case SerializationTag::kWasmModule:
-      return ReadWasmModule();
     case SerializationTag::kWasmModuleTransfer:
       return ReadWasmModuleTransfer();
     case SerializationTag::kWasmMemoryTransfer:
@@ -1814,8 +1779,8 @@ MaybeHandle<JSArrayBuffer> ValueDeserializer::ReadTransferredJSArrayBuffer() {
       !array_buffer_transfer_map_.ToHandle(&transfer_map)) {
     return MaybeHandle<JSArrayBuffer>();
   }
-  int index = transfer_map->FindEntry(isolate_, transfer_id);
-  if (index == SimpleNumberDictionary::kNotFound) {
+  InternalIndex index = transfer_map->FindEntry(isolate_, transfer_id);
+  if (index.is_not_found()) {
     return MaybeHandle<JSArrayBuffer>();
   }
   Handle<JSArrayBuffer> array_buffer(
@@ -1939,12 +1904,6 @@ MaybeHandle<Object> ValueDeserializer::ReadJSError() {
 }
 
 MaybeHandle<JSObject> ValueDeserializer::ReadWasmModuleTransfer() {
-  auto enabled_features = wasm::WasmFeaturesFromIsolate(isolate_);
-  if ((FLAG_wasm_disable_structured_cloning && !enabled_features.threads) ||
-      expect_inline_wasm()) {
-    return MaybeHandle<JSObject>();
-  }
-
   uint32_t transfer_id = 0;
   Local<Value> module_value;
   if (!ReadVarint<uint32_t>().To(&transfer_id) || delegate_ == nullptr ||
@@ -1962,60 +1921,11 @@ MaybeHandle<JSObject> ValueDeserializer::ReadWasmModuleTransfer() {
   return module;
 }
 
-MaybeHandle<JSObject> ValueDeserializer::ReadWasmModule() {
-  auto enabled_features = wasm::WasmFeaturesFromIsolate(isolate_);
-  if ((FLAG_wasm_disable_structured_cloning && !enabled_features.threads) ||
-      !expect_inline_wasm()) {
-    return MaybeHandle<JSObject>();
-  }
-
-  Vector<const uint8_t> encoding_tag;
-  if (!ReadRawBytes(sizeof(WasmEncodingTag)).To(&encoding_tag) ||
-      encoding_tag[0] != static_cast<uint8_t>(WasmEncodingTag::kRawBytes)) {
-    return MaybeHandle<JSObject>();
-  }
-
-  // Extract the data from the buffer: wasm wire bytes, followed by V8 compiled
-  // script data.
-  static_assert(sizeof(int) <= sizeof(uint32_t),
-                "max int must fit in uint32_t");
-  const uint32_t max_valid_size = std::numeric_limits<int>::max();
-  uint32_t wire_bytes_length = 0;
-  Vector<const uint8_t> wire_bytes;
-  uint32_t compiled_bytes_length = 0;
-  Vector<const uint8_t> compiled_bytes;
-  if (!ReadVarint<uint32_t>().To(&wire_bytes_length) ||
-      wire_bytes_length > max_valid_size ||
-      !ReadRawBytes(wire_bytes_length).To(&wire_bytes) ||
-      !ReadVarint<uint32_t>().To(&compiled_bytes_length) ||
-      compiled_bytes_length > max_valid_size ||
-      !ReadRawBytes(compiled_bytes_length).To(&compiled_bytes)) {
-    return MaybeHandle<JSObject>();
-  }
-
-  // Try to deserialize the compiled module first.
-  MaybeHandle<WasmModuleObject> result =
-      wasm::DeserializeNativeModule(isolate_, compiled_bytes, wire_bytes);
-  if (result.is_null()) {
-    wasm::ErrorThrower thrower(isolate_, "ValueDeserializer::ReadWasmModule");
-    // TODO(titzer): are the current features appropriate for deserializing?
-    auto enabled_features = wasm::WasmFeaturesFromIsolate(isolate_);
-    result = isolate_->wasm_engine()->SyncCompile(
-        isolate_, enabled_features, &thrower,
-        wasm::ModuleWireBytes(wire_bytes));
-  }
-  uint32_t id = next_id_++;
-  if (!result.is_null()) {
-    AddObjectWithID(id, result.ToHandleChecked());
-  }
-  return result;
-}
-
 MaybeHandle<WasmMemoryObject> ValueDeserializer::ReadWasmMemory() {
   uint32_t id = next_id_++;
 
-  auto enabled_features = wasm::WasmFeaturesFromIsolate(isolate_);
-  if (!enabled_features.threads) {
+  auto enabled_features = wasm::WasmFeatures::FromIsolate(isolate_);
+  if (!enabled_features.has_threads()) {
     return MaybeHandle<WasmMemoryObject>();
   }
 
@@ -2170,10 +2080,10 @@ Maybe<uint32_t> ValueDeserializer::ReadJSObjectProperties(
       CommitProperties(object, map, properties);
       num_properties = static_cast<uint32_t>(properties.size());
 
-      bool success;
-      LookupIterator it = LookupIterator::PropertyOrElement(
-          isolate_, object, key, &success, LookupIterator::OWN);
-      if (!success || it.state() != LookupIterator::NOT_FOUND ||
+      // We checked earlier that IsValidObjectKey(key).
+      LookupIterator::Key lookup_key(isolate_, key);
+      LookupIterator it(isolate_, object, lookup_key, LookupIterator::OWN);
+      if (it.state() != LookupIterator::NOT_FOUND ||
           JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, NONE)
               .is_null()) {
         return Nothing<uint32_t>();
@@ -2204,10 +2114,10 @@ Maybe<uint32_t> ValueDeserializer::ReadJSObjectProperties(
     Handle<Object> value;
     if (!ReadObject().ToHandle(&value)) return Nothing<uint32_t>();
 
-    bool success;
-    LookupIterator it = LookupIterator::PropertyOrElement(
-        isolate_, object, key, &success, LookupIterator::OWN);
-    if (!success || it.state() != LookupIterator::NOT_FOUND ||
+    // We checked earlier that IsValidObjectKey(key).
+    LookupIterator::Key lookup_key(isolate_, key);
+    LookupIterator it(isolate_, object, lookup_key, LookupIterator::OWN);
+    if (it.state() != LookupIterator::NOT_FOUND ||
         JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, NONE)
             .is_null()) {
       return Nothing<uint32_t>();
@@ -2251,10 +2161,9 @@ static Maybe<bool> SetPropertiesFromKeyValuePairs(Isolate* isolate,
     Handle<Object> key = data[i];
     if (!IsValidObjectKey(key)) return Nothing<bool>();
     Handle<Object> value = data[i + 1];
-    bool success;
-    LookupIterator it = LookupIterator::PropertyOrElement(
-        isolate, object, key, &success, LookupIterator::OWN);
-    if (!success || it.state() != LookupIterator::NOT_FOUND ||
+    LookupIterator::Key lookup_key(isolate, key);
+    LookupIterator it(isolate, object, lookup_key, LookupIterator::OWN);
+    if (it.state() != LookupIterator::NOT_FOUND ||
         JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, NONE)
             .is_null()) {
       return Nothing<bool>();
diff --git a/deps/v8/src/objects/value-serializer.h b/deps/v8/src/objects/value-serializer.h
index 839636ceef8841..acb3f3d25ec689 100644
--- a/deps/v8/src/objects/value-serializer.h
+++ b/deps/v8/src/objects/value-serializer.h
@@ -120,7 +120,7 @@ class ValueSerializer {
   void WriteJSDate(JSDate date);
   Maybe<bool> WriteJSPrimitiveWrapper(Handle<JSPrimitiveWrapper> value)
       V8_WARN_UNUSED_RESULT;
-  void WriteJSRegExp(JSRegExp regexp);
+  void WriteJSRegExp(Handle<JSRegExp> regexp);
   Maybe<bool> WriteJSMap(Handle<JSMap> map) V8_WARN_UNUSED_RESULT;
   Maybe<bool> WriteJSSet(Handle<JSSet> map) V8_WARN_UNUSED_RESULT;
   Maybe<bool> WriteJSArrayBuffer(Handle<JSArrayBuffer> array_buffer)
@@ -224,9 +224,6 @@ class ValueDeserializer {
   bool ReadUint64(uint64_t* value) V8_WARN_UNUSED_RESULT;
   bool ReadDouble(double* value) V8_WARN_UNUSED_RESULT;
   bool ReadRawBytes(size_t length, const void** data) V8_WARN_UNUSED_RESULT;
-  void set_expect_inline_wasm(bool expect_inline_wasm) {
-    expect_inline_wasm_ = expect_inline_wasm;
-  }
 
  private:
   // Reading the wire format.
@@ -239,7 +236,6 @@ class ValueDeserializer {
   Maybe<T> ReadZigZag() V8_WARN_UNUSED_RESULT;
   Maybe<double> ReadDouble() V8_WARN_UNUSED_RESULT;
   Maybe<Vector<const uint8_t>> ReadRawBytes(int size) V8_WARN_UNUSED_RESULT;
-  bool expect_inline_wasm() const { return expect_inline_wasm_; }
 
   // Reads a string if it matches the one provided.
   // Returns true if this was the case. Otherwise, nothing is consumed.
@@ -276,7 +272,6 @@ class ValueDeserializer {
   MaybeHandle<JSArrayBufferView> ReadJSArrayBufferView(
       Handle<JSArrayBuffer> buffer) V8_WARN_UNUSED_RESULT;
   MaybeHandle<Object> ReadJSError() V8_WARN_UNUSED_RESULT;
-  MaybeHandle<JSObject> ReadWasmModule() V8_WARN_UNUSED_RESULT;
   MaybeHandle<JSObject> ReadWasmModuleTransfer() V8_WARN_UNUSED_RESULT;
   MaybeHandle<WasmMemoryObject> ReadWasmMemory() V8_WARN_UNUSED_RESULT;
   MaybeHandle<JSObject> ReadHostObject() V8_WARN_UNUSED_RESULT;
@@ -300,7 +295,6 @@ class ValueDeserializer {
   const uint8_t* const end_;
   uint32_t version_ = 0;
   uint32_t next_id_ = 0;
-  bool expect_inline_wasm_ = false;
 
   // Always global handles.
   Handle<FixedArray> id_map_;
diff --git a/deps/v8/src/objects/visitors.h b/deps/v8/src/objects/visitors.h
index d36723b440071f..c302fdb610cb10 100644
--- a/deps/v8/src/objects/visitors.h
+++ b/deps/v8/src/objects/visitors.h
@@ -28,7 +28,6 @@ class CodeDataContainer;
   V(kDebug, "(Debugger)")                              \
   V(kCompilationCache, "(Compilation cache)")          \
   V(kHandleScope, "(Handle scope)")                    \
-  V(kDispatchTable, "(Dispatch table)")                \
   V(kBuiltins, "(Builtins)")                           \
   V(kGlobalHandles, "(Global handles)")                \
   V(kEternalHandles, "(Eternal handles)")              \
diff --git a/deps/v8/src/parsing/expression-scope-reparenter.cc b/deps/v8/src/parsing/expression-scope-reparenter.cc
deleted file mode 100644
index 2f4914398fd814..00000000000000
--- a/deps/v8/src/parsing/expression-scope-reparenter.cc
+++ /dev/null
@@ -1,123 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/parsing/expression-scope-reparenter.h"
-
-#include "src/ast/ast-traversal-visitor.h"
-#include "src/ast/ast.h"
-#include "src/ast/scopes.h"
-#include "src/objects/objects-inl.h"
-
-namespace v8 {
-namespace internal {
-
-namespace {
-
-class Reparenter final : public AstTraversalVisitor<Reparenter> {
- public:
-  Reparenter(uintptr_t stack_limit, Expression* initializer, Scope* scope)
-      : AstTraversalVisitor(stack_limit, initializer), scope_(scope) {}
-
- private:
-  // This is required so that the overriden Visit* methods can be
-  // called by the base class (template).
-  friend class AstTraversalVisitor<Reparenter>;
-
-  void VisitFunctionLiteral(FunctionLiteral* expr);
-  void VisitClassLiteral(ClassLiteral* expr);
-  void VisitVariableProxy(VariableProxy* expr);
-
-  void VisitBlock(Block* stmt);
-  void VisitTryCatchStatement(TryCatchStatement* stmt);
-  void VisitWithStatement(WithStatement* stmt);
-
-  Scope* scope_;
-};
-
-void Reparenter::VisitFunctionLiteral(FunctionLiteral* function_literal) {
-  function_literal->scope()->ReplaceOuterScope(scope_);
-}
-
-void Reparenter::VisitClassLiteral(ClassLiteral* class_literal) {
-  class_literal->scope()->ReplaceOuterScope(scope_);
-  // No need to visit the constructor since it will have the class
-  // scope on its scope chain.
-  DCHECK_EQ(class_literal->constructor()->scope()->outer_scope(),
-            class_literal->scope());
-
-  if (class_literal->static_fields_initializer() != nullptr) {
-    DCHECK_EQ(
-        class_literal->static_fields_initializer()->scope()->outer_scope(),
-        class_literal->scope());
-  }
-#if DEBUG
-  // The same goes for the rest of the class, but we do some
-  // sanity checking in debug mode.
-  for (ClassLiteralProperty* prop : *class_literal->private_members()) {
-    // No need to visit the values, since all values are functions with
-    // the class scope on their scope chain.
-    DCHECK(prop->value()->IsFunctionLiteral());
-    DCHECK_EQ(prop->value()->AsFunctionLiteral()->scope()->outer_scope(),
-              class_literal->scope());
-  }
-  for (ClassLiteralProperty* prop : *class_literal->public_members()) {
-    // No need to visit the values, since all values are functions with
-    // the class scope on their scope chain.
-    DCHECK(prop->value()->IsFunctionLiteral());
-    DCHECK_EQ(prop->value()->AsFunctionLiteral()->scope()->outer_scope(),
-              class_literal->scope());
-  }
-#endif
-}
-
-void Reparenter::VisitVariableProxy(VariableProxy* proxy) {
-  if (!proxy->is_resolved()) {
-    if (scope_->outer_scope()->RemoveUnresolved(proxy)) {
-      scope_->AddUnresolved(proxy);
-    }
-  } else {
-    // Ensure that temporaries we find are already in the correct scope.
-    DCHECK(proxy->var()->mode() != VariableMode::kTemporary ||
-           proxy->var()->scope() == scope_->GetClosureScope());
-  }
-}
-
-void Reparenter::VisitBlock(Block* stmt) {
-  if (stmt->scope())
-    stmt->scope()->ReplaceOuterScope(scope_);
-  else
-    VisitStatements(stmt->statements());
-}
-
-void Reparenter::VisitTryCatchStatement(TryCatchStatement* stmt) {
-  Visit(stmt->try_block());
-  if (stmt->scope()) {
-    stmt->scope()->ReplaceOuterScope(scope_);
-  } else {
-    Visit(stmt->catch_block());
-  }
-}
-
-void Reparenter::VisitWithStatement(WithStatement* stmt) {
-  Visit(stmt->expression());
-  stmt->scope()->ReplaceOuterScope(scope_);
-}
-
-}  // anonymous namespace
-
-void ReparentExpressionScope(uintptr_t stack_limit, Expression* expr,
-                             Scope* scope) {
-  // The only case that uses this code is block scopes for parameters containing
-  // sloppy eval.
-  DCHECK(scope->is_block_scope());
-  DCHECK(scope->is_declaration_scope());
-  DCHECK(scope->AsDeclarationScope()->sloppy_eval_can_extend_vars());
-  DCHECK(scope->outer_scope()->is_function_scope());
-
-  Reparenter r(stack_limit, expr, scope);
-  r.Run();
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/parsing/expression-scope-reparenter.h b/deps/v8/src/parsing/expression-scope-reparenter.h
deleted file mode 100644
index e473fe693723e6..00000000000000
--- a/deps/v8/src/parsing/expression-scope-reparenter.h
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_PARSING_EXPRESSION_SCOPE_REPARENTER_H_
-#define V8_PARSING_EXPRESSION_SCOPE_REPARENTER_H_
-
-#include <stdint.h>
-
-namespace v8 {
-namespace internal {
-
-class Expression;
-class Scope;
-
-// When an extra declaration scope needs to be inserted to account for
-// a sloppy eval in a default parameter or function body, the expressions
-// needs to be in that new inner scope which was added after initial
-// parsing.
-//
-// scope is the new inner scope, and its outer_scope() is assumed
-// to be the scope which was used during the initial parse.
-void ReparentExpressionScope(uintptr_t stack_limit, Expression* expr,
-                             Scope* scope);
-
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_PARSING_EXPRESSION_SCOPE_REPARENTER_H_
diff --git a/deps/v8/src/parsing/expression-scope.h b/deps/v8/src/parsing/expression-scope.h
index 709231ebb0f8db..6dd55a25c2d24f 100644
--- a/deps/v8/src/parsing/expression-scope.h
+++ b/deps/v8/src/parsing/expression-scope.h
@@ -66,6 +66,24 @@ class ExpressionScope {
     return result;
   }
 
+  void MergeVariableList(
+      ScopedList<std::pair<VariableProxy*, int>>* variable_list) {
+    if (!CanBeExpression()) return;
+    // Merged variables come from a CanBeDeclaration expression scope, and
+    // weren't added as unresolved references to the variable scope yet. Add
+    // them to the variable scope on the boundary where it becomes clear they
+    // aren't declarations. We explicitly delay declaring the variables up to
+    // that point to avoid trying to add them to the unresolved list multiple
+    // times, e.g., for (((a))).
+    if (!CanBeDeclaration()) {
+      for (auto& proxy_initializer_pair : *variable_list) {
+        VariableProxy* proxy = proxy_initializer_pair.first;
+        this->parser()->scope()->AddUnresolved(proxy);
+      }
+    }
+    variable_list->MergeInto(AsExpressionParsingScope()->variable_list());
+  }
+
   Variable* Declare(const AstRawString* name, int pos = kNoSourcePosition) {
     if (type_ == kParameterDeclaration) {
       return AsParameterDeclarationParsingScope()->Declare(name, pos);
@@ -178,7 +196,7 @@ class ExpressionScope {
   }
 
   bool IsCertainlyDeclaration() const {
-    return IsInRange(type_, kParameterDeclaration, kLexicalDeclaration);
+    return base::IsInRange(type_, kParameterDeclaration, kLexicalDeclaration);
   }
 
   int SetInitializers(int variable_index, int peek_position) {
@@ -245,14 +263,15 @@ class ExpressionScope {
 #endif
 
   bool CanBeExpression() const {
-    return IsInRange(type_, kExpression, kMaybeAsyncArrowParameterDeclaration);
+    return base::IsInRange(type_, kExpression,
+                           kMaybeAsyncArrowParameterDeclaration);
   }
   bool CanBeDeclaration() const {
-    return IsInRange(type_, kMaybeArrowParameterDeclaration,
-                     kLexicalDeclaration);
+    return base::IsInRange(type_, kMaybeArrowParameterDeclaration,
+                           kLexicalDeclaration);
   }
   bool IsVariableDeclaration() const {
-    return IsInRange(type_, kVarDeclaration, kLexicalDeclaration);
+    return base::IsInRange(type_, kVarDeclaration, kLexicalDeclaration);
   }
   bool IsLexicalDeclaration() const { return type_ == kLexicalDeclaration; }
   bool IsAsyncArrowHeadParsingScope() const {
@@ -281,17 +300,17 @@ class ExpressionScope {
   }
 
   bool IsArrowHeadParsingScope() const {
-    return IsInRange(type_, kMaybeArrowParameterDeclaration,
-                     kMaybeAsyncArrowParameterDeclaration);
+    return base::IsInRange(type_, kMaybeArrowParameterDeclaration,
+                           kMaybeAsyncArrowParameterDeclaration);
   }
   bool IsCertainlyPattern() const { return IsCertainlyDeclaration(); }
   bool CanBeParameterDeclaration() const {
-    return IsInRange(type_, kMaybeArrowParameterDeclaration,
-                     kParameterDeclaration);
+    return base::IsInRange(type_, kMaybeArrowParameterDeclaration,
+                           kParameterDeclaration);
   }
   bool CanBeArrowParameterDeclaration() const {
-    return IsInRange(type_, kMaybeArrowParameterDeclaration,
-                     kMaybeAsyncArrowParameterDeclaration);
+    return base::IsInRange(type_, kMaybeArrowParameterDeclaration,
+                           kMaybeAsyncArrowParameterDeclaration);
   }
   bool IsCertainlyParameterDeclaration() const {
     return type_ == kParameterDeclaration;
@@ -714,21 +733,19 @@ class ArrowHeadParsingScope : public ExpressionParsingScope<Types> {
     // references.
     this->parser()->next_arrow_function_info_.ClearStrictParameterError();
     ExpressionParsingScope<Types>::ValidateExpression();
-    for (auto& proxy_initializer_pair : *this->variable_list()) {
-      VariableProxy* proxy = proxy_initializer_pair.first;
-      this->parser()->scope()->AddUnresolved(proxy);
-    }
+    this->parent()->MergeVariableList(this->variable_list());
   }
 
   DeclarationScope* ValidateAndCreateScope() {
     DCHECK(!this->is_verified());
+    DeclarationScope* result = this->parser()->NewFunctionScope(kind());
     if (declaration_error_location.IsValid()) {
       ExpressionScope<Types>::Report(declaration_error_location,
                                      declaration_error_message);
+      return result;
     }
     this->ValidatePattern();
 
-    DeclarationScope* result = this->parser()->NewFunctionScope(kind());
     if (!has_simple_parameter_list_) result->SetHasNonSimpleParameters();
     VariableKind kind = PARAMETER_VARIABLE;
     VariableMode mode =
@@ -749,8 +766,11 @@ class ArrowHeadParsingScope : public ExpressionParsingScope<Types> {
     }
 
 #ifdef DEBUG
-    for (auto declaration : *result->declarations()) {
-      DCHECK_NE(declaration->var()->initializer_position(), kNoSourcePosition);
+    if (!this->has_error()) {
+      for (auto declaration : *result->declarations()) {
+        DCHECK_NE(declaration->var()->initializer_position(),
+                  kNoSourcePosition);
+      }
     }
 #endif  // DEBUG
 
diff --git a/deps/v8/src/parsing/keywords-gen.h b/deps/v8/src/parsing/keywords-gen.h
index b256187c960b7d..3a8101b6c5d0ae 100644
--- a/deps/v8/src/parsing/keywords-gen.h
+++ b/deps/v8/src/parsing/keywords-gen.h
@@ -154,7 +154,7 @@ static const struct PerfectKeywordHashTableEntry kPerfectKeywordHashTable[64] =
      {"", Token::IDENTIFIER}};
 
 inline Token::Value PerfectKeywordHash::GetToken(const char* str, int len) {
-  if (IsInRange(len, MIN_WORD_LENGTH, MAX_WORD_LENGTH)) {
+  if (base::IsInRange(len, MIN_WORD_LENGTH, MAX_WORD_LENGTH)) {
     unsigned int key = Hash(str, len) & 0x3f;
 
     DCHECK_LT(key, arraysize(kPerfectKeywordLengthTable));
diff --git a/deps/v8/src/parsing/parse-info.cc b/deps/v8/src/parsing/parse-info.cc
index b0a455e88d8f24..069696cef1993c 100644
--- a/deps/v8/src/parsing/parse-info.cc
+++ b/deps/v8/src/parsing/parse-info.cc
@@ -85,43 +85,45 @@ void ParseInfo::SetFunctionInfo(T function) {
   set_is_oneshot_iife(function->is_oneshot_iife());
 }
 
-ParseInfo::ParseInfo(Isolate* isolate, Handle<SharedFunctionInfo> shared)
+ParseInfo::ParseInfo(Isolate* isolate, SharedFunctionInfo shared)
     : ParseInfo(isolate, isolate->allocator()) {
   // Do not support re-parsing top-level function of a wrapped script.
   // TODO(yangguo): consider whether we need a top-level function in a
   //                wrapped script at all.
-  DCHECK_IMPLIES(is_toplevel(), !Script::cast(shared->script()).is_wrapped());
+  DCHECK_IMPLIES(is_toplevel(), !Script::cast(shared.script()).is_wrapped());
 
   set_allow_lazy_parsing(true);
-  set_asm_wasm_broken(shared->is_asm_wasm_broken());
+  set_asm_wasm_broken(shared.is_asm_wasm_broken());
 
-  set_start_position(shared->StartPosition());
-  set_end_position(shared->EndPosition());
-  function_literal_id_ = shared->function_literal_id();
-  SetFunctionInfo(shared);
+  set_start_position(shared.StartPosition());
+  set_end_position(shared.EndPosition());
+  function_literal_id_ = shared.function_literal_id();
+  SetFunctionInfo(&shared);
 
-  Handle<Script> script(Script::cast(shared->script()), isolate);
-  set_script(script);
+  Script script = Script::cast(shared.script());
+  SetFlagsFromScript(isolate, script);
 
-  if (shared->HasOuterScopeInfo()) {
-    set_outer_scope_info(handle(shared->GetOuterScopeInfo(), isolate));
+  if (shared.HasOuterScopeInfo()) {
+    set_outer_scope_info(handle(shared.GetOuterScopeInfo(), isolate));
   }
 
+  set_repl_mode(shared.is_repl_mode());
+
   // CollectTypeProfile uses its own feedback slots. If we have existing
   // FeedbackMetadata, we can only collect type profile if the feedback vector
   // has the appropriate slots.
   set_collect_type_profile(
       isolate->is_collecting_type_profile() &&
-      (shared->HasFeedbackMetadata()
-           ? shared->feedback_metadata().HasTypeProfileSlot()
-           : script->IsUserJavaScript()));
+      (shared.HasFeedbackMetadata()
+           ? shared.feedback_metadata().HasTypeProfileSlot()
+           : script.IsUserJavaScript()));
 }
 
-ParseInfo::ParseInfo(Isolate* isolate, Handle<Script> script)
+ParseInfo::ParseInfo(Isolate* isolate, Script script)
     : ParseInfo(isolate, isolate->allocator()) {
-  SetScriptForToplevelCompile(isolate, script);
+  SetFlagsForToplevelCompileFromScript(isolate, script);
   set_collect_type_profile(isolate->is_collecting_type_profile() &&
-                           script->IsUserJavaScript());
+                           script.IsUserJavaScript());
 }
 
 // static
@@ -165,6 +167,7 @@ DeclarationScope* ParseInfo::scope() const { return literal()->scope(); }
 
 Handle<Script> ParseInfo::CreateScript(Isolate* isolate, Handle<String> source,
                                        ScriptOriginOptions origin_options,
+                                       REPLMode repl_mode,
                                        NativesFlag natives) {
   // Create a script object describing the script to be compiled.
   Handle<Script> script;
@@ -187,8 +190,9 @@ Handle<Script> ParseInfo::CreateScript(Isolate* isolate, Handle<String> source,
       break;
   }
   script->set_origin_options(origin_options);
+  script->set_is_repl_mode(repl_mode == REPLMode::kYes);
 
-  SetScriptForToplevelCompile(isolate, script);
+  SetFlagsForToplevelCompileFromScript(isolate, *script);
   return script;
 }
 
@@ -213,30 +217,35 @@ void ParseInfo::set_character_stream(
   character_stream_.swap(character_stream);
 }
 
-void ParseInfo::SetScriptForToplevelCompile(Isolate* isolate,
-                                            Handle<Script> script) {
-  set_script(script);
+void ParseInfo::SetFlagsForToplevelCompileFromScript(Isolate* isolate,
+                                                     Script script) {
+  SetFlagsFromScript(isolate, script);
   set_allow_lazy_parsing();
   set_toplevel();
   set_collect_type_profile(isolate->is_collecting_type_profile() &&
-                           script->IsUserJavaScript());
-  if (script->is_wrapped()) {
+                           script.IsUserJavaScript());
+  set_repl_mode(script.is_repl_mode());
+
+  if (script.is_wrapped()) {
     set_function_syntax_kind(FunctionSyntaxKind::kWrapped);
   }
 }
 
-void ParseInfo::set_script(Handle<Script> script) {
-  script_ = script;
-  DCHECK(script_id_ == -1 || script_id_ == script->id());
-  script_id_ = script->id();
+void ParseInfo::SetFlagsFromScript(Isolate* isolate, Script script) {
+  DCHECK(script_id_ == -1 || script_id_ == script.id());
+  script_id_ = script.id();
 
-  set_eval(script->compilation_type() == Script::COMPILATION_TYPE_EVAL);
-  set_module(script->origin_options().IsModule());
+  set_eval(script.compilation_type() == Script::COMPILATION_TYPE_EVAL);
+  set_module(script.origin_options().IsModule());
   DCHECK(!(is_eval() && is_module()));
 
-  if (block_coverage_enabled() && script->IsUserJavaScript()) {
+  if (block_coverage_enabled() && script.IsUserJavaScript()) {
     AllocateSourceRangeMap();
   }
+
+  if (script.is_wrapped()) {
+    set_wrapped_arguments(handle(script.wrapped_arguments(), isolate));
+  }
 }
 
 void ParseInfo::ParallelTasks::Enqueue(ParseInfo* outer_parse_info,
diff --git a/deps/v8/src/parsing/parse-info.h b/deps/v8/src/parsing/parse-info.h
index dde331b88a4e3d..24f86e5bef74c7 100644
--- a/deps/v8/src/parsing/parse-info.h
+++ b/deps/v8/src/parsing/parse-info.h
@@ -43,8 +43,8 @@ class V8_EXPORT_PRIVATE ParseInfo {
   explicit ParseInfo(AccountingAllocator* zone_allocator);
   explicit ParseInfo(Isolate*);
   ParseInfo(Isolate*, AccountingAllocator* zone_allocator);
-  ParseInfo(Isolate* isolate, Handle<Script> script);
-  ParseInfo(Isolate* isolate, Handle<SharedFunctionInfo> shared);
+  ParseInfo(Isolate* isolate, Script script);
+  ParseInfo(Isolate* isolate, SharedFunctionInfo shared);
 
   // Creates a new parse info based on parent top-level |outer_parse_info| for
   // function |literal|.
@@ -56,6 +56,7 @@ class V8_EXPORT_PRIVATE ParseInfo {
 
   Handle<Script> CreateScript(Isolate* isolate, Handle<String> source,
                               ScriptOriginOptions origin_options,
+                              REPLMode repl_mode = REPLMode::kNo,
                               NativesFlag natives = NOT_NATIVES_CODE);
 
   // Either returns the ast-value-factory associcated with this ParseInfo, or
@@ -85,8 +86,6 @@ class V8_EXPORT_PRIVATE ParseInfo {
   FLAG_ACCESSOR(kCoverageEnabled, coverage_enabled, set_coverage_enabled)
   FLAG_ACCESSOR(kBlockCoverageEnabled, block_coverage_enabled,
                 set_block_coverage_enabled)
-  FLAG_ACCESSOR(kOnBackgroundThread, on_background_thread,
-                set_on_background_thread)
   FLAG_ACCESSOR(kAllowEvalCache, allow_eval_cache, set_allow_eval_cache)
   FLAG_ACCESSOR(kRequiresInstanceMembersInitializer,
                 requires_instance_members_initializer,
@@ -112,6 +111,7 @@ class V8_EXPORT_PRIVATE ParseInfo {
                 set_allow_harmony_nullish)
   FLAG_ACCESSOR(kAllowHarmonyTopLevelAwait, allow_harmony_top_level_await,
                 set_allow_harmony_top_level_await)
+  FLAG_ACCESSOR(kREPLMode, is_repl_mode, set_repl_mode)
 
 #undef FLAG_ACCESSOR
 
@@ -256,11 +256,15 @@ class V8_EXPORT_PRIVATE ParseInfo {
 
   ParallelTasks* parallel_tasks() { return parallel_tasks_.get(); }
 
+  void SetFlagsFromScript(Isolate* isolate, Script script);
+
   //--------------------------------------------------------------------------
   // TODO(titzer): these should not be part of ParseInfo.
   //--------------------------------------------------------------------------
-  Handle<Script> script() const { return script_; }
-  void set_script(Handle<Script> script);
+  Handle<FixedArray> wrapped_arguments() const { return wrapped_arguments_; }
+  void set_wrapped_arguments(Handle<FixedArray> wrapped_arguments) {
+    wrapped_arguments_ = wrapped_arguments;
+  }
 
   MaybeHandle<ScopeInfo> maybe_outer_scope_info() const {
     return maybe_outer_scope_info_;
@@ -281,7 +285,7 @@ class V8_EXPORT_PRIVATE ParseInfo {
   }
 
  private:
-  void SetScriptForToplevelCompile(Isolate* isolate, Handle<Script> script);
+  void SetFlagsForToplevelCompileFromScript(Isolate* isolate, Script script);
 
   // Set function info flags based on those in either FunctionLiteral or
   // SharedFunctionInfo |function|
@@ -291,37 +295,37 @@ class V8_EXPORT_PRIVATE ParseInfo {
   // Various configuration flags for parsing.
   enum Flag : uint32_t {
     // ---------- Input flags ---------------------------
-    kToplevel = 1 << 0,
-    kEager = 1 << 1,
-    kEval = 1 << 2,
-    kStrictMode = 1 << 3,
-    kNative = 1 << 4,
-    kParseRestriction = 1 << 5,
-    kModule = 1 << 6,
-    kAllowLazyParsing = 1 << 7,
-    kLazyCompile = 1 << 8,
-    kCollectTypeProfile = 1 << 9,
-    kCoverageEnabled = 1 << 10,
-    kBlockCoverageEnabled = 1 << 11,
-    kIsAsmWasmBroken = 1 << 12,
-    kOnBackgroundThread = 1 << 13,
-    kAllowEvalCache = 1 << 14,
-    kRequiresInstanceMembersInitializer = 1 << 15,
-    kContainsAsmModule = 1 << 16,
-    kMightAlwaysOpt = 1 << 17,
-    kAllowLazyCompile = 1 << 18,
-    kAllowNativeSyntax = 1 << 19,
-    kAllowHarmonyPublicFields = 1 << 20,
-    kAllowHarmonyStaticFields = 1 << 21,
-    kAllowHarmonyDynamicImport = 1 << 22,
-    kAllowHarmonyImportMeta = 1 << 23,
-    kAllowHarmonyOptionalChaining = 1 << 24,
-    kAllowHarmonyPrivateFields = 1 << 25,
-    kAllowHarmonyPrivateMethods = 1 << 26,
-    kIsOneshotIIFE = 1 << 27,
-    kCollectSourcePositions = 1 << 28,
-    kAllowHarmonyNullish = 1 << 29,
-    kAllowHarmonyTopLevelAwait = 1 << 30,
+    kToplevel = 1u << 0,
+    kEager = 1u << 1,
+    kEval = 1u << 2,
+    kStrictMode = 1u << 3,
+    kNative = 1u << 4,
+    kParseRestriction = 1u << 5,
+    kModule = 1u << 6,
+    kAllowLazyParsing = 1u << 7,
+    kLazyCompile = 1u << 8,
+    kCollectTypeProfile = 1u << 9,
+    kCoverageEnabled = 1u << 10,
+    kBlockCoverageEnabled = 1u << 11,
+    kIsAsmWasmBroken = 1u << 12,
+    kAllowEvalCache = 1u << 13,
+    kRequiresInstanceMembersInitializer = 1u << 14,
+    kContainsAsmModule = 1u << 15,
+    kMightAlwaysOpt = 1u << 16,
+    kAllowLazyCompile = 1u << 17,
+    kAllowNativeSyntax = 1u << 18,
+    kAllowHarmonyPublicFields = 1u << 19,
+    kAllowHarmonyStaticFields = 1u << 20,
+    kAllowHarmonyDynamicImport = 1u << 21,
+    kAllowHarmonyImportMeta = 1u << 22,
+    kAllowHarmonyOptionalChaining = 1u << 23,
+    kAllowHarmonyPrivateFields = 1u << 24,
+    kAllowHarmonyPrivateMethods = 1u << 25,
+    kIsOneshotIIFE = 1u << 26,
+    kCollectSourcePositions = 1u << 27,
+    kAllowHarmonyNullish = 1u << 28,
+    kAllowHarmonyTopLevelAwait = 1u << 29,
+    kREPLMode = 1u << 30,
   };
 
   //------------- Inputs to parsing and scope analysis -----------------------
@@ -341,7 +345,7 @@ class V8_EXPORT_PRIVATE ParseInfo {
   int max_function_literal_id_;
 
   // TODO(titzer): Move handles out of ParseInfo.
-  Handle<Script> script_;
+  Handle<FixedArray> wrapped_arguments_;
   MaybeHandle<ScopeInfo> maybe_outer_scope_info_;
 
   //----------- Inputs+Outputs of parsing and scope analysis -----------------
diff --git a/deps/v8/src/parsing/parser-base.h b/deps/v8/src/parsing/parser-base.h
index b12a27142c22a7..16129a4c005bbc 100644
--- a/deps/v8/src/parsing/parser-base.h
+++ b/deps/v8/src/parsing/parser-base.h
@@ -658,8 +658,9 @@ class ParserBase {
     return ast_value_factory->GetOneByteString(name.c_str());
   }
 
-  DeclarationScope* NewScriptScope() const {
-    return new (zone()) DeclarationScope(zone(), ast_value_factory());
+  DeclarationScope* NewScriptScope(REPLMode repl_mode) const {
+    return new (zone())
+        DeclarationScope(zone(), ast_value_factory(), repl_mode);
   }
 
   DeclarationScope* NewVarblockScope() const {
@@ -1051,8 +1052,8 @@ class ParserBase {
   ExpressionT ParseArrayLiteral();
 
   inline static bool IsAccessor(ParsePropertyKind kind) {
-    return IsInRange(kind, ParsePropertyKind::kAccessorGetter,
-                     ParsePropertyKind::kAccessorSetter);
+    return base::IsInRange(kind, ParsePropertyKind::kAccessorGetter,
+                           ParsePropertyKind::kAccessorSetter);
   }
 
   ExpressionT ParseProperty(ParsePropertyInfo* prop_info);
@@ -1503,7 +1504,7 @@ template <typename Impl>
 typename ParserBase<Impl>::IdentifierT
 ParserBase<Impl>::ParseAndClassifyIdentifier(Token::Value next) {
   DCHECK_EQ(scanner()->current_token(), next);
-  if (V8_LIKELY(IsInRange(next, Token::IDENTIFIER, Token::ASYNC))) {
+  if (V8_LIKELY(base::IsInRange(next, Token::IDENTIFIER, Token::ASYNC))) {
     IdentifierT name = impl()->GetIdentifier();
     if (V8_UNLIKELY(impl()->IsArguments(name) &&
                     scope()->ShouldBanArguments())) {
@@ -2013,7 +2014,7 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseProperty(
   }
 
   if (prop_info->kind == ParsePropertyKind::kNotSet &&
-      IsInRange(peek(), Token::GET, Token::SET)) {
+      base::IsInRange(peek(), Token::GET, Token::SET)) {
     Token::Value token = Next();
     if (prop_info->ParsePropertyKindFromToken(peek())) {
       prop_info->name = impl()->GetIdentifier();
@@ -2088,6 +2089,14 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseProperty(
       is_array_index = impl()->IsArrayIndex(prop_info->name, &index);
       break;
     }
+
+    case Token::BIGINT: {
+      Consume(Token::BIGINT);
+      prop_info->name = impl()->GetNumberAsSymbol();
+      is_array_index = impl()->IsArrayIndex(prop_info->name, &index);
+      break;
+    }
+
     case Token::LBRACK: {
       prop_info->name = impl()->NullIdentifier();
       prop_info->is_computed_name = true;
@@ -2299,6 +2308,7 @@ ParserBase<Impl>::ParseClassPropertyDefinition(ClassInfo* class_info,
 template <typename Impl>
 typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseMemberInitializer(
     ClassInfo* class_info, int beg_pos, bool is_static) {
+  FunctionBodyParsingScope body_parsing_scope(impl());
   DeclarationScope* initializer_scope =
       is_static ? class_info->static_fields_scope
                 : class_info->instance_members_scope;
@@ -3260,7 +3270,13 @@ ParserBase<Impl>::ParseLeftHandSideContinuation(ExpressionT result) {
         if (is_optional) {
           DCHECK_EQ(scanner()->current_token(), Token::QUESTION_PERIOD);
           int pos = position();
-          ExpressionT key = ParsePropertyOrPrivatePropertyName();
+          Token::Value next = Next();
+          if (V8_UNLIKELY(!Token::IsPropertyName(next))) {
+            ReportUnexpectedToken(next);
+            return impl()->FailureExpression();
+          }
+          IdentifierT name = impl()->GetSymbol();
+          ExpressionT key = factory()->NewStringLiteral(name, position());
           result = factory()->NewProperty(result, key, pos, is_optional);
           break;
         }
@@ -4194,14 +4210,12 @@ template <typename Impl>
 typename ParserBase<Impl>::ExpressionT
 ParserBase<Impl>::ParseArrowFunctionLiteral(
     const FormalParametersT& formal_parameters) {
-  const RuntimeCallCounterId counters[2][2] = {
-      {RuntimeCallCounterId::kParseBackgroundArrowFunctionLiteral,
-       RuntimeCallCounterId::kParseArrowFunctionLiteral},
-      {RuntimeCallCounterId::kPreParseBackgroundArrowFunctionLiteral,
-       RuntimeCallCounterId::kPreParseArrowFunctionLiteral}};
-  RuntimeCallTimerScope runtime_timer(
-      runtime_call_stats_,
-      counters[Impl::IsPreParser()][parsing_on_main_thread_]);
+  const RuntimeCallCounterId counters[2] = {
+      RuntimeCallCounterId::kParseArrowFunctionLiteral,
+      RuntimeCallCounterId::kPreParseArrowFunctionLiteral};
+  RuntimeCallTimerScope runtime_timer(runtime_call_stats_,
+                                      counters[Impl::IsPreParser()],
+                                      RuntimeCallStats::kThreadSpecific);
   base::ElapsedTimer timer;
   if (V8_UNLIKELY(FLAG_log_function_events)) timer.Start();
 
diff --git a/deps/v8/src/parsing/parser.cc b/deps/v8/src/parsing/parser.cc
index a05884adc0d2d2..21beff8790c665 100644
--- a/deps/v8/src/parsing/parser.cc
+++ b/deps/v8/src/parsing/parser.cc
@@ -17,10 +17,10 @@
 #include "src/codegen/bailout-reason.h"
 #include "src/common/message-template.h"
 #include "src/compiler-dispatcher/compiler-dispatcher.h"
+#include "src/logging/counters.h"
 #include "src/logging/log.h"
 #include "src/numbers/conversions-inl.h"
 #include "src/objects/scope-info.h"
-#include "src/parsing/expression-scope-reparenter.h"
 #include "src/parsing/parse-info.h"
 #include "src/parsing/rewriter.h"
 #include "src/runtime/runtime.h"
@@ -387,8 +387,7 @@ Parser::Parser(ParseInfo* info)
                          info->extension(), info->GetOrCreateAstValueFactory(),
                          info->pending_error_handler(),
                          info->runtime_call_stats(), info->logger(),
-                         info->script().is_null() ? -1 : info->script()->id(),
-                         info->is_module(), true),
+                         info->script_id(), info->is_module(), true),
       info_(info),
       scanner_(info->character_stream(), info->is_module()),
       preparser_zone_(info->zone()->allocator(), ZONE_NAME),
@@ -437,7 +436,8 @@ Parser::Parser(ParseInfo* info)
 void Parser::InitializeEmptyScopeChain(ParseInfo* info) {
   DCHECK_NULL(original_scope_);
   DCHECK_NULL(info->script_scope());
-  DeclarationScope* script_scope = NewScriptScope();
+  DeclarationScope* script_scope =
+      NewScriptScope(info->is_repl_mode() ? REPLMode::kYes : REPLMode::kNo);
   info->set_script_scope(script_scope);
   original_scope_ = script_scope;
 }
@@ -483,9 +483,11 @@ void MaybeProcessSourceRanges(ParseInfo* parse_info, Expression* root,
 
 }  // namespace
 
-FunctionLiteral* Parser::ParseProgram(Isolate* isolate, ParseInfo* info) {
+FunctionLiteral* Parser::ParseProgram(Isolate* isolate, Handle<Script> script,
+                                      ParseInfo* info) {
   // TODO(bmeurer): We temporarily need to pass allow_nesting = true here,
   // see comment for HistogramTimerScope class.
+  DCHECK_EQ(script->id(), script_id());
 
   // It's OK to use the Isolate & counters here, since this function is only
   // called in the main thread.
@@ -507,20 +509,19 @@ FunctionLiteral* Parser::ParseProgram(Isolate* isolate, ParseInfo* info) {
   MaybeResetCharacterStream(info, result);
   MaybeProcessSourceRanges(info, result, stack_limit_);
 
-  HandleSourceURLComments(isolate, info->script());
+  HandleSourceURLComments(isolate, script);
 
   if (V8_UNLIKELY(FLAG_log_function_events) && result != nullptr) {
     double ms = timer.Elapsed().InMillisecondsF();
     const char* event_name = "parse-eval";
-    Script script = *info->script();
     int start = -1;
     int end = -1;
     if (!info->is_eval()) {
       event_name = "parse-script";
       start = 0;
-      end = String::cast(script.source()).length();
+      end = String::cast(script->source()).length();
     }
-    LOG(isolate, FunctionEvent(event_name, script.id(), ms, start, end, "", 0));
+    LOG(isolate, FunctionEvent(event_name, script_id(), ms, start, end, "", 0));
   }
   return result;
 }
@@ -608,7 +609,10 @@ FunctionLiteral* Parser::DoParseProgram(Isolate* isolate, ParseInfo* info) {
         scanner()->set_parser_error();
       }
     } else if (info->is_wrapped_as_function()) {
+      DCHECK(parsing_on_main_thread_);
       ParseWrapped(isolate, info, &body, scope, zone());
+    } else if (info->is_repl_mode()) {
+      ParseREPLProgram(info, &body, scope);
     } else {
       // Don't count the mode in the use counters--give the program a chance
       // to enable script-wide strict mode below.
@@ -634,7 +638,7 @@ FunctionLiteral* Parser::DoParseProgram(Isolate* isolate, ParseInfo* info) {
     // conflicting var declarations with outer scope-info-backed scopes.
     if (info->is_eval()) {
       DCHECK(parsing_on_main_thread_);
-      info->ast_value_factory()->Internalize(isolate);
+      info->ast_value_factory()->Internalize(isolate->factory());
     }
     CheckConflictingVarDeclarations(scope);
 
@@ -670,7 +674,7 @@ ZonePtrList<const AstRawString>* Parser::PrepareWrappedArguments(
     Isolate* isolate, ParseInfo* info, Zone* zone) {
   DCHECK(parsing_on_main_thread_);
   DCHECK_NOT_NULL(isolate);
-  Handle<FixedArray> arguments(info->script()->wrapped_arguments(), isolate);
+  Handle<FixedArray> arguments = info->wrapped_arguments();
   int arguments_length = arguments->length();
   ZonePtrList<const AstRawString>* arguments_for_wrapped_function =
       new (zone) ZonePtrList<const AstRawString>(arguments_length, zone);
@@ -685,7 +689,7 @@ ZonePtrList<const AstRawString>* Parser::PrepareWrappedArguments(
 void Parser::ParseWrapped(Isolate* isolate, ParseInfo* info,
                           ScopedPtrList<Statement>* body,
                           DeclarationScope* outer_scope, Zone* zone) {
-  DCHECK_EQ(parsing_on_main_thread_, isolate != nullptr);
+  DCHECK(parsing_on_main_thread_);
   DCHECK(info->is_wrapped_as_function());
   ParsingModeScope parsing_mode(this, PARSE_EAGERLY);
 
@@ -709,6 +713,62 @@ void Parser::ParseWrapped(Isolate* isolate, ParseInfo* info,
   body->Add(return_statement);
 }
 
+void Parser::ParseREPLProgram(ParseInfo* info, ScopedPtrList<Statement>* body,
+                              DeclarationScope* scope) {
+  // REPL scripts are handled nearly the same way as the body of an async
+  // function. The difference is the value used to resolve the async
+  // promise.
+  // For a REPL script this is the completion value of the
+  // script instead of the expression of some "return" statement. The
+  // completion value of the script is obtained by manually invoking
+  // the {Rewriter} which will return a VariableProxy referencing the
+  // result.
+  DCHECK(info->is_repl_mode());
+  this->scope()->SetLanguageMode(info->language_mode());
+  PrepareGeneratorVariables();
+
+  BlockT block = impl()->NullBlock();
+  {
+    StatementListT statements(pointer_buffer());
+    ParseStatementList(&statements, Token::EOS);
+    block = factory()->NewBlock(true, statements);
+  }
+
+  if (has_error()) return;
+
+  base::Optional<VariableProxy*> maybe_result =
+      Rewriter::RewriteBody(info, scope, block->statements());
+  Expression* result_value =
+      (maybe_result && *maybe_result)
+          ? static_cast<Expression*>(*maybe_result)
+          : factory()->NewUndefinedLiteral(kNoSourcePosition);
+
+  impl()->RewriteAsyncFunctionBody(body, block, WrapREPLResult(result_value),
+                                   REPLMode::kYes);
+}
+
+Expression* Parser::WrapREPLResult(Expression* value) {
+  // REPL scripts additionally wrap the ".result" variable in an
+  // object literal:
+  //
+  //     return %_AsyncFunctionResolve(
+  //                .generator_object, {.repl_result: .result});
+  //
+  // Should ".result" be a resolved promise itself, the async return
+  // would chain the promises and return the resolve value instead of
+  // the promise.
+
+  Literal* property_name = factory()->NewStringLiteral(
+      ast_value_factory()->dot_repl_result_string(), kNoSourcePosition);
+  ObjectLiteralProperty* property =
+      factory()->NewObjectLiteralProperty(property_name, value, true);
+
+  ScopedPtrList<ObjectLiteralProperty> properties(pointer_buffer());
+  properties.Add(property);
+  return factory()->NewObjectLiteral(properties, false, kNoSourcePosition,
+                                     false);
+}
+
 FunctionLiteral* Parser::ParseFunction(Isolate* isolate, ParseInfo* info,
                                        Handle<SharedFunctionInfo> shared_info) {
   // It's OK to use the Isolate & counters here, since this function is only
@@ -750,11 +810,11 @@ FunctionLiteral* Parser::ParseFunction(Isolate* isolate, ParseInfo* info,
   if (V8_UNLIKELY(FLAG_log_function_events) && result != nullptr) {
     double ms = timer.Elapsed().InMillisecondsF();
     // We need to make sure that the debug-name is available.
-    ast_value_factory()->Internalize(isolate);
+    ast_value_factory()->Internalize(isolate->factory());
     DeclarationScope* function_scope = result->scope();
     std::unique_ptr<char[]> function_name = result->GetDebugName();
     LOG(isolate,
-        FunctionEvent("parse-function", info->script()->id(), ms,
+        FunctionEvent("parse-function", script_id(), ms,
                       function_scope->start_position(),
                       function_scope->end_position(), function_name.get(),
                       strlen(function_name.get())));
@@ -2331,10 +2391,8 @@ FunctionLiteral* Parser::ParseFunctionLiteral(
   const bool is_lazy_inner_function = is_lazy && !is_top_level;
 
   RuntimeCallTimerScope runtime_timer(
-      runtime_call_stats_,
-      parsing_on_main_thread_
-          ? RuntimeCallCounterId::kParseFunctionLiteral
-          : RuntimeCallCounterId::kParseBackgroundFunctionLiteral);
+      runtime_call_stats_, RuntimeCallCounterId::kParseFunctionLiteral,
+      RuntimeCallStats::kThreadSpecific);
   base::ElapsedTimer timer;
   if (V8_UNLIKELY(FLAG_log_function_events)) timer.Start();
 
@@ -2427,12 +2485,10 @@ FunctionLiteral* Parser::ParseFunctionLiteral(
   }
   if (V8_UNLIKELY(TracingFlags::is_runtime_stats_enabled()) &&
       did_preparse_successfully) {
-    const RuntimeCallCounterId counters[2] = {
-        RuntimeCallCounterId::kPreParseBackgroundWithVariableResolution,
-        RuntimeCallCounterId::kPreParseWithVariableResolution};
     if (runtime_call_stats_) {
       runtime_call_stats_->CorrectCurrentCounterId(
-          counters[parsing_on_main_thread_]);
+          RuntimeCallCounterId::kPreParseWithVariableResolution,
+          RuntimeCallStats::kThreadSpecific);
     }
   }
 
@@ -2598,38 +2654,11 @@ Block* Parser::BuildParameterInitializationBlock(
                                     initial_value, kNoSourcePosition);
     }
 
-    DeclarationScope* param_scope = scope()->AsDeclarationScope();
-    ScopedPtrList<Statement>* param_init_statements = &init_statements;
-
-    base::Optional<ScopedPtrList<Statement>> non_simple_param_init_statements;
-    if (!parameter->is_simple() && param_scope->sloppy_eval_can_extend_vars()) {
-      param_scope = NewVarblockScope();
-      param_scope->set_start_position(parameter->pattern->position());
-      param_scope->set_end_position(parameter->initializer_end_position);
-      param_scope->RecordEvalCall();
-      non_simple_param_init_statements.emplace(pointer_buffer());
-      param_init_statements = &non_simple_param_init_statements.value();
-      // Rewrite the outer initializer to point to param_scope
-      ReparentExpressionScope(stack_limit(), parameter->pattern, param_scope);
-      ReparentExpressionScope(stack_limit(), initial_value, param_scope);
-    }
-
-    BlockState block_state(&scope_, param_scope);
+    BlockState block_state(&scope_, scope()->AsDeclarationScope());
     DeclarationParsingResult::Declaration decl(parameter->pattern,
                                                initial_value);
+    InitializeVariables(&init_statements, PARAMETER_VARIABLE, &decl);
 
-    InitializeVariables(param_init_statements, PARAMETER_VARIABLE, &decl);
-
-    if (param_init_statements != &init_statements) {
-      DCHECK_EQ(param_init_statements,
-                &non_simple_param_init_statements.value());
-      Block* param_block =
-          factory()->NewBlock(true, *non_simple_param_init_statements);
-      non_simple_param_init_statements.reset();
-      param_block->set_scope(param_scope);
-      param_scope = param_scope->FinalizeBlockScope()->AsDeclarationScope();
-      init_statements.Add(param_block);
-    }
     ++index;
   }
   return factory()->NewBlock(true, init_statements);
@@ -2645,7 +2674,8 @@ Scope* Parser::NewHiddenCatchScope() {
   return catch_scope;
 }
 
-Block* Parser::BuildRejectPromiseOnException(Block* inner_block) {
+Block* Parser::BuildRejectPromiseOnException(Block* inner_block,
+                                             REPLMode repl_mode) {
   // try {
   //   <inner_block>
   // } catch (.catch) {
@@ -2672,9 +2702,16 @@ Block* Parser::BuildRejectPromiseOnException(Block* inner_block) {
   Block* catch_block = IgnoreCompletion(
       factory()->NewReturnStatement(reject_promise, kNoSourcePosition));
 
+  // Treat the exception for REPL mode scripts as UNCAUGHT. This will
+  // keep the corresponding JSMessageObject alive on the Isolate. The
+  // message object is used by the inspector to provide better error
+  // messages for REPL inputs that throw.
   TryStatement* try_catch_statement =
-      factory()->NewTryCatchStatementForAsyncAwait(
-          inner_block, catch_scope, catch_block, kNoSourcePosition);
+      repl_mode == REPLMode::kYes
+          ? factory()->NewTryCatchStatementForReplAsyncAwait(
+                inner_block, catch_scope, catch_block, kNoSourcePosition)
+          : factory()->NewTryCatchStatementForAsyncAwait(
+                inner_block, catch_scope, catch_block, kNoSourcePosition);
   result->statements()->Add(try_catch_statement, zone());
   return result;
 }
@@ -3273,7 +3310,8 @@ Expression* Parser::ExpressionListToExpression(
 
 // This method completes the desugaring of the body of async_function.
 void Parser::RewriteAsyncFunctionBody(ScopedPtrList<Statement>* body,
-                                      Block* block, Expression* return_value) {
+                                      Block* block, Expression* return_value,
+                                      REPLMode repl_mode) {
   // function async_function() {
   //   .generator_object = %_AsyncFunctionEnter();
   //   BuildRejectPromiseOnException({
@@ -3285,7 +3323,7 @@ void Parser::RewriteAsyncFunctionBody(ScopedPtrList<Statement>* body,
   block->statements()->Add(factory()->NewSyntheticAsyncReturnStatement(
                                return_value, return_value->position()),
                            zone());
-  block = BuildRejectPromiseOnException(block);
+  block = BuildRejectPromiseOnException(block, repl_mode);
   body->Add(block);
 }
 
diff --git a/deps/v8/src/parsing/parser.h b/deps/v8/src/parsing/parser.h
index 6f570b8751bb90..d53ccc7fbda49b 100644
--- a/deps/v8/src/parsing/parser.h
+++ b/deps/v8/src/parsing/parser.h
@@ -167,7 +167,8 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   friend class i::ParameterDeclarationParsingScope<ParserTypes<Parser>>;
   friend class i::ArrowHeadParsingScope<ParserTypes<Parser>>;
   friend bool v8::internal::parsing::ParseProgram(
-      ParseInfo*, Isolate*, parsing::ReportErrorsAndStatisticsMode stats_mode);
+      ParseInfo*, Handle<Script>, Isolate*,
+      parsing::ReportErrorsAndStatisticsMode stats_mode);
   friend bool v8::internal::parsing::ParseFunction(
       ParseInfo*, Handle<SharedFunctionInfo> shared_info, Isolate*,
       parsing::ReportErrorsAndStatisticsMode stats_mode);
@@ -208,7 +209,8 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   void PrepareGeneratorVariables();
 
   // Returns nullptr if parsing failed.
-  FunctionLiteral* ParseProgram(Isolate* isolate, ParseInfo* info);
+  FunctionLiteral* ParseProgram(Isolate* isolate, Handle<Script> script,
+                                ParseInfo* info);
 
   FunctionLiteral* ParseFunction(Isolate* isolate, ParseInfo* info,
                                  Handle<SharedFunctionInfo> shared_info);
@@ -225,6 +227,10 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
                     ScopedPtrList<Statement>* body, DeclarationScope* scope,
                     Zone* zone);
 
+  void ParseREPLProgram(ParseInfo* info, ScopedPtrList<Statement>* body,
+                        DeclarationScope* scope);
+  Expression* WrapREPLResult(Expression* value);
+
   ZonePtrList<const AstRawString>* PrepareWrappedArguments(Isolate* isolate,
                                                            ParseInfo* info,
                                                            Zone* zone);
@@ -351,8 +357,6 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
     return scope()->GetDeclarationScope()->has_checked_syntax();
   }
 
-  // PatternRewriter and associated methods defined in pattern-rewriter.cc.
-  friend class PatternRewriter;
   void InitializeVariables(
       ScopedPtrList<Statement>* statements, VariableKind kind,
       const DeclarationParsingResult::Declaration* declaration);
@@ -428,7 +432,8 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
 
   Block* BuildParameterInitializationBlock(
       const ParserFormalParameters& parameters);
-  Block* BuildRejectPromiseOnException(Block* block);
+  Block* BuildRejectPromiseOnException(Block* block,
+                                       REPLMode repl_mode = REPLMode::kNo);
 
   void ParseFunction(
       ScopedPtrList<Statement>* body, const AstRawString* function_name,
@@ -510,7 +515,8 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   Statement* CheckCallable(Variable* var, Expression* error, int pos);
 
   void RewriteAsyncFunctionBody(ScopedPtrList<Statement>* body, Block* block,
-                                Expression* return_value);
+                                Expression* return_value,
+                                REPLMode repl_mode = REPLMode::kNo);
 
   void AddArrowFunctionFormalParameters(ParserFormalParameters* parameters,
                                         Expression* params, int end_pos);
diff --git a/deps/v8/src/parsing/parsing.cc b/deps/v8/src/parsing/parsing.cc
index 95cc1867874655..cb8334bc51a27b 100644
--- a/deps/v8/src/parsing/parsing.cc
+++ b/deps/v8/src/parsing/parsing.cc
@@ -18,7 +18,7 @@ namespace v8 {
 namespace internal {
 namespace parsing {
 
-bool ParseProgram(ParseInfo* info, Isolate* isolate,
+bool ParseProgram(ParseInfo* info, Handle<Script> script, Isolate* isolate,
                   ReportErrorsAndStatisticsMode mode) {
   DCHECK(info->is_toplevel());
   DCHECK_NULL(info->literal());
@@ -26,7 +26,7 @@ bool ParseProgram(ParseInfo* info, Isolate* isolate,
   VMState<PARSER> state(isolate);
 
   // Create a character stream for the parser.
-  Handle<String> source(String::cast(info->script()->source()), isolate);
+  Handle<String> source(String::cast(script->source()), isolate);
   isolate->counters()->total_parse_size()->Increment(source->length());
   std::unique_ptr<Utf16CharacterStream> stream(
       ScannerStream::For(isolate, source));
@@ -38,7 +38,7 @@ bool ParseProgram(ParseInfo* info, Isolate* isolate,
   // Ok to use Isolate here; this function is only called in the main thread.
   DCHECK(parser.parsing_on_main_thread_);
 
-  result = parser.ParseProgram(isolate, info);
+  result = parser.ParseProgram(isolate, script, info);
   info->set_literal(result);
   if (result) {
     info->set_language_mode(info->literal()->language_mode());
@@ -49,10 +49,10 @@ bool ParseProgram(ParseInfo* info, Isolate* isolate,
 
   if (mode == ReportErrorsAndStatisticsMode::kYes) {
     if (result == nullptr) {
-      info->pending_error_handler()->ReportErrors(isolate, info->script(),
+      info->pending_error_handler()->ReportErrors(isolate, script,
                                                   info->ast_value_factory());
     }
-    parser.UpdateStatistics(isolate, info->script());
+    parser.UpdateStatistics(isolate, script);
   }
   return (result != nullptr);
 }
@@ -64,7 +64,8 @@ bool ParseFunction(ParseInfo* info, Handle<SharedFunctionInfo> shared_info,
   DCHECK_NULL(info->literal());
 
   // Create a character stream for the parser.
-  Handle<String> source(String::cast(info->script()->source()), isolate);
+  Handle<Script> script(Script::cast(shared_info->script()), isolate);
+  Handle<String> source(String::cast(script->source()), isolate);
   isolate->counters()->total_parse_size()->Increment(source->length());
   std::unique_ptr<Utf16CharacterStream> stream(
       ScannerStream::For(isolate, source, shared_info->StartPosition(),
@@ -82,7 +83,7 @@ bool ParseFunction(ParseInfo* info, Handle<SharedFunctionInfo> shared_info,
   result = parser.ParseFunction(isolate, info, shared_info);
   info->set_literal(result);
   if (result) {
-    info->ast_value_factory()->Internalize(isolate);
+    info->ast_value_factory()->Internalize(isolate->factory());
     if (info->is_eval()) {
       info->set_allow_eval_cache(parser.allow_eval_cache());
     }
@@ -90,10 +91,10 @@ bool ParseFunction(ParseInfo* info, Handle<SharedFunctionInfo> shared_info,
 
   if (mode == ReportErrorsAndStatisticsMode::kYes) {
     if (result == nullptr) {
-      info->pending_error_handler()->ReportErrors(isolate, info->script(),
+      info->pending_error_handler()->ReportErrors(isolate, script,
                                                   info->ast_value_factory());
     }
-    parser.UpdateStatistics(isolate, info->script());
+    parser.UpdateStatistics(isolate, script);
   }
   return (result != nullptr);
 }
@@ -101,8 +102,11 @@ bool ParseFunction(ParseInfo* info, Handle<SharedFunctionInfo> shared_info,
 bool ParseAny(ParseInfo* info, Handle<SharedFunctionInfo> shared_info,
               Isolate* isolate, ReportErrorsAndStatisticsMode mode) {
   DCHECK(!shared_info.is_null());
-  return info->is_toplevel() ? ParseProgram(info, isolate, mode)
-                             : ParseFunction(info, shared_info, isolate, mode);
+  return info->is_toplevel()
+             ? ParseProgram(
+                   info, handle(Script::cast(shared_info->script()), isolate),
+                   isolate, mode)
+             : ParseFunction(info, shared_info, isolate, mode);
 }
 
 }  // namespace parsing
diff --git a/deps/v8/src/parsing/parsing.h b/deps/v8/src/parsing/parsing.h
index bdf309d60b27c0..9bce504c1ea7ea 100644
--- a/deps/v8/src/parsing/parsing.h
+++ b/deps/v8/src/parsing/parsing.h
@@ -21,7 +21,7 @@ enum class ReportErrorsAndStatisticsMode { kYes, kNo };
 // function literal.  Returns false (and deallocates any allocated AST
 // nodes) if parsing failed.
 V8_EXPORT_PRIVATE bool ParseProgram(
-    ParseInfo* info, Isolate* isolate,
+    ParseInfo* info, Handle<Script> script, Isolate* isolate,
     ReportErrorsAndStatisticsMode mode = ReportErrorsAndStatisticsMode::kYes);
 
 // Like ParseProgram but for an individual function which already has a
diff --git a/deps/v8/src/parsing/pending-compilation-error-handler.cc b/deps/v8/src/parsing/pending-compilation-error-handler.cc
index d792d5c184dd69..ce514235a05030 100644
--- a/deps/v8/src/parsing/pending-compilation-error-handler.cc
+++ b/deps/v8/src/parsing/pending-compilation-error-handler.cc
@@ -16,7 +16,7 @@ namespace internal {
 
 Handle<String> PendingCompilationErrorHandler::MessageDetails::ArgumentString(
     Isolate* isolate) const {
-  if (arg_ != nullptr) return arg_->string();
+  if (arg_ != nullptr) return arg_->string().get<Factory>();
   if (char_arg_ != nullptr) {
     return isolate->factory()
         ->NewStringFromUtf8(CStrVector(char_arg_))
@@ -83,7 +83,7 @@ void PendingCompilationErrorHandler::ReportErrors(
   } else {
     DCHECK(has_pending_error());
     // Internalize ast values for throwing the pending error.
-    ast_value_factory->Internalize(isolate);
+    ast_value_factory->Internalize(isolate->factory());
     ThrowPendingError(isolate, script);
   }
 }
@@ -97,37 +97,9 @@ void PendingCompilationErrorHandler::ThrowPendingError(Isolate* isolate,
   isolate->debug()->OnCompileError(script);
 
   Factory* factory = isolate->factory();
-  Handle<Object> error =
+  Handle<JSObject> error =
       factory->NewSyntaxError(error_details_.message(), argument);
-
-  if (!error->IsJSObject()) {
-    isolate->Throw(*error, &location);
-    return;
-  }
-
-  Handle<JSObject> jserror = Handle<JSObject>::cast(error);
-
-  Handle<Name> key_start_pos = factory->error_start_pos_symbol();
-  Object::SetProperty(isolate, jserror, key_start_pos,
-                      handle(Smi::FromInt(location.start_pos()), isolate),
-                      StoreOrigin::kMaybeKeyed,
-                      Just(ShouldThrow::kThrowOnError))
-      .Check();
-
-  Handle<Name> key_end_pos = factory->error_end_pos_symbol();
-  Object::SetProperty(isolate, jserror, key_end_pos,
-                      handle(Smi::FromInt(location.end_pos()), isolate),
-                      StoreOrigin::kMaybeKeyed,
-                      Just(ShouldThrow::kThrowOnError))
-      .Check();
-
-  Handle<Name> key_script = factory->error_script_symbol();
-  Object::SetProperty(isolate, jserror, key_script, script,
-                      StoreOrigin::kMaybeKeyed,
-                      Just(ShouldThrow::kThrowOnError))
-      .Check();
-
-  isolate->Throw(*error, &location);
+  isolate->ThrowAt(error, &location);
 }
 
 Handle<String> PendingCompilationErrorHandler::FormatErrorMessageForTest(
diff --git a/deps/v8/src/parsing/preparse-data.cc b/deps/v8/src/parsing/preparse-data.cc
index 460ae65a306c0b..53c6256a5fb409 100644
--- a/deps/v8/src/parsing/preparse-data.cc
+++ b/deps/v8/src/parsing/preparse-data.cc
@@ -21,22 +21,21 @@ namespace internal {
 
 namespace {
 
-using ScopeSloppyEvalCanExtendVarsField = BitField8<bool, 0, 1>;
-using InnerScopeCallsEvalField =
-    ScopeSloppyEvalCanExtendVarsField::Next<bool, 1>;
+using ScopeSloppyEvalCanExtendVarsBit = base::BitField8<bool, 0, 1>;
+using InnerScopeCallsEvalField = ScopeSloppyEvalCanExtendVarsBit::Next<bool, 1>;
 using NeedsPrivateNameContextChainRecalcField =
     InnerScopeCallsEvalField::Next<bool, 1>;
 using ShouldSaveClassVariableIndexField =
     NeedsPrivateNameContextChainRecalcField::Next<bool, 1>;
 
-using VariableMaybeAssignedField = BitField8<bool, 0, 1>;
+using VariableMaybeAssignedField = base::BitField8<bool, 0, 1>;
 using VariableContextAllocatedField = VariableMaybeAssignedField::Next<bool, 1>;
 
-using HasDataField = BitField<bool, 0, 1>;
+using HasDataField = base::BitField<bool, 0, 1>;
 using LengthEqualsParametersField = HasDataField::Next<bool, 1>;
 using NumberOfParametersField = LengthEqualsParametersField::Next<uint16_t, 16>;
 
-using LanguageField = BitField8<LanguageMode, 0, 1>;
+using LanguageField = base::BitField8<LanguageMode, 0, 1>;
 using UsesSuperField = LanguageField::Next<bool, 1>;
 STATIC_ASSERT(LanguageModeSize <= LanguageField::kNumValues);
 
@@ -357,7 +356,7 @@ void PreparseDataBuilder::SaveDataForScope(Scope* scope) {
 #endif
 
   uint8_t eval_and_private_recalc =
-      ScopeSloppyEvalCanExtendVarsField::encode(
+      ScopeSloppyEvalCanExtendVarsBit::encode(
           scope->is_declaration_scope() &&
           scope->AsDeclarationScope()->sloppy_eval_can_extend_vars()) |
       InnerScopeCallsEvalField::encode(scope->inner_scope_calls_eval()) |
@@ -612,7 +611,7 @@ void BaseConsumedPreparseData<Data>::RestoreDataForScope(
 
   CHECK(scope_data_->HasRemainingBytes(ByteData::kUint8Size));
   uint32_t scope_data_flags = scope_data_->ReadUint8();
-  if (ScopeSloppyEvalCanExtendVarsField::decode(scope_data_flags)) {
+  if (ScopeSloppyEvalCanExtendVarsBit::decode(scope_data_flags)) {
     scope->RecordEvalCall();
   }
   if (InnerScopeCallsEvalField::decode(scope_data_flags)) {
diff --git a/deps/v8/src/parsing/preparser.cc b/deps/v8/src/parsing/preparser.cc
index c25ed2f8dd4cb8..464e8e7b17cab7 100644
--- a/deps/v8/src/parsing/preparser.cc
+++ b/deps/v8/src/parsing/preparser.cc
@@ -6,6 +6,7 @@
 
 #include "src/base/logging.h"
 #include "src/common/globals.h"
+#include "src/logging/counters.h"
 #include "src/numbers/conversions-inl.h"
 #include "src/numbers/conversions.h"
 #include "src/parsing/parser-base.h"
@@ -69,7 +70,7 @@ PreParserIdentifier PreParser::GetIdentifier() const {
 
 PreParser::PreParseResult PreParser::PreParseProgram() {
   DCHECK_NULL(scope_);
-  DeclarationScope* scope = NewScriptScope();
+  DeclarationScope* scope = NewScriptScope(REPLMode::kNo);
 #ifdef DEBUG
   scope->set_is_being_lazily_parsed(true);
 #endif
@@ -272,11 +273,10 @@ PreParser::Expression PreParser::ParseFunctionLiteral(
   DCHECK_NE(FunctionSyntaxKind::kWrapped, function_syntax_kind);
   // Function ::
   //   '(' FormalParameterList? ')' '{' FunctionBody '}'
-  const RuntimeCallCounterId counters[2] = {
-      RuntimeCallCounterId::kPreParseBackgroundWithVariableResolution,
-      RuntimeCallCounterId::kPreParseWithVariableResolution};
-  RuntimeCallTimerScope runtime_timer(runtime_call_stats_,
-                                      counters[parsing_on_main_thread_]);
+  RuntimeCallTimerScope runtime_timer(
+      runtime_call_stats_,
+      RuntimeCallCounterId::kPreParseWithVariableResolution,
+      RuntimeCallStats::kThreadSpecific);
 
   base::ElapsedTimer timer;
   if (V8_UNLIKELY(FLAG_log_function_events)) timer.Start();
diff --git a/deps/v8/src/parsing/preparser.h b/deps/v8/src/parsing/preparser.h
index adc3d09cac153c..291abd05586136 100644
--- a/deps/v8/src/parsing/preparser.h
+++ b/deps/v8/src/parsing/preparser.h
@@ -61,7 +61,7 @@ class PreParserIdentifier {
   bool IsArguments() const { return type_ == kArgumentsIdentifier; }
   bool IsEvalOrArguments() const {
     STATIC_ASSERT(kEvalIdentifier + 1 == kArgumentsIdentifier);
-    return IsInRange(type_, kEvalIdentifier, kArgumentsIdentifier);
+    return base::IsInRange(type_, kEvalIdentifier, kArgumentsIdentifier);
   }
   bool IsConstructor() const { return type_ == kConstructorIdentifier; }
   bool IsAwait() const { return type_ == kAwaitIdentifier; }
@@ -226,8 +226,8 @@ class PreParserExpression {
 
   bool IsPattern() const {
     STATIC_ASSERT(kObjectLiteralExpression + 1 == kArrayLiteralExpression);
-    return IsInRange(TypeField::decode(code_), kObjectLiteralExpression,
-                     kArrayLiteralExpression);
+    return base::IsInRange(TypeField::decode(code_), kObjectLiteralExpression,
+                           kArrayLiteralExpression);
   }
 
   bool IsStringLiteral() const {
@@ -345,7 +345,7 @@ class PreParserExpression {
       : code_(expression_code) {}
 
   // The first three bits are for the Type.
-  using TypeField = BitField<Type, 0, 3>;
+  using TypeField = base::BitField<Type, 0, 3>;
 
   // The high order bit applies only to nodes which would inherit from the
   // Expression ASTNode --- This is by necessity, due to the fact that
diff --git a/deps/v8/src/parsing/rewriter.cc b/deps/v8/src/parsing/rewriter.cc
index 94d8c90a790d48..013ea68fac9d99 100644
--- a/deps/v8/src/parsing/rewriter.cc
+++ b/deps/v8/src/parsing/rewriter.cc
@@ -360,15 +360,10 @@ DECLARATION_NODE_LIST(DEF_VISIT)
 // Assumes code has been parsed.  Mutates the AST, so the AST should not
 // continue to be used in the case of failure.
 bool Rewriter::Rewrite(ParseInfo* info) {
-  DisallowHeapAllocation no_allocation;
-  DisallowHandleAllocation no_handles;
-  DisallowHandleDereference no_deref;
-
   RuntimeCallTimerScope runtimeTimer(
       info->runtime_call_stats(),
-      info->on_background_thread()
-          ? RuntimeCallCounterId::kCompileBackgroundRewriteReturnResult
-          : RuntimeCallCounterId::kCompileRewriteReturnResult);
+      RuntimeCallCounterId::kCompileRewriteReturnResult,
+      RuntimeCallStats::kThreadSpecific);
 
   FunctionLiteral* function = info->literal();
   DCHECK_NOT_NULL(function);
@@ -376,12 +371,22 @@ bool Rewriter::Rewrite(ParseInfo* info) {
   DCHECK_NOT_NULL(scope);
   DCHECK_EQ(scope, scope->GetClosureScope());
 
+  if (scope->is_repl_mode_scope()) return true;
   if (!(scope->is_script_scope() || scope->is_eval_scope() ||
         scope->is_module_scope())) {
     return true;
   }
 
   ZonePtrList<Statement>* body = function->body();
+  return RewriteBody(info, scope, body).has_value();
+}
+
+base::Optional<VariableProxy*> Rewriter::RewriteBody(
+    ParseInfo* info, Scope* scope, ZonePtrList<Statement>* body) {
+  DisallowHeapAllocation no_allocation;
+  DisallowHandleAllocation no_handles;
+  DisallowHandleDereference no_deref;
+
   DCHECK_IMPLIES(scope->is_module_scope(), !body->is_empty());
   if (!body->is_empty()) {
     Variable* result = scope->AsDeclarationScope()->NewTemporary(
@@ -393,17 +398,19 @@ bool Rewriter::Rewrite(ParseInfo* info) {
     DCHECK_IMPLIES(scope->is_module_scope(), processor.result_assigned());
     if (processor.result_assigned()) {
       int pos = kNoSourcePosition;
-      Expression* result_value =
+      VariableProxy* result_value =
           processor.factory()->NewVariableProxy(result, pos);
-      Statement* result_statement =
-          processor.factory()->NewReturnStatement(result_value, pos);
-      body->Add(result_statement, info->zone());
+      if (!info->is_repl_mode()) {
+        Statement* result_statement =
+            processor.factory()->NewReturnStatement(result_value, pos);
+        body->Add(result_statement, info->zone());
+      }
+      return result_value;
     }
 
-    if (processor.HasStackOverflow()) return false;
+    if (processor.HasStackOverflow()) return base::nullopt;
   }
-
-  return true;
+  return nullptr;
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/parsing/rewriter.h b/deps/v8/src/parsing/rewriter.h
index 0ec323adc291e2..e820c0e53b8b1e 100644
--- a/deps/v8/src/parsing/rewriter.h
+++ b/deps/v8/src/parsing/rewriter.h
@@ -6,6 +6,8 @@
 #define V8_PARSING_REWRITER_H_
 
 #include "src/base/macros.h"
+#include "src/base/optional.h"
+#include "src/zone/zone.h"
 
 namespace v8 {
 namespace internal {
@@ -16,6 +18,8 @@ class ParseInfo;
 class Parser;
 class DeclarationScope;
 class Scope;
+class Statement;
+class VariableProxy;
 
 class Rewriter {
  public:
@@ -26,6 +30,13 @@ class Rewriter {
   // Assumes code has been parsed and scopes have been analyzed.  Mutates the
   // AST, so the AST should not continue to be used in the case of failure.
   V8_EXPORT_PRIVATE static bool Rewrite(ParseInfo* info);
+
+  // Helper that does the actual re-writing. Extracted so REPL scripts can
+  // rewrite the body but then use the ".result" VariableProxy to resolve
+  // the async promise that is the result of running a REPL script.
+  // Returns base::nullopt in case something went wrong.
+  static base::Optional<VariableProxy*> RewriteBody(
+      ParseInfo* info, Scope* scope, ZonePtrList<Statement>* body);
 };
 
 
diff --git a/deps/v8/src/parsing/scanner-inl.h b/deps/v8/src/parsing/scanner-inl.h
index 53b53cb9981259..fc5194f263f9aa 100644
--- a/deps/v8/src/parsing/scanner-inl.h
+++ b/deps/v8/src/parsing/scanner-inl.h
@@ -8,6 +8,7 @@
 #include "src/parsing/keywords-gen.h"
 #include "src/parsing/scanner.h"
 #include "src/strings/char-predicates-inl.h"
+#include "src/utils/utils.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/src/parsing/scanner.cc b/deps/v8/src/parsing/scanner.cc
index d444719f638906..5d5fbdbab6be47 100644
--- a/deps/v8/src/parsing/scanner.cc
+++ b/deps/v8/src/parsing/scanner.cc
@@ -906,7 +906,7 @@ Token::Value Scanner::ScanIdentifierOrKeywordInnerSlow(bool escaped,
     Vector<const uint8_t> chars = next().literal_chars.one_byte_literal();
     Token::Value token =
         KeywordOrIdentifierToken(chars.begin(), chars.length());
-    if (IsInRange(token, Token::IDENTIFIER, Token::YIELD)) return token;
+    if (base::IsInRange(token, Token::IDENTIFIER, Token::YIELD)) return token;
 
     if (token == Token::FUTURE_STRICT_RESERVED_WORD) {
       if (escaped) return Token::ESCAPED_STRICT_RESERVED_WORD;
@@ -916,7 +916,7 @@ Token::Value Scanner::ScanIdentifierOrKeywordInnerSlow(bool escaped,
     if (!escaped) return token;
 
     STATIC_ASSERT(Token::LET + 1 == Token::STATIC);
-    if (IsInRange(token, Token::LET, Token::STATIC)) {
+    if (base::IsInRange(token, Token::LET, Token::STATIC)) {
       return Token::ESCAPED_STRICT_RESERVED_WORD;
     }
     return Token::ESCAPED_KEYWORD;
diff --git a/deps/v8/src/parsing/scanner.h b/deps/v8/src/parsing/scanner.h
index 871204bb55de87..2e953f6e6ac9c1 100644
--- a/deps/v8/src/parsing/scanner.h
+++ b/deps/v8/src/parsing/scanner.h
@@ -10,6 +10,7 @@
 #include <algorithm>
 #include <memory>
 
+#include "include/v8.h"
 #include "src/base/logging.h"
 #include "src/common/globals.h"
 #include "src/common/message-template.h"
@@ -256,7 +257,7 @@ class V8_EXPORT_PRIVATE Scanner {
     Location() : beg_pos(0), end_pos(0) { }
 
     int length() const { return end_pos - beg_pos; }
-    bool IsValid() const { return IsInRange(beg_pos, 0, end_pos); }
+    bool IsValid() const { return base::IsInRange(beg_pos, 0, end_pos); }
 
     static Location invalid() { return Location(-1, 0); }
 
@@ -443,13 +444,13 @@ class V8_EXPORT_PRIVATE Scanner {
       return token == Token::PRIVATE_NAME || token == Token::ILLEGAL ||
              token == Token::ESCAPED_KEYWORD || token == Token::UNINITIALIZED ||
              token == Token::REGEXP_LITERAL ||
-             IsInRange(token, Token::NUMBER, Token::STRING) ||
+             base::IsInRange(token, Token::NUMBER, Token::STRING) ||
              Token::IsAnyIdentifier(token) || Token::IsKeyword(token) ||
-             IsInRange(token, Token::TEMPLATE_SPAN, Token::TEMPLATE_TAIL);
+             base::IsInRange(token, Token::TEMPLATE_SPAN, Token::TEMPLATE_TAIL);
     }
     bool CanAccessRawLiteral() const {
       return token == Token::ILLEGAL || token == Token::UNINITIALIZED ||
-             IsInRange(token, Token::TEMPLATE_SPAN, Token::TEMPLATE_TAIL);
+             base::IsInRange(token, Token::TEMPLATE_SPAN, Token::TEMPLATE_TAIL);
     }
 #endif  // DEBUG
   };
@@ -464,11 +465,11 @@ class V8_EXPORT_PRIVATE Scanner {
   };
 
   inline bool IsValidBigIntKind(NumberKind kind) {
-    return IsInRange(kind, BINARY, DECIMAL);
+    return base::IsInRange(kind, BINARY, DECIMAL);
   }
 
   inline bool IsDecimalNumberKind(NumberKind kind) {
-    return IsInRange(kind, DECIMAL, DECIMAL_WITH_LEADING_ZERO);
+    return base::IsInRange(kind, DECIMAL, DECIMAL_WITH_LEADING_ZERO);
   }
 
   static const int kCharacterLookaheadBufferSize = 1;
diff --git a/deps/v8/src/parsing/token.h b/deps/v8/src/parsing/token.h
index 3f2e0ec870d01f..4749945ebd0cc2 100644
--- a/deps/v8/src/parsing/token.h
+++ b/deps/v8/src/parsing/token.h
@@ -5,9 +5,10 @@
 #ifndef V8_PARSING_TOKEN_H_
 #define V8_PARSING_TOKEN_H_
 
+#include "src/base/bit-field.h"
+#include "src/base/bounds.h"
 #include "src/base/logging.h"
 #include "src/common/globals.h"
-#include "src/utils/utils.h"
 
 namespace v8 {
 namespace internal {
@@ -217,7 +218,7 @@ class V8_EXPORT_PRIVATE Token {
     return name_[token];
   }
 
-  using IsKeywordBits = BitField8<bool, 0, 1>;
+  using IsKeywordBits = base::BitField8<bool, 0, 1>;
   using IsPropertyNameBits = IsKeywordBits::Next<bool, 1>;
 
   // Predicates
@@ -233,81 +234,85 @@ class V8_EXPORT_PRIVATE Token {
                                           LanguageMode language_mode,
                                           bool is_generator,
                                           bool disallow_await) {
-    if (V8_LIKELY(IsInRange(token, IDENTIFIER, ASYNC))) return true;
+    if (V8_LIKELY(base::IsInRange(token, IDENTIFIER, ASYNC))) return true;
     if (token == AWAIT) return !disallow_await;
     if (token == YIELD) return !is_generator && is_sloppy(language_mode);
     return IsStrictReservedWord(token) && is_sloppy(language_mode);
   }
 
   static bool IsCallable(Value token) {
-    return IsInRange(token, SUPER, ESCAPED_STRICT_RESERVED_WORD);
+    return base::IsInRange(token, SUPER, ESCAPED_STRICT_RESERVED_WORD);
   }
 
   static bool IsAutoSemicolon(Value token) {
-    return IsInRange(token, SEMICOLON, EOS);
+    return base::IsInRange(token, SEMICOLON, EOS);
   }
 
   static bool IsAnyIdentifier(Value token) {
-    return IsInRange(token, IDENTIFIER, ESCAPED_STRICT_RESERVED_WORD);
+    return base::IsInRange(token, IDENTIFIER, ESCAPED_STRICT_RESERVED_WORD);
   }
 
   static bool IsStrictReservedWord(Value token) {
-    return IsInRange(token, YIELD, ESCAPED_STRICT_RESERVED_WORD);
+    return base::IsInRange(token, YIELD, ESCAPED_STRICT_RESERVED_WORD);
   }
 
   static bool IsLiteral(Value token) {
-    return IsInRange(token, NULL_LITERAL, STRING);
+    return base::IsInRange(token, NULL_LITERAL, STRING);
   }
 
   static bool IsTemplate(Value token) {
-    return IsInRange(token, TEMPLATE_SPAN, TEMPLATE_TAIL);
+    return base::IsInRange(token, TEMPLATE_SPAN, TEMPLATE_TAIL);
   }
 
   static bool IsMember(Value token) {
-    return IsInRange(token, TEMPLATE_SPAN, LBRACK);
+    return base::IsInRange(token, TEMPLATE_SPAN, LBRACK);
   }
 
   static bool IsProperty(Value token) {
-    return IsInRange(token, PERIOD, LBRACK);
+    return base::IsInRange(token, PERIOD, LBRACK);
   }
 
   static bool IsPropertyOrCall(Value token) {
-    return IsInRange(token, TEMPLATE_SPAN, LPAREN);
+    return base::IsInRange(token, TEMPLATE_SPAN, LPAREN);
   }
 
   static bool IsArrowOrAssignmentOp(Value token) {
-    return IsInRange(token, ARROW, ASSIGN_SUB);
+    return base::IsInRange(token, ARROW, ASSIGN_SUB);
   }
 
   static bool IsAssignmentOp(Value token) {
-    return IsInRange(token, INIT, ASSIGN_SUB);
+    return base::IsInRange(token, INIT, ASSIGN_SUB);
   }
 
-  static bool IsBinaryOp(Value op) { return IsInRange(op, COMMA, SUB); }
+  static bool IsBinaryOp(Value op) { return base::IsInRange(op, COMMA, SUB); }
 
-  static bool IsCompareOp(Value op) { return IsInRange(op, EQ, IN); }
+  static bool IsCompareOp(Value op) { return base::IsInRange(op, EQ, IN); }
 
   static bool IsOrderedRelationalCompareOp(Value op) {
-    return IsInRange(op, LT, GTE);
+    return base::IsInRange(op, LT, GTE);
   }
 
-  static bool IsEqualityOp(Value op) { return IsInRange(op, EQ, EQ_STRICT); }
+  static bool IsEqualityOp(Value op) {
+    return base::IsInRange(op, EQ, EQ_STRICT);
+  }
 
   static Value BinaryOpForAssignment(Value op) {
-    DCHECK(IsInRange(op, ASSIGN_BIT_OR, ASSIGN_SUB));
+    DCHECK(base::IsInRange(op, ASSIGN_BIT_OR, ASSIGN_SUB));
     Value result = static_cast<Value>(op - ASSIGN_BIT_OR + BIT_OR);
     DCHECK(IsBinaryOp(result));
     return result;
   }
 
   static bool IsBitOp(Value op) {
-    return IsInRange(op, BIT_OR, SHR) || op == BIT_NOT;
+    return base::IsInRange(op, BIT_OR, SHR) || op == BIT_NOT;
   }
 
-  static bool IsUnaryOp(Value op) { return IsInRange(op, ADD, VOID); }
-  static bool IsCountOp(Value op) { return IsInRange(op, INC, DEC); }
-  static bool IsUnaryOrCountOp(Value op) { return IsInRange(op, ADD, DEC); }
-  static bool IsShiftOp(Value op) { return IsInRange(op, SHL, SHR); }
+  static bool IsUnaryOp(Value op) { return base::IsInRange(op, ADD, VOID); }
+  static bool IsCountOp(Value op) { return base::IsInRange(op, INC, DEC); }
+  static bool IsUnaryOrCountOp(Value op) {
+    return base::IsInRange(op, ADD, DEC);
+  }
+  static bool IsShiftOp(Value op) { return base::IsInRange(op, SHL, SHR); }
 
   // Returns a string corresponding to the JS token string
   // (.e., "<" for the token LT) or nullptr if the token doesn't
diff --git a/deps/v8/src/profiler/OWNERS b/deps/v8/src/profiler/OWNERS
index 7ab7c063dab990..001abef49d46cf 100644
--- a/deps/v8/src/profiler/OWNERS
+++ b/deps/v8/src/profiler/OWNERS
@@ -1,4 +1,6 @@
 alph@chromium.org
 petermarshall@chromium.org
 
+per-file *heap*=ulan@chromium.org
+
 # COMPONENT: Platform>DevTools>JavaScript
diff --git a/deps/v8/src/profiler/heap-profiler.cc b/deps/v8/src/profiler/heap-profiler.cc
index a498e8e21432b8..c5fcdcd71321de 100644
--- a/deps/v8/src/profiler/heap-profiler.cc
+++ b/deps/v8/src/profiler/heap-profiler.cc
@@ -64,8 +64,9 @@ void HeapProfiler::BuildEmbedderGraph(Isolate* isolate,
 
 HeapSnapshot* HeapProfiler::TakeSnapshot(
     v8::ActivityControl* control,
-    v8::HeapProfiler::ObjectNameResolver* resolver) {
-  HeapSnapshot* result = new HeapSnapshot(this);
+    v8::HeapProfiler::ObjectNameResolver* resolver,
+    bool treat_global_objects_as_roots) {
+  HeapSnapshot* result = new HeapSnapshot(this, treat_global_objects_as_roots);
   {
     HeapSnapshotGenerator generator(result, control, resolver, heap());
     if (!generator.GenerateSnapshot()) {
diff --git a/deps/v8/src/profiler/heap-profiler.h b/deps/v8/src/profiler/heap-profiler.h
index f7336eb6be50c8..0d964b5c5d606a 100644
--- a/deps/v8/src/profiler/heap-profiler.h
+++ b/deps/v8/src/profiler/heap-profiler.h
@@ -29,9 +29,9 @@ class HeapProfiler : public HeapObjectAllocationTracker {
   explicit HeapProfiler(Heap* heap);
   ~HeapProfiler() override;
 
-  HeapSnapshot* TakeSnapshot(
-      v8::ActivityControl* control,
-      v8::HeapProfiler::ObjectNameResolver* resolver);
+  HeapSnapshot* TakeSnapshot(v8::ActivityControl* control,
+                             v8::HeapProfiler::ObjectNameResolver* resolver,
+                             bool treat_global_objects_as_roots);
 
   bool StartSamplingHeapProfiler(uint64_t sample_interval, int stack_depth,
                                  v8::HeapProfiler::SamplingFlags);
diff --git a/deps/v8/src/profiler/heap-snapshot-generator.cc b/deps/v8/src/profiler/heap-snapshot-generator.cc
index 42e72207020764..c4f2777e14ec9e 100644
--- a/deps/v8/src/profiler/heap-snapshot-generator.cc
+++ b/deps/v8/src/profiler/heap-snapshot-generator.cc
@@ -181,7 +181,9 @@ const char* HeapEntry::TypeAsString() {
   }
 }
 
-HeapSnapshot::HeapSnapshot(HeapProfiler* profiler) : profiler_(profiler) {
+HeapSnapshot::HeapSnapshot(HeapProfiler* profiler, bool global_objects_as_roots)
+    : profiler_(profiler),
+      treat_global_objects_as_roots_(global_objects_as_roots) {
   // It is very important to keep objects that form a heap snapshot
   // as small as possible. Check assumptions about data structure sizes.
   STATIC_ASSERT((kSystemPointerSize == 4 && sizeof(HeapGraphEdge) == 12) ||
@@ -878,7 +880,7 @@ void V8HeapExplorer::ExtractJSObjectReferences(HeapEntry* entry,
                          JSGlobalObject::kNativeContextOffset);
     SetInternalReference(entry, "global_proxy", global_obj.global_proxy(),
                          JSGlobalObject::kGlobalProxyOffset);
-    STATIC_ASSERT(JSGlobalObject::kSize - JSObject::kHeaderSize ==
+    STATIC_ASSERT(JSGlobalObject::kHeaderSize - JSObject::kHeaderSize ==
                   2 * kTaggedSize);
   } else if (obj.IsJSArrayBufferView()) {
     JSArrayBufferView view = JSArrayBufferView::cast(obj);
@@ -913,7 +915,8 @@ void V8HeapExplorer::ExtractStringReferences(HeapEntry* entry, String string) {
 }
 
 void V8HeapExplorer::ExtractSymbolReferences(HeapEntry* entry, Symbol symbol) {
-  SetInternalReference(entry, "name", symbol.name(), Symbol::kNameOffset);
+  SetInternalReference(entry, "name", symbol.description(),
+                       Symbol::kDescriptionOffset);
 }
 
 void V8HeapExplorer::ExtractJSCollectionReferences(HeapEntry* entry,
@@ -930,7 +933,7 @@ void V8HeapExplorer::ExtractJSWeakCollectionReferences(HeapEntry* entry,
 
 void V8HeapExplorer::ExtractEphemeronHashTableReferences(
     HeapEntry* entry, EphemeronHashTable table) {
-  for (int i = 0, capacity = table.Capacity(); i < capacity; ++i) {
+  for (InternalIndex i : table.IterateEntries()) {
     int key_index = EphemeronHashTable::EntryToIndex(i) +
                     EphemeronHashTable::kEntryKeyIndex;
     int value_index = EphemeronHashTable::EntryToValueIndex(i);
@@ -941,11 +944,16 @@ void V8HeapExplorer::ExtractEphemeronHashTableReferences(
                      table.OffsetOfElementAt(value_index));
     HeapEntry* key_entry = GetEntry(key);
     HeapEntry* value_entry = GetEntry(value);
-    if (key_entry && value_entry) {
-      const char* edge_name =
-          names_->GetFormatted("key %s in WeakMap", key_entry->name());
+    HeapEntry* table_entry = GetEntry(table);
+    if (key_entry && value_entry && !key.IsUndefined()) {
+      const char* edge_name = names_->GetFormatted(
+          "part of key (%s @%u) -> value (%s @%u) pair in WeakMap (table @%u)",
+          key_entry->name(), key_entry->id(), value_entry->name(),
+          value_entry->id(), table_entry->id());
       key_entry->SetNamedAutoIndexReference(HeapGraphEdge::kInternal, edge_name,
                                             value_entry, names_);
+      table_entry->SetNamedAutoIndexReference(HeapGraphEdge::kInternal,
+                                              edge_name, value_entry, names_);
     }
   }
 }
@@ -989,12 +997,11 @@ void V8HeapExplorer::ExtractContextReferences(HeapEntry* entry,
       FixedArray::OffsetOfElementAt(Context::SCOPE_INFO_INDEX));
   SetInternalReference(entry, "previous", context.get(Context::PREVIOUS_INDEX),
                        FixedArray::OffsetOfElementAt(Context::PREVIOUS_INDEX));
-  SetInternalReference(entry, "extension",
-                       context.get(Context::EXTENSION_INDEX),
-                       FixedArray::OffsetOfElementAt(Context::EXTENSION_INDEX));
-  SetInternalReference(
-      entry, "native_context", context.get(Context::NATIVE_CONTEXT_INDEX),
-      FixedArray::OffsetOfElementAt(Context::NATIVE_CONTEXT_INDEX));
+  if (context.has_extension()) {
+    SetInternalReference(
+        entry, "extension", context.get(Context::EXTENSION_INDEX),
+        FixedArray::OffsetOfElementAt(Context::EXTENSION_INDEX));
+  }
 
   if (context.IsNativeContext()) {
     TagObject(context.normalized_map_cache(), "(context norm. map cache)");
@@ -1041,8 +1048,7 @@ void V8HeapExplorer::ExtractMapReferences(HeapEntry* entry, Map map) {
       TagObject(transitions, "(transition array)");
       SetInternalReference(entry, "transitions", transitions,
                            Map::kTransitionsOrPrototypeInfoOffset);
-    } else if (raw_transitions_or_prototype_info.IsTuple3() ||
-               raw_transitions_or_prototype_info.IsFixedArray()) {
+    } else if (raw_transitions_or_prototype_info.IsFixedArray()) {
       TagObject(raw_transitions_or_prototype_info, "(transition)");
       SetInternalReference(entry, "transition",
                            raw_transitions_or_prototype_info,
@@ -1064,19 +1070,26 @@ void V8HeapExplorer::ExtractMapReferences(HeapEntry* entry, Map map) {
     SetInternalReference(entry, "layout_descriptor", map.layout_descriptor(),
                          Map::kLayoutDescriptorOffset);
   }
-  Object constructor_or_backpointer = map.constructor_or_backpointer();
-  if (constructor_or_backpointer.IsMap()) {
-    TagObject(constructor_or_backpointer, "(back pointer)");
-    SetInternalReference(entry, "back_pointer", constructor_or_backpointer,
-                         Map::kConstructorOrBackPointerOffset);
-  } else if (constructor_or_backpointer.IsFunctionTemplateInfo()) {
-    TagObject(constructor_or_backpointer, "(constructor function data)");
-    SetInternalReference(entry, "constructor_function_data",
-                         constructor_or_backpointer,
-                         Map::kConstructorOrBackPointerOffset);
+  if (map.IsContextMap()) {
+    Object native_context = map.native_context();
+    TagObject(native_context, "(native context)");
+    SetInternalReference(entry, "native_context", native_context,
+                         Map::kConstructorOrBackPointerOrNativeContextOffset);
   } else {
-    SetInternalReference(entry, "constructor", constructor_or_backpointer,
-                         Map::kConstructorOrBackPointerOffset);
+    Object constructor_or_backpointer = map.constructor_or_backpointer();
+    if (constructor_or_backpointer.IsMap()) {
+      TagObject(constructor_or_backpointer, "(back pointer)");
+      SetInternalReference(entry, "back_pointer", constructor_or_backpointer,
+                           Map::kConstructorOrBackPointerOrNativeContextOffset);
+    } else if (constructor_or_backpointer.IsFunctionTemplateInfo()) {
+      TagObject(constructor_or_backpointer, "(constructor function data)");
+      SetInternalReference(entry, "constructor_function_data",
+                           constructor_or_backpointer,
+                           Map::kConstructorOrBackPointerOrNativeContextOffset);
+    } else {
+      SetInternalReference(entry, "constructor", constructor_or_backpointer,
+                           Map::kConstructorOrBackPointerOrNativeContextOffset);
+    }
   }
   TagObject(map.dependent_code(), "(dependent code)");
   SetInternalReference(entry, "dependent_code", map.dependent_code(),
@@ -1333,9 +1346,8 @@ void V8HeapExplorer::ExtractPropertyReferences(JSObject js_obj,
     // We assume that global objects can only have slow properties.
     GlobalDictionary dictionary =
         JSGlobalObject::cast(js_obj).global_dictionary();
-    int length = dictionary.Capacity();
     ReadOnlyRoots roots(isolate);
-    for (int i = 0; i < length; ++i) {
+    for (InternalIndex i : dictionary.IterateEntries()) {
       if (!dictionary.IsKey(roots, dictionary.KeyAt(i))) continue;
       PropertyCell cell = dictionary.CellAt(i);
       Name name = cell.name();
@@ -1345,9 +1357,8 @@ void V8HeapExplorer::ExtractPropertyReferences(JSObject js_obj,
     }
   } else {
     NameDictionary dictionary = js_obj.property_dictionary();
-    int length = dictionary.Capacity();
     ReadOnlyRoots roots(isolate);
-    for (int i = 0; i < length; ++i) {
+    for (InternalIndex i : dictionary.IterateEntries()) {
       Object k = dictionary.KeyAt(i);
       if (!dictionary.IsKey(roots, k)) continue;
       Object value = dictionary.ValueAt(i);
@@ -1388,8 +1399,7 @@ void V8HeapExplorer::ExtractElementReferences(JSObject js_obj,
     }
   } else if (js_obj.HasDictionaryElements()) {
     NumberDictionary dictionary = js_obj.element_dictionary();
-    int length = dictionary.Capacity();
-    for (int i = 0; i < length; ++i) {
+    for (InternalIndex i : dictionary.IterateEntries()) {
       Object k = dictionary.KeyAt(i);
       if (!dictionary.IsKey(roots, k)) continue;
       DCHECK(k.IsNumber());
@@ -1711,7 +1721,7 @@ void V8HeapExplorer::SetGcSubrootReference(Root root, const char* description,
 
   // For full heap snapshots we do not emit user roots but rather rely on
   // regular GC roots to retain objects.
-  if (FLAG_raw_heap_snapshots) return;
+  if (!snapshot_->treat_global_objects_as_roots()) return;
 
   // Add a shortcut to JS global object reference at snapshot root.
   // That allows the user to easily find global objects. They are
diff --git a/deps/v8/src/profiler/heap-snapshot-generator.h b/deps/v8/src/profiler/heap-snapshot-generator.h
index e6c72ffcf99cae..f17d3f9ed6f3b9 100644
--- a/deps/v8/src/profiler/heap-snapshot-generator.h
+++ b/deps/v8/src/profiler/heap-snapshot-generator.h
@@ -83,8 +83,8 @@ class HeapGraphEdge {
   V8_INLINE HeapSnapshot* snapshot() const;
   int from_index() const { return FromIndexField::decode(bit_field_); }
 
-  using TypeField = BitField<Type, 0, 3>;
-  using FromIndexField = BitField<int, 3, 29>;
+  using TypeField = base::BitField<Type, 0, 3>;
+  using FromIndexField = base::BitField<int, 3, 29>;
   uint32_t bit_field_;
   HeapEntry* to_entry_;
   union {
@@ -176,7 +176,7 @@ class HeapEntry {
 // HeapSnapshotGenerator fills in a HeapSnapshot.
 class HeapSnapshot {
  public:
-  explicit HeapSnapshot(HeapProfiler* profiler);
+  explicit HeapSnapshot(HeapProfiler* profiler, bool global_objects_as_roots);
   void Delete();
 
   HeapProfiler* profiler() const { return profiler_; }
@@ -194,6 +194,9 @@ class HeapSnapshot {
     return max_snapshot_js_object_id_;
   }
   bool is_complete() const { return !children_.empty(); }
+  bool treat_global_objects_as_roots() const {
+    return treat_global_objects_as_roots_;
+  }
 
   void AddLocation(HeapEntry* entry, int scriptId, int line, int col);
   HeapEntry* AddEntry(HeapEntry::Type type,
@@ -225,6 +228,7 @@ class HeapSnapshot {
   std::unordered_map<SnapshotObjectId, HeapEntry*> entries_by_id_cache_;
   std::vector<SourceLocation> locations_;
   SnapshotObjectId max_snapshot_js_object_id_ = -1;
+  bool treat_global_objects_as_roots_;
 
   DISALLOW_COPY_AND_ASSIGN(HeapSnapshot);
 };
diff --git a/deps/v8/src/profiler/profile-generator-inl.h b/deps/v8/src/profiler/profile-generator-inl.h
index e3dc193db2736c..9a8fd20448e208 100644
--- a/deps/v8/src/profiler/profile-generator-inl.h
+++ b/deps/v8/src/profiler/profile-generator-inl.h
@@ -46,10 +46,6 @@ ProfileNode::ProfileNode(ProfileTree* tree, CodeEntry* entry,
   tree_->EnqueueNode(this);
 }
 
-inline unsigned ProfileNode::function_id() const {
-  return tree_->GetFunctionId(this);
-}
-
 inline CpuProfileNode::SourceType ProfileNode::source_type() const {
   // Handle metadata and VM state code entry types.
   if (entry_ == CodeEntry::program_entry() ||
diff --git a/deps/v8/src/profiler/profile-generator.cc b/deps/v8/src/profiler/profile-generator.cc
index c8fe890b583d4e..11821035d5ce01 100644
--- a/deps/v8/src/profiler/profile-generator.cc
+++ b/deps/v8/src/profiler/profile-generator.cc
@@ -324,8 +324,7 @@ bool ProfileNode::GetLineTicks(v8::CpuProfileNode::LineTick* entries,
   return true;
 }
 
-
-void ProfileNode::Print(int indent) {
+void ProfileNode::Print(int indent) const {
   int line_number = line_number_ != 0 ? line_number_ : entry_->line_number();
   base::OS::Print("%5u %*s %s:%d %d %d #%d", self_ticks_, indent, "",
                   entry_->name(), line_number, source_type(),
@@ -334,7 +333,7 @@ void ProfileNode::Print(int indent) {
     base::OS::Print(" %s:%d", entry_->resource_name(), entry_->line_number());
   base::OS::Print("\n");
   for (size_t i = 0; i < deopt_infos_.size(); ++i) {
-    CpuProfileDeoptInfo& info = deopt_infos_[i];
+    const CpuProfileDeoptInfo& info = deopt_infos_[i];
     base::OS::Print(
         "%*s;;; deopted at script_id: %d position: %zu with reason '%s'.\n",
         indent + 10, "", info.stack[0].script_id, info.stack[0].position,
@@ -356,7 +355,6 @@ void ProfileNode::Print(int indent) {
   }
 }
 
-
 class DeleteNodesCallback {
  public:
   void BeforeTraversingChild(ProfileNode*, ProfileNode*) { }
@@ -371,24 +369,13 @@ class DeleteNodesCallback {
 ProfileTree::ProfileTree(Isolate* isolate)
     : next_node_id_(1),
       root_(new ProfileNode(this, CodeEntry::root_entry(), nullptr)),
-      isolate_(isolate),
-      next_function_id_(1) {}
+      isolate_(isolate) {}
 
 ProfileTree::~ProfileTree() {
   DeleteNodesCallback cb;
   TraverseDepthFirst(&cb);
 }
 
-
-unsigned ProfileTree::GetFunctionId(const ProfileNode* node) {
-  CodeEntry* code_entry = node->entry();
-  auto map_entry = function_ids_.find(code_entry);
-  if (map_entry == function_ids_.end()) {
-    return function_ids_[code_entry] = next_function_id_++;
-  }
-  return function_ids_[code_entry];
-}
-
 ProfileNode* ProfileTree::AddPathFromEnd(const std::vector<CodeEntry*>& path,
                                          int src_line, bool update_stats) {
   ProfileNode* node = root_;
@@ -508,8 +495,7 @@ CpuProfile::CpuProfile(CpuProfiler* profiler, const char* title,
       streaming_next_sample_(0),
       id_(++last_id_) {
   auto value = TracedValue::Create();
-  value->SetDouble("startTime",
-                   (start_time_ - base::TimeTicks()).InMicroseconds());
+  value->SetDouble("startTime", start_time_.since_origin().InMicroseconds());
   TRACE_EVENT_SAMPLE_WITH_ID1(TRACE_DISABLED_BY_DEFAULT("v8.cpu_profiler"),
                               "Profile", id_, "data", std::move(value));
 
@@ -650,7 +636,7 @@ void CpuProfile::FinishProfile() {
   context_filter_ = nullptr;
   StreamPendingTraceEvents();
   auto value = TracedValue::Create();
-  value->SetDouble("endTime", (end_time_ - base::TimeTicks()).InMicroseconds());
+  value->SetDouble("endTime", end_time_.since_origin().InMicroseconds());
   TRACE_EVENT_SAMPLE_WITH_ID1(TRACE_DISABLED_BY_DEFAULT("v8.cpu_profiler"),
                               "ProfileChunk", id_, "data", std::move(value));
 }
diff --git a/deps/v8/src/profiler/profile-generator.h b/deps/v8/src/profiler/profile-generator.h
index 2f7273a08626fc..38e31c5596b3c9 100644
--- a/deps/v8/src/profiler/profile-generator.h
+++ b/deps/v8/src/profiler/profile-generator.h
@@ -208,12 +208,12 @@ class CodeEntry {
   V8_EXPORT_PRIVATE static base::LazyDynamicInstance<
       CodeEntry, RootEntryCreateTrait>::type kRootEntry;
 
-  using TagField = BitField<CodeEventListener::LogEventsAndTags, 0, 8>;
-  using BuiltinIdField = BitField<Builtins::Name, 8, 22>;
+  using TagField = base::BitField<CodeEventListener::LogEventsAndTags, 0, 8>;
+  using BuiltinIdField = base::BitField<Builtins::Name, 8, 22>;
   static_assert(Builtins::builtin_count <= BuiltinIdField::kNumValues,
                 "builtin_count exceeds size of bitfield");
-  using UsedField = BitField<bool, 30, 1>;
-  using SharedCrossOriginField = BitField<bool, 31, 1>;
+  using UsedField = base::BitField<bool, 30, 1>;
+  using SharedCrossOriginField = base::BitField<bool, 31, 1>;
 
   uint32_t bit_field_;
   const char* name_;
@@ -284,7 +284,6 @@ class V8_EXPORT_PRIVATE ProfileNode {
   unsigned self_ticks() const { return self_ticks_; }
   const std::vector<ProfileNode*>* children() const { return &children_list_; }
   unsigned id() const { return id_; }
-  unsigned function_id() const;
   ProfileNode* parent() const { return parent_; }
   int line_number() const {
     return line_number_ != 0 ? line_number_ : entry_->line_number();
@@ -302,7 +301,7 @@ class V8_EXPORT_PRIVATE ProfileNode {
   }
   Isolate* isolate() const;
 
-  void Print(int indent);
+  void Print(int indent) const;
 
  private:
   struct Equals {
@@ -354,7 +353,6 @@ class V8_EXPORT_PRIVATE ProfileTree {
       ContextFilter* context_filter = nullptr);
   ProfileNode* root() const { return root_; }
   unsigned next_node_id() { return next_node_id_++; }
-  unsigned GetFunctionId(const ProfileNode* node);
 
   void Print() {
     root_->Print(0);
@@ -378,9 +376,6 @@ class V8_EXPORT_PRIVATE ProfileTree {
   ProfileNode* root_;
   Isolate* isolate_;
 
-  unsigned next_function_id_;
-  std::unordered_map<CodeEntry*, unsigned> function_ids_;
-
   DISALLOW_COPY_AND_ASSIGN(ProfileTree);
 };
 
diff --git a/deps/v8/src/profiler/profiler-listener.cc b/deps/v8/src/profiler/profiler-listener.cc
index 13641bfd41f4bd..29eea0f4ca4804 100644
--- a/deps/v8/src/profiler/profiler-listener.cc
+++ b/deps/v8/src/profiler/profiler-listener.cc
@@ -4,6 +4,8 @@
 
 #include "src/profiler/profiler-listener.h"
 
+#include <algorithm>
+
 #include "src/codegen/reloc-info.h"
 #include "src/codegen/source-position-table.h"
 #include "src/deoptimizer/deoptimizer.h"
@@ -15,6 +17,7 @@
 #include "src/objects/string-inl.h"
 #include "src/profiler/cpu-profiler.h"
 #include "src/profiler/profile-generator-inl.h"
+#include "src/utils/vector.h"
 #include "src/wasm/wasm-code-manager.h"
 
 namespace v8 {
@@ -27,56 +30,49 @@ ProfilerListener::ProfilerListener(Isolate* isolate,
 
 ProfilerListener::~ProfilerListener() = default;
 
-void ProfilerListener::CallbackEvent(Name name, Address entry_point) {
+void ProfilerListener::CodeCreateEvent(LogEventsAndTags tag,
+                                       Handle<AbstractCode> code,
+                                       const char* name) {
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
-  rec->instruction_start = entry_point;
-  rec->entry = new CodeEntry(CodeEventListener::CALLBACK_TAG, GetName(name));
-  rec->instruction_size = 1;
-  DispatchCodeEvent(evt_rec);
-}
-
-void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                                       AbstractCode code, const char* name) {
-  CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
-  CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
-  rec->instruction_start = code.InstructionStart();
+  rec->instruction_start = code->InstructionStart();
   rec->entry = new CodeEntry(tag, GetName(name), CodeEntry::kEmptyResourceName,
                              CpuProfileNode::kNoLineNumberInfo,
                              CpuProfileNode::kNoColumnNumberInfo, nullptr,
-                             code.InstructionStart());
-  rec->instruction_size = code.InstructionSize();
+                             code->InstructionStart());
+  rec->instruction_size = code->InstructionSize();
   DispatchCodeEvent(evt_rec);
 }
 
-void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                                       AbstractCode code, Name name) {
+void ProfilerListener::CodeCreateEvent(LogEventsAndTags tag,
+                                       Handle<AbstractCode> code,
+                                       Handle<Name> name) {
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
-  rec->instruction_start = code.InstructionStart();
-  rec->entry = new CodeEntry(tag, GetName(name), CodeEntry::kEmptyResourceName,
+  rec->instruction_start = code->InstructionStart();
+  rec->entry = new CodeEntry(tag, GetName(*name), CodeEntry::kEmptyResourceName,
                              CpuProfileNode::kNoLineNumberInfo,
                              CpuProfileNode::kNoColumnNumberInfo, nullptr,
-                             code.InstructionStart());
-  rec->instruction_size = code.InstructionSize();
+                             code->InstructionStart());
+  rec->instruction_size = code->InstructionSize();
   DispatchCodeEvent(evt_rec);
 }
 
-void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                                       AbstractCode code,
-                                       SharedFunctionInfo shared,
-                                       Name script_name) {
+void ProfilerListener::CodeCreateEvent(LogEventsAndTags tag,
+                                       Handle<AbstractCode> code,
+                                       Handle<SharedFunctionInfo> shared,
+                                       Handle<Name> script_name) {
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
-  rec->instruction_start = code.InstructionStart();
-  rec->entry = new CodeEntry(tag, GetName(shared.DebugName()),
-                             GetName(InferScriptName(script_name, shared)),
+  rec->instruction_start = code->InstructionStart();
+  rec->entry = new CodeEntry(tag, GetName(shared->DebugName()),
+                             GetName(InferScriptName(*script_name, *shared)),
                              CpuProfileNode::kNoLineNumberInfo,
                              CpuProfileNode::kNoColumnNumberInfo, nullptr,
-                             code.InstructionStart());
-  DCHECK(!code.IsCode());
-  rec->entry->FillFunctionInfo(shared);
-  rec->instruction_size = code.InstructionSize();
+                             code->InstructionStart());
+  DCHECK(!code->IsCode());
+  rec->entry->FillFunctionInfo(*shared);
+  rec->instruction_size = code->InstructionSize();
   DispatchCodeEvent(evt_rec);
 }
 
@@ -95,44 +91,44 @@ CodeEntry* GetOrInsertCachedEntry(
 
 }  // namespace
 
-void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                                       AbstractCode abstract_code,
-                                       SharedFunctionInfo shared,
-                                       Name script_name, int line, int column) {
+void ProfilerListener::CodeCreateEvent(LogEventsAndTags tag,
+                                       Handle<AbstractCode> abstract_code,
+                                       Handle<SharedFunctionInfo> shared,
+                                       Handle<Name> script_name, int line,
+                                       int column) {
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
-  rec->instruction_start = abstract_code.InstructionStart();
+  rec->instruction_start = abstract_code->InstructionStart();
   std::unique_ptr<SourcePositionTable> line_table;
   std::unordered_map<int, std::vector<CodeEntryAndLineNumber>> inline_stacks;
   std::unordered_set<std::unique_ptr<CodeEntry>, CodeEntry::Hasher,
                      CodeEntry::Equals>
       cached_inline_entries;
   bool is_shared_cross_origin = false;
-  if (shared.script().IsScript()) {
-    Script script = Script::cast(shared.script());
+  if (shared->script().IsScript()) {
+    Handle<Script> script = handle(Script::cast(shared->script()), isolate_);
     line_table.reset(new SourcePositionTable());
-    HandleScope scope(isolate_);
 
-    is_shared_cross_origin = script.origin_options().IsSharedCrossOrigin();
+    is_shared_cross_origin = script->origin_options().IsSharedCrossOrigin();
 
     // Add each position to the source position table and store inlining stacks
     // for inline positions. We store almost the same information in the
     // profiler as is stored on the code object, except that we transform source
     // positions to line numbers here, because we only care about attributing
     // ticks to a given line.
-    for (SourcePositionTableIterator it(abstract_code.source_position_table());
+    for (SourcePositionTableIterator it(abstract_code->source_position_table());
          !it.done(); it.Advance()) {
       int position = it.source_position().ScriptOffset();
       int inlining_id = it.source_position().InliningId();
 
       if (inlining_id == SourcePosition::kNotInlined) {
-        int line_number = script.GetLineNumber(position) + 1;
+        int line_number = script->GetLineNumber(position) + 1;
         line_table->SetPosition(it.code_offset(), line_number, inlining_id);
       } else {
-        DCHECK(abstract_code.IsCode());
-        Code code = abstract_code.GetCode();
+        DCHECK(abstract_code->IsCode());
+        Handle<Code> code = handle(abstract_code->GetCode(), isolate_);
         std::vector<SourcePositionInfo> stack =
-            it.source_position().InliningStack(handle(code, isolate_));
+            it.source_position().InliningStack(code);
         DCHECK(!stack.empty());
 
         // When we have an inlining id and we are doing cross-script inlining,
@@ -168,7 +164,7 @@ void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
           std::unique_ptr<CodeEntry> inline_entry = std::make_unique<CodeEntry>(
               tag, GetFunctionName(*pos_info.shared), resource_name,
               start_pos_info.line + 1, start_pos_info.column + 1, nullptr,
-              code.InstructionStart(), inline_is_shared_cross_origin);
+              code->InstructionStart(), inline_is_shared_cross_origin);
           inline_entry->FillFunctionInfo(*pos_info.shared);
 
           // Create a canonical CodeEntry for each inlined frame and then re-use
@@ -184,97 +180,84 @@ void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
     }
   }
   rec->entry =
-      new CodeEntry(tag, GetFunctionName(shared),
-                    GetName(InferScriptName(script_name, shared)), line, column,
-                    std::move(line_table), abstract_code.InstructionStart(),
-                    is_shared_cross_origin);
+      new CodeEntry(tag, GetFunctionName(*shared),
+                    GetName(InferScriptName(*script_name, *shared)), line,
+                    column, std::move(line_table),
+                    abstract_code->InstructionStart(), is_shared_cross_origin);
   if (!inline_stacks.empty()) {
     rec->entry->SetInlineStacks(std::move(cached_inline_entries),
                                 std::move(inline_stacks));
   }
 
-  rec->entry->FillFunctionInfo(shared);
-  rec->instruction_size = abstract_code.InstructionSize();
+  rec->entry->FillFunctionInfo(*shared);
+  rec->instruction_size = abstract_code->InstructionSize();
   DispatchCodeEvent(evt_rec);
 }
 
-void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
+void ProfilerListener::CodeCreateEvent(LogEventsAndTags tag,
                                        const wasm::WasmCode* code,
                                        wasm::WasmName name) {
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
   rec->instruction_start = code->instruction_start();
   rec->entry = new CodeEntry(
-      tag, GetName(name.begin()), CodeEntry::kWasmResourceNamePrefix,
+      tag, GetName(name), CodeEntry::kWasmResourceNamePrefix,
       CpuProfileNode::kNoLineNumberInfo, CpuProfileNode::kNoColumnNumberInfo,
       nullptr, code->instruction_start(), true);
   rec->instruction_size = code->instructions().length();
   DispatchCodeEvent(evt_rec);
 }
 
-void ProfilerListener::CodeMoveEvent(AbstractCode from, AbstractCode to) {
-  CodeEventsContainer evt_rec(CodeEventRecord::CODE_MOVE);
-  CodeMoveEventRecord* rec = &evt_rec.CodeMoveEventRecord_;
-  rec->from_instruction_start = from.InstructionStart();
-  rec->to_instruction_start = to.InstructionStart();
-  DispatchCodeEvent(evt_rec);
-}
-
-void ProfilerListener::CodeDisableOptEvent(AbstractCode code,
-                                           SharedFunctionInfo shared) {
-  CodeEventsContainer evt_rec(CodeEventRecord::CODE_DISABLE_OPT);
-  CodeDisableOptEventRecord* rec = &evt_rec.CodeDisableOptEventRecord_;
-  rec->instruction_start = code.InstructionStart();
-  rec->bailout_reason = GetBailoutReason(shared.disable_optimization_reason());
+void ProfilerListener::CallbackEvent(Handle<Name> name, Address entry_point) {
+  CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
+  CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
+  rec->instruction_start = entry_point;
+  rec->entry = new CodeEntry(CodeEventListener::CALLBACK_TAG, GetName(*name));
+  rec->instruction_size = 1;
   DispatchCodeEvent(evt_rec);
 }
 
-void ProfilerListener::CodeDeoptEvent(Code code, DeoptimizeKind kind,
-                                      Address pc, int fp_to_sp_delta) {
-  CodeEventsContainer evt_rec(CodeEventRecord::CODE_DEOPT);
-  CodeDeoptEventRecord* rec = &evt_rec.CodeDeoptEventRecord_;
-  Deoptimizer::DeoptInfo info = Deoptimizer::GetDeoptInfo(code, pc);
-  rec->instruction_start = code.InstructionStart();
-  rec->deopt_reason = DeoptimizeReasonToString(info.deopt_reason);
-  rec->deopt_id = info.deopt_id;
-  rec->pc = pc;
-  rec->fp_to_sp_delta = fp_to_sp_delta;
-
-  // When a function is deoptimized, we store the deoptimized frame information
-  // for the use of GetDeoptInfos().
-  AttachDeoptInlinedFrames(code, rec);
+void ProfilerListener::GetterCallbackEvent(Handle<Name> name,
+                                           Address entry_point) {
+  CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
+  CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
+  rec->instruction_start = entry_point;
+  rec->entry = new CodeEntry(CodeEventListener::CALLBACK_TAG,
+                             GetConsName("get ", *name));
+  rec->instruction_size = 1;
   DispatchCodeEvent(evt_rec);
 }
 
-void ProfilerListener::GetterCallbackEvent(Name name, Address entry_point) {
+void ProfilerListener::SetterCallbackEvent(Handle<Name> name,
+                                           Address entry_point) {
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
   rec->instruction_start = entry_point;
-  rec->entry =
-      new CodeEntry(CodeEventListener::CALLBACK_TAG, GetConsName("get ", name));
+  rec->entry = new CodeEntry(CodeEventListener::CALLBACK_TAG,
+                             GetConsName("set ", *name));
   rec->instruction_size = 1;
   DispatchCodeEvent(evt_rec);
 }
 
-void ProfilerListener::RegExpCodeCreateEvent(AbstractCode code, String source) {
+void ProfilerListener::RegExpCodeCreateEvent(Handle<AbstractCode> code,
+                                             Handle<String> source) {
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
-  rec->instruction_start = code.InstructionStart();
+  rec->instruction_start = code->InstructionStart();
   rec->entry = new CodeEntry(
-      CodeEventListener::REG_EXP_TAG, GetConsName("RegExp: ", source),
+      CodeEventListener::REG_EXP_TAG, GetConsName("RegExp: ", *source),
       CodeEntry::kEmptyResourceName, CpuProfileNode::kNoLineNumberInfo,
-      CpuProfileNode::kNoColumnNumberInfo, nullptr, code.InstructionStart());
-  rec->instruction_size = code.InstructionSize();
+      CpuProfileNode::kNoColumnNumberInfo, nullptr, code->InstructionStart());
+  rec->instruction_size = code->InstructionSize();
   DispatchCodeEvent(evt_rec);
 }
 
-void ProfilerListener::SetterCallbackEvent(Name name, Address entry_point) {
-  CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
-  CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
-  rec->instruction_start = entry_point;
-  rec->entry =
-      new CodeEntry(CodeEventListener::CALLBACK_TAG, GetConsName("set ", name));
-  rec->instruction_size = 1;
+void ProfilerListener::CodeMoveEvent(AbstractCode from, AbstractCode to) {
+  DisallowHeapAllocation no_gc;
+  CodeEventsContainer evt_rec(CodeEventRecord::CODE_MOVE);
+  CodeMoveEventRecord* rec = &evt_rec.CodeMoveEventRecord_;
+  rec->from_instruction_start = from.InstructionStart();
+  rec->to_instruction_start = to.InstructionStart();
   DispatchCodeEvent(evt_rec);
 }
 
@@ -285,6 +268,40 @@ void ProfilerListener::NativeContextMoveEvent(Address from, Address to) {
   DispatchCodeEvent(evt_rec);
 }
 
+void ProfilerListener::CodeDisableOptEvent(Handle<AbstractCode> code,
+                                           Handle<SharedFunctionInfo> shared) {
+  CodeEventsContainer evt_rec(CodeEventRecord::CODE_DISABLE_OPT);
+  CodeDisableOptEventRecord* rec = &evt_rec.CodeDisableOptEventRecord_;
+  rec->instruction_start = code->InstructionStart();
+  rec->bailout_reason = GetBailoutReason(shared->disable_optimization_reason());
+  DispatchCodeEvent(evt_rec);
+}
+
+void ProfilerListener::CodeDeoptEvent(Handle<Code> code, DeoptimizeKind kind,
+                                      Address pc, int fp_to_sp_delta) {
+  CodeEventsContainer evt_rec(CodeEventRecord::CODE_DEOPT);
+  CodeDeoptEventRecord* rec = &evt_rec.CodeDeoptEventRecord_;
+  Deoptimizer::DeoptInfo info = Deoptimizer::GetDeoptInfo(*code, pc);
+  rec->instruction_start = code->InstructionStart();
+  rec->deopt_reason = DeoptimizeReasonToString(info.deopt_reason);
+  rec->deopt_id = info.deopt_id;
+  rec->pc = pc;
+  rec->fp_to_sp_delta = fp_to_sp_delta;
+
+  // When a function is deoptimized, we store the deoptimized frame information
+  // for the use of GetDeoptInfos().
+  AttachDeoptInlinedFrames(code, rec);
+  DispatchCodeEvent(evt_rec);
+}
+
+const char* ProfilerListener::GetName(Vector<const char> name) {
+  // TODO(all): Change {StringsStorage} to accept non-null-terminated strings.
+  OwnedVector<char> null_terminated = OwnedVector<char>::New(name.size() + 1);
+  std::copy(name.begin(), name.end(), null_terminated.begin());
+  null_terminated[name.size()] = '\0';
+  return GetName(null_terminated.begin());
+}
+
 Name ProfilerListener::InferScriptName(Name name, SharedFunctionInfo info) {
   if (name.IsString() && String::cast(name).length()) return name;
   if (!info.script().IsScript()) return name;
@@ -293,7 +310,6 @@ Name ProfilerListener::InferScriptName(Name name, SharedFunctionInfo info) {
 }
 
 const char* ProfilerListener::GetFunctionName(SharedFunctionInfo shared) {
-  DisallowHeapAllocation no_gc;
   switch (naming_mode_) {
     case kDebugNaming:
       return GetName(shared.DebugName());
@@ -304,7 +320,7 @@ const char* ProfilerListener::GetFunctionName(SharedFunctionInfo shared) {
   }
 }
 
-void ProfilerListener::AttachDeoptInlinedFrames(Code code,
+void ProfilerListener::AttachDeoptInlinedFrames(Handle<Code> code,
                                                 CodeDeoptEventRecord* rec) {
   int deopt_id = rec->deopt_id;
   SourcePosition last_position = SourcePosition::Unknown();
@@ -315,7 +331,7 @@ void ProfilerListener::AttachDeoptInlinedFrames(Code code,
   rec->deopt_frames = nullptr;
   rec->deopt_frame_count = 0;
 
-  for (RelocIterator it(code, mask); !it.done(); it.next()) {
+  for (RelocIterator it(*code, mask); !it.done(); it.next()) {
     RelocInfo* info = it.rinfo();
     if (info->rmode() == RelocInfo::DEOPT_SCRIPT_OFFSET) {
       int script_offset = static_cast<int>(info->data());
@@ -333,8 +349,7 @@ void ProfilerListener::AttachDeoptInlinedFrames(Code code,
       // frame. These don't escape this function, but quickly add up. This
       // scope limits their lifetime.
       HandleScope scope(isolate_);
-      std::vector<SourcePositionInfo> stack =
-          last_position.InliningStack(handle(code, isolate_));
+      std::vector<SourcePositionInfo> stack = last_position.InliningStack(code);
       CpuProfileDeoptFrame* deopt_frames =
           new CpuProfileDeoptFrame[stack.size()];
 
diff --git a/deps/v8/src/profiler/profiler-listener.h b/deps/v8/src/profiler/profiler-listener.h
index 85070d65aaf11d..764c76c8ee00f6 100644
--- a/deps/v8/src/profiler/profiler-listener.h
+++ b/deps/v8/src/profiler/profiler-listener.h
@@ -30,32 +30,32 @@ class V8_EXPORT_PRIVATE ProfilerListener : public CodeEventListener {
                    CpuProfilingNamingMode mode = kDebugNaming);
   ~ProfilerListener() override;
 
-  void CallbackEvent(Name name, Address entry_point) override;
-  void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                       AbstractCode code, const char* comment) override;
-  void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                       AbstractCode code, Name name) override;
-  void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                       AbstractCode code, SharedFunctionInfo shared,
-                       Name script_name) override;
-  void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                       AbstractCode code, SharedFunctionInfo shared,
-                       Name script_name, int line, int column) override;
-  void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
-                       const wasm::WasmCode* code,
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       const char* name) override;
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<Name> name) override;
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<SharedFunctionInfo> shared,
+                       Handle<Name> script_name) override;
+  void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                       Handle<SharedFunctionInfo> shared,
+                       Handle<Name> script_name, int line, int column) override;
+  void CodeCreateEvent(LogEventsAndTags tag, const wasm::WasmCode* code,
                        wasm::WasmName name) override;
 
-  void CodeMovingGCEvent() override {}
+  void CallbackEvent(Handle<Name> name, Address entry_point) override;
+  void GetterCallbackEvent(Handle<Name> name, Address entry_point) override;
+  void SetterCallbackEvent(Handle<Name> name, Address entry_point) override;
+  void RegExpCodeCreateEvent(Handle<AbstractCode> code,
+                             Handle<String> source) override;
   void CodeMoveEvent(AbstractCode from, AbstractCode to) override;
-  void CodeDisableOptEvent(AbstractCode code,
-                           SharedFunctionInfo shared) override;
-  void CodeDeoptEvent(Code code, DeoptimizeKind kind, Address pc,
-                      int fp_to_sp_delta) override;
-  void GetterCallbackEvent(Name name, Address entry_point) override;
-  void RegExpCodeCreateEvent(AbstractCode code, String source) override;
-  void SetterCallbackEvent(Name name, Address entry_point) override;
   void SharedFunctionInfoMoveEvent(Address from, Address to) override {}
   void NativeContextMoveEvent(Address from, Address to) override;
+  void CodeMovingGCEvent() override {}
+  void CodeDisableOptEvent(Handle<AbstractCode> code,
+                           Handle<SharedFunctionInfo> shared) override;
+  void CodeDeoptEvent(Handle<Code> code, DeoptimizeKind kind, Address pc,
+                      int fp_to_sp_delta) override;
 
   const char* GetName(Name name) {
     return function_and_resource_names_.GetName(name);
@@ -66,6 +66,7 @@ class V8_EXPORT_PRIVATE ProfilerListener : public CodeEventListener {
   const char* GetName(const char* name) {
     return function_and_resource_names_.GetCopy(name);
   }
+  const char* GetName(Vector<const char> name);
   const char* GetConsName(const char* prefix, Name name) {
     return function_and_resource_names_.GetConsName(prefix, name);
   }
@@ -75,7 +76,7 @@ class V8_EXPORT_PRIVATE ProfilerListener : public CodeEventListener {
  private:
   const char* GetFunctionName(SharedFunctionInfo);
 
-  void AttachDeoptInlinedFrames(Code code, CodeDeoptEventRecord* rec);
+  void AttachDeoptInlinedFrames(Handle<Code> code, CodeDeoptEventRecord* rec);
   Name InferScriptName(Name name, SharedFunctionInfo info);
   V8_INLINE void DispatchCodeEvent(const CodeEventsContainer& evt_rec) {
     observer_->CodeEventHandler(evt_rec);
diff --git a/deps/v8/src/profiler/tick-sample.cc b/deps/v8/src/profiler/tick-sample.cc
index 5c2f2d63ce3400..6c1b8a9e903f98 100644
--- a/deps/v8/src/profiler/tick-sample.cc
+++ b/deps/v8/src/profiler/tick-sample.cc
@@ -143,40 +143,20 @@ bool SimulatorHelper::FillRegisters(Isolate* isolate,
 }
 #endif  // USE_SIMULATOR
 
-// Attempts to safely dereference the address of a native context at a given
-// context's address. Returns kNullAddress on failure, in the event that the
-// context is in an inconsistent state.
+// Returns the native context for a JavaScript frame. If the frame wasn't a
+// JavaScript frame, it'll return kNullAddress.
 Address ScrapeNativeContextAddress(Heap* heap, Address context_address) {
+#if !defined(V8_TARGET_ARCH_IA32) && !defined(V8_TARGET_ARCH_X64)
+  return kNullAddress;
+#else
   DCHECK_EQ(heap->gc_state(), Heap::NOT_IN_GC);
 
+  // If the value is tagged, we're looking at a JavaScript frame.
   if (!HAS_STRONG_HEAP_OBJECT_TAG(context_address)) return kNullAddress;
 
-  if (heap->memory_allocator()->IsOutsideAllocatedSpace(context_address))
-    return kNullAddress;
-
-  // Note that once a native context has been assigned to a context, the slot
-  // is no longer mutated except during pointer updates / evictions. Since
-  // pointer updates exclusively occur on the main thread, and we don't record
-  // TickSamples when the main thread's VM state is GC, the only other
-  // situation where the address here would be invalid is if it's being
-  // reassigned -- which isn't possible.
-  int native_context_offset =
-      i::Context::SlotOffset(i::Context::NATIVE_CONTEXT_INDEX);
-  i::Address native_context_slot_address =
-      context_address + native_context_offset;
-
-  // By the prior hypothesis, the indirect native context address should always
-  // be valid.
-  if (heap->memory_allocator()->IsOutsideAllocatedSpace(
-          native_context_slot_address)) {
-    DCHECK(false);
-    return kNullAddress;
-  }
-
-  i::ObjectSlot native_context_slot(native_context_slot_address);
-  i::Object native_context = native_context_slot.Relaxed_Load();
-
-  return native_context.ptr();
+  i::Object object(context_address);
+  return i::Context::cast(object).map().native_context().ptr();
+#endif
 }
 
 }  // namespace
diff --git a/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.cc b/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.cc
index 2f81b6de86d931..8f9da563a9b7ba 100644
--- a/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.cc
+++ b/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.cc
@@ -154,6 +154,19 @@ void RegExpMacroAssemblerARM::AdvanceRegister(int reg, int by) {
 
 void RegExpMacroAssemblerARM::Backtrack() {
   CheckPreemption();
+  if (has_backtrack_limit()) {
+    Label next;
+    __ ldr(r0, MemOperand(frame_pointer(), kBacktrackCount));
+    __ add(r0, r0, Operand(1));
+    __ str(r0, MemOperand(frame_pointer(), kBacktrackCount));
+    __ cmp(r0, Operand(backtrack_limit()));
+    __ b(ne, &next);
+
+    // Exceeded limits are treated as a failed match.
+    Fail();
+
+    __ bind(&next);
+  }
   // Pop Code offset from backtrack stack, add Code and jump to location.
   Pop(r0);
   __ add(pc, r0, Operand(code_pointer()));
@@ -642,9 +655,16 @@ Handle<HeapObject> RegExpMacroAssemblerARM::GetCode(Handle<String> source) {
   // Set frame pointer in space for it if this is not a direct call
   // from generated code.
   __ add(frame_pointer(), sp, Operand(4 * kPointerSize));
+
+  STATIC_ASSERT(kSuccessfulCaptures == kInputString - kSystemPointerSize);
   __ mov(r0, Operand::Zero());
   __ push(r0);  // Make room for success counter and initialize it to 0.
+  STATIC_ASSERT(kStringStartMinusOne ==
+                kSuccessfulCaptures - kSystemPointerSize);
   __ push(r0);  // Make room for "string start - 1" constant.
+  STATIC_ASSERT(kBacktrackCount == kStringStartMinusOne - kSystemPointerSize);
+  __ push(r0);  // The backtrack counter.
+
   // Check if we have space on the stack for registers.
   Label stack_limit_hit;
   Label stack_ok;
@@ -891,7 +911,7 @@ Handle<HeapObject> RegExpMacroAssemblerARM::GetCode(Handle<String> source) {
                           .set_self_reference(masm_->CodeObject())
                           .Build();
   PROFILE(masm_->isolate(),
-          RegExpCodeCreateEvent(AbstractCode::cast(*code), *source));
+          RegExpCodeCreateEvent(Handle<AbstractCode>::cast(code), source));
   return Handle<HeapObject>::cast(code);
 }
 
@@ -1073,17 +1093,10 @@ void RegExpMacroAssemblerARM::CallCheckStackGuardState() {
       ExternalReference::re_check_stack_guard_state(isolate());
   __ mov(ip, Operand(stack_guard_check));
 
-  if (FLAG_embedded_builtins) {
-    EmbeddedData d = EmbeddedData::FromBlob();
-    CHECK(Builtins::IsIsolateIndependent(Builtins::kDirectCEntry));
-    Address entry = d.InstructionStartOfBuiltin(Builtins::kDirectCEntry);
-    __ mov(lr, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
-  } else {
-    // TODO(v8:8519): Remove this once embedded builtins are on unconditionally.
-    Handle<Code> code = BUILTIN_CODE(isolate(), DirectCEntry);
-    __ mov(lr, Operand(reinterpret_cast<intptr_t>(code.location()),
-                       RelocInfo::CODE_TARGET));
-  }
+  EmbeddedData d = EmbeddedData::FromBlob();
+  CHECK(Builtins::IsIsolateIndependent(Builtins::kDirectCEntry));
+  Address entry = d.InstructionStartOfBuiltin(Builtins::kDirectCEntry);
+  __ mov(lr, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
   __ Call(lr);
 
   // Drop the return address from the stack.
diff --git a/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.h b/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.h
index 9b21c5a11c6e26..6320913f4cd5ea 100644
--- a/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.h
+++ b/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.h
@@ -118,8 +118,9 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerARM
   // the frame in GetCode.
   static const int kSuccessfulCaptures = kInputString - kPointerSize;
   static const int kStringStartMinusOne = kSuccessfulCaptures - kPointerSize;
+  static const int kBacktrackCount = kStringStartMinusOne - kSystemPointerSize;
   // First register address. Following registers are below it on the stack.
-  static const int kRegisterZero = kStringStartMinusOne - kPointerSize;
+  static const int kRegisterZero = kBacktrackCount - kSystemPointerSize;
 
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
diff --git a/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.cc b/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.cc
index 62a055e2a20cfd..56658819b1d9fd 100644
--- a/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.cc
+++ b/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.cc
@@ -187,6 +187,21 @@ void RegExpMacroAssemblerARM64::AdvanceRegister(int reg, int by) {
 
 void RegExpMacroAssemblerARM64::Backtrack() {
   CheckPreemption();
+  if (has_backtrack_limit()) {
+    Label next;
+    UseScratchRegisterScope temps(masm_);
+    Register scratch = temps.AcquireW();
+    __ Ldr(scratch, MemOperand(frame_pointer(), kBacktrackCount));
+    __ Add(scratch, scratch, 1);
+    __ Str(scratch, MemOperand(frame_pointer(), kBacktrackCount));
+    __ Cmp(scratch, Operand(backtrack_limit()));
+    __ B(ne, &next);
+
+    // Exceeded limits are treated as a failed match.
+    Fail();
+
+    __ bind(&next);
+  }
   Pop(w10);
   __ Add(x10, code_pointer(), Operand(w10, UXTW));
   __ Br(x10);
@@ -738,13 +753,15 @@ Handle<HeapObject> RegExpMacroAssemblerARM64::GetCode(Handle<String> source) {
   __ Mov(output_array(), x4);
 
   // Set the number of registers we will need to allocate, that is:
-  //   - success_counter (X register)
+  //   - kSuccessCounter / success_counter (X register)
+  //   - kBacktrackCount (X register)
   //   - (num_registers_ - kNumCachedRegisters) (W registers)
   int num_wreg_to_allocate = num_registers_ - kNumCachedRegisters;
   // Do not allocate registers on the stack if they can all be cached.
   if (num_wreg_to_allocate < 0) { num_wreg_to_allocate = 0; }
-  // Make room for the success_counter.
-  num_wreg_to_allocate += 2;
+  // Make room for the success_counter and kBacktrackCount. Each X (64-bit)
+  // register is equivalent to two W (32-bit) registers.
+  num_wreg_to_allocate += 2 + 2;
 
   // Make sure the stack alignment will be respected.
   int alignment = masm_->ActivationFrameAlignment();
@@ -785,8 +802,9 @@ Handle<HeapObject> RegExpMacroAssemblerARM64::GetCode(Handle<String> source) {
   // Allocate space on stack.
   __ Claim(num_wreg_to_allocate, kWRegSize);
 
-  // Initialize success_counter with 0.
+  // Initialize success_counter and kBacktrackCount with 0.
   __ Str(wzr, MemOperand(frame_pointer(), kSuccessCounter));
+  __ Str(wzr, MemOperand(frame_pointer(), kBacktrackCount));
 
   // Find negative length (offset of start relative to end).
   __ Sub(x10, input_start(), input_end());
@@ -1079,7 +1097,7 @@ Handle<HeapObject> RegExpMacroAssemblerARM64::GetCode(Handle<String> source) {
                           .set_self_reference(masm_->CodeObject())
                           .Build();
   PROFILE(masm_->isolate(),
-          RegExpCodeCreateEvent(AbstractCode::cast(*code), *source));
+          RegExpCodeCreateEvent(Handle<AbstractCode>::cast(code), source));
   return Handle<HeapObject>::cast(code);
 }
 
@@ -1394,7 +1412,7 @@ void RegExpMacroAssemblerARM64::CallCheckStackGuardState(Register scratch) {
       ExternalReference::re_check_stack_guard_state(isolate());
   __ Mov(scratch, check_stack_guard_state);
 
-  if (FLAG_embedded_builtins) {
+  {
     UseScratchRegisterScope temps(masm_);
     Register scratch = temps.AcquireX();
 
@@ -1404,10 +1422,6 @@ void RegExpMacroAssemblerARM64::CallCheckStackGuardState(Register scratch) {
 
     __ Ldr(scratch, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
     __ Call(scratch);
-  } else {
-    // TODO(v8:8519): Remove this once embedded builtins are on unconditionally.
-    Handle<Code> code = BUILTIN_CODE(isolate(), DirectCEntry);
-    __ Call(code, RelocInfo::CODE_TARGET);
   }
 
   // The input string may have been moved in memory, we need to reload it.
@@ -1479,7 +1493,7 @@ void RegExpMacroAssemblerARM64::CheckStackLimit() {
 
 void RegExpMacroAssemblerARM64::Push(Register source) {
   DCHECK(source.Is32Bits());
-  DCHECK(!source.is(backtrack_stackpointer()));
+  DCHECK_NE(source, backtrack_stackpointer());
   __ Str(source,
          MemOperand(backtrack_stackpointer(),
                     -static_cast<int>(kWRegSize),
@@ -1489,7 +1503,7 @@ void RegExpMacroAssemblerARM64::Push(Register source) {
 
 void RegExpMacroAssemblerARM64::Pop(Register target) {
   DCHECK(target.Is32Bits());
-  DCHECK(!target.is(backtrack_stackpointer()));
+  DCHECK_NE(target, backtrack_stackpointer());
   __ Ldr(target,
          MemOperand(backtrack_stackpointer(), kWRegSize, PostIndex));
 }
@@ -1546,7 +1560,7 @@ void RegExpMacroAssemblerARM64::StoreRegister(int register_index,
       break;
     case CACHED_LSW: {
       Register cached_register = GetCachedRegister(register_index);
-      if (!source.Is(cached_register.W())) {
+      if (source != cached_register.W()) {
         __ Bfi(cached_register, source.X(), 0, kWRegSizeInBits);
       }
       break;
diff --git a/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.h b/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.h
index 6154c6cf603ed2..cee9e2c97e9037 100644
--- a/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.h
+++ b/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.h
@@ -119,11 +119,12 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerARM64
   // When adding local variables remember to push space for them in
   // the frame in GetCode.
   static const int kSuccessCounter = kInput - kSystemPointerSize;
+  static const int kBacktrackCount = kSuccessCounter - kSystemPointerSize;
   // First position register address on the stack. Following positions are
   // below it. A position is a 32 bit value.
-  static const int kFirstRegisterOnStack = kSuccessCounter - kWRegSize;
+  static const int kFirstRegisterOnStack = kBacktrackCount - kWRegSize;
   // A capture is a 64 bit value holding two position.
-  static const int kFirstCaptureOnStack = kSuccessCounter - kXRegSize;
+  static const int kFirstCaptureOnStack = kBacktrackCount - kXRegSize;
 
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
diff --git a/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.cc b/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.cc
index 5ee7b909883548..f9015287f95bee 100644
--- a/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.cc
+++ b/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.cc
@@ -142,6 +142,17 @@ void RegExpMacroAssemblerIA32::AdvanceRegister(int reg, int by) {
 
 void RegExpMacroAssemblerIA32::Backtrack() {
   CheckPreemption();
+  if (has_backtrack_limit()) {
+    Label next;
+    __ inc(Operand(ebp, kBacktrackCount));
+    __ cmp(Operand(ebp, kBacktrackCount), Immediate(backtrack_limit()));
+    __ j(not_equal, &next);
+
+    // Exceeded limits are treated as a failed match.
+    Fail();
+
+    __ bind(&next);
+  }
   // Pop Code offset from backtrack stack, add Code and jump to location.
   Pop(ebx);
   __ add(ebx, Immediate(masm_->CodeObject()));
@@ -678,8 +689,14 @@ Handle<HeapObject> RegExpMacroAssemblerIA32::GetCode(Handle<String> source) {
   __ push(esi);
   __ push(edi);
   __ push(ebx);  // Callee-save on MacOS.
+
+  STATIC_ASSERT(kSuccessfulCaptures == kBackup_ebx - kSystemPointerSize);
   __ push(Immediate(0));  // Number of successful matches in a global regexp.
+  STATIC_ASSERT(kStringStartMinusOne ==
+                kSuccessfulCaptures - kSystemPointerSize);
   __ push(Immediate(0));  // Make room for "string start - 1" constant.
+  STATIC_ASSERT(kBacktrackCount == kStringStartMinusOne - kSystemPointerSize);
+  __ push(Immediate(0));  // The backtrack counter.
 
   // Check if we have space on the stack for registers.
   Label stack_limit_hit;
@@ -935,7 +952,7 @@ Handle<HeapObject> RegExpMacroAssemblerIA32::GetCode(Handle<String> source) {
                           .set_self_reference(masm_->CodeObject())
                           .Build();
   PROFILE(masm_->isolate(),
-          RegExpCodeCreateEvent(AbstractCode::cast(*code), *source));
+          RegExpCodeCreateEvent(Handle<AbstractCode>::cast(code), source));
   return Handle<HeapObject>::cast(code);
 }
 
diff --git a/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.h b/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.h
index 3464d81facd595..b2c6fab7b3ce84 100644
--- a/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.h
+++ b/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.h
@@ -120,8 +120,9 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerIA32
   static const int kSuccessfulCaptures = kBackup_ebx - kSystemPointerSize;
   static const int kStringStartMinusOne =
       kSuccessfulCaptures - kSystemPointerSize;
+  static const int kBacktrackCount = kStringStartMinusOne - kSystemPointerSize;
   // First register address. Following registers are below it on the stack.
-  static const int kRegisterZero = kStringStartMinusOne - kSystemPointerSize;
+  static const int kRegisterZero = kBacktrackCount - kSystemPointerSize;
 
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
diff --git a/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.cc b/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.cc
index 8d2800f004e909..1e7839c219385f 100644
--- a/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.cc
+++ b/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.cc
@@ -156,6 +156,18 @@ void RegExpMacroAssemblerMIPS::AdvanceRegister(int reg, int by) {
 
 void RegExpMacroAssemblerMIPS::Backtrack() {
   CheckPreemption();
+  if (has_backtrack_limit()) {
+    Label next;
+    __ Lw(a0, MemOperand(frame_pointer(), kBacktrackCount));
+    __ Addu(a0, a0, Operand(1));
+    __ Sw(a0, MemOperand(frame_pointer(), kBacktrackCount));
+    __ Branch(&next, ne, a0, Operand(backtrack_limit()));
+
+    // Exceeded limits are treated as a failed match.
+    Fail();
+
+    __ bind(&next);
+  }
   // Pop Code offset from backtrack stack, add Code and jump to location.
   Pop(a0);
   __ Addu(a0, a0, code_pointer());
@@ -639,9 +651,15 @@ Handle<HeapObject> RegExpMacroAssemblerMIPS::GetCode(Handle<String> source) {
     // Set frame pointer in space for it if this is not a direct call
     // from generated code.
     __ Addu(frame_pointer(), sp, Operand(4 * kPointerSize));
+
+    STATIC_ASSERT(kSuccessfulCaptures == kInputString - kSystemPointerSize);
     __ mov(a0, zero_reg);
     __ push(a0);  // Make room for success counter and initialize it to 0.
+    STATIC_ASSERT(kStringStartMinusOne ==
+                  kSuccessfulCaptures - kSystemPointerSize);
     __ push(a0);  // Make room for "string start - 1" constant.
+    STATIC_ASSERT(kBacktrackCount == kStringStartMinusOne - kSystemPointerSize);
+    __ push(a0);
 
     // Check if we have space on the stack for registers.
     Label stack_limit_hit;
@@ -904,7 +922,7 @@ Handle<HeapObject> RegExpMacroAssemblerMIPS::GetCode(Handle<String> source) {
                           .set_self_reference(masm_->CodeObject())
                           .Build();
   LOG(masm_->isolate(),
-      RegExpCodeCreateEvent(AbstractCode::cast(*code), *source));
+      RegExpCodeCreateEvent(Handle<AbstractCode>::cast(code), source));
   return Handle<HeapObject>::cast(code);
 }
 
@@ -1128,21 +1146,11 @@ void RegExpMacroAssemblerMIPS::CallCheckStackGuardState(Register scratch) {
       ExternalReference::re_check_stack_guard_state(masm_->isolate());
   __ li(t9, Operand(stack_guard_check));
 
-  if (FLAG_embedded_builtins) {
-    EmbeddedData d = EmbeddedData::FromBlob();
-    CHECK(Builtins::IsIsolateIndependent(Builtins::kDirectCEntry));
-    Address entry = d.InstructionStartOfBuiltin(Builtins::kDirectCEntry);
-    __ li(kScratchReg, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
-    __ Call(kScratchReg);
-  } else {
-    // TODO(v8:8519): Remove this once embedded builtins are on unconditionally.
-    Handle<Code> code = BUILTIN_CODE(isolate(), DirectCEntry);
-    __ li(kScratchReg,
-          Operand(reinterpret_cast<intptr_t>(code.location()),
-                  RelocInfo::CODE_TARGET),
-          CONSTANT_SIZE);
-    __ Call(kScratchReg);
-  }
+  EmbeddedData d = EmbeddedData::FromBlob();
+  CHECK(Builtins::IsIsolateIndependent(Builtins::kDirectCEntry));
+  Address entry = d.InstructionStartOfBuiltin(Builtins::kDirectCEntry);
+  __ li(kScratchReg, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+  __ Call(kScratchReg);
 
   // DirectCEntry allocated space for the C argument slots so we have to
   // drop them with the return address from the stack with loading saved sp.
diff --git a/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.h b/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.h
index 084436bbbd455e..9281b0174dd52c 100644
--- a/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.h
+++ b/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.h
@@ -121,8 +121,9 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerMIPS
   // the frame in GetCode.
   static const int kSuccessfulCaptures = kInputString - kPointerSize;
   static const int kStringStartMinusOne = kSuccessfulCaptures - kPointerSize;
+  static const int kBacktrackCount = kStringStartMinusOne - kSystemPointerSize;
   // First register address. Following registers are below it on the stack.
-  static const int kRegisterZero = kStringStartMinusOne - kPointerSize;
+  static const int kRegisterZero = kBacktrackCount - kSystemPointerSize;
 
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
diff --git a/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.cc b/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.cc
index 2d5402ebdbc298..3dd15486851486 100644
--- a/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.cc
+++ b/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.cc
@@ -192,6 +192,18 @@ void RegExpMacroAssemblerMIPS::AdvanceRegister(int reg, int by) {
 
 void RegExpMacroAssemblerMIPS::Backtrack() {
   CheckPreemption();
+  if (has_backtrack_limit()) {
+    Label next;
+    __ Ld(a0, MemOperand(frame_pointer(), kBacktrackCount));
+    __ Daddu(a0, a0, Operand(1));
+    __ Sd(a0, MemOperand(frame_pointer(), kBacktrackCount));
+    __ Branch(&next, ne, a0, Operand(backtrack_limit()));
+
+    // Exceeded limits are treated as a failed match.
+    Fail();
+
+    __ bind(&next);
+  }
   // Pop Code offset from backtrack stack, add Code and jump to location.
   Pop(a0);
   __ Daddu(a0, a0, code_pointer());
@@ -675,9 +687,14 @@ Handle<HeapObject> RegExpMacroAssemblerMIPS::GetCode(Handle<String> source) {
     // from generated code.
     // TODO(plind): this 8 is the # of argument regs, should have definition.
     __ Daddu(frame_pointer(), sp, Operand(8 * kPointerSize));
+    STATIC_ASSERT(kSuccessfulCaptures == kInputString - kSystemPointerSize);
     __ mov(a0, zero_reg);
     __ push(a0);  // Make room for success counter and initialize it to 0.
+    STATIC_ASSERT(kStringStartMinusOne ==
+                  kSuccessfulCaptures - kSystemPointerSize);
     __ push(a0);  // Make room for "string start - 1" constant.
+    STATIC_ASSERT(kBacktrackCount == kStringStartMinusOne - kSystemPointerSize);
+    __ push(a0);  // The backtrack counter
 
     // Check if we have space on the stack for registers.
     Label stack_limit_hit;
@@ -941,7 +958,7 @@ Handle<HeapObject> RegExpMacroAssemblerMIPS::GetCode(Handle<String> source) {
                           .set_self_reference(masm_->CodeObject())
                           .Build();
   LOG(masm_->isolate(),
-      RegExpCodeCreateEvent(AbstractCode::cast(*code), *source));
+      RegExpCodeCreateEvent(Handle<AbstractCode>::cast(code), source));
   return Handle<HeapObject>::cast(code);
 }
 
@@ -1165,21 +1182,11 @@ void RegExpMacroAssemblerMIPS::CallCheckStackGuardState(Register scratch) {
       ExternalReference::re_check_stack_guard_state(masm_->isolate());
   __ li(t9, Operand(stack_guard_check));
 
-  if (FLAG_embedded_builtins) {
-    EmbeddedData d = EmbeddedData::FromBlob();
-    CHECK(Builtins::IsIsolateIndependent(Builtins::kDirectCEntry));
-    Address entry = d.InstructionStartOfBuiltin(Builtins::kDirectCEntry);
-    __ li(kScratchReg, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
-    __ Call(kScratchReg);
-  } else {
-    // TODO(v8:8519): Remove this once embedded builtins are on unconditionally.
-    Handle<Code> code = BUILTIN_CODE(isolate(), DirectCEntry);
-    __ li(kScratchReg,
-          Operand(reinterpret_cast<intptr_t>(code.location()),
-                  RelocInfo::CODE_TARGET),
-          CONSTANT_SIZE);
-    __ Call(kScratchReg);
-  }
+  EmbeddedData d = EmbeddedData::FromBlob();
+  CHECK(Builtins::IsIsolateIndependent(Builtins::kDirectCEntry));
+  Address entry = d.InstructionStartOfBuiltin(Builtins::kDirectCEntry);
+  __ li(kScratchReg, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+  __ Call(kScratchReg);
 
   // DirectCEntry allocated space for the C argument slots so we have to
   // drop them with the return address from the stack with loading saved sp.
diff --git a/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.h b/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.h
index 9189a6a72d7141..bc7f83e6e9f6ad 100644
--- a/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.h
+++ b/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.h
@@ -126,8 +126,9 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerMIPS
   // the frame in GetCode.
   static const int kSuccessfulCaptures = kInputString - kPointerSize;
   static const int kStringStartMinusOne = kSuccessfulCaptures - kPointerSize;
+  static const int kBacktrackCount = kStringStartMinusOne - kSystemPointerSize;
   // First register address. Following registers are below it on the stack.
-  static const int kRegisterZero = kStringStartMinusOne - kPointerSize;
+  static const int kRegisterZero = kBacktrackCount - kSystemPointerSize;
 
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
diff --git a/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.cc b/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.cc
index a7f372ada5f0ef..50bf71e6d52ae5 100644
--- a/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.cc
+++ b/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.cc
@@ -170,6 +170,19 @@ void RegExpMacroAssemblerPPC::AdvanceRegister(int reg, int by) {
 
 void RegExpMacroAssemblerPPC::Backtrack() {
   CheckPreemption();
+  if (has_backtrack_limit()) {
+    Label next;
+    __ LoadP(r3, MemOperand(frame_pointer(), kBacktrackCount), r0);
+    __ addi(r3, r3, Operand(1));
+    __ StoreP(r3, MemOperand(frame_pointer(), kBacktrackCount), r0);
+    __ cmpi(r3, Operand(backtrack_limit()));
+    __ bne(&next);
+
+    // Exceeded limits are treated as a failed match.
+    Fail();
+
+    __ bind(&next);
+  }
   // Pop Code offset from backtrack stack, add Code and jump to location.
   Pop(r3);
   __ add(r3, r3, code_pointer());
@@ -682,9 +695,16 @@ Handle<HeapObject> RegExpMacroAssemblerPPC::GetCode(Handle<String> source) {
     // Set frame pointer in space for it if this is not a direct call
     // from generated code.
     __ addi(frame_pointer(), sp, Operand(8 * kPointerSize));
+
+    STATIC_ASSERT(kSuccessfulCaptures == kInputString - kSystemPointerSize);
     __ li(r3, Operand::Zero());
     __ push(r3);  // Make room for success counter and initialize it to 0.
+    STATIC_ASSERT(kStringStartMinusOne ==
+                  kSuccessfulCaptures - kSystemPointerSize);
     __ push(r3);  // Make room for "string start - 1" constant.
+    STATIC_ASSERT(kBacktrackCount == kStringStartMinusOne - kSystemPointerSize);
+    __ push(r3);  // The backtrack counter.
+
     // Check if we have space on the stack for registers.
     Label stack_limit_hit;
     Label stack_ok;
@@ -943,7 +963,7 @@ Handle<HeapObject> RegExpMacroAssemblerPPC::GetCode(Handle<String> source) {
                           .set_self_reference(masm_->CodeObject())
                           .Build();
   PROFILE(masm_->isolate(),
-          RegExpCodeCreateEvent(AbstractCode::cast(*code), *source));
+          RegExpCodeCreateEvent(Handle<AbstractCode>::cast(code), source));
   return Handle<HeapObject>::cast(code);
 }
 
@@ -1115,7 +1135,8 @@ void RegExpMacroAssemblerPPC::CallCheckStackGuardState(Register scratch) {
     __ mr(scratch, sp);
     __ addi(sp, sp, Operand(-(stack_passed_arguments + 1) * kPointerSize));
     DCHECK(base::bits::IsPowerOfTwo(frame_alignment));
-    __ ClearRightImm(sp, sp, Operand(WhichPowerOf2(frame_alignment)));
+    __ ClearRightImm(sp, sp,
+                     Operand(base::bits::WhichPowerOfTwo(frame_alignment)));
     __ StoreP(scratch, MemOperand(sp, stack_passed_arguments * kPointerSize));
   } else {
     // Make room for stack arguments
@@ -1137,17 +1158,10 @@ void RegExpMacroAssemblerPPC::CallCheckStackGuardState(Register scratch) {
       ExternalReference::re_check_stack_guard_state(isolate());
   __ mov(ip, Operand(stack_guard_check));
 
-  if (FLAG_embedded_builtins) {
-    EmbeddedData d = EmbeddedData::FromBlob();
-    CHECK(Builtins::IsIsolateIndependent(Builtins::kDirectCEntry));
-    Address entry = d.InstructionStartOfBuiltin(Builtins::kDirectCEntry);
-    __ mov(r0, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
-  } else {
-    // TODO(v8:8519): Remove this once embedded builtins are on unconditionally.
-    Handle<Code> code = BUILTIN_CODE(isolate(), DirectCEntry);
-    __ mov(r0, Operand(reinterpret_cast<intptr_t>(code.location()),
-                       RelocInfo::CODE_TARGET));
-  }
+  EmbeddedData d = EmbeddedData::FromBlob();
+  CHECK(Builtins::IsIsolateIndependent(Builtins::kDirectCEntry));
+  Address entry = d.InstructionStartOfBuiltin(Builtins::kDirectCEntry);
+  __ mov(r0, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
   __ Call(r0);
 
   // Restore the stack pointer
diff --git a/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.h b/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.h
index 60236a4000f066..c726a5f0d70b85 100644
--- a/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.h
+++ b/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.h
@@ -112,8 +112,9 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerPPC
   // the frame in GetCode.
   static const int kSuccessfulCaptures = kInputString - kPointerSize;
   static const int kStringStartMinusOne = kSuccessfulCaptures - kPointerSize;
+  static const int kBacktrackCount = kStringStartMinusOne - kSystemPointerSize;
   // First register address. Following registers are below it on the stack.
-  static const int kRegisterZero = kStringStartMinusOne - kPointerSize;
+  static const int kRegisterZero = kBacktrackCount - kSystemPointerSize;
 
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
diff --git a/deps/v8/src/regexp/regexp-interpreter.cc b/deps/v8/src/regexp/regexp-interpreter.cc
index df72951afbbc51..a78d73f86359b9 100644
--- a/deps/v8/src/regexp/regexp-interpreter.cc
+++ b/deps/v8/src/regexp/regexp-interpreter.cc
@@ -8,6 +8,7 @@
 
 #include "src/ast/ast.h"
 #include "src/base/small-vector.h"
+#include "src/logging/counters.h"
 #include "src/objects/js-regexp-inl.h"
 #include "src/objects/objects-inl.h"
 #include "src/regexp/regexp-bytecodes.h"
@@ -88,11 +89,17 @@ int32_t Load32Aligned(const byte* pc) {
   return *reinterpret_cast<const int32_t*>(pc);
 }
 
-int32_t Load16Aligned(const byte* pc) {
+// TODO(jgruber): Rename to Load16AlignedUnsigned.
+uint32_t Load16Aligned(const byte* pc) {
   DCHECK_EQ(0, reinterpret_cast<intptr_t>(pc) & 1);
   return *reinterpret_cast<const uint16_t*>(pc);
 }
 
+int32_t Load16AlignedSigned(const byte* pc) {
+  DCHECK_EQ(0, reinterpret_cast<intptr_t>(pc) & 1);
+  return *reinterpret_cast<const int16_t*>(pc);
+}
+
 // A simple abstraction over the backtracking stack used by the interpreter.
 //
 // Despite the name 'backtracking' stack, it's actually used as a generic stack
@@ -302,7 +309,8 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
                                      String subject_string,
                                      Vector<const Char> subject, int* registers,
                                      int current, uint32_t current_char,
-                                     RegExp::CallOrigin call_origin) {
+                                     RegExp::CallOrigin call_origin,
+                                     const uint32_t backtrack_limit) {
   DisallowHeapAllocation no_gc;
 
 #if V8_USE_COMPUTED_GOTO
@@ -358,6 +366,8 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
 
   BacktrackStack backtrack_stack;
 
+  uint32_t backtrack_count = 0;
+
 #ifdef DEBUG
   if (FLAG_trace_regexp_bytecodes) {
     PrintF("\n\nStart bytecode interpreter\n\n");
@@ -434,6 +444,12 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(POP_BT) {
+      STATIC_ASSERT(JSRegExp::kNoBacktrackLimit == 0);
+      if (++backtrack_count == backtrack_limit) {
+        // Exceeded limits are treated as a failed match.
+        return IrregexpInterpreter::FAILURE;
+      }
+
       IrregexpInterpreter::Result return_code =
           HandleInterrupts(isolate, call_origin, &code_array, &subject_string,
                            &code_base, &subject, &pc);
@@ -447,8 +463,16 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       registers[insn >> BYTECODE_SHIFT] = backtrack_stack.pop();
       DISPATCH();
     }
-    BYTECODE(FAIL) { return IrregexpInterpreter::FAILURE; }
-    BYTECODE(SUCCEED) { return IrregexpInterpreter::SUCCESS; }
+    BYTECODE(FAIL) {
+      isolate->counters()->regexp_backtracks()->AddSample(
+          static_cast<int>(backtrack_count));
+      return IrregexpInterpreter::FAILURE;
+    }
+    BYTECODE(SUCCEED) {
+      isolate->counters()->regexp_backtracks()->AddSample(
+          static_cast<int>(backtrack_count));
+      return IrregexpInterpreter::SUCCESS;
+    }
     BYTECODE(ADVANCE_CP) {
       ADVANCE(ADVANCE_CP);
       current += insn >> BYTECODE_SHIFT;
@@ -817,7 +841,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     }
     BYTECODE(SKIP_UNTIL_CHAR) {
       int load_offset = (insn >> BYTECODE_SHIFT);
-      uint32_t advance = Load16Aligned(pc + 4);
+      int32_t advance = Load16AlignedSigned(pc + 4);
       uint32_t c = Load16Aligned(pc + 6);
       while (static_cast<uintptr_t>(current + load_offset) <
              static_cast<uintptr_t>(subject.length())) {
@@ -833,7 +857,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     }
     BYTECODE(SKIP_UNTIL_CHAR_AND) {
       int load_offset = (insn >> BYTECODE_SHIFT);
-      uint16_t advance = Load16Aligned(pc + 4);
+      int32_t advance = Load16AlignedSigned(pc + 4);
       uint16_t c = Load16Aligned(pc + 6);
       uint32_t mask = Load32Aligned(pc + 8);
       int32_t maximum_offset = Load32Aligned(pc + 12);
@@ -851,7 +875,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     }
     BYTECODE(SKIP_UNTIL_CHAR_POS_CHECKED) {
       int load_offset = (insn >> BYTECODE_SHIFT);
-      uint16_t advance = Load16Aligned(pc + 4);
+      int32_t advance = Load16AlignedSigned(pc + 4);
       uint16_t c = Load16Aligned(pc + 6);
       int32_t maximum_offset = Load32Aligned(pc + 8);
       while (static_cast<uintptr_t>(current + maximum_offset) <=
@@ -868,7 +892,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     }
     BYTECODE(SKIP_UNTIL_BIT_IN_TABLE) {
       int load_offset = (insn >> BYTECODE_SHIFT);
-      uint32_t advance = Load16Aligned(pc + 4);
+      int32_t advance = Load16AlignedSigned(pc + 4);
       const byte* table = pc + 8;
       while (static_cast<uintptr_t>(current + load_offset) <
              static_cast<uintptr_t>(subject.length())) {
@@ -884,7 +908,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     }
     BYTECODE(SKIP_UNTIL_GT_OR_NOT_BIT_IN_TABLE) {
       int load_offset = (insn >> BYTECODE_SHIFT);
-      uint16_t advance = Load16Aligned(pc + 4);
+      int32_t advance = Load16AlignedSigned(pc + 4);
       uint16_t limit = Load16Aligned(pc + 6);
       const byte* table = pc + 8;
       while (static_cast<uintptr_t>(current + load_offset) <
@@ -905,7 +929,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     }
     BYTECODE(SKIP_UNTIL_CHAR_OR_CHAR) {
       int load_offset = (insn >> BYTECODE_SHIFT);
-      uint32_t advance = Load32Aligned(pc + 4);
+      int32_t advance = Load32Aligned(pc + 4);
       uint16_t c = Load16Aligned(pc + 8);
       uint16_t c2 = Load16Aligned(pc + 10);
       while (static_cast<uintptr_t>(current + load_offset) <
@@ -963,13 +987,14 @@ IrregexpInterpreter::Result IrregexpInterpreter::Match(
   ByteArray code_array = ByteArray::cast(regexp.Bytecode(is_one_byte));
 
   return MatchInternal(isolate, code_array, subject_string, registers,
-                       registers_length, start_position, call_origin);
+                       registers_length, start_position, call_origin,
+                       regexp.BacktrackLimit());
 }
 
 IrregexpInterpreter::Result IrregexpInterpreter::MatchInternal(
     Isolate* isolate, ByteArray code_array, String subject_string,
     int* registers, int registers_length, int start_position,
-    RegExp::CallOrigin call_origin) {
+    RegExp::CallOrigin call_origin, uint32_t backtrack_limit) {
   DCHECK(subject_string.IsFlat());
 
   // Note: Heap allocation *is* allowed in two situations if calling from
@@ -992,13 +1017,15 @@ IrregexpInterpreter::Result IrregexpInterpreter::MatchInternal(
     Vector<const uint8_t> subject_vector = subject_content.ToOneByteVector();
     if (start_position != 0) previous_char = subject_vector[start_position - 1];
     return RawMatch(isolate, code_array, subject_string, subject_vector,
-                    registers, start_position, previous_char, call_origin);
+                    registers, start_position, previous_char, call_origin,
+                    backtrack_limit);
   } else {
     DCHECK(subject_content.IsTwoByte());
     Vector<const uc16> subject_vector = subject_content.ToUC16Vector();
     if (start_position != 0) previous_char = subject_vector[start_position - 1];
     return RawMatch(isolate, code_array, subject_string, subject_vector,
-                    registers, start_position, previous_char, call_origin);
+                    registers, start_position, previous_char, call_origin,
+                    backtrack_limit);
   }
 }
 
diff --git a/deps/v8/src/regexp/regexp-interpreter.h b/deps/v8/src/regexp/regexp-interpreter.h
index 2d0b74f1360f29..d77b5db8968bab 100644
--- a/deps/v8/src/regexp/regexp-interpreter.h
+++ b/deps/v8/src/regexp/regexp-interpreter.h
@@ -46,7 +46,8 @@ class V8_EXPORT_PRIVATE IrregexpInterpreter : public AllStatic {
   static Result MatchInternal(Isolate* isolate, ByteArray code_array,
                               String subject_string, int* registers,
                               int registers_length, int start_position,
-                              RegExp::CallOrigin call_origin);
+                              RegExp::CallOrigin call_origin,
+                              uint32_t backtrack_limit);
 
  private:
   static Result Match(Isolate* isolate, JSRegExp regexp, String subject_string,
diff --git a/deps/v8/src/regexp/regexp-macro-assembler.h b/deps/v8/src/regexp/regexp-macro-assembler.h
index ccf19d3fb689e5..bda7e5cce17565 100644
--- a/deps/v8/src/regexp/regexp-macro-assembler.h
+++ b/deps/v8/src/regexp/regexp-macro-assembler.h
@@ -172,6 +172,10 @@ class RegExpMacroAssembler {
   void set_slow_safe(bool ssc) { slow_safe_compiler_ = ssc; }
   bool slow_safe() { return slow_safe_compiler_; }
 
+  void set_backtrack_limit(uint32_t backtrack_limit) {
+    backtrack_limit_ = backtrack_limit;
+  }
+
   enum GlobalMode {
     NOT_GLOBAL,
     GLOBAL_NO_ZERO_LENGTH_CHECK,
@@ -190,8 +194,15 @@ class RegExpMacroAssembler {
   Isolate* isolate() const { return isolate_; }
   Zone* zone() const { return zone_; }
 
+ protected:
+  bool has_backtrack_limit() const {
+    return backtrack_limit_ != JSRegExp::kNoBacktrackLimit;
+  }
+  uint32_t backtrack_limit() const { return backtrack_limit_; }
+
  private:
   bool slow_safe_compiler_;
+  uint32_t backtrack_limit_ = JSRegExp::kNoBacktrackLimit;
   GlobalMode global_mode_;
   Isolate* isolate_;
   Zone* zone_;
diff --git a/deps/v8/src/regexp/regexp-stack.cc b/deps/v8/src/regexp/regexp-stack.cc
index a6a128841fe7e0..7f47aec5ae4605 100644
--- a/deps/v8/src/regexp/regexp-stack.cc
+++ b/deps/v8/src/regexp/regexp-stack.cc
@@ -22,17 +22,23 @@ RegExpStackScope::~RegExpStackScope() {
   regexp_stack_->Reset();
 }
 
-RegExpStack::RegExpStack() : isolate_(nullptr) {}
-
-RegExpStack::~RegExpStack() {
-  thread_local_.Free();
-}
+RegExpStack::RegExpStack() : thread_local_(this), isolate_(nullptr) {}
 
+RegExpStack::~RegExpStack() { thread_local_.FreeAndInvalidate(); }
 
 char* RegExpStack::ArchiveStack(char* to) {
+  if (!thread_local_.owns_memory_) {
+    // Force dynamic stacks prior to archiving. Any growth will do. A dynamic
+    // stack is needed because stack archival & restoration rely on `memory_`
+    // pointing at a fixed-location backing store, whereas the static stack is
+    // tied to a RegExpStack instance.
+    EnsureCapacity(thread_local_.memory_size_ + 1);
+    DCHECK(thread_local_.owns_memory_);
+  }
+
   size_t size = sizeof(thread_local_);
   MemCopy(reinterpret_cast<void*>(to), &thread_local_, size);
-  thread_local_ = ThreadLocal();
+  thread_local_ = ThreadLocal(this);
   return to + size;
 }
 
@@ -43,39 +49,47 @@ char* RegExpStack::RestoreStack(char* from) {
   return from + size;
 }
 
+void RegExpStack::Reset() { thread_local_.ResetToStaticStack(this); }
 
-void RegExpStack::Reset() {
-  if (thread_local_.memory_size_ > kMinimumStackSize) {
-    DeleteArray(thread_local_.memory_);
-    thread_local_ = ThreadLocal();
-  }
+void RegExpStack::ThreadLocal::ResetToStaticStack(RegExpStack* regexp_stack) {
+  if (owns_memory_) DeleteArray(memory_);
+
+  memory_ = regexp_stack->static_stack_;
+  memory_top_ = regexp_stack->static_stack_ + kStaticStackSize;
+  memory_size_ = kStaticStackSize;
+  limit_ = reinterpret_cast<Address>(regexp_stack->static_stack_) +
+           kStackLimitSlack * kSystemPointerSize;
+  owns_memory_ = false;
 }
 
+void RegExpStack::ThreadLocal::FreeAndInvalidate() {
+  if (owns_memory_) DeleteArray(memory_);
 
-void RegExpStack::ThreadLocal::Free() {
-  if (memory_size_ > 0) {
-    DeleteArray(memory_);
-    Clear();
-  }
+  // This stack may not be used after being freed. Just reset to invalid values
+  // to ensure we don't accidentally use old memory areas.
+  memory_ = nullptr;
+  memory_top_ = nullptr;
+  memory_size_ = 0;
+  limit_ = kMemoryTop;
 }
 
-
 Address RegExpStack::EnsureCapacity(size_t size) {
   if (size > kMaximumStackSize) return kNullAddress;
-  if (size < kMinimumStackSize) size = kMinimumStackSize;
+  if (size < kMinimumDynamicStackSize) size = kMinimumDynamicStackSize;
   if (thread_local_.memory_size_ < size) {
     byte* new_memory = NewArray<byte>(size);
     if (thread_local_.memory_size_ > 0) {
       // Copy original memory into top of new memory.
       MemCopy(new_memory + size - thread_local_.memory_size_,
               thread_local_.memory_, thread_local_.memory_size_);
-      DeleteArray(thread_local_.memory_);
+      if (thread_local_.owns_memory_) DeleteArray(thread_local_.memory_);
     }
     thread_local_.memory_ = new_memory;
     thread_local_.memory_top_ = new_memory + size;
     thread_local_.memory_size_ = size;
     thread_local_.limit_ = reinterpret_cast<Address>(new_memory) +
                            kStackLimitSlack * kSystemPointerSize;
+    thread_local_.owns_memory_ = true;
   }
   return reinterpret_cast<Address>(thread_local_.memory_top_);
 }
diff --git a/deps/v8/src/regexp/regexp-stack.h b/deps/v8/src/regexp/regexp-stack.h
index d3c5415f1f3cd5..cd199adfb2c3ab 100644
--- a/deps/v8/src/regexp/regexp-stack.h
+++ b/deps/v8/src/regexp/regexp-stack.h
@@ -41,7 +41,7 @@ class RegExpStack {
   // Number of allocated locations on the stack below the limit.
   // No sequence of pushes must be longer that this without doing a stack-limit
   // check.
-  static const int kStackLimitSlack = 32;
+  static constexpr int kStackLimitSlack = 32;
 
   // Gives the top of the memory used as stack.
   Address stack_base() {
@@ -66,12 +66,12 @@ class RegExpStack {
   Address EnsureCapacity(size_t size);
 
   // Thread local archiving.
-  static int ArchiveSpacePerThread() {
+  static constexpr int ArchiveSpacePerThread() {
     return static_cast<int>(sizeof(ThreadLocal));
   }
   char* ArchiveStack(char* to);
   char* RestoreStack(char* from);
-  void FreeThreadResources() { thread_local_.Free(); }
+  void FreeThreadResources() { thread_local_.ResetToStaticStack(this); }
 
   // Maximal size of allocated stack area.
   static constexpr size_t kMaximumStackSize = 64 * MB;
@@ -80,41 +80,43 @@ class RegExpStack {
   RegExpStack();
   ~RegExpStack();
 
-  // Artificial limit used when no memory has been allocated.
+  // Artificial limit used when the thread-local state has been destroyed.
   static const Address kMemoryTop =
       static_cast<Address>(static_cast<uintptr_t>(-1));
 
-  // Minimal size of allocated stack area.
-  static const size_t kMinimumStackSize = 1 * KB;
+  // Minimal size of dynamically-allocated stack area.
+  static constexpr size_t kMinimumDynamicStackSize = 1 * KB;
+
+  // In addition to dynamically-allocated, variable-sized stacks, we also have
+  // a statically allocated and sized area that is used whenever no dynamic
+  // stack is allocated. This guarantees that a stack is always available and
+  // we can skip availability-checks later on.
+  // It's double the slack size to ensure that we have a bit of breathing room
+  // before NativeRegExpMacroAssembler::GrowStack must be called.
+  static constexpr size_t kStaticStackSize =
+      2 * kStackLimitSlack * kSystemPointerSize;
+  byte static_stack_[kStaticStackSize] = {0};
+
+  STATIC_ASSERT(kStaticStackSize <= kMaximumStackSize);
 
   // Structure holding the allocated memory, size and limit.
   struct ThreadLocal {
-    ThreadLocal() { Clear(); }
+    explicit ThreadLocal(RegExpStack* regexp_stack) {
+      ResetToStaticStack(regexp_stack);
+    }
+
     // If memory_size_ > 0 then memory_ and memory_top_ must be non-nullptr
     // and memory_top_ = memory_ + memory_size_
-    byte* memory_;
-    byte* memory_top_;
-    size_t memory_size_;
-    Address limit_;
-    void Clear() {
-      memory_ = nullptr;
-      memory_top_ = nullptr;
-      memory_size_ = 0;
-      limit_ = kMemoryTop;
-    }
-    void Free();
+    byte* memory_ = nullptr;
+    byte* memory_top_ = nullptr;
+    size_t memory_size_ = 0;
+    Address limit_ = kNullAddress;
+    bool owns_memory_ = false;  // Whether memory_ is owned and must be freed.
+
+    void ResetToStaticStack(RegExpStack* regexp_stack);
+    void FreeAndInvalidate();
   };
 
-  // Address of allocated memory.
-  Address memory_address_address() {
-    return reinterpret_cast<Address>(&thread_local_.memory_);
-  }
-
-  // Address of size of allocated memory.
-  Address memory_size_address() {
-    return reinterpret_cast<Address>(&thread_local_.memory_size_);
-  }
-
   // Address of top of memory used as stack.
   Address memory_top_address_address() {
     return reinterpret_cast<Address>(&thread_local_.memory_top_);
diff --git a/deps/v8/src/regexp/regexp.cc b/deps/v8/src/regexp/regexp.cc
index a4ab48ed0ed5be..3632deaeb8ee03 100644
--- a/deps/v8/src/regexp/regexp.cc
+++ b/deps/v8/src/regexp/regexp.cc
@@ -33,7 +33,8 @@ class RegExpImpl final : public AllStatic {
   // Prepares a JSRegExp object with Irregexp-specific data.
   static void IrregexpInitialize(Isolate* isolate, Handle<JSRegExp> re,
                                  Handle<String> pattern, JSRegExp::Flags flags,
-                                 int capture_register_count);
+                                 int capture_register_count,
+                                 uint32_t backtrack_limit);
 
   static void AtomCompile(Isolate* isolate, Handle<JSRegExp> re,
                           Handle<String> pattern, JSRegExp::Flags flags,
@@ -75,7 +76,8 @@ class RegExpImpl final : public AllStatic {
   // Returns true on success, false on failure.
   static bool Compile(Isolate* isolate, Zone* zone, RegExpCompileData* input,
                       JSRegExp::Flags flags, Handle<String> pattern,
-                      Handle<String> sample_subject, bool is_one_byte);
+                      Handle<String> sample_subject, bool is_one_byte,
+                      uint32_t backtrack_limit);
 
   // For acting on the JSRegExp data FixedArray.
   static int IrregexpMaxRegisterCount(FixedArray re);
@@ -131,17 +133,27 @@ static bool HasFewDifferentCharacters(Handle<String> pattern) {
 // static
 MaybeHandle<Object> RegExp::Compile(Isolate* isolate, Handle<JSRegExp> re,
                                     Handle<String> pattern,
-                                    JSRegExp::Flags flags) {
+                                    JSRegExp::Flags flags,
+                                    uint32_t backtrack_limit) {
   DCHECK(pattern->IsFlat());
 
+  // Caching is based only on the pattern and flags, but code also differs when
+  // a backtrack limit is set. A present backtrack limit is very much *not* the
+  // common case, so just skip the cache for these.
+  const bool is_compilation_cache_enabled =
+      (backtrack_limit == JSRegExp::kNoBacktrackLimit);
+
   Zone zone(isolate->allocator(), ZONE_NAME);
-  CompilationCache* compilation_cache = isolate->compilation_cache();
-  MaybeHandle<FixedArray> maybe_cached =
-      compilation_cache->LookupRegExp(pattern, flags);
-  Handle<FixedArray> cached;
-  if (maybe_cached.ToHandle(&cached)) {
-    re->set_data(*cached);
-    return re;
+  CompilationCache* compilation_cache = nullptr;
+  if (is_compilation_cache_enabled) {
+    compilation_cache = isolate->compilation_cache();
+    MaybeHandle<FixedArray> maybe_cached =
+        compilation_cache->LookupRegExp(pattern, flags);
+    Handle<FixedArray> cached;
+    if (maybe_cached.ToHandle(&cached)) {
+      re->set_data(*cached);
+      return re;
+    }
   }
 
   PostponeInterruptsScope postpone(isolate);
@@ -176,13 +188,15 @@ MaybeHandle<Object> RegExp::Compile(Isolate* isolate, Handle<JSRegExp> re,
   }
   if (!has_been_compiled) {
     RegExpImpl::IrregexpInitialize(isolate, re, pattern, flags,
-                                   parse_result.capture_count);
+                                   parse_result.capture_count, backtrack_limit);
   }
   DCHECK(re->data().IsFixedArray());
   // Compilation succeeded so the data is set on the regexp
   // and we can store it in the cache.
   Handle<FixedArray> data(FixedArray::cast(re->data()), isolate);
-  compilation_cache->PutRegExp(pattern, flags, data);
+  if (is_compilation_cache_enabled) {
+    compilation_cache->PutRegExp(pattern, flags, data);
+  }
 
   return re;
 }
@@ -391,7 +405,7 @@ bool RegExpImpl::CompileIrregexp(Isolate* isolate, Handle<JSRegExp> re,
                                         : RegExpCompilationTarget::kNative;
   const bool compilation_succeeded =
       Compile(isolate, &zone, &compile_data, flags, pattern, sample_subject,
-              is_one_byte);
+              is_one_byte, re->BacktrackLimit());
   if (!compilation_succeeded) {
     DCHECK(!compile_data.error.is_null());
     ThrowRegExpException(isolate, re, compile_data.error);
@@ -445,7 +459,7 @@ void RegExpImpl::SetIrregexpMaxRegisterCount(FixedArray re, int value) {
 void RegExpImpl::SetIrregexpCaptureNameMap(FixedArray re,
                                            Handle<FixedArray> value) {
   if (value.is_null()) {
-    re.set(JSRegExp::kIrregexpCaptureNameMapIndex, Smi::kZero);
+    re.set(JSRegExp::kIrregexpCaptureNameMapIndex, Smi::zero());
   } else {
     re.set(JSRegExp::kIrregexpCaptureNameMapIndex, *value);
   }
@@ -469,10 +483,11 @@ Code RegExpImpl::IrregexpNativeCode(FixedArray re, bool is_one_byte) {
 
 void RegExpImpl::IrregexpInitialize(Isolate* isolate, Handle<JSRegExp> re,
                                     Handle<String> pattern,
-                                    JSRegExp::Flags flags, int capture_count) {
+                                    JSRegExp::Flags flags, int capture_count,
+                                    uint32_t backtrack_limit) {
   // Initialize compiled code entries to null.
-  isolate->factory()->SetRegExpIrregexpData(re, JSRegExp::IRREGEXP, pattern,
-                                            flags, capture_count);
+  isolate->factory()->SetRegExpIrregexpData(
+      re, JSRegExp::IRREGEXP, pattern, flags, capture_count, backtrack_limit);
 }
 
 // static
@@ -658,12 +673,8 @@ Handle<RegExpMatchInfo> RegExp::SetLastMatchInfo(
   // regexp, RegExpExecStub finds that the match info is too small, it restarts
   // execution in RegExpImpl::Exec, which finally grows the match info right
   // here.
-
-  int capture_register_count = (capture_count + 1) * 2;
-  Handle<RegExpMatchInfo> result = RegExpMatchInfo::ReserveCaptures(
-      isolate, last_match_info, capture_register_count);
-  result->SetNumberOfCaptureRegisters(capture_register_count);
-
+  Handle<RegExpMatchInfo> result =
+      RegExpMatchInfo::ReserveCaptures(isolate, last_match_info, capture_count);
   if (*result != *last_match_info) {
     if (*last_match_info == *isolate->regexp_last_match_info()) {
       // This inner condition is only needed for special situations like the
@@ -674,6 +685,7 @@ Handle<RegExpMatchInfo> RegExp::SetLastMatchInfo(
     }
   }
 
+  int capture_register_count = (capture_count + 1) * 2;
   DisallowHeapAllocation no_allocation;
   if (match != nullptr) {
     for (int i = 0; i < capture_register_count; i += 2) {
@@ -719,12 +731,14 @@ bool RegExp::CompileForTesting(Isolate* isolate, Zone* zone,
                                Handle<String> sample_subject,
                                bool is_one_byte) {
   return RegExpImpl::Compile(isolate, zone, data, flags, pattern,
-                             sample_subject, is_one_byte);
+                             sample_subject, is_one_byte,
+                             JSRegExp::kNoBacktrackLimit);
 }
 
 bool RegExpImpl::Compile(Isolate* isolate, Zone* zone, RegExpCompileData* data,
                          JSRegExp::Flags flags, Handle<String> pattern,
-                         Handle<String> sample_subject, bool is_one_byte) {
+                         Handle<String> sample_subject, bool is_one_byte,
+                         uint32_t backtrack_limit) {
   if ((data->capture_count + 1) * 2 - 1 > RegExpMacroAssembler::kMaxRegister) {
     data->error =
         isolate->factory()->NewStringFromAsciiChecked("RegExp too big");
@@ -844,6 +858,7 @@ bool RegExpImpl::Compile(Isolate* isolate, Zone* zone, RegExpCompileData* data,
   }
 
   macro_assembler->set_slow_safe(TooMuchRegExpCode(isolate, pattern));
+  macro_assembler->set_backtrack_limit(backtrack_limit);
 
   // Inserted here, instead of in Assembler, because it depends on information
   // in the AST that isn't replicated in the Node structure.
@@ -887,12 +902,11 @@ bool RegExpImpl::Compile(Isolate* isolate, Zone* zone, RegExpCompileData* data,
     }
   }
 
-  if (FLAG_correctness_fuzzer_suppressions &&
-      strncmp(result.error_message, "Stack overflow", 15) == 0) {
-    FATAL("Aborting on stack overflow");
-  }
-
   if (result.error_message != nullptr) {
+    if (FLAG_correctness_fuzzer_suppressions &&
+        strncmp(result.error_message, "Stack overflow", 15) == 0) {
+      FATAL("Aborting on stack overflow");
+    }
     data->error =
         isolate->factory()->NewStringFromAsciiChecked(result.error_message);
   }
@@ -1029,10 +1043,10 @@ Object RegExpResultsCache::Lookup(Heap* heap, String key_string,
                                   FixedArray* last_match_cache,
                                   ResultsCacheType type) {
   FixedArray cache;
-  if (!key_string.IsInternalizedString()) return Smi::kZero;
+  if (!key_string.IsInternalizedString()) return Smi::zero();
   if (type == STRING_SPLIT_SUBSTRINGS) {
     DCHECK(key_pattern.IsString());
-    if (!key_pattern.IsInternalizedString()) return Smi::kZero;
+    if (!key_pattern.IsInternalizedString()) return Smi::zero();
     cache = heap->string_split_cache();
   } else {
     DCHECK(type == REGEXP_MULTIPLE_INDICES);
@@ -1049,7 +1063,7 @@ Object RegExpResultsCache::Lookup(Heap* heap, String key_string,
         ((index + kArrayEntriesPerCacheEntry) & (kRegExpResultsCacheSize - 1));
     if (cache.get(index + kStringOffset) != key_string ||
         cache.get(index + kPatternOffset) != key_pattern) {
-      return Smi::kZero;
+      return Smi::zero();
     }
   }
 
@@ -1078,7 +1092,7 @@ void RegExpResultsCache::Enter(Isolate* isolate, Handle<String> key_string,
   uint32_t hash = key_string->Hash();
   uint32_t index = ((hash & (kRegExpResultsCacheSize - 1)) &
                     ~(kArrayEntriesPerCacheEntry - 1));
-  if (cache->get(index + kStringOffset) == Smi::kZero) {
+  if (cache->get(index + kStringOffset) == Smi::zero()) {
     cache->set(index + kStringOffset, *key_string);
     cache->set(index + kPatternOffset, *key_pattern);
     cache->set(index + kArrayOffset, *value_array);
@@ -1086,16 +1100,16 @@ void RegExpResultsCache::Enter(Isolate* isolate, Handle<String> key_string,
   } else {
     uint32_t index2 =
         ((index + kArrayEntriesPerCacheEntry) & (kRegExpResultsCacheSize - 1));
-    if (cache->get(index2 + kStringOffset) == Smi::kZero) {
+    if (cache->get(index2 + kStringOffset) == Smi::zero()) {
       cache->set(index2 + kStringOffset, *key_string);
       cache->set(index2 + kPatternOffset, *key_pattern);
       cache->set(index2 + kArrayOffset, *value_array);
       cache->set(index2 + kLastMatchOffset, *last_match_cache);
     } else {
-      cache->set(index2 + kStringOffset, Smi::kZero);
-      cache->set(index2 + kPatternOffset, Smi::kZero);
-      cache->set(index2 + kArrayOffset, Smi::kZero);
-      cache->set(index2 + kLastMatchOffset, Smi::kZero);
+      cache->set(index2 + kStringOffset, Smi::zero());
+      cache->set(index2 + kPatternOffset, Smi::zero());
+      cache->set(index2 + kArrayOffset, Smi::zero());
+      cache->set(index2 + kLastMatchOffset, Smi::zero());
       cache->set(index + kStringOffset, *key_string);
       cache->set(index + kPatternOffset, *key_pattern);
       cache->set(index + kArrayOffset, *value_array);
@@ -1118,7 +1132,7 @@ void RegExpResultsCache::Enter(Isolate* isolate, Handle<String> key_string,
 
 void RegExpResultsCache::Clear(FixedArray cache) {
   for (int i = 0; i < kRegExpResultsCacheSize; i++) {
-    cache.set(i, Smi::kZero);
+    cache.set(i, Smi::zero());
   }
 }
 
diff --git a/deps/v8/src/regexp/regexp.h b/deps/v8/src/regexp/regexp.h
index 6625b063bcf320..9f3581d18e262e 100644
--- a/deps/v8/src/regexp/regexp.h
+++ b/deps/v8/src/regexp/regexp.h
@@ -15,6 +15,7 @@ class RegExpTree;
 
 enum class RegExpCompilationTarget : int { kBytecode, kNative };
 
+// TODO(jgruber): Do not expose in regexp.h.
 // TODO(jgruber): Consider splitting between ParseData and CompileData.
 struct RegExpCompileData {
   // The parsed AST as produced by the RegExpParser.
@@ -66,7 +67,7 @@ class RegExp final : public AllStatic {
   // Returns false if compilation fails.
   V8_WARN_UNUSED_RESULT static MaybeHandle<Object> Compile(
       Isolate* isolate, Handle<JSRegExp> re, Handle<String> pattern,
-      JSRegExp::Flags flags);
+      JSRegExp::Flags flags, uint32_t backtrack_limit);
 
   enum CallOrigin : int {
     kFromRuntime = 0,
diff --git a/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.cc b/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.cc
index 853d8b2815cdcd..bcef02369fa38b 100644
--- a/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.cc
+++ b/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.cc
@@ -164,6 +164,19 @@ void RegExpMacroAssemblerS390::AdvanceRegister(int reg, int by) {
 
 void RegExpMacroAssemblerS390::Backtrack() {
   CheckPreemption();
+  if (has_backtrack_limit()) {
+    Label next;
+    __ LoadP(r2, MemOperand(frame_pointer(), kBacktrackCount), r0);
+    __ AddP(r2, r2, Operand(1));
+    __ StoreP(r2, MemOperand(frame_pointer(), kBacktrackCount), r0);
+    __ CmpLogicalP(r2, Operand(backtrack_limit()));
+    __ bne(&next);
+
+    // Exceeded limits are treated as a failed match.
+    Fail();
+
+    __ bind(&next);
+  }
   // Pop Code offset from backtrack stack, add Code and jump to location.
   Pop(r2);
   __ AddP(r2, code_pointer());
@@ -659,10 +672,14 @@ Handle<HeapObject> RegExpMacroAssemblerS390::GetCode(Handle<String> source) {
   // from generated code.
   __ LoadRR(frame_pointer(), sp);
   __ lay(sp, MemOperand(sp, -10 * kSystemPointerSize));
+  STATIC_ASSERT(kSuccessfulCaptures == kInputString - kSystemPointerSize);
   __ mov(r1, Operand::Zero());  // success counter
+  STATIC_ASSERT(kStringStartMinusOne ==
+                kSuccessfulCaptures - kSystemPointerSize);
   __ LoadRR(r0, r1);            // offset of location
   __ StoreMultipleP(r0, r9, MemOperand(sp, 0));
-
+  STATIC_ASSERT(kBacktrackCount == kStringStartMinusOne - kSystemPointerSize);
+  __ Push(r1);  // The backtrack counter.
   // Check if we have space on the stack for registers.
   Label stack_limit_hit;
   Label stack_ok;
@@ -940,7 +957,7 @@ Handle<HeapObject> RegExpMacroAssemblerS390::GetCode(Handle<String> source) {
                           .set_self_reference(masm_->CodeObject())
                           .Build();
   PROFILE(masm_->isolate(),
-          RegExpCodeCreateEvent(AbstractCode::cast(*code), *source));
+          RegExpCodeCreateEvent(Handle<AbstractCode>::cast(code), source));
   return Handle<HeapObject>::cast(code);
 }
 
diff --git a/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.h b/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.h
index 4811ac7382a8c1..4f79296d78cd2c 100644
--- a/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.h
+++ b/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.h
@@ -114,8 +114,9 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerS390
   static const int kSuccessfulCaptures = kInputString - kSystemPointerSize;
   static const int kStringStartMinusOne =
       kSuccessfulCaptures - kSystemPointerSize;
+  static const int kBacktrackCount = kStringStartMinusOne - kSystemPointerSize;
   // First register address. Following registers are below it on the stack.
-  static const int kRegisterZero = kStringStartMinusOne - kSystemPointerSize;
+  static const int kRegisterZero = kBacktrackCount - kSystemPointerSize;
 
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
diff --git a/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.cc b/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.cc
index 4352c3f67f3686..5620c6b9ce8767 100644
--- a/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.cc
+++ b/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.cc
@@ -151,6 +151,17 @@ void RegExpMacroAssemblerX64::AdvanceRegister(int reg, int by) {
 
 void RegExpMacroAssemblerX64::Backtrack() {
   CheckPreemption();
+  if (has_backtrack_limit()) {
+    Label next;
+    __ incq(Operand(rbp, kBacktrackCount));
+    __ cmpq(Operand(rbp, kBacktrackCount), Immediate(backtrack_limit()));
+    __ j(not_equal, &next);
+
+    // Exceeded limits are treated as a failed match.
+    Fail();
+
+    __ bind(&next);
+  }
   // Pop Code offset from backtrack stack, add Code and jump to location.
   Pop(rbx);
   __ addq(rbx, code_object_pointer());
@@ -713,8 +724,14 @@ Handle<HeapObject> RegExpMacroAssemblerX64::GetCode(Handle<String> source) {
   __ pushq(rbx);  // Callee-save
 #endif
 
+  STATIC_ASSERT(kSuccessfulCaptures ==
+                kLastCalleeSaveRegister - kSystemPointerSize);
   __ Push(Immediate(0));  // Number of successful matches in a global regexp.
+  STATIC_ASSERT(kStringStartMinusOne ==
+                kSuccessfulCaptures - kSystemPointerSize);
   __ Push(Immediate(0));  // Make room for "string start - 1" constant.
+  STATIC_ASSERT(kBacktrackCount == kStringStartMinusOne - kSystemPointerSize);
+  __ Push(Immediate(0));  // The backtrack counter.
 
   // Check if we have space on the stack for registers.
   Label stack_limit_hit;
@@ -997,7 +1014,8 @@ Handle<HeapObject> RegExpMacroAssemblerX64::GetCode(Handle<String> source) {
   Handle<Code> code = Factory::CodeBuilder(isolate, code_desc, Code::REGEXP)
                           .set_self_reference(masm_.CodeObject())
                           .Build();
-  PROFILE(isolate, RegExpCodeCreateEvent(AbstractCode::cast(*code), *source));
+  PROFILE(isolate,
+          RegExpCodeCreateEvent(Handle<AbstractCode>::cast(code), source));
   return Handle<HeapObject>::cast(code);
 }
 
diff --git a/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.h b/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.h
index 1d95a2718fba1a..0bf1c2e15031af 100644
--- a/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.h
+++ b/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.h
@@ -146,15 +146,16 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerX64
   static const int kLastCalleeSaveRegister = kBackup_rbx;
 #endif
 
-  static const int kSuccessfulCaptures =
-      kLastCalleeSaveRegister - kSystemPointerSize;
   // When adding local variables remember to push space for them in
   // the frame in GetCode.
+  static const int kSuccessfulCaptures =
+      kLastCalleeSaveRegister - kSystemPointerSize;
   static const int kStringStartMinusOne =
       kSuccessfulCaptures - kSystemPointerSize;
+  static const int kBacktrackCount = kStringStartMinusOne - kSystemPointerSize;
 
   // First register address. Following registers are below it on the stack.
-  static const int kRegisterZero = kStringStartMinusOne - kSystemPointerSize;
+  static const int kRegisterZero = kBacktrackCount - kSystemPointerSize;
 
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
diff --git a/deps/v8/src/roots/roots-inl.h b/deps/v8/src/roots/roots-inl.h
index 4513f7ba978428..65c0c4a3245db6 100644
--- a/deps/v8/src/roots/roots-inl.h
+++ b/deps/v8/src/roots/roots-inl.h
@@ -9,6 +9,7 @@
 
 #include "src/execution/isolate.h"
 #include "src/handles/handles.h"
+#include "src/heap/off-thread-factory.h"
 #include "src/heap/read-only-heap.h"
 #include "src/objects/api-callbacks.h"
 #include "src/objects/descriptor-array.h"
@@ -65,6 +66,9 @@ ReadOnlyRoots::ReadOnlyRoots(Isolate* isolate)
     : read_only_roots_(reinterpret_cast<Address*>(
           isolate->roots_table().read_only_roots_begin().address())) {}
 
+ReadOnlyRoots::ReadOnlyRoots(OffThreadFactory* factory)
+    : ReadOnlyRoots(factory->read_only_roots()) {}
+
 ReadOnlyRoots::ReadOnlyRoots(Address* ro_roots) : read_only_roots_(ro_roots) {}
 
 // We use unchecked_cast below because we trust our read-only roots to
diff --git a/deps/v8/src/roots/roots.h b/deps/v8/src/roots/roots.h
index c262f639282aaf..391c1faceafb86 100644
--- a/deps/v8/src/roots/roots.h
+++ b/deps/v8/src/roots/roots.h
@@ -17,6 +17,7 @@ namespace internal {
 
 // Forward declarations.
 enum ElementsKind : uint8_t;
+class OffThreadFactory;
 template <typename T>
 class Handle;
 class Heap;
@@ -54,12 +55,12 @@ class Symbol;
   V(Map, scope_info_map, ScopeInfoMap)                                         \
   V(Map, shared_function_info_map, SharedFunctionInfoMap)                      \
   V(Map, code_map, CodeMap)                                                    \
-  V(Map, function_context_map, FunctionContextMap)                             \
   V(Map, cell_map, CellMap)                                                    \
   V(Map, global_property_cell_map, GlobalPropertyCellMap)                      \
   V(Map, foreign_map, ForeignMap)                                              \
   V(Map, heap_number_map, HeapNumberMap)                                       \
   V(Map, transition_array_map, TransitionArrayMap)                             \
+  V(Map, thin_one_byte_string_map, ThinOneByteStringMap)                       \
   /* TODO(mythria): Once lazy feedback lands, check if feedback vector map */  \
   /* is still a popular map */                                                 \
   V(Map, feedback_vector_map, FeedbackVectorMap)                               \
@@ -73,18 +74,8 @@ class Symbol;
   V(Oddball, termination_exception, TerminationException)                      \
   V(Oddball, optimized_out, OptimizedOut)                                      \
   V(Oddball, stale_register, StaleRegister)                                    \
-  /* Context maps */                                                           \
-  V(Map, native_context_map, NativeContextMap)                                 \
-  V(Map, module_context_map, ModuleContextMap)                                 \
-  V(Map, eval_context_map, EvalContextMap)                                     \
-  V(Map, script_context_map, ScriptContextMap)                                 \
-  V(Map, await_context_map, AwaitContextMap)                                   \
-  V(Map, block_context_map, BlockContextMap)                                   \
-  V(Map, catch_context_map, CatchContextMap)                                   \
-  V(Map, with_context_map, WithContextMap)                                     \
-  V(Map, debug_evaluate_context_map, DebugEvaluateContextMap)                  \
-  V(Map, script_context_table_map, ScriptContextTableMap)                      \
   /* Maps */                                                                   \
+  V(Map, script_context_table_map, ScriptContextTableMap)                      \
   V(Map, closure_feedback_cell_array_map, ClosureFeedbackCellArrayMap)         \
   V(Map, feedback_metadata_map, FeedbackMetadataArrayMap)                      \
   V(Map, array_list_map, ArrayListMap)                                         \
@@ -129,11 +120,9 @@ class Symbol;
   V(Map, embedder_data_array_map, EmbedderDataArrayMap)                        \
   V(Map, weak_cell_map, WeakCellMap)                                           \
   /* String maps */                                                            \
-  V(Map, native_source_string_map, NativeSourceStringMap)                      \
   V(Map, string_map, StringMap)                                                \
   V(Map, cons_one_byte_string_map, ConsOneByteStringMap)                       \
   V(Map, cons_string_map, ConsStringMap)                                       \
-  V(Map, thin_one_byte_string_map, ThinOneByteStringMap)                       \
   V(Map, thin_string_map, ThinStringMap)                                       \
   V(Map, sliced_string_map, SlicedStringMap)                                   \
   V(Map, sliced_one_byte_string_map, SlicedOneByteStringMap)                   \
@@ -201,6 +190,7 @@ class Symbol;
   /* Canonical scope infos */                                                  \
   V(ScopeInfo, global_this_binding_scope_info, GlobalThisBindingScopeInfo)     \
   V(ScopeInfo, empty_function_scope_info, EmptyFunctionScopeInfo)              \
+  V(ScopeInfo, native_scope_info, NativeScopeInfo)                             \
   /* Hash seed */                                                              \
   V(ByteArray, hash_seed, HashSeed)
 
@@ -490,6 +480,7 @@ class ReadOnlyRoots {
 
   V8_INLINE explicit ReadOnlyRoots(Heap* heap);
   V8_INLINE explicit ReadOnlyRoots(Isolate* isolate);
+  V8_INLINE explicit ReadOnlyRoots(OffThreadFactory* factory);
 
 #define ROOT_ACCESSOR(Type, name, CamelName) \
   V8_INLINE class Type name() const;         \
diff --git a/deps/v8/src/runtime/runtime-array.cc b/deps/v8/src/runtime/runtime-array.cc
index 34a8b2b93785ef..52c9c3098b105c 100644
--- a/deps/v8/src/runtime/runtime-array.cc
+++ b/deps/v8/src/runtime/runtime-array.cc
@@ -162,16 +162,26 @@ RUNTIME_FUNCTION(Runtime_GrowArrayElements) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
-  CONVERT_NUMBER_CHECKED(int, key, Int32, args[1]);
-
-  if (key < 0) return Smi::kZero;
+  CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
+  uint32_t index;
+  if (key->IsSmi()) {
+    int value = Smi::ToInt(*key);
+    if (value < 0) return Smi::zero();
+    index = static_cast<uint32_t>(value);
+  } else {
+    CHECK(key->IsHeapNumber());
+    double value = HeapNumber::cast(*key).value();
+    if (value < 0 || value > std::numeric_limits<uint32_t>::max()) {
+      return Smi::zero();
+    }
+    index = static_cast<uint32_t>(value);
+  }
 
   uint32_t capacity = static_cast<uint32_t>(object->elements().length());
-  uint32_t index = static_cast<uint32_t>(key);
 
   if (index >= capacity) {
     if (!object->GetElementsAccessor()->GrowCapacity(object, index)) {
-      return Smi::kZero;
+      return Smi::zero();
     }
   }
 
@@ -278,9 +288,8 @@ RUNTIME_FUNCTION(Runtime_ArrayIncludes_Slow) {
       JSObject::PrototypeHasNoElements(isolate, JSObject::cast(*object))) {
     Handle<JSObject> obj = Handle<JSObject>::cast(object);
     ElementsAccessor* elements = obj->GetElementsAccessor();
-    Maybe<bool> result = elements->IncludesValue(isolate, obj, search_element,
-                                                 static_cast<uint32_t>(index),
-                                                 static_cast<uint32_t>(len));
+    Maybe<bool> result =
+        elements->IncludesValue(isolate, obj, search_element, index, len);
     MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
     return *isolate->factory()->ToBoolean(result.FromJust());
   }
@@ -292,11 +301,8 @@ RUNTIME_FUNCTION(Runtime_ArrayIncludes_Slow) {
     // Let elementK be the result of ? Get(O, ! ToString(k)).
     Handle<Object> element_k;
     {
-      Handle<Object> index_obj = isolate->factory()->NewNumberFromInt64(index);
-      bool success;
-      LookupIterator it = LookupIterator::PropertyOrElement(
-          isolate, object, index_obj, &success);
-      DCHECK(success);
+      LookupIterator::Key key(isolate, static_cast<double>(index));
+      LookupIterator it(isolate, object, key);
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, element_k,
                                          Object::GetProperty(&it));
     }
@@ -386,24 +392,21 @@ RUNTIME_FUNCTION(Runtime_ArrayIndexOf) {
     return *isolate->factory()->NewNumberFromInt64(result.FromJust());
   }
 
-  // Otherwise, perform slow lookups for special receiver types
+  // Otherwise, perform slow lookups for special receiver types.
   for (; index < len; ++index) {
     HandleScope iteration_hs(isolate);
     // Let elementK be the result of ? Get(O, ! ToString(k)).
     Handle<Object> element_k;
     {
-      Handle<Object> index_obj = isolate->factory()->NewNumberFromInt64(index);
-      bool success;
-      LookupIterator it = LookupIterator::PropertyOrElement(
-          isolate, object, index_obj, &success);
-      DCHECK(success);
+      LookupIterator::Key key(isolate, static_cast<double>(index));
+      LookupIterator it(isolate, object, key);
       Maybe<bool> present = JSReceiver::HasProperty(&it);
       MAYBE_RETURN(present, ReadOnlyRoots(isolate).exception());
       if (!present.FromJust()) continue;
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, element_k,
                                          Object::GetProperty(&it));
       if (search_element->StrictEquals(*element_k)) {
-        return *index_obj;
+        return *isolate->factory()->NewNumberFromInt64(index);
       }
     }
   }
diff --git a/deps/v8/src/runtime/runtime-classes.cc b/deps/v8/src/runtime/runtime-classes.cc
index a4e9680a1f5c35..2aa1dafd0d59a6 100644
--- a/deps/v8/src/runtime/runtime-classes.cc
+++ b/deps/v8/src/runtime/runtime-classes.cc
@@ -17,6 +17,7 @@
 #include "src/objects/elements.h"
 #include "src/objects/hash-table-inl.h"
 #include "src/objects/literal-objects-inl.h"
+#include "src/objects/lookup-inl.h"
 #include "src/objects/smi.h"
 #include "src/objects/struct-inl.h"
 #include "src/runtime/runtime.h"
@@ -38,6 +39,11 @@ RUNTIME_FUNCTION(Runtime_ThrowConstructorNonCallableError) {
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, constructor, 0);
   Handle<String> name(constructor->shared().Name(), isolate);
+  if (name->length() == 0) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate,
+        NewTypeError(MessageTemplate::kAnonymousConstructorNonCallable));
+  }
   THROW_NEW_ERROR_RETURN_FAILURE(
       isolate, NewTypeError(MessageTemplate::kConstructorNonCallable, name));
 }
@@ -215,8 +221,7 @@ Handle<Dictionary> ShallowCopyDictionaryTemplate(
       Handle<Dictionary>::cast(isolate->factory()->CopyFixedArrayWithMap(
           dictionary_template, dictionary_map));
   // Clone all AccessorPairs in the dictionary.
-  int capacity = dictionary->Capacity();
-  for (int i = 0; i < capacity; i++) {
+  for (InternalIndex i : dictionary->IterateEntries()) {
     Object value = dictionary->ValueAt(i);
     if (value.IsAccessorPair()) {
       Handle<AccessorPair> pair(AccessorPair::cast(value), isolate);
@@ -235,9 +240,8 @@ bool SubstituteValues(Isolate* isolate, Handle<Dictionary> dictionary,
   Handle<Name> name_string = isolate->factory()->name_string();
 
   // Replace all indices with proper methods.
-  int capacity = dictionary->Capacity();
   ReadOnlyRoots roots(isolate);
-  for (int i = 0; i < capacity; i++) {
+  for (InternalIndex i : dictionary->IterateEntries()) {
     Object maybe_key = dictionary->KeyAt(i);
     if (!Dictionary::IsKey(roots, maybe_key)) continue;
     if (install_name_accessor && *install_name_accessor &&
@@ -284,6 +288,26 @@ bool SubstituteValues(Isolate* isolate, Handle<Dictionary> dictionary,
   return true;
 }
 
+void UpdateProtectors(Isolate* isolate, Handle<JSObject> receiver,
+                      Handle<NameDictionary> properties_dictionary) {
+  ReadOnlyRoots roots(isolate);
+  for (InternalIndex i : properties_dictionary->IterateEntries()) {
+    Object maybe_key = properties_dictionary->KeyAt(i);
+    if (!NameDictionary::IsKey(roots, maybe_key)) continue;
+    Handle<Name> name(Name::cast(maybe_key), isolate);
+    LookupIterator::UpdateProtector(isolate, receiver, name);
+  }
+}
+
+void UpdateProtectors(Isolate* isolate, Handle<JSObject> receiver,
+                      Handle<DescriptorArray> properties_template) {
+  int nof_descriptors = properties_template->number_of_descriptors();
+  for (InternalIndex i : InternalIndex::Range(nof_descriptors)) {
+    Handle<Name> name(properties_template->GetKey(i), isolate);
+    LookupIterator::UpdateProtector(isolate, receiver, name);
+  }
+}
+
 bool AddDescriptorsByTemplate(
     Isolate* isolate, Handle<Map> map,
     Handle<DescriptorArray> descriptors_template,
@@ -370,6 +394,8 @@ bool AddDescriptorsByTemplate(
     }
   }
 
+  UpdateProtectors(isolate, receiver, descriptors_template);
+
   map->InitializeDescriptors(isolate, *descriptors,
                              LayoutDescriptor::FastPointerLayout());
   if (elements_dictionary->NumberOfElements() > 0) {
@@ -417,7 +443,7 @@ bool AddDescriptorsByTemplate(
 
     ValueKind value_kind = ComputedEntryFlags::ValueKindBits::decode(flags);
     int key_index = ComputedEntryFlags::KeyIndexBits::decode(flags);
-    Object value = Smi::FromInt(key_index + 1);  // Value follows name.
+    Smi value = Smi::FromInt(key_index + 1);  // Value follows name.
 
     Handle<Object> key = args.at<Object>(key_index);
     DCHECK(key->IsName());
@@ -450,6 +476,8 @@ bool AddDescriptorsByTemplate(
     CHECK_EQ(*dict, *properties_dictionary);
   }
 
+  UpdateProtectors(isolate, receiver, properties_dictionary);
+
   if (elements_dictionary->NumberOfElements() > 0) {
     if (!SubstituteValues<NumberDictionary>(isolate, elements_dictionary,
                                             receiver, args)) {
@@ -662,9 +690,10 @@ namespace {
 
 enum class SuperMode { kLoad, kStore };
 
-MaybeHandle<JSReceiver> GetSuperHolder(
-    Isolate* isolate, Handle<Object> receiver, Handle<JSObject> home_object,
-    SuperMode mode, MaybeHandle<Name> maybe_name, uint32_t index) {
+MaybeHandle<JSReceiver> GetSuperHolder(Isolate* isolate,
+                                       Handle<JSObject> home_object,
+                                       SuperMode mode,
+                                       LookupIterator::Key* key) {
   if (home_object->IsAccessCheckNeeded() &&
       !isolate->MayAccess(handle(isolate->context(), isolate), home_object)) {
     isolate->ReportFailedAccessCheck(home_object);
@@ -677,10 +706,7 @@ MaybeHandle<JSReceiver> GetSuperHolder(
     MessageTemplate message = mode == SuperMode::kLoad
                                   ? MessageTemplate::kNonObjectPropertyLoad
                                   : MessageTemplate::kNonObjectPropertyStore;
-    Handle<Name> name;
-    if (!maybe_name.ToHandle(&name)) {
-      name = isolate->factory()->Uint32ToString(index);
-    }
+    Handle<Name> name = key->GetName(isolate);
     THROW_NEW_ERROR(isolate, NewTypeError(message, name, proto), JSReceiver);
   }
   return Handle<JSReceiver>::cast(proto);
@@ -688,29 +714,12 @@ MaybeHandle<JSReceiver> GetSuperHolder(
 
 MaybeHandle<Object> LoadFromSuper(Isolate* isolate, Handle<Object> receiver,
                                   Handle<JSObject> home_object,
-                                  Handle<Name> name) {
-  Handle<JSReceiver> holder;
-  ASSIGN_RETURN_ON_EXCEPTION(
-      isolate, holder,
-      GetSuperHolder(isolate, receiver, home_object, SuperMode::kLoad, name, 0),
-      Object);
-  LookupIterator it(receiver, name, holder);
-  Handle<Object> result;
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, result, Object::GetProperty(&it), Object);
-  return result;
-}
-
-MaybeHandle<Object> LoadElementFromSuper(Isolate* isolate,
-                                         Handle<Object> receiver,
-                                         Handle<JSObject> home_object,
-                                         uint32_t index) {
+                                  LookupIterator::Key* key) {
   Handle<JSReceiver> holder;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, holder,
-      GetSuperHolder(isolate, receiver, home_object, SuperMode::kLoad,
-                     MaybeHandle<Name>(), index),
-      Object);
-  LookupIterator it(isolate, receiver, index, holder);
+      GetSuperHolder(isolate, home_object, SuperMode::kLoad, key), Object);
+  LookupIterator it(isolate, receiver, *key, holder);
   Handle<Object> result;
   ASSIGN_RETURN_ON_EXCEPTION(isolate, result, Object::GetProperty(&it), Object);
   return result;
@@ -725,8 +734,10 @@ RUNTIME_FUNCTION(Runtime_LoadFromSuper) {
   CONVERT_ARG_HANDLE_CHECKED(JSObject, home_object, 1);
   CONVERT_ARG_HANDLE_CHECKED(Name, name, 2);
 
+  LookupIterator::Key key(isolate, name);
+
   RETURN_RESULT_OR_FAILURE(isolate,
-                           LoadFromSuper(isolate, receiver, home_object, name));
+                           LoadFromSuper(isolate, receiver, home_object, &key));
 }
 
 
@@ -735,55 +746,30 @@ RUNTIME_FUNCTION(Runtime_LoadKeyedFromSuper) {
   DCHECK_EQ(3, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSObject, home_object, 1);
+  // TODO(ishell): To improve performance, consider performing the to-string
+  // conversion of {key} before calling into the runtime.
   CONVERT_ARG_HANDLE_CHECKED(Object, key, 2);
 
-  uint32_t index = 0;
-
-  if (key->ToArrayIndex(&index)) {
-    RETURN_RESULT_OR_FAILURE(
-        isolate, LoadElementFromSuper(isolate, receiver, home_object, index));
-  }
+  bool success;
+  LookupIterator::Key lookup_key(isolate, key, &success);
+  if (!success) return ReadOnlyRoots(isolate).exception();
 
-  Handle<Name> name;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, name,
-                                     Object::ToName(isolate, key));
-  // TODO(verwaest): Unify using LookupIterator.
-  if (name->AsArrayIndex(&index)) {
-    RETURN_RESULT_OR_FAILURE(
-        isolate, LoadElementFromSuper(isolate, receiver, home_object, index));
-  }
-  RETURN_RESULT_OR_FAILURE(isolate,
-                           LoadFromSuper(isolate, receiver, home_object, name));
+  RETURN_RESULT_OR_FAILURE(
+      isolate, LoadFromSuper(isolate, receiver, home_object, &lookup_key));
 }
 
 namespace {
 
 MaybeHandle<Object> StoreToSuper(Isolate* isolate, Handle<JSObject> home_object,
-                                 Handle<Object> receiver, Handle<Name> name,
-                                 Handle<Object> value) {
-  Handle<JSReceiver> holder;
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, holder,
-                             GetSuperHolder(isolate, receiver, home_object,
-                                            SuperMode::kStore, name, 0),
-                             Object);
-  LookupIterator it(receiver, name, holder);
-  MAYBE_RETURN(Object::SetSuperProperty(&it, value, StoreOrigin::kNamed),
-               MaybeHandle<Object>());
-  return value;
-}
-
-MaybeHandle<Object> StoreElementToSuper(Isolate* isolate,
-                                        Handle<JSObject> home_object,
-                                        Handle<Object> receiver, uint32_t index,
-                                        Handle<Object> value) {
+                                 Handle<Object> receiver,
+                                 LookupIterator::Key* key, Handle<Object> value,
+                                 StoreOrigin store_origin) {
   Handle<JSReceiver> holder;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, holder,
-      GetSuperHolder(isolate, receiver, home_object, SuperMode::kStore,
-                     MaybeHandle<Name>(), index),
-      Object);
-  LookupIterator it(isolate, receiver, index, holder);
-  MAYBE_RETURN(Object::SetSuperProperty(&it, value, StoreOrigin::kMaybeKeyed),
+      GetSuperHolder(isolate, home_object, SuperMode::kStore, key), Object);
+  LookupIterator it(isolate, receiver, *key, holder);
+  MAYBE_RETURN(Object::SetSuperProperty(&it, value, store_origin),
                MaybeHandle<Object>());
   return value;
 }
@@ -798,28 +784,11 @@ RUNTIME_FUNCTION(Runtime_StoreToSuper) {
   CONVERT_ARG_HANDLE_CHECKED(Name, name, 2);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 3);
 
-  RETURN_RESULT_OR_FAILURE(
-      isolate, StoreToSuper(isolate, home_object, receiver, name, value));
-}
-
-static MaybeHandle<Object> StoreKeyedToSuper(Isolate* isolate,
-                                             Handle<JSObject> home_object,
-                                             Handle<Object> receiver,
-                                             Handle<Object> key,
-                                             Handle<Object> value) {
-  uint32_t index = 0;
+  LookupIterator::Key key(isolate, name);
 
-  if (key->ToArrayIndex(&index)) {
-    return StoreElementToSuper(isolate, home_object, receiver, index, value);
-  }
-  Handle<Name> name;
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, name, Object::ToName(isolate, key),
-                             Object);
-  // TODO(verwaest): Unify using LookupIterator.
-  if (name->AsArrayIndex(&index)) {
-    return StoreElementToSuper(isolate, home_object, receiver, index, value);
-  }
-  return StoreToSuper(isolate, home_object, receiver, name, value);
+  RETURN_RESULT_OR_FAILURE(
+      isolate, StoreToSuper(isolate, home_object, receiver, &key, value,
+                            StoreOrigin::kNamed));
 }
 
 RUNTIME_FUNCTION(Runtime_StoreKeyedToSuper) {
@@ -827,11 +796,18 @@ RUNTIME_FUNCTION(Runtime_StoreKeyedToSuper) {
   DCHECK_EQ(4, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSObject, home_object, 1);
+  // TODO(ishell): To improve performance, consider performing the to-string
+  // conversion of {key} before calling into the runtime.
   CONVERT_ARG_HANDLE_CHECKED(Object, key, 2);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 3);
 
+  bool success;
+  LookupIterator::Key lookup_key(isolate, key, &success);
+  if (!success) return ReadOnlyRoots(isolate).exception();
+
   RETURN_RESULT_OR_FAILURE(
-      isolate, StoreKeyedToSuper(isolate, home_object, receiver, key, value));
+      isolate, StoreToSuper(isolate, home_object, receiver, &lookup_key, value,
+                            StoreOrigin::kMaybeKeyed));
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/runtime/runtime-compiler.cc b/deps/v8/src/runtime/runtime-compiler.cc
index c7f3201eacd531..29ad7755b9fae7 100644
--- a/deps/v8/src/runtime/runtime-compiler.cc
+++ b/deps/v8/src/runtime/runtime-compiler.cc
@@ -142,7 +142,7 @@ RUNTIME_FUNCTION(Runtime_InstantiateAsmJs) {
   DCHECK(function->code() ==
          isolate->builtins()->builtin(Builtins::kInstantiateAsmJs));
   function->set_code(isolate->builtins()->builtin(Builtins::kCompileLazy));
-  return Smi::kZero;
+  return Smi::zero();
 }
 
 RUNTIME_FUNCTION(Runtime_NotifyDeoptimized) {
@@ -188,6 +188,12 @@ static bool IsSuitableForOnStackReplacement(Isolate* isolate,
                                             Handle<JSFunction> function) {
   // Keep track of whether we've succeeded in optimizing.
   if (function->shared().optimization_disabled()) return false;
+  // TODO(chromium:1031479): Currently, OSR triggering mechanism is tied to the
+  // bytecode array. So, it might be possible to mark closure in one native
+  // context and optimize a closure from a different native context. So check if
+  // there is a feedback vector before OSRing. We don't expect this to happen
+  // often.
+  if (!function->has_feedback_vector()) return false;
   // If we are trying to do OSR when there are already optimized
   // activations of the function, it means (a) the function is directly or
   // indirectly recursive and (b) an optimized invocation has been
diff --git a/deps/v8/src/runtime/runtime-debug.cc b/deps/v8/src/runtime/runtime-debug.cc
index 09dd4f8132d195..a7e6229ff96637 100644
--- a/deps/v8/src/runtime/runtime-debug.cc
+++ b/deps/v8/src/runtime/runtime-debug.cc
@@ -66,10 +66,6 @@ RUNTIME_FUNCTION_RETURN_PAIR(Runtime_DebugBreakOnBytecode) {
   DCHECK(it.frame()->is_interpreted());
   InterpretedFrame* interpreted_frame =
       reinterpret_cast<InterpretedFrame*>(it.frame());
-  SharedFunctionInfo shared = interpreted_frame->function().shared();
-  BytecodeArray bytecode_array = shared.GetBytecodeArray();
-  int bytecode_offset = interpreted_frame->GetBytecodeOffset();
-  Bytecode bytecode = Bytecodes::FromByte(bytecode_array.get(bytecode_offset));
 
   bool side_effect_check_failed = false;
   if (isolate->debug_execution_mode() == DebugInfo::kSideEffects) {
@@ -77,6 +73,13 @@ RUNTIME_FUNCTION_RETURN_PAIR(Runtime_DebugBreakOnBytecode) {
         !isolate->debug()->PerformSideEffectCheckAtBytecode(interpreted_frame);
   }
 
+  // Make sure to only access these objects after the side effect check, as the
+  // check can allocate on failure.
+  SharedFunctionInfo shared = interpreted_frame->function().shared();
+  BytecodeArray bytecode_array = shared.GetBytecodeArray();
+  int bytecode_offset = interpreted_frame->GetBytecodeOffset();
+  Bytecode bytecode = Bytecodes::FromByte(bytecode_array.get(bytecode_offset));
+
   if (Bytecodes::Returns(bytecode)) {
     // If we are returning (or suspending), reset the bytecode array on the
     // interpreted stack frame to the non-debug variant so that the interpreter
@@ -308,14 +311,14 @@ RUNTIME_FUNCTION(Runtime_GetGeneratorScopeCount) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
 
-  if (!args[0].IsJSGeneratorObject()) return Smi::kZero;
+  if (!args[0].IsJSGeneratorObject()) return Smi::zero();
 
   // Check arguments.
   CONVERT_ARG_HANDLE_CHECKED(JSGeneratorObject, gen, 0);
 
   // Only inspect suspended generator scopes.
   if (!gen->is_suspended()) {
-    return Smi::kZero;
+    return Smi::zero();
   }
 
   // Count the visible scopes.
@@ -844,10 +847,8 @@ RUNTIME_FUNCTION(Runtime_ProfileCreateSnapshotDataBlob) {
   // Track the embedded blob size as well.
   {
     int embedded_blob_size = 0;
-    if (FLAG_embedded_builtins) {
-      i::EmbeddedData d = i::EmbeddedData::FromBlob();
-      embedded_blob_size = static_cast<int>(d.size());
-    }
+    i::EmbeddedData d = i::EmbeddedData::FromBlob();
+    embedded_blob_size = static_cast<int>(d.size());
     PrintF("Embedded blob is %d bytes\n", embedded_blob_size);
   }
 
diff --git a/deps/v8/src/runtime/runtime-forin.cc b/deps/v8/src/runtime/runtime-forin.cc
index 0d7e1dc30b3a9a..08e68ee996e352 100644
--- a/deps/v8/src/runtime/runtime-forin.cc
+++ b/deps/v8/src/runtime/runtime-forin.cc
@@ -45,16 +45,16 @@ MaybeHandle<HeapObject> Enumerate(Isolate* isolate,
   return handle(receiver->map(), isolate);
 }
 
-// This is a slight modifcation of JSReceiver::HasProperty, dealing with
+// This is a slight modification of JSReceiver::HasProperty, dealing with
 // the oddities of JSProxy and JSModuleNamespace in for-in filter.
 MaybeHandle<Object> HasEnumerableProperty(Isolate* isolate,
                                           Handle<JSReceiver> receiver,
                                           Handle<Object> key) {
   bool success = false;
   Maybe<PropertyAttributes> result = Just(ABSENT);
-  LookupIterator it =
-      LookupIterator::PropertyOrElement(isolate, receiver, key, &success);
+  LookupIterator::Key lookup_key(isolate, key, &success);
   if (!success) return isolate->factory()->undefined_value();
+  LookupIterator it(isolate, receiver, lookup_key);
   for (; it.IsFound(); it.Next()) {
     switch (it.state()) {
       case LookupIterator::NOT_FOUND:
diff --git a/deps/v8/src/runtime/runtime-internal.cc b/deps/v8/src/runtime/runtime-internal.cc
index 03c9e582d80a06..18e6f67c2ff1e8 100644
--- a/deps/v8/src/runtime/runtime-internal.cc
+++ b/deps/v8/src/runtime/runtime-internal.cc
@@ -284,6 +284,21 @@ RUNTIME_FUNCTION(Runtime_StackGuard) {
   return isolate->stack_guard()->HandleInterrupts();
 }
 
+RUNTIME_FUNCTION(Runtime_StackGuardWithGap) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(args.length(), 1);
+  CONVERT_UINT32_ARG_CHECKED(gap, 0);
+  TRACE_EVENT0("v8.execute", "V8.StackGuard");
+
+  // First check if this is a real stack overflow.
+  StackLimitCheck check(isolate);
+  if (check.JsHasOverflowed(gap)) {
+    return isolate->StackOverflow();
+  }
+
+  return isolate->stack_guard()->HandleInterrupts();
+}
+
 RUNTIME_FUNCTION(Runtime_BytecodeBudgetInterrupt) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -573,5 +588,18 @@ RUNTIME_FUNCTION(Runtime_GetInitializerFunction) {
   Handle<Object> initializer = JSReceiver::GetDataProperty(constructor, key);
   return *initializer;
 }
+
+RUNTIME_FUNCTION(Runtime_DoubleToStringWithRadix) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(2, args.length());
+  CONVERT_DOUBLE_ARG_CHECKED(number, 0);
+  CONVERT_INT32_ARG_CHECKED(radix, 1);
+
+  char* const str = DoubleToRadixCString(number, radix);
+  Handle<String> result = isolate->factory()->NewStringFromAsciiChecked(str);
+  DeleteArray(str);
+  return *result;
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-literals.cc b/deps/v8/src/runtime/runtime-literals.cc
index 497a27dbb907d0..a69f903c670748 100644
--- a/deps/v8/src/runtime/runtime-literals.cc
+++ b/deps/v8/src/runtime/runtime-literals.cc
@@ -21,7 +21,7 @@ namespace internal {
 namespace {
 
 bool IsUninitializedLiteralSite(Object literal_site) {
-  return literal_site == Smi::kZero;
+  return literal_site == Smi::zero();
 }
 
 bool HasBoilerplate(Handle<Object> literal_site) {
@@ -133,8 +133,7 @@ MaybeHandle<JSObject> JSObjectWalkVisitor<ContextObject>::StructureWalk(
       }
     } else {
       Handle<NameDictionary> dict(copy->property_dictionary(isolate), isolate);
-      int capacity = dict->Capacity();
-      for (int i = 0; i < capacity; i++) {
+      for (InternalIndex i : dict->IterateEntries()) {
         Object raw = dict->ValueAt(isolate, i);
         if (!raw.IsJSObject(isolate)) continue;
         DCHECK(dict->KeyAt(isolate, i).IsName());
@@ -183,8 +182,7 @@ MaybeHandle<JSObject> JSObjectWalkVisitor<ContextObject>::StructureWalk(
     case DICTIONARY_ELEMENTS: {
       Handle<NumberDictionary> element_dictionary(
           copy->element_dictionary(isolate), isolate);
-      int capacity = element_dictionary->Capacity();
-      for (int i = 0; i < capacity; i++) {
+      for (InternalIndex i : element_dictionary->IterateEntries()) {
         Object raw = element_dictionary->ValueAt(isolate, i);
         if (!raw.IsJSObject(isolate)) continue;
         Handle<JSObject> value(JSObject::cast(raw), isolate);
@@ -417,7 +415,7 @@ Handle<JSObject> CreateObjectLiteral(
     if (key->ToArrayIndex(&element_index)) {
       // Array index (uint32).
       if (value->IsUninitialized(isolate)) {
-        value = handle(Smi::kZero, isolate);
+        value = handle(Smi::zero(), isolate);
       }
       JSObject::SetOwnElementIgnoreAttributes(boilerplate, element_index, value,
                                               NONE)
diff --git a/deps/v8/src/runtime/runtime-object.cc b/deps/v8/src/runtime/runtime-object.cc
index e07d91dd314d96..20f562defd6d5a 100644
--- a/deps/v8/src/runtime/runtime-object.cc
+++ b/deps/v8/src/runtime/runtime-object.cc
@@ -32,16 +32,16 @@ MaybeHandle<Object> Runtime::GetObjectProperty(Isolate* isolate,
   }
 
   bool success = false;
-  LookupIterator it =
-      LookupIterator::PropertyOrElement(isolate, object, key, &success);
+  LookupIterator::Key lookup_key(isolate, key, &success);
   if (!success) return MaybeHandle<Object>();
+  LookupIterator it(isolate, object, lookup_key);
 
   MaybeHandle<Object> result = Object::GetProperty(&it);
   if (is_found_out) *is_found_out = it.IsFound();
 
   if (!it.IsFound() && key->IsSymbol() &&
       Symbol::cast(*key).is_private_name()) {
-    Handle<Object> name_string(Symbol::cast(*key).name(), isolate);
+    Handle<Object> name_string(Symbol::cast(*key).description(), isolate);
     DCHECK(name_string->IsString());
     THROW_NEW_ERROR(isolate,
                     NewTypeError(MessageTemplate::kInvalidPrivateMemberRead,
@@ -186,9 +186,9 @@ Maybe<bool> Runtime::DeleteObjectProperty(Isolate* isolate,
   if (DeleteObjectPropertyFast(isolate, receiver, key)) return Just(true);
 
   bool success = false;
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, receiver, key, &success, LookupIterator::OWN);
+  LookupIterator::Key lookup_key(isolate, key, &success);
   if (!success) return Nothing<bool>();
+  LookupIterator it(isolate, receiver, lookup_key, LookupIterator::OWN);
 
   return JSReceiver::DeleteProperty(&it, language_mode);
 }
@@ -270,27 +270,22 @@ RUNTIME_FUNCTION(Runtime_ObjectHasOwnProperty) {
   HandleScope scope(isolate);
   Handle<Object> property = args.at(1);
 
-  Handle<Name> key;
-  uint32_t index;
-  bool key_is_array_index = property->ToArrayIndex(&index);
-
-  if (!key_is_array_index) {
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, key,
-                                       Object::ToName(isolate, property));
-    key_is_array_index = key->AsArrayIndex(&index);
-  }
+  // TODO(ishell): To improve performance, consider performing the to-string
+  // conversion of {property} before calling into the runtime.
+  bool success;
+  LookupIterator::Key key(isolate, property, &success);
+  if (!success) return ReadOnlyRoots(isolate).exception();
 
   Handle<Object> object = args.at(0);
 
   if (object->IsJSModuleNamespace()) {
-    if (key.is_null()) {
-      DCHECK(key_is_array_index);
+    if (key.is_element()) {
       // Namespace objects can't have indexed properties.
       return ReadOnlyRoots(isolate).false_value();
     }
-
-    Maybe<bool> result =
-        JSReceiver::HasOwnProperty(Handle<JSReceiver>::cast(object), key);
+    LookupIterator it(isolate, object, key, LookupIterator::OWN);
+    PropertyDescriptor desc;
+    Maybe<bool> result = JSReceiver::GetOwnPropertyDescriptor(&it, &desc);
     if (!result.IsJust()) return ReadOnlyRoots(isolate).exception();
     return isolate->heap()->ToBoolean(result.FromJust());
 
@@ -303,9 +298,7 @@ RUNTIME_FUNCTION(Runtime_ObjectHasOwnProperty) {
     // handle all cases directly (without this custom fast path).
     {
       LookupIterator::Configuration c = LookupIterator::OWN_SKIP_INTERCEPTOR;
-      LookupIterator it =
-          key_is_array_index ? LookupIterator(isolate, js_obj, index, js_obj, c)
-                             : LookupIterator(js_obj, key, js_obj, c);
+      LookupIterator it(isolate, js_obj, key, js_obj, c);
       Maybe<bool> maybe = JSReceiver::HasProperty(&it);
       if (maybe.IsNothing()) return ReadOnlyRoots(isolate).exception();
       DCHECK(!isolate->has_pending_exception());
@@ -314,38 +307,32 @@ RUNTIME_FUNCTION(Runtime_ObjectHasOwnProperty) {
 
     Map map = js_obj->map();
     if (!map.IsJSGlobalProxyMap() &&
-        (key_is_array_index ? !map.has_indexed_interceptor()
-                            : !map.has_named_interceptor())) {
+        (key.is_element() && key.index() <= JSArray::kMaxArrayIndex
+             ? !map.has_indexed_interceptor()
+             : !map.has_named_interceptor())) {
       return ReadOnlyRoots(isolate).false_value();
     }
 
     // Slow case.
-    LookupIterator::Configuration c = LookupIterator::OWN;
-    LookupIterator it = key_is_array_index
-                            ? LookupIterator(isolate, js_obj, index, js_obj, c)
-                            : LookupIterator(js_obj, key, js_obj, c);
-
+    LookupIterator it(isolate, js_obj, key, js_obj, LookupIterator::OWN);
     Maybe<bool> maybe = JSReceiver::HasProperty(&it);
     if (maybe.IsNothing()) return ReadOnlyRoots(isolate).exception();
     DCHECK(!isolate->has_pending_exception());
     return isolate->heap()->ToBoolean(maybe.FromJust());
 
   } else if (object->IsJSProxy()) {
-    if (key.is_null()) {
-      DCHECK(key_is_array_index);
-      key = isolate->factory()->Uint32ToString(index);
-    }
-
-    Maybe<bool> result =
-        JSReceiver::HasOwnProperty(Handle<JSProxy>::cast(object), key);
-    if (result.IsNothing()) return ReadOnlyRoots(isolate).exception();
-    return isolate->heap()->ToBoolean(result.FromJust());
+    LookupIterator it(isolate, object, key, Handle<JSProxy>::cast(object),
+                      LookupIterator::OWN);
+    Maybe<PropertyAttributes> attributes =
+        JSReceiver::GetPropertyAttributes(&it);
+    if (attributes.IsNothing()) return ReadOnlyRoots(isolate).exception();
+    return isolate->heap()->ToBoolean(attributes.FromJust() != ABSENT);
 
   } else if (object->IsString()) {
     return isolate->heap()->ToBoolean(
-        key_is_array_index
-            ? index < static_cast<uint32_t>(String::cast(*object).length())
-            : key->Equals(ReadOnlyRoots(isolate).length_string()));
+        key.is_element()
+            ? key.index() < static_cast<size_t>(String::cast(*object).length())
+            : key.name()->Equals(ReadOnlyRoots(isolate).length_string()));
   } else if (object->IsNullOrUndefined(isolate)) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewTypeError(MessageTemplate::kUndefinedOrNullToObject));
@@ -411,13 +398,13 @@ MaybeHandle<Object> Runtime::SetObjectProperty(
 
   // Check if the given key is an array index.
   bool success = false;
-  LookupIterator it =
-      LookupIterator::PropertyOrElement(isolate, object, key, &success);
+  LookupIterator::Key lookup_key(isolate, key, &success);
   if (!success) return MaybeHandle<Object>();
+  LookupIterator it(isolate, object, lookup_key);
 
   if (!it.IsFound() && key->IsSymbol() &&
       Symbol::cast(*key).is_private_name()) {
-    Handle<Object> name_string(Symbol::cast(*key).name(), isolate);
+    Handle<Object> name_string(Symbol::cast(*key).description(), isolate);
     DCHECK(name_string->IsString());
     THROW_NEW_ERROR(isolate,
                     NewTypeError(MessageTemplate::kInvalidPrivateMemberWrite,
@@ -617,8 +604,8 @@ RUNTIME_FUNCTION(Runtime_GetProperty) {
         // Attempt dictionary lookup.
         GlobalDictionary dictionary =
             JSGlobalObject::cast(*receiver).global_dictionary();
-        int entry = dictionary.FindEntry(isolate, key);
-        if (entry != GlobalDictionary::kNotFound) {
+        InternalIndex entry = dictionary.FindEntry(isolate, key);
+        if (entry.is_found()) {
           PropertyCell cell = dictionary.CellAt(entry);
           if (cell.property_details().kind() == kData) {
             Object value = cell.value();
@@ -629,8 +616,8 @@ RUNTIME_FUNCTION(Runtime_GetProperty) {
       } else if (!receiver->HasFastProperties()) {
         // Attempt dictionary lookup.
         NameDictionary dictionary = receiver->property_dictionary();
-        int entry = dictionary.FindEntry(isolate, key);
-        if ((entry != NameDictionary::kNotFound) &&
+        InternalIndex entry = dictionary.FindEntry(isolate, key);
+        if ((entry.is_found()) &&
             (dictionary.DetailsAt(entry).kind() == kData)) {
           return dictionary.ValueAt(entry);
         }
@@ -709,9 +696,8 @@ RUNTIME_FUNCTION(Runtime_StoreDataPropertyInLiteral) {
   CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
 
-  bool success;
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, object, key, &success, LookupIterator::OWN);
+  LookupIterator::Key lookup_key(isolate, key);
+  LookupIterator it(isolate, object, lookup_key, LookupIterator::OWN);
 
   Maybe<bool> result = JSObject::DefineOwnPropertyIgnoreAttributes(
       &it, value, NONE, Just(kDontThrow));
@@ -756,7 +742,7 @@ RUNTIME_FUNCTION(Runtime_ShrinkPropertyDictionary) {
   Handle<NameDictionary> new_properties =
       NameDictionary::Shrink(isolate, dictionary);
   receiver->SetProperties(*new_properties);
-  return Smi::kZero;
+  return Smi::zero();
 }
 
 // ES6 section 12.9.3, operator in.
@@ -852,15 +838,15 @@ RUNTIME_FUNCTION(Runtime_TryMigrateInstance) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
-  if (!object->IsJSObject()) return Smi::kZero;
+  if (!object->IsJSObject()) return Smi::zero();
   Handle<JSObject> js_object = Handle<JSObject>::cast(object);
   // It could have been a DCHECK but we call this function directly from tests.
-  if (!js_object->map().is_deprecated()) return Smi::kZero;
+  if (!js_object->map().is_deprecated()) return Smi::zero();
   // This call must not cause lazy deopts, because it's called from deferred
   // code where we can't handle lazy deopts for lack of a suitable bailout
   // ID. So we just try migration and signal failure if necessary,
   // which will also trigger a deopt.
-  if (!JSObject::TryMigrateInstance(isolate, js_object)) return Smi::kZero;
+  if (!JSObject::TryMigrateInstance(isolate, js_object)) return Smi::zero();
   return *object;
 }
 
@@ -940,8 +926,8 @@ RUNTIME_FUNCTION(Runtime_DefineDataPropertyInLiteral) {
                   *function_map == function->map());
   }
 
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, object, name, object, LookupIterator::OWN);
+  LookupIterator::Key key(isolate, name);
+  LookupIterator it(isolate, object, key, object, LookupIterator::OWN);
   // Cannot fail since this should only be called when
   // creating an object literal.
   CHECK(JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, attrs,
@@ -955,6 +941,11 @@ RUNTIME_FUNCTION(Runtime_CollectTypeProfile) {
   DCHECK_EQ(3, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Smi, position, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
+  CONVERT_ARG_HANDLE_CHECKED(HeapObject, maybe_vector, 2);
+
+  if (maybe_vector->IsUndefined()) {
+    return ReadOnlyRoots(isolate).undefined_value();
+  }
   CONVERT_ARG_HANDLE_CHECKED(FeedbackVector, vector, 2);
 
   Handle<String> type = Object::TypeOf(isolate, value);
@@ -1187,9 +1178,9 @@ RUNTIME_FUNCTION(Runtime_CreateDataProperty) {
   CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
   bool success;
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, o, key, &success, LookupIterator::OWN);
+  LookupIterator::Key lookup_key(isolate, key, &success);
   if (!success) return ReadOnlyRoots(isolate).exception();
+  LookupIterator it(isolate, o, lookup_key, LookupIterator::OWN);
   MAYBE_RETURN(JSReceiver::CreateDataProperty(&it, value, Just(kThrowOnError)),
                ReadOnlyRoots(isolate).exception());
   return *value;
@@ -1239,13 +1230,13 @@ RUNTIME_FUNCTION(Runtime_CreatePrivateAccessors) {
 
 RUNTIME_FUNCTION(Runtime_AddPrivateBrand) {
   HandleScope scope(isolate);
-  DCHECK_EQ(args.length(), 2);
+  DCHECK_EQ(args.length(), 3);
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
   CONVERT_ARG_HANDLE_CHECKED(Symbol, brand, 1);
+  CONVERT_ARG_HANDLE_CHECKED(Context, context, 2);
   DCHECK(brand->is_private_name());
 
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate, receiver, brand, LookupIterator::OWN);
+  LookupIterator it(isolate, receiver, brand, LookupIterator::OWN);
 
   if (it.IsFound()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
@@ -1254,9 +1245,7 @@ RUNTIME_FUNCTION(Runtime_AddPrivateBrand) {
 
   PropertyAttributes attributes =
       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
-  // TODO(joyee): we could use this slot to store something useful. For now,
-  // store the brand itself.
-  CHECK(Object::AddDataProperty(&it, brand, attributes, Just(kDontThrow),
+  CHECK(Object::AddDataProperty(&it, context, attributes, Just(kDontThrow),
                                 StoreOrigin::kMaybeKeyed)
             .FromJust());
   return *receiver;
@@ -1270,8 +1259,7 @@ RUNTIME_FUNCTION(Runtime_AddPrivateField) {
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
   DCHECK(key->is_private_name());
 
-  LookupIterator it =
-      LookupIterator::PropertyOrElement(isolate, o, key, LookupIterator::OWN);
+  LookupIterator it(isolate, o, key, LookupIterator::OWN);
 
   if (it.IsFound()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
diff --git a/deps/v8/src/runtime/runtime-proxy.cc b/deps/v8/src/runtime/runtime-proxy.cc
index 2543b3f5d4e837..afdfa98b0c3480 100644
--- a/deps/v8/src/runtime/runtime-proxy.cc
+++ b/deps/v8/src/runtime/runtime-proxy.cc
@@ -23,19 +23,24 @@ RUNTIME_FUNCTION(Runtime_GetPropertyWithReceiver) {
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, holder, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
   CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 2);
+  // TODO(mythria): Remove the on_non_existent parameter to this function. This
+  // should only be called when getting named properties on receiver. This
+  // doesn't handle the global variable loads.
+#ifdef DEBUG
   CONVERT_ARG_HANDLE_CHECKED(Smi, on_non_existent, 3);
+  DCHECK_NE(static_cast<OnNonExistent>(on_non_existent->value()),
+            OnNonExistent::kThrowReferenceError);
+#endif
 
   bool success = false;
-  LookupIterator it = LookupIterator::PropertyOrElement(isolate, receiver, key,
-                                                        &success, holder);
+  LookupIterator::Key lookup_key(isolate, key, &success);
   if (!success) {
     DCHECK(isolate->has_pending_exception());
     return ReadOnlyRoots(isolate).exception();
   }
+  LookupIterator it(isolate, receiver, lookup_key, holder);
 
-  RETURN_RESULT_OR_FAILURE(
-      isolate, Object::GetProperty(
-                   &it, static_cast<OnNonExistent>(on_non_existent->value())));
+  RETURN_RESULT_OR_FAILURE(isolate, Object::GetProperty(&it));
 }
 
 RUNTIME_FUNCTION(Runtime_SetPropertyWithReceiver) {
@@ -48,12 +53,12 @@ RUNTIME_FUNCTION(Runtime_SetPropertyWithReceiver) {
   CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 3);
 
   bool success = false;
-  LookupIterator it = LookupIterator::PropertyOrElement(isolate, receiver, key,
-                                                        &success, holder);
+  LookupIterator::Key lookup_key(isolate, key, &success);
   if (!success) {
     DCHECK(isolate->has_pending_exception());
     return ReadOnlyRoots(isolate).exception();
   }
+  LookupIterator it(isolate, receiver, lookup_key, holder);
   Maybe<bool> result =
       Object::SetSuperProperty(&it, value, StoreOrigin::kMaybeKeyed);
   MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
diff --git a/deps/v8/src/runtime/runtime-regexp.cc b/deps/v8/src/runtime/runtime-regexp.cc
index 980339ee5e5a45..1d6cad9465b5ae 100644
--- a/deps/v8/src/runtime/runtime-regexp.cc
+++ b/deps/v8/src/runtime/runtime-regexp.cc
@@ -803,7 +803,7 @@ RUNTIME_FUNCTION(Runtime_StringSplit) {
                                    &last_match_cache_unused,
                                    RegExpResultsCache::STRING_SPLIT_SUBSTRINGS),
         isolate);
-    if (*cached_answer != Smi::kZero) {
+    if (*cached_answer != Smi::zero()) {
       // The cache FixedArray is a COW-array and can therefore be reused.
       Handle<JSArray> result = isolate->factory()->NewJSArrayWithElements(
           Handle<FixedArray>::cast(cached_answer));
@@ -1055,15 +1055,15 @@ Handle<JSObject> ConstructNamedCaptureGroupsObject(
     const std::function<Object(int)>& f_get_capture) {
   Handle<JSObject> groups = isolate->factory()->NewJSObjectWithNullProto();
 
-  const int capture_count = capture_map->length() >> 1;
-  for (int i = 0; i < capture_count; i++) {
+  const int named_capture_count = capture_map->length() >> 1;
+  for (int i = 0; i < named_capture_count; i++) {
     const int name_ix = i * 2;
     const int index_ix = i * 2 + 1;
 
     Handle<String> capture_name(String::cast(capture_map->get(name_ix)),
                                 isolate);
     const int capture_ix = Smi::ToInt(capture_map->get(index_ix));
-    DCHECK(1 <= capture_ix && capture_ix <= capture_count);
+    DCHECK_GE(capture_ix, 1);  // Explicit groups start at index 1.
 
     Handle<Object> capture_value(f_get_capture(capture_ix), isolate);
     DCHECK(capture_value->IsUndefined(isolate) || capture_value->IsString());
@@ -1301,7 +1301,7 @@ V8_WARN_UNUSED_RESULT MaybeHandle<String> RegExpReplace(
     }
 
     if (match_indices_obj->IsNull(isolate)) {
-      if (sticky) regexp->set_last_index(Smi::kZero, SKIP_WRITE_BARRIER);
+      if (sticky) regexp->set_last_index(Smi::zero(), SKIP_WRITE_BARRIER);
       return string;
     }
 
@@ -1443,7 +1443,7 @@ RUNTIME_FUNCTION(Runtime_StringReplaceNonGlobalRegExpWithFunction) {
   }
 
   if (match_indices_obj->IsNull(isolate)) {
-    if (sticky) regexp->set_last_index(Smi::kZero, SKIP_WRITE_BARRIER);
+    if (sticky) regexp->set_last_index(Smi::zero(), SKIP_WRITE_BARRIER);
     return *subject;
   }
 
diff --git a/deps/v8/src/runtime/runtime-scopes.cc b/deps/v8/src/runtime/runtime-scopes.cc
index 812b09b1f0640c..5a588cc917bcb4 100644
--- a/deps/v8/src/runtime/runtime-scopes.cc
+++ b/deps/v8/src/runtime/runtime-scopes.cc
@@ -48,9 +48,8 @@ Object ThrowRedeclarationError(Isolate* isolate, Handle<String> name,
 Object DeclareGlobal(
     Isolate* isolate, Handle<JSGlobalObject> global, Handle<String> name,
     Handle<Object> value, PropertyAttributes attr, bool is_var,
-    bool is_function_declaration, RedeclarationType redeclaration_type,
-    Handle<FeedbackVector> feedback_vector = Handle<FeedbackVector>(),
-    FeedbackSlot slot = FeedbackSlot::Invalid()) {
+    RedeclarationType redeclaration_type,
+    Handle<FeedbackVector> feedback_vector = Handle<FeedbackVector>()) {
   Handle<ScriptContextTable> script_contexts(
       global->native_context().script_context_table(), isolate);
   ScriptContextTable::LookupResult lookup;
@@ -66,12 +65,12 @@ Object DeclareGlobal(
   // Do the lookup own properties only, see ES5 erratum.
   LookupIterator::Configuration lookup_config(
       LookupIterator::Configuration::OWN_SKIP_INTERCEPTOR);
-  if (is_function_declaration) {
+  if (!is_var) {
     // For function declarations, use the interceptor on the declaration. For
     // non-functions, use it only on initialization.
     lookup_config = LookupIterator::Configuration::OWN;
   }
-  LookupIterator it(global, name, global, lookup_config);
+  LookupIterator it(isolate, global, name, global, lookup_config);
   Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
   if (maybe.IsNothing()) return ReadOnlyRoots(isolate).exception();
 
@@ -82,7 +81,6 @@ Object DeclareGlobal(
     // Skip var re-declarations.
     if (is_var) return ReadOnlyRoots(isolate).undefined_value();
 
-    DCHECK(is_function_declaration);
     if ((old_attributes & DONT_DELETE) != 0) {
       // Only allow reconfiguring globals to functions in user code (no
       // natives, which are marked as read-only).
@@ -111,30 +109,17 @@ Object DeclareGlobal(
     if (it.state() == LookupIterator::ACCESSOR) it.Delete();
   }
 
-  if (is_function_declaration) {
-    it.Restart();
-  }
+  if (!is_var) it.Restart();
 
   // Define or redefine own property.
   RETURN_FAILURE_ON_EXCEPTION(
       isolate, JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, attr));
 
-  if (!feedback_vector.is_null() &&
-      it.state() != LookupIterator::State::INTERCEPTOR) {
-    DCHECK_EQ(*global, *it.GetHolder<Object>());
-    // Preinitialize the feedback slot if the global object does not have
-    // named interceptor or the interceptor is not masking.
-    if (!global->HasNamedInterceptor() ||
-        global->GetNamedInterceptor().non_masking()) {
-      FeedbackNexus nexus(feedback_vector, slot);
-      nexus.ConfigurePropertyCellMode(it.GetPropertyCell());
-    }
-  }
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
 Object DeclareGlobals(Isolate* isolate, Handle<FixedArray> declarations,
-                      int flags, Handle<JSFunction> closure) {
+                      Handle<JSFunction> closure) {
   HandleScope scope(isolate);
   Handle<JSGlobalObject> global(isolate->global_object());
   Handle<Context> context(isolate->context(), isolate);
@@ -154,46 +139,38 @@ Object DeclareGlobals(Isolate* isolate, Handle<FixedArray> declarations,
 
   // Traverse the name/value pairs and set the properties.
   int length = declarations->length();
-  FOR_WITH_HANDLE_SCOPE(isolate, int, i = 0, i, i < length, i += 4, {
-    Handle<String> name(String::cast(declarations->get(i)), isolate);
-    FeedbackSlot slot(Smi::ToInt(declarations->get(i + 1)));
-    Handle<Object> possibly_feedback_cell_slot(declarations->get(i + 2),
-                                               isolate);
-    Handle<Object> initial_value(declarations->get(i + 3), isolate);
-
-    bool is_var = initial_value->IsUndefined(isolate);
-    bool is_function = initial_value->IsSharedFunctionInfo();
-    DCHECK_NE(is_var, is_function);
-
+  FOR_WITH_HANDLE_SCOPE(isolate, int, i = 0, i, i < length, i++, {
+    Handle<Object> decl(declarations->get(i), isolate);
+    Handle<String> name;
     Handle<Object> value;
-    if (is_function) {
-      DCHECK(possibly_feedback_cell_slot->IsSmi());
-      Handle<FeedbackCell> feedback_cell =
-          closure_feedback_cell_array->GetFeedbackCell(
-              Smi::ToInt(*possibly_feedback_cell_slot));
-      // Copy the function and update its context. Use it as value.
-      Handle<SharedFunctionInfo> shared =
-          Handle<SharedFunctionInfo>::cast(initial_value);
-      Handle<JSFunction> function =
-          isolate->factory()->NewFunctionFromSharedFunctionInfo(
-              shared, context, feedback_cell, AllocationType::kOld);
-      value = function;
-    } else {
+    bool is_var = decl->IsString();
+
+    if (is_var) {
+      name = Handle<String>::cast(decl);
       value = isolate->factory()->undefined_value();
+    } else {
+      Handle<SharedFunctionInfo> sfi = Handle<SharedFunctionInfo>::cast(decl);
+      name = handle(sfi->Name(), isolate);
+      int index = Smi::ToInt(declarations->get(++i));
+      Handle<FeedbackCell> feedback_cell =
+          closure_feedback_cell_array->GetFeedbackCell(index);
+      value = isolate->factory()->NewFunctionFromSharedFunctionInfo(
+          sfi, context, feedback_cell, AllocationType::kOld);
     }
 
     // Compute the property attributes. According to ECMA-262,
     // the property must be non-configurable except in eval.
-    bool is_eval = DeclareGlobalsEvalFlag::decode(flags);
-    int attr = NONE;
-    if (!is_eval) attr |= DONT_DELETE;
+    Script script = Script::cast(closure->shared().script());
+    PropertyAttributes attr =
+        script.compilation_type() == Script::COMPILATION_TYPE_EVAL
+            ? NONE
+            : DONT_DELETE;
 
     // ES#sec-globaldeclarationinstantiation 5.d:
     // If hasRestrictedGlobal is true, throw a SyntaxError exception.
-    Object result = DeclareGlobal(isolate, global, name, value,
-                                  static_cast<PropertyAttributes>(attr), is_var,
-                                  is_function, RedeclarationType::kSyntaxError,
-                                  feedback_vector, slot);
+    Object result =
+        DeclareGlobal(isolate, global, name, value, attr, is_var,
+                      RedeclarationType::kSyntaxError, feedback_vector);
     if (isolate->has_pending_exception()) return result;
   });
 
@@ -204,13 +181,12 @@ Object DeclareGlobals(Isolate* isolate, Handle<FixedArray> declarations,
 
 RUNTIME_FUNCTION(Runtime_DeclareGlobals) {
   HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
+  DCHECK_EQ(2, args.length());
 
   CONVERT_ARG_HANDLE_CHECKED(FixedArray, declarations, 0);
-  CONVERT_SMI_ARG_CHECKED(flags, 1);
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, closure, 2);
+  CONVERT_ARG_HANDLE_CHECKED(JSFunction, closure, 1);
 
-  return DeclareGlobals(isolate, declarations, flags, closure);
+  return DeclareGlobals(isolate, declarations, closure);
 }
 
 namespace {
@@ -228,9 +204,8 @@ Object DeclareEvalHelper(Isolate* isolate, Handle<String> name,
          (context->IsBlockContext() &&
           context->scope_info().is_declaration_scope()));
 
-  bool is_function = value->IsJSFunction();
-  bool is_var = !is_function;
-  DCHECK(!is_var || value->IsUndefined(isolate));
+  bool is_var = value->IsUndefined(isolate);
+  DCHECK_IMPLIES(!is_var, value->IsJSFunction());
 
   int index;
   PropertyAttributes attributes;
@@ -249,20 +224,19 @@ Object DeclareEvalHelper(Isolate* isolate, Handle<String> name,
     // ES#sec-evaldeclarationinstantiation 8.a.iv.1.b:
     // If fnDefinable is false, throw a TypeError exception.
     return DeclareGlobal(isolate, Handle<JSGlobalObject>::cast(holder), name,
-                         value, NONE, is_var, is_function,
-                         RedeclarationType::kTypeError);
+                         value, NONE, is_var, RedeclarationType::kTypeError);
   }
-  if (context->extension().IsJSGlobalObject()) {
+  if (context->has_extension() && context->extension().IsJSGlobalObject()) {
     Handle<JSGlobalObject> global(JSGlobalObject::cast(context->extension()),
                                   isolate);
     return DeclareGlobal(isolate, global, name, value, NONE, is_var,
-                         is_function, RedeclarationType::kTypeError);
+                         RedeclarationType::kTypeError);
   } else if (context->IsScriptContext()) {
     DCHECK(context->global_object().IsJSGlobalObject());
     Handle<JSGlobalObject> global(
         JSGlobalObject::cast(context->global_object()), isolate);
     return DeclareGlobal(isolate, global, name, value, NONE, is_var,
-                         is_function, RedeclarationType::kTypeError);
+                         RedeclarationType::kTypeError);
   }
 
   if (attributes != ABSENT) {
@@ -271,7 +245,6 @@ Object DeclareEvalHelper(Isolate* isolate, Handle<String> name,
     // Skip var re-declarations.
     if (is_var) return ReadOnlyRoots(isolate).undefined_value();
 
-    DCHECK(is_function);
     if (index != Context::kNotFound) {
       DCHECK(holder.is_identical_to(context));
       context->set(index, *value);
@@ -439,7 +412,7 @@ Handle<JSObject> NewSloppyArguments(Isolate* isolate, Handle<JSFunction> callee,
         int parameter = scope_info->ContextLocalParameterNumber(i);
         if (parameter >= mapped_count) continue;
         arguments->set_the_hole(parameter);
-        Smi slot = Smi::FromInt(Context::MIN_CONTEXT_SLOTS + i);
+        Smi slot = Smi::FromInt(scope_info->ContextHeaderLength() + i);
         parameter_map->set(parameter + 2, slot);
       }
     } else {
@@ -624,69 +597,6 @@ RUNTIME_FUNCTION(Runtime_NewClosure_Tenured) {
   return *function;
 }
 
-static Object FindNameClash(Isolate* isolate, Handle<ScopeInfo> scope_info,
-                            Handle<JSGlobalObject> global_object,
-                            Handle<ScriptContextTable> script_context) {
-  for (int var = 0; var < scope_info->ContextLocalCount(); var++) {
-    Handle<String> name(scope_info->ContextLocalName(var), isolate);
-    VariableMode mode = scope_info->ContextLocalMode(var);
-    ScriptContextTable::LookupResult lookup;
-    if (ScriptContextTable::Lookup(isolate, *script_context, *name, &lookup)) {
-      if (IsLexicalVariableMode(mode) || IsLexicalVariableMode(lookup.mode)) {
-        // ES#sec-globaldeclarationinstantiation 5.b:
-        // If envRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
-        // exception.
-        return ThrowRedeclarationError(isolate, name,
-                                       RedeclarationType::kSyntaxError);
-      }
-    }
-
-    if (IsLexicalVariableMode(mode)) {
-      LookupIterator it(global_object, name, global_object,
-                        LookupIterator::OWN_SKIP_INTERCEPTOR);
-      Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
-      if (maybe.IsNothing()) return ReadOnlyRoots(isolate).exception();
-      if ((maybe.FromJust() & DONT_DELETE) != 0) {
-        // ES#sec-globaldeclarationinstantiation 5.a:
-        // If envRec.HasVarDeclaration(name) is true, throw a SyntaxError
-        // exception.
-        // ES#sec-globaldeclarationinstantiation 5.d:
-        // If hasRestrictedGlobal is true, throw a SyntaxError exception.
-        return ThrowRedeclarationError(isolate, name,
-                                       RedeclarationType::kSyntaxError);
-      }
-
-      JSGlobalObject::InvalidatePropertyCell(global_object, name);
-    }
-  }
-  return ReadOnlyRoots(isolate).undefined_value();
-}
-
-RUNTIME_FUNCTION(Runtime_NewScriptContext) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-
-  CONVERT_ARG_HANDLE_CHECKED(ScopeInfo, scope_info, 0);
-  Handle<NativeContext> native_context(NativeContext::cast(isolate->context()),
-                                       isolate);
-  Handle<JSGlobalObject> global_object(native_context->global_object(),
-                                       isolate);
-  Handle<ScriptContextTable> script_context_table(
-      native_context->script_context_table(), isolate);
-
-  Object name_clash_result =
-      FindNameClash(isolate, scope_info, global_object, script_context_table);
-  if (isolate->has_pending_exception()) return name_clash_result;
-
-  Handle<Context> result =
-      isolate->factory()->NewScriptContext(native_context, scope_info);
-
-  Handle<ScriptContextTable> new_script_context_table =
-      ScriptContextTable::Extend(script_context_table, result);
-  native_context->set_script_context_table(*new_script_context_table);
-  return *result;
-}
-
 RUNTIME_FUNCTION(Runtime_NewFunctionContext) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -991,5 +901,26 @@ RUNTIME_FUNCTION(Runtime_StoreLookupSlot_SloppyHoisting) {
                                LanguageMode::kSloppy, lookup_flags));
 }
 
+RUNTIME_FUNCTION(Runtime_StoreGlobalNoHoleCheckForReplLet) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(2, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(String, name, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
+
+  Handle<Context> native_context = isolate->native_context();
+  Handle<ScriptContextTable> script_contexts(
+      native_context->script_context_table(), isolate);
+
+  ScriptContextTable::LookupResult lookup_result;
+  bool found = ScriptContextTable::Lookup(isolate, *script_contexts, *name,
+                                          &lookup_result);
+  CHECK(found);
+  Handle<Context> script_context = ScriptContextTable::GetContext(
+      isolate, script_contexts, lookup_result.context_index);
+
+  script_context->set(lookup_result.slot_index, *value);
+  return *value;
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-strings.cc b/deps/v8/src/runtime/runtime-strings.cc
index 2ddd9d13f7134c..992a9c19a23226 100644
--- a/deps/v8/src/runtime/runtime-strings.cc
+++ b/deps/v8/src/runtime/runtime-strings.cc
@@ -362,12 +362,12 @@ static int CopyCachedOneByteCharsToArray(Heap* heap, const uint8_t* chars,
     elements.set(i, value, mode);
   }
   if (i < length) {
-    MemsetTagged(elements.RawFieldOfElementAt(i), Smi::kZero, length - i);
+    MemsetTagged(elements.RawFieldOfElementAt(i), Smi::zero(), length - i);
   }
 #ifdef DEBUG
   for (int j = 0; j < length; ++j) {
     Object element = elements.get(j);
-    DCHECK(element == Smi::kZero ||
+    DCHECK(element == Smi::zero() ||
            (element.IsString() && String::cast(element).LooksValid()));
   }
 #endif
diff --git a/deps/v8/src/runtime/runtime-symbol.cc b/deps/v8/src/runtime/runtime-symbol.cc
index b204033f39f51f..fff5a4f4006e10 100644
--- a/deps/v8/src/runtime/runtime-symbol.cc
+++ b/deps/v8/src/runtime/runtime-symbol.cc
@@ -18,13 +18,23 @@ RUNTIME_FUNCTION(Runtime_CreatePrivateSymbol) {
   DCHECK_GE(1, args.length());
   Handle<Symbol> symbol = isolate->factory()->NewPrivateSymbol();
   if (args.length() == 1) {
-    CONVERT_ARG_HANDLE_CHECKED(Object, name, 0);
-    CHECK(name->IsString() || name->IsUndefined(isolate));
-    if (name->IsString()) symbol->set_name(*name);
+    CONVERT_ARG_HANDLE_CHECKED(Object, description, 0);
+    CHECK(description->IsString() || description->IsUndefined(isolate));
+    if (description->IsString())
+      symbol->set_description(String::cast(*description));
   }
   return *symbol;
 }
 
+RUNTIME_FUNCTION(Runtime_CreatePrivateBrandSymbol) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(String, name, 0);
+  Handle<Symbol> symbol = isolate->factory()->NewPrivateNameSymbol(name);
+  symbol->set_is_private_brand();
+  return *symbol;
+}
+
 RUNTIME_FUNCTION(Runtime_CreatePrivateNameSymbol) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -39,8 +49,8 @@ RUNTIME_FUNCTION(Runtime_SymbolDescriptiveString) {
   CONVERT_ARG_HANDLE_CHECKED(Symbol, symbol, 0);
   IncrementalStringBuilder builder(isolate);
   builder.AppendCString("Symbol(");
-  if (symbol->name().IsString()) {
-    builder.AppendString(handle(String::cast(symbol->name()), isolate));
+  if (symbol->description().IsString()) {
+    builder.AppendString(handle(String::cast(symbol->description()), isolate));
   }
   builder.AppendCharacter(')');
   RETURN_RESULT_OR_FAILURE(isolate, builder.Finish());
diff --git a/deps/v8/src/runtime/runtime-test.cc b/deps/v8/src/runtime/runtime-test.cc
index a58b28ce52f314..fb06a8b8f95095 100644
--- a/deps/v8/src/runtime/runtime-test.cc
+++ b/deps/v8/src/runtime/runtime-test.cc
@@ -13,6 +13,7 @@
 #include "src/codegen/compiler.h"
 #include "src/codegen/pending-optimization-table.h"
 #include "src/compiler-dispatcher/optimizing-compile-dispatcher.h"
+#include "src/debug/debug-evaluate.h"
 #include "src/deoptimizer/deoptimizer.h"
 #include "src/execution/arguments-inl.h"
 #include "src/execution/frames-inl.h"
@@ -27,7 +28,6 @@
 #include "src/objects/js-array-inl.h"
 #include "src/objects/js-regexp-inl.h"
 #include "src/objects/smi.h"
-#include "src/snapshot/natives.h"
 #include "src/trap-handler/trap-handler.h"
 #include "src/utils/ostreams.h"
 #include "src/wasm/memory-tracing.h"
@@ -77,7 +77,7 @@ bool IsWasmInstantiateAllowed(v8::Isolate* isolate,
   DCHECK_GT(GetPerIsolateWasmControls()->count(isolate), 0);
   const WasmCompileControls& ctrls = GetPerIsolateWasmControls()->at(isolate);
   if (is_async && ctrls.AllowAnySizeForAsync) return true;
-  if (!module_or_bytes->IsWebAssemblyCompiledModule()) {
+  if (!module_or_bytes->IsWasmModuleObject()) {
     return IsWasmCompileAllowed(isolate, module_or_bytes, is_async);
   }
   v8::Local<v8::WasmModuleObject> module =
@@ -209,6 +209,20 @@ RUNTIME_FUNCTION(Runtime_RunningInSimulator) {
 #endif
 }
 
+RUNTIME_FUNCTION(Runtime_RuntimeEvaluateREPL) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(String, source, 0);
+  Handle<Object> result;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, result,
+      DebugEvaluate::Global(isolate, source,
+                            debug::EvaluateGlobalMode::kDefault,
+                            REPLMode::kYes));
+
+  return *result;
+}
+
 RUNTIME_FUNCTION(Runtime_ICsAreEnabled) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(0, args.length());
@@ -685,9 +699,15 @@ int FixedArrayLenFromSize(int size) {
 }
 
 void FillUpOneNewSpacePage(Isolate* isolate, Heap* heap) {
+  PauseAllocationObserversScope pause_observers(heap);
   NewSpace* space = heap->new_space();
-  int space_remaining = static_cast<int>(*space->allocation_limit_address() -
-                                         *space->allocation_top_address());
+  // We cannot rely on `space->limit()` to point to the end of the current page
+  // in the case where inline allocations are disabled, it actually points to
+  // the current allocation pointer.
+  DCHECK_IMPLIES(space->heap()->inline_allocation_disabled(),
+                 space->limit() == space->top());
+  int space_remaining =
+      static_cast<int>(space->to_space().page_high() - space->top());
   while (space_remaining > 0) {
     int length = FixedArrayLenFromSize(space_remaining);
     if (length > 0) {
@@ -710,7 +730,6 @@ RUNTIME_FUNCTION(Runtime_SimulateNewspaceFull) {
   HandleScope scope(isolate);
   Heap* heap = isolate->heap();
   NewSpace* space = heap->new_space();
-  PauseAllocationObserversScope pause_observers(heap);
   AlwaysAllocateScope always_allocate(heap);
   do {
     FillUpOneNewSpacePage(isolate, heap);
@@ -732,7 +751,7 @@ RUNTIME_FUNCTION(Runtime_DebugPrint) {
     Object object = maybe_object.GetHeapObjectOrSmi();
     bool weak = maybe_object.IsWeak();
 
-#ifdef DEBUG
+#ifdef OBJECT_PRINT
     if (object.IsString() && !isolate->context().is_null()) {
       DCHECK(!weak);
       // If we have a string, assume it's a code "marker"
@@ -994,18 +1013,25 @@ RUNTIME_FUNCTION(Runtime_IsAsmWasmCode) {
 }
 
 namespace {
-bool DisallowCodegenFromStringsCallback(v8::Local<v8::Context> context,
-                                        v8::Local<v8::String> source) {
-  return false;
+
+v8::ModifyCodeGenerationFromStringsResult DisallowCodegenFromStringsCallback(
+    v8::Local<v8::Context> context, v8::Local<v8::Value> source) {
+  return {false, {}};
 }
+
+bool DisallowWasmCodegenFromStringsCallback(v8::Local<v8::Context> context,
+                                            v8::Local<v8::String> source) {
+  return false;
 }
 
+}  // namespace
+
 RUNTIME_FUNCTION(Runtime_DisallowCodegenFromStrings) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_BOOLEAN_ARG_CHECKED(flag, 0);
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
-  v8_isolate->SetAllowCodeGenerationFromStringsCallback(
+  v8_isolate->SetModifyCodeGenerationFromStringsCallback(
       flag ? DisallowCodegenFromStringsCallback : nullptr);
   return ReadOnlyRoots(isolate).undefined_value();
 }
@@ -1016,7 +1042,7 @@ RUNTIME_FUNCTION(Runtime_DisallowWasmCodegen) {
   CONVERT_BOOLEAN_ARG_CHECKED(flag, 0);
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
   v8_isolate->SetAllowWasmCodeGenerationCallback(
-      flag ? DisallowCodegenFromStringsCallback : nullptr);
+      flag ? DisallowWasmCodegenFromStringsCallback : nullptr);
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
@@ -1096,8 +1122,13 @@ RUNTIME_FUNCTION(Runtime_RegexpHasBytecode) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_CHECKED(JSRegExp, regexp, 0);
   CONVERT_BOOLEAN_ARG_CHECKED(is_latin1, 1);
-  bool is_irregexp_bytecode = regexp.Bytecode(is_latin1).IsByteArray();
-  return isolate->heap()->ToBoolean(is_irregexp_bytecode);
+  bool result;
+  if (regexp.TypeTag() == JSRegExp::IRREGEXP) {
+    result = regexp.Bytecode(is_latin1).IsByteArray();
+  } else {
+    result = false;
+  }
+  return isolate->heap()->ToBoolean(result);
 }
 
 RUNTIME_FUNCTION(Runtime_RegexpHasNativeCode) {
@@ -1105,8 +1136,13 @@ RUNTIME_FUNCTION(Runtime_RegexpHasNativeCode) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_CHECKED(JSRegExp, regexp, 0);
   CONVERT_BOOLEAN_ARG_CHECKED(is_latin1, 1);
-  bool is_irregexp_native_code = regexp.Code(is_latin1).IsCode();
-  return isolate->heap()->ToBoolean(is_irregexp_native_code);
+  bool result;
+  if (regexp.TypeTag() == JSRegExp::IRREGEXP) {
+    result = regexp.Code(is_latin1).IsCode();
+  } else {
+    result = false;
+  }
+  return isolate->heap()->ToBoolean(result);
 }
 
 #define ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(Name)      \
@@ -1216,7 +1252,7 @@ RUNTIME_FUNCTION(Runtime_DeserializeWasmModule) {
   // Note that {wasm::DeserializeNativeModule} will allocate. We assume the
   // JSArrayBuffer backing store doesn't get relocated.
   MaybeHandle<WasmModuleObject> maybe_module_object =
-      wasm::DeserializeNativeModule(isolate, buffer_vec, wire_bytes_vec);
+      wasm::DeserializeNativeModule(isolate, buffer_vec, wire_bytes_vec, {});
   Handle<WasmModuleObject> module_object;
   if (!maybe_module_object.ToHandle(&module_object)) {
     return ReadOnlyRoots(isolate).undefined_value();
@@ -1231,7 +1267,7 @@ RUNTIME_FUNCTION(Runtime_CloneWasmModule) {
   CONVERT_ARG_HANDLE_CHECKED(WasmModuleObject, module_object, 0);
 
   Handle<WasmModuleObject> new_module_object =
-      wasm::WasmEngine::GetWasmEngine()->ImportNativeModule(
+      isolate->wasm_engine()->ImportNativeModule(
           isolate, module_object->shared_native_module());
 
   return *new_module_object;
@@ -1254,6 +1290,18 @@ RUNTIME_FUNCTION(Runtime_HeapObjectVerify) {
   return isolate->heap()->ToBoolean(true);
 }
 
+RUNTIME_FUNCTION(Runtime_ArrayBufferMaxByteLength) {
+  HandleScope shs(isolate);
+  DCHECK_EQ(0, args.length());
+  return *isolate->factory()->NewNumber(JSArrayBuffer::kMaxByteLength);
+}
+
+RUNTIME_FUNCTION(Runtime_TypedArrayMaxLength) {
+  HandleScope shs(isolate);
+  DCHECK_EQ(0, args.length());
+  return *isolate->factory()->NewNumber(JSTypedArray::kMaxLength);
+}
+
 RUNTIME_FUNCTION(Runtime_WasmGetNumberOfInstances) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
@@ -1346,6 +1394,26 @@ RUNTIME_FUNCTION(Runtime_WasmTierUpFunction) {
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
+RUNTIME_FUNCTION(Runtime_WasmTierDownModule) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
+  auto* native_module = instance->module_object().native_module();
+  native_module->TierDown(isolate);
+  CHECK(!native_module->compilation_state()->failed());
+  return ReadOnlyRoots(isolate).undefined_value();
+}
+
+RUNTIME_FUNCTION(Runtime_WasmTierUpModule) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
+  auto* native_module = instance->module_object().native_module();
+  native_module->TierUp(isolate);
+  CHECK(!native_module->compilation_state()->failed());
+  return ReadOnlyRoots(isolate).undefined_value();
+}
+
 RUNTIME_FUNCTION(Runtime_IsLiftoffFunction) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -1382,38 +1450,48 @@ RUNTIME_FUNCTION(Runtime_FreezeWasmLazyCompilation) {
 
 RUNTIME_FUNCTION(Runtime_TurbofanStaticAssert) {
   SealHandleScope shs(isolate);
-  // Always lowered to StaticAssert node in Turbofan, so we should never get
-  // here in compiled code.
+  // Always lowered to StaticAssert node in Turbofan, so we never get here in
+  // compiled code.
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
+RUNTIME_FUNCTION(Runtime_IsBeingInterpreted) {
+  SealHandleScope shs(isolate);
+  // Always lowered to false in Turbofan, so we never get here in compiled code.
+  return ReadOnlyRoots(isolate).true_value();
+}
+
 RUNTIME_FUNCTION(Runtime_EnableCodeLoggingForTesting) {
   // The {NoopListener} currently does nothing on any callback, but reports
   // {true} on {is_listening_to_code_events()}. Feel free to add assertions to
   // any method to further test the code logging callbacks.
   class NoopListener final : public CodeEventListener {
-    void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                         const char* comment) final {}
-    void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                         Name name) final {}
-    void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                         SharedFunctionInfo shared, Name source) final {}
-    void CodeCreateEvent(LogEventsAndTags tag, AbstractCode code,
-                         SharedFunctionInfo shared, Name source, int line,
-                         int column) final {}
+    void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                         const char* name) final {}
+    void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                         Handle<Name> name) final {}
+    void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                         Handle<SharedFunctionInfo> shared,
+                         Handle<Name> script_name) final {}
+    void CodeCreateEvent(LogEventsAndTags tag, Handle<AbstractCode> code,
+                         Handle<SharedFunctionInfo> shared,
+                         Handle<Name> script_name, int line, int column) final {
+    }
     void CodeCreateEvent(LogEventsAndTags tag, const wasm::WasmCode* code,
                          wasm::WasmName name) final {}
-    void CallbackEvent(Name name, Address entry_point) final {}
-    void GetterCallbackEvent(Name name, Address entry_point) final {}
-    void SetterCallbackEvent(Name name, Address entry_point) final {}
-    void RegExpCodeCreateEvent(AbstractCode code, String source) final {}
+
+    void CallbackEvent(Handle<Name> name, Address entry_point) final {}
+    void GetterCallbackEvent(Handle<Name> name, Address entry_point) final {}
+    void SetterCallbackEvent(Handle<Name> name, Address entry_point) final {}
+    void RegExpCodeCreateEvent(Handle<AbstractCode> code,
+                               Handle<String> source) final {}
     void CodeMoveEvent(AbstractCode from, AbstractCode to) final {}
     void SharedFunctionInfoMoveEvent(Address from, Address to) final {}
     void NativeContextMoveEvent(Address from, Address to) final {}
     void CodeMovingGCEvent() final {}
-    void CodeDisableOptEvent(AbstractCode code,
-                             SharedFunctionInfo shared) final {}
-    void CodeDeoptEvent(Code code, DeoptimizeKind kind, Address pc,
+    void CodeDisableOptEvent(Handle<AbstractCode> code,
+                             Handle<SharedFunctionInfo> shared) final {}
+    void CodeDeoptEvent(Handle<Code> code, DeoptimizeKind kind, Address pc,
                         int fp_to_sp_delta) final {}
 
     bool is_listening_to_code_events() final { return true; }
@@ -1424,5 +1502,22 @@ RUNTIME_FUNCTION(Runtime_EnableCodeLoggingForTesting) {
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
+RUNTIME_FUNCTION(Runtime_NewRegExpWithBacktrackLimit) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(3, args.length());
+
+  CONVERT_ARG_HANDLE_CHECKED(String, pattern, 0);
+  CONVERT_ARG_HANDLE_CHECKED(String, flags_string, 1);
+  CONVERT_UINT32_ARG_CHECKED(backtrack_limit, 2);
+
+  bool success = false;
+  JSRegExp::Flags flags =
+      JSRegExp::FlagsFromString(isolate, flags_string, &success);
+  CHECK(success);
+
+  RETURN_RESULT_OR_FAILURE(
+      isolate, JSRegExp::New(isolate, pattern, flags, backtrack_limit));
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-typedarray.cc b/deps/v8/src/runtime/runtime-typedarray.cc
index 327c1022388eeb..c5bc52da91666f 100644
--- a/deps/v8/src/runtime/runtime-typedarray.cc
+++ b/deps/v8/src/runtime/runtime-typedarray.cc
@@ -42,7 +42,7 @@ RUNTIME_FUNCTION(Runtime_TypedArrayCopyElements) {
   CHECK(TryNumberToSize(*length_obj, &length));
 
   ElementsAccessor* accessor = target->GetElementsAccessor();
-  return accessor->CopyElements(source, target, length);
+  return accessor->CopyElements(source, target, length, 0);
 }
 
 RUNTIME_FUNCTION(Runtime_TypedArrayGetBuffer) {
@@ -85,7 +85,7 @@ RUNTIME_FUNCTION(Runtime_TypedArraySortFast) {
   DCHECK(!array->WasDetached());
 
   size_t length = array->length();
-  if (length <= 1) return *array;
+  DCHECK_LT(1, length);
 
   // In case of a SAB, the data is copied into temporary memory, as
   // std::sort might crash in case the underlying data is concurrently
@@ -95,14 +95,20 @@ RUNTIME_FUNCTION(Runtime_TypedArraySortFast) {
   const bool copy_data = buffer->is_shared();
 
   Handle<ByteArray> array_copy;
+  std::vector<uint8_t> offheap_copy;
+  void* data_copy_ptr = nullptr;
   if (copy_data) {
     const size_t bytes = array->byte_length();
-    // TODO(szuend): Re-check this approach once support for larger typed
-    //               arrays has landed.
-    CHECK_LE(bytes, INT_MAX);
-    array_copy = isolate->factory()->NewByteArray(static_cast<int>(bytes));
-    std::memcpy(static_cast<void*>(array_copy->GetDataStartAddress()),
-                static_cast<void*>(array->DataPtr()), bytes);
+    if (bytes <= static_cast<unsigned>(
+                     ByteArray::LengthFor(kMaxRegularHeapObjectSize))) {
+      array_copy = isolate->factory()->NewByteArray(static_cast<int>(bytes));
+      data_copy_ptr = array_copy->GetDataStartAddress();
+    } else {
+      // Allocate copy in C++ heap.
+      offheap_copy.resize(bytes);
+      data_copy_ptr = &offheap_copy[0];
+    }
+    std::memcpy(data_copy_ptr, static_cast<void*>(array->DataPtr()), bytes);
   }
 
   DisallowHeapAllocation no_gc;
@@ -110,10 +116,8 @@ RUNTIME_FUNCTION(Runtime_TypedArraySortFast) {
   switch (array->type()) {
 #define TYPED_ARRAY_SORT(Type, type, TYPE, ctype)                          \
   case kExternal##Type##Array: {                                           \
-    ctype* data =                                                          \
-        copy_data                                                          \
-            ? reinterpret_cast<ctype*>(array_copy->GetDataStartAddress())  \
-            : static_cast<ctype*>(array->DataPtr());                       \
+    ctype* data = copy_data ? reinterpret_cast<ctype*>(data_copy_ptr)      \
+                            : static_cast<ctype*>(array->DataPtr());       \
     if (kExternal##Type##Array == kExternalFloat64Array ||                 \
         kExternal##Type##Array == kExternalFloat32Array) {                 \
       if (COMPRESS_POINTERS_BOOL && alignof(ctype) > kTaggedSize) {        \
@@ -140,58 +144,31 @@ RUNTIME_FUNCTION(Runtime_TypedArraySortFast) {
   }
 
   if (copy_data) {
-    DCHECK(!array_copy.is_null());
+    DCHECK_NOT_NULL(data_copy_ptr);
+    DCHECK_NE(array_copy.is_null(), offheap_copy.empty());
     const size_t bytes = array->byte_length();
-    std::memcpy(static_cast<void*>(array->DataPtr()),
-                static_cast<void*>(array_copy->GetDataStartAddress()), bytes);
+    std::memcpy(static_cast<void*>(array->DataPtr()), data_copy_ptr, bytes);
   }
 
   return *array;
 }
 
-// 22.2.3.23 %TypedArray%.prototype.set ( overloaded [ , offset ] )
 RUNTIME_FUNCTION(Runtime_TypedArraySet) {
   HandleScope scope(isolate);
-  Handle<JSTypedArray> target = args.at<JSTypedArray>(0);
-  Handle<Object> obj = args.at(1);
-  Handle<Smi> offset = args.at<Smi>(2);
-
-  DCHECK(!target->WasDetached());  // Checked in TypedArrayPrototypeSet.
-  DCHECK(!obj->IsJSTypedArray());  // Should be handled by CSA.
-  DCHECK_LE(0, offset->value());
-
-  const uint32_t uint_offset = static_cast<uint32_t>(offset->value());
-
-  if (obj->IsNumber()) {
-    // For number as a first argument, throw TypeError
-    // instead of silently ignoring the call, so that
-    // users know they did something wrong.
-    // (Consistent with Firefox and Blink/WebKit)
-    THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewTypeError(MessageTemplate::kInvalidArgument));
-  }
-
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, obj,
-                                     Object::ToObject(isolate, obj));
-
-  Handle<Object> len;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, len,
-      Object::GetProperty(isolate, obj, isolate->factory()->length_string()));
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, len,
-                                     Object::ToLength(isolate, len));
+  DCHECK_EQ(4, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, target, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, source, 1);
+  CONVERT_NUMBER_ARG_HANDLE_CHECKED(length_obj, 2);
+  CONVERT_NUMBER_ARG_HANDLE_CHECKED(offset_obj, 3);
 
-  if (uint_offset + len->Number() > target->length()) {
-    THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewRangeError(MessageTemplate::kTypedArraySetSourceTooLarge));
-  }
+  size_t length;
+  CHECK(TryNumberToSize(*length_obj, &length));
 
-  uint32_t int_l;
-  CHECK(DoubleToUint32IfEqualToSelf(len->Number(), &int_l));
+  size_t offset;
+  CHECK(TryNumberToSize(*offset_obj, &offset));
 
-  Handle<JSReceiver> source = Handle<JSReceiver>::cast(obj);
   ElementsAccessor* accessor = target->GetElementsAccessor();
-  return accessor->CopyElements(source, target, int_l, uint_offset);
+  return accessor->CopyElements(source, target, length, offset);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/runtime/runtime-wasm.cc b/deps/v8/src/runtime/runtime-wasm.cc
index b0153b782864be..3e0ab345916b67 100644
--- a/deps/v8/src/runtime/runtime-wasm.cc
+++ b/deps/v8/src/runtime/runtime-wasm.cc
@@ -71,7 +71,7 @@ RUNTIME_FUNCTION(Runtime_WasmIsValidFuncRefValue) {
   if (function->IsNull(isolate)) {
     return Smi::FromInt(true);
   }
-  if (WasmExportedFunction::IsWasmExportedFunction(*function)) {
+  if (WasmExternalFunction::IsWasmExternalFunction(*function)) {
     return Smi::FromInt(true);
   }
   return Smi::FromInt(false);
@@ -123,7 +123,7 @@ RUNTIME_FUNCTION(Runtime_WasmThrowCreate) {
   isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
   CONVERT_ARG_CHECKED(WasmExceptionTag, tag_raw, 0);
   CONVERT_SMI_ARG_CHECKED(size, 1);
-  // TODO(mstarzinger): Manually box because parameters are not visited yet.
+  // TODO(wasm): Manually box because parameters are not visited yet.
   Handle<Object> tag(tag_raw, isolate);
   Handle<Object> exception = isolate->factory()->NewWasmRuntimeError(
       MessageTemplate::kWasmExceptionError);
@@ -148,7 +148,7 @@ RUNTIME_FUNCTION(Runtime_WasmExceptionGetTag) {
   DCHECK(isolate->context().is_null());
   isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
   CONVERT_ARG_CHECKED(Object, except_obj_raw, 0);
-  // TODO(mstarzinger): Manually box because parameters are not visited yet.
+  // TODO(wasm): Manually box because parameters are not visited yet.
   Handle<Object> except_obj(except_obj_raw, isolate);
   if (!except_obj->IsWasmExceptionPackage(isolate)) {
     return ReadOnlyRoots(isolate).undefined_value();
@@ -165,7 +165,7 @@ RUNTIME_FUNCTION(Runtime_WasmExceptionGetValues) {
   DCHECK(isolate->context().is_null());
   isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
   CONVERT_ARG_CHECKED(Object, except_obj_raw, 0);
-  // TODO(mstarzinger): Manually box because parameters are not visited yet.
+  // TODO(wasm): Manually box because parameters are not visited yet.
   Handle<Object> except_obj(except_obj_raw, isolate);
   if (!except_obj->IsWasmExceptionPackage(isolate)) {
     return ReadOnlyRoots(isolate).undefined_value();
@@ -236,11 +236,13 @@ RUNTIME_FUNCTION(Runtime_WasmRunInterpreter) {
 #undef CASE_ARG_TYPE
       case wasm::kWasmAnyRef:
       case wasm::kWasmFuncRef:
+      case wasm::kWasmNullRef:
       case wasm::kWasmExnRef: {
         DCHECK_EQ(wasm::ValueTypes::ElementSizeInBytes(sig->GetParam(i)),
                   kSystemPointerSize);
         Handle<Object> ref(base::ReadUnalignedValue<Object>(arg_buf_ptr),
                            isolate);
+        DCHECK_IMPLIES(sig->GetParam(i) == wasm::kWasmNullRef, ref->IsNull());
         wasm_args[i] = wasm::WasmValue(ref);
         arg_buf_ptr += kSystemPointerSize;
         break;
@@ -287,9 +289,12 @@ RUNTIME_FUNCTION(Runtime_WasmRunInterpreter) {
 #undef CASE_RET_TYPE
       case wasm::kWasmAnyRef:
       case wasm::kWasmFuncRef:
+      case wasm::kWasmNullRef:
       case wasm::kWasmExnRef: {
         DCHECK_EQ(wasm::ValueTypes::ElementSizeInBytes(sig->GetReturn(i)),
                   kSystemPointerSize);
+        DCHECK_IMPLIES(sig->GetReturn(i) == wasm::kWasmNullRef,
+                       wasm_rets[i].to_anyref()->IsNull());
         base::WriteUnalignedValue<Object>(arg_buf_ptr,
                                           *wasm_rets[i].to_anyref());
         arg_buf_ptr += kSystemPointerSize;
@@ -477,7 +482,7 @@ RUNTIME_FUNCTION(Runtime_WasmFunctionTableSet) {
   CONVERT_UINT32_ARG_CHECKED(table_index, 1);
   CONVERT_UINT32_ARG_CHECKED(entry_index, 2);
   CONVERT_ARG_CHECKED(Object, element_raw, 3);
-  // TODO(mstarzinger): Manually box because parameters are not visited yet.
+  // TODO(wasm): Manually box because parameters are not visited yet.
   Handle<Object> element(element_raw, isolate);
   DCHECK_LT(table_index, instance->tables().length());
   auto table = handle(
@@ -536,7 +541,7 @@ RUNTIME_FUNCTION(Runtime_WasmTableGrow) {
       Handle<WasmInstanceObject>(GetWasmInstanceOnStackTop(isolate), isolate);
   CONVERT_UINT32_ARG_CHECKED(table_index, 0);
   CONVERT_ARG_CHECKED(Object, value_raw, 1);
-  // TODO(mstarzinger): Manually box because parameters are not visited yet.
+  // TODO(wasm): Manually box because parameters are not visited yet.
   Handle<Object> value(value_raw, isolate);
   CONVERT_UINT32_ARG_CHECKED(delta, 2);
 
@@ -555,14 +560,14 @@ RUNTIME_FUNCTION(Runtime_WasmTableFill) {
   CONVERT_UINT32_ARG_CHECKED(table_index, 0);
   CONVERT_UINT32_ARG_CHECKED(start, 1);
   CONVERT_ARG_CHECKED(Object, value_raw, 2);
-  // TODO(mstarzinger): Manually box because parameters are not visited yet.
+  // TODO(wasm): Manually box because parameters are not visited yet.
   Handle<Object> value(value_raw, isolate);
   CONVERT_UINT32_ARG_CHECKED(count, 3);
 
   Handle<WasmTableObject> table(
       WasmTableObject::cast(instance->tables().get(table_index)), isolate);
 
-  uint32_t table_size = static_cast<uint32_t>(table->entries().length());
+  uint32_t table_size = table->current_length();
 
   if (start > table_size) {
     return ThrowTableOutOfBounds(isolate, instance);
diff --git a/deps/v8/src/runtime/runtime.cc b/deps/v8/src/runtime/runtime.cc
index 09840802935309..2bba57f9109a34 100644
--- a/deps/v8/src/runtime/runtime.cc
+++ b/deps/v8/src/runtime/runtime.cc
@@ -111,6 +111,7 @@ bool Runtime::NeedsExactContext(FunctionId id) {
     case Runtime::kCopyDataProperties:
     case Runtime::kCreateDataProperty:
     case Runtime::kCreatePrivateNameSymbol:
+    case Runtime::kCreatePrivateBrandSymbol:
     case Runtime::kLoadPrivateGetter:
     case Runtime::kLoadPrivateSetter:
     case Runtime::kReThrow:
diff --git a/deps/v8/src/runtime/runtime.h b/deps/v8/src/runtime/runtime.h
index 8319aabe2c8d39..c9c4dd5931b937 100644
--- a/deps/v8/src/runtime/runtime.h
+++ b/deps/v8/src/runtime/runtime.h
@@ -7,6 +7,8 @@
 
 #include <memory>
 
+#include "include/v8.h"
+#include "src/base/bit-field.h"
 #include "src/base/platform/time.h"
 #include "src/common/globals.h"
 #include "src/objects/elements-kind.h"
@@ -31,7 +33,7 @@ namespace internal {
 // * Each compiler has an explicit list of intrisics it supports, falling back
 //   to a simple runtime call if necessary.
 
-// Entries have the form F(name, number of arguments, number of values):
+// Entries have the form F(name, number of arguments, number of return values):
 // A variable number of arguments is specified by a -1, additional restrictions
 // are specified by inline comments. To declare only the runtime version (no
 // inline), use the F macro below. To declare the runtime version and the inline
@@ -210,6 +212,7 @@ namespace internal {
   F(AllowDynamicFunction, 1, 1)                      \
   I(CreateAsyncFromSyncIterator, 1, 1)               \
   F(CreateListFromArrayLike, 1, 1)                   \
+  F(DoubleToStringWithRadix, 2, 1)                   \
   F(FatalProcessOutOfMemoryInAllocateRaw, 0, 1)      \
   F(FatalProcessOutOfMemoryInvalidArrayLength, 0, 1) \
   F(GetAndResetRuntimeCallStats, -1 /* <= 2 */, 1)   \
@@ -226,6 +229,7 @@ namespace internal {
   F(RunMicrotaskCallback, 2, 1)                      \
   F(PerformMicrotaskCheckpoint, 0, 1)                \
   F(StackGuard, 0, 1)                                \
+  F(StackGuardWithGap, 1, 1)                         \
   F(Throw, 1, 1)                                     \
   F(ThrowApplyNonFunction, 1, 1)                     \
   F(ThrowCalledNonCallable, 1, 1)                    \
@@ -262,6 +266,7 @@ namespace internal {
   F(GetModuleNamespace, 1, 1)
 
 #define FOR_EACH_INTRINSIC_NUMBERS(F, I) \
+  F(ArrayBufferMaxByteLength, 0, 1)      \
   F(GetHoleNaNLower, 0, 1)               \
   F(GetHoleNaNUpper, 0, 1)               \
   I(IsSmi, 1, 1)                         \
@@ -270,12 +275,13 @@ namespace internal {
   F(NumberToString, 1, 1)                \
   F(StringParseFloat, 1, 1)              \
   F(StringParseInt, 2, 1)                \
-  F(StringToNumber, 1, 1)
+  F(StringToNumber, 1, 1)                \
+  F(TypedArrayMaxLength, 0, 1)
 
 #define FOR_EACH_INTRINSIC_OBJECT(F, I)                         \
   F(AddDictionaryProperty, 3, 1)                                \
   F(AddPrivateField, 3, 1)                                      \
-  F(AddPrivateBrand, 2, 1)                                      \
+  F(AddPrivateBrand, 3, 1)                                      \
   F(AllocateHeapNumber, 0, 1)                                   \
   F(ClassOf, 1, 1)                                              \
   F(CollectTypeProfile, 3, 1)                                   \
@@ -377,30 +383,30 @@ namespace internal {
   F(StringReplaceNonGlobalRegExpWithFunction, 3, 1) \
   F(StringSplit, 3, 1)
 
-#define FOR_EACH_INTRINSIC_SCOPES(F, I)   \
-  F(DeclareEvalFunction, 2, 1)            \
-  F(DeclareEvalVar, 1, 1)                 \
-  F(DeclareGlobals, 3, 1)                 \
-  F(DeleteLookupSlot, 1, 1)               \
-  F(LoadLookupSlot, 1, 1)                 \
-  F(LoadLookupSlotInsideTypeof, 1, 1)     \
-  F(NewArgumentsElements, 3, 1)           \
-                                          \
-  F(NewClosure, 2, 1)                     \
-  F(NewClosure_Tenured, 2, 1)             \
-  F(NewFunctionContext, 1, 1)             \
-  F(NewRestParameter, 1, 1)               \
-  F(NewScriptContext, 1, 1)               \
-  F(NewSloppyArguments, 3, 1)             \
-  F(NewSloppyArguments_Generic, 1, 1)     \
-  F(NewStrictArguments, 1, 1)             \
-  F(PushBlockContext, 1, 1)               \
-  F(PushCatchContext, 2, 1)               \
-  F(PushModuleContext, 2, 1)              \
-  F(PushWithContext, 2, 1)                \
-  F(StoreLookupSlot_Sloppy, 2, 1)         \
-  F(StoreLookupSlot_SloppyHoisting, 2, 1) \
-  F(StoreLookupSlot_Strict, 2, 1)         \
+#define FOR_EACH_INTRINSIC_SCOPES(F, I)     \
+  F(DeclareEvalFunction, 2, 1)              \
+  F(DeclareEvalVar, 1, 1)                   \
+  F(DeclareGlobals, 2, 1)                   \
+  F(DeleteLookupSlot, 1, 1)                 \
+  F(LoadLookupSlot, 1, 1)                   \
+  F(LoadLookupSlotInsideTypeof, 1, 1)       \
+  F(NewArgumentsElements, 3, 1)             \
+                                            \
+  F(NewClosure, 2, 1)                       \
+  F(NewClosure_Tenured, 2, 1)               \
+  F(NewFunctionContext, 1, 1)               \
+  F(NewRestParameter, 1, 1)                 \
+  F(NewSloppyArguments, 3, 1)               \
+  F(NewSloppyArguments_Generic, 1, 1)       \
+  F(NewStrictArguments, 1, 1)               \
+  F(PushBlockContext, 1, 1)                 \
+  F(PushCatchContext, 2, 1)                 \
+  F(PushModuleContext, 2, 1)                \
+  F(PushWithContext, 2, 1)                  \
+  F(StoreGlobalNoHoleCheckForReplLet, 2, 1) \
+  F(StoreLookupSlot_Sloppy, 2, 1)           \
+  F(StoreLookupSlot_SloppyHoisting, 2, 1)   \
+  F(StoreLookupSlot_Strict, 2, 1)           \
   F(ThrowConstAssignError, 0, 1)
 
 #define FOR_EACH_INTRINSIC_STRINGS(F, I)  \
@@ -429,6 +435,7 @@ namespace internal {
 
 #define FOR_EACH_INTRINSIC_SYMBOL(F, I)    \
   F(CreatePrivateNameSymbol, 1, 1)         \
+  F(CreatePrivateBrandSymbol, 1, 1)        \
   F(CreatePrivateSymbol, -1 /* <= 1 */, 1) \
   F(SymbolDescriptiveString, 1, 1)         \
   F(SymbolIsPrivate, 1, 1)
@@ -491,6 +498,7 @@ namespace internal {
   F(ICsAreEnabled, 0, 1)                      \
   F(InYoungGeneration, 1, 1)                  \
   F(IsAsmWasmCode, 1, 1)                      \
+  F(IsBeingInterpreted, 0, 1)                 \
   F(IsConcurrentRecompilationSupported, 0, 1) \
   F(IsLiftoffFunction, 1, 1)                  \
   F(IsThreadInWasm, 0, 1)                     \
@@ -503,10 +511,12 @@ namespace internal {
   F(NotifyContextDisposed, 0, 1)              \
   F(OptimizeFunctionOnNextCall, -1, 1)        \
   F(OptimizeOsr, -1, 1)                       \
+  F(NewRegExpWithBacktrackLimit, 3, 1)        \
   F(PrepareFunctionForOptimization, -1, 1)    \
   F(PrintWithNameForAssert, 2, 1)             \
   F(RedirectToWasmInterpreter, 2, 1)          \
   F(RunningInSimulator, 0, 1)                 \
+  F(RuntimeEvaluateREPL, 1, 1)                \
   F(SerializeWasmModule, 1, 1)                \
   F(SetAllocationTimeout, -1 /* 2 || 3 */, 1) \
   F(SetForceSlowPath, 1, 1)                   \
@@ -524,7 +534,9 @@ namespace internal {
   F(WasmGetNumberOfInstances, 1, 1)           \
   F(WasmNumInterpretedCalls, 1, 1)            \
   F(WasmNumCodeSpaces, 1, 1)                  \
+  F(WasmTierDownModule, 1, 1)                 \
   F(WasmTierUpFunction, 2, 1)                 \
+  F(WasmTierUpModule, 1, 1)                   \
   F(WasmTraceMemory, 1, 1)                    \
   I(DeoptimizeNow, 0, 1)
 
@@ -576,6 +588,7 @@ namespace internal {
   F(LoadGlobalIC_Miss, 4, 1)                 \
   F(LoadGlobalIC_Slow, 3, 1)                 \
   F(LoadIC_Miss, 4, 1)                       \
+  F(LoadNoFeedbackIC_Miss, 4, 1)             \
   F(LoadPropertyWithInterceptor, 5, 1)       \
   F(StoreCallbackProperty, 5, 1)             \
   F(StoreGlobalIC_Miss, 4, 1)                \
@@ -775,11 +788,9 @@ V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, Runtime::FunctionId);
 //---------------------------------------------------------------------------
 // Constants used by interface to runtime functions.
 
-using AllocateDoubleAlignFlag = BitField<bool, 0, 1>;
+using AllocateDoubleAlignFlag = base::BitField<bool, 0, 1>;
 
-using AllowLargeObjectAllocationFlag = BitField<bool, 1, 1>;
-
-using DeclareGlobalsEvalFlag = BitField<bool, 0, 1>;
+using AllowLargeObjectAllocationFlag = base::BitField<bool, 1, 1>;
 
 // A set of bits returned by Runtime_GetOptimizationStatus.
 // These bits must be in sync with bits defined in test/mjsunit/mjsunit.js
diff --git a/deps/v8/src/snapshot/DEPS b/deps/v8/src/snapshot/DEPS
index 810dfd6e84e91e..70ef55e3408ac9 100644
--- a/deps/v8/src/snapshot/DEPS
+++ b/deps/v8/src/snapshot/DEPS
@@ -2,4 +2,7 @@ specific_include_rules = {
   "mksnapshot\.cc": [
     "+include/libplatform/libplatform.h",
   ],
+  "serializer-common.cc": [
+    "+third_party/zlib",
+  ],
 }
diff --git a/deps/v8/src/snapshot/code-serializer.cc b/deps/v8/src/snapshot/code-serializer.cc
index 774c2f3789e27e..30098bab467509 100644
--- a/deps/v8/src/snapshot/code-serializer.cc
+++ b/deps/v8/src/snapshot/code-serializer.cc
@@ -197,11 +197,6 @@ void CodeSerializer::SerializeObject(HeapObject obj) {
   }
 #endif  // V8_TARGET_ARCH_ARM
 
-  if (obj.IsBytecodeArray()) {
-    // Clear the stack frame cache if present
-    BytecodeArray::cast(obj).ClearFrameCacheFromSourcePositionTable();
-  }
-
   // Past this point we should not see any (context-specific) maps anymore.
   CHECK(!obj.IsMap());
   // There should be no references to the global object embedded.
@@ -228,16 +223,16 @@ void CodeSerializer::SerializeGeneric(HeapObject heap_object) {
 void CreateInterpreterDataForDeserializedCode(Isolate* isolate,
                                               Handle<SharedFunctionInfo> sfi,
                                               bool log_code_creation) {
-  Script script = Script::cast(sfi->script());
-  Handle<Script> script_handle(script, isolate);
+  Handle<Script> script(Script::cast(sfi->script()), isolate);
   String name = ReadOnlyRoots(isolate).empty_string();
-  if (script.name().IsString()) name = String::cast(script.name());
+  if (script->name().IsString()) name = String::cast(script->name());
   Handle<String> name_handle(name, isolate);
 
-  SharedFunctionInfo::ScriptIterator iter(isolate, script);
-  for (SharedFunctionInfo info = iter.Next(); !info.is_null();
-       info = iter.Next()) {
-    if (!info.HasBytecodeArray()) continue;
+  SharedFunctionInfo::ScriptIterator iter(isolate, *script);
+  for (SharedFunctionInfo shared_info = iter.Next(); !shared_info.is_null();
+       shared_info = iter.Next()) {
+    if (!shared_info.HasBytecodeArray()) continue;
+    Handle<SharedFunctionInfo> info = handle(shared_info, isolate);
     Handle<Code> code = isolate->factory()->CopyCode(Handle<Code>::cast(
         isolate->factory()->interpreter_entry_trampoline_for_profiling()));
 
@@ -245,18 +240,18 @@ void CreateInterpreterDataForDeserializedCode(Isolate* isolate,
         Handle<InterpreterData>::cast(isolate->factory()->NewStruct(
             INTERPRETER_DATA_TYPE, AllocationType::kOld));
 
-    interpreter_data->set_bytecode_array(info.GetBytecodeArray());
+    interpreter_data->set_bytecode_array(info->GetBytecodeArray());
     interpreter_data->set_interpreter_trampoline(*code);
 
-    info.set_interpreter_data(*interpreter_data);
+    info->set_interpreter_data(*interpreter_data);
 
     if (!log_code_creation) continue;
     Handle<AbstractCode> abstract_code = Handle<AbstractCode>::cast(code);
-    int line_num = script.GetLineNumber(info.StartPosition()) + 1;
-    int column_num = script.GetColumnNumber(info.StartPosition()) + 1;
+    int line_num = script->GetLineNumber(info->StartPosition()) + 1;
+    int column_num = script->GetColumnNumber(info->StartPosition()) + 1;
     PROFILE(isolate,
             CodeCreateEvent(CodeEventListener::INTERPRETED_FUNCTION_TAG,
-                            *abstract_code, info, *name_handle, line_num,
+                            abstract_code, info, name_handle, line_num,
                             column_num));
   }
 }
@@ -344,9 +339,10 @@ MaybeHandle<SharedFunctionInfo> CodeSerializer::Deserialize(
               script->GetLineNumber(shared_info->StartPosition()) + 1;
           int column_num =
               script->GetColumnNumber(shared_info->StartPosition()) + 1;
-          PROFILE(isolate, CodeCreateEvent(CodeEventListener::SCRIPT_TAG,
-                                           info.abstract_code(), *shared_info,
-                                           *name, line_num, column_num));
+          PROFILE(isolate,
+                  CodeCreateEvent(CodeEventListener::SCRIPT_TAG,
+                                  handle(shared_info->abstract_code(), isolate),
+                                  shared_info, name, line_num, column_num));
         }
       }
     }
@@ -403,9 +399,7 @@ SerializedCodeData::SerializedCodeData(const std::vector<byte>* payload,
   CopyBytes(data_ + padded_payload_offset, payload->data(),
             static_cast<size_t>(payload->size()));
 
-  Checksum checksum(ChecksummedContent());
-  SetHeaderValue(kChecksumPartAOffset, checksum.a());
-  SetHeaderValue(kChecksumPartBOffset, checksum.b());
+  SetHeaderValue(kChecksumOffset, Checksum(ChecksummedContent()));
 }
 
 SerializedCodeData::SanityCheckResult SerializedCodeData::SanityCheck(
@@ -417,8 +411,7 @@ SerializedCodeData::SanityCheckResult SerializedCodeData::SanityCheck(
   uint32_t source_hash = GetHeaderValue(kSourceHashOffset);
   uint32_t flags_hash = GetHeaderValue(kFlagHashOffset);
   uint32_t payload_length = GetHeaderValue(kPayloadLengthOffset);
-  uint32_t c1 = GetHeaderValue(kChecksumPartAOffset);
-  uint32_t c2 = GetHeaderValue(kChecksumPartBOffset);
+  uint32_t c = GetHeaderValue(kChecksumOffset);
   if (version_hash != Version::Hash()) return VERSION_MISMATCH;
   if (source_hash != expected_source_hash) return SOURCE_MISMATCH;
   if (flags_hash != FlagList::Hash()) return FLAGS_MISMATCH;
@@ -427,7 +420,7 @@ SerializedCodeData::SanityCheckResult SerializedCodeData::SanityCheck(
       POINTER_SIZE_ALIGN(kHeaderSize +
                          GetHeaderValue(kNumReservationsOffset) * kInt32Size);
   if (payload_length > max_payload_length) return LENGTH_MISMATCH;
-  if (!Checksum(ChecksummedContent()).Check(c1, c2)) return CHECKSUM_MISMATCH;
+  if (Checksum(ChecksummedContent()) != c) return CHECKSUM_MISMATCH;
   return CHECK_SUCCESS;
 }
 
diff --git a/deps/v8/src/snapshot/code-serializer.h b/deps/v8/src/snapshot/code-serializer.h
index 78b1cdc77c2b32..ace50b26f3a112 100644
--- a/deps/v8/src/snapshot/code-serializer.h
+++ b/deps/v8/src/snapshot/code-serializer.h
@@ -94,8 +94,7 @@ class SerializedCodeData : public SerializedData {
   // [3] flag hash
   // [4] number of reservation size entries
   // [5] payload length
-  // [6] payload checksum part A
-  // [7] payload checksum part B
+  // [6] payload checksum
   // ...  reservations
   // ...  code stub keys
   // ...  serialized payload
@@ -105,12 +104,8 @@ class SerializedCodeData : public SerializedData {
   static const uint32_t kNumReservationsOffset = kFlagHashOffset + kUInt32Size;
   static const uint32_t kPayloadLengthOffset =
       kNumReservationsOffset + kUInt32Size;
-  static const uint32_t kChecksumPartAOffset =
-      kPayloadLengthOffset + kUInt32Size;
-  static const uint32_t kChecksumPartBOffset =
-      kChecksumPartAOffset + kUInt32Size;
-  static const uint32_t kUnalignedHeaderSize =
-      kChecksumPartBOffset + kUInt32Size;
+  static const uint32_t kChecksumOffset = kPayloadLengthOffset + kUInt32Size;
+  static const uint32_t kUnalignedHeaderSize = kChecksumOffset + kUInt32Size;
   static const uint32_t kHeaderSize = POINTER_SIZE_ALIGN(kUnalignedHeaderSize);
 
   // Used when consuming.
diff --git a/deps/v8/src/snapshot/deserializer-allocator.cc b/deps/v8/src/snapshot/deserializer-allocator.cc
index 0b96a5a0508b72..ed179f6842e10e 100644
--- a/deps/v8/src/snapshot/deserializer-allocator.cc
+++ b/deps/v8/src/snapshot/deserializer-allocator.cc
@@ -26,7 +26,7 @@ Address DeserializerAllocator::AllocateRaw(SnapshotSpace space, int size) {
     AlwaysAllocateScope scope(heap_);
     // Note that we currently do not support deserialization of large code
     // objects.
-    LargeObjectSpace* lo_space = heap_->lo_space();
+    OldLargeObjectSpace* lo_space = heap_->lo_space();
     AllocationResult result = lo_space->AllocateRaw(size);
     HeapObject obj = result.ToObjectChecked();
     deserialized_large_objects_.push_back(obj);
@@ -56,7 +56,16 @@ Address DeserializerAllocator::AllocateRaw(SnapshotSpace space, int size) {
 Address DeserializerAllocator::Allocate(SnapshotSpace space, int size) {
   Address address;
   HeapObject obj;
-
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    AllocationType type = (space == SnapshotSpace::kCode)
+                              ? AllocationType::kCode
+                              : AllocationType::kYoung;
+    return heap_->DeserializerAllocate(type, size);
+  }
+  // TODO(steveblackburn) The following logic and AllocateRaw() above should
+  // be lifted into Heap, pushing the logic to heap_->DeserializerAllocate().
+  // The implementation below and AllocateRaw() above leak heap abstractions
+  // such as particular structure of heap spaces.
   if (next_alignment_ != kWordAligned) {
     const int reserved = size + Heap::GetMaximumFillToAlign(next_alignment_);
     address = AllocateRaw(space, reserved);
@@ -110,7 +119,8 @@ HeapObject DeserializerAllocator::GetObject(SnapshotSpace space,
   if (next_alignment_ != kWordAligned) {
     int padding = Heap::GetFillToAlign(address, next_alignment_);
     next_alignment_ = kWordAligned;
-    DCHECK(padding == 0 || HeapObject::FromAddress(address).IsFiller());
+    DCHECK(padding == 0 ||
+           HeapObject::FromAddress(address).IsFreeSpaceOrFiller());
     address += padding;
   }
   return HeapObject::FromAddress(address);
diff --git a/deps/v8/src/snapshot/deserializer.cc b/deps/v8/src/snapshot/deserializer.cc
index e477817d20ba6d..127cfae29e018c 100644
--- a/deps/v8/src/snapshot/deserializer.cc
+++ b/deps/v8/src/snapshot/deserializer.cc
@@ -22,7 +22,6 @@
 #include "src/objects/smi.h"
 #include "src/objects/string.h"
 #include "src/roots/roots.h"
-#include "src/snapshot/natives.h"
 #include "src/snapshot/snapshot.h"
 #include "src/tracing/trace-event.h"
 #include "src/tracing/traced-value.h"
@@ -102,6 +101,8 @@ void Deserializer::Synchronize(VisitorSynchronization::SyncTag tag) {
 }
 
 void Deserializer::DeserializeDeferredObjects() {
+  DisallowHeapAllocation no_gc;
+
   for (int code = source_.Get(); code != kSynchronize; code = source_.Get()) {
     switch (code) {
       case kAlignmentPrefix:
@@ -157,13 +158,6 @@ void Deserializer::LogScriptEvents(Script script) {
   LOG(isolate_,
       ScriptEvent(Logger::ScriptEventType::kDeserialize, script.id()));
   LOG(isolate_, ScriptDetails(script));
-  TRACE_EVENT_OBJECT_CREATED_WITH_ID(
-      TRACE_DISABLED_BY_DEFAULT("v8.compile"), "Script",
-      TRACE_ID_WITH_SCOPE("v8::internal::Script", script.id()));
-  TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID(
-      TRACE_DISABLED_BY_DEFAULT("v8.compile"), "Script",
-      TRACE_ID_WITH_SCOPE("v8::internal::Script", script.id()),
-      script.ToTracedValue());
 }
 
 StringTableInsertionKey::StringTableInsertionKey(String string)
@@ -191,8 +185,8 @@ namespace {
 
 String ForwardStringIfExists(Isolate* isolate, StringTableInsertionKey* key) {
   StringTable table = isolate->heap()->string_table();
-  int entry = table.FindEntry(isolate, key);
-  if (entry == kNotFound) return String();
+  InternalIndex entry = table.FindEntry(isolate, key);
+  if (entry.is_not_found()) return String();
 
   String canonical = String::cast(table.KeyAt(entry));
   DCHECK_NE(canonical, key->string());
@@ -204,6 +198,8 @@ String ForwardStringIfExists(Isolate* isolate, StringTableInsertionKey* key) {
 
 HeapObject Deserializer::PostProcessNewObject(HeapObject obj,
                                               SnapshotSpace space) {
+  DisallowHeapAllocation no_gc;
+
   if ((FLAG_rehash_snapshot && can_rehash_) || deserializing_user_code()) {
     if (obj.IsString()) {
       // Uninitialize hash field as we need to recompute the hash.
@@ -267,28 +263,27 @@ HeapObject Deserializer::PostProcessNewObject(HeapObject obj,
     call_handler_infos_.push_back(CallHandlerInfo::cast(obj));
 #endif
   } else if (obj.IsExternalString()) {
-    if (obj.map() == ReadOnlyRoots(isolate_).native_source_string_map()) {
-      ExternalOneByteString string = ExternalOneByteString::cast(obj);
-      DCHECK(string.is_uncached());
-      string.SetResource(
-          isolate_, NativesExternalStringResource::DecodeForDeserialization(
-                        string.resource()));
-    } else {
-      ExternalString string = ExternalString::cast(obj);
-      uint32_t index = string.resource_as_uint32();
-      Address address =
-          static_cast<Address>(isolate_->api_external_references()[index]);
-      string.set_address_as_resource(address);
-      isolate_->heap()->UpdateExternalString(string, 0,
-                                             string.ExternalPayloadSize());
-    }
+    ExternalString string = ExternalString::cast(obj);
+    uint32_t index = string.resource_as_uint32();
+    Address address =
+        static_cast<Address>(isolate_->api_external_references()[index]);
+    string.set_address_as_resource(address);
+    isolate_->heap()->UpdateExternalString(string, 0,
+                                           string.ExternalPayloadSize());
     isolate_->heap()->RegisterExternalString(String::cast(obj));
   } else if (obj.IsJSDataView()) {
     JSDataView data_view = JSDataView::cast(obj);
     JSArrayBuffer buffer = JSArrayBuffer::cast(data_view.buffer());
-    data_view.set_data_pointer(
-        reinterpret_cast<uint8_t*>(buffer.backing_store()) +
-        data_view.byte_offset());
+    void* backing_store = nullptr;
+    if (buffer.backing_store() != nullptr) {
+      // The backing store of the JSArrayBuffer has not been correctly restored
+      // yet, as that may trigger GC. The backing_store field currently contains
+      // a numbered reference to an already deserialized backing store.
+      size_t store_index = reinterpret_cast<size_t>(buffer.backing_store());
+      backing_store = backing_stores_[store_index]->buffer_start();
+    }
+    data_view.set_data_pointer(reinterpret_cast<uint8_t*>(backing_store) +
+                               data_view.byte_offset());
   } else if (obj.IsJSTypedArray()) {
     JSTypedArray typed_array = JSTypedArray::cast(obj);
     // Fixup typed array pointers.
@@ -306,15 +301,10 @@ HeapObject Deserializer::PostProcessNewObject(HeapObject obj,
     }
   } else if (obj.IsJSArrayBuffer()) {
     JSArrayBuffer buffer = JSArrayBuffer::cast(obj);
-    // Only fixup for the off-heap case.
+    buffer.set_extension(nullptr);
+    // Only fixup for the off-heap case. This may trigger GC.
     if (buffer.backing_store() != nullptr) {
-      // Serializer writes backing store ref in |backing_store| field.
-      size_t store_index = reinterpret_cast<size_t>(buffer.backing_store());
-      auto backing_store = backing_stores_[store_index];
-      SharedFlag shared = backing_store && backing_store->is_shared()
-                              ? SharedFlag::kShared
-                              : SharedFlag::kNotShared;
-      buffer.Setup(shared, backing_store);
+      new_off_heap_array_buffers_.push_back(handle(buffer, isolate_));
     }
   } else if (obj.IsBytecodeArray()) {
     // TODO(mythria): Remove these once we store the default values for these
@@ -389,6 +379,8 @@ HeapObject Deserializer::ReadObject() {
 }
 
 HeapObject Deserializer::ReadObject(SnapshotSpace space) {
+  DisallowHeapAllocation no_gc;
+
   const int size = source_.GetInt() << kObjectAlignmentBits;
 
   Address address = allocator()->Allocate(space, size);
@@ -405,7 +397,8 @@ HeapObject Deserializer::ReadObject(SnapshotSpace space) {
 
 #ifdef DEBUG
   if (obj.IsCode()) {
-    DCHECK_EQ(space, SnapshotSpace::kCode);
+    DCHECK(space == SnapshotSpace::kCode ||
+           space == SnapshotSpace::kReadOnlyHeap);
   } else {
     DCHECK_NE(space, SnapshotSpace::kCode);
   }
@@ -478,7 +471,6 @@ void Deserializer::VisitInternalReference(Code host, RelocInfo* rinfo) {
 }
 
 void Deserializer::VisitOffHeapTarget(Code host, RelocInfo* rinfo) {
-  DCHECK(FLAG_embedded_builtins);
   byte data = source_.Get();
   CHECK_EQ(data, kOffHeapTarget);
 
diff --git a/deps/v8/src/snapshot/deserializer.h b/deps/v8/src/snapshot/deserializer.h
index 9f66c37ac56098..871aa6b3a77303 100644
--- a/deps/v8/src/snapshot/deserializer.h
+++ b/deps/v8/src/snapshot/deserializer.h
@@ -41,9 +41,7 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
   ~Deserializer() override;
 
   void SetRehashability(bool v) { can_rehash_ = v; }
-  std::pair<uint32_t, uint32_t> GetChecksum() const {
-    return source_.GetChecksum();
-  }
+  uint32_t GetChecksum() const { return source_.GetChecksum(); }
 
  protected:
   // Create a deserializer from a snapshot byte source.
@@ -78,6 +76,10 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
     attached_objects_.push_back(attached_object);
   }
 
+  void CheckNoArrayBufferBackingStores() {
+    CHECK_EQ(new_off_heap_array_buffers().size(), 0);
+  }
+
   Isolate* isolate() const { return isolate_; }
   SnapshotByteSource* source() { return &source_; }
   const std::vector<AllocationSite>& new_allocation_sites() const {
@@ -100,6 +102,14 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
     return new_scripts_;
   }
 
+  const std::vector<Handle<JSArrayBuffer>>& new_off_heap_array_buffers() const {
+    return new_off_heap_array_buffers_;
+  }
+
+  std::shared_ptr<BackingStore> backing_store(size_t i) {
+    return backing_stores_[i];
+  }
+
   DeserializerAllocator* allocator() { return &allocator_; }
   bool deserializing_user_code() const { return deserializing_user_code_; }
   bool can_rehash() const { return can_rehash_; }
@@ -174,6 +184,7 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
   std::vector<CallHandlerInfo> call_handler_infos_;
   std::vector<Handle<String>> new_internalized_strings_;
   std::vector<Handle<Script>> new_scripts_;
+  std::vector<Handle<JSArrayBuffer>> new_off_heap_array_buffers_;
   std::vector<std::shared_ptr<BackingStore>> backing_stores_;
 
   DeserializerAllocator allocator_;
diff --git a/deps/v8/src/snapshot/embedded/embedded-data.cc b/deps/v8/src/snapshot/embedded/embedded-data.cc
index 2f6d17d6b2bd9d..bb2a49e61e11c5 100644
--- a/deps/v8/src/snapshot/embedded/embedded-data.cc
+++ b/deps/v8/src/snapshot/embedded/embedded-data.cc
@@ -14,12 +14,8 @@ namespace internal {
 
 // static
 bool InstructionStream::PcIsOffHeap(Isolate* isolate, Address pc) {
-  if (FLAG_embedded_builtins) {
-    const Address start = reinterpret_cast<Address>(isolate->embedded_blob());
-    return start <= pc && pc < start + isolate->embedded_blob_size();
-  } else {
-    return false;
-  }
+  const Address start = reinterpret_cast<Address>(isolate->embedded_blob());
+  return start <= pc && pc < start + isolate->embedded_blob_size();
 }
 
 // static
@@ -204,16 +200,6 @@ EmbeddedData EmbeddedData::FromIsolate(Isolate* isolate) {
         saw_unsafe_builtin = true;
         fprintf(stderr, "%s is not isolate-independent.\n", Builtins::name(i));
       }
-      if (Builtins::IsWasmRuntimeStub(i) &&
-          RelocInfo::RequiresRelocation(code)) {
-        // Wasm additionally requires that its runtime stubs must be
-        // individually PIC (i.e. we must be able to copy each stub outside the
-        // embedded area without relocations). In particular, that means
-        // pc-relative calls to other builtins are disallowed.
-        saw_unsafe_builtin = true;
-        fprintf(stderr, "%s is a wasm runtime stub but needs relocation.\n",
-                Builtins::name(i));
-      }
       if (BuiltinAliasesOffHeapTrampolineRegister(isolate, code)) {
         saw_unsafe_builtin = true;
         fprintf(stderr, "%s aliases the off-heap trampoline register.\n",
diff --git a/deps/v8/src/snapshot/embedded/embedded-data.h b/deps/v8/src/snapshot/embedded/embedded-data.h
index 58905668f2351d..9da860ab6c43ff 100644
--- a/deps/v8/src/snapshot/embedded/embedded-data.h
+++ b/deps/v8/src/snapshot/embedded/embedded-data.h
@@ -64,7 +64,7 @@ class EmbeddedData final {
 
   uint32_t AddressForHashing(Address addr) {
     Address start = reinterpret_cast<Address>(data_);
-    DCHECK(IsInRange(addr, start, start + size_));
+    DCHECK(base::IsInRange(addr, start, start + size_));
     return static_cast<uint32_t>(addr - start);
   }
 
diff --git a/deps/v8/src/snapshot/embedded/embedded-file-writer.cc b/deps/v8/src/snapshot/embedded/embedded-file-writer.cc
index 5f57993fc3255a..3b55a7f9fdc55d 100644
--- a/deps/v8/src/snapshot/embedded/embedded-file-writer.cc
+++ b/deps/v8/src/snapshot/embedded/embedded-file-writer.cc
@@ -31,7 +31,8 @@ void EmbeddedFileWriter::WriteBuiltin(PlatformEmbeddedFileWriterBase* w,
   // Isolate::SetEmbeddedBlob that the blob layout remains unchanged, i.e.
   // that labels do not insert bytes into the middle of the blob byte
   // stream.
-  w->DeclareFunctionBegin(builtin_symbol.begin());
+  w->DeclareFunctionBegin(builtin_symbol.begin(),
+                          blob->InstructionSizeOfBuiltin(builtin_id));
   const std::vector<byte>& current_positions = source_positions_[builtin_id];
 
   // The code below interleaves bytes of assembly code for the builtin
@@ -40,6 +41,10 @@ void EmbeddedFileWriter::WriteBuiltin(PlatformEmbeddedFileWriterBase* w,
   v8::internal::SourcePositionTableIterator positions(
       vpos, SourcePositionTableIterator::kExternalOnly);
 
+#ifndef DEBUG
+  CHECK(positions.done());  // Release builds must not contain debug infos.
+#endif
+
   const uint8_t* data = reinterpret_cast<const uint8_t*>(
       blob->InstructionStartOfBuiltin(builtin_id));
   uint32_t size = blob->PaddedInstructionSizeOfBuiltin(builtin_id);
diff --git a/deps/v8/src/snapshot/embedded/embedded-file-writer.h b/deps/v8/src/snapshot/embedded/embedded-file-writer.h
index 75fdb2eac395a2..55715bf0d1b69b 100644
--- a/deps/v8/src/snapshot/embedded/embedded-file-writer.h
+++ b/deps/v8/src/snapshot/embedded/embedded-file-writer.h
@@ -121,6 +121,11 @@ class EmbeddedFileWriter : public EmbeddedFileWriterInterface {
   }
 
   void WriteExternalFilenames(PlatformEmbeddedFileWriterBase* w) const {
+#ifndef DEBUG
+    // Release builds must not contain debug infos.
+    CHECK_EQ(external_filenames_by_index_.size(), 0);
+#endif
+
     w->Comment(
         "Source positions in the embedded blob refer to filenames by id.");
     w->Comment("Assembly directives here map the id to a filename.");
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.cc b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.cc
index 3aef77e34152d1..8b1b4500d6ed6e 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.cc
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.cc
@@ -82,7 +82,9 @@ void PlatformEmbeddedFileWriterAIX::SourceInfo(int fileid, const char* filename,
   fprintf(fp_, ".xline %d, \"%s\"\n", line, filename);
 }
 
-void PlatformEmbeddedFileWriterAIX::DeclareFunctionBegin(const char* name) {
+// TODO(mmarchini): investigate emitting size annotations for AIX
+void PlatformEmbeddedFileWriterAIX::DeclareFunctionBegin(const char* name,
+                                                         uint32_t size) {
   Newline();
   DeclareSymbolGlobal(name);
   fprintf(fp_, ".csect %s[DS]\n", name);  // function descriptor
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.h b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.h
index 6119d50623c090..8f99c1ae85b78b 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.h
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.h
@@ -34,7 +34,7 @@ class PlatformEmbeddedFileWriterAIX : public PlatformEmbeddedFileWriterBase {
   void DeclareLabel(const char* name) override;
 
   void SourceInfo(int fileid, const char* filename, int line) override;
-  void DeclareFunctionBegin(const char* name) override;
+  void DeclareFunctionBegin(const char* name, uint32_t size) override;
   void DeclareFunctionEnd(const char* name) override;
 
   int HexLiteral(uint64_t value) override;
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-base.h b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-base.h
index 0f1763ba244171..eab5ca8ec67030 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-base.h
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-base.h
@@ -63,7 +63,7 @@ class PlatformEmbeddedFileWriterBase {
   virtual void DeclareLabel(const char* name) = 0;
 
   virtual void SourceInfo(int fileid, const char* filename, int line) = 0;
-  virtual void DeclareFunctionBegin(const char* name) = 0;
+  virtual void DeclareFunctionBegin(const char* name, uint32_t size) = 0;
   virtual void DeclareFunctionEnd(const char* name) = 0;
 
   // Returns the number of printed characters.
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.cc b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.cc
index f4183b4b87d869..c5e131e3fe18bd 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.cc
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.cc
@@ -95,7 +95,8 @@ void PlatformEmbeddedFileWriterGeneric::SourceInfo(int fileid,
   fprintf(fp_, ".loc %d %d\n", fileid, line);
 }
 
-void PlatformEmbeddedFileWriterGeneric::DeclareFunctionBegin(const char* name) {
+void PlatformEmbeddedFileWriterGeneric::DeclareFunctionBegin(const char* name,
+                                                             uint32_t size) {
   DeclareLabel(name);
 
   if (target_arch_ == EmbeddedTargetArch::kArm ||
@@ -108,6 +109,7 @@ void PlatformEmbeddedFileWriterGeneric::DeclareFunctionBegin(const char* name) {
     // to create a DWARF subprogram entry.
     fprintf(fp_, ".type %s, @function\n", name);
   }
+  fprintf(fp_, ".size %s, %u\n", name, size);
 }
 
 void PlatformEmbeddedFileWriterGeneric::DeclareFunctionEnd(const char* name) {}
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.h b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.h
index 0c76e7df88a8a7..1f899cbb5caba7 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.h
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.h
@@ -36,7 +36,7 @@ class PlatformEmbeddedFileWriterGeneric
   void DeclareLabel(const char* name) override;
 
   void SourceInfo(int fileid, const char* filename, int line) override;
-  void DeclareFunctionBegin(const char* name) override;
+  void DeclareFunctionBegin(const char* name, uint32_t size) override;
   void DeclareFunctionEnd(const char* name) override;
 
   int HexLiteral(uint64_t value) override;
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.cc b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.cc
index 4be3c7ac6b67dc..234f8a1f485fa2 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.cc
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.cc
@@ -78,7 +78,9 @@ void PlatformEmbeddedFileWriterMac::SourceInfo(int fileid, const char* filename,
   fprintf(fp_, ".loc %d %d\n", fileid, line);
 }
 
-void PlatformEmbeddedFileWriterMac::DeclareFunctionBegin(const char* name) {
+// TODO(mmarchini): investigate emitting size annotations for OS X
+void PlatformEmbeddedFileWriterMac::DeclareFunctionBegin(const char* name,
+                                                         uint32_t size) {
   DeclareLabel(name);
 
   // TODO(mvstanton): Investigate the proper incantations to mark the label as
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.h b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.h
index 4f2cd3d6ae8086..76780d75f365a0 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.h
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.h
@@ -34,7 +34,7 @@ class PlatformEmbeddedFileWriterMac : public PlatformEmbeddedFileWriterBase {
   void DeclareLabel(const char* name) override;
 
   void SourceInfo(int fileid, const char* filename, int line) override;
-  void DeclareFunctionBegin(const char* name) override;
+  void DeclareFunctionBegin(const char* name, uint32_t size) override;
   void DeclareFunctionEnd(const char* name) override;
 
   int HexLiteral(uint64_t value) override;
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-win.cc b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-win.cc
index 9a9a26fbd0abef..86ac01d6fbc40d 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-win.cc
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-win.cc
@@ -238,7 +238,7 @@ void EmitUnwindData(PlatformEmbeddedFileWriterWin* w,
   w->Comment("    UnwindInfoAddress");
   w->StartPdataSection();
   std::vector<int> code_chunks;
-  std::vector<int> fp_adjustments;
+  std::vector<win64_unwindinfo::FrameOffsets> fp_adjustments;
 
   for (int i = 0; i < Builtins::builtin_count; i++) {
     if (!blob->ContainsBuiltin(i)) continue;
@@ -249,7 +249,7 @@ void EmitUnwindData(PlatformEmbeddedFileWriterWin* w,
     uint32_t builtin_size = blob->InstructionSizeOfBuiltin(i);
 
     const std::vector<int>& xdata_desc = unwind_infos[i].fp_offsets();
-    const std::vector<int>& xdata_fp_adjustments =
+    const std::vector<win64_unwindinfo::FrameOffsets>& xdata_fp_adjustments =
         unwind_infos[i].fp_adjustments();
     DCHECK_EQ(xdata_desc.size(), xdata_fp_adjustments.size());
 
@@ -418,7 +418,9 @@ void PlatformEmbeddedFileWriterWin::SourceInfo(int fileid, const char* filename,
   // Its syntax is #line <line> "<filename>"
 }
 
-void PlatformEmbeddedFileWriterWin::DeclareFunctionBegin(const char* name) {
+// TODO(mmarchini): investigate emitting size annotations for Windows
+void PlatformEmbeddedFileWriterWin::DeclareFunctionBegin(const char* name,
+                                                         uint32_t size) {
   fprintf(fp_, "%s%s PROC\n", SYMBOL_PREFIX, name);
 }
 
@@ -522,7 +524,9 @@ void PlatformEmbeddedFileWriterWin::SourceInfo(int fileid, const char* filename,
   // Its syntax is #line <line> "<filename>"
 }
 
-void PlatformEmbeddedFileWriterWin::DeclareFunctionBegin(const char* name) {
+// TODO(mmarchini): investigate emitting size annotations for Windows
+void PlatformEmbeddedFileWriterWin::DeclareFunctionBegin(const char* name,
+                                                         uint32_t size) {
   fprintf(fp_, "%s%s FUNCTION\n", SYMBOL_PREFIX, name);
 }
 
@@ -634,10 +638,13 @@ void PlatformEmbeddedFileWriterWin::DeclareLabel(const char* name) {
 
 void PlatformEmbeddedFileWriterWin::SourceInfo(int fileid, const char* filename,
                                                int line) {
-  fprintf(fp_, ".loc %d %d\n", fileid, line);
+  // BUG(9944): Use .cv_loc to ensure CodeView information is used on
+  // Windows.
 }
 
-void PlatformEmbeddedFileWriterWin::DeclareFunctionBegin(const char* name) {
+// TODO(mmarchini): investigate emitting size annotations for Windows
+void PlatformEmbeddedFileWriterWin::DeclareFunctionBegin(const char* name,
+                                                         uint32_t size) {
   DeclareLabel(name);
 
   if (target_arch_ == EmbeddedTargetArch::kArm64) {
@@ -666,11 +673,8 @@ void PlatformEmbeddedFileWriterWin::FilePrologue() {}
 
 void PlatformEmbeddedFileWriterWin::DeclareExternalFilename(
     int fileid, const char* filename) {
-  // Replace any Windows style paths (backslashes) with forward
-  // slashes.
-  std::string fixed_filename(filename);
-  std::replace(fixed_filename.begin(), fixed_filename.end(), '\\', '/');
-  fprintf(fp_, ".file %d \"%s\"\n", fileid, fixed_filename.c_str());
+  // BUG(9944): Use .cv_filename to ensure CodeView information is used on
+  // Windows.
 }
 
 void PlatformEmbeddedFileWriterWin::FileEpilogue() {}
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-win.h b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-win.h
index 376c6cc6ef78ff..907cb84ac4f74b 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-win.h
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-win.h
@@ -33,7 +33,7 @@ class PlatformEmbeddedFileWriterWin : public PlatformEmbeddedFileWriterBase {
   void DeclareLabel(const char* name) override;
 
   void SourceInfo(int fileid, const char* filename, int line) override;
-  void DeclareFunctionBegin(const char* name) override;
+  void DeclareFunctionBegin(const char* name, uint32_t size) override;
   void DeclareFunctionEnd(const char* name) override;
 
   int HexLiteral(uint64_t value) override;
diff --git a/deps/v8/src/snapshot/mksnapshot.cc b/deps/v8/src/snapshot/mksnapshot.cc
index 819f7009c2fdea..d0d941470724d1 100644
--- a/deps/v8/src/snapshot/mksnapshot.cc
+++ b/deps/v8/src/snapshot/mksnapshot.cc
@@ -14,7 +14,6 @@
 #include "src/flags/flags.h"
 #include "src/sanitizer/msan.h"
 #include "src/snapshot/embedded/embedded-file-writer.h"
-#include "src/snapshot/natives.h"
 #include "src/snapshot/partial-serializer.h"
 #include "src/snapshot/snapshot.h"
 #include "src/snapshot/startup-serializer.h"
@@ -255,29 +254,27 @@ int main(int argc, char** argv) {
 
       MaybeSetCounterFunction(isolate);
 
-      if (i::FLAG_embedded_builtins) {
-        // Set code range such that relative jumps for builtins to
-        // builtin calls in the snapshot are possible.
-        i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-        size_t code_range_size_mb =
-            i::kMaximalCodeRangeSize == 0
-                ? i::kMaxPCRelativeCodeRangeInMB
-                : std::min(i::kMaximalCodeRangeSize / i::MB,
-                           i::kMaxPCRelativeCodeRangeInMB);
-        v8::ResourceConstraints constraints;
-        constraints.set_code_range_size_in_bytes(code_range_size_mb * i::MB);
-        i_isolate->heap()->ConfigureHeap(constraints);
-        // The isolate contains data from builtin compilation that needs
-        // to be written out if builtins are embedded.
-        i_isolate->RegisterEmbeddedFileWriter(&embedded_writer);
-      }
+      // Set code range such that relative jumps for builtins to
+      // builtin calls in the snapshot are possible.
+      i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+      size_t code_range_size_mb =
+          i::kMaximalCodeRangeSize == 0
+              ? i::kMaxPCRelativeCodeRangeInMB
+              : std::min(i::kMaximalCodeRangeSize / i::MB,
+                         i::kMaxPCRelativeCodeRangeInMB);
+      v8::ResourceConstraints constraints;
+      constraints.set_code_range_size_in_bytes(code_range_size_mb * i::MB);
+      i_isolate->heap()->ConfigureHeap(constraints);
+      // The isolate contains data from builtin compilation that needs
+      // to be written out if builtins are embedded.
+      i_isolate->RegisterEmbeddedFileWriter(&embedded_writer);
+
       blob = CreateSnapshotDataBlob(isolate, embed_script.get());
-      if (i::FLAG_embedded_builtins) {
-        // At this point, the Isolate has been torn down but the embedded blob
-        // is still alive (we called DisableEmbeddedBlobRefcounting above).
-        // That's fine as far as the embedded file writer is concerned.
-        WriteEmbeddedFile(&embedded_writer);
-      }
+
+      // At this point, the Isolate has been torn down but the embedded blob
+      // is still alive (we called DisableEmbeddedBlobRefcounting above).
+      // That's fine as far as the embedded file writer is concerned.
+      WriteEmbeddedFile(&embedded_writer);
     }
 
     if (warmup_script) {
diff --git a/deps/v8/src/snapshot/natives-common.cc b/deps/v8/src/snapshot/natives-common.cc
deleted file mode 100644
index 321b74b45c576a..00000000000000
--- a/deps/v8/src/snapshot/natives-common.cc
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// The common functionality when building with internal or external natives.
-
-#include "src/heap/heap.h"
-#include "src/objects/objects-inl.h"
-#include "src/snapshot/natives.h"
-
-namespace v8 {
-namespace internal {
-
-NativesExternalStringResource::NativesExternalStringResource(NativeType type,
-                                                             int index)
-    : type_(type), index_(index) {
-  Vector<const char> source;
-  DCHECK_LE(0, index);
-  CHECK_EQ(EXTRAS, type_);
-  DCHECK(index < ExtraNatives::GetBuiltinsCount());
-  source = ExtraNatives::GetScriptSource(index);
-  data_ = source.begin();
-  length_ = source.length();
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/snapshot/natives-external.cc b/deps/v8/src/snapshot/natives-external.cc
deleted file mode 100644
index 4aa411dd92e9b7..00000000000000
--- a/deps/v8/src/snapshot/natives-external.cc
+++ /dev/null
@@ -1,211 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/snapshot/natives.h"
-
-#include "src/base/logging.h"
-#include "src/snapshot/snapshot-source-sink.h"
-#include "src/utils/vector.h"
-
-#ifndef V8_USE_EXTERNAL_STARTUP_DATA
-#error natives-external.cc is used only for the external snapshot build.
-#endif  // V8_USE_EXTERNAL_STARTUP_DATA
-
-
-namespace v8 {
-namespace internal {
-
-
-/**
- * NativesStore stores the 'native' (builtin) JS libraries.
- *
- * NativesStore needs to be initialized before using V8, usually by the
- * embedder calling v8::SetNativesDataBlob, which calls SetNativesFromFile
- * below.
- */
-class NativesStore {
- public:
-  ~NativesStore() {
-    for (size_t i = 0; i < native_names_.size(); i++) {
-      native_names_[i].Dispose();
-    }
-  }
-
-  int GetBuiltinsCount() { return static_cast<int>(native_ids_.size()); }
-
-  Vector<const char> GetScriptSource(int index) {
-    return native_source_[index];
-  }
-
-  Vector<const char> GetScriptName(int index) { return native_names_[index]; }
-
-  int GetIndex(const char* id) {
-    for (int i = 0; i < static_cast<int>(native_ids_.size()); ++i) {
-      int native_id_length = native_ids_[i].length();
-      if ((static_cast<int>(strlen(id)) == native_id_length) &&
-          (strncmp(id, native_ids_[i].begin(), native_id_length) == 0)) {
-        return i;
-      }
-    }
-    UNREACHABLE();
-  }
-
-  Vector<const char> GetScriptsSource() {
-    UNREACHABLE();  // Not implemented.
-  }
-
-  static NativesStore* MakeFromScriptsSource(SnapshotByteSource* source) {
-    NativesStore* store = new NativesStore;
-
-    // We expect the libraries in the following format:
-    //   int: # of sources.
-    //   2N blobs: N pairs of source name + actual source.
-    int library_count = source->GetIntSlow();
-    for (int i = 0; i < library_count; ++i) {
-      store->ReadNameAndContentPair(source);
-    }
-
-    return store;
-  }
-
- private:
-  NativesStore() = default;
-
-  Vector<const char> NameFromId(const byte* id, int id_length) {
-    const char native[] = "native ";
-    const char extension[] = ".js";
-    Vector<char> name(Vector<char>::New(id_length + sizeof(native) - 1 +
-                                        sizeof(extension) - 1));
-    memcpy(name.begin(), native, sizeof(native) - 1);
-    memcpy(name.begin() + sizeof(native) - 1, id, id_length);
-    memcpy(name.begin() + sizeof(native) - 1 + id_length, extension,
-           sizeof(extension) - 1);
-    return Vector<const char>::cast(name);
-  }
-
-  void ReadNameAndContentPair(SnapshotByteSource* bytes) {
-    const byte* id;
-    const byte* source;
-    int id_length = bytes->GetBlob(&id);
-    int source_length = bytes->GetBlob(&source);
-    native_ids_.emplace_back(reinterpret_cast<const char*>(id), id_length);
-    native_source_.emplace_back(reinterpret_cast<const char*>(source),
-                                source_length);
-    native_names_.push_back(NameFromId(id, id_length));
-  }
-
-  std::vector<Vector<const char>> native_ids_;
-  std::vector<Vector<const char>> native_names_;
-  std::vector<Vector<const char>> native_source_;
-
-  DISALLOW_COPY_AND_ASSIGN(NativesStore);
-};
-
-
-template<NativeType type>
-class NativesHolder {
- public:
-  static NativesStore* get() {
-    CHECK(holder_);
-    return holder_;
-  }
-  static void set(NativesStore* store) {
-    CHECK(store);
-    holder_ = store;
-  }
-  static bool empty() { return holder_ == nullptr; }
-  static void Dispose() {
-    delete holder_;
-    holder_ = nullptr;
-  }
-
- private:
-  static NativesStore* holder_;
-};
-
-template <NativeType type>
-NativesStore* NativesHolder<type>::holder_ = nullptr;
-
-// The natives blob. Memory is owned by caller.
-static StartupData* natives_blob_ = nullptr;
-
-/**
- * Read the Natives blob, as previously set by SetNativesFromFile.
- */
-void ReadNatives() {
-  if (natives_blob_ && NativesHolder<EXTRAS>::empty()) {
-    SnapshotByteSource bytes(natives_blob_->data, natives_blob_->raw_size);
-    NativesHolder<EXTRAS>::set(NativesStore::MakeFromScriptsSource(&bytes));
-    DCHECK(!bytes.HasMore());
-  }
-}
-
-
-/**
- * Set the Natives (library sources) blob, as generated by js2c + the build
- * system.
- */
-void SetNativesFromFile(StartupData* natives_blob) {
-  DCHECK(!natives_blob_);
-  DCHECK(natives_blob);
-  DCHECK(natives_blob->data);
-  DCHECK_GT(natives_blob->raw_size, 0);
-
-  natives_blob_ = natives_blob;
-  ReadNatives();
-}
-
-
-/**
- * Release memory allocated by SetNativesFromFile.
- */
-void DisposeNatives() {
-  NativesHolder<EXTRAS>::Dispose();
-}
-
-
-// Implement NativesCollection<T> bsaed on NativesHolder + NativesStore.
-//
-// (The callers expect a purely static interface, since this is how the
-//  natives are usually compiled in. Since we implement them based on
-//  runtime content, we have to implement this indirection to offer
-//  a static interface.)
-template<NativeType type>
-int NativesCollection<type>::GetBuiltinsCount() {
-  return NativesHolder<type>::get()->GetBuiltinsCount();
-}
-
-template<NativeType type>
-int NativesCollection<type>::GetIndex(const char* name) {
-  return NativesHolder<type>::get()->GetIndex(name);
-}
-
-template <NativeType type>
-Vector<const char> NativesCollection<type>::GetScriptSource(int index) {
-  return NativesHolder<type>::get()->GetScriptSource(index);
-}
-
-template<NativeType type>
-Vector<const char> NativesCollection<type>::GetScriptName(int index) {
-  return NativesHolder<type>::get()->GetScriptName(index);
-}
-
-template <NativeType type>
-Vector<const char> NativesCollection<type>::GetScriptsSource() {
-  return NativesHolder<type>::get()->GetScriptsSource();
-}
-
-
-// Explicit template instantiations.
-#define INSTANTIATE_TEMPLATES(T)                                            \
-  template int NativesCollection<T>::GetBuiltinsCount();                    \
-  template int NativesCollection<T>::GetIndex(const char* name);            \
-  template Vector<const char> NativesCollection<T>::GetScriptSource(int i); \
-  template Vector<const char> NativesCollection<T>::GetScriptName(int i);   \
-  template Vector<const char> NativesCollection<T>::GetScriptsSource();
-INSTANTIATE_TEMPLATES(EXTRAS)
-#undef INSTANTIATE_TEMPLATES
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/snapshot/natives.h b/deps/v8/src/snapshot/natives.h
deleted file mode 100644
index ea2136007b6643..00000000000000
--- a/deps/v8/src/snapshot/natives.h
+++ /dev/null
@@ -1,85 +0,0 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_SNAPSHOT_NATIVES_H_
-#define V8_SNAPSHOT_NATIVES_H_
-
-#include "include/v8.h"
-#include "src/utils/vector.h"
-#include "src/objects/objects.h"
-
-namespace v8 { class StartupData; }  // Forward declaration.
-
-namespace v8 {
-namespace internal {
-
-enum NativeType {
-  EXTRAS,
-};
-
-// Extra handling for V8_EXPORT_PRIVATE in combination with USING_V8_SHARED
-// since definition of methods of classes marked as dllimport is not allowed.
-template <NativeType type>
-#ifdef USING_V8_SHARED
-class NativesCollection {
-#else
-class V8_EXPORT_PRIVATE NativesCollection {
-#endif  // USING_V8_SHARED
-
- public:
-  // The following methods are implemented in js2c-generated code:
-
-  // Number of built-in scripts.
-  static int GetBuiltinsCount();
-  static int GetIndex(const char* name);
-  static Vector<const char> GetScriptSource(int index);
-  static Vector<const char> GetScriptName(int index);
-  static Vector<const char> GetScriptsSource();
-};
-
-using ExtraNatives = NativesCollection<EXTRAS>;
-
-#ifdef V8_USE_EXTERNAL_STARTUP_DATA
-// Used for reading the natives at runtime. Implementation in natives-empty.cc
-void SetNativesFromFile(StartupData* natives_blob);
-void ReadNatives();
-void DisposeNatives();
-#endif
-
-class NativesExternalStringResource final
-    : public v8::String::ExternalOneByteStringResource {
- public:
-  NativesExternalStringResource(NativeType type, int index);
-
-  const char* data() const override { return data_; }
-  size_t length() const override { return length_; }
-
-  v8::String::ExternalOneByteStringResource* EncodeForSerialization() const {
-    DCHECK(type_ == EXTRAS);
-    intptr_t val = (index_ << 1) | 1;
-    val = val << kSystemPointerSizeLog2;  // Pointer align.
-    return reinterpret_cast<v8::String::ExternalOneByteStringResource*>(val);
-  }
-
-  // Decode from serialization.
-  static NativesExternalStringResource* DecodeForDeserialization(
-      const v8::String::ExternalOneByteStringResource* encoded) {
-    intptr_t val =
-        reinterpret_cast<intptr_t>(encoded) >> kSystemPointerSizeLog2;
-    DCHECK(val & 1);
-    int index = static_cast<int>(val >> 1);
-    return new NativesExternalStringResource(EXTRAS, index);
-  }
-
- private:
-  const char* data_;
-  size_t length_;
-  NativeType type_;
-  int index_;
-};
-
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_SNAPSHOT_NATIVES_H_
diff --git a/deps/v8/src/snapshot/object-deserializer.cc b/deps/v8/src/snapshot/object-deserializer.cc
index daada252ba2775..ab6ddf1d0c2234 100644
--- a/deps/v8/src/snapshot/object-deserializer.cc
+++ b/deps/v8/src/snapshot/object-deserializer.cc
@@ -90,6 +90,15 @@ void ObjectDeserializer::CommitPostProcessedObjects() {
                                    MaybeObjectHandle::Weak(script));
     heap->SetRootScriptList(*list);
   }
+
+  for (Handle<JSArrayBuffer> buffer : new_off_heap_array_buffers()) {
+    // Serializer writes backing store ref in |backing_store| field.
+    size_t store_index = reinterpret_cast<size_t>(buffer->backing_store());
+    auto bs = backing_store(store_index);
+    SharedFlag shared =
+        bs && bs->is_shared() ? SharedFlag::kShared : SharedFlag::kNotShared;
+    buffer->Setup(shared, bs);
+  }
 }
 
 void ObjectDeserializer::LinkAllocationSites() {
@@ -102,7 +111,7 @@ void ObjectDeserializer::LinkAllocationSites() {
     // TODO(mvstanton): consider treating the heap()->allocation_sites_list()
     // as a (weak) root. If this root is relocated correctly, this becomes
     // unnecessary.
-    if (heap->allocation_sites_list() == Smi::kZero) {
+    if (heap->allocation_sites_list() == Smi::zero()) {
       site.set_weak_next(ReadOnlyRoots(heap).undefined_value());
     } else {
       site.set_weak_next(heap->allocation_sites_list());
diff --git a/deps/v8/src/snapshot/partial-deserializer.cc b/deps/v8/src/snapshot/partial-deserializer.cc
index 22854bf14a7a01..8a215b6b871e94 100644
--- a/deps/v8/src/snapshot/partial-deserializer.cc
+++ b/deps/v8/src/snapshot/partial-deserializer.cc
@@ -37,27 +37,46 @@ MaybeHandle<Object> PartialDeserializer::Deserialize(
 
   AddAttachedObject(global_proxy);
 
-  DisallowHeapAllocation no_gc;
-  // Keep track of the code space start and end pointers in case new
-  // code objects were unserialized
-  CodeSpace* code_space = isolate->heap()->code_space();
-  Address start_address = code_space->top();
-  Object root;
-  VisitRootPointer(Root::kPartialSnapshotCache, nullptr, FullObjectSlot(&root));
-  DeserializeDeferredObjects();
-  DeserializeEmbedderFields(embedder_fields_deserializer);
-
-  allocator()->RegisterDeserializedObjectsForBlackAllocation();
-
-  // There's no code deserialized here. If this assert fires then that's
-  // changed and logging should be added to notify the profiler et al of the
-  // new code, which also has to be flushed from instruction cache.
-  CHECK_EQ(start_address, code_space->top());
-
-  if (FLAG_rehash_snapshot && can_rehash()) Rehash();
-  LogNewMapEvents();
-
-  return Handle<Object>(root, isolate);
+  Handle<Object> result;
+  {
+    DisallowHeapAllocation no_gc;
+    // Keep track of the code space start and end pointers in case new
+    // code objects were unserialized
+    CodeSpace* code_space = isolate->heap()->code_space();
+    Address start_address = code_space->top();
+    Object root;
+    VisitRootPointer(Root::kPartialSnapshotCache, nullptr,
+                     FullObjectSlot(&root));
+    DeserializeDeferredObjects();
+    DeserializeEmbedderFields(embedder_fields_deserializer);
+
+    allocator()->RegisterDeserializedObjectsForBlackAllocation();
+
+    // There's no code deserialized here. If this assert fires then that's
+    // changed and logging should be added to notify the profiler et al of the
+    // new code, which also has to be flushed from instruction cache.
+    CHECK_EQ(start_address, code_space->top());
+
+    if (FLAG_rehash_snapshot && can_rehash()) Rehash();
+    LogNewMapEvents();
+
+    result = handle(root, isolate);
+  }
+
+  SetupOffHeapArrayBufferBackingStores();
+
+  return result;
+}
+
+void PartialDeserializer::SetupOffHeapArrayBufferBackingStores() {
+  for (Handle<JSArrayBuffer> buffer : new_off_heap_array_buffers()) {
+    // Serializer writes backing store ref in |backing_store| field.
+    size_t store_index = reinterpret_cast<size_t>(buffer->backing_store());
+    auto bs = backing_store(store_index);
+    SharedFlag shared =
+        bs && bs->is_shared() ? SharedFlag::kShared : SharedFlag::kNotShared;
+    buffer->Setup(shared, bs);
+  }
 }
 
 void PartialDeserializer::DeserializeEmbedderFields(
diff --git a/deps/v8/src/snapshot/partial-deserializer.h b/deps/v8/src/snapshot/partial-deserializer.h
index 0869793a9d93da..a25e6595954fa6 100644
--- a/deps/v8/src/snapshot/partial-deserializer.h
+++ b/deps/v8/src/snapshot/partial-deserializer.h
@@ -33,6 +33,8 @@ class V8_EXPORT_PRIVATE PartialDeserializer final : public Deserializer {
 
   void DeserializeEmbedderFields(
       v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer);
+
+  void SetupOffHeapArrayBufferBackingStores();
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/snapshot/read-only-deserializer.cc b/deps/v8/src/snapshot/read-only-deserializer.cc
index 5ac5a6444a6169..a2ad1a02796acf 100644
--- a/deps/v8/src/snapshot/read-only-deserializer.cc
+++ b/deps/v8/src/snapshot/read-only-deserializer.cc
@@ -51,6 +51,7 @@ void ReadOnlyDeserializer::DeserializeInto(Isolate* isolate) {
       if (object->IsUndefined(roots)) break;
     }
     DeserializeDeferredObjects();
+    CheckNoArrayBufferBackingStores();
   }
 
   if (FLAG_rehash_snapshot && can_rehash()) {
diff --git a/deps/v8/src/snapshot/references.h b/deps/v8/src/snapshot/references.h
index 215db9d9a56119..84cf30f9805d30 100644
--- a/deps/v8/src/snapshot/references.h
+++ b/deps/v8/src/snapshot/references.h
@@ -5,9 +5,9 @@
 #ifndef V8_SNAPSHOT_REFERENCES_H_
 #define V8_SNAPSHOT_REFERENCES_H_
 
+#include "src/base/bit-field.h"
 #include "src/base/hashmap.h"
 #include "src/common/assert-scope.h"
-#include "src/utils/utils.h"
 
 namespace v8 {
 namespace internal {
@@ -154,7 +154,7 @@ class SerializerReference {
   }
 
  private:
-  using SpaceBits = BitField<SnapshotSpace, 0, kSpaceTagSize>;
+  using SpaceBits = base::BitField<SnapshotSpace, 0, kSpaceTagSize>;
   using ChunkIndexBits = SpaceBits::Next<uint32_t, 32 - kSpaceTagSize>;
   using SpecialValueTypeBits =
       SpaceBits::Next<SpecialValueType, 32 - kSpaceTagSize>;
diff --git a/deps/v8/src/snapshot/serializer-common.cc b/deps/v8/src/snapshot/serializer-common.cc
index 2869c2bf244130..1703af771769ac 100644
--- a/deps/v8/src/snapshot/serializer-common.cc
+++ b/deps/v8/src/snapshot/serializer-common.cc
@@ -8,6 +8,7 @@
 #include "src/objects/foreign-inl.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/slots.h"
+#include "third_party/zlib/zlib.h"
 
 namespace v8 {
 namespace internal {
@@ -115,7 +116,7 @@ void SerializerDeserializer::Iterate(Isolate* isolate, RootVisitor* visitor) {
   std::vector<Object>* cache = isolate->partial_snapshot_cache();
   for (size_t i = 0;; ++i) {
     // Extend the array ready to get a value when deserializing.
-    if (cache->size() <= i) cache->push_back(Smi::kZero);
+    if (cache->size() <= i) cache->push_back(Smi::zero());
     // During deserialization, the visitor populates the partial snapshot cache
     // and eventually terminates the cache with undefined.
     visitor->VisitRootPointer(Root::kPartialSnapshotCache, nullptr,
@@ -145,5 +146,16 @@ void SerializerDeserializer::RestoreExternalReferenceRedirectors(
   }
 }
 
+V8_EXPORT_PRIVATE extern uint32_t Checksum(Vector<const byte> payload) {
+#ifdef MEMORY_SANITIZER
+  // Computing the checksum includes padding bytes for objects like strings.
+  // Mark every object as initialized in the code serializer.
+  MSAN_MEMORY_IS_INITIALIZED(payload.begin(), payload.length());
+#endif  // MEMORY_SANITIZER
+  // Priming the adler32 call so it can see what CPU features are available.
+  adler32(0, NULL, 0);
+  return static_cast<uint32_t>(adler32(0, payload.begin(), payload.length()));
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/snapshot/serializer-common.h b/deps/v8/src/snapshot/serializer-common.h
index 2a30fefe33b0fc..3636da3aa45efd 100644
--- a/deps/v8/src/snapshot/serializer-common.h
+++ b/deps/v8/src/snapshot/serializer-common.h
@@ -34,8 +34,8 @@ class ExternalReferenceEncoder {
     uint32_t index() const { return Index::decode(value_); }
 
    private:
-    using Index = BitField<uint32_t, 0, 31>;
-    using IsFromAPI = BitField<bool, 31, 1>;
+    using Index = base::BitField<uint32_t, 0, 31>;
+    using IsFromAPI = base::BitField<bool, 31, 1>;
     uint32_t value_;
   };
 
@@ -266,15 +266,15 @@ class SerializerDeserializer : public RootVisitor {
 
   // Encodes repeat count into a fixed repeat bytecode.
   static int EncodeFixedRepeat(int repeat_count) {
-    DCHECK(IsInRange(repeat_count, kFirstEncodableRepeatCount,
-                     kLastEncodableFixedRepeatCount));
+    DCHECK(base::IsInRange(repeat_count, kFirstEncodableRepeatCount,
+                           kLastEncodableFixedRepeatCount));
     return kFixedRepeat + repeat_count - kFirstEncodableRepeatCount;
   }
 
   // Decodes repeat count from a fixed repeat bytecode.
   static int DecodeFixedRepeatCount(int bytecode) {
-    DCHECK(IsInRange(bytecode, kFixedRepeat + 0,
-                     kFixedRepeat + kNumberOfFixedRepeat));
+    DCHECK(base::IsInRange(bytecode, kFixedRepeat + 0,
+                           kFixedRepeat + kNumberOfFixedRepeat));
     return bytecode - kFixedRepeat + kFirstEncodableRepeatCount;
   }
 
@@ -328,8 +328,8 @@ class SerializedData {
 
   uint32_t GetMagicNumber() const { return GetHeaderValue(kMagicNumberOffset); }
 
-  using ChunkSizeBits = BitField<uint32_t, 0, 31>;
-  using IsLastChunkBits = BitField<bool, 31, 1>;
+  using ChunkSizeBits = base::BitField<uint32_t, 0, 31>;
+  using IsLastChunkBits = base::BitField<bool, 31, 1>;
 
   static constexpr uint32_t kMagicNumberOffset = 0;
   static constexpr uint32_t kMagicNumber =
@@ -358,50 +358,7 @@ class SerializedData {
   DISALLOW_COPY_AND_ASSIGN(SerializedData);
 };
 
-class Checksum {
- public:
-  explicit Checksum(Vector<const byte> payload) {
-#ifdef MEMORY_SANITIZER
-    // Computing the checksum includes padding bytes for objects like strings.
-    // Mark every object as initialized in the code serializer.
-    MSAN_MEMORY_IS_INITIALIZED(payload.begin(), payload.length());
-#endif  // MEMORY_SANITIZER
-    // Fletcher's checksum. Modified to reduce 64-bit sums to 32-bit.
-    uintptr_t a = 1;
-    uintptr_t b = 0;
-    // TODO(jgruber, v8:9171): The following DCHECK should ideally hold since we
-    // access payload through an uintptr_t pointer later on; and some
-    // architectures, e.g. arm, may generate instructions that expect correct
-    // alignment. However, we do not control alignment for external snapshots.
-    // DCHECK(IsAligned(reinterpret_cast<intptr_t>(payload.begin()),
-    //                  kIntptrSize));
-    DCHECK(IsAligned(payload.length(), kIntptrSize));
-    const uintptr_t* cur = reinterpret_cast<const uintptr_t*>(payload.begin());
-    const uintptr_t* end = cur + payload.length() / kIntptrSize;
-    while (cur < end) {
-      // Unsigned overflow expected and intended.
-      a += *cur++;
-      b += a;
-    }
-#if V8_HOST_ARCH_64_BIT
-    a ^= a >> 32;
-    b ^= b >> 32;
-#endif  // V8_HOST_ARCH_64_BIT
-    a_ = static_cast<uint32_t>(a);
-    b_ = static_cast<uint32_t>(b);
-  }
-
-  bool Check(uint32_t a, uint32_t b) const { return a == a_ && b == b_; }
-
-  uint32_t a() const { return a_; }
-  uint32_t b() const { return b_; }
-
- private:
-  uint32_t a_;
-  uint32_t b_;
-
-  DISALLOW_COPY_AND_ASSIGN(Checksum);
-};
+V8_EXPORT_PRIVATE uint32_t Checksum(Vector<const byte> payload);
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/snapshot/serializer.cc b/deps/v8/src/snapshot/serializer.cc
index f009f08fc74111..fe7feb0bf01163 100644
--- a/deps/v8/src/snapshot/serializer.cc
+++ b/deps/v8/src/snapshot/serializer.cc
@@ -14,7 +14,6 @@
 #include "src/objects/map.h"
 #include "src/objects/slots-inl.h"
 #include "src/objects/smi.h"
-#include "src/snapshot/natives.h"
 #include "src/snapshot/snapshot.h"
 
 namespace v8 {
@@ -412,36 +411,20 @@ void Serializer::ObjectSerializer::SerializeJSArrayBuffer() {
 }
 
 void Serializer::ObjectSerializer::SerializeExternalString() {
-  Heap* heap = serializer_->isolate()->heap();
   // For external strings with known resources, we replace the resource field
   // with the encoded external reference, which we restore upon deserialize.
-  // for native native source code strings, we replace the resource field
-  // with the native source id.
   // For the rest we serialize them to look like ordinary sequential strings.
-  if (object_.map() != ReadOnlyRoots(heap).native_source_string_map()) {
-    ExternalString string = ExternalString::cast(object_);
-    Address resource = string.resource_as_address();
-    ExternalReferenceEncoder::Value reference;
-    if (serializer_->external_reference_encoder_.TryEncode(resource).To(
-            &reference)) {
-      DCHECK(reference.is_from_api());
-      string.set_uint32_as_resource(reference.index());
-      SerializeObject();
-      string.set_address_as_resource(resource);
-    } else {
-      SerializeExternalStringAsSequentialString();
-    }
-  } else {
-    ExternalOneByteString string = ExternalOneByteString::cast(object_);
-    DCHECK(string.is_uncached());
-    const NativesExternalStringResource* resource =
-        reinterpret_cast<const NativesExternalStringResource*>(
-            string.resource());
-    // Replace the resource field with the type and index of the native source.
-    string.set_resource(resource->EncodeForSerialization());
+  ExternalString string = ExternalString::cast(object_);
+  Address resource = string.resource_as_address();
+  ExternalReferenceEncoder::Value reference;
+  if (serializer_->external_reference_encoder_.TryEncode(resource).To(
+          &reference)) {
+    DCHECK(reference.is_from_api());
+    string.set_uint32_as_resource(reference.index());
     SerializeObject();
-    // Restore the resource field.
-    string.set_resource(resource);
+    string.set_address_as_resource(resource);
+  } else {
+    SerializeExternalStringAsSequentialString();
   }
 }
 
@@ -450,7 +433,6 @@ void Serializer::ObjectSerializer::SerializeExternalStringAsSequentialString() {
   // an imaginary sequential string with the same content.
   ReadOnlyRoots roots(serializer_->isolate());
   DCHECK(object_.IsExternalString());
-  DCHECK(object_.map() != roots.native_source_string_map());
   ExternalString string = ExternalString::cast(object_);
   int length = string.length();
   Map map;
@@ -561,7 +543,7 @@ void Serializer::ObjectSerializer::Serialize() {
   }
 
   // We don't expect fillers.
-  DCHECK(!object_.IsFiller());
+  DCHECK(!object_.IsFreeSpaceOrFiller());
 
   if (object_.IsScript()) {
     // Clear cached line ends.
@@ -572,25 +554,42 @@ void Serializer::ObjectSerializer::Serialize() {
   SerializeObject();
 }
 
-void Serializer::ObjectSerializer::SerializeObject() {
-  int size = object_.Size();
-  Map map = object_.map();
-  SnapshotSpace space;
-  if (ReadOnlyHeap::Contains(object_)) {
-    space = SnapshotSpace::kReadOnlyHeap;
+namespace {
+SnapshotSpace GetSnapshotSpace(HeapObject object) {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    if (third_party_heap::Heap::InCodeSpace(object.address())) {
+      return SnapshotSpace::kCode;
+    } else if (ReadOnlyHeap::Contains(object)) {
+      return SnapshotSpace::kReadOnlyHeap;
+    } else if (object.Size() > kMaxRegularHeapObjectSize) {
+      return SnapshotSpace::kLargeObject;
+    } else if (object.IsMap()) {
+      return SnapshotSpace::kMap;
+    } else {
+      return SnapshotSpace::kNew;  // avoid new/young distinction in TPH
+    }
+  } else if (ReadOnlyHeap::Contains(object)) {
+    return SnapshotSpace::kReadOnlyHeap;
   } else {
     AllocationSpace heap_space =
-        MemoryChunk::FromHeapObject(object_)->owner_identity();
+        MemoryChunk::FromHeapObject(object)->owner_identity();
     // Large code objects are not supported and cannot be expressed by
     // SnapshotSpace.
     DCHECK_NE(heap_space, CODE_LO_SPACE);
     // Young generation large objects are tenured.
     if (heap_space == NEW_LO_SPACE) {
-      space = SnapshotSpace::kLargeObject;
+      return SnapshotSpace::kLargeObject;
     } else {
-      space = static_cast<SnapshotSpace>(heap_space);
+      return static_cast<SnapshotSpace>(heap_space);
     }
   }
+}
+}  // namespace
+
+void Serializer::ObjectSerializer::SerializeObject() {
+  int size = object_.Size();
+  Map map = object_.map();
+  SnapshotSpace space = GetSnapshotSpace(object_);
   SerializePrologue(space, size, map);
 
   // Serialize the rest of the object.
@@ -661,6 +660,8 @@ void Serializer::ObjectSerializer::VisitPointers(HeapObject host,
 void Serializer::ObjectSerializer::VisitPointers(HeapObject host,
                                                  MaybeObjectSlot start,
                                                  MaybeObjectSlot end) {
+  DisallowHeapAllocation no_gc;
+
   MaybeObjectSlot current = start;
   while (current < end) {
     while (current < end && (*current)->IsSmi()) {
@@ -765,7 +766,6 @@ void Serializer::ObjectSerializer::VisitRuntimeEntry(Code host,
 
 void Serializer::ObjectSerializer::VisitOffHeapTarget(Code host,
                                                       RelocInfo* rinfo) {
-  DCHECK(FLAG_embedded_builtins);
   STATIC_ASSERT(EmbeddedData::kTableSize == Builtins::builtin_count);
 
   Address addr = rinfo->target_off_heap_target();
diff --git a/deps/v8/src/snapshot/serializer.h b/deps/v8/src/snapshot/serializer.h
index 73a9a1eaac46a8..de65a92013df81 100644
--- a/deps/v8/src/snapshot/serializer.h
+++ b/deps/v8/src/snapshot/serializer.h
@@ -32,8 +32,8 @@ class CodeAddressMap : public CodeEventLogger {
     address_to_name_map_.Move(from.address(), to.address());
   }
 
-  void CodeDisableOptEvent(AbstractCode code,
-                           SharedFunctionInfo shared) override {}
+  void CodeDisableOptEvent(Handle<AbstractCode> code,
+                           Handle<SharedFunctionInfo> shared) override {}
 
   const char* Lookup(Address address) {
     return address_to_name_map_.Lookup(address);
@@ -114,9 +114,10 @@ class CodeAddressMap : public CodeEventLogger {
     DISALLOW_COPY_AND_ASSIGN(NameMap);
   };
 
-  void LogRecordedBuffer(AbstractCode code, SharedFunctionInfo,
-                         const char* name, int length) override {
-    address_to_name_map_.Insert(code.address(), name, length);
+  void LogRecordedBuffer(Handle<AbstractCode> code,
+                         MaybeHandle<SharedFunctionInfo>, const char* name,
+                         int length) override {
+    address_to_name_map_.Insert(code->address(), name, length);
   }
 
   void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
diff --git a/deps/v8/src/snapshot/snapshot-common.cc b/deps/v8/src/snapshot/snapshot-common.cc
index f489999f8879a1..8e0c28c6d6c3b4 100644
--- a/deps/v8/src/snapshot/snapshot-common.cc
+++ b/deps/v8/src/snapshot/snapshot-common.cc
@@ -192,9 +192,7 @@ v8::StartupData Snapshot::CreateSnapshotBlob(
   DCHECK_EQ(total_length, payload_offset);
   v8::StartupData result = {data, static_cast<int>(total_length)};
 
-  Checksum checksum(ChecksummedContent(&result));
-  SetHeaderValue(data, kChecksumPartAOffset, checksum.a());
-  SetHeaderValue(data, kChecksumPartBOffset, checksum.b());
+  SetHeaderValue(data, kChecksumOffset, Checksum(ChecksummedContent(&result)));
 
   return result;
 }
@@ -208,14 +206,13 @@ uint32_t Snapshot::ExtractNumContexts(const v8::StartupData* data) {
 bool Snapshot::VerifyChecksum(const v8::StartupData* data) {
   base::ElapsedTimer timer;
   if (FLAG_profile_deserialization) timer.Start();
-  uint32_t expected_a = GetHeaderValue(data, kChecksumPartAOffset);
-  uint32_t expected_b = GetHeaderValue(data, kChecksumPartBOffset);
-  Checksum checksum(ChecksummedContent(data));
+  uint32_t expected = GetHeaderValue(data, kChecksumOffset);
+  uint32_t result = Checksum(ChecksummedContent(data));
   if (FLAG_profile_deserialization) {
     double ms = timer.Elapsed().InMillisecondsF();
     PrintF("[Verifying snapshot checksum took %0.3f ms]\n", ms);
   }
-  return checksum.Check(expected_a, expected_b);
+  return result == expected;
 }
 
 uint32_t Snapshot::ExtractContextOffset(const v8::StartupData* data,
diff --git a/deps/v8/src/snapshot/snapshot-source-sink.h b/deps/v8/src/snapshot/snapshot-source-sink.h
index 9cdb85089e1248..adcfa8df618fb2 100644
--- a/deps/v8/src/snapshot/snapshot-source-sink.h
+++ b/deps/v8/src/snapshot/snapshot-source-sink.h
@@ -87,9 +87,8 @@ class SnapshotByteSource final {
   int position() { return position_; }
   void set_position(int position) { position_ = position; }
 
-  std::pair<uint32_t, uint32_t> GetChecksum() const {
-    Checksum checksum(Vector<const byte>(data_, length_));
-    return {checksum.a(), checksum.b()};
+  uint32_t GetChecksum() const {
+    return Checksum(Vector<const byte>(data_, length_));
   }
 
  private:
diff --git a/deps/v8/src/snapshot/snapshot.h b/deps/v8/src/snapshot/snapshot.h
index 4a4da9f755484b..156d87301979e8 100644
--- a/deps/v8/src/snapshot/snapshot.h
+++ b/deps/v8/src/snapshot/snapshot.h
@@ -111,12 +111,11 @@ class Snapshot : public AllStatic {
   // Snapshot blob layout:
   // [0] number of contexts N
   // [1] rehashability
-  // [2] checksum part A
-  // [3] checksum part B
-  // [4] (128 bytes) version string
-  // [5] offset to readonly
-  // [6] offset to context 0
-  // [7] offset to context 1
+  // [2] checksum
+  // [3] (128 bytes) version string
+  // [4] offset to readonly
+  // [5] offset to context 0
+  // [6] offset to context 1
   // ...
   // ... offset to context N - 1
   // ... startup snapshot data
@@ -128,12 +127,8 @@ class Snapshot : public AllStatic {
   // TODO(yangguo): generalize rehashing, and remove this flag.
   static const uint32_t kRehashabilityOffset =
       kNumberOfContextsOffset + kUInt32Size;
-  static const uint32_t kChecksumPartAOffset =
-      kRehashabilityOffset + kUInt32Size;
-  static const uint32_t kChecksumPartBOffset =
-      kChecksumPartAOffset + kUInt32Size;
-  static const uint32_t kVersionStringOffset =
-      kChecksumPartBOffset + kUInt32Size;
+  static const uint32_t kChecksumOffset = kRehashabilityOffset + kUInt32Size;
+  static const uint32_t kVersionStringOffset = kChecksumOffset + kUInt32Size;
   static const uint32_t kVersionStringLength = 64;
   static const uint32_t kReadOnlyOffsetOffset =
       kVersionStringOffset + kVersionStringLength;
@@ -141,6 +136,7 @@ class Snapshot : public AllStatic {
       kReadOnlyOffsetOffset + kUInt32Size;
 
   static Vector<const byte> ChecksummedContent(const v8::StartupData* data) {
+    STATIC_ASSERT(kVersionStringOffset == kChecksumOffset + kUInt32Size);
     const uint32_t kChecksumStart = kVersionStringOffset;
     return Vector<const byte>(
         reinterpret_cast<const byte*>(data->data + kChecksumStart),
diff --git a/deps/v8/src/snapshot/startup-deserializer.cc b/deps/v8/src/snapshot/startup-deserializer.cc
index 168bc678fe46ea..8d99238d1e5268 100644
--- a/deps/v8/src/snapshot/startup-deserializer.cc
+++ b/deps/v8/src/snapshot/startup-deserializer.cc
@@ -44,16 +44,17 @@ void StartupDeserializer::DeserializeInto(Isolate* isolate) {
     FlushICache();
   }
 
+  CheckNoArrayBufferBackingStores();
+
   isolate->heap()->set_native_contexts_list(
       ReadOnlyRoots(isolate).undefined_value());
   // The allocation site list is build during root iteration, but if no sites
   // were encountered then it needs to be initialized to undefined.
-  if (isolate->heap()->allocation_sites_list() == Smi::kZero) {
+  if (isolate->heap()->allocation_sites_list() == Smi::zero()) {
     isolate->heap()->set_allocation_sites_list(
         ReadOnlyRoots(isolate).undefined_value());
   }
 
-
   isolate->builtins()->MarkInitialized();
 
   LogNewMapEvents();
diff --git a/deps/v8/src/snapshot/startup-serializer.cc b/deps/v8/src/snapshot/startup-serializer.cc
index 4e4bc9eefc02c0..4d6ce78b594dc3 100644
--- a/deps/v8/src/snapshot/startup-serializer.cc
+++ b/deps/v8/src/snapshot/startup-serializer.cc
@@ -47,7 +47,6 @@ bool IsUnexpectedCodeObject(Isolate* isolate, HeapObject obj) {
 
   if (code.kind() == Code::REGEXP) return false;
   if (!code.is_builtin()) return true;
-  if (!FLAG_embedded_builtins) return false;
   if (code.is_off_heap_trampoline()) return false;
 
   // An on-heap builtin. We only expect this for the interpreter entry
diff --git a/deps/v8/src/strings/OWNERS b/deps/v8/src/strings/OWNERS
index 35ab9a46348462..3c29ae29e258fd 100644
--- a/deps/v8/src/strings/OWNERS
+++ b/deps/v8/src/strings/OWNERS
@@ -2,6 +2,5 @@ bmeurer@chromium.org
 jkummerow@chromium.org
 leszeks@chromium.org
 verwaest@chromium.org
-yangguo@chromium.org
 
 # COMPONENT: Blink>JavaScript>Runtime
diff --git a/deps/v8/src/strings/char-predicates-inl.h b/deps/v8/src/strings/char-predicates-inl.h
index 8ff9f0d21f7470..bb2cd55d9f6ca3 100644
--- a/deps/v8/src/strings/char-predicates-inl.h
+++ b/deps/v8/src/strings/char-predicates-inl.h
@@ -5,7 +5,9 @@
 #ifndef V8_STRINGS_CHAR_PREDICATES_INL_H_
 #define V8_STRINGS_CHAR_PREDICATES_INL_H_
 
+#include "src/base/bounds.h"
 #include "src/strings/char-predicates.h"
+#include "src/utils/utils.h"
 
 namespace v8 {
 namespace internal {
@@ -24,26 +26,26 @@ inline constexpr bool IsAsciiIdentifier(uc32 c) {
 }
 
 inline constexpr bool IsAlphaNumeric(uc32 c) {
-  return IsInRange(AsciiAlphaToLower(c), 'a', 'z') || IsDecimalDigit(c);
+  return base::IsInRange(AsciiAlphaToLower(c), 'a', 'z') || IsDecimalDigit(c);
 }
 
 inline constexpr bool IsDecimalDigit(uc32 c) {
   // ECMA-262, 3rd, 7.8.3 (p 16)
-  return IsInRange(c, '0', '9');
+  return base::IsInRange(c, '0', '9');
 }
 
 inline constexpr bool IsHexDigit(uc32 c) {
   // ECMA-262, 3rd, 7.6 (p 15)
-  return IsDecimalDigit(c) || IsInRange(AsciiAlphaToLower(c), 'a', 'f');
+  return IsDecimalDigit(c) || base::IsInRange(AsciiAlphaToLower(c), 'a', 'f');
 }
 
 inline constexpr bool IsOctalDigit(uc32 c) {
   // ECMA-262, 6th, 7.8.3
-  return IsInRange(c, '0', '7');
+  return base::IsInRange(c, '0', '7');
 }
 
 inline constexpr bool IsNonOctalDecimalDigit(uc32 c) {
-  return IsInRange(c, '8', '9');
+  return base::IsInRange(c, '8', '9');
 }
 
 inline constexpr bool IsBinaryDigit(uc32 c) {
@@ -51,9 +53,13 @@ inline constexpr bool IsBinaryDigit(uc32 c) {
   return c == '0' || c == '1';
 }
 
-inline constexpr bool IsAsciiLower(uc32 c) { return IsInRange(c, 'a', 'z'); }
+inline constexpr bool IsAsciiLower(uc32 c) {
+  return base::IsInRange(c, 'a', 'z');
+}
 
-inline constexpr bool IsAsciiUpper(uc32 c) { return IsInRange(c, 'A', 'Z'); }
+inline constexpr bool IsAsciiUpper(uc32 c) {
+  return base::IsInRange(c, 'A', 'Z');
+}
 
 inline constexpr uc32 ToAsciiUpper(uc32 c) {
   return c & ~(IsAsciiLower(c) << 5);
@@ -64,7 +70,7 @@ inline constexpr uc32 ToAsciiLower(uc32 c) {
 }
 
 inline constexpr bool IsRegExpWord(uc16 c) {
-  return IsInRange(AsciiAlphaToLower(c), 'a', 'z') || IsDecimalDigit(c) ||
+  return base::IsInRange(AsciiAlphaToLower(c), 'a', 'z') || IsDecimalDigit(c) ||
          (c == '_');
 }
 
@@ -97,28 +103,28 @@ const constexpr uint8_t kAsciiCharFlags[128] = {
 };
 
 bool IsIdentifierStart(uc32 c) {
-  if (!IsInRange(c, 0, 127)) return IsIdentifierStartSlow(c);
+  if (!base::IsInRange(c, 0, 127)) return IsIdentifierStartSlow(c);
   DCHECK_EQ(IsIdentifierStartSlow(c),
             static_cast<bool>(kAsciiCharFlags[c] & kIsIdentifierStart));
   return kAsciiCharFlags[c] & kIsIdentifierStart;
 }
 
 bool IsIdentifierPart(uc32 c) {
-  if (!IsInRange(c, 0, 127)) return IsIdentifierPartSlow(c);
+  if (!base::IsInRange(c, 0, 127)) return IsIdentifierPartSlow(c);
   DCHECK_EQ(IsIdentifierPartSlow(c),
             static_cast<bool>(kAsciiCharFlags[c] & kIsIdentifierPart));
   return kAsciiCharFlags[c] & kIsIdentifierPart;
 }
 
 bool IsWhiteSpace(uc32 c) {
-  if (!IsInRange(c, 0, 127)) return IsWhiteSpaceSlow(c);
+  if (!base::IsInRange(c, 0, 127)) return IsWhiteSpaceSlow(c);
   DCHECK_EQ(IsWhiteSpaceSlow(c),
             static_cast<bool>(kAsciiCharFlags[c] & kIsWhiteSpace));
   return kAsciiCharFlags[c] & kIsWhiteSpace;
 }
 
 bool IsWhiteSpaceOrLineTerminator(uc32 c) {
-  if (!IsInRange(c, 0, 127)) return IsWhiteSpaceOrLineTerminatorSlow(c);
+  if (!base::IsInRange(c, 0, 127)) return IsWhiteSpaceOrLineTerminatorSlow(c);
   DCHECK_EQ(
       IsWhiteSpaceOrLineTerminatorSlow(c),
       static_cast<bool>(kAsciiCharFlags[c] & kIsWhiteSpaceOrLineTerminator));
diff --git a/deps/v8/src/strings/string-builder-inl.h b/deps/v8/src/strings/string-builder-inl.h
index 9f78884a60c83a..630b66ab20e64a 100644
--- a/deps/v8/src/strings/string-builder-inl.h
+++ b/deps/v8/src/strings/string-builder-inl.h
@@ -21,10 +21,10 @@ const int kStringBuilderConcatHelperLengthBits = 11;
 const int kStringBuilderConcatHelperPositionBits = 19;
 
 using StringBuilderSubstringLength =
-    BitField<int, 0, kStringBuilderConcatHelperLengthBits>;
+    base::BitField<int, 0, kStringBuilderConcatHelperLengthBits>;
 using StringBuilderSubstringPosition =
-    BitField<int, kStringBuilderConcatHelperLengthBits,
-             kStringBuilderConcatHelperPositionBits>;
+    base::BitField<int, kStringBuilderConcatHelperLengthBits,
+                   kStringBuilderConcatHelperPositionBits>;
 
 template <typename sinkchar>
 void StringBuilderConcatHelper(String special, sinkchar* sink,
diff --git a/deps/v8/src/strings/string-hasher-inl.h b/deps/v8/src/strings/string-hasher-inl.h
index 0c69e6c7baa15a..2857b277315706 100644
--- a/deps/v8/src/strings/string-hasher-inl.h
+++ b/deps/v8/src/strings/string-hasher-inl.h
@@ -7,6 +7,8 @@
 
 #include "src/strings/string-hasher.h"
 
+#include <type_traits>
+
 #include "src/objects/objects.h"
 #include "src/objects/string-inl.h"
 #include "src/strings/char-predicates-inl.h"
@@ -33,28 +35,40 @@ uint32_t StringHasher::GetHashCore(uint32_t running_hash) {
 
 uint32_t StringHasher::GetTrivialHash(int length) {
   DCHECK_GT(length, String::kMaxHashCalcLength);
-  // String hash of a large string is simply the length.
-  return (static_cast<uint32_t>(length) << String::kHashShift) |
-         String::kIsNotArrayIndexMask | String::kIsNotIntegerIndexMask;
+  // The hash of a large string is simply computed from the length. We don't
+  // have quite enough bits, so we drop the least significant bit.
+  // TODO(9904): Free up one bit, so we don't have to drop anything here.
+  constexpr int kDroppedBits = 1;
+  // Ensure that the max length after dropping bits is small enough to be
+  // shifted without losing information.
+  STATIC_ASSERT(base::bits::CountLeadingZeros32(String::kMaxLength) +
+                    kDroppedBits >=
+                String::kHashShift);
+  uint32_t hash = static_cast<uint32_t>(length) >> kDroppedBits;
+  return (hash << String::kHashShift) | String::kIsNotArrayIndexMask |
+         String::kIsNotIntegerIndexMask;
 }
 
-template <typename schar>
-uint32_t StringHasher::HashSequentialString(const schar* chars, int length,
+template <typename char_t>
+uint32_t StringHasher::HashSequentialString(const char_t* chars_raw, int length,
                                             uint64_t seed) {
+  STATIC_ASSERT(std::is_integral<char_t>::value);
+  STATIC_ASSERT(sizeof(char_t) <= 2);
+  using uchar = typename std::make_unsigned<char_t>::type;
+  const uchar* chars = reinterpret_cast<const uchar*>(chars_raw);
   DCHECK_LE(0, length);
   DCHECK_IMPLIES(0 < length, chars != nullptr);
   if (length >= 1) {
     if (IsDecimalDigit(chars[0]) && (length == 1 || chars[0] != '0')) {
-      uint32_t index = 0;
       if (length <= String::kMaxArrayIndexSize) {
         // Possible array index; try to compute the array index hash.
-        index = chars[0] - '0';
+        uint32_t index = chars[0] - '0';
         int i = 1;
         do {
           if (i == length) {
             return MakeArrayIndexHash(index, length);
           }
-        } while (TryAddIndexChar(&index, chars[i++]));
+        } while (TryAddArrayIndexChar(&index, chars[i++]));
       }
       // The following block wouldn't do anything on 32-bit platforms,
       // because kMaxArrayIndexSize == kMaxIntegerIndexSize there, and
@@ -70,10 +84,11 @@ uint32_t StringHasher::HashSequentialString(const schar* chars, int length,
         // if there are non-digit characters.
         uint32_t is_integer_index = 0;
         uint32_t running_hash = static_cast<uint32_t>(seed);
-        uint64_t index_big = index;
-        const schar* end = &chars[length];
+        uint64_t index_big = 0;
+        const uchar* end = &chars[length];
         while (chars != end) {
-          if (is_integer_index == 0 && !TryAddIndexChar(&index_big, *chars)) {
+          if (is_integer_index == 0 &&
+              !TryAddIntegerIndexChar(&index_big, *chars)) {
             is_integer_index = String::kIsNotIntegerIndexMask;
           }
           running_hash = AddCharacterCore(running_hash, *chars++);
@@ -92,7 +107,7 @@ uint32_t StringHasher::HashSequentialString(const schar* chars, int length,
 
   // Non-index hash.
   uint32_t running_hash = static_cast<uint32_t>(seed);
-  const schar* end = &chars[length];
+  const uchar* end = &chars[length];
   while (chars != end) {
     running_hash = AddCharacterCore(running_hash, *chars++);
   }
diff --git a/deps/v8/src/strings/string-hasher.h b/deps/v8/src/strings/string-hasher.h
index b3917b75cdc982..aadddea65f2713 100644
--- a/deps/v8/src/strings/string-hasher.h
+++ b/deps/v8/src/strings/string-hasher.h
@@ -16,8 +16,8 @@ class Vector;
 class V8_EXPORT_PRIVATE StringHasher final {
  public:
   StringHasher() = delete;
-  template <typename schar>
-  static inline uint32_t HashSequentialString(const schar* chars, int length,
+  template <typename char_t>
+  static inline uint32_t HashSequentialString(const char_t* chars, int length,
                                               uint64_t seed);
 
   // Calculated hash value for a string consisting of 1 to
diff --git a/deps/v8/src/strings/unicode-decoder.cc b/deps/v8/src/strings/unicode-decoder.cc
index 8ee66ec2517be7..b8d3c3e8ba3427 100644
--- a/deps/v8/src/strings/unicode-decoder.cc
+++ b/deps/v8/src/strings/unicode-decoder.cc
@@ -71,11 +71,11 @@ void Utf8Decoder::Decode(Char* out, const Vector<const uint8_t>& data) {
   if (t != unibrow::Utf8::kBufferEmpty) *out = static_cast<Char>(t);
 }
 
-template void Utf8Decoder::Decode(uint8_t* out,
-                                  const Vector<const uint8_t>& data);
+template V8_EXPORT_PRIVATE void Utf8Decoder::Decode(
+    uint8_t* out, const Vector<const uint8_t>& data);
 
-template void Utf8Decoder::Decode(uint16_t* out,
-                                  const Vector<const uint8_t>& data);
+template V8_EXPORT_PRIVATE void Utf8Decoder::Decode(
+    uint16_t* out, const Vector<const uint8_t>& data);
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/strings/unicode.h b/deps/v8/src/strings/unicode.h
index 48483af9e172bf..a050a27dc9f477 100644
--- a/deps/v8/src/strings/unicode.h
+++ b/deps/v8/src/strings/unicode.h
@@ -6,9 +6,9 @@
 #define V8_STRINGS_UNICODE_H_
 
 #include <sys/types.h>
+#include "src/base/bit-field.h"
 #include "src/common/globals.h"
 #include "src/third_party/utf8-decoder/utf8-decoder.h"
-#include "src/utils/utils.h"
 /**
  * \file
  * Definitions and convenience functions for working with unicode.
@@ -51,8 +51,8 @@ class Predicate {
     bool value() const { return ValueField::decode(bit_field_); }
 
    private:
-    using CodePointField = v8::internal::BitField<uchar, 0, 21>;
-    using ValueField = v8::internal::BitField<bool, 21, 1>;
+    using CodePointField = v8::base::BitField<uchar, 0, 21>;
+    using ValueField = v8::base::BitField<bool, 21, 1>;
 
     uint32_t bit_field_;
   };
@@ -228,12 +228,12 @@ V8_INLINE bool IsStringLiteralLineTerminator(uchar c) {
 }
 
 #ifndef V8_INTL_SUPPORT
-struct ToLowercase {
+struct V8_EXPORT_PRIVATE ToLowercase {
   static const int kMaxWidth = 3;
   static const bool kIsToLower = true;
   static int Convert(uchar c, uchar n, uchar* result, bool* allow_caching_ptr);
 };
-struct ToUppercase {
+struct V8_EXPORT_PRIVATE ToUppercase {
   static const int kMaxWidth = 3;
   static const bool kIsToLower = false;
   static int Convert(uchar c, uchar n, uchar* result, bool* allow_caching_ptr);
diff --git a/deps/v8/src/tasks/OWNERS b/deps/v8/src/tasks/OWNERS
index d31f346b03fc83..31d383cfcc3e22 100644
--- a/deps/v8/src/tasks/OWNERS
+++ b/deps/v8/src/tasks/OWNERS
@@ -1,6 +1,5 @@
 ahaas@chromium.org
 clemensb@chromium.org
 mlippautz@chromium.org
-mstarzinger@chromium.org
 rmcilroy@chromium.org
 ulan@chromium.org
diff --git a/deps/v8/src/third_party/siphash/OWNERS b/deps/v8/src/third_party/siphash/OWNERS
index 208670527f6113..f0ea8b5f4f97c4 100644
--- a/deps/v8/src/third_party/siphash/OWNERS
+++ b/deps/v8/src/third_party/siphash/OWNERS
@@ -1,3 +1,2 @@
 sigurds@chromium.org
 verwaest@chromium.org
-yangguo@chromium.org
diff --git a/deps/v8/src/third_party/vtune/BUILD.gn b/deps/v8/src/third_party/vtune/BUILD.gn
index a2163ebaf1b683..f699ab147ef030 100644
--- a/deps/v8/src/third_party/vtune/BUILD.gn
+++ b/deps/v8/src/third_party/vtune/BUILD.gn
@@ -4,17 +4,49 @@
 
 import("//build/toolchain/toolchain.gni")
 
+config("vtune_ittapi") {
+  include_dirs = [
+    "//third_party/ittapi/include",
+    "//third_party/ittapi/src/ittnotify",
+  ]
+}
+
 static_library("v8_vtune") {
   sources = [
-    "ittnotify_config.h",
-    "ittnotify_types.h",
-    "jitprofiling.cc",
-    "jitprofiling.h",
+    "//third_party/ittapi/include/jitprofiling.h",
+    "//third_party/ittapi/src/ittnotify/ittnotify_config.h",
+    "//third_party/ittapi/src/ittnotify/ittnotify_types.h",
+    "//third_party/ittapi/src/ittnotify/jitprofiling.c",
     "v8-vtune.h",
     "vtune-jit.cc",
     "vtune-jit.h",
   ]
+  configs += [ ":vtune_ittapi" ]
   deps = [
     "../../..:v8",
   ]
 }
+
+static_library("v8_vtune_trace_mark") {
+  sources = [
+    "//third_party/ittapi/include/ittnotify.h",
+    "vtuneapi.cc",
+    "vtuneapi.h",
+  ]
+  deps = [
+    ":ittnotify",
+  ]
+}
+
+static_library("ittnotify") {
+  sources = [
+    "//third_party/ittapi/include/ittnotify.h",
+    "//third_party/ittapi/include/legacy/ittnotify.h",
+    "//third_party/ittapi/src/ittnotify/disable-warnings.h",
+    "//third_party/ittapi/src/ittnotify/ittnotify_config.h",
+    "//third_party/ittapi/src/ittnotify/ittnotify_static.c",
+    "//third_party/ittapi/src/ittnotify/ittnotify_static.h",
+  ]
+  include_dirs = [ "//third_party/ittapi/include" ]
+  deps = []
+}
diff --git a/deps/v8/src/third_party/vtune/ittnotify_config.h b/deps/v8/src/third_party/vtune/ittnotify_config.h
deleted file mode 100644
index 9095107cb3dcc9..00000000000000
--- a/deps/v8/src/third_party/vtune/ittnotify_config.h
+++ /dev/null
@@ -1,484 +0,0 @@
-/*
-  This file is provided under a dual BSD/GPLv2 license.  When using or
-  redistributing this file, you may do so under either license.
-
-  GPL LICENSE SUMMARY
-
-  Copyright(c) 2005-2012 Intel Corporation. All rights reserved.
-
-  This program is free software; you can redistribute it and/or modify
-  it under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-
-  This program is distributed in the hope that it will be useful, but
-  WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-  General Public License for more details.
-
-  You should have received a copy of the GNU General Public License
-  along with this program; if not, write to the Free Software
-  Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-  The full GNU General Public License is included in this distribution
-  in the file called LICENSE.GPL.
-
-  Contact Information:
-  http://software.intel.com/en-us/articles/intel-vtune-amplifier-xe/
-
-  BSD LICENSE
-
-  Copyright(c) 2005-2012 Intel Corporation. All rights reserved.
-  All rights reserved.
-
-  Redistribution and use in source and binary forms, with or without
-  modification, are permitted provided that the following conditions
-  are met:
-
-    * Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in
-      the documentation and/or other materials provided with the
-      distribution.
-    * Neither the name of Intel Corporation nor the names of its
-      contributors may be used to endorse or promote products derived
-      from this software without specific prior written permission.
-
-  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-#ifndef _ITTNOTIFY_CONFIG_H_
-#define _ITTNOTIFY_CONFIG_H_
-
-/** @cond exclude_from_documentation */
-#ifndef ITT_OS_WIN
-#  define ITT_OS_WIN   1
-#endif /* ITT_OS_WIN */
-
-#ifndef ITT_OS_LINUX
-#  define ITT_OS_LINUX 2
-#endif /* ITT_OS_LINUX */
-
-#ifndef ITT_OS_MAC
-#  define ITT_OS_MAC   3
-#endif /* ITT_OS_MAC */
-
-#ifndef ITT_OS
-#  if defined WIN32 || defined _WIN32
-#    define ITT_OS ITT_OS_WIN
-#  elif defined( __APPLE__ ) && defined( __MACH__ )
-#    define ITT_OS ITT_OS_MAC
-#  else
-#    define ITT_OS ITT_OS_LINUX
-#  endif
-#endif /* ITT_OS */
-
-#ifndef ITT_PLATFORM_WIN
-#  define ITT_PLATFORM_WIN 1
-#endif /* ITT_PLATFORM_WIN */
-
-#ifndef ITT_PLATFORM_POSIX
-#  define ITT_PLATFORM_POSIX 2
-#endif /* ITT_PLATFORM_POSIX */
-
-#ifndef ITT_PLATFORM
-#  if ITT_OS==ITT_OS_WIN
-#    define ITT_PLATFORM ITT_PLATFORM_WIN
-#  else
-#    define ITT_PLATFORM ITT_PLATFORM_POSIX
-#  endif /* _WIN32 */
-#endif /* ITT_PLATFORM */
-
-#if defined(_UNICODE) && !defined(UNICODE)
-#define UNICODE
-#endif
-
-#include <stddef.h>
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-#include <tchar.h>
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-#include <stdint.h>
-#if defined(UNICODE) || defined(_UNICODE)
-#include <wchar.h>
-#endif /* UNICODE || _UNICODE */
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-
-#ifndef CDECL
-#  if ITT_PLATFORM==ITT_PLATFORM_WIN
-#    define CDECL __cdecl
-#  else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-#    if defined _M_X64 || defined _M_AMD64 || defined __x86_64__
-#      define CDECL /* not actual on x86_64 platform */
-#    else  /* _M_X64 || _M_AMD64 || __x86_64__ */
-#      define CDECL __attribute__ ((cdecl))
-#    endif /* _M_X64 || _M_AMD64 || __x86_64__ */
-#  endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-#endif /* CDECL */
-
-#ifndef STDCALL
-#  if ITT_PLATFORM==ITT_PLATFORM_WIN
-#    define STDCALL __stdcall
-#  else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-#    if defined _M_X64 || defined _M_AMD64 || defined __x86_64__
-#      define STDCALL /* not supported on x86_64 platform */
-#    else  /* _M_X64 || _M_AMD64 || __x86_64__ */
-#      define STDCALL __attribute__ ((stdcall))
-#    endif /* _M_X64 || _M_AMD64 || __x86_64__ */
-#  endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-#endif /* STDCALL */
-
-#define ITTAPI    CDECL
-#define LIBITTAPI CDECL
-
-/* TODO: Temporary for compatibility! */
-#define ITTAPI_CALL    CDECL
-#define LIBITTAPI_CALL CDECL
-
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-/* use __forceinline (VC++ specific) */
-#define ITT_INLINE           __forceinline
-#define ITT_INLINE_ATTRIBUTE /* nothing */
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-/*
- * Generally, functions are not inlined unless optimization is specified.
- * For functions declared inline, this attribute inlines the function even
- * if no optimization level was specified.
- */
-#ifdef __STRICT_ANSI__
-#define ITT_INLINE           static
-#else  /* __STRICT_ANSI__ */
-#define ITT_INLINE           static inline
-#endif /* __STRICT_ANSI__ */
-#define ITT_INLINE_ATTRIBUTE __attribute__ ((always_inline))
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-/** @endcond */
-
-#ifndef ITT_ARCH_IA32
-#  define ITT_ARCH_IA32  1
-#endif /* ITT_ARCH_IA32 */
-
-#ifndef ITT_ARCH_IA32E
-#  define ITT_ARCH_IA32E 2
-#endif /* ITT_ARCH_IA32E */
-
-#ifndef ITT_ARCH_IA64
-#  define ITT_ARCH_IA64  3
-#endif /* ITT_ARCH_IA64 */
-
-#ifndef ITT_ARCH
-#  if defined _M_X64 || defined _M_AMD64 || defined __x86_64__
-#    define ITT_ARCH ITT_ARCH_IA32E
-#  elif defined _M_IA64 || defined __ia64
-#    define ITT_ARCH ITT_ARCH_IA64
-#  else
-#    define ITT_ARCH ITT_ARCH_IA32
-#  endif
-#endif
-
-#ifdef __cplusplus
-#  define ITT_EXTERN_C extern "C"
-#else
-#  define ITT_EXTERN_C /* nothing */
-#endif /* __cplusplus */
-
-#define ITT_TO_STR_AUX(x) #x
-#define ITT_TO_STR(x)     ITT_TO_STR_AUX(x)
-
-#define __ITT_BUILD_ASSERT(expr, suffix) do { static char __itt_build_check_##suffix[(expr) ? 1 : -1]; __itt_build_check_##suffix[0] = 0; } while(0)
-#define _ITT_BUILD_ASSERT(expr, suffix)  __ITT_BUILD_ASSERT((expr), suffix)
-#define ITT_BUILD_ASSERT(expr)           _ITT_BUILD_ASSERT((expr), __LINE__)
-
-#define ITT_MAGIC { 0xED, 0xAB, 0xAB, 0xEC, 0x0D, 0xEE, 0xDA, 0x30 }
-
-/* Replace with snapshot date YYYYMMDD for promotion build. */
-#define API_VERSION_BUILD    20111111
-
-#ifndef API_VERSION_NUM
-#define API_VERSION_NUM 0.0.0
-#endif /* API_VERSION_NUM */
-
-#define API_VERSION "ITT-API-Version " ITT_TO_STR(API_VERSION_NUM) " (" ITT_TO_STR(API_VERSION_BUILD) ")"
-
-/* OS communication functions */
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-#include <windows.h>
-using lib_t = HMODULE;
-using TIDT = DWORD;
-using mutex_t = CRITICAL_SECTION;
-#define MUTEX_INITIALIZER { 0 }
-#define strong_alias(name, aliasname) /* empty for Windows */
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-#include <dlfcn.h>
-#if defined(UNICODE) || defined(_UNICODE)
-#include <wchar.h>
-#endif /* UNICODE */
-#ifndef _GNU_SOURCE
-#define _GNU_SOURCE 1 /* need for PTHREAD_MUTEX_RECURSIVE */
-#endif /* _GNU_SOURCE */
-#include <pthread.h>
-typedef void*             lib_t;
-using TIDT = pthread_t;
-using mutex_t = pthread_mutex_t;
-#define MUTEX_INITIALIZER PTHREAD_MUTEX_INITIALIZER
-#define _strong_alias(name, aliasname) extern __typeof (name) aliasname __attribute__ ((alias (#name)));
-#define strong_alias(name, aliasname) _strong_alias(name, aliasname)
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-#define __itt_get_proc(lib, name) GetProcAddress(lib, name)
-#define __itt_mutex_init(mutex)   InitializeCriticalSection(mutex)
-#define __itt_mutex_lock(mutex)   EnterCriticalSection(mutex)
-#define __itt_mutex_unlock(mutex) LeaveCriticalSection(mutex)
-#define __itt_load_lib(name)      LoadLibraryA(name)
-#define __itt_unload_lib(handle)  FreeLibrary(handle)
-#define __itt_system_error()      (int)GetLastError()
-#define __itt_fstrcmp(s1, s2)     lstrcmpA(s1, s2)
-#define __itt_fstrlen(s)          lstrlenA(s)
-#define __itt_fstrcpyn(s1, s2, l) lstrcpynA(s1, s2, l)
-#define __itt_fstrdup(s)          _strdup(s)
-#define __itt_thread_id()         GetCurrentThreadId()
-#define __itt_thread_yield()      SwitchToThread()
-#ifndef ITT_SIMPLE_INIT
-ITT_INLINE int __itt_interlocked_increment(volatile long* ptr) ITT_INLINE_ATTRIBUTE;
-ITT_INLINE int __itt_interlocked_increment(volatile long* ptr)
-{
-    return InterlockedIncrement(ptr);
-}
-#endif /* ITT_SIMPLE_INIT */
-#else /* ITT_PLATFORM!=ITT_PLATFORM_WIN */
-#define __itt_get_proc(lib, name) dlsym(lib, name)
-#define __itt_mutex_init(mutex)   \
-    {                                                                                        \
-        pthread_mutexattr_t mutex_attr;                                                      \
-        int error_code = pthread_mutexattr_init(&mutex_attr);                                \
-        if (error_code)                                                                      \
-            __itt_report_error(__itt_error_system, "pthread_mutexattr_init", error_code);    \
-        error_code = pthread_mutexattr_settype(&mutex_attr, PTHREAD_MUTEX_RECURSIVE);        \
-        if (error_code)                                                                      \
-            __itt_report_error(__itt_error_system, "pthread_mutexattr_settype", error_code); \
-        error_code = pthread_mutex_init(mutex, &mutex_attr);                                 \
-        if (error_code)                                                                      \
-            __itt_report_error(__itt_error_system, "pthread_mutex_init", error_code);        \
-        error_code = pthread_mutexattr_destroy(&mutex_attr);                                 \
-        if (error_code)                                                                      \
-            __itt_report_error(__itt_error_system, "pthread_mutexattr_destroy", error_code); \
-    }
-#define __itt_mutex_lock(mutex)   pthread_mutex_lock(mutex)
-#define __itt_mutex_unlock(mutex) pthread_mutex_unlock(mutex)
-#define __itt_load_lib(name)      dlopen(name, RTLD_LAZY)
-#define __itt_unload_lib(handle)  dlclose(handle)
-#define __itt_system_error()      errno
-#define __itt_fstrcmp(s1, s2)     strcmp(s1, s2)
-#define __itt_fstrlen(s)          strlen(s)
-#define __itt_fstrcpyn(s1, s2, l) strncpy(s1, s2, l)
-#define __itt_fstrdup(s)          strdup(s)
-#define __itt_thread_id()         pthread_self()
-#define __itt_thread_yield()      sched_yield()
-#if ITT_ARCH==ITT_ARCH_IA64
-#ifdef __INTEL_COMPILER
-#define __TBB_machine_fetchadd4(addr, val) __fetchadd4_acq((void *)addr, val)
-#else  /* __INTEL_COMPILER */
-/* TODO: Add Support for not Intel compilers for IA64 */
-#endif /* __INTEL_COMPILER */
-#else /* ITT_ARCH!=ITT_ARCH_IA64 */
-/*ITT_INLINE int __TBB_machine_fetchadd4(volatile void* ptr, long addend) ITT_INLINE_ATTRIBUTE;
-ITT_INLINE int __TBB_machine_fetchadd4(volatile void* ptr, long addend)
-{
-    int result;
-    __asm__ __volatile__("lock\nxaddl %0,%1"
-                          : "=r"(result),"=m"(*(long*)ptr)
-                          : "0"(addend), "m"(*(long*)ptr)
-                          : "memory");
-    return result;
-}
-*/
-#endif /* ITT_ARCH==ITT_ARCH_IA64 */
-#ifndef ITT_SIMPLE_INIT
-/*ITT_INLINE int __itt_interlocked_increment(volatile long* ptr) ITT_INLINE_ATTRIBUTE;
-ITT_INLINE int __itt_interlocked_increment(volatile long* ptr)
-{
-    return __TBB_machine_fetchadd4(ptr, 1) + 1;
-}
-*/
-#endif /* ITT_SIMPLE_INIT */
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-
-typedef enum {
-    __itt_collection_normal = 0,
-    __itt_collection_paused = 1
-} __itt_collection_state;
-
-typedef enum {
-    __itt_thread_normal  = 0,
-    __itt_thread_ignored = 1
-} __itt_thread_state;
-
-#pragma pack(push, 8)
-
-typedef struct ___itt_thread_info
-{
-    const char* nameA; /*!< Copy of original name in ASCII. */
-#if defined(UNICODE) || defined(_UNICODE)
-    const wchar_t* nameW; /*!< Copy of original name in UNICODE. */
-#else  /* UNICODE || _UNICODE */
-    void* nameW;
-#endif /* UNICODE || _UNICODE */
-    TIDT               tid;
-    __itt_thread_state state;   /*!< Thread state (paused or normal) */
-    int                extra1;  /*!< Reserved to the runtime */
-    void*              extra2;  /*!< Reserved to the runtime */
-    struct ___itt_thread_info* next;
-} __itt_thread_info;
-
-#include "ittnotify_types.h" /* For __itt_group_id definition */
-
-typedef struct ___itt_api_info_20101001
-{
-    const char*    name;
-    void**         func_ptr;
-    void*          init_func;
-    __itt_group_id group;
-}  __itt_api_info_20101001;
-
-typedef struct ___itt_api_info
-{
-    const char*    name;
-    void**         func_ptr;
-    void*          init_func;
-    void*          null_func;
-    __itt_group_id group;
-}  __itt_api_info;
-
-struct ___itt_domain;
-struct ___itt_string_handle;
-
-typedef struct ___itt_global
-{
-    unsigned char          magic[8];
-    unsigned long          version_major;
-    unsigned long          version_minor;
-    unsigned long          version_build;
-    volatile long          api_initialized;
-    volatile long          mutex_initialized;
-    volatile long          atomic_counter;
-    mutex_t                mutex;
-    lib_t                  lib;
-    void*                  error_handler;
-    const char**           dll_path_ptr;
-    __itt_api_info*        api_list_ptr;
-    struct ___itt_global*  next;
-    /* Joinable structures below */
-    __itt_thread_info*     thread_list;
-    struct ___itt_domain*  domain_list;
-    struct ___itt_string_handle* string_list;
-    __itt_collection_state state;
-} __itt_global;
-
-#pragma pack(pop)
-
-#define NEW_THREAD_INFO_W(gptr,h,h_tail,t,s,n) { \
-    h = (__itt_thread_info*)malloc(sizeof(__itt_thread_info)); \
-    if (h != NULL) { \
-        h->tid    = t; \
-        h->nameA  = NULL; \
-        h->nameW  = n ? _wcsdup(n) : NULL; \
-        h->state  = s; \
-        h->extra1 = 0;    /* reserved */ \
-        h->extra2 = NULL; /* reserved */ \
-        h->next   = NULL; \
-        if (h_tail == NULL) \
-            (gptr)->thread_list = h; \
-        else \
-            h_tail->next = h; \
-    } \
-}
-
-#define NEW_THREAD_INFO_A(gptr,h,h_tail,t,s,n) { \
-    h = (__itt_thread_info*)malloc(sizeof(__itt_thread_info)); \
-    if (h != NULL) { \
-        h->tid    = t; \
-        h->nameA  = n ? __itt_fstrdup(n) : NULL; \
-        h->nameW  = NULL; \
-        h->state  = s; \
-        h->extra1 = 0;    /* reserved */ \
-        h->extra2 = NULL; /* reserved */ \
-        h->next   = NULL; \
-        if (h_tail == NULL) \
-            (gptr)->thread_list = h; \
-        else \
-            h_tail->next = h; \
-    } \
-}
-
-#define NEW_DOMAIN_W(gptr,h,h_tail,name) { \
-    h = (__itt_domain*)malloc(sizeof(__itt_domain)); \
-    if (h != NULL) { \
-        h->flags  = 0;    /* domain is disabled by default */ \
-        h->nameA  = NULL; \
-        h->nameW  = name ? _wcsdup(name) : NULL; \
-        h->extra1 = 0;    /* reserved */ \
-        h->extra2 = NULL; /* reserved */ \
-        h->next   = NULL; \
-        if (h_tail == NULL) \
-            (gptr)->domain_list = h; \
-        else \
-            h_tail->next = h; \
-    } \
-}
-
-#define NEW_DOMAIN_A(gptr,h,h_tail,name) { \
-    h = (__itt_domain*)malloc(sizeof(__itt_domain)); \
-    if (h != NULL) { \
-        h->flags  = 0;    /* domain is disabled by default */ \
-        h->nameA  = name ? __itt_fstrdup(name) : NULL; \
-        h->nameW  = NULL; \
-        h->extra1 = 0;    /* reserved */ \
-        h->extra2 = NULL; /* reserved */ \
-        h->next   = NULL; \
-        if (h_tail == NULL) \
-            (gptr)->domain_list = h; \
-        else \
-            h_tail->next = h; \
-    } \
-}
-
-#define NEW_STRING_HANDLE_W(gptr,h,h_tail,name) { \
-    h = (__itt_string_handle*)malloc(sizeof(__itt_string_handle)); \
-    if (h != NULL) { \
-        h->strA   = NULL; \
-        h->strW   = name ? _wcsdup(name) : NULL; \
-        h->extra1 = 0;    /* reserved */ \
-        h->extra2 = NULL; /* reserved */ \
-        h->next   = NULL; \
-        if (h_tail == NULL) \
-            (gptr)->string_list = h; \
-        else \
-            h_tail->next = h; \
-    } \
-}
-
-#define NEW_STRING_HANDLE_A(gptr,h,h_tail,name) { \
-    h = (__itt_string_handle*)malloc(sizeof(__itt_string_handle)); \
-    if (h != NULL) { \
-        h->strA   = name ? __itt_fstrdup(name) : NULL; \
-        h->strW   = NULL; \
-        h->extra1 = 0;    /* reserved */ \
-        h->extra2 = NULL; /* reserved */ \
-        h->next   = NULL; \
-        if (h_tail == NULL) \
-            (gptr)->string_list = h; \
-        else \
-            h_tail->next = h; \
-    } \
-}
-
-#endif /* _ITTNOTIFY_CONFIG_H_ */
-
diff --git a/deps/v8/src/third_party/vtune/ittnotify_types.h b/deps/v8/src/third_party/vtune/ittnotify_types.h
deleted file mode 100644
index 736c1f5b5ec4b9..00000000000000
--- a/deps/v8/src/third_party/vtune/ittnotify_types.h
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
-  This file is provided under a dual BSD/GPLv2 license.  When using or
-  redistributing this file, you may do so under either license.
-
-  GPL LICENSE SUMMARY
-
-  Copyright(c) 2005-2012 Intel Corporation. All rights reserved.
-
-  This program is free software; you can redistribute it and/or modify
-  it under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-
-  This program is distributed in the hope that it will be useful, but
-  WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-  General Public License for more details.
-
-  You should have received a copy of the GNU General Public License
-  along with this program; if not, write to the Free Software
-  Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-  The full GNU General Public License is included in this distribution
-  in the file called LICENSE.GPL.
-
-  Contact Information:
-  http://software.intel.com/en-us/articles/intel-vtune-amplifier-xe/
-
-  BSD LICENSE
-
-  Copyright(c) 2005-2012 Intel Corporation. All rights reserved.
-  All rights reserved.
-
-  Redistribution and use in source and binary forms, with or without
-  modification, are permitted provided that the following conditions
-  are met:
-
-    * Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in
-      the documentation and/or other materials provided with the
-      distribution.
-    * Neither the name of Intel Corporation nor the names of its
-      contributors may be used to endorse or promote products derived
-      from this software without specific prior written permission.
-
-  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-#ifndef _ITTNOTIFY_TYPES_H_
-#define _ITTNOTIFY_TYPES_H_
-
-typedef enum ___itt_group_id
-{
-    __itt_group_none      = 0,
-    __itt_group_legacy    = 1<<0,
-    __itt_group_control   = 1<<1,
-    __itt_group_thread    = 1<<2,
-    __itt_group_mark      = 1<<3,
-    __itt_group_sync      = 1<<4,
-    __itt_group_fsync     = 1<<5,
-    __itt_group_jit       = 1<<6,
-    __itt_group_model     = 1<<7,
-    __itt_group_splitter_min = 1<<7,
-    __itt_group_counter   = 1<<8,
-    __itt_group_frame     = 1<<9,
-    __itt_group_stitch    = 1<<10,
-    __itt_group_heap      = 1<<11,
-    __itt_group_splitter_max = 1<<12,
-    __itt_group_structure = 1<<12,
-    __itt_group_suppress = 1<<13,
-    __itt_group_all       = -1
-} __itt_group_id;
-
-#pragma pack(push, 8)
-
-typedef struct ___itt_group_list
-{
-    __itt_group_id id;
-    const char*    name;
-} __itt_group_list;
-
-#pragma pack(pop)
-
-#define ITT_GROUP_LIST(varname) \
-    static __itt_group_list varname[] = {       \
-        { __itt_group_all,       "all"       }, \
-        { __itt_group_control,   "control"   }, \
-        { __itt_group_thread,    "thread"    }, \
-        { __itt_group_mark,      "mark"      }, \
-        { __itt_group_sync,      "sync"      }, \
-        { __itt_group_fsync,     "fsync"     }, \
-        { __itt_group_jit,       "jit"       }, \
-        { __itt_group_model,     "model"     }, \
-        { __itt_group_counter,   "counter"   }, \
-        { __itt_group_frame,     "frame"     }, \
-        { __itt_group_stitch,    "stitch"    }, \
-        { __itt_group_heap,      "heap"      }, \
-        { __itt_group_structure, "structure" }, \
-        { __itt_group_suppress,  "suppress"  }, \
-        { __itt_group_none,      NULL        }  \
-    }
-
-#endif /* _ITTNOTIFY_TYPES_H_ */
-
diff --git a/deps/v8/src/third_party/vtune/jitprofiling.cc b/deps/v8/src/third_party/vtune/jitprofiling.cc
deleted file mode 100644
index 40282903fcabe1..00000000000000
--- a/deps/v8/src/third_party/vtune/jitprofiling.cc
+++ /dev/null
@@ -1,499 +0,0 @@
-/*
-  This file is provided under a dual BSD/GPLv2 license.  When using or
-  redistributing this file, you may do so under either license.
-
-  GPL LICENSE SUMMARY
-
-  Copyright(c) 2005-2012 Intel Corporation. All rights reserved.
-
-  This program is free software; you can redistribute it and/or modify
-  it under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-
-  This program is distributed in the hope that it will be useful, but
-  WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-  General Public License for more details.
-
-  You should have received a copy of the GNU General Public License
-  along with this program; if not, write to the Free Software
-  Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-  The full GNU General Public License is included in this distribution
-  in the file called LICENSE.GPL.
-
-  Contact Information:
-  http://software.intel.com/en-us/articles/intel-vtune-amplifier-xe/
-
-  BSD LICENSE
-
-  Copyright(c) 2005-2012 Intel Corporation. All rights reserved.
-  All rights reserved.
-
-  Redistribution and use in source and binary forms, with or without
-  modification, are permitted provided that the following conditions
-  are met:
-
-    * Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in
-      the documentation and/or other materials provided with the
-      distribution.
-    * Neither the name of Intel Corporation nor the names of its
-      contributors may be used to endorse or promote products derived
-      from this software without specific prior written permission.
-
-  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-#include "ittnotify_config.h"
-
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-#include <windows.h>
-#pragma optimize("", off)
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-#include <pthread.h>
-#include <dlfcn.h>
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-#include <malloc.h>
-#include <stdlib.h>
-
-#include "jitprofiling.h"
-
-static const char rcsid[] = "\n@(#) $Revision: 234474 $\n";
-
-#define DLL_ENVIRONMENT_VAR		"VS_PROFILER"
-
-#ifndef NEW_DLL_ENVIRONMENT_VAR
-#if ITT_ARCH==ITT_ARCH_IA32
-#define NEW_DLL_ENVIRONMENT_VAR		"INTEL_JIT_PROFILER32"
-#else
-#define NEW_DLL_ENVIRONMENT_VAR		"INTEL_JIT_PROFILER64"
-#endif
-#endif /* NEW_DLL_ENVIRONMENT_VAR */
-
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-#define DEFAULT_DLLNAME			"JitPI.dll"
-HINSTANCE m_libHandle = NULL;
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-#define DEFAULT_DLLNAME			"libJitPI.so"
-void* m_libHandle = NULL;
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-
-/* default location of JIT profiling agent on Android */
-#define ANDROID_JIT_AGENT_PATH  "/data/intel/libittnotify.so"
-
-/* the function pointers */
-typedef unsigned int(*TPInitialize)(void);
-static TPInitialize FUNC_Initialize=NULL;
-
-typedef unsigned int(*TPNotify)(unsigned int, void*);
-static TPNotify FUNC_NotifyEvent=NULL;
-
-static iJIT_IsProfilingActiveFlags executionMode = iJIT_NOTHING_RUNNING;
-
-/* end collector dll part. */
-
-/* loadiJIT_Funcs() : this function is called just in the beginning and is responsible
-** to load the functions from BistroJavaCollector.dll
-** result:
-**		on success: the functions loads,    iJIT_DLL_is_missing=0, return value = 1.
-**		on failure: the functions are NULL, iJIT_DLL_is_missing=1, return value = 0.
-*/
-static int loadiJIT_Funcs(void);
-
-/* global representing whether the BistroJavaCollector can't be loaded */
-static int iJIT_DLL_is_missing = 0;
-
-/* Virtual stack - the struct is used as a virtual stack for each thread.
-** Every thread initializes with a stack of size INIT_TOP_STACK.
-** Every method entry decreases from the current stack point,
-** and when a thread stack reaches its top of stack (return from the global function),
-** the top of stack and the current stack increase. Notice that when returning from a function
-** the stack pointer is the address of the function return.
-*/
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-static DWORD threadLocalStorageHandle = 0;
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-static pthread_key_t threadLocalStorageHandle = (pthread_key_t)0;
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-
-#define INIT_TOP_Stack 10000
-
-typedef struct
-{
-    unsigned int TopStack;
-    unsigned int CurrentStack;
-} ThreadStack, *pThreadStack;
-
-/* end of virtual stack. */
-
-/*
-** The function for reporting virtual-machine related events to VTune.
-** Note: when reporting iJVM_EVENT_TYPE_ENTER_NIDS, there is no need to fill in the stack_id
-** field in the iJIT_Method_NIDS structure, as VTune fills it.
-**
-** The return value in iJVM_EVENT_TYPE_ENTER_NIDS && iJVM_EVENT_TYPE_LEAVE_NIDS events
-** will be 0 in case of failure.
-** in iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED event it will be -1 if EventSpecificData == 0
-** otherwise it will be 0.
-*/
-
-ITT_EXTERN_C int JITAPI iJIT_NotifyEvent(iJIT_JVM_EVENT event_type, void *EventSpecificData)
-{
-    int ReturnValue;
-
-    /*******************************************************************************
-    ** This section is for debugging outside of VTune.
-    ** It creates the environment variables that indicates call graph mode.
-    ** If running outside of VTune remove the remark.
-    **
-
-      static int firstTime = 1;
-      char DoCallGraph[12] = "DoCallGraph";
-      if (firstTime)
-      {
-      firstTime = 0;
-      SetEnvironmentVariable( "BISTRO_COLLECTORS_DO_CALLGRAPH", DoCallGraph);
-      }
-
-    ** end of section.
-    *******************************************************************************/
-
-    /* initialization part - the functions have not been loaded yet. This part
-    **		will load the functions, and check if we are in Call Graph mode.
-    **		(for special treatment).
-    */
-    if (!FUNC_NotifyEvent)
-    {
-        if (iJIT_DLL_is_missing)
-            return 0;
-
-        // load the Function from the DLL
-        if (!loadiJIT_Funcs())
-            return 0;
-
-        /* Call Graph initialization. */
-    }
-
-    /* If the event is method entry/exit, check that in the current mode
-    ** VTune is allowed to receive it
-    */
-    if ((event_type == iJVM_EVENT_TYPE_ENTER_NIDS || event_type == iJVM_EVENT_TYPE_LEAVE_NIDS) &&
-        (executionMode != iJIT_CALLGRAPH_ON))
-    {
-        return 0;
-    }
-    /* This section is performed when method enter event occurs.
-    ** It updates the virtual stack, or creates it if this is the first
-    ** method entry in the thread. The stack pointer is decreased.
-    */
-    if (event_type == iJVM_EVENT_TYPE_ENTER_NIDS)
-    {
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-        pThreadStack threadStack = (pThreadStack)TlsGetValue (threadLocalStorageHandle);
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-        pThreadStack threadStack = (pThreadStack)pthread_getspecific(threadLocalStorageHandle);
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-
-        // check for use of reserved method IDs
-        if ( ((piJIT_Method_NIDS) EventSpecificData)->method_id <= 999 )
-            return 0;
-
-        if (!threadStack)
-        {
-            // initialize the stack.
-            threadStack = (pThreadStack) calloc (sizeof(ThreadStack), 1);
-            threadStack->TopStack = INIT_TOP_Stack;
-            threadStack->CurrentStack = INIT_TOP_Stack;
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-            TlsSetValue(threadLocalStorageHandle,(void*)threadStack);
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-            pthread_setspecific(threadLocalStorageHandle,(void*)threadStack);
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-        }
-
-        // decrease the stack.
-        ((piJIT_Method_NIDS) EventSpecificData)->stack_id = (threadStack->CurrentStack)--;
-    }
-
-    /* This section is performed when method leave event occurs
-    ** It updates the virtual stack.
-    **		Increases the stack pointer.
-    **		If the stack pointer reached the top (left the global function)
-    **			increase the pointer and the top pointer.
-    */
-    if (event_type == iJVM_EVENT_TYPE_LEAVE_NIDS)
-    {
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-        pThreadStack threadStack = (pThreadStack)TlsGetValue (threadLocalStorageHandle);
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-        pThreadStack threadStack = (pThreadStack)pthread_getspecific(threadLocalStorageHandle);
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-
-        // check for use of reserved method IDs
-        if ( ((piJIT_Method_NIDS) EventSpecificData)->method_id <= 999 )
-            return 0;
-
-        if (!threadStack)
-        {
-            /* Error: first report in this thread is method exit */
-            exit (1);
-        }
-
-        ((piJIT_Method_NIDS) EventSpecificData)->stack_id = ++(threadStack->CurrentStack) + 1;
-
-        if (((piJIT_Method_NIDS) EventSpecificData)->stack_id > threadStack->TopStack)
-            ((piJIT_Method_NIDS) EventSpecificData)->stack_id = (unsigned int)-1;
-    }
-
-    if (event_type == iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED)
-    {
-        // check for use of reserved method IDs
-        if ( ((piJIT_Method_Load) EventSpecificData)->method_id <= 999 )
-            return 0;
-    }
-
-    ReturnValue = (int)FUNC_NotifyEvent(event_type, EventSpecificData);
-
-    return ReturnValue;
-}
-
-ITT_EXTERN_C void JITAPI iJIT_RegisterCallbackEx(void *userdata, iJIT_ModeChangedEx NewModeCallBackFuncEx) // The new mode call back routine
-{
-    // is it already missing... or the load of functions from the DLL failed
-    if (iJIT_DLL_is_missing || !loadiJIT_Funcs())
-    {
-        NewModeCallBackFuncEx(userdata, iJIT_NO_NOTIFICATIONS);  // then do not bother with notifications
-        /* Error: could not load JIT functions. */
-        return;
-    }
-    // nothing to do with the callback
-}
-
-/*
-** This function allows the user to query in which mode, if at all, VTune is running
-*/
-ITT_EXTERN_C iJIT_IsProfilingActiveFlags JITAPI iJIT_IsProfilingActive()
-{
-    if (!iJIT_DLL_is_missing)
-    {
-        loadiJIT_Funcs();
-    }
-
-    return executionMode;
-}
-#include <stdio.h>
-/* this function loads the collector dll (BistroJavaCollector) and the relevant functions.
-** on success: all functions load,     iJIT_DLL_is_missing = 0, return value = 1.
-** on failure: all functions are NULL, iJIT_DLL_is_missing = 1, return value = 0.
-*/
-static int loadiJIT_Funcs()
-{
-    static int bDllWasLoaded = 0;
-    char *dllName = (char*)rcsid; // !!! Just to avoid unused code elimination !!!
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-    DWORD dNameLength = 0;
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-
-    if(bDllWasLoaded)
-    {// dll was already loaded, no need to do it for the second time
-        return 1;
-    }
-
-    // Assumes that the DLL will not be found
-    iJIT_DLL_is_missing = 1;
-    FUNC_NotifyEvent = NULL;
-
-    if (m_libHandle)
-    {
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-        FreeLibrary(m_libHandle);
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-        dlclose(m_libHandle);
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-        m_libHandle = NULL;
-    }
-
-    // try to get the dll name from the environment
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-    dNameLength = GetEnvironmentVariableA(NEW_DLL_ENVIRONMENT_VAR, NULL, 0);
-    if (dNameLength)
-    {
-        DWORD envret = 0;
-        dllName = (char*)malloc(sizeof(char) * (dNameLength + 1));
-        envret = GetEnvironmentVariableA(NEW_DLL_ENVIRONMENT_VAR, dllName, dNameLength);
-        if (envret)
-        {
-            // Try to load the dll from the PATH...
-            m_libHandle = LoadLibraryExA(dllName, NULL, LOAD_WITH_ALTERED_SEARCH_PATH);
-        }
-        free(dllName);
-    } else {
-        // Try to use old VS_PROFILER variable
-        dNameLength = GetEnvironmentVariableA(DLL_ENVIRONMENT_VAR, NULL, 0);
-        if (dNameLength)
-        {
-            DWORD envret = 0;
-            dllName = (char*)malloc(sizeof(char) * (dNameLength + 1));
-            envret = GetEnvironmentVariableA(DLL_ENVIRONMENT_VAR, dllName, dNameLength);
-            if (envret)
-            {
-                // Try to load the dll from the PATH...
-                m_libHandle = LoadLibraryA(dllName);
-            }
-            free(dllName);
-        }
-    }
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-    dllName = getenv(NEW_DLL_ENVIRONMENT_VAR);
-    if (!dllName) {
-        dllName = getenv(DLL_ENVIRONMENT_VAR);
-    }
-#ifdef ANDROID
-    if (!dllName)
-        dllName = ANDROID_JIT_AGENT_PATH;
-#endif
-    if (dllName)
-    {
-        // Try to load the dll from the PATH...
-        m_libHandle = dlopen(dllName, RTLD_LAZY);
-    }
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-
-    if (!m_libHandle)
-    {
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-        m_libHandle = LoadLibraryA(DEFAULT_DLLNAME);
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-        m_libHandle = dlopen(DEFAULT_DLLNAME, RTLD_LAZY);
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-    }
-
-    // if the dll wasn't loaded - exit.
-    if (!m_libHandle)
-    {
-        iJIT_DLL_is_missing = 1; // don't try to initialize JIT agent the second time
-        return 0;
-    }
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-    FUNC_NotifyEvent = (TPNotify)GetProcAddress(m_libHandle, "NotifyEvent");
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-    FUNC_NotifyEvent = reinterpret_cast<TPNotify>(reinterpret_cast<intptr_t>(dlsym(m_libHandle, "NotifyEvent")));
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-    if (!FUNC_NotifyEvent)
-    {
-        FUNC_Initialize = NULL;
-        return 0;
-    }
-
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-    FUNC_Initialize = (TPInitialize)GetProcAddress(m_libHandle, "Initialize");
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-    FUNC_Initialize = reinterpret_cast<TPInitialize>(reinterpret_cast<intptr_t>(dlsym(m_libHandle, "Initialize")));
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-    if (!FUNC_Initialize)
-    {
-        FUNC_NotifyEvent = NULL;
-        return 0;
-    }
-
-    executionMode = (iJIT_IsProfilingActiveFlags)FUNC_Initialize();
-    if (executionMode != iJIT_SAMPLING_ON)
-      executionMode = iJIT_SAMPLING_ON;
-
-    bDllWasLoaded = 1;
-    iJIT_DLL_is_missing = 0; // DLL is ok.
-
-    /*
-    ** Call Graph mode: init the thread local storage
-    ** (need to store the virtual stack there).
-    */
-    if ( executionMode == iJIT_CALLGRAPH_ON )
-    {
-        // Allocate a thread local storage slot for the thread "stack"
-        if (!threadLocalStorageHandle)
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-            threadLocalStorageHandle = TlsAlloc();
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-        pthread_key_create(&threadLocalStorageHandle, NULL);
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-    }
-
-    return 1;
-}
-
-/*
-** This function should be called by the user whenever a thread ends, to free the thread
-** "virtual stack" storage
-*/
-ITT_EXTERN_C void JITAPI FinalizeThread()
-{
-    if (threadLocalStorageHandle)
-    {
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-        pThreadStack threadStack = (pThreadStack)TlsGetValue (threadLocalStorageHandle);
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-        pThreadStack threadStack = (pThreadStack)pthread_getspecific(threadLocalStorageHandle);
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-        if (threadStack)
-        {
-            free (threadStack);
-            threadStack = NULL;
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-            TlsSetValue (threadLocalStorageHandle, threadStack);
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-            pthread_setspecific(threadLocalStorageHandle, threadStack);
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-        }
-    }
-}
-
-/*
-** This function should be called by the user when the process ends, to free the local
-** storage index
-*/
-ITT_EXTERN_C void JITAPI FinalizeProcess()
-{
-    if (m_libHandle)
-    {
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-        FreeLibrary(m_libHandle);
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-        dlclose(m_libHandle);
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-        m_libHandle = NULL;
-    }
-
-    if (threadLocalStorageHandle)
-#if ITT_PLATFORM==ITT_PLATFORM_WIN
-        TlsFree (threadLocalStorageHandle);
-#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-    pthread_key_delete(threadLocalStorageHandle);
-#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
-}
-
-/*
-** This function should be called by the user for any method once.
-** The function will return a unique method ID, the user should maintain the ID for each
-** method
-*/
-ITT_EXTERN_C unsigned int JITAPI iJIT_GetNewMethodID()
-{
-    static unsigned int methodID = 0x100000;
-
-    if (methodID == 0)
-        return 0;	// ERROR : this is not a valid value
-
-    return methodID++;
-}
-
diff --git a/deps/v8/src/third_party/vtune/jitprofiling.h b/deps/v8/src/third_party/vtune/jitprofiling.h
deleted file mode 100644
index e23e11941a0a38..00000000000000
--- a/deps/v8/src/third_party/vtune/jitprofiling.h
+++ /dev/null
@@ -1,298 +0,0 @@
-/*
-  This file is provided under a dual BSD/GPLv2 license.  When using or
-  redistributing this file, you may do so under either license.
-
-  GPL LICENSE SUMMARY
-
-  Copyright (c) 2005-2012 Intel Corporation. All rights reserved.
-
-  This program is free software; you can redistribute it and/or modify
-  it under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-
-  This program is distributed in the hope that it will be useful, but
-  WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-  General Public License for more details.
-
-  You should have received a copy of the GNU General Public License
-  along with this program; if not, write to the Free Software
-  Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-  The full GNU General Public License is included in this distribution
-  in the file called LICENSE.GPL.
-
-  Contact Information:
-  http://software.intel.com/en-us/articles/intel-vtune-amplifier-xe/
-
-  BSD LICENSE
-
-  Copyright (c) 2005-2012 Intel Corporation. All rights reserved.
-  All rights reserved.
-
-  Redistribution and use in source and binary forms, with or without
-  modification, are permitted provided that the following conditions
-  are met:
-
-    * Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in
-      the documentation and/or other materials provided with the
-      distribution.
-    * Neither the name of Intel Corporation nor the names of its
-      contributors may be used to endorse or promote products derived
-      from this software without specific prior written permission.
-
-  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-#ifndef __JITPROFILING_H__
-#define __JITPROFILING_H__
-
-/*
- * Various constants used by functions
- */
-
-/* event notification */
-typedef enum iJIT_jvm_event
-{
-
-    /* shutdown  */
-
-    /*
-     * Program exiting EventSpecificData NA
-     */
-    iJVM_EVENT_TYPE_SHUTDOWN = 2,
-
-    /* JIT profiling  */
-
-    /*
-     * issued after method code jitted into memory but before code is executed
-     * EventSpecificData is an iJIT_Method_Load
-     */
-    iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED=13,
-
-    /* issued before unload. Method code will no longer be executed, but code
-     * and info are still in memory. The VTune profiler may capture method
-     * code only at this point EventSpecificData is iJIT_Method_Id
-     */
-    iJVM_EVENT_TYPE_METHOD_UNLOAD_START,
-
-    /* Method Profiling */
-
-    /* method name, Id and stack is supplied
-     * issued when a method is about to be entered EventSpecificData is
-     * iJIT_Method_NIDS
-     */
-    iJVM_EVENT_TYPE_ENTER_NIDS = 19,
-
-    /* method name, Id and stack is supplied
-     * issued when a method is about to be left EventSpecificData is
-     * iJIT_Method_NIDS
-     */
-    iJVM_EVENT_TYPE_LEAVE_NIDS
-} iJIT_JVM_EVENT;
-
-typedef enum _iJIT_ModeFlags
-{
-    /* No need to Notify VTune, since VTune is not running */
-    iJIT_NO_NOTIFICATIONS          = 0x0000,
-
-    /* when turned on the jit must call
-     * iJIT_NotifyEvent
-     * (
-     *     iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED,
-     * )
-     * for all the method already jitted
-     */
-    iJIT_BE_NOTIFY_ON_LOAD         = 0x0001,
-
-    /* when turned on the jit must call
-     * iJIT_NotifyEvent
-     * (
-     *     iJVM_EVENT_TYPE_METHOD_UNLOAD_FINISHED,
-     *  ) for all the method that are unloaded
-     */
-    iJIT_BE_NOTIFY_ON_UNLOAD       = 0x0002,
-
-    /* when turned on the jit must instrument all
-     * the currently jited code with calls on
-     * method entries
-     */
-    iJIT_BE_NOTIFY_ON_METHOD_ENTRY = 0x0004,
-
-    /* when turned on the jit must instrument all
-     * the currently jited code with calls
-     * on method exit
-     */
-    iJIT_BE_NOTIFY_ON_METHOD_EXIT  = 0x0008
-
-} iJIT_ModeFlags;
-
-
- /* Flags used by iJIT_IsProfilingActive() */
-typedef enum _iJIT_IsProfilingActiveFlags
-{
-    /* No profiler is running. Currently not used */
-    iJIT_NOTHING_RUNNING           = 0x0000,
-
-    /* Sampling is running. This is the default value
-     * returned by iJIT_IsProfilingActive()
-     */
-    iJIT_SAMPLING_ON               = 0x0001,
-
-      /* Call Graph is running */
-    iJIT_CALLGRAPH_ON              = 0x0002
-
-} iJIT_IsProfilingActiveFlags;
-
-/* Enumerator for the environment of methods*/
-typedef enum _iJDEnvironmentType
-{
-    iJDE_JittingAPI = 2
-} iJDEnvironmentType;
-
-/**********************************
- * Data structures for the events *
- **********************************/
-
-/* structure for the events:
- * iJVM_EVENT_TYPE_METHOD_UNLOAD_START
- */
-
-typedef struct _iJIT_Method_Id
-{
-   /* Id of the method (same as the one passed in
-   * the iJIT_Method_Load struct
-   */
-    unsigned int       method_id;
-
-} *piJIT_Method_Id, iJIT_Method_Id;
-
-
-/* structure for the events:
- * iJVM_EVENT_TYPE_ENTER_NIDS,
- * iJVM_EVENT_TYPE_LEAVE_NIDS,
- * iJVM_EVENT_TYPE_EXCEPTION_OCCURRED_NIDS
- */
-
-typedef struct _iJIT_Method_NIDS
-{
-    /* unique method ID */
-    unsigned int       method_id;
-
-    /* NOTE: no need to fill this field, it's filled by VTune */
-    unsigned int       stack_id;
-
-    /* method name (just the method, without the class) */
-    char*              method_name;
-} *piJIT_Method_NIDS, iJIT_Method_NIDS;
-
-/* structures for the events:
- * iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED
- */
-
-typedef struct _LineNumberInfo
-{
-  /* x86 Offset from the beginning of the method*/
-  unsigned int Offset;
-
-  /* source line number from the beginning of the source file */
-  unsigned int LineNumber;
-
-} *pLineNumberInfo, LineNumberInfo;
-
-typedef struct _iJIT_Method_Load
-{
-    /* unique method ID - can be any unique value, (except 0 - 999) */
-    unsigned int        method_id;
-
-    /* method name (can be with or without the class and signature, in any case
-     * the class name will be added to it)
-     */
-    char*               method_name;
-
-    /* virtual address of that method - This determines the method range for the
-     * iJVM_EVENT_TYPE_ENTER/LEAVE_METHOD_ADDR events
-     */
-    void*               method_load_address;
-
-    /* Size in memory - Must be exact */
-    unsigned int        method_size;
-
-    /* Line Table size in number of entries - Zero if none */
-    unsigned int        line_number_size;
-
-    /* Pointer to the beginning of the line numbers info array */
-    pLineNumberInfo     line_number_table;
-
-    /* unique class ID */
-    unsigned int        class_id;
-
-    /* class file name */
-    char*               class_file_name;
-
-    /* source file name */
-    char*               source_file_name;
-
-    /* bits supplied by the user for saving in the JIT file */
-    void*               user_data;
-
-    /* the size of the user data buffer */
-    unsigned int        user_data_size;
-
-    /* NOTE: no need to fill this field, it's filled by VTune */
-    iJDEnvironmentType  env;
-
-} *piJIT_Method_Load, iJIT_Method_Load;
-
-/* API Functions */
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#ifndef CDECL
-#  if defined WIN32 || defined _WIN32
-#    define CDECL __cdecl
-#  else /* defined WIN32 || defined _WIN32 */
-#    if defined _M_X64 || defined _M_AMD64 || defined __x86_64__
-#      define CDECL /* not actual on x86_64 platform */
-#    else  /* _M_X64 || _M_AMD64 || __x86_64__ */
-#      define CDECL __attribute__ ((cdecl))
-#    endif /* _M_X64 || _M_AMD64 || __x86_64__ */
-#  endif /* defined WIN32 || defined _WIN32 */
-#endif /* CDECL */
-
-#define JITAPI CDECL
-
-/* called when the settings are changed with new settings */
-typedef void (*iJIT_ModeChangedEx)(void *UserData, iJIT_ModeFlags Flags);
-
-int JITAPI iJIT_NotifyEvent(iJIT_JVM_EVENT event_type, void *EventSpecificData);
-
-/* The new mode call back routine */
-void JITAPI iJIT_RegisterCallbackEx(void *userdata,
-                                    iJIT_ModeChangedEx NewModeCallBackFuncEx);
-
-iJIT_IsProfilingActiveFlags JITAPI iJIT_IsProfilingActive(void);
-
-void JITAPI FinalizeThread(void);
-
-void JITAPI FinalizeProcess(void);
-
-unsigned int JITAPI iJIT_GetNewMethodID(void);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* __JITPROFILING_H__ */
diff --git a/deps/v8/src/third_party/vtune/vtune-jit.cc b/deps/v8/src/third_party/vtune/vtune-jit.cc
index dbbab7fc58bc12..94cb760e473ec3 100644
--- a/deps/v8/src/third_party/vtune/vtune-jit.cc
+++ b/deps/v8/src/third_party/vtune/vtune-jit.cc
@@ -60,7 +60,10 @@
 #include <string.h>
 
 #include <list>
+#include <memory>
+#include <string>
 #include <unordered_map>
+#include <vector>
 
 #include "v8-vtune.h"
 #include "vtune-jit.h"
@@ -136,7 +139,7 @@ static JITCodeLineInfo* UntagLineInfo(void* ptr) {
 // function name and some other info. It comes from all the
 // Logger::CodeCreateEvent(...) function. This function get the
 // pure function name from the input parameter.
-static char* GetFunctionNameFromMixedName(const char* str, int length) {
+static std::string GetFunctionNameFromMixedName(const char* str, int length) {
   int index = 0;
   int count = 0;
   char* start_ptr = NULL;
@@ -144,7 +147,7 @@ static char* GetFunctionNameFromMixedName(const char* str, int length) {
   while (str[index++] != ':' && (index < length)) {}
 
   if (str[index] == '*' || str[index] == '~' ) index++;
-  if (index >= length) return NULL;
+  if (index >= length) return std::string();
 
   start_ptr = const_cast<char*>(str + index);
 
@@ -152,11 +155,7 @@ static char* GetFunctionNameFromMixedName(const char* str, int length) {
     count++;
   }
 
-  char* result = new char[count + 1];
-  memcpy(result, start_ptr, count);
-  result[count] = '\0';
-
-  return result;
+  return std::string(start_ptr, count);
 }
 
 // The JitCodeEventHandler for Vtune.
@@ -164,16 +163,16 @@ void VTUNEJITInterface::event_handler(const v8::JitCodeEvent* event) {
   if (VTUNERUNNING && event != NULL) {
     switch (event->type) {
       case v8::JitCodeEvent::CODE_ADDED: {
-        char* temp_file_name = NULL;
-        char* temp_method_name =
-            GetFunctionNameFromMixedName(event->name.str,
-                                         static_cast<int>(event->name.len));
+        std::unique_ptr<char[]> temp_file_name;
+        std::string temp_method_name = GetFunctionNameFromMixedName(
+            event->name.str, static_cast<int>(event->name.len));
+        std::vector<LineNumberInfo> jmethod_line_number_table;
         iJIT_Method_Load jmethod;
         memset(&jmethod, 0, sizeof jmethod);
         jmethod.method_id = iJIT_GetNewMethodID();
         jmethod.method_load_address = event->code_start;
         jmethod.method_size = static_cast<unsigned int>(event->code_len);
-        jmethod.method_name = temp_method_name;
+        jmethod.method_name = const_cast<char*>(temp_method_name.c_str());
 
         Local<UnboundScript> script = event->script;
 
@@ -182,10 +181,10 @@ void VTUNEJITInterface::event_handler(const v8::JitCodeEvent* event) {
           if ((*script->GetScriptName())->IsString()) {
             Local<String> script_name =
                 Local<String>::Cast(script->GetScriptName());
-            temp_file_name =
-                new char[script_name->Utf8Length(event->isolate) + 1];
-            script_name->WriteUtf8(event->isolate, temp_file_name);
-            jmethod.source_file_name = temp_file_name;
+            temp_file_name.reset(
+                new char[script_name->Utf8Length(event->isolate) + 1]);
+            script_name->WriteUtf8(event->isolate, temp_file_name.get());
+            jmethod.source_file_name = temp_file_name.get();
           }
 
           JitInfoMap::iterator entry =
@@ -197,9 +196,8 @@ void VTUNEJITInterface::event_handler(const v8::JitCodeEvent* event) {
                 line_info->GetLineNumInfo();
 
             jmethod.line_number_size = (unsigned int)vtunelineinfo->size();
-            jmethod.line_number_table =
-                reinterpret_cast<LineNumberInfo*>(
-                    malloc(sizeof(LineNumberInfo)*jmethod.line_number_size));
+            jmethod_line_number_table.resize(jmethod.line_number_size);
+            jmethod.line_number_table = jmethod_line_number_table.data();
 
             std::list<JITCodeLineInfo::LineNumInfo>::iterator Iter;
             int index = 0;
@@ -213,14 +211,33 @@ void VTUNEJITInterface::event_handler(const v8::JitCodeEvent* event) {
             }
             GetEntries()->erase(event->code_start);
           }
+        } else if (event->wasm_source_info != nullptr) {
+          const char* filename = event->wasm_source_info->filename;
+          size_t filename_size = event->wasm_source_info->filename_size;
+          const v8::JitCodeEvent::line_info_t* line_number_table =
+              event->wasm_source_info->line_number_table;
+          size_t line_number_table_size =
+              event->wasm_source_info->line_number_table_size;
+
+          temp_file_name.reset(new char[filename_size + 1]);
+          memcpy(temp_file_name.get(), filename, filename_size);
+          temp_file_name[filename_size] = '\0';
+          jmethod.source_file_name = temp_file_name.get();
+
+          jmethod.line_number_size = line_number_table_size;
+          jmethod_line_number_table.resize(jmethod.line_number_size);
+          jmethod.line_number_table = jmethod_line_number_table.data();
+
+          for (size_t index = 0; index < line_number_table_size; ++index) {
+            jmethod.line_number_table[index].LineNumber =
+                line_number_table[index].pos;
+            jmethod.line_number_table[index].Offset =
+                line_number_table[index].offset;
+          }
         }
 
         iJIT_NotifyEvent(iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED,
                          reinterpret_cast<void*>(&jmethod));
-        if (temp_method_name)
-          delete []temp_method_name;
-        if (temp_file_name)
-          delete []temp_file_name;
         break;
       }
       // TODO(chunyang.dai@intel.com): code_move will be supported.
diff --git a/deps/v8/src/third_party/vtune/vtune-jit.h b/deps/v8/src/third_party/vtune/vtune-jit.h
index 15011bf05ea3b9..4e5af45c618731 100644
--- a/deps/v8/src/third_party/vtune/vtune-jit.h
+++ b/deps/v8/src/third_party/vtune/vtune-jit.h
@@ -58,8 +58,8 @@
 #ifndef VTUNE_VTUNE_JIT_H_
 #define VTUNE_VTUNE_JIT_H_
 
-#include "jitprofiling.h"
 #include "../../../include/v8.h"
+#include "third_party/ittapi/include/jitprofiling.h"
 
 #define VTUNERUNNING (iJIT_IsProfilingActive() == iJIT_SAMPLING_ON)
 
diff --git a/deps/v8/src/third_party/vtune/vtuneapi.cc b/deps/v8/src/third_party/vtune/vtuneapi.cc
new file mode 100644
index 00000000000000..b6f7b73d59a1d3
--- /dev/null
+++ b/deps/v8/src/third_party/vtune/vtuneapi.cc
@@ -0,0 +1,83 @@
+#include "vtuneapi.h"
+#ifdef _MSC_VER  // for msvc
+#include <cstdlib>
+#endif
+
+std::map<std::string, std::shared_ptr<VTuneDomain>> VTuneDomain::domains_;
+std::map<std::string, __itt_string_handle*> VTuneDomain::string_handlers_;
+
+std::shared_ptr<VTuneDomain> VTuneDomain::createDomain(
+    const char* domain_name) {
+  auto domain = getDomain(domain_name);
+
+  if (domain == nullptr) {
+#ifdef _MSC_VER  // for msvc
+    wchar_t buffer[255];
+    mbstowcs(buffer, domain_name, 255);
+    __itt_domain* itt_domain = __itt_domain_create(buffer);  // call api
+#else  // for clang and gcc
+    __itt_domain* itt_domain = __itt_domain_create(domain_name);  // call api
+#endif
+    if (itt_domain != NULL) {
+      std::string key(domain_name);
+      std::shared_ptr<VTuneDomain> value(new VTuneDomain(itt_domain));
+      domain = value;
+      domains_.insert(std::make_pair(key, value));
+    }
+  }
+
+  return domain;
+}
+
+void VTuneDomain::destroyDomain(const char* domain_name) {
+  auto it = domains_.find(domain_name);
+  if (it != domains_.end()) {
+    domains_.erase(it);
+  }
+}
+
+std::shared_ptr<VTuneDomain> VTuneDomain::getDomain(const char* domain_name) {
+  std::shared_ptr<VTuneDomain> result(nullptr);
+
+  auto it = domains_.find(domain_name);
+  if (it != domains_.end()) {
+    result = it->second;
+  }
+
+  return result;
+}
+
+__itt_string_handle* VTuneDomain::getString(const char* str) {
+  __itt_string_handle* result = NULL;
+
+  auto it = string_handlers_.find(str);
+  if (it != string_handlers_.end()) {
+    result = it->second;
+  } else {
+#ifdef _MSC_VER  // for msvc
+    wchar_t buffer[255];
+    mbstowcs(buffer, str, 255);
+    result = __itt_string_handle_create(buffer);  // call api
+#else                                             // for clang and gcc
+    result = __itt_string_handle_create(str);
+#endif
+    std::string key(str);
+    string_handlers_.insert(std::make_pair(key, result));
+  }
+
+  return result;
+}
+
+bool VTuneDomain::beginTask(const char* task_name) {
+  bool result = false;
+
+  __itt_string_handle* name = getString(task_name);
+  if (name != NULL) {
+    __itt_task_begin(domain_, __itt_null, __itt_null, name);
+    result = true;
+  }
+
+  return result;
+}
+
+void VTuneDomain::endTask() { __itt_task_end(domain_); }
diff --git a/deps/v8/src/third_party/vtune/vtuneapi.h b/deps/v8/src/third_party/vtune/vtuneapi.h
new file mode 100644
index 00000000000000..ee3addd943fb7d
--- /dev/null
+++ b/deps/v8/src/third_party/vtune/vtuneapi.h
@@ -0,0 +1,48 @@
+#ifndef __VTUNE_API_H__
+#define __VTUNE_API_H__
+
+#include <map>
+#include <memory>
+#include <string>
+#include "third_party/ittapi/include/ittnotify.h"
+
+class VTuneDomain {
+  /* factory method to create vtune domain */
+ public:
+  /* create vtune domain, domain_name should be unique, if there
+     already has a domain with same name, return false.
+   */
+  static std::shared_ptr<VTuneDomain> createDomain(const char* domain_name);
+
+  /* destory vtune domain*/
+  static void destroyDomain(const char* domain_name);
+
+  /* get a domain */
+  static std::shared_ptr<VTuneDomain> getDomain(const char* domain_name);
+
+  /* domain interface */
+ public:
+  /* start a task with name, if no task name or null, use "default_task_name"*/
+  bool beginTask(const char* task_name = "default_task_name");
+
+  /* end a task, if there is no stacked task, return false*/
+  void endTask();
+
+ public:
+  virtual ~VTuneDomain() {}
+
+ protected:
+  static __itt_string_handle* getString(const char* str);
+
+ protected:
+  VTuneDomain(__itt_domain* domain) { domain_ = domain; }
+
+ private:
+  static std::map<std::string, std::shared_ptr<VTuneDomain>> domains_;
+  static std::map<std::string, __itt_string_handle*> string_handlers_;
+
+ private:
+  __itt_domain* domain_;
+};
+
+#endif
diff --git a/deps/v8/src/torque/ast.h b/deps/v8/src/torque/ast.h
index fcbb02124d4d16..0b7cf7af9b8208 100644
--- a/deps/v8/src/torque/ast.h
+++ b/deps/v8/src/torque/ast.h
@@ -5,6 +5,7 @@
 #ifndef V8_TORQUE_AST_H_
 #define V8_TORQUE_AST_H_
 
+#include <algorithm>
 #include <iostream>
 #include <map>
 #include <memory>
@@ -66,12 +67,14 @@ namespace torque {
 #define AST_TYPE_DECLARATION_NODE_KIND_LIST(V) \
   V(AbstractTypeDeclaration)                   \
   V(TypeAliasDeclaration)                      \
+  V(BitFieldStructDeclaration)                 \
   V(ClassDeclaration)                          \
   V(StructDeclaration)
 
 #define AST_DECLARATION_NODE_KIND_LIST(V) \
   AST_TYPE_DECLARATION_NODE_KIND_LIST(V)  \
-  V(GenericDeclaration)                   \
+  V(GenericCallableDeclaration)           \
+  V(GenericTypeDeclaration)               \
   V(SpecializationDeclaration)            \
   V(ExternConstDeclaration)               \
   V(NamespaceDeclaration)                 \
@@ -182,6 +185,23 @@ struct NamespaceDeclaration : Declaration {
   std::string name;
 };
 
+struct EnumDescription {
+  SourcePosition pos;
+  std::string name;
+  std::string constexpr_generates;
+  bool is_open;
+  std::vector<std::string> entries;
+
+  EnumDescription(SourcePosition pos, std::string name,
+                  std::string constexpr_generates, bool is_open,
+                  std::vector<std::string> entries = {})
+      : pos(std::move(pos)),
+        name(std::move(name)),
+        constexpr_generates(std::move(constexpr_generates)),
+        is_open(is_open),
+        entries(std::move(entries)) {}
+};
+
 class Ast {
  public:
   Ast() {}
@@ -201,10 +221,26 @@ class Ast {
     declared_imports_[CurrentSourcePosition::Get().source].insert(import_id);
   }
 
+  void AddEnumDescription(EnumDescription description) {
+    std::string name = description.name;
+    DCHECK(!name.empty());
+    auto f = [&](const auto& d) { return d.name == name; };
+    USE(f);  // Suppress unused in release.
+    DCHECK_EQ(
+        std::find_if(enum_descriptions_.begin(), enum_descriptions_.end(), f),
+        enum_descriptions_.end());
+    enum_descriptions_.push_back(std::move(description));
+  }
+
+  std::vector<EnumDescription>& EnumDescriptions() {
+    return enum_descriptions_;
+  }
+
  private:
   std::vector<Declaration*> declarations_;
   std::vector<std::unique_ptr<AstNode>> nodes_;
   std::map<SourceId, std::set<SourceId>> declared_imports_;
+  std::vector<EnumDescription> enum_descriptions_;
 };
 
 static const char* const kThisParameterName = "this";
@@ -424,14 +460,14 @@ struct StringLiteralExpression : Expression {
 
 struct NumberLiteralExpression : Expression {
   DEFINE_AST_NODE_LEAF_BOILERPLATE(NumberLiteralExpression)
-  NumberLiteralExpression(SourcePosition pos, std::string name)
-      : Expression(kKind, pos), number(std::move(name)) {}
+  NumberLiteralExpression(SourcePosition pos, double number)
+      : Expression(kKind, pos), number(number) {}
 
   void VisitAllSubExpressions(VisitCallback callback) override {
     callback(this);
   }
 
-  std::string number;
+  double number;
 };
 
 struct ElementAccessExpression : LocationExpression {
@@ -838,6 +874,11 @@ struct StructFieldExpression {
   bool const_qualified;
 };
 
+struct BitFieldDeclaration {
+  NameAndTypeExpression name_and_type;
+  int num_bits;
+};
+
 enum class ConditionalAnnotationType {
   kPositive,
   kNegative,
@@ -848,14 +889,20 @@ struct ConditionalAnnotation {
   ConditionalAnnotationType type;
 };
 
+struct AnnotationParameter {
+  std::string string_value;
+  int int_value;
+  bool is_int;
+};
+
 struct Annotation {
   Identifier* name;
-  base::Optional<std::string> param;
+  base::Optional<AnnotationParameter> param;
 };
 
 struct ClassFieldExpression {
   NameAndTypeExpression name_and_type;
-  base::Optional<std::string> index;
+  base::Optional<Expression*> index;
   std::vector<ConditionalAnnotation> conditions;
   bool weak;
   bool const_qualified;
@@ -1017,18 +1064,45 @@ struct ConstDeclaration : Declaration {
   Expression* expression;
 };
 
-struct GenericDeclaration : Declaration {
-  DEFINE_AST_NODE_LEAF_BOILERPLATE(GenericDeclaration)
-  GenericDeclaration(SourcePosition pos,
-                     std::vector<Identifier*> generic_parameters,
-                     CallableDeclaration* declaration)
+struct GenericParameter {
+  Identifier* name;
+  base::Optional<TypeExpression*> constraint;
+};
+
+using GenericParameters = std::vector<GenericParameter>;
+
+// The AST re-shuffles generics from the concrete syntax:
+// Instead of the generic parameters being part of a normal declaration,
+// a declaration with generic parameters gets wrapped in a generic declaration,
+// which holds the generic parameters. This corresponds to how you write
+// templates in C++, with the template parameters coming before the declaration.
+
+struct GenericCallableDeclaration : Declaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(GenericCallableDeclaration)
+  GenericCallableDeclaration(SourcePosition pos,
+                             GenericParameters generic_parameters,
+                             CallableDeclaration* declaration)
       : Declaration(kKind, pos),
         generic_parameters(std::move(generic_parameters)),
         declaration(declaration) {}
-  std::vector<Identifier*> generic_parameters;
+
+  GenericParameters generic_parameters;
   CallableDeclaration* declaration;
 };
 
+struct GenericTypeDeclaration : Declaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(GenericTypeDeclaration)
+  GenericTypeDeclaration(SourcePosition pos,
+                         GenericParameters generic_parameters,
+                         TypeDeclaration* declaration)
+      : Declaration(kKind, pos),
+        generic_parameters(std::move(generic_parameters)),
+        declaration(declaration) {}
+
+  GenericParameters generic_parameters;
+  TypeDeclaration* declaration;
+};
+
 struct SpecializationDeclaration : CallableDeclaration {
   DEFINE_AST_NODE_LEAF_BOILERPLATE(SpecializationDeclaration)
   SpecializationDeclaration(SourcePosition pos, bool transitioning,
@@ -1061,19 +1135,28 @@ struct ExternConstDeclaration : Declaration {
 
 struct StructDeclaration : TypeDeclaration {
   DEFINE_AST_NODE_LEAF_BOILERPLATE(StructDeclaration)
-  StructDeclaration(SourcePosition pos, Identifier* name,
+  StructDeclaration(SourcePosition pos, StructFlags flags, Identifier* name,
                     std::vector<Declaration*> methods,
-                    std::vector<StructFieldExpression> fields,
-                    std::vector<Identifier*> generic_parameters)
+                    std::vector<StructFieldExpression> fields)
       : TypeDeclaration(kKind, pos, name),
+        flags(flags),
         methods(std::move(methods)),
-        fields(std::move(fields)),
-        generic_parameters(std::move(generic_parameters)) {}
+        fields(std::move(fields)) {}
+  StructFlags flags;
   std::vector<Declaration*> methods;
   std::vector<StructFieldExpression> fields;
-  std::vector<Identifier*> generic_parameters;
+};
 
-  bool IsGeneric() const { return !generic_parameters.empty(); }
+struct BitFieldStructDeclaration : TypeDeclaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(BitFieldStructDeclaration)
+  BitFieldStructDeclaration(SourcePosition pos, Identifier* name,
+                            TypeExpression* parent,
+                            std::vector<BitFieldDeclaration> fields)
+      : TypeDeclaration(kKind, pos, name),
+        parent(parent),
+        fields(std::move(fields)) {}
+  TypeExpression* parent;
+  std::vector<BitFieldDeclaration> fields;
 };
 
 struct ClassBody : AstNode {
@@ -1145,8 +1228,8 @@ DECLARE_CONTEXTUAL_VARIABLE(CurrentAst, Ast);
 
 template <class T, class... Args>
 T* MakeNode(Args... args) {
-  return CurrentAst::Get().AddNode(std::unique_ptr<T>(
-      new T(CurrentSourcePosition::Get(), std::move(args)...)));
+  return CurrentAst::Get().AddNode(
+      std::make_unique<T>(CurrentSourcePosition::Get(), std::move(args)...));
 }
 
 }  // namespace torque
diff --git a/deps/v8/src/torque/cfg.cc b/deps/v8/src/torque/cfg.cc
index 8ff3aec5d79566..9726cbfcb36fba 100644
--- a/deps/v8/src/torque/cfg.cc
+++ b/deps/v8/src/torque/cfg.cc
@@ -160,6 +160,55 @@ void CfgAssembler::DebugBreak() {
   Emit(AbortInstruction{AbortInstruction::Kind::kDebugBreak});
 }
 
+std::vector<std::size_t> CountBlockPredecessors(const ControlFlowGraph& cfg) {
+  std::vector<std::size_t> count(cfg.NumberOfBlockIds(), 0);
+  count[cfg.start()->id()] = 1;
+
+  for (const Block* block : cfg.blocks()) {
+    std::vector<Block*> successors;
+    for (const auto& instruction : block->instructions()) {
+      instruction->AppendSuccessorBlocks(&successors);
+    }
+    for (Block* successor : successors) {
+      DCHECK_LT(successor->id(), count.size());
+      ++count[successor->id()];
+    }
+  }
+
+  return count;
+}
+
+void CfgAssembler::OptimizeCfg() {
+  auto predecessor_count = CountBlockPredecessors(cfg_);
+
+  for (Block* block : cfg_.blocks()) {
+    if (cfg_.end() && *cfg_.end() == block) continue;
+    if (predecessor_count[block->id()] == 0) continue;
+
+    while (!block->instructions().empty()) {
+      const auto& instruction = block->instructions().back();
+      if (!instruction.Is<GotoInstruction>()) break;
+      Block* destination = instruction.Cast<GotoInstruction>().destination;
+      if (destination == block) break;
+      if (cfg_.end() && *cfg_.end() == destination) break;
+      DCHECK_GT(predecessor_count[destination->id()], 0);
+      if (predecessor_count[destination->id()] != 1) break;
+
+      DCHECK_GT(destination->instructions().size(), 0);
+      block->instructions().pop_back();
+      block->instructions().insert(block->instructions().end(),
+                                   destination->instructions().begin(),
+                                   destination->instructions().end());
+
+      --predecessor_count[destination->id()];
+      DCHECK_EQ(predecessor_count[destination->id()], 0);
+    }
+  }
+
+  cfg_.UnplaceBlockIf(
+      [&](Block* b) { return predecessor_count[b->id()] == 0; });
+}
+
 }  // namespace torque
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/torque/cfg.h b/deps/v8/src/torque/cfg.h
index 67b64bbc04a0d4..e75172c1e0619b 100644
--- a/deps/v8/src/torque/cfg.h
+++ b/deps/v8/src/torque/cfg.h
@@ -45,6 +45,7 @@ class Block {
     }
   }
 
+  std::vector<Instruction>& instructions() { return instructions_; }
   const std::vector<Instruction>& instructions() const { return instructions_; }
   bool IsComplete() const {
     return !instructions_.empty() && instructions_.back()->IsBlockTerminator();
@@ -74,6 +75,12 @@ class ControlFlowGraph {
     return &blocks_.back();
   }
   void PlaceBlock(Block* block) { placed_blocks_.push_back(block); }
+  template <typename UnaryPredicate>
+  void UnplaceBlockIf(UnaryPredicate&& predicate) {
+    auto newEnd = std::remove_if(placed_blocks_.begin(), placed_blocks_.end(),
+                                 std::forward<UnaryPredicate>(predicate));
+    placed_blocks_.erase(newEnd, placed_blocks_.end());
+  }
   Block* start() const { return start_; }
   base::Optional<Block*> end() const { return end_; }
   void set_end(Block* end) { end_ = end; }
@@ -87,6 +94,7 @@ class ControlFlowGraph {
     }
   }
   const std::vector<Block*>& blocks() const { return placed_blocks_; }
+  size_t NumberOfBlockIds() const { return next_block_id_; }
 
  private:
   std::list<Block> blocks_;
@@ -106,6 +114,8 @@ class CfgAssembler {
     if (!CurrentBlockIsComplete()) {
       cfg_.set_end(current_block_);
     }
+    OptimizeCfg();
+    DCHECK(CfgIsComplete());
     return cfg_;
   }
 
@@ -116,6 +126,12 @@ class CfgAssembler {
   }
 
   bool CurrentBlockIsComplete() const { return current_block_->IsComplete(); }
+  bool CfgIsComplete() const {
+    return std::all_of(
+        cfg_.blocks().begin(), cfg_.blocks().end(), [this](Block* block) {
+          return (cfg_.end() && *cfg_.end() == block) || block->IsComplete();
+        });
+  }
 
   void Emit(Instruction instruction) {
     instruction.TypeInstruction(&current_stack_, &cfg_);
@@ -150,6 +166,7 @@ class CfgAssembler {
   void DebugBreak();
 
   void PrintCurrentStack(std::ostream& s) { s << "stack: " << current_stack_; }
+  void OptimizeCfg();
 
  private:
   friend class CfgAssemblerScopedTemporaryBlock;
diff --git a/deps/v8/src/torque/class-debug-reader-generator.cc b/deps/v8/src/torque/class-debug-reader-generator.cc
index fca24099596c1d..e4f9ddcd607117 100644
--- a/deps/v8/src/torque/class-debug-reader-generator.cc
+++ b/deps/v8/src/torque/class-debug-reader-generator.cc
@@ -10,7 +10,7 @@ namespace v8 {
 namespace internal {
 namespace torque {
 
-const char* tq_object_override_decls =
+constexpr char kTqObjectOverrideDecls[] =
     R"(  std::vector<std::unique_ptr<ObjectProperty>> GetProperties(
       d::MemoryAccessor accessor) const override;
   const char* GetName() const override;
@@ -18,9 +18,404 @@ const char* tq_object_override_decls =
   bool IsSuperclassOf(const TqObject* other) const override;
 )";
 
+constexpr char kObjectClassListDefinition[] = R"(
+const d::ClassList kObjectClassList {
+  sizeof(kObjectClassNames) / sizeof(const char*),
+  kObjectClassNames,
+};
+)";
+
 namespace {
+enum TypeStorage {
+  kAsStoredInHeap,
+  kUncompressed,
+};
+
+// An iterator for use in ValueTypeFieldsRange.
+class ValueTypeFieldIterator {
+ public:
+  ValueTypeFieldIterator(const Type* type, size_t index)
+      : type_(type), index_(index) {}
+  struct Result {
+    NameAndType name_and_type;
+    SourcePosition pos;
+    size_t offset_bytes;
+    int num_bits;
+    int shift_bits;
+  };
+  const Result operator*() const {
+    if (const StructType* struct_type = StructType::DynamicCast(type_)) {
+      const auto& field = struct_type->fields()[index_];
+      return {field.name_and_type, field.pos, *field.offset, 0, 0};
+    }
+    if (const BitFieldStructType* bit_field_struct_type =
+            BitFieldStructType::DynamicCast(type_)) {
+      const auto& field = bit_field_struct_type->fields()[index_];
+      return {field.name_and_type, field.pos, 0, field.num_bits, field.offset};
+    }
+    UNREACHABLE();
+  }
+  ValueTypeFieldIterator& operator++() {
+    ++index_;
+    return *this;
+  }
+  bool operator==(const ValueTypeFieldIterator& other) const {
+    return type_ == other.type_ && index_ == other.index_;
+  }
+  bool operator!=(const ValueTypeFieldIterator& other) const {
+    return !(*this == other);
+  }
+
+ private:
+  const Type* type_;
+  size_t index_;
+};
+
+// A way to iterate over the fields of structs or bitfield structs. For other
+// types, the iterators returned from begin() and end() are immediately equal.
+class ValueTypeFieldsRange {
+ public:
+  explicit ValueTypeFieldsRange(const Type* type) : type_(type) {}
+  ValueTypeFieldIterator begin() { return {type_, 0}; }
+  ValueTypeFieldIterator end() {
+    size_t index = 0;
+    const StructType* struct_type = StructType::DynamicCast(type_);
+    if (struct_type && struct_type != TypeOracle::GetFloat64OrHoleType()) {
+      index = struct_type->fields().size();
+    }
+    if (const BitFieldStructType* bit_field_struct_type =
+            BitFieldStructType::DynamicCast(type_)) {
+      index = bit_field_struct_type->fields().size();
+    }
+    return {type_, index};
+  }
+
+ private:
+  const Type* type_;
+};
+
+// A convenient way to keep track of several different ways that we might need
+// to represent a field's type in the generated C++.
+class DebugFieldType {
+ public:
+  explicit DebugFieldType(const Field& field)
+      : name_and_type_(field.name_and_type), pos_(field.pos) {}
+  DebugFieldType(const NameAndType& name_and_type, const SourcePosition& pos)
+      : name_and_type_(name_and_type), pos_(pos) {}
+
+  bool IsTagged() const {
+    return name_and_type_.type->IsSubtypeOf(TypeOracle::GetTaggedType());
+  }
+
+  // Returns the type that should be used for this field's value within code
+  // that is compiled as part of the debug helper library. In particular, this
+  // simplifies any tagged type to a plain uintptr_t because the debug helper
+  // compiles without most of the V8 runtime code.
+  std::string GetValueType(TypeStorage storage) const {
+    if (IsTagged()) {
+      return storage == kAsStoredInHeap ? "i::Tagged_t" : "uintptr_t";
+    }
+    // Note that we need constexpr names to resolve correctly in the global
+    // namespace, because we're passing them as strings to a debugging
+    // extension. We can verify this during build of the debug helper, because
+    // we use this type for a local variable below, and generate this code in
+    // a disjoint namespace. However, we can't emit a useful error at this
+    // point. Instead we'll emit a comment that might be helpful.
+    return GetOriginalType(storage) +
+           " /*Failing? Ensure constexpr type name is fully qualified and "
+           "necessary #includes are in debug-helper-internal.h*/";
+  }
+
+  // Returns the type that should be used to represent a field's type to
+  // debugging tools that have full V8 symbols. The types returned from this
+  // method are fully qualified and may refer to object types that are not
+  // included in the compilation of the debug helper library.
+  std::string GetOriginalType(TypeStorage storage) const {
+    if (name_and_type_.type->IsStructType()) {
+      // There's no meaningful type we could use here, because the V8 symbols
+      // don't have any definition of a C++ struct matching this struct type.
+      return "";
+    }
+    if (IsTagged()) {
+      if (storage == kAsStoredInHeap &&
+          TargetArchitecture::ArePointersCompressed()) {
+        return "v8::internal::TaggedValue";
+      }
+      base::Optional<const ClassType*> field_class_type =
+          name_and_type_.type->ClassSupertype();
+      return "v8::internal::" +
+             (field_class_type.has_value()
+                  ? (*field_class_type)->GetGeneratedTNodeTypeName()
+                  : "Object");
+    }
+    return name_and_type_.type->GetConstexprGeneratedTypeName();
+  }
+
+  // Returns the field's size in bytes.
+  size_t GetSize() const {
+    auto opt_size = SizeOf(name_and_type_.type);
+    if (!opt_size.has_value()) {
+      Error("Size required for type ", name_and_type_.type->ToString())
+          .Position(pos_);
+      return 0;
+    }
+    return std::get<0>(*opt_size);
+  }
+
+  // Returns the name of the function for getting this field's address.
+  std::string GetAddressGetter() {
+    return "Get" + CamelifyString(name_and_type_.name) + "Address";
+  }
+
+ private:
+  NameAndType name_and_type_;
+  SourcePosition pos_;
+};
+
+// Emits a function to get the address of a field within a class, based on the
+// member variable {address_}, which is a tagged pointer. Example
+// implementation:
+//
+// uintptr_t TqFixedArray::GetObjectsAddress() const {
+//   return address_ - i::kHeapObjectTag + 16;
+// }
+void GenerateFieldAddressAccessor(const Field& field,
+                                  const std::string& class_name,
+                                  std::ostream& h_contents,
+                                  std::ostream& cc_contents) {
+  DebugFieldType debug_field_type(field);
+
+  const std::string address_getter = debug_field_type.GetAddressGetter();
+
+  h_contents << "  uintptr_t " << address_getter << "() const;\n";
+  cc_contents << "\nuintptr_t Tq" << class_name << "::" << address_getter
+              << "() const {\n";
+  cc_contents << "  return address_ - i::kHeapObjectTag + " << *field.offset
+              << ";\n";
+  cc_contents << "}\n";
+}
+
+// Emits a function to get the value of a field, or the value from an indexed
+// position within an array field, based on the member variable {address_},
+// which is a tagged pointer, and the parameter {accessor}, a function pointer
+// that allows for fetching memory from the debuggee. The returned result
+// includes both a "validity", indicating whether the memory could be fetched,
+// and the fetched value. If the field contains tagged data, then these
+// functions call EnsureDecompressed to expand compressed data. Example:
+//
+// Value<uintptr_t> TqMap::GetPrototypeValue(d::MemoryAccessor accessor) const {
+//   i::Tagged_t value{};
+//   d::MemoryAccessResult validity = accessor(
+//       GetPrototypeAddress(),
+//       reinterpret_cast<uint8_t*>(&value),
+//       sizeof(value));
+//   return {validity, EnsureDecompressed(value, address_)};
+// }
+//
+// For array fields, an offset parameter is included. Example:
+//
+// Value<uintptr_t> TqFixedArray::GetObjectsValue(d::MemoryAccessor accessor,
+//                                                size_t offset) const {
+//   i::Tagged_t value{};
+//   d::MemoryAccessResult validity = accessor(
+//       GetObjectsAddress() + offset * sizeof(value),
+//       reinterpret_cast<uint8_t*>(&value),
+//       sizeof(value));
+//   return {validity, EnsureDecompressed(value, address_)};
+// }
+void GenerateFieldValueAccessor(const Field& field,
+                                const std::string& class_name,
+                                std::ostream& h_contents,
+                                std::ostream& cc_contents) {
+  // Currently not implemented for struct fields.
+  if (field.name_and_type.type->IsStructType()) return;
+
+  DebugFieldType debug_field_type(field);
+
+  const std::string address_getter = debug_field_type.GetAddressGetter();
+  const std::string field_getter =
+      "Get" + CamelifyString(field.name_and_type.name) + "Value";
+
+  std::string index_param;
+  std::string index_offset;
+  if (field.index) {
+    index_param = ", size_t offset";
+    index_offset = " + offset * sizeof(value)";
+  }
+
+  if (!field.name_and_type.type->IsStructType()) {
+    std::string field_value_type = debug_field_type.GetValueType(kUncompressed);
+    h_contents << "  Value<" << field_value_type << "> " << field_getter
+               << "(d::MemoryAccessor accessor " << index_param << ") const;\n";
+    cc_contents << "\nValue<" << field_value_type << "> Tq" << class_name
+                << "::" << field_getter << "(d::MemoryAccessor accessor"
+                << index_param << ") const {\n";
+    cc_contents << "  " << debug_field_type.GetValueType(kAsStoredInHeap)
+                << " value{};\n";
+    cc_contents << "  d::MemoryAccessResult validity = accessor("
+                << address_getter << "()" << index_offset
+                << ", reinterpret_cast<uint8_t*>(&value), sizeof(value));\n";
+    cc_contents << "  return {validity, "
+                << (debug_field_type.IsTagged()
+                        ? "EnsureDecompressed(value, address_)"
+                        : "value")
+                << "};\n";
+    cc_contents << "}\n";
+  }
+}
+
+// Emits a portion of the member function GetProperties that is responsible for
+// adding data about the current field to a result vector called "result".
+// Example output:
+//
+// std::vector<std::unique_ptr<StructProperty>> prototype_struct_field_list;
+// result.push_back(std::make_unique<ObjectProperty>(
+//     "prototype",                                     // Field name
+//     "v8::internal::HeapObject",                      // Field type
+//     "v8::internal::HeapObject",                      // Decompressed type
+//     GetPrototypeAddress(),                           // Field address
+//     1,                                               // Number of values
+//     8,                                               // Size of value
+//     std::move(prototype_struct_field_list),          // Struct fields
+//     d::PropertyKind::kSingle));                      // Field kind
+//
+// In builds with pointer compression enabled, the field type for tagged values
+// is "v8::internal::TaggedValue" (a four-byte class) and the decompressed type
+// is a normal Object subclass that describes the expanded eight-byte type.
+//
+// If the field is an array, then its length is fetched from the debuggee. This
+// could fail if the debuggee has incomplete memory, so the "validity" from that
+// fetch is used to determine the result PropertyKind, which will say whether
+// the array's length is known.
+//
+// If the field's type is a struct, then a local variable is created and filled
+// with descriptions of each of the struct's fields. The type and decompressed
+// type in the ObjectProperty are set to the empty string, to indicate to the
+// caller that the struct fields vector should be used instead.
+//
+// The following example is an array of structs, so it uses both of the optional
+// components described above:
+//
+// std::vector<std::unique_ptr<StructProperty>> descriptors_struct_field_list;
+// descriptors_struct_field_list.push_back(std::make_unique<StructProperty>(
+//     "key",                                // Struct field name
+//     "v8::internal::PrimitiveHeapObject",  // Struct field type
+//     "v8::internal::PrimitiveHeapObject",  // Struct field decompressed type
+//     0,                                    // Byte offset within struct data
+//     0,                                    // Bitfield size (0=not a bitfield)
+//     0));                                  // Bitfield shift
+// // The line above is repeated for other struct fields. Omitted here.
+// Value<uint16_t> indexed_field_count =
+//     GetNumberOfAllDescriptorsValue(accessor);  // Fetch the array length.
+// result.push_back(std::make_unique<ObjectProperty>(
+//     "descriptors",                                 // Field name
+//     "",                                            // Field type
+//     "",                                            // Decompressed type
+//     GetDescriptorsAddress(),                       // Field address
+//     indexed_field_count.value,                     // Number of values
+//     24,                                            // Size of value
+//     std::move(descriptors_struct_field_list),      // Struct fields
+//     GetArrayKind(indexed_field_count.validity)));  // Field kind
+void GenerateGetPropsChunkForField(const Field& field,
+                                   base::Optional<NameAndType> array_length,
+                                   std::ostream& get_props_impl) {
+  DebugFieldType debug_field_type(field);
+
+  // If the current field is a struct or bitfield struct, create a vector
+  // describing its fields. Otherwise this vector will be empty.
+  std::string struct_field_list =
+      field.name_and_type.name + "_struct_field_list";
+  get_props_impl << "  std::vector<std::unique_ptr<StructProperty>> "
+                 << struct_field_list << ";\n";
+  for (const auto& struct_field :
+       ValueTypeFieldsRange(field.name_and_type.type)) {
+    DebugFieldType struct_field_type(struct_field.name_and_type,
+                                     struct_field.pos);
+    get_props_impl << "  " << struct_field_list
+                   << ".push_back(std::make_unique<StructProperty>(\""
+                   << struct_field.name_and_type.name << "\", \""
+                   << struct_field_type.GetOriginalType(kAsStoredInHeap)
+                   << "\", \""
+                   << struct_field_type.GetOriginalType(kUncompressed) << "\", "
+                   << struct_field.offset_bytes << ", " << struct_field.num_bits
+                   << ", " << struct_field.shift_bits << "));\n";
+  }
+  struct_field_list = "std::move(" + struct_field_list + ")";
+
+  // The number of values and property kind for non-indexed properties:
+  std::string count_value = "1";
+  std::string property_kind = "d::PropertyKind::kSingle";
+
+  // If the field is indexed, emit a fetch of the array length, and change
+  // count_value and property_kind to be the correct values for an array.
+  if (array_length) {
+    const Type* index_type = array_length->type;
+    std::string index_type_name;
+    if (index_type == TypeOracle::GetSmiType()) {
+      index_type_name = "uintptr_t";
+      count_value =
+          "i::PlatformSmiTagging::SmiToInt(indexed_field_count.value)";
+    } else if (!index_type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
+      index_type_name = index_type->GetConstexprGeneratedTypeName();
+      count_value = "indexed_field_count.value";
+    } else {
+      Error("Unsupported index type: ", index_type);
+      return;
+    }
+    get_props_impl << "  Value<" << index_type_name
+                   << "> indexed_field_count = Get"
+                   << CamelifyString(array_length->name)
+                   << "Value(accessor);\n";
+    property_kind = "GetArrayKind(indexed_field_count.validity)";
+  }
+
+  get_props_impl << "  result.push_back(std::make_unique<ObjectProperty>(\""
+                 << field.name_and_type.name << "\", \""
+                 << debug_field_type.GetOriginalType(kAsStoredInHeap)
+                 << "\", \"" << debug_field_type.GetOriginalType(kUncompressed)
+                 << "\", " << debug_field_type.GetAddressGetter() << "(), "
+                 << count_value << ", " << debug_field_type.GetSize() << ", "
+                 << struct_field_list << ", " << property_kind << "));\n";
+}
+
+// For any Torque-defined class Foo, this function generates a class TqFoo which
+// allows for convenient inspection of objects of type Foo in a crash dump or
+// time travel session (where we can't just run the object printer). The
+// generated class looks something like this:
+//
+// class TqFoo : public TqParentOfFoo {
+//  public:
+//   // {address} is an uncompressed tagged pointer.
+//   inline TqFoo(uintptr_t address) : TqParentOfFoo(address) {}
+//
+//   // Creates and returns a list of this object's properties.
+//   std::vector<std::unique_ptr<ObjectProperty>> GetProperties(
+//       d::MemoryAccessor accessor) const override;
+//
+//   // Returns the name of this class, "v8::internal::Foo".
+//   const char* GetName() const override;
+//
+//   // Visitor pattern; implementation just calls visitor->VisitFoo(this).
+//   void Visit(TqObjectVisitor* visitor) const override;
+//
+//   // Returns whether Foo is a superclass of the other object's type.
+//   bool IsSuperclassOf(const TqObject* other) const override;
+//
+//   // Field accessors omitted here (see other comments above).
+// };
+//
+// Four output streams are written:
+//
+// h_contents:  A header file which gets the class definition above.
+// cc_contents: A cc file which gets implementations of that class's members.
+// visitor:     A stream that is accumulating the definition of the class
+//              TqObjectVisitor. Each class Foo gets its own virtual method
+//              VisitFoo in TqObjectVisitor.
+// class_names: A stream that is accumulating a list of strings including fully-
+//              qualified names for every Torque-defined class type.
 void GenerateClassDebugReader(const ClassType& type, std::ostream& h_contents,
                               std::ostream& cc_contents, std::ostream& visitor,
+                              std::ostream& class_names,
                               std::unordered_set<const ClassType*>* done) {
   // Make sure each class only gets generated once.
   if (!done->insert(&type).second) return;
@@ -30,7 +425,7 @@ void GenerateClassDebugReader(const ClassType& type, std::ostream& h_contents,
   // been emitted yet, go handle it first.
   if (super_type != nullptr) {
     GenerateClassDebugReader(*super_type, h_contents, cc_contents, visitor,
-                             done);
+                             class_names, done);
   }
 
   // Classes with undefined layout don't grant any particular value here and may
@@ -44,7 +439,7 @@ void GenerateClassDebugReader(const ClassType& type, std::ostream& h_contents,
   h_contents << " public:\n";
   h_contents << "  inline Tq" << name << "(uintptr_t address) : Tq"
              << super_name << "(address) {}\n";
-  h_contents << tq_object_override_decls;
+  h_contents << kTqObjectOverrideDecls;
 
   cc_contents << "\nconst char* Tq" << name << "::GetName() const {\n";
   cc_contents << "  return \"v8::internal::" << name << "\";\n";
@@ -62,130 +457,45 @@ void GenerateClassDebugReader(const ClassType& type, std::ostream& h_contents,
       << name << "*>(other) != nullptr;\n";
   cc_contents << "}\n";
 
+  // By default, the visitor method for this class just calls the visitor method
+  // for this class's parent. This allows custom visitors to only override a few
+  // classes they care about without needing to know about the entire hierarchy.
   visitor << "  virtual void Visit" << name << "(const Tq" << name
           << "* object) {\n";
   visitor << "    Visit" << super_name << "(object);\n";
   visitor << "  }\n";
 
+  class_names << "  \"v8::internal::" << name << "\",\n";
+
   std::stringstream get_props_impl;
 
   for (const Field& field : type.fields()) {
-    const Type* field_type = field.name_and_type.type;
-    if (field_type == TypeOracle::GetVoidType()) continue;
-    const std::string& field_name = field.name_and_type.name;
-    bool is_field_tagged = field_type->IsSubtypeOf(TypeOracle::GetTaggedType());
-    base::Optional<const ClassType*> field_class_type =
-        field_type->ClassSupertype();
-    size_t field_size = 0;
-    std::string field_size_string;
-    std::tie(field_size, field_size_string) = field.GetFieldSizeInformation();
-
-    std::string field_value_type;
-    std::string field_value_type_compressed;
-    std::string field_cc_type;
-    std::string field_cc_type_compressed;
-    if (is_field_tagged) {
-      field_value_type = "uintptr_t";
-      field_value_type_compressed = "i::Tagged_t";
-      field_cc_type = "v8::internal::" +
-                      (field_class_type.has_value()
-                           ? (*field_class_type)->GetGeneratedTNodeTypeName()
-                           : "Object");
-      field_cc_type_compressed =
-          COMPRESS_POINTERS_BOOL ? "v8::internal::TaggedValue" : field_cc_type;
-    } else {
-      const Type* constexpr_version = field_type->ConstexprVersion();
-      if (constexpr_version == nullptr) {
-        Error("Type '", field_type->ToString(),
-              "' requires a constexpr representation");
-        continue;
-      }
-      field_cc_type = constexpr_version->GetGeneratedTypeName();
-      field_cc_type_compressed = field_cc_type;
-      // Note that we need constexpr names to resolve correctly in the global
-      // namespace, because we're passing them as strings to a debugging
-      // extension. We can verify this during build of the debug helper, because
-      // we use this type for a local variable below, and generate this code in
-      // a disjoint namespace. However, we can't emit a useful error at this
-      // point. Instead we'll emit a comment that might be helpful.
-      field_value_type =
-          field_cc_type +
-          " /*Failing? Ensure constexpr type name is fully qualified and "
-          "necessary #includes are in debug-helper-internal.h*/";
-      field_value_type_compressed = field_value_type;
+    if (field.name_and_type.type == TypeOracle::GetVoidType()) continue;
+    if (!field.offset.has_value()) {
+      // Fields with dynamic offset are currently unsupported.
+      continue;
     }
-
-    const std::string field_getter =
-        "Get" + CamelifyString(field_name) + "Value";
-    const std::string address_getter =
-        "Get" + CamelifyString(field_name) + "Address";
-
-    std::string indexed_field_info;
-    std::string index_param;
-    std::string index_offset;
+    GenerateFieldAddressAccessor(field, name, h_contents, cc_contents);
+    GenerateFieldValueAccessor(field, name, h_contents, cc_contents);
+    base::Optional<NameAndType> array_length;
     if (field.index) {
-      const Type* index_type = field.index->type;
-      std::string index_type_name;
-      std::string index_value;
-      if (index_type == TypeOracle::GetSmiType()) {
-        index_type_name = "uintptr_t";
-        index_value =
-            "i::PlatformSmiTagging::SmiToInt(indexed_field_count.value)";
-      } else if (!index_type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
-        const Type* constexpr_index = index_type->ConstexprVersion();
-        if (constexpr_index == nullptr) {
-          Error("Type '", index_type->ToString(),
-                "' requires a constexpr representation");
-          continue;
-        }
-        index_type_name = constexpr_index->GetGeneratedTypeName();
-        index_value = "indexed_field_count.value";
-      } else {
-        Error("Unsupported index type: ", index_type);
+      array_length = ExtractSimpleFieldArraySize(type, *field.index);
+      if (!array_length) {
+        // Unsupported complex array length, skipping this field.
         continue;
       }
-      get_props_impl << "  Value<" << index_type_name
-                     << "> indexed_field_count = Get"
-                     << CamelifyString(field.index->name)
-                     << "Value(accessor);\n";
-      indexed_field_info =
-          ", " + index_value + ", GetArrayKind(indexed_field_count.validity)";
-      index_param = ", size_t offset";
-      index_offset = " + offset * sizeof(value)";
     }
-    get_props_impl << "  result.push_back(std::make_unique<ObjectProperty>(\""
-                   << field_name << "\", \"" << field_cc_type_compressed
-                   << "\", \"" << field_cc_type << "\", " << address_getter
-                   << "()" << indexed_field_info << "));\n";
-
-    h_contents << "  uintptr_t " << address_getter << "() const;\n";
-    h_contents << "  Value<" << field_value_type << "> " << field_getter
-               << "(d::MemoryAccessor accessor " << index_param << ") const;\n";
-    cc_contents << "\nuintptr_t Tq" << name << "::" << address_getter
-                << "() const {\n";
-    cc_contents << "  return address_ - i::kHeapObjectTag + " << field.offset
-                << ";\n";
-    cc_contents << "}\n";
-    cc_contents << "\nValue<" << field_value_type << "> Tq" << name
-                << "::" << field_getter << "(d::MemoryAccessor accessor"
-                << index_param << ") const {\n";
-    cc_contents << "  " << field_value_type_compressed << " value{};\n";
-    cc_contents << "  d::MemoryAccessResult validity = accessor("
-                << address_getter << "()" << index_offset
-                << ", reinterpret_cast<uint8_t*>(&value), sizeof(value));\n";
-    cc_contents << "  return {validity, "
-                << (is_field_tagged ? "EnsureDecompressed(value, address_)"
-                                    : "value")
-                << "};\n";
-    cc_contents << "}\n";
+    GenerateGetPropsChunkForField(field, array_length, get_props_impl);
   }
 
   h_contents << "};\n";
 
   cc_contents << "\nstd::vector<std::unique_ptr<ObjectProperty>> Tq" << name
               << "::GetProperties(d::MemoryAccessor accessor) const {\n";
+  // Start by getting the fields from the parent class.
   cc_contents << "  std::vector<std::unique_ptr<ObjectProperty>> result = Tq"
               << super_name << "::GetProperties(accessor);\n";
+  // Then add the fields from this class.
   cc_contents << get_props_impl.str();
   cc_contents << "  return result;\n";
   cc_contents << "}\n";
@@ -226,14 +536,22 @@ void ImplementationVisitor::GenerateClassDebugReaders(
     visitor << " public:\n";
     visitor << "  virtual void VisitObject(const TqObject* object) {}\n";
 
+    std::stringstream class_names;
+
     std::unordered_set<const ClassType*> done;
     for (const TypeAlias* alias : GlobalContext::GetClasses()) {
       const ClassType* type = ClassType::DynamicCast(alias->type());
-      GenerateClassDebugReader(*type, h_contents, cc_contents, visitor, &done);
+      GenerateClassDebugReader(*type, h_contents, cc_contents, visitor,
+                               class_names, &done);
     }
 
     visitor << "};\n";
     h_contents << visitor.str();
+
+    cc_contents << "\nconst char* kObjectClassNames[] {\n";
+    cc_contents << class_names.str();
+    cc_contents << "};\n";
+    cc_contents << kObjectClassListDefinition;
   }
   WriteFile(output_directory + "/" + file_name + ".h", h_contents.str());
   WriteFile(output_directory + "/" + file_name + ".cc", cc_contents.str());
diff --git a/deps/v8/src/torque/constants.h b/deps/v8/src/torque/constants.h
index ebfbab0cba5ccb..3559daaccd5845 100644
--- a/deps/v8/src/torque/constants.h
+++ b/deps/v8/src/torque/constants.h
@@ -24,6 +24,7 @@ static const char* const BOOL_TYPE_STRING = "bool";
 static const char* const VOID_TYPE_STRING = "void";
 static const char* const ARGUMENTS_TYPE_STRING = "Arguments";
 static const char* const CONTEXT_TYPE_STRING = "Context";
+static const char* const NATIVE_CONTEXT_TYPE_STRING = "NativeContext";
 static const char* const JS_FUNCTION_TYPE_STRING = "JSFunction";
 static const char* const MAP_TYPE_STRING = "Map";
 static const char* const OBJECT_TYPE_STRING = "Object";
@@ -32,7 +33,10 @@ static const char* const JSANY_TYPE_STRING = "JSAny";
 static const char* const JSOBJECT_TYPE_STRING = "JSObject";
 static const char* const SMI_TYPE_STRING = "Smi";
 static const char* const TAGGED_TYPE_STRING = "Tagged";
+static const char* const STRONG_TAGGED_TYPE_STRING = "StrongTagged";
 static const char* const UNINITIALIZED_TYPE_STRING = "Uninitialized";
+static const char* const UNINITIALIZED_HEAP_OBJECT_TYPE_STRING =
+    "UninitializedHeapObject";
 static const char* const RAWPTR_TYPE_STRING = "RawPtr";
 static const char* const CONST_STRING_TYPE_STRING = "constexpr string";
 static const char* const STRING_TYPE_STRING = "String";
@@ -40,26 +44,36 @@ static const char* const NUMBER_TYPE_STRING = "Number";
 static const char* const BUILTIN_POINTER_TYPE_STRING = "BuiltinPtr";
 static const char* const INTPTR_TYPE_STRING = "intptr";
 static const char* const UINTPTR_TYPE_STRING = "uintptr";
+static const char* const INT64_TYPE_STRING = "int64";
+static const char* const INT31_TYPE_STRING = "int31";
 static const char* const INT32_TYPE_STRING = "int32";
+static const char* const UINT31_TYPE_STRING = "uint31";
 static const char* const UINT32_TYPE_STRING = "uint32";
 static const char* const INT16_TYPE_STRING = "int16";
 static const char* const UINT16_TYPE_STRING = "uint16";
 static const char* const INT8_TYPE_STRING = "int8";
 static const char* const UINT8_TYPE_STRING = "uint8";
+static const char* const BINT_TYPE_STRING = "bint";
+static const char* const CHAR8_TYPE_STRING = "char8";
+static const char* const CHAR16_TYPE_STRING = "char16";
+static const char* const FLOAT32_TYPE_STRING = "float32";
 static const char* const FLOAT64_TYPE_STRING = "float64";
+static const char* const FLOAT64_OR_HOLE_TYPE_STRING = "float64_or_hole";
 static const char* const CONST_INT31_TYPE_STRING = "constexpr int31";
 static const char* const CONST_INT32_TYPE_STRING = "constexpr int32";
 static const char* const CONST_FLOAT64_TYPE_STRING = "constexpr float64";
 static const char* const TORQUE_INTERNAL_NAMESPACE_STRING = "torque_internal";
 static const char* const REFERENCE_TYPE_STRING = "Reference";
 static const char* const SLICE_TYPE_STRING = "Slice";
-static const char* const STRUCT_NAMESPACE_STRING = "_struct";
+static const char* const WEAK_TYPE_STRING = "Weak";
+static const char* const UNINITIALIZED_ITERATOR_TYPE_STRING =
+    "UninitializedIterator";
+static const char* const GENERIC_TYPE_INSTANTIATION_NAMESPACE_STRING =
+    "_generic_type_instantiation_namespace";
 
 static const char* const ANNOTATION_GENERATE_PRINT = "@generatePrint";
 static const char* const ANNOTATION_NO_VERIFIER = "@noVerifier";
 static const char* const ANNOTATION_ABSTRACT = "@abstract";
-static const char* const ANNOTATION_INSTANTIATED_ABSTRACT_CLASS =
-    "@dirtyInstantiatedAbstractClass";
 static const char* const ANNOTATION_HAS_SAME_INSTANCE_TYPE_AS_PARENT =
     "@hasSameInstanceTypeAsParent";
 static const char* const ANNOTATION_GENERATE_CPP_CLASS = "@generateCppClass";
@@ -89,6 +103,13 @@ inline std::string GetConstexprName(const std::string& name) {
   return CONSTEXPR_TYPE_PREFIX + name;
 }
 
+enum class AbstractTypeFlag {
+  kNone = 0,
+  kTransient = 1 << 0,
+  kConstexpr = 1 << 1
+};
+using AbstractTypeFlags = base::Flags<AbstractTypeFlag>;
+
 enum class ClassFlag {
   kNone = 0,
   kExtern = 1 << 0,
@@ -96,7 +117,7 @@ enum class ClassFlag {
   kGenerateVerify = 1 << 2,
   kTransient = 1 << 3,
   kAbstract = 1 << 4,
-  kInstantiatedAbstractClass = 1 << 5,
+  kIsShape = 1 << 5,
   kHasSameInstanceTypeAsParent = 1 << 6,
   kGenerateCppClassDefinitions = 1 << 7,
   kHasIndexedField = 1 << 8,
@@ -106,6 +127,9 @@ enum class ClassFlag {
 };
 using ClassFlags = base::Flags<ClassFlag>;
 
+enum class StructFlag { kNone = 0, kExport = 1 << 0 };
+using StructFlags = base::Flags<StructFlag>;
+
 }  // namespace torque
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/torque/contextual.h b/deps/v8/src/torque/contextual.h
index d7764bfa68db5f..9aea5bf2e3ebb2 100644
--- a/deps/v8/src/torque/contextual.h
+++ b/deps/v8/src/torque/contextual.h
@@ -70,7 +70,7 @@ class ContextualVariable {
 
  private:
   template <class T>
-  friend typename T::Scope*& ContextualVariableTop();
+  friend V8_EXPORT_PRIVATE typename T::Scope*& ContextualVariableTop();
   static Scope*& Top() { return ContextualVariableTop<Derived>(); }
 
   static bool HasScope() { return Top() != nullptr; }
diff --git a/deps/v8/src/torque/csa-generator.cc b/deps/v8/src/torque/csa-generator.cc
index 2a10e4f3530908..29e8e1dea2716a 100644
--- a/deps/v8/src/torque/csa-generator.cc
+++ b/deps/v8/src/torque/csa-generator.cc
@@ -68,7 +68,10 @@ void CSAGenerator::EmitSourcePosition(SourcePosition pos, bool always_emit) {
 
 void CSAGenerator::EmitInstruction(const Instruction& instruction,
                                    Stack<std::string>* stack) {
+#ifdef DEBUG
   EmitSourcePosition(instruction->pos);
+#endif
+
   switch (instruction.kind()) {
 #define ENUM_ITEM(T)          \
   case InstructionKind::k##T: \
@@ -195,14 +198,22 @@ void CSAGenerator::EmitInstruction(const CallIntrinsicInstruction& instruction,
     if (parameter_types.size() != 1) {
       ReportError("%RawDownCast must take a single parameter");
     }
-    if (!return_type->IsSubtypeOf(parameter_types[0])) {
+    const Type* original_type = parameter_types[0];
+    bool is_subtype =
+        return_type->IsSubtypeOf(original_type) ||
+        (original_type == TypeOracle::GetUninitializedHeapObjectType() &&
+         return_type->IsSubtypeOf(TypeOracle::GetHeapObjectType()));
+    if (!is_subtype) {
       ReportError("%RawDownCast error: ", *return_type, " is not a subtype of ",
-                  *parameter_types[0]);
+                  *original_type);
     }
-    if (return_type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
-      if (return_type->GetGeneratedTNodeTypeName() !=
-          parameter_types[0]->GetGeneratedTNodeTypeName()) {
+    if (return_type->GetGeneratedTNodeTypeName() !=
+        original_type->GetGeneratedTNodeTypeName()) {
+      if (return_type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
         out_ << "TORQUE_CAST";
+      } else {
+        out_ << "ca_.UncheckedCast<" << return_type->GetGeneratedTNodeTypeName()
+             << ">";
       }
     }
   } else if (instruction.intrinsic->ExternalName() == "%FromConstexpr") {
@@ -230,34 +241,18 @@ void CSAGenerator::EmitInstruction(const CallIntrinsicInstruction& instruction,
       out_ << "ca_.UintPtrConstant";
     } else if (return_type->IsSubtypeOf(TypeOracle::GetInt32Type())) {
       out_ << "ca_.Int32Constant";
+    } else if (return_type->IsSubtypeOf(TypeOracle::GetUint32Type())) {
+      out_ << "ca_.Uint32Constant";
+    } else if (return_type->IsSubtypeOf(TypeOracle::GetBoolType())) {
+      out_ << "ca_.BoolConstant";
     } else {
       std::stringstream s;
       s << "%FromConstexpr does not support return type " << *return_type;
       ReportError(s.str());
     }
-  } else if (instruction.intrinsic->ExternalName() ==
-             "%GetAllocationBaseSize") {
-    if (instruction.specialization_types.size() != 1) {
-      ReportError(
-          "incorrect number of specialization classes for "
-          "%GetAllocationBaseSize (should be one)");
-    }
-    const ClassType* class_type =
-        ClassType::cast(instruction.specialization_types[0]);
-    // Special case classes that may not always have a fixed size (e.g.
-    // JSObjects). Their size must be fetched from the map.
-    if (class_type != TypeOracle::GetJSObjectType()) {
-      out_ << "CodeStubAssembler(state_).IntPtrConstant((";
-      args[0] = std::to_string(class_type->size());
-    } else {
-      out_ << "CodeStubAssembler(state_).TimesTaggedSize(CodeStubAssembler("
-              "state_).LoadMapInstanceSizeInWords(";
-    }
-  } else if (instruction.intrinsic->ExternalName() == "%Allocate") {
-    out_ << "ca_.UncheckedCast<" << return_type->GetGeneratedTNodeTypeName()
-         << ">(CodeStubAssembler(state_).Allocate";
-  } else if (instruction.intrinsic->ExternalName() == "%GetStructMap") {
-    out_ << "CodeStubAssembler(state_).GetStructMap";
+    // Wrap the raw constexpr value in a static_cast to ensure that
+    // enums get properly casted to their backing integral value.
+    out_ << "(CastToUnderlyingTypeIfEnum";
   } else {
     ReportError("no built in intrinsic with name " +
                 instruction.intrinsic->ExternalName());
@@ -265,22 +260,14 @@ void CSAGenerator::EmitInstruction(const CallIntrinsicInstruction& instruction,
 
   out_ << "(";
   PrintCommaSeparatedList(out_, args);
-  if (instruction.intrinsic->ExternalName() == "%Allocate") out_ << ")";
-  if (instruction.intrinsic->ExternalName() == "%GetAllocationBaseSize")
-    out_ << "))";
+  if (instruction.intrinsic->ExternalName() == "%FromConstexpr") {
+    out_ << ")";
+  }
   if (return_type->IsStructType()) {
     out_ << ").Flatten();\n";
   } else {
     out_ << ");\n";
   }
-  if (instruction.intrinsic->ExternalName() == "%Allocate") {
-    out_ << "    CodeStubAssembler(state_).InitializeFieldsWithRoot("
-         << results[0] << ", ";
-    out_ << "CodeStubAssembler(state_).IntPtrConstant("
-         << std::to_string(ClassType::cast(return_type)->size()) << "), ";
-    PrintCommaSeparatedList(out_, args);
-    out_ << ", RootIndex::kUndefinedValue);\n";
-  }
 }
 
 void CSAGenerator::EmitInstruction(const CallCsaMacroInstruction& instruction,
@@ -701,26 +688,6 @@ void CSAGenerator::EmitInstruction(const UnsafeCastInstruction& instruction,
                   ">(" + stack->Top() + ")");
 }
 
-void CSAGenerator::EmitInstruction(
-    const CreateFieldReferenceInstruction& instruction,
-    Stack<std::string>* stack) {
-  base::Optional<const ClassType*> class_type =
-      instruction.type->ClassSupertype();
-  if (!class_type.has_value()) {
-    ReportError("Cannot create field reference of type ", instruction.type,
-                " which does not inherit from a class type");
-  }
-  const Field& field = class_type.value()->LookupField(instruction.field_name);
-  std::string offset_name = FreshNodeName();
-  stack->Push(offset_name);
-
-  out_ << "    TNode<IntPtrT> " << offset_name << " = ca_.IntPtrConstant(";
-  out_ << field.aggregate->GetGeneratedTNodeTypeName() << "::k"
-       << CamelifyString(field.name_and_type.name) << "Offset";
-  out_ << ");\n"
-       << "    USE(" << stack->Top() << ");\n";
-}
-
 void CSAGenerator::EmitInstruction(const LoadReferenceInstruction& instruction,
                                    Stack<std::string>* stack) {
   std::string result_name = FreshNodeName();
@@ -742,11 +709,74 @@ void CSAGenerator::EmitInstruction(const StoreReferenceInstruction& instruction,
   std::string offset = stack->Pop();
   std::string object = stack->Pop();
 
-  out_ << "    CodeStubAssembler(state_).StoreReference(CodeStubAssembler::"
+  out_ << "    CodeStubAssembler(state_).StoreReference<"
+       << instruction.type->GetGeneratedTNodeTypeName()
+       << ">(CodeStubAssembler::"
           "Reference{"
        << object << ", " << offset << "}, " << value << ");\n";
 }
 
+namespace {
+std::string GetBitFieldSpecialization(const BitFieldStructType* container,
+                                      const BitField& field) {
+  std::string suffix = field.num_bits == 1 ? "Bit" : "Bits";
+  return "TorqueGenerated" + container->name() +
+         "Fields::" + CamelifyString(field.name_and_type.name) + suffix;
+}
+}  // namespace
+
+void CSAGenerator::EmitInstruction(const LoadBitFieldInstruction& instruction,
+                                   Stack<std::string>* stack) {
+  std::string result_name = FreshNodeName();
+
+  std::string bit_field_struct = stack->Pop();
+  stack->Push(result_name);
+
+  const BitFieldStructType* source_type = instruction.bit_field_struct_type;
+  const Type* result_type = instruction.bit_field.name_and_type.type;
+  bool source_uintptr = source_type->IsSubtypeOf(TypeOracle::GetUIntPtrType());
+  bool result_uintptr = result_type->IsSubtypeOf(TypeOracle::GetUIntPtrType());
+  std::string source_word_type = source_uintptr ? "WordT" : "Word32T";
+  std::string decoder =
+      source_uintptr
+          ? (result_uintptr ? "DecodeWord" : "DecodeWord32FromWord")
+          : (result_uintptr ? "DecodeWordFromWord32" : "DecodeWord32");
+
+  out_ << "    " << result_type->GetGeneratedTypeName() << result_name
+       << " = ca_.UncheckedCast<" << result_type->GetGeneratedTNodeTypeName()
+       << ">(CodeStubAssembler(state_)." << decoder << "<"
+       << GetBitFieldSpecialization(source_type, instruction.bit_field)
+       << ">(ca_.UncheckedCast<" << source_word_type << ">(" << bit_field_struct
+       << ")));\n";
+}
+
+void CSAGenerator::EmitInstruction(const StoreBitFieldInstruction& instruction,
+                                   Stack<std::string>* stack) {
+  std::string result_name = FreshNodeName();
+
+  std::string value = stack->Pop();
+  std::string bit_field_struct = stack->Pop();
+  stack->Push(result_name);
+
+  const BitFieldStructType* struct_type = instruction.bit_field_struct_type;
+  const Type* field_type = instruction.bit_field.name_and_type.type;
+  bool struct_uintptr = struct_type->IsSubtypeOf(TypeOracle::GetUIntPtrType());
+  bool field_uintptr = field_type->IsSubtypeOf(TypeOracle::GetUIntPtrType());
+  std::string struct_word_type = struct_uintptr ? "WordT" : "Word32T";
+  std::string field_word_type = field_uintptr ? "UintPtrT" : "Uint32T";
+  std::string encoder =
+      struct_uintptr ? (field_uintptr ? "UpdateWord" : "UpdateWord32InWord")
+                     : (field_uintptr ? "UpdateWordInWord32" : "UpdateWord32");
+
+  out_ << "    " << struct_type->GetGeneratedTypeName() << result_name
+       << " = ca_.UncheckedCast<" << struct_type->GetGeneratedTNodeTypeName()
+       << ">(CodeStubAssembler(state_)." << encoder << "<"
+       << GetBitFieldSpecialization(struct_type, instruction.bit_field)
+       << ">(ca_.UncheckedCast<" << struct_word_type << ">(" << bit_field_struct
+       << "), ca_.UncheckedCast<" << field_word_type << ">(" << value
+       << ")));\n";
+}
+
 // static
 void CSAGenerator::EmitCSAValue(VisitResult result,
                                 const Stack<std::string>& values,
diff --git a/deps/v8/src/torque/declarable.cc b/deps/v8/src/torque/declarable.cc
index 5bcaff016d9287..7c370c97b3cd13 100644
--- a/deps/v8/src/torque/declarable.cc
+++ b/deps/v8/src/torque/declarable.cc
@@ -56,17 +56,62 @@ std::ostream& operator<<(std::ostream& os, const RuntimeFunction& b) {
   return os;
 }
 
-std::ostream& operator<<(std::ostream& os, const Generic& g) {
+std::ostream& operator<<(std::ostream& os, const GenericCallable& g) {
   os << "generic " << g.name() << "<";
-  PrintCommaSeparatedList(
-      os, g.generic_parameters(),
-      [](const Identifier* identifier) { return identifier->value; });
+  PrintCommaSeparatedList(os, g.generic_parameters(),
+                          [](const GenericParameter& identifier) {
+                            return identifier.name->value;
+                          });
   os << ">";
 
   return os;
 }
 
-TypeArgumentInference Generic::InferSpecializationTypes(
+SpecializationRequester::SpecializationRequester(SourcePosition position,
+                                                 Scope* scope, std::string name)
+    : position(position), name(std::move(name)) {
+  // Skip scopes that are not related to template specializations, they might be
+  // stack-allocated and not live for long enough.
+  while (scope && scope->GetSpecializationRequester().IsNone())
+    scope = scope->ParentScope();
+  this->scope = scope;
+}
+
+base::Optional<std::string> TypeConstraint::IsViolated(const Type* type) const {
+  if (upper_bound && !type->IsSubtypeOf(*upper_bound)) {
+    return {ToString("expected ", *type, " to be a subtype of ", *upper_bound)};
+  }
+  return base::nullopt;
+}
+
+base::Optional<std::string> FindConstraintViolation(
+    const std::vector<const Type*>& types,
+    const std::vector<TypeConstraint>& constraints) {
+  DCHECK_EQ(constraints.size(), types.size());
+  for (size_t i = 0; i < types.size(); ++i) {
+    if (auto violation = constraints[i].IsViolated(types[i])) {
+      return {"Could not instantiate generic, " + *violation + "."};
+    }
+  }
+  return base::nullopt;
+}
+
+std::vector<TypeConstraint> ComputeConstraints(
+    Scope* scope, const GenericParameters& parameters) {
+  CurrentScope::Scope scope_scope(scope);
+  std::vector<TypeConstraint> result;
+  for (const GenericParameter& parameter : parameters) {
+    if (parameter.constraint) {
+      result.push_back(TypeConstraint::SubtypeConstraint(
+          TypeVisitor::ComputeType(*parameter.constraint)));
+    } else {
+      result.push_back(TypeConstraint::Unconstrained());
+    }
+  }
+  return result;
+}
+
+TypeArgumentInference GenericCallable::InferSpecializationTypes(
     const TypeVector& explicit_specialization_types,
     const TypeVector& arguments) {
   size_t implicit_count = declaration()->parameters.implicit_count;
@@ -79,10 +124,16 @@ TypeArgumentInference Generic::InferSpecializationTypes(
   TypeArgumentInference inference(generic_parameters(),
                                   explicit_specialization_types,
                                   explicit_parameters, arguments);
+  if (!inference.HasFailed()) {
+    if (auto violation =
+            FindConstraintViolation(inference.GetResult(), Constraints())) {
+      inference.Fail(*violation);
+    }
+  }
   return inference;
 }
 
-base::Optional<Statement*> Generic::CallableBody() {
+base::Optional<Statement*> GenericCallable::CallableBody() {
   if (auto* decl = TorqueMacroDeclaration::DynamicCast(declaration())) {
     return decl->body;
   } else if (auto* decl =
diff --git a/deps/v8/src/torque/declarable.h b/deps/v8/src/torque/declarable.h
index 502180953d292c..fe9a522b18601c 100644
--- a/deps/v8/src/torque/declarable.h
+++ b/deps/v8/src/torque/declarable.h
@@ -50,8 +50,8 @@ class Declarable {
     kBuiltin,
     kRuntimeFunction,
     kIntrinsic,
-    kGeneric,
-    kGenericStructType,
+    kGenericCallable,
+    kGenericType,
     kTypeAlias,
     kExternConstant,
     kNamespaceConstant
@@ -65,8 +65,8 @@ class Declarable {
   bool IsIntrinsic() const { return kind() == kIntrinsic; }
   bool IsBuiltin() const { return kind() == kBuiltin; }
   bool IsRuntimeFunction() const { return kind() == kRuntimeFunction; }
-  bool IsGeneric() const { return kind() == kGeneric; }
-  bool IsGenericStructType() const { return kind() == kGenericStructType; }
+  bool IsGenericCallable() const { return kind() == kGenericCallable; }
+  bool IsGenericType() const { return kind() == kGenericType; }
   bool IsTypeAlias() const { return kind() == kTypeAlias; }
   bool IsExternConstant() const { return kind() == kExternConstant; }
   bool IsNamespaceConstant() const { return kind() == kNamespaceConstant; }
@@ -133,6 +133,30 @@ class Declarable {
     return static_cast<const x*>(declarable);                 \
   }
 
+// Information about what code caused a specialization to exist. This is used
+// for error reporting.
+struct SpecializationRequester {
+  // The position of the expression that caused this specialization.
+  SourcePosition position;
+  // The Scope which contains the expression that caused this specialization.
+  // It may in turn also be within a specialization, which allows us to print
+  // the stack of requesters when an error occurs.
+  Scope* scope;
+  // The name of the specialization.
+  std::string name;
+
+  static SpecializationRequester None() {
+    return {SourcePosition::Invalid(), nullptr, ""};
+  }
+
+  bool IsNone() const {
+    return position == SourcePosition::Invalid() && scope == nullptr &&
+           name == "";
+  }
+  SpecializationRequester(SourcePosition position, Scope* scope,
+                          std::string name);
+};
+
 class Scope : public Declarable {
  public:
   DECLARE_DECLARABLE_BOILERPLATE(Scope, scope)
@@ -174,8 +198,20 @@ class Scope : public Declarable {
     return declarable;
   }
 
+  const SpecializationRequester& GetSpecializationRequester() const {
+    return requester_;
+  }
+  void SetSpecializationRequester(const SpecializationRequester& requester) {
+    requester_ = requester;
+  }
+
  private:
   std::unordered_map<std::string, std::vector<Declarable*>> declarations_;
+
+  // If this Scope was created for specializing a generic type or callable,
+  // then {requester_} refers to the place that caused the specialization so we
+  // can construct useful error messages.
+  SpecializationRequester requester_ = SpecializationRequester::None();
 };
 
 class Namespace : public Scope {
@@ -446,19 +482,46 @@ class Intrinsic : public Callable {
   }
 };
 
-template <class T>
-class SpecializationMap {
+class TypeConstraint {
+ public:
+  base::Optional<std::string> IsViolated(const Type*) const;
+
+  static TypeConstraint Unconstrained() { return {}; }
+  static TypeConstraint SubtypeConstraint(const Type* upper_bound) {
+    TypeConstraint result;
+    result.upper_bound = {upper_bound};
+    return result;
+  }
+
  private:
-  using Map = std::unordered_map<TypeVector, T*, base::hash<TypeVector>>;
+  base::Optional<const Type*> upper_bound;
+};
 
- public:
-  SpecializationMap() {}
+base::Optional<std::string> FindConstraintViolation(
+    const std::vector<const Type*>& types,
+    const std::vector<TypeConstraint>& constraints);
+
+std::vector<TypeConstraint> ComputeConstraints(
+    Scope* scope, const GenericParameters& parameters);
 
-  void Add(const TypeVector& type_arguments, T* specialization) {
+template <class SpecializationType, class DeclarationType>
+class GenericDeclarable : public Declarable {
+ private:
+  using Map = std::unordered_map<TypeVector, SpecializationType,
+                                 base::hash<TypeVector>>;
+
+ public:
+  void AddSpecialization(const TypeVector& type_arguments,
+                         SpecializationType specialization) {
     DCHECK_EQ(0, specializations_.count(type_arguments));
+    if (auto violation =
+            FindConstraintViolation(type_arguments, Constraints())) {
+      Error(*violation).Throw();
+    }
     specializations_[type_arguments] = specialization;
   }
-  base::Optional<T*> Get(const TypeVector& type_arguments) const {
+  base::Optional<SpecializationType> GetSpecialization(
+      const TypeVector& type_arguments) const {
     auto it = specializations_.find(type_arguments);
     if (it != specializations_.end()) return it->second;
     return base::nullopt;
@@ -468,22 +531,38 @@ class SpecializationMap {
   iterator begin() const { return specializations_.begin(); }
   iterator end() const { return specializations_.end(); }
 
+  const std::string& name() const { return name_; }
+  auto declaration() const { return generic_declaration_->declaration; }
+  const GenericParameters& generic_parameters() const {
+    return generic_declaration_->generic_parameters;
+  }
+
+  const std::vector<TypeConstraint>& Constraints() {
+    if (!constraints_)
+      constraints_ = {ComputeConstraints(ParentScope(), generic_parameters())};
+    return *constraints_;
+  }
+
+ protected:
+  GenericDeclarable(Declarable::Kind kind, const std::string& name,
+                    DeclarationType generic_declaration)
+      : Declarable(kind),
+        name_(name),
+        generic_declaration_(generic_declaration) {
+    DCHECK(!generic_declaration->generic_parameters.empty());
+  }
+
  private:
+  std::string name_;
+  DeclarationType generic_declaration_;
   Map specializations_;
+  base::Optional<std::vector<TypeConstraint>> constraints_;
 };
 
-class Generic : public Declarable {
+class GenericCallable
+    : public GenericDeclarable<Callable*, GenericCallableDeclaration*> {
  public:
-  DECLARE_DECLARABLE_BOILERPLATE(Generic, generic)
-
-  const std::string& name() const { return name_; }
-  CallableDeclaration* declaration() const {
-    return generic_declaration_->declaration;
-  }
-  const std::vector<Identifier*> generic_parameters() const {
-    return generic_declaration_->generic_parameters;
-  }
-  SpecializationMap<Callable>& specializations() { return specializations_; }
+  DECLARE_DECLARABLE_BOILERPLATE(GenericCallable, generic_callable)
 
   base::Optional<Statement*> CallableBody();
 
@@ -493,40 +572,23 @@ class Generic : public Declarable {
 
  private:
   friend class Declarations;
-  Generic(const std::string& name, GenericDeclaration* generic_declaration)
-      : Declarable(Declarable::kGeneric),
-        name_(name),
-        generic_declaration_(generic_declaration) {}
-
-  std::string name_;
-  GenericDeclaration* generic_declaration_;
-  SpecializationMap<Callable> specializations_;
+  GenericCallable(const std::string& name,
+                  GenericCallableDeclaration* generic_declaration)
+      : GenericDeclarable<Callable*, GenericCallableDeclaration*>(
+            Declarable::kGenericCallable, name, generic_declaration) {}
 };
 
-class GenericStructType : public Declarable {
+class GenericType
+    : public GenericDeclarable<const Type*, GenericTypeDeclaration*> {
  public:
-  DECLARE_DECLARABLE_BOILERPLATE(GenericStructType, generic_type)
-  const std::string& name() const { return name_; }
-  StructDeclaration* declaration() const { return declaration_; }
-  const std::vector<Identifier*>& generic_parameters() const {
-    return declaration_->generic_parameters;
-  }
-  SpecializationMap<const StructType>& specializations() {
-    return specializations_;
-  }
+  DECLARE_DECLARABLE_BOILERPLATE(GenericType, generic_type)
 
  private:
   friend class Declarations;
-  GenericStructType(const std::string& name, StructDeclaration* declaration)
-      : Declarable(Declarable::kGenericStructType),
-        name_(name),
-        declaration_(declaration) {
-    DCHECK_GT(declaration->generic_parameters.size(), 0);
-  }
-
-  std::string name_;
-  StructDeclaration* declaration_;
-  SpecializationMap<const StructType> specializations_;
+  GenericType(const std::string& name,
+              GenericTypeDeclaration* generic_declaration)
+      : GenericDeclarable<const Type*, GenericTypeDeclaration*>(
+            Declarable::kGenericType, name, generic_declaration) {}
 };
 
 class TypeAlias : public Declarable {
@@ -572,7 +634,7 @@ class TypeAlias : public Declarable {
 std::ostream& operator<<(std::ostream& os, const Callable& m);
 std::ostream& operator<<(std::ostream& os, const Builtin& b);
 std::ostream& operator<<(std::ostream& os, const RuntimeFunction& b);
-std::ostream& operator<<(std::ostream& os, const Generic& g);
+std::ostream& operator<<(std::ostream& os, const GenericCallable& g);
 
 #undef DECLARE_DECLARABLE_BOILERPLATE
 
diff --git a/deps/v8/src/torque/declaration-visitor.cc b/deps/v8/src/torque/declaration-visitor.cc
index c2fa1af98e8264..32c566ce8a0387 100644
--- a/deps/v8/src/torque/declaration-visitor.cc
+++ b/deps/v8/src/torque/declaration-visitor.cc
@@ -6,6 +6,7 @@
 
 #include "src/torque/ast.h"
 #include "src/torque/server-data.h"
+#include "src/torque/type-inference.h"
 #include "src/torque/type-visitor.h"
 
 namespace v8 {
@@ -32,8 +33,11 @@ void PredeclarationVisitor::Predeclare(Declaration* decl) {
 #undef ENUM_ITEM
     case AstNode::Kind::kNamespaceDeclaration:
       return Predeclare(NamespaceDeclaration::cast(decl));
-    case AstNode::Kind::kGenericDeclaration:
-      return Predeclare(GenericDeclaration::cast(decl));
+    case AstNode::Kind::kGenericCallableDeclaration:
+      return Predeclare(GenericCallableDeclaration::cast(decl));
+    case AstNode::Kind::kGenericTypeDeclaration:
+      return Predeclare(GenericTypeDeclaration::cast(decl));
+
     default:
       // Only processes type declaration nodes, namespaces and generics.
       break;
@@ -77,8 +81,10 @@ Builtin* DeclarationVisitor::CreateBuiltin(BuiltinDeclaration* decl,
     for (size_t i = signature.implicit_count;
          i < signature.parameter_types.types.size(); ++i) {
       const Type* parameter_type = signature.parameter_types.types[i];
-      if (parameter_type != TypeOracle::GetJSAnyType()) {
-        Error("Parameters of JavaScript-linkage builtins have to be JSAny.")
+      if (!TypeOracle::GetJSAnyType()->IsSubtypeOf(parameter_type)) {
+        Error(
+            "Parameters of JavaScript-linkage builtins have to be a supertype "
+            "of JSAny.")
             .Position(decl->parameters.types[i]->pos);
       }
     }
@@ -113,8 +119,12 @@ void DeclarationVisitor::Visit(ExternalBuiltinDeclaration* decl) {
 
 void DeclarationVisitor::Visit(ExternalRuntimeDeclaration* decl) {
   Signature signature = TypeVisitor::MakeSignature(decl);
-  if (signature.parameter_types.types.size() == 0 ||
-      !(signature.parameter_types.types[0] == TypeOracle::GetContextType())) {
+  if (signature.parameter_types.types.size() == 0) {
+    ReportError(
+        "Missing parameters for runtime function, at least the context "
+        "parameter is required.");
+  }
+  if (!(signature.parameter_types.types[0] == TypeOracle::GetContextType())) {
     ReportError(
         "first parameter to runtime functions has to be the context and have "
         "type Context, but found type ",
@@ -172,15 +182,21 @@ void DeclarationVisitor::Visit(ConstDeclaration* decl) {
 }
 
 void DeclarationVisitor::Visit(SpecializationDeclaration* decl) {
-  std::vector<Generic*> generic_list =
+  std::vector<GenericCallable*> generic_list =
       Declarations::LookupGeneric(decl->name->value);
   // Find the matching generic specialization based on the concrete parameter
   // list.
-  Generic* matching_generic = nullptr;
+  GenericCallable* matching_generic = nullptr;
   Signature signature_with_types = TypeVisitor::MakeSignature(decl);
-  for (Generic* generic : generic_list) {
+  for (GenericCallable* generic : generic_list) {
+    // This argument inference is just to trigger constraint checking on the
+    // generic arguments.
+    TypeArgumentInference inference = generic->InferSpecializationTypes(
+        TypeVisitor::ComputeTypeVector(decl->generic_parameters),
+        signature_with_types.GetExplicitTypes());
+    if (inference.HasFailed()) continue;
     Signature generic_signature_with_types =
-        MakeSpecializedSignature(SpecializationKey<Generic>{
+        MakeSpecializedSignature(SpecializationKey<GenericCallable>{
             generic, TypeVisitor::ComputeTypeVector(decl->generic_parameters)});
     if (signature_with_types.HasSameTypesAs(generic_signature_with_types,
                                             ParameterMode::kIgnoreImplicit)) {
@@ -206,9 +222,9 @@ void DeclarationVisitor::Visit(SpecializationDeclaration* decl) {
     stream << "specialization signature:";
     stream << "\n  " << signature_with_types;
     stream << "\ncandidates are:";
-    for (Generic* generic : generic_list) {
+    for (GenericCallable* generic : generic_list) {
       stream << "\n  "
-             << MakeSpecializedSignature(SpecializationKey<Generic>{
+             << MakeSpecializedSignature(SpecializationKey<GenericCallable>{
                     generic,
                     TypeVisitor::ComputeTypeVector(decl->generic_parameters)});
     }
@@ -222,9 +238,9 @@ void DeclarationVisitor::Visit(SpecializationDeclaration* decl) {
 
   CallableDeclaration* generic_declaration = matching_generic->declaration();
 
-  Specialize(SpecializationKey<Generic>{matching_generic,
-                                        TypeVisitor::ComputeTypeVector(
-                                            decl->generic_parameters)},
+  Specialize(SpecializationKey<GenericCallable>{matching_generic,
+                                                TypeVisitor::ComputeTypeVector(
+                                                    decl->generic_parameters)},
              generic_declaration, decl, decl->body, decl->pos);
 }
 
@@ -245,7 +261,7 @@ void DeclarationVisitor::Visit(CppIncludeDeclaration* decl) {
 }
 
 void DeclarationVisitor::DeclareSpecializedTypes(
-    const SpecializationKey<Generic>& key) {
+    const SpecializationKey<GenericCallable>& key) {
   size_t i = 0;
   const std::size_t generic_parameter_count =
       key.generic->generic_parameters().size();
@@ -258,14 +274,14 @@ void DeclarationVisitor::DeclareSpecializedTypes(
   }
 
   for (auto type : key.specialized_types) {
-    Identifier* generic_type_name = key.generic->generic_parameters()[i++];
+    Identifier* generic_type_name = key.generic->generic_parameters()[i++].name;
     TypeAlias* alias = Declarations::DeclareType(generic_type_name, type);
     alias->SetIsUserDefined(false);
   }
 }
 
 Signature DeclarationVisitor::MakeSpecializedSignature(
-    const SpecializationKey<Generic>& key) {
+    const SpecializationKey<GenericCallable>& key) {
   CurrentScope::Scope generic_scope(key.generic->ParentScope());
   // Create a temporary fake-namespace just to temporarily declare the
   // specialization aliases for the generic types to create a signature.
@@ -276,7 +292,7 @@ Signature DeclarationVisitor::MakeSpecializedSignature(
 }
 
 Callable* DeclarationVisitor::SpecializeImplicit(
-    const SpecializationKey<Generic>& key) {
+    const SpecializationKey<GenericCallable>& key) {
   base::Optional<Statement*> body = key.generic->CallableBody();
   if (!body && IntrinsicDeclaration::DynamicCast(key.generic->declaration()) ==
                    nullptr) {
@@ -284,17 +300,22 @@ Callable* DeclarationVisitor::SpecializeImplicit(
                 " with types <", key.specialized_types, "> declared at ",
                 key.generic->Position());
   }
+  SpecializationRequester requester{CurrentSourcePosition::Get(),
+                                    CurrentScope::Get(), ""};
   CurrentScope::Scope generic_scope(key.generic->ParentScope());
   Callable* result = Specialize(key, key.generic->declaration(), base::nullopt,
                                 body, CurrentSourcePosition::Get());
   result->SetIsUserDefined(false);
+  requester.name = result->ReadableName();
+  result->SetSpecializationRequester(requester);
   CurrentScope::Scope callable_scope(result);
   DeclareSpecializedTypes(key);
   return result;
 }
 
 Callable* DeclarationVisitor::Specialize(
-    const SpecializationKey<Generic>& key, CallableDeclaration* declaration,
+    const SpecializationKey<GenericCallable>& key,
+    CallableDeclaration* declaration,
     base::Optional<const SpecializationDeclaration*> explicit_specialization,
     base::Optional<Statement*> body, SourcePosition position) {
   CurrentSourcePosition::Scope pos_scope(position);
@@ -308,7 +329,7 @@ Callable* DeclarationVisitor::Specialize(
            << std::to_string(generic_parameter_count) << ")";
     ReportError(stream.str());
   }
-  if (key.generic->specializations().Get(key.specialized_types)) {
+  if (key.generic->GetSpecialization(key.specialized_types)) {
     ReportError("cannot redeclare specialization of ", key.generic->name(),
                 " with types <", key.specialized_types, ">");
   }
@@ -339,10 +360,11 @@ Callable* DeclarationVisitor::Specialize(
         Declarations::CreateIntrinsic(declaration->name->value, type_signature);
   } else {
     BuiltinDeclaration* builtin = BuiltinDeclaration::cast(declaration);
-    callable = CreateBuiltin(builtin, generated_name, readable_name.str(),
-                             type_signature, *body);
+    callable =
+        CreateBuiltin(builtin, GlobalContext::MakeUniqueName(generated_name),
+                      readable_name.str(), type_signature, *body);
   }
-  key.generic->specializations().Add(key.specialized_types, callable);
+  key.generic->AddSpecialization(key.specialized_types, callable);
   return callable;
 }
 
diff --git a/deps/v8/src/torque/declaration-visitor.h b/deps/v8/src/torque/declaration-visitor.h
index 3a5201e24ac6d7..c91cbc0f1842f8 100644
--- a/deps/v8/src/torque/declaration-visitor.h
+++ b/deps/v8/src/torque/declaration-visitor.h
@@ -38,14 +38,15 @@ class PredeclarationVisitor {
     Declarations::PredeclareTypeAlias(decl->name, decl, false);
   }
   static void Predeclare(StructDeclaration* decl) {
-    if (decl->IsGeneric()) {
-      Declarations::DeclareGenericStructType(decl->name->value, decl);
-    } else {
-      Declarations::PredeclareTypeAlias(decl->name, decl, false);
-    }
+    Declarations::PredeclareTypeAlias(decl->name, decl, false);
+  }
+  static void Predeclare(GenericTypeDeclaration* generic_decl) {
+    Declarations::DeclareGenericType(generic_decl->declaration->name->value,
+                                     generic_decl);
   }
-  static void Predeclare(GenericDeclaration* decl) {
-    Declarations::DeclareGeneric(decl->declaration->name->value, decl);
+  static void Predeclare(GenericCallableDeclaration* generic_decl) {
+    Declarations::DeclareGenericCallable(generic_decl->declaration->name->value,
+                                         generic_decl);
   }
 };
 
@@ -67,9 +68,7 @@ class DeclarationVisitor {
     Declarations::LookupType(decl->name);
   }
   static void Visit(StructDeclaration* decl) {
-    if (!decl->IsGeneric()) {
-      Declarations::LookupType(decl->name);
-    }
+    Declarations::LookupType(decl->name);
   }
 
   static Builtin* CreateBuiltin(BuiltinDeclaration* decl,
@@ -85,7 +84,10 @@ class DeclarationVisitor {
   static void Visit(IntrinsicDeclaration* decl);
 
   static void Visit(ConstDeclaration* decl);
-  static void Visit(GenericDeclaration* decl) {
+  static void Visit(GenericCallableDeclaration* decl) {
+    // The PredeclarationVisitor already handled this case.
+  }
+  static void Visit(GenericTypeDeclaration* decl) {
     // The PredeclarationVisitor already handled this case.
   }
   static void Visit(SpecializationDeclaration* decl);
@@ -93,15 +95,18 @@ class DeclarationVisitor {
   static void Visit(CppIncludeDeclaration* decl);
 
   static Signature MakeSpecializedSignature(
-      const SpecializationKey<Generic>& key);
-  static Callable* SpecializeImplicit(const SpecializationKey<Generic>& key);
+      const SpecializationKey<GenericCallable>& key);
+  static Callable* SpecializeImplicit(
+      const SpecializationKey<GenericCallable>& key);
   static Callable* Specialize(
-      const SpecializationKey<Generic>& key, CallableDeclaration* declaration,
+      const SpecializationKey<GenericCallable>& key,
+      CallableDeclaration* declaration,
       base::Optional<const SpecializationDeclaration*> explicit_specialization,
       base::Optional<Statement*> body, SourcePosition position);
 
  private:
-  static void DeclareSpecializedTypes(const SpecializationKey<Generic>& key);
+  static void DeclareSpecializedTypes(
+      const SpecializationKey<GenericCallable>& key);
 };
 
 }  // namespace torque
diff --git a/deps/v8/src/torque/declarations.cc b/deps/v8/src/torque/declarations.cc
index ed4ad230444666..0a1d45a510b829 100644
--- a/deps/v8/src/torque/declarations.cc
+++ b/deps/v8/src/torque/declarations.cc
@@ -39,16 +39,16 @@ void CheckAlreadyDeclared(const std::string& name, const char* new_type) {
       FilterDeclarables<T>(Declarations::TryLookupShallow(QualifiedName(name)));
   if (!declarations.empty()) {
     Scope* scope = CurrentScope::Get();
-    ReportError("cannot redeclare ", name, " (type ", new_type, scope, ")");
+    ReportError("cannot redeclare ", name, " (type ", *new_type, scope, ")");
   }
 }
 
 }  // namespace
 
 std::vector<Declarable*> Declarations::LookupGlobalScope(
-    const std::string& name) {
+    const QualifiedName& name) {
   std::vector<Declarable*> d =
-      GlobalContext::GetDefaultNamespace()->Lookup(QualifiedName(name));
+      GlobalContext::GetDefaultNamespace()->Lookup(name);
   if (d.empty()) {
     std::stringstream s;
     s << "cannot find \"" << name << "\" in global scope";
@@ -76,7 +76,14 @@ const Type* Declarations::LookupType(const Identifier* name) {
   return alias->type();
 }
 
-const Type* Declarations::LookupGlobalType(const std::string& name) {
+base::Optional<const Type*> Declarations::TryLookupType(
+    const QualifiedName& name) {
+  auto decls = FilterDeclarables<TypeAlias>(TryLookup(name));
+  if (decls.empty()) return base::nullopt;
+  return EnsureUnique(std::move(decls), name, "type")->type();
+}
+
+const Type* Declarations::LookupGlobalType(const QualifiedName& name) {
   TypeAlias* declaration = EnsureUnique(
       FilterDeclarables<TypeAlias>(LookupGlobalScope(name)), name, "type");
   return declaration->type();
@@ -120,31 +127,39 @@ base::Optional<Builtin*> Declarations::TryLookupBuiltin(
   return EnsureUnique(builtins, name.name, "builtin");
 }
 
-std::vector<Generic*> Declarations::LookupGeneric(const std::string& name) {
-  return EnsureNonempty(FilterDeclarables<Generic>(Lookup(QualifiedName(name))),
-                        name, "generic");
+std::vector<GenericCallable*> Declarations::LookupGeneric(
+    const std::string& name) {
+  return EnsureNonempty(
+      FilterDeclarables<GenericCallable>(Lookup(QualifiedName(name))), name,
+      "generic callable");
 }
 
-Generic* Declarations::LookupUniqueGeneric(const QualifiedName& name) {
-  return EnsureUnique(FilterDeclarables<Generic>(Lookup(name)), name,
-                      "generic");
+GenericCallable* Declarations::LookupUniqueGeneric(const QualifiedName& name) {
+  return EnsureUnique(FilterDeclarables<GenericCallable>(Lookup(name)), name,
+                      "generic callable");
 }
 
-GenericStructType* Declarations::LookupUniqueGenericStructType(
-    const QualifiedName& name) {
-  return EnsureUnique(FilterDeclarables<GenericStructType>(Lookup(name)), name,
-                      "generic struct");
+GenericType* Declarations::LookupUniqueGenericType(const QualifiedName& name) {
+  return EnsureUnique(FilterDeclarables<GenericType>(Lookup(name)), name,
+                      "generic type");
+}
+
+GenericType* Declarations::LookupGlobalUniqueGenericType(
+    const std::string& name) {
+  return EnsureUnique(
+      FilterDeclarables<GenericType>(LookupGlobalScope(QualifiedName(name))),
+      name, "generic type");
 }
 
-base::Optional<GenericStructType*> Declarations::TryLookupGenericStructType(
+base::Optional<GenericType*> Declarations::TryLookupGenericType(
     const QualifiedName& name) {
-  std::vector<GenericStructType*> results = TryLookup<GenericStructType>(name);
+  std::vector<GenericType*> results = TryLookup<GenericType>(name);
   if (results.empty()) return base::nullopt;
-  return EnsureUnique(results, name.name, "generic struct");
+  return EnsureUnique(results, name.name, "generic type");
 }
 
 Namespace* Declarations::DeclareNamespace(const std::string& name) {
-  return Declare(name, std::unique_ptr<Namespace>(new Namespace(name)));
+  return Declare(name, std::make_unique<Namespace>(name));
 }
 
 TypeAlias* Declarations::DeclareType(const Identifier* name, const Type* type) {
@@ -168,9 +183,7 @@ TorqueMacro* Declarations::CreateTorqueMacro(std::string external_name,
                                              Signature signature,
                                              base::Optional<Statement*> body,
                                              bool is_user_defined) {
-  // TODO(tebbi): Switch to more predictable names to improve incremental
-  // compilation.
-  external_name += "_" + std::to_string(GlobalContext::FreshId());
+  external_name = GlobalContext::MakeUniqueName(external_name);
   return RegisterDeclarable(std::unique_ptr<TorqueMacro>(new TorqueMacro(
       std::move(external_name), std::move(readable_name), std::move(signature),
       body, is_user_defined, exported_to_csa)));
@@ -215,10 +228,10 @@ Macro* Declarations::DeclareMacro(
 Method* Declarations::CreateMethod(AggregateType* container_type,
                                    const std::string& name, Signature signature,
                                    Statement* body) {
-  std::string generated_name{container_type->GetGeneratedMethodName(name)};
-  Method* result = RegisterDeclarable(std::unique_ptr<Method>(
-      new Method(container_type, container_type->GetGeneratedMethodName(name),
-                 name, std::move(signature), body)));
+  std::string generated_name = GlobalContext::MakeUniqueName(
+      "Method_" + container_type->SimpleName() + "_" + name);
+  Method* result = RegisterDeclarable(std::unique_ptr<Method>(new Method(
+      container_type, generated_name, name, std::move(signature), body)));
   container_type->RegisterMethod(result);
   return result;
 }
@@ -266,39 +279,39 @@ RuntimeFunction* Declarations::DeclareRuntimeFunction(
 void Declarations::DeclareExternConstant(Identifier* name, const Type* type,
                                          std::string value) {
   CheckAlreadyDeclared<Value>(name->value, "constant");
-  ExternConstant* result = new ExternConstant(name, type, value);
-  Declare(name->value, std::unique_ptr<Declarable>(result));
+  Declare(name->value, std::unique_ptr<ExternConstant>(
+                           new ExternConstant(name, type, value)));
 }
 
 NamespaceConstant* Declarations::DeclareNamespaceConstant(Identifier* name,
                                                           const Type* type,
                                                           Expression* body) {
   CheckAlreadyDeclared<Value>(name->value, "constant");
-  std::string external_name =
-      name->value + "_" + std::to_string(GlobalContext::FreshId());
-  NamespaceConstant* result =
-      new NamespaceConstant(name, std::move(external_name), type, body);
-  Declare(name->value, std::unique_ptr<Declarable>(result));
+  std::string external_name = GlobalContext::MakeUniqueName(name->value);
+  std::unique_ptr<NamespaceConstant> namespaceConstant(
+      new NamespaceConstant(name, std::move(external_name), type, body));
+  NamespaceConstant* result = namespaceConstant.get();
+  Declare(name->value, std::move(namespaceConstant));
   return result;
 }
 
-Generic* Declarations::DeclareGeneric(const std::string& name,
-                                      GenericDeclaration* generic) {
-  return Declare(name, std::unique_ptr<Generic>(new Generic(name, generic)));
+GenericCallable* Declarations::DeclareGenericCallable(
+    const std::string& name, GenericCallableDeclaration* ast_node) {
+  return Declare(name, std::unique_ptr<GenericCallable>(
+                           new GenericCallable(name, ast_node)));
 }
 
-GenericStructType* Declarations::DeclareGenericStructType(
-    const std::string& name, StructDeclaration* decl) {
-  return Declare(name, std::unique_ptr<GenericStructType>(
-                           new GenericStructType(name, decl)));
+GenericType* Declarations::DeclareGenericType(
+    const std::string& name, GenericTypeDeclaration* ast_node) {
+  return Declare(name,
+                 std::unique_ptr<GenericType>(new GenericType(name, ast_node)));
 }
 
 std::string Declarations::GetGeneratedCallableName(
     const std::string& name, const TypeVector& specialized_types) {
   std::string result = name;
   for (auto type : specialized_types) {
-    std::string type_string = type->MangledName();
-    result += std::to_string(type_string.size()) + type_string;
+    result += "_" + type->SimpleName();
   }
   return result;
 }
diff --git a/deps/v8/src/torque/declarations.h b/deps/v8/src/torque/declarations.h
index f3d2544ae1c46c..d21e7563af312d 100644
--- a/deps/v8/src/torque/declarations.h
+++ b/deps/v8/src/torque/declarations.h
@@ -56,12 +56,13 @@ class Declarations {
     return d;
   }
 
-  static std::vector<Declarable*> LookupGlobalScope(const std::string& name);
+  static std::vector<Declarable*> LookupGlobalScope(const QualifiedName& name);
 
   static const TypeAlias* LookupTypeAlias(const QualifiedName& name);
   static const Type* LookupType(const QualifiedName& name);
   static const Type* LookupType(const Identifier* identifier);
-  static const Type* LookupGlobalType(const std::string& name);
+  static base::Optional<const Type*> TryLookupType(const QualifiedName& name);
+  static const Type* LookupGlobalType(const QualifiedName& name);
 
   static Builtin* FindSomeInternalBuiltinWithType(
       const BuiltinPointerType* type);
@@ -72,12 +73,12 @@ class Declarations {
                                const TypeVector& types);
   static base::Optional<Builtin*> TryLookupBuiltin(const QualifiedName& name);
 
-  static std::vector<Generic*> LookupGeneric(const std::string& name);
-  static Generic* LookupUniqueGeneric(const QualifiedName& name);
+  static std::vector<GenericCallable*> LookupGeneric(const std::string& name);
+  static GenericCallable* LookupUniqueGeneric(const QualifiedName& name);
 
-  static GenericStructType* LookupUniqueGenericStructType(
-      const QualifiedName& name);
-  static base::Optional<GenericStructType*> TryLookupGenericStructType(
+  static GenericType* LookupUniqueGenericType(const QualifiedName& name);
+  static GenericType* LookupGlobalUniqueGenericType(const std::string& name);
+  static base::Optional<GenericType*> TryLookupGenericType(
       const QualifiedName& name);
 
   static Namespace* DeclareNamespace(const std::string& name);
@@ -128,10 +129,10 @@ class Declarations {
                                                      const Type* type,
                                                      Expression* body);
 
-  static Generic* DeclareGeneric(const std::string& name,
-                                 GenericDeclaration* generic);
-  static GenericStructType* DeclareGenericStructType(const std::string& name,
-                                                     StructDeclaration* decl);
+  static GenericCallable* DeclareGenericCallable(
+      const std::string& name, GenericCallableDeclaration* ast_node);
+  static GenericType* DeclareGenericType(const std::string& name,
+                                         GenericTypeDeclaration* ast_node);
 
   template <class T>
   static T* Declare(const std::string& name, T* d) {
diff --git a/deps/v8/src/torque/earley-parser.h b/deps/v8/src/torque/earley-parser.h
index 43ad6eb4523725..81b75bdd7a12c4 100644
--- a/deps/v8/src/torque/earley-parser.h
+++ b/deps/v8/src/torque/earley-parser.h
@@ -43,6 +43,7 @@ class ParseResultHolderBase {
 enum class ParseResultHolderBase::TypeId {
   kStdString,
   kBool,
+  kInt32,
   kStdVectorOfString,
   kExpressionPtr,
   kIdentifierPtr,
@@ -59,12 +60,16 @@ enum class ParseResultHolderBase::TypeId {
   kNameAndExpression,
   kAnnotation,
   kVectorOfAnnotation,
+  kAnnotationParameter,
+  kOptionalAnnotationParameter,
   kClassFieldExpression,
   kStructFieldExpression,
+  kBitFieldDeclaration,
   kStdVectorOfNameAndTypeExpression,
   kStdVectorOfNameAndExpression,
   kStdVectorOfClassFieldExpression,
   kStdVectorOfStructFieldExpression,
+  kStdVectorOfBitFieldDeclaration,
   kIncrementDecrementOperator,
   kOptionalStdString,
   kStdVectorOfStatementPtr,
@@ -84,6 +89,8 @@ enum class ParseResultHolderBase::TypeId {
   kStdVectorOfTypeswitchCase,
   kStdVectorOfIdentifierPtr,
   kOptionalClassBody,
+  kGenericParameter,
+  kGenericParameters,
 
   kJsonValue,
   kJsonMember,
@@ -426,8 +433,9 @@ class Grammar {
   // NewSymbol() allocates a fresh symbol and stores it in the current grammar.
   // This is necessary to define helpers that create new symbols.
   Symbol* NewSymbol(std::initializer_list<Rule> rules = {}) {
-    Symbol* result = new Symbol(rules);
-    generated_symbols_.push_back(std::unique_ptr<Symbol>(result));
+    auto symbol = std::make_unique<Symbol>(rules);
+    Symbol* result = symbol.get();
+    generated_symbols_.push_back(std::move(symbol));
     return result;
   }
 
diff --git a/deps/v8/src/torque/global-context.h b/deps/v8/src/torque/global-context.h
index 940325b51aafff..bb84f9bdf4add4 100644
--- a/deps/v8/src/torque/global-context.h
+++ b/deps/v8/src/torque/global-context.h
@@ -45,9 +45,9 @@ class GlobalContext : public ContextualClass<GlobalContext> {
   static const GlobalClassList& GetClasses() { return Get().classes_; }
 
   static void AddCppInclude(std::string include_path) {
-    Get().cpp_includes_.push_back(std::move(include_path));
+    Get().cpp_includes_.insert(std::move(include_path));
   }
-  static const std::vector<std::string>& CppIncludes() {
+  static const std::set<std::string>& CppIncludes() {
     return Get().cpp_includes_;
   }
 
@@ -64,7 +64,9 @@ class GlobalContext : public ContextualClass<GlobalContext> {
     return Get().force_assert_statements_;
   }
   static Ast* ast() { return &Get().ast_; }
-  static size_t FreshId() { return Get().fresh_id_++; }
+  static std::string MakeUniqueName(const std::string& base) {
+    return base + "_" + std::to_string(Get().fresh_ids_[base]++);
+  }
 
   struct PerFileStreams {
     std::stringstream csa_headerfile;
@@ -80,10 +82,10 @@ class GlobalContext : public ContextualClass<GlobalContext> {
   Namespace* default_namespace_;
   Ast ast_;
   std::vector<std::unique_ptr<Declarable>> declarables_;
-  std::vector<std::string> cpp_includes_;
+  std::set<std::string> cpp_includes_;
   std::map<SourceId, PerFileStreams> generated_per_file_;
   GlobalClassList classes_;
-  size_t fresh_id_ = 0;
+  std::map<std::string, size_t> fresh_ids_;
 
   friend class LanguageServerData;
 };
@@ -97,12 +99,14 @@ class TargetArchitecture : public ContextualClass<TargetArchitecture> {
  public:
   explicit TargetArchitecture(bool force_32bit);
 
-  static int TaggedSize() { return Get().tagged_size_; }
-  static int RawPtrSize() { return Get().raw_ptr_size_; }
+  static size_t TaggedSize() { return Get().tagged_size_; }
+  static size_t RawPtrSize() { return Get().raw_ptr_size_; }
+  static size_t MaxHeapAlignment() { return TaggedSize(); }
+  static bool ArePointersCompressed() { return TaggedSize() < RawPtrSize(); }
 
  private:
-  const int tagged_size_;
-  const int raw_ptr_size_;
+  const size_t tagged_size_;
+  const size_t raw_ptr_size_;
 };
 
 }  // namespace torque
diff --git a/deps/v8/src/torque/implementation-visitor.cc b/deps/v8/src/torque/implementation-visitor.cc
index 0c50a7009903a4..73f704bcaa081a 100644
--- a/deps/v8/src/torque/implementation-visitor.cc
+++ b/deps/v8/src/torque/implementation-visitor.cc
@@ -74,6 +74,7 @@ void ImplementationVisitor::BeginCSAFiles() {
         UnderlinifyPath(SourceFileMap::PathFromV8Root(file)) + "_H_";
     header << "#ifndef " << headerDefine << "\n";
     header << "#define " << headerDefine << "\n\n";
+    header << "#include \"src/builtins/builtins-promise.h\"\n";
     header << "#include \"src/compiler/code-assembler.h\"\n";
     header << "#include \"src/codegen/code-stub-assembler.h\"\n";
     header << "#include \"src/utils/utils.h\"\n";
@@ -180,9 +181,8 @@ VisitResult ImplementationVisitor::InlineMacro(
   // than read operations.
   if (this_reference) {
     DCHECK(macro->IsMethod());
-    LocalValue this_value = LocalValue{!this_reference->IsVariableAccess(),
-                                       this_reference->GetVisitResult()};
-    parameter_bindings.Add(kThisParameterName, this_value, true);
+    parameter_bindings.Add(kThisParameterName, LocalValue{*this_reference},
+                           true);
   }
 
   size_t i = 0;
@@ -190,7 +190,10 @@ VisitResult ImplementationVisitor::InlineMacro(
     if (this_reference && i == signature.implicit_count) i++;
     const bool mark_as_used = signature.implicit_count > i;
     const Identifier* name = macro->parameter_names()[i++];
-    parameter_bindings.Add(name, LocalValue{true, arg}, mark_as_used);
+    parameter_bindings.Add(name,
+                           LocalValue{LocationReference::Temporary(
+                               arg, "parameter " + name->value)},
+                           mark_as_used);
   }
 
   DCHECK_EQ(label_blocks.size(), signature.labels.size());
@@ -391,8 +394,11 @@ std::string AddParameter(size_t i, Builtin* builtin,
   std::string external_name = "parameter" + std::to_string(i);
   parameters->Push(external_name);
   StackRange range = parameter_types->PushMany(LowerType(type));
-  parameter_bindings->Add(name, LocalValue{true, VisitResult(type, range)},
-                          mark_as_used);
+  parameter_bindings->Add(
+      name,
+      LocalValue{LocationReference::Temporary(VisitResult(type, range),
+                                              "parameter " + name->value)},
+      mark_as_used);
   return external_name;
 }
 
@@ -442,9 +448,11 @@ void ImplementationVisitor::Visit(Builtin* builtin) {
       parameters.Push("torque_arguments.length");
       const Type* arguments_type = TypeOracle::GetArgumentsType();
       StackRange range = parameter_types.PushMany(LowerType(arguments_type));
-      parameter_bindings.Add(
-          *signature.arguments_variable,
-          LocalValue{true, VisitResult(arguments_type, range)}, true);
+      parameter_bindings.Add(*signature.arguments_variable,
+                             LocalValue{LocationReference::Temporary(
+                                 VisitResult(arguments_type, range),
+                                 "parameter " + *signature.arguments_variable)},
+                             true);
     }
 
     for (size_t i = 0; i < signature.implicit_count; ++i) {
@@ -453,13 +461,14 @@ void ImplementationVisitor::Visit(Builtin* builtin) {
       std::string generated_name = AddParameter(
           i, builtin, &parameters, &parameter_types, &parameter_bindings, true);
       const Type* actual_type = signature.parameter_types.types[i];
-      const Type* expected_type;
+      std::vector<const Type*> expected_types;
       if (param_name == "context") {
-        source_out() << "  TNode<Context> " << generated_name
-                     << " = UncheckedCast<Context>(Parameter("
+        source_out() << "  TNode<NativeContext> " << generated_name
+                     << " = UncheckedCast<NativeContext>(Parameter("
                      << "Descriptor::kContext));\n";
         source_out() << "  USE(" << generated_name << ");\n";
-        expected_type = TypeOracle::GetContextType();
+        expected_types = {TypeOracle::GetNativeContextType(),
+                          TypeOracle::GetContextType()};
       } else if (param_name == "receiver") {
         source_out()
             << "  TNode<Object> " << generated_name << " = "
@@ -468,31 +477,32 @@ void ImplementationVisitor::Visit(Builtin* builtin) {
                     : "UncheckedCast<Object>(Parameter(Descriptor::kReceiver))")
             << ";\n";
         source_out() << "USE(" << generated_name << ");\n";
-        expected_type = TypeOracle::GetJSAnyType();
+        expected_types = {TypeOracle::GetJSAnyType()};
       } else if (param_name == "newTarget") {
         source_out() << "  TNode<Object> " << generated_name
                      << " = UncheckedCast<Object>(Parameter("
                      << "Descriptor::kJSNewTarget));\n";
         source_out() << "USE(" << generated_name << ");\n";
-        expected_type = TypeOracle::GetJSAnyType();
+        expected_types = {TypeOracle::GetJSAnyType()};
       } else if (param_name == "target") {
         source_out() << "  TNode<JSFunction> " << generated_name
                      << " = UncheckedCast<JSFunction>(Parameter("
                      << "Descriptor::kJSTarget));\n";
         source_out() << "USE(" << generated_name << ");\n";
-        expected_type = TypeOracle::GetJSFunctionType();
+        expected_types = {TypeOracle::GetJSFunctionType()};
       } else {
         Error(
             "Unexpected implicit parameter \"", param_name,
             "\" for JavaScript calling convention, "
             "expected \"context\", \"receiver\", \"target\", or \"newTarget\"")
             .Position(param_pos);
-        expected_type = actual_type;
+        expected_types = {actual_type};
       }
-      if (actual_type != expected_type) {
+      if (std::find(expected_types.begin(), expected_types.end(),
+                    actual_type) == expected_types.end()) {
         Error("According to JavaScript calling convention, expected parameter ",
-              param_name, " to have type ", *expected_type, " but found type ",
-              *actual_type)
+              param_name, " to have type ", PrintList(expected_types, " or "),
+              " but found type ", *actual_type)
             .Position(param_pos);
       }
     }
@@ -597,8 +607,11 @@ const Type* ImplementationVisitor::Visit(
     init_result =
         VisitResult(*type, assembler().TopRange(lowered_types.size()));
   }
-  block_bindings->Add(stmt->name,
-                      LocalValue{stmt->const_qualified, *init_result});
+  LocationReference ref = stmt->const_qualified
+                              ? LocationReference::Temporary(
+                                    *init_result, "const " + stmt->name->value)
+                              : LocationReference::VariableAccess(*init_result);
+  block_bindings->Add(stmt->name, LocalValue{std::move(ref)});
   return TypeOracle::GetVoidType();
 }
 
@@ -760,18 +773,16 @@ VisitResult ImplementationVisitor::Visit(AssignmentExpression* expr) {
 }
 
 VisitResult ImplementationVisitor::Visit(NumberLiteralExpression* expr) {
-  // TODO(tebbi): Do not silently loose precision; support 64bit literals.
-  double d = std::stod(expr->number.c_str());
-  int32_t i = static_cast<int32_t>(d);
+  int32_t i = static_cast<int32_t>(expr->number);
   const Type* result_type = TypeOracle::GetConstFloat64Type();
-  if (i == d) {
+  if (i == expr->number) {
     if ((i >> 30) == (i >> 31)) {
       result_type = TypeOracle::GetConstInt31Type();
     } else {
       result_type = TypeOracle::GetConstInt32Type();
     }
   }
-  return VisitResult{result_type, expr->number};
+  return VisitResult{result_type, ToString(expr->number)};
 }
 
 VisitResult ImplementationVisitor::Visit(AssumeTypeImpossibleExpression* expr) {
@@ -989,8 +1000,9 @@ namespace {
 std::string FormatAssertSource(const std::string& str) {
   // Replace all whitespace characters with a space character.
   std::string str_no_newlines = str;
-  std::replace_if(str_no_newlines.begin(), str_no_newlines.end(),
-                  [](unsigned char c) { return isspace(c); }, ' ');
+  std::replace_if(
+      str_no_newlines.begin(), str_no_newlines.end(),
+      [](unsigned char c) { return isspace(c); }, ' ');
 
   // str might include indentation, squash multiple space characters into one.
   std::string result;
@@ -1145,8 +1157,10 @@ VisitResult ImplementationVisitor::Visit(TryLabelExpression* expr) {
   {
     BlockBindings<LocalValue> parameter_bindings(&ValueBindingsManager::Get());
     for (size_t i = 0; i < parameter_count; ++i) {
-      parameter_bindings.Add(expr->label_block->parameters.names[i],
-                             LocalValue{true, parameters[i]});
+      Identifier* name = expr->label_block->parameters.names[i];
+      parameter_bindings.Add(name,
+                             LocalValue{LocationReference::Temporary(
+                                 parameters[i], "parameter " + name->value)});
     }
 
     label_result = Visit(expr->label_block->body);
@@ -1223,77 +1237,205 @@ InitializerResults ImplementationVisitor::VisitInitializerResults(
   return result;
 }
 
+LocationReference ImplementationVisitor::GenerateFieldReference(
+    VisitResult object, const Field& field, const ClassType* class_type) {
+  StackRange result_range = assembler().TopRange(0);
+  result_range.Extend(GenerateCopy(object).stack_range());
+  VisitResult offset;
+  if (field.offset.has_value()) {
+    offset =
+        VisitResult(TypeOracle::GetConstInt31Type(), ToString(*field.offset));
+    offset = GenerateImplicitConvert(TypeOracle::GetIntPtrType(), offset);
+  } else {
+    StackScope stack_scope(this);
+    for (const Field& f : class_type->ComputeAllFields()) {
+      if (f.offset) {
+        offset =
+            VisitResult(TypeOracle::GetConstInt31Type(), ToString(*f.offset));
+      }
+      if (f.name_and_type.name == field.name_and_type.name) break;
+      if (f.index) {
+        if (!offset.IsOnStack()) {
+          offset = GenerateImplicitConvert(TypeOracle::GetIntPtrType(), offset);
+        }
+        VisitResult array_length = GenerateArrayLength(object, f);
+        size_t element_size;
+        std::string element_size_string;
+        std::tie(element_size, element_size_string) =
+            *SizeOf(f.name_and_type.type);
+        VisitResult array_element_size =
+            VisitResult(TypeOracle::GetConstInt31Type(), element_size_string);
+        // In contrast to the code used for allocation, we don't need overflow
+        // checks here because we already know all the offsets fit into memory.
+        VisitResult array_size =
+            GenerateCall("*", {{array_length, array_element_size}, {}});
+        offset = GenerateCall("+", {{offset, array_size}, {}});
+      }
+    }
+    DCHECK(offset.IsOnStack());
+    offset = stack_scope.Yield(offset);
+  }
+  result_range.Extend(offset.stack_range());
+  if (field.index) {
+    VisitResult length = GenerateArrayLength(object, field);
+    result_range.Extend(length.stack_range());
+    const Type* slice_type = TypeOracle::GetSliceType(field.name_and_type.type);
+    return LocationReference::HeapSlice(VisitResult(slice_type, result_range));
+
+  } else {
+    VisitResult heap_reference(
+        TypeOracle::GetReferenceType(field.name_and_type.type), result_range);
+    return LocationReference::HeapReference(heap_reference);
+  }
+}
+
+// This is used to generate field references during initialization, where we can
+// re-use the offsets used for computing the allocation size.
+LocationReference ImplementationVisitor::GenerateFieldReference(
+    VisitResult object, const Field& field,
+    const LayoutForInitialization& layout) {
+  StackRange result_range = assembler().TopRange(0);
+  result_range.Extend(GenerateCopy(object).stack_range());
+  VisitResult offset = GenerateImplicitConvert(
+      TypeOracle::GetIntPtrType(), layout.offsets.at(field.name_and_type.name));
+  result_range.Extend(offset.stack_range());
+  if (field.index) {
+    VisitResult length =
+        GenerateCopy(layout.array_lengths.at(field.name_and_type.name));
+    result_range.Extend(length.stack_range());
+    const Type* slice_type = TypeOracle::GetSliceType(field.name_and_type.type);
+    return LocationReference::HeapSlice(VisitResult(slice_type, result_range));
+  } else {
+    VisitResult heap_reference(
+        TypeOracle::GetReferenceType(field.name_and_type.type), result_range);
+    return LocationReference::HeapReference(heap_reference);
+  }
+}
+
 void ImplementationVisitor::InitializeClass(
     const ClassType* class_type, VisitResult allocate_result,
-    const InitializerResults& initializer_results) {
+    const InitializerResults& initializer_results,
+    const LayoutForInitialization& layout) {
   if (const ClassType* super = class_type->GetSuperClass()) {
-    InitializeClass(super, allocate_result, initializer_results);
+    InitializeClass(super, allocate_result, initializer_results, layout);
   }
 
   for (Field f : class_type->fields()) {
-    VisitResult current_value =
+    VisitResult initializer_value =
         initializer_results.field_value_map.at(f.name_and_type.name);
+    LocationReference field =
+        GenerateFieldReference(allocate_result, f, layout);
     if (f.index) {
-      InitializeFieldFromSpread(allocate_result, f, initializer_results);
+      DCHECK(field.IsHeapSlice());
+      VisitResult slice = field.GetVisitResult();
+      GenerateCall(QualifiedName({TORQUE_INTERNAL_NAMESPACE_STRING},
+                                 "InitializeFieldsFromIterator"),
+                   {{slice, initializer_value}, {}});
     } else {
-      allocate_result.SetType(class_type);
-      GenerateCopy(allocate_result);
-      assembler().Emit(CreateFieldReferenceInstruction{
-          ClassType::cast(class_type), f.name_and_type.name});
-      VisitResult heap_reference(
-          TypeOracle::GetReferenceType(f.name_and_type.type),
-          assembler().TopRange(2));
-      GenerateAssignToLocation(LocationReference::HeapReference(heap_reference),
-                               current_value);
+      GenerateAssignToLocation(field, initializer_value);
     }
   }
 }
 
-void ImplementationVisitor::InitializeFieldFromSpread(
-    VisitResult object, const Field& field,
-    const InitializerResults& initializer_results) {
-  const NameAndType& index = *field.index;
-  VisitResult iterator =
-      initializer_results.field_value_map.at(field.name_and_type.name);
-  VisitResult length = initializer_results.field_value_map.at(index.name);
+VisitResult ImplementationVisitor::GenerateArrayLength(
+    Expression* array_length, Namespace* nspace,
+    const std::map<std::string, LocationReference>& bindings) {
+  StackScope stack_scope(this);
+  CurrentSourcePosition::Scope pos_scope(array_length->pos);
+  // Switch to the namespace where the class was declared.
+  CurrentScope::Scope current_scope_scope(nspace);
+  // Reset local bindings and install local binding for the preceding fields.
+  BindingsManagersScope bindings_managers_scope;
+  BlockBindings<LocalValue> field_bindings(&ValueBindingsManager::Get());
+  for (auto& p : bindings) {
+    field_bindings.Add(p.first, LocalValue{p.second}, true);
+  }
+  VisitResult length = Visit(array_length);
+  VisitResult converted_length =
+      GenerateCall("Convert", Arguments{{length}, {}},
+                   {TypeOracle::GetIntPtrType(), length.type()}, false);
+  return stack_scope.Yield(converted_length);
+}
+
+VisitResult ImplementationVisitor::GenerateArrayLength(VisitResult object,
+                                                       const Field& field) {
+  DCHECK(field.index);
 
-  Arguments assign_arguments;
-  assign_arguments.parameters.push_back(object);
-  assign_arguments.parameters.push_back(length);
-  assign_arguments.parameters.push_back(iterator);
-  GenerateCall("%InitializeFieldsFromIterator", assign_arguments,
-               {field.aggregate, index.type, iterator.type()});
+  StackScope stack_scope(this);
+  const ClassType* class_type = *object.type()->ClassSupertype();
+  std::map<std::string, LocationReference> bindings;
+  for (Field f : class_type->ComputeAllFields()) {
+    if (f.index) break;
+    bindings.insert(
+        {f.name_and_type.name, GenerateFieldReference(object, f, class_type)});
+  }
+  return stack_scope.Yield(
+      GenerateArrayLength(*field.index, class_type->nspace(), bindings));
 }
 
-VisitResult ImplementationVisitor::AddVariableObjectSize(
-    VisitResult object_size, const ClassType* current_class,
+VisitResult ImplementationVisitor::GenerateArrayLength(
+    const ClassType* class_type, const InitializerResults& initializer_results,
+    const Field& field) {
+  DCHECK(field.index);
+
+  StackScope stack_scope(this);
+  std::map<std::string, LocationReference> bindings;
+  for (Field f : class_type->ComputeAllFields()) {
+    if (f.index) break;
+    const std::string& fieldname = f.name_and_type.name;
+    VisitResult value = initializer_results.field_value_map.at(fieldname);
+    bindings.insert({fieldname, LocationReference::Temporary(
+                                    value, "initial field " + fieldname)});
+  }
+  return stack_scope.Yield(
+      GenerateArrayLength(*field.index, class_type->nspace(), bindings));
+}
+
+LayoutForInitialization ImplementationVisitor::GenerateLayoutForInitialization(
+    const ClassType* class_type,
     const InitializerResults& initializer_results) {
-  while (current_class != nullptr) {
-    auto current_field = current_class->fields().begin();
-    while (current_field != current_class->fields().end()) {
-      if (current_field->index) {
-        if (!current_field->name_and_type.type->IsSubtypeOf(
-                TypeOracle::GetObjectType())) {
-          ReportError(
-              "allocating objects containing indexed fields of non-object "
-              "types is not yet supported");
-        }
-        VisitResult index_field_size =
-            VisitResult(TypeOracle::GetConstInt31Type(), "kTaggedSize");
-        VisitResult initializer_value =
-            initializer_results.field_value_map.at(current_field->index->name);
-        Arguments args;
-        args.parameters.push_back(object_size);
-        args.parameters.push_back(initializer_value);
-        args.parameters.push_back(index_field_size);
-        object_size = GenerateCall("%AddIndexedFieldSizeToObjectSize", args,
-                                   {current_field->index->type}, false);
-      }
-      ++current_field;
+  LayoutForInitialization layout;
+  VisitResult offset;
+  for (Field f : class_type->ComputeAllFields()) {
+    if (f.offset.has_value()) {
+      offset =
+          VisitResult(TypeOracle::GetConstInt31Type(), ToString(*f.offset));
     }
-    current_class = current_class->GetSuperClass();
+    layout.offsets[f.name_and_type.name] = offset;
+    if (f.index) {
+      size_t element_size;
+      std::string element_size_string;
+      std::tie(element_size, element_size_string) =
+          *SizeOf(f.name_and_type.type);
+      VisitResult array_element_size =
+          VisitResult(TypeOracle::GetConstInt31Type(), element_size_string);
+      VisitResult array_length =
+          GenerateArrayLength(class_type, initializer_results, f);
+      layout.array_lengths[f.name_and_type.name] = array_length;
+      Arguments arguments;
+      arguments.parameters = {offset, array_length, array_element_size};
+      offset = GenerateCall(QualifiedName({TORQUE_INTERNAL_NAMESPACE_STRING},
+                                          "AddIndexedFieldSizeToObjectSize"),
+                            arguments);
+    } else {
+      DCHECK(f.offset.has_value());
+    }
+  }
+  if (class_type->size().SingleValue()) {
+    layout.size = VisitResult(TypeOracle::GetConstInt31Type(),
+                              ToString(*class_type->size().SingleValue()));
+  } else {
+    layout.size = offset;
+  }
+  if ((size_t{1} << class_type->size().AlignmentLog2()) <
+      TargetArchitecture::TaggedSize()) {
+    Arguments arguments;
+    arguments.parameters = {layout.size};
+    layout.size = GenerateCall(
+        QualifiedName({TORQUE_INTERNAL_NAMESPACE_STRING}, "AlignTagged"),
+        arguments);
   }
-  return object_size;
+  return layout;
 }
 
 VisitResult ImplementationVisitor::Visit(NewExpression* expr) {
@@ -1314,14 +1456,14 @@ VisitResult ImplementationVisitor::Visit(NewExpression* expr) {
   InitializerResults initializer_results =
       VisitInitializerResults(class_type, expr->initializers);
 
-  VisitResult object_map;
   const Field& map_field = class_type->LookupField("map");
-  if (map_field.offset != 0) {
+  if (*map_field.offset != 0) {
     ReportError("class initializers must have a map as first parameter");
   }
   const std::map<std::string, VisitResult>& initializer_fields =
       initializer_results.field_value_map;
   auto it_object_map = initializer_fields.find(map_field.name_and_type.name);
+  VisitResult object_map;
   if (class_type->IsExtern()) {
     if (it_object_map == initializer_fields.end()) {
       ReportError("Constructor for ", class_type->name(),
@@ -1338,8 +1480,9 @@ VisitResult ImplementationVisitor::Visit(NewExpression* expr) {
     get_struct_map_arguments.parameters.push_back(
         VisitResult(TypeOracle::GetConstexprInstanceTypeType(),
                     CapifyStringWithUnderscores(class_type->name()) + "_TYPE"));
-    object_map =
-        GenerateCall("%GetStructMap", get_struct_map_arguments, {}, false);
+    object_map = GenerateCall(
+        QualifiedName({TORQUE_INTERNAL_NAMESPACE_STRING}, "GetStructMap"),
+        get_struct_map_arguments, {}, false);
     CurrentSourcePosition::Scope current_pos(expr->pos);
     initializer_results.names.insert(initializer_results.names.begin(),
                                      MakeNode<Identifier>("map"));
@@ -1351,23 +1494,21 @@ VisitResult ImplementationVisitor::Visit(NewExpression* expr) {
                               class_type->ComputeAllFields(),
                               expr->initializers, !class_type->IsExtern());
 
-  Arguments size_arguments;
-  size_arguments.parameters.push_back(object_map);
-  VisitResult object_size = GenerateCall("%GetAllocationBaseSize",
-                                         size_arguments, {class_type}, false);
-
-  object_size =
-      AddVariableObjectSize(object_size, class_type, initializer_results);
+  LayoutForInitialization layout =
+      GenerateLayoutForInitialization(class_type, initializer_results);
 
   Arguments allocate_arguments;
-  allocate_arguments.parameters.push_back(object_size);
-  VisitResult allocate_result =
-      GenerateCall("%Allocate", allocate_arguments, {class_type}, false);
+  allocate_arguments.parameters.push_back(layout.size);
+  allocate_arguments.parameters.push_back(object_map);
+  VisitResult allocate_result = GenerateCall(
+      QualifiedName({TORQUE_INTERNAL_NAMESPACE_STRING}, "Allocate"),
+      allocate_arguments, {class_type}, false);
   DCHECK(allocate_result.IsOnStack());
 
-  InitializeClass(class_type, allocate_result, initializer_results);
+  InitializeClass(class_type, allocate_result, initializer_results, layout);
 
-  return stack_scope.Yield(allocate_result);
+  return stack_scope.Yield(GenerateCall(
+      "%RawDownCast", Arguments{{allocate_result}, {}}, {class_type}));
 }
 
 const Type* ImplementationVisitor::Visit(BreakStatement* stmt) {
@@ -1533,12 +1674,13 @@ std::vector<std::string> ImplementationVisitor::GenerateFunctionDeclaration(
 
 namespace {
 
-void FailCallableLookup(const std::string& reason, const QualifiedName& name,
-                        const TypeVector& parameter_types,
-                        const std::vector<Binding<LocalLabel>*>& labels,
-                        const std::vector<Signature>& candidates,
-                        const std::vector<std::tuple<Generic*, const char*>>
-                            inapplicable_generics) {
+void FailCallableLookup(
+    const std::string& reason, const QualifiedName& name,
+    const TypeVector& parameter_types,
+    const std::vector<Binding<LocalLabel>*>& labels,
+    const std::vector<Signature>& candidates,
+    const std::vector<std::pair<GenericCallable*, std::string>>
+        inapplicable_generics) {
   std::stringstream stream;
   stream << "\n" << reason << ": \n  " << name << "(" << parameter_types << ")";
   if (labels.size() != 0) {
@@ -1555,9 +1697,8 @@ void FailCallableLookup(const std::string& reason, const QualifiedName& name,
   if (inapplicable_generics.size() != 0) {
     stream << "\nfailed to instantiate all of these generic declarations:";
     for (auto& failure : inapplicable_generics) {
-      Generic* generic;
-      const char* reason;
-      std::tie(generic, reason) = failure;
+      GenericCallable* generic = failure.first;
+      const std::string& reason = failure.second;
       stream << "\n  " << generic->name() << " defined at "
              << generic->Position() << ":\n    " << reason << "\n";
     }
@@ -1565,9 +1706,10 @@ void FailCallableLookup(const std::string& reason, const QualifiedName& name,
   ReportError(stream.str());
 }
 
-Callable* GetOrCreateSpecialization(const SpecializationKey<Generic>& key) {
+Callable* GetOrCreateSpecialization(
+    const SpecializationKey<GenericCallable>& key) {
   if (base::Optional<Callable*> specialization =
-          key.generic->specializations().Get(key.specialized_types)) {
+          key.generic->GetSpecialization(key.specialized_types)) {
     return *specialization;
   }
   return DeclarationVisitor::SpecializeImplicit(key);
@@ -1621,20 +1763,21 @@ Callable* ImplementationVisitor::LookupCallable(
 
   std::vector<Declarable*> overloads;
   std::vector<Signature> overload_signatures;
-  std::vector<std::tuple<Generic*, const char*>> inapplicable_generics;
+  std::vector<std::pair<GenericCallable*, std::string>> inapplicable_generics;
   for (auto* declarable : declaration_container) {
-    if (Generic* generic = Generic::DynamicCast(declarable)) {
+    if (GenericCallable* generic = GenericCallable::DynamicCast(declarable)) {
       TypeArgumentInference inference = generic->InferSpecializationTypes(
           specialization_types, parameter_types);
       if (inference.HasFailed()) {
         inapplicable_generics.push_back(
-            std::make_tuple(generic, inference.GetFailureReason()));
+            std::make_pair(generic, inference.GetFailureReason()));
         continue;
       }
       overloads.push_back(generic);
       overload_signatures.push_back(
           DeclarationVisitor::MakeSpecializedSignature(
-              SpecializationKey<Generic>{generic, inference.GetResult()}));
+              SpecializationKey<GenericCallable>{generic,
+                                                 inference.GetResult()}));
     } else if (Callable* callable = Callable::DynamicCast(declarable)) {
       overloads.push_back(callable);
       overload_signatures.push_back(callable->signature());
@@ -1683,11 +1826,12 @@ Callable* ImplementationVisitor::LookupCallable(
     }
   }
 
-  if (Generic* generic = Generic::DynamicCast(overloads[best])) {
+  if (GenericCallable* generic =
+          GenericCallable::DynamicCast(overloads[best])) {
     TypeArgumentInference inference = generic->InferSpecializationTypes(
         specialization_types, parameter_types);
     result = GetOrCreateSpecialization(
-        SpecializationKey<Generic>{generic, inference.GetResult()});
+        SpecializationKey<GenericCallable>{generic, inference.GetResult()});
   } else {
     result = Callable::cast(overloads[best]);
   }
@@ -1803,14 +1947,19 @@ LocationReference ImplementationVisitor::GetLocationReference(
 
 LocationReference ImplementationVisitor::GetLocationReference(
     FieldAccessExpression* expr) {
-  const std::string& fieldname = expr->field->value;
-  LocationReference reference = GetLocationReference(expr->object);
+  return GenerateFieldAccess(GetLocationReference(expr->object),
+                             expr->field->value, expr->field->pos);
+}
+
+LocationReference ImplementationVisitor::GenerateFieldAccess(
+    LocationReference reference, const std::string& fieldname,
+    base::Optional<SourcePosition> pos) {
   if (reference.IsVariableAccess() &&
       reference.variable().type()->IsStructType()) {
     const StructType* type = StructType::cast(reference.variable().type());
     const Field& field = type->LookupField(fieldname);
-    if (GlobalContext::collect_language_server_data()) {
-      LanguageServerData::AddDefinition(expr->field->pos, field.pos);
+    if (GlobalContext::collect_language_server_data() && pos.has_value()) {
+      LanguageServerData::AddDefinition(*pos, field.pos);
     }
     if (field.const_qualified) {
       VisitResult t_value = ProjectStructField(reference.variable(), fieldname);
@@ -1822,15 +1971,58 @@ LocationReference ImplementationVisitor::GetLocationReference(
     }
   }
   if (reference.IsTemporary() && reference.temporary().type()->IsStructType()) {
-    if (GlobalContext::collect_language_server_data()) {
+    if (GlobalContext::collect_language_server_data() && pos.has_value()) {
       const StructType* type = StructType::cast(reference.temporary().type());
       const Field& field = type->LookupField(fieldname);
-      LanguageServerData::AddDefinition(expr->field->pos, field.pos);
+      LanguageServerData::AddDefinition(*pos, field.pos);
     }
     return LocationReference::Temporary(
         ProjectStructField(reference.temporary(), fieldname),
         reference.temporary_description());
   }
+  if (reference.ReferencedType()->IsBitFieldStructType()) {
+    const BitFieldStructType* bitfield_struct =
+        BitFieldStructType::cast(reference.ReferencedType());
+    const BitField& field = bitfield_struct->LookupField(fieldname);
+    return LocationReference::BitFieldAccess(reference, field);
+  }
+  if (reference.IsHeapReference()) {
+    VisitResult ref = reference.heap_reference();
+    auto generic_type = StructType::MatchUnaryGeneric(
+        ref.type(), TypeOracle::GetReferenceGeneric());
+    if (!generic_type) {
+      ReportError(
+          "Left-hand side of field access expression is marked as a reference "
+          "but is not of type Reference<...>. Found type: ",
+          ref.type()->ToString());
+    }
+    if (const StructType* struct_type =
+            StructType::DynamicCast(*generic_type)) {
+      const Field& field = struct_type->LookupField(fieldname);
+      // Update the Reference's type to refer to the field type within the
+      // struct.
+      ref.SetType(TypeOracle::GetReferenceType(field.name_and_type.type));
+      if (!field.offset.has_value()) {
+        Error("accessing field with unknown offset").Throw();
+      }
+      if (*field.offset != 0) {
+        // Copy the Reference struct up the stack and update the new copy's
+        // |offset| value to point to the struct field.
+        StackScope scope(this);
+        ref = GenerateCopy(ref);
+        VisitResult ref_offset = ProjectStructField(ref, "offset");
+        VisitResult struct_offset{
+            TypeOracle::GetIntPtrType()->ConstexprVersion(),
+            std::to_string(*field.offset)};
+        VisitResult updated_offset =
+            GenerateCall("+", Arguments{{ref_offset, struct_offset}, {}});
+        assembler().Poke(ref_offset.stack_range(), updated_offset.stack_range(),
+                         ref_offset.type());
+        ref = scope.Yield(ref);
+      }
+      return LocationReference::HeapReference(ref);
+    }
+  }
   VisitResult object_result = GenerateFetchFromLocation(reference);
   if (base::Optional<const ClassType*> class_type =
           object_result.type()->ClassSupertype()) {
@@ -1840,45 +2032,10 @@ LocationReference ImplementationVisitor::GetLocationReference(
         QualifiedName{"." + fieldname}, {object_result.type()});
     if ((*class_type)->HasField(fieldname) && !has_explicit_overloads) {
       const Field& field = (*class_type)->LookupField(fieldname);
-      if (GlobalContext::collect_language_server_data()) {
-        LanguageServerData::AddDefinition(expr->field->pos, field.pos);
-      }
-      if (field.index) {
-        assembler().Emit(
-            CreateFieldReferenceInstruction{object_result.type(), fieldname});
-        // Fetch the length from the object
-        {
-          StackScope length_scope(this);
-          // Get a reference to the length
-          const NameAndType& index_field = field.index.value();
-          GenerateCopy(object_result);
-          assembler().Emit(CreateFieldReferenceInstruction{object_result.type(),
-                                                           index_field.name});
-          VisitResult length_reference(
-              TypeOracle::GetReferenceType(index_field.type),
-              assembler().TopRange(2));
-
-          // Load the length from the reference and convert it to intptr
-          VisitResult length = GenerateFetchFromLocation(
-              LocationReference::HeapReference(length_reference));
-          VisitResult converted_length =
-              GenerateCall("Convert", {{length}, {}},
-                           {TypeOracle::GetIntPtrType(), length.type()}, false);
-          DCHECK_EQ(converted_length.stack_range().Size(), 1);
-          length_scope.Yield(converted_length);
-        }
-        const Type* slice_type =
-            TypeOracle::GetSliceType(field.name_and_type.type);
-        return LocationReference::HeapSlice(
-            VisitResult(slice_type, assembler().TopRange(3)));
-      } else {
-        assembler().Emit(
-            CreateFieldReferenceInstruction{*class_type, fieldname});
-        const Type* reference_type =
-            TypeOracle::GetReferenceType(field.name_and_type.type);
-        return LocationReference::HeapReference(
-            VisitResult(reference_type, assembler().TopRange(2)));
+      if (GlobalContext::collect_language_server_data() && pos.has_value()) {
+        LanguageServerData::AddDefinition(*pos, field.pos);
       }
+      return GenerateFieldReference(object_result, field, *class_type);
     }
   }
   return LocationReference::FieldAccess(object_result, fieldname);
@@ -1893,8 +2050,12 @@ LocationReference ImplementationVisitor::GetLocationReference(
     const AggregateType* slice_type =
         AggregateType::cast(reference.heap_slice().type());
     Method* method = LookupMethod("AtIndex", slice_type, arguments, {});
+    // The reference has to be treated like a normal value when calling methods
+    // on the underlying slice implementation.
+    LocationReference slice_value = LocationReference::Temporary(
+        reference.GetVisitResult(), "slice as value");
     return LocationReference::HeapReference(
-        GenerateCall(method, reference, arguments, {}, false));
+        GenerateCall(method, std::move(slice_value), arguments, {}, false));
   } else {
     return LocationReference::ArrayAccess(GenerateFetchFromLocation(reference),
                                           index);
@@ -1914,11 +2075,12 @@ LocationReference ImplementationVisitor::GetLocationReference(
         ReportError("cannot have generic parameters on local name ",
                     expr->name);
       }
-      if ((*value)->is_const) {
-        return LocationReference::Temporary(
-            (*value)->value, "constant value " + expr->name->value);
+      const LocationReference& ref = (*value)->value;
+      if (ref.IsVariableAccess()) {
+        // Attach the binding to enable the never-assigned-to lint check.
+        return LocationReference::VariableAccess(ref.GetVisitResult(), *value);
       }
-      return LocationReference::VariableAccess((*value)->value, *value);
+      return ref;
     }
   }
 
@@ -1936,9 +2098,9 @@ LocationReference ImplementationVisitor::GetLocationReference(
                                         "builtin " + expr->name->value);
   }
   if (expr->generic_arguments.size() != 0) {
-    Generic* generic = Declarations::LookupUniqueGeneric(name);
+    GenericCallable* generic = Declarations::LookupUniqueGeneric(name);
     Callable* specialization =
-        GetOrCreateSpecialization(SpecializationKey<Generic>{
+        GetOrCreateSpecialization(SpecializationKey<GenericCallable>{
             generic, TypeVisitor::ComputeTypeVector(expr->generic_arguments)});
     if (Builtin* builtin = Builtin::DynamicCast(specialization)) {
       DCHECK(!builtin->IsExternal());
@@ -1974,8 +2136,7 @@ LocationReference ImplementationVisitor::GetLocationReference(
 LocationReference ImplementationVisitor::GetLocationReference(
     DereferenceExpression* expr) {
   VisitResult ref = Visit(expr->reference);
-  if (!StructType::MatchUnaryGeneric(ref.type(),
-                                     TypeOracle::GetReferenceGeneric())) {
+  if (!Type::MatchUnaryGeneric(ref.type(), TypeOracle::GetReferenceGeneric())) {
     ReportError("Operator * expects a reference but found a value of type ",
                 *ref.type());
   }
@@ -1989,9 +2150,34 @@ VisitResult ImplementationVisitor::GenerateFetchFromLocation(
   } else if (reference.IsVariableAccess()) {
     return GenerateCopy(reference.variable());
   } else if (reference.IsHeapReference()) {
-    GenerateCopy(reference.heap_reference());
-    assembler().Emit(LoadReferenceInstruction{reference.ReferencedType()});
-    DCHECK_EQ(1, LoweredSlotCount(reference.ReferencedType()));
+    const Type* referenced_type = reference.ReferencedType();
+    if (referenced_type == TypeOracle::GetFloat64OrHoleType()) {
+      return GenerateCall(QualifiedName({TORQUE_INTERNAL_NAMESPACE_STRING},
+                                        "LoadFloat64OrHole"),
+                          Arguments{{reference.heap_reference()}, {}});
+    } else if (auto* struct_type = StructType::DynamicCast(referenced_type)) {
+      StackRange result_range = assembler().TopRange(0);
+      for (const Field& field : struct_type->fields()) {
+        StackScope scope(this);
+        const std::string& fieldname = field.name_and_type.name;
+        VisitResult field_value = scope.Yield(GenerateFetchFromLocation(
+            GenerateFieldAccess(reference, fieldname)));
+        result_range.Extend(field_value.stack_range());
+      }
+      return VisitResult(referenced_type, result_range);
+    } else {
+      GenerateCopy(reference.heap_reference());
+      assembler().Emit(LoadReferenceInstruction{reference.ReferencedType()});
+      DCHECK_EQ(1, LoweredSlotCount(reference.ReferencedType()));
+      return VisitResult(reference.ReferencedType(), assembler().TopRange(1));
+    }
+  } else if (reference.IsBitFieldAccess()) {
+    // First fetch the bitfield struct, then get the bits out of it.
+    VisitResult bit_field_struct =
+        GenerateFetchFromLocation(reference.bit_field_struct_location());
+    assembler().Emit(LoadBitFieldInstruction{
+        BitFieldStructType::cast(bit_field_struct.type()),
+        reference.bit_field()});
     return VisitResult(reference.ReferencedType(), assembler().TopRange(1));
   } else {
     if (reference.IsHeapSlice()) {
@@ -2026,16 +2212,49 @@ void ImplementationVisitor::GenerateAssignToLocation(
     ReportError("assigning a value directly to an indexed field isn't allowed");
   } else if (reference.IsHeapReference()) {
     const Type* referenced_type = reference.ReferencedType();
-    GenerateCopy(reference.heap_reference());
-    VisitResult converted_assignment_value =
-        GenerateImplicitConvert(referenced_type, assignment_value);
-    if (referenced_type == TypeOracle::GetFloat64Type()) {
-      VisitResult silenced_float_value =
-          GenerateCall("Float64SilenceNaN", {{assignment_value}, {}});
-      assembler().Poke(converted_assignment_value.stack_range(),
-                       silenced_float_value.stack_range(), referenced_type);
-    }
-    assembler().Emit(StoreReferenceInstruction{referenced_type});
+    if (referenced_type == TypeOracle::GetFloat64OrHoleType()) {
+      GenerateCall(
+          QualifiedName({TORQUE_INTERNAL_NAMESPACE_STRING},
+                        "StoreFloat64OrHole"),
+          Arguments{{reference.heap_reference(), assignment_value}, {}});
+    } else if (auto* struct_type = StructType::DynamicCast(referenced_type)) {
+      if (assignment_value.type() != referenced_type) {
+        ReportError("Cannot assign to ", *referenced_type,
+                    " with value of type ", *assignment_value.type());
+      }
+      for (const Field& field : struct_type->fields()) {
+        const std::string& fieldname = field.name_and_type.name;
+        GenerateAssignToLocation(
+            GenerateFieldAccess(reference, fieldname),
+            ProjectStructField(assignment_value, fieldname));
+      }
+    } else {
+      GenerateCopy(reference.heap_reference());
+      VisitResult converted_assignment_value =
+          GenerateImplicitConvert(referenced_type, assignment_value);
+      if (referenced_type == TypeOracle::GetFloat64Type()) {
+        VisitResult silenced_float_value = GenerateCall(
+            "Float64SilenceNaN", Arguments{{assignment_value}, {}});
+        assembler().Poke(converted_assignment_value.stack_range(),
+                         silenced_float_value.stack_range(), referenced_type);
+      }
+      assembler().Emit(StoreReferenceInstruction{referenced_type});
+    }
+  } else if (reference.IsBitFieldAccess()) {
+    // First fetch the bitfield struct, then set the updated bits, then store
+    // it back to where we found it.
+    VisitResult bit_field_struct =
+        GenerateFetchFromLocation(reference.bit_field_struct_location());
+    VisitResult converted_value =
+        GenerateImplicitConvert(reference.ReferencedType(), assignment_value);
+    GenerateCopy(bit_field_struct);
+    GenerateCopy(converted_value);
+    assembler().Emit(StoreBitFieldInstruction{
+        BitFieldStructType::cast(bit_field_struct.type()),
+        reference.bit_field()});
+    GenerateAssignToLocation(
+        reference.bit_field_struct_location(),
+        VisitResult(bit_field_struct.type(), assembler().TopRange(1)));
   } else {
     DCHECK(reference.IsTemporary());
     ReportError("cannot assign to temporary ",
@@ -2129,14 +2348,9 @@ VisitResult ImplementationVisitor::GenerateCall(
     }
   }
 
-  std::vector<VisitResult> converted_arguments;
-  StackRange argument_range = assembler().TopRange(0);
-  std::vector<std::string> constexpr_arguments;
-
-  size_t current = 0;
-  for (; current < callable->signature().implicit_count; ++current) {
-    std::string implicit_name =
-        callable->signature().parameter_names[current]->value;
+  std::vector<VisitResult> implicit_arguments;
+  for (size_t i = 0; i < callable->signature().implicit_count; ++i) {
+    std::string implicit_name = callable->signature().parameter_names[i]->value;
     base::Optional<Binding<LocalValue>*> val =
         TryLookupLocalValue(implicit_name);
     if (!val) {
@@ -2144,7 +2358,16 @@ VisitResult ImplementationVisitor::GenerateCall(
                   "' required for call to '", callable->ReadableName(),
                   "' is not defined");
     }
-    AddCallParameter(callable, (*val)->value,
+    implicit_arguments.push_back(GenerateFetchFromLocation((*val)->value));
+  }
+
+  std::vector<VisitResult> converted_arguments;
+  StackRange argument_range = assembler().TopRange(0);
+  std::vector<std::string> constexpr_arguments;
+
+  size_t current = 0;
+  for (; current < callable->signature().implicit_count; ++current) {
+    AddCallParameter(callable, implicit_arguments[current],
                      callable->signature().parameter_types.types[current],
                      &converted_arguments, &argument_range,
                      &constexpr_arguments);
@@ -2324,7 +2547,19 @@ VisitResult ImplementationVisitor::GenerateCall(
       return VisitResult(return_type, assembler().TopRange(slot_count));
     }
   } else if (auto* intrinsic = Intrinsic::DynamicCast(callable)) {
-    if (intrinsic->ExternalName() == "%RawConstexprCast") {
+    if (intrinsic->ExternalName() == "%SizeOf") {
+      if (specialization_types.size() != 1) {
+        ReportError("%SizeOf must take a single type parameter");
+      }
+      const Type* type = specialization_types[0];
+      std::string size_string;
+      if (base::Optional<std::tuple<size_t, std::string>> size = SizeOf(type)) {
+        size_string = std::get<1>(*size);
+      } else {
+        Error("size of ", *type, " is not known.");
+      }
+      return VisitResult(return_type, size_string);
+    } else if (intrinsic->ExternalName() == "%RawConstexprCast") {
       if (intrinsic->signature().parameter_types.types.size() != 1 ||
           constexpr_arguments.size() != 1) {
         ReportError(
@@ -2480,10 +2715,11 @@ VisitResult ImplementationVisitor::GenerateImplicitConvert(
     return scope.Yield(GenerateCopy(source));
   }
 
-  if (TypeOracle::IsImplicitlyConvertableFrom(destination_type,
-                                              source.type())) {
-    return scope.Yield(GenerateCall(kFromConstexprMacroName, {{source}, {}},
-                                    {destination_type, source.type()}, false));
+  if (auto from = TypeOracle::ImplicitlyConvertableFrom(destination_type,
+                                                        source.type())) {
+    return scope.Yield(GenerateCall(kFromConstexprMacroName,
+                                    Arguments{{source}, {}},
+                                    {destination_type, *from}, false));
   } else if (IsAssignableFrom(destination_type, source.type())) {
     source.SetType(destination_type);
     return scope.Yield(GenerateCopy(source));
@@ -2654,8 +2890,8 @@ void ImplementationVisitor::Visit(Declarable* declarable) {
     case Declarable::kIntrinsic:
     case Declarable::kExternConstant:
     case Declarable::kNamespace:
-    case Declarable::kGeneric:
-    case Declarable::kGenericStructType:
+    case Declarable::kGenericCallable:
+    case Declarable::kGenericType:
       return;
   }
 }
@@ -2817,13 +3053,19 @@ class FieldOffsetsGenerator {
 
   virtual void WriteField(const Field& f, const std::string& size_string) = 0;
   virtual void WriteMarker(const std::string& marker) = 0;
-  virtual void BeginPrivateOffsets() = 0;
 
   virtual ~FieldOffsetsGenerator() { CHECK(is_finished_); }
 
   void RecordOffsetFor(const Field& f) {
     CHECK(!is_finished_);
     UpdateSection(f);
+
+    // Emit kHeaderSize before any indexed field.
+    // TODO(tebbi): Generalize this code to work with multiple indexed fields.
+    if (f.index.has_value()) {
+      WriteMarker("kHeaderSize");
+    }
+
     // We don't know statically how much space an indexed field takes, so report
     // it as zero.
     std::string size_string = "0";
@@ -2832,14 +3074,6 @@ class FieldOffsetsGenerator {
       std::tie(field_size, size_string) = f.GetFieldSizeInformation();
     }
     WriteField(f, size_string);
-
-    // Offsets for anything after an indexed field are likely to cause
-    // confusion, because the indexed field itself takes up a variable amount of
-    // space. We could not emit them at all, but that might allow an inherited
-    // kSize to be accessible (and wrong), so we emit them as private.
-    if (f.index.has_value()) {
-      BeginPrivateOffsets();
-    }
   }
 
   void Finish() {
@@ -2853,10 +3087,13 @@ class FieldOffsetsGenerator {
       End(FieldSectionType::kStrongSection);
     }
     is_finished_ = true;
-    if (type_->IsAbstract()) {
+
+    // In the presence of indexed fields, we already emitted kHeaderSize before
+    // the indexed field.
+    if (!type_->IsShape() && !type_->HasIndexedField()) {
       WriteMarker("kHeaderSize");
     }
-    if (!type_->IsAbstract() || type_->IsInstantiatedAbstractClass()) {
+    if (type_->HasStaticSize()) {
       WriteMarker("kSize");
     }
   }
@@ -2870,7 +3107,10 @@ class FieldOffsetsGenerator {
       // Allow void type for marker constants of size zero.
       return current_section_;
     }
-    if (f.name_and_type.type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
+    // Currently struct-valued fields are only allowed to have tagged data; see
+    // TypeVisitor::VisitClassFieldsAndMethods.
+    if (f.name_and_type.type->IsSubtypeOf(TypeOracle::GetTaggedType()) ||
+        f.name_and_type.type->IsStructType()) {
       if (f.is_weak) {
         return FieldSectionType::kWeakSection;
       } else {
@@ -2927,9 +3167,6 @@ class MacroFieldOffsetsGenerator : public FieldOffsetsGenerator {
   void WriteMarker(const std::string& marker) override {
     out_ << "V(" << marker << ", 0) \\\n";
   }
-  void BeginPrivateOffsets() override {
-    // Can't do anything meaningful here in the macro generator.
-  }
 
  private:
   std::ostream& out_;
@@ -2989,7 +3226,7 @@ void ImplementationVisitor::GenerateClassFieldOffsets(
 
       // TODO(danno): Remove this once all classes use ClassFieldOffsetGenerator
       // to generate field offsets without the use of macros.
-      if (!type->GenerateCppClassDefinitions()) {
+      if (!type->GenerateCppClassDefinitions() && !type->HasUndefinedLayout()) {
         MacroFieldOffsetsGenerator g(header, type);
         for (auto f : type->fields()) {
           CurrentSourcePosition::Scope scope(f.pos);
@@ -3004,6 +3241,44 @@ void ImplementationVisitor::GenerateClassFieldOffsets(
   WriteFile(output_header_path, header.str());
 }
 
+void ImplementationVisitor::GenerateBitFields(
+    const std::string& output_directory) {
+  std::stringstream header;
+  std::string file_name = "bit-fields-tq.h";
+  {
+    IncludeGuardScope include_guard(header, file_name);
+    header << "#include \"src/base/bit-field.h\"\n\n";
+    NamespaceScope namespaces(header, {"v8", "internal"});
+
+    // TODO(v8:7793): Once we can define enums in Torque, we should be able to
+    // do something nicer than hard-coding these predeclarations. Until then,
+    // any enum used as a bitfield must be included in this list.
+    header << R"(
+enum class FunctionSyntaxKind : uint8_t;
+enum class BailoutReason : uint8_t;
+enum FunctionKind : uint8_t;
+
+)";
+
+    for (const auto& type : TypeOracle::GetBitFieldStructTypes()) {
+      header << "struct TorqueGenerated" << type->name() << "Fields {\n";
+      std::string type_name = type->GetConstexprGeneratedTypeName();
+      for (const auto& field : type->fields()) {
+        const char* suffix = field.num_bits == 1 ? "Bit" : "Bits";
+        std::string field_type_name =
+            field.name_and_type.type->GetConstexprGeneratedTypeName();
+        header << "  using " << CamelifyString(field.name_and_type.name)
+               << suffix << " = base::BitField<" << field_type_name << ", "
+               << field.offset << ", " << field.num_bits << ", " << type_name
+               << ">;\n";
+      }
+      header << "};\n\n";
+    }
+  }
+  const std::string output_header_path = output_directory + "/" + file_name;
+  WriteFile(output_header_path, header.str());
+}
+
 namespace {
 
 class ClassFieldOffsetGenerator : public FieldOffsetsGenerator {
@@ -3025,11 +3300,6 @@ class ClassFieldOffsetGenerator : public FieldOffsetsGenerator {
     hdr_ << "  static constexpr int " << marker << " = " << previous_field_end_
          << ";\n";
   }
-  void BeginPrivateOffsets() override {
-    // The following section must re-establish public mode (currently done by
-    // GenerateClassConstructors).
-    hdr_ << " private:\n";
-  }
 
  private:
   std::ostream& hdr_;
@@ -3143,9 +3413,6 @@ void CppClassGenerator::GenerateClassConstructors() {
   hdr_ << "      \"class " << gen_name_ << " should be used as direct base for "
        << name_ << ".\");\n";
   hdr_ << "  }\n";
-  hdr_ << "  D* operator->() { return static_cast<D*>(this); }\n";
-  hdr_ << "  const D* operator->() const { return static_cast<const D*>(this); "
-          "}\n\n";
 
   hdr_ << "protected:\n";
   hdr_ << "  inline explicit " << gen_name_ << "(Address ptr);\n";
@@ -3153,20 +3420,14 @@ void CppClassGenerator::GenerateClassConstructors() {
   inl_ << "template<class D, class P>\n";
   inl_ << "inline " << gen_name_T_ << "::" << gen_name_ << "(Address ptr)\n";
   inl_ << "  : P(ptr) {\n";
-  if (type_->IsInstantiatedAbstractClass()) {
-    // This is a hack to prevent wrong instance type checks.
-    inl_ << "  // Instance check omitted because class is annotated with "
-         << ANNOTATION_INSTANTIATED_ABSTRACT_CLASS << ".\n";
-  } else {
-    inl_ << "  SLOW_DCHECK(this->Is" << name_ << "());\n";
-  }
+  inl_ << "  SLOW_DCHECK(this->Is" << name_ << "());\n";
   inl_ << "}\n";
 }
 
 // TODO(sigurds): Keep in sync with DECL_ACCESSORS and ACCESSORS macro.
 void CppClassGenerator::GenerateFieldAccessor(const Field& f) {
   const Type* field_type = f.name_and_type.type;
-  if (field_type == TypeOracle::GetVoidType()) return;
+  if (field_type == TypeOracle::GetVoidType() || f.index.has_value()) return;
   if (!f.name_and_type.type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
     return GenerateFieldAccessorForUntagged(f);
   }
@@ -3257,26 +3518,27 @@ void CppClassGenerator::GenerateFieldAccessorForObject(const Field& f) {
     hdr_ << "  // Torque type: " << field_type->ToString() << "\n";
   }
   hdr_ << "  inline " << type << " " << name << "() const;\n";
-  hdr_ << "  inline " << type << " " << name << "(Isolate* isolate) const;\n";
+  hdr_ << "  inline " << type << " " << name
+       << "(const Isolate* isolate) const;\n";
   hdr_ << "  inline void set_" << name << "(" << type
        << " value, WriteBarrierMode mode = UPDATE_WRITE_BARRIER);\n\n";
 
   std::string type_check;
-  for (const std::string& runtime_type : field_type->GetRuntimeTypes()) {
+  for (const RuntimeType& runtime_type : field_type->GetRuntimeTypes()) {
     if (!type_check.empty()) type_check += " || ";
-    type_check += "value.Is" + runtime_type + "()";
+    type_check += "value.Is" + runtime_type.type + "()";
   }
 
   // Generate implementation in inline header.
   inl_ << "template <class D, class P>\n";
   inl_ << type << " " << gen_name_ << "<D, P>::" << name << "() const {\n";
-  inl_ << "  Isolate* isolate = GetIsolateForPtrCompr(*this);\n";
+  inl_ << "  const Isolate* isolate = GetIsolateForPtrCompr(*this);\n";
   inl_ << "  return " << gen_name_ << "::" << name << "(isolate);\n";
   inl_ << "}\n";
 
   inl_ << "template <class D, class P>\n";
   inl_ << type << " " << gen_name_ << "<D, P>::" << name
-       << "(Isolate* isolate) const {\n";
+       << "(const Isolate* isolate) const {\n";
   if (class_type) {
     inl_ << "  return TaggedField<" << type << ", " << offset
          << ">::load(isolate, *this);\n";
@@ -3345,6 +3607,8 @@ void ImplementationVisitor::GenerateClassDefinitions(
     implementation << "#include \"src/objects/microtask-inl.h\"\n";
     implementation << "#include \"src/objects/module-inl.h\"\n";
     implementation << "#include \"src/objects/promise-inl.h\"\n";
+    implementation
+        << "#include \"src/objects/property-descriptor-object-inl.h\"\n";
     implementation << "#include \"src/objects/stack-frame-info-inl.h\"\n";
     implementation << "#include \"src/objects/struct-inl.h\"\n";
     implementation << "#include \"src/objects/template-objects-inl.h\"\n\n";
@@ -3437,43 +3701,33 @@ void ImplementationVisitor::GeneratePrintDefinitions(
 
 namespace {
 
-void GenerateClassFieldVerifier(const std::string& class_name,
-                                const ClassType& class_type, const Field& f,
-                                std::ostream& h_contents,
+// Generate verification code for a single piece of class data, which might be
+// nested within a struct or might be a single element in an indexed field (or
+// both).
+void GenerateFieldValueVerifier(const std::string& class_name,
+                                const Field& class_field,
+                                const Field& leaf_field, size_t struct_offset,
+                                std::string field_size,
                                 std::ostream& cc_contents) {
-  if (!f.generate_verify) return;
-  const Type* field_type = f.name_and_type.type;
-
-  // We only verify tagged types, not raw numbers or pointers. Note that this
-  // must check against GetObjectType not GetTaggedType, because Uninitialized
-  // is a Tagged but should not be verified.
-  if (!field_type->IsSubtypeOf(TypeOracle::GetObjectType())) return;
+  const Type* field_type = leaf_field.name_and_type.type;
 
-  if (f.index) {
-    if (f.index->type != TypeOracle::GetSmiType()) {
-      ReportError("Non-SMI values are not (yet) supported as indexes.");
-    }
-    // We already verified the index field because it was listed earlier, so we
-    // can assume it's safe to read here.
-    cc_contents << "  for (int i = 0; i < TaggedField<Smi, " << class_name
-                << "::k" << CamelifyString(f.index->name)
-                << "Offset>::load(o).value(); ++i) {\n";
-  } else {
-    cc_contents << "  {\n";
-  }
-
-  const char* object_type = f.is_weak ? "MaybeObject" : "Object";
+  bool maybe_object =
+      !field_type->IsSubtypeOf(TypeOracle::GetStrongTaggedType());
+  const char* object_type = maybe_object ? "MaybeObject" : "Object";
   const char* verify_fn =
-      f.is_weak ? "VerifyMaybeObjectPointer" : "VerifyPointer";
-  const char* index_offset = f.index ? "i * kTaggedSize" : "0";
+      maybe_object ? "VerifyMaybeObjectPointer" : "VerifyPointer";
+  std::string index_offset = std::to_string(struct_offset);
+  if (class_field.index) {
+    index_offset += " + i * " + field_size;
+  }
   // Name the local var based on the field name for nicer CHECK output.
-  const std::string value = f.name_and_type.name + "__value";
+  const std::string value = leaf_field.name_and_type.name + "__value";
 
   // Read the field.
   cc_contents << "    " << object_type << " " << value << " = TaggedField<"
               << object_type << ", " << class_name << "::k"
-              << CamelifyString(f.name_and_type.name) << "Offset>::load(o, "
-              << index_offset << ");\n";
+              << CamelifyString(class_field.name_and_type.name)
+              << "Offset>::load(o, " << index_offset << ");\n";
 
   // Call VerifyPointer or VerifyMaybeObjectPointer on it.
   cc_contents << "    " << object_type << "::" << verify_fn << "(isolate, "
@@ -3482,16 +3736,97 @@ void GenerateClassFieldVerifier(const std::string& class_name,
   // Check that the value is of an appropriate type. We can skip this part for
   // the Object type because it would not check anything beyond what we already
   // checked with VerifyPointer.
-  if (f.name_and_type.type != TypeOracle::GetObjectType()) {
-    std::string type_check = f.is_weak ? value + ".IsWeakOrCleared()" : "";
-    std::string strong_value =
-        value + (f.is_weak ? ".GetHeapObjectOrSmi()" : "");
-    for (const std::string& runtime_type : field_type->GetRuntimeTypes()) {
-      if (!type_check.empty()) type_check += " || ";
-      type_check += strong_value + ".Is" + runtime_type + "()";
+  if (field_type != TypeOracle::GetObjectType()) {
+    std::stringstream type_check;
+    bool at_start = true;
+    // If weak pointers are allowed, then start by checking for a cleared value.
+    if (maybe_object) {
+      type_check << value << ".IsCleared()";
+      at_start = false;
+    }
+    for (const RuntimeType& runtime_type : field_type->GetRuntimeTypes()) {
+      if (!at_start) type_check << " || ";
+      at_start = false;
+      if (maybe_object) {
+        bool strong = runtime_type.weak_ref_to.empty();
+        if (strong && runtime_type.type == "MaybeObject") {
+          // Rather than a generic Weak<T>, this is a basic type Tagged or
+          // WeakHeapObject. We can't validate anything more about the type of
+          // the object pointed to, so just check that it's weak.
+          type_check << value << ".IsWeak()";
+        } else {
+          type_check << "(" << (strong ? "!" : "") << value << ".IsWeak() && "
+                     << value << ".GetHeapObjectOrSmi().Is"
+                     << (strong ? runtime_type.type : runtime_type.weak_ref_to)
+                     << "())";
+        }
+      } else {
+        type_check << value << ".Is" << runtime_type.type << "()";
+      }
+    }
+    cc_contents << "    CHECK(" << type_check.str() << ");\n";
+  }
+}
+
+void GenerateClassFieldVerifier(const std::string& class_name,
+                                const ClassType& class_type, const Field& f,
+                                std::ostream& h_contents,
+                                std::ostream& cc_contents) {
+  if (!f.generate_verify) return;
+  const Type* field_type = f.name_and_type.type;
+
+  // We only verify tagged types, not raw numbers or pointers. Structs
+  // consisting of tagged types are also included.
+  if (!field_type->IsSubtypeOf(TypeOracle::GetTaggedType()) &&
+      !field_type->IsStructType())
+    return;
+  if (field_type == TypeOracle::GetFloat64OrHoleType()) return;
+  // Do not verify if the field may be uninitialized.
+  if (TypeOracle::GetUninitializedType()->IsSubtypeOf(field_type)) return;
+
+  if (f.index) {
+    base::Optional<NameAndType> array_length =
+        ExtractSimpleFieldArraySize(class_type, *f.index);
+    if (!array_length) {
+      Error("Cannot generate verifier for array field with complex length.")
+          .Position((*f.index)->pos)
+          .Throw();
+    }
+
+    std::string length_field_offset =
+        class_name + "::k" + CamelifyString(array_length->name) + "Offset";
+    cc_contents << "  for (int i = 0; i < ";
+    if (array_length->type == TypeOracle::GetSmiType()) {
+      // We already verified the index field because it was listed earlier, so
+      // we can assume it's safe to read here.
+      cc_contents << "TaggedField<Smi, " << length_field_offset
+                  << ">::load(o).value()";
+    } else {
+      const Type* constexpr_version = array_length->type->ConstexprVersion();
+      if (constexpr_version == nullptr) {
+        Error("constexpr representation for type ",
+              array_length->type->ToString(),
+              " is required due to usage as index")
+            .Position(f.pos);
+      }
+      cc_contents << "o.ReadField<" << constexpr_version->GetGeneratedTypeName()
+                  << ">(" << length_field_offset << ")";
+    }
+    cc_contents << "; ++i) {\n";
+  } else {
+    cc_contents << "  {\n";
+  }
+
+  if (const StructType* struct_type = StructType::DynamicCast(field_type)) {
+    for (const Field& field : struct_type->fields()) {
+      GenerateFieldValueVerifier(class_name, f, field, *field.offset,
+                                 std::to_string(struct_type->PackedSize()),
+                                 cc_contents);
     }
-    cc_contents << "    CHECK(" << type_check << ");\n";
+  } else {
+    GenerateFieldValueVerifier(class_name, f, f, 0, "kTaggedSize", cc_contents);
   }
+
   cc_contents << "  }\n";
 }
 
@@ -3568,12 +3903,7 @@ void ImplementationVisitor::GenerateClassVerifiers(
       }
 
       // Second, verify that this object is what it claims to be.
-      if (type->IsInstantiatedAbstractClass()) {
-        cc_contents << "  // Instance type check skipped because\n";
-        cc_contents << "  // it is an instantiated abstract class.\n";
-      } else {
-        cc_contents << "  CHECK(o.Is" << name << "());\n";
-      }
+      cc_contents << "  CHECK(o.Is" << name << "());\n";
 
       // Third, verify its properties.
       for (auto f : type->fields()) {
@@ -3589,6 +3919,38 @@ void ImplementationVisitor::GenerateClassVerifiers(
   WriteFile(output_directory + "/" + file_name + ".cc", cc_contents.str());
 }
 
+void ImplementationVisitor::GenerateEnumVerifiers(
+    const std::string& output_directory) {
+  std::string file_name = "enum-verifiers-tq";
+  std::stringstream cc_contents;
+  {
+    cc_contents << "#include \"src/compiler/code-assembler.h\"\n";
+    for (const std::string& include_path : GlobalContext::CppIncludes()) {
+      cc_contents << "#include " << StringLiteralQuote(include_path) << "\n";
+    }
+    cc_contents << "\n";
+
+    NamespaceScope cc_namespaces(cc_contents, {"v8", "internal", ""});
+
+    cc_contents << "class EnumVerifier {\n";
+    for (const auto& desc : GlobalContext::Get().ast()->EnumDescriptions()) {
+      cc_contents << "  // " << desc.name << " (" << desc.pos << ")\n";
+      cc_contents << "  void VerifyEnum_" << desc.name << "("
+                  << desc.constexpr_generates
+                  << " x) {\n"
+                     "    switch(x) {\n";
+      for (const auto& entry : desc.entries) {
+        cc_contents << "      case " << entry << ": break;\n";
+      }
+      if (desc.is_open) cc_contents << "      default: break;\n";
+      cc_contents << "    }\n  }\n\n";
+    }
+    cc_contents << "};\n";
+  }
+
+  WriteFile(output_directory + "/" + file_name + ".cc", cc_contents.str());
+}
+
 void ImplementationVisitor::GenerateExportedMacrosAssembler(
     const std::string& output_directory) {
   std::string file_name = "exported-macros-assembler-tq";
@@ -3664,7 +4026,7 @@ void ImplementationVisitor::GenerateCSATypes(
 
     // Generates headers for all structs in a topologically-sorted order, since
     // TypeOracle keeps them in the order of their resolution
-    for (auto& type : *TypeOracle::GetAggregateTypes()) {
+    for (const auto& type : TypeOracle::GetAggregateTypes()) {
       const StructType* struct_type = StructType::DynamicCast(type.get());
       if (!struct_type) continue;
       h_contents << "struct " << struct_type->GetGeneratedTypeNameImpl()
diff --git a/deps/v8/src/torque/implementation-visitor.h b/deps/v8/src/torque/implementation-visitor.h
index e1ebfeeb17654a..0d58b19d4657c1 100644
--- a/deps/v8/src/torque/implementation-visitor.h
+++ b/deps/v8/src/torque/implementation-visitor.h
@@ -24,6 +24,7 @@ namespace torque {
 template <typename T>
 class Binding;
 struct LocalValue;
+class ImplementationVisitor;
 
 // LocationReference is the representation of an l-value, so a value that might
 // allow for assignment. For uniformity, this class can also represent
@@ -54,8 +55,8 @@ class LocationReference {
   // pointer.
   static LocationReference HeapReference(VisitResult heap_reference) {
     LocationReference result;
-    DCHECK(StructType::MatchUnaryGeneric(heap_reference.type(),
-                                         TypeOracle::GetReferenceGeneric()));
+    DCHECK(Type::MatchUnaryGeneric(heap_reference.type(),
+                                   TypeOracle::GetReferenceGeneric()));
     result.heap_reference_ = std::move(heap_reference);
     return result;
   }
@@ -63,8 +64,8 @@ class LocationReference {
   // encode an inner pointer, and the number of elements.
   static LocationReference HeapSlice(VisitResult heap_slice) {
     LocationReference result;
-    DCHECK(StructType::MatchUnaryGeneric(heap_slice.type(),
-                                         TypeOracle::GetSliceGeneric()));
+    DCHECK(Type::MatchUnaryGeneric(heap_slice.type(),
+                                   TypeOracle::GetSliceGeneric()));
     result.heap_slice_ = std::move(heap_slice);
     return result;
   }
@@ -83,6 +84,13 @@ class LocationReference {
     result.call_arguments_ = {object};
     return result;
   }
+  static LocationReference BitFieldAccess(const LocationReference& object,
+                                          BitField field) {
+    LocationReference result;
+    result.bit_field_struct_ = std::make_shared<LocationReference>(object);
+    result.bit_field_ = std::move(field);
+    return result;
+  }
 
   bool IsConst() const { return temporary_.has_value(); }
 
@@ -106,14 +114,31 @@ class LocationReference {
     DCHECK(IsHeapSlice());
     return *heap_slice_;
   }
+  bool IsBitFieldAccess() const {
+    bool is_bitfield_access = bit_field_struct_ != nullptr;
+    DCHECK_EQ(is_bitfield_access, bit_field_.has_value());
+    return is_bitfield_access;
+  }
+  const LocationReference& bit_field_struct_location() const {
+    DCHECK(IsBitFieldAccess());
+    return *bit_field_struct_;
+  }
+  const BitField& bit_field() const {
+    DCHECK(IsBitFieldAccess());
+    return *bit_field_;
+  }
 
   const Type* ReferencedType() const {
     if (IsHeapReference()) {
-      return *StructType::MatchUnaryGeneric(heap_reference().type(),
-                                            TypeOracle::GetReferenceGeneric());
-    } else if (IsHeapSlice()) {
-      return *StructType::MatchUnaryGeneric(heap_slice().type(),
-                                            TypeOracle::GetSliceGeneric());
+      return *Type::MatchUnaryGeneric(heap_reference().type(),
+                                      TypeOracle::GetReferenceGeneric());
+    }
+    if (IsHeapSlice()) {
+      return *Type::MatchUnaryGeneric(heap_slice().type(),
+                                      TypeOracle::GetSliceGeneric());
+    }
+    if (IsBitFieldAccess()) {
+      return bit_field_->name_and_type.type;
     }
     return GetVisitResult().type();
   }
@@ -164,6 +189,13 @@ class LocationReference {
   VisitResultVector call_arguments_;
   base::Optional<Binding<LocalValue>*> binding_;
 
+  // The location of the bitfield struct that contains this bitfield, if this
+  // reference is a bitfield access. Uses a shared_ptr so that LocationReference
+  // is copyable, allowing us to set this field equal to a copy of a
+  // stack-allocated LocationReference.
+  std::shared_ptr<const LocationReference> bit_field_struct_;
+  base::Optional<BitField> bit_field_;
+
   LocationReference() = default;
 };
 
@@ -172,6 +204,12 @@ struct InitializerResults {
   std::map<std::string, VisitResult> field_value_map;
 };
 
+struct LayoutForInitialization {
+  std::map<std::string, VisitResult> array_lengths;
+  std::map<std::string, VisitResult> offsets;
+  VisitResult size;
+};
+
 template <class T>
 class Binding;
 
@@ -300,8 +338,7 @@ class BlockBindings {
 };
 
 struct LocalValue {
-  bool is_const;
-  VisitResult value;
+  LocationReference value;
 };
 
 struct LocalLabel {
@@ -321,7 +358,9 @@ template <>
 inline bool Binding<LocalValue>::CheckWritten() const {
   // Do the check only for non-const variables and non struct types.
   auto binding = *manager_->current_bindings_[name_];
-  return !binding->is_const && !binding->value.type()->IsStructType();
+  const LocationReference& ref = binding->value;
+  if (!ref.IsVariableAccess()) return false;
+  return !ref.GetVisitResult().type()->IsStructType();
 }
 template <>
 inline std::string Binding<LocalLabel>::BindingTypeString() const {
@@ -346,10 +385,12 @@ class ImplementationVisitor {
   void GenerateBuiltinDefinitionsAndInterfaceDescriptors(
       const std::string& output_directory);
   void GenerateClassFieldOffsets(const std::string& output_directory);
+  void GenerateBitFields(const std::string& output_directory);
   void GeneratePrintDefinitions(const std::string& output_directory);
   void GenerateClassDefinitions(const std::string& output_directory);
   void GenerateInstanceTypes(const std::string& output_directory);
   void GenerateClassVerifiers(const std::string& output_directory);
+  void GenerateEnumVerifiers(const std::string& output_directory);
   void GenerateClassDebugReaders(const std::string& output_directory);
   void GenerateExportedMacrosAssembler(const std::string& output_directory);
   void GenerateCSATypes(const std::string& output_directory);
@@ -367,16 +408,26 @@ class ImplementationVisitor {
   InitializerResults VisitInitializerResults(
       const ClassType* class_type,
       const std::vector<NameAndExpression>& expressions);
-
-  void InitializeFieldFromSpread(VisitResult object, const Field& field,
-                                 const InitializerResults& initializer_results);
-
-  VisitResult AddVariableObjectSize(
-      VisitResult object_size, const ClassType* current_class,
+  LocationReference GenerateFieldReference(VisitResult object,
+                                           const Field& field,
+                                           const ClassType* class_type);
+  LocationReference GenerateFieldReference(
+      VisitResult object, const Field& field,
+      const LayoutForInitialization& layout);
+  VisitResult GenerateArrayLength(
+      Expression* array_length, Namespace* nspace,
+      const std::map<std::string, LocationReference>& bindings);
+  VisitResult GenerateArrayLength(VisitResult object, const Field& field);
+  VisitResult GenerateArrayLength(const ClassType* class_type,
+                                  const InitializerResults& initializer_results,
+                                  const Field& field);
+  LayoutForInitialization GenerateLayoutForInitialization(
+      const ClassType* class_type,
       const InitializerResults& initializer_results);
 
   void InitializeClass(const ClassType* class_type, VisitResult allocate_result,
-                       const InitializerResults& initializer_results);
+                       const InitializerResults& initializer_results,
+                       const LayoutForInitialization& layout);
 
   VisitResult Visit(StructExpression* decl);
 
@@ -384,6 +435,9 @@ class ImplementationVisitor {
   LocationReference GetLocationReference(IdentifierExpression* expr);
   LocationReference GetLocationReference(DereferenceExpression* expr);
   LocationReference GetLocationReference(FieldAccessExpression* expr);
+  LocationReference GenerateFieldAccess(
+      LocationReference reference, const std::string& fieldname,
+      base::Optional<SourcePosition> pos = {});
   LocationReference GetLocationReference(ElementAccessExpression* expr);
 
   VisitResult GenerateFetchFromLocation(const LocationReference& reference);
diff --git a/deps/v8/src/torque/instance-type-generator.cc b/deps/v8/src/torque/instance-type-generator.cc
index 275e7064852815..3f1aec37774f37 100644
--- a/deps/v8/src/torque/instance-type-generator.cc
+++ b/deps/v8/src/torque/instance-type-generator.cc
@@ -16,14 +16,12 @@ namespace {
 struct InstanceTypeTree {
   explicit InstanceTypeTree(const ClassType* type)
       : type(type),
-        parent(nullptr),
         start(INT_MAX),
         end(INT_MIN),
         value(-1),
         num_values(0),
         num_own_values(0) {}
   const ClassType* type;
-  InstanceTypeTree* parent;
   std::vector<std::unique_ptr<InstanceTypeTree>> children;
   int start;  // Start of range for this and subclasses, or INT_MAX.
   int end;    // End of range for this and subclasses, or INT_MIN.
@@ -84,9 +82,7 @@ void PropagateInstanceTypeConstraints(InstanceTypeTree* root) {
   }
   const InstanceTypeConstraints& constraints =
       root->type->GetInstanceTypeConstraints();
-  if ((!root->type->IsAbstract() ||
-       root->type->IsInstantiatedAbstractClass()) &&
-      !root->type->HasSameInstanceTypeAsParent()) {
+  if (!root->type->IsAbstract() && !root->type->HasSameInstanceTypeAsParent()) {
     root->num_own_values = 1;
   }
   root->num_values += root->num_own_values;
@@ -290,8 +286,26 @@ std::unique_ptr<InstanceTypeTree> AssignInstanceTypes() {
 //   ranges are indented for readability.
 // - values: This list is just instance type names, like V(ODDBALL_TYPE). It
 //   does not include any FIRST_* and LAST_* range markers.
+// - fully_defined_single_instance_types: This list is pairs of class name and
+//   instance type, for classes which have defined layouts and a single
+//   corresponding instance type.
+// - only_declared_single_instance_types: This list is pairs of class name and
+//   instance type, for classes which have a single corresponding instance type
+//   and do not have layout definitions in Torque.
+// - fully_defined_range_instance_types: This list is triples of class name,
+//   first instance type, and last instance type, for classes which have defined
+//   layouts and multiple corresponding instance types.
+// - only_declared_range_instance_types: This list is triples of class name,
+//   first instance type, and last instance type, for classes which have
+//   multiple corresponding instance types and do not have layout definitions in
+//   Torque.
 void PrintInstanceTypes(InstanceTypeTree* root, std::ostream& definitions,
-                        std::ostream& values, const std::string& indent) {
+                        std::ostream& values,
+                        std::ostream& fully_defined_single_instance_types,
+                        std::ostream& only_declared_single_instance_types,
+                        std::ostream& fully_defined_range_instance_types,
+                        std::ostream& only_declared_range_instance_types,
+                        const std::string& indent) {
   std::string type_name =
       CapifyStringWithUnderscores(root->type->name()) + "_TYPE";
   std::string inner_indent = indent;
@@ -305,16 +319,39 @@ void PrintInstanceTypes(InstanceTypeTree* root, std::ostream& definitions,
     definitions << inner_indent << "V(" << type_name << ", " << root->value
                 << ") \\\n";
     values << "  V(" << type_name << ") \\\n";
+    if (root->num_values == 1) {
+      std::ostream& single_instance_types =
+          root->type->HasUndefinedLayout()
+              ? only_declared_single_instance_types
+              : fully_defined_single_instance_types;
+      single_instance_types << "  V(" << root->type->name() << ", " << type_name
+                            << ") \\\n";
+    }
   }
   for (auto& child : root->children) {
-    PrintInstanceTypes(child.get(), definitions, values, inner_indent);
+    PrintInstanceTypes(
+        child.get(), definitions, values, fully_defined_single_instance_types,
+        only_declared_single_instance_types, fully_defined_range_instance_types,
+        only_declared_range_instance_types, inner_indent);
   }
-  // We can't emit LAST_STRING_TYPE because it's not a valid flags combination.
-  // So if the class type has multiple own values, which only happens when using
-  // ANNOTATION_RESERVE_BITS_IN_INSTANCE_TYPE, then omit the end marker.
-  if (root->num_values > 1 && root->num_own_values <= 1) {
-    definitions << indent << "V(LAST_" << type_name << ", " << root->end
-                << ") \\\n";
+  if (root->num_values > 1) {
+    // We can't emit LAST_STRING_TYPE because it's not a valid flags
+    // combination. So if the class type has multiple own values, which only
+    // happens when using ANNOTATION_RESERVE_BITS_IN_INSTANCE_TYPE, then omit
+    // the end marker.
+    if (root->num_own_values <= 1) {
+      definitions << indent << "V(LAST_" << type_name << ", " << root->end
+                  << ") \\\n";
+    }
+
+    // Only output the instance type range for things other than the root type.
+    if (root->type->GetSuperClass() != nullptr) {
+      std::ostream& range_instance_types =
+          root->type->HasUndefinedLayout() ? only_declared_range_instance_types
+                                           : fully_defined_range_instance_types;
+      range_instance_types << "  V(" << root->type->name() << ", FIRST_"
+                           << type_name << ", LAST_" << type_name << ") \\\n";
+    }
   }
 }
 
@@ -332,16 +369,52 @@ void ImplementationVisitor::GenerateInstanceTypes(
     header << "#define TORQUE_ASSIGNED_INSTANCE_TYPES(V) \\\n";
     std::unique_ptr<InstanceTypeTree> instance_types = AssignInstanceTypes();
     std::stringstream values_list;
+    std::stringstream fully_defined_single_instance_types;
+    std::stringstream only_declared_single_instance_types;
+    std::stringstream fully_defined_range_instance_types;
+    std::stringstream only_declared_range_instance_types;
     if (instance_types != nullptr) {
-      PrintInstanceTypes(instance_types.get(), header, values_list, "  ");
+      PrintInstanceTypes(instance_types.get(), header, values_list,
+                         fully_defined_single_instance_types,
+                         only_declared_single_instance_types,
+                         fully_defined_range_instance_types,
+                         only_declared_range_instance_types, "  ");
     }
-    header << "\n\n";
+    header << "\n";
 
-    header << "// Instance types for all classes except for those that use "
-              "InstanceType as flags.\n";
+    header << "// Instance types for all classes except for those that use\n";
+    header << "// InstanceType as flags.\n";
     header << "#define TORQUE_ASSIGNED_INSTANCE_TYPE_LIST(V) \\\n";
     header << values_list.str();
-    header << "\n\n";
+    header << "\n";
+
+    header << "// Pairs of (ClassName, INSTANCE_TYPE) for classes that have\n";
+    header << "// full Torque definitions.\n";
+    header << "#define TORQUE_INSTANCE_CHECKERS_SINGLE_FULLY_DEFINED(V) \\\n";
+    header << fully_defined_single_instance_types.str();
+    header << "\n";
+
+    header << "// Pairs of (ClassName, INSTANCE_TYPE) for classes that are\n";
+    header << "// declared but not defined in Torque. These classes may\n";
+    header << "// correspond with actual C++ classes, but they are not\n";
+    header << "// guaranteed to.\n";
+    header << "#define TORQUE_INSTANCE_CHECKERS_SINGLE_ONLY_DECLARED(V) \\\n";
+    header << only_declared_single_instance_types.str();
+    header << "\n";
+
+    header << "// Triples of (ClassName, FIRST_TYPE, LAST_TYPE) for classes\n";
+    header << "// that have full Torque definitions.\n";
+    header << "#define TORQUE_INSTANCE_CHECKERS_RANGE_FULLY_DEFINED(V) \\\n";
+    header << fully_defined_range_instance_types.str();
+    header << "\n";
+
+    header << "// Triples of (ClassName, FIRST_TYPE, LAST_TYPE) for classes\n";
+    header << "// that are declared but not defined in Torque. These classes\n";
+    header << "// may correspond with actual C++ classes, but they are not\n";
+    header << "// guaranteed to.\n";
+    header << "#define TORQUE_INSTANCE_CHECKERS_RANGE_ONLY_DECLARED(V) \\\n";
+    header << only_declared_range_instance_types.str();
+    header << "\n";
 
     header << "// Instance types for Torque-internal classes.\n";
     header << "#define TORQUE_INTERNAL_INSTANCE_TYPES(V) \\\n";
@@ -352,7 +425,7 @@ void ImplementationVisitor::GenerateInstanceTypes(
           CapifyStringWithUnderscores(type->name()) + "_TYPE";
       header << "  V(" << type_name << ") \\\n";
     }
-    header << "\n\n";
+    header << "\n";
 
     header << "// Struct list entries for Torque-internal classes.\n";
     header << "#define TORQUE_STRUCT_LIST_GENERATOR(V, _) \\\n";
diff --git a/deps/v8/src/torque/instructions.cc b/deps/v8/src/torque/instructions.cc
index 5bc2149f414b91..81f5c6184cbd87 100644
--- a/deps/v8/src/torque/instructions.cc
+++ b/deps/v8/src/torque/instructions.cc
@@ -290,12 +290,6 @@ void UnsafeCastInstruction::TypeInstruction(Stack<const Type*>* stack,
   stack->Poke(stack->AboveTop() - 1, destination_type);
 }
 
-void CreateFieldReferenceInstruction::TypeInstruction(
-    Stack<const Type*>* stack, ControlFlowGraph* cfg) const {
-  ExpectSubtype(stack->Top(), type);
-  stack->Push(TypeOracle::GetIntPtrType());
-}
-
 void LoadReferenceInstruction::TypeInstruction(Stack<const Type*>* stack,
                                                ControlFlowGraph* cfg) const {
   ExpectType(TypeOracle::GetIntPtrType(), stack->Pop());
@@ -311,6 +305,19 @@ void StoreReferenceInstruction::TypeInstruction(Stack<const Type*>* stack,
   ExpectSubtype(stack->Pop(), TypeOracle::GetHeapObjectType());
 }
 
+void LoadBitFieldInstruction::TypeInstruction(Stack<const Type*>* stack,
+                                              ControlFlowGraph* cfg) const {
+  ExpectType(bit_field_struct_type, stack->Pop());
+  stack->Push(bit_field.name_and_type.type);
+}
+
+void StoreBitFieldInstruction::TypeInstruction(Stack<const Type*>* stack,
+                                               ControlFlowGraph* cfg) const {
+  ExpectSubtype(bit_field.name_and_type.type, stack->Pop());
+  ExpectType(bit_field_struct_type, stack->Pop());
+  stack->Push(bit_field_struct_type);
+}
+
 bool CallRuntimeInstruction::IsBlockTerminator() const {
   return is_tailcall || runtime_function->signature().return_type ==
                             TypeOracle::GetNeverType();
diff --git a/deps/v8/src/torque/instructions.h b/deps/v8/src/torque/instructions.h
index fe3b26b86ff3d4..cb560274fe7144 100644
--- a/deps/v8/src/torque/instructions.h
+++ b/deps/v8/src/torque/instructions.h
@@ -30,9 +30,10 @@ class RuntimeFunction;
   V(DeleteRangeInstruction)           \
   V(PushUninitializedInstruction)     \
   V(PushBuiltinPointerInstruction)    \
-  V(CreateFieldReferenceInstruction)  \
   V(LoadReferenceInstruction)         \
   V(StoreReferenceInstruction)        \
+  V(LoadBitFieldInstruction)          \
+  V(StoreBitFieldInstruction)         \
   V(CallCsaMacroInstruction)          \
   V(CallIntrinsicInstruction)         \
   V(NamespaceConstantInstruction)     \
@@ -204,14 +205,6 @@ struct NamespaceConstantInstruction : InstructionBase {
   NamespaceConstant* constant;
 };
 
-struct CreateFieldReferenceInstruction : InstructionBase {
-  TORQUE_INSTRUCTION_BOILERPLATE()
-  CreateFieldReferenceInstruction(const Type* type, std::string field_name)
-      : type(type), field_name(std::move(field_name)) {}
-  const Type* type;
-  std::string field_name;
-};
-
 struct LoadReferenceInstruction : InstructionBase {
   TORQUE_INSTRUCTION_BOILERPLATE()
   explicit LoadReferenceInstruction(const Type* type) : type(type) {}
@@ -224,6 +217,29 @@ struct StoreReferenceInstruction : InstructionBase {
   const Type* type;
 };
 
+// Pops a bitfield struct; pushes a bitfield value extracted from it.
+struct LoadBitFieldInstruction : InstructionBase {
+  TORQUE_INSTRUCTION_BOILERPLATE()
+  LoadBitFieldInstruction(const BitFieldStructType* bit_field_struct_type,
+                          BitField bit_field)
+      : bit_field_struct_type(bit_field_struct_type),
+        bit_field(std::move(bit_field)) {}
+  const BitFieldStructType* bit_field_struct_type;
+  BitField bit_field;
+};
+
+// Pops a bitfield value and a bitfield struct; pushes a new bitfield struct
+// containing the updated value.
+struct StoreBitFieldInstruction : InstructionBase {
+  TORQUE_INSTRUCTION_BOILERPLATE()
+  StoreBitFieldInstruction(const BitFieldStructType* bit_field_struct_type,
+                           BitField bit_field)
+      : bit_field_struct_type(bit_field_struct_type),
+        bit_field(std::move(bit_field)) {}
+  const BitFieldStructType* bit_field_struct_type;
+  BitField bit_field;
+};
+
 struct CallIntrinsicInstruction : InstructionBase {
   TORQUE_INSTRUCTION_BOILERPLATE()
   CallIntrinsicInstruction(Intrinsic* intrinsic,
diff --git a/deps/v8/src/torque/ls/message-handler.cc b/deps/v8/src/torque/ls/message-handler.cc
index becc97c9dc8da6..e9f2224df7648d 100644
--- a/deps/v8/src/torque/ls/message-handler.cc
+++ b/deps/v8/src/torque/ls/message-handler.cc
@@ -321,8 +321,8 @@ void HandleDocumentSymbolRequest(DocumentSymbolRequest request,
       symbol.set_name(builtin->ReadableName());
       symbol.set_kind(SymbolKind::kFunction);
       symbol.location().SetTo(builtin->Position());
-    } else if (symbol->IsGeneric()) {
-      Generic* generic = Generic::cast(symbol);
+    } else if (symbol->IsGenericCallable()) {
+      GenericCallable* generic = GenericCallable::cast(symbol);
       SymbolInformation symbol = response.add_result();
       symbol.set_name(generic->name());
       symbol.set_kind(SymbolKind::kFunction);
diff --git a/deps/v8/src/torque/runtime-support.h b/deps/v8/src/torque/runtime-support.h
new file mode 100644
index 00000000000000..15b223159b156f
--- /dev/null
+++ b/deps/v8/src/torque/runtime-support.h
@@ -0,0 +1,31 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_RUNTIME_SUPPORT_H_
+#define V8_TORQUE_RUNTIME_SUPPORT_H_
+
+#include <type_traits>
+
+template <class T>
+struct Identity {
+  using type = T;
+};
+
+template <class T>
+struct UnderlyingTypeHelper : Identity<typename std::underlying_type<T>::type> {
+};
+
+template <class T>
+using UnderlyingTypeIfEnum =
+    typename std::conditional_t<std::is_enum<T>::value, UnderlyingTypeHelper<T>,
+                                Identity<T>>::type;
+
+// Utility for extracting the underlying type of an enum, returns the type
+// itself if not an enum.
+template <class T>
+UnderlyingTypeIfEnum<T> CastToUnderlyingTypeIfEnum(T x) {
+  return static_cast<UnderlyingTypeIfEnum<T>>(x);
+}
+
+#endif  // V8_TORQUE_RUNTIME_SUPPORT_H_
diff --git a/deps/v8/src/torque/source-positions.h b/deps/v8/src/torque/source-positions.h
index 69ce78cf7c42b1..857efa22261866 100644
--- a/deps/v8/src/torque/source-positions.h
+++ b/deps/v8/src/torque/source-positions.h
@@ -38,6 +38,9 @@ struct LineAndColumn {
   bool operator==(const LineAndColumn& other) const {
     return line == other.line && column == other.column;
   }
+  bool operator!=(const LineAndColumn& other) const {
+    return !(*this == other);
+  }
 };
 
 struct SourcePosition {
@@ -66,6 +69,7 @@ struct SourcePosition {
   bool operator==(const SourcePosition& pos) const {
     return source == pos.source && start == pos.start && end == pos.end;
   }
+  bool operator!=(const SourcePosition& pos) const { return !(*this == pos); }
 };
 
 DECLARE_CONTEXTUAL_VARIABLE(CurrentSourceFile, SourceId);
diff --git a/deps/v8/src/torque/torque-compiler.cc b/deps/v8/src/torque/torque-compiler.cc
index 6d2b14fc1878a7..cb41cff946ca3f 100644
--- a/deps/v8/src/torque/torque-compiler.cc
+++ b/deps/v8/src/torque/torque-compiler.cc
@@ -82,10 +82,12 @@ void CompileCurrentAst(TorqueCompilerOptions options) {
   implementation_visitor.GenerateBuiltinDefinitionsAndInterfaceDescriptors(
       output_directory);
   implementation_visitor.GenerateClassFieldOffsets(output_directory);
+  implementation_visitor.GenerateBitFields(output_directory);
   implementation_visitor.GeneratePrintDefinitions(output_directory);
   implementation_visitor.GenerateClassDefinitions(output_directory);
   implementation_visitor.GenerateClassVerifiers(output_directory);
   implementation_visitor.GenerateClassDebugReaders(output_directory);
+  implementation_visitor.GenerateEnumVerifiers(output_directory);
   implementation_visitor.GenerateExportedMacrosAssembler(output_directory);
   implementation_visitor.GenerateCSATypes(output_directory);
   implementation_visitor.GenerateInstanceTypes(output_directory);
diff --git a/deps/v8/src/torque/torque-parser.cc b/deps/v8/src/torque/torque-parser.cc
index 3639bef97cc0f3..c6b63e22346988 100644
--- a/deps/v8/src/torque/torque-parser.cc
+++ b/deps/v8/src/torque/torque-parser.cc
@@ -5,6 +5,7 @@
 #include <algorithm>
 #include <cctype>
 #include <set>
+#include <stdexcept>
 #include <unordered_map>
 
 #include "src/common/globals.h"
@@ -21,7 +22,6 @@ namespace torque {
 DEFINE_CONTEXTUAL_VARIABLE(CurrentAst)
 
 using TypeList = std::vector<TypeExpression*>;
-using GenericParameters = std::vector<Identifier*>;
 
 struct ExpressionWithSource {
   Expression* expression;
@@ -65,6 +65,9 @@ template <>
 V8_EXPORT_PRIVATE const ParseResultTypeId ParseResultHolder<bool>::id =
     ParseResultTypeId::kBool;
 template <>
+V8_EXPORT_PRIVATE const ParseResultTypeId ParseResultHolder<int32_t>::id =
+    ParseResultTypeId::kInt32;
+template <>
 V8_EXPORT_PRIVATE const ParseResultTypeId
     ParseResultHolder<std::vector<std::string>>::id =
         ParseResultTypeId::kStdVectorOfString;
@@ -115,6 +118,14 @@ V8_EXPORT_PRIVATE const ParseResultTypeId
     ParseResultHolder<std::vector<Annotation>>::id =
         ParseResultTypeId::kVectorOfAnnotation;
 template <>
+V8_EXPORT_PRIVATE const ParseResultTypeId
+    ParseResultHolder<AnnotationParameter>::id =
+        ParseResultTypeId::kAnnotationParameter;
+template <>
+V8_EXPORT_PRIVATE const ParseResultTypeId
+    ParseResultHolder<base::Optional<AnnotationParameter>>::id =
+        ParseResultTypeId::kOptionalAnnotationParameter;
+template <>
 V8_EXPORT_PRIVATE const ParseResultTypeId
     ParseResultHolder<ClassFieldExpression>::id =
         ParseResultTypeId::kClassFieldExpression;
@@ -123,6 +134,10 @@ V8_EXPORT_PRIVATE const ParseResultTypeId
     ParseResultHolder<StructFieldExpression>::id =
         ParseResultTypeId::kStructFieldExpression;
 template <>
+V8_EXPORT_PRIVATE const ParseResultTypeId
+    ParseResultHolder<BitFieldDeclaration>::id =
+        ParseResultTypeId::kBitFieldDeclaration;
+template <>
 V8_EXPORT_PRIVATE const ParseResultTypeId
     ParseResultHolder<std::vector<NameAndTypeExpression>>::id =
         ParseResultTypeId::kStdVectorOfNameAndTypeExpression;
@@ -147,6 +162,10 @@ V8_EXPORT_PRIVATE const ParseResultTypeId
     ParseResultHolder<std::vector<StructFieldExpression>>::id =
         ParseResultTypeId::kStdVectorOfStructFieldExpression;
 template <>
+V8_EXPORT_PRIVATE const ParseResultTypeId
+    ParseResultHolder<std::vector<BitFieldDeclaration>>::id =
+        ParseResultTypeId::kStdVectorOfBitFieldDeclaration;
+template <>
 V8_EXPORT_PRIVATE const ParseResultTypeId
     ParseResultHolder<IncrementDecrementOperator>::id =
         ParseResultTypeId::kIncrementDecrementOperator;
@@ -218,6 +237,14 @@ template <>
 V8_EXPORT_PRIVATE const ParseResultTypeId
     ParseResultHolder<base::Optional<ClassBody*>>::id =
         ParseResultTypeId::kOptionalClassBody;
+template <>
+V8_EXPORT_PRIVATE const ParseResultTypeId
+    ParseResultHolder<GenericParameter>::id =
+        ParseResultTypeId::kGenericParameter;
+template <>
+V8_EXPORT_PRIVATE const ParseResultTypeId
+    ParseResultHolder<GenericParameters>::id =
+        ParseResultTypeId::kGenericParameters;
 
 namespace {
 
@@ -245,8 +272,9 @@ void NamingConventionError(const std::string& type, const Identifier* name,
 
 void LintGenericParameters(const GenericParameters& parameters) {
   for (auto parameter : parameters) {
-    if (!IsUpperCamelCase(parameter->value)) {
-      NamingConventionError("Generic parameter", parameter, "UpperCamelCase");
+    if (!IsUpperCamelCase(parameter.name->value)) {
+      NamingConventionError("Generic parameter", parameter.name,
+                            "UpperCamelCase");
     }
   }
 }
@@ -513,7 +541,8 @@ base::Optional<ParseResult> MakeIntrinsicDeclaration(
   }
   Declaration* result = declaration;
   if (!generic_parameters.empty()) {
-    result = MakeNode<GenericDeclaration>(generic_parameters, declaration);
+    result =
+        MakeNode<GenericCallableDeclaration>(generic_parameters, declaration);
   }
   return ParseResult{result};
 }
@@ -543,7 +572,8 @@ base::Optional<ParseResult> MakeTorqueMacroDeclaration(
     if (!body) ReportError("A non-generic declaration needs a body.");
   } else {
     if (export_to_csa) ReportError("Cannot export generics to CSA.");
-    result = MakeNode<GenericDeclaration>(generic_parameters, declaration);
+    result =
+        MakeNode<GenericCallableDeclaration>(generic_parameters, declaration);
   }
   return ParseResult{result};
 }
@@ -569,7 +599,8 @@ base::Optional<ParseResult> MakeTorqueBuiltinDeclaration(
   if (generic_parameters.empty()) {
     if (!body) ReportError("A non-generic declaration needs a body.");
   } else {
-    result = MakeNode<GenericDeclaration>(generic_parameters, declaration);
+    result =
+        MakeNode<GenericCallableDeclaration>(generic_parameters, declaration);
   }
   return ParseResult{result};
 }
@@ -612,10 +643,15 @@ base::Optional<ParseResult> MakeAbstractTypeDeclaration(
   if (!IsValidTypeName(name->value)) {
     NamingConventionError("Type", name, "UpperCamelCase");
   }
+  auto generic_parameters = child_results->NextAs<GenericParameters>();
   auto extends = child_results->NextAs<base::Optional<Identifier*>>();
   auto generates = child_results->NextAs<base::Optional<std::string>>();
-  Declaration* decl = MakeNode<AbstractTypeDeclaration>(
+  TypeDeclaration* type_decl = MakeNode<AbstractTypeDeclaration>(
       name, transient, extends, std::move(generates));
+  Declaration* decl = type_decl;
+  if (!generic_parameters.empty()) {
+    decl = MakeNode<GenericTypeDeclaration>(generic_parameters, type_decl);
+  }
 
   auto constexpr_generates =
       child_results->NextAs<base::Optional<std::string>>();
@@ -633,10 +669,15 @@ base::Optional<ParseResult> MakeAbstractTypeDeclaration(
           MakeNode<Identifier>(CONSTEXPR_TYPE_PREFIX + (*extends)->value);
       (*constexpr_extends)->pos = name->pos;
     }
-    AbstractTypeDeclaration* constexpr_decl = MakeNode<AbstractTypeDeclaration>(
+    TypeDeclaration* constexpr_decl = MakeNode<AbstractTypeDeclaration>(
         constexpr_name, transient, constexpr_extends, constexpr_generates);
     constexpr_decl->pos = name->pos;
-    result.push_back(constexpr_decl);
+    Declaration* decl = constexpr_decl;
+    if (!generic_parameters.empty()) {
+      decl =
+          MakeNode<GenericTypeDeclaration>(generic_parameters, constexpr_decl);
+    }
+    result.push_back(decl);
   }
 
   return ParseResult{result};
@@ -702,45 +743,70 @@ class AnnotationSet {
   bool Contains(const std::string& s) const {
     return set_.find(s) != set_.end();
   }
-  base::Optional<std::pair<std::string, SourcePosition>> GetParam(
-      const std::string& s) const {
+  base::Optional<std::string> GetStringParam(const std::string& s) const {
+    auto it = map_.find(s);
+    if (it == map_.end()) {
+      return {};
+    }
+    if (it->second.first.is_int) {
+      Error("Annotation ", s, " requires a string parameter but has an int")
+          .Position(it->second.second);
+    }
+    return it->second.first.string_value;
+  }
+  base::Optional<int32_t> GetIntParam(const std::string& s) const {
     auto it = map_.find(s);
-    return it == map_.end()
-               ? base::Optional<std::pair<std::string, SourcePosition>>()
-               : it->second;
+    if (it == map_.end()) {
+      return {};
+    }
+    if (!it->second.first.is_int) {
+      Error("Annotation ", s, " requires an int parameter but has a string")
+          .Position(it->second.second);
+    }
+    return it->second.first.int_value;
   }
 
  private:
   std::set<std::string> set_;
-  std::map<std::string, std::pair<std::string, SourcePosition>> map_;
+  std::map<std::string, std::pair<AnnotationParameter, SourcePosition>> map_;
 };
 
-int GetAnnotationValue(const AnnotationSet& annotations, const char* name,
-                       int default_value) {
-  auto value_and_pos = annotations.GetParam(name);
-  if (!value_and_pos.has_value()) return default_value;
-  const std::string& value = value_and_pos->first;
-  SourcePosition pos = value_and_pos->second;
-  if (value.empty()) {
-    Error("Annotation ", name, " requires an integer parameter").Position(pos);
-  }
+base::Optional<ParseResult> MakeInt32(ParseResultIterator* child_results) {
+  std::string value = child_results->NextAs<std::string>();
   size_t num_chars_converted = 0;
-  int result = default_value;
+  int result = 0;
   try {
     result = std::stoi(value, &num_chars_converted, 0);
   } catch (const std::invalid_argument&) {
-    Error("Expected an integer for annotation ", name).Position(pos);
-    return result;
+    Error("Expected an integer");
+    return ParseResult{result};
   } catch (const std::out_of_range&) {
-    Error("Integer out of 32-bit range in annotation ", name).Position(pos);
-    return result;
+    Error("Integer out of 32-bit range");
+    return ParseResult{result};
   }
-  if (num_chars_converted != value.size()) {
-    Error("Parameter for annotation ", name,
-          " must be an integer with no trailing characters")
-        .Position(pos);
-  }
-  return result;
+  // Tokenizer shouldn't have included extra trailing characters.
+  DCHECK_EQ(num_chars_converted, value.size());
+  return ParseResult{result};
+}
+
+base::Optional<ParseResult> MakeStringAnnotationParameter(
+    ParseResultIterator* child_results) {
+  std::string value = child_results->NextAs<std::string>();
+  AnnotationParameter result{value, 0, false};
+  return ParseResult{result};
+}
+
+base::Optional<ParseResult> MakeIntAnnotationParameter(
+    ParseResultIterator* child_results) {
+  int32_t value = child_results->NextAs<int32_t>();
+  AnnotationParameter result{"", value, true};
+  return ParseResult{result};
+}
+
+int GetAnnotationValue(const AnnotationSet& annotations, const char* name,
+                       int default_value) {
+  auto opt_value = annotations.GetIntParam(name);
+  return opt_value.has_value() ? *opt_value : default_value;
 }
 
 InstanceTypeConstraints MakeInstanceTypeConstraints(
@@ -766,7 +832,6 @@ base::Optional<ParseResult> MakeClassDeclaration(
   AnnotationSet annotations(
       child_results,
       {ANNOTATION_GENERATE_PRINT, ANNOTATION_NO_VERIFIER, ANNOTATION_ABSTRACT,
-       ANNOTATION_INSTANTIATED_ABSTRACT_CLASS,
        ANNOTATION_HAS_SAME_INSTANCE_TYPE_AS_PARENT,
        ANNOTATION_GENERATE_CPP_CLASS,
        ANNOTATION_HIGHEST_INSTANCE_TYPE_WITHIN_PARENT,
@@ -781,9 +846,6 @@ base::Optional<ParseResult> MakeClassDeclaration(
   if (annotations.Contains(ANNOTATION_ABSTRACT)) {
     flags |= ClassFlag::kAbstract;
   }
-  if (annotations.Contains(ANNOTATION_INSTANTIATED_ABSTRACT_CLASS)) {
-    flags |= ClassFlag::kInstantiatedAbstractClass;
-  }
   if (annotations.Contains(ANNOTATION_HAS_SAME_INSTANCE_TYPE_AS_PARENT)) {
     flags |= ClassFlag::kHasSameInstanceTypeAsParent;
   }
@@ -801,6 +863,14 @@ base::Optional<ParseResult> MakeClassDeclaration(
   if (is_extern) flags |= ClassFlag::kExtern;
   auto transient = child_results->NextAs<bool>();
   if (transient) flags |= ClassFlag::kTransient;
+  std::string kind = child_results->NextAs<Identifier*>()->value;
+  if (kind == "shape") {
+    flags |= ClassFlag::kIsShape;
+    flags |= ClassFlag::kTransient;
+    flags |= ClassFlag::kHasSameInstanceTypeAsParent;
+  } else {
+    DCHECK_EQ(kind, "class");
+  }
   auto name = child_results->NextAs<Identifier*>();
   if (!IsValidTypeName(name->value)) {
     NamingConventionError("Type", name, "UpperCamelCase");
@@ -873,6 +943,10 @@ base::Optional<ParseResult> MakeSpecializationDeclaration(
 
 base::Optional<ParseResult> MakeStructDeclaration(
     ParseResultIterator* child_results) {
+  bool is_export = child_results->NextAs<bool>();
+  StructFlags flags = StructFlag::kNone;
+  if (is_export) flags |= StructFlag::kExport;
+
   auto name = child_results->NextAs<Identifier*>();
   if (!IsValidTypeName(name->value)) {
     NamingConventionError("Struct", name, "UpperCamelCase");
@@ -881,12 +955,28 @@ base::Optional<ParseResult> MakeStructDeclaration(
   LintGenericParameters(generic_parameters);
   auto methods = child_results->NextAs<std::vector<Declaration*>>();
   auto fields = child_results->NextAs<std::vector<StructFieldExpression>>();
-  Declaration* result =
-      MakeNode<StructDeclaration>(name, std::move(methods), std::move(fields),
-                                  std::move(generic_parameters));
+  TypeDeclaration* struct_decl = MakeNode<StructDeclaration>(
+      flags, name, std::move(methods), std::move(fields));
+  Declaration* result = struct_decl;
+  if (!generic_parameters.empty()) {
+    result = MakeNode<GenericTypeDeclaration>(generic_parameters, struct_decl);
+  }
   return ParseResult{result};
 }
 
+base::Optional<ParseResult> MakeBitFieldStructDeclaration(
+    ParseResultIterator* child_results) {
+  auto name = child_results->NextAs<Identifier*>();
+  if (!IsValidTypeName(name->value)) {
+    NamingConventionError("Bitfield struct", name, "UpperCamelCase");
+  }
+  auto extends = child_results->NextAs<TypeExpression*>();
+  auto fields = child_results->NextAs<std::vector<BitFieldDeclaration>>();
+  Declaration* decl =
+      MakeNode<BitFieldStructDeclaration>(name, extends, std::move(fields));
+  return ParseResult{decl};
+}
+
 base::Optional<ParseResult> MakeCppIncludeDeclaration(
     ParseResultIterator* child_results) {
   auto include_path = child_results->NextAs<std::string>();
@@ -992,6 +1082,13 @@ base::Optional<ParseResult> MakeUnionTypeExpression(
   return ParseResult{result};
 }
 
+base::Optional<ParseResult> MakeGenericParameter(
+    ParseResultIterator* child_results) {
+  auto name = child_results->NextAs<Identifier*>();
+  auto constraint = child_results->NextAs<base::Optional<TypeExpression*>>();
+  return ParseResult{GenericParameter{name, constraint}};
+}
+
 base::Optional<ParseResult> MakeExpressionStatement(
     ParseResultIterator* child_results) {
   auto expression = child_results->NextAs<Expression*>();
@@ -1022,6 +1119,187 @@ base::Optional<ParseResult> MakeIfStatement(
   return ParseResult{result};
 }
 
+base::Optional<ParseResult> MakeEnumDeclaration(
+    ParseResultIterator* child_results) {
+  const bool is_extern = child_results->NextAs<bool>();
+  auto name_identifier = child_results->NextAs<Identifier*>();
+  auto name = name_identifier->value;
+  auto base_identifier = child_results->NextAs<base::Optional<Identifier*>>();
+  auto constexpr_generates_opt =
+      child_results->NextAs<base::Optional<std::string>>();
+  auto entries = child_results->NextAs<std::vector<Identifier*>>();
+  const bool is_open = child_results->NextAs<bool>();
+  CurrentSourcePosition::Scope current_source_position(
+      child_results->matched_input().pos);
+
+  if (!is_extern) {
+    ReportError("non-extern enums are not supported yet");
+  }
+
+  if (!IsValidTypeName(name)) {
+    NamingConventionError("Type", name, "UpperCamelCase");
+  }
+
+  auto constexpr_generates =
+      constexpr_generates_opt ? *constexpr_generates_opt : name;
+  const bool generate_nonconstexpr = base_identifier.has_value();
+
+  std::vector<Declaration*> result;
+  // Build non-constexpr types.
+  if (generate_nonconstexpr) {
+    DCHECK(base_identifier.has_value());
+
+    if (is_open) {
+      // For open enumerations, we define an abstract type and inherit all
+      // entries' types from that:
+      //   type Enum extends Base;
+      //   namespace Enum {
+      //     type kEntry0 extends Enum;
+      //     ...
+      //     type kEntryN extends Enum;
+      //   }
+      auto type_decl = MakeNode<AbstractTypeDeclaration>(
+          name_identifier, false, base_identifier, base::nullopt);
+
+      std::vector<Declaration*> entry_decls;
+      for (const auto& entry_name_identifier : entries) {
+        entry_decls.push_back(MakeNode<AbstractTypeDeclaration>(
+            entry_name_identifier, false, name_identifier, base::nullopt));
+      }
+
+      result.push_back(type_decl);
+      result.push_back(
+          MakeNode<NamespaceDeclaration>(name, std::move(entry_decls)));
+    } else {
+      // For closed enumerations, we define abstract types for all entries and
+      // define the enumeration as a union of those:
+      //   namespace Enum {
+      //     type kEntry0 extends Base;
+      //     ...
+      //     type kEntryN extends Base;
+      //   }
+      //   type Enum = Enum::kEntry0 | ... | Enum::kEntryN;
+      TypeExpression* union_type = nullptr;
+      std::vector<Declaration*> entry_decls;
+      for (const auto& entry_name_identifier : entries) {
+        entry_decls.push_back(MakeNode<AbstractTypeDeclaration>(
+            entry_name_identifier, false, base_identifier, base::nullopt));
+
+        auto entry_type = MakeNode<BasicTypeExpression>(
+            std::vector<std::string>{name}, entry_name_identifier->value,
+            std::vector<TypeExpression*>{});
+        if (union_type) {
+          union_type = MakeNode<UnionTypeExpression>(union_type, entry_type);
+        } else {
+          union_type = entry_type;
+        }
+      }
+
+      result.push_back(
+          MakeNode<NamespaceDeclaration>(name, std::move(entry_decls)));
+      result.push_back(
+          MakeNode<TypeAliasDeclaration>(name_identifier, union_type));
+    }
+  }
+
+  // Build constexpr types.
+  {
+    // The constexpr entries inherit from an abstract enumeration type:
+    //   type constexpr Enum extends constexpr Base;
+    //   namespace Enum {
+    //     type constexpr kEntry0 extends constexpr Enum;
+    //     ...
+    //     type constexpr kEntry1 extends constexpr Enum;
+    //   }
+    Identifier* constexpr_type_identifier =
+        MakeNode<Identifier>(std::string(CONSTEXPR_TYPE_PREFIX) + name);
+    base::Optional<Identifier*> base_constexpr_type_identifier = base::nullopt;
+    if (base_identifier) {
+      base_constexpr_type_identifier = MakeNode<Identifier>(
+          std::string(CONSTEXPR_TYPE_PREFIX) + (*base_identifier)->value);
+    }
+    result.push_back(MakeNode<AbstractTypeDeclaration>(
+        constexpr_type_identifier, false, base_constexpr_type_identifier,
+        constexpr_generates));
+
+    TypeExpression* type_expr = nullptr;
+    Identifier* fromconstexpr_identifier = nullptr;
+    Identifier* fromconstexpr_parameter_identifier = nullptr;
+    Statement* fromconstexpr_body = nullptr;
+    if (generate_nonconstexpr) {
+      DCHECK(base_identifier.has_value());
+      TypeExpression* base_type_expr = MakeNode<BasicTypeExpression>(
+          std::vector<std::string>{}, (*base_identifier)->value,
+          std::vector<TypeExpression*>{});
+      type_expr = MakeNode<BasicTypeExpression>(
+          std::vector<std::string>{}, name, std::vector<TypeExpression*>{});
+
+      // return %RawDownCast<Enum>(%FromConstexpr<Base>(o)))
+      fromconstexpr_identifier = MakeNode<Identifier>("FromConstexpr");
+      fromconstexpr_parameter_identifier = MakeNode<Identifier>("o");
+      fromconstexpr_body =
+          MakeNode<ReturnStatement>(MakeNode<IntrinsicCallExpression>(
+              MakeNode<Identifier>("%RawDownCast"),
+              std::vector<TypeExpression*>{type_expr},
+              std::vector<Expression*>{MakeNode<IntrinsicCallExpression>(
+                  MakeNode<Identifier>("%FromConstexpr"),
+                  std::vector<TypeExpression*>{base_type_expr},
+                  std::vector<Expression*>{MakeNode<IdentifierExpression>(
+                      std::vector<std::string>{},
+                      fromconstexpr_parameter_identifier)})}));
+    }
+
+    EnumDescription enum_description{CurrentSourcePosition::Get(), name,
+                                     constexpr_generates, is_open};
+    std::vector<Declaration*> entry_decls;
+    for (const auto& entry_name_identifier : entries) {
+      const std::string entry_name = entry_name_identifier->value;
+      const std::string entry_constexpr_type =
+          std::string(CONSTEXPR_TYPE_PREFIX) + entry_name;
+      enum_description.entries.push_back(constexpr_generates +
+                                         "::" + entry_name);
+
+      entry_decls.push_back(MakeNode<AbstractTypeDeclaration>(
+          MakeNode<Identifier>(entry_constexpr_type), false,
+          constexpr_type_identifier, constexpr_generates));
+
+      // namespace Enum {
+      //   const kEntry0: constexpr kEntry0 constexpr 'Enum::kEntry0';
+      // }
+      entry_decls.push_back(MakeNode<ExternConstDeclaration>(
+          entry_name_identifier,
+          MakeNode<BasicTypeExpression>(std::vector<std::string>{},
+                                        entry_constexpr_type,
+                                        std::vector<TypeExpression*>{}),
+          constexpr_generates + "::" + entry_name));
+
+      // FromConstexpr<Enum, Enum::constexpr kEntry0>(
+      //   : Enum::constexpr kEntry0): Enum
+      if (generate_nonconstexpr) {
+        TypeExpression* entry_constexpr_type_expr =
+            MakeNode<BasicTypeExpression>(std::vector<std::string>{name},
+                                          entry_constexpr_type,
+                                          std::vector<TypeExpression*>{});
+
+        ParameterList parameters;
+        parameters.names.push_back(fromconstexpr_parameter_identifier);
+        parameters.types.push_back(entry_constexpr_type_expr);
+        result.push_back(MakeNode<SpecializationDeclaration>(
+            false, fromconstexpr_identifier,
+            std::vector<TypeExpression*>{type_expr, entry_constexpr_type_expr},
+            std::move(parameters), type_expr, LabelAndTypesVector{},
+            fromconstexpr_body));
+      }
+    }
+
+    result.push_back(
+        MakeNode<NamespaceDeclaration>(name, std::move(entry_decls)));
+    CurrentAst::Get().AddEnumDescription(std::move(enum_description));
+  }
+
+  return ParseResult{std::move(result)};
+}
+
 base::Optional<ParseResult> MakeTypeswitchStatement(
     ParseResultIterator* child_results) {
   auto expression = child_results->NextAs<Expression*>();
@@ -1299,6 +1577,16 @@ base::Optional<ParseResult> MakeFieldAccessExpression(
   return ParseResult{result};
 }
 
+base::Optional<ParseResult> MakeReferenceFieldAccessExpression(
+    ParseResultIterator* child_results) {
+  auto object = child_results->NextAs<Expression*>();
+  auto field = child_results->NextAs<Identifier*>();
+  // `a->b` is equivalent to `(*a).b`.
+  Expression* deref = MakeNode<DereferenceExpression>(object);
+  Expression* result = MakeNode<FieldAccessExpression>(deref, field);
+  return ParseResult{result};
+}
+
 base::Optional<ParseResult> MakeElementAccessExpression(
     ParseResultIterator* child_results) {
   auto object = child_results->NextAs<Expression*>();
@@ -1336,7 +1624,15 @@ base::Optional<ParseResult> MakeAssignmentExpression(
 base::Optional<ParseResult> MakeNumberLiteralExpression(
     ParseResultIterator* child_results) {
   auto number = child_results->NextAs<std::string>();
-  Expression* result = MakeNode<NumberLiteralExpression>(std::move(number));
+  // TODO(tebbi): Support 64bit literals.
+  // Meanwhile, we type it as constexpr float64 when out of int32 range.
+  double value = 0;
+  try {
+    value = std::stod(number);
+  } catch (const std::out_of_range&) {
+    Error("double literal out-of-range").Throw();
+  }
+  Expression* result = MakeNode<NumberLiteralExpression>(value);
   return ParseResult{result};
 }
 
@@ -1431,7 +1727,7 @@ base::Optional<ParseResult> MakeNameAndExpressionFromExpression(
 base::Optional<ParseResult> MakeAnnotation(ParseResultIterator* child_results) {
   return ParseResult{
       Annotation{child_results->NextAs<Identifier*>(),
-                 child_results->NextAs<base::Optional<std::string>>()}};
+                 child_results->NextAs<base::Optional<AnnotationParameter>>()}};
 }
 
 base::Optional<ParseResult> MakeClassField(ParseResultIterator* child_results) {
@@ -1439,22 +1735,21 @@ base::Optional<ParseResult> MakeClassField(ParseResultIterator* child_results) {
                             {ANNOTATION_IF, ANNOTATION_IFNOT});
   bool generate_verify = !annotations.Contains(ANNOTATION_NO_VERIFIER);
   std::vector<ConditionalAnnotation> conditions;
-  base::Optional<std::pair<std::string, SourcePosition>> if_condition =
-      annotations.GetParam(ANNOTATION_IF);
-  base::Optional<std::pair<std::string, SourcePosition>> ifnot_condition =
-      annotations.GetParam(ANNOTATION_IFNOT);
+  base::Optional<std::string> if_condition =
+      annotations.GetStringParam(ANNOTATION_IF);
+  base::Optional<std::string> ifnot_condition =
+      annotations.GetStringParam(ANNOTATION_IFNOT);
   if (if_condition.has_value()) {
-    conditions.push_back(
-        {if_condition->first, ConditionalAnnotationType::kPositive});
+    conditions.push_back({*if_condition, ConditionalAnnotationType::kPositive});
   }
   if (ifnot_condition.has_value()) {
     conditions.push_back(
-        {ifnot_condition->first, ConditionalAnnotationType::kNegative});
+        {*ifnot_condition, ConditionalAnnotationType::kNegative});
   }
   auto weak = child_results->NextAs<bool>();
   auto const_qualified = child_results->NextAs<bool>();
   auto name = child_results->NextAs<Identifier*>();
-  auto index = child_results->NextAs<base::Optional<std::string>>();
+  auto index = child_results->NextAs<base::Optional<Expression*>>();
   auto type = child_results->NextAs<TypeExpression*>();
   return ParseResult{ClassFieldExpression{{name, type},
                                           index,
@@ -1472,6 +1767,14 @@ base::Optional<ParseResult> MakeStructField(
   return ParseResult{StructFieldExpression{{name, type}, const_qualified}};
 }
 
+base::Optional<ParseResult> MakeBitFieldDeclaration(
+    ParseResultIterator* child_results) {
+  auto name = child_results->NextAs<Identifier*>();
+  auto type = child_results->NextAs<TypeExpression*>();
+  auto num_bits = child_results->NextAs<int32_t>();
+  return ParseResult{BitFieldDeclaration{{name, type}, num_bits}};
+}
+
 base::Optional<ParseResult> ExtractAssignmentOperator(
     ParseResultIterator* child_results) {
   auto op = child_results->NextAs<Identifier*>();
@@ -1579,6 +1882,9 @@ struct TorqueGrammar : Grammar {
 
   TorqueGrammar() : Grammar(&file) { SetWhitespace(MatchWhitespace); }
 
+  // Result: Expression*
+  Symbol* expression = &assignmentExpression;
+
   // Result: std::string
   Symbol identifier = {Rule({Pattern(MatchIdentifier)}, YieldMatchedInput),
                        Rule({Token("runtime")}, YieldMatchedInput)};
@@ -1606,18 +1912,23 @@ struct TorqueGrammar : Grammar {
       Rule({Pattern(MatchDecimalLiteral)}, YieldMatchedInput),
       Rule({Pattern(MatchHexLiteral)}, YieldMatchedInput)};
 
-  // Result: std::string
-  Symbol annotationParameter = {Rule({&identifier}), Rule({&decimalLiteral}),
-                                Rule({&externalString})};
+  // Result: int32_t
+  Symbol int32Literal = {Rule({&decimalLiteral}, MakeInt32)};
 
-  // Result: std::string
+  // Result: AnnotationParameter
+  Symbol annotationParameter = {
+      Rule({&identifier}, MakeStringAnnotationParameter),
+      Rule({&int32Literal}, MakeIntAnnotationParameter),
+      Rule({&externalString}, MakeStringAnnotationParameter)};
+
+  // Result: AnnotationParameter
   Symbol annotationParameters = {
       Rule({Token("("), &annotationParameter, Token(")")})};
 
   // Result: Annotation
-  Symbol annotation = {
-      Rule({&annotationName, Optional<std::string>(&annotationParameters)},
-           MakeAnnotation)};
+  Symbol annotation = {Rule(
+      {&annotationName, Optional<AnnotationParameter>(&annotationParameters)},
+      MakeAnnotation)};
 
   // Result: std::vector<Annotation>
   Symbol* annotations = List<Annotation>(&annotation);
@@ -1642,18 +1953,22 @@ struct TorqueGrammar : Grammar {
   Symbol type = {Rule({&simpleType}), Rule({&type, Token("|"), &simpleType},
                                            MakeUnionTypeExpression)};
 
+  // Result: GenericParameter
+  Symbol genericParameter = {
+      Rule({&name, Token(":"), Token("type"),
+            Optional<TypeExpression*>(Sequence({Token("extends"), &type}))},
+           MakeGenericParameter)};
+
   // Result: GenericParameters
   Symbol genericParameters = {
-      Rule({Token("<"),
-            List<Identifier*>(Sequence({&name, Token(":"), Token("type")}),
-                              Token(",")),
+      Rule({Token("<"), List<GenericParameter>(&genericParameter, Token(",")),
             Token(">")})};
 
   // Result: TypeList
   Symbol genericSpecializationTypeList = {
       Rule({Token("<"), typeList, Token(">")})};
 
-  // Result: base::Optional<TypeList>
+  // Result: base::Optional<GenericParameters>
   Symbol* optionalGenericParameters = Optional<TypeList>(&genericParameters);
 
   Symbol implicitParameterList{
@@ -1696,18 +2011,26 @@ struct TorqueGrammar : Grammar {
   // Result: NameAndTypeExpression
   Symbol nameAndType = {Rule({&name, Token(":"), &type}, MakeNameAndType)};
 
+  // Result: base::Optional<Expression*>
   Symbol* optionalArraySpecifier =
-      Optional<std::string>(Sequence({Token("["), &identifier, Token("]")}));
+      Optional<Expression*>(Sequence({Token("["), expression, Token("]")}));
 
+  // Result: ClassFieldExpression
   Symbol classField = {
       Rule({annotations, CheckIf(Token("weak")), CheckIf(Token("const")), &name,
             optionalArraySpecifier, Token(":"), &type, Token(";")},
            MakeClassField)};
 
+  // Result: StructFieldExpression
   Symbol structField = {
       Rule({CheckIf(Token("const")), &name, Token(":"), &type, Token(";")},
            MakeStructField)};
 
+  // Result: BitFieldDeclaration
+  Symbol bitFieldDeclaration = {Rule({&name, Token(":"), &type, Token(":"),
+                                      &int32Literal, Token("bit"), Token(";")},
+                                     MakeBitFieldDeclaration)};
+
   // Result: ParameterList
   Symbol parameterListNoVararg = {
       Rule({optionalImplicitParameterList, Token("("),
@@ -1739,9 +2062,6 @@ struct TorqueGrammar : Grammar {
     return result;
   }
 
-  // Result: Expression*
-  Symbol* expression = &assignmentExpression;
-
   // Result: IncrementDecrementOperator
   Symbol incrementDecrementOperator = {
       Rule({Token("++")},
@@ -1795,6 +2115,8 @@ struct TorqueGrammar : Grammar {
       Rule({&intrinsicCallExpression}),
       Rule({&identifierExpression}),
       Rule({&primaryExpression, Token("."), &name}, MakeFieldAccessExpression),
+      Rule({&primaryExpression, Token("->"), &name},
+           MakeReferenceFieldAccessExpression),
       Rule({&primaryExpression, Token("["), expression, Token("]")},
            MakeElementAccessExpression),
       Rule({&decimalLiteral}, MakeNumberLiteralExpression),
@@ -1972,8 +2294,8 @@ struct TorqueGrammar : Grammar {
   Symbol method = {Rule(
       {CheckIf(Token("transitioning")),
        Optional<std::string>(Sequence({Token("operator"), &externalString})),
-       &name, &parameterListNoVararg, &optionalReturnType, optionalLabelList,
-       &block},
+       Token("macro"), &name, &parameterListNoVararg, &optionalReturnType,
+       optionalLabelList, &block},
       MakeMethodDeclaration)};
 
   // Result: base::Optional<ClassBody*>
@@ -1992,18 +2314,23 @@ struct TorqueGrammar : Grammar {
             &externalString, Token(";")},
            AsSingletonVector<Declaration*, MakeExternConstDeclaration>()),
       Rule({annotations, CheckIf(Token("extern")), CheckIf(Token("transient")),
-            Token("class"), &name,
+            OneOf({"class", "shape"}), &name,
             Optional<TypeExpression*>(Sequence({Token("extends"), &type})),
             Optional<std::string>(
                 Sequence({Token("generates"), &externalString})),
             &optionalClassBody},
            AsSingletonVector<Declaration*, MakeClassDeclaration>()),
-      Rule({Token("struct"), &name,
+      Rule({CheckIf(Token("@export")), Token("struct"), &name,
             TryOrDefault<GenericParameters>(&genericParameters), Token("{"),
             List<Declaration*>(&method),
             List<StructFieldExpression>(&structField), Token("}")},
            AsSingletonVector<Declaration*, MakeStructDeclaration>()),
+      Rule({Token("bitfield"), Token("struct"), &name, Token("extends"), &type,
+            Token("{"), List<BitFieldDeclaration>(&bitFieldDeclaration),
+            Token("}")},
+           AsSingletonVector<Declaration*, MakeBitFieldStructDeclaration>()),
       Rule({CheckIf(Token("transient")), Token("type"), &name,
+            TryOrDefault<GenericParameters>(&genericParameters),
             Optional<Identifier*>(Sequence({Token("extends"), &name})),
             Optional<std::string>(
                 Sequence({Token("generates"), &externalString})),
@@ -2052,7 +2379,14 @@ struct TorqueGrammar : Grammar {
             &optionalReturnType, optionalLabelList, &block},
            AsSingletonVector<Declaration*, MakeSpecializationDeclaration>()),
       Rule({Token("#include"), &externalString},
-           AsSingletonVector<Declaration*, MakeCppIncludeDeclaration>())};
+           AsSingletonVector<Declaration*, MakeCppIncludeDeclaration>()),
+      Rule({CheckIf(Token("extern")), Token("enum"), &name,
+            Optional<Identifier*>(Sequence({Token("extends"), &name})),
+            Optional<std::string>(
+                Sequence({Token("constexpr"), &externalString})),
+            Token("{"), NonemptyList<Identifier*>(&name, Token(",")),
+            CheckIf(Sequence({Token(","), Token("...")})), Token("}")},
+           MakeEnumDeclaration)};
 
   // Result: std::vector<Declaration*>
   Symbol declarationList = {
diff --git a/deps/v8/src/torque/type-inference.cc b/deps/v8/src/torque/type-inference.cc
index abd875f4f6c943..ac7b5ae307220c 100644
--- a/deps/v8/src/torque/type-inference.cc
+++ b/deps/v8/src/torque/type-inference.cc
@@ -9,7 +9,7 @@ namespace internal {
 namespace torque {
 
 TypeArgumentInference::TypeArgumentInference(
-    const NameVector& type_parameters,
+    const GenericParameters& type_parameters,
     const TypeVector& explicit_type_arguments,
     const std::vector<TypeExpression*>& term_parameters,
     const TypeVector& term_argument_types)
@@ -26,7 +26,7 @@ TypeArgumentInference::TypeArgumentInference(
   }
 
   for (size_t i = 0; i < type_parameters.size(); i++) {
-    type_parameter_from_name_[type_parameters[i]->value] = i;
+    type_parameter_from_name_[type_parameters[i].name->value] = i;
   }
   for (size_t i = 0; i < num_explicit_; i++) {
     inferred_[i] = {explicit_type_arguments[i]};
@@ -78,10 +78,7 @@ void TypeArgumentInference::Match(TypeExpression* parameter,
     }
     // Try to recurse in case of generic types
     if (!basic->generic_arguments.empty()) {
-      auto* argument_struct_type = StructType::DynamicCast(argument_type);
-      if (argument_struct_type) {
-        MatchGeneric(basic, argument_struct_type);
-      }
+      MatchGeneric(basic, argument_type);
     }
     // NOTE: We could also check whether ground parameter types match the
     // argument types, but we are only interested in inferring type arguments
@@ -92,13 +89,13 @@ void TypeArgumentInference::Match(TypeExpression* parameter,
 }
 
 void TypeArgumentInference::MatchGeneric(BasicTypeExpression* parameter,
-                                         const StructType* argument_type) {
+                                         const Type* argument_type) {
   QualifiedName qualified_name{parameter->namespace_qualification,
                                parameter->name};
-  GenericStructType* generic_struct =
-      Declarations::LookupUniqueGenericStructType(qualified_name);
+  GenericType* generic_type =
+      Declarations::LookupUniqueGenericType(qualified_name);
   auto& specialized_from = argument_type->GetSpecializedFrom();
-  if (!specialized_from || specialized_from->generic != generic_struct) {
+  if (!specialized_from || specialized_from->generic != generic_type) {
     return Fail("found conflicting generic type constructors");
   }
   auto& parameters = parameter->generic_arguments;
diff --git a/deps/v8/src/torque/type-inference.h b/deps/v8/src/torque/type-inference.h
index 671d68cce5dda1..125f8f25276afd 100644
--- a/deps/v8/src/torque/type-inference.h
+++ b/deps/v8/src/torque/type-inference.h
@@ -55,26 +55,24 @@ namespace torque {
 // should be instantiated in the appropriate scope.
 class TypeArgumentInference {
  public:
-  TypeArgumentInference(const NameVector& type_parameters,
+  TypeArgumentInference(const GenericParameters& type_parameters,
                         const TypeVector& explicit_type_arguments,
                         const std::vector<TypeExpression*>& term_parameters,
                         const TypeVector& term_argument_types);
 
   bool HasFailed() const { return failure_reason_.has_value(); }
-  const char* GetFailureReason() { return *failure_reason_; }
+  const std::string& GetFailureReason() { return *failure_reason_; }
   TypeVector GetResult() const;
+  void Fail(std::string reason) { failure_reason_ = {reason}; }
 
  private:
-  void Fail(const char* reason) { failure_reason_ = {reason}; }
-
   void Match(TypeExpression* parameter, const Type* argument_type);
-  void MatchGeneric(BasicTypeExpression* parameter,
-                    const StructType* argument_type);
+  void MatchGeneric(BasicTypeExpression* parameter, const Type* argument_type);
 
   size_t num_explicit_;
   std::unordered_map<std::string, size_t> type_parameter_from_name_;
   std::vector<base::Optional<const Type*>> inferred_;
-  base::Optional<const char*> failure_reason_;
+  base::Optional<std::string> failure_reason_;
 };
 
 }  // namespace torque
diff --git a/deps/v8/src/torque/type-oracle.cc b/deps/v8/src/torque/type-oracle.cc
index c7e11c2165caf5..0e5a8a7b6b59dd 100644
--- a/deps/v8/src/torque/type-oracle.cc
+++ b/deps/v8/src/torque/type-oracle.cc
@@ -12,40 +12,62 @@ namespace torque {
 DEFINE_CONTEXTUAL_VARIABLE(TypeOracle)
 
 // static
-const std::vector<std::unique_ptr<AggregateType>>*
+const std::vector<std::unique_ptr<AggregateType>>&
 TypeOracle::GetAggregateTypes() {
-  return &Get().aggregate_types_;
+  return Get().aggregate_types_;
+}
+
+// static
+const std::vector<std::unique_ptr<BitFieldStructType>>&
+TypeOracle::GetBitFieldStructTypes() {
+  return Get().bit_field_struct_types_;
 }
 
 // static
 void TypeOracle::FinalizeAggregateTypes() {
-  for (const std::unique_ptr<AggregateType>& p : Get().aggregate_types_) {
+  size_t current = 0;
+  while (current != Get().aggregate_types_.size()) {
+    auto& p = Get().aggregate_types_[current++];
     p->Finalize();
   }
 }
 
 // static
-const StructType* TypeOracle::GetGenericStructTypeInstance(
-    GenericStructType* generic_struct, TypeVector arg_types) {
-  auto& params = generic_struct->generic_parameters();
-  auto& specializations = generic_struct->specializations();
+const Type* TypeOracle::GetGenericTypeInstance(GenericType* generic_type,
+                                               TypeVector arg_types) {
+  auto& params = generic_type->generic_parameters();
 
   if (params.size() != arg_types.size()) {
     ReportError("Generic struct takes ", params.size(), " parameters, but ",
                 arg_types.size(), " were given");
   }
 
-  if (auto specialization = specializations.Get(arg_types)) {
+  if (auto specialization = generic_type->GetSpecialization(arg_types)) {
     return *specialization;
   } else {
-    CurrentScope::Scope generic_scope(generic_struct->ParentScope());
-    auto struct_type = TypeVisitor::ComputeType(generic_struct->declaration(),
-                                                {{generic_struct, arg_types}});
-    specializations.Add(arg_types, struct_type);
-    return struct_type;
+    const Type* type = nullptr;
+    // AddSpecialization can raise an error, which should be reported in the
+    // scope of the code requesting the specialization, not the generic type's
+    // parent scope, hence the following block.
+    {
+      v8::internal::torque::Scope* requester_scope = CurrentScope::Get();
+      CurrentScope::Scope generic_scope(generic_type->ParentScope());
+      type = TypeVisitor::ComputeType(generic_type->declaration(),
+                                      {{generic_type, arg_types}},
+                                      requester_scope);
+    }
+    generic_type->AddSpecialization(arg_types, type);
+    return type;
   }
 }
 
+// static
+Namespace* TypeOracle::CreateGenericTypeInstantiationNamespace() {
+  Get().generic_type_instantiation_namespaces_.push_back(
+      std::make_unique<Namespace>(GENERIC_TYPE_INSTANTIATION_NAMESPACE_STRING));
+  return Get().generic_type_instantiation_namespaces_.back().get();
+}
+
 }  // namespace torque
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/torque/type-oracle.h b/deps/v8/src/torque/type-oracle.h
index 03aad34d2ae1e5..04a78d872e01aa 100644
--- a/deps/v8/src/torque/type-oracle.h
+++ b/deps/v8/src/torque/type-oracle.h
@@ -20,25 +20,36 @@ namespace torque {
 class TypeOracle : public ContextualClass<TypeOracle> {
  public:
   static const AbstractType* GetAbstractType(
-      const Type* parent, std::string name, bool transient,
-      std::string generated, const AbstractType* non_constexpr_version) {
-    AbstractType* result =
-        new AbstractType(parent, transient, std::move(name),
-                         std::move(generated), non_constexpr_version);
-    Get().nominal_types_.push_back(std::unique_ptr<AbstractType>(result));
+      const Type* parent, std::string name, AbstractTypeFlags flags,
+      std::string generated, const Type* non_constexpr_version,
+      MaybeSpecializationKey specialized_from) {
+    auto ptr = std::unique_ptr<AbstractType>(
+        new AbstractType(parent, flags, std::move(name), std::move(generated),
+                         non_constexpr_version, specialized_from));
+    const AbstractType* result = ptr.get();
     if (non_constexpr_version) {
+      DCHECK(ptr->IsConstexpr());
       non_constexpr_version->SetConstexprVersion(result);
     }
+    Get().nominal_types_.push_back(std::move(ptr));
     return result;
   }
 
-  static StructType* GetStructType(
-      const StructDeclaration* decl,
-      StructType::MaybeSpecializationKey specialized_from) {
-    Namespace* nspace = new Namespace(STRUCT_NAMESPACE_STRING);
-    StructType* result = new StructType(nspace, decl, specialized_from);
-    Get().aggregate_types_.push_back(std::unique_ptr<StructType>(result));
-    Get().struct_namespaces_.push_back(std::unique_ptr<Namespace>(nspace));
+  static StructType* GetStructType(const StructDeclaration* decl,
+                                   MaybeSpecializationKey specialized_from) {
+    auto ptr = std::unique_ptr<StructType>(
+        new StructType(CurrentNamespace(), decl, specialized_from));
+    StructType* result = ptr.get();
+    Get().aggregate_types_.push_back(std::move(ptr));
+    return result;
+  }
+
+  static BitFieldStructType* GetBitFieldStructType(
+      const Type* parent, const BitFieldStructDeclaration* decl) {
+    auto ptr = std::unique_ptr<BitFieldStructType>(
+        new BitFieldStructType(CurrentNamespace(), parent, decl));
+    BitFieldStructType* result = ptr.get();
+    Get().bit_field_struct_types_.push_back(std::move(ptr));
     return result;
   }
 
@@ -46,9 +57,10 @@ class TypeOracle : public ContextualClass<TypeOracle> {
                                  ClassFlags flags, const std::string& generates,
                                  ClassDeclaration* decl,
                                  const TypeAlias* alias) {
-    ClassType* result = new ClassType(parent, CurrentNamespace(), name, flags,
-                                      generates, decl, alias);
-    Get().aggregate_types_.push_back(std::unique_ptr<ClassType>(result));
+    std::unique_ptr<ClassType> type(new ClassType(
+        parent, CurrentNamespace(), name, flags, generates, decl, alias));
+    ClassType* result = type.get();
+    Get().aggregate_types_.push_back(std::move(type));
     return result;
   }
 
@@ -66,26 +78,29 @@ class TypeOracle : public ContextualClass<TypeOracle> {
     return result;
   }
 
-  static const StructType* GetGenericStructTypeInstance(
-      GenericStructType* generic_struct, TypeVector arg_types);
+  static const Type* GetGenericTypeInstance(GenericType* generic_type,
+                                            TypeVector arg_types);
 
-  static GenericStructType* GetReferenceGeneric() {
-    return Declarations::LookupUniqueGenericStructType(QualifiedName(
+  static GenericType* GetReferenceGeneric() {
+    return Declarations::LookupUniqueGenericType(QualifiedName(
         {TORQUE_INTERNAL_NAMESPACE_STRING}, REFERENCE_TYPE_STRING));
   }
 
-  static GenericStructType* GetSliceGeneric() {
-    return Declarations::LookupUniqueGenericStructType(
+  static GenericType* GetSliceGeneric() {
+    return Declarations::LookupUniqueGenericType(
         QualifiedName({TORQUE_INTERNAL_NAMESPACE_STRING}, SLICE_TYPE_STRING));
   }
 
-  static const StructType* GetReferenceType(const Type* referenced_type) {
-    return GetGenericStructTypeInstance(GetReferenceGeneric(),
-                                        {referenced_type});
+  static GenericType* GetWeakGeneric() {
+    return Declarations::LookupGlobalUniqueGenericType(WEAK_TYPE_STRING);
+  }
+
+  static const Type* GetReferenceType(const Type* referenced_type) {
+    return GetGenericTypeInstance(GetReferenceGeneric(), {referenced_type});
   }
 
-  static const StructType* GetSliceType(const Type* referenced_type) {
-    return GetGenericStructTypeInstance(GetSliceGeneric(), {referenced_type});
+  static const Type* GetSliceType(const Type* referenced_type) {
+    return GetGenericTypeInstance(GetSliceGeneric(), {referenced_type});
   }
 
   static const std::vector<const BuiltinPointerType*>&
@@ -110,8 +125,9 @@ class TypeOracle : public ContextualClass<TypeOracle> {
 
   static const TopType* GetTopType(std::string reason,
                                    const Type* source_type) {
-    TopType* result = new TopType(std::move(reason), source_type);
-    Get().top_types_.push_back(std::unique_ptr<TopType>(result));
+    std::unique_ptr<TopType> type(new TopType(std::move(reason), source_type));
+    TopType* result = type.get();
+    Get().top_types_.push_back(std::move(type));
     return result;
   }
 
@@ -167,10 +183,20 @@ class TypeOracle : public ContextualClass<TypeOracle> {
     return Get().GetBuiltinType(TAGGED_TYPE_STRING);
   }
 
+  static const Type* GetStrongTaggedType() {
+    return Get().GetBuiltinType(STRONG_TAGGED_TYPE_STRING);
+  }
+
   static const Type* GetUninitializedType() {
     return Get().GetBuiltinType(UNINITIALIZED_TYPE_STRING);
   }
 
+  static const Type* GetUninitializedHeapObjectType() {
+    return Get().GetBuiltinType(
+        QualifiedName({TORQUE_INTERNAL_NAMESPACE_STRING},
+                      UNINITIALIZED_HEAP_OBJECT_TYPE_STRING));
+  }
+
   static const Type* GetSmiType() {
     return Get().GetBuiltinType(SMI_TYPE_STRING);
   }
@@ -223,6 +249,10 @@ class TypeOracle : public ContextualClass<TypeOracle> {
     return Get().GetBuiltinType(FLOAT64_TYPE_STRING);
   }
 
+  static const Type* GetFloat64OrHoleType() {
+    return Get().GetBuiltinType(FLOAT64_OR_HOLE_TYPE_STRING);
+  }
+
   static const Type* GetConstFloat64Type() {
     return Get().GetBuiltinType(CONST_FLOAT64_TYPE_STRING);
   }
@@ -243,40 +273,64 @@ class TypeOracle : public ContextualClass<TypeOracle> {
     return Get().GetBuiltinType(CONTEXT_TYPE_STRING);
   }
 
+  static const Type* GetNativeContextType() {
+    return Get().GetBuiltinType(NATIVE_CONTEXT_TYPE_STRING);
+  }
+
   static const Type* GetJSFunctionType() {
     return Get().GetBuiltinType(JS_FUNCTION_TYPE_STRING);
   }
 
-  static bool IsImplicitlyConvertableFrom(const Type* to, const Type* from) {
-    for (Generic* from_constexpr :
-         Declarations::LookupGeneric(kFromConstexprMacroName)) {
-      if (base::Optional<const Callable*> specialization =
-              from_constexpr->specializations().Get({to, from})) {
-        if ((*specialization)->signature().GetExplicitTypes() ==
-            TypeVector{from}) {
-          return true;
+  static const Type* GetUninitializedIteratorType() {
+    return Get().GetBuiltinType(UNINITIALIZED_ITERATOR_TYPE_STRING);
+  }
+
+  static base::Optional<const Type*> ImplicitlyConvertableFrom(
+      const Type* to, const Type* from) {
+    while (from != nullptr) {
+      for (GenericCallable* from_constexpr :
+           Declarations::LookupGeneric(kFromConstexprMacroName)) {
+        if (base::Optional<const Callable*> specialization =
+                from_constexpr->GetSpecialization({to, from})) {
+          if ((*specialization)->signature().GetExplicitTypes() ==
+              TypeVector{from}) {
+            return from;
+          }
         }
       }
+      from = from->parent();
     }
-    return false;
+    return base::nullopt;
   }
 
-  static const std::vector<std::unique_ptr<AggregateType>>* GetAggregateTypes();
+  static const std::vector<std::unique_ptr<AggregateType>>& GetAggregateTypes();
+  static const std::vector<std::unique_ptr<BitFieldStructType>>&
+  GetBitFieldStructTypes();
 
   static void FinalizeAggregateTypes();
 
+  static size_t FreshTypeId() { return Get().next_type_id_++; }
+
+  static Namespace* CreateGenericTypeInstantiationNamespace();
+
  private:
-  const Type* GetBuiltinType(const std::string& name) {
+  const Type* GetBuiltinType(const QualifiedName& name) {
     return Declarations::LookupGlobalType(name);
   }
+  const Type* GetBuiltinType(const std::string& name) {
+    return GetBuiltinType(QualifiedName(name));
+  }
 
   Deduplicator<BuiltinPointerType> function_pointer_types_;
   std::vector<const BuiltinPointerType*> all_builtin_pointer_types_;
   Deduplicator<UnionType> union_types_;
   std::vector<std::unique_ptr<Type>> nominal_types_;
   std::vector<std::unique_ptr<AggregateType>> aggregate_types_;
+  std::vector<std::unique_ptr<BitFieldStructType>> bit_field_struct_types_;
   std::vector<std::unique_ptr<Type>> top_types_;
-  std::vector<std::unique_ptr<Namespace>> struct_namespaces_;
+  std::vector<std::unique_ptr<Namespace>>
+      generic_type_instantiation_namespaces_;
+  size_t next_type_id_ = 0;
 };
 
 }  // namespace torque
diff --git a/deps/v8/src/torque/type-visitor.cc b/deps/v8/src/torque/type-visitor.cc
index b45452058dae60..ce942365e7a3d3 100644
--- a/deps/v8/src/torque/type-visitor.cc
+++ b/deps/v8/src/torque/type-visitor.cc
@@ -15,12 +15,34 @@ namespace v8 {
 namespace internal {
 namespace torque {
 
-const Type* TypeVisitor::ComputeType(TypeDeclaration* decl) {
+const Type* TypeVisitor::ComputeType(TypeDeclaration* decl,
+                                     MaybeSpecializationKey specialized_from,
+                                     Scope* specialization_requester) {
+  SourcePosition requester_position = CurrentSourcePosition::Get();
   CurrentSourcePosition::Scope scope(decl->pos);
+  Scope* current_scope = CurrentScope::Get();
+  if (specialized_from) {
+    current_scope = TypeOracle::CreateGenericTypeInstantiationNamespace();
+    current_scope->SetSpecializationRequester(
+        {requester_position, specialization_requester,
+         Type::ComputeName(decl->name->value, specialized_from)});
+  }
+  CurrentScope::Scope new_current_scope_scope(current_scope);
+  if (specialized_from) {
+    auto& params = specialized_from->generic->generic_parameters();
+    auto arg_types_iterator = specialized_from->specialized_types.begin();
+    for (auto param : params) {
+      TypeAlias* alias =
+          Declarations::DeclareType(param.name, *arg_types_iterator);
+      alias->SetIsUserDefined(false);
+      arg_types_iterator++;
+    }
+  }
+
   switch (decl->kind) {
 #define ENUM_ITEM(name)        \
   case AstNode::Kind::k##name: \
-    return ComputeType(name::cast(decl));
+    return ComputeType(name::cast(decl), specialized_from);
     AST_TYPE_DECLARATION_NODE_KIND_LIST(ENUM_ITEM)
 #undef ENUM_ITEM
     default:
@@ -28,7 +50,8 @@ const Type* TypeVisitor::ComputeType(TypeDeclaration* decl) {
   }
 }
 
-const Type* TypeVisitor::ComputeType(TypeAliasDeclaration* decl) {
+const Type* TypeVisitor::ComputeType(TypeAliasDeclaration* decl,
+                                     MaybeSpecializationKey specialized_from) {
   const Type* type = ComputeType(decl->type);
   type->AddAlias(decl->name->value);
   return type;
@@ -51,7 +74,8 @@ std::string ComputeGeneratesType(base::Optional<std::string> opt_gen,
 }
 }  // namespace
 
-const AbstractType* TypeVisitor::ComputeType(AbstractTypeDeclaration* decl) {
+const AbstractType* TypeVisitor::ComputeType(
+    AbstractTypeDeclaration* decl, MaybeSpecializationKey specialized_from) {
   std::string generates =
       ComputeGeneratesType(decl->generates, !decl->is_constexpr);
 
@@ -74,18 +98,21 @@ const AbstractType* TypeVisitor::ComputeType(AbstractTypeDeclaration* decl) {
     ReportError("cannot declare a transient type that is also constexpr");
   }
 
-  const AbstractType* non_constexpr_version = nullptr;
+  const Type* non_constexpr_version = nullptr;
   if (decl->is_constexpr) {
     QualifiedName non_constexpr_name{GetNonConstexprName(decl->name->value)};
-    const Type* non_constexpr_type =
-        Declarations::LookupType(non_constexpr_name);
-    non_constexpr_version = AbstractType::DynamicCast(non_constexpr_type);
-    DCHECK_NOT_NULL(non_constexpr_version);
+    if (auto type = Declarations::TryLookupType(non_constexpr_name)) {
+      non_constexpr_version = *type;
+    }
   }
 
-  return TypeOracle::GetAbstractType(parent_type, decl->name->value,
-                                     decl->transient, generates,
-                                     non_constexpr_version);
+  AbstractTypeFlags flags = AbstractTypeFlag::kNone;
+  if (decl->transient) flags |= AbstractTypeFlag::kTransient;
+  if (decl->is_constexpr) flags |= AbstractTypeFlag::kConstexpr;
+
+  return TypeOracle::GetAbstractType(parent_type, decl->name->value, flags,
+                                     generates, non_constexpr_version,
+                                     specialized_from);
 }
 
 void DeclareMethods(AggregateType* container_type,
@@ -107,24 +134,77 @@ void DeclareMethods(AggregateType* container_type,
   }
 }
 
+const BitFieldStructType* TypeVisitor::ComputeType(
+    BitFieldStructDeclaration* decl, MaybeSpecializationKey specialized_from) {
+  CurrentSourcePosition::Scope position_scope(decl->pos);
+  if (specialized_from.has_value()) {
+    ReportError("Bitfield struct specialization is not supported");
+  }
+  const Type* parent = TypeVisitor::ComputeType(decl->parent);
+  if (!IsAnyUnsignedInteger(parent)) {
+    ReportError(
+        "Bitfield struct must extend from an unsigned integer type, not ",
+        parent->ToString());
+  }
+  auto opt_size = SizeOf(parent);
+  if (!opt_size.has_value()) {
+    ReportError("Cannot determine size of bitfield struct ", decl->name->value,
+                " because of unsized parent type ", parent->ToString());
+  }
+  const size_t size = 8 * std::get<0>(*opt_size);  // Convert bytes to bits.
+  BitFieldStructType* type = TypeOracle::GetBitFieldStructType(parent, decl);
+
+  // Iterate through all of the declared fields, checking their validity and
+  // registering them on the newly-constructed BitFieldStructType instance.
+  int offset = 0;
+  for (const auto& field : decl->fields) {
+    CurrentSourcePosition::Scope field_position_scope(
+        field.name_and_type.type->pos);
+    const Type* field_type = TypeVisitor::ComputeType(field.name_and_type.type);
+    if (!IsAllowedAsBitField(field_type)) {
+      ReportError("Type not allowed as bitfield: ",
+                  field.name_and_type.name->value);
+    }
+
+    // Compute the maximum number of bits that could be used for a field of this
+    // type. Booleans are a special case, not included in SizeOf, because their
+    // runtime size is 32 bits but they should only occupy 1 bit as a bitfield.
+    size_t field_type_size = 0;
+    if (field_type->IsSubtypeOf(TypeOracle::GetBoolType())) {
+      field_type_size = 1;
+    } else {
+      auto opt_field_type_size = SizeOf(field_type);
+      if (!opt_field_type_size.has_value()) {
+        ReportError("Size unknown for type ", field_type->ToString());
+      }
+      field_type_size = 8 * std::get<0>(*opt_field_type_size);
+    }
+
+    if (field.num_bits < 1 ||
+        static_cast<size_t>(field.num_bits) > field_type_size) {
+      ReportError("Invalid number of bits for ",
+                  field.name_and_type.name->value);
+    }
+    type->RegisterField({field.name_and_type.name->pos,
+                         {field.name_and_type.name->value, field_type},
+                         offset,
+                         field.num_bits});
+    offset += field.num_bits;
+    if (static_cast<size_t>(offset) > size) {
+      ReportError("Too many total bits in ", decl->name->value);
+    }
+  }
+
+  return type;
+}
+
 const StructType* TypeVisitor::ComputeType(
-    StructDeclaration* decl,
-    StructType::MaybeSpecializationKey specialized_from) {
+    StructDeclaration* decl, MaybeSpecializationKey specialized_from) {
   StructType* struct_type = TypeOracle::GetStructType(decl, specialized_from);
   CurrentScope::Scope struct_namespace_scope(struct_type->nspace());
   CurrentSourcePosition::Scope position_activator(decl->pos);
 
-  if (specialized_from) {
-    auto& params = specialized_from->generic->generic_parameters();
-    auto arg_types_iterator = specialized_from->specialized_types.begin();
-    for (auto param : params) {
-      TypeAlias* alias = Declarations::DeclareType(param, *arg_types_iterator);
-      alias->SetIsUserDefined(false);
-      arg_types_iterator++;
-    }
-  }
-
-  size_t offset = 0;
+  ResidueClass offset = 0;
   for (auto& field : decl->fields) {
     CurrentSourcePosition::Scope position_activator(
         field.name_and_type.type->pos);
@@ -133,37 +213,61 @@ const StructType* TypeVisitor::ComputeType(
       ReportError("struct field \"", field.name_and_type.name->value,
                   "\" carries constexpr type \"", *field_type, "\"");
     }
-    struct_type->RegisterField({field.name_and_type.name->pos,
-                                struct_type,
-                                base::nullopt,
-                                {field.name_and_type.name->value, field_type},
-                                offset,
-                                false,
-                                field.const_qualified,
-                                false});
-    offset += LoweredSlotCount(field_type);
+    Field f{field.name_and_type.name->pos,
+            struct_type,
+            base::nullopt,
+            {field.name_and_type.name->value, field_type},
+            offset.SingleValue(),
+            false,
+            field.const_qualified,
+            false};
+    auto optional_size = SizeOf(f.name_and_type.type);
+    struct_type->RegisterField(f);
+    // Offsets are assigned based on an assumption of no space between members.
+    // This might lead to invalid alignment in some cases, but most structs are
+    // never actually packed in memory together (they just represent a batch of
+    // CSA TNode values that should be passed around together). For any struct
+    // that is used as a class field, we verify its offsets when setting up the
+    // class type.
+    if (optional_size.has_value()) {
+      size_t field_size = 0;
+      std::tie(field_size, std::ignore) = *optional_size;
+      offset += field_size;
+    } else {
+      // Structs may contain fields that aren't representable in packed form. If
+      // so, the offset of subsequent fields are marked as invalid.
+      offset = ResidueClass::Unknown();
+    }
   }
   return struct_type;
 }
 
-const ClassType* TypeVisitor::ComputeType(ClassDeclaration* decl) {
+const ClassType* TypeVisitor::ComputeType(
+    ClassDeclaration* decl, MaybeSpecializationKey specialized_from) {
   ClassType* new_class;
   // TODO(sigurds): Remove this hack by introducing a declarable for classes.
   const TypeAlias* alias =
       Declarations::LookupTypeAlias(QualifiedName(decl->name->value));
   GlobalContext::RegisterClass(alias);
   DCHECK_EQ(*alias->delayed_, decl);
+  bool is_shape = decl->flags & ClassFlag::kIsShape;
+  if (is_shape && !(decl->flags & ClassFlag::kExtern)) {
+    ReportError("Shapes must be extern, add \"extern\" to the declaration.");
+  }
+  if (is_shape && decl->flags & ClassFlag::kUndefinedLayout) {
+    ReportError("Shapes need to define their layout.");
+  }
   if (decl->flags & ClassFlag::kExtern) {
     if (!decl->super) {
       ReportError("Extern class must extend another type.");
     }
     const Type* super_type = TypeVisitor::ComputeType(*decl->super);
-    if (super_type != TypeOracle::GetTaggedType()) {
+    if (super_type != TypeOracle::GetStrongTaggedType()) {
       const ClassType* super_class = ClassType::DynamicCast(super_type);
       if (!super_class) {
         ReportError(
             "class \"", decl->name->value,
-            "\" must extend either Tagged or an already declared class");
+            "\" must extend either StrongTagged or an already declared class");
       }
       if (super_class->HasUndefinedLayout() &&
           !(decl->flags & ClassFlag::kUndefinedLayout)) {
@@ -174,6 +278,18 @@ const ClassType* TypeVisitor::ComputeType(ClassDeclaration* decl) {
     }
 
     std::string generates = decl->name->value;
+    if (is_shape) {
+      const ClassType* super_class = ClassType::DynamicCast(super_type);
+      if (!super_class ||
+          !super_class->IsSubtypeOf(TypeOracle::GetJSObjectType())) {
+        Error("Shapes need to extend a subclass of ",
+              *TypeOracle::GetJSObjectType())
+            .Throw();
+      }
+      // Shapes use their super class in CSA code since they have incomplete
+      // support for type-checks on the C++ side.
+      generates = super_class->name();
+    }
     if (decl->generates) {
       bool enforce_tnode_type = true;
       generates = ComputeGeneratesType(decl->generates, enforce_tnode_type);
@@ -188,7 +304,8 @@ const ClassType* TypeVisitor::ComputeType(ClassDeclaration* decl) {
     }
     const Type* super_type = TypeVisitor::ComputeType(*decl->super);
     const ClassType* super_class = ClassType::DynamicCast(super_type);
-    const Type* struct_type = Declarations::LookupGlobalType("Struct");
+    const Type* struct_type =
+        Declarations::LookupGlobalType(QualifiedName("Struct"));
     if (!super_class || super_class != struct_type) {
       ReportError("Intern class ", decl->name->value,
                   " must extend class Struct.");
@@ -216,11 +333,11 @@ const Type* TypeVisitor::ComputeType(TypeExpression* type_expression) {
       type = alias->type();
       pos = alias->GetDeclarationPosition();
     } else {
-      auto* generic_struct =
-          Declarations::LookupUniqueGenericStructType(qualified_name);
-      type = TypeOracle::GetGenericStructTypeInstance(generic_struct,
-                                                      ComputeTypeVector(args));
-      pos = generic_struct->declaration()->name->pos;
+      auto* generic_type =
+          Declarations::LookupUniqueGenericType(qualified_name);
+      type = TypeOracle::GetGenericTypeInstance(generic_type,
+                                                ComputeTypeVector(args));
+      pos = generic_type->declaration()->name->pos;
     }
 
     if (GlobalContext::collect_language_server_data()) {
@@ -266,72 +383,92 @@ Signature TypeVisitor::MakeSignature(const CallableDeclaration* declaration) {
 void TypeVisitor::VisitClassFieldsAndMethods(
     ClassType* class_type, const ClassDeclaration* class_declaration) {
   const ClassType* super_class = class_type->GetSuperClass();
-  size_t class_offset = super_class ? super_class->size() : 0;
-  bool seen_indexed_field = false;
+  ResidueClass class_offset = 0;
+  size_t header_size = 0;
+  if (super_class) {
+    class_offset = super_class->size();
+    header_size = super_class->header_size();
+  }
+
   for (const ClassFieldExpression& field_expression :
        class_declaration->fields) {
     CurrentSourcePosition::Scope position_activator(
         field_expression.name_and_type.type->pos);
     const Type* field_type = ComputeType(field_expression.name_and_type.type);
-    if (!(class_declaration->flags & ClassFlag::kExtern)) {
-      if (!field_type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
-        ReportError("non-extern classes do not support untagged fields");
+    if (class_type->IsShape()) {
+      if (!field_type->IsSubtypeOf(TypeOracle::GetObjectType())) {
+        ReportError(
+            "in-object properties only support subtypes of Object, but "
+            "found type ",
+            *field_type);
       }
       if (field_expression.weak) {
-        ReportError("non-extern classes do not support weak fields");
+        ReportError("in-object properties cannot be weak");
       }
     }
-    if (field_expression.index) {
-      if (seen_indexed_field ||
-          (super_class && super_class->HasIndexedField())) {
+    if (!(class_declaration->flags & ClassFlag::kExtern)) {
+      if (!field_type->IsSubtypeOf(TypeOracle::GetObjectType())) {
         ReportError(
-            "only one indexable field is currently supported per class");
+            "non-extern classes only support subtypes of type Object, but "
+            "found type ",
+            *field_type);
       }
-      seen_indexed_field = true;
-      const NameAndType& index_field =
-          class_type->LookupFieldInternal(*field_expression.index)
-              .name_and_type;
-      class_type->RegisterField(
-          {field_expression.name_and_type.name->pos,
-           class_type,
-           index_field,
-           {field_expression.name_and_type.name->value, field_type},
-           class_offset,
-           field_expression.weak,
-           field_expression.const_qualified,
-           field_expression.generate_verify});
-    } else {
-      if (seen_indexed_field) {
-        ReportError("cannot declare non-indexable field \"",
-                    field_expression.name_and_type.name,
-                    "\" after an indexable field "
-                    "declaration");
+      if (field_expression.weak) {
+        ReportError("non-extern classes do not support weak fields");
+      }
+    }
+    const StructType* struct_type = StructType::DynamicCast(field_type);
+    if (struct_type && struct_type != TypeOracle::GetFloat64OrHoleType()) {
+      for (const Field& struct_field : struct_type->fields()) {
+        if (!struct_field.name_and_type.type->IsSubtypeOf(
+                TypeOracle::GetTaggedType())) {
+          // If we ever actually need different sizes of struct fields, then we
+          // can define the packing and alignment rules. Until then, let's keep
+          // it simple. This restriction also helps keep the tagged and untagged
+          // regions separate in the class layout (see also
+          // FieldOffsetsGenerator::GetSectionFor).
+          Error(
+              "Classes do not support fields which are structs containing "
+              "untagged data.");
+        }
       }
-      const Field& field = class_type->RegisterField(
-          {field_expression.name_and_type.name->pos,
-           class_type,
-           base::nullopt,
-           {field_expression.name_and_type.name->value, field_type},
-           class_offset,
-           field_expression.weak,
-           field_expression.const_qualified,
-           field_expression.generate_verify});
-      size_t field_size;
-      std::string size_string;
-      std::string machine_type;
-      std::tie(field_size, size_string) = field.GetFieldSizeInformation();
-      // Our allocations don't support alignments beyond kTaggedSize.
-      size_t alignment = std::min(
-          static_cast<size_t>(TargetArchitecture::TaggedSize()), field_size);
-      if (alignment > 0 && class_offset % alignment != 0) {
-        ReportError("field ", field_expression.name_and_type.name,
-                    " at offset ", class_offset, " is not ", alignment,
-                    "-byte aligned.");
+    }
+    base::Optional<Expression*> array_length = field_expression.index;
+    const Field& field = class_type->RegisterField(
+        {field_expression.name_and_type.name->pos,
+         class_type,
+         array_length,
+         {field_expression.name_and_type.name->value, field_type},
+         class_offset.SingleValue(),
+         field_expression.weak,
+         field_expression.const_qualified,
+         field_expression.generate_verify});
+    ResidueClass field_size = std::get<0>(field.GetFieldSizeInformation());
+    if (field.index) {
+      if (auto literal = NumberLiteralExpression::DynamicCast(*field.index)) {
+        size_t value = static_cast<size_t>(literal->number);
+        if (value != literal->number) {
+          Error("non-integral array length").Position(field.pos);
+        }
+        field_size *= value;
+      } else {
+        field_size *= ResidueClass::Unknown();
       }
-      class_offset += field_size;
+    }
+    field.ValidateAlignment(class_offset);
+    class_offset += field_size;
+    // In-object properties are not considered part of the header.
+    if (class_offset.SingleValue() && !class_type->IsShape()) {
+      header_size = *class_offset.SingleValue();
+    }
+    if (!field.index && !class_offset.SingleValue()) {
+      Error("Indexed fields have to be at the end of the object")
+          .Position(field.pos);
     }
   }
-  class_type->SetSize(class_offset);
+  DCHECK_GT(header_size, 0);
+  class_type->header_size_ = header_size;
+  class_type->size_ = class_offset;
   class_type->GenerateAccessors();
   DeclareMethods(class_type, class_declaration->methods);
 }
@@ -350,11 +487,16 @@ const StructType* TypeVisitor::ComputeTypeForStructExpression(
   }
 
   QualifiedName qualified_name{basic->namespace_qualification, basic->name};
-  base::Optional<GenericStructType*> maybe_generic_struct =
-      Declarations::TryLookupGenericStructType(qualified_name);
+  base::Optional<GenericType*> maybe_generic_type =
+      Declarations::TryLookupGenericType(qualified_name);
+
+  StructDeclaration* decl =
+      maybe_generic_type
+          ? StructDeclaration::DynamicCast((*maybe_generic_type)->declaration())
+          : nullptr;
 
   // Compute types of non-generic structs as usual
-  if (!maybe_generic_struct) {
+  if (!(maybe_generic_type && decl)) {
     const Type* type = ComputeType(type_expression);
     const StructType* struct_type = StructType::DynamicCast(type);
     if (!struct_type) {
@@ -363,20 +505,20 @@ const StructType* TypeVisitor::ComputeTypeForStructExpression(
     return struct_type;
   }
 
-  auto generic_struct = *maybe_generic_struct;
+  auto generic_type = *maybe_generic_type;
   auto explicit_type_arguments = ComputeTypeVector(basic->generic_arguments);
 
   std::vector<TypeExpression*> term_parameters;
-  auto& fields = generic_struct->declaration()->fields;
+  auto& fields = decl->fields;
   term_parameters.reserve(fields.size());
   for (auto& field : fields) {
     term_parameters.push_back(field.name_and_type.type);
   }
 
-  CurrentScope::Scope generic_scope(generic_struct->ParentScope());
-  TypeArgumentInference inference(
-      generic_struct->declaration()->generic_parameters,
-      explicit_type_arguments, term_parameters, term_argument_types);
+  CurrentScope::Scope generic_scope(generic_type->ParentScope());
+  TypeArgumentInference inference(generic_type->generic_parameters(),
+                                  explicit_type_arguments, term_parameters,
+                                  term_argument_types);
 
   if (inference.HasFailed()) {
     ReportError("failed to infer type arguments for struct ", basic->name,
@@ -384,10 +526,10 @@ const StructType* TypeVisitor::ComputeTypeForStructExpression(
   }
   if (GlobalContext::collect_language_server_data()) {
     LanguageServerData::AddDefinition(type_expression->pos,
-                                      generic_struct->declaration()->name->pos);
+                                      generic_type->declaration()->name->pos);
   }
-  return TypeOracle::GetGenericStructTypeInstance(generic_struct,
-                                                  inference.GetResult());
+  return StructType::cast(
+      TypeOracle::GetGenericTypeInstance(generic_type, inference.GetResult()));
 }
 
 }  // namespace torque
diff --git a/deps/v8/src/torque/type-visitor.h b/deps/v8/src/torque/type-visitor.h
index cafd752cbf4958..6bb2bba499d4f3 100644
--- a/deps/v8/src/torque/type-visitor.h
+++ b/deps/v8/src/torque/type-visitor.h
@@ -14,6 +14,8 @@ namespace v8 {
 namespace internal {
 namespace torque {
 
+class Scope;
+
 class TypeVisitor {
  public:
   static TypeVector ComputeTypeVector(const std::vector<TypeExpression*>& v) {
@@ -37,13 +39,20 @@ class TypeVisitor {
  private:
   friend class TypeAlias;
   friend class TypeOracle;
-  static const Type* ComputeType(TypeDeclaration* decl);
-  static const AbstractType* ComputeType(AbstractTypeDeclaration* decl);
-  static const Type* ComputeType(TypeAliasDeclaration* decl);
-  static const StructType* ComputeType(
-      StructDeclaration* decl,
-      StructType::MaybeSpecializationKey specialized_from = base::nullopt);
-  static const ClassType* ComputeType(ClassDeclaration* decl);
+  static const Type* ComputeType(
+      TypeDeclaration* decl,
+      MaybeSpecializationKey specialized_from = base::nullopt,
+      Scope* specialization_requester = nullptr);
+  static const AbstractType* ComputeType(
+      AbstractTypeDeclaration* decl, MaybeSpecializationKey specialized_from);
+  static const Type* ComputeType(TypeAliasDeclaration* decl,
+                                 MaybeSpecializationKey specialized_from);
+  static const BitFieldStructType* ComputeType(
+      BitFieldStructDeclaration* decl, MaybeSpecializationKey specialized_from);
+  static const StructType* ComputeType(StructDeclaration* decl,
+                                       MaybeSpecializationKey specialized_from);
+  static const ClassType* ComputeType(ClassDeclaration* decl,
+                                      MaybeSpecializationKey specialized_from);
 };
 
 }  // namespace torque
diff --git a/deps/v8/src/torque/types.cc b/deps/v8/src/torque/types.cc
index 022649e0657eb8..a8e56ff5eec6b1 100644
--- a/deps/v8/src/torque/types.cc
+++ b/deps/v8/src/torque/types.cc
@@ -4,19 +4,38 @@
 
 #include <iostream>
 
+#include "src/torque/types.h"
+
+#include "src/base/bits.h"
 #include "src/torque/ast.h"
 #include "src/torque/declarable.h"
 #include "src/torque/global-context.h"
 #include "src/torque/type-oracle.h"
 #include "src/torque/type-visitor.h"
-#include "src/torque/types.h"
 
 namespace v8 {
 namespace internal {
 namespace torque {
 
+// This custom copy constructor doesn't copy aliases_ and id_ because they
+// should be distinct for each type.
+Type::Type(const Type& other) V8_NOEXCEPT
+    : TypeBase(other),
+      parent_(other.parent_),
+      aliases_(),
+      id_(TypeOracle::FreshTypeId()),
+      constexpr_version_(other.constexpr_version_) {}
+Type::Type(TypeBase::Kind kind, const Type* parent,
+           MaybeSpecializationKey specialized_from)
+    : TypeBase(kind),
+      parent_(parent),
+      id_(TypeOracle::FreshTypeId()),
+      specialized_from_(specialized_from),
+      constexpr_version_(nullptr) {}
+
 std::string Type::ToString() const {
-  if (aliases_.size() == 0) return ToExplicitString();
+  if (aliases_.size() == 0)
+    return ComputeName(ToExplicitString(), GetSpecializedFrom());
   if (aliases_.size() == 1) return *aliases_.begin();
   std::stringstream result;
   int i = 0;
@@ -34,6 +53,20 @@ std::string Type::ToString() const {
   return result.str();
 }
 
+std::string Type::SimpleName() const {
+  if (aliases_.empty()) {
+    std::stringstream result;
+    result << SimpleNameImpl();
+    if (GetSpecializedFrom()) {
+      for (const Type* t : GetSpecializedFrom()->specialized_types) {
+        result << "_" << t->SimpleName();
+      }
+    }
+    return result.str();
+  }
+  return *aliases_.begin();
+}
+
 bool Type::IsSubtypeOf(const Type* supertype) const {
   if (supertype->IsTopType()) return true;
   if (IsNever()) return true;
@@ -48,6 +81,15 @@ bool Type::IsSubtypeOf(const Type* supertype) const {
   return false;
 }
 
+std::string Type::GetConstexprGeneratedTypeName() const {
+  const Type* constexpr_version = ConstexprVersion();
+  if (constexpr_version == nullptr) {
+    Error("Type '", ToString(), "' requires a constexpr representation");
+    return "";
+  }
+  return constexpr_version->GetGeneratedTypeName();
+}
+
 base::Optional<const ClassType*> Type::ClassSupertype() const {
   for (const Type* t = this; t != nullptr; t = t->parent()) {
     if (auto* class_type = ClassType::DynamicCast(t)) {
@@ -108,6 +150,23 @@ std::string AbstractType::GetGeneratedTNodeTypeNameImpl() const {
   return generated_type_;
 }
 
+std::vector<RuntimeType> AbstractType::GetRuntimeTypes() const {
+  std::string type_name = GetGeneratedTNodeTypeName();
+  if (auto strong_type =
+          Type::MatchUnaryGeneric(this, TypeOracle::GetWeakGeneric())) {
+    auto strong_runtime_types = (*strong_type)->GetRuntimeTypes();
+    std::vector<RuntimeType> result;
+    for (const RuntimeType& type : strong_runtime_types) {
+      // Generic parameter in Weak<T> should have already been checked to
+      // extend HeapObject, so it couldn't itself be another weak type.
+      DCHECK(type.weak_ref_to.empty());
+      result.push_back({type_name, type.type});
+    }
+    return result;
+  }
+  return {{type_name, ""}};
+}
+
 std::string BuiltinPointerType::ToExplicitString() const {
   std::stringstream result;
   result << "builtin (";
@@ -116,15 +175,13 @@ std::string BuiltinPointerType::ToExplicitString() const {
   return result.str();
 }
 
-std::string BuiltinPointerType::MangledName() const {
+std::string BuiltinPointerType::SimpleNameImpl() const {
   std::stringstream result;
-  result << "FT";
+  result << "BuiltinPointer";
   for (const Type* t : parameter_types_) {
-    std::string arg_type_string = t->MangledName();
-    result << arg_type_string.size() << arg_type_string;
+    result << "_" << t->SimpleName();
   }
-  std::string return_type_string = return_type_->MangledName();
-  result << return_type_string.size() << return_type_string;
+  result << "_" << return_type_->SimpleName();
   return result.str();
 }
 
@@ -143,12 +200,15 @@ std::string UnionType::ToExplicitString() const {
   return result.str();
 }
 
-std::string UnionType::MangledName() const {
+std::string UnionType::SimpleNameImpl() const {
   std::stringstream result;
-  result << "UT";
+  bool first = true;
   for (const Type* t : types_) {
-    std::string arg_type_string = t->MangledName();
-    result << arg_type_string.size() << arg_type_string;
+    if (!first) {
+      result << "_OR_";
+    }
+    first = false;
+    result << t->SimpleName();
   }
   return result.str();
 }
@@ -199,6 +259,19 @@ const Type* SubtractType(const Type* a, const Type* b) {
   return TypeOracle::GetUnionType(result);
 }
 
+std::string BitFieldStructType::ToExplicitString() const {
+  return "bitfield struct " + name();
+}
+
+const BitField& BitFieldStructType::LookupField(const std::string& name) const {
+  for (const BitField& field : fields_) {
+    if (field.name_and_type.name == name) {
+      return field;
+    }
+  }
+  ReportError("Couldn't find bitfield ", name);
+}
+
 void AggregateType::CheckForDuplicateFields() const {
   // Check the aggregate hierarchy and currently defined class for duplicate
   // field declarations.
@@ -273,14 +346,34 @@ const Field& AggregateType::LookupField(const std::string& name) const {
   return LookupFieldInternal(name);
 }
 
+StructType::StructType(Namespace* nspace, const StructDeclaration* decl,
+                       MaybeSpecializationKey specialized_from)
+    : AggregateType(Kind::kStructType, nullptr, nspace, decl->name->value,
+                    specialized_from),
+      decl_(decl) {
+  if (decl->flags & StructFlag::kExport) {
+    generated_type_name_ = "TorqueStruct" + name();
+  } else {
+    generated_type_name_ =
+        GlobalContext::MakeUniqueName("TorqueStruct" + SimpleName());
+  }
+}
+
 std::string StructType::GetGeneratedTypeNameImpl() const {
-  return "TorqueStruct" + MangledName();
+  return generated_type_name_;
+}
+
+size_t StructType::PackedSize() const {
+  size_t result = 0;
+  for (const Field& field : fields()) {
+    result += std::get<0>(field.GetFieldSizeInformation());
+  }
+  return result;
 }
 
 // static
-std::string StructType::ComputeName(
-    const std::string& basename,
-    StructType::MaybeSpecializationKey specialized_from) {
+std::string Type::ComputeName(const std::string& basename,
+                              MaybeSpecializationKey specialized_from) {
   if (!specialized_from) return basename;
   std::stringstream s;
   s << basename << "<";
@@ -296,37 +389,16 @@ std::string StructType::ComputeName(
   return s.str();
 }
 
-std::string StructType::MangledName() const {
-  std::stringstream result;
-  // TODO(gsps): Add 'ST' as a prefix once we can control the generated type
-  // name from Torque code
-  result << decl_->name->value;
-  if (specialized_from_) {
-    for (const Type* t : specialized_from_->specialized_types) {
-      std::string arg_type_string = t->MangledName();
-      result << arg_type_string.size() << arg_type_string;
-    }
-  }
-  return result.str();
-}
+std::string StructType::SimpleNameImpl() const { return decl_->name->value; }
 
 // static
-base::Optional<const Type*> StructType::MatchUnaryGeneric(
-    const Type* type, GenericStructType* generic) {
-  if (auto* struct_type = StructType::DynamicCast(type)) {
-    return MatchUnaryGeneric(struct_type, generic);
-  }
-  return base::nullopt;
-}
-
-// static
-base::Optional<const Type*> StructType::MatchUnaryGeneric(
-    const StructType* type, GenericStructType* generic) {
+base::Optional<const Type*> Type::MatchUnaryGeneric(const Type* type,
+                                                    GenericType* generic) {
   DCHECK_EQ(generic->generic_parameters().size(), 1);
-  if (!type->specialized_from_) {
+  if (!type->GetSpecializedFrom()) {
     return base::nullopt;
   }
-  auto& key = type->specialized_from_.value();
+  auto& key = type->GetSpecializedFrom().value();
   if (key.generic != generic || key.specialized_types.size() != 1) {
     return base::nullopt;
   }
@@ -341,11 +413,7 @@ std::vector<Method*> AggregateType::Methods(const std::string& name) const {
   return result;
 }
 
-std::string StructType::ToExplicitString() const {
-  std::stringstream result;
-  result << "struct " << name();
-  return result.str();
-}
+std::string StructType::ToExplicitString() const { return "struct " + name(); }
 
 void StructType::Finalize() const {
   if (is_finalized_) return;
@@ -365,7 +433,7 @@ ClassType::ClassType(const Type* parent, Namespace* nspace,
                      const std::string& generates, const ClassDeclaration* decl,
                      const TypeAlias* alias)
     : AggregateType(Kind::kClassType, parent, nspace, name),
-      size_(0),
+      size_(ResidueClass::Unknown()),
       flags_(flags & ~(kInternalFlags)),
       generates_(generates),
       decl_(decl),
@@ -387,15 +455,10 @@ std::string ClassType::GetGeneratedTypeNameImpl() const {
                        : "TNode<" + GetGeneratedTNodeTypeName() + ">";
 }
 
-std::string ClassType::ToExplicitString() const {
-  std::stringstream result;
-  result << "class " << name();
-  return result.str();
-}
+std::string ClassType::ToExplicitString() const { return "class " + name(); }
 
 bool ClassType::AllowInstantiation() const {
-  return (!IsExtern() || nspace()->IsDefaultNamespace()) &&
-         (!IsAbstract() || IsInstantiatedAbstractClass());
+  return (!IsExtern() || nspace()->IsDefaultNamespace()) && !IsAbstract();
 }
 
 void ClassType::Finalize() const {
@@ -405,14 +468,6 @@ void ClassType::Finalize() const {
   if (parent()) {
     if (const ClassType* super_class = ClassType::DynamicCast(parent())) {
       if (super_class->HasIndexedField()) flags_ |= ClassFlag::kHasIndexedField;
-      if (!super_class->IsAbstract() && !HasSameInstanceTypeAsParent()) {
-        Error("Super class must either be abstract (annotate super class with ",
-              ANNOTATION_ABSTRACT,
-              ") or this class must have the same instance type as the super "
-              "class (annotate this class with ",
-              ANNOTATION_HAS_SAME_INSTANCE_TYPE_AS_PARENT, ").")
-            .Position(this->decl_->name->pos);
-      }
     }
   }
   TypeVisitor::VisitClassFieldsAndMethods(const_cast<ClassType*>(this),
@@ -444,8 +499,7 @@ std::vector<Field> ClassType::ComputeAllFields() const {
 
 void ClassType::GenerateAccessors() {
   // For each field, construct AST snippets that implement a CSA accessor
-  // function and define a corresponding '.field' operator. The
-  // implementation iterator will turn the snippets into code.
+  // function. The implementation iterator will turn the snippets into code.
   for (auto& field : fields_) {
     if (field.index || field.name_and_type.type == TypeOracle::GetVoidType()) {
       continue;
@@ -491,6 +545,14 @@ void ClassType::GenerateAccessors() {
   }
 }
 
+bool ClassType::HasStaticSize() const {
+  if (IsShape()) return true;
+  if (IsSubtypeOf(TypeOracle::GetJSObjectType())) return false;
+  if (IsAbstract()) return false;
+  if (HasIndexedField()) return false;
+  return true;
+}
+
 void PrintSignature(std::ostream& os, const Signature& sig, bool with_names) {
   os << "(";
   for (size_t i = 0; i < sig.parameter_types.types.size(); ++i) {
@@ -586,12 +648,10 @@ bool Signature::HasSameTypesAs(const Signature& other,
 bool IsAssignableFrom(const Type* to, const Type* from) {
   if (to == from) return true;
   if (from->IsSubtypeOf(to)) return true;
-  return TypeOracle::IsImplicitlyConvertableFrom(to, from);
+  return TypeOracle::ImplicitlyConvertableFrom(to, from).has_value();
 }
 
-bool operator<(const Type& a, const Type& b) {
-  return a.MangledName() < b.MangledName();
-}
+bool operator<(const Type& a, const Type& b) { return a.id() < b.id(); }
 
 VisitResult ProjectStructField(VisitResult structure,
                                const std::string& fieldname) {
@@ -660,49 +720,169 @@ VisitResult VisitResult::NeverResult() {
 }
 
 std::tuple<size_t, std::string> Field::GetFieldSizeInformation() const {
-  std::string size_string = "#no size";
-  const Type* field_type = this->name_and_type.type;
-  size_t field_size = 0;
-  if (field_type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
-    field_size = TargetArchitecture::TaggedSize();
+  auto optional = SizeOf(this->name_and_type.type);
+  if (optional.has_value()) {
+    return *optional;
+  }
+  Error("fields of type ", *name_and_type.type, " are not (yet) supported")
+      .Position(pos);
+  return std::make_tuple(0, "#no size");
+}
+
+size_t Type::AlignmentLog2() const {
+  if (parent()) return parent()->AlignmentLog2();
+  return TargetArchitecture::TaggedSize();
+}
+
+size_t AbstractType::AlignmentLog2() const {
+  size_t alignment;
+  if (this == TypeOracle::GetTaggedType()) {
+    alignment = TargetArchitecture::TaggedSize();
+  } else if (this == TypeOracle::GetRawPtrType()) {
+    alignment = TargetArchitecture::RawPtrSize();
+  } else if (this == TypeOracle::GetVoidType()) {
+    alignment = 1;
+  } else if (this == TypeOracle::GetInt8Type()) {
+    alignment = kUInt8Size;
+  } else if (this == TypeOracle::GetUint8Type()) {
+    alignment = kUInt8Size;
+  } else if (this == TypeOracle::GetInt16Type()) {
+    alignment = kUInt16Size;
+  } else if (this == TypeOracle::GetUint16Type()) {
+    alignment = kUInt16Size;
+  } else if (this == TypeOracle::GetInt32Type()) {
+    alignment = kInt32Size;
+  } else if (this == TypeOracle::GetUint32Type()) {
+    alignment = kInt32Size;
+  } else if (this == TypeOracle::GetFloat64Type()) {
+    alignment = kDoubleSize;
+  } else if (this == TypeOracle::GetIntPtrType()) {
+    alignment = TargetArchitecture::RawPtrSize();
+  } else if (this == TypeOracle::GetUIntPtrType()) {
+    alignment = TargetArchitecture::RawPtrSize();
+  } else {
+    return Type::AlignmentLog2();
+  }
+  alignment = std::min(alignment, TargetArchitecture::TaggedSize());
+  return base::bits::WhichPowerOfTwo(alignment);
+}
+
+size_t StructType::AlignmentLog2() const {
+  if (this == TypeOracle::GetFloat64OrHoleType()) {
+    return TypeOracle::GetFloat64Type()->AlignmentLog2();
+  }
+  size_t alignment_log_2 = 0;
+  for (const Field& field : fields()) {
+    alignment_log_2 =
+        std::max(alignment_log_2, field.name_and_type.type->AlignmentLog2());
+  }
+  return alignment_log_2;
+}
+
+void Field::ValidateAlignment(ResidueClass at_offset) const {
+  const Type* type = name_and_type.type;
+  const StructType* struct_type = StructType::DynamicCast(type);
+  if (struct_type && struct_type != TypeOracle::GetFloat64OrHoleType()) {
+    for (const Field& field : struct_type->fields()) {
+      field.ValidateAlignment(at_offset);
+      size_t field_size = std::get<0>(field.GetFieldSizeInformation());
+      at_offset += field_size;
+    }
+  } else {
+    size_t alignment_log_2 = name_and_type.type->AlignmentLog2();
+    if (at_offset.AlignmentLog2() < alignment_log_2) {
+      Error("field ", name_and_type.name, " at offset ", at_offset, " is not ",
+            size_t{1} << alignment_log_2, "-byte aligned.")
+          .Position(pos);
+    }
+  }
+}
+
+base::Optional<std::tuple<size_t, std::string>> SizeOf(const Type* type) {
+  std::string size_string;
+  size_t size;
+  if (type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
+    size = TargetArchitecture::TaggedSize();
     size_string = "kTaggedSize";
-  } else if (field_type->IsSubtypeOf(TypeOracle::GetRawPtrType())) {
-    field_size = TargetArchitecture::RawPtrSize();
+  } else if (type->IsSubtypeOf(TypeOracle::GetRawPtrType())) {
+    size = TargetArchitecture::RawPtrSize();
     size_string = "kSystemPointerSize";
-  } else if (field_type->IsSubtypeOf(TypeOracle::GetVoidType())) {
-    field_size = 0;
+  } else if (type->IsSubtypeOf(TypeOracle::GetVoidType())) {
+    size = 0;
     size_string = "0";
-  } else if (field_type->IsSubtypeOf(TypeOracle::GetInt8Type())) {
-    field_size = kUInt8Size;
+  } else if (type->IsSubtypeOf(TypeOracle::GetInt8Type())) {
+    size = kUInt8Size;
     size_string = "kUInt8Size";
-  } else if (field_type->IsSubtypeOf(TypeOracle::GetUint8Type())) {
-    field_size = kUInt8Size;
+  } else if (type->IsSubtypeOf(TypeOracle::GetUint8Type())) {
+    size = kUInt8Size;
     size_string = "kUInt8Size";
-  } else if (field_type->IsSubtypeOf(TypeOracle::GetInt16Type())) {
-    field_size = kUInt16Size;
+  } else if (type->IsSubtypeOf(TypeOracle::GetInt16Type())) {
+    size = kUInt16Size;
     size_string = "kUInt16Size";
-  } else if (field_type->IsSubtypeOf(TypeOracle::GetUint16Type())) {
-    field_size = kUInt16Size;
+  } else if (type->IsSubtypeOf(TypeOracle::GetUint16Type())) {
+    size = kUInt16Size;
     size_string = "kUInt16Size";
-  } else if (field_type->IsSubtypeOf(TypeOracle::GetInt32Type())) {
-    field_size = kInt32Size;
+  } else if (type->IsSubtypeOf(TypeOracle::GetInt32Type())) {
+    size = kInt32Size;
     size_string = "kInt32Size";
-  } else if (field_type->IsSubtypeOf(TypeOracle::GetUint32Type())) {
-    field_size = kInt32Size;
+  } else if (type->IsSubtypeOf(TypeOracle::GetUint32Type())) {
+    size = kInt32Size;
     size_string = "kInt32Size";
-  } else if (field_type->IsSubtypeOf(TypeOracle::GetFloat64Type())) {
-    field_size = kDoubleSize;
+  } else if (type->IsSubtypeOf(TypeOracle::GetFloat64Type())) {
+    size = kDoubleSize;
     size_string = "kDoubleSize";
-  } else if (field_type->IsSubtypeOf(TypeOracle::GetIntPtrType())) {
-    field_size = TargetArchitecture::RawPtrSize();
+  } else if (type->IsSubtypeOf(TypeOracle::GetIntPtrType())) {
+    size = TargetArchitecture::RawPtrSize();
     size_string = "kIntptrSize";
-  } else if (field_type->IsSubtypeOf(TypeOracle::GetUIntPtrType())) {
-    field_size = TargetArchitecture::RawPtrSize();
+  } else if (type->IsSubtypeOf(TypeOracle::GetUIntPtrType())) {
+    size = TargetArchitecture::RawPtrSize();
     size_string = "kIntptrSize";
+  } else if (const StructType* struct_type = StructType::DynamicCast(type)) {
+    if (type == TypeOracle::GetFloat64OrHoleType()) {
+      size = kDoubleSize;
+      size_string = "kDoubleSize";
+    } else {
+      size = struct_type->PackedSize();
+      size_string = std::to_string(size);
+    }
   } else {
-    ReportError("fields of type ", *field_type, " are not (yet) supported");
+    return {};
+  }
+  return std::make_tuple(size, size_string);
+}
+
+bool IsAnyUnsignedInteger(const Type* type) {
+  return type == TypeOracle::GetUint32Type() ||
+         type == TypeOracle::GetUint16Type() ||
+         type == TypeOracle::GetUint8Type() ||
+         type == TypeOracle::GetUIntPtrType();
+}
+
+bool IsAllowedAsBitField(const Type* type) {
+  if (type->IsBitFieldStructType()) {
+    // No nested bitfield structs for now. We could reconsider if there's a
+    // compelling use case.
+    return false;
   }
-  return std::make_tuple(field_size, size_string);
+  // Any integer-ish type, including bools and enums which inherit from integer
+  // types, are allowed. Note, however, that we always zero-extend during
+  // decoding regardless of signedness.
+  return type->IsSubtypeOf(TypeOracle::GetUint32Type()) ||
+         type->IsSubtypeOf(TypeOracle::GetUIntPtrType()) ||
+         type->IsSubtypeOf(TypeOracle::GetInt32Type()) ||
+         type->IsSubtypeOf(TypeOracle::GetIntPtrType()) ||
+         type->IsSubtypeOf(TypeOracle::GetBoolType());
+}
+
+base::Optional<NameAndType> ExtractSimpleFieldArraySize(
+    const ClassType& class_type, Expression* array_size) {
+  IdentifierExpression* identifier =
+      IdentifierExpression::DynamicCast(array_size);
+  if (!identifier || !identifier->generic_arguments.empty() ||
+      !identifier->namespace_qualification.empty())
+    return {};
+  if (!class_type.HasField(identifier->name->value)) return {};
+  return class_type.LookupField(identifier->name->value).name_and_type;
 }
 
 }  // namespace torque
diff --git a/deps/v8/src/torque/types.h b/deps/v8/src/torque/types.h
index 0102cf31d5c499..19b5cdd6351e0c 100644
--- a/deps/v8/src/torque/types.h
+++ b/deps/v8/src/torque/types.h
@@ -25,8 +25,9 @@ class AggregateType;
 struct Identifier;
 class Macro;
 class Method;
-class GenericStructType;
+class GenericType;
 class StructType;
+class Type;
 class ClassType;
 class Value;
 class Namespace;
@@ -38,6 +39,7 @@ class TypeBase {
     kAbstractType,
     kBuiltinPointerType,
     kUnionType,
+    kBitFieldStructType,
     kStructType,
     kClassType
   };
@@ -48,6 +50,9 @@ class TypeBase {
     return kind() == Kind::kBuiltinPointerType;
   }
   bool IsUnionType() const { return kind() == Kind::kUnionType; }
+  bool IsBitFieldStructType() const {
+    return kind() == Kind::kBitFieldStructType;
+  }
   bool IsStructType() const { return kind() == Kind::kStructType; }
   bool IsClassType() const { return kind() == Kind::kClassType; }
   bool IsAggregateType() const { return IsStructType() || IsClassType(); }
@@ -80,12 +85,35 @@ class TypeBase {
     return static_cast<const x*>(declarable);               \
   }
 
+using TypeVector = std::vector<const Type*>;
+
+template <typename T>
+struct SpecializationKey {
+  T* generic;
+  TypeVector specialized_types;
+};
+
+using MaybeSpecializationKey = base::Optional<SpecializationKey<GenericType>>;
+
+struct RuntimeType {
+  std::string type;
+  // If {type} is "MaybeObject", then {weak_ref_to} indicates the corresponding
+  // strong object type. Otherwise, {weak_ref_to} is empty.
+  std::string weak_ref_to;
+};
+
 class V8_EXPORT_PRIVATE Type : public TypeBase {
  public:
   virtual bool IsSubtypeOf(const Type* supertype) const;
 
+  // Default rendering for error messages etc.
   std::string ToString() const;
-  virtual std::string MangledName() const = 0;
+
+  // This name is not unique, but short and somewhat descriptive.
+  // Used for naming generated code.
+  virtual std::string SimpleName() const;
+
+  const Type* parent() const { return parent_; }
   bool IsVoid() const { return IsAbstractName(VOID_TYPE_STRING); }
   bool IsNever() const { return IsAbstractName(NEVER_TYPE_STRING); }
   bool IsBool() const { return IsAbstractName(BOOL_TYPE_STRING); }
@@ -101,21 +129,44 @@ class V8_EXPORT_PRIVATE Type : public TypeBase {
   }
   virtual bool IsTransient() const { return false; }
   virtual const Type* NonConstexprVersion() const { return this; }
-  virtual const Type* ConstexprVersion() const { return nullptr; }
+  std::string GetConstexprGeneratedTypeName() const;
   base::Optional<const ClassType*> ClassSupertype() const;
-  virtual std::vector<std::string> GetRuntimeTypes() const { return {}; }
+  virtual std::vector<RuntimeType> GetRuntimeTypes() const { return {}; }
   static const Type* CommonSupertype(const Type* a, const Type* b);
   void AddAlias(std::string alias) const { aliases_.insert(std::move(alias)); }
+  size_t id() const { return id_; }
+  const MaybeSpecializationKey& GetSpecializedFrom() const {
+    return specialized_from_;
+  }
+
+  static base::Optional<const Type*> MatchUnaryGeneric(const Type* type,
+                                                       GenericType* generic);
+
+  static std::string ComputeName(const std::string& basename,
+                                 MaybeSpecializationKey specialized_from);
+  virtual void SetConstexprVersion(const Type* type) const {
+    constexpr_version_ = type;
+  }
+
+  virtual const Type* ConstexprVersion() const {
+    if (constexpr_version_) return constexpr_version_;
+    if (IsConstexpr()) return this;
+    return nullptr;
+  }
+
+  virtual size_t AlignmentLog2() const;
 
  protected:
-  Type(TypeBase::Kind kind, const Type* parent)
-      : TypeBase(kind), parent_(parent) {}
-  const Type* parent() const { return parent_; }
+  Type(TypeBase::Kind kind, const Type* parent,
+       MaybeSpecializationKey specialized_from = base::nullopt);
+  Type(const Type& other) V8_NOEXCEPT;
+  Type& operator=(const Type& other) = delete;
   void set_parent(const Type* t) { parent_ = t; }
   int Depth() const;
   virtual std::string ToExplicitString() const = 0;
   virtual std::string GetGeneratedTypeNameImpl() const = 0;
   virtual std::string GetGeneratedTNodeTypeNameImpl() const = 0;
+  virtual std::string SimpleNameImpl() const = 0;
 
  private:
   bool IsAbstractName(const std::string& name) const;
@@ -123,10 +174,11 @@ class V8_EXPORT_PRIVATE Type : public TypeBase {
   // If {parent_} is not nullptr, then this type is a subtype of {parent_}.
   const Type* parent_;
   mutable std::set<std::string> aliases_;
+  size_t id_;
+  MaybeSpecializationKey specialized_from_;
+  mutable const Type* constexpr_version_ = nullptr;
 };
 
-using TypeVector = std::vector<const Type*>;
-
 inline size_t hash_value(const TypeVector& types) {
   size_t hash = 0;
   for (const Type* t : types) {
@@ -142,23 +194,27 @@ struct NameAndType {
 
 std::ostream& operator<<(std::ostream& os, const NameAndType& name_and_type);
 
-template <typename T>
-struct SpecializationKey {
-  T* generic;
-  TypeVector specialized_types;
-};
-
 struct Field {
   // TODO(danno): This likely should be refactored, the handling of the types
   // using the universal grab-bag utility with std::tie, as well as the
   // reliance of string types is quite clunky.
   std::tuple<size_t, std::string> GetFieldSizeInformation() const;
 
+  void ValidateAlignment(ResidueClass at_offset) const;
+
   SourcePosition pos;
   const AggregateType* aggregate;
-  base::Optional<NameAndType> index;
+  base::Optional<Expression*> index;
   NameAndType name_and_type;
-  size_t offset;
+
+  // The byte offset of this field from the beginning of the containing class or
+  // struct. Most structs are never packed together in memory, and are only used
+  // to hold a batch of related CSA TNode values, in which case |offset| is
+  // irrelevant.
+  // The offset may be unknown because the field is after an indexed field or
+  // because we don't support the struct field for on-heap layouts.
+  base::Optional<size_t> offset;
+
   bool is_weak;
   bool const_qualified;
   bool generate_verify;
@@ -169,7 +225,6 @@ std::ostream& operator<<(std::ostream& os, const Field& name_and_type);
 class TopType final : public Type {
  public:
   DECLARE_TYPE_BOILERPLATE(TopType)
-  std::string MangledName() const override { return "top"; }
   std::string GetGeneratedTypeNameImpl() const override { UNREACHABLE(); }
   std::string GetGeneratedTNodeTypeNameImpl() const override {
     return source_type_->GetGeneratedTNodeTypeName();
@@ -189,6 +244,8 @@ class TopType final : public Type {
       : Type(Kind::kTopType, nullptr),
         reason_(std::move(reason)),
         source_type_(source_type) {}
+  std::string SimpleNameImpl() const override { return "TopType"; }
+
   std::string reason_;
   const Type* source_type_;
 };
@@ -198,18 +255,13 @@ class AbstractType final : public Type {
   DECLARE_TYPE_BOILERPLATE(AbstractType)
   const std::string& name() const { return name_; }
   std::string ToExplicitString() const override { return name(); }
-  std::string MangledName() const override {
-    std::string str(name());
-    std::replace(str.begin(), str.end(), ' ', '_');
-    return "AT" + str;
-  }
   std::string GetGeneratedTypeNameImpl() const override {
     return IsConstexpr() ? generated_type_ : "TNode<" + generated_type_ + ">";
   }
   std::string GetGeneratedTNodeTypeNameImpl() const override;
-  bool IsConstexpr() const override {
-    bool is_constexpr = non_constexpr_version_ != nullptr;
-    DCHECK_EQ(is_constexpr, IsConstexprName(name()));
+  bool IsConstexpr() const final {
+    const bool is_constexpr = flags_ & AbstractTypeFlag::kConstexpr;
+    DCHECK_IMPLIES(non_constexpr_version_ != nullptr, is_constexpr);
     return is_constexpr;
   }
 
@@ -219,42 +271,41 @@ class AbstractType final : public Type {
     return nullptr;
   }
 
-  const AbstractType* ConstexprVersion() const override {
-    if (constexpr_version_) return constexpr_version_;
-    if (IsConstexpr()) return this;
-    return nullptr;
-  }
+  std::vector<RuntimeType> GetRuntimeTypes() const override;
 
-  std::vector<std::string> GetRuntimeTypes() const override { return {name()}; }
+  size_t AlignmentLog2() const override;
 
  private:
   friend class TypeOracle;
-  AbstractType(const Type* parent, bool transient, const std::string& name,
-               const std::string& generated_type,
-               const Type* non_constexpr_version)
-      : Type(Kind::kAbstractType, parent),
-        transient_(transient),
+  AbstractType(const Type* parent, AbstractTypeFlags flags,
+               const std::string& name, const std::string& generated_type,
+               const Type* non_constexpr_version,
+               MaybeSpecializationKey specialized_from)
+      : Type(Kind::kAbstractType, parent, specialized_from),
+        flags_(flags),
         name_(name),
         generated_type_(generated_type),
         non_constexpr_version_(non_constexpr_version) {
-    if (parent) DCHECK(parent->IsConstexpr() == IsConstexpr());
-    DCHECK_EQ(!IsConstexprName(name), non_constexpr_version == nullptr);
-    DCHECK_IMPLIES(IsConstexprName(name),
-                   !non_constexpr_version->IsConstexpr());
+    if (parent) DCHECK_EQ(parent->IsConstexpr(), IsConstexpr());
+    DCHECK_EQ(IsConstexprName(name), IsConstexpr());
+    DCHECK_IMPLIES(non_constexpr_version_ != nullptr, IsConstexpr());
+    DCHECK(!(IsConstexpr() && (flags_ & AbstractTypeFlag::kTransient)));
   }
 
-  void SetConstexprVersion(const AbstractType* type) const {
-    DCHECK_EQ(GetConstexprName(name()), type->name());
-    constexpr_version_ = type;
+  std::string SimpleNameImpl() const override {
+    if (IsConstexpr())
+      return "constexpr_" + NonConstexprVersion()->SimpleName();
+    return name();
   }
 
-  bool IsTransient() const override { return transient_; }
+  bool IsTransient() const override {
+    return flags_ & AbstractTypeFlag::kTransient;
+  }
 
-  bool transient_;
+  AbstractTypeFlags flags_;
   const std::string name_;
   const std::string generated_type_;
   const Type* non_constexpr_version_;
-  mutable const AbstractType* constexpr_version_ = nullptr;
 };
 
 // For now, builtin pointers are restricted to Torque-defined builtins.
@@ -262,7 +313,6 @@ class V8_EXPORT_PRIVATE BuiltinPointerType final : public Type {
  public:
   DECLARE_TYPE_BOILERPLATE(BuiltinPointerType)
   std::string ToExplicitString() const override;
-  std::string MangledName() const override;
   std::string GetGeneratedTypeNameImpl() const override {
     return parent()->GetGeneratedTypeName();
   }
@@ -286,7 +336,9 @@ class V8_EXPORT_PRIVATE BuiltinPointerType final : public Type {
   }
   size_t function_pointer_type_id() const { return function_pointer_type_id_; }
 
-  std::vector<std::string> GetRuntimeTypes() const override { return {"Smi"}; }
+  std::vector<RuntimeType> GetRuntimeTypes() const override {
+    return {{"Smi", ""}};
+  }
 
  private:
   friend class TypeOracle;
@@ -296,6 +348,7 @@ class V8_EXPORT_PRIVATE BuiltinPointerType final : public Type {
         parameter_types_(parameter_types),
         return_type_(return_type),
         function_pointer_type_id_(function_pointer_type_id) {}
+  std::string SimpleNameImpl() const override;
 
   const TypeVector parameter_types_;
   const Type* const return_type_;
@@ -312,8 +365,6 @@ struct TypeLess {
 class V8_EXPORT_PRIVATE UnionType final : public Type {
  public:
   DECLARE_TYPE_BOILERPLATE(UnionType)
-  std::string ToExplicitString() const override;
-  std::string MangledName() const override;
   std::string GetGeneratedTypeNameImpl() const override {
     return "TNode<" + GetGeneratedTNodeTypeName() + ">";
   }
@@ -376,6 +427,7 @@ class V8_EXPORT_PRIVATE UnionType final : public Type {
       types_.insert(t);
     }
   }
+  std::string ToExplicitString() const override;
 
   void Subtract(const Type* t);
 
@@ -384,10 +436,10 @@ class V8_EXPORT_PRIVATE UnionType final : public Type {
     return union_type ? UnionType(*union_type) : UnionType(t);
   }
 
-  std::vector<std::string> GetRuntimeTypes() const override {
-    std::vector<std::string> result;
+  std::vector<RuntimeType> GetRuntimeTypes() const override {
+    std::vector<RuntimeType> result;
     for (const Type* member : types_) {
-      std::vector<std::string> sub_result = member->GetRuntimeTypes();
+      std::vector<RuntimeType> sub_result = member->GetRuntimeTypes();
       result.insert(result.end(), sub_result.begin(), sub_result.end());
     }
     return result;
@@ -396,16 +448,64 @@ class V8_EXPORT_PRIVATE UnionType final : public Type {
  private:
   explicit UnionType(const Type* t) : Type(Kind::kUnionType, t), types_({t}) {}
   void RecomputeParent();
+  std::string SimpleNameImpl() const override;
 
   std::set<const Type*, TypeLess> types_;
 };
 
 const Type* SubtractType(const Type* a, const Type* b);
 
+struct BitField {
+  SourcePosition pos;
+  NameAndType name_and_type;
+  int offset;
+  int num_bits;
+};
+
+class V8_EXPORT_PRIVATE BitFieldStructType final : public Type {
+ public:
+  DECLARE_TYPE_BOILERPLATE(BitFieldStructType)
+  std::string ToExplicitString() const override;
+  std::string GetGeneratedTypeNameImpl() const override {
+    return parent()->GetGeneratedTypeName();
+  }
+  std::string GetGeneratedTNodeTypeNameImpl() const override {
+    return parent()->GetGeneratedTNodeTypeName();
+  }
+
+  std::vector<RuntimeType> GetRuntimeTypes() const override {
+    return {{parent()->GetGeneratedTNodeTypeName(), ""}};
+  }
+
+  void SetConstexprVersion(const Type*) const override { UNREACHABLE(); }
+  const Type* ConstexprVersion() const override {
+    return parent()->ConstexprVersion();
+  }
+
+  void RegisterField(BitField field) { fields_.push_back(std::move(field)); }
+
+  const std::string& name() const { return decl_->name->value; }
+  const std::vector<BitField>& fields() const { return fields_; }
+
+  const BitField& LookupField(const std::string& name) const;
+
+ private:
+  friend class TypeOracle;
+  BitFieldStructType(Namespace* nspace, const Type* parent,
+                     const BitFieldStructDeclaration* decl)
+      : Type(Kind::kBitFieldStructType, parent),
+        namespace_(nspace),
+        decl_(decl) {}
+  std::string SimpleNameImpl() const override { return name(); }
+
+  Namespace* namespace_;
+  const BitFieldStructDeclaration* decl_;
+  std::vector<BitField> fields_;
+};
+
 class AggregateType : public Type {
  public:
   DECLARE_TYPE_BOILERPLATE(AggregateType)
-  std::string MangledName() const override { return name_; }
   std::string GetGeneratedTypeNameImpl() const override { UNREACHABLE(); }
   std::string GetGeneratedTNodeTypeNameImpl() const override { UNREACHABLE(); }
 
@@ -423,10 +523,6 @@ class AggregateType : public Type {
   const std::string& name() const { return name_; }
   Namespace* nspace() const { return namespace_; }
 
-  std::string GetGeneratedMethodName(const std::string& name) const {
-    return "_method_" + name_ + "_" + name;
-  }
-
   virtual const Field& RegisterField(Field field) {
     fields_.push_back(field);
     return fields_.back();
@@ -440,12 +536,15 @@ class AggregateType : public Type {
   std::vector<Method*> Methods(const std::string& name) const;
 
   std::vector<const AggregateType*> GetHierarchy() const;
-  std::vector<std::string> GetRuntimeTypes() const override { return {name_}; }
+  std::vector<RuntimeType> GetRuntimeTypes() const override {
+    return {{name_, ""}};
+  }
 
  protected:
   AggregateType(Kind kind, const Type* parent, Namespace* nspace,
-                const std::string& name)
-      : Type(kind, parent),
+                const std::string& name,
+                MaybeSpecializationKey specialized_from = base::nullopt)
+      : Type(kind, parent, specialized_from),
         is_finalized_(false),
         namespace_(nspace),
         name_(name) {}
@@ -453,6 +552,7 @@ class AggregateType : public Type {
   void CheckForDuplicateFields() const;
   // Use this lookup if you do not want to trigger finalization on this type.
   const Field& LookupFieldInternal(const std::string& name) const;
+  std::string SimpleNameImpl() const override { return name_; }
 
  protected:
   mutable bool is_finalized_;
@@ -468,37 +568,24 @@ class StructType final : public AggregateType {
  public:
   DECLARE_TYPE_BOILERPLATE(StructType)
 
-  using MaybeSpecializationKey =
-      base::Optional<SpecializationKey<GenericStructType>>;
-
-  std::string ToExplicitString() const override;
   std::string GetGeneratedTypeNameImpl() const override;
-  std::string MangledName() const override;
-  const MaybeSpecializationKey& GetSpecializedFrom() const {
-    return specialized_from_;
-  }
 
-  static base::Optional<const Type*> MatchUnaryGeneric(
-      const Type* type, GenericStructType* generic);
-  static base::Optional<const Type*> MatchUnaryGeneric(
-      const StructType* type, GenericStructType* generic);
+  // Returns the sum of the size of all members.
+  size_t PackedSize() const;
+
+  size_t AlignmentLog2() const override;
 
  private:
   friend class TypeOracle;
   StructType(Namespace* nspace, const StructDeclaration* decl,
-             MaybeSpecializationKey specialized_from = base::nullopt)
-      : AggregateType(Kind::kStructType, nullptr, nspace,
-                      ComputeName(decl->name->value, specialized_from)),
-        decl_(decl),
-        specialized_from_(specialized_from) {}
+             MaybeSpecializationKey specialized_from = base::nullopt);
 
   void Finalize() const override;
-
-  static std::string ComputeName(const std::string& basename,
-                                 MaybeSpecializationKey specialized_from);
+  std::string ToExplicitString() const override;
+  std::string SimpleNameImpl() const override;
 
   const StructDeclaration* decl_;
-  MaybeSpecializationKey specialized_from_;
+  std::string generated_type_name_;
 };
 
 class TypeAlias;
@@ -518,26 +605,31 @@ class ClassType final : public AggregateType {
   }
   bool ShouldGenerateVerify() const {
     return (flags_ & ClassFlag::kGenerateVerify || !IsExtern()) &&
-           !HasUndefinedLayout();
+           !HasUndefinedLayout() && !IsShape();
   }
   bool IsTransient() const override { return flags_ & ClassFlag::kTransient; }
   bool IsAbstract() const { return flags_ & ClassFlag::kAbstract; }
-  bool IsInstantiatedAbstractClass() const {
-    return flags_ & ClassFlag::kInstantiatedAbstractClass;
-  }
   bool HasSameInstanceTypeAsParent() const {
     return flags_ & ClassFlag::kHasSameInstanceTypeAsParent;
   }
   bool GenerateCppClassDefinitions() const {
     return flags_ & ClassFlag::kGenerateCppClassDefinitions || !IsExtern();
   }
+  bool IsShape() const { return flags_ & ClassFlag::kIsShape; }
+  bool HasStaticSize() const;
   bool HasIndexedField() const override;
-  size_t size() const { return size_; }
+  size_t header_size() const {
+    if (!is_finalized_) Finalize();
+    return header_size_;
+  }
+  ResidueClass size() const {
+    if (!is_finalized_) Finalize();
+    return size_;
+  }
   const ClassType* GetSuperClass() const {
     if (parent() == nullptr) return nullptr;
     return parent()->IsClassType() ? ClassType::DynamicCast(parent()) : nullptr;
   }
-  void SetSize(size_t size) { size_ = size; }
   void GenerateAccessors();
   bool AllowInstantiation() const;
   const Field& RegisterField(Field field) override {
@@ -571,7 +663,8 @@ class ClassType final : public AggregateType {
             ClassFlags flags, const std::string& generates,
             const ClassDeclaration* decl, const TypeAlias* alias);
 
-  size_t size_;
+  size_t header_size_;
+  ResidueClass size_;
   mutable ClassFlags flags_;
   const std::string generates_;
   const ClassDeclaration* decl_;
@@ -702,6 +795,13 @@ TypeVector LowerParameterTypes(const TypeVector& parameters);
 TypeVector LowerParameterTypes(const ParameterTypes& parameter_types,
                                size_t vararg_count = 0);
 
+base::Optional<std::tuple<size_t, std::string>> SizeOf(const Type* type);
+bool IsAnyUnsignedInteger(const Type* type);
+bool IsAllowedAsBitField(const Type* type);
+
+base::Optional<NameAndType> ExtractSimpleFieldArraySize(
+    const ClassType& class_type, Expression* array_size);
+
 }  // namespace torque
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/torque/utils.cc b/deps/v8/src/torque/utils.cc
index 4e757ac9e86771..9c04d73d1b7f01 100644
--- a/deps/v8/src/torque/utils.cc
+++ b/deps/v8/src/torque/utils.cc
@@ -7,8 +7,11 @@
 #include <iostream>
 #include <string>
 
+#include "src/base/bits.h"
 #include "src/base/logging.h"
 #include "src/torque/ast.h"
+#include "src/torque/constants.h"
+#include "src/torque/declarable.h"
 #include "src/torque/utils.h"
 
 namespace v8 {
@@ -130,10 +133,32 @@ MessageBuilder::MessageBuilder(const std::string& message,
     position = CurrentSourcePosition::Get();
   }
   message_ = TorqueMessage{message, position, kind};
+  if (CurrentScope::HasScope()) {
+    // Traverse the parent scopes to find one that was created to represent a
+    // specialization of something generic. If we find one, then log it and
+    // continue walking the scope tree of the code that requested that
+    // specialization. This allows us to collect the stack of locations that
+    // caused a specialization.
+    Scope* scope = CurrentScope::Get();
+    while (scope) {
+      SpecializationRequester requester = scope->GetSpecializationRequester();
+      if (!requester.IsNone()) {
+        extra_messages_.push_back(
+            {"Note: in specialization " + requester.name + " requested here",
+             requester.position, kind});
+        scope = requester.scope;
+      } else {
+        scope = scope->ParentScope();
+      }
+    }
+  }
 }
 
 void MessageBuilder::Report() const {
   TorqueMessages::Get().push_back(message_);
+  for (const auto& message : extra_messages_) {
+    TorqueMessages::Get().push_back(message);
+  }
 }
 
 [[noreturn]] void MessageBuilder::Throw() const {
@@ -168,9 +193,17 @@ bool IsKeywordLikeName(const std::string& s) {
 // naming convention and are those exempt from the normal type convention.
 bool IsMachineType(const std::string& s) {
   static const char* const machine_types[]{
-      "void",    "never", "int8",   "uint8", "int16",  "uint16",  "int31",
-      "uint31",  "int32", "uint32", "int64", "intptr", "uintptr", "float32",
-      "float64", "bool",  "string", "bint",  "char8",  "char16"};
+      VOID_TYPE_STRING,    NEVER_TYPE_STRING,
+      INT8_TYPE_STRING,    UINT8_TYPE_STRING,
+      INT16_TYPE_STRING,   UINT16_TYPE_STRING,
+      INT31_TYPE_STRING,   UINT31_TYPE_STRING,
+      INT32_TYPE_STRING,   UINT32_TYPE_STRING,
+      INT64_TYPE_STRING,   INTPTR_TYPE_STRING,
+      UINTPTR_TYPE_STRING, FLOAT32_TYPE_STRING,
+      FLOAT64_TYPE_STRING, FLOAT64_OR_HOLE_TYPE_STRING,
+      BOOL_TYPE_STRING,    "string",
+      BINT_TYPE_STRING,    CHAR8_TYPE_STRING,
+      CHAR16_TYPE_STRING};
 
   return std::find(std::begin(machine_types), std::end(machine_types), s) !=
          std::end(machine_types);
@@ -334,6 +367,18 @@ IncludeObjectMacrosScope::~IncludeObjectMacrosScope() {
   os_ << "\n#include \"src/objects/object-macros-undef.h\"\n";
 }
 
+size_t ResidueClass::AlignmentLog2() const {
+  if (value_ == 0) return modulus_log_2_;
+  return base::bits::CountTrailingZeros(value_);
+}
+
+const size_t ResidueClass::kMaxModulusLog2;
+
+std::ostream& operator<<(std::ostream& os, const ResidueClass& a) {
+  if (a.SingleValue().has_value()) return os << *a.SingleValue();
+  return os << "[" << a.value_ << " mod 2^" << a.modulus_log_2_ << "]";
+}
+
 }  // namespace torque
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/torque/utils.h b/deps/v8/src/torque/utils.h
index 5f44dedea9ec6c..448e7da7fb7e16 100644
--- a/deps/v8/src/torque/utils.h
+++ b/deps/v8/src/torque/utils.h
@@ -38,6 +38,13 @@ struct TorqueMessage {
 
 DECLARE_CONTEXTUAL_VARIABLE(TorqueMessages, std::vector<TorqueMessage>);
 
+template <class... Args>
+std::string ToString(Args&&... args) {
+  std::stringstream stream;
+  USE((stream << std::forward<Args>(args))...);
+  return stream.str();
+}
+
 class V8_EXPORT_PRIVATE MessageBuilder {
  public:
   MessageBuilder(const std::string& message, TorqueMessage::Kind kind);
@@ -59,6 +66,7 @@ class V8_EXPORT_PRIVATE MessageBuilder {
   void Report() const;
 
   TorqueMessage message_;
+  std::vector<TorqueMessage> extra_messages_;
 };
 
 // Used for throwing exceptions. Retrieve TorqueMessage from the contextual
@@ -67,9 +75,7 @@ struct TorqueAbortCompilation {};
 
 template <class... Args>
 static MessageBuilder Message(TorqueMessage::Kind kind, Args&&... args) {
-  std::stringstream stream;
-  USE((stream << std::forward<Args>(args))...);
-  return MessageBuilder(stream.str(), kind);
+  return MessageBuilder(ToString(std::forward<Args>(args)...), kind);
 }
 
 template <class... Args>
@@ -112,47 +118,56 @@ class Deduplicator {
   std::unordered_set<T, base::hash<T>> storage_;
 };
 
-template <class C, class T>
-void PrintCommaSeparatedList(std::ostream& os, const T& list, C transform) {
-  bool first = true;
-  for (auto& e : list) {
-    if (first) {
-      first = false;
-    } else {
-      os << ", ";
-    }
-    os << transform(e);
-  }
+template <class T>
+T& DereferenceIfPointer(T* x) {
+  return *x;
+}
+template <class T>
+T&& DereferenceIfPointer(T&& x) {
+  return std::forward<T>(x);
 }
 
-template <class T,
-          typename std::enable_if<
-              std::is_pointer<typename T::value_type>::value, int>::type = 0>
-void PrintCommaSeparatedList(std::ostream& os, const T& list) {
-  bool first = true;
-  for (auto& e : list) {
-    if (first) {
-      first = false;
-    } else {
-      os << ", ";
+template <class T, class L>
+struct ListPrintAdaptor {
+  const T& list;
+  const std::string& separator;
+  L transformer;
+
+  friend std::ostream& operator<<(std::ostream& os, const ListPrintAdaptor& l) {
+    bool first = true;
+    for (auto& e : l.list) {
+      if (first) {
+        first = false;
+      } else {
+        os << l.separator;
+      }
+      os << DereferenceIfPointer(l.transformer(e));
     }
-    os << *e;
+    return os;
   }
+};
+
+template <class T>
+auto PrintList(const T& list, const std::string& separator = ", ") {
+  using ElementType = decltype(*list.begin());
+  auto id = [](ElementType el) { return el; };
+  return ListPrintAdaptor<T, decltype(id)>{list, separator, id};
+}
+
+template <class T, class L>
+auto PrintList(const T& list, const std::string& separator, L&& transformer) {
+  return ListPrintAdaptor<T, L&&>{list, separator,
+                                  std::forward<L>(transformer)};
+}
+
+template <class C, class T>
+void PrintCommaSeparatedList(std::ostream& os, const T& list, C&& transform) {
+  os << PrintList(list, ", ", std::forward<C>(transform));
 }
 
-template <class T,
-          typename std::enable_if<
-              !std::is_pointer<typename T::value_type>::value, int>::type = 0>
+template <class T>
 void PrintCommaSeparatedList(std::ostream& os, const T& list) {
-  bool first = true;
-  for (auto& e : list) {
-    if (first) {
-      first = false;
-    } else {
-      os << ", ";
-    }
-    os << e;
-  }
+  os << PrintList(list, ", ");
 }
 
 struct BottomOffset {
@@ -298,18 +313,6 @@ inline std::ostream& operator<<(std::ostream& os, const Stack<T>& t) {
   os << "}";
   return os;
 }
-class ToString {
- public:
-  template <class T>
-  ToString& operator<<(T&& x) {
-    s_ << std::forward<T>(x);
-    return *this;
-  }
-  operator std::string() { return s_.str(); }
-
- private:
-  std::stringstream s_;
-};
 
 static const char* const kBaseNamespaceName = "base";
 static const char* const kTestNamespaceName = "test";
@@ -404,6 +407,87 @@ class IncludeObjectMacrosScope {
   std::ostream& os_;
 };
 
+// A value of ResidueClass is a congruence class of integers modulo a power
+// of 2.
+// In contrast to common modulo arithmetic, we also allow addition and
+// multiplication of congruence classes with different modulus. In this case, we
+// do an abstract-interpretation style approximation to produce an as small as
+// possible congruence class. ResidueClass is used to represent partial
+// knowledge about offsets and sizes to validate alignment constraints.
+// ResidueClass(x,m) = {y \in Z | x == y mod 2^m} = {x+k2^m | k \in Z} where Z
+// is the set of all integers.
+// Notation: 2^x is 2 to the power of x.
+class ResidueClass {
+ public:
+  ResidueClass(size_t value, size_t modulus_log_2 =
+                                 kMaxModulusLog2)  // NOLINT(runtime/explicit)
+      : value_(value),
+        modulus_log_2_(std::min(modulus_log_2, kMaxModulusLog2)) {
+    if (modulus_log_2_ < kMaxModulusLog2) {
+      value_ %= size_t{1} << modulus_log_2_;
+    }
+  }
+
+  // 0 modulo 1, in other words, the class of all integers.
+  static ResidueClass Unknown() { return ResidueClass{0, 0}; }
+
+  // If the modulus corresponds to the size of size_t, it represents a concrete
+  // value.
+  base::Optional<size_t> SingleValue() const {
+    if (modulus_log_2_ == kMaxModulusLog2) return value_;
+    return base::nullopt;
+  }
+
+  friend ResidueClass operator+(const ResidueClass& a, const ResidueClass& b) {
+    return ResidueClass{a.value_ + b.value_,
+                        std::min(a.modulus_log_2_, b.modulus_log_2_)};
+  }
+
+  // Reasoning for the choice of the new modulus:
+  // {x+k2^a | k \in Z} * {y+l2^b | l \in Z}
+  // = {xy + xl2^b + yk2^a + kl2^(a+b)| k,l \in Z},
+  // which is a subset of {xy + k2^c | k \in Z}
+  // if 2^c is a common divisor of x2^b, y2^a and hence also of 2^(a+b) since
+  // x<2^a and y<2^b.
+  // So we use the gcd of x2^b and y2^a as the new modulus.
+  friend ResidueClass operator*(const ResidueClass& a, const ResidueClass& b) {
+    return ResidueClass{a.value_ * b.value_,
+                        std::min(a.modulus_log_2_ + b.AlignmentLog2(),
+                                 b.modulus_log_2_ + a.AlignmentLog2())};
+  }
+
+  friend std::ostream& operator<<(std::ostream& os, const ResidueClass& a);
+
+  ResidueClass& operator+=(const ResidueClass& other) {
+    *this = *this + other;
+    return *this;
+  }
+
+  ResidueClass& operator*=(const ResidueClass& other) {
+    *this = *this * other;
+    return *this;
+  }
+
+  // 2^AlignmentLog2() is the larget power of 2 that divides all elements of the
+  // congruence class.
+  size_t AlignmentLog2() const;
+  size_t Alignment() const {
+    DCHECK_LT(AlignmentLog2(), kMaxModulusLog2);
+    return size_t{1} << AlignmentLog2();
+  }
+
+ private:
+  // The value is the representative of the congruence class. It's always
+  // smaller than 2^modulus_log_2_.
+  size_t value_;
+  // Base 2 logarithm of the modulus.
+  size_t modulus_log_2_;
+
+  // size_t values are modulo 2^kMaxModulusLog2, so we don't consider larger
+  // modulus.
+  static const size_t kMaxModulusLog2 = 8 * sizeof(size_t);
+};
+
 }  // namespace torque
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/tracing/trace-event.h b/deps/v8/src/tracing/trace-event.h
index 53839ba4b1de87..0a650a8ebb79b5 100644
--- a/deps/v8/src/tracing/trace-event.h
+++ b/deps/v8/src/tracing/trace-event.h
@@ -38,14 +38,6 @@ enum CategoryGroupEnabledFlags {
 // and will not be copied. Use this macro to force a const char* to be copied.
 #define TRACE_STR_COPY(str) v8::internal::tracing::TraceStringWithCopy(str)
 
-// By default, uint64 ID argument values are not mangled with the Process ID in
-// TRACE_EVENT_ASYNC macros. Use this macro to force Process ID mangling.
-#define TRACE_ID_MANGLE(id) v8::internal::tracing::TraceID::ForceMangle(id)
-
-// By default, pointers are mangled with the Process ID in TRACE_EVENT_ASYNC
-// macros. Use this macro to prevent Process ID mangling.
-#define TRACE_ID_DONT_MANGLE(id) v8::internal::tracing::TraceID::DontMangle(id)
-
 // By default, trace IDs are eventually converted to a single 64-bit number. Use
 // this macro to add a scope string.
 #define TRACE_ID_WITH_SCOPE(scope, id) \
@@ -303,9 +295,7 @@ class TraceEventHelper {
   V8_EXPORT_PRIVATE static v8::TracingController* GetTracingController();
 };
 
-// TraceID encapsulates an ID that can either be an integer or pointer. Pointers
-// are by default mangled with the Process ID so that they are unlikely to
-// collide when the same pointer is used on different processes.
+// TraceID encapsulates an ID that can either be an integer or pointer.
 class TraceID {
  public:
   class WithScope {
@@ -320,59 +310,8 @@ class TraceID {
     uint64_t raw_id_;
   };
 
-  class DontMangle {
-   public:
-    explicit DontMangle(const void* raw_id)
-        : raw_id_(static_cast<uint64_t>(reinterpret_cast<uintptr_t>(raw_id))) {}
-    explicit DontMangle(uint64_t raw_id) : raw_id_(raw_id) {}
-    explicit DontMangle(unsigned int raw_id) : raw_id_(raw_id) {}
-    explicit DontMangle(uint16_t raw_id) : raw_id_(raw_id) {}
-    explicit DontMangle(unsigned char raw_id) : raw_id_(raw_id) {}
-    explicit DontMangle(int64_t raw_id)
-        : raw_id_(static_cast<uint64_t>(raw_id)) {}
-    explicit DontMangle(int raw_id) : raw_id_(static_cast<uint64_t>(raw_id)) {}
-    explicit DontMangle(int16_t raw_id)
-        : raw_id_(static_cast<uint64_t>(raw_id)) {}
-    explicit DontMangle(signed char raw_id)
-        : raw_id_(static_cast<uint64_t>(raw_id)) {}
-    explicit DontMangle(WithScope scoped_id)
-        : scope_(scoped_id.scope()), raw_id_(scoped_id.raw_id()) {}
-    const char* scope() const { return scope_; }
-    uint64_t raw_id() const { return raw_id_; }
-
-   private:
-    const char* scope_ = nullptr;
-    uint64_t raw_id_;
-  };
-
-  class ForceMangle {
-   public:
-    explicit ForceMangle(uint64_t raw_id) : raw_id_(raw_id) {}
-    explicit ForceMangle(unsigned int raw_id) : raw_id_(raw_id) {}
-    explicit ForceMangle(uint16_t raw_id) : raw_id_(raw_id) {}
-    explicit ForceMangle(unsigned char raw_id) : raw_id_(raw_id) {}
-    explicit ForceMangle(int64_t raw_id)
-        : raw_id_(static_cast<uint64_t>(raw_id)) {}
-    explicit ForceMangle(int raw_id) : raw_id_(static_cast<uint64_t>(raw_id)) {}
-    explicit ForceMangle(int16_t raw_id)
-        : raw_id_(static_cast<uint64_t>(raw_id)) {}
-    explicit ForceMangle(signed char raw_id)
-        : raw_id_(static_cast<uint64_t>(raw_id)) {}
-    uint64_t raw_id() const { return raw_id_; }
-
-   private:
-    uint64_t raw_id_;
-  };
-
   TraceID(const void* raw_id, unsigned int* flags)
-      : raw_id_(static_cast<uint64_t>(reinterpret_cast<uintptr_t>(raw_id))) {
-    *flags |= TRACE_EVENT_FLAG_MANGLE_ID;
-  }
-  TraceID(ForceMangle raw_id, unsigned int* flags) : raw_id_(raw_id.raw_id()) {
-    *flags |= TRACE_EVENT_FLAG_MANGLE_ID;
-  }
-  TraceID(DontMangle maybe_scoped_id, unsigned int* flags)
-      : scope_(maybe_scoped_id.scope()), raw_id_(maybe_scoped_id.raw_id()) {}
+      : raw_id_(static_cast<uint64_t>(reinterpret_cast<uintptr_t>(raw_id))) {}
   TraceID(uint64_t raw_id, unsigned int* flags) : raw_id_(raw_id) {
     (void)flags;
   }
@@ -412,16 +351,6 @@ class TraceID {
   uint64_t raw_id_;
 };
 
-// Simple union to store various types as uint64_t.
-union TraceValueUnion {
-  bool as_bool;
-  uint64_t as_uint;
-  int64_t as_int;
-  double as_double;
-  const void* as_pointer;
-  const char* as_string;
-};
-
 // Simple container for const char* that should be copied instead of retained.
 class TraceStringWithCopy {
  public:
@@ -479,42 +408,32 @@ static V8_INLINE uint64_t AddTraceEventWithTimestampImpl(
 // Define SetTraceValue for each allowed type. It stores the type and
 // value in the return arguments. This allows this API to avoid declaring any
 // structures so that it is portable to third_party libraries.
-#define INTERNAL_DECLARE_SET_TRACE_VALUE(actual_type, union_member,         \
-                                         value_type_id)                     \
-  static V8_INLINE void SetTraceValue(actual_type arg, unsigned char* type, \
-                                      uint64_t* value) {                    \
-    TraceValueUnion type_value;                                             \
-    type_value.union_member = arg;                                          \
-    *type = value_type_id;                                                  \
-    *value = type_value.as_uint;                                            \
-  }
-// Simpler form for int types that can be safely casted.
-#define INTERNAL_DECLARE_SET_TRACE_VALUE_INT(actual_type, value_type_id)    \
+// This is the base implementation for integer types (including bool) and enums.
+template <typename T>
+static V8_INLINE typename std::enable_if<
+    std::is_integral<T>::value || std::is_enum<T>::value, void>::type
+SetTraceValue(T arg, unsigned char* type, uint64_t* value) {
+  *type = std::is_same<T, bool>::value
+              ? TRACE_VALUE_TYPE_BOOL
+              : std::is_signed<T>::value ? TRACE_VALUE_TYPE_INT
+                                         : TRACE_VALUE_TYPE_UINT;
+  *value = static_cast<uint64_t>(arg);
+}
+
+#define INTERNAL_DECLARE_SET_TRACE_VALUE(actual_type, value_type_id)        \
   static V8_INLINE void SetTraceValue(actual_type arg, unsigned char* type, \
                                       uint64_t* value) {                    \
     *type = value_type_id;                                                  \
-    *value = static_cast<uint64_t>(arg);                                    \
+    *value = 0;                                                             \
+    STATIC_ASSERT(sizeof(arg) <= sizeof(*value));                           \
+    memcpy(value, &arg, sizeof(arg));                                       \
   }
-
-INTERNAL_DECLARE_SET_TRACE_VALUE_INT(uint64_t, TRACE_VALUE_TYPE_UINT)
-INTERNAL_DECLARE_SET_TRACE_VALUE_INT(unsigned int, TRACE_VALUE_TYPE_UINT)
-INTERNAL_DECLARE_SET_TRACE_VALUE_INT(uint16_t, TRACE_VALUE_TYPE_UINT)
-INTERNAL_DECLARE_SET_TRACE_VALUE_INT(unsigned char, TRACE_VALUE_TYPE_UINT)
-INTERNAL_DECLARE_SET_TRACE_VALUE_INT(int64_t, TRACE_VALUE_TYPE_INT)
-INTERNAL_DECLARE_SET_TRACE_VALUE_INT(int, TRACE_VALUE_TYPE_INT)
-INTERNAL_DECLARE_SET_TRACE_VALUE_INT(int16_t, TRACE_VALUE_TYPE_INT)
-INTERNAL_DECLARE_SET_TRACE_VALUE_INT(signed char, TRACE_VALUE_TYPE_INT)
-INTERNAL_DECLARE_SET_TRACE_VALUE(bool, as_bool, TRACE_VALUE_TYPE_BOOL)
-INTERNAL_DECLARE_SET_TRACE_VALUE(double, as_double, TRACE_VALUE_TYPE_DOUBLE)
-INTERNAL_DECLARE_SET_TRACE_VALUE(const void*, as_pointer,
-                                 TRACE_VALUE_TYPE_POINTER)
-INTERNAL_DECLARE_SET_TRACE_VALUE(const char*, as_string,
-                                 TRACE_VALUE_TYPE_STRING)
-INTERNAL_DECLARE_SET_TRACE_VALUE(const TraceStringWithCopy&, as_string,
+INTERNAL_DECLARE_SET_TRACE_VALUE(double, TRACE_VALUE_TYPE_DOUBLE)
+INTERNAL_DECLARE_SET_TRACE_VALUE(const void*, TRACE_VALUE_TYPE_POINTER)
+INTERNAL_DECLARE_SET_TRACE_VALUE(const char*, TRACE_VALUE_TYPE_STRING)
+INTERNAL_DECLARE_SET_TRACE_VALUE(const TraceStringWithCopy&,
                                  TRACE_VALUE_TYPE_COPY_STRING)
-
 #undef INTERNAL_DECLARE_SET_TRACE_VALUE
-#undef INTERNAL_DECLARE_SET_TRACE_VALUE_INT
 
 static V8_INLINE void SetTraceValue(ConvertableToTraceFormat* convertable_value,
                                     unsigned char* type, uint64_t* value) {
diff --git a/deps/v8/src/trap-handler/handler-inside-posix.cc b/deps/v8/src/trap-handler/handler-inside-posix.cc
index 60f3398ece1ff0..6228e87e84f8a6 100644
--- a/deps/v8/src/trap-handler/handler-inside-posix.cc
+++ b/deps/v8/src/trap-handler/handler-inside-posix.cc
@@ -27,7 +27,7 @@
 
 #include <signal.h>
 
-#ifdef V8_OS_LINUX
+#if defined(V8_OS_LINUX) || defined(V8_OS_FREEBSD)
 #include <ucontext.h>
 #elif V8_OS_MACOSX
 #include <sys/ucontext.h>
@@ -112,6 +112,8 @@ bool TryHandleSignal(int signum, siginfo_t* info, void* context) {
     auto* context_rip = &uc->uc_mcontext.gregs[REG_RIP];
 #elif V8_OS_MACOSX
     auto* context_rip = &uc->uc_mcontext->__ss.__rip;
+#elif V8_OS_FREEBSD
+    auto* context_rip = &uc->uc_mcontext.mc_rip;
 #else
 #error Unsupported platform
 #endif
diff --git a/deps/v8/src/trap-handler/handler-inside-posix.h b/deps/v8/src/trap-handler/handler-inside-posix.h
index a167455efcde13..49fe23a7128245 100644
--- a/deps/v8/src/trap-handler/handler-inside-posix.h
+++ b/deps/v8/src/trap-handler/handler-inside-posix.h
@@ -12,12 +12,12 @@ namespace v8 {
 namespace internal {
 namespace trap_handler {
 
-#if V8_OS_LINUX
+#if V8_OS_LINUX || V8_OS_FREEBSD
 constexpr int kOobSignal = SIGSEGV;
 #elif V8_OS_MACOSX
 constexpr int kOobSignal = SIGBUS;
 #else
-#error Posix trap handlers are only supported on Linux and MacOSX.
+#error Posix trap handlers are only supported on Linux, MacOSX and FreeBSD.
 #endif
 
 void HandleSignal(int signum, siginfo_t* info, void* context);
diff --git a/deps/v8/src/trap-handler/trap-handler.h b/deps/v8/src/trap-handler/trap-handler.h
index 51f5fe82502e44..f6fdca553e181b 100644
--- a/deps/v8/src/trap-handler/trap-handler.h
+++ b/deps/v8/src/trap-handler/trap-handler.h
@@ -23,6 +23,8 @@ namespace trap_handler {
 #define V8_TRAP_HANDLER_SUPPORTED true
 #elif V8_TARGET_ARCH_X64 && V8_OS_MACOSX
 #define V8_TRAP_HANDLER_SUPPORTED true
+#elif V8_TARGET_ARCH_X64 && V8_OS_FREEBSD
+#define V8_TRAP_HANDLER_SUPPORTED true
 #else
 #define V8_TRAP_HANDLER_SUPPORTED false
 #endif
diff --git a/deps/v8/src/utils/allocation.cc b/deps/v8/src/utils/allocation.cc
index c89f83ba85dc5f..12dfaf95726f1e 100644
--- a/deps/v8/src/utils/allocation.cc
+++ b/deps/v8/src/utils/allocation.cc
@@ -210,6 +210,8 @@ bool OnCriticalMemoryPressure(size_t length) {
   return true;
 }
 
+VirtualMemory::VirtualMemory() = default;
+
 VirtualMemory::VirtualMemory(v8::PageAllocator* page_allocator, size_t size,
                              void* hint, size_t alignment)
     : page_allocator_(page_allocator) {
diff --git a/deps/v8/src/utils/allocation.h b/deps/v8/src/utils/allocation.h
index 4cb244172c5ba9..2cdd12242ed707 100644
--- a/deps/v8/src/utils/allocation.h
+++ b/deps/v8/src/utils/allocation.h
@@ -76,7 +76,7 @@ class FreeStoreAllocationPolicy {
 void* AllocWithRetry(size_t size);
 
 V8_EXPORT_PRIVATE void* AlignedAlloc(size_t size, size_t alignment);
-void AlignedFree(void* ptr);
+V8_EXPORT_PRIVATE void AlignedFree(void* ptr);
 
 // Returns platfrom page allocator instance. Guaranteed to be a valid pointer.
 V8_EXPORT_PRIVATE v8::PageAllocator* GetPlatformPageAllocator();
@@ -148,17 +148,18 @@ inline bool SetPermissions(v8::PageAllocator* page_allocator, Address address,
 V8_EXPORT_PRIVATE bool OnCriticalMemoryPressure(size_t length);
 
 // Represents and controls an area of reserved memory.
-class V8_EXPORT_PRIVATE VirtualMemory final {
+class VirtualMemory final {
  public:
   // Empty VirtualMemory object, controlling no reserved memory.
-  VirtualMemory() = default;
+  V8_EXPORT_PRIVATE VirtualMemory();
 
   // Reserves virtual memory containing an area of the given size that is
   // aligned per |alignment| rounded up to the |page_allocator|'s allocate page
   // size. The |size| must be aligned with |page_allocator|'s commit page size.
   // This may not be at the position returned by address().
-  VirtualMemory(v8::PageAllocator* page_allocator, size_t size, void* hint,
-                size_t alignment = 1);
+  V8_EXPORT_PRIVATE VirtualMemory(v8::PageAllocator* page_allocator,
+                                  size_t size, void* hint,
+                                  size_t alignment = 1);
 
   // Construct a virtual memory by assigning it some already mapped address
   // and size.
@@ -171,7 +172,7 @@ class V8_EXPORT_PRIVATE VirtualMemory final {
 
   // Releases the reserved memory, if any, controlled by this VirtualMemory
   // object.
-  ~VirtualMemory();
+  V8_EXPORT_PRIVATE ~VirtualMemory();
 
   // Move constructor.
   VirtualMemory(VirtualMemory&& other) V8_NOEXCEPT { *this = std::move(other); }
@@ -189,7 +190,7 @@ class V8_EXPORT_PRIVATE VirtualMemory final {
   bool IsReserved() const { return region_.begin() != kNullAddress; }
 
   // Initialize or resets an embedded VirtualMemory object.
-  void Reset();
+  V8_EXPORT_PRIVATE void Reset();
 
   v8::PageAllocator* page_allocator() { return page_allocator_; }
 
@@ -217,14 +218,14 @@ class V8_EXPORT_PRIVATE VirtualMemory final {
 
   // Sets permissions according to the access argument. address and size must be
   // multiples of CommitPageSize(). Returns true on success, otherwise false.
-  bool SetPermissions(Address address, size_t size,
-                      PageAllocator::Permission access);
+  V8_EXPORT_PRIVATE bool SetPermissions(Address address, size_t size,
+                                        PageAllocator::Permission access);
 
   // Releases memory after |free_start|. Returns the number of bytes released.
-  size_t Release(Address free_start);
+  V8_EXPORT_PRIVATE size_t Release(Address free_start);
 
   // Frees all memory.
-  void Free();
+  V8_EXPORT_PRIVATE void Free();
 
   bool InVM(Address address, size_t size) {
     return region_.contains(address, size);
diff --git a/deps/v8/src/utils/bit-vector.cc b/deps/v8/src/utils/bit-vector.cc
index 8d4b097bfd2a55..20e645f24cbc8d 100644
--- a/deps/v8/src/utils/bit-vector.cc
+++ b/deps/v8/src/utils/bit-vector.cc
@@ -25,31 +25,14 @@ void BitVector::Print() {
 }
 #endif
 
-void BitVector::Iterator::Advance() {
-  current_++;
-  uintptr_t val = current_value_;
-  while (val == 0) {
-    current_index_++;
-    if (Done()) return;
-    DCHECK(!target_->is_inline());
-    val = target_->data_.ptr_[current_index_];
-    current_ = current_index_ << kDataBitShift;
-  }
-  val = SkipZeroBytes(val);
-  val = SkipZeroBits(val);
-  current_value_ = val >> 1;
-}
-
 int BitVector::Count() const {
-  if (data_length_ == 0) {
-    return base::bits::CountPopulation(data_.inline_);
-  } else {
-    int count = 0;
-    for (int i = 0; i < data_length_; i++) {
-      count += base::bits::CountPopulation(data_.ptr_[i]);
-    }
-    return count;
+  if (is_inline()) return base::bits::CountPopulation(data_.inline_);
+
+  int count = 0;
+  for (int i = 0; i < data_length_; i++) {
+    count += base::bits::CountPopulation(data_.ptr_[i]);
   }
+  return count;
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/utils/bit-vector.h b/deps/v8/src/utils/bit-vector.h
index 5bb5ef85952dda..1cc6a2459a26a2 100644
--- a/deps/v8/src/utils/bit-vector.h
+++ b/deps/v8/src/utils/bit-vector.h
@@ -5,6 +5,7 @@
 #ifndef V8_UTILS_BIT_VECTOR_H_
 #define V8_UTILS_BIT_VECTOR_H_
 
+#include "src/base/bits.h"
 #include "src/utils/allocation.h"
 #include "src/zone/zone.h"
 
@@ -34,7 +35,27 @@ class V8_EXPORT_PRIVATE BitVector : public ZoneObject {
     ~Iterator() = default;
 
     bool Done() const { return current_index_ >= target_->data_length_; }
-    V8_EXPORT_PRIVATE void Advance();
+
+    V8_EXPORT_PRIVATE inline void Advance() {
+      current_++;
+
+      // Skip zeroed words.
+      while (current_value_ == 0) {
+        current_index_++;
+        if (Done()) return;
+        DCHECK(!target_->is_inline());
+        current_value_ = target_->data_.ptr_[current_index_];
+        current_ = current_index_ << kDataBitShift;
+      }
+
+      // Skip zeroed bits.
+      uintptr_t trailing_zeros = base::bits::CountTrailingZeros(current_value_);
+      current_ += trailing_zeros;
+      current_value_ >>= trailing_zeros;
+
+      // Get current_value ready for next advance.
+      current_value_ >>= 1;
+    }
 
     int Current() const {
       DCHECK(!Done());
@@ -42,21 +63,6 @@ class V8_EXPORT_PRIVATE BitVector : public ZoneObject {
     }
 
    private:
-    uintptr_t SkipZeroBytes(uintptr_t val) {
-      while ((val & 0xFF) == 0) {
-        val >>= 8;
-        current_ += 8;
-      }
-      return val;
-    }
-    uintptr_t SkipZeroBits(uintptr_t val) {
-      while ((val & 0x1) == 0) {
-        val >>= 1;
-        current_++;
-      }
-      return val;
-    }
-
     BitVector* target_;
     int current_index_;
     uintptr_t current_value_;
@@ -66,8 +72,8 @@ class V8_EXPORT_PRIVATE BitVector : public ZoneObject {
   };
 
   static const int kDataLengthForInline = 1;
-  static const int kDataBits = kSystemPointerSize * 8;
-  static const int kDataBitShift = kSystemPointerSize == 8 ? 6 : 5;
+  static const int kDataBits = kBitsPerSystemPointer;
+  static const int kDataBitShift = kBitsPerSystemPointerLog2;
   static const uintptr_t kOne = 1;  // This saves some static_casts.
 
   BitVector() : length_(0), data_length_(kDataLengthForInline), data_(0) {}
diff --git a/deps/v8/src/utils/memcopy.h b/deps/v8/src/utils/memcopy.h
index 7e1b8539df061d..b9c6c8eb8079d9 100644
--- a/deps/v8/src/utils/memcopy.h
+++ b/deps/v8/src/utils/memcopy.h
@@ -78,12 +78,68 @@ V8_EXPORT_PRIVATE V8_INLINE void MemMove(void* dest, const void* src,
 }
 #else
 // Copy memory area to disjoint memory area.
-V8_INLINE void MemCopy(void* dest, const void* src, size_t size) {
-  memcpy(dest, src, size);
+inline void MemCopy(void* dest, const void* src, size_t size) {
+  // Fast path for small sizes. The compiler will expand the {memcpy} for small
+  // fixed sizes to a sequence of move instructions. This avoids the overhead of
+  // the general {memcpy} function.
+  switch (size) {
+#define CASE(N)           \
+  case N:                 \
+    memcpy(dest, src, N); \
+    return;
+    CASE(1)
+    CASE(2)
+    CASE(3)
+    CASE(4)
+    CASE(5)
+    CASE(6)
+    CASE(7)
+    CASE(8)
+    CASE(9)
+    CASE(10)
+    CASE(11)
+    CASE(12)
+    CASE(13)
+    CASE(14)
+    CASE(15)
+    CASE(16)
+#undef CASE
+    default:
+      memcpy(dest, src, size);
+      return;
+  }
 }
-V8_EXPORT_PRIVATE V8_INLINE void MemMove(void* dest, const void* src,
-                                         size_t size) {
-  memmove(dest, src, size);
+V8_EXPORT_PRIVATE inline void MemMove(void* dest, const void* src,
+                                      size_t size) {
+  // Fast path for small sizes. The compiler will expand the {memmove} for small
+  // fixed sizes to a sequence of move instructions. This avoids the overhead of
+  // the general {memmove} function.
+  switch (size) {
+#define CASE(N)            \
+  case N:                  \
+    memmove(dest, src, N); \
+    return;
+    CASE(1)
+    CASE(2)
+    CASE(3)
+    CASE(4)
+    CASE(5)
+    CASE(6)
+    CASE(7)
+    CASE(8)
+    CASE(9)
+    CASE(10)
+    CASE(11)
+    CASE(12)
+    CASE(13)
+    CASE(14)
+    CASE(15)
+    CASE(16)
+#undef CASE
+    default:
+      memmove(dest, src, size);
+      return;
+  }
 }
 const size_t kMinComplexMemCopy = 8;
 #endif  // V8_TARGET_ARCH_IA32
@@ -208,6 +264,8 @@ template <typename SrcType, typename DstType>
 void CopyChars(DstType* dst, const SrcType* src, size_t count) {
   STATIC_ASSERT(std::is_integral<SrcType>::value);
   STATIC_ASSERT(std::is_integral<DstType>::value);
+  using SrcTypeUnsigned = typename std::make_unsigned<SrcType>::type;
+  using DstTypeUnsigned = typename std::make_unsigned<DstType>::type;
 
 #ifdef DEBUG
   // Check for no overlap, otherwise {std::copy_n} cannot be used.
@@ -218,10 +276,38 @@ void CopyChars(DstType* dst, const SrcType* src, size_t count) {
   DCHECK(src_end <= dst_start || dst_end <= src_start);
 #endif
 
-  using SrcTypeUnsigned = typename std::make_unsigned<SrcType>::type;
-  using DstTypeUnsigned = typename std::make_unsigned<DstType>::type;
-  std::copy_n(reinterpret_cast<const SrcTypeUnsigned*>(src), count,
-              reinterpret_cast<DstTypeUnsigned*>(dst));
+  auto* dst_u = reinterpret_cast<DstTypeUnsigned*>(dst);
+  auto* src_u = reinterpret_cast<const SrcTypeUnsigned*>(src);
+
+  // Especially Atom CPUs profit from this explicit instantiation for small
+  // counts. This gives up to 20 percent improvement for microbenchmarks such as
+  // joining an array of small integers (2019-10-16).
+  switch (count) {
+#define CASE(N)                   \
+  case N:                         \
+    std::copy_n(src_u, N, dst_u); \
+    return;
+    CASE(1)
+    CASE(2)
+    CASE(3)
+    CASE(4)
+    CASE(5)
+    CASE(6)
+    CASE(7)
+    CASE(8)
+    CASE(9)
+    CASE(10)
+    CASE(11)
+    CASE(12)
+    CASE(13)
+    CASE(14)
+    CASE(15)
+    CASE(16)
+#undef CASE
+    default:
+      std::copy_n(src_u, count, dst_u);
+      return;
+  }
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/utils/utils-inl.h b/deps/v8/src/utils/utils-inl.h
index 0c8af7cb88a36b..b44d3229a13fc1 100644
--- a/deps/v8/src/utils/utils-inl.h
+++ b/deps/v8/src/utils/utils-inl.h
@@ -33,7 +33,7 @@ class TimedScope {
 };
 
 template <typename Char>
-bool TryAddIndexChar(uint32_t* index, Char c) {
+bool TryAddArrayIndexChar(uint32_t* index, Char c) {
   if (!IsDecimalDigit(c)) return false;
   int d = c - '0';
   // The maximum index is 4294967294; for the computation below to not
@@ -46,20 +46,15 @@ bool TryAddIndexChar(uint32_t* index, Char c) {
 }
 
 template <typename Char>
-bool TryAddIndexChar(uint64_t* index, Char c) {
+bool TryAddIntegerIndexChar(uint64_t* index, Char c) {
   if (!IsDecimalDigit(c)) return false;
   int d = c - '0';
-  // The maximum uint64_t is 18446744073709551615; for the computation below to
-  // not exceed that, the previous index value must be <= 1844674407370955161
-  // if d <= 5, or <= 1844674407370955160 if d >= 6. The (d+2)>>3 computation
-  // is a branch-free way to express that.
-  if (*index > 1844674407370955161ull - ((d + 2) >> 3)) return false;
   *index = (*index) * 10 + d;
-  return true;
+  return (*index <= kMaxSafeIntegerUint64);
 }
 
-template <typename Stream, typename index_t>
-bool StringToArrayIndex(Stream* stream, index_t* index) {
+template <typename Stream, typename index_t, enum ToIndexMode mode>
+bool StringToIndex(Stream* stream, index_t* index) {
   uint16_t ch = stream->GetNext();
 
   // If the string begins with a '0' character, it must only consist
@@ -76,14 +71,16 @@ bool StringToArrayIndex(Stream* stream, index_t* index) {
   while (stream->HasMore()) {
     // Clang on Mac doesn't think that size_t and uint*_t should be
     // implicitly convertible.
-    if (sizeof(index_t) == 8) {
-      if (!TryAddIndexChar(reinterpret_cast<uint64_t*>(&result),
-                           stream->GetNext())) {
+    if (sizeof(result) == 8) {
+      DCHECK_EQ(kToIntegerIndex, mode);
+      if (!TryAddIntegerIndexChar(reinterpret_cast<uint64_t*>(&result),
+                                  stream->GetNext())) {
         return false;
       }
     } else {
-      if (!TryAddIndexChar(reinterpret_cast<uint32_t*>(&result),
-                           stream->GetNext()))
+      // Either mode is fine here.
+      if (!TryAddArrayIndexChar(reinterpret_cast<uint32_t*>(&result),
+                                stream->GetNext()))
         return false;
     }
   }
diff --git a/deps/v8/src/utils/utils.cc b/deps/v8/src/utils/utils.cc
index f2283e91e2201a..827fd511c6bbf3 100644
--- a/deps/v8/src/utils/utils.cc
+++ b/deps/v8/src/utils/utils.cc
@@ -133,8 +133,6 @@ void StrNCpy(Vector<char> dest, const char* src, size_t n) {
   base::OS::StrNCpy(dest.begin(), dest.length(), src, n);
 }
 
-void Flush(FILE* out) { fflush(out); }
-
 char* ReadLine(const char* prompt) {
   char* result = nullptr;
   char line_buf[256];
@@ -229,18 +227,6 @@ std::string VectorToString(const std::vector<char>& chars) {
   return std::string(chars.begin(), chars.end());
 }
 
-}  // namespace
-
-std::string ReadFile(const char* filename, bool* exists, bool verbose) {
-  std::vector<char> result = ReadCharsFromFile(filename, exists, verbose);
-  return VectorToString(result);
-}
-
-std::string ReadFile(FILE* file, bool* exists, bool verbose) {
-  std::vector<char> result = ReadCharsFromFile(file, exists, verbose, "");
-  return VectorToString(result);
-}
-
 int WriteCharsToFile(const char* str, int size, FILE* f) {
   int total = 0;
   while (total < size) {
@@ -254,17 +240,16 @@ int WriteCharsToFile(const char* str, int size, FILE* f) {
   return total;
 }
 
-int AppendChars(const char* filename, const char* str, int size, bool verbose) {
-  FILE* f = base::OS::FOpen(filename, "ab");
-  if (f == nullptr) {
-    if (verbose) {
-      base::OS::PrintError("Cannot open file %s for writing.\n", filename);
-    }
-    return 0;
-  }
-  int written = WriteCharsToFile(str, size, f);
-  fclose(f);
-  return written;
+}  // namespace
+
+std::string ReadFile(const char* filename, bool* exists, bool verbose) {
+  std::vector<char> result = ReadCharsFromFile(filename, exists, verbose);
+  return VectorToString(result);
+}
+
+std::string ReadFile(FILE* file, bool* exists, bool verbose) {
+  std::vector<char> result = ReadCharsFromFile(file, exists, verbose, "");
+  return VectorToString(result);
 }
 
 int WriteChars(const char* filename, const char* str, int size, bool verbose) {
diff --git a/deps/v8/src/utils/utils.h b/deps/v8/src/utils/utils.h
index b414a4c52b15ee..2c7bb70bbd366f 100644
--- a/deps/v8/src/utils/utils.h
+++ b/deps/v8/src/utils/utils.h
@@ -12,7 +12,6 @@
 #include <string>
 #include <type_traits>
 
-#include "include/v8.h"
 #include "src/base/bits.h"
 #include "src/base/compiler-specific.h"
 #include "src/base/logging.h"
@@ -53,104 +52,6 @@ inline char HexCharOfValue(int value) {
   return value - 10 + 'A';
 }
 
-inline int BoolToInt(bool b) { return b ? 1 : 0; }
-
-// Checks if value is in range [lower_limit, higher_limit] using a single
-// branch.
-template <typename T, typename U>
-inline constexpr bool IsInRange(T value, U lower_limit, U higher_limit) {
-#if V8_CAN_HAVE_DCHECK_IN_CONSTEXPR
-  DCHECK(lower_limit <= higher_limit);
-#endif
-  STATIC_ASSERT(sizeof(U) <= sizeof(T));
-  using unsigned_T = typename std::make_unsigned<T>::type;
-  // Use static_cast to support enum classes.
-  return static_cast<unsigned_T>(static_cast<unsigned_T>(value) -
-                                 static_cast<unsigned_T>(lower_limit)) <=
-         static_cast<unsigned_T>(static_cast<unsigned_T>(higher_limit) -
-                                 static_cast<unsigned_T>(lower_limit));
-}
-
-// Checks if [index, index+length) is in range [0, max). Note that this check
-// works even if {index+length} would wrap around.
-inline constexpr bool IsInBounds(size_t index, size_t length, size_t max) {
-  return length <= max && index <= (max - length);
-}
-
-// Checks if [index, index+length) is in range [0, max). If not, {length} is
-// clamped to its valid range. Note that this check works even if
-// {index+length} would wrap around.
-template <typename T>
-inline bool ClampToBounds(T index, T* length, T max) {
-  if (index > max) {
-    *length = 0;
-    return false;
-  }
-  T avail = max - index;
-  bool oob = *length > avail;
-  if (oob) *length = avail;
-  return !oob;
-}
-
-// X must be a power of 2.  Returns the number of trailing zeros.
-template <typename T,
-          typename = typename std::enable_if<std::is_integral<T>::value>::type>
-inline int WhichPowerOf2(T x) {
-  DCHECK(base::bits::IsPowerOfTwo(x));
-  int bits = 0;
-#ifdef DEBUG
-  const T original_x = x;
-#endif
-  constexpr int max_bits = sizeof(T) * 8;
-  static_assert(max_bits <= 64, "integral types are not bigger than 64 bits");
-// Avoid shifting by more than the bit width of x to avoid compiler warnings.
-#define CHECK_BIGGER(s)                                      \
-  if (max_bits > s && x >= T{1} << (max_bits > s ? s : 0)) { \
-    bits += s;                                               \
-    x >>= max_bits > s ? s : 0;                              \
-  }
-  CHECK_BIGGER(32)
-  CHECK_BIGGER(16)
-  CHECK_BIGGER(8)
-  CHECK_BIGGER(4)
-#undef CHECK_BIGGER
-  switch (x) {
-    default:
-      UNREACHABLE();
-    case 8:
-      bits++;
-      V8_FALLTHROUGH;
-    case 4:
-      bits++;
-      V8_FALLTHROUGH;
-    case 2:
-      bits++;
-      V8_FALLTHROUGH;
-    case 1:
-      break;
-  }
-  DCHECK_EQ(T{1} << bits, original_x);
-  return bits;
-}
-
-inline int MostSignificantBit(uint32_t x) {
-  static const int msb4[] = {0, 1, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 4, 4, 4, 4};
-  int nibble = 0;
-  if (x & 0xffff0000) {
-    nibble += 16;
-    x >>= 16;
-  }
-  if (x & 0xff00) {
-    nibble += 8;
-    x >>= 8;
-  }
-  if (x & 0xf0) {
-    nibble += 4;
-    x >>= 4;
-  }
-  return nibble + msb4[x];
-}
-
 template <typename T>
 static T ArithmeticShiftRight(T x, int shift) {
   DCHECK_LE(0, shift);
@@ -165,26 +66,6 @@ static T ArithmeticShiftRight(T x, int shift) {
   }
 }
 
-template <typename T>
-int Compare(const T& a, const T& b) {
-  if (a == b)
-    return 0;
-  else if (a < b)
-    return -1;
-  else
-    return 1;
-}
-
-// Compare function to compare the object pointer value of two
-// handlified objects. The handles are passed as pointers to the
-// handles.
-template <typename T>
-class Handle;  // Forward declaration.
-template <typename T>
-int HandleObjectPointerCompare(const Handle<T>* a, const Handle<T>* b) {
-  return Compare<T*>(*(*a), *(*b));
-}
-
 // Returns the maximum of the two parameters.
 template <typename T>
 constexpr T Max(T a, T b) {
@@ -228,13 +109,6 @@ typename std::make_unsigned<T>::type Abs(T a) {
   return (x ^ y) - y;
 }
 
-// Returns the negative absolute value of its argument.
-template <typename T,
-          typename = typename std::enable_if<std::is_signed<T>::value>::type>
-T Nabs(T a) {
-  return a < 0 ? a : -a;
-}
-
 inline double Modulo(double x, double y) {
 #if defined(V8_OS_WIN)
   // Workaround MS fmod bugs. ECMA-262 says:
@@ -302,147 +176,6 @@ T SaturateSub(T a, T b) {
   return a - b;
 }
 
-// ----------------------------------------------------------------------------
-// BitField is a help template for encoding and decode bitfield with
-// unsigned content.
-// Instantiate them via 'using', which is cheaper than deriving a new class:
-// using MyBitField = BitField<int, 4, 2, MyEnum>;
-// The BitField class is final to enforce this style over derivation.
-
-template <class T, int shift, int size, class U = uint32_t>
-class BitField final {
- public:
-  STATIC_ASSERT(std::is_unsigned<U>::value);
-  STATIC_ASSERT(shift < 8 * sizeof(U));  // Otherwise shifts by {shift} are UB.
-  STATIC_ASSERT(size < 8 * sizeof(U));   // Otherwise shifts by {size} are UB.
-  STATIC_ASSERT(shift + size <= 8 * sizeof(U));
-  STATIC_ASSERT(size > 0);
-
-  using FieldType = T;
-
-  // A type U mask of bit field.  To use all bits of a type U of x bits
-  // in a bitfield without compiler warnings we have to compute 2^x
-  // without using a shift count of x in the computation.
-  static constexpr int kShift = shift;
-  static constexpr int kSize = size;
-  static constexpr U kMask = ((U{1} << kShift) << kSize) - (U{1} << kShift);
-  static constexpr int kLastUsedBit = kShift + kSize - 1;
-  static constexpr U kNumValues = U{1} << kSize;
-
-  // Value for the field with all bits set.
-  static constexpr T kMax = static_cast<T>(kNumValues - 1);
-
-  template <class T2, int size2>
-  using Next = BitField<T2, kShift + kSize, size2, U>;
-
-  // Tells whether the provided value fits into the bit field.
-  static constexpr bool is_valid(T value) {
-    return (static_cast<U>(value) & ~static_cast<U>(kMax)) == 0;
-  }
-
-  // Returns a type U with the bit field value encoded.
-  static constexpr U encode(T value) {
-#if V8_CAN_HAVE_DCHECK_IN_CONSTEXPR
-    DCHECK(is_valid(value));
-#endif
-    return static_cast<U>(value) << kShift;
-  }
-
-  // Returns a type U with the bit field value updated.
-  static constexpr U update(U previous, T value) {
-    return (previous & ~kMask) | encode(value);
-  }
-
-  // Extracts the bit field from the value.
-  static constexpr T decode(U value) {
-    return static_cast<T>((value & kMask) >> kShift);
-  }
-};
-
-template <class T, int shift, int size>
-using BitField8 = BitField<T, shift, size, uint8_t>;
-
-template <class T, int shift, int size>
-using BitField16 = BitField<T, shift, size, uint16_t>;
-
-template <class T, int shift, int size>
-using BitField64 = BitField<T, shift, size, uint64_t>;
-
-// Helper macros for defining a contiguous sequence of bit fields. Example:
-// (backslashes at the ends of respective lines of this multi-line macro
-// definition are omitted here to please the compiler)
-//
-// #define MAP_BIT_FIELD1(V, _)
-//   V(IsAbcBit, bool, 1, _)
-//   V(IsBcdBit, bool, 1, _)
-//   V(CdeBits, int, 5, _)
-//   V(DefBits, MutableMode, 1, _)
-//
-// DEFINE_BIT_FIELDS(MAP_BIT_FIELD1)
-// or
-// DEFINE_BIT_FIELDS_64(MAP_BIT_FIELD1)
-//
-#define DEFINE_BIT_FIELD_RANGE_TYPE(Name, Type, Size, _) \
-  k##Name##Start, k##Name##End = k##Name##Start + Size - 1,
-
-#define DEFINE_BIT_RANGES(LIST_MACRO)                               \
-  struct LIST_MACRO##_Ranges {                                      \
-    enum { LIST_MACRO(DEFINE_BIT_FIELD_RANGE_TYPE, _) kBitsCount }; \
-  };
-
-#define DEFINE_BIT_FIELD_TYPE(Name, Type, Size, RangesName) \
-  using Name = BitField<Type, RangesName::k##Name##Start, Size>;
-
-#define DEFINE_BIT_FIELD_64_TYPE(Name, Type, Size, RangesName) \
-  using Name = BitField64<Type, RangesName::k##Name##Start, Size>;
-
-#define DEFINE_BIT_FIELDS(LIST_MACRO) \
-  DEFINE_BIT_RANGES(LIST_MACRO)       \
-  LIST_MACRO(DEFINE_BIT_FIELD_TYPE, LIST_MACRO##_Ranges)
-
-#define DEFINE_BIT_FIELDS_64(LIST_MACRO) \
-  DEFINE_BIT_RANGES(LIST_MACRO)          \
-  LIST_MACRO(DEFINE_BIT_FIELD_64_TYPE, LIST_MACRO##_Ranges)
-
-// ----------------------------------------------------------------------------
-// BitSetComputer is a help template for encoding and decoding information for
-// a variable number of items in an array.
-//
-// To encode boolean data in a smi array you would use:
-//  using BoolComputer = BitSetComputer<bool, 1, kSmiValueSize, uint32_t>;
-//
-template <class T, int kBitsPerItem, int kBitsPerWord, class U>
-class BitSetComputer {
- public:
-  static const int kItemsPerWord = kBitsPerWord / kBitsPerItem;
-  static const int kMask = (1 << kBitsPerItem) - 1;
-
-  // The number of array elements required to embed T information for each item.
-  static int word_count(int items) {
-    if (items == 0) return 0;
-    return (items - 1) / kItemsPerWord + 1;
-  }
-
-  // The array index to look at for item.
-  static int index(int base_index, int item) {
-    return base_index + item / kItemsPerWord;
-  }
-
-  // Extract T data for a given item from data.
-  static T decode(U data, int item) {
-    return static_cast<T>((data >> shift(item)) & kMask);
-  }
-
-  // Return the encoding for a store of value for item in previous.
-  static U encode(U previous, int item, T value) {
-    int shift_value = shift(item);
-    int set_bits = (static_cast<int>(value) << shift_value);
-    return (previous & ~(kMask << shift_value)) | set_bits;
-  }
-
-  static int shift(int item) { return (item % kItemsPerWord) * kBitsPerItem; }
-};
-
 // Helper macros for defining a contiguous sequence of field offset constants.
 // Example: (backslashes at the ends of respective lines of this multi-line
 // macro definition are omitted here to please the compiler)
@@ -528,45 +261,6 @@ static const int kInt64LowerHalfMemoryOffset = 4;
 static const int kInt64UpperHalfMemoryOffset = 0;
 #endif  // V8_TARGET_LITTLE_ENDIAN
 
-// A static resource holds a static instance that can be reserved in
-// a local scope using an instance of Access.  Attempts to re-reserve
-// the instance will cause an error.
-template <typename T>
-class StaticResource {
- public:
-  StaticResource() : is_reserved_(false) {}
-
- private:
-  template <typename S>
-  friend class Access;
-  T instance_;
-  bool is_reserved_;
-};
-
-// Locally scoped access to a static resource.
-template <typename T>
-class Access {
- public:
-  explicit Access(StaticResource<T>* resource)
-      : resource_(resource), instance_(&resource->instance_) {
-    DCHECK(!resource->is_reserved_);
-    resource->is_reserved_ = true;
-  }
-
-  ~Access() {
-    resource_->is_reserved_ = false;
-    resource_ = nullptr;
-    instance_ = nullptr;
-  }
-
-  T* value() { return instance_; }
-  T* operator->() { return instance_; }
-
- private:
-  StaticResource<T>* resource_;
-  T* instance_;
-};
-
 // A pointer that can only be set once and doesn't allow NULL values.
 template <typename T>
 class SetOncePointer {
@@ -650,41 +344,6 @@ inline int TenToThe(int exponent) {
   return answer;
 }
 
-template <typename ElementType, int NumElements>
-class EmbeddedContainer {
- public:
-  EmbeddedContainer() : elems_() {}
-
-  int length() const { return NumElements; }
-  const ElementType& operator[](int i) const {
-    DCHECK(i < length());
-    return elems_[i];
-  }
-  ElementType& operator[](int i) {
-    DCHECK(i < length());
-    return elems_[i];
-  }
-
- private:
-  ElementType elems_[NumElements];
-};
-
-template <typename ElementType>
-class EmbeddedContainer<ElementType, 0> {
- public:
-  int length() const { return 0; }
-  const ElementType& operator[](int i) const {
-    UNREACHABLE();
-    static ElementType t = 0;
-    return t;
-  }
-  ElementType& operator[](int i) {
-    UNREACHABLE();
-    static ElementType t = 0;
-    return t;
-  }
-};
-
 // Helper class for building result strings in a character buffer. The
 // purpose of the class is to use safe operations that checks the
 // buffer bounds on all operations in debug mode.
@@ -915,20 +574,10 @@ V8_EXPORT_PRIVATE int PRINTF_FORMAT(2, 0)
 
 void StrNCpy(Vector<char> dest, const char* src, size_t n);
 
-// Our version of fflush.
-void Flush(FILE* out);
-
-inline void Flush() { Flush(stdout); }
-
 // Read a line of characters after printing the prompt to stdout. The resulting
 // char* needs to be disposed off with DeleteArray by the caller.
 char* ReadLine(const char* prompt);
 
-// Append size chars from str to the file given by filename.
-// The file is overwritten. Returns the number of chars written.
-int AppendChars(const char* filename, const char* str, int size,
-                bool verbose = true);
-
 // Write size chars from str to the file given by filename.
 // The file is overwritten. Returns the number of chars written.
 int WriteChars(const char* filename, const char* str, int size,
@@ -939,13 +588,6 @@ int WriteChars(const char* filename, const char* str, int size,
 int WriteBytes(const char* filename, const byte* bytes, int size,
                bool verbose = true);
 
-// Write the C code
-// const char* <varname> = "<str>";
-// const int <varname>_len = <len>;
-// to the file given by filename. Only the first len chars are written.
-int WriteAsCFile(const char* filename, const char* varname, const char* str,
-                 int size, bool verbose = true);
-
 // Simple support to read a file into std::string.
 // On return, *exits tells whether the file existed.
 V8_EXPORT_PRIVATE std::string ReadFile(const char* filename, bool* exists,
@@ -973,8 +615,12 @@ bool DoubleToBoolean(double d);
 template <typename Char>
 bool TryAddIndexChar(uint32_t* index, Char c);
 
-template <typename Stream, typename index_t>
-bool StringToArrayIndex(Stream* stream, index_t* index);
+enum ToIndexMode { kToArrayIndex, kToIntegerIndex };
+
+// {index_t} is meant to be {uint32_t} or {size_t}.
+template <typename Stream, typename index_t,
+          enum ToIndexMode mode = kToArrayIndex>
+bool StringToIndex(Stream* stream, index_t* index);
 
 // Returns the current stack top. Works correctly with ASAN and SafeStack.
 // GetCurrentStackPosition() should not be inlined, because it works on stack
diff --git a/deps/v8/src/utils/vector.h b/deps/v8/src/utils/vector.h
index e0c13afc901c52..5c106cc0c81126 100644
--- a/deps/v8/src/utils/vector.h
+++ b/deps/v8/src/utils/vector.h
@@ -23,7 +23,7 @@ class Vector {
   constexpr Vector() : start_(nullptr), length_(0) {}
 
   constexpr Vector(T* data, size_t length) : start_(data), length_(length) {
-#ifdef V8_CAN_HAVE_DCHECK_IN_CONSTEXPR
+#if V8_HAS_CXX14_CONSTEXPR
     DCHECK(length == 0 || data != nullptr);
 #endif
   }
@@ -118,14 +118,11 @@ class Vector {
   }
 
   bool operator==(const Vector<const T> other) const {
-    if (length_ != other.length_) return false;
-    if (start_ == other.start_) return true;
-    for (size_t i = 0; i < length_; ++i) {
-      if (start_[i] != other.start_[i]) {
-        return false;
-      }
-    }
-    return true;
+    return std::equal(begin(), end(), other.begin(), other.end());
+  }
+
+  bool operator!=(const Vector<const T> other) const {
+    return !operator==(other);
   }
 
  private:
@@ -198,7 +195,7 @@ class OwnedVector {
   // Allocates a new vector of the specified size via the default allocator.
   static OwnedVector<T> New(size_t size) {
     if (size == 0) return {};
-    return OwnedVector<T>(std::unique_ptr<T[]>(new T[size]), size);
+    return OwnedVector<T>(std::make_unique<T[]>(size), size);
   }
 
   // Allocates a new vector containing the specified collection of values.
@@ -210,7 +207,8 @@ class OwnedVector {
   static OwnedVector<T> Of(const U& collection) {
     Iterator begin = std::begin(collection);
     Iterator end = std::end(collection);
-    OwnedVector<T> vec = New(std::distance(begin, end));
+    using non_const_t = typename std::remove_const<T>::type;
+    auto vec = OwnedVector<non_const_t>::New(std::distance(begin, end));
     std::copy(begin, end, vec.start());
     return vec;
   }
@@ -245,14 +243,6 @@ inline Vector<const uint8_t> OneByteVector(const char* data) {
   return OneByteVector(data, strlen(data));
 }
 
-inline Vector<char> MutableCStrVector(char* data) {
-  return Vector<char>(data, strlen(data));
-}
-
-inline Vector<char> MutableCStrVector(char* data, size_t max) {
-  return Vector<char>(data, strnlen(data, max));
-}
-
 // For string literals, ArrayVector("foo") returns a vector ['f', 'o', 'o', \0]
 // with length 4 and null-termination.
 // If you want ['f', 'o', 'o'], use CStrVector("foo").
diff --git a/deps/v8/src/wasm/OWNERS b/deps/v8/src/wasm/OWNERS
index bc9ec357df47d6..801795058d91d2 100644
--- a/deps/v8/src/wasm/OWNERS
+++ b/deps/v8/src/wasm/OWNERS
@@ -3,8 +3,9 @@ bbudge@chromium.org
 binji@chromium.org
 clemensb@chromium.org
 gdeepti@chromium.org
-mstarzinger@chromium.org
-titzer@chromium.org
+jkummerow@chromium.org
+thibaudm@chromium.org
+zhin@chromium.org
 
 per-file wasm-js.*=adamk@chromium.org
 
diff --git a/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h b/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h
index e6c46e4a09dba1..9b7f8696a17b40 100644
--- a/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h
+++ b/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h
@@ -37,34 +37,21 @@ namespace liftoff {
 //
 static_assert(2 * kSystemPointerSize == LiftoffAssembler::kStackSlotSize,
               "Slot size should be twice the size of the 32 bit pointer.");
-constexpr int32_t kInstanceOffset = 2 * kSystemPointerSize;
-constexpr int32_t kFirstStackSlotOffset =
-    kInstanceOffset + 2 * kSystemPointerSize;
-constexpr int32_t kConstantStackSpace = kSystemPointerSize;
+constexpr int kInstanceOffset = 2 * kSystemPointerSize;
 // kPatchInstructionsRequired sets a maximum limit of how many instructions that
 // PatchPrepareStackFrame will use in order to increase the stack appropriately.
 // Three instructions are required to sub a large constant, movw + movt + sub.
 constexpr int32_t kPatchInstructionsRequired = 3;
 
-inline int GetStackSlotOffset(uint32_t index) {
-  return kFirstStackSlotOffset + index * LiftoffAssembler::kStackSlotSize;
-}
-
-inline MemOperand GetStackSlot(uint32_t index) {
-  return MemOperand(fp, -GetStackSlotOffset(index));
-}
+inline MemOperand GetStackSlot(int offset) { return MemOperand(fp, -offset); }
 
-inline MemOperand GetHalfStackSlot(uint32_t index, RegPairHalf half) {
+inline MemOperand GetHalfStackSlot(int offset, RegPairHalf half) {
   int32_t half_offset =
       half == kLowWord ? 0 : LiftoffAssembler::kStackSlotSize / 2;
-  int32_t offset = kFirstStackSlotOffset +
-                   index * LiftoffAssembler::kStackSlotSize - half_offset;
-  return MemOperand(fp, -offset);
+  return MemOperand(fp, -offset + half_offset);
 }
 
-inline MemOperand GetInstanceOperand() {
-  return MemOperand(fp, -kInstanceOffset);
-}
+inline MemOperand GetInstanceOperand() { return GetStackSlot(kInstanceOffset); }
 
 inline MemOperand GetMemOp(LiftoffAssembler* assm,
                            UseScratchRegisterScope* temps, Register addr,
@@ -165,8 +152,7 @@ template <void (TurboAssembler::*op)(Register, Register, Register, Register,
                                      Register),
           bool is_left_shift>
 inline void I64Shiftop(LiftoffAssembler* assm, LiftoffRegister dst,
-                       LiftoffRegister src, Register amount,
-                       LiftoffRegList pinned) {
+                       LiftoffRegister src, Register amount) {
   Register src_low = src.low_gp();
   Register src_high = src.high_gp();
   Register dst_low = dst.low_gp();
@@ -174,8 +160,7 @@ inline void I64Shiftop(LiftoffAssembler* assm, LiftoffRegister dst,
   // Left shift writes {dst_high} then {dst_low}, right shifts write {dst_low}
   // then {dst_high}.
   Register clobbered_dst_reg = is_left_shift ? dst_high : dst_low;
-  pinned.set(clobbered_dst_reg);
-  pinned.set(src);
+  LiftoffRegList pinned = LiftoffRegList::ForRegs(clobbered_dst_reg, src);
   Register amount_capped =
       pinned.set(assm->GetUnusedRegister(kGpReg, pinned)).gp();
   assm->and_(amount_capped, amount, Operand(0x3F));
@@ -196,6 +181,10 @@ inline FloatRegister GetFloatRegister(DoubleRegister reg) {
   return LowDwVfpRegister::from_code(reg.code()).low();
 }
 
+inline Simd128Register GetSimd128Register(DoubleRegister reg) {
+  return QwNeonRegister::from_code(reg.code() / 2);
+}
+
 enum class MinOrMax : uint8_t { kMin, kMax };
 template <typename RegisterType>
 inline void EmitFloatMinOrMax(LiftoffAssembler* assm, RegisterType dst,
@@ -219,6 +208,16 @@ inline void EmitFloatMinOrMax(LiftoffAssembler* assm, RegisterType dst,
   assm->bind(&done);
 }
 
+inline Register EnsureNoAlias(Assembler* assm, Register reg,
+                              Register must_not_alias,
+                              UseScratchRegisterScope* temps) {
+  if (reg != must_not_alias) return reg;
+  Register tmp = temps->Acquire();
+  DCHECK_NE(reg, tmp);
+  assm->mov(tmp, reg);
+  return tmp;
+}
+
 }  // namespace liftoff
 
 int LiftoffAssembler::PrepareStackFrame() {
@@ -238,15 +237,12 @@ int LiftoffAssembler::PrepareStackFrame() {
   return offset;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(int offset,
-                                              uint32_t stack_slots) {
-  // Allocate space for instance plus what is needed for the frame slots.
-  uint32_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
+void LiftoffAssembler::PatchPrepareStackFrame(int offset, int frame_size) {
 #ifdef USE_SIMULATOR
   // When using the simulator, deal with Liftoff which allocates the stack
   // before checking it.
   // TODO(arm): Remove this when the stack check mechanism will be updated.
-  if (bytes > KB / 2) {
+  if (frame_size > KB / 2) {
     bailout(kOtherReason,
             "Stack limited to 512 bytes to avoid a bug in StackCheck");
     return;
@@ -256,7 +252,7 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
                                        buffer_start_ + offset,
                                        liftoff::kPatchInstructionsRequired);
 #if V8_OS_WIN
-  if (bytes > kStackPageSize) {
+  if (frame_size > kStackPageSize) {
     // Generate OOL code (at the end of the function, where the current
     // assembler is pointing) to do the explicit stack limit check (see
     // https://docs.microsoft.com/en-us/previous-versions/visualstudio/
@@ -277,7 +273,7 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
     return;
   }
 #endif
-  patching_assembler.sub(sp, sp, Operand(bytes));
+  patching_assembler.sub(sp, sp, Operand(frame_size));
   patching_assembler.PadWithNops();
 }
 
@@ -285,6 +281,30 @@ void LiftoffAssembler::FinishCode() { CheckConstPool(true, false); }
 
 void LiftoffAssembler::AbortCompilation() { AbortedCodeGeneration(); }
 
+// static
+constexpr int LiftoffAssembler::StaticStackFrameSize() {
+  return liftoff::kInstanceOffset;
+}
+
+int LiftoffAssembler::SlotSizeForType(ValueType type) {
+  switch (type) {
+    case kWasmS128:
+      return ValueTypes::ElementSizeInBytes(type);
+    default:
+      return kStackSlotSize;
+  }
+}
+
+bool LiftoffAssembler::NeedsAlignment(ValueType type) {
+  switch (type) {
+    case kWasmS128:
+      return true;
+    default:
+      // No alignment because all other types are kStackSlotSize.
+      return false;
+  }
+}
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   switch (value.type()) {
@@ -346,7 +366,7 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
                             uint32_t* protected_load_pc, bool is_load_mem) {
-  DCHECK_IMPLIES(type.value_type() == kWasmI64, dst.is_pair());
+  DCHECK_IMPLIES(type.value_type() == kWasmI64, dst.is_gp_pair());
   // If offset_imm cannot be converted to int32 safely, we abort as a separate
   // check should cause this code to never be executed.
   // TODO(7881): Support when >2GB is required.
@@ -356,20 +376,26 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
   }
   UseScratchRegisterScope temps(this);
   if (type.value() == LoadType::kF64Load ||
-      type.value() == LoadType::kF32Load) {
+      type.value() == LoadType::kF32Load ||
+      type.value() == LoadType::kS128Load) {
     Register actual_src_addr = liftoff::CalculateActualAddress(
         this, &temps, src_addr, offset_reg, offset_imm);
     if (type.value() == LoadType::kF64Load) {
       // Armv6 is not supported so Neon can be used to avoid alignment issues.
       CpuFeatureScope scope(this, NEON);
       vld1(Neon64, NeonListOperand(dst.fp()), NeonMemOperand(actual_src_addr));
-    } else {
+    } else if (type.value() == LoadType::kF32Load) {
       // TODO(arm): Use vld1 for f32 when implemented in simulator as used for
       // f64. It supports unaligned access.
       Register scratch =
           (actual_src_addr == src_addr) ? temps.Acquire() : actual_src_addr;
       ldr(scratch, MemOperand(actual_src_addr));
       vmov(liftoff::GetFloatRegister(dst.fp()), scratch);
+    } else {
+      // Armv6 is not supported so Neon can be used to avoid alignment issues.
+      CpuFeatureScope scope(this, NEON);
+      vld1(Neon8, NeonListOperand(dst.low_fp(), 2),
+           NeonMemOperand(actual_src_addr));
     }
   } else {
     MemOperand src_op =
@@ -452,6 +478,13 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
     // Armv6 is not supported so Neon can be used to avoid alignment issues.
     CpuFeatureScope scope(this, NEON);
     vst1(Neon64, NeonListOperand(src.fp()), NeonMemOperand(actual_dst_addr));
+  } else if (type.value() == StoreType::kS128Store) {
+    Register actual_dst_addr = liftoff::CalculateActualAddress(
+        this, &temps, dst_addr, offset_reg, offset_imm);
+    // Armv6 is not supported so Neon can be used to avoid alignment issues.
+    CpuFeatureScope scope(this, NEON);
+    vst1(Neon8, NeonListOperand(src.low_fp(), 2),
+         NeonMemOperand(actual_dst_addr));
   } else if (type.value() == StoreType::kF32Store) {
     // TODO(arm): Use vst1 for f32 when implemented in simulator as used for
     // f64. It supports unaligned access.
@@ -507,6 +540,48 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
   }
 }
 
+void LiftoffAssembler::AtomicLoad(LiftoffRegister dst, Register src_addr,
+                                  Register offset_reg, uint32_t offset_imm,
+                                  LoadType type, LiftoffRegList pinned) {
+  bailout(kAtomics, "AtomicLoad");
+}
+
+void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
+                                   uint32_t offset_imm, LiftoffRegister src,
+                                   StoreType type, LiftoffRegList pinned) {
+  bailout(kAtomics, "AtomicStore");
+}
+
+void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAdd");
+}
+
+void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicSub");
+}
+
+void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAnd");
+}
+
+void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
+                                uint32_t offset_imm, LiftoffRegister value,
+                                StoreType type) {
+  bailout(kAtomics, "AtomicOr");
+}
+
+void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicXor");
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
@@ -531,12 +606,12 @@ void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
   }
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
-  DCHECK_NE(dst_index, src_index);
+  DCHECK_NE(dst_offset, src_offset);
   LiftoffRegister reg = GetUnusedRegister(reg_class_for(type));
-  Fill(reg, src_index, type);
-  Spill(dst_index, reg, type);
+  Fill(reg, src_offset, type);
+  Spill(dst_offset, reg, type);
 }
 
 void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
@@ -550,23 +625,24 @@ void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
   DCHECK_NE(dst, src);
   if (type == kWasmF32) {
     vmov(liftoff::GetFloatRegister(dst), liftoff::GetFloatRegister(src));
-  } else {
-    DCHECK_EQ(kWasmF64, type);
+  } else if (type == kWasmF64) {
     vmov(dst, src);
+  } else {
+    DCHECK_EQ(kWasmS128, type);
+    vmov(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(src));
   }
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
-                             ValueType type) {
-  RecordUsedSpillSlot(index);
-  MemOperand dst = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Spill(int offset, LiftoffRegister reg, ValueType type) {
+  RecordUsedSpillOffset(offset);
+  MemOperand dst = liftoff::GetStackSlot(offset);
   switch (type) {
     case kWasmI32:
       str(reg.gp(), dst);
       break;
     case kWasmI64:
-      str(reg.low_gp(), liftoff::GetHalfStackSlot(index, kLowWord));
-      str(reg.high_gp(), liftoff::GetHalfStackSlot(index, kHighWord));
+      str(reg.low_gp(), liftoff::GetHalfStackSlot(offset, kLowWord));
+      str(reg.high_gp(), liftoff::GetHalfStackSlot(offset, kHighWord));
       break;
     case kWasmF32:
       vstr(liftoff::GetFloatRegister(reg.fp()), dst);
@@ -574,14 +650,21 @@ void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
     case kWasmF64:
       vstr(reg.fp(), dst);
       break;
+    case kWasmS128: {
+      UseScratchRegisterScope temps(this);
+      Register addr = liftoff::CalculateActualAddress(this, &temps, dst.rn(),
+                                                      no_reg, dst.offset());
+      vst1(Neon8, NeonListOperand(reg.low_fp(), 2), NeonMemOperand(addr));
+      break;
+    }
     default:
       UNREACHABLE();
   }
 }
 
-void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
-  RecordUsedSpillSlot(index);
-  MemOperand dst = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Spill(int offset, WasmValue value) {
+  RecordUsedSpillOffset(offset);
+  MemOperand dst = liftoff::GetStackSlot(offset);
   UseScratchRegisterScope temps(this);
   Register src = no_reg;
   // The scratch register will be required by str if multiple instructions
@@ -599,10 +682,10 @@ void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
     case kWasmI64: {
       int32_t low_word = value.to_i64();
       mov(src, Operand(low_word));
-      str(src, liftoff::GetHalfStackSlot(index, kLowWord));
+      str(src, liftoff::GetHalfStackSlot(offset, kLowWord));
       int32_t high_word = value.to_i64() >> 32;
       mov(src, Operand(high_word));
-      str(src, liftoff::GetHalfStackSlot(index, kHighWord));
+      str(src, liftoff::GetHalfStackSlot(offset, kHighWord));
       break;
     }
     default:
@@ -611,56 +694,62 @@ void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
   }
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
-                            ValueType type) {
+void LiftoffAssembler::Fill(LiftoffRegister reg, int offset, ValueType type) {
   switch (type) {
     case kWasmI32:
-      ldr(reg.gp(), liftoff::GetStackSlot(index));
+      ldr(reg.gp(), liftoff::GetStackSlot(offset));
       break;
     case kWasmI64:
-      ldr(reg.low_gp(), liftoff::GetHalfStackSlot(index, kLowWord));
-      ldr(reg.high_gp(), liftoff::GetHalfStackSlot(index, kHighWord));
+      ldr(reg.low_gp(), liftoff::GetHalfStackSlot(offset, kLowWord));
+      ldr(reg.high_gp(), liftoff::GetHalfStackSlot(offset, kHighWord));
       break;
     case kWasmF32:
-      vldr(liftoff::GetFloatRegister(reg.fp()), liftoff::GetStackSlot(index));
+      vldr(liftoff::GetFloatRegister(reg.fp()), liftoff::GetStackSlot(offset));
       break;
     case kWasmF64:
-      vldr(reg.fp(), liftoff::GetStackSlot(index));
+      vldr(reg.fp(), liftoff::GetStackSlot(offset));
+      break;
+    case kWasmS128: {
+      // Get memory address of slot to fill from.
+      MemOperand slot = liftoff::GetStackSlot(offset);
+      UseScratchRegisterScope temps(this);
+      Register addr = liftoff::CalculateActualAddress(this, &temps, slot.rn(),
+                                                      no_reg, slot.offset());
+      vld1(Neon8, NeonListOperand(reg.low_fp(), 2), NeonMemOperand(addr));
       break;
+    }
     default:
       UNREACHABLE();
   }
 }
 
-void LiftoffAssembler::FillI64Half(Register reg, uint32_t index,
-                                   RegPairHalf half) {
-  ldr(reg, liftoff::GetHalfStackSlot(index, half));
+void LiftoffAssembler::FillI64Half(Register reg, int offset, RegPairHalf half) {
+  ldr(reg, liftoff::GetHalfStackSlot(offset, half));
 }
 
-void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
-  DCHECK_LT(0, count);
-  uint32_t last_stack_slot = index + count - 1;
-  RecordUsedSpillSlot(last_stack_slot);
+void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
+  DCHECK_LT(0, size);
+  DCHECK_EQ(0, size % 4);
+  RecordUsedSpillOffset(start + size);
 
   // We need a zero reg. Always use r0 for that, and push it before to restore
   // its value afterwards.
   push(r0);
   mov(r0, Operand(0));
 
-  if (count <= 5) {
-    // Special straight-line code for up to five slots. Generates two
-    // instructions per slot.
-    for (uint32_t offset = 0; offset < count; ++offset) {
-      str(r0, liftoff::GetHalfStackSlot(index + offset, kLowWord));
-      str(r0, liftoff::GetHalfStackSlot(index + offset, kHighWord));
+  if (size <= 36) {
+    // Special straight-line code for up to 9 words. Generates one
+    // instruction per word.
+    for (int offset = 4; offset <= size; offset += 4) {
+      str(r0, liftoff::GetHalfStackSlot(start + offset, kLowWord));
     }
   } else {
     // General case for bigger counts (9 instructions).
     // Use r1 for start address (inclusive), r2 for end address (exclusive).
     push(r1);
     push(r2);
-    sub(r1, fp, Operand(liftoff::GetStackSlotOffset(last_stack_slot)));
-    sub(r2, fp, Operand(liftoff::GetStackSlotOffset(index) - kStackSlotSize));
+    sub(r1, fp, Operand(start + size));
+    sub(r2, fp, Operand(start));
 
     Label loop;
     bind(&loop);
@@ -686,13 +775,21 @@ void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
                                      int32_t imm) {              \
     instruction(dst, lhs, Operand(imm));                         \
   }
-#define I32_SHIFTOP(name, instruction)                                         \
-  void LiftoffAssembler::emit_##name(Register dst, Register src,               \
-                                     Register amount, LiftoffRegList pinned) { \
-    UseScratchRegisterScope temps(this);                                       \
-    Register scratch = temps.Acquire();                                        \
-    and_(scratch, amount, Operand(0x1f));                                      \
-    instruction(dst, src, Operand(scratch));                                   \
+#define I32_SHIFTOP(name, instruction)                           \
+  void LiftoffAssembler::emit_##name(Register dst, Register src, \
+                                     Register amount) {          \
+    UseScratchRegisterScope temps(this);                         \
+    Register scratch = temps.Acquire();                          \
+    and_(scratch, amount, Operand(0x1f));                        \
+    instruction(dst, src, Operand(scratch));                     \
+  }                                                              \
+  void LiftoffAssembler::emit_##name(Register dst, Register src, \
+                                     int32_t amount) {           \
+    if (V8_LIKELY((amount & 31) != 0)) {                         \
+      instruction(dst, src, Operand(amount & 31));               \
+    } else if (dst != src) {                                     \
+      mov(dst, src);                                             \
+    }                                                            \
   }
 #define FP32_UNOP(name, instruction)                                           \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
@@ -747,41 +844,45 @@ FP64_UNOP(f64_sqrt, vsqrt)
 #undef FP64_UNOP
 #undef FP64_BINOP
 
-bool LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
+void LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
   clz(dst, src);
-  return true;
 }
 
-bool LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
+void LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
   rbit(dst, src);
   clz(dst, dst);
-  return true;
 }
 
-bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
-  {
-    UseScratchRegisterScope temps(this);
-    LiftoffRegList pinned = LiftoffRegList::ForRegs(dst);
-    Register scratch = pinned.set(GetUnusedRegister(kGpReg, pinned)).gp();
-    Register scratch_2 = GetUnusedRegister(kGpReg, pinned).gp();
-    // x = x - ((x & (0x55555555 << 1)) >> 1)
-    and_(scratch, src, Operand(0xaaaaaaaa));
-    sub(dst, src, Operand(scratch, LSR, 1));
-    // x = (x & 0x33333333) + ((x & (0x33333333 << 2)) >> 2)
-    mov(scratch, Operand(0x33333333));
-    and_(scratch_2, dst, Operand(scratch, LSL, 2));
-    and_(scratch, dst, scratch);
-    add(dst, scratch, Operand(scratch_2, LSR, 2));
-  }
+namespace liftoff {
+inline void GeneratePopCnt(Assembler* assm, Register dst, Register src,
+                           Register scratch1, Register scratch2) {
+  DCHECK(!AreAliased(dst, scratch1, scratch2));
+  if (src == scratch1) std::swap(scratch1, scratch2);
+  // x = x - ((x & (0x55555555 << 1)) >> 1)
+  assm->and_(scratch1, src, Operand(0xaaaaaaaa));
+  assm->sub(dst, src, Operand(scratch1, LSR, 1));
+  // x = (x & 0x33333333) + ((x & (0x33333333 << 2)) >> 2)
+  assm->mov(scratch1, Operand(0x33333333));
+  assm->and_(scratch2, dst, Operand(scratch1, LSL, 2));
+  assm->and_(scratch1, dst, scratch1);
+  assm->add(dst, scratch1, Operand(scratch2, LSR, 2));
   // x = (x + (x >> 4)) & 0x0F0F0F0F
-  add(dst, dst, Operand(dst, LSR, 4));
-  and_(dst, dst, Operand(0x0f0f0f0f));
+  assm->add(dst, dst, Operand(dst, LSR, 4));
+  assm->and_(dst, dst, Operand(0x0f0f0f0f));
   // x = x + (x >> 8)
-  add(dst, dst, Operand(dst, LSR, 8));
+  assm->add(dst, dst, Operand(dst, LSR, 8));
   // x = x + (x >> 16)
-  add(dst, dst, Operand(dst, LSR, 16));
+  assm->add(dst, dst, Operand(dst, LSR, 16));
   // x = x & 0x3F
-  and_(dst, dst, Operand(0x3f));
+  assm->and_(dst, dst, Operand(0x3f));
+}
+}  // namespace liftoff
+
+bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
+  LiftoffRegList pinned = LiftoffRegList::ForRegs(dst);
+  Register scratch1 = pinned.set(GetUnusedRegister(kGpReg, pinned)).gp();
+  Register scratch2 = GetUnusedRegister(kGpReg, pinned).gp();
+  liftoff::GeneratePopCnt(this, dst, src, scratch1, scratch2);
   return true;
 }
 
@@ -869,11 +970,6 @@ void LiftoffAssembler::emit_i32_remu(Register dst, Register lhs, Register rhs,
   mls(dst, scratch, rhs, lhs);
 }
 
-void LiftoffAssembler::emit_i32_shr(Register dst, Register src, int amount) {
-  DCHECK(is_uint5(amount));
-  lsr(dst, src, Operand(amount));
-}
-
 void LiftoffAssembler::emit_i64_add(LiftoffRegister dst, LiftoffRegister lhs,
                                     LiftoffRegister rhs) {
   liftoff::I64Binop<&Assembler::add, &Assembler::adc>(this, dst, lhs, rhs);
@@ -935,35 +1031,104 @@ bool LiftoffAssembler::emit_i64_remu(LiftoffRegister dst, LiftoffRegister lhs,
 }
 
 void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
-                                    Register amount, LiftoffRegList pinned) {
-  liftoff::I64Shiftop<&TurboAssembler::LslPair, true>(this, dst, src, amount,
-                                                      pinned);
+                                    Register amount) {
+  liftoff::I64Shiftop<&TurboAssembler::LslPair, true>(this, dst, src, amount);
+}
+
+void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
+                                    int32_t amount) {
+  UseScratchRegisterScope temps(this);
+  // {src.low_gp()} will still be needed after writing {dst.high_gp()}.
+  Register src_low =
+      liftoff::EnsureNoAlias(this, src.low_gp(), dst.high_gp(), &temps);
+
+  LslPair(dst.low_gp(), dst.high_gp(), src_low, src.high_gp(), amount & 63);
+}
+
+void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
+                                    Register amount) {
+  liftoff::I64Shiftop<&TurboAssembler::AsrPair, false>(this, dst, src, amount);
 }
 
 void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
-                                    Register amount, LiftoffRegList pinned) {
-  liftoff::I64Shiftop<&TurboAssembler::AsrPair, false>(this, dst, src, amount,
-                                                       pinned);
+                                    int32_t amount) {
+  UseScratchRegisterScope temps(this);
+  // {src.high_gp()} will still be needed after writing {dst.low_gp()}.
+  Register src_high =
+      liftoff::EnsureNoAlias(this, src.high_gp(), dst.low_gp(), &temps);
+
+  AsrPair(dst.low_gp(), dst.high_gp(), src.low_gp(), src_high, amount & 63);
 }
 
 void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                                    Register amount, LiftoffRegList pinned) {
-  liftoff::I64Shiftop<&TurboAssembler::LsrPair, false>(this, dst, src, amount,
-                                                       pinned);
+                                    Register amount) {
+  liftoff::I64Shiftop<&TurboAssembler::LsrPair, false>(this, dst, src, amount);
 }
 
 void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                                    int amount) {
-  DCHECK(is_uint6(amount));
+                                    int32_t amount) {
   UseScratchRegisterScope temps(this);
-  Register src_high = src.high_gp();
   // {src.high_gp()} will still be needed after writing {dst.low_gp()}.
-  if (src_high == dst.low_gp()) {
-    src_high = GetUnusedRegister(kGpReg).gp();
-    TurboAssembler::Move(src_high, dst.low_gp());
-  }
-
-  LsrPair(dst.low_gp(), dst.high_gp(), src.low_gp(), src_high, amount);
+  Register src_high =
+      liftoff::EnsureNoAlias(this, src.high_gp(), dst.low_gp(), &temps);
+
+  LsrPair(dst.low_gp(), dst.high_gp(), src.low_gp(), src_high, amount & 63);
+}
+
+void LiftoffAssembler::emit_i64_clz(LiftoffRegister dst, LiftoffRegister src) {
+  // return high == 0 ? 32 + CLZ32(low) : CLZ32(high);
+  Label done;
+  Label high_is_zero;
+  cmp(src.high_gp(), Operand(0));
+  b(&high_is_zero, eq);
+
+  clz(dst.low_gp(), src.high_gp());
+  jmp(&done);
+
+  bind(&high_is_zero);
+  clz(dst.low_gp(), src.low_gp());
+  add(dst.low_gp(), dst.low_gp(), Operand(32));
+
+  bind(&done);
+  mov(dst.high_gp(), Operand(0));  // High word of result is always 0.
+}
+
+void LiftoffAssembler::emit_i64_ctz(LiftoffRegister dst, LiftoffRegister src) {
+  // return low == 0 ? 32 + CTZ32(high) : CTZ32(low);
+  // CTZ32(x) = CLZ(RBIT(x))
+  Label done;
+  Label low_is_zero;
+  cmp(src.low_gp(), Operand(0));
+  b(&low_is_zero, eq);
+
+  rbit(dst.low_gp(), src.low_gp());
+  clz(dst.low_gp(), dst.low_gp());
+  jmp(&done);
+
+  bind(&low_is_zero);
+  rbit(dst.low_gp(), src.high_gp());
+  clz(dst.low_gp(), dst.low_gp());
+  add(dst.low_gp(), dst.low_gp(), Operand(32));
+
+  bind(&done);
+  mov(dst.high_gp(), Operand(0));  // High word of result is always 0.
+}
+
+bool LiftoffAssembler::emit_i64_popcnt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  // Produce partial popcnts in the two dst registers, making sure not to
+  // overwrite the second src register before using it.
+  Register src1 = src.high_gp() == dst.low_gp() ? src.high_gp() : src.low_gp();
+  Register src2 = src.high_gp() == dst.low_gp() ? src.low_gp() : src.high_gp();
+  LiftoffRegList pinned = LiftoffRegList::ForRegs(dst, src2);
+  Register scratch1 = pinned.set(GetUnusedRegister(kGpReg, pinned)).gp();
+  Register scratch2 = GetUnusedRegister(kGpReg, pinned).gp();
+  liftoff::GeneratePopCnt(this, dst.low_gp(), src1, scratch1, scratch2);
+  liftoff::GeneratePopCnt(this, dst.high_gp(), src2, scratch1, scratch2);
+  // Now add the two into the lower dst reg and clear the higher dst reg.
+  add(dst.low_gp(), dst.low_gp(), dst.high_gp());
+  mov(dst.high_gp(), Operand(0));
+  return true;
 }
 
 bool LiftoffAssembler::emit_f32_ceil(DoubleRegister dst, DoubleRegister src) {
@@ -1064,7 +1229,7 @@ void LiftoffAssembler::emit_f64_max(DoubleRegister dst, DoubleRegister lhs,
   liftoff::EmitFloatMinOrMax(this, dst, lhs, rhs, liftoff::MinOrMax::kMax);
 }
 
-void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+void LiftoffAssembler::emit_u32_to_intptr(Register dst, Register src) {
   // This is a nop on arm.
 }
 
@@ -1366,6 +1531,11 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   }
 }
 
+void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  vdup(Neon32, liftoff::GetSimd128Register(dst.low_fp()), src.fp(), 0);
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
   ldr(limit_address, MemOperand(limit_address));
   cmp(sp, limit_address);
@@ -1536,6 +1706,8 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   add(sp, sp, Operand(size));
 }
 
+void LiftoffAssembler::DebugBreak() { stop(); }
+
 void LiftoffStackSlots::Construct() {
   for (auto& slot : slots_) {
     const LiftoffAssembler::VarState& src = slot.src_;
@@ -1550,13 +1722,13 @@ void LiftoffStackSlots::Construct() {
             UseScratchRegisterScope temps(asm_);
             Register scratch = temps.Acquire();
             asm_->ldr(scratch,
-                      liftoff::GetHalfStackSlot(slot.src_index_, slot.half_));
+                      liftoff::GetHalfStackSlot(slot.src_offset_, slot.half_));
             asm_->Push(scratch);
           } break;
           case kWasmF64: {
             UseScratchRegisterScope temps(asm_);
             DwVfpRegister scratch = temps.AcquireD();
-            asm_->vldr(scratch, liftoff::GetStackSlot(slot.src_index_));
+            asm_->vldr(scratch, liftoff::GetStackSlot(slot.src_offset_));
             asm_->vpush(scratch);
           } break;
           default:
diff --git a/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h b/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
index dede53b7a484ee..9697fabf9f4d40 100644
--- a/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
+++ b/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
@@ -39,21 +39,11 @@ namespace liftoff {
 //  -----+--------------------+  <-- stack ptr (sp)
 //
 
-constexpr int32_t kInstanceOffset = 2 * kSystemPointerSize;
-constexpr int32_t kFirstStackSlotOffset = kInstanceOffset + kSystemPointerSize;
-constexpr int32_t kConstantStackSpace = 0;
+constexpr int kInstanceOffset = 2 * kSystemPointerSize;
 
-inline int GetStackSlotOffset(uint32_t index) {
-  return kFirstStackSlotOffset + index * LiftoffAssembler::kStackSlotSize;
-}
-
-inline MemOperand GetStackSlot(uint32_t index) {
-  return MemOperand(fp, -GetStackSlotOffset(index));
-}
+inline MemOperand GetStackSlot(int offset) { return MemOperand(fp, -offset); }
 
-inline MemOperand GetInstanceOperand() {
-  return MemOperand(fp, -kInstanceOffset);
-}
+inline MemOperand GetInstanceOperand() { return GetStackSlot(kInstanceOffset); }
 
 inline CPURegister GetRegFromType(const LiftoffRegister& reg, ValueType type) {
   switch (type) {
@@ -65,6 +55,8 @@ inline CPURegister GetRegFromType(const LiftoffRegister& reg, ValueType type) {
       return reg.fp().S();
     case kWasmF64:
       return reg.fp().D();
+    case kWasmS128:
+      return reg.fp().Q();
     default:
       UNREACHABLE();
   }
@@ -77,7 +69,7 @@ inline CPURegList PadRegList(RegList list) {
 
 inline CPURegList PadVRegList(RegList list) {
   if ((base::bits::CountPopulation(list) & 1) != 0) list |= fp_scratch.bit();
-  return CPURegList(CPURegister::kVRegister, kDRegSizeInBits, list);
+  return CPURegList(CPURegister::kVRegister, kQRegSizeInBits, list);
 }
 
 inline CPURegister AcquireByType(UseScratchRegisterScope* temps,
@@ -99,11 +91,9 @@ inline CPURegister AcquireByType(UseScratchRegisterScope* temps,
 inline MemOperand GetMemOp(LiftoffAssembler* assm,
                            UseScratchRegisterScope* temps, Register addr,
                            Register offset, uint32_t offset_imm) {
-  // Wasm memory is limited to a size <2GB, so all offsets can be encoded as
-  // immediate value (in 31 bits, interpreted as signed value).
-  // If the offset is bigger, we always trap and this code is not reached.
-  DCHECK(is_uint31(offset_imm));
-  if (offset.IsValid()) {
+  // Wasm memory is limited to a size <4GB.
+  DCHECK(is_uint32(offset_imm));
+  if (offset.is_valid()) {
     if (offset_imm == 0) return MemOperand(addr.X(), offset.W(), UXTW);
     Register tmp = temps->AcquireW();
     assm->Add(tmp, offset.W(), offset_imm);
@@ -121,20 +111,18 @@ int LiftoffAssembler::PrepareStackFrame() {
   return offset;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(int offset,
-                                              uint32_t stack_slots) {
+void LiftoffAssembler::PatchPrepareStackFrame(int offset, int frame_size) {
   static_assert(kStackSlotSize == kXRegSize,
                 "kStackSlotSize must equal kXRegSize");
-  uint32_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
   // The stack pointer is required to be quadword aligned.
   // Misalignment will cause a stack alignment fault.
-  bytes = RoundUp(bytes, kQuadWordSizeInBytes);
-  if (!IsImmAddSub(bytes)) {
+  frame_size = RoundUp(frame_size, kQuadWordSizeInBytes);
+  if (!IsImmAddSub(frame_size)) {
     // Round the stack to a page to try to fit a add/sub immediate.
-    bytes = RoundUp(bytes, 0x1000);
-    if (!IsImmAddSub(bytes)) {
+    frame_size = RoundUp(frame_size, 0x1000);
+    if (!IsImmAddSub(frame_size)) {
       // Stack greater than 4M! Because this is a quite improbable case, we
-      // just fallback to Turbofan.
+      // just fallback to TurboFan.
       bailout(kOtherReason, "Stack too big");
       return;
     }
@@ -143,7 +131,7 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
   // When using the simulator, deal with Liftoff which allocates the stack
   // before checking it.
   // TODO(arm): Remove this when the stack check mechanism will be updated.
-  if (bytes > KB / 2) {
+  if (frame_size > KB / 2) {
     bailout(kOtherReason,
             "Stack limited to 512 bytes to avoid a bug in StackCheck");
     return;
@@ -152,7 +140,7 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
   PatchingAssembler patching_assembler(AssemblerOptions{},
                                        buffer_start_ + offset, 1);
 #if V8_OS_WIN
-  if (bytes > kStackPageSize) {
+  if (frame_size > kStackPageSize) {
     // Generate OOL code (at the end of the function, where the current
     // assembler is pointing) to do the explicit stack limit check (see
     // https://docs.microsoft.com/en-us/previous-versions/visualstudio/
@@ -163,7 +151,7 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
     patching_assembler.b(ool_offset >> kInstrSizeLog2);
 
     // Now generate the OOL code.
-    Claim(bytes, 1);
+    Claim(frame_size, 1);
     // Jump back to the start of the function (from {pc_offset()} to {offset +
     // kInstrSize}).
     int func_start_offset = offset + kInstrSize - pc_offset();
@@ -171,13 +159,39 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
     return;
   }
 #endif
-  patching_assembler.PatchSubSp(bytes);
+  patching_assembler.PatchSubSp(frame_size);
 }
 
 void LiftoffAssembler::FinishCode() { ForceConstantPoolEmissionWithoutJump(); }
 
 void LiftoffAssembler::AbortCompilation() { AbortedCodeGeneration(); }
 
+// static
+constexpr int LiftoffAssembler::StaticStackFrameSize() {
+  return liftoff::kInstanceOffset;
+}
+
+int LiftoffAssembler::SlotSizeForType(ValueType type) {
+  // TODO(zhin): Unaligned access typically take additional cycles, we should do
+  // some performance testing to see how big an effect it will take.
+  switch (type) {
+    case kWasmS128:
+      return ValueTypes::ElementSizeInBytes(type);
+    default:
+      return kStackSlotSize;
+  }
+}
+
+bool LiftoffAssembler::NeedsAlignment(ValueType type) {
+  switch (type) {
+    case kWasmS128:
+      return true;
+    default:
+      // No alignment because all other types are kStackSlotSize.
+      return false;
+  }
+}
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   switch (value.type()) {
@@ -280,6 +294,9 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
     case LoadType::kF64Load:
       Ldr(dst.fp().D(), src_op);
       break;
+    case LoadType::kS128Load:
+      Ldr(dst.fp().Q(), src_op);
+      break;
     default:
       UNREACHABLE();
   }
@@ -315,11 +332,56 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
     case StoreType::kF64Store:
       Str(src.fp().D(), dst_op);
       break;
+    case StoreType::kS128Store:
+      Str(src.fp().Q(), dst_op);
+      break;
     default:
       UNREACHABLE();
   }
 }
 
+void LiftoffAssembler::AtomicLoad(LiftoffRegister dst, Register src_addr,
+                                  Register offset_reg, uint32_t offset_imm,
+                                  LoadType type, LiftoffRegList pinned) {
+  bailout(kAtomics, "AtomicLoad");
+}
+
+void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
+                                   uint32_t offset_imm, LiftoffRegister src,
+                                   StoreType type, LiftoffRegList pinned) {
+  bailout(kAtomics, "AtomicStore");
+}
+
+void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAdd");
+}
+
+void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicSub");
+}
+
+void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAnd");
+}
+
+void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
+                                uint32_t offset_imm, LiftoffRegister value,
+                                StoreType type) {
+  bailout(kAtomics, "AtomicOr");
+}
+
+void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicXor");
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
@@ -327,12 +389,12 @@ void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
   Ldr(liftoff::GetRegFromType(dst, type), MemOperand(fp, offset));
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
   UseScratchRegisterScope temps(this);
   CPURegister scratch = liftoff::AcquireByType(&temps, type);
-  Ldr(scratch, liftoff::GetStackSlot(src_index));
-  Str(scratch, liftoff::GetStackSlot(dst_index));
+  Ldr(scratch, liftoff::GetStackSlot(src_offset));
+  Str(scratch, liftoff::GetStackSlot(dst_offset));
 }
 
 void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
@@ -348,22 +410,23 @@ void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
                             ValueType type) {
   if (type == kWasmF32) {
     Fmov(dst.S(), src.S());
-  } else {
-    DCHECK_EQ(kWasmF64, type);
+  } else if (type == kWasmF64) {
     Fmov(dst.D(), src.D());
+  } else {
+    DCHECK_EQ(kWasmS128, type);
+    Fmov(dst.Q(), src.Q());
   }
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
-                             ValueType type) {
-  RecordUsedSpillSlot(index);
-  MemOperand dst = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Spill(int offset, LiftoffRegister reg, ValueType type) {
+  RecordUsedSpillOffset(offset);
+  MemOperand dst = liftoff::GetStackSlot(offset);
   Str(liftoff::GetRegFromType(reg, type), dst);
 }
 
-void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
-  RecordUsedSpillSlot(index);
-  MemOperand dst = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Spill(int offset, WasmValue value) {
+  RecordUsedSpillOffset(offset);
+  MemOperand dst = liftoff::GetStackSlot(offset);
   UseScratchRegisterScope temps(this);
   CPURegister src = CPURegister::no_reg();
   switch (value.type()) {
@@ -390,45 +453,62 @@ void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
   Str(src, dst);
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
-                            ValueType type) {
-  MemOperand src = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Fill(LiftoffRegister reg, int offset, ValueType type) {
+  MemOperand src = liftoff::GetStackSlot(offset);
   Ldr(liftoff::GetRegFromType(reg, type), src);
 }
 
-void LiftoffAssembler::FillI64Half(Register, uint32_t index, RegPairHalf) {
+void LiftoffAssembler::FillI64Half(Register, int offset, RegPairHalf) {
   UNREACHABLE();
 }
 
-void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
-  DCHECK_LT(0, count);
-  uint32_t last_stack_slot = index + count - 1;
-  RecordUsedSpillSlot(last_stack_slot);
+void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
+  DCHECK_LT(0, size);
+  DCHECK_EQ(0, size % 4);
+  RecordUsedSpillOffset(start + size);
+
+  int max_stp_offset = -start - size;
+  if (size <= 12 * kStackSlotSize &&
+      IsImmLSPair(max_stp_offset, kXRegSizeLog2)) {
+    // Special straight-line code for up to 12 slots. Generates one
+    // instruction per two slots (<= 7 instructions total).
+    STATIC_ASSERT(kStackSlotSize == kSystemPointerSize);
+    uint32_t remainder = size;
+    for (; remainder >= 2 * kStackSlotSize; remainder -= 2 * kStackSlotSize) {
+      stp(xzr, xzr, liftoff::GetStackSlot(start + remainder));
+    }
 
-  int max_stp_offset = -liftoff::GetStackSlotOffset(index + count - 1);
-  if (count <= 20 && IsImmLSPair(max_stp_offset, kXRegSizeLog2)) {
-    // Special straight-line code for up to 20 slots. Generates one
-    // instruction per two slots (<= 10 instructions total).
-    for (; count > 1; count -= 2) {
-      STATIC_ASSERT(kStackSlotSize == kSystemPointerSize);
-      stp(xzr, xzr, liftoff::GetStackSlot(index + count - 1));
+    DCHECK_GE(12, remainder);
+    switch (remainder) {
+      case 12:
+        str(xzr, liftoff::GetStackSlot(start + remainder));
+        str(wzr, liftoff::GetStackSlot(start + remainder - 8));
+        break;
+      case 8:
+        str(xzr, liftoff::GetStackSlot(start + remainder));
+        break;
+      case 4:
+        str(wzr, liftoff::GetStackSlot(start + remainder));
+        break;
+      case 0:
+        break;
+      default:
+        UNREACHABLE();
     }
-    DCHECK(count == 0 || count == 1);
-    if (count) str(xzr, liftoff::GetStackSlot(index));
   } else {
-    // General case for bigger counts (7 instructions).
-    // Use x0 for start address (inclusive), x1 for end address (exclusive).
-    Push(x1, x0);
-    Sub(x0, fp, Operand(liftoff::GetStackSlotOffset(last_stack_slot)));
-    Sub(x1, fp, Operand(liftoff::GetStackSlotOffset(index) - kStackSlotSize));
+    // General case for bigger counts (5-8 instructions).
+    UseScratchRegisterScope temps(this);
+    Register address_reg = temps.AcquireX();
+    // This {Sub} might use another temp register if the offset is too large.
+    Sub(address_reg, fp, start + size);
+    Register count_reg = temps.AcquireX();
+    Mov(count_reg, size / 4);
 
     Label loop;
     bind(&loop);
-    str(xzr, MemOperand(x0, /* offset */ kSystemPointerSize, PostIndex));
-    cmp(x0, x1);
-    b(&loop, ne);
-
-    Pop(x0, x1);
+    sub(count_reg, count_reg, 1);
+    str(wzr, MemOperand(address_reg, kSystemPointerSize / 2, PostIndex));
+    cbnz(count_reg, &loop);
   }
 }
 
@@ -482,28 +562,23 @@ void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
     instruction(dst.D(), src.D());                                             \
     return true;                                                               \
   }
-#define I32_SHIFTOP(name, instruction)                                         \
-  void LiftoffAssembler::emit_##name(Register dst, Register src,               \
-                                     Register amount, LiftoffRegList pinned) { \
-    instruction(dst.W(), src.W(), amount.W());                                 \
-  }
-#define I32_SHIFTOP_I(name, instruction)                                       \
-  I32_SHIFTOP(name, instruction)                                               \
-  void LiftoffAssembler::emit_##name(Register dst, Register src, int amount) { \
-    DCHECK(is_uint5(amount));                                                  \
-    instruction(dst.W(), src.W(), amount);                                     \
+#define I32_SHIFTOP(name, instruction)                           \
+  void LiftoffAssembler::emit_##name(Register dst, Register src, \
+                                     Register amount) {          \
+    instruction(dst.W(), src.W(), amount.W());                   \
+  }                                                              \
+  void LiftoffAssembler::emit_##name(Register dst, Register src, \
+                                     int32_t amount) {           \
+    instruction(dst.W(), src.W(), amount & 31);                  \
   }
 #define I64_SHIFTOP(name, instruction)                                         \
   void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
-                                     Register amount, LiftoffRegList pinned) { \
+                                     Register amount) {                        \
     instruction(dst.gp().X(), src.gp().X(), amount.X());                       \
-  }
-#define I64_SHIFTOP_I(name, instruction)                                       \
-  I64_SHIFTOP(name, instruction)                                               \
+  }                                                                            \
   void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
-                                     int amount) {                             \
-    DCHECK(is_uint6(amount));                                                  \
-    instruction(dst.gp().X(), src.gp().X(), amount);                           \
+                                     int32_t amount) {                         \
+    instruction(dst.gp().X(), src.gp().X(), amount & 63);                      \
   }
 
 I32_BINOP_I(i32_add, Add)
@@ -514,7 +589,7 @@ I32_BINOP_I(i32_or, Orr)
 I32_BINOP_I(i32_xor, Eor)
 I32_SHIFTOP(i32_shl, Lsl)
 I32_SHIFTOP(i32_sar, Asr)
-I32_SHIFTOP_I(i32_shr, Lsr)
+I32_SHIFTOP(i32_shr, Lsr)
 I64_BINOP_I(i64_add, Add)
 I64_BINOP(i64_sub, Sub)
 I64_BINOP(i64_mul, Mul)
@@ -523,7 +598,7 @@ I64_BINOP_I(i64_or, Orr)
 I64_BINOP_I(i64_xor, Eor)
 I64_SHIFTOP(i64_shl, Lsl)
 I64_SHIFTOP(i64_sar, Asr)
-I64_SHIFTOP_I(i64_shr, Lsr)
+I64_SHIFTOP(i64_shr, Lsr)
 FP32_BINOP(f32_add, Fadd)
 FP32_BINOP(f32_sub, Fsub)
 FP32_BINOP(f32_mul, Fmul)
@@ -559,19 +634,15 @@ FP64_UNOP(f64_sqrt, Fsqrt)
 #undef FP64_UNOP
 #undef FP64_UNOP_RETURN_TRUE
 #undef I32_SHIFTOP
-#undef I32_SHIFTOP_I
 #undef I64_SHIFTOP
-#undef I64_SHIFTOP_I
 
-bool LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
+void LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
   Clz(dst.W(), src.W());
-  return true;
 }
 
-bool LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
+void LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
   Rbit(dst.W(), src.W());
   Clz(dst.W(), dst.W());
-  return true;
 }
 
 bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
@@ -584,6 +655,26 @@ bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
   return true;
 }
 
+void LiftoffAssembler::emit_i64_clz(LiftoffRegister dst, LiftoffRegister src) {
+  Clz(dst.gp().X(), src.gp().X());
+}
+
+void LiftoffAssembler::emit_i64_ctz(LiftoffRegister dst, LiftoffRegister src) {
+  Rbit(dst.gp().X(), src.gp().X());
+  Clz(dst.gp().X(), dst.gp().X());
+}
+
+bool LiftoffAssembler::emit_i64_popcnt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  UseScratchRegisterScope temps(this);
+  VRegister scratch = temps.AcquireV(kFormat8B);
+  Fmov(scratch.D(), src.gp().X());
+  Cnt(scratch, scratch);
+  Addv(scratch.B(), scratch);
+  Fmov(dst.gp().X(), scratch.D());
+  return true;
+}
+
 void LiftoffAssembler::emit_i32_divs(Register dst, Register lhs, Register rhs,
                                      Label* trap_div_by_zero,
                                      Label* trap_div_unrepresentable) {
@@ -718,8 +809,8 @@ bool LiftoffAssembler::emit_i64_remu(LiftoffRegister dst, LiftoffRegister lhs,
   return true;
 }
 
-void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
-  Sxtw(dst, src);
+void LiftoffAssembler::emit_u32_to_intptr(Register dst, Register src) {
+  Uxtw(dst, src);
 }
 
 void LiftoffAssembler::emit_f32_copysign(DoubleRegister dst, DoubleRegister lhs,
@@ -914,14 +1005,14 @@ void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label,
                                       Register rhs) {
   switch (type) {
     case kWasmI32:
-      if (rhs.IsValid()) {
+      if (rhs.is_valid()) {
         Cmp(lhs.W(), rhs.W());
       } else {
         Cmp(lhs.W(), wzr);
       }
       break;
     case kWasmI64:
-      if (rhs.IsValid()) {
+      if (rhs.is_valid()) {
         Cmp(lhs.X(), rhs.X());
       } else {
         Cmp(lhs.X(), xzr);
@@ -978,6 +1069,11 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   }
 }
 
+void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  Dup(dst.fp().V4S(), src.fp().S(), 0);
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
   Ldr(limit_address, MemOperand(limit_address));
   Cmp(sp, limit_address);
@@ -1059,7 +1155,7 @@ void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
                                     Register target) {
   // For Arm64, we have more cache registers than wasm parameters. That means
   // that target will always be in a register.
-  DCHECK(target.IsValid());
+  DCHECK(target.is_valid());
   Call(target);
 }
 
@@ -1082,6 +1178,8 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   Drop(size, 1);
 }
 
+void LiftoffAssembler::DebugBreak() { debug("DebugBreak", 0, BREAK); }
+
 void LiftoffStackSlots::Construct() {
   size_t slot_count = slots_.size();
   // The stack pointer is required to be quadword aligned.
@@ -1093,7 +1191,7 @@ void LiftoffStackSlots::Construct() {
       case LiftoffAssembler::VarState::kStack: {
         UseScratchRegisterScope temps(asm_);
         CPURegister scratch = liftoff::AcquireByType(&temps, slot.src_.type());
-        asm_->Ldr(scratch, liftoff::GetStackSlot(slot.src_index_));
+        asm_->Ldr(scratch, liftoff::GetStackSlot(slot.src_offset_));
         asm_->Poke(scratch, poke_offset);
         break;
       }
diff --git a/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h b/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h
index fa88d20df63759..7e6356b83372e3 100644
--- a/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h
+++ b/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h
@@ -14,38 +14,28 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-#define REQUIRE_CPU_FEATURE(name, ...)        \
-  if (!CpuFeatures::IsSupported(name)) {      \
-    bailout(kMissingCPUFeature, "no " #name); \
-    return __VA_ARGS__;                       \
-  }                                           \
+#define RETURN_FALSE_IF_MISSING_CPU_FEATURE(name)    \
+  if (!CpuFeatures::IsSupported(name)) return false; \
   CpuFeatureScope feature(this, name);
 
 namespace liftoff {
 
-// ebp-4 holds the stack marker, ebp-8 is the instance parameter, first stack
-// slot is located at ebp-16.
-constexpr int32_t kConstantStackSpace = 8;
-constexpr int32_t kFirstStackSlotOffset =
-    kConstantStackSpace + LiftoffAssembler::kStackSlotSize;
+// ebp-4 holds the stack marker, ebp-8 is the instance parameter.
+constexpr int kInstanceOffset = 8;
 
-inline Operand GetStackSlot(uint32_t index) {
-  int32_t offset = index * LiftoffAssembler::kStackSlotSize;
-  return Operand(ebp, -kFirstStackSlotOffset - offset);
-}
+inline Operand GetStackSlot(int offset) { return Operand(ebp, -offset); }
 
-inline MemOperand GetHalfStackSlot(uint32_t index, RegPairHalf half) {
+inline MemOperand GetHalfStackSlot(int offset, RegPairHalf half) {
   int32_t half_offset =
       half == kLowWord ? 0 : LiftoffAssembler::kStackSlotSize / 2;
-  int32_t offset = index * LiftoffAssembler::kStackSlotSize - half_offset;
-  return Operand(ebp, -kFirstStackSlotOffset - offset);
+  return Operand(ebp, -offset + half_offset);
 }
 
 // TODO(clemensb): Make this a constexpr variable once Operand is constexpr.
-inline Operand GetInstanceOperand() { return Operand(ebp, -8); }
+inline Operand GetInstanceOperand() { return GetStackSlot(kInstanceOffset); }
 
 static constexpr LiftoffRegList kByteRegs =
-    LiftoffRegList::FromBits<Register::ListOf<eax, ecx, edx>()>();
+    LiftoffRegList::FromBits<Register::ListOf(eax, ecx, edx)>();
 
 inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, Register base,
                  int32_t offset, ValueType type) {
@@ -160,10 +150,8 @@ int LiftoffAssembler::PrepareStackFrame() {
   return offset;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(int offset,
-                                              uint32_t stack_slots) {
-  uint32_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
-  DCHECK_LE(bytes, kMaxInt);
+void LiftoffAssembler::PatchPrepareStackFrame(int offset, int frame_size) {
+  DCHECK_EQ(frame_size % kSystemPointerSize, 0);
   // We can't run out of space, just pass anything big enough to not cause the
   // assembler to try to grow the buffer.
   constexpr int kAvailableSpace = 64;
@@ -171,7 +159,7 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
       AssemblerOptions{},
       ExternalAssemblerBuffer(buffer_start_ + offset, kAvailableSpace));
 #if V8_OS_WIN
-  if (bytes > kStackPageSize) {
+  if (frame_size > kStackPageSize) {
     // Generate OOL code (at the end of the function, where the current
     // assembler is pointing) to do the explicit stack limit check (see
     // https://docs.microsoft.com/en-us/previous-versions/visualstudio/
@@ -185,7 +173,7 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
                            patching_assembler.pc_offset());
 
     // Now generate the OOL code.
-    AllocateStackSpace(bytes);
+    AllocateStackSpace(frame_size);
     // Jump back to the start of the function (from {pc_offset()} to {offset +
     // kSubSpSize}).
     int func_start_offset = offset + liftoff::kSubSpSize - pc_offset();
@@ -193,7 +181,7 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
     return;
   }
 #endif
-  patching_assembler.sub_sp_32(bytes);
+  patching_assembler.sub_sp_32(frame_size);
   DCHECK_EQ(liftoff::kSubSpSize, patching_assembler.pc_offset());
 }
 
@@ -201,6 +189,17 @@ void LiftoffAssembler::FinishCode() {}
 
 void LiftoffAssembler::AbortCompilation() {}
 
+// static
+constexpr int LiftoffAssembler::StaticStackFrameSize() {
+  return liftoff::kInstanceOffset;
+}
+
+int LiftoffAssembler::SlotSizeForType(ValueType type) {
+  return ValueTypes::ElementSizeInBytes(type);
+}
+
+bool LiftoffAssembler::NeedsAlignment(ValueType type) { return false; }
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   switch (value.type()) {
@@ -260,14 +259,10 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
                             uint32_t* protected_load_pc, bool is_load_mem) {
-  DCHECK_EQ(type.value_type() == kWasmI64, dst.is_pair());
-  // Wasm memory is limited to a size <2GB, so all offsets can be encoded as
-  // immediate value (in 31 bits, interpreted as signed value).
-  // If the offset is bigger, we always trap and this code is not reached.
-  // Note: We shouldn't have memories larger than 2GiB on 32-bit, but if we
-  // did, we encode {offset_im} as signed, and it will simply wrap around.
+  DCHECK_EQ(type.value_type() == kWasmI64, dst.is_gp_pair());
+  DCHECK_LE(offset_imm, std::numeric_limits<int32_t>::max());
   Operand src_op = offset_reg == no_reg
-                       ? Operand(src_addr, bit_cast<int32_t>(offset_imm))
+                       ? Operand(src_addr, offset_imm)
                        : Operand(src_addr, offset_reg, times_1, offset_imm);
   if (protected_load_pc) *protected_load_pc = pc_offset();
 
@@ -329,6 +324,9 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
     case LoadType::kF64Load:
       movsd(dst.fp(), src_op);
       break;
+    case LoadType::kS128Load:
+      movdqu(dst.fp(), src_op);
+      break;
     default:
       UNREACHABLE();
   }
@@ -338,12 +336,10 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
                              uint32_t* protected_store_pc, bool is_store_mem) {
-  DCHECK_EQ(type.value_type() == kWasmI64, src.is_pair());
-  // Wasm memory is limited to a size <2GB, so all offsets can be encoded as
-  // immediate value (in 31 bits, interpreted as signed value).
-  // If the offset is bigger, we always trap and this code is not reached.
+  DCHECK_EQ(type.value_type() == kWasmI64, src.is_gp_pair());
+  DCHECK_LE(offset_imm, std::numeric_limits<int32_t>::max());
   Operand dst_op = offset_reg == no_reg
-                       ? Operand(dst_addr, bit_cast<int32_t>(offset_imm))
+                       ? Operand(dst_addr, offset_imm)
                        : Operand(dst_addr, offset_reg, times_1, offset_imm);
   if (protected_store_pc) *protected_store_pc = pc_offset();
 
@@ -397,11 +393,134 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
     case StoreType::kF64Store:
       movsd(dst_op, src.fp());
       break;
+    case StoreType::kS128Store:
+      Movdqu(dst_op, src.fp());
+      break;
     default:
       UNREACHABLE();
   }
 }
 
+void LiftoffAssembler::AtomicLoad(LiftoffRegister dst, Register src_addr,
+                                  Register offset_reg, uint32_t offset_imm,
+                                  LoadType type, LiftoffRegList pinned) {
+  if (type.value() != LoadType::kI64Load) {
+    Load(dst, src_addr, offset_reg, offset_imm, type, pinned, nullptr, true);
+    return;
+  }
+
+  DCHECK_EQ(type.value_type() == kWasmI64, dst.is_gp_pair());
+  DCHECK_LE(offset_imm, std::numeric_limits<int32_t>::max());
+  Operand src_op = offset_reg == no_reg
+                       ? Operand(src_addr, offset_imm)
+                       : Operand(src_addr, offset_reg, times_1, offset_imm);
+
+  movsd(liftoff::kScratchDoubleReg, src_op);
+  Pextrd(dst.low().gp(), liftoff::kScratchDoubleReg, 0);
+  Pextrd(dst.high().gp(), liftoff::kScratchDoubleReg, 1);
+}
+
+void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
+                                   uint32_t offset_imm, LiftoffRegister src,
+                                   StoreType type, LiftoffRegList pinned) {
+  DCHECK_NE(offset_reg, no_reg);
+  DCHECK_LE(offset_imm, std::numeric_limits<int32_t>::max());
+  Operand dst_op = Operand(dst_addr, offset_reg, times_1, offset_imm);
+
+  pinned = pinned | LiftoffRegList::ForRegs(dst_addr, src, offset_reg);
+  Register src_reg = src.is_gp_pair() ? src.low().gp() : src.gp();
+  // If {src} is used after this operation, we are not allowed to overwrite it.
+  // {kI64Store} and {kI(32|64)Store8} need special treatment below, so we don't
+  // handle them here.
+  if (type.value() != StoreType::kI64Store &&
+      type.value() != StoreType::kI64Store8 &&
+      type.value() != StoreType::kI32Store8 && cache_state()->is_used(src)) {
+    Register old_src = src_reg;
+    src_reg = GetUnusedRegister(kGpReg, pinned).gp();
+    mov(src_reg, old_src);
+  }
+
+  switch (type.value()) {
+    case StoreType::kI64Store8:
+    case StoreType::kI32Store8:
+      if (cache_state()->is_used(src)) {
+        // Only the lower 4 registers can be addressed as 8-bit registers.
+        if (cache_state()->has_unused_register(liftoff::kByteRegs, pinned)) {
+          Register byte_src =
+              GetUnusedRegister(liftoff::kByteRegs, pinned).gp();
+          mov(byte_src, src_reg);
+          xchg_b(byte_src, dst_op);
+        } else {  // (if !cache_state()->has_unused_register(...))
+          // No byte register is available, we have to spill {src}.
+          push(src_reg);
+          xchg_b(src_reg, dst_op);
+          pop(src_reg);
+        }
+      } else {  // if (!cache_state()->is_used(src)) {
+        if (src_reg.is_byte_register()) {
+          xchg_b(src_reg, dst_op);
+        } else {  // if (!src.gp().is_byte_register())
+          Register byte_src =
+              GetUnusedRegister(liftoff::kByteRegs, pinned).gp();
+          mov(byte_src, src_reg);
+          xchg_b(byte_src, dst_op);
+        }
+      }
+      return;
+    case StoreType::kI64Store16:
+    case StoreType::kI32Store16:
+      xchg_w(src_reg, dst_op);
+      return;
+    case StoreType::kI64Store32:
+    case StoreType::kI32Store:
+      xchg(src_reg, dst_op);
+      return;
+    case StoreType::kI64Store: {
+      auto scratch2 = GetUnusedRegister(kFpReg, pinned).fp();
+      movd(liftoff::kScratchDoubleReg, src.low().gp());
+      movd(scratch2, src.high().gp());
+      Punpckldq(liftoff::kScratchDoubleReg, scratch2);
+      movsd(dst_op, liftoff::kScratchDoubleReg);
+      // This lock+or is needed to achieve sequential consistency.
+      lock();
+      or_(Operand(esp, 0), Immediate(0));
+      return;
+    }
+    default:
+      UNREACHABLE();
+  }
+}
+
+void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAdd");
+}
+
+void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicSub");
+}
+
+void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAnd");
+}
+
+void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
+                                uint32_t offset_imm, LiftoffRegister value,
+                                StoreType type) {
+  bailout(kAtomics, "AtomicOr");
+}
+
+void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicXor");
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
@@ -409,18 +528,18 @@ void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                 type);
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
-  if (needs_reg_pair(type)) {
+  if (needs_gp_reg_pair(type)) {
     liftoff::MoveStackValue(this,
-                            liftoff::GetHalfStackSlot(src_index, kLowWord),
-                            liftoff::GetHalfStackSlot(dst_index, kLowWord));
+                            liftoff::GetHalfStackSlot(src_offset, kLowWord),
+                            liftoff::GetHalfStackSlot(dst_offset, kLowWord));
     liftoff::MoveStackValue(this,
-                            liftoff::GetHalfStackSlot(src_index, kHighWord),
-                            liftoff::GetHalfStackSlot(dst_index, kHighWord));
+                            liftoff::GetHalfStackSlot(src_offset, kHighWord),
+                            liftoff::GetHalfStackSlot(dst_offset, kHighWord));
   } else {
-    liftoff::MoveStackValue(this, liftoff::GetStackSlot(src_index),
-                            liftoff::GetStackSlot(dst_index));
+    liftoff::MoveStackValue(this, liftoff::GetStackSlot(src_offset),
+                            liftoff::GetStackSlot(dst_offset));
   }
 }
 
@@ -435,23 +554,24 @@ void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
   DCHECK_NE(dst, src);
   if (type == kWasmF32) {
     movss(dst, src);
-  } else {
-    DCHECK_EQ(kWasmF64, type);
+  } else if (type == kWasmF64) {
     movsd(dst, src);
+  } else {
+    DCHECK_EQ(kWasmS128, type);
+    movapd(dst, src);
   }
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
-                             ValueType type) {
-  RecordUsedSpillSlot(index);
-  Operand dst = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Spill(int offset, LiftoffRegister reg, ValueType type) {
+  RecordUsedSpillOffset(offset);
+  Operand dst = liftoff::GetStackSlot(offset);
   switch (type) {
     case kWasmI32:
       mov(dst, reg.gp());
       break;
     case kWasmI64:
-      mov(liftoff::GetHalfStackSlot(index, kLowWord), reg.low_gp());
-      mov(liftoff::GetHalfStackSlot(index, kHighWord), reg.high_gp());
+      mov(liftoff::GetHalfStackSlot(offset, kLowWord), reg.low_gp());
+      mov(liftoff::GetHalfStackSlot(offset, kHighWord), reg.high_gp());
       break;
     case kWasmF32:
       movss(dst, reg.fp());
@@ -459,14 +579,17 @@ void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
     case kWasmF64:
       movsd(dst, reg.fp());
       break;
+    case kWasmS128:
+      movdqu(dst, reg.fp());
+      break;
     default:
       UNREACHABLE();
   }
 }
 
-void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
-  RecordUsedSpillSlot(index);
-  Operand dst = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Spill(int offset, WasmValue value) {
+  RecordUsedSpillOffset(offset);
+  Operand dst = liftoff::GetStackSlot(offset);
   switch (value.type()) {
     case kWasmI32:
       mov(dst, Immediate(value.to_i32()));
@@ -474,8 +597,8 @@ void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
     case kWasmI64: {
       int32_t low_word = value.to_i64();
       int32_t high_word = value.to_i64() >> 32;
-      mov(liftoff::GetHalfStackSlot(index, kLowWord), Immediate(low_word));
-      mov(liftoff::GetHalfStackSlot(index, kHighWord), Immediate(high_word));
+      mov(liftoff::GetHalfStackSlot(offset, kLowWord), Immediate(low_word));
+      mov(liftoff::GetHalfStackSlot(offset, kHighWord), Immediate(high_word));
       break;
     }
     default:
@@ -484,16 +607,15 @@ void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
   }
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
-                            ValueType type) {
-  Operand src = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Fill(LiftoffRegister reg, int offset, ValueType type) {
+  Operand src = liftoff::GetStackSlot(offset);
   switch (type) {
     case kWasmI32:
       mov(reg.gp(), src);
       break;
     case kWasmI64:
-      mov(reg.low_gp(), liftoff::GetHalfStackSlot(index, kLowWord));
-      mov(reg.high_gp(), liftoff::GetHalfStackSlot(index, kHighWord));
+      mov(reg.low_gp(), liftoff::GetHalfStackSlot(offset, kLowWord));
+      mov(reg.high_gp(), liftoff::GetHalfStackSlot(offset, kHighWord));
       break;
     case kWasmF32:
       movss(reg.fp(), src);
@@ -501,27 +623,28 @@ void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
     case kWasmF64:
       movsd(reg.fp(), src);
       break;
+    case kWasmS128:
+      movdqu(reg.fp(), src);
+      break;
     default:
       UNREACHABLE();
   }
 }
 
-void LiftoffAssembler::FillI64Half(Register reg, uint32_t index,
-                                   RegPairHalf half) {
-  mov(reg, liftoff::GetHalfStackSlot(index, half));
+void LiftoffAssembler::FillI64Half(Register reg, int offset, RegPairHalf half) {
+  mov(reg, liftoff::GetHalfStackSlot(offset, half));
 }
 
-void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
-  DCHECK_LT(0, count);
-  uint32_t last_stack_slot = index + count - 1;
-  RecordUsedSpillSlot(last_stack_slot);
+void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
+  DCHECK_LT(0, size);
+  DCHECK_EQ(0, size % 4);
+  RecordUsedSpillOffset(start + size);
 
-  if (count <= 2) {
-    // Special straight-line code for up to two slots (6-9 bytes per word:
-    // C7 <1-4 bytes operand> <4 bytes imm>, makes 12-18 bytes per slot).
-    for (uint32_t offset = 0; offset < count; ++offset) {
-      mov(liftoff::GetHalfStackSlot(index + offset, kLowWord), Immediate(0));
-      mov(liftoff::GetHalfStackSlot(index + offset, kHighWord), Immediate(0));
+  if (size <= 12) {
+    // Special straight-line code for up to three words (6-9 bytes per word:
+    // C7 <1-4 bytes operand> <4 bytes imm>, makes 18-27 bytes total).
+    for (int offset = 4; offset <= size; offset += 4) {
+      mov(liftoff::GetHalfStackSlot(start + offset, kLowWord), Immediate(0));
     }
   } else {
     // General case for bigger counts.
@@ -531,10 +654,10 @@ void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
     push(eax);
     push(ecx);
     push(edi);
-    lea(edi, liftoff::GetStackSlot(last_stack_slot));
+    lea(edi, liftoff::GetStackSlot(start + size));
     xor_(eax, eax);
-    // Number of words is number of slots times two.
-    mov(ecx, Immediate(count * 2));
+    // Size is in bytes, convert to doublewords (4-bytes).
+    mov(ecx, Immediate(size / 4));
     rep_stos();
     pop(edi);
     pop(ecx);
@@ -716,11 +839,8 @@ void LiftoffAssembler::emit_i32_xor(Register dst, Register lhs, int32_t imm) {
 namespace liftoff {
 inline void EmitShiftOperation(LiftoffAssembler* assm, Register dst,
                                Register src, Register amount,
-                               void (Assembler::*emit_shift)(Register),
-                               LiftoffRegList pinned) {
-  pinned.set(dst);
-  pinned.set(src);
-  pinned.set(amount);
+                               void (Assembler::*emit_shift)(Register)) {
+  LiftoffRegList pinned = LiftoffRegList::ForRegs(dst, src, amount);
   // If dst is ecx, compute into a tmp register first, then move to ecx.
   if (dst == ecx) {
     Register tmp = assm->GetUnusedRegister(kGpReg, pinned).gp();
@@ -753,62 +873,45 @@ inline void EmitShiftOperation(LiftoffAssembler* assm, Register dst,
 }
 }  // namespace liftoff
 
-void LiftoffAssembler::emit_i32_shl(Register dst, Register src, Register amount,
-                                    LiftoffRegList pinned) {
-  liftoff::EmitShiftOperation(this, dst, src, amount, &Assembler::shl_cl,
-                              pinned);
+void LiftoffAssembler::emit_i32_shl(Register dst, Register src,
+                                    Register amount) {
+  liftoff::EmitShiftOperation(this, dst, src, amount, &Assembler::shl_cl);
 }
 
-void LiftoffAssembler::emit_i32_sar(Register dst, Register src, Register amount,
-                                    LiftoffRegList pinned) {
-  liftoff::EmitShiftOperation(this, dst, src, amount, &Assembler::sar_cl,
-                              pinned);
+void LiftoffAssembler::emit_i32_shl(Register dst, Register src,
+                                    int32_t amount) {
+  if (dst != src) mov(dst, src);
+  shl(dst, amount & 31);
 }
 
-void LiftoffAssembler::emit_i32_shr(Register dst, Register src, Register amount,
-                                    LiftoffRegList pinned) {
-  liftoff::EmitShiftOperation(this, dst, src, amount, &Assembler::shr_cl,
-                              pinned);
+void LiftoffAssembler::emit_i32_sar(Register dst, Register src,
+                                    Register amount) {
+  liftoff::EmitShiftOperation(this, dst, src, amount, &Assembler::sar_cl);
 }
 
-void LiftoffAssembler::emit_i32_shr(Register dst, Register src, int amount) {
+void LiftoffAssembler::emit_i32_sar(Register dst, Register src,
+                                    int32_t amount) {
   if (dst != src) mov(dst, src);
-  DCHECK(is_uint5(amount));
-  shr(dst, amount);
+  sar(dst, amount & 31);
 }
 
-bool LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
-  Label nonzero_input;
-  Label continuation;
-  test(src, src);
-  j(not_zero, &nonzero_input, Label::kNear);
-  mov(dst, Immediate(32));
-  jmp(&continuation, Label::kNear);
-
-  bind(&nonzero_input);
-  // Get most significant bit set (MSBS).
-  bsr(dst, src);
-  // CLZ = 31 - MSBS = MSBS ^ 31.
-  xor_(dst, 31);
-
-  bind(&continuation);
-  return true;
+void LiftoffAssembler::emit_i32_shr(Register dst, Register src,
+                                    Register amount) {
+  liftoff::EmitShiftOperation(this, dst, src, amount, &Assembler::shr_cl);
 }
 
-bool LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
-  Label nonzero_input;
-  Label continuation;
-  test(src, src);
-  j(not_zero, &nonzero_input, Label::kNear);
-  mov(dst, Immediate(32));
-  jmp(&continuation, Label::kNear);
+void LiftoffAssembler::emit_i32_shr(Register dst, Register src,
+                                    int32_t amount) {
+  if (dst != src) mov(dst, src);
+  shr(dst, amount & 31);
+}
 
-  bind(&nonzero_input);
-  // Get least significant bit set, which equals number of trailing zeros.
-  bsf(dst, src);
+void LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
+  Lzcnt(dst, src);
+}
 
-  bind(&continuation);
-  return true;
+void LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
+  Tzcnt(dst, src);
 }
 
 bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
@@ -979,10 +1082,9 @@ inline LiftoffRegister ReplaceInPair(LiftoffRegister pair, Register old_reg,
 
 inline void Emit64BitShiftOperation(
     LiftoffAssembler* assm, LiftoffRegister dst, LiftoffRegister src,
-    Register amount, void (TurboAssembler::*emit_shift)(Register, Register),
-    LiftoffRegList pinned) {
+    Register amount, void (TurboAssembler::*emit_shift)(Register, Register)) {
   // Temporary registers cannot overlap with {dst}.
-  pinned.set(dst);
+  LiftoffRegList pinned = LiftoffRegList::ForRegs(dst);
 
   constexpr size_t kMaxRegMoves = 3;
   base::SmallVector<LiftoffAssembler::ParallelRegisterMoveTuple, kMaxRegMoves>
@@ -1017,31 +1119,141 @@ inline void Emit64BitShiftOperation(
 }  // namespace liftoff
 
 void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
-                                    Register amount, LiftoffRegList pinned) {
+                                    Register amount) {
   liftoff::Emit64BitShiftOperation(this, dst, src, amount,
-                                   &TurboAssembler::ShlPair_cl, pinned);
+                                   &TurboAssembler::ShlPair_cl);
+}
+
+void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
+                                    int32_t amount) {
+  amount &= 63;
+  if (amount >= 32) {
+    if (dst.high_gp() != src.low_gp()) mov(dst.high_gp(), src.low_gp());
+    if (amount != 32) shl(dst.high_gp(), amount - 32);
+    xor_(dst.low_gp(), dst.low_gp());
+  } else {
+    if (dst != src) Move(dst, src, kWasmI64);
+    ShlPair(dst.high_gp(), dst.low_gp(), amount);
+  }
 }
 
 void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
-                                    Register amount, LiftoffRegList pinned) {
+                                    Register amount) {
   liftoff::Emit64BitShiftOperation(this, dst, src, amount,
-                                   &TurboAssembler::SarPair_cl, pinned);
+                                   &TurboAssembler::SarPair_cl);
 }
 
+void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
+                                    int32_t amount) {
+  amount &= 63;
+  if (amount >= 32) {
+    if (dst.low_gp() != src.high_gp()) mov(dst.low_gp(), src.high_gp());
+    if (dst.high_gp() != src.high_gp()) mov(dst.high_gp(), src.high_gp());
+    if (amount != 32) sar(dst.low_gp(), amount - 32);
+    sar(dst.high_gp(), 31);
+  } else {
+    if (dst != src) Move(dst, src, kWasmI64);
+    SarPair(dst.high_gp(), dst.low_gp(), amount);
+  }
+}
 void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                                    Register amount, LiftoffRegList pinned) {
+                                    Register amount) {
   liftoff::Emit64BitShiftOperation(this, dst, src, amount,
-                                   &TurboAssembler::ShrPair_cl, pinned);
+                                   &TurboAssembler::ShrPair_cl);
 }
 
 void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                                    int amount) {
-  if (dst != src) Move(dst, src, kWasmI64);
-  DCHECK(is_uint6(amount));
-  ShrPair(dst.high_gp(), dst.low_gp(), amount);
+                                    int32_t amount) {
+  amount &= 63;
+  if (amount >= 32) {
+    if (dst.low_gp() != src.high_gp()) mov(dst.low_gp(), src.high_gp());
+    if (amount != 32) shr(dst.low_gp(), amount - 32);
+    xor_(dst.high_gp(), dst.high_gp());
+  } else {
+    if (dst != src) Move(dst, src, kWasmI64);
+    ShrPair(dst.high_gp(), dst.low_gp(), amount);
+  }
 }
 
-void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+void LiftoffAssembler::emit_i64_clz(LiftoffRegister dst, LiftoffRegister src) {
+  // return high == 0 ? 32 + CLZ32(low) : CLZ32(high);
+  Label done;
+  Register safe_dst = dst.low_gp();
+  if (src.low_gp() == safe_dst) safe_dst = dst.high_gp();
+  if (CpuFeatures::IsSupported(LZCNT)) {
+    CpuFeatureScope scope(this, LZCNT);
+    lzcnt(safe_dst, src.high_gp());  // Sets CF if high == 0.
+    j(not_carry, &done, Label::kNear);
+    lzcnt(safe_dst, src.low_gp());
+    add(safe_dst, Immediate(32));  // 32 + CLZ32(low)
+  } else {
+    // CLZ32(x) =^ x == 0 ? 32 : 31 - BSR32(x)
+    Label high_is_zero;
+    bsr(safe_dst, src.high_gp());  // Sets ZF is high == 0.
+    j(zero, &high_is_zero, Label::kNear);
+    xor_(safe_dst, Immediate(31));  // for x in [0..31], 31^x == 31-x.
+    jmp(&done, Label::kNear);
+
+    bind(&high_is_zero);
+    Label low_not_zero;
+    bsr(safe_dst, src.low_gp());
+    j(not_zero, &low_not_zero, Label::kNear);
+    mov(safe_dst, Immediate(64 ^ 63));  // 64, after the xor below.
+    bind(&low_not_zero);
+    xor_(safe_dst, 63);  // for x in [0..31], 63^x == 63-x.
+  }
+
+  bind(&done);
+  if (safe_dst != dst.low_gp()) mov(dst.low_gp(), safe_dst);
+  xor_(dst.high_gp(), dst.high_gp());  // High word of result is always 0.
+}
+
+void LiftoffAssembler::emit_i64_ctz(LiftoffRegister dst, LiftoffRegister src) {
+  // return low == 0 ? 32 + CTZ32(high) : CTZ32(low);
+  Label done;
+  Register safe_dst = dst.low_gp();
+  if (src.high_gp() == safe_dst) safe_dst = dst.high_gp();
+  if (CpuFeatures::IsSupported(BMI1)) {
+    CpuFeatureScope scope(this, BMI1);
+    tzcnt(safe_dst, src.low_gp());  // Sets CF if low == 0.
+    j(not_carry, &done, Label::kNear);
+    tzcnt(safe_dst, src.high_gp());
+    add(safe_dst, Immediate(32));  // 32 + CTZ32(high)
+  } else {
+    // CTZ32(x) =^ x == 0 ? 32 : BSF32(x)
+    bsf(safe_dst, src.low_gp());  // Sets ZF is low == 0.
+    j(not_zero, &done, Label::kNear);
+
+    Label high_not_zero;
+    bsf(safe_dst, src.high_gp());
+    j(not_zero, &high_not_zero, Label::kNear);
+    mov(safe_dst, 64);  // low == 0 and high == 0
+    jmp(&done);
+    bind(&high_not_zero);
+    add(safe_dst, Immediate(32));  // 32 + CTZ32(high)
+  }
+
+  bind(&done);
+  if (safe_dst != dst.low_gp()) mov(dst.low_gp(), safe_dst);
+  xor_(dst.high_gp(), dst.high_gp());  // High word of result is always 0.
+}
+
+bool LiftoffAssembler::emit_i64_popcnt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  if (!CpuFeatures::IsSupported(POPCNT)) return false;
+  CpuFeatureScope scope(this, POPCNT);
+  // Produce partial popcnts in the two dst registers.
+  Register src1 = src.high_gp() == dst.low_gp() ? src.high_gp() : src.low_gp();
+  Register src2 = src.high_gp() == dst.low_gp() ? src.low_gp() : src.high_gp();
+  popcnt(dst.low_gp(), src1);
+  popcnt(dst.high_gp(), src2);
+  // Add the two into the lower dst reg, clear the higher dst reg.
+  add(dst.low_gp(), dst.high_gp());
+  xor_(dst.high_gp(), dst.high_gp());
+  return true;
+}
+
+void LiftoffAssembler::emit_u32_to_intptr(Register dst, Register src) {
   // This is a nop on ia32.
 }
 
@@ -1211,40 +1423,28 @@ void LiftoffAssembler::emit_f32_neg(DoubleRegister dst, DoubleRegister src) {
 }
 
 bool LiftoffAssembler::emit_f32_ceil(DoubleRegister dst, DoubleRegister src) {
-  if (CpuFeatures::IsSupported(SSE4_1)) {
-    CpuFeatureScope feature(this, SSE4_1);
-    roundss(dst, src, kRoundUp);
-    return true;
-  }
-  return false;
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
+  roundss(dst, src, kRoundUp);
+  return true;
 }
 
 bool LiftoffAssembler::emit_f32_floor(DoubleRegister dst, DoubleRegister src) {
-  if (CpuFeatures::IsSupported(SSE4_1)) {
-    CpuFeatureScope feature(this, SSE4_1);
-    roundss(dst, src, kRoundDown);
-    return true;
-  }
-  return false;
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
+  roundss(dst, src, kRoundDown);
+  return true;
 }
 
 bool LiftoffAssembler::emit_f32_trunc(DoubleRegister dst, DoubleRegister src) {
-  if (CpuFeatures::IsSupported(SSE4_1)) {
-    CpuFeatureScope feature(this, SSE4_1);
-    roundss(dst, src, kRoundToZero);
-    return true;
-  }
-  return false;
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
+  roundss(dst, src, kRoundToZero);
+  return true;
 }
 
 bool LiftoffAssembler::emit_f32_nearest_int(DoubleRegister dst,
                                             DoubleRegister src) {
-  if (CpuFeatures::IsSupported(SSE4_1)) {
-    CpuFeatureScope feature(this, SSE4_1);
-    roundss(dst, src, kRoundToNearest);
-    return true;
-  }
-  return false;
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
+  roundss(dst, src, kRoundToNearest);
+  return true;
 }
 
 void LiftoffAssembler::emit_f32_sqrt(DoubleRegister dst, DoubleRegister src) {
@@ -1360,26 +1560,26 @@ void LiftoffAssembler::emit_f64_neg(DoubleRegister dst, DoubleRegister src) {
 }
 
 bool LiftoffAssembler::emit_f64_ceil(DoubleRegister dst, DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1, true);
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
   roundsd(dst, src, kRoundUp);
   return true;
 }
 
 bool LiftoffAssembler::emit_f64_floor(DoubleRegister dst, DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1, true);
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
   roundsd(dst, src, kRoundDown);
   return true;
 }
 
 bool LiftoffAssembler::emit_f64_trunc(DoubleRegister dst, DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1, true);
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
   roundsd(dst, src, kRoundToZero);
   return true;
 }
 
 bool LiftoffAssembler::emit_f64_nearest_int(DoubleRegister dst,
                                             DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1, true);
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
   roundsd(dst, src, kRoundToNearest);
   return true;
 }
@@ -1712,6 +1912,19 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   liftoff::EmitFloatSetCond<&Assembler::ucomisd>(this, cond, dst, lhs, rhs);
 }
 
+void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vshufps(dst.fp(), src.fp(), src.fp(), 0);
+  } else {
+    if (dst.fp() != src.fp()) {
+      movss(dst.fp(), src.fp());
+    }
+    shufps(dst.fp(), src.fp(), 0);
+  }
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
   cmp(esp, Operand(limit_address, 0));
   j(below_equal, ool_code);
@@ -1736,15 +1949,15 @@ void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
   LiftoffRegList fp_regs = regs & kFpCacheRegList;
   unsigned num_fp_regs = fp_regs.GetNumRegsSet();
   if (num_fp_regs) {
-    AllocateStackSpace(num_fp_regs * kStackSlotSize);
+    AllocateStackSpace(num_fp_regs * kSimd128Size);
     unsigned offset = 0;
     while (!fp_regs.is_empty()) {
       LiftoffRegister reg = fp_regs.GetFirstRegSet();
-      movsd(Operand(esp, offset), reg.fp());
+      Movdqu(Operand(esp, offset), reg.fp());
       fp_regs.clear(reg);
-      offset += sizeof(double);
+      offset += kSimd128Size;
     }
-    DCHECK_EQ(offset, num_fp_regs * sizeof(double));
+    DCHECK_EQ(offset, num_fp_regs * kSimd128Size);
   }
 }
 
@@ -1753,9 +1966,9 @@ void LiftoffAssembler::PopRegisters(LiftoffRegList regs) {
   unsigned fp_offset = 0;
   while (!fp_regs.is_empty()) {
     LiftoffRegister reg = fp_regs.GetFirstRegSet();
-    movsd(reg.fp(), Operand(esp, fp_offset));
+    Movdqu(reg.fp(), Operand(esp, fp_offset));
     fp_regs.clear(reg);
-    fp_offset += sizeof(double);
+    fp_offset += kSimd128Size;
   }
   if (fp_offset) add(esp, Immediate(fp_offset));
   LiftoffRegList gp_regs = regs & kGpCacheRegList;
@@ -1850,6 +2063,8 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   add(esp, Immediate(size));
 }
 
+void LiftoffAssembler::DebugBreak() { int3(); }
+
 void LiftoffStackSlots::Construct() {
   for (auto& slot : slots_) {
     const LiftoffAssembler::VarState& src = slot.src_;
@@ -1857,9 +2072,9 @@ void LiftoffStackSlots::Construct() {
       case LiftoffAssembler::VarState::kStack:
         if (src.type() == kWasmF64) {
           DCHECK_EQ(kLowWord, slot.half_);
-          asm_->push(liftoff::GetHalfStackSlot(slot.src_index_, kHighWord));
+          asm_->push(liftoff::GetHalfStackSlot(slot.src_offset_, kHighWord));
         }
-        asm_->push(liftoff::GetHalfStackSlot(slot.src_index_, slot.half_));
+        asm_->push(liftoff::GetHalfStackSlot(slot.src_offset_, slot.half_));
         break;
       case LiftoffAssembler::VarState::kRegister:
         if (src.type() == kWasmI64) {
@@ -1879,7 +2094,7 @@ void LiftoffStackSlots::Construct() {
   }
 }
 
-#undef REQUIRE_CPU_FEATURE
+#undef RETURN_FALSE_IF_MISSING_CPU_FEATURE
 
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/src/wasm/baseline/liftoff-assembler-defs.h b/deps/v8/src/wasm/baseline/liftoff-assembler-defs.h
index 17966987975c57..781fb87dbcf425 100644
--- a/deps/v8/src/wasm/baseline/liftoff-assembler-defs.h
+++ b/deps/v8/src/wasm/baseline/liftoff-assembler-defs.h
@@ -14,64 +14,60 @@ namespace wasm {
 
 #if V8_TARGET_ARCH_IA32
 
+// Omit ebx, which is the root register.
 constexpr RegList kLiftoffAssemblerGpCacheRegs =
-    Register::ListOf<eax, ecx, edx, esi, edi>();
+    Register::ListOf(eax, ecx, edx, esi, edi);
 
 // Omit xmm7, which is the kScratchDoubleReg.
 constexpr RegList kLiftoffAssemblerFpCacheRegs =
-    DoubleRegister::ListOf<xmm0, xmm1, xmm2, xmm3, xmm4, xmm5, xmm6>();
+    DoubleRegister::ListOf(xmm0, xmm1, xmm2, xmm3, xmm4, xmm5, xmm6);
 
 #elif V8_TARGET_ARCH_X64
 
 constexpr RegList kLiftoffAssemblerGpCacheRegs =
-    Register::ListOf<rax, rcx, rdx, rbx, rsi, rdi, r9>();
+    Register::ListOf(rax, rcx, rdx, rbx, rsi, rdi, r9);
 
 constexpr RegList kLiftoffAssemblerFpCacheRegs =
-    DoubleRegister::ListOf<xmm0, xmm1, xmm2, xmm3, xmm4, xmm5, xmm6, xmm7>();
+    DoubleRegister::ListOf(xmm0, xmm1, xmm2, xmm3, xmm4, xmm5, xmm6, xmm7);
 
 #elif V8_TARGET_ARCH_MIPS
 
 constexpr RegList kLiftoffAssemblerGpCacheRegs =
-    Register::ListOf<a0, a1, a2, a3, t0, t1, t2, t3, t4, t5, t6, s7, v0, v1>();
+    Register::ListOf(a0, a1, a2, a3, t0, t1, t2, t3, t4, t5, t6, s7, v0, v1);
 
-constexpr RegList kLiftoffAssemblerFpCacheRegs =
-    DoubleRegister::ListOf<f0, f2, f4, f6, f8, f10, f12, f14, f16, f18, f20,
-                           f22, f24>();
+constexpr RegList kLiftoffAssemblerFpCacheRegs = DoubleRegister::ListOf(
+    f0, f2, f4, f6, f8, f10, f12, f14, f16, f18, f20, f22, f24);
 
 #elif V8_TARGET_ARCH_MIPS64
 
 constexpr RegList kLiftoffAssemblerGpCacheRegs =
-    Register::ListOf<a0, a1, a2, a3, a4, a5, a6, a7, t0, t1, t2, s7, v0, v1>();
+    Register::ListOf(a0, a1, a2, a3, a4, a5, a6, a7, t0, t1, t2, s7, v0, v1);
 
-constexpr RegList kLiftoffAssemblerFpCacheRegs =
-    DoubleRegister::ListOf<f0, f2, f4, f6, f8, f10, f12, f14, f16, f18, f20,
-                           f22, f24, f26>();
+constexpr RegList kLiftoffAssemblerFpCacheRegs = DoubleRegister::ListOf(
+    f0, f2, f4, f6, f8, f10, f12, f14, f16, f18, f20, f22, f24, f26);
 
 #elif V8_TARGET_ARCH_ARM
 
 // r7: cp, r10: root, r11: fp, r12: ip, r13: sp, r14: lr, r15: pc.
 constexpr RegList kLiftoffAssemblerGpCacheRegs =
-    Register::ListOf<r0, r1, r2, r3, r4, r5, r6, r8, r9>();
+    Register::ListOf(r0, r1, r2, r3, r4, r5, r6, r8, r9);
 
 // d13: zero, d14-d15: scratch
-constexpr RegList kLiftoffAssemblerFpCacheRegs =
-    LowDwVfpRegister::ListOf<d0, d1, d2, d3, d4, d5, d6, d7, d8, d9, d10, d11,
-                             d12>();
+constexpr RegList kLiftoffAssemblerFpCacheRegs = LowDwVfpRegister::ListOf(
+    d0, d1, d2, d3, d4, d5, d6, d7, d8, d9, d10, d11, d12);
 
 #elif V8_TARGET_ARCH_ARM64
 
 // x16: ip0, x17: ip1, x18: platform register, x26: root, x27: cp, x29: fp,
 // x30: lr, x31: xzr.
 constexpr RegList kLiftoffAssemblerGpCacheRegs =
-    CPURegister::ListOf<x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12,
-                        x13, x14, x15, x19, x20, x21, x22, x23, x24, x25,
-                        x28>();
+    CPURegister::ListOf(x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12,
+                        x13, x14, x15, x19, x20, x21, x22, x23, x24, x25, x28);
 
 // d15: fp_zero, d30-d31: macro-assembler scratch V Registers.
-constexpr RegList kLiftoffAssemblerFpCacheRegs =
-    CPURegister::ListOf<d0, d1, d2, d3, d4, d5, d6, d7, d8, d9, d10, d11, d12,
-                        d13, d14, d16, d17, d18, d19, d20, d21, d22, d23, d24,
-                        d25, d26, d27, d28, d29>();
+constexpr RegList kLiftoffAssemblerFpCacheRegs = CPURegister::ListOf(
+    d0, d1, d2, d3, d4, d5, d6, d7, d8, d9, d10, d11, d12, d13, d14, d16, d17,
+    d18, d19, d20, d21, d22, d23, d24, d25, d26, d27, d28, d29);
 
 #else
 
diff --git a/deps/v8/src/wasm/baseline/liftoff-assembler.cc b/deps/v8/src/wasm/baseline/liftoff-assembler.cc
index 389c0655075b06..68a8ad6e48891a 100644
--- a/deps/v8/src/wasm/baseline/liftoff-assembler.cc
+++ b/deps/v8/src/wasm/baseline/liftoff-assembler.cc
@@ -24,13 +24,6 @@ using VarState = LiftoffAssembler::VarState;
 
 namespace {
 
-#define __ asm_->
-
-#define TRACE(...)                                            \
-  do {                                                        \
-    if (FLAG_trace_liftoff) PrintF("[liftoff] " __VA_ARGS__); \
-  } while (false)
-
 class StackTransferRecipe {
   struct RegisterMove {
     LiftoffRegister src;
@@ -49,7 +42,7 @@ class StackTransferRecipe {
 
     LoadKind kind;
     ValueType type;
-    int32_t value;  // i32 constant value or stack index, depending on kind.
+    int32_t value;  // i32 constant value or stack offset, depending on kind.
 
     // Named constructors.
     static RegisterLoad Const(WasmValue constant) {
@@ -60,12 +53,12 @@ class StackTransferRecipe {
       DCHECK_EQ(constant.to_i32_unchecked(), constant.to_i64_unchecked());
       return {kConstant, kWasmI64, constant.to_i32_unchecked()};
     }
-    static RegisterLoad Stack(int32_t stack_index, ValueType type) {
-      return {kStack, type, stack_index};
+    static RegisterLoad Stack(int32_t offset, ValueType type) {
+      return {kStack, type, offset};
     }
-    static RegisterLoad HalfStack(int32_t stack_index, RegPairHalf half) {
+    static RegisterLoad HalfStack(int32_t offset, RegPairHalf half) {
       return {half == kLowWord ? kLowHalfStack : kHighHalfStack, kWasmI32,
-              stack_index};
+              offset};
     }
 
    private:
@@ -86,30 +79,25 @@ class StackTransferRecipe {
     DCHECK(load_dst_regs_.is_empty());
   }
 
-  void TransferStackSlot(const LiftoffAssembler::CacheState& dst_state,
-                         uint32_t dst_index,
-                         const LiftoffAssembler::CacheState& src_state,
-                         uint32_t src_index) {
-    const VarState& dst = dst_state.stack_state[dst_index];
-    const VarState& src = src_state.stack_state[src_index];
+  void TransferStackSlot(const VarState& dst, const VarState& src) {
     DCHECK_EQ(dst.type(), src.type());
     switch (dst.loc()) {
       case VarState::kStack:
         switch (src.loc()) {
           case VarState::kStack:
-            if (src_index == dst_index) break;
-            asm_->MoveStackValue(dst_index, src_index, src.type());
+            if (src.offset() == dst.offset()) break;
+            asm_->MoveStackValue(dst.offset(), src.offset(), src.type());
             break;
           case VarState::kRegister:
-            asm_->Spill(dst_index, src.reg(), src.type());
+            asm_->Spill(dst.offset(), src.reg(), src.type());
             break;
           case VarState::kIntConst:
-            asm_->Spill(dst_index, src.constant());
+            asm_->Spill(dst.offset(), src.constant());
             break;
         }
         break;
       case VarState::kRegister:
-        LoadIntoRegister(dst.reg(), src, src_index);
+        LoadIntoRegister(dst.reg(), src, src.offset());
         break;
       case VarState::kIntConst:
         DCHECK_EQ(dst, src);
@@ -119,10 +107,10 @@ class StackTransferRecipe {
 
   void LoadIntoRegister(LiftoffRegister dst,
                         const LiftoffAssembler::VarState& src,
-                        uint32_t src_index) {
+                        uint32_t src_offset) {
     switch (src.loc()) {
       case VarState::kStack:
-        LoadStackSlot(dst, src_index, src.type());
+        LoadStackSlot(dst, src_offset, src.type());
         break;
       case VarState::kRegister:
         DCHECK_EQ(dst.reg_class(), src.reg_class());
@@ -136,14 +124,14 @@ class StackTransferRecipe {
 
   void LoadI64HalfIntoRegister(LiftoffRegister dst,
                                const LiftoffAssembler::VarState& src,
-                               uint32_t index, RegPairHalf half) {
+                               int offset, RegPairHalf half) {
     // Use CHECK such that the remaining code is statically dead if
     // {kNeedI64RegPair} is false.
     CHECK(kNeedI64RegPair);
     DCHECK_EQ(kWasmI64, src.type());
     switch (src.loc()) {
       case VarState::kStack:
-        LoadI64HalfStackSlot(dst, index, half);
+        LoadI64HalfStackSlot(dst, offset, half);
         break;
       case VarState::kRegister: {
         LiftoffRegister src_half =
@@ -164,13 +152,21 @@ class StackTransferRecipe {
     DCHECK_NE(dst, src);
     DCHECK_EQ(dst.reg_class(), src.reg_class());
     DCHECK_EQ(reg_class_for(type), src.reg_class());
-    if (src.is_pair()) {
+    if (src.is_gp_pair()) {
       DCHECK_EQ(kWasmI64, type);
       if (dst.low() != src.low()) MoveRegister(dst.low(), src.low(), kWasmI32);
       if (dst.high() != src.high())
         MoveRegister(dst.high(), src.high(), kWasmI32);
       return;
     }
+    if (src.is_fp_pair()) {
+      DCHECK_EQ(kWasmS128, type);
+      if (dst.low() != src.low()) {
+        MoveRegister(dst.low(), src.low(), kWasmF64);
+        MoveRegister(dst.high(), src.high(), kWasmF64);
+      }
+      return;
+    }
     if (move_dst_regs_.has(dst)) {
       DCHECK_EQ(register_move(dst)->src, src);
       // Non-fp registers can only occur with the exact same type.
@@ -189,7 +185,7 @@ class StackTransferRecipe {
   void LoadConstant(LiftoffRegister dst, WasmValue value) {
     DCHECK(!load_dst_regs_.has(dst));
     load_dst_regs_.set(dst);
-    if (dst.is_pair()) {
+    if (dst.is_gp_pair()) {
       DCHECK_EQ(kWasmI64, value.type());
       int64_t i64 = value.to_i64();
       *register_load(dst.low()) =
@@ -201,7 +197,7 @@ class StackTransferRecipe {
     }
   }
 
-  void LoadStackSlot(LiftoffRegister dst, uint32_t stack_index,
+  void LoadStackSlot(LiftoffRegister dst, uint32_t stack_offset,
                      ValueType type) {
     if (load_dst_regs_.has(dst)) {
       // It can happen that we spilled the same register to different stack
@@ -210,19 +206,21 @@ class StackTransferRecipe {
       return;
     }
     load_dst_regs_.set(dst);
-    if (dst.is_pair()) {
+    if (dst.is_gp_pair()) {
       DCHECK_EQ(kWasmI64, type);
       *register_load(dst.low()) =
-          RegisterLoad::HalfStack(stack_index, kLowWord);
+          RegisterLoad::HalfStack(stack_offset, kLowWord);
       *register_load(dst.high()) =
-          RegisterLoad::HalfStack(stack_index, kHighWord);
+          RegisterLoad::HalfStack(stack_offset, kHighWord);
+    } else if (dst.is_fp_pair()) {
+      DCHECK_EQ(kWasmS128, type);
+      *register_load(dst.low()) = RegisterLoad::Stack(stack_offset, type);
     } else {
-      *register_load(dst) = RegisterLoad::Stack(stack_index, type);
+      *register_load(dst) = RegisterLoad::Stack(stack_offset, type);
     }
   }
 
-  void LoadI64HalfStackSlot(LiftoffRegister dst, uint32_t stack_index,
-                            RegPairHalf half) {
+  void LoadI64HalfStackSlot(LiftoffRegister dst, int offset, RegPairHalf half) {
     if (load_dst_regs_.has(dst)) {
       // It can happen that we spilled the same register to different stack
       // slots, and then we reload them later into the same dst register.
@@ -230,7 +228,7 @@ class StackTransferRecipe {
       return;
     }
     load_dst_regs_.set(dst);
-    *register_load(dst) = RegisterLoad::HalfStack(stack_index, half);
+    *register_load(dst) = RegisterLoad::HalfStack(offset, half);
   }
 
  private:
@@ -295,16 +293,16 @@ class StackTransferRecipe {
 
     // All remaining moves are parts of a cycle. Just spill the first one, then
     // process all remaining moves in that cycle. Repeat for all cycles.
-    uint32_t next_spill_slot = asm_->cache_state()->stack_height();
+    int last_spill_offset = asm_->TopSpillOffset();
     while (!move_dst_regs_.is_empty()) {
       // TODO(clemensb): Use an unused register if available.
       LiftoffRegister dst = move_dst_regs_.GetFirstRegSet();
       RegisterMove* move = register_move(dst);
+      last_spill_offset += LiftoffAssembler::SlotSizeForType(move->type);
       LiftoffRegister spill_reg = move->src;
-      asm_->Spill(next_spill_slot, spill_reg, move->type);
+      asm_->Spill(last_spill_offset, spill_reg, move->type);
       // Remember to reload into the destination register later.
-      LoadStackSlot(dst, next_spill_slot, move->type);
-      ++next_spill_slot;
+      LoadStackSlot(dst, last_spill_offset, move->type);
       ClearExecutedMove(dst);
     }
   }
@@ -319,7 +317,12 @@ class StackTransferRecipe {
                                       : WasmValue(int32_t{load->value}));
           break;
         case RegisterLoad::kStack:
-          asm_->Fill(dst, load->value, load->type);
+          if (kNeedS128RegPair && load->type == kWasmS128) {
+            asm_->Fill(LiftoffRegister::ForFpPair(dst.fp()), load->value,
+                       load->type);
+          } else {
+            asm_->Fill(dst, load->value, load->type);
+          }
           break;
         case RegisterLoad::kLowHalfStack:
           // Half of a register pair, {dst} must be a gp register.
@@ -350,7 +353,7 @@ class RegisterReuseMap {
 
   base::Optional<LiftoffRegister> Lookup(LiftoffRegister src) {
     for (auto it = map_.begin(), end = map_.end(); it != end; it += 2) {
-      if (it->is_pair() == src.is_pair() && *it == src) return *(it + 1);
+      if (it->is_gp_pair() == src.is_gp_pair() && *it == src) return *(it + 1);
     }
     return {};
   }
@@ -401,12 +404,12 @@ void InitMergeRegion(LiftoffAssembler::CacheState* state,
     }
     if (!reg) {
       // No free register; make this a stack slot.
-      *target = VarState(source->type());
+      *target = VarState(source->type(), source->offset());
       continue;
     }
     if (reuse_registers) register_reuse_map.Add(source->reg(), *reg);
     state->inc_used(*reg);
-    *target = VarState(source->type(), *reg);
+    *target = VarState(source->type(), *reg, source->offset());
   }
 }
 
@@ -484,8 +487,6 @@ constexpr AssemblerOptions DefaultLiftoffOptions() {
 
 }  // namespace
 
-// TODO(clemensb): Provide a reasonably sized buffer, based on wasm function
-// size.
 LiftoffAssembler::LiftoffAssembler(std::unique_ptr<AssemblerBuffer> buffer)
     : TurboAssembler(nullptr, DefaultLiftoffOptions(), CodeObjectRequired::kNo,
                      std::move(buffer)) {
@@ -506,7 +507,7 @@ LiftoffRegister LiftoffAssembler::PopToRegister(LiftoffRegList pinned) {
     case VarState::kStack: {
       LiftoffRegister reg =
           GetUnusedRegister(reg_class_for(slot.type()), pinned);
-      Fill(reg, cache_state_.stack_height(), slot.type());
+      Fill(reg, slot.offset(), slot.type());
       return reg;
     }
     case VarState::kRegister:
@@ -530,7 +531,7 @@ void LiftoffAssembler::MergeFullStackWith(const CacheState& target,
   // allocations.
   StackTransferRecipe transfers(this);
   for (uint32_t i = 0, e = source.stack_height(); i < e; ++i) {
-    transfers.TransferStackSlot(target, i, source, i);
+    transfers.TransferStackSlot(target.stack_state[i], source.stack_state[i]);
   }
 }
 
@@ -549,33 +550,33 @@ void LiftoffAssembler::MergeStackWith(const CacheState& target,
   uint32_t target_stack_base = target_stack_height - arity;
   StackTransferRecipe transfers(this);
   for (uint32_t i = 0; i < target_stack_base; ++i) {
-    transfers.TransferStackSlot(target, i, cache_state_, i);
+    transfers.TransferStackSlot(target.stack_state[i],
+                                cache_state_.stack_state[i]);
   }
   for (uint32_t i = 0; i < arity; ++i) {
-    transfers.TransferStackSlot(target, target_stack_base + i, cache_state_,
-                                stack_base + i);
+    transfers.TransferStackSlot(target.stack_state[target_stack_base + i],
+                                cache_state_.stack_state[stack_base + i]);
   }
 }
 
-void LiftoffAssembler::Spill(uint32_t index) {
-  auto& slot = cache_state_.stack_state[index];
-  switch (slot.loc()) {
+void LiftoffAssembler::Spill(VarState* slot) {
+  switch (slot->loc()) {
     case VarState::kStack:
       return;
     case VarState::kRegister:
-      Spill(index, slot.reg(), slot.type());
-      cache_state_.dec_used(slot.reg());
+      Spill(slot->offset(), slot->reg(), slot->type());
+      cache_state_.dec_used(slot->reg());
       break;
     case VarState::kIntConst:
-      Spill(index, slot.constant());
+      Spill(slot->offset(), slot->constant());
       break;
   }
-  slot.MakeStack();
+  slot->MakeStack();
 }
 
 void LiftoffAssembler::SpillLocals() {
   for (uint32_t i = 0; i < num_locals_; ++i) {
-    Spill(i);
+    Spill(&cache_state_.stack_state[i]);
   }
 }
 
@@ -583,7 +584,7 @@ void LiftoffAssembler::SpillAllRegisters() {
   for (uint32_t i = 0, e = cache_state_.stack_height(); i < e; ++i) {
     auto& slot = cache_state_.stack_state[i];
     if (!slot.is_reg()) continue;
-    Spill(i, slot.reg(), slot.type());
+    Spill(slot.offset(), slot.reg(), slot.type());
     slot.MakeStack();
   }
   cache_state_.reset_used_registers();
@@ -603,7 +604,7 @@ void LiftoffAssembler::PrepareCall(FunctionSig* sig,
        idx < end; ++idx) {
     VarState& slot = cache_state_.stack_state[idx];
     if (!slot.is_reg()) continue;
-    Spill(idx, slot.reg(), slot.type());
+    Spill(slot.offset(), slot.reg(), slot.type());
     slot.MakeStack();
   }
 
@@ -634,42 +635,52 @@ void LiftoffAssembler::PrepareCall(FunctionSig* sig,
   for (uint32_t i = num_params; i > 0; --i) {
     const uint32_t param = i - 1;
     ValueType type = sig->GetParam(param);
-    const bool is_pair = kNeedI64RegPair && type == kWasmI64;
-    const int num_lowered_params = is_pair ? 2 : 1;
+    const bool is_gp_pair = kNeedI64RegPair && type == kWasmI64;
+    const int num_lowered_params = is_gp_pair ? 2 : 1;
     const uint32_t stack_idx = param_base + param;
     const VarState& slot = cache_state_.stack_state[stack_idx];
+    const uint32_t stack_offset = slot.offset();
     // Process both halfs of a register pair separately, because they are passed
     // as separate parameters. One or both of them could end up on the stack.
     for (int lowered_idx = 0; lowered_idx < num_lowered_params; ++lowered_idx) {
       const RegPairHalf half =
-          is_pair && lowered_idx == 0 ? kHighWord : kLowWord;
+          is_gp_pair && lowered_idx == 0 ? kHighWord : kLowWord;
       --call_desc_input_idx;
       compiler::LinkageLocation loc =
           call_descriptor->GetInputLocation(call_desc_input_idx);
       if (loc.IsRegister()) {
         DCHECK(!loc.IsAnyRegister());
-        RegClass rc = is_pair ? kGpReg : reg_class_for(type);
+        RegClass rc = is_gp_pair ? kGpReg : reg_class_for(type);
         int reg_code = loc.AsRegister();
-#if V8_TARGET_ARCH_ARM
-        // Liftoff assumes a one-to-one mapping between float registers and
-        // double registers, and so does not distinguish between f32 and f64
-        // registers. The f32 register code must therefore be halved in order to
-        // pass the f64 code to Liftoff.
-        DCHECK_IMPLIES(type == kWasmF32, (reg_code % 2) == 0);
-        LiftoffRegister reg = LiftoffRegister::from_code(
-            rc, (type == kWasmF32) ? (reg_code / 2) : reg_code);
-#else
-        LiftoffRegister reg = LiftoffRegister::from_code(rc, reg_code);
-#endif
+
+        // Initialize to anything, will be set in all branches below.
+        LiftoffRegister reg = kGpCacheRegList.GetFirstRegSet();
+        if (!kSimpleFPAliasing && type == kWasmF32) {
+          // Liftoff assumes a one-to-one mapping between float registers and
+          // double registers, and so does not distinguish between f32 and f64
+          // registers. The f32 register code must therefore be halved in order
+          // to pass the f64 code to Liftoff.
+          DCHECK_EQ(0, reg_code % 2);
+          reg = LiftoffRegister::from_code(rc, (reg_code / 2));
+        } else if (kNeedS128RegPair && type == kWasmS128) {
+          // Similarly for double registers and SIMD registers, the SIMD code
+          // needs to be doubled to pass the f64 code to Liftoff.
+          reg = LiftoffRegister::ForFpPair(
+              DoubleRegister::from_code(reg_code * 2));
+        } else {
+          reg = LiftoffRegister::from_code(rc, reg_code);
+        }
+
         param_regs.set(reg);
-        if (is_pair) {
-          stack_transfers.LoadI64HalfIntoRegister(reg, slot, stack_idx, half);
+        if (is_gp_pair) {
+          stack_transfers.LoadI64HalfIntoRegister(reg, slot, stack_offset,
+                                                  half);
         } else {
-          stack_transfers.LoadIntoRegister(reg, slot, stack_idx);
+          stack_transfers.LoadIntoRegister(reg, slot, stack_offset);
         }
       } else {
         DCHECK(loc.IsCallerFrameSlot());
-        stack_slots.Add(slot, stack_idx, half);
+        stack_slots.Add(slot, stack_offset, half);
       }
     }
   }
@@ -688,7 +699,7 @@ void LiftoffAssembler::PrepareCall(FunctionSig* sig,
       *target = new_target.gp();
     } else {
       stack_slots.Add(LiftoffAssembler::VarState(LiftoffAssembler::kWasmIntPtr,
-                                                 LiftoffRegister(*target)));
+                                                 LiftoffRegister(*target), 0));
       *target = no_reg;
     }
   }
@@ -716,9 +727,12 @@ void LiftoffAssembler::FinishCall(FunctionSig* sig,
   if (return_count != 0) {
     DCHECK_EQ(1, return_count);
     ValueType return_type = sig->GetReturn(0);
-    const bool need_pair = kNeedI64RegPair && return_type == kWasmI64;
-    DCHECK_EQ(need_pair ? 2 : 1, call_descriptor->ReturnCount());
-    RegClass rc = need_pair ? kGpReg : reg_class_for(return_type);
+    const bool needs_gp_pair = needs_gp_reg_pair(return_type);
+    const bool needs_fp_pair = needs_fp_reg_pair(return_type);
+    DCHECK_EQ(needs_gp_pair ? 2 : 1, call_descriptor->ReturnCount());
+    RegClass rc = needs_gp_pair
+                      ? kGpReg
+                      : needs_fp_pair ? kFpReg : reg_class_for(return_type);
 #if V8_TARGET_ARCH_ARM
     // If the return register was not d0 for f32, the code value would have to
     // be halved as is done for the parameter registers.
@@ -727,11 +741,14 @@ void LiftoffAssembler::FinishCall(FunctionSig* sig,
     LiftoffRegister return_reg = LiftoffRegister::from_code(
         rc, call_descriptor->GetReturnLocation(0).AsRegister());
     DCHECK(GetCacheRegList(rc).has(return_reg));
-    if (need_pair) {
+    if (needs_gp_pair) {
       LiftoffRegister high_reg = LiftoffRegister::from_code(
           rc, call_descriptor->GetReturnLocation(1).AsRegister());
       DCHECK(GetCacheRegList(rc).has(high_reg));
       return_reg = LiftoffRegister::ForPair(return_reg.gp(), high_reg.gp());
+    } else if (needs_fp_pair) {
+      DCHECK_EQ(0, return_reg.fp().code() % 2);
+      return_reg = LiftoffRegister::ForFpPair(return_reg.fp());
     }
     DCHECK(!cache_state_.is_used(return_reg));
     PushRegister(return_type, return_reg);
@@ -742,7 +759,7 @@ void LiftoffAssembler::Move(LiftoffRegister dst, LiftoffRegister src,
                             ValueType type) {
   DCHECK_EQ(dst.reg_class(), src.reg_class());
   DCHECK_NE(dst, src);
-  if (kNeedI64RegPair && dst.is_pair()) {
+  if (kNeedI64RegPair && dst.is_gp_pair()) {
     // Use the {StackTransferRecipe} to move pairs, as the registers in the
     // pairs might overlap.
     StackTransferRecipe(this).MoveRegister(dst, src, type);
@@ -767,15 +784,21 @@ void LiftoffAssembler::MoveToReturnRegisters(FunctionSig* sig) {
   DCHECK_EQ(1, sig->return_count());
   ValueType return_type = sig->GetReturn(0);
   StackTransferRecipe stack_transfers(this);
-  LiftoffRegister return_reg =
-      needs_reg_pair(return_type)
-          ? LiftoffRegister::ForPair(kGpReturnRegisters[0],
-                                     kGpReturnRegisters[1])
-          : reg_class_for(return_type) == kGpReg
-                ? LiftoffRegister(kGpReturnRegisters[0])
-                : LiftoffRegister(kFpReturnRegisters[0]);
+  // Defaults to a gp reg, will be set below if return type is not gp.
+  LiftoffRegister return_reg = LiftoffRegister(kGpReturnRegisters[0]);
+
+  if (needs_gp_reg_pair(return_type)) {
+    return_reg =
+        LiftoffRegister::ForPair(kGpReturnRegisters[0], kGpReturnRegisters[1]);
+  } else if (needs_fp_reg_pair(return_type)) {
+    return_reg = LiftoffRegister::ForFpPair(kFpReturnRegisters[0]);
+  } else if (reg_class_for(return_type) == kFpReg) {
+    return_reg = LiftoffRegister(kFpReturnRegisters[0]);
+  } else {
+    DCHECK_EQ(kGpReg, reg_class_for(return_type));
+  }
   stack_transfers.LoadIntoRegister(return_reg, cache_state_.stack_state.back(),
-                                   cache_state_.stack_height() - 1);
+                                   cache_state_.stack_state.back().offset());
 }
 
 #ifdef ENABLE_SLOW_DCHECKS
@@ -785,7 +808,7 @@ bool LiftoffAssembler::ValidateCacheState() const {
   for (const VarState& var : cache_state_.stack_state) {
     if (!var.is_reg()) continue;
     LiftoffRegister reg = var.reg();
-    if (kNeedI64RegPair && reg.is_pair()) {
+    if ((kNeedI64RegPair || kNeedS128RegPair) && reg.is_pair()) {
       ++register_use_count[reg.low().liftoff_code()];
       ++register_use_count[reg.high().liftoff_code()];
     } else {
@@ -816,6 +839,52 @@ LiftoffRegister LiftoffAssembler::SpillOneRegister(LiftoffRegList candidates,
   return spill_reg;
 }
 
+LiftoffRegister LiftoffAssembler::SpillAdjacentFpRegisters(
+    LiftoffRegList pinned) {
+  // We end up in this call only when:
+  // [1] kNeedS128RegPair, and
+  // [2] there are no pair of adjacent FP registers that are free
+  CHECK(kNeedS128RegPair);
+  DCHECK(!kFpCacheRegList.MaskOut(pinned)
+              .MaskOut(cache_state_.used_registers)
+              .HasAdjacentFpRegsSet());
+
+  // Special logic, if the top fp register is even, we might hit a case of an
+  // invalid register in case 2.
+  LiftoffRegister last_fp = kFpCacheRegList.GetLastRegSet();
+  if (last_fp.fp().code() % 2 == 0) {
+    pinned.set(last_fp);
+  }
+
+  // We can try to optimize the spilling here:
+  // 1. Try to get a free fp register, either:
+  //  a. This register is already free, or
+  //  b. it had to be spilled.
+  // 2. If 1a, the adjacent register is used (invariant [2]), spill it.
+  // 3. If 1b, check the adjacent register:
+  //  a. If free, done!
+  //  b. If used, spill it.
+  // We spill one register in 2 and 3a, and two registers in 3b.
+
+  LiftoffRegister first_reg = GetUnusedRegister(kFpCacheRegList, pinned);
+  LiftoffRegister second_reg = first_reg, low_reg = first_reg;
+
+  if (first_reg.fp().code() % 2 == 0) {
+    second_reg =
+        LiftoffRegister::from_liftoff_code(first_reg.liftoff_code() + 1);
+  } else {
+    second_reg =
+        LiftoffRegister::from_liftoff_code(first_reg.liftoff_code() - 1);
+    low_reg = second_reg;
+  }
+
+  if (cache_state_.is_used(second_reg)) {
+    SpillRegister(second_reg);
+  }
+
+  return low_reg;
+}
+
 void LiftoffAssembler::SpillRegister(LiftoffRegister reg) {
   int remaining_uses = cache_state_.get_use_count(reg);
   DCHECK_LT(0, remaining_uses);
@@ -829,7 +898,7 @@ void LiftoffAssembler::SpillRegister(LiftoffRegister reg) {
       cache_state_.dec_used(slot->reg().low());
       cache_state_.dec_used(slot->reg().high());
     }
-    Spill(idx, slot->reg(), slot->type());
+    Spill(slot->offset(), slot->reg(), slot->type());
     slot->MakeStack();
     if (--remaining_uses == 0) break;
   }
@@ -859,9 +928,6 @@ std::ostream& operator<<(std::ostream& os, VarState slot) {
   UNREACHABLE();
 }
 
-#undef __
-#undef TRACE
-
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/baseline/liftoff-assembler.h b/deps/v8/src/wasm/baseline/liftoff-assembler.h
index f0d49a878285d6..868b9390d19045 100644
--- a/deps/v8/src/wasm/baseline/liftoff-assembler.h
+++ b/deps/v8/src/wasm/baseline/liftoff-assembler.h
@@ -33,7 +33,7 @@ namespace wasm {
 class LiftoffAssembler : public TurboAssembler {
  public:
   // Each slot in our stack frame currently has exactly 8 bytes.
-  static constexpr uint32_t kStackSlotSize = 8;
+  static constexpr int kStackSlotSize = 8;
 
   static constexpr ValueType kWasmIntPtr =
       kSystemPointerSize == 8 ? kWasmI64 : kWasmI32;
@@ -42,13 +42,17 @@ class LiftoffAssembler : public TurboAssembler {
    public:
     enum Location : uint8_t { kStack, kRegister, kIntConst };
 
-    explicit VarState(ValueType type) : loc_(kStack), type_(type) {}
-    explicit VarState(ValueType type, LiftoffRegister r)
-        : loc_(kRegister), type_(type), reg_(r) {
+    explicit VarState(ValueType type, int offset)
+        : loc_(kStack), type_(type), spill_offset_(offset) {}
+    explicit VarState(ValueType type, LiftoffRegister r, int offset)
+        : loc_(kRegister), type_(type), reg_(r), spill_offset_(offset) {
       DCHECK_EQ(r.reg_class(), reg_class_for(type));
     }
-    explicit VarState(ValueType type, int32_t i32_const)
-        : loc_(kIntConst), type_(type), i32_const_(i32_const) {
+    explicit VarState(ValueType type, int32_t i32_const, int offset)
+        : loc_(kIntConst),
+          type_(type),
+          i32_const_(i32_const),
+          spill_offset_(offset) {
       DCHECK(type_ == kWasmI32 || type_ == kWasmI64);
     }
 
@@ -87,6 +91,8 @@ class LiftoffAssembler : public TurboAssembler {
                                : WasmValue(int64_t{i32_const_});
     }
 
+    int offset() const { return spill_offset_; }
+
     Register gp_reg() const { return reg().gp(); }
     DoubleRegister fp_reg() const { return reg().fp(); }
     LiftoffRegister reg() const {
@@ -97,6 +103,18 @@ class LiftoffAssembler : public TurboAssembler {
 
     void MakeStack() { loc_ = kStack; }
 
+    // Copy src to this, except for offset, since src and this could have been
+    // from different stack states.
+    void Copy(VarState src) {
+      loc_ = src.loc();
+      type_ = src.type();
+      if (loc_ == kRegister) {
+        reg_ = src.reg();
+      } else if (loc_ == kIntConst) {
+        i32_const_ = src.i32_const();
+      }
+    }
+
    private:
     Location loc_;
     // TODO(wasm): This is redundant, the decoder already knows the type of each
@@ -107,6 +125,7 @@ class LiftoffAssembler : public TurboAssembler {
       LiftoffRegister reg_;  // used if loc_ == kRegister
       int32_t i32_const_;    // used if loc_ == kIntConst
     };
+    int spill_offset_;
   };
 
   ASSERT_TRIVIALLY_COPYABLE(VarState);
@@ -127,6 +146,10 @@ class LiftoffAssembler : public TurboAssembler {
         LiftoffRegList available_regs =
             kGpCacheRegList.MaskOut(used_registers).MaskOut(pinned);
         return available_regs.GetNumRegsSet() >= 2;
+      } else if (kNeedS128RegPair && rc == kFpRegPair) {
+        LiftoffRegList available_regs =
+            kFpCacheRegList.MaskOut(used_registers).MaskOut(pinned);
+        return available_regs.HasAdjacentFpRegsSet();
       }
       DCHECK(rc == kGpReg || rc == kFpReg);
       LiftoffRegList candidates = GetCacheRegList(rc);
@@ -146,6 +169,13 @@ class LiftoffAssembler : public TurboAssembler {
         Register low = pinned.set(unused_register(kGpReg, pinned)).gp();
         Register high = unused_register(kGpReg, pinned).gp();
         return LiftoffRegister::ForPair(low, high);
+      } else if (kNeedS128RegPair && rc == kFpRegPair) {
+        LiftoffRegList available_regs =
+            kFpCacheRegList.MaskOut(used_registers).MaskOut(pinned);
+        DoubleRegister low =
+            available_regs.GetAdjacentFpRegsSet().GetFirstRegSet().fp();
+        DCHECK(is_free(LiftoffRegister::ForFpPair(low)));
+        return LiftoffRegister::ForFpPair(low);
       }
       DCHECK(rc == kGpReg || rc == kFpReg);
       LiftoffRegList candidates = GetCacheRegList(rc);
@@ -252,10 +282,34 @@ class LiftoffAssembler : public TurboAssembler {
 
   LiftoffRegister PopToRegister(LiftoffRegList pinned = {});
 
+  int NextSpillOffset(ValueType type) {
+    int offset = TopSpillOffset() + SlotSizeForType(type);
+    if (NeedsAlignment(type)) {
+      offset = RoundUp(offset, SlotSizeForType(type));
+    }
+    return offset;
+  }
+
+  int TopSpillOffset() const {
+    return cache_state_.stack_state.empty()
+               ? StaticStackFrameSize()
+               : cache_state_.stack_state.back().offset();
+  }
+
   void PushRegister(ValueType type, LiftoffRegister reg) {
     DCHECK_EQ(reg_class_for(type), reg.reg_class());
     cache_state_.inc_used(reg);
-    cache_state_.stack_state.emplace_back(type, reg);
+    cache_state_.stack_state.emplace_back(type, reg, NextSpillOffset(type));
+  }
+
+  void PushConstant(ValueType type, int32_t i32_const) {
+    DCHECK(type == kWasmI32 || type == kWasmI64);
+    cache_state_.stack_state.emplace_back(type, i32_const,
+                                          NextSpillOffset(type));
+  }
+
+  void PushStack(ValueType type) {
+    cache_state_.stack_state.emplace_back(type, NextSpillOffset(type));
   }
 
   void SpillRegister(LiftoffRegister);
@@ -283,6 +337,14 @@ class LiftoffAssembler : public TurboAssembler {
       Register low = pinned.set(GetUnusedRegister(candidates, pinned)).gp();
       Register high = GetUnusedRegister(candidates, pinned).gp();
       return LiftoffRegister::ForPair(low, high);
+    } else if (kNeedS128RegPair && rc == kFpRegPair) {
+      // kFpRegPair specific logic here because we need adjacent registers, not
+      // just any two registers (like kGpRegPair).
+      if (cache_state_.has_unused_register(rc, pinned)) {
+        return cache_state_.unused_register(rc, pinned);
+      }
+      DoubleRegister low_fp = SpillAdjacentFpRegisters(pinned).fp();
+      return LiftoffRegister::ForFpPair(low_fp);
     }
     DCHECK(rc == kGpReg || rc == kFpReg);
     LiftoffRegList candidates = GetCacheRegList(rc);
@@ -301,14 +363,14 @@ class LiftoffAssembler : public TurboAssembler {
   void MergeFullStackWith(const CacheState& target, const CacheState& source);
   void MergeStackWith(const CacheState& target, uint32_t arity);
 
-  void Spill(uint32_t index);
+  void Spill(VarState* slot);
   void SpillLocals();
   void SpillAllRegisters();
 
   // Call this method whenever spilling something, such that the number of used
   // spill slot can be tracked and the stack frame will be allocated big enough.
-  void RecordUsedSpillSlot(uint32_t index) {
-    if (index >= num_used_spill_slots_) num_used_spill_slots_ = index + 1;
+  void RecordUsedSpillOffset(int offset) {
+    if (offset >= max_used_spill_offset_) max_used_spill_offset_ = offset;
   }
 
   // Load parameters into the right registers / stack slots for the call.
@@ -352,9 +414,12 @@ class LiftoffAssembler : public TurboAssembler {
   // which can later be patched (via {PatchPrepareStackFrame)} when the size of
   // the frame is known.
   inline int PrepareStackFrame();
-  inline void PatchPrepareStackFrame(int offset, uint32_t stack_slots);
+  inline void PatchPrepareStackFrame(int offset, int frame_size);
   inline void FinishCode();
   inline void AbortCompilation();
+  inline static constexpr int StaticStackFrameSize();
+  inline static int SlotSizeForType(ValueType type);
+  inline static bool NeedsAlignment(ValueType type);
 
   inline void LoadConstant(LiftoffRegister, WasmValue,
                            RelocInfo::Mode rmode = RelocInfo::NONE);
@@ -373,20 +438,48 @@ class LiftoffAssembler : public TurboAssembler {
                     LiftoffRegister src, StoreType type, LiftoffRegList pinned,
                     uint32_t* protected_store_pc = nullptr,
                     bool is_store_mem = false);
+  inline void AtomicLoad(LiftoffRegister dst, Register src_addr,
+                         Register offset_reg, uint32_t offset_imm,
+                         LoadType type, LiftoffRegList pinned);
+  inline void AtomicStore(Register dst_addr, Register offset_reg,
+                          uint32_t offset_imm, LiftoffRegister src,
+                          StoreType type, LiftoffRegList pinned);
+
+  inline void AtomicAdd(Register dst_addr, Register offset_reg,
+                        uint32_t offset_imm, LiftoffRegister result,
+                        StoreType type);
+
+  inline void AtomicSub(Register dst_addr, Register offset_reg,
+                        uint32_t offset_imm, LiftoffRegister result,
+                        StoreType type);
+
+  inline void AtomicAnd(Register dst_addr, Register offset_reg,
+                        uint32_t offset_imm, LiftoffRegister result,
+                        StoreType type);
+
+  inline void AtomicOr(Register dst_addr, Register offset_reg,
+                       uint32_t offset_imm, LiftoffRegister result,
+                       StoreType type);
+
+  inline void AtomicXor(Register dst_addr, Register offset_reg,
+                        uint32_t offset_imm, LiftoffRegister result,
+                        StoreType type);
+
   inline void LoadCallerFrameSlot(LiftoffRegister, uint32_t caller_slot_idx,
                                   ValueType);
-  inline void MoveStackValue(uint32_t dst_index, uint32_t src_index, ValueType);
+  inline void MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
+                             ValueType);
 
   inline void Move(Register dst, Register src, ValueType);
   inline void Move(DoubleRegister dst, DoubleRegister src, ValueType);
 
-  inline void Spill(uint32_t index, LiftoffRegister, ValueType);
-  inline void Spill(uint32_t index, WasmValue);
-  inline void Fill(LiftoffRegister, uint32_t index, ValueType);
+  inline void Spill(int offset, LiftoffRegister, ValueType);
+  inline void Spill(int offset, WasmValue);
+  inline void Fill(LiftoffRegister, int offset, ValueType);
   // Only used on 32-bit systems: Fill a register from a "half stack slot", i.e.
   // 4 bytes on the stack holding half of a 64-bit value.
-  inline void FillI64Half(Register, uint32_t index, RegPairHalf);
-  inline void FillStackSlotsWithZero(uint32_t index, uint32_t count);
+  inline void FillI64Half(Register, int offset, RegPairHalf);
+  inline void FillStackSlotsWithZero(int start, int size);
 
   // i32 binops.
   inline void emit_i32_add(Register dst, Register lhs, Register rhs);
@@ -408,17 +501,16 @@ class LiftoffAssembler : public TurboAssembler {
   inline void emit_i32_or(Register dst, Register lhs, int32_t imm);
   inline void emit_i32_xor(Register dst, Register lhs, Register rhs);
   inline void emit_i32_xor(Register dst, Register lhs, int32_t imm);
-  inline void emit_i32_shl(Register dst, Register src, Register amount,
-                           LiftoffRegList pinned = {});
-  inline void emit_i32_sar(Register dst, Register src, Register amount,
-                           LiftoffRegList pinned = {});
-  inline void emit_i32_shr(Register dst, Register src, Register amount,
-                           LiftoffRegList pinned = {});
-  inline void emit_i32_shr(Register dst, Register src, int amount);
+  inline void emit_i32_shl(Register dst, Register src, Register amount);
+  inline void emit_i32_shl(Register dst, Register src, int32_t amount);
+  inline void emit_i32_sar(Register dst, Register src, Register amount);
+  inline void emit_i32_sar(Register dst, Register src, int32_t amount);
+  inline void emit_i32_shr(Register dst, Register src, Register amount);
+  inline void emit_i32_shr(Register dst, Register src, int32_t amount);
 
   // i32 unops.
-  inline bool emit_i32_clz(Register dst, Register src);
-  inline bool emit_i32_ctz(Register dst, Register src);
+  inline void emit_i32_clz(Register dst, Register src);
+  inline void emit_i32_ctz(Register dst, Register src);
   inline bool emit_i32_popcnt(Register dst, Register src);
 
   // i64 binops.
@@ -452,15 +544,24 @@ class LiftoffAssembler : public TurboAssembler {
   inline void emit_i64_xor(LiftoffRegister dst, LiftoffRegister lhs,
                            int32_t imm);
   inline void emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
-                           Register amount, LiftoffRegList pinned = {});
+                           Register amount);
+  inline void emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
+                           int32_t amount);
+  inline void emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
+                           Register amount);
   inline void emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
-                           Register amount, LiftoffRegList pinned = {});
+                           int32_t amount);
   inline void emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                           Register amount, LiftoffRegList pinned = {});
+                           Register amount);
   inline void emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                           int amount);
+                           int32_t amount);
 
-  inline void emit_i32_to_intptr(Register dst, Register src);
+  // i64 unops.
+  inline void emit_i64_clz(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_i64_ctz(LiftoffRegister dst, LiftoffRegister src);
+  inline bool emit_i64_popcnt(LiftoffRegister dst, LiftoffRegister src);
+
+  inline void emit_u32_to_intptr(Register dst, Register src);
 
   inline void emit_ptrsize_add(Register dst, Register lhs, Register rhs) {
     if (kSystemPointerSize == 8) {
@@ -578,6 +679,8 @@ class LiftoffAssembler : public TurboAssembler {
   inline void emit_f64_set_cond(Condition condition, Register dst,
                                 DoubleRegister lhs, DoubleRegister rhs);
 
+  inline void emit_f32x4_splat(LiftoffRegister dst, LiftoffRegister src);
+
   inline void StackCheck(Label* ool_code, Register limit_address);
 
   inline void CallTrapCallbackForTesting();
@@ -609,6 +712,7 @@ class LiftoffAssembler : public TurboAssembler {
   inline void AllocateStackSlot(Register addr, uint32_t size);
   inline void DeallocateStackSlot(uint32_t size);
 
+  inline void DebugBreak();
   ////////////////////////////////////
   // End of platform-specific part. //
   ////////////////////////////////////
@@ -616,10 +720,13 @@ class LiftoffAssembler : public TurboAssembler {
   uint32_t num_locals() const { return num_locals_; }
   void set_num_locals(uint32_t num_locals);
 
-  uint32_t GetTotalFrameSlotCount() const {
-    return num_locals_ + num_used_spill_slots_;
+  int GetTotalFrameSlotCount() const {
+    // TODO(zhin): Temporary for migration from index to offset.
+    return ((max_used_spill_offset_ + kStackSlotSize - 1) / kStackSlotSize);
   }
 
+  int GetTotalFrameSize() const { return max_used_spill_offset_; }
+
   ValueType local_type(uint32_t index) {
     DCHECK_GT(num_locals_, index);
     ValueType* locals =
@@ -658,12 +765,14 @@ class LiftoffAssembler : public TurboAssembler {
   static_assert(sizeof(ValueType) == 1,
                 "Reconsider this inlining if ValueType gets bigger");
   CacheState cache_state_;
-  uint32_t num_used_spill_slots_ = 0;
+  int max_used_spill_offset_ = StaticStackFrameSize();
   LiftoffBailoutReason bailout_reason_ = kSuccess;
   const char* bailout_detail_ = nullptr;
 
   LiftoffRegister SpillOneRegister(LiftoffRegList candidates,
                                    LiftoffRegList pinned);
+  // Spill one or two fp registers to get a pair of adjacent fp registers.
+  LiftoffRegister SpillAdjacentFpRegisters(LiftoffRegList pinned);
 };
 
 std::ostream& operator<<(std::ostream& os, LiftoffAssembler::VarState);
@@ -776,9 +885,9 @@ class LiftoffStackSlots {
  public:
   explicit LiftoffStackSlots(LiftoffAssembler* wasm_asm) : asm_(wasm_asm) {}
 
-  void Add(const LiftoffAssembler::VarState& src, uint32_t src_index,
+  void Add(const LiftoffAssembler::VarState& src, uint32_t src_offset,
            RegPairHalf half) {
-    slots_.emplace_back(src, src_index, half);
+    slots_.emplace_back(src, src_offset, half);
   }
   void Add(const LiftoffAssembler::VarState& src) { slots_.emplace_back(src); }
 
@@ -788,14 +897,14 @@ class LiftoffStackSlots {
   struct Slot {
     // Allow move construction.
     Slot(Slot&&) V8_NOEXCEPT = default;
-    Slot(const LiftoffAssembler::VarState& src, uint32_t src_index,
+    Slot(const LiftoffAssembler::VarState& src, uint32_t src_offset,
          RegPairHalf half)
-        : src_(src), src_index_(src_index), half_(half) {}
+        : src_(src), src_offset_(src_offset), half_(half) {}
     explicit Slot(const LiftoffAssembler::VarState& src)
         : src_(src), half_(kLowWord) {}
 
     const LiftoffAssembler::VarState src_;
-    uint32_t src_index_ = 0;
+    uint32_t src_offset_ = 0;
     RegPairHalf half_;
   };
 
diff --git a/deps/v8/src/wasm/baseline/liftoff-compiler.cc b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
index 997c8ff52b71d9..37d7c7ba677a2e 100644
--- a/deps/v8/src/wasm/baseline/liftoff-compiler.cc
+++ b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
@@ -22,6 +22,7 @@
 #include "src/wasm/function-compiler.h"
 #include "src/wasm/memory-tracing.h"
 #include "src/wasm/object-access.h"
+#include "src/wasm/wasm-debug.h"
 #include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-linkage.h"
 #include "src/wasm/wasm-objects.h"
@@ -115,10 +116,123 @@ compiler::CallDescriptor* GetLoweredCallDescriptor(
 }
 
 constexpr ValueType kSupportedTypesArr[] = {kWasmI32, kWasmI64, kWasmF32,
-                                            kWasmF64};
+                                            kWasmF64, kWasmS128};
 constexpr Vector<const ValueType> kSupportedTypes =
     ArrayVector(kSupportedTypesArr);
 
+constexpr Condition GetCompareCondition(WasmOpcode opcode) {
+  switch (opcode) {
+    case kExprI32Eq:
+      return kEqual;
+    case kExprI32Ne:
+      return kUnequal;
+    case kExprI32LtS:
+      return kSignedLessThan;
+    case kExprI32LtU:
+      return kUnsignedLessThan;
+    case kExprI32GtS:
+      return kSignedGreaterThan;
+    case kExprI32GtU:
+      return kUnsignedGreaterThan;
+    case kExprI32LeS:
+      return kSignedLessEqual;
+    case kExprI32LeU:
+      return kUnsignedLessEqual;
+    case kExprI32GeS:
+      return kSignedGreaterEqual;
+    case kExprI32GeU:
+      return kUnsignedGreaterEqual;
+    default:
+#if V8_HAS_CXX14_CONSTEXPR
+      UNREACHABLE();
+#else
+      // We need to return something for old compilers here.
+      return kEqual;
+#endif
+  }
+}
+
+// Builds a {DebugSideTable}.
+class DebugSideTableBuilder {
+ public:
+  class EntryBuilder {
+   public:
+    explicit EntryBuilder(
+        int pc_offset, std::vector<ValueType> stack_types,
+        std::vector<int> stack_offsets,
+        std::vector<DebugSideTable::Entry::Constant> constants)
+        : pc_offset_(pc_offset),
+          stack_types_(std::move(stack_types)),
+          stack_offsets_(std::move(stack_offsets)),
+          constants_(std::move(constants)) {}
+
+    DebugSideTable::Entry ToTableEntry() const {
+      return DebugSideTable::Entry{pc_offset_, std::move(stack_types_),
+                                   std::move(stack_offsets_),
+                                   std::move(constants_)};
+    }
+
+    int pc_offset() const { return pc_offset_; }
+    void set_pc_offset(int new_pc_offset) { pc_offset_ = new_pc_offset; }
+
+   private:
+    int pc_offset_;
+    std::vector<ValueType> stack_types_;
+    std::vector<int> stack_offsets_;
+    std::vector<DebugSideTable::Entry::Constant> constants_;
+  };
+
+  // Adds a new entry, and returns a pointer to a builder for modifying that
+  // entry ({stack_height} includes {num_locals}).
+  EntryBuilder* NewEntry(int pc_offset, int num_locals, int stack_height,
+                         LiftoffAssembler::VarState* stack_state) {
+    DCHECK_LE(num_locals, stack_height);
+    // Record stack types.
+    int stack_height_without_locals = stack_height - num_locals;
+    std::vector<ValueType> stack_types(stack_height_without_locals);
+    for (int i = 0; i < stack_height_without_locals; ++i) {
+      stack_types[i] = stack_state[num_locals + i].type();
+    }
+    // Record stack offsets.
+    std::vector<int> stack_offsets(stack_height_without_locals);
+    for (int i = 0; i < stack_height_without_locals; ++i) {
+      stack_offsets[i] = stack_state[num_locals + i].offset();
+    }
+    // Record all constants on the locals and stack.
+    std::vector<DebugSideTable::Entry::Constant> constants;
+    for (int idx = 0; idx < stack_height; ++idx) {
+      auto& slot = stack_state[idx];
+      if (slot.is_const()) constants.push_back({idx, slot.i32_const()});
+    }
+    entries_.emplace_back(pc_offset, std::move(stack_types),
+                          std::move(stack_offsets), std::move(constants));
+    return &entries_.back();
+  }
+
+  void AddLocalType(ValueType type, int stack_offset) {
+    local_types_.push_back(type);
+    local_stack_offsets_.push_back(stack_offset);
+  }
+
+  DebugSideTable GenerateDebugSideTable() {
+    std::vector<DebugSideTable::Entry> table_entries;
+    table_entries.reserve(entries_.size());
+    for (auto& entry : entries_) table_entries.push_back(entry.ToTableEntry());
+    std::sort(table_entries.begin(), table_entries.end(),
+              [](DebugSideTable::Entry& a, DebugSideTable::Entry& b) {
+                return a.pc_offset() < b.pc_offset();
+              });
+    return DebugSideTable{std::move(local_types_),
+                          std::move(local_stack_offsets_),
+                          std::move(table_entries)};
+  }
+
+ private:
+  std::vector<ValueType> local_types_;
+  std::vector<int> local_stack_offsets_;
+  std::list<EntryBuilder> entries_;
+};
+
 class LiftoffCompiler {
  public:
   // TODO(clemensb): Make this a template parameter.
@@ -152,27 +266,37 @@ class LiftoffCompiler {
     WasmCodePosition position;
     LiftoffRegList regs_to_save;
     uint32_t pc;  // for trap handler.
+    DebugSideTableBuilder::EntryBuilder* debug_sidetable_entry_builder;
 
     // Named constructors:
-    static OutOfLineCode Trap(WasmCode::RuntimeStubId s, WasmCodePosition pos,
-                              uint32_t pc) {
+    static OutOfLineCode Trap(
+        WasmCode::RuntimeStubId s, WasmCodePosition pos, uint32_t pc,
+        DebugSideTableBuilder::EntryBuilder* debug_sidetable_entry_builder) {
       DCHECK_LT(0, pos);
-      return {{}, {}, s, pos, {}, pc};
+      return {{}, {}, s, pos, {}, pc, debug_sidetable_entry_builder};
     }
-    static OutOfLineCode StackCheck(WasmCodePosition pos, LiftoffRegList regs) {
-      return {{}, {}, WasmCode::kWasmStackGuard, pos, regs, 0};
+    static OutOfLineCode StackCheck(
+        WasmCodePosition pos, LiftoffRegList regs,
+        DebugSideTableBuilder::EntryBuilder* debug_sidetable_entry_builder) {
+      return {{},   {}, WasmCode::kWasmStackGuard,    pos,
+              regs, 0,  debug_sidetable_entry_builder};
     }
   };
 
   LiftoffCompiler(compiler::CallDescriptor* call_descriptor,
                   CompilationEnv* env, Zone* compilation_zone,
-                  std::unique_ptr<AssemblerBuffer> buffer)
+                  std::unique_ptr<AssemblerBuffer> buffer,
+                  DebugSideTableBuilder* debug_sidetable_builder,
+                  Vector<int> breakpoints = {})
       : asm_(std::move(buffer)),
         descriptor_(
             GetLoweredCallDescriptor(compilation_zone, call_descriptor)),
         env_(env),
+        debug_sidetable_builder_(debug_sidetable_builder),
         compilation_zone_(compilation_zone),
-        safepoint_table_builder_(compilation_zone_) {}
+        safepoint_table_builder_(compilation_zone_),
+        next_breakpoint_ptr_(breakpoints.begin()),
+        next_breakpoint_end_(breakpoints.end()) {}
 
   bool did_bailout() const { return bailout_reason_ != kSuccess; }
   LiftoffBailoutReason bailout_reason() const { return bailout_reason_; }
@@ -267,17 +391,22 @@ class LiftoffCompiler {
   }
 
   void StartFunction(FullDecoder* decoder) {
+    if (FLAG_trace_liftoff && !FLAG_trace_wasm_decoder) {
+      StdoutStream{} << "hint: add --trace-wasm-decoder to also see the wasm "
+                        "instructions being decoded\n";
+    }
     int num_locals = decoder->num_locals();
     __ set_num_locals(num_locals);
     for (int i = 0; i < num_locals; ++i) {
-      __ set_local_type(i, decoder->GetLocalType(i));
+      ValueType type = decoder->GetLocalType(i);
+      __ set_local_type(i, type);
     }
   }
 
   // Returns the number of inputs processed (1 or 2).
   uint32_t ProcessParameter(ValueType type, uint32_t input_idx) {
-    const int num_lowered_params = 1 + needs_reg_pair(type);
-    ValueType lowered_type = needs_reg_pair(type) ? kWasmI32 : type;
+    const int num_lowered_params = 1 + needs_gp_reg_pair(type);
+    ValueType lowered_type = needs_gp_reg_pair(type) ? kWasmI32 : type;
     RegClass rc = reg_class_for(lowered_type);
     // Initialize to anything, will be set in the loop and used afterwards.
     LiftoffRegister reg = kGpCacheRegList.GetFirstRegSet();
@@ -290,21 +419,28 @@ class LiftoffCompiler {
       if (param_loc.IsRegister()) {
         DCHECK(!param_loc.IsAnyRegister());
         int reg_code = param_loc.AsRegister();
-#if V8_TARGET_ARCH_ARM
-        // Liftoff assumes a one-to-one mapping between float registers and
-        // double registers, and so does not distinguish between f32 and f64
-        // registers. The f32 register code must therefore be halved in order to
-        // pass the f64 code to Liftoff.
-        DCHECK_IMPLIES(type == kWasmF32, (reg_code % 2) == 0);
-        if (type == kWasmF32) {
+        if (!kSimpleFPAliasing && type == kWasmF32) {
+          // Liftoff assumes a one-to-one mapping between float registers and
+          // double registers, and so does not distinguish between f32 and f64
+          // registers. The f32 register code must therefore be halved in order
+          // to pass the f64 code to Liftoff.
+          DCHECK_EQ(0, reg_code % 2);
           reg_code /= 2;
+        } else if (kNeedS128RegPair && type == kWasmS128) {
+          // Similarly for double registers and SIMD registers, the SIMD code
+          // needs to be doubled to pass the f64 code to Liftoff.
+          reg_code *= 2;
         }
-#endif
         RegList cache_regs = rc == kGpReg ? kLiftoffAssemblerGpCacheRegs
                                           : kLiftoffAssemblerFpCacheRegs;
         if (cache_regs & (1ULL << reg_code)) {
           // This is a cache register, just use it.
-          in_reg = LiftoffRegister::from_code(rc, reg_code);
+          if (kNeedS128RegPair && rc == kFpRegPair) {
+            in_reg =
+                LiftoffRegister::ForFpPair(DoubleRegister::from_code(reg_code));
+          } else {
+            in_reg = LiftoffRegister::from_code(rc, reg_code);
+          }
         } else {
           // Move to a cache register (spill one if necessary).
           // Note that we cannot create a {LiftoffRegister} for reg_code, since
@@ -312,7 +448,11 @@ class LiftoffCompiler {
           in_reg = __ GetUnusedRegister(rc, pinned);
           if (rc == kGpReg) {
             __ Move(in_reg.gp(), Register::from_code(reg_code), lowered_type);
+          } else if (kNeedS128RegPair && rc == kFpRegPair) {
+            __ Move(in_reg.low_fp(), DoubleRegister::from_code(reg_code),
+                    lowered_type);
           } else {
+            DCHECK_EQ(kFpReg, rc);
             __ Move(in_reg.fp(), DoubleRegister::from_code(reg_code),
                     lowered_type);
           }
@@ -331,9 +471,10 @@ class LiftoffCompiler {
   }
 
   void StackCheck(WasmCodePosition position) {
-    if (FLAG_wasm_no_stack_checks || !env_->runtime_exception_support) return;
+    if (!FLAG_wasm_stack_checks || !env_->runtime_exception_support) return;
     out_of_line_code_.push_back(
-        OutOfLineCode::StackCheck(position, __ cache_state()->used_registers));
+        OutOfLineCode::StackCheck(position, __ cache_state()->used_registers,
+                                  RegisterDebugSideTableEntry()));
     OutOfLineCode& ool = out_of_line_code_.back();
     Register limit_address = __ GetUnusedRegister(kGpReg).gp();
     LOAD_INSTANCE_FIELD(limit_address, StackLimitAddress, kSystemPointerSize);
@@ -398,29 +539,38 @@ class LiftoffCompiler {
     for (uint32_t param_idx = 0; param_idx < num_params; ++param_idx) {
       input_idx += ProcessParameter(__ local_type(param_idx), input_idx);
     }
+    int params_size = __ TopSpillOffset();
     DCHECK_EQ(input_idx, descriptor_->InputCount());
 
     // Initialize locals beyond parameters.
     if (SpillLocalsInitially(decoder, num_params)) {
-      __ FillStackSlotsWithZero(num_params, __ num_locals() - num_params);
       for (uint32_t param_idx = num_params; param_idx < __ num_locals();
            ++param_idx) {
         ValueType type = decoder->GetLocalType(param_idx);
-        __ cache_state()->stack_state.emplace_back(type);
+        __ PushStack(type);
       }
+      int spill_size = __ TopSpillOffset() - params_size;
+      __ FillStackSlotsWithZero(params_size, spill_size);
     } else {
       for (uint32_t param_idx = num_params; param_idx < __ num_locals();
            ++param_idx) {
         ValueType type = decoder->GetLocalType(param_idx);
-        __ cache_state()->stack_state.emplace_back(type, int32_t{0});
+        __ PushConstant(type, int32_t{0});
       }
     }
 
+    DCHECK_EQ(__ num_locals(), __ cache_state()->stack_height());
+
+    // Register local types and stack offsets for the debug side table.
+    if (V8_UNLIKELY(debug_sidetable_builder_)) {
+      for (uint32_t i = 0; i < __ num_locals(); ++i) {
+        debug_sidetable_builder_->AddLocalType(
+            __ local_type(i), __ cache_state()->stack_state[i].offset());
+      }
+    }
     // The function-prologue stack check is associated with position 0, which
     // is never a position of any instruction in the function.
     StackCheck(0);
-
-    DCHECK_EQ(__ num_locals(), __ cache_state()->stack_height());
   }
 
   void GenerateOutOfLineCode(OutOfLineCode* ool) {
@@ -453,6 +603,10 @@ class LiftoffCompiler {
     source_position_table_builder_.AddPosition(
         __ pc_offset(), SourcePosition(ool->position), false);
     __ CallRuntimeStub(ool->stub);
+    DCHECK_EQ(!debug_sidetable_builder_, !ool->debug_sidetable_entry_builder);
+    if (V8_UNLIKELY(ool->debug_sidetable_entry_builder)) {
+      ool->debug_sidetable_entry_builder->set_pc_offset(__ pc_offset());
+    }
     safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kNoLazyDeopt);
     DCHECK_EQ(ool->continuation.get()->is_bound(), is_stack_check);
     if (!ool->regs_to_save.is_empty()) __ PopRegisters(ool->regs_to_save);
@@ -464,12 +618,14 @@ class LiftoffCompiler {
   }
 
   void FinishFunction(FullDecoder* decoder) {
+    // All breakpoints (if any) must be emitted by now.
+    DCHECK_NULL(next_breakpoint_ptr_);
     if (DidAssemblerBailout(decoder)) return;
     for (OutOfLineCode& ool : out_of_line_code_) {
       GenerateOutOfLineCode(&ool);
     }
     __ PatchPrepareStackFrame(pc_offset_stack_frame_construction_,
-                              __ GetTotalFrameSlotCount());
+                              __ GetTotalFrameSize());
     __ FinishCode();
     safepoint_table_builder_.Emit(&asm_, __ GetTotalFrameSlotCount());
     __ MaybeEmitOutOfLineConstantPool();
@@ -484,14 +640,31 @@ class LiftoffCompiler {
   }
 
   void NextInstruction(FullDecoder* decoder, WasmOpcode opcode) {
+    if (V8_UNLIKELY(next_breakpoint_ptr_) &&
+        *next_breakpoint_ptr_ == decoder->position()) {
+      ++next_breakpoint_ptr_;
+      if (next_breakpoint_ptr_ == next_breakpoint_end_) {
+        next_breakpoint_ptr_ = next_breakpoint_end_ = nullptr;
+      }
+      EmitBreakpoint();
+    }
     TraceCacheState(decoder);
     SLOW_DCHECK(__ ValidateCacheState());
     DEBUG_CODE_COMMENT(WasmOpcodes::OpcodeName(opcode));
   }
 
+  void EmitBreakpoint() {
+    DEBUG_CODE_COMMENT("breakpoint");
+    // TODO(clemensb): Actually emit a breakpoint.
+  }
+
   void Block(FullDecoder* decoder, Control* block) {}
 
   void Loop(FullDecoder* decoder, Control* loop) {
+    if (loop->start_merge.arity > 0 || loop->end_merge.arity > 1) {
+      return unsupported(decoder, kMultiValue, "multi-value loop");
+    }
+
     // Before entering a loop, spill all locals to the stack, in order to free
     // the cache registers, and to avoid unnecessarily reloading stack values
     // into registers at branches.
@@ -634,19 +807,6 @@ class LiftoffCompiler {
     __ PushRegister(result_type, dst);
   }
 
-  void EmitI32UnOpWithCFallback(bool (LiftoffAssembler::*emit_fn)(Register,
-                                                                  Register),
-                                ExternalReference (*fallback_fn)()) {
-    auto emit_with_c_fallback = [=](LiftoffRegister dst, LiftoffRegister src) {
-      if (emit_fn && (asm_.*emit_fn)(dst.gp(), src.gp())) return;
-      ExternalReference ext_ref = fallback_fn();
-      ValueType sig_i_i_reps[] = {kWasmI32, kWasmI32};
-      FunctionSig sig_i_i(1, 1, sig_i_i_reps);
-      GenerateCCall(&dst, &sig_i_i, kWasmStmt, &src, ext_ref);
-    };
-    EmitUnOp<kWasmI32, kWasmI32>(emit_with_c_fallback);
-  }
-
   template <ValueType type>
   void EmitFloatUnOpWithCFallback(
       bool (LiftoffAssembler::*emit_fn)(DoubleRegister, DoubleRegister),
@@ -706,14 +866,7 @@ class LiftoffCompiler {
           __ emit_##fn(dst.gp(), src.gp());             \
         });                                             \
     break;
-#define CASE_I32_SIGN_EXTENSION(opcode, fn)             \
-  case kExpr##opcode:                                   \
-    EmitUnOp<kWasmI32, kWasmI32>(                       \
-        [=](LiftoffRegister dst, LiftoffRegister src) { \
-          __ emit_##fn(dst.gp(), src.gp());             \
-        });                                             \
-    break;
-#define CASE_I64_SIGN_EXTENSION(opcode, fn)             \
+#define CASE_I64_UNOP(opcode, fn)                       \
   case kExpr##opcode:                                   \
     EmitUnOp<kWasmI64, kWasmI64>(                       \
         [=](LiftoffRegister dst, LiftoffRegister src) { \
@@ -787,11 +940,13 @@ class LiftoffCompiler {
                            &ExternalReference::wasm_uint64_to_float64, kNoTrap)
       CASE_TYPE_CONVERSION(F64ConvertF32, F64, F32, nullptr, kNoTrap)
       CASE_TYPE_CONVERSION(F64ReinterpretI64, F64, I64, nullptr, kNoTrap)
-      CASE_I32_SIGN_EXTENSION(I32SExtendI8, i32_signextend_i8)
-      CASE_I32_SIGN_EXTENSION(I32SExtendI16, i32_signextend_i16)
-      CASE_I64_SIGN_EXTENSION(I64SExtendI8, i64_signextend_i8)
-      CASE_I64_SIGN_EXTENSION(I64SExtendI16, i64_signextend_i16)
-      CASE_I64_SIGN_EXTENSION(I64SExtendI32, i64_signextend_i32)
+      CASE_I32_UNOP(I32SExtendI8, i32_signextend_i8)
+      CASE_I32_UNOP(I32SExtendI16, i32_signextend_i16)
+      CASE_I64_UNOP(I64SExtendI8, i64_signextend_i8)
+      CASE_I64_UNOP(I64SExtendI16, i64_signextend_i16)
+      CASE_I64_UNOP(I64SExtendI32, i64_signextend_i32)
+      CASE_I64_UNOP(I64Clz, i64_clz)
+      CASE_I64_UNOP(I64Ctz, i64_ctz)
       case kExprI32Eqz:
         DCHECK(decoder->lookahead(0, kExprI32Eqz));
         if (decoder->lookahead(1, kExprBrIf)) {
@@ -804,21 +959,37 @@ class LiftoffCompiler {
               __ emit_i32_eqz(dst.gp(), src.gp());
             });
         break;
-      case kExprI32Popcnt:
-        EmitI32UnOpWithCFallback(&LiftoffAssembler::emit_i32_popcnt,
-                                 &ExternalReference::wasm_word32_popcnt);
-        break;
       case kExprI64Eqz:
         EmitUnOp<kWasmI64, kWasmI32>(
             [=](LiftoffRegister dst, LiftoffRegister src) {
               __ emit_i64_eqz(dst.gp(), src);
             });
         break;
-      case kExprI64Clz:
-      case kExprI64Ctz:
+      case kExprI32Popcnt:
+        EmitUnOp<kWasmI32, kWasmI32>(
+            [=](LiftoffRegister dst, LiftoffRegister src) {
+              if (__ emit_i32_popcnt(dst.gp(), src.gp())) return;
+              ValueType sig_i_i_reps[] = {kWasmI32, kWasmI32};
+              FunctionSig sig_i_i(1, 1, sig_i_i_reps);
+              GenerateCCall(&dst, &sig_i_i, kWasmStmt, &src,
+                            ExternalReference::wasm_word32_popcnt());
+            });
+        break;
       case kExprI64Popcnt:
-        return unsupported(decoder, kComplexOperation,
-                           WasmOpcodes::OpcodeName(opcode));
+        EmitUnOp<kWasmI64, kWasmI64>(
+            [=](LiftoffRegister dst, LiftoffRegister src) {
+              if (__ emit_i64_popcnt(dst, src)) return;
+              // The c function returns i32. We will zero-extend later.
+              ValueType sig_i_l_reps[] = {kWasmI32, kWasmI64};
+              FunctionSig sig_i_l(1, 1, sig_i_l_reps);
+              LiftoffRegister c_call_dst = kNeedI64RegPair ? dst.low() : dst;
+              GenerateCCall(&c_call_dst, &sig_i_l, kWasmStmt, &src,
+                            ExternalReference::wasm_word64_popcnt());
+              // Now zero-extend the result to i64.
+              __ emit_type_conversion(kExprI64UConvertI32, dst, c_call_dst,
+                                      nullptr);
+            });
+        break;
       case kExprI32SConvertSatF32:
       case kExprI32UConvertSatF32:
       case kExprI32SConvertSatF64:
@@ -833,8 +1004,7 @@ class LiftoffCompiler {
         UNREACHABLE();
     }
 #undef CASE_I32_UNOP
-#undef CASE_I32_SIGN_EXTENSION
-#undef CASE_I64_SIGN_EXTENSION
+#undef CASE_I64_UNOP
 #undef CASE_FLOAT_UNOP
 #undef CASE_FLOAT_UNOP_WITH_CFALLBACK
 #undef CASE_TYPE_CONVERSION
@@ -848,7 +1018,7 @@ class LiftoffCompiler {
 
     LiftoffAssembler::VarState rhs_slot = __ cache_state()->stack_state.back();
     // Check if the RHS is an immediate.
-    if (rhs_slot.loc() == LiftoffAssembler::VarState::kIntConst) {
+    if (rhs_slot.is_const()) {
       __ cache_state()->stack_state.pop_back();
       int32_t imm = rhs_slot.i32_const();
 
@@ -911,13 +1081,13 @@ class LiftoffCompiler {
   void BinOp(FullDecoder* decoder, WasmOpcode opcode, const Value& lhs,
              const Value& rhs, Value* result) {
 #define CASE_I32_BINOP(opcode, fn)                                           \
-  case WasmOpcode::kExpr##opcode:                                            \
+  case kExpr##opcode:                                                        \
     return EmitBinOp<kWasmI32, kWasmI32>(                                    \
         [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
           __ emit_##fn(dst.gp(), lhs.gp(), rhs.gp());                        \
         });
 #define CASE_I32_BINOPI(opcode, fn)                                          \
-  case WasmOpcode::kExpr##opcode:                                            \
+  case kExpr##opcode:                                                        \
     return EmitBinOpImm<kWasmI32, kWasmI32>(                                 \
         [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
           __ emit_##fn(dst.gp(), lhs.gp(), rhs.gp());                        \
@@ -926,13 +1096,13 @@ class LiftoffCompiler {
           __ emit_##fn(dst.gp(), lhs.gp(), imm);                             \
         });
 #define CASE_I64_BINOP(opcode, fn)                                           \
-  case WasmOpcode::kExpr##opcode:                                            \
+  case kExpr##opcode:                                                        \
     return EmitBinOp<kWasmI64, kWasmI64>(                                    \
         [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
           __ emit_##fn(dst, lhs, rhs);                                       \
         });
 #define CASE_I64_BINOPI(opcode, fn)                                          \
-  case WasmOpcode::kExpr##opcode:                                            \
+  case kExpr##opcode:                                                        \
     return EmitBinOpImm<kWasmI64, kWasmI64>(                                 \
         [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
           __ emit_##fn(dst, lhs, rhs);                                       \
@@ -941,58 +1111,64 @@ class LiftoffCompiler {
           __ emit_##fn(dst, lhs, imm);                                       \
         });
 #define CASE_FLOAT_BINOP(opcode, type, fn)                                   \
-  case WasmOpcode::kExpr##opcode:                                            \
+  case kExpr##opcode:                                                        \
     return EmitBinOp<kWasm##type, kWasm##type>(                              \
         [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
           __ emit_##fn(dst.fp(), lhs.fp(), rhs.fp());                        \
         });
-#define CASE_I32_CMPOP(opcode, cond)                                         \
-  case WasmOpcode::kExpr##opcode:                                            \
+#define CASE_I32_CMPOP(opcode)                                               \
+  case kExpr##opcode:                                                        \
+    DCHECK(decoder->lookahead(0, kExpr##opcode));                            \
+    if (decoder->lookahead(1, kExprBrIf)) {                                  \
+      DCHECK(!has_outstanding_op());                                         \
+      outstanding_op_ = kExpr##opcode;                                       \
+      break;                                                                 \
+    }                                                                        \
     return EmitBinOp<kWasmI32, kWasmI32>(                                    \
         [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
+          constexpr Condition cond = GetCompareCondition(kExpr##opcode);     \
           __ emit_i32_set_cond(cond, dst.gp(), lhs.gp(), rhs.gp());          \
         });
 #define CASE_I64_CMPOP(opcode, cond)                                         \
-  case WasmOpcode::kExpr##opcode:                                            \
+  case kExpr##opcode:                                                        \
     return EmitBinOp<kWasmI64, kWasmI32>(                                    \
         [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
           __ emit_i64_set_cond(cond, dst.gp(), lhs, rhs);                    \
         });
 #define CASE_F32_CMPOP(opcode, cond)                                         \
-  case WasmOpcode::kExpr##opcode:                                            \
+  case kExpr##opcode:                                                        \
     return EmitBinOp<kWasmF32, kWasmI32>(                                    \
         [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
           __ emit_f32_set_cond(cond, dst.gp(), lhs.fp(), rhs.fp());          \
         });
 #define CASE_F64_CMPOP(opcode, cond)                                         \
-  case WasmOpcode::kExpr##opcode:                                            \
+  case kExpr##opcode:                                                        \
     return EmitBinOp<kWasmF64, kWasmI32>(                                    \
         [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
           __ emit_f64_set_cond(cond, dst.gp(), lhs.fp(), rhs.fp());          \
         });
-#define CASE_I32_SHIFTOP(opcode, fn)                                         \
-  case WasmOpcode::kExpr##opcode:                                            \
-    return EmitBinOp<kWasmI32, kWasmI32>(                                    \
-        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
-          __ emit_##fn(dst.gp(), lhs.gp(), rhs.gp(), {});                    \
+#define CASE_I64_SHIFTOP(opcode, fn)                                         \
+  case kExpr##opcode:                                                        \
+    return EmitBinOpImm<kWasmI64, kWasmI64>(                                 \
+        [=](LiftoffRegister dst, LiftoffRegister src,                        \
+            LiftoffRegister amount) {                                        \
+          __ emit_##fn(dst, src,                                             \
+                       amount.is_gp_pair() ? amount.low_gp() : amount.gp()); \
+        },                                                                   \
+        [=](LiftoffRegister dst, LiftoffRegister src, int32_t amount) {      \
+          __ emit_##fn(dst, src, amount);                                    \
         });
-#define CASE_I64_SHIFTOP(opcode, fn)                                           \
-  case WasmOpcode::kExpr##opcode:                                              \
-    return EmitBinOp<kWasmI64, kWasmI64>([=](LiftoffRegister dst,              \
-                                             LiftoffRegister src,              \
-                                             LiftoffRegister amount) {         \
-      __ emit_##fn(dst, src, amount.is_pair() ? amount.low_gp() : amount.gp(), \
-                   {});                                                        \
-    });
 #define CASE_CCALL_BINOP(opcode, type, ext_ref_fn)                           \
-  case WasmOpcode::kExpr##opcode:                                            \
-    return EmitBinOp<kWasmI32, kWasmI32>(                                    \
+  case kExpr##opcode:                                                        \
+    return EmitBinOp<kWasm##type, kWasm##type>(                              \
         [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
           LiftoffRegister args[] = {lhs, rhs};                               \
           auto ext_ref = ExternalReference::ext_ref_fn();                    \
-          ValueType sig_i_ii_reps[] = {kWasmI32, kWasmI32, kWasmI32};        \
-          FunctionSig sig_i_ii(1, 2, sig_i_ii_reps);                         \
-          GenerateCCall(&dst, &sig_i_ii, kWasmStmt, args, ext_ref);          \
+          ValueType sig_reps[] = {kWasm##type, kWasm##type, kWasm##type};    \
+          const bool out_via_stack = kWasm##type == kWasmI64;                \
+          FunctionSig sig(out_via_stack ? 0 : 1, 2, sig_reps);               \
+          ValueType out_arg_type = out_via_stack ? kWasmI64 : kWasmStmt;     \
+          GenerateCCall(&dst, &sig, out_arg_type, args, ext_ref);            \
         });
     switch (opcode) {
       CASE_I32_BINOPI(I32Add, i32_add)
@@ -1004,16 +1180,16 @@ class LiftoffCompiler {
       CASE_I64_BINOPI(I64And, i64_and)
       CASE_I64_BINOPI(I64Ior, i64_or)
       CASE_I64_BINOPI(I64Xor, i64_xor)
-      CASE_I32_CMPOP(I32Eq, kEqual)
-      CASE_I32_CMPOP(I32Ne, kUnequal)
-      CASE_I32_CMPOP(I32LtS, kSignedLessThan)
-      CASE_I32_CMPOP(I32LtU, kUnsignedLessThan)
-      CASE_I32_CMPOP(I32GtS, kSignedGreaterThan)
-      CASE_I32_CMPOP(I32GtU, kUnsignedGreaterThan)
-      CASE_I32_CMPOP(I32LeS, kSignedLessEqual)
-      CASE_I32_CMPOP(I32LeU, kUnsignedLessEqual)
-      CASE_I32_CMPOP(I32GeS, kSignedGreaterEqual)
-      CASE_I32_CMPOP(I32GeU, kUnsignedGreaterEqual)
+      CASE_I32_CMPOP(I32Eq)
+      CASE_I32_CMPOP(I32Ne)
+      CASE_I32_CMPOP(I32LtS)
+      CASE_I32_CMPOP(I32LtU)
+      CASE_I32_CMPOP(I32GtS)
+      CASE_I32_CMPOP(I32GtU)
+      CASE_I32_CMPOP(I32LeS)
+      CASE_I32_CMPOP(I32LeU)
+      CASE_I32_CMPOP(I32GeS)
+      CASE_I32_CMPOP(I32GeU)
       CASE_I64_BINOPI(I64Add, i64_add)
       CASE_I64_BINOP(I64Sub, i64_sub)
       CASE_I64_BINOP(I64Mul, i64_mul)
@@ -1039,14 +1215,16 @@ class LiftoffCompiler {
       CASE_F64_CMPOP(F64Gt, kUnsignedGreaterThan)
       CASE_F64_CMPOP(F64Le, kUnsignedLessEqual)
       CASE_F64_CMPOP(F64Ge, kUnsignedGreaterEqual)
-      CASE_I32_SHIFTOP(I32Shl, i32_shl)
-      CASE_I32_SHIFTOP(I32ShrS, i32_sar)
-      CASE_I32_SHIFTOP(I32ShrU, i32_shr)
+      CASE_I32_BINOPI(I32Shl, i32_shl)
+      CASE_I32_BINOPI(I32ShrS, i32_sar)
+      CASE_I32_BINOPI(I32ShrU, i32_shr)
+      CASE_CCALL_BINOP(I32Rol, I32, wasm_word32_rol)
+      CASE_CCALL_BINOP(I32Ror, I32, wasm_word32_ror)
       CASE_I64_SHIFTOP(I64Shl, i64_shl)
       CASE_I64_SHIFTOP(I64ShrS, i64_sar)
       CASE_I64_SHIFTOP(I64ShrU, i64_shr)
-      CASE_CCALL_BINOP(I32Rol, I32, wasm_word32_rol)
-      CASE_CCALL_BINOP(I32Ror, I32, wasm_word32_ror)
+      CASE_CCALL_BINOP(I64Rol, I64, wasm_word64_rol)
+      CASE_CCALL_BINOP(I64Ror, I64, wasm_word64_ror)
       CASE_FLOAT_BINOP(F32Add, F32, f32_add)
       CASE_FLOAT_BINOP(F32Sub, F32, f32_sub)
       CASE_FLOAT_BINOP(F32Mul, F32, f32_mul)
@@ -1061,7 +1239,7 @@ class LiftoffCompiler {
       CASE_FLOAT_BINOP(F64Min, F64, f64_min)
       CASE_FLOAT_BINOP(F64Max, F64, f64_max)
       CASE_FLOAT_BINOP(F64CopySign, F64, f64_copysign)
-      case WasmOpcode::kExprI32DivS:
+      case kExprI32DivS:
         EmitBinOp<kWasmI32, kWasmI32>([this, decoder](LiftoffRegister dst,
                                                       LiftoffRegister lhs,
                                                       LiftoffRegister rhs) {
@@ -1077,7 +1255,7 @@ class LiftoffCompiler {
                            div_unrepresentable);
         });
         break;
-      case WasmOpcode::kExprI32DivU:
+      case kExprI32DivU:
         EmitBinOp<kWasmI32, kWasmI32>([this, decoder](LiftoffRegister dst,
                                                       LiftoffRegister lhs,
                                                       LiftoffRegister rhs) {
@@ -1086,7 +1264,7 @@ class LiftoffCompiler {
           __ emit_i32_divu(dst.gp(), lhs.gp(), rhs.gp(), div_by_zero);
         });
         break;
-      case WasmOpcode::kExprI32RemS:
+      case kExprI32RemS:
         EmitBinOp<kWasmI32, kWasmI32>([this, decoder](LiftoffRegister dst,
                                                       LiftoffRegister lhs,
                                                       LiftoffRegister rhs) {
@@ -1095,7 +1273,7 @@ class LiftoffCompiler {
           __ emit_i32_rems(dst.gp(), lhs.gp(), rhs.gp(), rem_by_zero);
         });
         break;
-      case WasmOpcode::kExprI32RemU:
+      case kExprI32RemU:
         EmitBinOp<kWasmI32, kWasmI32>([this, decoder](LiftoffRegister dst,
                                                       LiftoffRegister lhs,
                                                       LiftoffRegister rhs) {
@@ -1104,7 +1282,7 @@ class LiftoffCompiler {
           __ emit_i32_remu(dst.gp(), lhs.gp(), rhs.gp(), rem_by_zero);
         });
         break;
-      case WasmOpcode::kExprI64DivS:
+      case kExprI64DivS:
         EmitBinOp<kWasmI64, kWasmI64>([this, decoder](LiftoffRegister dst,
                                                       LiftoffRegister lhs,
                                                       LiftoffRegister rhs) {
@@ -1124,7 +1302,7 @@ class LiftoffCompiler {
           }
         });
         break;
-      case WasmOpcode::kExprI64DivU:
+      case kExprI64DivU:
         EmitBinOp<kWasmI64, kWasmI64>([this, decoder](LiftoffRegister dst,
                                                       LiftoffRegister lhs,
                                                       LiftoffRegister rhs) {
@@ -1136,7 +1314,7 @@ class LiftoffCompiler {
           }
         });
         break;
-      case WasmOpcode::kExprI64RemS:
+      case kExprI64RemS:
         EmitBinOp<kWasmI64, kWasmI64>([this, decoder](LiftoffRegister dst,
                                                       LiftoffRegister lhs,
                                                       LiftoffRegister rhs) {
@@ -1148,7 +1326,7 @@ class LiftoffCompiler {
           }
         });
         break;
-      case WasmOpcode::kExprI64RemU:
+      case kExprI64RemU:
         EmitBinOp<kWasmI64, kWasmI64>([this, decoder](LiftoffRegister dst,
                                                       LiftoffRegister lhs,
                                                       LiftoffRegister rhs) {
@@ -1160,10 +1338,6 @@ class LiftoffCompiler {
           }
         });
         break;
-      case WasmOpcode::kExprI64Rol:
-      case WasmOpcode::kExprI64Ror:
-        return unsupported(decoder, kComplexOperation,
-                           WasmOpcodes::OpcodeName(opcode));
       default:
         UNREACHABLE();
     }
@@ -1176,13 +1350,12 @@ class LiftoffCompiler {
 #undef CASE_I64_CMPOP
 #undef CASE_F32_CMPOP
 #undef CASE_F64_CMPOP
-#undef CASE_I32_SHIFTOP
 #undef CASE_I64_SHIFTOP
 #undef CASE_CCALL_BINOP
   }
 
   void I32Const(FullDecoder* decoder, Value* result, int32_t value) {
-    __ cache_state()->stack_state.emplace_back(kWasmI32, value);
+    __ PushConstant(kWasmI32, value);
   }
 
   void I64Const(FullDecoder* decoder, Value* result, int64_t value) {
@@ -1192,7 +1365,7 @@ class LiftoffCompiler {
     // a register immediately.
     int32_t value_i32 = static_cast<int32_t>(value);
     if (value_i32 == value) {
-      __ cache_state()->stack_state.emplace_back(kWasmI64, value_i32);
+      __ PushConstant(kWasmI64, value_i32);
     } else {
       LiftoffRegister reg = __ GetUnusedRegister(reg_class_for(kWasmI64));
       __ LoadConstant(reg, WasmValue(value));
@@ -1251,12 +1424,12 @@ class LiftoffCompiler {
         __ PushRegister(slot.type(), slot.reg());
         break;
       case kIntConst:
-        __ cache_state()->stack_state.emplace_back(imm.type, slot.i32_const());
+        __ PushConstant(imm.type, slot.i32_const());
         break;
       case kStack: {
         auto rc = reg_class_for(imm.type);
         LiftoffRegister reg = __ GetUnusedRegister(rc);
-        __ Fill(reg, imm.index, imm.type);
+        __ Fill(reg, slot.offset(), imm.type);
         __ PushRegister(slot.type(), reg);
         break;
       }
@@ -1266,11 +1439,12 @@ class LiftoffCompiler {
   void LocalSetFromStackSlot(LiftoffAssembler::VarState* dst_slot,
                              uint32_t local_index) {
     auto& state = *__ cache_state();
+    auto& src_slot = state.stack_state.back();
     ValueType type = dst_slot->type();
     if (dst_slot->is_reg()) {
       LiftoffRegister slot_reg = dst_slot->reg();
       if (state.get_use_count(slot_reg) == 1) {
-        __ Fill(dst_slot->reg(), state.stack_height() - 1, type);
+        __ Fill(dst_slot->reg(), src_slot.offset(), type);
         return;
       }
       state.dec_used(slot_reg);
@@ -1279,8 +1453,8 @@ class LiftoffCompiler {
     DCHECK_EQ(type, __ local_type(local_index));
     RegClass rc = reg_class_for(type);
     LiftoffRegister dst_reg = __ GetUnusedRegister(rc);
-    __ Fill(dst_reg, __ cache_state()->stack_height() - 1, type);
-    *dst_slot = LiftoffAssembler::VarState(type, dst_reg);
+    __ Fill(dst_reg, src_slot.offset(), type);
+    *dst_slot = LiftoffAssembler::VarState(type, dst_reg, dst_slot->offset());
     __ cache_state()->inc_used(dst_reg);
   }
 
@@ -1291,12 +1465,12 @@ class LiftoffCompiler {
     switch (source_slot.loc()) {
       case kRegister:
         if (target_slot.is_reg()) state.dec_used(target_slot.reg());
-        target_slot = source_slot;
+        target_slot.Copy(source_slot);
         if (is_tee) state.inc_used(target_slot.reg());
         break;
       case kIntConst:
         if (target_slot.is_reg()) state.dec_used(target_slot.reg());
-        target_slot = source_slot;
+        target_slot.Copy(source_slot);
         break;
       case kStack:
         LocalSetFromStackSlot(&target_slot, local_index);
@@ -1421,18 +1595,25 @@ class LiftoffCompiler {
   }
 
   void BrIf(FullDecoder* decoder, const Value& /* cond */, uint32_t depth) {
-    Condition cond = kEqual;  // Unary "equal" means "equals zero".
+    Label cont_false;
+    Register value = __ PopToRegister().gp();
 
-    if (has_outstanding_op()) {
-      DCHECK_EQ(kExprI32Eqz, outstanding_op_);
-      cond = kUnequal;  // Unary "unequal" means "not equals zero".
+    if (!has_outstanding_op()) {
+      // Unary "equal" means "equals zero".
+      __ emit_cond_jump(kEqual, &cont_false, kWasmI32, value);
+    } else if (outstanding_op_ == kExprI32Eqz) {
+      // Unary "unequal" means "not equals zero".
+      __ emit_cond_jump(kUnequal, &cont_false, kWasmI32, value);
+      outstanding_op_ = kNoOutstandingOp;
+    } else {
+      // Otherwise, it's an i32 compare opcode.
+      Condition cond = NegateCondition(GetCompareCondition(outstanding_op_));
+      Register rhs = value;
+      Register lhs = __ PopToRegister(LiftoffRegList::ForRegs(rhs)).gp();
+      __ emit_cond_jump(cond, &cont_false, kWasmI32, lhs, rhs);
       outstanding_op_ = kNoOutstandingOp;
     }
 
-    Label cont_false;
-    Register value = __ PopToRegister().gp();
-    __ emit_cond_jump(cond, &cont_false, kWasmI32, value);
-
     BrOrRet(decoder, depth);
     __ bind(&cont_false);
   }
@@ -1473,6 +1654,8 @@ class LiftoffCompiler {
     GenerateBrTable(decoder, tmp, value, min, split, table_iterator,
                     br_targets);
     __ bind(&upper_half);
+    // table_iterator will trigger a DCHECK if we don't stop decoding now.
+    if (did_bailout()) return;
     // Emit br table for upper half:
     GenerateBrTable(decoder, tmp, value, split, max, table_iterator,
                     br_targets);
@@ -1496,6 +1679,8 @@ class LiftoffCompiler {
                       &br_targets);
 
       __ bind(&case_default);
+      // table_iterator will trigger a DCHECK if we don't stop decoding now.
+      if (did_bailout()) return;
     }
 
     // Generate the default case.
@@ -1518,25 +1703,29 @@ class LiftoffCompiler {
 
   Label* AddOutOfLineTrap(WasmCodePosition position,
                           WasmCode::RuntimeStubId stub, uint32_t pc = 0) {
-    DCHECK(!FLAG_wasm_no_bounds_checks);
+    DCHECK(FLAG_wasm_bounds_checks);
     // The pc is needed for memory OOB trap with trap handler enabled. Other
     // callers should not even compute it.
     DCHECK_EQ(pc != 0, stub == WasmCode::kThrowWasmTrapMemOutOfBounds &&
                            env_->use_trap_handler);
 
-    out_of_line_code_.push_back(OutOfLineCode::Trap(stub, position, pc));
+    out_of_line_code_.push_back(
+        OutOfLineCode::Trap(stub, position, pc, RegisterDebugSideTableEntry()));
     return out_of_line_code_.back().label.get();
   }
 
+  enum ForceCheck : bool { kDoForceCheck = true, kDontForceCheck = false };
+
   // Returns true if the memory access is statically known to be out of bounds
   // (a jump to the trap was generated then); return false otherwise.
   bool BoundsCheckMem(FullDecoder* decoder, uint32_t access_size,
-                      uint32_t offset, Register index, LiftoffRegList pinned) {
+                      uint32_t offset, Register index, LiftoffRegList pinned,
+                      ForceCheck force_check) {
     const bool statically_oob =
-        !IsInBounds(offset, access_size, env_->max_memory_size);
+        !base::IsInBounds(offset, access_size, env_->max_memory_size);
 
-    if (!statically_oob &&
-        (FLAG_wasm_no_bounds_checks || env_->use_trap_handler)) {
+    if (!force_check && !statically_oob &&
+        (!FLAG_wasm_bounds_checks || env_->use_trap_handler)) {
       return false;
     }
 
@@ -1556,9 +1745,6 @@ class LiftoffCompiler {
       return true;
     }
 
-    DCHECK(!env_->use_trap_handler);
-    DCHECK(!FLAG_wasm_no_bounds_checks);
-
     uint64_t end_offset = uint64_t{offset} + access_size - 1u;
 
     // If the end offset is larger than the smallest memory, dynamically check
@@ -1586,7 +1772,7 @@ class LiftoffCompiler {
     LiftoffRegister effective_size_reg = end_offset_reg;
     __ emit_ptrsize_sub(effective_size_reg.gp(), mem_size, end_offset_reg.gp());
 
-    __ emit_i32_to_intptr(index, index);
+    __ emit_u32_to_intptr(index, index);
 
     __ emit_cond_jump(kUnsignedGreaterEqual, trap_label,
                       LiftoffAssembler::kWasmIntPtr, index,
@@ -1594,6 +1780,31 @@ class LiftoffCompiler {
     return false;
   }
 
+  void AlignmentCheckMem(FullDecoder* decoder, uint32_t access_size,
+                         uint32_t offset, Register index,
+                         LiftoffRegList pinned) {
+    Label* trap_label = AddOutOfLineTrap(
+        decoder->position(), WasmCode::kThrowWasmTrapUnalignedAccess, 0);
+    Register address = __ GetUnusedRegister(kGpReg, pinned).gp();
+
+    const uint32_t align_mask = access_size - 1;
+    if ((offset & align_mask) == 0) {
+      // If {offset} is aligned, we can produce faster code.
+
+      // TODO(ahaas): On Intel, the "test" instruction implicitly computes the
+      // AND of two operands. We could introduce a new variant of
+      // {emit_cond_jump} to use the "test" instruction without the "and" here.
+      // Then we can also avoid using the temp register here.
+      __ emit_i32_and(address, index, align_mask);
+      __ emit_cond_jump(kUnequal, trap_label, kWasmI32, address);
+      return;
+    }
+    __ emit_i32_add(address, index, offset);
+    __ emit_i32_and(address, address, align_mask);
+
+    __ emit_cond_jump(kUnequal, trap_label, kWasmI32, address);
+  }
+
   void TraceMemoryOperation(bool is_store, MachineRepresentation rep,
                             Register index, uint32_t offset,
                             WasmCodePosition position) {
@@ -1622,49 +1833,22 @@ class LiftoffCompiler {
     __ Store(info.gp(), no_reg, offsetof(MemoryTracingInfo, mem_rep), address,
              StoreType::kI32Store8, pinned);
 
+    WasmTraceMemoryDescriptor descriptor;
+    DCHECK_EQ(0, descriptor.GetStackParameterCount());
+    DCHECK_EQ(1, descriptor.GetRegisterParameterCount());
+    Register param_reg = descriptor.GetRegisterParameter(0);
+    if (info.gp() != param_reg) {
+      __ Move(param_reg, info.gp(), LiftoffAssembler::kWasmIntPtr);
+    }
+
     source_position_table_builder_.AddPosition(__ pc_offset(),
                                                SourcePosition(position), false);
+    __ CallRuntimeStub(WasmCode::kWasmTraceMemory);
+    safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kNoLazyDeopt);
 
-    Register args[] = {info.gp()};
-    GenerateRuntimeCall(Runtime::kWasmTraceMemory, arraysize(args), args);
     __ DeallocateStackSlot(sizeof(MemoryTracingInfo));
   }
 
-  void GenerateRuntimeCall(Runtime::FunctionId runtime_function, int num_args,
-                           Register* args) {
-    // Currently, only one argument is supported. More arguments require some
-    // caution for the parallel register moves (reuse StackTransferRecipe).
-    DCHECK_EQ(1, num_args);
-#ifdef DEBUG
-    auto call_descriptor = compiler::Linkage::GetRuntimeCallDescriptor(
-        compilation_zone_, runtime_function, num_args,
-        compiler::Operator::kNoProperties, compiler::CallDescriptor::kNoFlags);
-    constexpr size_t kInputShift = 1;  // Input 0 is the call target.
-    compiler::LinkageLocation param_loc =
-        call_descriptor->GetInputLocation(kInputShift);
-    // Runtime calls take their arguments on the stack.
-    DCHECK(param_loc.IsCallerFrameSlot());
-#endif
-    LiftoffStackSlots stack_slots(&asm_);
-    stack_slots.Add(LiftoffAssembler::VarState(LiftoffAssembler::kWasmIntPtr,
-                                               LiftoffRegister(args[0])));
-    stack_slots.Construct();
-
-    // Set context to "no context" for the runtime call.
-    __ TurboAssembler::Move(kContextRegister,
-                            Smi::FromInt(Context::kNoContext));
-    Register centry = kJavaScriptCallCodeStartRegister;
-    LOAD_INSTANCE_FIELD(centry, IsolateRoot, kSystemPointerSize);
-    // All cache registers are spilled and there are no register arguments.
-    LiftoffRegList pinned;
-    auto centry_id =
-        Builtins::kCEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit;
-    __ LoadTaggedPointer(centry, centry, no_reg,
-                         IsolateData::builtin_slot_offset(centry_id), pinned);
-    __ CallRuntimeWithCEntry(runtime_function, centry);
-    safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kNoLazyDeopt);
-  }
-
   Register AddMemoryMasking(Register index, uint32_t* offset,
                             LiftoffRegList* pinned) {
     if (!FLAG_untrusted_code_mitigations || env_->use_trap_handler) {
@@ -1694,7 +1878,8 @@ class LiftoffCompiler {
       return;
     LiftoffRegList pinned;
     Register index = pinned.set(__ PopToRegister()).gp();
-    if (BoundsCheckMem(decoder, type.size(), imm.offset, index, pinned)) {
+    if (BoundsCheckMem(decoder, type.size(), imm.offset, index, pinned,
+                       kDontForceCheck)) {
       return;
     }
     uint32_t offset = imm.offset;
@@ -1718,6 +1903,12 @@ class LiftoffCompiler {
                            offset, decoder->position());
     }
   }
+  void LoadTransform(FullDecoder* decoder, LoadType type,
+                     LoadTransformationKind transform,
+                     const MemoryAccessImmediate<validate>& imm,
+                     const Value& index_val, Value* result) {
+    unsupported(decoder, kSimd, "simd");
+  }
 
   void StoreMem(FullDecoder* decoder, StoreType type,
                 const MemoryAccessImmediate<validate>& imm,
@@ -1728,7 +1919,8 @@ class LiftoffCompiler {
     LiftoffRegList pinned;
     LiftoffRegister value = pinned.set(__ PopToRegister());
     Register index = pinned.set(__ PopToRegister(pinned)).gp();
-    if (BoundsCheckMem(decoder, type.size(), imm.offset, index, pinned)) {
+    if (BoundsCheckMem(decoder, type.size(), imm.offset, index, pinned,
+                       kDontForceCheck)) {
       return;
     }
     uint32_t offset = imm.offset;
@@ -1766,7 +1958,7 @@ class LiftoffCompiler {
     __ SpillAllRegisters();
 
     constexpr Register kGpReturnReg = kGpReturnRegisters[0];
-    static_assert(kLiftoffAssemblerGpCacheRegs & Register::bit<kGpReturnReg>(),
+    static_assert(kLiftoffAssemblerGpCacheRegs & kGpReturnReg.bit(),
                   "first return register is a cache register (needs more "
                   "complex code here otherwise)");
     LiftoffRegister result = pinned.set(LiftoffRegister(kGpReturnReg));
@@ -1781,6 +1973,7 @@ class LiftoffCompiler {
     if (input.gp() != param_reg) __ Move(param_reg, input.gp(), kWasmI32);
 
     __ CallRuntimeStub(WasmCode::kWasmMemoryGrow);
+    RegisterDebugSideTableEntry();
     safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kNoLazyDeopt);
 
     if (kReturnRegister0 != result.gp()) {
@@ -1790,6 +1983,14 @@ class LiftoffCompiler {
     __ PushRegister(kWasmI32, result);
   }
 
+  DebugSideTableBuilder::EntryBuilder* RegisterDebugSideTableEntry() {
+    if (V8_LIKELY(!debug_sidetable_builder_)) return nullptr;
+    int stack_height = static_cast<int>(__ cache_state()->stack_height());
+    return debug_sidetable_builder_->NewEntry(
+        __ pc_offset(), __ num_locals(), stack_height,
+        __ cache_state()->stack_state.begin());
+  }
+
   void CallDirect(FullDecoder* decoder,
                   const CallFunctionImmediate<validate>& imm,
                   const Value args[], Value returns[]) {
@@ -1833,10 +2034,6 @@ class LiftoffCompiler {
           __ pc_offset(), SourcePosition(decoder->position()), false);
 
       __ CallIndirect(imm.sig, call_descriptor, target);
-
-      safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kNoLazyDeopt);
-
-      __ FinishCall(imm.sig, call_descriptor);
     } else {
       // A direct call within this module just gets the current instance.
       __ PrepareCall(imm.sig, call_descriptor);
@@ -1847,11 +2044,12 @@ class LiftoffCompiler {
       // Just encode the function index. This will be patched at instantiation.
       Address addr = static_cast<Address>(imm.index);
       __ CallNativeWasmCode(addr);
+    }
 
-      safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kNoLazyDeopt);
+    RegisterDebugSideTableEntry();
+    safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kNoLazyDeopt);
 
-      __ FinishCall(imm.sig, call_descriptor);
-    }
+    __ FinishCall(imm.sig, call_descriptor);
   }
 
   void CallIndirect(FullDecoder* decoder, const Value& index_val,
@@ -1916,8 +2114,7 @@ class LiftoffCompiler {
       // 3) mask = diff & neg_index
       __ emit_i32_and(mask, diff, neg_index);
       // 4) mask = mask >> 31
-      __ LoadConstant(LiftoffRegister(tmp_const), WasmValue(int32_t{31}));
-      __ emit_i32_sar(mask, mask, tmp_const, pinned);
+      __ emit_i32_sar(mask, mask, 31);
 
       // Apply mask.
       __ emit_i32_and(index, index, mask);
@@ -1926,12 +2123,9 @@ class LiftoffCompiler {
     DEBUG_CODE_COMMENT("Check indirect call signature");
     // Load the signature from {instance->ift_sig_ids[key]}
     LOAD_INSTANCE_FIELD(table, IndirectFunctionTableSigIds, kSystemPointerSize);
-    // Multiply {index} by 4 to represent kInt32Size items.
-    STATIC_ASSERT(kInt32Size == 4);
-    // TODO(wasm): use a emit_i32_shli() instead of two adds.
-    // (currently cannot use shl on ia32/x64 because it clobbers %rcx).
-    __ emit_i32_add(index, index, index);
-    __ emit_i32_add(index, index, index);
+    // Shift {index} by 2 (multiply by 4) to represent kInt32Size items.
+    STATIC_ASSERT((1 << 2) == kInt32Size);
+    __ emit_i32_shl(index, index, 2);
     __ Load(LiftoffRegister(scratch), table, index, 0, LoadType::kI32Load,
             pinned);
 
@@ -1985,6 +2179,7 @@ class LiftoffCompiler {
     __ PrepareCall(imm.sig, call_descriptor, &target, explicit_instance);
     __ CallIndirect(imm.sig, call_descriptor, target);
 
+    RegisterDebugSideTableEntry();
     safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kNoLazyDeopt);
 
     __ FinishCall(imm.sig, call_descriptor);
@@ -2000,20 +2195,26 @@ class LiftoffCompiler {
                           const Value args[]) {
     unsupported(decoder, kTailCall, "return_call_indirect");
   }
+
   void SimdOp(FullDecoder* decoder, WasmOpcode opcode, Vector<Value> args,
               Value* result) {
-    unsupported(decoder, kSimd, "simd");
+    switch (opcode) {
+      case wasm::kExprF32x4Splat:
+        EmitUnOp<kWasmF32, kWasmS128>(
+            [=](LiftoffRegister dst, LiftoffRegister src) {
+              __ emit_f32x4_splat(dst, src);
+            });
+        break;
+      default:
+        unsupported(decoder, kSimd, "simd");
+    }
   }
+
   void SimdLaneOp(FullDecoder* decoder, WasmOpcode opcode,
                   const SimdLaneImmediate<validate>& imm,
                   const Vector<Value> inputs, Value* result) {
     unsupported(decoder, kSimd, "simd");
   }
-  void SimdShiftOp(FullDecoder* decoder, WasmOpcode opcode,
-                   const SimdShiftImmediate<validate>& imm, const Value& input,
-                   Value* result) {
-    unsupported(decoder, kSimd, "simd");
-  }
   void Simd8x16ShuffleOp(FullDecoder* decoder,
                          const Simd8x16ShuffleImmediate<validate>& imm,
                          const Value& input0, const Value& input1,
@@ -2032,10 +2233,181 @@ class LiftoffCompiler {
                      uint32_t depth, Vector<Value> values) {
     unsupported(decoder, kExceptionHandling, "br_on_exn");
   }
+
+  void AtomicStoreMem(FullDecoder* decoder, StoreType type,
+                      const MemoryAccessImmediate<validate>& imm) {
+    LiftoffRegList pinned;
+    LiftoffRegister value = pinned.set(__ PopToRegister());
+    Register index = pinned.set(__ PopToRegister(pinned)).gp();
+    if (BoundsCheckMem(decoder, type.size(), imm.offset, index, pinned,
+                       kDoForceCheck)) {
+      return;
+    }
+    AlignmentCheckMem(decoder, type.size(), imm.offset, index, pinned);
+    uint32_t offset = imm.offset;
+    index = AddMemoryMasking(index, &offset, &pinned);
+    DEBUG_CODE_COMMENT("Atomic store to memory");
+    Register addr = pinned.set(__ GetUnusedRegister(kGpReg, pinned)).gp();
+    LOAD_INSTANCE_FIELD(addr, MemoryStart, kSystemPointerSize);
+    LiftoffRegList outer_pinned;
+    if (FLAG_trace_wasm_memory) outer_pinned.set(index);
+    __ AtomicStore(addr, index, offset, value, type, outer_pinned);
+    if (FLAG_trace_wasm_memory) {
+      TraceMemoryOperation(true, type.mem_rep(), index, offset,
+                           decoder->position());
+    }
+  }
+
+  void AtomicLoadMem(FullDecoder* decoder, LoadType type,
+                     const MemoryAccessImmediate<validate>& imm) {
+    ValueType value_type = type.value_type();
+    LiftoffRegList pinned;
+    Register index = pinned.set(__ PopToRegister()).gp();
+    if (BoundsCheckMem(decoder, type.size(), imm.offset, index, pinned,
+                       kDoForceCheck)) {
+      return;
+    }
+    AlignmentCheckMem(decoder, type.size(), imm.offset, index, pinned);
+    uint32_t offset = imm.offset;
+    index = AddMemoryMasking(index, &offset, &pinned);
+    DEBUG_CODE_COMMENT("Atomic load from memory");
+    Register addr = pinned.set(__ GetUnusedRegister(kGpReg, pinned)).gp();
+    LOAD_INSTANCE_FIELD(addr, MemoryStart, kSystemPointerSize);
+    RegClass rc = reg_class_for(value_type);
+    LiftoffRegister value = pinned.set(__ GetUnusedRegister(rc, pinned));
+    __ AtomicLoad(value, addr, index, offset, type, pinned);
+    __ PushRegister(value_type, value);
+
+    if (FLAG_trace_wasm_memory) {
+      TraceMemoryOperation(false, type.mem_type().representation(), index,
+                           offset, decoder->position());
+    }
+  }
+
+  void AtomicBinop(FullDecoder* decoder, StoreType type,
+                   const MemoryAccessImmediate<validate>& imm,
+                   void (LiftoffAssembler::*emit_fn)(Register, Register,
+                                                     uint32_t, LiftoffRegister,
+                                                     StoreType)) {
+    ValueType result_type = type.value_type();
+    LiftoffRegList pinned;
+    LiftoffRegister value = pinned.set(__ PopToRegister());
+    // We have to reuse the value register as the result register so that we
+    //  don't run out of registers on ia32. For this we use the value register
+    //  as the result register if it has no other uses. Otherwise  we allocate
+    //  a new register and let go of the value register to get spilled.
+    LiftoffRegister result = value;
+    if (__ cache_state()->is_used(value)) {
+      result = pinned.set(__ GetUnusedRegister(value.reg_class(), pinned));
+      __ Move(result, value, result_type);
+      pinned.clear(value);
+    }
+    Register index = pinned.set(__ PopToRegister(pinned)).gp();
+    if (BoundsCheckMem(decoder, type.size(), imm.offset, index, pinned,
+                       kDoForceCheck)) {
+      return;
+    }
+    AlignmentCheckMem(decoder, type.size(), imm.offset, index, pinned);
+
+    uint32_t offset = imm.offset;
+    index = AddMemoryMasking(index, &offset, &pinned);
+    Register addr = pinned.set(__ GetUnusedRegister(kGpReg, pinned)).gp();
+    LOAD_INSTANCE_FIELD(addr, MemoryStart, kSystemPointerSize);
+
+    (asm_.*emit_fn)(addr, index, offset, result, type);
+    __ PushRegister(result_type, result);
+  }
+
+#define ATOMIC_STORE_LIST(V)        \
+  V(I32AtomicStore, kI32Store)      \
+  V(I64AtomicStore, kI64Store)      \
+  V(I32AtomicStore8U, kI32Store8)   \
+  V(I32AtomicStore16U, kI32Store16) \
+  V(I64AtomicStore8U, kI64Store8)   \
+  V(I64AtomicStore16U, kI64Store16) \
+  V(I64AtomicStore32U, kI64Store32)
+
+#define ATOMIC_LOAD_LIST(V)        \
+  V(I32AtomicLoad, kI32Load)       \
+  V(I64AtomicLoad, kI64Load)       \
+  V(I32AtomicLoad8U, kI32Load8U)   \
+  V(I32AtomicLoad16U, kI32Load16U) \
+  V(I64AtomicLoad8U, kI64Load8U)   \
+  V(I64AtomicLoad16U, kI64Load16U) \
+  V(I64AtomicLoad32U, kI64Load32U)
+
+#define ATOMIC_BINOP_INSTRUCTION_LIST(V) \
+  V(Add, I32AtomicAdd, kI32Store)        \
+  V(Add, I64AtomicAdd, kI64Store)        \
+  V(Add, I32AtomicAdd8U, kI32Store8)     \
+  V(Add, I32AtomicAdd16U, kI32Store16)   \
+  V(Add, I64AtomicAdd8U, kI64Store8)     \
+  V(Add, I64AtomicAdd16U, kI64Store16)   \
+  V(Add, I64AtomicAdd32U, kI64Store32)   \
+  V(Sub, I32AtomicSub, kI32Store)        \
+  V(Sub, I64AtomicSub, kI64Store)        \
+  V(Sub, I32AtomicSub8U, kI32Store8)     \
+  V(Sub, I32AtomicSub16U, kI32Store16)   \
+  V(Sub, I64AtomicSub8U, kI64Store8)     \
+  V(Sub, I64AtomicSub16U, kI64Store16)   \
+  V(Sub, I64AtomicSub32U, kI64Store32)   \
+  V(And, I32AtomicAnd, kI32Store)        \
+  V(And, I64AtomicAnd, kI64Store)        \
+  V(And, I32AtomicAnd8U, kI32Store8)     \
+  V(And, I32AtomicAnd16U, kI32Store16)   \
+  V(And, I64AtomicAnd8U, kI64Store8)     \
+  V(And, I64AtomicAnd16U, kI64Store16)   \
+  V(And, I64AtomicAnd32U, kI64Store32)   \
+  V(Or, I32AtomicOr, kI32Store)          \
+  V(Or, I64AtomicOr, kI64Store)          \
+  V(Or, I32AtomicOr8U, kI32Store8)       \
+  V(Or, I32AtomicOr16U, kI32Store16)     \
+  V(Or, I64AtomicOr8U, kI64Store8)       \
+  V(Or, I64AtomicOr16U, kI64Store16)     \
+  V(Or, I64AtomicOr32U, kI64Store32)     \
+  V(Xor, I32AtomicXor, kI32Store)        \
+  V(Xor, I64AtomicXor, kI64Store)        \
+  V(Xor, I32AtomicXor8U, kI32Store8)     \
+  V(Xor, I32AtomicXor16U, kI32Store16)   \
+  V(Xor, I64AtomicXor8U, kI64Store8)     \
+  V(Xor, I64AtomicXor16U, kI64Store16)   \
+  V(Xor, I64AtomicXor32U, kI64Store32)
+
   void AtomicOp(FullDecoder* decoder, WasmOpcode opcode, Vector<Value> args,
                 const MemoryAccessImmediate<validate>& imm, Value* result) {
-    unsupported(decoder, kAtomics, "atomicop");
+    switch (opcode) {
+#define ATOMIC_STORE_OP(name, type)                \
+  case wasm::kExpr##name:                          \
+    AtomicStoreMem(decoder, StoreType::type, imm); \
+    break;
+
+      ATOMIC_STORE_LIST(ATOMIC_STORE_OP)
+#undef ATOMIC_STORE_OP
+
+#define ATOMIC_LOAD_OP(name, type)               \
+  case wasm::kExpr##name:                        \
+    AtomicLoadMem(decoder, LoadType::type, imm); \
+    break;
+
+      ATOMIC_LOAD_LIST(ATOMIC_LOAD_OP)
+#undef ATOMIC_LOAD_OP
+
+#define ATOMIC_BINOP_OP(op, name, type)                                        \
+  case wasm::kExpr##name:                                                      \
+    AtomicBinop(decoder, StoreType::type, imm, &LiftoffAssembler::Atomic##op); \
+    break;
+
+      ATOMIC_BINOP_INSTRUCTION_LIST(ATOMIC_BINOP_OP)
+#undef ATOMIC_BINOP_OP
+      default:
+        unsupported(decoder, kAtomics, "atomicop");
+    }
   }
+
+#undef ATOMIC_STORE_LIST
+#undef ATOMIC_LOAD_LIST
+#undef ATOMIC_BINOP_INSTRUCTION_LIST
+
   void AtomicFence(FullDecoder* decoder) {
     unsupported(decoder, kAtomics, "atomic.fence");
   }
@@ -2092,6 +2464,7 @@ class LiftoffCompiler {
 
   compiler::CallDescriptor* const descriptor_;
   CompilationEnv* const env_;
+  DebugSideTableBuilder* const debug_sidetable_builder_;
   LiftoffBailoutReason bailout_reason_ = kSuccess;
   std::vector<OutOfLineCode> out_of_line_code_;
   SourcePositionTableBuilder source_position_table_builder_;
@@ -2104,14 +2477,17 @@ class LiftoffCompiler {
   // The pc offset of the instructions to reserve the stack frame. Needed to
   // patch the actually needed stack size in the end.
   uint32_t pc_offset_stack_frame_construction_ = 0;
+  // For emitting breakpoint, we store a pointer to the position of the next
+  // breakpoint, and a pointer after the list of breakpoints as end marker.
+  int* next_breakpoint_ptr_ = nullptr;
+  int* next_breakpoint_end_ = nullptr;
 
   bool has_outstanding_op() const {
     return outstanding_op_ != kNoOutstandingOp;
   }
 
   void TraceCacheState(FullDecoder* decoder) const {
-#ifdef DEBUG
-    if (!FLAG_trace_liftoff || !FLAG_trace_wasm_decoder) return;
+    if (!FLAG_trace_liftoff) return;
     StdoutStream os;
     for (int control_depth = decoder->control_depth() - 1; control_depth >= -1;
          --control_depth) {
@@ -2123,7 +2499,6 @@ class LiftoffCompiler {
       if (control_depth != -1) PrintF("; ");
     }
     os << "\n";
-#endif
   }
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(LiftoffCompiler);
@@ -2131,47 +2506,55 @@ class LiftoffCompiler {
 
 }  // namespace
 
-WasmCompilationResult ExecuteLiftoffCompilation(AccountingAllocator* allocator,
-                                                CompilationEnv* env,
-                                                const FunctionBody& func_body,
-                                                int func_index,
-                                                Counters* counters,
-                                                WasmFeatures* detected) {
+WasmCompilationResult ExecuteLiftoffCompilation(
+    AccountingAllocator* allocator, CompilationEnv* env,
+    const FunctionBody& func_body, int func_index, Counters* counters,
+    WasmFeatures* detected, Vector<int> breakpoints) {
+  int func_body_size = static_cast<int>(func_body.end - func_body.start);
   TRACE_EVENT2(TRACE_DISABLED_BY_DEFAULT("v8.wasm"),
                "ExecuteLiftoffCompilation", "func_index", func_index,
-               "body_size",
-               static_cast<uint32_t>(func_body.end - func_body.start));
+               "body_size", func_body_size);
 
   Zone zone(allocator, "LiftoffCompilationZone");
-  const WasmModule* module = env ? env->module : nullptr;
   auto call_descriptor = compiler::GetWasmCallDescriptor(&zone, func_body.sig);
-  base::Optional<TimedHistogramScope> liftoff_compile_time_scope(
-      base::in_place, counters->liftoff_compile_time());
+  base::Optional<TimedHistogramScope> liftoff_compile_time_scope;
+  if (counters) {
+    liftoff_compile_time_scope.emplace(counters->liftoff_compile_time());
+  }
+  size_t code_size_estimate =
+      WasmCodeManager::EstimateLiftoffCodeSize(func_body_size);
+  // Allocate the initial buffer a bit bigger to avoid reallocation during code
+  // generation.
   std::unique_ptr<wasm::WasmInstructionBuffer> instruction_buffer =
-      wasm::WasmInstructionBuffer::New();
+      wasm::WasmInstructionBuffer::New(128 + code_size_estimate * 4 / 3);
+  DebugSideTableBuilder* const kNoDebugSideTable = nullptr;
   WasmFullDecoder<Decoder::kValidate, LiftoffCompiler> decoder(
-      &zone, module, env->enabled_features, detected, func_body,
-      call_descriptor, env, &zone, instruction_buffer->CreateView());
+      &zone, env->module, env->enabled_features, detected, func_body,
+      call_descriptor, env, &zone, instruction_buffer->CreateView(),
+      kNoDebugSideTable, breakpoints);
   decoder.Decode();
   liftoff_compile_time_scope.reset();
   LiftoffCompiler* compiler = &decoder.interface();
   if (decoder.failed()) compiler->OnFirstError(&decoder);
 
-  // Check that the histogram for the bailout reasons has the correct size.
-  DCHECK_EQ(0, counters->liftoff_bailout_reasons()->min());
-  DCHECK_EQ(kNumBailoutReasons - 1, counters->liftoff_bailout_reasons()->max());
-  DCHECK_EQ(kNumBailoutReasons,
-            counters->liftoff_bailout_reasons()->num_buckets());
-  // Register the bailout reason (can also be {kSuccess}).
-  counters->liftoff_bailout_reasons()->AddSample(
-      static_cast<int>(compiler->bailout_reason()));
-  if (compiler->did_bailout()) {
-    // Liftoff compilation failed.
-    counters->liftoff_unsupported_functions()->Increment();
-    return WasmCompilationResult{};
-  }
+  if (counters) {
+    // Check that the histogram for the bailout reasons has the correct size.
+    DCHECK_EQ(0, counters->liftoff_bailout_reasons()->min());
+    DCHECK_EQ(kNumBailoutReasons - 1,
+              counters->liftoff_bailout_reasons()->max());
+    DCHECK_EQ(kNumBailoutReasons,
+              counters->liftoff_bailout_reasons()->num_buckets());
+    // Register the bailout reason (can also be {kSuccess}).
+    counters->liftoff_bailout_reasons()->AddSample(
+        static_cast<int>(compiler->bailout_reason()));
+    if (compiler->did_bailout()) {
+      // Liftoff compilation failed.
+      counters->liftoff_unsupported_functions()->Increment();
+      return WasmCompilationResult{};
+    }
 
-  counters->liftoff_compiled_functions()->Increment();
+    counters->liftoff_compiled_functions()->Increment();
+  }
 
   WasmCompilationResult result;
   compiler->GetCode(&result.code_desc);
@@ -2186,6 +2569,24 @@ WasmCompilationResult ExecuteLiftoffCompilation(AccountingAllocator* allocator,
   return result;
 }
 
+DebugSideTable GenerateLiftoffDebugSideTable(AccountingAllocator* allocator,
+                                             CompilationEnv* env,
+                                             const FunctionBody& func_body) {
+  Zone zone(allocator, "LiftoffDebugSideTableZone");
+  auto call_descriptor = compiler::GetWasmCallDescriptor(&zone, func_body.sig);
+  DebugSideTableBuilder debug_sidetable_builder;
+  WasmFeatures detected;
+  WasmFullDecoder<Decoder::kValidate, LiftoffCompiler> decoder(
+      &zone, env->module, env->enabled_features, &detected, func_body,
+      call_descriptor, env, &zone,
+      NewAssemblerBuffer(AssemblerBase::kDefaultBufferSize),
+      &debug_sidetable_builder);
+  decoder.Decode();
+  DCHECK(decoder.ok());
+  DCHECK(!decoder.interface().did_bailout());
+  return debug_sidetable_builder.GenerateDebugSideTable();
+}
+
 #undef __
 #undef TRACE
 #undef WASM_INSTANCE_OBJECT_FIELD_OFFSET
diff --git a/deps/v8/src/wasm/baseline/liftoff-compiler.h b/deps/v8/src/wasm/baseline/liftoff-compiler.h
index d40b92bef4e70b..fba92146e19a7d 100644
--- a/deps/v8/src/wasm/baseline/liftoff-compiler.h
+++ b/deps/v8/src/wasm/baseline/liftoff-compiler.h
@@ -16,8 +16,9 @@ class Counters;
 namespace wasm {
 
 struct CompilationEnv;
+class DebugSideTable;
 struct FunctionBody;
-struct WasmFeatures;
+class WasmFeatures;
 
 // Note: If this list changes, also the histogram "V8.LiftoffBailoutReasons"
 // on the chromium side needs to be updated.
@@ -51,9 +52,12 @@ enum LiftoffBailoutReason : int8_t {
   kNumBailoutReasons
 };
 
-WasmCompilationResult ExecuteLiftoffCompilation(
+V8_EXPORT_PRIVATE WasmCompilationResult ExecuteLiftoffCompilation(
     AccountingAllocator*, CompilationEnv*, const FunctionBody&, int func_index,
-    Counters*, WasmFeatures* detected_features);
+    Counters*, WasmFeatures* detected_features, Vector<int> breakpoints = {});
+
+V8_EXPORT_PRIVATE DebugSideTable GenerateLiftoffDebugSideTable(
+    AccountingAllocator*, CompilationEnv*, const FunctionBody&);
 
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/src/wasm/baseline/liftoff-register.h b/deps/v8/src/wasm/baseline/liftoff-register.h
index b322f7eb68d387..f2d42af7b13703 100644
--- a/deps/v8/src/wasm/baseline/liftoff-register.h
+++ b/deps/v8/src/wasm/baseline/liftoff-register.h
@@ -17,21 +17,42 @@ namespace internal {
 namespace wasm {
 
 static constexpr bool kNeedI64RegPair = kSystemPointerSize == 4;
+static constexpr bool kNeedS128RegPair = !kSimpleFPAliasing;
 
 enum RegClass : uint8_t {
   kGpReg,
   kFpReg,
-  // {kGpRegPair} equals {kNoReg} if {kNeedI64RegPair} is false.
-  kGpRegPair,
-  kNoReg = kGpRegPair + kNeedI64RegPair
+  kGpRegPair = kFpReg + 1 + (kNeedS128RegPair && !kNeedI64RegPair),
+  kFpRegPair = kFpReg + 1 + kNeedI64RegPair,
+  kNoReg = kFpRegPair + kNeedS128RegPair,
+  // +------------------+-------------------------------+
+  // |                  |        kNeedI64RegPair        |
+  // +------------------+---------------+---------------+
+  // | kNeedS128RegPair |     true      |    false      |
+  // +------------------+---------------+---------------+
+  // |             true | 0,1,2,3,4 (a) | 0,1,3,2,3     |
+  // |            false | 0,1,2,3,3 (b) | 0,1,2,2,2 (c) |
+  // +------------------+---------------+---------------+
+  // (a) arm
+  // (b) ia32
+  // (c) x64, arm64
 };
 
+static_assert(kNeedI64RegPair == (kGpRegPair != kNoReg),
+              "kGpRegPair equals kNoReg if unused");
+static_assert(kNeedS128RegPair == (kFpRegPair != kNoReg),
+              "kFpRegPair equals kNoReg if unused");
+
 enum RegPairHalf : uint8_t { kLowWord = 0, kHighWord = 1 };
 
-static inline constexpr bool needs_reg_pair(ValueType type) {
+static inline constexpr bool needs_gp_reg_pair(ValueType type) {
   return kNeedI64RegPair && type == kWasmI64;
 }
 
+static inline constexpr bool needs_fp_reg_pair(ValueType type) {
+  return kNeedS128RegPair && type == kWasmS128;
+}
+
 static inline constexpr RegClass reg_class_for(ValueType type) {
   switch (type) {
     case kWasmF32:
@@ -41,11 +62,47 @@ static inline constexpr RegClass reg_class_for(ValueType type) {
       return kGpReg;
     case kWasmI64:
       return kNeedI64RegPair ? kGpRegPair : kGpReg;
+    case kWasmS128:
+      return kNeedS128RegPair ? kFpRegPair : kFpReg;
     default:
       return kNoReg;  // unsupported type
   }
 }
 
+// Description of LiftoffRegister code encoding.
+// This example uses the ARM architecture, which as of writing has:
+// - 9 GP registers, requiring 4 bits
+// - 13 FP regitsters, requiring 5 bits
+// - kNeedI64RegPair is true
+// - kNeedS128RegPair is true
+// - thus, kBitsPerRegPair is 2 + 2 * 4 = 10
+// - storage_t is uint16_t
+// The table below illustrates how each RegClass is encoded, with brackets
+// surrounding the bits which encode the register number.
+//
+// +----------------+------------------+
+// | RegClass       | Example          |
+// +----------------+------------------+
+// | kGpReg (1)     | [00 0000   0000] |
+// | kFpReg (2)     | [00 0000   1001] |
+// | kGpRegPair (3) | 01 [0000] [0001] |
+// | kFpRegPair (4) | 10  000[0  0010] |
+// +----------------+------------------+
+//
+// gp and fp registers are encoded in the same index space, which means that
+// code has to check for kGpRegPair and kFpRegPair before it can treat the code
+// as a register code.
+// (1) [0 .. kMaxGpRegCode] encodes gp registers
+// (2) [kMaxGpRegCode + 1 .. kMaxGpRegCode + kMaxFpRegCode] encodes fp
+// registers, so in this example, 1001 is really fp register 0.
+// (3) The second top bit is set for kGpRegPair, and the two gp registers are
+// stuffed side by side in code. Note that this is not the second top bit of
+// storage_t, since storage_t is larger than the number of meaningful bits we
+// need for the encoding.
+// (4) The top bit is set for kFpRegPair, and the fp register is stuffed into
+// the bottom part of the code. Unlike (2), this is the fp register code itself
+// (not sharing index space with gp), so in this example, it is fp register 2.
+
 // Maximum code of a gp cache register.
 static constexpr int kMaxGpRegCode =
     8 * sizeof(kLiftoffAssemblerGpCacheRegs) -
@@ -54,11 +111,6 @@ static constexpr int kMaxGpRegCode =
 static constexpr int kMaxFpRegCode =
     8 * sizeof(kLiftoffAssemblerFpCacheRegs) -
     base::bits::CountLeadingZeros(kLiftoffAssemblerFpCacheRegs) - 1;
-// LiftoffRegister encodes both gp and fp in a unified index space.
-// [0 .. kMaxGpRegCode] encodes gp registers,
-// [kMaxGpRegCode+1 .. kMaxGpRegCode + kMaxFpRegCode] encodes fp registers.
-// I64 values on 32 bit platforms are stored in two registers, both encoded in
-// the same LiftoffRegister value.
 static constexpr int kAfterMaxLiftoffGpRegCode = kMaxGpRegCode + 1;
 static constexpr int kAfterMaxLiftoffFpRegCode =
     kAfterMaxLiftoffGpRegCode + kMaxFpRegCode + 1;
@@ -67,11 +119,19 @@ static constexpr int kBitsPerLiftoffRegCode =
     32 - base::bits::CountLeadingZeros<uint32_t>(kAfterMaxLiftoffRegCode - 1);
 static constexpr int kBitsPerGpRegCode =
     32 - base::bits::CountLeadingZeros<uint32_t>(kMaxGpRegCode);
-static constexpr int kBitsPerGpRegPair = 1 + 2 * kBitsPerGpRegCode;
+static constexpr int kBitsPerFpRegCode =
+    32 - base::bits::CountLeadingZeros<uint32_t>(kMaxFpRegCode);
+// GpRegPair requires 1 extra bit, S128RegPair also needs an extra bit.
+static constexpr int kBitsPerRegPair =
+    (kNeedS128RegPair ? 2 : 1) + 2 * kBitsPerGpRegCode;
+
+static_assert(2 * kBitsPerGpRegCode >= kBitsPerFpRegCode,
+              "encoding for gp pair and fp pair collides");
 
 class LiftoffRegister {
   static constexpr int needed_bits =
-      Max(kNeedI64RegPair ? kBitsPerGpRegPair : 0, kBitsPerLiftoffRegCode);
+      Max(kNeedI64RegPair || kNeedS128RegPair ? kBitsPerRegPair : 0,
+          kBitsPerLiftoffRegCode);
   using storage_t = std::conditional<
       needed_bits <= 8, uint8_t,
       std::conditional<needed_bits <= 16, uint16_t, uint32_t>::type>::type;
@@ -121,31 +181,67 @@ class LiftoffRegister {
     return LiftoffRegister(combined_code);
   }
 
+  static LiftoffRegister ForFpPair(DoubleRegister low) {
+    DCHECK(kNeedS128RegPair);
+    DCHECK_EQ(0, low.code() % 2);
+    storage_t combined_code = low.code() | 2 << (2 * kBitsPerGpRegCode);
+    return LiftoffRegister(combined_code);
+  }
+
   constexpr bool is_pair() const {
+    return (kNeedI64RegPair || kNeedS128RegPair) &&
+           (code_ & (3 << (2 * kBitsPerGpRegCode)));
+  }
+
+  constexpr bool is_gp_pair() const {
     return kNeedI64RegPair && (code_ & (1 << (2 * kBitsPerGpRegCode))) != 0;
   }
+  constexpr bool is_fp_pair() const {
+    return kNeedS128RegPair && (code_ & (2 << (2 * kBitsPerGpRegCode))) != 0;
+  }
   constexpr bool is_gp() const { return code_ < kAfterMaxLiftoffGpRegCode; }
   constexpr bool is_fp() const {
     return code_ >= kAfterMaxLiftoffGpRegCode &&
            code_ < kAfterMaxLiftoffFpRegCode;
   }
 
-  LiftoffRegister low() const { return LiftoffRegister(low_gp()); }
+  LiftoffRegister low() const {
+    // Common case for most archs where only gp pair supported.
+    if (!kNeedS128RegPair) return LiftoffRegister(low_gp());
+    return is_gp_pair() ? LiftoffRegister(low_gp()) : LiftoffRegister(low_fp());
+  }
 
-  LiftoffRegister high() const { return LiftoffRegister(high_gp()); }
+  LiftoffRegister high() const {
+    // Common case for most archs where only gp pair supported.
+    if (!kNeedS128RegPair) return LiftoffRegister(high_gp());
+    return is_gp_pair() ? LiftoffRegister(high_gp())
+                        : LiftoffRegister(high_fp());
+  }
 
   Register low_gp() const {
-    DCHECK(is_pair());
+    DCHECK(is_gp_pair());
     static constexpr storage_t kCodeMask = (1 << kBitsPerGpRegCode) - 1;
     return Register::from_code(code_ & kCodeMask);
   }
 
   Register high_gp() const {
-    DCHECK(is_pair());
+    DCHECK(is_gp_pair());
     static constexpr storage_t kCodeMask = (1 << kBitsPerGpRegCode) - 1;
     return Register::from_code((code_ >> kBitsPerGpRegCode) & kCodeMask);
   }
 
+  DoubleRegister low_fp() const {
+    DCHECK(is_fp_pair());
+    static constexpr storage_t kCodeMask = (1 << kBitsPerFpRegCode) - 1;
+    return DoubleRegister::from_code(code_ & kCodeMask);
+  }
+
+  DoubleRegister high_fp() const {
+    DCHECK(is_fp_pair());
+    static constexpr storage_t kCodeMask = (1 << kBitsPerFpRegCode) - 1;
+    return DoubleRegister::from_code((code_ & kCodeMask) + 1);
+  }
+
   Register gp() const {
     DCHECK(is_gp());
     return Register::from_code(code_);
@@ -162,15 +258,18 @@ class LiftoffRegister {
   }
 
   RegClass reg_class() const {
-    return is_pair() ? kGpRegPair : is_gp() ? kGpReg : kFpReg;
+    return is_fp_pair() ? kFpRegPair
+                        : is_gp_pair() ? kGpRegPair : is_gp() ? kGpReg : kFpReg;
   }
 
   bool operator==(const LiftoffRegister other) const {
-    DCHECK_EQ(is_pair(), other.is_pair());
+    DCHECK_EQ(is_gp_pair(), other.is_gp_pair());
+    DCHECK_EQ(is_fp_pair(), other.is_fp_pair());
     return code_ == other.code_;
   }
   bool operator!=(const LiftoffRegister other) const {
-    DCHECK_EQ(is_pair(), other.is_pair());
+    DCHECK_EQ(is_gp_pair(), other.is_gp_pair());
+    DCHECK_EQ(is_fp_pair(), other.is_fp_pair());
     return code_ != other.code_;
   }
   bool overlaps(const LiftoffRegister other) const {
@@ -187,8 +286,10 @@ class LiftoffRegister {
 ASSERT_TRIVIALLY_COPYABLE(LiftoffRegister);
 
 inline std::ostream& operator<<(std::ostream& os, LiftoffRegister reg) {
-  if (reg.is_pair()) {
+  if (reg.is_gp_pair()) {
     return os << "<" << reg.low_gp() << "+" << reg.high_gp() << ">";
+  } else if (reg.is_fp_pair()) {
+    return os << "<" << reg.low_fp() << "+" << reg.high_fp() << ">";
   } else if (reg.is_gp()) {
     return os << reg.gp();
   } else {
@@ -209,6 +310,9 @@ class LiftoffRegList {
   static constexpr storage_t kGpMask = storage_t{kLiftoffAssemblerGpCacheRegs};
   static constexpr storage_t kFpMask = storage_t{kLiftoffAssemblerFpCacheRegs}
                                        << kAfterMaxLiftoffGpRegCode;
+  // Sets all even numbered fp registers.
+  static constexpr uint64_t kEvenFpSetMask = uint64_t{0x5555555555555555}
+                                             << kAfterMaxLiftoffGpRegCode;
 
   constexpr LiftoffRegList() = default;
 
@@ -261,6 +365,17 @@ class LiftoffRegList {
     return LiftoffRegList(regs_ | other.regs_);
   }
 
+  constexpr LiftoffRegList GetAdjacentFpRegsSet() const {
+    // And regs_ with a right shifted version of itself, so reg[i] is set only
+    // if reg[i+1] is set. We only care about the even fp registers.
+    storage_t available = (regs_ >> 1) & regs_ & kEvenFpSetMask;
+    return LiftoffRegList(available);
+  }
+
+  constexpr bool HasAdjacentFpRegsSet() const {
+    return !GetAdjacentFpRegsSet().is_empty();
+  }
+
   constexpr bool operator==(const LiftoffRegList other) const {
     return regs_ == other.regs_;
   }
diff --git a/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h b/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h
index 4c69e423c1aa6f..32215b3df59445 100644
--- a/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h
+++ b/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h
@@ -43,28 +43,18 @@ constexpr int32_t kLowWordOffset = 0;
 constexpr int32_t kHighWordOffset = 4;
 #endif
 
-// fp-4 holds the stack marker, fp-8 is the instance parameter, first stack
-// slot is located at fp-16.
-constexpr int32_t kConstantStackSpace = 8;
-constexpr int32_t kFirstStackSlotOffset =
-    kConstantStackSpace + LiftoffAssembler::kStackSlotSize;
+// fp-4 holds the stack marker, fp-8 is the instance parameter.
+constexpr int kInstanceOffset = 8;
 
-inline int GetStackSlotOffset(uint32_t index) {
-  return kFirstStackSlotOffset + index * LiftoffAssembler::kStackSlotSize;
-}
-
-inline MemOperand GetStackSlot(uint32_t index) {
-  return MemOperand(fp, -GetStackSlotOffset(index));
-}
+inline MemOperand GetStackSlot(int offset) { return MemOperand(fp, -offset); }
 
-inline MemOperand GetHalfStackSlot(uint32_t index, RegPairHalf half) {
+inline MemOperand GetHalfStackSlot(int offset, RegPairHalf half) {
   int32_t half_offset =
       half == kLowWord ? 0 : LiftoffAssembler::kStackSlotSize / 2;
-  int32_t offset = index * LiftoffAssembler::kStackSlotSize + half_offset;
-  return MemOperand(fp, -kFirstStackSlotOffset - offset);
+  return MemOperand(fp, -offset + half_offset);
 }
 
-inline MemOperand GetInstanceOperand() { return MemOperand(fp, -8); }
+inline MemOperand GetInstanceOperand() { return GetStackSlot(kInstanceOffset); }
 
 inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, Register base,
                  int32_t offset, ValueType type) {
@@ -135,6 +125,18 @@ inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
   }
 }
 
+inline Register EnsureNoAlias(Assembler* assm, Register reg,
+                              LiftoffRegister must_not_alias,
+                              UseScratchRegisterScope* temps) {
+  if (reg != must_not_alias.low_gp() && reg != must_not_alias.high_gp())
+    return reg;
+  Register tmp = temps->Acquire();
+  DCHECK_NE(must_not_alias.low_gp(), tmp);
+  DCHECK_NE(must_not_alias.high_gp(), tmp);
+  assm->movz(tmp, reg, zero_reg);
+  return tmp;
+}
+
 #if defined(V8_TARGET_BIG_ENDIAN)
 inline void ChangeEndiannessLoad(LiftoffAssembler* assm, LiftoffRegister dst,
                                  LoadType type, LiftoffRegList pinned) {
@@ -273,10 +275,7 @@ int LiftoffAssembler::PrepareStackFrame() {
   return offset;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(int offset,
-                                              uint32_t stack_slots) {
-  uint32_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
-  DCHECK_LE(bytes, kMaxInt);
+void LiftoffAssembler::PatchPrepareStackFrame(int offset, int frame_size) {
   // We can't run out of space, just pass anything big enough to not cause the
   // assembler to try to grow the buffer.
   constexpr int kAvailableSpace = 256;
@@ -286,13 +285,37 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
   // If bytes can be represented as 16bit, addiu will be generated and two
   // nops will stay untouched. Otherwise, lui-ori sequence will load it to
   // register and, as third instruction, addu will be generated.
-  patching_assembler.Addu(sp, sp, Operand(-bytes));
+  patching_assembler.Addu(sp, sp, Operand(-frame_size));
 }
 
 void LiftoffAssembler::FinishCode() {}
 
 void LiftoffAssembler::AbortCompilation() {}
 
+// static
+constexpr int LiftoffAssembler::StaticStackFrameSize() {
+  return liftoff::kInstanceOffset;
+}
+
+int LiftoffAssembler::SlotSizeForType(ValueType type) {
+  switch (type) {
+    case kWasmS128:
+      return ValueTypes::ElementSizeInBytes(type);
+    default:
+      return kStackSlotSize;
+  }
+}
+
+bool LiftoffAssembler::NeedsAlignment(ValueType type) {
+  switch (type) {
+    case kWasmS128:
+      return true;
+    default:
+      // No alignment because all other types are kStackSlotSize.
+      return false;
+  }
+}
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   switch (value.type()) {
@@ -503,6 +526,48 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
   }
 }
 
+void LiftoffAssembler::AtomicLoad(LiftoffRegister dst, Register src_addr,
+                                  Register offset_reg, uint32_t offset_imm,
+                                  LoadType type, LiftoffRegList pinned) {
+  bailout(kAtomics, "AtomicLoad");
+}
+
+void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
+                                   uint32_t offset_imm, LiftoffRegister src,
+                                   StoreType type, LiftoffRegList pinned) {
+  bailout(kAtomics, "AtomicStore");
+}
+
+void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAdd");
+}
+
+void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicSub");
+}
+
+void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAnd");
+}
+
+void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
+                                uint32_t offset_imm, LiftoffRegister value,
+                                StoreType type) {
+  bailout(kAtomics, "AtomicOr");
+}
+
+void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicXor");
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
@@ -510,12 +575,12 @@ void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
   liftoff::Load(this, dst, fp, offset, type);
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
-  DCHECK_NE(dst_index, src_index);
+  DCHECK_NE(dst_offset, src_offset);
   LiftoffRegister reg = GetUnusedRegister(reg_class_for(type));
-  Fill(reg, src_index, type);
-  Spill(dst_index, reg, type);
+  Fill(reg, src_offset, type);
+  Spill(dst_offset, reg, type);
 }
 
 void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
@@ -529,17 +594,16 @@ void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
   TurboAssembler::Move(dst, src);
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
-                             ValueType type) {
-  RecordUsedSpillSlot(index);
-  MemOperand dst = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Spill(int offset, LiftoffRegister reg, ValueType type) {
+  RecordUsedSpillOffset(offset);
+  MemOperand dst = liftoff::GetStackSlot(offset);
   switch (type) {
     case kWasmI32:
       sw(reg.gp(), dst);
       break;
     case kWasmI64:
-      sw(reg.low_gp(), liftoff::GetHalfStackSlot(index, kLowWord));
-      sw(reg.high_gp(), liftoff::GetHalfStackSlot(index, kHighWord));
+      sw(reg.low_gp(), liftoff::GetHalfStackSlot(offset, kLowWord));
+      sw(reg.high_gp(), liftoff::GetHalfStackSlot(offset, kHighWord));
       break;
     case kWasmF32:
       swc1(reg.fp(), dst);
@@ -552,9 +616,9 @@ void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
   }
 }
 
-void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
-  RecordUsedSpillSlot(index);
-  MemOperand dst = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Spill(int offset, WasmValue value) {
+  RecordUsedSpillOffset(offset);
+  MemOperand dst = liftoff::GetStackSlot(offset);
   switch (value.type()) {
     case kWasmI32: {
       LiftoffRegister tmp = GetUnusedRegister(kGpReg);
@@ -570,8 +634,8 @@ void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
       TurboAssembler::li(tmp.low_gp(), Operand(low_word));
       TurboAssembler::li(tmp.high_gp(), Operand(high_word));
 
-      sw(tmp.low_gp(), liftoff::GetHalfStackSlot(index, kLowWord));
-      sw(tmp.high_gp(), liftoff::GetHalfStackSlot(index, kHighWord));
+      sw(tmp.low_gp(), liftoff::GetHalfStackSlot(offset, kLowWord));
+      sw(tmp.high_gp(), liftoff::GetHalfStackSlot(offset, kHighWord));
       break;
     }
     default:
@@ -581,16 +645,15 @@ void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
   }
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
-                            ValueType type) {
-  MemOperand src = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Fill(LiftoffRegister reg, int offset, ValueType type) {
+  MemOperand src = liftoff::GetStackSlot(offset);
   switch (type) {
     case kWasmI32:
       lw(reg.gp(), src);
       break;
     case kWasmI64:
-      lw(reg.low_gp(), liftoff::GetHalfStackSlot(index, kLowWord));
-      lw(reg.high_gp(), liftoff::GetHalfStackSlot(index, kHighWord));
+      lw(reg.low_gp(), liftoff::GetHalfStackSlot(offset, kLowWord));
+      lw(reg.high_gp(), liftoff::GetHalfStackSlot(offset, kHighWord));
       break;
     case kWasmF32:
       lwc1(reg.fp(), src);
@@ -603,28 +666,27 @@ void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
   }
 }
 
-void LiftoffAssembler::FillI64Half(Register reg, uint32_t index,
-                                   RegPairHalf half) {
-  lw(reg, liftoff::GetHalfStackSlot(index, half));
+void LiftoffAssembler::FillI64Half(Register reg, int offset, RegPairHalf half) {
+  lw(reg, liftoff::GetHalfStackSlot(offset, half));
 }
 
-void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
-  DCHECK_LT(0, count);
-  uint32_t last_stack_slot = index + count - 1;
-  RecordUsedSpillSlot(last_stack_slot);
+void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
+  DCHECK_LT(0, size);
+  DCHECK_EQ(0, size % 4);
+  RecordUsedSpillOffset(start + size);
 
-  if (count <= 12) {
-    // Special straight-line code for up to 12 slots. Generates one
-    // instruction per slot (<=12 instructions total).
-    for (uint32_t offset = 0; offset < count; ++offset) {
-      Sw(zero_reg, liftoff::GetStackSlot(index + offset));
+  if (size <= 48) {
+    // Special straight-line code for up to 12 words. Generates one
+    // instruction per word (<=12 instructions total).
+    for (int offset = 4; offset <= size; offset += 4) {
+      Sw(zero_reg, liftoff::GetStackSlot(start + offset));
     }
   } else {
     // General case for bigger counts (12 instructions).
     // Use a0 for start address (inclusive), a1 for end address (exclusive).
     Push(a1, a0);
-    Addu(a0, fp, Operand(-liftoff::GetStackSlotOffset(last_stack_slot)));
-    Addu(a1, fp, Operand(-liftoff::GetStackSlotOffset(index) + kStackSlotSize));
+    Addu(a0, fp, Operand(-start - size));
+    Addu(a1, fp, Operand(-start));
 
     Label loop;
     bind(&loop);
@@ -706,14 +768,12 @@ I32_BINOP_I(xor, Xor)
 
 #undef I32_BINOP_I
 
-bool LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
+void LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
   TurboAssembler::Clz(dst, src);
-  return true;
 }
 
-bool LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
+void LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
   TurboAssembler::Ctz(dst, src);
-  return true;
 }
 
 bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
@@ -721,10 +781,10 @@ bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
   return true;
 }
 
-#define I32_SHIFTOP(name, instruction)                                      \
-  void LiftoffAssembler::emit_i32_##name(                                   \
-      Register dst, Register src, Register amount, LiftoffRegList pinned) { \
-    instruction(dst, src, amount);                                          \
+#define I32_SHIFTOP(name, instruction)                               \
+  void LiftoffAssembler::emit_i32_##name(Register dst, Register src, \
+                                         Register amount) {          \
+    instruction(dst, src, amount);                                   \
   }
 #define I32_SHIFTOP_I(name, instruction)                             \
   I32_SHIFTOP(name, instruction##v)                                  \
@@ -734,8 +794,8 @@ bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
     instruction(dst, src, amount);                                   \
   }
 
-I32_SHIFTOP(shl, sllv)
-I32_SHIFTOP(sar, srav)
+I32_SHIFTOP_I(shl, sll)
+I32_SHIFTOP_I(sar, sra)
 I32_SHIFTOP_I(shr, srl)
 
 #undef I32_SHIFTOP
@@ -797,7 +857,7 @@ void LiftoffAssembler::emit_i64_sub(LiftoffRegister dst, LiftoffRegister lhs,
 namespace liftoff {
 
 inline bool IsRegInRegPair(LiftoffRegister pair, Register reg) {
-  DCHECK(pair.is_pair());
+  DCHECK(pair.is_gp_pair());
   return pair.low_gp() == reg || pair.high_gp() == reg;
 }
 
@@ -805,12 +865,9 @@ inline void Emit64BitShiftOperation(
     LiftoffAssembler* assm, LiftoffRegister dst, LiftoffRegister src,
     Register amount,
     void (TurboAssembler::*emit_shift)(Register, Register, Register, Register,
-                                       Register, Register, Register),
-    LiftoffRegList pinned) {
+                                       Register, Register, Register)) {
   Label move, done;
-  pinned.set(dst);
-  pinned.set(src);
-  pinned.set(amount);
+  LiftoffRegList pinned = LiftoffRegList::ForRegs(dst, src, amount);
 
   // If some of destination registers are in use, get another, unused pair.
   // That way we prevent overwriting some input registers while shifting.
@@ -845,31 +902,115 @@ inline void Emit64BitShiftOperation(
 }  // namespace liftoff
 
 void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
-                                    Register amount, LiftoffRegList pinned) {
+                                    Register amount) {
   liftoff::Emit64BitShiftOperation(this, dst, src, amount,
-                                   &TurboAssembler::ShlPair, pinned);
+                                   &TurboAssembler::ShlPair);
+}
+
+void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
+                                    int32_t amount) {
+  UseScratchRegisterScope temps(this);
+  // {src.low_gp()} will still be needed after writing {dst.high_gp()} and
+  // {dst.low_gp()}.
+  Register src_low = liftoff::EnsureNoAlias(this, src.low_gp(), dst, &temps);
+  Register src_high = src.high_gp();
+  // {src.high_gp()} will still be needed after writing {dst.high_gp()}.
+  if (src_high == dst.high_gp()) {
+    mov(kScratchReg, src_high);
+    src_high = kScratchReg;
+  }
+  DCHECK_NE(dst.low_gp(), kScratchReg);
+  DCHECK_NE(dst.high_gp(), kScratchReg);
+
+  ShlPair(dst.low_gp(), dst.high_gp(), src_low, src_high, amount, kScratchReg);
 }
 
 void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
-                                    Register amount, LiftoffRegList pinned) {
+                                    Register amount) {
   liftoff::Emit64BitShiftOperation(this, dst, src, amount,
-                                   &TurboAssembler::SarPair, pinned);
+                                   &TurboAssembler::SarPair);
+}
+
+void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
+                                    int32_t amount) {
+  UseScratchRegisterScope temps(this);
+  // {src.high_gp()} will still be needed after writing {dst.high_gp()} and
+  // {dst.low_gp()}.
+  Register src_high = liftoff::EnsureNoAlias(this, src.high_gp(), dst, &temps);
+  DCHECK_NE(dst.low_gp(), kScratchReg);
+  DCHECK_NE(dst.high_gp(), kScratchReg);
+
+  SarPair(dst.low_gp(), dst.high_gp(), src.low_gp(), src_high, amount,
+          kScratchReg);
 }
 
 void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                                    Register amount, LiftoffRegList pinned) {
+                                    Register amount) {
   liftoff::Emit64BitShiftOperation(this, dst, src, amount,
-                                   &TurboAssembler::ShrPair, pinned);
+                                   &TurboAssembler::ShrPair);
 }
 
 void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                                    int amount) {
-  DCHECK(is_uint6(amount));
-  ShrPair(dst.high_gp(), dst.low_gp(), src.high_gp(), src.low_gp(), amount,
+                                    int32_t amount) {
+  UseScratchRegisterScope temps(this);
+  // {src.high_gp()} will still be needed after writing {dst.high_gp()} and
+  // {dst.low_gp()}.
+  Register src_high = liftoff::EnsureNoAlias(this, src.high_gp(), dst, &temps);
+  DCHECK_NE(dst.low_gp(), kScratchReg);
+  DCHECK_NE(dst.high_gp(), kScratchReg);
+
+  ShrPair(dst.low_gp(), dst.high_gp(), src.low_gp(), src_high, amount,
           kScratchReg);
 }
 
-void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+void LiftoffAssembler::emit_i64_clz(LiftoffRegister dst, LiftoffRegister src) {
+  // return high == 0 ? 32 + CLZ32(low) : CLZ32(high);
+  Label done;
+  Label high_is_zero;
+  Branch(&high_is_zero, eq, src.high_gp(), Operand(zero_reg));
+
+  clz(dst.low_gp(), src.high_gp());
+  jmp(&done);
+
+  bind(&high_is_zero);
+  clz(dst.low_gp(), src.low_gp());
+  Addu(dst.low_gp(), dst.low_gp(), Operand(32));
+
+  bind(&done);
+  mov(dst.high_gp(), zero_reg);  // High word of result is always 0.
+}
+
+void LiftoffAssembler::emit_i64_ctz(LiftoffRegister dst, LiftoffRegister src) {
+  // return low == 0 ? 32 + CTZ32(high) : CTZ32(low);
+  Label done;
+  Label low_is_zero;
+  Branch(&low_is_zero, eq, src.low_gp(), Operand(zero_reg));
+
+  Ctz(dst.low_gp(), src.low_gp());
+  jmp(&done);
+
+  bind(&low_is_zero);
+  Ctz(dst.low_gp(), src.high_gp());
+  Addu(dst.low_gp(), dst.low_gp(), Operand(32));
+
+  bind(&done);
+  mov(dst.high_gp(), zero_reg);  // High word of result is always 0.
+}
+
+bool LiftoffAssembler::emit_i64_popcnt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  // Produce partial popcnts in the two dst registers.
+  Register src1 = src.high_gp() == dst.low_gp() ? src.high_gp() : src.low_gp();
+  Register src2 = src.high_gp() == dst.low_gp() ? src.low_gp() : src.high_gp();
+  TurboAssembler::Popcnt(dst.low_gp(), src1);
+  TurboAssembler::Popcnt(dst.high_gp(), src2);
+  // Now add the two into the lower dst reg and clear the higher dst reg.
+  addu(dst.low_gp(), dst.low_gp(), dst.high_gp());
+  mov(dst.high_gp(), zero_reg);
+  return true;
+}
+
+void LiftoffAssembler::emit_u32_to_intptr(Register dst, Register src) {
   // This is a nop on mips32.
 }
 
@@ -1376,6 +1517,14 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   bind(&cont);
 }
 
+void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
+  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
+  // 3a4000 support MSA.
+  bailout(kUnsupportedArchitecture, "emit_f32x4_splat");
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
   TurboAssembler::Ulw(limit_address, MemOperand(limit_address));
   TurboAssembler::Branch(ool_code, ule, sp, Operand(limit_address));
@@ -1519,6 +1668,8 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   addiu(sp, sp, size);
 }
 
+void LiftoffAssembler::DebugBreak() { stop(); }
+
 void LiftoffStackSlots::Construct() {
   for (auto& slot : slots_) {
     const LiftoffAssembler::VarState& src = slot.src_;
@@ -1527,11 +1678,11 @@ void LiftoffStackSlots::Construct() {
         if (src.type() == kWasmF64) {
           DCHECK_EQ(kLowWord, slot.half_);
           asm_->lw(kScratchReg,
-                   liftoff::GetHalfStackSlot(slot.src_index_, kHighWord));
+                   liftoff::GetHalfStackSlot(slot.src_offset_, kHighWord));
           asm_->push(kScratchReg);
         }
         asm_->lw(kScratchReg,
-                 liftoff::GetHalfStackSlot(slot.src_index_, slot.half_));
+                 liftoff::GetHalfStackSlot(slot.src_offset_, slot.half_));
         asm_->push(kScratchReg);
         break;
       }
diff --git a/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h b/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h
index 5314a65da5705e..09dd5105bf2195 100644
--- a/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h
+++ b/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h
@@ -39,21 +39,12 @@ namespace liftoff {
 //  -----+--------------------+  <-- stack ptr (sp)
 //
 
-// fp-8 holds the stack marker, fp-16 is the instance parameter, first stack
-// slot is located at fp-24.
-constexpr int32_t kConstantStackSpace = 16;
-constexpr int32_t kFirstStackSlotOffset =
-    kConstantStackSpace + LiftoffAssembler::kStackSlotSize;
+// fp-8 holds the stack marker, fp-16 is the instance parameter.
+constexpr int kInstanceOffset = 16;
 
-inline int GetStackSlotOffset(uint32_t index) {
-  return kFirstStackSlotOffset + index * LiftoffAssembler::kStackSlotSize;
-}
-
-inline MemOperand GetStackSlot(uint32_t index) {
-  return MemOperand(fp, -GetStackSlotOffset(index));
-}
+inline MemOperand GetStackSlot(int offset) { return MemOperand(fp, -offset); }
 
-inline MemOperand GetInstanceOperand() { return MemOperand(fp, -16); }
+inline MemOperand GetInstanceOperand() { return GetStackSlot(kInstanceOffset); }
 
 inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, MemOperand src,
                  ValueType type) {
@@ -242,10 +233,7 @@ int LiftoffAssembler::PrepareStackFrame() {
   return offset;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(int offset,
-                                              uint32_t stack_slots) {
-  uint64_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
-  DCHECK_LE(bytes, kMaxInt);
+void LiftoffAssembler::PatchPrepareStackFrame(int offset, int frame_size) {
   // We can't run out of space, just pass anything big enough to not cause the
   // assembler to try to grow the buffer.
   constexpr int kAvailableSpace = 256;
@@ -255,13 +243,37 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
   // If bytes can be represented as 16bit, daddiu will be generated and two
   // nops will stay untouched. Otherwise, lui-ori sequence will load it to
   // register and, as third instruction, daddu will be generated.
-  patching_assembler.Daddu(sp, sp, Operand(-bytes));
+  patching_assembler.Daddu(sp, sp, Operand(-frame_size));
 }
 
 void LiftoffAssembler::FinishCode() {}
 
 void LiftoffAssembler::AbortCompilation() {}
 
+// static
+constexpr int LiftoffAssembler::StaticStackFrameSize() {
+  return liftoff::kInstanceOffset;
+}
+
+int LiftoffAssembler::SlotSizeForType(ValueType type) {
+  switch (type) {
+    case kWasmS128:
+      return ValueTypes::ElementSizeInBytes(type);
+    default:
+      return kStackSlotSize;
+  }
+}
+
+bool LiftoffAssembler::NeedsAlignment(ValueType type) {
+  switch (type) {
+    case kWasmS128:
+      return true;
+    default:
+      // No alignment because all other types are kStackSlotSize.
+      return false;
+  }
+}
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   switch (value.type()) {
@@ -430,6 +442,48 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
   }
 }
 
+void LiftoffAssembler::AtomicLoad(LiftoffRegister dst, Register src_addr,
+                                  Register offset_reg, uint32_t offset_imm,
+                                  LoadType type, LiftoffRegList pinned) {
+  bailout(kAtomics, "AtomicLoad");
+}
+
+void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
+                                   uint32_t offset_imm, LiftoffRegister src,
+                                   StoreType type, LiftoffRegList pinned) {
+  bailout(kAtomics, "AtomicStore");
+}
+
+void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAdd");
+}
+
+void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicSub");
+}
+
+void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAnd");
+}
+
+void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
+                                uint32_t offset_imm, LiftoffRegister value,
+                                StoreType type) {
+  bailout(kAtomics, "AtomicOr");
+}
+
+void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicXor");
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
@@ -437,12 +491,12 @@ void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
   liftoff::Load(this, dst, src, type);
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
-  DCHECK_NE(dst_index, src_index);
+  DCHECK_NE(dst_offset, src_offset);
   LiftoffRegister reg = GetUnusedRegister(reg_class_for(type));
-  Fill(reg, src_index, type);
-  Spill(dst_index, reg, type);
+  Fill(reg, src_offset, type);
+  Spill(dst_offset, reg, type);
 }
 
 void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
@@ -457,10 +511,9 @@ void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
   TurboAssembler::Move(dst, src);
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
-                             ValueType type) {
-  RecordUsedSpillSlot(index);
-  MemOperand dst = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Spill(int offset, LiftoffRegister reg, ValueType type) {
+  RecordUsedSpillOffset(offset);
+  MemOperand dst = liftoff::GetStackSlot(offset);
   switch (type) {
     case kWasmI32:
       Sw(reg.gp(), dst);
@@ -479,9 +532,9 @@ void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
   }
 }
 
-void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
-  RecordUsedSpillSlot(index);
-  MemOperand dst = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Spill(int offset, WasmValue value) {
+  RecordUsedSpillOffset(offset);
+  MemOperand dst = liftoff::GetStackSlot(offset);
   switch (value.type()) {
     case kWasmI32: {
       LiftoffRegister tmp = GetUnusedRegister(kGpReg);
@@ -502,9 +555,8 @@ void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
   }
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
-                            ValueType type) {
-  MemOperand src = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Fill(LiftoffRegister reg, int offset, ValueType type) {
+  MemOperand src = liftoff::GetStackSlot(offset);
   switch (type) {
     case kWasmI32:
       Lw(reg.gp(), src);
@@ -523,28 +575,31 @@ void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
   }
 }
 
-void LiftoffAssembler::FillI64Half(Register, uint32_t index, RegPairHalf) {
+void LiftoffAssembler::FillI64Half(Register, int offset, RegPairHalf) {
   UNREACHABLE();
 }
 
-void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
-  DCHECK_LT(0, count);
-  uint32_t last_stack_slot = index + count - 1;
-  RecordUsedSpillSlot(last_stack_slot);
+void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
+  DCHECK_LT(0, size);
+  RecordUsedSpillOffset(start + size);
 
-  if (count <= 12) {
+  if (size <= 12 * kStackSlotSize) {
     // Special straight-line code for up to 12 slots. Generates one
     // instruction per slot (<= 12 instructions total).
-    for (uint32_t offset = 0; offset < count; ++offset) {
-      Sd(zero_reg, liftoff::GetStackSlot(index + offset));
+    uint32_t remainder = size;
+    for (; remainder >= kStackSlotSize; remainder -= kStackSlotSize) {
+      Sd(zero_reg, liftoff::GetStackSlot(start + remainder));
+    }
+    DCHECK(remainder == 4 || remainder == 0);
+    if (remainder) {
+      Sw(zero_reg, liftoff::GetStackSlot(start + remainder));
     }
   } else {
     // General case for bigger counts (12 instructions).
     // Use a0 for start address (inclusive), a1 for end address (exclusive).
     Push(a1, a0);
-    Daddu(a0, fp, Operand(-liftoff::GetStackSlotOffset(last_stack_slot)));
-    Daddu(a1, fp,
-          Operand(-liftoff::GetStackSlotOffset(index) + kStackSlotSize));
+    Daddu(a0, fp, Operand(-start - size));
+    Daddu(a1, fp, Operand(-start));
 
     Label loop;
     bind(&loop);
@@ -556,6 +611,20 @@ void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
   }
 }
 
+void LiftoffAssembler::emit_i64_clz(LiftoffRegister dst, LiftoffRegister src) {
+  TurboAssembler::Dclz(dst.gp(), src.gp());
+}
+
+void LiftoffAssembler::emit_i64_ctz(LiftoffRegister dst, LiftoffRegister src) {
+  TurboAssembler::Dctz(dst.gp(), src.gp());
+}
+
+bool LiftoffAssembler::emit_i64_popcnt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  TurboAssembler::Dpopcnt(dst.gp(), src.gp());
+  return true;
+}
+
 void LiftoffAssembler::emit_i32_mul(Register dst, Register lhs, Register rhs) {
   TurboAssembler::Mul(dst, lhs, rhs);
 }
@@ -626,14 +695,12 @@ I32_BINOP_I(xor, Xor)
 
 #undef I32_BINOP_I
 
-bool LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
+void LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
   TurboAssembler::Clz(dst, src);
-  return true;
 }
 
-bool LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
+void LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
   TurboAssembler::Ctz(dst, src);
-  return true;
 }
 
 bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
@@ -641,10 +708,10 @@ bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
   return true;
 }
 
-#define I32_SHIFTOP(name, instruction)                                      \
-  void LiftoffAssembler::emit_i32_##name(                                   \
-      Register dst, Register src, Register amount, LiftoffRegList pinned) { \
-    instruction(dst, src, amount);                                          \
+#define I32_SHIFTOP(name, instruction)                               \
+  void LiftoffAssembler::emit_i32_##name(Register dst, Register src, \
+                                         Register amount) {          \
+    instruction(dst, src, amount);                                   \
   }
 #define I32_SHIFTOP_I(name, instruction)                             \
   I32_SHIFTOP(name, instruction##v)                                  \
@@ -654,8 +721,8 @@ bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
     instruction(dst, src, amount);                                   \
   }
 
-I32_SHIFTOP(shl, sllv)
-I32_SHIFTOP(sar, srav)
+I32_SHIFTOP_I(shl, sll)
+I32_SHIFTOP_I(sar, sra)
 I32_SHIFTOP_I(shr, srl)
 
 #undef I32_SHIFTOP
@@ -741,28 +808,30 @@ I64_BINOP_I(xor, Xor)
 
 #undef I64_BINOP_I
 
-#define I64_SHIFTOP(name, instruction)                                         \
-  void LiftoffAssembler::emit_i64_##name(LiftoffRegister dst,                  \
-                                         LiftoffRegister src, Register amount, \
-                                         LiftoffRegList pinned) {              \
-    instruction(dst.gp(), src.gp(), amount);                                   \
+#define I64_SHIFTOP(name, instruction)                             \
+  void LiftoffAssembler::emit_i64_##name(                          \
+      LiftoffRegister dst, LiftoffRegister src, Register amount) { \
+    instruction(dst.gp(), src.gp(), amount);                       \
   }
 #define I64_SHIFTOP_I(name, instruction)                                    \
   I64_SHIFTOP(name, instruction##v)                                         \
   void LiftoffAssembler::emit_i64_##name(LiftoffRegister dst,               \
                                          LiftoffRegister src, int amount) { \
     DCHECK(is_uint6(amount));                                               \
-    instruction(dst.gp(), src.gp(), amount);                                \
+    if (amount < 32)                                                        \
+      instruction(dst.gp(), src.gp(), amount);                              \
+    else                                                                    \
+      instruction##32(dst.gp(), src.gp(), amount - 32);                     \
   }
 
-I64_SHIFTOP(shl, dsllv)
-I64_SHIFTOP(sar, dsrav)
+I64_SHIFTOP_I(shl, dsll)
+I64_SHIFTOP_I(sar, dsra)
 I64_SHIFTOP_I(shr, dsrl)
 
 #undef I64_SHIFTOP
 #undef I64_SHIFTOP_I
 
-void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+void LiftoffAssembler::emit_u32_to_intptr(Register dst, Register src) {
   addu(dst, src, zero_reg);
 }
 
@@ -1240,6 +1309,14 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   bind(&cont);
 }
 
+void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
+  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
+  // 3a4000 support MSA.
+  bailout(kUnsupportedArchitecture, "emit_f32x4_splat");
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
   TurboAssembler::Uld(limit_address, MemOperand(limit_address));
   TurboAssembler::Branch(ool_code, ule, sp, Operand(limit_address));
@@ -1383,12 +1460,14 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   daddiu(sp, sp, size);
 }
 
+void LiftoffAssembler::DebugBreak() { stop(); }
+
 void LiftoffStackSlots::Construct() {
   for (auto& slot : slots_) {
     const LiftoffAssembler::VarState& src = slot.src_;
     switch (src.loc()) {
       case LiftoffAssembler::VarState::kStack:
-        asm_->ld(kScratchReg, liftoff::GetStackSlot(slot.src_index_));
+        asm_->ld(kScratchReg, liftoff::GetStackSlot(slot.src_offset_));
         asm_->push(kScratchReg);
         break;
       case LiftoffAssembler::VarState::kRegister:
diff --git a/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h b/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h
index 3b436a96d51c5f..89294877ffc0ca 100644
--- a/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h
+++ b/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h
@@ -38,19 +38,11 @@ namespace liftoff {
 //
 
 constexpr int32_t kInstanceOffset = 2 * kSystemPointerSize;
-constexpr int32_t kFirstStackSlotOffset =
-    kInstanceOffset + 2 * kSystemPointerSize;
 
-inline int GetStackSlotOffset(uint32_t index) {
-  return kFirstStackSlotOffset + index * LiftoffAssembler::kStackSlotSize;
-}
-
-inline MemOperand GetHalfStackSlot(uint32_t index, RegPairHalf half) {
+inline MemOperand GetHalfStackSlot(int offset, RegPairHalf half) {
   int32_t half_offset =
       half == kLowWord ? 0 : LiftoffAssembler::kStackSlotSize / 2;
-  int32_t offset = kFirstStackSlotOffset +
-                   index * LiftoffAssembler::kStackSlotSize - half_offset;
-  return MemOperand(fp, -offset);
+  return MemOperand(fp, -kInstanceOffset - offset + half_offset);
 }
 
 }  // namespace liftoff
@@ -60,8 +52,7 @@ int LiftoffAssembler::PrepareStackFrame() {
   return 0;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(int offset,
-                                              uint32_t stack_slots) {
+void LiftoffAssembler::PatchPrepareStackFrame(int offset, int frame_size) {
   bailout(kUnsupportedArchitecture, "PatchPrepareStackFrame");
 }
 
@@ -69,6 +60,30 @@ void LiftoffAssembler::FinishCode() { EmitConstantPool(); }
 
 void LiftoffAssembler::AbortCompilation() { FinishCode(); }
 
+// static
+constexpr int LiftoffAssembler::StaticStackFrameSize() {
+  return liftoff::kInstanceOffset;
+}
+
+int LiftoffAssembler::SlotSizeForType(ValueType type) {
+  switch (type) {
+    case kWasmS128:
+      return ValueTypes::ElementSizeInBytes(type);
+    default:
+      return kStackSlotSize;
+  }
+}
+
+bool LiftoffAssembler::NeedsAlignment(ValueType type) {
+  switch (type) {
+    case kWasmS128:
+      return true;
+    default:
+      // No alignment because all other types are kStackSlotSize.
+      return false;
+  }
+}
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   bailout(kUnsupportedArchitecture, "LoadConstant");
@@ -113,13 +128,55 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
   bailout(kUnsupportedArchitecture, "Store");
 }
 
+void LiftoffAssembler::AtomicLoad(LiftoffRegister dst, Register src_addr,
+                                  Register offset_reg, uint32_t offset_imm,
+                                  LoadType type, LiftoffRegList pinned) {
+  bailout(kAtomics, "AtomicLoad");
+}
+
+void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
+                                   uint32_t offset_imm, LiftoffRegister src,
+                                   StoreType type, LiftoffRegList pinned) {
+  bailout(kAtomics, "AtomicStore");
+}
+
+void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAdd");
+}
+
+void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicSub");
+}
+
+void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAnd");
+}
+
+void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
+                                uint32_t offset_imm, LiftoffRegister value,
+                                StoreType type) {
+  bailout(kAtomics, "AtomicOr");
+}
+
+void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicXor");
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
   bailout(kUnsupportedArchitecture, "LoadCallerFrameSlot");
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
   bailout(kUnsupportedArchitecture, "MoveStackValue");
 }
@@ -133,48 +190,45 @@ void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
   bailout(kUnsupportedArchitecture, "Move DoubleRegister");
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
-                             ValueType type) {
+void LiftoffAssembler::Spill(int offset, LiftoffRegister reg, ValueType type) {
   bailout(kUnsupportedArchitecture, "Spill register");
 }
 
-void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
+void LiftoffAssembler::Spill(int offset, WasmValue value) {
   bailout(kUnsupportedArchitecture, "Spill value");
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
-                            ValueType type) {
+void LiftoffAssembler::Fill(LiftoffRegister reg, int offset, ValueType type) {
   bailout(kUnsupportedArchitecture, "Fill");
 }
 
-void LiftoffAssembler::FillI64Half(Register, uint32_t index, RegPairHalf) {
+void LiftoffAssembler::FillI64Half(Register, int offset, RegPairHalf) {
   bailout(kUnsupportedArchitecture, "FillI64Half");
 }
 
-void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
-  DCHECK_LT(0, count);
-  uint32_t last_stack_slot = index + count - 1;
-  RecordUsedSpillSlot(last_stack_slot);
+void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
+  DCHECK_LT(0, size);
+  DCHECK_EQ(0, size % 4);
+  RecordUsedSpillOffset(start + size);
 
   // We need a zero reg. Always use r0 for that, and push it before to restore
   // its value afterwards.
   push(r0);
   mov(r0, Operand(0));
 
-  if (count <= 5) {
-    // Special straight-line code for up to five slots. Generates two
-    // instructions per slot.
-    for (uint32_t offset = 0; offset < count; ++offset) {
-      StoreP(r0, liftoff::GetHalfStackSlot(index + offset, kLowWord));
-      StoreP(r0, liftoff::GetHalfStackSlot(index + offset, kHighWord));
+  if (size <= 36) {
+    // Special straight-line code for up to nine words. Generates one
+    // instruction per word.
+    for (int offset = 4; offset <= size; offset += 4) {
+      StoreP(r0, liftoff::GetHalfStackSlot(start + offset, kLowWord));
     }
   } else {
     // General case for bigger counts (9 instructions).
     // Use r4 for start address (inclusive), r5 for end address (exclusive).
     push(r4);
     push(r5);
-    subi(r4, fp, Operand(liftoff::GetStackSlotOffset(last_stack_slot)));
-    subi(r5, fp, Operand(liftoff::GetStackSlotOffset(index) + kStackSlotSize));
+    subi(r4, fp, Operand(start + size));
+    subi(r5, fp, Operand(start));
 
     Label loop;
     bind(&loop);
@@ -213,9 +267,8 @@ void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
     bailout(kUnsupportedArchitecture, "i64_i binop: " #name);                  \
   }
 #define UNIMPLEMENTED_GP_UNOP(name)                                \
-  bool LiftoffAssembler::emit_##name(Register dst, Register src) { \
+  void LiftoffAssembler::emit_##name(Register dst, Register src) { \
     bailout(kUnsupportedArchitecture, "gp unop: " #name);          \
-    return true;                                                   \
   }
 #define UNIMPLEMENTED_FP_BINOP(name)                                         \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister lhs, \
@@ -231,14 +284,22 @@ void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
     bailout(kUnsupportedArchitecture, "fp unop: " #name);                      \
     return true;                                                               \
   }
-#define UNIMPLEMENTED_I32_SHIFTOP(name)                                        \
-  void LiftoffAssembler::emit_##name(Register dst, Register src,               \
-                                     Register amount, LiftoffRegList pinned) { \
-    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);                  \
+#define UNIMPLEMENTED_I32_SHIFTOP(name)                          \
+  void LiftoffAssembler::emit_##name(Register dst, Register src, \
+                                     Register amount) {          \
+    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);    \
+  }                                                              \
+  void LiftoffAssembler::emit_##name(Register dst, Register src, \
+                                     int32_t amount) {           \
+    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);    \
   }
 #define UNIMPLEMENTED_I64_SHIFTOP(name)                                        \
   void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
-                                     Register amount, LiftoffRegList pinned) { \
+                                     Register amount) {                        \
+    bailout(kUnsupportedArchitecture, "i64 shiftop: " #name);                  \
+  }                                                                            \
+  void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
+                                     int32_t amount) {                         \
     bailout(kUnsupportedArchitecture, "i64 shiftop: " #name);                  \
   }
 
@@ -264,7 +325,6 @@ UNIMPLEMENTED_I64_SHIFTOP(i64_sar)
 UNIMPLEMENTED_I64_SHIFTOP(i64_shr)
 UNIMPLEMENTED_GP_UNOP(i32_clz)
 UNIMPLEMENTED_GP_UNOP(i32_ctz)
-UNIMPLEMENTED_GP_UNOP(i32_popcnt)
 UNIMPLEMENTED_FP_BINOP(f32_add)
 UNIMPLEMENTED_FP_BINOP(f32_sub)
 UNIMPLEMENTED_FP_BINOP(f32_mul)
@@ -305,6 +365,17 @@ UNIMPLEMENTED_FP_UNOP(f64_sqrt)
 #undef UNIMPLEMENTED_I32_SHIFTOP
 #undef UNIMPLEMENTED_I64_SHIFTOP
 
+bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
+  bailout(kUnsupportedArchitecture, "i32_popcnt");
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_popcnt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "i64_popcnt");
+  return true;
+}
+
 void LiftoffAssembler::emit_i32_divs(Register dst, Register lhs, Register rhs,
                                      Label* trap_div_by_zero,
                                      Label* trap_div_unrepresentable) {
@@ -326,10 +397,6 @@ void LiftoffAssembler::emit_i32_remu(Register dst, Register lhs, Register rhs,
   bailout(kUnsupportedArchitecture, "i32_remu");
 }
 
-void LiftoffAssembler::emit_i32_shr(Register dst, Register lhs, int amount) {
-  bailout(kUnsupportedArchitecture, "i32_shr");
-}
-
 bool LiftoffAssembler::emit_i64_divs(LiftoffRegister dst, LiftoffRegister lhs,
                                      LiftoffRegister rhs,
                                      Label* trap_div_by_zero,
@@ -359,14 +426,17 @@ bool LiftoffAssembler::emit_i64_remu(LiftoffRegister dst, LiftoffRegister lhs,
   return true;
 }
 
-void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister lhs,
-                                    int amount) {
-  bailout(kUnsupportedArchitecture, "i64_shr");
+void LiftoffAssembler::emit_i64_clz(LiftoffRegister dst, LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "i64_clz");
 }
 
-void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+void LiftoffAssembler::emit_i64_ctz(LiftoffRegister dst, LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "i64_ctz");
+}
+
+void LiftoffAssembler::emit_u32_to_intptr(Register dst, Register src) {
 #ifdef V8_TARGET_ARCH_PPC64
-  bailout(kUnsupportedArchitecture, "emit_i32_to_intptr");
+  bailout(kUnsupportedArchitecture, "emit_u32_to_intptr");
 #else
 // This is a nop on ppc32.
 #endif
@@ -447,6 +517,11 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   bailout(kUnsupportedArchitecture, "emit_f64_set_cond");
 }
 
+void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4_splat");
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
   bailout(kUnsupportedArchitecture, "StackCheck");
 }
@@ -501,6 +576,8 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   bailout(kUnsupportedArchitecture, "DeallocateStackSlot");
 }
 
+void LiftoffAssembler::DebugBreak() { stop(); }
+
 void LiftoffStackSlots::Construct() {
   asm_->bailout(kUnsupportedArchitecture, "LiftoffStackSlots::Construct");
 }
diff --git a/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h b/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h
index 36267560dda4b7..f18c60a1faeb40 100644
--- a/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h
+++ b/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h
@@ -37,19 +37,11 @@ namespace liftoff {
 //  -----+--------------------+  <-- stack ptr (sp)
 //
 constexpr int32_t kInstanceOffset = 2 * kSystemPointerSize;
-constexpr int32_t kFirstStackSlotOffset =
-    kInstanceOffset + 2 * kSystemPointerSize;
 
-inline int GetStackSlotOffset(uint32_t index) {
-  return kFirstStackSlotOffset + index * LiftoffAssembler::kStackSlotSize;
-}
-
-inline MemOperand GetHalfStackSlot(uint32_t index, RegPairHalf half) {
+inline MemOperand GetHalfStackSlot(int offset, RegPairHalf half) {
   int32_t half_offset =
       half == kLowWord ? 0 : LiftoffAssembler::kStackSlotSize / 2;
-  int32_t offset = kFirstStackSlotOffset +
-                   index * LiftoffAssembler::kStackSlotSize - half_offset;
-  return MemOperand(fp, -offset);
+  return MemOperand(fp, -offset + half_offset);
 }
 
 }  // namespace liftoff
@@ -59,8 +51,7 @@ int LiftoffAssembler::PrepareStackFrame() {
   return 0;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(int offset,
-                                              uint32_t stack_slots) {
+void LiftoffAssembler::PatchPrepareStackFrame(int offset, int frame_size) {
   bailout(kUnsupportedArchitecture, "PatchPrepareStackFrame");
 }
 
@@ -68,6 +59,30 @@ void LiftoffAssembler::FinishCode() {}
 
 void LiftoffAssembler::AbortCompilation() {}
 
+// static
+constexpr int LiftoffAssembler::StaticStackFrameSize() {
+  return liftoff::kInstanceOffset;
+}
+
+int LiftoffAssembler::SlotSizeForType(ValueType type) {
+  switch (type) {
+    case kWasmS128:
+      return ValueTypes::ElementSizeInBytes(type);
+    default:
+      return kStackSlotSize;
+  }
+}
+
+bool LiftoffAssembler::NeedsAlignment(ValueType type) {
+  switch (type) {
+    case kWasmS128:
+      return true;
+    default:
+      // No alignment because all other types are kStackSlotSize.
+      return false;
+  }
+}
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   bailout(kUnsupportedArchitecture, "LoadConstant");
@@ -112,13 +127,55 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
   bailout(kUnsupportedArchitecture, "Store");
 }
 
+void LiftoffAssembler::AtomicLoad(LiftoffRegister dst, Register src_addr,
+                                  Register offset_reg, uint32_t offset_imm,
+                                  LoadType type, LiftoffRegList pinned) {
+  bailout(kAtomics, "AtomicLoad");
+}
+
+void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
+                                   uint32_t offset_imm, LiftoffRegister src,
+                                   StoreType type, LiftoffRegList pinned) {
+  bailout(kAtomics, "AtomicStore");
+}
+
+void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAdd");
+}
+
+void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicSub");
+}
+
+void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicAnd");
+}
+
+void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
+                                uint32_t offset_imm, LiftoffRegister value,
+                                StoreType type) {
+  bailout(kAtomics, "AtomicOr");
+}
+
+void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  bailout(kAtomics, "AtomicXor");
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
   bailout(kUnsupportedArchitecture, "LoadCallerFrameSlot");
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
   bailout(kUnsupportedArchitecture, "MoveStackValue");
 }
@@ -132,48 +189,50 @@ void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
   bailout(kUnsupportedArchitecture, "Move DoubleRegister");
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
-                             ValueType type) {
+void LiftoffAssembler::Spill(int offset, LiftoffRegister reg, ValueType type) {
   bailout(kUnsupportedArchitecture, "Spill register");
 }
 
-void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
+void LiftoffAssembler::Spill(int offset, WasmValue value) {
   bailout(kUnsupportedArchitecture, "Spill value");
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
-                            ValueType type) {
+void LiftoffAssembler::Fill(LiftoffRegister reg, int offset, ValueType type) {
   bailout(kUnsupportedArchitecture, "Fill");
 }
 
-void LiftoffAssembler::FillI64Half(Register, uint32_t index, RegPairHalf) {
+void LiftoffAssembler::FillI64Half(Register, int offset, RegPairHalf) {
   bailout(kUnsupportedArchitecture, "FillI64Half");
 }
 
-void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
-  DCHECK_LT(0, count);
-  uint32_t last_stack_slot = index + count - 1;
-  RecordUsedSpillSlot(last_stack_slot);
+void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
+  DCHECK_LT(0, size);
+  RecordUsedSpillOffset(start + size);
 
   // We need a zero reg. Always use r0 for that, and push it before to restore
   // its value afterwards.
   push(r0);
   mov(r0, Operand(0));
 
-  if (count <= 5) {
+  if (size <= 5 * kStackSlotSize) {
     // Special straight-line code for up to five slots. Generates two
     // instructions per slot.
-    for (uint32_t offset = 0; offset < count; ++offset) {
-      StoreP(r0, liftoff::GetHalfStackSlot(index + offset, kLowWord));
-      StoreP(r0, liftoff::GetHalfStackSlot(index + offset, kHighWord));
+    uint32_t remainder = size;
+    for (; remainder >= kStackSlotSize; remainder -= kStackSlotSize) {
+      StoreP(r0, liftoff::GetHalfStackSlot(start + remainder, kLowWord));
+      StoreP(r0, liftoff::GetHalfStackSlot(start + remainder, kHighWord));
+    }
+    DCHECK(remainder == 4 || remainder == 0);
+    if (remainder) {
+      StoreP(r0, liftoff::GetHalfStackSlot(start + remainder, kLowWord));
     }
   } else {
     // General case for bigger counts (9 instructions).
     // Use r3 for start address (inclusive), r4 for end address (exclusive).
     push(r3);
     push(r4);
-    SubP(r3, fp, Operand(liftoff::GetStackSlotOffset(last_stack_slot)));
-    SubP(r4, fp, Operand(liftoff::GetStackSlotOffset(index) + kStackSlotSize));
+    SubP(r3, fp, Operand(start + size));
+    SubP(r4, fp, Operand(start));
 
     Label loop;
     bind(&loop);
@@ -212,9 +271,8 @@ void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
     bailout(kUnsupportedArchitecture, "i64 binop_i: " #name);                  \
   }
 #define UNIMPLEMENTED_GP_UNOP(name)                                \
-  bool LiftoffAssembler::emit_##name(Register dst, Register src) { \
+  void LiftoffAssembler::emit_##name(Register dst, Register src) { \
     bailout(kUnsupportedArchitecture, "gp unop: " #name);          \
-    return true;                                                   \
   }
 #define UNIMPLEMENTED_FP_BINOP(name)                                         \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister lhs, \
@@ -230,14 +288,22 @@ void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
     bailout(kUnsupportedArchitecture, "fp unop: " #name);                      \
     return true;                                                               \
   }
-#define UNIMPLEMENTED_I32_SHIFTOP(name)                                        \
-  void LiftoffAssembler::emit_##name(Register dst, Register src,               \
-                                     Register amount, LiftoffRegList pinned) { \
-    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);                  \
+#define UNIMPLEMENTED_I32_SHIFTOP(name)                          \
+  void LiftoffAssembler::emit_##name(Register dst, Register src, \
+                                     Register amount) {          \
+    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);    \
+  }                                                              \
+  void LiftoffAssembler::emit_##name(Register dst, Register src, \
+                                     int32_t amount) {           \
+    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);    \
   }
 #define UNIMPLEMENTED_I64_SHIFTOP(name)                                        \
   void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
-                                     Register amount, LiftoffRegList pinned) { \
+                                     Register amount) {                        \
+    bailout(kUnsupportedArchitecture, "i64 shiftop: " #name);                  \
+  }                                                                            \
+  void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
+                                     int32_t amount) {                         \
     bailout(kUnsupportedArchitecture, "i64 shiftop: " #name);                  \
   }
 
@@ -263,7 +329,6 @@ UNIMPLEMENTED_I64_SHIFTOP(i64_sar)
 UNIMPLEMENTED_I64_SHIFTOP(i64_shr)
 UNIMPLEMENTED_GP_UNOP(i32_clz)
 UNIMPLEMENTED_GP_UNOP(i32_ctz)
-UNIMPLEMENTED_GP_UNOP(i32_popcnt)
 UNIMPLEMENTED_FP_BINOP(f32_add)
 UNIMPLEMENTED_FP_BINOP(f32_sub)
 UNIMPLEMENTED_FP_BINOP(f32_mul)
@@ -304,6 +369,17 @@ UNIMPLEMENTED_FP_UNOP(f64_sqrt)
 #undef UNIMPLEMENTED_I32_SHIFTOP
 #undef UNIMPLEMENTED_I64_SHIFTOP
 
+bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
+  bailout(kUnsupportedArchitecture, "i32_popcnt");
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_popcnt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "i64_popcnt");
+  return true;
+}
+
 void LiftoffAssembler::emit_i32_divs(Register dst, Register lhs, Register rhs,
                                      Label* trap_div_by_zero,
                                      Label* trap_div_unrepresentable) {
@@ -325,10 +401,6 @@ void LiftoffAssembler::emit_i32_remu(Register dst, Register lhs, Register rhs,
   bailout(kUnsupportedArchitecture, "i32_remu");
 }
 
-void LiftoffAssembler::emit_i32_shr(Register dst, Register lhs, int amount) {
-  bailout(kUnsupportedArchitecture, "i32_shr");
-}
-
 bool LiftoffAssembler::emit_i64_divs(LiftoffRegister dst, LiftoffRegister lhs,
                                      LiftoffRegister rhs,
                                      Label* trap_div_by_zero,
@@ -358,14 +430,17 @@ bool LiftoffAssembler::emit_i64_remu(LiftoffRegister dst, LiftoffRegister lhs,
   return true;
 }
 
-void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister lhs,
-                                    int amount) {
-  bailout(kUnsupportedArchitecture, "i64_shr");
+void LiftoffAssembler::emit_i64_clz(LiftoffRegister dst, LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "i64_clz");
 }
 
-void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+void LiftoffAssembler::emit_i64_ctz(LiftoffRegister dst, LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "i64_ctz");
+}
+
+void LiftoffAssembler::emit_u32_to_intptr(Register dst, Register src) {
 #ifdef V8_TARGET_ARCH_S390X
-  bailout(kUnsupportedArchitecture, "emit_i32_to_intptr");
+  bailout(kUnsupportedArchitecture, "emit_u32_to_intptr");
 #else
 // This is a nop on s390.
 #endif
@@ -446,6 +521,11 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   bailout(kUnsupportedArchitecture, "emit_f64_set_cond");
 }
 
+void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4_splat");
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
   bailout(kUnsupportedArchitecture, "StackCheck");
 }
@@ -500,6 +580,8 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   bailout(kUnsupportedArchitecture, "DeallocateStackSlot");
 }
 
+void LiftoffAssembler::DebugBreak() { stop(); }
+
 void LiftoffStackSlots::Construct() {
   asm_->bailout(kUnsupportedArchitecture, "LiftoffStackSlots::Construct");
 }
diff --git a/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h b/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
index f4185de0700a37..e760f275fb1d18 100644
--- a/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
+++ b/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
@@ -14,11 +14,8 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-#define REQUIRE_CPU_FEATURE(name, ...)        \
-  if (!CpuFeatures::IsSupported(name)) {      \
-    bailout(kMissingCPUFeature, "no " #name); \
-    return __VA_ARGS__;                       \
-  }                                           \
+#define RETURN_FALSE_IF_MISSING_CPU_FEATURE(name)    \
+  if (!CpuFeatures::IsSupported(name)) return false; \
   CpuFeatureScope feature(this, name);
 
 namespace liftoff {
@@ -26,29 +23,23 @@ namespace liftoff {
 constexpr Register kScratchRegister2 = r11;
 static_assert(kScratchRegister != kScratchRegister2, "collision");
 static_assert((kLiftoffAssemblerGpCacheRegs &
-               Register::ListOf<kScratchRegister, kScratchRegister2>()) == 0,
+               Register::ListOf(kScratchRegister, kScratchRegister2)) == 0,
               "scratch registers must not be used as cache registers");
 
 constexpr DoubleRegister kScratchDoubleReg2 = xmm14;
 static_assert(kScratchDoubleReg != kScratchDoubleReg2, "collision");
-static_assert(
-    (kLiftoffAssemblerFpCacheRegs &
-     DoubleRegister::ListOf<kScratchDoubleReg, kScratchDoubleReg2>()) == 0,
-    "scratch registers must not be used as cache registers");
+static_assert((kLiftoffAssemblerFpCacheRegs &
+               DoubleRegister::ListOf(kScratchDoubleReg, kScratchDoubleReg2)) ==
+                  0,
+              "scratch registers must not be used as cache registers");
 
-// rbp-8 holds the stack marker, rbp-16 is the instance parameter, first stack
-// slot is located at rbp-24.
-constexpr int32_t kConstantStackSpace = 16;
-constexpr int32_t kFirstStackSlotOffset =
-    kConstantStackSpace + LiftoffAssembler::kStackSlotSize;
+// rbp-8 holds the stack marker, rbp-16 is the instance parameter.
+constexpr int kInstanceOffset = 16;
 
-inline Operand GetStackSlot(uint32_t index) {
-  int32_t offset = index * LiftoffAssembler::kStackSlotSize;
-  return Operand(rbp, -kFirstStackSlotOffset - offset);
-}
+inline Operand GetStackSlot(int offset) { return Operand(rbp, -offset); }
 
 // TODO(clemensb): Make this a constexpr variable once Operand is constexpr.
-inline Operand GetInstanceOperand() { return Operand(rbp, -16); }
+inline Operand GetInstanceOperand() { return GetStackSlot(kInstanceOffset); }
 
 inline Operand GetMemOp(LiftoffAssembler* assm, Register addr, Register offset,
                         uint32_t offset_imm) {
@@ -142,10 +133,9 @@ int LiftoffAssembler::PrepareStackFrame() {
   return offset;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(int offset,
-                                              uint32_t stack_slots) {
-  uint32_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
-  DCHECK_LE(bytes, kMaxInt);
+void LiftoffAssembler::PatchPrepareStackFrame(int offset, int frame_size) {
+  // Need to align sp to system pointer size.
+  frame_size = RoundUp(frame_size, kSystemPointerSize);
   // We can't run out of space, just pass anything big enough to not cause the
   // assembler to try to grow the buffer.
   constexpr int kAvailableSpace = 64;
@@ -153,7 +143,7 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
       AssemblerOptions{},
       ExternalAssemblerBuffer(buffer_start_ + offset, kAvailableSpace));
 #if V8_OS_WIN
-  if (bytes > kStackPageSize) {
+  if (frame_size > kStackPageSize) {
     // Generate OOL code (at the end of the function, where the current
     // assembler is pointing) to do the explicit stack limit check (see
     // https://docs.microsoft.com/en-us/previous-versions/visualstudio/visual-studio-6.0/aa227153(v=vs.60)).
@@ -166,7 +156,7 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
                            patching_assembler.pc_offset());
 
     // Now generate the OOL code.
-    AllocateStackSpace(bytes);
+    AllocateStackSpace(frame_size);
     // Jump back to the start of the function (from {pc_offset()} to {offset +
     // kSubSpSize}).
     int func_start_offset = offset + liftoff::kSubSpSize - pc_offset();
@@ -174,7 +164,7 @@ void LiftoffAssembler::PatchPrepareStackFrame(int offset,
     return;
   }
 #endif
-  patching_assembler.sub_sp_32(bytes);
+  patching_assembler.sub_sp_32(frame_size);
   DCHECK_EQ(liftoff::kSubSpSize, patching_assembler.pc_offset());
 }
 
@@ -182,6 +172,17 @@ void LiftoffAssembler::FinishCode() {}
 
 void LiftoffAssembler::AbortCompilation() {}
 
+// static
+constexpr int LiftoffAssembler::StaticStackFrameSize() {
+  return liftoff::kInstanceOffset;
+}
+
+int LiftoffAssembler::SlotSizeForType(ValueType type) {
+  return ValueTypes::ElementSizeInBytes(type);
+}
+
+bool LiftoffAssembler::NeedsAlignment(ValueType type) { return false; }
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   switch (value.type()) {
@@ -248,6 +249,12 @@ void LiftoffAssembler::LoadTaggedPointer(Register dst, Register src_addr,
   LoadTaggedPointerField(dst, src_op);
 }
 
+void LiftoffAssembler::AtomicLoad(LiftoffRegister dst, Register src_addr,
+                                  Register offset_reg, uint32_t offset_imm,
+                                  LoadType type, LiftoffRegList pinned) {
+  Load(dst, src_addr, offset_reg, offset_imm, type, pinned, nullptr, true);
+}
+
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
@@ -294,6 +301,9 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
     case LoadType::kF64Load:
       Movsd(dst.fp(), src_op);
       break;
+    case LoadType::kS128Load:
+      Movdqu(dst.fp(), src_op);
+      break;
     default:
       UNREACHABLE();
   }
@@ -330,11 +340,232 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
     case StoreType::kF64Store:
       Movsd(dst_op, src.fp());
       break;
+    case StoreType::kS128Store:
+      Movdqu(dst_op, src.fp());
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
+                                   uint32_t offset_imm, LiftoffRegister src,
+                                   StoreType type, LiftoffRegList pinned) {
+  if (emit_debug_code() && offset_reg != no_reg) {
+    AssertZeroExtended(offset_reg);
+  }
+  Operand dst_op = liftoff::GetMemOp(this, dst_addr, offset_reg, offset_imm);
+  Register src_reg = src.gp();
+  if (cache_state()->is_used(src)) {
+    movq(kScratchRegister, src_reg);
+    src_reg = kScratchRegister;
+  }
+  switch (type.value()) {
+    case StoreType::kI32Store8:
+    case StoreType::kI64Store8:
+      xchgb(src_reg, dst_op);
+      break;
+    case StoreType::kI32Store16:
+    case StoreType::kI64Store16:
+      xchgw(src_reg, dst_op);
+      break;
+    case StoreType::kI32Store:
+    case StoreType::kI64Store32:
+      xchgl(src_reg, dst_op);
+      break;
+    case StoreType::kI64Store:
+      xchgq(src_reg, dst_op);
+      break;
     default:
       UNREACHABLE();
   }
 }
 
+void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  DCHECK(!cache_state()->is_used(value));
+  if (emit_debug_code() && offset_reg != no_reg) {
+    AssertZeroExtended(offset_reg);
+  }
+  Operand dst_op = liftoff::GetMemOp(this, dst_addr, offset_reg, offset_imm);
+  lock();
+  switch (type.value()) {
+    case StoreType::kI32Store8:
+    case StoreType::kI64Store8:
+      xaddb(dst_op, value.gp());
+      movzxbq(value.gp(), value.gp());
+      break;
+    case StoreType::kI32Store16:
+    case StoreType::kI64Store16:
+      xaddw(dst_op, value.gp());
+      movzxwq(value.gp(), value.gp());
+      break;
+    case StoreType::kI32Store:
+    case StoreType::kI64Store32:
+      xaddl(dst_op, value.gp());
+      break;
+    case StoreType::kI64Store:
+      xaddq(dst_op, value.gp());
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  DCHECK(!cache_state()->is_used(value));
+  if (emit_debug_code() && offset_reg != no_reg) {
+    AssertZeroExtended(offset_reg);
+  }
+  Operand dst_op = liftoff::GetMemOp(this, dst_addr, offset_reg, offset_imm);
+  switch (type.value()) {
+    case StoreType::kI32Store8:
+    case StoreType::kI64Store8:
+      negb(value.gp());
+      lock();
+      xaddb(dst_op, value.gp());
+      movzxbq(value.gp(), value.gp());
+      break;
+    case StoreType::kI32Store16:
+    case StoreType::kI64Store16:
+      negw(value.gp());
+      lock();
+      xaddw(dst_op, value.gp());
+      movzxwq(value.gp(), value.gp());
+      break;
+    case StoreType::kI32Store:
+    case StoreType::kI64Store32:
+      negl(value.gp());
+      lock();
+      xaddl(dst_op, value.gp());
+      break;
+    case StoreType::kI64Store:
+      negq(value.gp());
+      lock();
+      xaddq(dst_op, value.gp());
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+namespace liftoff {
+inline void AtomicBinop(LiftoffAssembler* lasm,
+                        void (Assembler::*opl)(Register, Register),
+                        void (Assembler::*opq)(Register, Register),
+                        Register dst_addr, Register offset_reg,
+                        uint32_t offset_imm, LiftoffRegister value,
+                        StoreType type) {
+#define __ lasm->
+  DCHECK(!__ cache_state()->is_used(value));
+  // The cmpxchg instruction uses rax to store the old value of the
+  // compare-exchange primitive. Therefore we have to spill the register and
+  // move any use to another register.
+  liftoff::SpillRegisters(lasm, rax);
+  Register value_reg = value.gp();
+  LiftoffRegList pinned =
+      LiftoffRegList::ForRegs(dst_addr, offset_reg, value_reg);
+  if (pinned.has(rax)) {
+    Register replacement =
+        pinned.set(__ GetUnusedRegister(kGpReg, pinned)).gp();
+    for (Register* reg : {&dst_addr, &offset_reg, &value_reg}) {
+      if (*reg == rax) {
+        *reg = replacement;
+      }
+    }
+    __ movq(replacement, rax);
+  }
+
+  if (__ emit_debug_code() && offset_reg != no_reg) {
+    __ AssertZeroExtended(offset_reg);
+  }
+  Operand dst_op = liftoff::GetMemOp(lasm, dst_addr, offset_reg, offset_imm);
+
+  switch (type.value()) {
+    case StoreType::kI32Store8:
+    case StoreType::kI64Store8: {
+      Label binop;
+      __ xorq(rax, rax);
+      __ movb(rax, dst_op);
+      __ bind(&binop);
+      __ movl(kScratchRegister, rax);
+      (lasm->*opl)(kScratchRegister, value_reg);
+      __ lock();
+      __ cmpxchgb(dst_op, kScratchRegister);
+      __ j(not_equal, &binop);
+      break;
+    }
+    case StoreType::kI32Store16:
+    case StoreType::kI64Store16: {
+      Label binop;
+      __ xorq(rax, rax);
+      __ movw(rax, dst_op);
+      __ bind(&binop);
+      __ movl(kScratchRegister, rax);
+      (lasm->*opl)(kScratchRegister, value_reg);
+      __ lock();
+      __ cmpxchgw(dst_op, kScratchRegister);
+      __ j(not_equal, &binop);
+      break;
+    }
+    case StoreType::kI32Store:
+    case StoreType::kI64Store32: {
+      Label binop;
+      __ movl(rax, dst_op);
+      __ bind(&binop);
+      __ movl(kScratchRegister, rax);
+      (lasm->*opl)(kScratchRegister, value_reg);
+      __ lock();
+      __ cmpxchgl(dst_op, kScratchRegister);
+      __ j(not_equal, &binop);
+      break;
+    }
+    case StoreType::kI64Store: {
+      Label binop;
+      __ movq(rax, dst_op);
+      __ bind(&binop);
+      __ movq(kScratchRegister, rax);
+      (lasm->*opq)(kScratchRegister, value_reg);
+      __ lock();
+      __ cmpxchgq(dst_op, kScratchRegister);
+      __ j(not_equal, &binop);
+      break;
+    }
+    default:
+      UNREACHABLE();
+  }
+
+  if (value.gp() != rax) {
+    __ movq(value.gp(), rax);
+  }
+}
+#undef __
+}  // namespace liftoff
+
+void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  liftoff::AtomicBinop(this, &Assembler::andl, &Assembler::andq, dst_addr,
+                       offset_reg, offset_imm, value, type);
+}
+
+void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
+                                uint32_t offset_imm, LiftoffRegister value,
+                                StoreType type) {
+  liftoff::AtomicBinop(this, &Assembler::orl, &Assembler::orq, dst_addr,
+                       offset_reg, offset_imm, value, type);
+}
+
+void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
+                                 uint32_t offset_imm, LiftoffRegister value,
+                                 StoreType type) {
+  liftoff::AtomicBinop(this, &Assembler::xorl, &Assembler::xorq, dst_addr,
+                       offset_reg, offset_imm, value, type);
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
@@ -342,11 +573,11 @@ void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
   liftoff::Load(this, dst, src, type);
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
-  DCHECK_NE(dst_index, src_index);
-  Operand src = liftoff::GetStackSlot(src_index);
-  Operand dst = liftoff::GetStackSlot(dst_index);
+  DCHECK_NE(dst_offset, src_offset);
+  Operand dst = liftoff::GetStackSlot(dst_offset);
+  Operand src = liftoff::GetStackSlot(src_offset);
   if (ValueTypes::ElementSizeLog2Of(type) == 2) {
     movl(kScratchRegister, src);
     movl(dst, kScratchRegister);
@@ -372,16 +603,17 @@ void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
   DCHECK_NE(dst, src);
   if (type == kWasmF32) {
     Movss(dst, src);
-  } else {
-    DCHECK_EQ(kWasmF64, type);
+  } else if (type == kWasmF64) {
     Movsd(dst, src);
+  } else {
+    DCHECK_EQ(kWasmS128, type);
+    Movapd(dst, src);
   }
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
-                             ValueType type) {
-  RecordUsedSpillSlot(index);
-  Operand dst = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Spill(int offset, LiftoffRegister reg, ValueType type) {
+  RecordUsedSpillOffset(offset);
+  Operand dst = liftoff::GetStackSlot(offset);
   switch (type) {
     case kWasmI32:
       movl(dst, reg.gp());
@@ -395,14 +627,17 @@ void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
     case kWasmF64:
       Movsd(dst, reg.fp());
       break;
+    case kWasmS128:
+      Movdqu(dst, reg.fp());
+      break;
     default:
       UNREACHABLE();
   }
 }
 
-void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
-  RecordUsedSpillSlot(index);
-  Operand dst = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Spill(int offset, WasmValue value) {
+  RecordUsedSpillOffset(offset);
+  Operand dst = liftoff::GetStackSlot(offset);
   switch (value.type()) {
     case kWasmI32:
       movl(dst, Immediate(value.to_i32()));
@@ -427,9 +662,8 @@ void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
   }
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
-                            ValueType type) {
-  Operand src = liftoff::GetStackSlot(index);
+void LiftoffAssembler::Fill(LiftoffRegister reg, int offset, ValueType type) {
+  Operand src = liftoff::GetStackSlot(offset);
   switch (type) {
     case kWasmI32:
       movl(reg.gp(), src);
@@ -443,38 +677,46 @@ void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
     case kWasmF64:
       Movsd(reg.fp(), src);
       break;
+    case kWasmS128:
+      Movdqu(reg.fp(), src);
+      break;
     default:
       UNREACHABLE();
   }
 }
 
-void LiftoffAssembler::FillI64Half(Register, uint32_t index, RegPairHalf) {
+void LiftoffAssembler::FillI64Half(Register, int offset, RegPairHalf) {
   UNREACHABLE();
 }
 
-void LiftoffAssembler::FillStackSlotsWithZero(uint32_t index, uint32_t count) {
-  DCHECK_LT(0, count);
-  uint32_t last_stack_slot = index + count - 1;
-  RecordUsedSpillSlot(last_stack_slot);
+void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
+  DCHECK_LT(0, size);
+  RecordUsedSpillOffset(start + size);
 
-  if (count <= 3) {
+  if (size <= 3 * kStackSlotSize) {
     // Special straight-line code for up to three slots
-    // (7-10 bytes per slot: REX C7 <1-4 bytes op> <4 bytes imm>).
-    for (uint32_t offset = 0; offset < count; ++offset) {
-      movq(liftoff::GetStackSlot(index + offset), Immediate(0));
+    // (7-10 bytes per slot: REX C7 <1-4 bytes op> <4 bytes imm>),
+    // And a movd (6-9 byte) when size % 8 != 0;
+    uint32_t remainder = size;
+    for (; remainder >= kStackSlotSize; remainder -= kStackSlotSize) {
+      movq(liftoff::GetStackSlot(start + remainder), Immediate(0));
+    }
+    DCHECK(remainder == 4 || remainder == 0);
+    if (remainder) {
+      movl(liftoff::GetStackSlot(start + remainder), Immediate(0));
     }
   } else {
     // General case for bigger counts.
-    // This sequence takes 20-23 bytes (3 for pushes, 4-7 for lea, 2 for xor, 5
-    // for mov, 3 for repstosq, 3 for pops).
-    // From intel manual: repstosq fills RCX quadwords at [RDI] with RAX.
+    // This sequence takes 19-22 bytes (3 for pushes, 4-7 for lea, 2 for xor, 5
+    // for mov, 2 for repstosl, 3 for pops).
     pushq(rax);
     pushq(rcx);
     pushq(rdi);
-    leaq(rdi, liftoff::GetStackSlot(last_stack_slot));
+    leaq(rdi, liftoff::GetStackSlot(start + size));
     xorl(rax, rax);
-    movl(rcx, Immediate(count));
-    repstosq();
+    // Convert size (bytes) to doublewords (4-bytes).
+    movl(rcx, Immediate(size / 4));
+    repstosl();
     popq(rdi);
     popq(rcx);
     popq(rax);
@@ -684,8 +926,7 @@ namespace liftoff {
 template <ValueType type>
 inline void EmitShiftOperation(LiftoffAssembler* assm, Register dst,
                                Register src, Register amount,
-                               void (Assembler::*emit_shift)(Register),
-                               LiftoffRegList pinned) {
+                               void (Assembler::*emit_shift)(Register)) {
   // If dst is rcx, compute into the scratch register first, then move to rcx.
   if (dst == rcx) {
     assm->Move(kScratchRegister, src, type);
@@ -699,9 +940,8 @@ inline void EmitShiftOperation(LiftoffAssembler* assm, Register dst,
   // register. If src is rcx, src is now the scratch register.
   bool use_scratch = false;
   if (amount != rcx) {
-    use_scratch = src == rcx ||
-                  assm->cache_state()->is_used(LiftoffRegister(rcx)) ||
-                  pinned.has(LiftoffRegister(rcx));
+    use_scratch =
+        src == rcx || assm->cache_state()->is_used(LiftoffRegister(rcx));
     if (use_scratch) assm->movq(kScratchRegister, rcx);
     if (src == rcx) src = kScratchRegister;
     assm->Move(rcx, amount, type);
@@ -716,62 +956,48 @@ inline void EmitShiftOperation(LiftoffAssembler* assm, Register dst,
 }
 }  // namespace liftoff
 
-void LiftoffAssembler::emit_i32_shl(Register dst, Register src, Register amount,
-                                    LiftoffRegList pinned) {
+void LiftoffAssembler::emit_i32_shl(Register dst, Register src,
+                                    Register amount) {
   liftoff::EmitShiftOperation<kWasmI32>(this, dst, src, amount,
-                                        &Assembler::shll_cl, pinned);
+                                        &Assembler::shll_cl);
 }
 
-void LiftoffAssembler::emit_i32_sar(Register dst, Register src, Register amount,
-                                    LiftoffRegList pinned) {
-  liftoff::EmitShiftOperation<kWasmI32>(this, dst, src, amount,
-                                        &Assembler::sarl_cl, pinned);
+void LiftoffAssembler::emit_i32_shl(Register dst, Register src,
+                                    int32_t amount) {
+  if (dst != src) movl(dst, src);
+  shll(dst, Immediate(amount & 31));
 }
 
-void LiftoffAssembler::emit_i32_shr(Register dst, Register src, Register amount,
-                                    LiftoffRegList pinned) {
+void LiftoffAssembler::emit_i32_sar(Register dst, Register src,
+                                    Register amount) {
   liftoff::EmitShiftOperation<kWasmI32>(this, dst, src, amount,
-                                        &Assembler::shrl_cl, pinned);
+                                        &Assembler::sarl_cl);
 }
 
-void LiftoffAssembler::emit_i32_shr(Register dst, Register src, int amount) {
+void LiftoffAssembler::emit_i32_sar(Register dst, Register src,
+                                    int32_t amount) {
   if (dst != src) movl(dst, src);
-  DCHECK(is_uint5(amount));
-  shrl(dst, Immediate(amount));
+  sarl(dst, Immediate(amount & 31));
 }
 
-bool LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
-  Label nonzero_input;
-  Label continuation;
-  testl(src, src);
-  j(not_zero, &nonzero_input, Label::kNear);
-  movl(dst, Immediate(32));
-  jmp(&continuation, Label::kNear);
-
-  bind(&nonzero_input);
-  // Get most significant bit set (MSBS).
-  bsrl(dst, src);
-  // CLZ = 31 - MSBS = MSBS ^ 31.
-  xorl(dst, Immediate(31));
-
-  bind(&continuation);
-  return true;
+void LiftoffAssembler::emit_i32_shr(Register dst, Register src,
+                                    Register amount) {
+  liftoff::EmitShiftOperation<kWasmI32>(this, dst, src, amount,
+                                        &Assembler::shrl_cl);
 }
 
-bool LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
-  Label nonzero_input;
-  Label continuation;
-  testl(src, src);
-  j(not_zero, &nonzero_input, Label::kNear);
-  movl(dst, Immediate(32));
-  jmp(&continuation, Label::kNear);
+void LiftoffAssembler::emit_i32_shr(Register dst, Register src,
+                                    int32_t amount) {
+  if (dst != src) movl(dst, src);
+  shrl(dst, Immediate(amount & 31));
+}
 
-  bind(&nonzero_input);
-  // Get least significant bit set, which equals number of trailing zeros.
-  bsfl(dst, src);
+void LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
+  Lzcntl(dst, src);
+}
 
-  bind(&continuation);
-  return true;
+void LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
+  Tzcntl(dst, src);
 }
 
 bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
@@ -887,32 +1113,59 @@ void LiftoffAssembler::emit_i64_xor(LiftoffRegister dst, LiftoffRegister lhs,
 }
 
 void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
-                                    Register amount, LiftoffRegList pinned) {
+                                    Register amount) {
   liftoff::EmitShiftOperation<kWasmI64>(this, dst.gp(), src.gp(), amount,
-                                        &Assembler::shlq_cl, pinned);
+                                        &Assembler::shlq_cl);
+}
+
+void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
+                                    int32_t amount) {
+  if (dst.gp() != src.gp()) movq(dst.gp(), src.gp());
+  shlq(dst.gp(), Immediate(amount & 63));
 }
 
 void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
-                                    Register amount, LiftoffRegList pinned) {
+                                    Register amount) {
   liftoff::EmitShiftOperation<kWasmI64>(this, dst.gp(), src.gp(), amount,
-                                        &Assembler::sarq_cl, pinned);
+                                        &Assembler::sarq_cl);
+}
+
+void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
+                                    int32_t amount) {
+  if (dst.gp() != src.gp()) movq(dst.gp(), src.gp());
+  sarq(dst.gp(), Immediate(amount & 63));
 }
 
 void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                                    Register amount, LiftoffRegList pinned) {
+                                    Register amount) {
   liftoff::EmitShiftOperation<kWasmI64>(this, dst.gp(), src.gp(), amount,
-                                        &Assembler::shrq_cl, pinned);
+                                        &Assembler::shrq_cl);
 }
 
 void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                                    int amount) {
-  if (dst.gp() != src.gp()) movl(dst.gp(), src.gp());
-  DCHECK(is_uint6(amount));
-  shrq(dst.gp(), Immediate(amount));
+                                    int32_t amount) {
+  if (dst != src) movq(dst.gp(), src.gp());
+  shrq(dst.gp(), Immediate(amount & 63));
+}
+
+void LiftoffAssembler::emit_i64_clz(LiftoffRegister dst, LiftoffRegister src) {
+  Lzcntq(dst.gp(), src.gp());
 }
 
-void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
-  movsxlq(dst, src);
+void LiftoffAssembler::emit_i64_ctz(LiftoffRegister dst, LiftoffRegister src) {
+  Tzcntq(dst.gp(), src.gp());
+}
+
+bool LiftoffAssembler::emit_i64_popcnt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  if (!CpuFeatures::IsSupported(POPCNT)) return false;
+  CpuFeatureScope scope(this, POPCNT);
+  popcntq(dst.gp(), src.gp());
+  return true;
+}
+
+void LiftoffAssembler::emit_u32_to_intptr(Register dst, Register src) {
+  movl(dst, src);
 }
 
 void LiftoffAssembler::emit_f32_add(DoubleRegister dst, DoubleRegister lhs,
@@ -1074,40 +1327,28 @@ void LiftoffAssembler::emit_f32_neg(DoubleRegister dst, DoubleRegister src) {
 }
 
 bool LiftoffAssembler::emit_f32_ceil(DoubleRegister dst, DoubleRegister src) {
-  if (CpuFeatures::IsSupported(SSE4_1)) {
-    CpuFeatureScope feature(this, SSE4_1);
-    Roundss(dst, src, kRoundUp);
-    return true;
-  }
-  return false;
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
+  Roundss(dst, src, kRoundUp);
+  return true;
 }
 
 bool LiftoffAssembler::emit_f32_floor(DoubleRegister dst, DoubleRegister src) {
-  if (CpuFeatures::IsSupported(SSE4_1)) {
-    CpuFeatureScope feature(this, SSE4_1);
-    Roundss(dst, src, kRoundDown);
-    return true;
-  }
-  return false;
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
+  Roundss(dst, src, kRoundDown);
+  return true;
 }
 
 bool LiftoffAssembler::emit_f32_trunc(DoubleRegister dst, DoubleRegister src) {
-  if (CpuFeatures::IsSupported(SSE4_1)) {
-    CpuFeatureScope feature(this, SSE4_1);
-    Roundss(dst, src, kRoundToZero);
-    return true;
-  }
-  return false;
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
+  Roundss(dst, src, kRoundToZero);
+  return true;
 }
 
 bool LiftoffAssembler::emit_f32_nearest_int(DoubleRegister dst,
                                             DoubleRegister src) {
-  if (CpuFeatures::IsSupported(SSE4_1)) {
-    CpuFeatureScope feature(this, SSE4_1);
-    Roundss(dst, src, kRoundToNearest);
-    return true;
-  }
-  return false;
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
+  Roundss(dst, src, kRoundToNearest);
+  return true;
 }
 
 void LiftoffAssembler::emit_f32_sqrt(DoubleRegister dst, DoubleRegister src) {
@@ -1219,26 +1460,26 @@ void LiftoffAssembler::emit_f64_neg(DoubleRegister dst, DoubleRegister src) {
 }
 
 bool LiftoffAssembler::emit_f64_ceil(DoubleRegister dst, DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1, true);
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
   Roundsd(dst, src, kRoundUp);
   return true;
 }
 
 bool LiftoffAssembler::emit_f64_floor(DoubleRegister dst, DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1, true);
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
   Roundsd(dst, src, kRoundDown);
   return true;
 }
 
 bool LiftoffAssembler::emit_f64_trunc(DoubleRegister dst, DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1, true);
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
   Roundsd(dst, src, kRoundToZero);
   return true;
 }
 
 bool LiftoffAssembler::emit_f64_nearest_int(DoubleRegister dst,
                                             DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1, true);
+  RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
   Roundsd(dst, src, kRoundToNearest);
   return true;
 }
@@ -1347,7 +1588,7 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
       return liftoff::EmitTruncateFloatToInt<int64_t, float>(this, dst.gp(),
                                                              src.fp(), trap);
     case kExprI64UConvertF32: {
-      REQUIRE_CPU_FEATURE(SSE4_1, true);
+      RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
       Cvttss2uiq(dst.gp(), src.fp(), trap);
       return true;
     }
@@ -1355,7 +1596,7 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
       return liftoff::EmitTruncateFloatToInt<int64_t, double>(this, dst.gp(),
                                                               src.fp(), trap);
     case kExprI64UConvertF64: {
-      REQUIRE_CPU_FEATURE(SSE4_1, true);
+      RETURN_FALSE_IF_MISSING_CPU_FEATURE(SSE4_1);
       Cvttsd2uiq(dst.gp(), src.fp(), trap);
       return true;
     }
@@ -1524,6 +1765,14 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
                                                       rhs);
 }
 
+void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  if (dst.fp() != src.fp()) {
+    Movss(dst.fp(), src.fp());
+  }
+  Shufps(dst.fp(), src.fp(), static_cast<byte>(0));
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
   cmpq(rsp, Operand(limit_address, 0));
   j(below_equal, ool_code);
@@ -1548,15 +1797,15 @@ void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
   LiftoffRegList fp_regs = regs & kFpCacheRegList;
   unsigned num_fp_regs = fp_regs.GetNumRegsSet();
   if (num_fp_regs) {
-    AllocateStackSpace(num_fp_regs * kStackSlotSize);
+    AllocateStackSpace(num_fp_regs * kSimd128Size);
     unsigned offset = 0;
     while (!fp_regs.is_empty()) {
       LiftoffRegister reg = fp_regs.GetFirstRegSet();
-      Movsd(Operand(rsp, offset), reg.fp());
+      Movdqu(Operand(rsp, offset), reg.fp());
       fp_regs.clear(reg);
-      offset += sizeof(double);
+      offset += kSimd128Size;
     }
-    DCHECK_EQ(offset, num_fp_regs * sizeof(double));
+    DCHECK_EQ(offset, num_fp_regs * kSimd128Size);
   }
 }
 
@@ -1565,9 +1814,9 @@ void LiftoffAssembler::PopRegisters(LiftoffRegList regs) {
   unsigned fp_offset = 0;
   while (!fp_regs.is_empty()) {
     LiftoffRegister reg = fp_regs.GetFirstRegSet();
-    Movsd(reg.fp(), Operand(rsp, fp_offset));
+    Movdqu(reg.fp(), Operand(rsp, fp_offset));
     fp_regs.clear(reg);
-    fp_offset += sizeof(double);
+    fp_offset += kSimd128Size;
   }
   if (fp_offset) addq(rsp, Immediate(fp_offset));
   LiftoffRegList gp_regs = regs & kGpCacheRegList;
@@ -1659,6 +1908,8 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   addq(rsp, Immediate(size));
 }
 
+void LiftoffAssembler::DebugBreak() { int3(); }
+
 void LiftoffStackSlots::Construct() {
   for (auto& slot : slots_) {
     const LiftoffAssembler::VarState& src = slot.src_;
@@ -1667,14 +1918,14 @@ void LiftoffStackSlots::Construct() {
         if (src.type() == kWasmI32) {
           // Load i32 values to a register first to ensure they are zero
           // extended.
-          asm_->movl(kScratchRegister, liftoff::GetStackSlot(slot.src_index_));
+          asm_->movl(kScratchRegister, liftoff::GetStackSlot(slot.src_offset_));
           asm_->pushq(kScratchRegister);
         } else {
           // For all other types, just push the whole (8-byte) stack slot.
           // This is also ok for f32 values (even though we copy 4 uninitialized
           // bytes), because f32 and f64 values are clearly distinguished in
           // Turbofan, so the uninitialized bytes are never accessed.
-          asm_->pushq(liftoff::GetStackSlot(slot.src_index_));
+          asm_->pushq(liftoff::GetStackSlot(slot.src_offset_));
         }
         break;
       case LiftoffAssembler::VarState::kRegister:
@@ -1687,7 +1938,7 @@ void LiftoffStackSlots::Construct() {
   }
 }
 
-#undef REQUIRE_CPU_FEATURE
+#undef RETURN_FALSE_IF_MISSING_CPU_FEATURE
 
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/src/wasm/c-api.cc b/deps/v8/src/wasm/c-api.cc
index 31b68e9cdc5672..8fdf180182066a 100644
--- a/deps/v8/src/wasm/c-api.cc
+++ b/deps/v8/src/wasm/c-api.cc
@@ -781,9 +781,7 @@ struct implement<Ref> {
   using type = RefImpl<Ref, i::JSReceiver>;
 };
 
-Ref::~Ref() {
-  delete impl(this);
-}
+Ref::~Ref() { delete impl(this); }
 
 void Ref::operator delete(void* p) {}
 
@@ -895,7 +893,7 @@ own<Frame> CreateFrameFromInternal(i::Handle<i::FixedArray> frames, int index,
                                       isolate);
   i::Handle<i::WasmInstanceObject> instance =
       i::StackTraceFrame::GetWasmInstance(frame);
-  uint32_t func_index = i::StackTraceFrame::GetLineNumber(frame);
+  uint32_t func_index = i::StackTraceFrame::GetWasmFunctionIndex(frame);
   size_t func_offset = i::StackTraceFrame::GetFunctionOffset(frame);
   size_t module_offset = i::StackTraceFrame::GetColumnNumber(frame);
   return own<Frame>(seal<Frame>(new (std::nothrow) FrameImpl(
@@ -972,7 +970,7 @@ auto Module::validate(Store* store_abs, const vec<byte_t>& binary) -> bool {
   i::wasm::ModuleWireBytes bytes(
       {reinterpret_cast<const uint8_t*>(binary.get()), binary.size()});
   i::Isolate* isolate = impl(store_abs)->i_isolate();
-  i::wasm::WasmFeatures features = i::wasm::WasmFeaturesFromIsolate(isolate);
+  i::wasm::WasmFeatures features = i::wasm::WasmFeatures::FromIsolate(isolate);
   return isolate->wasm_engine()->SyncValidate(isolate, features, bytes);
 }
 
@@ -982,7 +980,7 @@ auto Module::make(Store* store_abs, const vec<byte_t>& binary) -> own<Module> {
   i::HandleScope scope(isolate);
   i::wasm::ModuleWireBytes bytes(
       {reinterpret_cast<const uint8_t*>(binary.get()), binary.size()});
-  i::wasm::WasmFeatures features = i::wasm::WasmFeaturesFromIsolate(isolate);
+  i::wasm::WasmFeatures features = i::wasm::WasmFeatures::FromIsolate(isolate);
   i::wasm::ErrorThrower thrower(isolate, "ignored");
   i::Handle<i::WasmModuleObject> module;
   if (!isolate->wasm_engine()
@@ -1069,7 +1067,7 @@ auto Module::deserialize(Store* store_abs, const vec<byte_t>& serialized)
   if (!i::wasm::DeserializeNativeModule(
            isolate,
            {reinterpret_cast<const uint8_t*>(ptr + data_size), serial_size},
-           {reinterpret_cast<const uint8_t*>(ptr), data_size})
+           {reinterpret_cast<const uint8_t*>(ptr), data_size}, {})
            .ToHandle(&module_obj)) {
     return nullptr;
   }
@@ -1414,6 +1412,7 @@ void PushArgs(i::wasm::FunctionSig* sig, const Val args[],
         break;
       case i::wasm::kWasmAnyRef:
       case i::wasm::kWasmFuncRef:
+      case i::wasm::kWasmNullRef:
         packer->Push(WasmRefToV8(store->i_isolate(), args[i].ref())->ptr());
         break;
       case i::wasm::kWasmExnRef:
@@ -1445,9 +1444,11 @@ void PopArgs(i::wasm::FunctionSig* sig, Val results[],
         results[i] = Val(packer->Pop<double>());
         break;
       case i::wasm::kWasmAnyRef:
-      case i::wasm::kWasmFuncRef: {
+      case i::wasm::kWasmFuncRef:
+      case i::wasm::kWasmNullRef: {
         i::Address raw = packer->Pop<i::Address>();
         i::Handle<i::Object> obj(i::Object(raw), store->i_isolate());
+        DCHECK_IMPLIES(type == i::wasm::kWasmNullRef, obj->IsNull());
         results[i] = Val(V8RefValueToWasm(store, obj));
         break;
       }
@@ -1561,7 +1562,7 @@ auto Func::call(const Val args[], Val results[]) const -> own<Trap> {
 i::Address FuncData::v8_callback(i::Address host_data_foreign,
                                  i::Address argv) {
   FuncData* self =
-      i::Managed<FuncData>::cast(i::Object(host_data_foreign))->raw();
+      i::Managed<FuncData>::cast(i::Object(host_data_foreign)).raw();
   StoreImpl* store = impl(self->store);
   i::Isolate* isolate = store->i_isolate();
   i::HandleScope scope(isolate);
@@ -1765,7 +1766,8 @@ auto Table::make(Store* store_abs, const TableType* type, const Ref* ref)
       i_type = i::wasm::kWasmFuncRef;
       break;
     case ANYREF:
-      DCHECK(i::wasm::WasmFeaturesFromFlags().anyref);  // See Engine::make().
+      // See Engine::make().
+      DCHECK(i::wasm::WasmFeatures::FromFlags().has_anyref());
       i_type = i::wasm::kWasmAnyRef;
       break;
     default:
@@ -1823,7 +1825,7 @@ auto Table::type() const -> own<TableType> {
 
 auto Table::get(size_t index) const -> own<Ref> {
   i::Handle<i::WasmTableObject> table = impl(this)->v8_object();
-  if (index >= table->current_length()) return own<Ref>();
+  if (index >= static_cast<size_t>(table->current_length())) return own<Ref>();
   i::Isolate* isolate = table->GetIsolate();
   i::HandleScope handle_scope(isolate);
   i::Handle<i::Object> result =
@@ -1836,7 +1838,7 @@ auto Table::get(size_t index) const -> own<Ref> {
 
 auto Table::set(size_t index, const Ref* ref) -> bool {
   i::Handle<i::WasmTableObject> table = impl(this)->v8_object();
-  if (index >= table->current_length()) return false;
+  if (index >= static_cast<size_t>(table->current_length())) return false;
   i::Isolate* isolate = table->GetIsolate();
   i::HandleScope handle_scope(isolate);
   i::Handle<i::Object> obj = WasmRefToV8(isolate, ref);
@@ -1977,7 +1979,7 @@ own<Instance> Instance::make(Store* store_abs, const Module* module_abs,
     if (thrower.error()) {
       *trap = implement<Trap>::type::make(
           store, GetProperException(isolate, thrower.Reify()));
-      DCHECK(!thrower.error());  // Reify() called Reset().
+      DCHECK(!thrower.error());                   // Reify() called Reset().
       DCHECK(!isolate->has_pending_exception());  // Hasn't been thrown yet.
       return own<Instance>();
     } else if (isolate->has_pending_exception()) {
diff --git a/deps/v8/src/wasm/compilation-environment.h b/deps/v8/src/wasm/compilation-environment.h
index 07bc8f57bc80c0..629ebe913e0cec 100644
--- a/deps/v8/src/wasm/compilation-environment.h
+++ b/deps/v8/src/wasm/compilation-environment.h
@@ -72,7 +72,7 @@ struct CompilationEnv {
                                : 0),
         max_memory_size((module && module->has_maximum_pages
                              ? module->maximum_pages
-                             : kV8MaxWasmMemoryPages) *
+                             : max_mem_pages()) *
                         uint64_t{kWasmPageSize}),
         enabled_features(enabled_features),
         lower_simd(lower_simd) {}
@@ -93,10 +93,7 @@ enum class CompilationEvent : uint8_t {
   kFinishedBaselineCompilation,
   kFinishedTopTierCompilation,
   kFailedCompilation,
-
-  // Marker:
-  // After an event >= kFirstFinalEvent, no further events are generated.
-  kFirstFinalEvent = kFinishedTopTierCompilation
+  kFinishedRecompilation
 };
 
 // The implementation of {CompilationState} lives in module-compiler.cc.
@@ -121,6 +118,7 @@ class CompilationState {
   bool failed() const;
   V8_EXPORT_PRIVATE bool baseline_compilation_finished() const;
   V8_EXPORT_PRIVATE bool top_tier_compilation_finished() const;
+  V8_EXPORT_PRIVATE bool recompilation_finished() const;
 
   // Override {operator delete} to avoid implicit instantiation of {operator
   // delete} with {size_t} argument. The {size_t} argument would be incorrect.
diff --git a/deps/v8/src/wasm/decoder.h b/deps/v8/src/wasm/decoder.h
index 71c06467f11bcf..f6c88d04166f53 100644
--- a/deps/v8/src/wasm/decoder.h
+++ b/deps/v8/src/wasm/decoder.h
@@ -285,11 +285,6 @@ class Decoder {
   void verrorf(uint32_t offset, const char* format, va_list args) {
     // Only report the first error.
     if (!ok()) return;
-#if DEBUG
-    if (FLAG_wasm_break_on_decoder_error) {
-      base::OS::DebugBreak();
-    }
-#endif
     constexpr int kMaxErrorMsg = 256;
     EmbeddedVector<char, kMaxErrorMsg> buffer;
     int len = VSNPrintF(buffer, format, args);
diff --git a/deps/v8/src/wasm/function-body-decoder-impl.h b/deps/v8/src/wasm/function-body-decoder-impl.h
index 1f29571e40627a..496598b18f2a15 100644
--- a/deps/v8/src/wasm/function-body-decoder-impl.h
+++ b/deps/v8/src/wasm/function-body-decoder-impl.h
@@ -43,19 +43,19 @@ struct WasmException;
 
 #define RET_ON_PROTOTYPE_OPCODE(feat)                                          \
   DCHECK(!this->module_ || this->module_->origin == kWasmOrigin);              \
-  if (!this->enabled_.feat) {                                                  \
+  if (!this->enabled_.has_##feat()) {                                          \
     this->error("Invalid opcode (enable with --experimental-wasm-" #feat ")"); \
   } else {                                                                     \
-    this->detected_->feat = true;                                              \
+    this->detected_->Add(kFeature_##feat);                                     \
   }
 
 #define CHECK_PROTOTYPE_OPCODE(feat)                                           \
   DCHECK(!this->module_ || this->module_->origin == kWasmOrigin);              \
-  if (!this->enabled_.feat) {                                                  \
+  if (!this->enabled_.has_##feat()) {                                          \
     this->error("Invalid opcode (enable with --experimental-wasm-" #feat ")"); \
     break;                                                                     \
   } else {                                                                     \
-    this->detected_->feat = true;                                              \
+    this->detected_->Add(kFeature_##feat);                                     \
   }
 
 #define OPCODE_ERROR(opcode, message)                                 \
@@ -236,6 +236,9 @@ inline bool decode_local_type(uint8_t val, ValueType* result) {
     case kLocalAnyRef:
       *result = kWasmAnyRef;
       return true;
+    case kLocalNullRef:
+      *result = kWasmNullRef;
+      return true;
     case kLocalExnRef:
       *result = kWasmExnRef;
       return true;
@@ -281,7 +284,7 @@ struct BlockTypeImmediate {
     uint8_t val = decoder->read_u8<validate>(pc + 1, "block type");
     if (!function_body_decoder::decode_local_type(val, &type)) {
       // Handle multi-value blocks.
-      if (!VALIDATE(enabled.mv)) {
+      if (!VALIDATE(enabled.has_mv())) {
         decoder->error(pc + 1, "invalid block type");
         return;
       }
@@ -381,7 +384,8 @@ struct CallIndirectImmediate {
     uint32_t len = 0;
     sig_index = decoder->read_u32v<validate>(pc + 1, &len, "signature index");
     TableIndexImmediate<validate> table(decoder, pc + len);
-    if (!VALIDATE((table.index == 0 && table.length == 1) || enabled.anyref)) {
+    if (!VALIDATE((table.index == 0 && table.length == 1) ||
+                  enabled.has_anyref())) {
       decoder->errorf(pc + 1 + len, "expected table index 0, found %u",
                       table.index);
     }
@@ -486,17 +490,6 @@ struct SimdLaneImmediate {
   }
 };
 
-// Immediate for SIMD shift operations.
-template <Decoder::ValidateFlag validate>
-struct SimdShiftImmediate {
-  uint8_t shift;
-  uint32_t length = 1;
-
-  inline SimdShiftImmediate(Decoder* decoder, const byte* pc) {
-    shift = decoder->read_u8<validate>(pc + 2, "shift");
-  }
-};
-
 // Immediate for SIMD S8x16 shuffle operations.
 template <Decoder::ValidateFlag validate>
 struct Simd8x16ShuffleImmediate {
@@ -518,7 +511,7 @@ struct MemoryInitImmediate {
   inline MemoryInitImmediate(Decoder* decoder, const byte* pc) {
     uint32_t len = 0;
     data_segment_index =
-        decoder->read_i32v<validate>(pc + 2, &len, "data segment index");
+        decoder->read_u32v<validate>(pc + 2, &len, "data segment index");
     memory = MemoryIndexImmediate<validate>(decoder, pc + 1 + len);
     length = len + memory.length;
   }
@@ -530,7 +523,7 @@ struct DataDropImmediate {
   unsigned length;
 
   inline DataDropImmediate(Decoder* decoder, const byte* pc) {
-    index = decoder->read_i32v<validate>(pc + 2, &length, "data segment index");
+    index = decoder->read_u32v<validate>(pc + 2, &length, "data segment index");
   }
 };
 
@@ -557,7 +550,7 @@ struct TableInitImmediate {
   inline TableInitImmediate(Decoder* decoder, const byte* pc) {
     uint32_t len = 0;
     elem_segment_index =
-        decoder->read_i32v<validate>(pc + 2, &len, "elem segment index");
+        decoder->read_u32v<validate>(pc + 2, &len, "elem segment index");
     table = TableIndexImmediate<validate>(decoder, pc + 1 + len);
     length = len + table.length;
   }
@@ -569,7 +562,7 @@ struct ElemDropImmediate {
   unsigned length;
 
   inline ElemDropImmediate(Decoder* decoder, const byte* pc) {
-    index = decoder->read_i32v<validate>(pc + 2, &length, "elem segment index");
+    index = decoder->read_u32v<validate>(pc + 2, &length, "elem segment index");
   }
 };
 
@@ -683,6 +676,11 @@ struct ControlBase {
   }
 };
 
+enum class LoadTransformationKind : uint8_t {
+  kSplat,
+  kExtend,
+};
+
 // This is the list of callback functions that an interface for the
 // WasmFullDecoder should implement.
 // F(Name, args...)
@@ -733,6 +731,8 @@ struct ControlBase {
   F(Else, Control* if_block)                                                  \
   F(LoadMem, LoadType type, const MemoryAccessImmediate<validate>& imm,       \
     const Value& index, Value* result)                                        \
+  F(LoadTransform, LoadType type, LoadTransformationKind transform,           \
+    MemoryAccessImmediate<validate>& imm, const Value& index, Value* result)  \
   F(StoreMem, StoreType type, const MemoryAccessImmediate<validate>& imm,     \
     const Value& index, const Value& value)                                   \
   F(CurrentMemoryPages, Value* result)                                        \
@@ -844,7 +844,7 @@ class WasmDecoder : public Decoder {
           type = kWasmF64;
           break;
         case kLocalAnyRef:
-          if (enabled.anyref) {
+          if (enabled.has_anyref()) {
             type = kWasmAnyRef;
             break;
           }
@@ -853,7 +853,7 @@ class WasmDecoder : public Decoder {
                          "--experimental-wasm-anyref");
           return false;
         case kLocalFuncRef:
-          if (enabled.anyref) {
+          if (enabled.has_anyref()) {
             type = kWasmFuncRef;
             break;
           }
@@ -861,8 +861,17 @@ class WasmDecoder : public Decoder {
                          "invalid local type 'funcref', enable with "
                          "--experimental-wasm-anyref");
           return false;
+        case kLocalNullRef:
+          if (enabled.has_anyref()) {
+            type = kWasmNullRef;
+            break;
+          }
+          decoder->error(decoder->pc() - 1,
+                         "invalid local type 'nullref', enable with "
+                         "--experimental-wasm-anyref");
+          return false;
         case kLocalExnRef:
-          if (enabled.eh) {
+          if (enabled.has_eh()) {
             type = kWasmExnRef;
             break;
           }
@@ -871,7 +880,7 @@ class WasmDecoder : public Decoder {
                          "--experimental-wasm-eh");
           return false;
         case kLocalS128:
-          if (enabled.simd) {
+          if (enabled.has_simd()) {
             type = kWasmS128;
             break;
           }
@@ -1091,42 +1100,6 @@ class WasmDecoder : public Decoder {
     }
   }
 
-  inline bool Validate(const byte* pc, WasmOpcode opcode,
-                       SimdShiftImmediate<validate>& imm) {
-    uint8_t max_shift = 0;
-    switch (opcode) {
-      case kExprI64x2Shl:
-      case kExprI64x2ShrS:
-      case kExprI64x2ShrU:
-        max_shift = 64;
-        break;
-      case kExprI32x4Shl:
-      case kExprI32x4ShrS:
-      case kExprI32x4ShrU:
-        max_shift = 32;
-        break;
-      case kExprI16x8Shl:
-      case kExprI16x8ShrS:
-      case kExprI16x8ShrU:
-        max_shift = 16;
-        break;
-      case kExprI8x16Shl:
-      case kExprI8x16ShrS:
-      case kExprI8x16ShrU:
-        max_shift = 8;
-        break;
-      default:
-        UNREACHABLE();
-        break;
-    }
-    if (!VALIDATE(imm.shift >= 0 && imm.shift < max_shift)) {
-      error(pc_ + 2, "invalid shift amount");
-      return false;
-    } else {
-      return true;
-    }
-  }
-
   inline bool Validate(const byte* pc,
                        Simd8x16ShuffleImmediate<validate>& imm) {
     uint8_t max_lane = 0;
@@ -1271,7 +1244,7 @@ class WasmDecoder : public Decoder {
       }
       case kExprCallIndirect:
       case kExprReturnCallIndirect: {
-        CallIndirectImmediate<validate> imm(kAllWasmFeatures, decoder, pc);
+        CallIndirectImmediate<validate> imm(WasmFeatures::All(), decoder, pc);
         return 1 + imm.length;
       }
 
@@ -1279,7 +1252,7 @@ class WasmDecoder : public Decoder {
       case kExprIf:  // fall through
       case kExprLoop:
       case kExprBlock: {
-        BlockTypeImmediate<validate> imm(kAllWasmFeatures, decoder, pc);
+        BlockTypeImmediate<validate> imm(WasmFeatures::All(), decoder, pc);
         return 1 + imm.length;
       }
 
@@ -1695,7 +1668,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     return true;
   }
 
-  bool CheckHasSharedMemory() {
+  bool CheckHasMemoryForAtomics() {
+    if (FLAG_wasm_atomics_on_non_shared_memory && CheckHasMemory()) return true;
     if (!VALIDATE(this->module_->has_shared_memory)) {
       this->error(this->pc_ - 1, "Atomic opcodes used without shared memory");
       return false;
@@ -1845,8 +1819,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           auto exception = Pop(0, kWasmExnRef);
           const WasmExceptionSig* sig = imm.index.exception->sig;
           size_t value_count = sig->parameter_count();
-          // TODO(mstarzinger): This operand stack mutation is an ugly hack to
-          // make both type checking here as well as environment merging in the
+          // TODO(wasm): This operand stack mutation is an ugly hack to make
+          // both type checking here as well as environment merging in the
           // graph builder interface work out of the box. We should introduce
           // special handling for both and do minimal/no stack mutation here.
           for (size_t i = 0; i < value_count; ++i) Push(sig->GetParam(i));
@@ -1928,8 +1902,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
                   "start-arity and end-arity of one-armed if must match");
               break;
             }
+            if (!TypeCheckOneArmedIf(c)) break;
           }
-
           if (!TypeCheckFallThru()) break;
 
           if (control_.size() == 1) {
@@ -2349,12 +2323,10 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           byte numeric_index =
               this->template read_u8<validate>(this->pc_ + 1, "numeric index");
           opcode = static_cast<WasmOpcode>(opcode << 8 | numeric_index);
-          if (opcode < kExprMemoryInit) {
-            CHECK_PROTOTYPE_OPCODE(sat_f2i_conversions);
-          } else if (opcode == kExprTableGrow || opcode == kExprTableSize ||
-                     opcode == kExprTableFill) {
+          if (opcode == kExprTableGrow || opcode == kExprTableSize ||
+              opcode == kExprTableFill) {
             CHECK_PROTOTYPE_OPCODE(anyref);
-          } else {
+          } else if (opcode >= kExprMemoryInit) {
             CHECK_PROTOTYPE_OPCODE(bulk_memory);
           }
           TRACE_PART(TRACE_INST_FORMAT, startrel(this->pc_),
@@ -2555,6 +2527,16 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     return imm.length;
   }
 
+  int DecodeLoadTransformMem(LoadType type, LoadTransformationKind transform) {
+    if (!CheckHasMemory()) return 0;
+    MemoryAccessImmediate<validate> imm(this, this->pc_ + 1, type.size_log_2());
+    auto index = Pop(0, kWasmI32);
+    auto* result = Push(ValueType::kWasmS128);
+    CALL_INTERFACE_IF_REACHABLE(LoadTransform, type, transform, imm, index,
+                                result);
+    return imm.length;
+  }
+
   int DecodeStoreMem(StoreType store, int prefix_len = 0) {
     if (!CheckHasMemory()) return 0;
     MemoryAccessImmediate<validate> imm(this, this->pc_ + prefix_len,
@@ -2598,7 +2580,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     }
 
     for (int i = 0; i < br_arity; ++i) {
-      if (this->enabled_.anyref) {
+      if (this->enabled_.has_anyref()) {
         // The expected type is the biggest common sub type of all targets.
         (*result_types)[i] =
             ValueTypes::CommonSubType((*result_types)[i], (*merge)[i].type);
@@ -2737,6 +2719,46 @@ class WasmFullDecoder : public WasmDecoder<validate> {
       case kExprS128StoreMem:
         len = DecodeStoreMem(StoreType::kS128Store, 1);
         break;
+      case kExprS8x16LoadSplat:
+        len = DecodeLoadTransformMem(LoadType::kI32Load8S,
+                                     LoadTransformationKind::kSplat);
+        break;
+      case kExprS16x8LoadSplat:
+        len = DecodeLoadTransformMem(LoadType::kI32Load16S,
+                                     LoadTransformationKind::kSplat);
+        break;
+      case kExprS32x4LoadSplat:
+        len = DecodeLoadTransformMem(LoadType::kI32Load,
+                                     LoadTransformationKind::kSplat);
+        break;
+      case kExprS64x2LoadSplat:
+        len = DecodeLoadTransformMem(LoadType::kI64Load,
+                                     LoadTransformationKind::kSplat);
+        break;
+      case kExprI16x8Load8x8S:
+        len = DecodeLoadTransformMem(LoadType::kI32Load8S,
+                                     LoadTransformationKind::kExtend);
+        break;
+      case kExprI16x8Load8x8U:
+        len = DecodeLoadTransformMem(LoadType::kI32Load8U,
+                                     LoadTransformationKind::kExtend);
+        break;
+      case kExprI32x4Load16x4S:
+        len = DecodeLoadTransformMem(LoadType::kI32Load16S,
+                                     LoadTransformationKind::kExtend);
+        break;
+      case kExprI32x4Load16x4U:
+        len = DecodeLoadTransformMem(LoadType::kI32Load16U,
+                                     LoadTransformationKind::kExtend);
+        break;
+      case kExprI64x2Load32x2S:
+        len = DecodeLoadTransformMem(LoadType::kI64Load32S,
+                                     LoadTransformationKind::kExtend);
+        break;
+      case kExprI64x2Load32x2U:
+        len = DecodeLoadTransformMem(LoadType::kI64Load32U,
+                                     LoadTransformationKind::kExtend);
+        break;
       default: {
         FunctionSig* sig = WasmOpcodes::Signature(opcode);
         if (!VALIDATE(sig != nullptr)) {
@@ -2791,7 +2813,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
         this->error("invalid atomic opcode");
         return 0;
     }
-    if (!CheckHasSharedMemory()) return 0;
+    if (!CheckHasMemoryForAtomics()) return 0;
     MemoryAccessImmediate<validate> imm(
         this, this->pc_ + 1, ElementSizeLog2Of(memtype.representation()));
     len += imm.length;
@@ -2992,9 +3014,9 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     // For conditional branches, stack value '0' is the condition of the branch,
     // and the result values start at index '1'.
     int index_offset = conditional_branch ? 1 : 0;
-    for (int i = 0; i < arity; ++i) Pop(index_offset + i, merge[i].type);
+    for (int i = arity - 1; i >= 0; --i) Pop(index_offset + i, merge[i].type);
     // Push values of the correct type back on the stack.
-    for (int i = arity - 1; i >= 0; --i) Push(merge[i].type);
+    for (int i = 0; i < arity; ++i) Push(merge[i].type);
     return this->ok();
   }
 
@@ -3033,12 +3055,28 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     return true;
   }
 
+  bool TypeCheckOneArmedIf(Control* c) {
+    static_assert(validate, "Call this function only within VALIDATE");
+    DCHECK(c->is_onearmed_if());
+    DCHECK_EQ(c->start_merge.arity, c->end_merge.arity);
+    for (uint32_t i = 0; i < c->start_merge.arity; ++i) {
+      Value& start = c->start_merge[i];
+      Value& end = c->end_merge[i];
+      if (!ValueTypes::IsSubType(start.type, end.type)) {
+        this->errorf(this->pc_, "type error in merge[%u] (expected %s, got %s)",
+                     i, ValueTypes::TypeName(end.type),
+                     ValueTypes::TypeName(start.type));
+        return false;
+      }
+    }
+
+    return true;
+  }
+
   bool TypeCheckFallThru() {
+    static_assert(validate, "Call this function only whithin VALIDATE");
     Control& c = control_.back();
     if (V8_LIKELY(c.reachable())) {
-      // We only do type-checking here. This is only needed during validation.
-      if (!validate) return true;
-
       uint32_t expected = c.end_merge.arity;
       DCHECK_GE(stack_.size(), c.stack_depth);
       uint32_t actual = static_cast<uint32_t>(stack_.size()) - c.stack_depth;
@@ -3147,9 +3185,6 @@ class WasmFullDecoder : public WasmDecoder<validate> {
   }
 
   void BuildSimplePrototypeOperator(WasmOpcode opcode) {
-    if (WasmOpcodes::IsSignExtensionOpcode(opcode)) {
-      RET_ON_PROTOTYPE_OPCODE(se);
-    }
     if (WasmOpcodes::IsAnyRefOpcode(opcode)) {
       RET_ON_PROTOTYPE_OPCODE(anyref);
     }
diff --git a/deps/v8/src/wasm/function-body-decoder.cc b/deps/v8/src/wasm/function-body-decoder.cc
index 0568d61f3fae72..3113d1665b4fcc 100644
--- a/deps/v8/src/wasm/function-body-decoder.cc
+++ b/deps/v8/src/wasm/function-body-decoder.cc
@@ -35,7 +35,7 @@ BytecodeIterator::BytecodeIterator(const byte* start, const byte* end,
                                    BodyLocalDecls* decls)
     : Decoder(start, end) {
   if (decls != nullptr) {
-    if (DecodeLocalDecls(kAllWasmFeatures, decls, start, end)) {
+    if (DecodeLocalDecls(WasmFeatures::All(), decls, start, end)) {
       pc_ += decls->encoded_size;
       if (pc_ > end_) pc_ = end_;
     }
@@ -61,9 +61,9 @@ unsigned OpcodeLength(const byte* pc, const byte* end) {
 std::pair<uint32_t, uint32_t> StackEffect(const WasmModule* module,
                                           FunctionSig* sig, const byte* pc,
                                           const byte* end) {
-  WasmFeatures unused_detected_features;
+  WasmFeatures unused_detected_features = WasmFeatures::None();
   WasmDecoder<Decoder::kNoValidate> decoder(
-      module, kAllWasmFeatures, &unused_detected_features, sig, pc, end);
+      module, WasmFeatures::All(), &unused_detected_features, sig, pc, end);
   return decoder.StackEffect(pc);
 }
 
@@ -86,6 +86,17 @@ const char* RawOpcodeName(WasmOpcode opcode) {
   }
   return "Unknown";
 }
+const char* PrefixName(WasmOpcode prefix_opcode) {
+  switch (prefix_opcode) {
+#define DECLARE_PREFIX_CASE(name, opcode) \
+  case k##name##Prefix:                   \
+    return "k" #name "Prefix";
+    FOREACH_PREFIX(DECLARE_PREFIX_CASE)
+#undef DECLARE_PREFIX_CASE
+    default:
+      return "Unknown prefix";
+  }
+}
 }  // namespace
 
 bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
@@ -98,8 +109,8 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
                       const WasmModule* module, PrintLocals print_locals,
                       std::ostream& os, std::vector<int>* line_numbers) {
   Zone zone(allocator, ZONE_NAME);
-  WasmFeatures unused_detected_features;
-  WasmDecoder<Decoder::kNoValidate> decoder(module, kAllWasmFeatures,
+  WasmFeatures unused_detected_features = WasmFeatures::None();
+  WasmDecoder<Decoder::kNoValidate> decoder(module, WasmFeatures::All(),
                                             &unused_detected_features, body.sig,
                                             body.start, body.end);
   int line_nr = 0;
@@ -154,6 +165,7 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
     unsigned offset = 1;
     WasmOpcode opcode = i.current();
     if (WasmOpcodes::IsPrefixOpcode(opcode)) {
+      os << PrefixName(opcode) << ", ";
       opcode = i.prefixed_opcode();
       offset = 2;
     }
@@ -208,7 +220,7 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
       case kExprIf:
       case kExprBlock:
       case kExprTry: {
-        BlockTypeImmediate<Decoder::kNoValidate> imm(kAllWasmFeatures, &i,
+        BlockTypeImmediate<Decoder::kNoValidate> imm(WasmFeatures::All(), &i,
                                                      i.pc());
         os << "   // @" << i.pc_offset();
         if (decoder.Complete(imm)) {
@@ -239,7 +251,7 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
         break;
       }
       case kExprCallIndirect: {
-        CallIndirectImmediate<Decoder::kNoValidate> imm(kAllWasmFeatures, &i,
+        CallIndirectImmediate<Decoder::kNoValidate> imm(WasmFeatures::All(), &i,
                                                         i.pc());
         os << "   // sig #" << imm.sig_index;
         if (decoder.Complete(i.pc(), imm)) {
diff --git a/deps/v8/src/wasm/function-body-decoder.h b/deps/v8/src/wasm/function-body-decoder.h
index eadc333dd53c00..ef91d8a0e99943 100644
--- a/deps/v8/src/wasm/function-body-decoder.h
+++ b/deps/v8/src/wasm/function-body-decoder.h
@@ -19,8 +19,8 @@ class BitVector;  // forward declaration
 
 namespace wasm {
 
+class WasmFeatures;
 struct WasmModule;  // forward declaration of module interface.
-struct WasmFeatures;
 
 // A wrapper around the signature and bytes of a function.
 struct FunctionBody {
diff --git a/deps/v8/src/wasm/function-compiler.cc b/deps/v8/src/wasm/function-compiler.cc
index e89c31d72954a1..f285deca1ce97d 100644
--- a/deps/v8/src/wasm/function-compiler.cc
+++ b/deps/v8/src/wasm/function-compiler.cc
@@ -57,6 +57,9 @@ class WasmInstructionBufferImpl {
     WasmInstructionBufferImpl* const holder_;
   };
 
+  explicit WasmInstructionBufferImpl(size_t size)
+      : buffer_(OwnedVector<uint8_t>::New(size)) {}
+
   std::unique_ptr<AssemblerBuffer> CreateView() {
     DCHECK_NOT_NULL(buffer_);
     return std::make_unique<View>(buffer_.as_vector(), this);
@@ -72,8 +75,7 @@ class WasmInstructionBufferImpl {
 
  private:
   // The current buffer used to emit code.
-  OwnedVector<uint8_t> buffer_ =
-      OwnedVector<uint8_t>::New(AssemblerBase::kMinimalBufferSize);
+  OwnedVector<uint8_t> buffer_;
 
   // While the buffer is grown, we need to temporarily also keep the old buffer
   // alive.
@@ -100,15 +102,15 @@ std::unique_ptr<uint8_t[]> WasmInstructionBuffer::ReleaseBuffer() {
 }
 
 // static
-std::unique_ptr<WasmInstructionBuffer> WasmInstructionBuffer::New() {
+std::unique_ptr<WasmInstructionBuffer> WasmInstructionBuffer::New(size_t size) {
   return std::unique_ptr<WasmInstructionBuffer>{
-      reinterpret_cast<WasmInstructionBuffer*>(
-          new WasmInstructionBufferImpl())};
+      reinterpret_cast<WasmInstructionBuffer*>(new WasmInstructionBufferImpl(
+          std::max(size_t{AssemblerBase::kMinimalBufferSize}, size)))};
 }
 // End of PIMPL interface WasmInstructionBuffer for WasmInstBufferImpl
 
 // static
-ExecutionTier WasmCompilationUnit::GetDefaultExecutionTier(
+ExecutionTier WasmCompilationUnit::GetBaselineExecutionTier(
     const WasmModule* module) {
   // Liftoff does not support the special asm.js opcodes, thus always compile
   // asm.js modules with TurboFan.
@@ -231,7 +233,7 @@ void RecordWasmHeapStubCompilation(Isolate* isolate, Handle<Code> code,
   Handle<String> name_str =
       isolate->factory()->NewStringFromAsciiChecked(buffer.begin());
   PROFILE(isolate, CodeCreateEvent(CodeEventListener::STUB_TAG,
-                                   AbstractCode::cast(*code), *name_str));
+                                   Handle<AbstractCode>::cast(code), name_str));
 }
 }  // namespace
 
@@ -274,7 +276,7 @@ JSToWasmWrapperCompilationUnit::~JSToWasmWrapperCompilationUnit() = default;
 
 void JSToWasmWrapperCompilationUnit::Execute() {
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "CompileJSToWasmWrapper");
-  CompilationJob::Status status = job_->ExecuteJob();
+  CompilationJob::Status status = job_->ExecuteJob(nullptr);
   CHECK_EQ(status, CompilationJob::SUCCEEDED);
 }
 
@@ -293,7 +295,7 @@ Handle<Code> JSToWasmWrapperCompilationUnit::Finalize(Isolate* isolate) {
 Handle<Code> JSToWasmWrapperCompilationUnit::CompileJSToWasmWrapper(
     Isolate* isolate, FunctionSig* sig, bool is_import) {
   // Run the compilation unit synchronously.
-  WasmFeatures enabled_features = WasmFeaturesFromIsolate(isolate);
+  WasmFeatures enabled_features = WasmFeatures::FromIsolate(isolate);
   JSToWasmWrapperCompilationUnit unit(isolate, isolate->wasm_engine(), sig,
                                       is_import, enabled_features);
   unit.Execute();
diff --git a/deps/v8/src/wasm/function-compiler.h b/deps/v8/src/wasm/function-compiler.h
index bdebfebe14d460..9d6d40e1408df6 100644
--- a/deps/v8/src/wasm/function-compiler.h
+++ b/deps/v8/src/wasm/function-compiler.h
@@ -35,7 +35,9 @@ class WasmInstructionBuffer final {
   std::unique_ptr<AssemblerBuffer> CreateView();
   std::unique_ptr<uint8_t[]> ReleaseBuffer();
 
-  static std::unique_ptr<WasmInstructionBuffer> New();
+  // Allocate a new {WasmInstructionBuffer}. The size is the maximum of {size}
+  // and {AssemblerBase::kMinimalSize}.
+  static std::unique_ptr<WasmInstructionBuffer> New(size_t size = 0);
 
   // Override {operator delete} to avoid implicit instantiation of {operator
   // delete} with {size_t} argument. The {size_t} argument would be incorrect.
@@ -74,7 +76,7 @@ struct WasmCompilationResult {
 
 class V8_EXPORT_PRIVATE WasmCompilationUnit final {
  public:
-  static ExecutionTier GetDefaultExecutionTier(const WasmModule*);
+  static ExecutionTier GetBaselineExecutionTier(const WasmModule*);
 
   WasmCompilationUnit(int index, ExecutionTier tier)
       : func_index_(index), tier_(tier) {}
diff --git a/deps/v8/src/wasm/graph-builder-interface.cc b/deps/v8/src/wasm/graph-builder-interface.cc
index b08aa9215ec275..e2ddafbf30cfd7 100644
--- a/deps/v8/src/wasm/graph-builder-interface.cc
+++ b/deps/v8/src/wasm/graph-builder-interface.cc
@@ -115,8 +115,7 @@ class WasmGraphBuildingInterface {
     ssa_env->control = start;
     // Initialize effect and control before initializing the locals default
     // values (which might require instance loads) or loading the context.
-    builder_->set_effect_ptr(&ssa_env->effect);
-    builder_->set_control_ptr(&ssa_env->control);
+    builder_->SetEffectControl(start);
     // Initialize the instance parameter (index 0).
     builder_->set_instance_node(builder_->Param(kWasmInstanceParameterIndex));
     // Initialize local variables. Parameters are shifted by 1 because of the
@@ -133,8 +132,8 @@ class WasmGraphBuildingInterface {
         ssa_env->locals[index++] = node;
       }
     }
-    LoadContextIntoSsa(ssa_env);
     SetEnv(ssa_env);
+    LoadContextIntoSsa(ssa_env);
   }
 
   // Reload the instance cache entries into the Ssa Environment.
@@ -159,8 +158,9 @@ class WasmGraphBuildingInterface {
   void Loop(FullDecoder* decoder, Control* block) {
     SsaEnv* finish_try_env = Steal(decoder->zone(), ssa_env_);
     block->end_env = finish_try_env;
+    SetEnv(finish_try_env);
     // The continue environment is the inner environment.
-    SetEnv(PrepareForLoop(decoder, finish_try_env));
+    PrepareForLoop(decoder);
     ssa_env_->SetNotMerged();
     if (!decoder->ok()) return;
     // Wrap input merge into phis.
@@ -318,7 +318,7 @@ class WasmGraphBuildingInterface {
     TFNode* inputs[] = {tval.node, fval.node, merge};
     TFNode* phi = BUILD(Phi, tval.type, 2, inputs);
     result->node = phi;
-    ssa_env_->control = merge;
+    builder_->SetControl(merge);
   }
 
   void BrOrRet(FullDecoder* decoder, uint32_t depth) {
@@ -343,6 +343,7 @@ class WasmGraphBuildingInterface {
     SsaEnv* tenv = Split(decoder, fenv);
     fenv->SetNotMerged();
     BUILD(BranchNoHint, cond.node, &tenv->control, &fenv->control);
+    builder_->SetControl(fenv->control);
     SetEnv(tenv);
     BrOrRet(decoder, depth);
     SetEnv(fenv);
@@ -368,8 +369,8 @@ class WasmGraphBuildingInterface {
       uint32_t i = iterator.cur_index();
       uint32_t target = iterator.next();
       SetEnv(Split(decoder, copy));
-      ssa_env_->control =
-          (i == imm.table_count) ? BUILD(IfDefault, sw) : BUILD(IfValue, i, sw);
+      builder_->SetControl(i == imm.table_count ? BUILD(IfDefault, sw)
+                                                : BUILD(IfValue, i, sw));
       BrOrRet(decoder, target);
     }
     DCHECK(decoder->ok());
@@ -392,6 +393,14 @@ class WasmGraphBuildingInterface {
               imm.offset, imm.alignment, decoder->position());
   }
 
+  void LoadTransform(FullDecoder* decoder, LoadType type,
+                     LoadTransformationKind transform,
+                     const MemoryAccessImmediate<validate>& imm,
+                     const Value& index, Value* result) {
+    result->node = BUILD(LoadTransform, type.mem_type(), transform, index.node,
+                         imm.offset, imm.alignment, decoder->position());
+  }
+
   void StoreMem(FullDecoder* decoder, StoreType type,
                 const MemoryAccessImmediate<validate>& imm, const Value& index,
                 const Value& value) {
@@ -467,12 +476,12 @@ class WasmGraphBuildingInterface {
       args[i] = value_args[i].node;
     }
     BUILD(Throw, imm.index, imm.exception, VectorOf(args), decoder->position());
-    builder_->TerminateThrow(ssa_env_->effect, ssa_env_->control);
+    builder_->TerminateThrow(effect(), control());
   }
 
   void Rethrow(FullDecoder* decoder, const Value& exception) {
     BUILD(Rethrow, exception.node);
-    builder_->TerminateThrow(ssa_env_->effect, ssa_env_->control);
+    builder_->TerminateThrow(effect(), control());
   }
 
   void BrOnException(FullDecoder* decoder, const Value& exception,
@@ -590,10 +599,14 @@ class WasmGraphBuildingInterface {
   }
 
  private:
-  SsaEnv* ssa_env_;
+  SsaEnv* ssa_env_ = nullptr;
   compiler::WasmGraphBuilder* builder_;
   uint32_t current_catch_ = kNullCatch;
 
+  TFNode* effect() { return builder_->effect(); }
+
+  TFNode* control() { return builder_->control(); }
+
   TryInfo* current_try_info(FullDecoder* decoder) {
     return decoder->control_at(decoder->control_depth() - 1 - current_catch_)
         ->try_info;
@@ -610,7 +623,6 @@ class WasmGraphBuildingInterface {
   }
 
   void SetEnv(SsaEnv* env) {
-#if DEBUG
     if (FLAG_trace_wasm_decoder) {
       char state = 'X';
       if (env) {
@@ -636,11 +648,12 @@ class WasmGraphBuildingInterface {
       }
       PrintF("}\n");
     }
-#endif
+    if (ssa_env_) {
+      ssa_env_->control = control();
+      ssa_env_->effect = effect();
+    }
     ssa_env_ = env;
-    // TODO(wasm): combine the control and effect pointers with instance cache.
-    builder_->set_control_ptr(&env->control);
-    builder_->set_effect_ptr(&env->effect);
+    builder_->SetEffectControl(env->effect, env->control);
     builder_->set_instance_cache(&env->instance_cache);
   }
 
@@ -663,8 +676,9 @@ class WasmGraphBuildingInterface {
     SsaEnv* exception_env = Split(decoder, success_env);
     exception_env->control = if_exception;
     exception_env->effect = if_exception;
+    SetEnv(exception_env);
     TryInfo* try_info = current_try_info(decoder);
-    Goto(decoder, exception_env, try_info->catch_env);
+    Goto(decoder, try_info->catch_env);
     if (try_info->exception == nullptr) {
       DCHECK_EQ(SsaEnv::kReached, try_info->catch_env->state);
       try_info->exception = if_exception;
@@ -693,6 +707,7 @@ class WasmGraphBuildingInterface {
         return builder_->S128Zero();
       case kWasmAnyRef:
       case kWasmFuncRef:
+      case kWasmNullRef:
       case kWasmExnRef:
         return builder_->RefNull();
       default:
@@ -706,7 +721,7 @@ class WasmGraphBuildingInterface {
 
     SsaEnv* target = c->end_env;
     const bool first = target->state == SsaEnv::kUnreachable;
-    Goto(decoder, ssa_env_, target);
+    Goto(decoder, target);
 
     if (merge->arity == 0) return;
 
@@ -735,32 +750,33 @@ class WasmGraphBuildingInterface {
     MergeValuesInto(decoder, c, merge, stack_values);
   }
 
-  void Goto(FullDecoder* decoder, SsaEnv* from, SsaEnv* to) {
+  void Goto(FullDecoder* decoder, SsaEnv* to) {
     DCHECK_NOT_NULL(to);
     switch (to->state) {
       case SsaEnv::kUnreachable: {  // Overwrite destination.
         to->state = SsaEnv::kReached;
-        to->locals = from->locals;
-        to->control = from->control;
-        to->effect = from->effect;
-        to->instance_cache = from->instance_cache;
+        to->locals = ssa_env_->locals;
+        to->control = control();
+        to->effect = effect();
+        to->instance_cache = ssa_env_->instance_cache;
         break;
       }
       case SsaEnv::kReached: {  // Create a new merge.
         to->state = SsaEnv::kMerged;
         // Merge control.
-        TFNode* controls[] = {to->control, from->control};
+        TFNode* controls[] = {to->control, control()};
         TFNode* merge = builder_->Merge(2, controls);
         to->control = merge;
         // Merge effects.
-        if (from->effect != to->effect) {
-          TFNode* inputs[] = {to->effect, from->effect, merge};
+        TFNode* old_effect = effect();
+        if (old_effect != to->effect) {
+          TFNode* inputs[] = {to->effect, old_effect, merge};
           to->effect = builder_->EffectPhi(2, inputs);
         }
         // Merge SSA values.
         for (int i = decoder->num_locals() - 1; i >= 0; i--) {
           TFNode* a = to->locals[i];
-          TFNode* b = from->locals[i];
+          TFNode* b = ssa_env_->locals[i];
           if (a != b) {
             TFNode* inputs[] = {a, b, merge};
             to->locals[i] = builder_->Phi(decoder->GetLocalType(i), 2, inputs);
@@ -768,82 +784,84 @@ class WasmGraphBuildingInterface {
         }
         // Start a new merge from the instance cache.
         builder_->NewInstanceCacheMerge(&to->instance_cache,
-                                        &from->instance_cache, merge);
+                                        &ssa_env_->instance_cache, merge);
         break;
       }
       case SsaEnv::kMerged: {
         TFNode* merge = to->control;
         // Extend the existing merge control node.
-        builder_->AppendToMerge(merge, from->control);
+        builder_->AppendToMerge(merge, control());
         // Merge effects.
-        to->effect = builder_->CreateOrMergeIntoEffectPhi(merge, to->effect,
-                                                          from->effect);
+        to->effect =
+            builder_->CreateOrMergeIntoEffectPhi(merge, to->effect, effect());
         // Merge locals.
         for (int i = decoder->num_locals() - 1; i >= 0; i--) {
           to->locals[i] = builder_->CreateOrMergeIntoPhi(
               ValueTypes::MachineRepresentationFor(decoder->GetLocalType(i)),
-              merge, to->locals[i], from->locals[i]);
+              merge, to->locals[i], ssa_env_->locals[i]);
         }
         // Merge the instance caches.
         builder_->MergeInstanceCacheInto(&to->instance_cache,
-                                         &from->instance_cache, merge);
+                                         &ssa_env_->instance_cache, merge);
         break;
       }
       default:
         UNREACHABLE();
     }
-    return from->Kill();
+    return ssa_env_->Kill();
   }
 
-  SsaEnv* PrepareForLoop(FullDecoder* decoder, SsaEnv* env) {
-    env->state = SsaEnv::kMerged;
+  void PrepareForLoop(FullDecoder* decoder) {
+    ssa_env_->state = SsaEnv::kMerged;
 
-    env->control = builder_->Loop(env->control);
-    TFNode* effect_inputs[] = {env->effect, env->control};
-    env->effect = builder_->EffectPhi(1, effect_inputs);
-    builder_->TerminateLoop(env->effect, env->control);
+    builder_->SetControl(builder_->Loop(control()));
+    TFNode* effect_inputs[] = {effect(), control()};
+    builder_->SetEffect(builder_->EffectPhi(1, effect_inputs));
+    builder_->TerminateLoop(effect(), control());
     // The '+ 1' here is to be able to set the instance cache as assigned.
     BitVector* assigned = WasmDecoder<validate>::AnalyzeLoopAssignment(
         decoder, decoder->pc(), decoder->total_locals() + 1, decoder->zone());
-    if (decoder->failed()) return env;
+    if (decoder->failed()) return;
     if (assigned != nullptr) {
       // Only introduce phis for variables assigned in this loop.
       int instance_cache_index = decoder->total_locals();
       for (int i = decoder->num_locals() - 1; i >= 0; i--) {
         if (!assigned->Contains(i)) continue;
-        TFNode* inputs[] = {env->locals[i], env->control};
-        env->locals[i] = builder_->Phi(decoder->GetLocalType(i), 1, inputs);
+        TFNode* inputs[] = {ssa_env_->locals[i], control()};
+        ssa_env_->locals[i] =
+            builder_->Phi(decoder->GetLocalType(i), 1, inputs);
       }
       // Introduce phis for instance cache pointers if necessary.
       if (assigned->Contains(instance_cache_index)) {
-        builder_->PrepareInstanceCacheForLoop(&env->instance_cache,
-                                              env->control);
+        builder_->PrepareInstanceCacheForLoop(&ssa_env_->instance_cache,
+                                              control());
       }
 
-      SsaEnv* loop_body_env = Split(decoder, env);
-      builder_->StackCheck(decoder->position(), &(loop_body_env->effect),
-                           &(loop_body_env->control));
-      return loop_body_env;
+      SetEnv(Split(decoder, ssa_env_));
+      builder_->StackCheck(decoder->position());
+      return;
     }
 
     // Conservatively introduce phis for all local variables.
     for (int i = decoder->num_locals() - 1; i >= 0; i--) {
-      TFNode* inputs[] = {env->locals[i], env->control};
-      env->locals[i] = builder_->Phi(decoder->GetLocalType(i), 1, inputs);
+      TFNode* inputs[] = {ssa_env_->locals[i], control()};
+      ssa_env_->locals[i] = builder_->Phi(decoder->GetLocalType(i), 1, inputs);
     }
 
     // Conservatively introduce phis for instance cache.
-    builder_->PrepareInstanceCacheForLoop(&env->instance_cache, env->control);
+    builder_->PrepareInstanceCacheForLoop(&ssa_env_->instance_cache, control());
 
-    SsaEnv* loop_body_env = Split(decoder, env);
-    builder_->StackCheck(decoder->position(), &loop_body_env->effect,
-                         &loop_body_env->control);
-    return loop_body_env;
+    SetEnv(Split(decoder, ssa_env_));
+    builder_->StackCheck(decoder->position());
   }
 
   // Create a complete copy of {from}.
   SsaEnv* Split(FullDecoder* decoder, SsaEnv* from) {
     DCHECK_NOT_NULL(from);
+    if (from == ssa_env_) {
+      ssa_env_->control = control();
+      ssa_env_->effect = effect();
+    }
     SsaEnv* result =
         reinterpret_cast<SsaEnv*>(decoder->zone()->New(sizeof(SsaEnv)));
     size_t size = sizeof(TFNode*) * decoder->num_locals();
@@ -866,6 +884,10 @@ class WasmGraphBuildingInterface {
   // unreachable.
   SsaEnv* Steal(Zone* zone, SsaEnv* from) {
     DCHECK_NOT_NULL(from);
+    if (from == ssa_env_) {
+      ssa_env_->control = control();
+      ssa_env_->effect = effect();
+    }
     SsaEnv* result = reinterpret_cast<SsaEnv*>(zone->New(sizeof(SsaEnv)));
     result->state = SsaEnv::kReached;
     result->locals = from->locals;
diff --git a/deps/v8/src/wasm/graph-builder-interface.h b/deps/v8/src/wasm/graph-builder-interface.h
index 165953b7d1a721..e7101468274bbe 100644
--- a/deps/v8/src/wasm/graph-builder-interface.h
+++ b/deps/v8/src/wasm/graph-builder-interface.h
@@ -20,8 +20,8 @@ class WasmGraphBuilder;
 namespace wasm {
 
 struct FunctionBody;
+class WasmFeatures;
 struct WasmModule;
-struct WasmFeatures;
 
 V8_EXPORT_PRIVATE DecodeResult
 BuildTFGraph(AccountingAllocator* allocator, const WasmFeatures& enabled,
diff --git a/deps/v8/src/wasm/jump-table-assembler.cc b/deps/v8/src/wasm/jump-table-assembler.cc
index adb7e19158a04e..ad73562d269ac4 100644
--- a/deps/v8/src/wasm/jump-table-assembler.cc
+++ b/deps/v8/src/wasm/jump-table-assembler.cc
@@ -235,7 +235,7 @@ void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index,
 }
 
 bool JumpTableAssembler::EmitJumpSlot(Address target) {
-  Jump(target, RelocInfo::NONE);
+  PatchAndJump(target);
   return true;
 }
 
diff --git a/deps/v8/src/wasm/jump-table-assembler.h b/deps/v8/src/wasm/jump-table-assembler.h
index 2100e44199f39a..4aeee29e26d1c1 100644
--- a/deps/v8/src/wasm/jump-table-assembler.h
+++ b/deps/v8/src/wasm/jump-table-assembler.h
@@ -202,13 +202,13 @@ class V8_EXPORT_PRIVATE JumpTableAssembler : public MacroAssembler {
   static constexpr int kFarJumpTableSlotSize = 7 * kInstrSize;
   static constexpr int kLazyCompileTableSlotSize = 12 * kInstrSize;
 #elif V8_TARGET_ARCH_MIPS
-  static constexpr int kJumpTableLineSize = 6 * kInstrSize;
-  static constexpr int kJumpTableSlotSize = 4 * kInstrSize;
+  static constexpr int kJumpTableLineSize = 8 * kInstrSize;
+  static constexpr int kJumpTableSlotSize = 8 * kInstrSize;
   static constexpr int kFarJumpTableSlotSize = 4 * kInstrSize;
   static constexpr int kLazyCompileTableSlotSize = 6 * kInstrSize;
 #elif V8_TARGET_ARCH_MIPS64
   static constexpr int kJumpTableLineSize = 8 * kInstrSize;
-  static constexpr int kJumpTableSlotSize = 6 * kInstrSize;
+  static constexpr int kJumpTableSlotSize = 8 * kInstrSize;
   static constexpr int kFarJumpTableSlotSize = 6 * kInstrSize;
   static constexpr int kLazyCompileTableSlotSize = 8 * kInstrSize;
 #else
diff --git a/deps/v8/src/wasm/module-compiler.cc b/deps/v8/src/wasm/module-compiler.cc
index 9e08f8d1090e7a..ca5c785247b5d9 100644
--- a/deps/v8/src/wasm/module-compiler.cc
+++ b/deps/v8/src/wasm/module-compiler.cc
@@ -381,6 +381,9 @@ class CompilationStateImpl {
   // is invoked which triggers background compilation.
   void InitializeCompilationProgress(bool lazy_module, int num_wrappers);
 
+  // Initialize compilation progress for recompilation of the whole module.
+  void InitializeRecompilationProgress(ExecutionTier tier);
+
   // Add the callback function to be called on compilation events. Needs to be
   // set before {AddCompilationUnits} is run to ensure that it receives all
   // events. The callback object must support being deleted from any thread.
@@ -404,7 +407,8 @@ class CompilationStateImpl {
   void OnFinishedUnits(Vector<WasmCode*>);
   void OnFinishedJSToWasmWrapperUnits(int num);
   void TriggerCallbacks(bool completes_baseline_compilation,
-                        bool completes_top_tier_compilation);
+                        bool completes_top_tier_compilation,
+                        bool completes_recompilation = false);
 
   void OnBackgroundTaskStopped(int task_id, const WasmFeatures& detected);
   void UpdateDetectedFeatures(const WasmFeatures& detected);
@@ -427,6 +431,11 @@ class CompilationStateImpl {
     return outstanding_top_tier_functions_ == 0;
   }
 
+  bool recompilation_finished() const {
+    base::MutexGuard guard(&callbacks_mutex_);
+    return outstanding_recompilation_functions_ == 0;
+  }
+
   CompileMode compile_mode() const { return compile_mode_; }
   Counters* counters() const { return async_counters_.get(); }
   WasmFeatures* detected_features() { return &detected_features_; }
@@ -511,7 +520,7 @@ class CompilationStateImpl {
 
   // Features detected to be used in this module. Features can be detected
   // as a module is being compiled.
-  WasmFeatures detected_features_ = kNoWasmFeatures;
+  WasmFeatures detected_features_ = WasmFeatures::None();
 
   // Abstraction over the storage of the wire bytes. Held in a shared_ptr so
   // that background compilation jobs can keep the storage alive while
@@ -536,13 +545,14 @@ class CompilationStateImpl {
   int outstanding_top_tier_functions_ = 0;
   std::vector<uint8_t> compilation_progress_;
 
+  int outstanding_recompilation_functions_ = 0;
   // End of fields protected by {callbacks_mutex_}.
   //////////////////////////////////////////////////////////////////////////////
 
   // Encoding of fields in the {compilation_progress_} vector.
-  using RequiredBaselineTierField = BitField8<ExecutionTier, 0, 2>;
-  using RequiredTopTierField = BitField8<ExecutionTier, 2, 2>;
-  using ReachedTierField = BitField8<ExecutionTier, 4, 2>;
+  using RequiredBaselineTierField = base::BitField8<ExecutionTier, 0, 2>;
+  using RequiredTopTierField = base::BitField8<ExecutionTier, 2, 2>;
+  using ReachedTierField = base::BitField8<ExecutionTier, 4, 2>;
 };
 
 CompilationStateImpl* Impl(CompilationState* compilation_state) {
@@ -557,7 +567,7 @@ CompilationStateImpl* BackgroundCompileScope::compilation_state() {
 }
 
 void UpdateFeatureUseCounts(Isolate* isolate, const WasmFeatures& detected) {
-  if (detected.threads) {
+  if (detected.has_threads()) {
     isolate->CountUsage(v8::Isolate::UseCounterFeature::kWasmThreadOpcodes);
   }
 }
@@ -597,6 +607,10 @@ bool CompilationState::top_tier_compilation_finished() const {
   return Impl(this)->top_tier_compilation_finished();
 }
 
+bool CompilationState::recompilation_finished() const {
+  return Impl(this)->recompilation_finished();
+}
+
 // static
 std::unique_ptr<CompilationState> CompilationState::New(
     const std::shared_ptr<NativeModule>& native_module,
@@ -628,7 +642,7 @@ ExecutionTier ApplyHintToExecutionTier(WasmCompilationHintTier hint,
 const WasmCompilationHint* GetCompilationHint(const WasmModule* module,
                                               uint32_t func_index) {
   DCHECK_LE(module->num_imported_functions, func_index);
-  uint32_t hint_index = func_index - module->num_imported_functions;
+  uint32_t hint_index = declared_function_index(module, func_index);
   const std::vector<WasmCompilationHint>& compilation_hints =
       module->compilation_hints;
   if (hint_index < compilation_hints.size()) {
@@ -641,7 +655,9 @@ CompileStrategy GetCompileStrategy(const WasmModule* module,
                                    const WasmFeatures& enabled_features,
                                    uint32_t func_index, bool lazy_module) {
   if (lazy_module) return CompileStrategy::kLazy;
-  if (!enabled_features.compilation_hints) return CompileStrategy::kDefault;
+  if (!enabled_features.has_compilation_hints()) {
+    return CompileStrategy::kDefault;
+  }
   auto* hint = GetCompilationHint(module, func_index);
   if (hint == nullptr) return CompileStrategy::kDefault;
   switch (hint->strategy) {
@@ -666,21 +682,19 @@ ExecutionTierPair GetRequestedExecutionTiers(
     const WasmFeatures& enabled_features, uint32_t func_index) {
   ExecutionTierPair result;
 
+  result.baseline_tier = WasmCompilationUnit::GetBaselineExecutionTier(module);
   switch (compile_mode) {
     case CompileMode::kRegular:
-      result.baseline_tier =
-          WasmCompilationUnit::GetDefaultExecutionTier(module);
       result.top_tier = result.baseline_tier;
       return result;
 
     case CompileMode::kTiering:
 
       // Default tiering behaviour.
-      result.baseline_tier = ExecutionTier::kLiftoff;
       result.top_tier = ExecutionTier::kTurbofan;
 
       // Check if compilation hints override default tiering behaviour.
-      if (enabled_features.compilation_hints) {
+      if (enabled_features.has_compilation_hints()) {
         const WasmCompilationHint* hint =
             GetCompilationHint(module, func_index);
         if (hint != nullptr) {
@@ -709,9 +723,7 @@ ExecutionTierPair GetRequestedExecutionTiers(
 class CompilationUnitBuilder {
  public:
   explicit CompilationUnitBuilder(NativeModule* native_module)
-      : native_module_(native_module),
-        default_tier_(WasmCompilationUnit::GetDefaultExecutionTier(
-            native_module->module())) {}
+      : native_module_(native_module) {}
 
   void AddUnits(uint32_t func_index) {
     if (func_index < native_module_->module()->num_imported_functions) {
@@ -749,6 +761,10 @@ class CompilationUnitBuilder {
     tiering_units_.emplace_back(func_index, tiers.top_tier);
   }
 
+  void AddBaselineUnit(int func_index) {
+    baseline_units_.emplace_back(func_index, ExecutionTier::kLiftoff);
+  }
+
   bool Commit() {
     if (baseline_units_.empty() && tiering_units_.empty() &&
         js_to_wasm_wrapper_units_.empty()) {
@@ -773,7 +789,6 @@ class CompilationUnitBuilder {
   }
 
   NativeModule* const native_module_;
-  const ExecutionTier default_tier_;
   std::vector<WasmCompilationUnit> baseline_units_;
   std::vector<WasmCompilationUnit> tiering_units_;
   std::vector<std::shared_ptr<JSToWasmWrapperCompilationUnit>>
@@ -1001,7 +1016,7 @@ bool ExecuteCompilationUnits(
   std::shared_ptr<const WasmModule> module;
   WasmEngine* wasm_engine = nullptr;
   base::Optional<WasmCompilationUnit> unit;
-  WasmFeatures detected_features = kNoWasmFeatures;
+  WasmFeatures detected_features = WasmFeatures::None();
 
   auto stop = [is_foreground, task_id,
                &detected_features](BackgroundCompileScope& compile_scope) {
@@ -1036,7 +1051,8 @@ bool ExecuteCompilationUnits(
 
   auto publish_results = [&results_to_publish](
                              BackgroundCompileScope* compile_scope) {
-    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "PublishResults");
+    TRACE_EVENT1(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "PublishResults",
+                 "num_results", results_to_publish.size());
     if (results_to_publish.empty()) return;
     WasmCodeRefScope code_ref_scope;
     std::vector<WasmCode*> code_vector =
@@ -1065,6 +1081,8 @@ bool ExecuteCompilationUnits(
       }
     }
 
+    native_module->engine()->LogCode(VectorOf(code_vector));
+
     compile_scope->compilation_state()->OnFinishedUnits(VectorOf(code_vector));
     results_to_publish.clear();
   };
@@ -1123,9 +1141,6 @@ int AddExportWrapperUnits(Isolate* isolate, WasmEngine* wasm_engine,
                           NativeModule* native_module,
                           CompilationUnitBuilder* builder,
                           const WasmFeatures& enabled_features) {
-// Disable asynchronous wrapper compilation when builtins are not embedded,
-// otherwise the isolate might be used after tear down to access builtins.
-#ifdef V8_EMBEDDED_BUILTINS
   std::unordered_set<JSToWasmWrapperKey, base::hash<JSToWasmWrapperKey>> keys;
   for (auto exp : native_module->module()->export_table) {
     if (exp.kind != kExternalFunction) continue;
@@ -1140,9 +1155,6 @@ int AddExportWrapperUnits(Isolate* isolate, WasmEngine* wasm_engine,
   }
 
   return static_cast<int>(keys.size());
-#else
-  return 0;
-#endif
 }
 
 // Returns the number of units added.
@@ -1195,16 +1207,29 @@ void InitializeCompilationUnits(Isolate* isolate, NativeModule* native_module) {
   int num_import_wrappers = AddImportWrapperUnits(native_module, &builder);
   int num_export_wrappers =
       AddExportWrapperUnits(isolate, isolate->wasm_engine(), native_module,
-                            &builder, WasmFeaturesFromIsolate(isolate));
+                            &builder, WasmFeatures::FromIsolate(isolate));
   compilation_state->InitializeCompilationProgress(
       lazy_module, num_import_wrappers + num_export_wrappers);
   builder.Commit();
 }
 
+void AddBaselineCompilationUnits(NativeModule* native_module) {
+  CompilationUnitBuilder builder(native_module);
+  auto* module = native_module->module();
+
+  uint32_t start = module->num_imported_functions;
+  uint32_t end = start + module->num_declared_functions;
+  for (uint32_t func_index = start; func_index < end; func_index++) {
+    builder.AddBaselineUnit(func_index);
+  }
+
+  builder.Commit();
+}
+
 bool MayCompriseLazyFunctions(const WasmModule* module,
                               const WasmFeatures& enabled_features,
                               bool lazy_module) {
-  if (lazy_module || enabled_features.compilation_hints) return true;
+  if (lazy_module || enabled_features.has_compilation_hints()) return true;
 #ifdef ENABLE_SLOW_DCHECKS
   int start = module->num_imported_functions;
   int end = start + module->num_declared_functions;
@@ -1271,10 +1296,6 @@ void CompileNativeModule(Isolate* isolate, ErrorThrower* thrower,
     if (thrower->error()) return;
   }
 
-  // Turn on the {CanonicalHandleScope} so that the background threads can
-  // use the node cache.
-  CanonicalHandleScope canonical(isolate);
-
   DCHECK_GE(kMaxInt, native_module->module()->num_declared_functions);
 
   // Install a callback to notify us once background compilation finished, or
@@ -1355,6 +1376,15 @@ std::shared_ptr<NativeModule> CompileToNativeModule(
     std::shared_ptr<const WasmModule> module, const ModuleWireBytes& wire_bytes,
     Handle<FixedArray>* export_wrappers_out) {
   const WasmModule* wasm_module = module.get();
+  std::shared_ptr<NativeModule> native_module =
+      isolate->wasm_engine()->MaybeGetNativeModule(wasm_module->origin,
+                                                   wire_bytes.module_bytes());
+  if (native_module) {
+    // TODO(thibaudm): Look into sharing export wrappers.
+    CompileJsToWasmWrappers(isolate, wasm_module, export_wrappers_out);
+    return native_module;
+  }
+
   TimedHistogramScope wasm_compile_module_time_scope(SELECT_WASM_COUNTER(
       isolate->counters(), wasm_module->origin, wasm_compile, module_time));
 
@@ -1362,34 +1392,67 @@ std::shared_ptr<NativeModule> CompileToNativeModule(
   if (wasm_module->has_shared_memory) {
     isolate->CountUsage(v8::Isolate::UseCounterFeature::kWasmSharedMemory);
   }
-  // TODO(wasm): only save the sections necessary to deserialize a
-  // {WasmModule}. E.g. function bodies could be omitted.
   OwnedVector<uint8_t> wire_bytes_copy =
       OwnedVector<uint8_t>::Of(wire_bytes.module_bytes());
 
   // Create a new {NativeModule} first.
-  auto native_module = isolate->wasm_engine()->NewNativeModule(
-      isolate, enabled, std::move(module));
+  const bool uses_liftoff = module->origin == kWasmOrigin && FLAG_liftoff;
+  size_t code_size_estimate =
+      wasm::WasmCodeManager::EstimateNativeModuleCodeSize(module.get(),
+                                                          uses_liftoff);
+  native_module = isolate->wasm_engine()->NewNativeModule(
+      isolate, enabled, std::move(module), code_size_estimate);
   native_module->SetWireBytes(std::move(wire_bytes_copy));
 
   CompileNativeModule(isolate, thrower, wasm_module, native_module.get());
+  isolate->wasm_engine()->UpdateNativeModuleCache(native_module,
+                                                  thrower->error());
   if (thrower->error()) return {};
 
-#ifdef V8_EMBEDDED_BUILTINS
   Impl(native_module->compilation_state())
       ->FinalizeJSToWasmWrappers(isolate, native_module->module(),
                                  export_wrappers_out);
-#else
-  CompileJsToWasmWrappers(isolate, native_module->module(),
-                          export_wrappers_out);
-#endif
 
-  // Log the code within the generated module for profiling.
-  native_module->LogWasmCodes(isolate);
+  // Ensure that the code objects are logged before returning.
+  isolate->wasm_engine()->LogOutstandingCodesForIsolate(isolate);
 
   return native_module;
 }
 
+void RecompileNativeModule(Isolate* isolate, NativeModule* native_module,
+                           ExecutionTier tier) {
+  // Install a callback to notify us once background recompilation finished.
+  auto recompilation_finished_semaphore = std::make_shared<base::Semaphore>(0);
+  auto* compilation_state = Impl(native_module->compilation_state());
+  DCHECK_EQ(tier, ExecutionTier::kLiftoff);
+  // The callback captures a shared ptr to the semaphore.
+  compilation_state->AddCallback(
+      [recompilation_finished_semaphore](CompilationEvent event) {
+        if (event == CompilationEvent::kFinishedRecompilation) {
+          recompilation_finished_semaphore->Signal();
+        }
+      });
+
+  // Initialize the compilation units and kick off background compile tasks.
+  compilation_state->InitializeRecompilationProgress(tier);
+  AddBaselineCompilationUnits(native_module);
+
+  // The main thread contributes to the compilation, except if we need
+  // deterministic compilation; in that case, the single background task will
+  // execute all compilation.
+  if (!NeedsDeterministicCompile()) {
+    while (ExecuteCompilationUnits(
+        compilation_state->background_compile_token(), isolate->counters(),
+        kMainThreadTaskId, kBaselineOnly)) {
+      // Continue executing compilation units.
+    }
+  }
+
+  // Now wait until baseline recompilation finished.
+  recompilation_finished_semaphore->Wait();
+  DCHECK(!compilation_state->failed());
+}
+
 AsyncCompileJob::AsyncCompileJob(
     Isolate* isolate, const WasmFeatures& enabled,
     std::unique_ptr<byte[]> bytes_copy, size_t length, Handle<Context> context,
@@ -1399,10 +1462,12 @@ AsyncCompileJob::AsyncCompileJob(
       api_method_name_(api_method_name),
       enabled_features_(enabled),
       wasm_lazy_compilation_(FLAG_wasm_lazy_compilation),
+      start_time_(base::TimeTicks::Now()),
       bytes_copy_(std::move(bytes_copy)),
       wire_bytes_(bytes_copy_.get(), bytes_copy_.get() + length),
       resolver_(std::move(resolver)) {
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "new AsyncCompileJob");
+  CHECK(!FLAG_jitless);
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
   v8::Platform* platform = V8::GetCurrentPlatform();
   foreground_task_runner_ = platform->GetForegroundTaskRunner(v8_isolate);
@@ -1431,8 +1496,9 @@ class AsyncStreamingProcessor final : public StreamingProcessor {
   bool ProcessSection(SectionCode section_code, Vector<const uint8_t> bytes,
                       uint32_t offset) override;
 
-  bool ProcessCodeSectionHeader(int functions_count, uint32_t offset,
-                                std::shared_ptr<WireBytesStorage>) override;
+  bool ProcessCodeSectionHeader(int num_functions, uint32_t offset,
+                                std::shared_ptr<WireBytesStorage>,
+                                int code_section_length) override;
 
   bool ProcessFunctionBody(Vector<const uint8_t> bytes,
                            uint32_t offset) override;
@@ -1458,7 +1524,6 @@ class AsyncStreamingProcessor final : public StreamingProcessor {
   AsyncCompileJob* job_;
   WasmEngine* wasm_engine_;
   std::unique_ptr<CompilationUnitBuilder> compilation_unit_builder_;
-  base::TimeTicks start_time_;
   int num_functions_ = 0;
 };
 
@@ -1490,7 +1555,7 @@ AsyncCompileJob::~AsyncCompileJob() {
 }
 
 void AsyncCompileJob::CreateNativeModule(
-    std::shared_ptr<const WasmModule> module) {
+    std::shared_ptr<const WasmModule> module, size_t code_size_estimate) {
   // Embedder usage count for declared shared memories.
   if (module->has_shared_memory) {
     isolate_->CountUsage(v8::Isolate::UseCounterFeature::kWasmSharedMemory);
@@ -1507,7 +1572,7 @@ void AsyncCompileJob::CreateNativeModule(
   // Create the module object.
 
   native_module_ = isolate_->wasm_engine()->NewNativeModule(
-      isolate_, enabled_features_, std::move(module));
+      isolate_, enabled_features_, std::move(module), code_size_estimate);
   native_module_->SetWireBytes({std::move(bytes_copy_), wire_bytes_.length()});
 
   if (stream_) stream_->NotifyNativeModuleCreated(native_module_);
@@ -1516,9 +1581,12 @@ void AsyncCompileJob::CreateNativeModule(
 void AsyncCompileJob::PrepareRuntimeObjects() {
   // Create heap objects for script and module bytes to be stored in the
   // module object. Asm.js is not compiled asynchronously.
+  DCHECK(module_object_.is_null());
   const WasmModule* module = native_module_->module();
+  auto source_url = stream_ ? stream_->url() : Vector<const char>();
   Handle<Script> script =
-      CreateWasmScript(isolate_, wire_bytes_, module->source_map_url);
+      CreateWasmScript(isolate_, wire_bytes_, VectorOf(module->source_map_url),
+                       module->name, source_url);
 
   Handle<WasmModuleObject> module_object =
       WasmModuleObject::New(isolate_, native_module_, script);
@@ -1535,6 +1603,15 @@ void AsyncCompileJob::FinishCompile() {
   if (!is_after_deserialization) {
     PrepareRuntimeObjects();
   }
+
+  // Measure duration of baseline compilation or deserialization from cache.
+  if (base::TimeTicks::IsHighResolution()) {
+    base::TimeDelta duration = base::TimeTicks::Now() - start_time_;
+    int duration_usecs = static_cast<int>(duration.InMicroseconds());
+    isolate_->counters()->wasm_streaming_finish_wasm_module_time()->AddSample(
+        duration_usecs);
+  }
+
   DCHECK(!isolate_->context().is_null());
   // Finish the wasm script now and make it public to the debugger.
   Handle<Script> script(module_object_->script(), isolate_);
@@ -1545,24 +1622,20 @@ void AsyncCompileJob::FinishCompile() {
         AllocationType::kOld);
     script->set_source_mapping_url(*src_map_str.ToHandleChecked());
   }
-  isolate_->debug()->OnAfterCompile(script);
+  {
+    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "Debug::OnAfterCompile");
+    isolate_->debug()->OnAfterCompile(script);
+  }
 
   auto compilation_state =
       Impl(module_object_->native_module()->compilation_state());
   // TODO(bbudge) Allow deserialization without wrapper compilation, so we can
   // just compile wrappers here.
   if (!is_after_deserialization) {
-#ifdef V8_EMBEDDED_BUILTINS
     Handle<FixedArray> export_wrappers;
     compilation_state->FinalizeJSToWasmWrappers(
         isolate_, module_object_->module(), &export_wrappers);
     module_object_->set_export_wrappers(*export_wrappers);
-#else
-    Handle<FixedArray> export_wrappers;
-    CompileJsToWasmWrappers(isolate_, module_object_->module(),
-                            &export_wrappers);
-    module_object_->set_export_wrappers(*export_wrappers);
-#endif
   }
   // We can only update the feature counts once the entire compile is done.
   compilation_state->PublishDetectedFeatures(isolate_);
@@ -1594,6 +1667,8 @@ void AsyncCompileJob::AsyncCompileFailed() {
 }
 
 void AsyncCompileJob::AsyncCompileSucceeded(Handle<WasmModuleObject> result) {
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"),
+               "CompilationResultResolver::OnCompilationSucceeded");
   resolver_->OnCompilationSucceeded(result);
 }
 
@@ -1607,6 +1682,11 @@ class AsyncCompileJob::CompilationStateCallback {
       case CompilationEvent::kFinishedBaselineCompilation:
         DCHECK(!last_event_.has_value());
         if (job_->DecrementAndCheckFinisherCount()) {
+          // TODO(v8:6847): Also share streaming compilation result.
+          if (job_->stream_ == nullptr) {
+            job_->isolate_->wasm_engine()->UpdateNativeModuleCache(
+                job_->native_module_, false);
+          }
           job_->DoSync<CompileFinished>();
         }
         break;
@@ -1615,13 +1695,22 @@ class AsyncCompileJob::CompilationStateCallback {
         // At this point, the job will already be gone, thus do not access it
         // here.
         break;
-      case CompilationEvent::kFailedCompilation: {
+      case CompilationEvent::kFailedCompilation:
         DCHECK(!last_event_.has_value());
         if (job_->DecrementAndCheckFinisherCount()) {
+          // TODO(v8:6847): Also share streaming compilation result.
+          if (job_->stream_ == nullptr) {
+            job_->isolate_->wasm_engine()->UpdateNativeModuleCache(
+                job_->native_module_, true);
+          }
           job_->DoSync<CompileFailed>();
         }
         break;
-      }
+      case CompilationEvent::kFinishedRecompilation:
+        // This event can happen either before or after
+        // {kFinishedTopTierCompilation}, hence don't remember this in
+        // {last_event_}.
+        return;
       default:
         UNREACHABLE();
     }
@@ -1820,7 +1909,13 @@ class AsyncCompileJob::DecodeModule : public AsyncCompileJob::CompileStep {
       job->DoSync<DecodeFail>(std::move(result).error());
     } else {
       // Decode passed.
-      job->DoSync<PrepareAndStartCompile>(std::move(result).value(), true);
+      std::shared_ptr<WasmModule> module = std::move(result).value();
+      const bool kUsesLiftoff = false;
+      size_t code_size_estimate =
+          wasm::WasmCodeManager::EstimateNativeModuleCodeSize(module.get(),
+                                                              kUsesLiftoff);
+      job->DoSync<PrepareAndStartCompile>(std::move(module), true,
+                                          code_size_estimate);
     }
   }
 
@@ -1851,21 +1946,41 @@ class AsyncCompileJob::DecodeFail : public CompileStep {
 class AsyncCompileJob::PrepareAndStartCompile : public CompileStep {
  public:
   PrepareAndStartCompile(std::shared_ptr<const WasmModule> module,
-                         bool start_compilation)
-      : module_(std::move(module)), start_compilation_(start_compilation) {}
+                         bool start_compilation, size_t code_size_estimate)
+      : module_(std::move(module)),
+        start_compilation_(start_compilation),
+        code_size_estimate_(code_size_estimate) {}
 
  private:
-  std::shared_ptr<const WasmModule> module_;
-  bool start_compilation_;
+  const std::shared_ptr<const WasmModule> module_;
+  const bool start_compilation_;
+  const size_t code_size_estimate_;
 
   void RunInForeground(AsyncCompileJob* job) override {
     TRACE_COMPILE("(2) Prepare and start compile...\n");
 
+    // TODO(v8:6847): Also share streaming compilation result.
+    if (job->stream_ == nullptr) {
+      auto cached_native_module =
+          job->isolate_->wasm_engine()->MaybeGetNativeModule(
+              module_->origin, job->wire_bytes_.module_bytes());
+      if (cached_native_module != nullptr) {
+        job->native_module_ = std::move(cached_native_module);
+        job->PrepareRuntimeObjects();
+        Handle<FixedArray> export_wrappers;
+        CompileJsToWasmWrappers(job->isolate_, job->native_module_->module(),
+                                &export_wrappers);
+        job->module_object_->set_export_wrappers(*export_wrappers);
+        job->FinishCompile();
+        return;
+      }
+    }
+
     // Make sure all compilation tasks stopped running. Decoding (async step)
     // is done.
     job->background_task_manager_.CancelAndWait();
 
-    job->CreateNativeModule(module_);
+    job->CreateNativeModule(module_, code_size_estimate_);
 
     CompilationStateImpl* compilation_state =
         Impl(job->native_module_->compilation_state());
@@ -1914,6 +2029,7 @@ class SampleTopTierCodeSizeCallback {
   void operator()(CompilationEvent event) {
     // This callback is registered after baseline compilation finished, so the
     // only possible event to follow is {kFinishedTopTierCompilation}.
+    if (event == CompilationEvent::kFinishedRecompilation) return;
     DCHECK_EQ(CompilationEvent::kFinishedTopTierCompilation, event);
     if (std::shared_ptr<NativeModule> native_module = native_module_.lock()) {
       native_module->engine()->SampleTopTierCodeSizeInAllIsolates(
@@ -1956,8 +2072,7 @@ AsyncStreamingProcessor::AsyncStreamingProcessor(AsyncCompileJob* job)
     : decoder_(job->enabled_features_),
       job_(job),
       wasm_engine_(job_->isolate_->wasm_engine()),
-      compilation_unit_builder_(nullptr),
-      start_time_(base::TimeTicks::Now()) {}
+      compilation_unit_builder_(nullptr) {}
 
 void AsyncStreamingProcessor::FinishAsyncCompileJobWithError(
     const WasmError& error) {
@@ -2031,19 +2146,28 @@ bool AsyncStreamingProcessor::ProcessSection(SectionCode section_code,
 
 // Start the code section.
 bool AsyncStreamingProcessor::ProcessCodeSectionHeader(
-    int functions_count, uint32_t offset,
-    std::shared_ptr<WireBytesStorage> wire_bytes_storage) {
+    int num_functions, uint32_t offset,
+    std::shared_ptr<WireBytesStorage> wire_bytes_storage,
+    int code_section_length) {
   TRACE_STREAMING("Start the code section with %d functions...\n",
-                  functions_count);
-  if (!decoder_.CheckFunctionsCount(static_cast<uint32_t>(functions_count),
+                  num_functions);
+  if (!decoder_.CheckFunctionsCount(static_cast<uint32_t>(num_functions),
                                     offset)) {
     FinishAsyncCompileJobWithError(decoder_.FinishDecoding(false).error());
     return false;
   }
   // Execute the PrepareAndStartCompile step immediately and not in a separate
   // task.
+  int num_imported_functions =
+      static_cast<int>(decoder_.module()->num_imported_functions);
+  DCHECK_EQ(kWasmOrigin, decoder_.module()->origin);
+  const bool uses_liftoff = FLAG_liftoff;
+  size_t code_size_estimate =
+      wasm::WasmCodeManager::EstimateNativeModuleCodeSize(
+          num_functions, num_imported_functions, code_section_length,
+          uses_liftoff);
   job_->DoImmediately<AsyncCompileJob::PrepareAndStartCompile>(
-      decoder_.shared_module(), false);
+      decoder_.shared_module(), false, code_size_estimate);
   auto* compilation_state = Impl(job_->native_module_->compilation_state());
   compilation_state->SetWireBytesStorage(std::move(wire_bytes_storage));
   DCHECK_EQ(job_->native_module_->module()->origin, kWasmOrigin);
@@ -2152,7 +2276,8 @@ void AsyncStreamingProcessor::OnFinishedStream(OwnedVector<uint8_t> bytes) {
   if (job_->native_module_ == nullptr) {
     // We are processing a WebAssembly module without code section. Create the
     // runtime objects now (would otherwise happen in {PrepareAndStartCompile}).
-    job_->CreateNativeModule(std::move(result).value());
+    constexpr size_t kCodeSizeEstimate = 0;
+    job_->CreateNativeModule(std::move(result).value(), kCodeSizeEstimate);
     DCHECK(needs_finish);
   }
   job_->wire_bytes_ = ModuleWireBytes(bytes.as_vector());
@@ -2184,23 +2309,15 @@ bool AsyncStreamingProcessor::Deserialize(Vector<const uint8_t> module_bytes,
   HandleScope scope(job_->isolate_);
   SaveAndSwitchContext saved_context(job_->isolate_, *job_->native_context_);
 
-  MaybeHandle<WasmModuleObject> result =
-      DeserializeNativeModule(job_->isolate_, module_bytes, wire_bytes);
-  if (base::TimeTicks::IsHighResolution()) {
-    base::TimeDelta duration = base::TimeTicks::Now() - start_time_;
-    auto* histogram = job_->isolate_->counters()
-                          ->wasm_streaming_deserialize_wasm_module_time();
-    histogram->AddSample(static_cast<int>(duration.InMicroseconds()));
-  }
+  MaybeHandle<WasmModuleObject> result = DeserializeNativeModule(
+      job_->isolate_, module_bytes, wire_bytes, job_->stream_->url());
 
   if (result.is_null()) return false;
 
   job_->module_object_ =
       job_->isolate_->global_handles()->Create(*result.ToHandleChecked());
   job_->native_module_ = job_->module_object_->shared_native_module();
-  auto owned_wire_bytes = OwnedVector<uint8_t>::Of(wire_bytes);
-  job_->wire_bytes_ = ModuleWireBytes(owned_wire_bytes.as_vector());
-  job_->native_module_->SetWireBytes(std::move(owned_wire_bytes));
+  job_->wire_bytes_ = ModuleWireBytes(job_->native_module_->wire_bytes());
   job_->FinishCompile();
   return true;
 }
@@ -2302,6 +2419,37 @@ void CompilationStateImpl::InitializeCompilationProgress(bool lazy_module,
   }
 }
 
+void CompilationStateImpl::InitializeRecompilationProgress(ExecutionTier tier) {
+  DCHECK(!failed());
+  auto* module = native_module_->module();
+
+  base::MutexGuard guard(&callbacks_mutex_);
+  // Ensure that we don't trigger recompilation if another recompilation is
+  // already happening.
+  DCHECK_EQ(0, outstanding_recompilation_functions_);
+  int start = module->num_imported_functions;
+  int end = start + module->num_declared_functions;
+  for (int function_index = start; function_index < end; function_index++) {
+    int slot_index = function_index - start;
+    DCHECK_LT(slot_index, compilation_progress_.size());
+    ExecutionTier reached_tier =
+        ReachedTierField::decode(compilation_progress_[slot_index]);
+    if (reached_tier != tier) {
+      outstanding_recompilation_functions_++;
+    }
+  }
+  DCHECK_LE(0, outstanding_recompilation_functions_);
+  DCHECK_LE(outstanding_recompilation_functions_,
+            module->num_declared_functions);
+
+  // Trigger callbacks if module needs no recompilation.
+  if (outstanding_recompilation_functions_ == 0) {
+    for (auto& callback : callbacks_) {
+      callback(CompilationEvent::kFinishedRecompilation);
+    }
+  }
+}
+
 void CompilationStateImpl::AddCallback(CompilationState::callback_t callback) {
   base::MutexGuard callbacks_guard(&callbacks_mutex_);
   callbacks_.emplace_back(std::move(callback));
@@ -2345,8 +2493,8 @@ void CompilationStateImpl::FinalizeJSToWasmWrappers(
   // TODO(6792): Wrappers below are allocated with {Factory::NewCode}. As an
   // optimization we keep the code space unlocked to avoid repeated unlocking
   // because many such wrapper are allocated in sequence below.
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"),
-               "FinalizeJSToWasmWrappers");
+  TRACE_EVENT1(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "FinalizeJSToWasmWrappers",
+               "num_wrappers", js_to_wasm_wrapper_units_.size());
   CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
   for (auto& unit : js_to_wasm_wrapper_units_) {
     Handle<Code> code = unit->Finalize(isolate);
@@ -2364,7 +2512,8 @@ CompilationStateImpl::GetNextCompilationUnit(
 }
 
 void CompilationStateImpl::OnFinishedUnits(Vector<WasmCode*> code_vector) {
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "OnFinishedUnits");
+  TRACE_EVENT1(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "OnFinishedUnits",
+               "num_units", code_vector.size());
 
   base::MutexGuard guard(&callbacks_mutex_);
 
@@ -2372,7 +2521,8 @@ void CompilationStateImpl::OnFinishedUnits(Vector<WasmCode*> code_vector) {
   // This is especially important for lazy modules that were deserialized.
   // Compilation progress was not set up in these cases.
   if (outstanding_baseline_units_ == 0 &&
-      outstanding_top_tier_functions_ == 0) {
+      outstanding_top_tier_functions_ == 0 &&
+      outstanding_recompilation_functions_ == 0) {
     return;
   }
 
@@ -2386,13 +2536,14 @@ void CompilationStateImpl::OnFinishedUnits(Vector<WasmCode*> code_vector) {
   DCHECK_EQ(compilation_progress_.size(),
             native_module_->module()->num_declared_functions);
 
+  bool completes_baseline_compilation = false;
+  bool completes_top_tier_compilation = false;
+  bool completes_recompilation = false;
+
   for (WasmCode* code : code_vector) {
     DCHECK_NOT_NULL(code);
     DCHECK_LT(code->index(), native_module_->num_functions());
 
-    bool completes_baseline_compilation = false;
-    bool completes_top_tier_compilation = false;
-
     if (code->index() < native_module_->num_imported_functions()) {
       // Import wrapper.
       DCHECK_EQ(code->tier(), ExecutionTier::kTurbofan);
@@ -2403,14 +2554,13 @@ void CompilationStateImpl::OnFinishedUnits(Vector<WasmCode*> code_vector) {
     } else {
       // Function.
       DCHECK_NE(code->tier(), ExecutionTier::kNone);
-      native_module_->engine()->LogCode(code);
 
       // Read function's compilation progress.
       // This view on the compilation progress may differ from the actually
       // compiled code. Any lazily compiled function does not contribute to the
       // compilation progress but may publish code to the code manager.
       int slot_index =
-          code->index() - native_module_->module()->num_imported_functions;
+          declared_function_index(native_module_->module(), code->index());
       uint8_t function_progress = compilation_progress_[slot_index];
       ExecutionTier required_baseline_tier =
           RequiredBaselineTierField::decode(function_progress);
@@ -2436,17 +2586,34 @@ void CompilationStateImpl::OnFinishedUnits(Vector<WasmCode*> code_vector) {
         }
       }
 
-      // Update function's compilation progress.
-      if (code->tier() > reached_tier) {
-        compilation_progress_[slot_index] = ReachedTierField::update(
-            compilation_progress_[slot_index], code->tier());
+      // If there is recompilation in progress, we would only count the
+      // functions which are not Liftoff already, and would only decrement the
+      // counter once a function reaches Liftoff.
+      if (outstanding_recompilation_functions_ > 0) {
+        // TODO(duongn): extend this logic for tier up.
+        if (code->tier() == ExecutionTier::kLiftoff &&
+            reached_tier != ExecutionTier::kLiftoff) {
+          outstanding_recompilation_functions_--;
+          // Update function's compilation progress.
+          compilation_progress_[slot_index] = ReachedTierField::update(
+              compilation_progress_[slot_index], code->tier());
+          if (outstanding_recompilation_functions_ == 0) {
+            completes_recompilation = true;
+          }
+        }
+      } else {
+        // Update function's compilation progress.
+        if (code->tier() > reached_tier) {
+          compilation_progress_[slot_index] = ReachedTierField::update(
+              compilation_progress_[slot_index], code->tier());
+        }
       }
       DCHECK_LE(0, outstanding_baseline_units_);
     }
-
-    TriggerCallbacks(completes_baseline_compilation,
-                     completes_top_tier_compilation);
   }
+
+  TriggerCallbacks(completes_baseline_compilation,
+                   completes_top_tier_compilation, completes_recompilation);
 }
 
 void CompilationStateImpl::OnFinishedJSToWasmWrapperUnits(int num) {
@@ -2457,8 +2624,14 @@ void CompilationStateImpl::OnFinishedJSToWasmWrapperUnits(int num) {
   TriggerCallbacks(completes_baseline_compilation, false);
 }
 
-void CompilationStateImpl::TriggerCallbacks(
-    bool completes_baseline_compilation, bool completes_top_tier_compilation) {
+void CompilationStateImpl::TriggerCallbacks(bool completes_baseline_compilation,
+                                            bool completes_top_tier_compilation,
+                                            bool completes_recompilation) {
+  if (completes_recompilation) {
+    for (auto& callback : callbacks_) {
+      callback(CompilationEvent::kFinishedRecompilation);
+    }
+  }
   if (completes_baseline_compilation) {
     TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "BaselineFinished");
     for (auto& callback : callbacks_) {
@@ -2473,6 +2646,10 @@ void CompilationStateImpl::TriggerCallbacks(
     for (auto& callback : callbacks_) {
       callback(CompilationEvent::kFinishedTopTierCompilation);
     }
+  }
+  if (outstanding_baseline_units_ == 0 &&
+      outstanding_top_tier_functions_ == 0 &&
+      outstanding_recompilation_functions_ == 0) {
     // Clear the callbacks because no more events will be delivered.
     callbacks_.clear();
   }
@@ -2486,7 +2663,7 @@ void CompilationStateImpl::OnBackgroundTaskStopped(
                             available_task_ids_.end(), task_id));
     DCHECK_GT(max_background_tasks_, available_task_ids_.size());
     available_task_ids_.push_back(task_id);
-    UnionFeaturesInto(&detected_features_, detected);
+    detected_features_.Add(detected);
   }
 
   // The background task could have stopped while we were adding new units, or
@@ -2498,7 +2675,7 @@ void CompilationStateImpl::OnBackgroundTaskStopped(
 void CompilationStateImpl::UpdateDetectedFeatures(
     const WasmFeatures& detected) {
   base::MutexGuard guard(&mutex_);
-  UnionFeaturesInto(&detected_features_, detected);
+  detected_features_.Add(detected);
 }
 
 void CompilationStateImpl::PublishDetectedFeatures(Isolate* isolate) {
@@ -2539,7 +2716,7 @@ void CompilationStateImpl::RestartBackgroundTasks() {
     }
   }
 
-  if (baseline_compilation_finished()) {
+  if (baseline_compilation_finished() && recompilation_finished()) {
     for (auto& task : new_tasks) {
       V8::GetCurrentPlatform()->CallLowPriorityTaskOnWorkerThread(
           std::move(task));
@@ -2603,7 +2780,7 @@ void CompileJsToWasmWrappers(Isolate* isolate, const WasmModule* module,
 
   JSToWasmWrapperQueue queue;
   JSToWasmWrapperUnitMap compilation_units;
-  WasmFeatures enabled_features = WasmFeaturesFromIsolate(isolate);
+  WasmFeatures enabled_features = WasmFeatures::FromIsolate(isolate);
 
   // Prepare compilation units in the main thread.
   for (auto exp : module->export_table) {
@@ -2680,9 +2857,12 @@ WasmCode* CompileImportWrapper(
 
 Handle<Script> CreateWasmScript(Isolate* isolate,
                                 const ModuleWireBytes& wire_bytes,
-                                const std::string& source_map_url) {
+                                Vector<const char> source_map_url,
+                                WireBytesRef name,
+                                Vector<const char> source_url) {
   Handle<Script> script =
       isolate->factory()->NewScript(isolate->factory()->empty_string());
+  script->set_compilation_state(Script::COMPILATION_STATE_COMPILED);
   script->set_context_data(isolate->native_context()->debug_context_id());
   script->set_type(Script::TYPE_WASM);
 
@@ -2693,25 +2873,48 @@ Handle<Script> CreateWasmScript(Isolate* isolate,
   const int kBufferSize = 32;
   char buffer[kBufferSize];
 
-  Handle<String> url_prefix =
-      isolate->factory()->InternalizeString(StaticCharVector("wasm://wasm/"));
-
-  int name_chars = SNPrintF(ArrayVector(buffer), "wasm-%08x", hash);
-  DCHECK(name_chars >= 0 && name_chars < kBufferSize);
-  Handle<String> name_str =
-      isolate->factory()
-          ->NewStringFromOneByte(
-              VectorOf(reinterpret_cast<uint8_t*>(buffer), name_chars),
-              AllocationType::kOld)
-          .ToHandleChecked();
+  // Script name is "<module_name>-hash" if name is available and "hash"
+  // otherwise.
+  Handle<String> name_str;
+  if (name.is_set()) {
+    int name_chars = SNPrintF(ArrayVector(buffer), "-%08x", hash);
+    DCHECK(name_chars >= 0 && name_chars < kBufferSize);
+    Handle<String> name_hash =
+        isolate->factory()
+            ->NewStringFromOneByte(
+                VectorOf(reinterpret_cast<uint8_t*>(buffer), name_chars),
+                AllocationType::kOld)
+            .ToHandleChecked();
+    Handle<String> module_name =
+        WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+            isolate, wire_bytes.module_bytes(), name, kNoInternalize);
+    name_str = isolate->factory()
+                   ->NewConsString(module_name, name_hash)
+                   .ToHandleChecked();
+  } else {
+    int name_chars = SNPrintF(ArrayVector(buffer), "%08x", hash);
+    DCHECK(name_chars >= 0 && name_chars < kBufferSize);
+    name_str = isolate->factory()
+                   ->NewStringFromOneByte(
+                       VectorOf(reinterpret_cast<uint8_t*>(buffer), name_chars),
+                       AllocationType::kOld)
+                   .ToHandleChecked();
+  }
   script->set_name(*name_str);
-  MaybeHandle<String> url_str =
-      isolate->factory()->NewConsString(url_prefix, name_str);
+  MaybeHandle<String> url_str;
+  if (!source_url.empty()) {
+    url_str =
+        isolate->factory()->NewStringFromUtf8(source_url, AllocationType::kOld);
+  } else {
+    Handle<String> url_prefix =
+        isolate->factory()->InternalizeString(StaticCharVector("wasm://wasm/"));
+    url_str = isolate->factory()->NewConsString(url_prefix, name_str);
+  }
   script->set_source_url(*url_str.ToHandleChecked());
 
-  if (source_map_url.size() != 0) {
+  if (!source_map_url.empty()) {
     MaybeHandle<String> src_map_str = isolate->factory()->NewStringFromUtf8(
-        CStrVector(source_map_url.c_str()), AllocationType::kOld);
+        source_map_url, AllocationType::kOld);
     script->set_source_mapping_url(*src_map_str.ToHandleChecked());
   }
   return script;
diff --git a/deps/v8/src/wasm/module-compiler.h b/deps/v8/src/wasm/module-compiler.h
index 69eb6bb62c404b..b60c12702f74c5 100644
--- a/deps/v8/src/wasm/module-compiler.h
+++ b/deps/v8/src/wasm/module-compiler.h
@@ -44,6 +44,9 @@ std::shared_ptr<NativeModule> CompileToNativeModule(
     std::shared_ptr<const WasmModule> module, const ModuleWireBytes& wire_bytes,
     Handle<FixedArray>* export_wrappers_out);
 
+void RecompileNativeModule(Isolate* isolate, NativeModule* native_module,
+                           ExecutionTier tier);
+
 V8_EXPORT_PRIVATE
 void CompileJsToWasmWrappers(Isolate* isolate, const WasmModule* module,
                              Handle<FixedArray>* export_wrappers_out);
@@ -59,7 +62,8 @@ WasmCode* CompileImportWrapper(
 
 V8_EXPORT_PRIVATE Handle<Script> CreateWasmScript(
     Isolate* isolate, const ModuleWireBytes& wire_bytes,
-    const std::string& source_map_url);
+    Vector<const char> source_map_url, WireBytesRef name,
+    Vector<const char> source_url = {});
 
 // Triggered by the WasmCompileLazy builtin. The return value indicates whether
 // compilation was successful. Lazy compilation can fail only if validation is
@@ -143,7 +147,8 @@ class AsyncCompileJob {
     return outstanding_finishers_.fetch_sub(1) == 1;
   }
 
-  void CreateNativeModule(std::shared_ptr<const WasmModule> module);
+  void CreateNativeModule(std::shared_ptr<const WasmModule> module,
+                          size_t code_size_estimate);
   void PrepareRuntimeObjects();
 
   void FinishCompile();
@@ -191,6 +196,7 @@ class AsyncCompileJob {
   const char* const api_method_name_;
   const WasmFeatures enabled_features_;
   const bool wasm_lazy_compilation_;
+  base::TimeTicks start_time_;
   // Copy of the module wire bytes, moved into the {native_module_} on its
   // creation.
   std::unique_ptr<byte[]> bytes_copy_;
diff --git a/deps/v8/src/wasm/module-decoder.cc b/deps/v8/src/wasm/module-decoder.cc
index b89d06b881cde0..bc8260cd9b1668 100644
--- a/deps/v8/src/wasm/module-decoder.cc
+++ b/deps/v8/src/wasm/module-decoder.cc
@@ -291,14 +291,15 @@ class ModuleDecoderImpl : public Decoder {
     size_t hash = base::hash_range(module_bytes.begin(), module_bytes.end());
     EmbeddedVector<char, 32> buf;
     SNPrintF(buf, "%016zx.%s.wasm", hash, ok() ? "ok" : "failed");
-    std::string name(buf.begin());
-    if (FILE* wasm_file = base::OS::FOpen((path + name).c_str(), "wb")) {
-      if (fwrite(module_bytes.begin(), module_bytes.length(), 1, wasm_file) !=
-          1) {
-        OFStream os(stderr);
-        os << "Error while dumping wasm file" << std::endl;
-      }
-      fclose(wasm_file);
+    path += buf.begin();
+    size_t rv = 0;
+    if (FILE* file = base::OS::FOpen(path.c_str(), "wb")) {
+      rv = fwrite(module_bytes.begin(), module_bytes.length(), 1, file);
+      fclose(file);
+    }
+    if (rv != 1) {
+      OFStream os(stderr);
+      os << "Error while dumping wasm file to " << path << std::endl;
     }
   }
 
@@ -467,7 +468,7 @@ class ModuleDecoderImpl : public Decoder {
         consume_bytes(static_cast<uint32_t>(end_ - start_), ".debug_info");
         break;
       case kCompilationHintsSectionCode:
-        if (enabled_features_.compilation_hints) {
+        if (enabled_features_.has_compilation_hints()) {
           DecodeCompilationHintsSection();
         } else {
           // Ignore this section when feature was disabled. It is an optional
@@ -476,14 +477,14 @@ class ModuleDecoderImpl : public Decoder {
         }
         break;
       case kDataCountSectionCode:
-        if (enabled_features_.bulk_memory) {
+        if (enabled_features_.has_bulk_memory()) {
           DecodeDataCountSection();
         } else {
           errorf(pc(), "unexpected section <%s>", SectionName(section_code));
         }
         break;
       case kExceptionSectionCode:
-        if (enabled_features_.eh) {
+        if (enabled_features_.has_eh()) {
           DecodeExceptionSection();
         } else {
           errorf(pc(), "unexpected section <%s>", SectionName(section_code));
@@ -562,7 +563,7 @@ class ModuleDecoderImpl : public Decoder {
           WasmTable* table = &module_->tables.back();
           table->imported = true;
           ValueType type = consume_reference_type();
-          if (!enabled_features_.anyref) {
+          if (!enabled_features_.has_anyref()) {
             if (type != kWasmFuncRef) {
               error(pc_ - 1, "invalid table type");
               break;
@@ -601,7 +602,7 @@ class ModuleDecoderImpl : public Decoder {
         }
         case kExternalException: {
           // ===== Imported exception ==========================================
-          if (!enabled_features_.eh) {
+          if (!enabled_features_.has_eh()) {
             errorf(pos, "unknown import kind 0x%02x", import->kind);
             break;
           }
@@ -648,7 +649,8 @@ class ModuleDecoderImpl : public Decoder {
   void DecodeTableSection() {
     // TODO(ahaas): Set the correct limit to {kV8MaxWasmTables} once the
     // implementation of AnyRef landed.
-    uint32_t max_count = enabled_features_.anyref ? 100000 : kV8MaxWasmTables;
+    uint32_t max_count =
+        enabled_features_.has_anyref() ? 100000 : kV8MaxWasmTables;
     uint32_t table_count = consume_count("table count", max_count);
 
     for (uint32_t i = 0; ok() && i < table_count; i++) {
@@ -745,7 +747,7 @@ class ModuleDecoderImpl : public Decoder {
           break;
         }
         case kExternalException: {
-          if (!enabled_features_.eh) {
+          if (!enabled_features_.has_eh()) {
             errorf(pos, "invalid export kind 0x%02x", exp->kind);
             break;
           }
@@ -966,7 +968,9 @@ class ModuleDecoderImpl : public Decoder {
         // Function and local names will be decoded when needed.
         if (name_type == NameSectionKindCode::kModule) {
           WireBytesRef name = consume_string(&inner, false, "module name");
-          if (inner.ok() && validate_utf8(&inner, name)) module_->name = name;
+          if (inner.ok() && validate_utf8(&inner, name)) {
+            module_->name = name;
+          }
         } else {
           inner.consume_bytes(name_payload_len, "name subsection payload");
         }
@@ -1236,7 +1240,7 @@ class ModuleDecoderImpl : public Decoder {
   }
 
   bool AddTable(WasmModule* module) {
-    if (enabled_features_.anyref) return true;
+    if (enabled_features_.has_anyref()) return true;
     if (module->tables.size() > 0) {
       error("At most one table is supported");
       return false;
@@ -1329,7 +1333,7 @@ class ModuleDecoderImpl : public Decoder {
                                               wasm_decode, function_time);
 
       TimedHistogramScope wasm_decode_function_time_scope(time_counter);
-      WasmFeatures unused_detected_features;
+      WasmFeatures unused_detected_features = WasmFeatures::None();
       result = VerifyWasmCode(allocator, enabled_features_, module,
                               &unused_detected_features, body);
     }
@@ -1424,7 +1428,7 @@ class ModuleDecoderImpl : public Decoder {
     uint8_t flags = consume_u8("resizable limits flags");
     const byte* pos = pc();
     *has_shared_memory = false;
-    if (enabled_features_.threads) {
+    if (enabled_features_.has_threads()) {
       if (flags & 0xFC) {
         errorf(pos - 1, "invalid memory limits flags");
       } else if (flags == 3) {
@@ -1542,7 +1546,7 @@ class ModuleDecoderImpl : public Decoder {
         break;
       }
       case kExprRefNull: {
-        if (enabled_features_.anyref || enabled_features_.eh) {
+        if (enabled_features_.has_anyref() || enabled_features_.has_eh()) {
           expr.kind = WasmInitExpr::kRefNullConst;
           len = 0;
           break;
@@ -1550,7 +1554,7 @@ class ModuleDecoderImpl : public Decoder {
         V8_FALLTHROUGH;
       }
       case kExprRefFunc: {
-        if (enabled_features_.anyref) {
+        if (enabled_features_.has_anyref()) {
           FunctionIndexImmediate<Decoder::kValidate> imm(this, pc() - 1);
           if (module->functions.size() <= imm.index) {
             errorf(pc() - 1, "invalid function index: %u", imm.index);
@@ -1605,16 +1609,19 @@ class ModuleDecoderImpl : public Decoder {
         if (origin_ == kWasmOrigin) {
           switch (t) {
             case kLocalS128:
-              if (enabled_features_.simd) return kWasmS128;
+              if (enabled_features_.has_simd()) return kWasmS128;
               break;
             case kLocalFuncRef:
-              if (enabled_features_.anyref) return kWasmFuncRef;
+              if (enabled_features_.has_anyref()) return kWasmFuncRef;
               break;
             case kLocalAnyRef:
-              if (enabled_features_.anyref) return kWasmAnyRef;
+              if (enabled_features_.has_anyref()) return kWasmAnyRef;
+              break;
+            case kLocalNullRef:
+              if (enabled_features_.has_anyref()) return kWasmNullRef;
               break;
             case kLocalExnRef:
-              if (enabled_features_.eh) return kWasmExnRef;
+              if (enabled_features_.has_eh()) return kWasmExnRef;
               break;
             default:
               break;
@@ -1633,11 +1640,24 @@ class ModuleDecoderImpl : public Decoder {
       case kLocalFuncRef:
         return kWasmFuncRef;
       case kLocalAnyRef:
-        if (!enabled_features_.anyref) {
+        if (!enabled_features_.has_anyref()) {
           error(pc_ - 1,
                 "Invalid type. Set --experimental-wasm-anyref to use 'AnyRef'");
         }
         return kWasmAnyRef;
+      case kLocalNullRef:
+        if (!enabled_features_.has_anyref()) {
+          error(
+              pc_ - 1,
+              "Invalid type. Set --experimental-wasm-anyref to use 'NullRef'");
+        }
+        return kWasmNullRef;
+      case kLocalExnRef:
+        if (!enabled_features_.has_eh()) {
+          error(pc_ - 1,
+                "Invalid type. Set --experimental-wasm-eh to use 'ExnRef'");
+        }
+        return kWasmExnRef;
       default:
         break;
     }
@@ -1658,7 +1678,7 @@ class ModuleDecoderImpl : public Decoder {
     }
     std::vector<ValueType> returns;
     // parse return types
-    const size_t max_return_count = enabled_features_.mv
+    const size_t max_return_count = enabled_features_.has_mv()
                                         ? kV8MaxWasmFunctionMultiReturns
                                         : kV8MaxWasmFunctionReturns;
     uint32_t return_count = consume_count("return count", max_return_count);
@@ -1696,7 +1716,7 @@ class ModuleDecoderImpl : public Decoder {
                                       WasmInitExpr* offset) {
     const byte* pos = pc();
     uint8_t flag;
-    if (enabled_features_.bulk_memory || enabled_features_.anyref) {
+    if (enabled_features_.has_bulk_memory() || enabled_features_.has_anyref()) {
       flag = consume_u8("flag");
     } else {
       uint32_t table_index = consume_u32v("table index");
@@ -1727,18 +1747,18 @@ class ModuleDecoderImpl : public Decoder {
     *functions_as_elements = flag & kFunctionsAsElementsMask;
     bool has_table_index = flag & kHasTableIndexMask;
 
-    if (is_passive && !enabled_features_.bulk_memory) {
+    if (is_passive && !enabled_features_.has_bulk_memory()) {
       error("Passive element segments require --experimental-wasm-bulk-memory");
       return;
     }
-    if (*functions_as_elements && !enabled_features_.bulk_memory) {
+    if (*functions_as_elements && !enabled_features_.has_bulk_memory()) {
       error(
           "Illegal segment flag. Did you forget "
           "--experimental-wasm-bulk-memory?");
       return;
     }
-    if (flag != 0 && !enabled_features_.bulk_memory &&
-        !enabled_features_.anyref) {
+    if (flag != 0 && !enabled_features_.has_bulk_memory() &&
+        !enabled_features_.has_anyref()) {
       error(
           "Invalid segment flag. Did you forget "
           "--experimental-wasm-bulk-memory or --experimental-wasm-anyref?");
@@ -1792,13 +1812,14 @@ class ModuleDecoderImpl : public Decoder {
 
     // Some flag values are only valid for specific proposals.
     if (flag == SegmentFlags::kPassive) {
-      if (!enabled_features_.bulk_memory) {
+      if (!enabled_features_.has_bulk_memory()) {
         error(
             "Passive element segments require --experimental-wasm-bulk-memory");
         return;
       }
     } else if (flag == SegmentFlags::kActiveWithIndex) {
-      if (!(enabled_features_.bulk_memory || enabled_features_.anyref)) {
+      if (!(enabled_features_.has_bulk_memory() ||
+            enabled_features_.has_anyref())) {
         error(
             "Element segments with table indices require "
             "--experimental-wasm-bulk-memory or --experimental-wasm-anyref");
@@ -2009,29 +2030,26 @@ FunctionResult DecodeWasmFunctionForTesting(
                                       std::make_unique<WasmFunction>());
 }
 
-AsmJsOffsetsResult DecodeAsmJsOffsets(const byte* tables_start,
-                                      const byte* tables_end) {
-  AsmJsOffsets table;
+AsmJsOffsetsResult DecodeAsmJsOffsets(Vector<const uint8_t> encoded_offsets) {
+  std::vector<AsmJsOffsetFunctionEntries> functions;
 
-  Decoder decoder(tables_start, tables_end);
+  Decoder decoder(encoded_offsets);
   uint32_t functions_count = decoder.consume_u32v("functions count");
-  // Reserve space for the entries, taking care of invalid input.
-  if (functions_count < static_cast<uint32_t>(tables_end - tables_start)) {
-    table.reserve(functions_count);
-  }
+  // Sanity check.
+  DCHECK_GE(encoded_offsets.size(), functions_count);
+  functions.reserve(functions_count);
 
-  for (uint32_t i = 0; i < functions_count && decoder.ok(); ++i) {
+  for (uint32_t i = 0; i < functions_count; ++i) {
     uint32_t size = decoder.consume_u32v("table size");
     if (size == 0) {
-      table.emplace_back();
+      functions.emplace_back();
       continue;
     }
-    if (!decoder.checkAvailable(size)) {
-      decoder.error("illegal asm function offset table size");
-    }
+    DCHECK(decoder.checkAvailable(size));
     const byte* table_end = decoder.pc() + size;
     uint32_t locals_size = decoder.consume_u32v("locals size");
     int function_start_position = decoder.consume_u32v("function start pos");
+    int function_end_position = function_start_position;
     int last_byte_offset = locals_size;
     int last_asm_position = function_start_position;
     std::vector<AsmJsOffsetEntry> func_asm_offsets;
@@ -2039,24 +2057,32 @@ AsmJsOffsetsResult DecodeAsmJsOffsets(const byte* tables_start,
     // Add an entry for the stack check, associated with position 0.
     func_asm_offsets.push_back(
         {0, function_start_position, function_start_position});
-    while (decoder.ok() && decoder.pc() < table_end) {
+    while (decoder.pc() < table_end) {
+      DCHECK(decoder.ok());
       last_byte_offset += decoder.consume_u32v("byte offset delta");
       int call_position =
           last_asm_position + decoder.consume_i32v("call position delta");
       int to_number_position =
           call_position + decoder.consume_i32v("to_number position delta");
       last_asm_position = to_number_position;
-      func_asm_offsets.push_back(
-          {last_byte_offset, call_position, to_number_position});
-    }
-    if (decoder.pc() != table_end) {
-      decoder.error("broken asm offset table");
+      if (decoder.pc() == table_end) {
+        // The last entry is the function end marker.
+        DCHECK_EQ(call_position, to_number_position);
+        function_end_position = call_position;
+      } else {
+        func_asm_offsets.push_back(
+            {last_byte_offset, call_position, to_number_position});
+      }
     }
-    table.push_back(std::move(func_asm_offsets));
+    DCHECK_EQ(decoder.pc(), table_end);
+    functions.emplace_back(AsmJsOffsetFunctionEntries{
+        function_start_position, function_end_position,
+        std::move(func_asm_offsets)});
   }
-  if (decoder.more()) decoder.error("unexpected additional bytes");
+  DCHECK(decoder.ok());
+  DCHECK(!decoder.more());
 
-  return decoder.toResult(std::move(table));
+  return decoder.toResult(AsmJsOffsets{std::move(functions)});
 }
 
 std::vector<CustomSectionOffset> DecodeCustomSections(const byte* start,
@@ -2151,14 +2177,11 @@ void DecodeFunctionNames(const byte* module_start, const byte* module_end,
   }
 }
 
-void DecodeLocalNames(const byte* module_start, const byte* module_end,
-                      LocalNames* result) {
-  DCHECK_NOT_NULL(result);
-  DCHECK(result->names.empty());
-
-  Decoder decoder(module_start, module_end);
-  if (!FindNameSection(&decoder)) return;
+LocalNames DecodeLocalNames(Vector<const uint8_t> module_bytes) {
+  Decoder decoder(module_bytes);
+  if (!FindNameSection(&decoder)) return LocalNames{{}};
 
+  std::vector<LocalNamesPerFunction> functions;
   while (decoder.ok() && decoder.more()) {
     uint8_t name_type = decoder.consume_u8("name type");
     if (name_type & 0x80) break;  // no varuint7
@@ -2175,22 +2198,26 @@ void DecodeLocalNames(const byte* module_start, const byte* module_end,
     for (uint32_t i = 0; i < local_names_count; ++i) {
       uint32_t func_index = decoder.consume_u32v("function index");
       if (func_index > kMaxInt) continue;
-      result->names.emplace_back(static_cast<int>(func_index));
-      LocalNamesPerFunction& func_names = result->names.back();
-      result->max_function_index =
-          std::max(result->max_function_index, func_names.function_index);
+      std::vector<LocalName> names;
       uint32_t num_names = decoder.consume_u32v("namings count");
       for (uint32_t k = 0; k < num_names; ++k) {
         uint32_t local_index = decoder.consume_u32v("local index");
-        WireBytesRef name = consume_string(&decoder, true, "local name");
+        WireBytesRef name = consume_string(&decoder, false, "local name");
         if (!decoder.ok()) break;
         if (local_index > kMaxInt) continue;
-        func_names.max_local_index =
-            std::max(func_names.max_local_index, static_cast<int>(local_index));
-        func_names.names.emplace_back(static_cast<int>(local_index), name);
+        // Ignore non-utf8 names.
+        if (!validate_utf8(&decoder, name)) continue;
+        names.emplace_back(static_cast<int>(local_index), name);
       }
+      // Use stable sort to get deterministic names (the first one declared)
+      // even in the presence of duplicates.
+      std::stable_sort(names.begin(), names.end(), LocalName::IndexLess{});
+      functions.emplace_back(static_cast<int>(func_index), std::move(names));
     }
   }
+  std::stable_sort(functions.begin(), functions.end(),
+                   LocalNamesPerFunction::FunctionIndexLess{});
+  return LocalNames{std::move(functions)};
 }
 
 #undef TRACE
diff --git a/deps/v8/src/wasm/module-decoder.h b/deps/v8/src/wasm/module-decoder.h
index 5ee324b109e690..da35c0c4f57888 100644
--- a/deps/v8/src/wasm/module-decoder.h
+++ b/deps/v8/src/wasm/module-decoder.h
@@ -39,25 +39,90 @@ struct AsmJsOffsetEntry {
   int source_position_call;
   int source_position_number_conversion;
 };
-using AsmJsOffsets = std::vector<std::vector<AsmJsOffsetEntry>>;
+struct AsmJsOffsetFunctionEntries {
+  int start_offset;
+  int end_offset;
+  std::vector<AsmJsOffsetEntry> entries;
+};
+struct AsmJsOffsets {
+  std::vector<AsmJsOffsetFunctionEntries> functions;
+};
 using AsmJsOffsetsResult = Result<AsmJsOffsets>;
 
-struct LocalName {
-  int local_index;
-  WireBytesRef name;
-  LocalName(int local_index, WireBytesRef name)
-      : local_index(local_index), name(name) {}
+class LocalName {
+ public:
+  LocalName(int index, WireBytesRef name) : index_(index), name_(name) {}
+
+  int index() const { return index_; }
+  WireBytesRef name() const { return name_; }
+
+  struct IndexLess {
+    bool operator()(const LocalName& a, const LocalName& b) const {
+      return a.index() < b.index();
+    }
+  };
+
+ private:
+  int index_;
+  WireBytesRef name_;
 };
-struct LocalNamesPerFunction {
-  int function_index;
-  int max_local_index = -1;
-  std::vector<LocalName> names;
-  explicit LocalNamesPerFunction(int function_index)
-      : function_index(function_index) {}
+
+class LocalNamesPerFunction {
+ public:
+  // For performance reasons, {LocalNamesPerFunction} should not be copied.
+  MOVE_ONLY_NO_DEFAULT_CONSTRUCTOR(LocalNamesPerFunction);
+
+  LocalNamesPerFunction(int function_index, std::vector<LocalName> names)
+      : function_index_(function_index), names_(std::move(names)) {
+    DCHECK(
+        std::is_sorted(names_.begin(), names_.end(), LocalName::IndexLess{}));
+  }
+
+  int function_index() const { return function_index_; }
+
+  WireBytesRef GetName(int local_index) {
+    auto it =
+        std::lower_bound(names_.begin(), names_.end(),
+                         LocalName{local_index, {}}, LocalName::IndexLess{});
+    if (it == names_.end()) return {};
+    if (it->index() != local_index) return {};
+    return it->name();
+  }
+
+  struct FunctionIndexLess {
+    bool operator()(const LocalNamesPerFunction& a,
+                    const LocalNamesPerFunction& b) const {
+      return a.function_index() < b.function_index();
+    }
+  };
+
+ private:
+  int function_index_;
+  std::vector<LocalName> names_;
 };
-struct LocalNames {
-  int max_function_index = -1;
-  std::vector<LocalNamesPerFunction> names;
+
+class LocalNames {
+ public:
+  // For performance reasons, {LocalNames} should not be copied.
+  MOVE_ONLY_NO_DEFAULT_CONSTRUCTOR(LocalNames);
+
+  explicit LocalNames(std::vector<LocalNamesPerFunction> functions)
+      : functions_(std::move(functions)) {
+    DCHECK(std::is_sorted(functions_.begin(), functions_.end(),
+                          LocalNamesPerFunction::FunctionIndexLess{}));
+  }
+
+  WireBytesRef GetName(int function_index, int local_index) {
+    auto it = std::lower_bound(functions_.begin(), functions_.end(),
+                               LocalNamesPerFunction{function_index, {}},
+                               LocalNamesPerFunction::FunctionIndexLess{});
+    if (it == functions_.end()) return {};
+    if (it->function_index() != function_index) return {};
+    return it->GetName(local_index);
+  }
+
+ private:
+  std::vector<LocalNamesPerFunction> functions_;
 };
 
 // Decodes the bytes of a wasm module between {module_start} and {module_end}.
@@ -93,11 +158,7 @@ V8_EXPORT_PRIVATE std::vector<CustomSectionOffset> DecodeCustomSections(
 
 // Extracts the mapping from wasm byte offset to asm.js source position per
 // function.
-// Returns a vector of vectors with <byte_offset, source_position> entries, or
-// failure if the wasm bytes are detected as invalid. Note that this validation
-// is not complete.
-AsmJsOffsetsResult DecodeAsmJsOffsets(const byte* module_start,
-                                      const byte* module_end);
+AsmJsOffsetsResult DecodeAsmJsOffsets(Vector<const uint8_t> encoded_offsets);
 
 // Decode the function names from the name section.
 // Returns the result as an unordered map. Only names with valid utf8 encoding
@@ -106,11 +167,10 @@ void DecodeFunctionNames(const byte* module_start, const byte* module_end,
                          std::unordered_map<uint32_t, WireBytesRef>* names);
 
 // Decode the local names assignment from the name section.
-// Stores the result in the given {LocalNames} structure. The result will be
-// empty if no name section is present. On encountering an error in the name
-// section, returns all information decoded up to the first error.
-void DecodeLocalNames(const byte* module_start, const byte* module_end,
-                      LocalNames* result);
+// The result will be empty if no name section is present. On encountering an
+// error in the name section, returns all information decoded up to the first
+// error.
+LocalNames DecodeLocalNames(Vector<const uint8_t> module_bytes);
 
 class ModuleDecoderImpl;
 
diff --git a/deps/v8/src/wasm/module-instantiate.cc b/deps/v8/src/wasm/module-instantiate.cc
index 95d892ab505961..6d40e9ed5eee27 100644
--- a/deps/v8/src/wasm/module-instantiate.cc
+++ b/deps/v8/src/wasm/module-instantiate.cc
@@ -477,7 +477,7 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   // The bulk memory proposal changes the MVP behavior here; the segments are
   // written as if `memory.init` and `table.init` are executed directly, and
   // not bounds checked ahead of time.
-  if (!enabled_.bulk_memory) {
+  if (!enabled_.has_bulk_memory()) {
     //--------------------------------------------------------------------------
     // Check that indirect function table segments are within bounds.
     //--------------------------------------------------------------------------
@@ -490,8 +490,8 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
       auto table_object = handle(WasmTableObject::cast(instance->tables().get(
                                      elem_segment.table_index)),
                                  isolate_);
-      size_t table_size = table_object->entries().length();
-      if (!IsInBounds(base, elem_segment.entries.size(), table_size)) {
+      size_t table_size = table_object->current_length();
+      if (!base::IsInBounds(base, elem_segment.entries.size(), table_size)) {
         thrower_->LinkError("table initializer is out of bounds");
         return {};
       }
@@ -503,7 +503,8 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
     for (const WasmDataSegment& seg : module_->data_segments) {
       if (!seg.active) continue;
       uint32_t base = EvalUint32InitExpr(instance, seg.dest_addr);
-      if (!IsInBounds(base, seg.source.length(), instance->memory_size())) {
+      if (!base::IsInBounds(base, seg.source.length(),
+                            instance->memory_size())) {
         thrower_->LinkError("data segment is out of bounds");
         return {};
       }
@@ -536,7 +537,7 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   // Debugging support.
   //--------------------------------------------------------------------------
   // Set all breakpoints that were set on the shared module.
-  WasmModuleObject::SetBreakpointsOnNewInstance(
+  WasmScript::SetBreakpointsOnNewInstance(
       handle(module_object_->script(), isolate_), instance);
 
   //--------------------------------------------------------------------------
@@ -582,7 +583,6 @@ bool InstanceBuilder::ExecuteStartFunction() {
 // Look up an import value in the {ffi_} object.
 MaybeHandle<Object> InstanceBuilder::LookupImport(uint32_t index,
                                                   Handle<String> module_name,
-
                                                   Handle<String> import_name) {
   // We pre-validated in the js-api layer that the ffi object is present, and
   // a JSObject, if the module has imports.
@@ -626,8 +626,8 @@ MaybeHandle<Object> InstanceBuilder::LookupImportAsm(
   // side-effect. We only accept accesses that resolve to data properties,
   // which is indicated by the asm.js spec in section 7 ("Linking") as well.
   Handle<Object> result;
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      isolate_, ffi_.ToHandleChecked(), import_name);
+  LookupIterator::Key key(isolate_, Handle<Name>::cast(import_name));
+  LookupIterator it(isolate_, ffi_.ToHandleChecked(), key);
   switch (it.state()) {
     case LookupIterator::ACCESS_CHECK:
     case LookupIterator::INTEGER_INDEXED_EXOTIC:
@@ -656,30 +656,31 @@ void InstanceBuilder::LoadDataSegments(Handle<WasmInstanceObject> instance) {
   for (const WasmDataSegment& segment : module_->data_segments) {
     uint32_t size = segment.source.length();
 
-    if (enabled_.bulk_memory) {
-      if (size == 0) continue;
+    if (enabled_.has_bulk_memory()) {
       // Passive segments are not copied during instantiation.
       if (!segment.active) continue;
 
       uint32_t dest_offset = EvalUint32InitExpr(instance, segment.dest_addr);
-      bool ok = ClampToBounds(dest_offset, &size,
-                              static_cast<uint32_t>(instance->memory_size()));
+      bool ok = base::ClampToBounds(
+          dest_offset, &size, static_cast<uint32_t>(instance->memory_size()));
+      if (!ok) {
+        thrower_->RuntimeError("data segment is out of bounds");
+        return;
+      }
+      // No need to copy empty segments.
+      if (size == 0) continue;
       Address dest_addr =
           reinterpret_cast<Address>(instance->memory_start()) + dest_offset;
       Address src_addr = reinterpret_cast<Address>(wire_bytes.begin()) +
                          segment.source.offset();
       memory_copy_wrapper(dest_addr, src_addr, size);
-      if (!ok) {
-        thrower_->LinkError("data segment is out of bounds");
-        return;
-      }
     } else {
       DCHECK(segment.active);
       // Segments of size == 0 are just nops.
       if (size == 0) continue;
 
       uint32_t dest_offset = EvalUint32InitExpr(instance, segment.dest_addr);
-      DCHECK(IsInBounds(dest_offset, size, instance->memory_size()));
+      DCHECK(base::IsInBounds(dest_offset, size, instance->memory_size()));
       byte* dest = instance->memory_start() + dest_offset;
       const byte* src = wire_bytes.begin() + segment.source.offset();
       memcpy(dest, src, size);
@@ -752,7 +753,9 @@ void InstanceBuilder::WriteGlobalValue(const WasmGlobal& global,
     }
     case kWasmAnyRef:
     case kWasmFuncRef:
+    case kWasmNullRef:
     case kWasmExnRef: {
+      DCHECK_IMPLIES(global.type == kWasmNullRef, value->GetRef()->IsNull());
       tagged_globals_->set(global.offset, *value->GetRef());
       break;
     }
@@ -774,25 +777,13 @@ void InstanceBuilder::SanitizeImports() {
   for (size_t index = 0; index < module_->import_table.size(); ++index) {
     const WasmImport& import = module_->import_table[index];
 
-    Handle<String> module_name;
-    MaybeHandle<String> maybe_module_name =
-        WasmModuleObject::ExtractUtf8StringFromModuleBytes(isolate_, wire_bytes,
-                                                           import.module_name);
-    if (!maybe_module_name.ToHandle(&module_name)) {
-      thrower_->LinkError("Could not resolve module name for import %zu",
-                          index);
-      return;
-    }
+    Handle<String> module_name =
+        WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+            isolate_, wire_bytes, import.module_name, kInternalize);
 
-    Handle<String> import_name;
-    MaybeHandle<String> maybe_import_name =
-        WasmModuleObject::ExtractUtf8StringFromModuleBytes(isolate_, wire_bytes,
-                                                           import.field_name);
-    if (!maybe_import_name.ToHandle(&import_name)) {
-      thrower_->LinkError("Could not resolve import name for import %zu",
-                          index);
-      return;
-    }
+    Handle<String> import_name =
+        WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+            isolate_, wire_bytes, import.field_name, kInternalize);
 
     int int_index = static_cast<int>(index);
     MaybeHandle<Object> result =
@@ -908,7 +899,7 @@ bool InstanceBuilder::ProcessImportedFunction(
 bool InstanceBuilder::InitializeImportedIndirectFunctionTable(
     Handle<WasmInstanceObject> instance, int table_index, int import_index,
     Handle<WasmTableObject> table_object) {
-  int imported_table_size = table_object->entries().length();
+  int imported_table_size = table_object->current_length();
   // Allocate a new dispatch table.
   WasmInstanceObject::EnsureIndirectFunctionTableWithMinimumSize(
       instance, table_index, imported_table_size);
@@ -967,7 +958,7 @@ bool InstanceBuilder::ProcessImportedTable(Handle<WasmInstanceObject> instance,
 
   auto table_object = Handle<WasmTableObject>::cast(value);
 
-  int imported_table_size = table_object->entries().length();
+  int imported_table_size = table_object->current_length();
   if (imported_table_size < static_cast<int>(table.initial_size)) {
     thrower_->LinkError("table import %d is smaller than initial %d, got %u",
                         import_index, table.initial_size, imported_table_size);
@@ -1129,7 +1120,7 @@ bool InstanceBuilder::ProcessImportedGlobal(Handle<WasmInstanceObject> instance,
   //
   // However, the bigint proposal allows importing constant i64 values,
   // as non WebAssembly.Global object.
-  if (global.type == kWasmI64 && !enabled_.bigint &&
+  if (global.type == kWasmI64 && !enabled_.has_bigint() &&
       !value->IsWasmGlobalObject()) {
     ReportLinkError("global import cannot have type i64", import_index,
                     module_name, import_name);
@@ -1138,10 +1129,10 @@ bool InstanceBuilder::ProcessImportedGlobal(Handle<WasmInstanceObject> instance,
   if (is_asmjs_module(module_)) {
     // Accepting {JSFunction} on top of just primitive values here is a
     // workaround to support legacy asm.js code with broken binding. Note
-    // that using {NaN} (or Smi::kZero) here is what using the observable
+    // that using {NaN} (or Smi::zero()) here is what using the observable
     // conversion via {ToPrimitive} would produce as well.
-    // TODO(mstarzinger): Still observable if Function.prototype.valueOf
-    // or friends are patched, we might need to check for that as well.
+    // TODO(wasm): Still observable if Function.prototype.valueOf or friends
+    // are patched, we might need to check for that as well.
     if (value->IsJSFunction()) value = isolate_->factory()->nan_value();
     if (value->IsPrimitive() && !value->IsSymbol()) {
       if (global.type == kWasmI32) {
@@ -1166,8 +1157,6 @@ bool InstanceBuilder::ProcessImportedGlobal(Handle<WasmInstanceObject> instance,
   }
 
   if (ValueTypes::IsReferenceType(global.type)) {
-    // There shouldn't be any null-ref globals.
-    DCHECK_NE(ValueType::kWasmNullRef, global.type);
     if (global.type == ValueType::kWasmFuncRef) {
       if (!value->IsNull(isolate_) &&
           !WasmExportedFunction::IsWasmExportedFunction(*value)) {
@@ -1176,6 +1165,12 @@ bool InstanceBuilder::ProcessImportedGlobal(Handle<WasmInstanceObject> instance,
             import_index, module_name, import_name);
         return false;
       }
+    } else if (global.type == ValueType::kWasmNullRef) {
+      if (!value->IsNull(isolate_)) {
+        ReportLinkError("imported nullref global must be null", import_index,
+                        module_name, import_name);
+        return false;
+      }
     }
     WriteGlobalAnyRef(global, value);
     return true;
@@ -1186,7 +1181,7 @@ bool InstanceBuilder::ProcessImportedGlobal(Handle<WasmInstanceObject> instance,
     return true;
   }
 
-  if (enabled_.bigint && global.type == kWasmI64 && value->IsBigInt()) {
+  if (enabled_.has_bigint() && global.type == kWasmI64 && value->IsBigInt()) {
     WriteGlobalValue(global, BigInt::cast(*value).AsInt64());
     return true;
   }
@@ -1363,7 +1358,7 @@ void InstanceBuilder::InitGlobals(Handle<WasmInstanceObject> instance) {
                                        global.init.val.f64_const);
         break;
       case WasmInitExpr::kRefNullConst:
-        DCHECK(enabled_.anyref || enabled_.eh);
+        DCHECK(enabled_.has_anyref() || enabled_.has_eh());
         if (global.imported) break;  // We already initialized imported globals.
 
         tagged_globals_->set(global.offset,
@@ -1371,7 +1366,7 @@ void InstanceBuilder::InitGlobals(Handle<WasmInstanceObject> instance) {
                              SKIP_WRITE_BARRIER);
         break;
       case WasmInitExpr::kRefFuncConst: {
-        DCHECK(enabled_.anyref);
+        DCHECK(enabled_.has_anyref());
         auto function = WasmInstanceObject::GetOrCreateWasmExternalFunction(
             isolate_, instance, global.init.val.function_index);
         tagged_globals_->set(global.offset, *function);
@@ -1384,7 +1379,7 @@ void InstanceBuilder::InitGlobals(Handle<WasmInstanceObject> instance) {
             module_->globals[global.init.val.global_index].offset;
         TRACE("init [globals+%u] = [globals+%d]\n", global.offset, old_offset);
         if (ValueTypes::IsReferenceType(global.type)) {
-          DCHECK(enabled_.anyref || enabled_.eh);
+          DCHECK(enabled_.has_anyref() || enabled_.has_eh());
           tagged_globals_->set(new_offset, tagged_globals_->get(old_offset));
         } else {
           size_t size = (global.type == kWasmI64 || global.type == kWasmF64)
@@ -1414,7 +1409,7 @@ bool InstanceBuilder::AllocateMemory() {
     thrower_->RangeError("Out of memory: wasm memory too large");
     return false;
   }
-  auto shared = (module_->has_shared_memory && enabled_.threads)
+  auto shared = (module_->has_shared_memory && enabled_.has_threads())
                     ? SharedFlag::kShared
                     : SharedFlag::kNotShared;
 
@@ -1461,25 +1456,15 @@ void InstanceBuilder::ProcessExports(Handle<WasmInstanceObject> instance) {
 
   Handle<JSObject> exports_object;
   MaybeHandle<String> single_function_name;
-  bool is_asm_js = false;
-  switch (module_->origin) {
-    case kWasmOrigin: {
-      // Create the "exports" object.
-      exports_object = isolate_->factory()->NewJSObjectWithNullProto();
-      break;
-    }
-    case kAsmJsSloppyOrigin:
-    case kAsmJsStrictOrigin: {
-      Handle<JSFunction> object_function = Handle<JSFunction>(
-          isolate_->native_context()->object_function(), isolate_);
-      exports_object = isolate_->factory()->NewJSObject(object_function);
-      single_function_name = isolate_->factory()->InternalizeUtf8String(
-          AsmJs::kSingleFunctionName);
-      is_asm_js = true;
-      break;
-    }
-    default:
-      UNREACHABLE();
+  bool is_asm_js = is_asmjs_module(module_);
+  if (is_asm_js) {
+    Handle<JSFunction> object_function = Handle<JSFunction>(
+        isolate_->native_context()->object_function(), isolate_);
+    exports_object = isolate_->factory()->NewJSObject(object_function);
+    single_function_name =
+        isolate_->factory()->InternalizeUtf8String(AsmJs::kSingleFunctionName);
+  } else {
+    exports_object = isolate_->factory()->NewJSObjectWithNullProto();
   }
   instance->set_exports_object(*exports_object);
 
@@ -1491,8 +1476,7 @@ void InstanceBuilder::ProcessExports(Handle<WasmInstanceObject> instance) {
   // Process each export in the export table.
   for (const WasmExport& exp : module_->export_table) {
     Handle<String> name = WasmModuleObject::ExtractUtf8StringFromModuleBytes(
-                              isolate_, module_object_, exp.name)
-                              .ToHandleChecked();
+        isolate_, module_object_, exp.name, kInternalize);
     Handle<JSObject> export_to = exports_object;
     switch (exp.kind) {
       case kExternalFunction: {
@@ -1626,17 +1610,20 @@ void InstanceBuilder::InitializeIndirectFunctionTables(
 
 bool LoadElemSegmentImpl(Isolate* isolate, Handle<WasmInstanceObject> instance,
                          Handle<WasmTableObject> table_object,
-                         uint32_t table_index,
-                         const WasmElemSegment& elem_segment, uint32_t dst,
-                         uint32_t src, size_t count) {
-  if (count == 0) return true;
+                         uint32_t table_index, uint32_t segment_index,
+                         uint32_t dst, uint32_t src, size_t count) {
+  DCHECK_LT(segment_index, instance->module()->elem_segments.size());
+  auto& elem_segment = instance->module()->elem_segments[segment_index];
   // TODO(wasm): Move this functionality into wasm-objects, since it is used
   // for both instantiation and in the implementation of the table.init
   // instruction.
-  bool ok =
-      ClampToBounds<size_t>(dst, &count, table_object->entries().length());
-  // Use & instead of && so the clamp is not short-circuited.
-  ok &= ClampToBounds<size_t>(src, &count, elem_segment.entries.size());
+  if (!base::IsInBounds(dst, count, table_object->current_length()) ||
+      !base::IsInBounds(src, count,
+                        instance->dropped_elem_segments()[segment_index] == 0
+                            ? elem_segment.entries.size()
+                            : 0)) {
+    return false;
+  }
 
   const WasmModule* module = instance->module();
   for (size_t i = 0; i < count; ++i) {
@@ -1690,11 +1677,13 @@ bool LoadElemSegmentImpl(Isolate* isolate, Handle<WasmInstanceObject> instance,
                                             func_index);
     }
   }
-  return ok;
+  return true;
 }
 
 void InstanceBuilder::LoadTableSegments(Handle<WasmInstanceObject> instance) {
-  for (auto& elem_segment : module_->elem_segments) {
+  for (uint32_t segment_index = 0;
+       segment_index < module_->elem_segments.size(); ++segment_index) {
+    auto& elem_segment = instance->module()->elem_segments[segment_index];
     // Passive segments are not copied during instantiation.
     if (!elem_segment.active) continue;
 
@@ -1702,17 +1691,20 @@ void InstanceBuilder::LoadTableSegments(Handle<WasmInstanceObject> instance) {
     uint32_t dst = EvalUint32InitExpr(instance, elem_segment.offset);
     uint32_t src = 0;
     size_t count = elem_segment.entries.size();
-    if (enabled_.bulk_memory && count == 0) continue;
 
     bool success = LoadElemSegmentImpl(
         isolate_, instance,
         handle(WasmTableObject::cast(
                    instance->tables().get(elem_segment.table_index)),
                isolate_),
-        table_index, elem_segment, dst, src, count);
-    if (enabled_.bulk_memory) {
+        table_index, segment_index, dst, src, count);
+    // Set the active segments to being already dropped, since memory.init on
+    // a dropped passive segment and an active segment have the same
+    // behavior.
+    instance->dropped_elem_segments()[segment_index] = 1;
+    if (enabled_.has_bulk_memory()) {
       if (!success) {
-        thrower_->LinkError("table initializer is out of bounds");
+        thrower_->RuntimeError("table initializer is out of bounds");
         // Break out instead of returning; we don't want to continue to
         // initialize any further element segments, but still need to add
         // dispatch tables below.
@@ -1750,12 +1742,11 @@ void InstanceBuilder::InitializeExceptions(
 bool LoadElemSegment(Isolate* isolate, Handle<WasmInstanceObject> instance,
                      uint32_t table_index, uint32_t segment_index, uint32_t dst,
                      uint32_t src, uint32_t count) {
-  auto& elem_segment = instance->module()->elem_segments[segment_index];
   return LoadElemSegmentImpl(
       isolate, instance,
       handle(WasmTableObject::cast(instance->tables().get(table_index)),
              isolate),
-      table_index, elem_segment, dst, src, count);
+      table_index, segment_index, dst, src, count);
 }
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/object-access.h b/deps/v8/src/wasm/object-access.h
index 38f0f58a003c2d..94cc89c9af1c52 100644
--- a/deps/v8/src/wasm/object-access.h
+++ b/deps/v8/src/wasm/object-access.h
@@ -39,6 +39,11 @@ class ObjectAccess : public AllStatic {
   static constexpr int FormalParameterCountOffsetInSharedFunctionInfo() {
     return ToTagged(SharedFunctionInfo::kFormalParameterCountOffset);
   }
+
+  // Get the offset of the flags in a {SharedFunctionInfo} object.
+  static constexpr int FlagsOffsetInSharedFunctionInfo() {
+    return ToTagged(SharedFunctionInfo::kFlagsOffset);
+  }
 };
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/streaming-decoder.cc b/deps/v8/src/wasm/streaming-decoder.cc
index 37aaf056056d25..c88a2c77b89be7 100644
--- a/deps/v8/src/wasm/streaming-decoder.cc
+++ b/deps/v8/src/wasm/streaming-decoder.cc
@@ -370,6 +370,16 @@ std::unique_ptr<StreamingDecoder::DecodingState>
 StreamingDecoder::DecodeSectionID::Next(StreamingDecoder* streaming) {
   TRACE_STREAMING("DecodeSectionID: %s section\n",
                   SectionName(static_cast<SectionCode>(id_)));
+  if (id_ == SectionCode::kCodeSectionCode) {
+    // Explicitly check for multiple code sections as module decoder never
+    // sees the code section and hence cannot track this section.
+    if (streaming->code_section_processed_) {
+      // TODO(wasm): This error message (and others in this class) is different
+      // for non-streaming decoding. Bring them in sync and test.
+      return streaming->Error("code section can only appear once");
+    }
+    streaming->code_section_processed_ = true;
+  }
   return std::make_unique<DecodeSectionLength>(id_, module_offset_);
 }
 
@@ -391,22 +401,13 @@ StreamingDecoder::DecodeSectionLength::NextWithValue(
     if (!streaming->ok()) return nullptr;
     // There is no payload, we go to the next section immediately.
     return std::make_unique<DecodeSectionID>(streaming->module_offset_);
-  } else {
-    if (section_id_ == SectionCode::kCodeSectionCode) {
-      // Explicitly check for multiple code sections as module decoder never
-      // sees the code section and hence cannot track this section.
-      if (streaming->code_section_processed_) {
-        // TODO(mstarzinger): This error message (and other in this class) is
-        // different for non-streaming decoding. Bring them in sync and test.
-        return streaming->Error("code section can only appear once");
-      }
-      streaming->code_section_processed_ = true;
-      // We reached the code section. All functions of the code section are put
-      // into the same SectionBuffer.
-      return std::make_unique<DecodeNumberOfFunctions>(buf);
-    }
-    return std::make_unique<DecodeSectionPayload>(buf);
   }
+  if (section_id_ == SectionCode::kCodeSectionCode) {
+    // We reached the code section. All functions of the code section are put
+    // into the same SectionBuffer.
+    return std::make_unique<DecodeNumberOfFunctions>(buf);
+  }
+  return std::make_unique<DecodeSectionPayload>(buf);
 }
 
 std::unique_ptr<StreamingDecoder::DecodingState>
@@ -436,9 +437,12 @@ StreamingDecoder::DecodeNumberOfFunctions::NextWithValue(
     return std::make_unique<DecodeSectionID>(streaming->module_offset());
   }
 
+  DCHECK_GE(kMaxInt, payload_buf.length());
+  int code_section_len = static_cast<int>(payload_buf.length());
   DCHECK_GE(kMaxInt, value_);
   streaming->StartCodeSection(static_cast<int>(value_),
-                              streaming->section_buffers_.back());
+                              streaming->section_buffers_.back(),
+                              code_section_len);
   if (!streaming->ok()) return nullptr;
   return std::make_unique<DecodeFunctionLength>(
       section_buffer_, section_buffer_->payload_offset() + bytes_consumed_,
diff --git a/deps/v8/src/wasm/streaming-decoder.h b/deps/v8/src/wasm/streaming-decoder.h
index 0d680a2df79a85..f3203e702746f0 100644
--- a/deps/v8/src/wasm/streaming-decoder.h
+++ b/deps/v8/src/wasm/streaming-decoder.h
@@ -37,7 +37,8 @@ class V8_EXPORT_PRIVATE StreamingProcessor {
   // Process the start of the code section. Returns true if the processing
   // finished successfully and the decoding should continue.
   virtual bool ProcessCodeSectionHeader(int num_functions, uint32_t offset,
-                                        std::shared_ptr<WireBytesStorage>) = 0;
+                                        std::shared_ptr<WireBytesStorage>,
+                                        int code_section_length) = 0;
 
   // Process a function body. Returns true if the processing finished
   // successfully and the decoding should continue.
@@ -89,6 +90,11 @@ class V8_EXPORT_PRIVATE StreamingDecoder {
   void NotifyNativeModuleCreated(
       const std::shared_ptr<NativeModule>& native_module);
 
+  Vector<const char> url() { return VectorOf(url_); }
+  void SetUrl(Vector<const char> url) {
+    url_.assign(url.begin(), url.length());
+  }
+
  private:
   // TODO(ahaas): Put the whole private state of the StreamingDecoder into the
   // cc file (PIMPL design pattern).
@@ -228,13 +234,14 @@ class V8_EXPORT_PRIVATE StreamingDecoder {
   }
 
   void StartCodeSection(int num_functions,
-                        std::shared_ptr<WireBytesStorage> wire_bytes_storage) {
+                        std::shared_ptr<WireBytesStorage> wire_bytes_storage,
+                        int code_section_length) {
     if (!ok()) return;
     // The offset passed to {ProcessCodeSectionHeader} is an error offset and
     // not the start offset of a buffer. Therefore we need the -1 here.
-    if (!processor_->ProcessCodeSectionHeader(num_functions,
-                                              module_offset() - 1,
-                                              std::move(wire_bytes_storage))) {
+    if (!processor_->ProcessCodeSectionHeader(
+            num_functions, module_offset() - 1, std::move(wire_bytes_storage),
+            code_section_length)) {
       Fail();
     }
   }
@@ -264,6 +271,7 @@ class V8_EXPORT_PRIVATE StreamingDecoder {
   bool code_section_processed_ = false;
   uint32_t module_offset_ = 0;
   size_t total_size_ = 0;
+  std::string url_;
 
   // Caching support.
   ModuleCompiledCallback module_compiled_callback_ = nullptr;
diff --git a/deps/v8/src/wasm/value-type.h b/deps/v8/src/wasm/value-type.h
index 49f348b714a361..7a4c50303c6883 100644
--- a/deps/v8/src/wasm/value-type.h
+++ b/deps/v8/src/wasm/value-type.h
@@ -16,6 +16,9 @@ class Signature;
 
 namespace wasm {
 
+// Type for holding simd values, defined in wasm-value.h.
+class Simd128;
+
 // Type lattice: For any two types connected by a line, the type at the bottom
 // is a subtype of the other type.
 //
@@ -40,28 +43,33 @@ enum ValueType : uint8_t {
   kWasmBottom,
 };
 
+#define FOREACH_WASMVALUE_CTYPES(V) \
+  V(kWasmI32, int32_t)              \
+  V(kWasmI64, int64_t)              \
+  V(kWasmF32, float)                \
+  V(kWasmF64, double)               \
+  V(kWasmS128, Simd128)
+
 using FunctionSig = Signature<ValueType>;
 
 inline size_t hash_value(ValueType type) { return static_cast<size_t>(type); }
 
-// TODO(clemensb): Compute memtype and size from ValueType once we have c++14
-// constexpr support.
 #define FOREACH_LOAD_TYPE(V) \
-  V(I32, , Int32, 2)         \
-  V(I32, 8S, Int8, 0)        \
-  V(I32, 8U, Uint8, 0)       \
-  V(I32, 16S, Int16, 1)      \
-  V(I32, 16U, Uint16, 1)     \
-  V(I64, , Int64, 3)         \
-  V(I64, 8S, Int8, 0)        \
-  V(I64, 8U, Uint8, 0)       \
-  V(I64, 16S, Int16, 1)      \
-  V(I64, 16U, Uint16, 1)     \
-  V(I64, 32S, Int32, 2)      \
-  V(I64, 32U, Uint32, 2)     \
-  V(F32, , Float32, 2)       \
-  V(F64, , Float64, 3)       \
-  V(S128, , Simd128, 4)
+  V(I32, , Int32)            \
+  V(I32, 8S, Int8)           \
+  V(I32, 8U, Uint8)          \
+  V(I32, 16S, Int16)         \
+  V(I32, 16U, Uint16)        \
+  V(I64, , Int64)            \
+  V(I64, 8S, Int8)           \
+  V(I64, 8U, Uint8)          \
+  V(I64, 16S, Int16)         \
+  V(I64, 16U, Uint16)        \
+  V(I64, 32S, Int32)         \
+  V(I64, 32U, Uint32)        \
+  V(F32, , Float32)          \
+  V(F64, , Float64)          \
+  V(S128, , Simd128)
 
 class LoadType {
  public:
@@ -91,6 +99,8 @@ class LoadType {
         return kF32Load;
       case kWasmF64:
         return kF64Load;
+      case kWasmS128:
+        return kS128Load;
       default:
         UNREACHABLE();
     }
@@ -100,7 +110,10 @@ class LoadType {
   const LoadTypeValue val_;
 
   static constexpr uint8_t kLoadSizeLog2[] = {
-#define LOAD_SIZE(_, __, ___, size) size,
+  // MSVC wants a static_cast here.
+#define LOAD_SIZE(_, __, memtype) \
+  static_cast<uint8_t>(           \
+      ElementSizeLog2Of(MachineType::memtype().representation())),
       FOREACH_LOAD_TYPE(LOAD_SIZE)
 #undef LOAD_SIZE
   };
@@ -112,23 +125,23 @@ class LoadType {
   };
 
   static constexpr MachineType kMemType[] = {
-#define MEMTYPE(_, __, memtype, ___) MachineType::memtype(),
+#define MEMTYPE(_, __, memtype) MachineType::memtype(),
       FOREACH_LOAD_TYPE(MEMTYPE)
 #undef MEMTYPE
   };
 };
 
 #define FOREACH_STORE_TYPE(V) \
-  V(I32, , Word32, 2)         \
-  V(I32, 8, Word8, 0)         \
-  V(I32, 16, Word16, 1)       \
-  V(I64, , Word64, 3)         \
-  V(I64, 8, Word8, 0)         \
-  V(I64, 16, Word16, 1)       \
-  V(I64, 32, Word32, 2)       \
-  V(F32, , Float32, 2)        \
-  V(F64, , Float64, 3)        \
-  V(S128, , Simd128, 4)
+  V(I32, , Word32)            \
+  V(I32, 8, Word8)            \
+  V(I32, 16, Word16)          \
+  V(I64, , Word64)            \
+  V(I64, 8, Word8)            \
+  V(I64, 16, Word16)          \
+  V(I64, 32, Word32)          \
+  V(F32, , Float32)           \
+  V(F64, , Float64)           \
+  V(S128, , Simd128)
 
 class StoreType {
  public:
@@ -158,6 +171,8 @@ class StoreType {
         return kF32Store;
       case kWasmF64:
         return kF64Store;
+      case kWasmS128:
+        return kS128Store;
       default:
         UNREACHABLE();
     }
@@ -167,7 +182,9 @@ class StoreType {
   const StoreTypeValue val_;
 
   static constexpr uint8_t kStoreSizeLog2[] = {
-#define STORE_SIZE(_, __, ___, size) size,
+  // MSVC wants a static_cast here.
+#define STORE_SIZE(_, __, memrep) \
+  static_cast<uint8_t>(ElementSizeLog2Of(MachineRepresentation::k##memrep)),
       FOREACH_STORE_TYPE(STORE_SIZE)
 #undef STORE_SIZE
   };
@@ -179,7 +196,7 @@ class StoreType {
   };
 
   static constexpr MachineRepresentation kMemRep[] = {
-#define MEMREP(_, __, memrep, ___) MachineRepresentation::k##memrep,
+#define MEMREP(_, __, memrep) MachineRepresentation::k##memrep,
       FOREACH_STORE_TYPE(MEMREP)
 #undef MEMREP
   };
@@ -194,14 +211,12 @@ class V8_EXPORT_PRIVATE ValueTypes {
            (expected == kWasmAnyRef && actual == kWasmFuncRef) ||
            (expected == kWasmAnyRef && actual == kWasmExnRef) ||
            (expected == kWasmFuncRef && actual == kWasmNullRef) ||
-           // TODO(mstarzinger): For now we treat "nullref" as a sub-type of
-           // "exnref", which is correct but might change. See here:
-           // https://github.com/WebAssembly/exception-handling/issues/55
            (expected == kWasmExnRef && actual == kWasmNullRef);
   }
 
   static inline bool IsReferenceType(ValueType type) {
-    return type == kWasmAnyRef || type == kWasmFuncRef || type == kWasmExnRef;
+    return type == kWasmAnyRef || type == kWasmFuncRef ||
+           type == kWasmNullRef || type == kWasmExnRef;
   }
 
   static inline ValueType CommonSubType(ValueType a, ValueType b) {
@@ -231,9 +246,11 @@ class V8_EXPORT_PRIVATE ValueTypes {
         return 16;
       case kWasmAnyRef:
       case kWasmFuncRef:
+      case kWasmNullRef:
       case kWasmExnRef:
         return kSystemPointerSize;
-      default:
+      case kWasmStmt:
+      case kWasmBottom:
         UNREACHABLE();
     }
   }
@@ -250,9 +267,11 @@ class V8_EXPORT_PRIVATE ValueTypes {
         return 4;
       case kWasmAnyRef:
       case kWasmFuncRef:
+      case kWasmNullRef:
       case kWasmExnRef:
         return kSystemPointerSizeLog2;
-      default:
+      case kWasmStmt:
+      case kWasmBottom:
         UNREACHABLE();
     }
   }
@@ -275,11 +294,13 @@ class V8_EXPORT_PRIVATE ValueTypes {
         return kLocalAnyRef;
       case kWasmFuncRef:
         return kLocalFuncRef;
+      case kWasmNullRef:
+        return kLocalNullRef;
       case kWasmExnRef:
         return kLocalExnRef;
       case kWasmStmt:
         return kLocalVoid;
-      default:
+      case kWasmBottom:
         UNREACHABLE();
     }
   }
@@ -296,13 +317,14 @@ class V8_EXPORT_PRIVATE ValueTypes {
         return MachineType::Float64();
       case kWasmAnyRef:
       case kWasmFuncRef:
+      case kWasmNullRef:
       case kWasmExnRef:
         return MachineType::TaggedPointer();
       case kWasmS128:
         return MachineType::Simd128();
       case kWasmStmt:
         return MachineType::None();
-      default:
+      case kWasmBottom:
         UNREACHABLE();
     }
   }
@@ -326,7 +348,7 @@ class V8_EXPORT_PRIVATE ValueTypes {
         return MachineRepresentation::kSimd128;
       case kWasmStmt:
         return MachineRepresentation::kNone;
-      default:
+      case kWasmBottom:
         UNREACHABLE();
     }
   }
@@ -370,10 +392,11 @@ class V8_EXPORT_PRIVATE ValueTypes {
         return 's';
       case kWasmStmt:
         return 'v';
+      case kWasmNullRef:
+        return 'n';
+      case kWasmExnRef:
       case kWasmBottom:
         return '*';
-      default:
-        return '?';
     }
   }
 
@@ -401,8 +424,6 @@ class V8_EXPORT_PRIVATE ValueTypes {
         return "<stmt>";
       case kWasmBottom:
         return "<bot>";
-      default:
-        return "<unknown>";
     }
   }
 
diff --git a/deps/v8/src/wasm/wasm-code-manager.cc b/deps/v8/src/wasm/wasm-code-manager.cc
index 55695259f019be..8eb0f5d97f556c 100644
--- a/deps/v8/src/wasm/wasm-code-manager.cc
+++ b/deps/v8/src/wasm/wasm-code-manager.cc
@@ -24,6 +24,7 @@
 #include "src/wasm/compilation-environment.h"
 #include "src/wasm/function-compiler.h"
 #include "src/wasm/jump-table-assembler.h"
+#include "src/wasm/wasm-debug.h"
 #include "src/wasm/wasm-import-wrapper-cache.h"
 #include "src/wasm/wasm-module-sourcemap.h"
 #include "src/wasm/wasm-module.h"
@@ -178,10 +179,9 @@ void WasmCode::LogCode(Isolate* isolate) const {
   if (IsAnonymous()) return;
 
   ModuleWireBytes wire_bytes(native_module()->wire_bytes());
-  // TODO(herhut): Allow to log code without on-heap round-trip of the name.
   WireBytesRef name_ref =
-      native_module()->module()->LookupFunctionName(wire_bytes, index());
-  WasmName name_vec = wire_bytes.GetNameOrNull(name_ref);
+      native_module()->module()->function_names.Lookup(wire_bytes, index());
+  WasmName name = wire_bytes.GetNameOrNull(name_ref);
 
   const std::string& source_map_url = native_module()->module()->source_map_url;
   auto load_wasm_source_map = isolate->wasm_load_source_map_callback();
@@ -195,28 +195,31 @@ void WasmCode::LogCode(Isolate* isolate) const {
         std::make_unique<WasmModuleSourceMap>(v8_isolate, source_map_str));
   }
 
-  if (!name_vec.empty()) {
-    HandleScope scope(isolate);
-    MaybeHandle<String> maybe_name = isolate->factory()->NewStringFromUtf8(
-        Vector<const char>::cast(name_vec));
-    Handle<String> name;
-    if (!maybe_name.ToHandle(&name)) {
-      name = isolate->factory()->NewStringFromAsciiChecked("<name too long>");
+  std::unique_ptr<char[]> name_buffer;
+  if (kind_ == kWasmToJsWrapper) {
+    constexpr size_t kNameBufferLen = 128;
+    constexpr size_t kNamePrefixLen = 11;
+    name_buffer = std::make_unique<char[]>(kNameBufferLen);
+    memcpy(name_buffer.get(), "wasm-to-js:", kNamePrefixLen);
+    Vector<char> remaining_buf =
+        VectorOf(name_buffer.get(), kNameBufferLen) + kNamePrefixLen;
+    FunctionSig* sig = native_module()->module()->functions[index_].sig;
+    remaining_buf += PrintSignature(remaining_buf, sig);
+    // If the import has a name, also append that (separated by "-").
+    if (!name.empty() && remaining_buf.length() > 1) {
+      remaining_buf[0] = '-';
+      remaining_buf += 1;
+      size_t suffix_len = std::min(name.size(), remaining_buf.size());
+      memcpy(remaining_buf.begin(), name.begin(), suffix_len);
+      remaining_buf += suffix_len;
     }
-    int name_length;
-    auto cname =
-        name->ToCString(AllowNullsFlag::DISALLOW_NULLS,
-                        RobustnessFlag::ROBUST_STRING_TRAVERSAL, &name_length);
-    PROFILE(isolate,
-            CodeCreateEvent(CodeEventListener::FUNCTION_TAG, this,
-                            {cname.get(), static_cast<size_t>(name_length)}));
-  } else {
-    EmbeddedVector<char, 32> generated_name;
-    int length = SNPrintF(generated_name, "wasm-function[%d]", index());
-    generated_name.Truncate(length);
-    PROFILE(isolate, CodeCreateEvent(CodeEventListener::FUNCTION_TAG, this,
-                                     generated_name));
+    size_t name_len = remaining_buf.begin() - name_buffer.get();
+    name = VectorOf(name_buffer.get(), name_len);
+  } else if (name.empty()) {
+    name = CStrVector("<wasm-unnamed>");
   }
+  PROFILE(isolate,
+          CodeCreateEvent(CodeEventListener::FUNCTION_TAG, this, name));
 
   if (!source_positions().empty()) {
     LOG_CODE_EVENT(isolate, CodeLinePosInfoRecordEvent(instruction_start(),
@@ -245,13 +248,8 @@ void WasmCode::Validate() const {
         Address target = it.rinfo()->wasm_stub_call_address();
         WasmCode* code = native_module_->Lookup(target);
         CHECK_NOT_NULL(code);
-#ifdef V8_EMBEDDED_BUILTINS
         CHECK_EQ(WasmCode::kJumpTable, code->kind());
         CHECK(code->contains(target));
-#else
-        CHECK_EQ(WasmCode::kRuntimeStub, code->kind());
-        CHECK_EQ(target, code->instruction_start());
-#endif
         break;
       }
       case RelocInfo::INTERNAL_REFERENCE:
@@ -919,7 +917,7 @@ void NativeModule::UseLazyStub(uint32_t func_index) {
   }
 
   // Add jump table entry for jump to the lazy compile stub.
-  uint32_t slot_index = func_index - module_->num_imported_functions;
+  uint32_t slot_index = declared_function_index(module(), func_index);
   DCHECK_NULL(code_table_[slot_index]);
   Address lazy_compile_target =
       lazy_compile_table_->instruction_start() +
@@ -1049,11 +1047,14 @@ WasmCode* NativeModule::PublishCodeLocked(std::unique_ptr<WasmCode> code) {
                       ExecutionTier::kLiftoff < ExecutionTier::kTurbofan,
                   "Assume an order on execution tiers");
 
-    // Update code table but avoid to fall back to less optimized code. We use
-    // the new code if it was compiled with a higher tier.
-    uint32_t slot_idx = code->index() - module_->num_imported_functions;
+    // Unless tier down to Liftoff: update code table but avoid to fall back to
+    // less optimized code. We use the new code if it was compiled with a higher
+    // tier.
+    uint32_t slot_idx = declared_function_index(module(), code->index());
     WasmCode* prior_code = code_table_[slot_idx];
-    bool update_code_table = !prior_code || prior_code->tier() < code->tier();
+    bool update_code_table =
+        tier_down_ ? !prior_code || code->tier() == ExecutionTier::kLiftoff
+                   : !prior_code || prior_code->tier() < code->tier();
     if (update_code_table) {
       code_table_[slot_idx] = code.get();
       if (prior_code) {
@@ -1121,18 +1122,14 @@ std::vector<WasmCode*> NativeModule::SnapshotCodeTable() const {
 
 WasmCode* NativeModule::GetCode(uint32_t index) const {
   base::MutexGuard guard(&allocation_mutex_);
-  DCHECK_LT(index, num_functions());
-  DCHECK_LE(module_->num_imported_functions, index);
-  WasmCode* code = code_table_[index - module_->num_imported_functions];
+  WasmCode* code = code_table_[declared_function_index(module(), index)];
   if (code) WasmCodeRefScope::AddRef(code);
   return code;
 }
 
 bool NativeModule::HasCode(uint32_t index) const {
   base::MutexGuard guard(&allocation_mutex_);
-  DCHECK_LT(index, num_functions());
-  DCHECK_LE(module_->num_imported_functions, index);
-  return code_table_[index - module_->num_imported_functions] != nullptr;
+  return code_table_[declared_function_index(module(), index)] != nullptr;
 }
 
 void NativeModule::SetWasmSourceMap(
@@ -1214,17 +1211,6 @@ void NativeModule::PatchJumpTableLocked(const CodeSpaceData& code_space_data,
 void NativeModule::AddCodeSpace(
     base::AddressRegion region,
     const WasmCodeAllocator::OptionalLock& allocator_lock) {
-#ifndef V8_EMBEDDED_BUILTINS
-  // The far jump table contains far jumps to the embedded builtins. This
-  // requires a build with embedded builtins enabled.
-  FATAL(
-      "WebAssembly is not supported in no-embed builds. no-embed builds are "
-      "deprecated. See\n"
-      " - https://groups.google.com/d/msg/v8-users/9F53xqBjpkI/9WmKSbcWBAAJ\n"
-      " - https://crbug.com/v8/8519\n"
-      " - https://crbug.com/v8/8531\n");
-#endif  // V8_EMBEDDED_BUILTINS
-
   // Each code space must be at least twice as large as the overhead per code
   // space. Otherwise, we are wasting too much memory.
   DCHECK_GE(region.size(),
@@ -1270,7 +1256,8 @@ void NativeModule::AddCodeSpace(
   int num_function_slots = NumWasmFunctionsInFarJumpTable(num_wasm_functions);
   far_jump_table = CreateEmptyJumpTableInRegion(
       JumpTableAssembler::SizeForNumberOfFarJumpSlots(
-          WasmCode::kRuntimeStubCount, num_function_slots),
+          WasmCode::kRuntimeStubCount,
+          NumWasmFunctionsInFarJumpTable(num_function_slots)),
       region, allocator_lock);
   CHECK(region.contains(far_jump_table->instruction_start()));
   EmbeddedData embedded_data = EmbeddedData::FromBlob();
@@ -1355,8 +1342,7 @@ WasmCode* NativeModule::Lookup(Address pc) const {
 }
 
 uint32_t NativeModule::GetJumpTableOffset(uint32_t func_index) const {
-  uint32_t slot_idx = func_index - module_->num_imported_functions;
-  DCHECK_GT(module_->num_declared_functions, slot_idx);
+  uint32_t slot_idx = declared_function_index(module(), func_index);
   return JumpTableAssembler::JumpSlotIndexToOffset(slot_idx);
 }
 
@@ -1554,24 +1540,107 @@ VirtualMemory WasmCodeManager::TryAllocate(size_t size, void* hint) {
   return mem;
 }
 
+namespace {
+// The numbers here are rough estimates, used to calculate the size of the
+// initial code reservation and for estimating the amount of external memory
+// reported to the GC.
+// They do not need to be accurate. Choosing them too small will result in
+// separate code spaces being allocated (compile time and runtime overhead),
+// choosing them too large results in over-reservation (virtual address space
+// only).
+// The current numbers have been determined on 2019-11-11 by clemensb@, based
+// on one small and one large module compiled from C++ by Emscripten. If in
+// doubt, they where chosen slightly larger than required, as over-reservation
+// is not a big issue currently.
+// Numbers will change when Liftoff or TurboFan evolve, other toolchains are
+// used to produce the wasm code, or characteristics of wasm modules on the
+// web change. They might require occasional tuning.
+// This patch might help to find reasonable numbers for any future adaptation:
+// https://crrev.com/c/1910945
+#if V8_TARGET_ARCH_X64
+constexpr size_t kTurbofanFunctionOverhead = 20;
+constexpr size_t kTurbofanCodeSizeMultiplier = 3;
+constexpr size_t kLiftoffFunctionOverhead = 60;
+constexpr size_t kLiftoffCodeSizeMultiplier = 4;
+constexpr size_t kImportSize = 350;
+#elif V8_TARGET_ARCH_IA32
+constexpr size_t kTurbofanFunctionOverhead = 20;
+constexpr size_t kTurbofanCodeSizeMultiplier = 4;
+constexpr size_t kLiftoffFunctionOverhead = 60;
+constexpr size_t kLiftoffCodeSizeMultiplier = 5;
+constexpr size_t kImportSize = 480;
+#elif V8_TARGET_ARCH_ARM
+constexpr size_t kTurbofanFunctionOverhead = 40;
+constexpr size_t kTurbofanCodeSizeMultiplier = 4;
+constexpr size_t kLiftoffFunctionOverhead = 108;
+constexpr size_t kLiftoffCodeSizeMultiplier = 7;
+constexpr size_t kImportSize = 750;
+#elif V8_TARGET_ARCH_ARM64
+constexpr size_t kTurbofanFunctionOverhead = 60;
+constexpr size_t kTurbofanCodeSizeMultiplier = 4;
+constexpr size_t kLiftoffFunctionOverhead = 80;
+constexpr size_t kLiftoffCodeSizeMultiplier = 7;
+constexpr size_t kImportSize = 750;
+#else
+// Other platforms should add their own estimates if needed. Numbers below are
+// the minimum of other architectures.
+constexpr size_t kTurbofanFunctionOverhead = 20;
+constexpr size_t kTurbofanCodeSizeMultiplier = 3;
+constexpr size_t kLiftoffFunctionOverhead = 60;
+constexpr size_t kLiftoffCodeSizeMultiplier = 4;
+constexpr size_t kImportSize = 350;
+#endif
+}  // namespace
+
 // static
-size_t WasmCodeManager::EstimateNativeModuleCodeSize(const WasmModule* module) {
-  constexpr size_t kCodeSizeMultiplier = 4;
-  constexpr size_t kCodeOverhead = 32;     // for prologue, stack check, ...
-  constexpr size_t kStaticCodeSize = 512;  // runtime stubs, ...
-  constexpr size_t kImportSize = 64 * kSystemPointerSize;
+size_t WasmCodeManager::EstimateLiftoffCodeSize(int body_size) {
+  return kLiftoffFunctionOverhead + kCodeAlignment / 2 +
+         body_size * kLiftoffCodeSizeMultiplier;
+}
 
-  size_t estimate = kStaticCodeSize;
-  for (auto& function : module->functions) {
-    estimate += kCodeOverhead + kCodeSizeMultiplier * function.code.length();
-  }
-  estimate += kImportSize * module->num_imported_functions;
+// static
+size_t WasmCodeManager::EstimateNativeModuleCodeSize(const WasmModule* module,
+                                                     bool include_liftoff) {
+  int num_functions = static_cast<int>(module->num_declared_functions);
+  int num_imported_functions = static_cast<int>(module->num_imported_functions);
+  int code_section_length = 0;
+  if (num_functions > 0) {
+    DCHECK_EQ(module->functions.size(), num_imported_functions + num_functions);
+    auto* first_fn = &module->functions[module->num_imported_functions];
+    auto* last_fn = &module->functions.back();
+    code_section_length =
+        static_cast<int>(last_fn->code.end_offset() - first_fn->code.offset());
+  }
+  return EstimateNativeModuleCodeSize(num_functions, num_imported_functions,
+                                      code_section_length, include_liftoff);
+}
 
-  return estimate;
+// static
+size_t WasmCodeManager::EstimateNativeModuleCodeSize(int num_functions,
+                                                     int num_imported_functions,
+                                                     int code_section_length,
+                                                     bool include_liftoff) {
+  const size_t overhead_per_function =
+      kTurbofanFunctionOverhead + kCodeAlignment / 2 +
+      (include_liftoff ? kLiftoffFunctionOverhead + kCodeAlignment / 2 : 0);
+  const size_t overhead_per_code_byte =
+      kTurbofanCodeSizeMultiplier +
+      (include_liftoff ? kLiftoffCodeSizeMultiplier : 0);
+  const size_t jump_table_size = RoundUp<kCodeAlignment>(
+      JumpTableAssembler::SizeForNumberOfSlots(num_functions));
+  const size_t far_jump_table_size =
+      RoundUp<kCodeAlignment>(JumpTableAssembler::SizeForNumberOfFarJumpSlots(
+          WasmCode::kRuntimeStubCount,
+          NumWasmFunctionsInFarJumpTable(num_functions)));
+  return jump_table_size                                 // jump table
+         + far_jump_table_size                           // far jump table
+         + overhead_per_function * num_functions         // per function
+         + overhead_per_code_byte * code_section_length  // per code byte
+         + kImportSize * num_imported_functions;         // per import
 }
 
 // static
-size_t WasmCodeManager::EstimateNativeModuleNonCodeSize(
+size_t WasmCodeManager::EstimateNativeModuleMetaDataSize(
     const WasmModule* module) {
   size_t wasm_module_estimate = EstimateStoredSize(module);
 
@@ -1737,6 +1806,34 @@ bool NativeModule::IsRedirectedToInterpreter(uint32_t func_index) {
   return has_interpreter_redirection(func_index);
 }
 
+void NativeModule::TierDown(Isolate* isolate) {
+  // Set the flag.
+  {
+    base::MutexGuard lock(&allocation_mutex_);
+    tier_down_ = true;
+  }
+  // Tier down all functions.
+  isolate->wasm_engine()->RecompileAllFunctions(isolate, this,
+                                                ExecutionTier::kLiftoff);
+}
+
+void NativeModule::TierUp(Isolate* isolate) {
+  // Set the flag.
+  {
+    base::MutexGuard lock(&allocation_mutex_);
+    tier_down_ = false;
+  }
+
+  // Tier up all functions.
+  // TODO(duongn): parallelize this eventually.
+  for (uint32_t index = module_->num_imported_functions;
+       index < num_functions(); index++) {
+    isolate->wasm_engine()->CompileFunction(isolate, this, index,
+                                            ExecutionTier::kTurbofan);
+    DCHECK(!compilation_state()->failed());
+  }
+}
+
 void NativeModule::FreeCode(Vector<WasmCode* const> codes) {
   // Free the code space.
   code_allocator_.FreeCode(codes);
@@ -1753,6 +1850,12 @@ size_t NativeModule::GetNumberOfCodeSpacesForTesting() const {
   return code_allocator_.GetNumCodeSpaces();
 }
 
+DebugInfo* NativeModule::GetDebugInfo() {
+  base::MutexGuard guard(&allocation_mutex_);
+  if (!debug_info_) debug_info_ = std::make_unique<DebugInfo>(this);
+  return debug_info_.get();
+}
+
 void WasmCodeManager::FreeNativeModule(Vector<VirtualMemory> owned_code_space,
                                        size_t committed_size) {
   base::MutexGuard lock(&native_modules_mutex_);
@@ -1775,9 +1878,13 @@ void WasmCodeManager::FreeNativeModule(Vector<VirtualMemory> owned_code_space,
   }
 
   DCHECK(IsAligned(committed_size, CommitPageSize()));
-  size_t old_committed = total_committed_code_space_.fetch_sub(committed_size);
-  DCHECK_LE(committed_size, old_committed);
-  USE(old_committed);
+  // TODO(v8:8462): Remove this once perf supports remapping.
+  if (!FLAG_perf_prof) {
+    size_t old_committed =
+        total_committed_code_space_.fetch_sub(committed_size);
+    DCHECK_LE(committed_size, old_committed);
+    USE(old_committed);
+  }
 }
 
 NativeModule* WasmCodeManager::LookupNativeModule(Address pc) const {
diff --git a/deps/v8/src/wasm/wasm-code-manager.h b/deps/v8/src/wasm/wasm-code-manager.h
index 7deea9032a5c65..513426785f427a 100644
--- a/deps/v8/src/wasm/wasm-code-manager.h
+++ b/deps/v8/src/wasm/wasm-code-manager.h
@@ -35,6 +35,7 @@ class Isolate;
 
 namespace wasm {
 
+class DebugInfo;
 class NativeModule;
 class WasmCodeManager;
 struct WasmCompilationResult;
@@ -42,6 +43,32 @@ class WasmEngine;
 class WasmImportWrapperCache;
 struct WasmModule;
 
+// Convenience macro listing all wasm runtime stubs. Note that the first few
+// elements of the list coincide with {compiler::TrapId}, order matters.
+#define WASM_RUNTIME_STUB_LIST(V, VTRAP) \
+  FOREACH_WASM_TRAPREASON(VTRAP)         \
+  V(WasmCompileLazy)                     \
+  V(WasmAtomicNotify)                    \
+  V(WasmI32AtomicWait)                   \
+  V(WasmI64AtomicWait)                   \
+  V(WasmMemoryGrow)                      \
+  V(WasmTableGet)                        \
+  V(WasmTableSet)                        \
+  V(WasmStackGuard)                      \
+  V(WasmStackOverflow)                   \
+  V(WasmThrow)                           \
+  V(WasmRethrow)                         \
+  V(WasmTraceMemory)                     \
+  V(AllocateHeapNumber)                  \
+  V(ArgumentsAdaptorTrampoline)          \
+  V(BigIntToI32Pair)                     \
+  V(BigIntToI64)                         \
+  V(DoubleToI)                           \
+  V(I32PairToBigInt)                     \
+  V(I64ToBigInt)                         \
+  V(RecordWrite)                         \
+  V(ToNumber)
+
 // Sorted, disjoint and non-overlapping memory regions. A region is of the
 // form [start, end). So there's no [start, end), [end, other_end),
 // because that should have been reduced to [start, other_end).
@@ -525,6 +552,11 @@ class V8_EXPORT_PRIVATE NativeModule final {
   // by publishing an entry stub with the {Kind::kInterpreterEntry} code kind.
   bool IsRedirectedToInterpreter(uint32_t func_index);
 
+  // Sets the flag, triggers recompilation of all methods to tier down or up,
+  // waits for that to complete.
+  void TierDown(Isolate* isolate);
+  void TierUp(Isolate* isolate);
+
   // Free a set of functions of this module. Uncommits whole pages if possible.
   // The given vector must be ordered by the instruction start address, and all
   // {WasmCode} objects must not be used any more.
@@ -535,6 +567,9 @@ class V8_EXPORT_PRIVATE NativeModule final {
   // Retrieve the number of separately reserved code spaces for this module.
   size_t GetNumberOfCodeSpacesForTesting() const;
 
+  // Get or create the debug info for this NativeModule.
+  DebugInfo* GetDebugInfo();
+
  private:
   friend class WasmCode;
   friend class WasmCodeAllocator;
@@ -583,7 +618,7 @@ class V8_EXPORT_PRIVATE NativeModule final {
     DCHECK_LT(func_index, num_functions());
     DCHECK_LE(module_->num_imported_functions, func_index);
     if (!interpreter_redirections_) return false;
-    uint32_t bitset_idx = func_index - module_->num_imported_functions;
+    uint32_t bitset_idx = declared_function_index(module(), func_index);
     uint8_t byte = interpreter_redirections_[bitset_idx / kBitsPerByte];
     return byte & (1 << (bitset_idx % kBitsPerByte));
   }
@@ -597,7 +632,7 @@ class V8_EXPORT_PRIVATE NativeModule final {
           new uint8_t[RoundUp<kBitsPerByte>(module_->num_declared_functions) /
                       kBitsPerByte]{});
     }
-    uint32_t bitset_idx = func_index - module_->num_imported_functions;
+    uint32_t bitset_idx = declared_function_index(module(), func_index);
     uint8_t& byte = interpreter_redirections_[bitset_idx / kBitsPerByte];
     byte |= 1 << (bitset_idx % kBitsPerByte);
   }
@@ -660,6 +695,13 @@ class V8_EXPORT_PRIVATE NativeModule final {
   // Data (especially jump table) per code space.
   std::vector<CodeSpaceData> code_space_data_;
 
+  // Debug information for this module. You only need to hold the allocation
+  // mutex while getting the {DebugInfo} pointer, or initializing this field.
+  // Further accesses to the {DebugInfo} do not need to be protected by the
+  // mutex.
+  std::unique_ptr<DebugInfo> debug_info_;
+
+  bool tier_down_ = false;
   // End of fields protected by {allocation_mutex_}.
   //////////////////////////////////////////////////////////////////////////////
 
@@ -692,8 +734,21 @@ class V8_EXPORT_PRIVATE WasmCodeManager final {
     return total_committed_code_space_.load();
   }
 
-  static size_t EstimateNativeModuleCodeSize(const WasmModule* module);
-  static size_t EstimateNativeModuleNonCodeSize(const WasmModule* module);
+  // Estimate the needed code space for a Liftoff function based on the size of
+  // the function body (wasm byte code).
+  static size_t EstimateLiftoffCodeSize(int body_size);
+  // Estimate the needed code space from a completely decoded module.
+  static size_t EstimateNativeModuleCodeSize(const WasmModule* module,
+                                             bool include_liftoff);
+  // Estimate the needed code space from the number of functions and total code
+  // section length.
+  static size_t EstimateNativeModuleCodeSize(int num_functions,
+                                             int num_imported_functions,
+                                             int code_section_length,
+                                             bool include_liftoff);
+  // Estimate the size of meta data needed for the NativeModule, excluding
+  // generated code. This data still be stored on the C++ heap.
+  static size_t EstimateNativeModuleMetaDataSize(const WasmModule* module);
 
  private:
   friend class WasmCodeAllocator;
diff --git a/deps/v8/src/wasm/wasm-constants.h b/deps/v8/src/wasm/wasm-constants.h
index 2b5cb6c9ec7995..956322f54ae532 100644
--- a/deps/v8/src/wasm/wasm-constants.h
+++ b/deps/v8/src/wasm/wasm-constants.h
@@ -28,6 +28,7 @@ enum ValueTypeCode : uint8_t {
   kLocalS128 = 0x7b,
   kLocalFuncRef = 0x70,
   kLocalAnyRef = 0x6f,
+  kLocalNullRef = 0x6e,
   kLocalExnRef = 0x68,
 };
 // Binary encoding of other types.
diff --git a/deps/v8/src/wasm/wasm-debug.cc b/deps/v8/src/wasm/wasm-debug.cc
index f3580e4427d7a4..230427bed085de 100644
--- a/deps/v8/src/wasm/wasm-debug.cc
+++ b/deps/v8/src/wasm/wasm-debug.cc
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/wasm/wasm-debug.h"
+
 #include <unordered_map>
 
 #include "src/base/optional.h"
@@ -14,6 +16,7 @@
 #include "src/execution/isolate.h"
 #include "src/heap/factory.h"
 #include "src/utils/identity-map.h"
+#include "src/wasm/baseline/liftoff-compiler.h"
 #include "src/wasm/module-decoder.h"
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-interpreter.h"
@@ -69,31 +72,17 @@ Handle<Object> WasmValueToValueObject(Isolate* isolate, WasmValue value) {
   }
 }
 
-MaybeHandle<String> GetLocalName(Isolate* isolate,
-                                 Handle<WasmDebugInfo> debug_info,
-                                 int func_index, int local_index) {
-  DCHECK_LE(0, func_index);
-  DCHECK_LE(0, local_index);
-  if (!debug_info->has_locals_names()) {
-    Handle<WasmModuleObject> module_object(
-        debug_info->wasm_instance().module_object(), isolate);
-    Handle<FixedArray> locals_names = DecodeLocalNames(isolate, module_object);
-    debug_info->set_locals_names(*locals_names);
-  }
-
-  Handle<FixedArray> locals_names(debug_info->locals_names(), isolate);
-  if (func_index >= locals_names->length() ||
-      locals_names->get(func_index).IsUndefined(isolate)) {
-    return {};
-  }
-
-  Handle<FixedArray> func_locals_names(
-      FixedArray::cast(locals_names->get(func_index)), isolate);
-  if (local_index >= func_locals_names->length() ||
-      func_locals_names->get(local_index).IsUndefined(isolate)) {
-    return {};
-  }
-  return handle(String::cast(func_locals_names->get(local_index)), isolate);
+MaybeHandle<String> GetLocalNameString(Isolate* isolate,
+                                       NativeModule* native_module,
+                                       int func_index, int local_index) {
+  WireBytesRef name_ref =
+      native_module->GetDebugInfo()->GetLocalName(func_index, local_index);
+  ModuleWireBytes wire_bytes{native_module->wire_bytes()};
+  // Bounds were checked during decoding.
+  DCHECK(wire_bytes.BoundsCheck(name_ref));
+  Vector<const char> name = wire_bytes.GetNameOrNull(name_ref);
+  if (name.begin() == nullptr) return {};
+  return isolate->factory()->NewStringFromUtf8(name);
 }
 
 class InterpreterHandle {
@@ -119,6 +108,10 @@ class InterpreterHandle {
     activations_.erase(frame_pointer);
   }
 
+  bool HasActivation(Address frame_pointer) {
+    return activations_.count(frame_pointer);
+  }
+
   std::pair<uint32_t, uint32_t> GetActivationFrameRange(
       WasmInterpreter::Thread* thread, Address frame_pointer) {
     DCHECK_EQ(1, activations_.count(frame_pointer));
@@ -221,15 +214,28 @@ class InterpreterHandle {
     }
 
     // Copy back the return value.
-    DCHECK_GE(kV8MaxWasmFunctionReturns, sig->return_count());
-    // TODO(wasm): Handle multi-value returns.
-    DCHECK_EQ(1, kV8MaxWasmFunctionReturns);
-    if (sig->return_count()) {
-      return_values[0] = thread->GetReturnValue(0);
+#ifdef DEBUG
+    const int max_count = WasmFeatures::FromIsolate(isolate_).has_mv()
+                              ? kV8MaxWasmFunctionMultiReturns
+                              : kV8MaxWasmFunctionReturns;
+#endif
+    DCHECK_GE(max_count, sig->return_count());
+    for (unsigned i = 0; i < sig->return_count(); ++i) {
+      return_values[i] = thread->GetReturnValue(i);
     }
 
     FinishActivation(frame_pointer, activation_id);
 
+    // If we do stepping and it exits wasm interpreter then debugger need to
+    // prepare for it.
+    if (next_step_action_ != StepNone) {
+      // Enter the debugger.
+      DebugScope debug_scope(isolate_->debug());
+
+      isolate_->debug()->PrepareStep(StepOut);
+    }
+    ClearStepping();
+
     return true;
   }
 
@@ -279,7 +285,7 @@ class InterpreterHandle {
       Handle<Script> script(module_object->script(), isolate_);
       int position = GetTopPosition(module_object);
       Handle<FixedArray> breakpoints;
-      if (WasmModuleObject::CheckBreakPoints(isolate_, script, position)
+      if (WasmScript::CheckBreakPoints(isolate_, script, position)
               .ToHandle(&breakpoints)) {
         // We hit one or several breakpoints. Clear stepping, notify the
         // listeners and return.
@@ -340,6 +346,18 @@ class InterpreterHandle {
     return stack;
   }
 
+  int NumberOfActiveFrames(Address frame_pointer) {
+    if (!HasActivation(frame_pointer)) return 0;
+
+    DCHECK_EQ(1, interpreter()->GetThreadCount());
+    WasmInterpreter::Thread* thread = interpreter()->GetThread(0);
+
+    std::pair<uint32_t, uint32_t> frame_range =
+        GetActivationFrameRange(thread, frame_pointer);
+
+    return frame_range.second - frame_range.first;
+  }
+
   WasmInterpreter::FramePtr GetInterpretedFrame(Address frame_pointer,
                                                 int idx) {
     DCHECK_EQ(1, interpreter()->GetThreadCount());
@@ -358,52 +376,6 @@ class InterpreterHandle {
     return interpreter()->GetThread(0)->NumInterpretedCalls();
   }
 
-  Handle<JSObject> GetGlobalScopeObject(InterpretedFrame* frame,
-                                        Handle<WasmDebugInfo> debug_info) {
-    Isolate* isolate = isolate_;
-    Handle<WasmInstanceObject> instance(debug_info->wasm_instance(), isolate);
-
-    Handle<JSObject> global_scope_object =
-        isolate_->factory()->NewJSObjectWithNullProto();
-    if (instance->has_memory_object()) {
-      Handle<String> name =
-          isolate_->factory()->InternalizeString(StaticCharVector("memory"));
-      Handle<JSArrayBuffer> memory_buffer(
-          instance->memory_object().array_buffer(), isolate_);
-      Handle<JSTypedArray> uint8_array = isolate_->factory()->NewJSTypedArray(
-          kExternalUint8Array, memory_buffer, 0, memory_buffer->byte_length());
-      JSObject::SetOwnPropertyIgnoreAttributes(global_scope_object, name,
-                                               uint8_array, NONE)
-          .Assert();
-    }
-
-    DCHECK_EQ(1, interpreter()->GetThreadCount());
-    WasmInterpreter::Thread* thread = interpreter()->GetThread(0);
-
-    uint32_t global_count = thread->GetGlobalCount();
-    if (global_count > 0) {
-      Handle<JSObject> globals_obj =
-          isolate_->factory()->NewJSObjectWithNullProto();
-      Handle<String> globals_name =
-          isolate_->factory()->InternalizeString(StaticCharVector("globals"));
-      JSObject::SetOwnPropertyIgnoreAttributes(global_scope_object,
-                                               globals_name, globals_obj, NONE)
-          .Assert();
-
-      for (uint32_t i = 0; i < global_count; ++i) {
-        const char* label = "global#%d";
-        Handle<String> name = PrintFToOneByteString<true>(isolate_, label, i);
-        WasmValue value = thread->GetGlobalValue(i);
-        Handle<Object> value_obj = WasmValueToValueObject(isolate_, value);
-        JSObject::SetOwnPropertyIgnoreAttributes(globals_obj, name, value_obj,
-                                                 NONE)
-            .Assert();
-      }
-    }
-
-    return global_scope_object;
-  }
-
   Handle<JSObject> GetLocalScopeObject(InterpretedFrame* frame,
                                        Handle<WasmDebugInfo> debug_info) {
     Isolate* isolate = isolate_;
@@ -419,13 +391,15 @@ class InterpreterHandle {
           isolate_->factory()->NewJSObjectWithNullProto();
       Handle<String> locals_name =
           isolate_->factory()->InternalizeString(StaticCharVector("locals"));
-      JSObject::SetOwnPropertyIgnoreAttributes(local_scope_object, locals_name,
-                                               locals_obj, NONE)
-          .Assert();
+      JSObject::AddProperty(isolate, local_scope_object, locals_name,
+                            locals_obj, NONE);
+      NativeModule* native_module =
+          debug_info->wasm_instance().module_object().native_module();
       for (int i = 0; i < num_locals; ++i) {
-        MaybeHandle<String> name =
-            GetLocalName(isolate, debug_info, frame->function()->func_index, i);
-        if (name.is_null()) {
+        Handle<Name> name;
+        if (!GetLocalNameString(isolate, native_module,
+                                frame->function()->func_index, i)
+                 .ToHandle(&name)) {
           // Parameters should come before locals in alphabetical ordering, so
           // we name them "args" here.
           const char* label = i < num_params ? "arg#%d" : "local#%d";
@@ -433,9 +407,15 @@ class InterpreterHandle {
         }
         WasmValue value = frame->GetLocalValue(i);
         Handle<Object> value_obj = WasmValueToValueObject(isolate_, value);
-        JSObject::SetOwnPropertyIgnoreAttributes(
-            locals_obj, name.ToHandleChecked(), value_obj, NONE)
-            .Assert();
+        // {name} can be a string representation of an element index.
+        LookupIterator::Key lookup_key{isolate, name};
+        LookupIterator it(isolate, locals_obj, lookup_key, locals_obj,
+                          LookupIterator::OWN_SKIP_INTERCEPTOR);
+        if (it.IsFound()) continue;
+        Object::AddDataProperty(&it, value_obj, NONE,
+                                Just(ShouldThrow::kThrowOnError),
+                                StoreOrigin::kNamed)
+            .Check();
       }
     }
 
@@ -448,15 +428,13 @@ class InterpreterHandle {
         isolate_->factory()->NewJSObjectWithNullProto();
     Handle<String> stack_name =
         isolate_->factory()->InternalizeString(StaticCharVector("stack"));
-    JSObject::SetOwnPropertyIgnoreAttributes(local_scope_object, stack_name,
-                                             stack_obj, NONE)
-        .Assert();
+    JSObject::AddProperty(isolate, local_scope_object, stack_name, stack_obj,
+                          NONE);
     for (int i = 0; i < stack_count; ++i) {
       WasmValue value = frame->GetStackValue(i);
       Handle<Object> value_obj = WasmValueToValueObject(isolate_, value);
-      JSObject::SetOwnElementIgnoreAttributes(
-          stack_obj, static_cast<uint32_t>(i), value_obj, NONE)
-          .Assert();
+      JSObject::AddDataElement(stack_obj, static_cast<uint32_t>(i), value_obj,
+                               NONE);
     }
     return local_scope_object;
   }
@@ -467,6 +445,261 @@ class InterpreterHandle {
 
 }  // namespace
 
+Handle<JSObject> GetGlobalScopeObject(Handle<WasmInstanceObject> instance) {
+  Isolate* isolate = instance->GetIsolate();
+
+  Handle<JSObject> global_scope_object =
+      isolate->factory()->NewJSObjectWithNullProto();
+  if (instance->has_memory_object()) {
+    Handle<String> name =
+        isolate->factory()->InternalizeString(StaticCharVector("memory"));
+    Handle<JSArrayBuffer> memory_buffer(
+        instance->memory_object().array_buffer(), isolate);
+    Handle<JSTypedArray> uint8_array = isolate->factory()->NewJSTypedArray(
+        kExternalUint8Array, memory_buffer, 0, memory_buffer->byte_length());
+    JSObject::AddProperty(isolate, global_scope_object, name, uint8_array,
+                          NONE);
+  }
+
+  auto& globals = instance->module()->globals;
+  if (globals.size() > 0) {
+    Handle<JSObject> globals_obj =
+        isolate->factory()->NewJSObjectWithNullProto();
+    Handle<String> globals_name =
+        isolate->factory()->InternalizeString(StaticCharVector("globals"));
+    JSObject::AddProperty(isolate, global_scope_object, globals_name,
+                          globals_obj, NONE);
+
+    for (size_t i = 0; i < globals.size(); ++i) {
+      const char* label = "global#%d";
+      Handle<String> name = PrintFToOneByteString<true>(isolate, label, i);
+      WasmValue value =
+          WasmInstanceObject::GetGlobalValue(instance, globals[i]);
+      Handle<Object> value_obj = WasmValueToValueObject(isolate, value);
+      JSObject::AddProperty(isolate, globals_obj, name, value_obj, NONE);
+    }
+  }
+
+  return global_scope_object;
+}
+
+class DebugInfoImpl {
+ public:
+  explicit DebugInfoImpl(NativeModule* native_module)
+      : native_module_(native_module) {}
+
+  Handle<JSObject> GetLocalScopeObject(Isolate* isolate, Address pc,
+                                       Address fp) {
+    Handle<JSObject> local_scope_object =
+        isolate->factory()->NewJSObjectWithNullProto();
+
+    wasm::WasmCodeRefScope wasm_code_ref_scope;
+    wasm::WasmCode* code =
+        isolate->wasm_engine()->code_manager()->LookupCode(pc);
+    // Only Liftoff code can be inspected.
+    if (!code->is_liftoff()) return local_scope_object;
+
+    const WasmModule* module = native_module_->module();
+    const WasmFunction* function = &module->functions[code->index()];
+    DebugSideTable* debug_side_table =
+        GetDebugSideTable(isolate->allocator(), function->func_index);
+    int pc_offset = static_cast<int>(pc - code->instruction_start());
+    auto* debug_side_table_entry = debug_side_table->GetEntry(pc_offset);
+    DCHECK_NOT_NULL(debug_side_table_entry);
+
+    // Fill parameters and locals.
+    int num_params = static_cast<int>(function->sig->parameter_count());
+    int num_locals = static_cast<int>(debug_side_table->num_locals());
+    DCHECK_LE(num_params, num_locals);
+    if (num_locals > 0) {
+      Handle<JSObject> locals_obj =
+          isolate->factory()->NewJSObjectWithNullProto();
+      Handle<String> locals_name =
+          isolate->factory()->InternalizeString(StaticCharVector("locals"));
+      JSObject::AddProperty(isolate, local_scope_object, locals_name,
+                            locals_obj, NONE);
+      for (int i = 0; i < num_locals; ++i) {
+        Handle<Name> name;
+        if (!GetLocalNameString(isolate, native_module_, function->func_index,
+                                i)
+                 .ToHandle(&name)) {
+          // Parameters should come before locals in alphabetical ordering, so
+          // we name them "args" here.
+          const char* label = i < num_params ? "arg#%d" : "local#%d";
+          name = PrintFToOneByteString<true>(isolate, label, i);
+        }
+        WasmValue value =
+            GetValue(debug_side_table_entry, debug_side_table->local_type(i), i,
+                     fp - debug_side_table->local_stack_offset(i));
+        Handle<Object> value_obj = WasmValueToValueObject(isolate, value);
+        // {name} can be a string representation of an element index.
+        LookupIterator::Key lookup_key{isolate, name};
+        LookupIterator it(isolate, locals_obj, lookup_key, locals_obj,
+                          LookupIterator::OWN_SKIP_INTERCEPTOR);
+        if (it.IsFound()) continue;
+        Object::AddDataProperty(&it, value_obj, NONE,
+                                Just(ShouldThrow::kThrowOnError),
+                                StoreOrigin::kNamed)
+            .Check();
+      }
+    }
+
+    // Fill stack values.
+    int stack_count = debug_side_table_entry->stack_height();
+    // Use an object without prototype instead of an Array, for nicer displaying
+    // in DevTools. For Arrays, the length field and prototype is displayed,
+    // which does not make too much sense here.
+    Handle<JSObject> stack_obj = isolate->factory()->NewJSObjectWithNullProto();
+    Handle<String> stack_name =
+        isolate->factory()->InternalizeString(StaticCharVector("stack"));
+    JSObject::AddProperty(isolate, local_scope_object, stack_name, stack_obj,
+                          NONE);
+    for (int i = 0; i < stack_count; ++i) {
+      ValueType type = debug_side_table_entry->stack_type(i);
+      WasmValue value = GetValue(debug_side_table_entry, type, num_locals + i,
+                                 fp - debug_side_table_entry->stack_offset(i));
+      Handle<Object> value_obj = WasmValueToValueObject(isolate, value);
+      JSObject::AddDataElement(stack_obj, static_cast<uint32_t>(i), value_obj,
+                               NONE);
+    }
+    return local_scope_object;
+  }
+
+  WireBytesRef GetLocalName(int func_index, int local_index) {
+    base::MutexGuard guard(&mutex_);
+    if (!local_names_) {
+      local_names_ = std::make_unique<LocalNames>(
+          DecodeLocalNames(native_module_->wire_bytes()));
+    }
+    return local_names_->GetName(func_index, local_index);
+  }
+
+  void SetBreakpoint(int func_index, int offset) {
+    // Hold the mutex while setting the breakpoint. This guards against multiple
+    // isolates setting breakpoints at the same time. We don't really support
+    // that scenario yet, but concurrently compiling and installing different
+    // Liftoff variants of a function would be problematic.
+    base::MutexGuard guard(&mutex_);
+
+    std::vector<int>& breakpoints = breakpoints_per_function_[func_index];
+    auto insertion_point =
+        std::lower_bound(breakpoints.begin(), breakpoints.end(), offset);
+    if (insertion_point != breakpoints.end() && *insertion_point == offset) {
+      // The breakpoint is already set.
+      return;
+    }
+    breakpoints.insert(insertion_point, offset);
+
+    // Recompile the function with Liftoff, setting the new breakpoints.
+    CompilationEnv env = native_module_->CreateCompilationEnv();
+    auto* function = &native_module_->module()->functions[func_index];
+    Vector<const uint8_t> wire_bytes = native_module_->wire_bytes();
+    FunctionBody body{function->sig, function->code.offset(),
+                      wire_bytes.begin() + function->code.offset(),
+                      wire_bytes.begin() + function->code.end_offset()};
+    WasmCompilationResult result = ExecuteLiftoffCompilation(
+        native_module_->engine()->allocator(), &env, body, func_index, nullptr,
+        nullptr, VectorOf(breakpoints));
+    DCHECK(result.succeeded());
+
+    WasmCodeRefScope wasm_code_ref_scope;
+    WasmCode* new_code = native_module_->AddCompiledCode(std::move(result));
+
+    // TODO(clemensb): OSR active frames on the stack (on all threads).
+    USE(new_code);
+  }
+
+ private:
+  DebugSideTable* GetDebugSideTable(AccountingAllocator* allocator,
+                                    int func_index) {
+    base::MutexGuard guard(&mutex_);
+    if (debug_side_tables_.empty()) {
+      debug_side_tables_.resize(native_module_->module()->functions.size());
+    }
+    if (auto& existing_table = debug_side_tables_[func_index]) {
+      return existing_table.get();
+    }
+
+    // Otherwise create the debug side table now.
+    const WasmModule* module = native_module_->module();
+    const WasmFunction* function = &module->functions[func_index];
+    ModuleWireBytes wire_bytes{native_module_->wire_bytes()};
+    Vector<const byte> function_bytes = wire_bytes.GetFunctionBytes(function);
+    CompilationEnv env = native_module_->CreateCompilationEnv();
+    FunctionBody func_body{function->sig, 0, function_bytes.begin(),
+                           function_bytes.end()};
+    DebugSideTable debug_side_table =
+        GenerateLiftoffDebugSideTable(allocator, &env, func_body);
+
+    // Install into cache and return.
+    debug_side_tables_[func_index] =
+        std::make_unique<DebugSideTable>(std::move(debug_side_table));
+    return debug_side_tables_[func_index].get();
+  }
+
+  // Get the value of a local (including parameters) or stack value. Stack
+  // values follow the locals in the same index space.
+  WasmValue GetValue(const DebugSideTable::Entry* debug_side_table_entry,
+                     ValueType type, int index, Address stack_address) {
+    if (debug_side_table_entry->IsConstant(index)) {
+      DCHECK(type == kWasmI32 || type == kWasmI64);
+      return type == kWasmI32
+                 ? WasmValue(debug_side_table_entry->GetConstant(index))
+                 : WasmValue(
+                       int64_t{debug_side_table_entry->GetConstant(index)});
+    }
+
+    // Otherwise load the value from the stack.
+    switch (type) {
+      case kWasmI32:
+        return WasmValue(ReadUnalignedValue<int32_t>(stack_address));
+      case kWasmI64:
+        return WasmValue(ReadUnalignedValue<int64_t>(stack_address));
+      case kWasmF32:
+        return WasmValue(ReadUnalignedValue<float>(stack_address));
+      case kWasmF64:
+        return WasmValue(ReadUnalignedValue<double>(stack_address));
+      default:
+        UNIMPLEMENTED();
+    }
+  }
+
+  NativeModule* const native_module_;
+
+  // {mutex_} protects all fields below.
+  base::Mutex mutex_;
+
+  // DebugSideTable per function, lazily initialized.
+  std::vector<std::unique_ptr<DebugSideTable>> debug_side_tables_;
+
+  // Names of locals, lazily decoded from the wire bytes.
+  std::unique_ptr<LocalNames> local_names_;
+
+  // Keeps track of the currently set breakpoints (by offset within that
+  // function).
+  std::unordered_map<int, std::vector<int>> breakpoints_per_function_;
+
+  DISALLOW_COPY_AND_ASSIGN(DebugInfoImpl);
+};
+
+DebugInfo::DebugInfo(NativeModule* native_module)
+    : impl_(std::make_unique<DebugInfoImpl>(native_module)) {}
+
+DebugInfo::~DebugInfo() = default;
+
+Handle<JSObject> DebugInfo::GetLocalScopeObject(Isolate* isolate, Address pc,
+                                                Address fp) {
+  return impl_->GetLocalScopeObject(isolate, pc, fp);
+}
+
+WireBytesRef DebugInfo::GetLocalName(int func_index, int local_index) {
+  return impl_->GetLocalName(func_index, local_index);
+}
+
+void DebugInfo::SetBreakpoint(int func_index, int offset) {
+  impl_->SetBreakpoint(func_index, offset);
+}
+
 }  // namespace wasm
 
 namespace {
@@ -530,6 +763,18 @@ wasm::WasmInterpreter* WasmDebugInfo::SetupForTesting(
   return interp_handle->raw()->interpreter();
 }
 
+// static
+void WasmDebugInfo::PrepareStepIn(Handle<WasmDebugInfo> debug_info,
+                                  int func_index) {
+  Isolate* isolate = debug_info->GetIsolate();
+  auto* handle = GetOrCreateInterpreterHandle(isolate, debug_info);
+  RedirectToInterpreter(debug_info, Vector<int>(&func_index, 1));
+  const wasm::WasmFunction* func = &handle->module()->functions[func_index];
+  handle->interpreter()->PrepareStepIn(func);
+  // Debug break would be considered as a step-in inside wasm.
+  handle->PrepareStep(StepAction::StepIn);
+}
+
 // static
 void WasmDebugInfo::SetBreakpoint(Handle<WasmDebugInfo> debug_info,
                                   int func_index, int offset) {
@@ -609,6 +854,10 @@ std::vector<std::pair<uint32_t, int>> WasmDebugInfo::GetInterpretedStack(
   return GetInterpreterHandle(*this)->GetInterpretedStack(frame_pointer);
 }
 
+int WasmDebugInfo::NumberOfActiveFrames(Address frame_pointer) {
+  return GetInterpreterHandle(*this)->NumberOfActiveFrames(frame_pointer);
+}
+
 wasm::WasmInterpreter::FramePtr WasmDebugInfo::GetInterpretedFrame(
     Address frame_pointer, int idx) {
   return GetInterpreterHandle(*this)->GetInterpretedFrame(frame_pointer, idx);
@@ -619,14 +868,6 @@ uint64_t WasmDebugInfo::NumInterpretedCalls() {
   return handle ? handle->NumInterpretedCalls() : 0;
 }
 
-// static
-Handle<JSObject> WasmDebugInfo::GetGlobalScopeObject(
-    Handle<WasmDebugInfo> debug_info, Address frame_pointer, int frame_index) {
-  auto* interp_handle = GetInterpreterHandle(*debug_info);
-  auto frame = interp_handle->GetInterpretedFrame(frame_pointer, frame_index);
-  return interp_handle->GetGlobalScopeObject(frame.get(), debug_info);
-}
-
 // static
 Handle<JSObject> WasmDebugInfo::GetLocalScopeObject(
     Handle<WasmDebugInfo> debug_info, Address frame_pointer, int frame_index) {
@@ -666,5 +907,416 @@ Handle<Code> WasmDebugInfo::GetCWasmEntry(Handle<WasmDebugInfo> debug_info,
   return handle(Code::cast(entries->get(index)), isolate);
 }
 
+namespace {
+
+// Return the next breakable position after {offset_in_func} in function
+// {func_index}, or 0 if there is none.
+// Note that 0 is never a breakable position in wasm, since the first byte
+// contains the locals count for the function.
+int FindNextBreakablePosition(wasm::NativeModule* native_module, int func_index,
+                              int offset_in_func) {
+  AccountingAllocator alloc;
+  Zone tmp(&alloc, ZONE_NAME);
+  wasm::BodyLocalDecls locals(&tmp);
+  const byte* module_start = native_module->wire_bytes().begin();
+  const wasm::WasmFunction& func =
+      native_module->module()->functions[func_index];
+  wasm::BytecodeIterator iterator(module_start + func.code.offset(),
+                                  module_start + func.code.end_offset(),
+                                  &locals);
+  DCHECK_LT(0, locals.encoded_size);
+  if (offset_in_func < 0) return 0;
+  for (uint32_t offset : iterator.offsets()) {
+    if (offset >= static_cast<uint32_t>(offset_in_func)) return offset;
+  }
+  return 0;
+}
+
+}  // namespace
+
+// static
+bool WasmScript::SetBreakPoint(Handle<Script> script, int* position,
+                               Handle<BreakPoint> break_point) {
+  // Find the function for this breakpoint.
+  const wasm::WasmModule* module = script->wasm_native_module()->module();
+  int func_index = GetContainingWasmFunction(module, *position);
+  if (func_index < 0) return false;
+  const wasm::WasmFunction& func = module->functions[func_index];
+  int offset_in_func = *position - func.code.offset();
+
+  int breakable_offset = FindNextBreakablePosition(script->wasm_native_module(),
+                                                   func_index, offset_in_func);
+  if (breakable_offset == 0) return false;
+  *position = func.code.offset() + breakable_offset;
+
+  return WasmScript::SetBreakPointForFunction(script, func_index,
+                                              breakable_offset, break_point);
+}
+
+// static
+bool WasmScript::SetBreakPointOnFirstBreakableForFunction(
+    Handle<Script> script, int func_index, Handle<BreakPoint> break_point) {
+  if (func_index < 0) return false;
+  int offset_in_func = 0;
+
+  int breakable_offset = FindNextBreakablePosition(script->wasm_native_module(),
+                                                   func_index, offset_in_func);
+  if (breakable_offset == 0) return false;
+  return WasmScript::SetBreakPointForFunction(script, func_index,
+                                              breakable_offset, break_point);
+}
+
+// static
+bool WasmScript::SetBreakPointForFunction(Handle<Script> script, int func_index,
+                                          int offset,
+                                          Handle<BreakPoint> break_point) {
+  Isolate* isolate = script->GetIsolate();
+
+  DCHECK_LE(0, func_index);
+  DCHECK_NE(0, offset);
+
+  // Find the function for this breakpoint.
+  wasm::NativeModule* native_module = script->wasm_native_module();
+  const wasm::WasmModule* module = native_module->module();
+  const wasm::WasmFunction& func = module->functions[func_index];
+
+  // Insert new break point into {wasm_breakpoint_infos} of the script.
+  WasmScript::AddBreakpointToInfo(script, func.code.offset() + offset,
+                                  break_point);
+
+  if (FLAG_debug_in_liftoff) {
+    native_module->GetDebugInfo()->SetBreakpoint(func_index, offset);
+  } else {
+    // Iterate over all instances and tell them to set this new breakpoint.
+    // We do this using the weak list of all instances from the script.
+    Handle<WeakArrayList> weak_instance_list(script->wasm_weak_instance_list(),
+                                             isolate);
+    for (int i = 0; i < weak_instance_list->length(); ++i) {
+      MaybeObject maybe_instance = weak_instance_list->Get(i);
+      if (maybe_instance->IsWeak()) {
+        Handle<WasmInstanceObject> instance(
+            WasmInstanceObject::cast(maybe_instance->GetHeapObjectAssumeWeak()),
+            isolate);
+        Handle<WasmDebugInfo> debug_info =
+            WasmInstanceObject::GetOrCreateDebugInfo(instance);
+        WasmDebugInfo::SetBreakpoint(debug_info, func_index, offset);
+      }
+    }
+  }
+
+  return true;
+}
+
+// static
+bool WasmScript::ClearBreakPoint(Handle<Script> script, int position,
+                                 Handle<BreakPoint> break_point) {
+  Isolate* isolate = script->GetIsolate();
+
+  // Find the function for this breakpoint.
+  const wasm::WasmModule* module = script->wasm_native_module()->module();
+  int func_index = GetContainingWasmFunction(module, position);
+  if (func_index < 0) return false;
+  const wasm::WasmFunction& func = module->functions[func_index];
+  int offset_in_func = position - func.code.offset();
+
+  if (!WasmScript::RemoveBreakpointFromInfo(script, position, break_point)) {
+    return false;
+  }
+
+  // Iterate over all instances and tell them to remove this breakpoint.
+  // We do this using the weak list of all instances from the script.
+  Handle<WeakArrayList> weak_instance_list(script->wasm_weak_instance_list(),
+                                           isolate);
+  for (int i = 0; i < weak_instance_list->length(); ++i) {
+    MaybeObject maybe_instance = weak_instance_list->Get(i);
+    if (maybe_instance->IsWeak()) {
+      Handle<WasmInstanceObject> instance(
+          WasmInstanceObject::cast(maybe_instance->GetHeapObjectAssumeWeak()),
+          isolate);
+      Handle<WasmDebugInfo> debug_info =
+          WasmInstanceObject::GetOrCreateDebugInfo(instance);
+      WasmDebugInfo::ClearBreakpoint(debug_info, func_index, offset_in_func);
+    }
+  }
+
+  return true;
+}
+
+// static
+bool WasmScript::ClearBreakPointById(Handle<Script> script, int breakpoint_id) {
+  if (!script->has_wasm_breakpoint_infos()) {
+    return false;
+  }
+  Isolate* isolate = script->GetIsolate();
+  Handle<FixedArray> breakpoint_infos(script->wasm_breakpoint_infos(), isolate);
+  // If the array exists, it should not be empty.
+  DCHECK_LT(0, breakpoint_infos->length());
+
+  for (int i = 0, e = breakpoint_infos->length(); i < e; ++i) {
+    Handle<Object> obj(breakpoint_infos->get(i), isolate);
+    if (obj->IsUndefined(isolate)) {
+      continue;
+    }
+    Handle<BreakPointInfo> breakpoint_info = Handle<BreakPointInfo>::cast(obj);
+    Handle<BreakPoint> breakpoint;
+    if (BreakPointInfo::GetBreakPointById(isolate, breakpoint_info,
+                                          breakpoint_id)
+            .ToHandle(&breakpoint)) {
+      DCHECK(breakpoint->id() == breakpoint_id);
+      return WasmScript::ClearBreakPoint(
+          script, breakpoint_info->source_position(), breakpoint);
+    }
+  }
+  return false;
+}
+
+namespace {
+
+int GetBreakpointPos(Isolate* isolate, Object break_point_info_or_undef) {
+  if (break_point_info_or_undef.IsUndefined(isolate)) return kMaxInt;
+  return BreakPointInfo::cast(break_point_info_or_undef).source_position();
+}
+
+int FindBreakpointInfoInsertPos(Isolate* isolate,
+                                Handle<FixedArray> breakpoint_infos,
+                                int position) {
+  // Find insert location via binary search, taking care of undefined values on
+  // the right. Position is always greater than zero.
+  DCHECK_LT(0, position);
+
+  int left = 0;                            // inclusive
+  int right = breakpoint_infos->length();  // exclusive
+  while (right - left > 1) {
+    int mid = left + (right - left) / 2;
+    Object mid_obj = breakpoint_infos->get(mid);
+    if (GetBreakpointPos(isolate, mid_obj) <= position) {
+      left = mid;
+    } else {
+      right = mid;
+    }
+  }
+
+  int left_pos = GetBreakpointPos(isolate, breakpoint_infos->get(left));
+  return left_pos < position ? left + 1 : left;
+}
+
+}  // namespace
+
+// static
+void WasmScript::AddBreakpointToInfo(Handle<Script> script, int position,
+                                     Handle<BreakPoint> break_point) {
+  Isolate* isolate = script->GetIsolate();
+  Handle<FixedArray> breakpoint_infos;
+  if (script->has_wasm_breakpoint_infos()) {
+    breakpoint_infos = handle(script->wasm_breakpoint_infos(), isolate);
+  } else {
+    breakpoint_infos =
+        isolate->factory()->NewFixedArray(4, AllocationType::kOld);
+    script->set_wasm_breakpoint_infos(*breakpoint_infos);
+  }
+
+  int insert_pos =
+      FindBreakpointInfoInsertPos(isolate, breakpoint_infos, position);
+
+  // If a BreakPointInfo object already exists for this position, add the new
+  // breakpoint object and return.
+  if (insert_pos < breakpoint_infos->length() &&
+      GetBreakpointPos(isolate, breakpoint_infos->get(insert_pos)) ==
+          position) {
+    Handle<BreakPointInfo> old_info(
+        BreakPointInfo::cast(breakpoint_infos->get(insert_pos)), isolate);
+    BreakPointInfo::SetBreakPoint(isolate, old_info, break_point);
+    return;
+  }
+
+  // Enlarge break positions array if necessary.
+  bool need_realloc = !breakpoint_infos->get(breakpoint_infos->length() - 1)
+                           .IsUndefined(isolate);
+  Handle<FixedArray> new_breakpoint_infos = breakpoint_infos;
+  if (need_realloc) {
+    new_breakpoint_infos = isolate->factory()->NewFixedArray(
+        2 * breakpoint_infos->length(), AllocationType::kOld);
+    script->set_wasm_breakpoint_infos(*new_breakpoint_infos);
+    // Copy over the entries [0, insert_pos).
+    for (int i = 0; i < insert_pos; ++i)
+      new_breakpoint_infos->set(i, breakpoint_infos->get(i));
+  }
+
+  // Move elements [insert_pos, ...] up by one.
+  for (int i = breakpoint_infos->length() - 1; i >= insert_pos; --i) {
+    Object entry = breakpoint_infos->get(i);
+    if (entry.IsUndefined(isolate)) continue;
+    new_breakpoint_infos->set(i + 1, entry);
+  }
+
+  // Generate new BreakpointInfo.
+  Handle<BreakPointInfo> breakpoint_info =
+      isolate->factory()->NewBreakPointInfo(position);
+  BreakPointInfo::SetBreakPoint(isolate, breakpoint_info, break_point);
+
+  // Now insert new position at insert_pos.
+  new_breakpoint_infos->set(insert_pos, *breakpoint_info);
+}
+
+// static
+bool WasmScript::RemoveBreakpointFromInfo(Handle<Script> script, int position,
+                                          Handle<BreakPoint> break_point) {
+  if (!script->has_wasm_breakpoint_infos()) return false;
+
+  Isolate* isolate = script->GetIsolate();
+  Handle<FixedArray> breakpoint_infos(script->wasm_breakpoint_infos(), isolate);
+
+  int pos = FindBreakpointInfoInsertPos(isolate, breakpoint_infos, position);
+
+  // Does a BreakPointInfo object already exist for this position?
+  if (pos == breakpoint_infos->length()) return false;
+
+  Handle<BreakPointInfo> info(BreakPointInfo::cast(breakpoint_infos->get(pos)),
+                              isolate);
+  BreakPointInfo::ClearBreakPoint(isolate, info, break_point);
+
+  // Check if there are no more breakpoints at this location.
+  if (info->GetBreakPointCount(isolate) == 0) {
+    // Update array by moving breakpoints up one position.
+    for (int i = pos; i < breakpoint_infos->length() - 1; i++) {
+      Object entry = breakpoint_infos->get(i + 1);
+      breakpoint_infos->set(i, entry);
+      if (entry.IsUndefined(isolate)) break;
+    }
+    // Make sure last array element is empty as a result.
+    breakpoint_infos->set_undefined(breakpoint_infos->length() - 1);
+  }
+  return true;
+}
+
+void WasmScript::SetBreakpointsOnNewInstance(
+    Handle<Script> script, Handle<WasmInstanceObject> instance) {
+  if (!script->has_wasm_breakpoint_infos()) return;
+  Isolate* isolate = script->GetIsolate();
+  Handle<WasmDebugInfo> debug_info =
+      WasmInstanceObject::GetOrCreateDebugInfo(instance);
+
+  Handle<FixedArray> breakpoint_infos(script->wasm_breakpoint_infos(), isolate);
+  // If the array exists, it should not be empty.
+  DCHECK_LT(0, breakpoint_infos->length());
+
+  for (int i = 0, e = breakpoint_infos->length(); i < e; ++i) {
+    Handle<Object> obj(breakpoint_infos->get(i), isolate);
+    if (obj->IsUndefined(isolate)) {
+      for (; i < e; ++i) {
+        DCHECK(breakpoint_infos->get(i).IsUndefined(isolate));
+      }
+      break;
+    }
+    Handle<BreakPointInfo> breakpoint_info = Handle<BreakPointInfo>::cast(obj);
+    int position = breakpoint_info->source_position();
+
+    // Find the function for this breakpoint, and set the breakpoint.
+    const wasm::WasmModule* module = script->wasm_native_module()->module();
+    int func_index = GetContainingWasmFunction(module, position);
+    DCHECK_LE(0, func_index);
+    const wasm::WasmFunction& func = module->functions[func_index];
+    int offset_in_func = position - func.code.offset();
+    WasmDebugInfo::SetBreakpoint(debug_info, func_index, offset_in_func);
+  }
+}
+
+// static
+bool WasmScript::GetPossibleBreakpoints(
+    wasm::NativeModule* native_module, const v8::debug::Location& start,
+    const v8::debug::Location& end,
+    std::vector<v8::debug::BreakLocation>* locations) {
+  DisallowHeapAllocation no_gc;
+
+  const wasm::WasmModule* module = native_module->module();
+  const std::vector<wasm::WasmFunction>& functions = module->functions;
+
+  if (start.GetLineNumber() != 0 || start.GetColumnNumber() < 0 ||
+      (!end.IsEmpty() &&
+       (end.GetLineNumber() != 0 || end.GetColumnNumber() < 0 ||
+        end.GetColumnNumber() < start.GetColumnNumber())))
+    return false;
+
+  // start_func_index, start_offset and end_func_index is inclusive.
+  // end_offset is exclusive.
+  // start_offset and end_offset are module-relative byte offsets.
+  // We set strict to false because offsets may be between functions.
+  int start_func_index =
+      GetNearestWasmFunction(module, start.GetColumnNumber());
+  if (start_func_index < 0) return false;
+  uint32_t start_offset = start.GetColumnNumber();
+  int end_func_index;
+  uint32_t end_offset;
+
+  if (end.IsEmpty()) {
+    // Default: everything till the end of the Script.
+    end_func_index = static_cast<uint32_t>(functions.size() - 1);
+    end_offset = functions[end_func_index].code.end_offset();
+  } else {
+    // If end is specified: Use it and check for valid input.
+    end_offset = end.GetColumnNumber();
+    end_func_index = GetNearestWasmFunction(module, end_offset);
+    DCHECK_GE(end_func_index, start_func_index);
+  }
+
+  if (start_func_index == end_func_index &&
+      start_offset > functions[end_func_index].code.end_offset())
+    return false;
+  AccountingAllocator alloc;
+  Zone tmp(&alloc, ZONE_NAME);
+  const byte* module_start = native_module->wire_bytes().begin();
+
+  for (int func_idx = start_func_index; func_idx <= end_func_index;
+       ++func_idx) {
+    const wasm::WasmFunction& func = functions[func_idx];
+    if (func.code.length() == 0) continue;
+
+    wasm::BodyLocalDecls locals(&tmp);
+    wasm::BytecodeIterator iterator(module_start + func.code.offset(),
+                                    module_start + func.code.end_offset(),
+                                    &locals);
+    DCHECK_LT(0u, locals.encoded_size);
+    for (uint32_t offset : iterator.offsets()) {
+      uint32_t total_offset = func.code.offset() + offset;
+      if (total_offset >= end_offset) {
+        DCHECK_EQ(end_func_index, func_idx);
+        break;
+      }
+      if (total_offset < start_offset) continue;
+      locations->emplace_back(0, total_offset, debug::kCommonBreakLocation);
+    }
+  }
+  return true;
+}
+
+// static
+MaybeHandle<FixedArray> WasmScript::CheckBreakPoints(Isolate* isolate,
+                                                     Handle<Script> script,
+                                                     int position) {
+  if (!script->has_wasm_breakpoint_infos()) return {};
+
+  Handle<FixedArray> breakpoint_infos(script->wasm_breakpoint_infos(), isolate);
+  int insert_pos =
+      FindBreakpointInfoInsertPos(isolate, breakpoint_infos, position);
+  if (insert_pos >= breakpoint_infos->length()) return {};
+
+  Handle<Object> maybe_breakpoint_info(breakpoint_infos->get(insert_pos),
+                                       isolate);
+  if (maybe_breakpoint_info->IsUndefined(isolate)) return {};
+  Handle<BreakPointInfo> breakpoint_info =
+      Handle<BreakPointInfo>::cast(maybe_breakpoint_info);
+  if (breakpoint_info->source_position() != position) return {};
+
+  // There is no support for conditional break points. Just assume that every
+  // break point always hits.
+  Handle<Object> break_points(breakpoint_info->break_points(), isolate);
+  if (break_points->IsFixedArray()) {
+    return Handle<FixedArray>::cast(break_points);
+  }
+  Handle<FixedArray> break_points_hit = isolate->factory()->NewFixedArray(1);
+  break_points_hit->set(0, *break_points);
+  return break_points_hit;
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/wasm-debug.h b/deps/v8/src/wasm/wasm-debug.h
new file mode 100644
index 00000000000000..ca0ab76bf76e76
--- /dev/null
+++ b/deps/v8/src/wasm/wasm-debug.h
@@ -0,0 +1,164 @@
+// Copyright 2019 the V8 project authors. All rights reserved.  Use of
+// this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_WASM_WASM_DEBUG_H_
+#define V8_WASM_WASM_DEBUG_H_
+
+#include <algorithm>
+#include <memory>
+#include <vector>
+
+#include "include/v8-internal.h"
+#include "src/base/iterator.h"
+#include "src/base/logging.h"
+#include "src/base/macros.h"
+#include "src/wasm/value-type.h"
+
+namespace v8 {
+namespace internal {
+
+template <typename T>
+class Handle;
+class JSObject;
+class WasmInstanceObject;
+
+namespace wasm {
+
+class DebugInfoImpl;
+class LocalNames;
+class NativeModule;
+class WireBytesRef;
+
+// Side table storing information used to inspect Liftoff frames at runtime.
+// This table is only created on demand for debugging, so it is not optimized
+// for memory size.
+class DebugSideTable {
+ public:
+  class Entry {
+   public:
+    struct Constant {
+      int index;
+      int32_t i32_const;
+    };
+
+    Entry(int pc_offset, std::vector<ValueType> stack_types,
+          std::vector<int> stack_offsets, std::vector<Constant> constants)
+        : pc_offset_(pc_offset),
+          stack_types_(std::move(stack_types)),
+          stack_offsets_(std::move(stack_offsets)),
+          constants_(std::move(constants)) {
+      DCHECK(std::is_sorted(constants_.begin(), constants_.end(),
+                            ConstantIndexLess{}));
+      DCHECK_EQ(stack_types_.size(), stack_offsets_.size());
+    }
+
+    // Constructor for map lookups (only initializes the {pc_offset_}).
+    explicit Entry(int pc_offset) : pc_offset_(pc_offset) {}
+
+    int pc_offset() const { return pc_offset_; }
+    int stack_height() const { return static_cast<int>(stack_types_.size()); }
+    ValueType stack_type(int stack_index) const {
+      return stack_types_[stack_index];
+    }
+    int stack_offset(int stack_index) const {
+      return stack_offsets_[stack_index];
+    }
+    // {index} can point to a local or operand stack value.
+    bool IsConstant(int index) const {
+      return std::binary_search(constants_.begin(), constants_.end(),
+                                Constant{index, 0}, ConstantIndexLess{});
+    }
+    int32_t GetConstant(int index) const {
+      DCHECK(IsConstant(index));
+      auto it = std::lower_bound(constants_.begin(), constants_.end(),
+                                 Constant{index, 0}, ConstantIndexLess{});
+      DCHECK_NE(it, constants_.end());
+      DCHECK_EQ(it->index, index);
+      return it->i32_const;
+    }
+
+   private:
+    struct ConstantIndexLess {
+      bool operator()(const Constant& a, const Constant& b) const {
+        return a.index < b.index;
+      }
+    };
+
+    int pc_offset_;
+    // TODO(clemensb): Merge these vectors into one.
+    std::vector<ValueType> stack_types_;
+    std::vector<int> stack_offsets_;
+    std::vector<Constant> constants_;
+  };
+
+  // Technically it would be fine to copy this class, but there should not be a
+  // reason to do so, hence mark it move only.
+  MOVE_ONLY_NO_DEFAULT_CONSTRUCTOR(DebugSideTable);
+
+  explicit DebugSideTable(std::vector<ValueType> local_types,
+                          std::vector<int> local_stack_offsets,
+                          std::vector<Entry> entries)
+      : local_types_(std::move(local_types)),
+        local_stack_offsets_(std::move(local_stack_offsets)),
+        entries_(std::move(entries)) {
+    DCHECK(
+        std::is_sorted(entries_.begin(), entries_.end(), EntryPositionLess{}));
+  }
+
+  const Entry* GetEntry(int pc_offset) const {
+    auto it = std::lower_bound(entries_.begin(), entries_.end(),
+                               Entry{pc_offset}, EntryPositionLess{});
+    if (it == entries_.end() || it->pc_offset() != pc_offset) return nullptr;
+    return &*it;
+  }
+
+  auto entries() const {
+    return base::make_iterator_range(entries_.begin(), entries_.end());
+  }
+
+  size_t num_entries() const { return entries_.size(); }
+  int num_locals() const { return static_cast<int>(local_types_.size()); }
+  ValueType local_type(int index) const { return local_types_[index]; }
+  int local_stack_offset(int index) const {
+    return local_stack_offsets_[index];
+  }
+
+ private:
+  struct EntryPositionLess {
+    bool operator()(const Entry& a, const Entry& b) const {
+      return a.pc_offset() < b.pc_offset();
+    }
+  };
+
+  std::vector<ValueType> local_types_;
+  std::vector<int32_t> local_stack_offsets_;
+  std::vector<Entry> entries_;
+};
+
+// Get the global scope for a given instance. This will contain the wasm memory
+// (if the instance has a memory) and the values of all globals.
+Handle<JSObject> GetGlobalScopeObject(Handle<WasmInstanceObject>);
+
+// Debug info per NativeModule, created lazily on demand.
+// Implementation in {wasm-debug.cc} using PIMPL.
+class DebugInfo {
+ public:
+  explicit DebugInfo(NativeModule*);
+  ~DebugInfo();
+
+  Handle<JSObject> GetLocalScopeObject(Isolate*, Address pc, Address fp);
+
+  WireBytesRef GetLocalName(int func_index, int local_index);
+
+  void SetBreakpoint(int func_index, int offset);
+
+ private:
+  std::unique_ptr<DebugInfoImpl> impl_;
+};
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_WASM_WASM_DEBUG_H_
diff --git a/deps/v8/src/wasm/wasm-engine.cc b/deps/v8/src/wasm/wasm-engine.cc
index adb566cb41835f..28b0aa0ca5c838 100644
--- a/deps/v8/src/wasm/wasm-engine.cc
+++ b/deps/v8/src/wasm/wasm-engine.cc
@@ -13,6 +13,7 @@
 #include "src/objects/heap-number.h"
 #include "src/objects/js-promise.h"
 #include "src/objects/objects-inl.h"
+#include "src/strings/string-hasher-inl.h"
 #include "src/utils/ostreams.h"
 #include "src/wasm/function-compiler.h"
 #include "src/wasm/module-compiler.h"
@@ -125,6 +126,70 @@ class WasmGCForegroundTask : public CancelableTask {
 
 }  // namespace
 
+std::shared_ptr<NativeModule> NativeModuleCache::MaybeGetNativeModule(
+    ModuleOrigin origin, Vector<const uint8_t> wire_bytes) {
+  if (origin != kWasmOrigin) return nullptr;
+  base::MutexGuard lock(&mutex_);
+  while (true) {
+    auto it = map_.find(wire_bytes);
+    if (it == map_.end()) {
+      // Insert a {nullopt} entry to let other threads know that this
+      // {NativeModule} is already being created on another thread.
+      map_.emplace(wire_bytes, base::nullopt);
+      return nullptr;
+    }
+    auto maybe_native_module = it->second;
+    if (maybe_native_module.has_value()) {
+      auto weak_ptr = maybe_native_module.value();
+      if (auto shared_native_module = weak_ptr.lock()) {
+        return shared_native_module;
+      }
+    }
+    cache_cv_.Wait(&mutex_);
+  }
+}
+
+void NativeModuleCache::Update(std::shared_ptr<NativeModule> native_module,
+                               bool error) {
+  DCHECK_NOT_NULL(native_module);
+  if (native_module->module()->origin != kWasmOrigin) return;
+  Vector<const uint8_t> wire_bytes = native_module->wire_bytes();
+  base::MutexGuard lock(&mutex_);
+  auto it = map_.find(wire_bytes);
+  DCHECK_NE(it, map_.end());
+  DCHECK(!it->second.has_value());
+  // The lifetime of the temporary entry's bytes is unknown. Use the new native
+  // module's owned copy of the bytes for the key instead.
+  map_.erase(it);
+  if (!error) {
+    map_.emplace(wire_bytes, base::Optional<std::weak_ptr<NativeModule>>(
+                                 std::move(native_module)));
+  }
+  cache_cv_.NotifyAll();
+}
+
+void NativeModuleCache::Erase(NativeModule* native_module) {
+  base::MutexGuard lock(&mutex_);
+  auto cache_it = map_.find(native_module->wire_bytes());
+  // Not all native modules are stored in the cache currently. In particular
+  // streaming compilation and asmjs compilation results are not. So make
+  // sure that we only delete existing and expired entries.
+  // Do not erase {nullopt} values either, as they indicate that the
+  // {NativeModule} is currently being created in another thread.
+  if (cache_it != map_.end() && cache_it->second.has_value() &&
+      cache_it->second.value().expired()) {
+    map_.erase(cache_it);
+    cache_cv_.NotifyAll();
+  }
+}
+
+size_t NativeModuleCache::WireBytesHasher::operator()(
+    const Vector<const uint8_t>& bytes) const {
+  return StringHasher::HashSequentialString(
+      reinterpret_cast<const char*>(bytes.begin()), bytes.length(),
+      kZeroHashSeed);
+}
+
 struct WasmEngine::CurrentGCInfo {
   explicit CurrentGCInfo(int8_t gc_sequence_index)
       : gc_sequence_index(gc_sequence_index) {
@@ -242,8 +307,8 @@ MaybeHandle<AsmWasmData> WasmEngine::SyncCompileTranslatedAsmJs(
                             ? kAsmJsSloppyOrigin
                             : kAsmJsStrictOrigin;
   ModuleResult result =
-      DecodeWasmModule(kAsmjsWasmFeatures, bytes.start(), bytes.end(), false,
-                       origin, isolate->counters(), allocator());
+      DecodeWasmModule(WasmFeatures::ForAsmjs(), bytes.start(), bytes.end(),
+                       false, origin, isolate->counters(), allocator());
   if (result.failed()) {
     // This happens once in a while when we have missed some limit check
     // in the asm parser. Output an error message to help diagnose, but crash.
@@ -251,23 +316,19 @@ MaybeHandle<AsmWasmData> WasmEngine::SyncCompileTranslatedAsmJs(
     UNREACHABLE();
   }
 
+  result.value()->asm_js_offset_information =
+      std::make_unique<AsmJsOffsetInformation>(asm_js_offset_table_bytes);
+
   // Transfer ownership of the WasmModule to the {Managed<WasmModule>} generated
   // in {CompileToNativeModule}.
   Handle<FixedArray> export_wrappers;
   std::shared_ptr<NativeModule> native_module =
-      CompileToNativeModule(isolate, kAsmjsWasmFeatures, thrower,
+      CompileToNativeModule(isolate, WasmFeatures::ForAsmjs(), thrower,
                             std::move(result).value(), bytes, &export_wrappers);
   if (!native_module) return {};
 
-  // Create heap objects for asm.js offset table to be stored in the module
-  // object.
-  Handle<ByteArray> asm_js_offset_table =
-      isolate->factory()->NewByteArray(asm_js_offset_table_bytes.length());
-  asm_js_offset_table->copy_in(0, asm_js_offset_table_bytes.begin(),
-                               asm_js_offset_table_bytes.length());
-
   return AsmWasmData::New(isolate, std::move(native_module), export_wrappers,
-                          asm_js_offset_table, uses_bitset);
+                          uses_bitset);
 }
 
 Handle<WasmModuleObject> WasmEngine::FinalizeTranslatedAsmJs(
@@ -279,7 +340,6 @@ Handle<WasmModuleObject> WasmEngine::FinalizeTranslatedAsmJs(
       handle(asm_wasm_data->export_wrappers(), isolate);
   Handle<WasmModuleObject> module_object = WasmModuleObject::New(
       isolate, std::move(native_module), script, export_wrappers);
-  module_object->set_asm_js_offset_table(asm_wasm_data->asm_js_offset_table());
   return module_object;
 }
 
@@ -302,13 +362,9 @@ MaybeHandle<WasmModuleObject> WasmEngine::SyncCompile(
                             std::move(result).value(), bytes, &export_wrappers);
   if (!native_module) return {};
 
-  Handle<Script> script =
-      CreateWasmScript(isolate, bytes, native_module->module()->source_map_url);
-
-  // Create the module object.
-  // TODO(clemensb): For the same module (same bytes / same hash), we should
-  // only have one WasmModuleObject. Otherwise, we might only set
-  // breakpoints on a (potentially empty) subset of the instances.
+  Handle<Script> script = CreateWasmScript(
+      isolate, bytes, VectorOf(native_module->module()->source_map_url),
+      native_module->module()->name);
 
   // Create the compiled module object and populate with compiled functions
   // and information needed at instantiation time. This object needs to be
@@ -426,12 +482,18 @@ std::shared_ptr<StreamingDecoder> WasmEngine::StartStreamingCompilation(
 void WasmEngine::CompileFunction(Isolate* isolate, NativeModule* native_module,
                                  uint32_t function_index, ExecutionTier tier) {
   // Note we assume that "one-off" compilations can discard detected features.
-  WasmFeatures detected = kNoWasmFeatures;
+  WasmFeatures detected = WasmFeatures::None();
   WasmCompilationUnit::CompileWasmFunction(
       isolate, native_module, &detected,
       &native_module->module()->functions[function_index], tier);
 }
 
+void WasmEngine::RecompileAllFunctions(Isolate* isolate,
+                                       NativeModule* native_module,
+                                       ExecutionTier tier) {
+  RecompileNativeModule(isolate, native_module, tier);
+}
+
 std::shared_ptr<NativeModule> WasmEngine::ExportNativeModule(
     Handle<WasmModuleObject> module_object) {
   return module_object->shared_native_module();
@@ -442,7 +504,8 @@ Handle<WasmModuleObject> WasmEngine::ImportNativeModule(
   NativeModule* native_module = shared_native_module.get();
   ModuleWireBytes wire_bytes(native_module->wire_bytes());
   Handle<Script> script = CreateWasmScript(
-      isolate, wire_bytes, native_module->module()->source_map_url);
+      isolate, wire_bytes, VectorOf(native_module->module()->source_map_url),
+      native_module->module()->name);
   Handle<FixedArray> export_wrappers;
   CompileJsToWasmWrappers(isolate, native_module->module(), &export_wrappers);
   Handle<WasmModuleObject> module_object = WasmModuleObject::New(
@@ -621,9 +684,10 @@ void WasmEngine::RemoveIsolate(Isolate* isolate) {
   }
 }
 
-void WasmEngine::LogCode(WasmCode* code) {
+void WasmEngine::LogCode(Vector<WasmCode*> code_vec) {
+  if (code_vec.empty()) return;
   base::MutexGuard guard(&mutex_);
-  NativeModule* native_module = code->native_module();
+  NativeModule* native_module = code_vec[0]->native_module();
   DCHECK_EQ(1, native_modules_.count(native_module));
   for (Isolate* isolate : native_modules_[native_module]->isolates) {
     DCHECK_EQ(1, isolates_.count(isolate));
@@ -638,8 +702,12 @@ void WasmEngine::LogCode(WasmCode* code) {
     if (info->code_to_log.empty()) {
       isolate->stack_guard()->RequestLogWasmCode();
     }
-    info->code_to_log.push_back(code);
-    code->IncRef();
+    info->code_to_log.insert(info->code_to_log.end(), code_vec.begin(),
+                             code_vec.end());
+    for (WasmCode* code : code_vec) {
+      DCHECK_EQ(native_module, code->native_module());
+      code->IncRef();
+    }
   }
 }
 
@@ -671,18 +739,11 @@ void WasmEngine::LogOutstandingCodesForIsolate(Isolate* isolate) {
 
 std::shared_ptr<NativeModule> WasmEngine::NewNativeModule(
     Isolate* isolate, const WasmFeatures& enabled,
-    std::shared_ptr<const WasmModule> module) {
-  size_t code_size_estimate =
-      wasm::WasmCodeManager::EstimateNativeModuleCodeSize(module.get());
-  return NewNativeModule(isolate, enabled, code_size_estimate,
-                         !wasm::NativeModule::kNeedsFarJumpsBetweenCodeSpaces ||
-                             FLAG_wasm_far_jump_table,
-                         std::move(module));
-}
-
-std::shared_ptr<NativeModule> WasmEngine::NewNativeModule(
-    Isolate* isolate, const WasmFeatures& enabled, size_t code_size_estimate,
-    bool can_request_more, std::shared_ptr<const WasmModule> module) {
+    std::shared_ptr<const WasmModule> module, size_t code_size_estimate) {
+  // TODO(clemensb): Remove --wasm-far-jump-table and {can_request_more}.
+  bool can_request_more =
+      !wasm::NativeModule::kNeedsFarJumpsBetweenCodeSpaces ||
+      FLAG_wasm_far_jump_table;
   std::shared_ptr<NativeModule> native_module =
       code_manager_.NewNativeModule(this, isolate, enabled, code_size_estimate,
                                     can_request_more, std::move(module));
@@ -695,6 +756,16 @@ std::shared_ptr<NativeModule> WasmEngine::NewNativeModule(
   return native_module;
 }
 
+std::shared_ptr<NativeModule> WasmEngine::MaybeGetNativeModule(
+    ModuleOrigin origin, Vector<const uint8_t> wire_bytes) {
+  return native_module_cache_.MaybeGetNativeModule(origin, wire_bytes);
+}
+
+void WasmEngine::UpdateNativeModuleCache(
+    std::shared_ptr<NativeModule> native_module, bool error) {
+  native_module_cache_.Update(native_module, error);
+}
+
 void WasmEngine::FreeNativeModule(NativeModule* native_module) {
   base::MutexGuard guard(&mutex_);
   auto it = native_modules_.find(native_module);
@@ -735,6 +806,7 @@ void WasmEngine::FreeNativeModule(NativeModule* native_module) {
     TRACE_CODE_GC("Native module %p died, reducing dead code objects to %zu.\n",
                   native_module, current_gc_info_->dead_code.size());
   }
+  native_module_cache_.Erase(native_module);
   native_modules_.erase(it);
 }
 
@@ -959,20 +1031,17 @@ DEFINE_LAZY_LEAKY_OBJECT_GETTER(std::shared_ptr<WasmEngine>,
 
 // static
 void WasmEngine::InitializeOncePerProcess() {
-  if (!FLAG_wasm_shared_engine) return;
   *GetSharedWasmEngine() = std::make_shared<WasmEngine>();
 }
 
 // static
 void WasmEngine::GlobalTearDown() {
-  if (!FLAG_wasm_shared_engine) return;
   GetSharedWasmEngine()->reset();
 }
 
 // static
 std::shared_ptr<WasmEngine> WasmEngine::GetWasmEngine() {
-  if (FLAG_wasm_shared_engine) return *GetSharedWasmEngine();
-  return std::make_shared<WasmEngine>();
+  return *GetSharedWasmEngine();
 }
 
 // {max_mem_pages} is declared in wasm-limits.h.
diff --git a/deps/v8/src/wasm/wasm-engine.h b/deps/v8/src/wasm/wasm-engine.h
index 424f85fa7988be..073d617b31c830 100644
--- a/deps/v8/src/wasm/wasm-engine.h
+++ b/deps/v8/src/wasm/wasm-engine.h
@@ -6,8 +6,11 @@
 #define V8_WASM_WASM_ENGINE_H_
 
 #include <memory>
+#include <unordered_map>
 #include <unordered_set>
 
+#include "src/base/platform/condition-variable.h"
+#include "src/base/platform/mutex.h"
 #include "src/tasks/cancelable-task.h"
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-tier.h"
@@ -29,7 +32,7 @@ namespace wasm {
 class AsyncCompileJob;
 class ErrorThrower;
 struct ModuleWireBytes;
-struct WasmFeatures;
+class WasmFeatures;
 
 class V8_EXPORT_PRIVATE CompilationResultResolver {
  public:
@@ -45,6 +48,43 @@ class V8_EXPORT_PRIVATE InstantiationResultResolver {
   virtual ~InstantiationResultResolver() = default;
 };
 
+// Native modules cached by their wire bytes.
+class NativeModuleCache {
+ public:
+  struct WireBytesHasher {
+    size_t operator()(const Vector<const uint8_t>& bytes) const;
+  };
+
+  std::shared_ptr<NativeModule> MaybeGetNativeModule(
+      ModuleOrigin origin, Vector<const uint8_t> wire_bytes);
+  void Update(std::shared_ptr<NativeModule> native_module, bool error);
+  void Erase(NativeModule* native_module);
+
+ private:
+  // Each key points to the corresponding native module's wire bytes, so they
+  // should always be valid as long as the native module is alive.  When
+  // the native module dies, {FreeNativeModule} deletes the entry from the
+  // map, so that we do not leave any dangling key pointing to an expired
+  // weak_ptr. This also serves as a way to regularly clean up the map, which
+  // would otherwise accumulate expired entries.
+  // A {nullopt} value is inserted to indicate that this native module is
+  // currently being created in some thread, and that other threads should wait
+  // before trying to get it from the cache.
+  // By contrast, an expired {weak_ptr} indicates that the native module died
+  // and will soon be cleaned up from the cache.
+  std::unordered_map<Vector<const uint8_t>,
+                     base::Optional<std::weak_ptr<NativeModule>>,
+                     WireBytesHasher>
+      map_;
+
+  base::Mutex mutex_;
+
+  // This condition variable is used to synchronize threads compiling the same
+  // module. Only one thread will create the {NativeModule}. Other threads
+  // will wait on this variable until the first thread wakes them up.
+  base::ConditionVariable cache_cv_;
+};
+
 // The central data structure that represents an engine instance capable of
 // loading, instantiating, and executing WASM code.
 class V8_EXPORT_PRIVATE WasmEngine {
@@ -108,6 +148,10 @@ class V8_EXPORT_PRIVATE WasmEngine {
   void CompileFunction(Isolate* isolate, NativeModule* native_module,
                        uint32_t function_index, ExecutionTier tier);
 
+  // Recompiles all functions at a specific compilation tier.
+  void RecompileAllFunctions(Isolate* isolate, NativeModule* native_module,
+                             ExecutionTier tier);
+
   // Exports the sharable parts of the given module object so that they can be
   // transferred to a different Context/Isolate using the same engine.
   std::shared_ptr<NativeModule> ExportNativeModule(
@@ -158,10 +202,10 @@ class V8_EXPORT_PRIVATE WasmEngine {
                                std::forward<Args>(args)...);
   }
 
-  // Trigger code logging for this WasmCode in all Isolates which have access to
-  // the NativeModule containing this code. This method can be called from
-  // background threads.
-  void LogCode(WasmCode*);
+  // Trigger code logging for the given code objects in all Isolates which have
+  // access to the NativeModule containing this code. This method can be called
+  // from background threads.
+  void LogCode(Vector<WasmCode*>);
 
   // Enable code logging for the given Isolate. Initially, code logging is
   // enabled if {WasmCode::ShouldBeLogged(Isolate*)} returns true during
@@ -175,16 +219,28 @@ class V8_EXPORT_PRIVATE WasmEngine {
   // Create a new NativeModule. The caller is responsible for its
   // lifetime. The native module will be given some memory for code,
   // which will be page size aligned. The size of the initial memory
-  // is determined with a heuristic based on the total size of wasm
-  // code. The native module may later request more memory.
-  // TODO(titzer): isolate is only required here for CompilationState.
+  // is determined by {code_size_estimate}. The native module may later request
+  // more memory.
+  // TODO(wasm): isolate is only required here for CompilationState.
   std::shared_ptr<NativeModule> NewNativeModule(
       Isolate* isolate, const WasmFeatures& enabled_features,
-      std::shared_ptr<const WasmModule> module);
-  std::shared_ptr<NativeModule> NewNativeModule(
-      Isolate* isolate, const WasmFeatures& enabled_features,
-      size_t code_size_estimate, bool can_request_more,
-      std::shared_ptr<const WasmModule> module);
+      std::shared_ptr<const WasmModule> module, size_t code_size_estimate);
+
+  // Try getting a cached {NativeModule}. The {wire_bytes}' underlying array
+  // should be valid at least until the next call to {UpdateNativeModuleCache}.
+  // Return nullptr if no {NativeModule} exists for these bytes. In this case,
+  // an empty entry is added to let other threads know that a {NativeModule} for
+  // these bytes is currently being created. The caller should eventually call
+  // {UpdateNativeModuleCache} to update the entry and wake up other threads.
+  std::shared_ptr<NativeModule> MaybeGetNativeModule(
+      ModuleOrigin origin, Vector<const uint8_t> wire_bytes);
+
+  // Update the temporary entry inserted by {MaybeGetNativeModule}.
+  // If {error} is true, the entry is erased. Otherwise the entry is updated to
+  // match the {native_module} argument. Wake up threads waiting for this native
+  // module.
+  void UpdateNativeModuleCache(std::shared_ptr<NativeModule> native_module,
+                               bool error);
 
   void FreeNativeModule(NativeModule*);
 
@@ -215,8 +271,9 @@ class V8_EXPORT_PRIVATE WasmEngine {
   static void InitializeOncePerProcess();
   static void GlobalTearDown();
 
-  // Constructs a WasmEngine instance. Depending on whether we are sharing
-  // engines this might be a pointer to a new instance or to a shared one.
+  // Returns a reference to the WasmEngine shared by the entire process. Try to
+  // use {Isolate::wasm_engine} instead if it is available, which encapsulates
+  // engine lifetime decisions during Isolate bootstrapping.
   static std::shared_ptr<WasmEngine> GetWasmEngine();
 
  private:
@@ -278,6 +335,8 @@ class V8_EXPORT_PRIVATE WasmEngine {
   // about that.
   std::unique_ptr<CurrentGCInfo> current_gc_info_;
 
+  NativeModuleCache native_module_cache_;
+
   // End of fields protected by {mutex_}.
   //////////////////////////////////////////////////////////////////////////////
 
diff --git a/deps/v8/src/wasm/wasm-external-refs.cc b/deps/v8/src/wasm/wasm-external-refs.cc
index 13c159c0efc2ab..5c1058d7885b71 100644
--- a/deps/v8/src/wasm/wasm-external-refs.cc
+++ b/deps/v8/src/wasm/wasm-external-refs.cc
@@ -303,6 +303,20 @@ uint32_t word32_ror_wrapper(Address data) {
   return (input >> shift) | (input << ((32 - shift) & 31));
 }
 
+void word64_rol_wrapper(Address data) {
+  uint64_t input = ReadUnalignedValue<uint64_t>(data);
+  uint64_t shift = ReadUnalignedValue<uint64_t>(data + sizeof(input)) & 63;
+  uint64_t result = (input << shift) | (input >> ((64 - shift) & 63));
+  WriteUnalignedValue<uint64_t>(data, result);
+}
+
+void word64_ror_wrapper(Address data) {
+  uint64_t input = ReadUnalignedValue<uint64_t>(data);
+  uint64_t shift = ReadUnalignedValue<uint64_t>(data + sizeof(input)) & 63;
+  uint64_t result = (input >> shift) | (input << ((64 - shift) & 63));
+  WriteUnalignedValue<uint64_t>(data, result);
+}
+
 void float64_pow_wrapper(Address data) {
   double x = ReadUnalignedValue<double>(data);
   double y = ReadUnalignedValue<double>(data + sizeof(x));
diff --git a/deps/v8/src/wasm/wasm-external-refs.h b/deps/v8/src/wasm/wasm-external-refs.h
index 8318b8b0bb6489..d1026517025f8f 100644
--- a/deps/v8/src/wasm/wasm-external-refs.h
+++ b/deps/v8/src/wasm/wasm-external-refs.h
@@ -65,6 +65,10 @@ V8_EXPORT_PRIVATE uint32_t word32_rol_wrapper(Address data);
 
 V8_EXPORT_PRIVATE uint32_t word32_ror_wrapper(Address data);
 
+V8_EXPORT_PRIVATE void word64_rol_wrapper(Address data);
+
+V8_EXPORT_PRIVATE void word64_ror_wrapper(Address data);
+
 V8_EXPORT_PRIVATE void float64_pow_wrapper(Address data);
 
 void memory_copy_wrapper(Address dst, Address src, uint32_t size);
diff --git a/deps/v8/src/wasm/wasm-feature-flags.h b/deps/v8/src/wasm/wasm-feature-flags.h
index b18fa90acf7002..4ae5de91095b51 100644
--- a/deps/v8/src/wasm/wasm-feature-flags.h
+++ b/deps/v8/src/wasm/wasm-feature-flags.h
@@ -5,24 +5,83 @@
 #ifndef V8_WASM_WASM_FEATURE_FLAGS_H_
 #define V8_WASM_WASM_FEATURE_FLAGS_H_
 
-#define FOREACH_WASM_EXPERIMENTAL_FEATURE_FLAG(V) \
-  V(mv, "multi-value support", false)             \
-  V(eh, "exception handling opcodes", false)      \
-  V(threads, "thread opcodes", false)             \
-  V(simd, "SIMD opcodes", false)                  \
-  V(return_call, "return call opcodes", false)    \
+// See https://github.com/WebAssembly/proposals for an overview of current
+// WebAssembly proposals.
+
+// Experimental features (disabled by default).
+#define FOREACH_WASM_EXPERIMENTAL_FEATURE_FLAG(V) /*     (force 80 columns) */ \
+  /* Exception handling proposal. */                                           \
+  /* https://github.com/WebAssembly/exception-handling */                      \
+  /* V8 side owner: clemensb */                                                \
+  V(eh, "exception handling opcodes", false)                                   \
+                                                                               \
+  /* Fixed-width SIMD operations. */                                           \
+  /* https://github.com/webassembly/simd */                                    \
+  /* V8 side owner: gdeepti */                                                 \
+  V(simd, "SIMD opcodes", false)                                               \
+                                                                               \
+  /* Tail call / return call proposal. */                                      \
+  /* https://github.com/webassembly/tail-call */                               \
+  /* V8 side owner: fgm */                                                     \
+  V(return_call, "return call opcodes", false)                                 \
+                                                                               \
+  /* No official proposal (yet?). */                                           \
+  /* V8 side owner: clemensb */                                                \
   V(compilation_hints, "compilation hints section", false)
 
-#define FOREACH_WASM_STAGING_FEATURE_FLAG(V) \
-  V(anyref, "anyref opcodes", false)         \
-  V(bigint, "JS BigInt support", false)      \
+// #############################################################################
+// Staged features (disabled by default, but enabled via --wasm-staging (also
+// exposed as chrome://flags/#enable-experimental-webassembly-features). Staged
+// features get limited fuzzer coverage, and should come with their own tests.
+// They are not run through all fuzzers though and don't get much exposure in
+// the wild. Staged features do not necessarily be fully stabilized. They should
+// be shipped with enough lead time to the next branch to allow for
+// stabilization.
+#define FOREACH_WASM_STAGING_FEATURE_FLAG(V) /*          (force 80 columns) */ \
+  /* Reference Types, a.k.a. anyref proposal. */                               \
+  /* https://github.com/WebAssembly/reference-types */                         \
+  /* V8 side owner: ahaas */                                                   \
+  /* Staged in v7.8. */                                                        \
+  V(anyref, "anyref opcodes", false)                                           \
+                                                                               \
+  /* JS BitInt to wasm i64 integration. */                                     \
+  /* https://github.com/WebAssembly/JS-BigInt-integration */                   \
+  /* V8 side owner: ahaas, ssauleau@igalia.com */                              \
+  /* Staged in v7.9. */                                                        \
+  V(bigint, "JS BigInt support", false)                                        \
+                                                                               \
+  /* Multi-value proposal. */                                                  \
+  /* https://github.com/WebAssembly/multi-value */                             \
+  /* V8 side owner: thibaudm */                                                \
+  /* Staged in v8.0. */                                                        \
+  V(mv, "multi-value support", false)                                          \
+                                                                               \
+  /* Threads proposal. */                                                      \
+  /* https://github.com/webassembly/threads */                                 \
+  /* NOTE: This is enabled via chromium flag on desktop systems since v7.4  */ \
+  /* (see https://crrev.com/c/1487808). ITS: https://groups.google.com/a/   */ \
+  /* chromium.org/d/msg/blink-dev/tD6np-OG2PU/rcNGROOMFQAJ */                  \
+  /* V8 side owner: gdeepti */                                                 \
+  V(threads, "thread opcodes", false)                                          \
+                                                                               \
+  /* Type reflection proposal. */                                              \
+  /* https://github.com/webassembly/js-types */                                \
+  /* V8 side owner: ahaas */                                                   \
+  /* Staged in v7.8. */                                                        \
   V(type_reflection, "wasm type reflection in JS", false)
 
-#define FOREACH_WASM_SHIPPED_FEATURE_FLAG(V)                          \
-  V(bulk_memory, "bulk memory opcodes", true)                         \
-  V(sat_f2i_conversions, "saturating float conversion opcodes", true) \
-  V(se, "sign extension opcodes", true)
+// #############################################################################
+// Shipped features (enabled by default). Remove the feature flag once they hit
+// stable and are expected to stay enabled.
+#define FOREACH_WASM_SHIPPED_FEATURE_FLAG(V) /*          (force 80 columns) */ \
+  /* Bulk memory operations. */                                                \
+  /* https://github.com/webassembly/bulk-memory-operations */                  \
+  /* V8 side owner: binji */                                                   \
+  /* Shipped in v7.5. */                                                       \
+  /* ITS: https://groups.google.com/forum/#!topic/v8-users/zM05lYEBVog */      \
+  V(bulk_memory, "bulk memory opcodes", true)
 
+// Combination of all available wasm feature flags.
 #define FOREACH_WASM_FEATURE_FLAG(V)        \
   FOREACH_WASM_EXPERIMENTAL_FEATURE_FLAG(V) \
   FOREACH_WASM_STAGING_FEATURE_FLAG(V)      \
diff --git a/deps/v8/src/wasm/wasm-features.cc b/deps/v8/src/wasm/wasm-features.cc
index d62db91750bb22..2e0909a8e33b8c 100644
--- a/deps/v8/src/wasm/wasm-features.cc
+++ b/deps/v8/src/wasm/wasm-features.cc
@@ -11,23 +11,22 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-
-void UnionFeaturesInto(WasmFeatures* dst, const WasmFeatures& src) {
-#define DO_UNION(feat, desc, val) dst->feat |= src.feat;
-  FOREACH_WASM_FEATURE(DO_UNION);
-#undef DO_UNION
-}
-
-WasmFeatures WasmFeaturesFromFlags() {
-#define FLAG_REF(feat, desc, val) FLAG_experimental_wasm_##feat,
-  return WasmFeatures(FOREACH_WASM_FEATURE(FLAG_REF){});
+// static
+WasmFeatures WasmFeatures::FromFlags() {
+  WasmFeatures features = WasmFeatures::None();
+#define FLAG_REF(feat, ...) \
+  if (FLAG_experimental_wasm_##feat) features.Add(kFeature_##feat);
+  FOREACH_WASM_FEATURE(FLAG_REF)
 #undef FLAG_REF
+  return features;
 }
 
-WasmFeatures WasmFeaturesFromIsolate(Isolate* isolate) {
-  WasmFeatures features = WasmFeaturesFromFlags();
-  features.threads |=
-      isolate->AreWasmThreadsEnabled(handle(isolate->context(), isolate));
+// static
+WasmFeatures WasmFeatures::FromIsolate(Isolate* isolate) {
+  WasmFeatures features = WasmFeatures::FromFlags();
+  if (isolate->AreWasmThreadsEnabled(handle(isolate->context(), isolate))) {
+    features.Add(kFeature_threads);
+  }
   return features;
 }
 
diff --git a/deps/v8/src/wasm/wasm-features.h b/deps/v8/src/wasm/wasm-features.h
index 956982536da7d1..5604e81fd561cb 100644
--- a/deps/v8/src/wasm/wasm-features.h
+++ b/deps/v8/src/wasm/wasm-features.h
@@ -6,6 +6,7 @@
 #define V8_WASM_WASM_FEATURES_H_
 
 // The feature flags are declared in their own header.
+#include "src/base/enum-set.h"
 #include "src/base/macros.h"
 #include "src/wasm/wasm-feature-flags.h"
 
@@ -14,64 +15,49 @@
 
 namespace v8 {
 namespace internal {
+
 class Isolate;
+
 namespace wasm {
 
-// This is an empty type to indicate the end of the {WasmFeatures} struct. We
-// use the {end_t} type there to avoid trailing commas that get generated by
-// the macro generators. We considered the following alternatives:
-// * Add "separators" to the {FOREACH_WASM_FEATURE_FLAGS} between entries. This
-//   does not work when we want to have different kinds of flags, e.g. for
-//   experimental, staging, and shipped features.
-// * Use initialization lists, e.g. construct {WasmFeatures} with
-//   "WasmFeatures{true, true, ..., true,}". This solves the comma problem,
-//   because trailing commas are allowed here. However, we cannot
-//   default-initialize the fields of {WasmFeatures} anymore. This seems
-//   error-prone, because default-constructed {WasmFeatures} structs are already
-//   used in the code base.
-// * Avoid the use of {constexpr}. With that we would be more flexible with how
-//   we generate {kAllWasmFeatures} and {kNoWasmFeatures}. These values may be
-//   used in performance-critical code, however, e.g. in the decoder or in the
-//   interpreter.
-struct end_t {};
+enum WasmFeature {
+#define DECL_FEATURE_ENUM(feat, ...) kFeature_##feat,
+  FOREACH_WASM_FEATURE(DECL_FEATURE_ENUM)
+#undef DECL_FEATURE_ENUM
+};
 
 // Enabled or detected features.
-struct WasmFeatures {
-#define DECL_FIELD(feat, desc, val) bool feat = false;
-  FOREACH_WASM_FEATURE(DECL_FIELD)
-#undef DECL_FIELD
-  // Marker for the end of the list, see the comment at {end_t}.
-  end_t end_;
-
-#define DECL_PARAM(feat, desc, val) bool p##feat,
-#define DO_INIT(feat, desc, val) feat(p##feat),
-  explicit constexpr WasmFeatures(FOREACH_WASM_FEATURE(DECL_PARAM) end_t)
-      : FOREACH_WASM_FEATURE(DO_INIT) end_() {}
-#undef DECL_PARAM
-#undef DO_INIT
+class WasmFeatures : public base::EnumSet<WasmFeature> {
+ public:
   constexpr WasmFeatures() = default;
-};
-
-#define JUST_TRUE(feat, desc, val) true,
-static constexpr WasmFeatures kAllWasmFeatures(
-    FOREACH_WASM_FEATURE(JUST_TRUE){});
-#undef JUST_TRUE
+  explicit constexpr WasmFeatures(std::initializer_list<WasmFeature> features)
+      : EnumSet(features) {}
 
-#define JUST_FALSE(feat, desc, val) false,
-static constexpr WasmFeatures kNoWasmFeatures(
-    FOREACH_WASM_FEATURE(JUST_FALSE){});
-#undef JUST_FALSE
+  // Simplified getters. Use {has_foo()} instead of {contains(kFeature_foo)}.
+#define DECL_FEATURE_GETTER(feat, ...) \
+  bool has_##feat() const { return contains(kFeature_##feat); }
+  FOREACH_WASM_FEATURE(DECL_FEATURE_GETTER)
+#undef DECL_FEATURE_GETTER
 
-static constexpr WasmFeatures kAsmjsWasmFeatures = kNoWasmFeatures;
+  static inline constexpr WasmFeatures All();
+  static inline constexpr WasmFeatures None();
+  static inline constexpr WasmFeatures ForAsmjs();
+  static WasmFeatures FromFlags();
+  static V8_EXPORT_PRIVATE WasmFeatures FromIsolate(Isolate*);
+};
 
-V8_EXPORT_PRIVATE WasmFeatures WasmFeaturesFromFlags();
+// static
+constexpr WasmFeatures WasmFeatures::All() {
+#define LIST_FEATURE(feat, ...) kFeature_##feat,
+  return WasmFeatures({FOREACH_WASM_FEATURE(LIST_FEATURE)});
+#undef LIST_FEATURE
+}
 
-// Enables features based on both commandline flags and the isolate.
-// Precondition: A valid context must be set in {isolate->context()}.
-V8_EXPORT_PRIVATE WasmFeatures WasmFeaturesFromIsolate(Isolate* isolate);
+// static
+constexpr WasmFeatures WasmFeatures::None() { return {}; }
 
-V8_EXPORT_PRIVATE void UnionFeaturesInto(WasmFeatures* dst,
-                                         const WasmFeatures& src);
+// static
+constexpr WasmFeatures WasmFeatures::ForAsmjs() { return {}; }
 
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/src/wasm/wasm-import-wrapper-cache.cc b/deps/v8/src/wasm/wasm-import-wrapper-cache.cc
index 9630fa76dd6d66..9469855ee5472c 100644
--- a/deps/v8/src/wasm/wasm-import-wrapper-cache.cc
+++ b/deps/v8/src/wasm/wasm-import-wrapper-cache.cc
@@ -25,6 +25,7 @@ WasmCode*& WasmImportWrapperCache::operator[](
 
 WasmCode* WasmImportWrapperCache::Get(compiler::WasmImportCallKind kind,
                                       FunctionSig* sig) const {
+  base::MutexGuard lock(&mutex_);
   auto it = entry_map_.find({kind, sig});
   DCHECK(it != entry_map_.end());
   return it->second;
diff --git a/deps/v8/src/wasm/wasm-import-wrapper-cache.h b/deps/v8/src/wasm/wasm-import-wrapper-cache.h
index e9e60faad405b7..6172881dc7d78a 100644
--- a/deps/v8/src/wasm/wasm-import-wrapper-cache.h
+++ b/deps/v8/src/wasm/wasm-import-wrapper-cache.h
@@ -49,14 +49,14 @@ class WasmImportWrapperCache {
   // cache.
   V8_EXPORT_PRIVATE WasmCode*& operator[](const CacheKey& key);
 
-  // Assumes the key exists in the map.
+  // Thread-safe. Assumes the key exists in the map.
   V8_EXPORT_PRIVATE WasmCode* Get(compiler::WasmImportCallKind kind,
                                   FunctionSig* sig) const;
 
   ~WasmImportWrapperCache();
 
  private:
-  base::Mutex mutex_;
+  mutable base::Mutex mutex_;
   std::unordered_map<CacheKey, WasmCode*, CacheKeyHash> entry_map_;
 };
 
diff --git a/deps/v8/src/wasm/wasm-interpreter.cc b/deps/v8/src/wasm/wasm-interpreter.cc
index 7c41f6a8e02125..e8b073c2cea5e4 100644
--- a/deps/v8/src/wasm/wasm-interpreter.cc
+++ b/deps/v8/src/wasm/wasm-interpreter.cc
@@ -51,9 +51,6 @@ using base::WriteUnalignedValue;
 
 #define FOREACH_INTERNAL_OPCODE(V) V(Breakpoint, 0xFF)
 
-#define WASM_CTYPES(V) \
-  V(I32, int32_t) V(I64, int64_t) V(F32, float) V(F64, double) V(S128, Simd128)
-
 #define FOREACH_SIMPLE_BINOP(V) \
   V(I32Add, uint32_t, +)        \
   V(I32Sub, uint32_t, -)        \
@@ -643,7 +640,7 @@ const char* OpcodeName(uint32_t val) {
   return WasmOpcodes::OpcodeName(static_cast<WasmOpcode>(val));
 }
 
-constexpr uint32_t kCatchInArity = 1;
+constexpr int32_t kCatchInArity = 1;
 
 }  // namespace
 
@@ -668,7 +665,7 @@ struct InterpreterCode {
 class SideTable : public ZoneObject {
  public:
   ControlTransferMap map_;
-  uint32_t max_stack_height_ = 0;
+  int32_t max_stack_height_ = 0;
 
   SideTable(Zone* zone, const WasmModule* module, InterpreterCode* code)
       : map_(zone) {
@@ -677,7 +674,7 @@ class SideTable : public ZoneObject {
 
     // Represents a control flow label.
     class CLabel : public ZoneObject {
-      explicit CLabel(Zone* zone, uint32_t target_stack_height, uint32_t arity)
+      explicit CLabel(Zone* zone, int32_t target_stack_height, uint32_t arity)
           : target_stack_height(target_stack_height),
             arity(arity),
             refs(zone) {}
@@ -685,15 +682,15 @@ class SideTable : public ZoneObject {
      public:
       struct Ref {
         const byte* from_pc;
-        const uint32_t stack_height;
+        const int32_t stack_height;
       };
       const byte* target = nullptr;
-      uint32_t target_stack_height;
+      int32_t target_stack_height;
       // Arity when branching to this label.
       const uint32_t arity;
       ZoneVector<Ref> refs;
 
-      static CLabel* New(Zone* zone, uint32_t stack_height, uint32_t arity) {
+      static CLabel* New(Zone* zone, int32_t stack_height, uint32_t arity) {
         return new (zone) CLabel(zone, stack_height, arity);
       }
 
@@ -704,7 +701,7 @@ class SideTable : public ZoneObject {
       }
 
       // Reference this label from the given location.
-      void Ref(const byte* from_pc, uint32_t stack_height) {
+      void Ref(const byte* from_pc, int32_t stack_height) {
         // Target being bound before a reference means this is a loop.
         DCHECK_IMPLIES(target, *target == kExprLoop);
         refs.push_back({from_pc, stack_height});
@@ -766,7 +763,7 @@ class SideTable : public ZoneObject {
     // control transfers are treated just like other branches in the resulting
     // map. This stack contains indices into the above control stack.
     ZoneVector<size_t> exception_stack(zone);
-    uint32_t stack_height = 0;
+    int32_t stack_height = 0;
     uint32_t func_arity =
         static_cast<uint32_t>(code->function->sig->return_count());
     CLabel* func_label =
@@ -782,7 +779,7 @@ class SideTable : public ZoneObject {
     for (BytecodeIterator i(code->orig_start, code->orig_end, &code->locals);
          i.has_next(); i.next()) {
       WasmOpcode opcode = i.current();
-      uint32_t exceptional_stack_height = 0;
+      int32_t exceptional_stack_height = 0;
       if (WasmOpcodes::IsPrefixOpcode(opcode)) opcode = i.prefixed_opcode();
       bool unreachable = control_stack.back().unreachable;
       if (unreachable) {
@@ -818,7 +815,7 @@ class SideTable : public ZoneObject {
         case kExprBlock:
         case kExprLoop: {
           bool is_loop = opcode == kExprLoop;
-          BlockTypeImmediate<Decoder::kNoValidate> imm(kAllWasmFeatures, &i,
+          BlockTypeImmediate<Decoder::kNoValidate> imm(WasmFeatures::All(), &i,
                                                        i.pc());
           if (imm.type == kWasmBottom) {
             imm.sig = module->signatures[imm.sig_index];
@@ -826,7 +823,7 @@ class SideTable : public ZoneObject {
           TRACE("control @%u: %s, arity %d->%d\n", i.pc_offset(),
                 is_loop ? "Loop" : "Block", imm.in_arity(), imm.out_arity());
           CLabel* label =
-              CLabel::New(&control_transfer_zone, stack_height,
+              CLabel::New(&control_transfer_zone, stack_height - imm.in_arity(),
                           is_loop ? imm.in_arity() : imm.out_arity());
           control_stack.emplace_back(i.pc(), label, imm.out_arity());
           copy_unreachable();
@@ -834,15 +831,16 @@ class SideTable : public ZoneObject {
           break;
         }
         case kExprIf: {
-          BlockTypeImmediate<Decoder::kNoValidate> imm(kAllWasmFeatures, &i,
+          BlockTypeImmediate<Decoder::kNoValidate> imm(WasmFeatures::All(), &i,
                                                        i.pc());
           if (imm.type == kWasmBottom) {
             imm.sig = module->signatures[imm.sig_index];
           }
           TRACE("control @%u: If, arity %d->%d\n", i.pc_offset(),
                 imm.in_arity(), imm.out_arity());
-          CLabel* end_label = CLabel::New(&control_transfer_zone, stack_height,
-                                          imm.out_arity());
+          CLabel* end_label =
+              CLabel::New(&control_transfer_zone, stack_height - imm.in_arity(),
+                          imm.out_arity());
           CLabel* else_label =
               CLabel::New(&control_transfer_zone, stack_height, 0);
           control_stack.emplace_back(i.pc(), end_label, else_label,
@@ -861,13 +859,14 @@ class SideTable : public ZoneObject {
           DCHECK_NOT_NULL(c->else_label);
           c->else_label->Bind(i.pc() + 1);
           c->else_label->Finish(&map_, code->orig_start);
+          stack_height = c->else_label->target_stack_height;
           c->else_label = nullptr;
-          DCHECK_GE(stack_height, c->end_label->target_stack_height);
-          stack_height = c->end_label->target_stack_height;
+          DCHECK_IMPLIES(!unreachable,
+                         stack_height >= c->end_label->target_stack_height);
           break;
         }
         case kExprTry: {
-          BlockTypeImmediate<Decoder::kNoValidate> imm(kAllWasmFeatures, &i,
+          BlockTypeImmediate<Decoder::kNoValidate> imm(WasmFeatures::All(), &i,
                                                        i.pc());
           if (imm.type == kWasmBottom) {
             imm.sig = module->signatures[imm.sig_index];
@@ -897,7 +896,8 @@ class SideTable : public ZoneObject {
           c->else_label->Bind(i.pc() + 1);
           c->else_label->Finish(&map_, code->orig_start);
           c->else_label = nullptr;
-          DCHECK_GE(stack_height, c->end_label->target_stack_height);
+          DCHECK_IMPLIES(!unreachable,
+                         stack_height >= c->end_label->target_stack_height);
           stack_height = c->end_label->target_stack_height + kCatchInArity;
           break;
         }
@@ -908,7 +908,7 @@ class SideTable : public ZoneObject {
           DCHECK_EQ(0, imm.index.exception->sig->return_count());
           size_t params = imm.index.exception->sig->parameter_count();
           // Taken branches pop the exception and push the encoded values.
-          uint32_t height = stack_height - 1 + static_cast<uint32_t>(params);
+          int32_t height = stack_height - 1 + static_cast<int32_t>(params);
           TRACE("control @%u: BrOnExn[depth=%u]\n", i.pc_offset(), depth);
           Control* c = &control_stack[control_stack.size() - depth - 1];
           if (!unreachable) c->end_label->Ref(i.pc(), height);
@@ -924,7 +924,8 @@ class SideTable : public ZoneObject {
             c->end_label->Bind(i.pc() + 1);
           }
           c->Finish(&map_, code->orig_start);
-          DCHECK_GE(stack_height, c->end_label->target_stack_height);
+          DCHECK_IMPLIES(!unreachable,
+                         stack_height >= c->end_label->target_stack_height);
           stack_height = c->end_label->target_stack_height + c->exit_arity;
           control_stack.pop_back();
           break;
@@ -1294,37 +1295,6 @@ class ThreadImpl {
     return WasmInterpreter::Thread::HANDLED;
   }
 
-  uint32_t GetGlobalCount() {
-    return static_cast<uint32_t>(module()->globals.size());
-  }
-
-  WasmValue GetGlobalValue(uint32_t index) {
-    const WasmGlobal* global = &module()->globals[index];
-    switch (global->type) {
-#define CASE_TYPE(wasm, ctype)                                         \
-  case kWasm##wasm: {                                                  \
-    byte* ptr = GetGlobalPtr(global);                                  \
-    return WasmValue(                                                  \
-        ReadLittleEndianValue<ctype>(reinterpret_cast<Address>(ptr))); \
-    break;                                                             \
-  }
-      WASM_CTYPES(CASE_TYPE)
-#undef CASE_TYPE
-      case kWasmAnyRef:
-      case kWasmFuncRef:
-      case kWasmExnRef: {
-        HandleScope handle_scope(isolate_);  // Avoid leaking handles.
-        Handle<FixedArray> global_buffer;    // The buffer of the global.
-        uint32_t global_index = 0;           // The index into the buffer.
-        GetGlobalBufferAndIndex(global, &global_buffer, &global_index);
-        Handle<Object> value(global_buffer->get(global_index), isolate_);
-        return WasmValue(handle_scope.CloseAndEscape(value));
-      }
-      default:
-        UNREACHABLE();
-    }
-  }
-
  private:
   // Handle a thrown exception. Returns whether the exception was handled inside
   // the current activation. Unwinds the interpreted stack accordingly.
@@ -1372,9 +1342,9 @@ class ThreadImpl {
   // Safety wrapper for values on the operand stack represented as {WasmValue}.
   // Most values are stored directly on the stack, only reference values are
   // kept in a separate on-heap reference stack to make the GC trace them.
-  // TODO(mstarzinger): Optimize simple stack operations (like "get_local",
+  // TODO(wasm): Optimize simple stack operations (like "get_local",
   // "set_local", and "tee_local") so that they don't require a handle scope.
-  // TODO(mstarzinger): Consider optimizing activations that use no reference
+  // TODO(wasm): Consider optimizing activations that use no reference
   // values to avoid allocating the reference stack entirely.
   class StackValue {
    public:
@@ -1486,14 +1456,15 @@ class ThreadImpl {
     for (auto p : code->locals.type_list) {
       WasmValue val;
       switch (p) {
-#define CASE_TYPE(wasm, ctype) \
-  case kWasm##wasm:            \
-    val = WasmValue(ctype{});  \
+#define CASE_TYPE(valuetype, ctype) \
+  case valuetype:                   \
+    val = WasmValue(ctype{});       \
     break;
-        WASM_CTYPES(CASE_TYPE)
+        FOREACH_WASMVALUE_CTYPES(CASE_TYPE)
 #undef CASE_TYPE
         case kWasmAnyRef:
         case kWasmFuncRef:
+        case kWasmNullRef:
         case kWasmExnRef: {
           val = WasmValue(isolate_->factory()->null_value());
           break;
@@ -1555,7 +1526,7 @@ class ThreadImpl {
         return pc + 1 + imm.length;
       }
       case kExprCallIndirect: {
-        CallIndirectImmediate<Decoder::kNoValidate> imm(kAllWasmFeatures,
+        CallIndirectImmediate<Decoder::kNoValidate> imm(WasmFeatures::All(),
                                                         decoder, code->at(pc));
         return pc + 1 + imm.length;
       }
@@ -1675,8 +1646,8 @@ class ThreadImpl {
     if (effective_index < index) {
       return kNullAddress;  // wraparound => oob
     }
-    if (!IsInBounds(effective_index, sizeof(mtype),
-                    instance_object_->memory_size())) {
+    if (!base::IsInBounds(effective_index, sizeof(mtype),
+                          instance_object_->memory_size())) {
       return kNullAddress;  // oob
     }
     return EffectiveAddress(effective_index);
@@ -1684,7 +1655,7 @@ class ThreadImpl {
 
   inline bool BoundsCheckMemRange(uint32_t index, uint32_t* size,
                                   Address* out_address) {
-    bool ok = ClampToBounds(
+    bool ok = base::ClampToBounds(
         index, size, static_cast<uint32_t>(instance_object_->memory_size()));
     *out_address = EffectiveAddress(index);
     return ok;
@@ -1755,24 +1726,6 @@ class ThreadImpl {
     return true;
   }
 
-  bool CheckDataSegmentIsPassiveAndNotDropped(uint32_t index, pc_t pc) {
-    DCHECK_LT(index, module()->num_declared_data_segments);
-    if (instance_object_->dropped_data_segments()[index]) {
-      DoTrap(kTrapDataSegmentDropped, pc);
-      return false;
-    }
-    return true;
-  }
-
-  bool CheckElemSegmentIsPassiveAndNotDropped(uint32_t index, pc_t pc) {
-    DCHECK_LT(index, module()->elem_segments.size());
-    if (instance_object_->dropped_elem_segments()[index]) {
-      DoTrap(kTrapElemSegmentDropped, pc);
-      return false;
-    }
-    return true;
-  }
-
   template <typename type, typename op_type>
   bool ExtractAtomicOpParams(Decoder* decoder, InterpreterCode* code,
                              Address* address, pc_t pc, int* const len,
@@ -1783,10 +1736,47 @@ class ThreadImpl {
     if (val) *val = static_cast<type>(Pop().to<op_type>());
     uint32_t index = Pop().to<uint32_t>();
     *address = BoundsCheckMem<type>(imm.offset, index);
+    if (!*address) {
+      DoTrap(kTrapMemOutOfBounds, pc);
+      return false;
+    }
+    if (!IsAligned(*address, sizeof(type))) {
+      DoTrap(kTrapUnalignedAccess, pc);
+      return false;
+    }
+    *len = 2 + imm.length;
+    return true;
+  }
+
+  template <typename type>
+  bool ExtractAtomicWaitNotifyParams(Decoder* decoder, InterpreterCode* code,
+                                     pc_t pc, int* const len,
+                                     uint32_t* buffer_offset, type* val,
+                                     double* timeout = nullptr) {
+    MemoryAccessImmediate<Decoder::kValidate> imm(decoder, code->at(pc + 1),
+                                                  sizeof(type));
+    if (timeout) {
+      double timeout_ns = Pop().to<int64_t>();
+      *timeout = (timeout_ns < 0)
+                     ? V8_INFINITY
+                     : timeout_ns / (base::Time::kNanosecondsPerMicrosecond *
+                                     base::Time::kMicrosecondsPerMillisecond);
+    }
+    *val = Pop().to<type>();
+    auto index = Pop().to<uint32_t>();
+    // Check bounds.
+    Address address = BoundsCheckMem<uint32_t>(imm.offset, index);
+    *buffer_offset = index + imm.offset;
     if (!address) {
       DoTrap(kTrapMemOutOfBounds, pc);
       return false;
     }
+    // Check alignment.
+    const uint32_t align_mask = sizeof(type) - 1;
+    if ((*buffer_offset & align_mask) != 0) {
+      DoTrap(kTrapUnalignedAccess, pc);
+      return false;
+    }
     *len = 2 + imm.length;
     return true;
   }
@@ -1820,38 +1810,34 @@ class ThreadImpl {
         return true;
       case kExprMemoryInit: {
         MemoryInitImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc));
+        // The data segment index must be in bounds since it is required by
+        // validation.
         DCHECK_LT(imm.data_segment_index, module()->num_declared_data_segments);
         *len += imm.length;
-        if (!CheckDataSegmentIsPassiveAndNotDropped(imm.data_segment_index,
-                                                    pc)) {
-          return false;
-        }
         auto size = Pop().to<uint32_t>();
         auto src = Pop().to<uint32_t>();
         auto dst = Pop().to<uint32_t>();
-        if (size == 0) {
-          return true;
-        }
         Address dst_addr;
-        bool ok = BoundsCheckMemRange(dst, &size, &dst_addr);
         auto src_max =
             instance_object_->data_segment_sizes()[imm.data_segment_index];
-        // Use & instead of && so the clamp is not short-circuited.
-        ok &= ClampToBounds(src, &size, src_max);
+        if (!BoundsCheckMemRange(dst, &size, &dst_addr) ||
+            !base::IsInBounds(src, size, src_max)) {
+          DoTrap(kTrapMemOutOfBounds, pc);
+          return false;
+        }
         Address src_addr =
             instance_object_->data_segment_starts()[imm.data_segment_index] +
             src;
         memory_copy_wrapper(dst_addr, src_addr, size);
-        if (!ok) DoTrap(kTrapMemOutOfBounds, pc);
-        return ok;
+        return true;
       }
       case kExprDataDrop: {
         DataDropImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc));
+        // The data segment index must be in bounds since it is required by
+        // validation.
+        DCHECK_LT(imm.index, module()->num_declared_data_segments);
         *len += imm.length;
-        if (!CheckDataSegmentIsPassiveAndNotDropped(imm.index, pc)) {
-          return false;
-        }
-        instance_object_->dropped_data_segments()[imm.index] = 1;
+        instance_object_->data_segment_sizes()[imm.index] = 0;
         return true;
       }
       case kExprMemoryCopy: {
@@ -1860,24 +1846,16 @@ class ThreadImpl {
         auto size = Pop().to<uint32_t>();
         auto src = Pop().to<uint32_t>();
         auto dst = Pop().to<uint32_t>();
-        if (size == 0) {
-          return true;
-        }
         Address dst_addr;
-        bool copy_backward = src < dst;
-        bool ok = BoundsCheckMemRange(dst, &size, &dst_addr);
-        // Trap without copying any bytes if we are copying backward and the
-        // copy is partially out-of-bounds. We only need to check that the dst
-        // region is out-of-bounds, because we know that {src < dst}, so the src
-        // region is always out of bounds if the dst region is.
-        if (ok || !copy_backward) {
-          Address src_addr;
-          // Use & instead of && so the bounds check is not short-circuited.
-          ok &= BoundsCheckMemRange(src, &size, &src_addr);
-          memory_copy_wrapper(dst_addr, src_addr, size);
+        Address src_addr;
+        if (!BoundsCheckMemRange(dst, &size, &dst_addr) ||
+            !BoundsCheckMemRange(src, &size, &src_addr)) {
+          DoTrap(kTrapMemOutOfBounds, pc);
+          return false;
         }
-        if (!ok) DoTrap(kTrapMemOutOfBounds, pc);
-        return ok;
+
+        memory_copy_wrapper(dst_addr, src_addr, size);
+        return true;
       }
       case kExprMemoryFill: {
         MemoryIndexImmediate<Decoder::kNoValidate> imm(decoder,
@@ -1886,22 +1864,18 @@ class ThreadImpl {
         auto size = Pop().to<uint32_t>();
         auto value = Pop().to<uint32_t>();
         auto dst = Pop().to<uint32_t>();
-        if (size == 0) {
-          return true;
-        }
         Address dst_addr;
         bool ok = BoundsCheckMemRange(dst, &size, &dst_addr);
+        if (!ok) {
+          DoTrap(kTrapMemOutOfBounds, pc);
+          return false;
+        }
         memory_fill_wrapper(dst_addr, value, size);
-        if (!ok) DoTrap(kTrapMemOutOfBounds, pc);
-        return ok;
+        return true;
       }
       case kExprTableInit: {
         TableInitImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc));
         *len += imm.length;
-        if (!CheckElemSegmentIsPassiveAndNotDropped(imm.elem_segment_index,
-                                                    pc)) {
-          return false;
-        }
         auto size = Pop().to<uint32_t>();
         auto src = Pop().to<uint32_t>();
         auto dst = Pop().to<uint32_t>();
@@ -1915,9 +1889,6 @@ class ThreadImpl {
       case kExprElemDrop: {
         ElemDropImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc));
         *len += imm.length;
-        if (!CheckElemSegmentIsPassiveAndNotDropped(imm.index, pc)) {
-          return false;
-        }
         instance_object_->dropped_elem_segments()[imm.index] = 1;
         return true;
       }
@@ -2196,6 +2167,52 @@ class ThreadImpl {
         std::atomic_thread_fence(std::memory_order_seq_cst);
         *len += 2;
         break;
+      case kExprI32AtomicWait: {
+        int32_t val;
+        double timeout;
+        uint32_t buffer_offset;
+        if (!ExtractAtomicWaitNotifyParams<int32_t>(
+                decoder, code, pc, len, &buffer_offset, &val, &timeout)) {
+          return false;
+        }
+        HandleScope handle_scope(isolate_);
+        Handle<JSArrayBuffer> array_buffer(
+            instance_object_->memory_object().array_buffer(), isolate_);
+        auto result = FutexEmulation::Wait32(isolate_, array_buffer,
+                                             buffer_offset, val, timeout);
+        Push(WasmValue(result.ToSmi().value()));
+        break;
+      }
+      case kExprI64AtomicWait: {
+        int64_t val;
+        double timeout;
+        uint32_t buffer_offset;
+        if (!ExtractAtomicWaitNotifyParams<int64_t>(
+                decoder, code, pc, len, &buffer_offset, &val, &timeout)) {
+          return false;
+        }
+        HandleScope handle_scope(isolate_);
+        Handle<JSArrayBuffer> array_buffer(
+            instance_object_->memory_object().array_buffer(), isolate_);
+        auto result = FutexEmulation::Wait64(isolate_, array_buffer,
+                                             buffer_offset, val, timeout);
+        Push(WasmValue(result.ToSmi().value()));
+        break;
+      }
+      case kExprAtomicNotify: {
+        int32_t val;
+        uint32_t buffer_offset;
+        if (!ExtractAtomicWaitNotifyParams<int32_t>(decoder, code, pc, len,
+                                                    &buffer_offset, &val)) {
+          return false;
+        }
+        HandleScope handle_scope(isolate_);
+        Handle<JSArrayBuffer> array_buffer(
+            instance_object_->memory_object().array_buffer(), isolate_);
+        auto result = FutexEmulation::Wake(array_buffer, buffer_offset, val);
+        Push(WasmValue(result.ToSmi().value()));
+        break;
+      }
       default:
         UNREACHABLE();
         return false;
@@ -2203,34 +2220,6 @@ class ThreadImpl {
     return true;
   }
 
-  byte* GetGlobalPtr(const WasmGlobal* global) {
-    DCHECK(!ValueTypes::IsReferenceType(global->type));
-    if (global->mutability && global->imported) {
-      return reinterpret_cast<byte*>(
-          instance_object_->imported_mutable_globals()[global->index]);
-    } else {
-      return instance_object_->globals_start() + global->offset;
-    }
-  }
-
-  void GetGlobalBufferAndIndex(const WasmGlobal* global,
-                               Handle<FixedArray>* buffer, uint32_t* index) {
-    DCHECK(ValueTypes::IsReferenceType(global->type));
-    if (global->mutability && global->imported) {
-      *buffer =
-          handle(FixedArray::cast(
-                     instance_object_->imported_mutable_globals_buffers().get(
-                         global->index)),
-                 isolate_);
-      Address idx = instance_object_->imported_mutable_globals()[global->index];
-      DCHECK_LE(idx, std::numeric_limits<uint32_t>::max());
-      *index = static_cast<uint32_t>(idx);
-    } else {
-      *buffer = handle(instance_object_->tagged_globals_buffer(), isolate_);
-      *index = global->offset;
-    }
-  }
-
   bool ExecuteSimdOp(WasmOpcode opcode, Decoder* decoder, InterpreterCode* code,
                      pc_t pc, int* const len) {
     switch (opcode) {
@@ -2328,6 +2317,7 @@ class ThreadImpl {
       BINOP_CASE(S128And, i32x4, int4, 4, a & b)
       BINOP_CASE(S128Or, i32x4, int4, 4, a | b)
       BINOP_CASE(S128Xor, i32x4, int4, 4, a ^ b)
+      BINOP_CASE(S128AndNot, i32x4, int4, 4, a & ~b)
       BINOP_CASE(I16x8Add, i16x8, int8, 8, base::AddWithWraparound(a, b))
       BINOP_CASE(I16x8Sub, i16x8, int8, 8, base::SubWithWraparound(a, b))
       BINOP_CASE(I16x8Mul, i16x8, int8, 8, base::MulWithWraparound(a, b))
@@ -2341,6 +2331,8 @@ class ThreadImpl {
       BINOP_CASE(I16x8AddSaturateU, i16x8, int8, 8, SaturateAdd<uint16_t>(a, b))
       BINOP_CASE(I16x8SubSaturateS, i16x8, int8, 8, SaturateSub<int16_t>(a, b))
       BINOP_CASE(I16x8SubSaturateU, i16x8, int8, 8, SaturateSub<uint16_t>(a, b))
+      BINOP_CASE(I16x8RoundingAverageU, i16x8, int8, 8,
+                 base::RoundingAverageUnsigned<uint16_t>(a, b))
       BINOP_CASE(I8x16Add, i8x16, int16, 16, base::AddWithWraparound(a, b))
       BINOP_CASE(I8x16Sub, i8x16, int16, 16, base::SubWithWraparound(a, b))
       BINOP_CASE(I8x16Mul, i8x16, int16, 16, base::MulWithWraparound(a, b))
@@ -2356,6 +2348,8 @@ class ThreadImpl {
       BINOP_CASE(I8x16SubSaturateS, i8x16, int16, 16, SaturateSub<int8_t>(a, b))
       BINOP_CASE(I8x16SubSaturateU, i8x16, int16, 16,
                  SaturateSub<uint8_t>(a, b))
+      BINOP_CASE(I8x16RoundingAverageU, i8x16, int16, 16,
+                 base::RoundingAverageUnsigned<uint8_t>(a, b))
 #undef BINOP_CASE
 #define UNOP_CASE(op, name, stype, count, expr) \
   case kExpr##op: {                             \
@@ -2569,34 +2563,28 @@ class ThreadImpl {
         CONVERT_CASE(I16x8UConvertI8x16Low, int16, i8x16, int8, 8, 0, uint8_t,
                      a)
 #undef CONVERT_CASE
-#define PACK_CASE(op, src_type, name, dst_type, count, ctype, dst_ctype,   \
-                  is_unsigned)                                             \
-  case kExpr##op: {                                                        \
-    WasmValue v2 = Pop();                                                  \
-    WasmValue v1 = Pop();                                                  \
-    src_type s1 = v1.to_s128().to_##name();                                \
-    src_type s2 = v2.to_s128().to_##name();                                \
-    dst_type res;                                                          \
-    int64_t min = std::numeric_limits<ctype>::min();                       \
-    int64_t max = std::numeric_limits<ctype>::max();                       \
-    for (size_t i = 0; i < count; ++i) {                                   \
-      int32_t v = i < count / 2 ? s1.val[LANE(i, s1)]                      \
-                                : s2.val[LANE(i - count / 2, s2)];         \
-      int64_t a = is_unsigned ? static_cast<int64_t>(v & 0xFFFFFFFFu) : v; \
-      res.val[LANE(i, res)] =                                              \
-          static_cast<dst_ctype>(std::max(min, std::min(max, a)));         \
-    }                                                                      \
-    Push(WasmValue(Simd128(res)));                                         \
-    return true;                                                           \
-  }
-        PACK_CASE(I16x8SConvertI32x4, int4, i32x4, int8, 8, int16_t, int16_t,
-                  false)
-        PACK_CASE(I16x8UConvertI32x4, int4, i32x4, int8, 8, uint16_t, int16_t,
-                  true)
-        PACK_CASE(I8x16SConvertI16x8, int8, i16x8, int16, 16, int8_t, int8_t,
-                  false)
-        PACK_CASE(I8x16UConvertI16x8, int8, i16x8, int16, 16, uint8_t, int8_t,
-                  true)
+#define PACK_CASE(op, src_type, name, dst_type, count, ctype, dst_ctype) \
+  case kExpr##op: {                                                      \
+    WasmValue v2 = Pop();                                                \
+    WasmValue v1 = Pop();                                                \
+    src_type s1 = v1.to_s128().to_##name();                              \
+    src_type s2 = v2.to_s128().to_##name();                              \
+    dst_type res;                                                        \
+    int64_t min = std::numeric_limits<ctype>::min();                     \
+    int64_t max = std::numeric_limits<ctype>::max();                     \
+    for (size_t i = 0; i < count; ++i) {                                 \
+      int64_t v = i < count / 2 ? s1.val[LANE(i, s1)]                    \
+                                : s2.val[LANE(i - count / 2, s2)];       \
+      res.val[LANE(i, res)] =                                            \
+          static_cast<dst_ctype>(std::max(min, std::min(max, v)));       \
+    }                                                                    \
+    Push(WasmValue(Simd128(res)));                                       \
+    return true;                                                         \
+  }
+        PACK_CASE(I16x8SConvertI32x4, int4, i32x4, int8, 8, int16_t, int16_t)
+        PACK_CASE(I16x8UConvertI32x4, int4, i32x4, int8, 8, uint16_t, int16_t)
+        PACK_CASE(I8x16SConvertI16x8, int8, i16x8, int16, 16, int8_t, int8_t)
+        PACK_CASE(I8x16UConvertI16x8, int8, i16x8, int16, 16, uint8_t, int8_t)
 #undef PACK_CASE
       case kExprS128Select: {
         int4 bool_val = Pop().to_s128().to_i32x4();
@@ -2698,11 +2686,86 @@ class ThreadImpl {
         QFM_CASE(F64x2Qfma, f64x2, float2, 2, +)
         QFM_CASE(F64x2Qfms, f64x2, float2, 2, -)
 #undef QFM_CASE
+      case kExprS8x16LoadSplat: {
+        return DoSimdLoadSplat<int16, int32_t, int8_t>(
+            decoder, code, pc, len, MachineRepresentation::kWord8);
+      }
+      case kExprS16x8LoadSplat: {
+        return DoSimdLoadSplat<int8, int32_t, int16_t>(
+            decoder, code, pc, len, MachineRepresentation::kWord16);
+      }
+      case kExprS32x4LoadSplat: {
+        return DoSimdLoadSplat<int4, int32_t, int32_t>(
+            decoder, code, pc, len, MachineRepresentation::kWord32);
+      }
+      case kExprS64x2LoadSplat: {
+        return DoSimdLoadSplat<int2, int64_t, int64_t>(
+            decoder, code, pc, len, MachineRepresentation::kWord64);
+      }
+      case kExprI16x8Load8x8S: {
+        return DoSimdLoadExtend<int8, int16_t, int8_t>(
+            decoder, code, pc, len, MachineRepresentation::kWord64);
+      }
+      case kExprI16x8Load8x8U: {
+        return DoSimdLoadExtend<int8, uint16_t, uint8_t>(
+            decoder, code, pc, len, MachineRepresentation::kWord64);
+      }
+      case kExprI32x4Load16x4S: {
+        return DoSimdLoadExtend<int4, int32_t, int16_t>(
+            decoder, code, pc, len, MachineRepresentation::kWord64);
+      }
+      case kExprI32x4Load16x4U: {
+        return DoSimdLoadExtend<int4, uint32_t, uint16_t>(
+            decoder, code, pc, len, MachineRepresentation::kWord64);
+      }
+      case kExprI64x2Load32x2S: {
+        return DoSimdLoadExtend<int2, int64_t, int32_t>(
+            decoder, code, pc, len, MachineRepresentation::kWord64);
+      }
+      case kExprI64x2Load32x2U: {
+        return DoSimdLoadExtend<int2, uint64_t, uint32_t>(
+            decoder, code, pc, len, MachineRepresentation::kWord64);
+      }
       default:
         return false;
     }
   }
 
+  template <typename s_type, typename result_type, typename load_type>
+  bool DoSimdLoadSplat(Decoder* decoder, InterpreterCode* code, pc_t pc,
+                       int* const len, MachineRepresentation rep) {
+    if (!ExecuteLoad<result_type, load_type>(decoder, code, pc, len, rep,
+                                             /*prefix_len=*/1)) {
+      return false;
+    }
+    result_type v = Pop().to<result_type>();
+    s_type s;
+    for (size_t i = 0; i < arraysize(s.val); i++) s.val[i] = v;
+    Push(WasmValue(Simd128(s)));
+    return true;
+  }
+
+  template <typename s_type, typename wide_type, typename narrow_type>
+  bool DoSimdLoadExtend(Decoder* decoder, InterpreterCode* code, pc_t pc,
+                        int* const len, MachineRepresentation rep) {
+    static_assert(sizeof(wide_type) == sizeof(narrow_type) * 2,
+                  "size mismatch for wide and narrow types");
+    if (!ExecuteLoad<uint64_t, uint64_t>(decoder, code, pc, len, rep,
+                                         /*prefix_len=*/1)) {
+      return false;
+    }
+    constexpr int lanes = kSimd128Size / sizeof(wide_type);
+    uint64_t v = Pop().to_u64();
+    s_type s;
+    for (int i = 0; i < lanes; i++) {
+      uint8_t shift = i * (sizeof(narrow_type) * 8);
+      narrow_type el = static_cast<narrow_type>(v >> shift);
+      s.val[i] = static_cast<wide_type>(el);
+    }
+    Push(WasmValue(Simd128(s)));
+    return true;
+  }
+
   // Check if our control stack (frames_) exceeds the limit. Trigger stack
   // overflow if it does, and unwinding the current frame.
   // Returns true if execution can continue, false if the current activation was
@@ -2795,8 +2858,10 @@ class ThreadImpl {
         }
         case kWasmAnyRef:
         case kWasmFuncRef:
+        case kWasmNullRef:
         case kWasmExnRef: {
           Handle<Object> anyref = value.to_anyref();
+          DCHECK_IMPLIES(sig->GetParam(i) == kWasmNullRef, anyref->IsNull());
           encoded_values->set(encoded_index++, *anyref);
           break;
         }
@@ -2897,8 +2962,10 @@ class ThreadImpl {
         }
         case kWasmAnyRef:
         case kWasmFuncRef:
+        case kWasmNullRef:
         case kWasmExnRef: {
           Handle<Object> anyref(encoded_values->get(encoded_index++), isolate_);
+          DCHECK_IMPLIES(sig->GetParam(i) == kWasmNullRef, anyref->IsNull());
           value = WasmValue(anyref);
           break;
         }
@@ -2989,13 +3056,13 @@ class ThreadImpl {
         case kExprBlock:
         case kExprLoop:
         case kExprTry: {
-          BlockTypeImmediate<Decoder::kNoValidate> imm(kAllWasmFeatures,
+          BlockTypeImmediate<Decoder::kNoValidate> imm(WasmFeatures::All(),
                                                        &decoder, code->at(pc));
           len = 1 + imm.length;
           break;
         }
         case kExprIf: {
-          BlockTypeImmediate<Decoder::kNoValidate> imm(kAllWasmFeatures,
+          BlockTypeImmediate<Decoder::kNoValidate> imm(WasmFeatures::All(),
                                                        &decoder, code->at(pc));
           WasmValue cond = Pop();
           bool is_true = cond.to<uint32_t>() != 0;
@@ -3056,6 +3123,7 @@ class ThreadImpl {
           V8_FALLTHROUGH;
         }
         case kExprSelect: {
+          HandleScope scope(isolate_);  // Avoid leaking handles.
           WasmValue cond = Pop();
           WasmValue fval = Pop();
           WasmValue tval = Pop();
@@ -3216,7 +3284,7 @@ class ThreadImpl {
 
         case kExprCallIndirect: {
           CallIndirectImmediate<Decoder::kNoValidate> imm(
-              kAllWasmFeatures, &decoder, code->at(pc));
+              WasmFeatures::All(), &decoder, code->at(pc));
           uint32_t entry_index = Pop().to<uint32_t>();
           CommitPc(pc);  // TODO(wasm): Be more disciplined about committing PC.
           ExternalCallResult result =
@@ -3286,7 +3354,7 @@ class ThreadImpl {
 
         case kExprReturnCallIndirect: {
           CallIndirectImmediate<Decoder::kNoValidate> imm(
-              kAllWasmFeatures, &decoder, code->at(pc));
+              WasmFeatures::All(), &decoder, code->at(pc));
           uint32_t entry_index = Pop().to<uint32_t>();
           CommitPc(pc);  // TODO(wasm): Be more disciplined about committing PC.
 
@@ -3331,32 +3399,39 @@ class ThreadImpl {
           GlobalIndexImmediate<Decoder::kNoValidate> imm(&decoder,
                                                          code->at(pc));
           HandleScope handle_scope(isolate_);
-          Push(GetGlobalValue(imm.index));
+          Push(WasmInstanceObject::GetGlobalValue(
+              instance_object_, module()->globals[imm.index]));
           len = 1 + imm.length;
           break;
         }
         case kExprGlobalSet: {
           GlobalIndexImmediate<Decoder::kNoValidate> imm(&decoder,
                                                          code->at(pc));
-          const WasmGlobal* global = &module()->globals[imm.index];
-          switch (global->type) {
-#define CASE_TYPE(wasm, ctype)                                    \
-  case kWasm##wasm: {                                             \
-    byte* ptr = GetGlobalPtr(global);                             \
-    WriteLittleEndianValue<ctype>(reinterpret_cast<Address>(ptr), \
-                                  Pop().to<ctype>());             \
-    break;                                                        \
-  }
-            WASM_CTYPES(CASE_TYPE)
+          auto& global = module()->globals[imm.index];
+          switch (global.type) {
+#define CASE_TYPE(valuetype, ctype)                                     \
+  case valuetype: {                                                     \
+    uint8_t* ptr =                                                      \
+        WasmInstanceObject::GetGlobalStorage(instance_object_, global); \
+    WriteLittleEndianValue<ctype>(reinterpret_cast<Address>(ptr),       \
+                                  Pop().to<ctype>());                   \
+    break;                                                              \
+  }
+            FOREACH_WASMVALUE_CTYPES(CASE_TYPE)
 #undef CASE_TYPE
             case kWasmAnyRef:
             case kWasmFuncRef:
+            case kWasmNullRef:
             case kWasmExnRef: {
               HandleScope handle_scope(isolate_);  // Avoid leaking handles.
               Handle<FixedArray> global_buffer;    // The buffer of the global.
-              uint32_t global_index = 0;           // The index into the buffer.
-              GetGlobalBufferAndIndex(global, &global_buffer, &global_index);
-              global_buffer->set(global_index, *Pop().to_anyref());
+              uint32_t global_index;               // The index into the buffer.
+              std::tie(global_buffer, global_index) =
+                  WasmInstanceObject::GetGlobalBufferAndIndex(instance_object_,
+                                                              global);
+              Handle<Object> ref = Pop().to_anyref();
+              DCHECK_IMPLIES(global.type == kWasmNullRef, ref->IsNull());
+              global_buffer->set(global_index, *ref);
               break;
             }
             default:
@@ -3777,7 +3852,7 @@ class ThreadImpl {
                                               const WasmCode* code,
                                               FunctionSig* sig) {
     int num_args = static_cast<int>(sig->parameter_count());
-    WasmFeatures enabled_features = WasmFeaturesFromIsolate(isolate);
+    WasmFeatures enabled_features = WasmFeatures::FromIsolate(isolate);
 
     if (code->kind() == WasmCode::kWasmToJsWrapper &&
         !IsJSCompatibleSignature(sig, enabled_features)) {
@@ -3812,7 +3887,10 @@ class ThreadImpl {
           break;
         case kWasmAnyRef:
         case kWasmFuncRef:
+        case kWasmNullRef:
         case kWasmExnRef:
+          DCHECK_IMPLIES(sig->GetParam(i) == kWasmNullRef,
+                         arg.to_anyref()->IsNull());
           packer.Push(arg.to_anyref()->ptr());
           break;
         default:
@@ -3851,8 +3929,10 @@ class ThreadImpl {
           break;
         case kWasmAnyRef:
         case kWasmFuncRef:
+        case kWasmNullRef:
         case kWasmExnRef: {
           Handle<Object> ref(Object(packer.Pop<Address>()), isolate);
+          DCHECK_IMPLIES(sig->GetReturn(i) == kWasmNullRef, ref->IsNull());
           Push(WasmValue(ref));
           break;
         }
@@ -4086,12 +4166,6 @@ WasmValue WasmInterpreter::Thread::GetReturnValue(int index) {
 TrapReason WasmInterpreter::Thread::GetTrapReason() {
   return ToImpl(this)->GetTrapReason();
 }
-uint32_t WasmInterpreter::Thread::GetGlobalCount() {
-  return ToImpl(this)->GetGlobalCount();
-}
-WasmValue WasmInterpreter::Thread::GetGlobalValue(uint32_t index) {
-  return ToImpl(this)->GetGlobalValue(index);
-}
 bool WasmInterpreter::Thread::PossibleNondeterminism() {
   return ToImpl(this)->PossibleNondeterminism();
 }
@@ -4179,6 +4253,13 @@ void WasmInterpreter::Run() { internals_->threads_[0].Run(); }
 
 void WasmInterpreter::Pause() { internals_->threads_[0].Pause(); }
 
+void WasmInterpreter::PrepareStepIn(const WasmFunction* function) {
+  // Set a breakpoint at the start of function.
+  InterpreterCode* code = internals_->codemap_.GetCode(function);
+  pc_t pc = code->locals.encoded_size;
+  SetBreakpoint(function, pc, true);
+}
+
 bool WasmInterpreter::SetBreakpoint(const WasmFunction* function, pc_t pc,
                                     bool enabled) {
   InterpreterCode* code = internals_->codemap_.GetCode(function);
@@ -4276,7 +4357,6 @@ void InterpretedFrameDeleter::operator()(InterpretedFrame* ptr) {
 #undef TRACE
 #undef LANE
 #undef FOREACH_INTERNAL_OPCODE
-#undef WASM_CTYPES
 #undef FOREACH_SIMPLE_BINOP
 #undef FOREACH_OTHER_BINOP
 #undef FOREACH_I32CONV_FLOATOP
diff --git a/deps/v8/src/wasm/wasm-interpreter.h b/deps/v8/src/wasm/wasm-interpreter.h
index e0a32c71d65dcb..5a154be69829a9 100644
--- a/deps/v8/src/wasm/wasm-interpreter.h
+++ b/deps/v8/src/wasm/wasm-interpreter.h
@@ -133,16 +133,12 @@ class V8_EXPORT_PRIVATE WasmInterpreter {
 
     // Stack inspection and modification.
     pc_t GetBreakpointPc();
-    // TODO(clemensb): Make this uint32_t.
     int GetFrameCount();
     // The InterpretedFrame is only valid as long as the Thread is paused.
     FramePtr GetFrame(int index);
     WasmValue GetReturnValue(int index = 0);
     TrapReason GetTrapReason();
 
-    uint32_t GetGlobalCount();
-    WasmValue GetGlobalValue(uint32_t index);
-
     // Returns true if the thread executed an instruction which may produce
     // nondeterministic results, e.g. float div, float sqrt, and float mul,
     // where the sign bit of a NaN is nondeterministic.
@@ -184,6 +180,9 @@ class V8_EXPORT_PRIVATE WasmInterpreter {
   void Run();
   void Pause();
 
+  // Prepare {function} for stepping in from Javascript.
+  void PrepareStepIn(const WasmFunction* function);
+
   // Set a breakpoint at {pc} in {function} to be {enabled}. Returns the
   // previous state of the breakpoint at {pc}.
   bool SetBreakpoint(const WasmFunction* function, pc_t pc, bool enabled);
diff --git a/deps/v8/src/wasm/wasm-js.cc b/deps/v8/src/wasm/wasm-js.cc
index 80d2fcb0590328..cb1f24734fa833 100644
--- a/deps/v8/src/wasm/wasm-js.cc
+++ b/deps/v8/src/wasm/wasm-js.cc
@@ -40,7 +40,7 @@ class WasmStreaming::WasmStreamingImpl {
       std::shared_ptr<internal::wasm::CompilationResultResolver> resolver)
       : isolate_(isolate), resolver_(std::move(resolver)) {
     i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate_);
-    auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
+    auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
     streaming_decoder_ = i_isolate->wasm_engine()->StartStreamingCompilation(
         i_isolate, enabled_features, handle(i_isolate->context(), i_isolate),
         api_method_name, resolver_);
@@ -70,23 +70,16 @@ class WasmStreaming::WasmStreamingImpl {
   }
 
   void SetClient(std::shared_ptr<Client> client) {
-    // There are no other event notifications so just pass client to decoder.
-    // Wrap the client with a callback to trigger the callback in a new
-    // foreground task.
-    i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate_);
-    v8::Platform* platform = i::V8::GetCurrentPlatform();
-    std::shared_ptr<TaskRunner> foreground_task_runner =
-        platform->GetForegroundTaskRunner(isolate_);
     streaming_decoder_->SetModuleCompiledCallback(
-        [client, i_isolate, foreground_task_runner](
-            const std::shared_ptr<i::wasm::NativeModule>& native_module) {
-          foreground_task_runner->PostTask(
-              i::MakeCancelableTask(i_isolate, [client, native_module] {
-                client->OnModuleCompiled(Utils::Convert(native_module));
-              }));
+        [client](const std::shared_ptr<i::wasm::NativeModule>& native_module) {
+          client->OnModuleCompiled(Utils::Convert(native_module));
         });
   }
 
+  void SetUrl(internal::Vector<const char> url) {
+    streaming_decoder_->SetUrl(url);
+  }
+
  private:
   Isolate* const isolate_;
   std::shared_ptr<internal::wasm::StreamingDecoder> streaming_decoder_;
@@ -118,6 +111,10 @@ void WasmStreaming::SetClient(std::shared_ptr<Client> client) {
   impl_->SetClient(client);
 }
 
+void WasmStreaming::SetUrl(const char* url, size_t length) {
+  impl_->SetUrl(internal::VectorOf(url, length));
+}
+
 // static
 std::shared_ptr<WasmStreaming> WasmStreaming::Unpack(Isolate* isolate,
                                                      Local<Value> value) {
@@ -529,7 +526,7 @@ void WebAssemblyCompile(const v8::FunctionCallbackInfo<v8::Value>& args) {
     return;
   }
   // Asynchronous compilation handles copying wire bytes if necessary.
-  auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
   i_isolate->wasm_engine()->AsyncCompile(i_isolate, enabled_features,
                                          std::move(resolver), bytes, is_shared,
                                          kAPIMethodName);
@@ -565,7 +562,8 @@ void WasmStreamingPromiseFailedCallback(
   streaming->Abort(args[0]);
 }
 
-// WebAssembly.compileStreaming(Promise<Response>) -> Promise
+// WebAssembly.compileStreaming(Response | Promise<Response>)
+//   -> Promise<WebAssembly.Module>
 void WebAssemblyCompileStreaming(
     const v8::FunctionCallbackInfo<v8::Value>& args) {
   v8::Isolate* isolate = args.GetIsolate();
@@ -643,7 +641,7 @@ void WebAssemblyValidate(const v8::FunctionCallbackInfo<v8::Value>& args) {
     return;
   }
 
-  auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
   bool validated = false;
   if (is_shared) {
     // Make a copy of the wire bytes to avoid concurrent modification.
@@ -686,7 +684,7 @@ void WebAssemblyModule(const v8::FunctionCallbackInfo<v8::Value>& args) {
   if (thrower.error()) {
     return;
   }
-  auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
   i::MaybeHandle<i::Object> module_obj;
   if (is_shared) {
     // Make a copy of the wire bytes to avoid concurrent modification.
@@ -822,6 +820,9 @@ void WebAssemblyInstance(const v8::FunctionCallbackInfo<v8::Value>& args) {
   }
 }
 
+// WebAssembly.instantiateStreaming(Response | Promise<Response> [, imports])
+//   -> Promise<ResultObject>
+// (where ResultObject has a "module" and an "instance" field)
 void WebAssemblyInstantiateStreaming(
     const v8::FunctionCallbackInfo<v8::Value>& args) {
   v8::Isolate* isolate = args.GetIsolate();
@@ -980,7 +981,7 @@ void WebAssemblyInstantiate(const v8::FunctionCallbackInfo<v8::Value>& args) {
   }
 
   // Asynchronous compilation handles copying wire bytes if necessary.
-  auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
   i_isolate->wasm_engine()->AsyncCompile(i_isolate, enabled_features,
                                          std::move(compilation_resolver), bytes,
                                          is_shared, kAPIMethodName);
@@ -1050,8 +1051,8 @@ bool GetInitialOrMinimumProperty(v8::Isolate* isolate, ErrorThrower* thrower,
                                   result, lower_bound, upper_bound)) {
     return false;
   }
-  auto enabled_features = i::wasm::WasmFeaturesFromFlags();
-  if (!has_initial && enabled_features.type_reflection) {
+  auto enabled_features = i::wasm::WasmFeatures::FromFlags();
+  if (!has_initial && enabled_features.has_type_reflection()) {
     if (!GetOptionalIntegerProperty(isolate, thrower, context, object,
                                     v8_str(isolate, "minimum"), &has_initial,
                                     result, lower_bound, upper_bound)) {
@@ -1091,12 +1092,15 @@ void WebAssemblyTable(const v8::FunctionCallbackInfo<v8::Value>& args) {
     if (!maybe.ToLocal(&value)) return;
     v8::Local<v8::String> string;
     if (!value->ToString(context).ToLocal(&string)) return;
-    auto enabled_features = i::wasm::WasmFeaturesFromFlags();
+    auto enabled_features = i::wasm::WasmFeatures::FromFlags();
     if (string->StringEquals(v8_str(isolate, "anyfunc"))) {
       type = i::wasm::kWasmFuncRef;
-    } else if (enabled_features.anyref &&
+    } else if (enabled_features.has_anyref() &&
                string->StringEquals(v8_str(isolate, "anyref"))) {
       type = i::wasm::kWasmAnyRef;
+    } else if (enabled_features.has_anyref() &&
+               string->StringEquals(v8_str(isolate, "nullref"))) {
+      type = i::wasm::kWasmNullRef;
     } else {
       thrower.TypeError("Descriptor property 'element' must be 'anyfunc'");
       return;
@@ -1156,8 +1160,8 @@ void WebAssemblyMemory(const v8::FunctionCallbackInfo<v8::Value>& args) {
   }
 
   auto shared = i::SharedFlag::kNotShared;
-  auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
-  if (enabled_features.threads) {
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
+  if (enabled_features.has_threads()) {
     // Shared property of descriptor
     Local<String> shared_key = v8_str(isolate, "shared");
     v8::MaybeLocal<v8::Value> maybe_value =
@@ -1166,7 +1170,11 @@ void WebAssemblyMemory(const v8::FunctionCallbackInfo<v8::Value>& args) {
     if (maybe_value.ToLocal(&value)) {
       shared = value->BooleanValue(isolate) ? i::SharedFlag::kShared
                                             : i::SharedFlag::kNotShared;
+    } else {
+      DCHECK(i_isolate->has_scheduled_exception());
+      return;
     }
+
     // Throw TypeError if shared is true, and the descriptor has no "maximum"
     if (shared == i::SharedFlag::kShared && maximum == -1) {
       thrower.TypeError(
@@ -1216,13 +1224,16 @@ bool GetValueType(Isolate* isolate, MaybeLocal<Value> maybe,
     *type = i::wasm::kWasmI64;
   } else if (string->StringEquals(v8_str(isolate, "f64"))) {
     *type = i::wasm::kWasmF64;
-  } else if (enabled_features.anyref &&
+  } else if (enabled_features.has_anyref() &&
              string->StringEquals(v8_str(isolate, "anyref"))) {
     *type = i::wasm::kWasmAnyRef;
-  } else if (enabled_features.anyref &&
+  } else if (enabled_features.has_anyref() &&
              string->StringEquals(v8_str(isolate, "anyfunc"))) {
     *type = i::wasm::kWasmFuncRef;
-  } else if (enabled_features.eh &&
+  } else if (enabled_features.has_anyref() &&
+             string->StringEquals(v8_str(isolate, "nullref"))) {
+    *type = i::wasm::kWasmNullRef;
+  } else if (enabled_features.has_eh() &&
              string->StringEquals(v8_str(isolate, "exnref"))) {
     *type = i::wasm::kWasmExnRef;
   } else {
@@ -1248,7 +1259,7 @@ void WebAssemblyGlobal(const v8::FunctionCallbackInfo<v8::Value>& args) {
   }
   Local<Context> context = isolate->GetCurrentContext();
   Local<v8::Object> descriptor = Local<Object>::Cast(args[0]);
-  auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
 
   // The descriptor's 'mutable'.
   bool is_mutable = false;
@@ -1258,6 +1269,9 @@ void WebAssemblyGlobal(const v8::FunctionCallbackInfo<v8::Value>& args) {
     v8::Local<v8::Value> value;
     if (maybe.ToLocal(&value)) {
       is_mutable = value->BooleanValue(isolate);
+    } else {
+      DCHECK(i_isolate->has_scheduled_exception());
+      return;
     }
   }
 
@@ -1305,7 +1319,7 @@ void WebAssemblyGlobal(const v8::FunctionCallbackInfo<v8::Value>& args) {
     case i::wasm::kWasmI64: {
       int64_t i64_value = 0;
       if (!value->IsUndefined()) {
-        if (!enabled_features.bigint) {
+        if (!enabled_features.has_bigint()) {
           thrower.TypeError("Can't set the value of i64 WebAssembly.Global");
           return;
         }
@@ -1342,7 +1356,7 @@ void WebAssemblyGlobal(const v8::FunctionCallbackInfo<v8::Value>& args) {
     case i::wasm::kWasmAnyRef:
     case i::wasm::kWasmExnRef: {
       if (args.Length() < 2) {
-        // When no inital value is provided, we have to use the WebAssembly
+        // When no initial value is provided, we have to use the WebAssembly
         // default value 'null', and not the JS default value 'undefined'.
         global_obj->SetAnyRef(i_isolate->factory()->null_value());
         break;
@@ -1350,9 +1364,20 @@ void WebAssemblyGlobal(const v8::FunctionCallbackInfo<v8::Value>& args) {
       global_obj->SetAnyRef(Utils::OpenHandle(*value));
       break;
     }
+    case i::wasm::kWasmNullRef:
+      if (args.Length() < 2) {
+        // When no initial value is provided, we have to use the WebAssembly
+        // default value 'null', and not the JS default value 'undefined'.
+        global_obj->SetNullRef(i_isolate->factory()->null_value());
+        break;
+      }
+      if (!global_obj->SetNullRef(Utils::OpenHandle(*value))) {
+        thrower.TypeError("The value of nullref globals must be null");
+      }
+      break;
     case i::wasm::kWasmFuncRef: {
       if (args.Length() < 2) {
-        // When no inital value is provided, we have to use the WebAssembly
+        // When no initial value is provided, we have to use the WebAssembly
         // default value 'null', and not the JS default value 'undefined'.
         global_obj->SetFuncRef(i_isolate, i_isolate->factory()->null_value());
         break;
@@ -1413,7 +1438,7 @@ void WebAssemblyFunction(const v8::FunctionCallbackInfo<v8::Value>& args) {
   }
   Local<Object> function_type = Local<Object>::Cast(args[0]);
   Local<Context> context = isolate->GetCurrentContext();
-  auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
 
   // Load the 'parameters' property of the function type.
   Local<String> parameters_key = v8_str(isolate, "parameters");
@@ -1452,7 +1477,7 @@ void WebAssemblyFunction(const v8::FunctionCallbackInfo<v8::Value>& args) {
     thrower.TypeError("Argument 0 contains results without 'length'");
     return;
   }
-  if (results_len > (enabled_features.mv
+  if (results_len > (enabled_features.has_mv()
                          ? i::wasm::kV8MaxWasmFunctionMultiReturns
                          : i::wasm::kV8MaxWasmFunctionReturns)) {
     thrower.TypeError("Argument 0 contains too many results");
@@ -1763,8 +1788,8 @@ void WebAssemblyGlobalGetValueCommon(
       return_value.Set(receiver->GetI32());
       break;
     case i::wasm::kWasmI64: {
-      auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
-      if (enabled_features.bigint) {
+      auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
+      if (enabled_features.has_bigint()) {
         Local<BigInt> value = BigInt::New(isolate, receiver->GetI64());
 
         return_value.Set(value);
@@ -1781,7 +1806,10 @@ void WebAssemblyGlobalGetValueCommon(
       break;
     case i::wasm::kWasmAnyRef:
     case i::wasm::kWasmFuncRef:
+    case i::wasm::kWasmNullRef:
     case i::wasm::kWasmExnRef:
+      DCHECK_IMPLIES(receiver->type() == i::wasm::kWasmNullRef,
+                     receiver->GetRef()->IsNull());
       return_value.Set(Utils::ToLocal(receiver->GetRef()));
       break;
     default:
@@ -1827,8 +1855,8 @@ void WebAssemblyGlobalSetValue(
       break;
     }
     case i::wasm::kWasmI64: {
-      auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
-      if (enabled_features.bigint) {
+      auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
+      if (enabled_features.has_bigint()) {
         v8::Local<v8::BigInt> bigint_value;
         if (!args[0]->ToBigInt(context).ToLocal(&bigint_value)) return;
         receiver->SetI64(bigint_value->Int64Value());
@@ -1854,6 +1882,11 @@ void WebAssemblyGlobalSetValue(
       receiver->SetAnyRef(Utils::OpenHandle(*args[0]));
       break;
     }
+    case i::wasm::kWasmNullRef:
+      if (!receiver->SetNullRef(Utils::OpenHandle(*args[0]))) {
+        thrower.TypeError("The value of nullref must be null");
+      }
+      break;
     case i::wasm::kWasmFuncRef: {
       if (!receiver->SetFuncRef(i_isolate, Utils::OpenHandle(*args[0]))) {
         thrower.TypeError(
@@ -1887,10 +1920,10 @@ void WebAssemblyGlobalType(const v8::FunctionCallbackInfo<v8::Value>& args) {
 // TODO(titzer): we use the API to create the function template because the
 // internal guts are too ugly to replicate here.
 static i::Handle<i::FunctionTemplateInfo> NewFunctionTemplate(
-    i::Isolate* i_isolate, FunctionCallback func) {
+    i::Isolate* i_isolate, FunctionCallback func, bool has_prototype) {
   Isolate* isolate = reinterpret_cast<Isolate*>(i_isolate);
   Local<FunctionTemplate> templ = FunctionTemplate::New(isolate, func);
-  templ->ReadOnlyPrototype();
+  has_prototype ? templ->ReadOnlyPrototype() : templ->RemovePrototype();
   return v8::Utils::OpenHandle(*templ);
 }
 
@@ -1904,8 +1937,9 @@ static i::Handle<i::ObjectTemplateInfo> NewObjectTemplate(
 namespace internal {
 
 Handle<JSFunction> CreateFunc(Isolate* isolate, Handle<String> name,
-                              FunctionCallback func) {
-  Handle<FunctionTemplateInfo> temp = NewFunctionTemplate(isolate, func);
+                              FunctionCallback func, bool has_prototype) {
+  Handle<FunctionTemplateInfo> temp =
+      NewFunctionTemplate(isolate, func, has_prototype);
   Handle<JSFunction> function =
       ApiNatives::InstantiateFunction(temp, name).ToHandleChecked();
   DCHECK(function->shared().HasSharedName());
@@ -1914,10 +1948,10 @@ Handle<JSFunction> CreateFunc(Isolate* isolate, Handle<String> name,
 
 Handle<JSFunction> InstallFunc(Isolate* isolate, Handle<JSObject> object,
                                const char* str, FunctionCallback func,
-                               int length = 0,
+                               int length, bool has_prototype = false,
                                PropertyAttributes attributes = NONE) {
   Handle<String> name = v8_str(isolate, str);
-  Handle<JSFunction> function = CreateFunc(isolate, name, func);
+  Handle<JSFunction> function = CreateFunc(isolate, name, func, has_prototype);
   function->shared().set_length(length);
   JSObject::AddProperty(isolate, object, name, function, attributes);
   return function;
@@ -1927,7 +1961,7 @@ Handle<JSFunction> InstallConstructorFunc(Isolate* isolate,
                                          Handle<JSObject> object,
                                          const char* str,
                                          FunctionCallback func) {
-  return InstallFunc(isolate, object, str, func, 1, DONT_ENUM);
+  return InstallFunc(isolate, object, str, func, 1, true, DONT_ENUM);
 }
 
 Handle<String> GetterName(Isolate* isolate, Handle<String> name) {
@@ -1939,7 +1973,7 @@ void InstallGetter(Isolate* isolate, Handle<JSObject> object, const char* str,
                    FunctionCallback func) {
   Handle<String> name = v8_str(isolate, str);
   Handle<JSFunction> function =
-      CreateFunc(isolate, GetterName(isolate, name), func);
+      CreateFunc(isolate, GetterName(isolate, name), func, false);
 
   Utils::ToLocal(object)->SetAccessorProperty(Utils::ToLocal(name),
                                               Utils::ToLocal(function),
@@ -1956,16 +1990,14 @@ void InstallGetterSetter(Isolate* isolate, Handle<JSObject> object,
                          FunctionCallback setter) {
   Handle<String> name = v8_str(isolate, str);
   Handle<JSFunction> getter_func =
-      CreateFunc(isolate, GetterName(isolate, name), getter);
+      CreateFunc(isolate, GetterName(isolate, name), getter, false);
   Handle<JSFunction> setter_func =
-      CreateFunc(isolate, SetterName(isolate, name), setter);
+      CreateFunc(isolate, SetterName(isolate, name), setter, false);
   setter_func->shared().set_length(1);
 
-  v8::PropertyAttribute attributes = v8::None;
-
   Utils::ToLocal(object)->SetAccessorProperty(
       Utils::ToLocal(name), Utils::ToLocal(getter_func),
-      Utils::ToLocal(setter_func), attributes);
+      Utils::ToLocal(setter_func), v8::None);
 }
 
 // Assigns a dummy instance template to the given constructor function. Used to
@@ -2034,7 +2066,7 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
   Handle<JSObject> module_proto(
       JSObject::cast(module_constructor->instance_prototype()), isolate);
   Handle<Map> module_map = isolate->factory()->NewMap(
-      i::WASM_MODULE_OBJECT_TYPE, WasmModuleObject::kSize);
+      i::WASM_MODULE_OBJECT_TYPE, WasmModuleObject::kHeaderSize);
   JSFunction::SetInitialMap(module_constructor, module_map, module_proto);
   InstallFunc(isolate, module_constructor, "imports", WebAssemblyModuleImports,
               1);
@@ -2054,7 +2086,7 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
   Handle<JSObject> instance_proto(
       JSObject::cast(instance_constructor->instance_prototype()), isolate);
   Handle<Map> instance_map = isolate->factory()->NewMap(
-      i::WASM_INSTANCE_OBJECT_TYPE, WasmInstanceObject::kSize);
+      i::WASM_INSTANCE_OBJECT_TYPE, WasmInstanceObject::kHeaderSize);
   JSFunction::SetInitialMap(instance_constructor, instance_map, instance_proto);
   InstallGetter(isolate, instance_proto, "exports",
                 WebAssemblyInstanceGetExports);
@@ -2063,8 +2095,9 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
                         v8_str(isolate, "WebAssembly.Instance"), ro_attributes);
 
   // The context is not set up completely yet. That's why we cannot use
-  // {WasmFeaturesFromIsolate} and have to use {WasmFeaturesFromFlags} instead.
-  auto enabled_features = i::wasm::WasmFeaturesFromFlags();
+  // {WasmFeatures::FromIsolate} and have to use {WasmFeatures::FromFlags}
+  // instead.
+  auto enabled_features = i::wasm::WasmFeatures::FromFlags();
 
   // Setup Table
   Handle<JSFunction> table_constructor =
@@ -2074,14 +2107,14 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
   JSFunction::EnsureHasInitialMap(table_constructor);
   Handle<JSObject> table_proto(
       JSObject::cast(table_constructor->instance_prototype()), isolate);
-  Handle<Map> table_map = isolate->factory()->NewMap(i::WASM_TABLE_OBJECT_TYPE,
-                                                     WasmTableObject::kSize);
+  Handle<Map> table_map = isolate->factory()->NewMap(
+      i::WASM_TABLE_OBJECT_TYPE, WasmTableObject::kHeaderSize);
   JSFunction::SetInitialMap(table_constructor, table_map, table_proto);
   InstallGetter(isolate, table_proto, "length", WebAssemblyTableGetLength);
   InstallFunc(isolate, table_proto, "grow", WebAssemblyTableGrow, 1);
   InstallFunc(isolate, table_proto, "get", WebAssemblyTableGet, 1);
   InstallFunc(isolate, table_proto, "set", WebAssemblyTableSet, 2);
-  if (enabled_features.type_reflection) {
+  if (enabled_features.has_type_reflection()) {
     InstallFunc(isolate, table_constructor, "type", WebAssemblyTableType, 1);
   }
   JSObject::AddProperty(isolate, table_proto, factory->to_string_tag_symbol(),
@@ -2096,11 +2129,11 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
   Handle<JSObject> memory_proto(
       JSObject::cast(memory_constructor->instance_prototype()), isolate);
   Handle<Map> memory_map = isolate->factory()->NewMap(
-      i::WASM_MEMORY_OBJECT_TYPE, WasmMemoryObject::kSize);
+      i::WASM_MEMORY_OBJECT_TYPE, WasmMemoryObject::kHeaderSize);
   JSFunction::SetInitialMap(memory_constructor, memory_map, memory_proto);
   InstallFunc(isolate, memory_proto, "grow", WebAssemblyMemoryGrow, 1);
   InstallGetter(isolate, memory_proto, "buffer", WebAssemblyMemoryGetBuffer);
-  if (enabled_features.type_reflection) {
+  if (enabled_features.has_type_reflection()) {
     InstallFunc(isolate, memory_constructor, "type", WebAssemblyMemoryType, 1);
   }
   JSObject::AddProperty(isolate, memory_proto, factory->to_string_tag_symbol(),
@@ -2115,19 +2148,19 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
   Handle<JSObject> global_proto(
       JSObject::cast(global_constructor->instance_prototype()), isolate);
   Handle<Map> global_map = isolate->factory()->NewMap(
-      i::WASM_GLOBAL_OBJECT_TYPE, WasmGlobalObject::kSize);
+      i::WASM_GLOBAL_OBJECT_TYPE, WasmGlobalObject::kHeaderSize);
   JSFunction::SetInitialMap(global_constructor, global_map, global_proto);
   InstallFunc(isolate, global_proto, "valueOf", WebAssemblyGlobalValueOf, 0);
   InstallGetterSetter(isolate, global_proto, "value", WebAssemblyGlobalGetValue,
                       WebAssemblyGlobalSetValue);
-  if (enabled_features.type_reflection) {
+  if (enabled_features.has_type_reflection()) {
     InstallFunc(isolate, global_constructor, "type", WebAssemblyGlobalType, 1);
   }
   JSObject::AddProperty(isolate, global_proto, factory->to_string_tag_symbol(),
                         v8_str(isolate, "WebAssembly.Global"), ro_attributes);
 
   // Setup Exception
-  if (enabled_features.eh) {
+  if (enabled_features.has_eh()) {
     Handle<JSFunction> exception_constructor = InstallConstructorFunc(
         isolate, webassembly, "Exception", WebAssemblyException);
     context->set_wasm_exception_constructor(*exception_constructor);
@@ -2136,13 +2169,13 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
     Handle<JSObject> exception_proto(
         JSObject::cast(exception_constructor->instance_prototype()), isolate);
     Handle<Map> exception_map = isolate->factory()->NewMap(
-        i::WASM_EXCEPTION_OBJECT_TYPE, WasmExceptionObject::kSize);
+        i::WASM_EXCEPTION_OBJECT_TYPE, WasmExceptionObject::kHeaderSize);
     JSFunction::SetInitialMap(exception_constructor, exception_map,
                               exception_proto);
   }
 
   // Setup Function
-  if (enabled_features.type_reflection) {
+  if (enabled_features.has_type_reflection()) {
     Handle<JSFunction> function_constructor = InstallConstructorFunc(
         isolate, webassembly, "Function", WebAssemblyFunction);
     SetDummyInstanceTemplate(isolate, function_constructor);
diff --git a/deps/v8/src/wasm/wasm-limits.h b/deps/v8/src/wasm/wasm-limits.h
index 6dc652aba2da8d..5206ad6212011d 100644
--- a/deps/v8/src/wasm/wasm-limits.h
+++ b/deps/v8/src/wasm/wasm-limits.h
@@ -28,7 +28,7 @@ constexpr size_t kV8MaxWasmExceptions = 1000000;
 constexpr size_t kV8MaxWasmExceptionTypes = 1000000;
 constexpr size_t kV8MaxWasmDataSegments = 100000;
 // Don't use this limit directly, but use the value of {max_mem_pages()}.
-constexpr size_t kV8MaxWasmMemoryPages = 32767;  // = ~ 2 GiB
+constexpr size_t kV8MaxWasmMemoryPages = 65536;  // = 4 GiB
 constexpr size_t kV8MaxWasmStringSize = 100000;
 constexpr size_t kV8MaxWasmModuleSize = 1024 * 1024 * 1024;  // = 1 GiB
 constexpr size_t kV8MaxWasmFunctionSize = 7654321;
@@ -58,7 +58,7 @@ constexpr uint64_t kWasmMaxHeapOffset =
 // Defined in wasm-engine.cc.
 // TODO(wasm): Make this size_t for wasm64. Currently the --wasm-max-mem-pages
 // flag is only uint32_t.
-uint32_t max_mem_pages();
+V8_EXPORT_PRIVATE uint32_t max_mem_pages();
 uint32_t max_table_init_entries();
 
 inline uint64_t max_mem_bytes() {
diff --git a/deps/v8/src/wasm/wasm-module-builder.cc b/deps/v8/src/wasm/wasm-module-builder.cc
index 0bbc104070d5b0..c8a65ba6a2407a 100644
--- a/deps/v8/src/wasm/wasm-module-builder.cc
+++ b/deps/v8/src/wasm/wasm-module-builder.cc
@@ -88,6 +88,12 @@ void WasmFunctionBuilder::EmitCode(const byte* code, uint32_t code_size) {
 
 void WasmFunctionBuilder::Emit(WasmOpcode opcode) { body_.write_u8(opcode); }
 
+void WasmFunctionBuilder::EmitWithPrefix(WasmOpcode opcode) {
+  DCHECK_NE(0, opcode & 0xff00);
+  body_.write_u8(opcode >> 8);
+  body_.write_u8(opcode);
+}
+
 void WasmFunctionBuilder::EmitWithU8(WasmOpcode opcode, const byte immediate) {
   body_.write_u8(opcode);
   body_.write_u8(immediate);
@@ -705,8 +711,6 @@ void WasmModuleBuilder::WriteAsmJsOffsetTable(ZoneBuffer* buffer) const {
   for (auto* function : functions_) {
     function->WriteAsmWasmOffsetTable(buffer);
   }
-  // Append a 0 to indicate that this is an encoded table.
-  buffer->write_u8(0);
 }
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/src/wasm/wasm-module-builder.h b/deps/v8/src/wasm/wasm-module-builder.h
index 4c122b806235bd..93ee913badd7e5 100644
--- a/deps/v8/src/wasm/wasm-module-builder.h
+++ b/deps/v8/src/wasm/wasm-module-builder.h
@@ -122,6 +122,7 @@ class ZoneBuffer : public ZoneObject {
 
   size_t offset() const { return static_cast<size_t>(pos_ - buffer_); }
   size_t size() const { return static_cast<size_t>(pos_ - buffer_); }
+  const byte* data() const { return buffer_; }
   const byte* begin() const { return buffer_; }
   const byte* end() const { return pos_; }
 
@@ -162,6 +163,7 @@ class V8_EXPORT_PRIVATE WasmFunctionBuilder : public ZoneObject {
   void EmitU32V(uint32_t val);
   void EmitCode(const byte* code, uint32_t code_size);
   void Emit(WasmOpcode opcode);
+  void EmitWithPrefix(WasmOpcode opcode);
   void EmitGetLocal(uint32_t index);
   void EmitSetLocal(uint32_t index);
   void EmitTeeLocal(uint32_t index);
diff --git a/deps/v8/src/wasm/wasm-module.cc b/deps/v8/src/wasm/wasm-module.cc
index 033f12ae24154a..0f7a9e0417a91e 100644
--- a/deps/v8/src/wasm/wasm-module.cc
+++ b/deps/v8/src/wasm/wasm-module.cc
@@ -22,7 +22,6 @@
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-objects-inl.h"
 #include "src/wasm/wasm-result.h"
-#include "src/wasm/wasm-text.h"
 
 namespace v8 {
 namespace internal {
@@ -31,15 +30,16 @@ namespace wasm {
 // static
 const uint32_t WasmElemSegment::kNullIndex;
 
-WireBytesRef WasmModule::LookupFunctionName(const ModuleWireBytes& wire_bytes,
-                                            uint32_t function_index) const {
-  if (!function_names) {
-    function_names.reset(new std::unordered_map<uint32_t, WireBytesRef>());
+WireBytesRef DecodedFunctionNames::Lookup(const ModuleWireBytes& wire_bytes,
+                                          uint32_t function_index) const {
+  base::MutexGuard lock(&mutex_);
+  if (!function_names_) {
+    function_names_.reset(new std::unordered_map<uint32_t, WireBytesRef>());
     DecodeFunctionNames(wire_bytes.start(), wire_bytes.end(),
-                        function_names.get());
+                        function_names_.get());
   }
-  auto it = function_names->find(function_index);
-  if (it == function_names->end()) return WireBytesRef();
+  auto it = function_names_->find(function_index);
+  if (it == function_names_->end()) return WireBytesRef();
   return it->second;
 }
 
@@ -68,13 +68,13 @@ int GetWasmFunctionOffset(const WasmModule* module, uint32_t func_index) {
 }
 
 // static
-int GetContainingWasmFunction(const WasmModule* module, uint32_t byte_offset) {
+int GetNearestWasmFunction(const WasmModule* module, uint32_t byte_offset) {
   const std::vector<WasmFunction>& functions = module->functions;
 
   // Binary search for a function containing the given position.
   int left = 0;                                    // inclusive
   int right = static_cast<int>(functions.size());  // exclusive
-  if (right == 0) return false;
+  if (right == 0) return -1;
   while (right - left > 1) {
     int mid = left + (right - left) / 2;
     if (functions[mid].code.offset() <= byte_offset) {
@@ -83,45 +83,92 @@ int GetContainingWasmFunction(const WasmModule* module, uint32_t byte_offset) {
       right = mid;
     }
   }
-  // If the found function does not contains the given position, return -1.
-  const WasmFunction& func = functions[left];
-  if (byte_offset < func.code.offset() ||
-      byte_offset >= func.code.end_offset()) {
-    return -1;
-  }
 
   return left;
 }
 
 // static
-v8::debug::WasmDisassembly DisassembleWasmFunction(
-    const WasmModule* module, const ModuleWireBytes& wire_bytes,
-    int func_index) {
-  if (func_index < 0 ||
-      static_cast<uint32_t>(func_index) >= module->functions.size())
-    return {};
+int GetContainingWasmFunction(const WasmModule* module, uint32_t byte_offset) {
+  int func_index = GetNearestWasmFunction(module, byte_offset);
+
+  if (func_index >= 0) {
+    // If the found function does not contain the given position, return -1.
+    const WasmFunction& func = module->functions[func_index];
+    if (byte_offset < func.code.offset() ||
+        byte_offset >= func.code.end_offset()) {
+      return -1;
+    }
+  }
+  return func_index;
+}
 
-  std::ostringstream disassembly_os;
-  v8::debug::WasmDisassembly::OffsetTable offset_table;
+void DecodedFunctionNames::AddForTesting(int function_index,
+                                         WireBytesRef name) {
+  base::MutexGuard lock(&mutex_);
+  if (!function_names_) {
+    function_names_.reset(new std::unordered_map<uint32_t, WireBytesRef>());
+  }
+  function_names_->insert(std::make_pair(function_index, name));
+}
+
+AsmJsOffsetInformation::AsmJsOffsetInformation(
+    Vector<const byte> encoded_offsets)
+    : encoded_offsets_(OwnedVector<const uint8_t>::Of(encoded_offsets)) {}
+
+AsmJsOffsetInformation::~AsmJsOffsetInformation() = default;
+
+int AsmJsOffsetInformation::GetSourcePosition(int declared_func_index,
+                                              int byte_offset,
+                                              bool is_at_number_conversion) {
+  EnsureDecodedOffsets();
+
+  DCHECK_LE(0, declared_func_index);
+  DCHECK_GT(decoded_offsets_->functions.size(), declared_func_index);
+  std::vector<AsmJsOffsetEntry>& function_offsets =
+      decoded_offsets_->functions[declared_func_index].entries;
+
+  auto byte_offset_less = [](const AsmJsOffsetEntry& a,
+                             const AsmJsOffsetEntry& b) {
+    return a.byte_offset < b.byte_offset;
+  };
+  SLOW_DCHECK(std::is_sorted(function_offsets.begin(), function_offsets.end(),
+                             byte_offset_less));
+  auto it =
+      std::lower_bound(function_offsets.begin(), function_offsets.end(),
+                       AsmJsOffsetEntry{byte_offset, 0, 0}, byte_offset_less);
+  DCHECK_NE(function_offsets.end(), it);
+  DCHECK_EQ(byte_offset, it->byte_offset);
+  return is_at_number_conversion ? it->source_position_number_conversion
+                                 : it->source_position_call;
+}
+
+std::pair<int, int> AsmJsOffsetInformation::GetFunctionOffsets(
+    int declared_func_index) {
+  EnsureDecodedOffsets();
 
-  PrintWasmText(module, wire_bytes, static_cast<uint32_t>(func_index),
-                disassembly_os, &offset_table);
+  DCHECK_LE(0, declared_func_index);
+  DCHECK_GT(decoded_offsets_->functions.size(), declared_func_index);
+  AsmJsOffsetFunctionEntries& function_info =
+      decoded_offsets_->functions[declared_func_index];
 
-  return {disassembly_os.str(), std::move(offset_table)};
+  return {function_info.start_offset, function_info.end_offset};
 }
 
-void WasmModule::AddFunctionNameForTesting(int function_index,
-                                           WireBytesRef name) {
-  if (!function_names) {
-    function_names.reset(new std::unordered_map<uint32_t, WireBytesRef>());
-  }
-  function_names->insert(std::make_pair(function_index, name));
+void AsmJsOffsetInformation::EnsureDecodedOffsets() {
+  base::MutexGuard mutex_guard(&mutex_);
+  DCHECK_EQ(encoded_offsets_ == nullptr, decoded_offsets_ != nullptr);
+
+  if (decoded_offsets_) return;
+  AsmJsOffsetsResult result =
+      wasm::DecodeAsmJsOffsets(encoded_offsets_.as_vector());
+  decoded_offsets_ = std::make_unique<AsmJsOffsets>(std::move(result).value());
+  encoded_offsets_.ReleaseData();
 }
 
 // Get a string stored in the module bytes representing a name.
 WasmName ModuleWireBytes::GetNameOrNull(WireBytesRef ref) const {
   if (!ref.is_set()) return {nullptr, 0};  // no name.
-  CHECK(BoundsCheck(ref.offset(), ref.length()));
+  DCHECK(BoundsCheck(ref));
   return WasmName::cast(
       module_bytes_.SubVector(ref.offset(), ref.end_offset()));
 }
@@ -129,7 +176,8 @@ WasmName ModuleWireBytes::GetNameOrNull(WireBytesRef ref) const {
 // Get a string stored in the module bytes representing a function name.
 WasmName ModuleWireBytes::GetNameOrNull(const WasmFunction* function,
                                         const WasmModule* module) const {
-  return GetNameOrNull(module->LookupFunctionName(*this, function->func_index));
+  return GetNameOrNull(
+      module->function_names.Lookup(*this, function->func_index));
 }
 
 std::ostream& operator<<(std::ostream& os, const WasmFunctionName& name) {
@@ -197,6 +245,10 @@ Handle<String> ToValueTypeString(Isolate* isolate, ValueType type) {
       string = factory->InternalizeUtf8String("anyfunc");
       break;
     }
+    case i::wasm::kWasmNullRef: {
+      string = factory->InternalizeUtf8String("nullref");
+      break;
+    }
     case i::wasm::kWasmExnRef: {
       string = factory->InternalizeUtf8String("exnref");
       break;
@@ -286,7 +338,8 @@ Handle<JSObject> GetTypeForTable(Isolate* isolate, ValueType type,
     // and then use that constant everywhere.
     element = factory->InternalizeUtf8String("anyfunc");
   } else {
-    DCHECK(WasmFeaturesFromFlags().anyref && type == ValueType::kWasmAnyRef);
+    DCHECK(WasmFeatures::FromFlags().has_anyref() &&
+           type == ValueType::kWasmAnyRef);
     element = factory->InternalizeUtf8String("anyref");
   }
 
@@ -308,7 +361,7 @@ Handle<JSObject> GetTypeForTable(Isolate* isolate, ValueType type,
 
 Handle<JSArray> GetImports(Isolate* isolate,
                            Handle<WasmModuleObject> module_object) {
-  auto enabled_features = i::wasm::WasmFeaturesFromIsolate(isolate);
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(isolate);
   Factory* factory = isolate->factory();
 
   Handle<String> module_string = factory->InternalizeUtf8String("module");
@@ -343,14 +396,14 @@ Handle<JSArray> GetImports(Isolate* isolate,
     Handle<JSObject> type_value;
     switch (import.kind) {
       case kExternalFunction:
-        if (enabled_features.type_reflection) {
+        if (enabled_features.has_type_reflection()) {
           auto& func = module->functions[import.index];
           type_value = GetTypeForFunction(isolate, func.sig);
         }
         import_kind = function_string;
         break;
       case kExternalTable:
-        if (enabled_features.type_reflection) {
+        if (enabled_features.has_type_reflection()) {
           auto& table = module->tables[import.index];
           base::Optional<uint32_t> maximum_size;
           if (table.has_maximum_size) maximum_size.emplace(table.maximum_size);
@@ -360,7 +413,7 @@ Handle<JSArray> GetImports(Isolate* isolate,
         import_kind = table_string;
         break;
       case kExternalMemory:
-        if (enabled_features.type_reflection) {
+        if (enabled_features.has_type_reflection()) {
           DCHECK_EQ(0, import.index);  // Only one memory supported.
           base::Optional<uint32_t> maximum_size;
           if (module->has_maximum_pages) {
@@ -372,7 +425,7 @@ Handle<JSArray> GetImports(Isolate* isolate,
         import_kind = memory_string;
         break;
       case kExternalGlobal:
-        if (enabled_features.type_reflection) {
+        if (enabled_features.has_type_reflection()) {
           auto& global = module->globals[import.index];
           type_value =
               GetTypeForGlobal(isolate, global.mutability, global.type);
@@ -386,18 +439,16 @@ Handle<JSArray> GetImports(Isolate* isolate,
         UNREACHABLE();
     }
 
-    MaybeHandle<String> import_module =
+    Handle<String> import_module =
         WasmModuleObject::ExtractUtf8StringFromModuleBytes(
-            isolate, module_object, import.module_name);
+            isolate, module_object, import.module_name, kInternalize);
 
-    MaybeHandle<String> import_name =
+    Handle<String> import_name =
         WasmModuleObject::ExtractUtf8StringFromModuleBytes(
-            isolate, module_object, import.field_name);
+            isolate, module_object, import.field_name, kInternalize);
 
-    JSObject::AddProperty(isolate, entry, module_string,
-                          import_module.ToHandleChecked(), NONE);
-    JSObject::AddProperty(isolate, entry, name_string,
-                          import_name.ToHandleChecked(), NONE);
+    JSObject::AddProperty(isolate, entry, module_string, import_module, NONE);
+    JSObject::AddProperty(isolate, entry, name_string, import_name, NONE);
     JSObject::AddProperty(isolate, entry, kind_string, import_kind, NONE);
     if (!type_value.is_null()) {
       JSObject::AddProperty(isolate, entry, type_string, type_value, NONE);
@@ -411,7 +462,7 @@ Handle<JSArray> GetImports(Isolate* isolate,
 
 Handle<JSArray> GetExports(Isolate* isolate,
                            Handle<WasmModuleObject> module_object) {
-  auto enabled_features = i::wasm::WasmFeaturesFromIsolate(isolate);
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(isolate);
   Factory* factory = isolate->factory();
 
   Handle<String> name_string = factory->InternalizeUtf8String("name");
@@ -443,14 +494,14 @@ Handle<JSArray> GetExports(Isolate* isolate,
     Handle<JSObject> type_value;
     switch (exp.kind) {
       case kExternalFunction:
-        if (enabled_features.type_reflection) {
+        if (enabled_features.has_type_reflection()) {
           auto& func = module->functions[exp.index];
           type_value = GetTypeForFunction(isolate, func.sig);
         }
         export_kind = function_string;
         break;
       case kExternalTable:
-        if (enabled_features.type_reflection) {
+        if (enabled_features.has_type_reflection()) {
           auto& table = module->tables[exp.index];
           base::Optional<uint32_t> maximum_size;
           if (table.has_maximum_size) maximum_size.emplace(table.maximum_size);
@@ -460,7 +511,7 @@ Handle<JSArray> GetExports(Isolate* isolate,
         export_kind = table_string;
         break;
       case kExternalMemory:
-        if (enabled_features.type_reflection) {
+        if (enabled_features.has_type_reflection()) {
           DCHECK_EQ(0, exp.index);  // Only one memory supported.
           base::Optional<uint32_t> maximum_size;
           if (module->has_maximum_pages) {
@@ -472,7 +523,7 @@ Handle<JSArray> GetExports(Isolate* isolate,
         export_kind = memory_string;
         break;
       case kExternalGlobal:
-        if (enabled_features.type_reflection) {
+        if (enabled_features.has_type_reflection()) {
           auto& global = module->globals[exp.index];
           type_value =
               GetTypeForGlobal(isolate, global.mutability, global.type);
@@ -488,12 +539,11 @@ Handle<JSArray> GetExports(Isolate* isolate,
 
     Handle<JSObject> entry = factory->NewJSObject(object_function);
 
-    MaybeHandle<String> export_name =
+    Handle<String> export_name =
         WasmModuleObject::ExtractUtf8StringFromModuleBytes(
-            isolate, module_object, exp.name);
+            isolate, module_object, exp.name, kNoInternalize);
 
-    JSObject::AddProperty(isolate, entry, name_string,
-                          export_name.ToHandleChecked(), NONE);
+    JSObject::AddProperty(isolate, entry, name_string, export_name, NONE);
     JSObject::AddProperty(isolate, entry, kind_string, export_kind, NONE);
     if (!type_value.is_null()) {
       JSObject::AddProperty(isolate, entry, type_string, type_value, NONE);
@@ -519,11 +569,11 @@ Handle<JSArray> GetCustomSections(Isolate* isolate,
 
   // Gather matching sections.
   for (auto& section : custom_sections) {
-    MaybeHandle<String> section_name =
+    Handle<String> section_name =
         WasmModuleObject::ExtractUtf8StringFromModuleBytes(
-            isolate, module_object, section.name);
+            isolate, module_object, section.name, kNoInternalize);
 
-    if (!name->Equals(*section_name.ToHandleChecked())) continue;
+    if (!name->Equals(*section_name)) continue;
 
     // Make a copy of the payload data in the section.
     size_t size = section.payload.length();
@@ -555,27 +605,22 @@ Handle<JSArray> GetCustomSections(Isolate* isolate,
   return array_object;
 }
 
-Handle<FixedArray> DecodeLocalNames(Isolate* isolate,
-                                    Handle<WasmModuleObject> module_object) {
-  Vector<const uint8_t> wire_bytes =
-      module_object->native_module()->wire_bytes();
-  LocalNames decoded_locals;
-  DecodeLocalNames(wire_bytes.begin(), wire_bytes.end(), &decoded_locals);
-  Handle<FixedArray> locals_names =
-      isolate->factory()->NewFixedArray(decoded_locals.max_function_index + 1);
-  for (LocalNamesPerFunction& func : decoded_locals.names) {
-    Handle<FixedArray> func_locals_names =
-        isolate->factory()->NewFixedArray(func.max_local_index + 1);
-    locals_names->set(func.function_index, *func_locals_names);
-    for (LocalName& name : func.names) {
-      Handle<String> name_str =
-          WasmModuleObject::ExtractUtf8StringFromModuleBytes(
-              isolate, module_object, name.name)
-              .ToHandleChecked();
-      func_locals_names->set(name.local_index, *name_str);
-    }
+// Get the source position from a given function index and byte offset,
+// for either asm.js or pure Wasm modules.
+int GetSourcePosition(const WasmModule* module, uint32_t func_index,
+                      uint32_t byte_offset, bool is_at_number_conversion) {
+  DCHECK_EQ(is_asmjs_module(module),
+            module->asm_js_offset_information != nullptr);
+  if (!is_asmjs_module(module)) {
+    // For non-asm.js modules, we just add the function's start offset
+    // to make a module-relative position.
+    return byte_offset + GetWasmFunctionOffset(module, func_index);
   }
-  return locals_names;
+
+  // asm.js modules have an additional offset table that must be searched.
+  return module->asm_js_offset_information->GetSourcePosition(
+      declared_function_index(module, func_index), byte_offset,
+      is_at_number_conversion);
 }
 
 namespace {
@@ -595,6 +640,26 @@ size_t EstimateStoredSize(const WasmModule* module) {
          VectorSize(module->export_table) + VectorSize(module->exceptions) +
          VectorSize(module->elem_segments);
 }
+
+size_t PrintSignature(Vector<char> buffer, wasm::FunctionSig* sig) {
+  if (buffer.empty()) return 0;
+  size_t old_size = buffer.size();
+  auto append_char = [&buffer](char c) {
+    if (buffer.size() == 1) return;  // Keep last character for '\0'.
+    buffer[0] = c;
+    buffer += 1;
+  };
+  for (wasm::ValueType t : sig->parameters()) {
+    append_char(wasm::ValueTypes::ShortNameOf(t));
+  }
+  append_char(':');
+  for (wasm::ValueType t : sig->returns()) {
+    append_char(wasm::ValueTypes::ShortNameOf(t));
+  }
+  buffer[0] = '\0';
+  return old_size - buffer.size();
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/wasm-module.h b/deps/v8/src/wasm/wasm-module.h
index 79c3b23a33298f..9fb67a7c16be52 100644
--- a/deps/v8/src/wasm/wasm-module.h
+++ b/deps/v8/src/wasm/wasm-module.h
@@ -17,10 +17,6 @@
 
 namespace v8 {
 
-namespace debug {
-struct WasmDisassembly;
-}
-
 namespace internal {
 
 class WasmModuleObject;
@@ -29,6 +25,7 @@ namespace wasm {
 
 using WasmName = Vector<const char>;
 
+struct AsmJsOffsets;
 class ErrorThrower;
 
 // Reference to a string in the wire bytes.
@@ -181,10 +178,50 @@ enum ModuleOrigin : uint8_t {
 
 struct ModuleWireBytes;
 
+class V8_EXPORT_PRIVATE DecodedFunctionNames {
+ public:
+  WireBytesRef Lookup(const ModuleWireBytes& wire_bytes,
+                      uint32_t function_index) const;
+  void AddForTesting(int function_index, WireBytesRef name);
+
+ private:
+  // {function_names_} is populated lazily after decoding, and therefore needs a
+  // mutex to protect concurrent modifications from multiple {WasmModuleObject}.
+  mutable base::Mutex mutex_;
+  mutable std::unique_ptr<std::unordered_map<uint32_t, WireBytesRef>>
+      function_names_;
+};
+
+class V8_EXPORT_PRIVATE AsmJsOffsetInformation {
+ public:
+  explicit AsmJsOffsetInformation(Vector<const byte> encoded_offsets);
+
+  // Destructor defined in wasm-module.cc, where the definition of
+  // {AsmJsOffsets} is available.
+  ~AsmJsOffsetInformation();
+
+  int GetSourcePosition(int func_index, int byte_offset,
+                        bool is_at_number_conversion);
+
+  std::pair<int, int> GetFunctionOffsets(int func_index);
+
+ private:
+  void EnsureDecodedOffsets();
+
+  // The offset information table is decoded lazily, hence needs to be
+  // protected against concurrent accesses.
+  // Exactly one of the two fields below will be set at a time.
+  mutable base::Mutex mutex_;
+
+  // Holds the encoded offset table bytes.
+  OwnedVector<const uint8_t> encoded_offsets_;
+
+  // Holds the decoded offset table.
+  std::unique_ptr<AsmJsOffsets> decoded_offsets_;
+};
+
 // Static representation of a module.
 struct V8_EXPORT_PRIVATE WasmModule {
-  MOVE_ONLY_NO_DEFAULT_CONSTRUCTOR(WasmModule);
-
   std::unique_ptr<Zone> signature_zone;
   uint32_t initial_pages = 0;      // initial size of the memory in 64k pages
   uint32_t maximum_pages = 0;      // maximum size of the memory in 64k pages
@@ -219,15 +256,16 @@ struct V8_EXPORT_PRIVATE WasmModule {
   SignatureMap signature_map;  // canonicalizing map for signature indexes.
 
   ModuleOrigin origin = kWasmOrigin;  // origin of the module
-  mutable std::unique_ptr<std::unordered_map<uint32_t, WireBytesRef>>
-      function_names;
+  DecodedFunctionNames function_names;
   std::string source_map_url;
 
+  // Asm.js source position information. Only available for modules compiled
+  // from asm.js.
+  std::unique_ptr<AsmJsOffsetInformation> asm_js_offset_information;
+
   explicit WasmModule(std::unique_ptr<Zone> signature_zone = nullptr);
 
-  WireBytesRef LookupFunctionName(const ModuleWireBytes& wire_bytes,
-                                  uint32_t function_index) const;
-  void AddFunctionNameForTesting(int function_index, WireBytesRef name);
+  DISALLOW_COPY_AND_ASSIGN(WasmModule);
 };
 
 inline bool is_asmjs_module(const WasmModule* module) {
@@ -250,18 +288,14 @@ int GetExportWrapperIndex(const WasmModule* module, const FunctionSig* sig,
 int GetWasmFunctionOffset(const WasmModule* module, uint32_t func_index);
 
 // Returns the function containing the given byte offset.
-// Returns -1 if the byte offset is not contained in any function of this
-// module.
+// Returns -1 if the byte offset is not contained in any
+// function of this module.
 int GetContainingWasmFunction(const WasmModule* module, uint32_t byte_offset);
 
-// Compute the disassembly of a wasm function.
-// Returns the disassembly string and a list of <byte_offset, line, column>
-// entries, mapping wasm byte offsets to line and column in the disassembly.
-// The list is guaranteed to be ordered by the byte_offset.
-// Returns an empty string and empty vector if the function index is invalid.
-V8_EXPORT_PRIVATE debug::WasmDisassembly DisassembleWasmFunction(
-    const WasmModule* module, const ModuleWireBytes& wire_bytes,
-    int func_index);
+// Returns the function containing the given byte offset.
+// Will return preceding function if the byte offset is not
+// contained within a function.
+int GetNearestWasmFunction(const WasmModule* module, uint32_t byte_offset);
 
 // Interface to the storage (wire bytes) of a wasm module.
 // It is illegal for anyone receiving a ModuleWireBytes to store pointers based
@@ -282,10 +316,10 @@ struct V8_EXPORT_PRIVATE ModuleWireBytes {
   WasmName GetNameOrNull(const WasmFunction* function,
                          const WasmModule* module) const;
 
-  // Checks the given offset range is contained within the module bytes.
-  bool BoundsCheck(uint32_t offset, uint32_t length) const {
+  // Checks the given reference is contained within the module bytes.
+  bool BoundsCheck(WireBytesRef ref) const {
     uint32_t size = static_cast<uint32_t>(module_bytes_.length());
-    return offset <= size && length <= size - offset;
+    return ref.offset() <= size && ref.length() <= size - ref.offset();
   }
 
   Vector<const byte> GetFunctionBytes(const WasmFunction* function) const {
@@ -330,10 +364,19 @@ Handle<JSArray> GetCustomSections(Isolate* isolate,
                                   Handle<WasmModuleObject> module,
                                   Handle<String> name, ErrorThrower* thrower);
 
-// Decode local variable names from the names section. Return FixedArray of
-// FixedArray of <undefined|String>. The outer fixed array is indexed by the
-// function index, the inner one by the local index.
-Handle<FixedArray> DecodeLocalNames(Isolate*, Handle<WasmModuleObject>);
+// Get the source position from a given function index and byte offset,
+// for either asm.js or pure Wasm modules.
+int GetSourcePosition(const WasmModule*, uint32_t func_index,
+                      uint32_t byte_offset, bool is_at_number_conversion);
+
+// Translate function index to the index relative to the first declared (i.e.
+// non-imported) function.
+inline int declared_function_index(const WasmModule* module, int func_index) {
+  DCHECK_LE(module->num_imported_functions, func_index);
+  int declared_idx = func_index - module->num_imported_functions;
+  DCHECK_GT(module->num_declared_functions, declared_idx);
+  return declared_idx;
+}
 
 // TruncatedUserString makes it easy to output names up to a certain length, and
 // output a truncation followed by '...' if they exceed a limit.
@@ -371,6 +414,11 @@ class TruncatedUserString {
   char buffer_[kMaxLen];
 };
 
+// Print the signature into the given {buffer}. If {buffer} is non-empty, it
+// will be null-terminated, even if the signature is cut off. Returns the number
+// of characters written, excluding the terminating null-byte.
+size_t PrintSignature(Vector<char> buffer, wasm::FunctionSig*);
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/wasm-objects-inl.h b/deps/v8/src/wasm/wasm-objects-inl.h
index a7f74381ae9c70..211a27a7495336 100644
--- a/deps/v8/src/wasm/wasm-objects-inl.h
+++ b/deps/v8/src/wasm/wasm-objects-inl.h
@@ -88,8 +88,6 @@ ACCESSORS(WasmModuleObject, managed_native_module, Managed<wasm::NativeModule>,
           kNativeModuleOffset)
 ACCESSORS(WasmModuleObject, export_wrappers, FixedArray, kExportWrappersOffset)
 ACCESSORS(WasmModuleObject, script, Script, kScriptOffset)
-OPTIONAL_ACCESSORS(WasmModuleObject, asm_js_offset_table, ByteArray,
-                   kAsmJsOffsetTableOffset)
 wasm::NativeModule* WasmModuleObject::native_module() const {
   return managed_native_module().raw();
 }
@@ -104,12 +102,12 @@ const wasm::WasmModule* WasmModuleObject::module() const {
 bool WasmModuleObject::is_asm_js() {
   bool asm_js = is_asmjs_module(module());
   DCHECK_EQ(asm_js, script().IsUserJavaScript());
-  DCHECK_EQ(asm_js, has_asm_js_offset_table());
   return asm_js;
 }
 
 // WasmTableObject
 ACCESSORS(WasmTableObject, entries, FixedArray, kEntriesOffset)
+SMI_ACCESSORS(WasmTableObject, current_length, kCurrentLengthOffset)
 ACCESSORS(WasmTableObject, maximum_length, Object, kMaximumLengthOffset)
 ACCESSORS(WasmTableObject, dispatch_tables, FixedArray, kDispatchTablesOffset)
 SMI_ACCESSORS(WasmTableObject, raw_type, kRawTypeOffset)
@@ -183,10 +181,19 @@ void WasmGlobalObject::SetAnyRef(Handle<Object> value) {
   tagged_buffer().set(offset(), *value);
 }
 
+bool WasmGlobalObject::SetNullRef(Handle<Object> value) {
+  DCHECK_EQ(type(), wasm::kWasmNullRef);
+  if (!value->IsNull()) {
+    return false;
+  }
+  tagged_buffer().set(offset(), *value);
+  return true;
+}
+
 bool WasmGlobalObject::SetFuncRef(Isolate* isolate, Handle<Object> value) {
   DCHECK_EQ(type(), wasm::kWasmFuncRef);
   if (!value->IsNull(isolate) &&
-      !WasmExportedFunction::IsWasmExportedFunction(*value) &&
+      !WasmExternalFunction::IsWasmExternalFunction(*value) &&
       !WasmCapiFunction::IsWasmCapiFunction(*value)) {
     return false;
   }
@@ -222,8 +229,6 @@ PRIMITIVE_ACCESSORS(WasmInstanceObject, data_segment_starts, Address*,
                     kDataSegmentStartsOffset)
 PRIMITIVE_ACCESSORS(WasmInstanceObject, data_segment_sizes, uint32_t*,
                     kDataSegmentSizesOffset)
-PRIMITIVE_ACCESSORS(WasmInstanceObject, dropped_data_segments, byte*,
-                    kDroppedDataSegmentsOffset)
 PRIMITIVE_ACCESSORS(WasmInstanceObject, dropped_elem_segments, byte*,
                     kDroppedElemSegmentsOffset)
 
@@ -380,7 +385,6 @@ ACCESSORS(WasmDebugInfo, wasm_instance, WasmInstanceObject, kInstanceOffset)
 ACCESSORS(WasmDebugInfo, interpreter_handle, Object, kInterpreterHandleOffset)
 ACCESSORS(WasmDebugInfo, interpreter_reference_stack, Cell,
           kInterpreterReferenceStackOffset)
-OPTIONAL_ACCESSORS(WasmDebugInfo, locals_names, FixedArray, kLocalsNamesOffset)
 OPTIONAL_ACCESSORS(WasmDebugInfo, c_wasm_entries, FixedArray,
                    kCWasmEntriesOffset)
 OPTIONAL_ACCESSORS(WasmDebugInfo, c_wasm_entry_map, Managed<wasm::SignatureMap>,
@@ -391,8 +395,6 @@ OPTIONAL_ACCESSORS(WasmDebugInfo, c_wasm_entry_map, Managed<wasm::SignatureMap>,
 #undef WRITE_PRIMITIVE_FIELD
 #undef PRIMITIVE_ACCESSORS
 
-uint32_t WasmTableObject::current_length() { return entries().length(); }
-
 wasm::ValueType WasmTableObject::type() {
   return static_cast<wasm::ValueType>(raw_type());
 }
@@ -406,7 +408,6 @@ TQ_SMI_ACCESSORS(WasmExceptionTag, index)
 ACCESSORS(AsmWasmData, managed_native_module, Managed<wasm::NativeModule>,
           kManagedNativeModuleOffset)
 ACCESSORS(AsmWasmData, export_wrappers, FixedArray, kExportWrappersOffset)
-ACCESSORS(AsmWasmData, asm_js_offset_table, ByteArray, kAsmJsOffsetTableOffset)
 ACCESSORS(AsmWasmData, uses_bitset, HeapNumber, kUsesBitsetOffset)
 
 #include "src/objects/object-macros-undef.h"
diff --git a/deps/v8/src/wasm/wasm-objects.cc b/deps/v8/src/wasm/wasm-objects.cc
index 93ce345a5fb06a..15fa129d2b4fbb 100644
--- a/deps/v8/src/wasm/wasm-objects.cc
+++ b/deps/v8/src/wasm/wasm-objects.cc
@@ -27,11 +27,7 @@
 #include "src/wasm/wasm-limits.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-objects-inl.h"
-
-#define TRACE(...)                                      \
-  do {                                                  \
-    if (FLAG_trace_wasm_instances) PrintF(__VA_ARGS__); \
-  } while (false)
+#include "src/wasm/wasm-value.h"
 
 #define TRACE_IFT(...)              \
   do {                              \
@@ -58,11 +54,7 @@ class WasmInstanceNativeAllocations {
 // Helper macro to set an internal field and the corresponding field
 // on an instance.
 #define SET(instance, field, value) \
-  {                                 \
-    auto v = value;                 \
-    this->field##_ = v;             \
-    instance->set_##field(v);       \
-  }
+  instance->set_##field((this->field##_ = value).get());
 
   // Allocates initial native storage for a given instance.
   WasmInstanceNativeAllocations(Handle<WasmInstanceObject> instance,
@@ -71,85 +63,63 @@ class WasmInstanceNativeAllocations {
                                 size_t num_data_segments,
                                 size_t num_elem_segments) {
     SET(instance, imported_function_targets,
-        reinterpret_cast<Address*>(
-            calloc(num_imported_functions, sizeof(Address))));
+        std::make_unique<Address[]>(num_imported_functions));
     SET(instance, imported_mutable_globals,
-        reinterpret_cast<Address*>(
-            calloc(num_imported_mutable_globals, sizeof(Address))));
+        std::make_unique<Address[]>(num_imported_mutable_globals));
     SET(instance, data_segment_starts,
-        reinterpret_cast<Address*>(calloc(num_data_segments, sizeof(Address))));
+        std::make_unique<Address[]>(num_data_segments));
     SET(instance, data_segment_sizes,
-        reinterpret_cast<uint32_t*>(
-            calloc(num_data_segments, sizeof(uint32_t))));
-    SET(instance, dropped_data_segments,
-        reinterpret_cast<uint8_t*>(calloc(num_data_segments, sizeof(uint8_t))));
+        std::make_unique<uint32_t[]>(num_data_segments));
     SET(instance, dropped_elem_segments,
-        reinterpret_cast<uint8_t*>(calloc(num_elem_segments, sizeof(uint8_t))));
-  }
-  ~WasmInstanceNativeAllocations() {
-    ::free(indirect_function_table_sig_ids_);
-    indirect_function_table_sig_ids_ = nullptr;
-    ::free(indirect_function_table_targets_);
-    indirect_function_table_targets_ = nullptr;
-    ::free(imported_function_targets_);
-    imported_function_targets_ = nullptr;
-    ::free(imported_mutable_globals_);
-    imported_mutable_globals_ = nullptr;
-    ::free(data_segment_starts_);
-    data_segment_starts_ = nullptr;
-    ::free(data_segment_sizes_);
-    data_segment_sizes_ = nullptr;
-    ::free(dropped_data_segments_);
-    dropped_data_segments_ = nullptr;
-    ::free(dropped_elem_segments_);
-    dropped_elem_segments_ = nullptr;
+        std::make_unique<uint8_t[]>(num_elem_segments));
+  }
+
+  uint32_t indirect_function_table_capacity() const {
+    return indirect_function_table_capacity_;
   }
+
   // Resizes the indirect function table.
   void resize_indirect_function_table(Isolate* isolate,
                                       Handle<WasmInstanceObject> instance,
-                                      uint32_t new_size) {
-    uint32_t old_size = instance->indirect_function_table_size();
-    void* new_sig_ids = nullptr;
-    void* new_targets = nullptr;
-    Handle<FixedArray> new_refs;
-    if (indirect_function_table_sig_ids_) {
-      // Reallocate the old storage.
-      new_sig_ids = realloc(indirect_function_table_sig_ids_,
-                            new_size * sizeof(uint32_t));
-      new_targets =
-          realloc(indirect_function_table_targets_, new_size * sizeof(Address));
-
-      Handle<FixedArray> old(instance->indirect_function_table_refs(), isolate);
-      new_refs = isolate->factory()->CopyFixedArrayAndGrow(
-          old, static_cast<int>(new_size - old_size));
-    } else {
-      // Allocate new storage.
-      new_sig_ids = malloc(new_size * sizeof(uint32_t));
-      new_targets = malloc(new_size * sizeof(Address));
-      new_refs = isolate->factory()->NewFixedArray(static_cast<int>(new_size));
-    }
-    // Initialize new entries.
-    instance->set_indirect_function_table_size(new_size);
+                                      uint32_t new_capacity) {
+    uint32_t old_capacity = indirect_function_table_capacity_;
+    DCHECK_LT(old_capacity, new_capacity);
+    // Grow exponentially to support repeated re-allocation.
+    new_capacity = std::max(new_capacity, 2 * old_capacity);
+    CHECK_GE(kMaxInt, old_capacity);
+    CHECK_GE(kMaxInt, new_capacity);
+
     SET(instance, indirect_function_table_sig_ids,
-        reinterpret_cast<uint32_t*>(new_sig_ids));
+        grow(indirect_function_table_sig_ids_.get(), old_capacity,
+             new_capacity));
     SET(instance, indirect_function_table_targets,
-        reinterpret_cast<Address*>(new_targets));
+        grow(indirect_function_table_targets_.get(), old_capacity,
+             new_capacity));
 
+    Handle<FixedArray> old_refs(instance->indirect_function_table_refs(),
+                                isolate);
+    Handle<FixedArray> new_refs = isolate->factory()->CopyFixedArrayAndGrow(
+        old_refs, static_cast<int>(new_capacity - old_capacity));
     instance->set_indirect_function_table_refs(*new_refs);
-    for (uint32_t j = old_size; j < new_size; j++) {
-      // {WasmInstanceNativeAllocations} only manages the memory of table 0.
-      // Therefore we pass the {table_index} as a constant here.
-      IndirectFunctionTableEntry(instance, 0, static_cast<int>(j)).clear();
-    }
+    indirect_function_table_capacity_ = new_capacity;
   }
-  uint32_t* indirect_function_table_sig_ids_ = nullptr;
-  Address* indirect_function_table_targets_ = nullptr;
-  Address* imported_function_targets_ = nullptr;
-  Address* imported_mutable_globals_ = nullptr;
-  Address* data_segment_starts_ = nullptr;
-  uint32_t* data_segment_sizes_ = nullptr;
-  uint8_t* dropped_data_segments_ = nullptr;
-  uint8_t* dropped_elem_segments_ = nullptr;
+
+ private:
+  template <typename T>
+  std::unique_ptr<T[]> grow(T* old_arr, size_t old_size, size_t new_size) {
+    std::unique_ptr<T[]> new_arr = std::make_unique<T[]>(new_size);
+    std::copy_n(old_arr, old_size, new_arr.get());
+    return new_arr;
+  }
+
+  uint32_t indirect_function_table_capacity_ = 0;
+  std::unique_ptr<uint32_t[]> indirect_function_table_sig_ids_;
+  std::unique_ptr<Address[]> indirect_function_table_targets_;
+  std::unique_ptr<Address[]> imported_function_targets_;
+  std::unique_ptr<Address[]> imported_mutable_globals_;
+  std::unique_ptr<Address[]> data_segment_starts_;
+  std::unique_ptr<uint32_t[]> data_segment_sizes_;
+  std::unique_ptr<uint8_t[]> dropped_elem_segments_;
 #undef SET
 };
 
@@ -173,26 +143,6 @@ WasmInstanceNativeAllocations* GetNativeAllocations(
       .raw();
 }
 
-#ifdef DEBUG
-bool IsBreakablePosition(wasm::NativeModule* native_module, int func_index,
-                         int offset_in_func) {
-  AccountingAllocator alloc;
-  Zone tmp(&alloc, ZONE_NAME);
-  wasm::BodyLocalDecls locals(&tmp);
-  const byte* module_start = native_module->wire_bytes().begin();
-  const WasmFunction& func = native_module->module()->functions[func_index];
-  wasm::BytecodeIterator iterator(module_start + func.code.offset(),
-                                  module_start + func.code.end_offset(),
-                                  &locals);
-  DCHECK_LT(0, locals.encoded_size);
-  for (uint32_t offset : iterator.offsets()) {
-    if (offset > static_cast<uint32_t>(offset_in_func)) break;
-    if (offset == static_cast<uint32_t>(offset_in_func)) return true;
-  }
-  return false;
-}
-#endif  // DEBUG
-
 enum DispatchTableElements : int {
   kDispatchTableInstanceOffset,
   kDispatchTableIndexOffset,
@@ -216,8 +166,10 @@ Handle<WasmModuleObject> WasmModuleObject::New(
     Isolate* isolate, std::shared_ptr<wasm::NativeModule> native_module,
     Handle<Script> script, Handle<FixedArray> export_wrappers) {
   const WasmModule* module = native_module->module();
+  const bool uses_liftoff =
+      FLAG_liftoff && native_module->module()->origin == wasm::kWasmOrigin;
   size_t code_size_estimate =
-      wasm::WasmCodeManager::EstimateNativeModuleCodeSize(module);
+      wasm::WasmCodeManager::EstimateNativeModuleCodeSize(module, uses_liftoff);
   return New(isolate, std::move(native_module), script, export_wrappers,
              code_size_estimate);
 }
@@ -233,7 +185,7 @@ Handle<WasmModuleObject> WasmModuleObject::New(
   // allocating a new {Managed<T>} that the {WasmModuleObject} references.
   size_t memory_estimate =
       code_size_estimate +
-      wasm::WasmCodeManager::EstimateNativeModuleNonCodeSize(module);
+      wasm::WasmCodeManager::EstimateNativeModuleMetaDataSize(module);
   Handle<Managed<wasm::NativeModule>> managed_native_module =
       Managed<wasm::NativeModule>::FromSharedPtr(isolate, memory_estimate,
                                                  std::move(native_module));
@@ -253,488 +205,48 @@ Handle<WasmModuleObject> WasmModuleObject::New(
   return module_object;
 }
 
-// static
-bool WasmModuleObject::SetBreakPoint(Handle<Script> script, int* position,
-                                     Handle<BreakPoint> break_point) {
-  Isolate* isolate = script->GetIsolate();
-
-  // Find the function for this breakpoint.
-  const WasmModule* module = script->wasm_native_module()->module();
-  int func_index = GetContainingWasmFunction(module, *position);
-  if (func_index < 0) return false;
-  const WasmFunction& func = module->functions[func_index];
-  int offset_in_func = *position - func.code.offset();
-
-  // According to the current design, we should only be called with valid
-  // breakable positions.
-  DCHECK(IsBreakablePosition(script->wasm_native_module(), func_index,
-                             offset_in_func));
-
-  // Insert new break point into break_positions of module object.
-  WasmModuleObject::AddBreakpointToInfo(script, *position, break_point);
-
-  // Iterate over all instances and tell them to set this new breakpoint.
-  // We do this using the weak list of all instances from the script.
-  Handle<WeakArrayList> weak_instance_list(script->wasm_weak_instance_list(),
-                                           isolate);
-  for (int i = 0; i < weak_instance_list->length(); ++i) {
-    MaybeObject maybe_instance = weak_instance_list->Get(i);
-    if (maybe_instance->IsWeak()) {
-      Handle<WasmInstanceObject> instance(
-          WasmInstanceObject::cast(maybe_instance->GetHeapObjectAssumeWeak()),
-          isolate);
-      Handle<WasmDebugInfo> debug_info =
-          WasmInstanceObject::GetOrCreateDebugInfo(instance);
-      WasmDebugInfo::SetBreakpoint(debug_info, func_index, offset_in_func);
-    }
-  }
-
-  return true;
-}
-
-// static
-bool WasmModuleObject::ClearBreakPoint(Handle<Script> script, int position,
-                                       Handle<BreakPoint> break_point) {
-  Isolate* isolate = script->GetIsolate();
-
-  // Find the function for this breakpoint.
-  const WasmModule* module = script->wasm_native_module()->module();
-  int func_index = GetContainingWasmFunction(module, position);
-  if (func_index < 0) return false;
-  const WasmFunction& func = module->functions[func_index];
-  int offset_in_func = position - func.code.offset();
-
-  if (!WasmModuleObject::RemoveBreakpointFromInfo(script, position,
-                                                  break_point)) {
-    return false;
-  }
-
-  // Iterate over all instances and tell them to remove this breakpoint.
-  // We do this using the weak list of all instances from the script.
-  Handle<WeakArrayList> weak_instance_list(script->wasm_weak_instance_list(),
-                                           isolate);
-  for (int i = 0; i < weak_instance_list->length(); ++i) {
-    MaybeObject maybe_instance = weak_instance_list->Get(i);
-    if (maybe_instance->IsWeak()) {
-      Handle<WasmInstanceObject> instance(
-          WasmInstanceObject::cast(maybe_instance->GetHeapObjectAssumeWeak()),
-          isolate);
-      Handle<WasmDebugInfo> debug_info =
-          WasmInstanceObject::GetOrCreateDebugInfo(instance);
-      WasmDebugInfo::ClearBreakpoint(debug_info, func_index, offset_in_func);
-    }
-  }
-
-  return true;
-}
-
-namespace {
-
-int GetBreakpointPos(Isolate* isolate, Object break_point_info_or_undef) {
-  if (break_point_info_or_undef.IsUndefined(isolate)) return kMaxInt;
-  return BreakPointInfo::cast(break_point_info_or_undef).source_position();
-}
-
-int FindBreakpointInfoInsertPos(Isolate* isolate,
-                                Handle<FixedArray> breakpoint_infos,
-                                int position) {
-  // Find insert location via binary search, taking care of undefined values on
-  // the right. Position is always greater than zero.
-  DCHECK_LT(0, position);
-
-  int left = 0;                            // inclusive
-  int right = breakpoint_infos->length();  // exclusive
-  while (right - left > 1) {
-    int mid = left + (right - left) / 2;
-    Object mid_obj = breakpoint_infos->get(mid);
-    if (GetBreakpointPos(isolate, mid_obj) <= position) {
-      left = mid;
-    } else {
-      right = mid;
-    }
-  }
-
-  int left_pos = GetBreakpointPos(isolate, breakpoint_infos->get(left));
-  return left_pos < position ? left + 1 : left;
-}
-
-}  // namespace
-
-// static
-void WasmModuleObject::AddBreakpointToInfo(Handle<Script> script, int position,
-                                           Handle<BreakPoint> break_point) {
-  Isolate* isolate = script->GetIsolate();
-  Handle<FixedArray> breakpoint_infos;
-  if (script->has_wasm_breakpoint_infos()) {
-    breakpoint_infos = handle(script->wasm_breakpoint_infos(), isolate);
-  } else {
-    breakpoint_infos =
-        isolate->factory()->NewFixedArray(4, AllocationType::kOld);
-    script->set_wasm_breakpoint_infos(*breakpoint_infos);
-  }
-
-  int insert_pos =
-      FindBreakpointInfoInsertPos(isolate, breakpoint_infos, position);
-
-  // If a BreakPointInfo object already exists for this position, add the new
-  // breakpoint object and return.
-  if (insert_pos < breakpoint_infos->length() &&
-      GetBreakpointPos(isolate, breakpoint_infos->get(insert_pos)) ==
-          position) {
-    Handle<BreakPointInfo> old_info(
-        BreakPointInfo::cast(breakpoint_infos->get(insert_pos)), isolate);
-    BreakPointInfo::SetBreakPoint(isolate, old_info, break_point);
-    return;
-  }
-
-  // Enlarge break positions array if necessary.
-  bool need_realloc = !breakpoint_infos->get(breakpoint_infos->length() - 1)
-                           .IsUndefined(isolate);
-  Handle<FixedArray> new_breakpoint_infos = breakpoint_infos;
-  if (need_realloc) {
-    new_breakpoint_infos = isolate->factory()->NewFixedArray(
-        2 * breakpoint_infos->length(), AllocationType::kOld);
-    script->set_wasm_breakpoint_infos(*new_breakpoint_infos);
-    // Copy over the entries [0, insert_pos).
-    for (int i = 0; i < insert_pos; ++i)
-      new_breakpoint_infos->set(i, breakpoint_infos->get(i));
-  }
-
-  // Move elements [insert_pos, ...] up by one.
-  for (int i = breakpoint_infos->length() - 1; i >= insert_pos; --i) {
-    Object entry = breakpoint_infos->get(i);
-    if (entry.IsUndefined(isolate)) continue;
-    new_breakpoint_infos->set(i + 1, entry);
-  }
-
-  // Generate new BreakpointInfo.
-  Handle<BreakPointInfo> breakpoint_info =
-      isolate->factory()->NewBreakPointInfo(position);
-  BreakPointInfo::SetBreakPoint(isolate, breakpoint_info, break_point);
-
-  // Now insert new position at insert_pos.
-  new_breakpoint_infos->set(insert_pos, *breakpoint_info);
-}
-
-// static
-bool WasmModuleObject::RemoveBreakpointFromInfo(
-    Handle<Script> script, int position, Handle<BreakPoint> break_point) {
-  if (!script->has_wasm_breakpoint_infos()) return false;
-
-  Isolate* isolate = script->GetIsolate();
-  Handle<FixedArray> breakpoint_infos(script->wasm_breakpoint_infos(), isolate);
-
-  int pos = FindBreakpointInfoInsertPos(isolate, breakpoint_infos, position);
-
-  // Does a BreakPointInfo object already exist for this position?
-  if (pos == breakpoint_infos->length()) return false;
-
-  Handle<BreakPointInfo> info(BreakPointInfo::cast(breakpoint_infos->get(pos)),
-                              isolate);
-  BreakPointInfo::ClearBreakPoint(isolate, info, break_point);
-
-  // Check if there are no more breakpoints at this location.
-  if (info->GetBreakPointCount(isolate) == 0) {
-    // Update array by moving breakpoints up one position.
-    for (int i = pos; i < breakpoint_infos->length() - 1; i++) {
-      Object entry = breakpoint_infos->get(i + 1);
-      breakpoint_infos->set(i, entry);
-      if (entry.IsUndefined(isolate)) break;
-    }
-    // Make sure last array element is empty as a result.
-    breakpoint_infos->set_undefined(breakpoint_infos->length() - 1);
-  }
-  return true;
-}
-
-void WasmModuleObject::SetBreakpointsOnNewInstance(
-    Handle<Script> script, Handle<WasmInstanceObject> instance) {
-  if (!script->has_wasm_breakpoint_infos()) return;
-  Isolate* isolate = script->GetIsolate();
-  Handle<WasmDebugInfo> debug_info =
-      WasmInstanceObject::GetOrCreateDebugInfo(instance);
-
-  Handle<FixedArray> breakpoint_infos(script->wasm_breakpoint_infos(), isolate);
-  // If the array exists, it should not be empty.
-  DCHECK_LT(0, breakpoint_infos->length());
-
-  for (int i = 0, e = breakpoint_infos->length(); i < e; ++i) {
-    Handle<Object> obj(breakpoint_infos->get(i), isolate);
-    if (obj->IsUndefined(isolate)) {
-      for (; i < e; ++i) {
-        DCHECK(breakpoint_infos->get(i).IsUndefined(isolate));
-      }
-      break;
-    }
-    Handle<BreakPointInfo> breakpoint_info = Handle<BreakPointInfo>::cast(obj);
-    int position = breakpoint_info->source_position();
-
-    // Find the function for this breakpoint, and set the breakpoint.
-    const WasmModule* module = script->wasm_native_module()->module();
-    int func_index = GetContainingWasmFunction(module, position);
-    DCHECK_LE(0, func_index);
-    const WasmFunction& func = module->functions[func_index];
-    int offset_in_func = position - func.code.offset();
-    WasmDebugInfo::SetBreakpoint(debug_info, func_index, offset_in_func);
-  }
-}
-
-namespace {
-
-enum AsmJsOffsetTableEntryLayout {
-  kOTEByteOffset,
-  kOTECallPosition,
-  kOTENumberConvPosition,
-  kOTESize
-};
-
-Handle<ByteArray> GetDecodedAsmJsOffsetTable(
-    Handle<WasmModuleObject> module_object, Isolate* isolate) {
-  DCHECK(module_object->is_asm_js());
-  Handle<ByteArray> offset_table(module_object->asm_js_offset_table(), isolate);
-
-  // The last byte in the asm_js_offset_tables ByteArray tells whether it is
-  // still encoded (0) or decoded (1).
-  enum AsmJsTableType : int { Encoded = 0, Decoded = 1 };
-  int table_type = offset_table->get(offset_table->length() - 1);
-  DCHECK(table_type == Encoded || table_type == Decoded);
-  if (table_type == Decoded) return offset_table;
-
-  wasm::AsmJsOffsets asm_offsets;
-  {
-    DisallowHeapAllocation no_gc;
-    byte* bytes_start = offset_table->GetDataStartAddress();
-    byte* bytes_end = reinterpret_cast<byte*>(
-        reinterpret_cast<Address>(bytes_start) + offset_table->length() - 1);
-    asm_offsets = wasm::DecodeAsmJsOffsets(bytes_start, bytes_end).value();
-  }
-  // Wasm bytes must be valid and must contain asm.js offset table.
-  DCHECK_GE(kMaxInt, asm_offsets.size());
-  int num_functions = static_cast<int>(asm_offsets.size());
-  int num_imported_functions =
-      static_cast<int>(module_object->module()->num_imported_functions);
-  DCHECK_EQ(module_object->module()->functions.size(),
-            static_cast<size_t>(num_functions) + num_imported_functions);
-  int num_entries = 0;
-  for (int func = 0; func < num_functions; ++func) {
-    size_t new_size = asm_offsets[func].size();
-    DCHECK_LE(new_size, static_cast<size_t>(kMaxInt) - num_entries);
-    num_entries += static_cast<int>(new_size);
-  }
-  // One byte to encode that this is a decoded table.
-  DCHECK_GE(kMaxInt,
-            1 + static_cast<uint64_t>(num_entries) * kOTESize * kIntSize);
-  int total_size = 1 + num_entries * kOTESize * kIntSize;
-  Handle<ByteArray> decoded_table =
-      isolate->factory()->NewByteArray(total_size, AllocationType::kOld);
-  decoded_table->set(total_size - 1, AsmJsTableType::Decoded);
-  module_object->set_asm_js_offset_table(*decoded_table);
-
-  int idx = 0;
-  const std::vector<WasmFunction>& wasm_funs =
-      module_object->module()->functions;
-  for (int func = 0; func < num_functions; ++func) {
-    std::vector<wasm::AsmJsOffsetEntry>& func_asm_offsets = asm_offsets[func];
-    if (func_asm_offsets.empty()) continue;
-    int func_offset = wasm_funs[num_imported_functions + func].code.offset();
-    for (wasm::AsmJsOffsetEntry& e : func_asm_offsets) {
-      // Byte offsets must be strictly monotonously increasing:
-      DCHECK_IMPLIES(idx > 0, func_offset + e.byte_offset >
-                                  decoded_table->get_int(idx - kOTESize));
-      decoded_table->set_int(idx + kOTEByteOffset, func_offset + e.byte_offset);
-      decoded_table->set_int(idx + kOTECallPosition, e.source_position_call);
-      decoded_table->set_int(idx + kOTENumberConvPosition,
-                             e.source_position_number_conversion);
-      idx += kOTESize;
-    }
-  }
-  DCHECK_EQ(total_size, idx * kIntSize + 1);
-  return decoded_table;
-}
-
-}  // namespace
-
-int WasmModuleObject::GetSourcePosition(Handle<WasmModuleObject> module_object,
-                                        uint32_t func_index,
-                                        uint32_t byte_offset,
-                                        bool is_at_number_conversion) {
-  Isolate* isolate = module_object->GetIsolate();
-  const WasmModule* module = module_object->module();
-
-  if (module->origin == wasm::kWasmOrigin) {
-    // for non-asm.js modules, we just add the function's start offset
-    // to make a module-relative position.
-    return byte_offset + GetWasmFunctionOffset(module, func_index);
-  }
-
-  // asm.js modules have an additional offset table that must be searched.
-  Handle<ByteArray> offset_table =
-      GetDecodedAsmJsOffsetTable(module_object, isolate);
-
-  DCHECK_LT(func_index, module->functions.size());
-  uint32_t func_code_offset = module->functions[func_index].code.offset();
-  uint32_t total_offset = func_code_offset + byte_offset;
-
-  // Binary search for the total byte offset.
-  int left = 0;                                              // inclusive
-  int right = offset_table->length() / kIntSize / kOTESize;  // exclusive
-  DCHECK_LT(left, right);
-  while (right - left > 1) {
-    int mid = left + (right - left) / 2;
-    int mid_entry = offset_table->get_int(kOTESize * mid);
-    DCHECK_GE(kMaxInt, mid_entry);
-    if (static_cast<uint32_t>(mid_entry) <= total_offset) {
-      left = mid;
-    } else {
-      right = mid;
-    }
-  }
-  // There should be an entry for each position that could show up on the stack
-  // trace:
-  DCHECK_EQ(total_offset, offset_table->get_int(kOTESize * left));
-  int idx = is_at_number_conversion ? kOTENumberConvPosition : kOTECallPosition;
-  return offset_table->get_int(kOTESize * left + idx);
-}
-
-// static
-bool WasmModuleObject::GetPossibleBreakpoints(
-    wasm::NativeModule* native_module, const v8::debug::Location& start,
-    const v8::debug::Location& end,
-    std::vector<v8::debug::BreakLocation>* locations) {
-  DisallowHeapAllocation no_gc;
-
-  const std::vector<WasmFunction>& functions =
-      native_module->module()->functions;
-  if (start.GetLineNumber() < 0 || start.GetColumnNumber() < 0 ||
-      (!end.IsEmpty() &&
-       (end.GetLineNumber() < 0 || end.GetColumnNumber() < 0)))
-    return false;
-
-  // start_func_index, start_offset and end_func_index is inclusive.
-  // end_offset is exclusive.
-  // start_offset and end_offset are module-relative byte offsets.
-  uint32_t start_func_index = start.GetLineNumber();
-  if (start_func_index >= functions.size()) return false;
-  int start_func_len = functions[start_func_index].code.length();
-  if (start.GetColumnNumber() > start_func_len) return false;
-  uint32_t start_offset =
-      functions[start_func_index].code.offset() + start.GetColumnNumber();
-  uint32_t end_func_index;
-  uint32_t end_offset;
-  if (end.IsEmpty()) {
-    // Default: everything till the end of the Script.
-    end_func_index = static_cast<uint32_t>(functions.size() - 1);
-    end_offset = functions[end_func_index].code.end_offset();
-  } else {
-    // If end is specified: Use it and check for valid input.
-    end_func_index = static_cast<uint32_t>(end.GetLineNumber());
-
-    // Special case: Stop before the start of the next function. Change to: Stop
-    // at the end of the function before, such that we don't disassemble the
-    // next function also.
-    if (end.GetColumnNumber() == 0 && end_func_index > 0) {
-      --end_func_index;
-      end_offset = functions[end_func_index].code.end_offset();
-    } else {
-      if (end_func_index >= functions.size()) return false;
-      end_offset =
-          functions[end_func_index].code.offset() + end.GetColumnNumber();
-      if (end_offset > functions[end_func_index].code.end_offset())
-        return false;
-    }
-  }
-
-  AccountingAllocator alloc;
-  Zone tmp(&alloc, ZONE_NAME);
-  const byte* module_start = native_module->wire_bytes().begin();
-
-  for (uint32_t func_idx = start_func_index; func_idx <= end_func_index;
-       ++func_idx) {
-    const WasmFunction& func = functions[func_idx];
-    if (func.code.length() == 0) continue;
-
-    wasm::BodyLocalDecls locals(&tmp);
-    wasm::BytecodeIterator iterator(module_start + func.code.offset(),
-                                    module_start + func.code.end_offset(),
-                                    &locals);
-    DCHECK_LT(0u, locals.encoded_size);
-    for (uint32_t offset : iterator.offsets()) {
-      uint32_t total_offset = func.code.offset() + offset;
-      if (total_offset >= end_offset) {
-        DCHECK_EQ(end_func_index, func_idx);
-        break;
-      }
-      if (total_offset < start_offset) continue;
-      locations->emplace_back(func_idx, offset, debug::kCommonBreakLocation);
-    }
-  }
-  return true;
-}
-
-// static
-MaybeHandle<FixedArray> WasmModuleObject::CheckBreakPoints(
-    Isolate* isolate, Handle<Script> script, int position) {
-  if (!script->has_wasm_breakpoint_infos()) return {};
-
-  Handle<FixedArray> breakpoint_infos(script->wasm_breakpoint_infos(), isolate);
-  int insert_pos =
-      FindBreakpointInfoInsertPos(isolate, breakpoint_infos, position);
-  if (insert_pos >= breakpoint_infos->length()) return {};
-
-  Handle<Object> maybe_breakpoint_info(breakpoint_infos->get(insert_pos),
-                                       isolate);
-  if (maybe_breakpoint_info->IsUndefined(isolate)) return {};
-  Handle<BreakPointInfo> breakpoint_info =
-      Handle<BreakPointInfo>::cast(maybe_breakpoint_info);
-  if (breakpoint_info->source_position() != position) return {};
-
-  // There is no support for conditional break points. Just assume that every
-  // break point always hits.
-  Handle<Object> break_points(breakpoint_info->break_points(), isolate);
-  if (break_points->IsFixedArray()) {
-    return Handle<FixedArray>::cast(break_points);
-  }
-  Handle<FixedArray> break_points_hit = isolate->factory()->NewFixedArray(1);
-  break_points_hit->set(0, *break_points);
-  return break_points_hit;
-}
-
-MaybeHandle<String> WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+Handle<String> WasmModuleObject::ExtractUtf8StringFromModuleBytes(
     Isolate* isolate, Handle<WasmModuleObject> module_object,
-    wasm::WireBytesRef ref) {
-  // TODO(wasm): cache strings from modules if it's a performance win.
+    wasm::WireBytesRef ref, InternalizeString internalize) {
   Vector<const uint8_t> wire_bytes =
       module_object->native_module()->wire_bytes();
-  return ExtractUtf8StringFromModuleBytes(isolate, wire_bytes, ref);
+  return ExtractUtf8StringFromModuleBytes(isolate, wire_bytes, ref,
+                                          internalize);
 }
 
-MaybeHandle<String> WasmModuleObject::ExtractUtf8StringFromModuleBytes(
-    Isolate* isolate, Vector<const uint8_t> wire_bytes,
-    wasm::WireBytesRef ref) {
-  Vector<const uint8_t> name_vec = wire_bytes + ref.offset();
-  name_vec.Truncate(ref.length());
+Handle<String> WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+    Isolate* isolate, Vector<const uint8_t> wire_bytes, wasm::WireBytesRef ref,
+    InternalizeString internalize) {
+  Vector<const uint8_t> name_vec =
+      wire_bytes.SubVector(ref.offset(), ref.end_offset());
   // UTF8 validation happens at decode time.
   DCHECK(unibrow::Utf8::ValidateEncoding(name_vec.begin(), name_vec.length()));
-  return isolate->factory()->NewStringFromUtf8(
-      Vector<const char>::cast(name_vec));
+  auto* factory = isolate->factory();
+  return internalize
+             ? factory->InternalizeUtf8String(
+                   Vector<const char>::cast(name_vec))
+             : factory->NewStringFromUtf8(Vector<const char>::cast(name_vec))
+                   .ToHandleChecked();
 }
 
 MaybeHandle<String> WasmModuleObject::GetModuleNameOrNull(
     Isolate* isolate, Handle<WasmModuleObject> module_object) {
   const WasmModule* module = module_object->module();
   if (!module->name.is_set()) return {};
-  return ExtractUtf8StringFromModuleBytes(isolate, module_object, module->name);
+  return ExtractUtf8StringFromModuleBytes(isolate, module_object, module->name,
+                                          kNoInternalize);
 }
 
 MaybeHandle<String> WasmModuleObject::GetFunctionNameOrNull(
     Isolate* isolate, Handle<WasmModuleObject> module_object,
     uint32_t func_index) {
   DCHECK_LT(func_index, module_object->module()->functions.size());
-  wasm::WireBytesRef name = module_object->module()->LookupFunctionName(
+  wasm::WireBytesRef name = module_object->module()->function_names.Lookup(
       wasm::ModuleWireBytes(module_object->native_module()->wire_bytes()),
       func_index);
   if (!name.is_set()) return {};
-  return ExtractUtf8StringFromModuleBytes(isolate, module_object, name);
+  return ExtractUtf8StringFromModuleBytes(isolate, module_object, name,
+                                          kNoInternalize);
 }
 
 Handle<String> WasmModuleObject::GetFunctionName(
@@ -755,7 +267,7 @@ Vector<const uint8_t> WasmModuleObject::GetRawFunctionName(
   DCHECK_GT(module()->functions.size(), func_index);
   wasm::ModuleWireBytes wire_bytes(native_module()->wire_bytes());
   wasm::WireBytesRef name_ref =
-      module()->LookupFunctionName(wire_bytes, func_index);
+      module()->function_names.Lookup(wire_bytes, func_index);
   wasm::WasmName name = wire_bytes.GetNameOrNull(name_ref);
   return Vector<const uint8_t>::cast(name);
 }
@@ -784,9 +296,10 @@ Handle<WasmTableObject> WasmTableObject::New(Isolate* isolate,
       isolate->factory()->NewJSObject(table_ctor));
   DisallowHeapAllocation no_gc;
 
-  table_obj->set_raw_type(static_cast<int>(type));
   table_obj->set_entries(*backing_store);
+  table_obj->set_current_length(initial);
   table_obj->set_maximum_length(*max);
+  table_obj->set_raw_type(static_cast<int>(type));
 
   table_obj->set_dispatch_tables(ReadOnlyRoots(isolate).empty_fixed_array());
   if (entries != nullptr) {
@@ -833,9 +346,21 @@ int WasmTableObject::Grow(Isolate* isolate, Handle<WasmTableObject> table,
   if (max_size - old_size < count) return -1;
 
   uint32_t new_size = old_size + count;
-  auto new_store = isolate->factory()->CopyFixedArrayAndGrow(
-      handle(table->entries(), isolate), count);
-  table->set_entries(*new_store, WriteBarrierMode::UPDATE_WRITE_BARRIER);
+  // Even with 2x over-allocation, there should not be an integer overflow.
+  STATIC_ASSERT(wasm::kV8MaxWasmTableSize <= kMaxInt / 2);
+  DCHECK_GE(kMaxInt, new_size);
+  int old_capacity = table->entries().length();
+  if (new_size > static_cast<uint32_t>(old_capacity)) {
+    int grow = static_cast<int>(new_size) - old_capacity;
+    // Grow at least by the old capacity, to implement exponential growing.
+    grow = std::max(grow, old_capacity);
+    // Never grow larger than the max size.
+    grow = std::min(grow, static_cast<int>(max_size - old_capacity));
+    auto new_store = isolate->factory()->CopyFixedArrayAndGrow(
+        handle(table->entries(), isolate), grow);
+    table->set_entries(*new_store, WriteBarrierMode::UPDATE_WRITE_BARRIER);
+  }
+  table->set_current_length(new_size);
 
   Handle<FixedArray> dispatch_tables(table->dispatch_tables(), isolate);
   DCHECK_EQ(0, dispatch_tables->length() % kDispatchTableNumElements);
@@ -868,16 +393,21 @@ int WasmTableObject::Grow(Isolate* isolate, Handle<WasmTableObject> table,
 bool WasmTableObject::IsInBounds(Isolate* isolate,
                                  Handle<WasmTableObject> table,
                                  uint32_t entry_index) {
-  return (entry_index <
-              static_cast<uint32_t>(std::numeric_limits<int>::max()) &&
-          static_cast<int>(entry_index) < table->entries().length());
+  return entry_index < static_cast<uint32_t>(table->current_length());
 }
 
 bool WasmTableObject::IsValidElement(Isolate* isolate,
                                      Handle<WasmTableObject> table,
                                      Handle<Object> entry) {
-  // Anyref tables take everything.
-  if (table->type() == wasm::kWasmAnyRef) return true;
+  // Anyref and exnref tables take everything.
+  if (table->type() == wasm::kWasmAnyRef ||
+      table->type() == wasm::kWasmExnRef) {
+    return true;
+  }
+  // Nullref only takes {null}.
+  if (table->type() == wasm::kWasmNullRef) {
+    return entry->IsNull(isolate);
+  }
   // FuncRef tables can store {null}, {WasmExportedFunction}, {WasmJSFunction},
   // or {WasmCapiFunction} objects.
   if (entry->IsNull(isolate)) return true;
@@ -895,7 +425,8 @@ void WasmTableObject::Set(Isolate* isolate, Handle<WasmTableObject> table,
   Handle<FixedArray> entries(table->entries(), isolate);
   // The FixedArray is addressed with int's.
   int entry_index = static_cast<int>(index);
-  if (table->type() == wasm::kWasmAnyRef) {
+  if (table->type() == wasm::kWasmAnyRef ||
+      table->type() == wasm::kWasmExnRef) {
     entries->set(entry_index, *entry);
     return;
   }
@@ -939,8 +470,11 @@ Handle<Object> WasmTableObject::Get(Isolate* isolate,
 
   Handle<Object> entry(entries->get(entry_index), isolate);
 
-  // First we handle the easy anyref table case.
-  if (table->type() == wasm::kWasmAnyRef) return entry;
+  // First we handle the easy anyref and exnref table case.
+  if (table->type() == wasm::kWasmAnyRef ||
+      table->type() == wasm::kWasmExnRef) {
+    return entry;
+  }
 
   // Now we handle the funcref case.
   if (WasmExportedFunction::IsWasmExportedFunction(*entry) ||
@@ -971,9 +505,9 @@ void WasmTableObject::Fill(Isolate* isolate, Handle<WasmTableObject> table,
                            uint32_t start, Handle<Object> entry,
                            uint32_t count) {
   // Bounds checks must be done by the caller.
-  DCHECK_LE(start, table->entries().length());
-  DCHECK_LE(count, table->entries().length());
-  DCHECK_LE(start + count, table->entries().length());
+  DCHECK_LE(start, table->current_length());
+  DCHECK_LE(count, table->current_length());
+  DCHECK_LE(start + count, table->current_length());
 
   for (uint32_t i = 0; i < count; i++) {
     WasmTableObject::Set(isolate, table, start + i, entry);
@@ -1117,7 +651,7 @@ void WasmTableObject::GetFunctionTableEntry(
     bool* is_valid, bool* is_null, MaybeHandle<WasmInstanceObject>* instance,
     int* function_index, MaybeHandle<WasmJSFunction>* maybe_js_function) {
   DCHECK_EQ(table->type(), wasm::kWasmFuncRef);
-  DCHECK_LT(entry_index, table->entries().length());
+  DCHECK_LT(entry_index, table->current_length());
   // We initialize {is_valid} with {true}. We may change it later.
   *is_valid = true;
   Handle<Object> element(table->entries().get(entry_index), isolate);
@@ -1599,13 +1133,25 @@ bool WasmInstanceObject::EnsureIndirectFunctionTableWithMinimumSize(
     WasmIndirectFunctionTable::Resize(isolate, table, minimum_size);
     return true;
   }
+
   uint32_t old_size = instance->indirect_function_table_size();
   if (old_size >= minimum_size) return false;  // Nothing to do.
 
-  HandleScope scope(isolate);
   auto native_allocations = GetNativeAllocations(*instance);
-  native_allocations->resize_indirect_function_table(isolate, instance,
-                                                     minimum_size);
+  if (native_allocations->indirect_function_table_capacity() < minimum_size) {
+    HandleScope scope(isolate);
+    native_allocations->resize_indirect_function_table(isolate, instance,
+                                                       minimum_size);
+    DCHECK_GE(native_allocations->indirect_function_table_capacity(),
+              minimum_size);
+  }
+  instance->set_indirect_function_table_size(minimum_size);
+  for (uint32_t j = old_size; j < minimum_size; j++) {
+    // {WasmInstanceNativeAllocations} only manages the memory of table 0.
+    // Therefore we pass the {table_index} as a constant here.
+    IndirectFunctionTableEntry(instance, 0, static_cast<int>(j)).clear();
+  }
+
   return true;
 }
 
@@ -1679,6 +1225,8 @@ Handle<WasmInstanceObject> WasmInstanceObject::New(
       isolate->stack_guard()->address_of_real_jslimit());
   instance->set_globals_start(nullptr);
   instance->set_indirect_function_table_size(0);
+  instance->set_indirect_function_table_refs(
+      ReadOnlyRoots(isolate).empty_fixed_array());
   instance->set_indirect_function_table_sig_ids(nullptr);
   instance->set_indirect_function_table_targets(nullptr);
   instance->set_native_context(*isolate->native_context());
@@ -1688,7 +1236,7 @@ Handle<WasmInstanceObject> WasmInstanceObject::New(
 
   // Insert the new instance into the scripts weak list of instances. This list
   // is used for breakpoints affecting all instances belonging to the script.
-  // TODO(mstarzinger): Allow to reuse holes in the {WeakArrayList} below.
+  // TODO(wasm): Allow to reuse holes in the {WeakArrayList} below.
   if (module_object->script().type() == Script::TYPE_WASM) {
     Handle<WeakArrayList> weak_instance_list(
         module_object->script().wasm_weak_instance_list(), isolate);
@@ -1719,17 +1267,16 @@ void WasmInstanceObject::InitDataSegmentArrays(
          num_data_segments == module->data_segments.size());
   for (size_t i = 0; i < num_data_segments; ++i) {
     const wasm::WasmDataSegment& segment = module->data_segments[i];
-    // Set the active segments to being already dropped, since memory.init on
-    // a dropped passive segment and an active segment have the same
-    // behavior.
-    instance->dropped_data_segments()[i] = segment.active ? 1 : 0;
-
     // Initialize the pointer and size of passive segments.
     auto source_bytes = wire_bytes.SubVector(segment.source.offset(),
                                              segment.source.end_offset());
     instance->data_segment_starts()[i] =
         reinterpret_cast<Address>(source_bytes.begin());
-    instance->data_segment_sizes()[i] = source_bytes.length();
+    // Set the active segments to being already dropped, since memory.init on
+    // a dropped passive segment and an active segment have the same
+    // behavior.
+    instance->data_segment_sizes()[i] =
+        segment.active ? 0 : source_bytes.length();
   }
 }
 
@@ -1739,11 +1286,7 @@ void WasmInstanceObject::InitElemSegmentArrays(
   auto module = module_object->module();
   auto num_elem_segments = module->elem_segments.size();
   for (size_t i = 0; i < num_elem_segments; ++i) {
-    const wasm::WasmElemSegment& segment = module->elem_segments[i];
-    // Set the active segments to being already dropped, since table.init on
-    // a dropped passive segment and an active segment have the same
-    // behavior.
-    instance->dropped_elem_segments()[i] = segment.active ? 1 : 0;
+    instance->dropped_elem_segments()[i] = 0;
   }
 }
 
@@ -1775,28 +1318,23 @@ bool WasmInstanceObject::CopyTableEntries(Isolate* isolate,
                                           uint32_t table_src_index,
                                           uint32_t dst, uint32_t src,
                                           uint32_t count) {
-  // Copying 0 elements is a no-op.
-  if (count == 0) return true;
   CHECK_LT(table_dst_index, instance->tables().length());
   CHECK_LT(table_src_index, instance->tables().length());
   auto table_dst = handle(
       WasmTableObject::cast(instance->tables().get(table_dst_index)), isolate);
   auto table_src = handle(
       WasmTableObject::cast(instance->tables().get(table_src_index)), isolate);
-  uint32_t max_dst = static_cast<uint32_t>(table_dst->entries().length());
-  uint32_t max_src = static_cast<uint32_t>(table_src->entries().length());
+  uint32_t max_dst = table_dst->current_length();
+  uint32_t max_src = table_src->current_length();
   bool copy_backward = src < dst;
-  bool ok = ClampToBounds(dst, &count, max_dst);
-  // Use & instead of && so the clamp is not short-circuited.
-  ok &= ClampToBounds(src, &count, max_src);
-
-  // If performing a partial copy when copying backward, then the first access
-  // will be out-of-bounds, so no entries should be copied.
-  if (copy_backward && !ok) return ok;
+  if (!base::IsInBounds(dst, count, max_dst) ||
+      !base::IsInBounds(src, count, max_src)) {
+    return false;
+  }
 
   // no-op
   if ((dst == src && table_dst_index == table_src_index) || count == 0) {
-    return ok;
+    return true;
   }
 
   for (uint32_t i = 0; i < count; ++i) {
@@ -1805,7 +1343,7 @@ bool WasmInstanceObject::CopyTableEntries(Isolate* isolate,
     auto value = WasmTableObject::Get(isolate, table_src, src_index);
     WasmTableObject::Set(isolate, table_dst, dst_index, value);
   }
-  return ok;
+  return true;
 }
 
 // static
@@ -1814,8 +1352,6 @@ bool WasmInstanceObject::InitTableEntries(Isolate* isolate,
                                           uint32_t table_index,
                                           uint32_t segment_index, uint32_t dst,
                                           uint32_t src, uint32_t count) {
-  // Copying 0 elements is a no-op.
-  if (count == 0) return true;
   // Note that this implementation just calls through to module instantiation.
   // This is intentional, so that the runtime only depends on the object
   // methods, and not the module instantiation logic.
@@ -1911,7 +1447,7 @@ void WasmInstanceObject::ImportWasmJSFunctionIntoTable(
   if (sig_id >= 0) {
     wasm::NativeModule* native_module =
         instance->module_object().native_module();
-    // TODO(mstarzinger): Cache and reuse wrapper code.
+    // TODO(wasm): Cache and reuse wrapper code.
     const wasm::WasmFeatures enabled = native_module->enabled_features();
     auto resolved = compiler::ResolveWasmImportCall(callable, sig, enabled);
     compiler::WasmImportCallKind kind = resolved.first;
@@ -1941,6 +1477,60 @@ void WasmInstanceObject::ImportWasmJSFunctionIntoTable(
       .Set(sig_id, call_target, *tuple);
 }
 
+// static
+uint8_t* WasmInstanceObject::GetGlobalStorage(
+    Handle<WasmInstanceObject> instance, const wasm::WasmGlobal& global) {
+  DCHECK(!wasm::ValueTypes::IsReferenceType(global.type));
+  if (global.mutability && global.imported) {
+    return reinterpret_cast<byte*>(
+        instance->imported_mutable_globals()[global.index]);
+  } else {
+    return instance->globals_start() + global.offset;
+  }
+}
+
+// static
+std::pair<Handle<FixedArray>, uint32_t>
+WasmInstanceObject::GetGlobalBufferAndIndex(Handle<WasmInstanceObject> instance,
+                                            const wasm::WasmGlobal& global) {
+  DCHECK(wasm::ValueTypes::IsReferenceType(global.type));
+  Isolate* isolate = instance->GetIsolate();
+  if (global.mutability && global.imported) {
+    Handle<FixedArray> buffer(
+        FixedArray::cast(
+            instance->imported_mutable_globals_buffers().get(global.index)),
+        isolate);
+    Address idx = instance->imported_mutable_globals()[global.index];
+    DCHECK_LE(idx, std::numeric_limits<uint32_t>::max());
+    return {buffer, static_cast<uint32_t>(idx)};
+  }
+  return {handle(instance->tagged_globals_buffer(), isolate), global.offset};
+}
+
+// static
+wasm::WasmValue WasmInstanceObject::GetGlobalValue(
+    Handle<WasmInstanceObject> instance, const wasm::WasmGlobal& global) {
+  Isolate* isolate = instance->GetIsolate();
+  if (wasm::ValueTypes::IsReferenceType(global.type)) {
+    Handle<FixedArray> global_buffer;  // The buffer of the global.
+    uint32_t global_index = 0;         // The index into the buffer.
+    std::tie(global_buffer, global_index) =
+        GetGlobalBufferAndIndex(instance, global);
+    return wasm::WasmValue(handle(global_buffer->get(global_index), isolate));
+  }
+  Address ptr = reinterpret_cast<Address>(GetGlobalStorage(instance, global));
+  using wasm::Simd128;
+  switch (global.type) {
+#define CASE_TYPE(valuetype, ctype) \
+  case wasm::valuetype:             \
+    return wasm::WasmValue(base::ReadLittleEndianValue<ctype>(ptr));
+    FOREACH_WASMVALUE_CTYPES(CASE_TYPE)
+#undef CASE_TYPE
+    default:
+      UNREACHABLE();
+  }
+}
+
 // static
 Handle<WasmExceptionObject> WasmExceptionObject::New(
     Isolate* isolate, const wasm::FunctionSig* sig,
@@ -2089,6 +1679,7 @@ uint32_t WasmExceptionPackage::GetEncodedSize(
         break;
       case wasm::kWasmAnyRef:
       case wasm::kWasmFuncRef:
+      case wasm::kWasmNullRef:
       case wasm::kWasmExnRef:
         encoded_size += 1;
         break;
@@ -2209,6 +1800,7 @@ Handle<WasmExportedFunction> WasmExportedFunction::New(
   DCHECK_EQ(is_asm_js_module, js_function->IsConstructor());
   js_function->shared().set_length(arity);
   js_function->shared().set_internal_formal_parameter_count(arity);
+  js_function->shared().set_script(instance->module_object().script());
   return Handle<WasmExportedFunction>::cast(js_function);
 }
 
@@ -2239,8 +1831,8 @@ Handle<WasmJSFunction> WasmJSFunction::New(Isolate* isolate,
   if (sig_size > 0) {
     serialized_sig->copy_in(0, sig->all().begin(), sig_size);
   }
-  // TODO(mstarzinger): Think about caching and sharing the JS-to-JS wrappers
-  // per signature instead of compiling a new one for every instantiation.
+  // TODO(wasm): Think about caching and sharing the JS-to-JS wrappers per
+  // signature instead of compiling a new one for every instantiation.
   Handle<Code> wrapper_code =
       compiler::CompileJSToJSWrapper(isolate, sig).ToHandleChecked();
   Handle<WasmJSFunctionData> function_data =
@@ -2317,12 +1909,13 @@ Handle<WasmExceptionTag> WasmExceptionTag::New(Isolate* isolate, int index) {
 
 Handle<AsmWasmData> AsmWasmData::New(
     Isolate* isolate, std::shared_ptr<wasm::NativeModule> native_module,
-    Handle<FixedArray> export_wrappers, Handle<ByteArray> asm_js_offset_table,
-    Handle<HeapNumber> uses_bitset) {
+    Handle<FixedArray> export_wrappers, Handle<HeapNumber> uses_bitset) {
   const WasmModule* module = native_module->module();
+  const bool kUsesLiftoff = false;
   size_t memory_estimate =
-      wasm::WasmCodeManager::EstimateNativeModuleCodeSize(module) +
-      wasm::WasmCodeManager::EstimateNativeModuleNonCodeSize(module);
+      wasm::WasmCodeManager::EstimateNativeModuleCodeSize(module,
+                                                          kUsesLiftoff) +
+      wasm::WasmCodeManager::EstimateNativeModuleMetaDataSize(module);
   Handle<Managed<wasm::NativeModule>> managed_native_module =
       Managed<wasm::NativeModule>::FromSharedPtr(isolate, memory_estimate,
                                                  std::move(native_module));
@@ -2330,12 +1923,11 @@ Handle<AsmWasmData> AsmWasmData::New(
       isolate->factory()->NewStruct(ASM_WASM_DATA_TYPE, AllocationType::kOld));
   result->set_managed_native_module(*managed_native_module);
   result->set_export_wrappers(*export_wrappers);
-  result->set_asm_js_offset_table(*asm_js_offset_table);
   result->set_uses_bitset(*uses_bitset);
   return result;
 }
 
-#undef TRACE
-#undef TRACE_IFT
 }  // namespace internal
 }  // namespace v8
+
+#undef TRACE_IFT
diff --git a/deps/v8/src/wasm/wasm-objects.h b/deps/v8/src/wasm/wasm-objects.h
index 23c13c4329942e..c0a7956e15f383 100644
--- a/deps/v8/src/wasm/wasm-objects.h
+++ b/deps/v8/src/wasm/wasm-objects.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "src/base/bit-field.h"
 #include "src/base/bits.h"
 #include "src/codegen/signature.h"
 #include "src/debug/debug.h"
@@ -27,7 +28,8 @@ class NativeModule;
 class SignatureMap;
 class WasmCode;
 struct WasmException;
-struct WasmFeatures;
+class WasmFeatures;
+struct WasmGlobal;
 class WasmInterpreter;
 struct WasmModule;
 class WasmValue;
@@ -118,6 +120,8 @@ class ImportedFunctionEntry {
   int const index_;
 };
 
+enum InternalizeString : bool { kInternalize = true, kNoInternalize = false };
+
 // Representation of a WebAssembly.Module JavaScript-level object.
 class WasmModuleObject : public JSObject {
  public:
@@ -126,7 +130,6 @@ class WasmModuleObject : public JSObject {
   DECL_ACCESSORS(managed_native_module, Managed<wasm::NativeModule>)
   DECL_ACCESSORS(export_wrappers, FixedArray)
   DECL_ACCESSORS(script, Script)
-  DECL_OPTIONAL_ACCESSORS(asm_js_offset_table, ByteArray)
   inline wasm::NativeModule* native_module() const;
   inline const std::shared_ptr<wasm::NativeModule>& shared_native_module()
       const;
@@ -152,30 +155,9 @@ class WasmModuleObject : public JSObject {
       Handle<Script> script, Handle<FixedArray> export_wrappers,
       size_t code_size_estimate);
 
-  // TODO(mstarzinger): The below breakpoint handling methods taking a {Script}
-  // instead of a {WasmModuleObject} as first argument should be moved onto a
-  // separate {WasmScript} class, implementation move to wasm-debug.cc then.
-
-  // Set a breakpoint on the given byte position inside the given module.
-  // This will affect all live and future instances of the module.
-  // The passed position might be modified to point to the next breakable
-  // location inside the same function.
-  // If it points outside a function, or behind the last breakable location,
-  // this function returns false and does not set any breakpoint.
-  V8_EXPORT_PRIVATE static bool SetBreakPoint(Handle<Script>, int* position,
-                                              Handle<BreakPoint> break_point);
-
-  // Remove a previously set breakpoint at the given byte position inside the
-  // given module. If this breakpoint is not found this function returns false.
-  V8_EXPORT_PRIVATE static bool ClearBreakPoint(Handle<Script>, int position,
-                                                Handle<BreakPoint> break_point);
-
   // Check whether this module was generated from asm.js source.
   inline bool is_asm_js();
 
-  static void SetBreakpointsOnNewInstance(Handle<Script>,
-                                          Handle<WasmInstanceObject>);
-
   // Get the module name, if set. Returns an empty handle otherwise.
   static MaybeHandle<String> GetModuleNameOrNull(Isolate*,
                                                  Handle<WasmModuleObject>);
@@ -199,40 +181,17 @@ class WasmModuleObject : public JSObject {
   // Does not allocate, hence gc-safe.
   Vector<const uint8_t> GetRawFunctionName(uint32_t func_index);
 
-  // Get the source position from a given function index and byte offset,
-  // for either asm.js or pure Wasm modules.
-  static int GetSourcePosition(Handle<WasmModuleObject>, uint32_t func_index,
-                               uint32_t byte_offset,
-                               bool is_at_number_conversion);
-
-  // Extract a portion of the wire bytes as UTF-8 string.
-  // Returns a null handle if the respective bytes do not form a valid UTF-8
-  // string.
-  static MaybeHandle<String> ExtractUtf8StringFromModuleBytes(
-      Isolate* isolate, Handle<WasmModuleObject>, wasm::WireBytesRef ref);
-  static MaybeHandle<String> ExtractUtf8StringFromModuleBytes(
-      Isolate* isolate, Vector<const uint8_t> wire_byte,
-      wasm::WireBytesRef ref);
-
-  // Get a list of all possible breakpoints within a given range of this module.
-  V8_EXPORT_PRIVATE static bool GetPossibleBreakpoints(
-      wasm::NativeModule* native_module, const debug::Location& start,
-      const debug::Location& end, std::vector<debug::BreakLocation>* locations);
-
-  // Return an empty handle if no breakpoint is hit at that location, or a
-  // FixedArray with all hit breakpoint objects.
-  static MaybeHandle<FixedArray> CheckBreakPoints(Isolate*, Handle<Script>,
-                                                  int position);
+  // Extract a portion of the wire bytes as UTF-8 string, optionally
+  // internalized. (Prefer to internalize early if the string will be used for a
+  // property lookup anyway.)
+  static Handle<String> ExtractUtf8StringFromModuleBytes(
+      Isolate*, Handle<WasmModuleObject>, wasm::WireBytesRef,
+      InternalizeString);
+  static Handle<String> ExtractUtf8StringFromModuleBytes(
+      Isolate*, Vector<const uint8_t> wire_byte, wasm::WireBytesRef,
+      InternalizeString);
 
   OBJECT_CONSTRUCTORS(WasmModuleObject, JSObject);
-
- private:
-  // Helper functions that update the breakpoint info list.
-  static void AddBreakpointToInfo(Handle<Script>, int position,
-                                  Handle<BreakPoint> break_point);
-
-  static bool RemoveBreakpointFromInfo(Handle<Script>, int position,
-                                       Handle<BreakPoint> break_point);
 };
 
 // Representation of a WebAssembly.Table JavaScript-level object.
@@ -240,7 +199,10 @@ class V8_EXPORT_PRIVATE WasmTableObject : public JSObject {
  public:
   DECL_CAST(WasmTableObject)
 
+  // The entries array is at least as big as {current_length()}, but might be
+  // bigger to make future growth more efficient.
   DECL_ACCESSORS(entries, FixedArray)
+  DECL_INT_ACCESSORS(current_length)
   // TODO(titzer): introduce DECL_I64_ACCESSORS macro
   DECL_ACCESSORS(maximum_length, Object)
   DECL_ACCESSORS(dispatch_tables, FixedArray)
@@ -253,7 +215,6 @@ class V8_EXPORT_PRIVATE WasmTableObject : public JSObject {
   DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
                                 TORQUE_GENERATED_WASM_TABLE_OBJECT_FIELDS)
 
-  inline uint32_t current_length();
   inline wasm::ValueType type();
 
   static int Grow(Isolate* isolate, Handle<WasmTableObject> table,
@@ -283,7 +244,7 @@ class V8_EXPORT_PRIVATE WasmTableObject : public JSObject {
   static void Fill(Isolate* isolate, Handle<WasmTableObject> table,
                    uint32_t start, Handle<Object> entry, uint32_t count);
 
-  // TODO(mstarzinger): Unify these three methods into one.
+  // TODO(wasm): Unify these three methods into one.
   static void UpdateDispatchTables(Isolate* isolate,
                                    Handle<WasmTableObject> table,
                                    int entry_index, wasm::FunctionSig* sig,
@@ -401,6 +362,7 @@ class WasmGlobalObject : public JSObject {
   inline void SetF32(float value);
   inline void SetF64(double value);
   inline void SetAnyRef(Handle<Object> value);
+  inline bool SetNullRef(Handle<Object> value);
   inline bool SetFuncRef(Isolate* isolate, Handle<Object> value);
 
  private:
@@ -447,7 +409,6 @@ class WasmInstanceObject : public JSObject {
   DECL_PRIMITIVE_ACCESSORS(jump_table_start, Address)
   DECL_PRIMITIVE_ACCESSORS(data_segment_starts, Address*)
   DECL_PRIMITIVE_ACCESSORS(data_segment_sizes, uint32_t*)
-  DECL_PRIMITIVE_ACCESSORS(dropped_data_segments, byte*)
   DECL_PRIMITIVE_ACCESSORS(dropped_elem_segments, byte*)
 
   // Clear uninitialized padding space. This ensures that the snapshot content
@@ -494,14 +455,12 @@ class WasmInstanceObject : public JSObject {
   V(kRealStackLimitAddressOffset, kSystemPointerSize)                     \
   V(kDataSegmentStartsOffset, kSystemPointerSize)                         \
   V(kDataSegmentSizesOffset, kSystemPointerSize)                          \
-  V(kDroppedDataSegmentsOffset, kSystemPointerSize)                       \
   V(kDroppedElemSegmentsOffset, kSystemPointerSize)                       \
-  /* Header size. */                                                      \
-  V(kSize, 0)
+  V(kHeaderSize, 0)
 
   DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
                                 WASM_INSTANCE_OBJECT_FIELDS)
-  STATIC_ASSERT(IsAligned(kSize, kTaggedSize));
+  STATIC_ASSERT(IsAligned(kHeaderSize, kTaggedSize));
   // TODO(ishell, v8:8875): When pointer compression is enabled 8-byte size
   // fields (external pointers, doubles and BigInt data) are only kTaggedSize
   // aligned so checking for alignments of fields bigger than kTaggedSize
@@ -597,6 +556,20 @@ class WasmInstanceObject : public JSObject {
                                             int table_index, int entry_index,
                                             Handle<WasmJSFunction> js_function);
 
+  // Get a raw pointer to the location where the given global is stored.
+  // {global} must not be a reference type.
+  static uint8_t* GetGlobalStorage(Handle<WasmInstanceObject>,
+                                   const wasm::WasmGlobal&);
+
+  // Get the FixedArray and the index in that FixedArray for the given global,
+  // which must be a reference type.
+  static std::pair<Handle<FixedArray>, uint32_t> GetGlobalBufferAndIndex(
+      Handle<WasmInstanceObject>, const wasm::WasmGlobal&);
+
+  // Get the value of a global in the given instance.
+  static wasm::WasmValue GetGlobalValue(Handle<WasmInstanceObject>,
+                                        const wasm::WasmGlobal&);
+
   OBJECT_CONSTRUCTORS(WasmInstanceObject, JSObject);
 
  private:
@@ -825,13 +798,14 @@ class WasmJSFunctionData : public Struct {
   OBJECT_CONSTRUCTORS(WasmJSFunctionData, Struct);
 };
 
+// Debug info used for wasm debugging in the interpreter. For Liftoff debugging,
+// all information is held off-heap in {wasm::DebugInfo}.
 class WasmDebugInfo : public Struct {
  public:
   NEVER_READ_ONLY_SPACE
   DECL_ACCESSORS(wasm_instance, WasmInstanceObject)
   DECL_ACCESSORS(interpreter_handle, Object)  // Foreign or undefined
   DECL_ACCESSORS(interpreter_reference_stack, Cell)
-  DECL_OPTIONAL_ACCESSORS(locals_names, FixedArray)
   DECL_OPTIONAL_ACCESSORS(c_wasm_entries, FixedArray)
   DECL_OPTIONAL_ACCESSORS(c_wasm_entry_map, Managed<wasm::SignatureMap>)
 
@@ -854,6 +828,10 @@ class WasmDebugInfo : public Struct {
   V8_EXPORT_PRIVATE static wasm::WasmInterpreter* SetupForTesting(
       Handle<WasmInstanceObject>);
 
+  // Prepare WasmDebugInfo for stepping in the given function.
+  V8_EXPORT_PRIVATE static void PrepareStepIn(Handle<WasmDebugInfo>,
+                                              int func_index);
+
   // Set a breakpoint in the given function at the given byte offset within that
   // function. This will redirect all future calls to this function to the
   // interpreter and will always pause at the given offset.
@@ -888,6 +866,8 @@ class WasmDebugInfo : public Struct {
   std::vector<std::pair<uint32_t, int>> GetInterpretedStack(
       Address frame_pointer);
 
+  int NumberOfActiveFrames(Address frame_pointer);
+
   V8_EXPORT_PRIVATE
   std::unique_ptr<wasm::InterpretedFrame, wasm::InterpretedFrameDeleter>
   GetInterpretedFrame(Address frame_pointer, int frame_index);
@@ -895,16 +875,8 @@ class WasmDebugInfo : public Struct {
   // Returns the number of calls / function frames executed in the interpreter.
   V8_EXPORT_PRIVATE uint64_t NumInterpretedCalls();
 
-  // Get scope details for a specific interpreted frame.
-  // Both of these methods return a JSArrays (for the global scope and local
-  // scope respectively) of size {ScopeIterator::kScopeDetailsSize} and layout
-  // as described in debug-scopes.h.
-  //   - The global scope contains information about globals and the memory.
-  //   - The local scope contains information about parameters, locals, and
-  //     stack values.
-  static Handle<JSObject> GetGlobalScopeObject(Handle<WasmDebugInfo>,
-                                               Address frame_pointer,
-                                               int frame_index);
+  // Get local scope details for a specific interpreted frame. It contains
+  // information about parameters, locals, and stack values.
   static Handle<JSObject> GetLocalScopeObject(Handle<WasmDebugInfo>,
                                               Address frame_pointer,
                                               int frame_index);
@@ -915,6 +887,62 @@ class WasmDebugInfo : public Struct {
   OBJECT_CONSTRUCTORS(WasmDebugInfo, Struct);
 };
 
+class WasmScript : public AllStatic {
+ public:
+  // Set a breakpoint on the given byte position inside the given module.
+  // This will affect all live and future instances of the module.
+  // The passed position might be modified to point to the next breakable
+  // location inside the same function.
+  // If it points outside a function, or behind the last breakable location,
+  // this function returns false and does not set any breakpoint.
+  V8_EXPORT_PRIVATE static bool SetBreakPoint(Handle<Script>, int* position,
+                                              Handle<BreakPoint> break_point);
+
+  // Set a breakpoint on first breakable position of the given function index
+  // inside the given module. This will affect all live and future instances of
+  // the module.
+  V8_EXPORT_PRIVATE static bool SetBreakPointOnFirstBreakableForFunction(
+      Handle<Script>, int function_index, Handle<BreakPoint> break_point);
+
+  // Set a breakpoint at the breakable offset of the given function index
+  // inside the given module. This will affect all live and future instances of
+  // the module.
+  V8_EXPORT_PRIVATE static bool SetBreakPointForFunction(
+      Handle<Script>, int function_index, int breakable_offset,
+      Handle<BreakPoint> break_point);
+
+  // Remove a previously set breakpoint at the given byte position inside the
+  // given module. If this breakpoint is not found this function returns false.
+  V8_EXPORT_PRIVATE static bool ClearBreakPoint(Handle<Script>, int position,
+                                                Handle<BreakPoint> break_point);
+
+  // Remove a previously set breakpoint by id. If this breakpoint is not found,
+  // returns false.
+  V8_EXPORT_PRIVATE static bool ClearBreakPointById(Handle<Script>,
+                                                    int breakpoint_id);
+
+  static void SetBreakpointsOnNewInstance(Handle<Script>,
+                                          Handle<WasmInstanceObject>);
+
+  // Get a list of all possible breakpoints within a given range of this module.
+  V8_EXPORT_PRIVATE static bool GetPossibleBreakpoints(
+      wasm::NativeModule* native_module, const debug::Location& start,
+      const debug::Location& end, std::vector<debug::BreakLocation>* locations);
+
+  // Return an empty handle if no breakpoint is hit at that location, or a
+  // FixedArray with all hit breakpoint objects.
+  static MaybeHandle<FixedArray> CheckBreakPoints(Isolate*, Handle<Script>,
+                                                  int position);
+
+ private:
+  // Helper functions that update the breakpoint info list.
+  static void AddBreakpointToInfo(Handle<Script>, int position,
+                                  Handle<BreakPoint> break_point);
+
+  static bool RemoveBreakpointFromInfo(Handle<Script>, int position,
+                                       Handle<BreakPoint> break_point);
+};
+
 // Tags provide an object identity for each exception defined in a wasm module
 // header. They are referenced by the following fields:
 //  - {WasmExceptionObject::exception_tag}  : The tag of the exception object.
@@ -935,16 +963,16 @@ class WasmExceptionTag
   TQ_OBJECT_CONSTRUCTORS(WasmExceptionTag)
 };
 
+// Data annotated to the asm.js Module function. Used for later instantiation of
+// that function.
 class AsmWasmData : public Struct {
  public:
   static Handle<AsmWasmData> New(
       Isolate* isolate, std::shared_ptr<wasm::NativeModule> native_module,
-      Handle<FixedArray> export_wrappers, Handle<ByteArray> asm_js_offset_table,
-      Handle<HeapNumber> uses_bitset);
+      Handle<FixedArray> export_wrappers, Handle<HeapNumber> uses_bitset);
 
   DECL_ACCESSORS(managed_native_module, Managed<wasm::NativeModule>)
   DECL_ACCESSORS(export_wrappers, FixedArray)
-  DECL_ACCESSORS(asm_js_offset_table, ByteArray)
   DECL_ACCESSORS(uses_bitset, HeapNumber)
 
   DECL_CAST(AsmWasmData)
diff --git a/deps/v8/src/wasm/wasm-objects.tq b/deps/v8/src/wasm/wasm-objects.tq
new file mode 100644
index 00000000000000..adb3c18cd584ee
--- /dev/null
+++ b/deps/v8/src/wasm/wasm-objects.tq
@@ -0,0 +1,95 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class WasmInstanceObject extends JSObject;
+
+extern class WasmExportedFunctionData extends Struct {
+  wrapper_code: Code;
+  instance: WasmInstanceObject;
+  jump_table_offset: Smi;
+  function_index: Smi;
+  // The remaining fields are for fast calling from C++. The contract is
+  // that they are lazily populated, and either all will be present or none.
+  c_wrapper_code: Object;
+  wasm_call_target: Smi|Foreign;
+  packed_args_size: Smi;
+}
+
+extern class WasmJSFunctionData extends Struct {
+  callable: JSReceiver;
+  wrapper_code: Code;
+  serialized_return_count: Smi;
+  serialized_parameter_count: Smi;
+  serialized_signature: ByteArray;  // PodArray<wasm::ValueType>
+}
+
+extern class WasmCapiFunctionData extends Struct {
+  call_target: RawPtr;
+  embedder_data: Foreign;  // Managed<wasm::FuncData>
+  wrapper_code: Code;
+  serialized_signature: ByteArray;  // PodArray<wasm::ValueType>
+}
+
+extern class WasmIndirectFunctionTable extends Struct {
+  size: uint32;
+  @if(TAGGED_SIZE_8_BYTES) optional_padding: uint32;
+  @ifnot(TAGGED_SIZE_8_BYTES) optional_padding: void;
+  sig_ids: RawPtr;
+  targets: RawPtr;
+  managed_native_allocations: Foreign|Undefined;
+  refs: FixedArray;
+}
+
+extern class WasmDebugInfo extends Struct {
+  instance: WasmInstanceObject;
+  interpreter_handle: Foreign|Undefined;
+  interpreter_reference_stack: Cell;
+  c_wasm_entries: FixedArray|Undefined;
+  c_wasm_entry_map: Foreign|Undefined;  // Managed<wasm::SignatureMap>
+}
+
+@generateCppClass
+extern class WasmExceptionTag extends Struct {
+  index: Smi;
+}
+
+extern class WasmModuleObject extends JSObject {
+  native_module: Foreign;
+  export_wrappers: FixedArray;
+  script: Script;
+}
+
+extern class WasmTableObject extends JSObject {
+  entries: FixedArray;
+  current_length: Smi;
+  maximum_length: Smi|HeapNumber|Undefined;
+  dispatch_tables: FixedArray;
+  raw_type: Smi;
+}
+
+extern class WasmMemoryObject extends JSObject {
+  array_buffer: JSArrayBuffer;
+  maximum_pages: Smi;
+  instances: WeakArrayList|Undefined;
+}
+
+extern class WasmGlobalObject extends JSObject {
+  untagged_buffer: JSArrayBuffer|Undefined;
+  tagged_buffer: FixedArray|Undefined;
+  offset: Smi;
+  flags: Smi;
+}
+
+extern class WasmExceptionObject extends JSObject {
+  serialized_signature: ByteArray;  // PodArray<wasm::ValueType>
+  exception_tag: HeapObject;
+}
+
+type WasmExportedFunction extends JSFunction;
+
+extern class AsmWasmData extends Struct {
+  managed_native_module: Foreign;  // Managed<wasm::NativeModule>
+  export_wrappers: FixedArray;
+  uses_bitset: HeapNumber;
+}
diff --git a/deps/v8/src/wasm/wasm-opcodes.cc b/deps/v8/src/wasm/wasm-opcodes.cc
index 3bd76ae43b8c08..7af21cf8a1c92d 100644
--- a/deps/v8/src/wasm/wasm-opcodes.cc
+++ b/deps/v8/src/wasm/wasm-opcodes.cc
@@ -31,6 +31,7 @@ namespace wasm {
 #define CASE_I16x8_OP(name, str) CASE_OP(I16x8##name, "i16x8." str)
 #define CASE_I8x16_OP(name, str) CASE_OP(I8x16##name, "i8x16." str)
 #define CASE_S128_OP(name, str) CASE_OP(S128##name, "s128." str)
+#define CASE_S64x2_OP(name, str) CASE_OP(S64x2##name, "s64x2." str)
 #define CASE_S32x4_OP(name, str) CASE_OP(S32x4##name, "s32x4." str)
 #define CASE_S16x8_OP(name, str) CASE_OP(S16x8##name, "s16x8." str)
 #define CASE_S8x16_OP(name, str) CASE_OP(S8x16##name, "s8x16." str)
@@ -306,6 +307,7 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
     CASE_S128_OP(Xor, "xor")
     CASE_S128_OP(Not, "not")
     CASE_S128_OP(Select, "select")
+    CASE_S128_OP(AndNot, "andnot")
     CASE_S8x16_OP(Swizzle, "swizzle")
     CASE_S8x16_OP(Shuffle, "shuffle")
     CASE_S1x2_OP(AnyTrue, "any_true")
@@ -321,6 +323,20 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
     CASE_F32x4_OP(Qfma, "qfma")
     CASE_F32x4_OP(Qfms, "qfms")
 
+    CASE_S8x16_OP(LoadSplat, "load_splat")
+    CASE_S16x8_OP(LoadSplat, "load_splat")
+    CASE_S32x4_OP(LoadSplat, "load_splat")
+    CASE_S64x2_OP(LoadSplat, "load_splat")
+    CASE_I16x8_OP(Load8x8S, "load8x8_s")
+    CASE_I16x8_OP(Load8x8U, "load8x8_u")
+    CASE_I32x4_OP(Load16x4S, "load16x4_s")
+    CASE_I32x4_OP(Load16x4U, "load16x4_u")
+    CASE_I64x2_OP(Load32x2S, "load32x2_s")
+    CASE_I64x2_OP(Load32x2U, "load32x2_u")
+
+    CASE_I8x16_OP(RoundingAverageU, "avgr_u")
+    CASE_I16x8_OP(RoundingAverageU, "avgr_u")
+
     // Atomic operations.
     CASE_OP(AtomicNotify, "atomic.notify")
     CASE_INT_OP(AtomicWait, "atomic.wait")
@@ -353,6 +369,7 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
 #undef CASE_I16x8_OP
 #undef CASE_I8x16_OP
 #undef CASE_S128_OP
+#undef CASE_S64x2_OP
 #undef CASE_S32x4_OP
 #undef CASE_S16x8_OP
 #undef CASE_S8x16_OP
@@ -408,19 +425,6 @@ bool WasmOpcodes::IsUnconditionalJump(WasmOpcode opcode) {
   }
 }
 
-bool WasmOpcodes::IsSignExtensionOpcode(WasmOpcode opcode) {
-  switch (opcode) {
-    case kExprI32SExtendI8:
-    case kExprI32SExtendI16:
-    case kExprI64SExtendI8:
-    case kExprI64SExtendI16:
-    case kExprI64SExtendI32:
-      return true;
-    default:
-      return false;
-  }
-}
-
 bool WasmOpcodes::IsAnyRefOpcode(WasmOpcode opcode) {
   switch (opcode) {
     case kExprRefNull:
@@ -460,11 +464,11 @@ std::ostream& operator<<(std::ostream& os, const FunctionSig& sig) {
 
 bool IsJSCompatibleSignature(const FunctionSig* sig,
                              const WasmFeatures& enabled_features) {
-  if (!enabled_features.mv && sig->return_count() > 1) {
+  if (!enabled_features.has_mv() && sig->return_count() > 1) {
     return false;
   }
   for (auto type : sig->all()) {
-    if (!enabled_features.bigint && type == kWasmI64) {
+    if (!enabled_features.has_bigint() && type == kWasmI64) {
       return false;
     }
 
@@ -495,64 +499,49 @@ constexpr const FunctionSig* kCachedSigs[] = {
     nullptr, FOREACH_SIGNATURE(DECLARE_SIG_ENTRY)};
 #undef DECLARE_SIG_ENTRY
 
-// gcc 4.7 - 4.9 has a bug which causes the constexpr attribute to get lost when
-// passing functions (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=52892). Hence
-// encapsulate these constexpr functions in functors.
-// TODO(clemensb): Remove this once we require gcc >= 5.0.
-
-struct GetShortOpcodeSigIndex {
-  constexpr WasmOpcodeSig operator()(byte opcode) const {
+constexpr WasmOpcodeSig GetShortOpcodeSigIndex(byte opcode) {
 #define CASE(name, opc, sig) opcode == opc ? kSigEnum_##sig:
     return FOREACH_SIMPLE_OPCODE(CASE) FOREACH_SIMPLE_PROTOTYPE_OPCODE(CASE)
         kSigEnum_None;
 #undef CASE
-  }
-};
+}
 
-struct GetAsmJsOpcodeSigIndex {
-  constexpr WasmOpcodeSig operator()(byte opcode) const {
+constexpr WasmOpcodeSig GetAsmJsOpcodeSigIndex(byte opcode) {
 #define CASE(name, opc, sig) opcode == opc ? kSigEnum_##sig:
     return FOREACH_ASMJS_COMPAT_OPCODE(CASE) kSigEnum_None;
 #undef CASE
-  }
-};
+}
 
-struct GetSimdOpcodeSigIndex {
-  constexpr WasmOpcodeSig operator()(byte opcode) const {
+constexpr WasmOpcodeSig GetSimdOpcodeSigIndex(byte opcode) {
 #define CASE(name, opc, sig) opcode == (opc & 0xFF) ? kSigEnum_##sig:
     return FOREACH_SIMD_0_OPERAND_OPCODE(CASE) FOREACH_SIMD_MEM_OPCODE(CASE)
         kSigEnum_None;
 #undef CASE
-  }
-};
+}
 
-struct GetAtomicOpcodeSigIndex {
-  constexpr WasmOpcodeSig operator()(byte opcode) const {
+constexpr WasmOpcodeSig GetAtomicOpcodeSigIndex(byte opcode) {
 #define CASE(name, opc, sig) opcode == (opc & 0xFF) ? kSigEnum_##sig:
     return FOREACH_ATOMIC_OPCODE(CASE) FOREACH_ATOMIC_0_OPERAND_OPCODE(CASE)
         kSigEnum_None;
 #undef CASE
 }
-};
 
-struct GetNumericOpcodeSigIndex {
-  constexpr WasmOpcodeSig operator()(byte opcode) const {
+constexpr WasmOpcodeSig GetNumericOpcodeSigIndex(byte opcode) {
 #define CASE(name, opc, sig) opcode == (opc & 0xFF) ? kSigEnum_##sig:
     return FOREACH_NUMERIC_OPCODE(CASE) kSigEnum_None;
 #undef CASE
-  }
-};
+}
 
 constexpr std::array<WasmOpcodeSig, 256> kShortSigTable =
-    base::make_array<256>(GetShortOpcodeSigIndex{});
+    base::make_array<256>(GetShortOpcodeSigIndex);
 constexpr std::array<WasmOpcodeSig, 256> kSimpleAsmjsExprSigTable =
-    base::make_array<256>(GetAsmJsOpcodeSigIndex{});
+    base::make_array<256>(GetAsmJsOpcodeSigIndex);
 constexpr std::array<WasmOpcodeSig, 256> kSimdExprSigTable =
-    base::make_array<256>(GetSimdOpcodeSigIndex{});
+    base::make_array<256>(GetSimdOpcodeSigIndex);
 constexpr std::array<WasmOpcodeSig, 256> kAtomicExprSigTable =
-    base::make_array<256>(GetAtomicOpcodeSigIndex{});
+    base::make_array<256>(GetAtomicOpcodeSigIndex);
 constexpr std::array<WasmOpcodeSig, 256> kNumericExprSigTable =
-    base::make_array<256>(GetNumericOpcodeSigIndex{});
+    base::make_array<256>(GetNumericOpcodeSigIndex);
 
 }  // namespace
 
diff --git a/deps/v8/src/wasm/wasm-opcodes.h b/deps/v8/src/wasm/wasm-opcodes.h
index f37f7f05207aec..53fe21f30fd2ed 100644
--- a/deps/v8/src/wasm/wasm-opcodes.h
+++ b/deps/v8/src/wasm/wasm-opcodes.h
@@ -15,7 +15,7 @@ namespace internal {
 
 namespace wasm {
 
-struct WasmFeatures;
+class WasmFeatures;
 
 std::ostream& operator<<(std::ostream& os, const FunctionSig& function);
 bool IsJSCompatibleSignature(const FunctionSig* sig, const WasmFeatures&);
@@ -220,15 +220,14 @@ bool IsJSCompatibleSignature(const FunctionSig* sig, const WasmFeatures&);
   V(I32ReinterpretF32, 0xbc, i_f) \
   V(I64ReinterpretF64, 0xbd, l_d) \
   V(F32ReinterpretI32, 0xbe, f_i) \
-  V(F64ReinterpretI64, 0xbf, d_l)
+  V(F64ReinterpretI64, 0xbf, d_l) \
+  V(I32SExtendI8, 0xc0, i_i)      \
+  V(I32SExtendI16, 0xc1, i_i)     \
+  V(I64SExtendI8, 0xc2, l_l)      \
+  V(I64SExtendI16, 0xc3, l_l)     \
+  V(I64SExtendI32, 0xc4, l_l)
 
-#define FOREACH_SIMPLE_PROTOTYPE_OPCODE(V) \
-  V(I32SExtendI8, 0xc0, i_i)               \
-  V(I32SExtendI16, 0xc1, i_i)              \
-  V(I64SExtendI8, 0xc2, l_l)               \
-  V(I64SExtendI16, 0xc3, l_l)              \
-  V(I64SExtendI32, 0xc4, l_l)              \
-  V(RefIsNull, 0xd1, i_r)
+#define FOREACH_SIMPLE_PROTOTYPE_OPCODE(V) V(RefIsNull, 0xd1, i_r)
 
 // For compatibility with Asm.js.
 #define FOREACH_ASMJS_COMPAT_OPCODE(V) \
@@ -421,6 +420,10 @@ bool IsJSCompatibleSignature(const FunctionSig* sig, const WasmFeatures&);
   V(F32x4SConvertI32x4, 0xfdaf, s_s)     \
   V(F32x4UConvertI32x4, 0xfdb0, s_s)     \
   V(S8x16Swizzle, 0xfdc0, s_ss)          \
+  V(S8x16LoadSplat, 0xfdc2, s_i)         \
+  V(S16x8LoadSplat, 0xfdc3, s_i)         \
+  V(S32x4LoadSplat, 0xfdc4, s_i)         \
+  V(S64x2LoadSplat, 0xfdc5, s_i)         \
   V(I8x16SConvertI16x8, 0xfdc6, s_ss)    \
   V(I8x16UConvertI16x8, 0xfdc7, s_ss)    \
   V(I16x8SConvertI32x4, 0xfdc8, s_ss)    \
@@ -433,6 +436,15 @@ bool IsJSCompatibleSignature(const FunctionSig* sig, const WasmFeatures&);
   V(I32x4SConvertI16x8High, 0xfdcf, s_s) \
   V(I32x4UConvertI16x8Low, 0xfdd0, s_s)  \
   V(I32x4UConvertI16x8High, 0xfdd1, s_s) \
+  V(I16x8Load8x8S, 0xfdd2, s_s)          \
+  V(I16x8Load8x8U, 0xfdd3, s_s)          \
+  V(I32x4Load16x4S, 0xfdd4, s_s)         \
+  V(I32x4Load16x4U, 0xfdd5, s_s)         \
+  V(I64x2Load32x2S, 0xfdd6, s_s)         \
+  V(I64x2Load32x2U, 0xfdd7, s_s)         \
+  V(S128AndNot, 0xfdd8, s_ss)            \
+  V(I8x16RoundingAverageU, 0xfdd9, s_ss) \
+  V(I16x8RoundingAverageU, 0xfdda, s_ss) \
   V(I16x8AddHoriz, 0xfdbd, s_ss)         \
   V(I32x4AddHoriz, 0xfdbe, s_ss)         \
   V(F32x4AddHoriz, 0xfdbf, s_ss)         \
@@ -657,7 +669,6 @@ class V8_EXPORT_PRIVATE WasmOpcodes {
   static FunctionSig* AsmjsSignature(WasmOpcode opcode);
   static bool IsPrefixOpcode(WasmOpcode opcode);
   static bool IsControlOpcode(WasmOpcode opcode);
-  static bool IsSignExtensionOpcode(WasmOpcode opcode);
   static bool IsAnyRefOpcode(WasmOpcode opcode);
   static bool IsThrowingOpcode(WasmOpcode opcode);
   // Check whether the given opcode always jumps, i.e. all instructions after
diff --git a/deps/v8/src/wasm/wasm-serialization.cc b/deps/v8/src/wasm/wasm-serialization.cc
index f1fa76b98a8443..c736a272b163ce 100644
--- a/deps/v8/src/wasm/wasm-serialization.cc
+++ b/deps/v8/src/wasm/wasm-serialization.cc
@@ -119,13 +119,12 @@ class Reader {
   const byte* pos_;
 };
 
-constexpr size_t kVersionSize = 4 * sizeof(uint32_t);
-
-void WriteVersion(Writer* writer) {
+void WriteHeader(Writer* writer) {
   writer->Write(SerializedData::kMagicNumber);
   writer->Write(Version::Hash());
   writer->Write(static_cast<uint32_t>(CpuFeatures::SupportedFeatures()));
   writer->Write(FlagList::Hash());
+  DCHECK_EQ(WasmSerializer::kHeaderSize, writer->bytes_written());
 }
 
 // On Intel, call sites are encoded as a displacement. For linking and for
@@ -438,16 +437,16 @@ WasmSerializer::WasmSerializer(NativeModule* native_module)
 
 size_t WasmSerializer::GetSerializedNativeModuleSize() const {
   NativeModuleSerializer serializer(native_module_, VectorOf(code_table_));
-  return kVersionSize + serializer.Measure();
+  return kHeaderSize + serializer.Measure();
 }
 
 bool WasmSerializer::SerializeNativeModule(Vector<byte> buffer) const {
   NativeModuleSerializer serializer(native_module_, VectorOf(code_table_));
-  size_t measured_size = kVersionSize + serializer.Measure();
+  size_t measured_size = kHeaderSize + serializer.Measure();
   if (buffer.size() < measured_size) return false;
 
   Writer writer(buffer);
-  WriteVersion(&writer);
+  WriteHeader(&writer);
 
   if (!serializer.Write(&writer)) return false;
   DCHECK_EQ(measured_size, writer.bytes_written());
@@ -498,7 +497,7 @@ bool NativeModuleDeserializer::ReadCode(uint32_t fn_index, Reader* reader) {
   size_t code_section_size = reader->Read<size_t>();
   if (code_section_size == 0) {
     DCHECK(FLAG_wasm_lazy_compilation ||
-           native_module_->enabled_features().compilation_hints);
+           native_module_->enabled_features().has_compilation_hints());
     native_module_->UseLazyStub(fn_index);
     return true;
   }
@@ -592,36 +591,58 @@ bool NativeModuleDeserializer::ReadCode(uint32_t fn_index, Reader* reader) {
   return true;
 }
 
-bool IsSupportedVersion(Vector<const byte> version) {
-  if (version.size() < kVersionSize) return false;
-  byte current_version[kVersionSize];
-  Writer writer({current_version, kVersionSize});
-  WriteVersion(&writer);
-  return memcmp(version.begin(), current_version, kVersionSize) == 0;
+bool IsSupportedVersion(Vector<const byte> header) {
+  if (header.size() < WasmSerializer::kHeaderSize) return false;
+  byte current_version[WasmSerializer::kHeaderSize];
+  Writer writer({current_version, WasmSerializer::kHeaderSize});
+  WriteHeader(&writer);
+  return memcmp(header.begin(), current_version, WasmSerializer::kHeaderSize) ==
+         0;
 }
 
 MaybeHandle<WasmModuleObject> DeserializeNativeModule(
     Isolate* isolate, Vector<const byte> data,
-    Vector<const byte> wire_bytes_vec) {
+    Vector<const byte> wire_bytes_vec, Vector<const char> source_url) {
   if (!IsWasmCodegenAllowed(isolate, isolate->native_context())) return {};
   if (!IsSupportedVersion(data)) return {};
 
   ModuleWireBytes wire_bytes(wire_bytes_vec);
   // TODO(titzer): module features should be part of the serialization format.
-  WasmFeatures enabled_features = WasmFeaturesFromIsolate(isolate);
-  ModuleResult decode_result =
-      DecodeWasmModule(enabled_features, wire_bytes.start(), wire_bytes.end(),
-                       false, i::wasm::kWasmOrigin, isolate->counters(),
-                       isolate->wasm_engine()->allocator());
+  WasmEngine* wasm_engine = isolate->wasm_engine();
+  WasmFeatures enabled_features = WasmFeatures::FromIsolate(isolate);
+  ModuleResult decode_result = DecodeWasmModule(
+      enabled_features, wire_bytes.start(), wire_bytes.end(), false,
+      i::wasm::kWasmOrigin, isolate->counters(), wasm_engine->allocator());
   if (decode_result.failed()) return {};
-  CHECK_NOT_NULL(decode_result.value());
-  WasmModule* module = decode_result.value().get();
+  std::shared_ptr<WasmModule> module = std::move(decode_result.value());
+  CHECK_NOT_NULL(module);
   Handle<Script> script =
-      CreateWasmScript(isolate, wire_bytes, module->source_map_url);
+      CreateWasmScript(isolate, wire_bytes, VectorOf(module->source_map_url),
+                       module->name, source_url);
+
+  auto shared_native_module =
+      wasm_engine->MaybeGetNativeModule(module->origin, wire_bytes_vec);
+  if (shared_native_module == nullptr) {
+    const bool kIncludeLiftoff = false;
+    size_t code_size_estimate =
+        wasm::WasmCodeManager::EstimateNativeModuleCodeSize(module.get(),
+                                                            kIncludeLiftoff);
+    shared_native_module = wasm_engine->NewNativeModule(
+        isolate, enabled_features, std::move(module), code_size_estimate);
+    shared_native_module->SetWireBytes(
+        OwnedVector<uint8_t>::Of(wire_bytes_vec));
+
+    NativeModuleDeserializer deserializer(shared_native_module.get());
+    WasmCodeRefScope wasm_code_ref_scope;
+
+    Reader reader(data + WasmSerializer::kHeaderSize);
+    bool error = !deserializer.Read(&reader);
+    wasm_engine->UpdateNativeModuleCache(shared_native_module, error);
+    if (error) return {};
+  }
 
-  auto shared_native_module = isolate->wasm_engine()->NewNativeModule(
-      isolate, enabled_features, std::move(decode_result.value()));
-  shared_native_module->SetWireBytes(OwnedVector<uint8_t>::Of(wire_bytes_vec));
+  // Log the code within the generated module for profiling.
+  shared_native_module->LogWasmCodes(isolate);
 
   Handle<FixedArray> export_wrappers;
   CompileJsToWasmWrappers(isolate, shared_native_module->module(),
@@ -629,16 +650,6 @@ MaybeHandle<WasmModuleObject> DeserializeNativeModule(
 
   Handle<WasmModuleObject> module_object = WasmModuleObject::New(
       isolate, std::move(shared_native_module), script, export_wrappers);
-  NativeModule* native_module = module_object->native_module();
-
-  NativeModuleDeserializer deserializer(native_module);
-  WasmCodeRefScope wasm_code_ref_scope;
-
-  Reader reader(data + kVersionSize);
-  if (!deserializer.Read(&reader)) return {};
-
-  // Log the code within the generated module for profiling.
-  native_module->LogWasmCodes(isolate);
 
   // Finish the Wasm script now and make it public to the debugger.
   isolate->debug()->OnAfterCompile(script);
diff --git a/deps/v8/src/wasm/wasm-serialization.h b/deps/v8/src/wasm/wasm-serialization.h
index f35bc7346056d9..1e86a7b0633987 100644
--- a/deps/v8/src/wasm/wasm-serialization.h
+++ b/deps/v8/src/wasm/wasm-serialization.h
@@ -25,6 +25,21 @@ class V8_EXPORT_PRIVATE WasmSerializer {
   // success and false if the given buffer it too small for serialization.
   bool SerializeNativeModule(Vector<byte> buffer) const;
 
+  // The data header consists of uint32_t-sized entries (see {WriteVersion}):
+  // [0] magic number
+  // [1] version hash
+  // [2] supported CPU features
+  // [3] flag hash
+  // ...  number of functions
+  // ... serialized functions
+  static constexpr size_t kMagicNumberOffset = 0;
+  static constexpr size_t kVersionHashOffset = kMagicNumberOffset + kUInt32Size;
+  static constexpr size_t kSupportedCPUFeaturesOffset =
+      kVersionHashOffset + kUInt32Size;
+  static constexpr size_t kFlagHashOffset =
+      kSupportedCPUFeaturesOffset + kUInt32Size;
+  static constexpr size_t kHeaderSize = 4 * kUInt32Size;
+
  private:
   NativeModule* native_module_;
   std::vector<WasmCode*> code_table_;
@@ -35,8 +50,9 @@ class V8_EXPORT_PRIVATE WasmSerializer {
 bool IsSupportedVersion(Vector<const byte> data);
 
 // Deserializes the given data to create a Wasm module object.
-MaybeHandle<WasmModuleObject> DeserializeNativeModule(
-    Isolate* isolate, Vector<const byte> data, Vector<const byte> wire_bytes);
+V8_EXPORT_PRIVATE MaybeHandle<WasmModuleObject> DeserializeNativeModule(
+    Isolate*, Vector<const byte> data, Vector<const byte> wire_bytes,
+    Vector<const char> source_url);
 
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/src/wasm/wasm-text.cc b/deps/v8/src/wasm/wasm-text.cc
deleted file mode 100644
index fedd37ccd384d9..00000000000000
--- a/deps/v8/src/wasm/wasm-text.cc
+++ /dev/null
@@ -1,381 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/wasm/wasm-text.h"
-
-#include "src/debug/interface-types.h"
-#include "src/utils/ostreams.h"
-#include "src/utils/vector.h"
-#include "src/objects/objects-inl.h"
-#include "src/wasm/function-body-decoder-impl.h"
-#include "src/wasm/function-body-decoder.h"
-#include "src/wasm/wasm-module.h"
-#include "src/wasm/wasm-opcodes.h"
-#include "src/zone/zone.h"
-
-namespace v8 {
-namespace internal {
-namespace wasm {
-
-namespace {
-bool IsValidFunctionName(const Vector<const char> &name) {
-  if (name.empty()) return false;
-  const char *special_chars = "_.+-*/\\^~=<>!?@#$%&|:'`";
-  for (char c : name) {
-    bool valid_char = (c >= '0' && c <= '9') || (c >= 'a' && c <= 'z') ||
-                      (c >= 'A' && c <= 'Z') || strchr(special_chars, c);
-    if (!valid_char) return false;
-  }
-  return true;
-}
-
-}  // namespace
-
-void PrintWasmText(const WasmModule* module, const ModuleWireBytes& wire_bytes,
-                   uint32_t func_index, std::ostream& os,
-                   debug::WasmDisassembly::OffsetTable* offset_table) {
-  DCHECK_NOT_NULL(module);
-  DCHECK_GT(module->functions.size(), func_index);
-  const WasmFunction *fun = &module->functions[func_index];
-
-  AccountingAllocator allocator;
-  Zone zone(&allocator, ZONE_NAME);
-  int line_nr = 0;
-  int control_depth = 1;
-
-  // Print the function signature.
-  os << "func";
-  WasmName fun_name = wire_bytes.GetNameOrNull(fun, module);
-  if (IsValidFunctionName(fun_name)) {
-    os << " $";
-    os.write(fun_name.begin(), fun_name.length());
-  }
-  if (fun->sig->parameter_count()) {
-    os << " (param";
-    for (auto param : fun->sig->parameters())
-      os << ' ' << ValueTypes::TypeName(param);
-    os << ')';
-  }
-  if (fun->sig->return_count()) {
-    os << " (result";
-    for (auto ret : fun->sig->returns()) os << ' ' << ValueTypes::TypeName(ret);
-    os << ')';
-  }
-  os << "\n";
-  ++line_nr;
-
-  // Print the local declarations.
-  BodyLocalDecls decls(&zone);
-  Vector<const byte> func_bytes = wire_bytes.GetFunctionBytes(fun);
-  BytecodeIterator i(func_bytes.begin(), func_bytes.end(), &decls);
-  DCHECK_LT(func_bytes.begin(), i.pc());
-  if (!decls.type_list.empty()) {
-    os << "(local";
-    for (const ValueType &v : decls.type_list) {
-      os << ' ' << ValueTypes::TypeName(v);
-    }
-    os << ")\n";
-    ++line_nr;
-  }
-
-  for (; i.has_next(); i.next()) {
-    WasmOpcode opcode = i.current();
-    if (opcode == kExprElse || opcode == kExprCatch || opcode == kExprEnd) {
-      --control_depth;
-    }
-
-    DCHECK_LE(0, control_depth);
-    const int kMaxIndentation = 64;
-    int indentation = std::min(kMaxIndentation, 2 * control_depth);
-    if (offset_table) {
-      offset_table->emplace_back(i.pc_offset(), line_nr, indentation);
-    }
-
-    // 64 whitespaces
-    const char padding[kMaxIndentation + 1] =
-        "                                                                ";
-    os.write(padding, indentation);
-
-    switch (opcode) {
-      case kExprLoop:
-      case kExprIf:
-      case kExprBlock:
-      case kExprTry: {
-        BlockTypeImmediate<Decoder::kNoValidate> imm(kAllWasmFeatures, &i,
-                                                     i.pc());
-        os << WasmOpcodes::OpcodeName(opcode);
-        if (imm.type == kWasmBottom) {
-          os << " (type " << imm.sig_index << ")";
-        } else if (imm.out_arity() > 0) {
-          os << " " << ValueTypes::TypeName(imm.out_type(0));
-        }
-        control_depth++;
-        break;
-      }
-      case kExprBr:
-      case kExprBrIf: {
-        BranchDepthImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-        os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.depth;
-        break;
-      }
-      case kExprBrOnExn: {
-        BranchOnExceptionImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-        os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.depth.depth << ' '
-           << imm.index.index;
-        break;
-      }
-      case kExprElse:
-      case kExprCatch:
-        os << WasmOpcodes::OpcodeName(opcode);
-        control_depth++;
-        break;
-      case kExprEnd:
-        os << "end";
-        break;
-      case kExprBrTable: {
-        BranchTableImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-        BranchTableIterator<Decoder::kNoValidate> iterator(&i, imm);
-        os << "br_table";
-        while (iterator.has_next()) os << ' ' << iterator.next();
-        break;
-      }
-      case kExprCallIndirect:
-      case kExprReturnCallIndirect: {
-        CallIndirectImmediate<Decoder::kNoValidate> imm(kAllWasmFeatures, &i,
-                                                        i.pc());
-        DCHECK_EQ(0, imm.table_index);
-        os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.sig_index;
-        break;
-      }
-      case kExprCallFunction:
-      case kExprReturnCall: {
-        CallFunctionImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-        os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.index;
-        break;
-      }
-      case kExprLocalGet:
-      case kExprLocalSet:
-      case kExprLocalTee: {
-        LocalIndexImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-        os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.index;
-        break;
-      }
-      case kExprThrow: {
-        ExceptionIndexImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-        os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.index;
-        break;
-      }
-      case kExprGlobalGet:
-      case kExprGlobalSet: {
-        GlobalIndexImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-        os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.index;
-        break;
-      }
-      case kExprTableGet:
-      case kExprTableSet: {
-        TableIndexImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-        os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.index;
-        break;
-      }
-      case kExprSelectWithType: {
-        SelectTypeImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-        os << WasmOpcodes::OpcodeName(opcode) << ' '
-           << ValueTypes::TypeName(imm.type);
-        break;
-      }
-#define CASE_CONST(type, str, cast_type)                        \
-  case kExpr##type##Const: {                                    \
-    Imm##type##Immediate<Decoder::kNoValidate> imm(&i, i.pc()); \
-    os << #str ".const " << static_cast<cast_type>(imm.value);  \
-    break;                                                      \
-  }
-        CASE_CONST(I32, i32, int32_t)
-        CASE_CONST(I64, i64, int64_t)
-        CASE_CONST(F32, f32, float)
-        CASE_CONST(F64, f64, double)
-#undef CASE_CONST
-
-      case kExprRefFunc: {
-        FunctionIndexImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-        os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.index;
-        break;
-      }
-
-#define CASE_OPCODE(opcode, _, __) case kExpr##opcode:
-        FOREACH_LOAD_MEM_OPCODE(CASE_OPCODE)
-        FOREACH_STORE_MEM_OPCODE(CASE_OPCODE) {
-          MemoryAccessImmediate<Decoder::kNoValidate> imm(&i, i.pc(),
-                                                          kMaxUInt32);
-          os << WasmOpcodes::OpcodeName(opcode) << " offset=" << imm.offset
-             << " align=" << (1ULL << imm.alignment);
-          break;
-        }
-
-        FOREACH_SIMPLE_OPCODE(CASE_OPCODE)
-        FOREACH_SIMPLE_PROTOTYPE_OPCODE(CASE_OPCODE)
-      case kExprUnreachable:
-      case kExprNop:
-      case kExprReturn:
-      case kExprMemorySize:
-      case kExprMemoryGrow:
-      case kExprDrop:
-      case kExprSelect:
-      case kExprRethrow:
-      case kExprRefNull:
-        os << WasmOpcodes::OpcodeName(opcode);
-        break;
-
-      case kNumericPrefix: {
-        WasmOpcode numeric_opcode = i.prefixed_opcode();
-        switch (numeric_opcode) {
-          case kExprI32SConvertSatF32:
-          case kExprI32UConvertSatF32:
-          case kExprI32SConvertSatF64:
-          case kExprI32UConvertSatF64:
-          case kExprI64SConvertSatF32:
-          case kExprI64UConvertSatF32:
-          case kExprI64SConvertSatF64:
-          case kExprI64UConvertSatF64:
-          case kExprMemoryCopy:
-          case kExprMemoryFill:
-            os << WasmOpcodes::OpcodeName(opcode);
-            break;
-          case kExprMemoryInit: {
-            MemoryInitImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-            os << WasmOpcodes::OpcodeName(opcode) << ' '
-               << imm.data_segment_index;
-            break;
-          }
-          case kExprDataDrop: {
-            DataDropImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-            os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.index;
-            break;
-          }
-          case kExprTableInit: {
-            TableInitImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-            os << WasmOpcodes::OpcodeName(opcode) << ' '
-               << imm.elem_segment_index << ' ' << imm.table.index;
-            break;
-          }
-          case kExprElemDrop: {
-            ElemDropImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-            os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.index;
-            break;
-          }
-          case kExprTableCopy: {
-            TableCopyImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-            os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.table_src.index
-               << ' ' << imm.table_dst.index;
-            break;
-          }
-          case kExprTableGrow:
-          case kExprTableSize:
-          case kExprTableFill: {
-            TableIndexImmediate<Decoder::kNoValidate> imm(&i, i.pc() + 1);
-            os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.index;
-            break;
-          }
-          default:
-            UNREACHABLE();
-            break;
-        }
-        break;
-      }
-
-      case kSimdPrefix: {
-        WasmOpcode simd_opcode = i.prefixed_opcode();
-        switch (simd_opcode) {
-          case kExprS128LoadMem:
-          case kExprS128StoreMem: {
-            MemoryAccessImmediate<Decoder::kNoValidate> imm(&i, i.pc(),
-                                                            kMaxUInt32);
-            os << WasmOpcodes::OpcodeName(opcode) << " offset=" << imm.offset
-               << " align=" << (1ULL << imm.alignment);
-            break;
-          }
-
-          case kExprS8x16Shuffle: {
-            Simd8x16ShuffleImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-            os << WasmOpcodes::OpcodeName(opcode);
-            for (uint8_t v : imm.shuffle) {
-              os << ' ' << v;
-            }
-            break;
-          }
-
-          case kExprI8x16ExtractLaneS:
-          case kExprI8x16ExtractLaneU:
-          case kExprI16x8ExtractLaneS:
-          case kExprI16x8ExtractLaneU:
-          case kExprI32x4ExtractLane:
-          case kExprI64x2ExtractLane:
-          case kExprF32x4ExtractLane:
-          case kExprF64x2ExtractLane:
-          case kExprI8x16ReplaceLane:
-          case kExprI16x8ReplaceLane:
-          case kExprI32x4ReplaceLane:
-          case kExprI64x2ReplaceLane:
-          case kExprF32x4ReplaceLane:
-          case kExprF64x2ReplaceLane: {
-            SimdLaneImmediate<Decoder::kNoValidate> imm(&i, i.pc());
-            os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.lane;
-            break;
-          }
-
-            FOREACH_SIMD_0_OPERAND_OPCODE(CASE_OPCODE) {
-              os << WasmOpcodes::OpcodeName(opcode);
-              break;
-            }
-
-          default:
-            UNREACHABLE();
-            break;
-        }
-        break;
-      }
-
-      case kAtomicPrefix: {
-        WasmOpcode atomic_opcode = i.prefixed_opcode();
-        switch (atomic_opcode) {
-          FOREACH_ATOMIC_OPCODE(CASE_OPCODE) {
-            MemoryAccessImmediate<Decoder::kNoValidate> imm(&i, i.pc() + 1,
-                                                            kMaxUInt32);
-            os << WasmOpcodes::OpcodeName(atomic_opcode)
-               << " offset=" << imm.offset
-               << " align=" << (1ULL << imm.alignment);
-            break;
-          }
-          FOREACH_ATOMIC_0_OPERAND_OPCODE(CASE_OPCODE) {
-            os << WasmOpcodes::OpcodeName(atomic_opcode);
-            break;
-          }
-          default:
-            UNREACHABLE();
-            break;
-        }
-        break;
-      }
-
-        // This group is just printed by their internal opcode name, as they
-        // should never be shown to end-users.
-        FOREACH_ASMJS_COMPAT_OPCODE(CASE_OPCODE) {
-          os << WasmOpcodes::OpcodeName(opcode);
-        }
-        break;
-#undef CASE_OPCODE
-
-      default:
-        UNREACHABLE();
-        break;
-    }
-    os << '\n';
-    ++line_nr;
-  }
-  DCHECK_EQ(0, control_depth);
-  DCHECK(i.ok());
-}
-
-}  // namespace wasm
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/wasm/wasm-text.h b/deps/v8/src/wasm/wasm-text.h
deleted file mode 100644
index 205df5e6fd3ca5..00000000000000
--- a/deps/v8/src/wasm/wasm-text.h
+++ /dev/null
@@ -1,39 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_WASM_WASM_TEXT_H_
-#define V8_WASM_WASM_TEXT_H_
-
-#include <cstdint>
-#include <ostream>
-#include <vector>
-
-#include "src/common/globals.h"
-
-namespace v8 {
-
-namespace debug {
-struct WasmDisassemblyOffsetTableEntry;
-}  // namespace debug
-
-namespace internal {
-namespace wasm {
-
-// Forward declaration.
-struct WasmModule;
-struct ModuleWireBytes;
-
-// Generate disassembly according to official text format.
-// Output disassembly to the given output stream, and optionally return an
-// offset table of <byte offset, line, column> via the given pointer.
-V8_EXPORT_PRIVATE void PrintWasmText(
-    const WasmModule* module, const ModuleWireBytes& wire_bytes,
-    uint32_t func_index, std::ostream& os,
-    std::vector<debug::WasmDisassemblyOffsetTableEntry>* offset_table);
-
-}  // namespace wasm
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_WASM_WASM_TEXT_H_
diff --git a/deps/v8/src/wasm/wasm-value.h b/deps/v8/src/wasm/wasm-value.h
index 8de53b96cf85b9..9a6f0ca7262807 100644
--- a/deps/v8/src/wasm/wasm-value.h
+++ b/deps/v8/src/wasm/wasm-value.h
@@ -32,11 +32,8 @@ FOREACH_SIMD_TYPE(DEFINE_SIMD_TYPE)
 
 class Simd128 {
  public:
-  Simd128() : val_() {
-    for (size_t i = 0; i < 16; i++) {
-      val_[i] = 0;
-    }
-  }
+  Simd128() = default;
+
 #define DEFINE_SIMD_TYPE_SPECIFIC_METHODS(cType, sType, name, size)          \
   explicit Simd128(sType val) {                                              \
     base::WriteUnalignedValue<sType>(reinterpret_cast<Address>(val_), val);  \
@@ -48,7 +45,7 @@ class Simd128 {
 #undef DEFINE_SIMD_TYPE_SPECIFIC_METHODS
 
  private:
-  uint8_t val_[16];
+  uint8_t val_[16] = {0};
 };
 
 // Macro for defining WasmValue methods for different types.
diff --git a/deps/v8/src/zone/zone-containers.h b/deps/v8/src/zone/zone-containers.h
index 2aa2f122a93772..638ddd221355ed 100644
--- a/deps/v8/src/zone/zone-containers.h
+++ b/deps/v8/src/zone/zone-containers.h
@@ -66,8 +66,8 @@ class ZoneDeque : public std::deque<T, RecyclingZoneAllocator<T>> {
 
 // A wrapper subclass for std::list to make it easy to construct one
 // that uses a zone allocator.
-// TODO(mstarzinger): This should be renamed to ZoneList once we got rid of our
-// own home-grown ZoneList that actually is a ZoneVector.
+// TODO(all): This should be renamed to ZoneList once we got rid of our own
+// home-grown ZoneList that actually is a ZoneVector.
 template <typename T>
 class ZoneLinkedList : public std::list<T, ZoneAllocator<T>> {
  public:
diff --git a/deps/v8/test/BUILD.gn b/deps/v8/test/BUILD.gn
index 6bf9ca643d6bf6..f6d30537a83a5e 100644
--- a/deps/v8/test/BUILD.gn
+++ b/deps/v8/test/BUILD.gn
@@ -14,7 +14,6 @@ group("gn_all") {
     "message:v8_message",
     "mjsunit:v8_mjsunit",
     "mozilla:v8_mozilla",
-    "preparser:v8_preparser",
     "test262:v8_test262",
     "wasm-js:v8_wasm_js",
     "wasm-spec-tests:v8_wasm_spec_tests",
@@ -46,21 +45,14 @@ group("v8_perf") {
 
   data_deps = [
     "..:v8_python_base",
-    "cctest:cctest",
     "..:d8",
     "../tools:v8_android_test_runner_deps",
+    "../tools:v8_testrunner",
   ]
 
   data = [
     "../tools/run_perf.py",
 
-    # TODO(machenbach): These files are referenced by the perf runner.
-    # They should be transformed into a proper python module.
-    "../tools/testrunner/local/android.py",
-    "../tools/testrunner/local/command.py",
-    "../tools/testrunner/local/utils.py",
-    "../tools/testrunner/objects/output.py",
-
     # This is often used to trigger performance bots. We include it in the
     # isolate to not get these builds deduped.
     "../tools/whitespace.txt",
@@ -81,7 +73,6 @@ group("v8_bot_default") {
     "message:v8_message",
     "mjsunit:v8_mjsunit",
     "mkgrokdump:mkgrokdump",
-    "preparser:v8_preparser",
     "unittests:unittests",
     "wasm-api-tests:wasm_api_tests",
     "wasm-js:v8_wasm_js",
@@ -102,7 +93,6 @@ group("v8_default") {
     "message:v8_message",
     "mjsunit:v8_mjsunit",
     "mkgrokdump:mkgrokdump",
-    "preparser:v8_preparser",
     "unittests:unittests",
     "wasm-api-tests:wasm_api_tests",
     "wasm-js:v8_wasm_js",
@@ -131,7 +121,6 @@ group("v8_d8_default") {
     "intl:v8_intl",
     "message:v8_message",
     "mjsunit:v8_mjsunit",
-    "preparser:v8_preparser",
     "webkit:v8_webkit",
   ]
 }
diff --git a/deps/v8/test/benchmarks/benchmarks.status b/deps/v8/test/benchmarks/benchmarks.status
index 4941ac2be6f9ab..1ad433bb23ca8b 100644
--- a/deps/v8/test/benchmarks/benchmarks.status
+++ b/deps/v8/test/benchmarks/benchmarks.status
@@ -82,8 +82,4 @@
   'octane/typescript': [SKIP],
 }],  # 'predictable'
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
 ]
diff --git a/deps/v8/test/cctest/BUILD.gn b/deps/v8/test/cctest/BUILD.gn
index 6d6bcdcd67fce4..ee6407c74bb138 100644
--- a/deps/v8/test/cctest/BUILD.gn
+++ b/deps/v8/test/cctest/BUILD.gn
@@ -145,6 +145,7 @@ v8_source_set("cctest_sources") {
     "heap/test-iterators.cc",
     "heap/test-lab.cc",
     "heap/test-mark-compact.cc",
+    "heap/test-memory-measurement.cc",
     "heap/test-page-promotion.cc",
     "heap/test-spaces.cc",
     "heap/test-unmapper.cc",
@@ -182,6 +183,7 @@ v8_source_set("cctest_sources") {
     "test-api-interceptors.cc",
     "test-api-stack-traces.cc",
     "test-api-typed-array.cc",
+    "test-api-wasm.cc",
     "test-api.cc",
     "test-api.h",
     "test-array-list.cc",
@@ -192,6 +194,7 @@ v8_source_set("cctest_sources") {
     "test-bit-vector.cc",
     "test-circular-queue.cc",
     "test-code-layout.cc",
+    "test-code-pages.cc",
     "test-code-stub-assembler.cc",
     "test-compiler.cc",
     "test-constantpool.cc",
@@ -257,6 +260,7 @@ v8_source_set("cctest_sources") {
     "test-types.cc",
     "test-unboxed-doubles.cc",
     "test-unscopables-hidden-prototype.cc",
+    "test-unwinder-code-pages.cc",
     "test-unwinder.cc",
     "test-usecounters.cc",
     "test-utils.cc",
@@ -269,8 +273,10 @@ v8_source_set("cctest_sources") {
     "unicode-helpers.cc",
     "unicode-helpers.h",
     "wasm/test-c-wasm-entry.cc",
+    "wasm/test-compilation-cache.cc",
     "wasm/test-grow-memory.cc",
     "wasm/test-jump-table-assembler.cc",
+    "wasm/test-liftoff-inspection.cc",
     "wasm/test-run-wasm-64.cc",
     "wasm/test-run-wasm-asmjs.cc",
     "wasm/test-run-wasm-atomics.cc",
@@ -281,6 +287,7 @@ v8_source_set("cctest_sources") {
     "wasm/test-run-wasm-js.cc",
     "wasm/test-run-wasm-module.cc",
     "wasm/test-run-wasm-sign-extension.cc",
+    "wasm/test-run-wasm-simd-liftoff.cc",
     "wasm/test-run-wasm-simd.cc",
     "wasm/test-run-wasm.cc",
     "wasm/test-streaming-compilation.cc",
@@ -297,16 +304,6 @@ v8_source_set("cctest_sources") {
     "wasm/wasm-run-utils.h",
   ]
 
-  if (use_jumbo_build) {
-    jumbo_excluded_sources = [
-      # TODO(mostynb@opera.com): figure out the jumbo issues with these source
-      # files, and include them in jumbo compilation units.
-      "interpreter/bytecode-expectations-printer.cc",
-      "interpreter/test-bytecode-generator.cc",
-      "test-api.cc",
-    ]
-  }
-
   if (v8_current_cpu == "arm") {
     sources += [  ### gcmole(arch:arm) ###
       "assembler-helper-arm.cc",
diff --git a/deps/v8/test/cctest/cctest.h b/deps/v8/test/cctest/cctest.h
index 3de8baa3e4f361..8a5a5a6d317ff2 100644
--- a/deps/v8/test/cctest/cctest.h
+++ b/deps/v8/test/cctest/cctest.h
@@ -169,6 +169,11 @@ class CcTest {
   static v8::Local<v8::Context> NewContext(
       CcTestExtensionFlags extension_flags,
       v8::Isolate* isolate = CcTest::isolate());
+  static v8::Local<v8::Context> NewContext(
+      std::initializer_list<CcTestExtensionId> extensions,
+      v8::Isolate* isolate = CcTest::isolate()) {
+    return NewContext(CcTestExtensionFlags{extensions}, isolate);
+  }
 
   static void TearDown();
 
@@ -373,18 +378,23 @@ static inline v8::Local<v8::Symbol> v8_symbol(const char* name) {
 
 static inline v8::Local<v8::Script> v8_compile(v8::Local<v8::String> x) {
   v8::Local<v8::Script> result;
-  if (v8::Script::Compile(v8::Isolate::GetCurrent()->GetCurrentContext(), x)
-          .ToLocal(&result)) {
-    return result;
-  }
-  return v8::Local<v8::Script>();
+  CHECK(v8::Script::Compile(v8::Isolate::GetCurrent()->GetCurrentContext(), x)
+            .ToLocal(&result));
+  return result;
 }
 
-
 static inline v8::Local<v8::Script> v8_compile(const char* x) {
   return v8_compile(v8_str(x));
 }
 
+static inline v8::MaybeLocal<v8::Script> v8_try_compile(
+    v8::Local<v8::String> x) {
+  return v8::Script::Compile(v8::Isolate::GetCurrent()->GetCurrentContext(), x);
+}
+
+static inline v8::MaybeLocal<v8::Script> v8_try_compile(const char* x) {
+  return v8_try_compile(v8_str(x));
+}
 
 static inline int32_t v8_run_int32value(v8::Local<v8::Script> script) {
   v8::Local<v8::Context> context = CcTest::isolate()->GetCurrentContext();
@@ -697,17 +707,6 @@ class TestPlatform : public v8::Platform {
     old_platform_->CallDelayedOnWorkerThread(std::move(task), delay_in_seconds);
   }
 
-  void CallOnForegroundThread(v8::Isolate* isolate, v8::Task* task) override {
-    // This is a deprecated function and should not be called anymore.
-    UNREACHABLE();
-  }
-
-  void CallDelayedOnForegroundThread(v8::Isolate* isolate, v8::Task* task,
-                                     double delay_in_seconds) override {
-    // This is a deprecated function and should not be called anymore.
-    UNREACHABLE();
-  }
-
   double MonotonicallyIncreasingTime() override {
     return old_platform_->MonotonicallyIncreasingTime();
   }
@@ -716,12 +715,6 @@ class TestPlatform : public v8::Platform {
     return old_platform_->CurrentClockTimeMillis();
   }
 
-  void CallIdleOnForegroundThread(v8::Isolate* isolate,
-                                  v8::IdleTask* task) override {
-    // This is a deprecated function and should not be called anymore.
-    UNREACHABLE();
-  }
-
   bool IdleTasksEnabled(v8::Isolate* isolate) override {
     return old_platform_->IdleTasksEnabled(isolate);
   }
diff --git a/deps/v8/test/cctest/cctest.status b/deps/v8/test/cctest/cctest.status
index 430ca647b745d8..c4f41001d31edc 100644
--- a/deps/v8/test/cctest/cctest.status
+++ b/deps/v8/test/cctest/cctest.status
@@ -122,6 +122,22 @@
   'test-parsing/ObjectRestNegativeTestSlow': [PASS, ['mode == debug', SKIP]],
 }],  # ALWAYS
 
+##############################################################################
+['(arch != ia32 and arch != x64)', {
+  # BUG(v8:9860). We can only safely read the native context for a frame on
+  # ia32 and x64.
+  'test-cpu-profiler/ContextFilterMovedNativeContext': [FAIL],
+  'test-cpu-profiler/ContextIsolation': [FAIL],
+}],
+
+##############################################################################
+['tsan == True', {
+  # BUG(v8:9869) TSAN considers SIGPROF an asynchronous signal, and will call
+  # into the handler after the stack has drifted from the context on the
+  # signal.
+  'test-cpu-profiler/*': [SKIP],
+}],
+
 ##############################################################################
 ['arch == arm64', {
   'test-api/Bug618': [PASS],
@@ -151,7 +167,7 @@
   # Pass but take too long with the simulator.
   'test-api/ExternalArrays': [PASS, SLOW],
   'test-api/Threading*': [SKIP],
-  'test-cpu-profiler/MultipleIsolates': [PASS, SLOW],
+  'test-cpu-profiler/MultipleIsolates': [PASS, ['not pointer_compression', SLOW]],
   'test-debug/DebugBreakStackTrace': [PASS, SLOW],
 }],  # 'arch == arm64 and simulator_run'
 
@@ -182,42 +198,10 @@
   'test-api/NewStringRangeError': [PASS, NO_VARIANTS],
 }],  # 'tsan == True'
 
-##############################################################################
-['no_snap == True', {
-  # Slow tests.
-  'test-api/ExternalWrap': [PASS, SLOW],
-  'test-api/FastReturnValues*': [PASS, SLOW],
-  'test-decls/CrossScriptReferences_Simple2': [PASS, SLOW],
-  # "WithWarmup" means starting from a snapshot, for which nosnap builds lack
-  # support.
-  'test-serialize/CustomSnapshotDataBlobWithWarmup': [SKIP],
-  'test-serialize/SnapshotDataBlobWithWarmup': [SKIP],
-  # Fails the embedded blob <-> Isolate verification step.
-  'test-serialize/CustomSnapshotDataBlobWithLocker': [SKIP],
-
-  # https://crbug.com/v8/7763
-  'test-lockers/ExtensionsRegistration': [SKIP],
-}],  # 'no_snap == True'
-
-##############################################################################
-['no_snap == True and system != windows and mode == debug', {
-  # BUG(v8:9400).
-  'test-heap/Regress615489': [SKIP],
-}], # 'no_snap == True and system != windows and mode == debug'
-
-##############################################################################
-# TODO(machenbach): Fix application of '*'. Nosnap windows needs a separate
-# section to not overwrite the expectations for TestThatAlwaysFails.
-['no_snap == True and system == windows', {
-  # Windows doesn't support nosnap mode.
-  'test-serialize/*': [SKIP],
-}],  # 'no_snap == True and system == windows'
-
 ##############################################################################
 ['is_full_debug', {
   # Tests too slow in non-optimized debug mode.
   'test-api/InternalFieldsSubclassing': [SKIP],
-  'test-cpu-profiler/Inlining2': [SKIP],
   'test-heap/TestInternalWeakLists': [SKIP],
 }],  # 'is_full_debug'
 
@@ -245,6 +229,10 @@
 
   # BUG(5920): Flaky crash.
   'test-serialize/PartialSerializerContext': [PASS, ['arch == x64 and mode == debug', SKIP]],
+
+  # BUG(10107): Failing flakily
+  'test-cpu-profiler/Inlining2': ['arch == ia32 and mode == debug', SKIP],
+  'test-cpu-profiler/CrossScriptInliningCallerLineNumbers2': ['arch == ia32 and mode == debug', SKIP],
 }],  # 'system == windows'
 
 ##############################################################################
@@ -333,6 +321,7 @@
   'test-run-wasm-simd/RunWasm_ReductionTest4_compiled': [SKIP],
   'test-run-wasm-simd/RunWasm_ReductionTest8_compiled': [SKIP],
   'test-run-wasm-simd/RunWasm_ReductionTest16_compiled': [SKIP],
+  'test-run-wasm-simd-liftoff/*': [SKIP],
 }],  # '(arch == mipsel or arch == mips64el or arch == mips or arch == mips64) and not simd_mips'
 
 ##############################################################################
@@ -341,12 +330,6 @@
   'test-run-wasm-atomics64/*': [SKIP],
 }],  # 'arch == mipsel or arch == mips64el or arch == mips or arch == mips64'
 
-##############################################################################
-['arch == mips64el or arch == mipsel', {
-  # TODO(mips-team): support concurrent patching of jump table.
-  'test-jump-table-assembler/*': [SKIP],
-}],  # 'arch == mips64el or arch == mipsel'
-
 ##############################################################################
 ['mips_arch_variant == r6', {
   # For MIPS[64] architecture release 6, fusion multiply-accumulate instructions
@@ -358,15 +341,6 @@
   'test-run-machops/RunFloat64MulAndFloat64Sub2': [SKIP],
 }],  # 'mips_arch_variant == r6'
 
-##############################################################################
-['arch == android_arm or arch == android_ia32', {
-
-  # Tests crash as there is no /tmp directory in Android.
-  'test-log/LogAccessorCallbacks': [SKIP],
-  'test-log/LogCallbacks': [SKIP],
-  'test-log/ProfLazyMode': [SKIP],
-}],  # 'arch == android_arm or arch == android_ia32'
-
 ##############################################################################
 ['system == android', {
   # Uses too much memory.
@@ -409,6 +383,12 @@
   # TODO(ppc/s390): support concurrent patching of jump table
   'test-jump-table-assembler/*': [SKIP],
 
+  # Liftoff is not currently supported on ppc and s390
+  'test-liftoff-*': [SKIP],
+
+  # SIMD not fully implemented yet
+  'test-run-wasm-simd-liftoff/*': [SKIP],
+
 }],  # 'arch == ppc or arch == ppc64 or arch == s390 or arch == s390x'
 
 ['arch == ppc64', {
@@ -454,15 +434,13 @@
 }],  # variant == no_wasm_traps
 
 ##############################################################################
-# The stack unwinder API is only supported on x64.
-['arch != x64', {
+# The stack unwinder API is only supported on x64, arm64 and arm.
+['arch != x64 and arch != arm64', {
   'test-unwinder/*': [SKIP]
 }],
 
-##############################################################################
-# Windows stack unwinding is only supported on x64.
-['arch != x64 or system != windows', {
-  'test-stack-unwinding-x64/*': [SKIP]
+['arch != x64 and arch != arm64 and arch != arm', {
+  'test-unwinder-code-pages/*': [SKIP]
 }],
 
 ##############################################################################
@@ -474,9 +452,10 @@
   # TODO(v8:7777): Re-enable once wasm is supported in jitless mode.
   'test-api/WasmI32AtomicWaitCallback': [SKIP],
   'test-api/WasmI64AtomicWaitCallback': [SKIP],
-  'test-api/WasmStreaming*': [SKIP],
+  'test-api-wasm/WasmStreaming*': [SKIP],
   'test-backing-store/Run_WasmModule_Buffer_Externalized_Regression_UseAfterFree': [SKIP],
   'test-c-wasm-entry/*': [SKIP],
+  'test-compilation-cache/TestAsyncCache': [SKIP],
   'test-jump-table-assembler/*': [SKIP],
   'test-grow-memory/*': [SKIP],
   'test-run-wasm-64/*': [SKIP],
@@ -490,6 +469,7 @@
   'test-run-wasm-js/*': [SKIP],
   'test-run-wasm-module/*': [SKIP],
   'test-run-wasm-sign-extension/*': [SKIP],
+  'test-run-wasm-simd-liftoff/*': [SKIP],
   'test-run-wasm-simd/*': [SKIP],
   'test-streaming-compilation/*': [SKIP],
   'test-wasm-breakpoints/*': [SKIP],
@@ -510,6 +490,7 @@
   'test-branch-combine/*': [SKIP],
   'test-code-assembler/*': [SKIP],
   'test-code-generator/*': [SKIP],
+  'test-code-pages/*': [SKIP],
   'test-code-stub-assembler/*': [SKIP],
   'test-js-context-specialization/*': [SKIP],
   'test-multiple-return/*': [SKIP],
@@ -611,11 +592,6 @@
   'test-macro-assembler-arm/ReplaceLane': [PASS, ['arch == arm and not simulator_run', SKIP]],
 }], # variant == jitless
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-
 ##############################################################################
 ['variant == turboprop', {
   # Require inlining.
diff --git a/deps/v8/test/cctest/compiler/serializer-tester.cc b/deps/v8/test/cctest/compiler/serializer-tester.cc
index 01979a220104d7..8c0e95f07e5719 100644
--- a/deps/v8/test/cctest/compiler/serializer-tester.cc
+++ b/deps/v8/test/cctest/compiler/serializer-tester.cc
@@ -39,7 +39,6 @@ SerializerTester::SerializerTester(const char* source)
       *v8::Local<v8::Function>::Cast(CompileRun(function_string.c_str()))));
   uint32_t flags = i::OptimizedCompilationInfo::kInliningEnabled |
                    i::OptimizedCompilationInfo::kFunctionContextSpecializing |
-                   i::OptimizedCompilationInfo::kAccessorInliningEnabled |
                    i::OptimizedCompilationInfo::kLoopPeelingEnabled |
                    i::OptimizedCompilationInfo::kBailoutOnUninitialized |
                    i::OptimizedCompilationInfo::kAllocationFoldingEnabled |
@@ -53,8 +52,8 @@ TEST(SerializeEmptyFunction) {
   SerializerTester tester(
       "function f() {}; %EnsureFeedbackVectorForFunction(f); return f;");
   JSFunctionRef function = tester.function();
-  CHECK(
-      function.shared().IsSerializedForCompilation(function.feedback_vector()));
+  CHECK(tester.broker()->IsSerializedForCompilation(
+      function.shared(), function.feedback_vector()));
 }
 
 // This helper function allows for testing whether an inlinee candidate
@@ -64,7 +63,8 @@ void CheckForSerializedInlinee(const char* source, int argc = 0,
                                Handle<Object> argv[] = {}) {
   SerializerTester tester(source);
   JSFunctionRef f = tester.function();
-  CHECK(f.shared().IsSerializedForCompilation(f.feedback_vector()));
+  CHECK(tester.broker()->IsSerializedForCompilation(f.shared(),
+                                                    f.feedback_vector()));
 
   MaybeHandle<Object> g_obj = Execution::Call(
       tester.isolate(), tester.function().object(),
@@ -81,7 +81,7 @@ void CheckForSerializedInlinee(const char* source, int argc = 0,
                               handle(g_func->shared(), tester.isolate()));
   FeedbackVectorRef g_fv(tester.broker(),
                          handle(g_func->feedback_vector(), tester.isolate()));
-  CHECK(g_sfi.IsSerializedForCompilation(g_fv));
+  CHECK(tester.broker()->IsSerializedForCompilation(g_sfi, g_fv));
 }
 
 TEST(SerializeInlinedClosure) {
@@ -322,6 +322,48 @@ TEST(BoundFunctionArguments) {
       "test(); return test;");
 }
 
+TEST(ArrowFunctionInlined) {
+  // The loop is to ensure there is a feedback vector for the arrow function
+  // {b}.
+  CheckForSerializedInlinee(
+      "function foo() {"
+      "  let b = x => x * x;"
+      "  let a = [1, 2, 3].map(b);"
+      "  return b;"
+      "}"
+      "%EnsureFeedbackVectorForFunction(foo);"
+      "for (let i = 0; i < 100; ++i) foo();"
+      "return foo;");
+}
+
+TEST(BoundFunctionResult) {
+  CheckForSerializedInlinee(
+      "function id(x) { return x }"
+      "function foo() { id.bind(undefined, 42)(); return id; }"
+      "%PrepareFunctionForOptimization(foo);"
+      "%PrepareFunctionForOptimization(id);"
+      "foo();"
+      "foo();"
+      "%OptimizeFunctionOnNextCall(foo);"
+      "foo(); return foo;");
+}
+
+TEST(MultipleFunctionCalls) {
+  CheckForSerializedInlinee(
+      "function inc(x) { return ++x; }"
+      "function dec(x) { return --x; }"
+      "function apply(f, x) { return f(x); }"
+      "function foo() { apply(inc, 42); apply(dec, 42); return dec; }"
+      "%PrepareFunctionForOptimization(inc);"
+      "%PrepareFunctionForOptimization(dec);"
+      "%PrepareFunctionForOptimization(apply);"
+      "%PrepareFunctionForOptimization(foo);"
+      "foo();"
+      "foo();"
+      "%OptimizeFunctionOnNextCall(foo);"
+      "foo(); return foo;");
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/compiler/test-code-assembler.cc b/deps/v8/test/cctest/compiler/test-code-assembler.cc
index 56628ffde40313..e3db983488f43a 100644
--- a/deps/v8/test/cctest/compiler/test-code-assembler.cc
+++ b/deps/v8/test/cctest/compiler/test-code-assembler.cc
@@ -20,20 +20,21 @@ namespace {
 
 using Variable = CodeAssemblerVariable;
 
-Node* SmiTag(CodeAssembler* m, Node* value) {
+TNode<Smi> SmiTag(CodeAssembler* m, Node* value) {
   int32_t constant_value;
   if (m->ToInt32Constant(value, &constant_value) &&
       Smi::IsValid(constant_value)) {
     return m->SmiConstant(Smi::FromInt(constant_value));
   }
-  return m->WordShl(value, m->IntPtrConstant(kSmiShiftSize + kSmiTagSize));
+  return m->BitcastWordToTaggedSigned(
+      m->WordShl(value, m->IntPtrConstant(kSmiShiftSize + kSmiTagSize)));
 }
 
 Node* UndefinedConstant(CodeAssembler* m) {
   return m->LoadRoot(RootIndex::kUndefinedValue);
 }
 
-Node* SmiFromInt32(CodeAssembler* m, Node* value) {
+TNode<Smi> SmiFromInt32(CodeAssembler* m, Node* value) {
   value = m->ChangeInt32ToIntPtr(value);
   return m->BitcastWordToTaggedSigned(
       m->WordShl(value, kSmiShiftSize + kSmiTagSize));
@@ -160,7 +161,7 @@ TEST(SimpleCallJSFunction0Arg) {
     Node* receiver = SmiTag(&m, m.Int32Constant(42));
 
     Callable callable = CodeFactory::Call(isolate);
-    Node* result = m.CallJS(callable, context, function, receiver);
+    TNode<Object> result = m.CallJS(callable, context, function, receiver);
     m.Return(result);
   }
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
@@ -183,7 +184,7 @@ TEST(SimpleCallJSFunction1Arg) {
     Node* a = SmiTag(&m, m.Int32Constant(13));
 
     Callable callable = CodeFactory::Call(isolate);
-    Node* result = m.CallJS(callable, context, function, receiver, a);
+    TNode<Object> result = m.CallJS(callable, context, function, receiver, a);
     m.Return(result);
   }
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
@@ -207,7 +208,8 @@ TEST(SimpleCallJSFunction2Arg) {
     Node* b = SmiTag(&m, m.Int32Constant(153));
 
     Callable callable = CodeFactory::Call(isolate);
-    Node* result = m.CallJS(callable, context, function, receiver, a, b);
+    TNode<Object> result =
+        m.CallJS(callable, context, function, receiver, a, b);
     m.Return(result);
   }
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
@@ -464,7 +466,7 @@ TEST(GotoIfException) {
   m.Return(string);
 
   m.Bind(&exception_handler);
-  m.Return(exception.value());
+  m.Return(m.UncheckedCast<Object>(exception.value()));
 
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
   Handle<Object> result = ft.Call().ToHandleChecked();
@@ -525,7 +527,7 @@ TEST(GotoIfExceptionMultiple) {
                       m.Word32Xor(m.Int32Constant(2), m.Int32Constant(-1)))));
 
   m.Bind(&exception_handler3);
-  m.Return(error.value());
+  m.Return(m.UncheckedCast<Object>(error.value()));
 
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
 
diff --git a/deps/v8/test/cctest/compiler/test-code-generator.cc b/deps/v8/test/cctest/compiler/test-code-generator.cc
index 74c50a4bfacbc9..3e668561891117 100644
--- a/deps/v8/test/cctest/compiler/test-code-generator.cc
+++ b/deps/v8/test/cctest/compiler/test-code-generator.cc
@@ -147,9 +147,10 @@ Handle<Code> BuildSetupFunction(Isolate* isolate,
     }
     params.push_back(element);
   }
-  __ Return(tester.raw_assembler_for_testing()->AddNode(
-      tester.raw_assembler_for_testing()->common()->Call(call_descriptor),
-      static_cast<int>(params.size()), params.data()));
+  __ Return(
+      __ UncheckedCast<Object>(tester.raw_assembler_for_testing()->AddNode(
+          tester.raw_assembler_for_testing()->common()->Call(call_descriptor),
+          static_cast<int>(params.size()), params.data())));
   return tester.GenerateCodeCloseAndEscape();
 }
 
@@ -214,11 +215,11 @@ Handle<Code> BuildTeardownFunction(Isolate* isolate,
         param =
             tester.raw_assembler_for_testing()->ChangeFloat32ToFloat64(param);
         V8_FALLTHROUGH;
-      case MachineRepresentation::kFloat64:
+      case MachineRepresentation::kFloat64: {
         __ StoreObjectFieldNoWriteBarrier(
-            __ LoadFixedArrayElement(result_array, i), HeapNumber::kValueOffset,
-            param, MachineRepresentation::kFloat64);
-        break;
+            __ Cast(__ LoadFixedArrayElement(result_array, i)),
+            HeapNumber::kValueOffset, __ UncheckedCast<Float64T>(param));
+      } break;
       case MachineRepresentation::kSimd128: {
         TNode<FixedArray> vector =
             __ Cast(__ LoadFixedArrayElement(result_array, i));
@@ -991,13 +992,15 @@ class CodeGeneratorTester {
     }
 
     static constexpr size_t kMaxUnoptimizedFrameHeight = 0;
+    static constexpr size_t kMaxPushedArgumentCount = 0;
     generator_ = new CodeGenerator(
         environment->main_zone(), &frame_, &linkage_,
         environment->instructions(), &info_, environment->main_isolate(),
         base::Optional<OsrHelper>(), kNoSourcePosition, nullptr,
         PoisoningMitigationLevel::kDontPoison,
         AssemblerOptions::Default(environment->main_isolate()),
-        Builtins::kNoBuiltinId, kMaxUnoptimizedFrameHeight);
+        Builtins::kNoBuiltinId, kMaxUnoptimizedFrameHeight,
+        kMaxPushedArgumentCount);
 
     // Force a frame to be created.
     generator_->frame_access_state()->MarkHasFrame(true);
diff --git a/deps/v8/test/cctest/compiler/test-js-constant-cache.cc b/deps/v8/test/cctest/compiler/test-js-constant-cache.cc
index cc2eddd1a06524..d91cbdc9f4009d 100644
--- a/deps/v8/test/cctest/compiler/test-js-constant-cache.cc
+++ b/deps/v8/test/cctest/compiler/test-js-constant-cache.cc
@@ -38,7 +38,7 @@ class JSConstantCacheTester : public HandleAndZoneScope,
         JSGraph(main_isolate(), &main_graph_, &main_common_, &main_javascript_,
                 nullptr, &main_machine_),
         canonical_(main_isolate()),
-        broker_(main_isolate(), main_zone(), false) {
+        broker_(main_isolate(), main_zone(), false, false) {
     main_graph_.SetStart(main_graph_.NewNode(common()->Start(0)));
     main_graph_.SetEnd(
         main_graph_.NewNode(common()->End(1), main_graph_.start()));
diff --git a/deps/v8/test/cctest/compiler/test-js-context-specialization.cc b/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
index 1b136873b53a8b..f46c6c57938851 100644
--- a/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
+++ b/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
@@ -33,7 +33,8 @@ class ContextSpecializationTester : public HandleAndZoneScope {
         jsgraph_(main_isolate(), graph(), common(), &javascript_, &simplified_,
                  &machine_),
         reducer_(main_zone(), graph(), &tick_counter_),
-        js_heap_broker_(main_isolate(), main_zone(), FLAG_trace_heap_broker),
+        js_heap_broker_(main_isolate(), main_zone(), FLAG_trace_heap_broker,
+                        false),
         spec_(&reducer_, jsgraph(), &js_heap_broker_, context,
               MaybeHandle<JSFunction>()) {}
 
@@ -110,7 +111,7 @@ void ContextSpecializationTester::CheckContextInputAndDepthChanges(
   CHECK_EQ(new_access.immutable(), access.immutable());
 }
 
-static const int slot_index = Context::NATIVE_CONTEXT_INDEX;
+static const int slot_index = Context::PREVIOUS_INDEX;
 
 TEST(ReduceJSLoadContext0) {
   ContextSpecializationTester t(Nothing<OuterContext>());
@@ -125,7 +126,7 @@ TEST(ReduceJSLoadContext0) {
   subcontext2->set_previous(*subcontext1);
   subcontext1->set_previous(*native);
   Handle<Object> expected = t.factory()->InternalizeUtf8String("gboy!");
-  const int slot = Context::NATIVE_CONTEXT_INDEX;
+  const int slot = Context::PREVIOUS_INDEX;
   native->set(slot, *expected);
 
   Node* const_context = t.jsgraph()->Constant(ObjectRef(t.broker(), native));
@@ -269,8 +270,8 @@ TEST(ReduceJSLoadContext2) {
   Handle<Context> context_object0 = t.factory()->NewNativeContext();
   Handle<Context> context_object1 = t.factory()->NewNativeContext();
   context_object1->set_previous(*context_object0);
-  context_object0->set(slot_index, *slot_value0);
-  context_object1->set(slot_index, *slot_value1);
+  context_object0->set(Context::EXTENSION_INDEX, *slot_value0);
+  context_object1->set(Context::EXTENSION_INDEX, *slot_value1);
 
   Node* context0 =
       t.jsgraph()->Constant(ObjectRef(t.broker(), context_object1));
@@ -311,7 +312,8 @@ TEST(ReduceJSLoadContext2) {
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(2, slot_index, true), context2, start);
+        t.javascript()->LoadContext(2, Context::EXTENSION_INDEX, true),
+        context2, start);
     t.CheckChangesToValue(load, slot_value1);
   }
 
@@ -323,7 +325,8 @@ TEST(ReduceJSLoadContext2) {
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(3, slot_index, true), context2, start);
+        t.javascript()->LoadContext(3, Context::EXTENSION_INDEX, true),
+        context2, start);
     t.CheckChangesToValue(load, slot_value0);
   }
 }
@@ -344,8 +347,8 @@ TEST(ReduceJSLoadContext3) {
   Handle<Context> context_object0 = factory->NewNativeContext();
   Handle<Context> context_object1 = factory->NewNativeContext();
   context_object1->set_previous(*context_object0);
-  context_object0->set(slot_index, *slot_value0);
-  context_object1->set(slot_index, *slot_value1);
+  context_object0->set(Context::EXTENSION_INDEX, *slot_value0);
+  context_object1->set(Context::EXTENSION_INDEX, *slot_value1);
 
   ContextSpecializationTester t(Just(OuterContext(context_object1, 0)));
 
@@ -394,7 +397,8 @@ TEST(ReduceJSLoadContext3) {
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(2, slot_index, true), context2, start);
+        t.javascript()->LoadContext(2, Context::EXTENSION_INDEX, true),
+        context2, start);
     t.CheckChangesToValue(load, slot_value1);
   }
 
@@ -406,7 +410,8 @@ TEST(ReduceJSLoadContext3) {
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(3, slot_index, true), context2, start);
+        t.javascript()->LoadContext(3, Context::EXTENSION_INDEX, true),
+        context2, start);
     t.CheckChangesToValue(load, slot_value0);
   }
 }
@@ -424,7 +429,7 @@ TEST(ReduceJSStoreContext0) {
   subcontext2->set_previous(*subcontext1);
   subcontext1->set_previous(*native);
   Handle<Object> expected = t.factory()->InternalizeUtf8String("gboy!");
-  const int slot = Context::NATIVE_CONTEXT_INDEX;
+  const int slot = Context::PREVIOUS_INDEX;
   native->set(slot, *expected);
 
   Node* const_context = t.jsgraph()->Constant(ObjectRef(t.broker(), native));
@@ -533,8 +538,8 @@ TEST(ReduceJSStoreContext2) {
   Handle<Context> context_object0 = t.factory()->NewNativeContext();
   Handle<Context> context_object1 = t.factory()->NewNativeContext();
   context_object1->set_previous(*context_object0);
-  context_object0->set(slot_index, *slot_value0);
-  context_object1->set(slot_index, *slot_value1);
+  context_object0->set(Context::EXTENSION_INDEX, *slot_value0);
+  context_object1->set(Context::EXTENSION_INDEX, *slot_value1);
 
   Node* context0 =
       t.jsgraph()->Constant(ObjectRef(t.broker(), context_object1));
@@ -544,30 +549,30 @@ TEST(ReduceJSStoreContext2) {
       t.graph()->NewNode(create_function_context, context1, start, start);
 
   {
-    Node* store =
-        t.graph()->NewNode(t.javascript()->StoreContext(0, slot_index),
-                           context2, context2, start, start);
+    Node* store = t.graph()->NewNode(
+        t.javascript()->StoreContext(0, Context::EXTENSION_INDEX), context2,
+        context2, start, start);
     CHECK(!t.spec()->Reduce(store).Changed());
   }
 
   {
-    Node* store =
-        t.graph()->NewNode(t.javascript()->StoreContext(1, slot_index),
-                           context2, context2, start, start);
+    Node* store = t.graph()->NewNode(
+        t.javascript()->StoreContext(1, Context::EXTENSION_INDEX), context2,
+        context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context1, 0);
   }
 
   {
-    Node* store =
-        t.graph()->NewNode(t.javascript()->StoreContext(2, slot_index),
-                           context2, context2, start, start);
+    Node* store = t.graph()->NewNode(
+        t.javascript()->StoreContext(2, Context::EXTENSION_INDEX), context2,
+        context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context0, 0);
   }
 
   {
-    Node* store =
-        t.graph()->NewNode(t.javascript()->StoreContext(3, slot_index),
-                           context2, context2, start, start);
+    Node* store = t.graph()->NewNode(
+        t.javascript()->StoreContext(3, Context::EXTENSION_INDEX), context2,
+        context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context_object0, 0);
   }
 }
@@ -582,8 +587,8 @@ TEST(ReduceJSStoreContext3) {
   Handle<Context> context_object0 = factory->NewNativeContext();
   Handle<Context> context_object1 = factory->NewNativeContext();
   context_object1->set_previous(*context_object0);
-  context_object0->set(slot_index, *slot_value0);
-  context_object1->set(slot_index, *slot_value1);
+  context_object0->set(Context::EXTENSION_INDEX, *slot_value0);
+  context_object1->set(Context::EXTENSION_INDEX, *slot_value1);
 
   ContextSpecializationTester t(Just(OuterContext(context_object1, 0)));
 
@@ -601,30 +606,30 @@ TEST(ReduceJSStoreContext3) {
       t.graph()->NewNode(create_function_context, context1, start, start);
 
   {
-    Node* store =
-        t.graph()->NewNode(t.javascript()->StoreContext(0, slot_index),
-                           context2, context2, start, start);
+    Node* store = t.graph()->NewNode(
+        t.javascript()->StoreContext(0, Context::EXTENSION_INDEX), context2,
+        context2, start, start);
     CHECK(!t.spec()->Reduce(store).Changed());
   }
 
   {
-    Node* store =
-        t.graph()->NewNode(t.javascript()->StoreContext(1, slot_index),
-                           context2, context2, start, start);
+    Node* store = t.graph()->NewNode(
+        t.javascript()->StoreContext(1, Context::EXTENSION_INDEX), context2,
+        context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context1, 0);
   }
 
   {
-    Node* store =
-        t.graph()->NewNode(t.javascript()->StoreContext(2, slot_index),
-                           context2, context2, start, start);
+    Node* store = t.graph()->NewNode(
+        t.javascript()->StoreContext(2, Context::EXTENSION_INDEX), context2,
+        context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context_object1, 0);
   }
 
   {
-    Node* store =
-        t.graph()->NewNode(t.javascript()->StoreContext(3, slot_index),
-                           context2, context2, start, start);
+    Node* store = t.graph()->NewNode(
+        t.javascript()->StoreContext(3, Context::EXTENSION_INDEX), context2,
+        context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context_object0, 0);
   }
 }
diff --git a/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc b/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
index fbe3892af163e5..1d02d8a59c691e 100644
--- a/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
+++ b/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
@@ -26,7 +26,7 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
   explicit JSTypedLoweringTester(int num_parameters = 0)
       : isolate(main_isolate()),
         canonical(isolate),
-        js_heap_broker(isolate, main_zone(), FLAG_trace_heap_broker),
+        js_heap_broker(isolate, main_zone(), FLAG_trace_heap_broker, false),
         binop(nullptr),
         unop(nullptr),
         javascript(main_zone()),
diff --git a/deps/v8/test/cctest/compiler/test-multiple-return.cc b/deps/v8/test/cctest/compiler/test-multiple-return.cc
index ad1c7efbd71dec..156ea8074afe65 100644
--- a/deps/v8/test/cctest/compiler/test-multiple-return.cc
+++ b/deps/v8/test/cctest/compiler/test-multiple-return.cc
@@ -125,8 +125,10 @@ std::shared_ptr<wasm::NativeModule> AllocateNativeModule(Isolate* isolate,
   // We have to add the code object to a NativeModule, because the
   // WasmCallDescriptor assumes that code is on the native heap and not
   // within a code object.
-  return isolate->wasm_engine()->NewNativeModule(
-      isolate, wasm::kAllWasmFeatures, code_size, false, std::move(module));
+  auto native_module = isolate->wasm_engine()->NewNativeModule(
+      isolate, wasm::WasmFeatures::All(), std::move(module), code_size);
+  native_module->SetWireBytes({});
+  return native_module;
 }
 
 void TestReturnMultipleValues(MachineType type) {
diff --git a/deps/v8/test/cctest/compiler/test-node.cc b/deps/v8/test/cctest/compiler/test-node.cc
index d48d4c86e3c92e..16c3fb896eeeb9 100644
--- a/deps/v8/test/cctest/compiler/test-node.cc
+++ b/deps/v8/test/cctest/compiler/test-node.cc
@@ -42,8 +42,22 @@ void CheckUseChain(Node* node, Node** uses, int use_count) {
   // Check ownership.
   if (use_count == 1) CHECK(node->OwnedBy(uses[0]));
   if (use_count > 1) {
+    Node* first_use = uses[0];
+    bool different_uses = false;
     for (int i = 0; i < use_count; i++) {
-      CHECK(!node->OwnedBy(uses[i]));
+      if (uses[i] != first_use) {
+        different_uses = true;
+        break;
+      }
+    }
+    if (different_uses) {
+      // If there are different uses, check that node is not owned by any use.
+      for (int i = 0; i < use_count; i++) {
+        CHECK(!node->OwnedBy(uses[i]));
+      }
+    } else {
+      // If all uses are the same, check that node is owned by that use.
+      CHECK(node->OwnedBy(first_use));
     }
   }
 
diff --git a/deps/v8/test/cctest/compiler/test-representation-change.cc b/deps/v8/test/cctest/compiler/test-representation-change.cc
index d858448ef8cc6e..42a7fbdb0209b5 100644
--- a/deps/v8/test/cctest/compiler/test-representation-change.cc
+++ b/deps/v8/test/cctest/compiler/test-representation-change.cc
@@ -27,7 +27,7 @@ class RepresentationChangerTester : public HandleAndZoneScope,
         javascript_(main_zone()),
         jsgraph_(main_isolate(), main_graph_, &main_common_, &javascript_,
                  &main_simplified_, &main_machine_),
-        broker_{main_isolate(), main_zone(), FLAG_trace_heap_broker},
+        broker_{main_isolate(), main_zone(), FLAG_trace_heap_broker, false},
         changer_(&jsgraph_, &broker_) {
     Node* s = graph()->NewNode(common()->Start(num_parameters));
     graph()->SetStart(s);
@@ -123,12 +123,10 @@ class RepresentationChangerTester : public HandleAndZoneScope,
 };
 
 const MachineType kMachineTypes[] = {
-    MachineType::Float32(),   MachineType::Float64(),
-    MachineType::Int8(),      MachineType::Uint8(),
-    MachineType::Int16(),     MachineType::Uint16(),
-    MachineType::Int32(),     MachineType::Uint32(),
-    MachineType::Int64(),     MachineType::Uint64(),
-    MachineType::AnyTagged(), MachineType::AnyCompressed()};
+    MachineType::Float32(), MachineType::Float64(),  MachineType::Int8(),
+    MachineType::Uint8(),   MachineType::Int16(),    MachineType::Uint16(),
+    MachineType::Int32(),   MachineType::Uint32(),   MachineType::Int64(),
+    MachineType::Uint64(),  MachineType::AnyTagged()};
 
 TEST(BoolToBit_constant) {
   RepresentationChangerTester r;
@@ -526,9 +524,6 @@ TEST(SingleChanges) {
   CheckChange(IrOpcode::kChangeBitToTagged, MachineRepresentation::kBit,
               Type::Boolean(), MachineRepresentation::kTagged);
 
-  CheckChange(IrOpcode::kChangeInt31ToCompressedSigned,
-              MachineRepresentation::kWord32, Type::Signed31(),
-              MachineRepresentation::kCompressedSigned);
   CheckChange(IrOpcode::kChangeInt31ToTaggedSigned,
               MachineRepresentation::kWord32, Type::Signed31(),
               MachineRepresentation::kTagged);
@@ -647,52 +642,6 @@ TEST(SignednessInWord32) {
       UseInfo::CheckedSigned32AsWord32(kIdentifyZeros, FeedbackSource()));
 }
 
-TEST(CompressedAndTagged) {
-  // Simple Tagged to Compressed
-  CheckChange(IrOpcode::kChangeTaggedToCompressed,
-              MachineRepresentation::kTagged, Type::Any(),
-              MachineRepresentation::kCompressed);
-  CheckChange(IrOpcode::kChangeTaggedPointerToCompressedPointer,
-              MachineRepresentation::kTaggedPointer, Type::Any(),
-              MachineRepresentation::kCompressedPointer);
-  CheckChange(IrOpcode::kChangeTaggedSignedToCompressedSigned,
-              MachineRepresentation::kTaggedSigned, Type::Any(),
-              MachineRepresentation::kCompressedSigned);
-
-  // Simple Compressed to Tagged
-  CheckChange(IrOpcode::kChangeCompressedToTagged,
-              MachineRepresentation::kCompressed, Type::Any(),
-              MachineRepresentation::kTagged);
-  CheckChange(IrOpcode::kChangeCompressedPointerToTaggedPointer,
-              MachineRepresentation::kCompressedPointer, Type::Any(),
-              MachineRepresentation::kTaggedPointer);
-  CheckChange(IrOpcode::kChangeCompressedSignedToTaggedSigned,
-              MachineRepresentation::kCompressedSigned, Type::Any(),
-              MachineRepresentation::kTaggedSigned);
-
-  // Compressed To TaggedSigned
-  CheckChange(IrOpcode::kChangeCompressedToTaggedSigned,
-              MachineRepresentation::kCompressed, Type::SignedSmall(),
-              MachineRepresentation::kTaggedSigned);
-
-  // Tagged To CompressedSigned
-  CheckChange(IrOpcode::kChangeTaggedToCompressedSigned,
-              MachineRepresentation::kTagged, Type::SignedSmall(),
-              MachineRepresentation::kCompressedSigned);
-
-  // TaggedSigned to CompressedPointer
-  CheckChange(IrOpcode::kCheckedTaggedToCompressedPointer,
-              MachineRepresentation::kTaggedSigned, Type::SignedSmall(),
-              UseInfo(MachineRepresentation::kCompressedPointer,
-                      Truncation::Any(), TypeCheckKind::kHeapObject));
-
-  // CompressedSigned to TaggedPointer
-  CheckChange(IrOpcode::kCheckedCompressedToTaggedPointer,
-              MachineRepresentation::kCompressedSigned, Type::SignedSmall(),
-              UseInfo(MachineRepresentation::kTaggedPointer, Truncation::Any(),
-                      TypeCheckKind::kHeapObject));
-}
-
 static void TestMinusZeroCheck(IrOpcode::Value expected, Type from_type) {
   RepresentationChangerTester r;
 
diff --git a/deps/v8/test/cctest/compiler/test-run-machops.cc b/deps/v8/test/cctest/compiler/test-run-machops.cc
index ccc05ce11b67b0..fe8a3cac5842b6 100644
--- a/deps/v8/test/cctest/compiler/test-run-machops.cc
+++ b/deps/v8/test/cctest/compiler/test-run-machops.cc
@@ -397,57 +397,6 @@ TEST(RunWord64Popcnt) {
   CHECK_EQ(18, m.Call(uint64_t(0x000DC107000DC107)));
 }
 
-#ifdef V8_COMPRESS_POINTERS
-TEST(CompressDecompressTaggedAnyPointer) {
-  RawMachineAssemblerTester<void*> m;
-
-  Handle<HeapNumber> value = m.isolate()->factory()->NewHeapNumber(11.2);
-  Node* node = m.HeapConstant(value);
-  m.Return(m.ChangeCompressedToTagged(m.ChangeTaggedToCompressed(node)));
-
-  HeapObject result =
-      HeapObject::cast(Object(reinterpret_cast<Address>(m.Call())));
-  CHECK_EQ(result, *value);
-}
-
-TEST(CompressDecompressTaggedAnySigned) {
-  RawMachineAssemblerTester<void*> m;
-  Smi smi = Smi::FromInt(123);
-  Node* node = m.Int64Constant(static_cast<int64_t>(smi.ptr()));
-  m.Return(m.ChangeCompressedToTagged(m.ChangeTaggedToCompressed(node)));
-
-  Object result = Object(reinterpret_cast<Address>(m.Call()));
-  Address smiPointer =
-      DecompressTaggedAny(m.isolate(), CompressTagged(smi.ptr()));
-  CHECK_EQ(smiPointer, result.ptr());
-}
-
-TEST(CompressDecompressTaggedPointer) {
-  RawMachineAssemblerTester<void*> m;
-
-  Handle<HeapNumber> value = m.isolate()->factory()->NewHeapNumber(11.2);
-  Node* node = m.HeapConstant(value);
-  m.Return(m.ChangeCompressedPointerToTaggedPointer(
-      m.ChangeTaggedPointerToCompressedPointer(node)));
-
-  HeapObject result =
-      HeapObject::cast(Object(reinterpret_cast<Address>(m.Call())));
-  CHECK_EQ(result, *value);
-}
-
-TEST(CompressDecompressTaggedSigned) {
-  RawMachineAssemblerTester<void*> m;
-  Smi smi = Smi::FromInt(123);
-  Address smiPointer = smi.ptr();
-  Node* node = m.Int64Constant(static_cast<int64_t>(smiPointer));
-  m.Return(m.ChangeCompressedSignedToTaggedSigned(
-      m.ChangeTaggedSignedToCompressedSigned(node)));
-
-  Object result = Object(reinterpret_cast<Address>(m.Call()));
-  CHECK_EQ(smiPointer, result.ptr());
-}
-#endif  // V8_COMPRESS_POINTERS
-
 #endif  // V8_TARGET_ARCH_64_BIT
 
 
diff --git a/deps/v8/test/cctest/compiler/test-run-retpoline.cc b/deps/v8/test/cctest/compiler/test-run-retpoline.cc
index 32569eaaeec0bc..33f0b0bbeb4025 100644
--- a/deps/v8/test/cctest/compiler/test-run-retpoline.cc
+++ b/deps/v8/test/cctest/compiler/test-run-retpoline.cc
@@ -25,7 +25,7 @@ Handle<Code> BuildCallee(Isolate* isolate, CallDescriptor* call_descriptor) {
   CodeAssemblerTester tester(isolate, call_descriptor, "callee");
   CodeStubAssembler assembler(tester.state());
   int param_count = static_cast<int>(call_descriptor->StackParameterCount());
-  Node* sum = __ IntPtrConstant(0);
+  TNode<IntPtrT> sum = __ IntPtrConstant(0);
   for (int i = 0; i < param_count; ++i) {
     TNode<IntPtrT> product =
         __ Signed(__ IntPtrMul(__ Parameter(i), __ IntPtrConstant(i + 1)));
@@ -70,7 +70,7 @@ Handle<Code> BuildCaller(Isolate* isolate, CallDescriptor* call_descriptor,
   } else {
     Node* result = tester.raw_assembler_for_testing()->CallN(
         callee_descriptor, param_count + 1, params.data());
-    __ Return(result);
+    __ Return(__ UncheckedCast<IntPtrT>(result));
   }
   return tester.GenerateCodeCloseAndEscape();
 }
diff --git a/deps/v8/test/cctest/compiler/test-run-tail-calls.cc b/deps/v8/test/cctest/compiler/test-run-tail-calls.cc
index ed8a099090dac0..cb83d899edd8d5 100644
--- a/deps/v8/test/cctest/compiler/test-run-tail-calls.cc
+++ b/deps/v8/test/cctest/compiler/test-run-tail-calls.cc
@@ -26,7 +26,7 @@ Handle<Code> BuildCallee(Isolate* isolate, CallDescriptor* call_descriptor) {
   CodeAssemblerTester tester(isolate, call_descriptor, "callee");
   CodeStubAssembler assembler(tester.state());
   int param_count = static_cast<int>(call_descriptor->StackParameterCount());
-  Node* sum = __ IntPtrConstant(0);
+  TNode<IntPtrT> sum = __ IntPtrConstant(0);
   for (int i = 0; i < param_count; ++i) {
     TNode<WordT> product =
         __ IntPtrMul(__ Parameter(i), __ IntPtrConstant(i + 1));
diff --git a/deps/v8/test/cctest/compiler/test-run-unwinding-info.cc b/deps/v8/test/cctest/compiler/test-run-unwinding-info.cc
index e4e355b801cb4a..0a4efc2c537c33 100644
--- a/deps/v8/test/cctest/compiler/test-run-unwinding-info.cc
+++ b/deps/v8/test/cctest/compiler/test-run-unwinding-info.cc
@@ -3,8 +3,9 @@
 // found in the LICENSE file.
 
 // Test enabled only on supported architectures.
-#if defined(V8_TARGET_ARCH_X64) || defined(V8_TARGET_ARCH_ARM) || \
-    defined(V8_TARGET_ARCH_ARM64)
+#if V8_OS_LINUX &&                                                 \
+    (defined(V8_TARGET_ARCH_X64) || defined(V8_TARGET_ARCH_ARM) || \
+     defined(V8_TARGET_ARCH_ARM64))
 
 #include "src/flags/flags.h"
 #include "src/objects/objects-inl.h"
diff --git a/deps/v8/test/cctest/compiler/value-helper.h b/deps/v8/test/cctest/compiler/value-helper.h
index 4b8f34c9d265c6..a612a6432d3cfa 100644
--- a/deps/v8/test/cctest/compiler/value-helper.h
+++ b/deps/v8/test/cctest/compiler/value-helper.h
@@ -315,8 +315,46 @@ class ValueHelper {
   static constexpr Vector<const uint32_t> ror_vector() {
     return ArrayVector(ror_array);
   }
+
+  template <typename T>
+  static constexpr Vector<const T> GetVector();
 };
 
+template <>
+constexpr Vector<const int8_t> ValueHelper::GetVector() {
+  return int8_vector();
+}
+
+template <>
+constexpr Vector<const uint8_t> ValueHelper::GetVector() {
+  return uint8_vector();
+}
+
+template <>
+constexpr Vector<const int16_t> ValueHelper::GetVector() {
+  return int16_vector();
+}
+
+template <>
+constexpr Vector<const uint16_t> ValueHelper::GetVector() {
+  return uint16_vector();
+}
+
+template <>
+constexpr Vector<const int32_t> ValueHelper::GetVector() {
+  return int32_vector();
+}
+
+template <>
+constexpr Vector<const uint32_t> ValueHelper::GetVector() {
+  return uint32_vector();
+}
+
+template <>
+constexpr Vector<const int64_t> ValueHelper::GetVector() {
+  return int64_vector();
+}
+
 // Helper macros that can be used in FOR_INT32_INPUTS(i) { ... i ... }
 #define FOR_INPUTS(ctype, itype, var) \
   for (ctype var : ::v8::internal::compiler::ValueHelper::itype##_vector())
diff --git a/deps/v8/test/cctest/heap/heap-tester.h b/deps/v8/test/cctest/heap/heap-tester.h
index 0b47665a781d3d..998e3ff011fa3e 100644
--- a/deps/v8/test/cctest/heap/heap-tester.h
+++ b/deps/v8/test/cctest/heap/heap-tester.h
@@ -10,53 +10,53 @@
 
 // Tests that should have access to private methods of {v8::internal::Heap}.
 // Those tests need to be defined using HEAP_TEST(Name) { ... }.
-#define HEAP_TEST_METHODS(V)                              \
-  V(CompactionFullAbortedPage)                            \
-  V(CompactionPartiallyAbortedPage)                       \
-  V(CompactionPartiallyAbortedPageIntraAbortedPointers)   \
-  V(CompactionPartiallyAbortedPageWithInvalidatedSlots)   \
-  V(CompactionPartiallyAbortedPageWithStoreBufferEntries) \
-  V(CompactionSpaceDivideMultiplePages)                   \
-  V(CompactionSpaceDivideSinglePage)                      \
-  V(InvalidatedSlotsAfterTrimming)                        \
-  V(InvalidatedSlotsAllInvalidatedRanges)                 \
-  V(InvalidatedSlotsCleanupEachObject)                    \
-  V(InvalidatedSlotsCleanupFull)                          \
-  V(InvalidatedSlotsCleanupRightTrim)                     \
-  V(InvalidatedSlotsCleanupOverlapRight)                  \
-  V(InvalidatedSlotsEvacuationCandidate)                  \
-  V(InvalidatedSlotsNoInvalidatedRanges)                  \
-  V(InvalidatedSlotsResetObjectRegression)                \
-  V(InvalidatedSlotsRightTrimFixedArray)                  \
-  V(InvalidatedSlotsRightTrimLargeFixedArray)             \
-  V(InvalidatedSlotsLeftTrimFixedArray)                   \
-  V(InvalidatedSlotsFastToSlow)                           \
-  V(InvalidatedSlotsSomeInvalidatedRanges)                \
-  V(TestNewSpaceRefsInCopiedCode)                         \
-  V(GCFlags)                                              \
-  V(MarkCompactCollector)                                 \
-  V(MarkCompactEpochCounter)                              \
-  V(MemoryReducerActivationForSmallHeaps)                 \
-  V(NoPromotion)                                          \
-  V(NumberStringCacheSize)                                \
-  V(ObjectGroups)                                         \
-  V(Promotion)                                            \
-  V(Regression39128)                                      \
-  V(ResetWeakHandle)                                      \
-  V(StressHandles)                                        \
-  V(TestMemoryReducerSampleJsCalls)                       \
-  V(TestSizeOfObjects)                                    \
-  V(Regress5831)                                          \
-  V(Regress538257)                                        \
-  V(Regress587004)                                        \
-  V(Regress589413)                                        \
-  V(Regress658718)                                        \
-  V(Regress670675)                                        \
-  V(Regress777177)                                        \
-  V(Regress779503)                                        \
-  V(Regress791582)                                        \
-  V(Regress845060)                                        \
-  V(RegressMissingWriteBarrierInAllocate)                 \
+#define HEAP_TEST_METHODS(V)                                \
+  V(CompactionFullAbortedPage)                              \
+  V(CompactionPartiallyAbortedPage)                         \
+  V(CompactionPartiallyAbortedPageIntraAbortedPointers)     \
+  V(CompactionPartiallyAbortedPageWithInvalidatedSlots)     \
+  V(CompactionPartiallyAbortedPageWithRememberedSetEntries) \
+  V(CompactionSpaceDivideMultiplePages)                     \
+  V(CompactionSpaceDivideSinglePage)                        \
+  V(InvalidatedSlotsAfterTrimming)                          \
+  V(InvalidatedSlotsAllInvalidatedRanges)                   \
+  V(InvalidatedSlotsCleanupEachObject)                      \
+  V(InvalidatedSlotsCleanupFull)                            \
+  V(InvalidatedSlotsCleanupRightTrim)                       \
+  V(InvalidatedSlotsCleanupOverlapRight)                    \
+  V(InvalidatedSlotsEvacuationCandidate)                    \
+  V(InvalidatedSlotsNoInvalidatedRanges)                    \
+  V(InvalidatedSlotsResetObjectRegression)                  \
+  V(InvalidatedSlotsRightTrimFixedArray)                    \
+  V(InvalidatedSlotsRightTrimLargeFixedArray)               \
+  V(InvalidatedSlotsLeftTrimFixedArray)                     \
+  V(InvalidatedSlotsFastToSlow)                             \
+  V(InvalidatedSlotsSomeInvalidatedRanges)                  \
+  V(TestNewSpaceRefsInCopiedCode)                           \
+  V(GCFlags)                                                \
+  V(MarkCompactCollector)                                   \
+  V(MarkCompactEpochCounter)                                \
+  V(MemoryReducerActivationForSmallHeaps)                   \
+  V(NoPromotion)                                            \
+  V(NumberStringCacheSize)                                  \
+  V(ObjectGroups)                                           \
+  V(Promotion)                                              \
+  V(Regression39128)                                        \
+  V(ResetWeakHandle)                                        \
+  V(StressHandles)                                          \
+  V(TestMemoryReducerSampleJsCalls)                         \
+  V(TestSizeOfObjects)                                      \
+  V(Regress5831)                                            \
+  V(Regress538257)                                          \
+  V(Regress587004)                                          \
+  V(Regress589413)                                          \
+  V(Regress658718)                                          \
+  V(Regress670675)                                          \
+  V(Regress777177)                                          \
+  V(Regress779503)                                          \
+  V(Regress791582)                                          \
+  V(Regress845060)                                          \
+  V(RegressMissingWriteBarrierInAllocate)                   \
   V(WriteBarriersInCopyJSObject)
 
 #define HEAP_TEST(Name)                                                   \
diff --git a/deps/v8/test/cctest/heap/heap-utils.cc b/deps/v8/test/cctest/heap/heap-utils.cc
index 3fa2714a61beb2..30ebfd05021a19 100644
--- a/deps/v8/test/cctest/heap/heap-utils.cc
+++ b/deps/v8/test/cctest/heap/heap-utils.cc
@@ -121,32 +121,24 @@ std::vector<Handle<FixedArray>> CreatePadding(Heap* heap, int padding_size,
   return handles;
 }
 
-void AllocateAllButNBytes(v8::internal::NewSpace* space, int extra_bytes,
-                          std::vector<Handle<FixedArray>>* out_handles) {
-  PauseAllocationObserversScope pause_observers(space->heap());
-  int space_remaining = static_cast<int>(*space->allocation_limit_address() -
-                                         *space->allocation_top_address());
-  CHECK(space_remaining >= extra_bytes);
-  int new_linear_size = space_remaining - extra_bytes;
-  if (new_linear_size == 0) return;
-  std::vector<Handle<FixedArray>> handles = heap::CreatePadding(
-      space->heap(), new_linear_size, i::AllocationType::kYoung);
-  if (out_handles != nullptr) {
-    out_handles->insert(out_handles->end(), handles.begin(), handles.end());
-  }
-}
-
-void FillCurrentPage(v8::internal::NewSpace* space,
+bool FillCurrentPage(v8::internal::NewSpace* space,
                      std::vector<Handle<FixedArray>>* out_handles) {
-  heap::AllocateAllButNBytes(space, 0, out_handles);
+  return heap::FillCurrentPageButNBytes(space, 0, out_handles);
 }
 
-bool FillUpOnePage(v8::internal::NewSpace* space,
-                   std::vector<Handle<FixedArray>>* out_handles) {
+bool FillCurrentPageButNBytes(v8::internal::NewSpace* space, int extra_bytes,
+                              std::vector<Handle<FixedArray>>* out_handles) {
   PauseAllocationObserversScope pause_observers(space->heap());
-  int space_remaining = static_cast<int>(*space->allocation_limit_address() -
-                                         *space->allocation_top_address());
-  if (space_remaining == 0) return false;
+  // We cannot rely on `space->limit()` to point to the end of the current page
+  // in the case where inline allocations are disabled, it actually points to
+  // the current allocation pointer.
+  DCHECK_IMPLIES(space->heap()->inline_allocation_disabled(),
+                 space->limit() == space->top());
+  int space_remaining =
+      static_cast<int>(space->to_space().page_high() - space->top());
+  CHECK(space_remaining >= extra_bytes);
+  int new_linear_size = space_remaining - extra_bytes;
+  if (new_linear_size == 0) return false;
   std::vector<Handle<FixedArray>> handles = heap::CreatePadding(
       space->heap(), space_remaining, i::AllocationType::kYoung);
   if (out_handles != nullptr) {
@@ -157,8 +149,7 @@ bool FillUpOnePage(v8::internal::NewSpace* space,
 
 void SimulateFullSpace(v8::internal::NewSpace* space,
                        std::vector<Handle<FixedArray>>* out_handles) {
-  heap::FillCurrentPage(space, out_handles);
-  while (heap::FillUpOnePage(space, out_handles) || space->AddFreshPage()) {
+  while (heap::FillCurrentPage(space, out_handles) || space->AddFreshPage()) {
   }
 }
 
diff --git a/deps/v8/test/cctest/heap/heap-utils.h b/deps/v8/test/cctest/heap/heap-utils.h
index dfd4094913e84d..4962f898494a22 100644
--- a/deps/v8/test/cctest/heap/heap-utils.h
+++ b/deps/v8/test/cctest/heap/heap-utils.h
@@ -42,17 +42,14 @@ std::vector<Handle<FixedArray>> CreatePadding(
     Heap* heap, int padding_size, AllocationType allocation,
     int object_size = kMaxRegularHeapObjectSize);
 
-void AllocateAllButNBytes(
+bool FillCurrentPage(v8::internal::NewSpace* space,
+                     std::vector<Handle<FixedArray>>* out_handles = nullptr);
+
+bool FillCurrentPageButNBytes(
     v8::internal::NewSpace* space, int extra_bytes,
     std::vector<Handle<FixedArray>>* out_handles = nullptr);
 
-void FillCurrentPage(v8::internal::NewSpace* space,
-                     std::vector<Handle<FixedArray>>* out_handles = nullptr);
-
 // Helper function that simulates a full new-space in the heap.
-bool FillUpOnePage(v8::internal::NewSpace* space,
-                   std::vector<Handle<FixedArray>>* out_handles = nullptr);
-
 void SimulateFullSpace(v8::internal::NewSpace* space,
                        std::vector<Handle<FixedArray>>* out_handles = nullptr);
 
diff --git a/deps/v8/test/cctest/heap/test-alloc.cc b/deps/v8/test/cctest/heap/test-alloc.cc
index f3ae6c125ddae3..684bda4411f408 100644
--- a/deps/v8/test/cctest/heap/test-alloc.cc
+++ b/deps/v8/test/cctest/heap/test-alloc.cc
@@ -86,7 +86,10 @@ Handle<Object> HeapTester::TestAllocateAfterFailures() {
   // Code space.
   heap::SimulateFullSpace(heap->code_space());
   size = CcTest::i_isolate()->builtins()->builtin(Builtins::kIllegal).Size();
-  obj = heap->AllocateRaw(size, AllocationType::kCode).ToObjectChecked();
+  obj =
+      heap->AllocateRaw(size, AllocationType::kCode, AllocationOrigin::kRuntime,
+                        AllocationAlignment::kCodeAligned)
+          .ToObjectChecked();
   heap->CreateFillerObjectAt(obj.address(), size, ClearRecordedSlots::kNo);
   return CcTest::i_isolate()->factory()->true_value();
 }
diff --git a/deps/v8/test/cctest/heap/test-array-buffer-tracker.cc b/deps/v8/test/cctest/heap/test-array-buffer-tracker.cc
index 66354cab7f1c1e..82cc6c84f3429c 100644
--- a/deps/v8/test/cctest/heap/test-array-buffer-tracker.cc
+++ b/deps/v8/test/cctest/heap/test-array-buffer-tracker.cc
@@ -4,6 +4,7 @@
 
 #include "src/api/api-inl.h"
 #include "src/execution/isolate.h"
+#include "src/heap/array-buffer-sweeper.h"
 #include "src/heap/array-buffer-tracker.h"
 #include "src/heap/heap-inl.h"
 #include "src/heap/spaces.h"
@@ -20,6 +21,27 @@ bool IsTracked(i::JSArrayBuffer buf) {
   return i::ArrayBufferTracker::IsTracked(buf);
 }
 
+bool IsTrackedYoung(i::Heap* heap, i::ArrayBufferExtension* extension) {
+  bool in_young = heap->array_buffer_sweeper()->young().Contains(extension);
+  bool in_old = heap->array_buffer_sweeper()->old().Contains(extension);
+  CHECK(!(in_young && in_old));
+  return in_young;
+}
+
+bool IsTrackedOld(i::Heap* heap, i::ArrayBufferExtension* extension) {
+  bool in_young = heap->array_buffer_sweeper()->young().Contains(extension);
+  bool in_old = heap->array_buffer_sweeper()->old().Contains(extension);
+  CHECK(!(in_young && in_old));
+  return in_old;
+}
+
+bool IsTracked(i::Heap* heap, i::ArrayBufferExtension* extension) {
+  bool in_young = heap->array_buffer_sweeper()->young().Contains(extension);
+  bool in_old = heap->array_buffer_sweeper()->old().Contains(extension);
+  CHECK(!(in_young && in_old));
+  return in_young || in_old;
+}
+
 }  // namespace
 
 namespace v8 {
@@ -30,6 +52,7 @@ namespace heap {
 // moving the objects through various spaces during GC phases.
 
 TEST(ArrayBuffer_OnlyMC) {
+  if (V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
   ManualGCScope manual_gc_scope;
   CcTest::InitializeVM();
   LocalContext env;
@@ -57,7 +80,34 @@ TEST(ArrayBuffer_OnlyMC) {
   CHECK(!IsTracked(raw_ab));
 }
 
+TEST(ArrayBuffer_OnlyMC_Extension) {
+  if (!V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
+  FLAG_concurrent_array_buffer_sweeping = false;
+
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
+
+  ArrayBufferExtension* extension;
+  {
+    v8::HandleScope handle_scope(isolate);
+    Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, 100);
+    Handle<JSArrayBuffer> buf = v8::Utils::OpenHandle(*ab);
+    extension = buf->extension();
+    CHECK(IsTrackedYoung(heap, extension));
+    heap::GcAndSweep(heap, OLD_SPACE);
+    CHECK(IsTrackedOld(heap, extension));
+    heap::GcAndSweep(heap, OLD_SPACE);
+    CHECK(IsTrackedOld(heap, extension));
+  }
+  heap::GcAndSweep(heap, OLD_SPACE);
+  CHECK(!IsTracked(heap, extension));
+}
+
 TEST(ArrayBuffer_OnlyScavenge) {
+  if (V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
   ManualGCScope manual_gc_scope;
   CcTest::InitializeVM();
   LocalContext env;
@@ -87,7 +137,36 @@ TEST(ArrayBuffer_OnlyScavenge) {
   CHECK(!IsTracked(raw_ab));
 }
 
+TEST(ArrayBuffer_OnlyScavenge_Extension) {
+  if (!V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
+  FLAG_concurrent_array_buffer_sweeping = false;
+
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
+
+  ArrayBufferExtension* extension;
+  {
+    v8::HandleScope handle_scope(isolate);
+    Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, 100);
+    Handle<JSArrayBuffer> buf = v8::Utils::OpenHandle(*ab);
+    extension = buf->extension();
+    CHECK(IsTrackedYoung(heap, extension));
+    heap::GcAndSweep(heap, NEW_SPACE);
+    CHECK(IsTrackedYoung(heap, extension));
+    heap::GcAndSweep(heap, NEW_SPACE);
+    CHECK(IsTrackedOld(heap, extension));
+    heap::GcAndSweep(heap, NEW_SPACE);
+    CHECK(IsTrackedOld(heap, extension));
+  }
+  heap::GcAndSweep(heap, OLD_SPACE);
+  CHECK(!IsTracked(heap, extension));
+}
+
 TEST(ArrayBuffer_ScavengeAndMC) {
+  if (V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
   ManualGCScope manual_gc_scope;
   CcTest::InitializeVM();
   LocalContext env;
@@ -119,8 +198,38 @@ TEST(ArrayBuffer_ScavengeAndMC) {
   CHECK(!IsTracked(raw_ab));
 }
 
+TEST(ArrayBuffer_ScavengeAndMC_Extension) {
+  if (!V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
+  FLAG_concurrent_array_buffer_sweeping = false;
+
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
+
+  ArrayBufferExtension* extension;
+  {
+    v8::HandleScope handle_scope(isolate);
+    Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, 100);
+    Handle<JSArrayBuffer> buf = v8::Utils::OpenHandle(*ab);
+    extension = buf->extension();
+    CHECK(IsTrackedYoung(heap, extension));
+    heap::GcAndSweep(heap, NEW_SPACE);
+    CHECK(IsTrackedYoung(heap, extension));
+    heap::GcAndSweep(heap, NEW_SPACE);
+    CHECK(IsTrackedOld(heap, extension));
+    heap::GcAndSweep(heap, OLD_SPACE);
+    CHECK(IsTrackedOld(heap, extension));
+    heap::GcAndSweep(heap, NEW_SPACE);
+    CHECK(IsTrackedOld(heap, extension));
+  }
+  heap::GcAndSweep(heap, OLD_SPACE);
+  CHECK(!IsTracked(heap, extension));
+}
+
 TEST(ArrayBuffer_Compaction) {
-  if (FLAG_never_compact) return;
+  if (FLAG_never_compact || V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
   ManualGCScope manual_gc_scope;
   FLAG_manual_evacuation_candidates_selection = true;
   CcTest::InitializeVM();
@@ -149,9 +258,10 @@ TEST(ArrayBuffer_Compaction) {
 }
 
 TEST(ArrayBuffer_UnregisterDuringSweep) {
+  if (V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
 // Regular pages in old space (without compaction) are processed concurrently
 // in the sweeper. If we happen to unregister a buffer (either explicitly, or
-// implicitly through e.g. |Externalize|) we need to sync with the sweeper
+// implicitly through e.g. |Detach|) we need to sync with the sweeper
 // task.
 //
 // Note: This test will will only fail on TSAN configurations.
@@ -189,17 +299,15 @@ TEST(ArrayBuffer_UnregisterDuringSweep) {
     }
 
     CcTest::CollectGarbage(OLD_SPACE);
-    // |Externalize| will cause the buffer to be |Unregister|ed. Without
+    // |Detach| will cause the buffer to be |Unregister|ed. Without
     // barriers and proper synchronization this will trigger a data race on
     // TSAN.
-    v8::ArrayBuffer::Contents contents = ab->Externalize();
-    contents.Deleter()(contents.Data(), contents.ByteLength(),
-                       contents.DeleterData());
+    ab->Detach();
   }
 }
 
 TEST(ArrayBuffer_NonLivePromotion) {
-  if (!FLAG_incremental_marking) return;
+  if (!FLAG_incremental_marking || V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
   ManualGCScope manual_gc_scope;
   // The test verifies that the marking state is preserved when promoting
   // a buffer to old space.
@@ -236,7 +344,7 @@ TEST(ArrayBuffer_NonLivePromotion) {
 }
 
 TEST(ArrayBuffer_LivePromotion) {
-  if (!FLAG_incremental_marking) return;
+  if (!FLAG_incremental_marking || V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
   ManualGCScope manual_gc_scope;
   // The test verifies that the marking state is preserved when promoting
   // a buffer to old space.
@@ -272,7 +380,7 @@ TEST(ArrayBuffer_LivePromotion) {
 }
 
 TEST(ArrayBuffer_SemiSpaceCopyThenPagePromotion) {
-  if (!i::FLAG_incremental_marking) return;
+  if (!i::FLAG_incremental_marking || V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
   ManualGCScope manual_gc_scope;
   // The test verifies that the marking state is preserved across semispace
   // copy.
@@ -306,6 +414,42 @@ TEST(ArrayBuffer_SemiSpaceCopyThenPagePromotion) {
   }
 }
 
+TEST(ArrayBuffer_PagePromotion_Extension) {
+  if (!i::FLAG_incremental_marking || !V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
+  i::FLAG_always_promote_young_mc = true;
+  i::FLAG_concurrent_array_buffer_sweeping = false;
+
+  ManualGCScope manual_gc_scope;
+  // The test verifies that the marking state is preserved across semispace
+  // copy.
+  CcTest::InitializeVM();
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
+
+  heap::SealCurrentObjects(heap);
+  {
+    v8::HandleScope handle_scope(isolate);
+    Handle<FixedArray> root =
+        heap->isolate()->factory()->NewFixedArray(1, AllocationType::kOld);
+    ArrayBufferExtension* extension;
+    {
+      v8::HandleScope handle_scope(isolate);
+      Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, 100);
+      Handle<JSArrayBuffer> buf = v8::Utils::OpenHandle(*ab);
+      extension = buf->extension();
+      root->set(0, *buf);  // Buffer that should be promoted as live.
+    }
+    std::vector<Handle<FixedArray>> handles;
+    // Create live objects on page such that the whole page gets promoted
+    heap::FillCurrentPage(heap->new_space(), &handles);
+    CHECK(IsTrackedYoung(heap, extension));
+    heap::SimulateIncrementalMarking(heap, true);
+    heap::GcAndSweep(heap, OLD_SPACE);
+    CHECK(IsTrackedOld(heap, extension));
+  }
+}
+
 UNINITIALIZED_TEST(ArrayBuffer_SemiSpaceCopyMultipleTasks) {
   if (FLAG_optimize_for_size) return;
   ManualGCScope manual_gc_scope;
@@ -339,6 +483,7 @@ UNINITIALIZED_TEST(ArrayBuffer_SemiSpaceCopyMultipleTasks) {
 }
 
 TEST(ArrayBuffer_ExternalBackingStoreSizeIncreases) {
+  if (V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
   CcTest::InitializeVM();
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
@@ -380,7 +525,7 @@ TEST(ArrayBuffer_ExternalBackingStoreSizeDecreases) {
 }
 
 TEST(ArrayBuffer_ExternalBackingStoreSizeIncreasesMarkCompact) {
-  if (FLAG_never_compact) return;
+  if (FLAG_never_compact || V8_ARRAY_BUFFER_EXTENSION_BOOL) return;
   ManualGCScope manual_gc_scope;
   FLAG_manual_evacuation_candidates_selection = true;
   CcTest::InitializeVM();
diff --git a/deps/v8/test/cctest/heap/test-compaction.cc b/deps/v8/test/cctest/heap/test-compaction.cc
index 96eca0f5aecbe2..d5a5df9cf225a9 100644
--- a/deps/v8/test/cctest/heap/test-compaction.cc
+++ b/deps/v8/test/cctest/heap/test-compaction.cc
@@ -335,13 +335,12 @@ HEAP_TEST(CompactionPartiallyAbortedPageIntraAbortedPointers) {
   }
 }
 
-
-HEAP_TEST(CompactionPartiallyAbortedPageWithStoreBufferEntries) {
-  if (FLAG_never_compact) return;
+HEAP_TEST(CompactionPartiallyAbortedPageWithRememberedSetEntries) {
+  if (FLAG_never_compact || FLAG_always_promote_young_mc) return;
   // Test the scenario where we reach OOM during compaction and parts of the
   // page have already been migrated to a new one. Objects on the aborted page
   // are linked together and the very first object on the aborted page points
-  // into new space. The test verifies that the store buffer entries are
+  // into new space. The test verifies that the remembered set entries are
   // properly cleared and rebuilt after aborting a page. Failing to do so can
   // result in other objects being allocated in the free space where their
   // payload looks like a valid new space pointer.
@@ -452,7 +451,7 @@ HEAP_TEST(CompactionPartiallyAbortedPageWithStoreBufferEntries) {
                      .ToHandleChecked();
       } while (Page::FromHeapObject(*string) != to_be_aborted_page);
 
-      // If store buffer entries are not properly filtered/reset for aborted
+      // If remembered set entries are not properly filtered/reset for aborted
       // pages we have now a broken address at an object slot in old space and
       // the following scavenge will crash.
       CcTest::CollectGarbage(NEW_SPACE);
diff --git a/deps/v8/test/cctest/heap/test-concurrent-marking.cc b/deps/v8/test/cctest/heap/test-concurrent-marking.cc
index 3a67954528e819..ca48d3b4ce1b7e 100644
--- a/deps/v8/test/cctest/heap/test-concurrent-marking.cc
+++ b/deps/v8/test/cctest/heap/test-concurrent-marking.cc
@@ -18,10 +18,8 @@ namespace v8 {
 namespace internal {
 namespace heap {
 
-void PublishSegment(ConcurrentMarking::MarkingWorklist* worklist,
-                    HeapObject object) {
-  for (size_t i = 0; i <= ConcurrentMarking::MarkingWorklist::kSegmentCapacity;
-       i++) {
+void PublishSegment(MarkingWorklist* worklist, HeapObject object) {
+  for (size_t i = 0; i <= MarkingWorklist::kSegmentCapacity; i++) {
     worklist->Push(0, object);
   }
   CHECK(worklist->Pop(0, &object));
@@ -38,12 +36,12 @@ TEST(ConcurrentMarking) {
     collector->EnsureSweepingCompleted();
   }
 
-  ConcurrentMarking::MarkingWorklist shared, on_hold;
-  ConcurrentMarking::EmbedderTracingWorklist embedder_objects;
+  MarkingWorklistsHolder marking_worklists_holder;
   WeakObjects weak_objects;
-  ConcurrentMarking* concurrent_marking = new ConcurrentMarking(
-      heap, &shared, &on_hold, &weak_objects, &embedder_objects);
-  PublishSegment(&shared, ReadOnlyRoots(heap).undefined_value());
+  ConcurrentMarking* concurrent_marking =
+      new ConcurrentMarking(heap, &marking_worklists_holder, &weak_objects);
+  PublishSegment(marking_worklists_holder.shared(),
+                 ReadOnlyRoots(heap).undefined_value());
   concurrent_marking->ScheduleTasks();
   concurrent_marking->Stop(
       ConcurrentMarking::StopRequest::COMPLETE_TASKS_FOR_TESTING);
@@ -61,16 +59,17 @@ TEST(ConcurrentMarkingReschedule) {
     collector->EnsureSweepingCompleted();
   }
 
-  ConcurrentMarking::MarkingWorklist shared, on_hold;
-  ConcurrentMarking::EmbedderTracingWorklist embedder_objects;
+  MarkingWorklistsHolder marking_worklists_holder;
   WeakObjects weak_objects;
-  ConcurrentMarking* concurrent_marking = new ConcurrentMarking(
-      heap, &shared, &on_hold, &weak_objects, &embedder_objects);
-  PublishSegment(&shared, ReadOnlyRoots(heap).undefined_value());
+  ConcurrentMarking* concurrent_marking =
+      new ConcurrentMarking(heap, &marking_worklists_holder, &weak_objects);
+  PublishSegment(marking_worklists_holder.shared(),
+                 ReadOnlyRoots(heap).undefined_value());
   concurrent_marking->ScheduleTasks();
   concurrent_marking->Stop(
       ConcurrentMarking::StopRequest::COMPLETE_ONGOING_TASKS);
-  PublishSegment(&shared, ReadOnlyRoots(heap).undefined_value());
+  PublishSegment(marking_worklists_holder.shared(),
+                 ReadOnlyRoots(heap).undefined_value());
   concurrent_marking->RescheduleTasksIfNeeded();
   concurrent_marking->Stop(
       ConcurrentMarking::StopRequest::COMPLETE_TASKS_FOR_TESTING);
@@ -88,17 +87,18 @@ TEST(ConcurrentMarkingPreemptAndReschedule) {
     collector->EnsureSweepingCompleted();
   }
 
-  ConcurrentMarking::MarkingWorklist shared, on_hold;
-  ConcurrentMarking::EmbedderTracingWorklist embedder_objects;
+  MarkingWorklistsHolder marking_worklists_holder;
   WeakObjects weak_objects;
-  ConcurrentMarking* concurrent_marking = new ConcurrentMarking(
-      heap, &shared, &on_hold, &weak_objects, &embedder_objects);
+  ConcurrentMarking* concurrent_marking =
+      new ConcurrentMarking(heap, &marking_worklists_holder, &weak_objects);
   for (int i = 0; i < 5000; i++)
-    PublishSegment(&shared, ReadOnlyRoots(heap).undefined_value());
+    PublishSegment(marking_worklists_holder.shared(),
+                   ReadOnlyRoots(heap).undefined_value());
   concurrent_marking->ScheduleTasks();
   concurrent_marking->Stop(ConcurrentMarking::StopRequest::PREEMPT_TASKS);
   for (int i = 0; i < 5000; i++)
-    PublishSegment(&shared, ReadOnlyRoots(heap).undefined_value());
+    PublishSegment(marking_worklists_holder.shared(),
+                   ReadOnlyRoots(heap).undefined_value());
   concurrent_marking->RescheduleTasksIfNeeded();
   concurrent_marking->Stop(
       ConcurrentMarking::StopRequest::COMPLETE_TASKS_FOR_TESTING);
diff --git a/deps/v8/test/cctest/heap/test-embedder-tracing.cc b/deps/v8/test/cctest/heap/test-embedder-tracing.cc
index 8ff4acc05beb53..37b31c2c337b21 100644
--- a/deps/v8/test/cctest/heap/test-embedder-tracing.cc
+++ b/deps/v8/test/cctest/heap/test-embedder-tracing.cc
@@ -56,15 +56,23 @@ class TestEmbedderHeapTracer final : public v8::EmbedderHeapTracer {
                                embedder_fields.begin(), embedder_fields.end());
   }
 
-  void AddReferenceForTracing(v8::TracedGlobal<v8::Object>* global) {
+  void AddReferenceForTracing(v8::TracedGlobal<v8::Value>* global) {
     to_register_with_v8_.push_back(global);
   }
 
+  void AddReferenceForTracing(v8::TracedReference<v8::Value>* ref) {
+    to_register_with_v8_references_.push_back(ref);
+  }
+
   bool AdvanceTracing(double deadline_in_ms) final {
     for (auto global : to_register_with_v8_) {
       RegisterEmbedderReference(global->As<v8::Data>());
     }
     to_register_with_v8_.clear();
+    for (auto ref : to_register_with_v8_references_) {
+      RegisterEmbedderReference(ref->As<v8::Data>());
+    }
+    to_register_with_v8_references_.clear();
     return true;
   }
 
@@ -78,7 +86,7 @@ class TestEmbedderHeapTracer final : public v8::EmbedderHeapTracer {
     }
   }
 
-  void TraceEpilogue() final {}
+  void TraceEpilogue(TraceSummary*) final {}
   void EnterFinalPause(EmbedderStackState) final {}
 
   bool IsRegisteredFromV8(void* first_field) const {
@@ -98,7 +106,8 @@ class TestEmbedderHeapTracer final : public v8::EmbedderHeapTracer {
 
  private:
   std::vector<std::pair<void*, void*>> registered_from_v8_;
-  std::vector<v8::TracedGlobal<v8::Object>*> to_register_with_v8_;
+  std::vector<v8::TracedGlobal<v8::Value>*> to_register_with_v8_;
+  std::vector<v8::TracedReference<v8::Value>*> to_register_with_v8_references_;
   bool consider_traced_global_as_root_ = true;
   TracePrologueBehavior prologue_behavior_ = TracePrologueBehavior::kNoop;
   v8::Global<v8::Array> array_;
@@ -138,10 +147,10 @@ TEST(EmbedderRegisteringV8Reference) {
   v8::Local<v8::Context> context = v8::Context::New(isolate);
   v8::Context::Scope context_scope(context);
 
-  v8::TracedGlobal<v8::Object> g;
+  v8::TracedGlobal<v8::Value> g;
   {
     v8::HandleScope inner_scope(isolate);
-    v8::Local<v8::Object> o =
+    v8::Local<v8::Value> o =
         v8::Local<v8::Object>::New(isolate, v8::Object::New(isolate));
     g.Reset(isolate, o);
   }
@@ -520,6 +529,74 @@ TEST(TracedGlobalWrapperClassId) {
   CHECK_EQ(17, traced.WrapperClassId());
 }
 
+TEST(TracedReferenceHandlesMarking) {
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+  v8::TracedReference<v8::Value> live;
+  v8::TracedReference<v8::Value> dead;
+  live.Reset(isolate, v8::Undefined(isolate));
+  dead.Reset(isolate, v8::Undefined(isolate));
+  i::GlobalHandles* global_handles = CcTest::i_isolate()->global_handles();
+  {
+    TestEmbedderHeapTracer tracer;
+    heap::TemporaryEmbedderHeapTracerScope tracer_scope(isolate, &tracer);
+    tracer.AddReferenceForTracing(&live);
+    const size_t initial_count = global_handles->handles_count();
+    InvokeMarkSweep();
+    const size_t final_count = global_handles->handles_count();
+    // Handles are black allocated, so the first GC does not collect them.
+    CHECK_EQ(initial_count, final_count);
+  }
+
+  {
+    TestEmbedderHeapTracer tracer;
+    heap::TemporaryEmbedderHeapTracerScope tracer_scope(isolate, &tracer);
+    tracer.AddReferenceForTracing(&live);
+    const size_t initial_count = global_handles->handles_count();
+    InvokeMarkSweep();
+    const size_t final_count = global_handles->handles_count();
+    CHECK_EQ(initial_count, final_count + 1);
+  }
+}
+
+TEST(TracedReferenceHandlesDoNotLeak) {
+  // TracedReference handles are not cleared by the destructor of the embedder
+  // object. To avoid leaks we need to mark these handles during GC.
+  // This test checks that unmarked handles do not leak.
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+  v8::TracedReference<v8::Value> ref;
+  ref.Reset(isolate, v8::Undefined(isolate));
+  i::GlobalHandles* global_handles = CcTest::i_isolate()->global_handles();
+  const size_t initial_count = global_handles->handles_count();
+  // We need two GCs because handles are black allocated.
+  InvokeMarkSweep();
+  InvokeMarkSweep();
+  const size_t final_count = global_handles->handles_count();
+  CHECK_EQ(initial_count, final_count + 1);
+}
+
+TEST(TracedGlobalHandlesAreRetained) {
+  // TracedGlobal handles are cleared by the destructor of the embedder object.
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+  v8::TracedGlobal<v8::Value> global;
+  global.Reset(isolate, v8::Undefined(isolate));
+  i::GlobalHandles* global_handles = CcTest::i_isolate()->global_handles();
+  const size_t initial_count = global_handles->handles_count();
+  // We need two GCs because handles are black allocated.
+  InvokeMarkSweep();
+  InvokeMarkSweep();
+  const size_t final_count = global_handles->handles_count();
+  CHECK_EQ(initial_count, final_count);
+}
+
 namespace {
 
 class TracedGlobalVisitor final
@@ -704,7 +781,7 @@ class EmptyEmbedderHeapTracer : public v8::EmbedderHeapTracer {
   bool AdvanceTracing(double deadline_in_ms) final { return true; }
   bool IsTracingDone() final { return true; }
   void TracePrologue(EmbedderHeapTracer::TraceFlags) final {}
-  void TraceEpilogue() final {}
+  void TraceEpilogue(TraceSummary*) final {}
   void EnterFinalPause(EmbedderStackState) final {}
 };
 
@@ -721,12 +798,6 @@ class EmbedderHeapTracerDestructorNonTracingClearing final
     return handle.WrapperClassId() != class_id_to_optimize_;
   }
 
-  void ResetHandleInNonTracingGC(
-      const v8::TracedGlobal<v8::Value>& handle) final {
-    // Not called when used with handles that have destructors.
-    CHECK(false);
-  }
-
  private:
   uint16_t class_id_to_optimize_;
 };
@@ -836,6 +907,402 @@ TEST(TracedGlobalNoDestructorReclaimedOnScavenge) {
   CHECK_EQ(initial_count, global_handles->handles_count());
 }
 
+namespace {
+
+template <typename T>
+V8_NOINLINE void OnStackTest(TestEmbedderHeapTracer* tracer) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::Global<v8::Object> observer;
+  T stack_ref;
+  {
+    v8::HandleScope scope(isolate);
+    v8::Local<v8::Object> object(ConstructTraceableJSApiObject(
+        isolate->GetCurrentContext(), nullptr, nullptr));
+    stack_ref.Reset(isolate, object);
+    observer.Reset(isolate, object);
+    observer.SetWeak();
+  }
+  CHECK(!observer.IsEmpty());
+  heap::InvokeMarkSweep();
+  CHECK(!observer.IsEmpty());
+}
+
+V8_NOINLINE void CreateTracedReferenceInDeepStack(
+    v8::Isolate* isolate, v8::Global<v8::Object>* observer) {
+  v8::TracedReference<v8::Value> stack_ref;
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::Object> object(ConstructTraceableJSApiObject(
+      isolate->GetCurrentContext(), nullptr, nullptr));
+  stack_ref.Reset(isolate, object);
+  observer->Reset(isolate, object);
+  observer->SetWeak();
+}
+
+V8_NOINLINE void TracedReferenceNotifyEmptyStackTest(
+    TestEmbedderHeapTracer* tracer) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::Global<v8::Object> observer;
+  CreateTracedReferenceInDeepStack(isolate, &observer);
+  CHECK(!observer.IsEmpty());
+  tracer->NotifyEmptyEmbedderStack();
+  heap::InvokeMarkSweep();
+  CHECK(observer.IsEmpty());
+}
+
+enum class Operation {
+  kCopy,
+  kMove,
+};
+
+template <typename T>
+void PerformOperation(Operation op, T* lhs, T* rhs) {
+  switch (op) {
+    case Operation::kMove:
+      *lhs = std::move(*rhs);
+      break;
+    case Operation::kCopy:
+      *lhs = *rhs;
+      rhs->Reset();
+      break;
+  }
+}
+
+enum class TargetHandling {
+  kNonInitialized,
+  kInitializedYoungGen,
+  kInitializedOldGen
+};
+
+template <typename T>
+V8_NOINLINE void StackToHeapTest(TestEmbedderHeapTracer* tracer, Operation op,
+                                 TargetHandling target_handling) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::Global<v8::Object> observer;
+  T stack_handle;
+  T* heap_handle = new T();
+  if (target_handling != TargetHandling::kNonInitialized) {
+    v8::HandleScope scope(isolate);
+    v8::Local<v8::Object> to_object(ConstructTraceableJSApiObject(
+        isolate->GetCurrentContext(), nullptr, nullptr));
+    CHECK(i::Heap::InYoungGeneration(*v8::Utils::OpenHandle(*to_object)));
+    if (target_handling == TargetHandling::kInitializedOldGen) {
+      heap::InvokeScavenge();
+      heap::InvokeScavenge();
+      CHECK(!i::Heap::InYoungGeneration(*v8::Utils::OpenHandle(*to_object)));
+    }
+    heap_handle->Reset(isolate, to_object);
+  }
+  {
+    v8::HandleScope scope(isolate);
+    v8::Local<v8::Object> object(ConstructTraceableJSApiObject(
+        isolate->GetCurrentContext(), nullptr, nullptr));
+    stack_handle.Reset(isolate, object);
+    observer.Reset(isolate, object);
+    observer.SetWeak();
+  }
+  CHECK(!observer.IsEmpty());
+  tracer->AddReferenceForTracing(heap_handle);
+  heap::InvokeMarkSweep();
+  CHECK(!observer.IsEmpty());
+  tracer->AddReferenceForTracing(heap_handle);
+  PerformOperation(op, heap_handle, &stack_handle);
+  heap::InvokeMarkSweep();
+  CHECK(!observer.IsEmpty());
+  heap::InvokeMarkSweep();
+  CHECK(observer.IsEmpty());
+  delete heap_handle;
+}
+
+template <typename T>
+V8_NOINLINE void HeapToStackTest(TestEmbedderHeapTracer* tracer, Operation op,
+                                 TargetHandling target_handling) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::Global<v8::Object> observer;
+  T stack_handle;
+  T* heap_handle = new T();
+  if (target_handling != TargetHandling::kNonInitialized) {
+    v8::HandleScope scope(isolate);
+    v8::Local<v8::Object> to_object(ConstructTraceableJSApiObject(
+        isolate->GetCurrentContext(), nullptr, nullptr));
+    CHECK(i::Heap::InYoungGeneration(*v8::Utils::OpenHandle(*to_object)));
+    if (target_handling == TargetHandling::kInitializedOldGen) {
+      heap::InvokeScavenge();
+      heap::InvokeScavenge();
+      CHECK(!i::Heap::InYoungGeneration(*v8::Utils::OpenHandle(*to_object)));
+    }
+    stack_handle.Reset(isolate, to_object);
+  }
+  {
+    v8::HandleScope scope(isolate);
+    v8::Local<v8::Object> object(ConstructTraceableJSApiObject(
+        isolate->GetCurrentContext(), nullptr, nullptr));
+    heap_handle->Reset(isolate, object);
+    observer.Reset(isolate, object);
+    observer.SetWeak();
+  }
+  CHECK(!observer.IsEmpty());
+  tracer->AddReferenceForTracing(heap_handle);
+  heap::InvokeMarkSweep();
+  CHECK(!observer.IsEmpty());
+  PerformOperation(op, &stack_handle, heap_handle);
+  heap::InvokeMarkSweep();
+  CHECK(!observer.IsEmpty());
+  stack_handle.Reset();
+  heap::InvokeMarkSweep();
+  CHECK(observer.IsEmpty());
+  delete heap_handle;
+}
+
+template <typename T>
+V8_NOINLINE void StackToStackTest(TestEmbedderHeapTracer* tracer, Operation op,
+                                  TargetHandling target_handling) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::Global<v8::Object> observer;
+  T stack_handle1;
+  T stack_handle2;
+  if (target_handling != TargetHandling::kNonInitialized) {
+    v8::HandleScope scope(isolate);
+    v8::Local<v8::Object> to_object(ConstructTraceableJSApiObject(
+        isolate->GetCurrentContext(), nullptr, nullptr));
+    CHECK(i::Heap::InYoungGeneration(*v8::Utils::OpenHandle(*to_object)));
+    if (target_handling == TargetHandling::kInitializedOldGen) {
+      heap::InvokeScavenge();
+      heap::InvokeScavenge();
+      CHECK(!i::Heap::InYoungGeneration(*v8::Utils::OpenHandle(*to_object)));
+    }
+    stack_handle2.Reset(isolate, to_object);
+  }
+  {
+    v8::HandleScope scope(isolate);
+    v8::Local<v8::Object> object(ConstructTraceableJSApiObject(
+        isolate->GetCurrentContext(), nullptr, nullptr));
+    stack_handle1.Reset(isolate, object);
+    observer.Reset(isolate, object);
+    observer.SetWeak();
+  }
+  CHECK(!observer.IsEmpty());
+  heap::InvokeMarkSweep();
+  CHECK(!observer.IsEmpty());
+  PerformOperation(op, &stack_handle2, &stack_handle1);
+  heap::InvokeMarkSweep();
+  CHECK(!observer.IsEmpty());
+  stack_handle2.Reset();
+  heap::InvokeMarkSweep();
+  CHECK(observer.IsEmpty());
+}
+
+template <typename T>
+V8_NOINLINE void TracedReferenceCleanedTest(TestEmbedderHeapTracer* tracer) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::Object> object(ConstructTraceableJSApiObject(
+      isolate->GetCurrentContext(), nullptr, nullptr));
+  const size_t before =
+      CcTest::i_isolate()->global_handles()->NumberOfOnStackHandlesForTesting();
+  for (int i = 0; i < 100; i++) {
+    T stack_handle;
+    stack_handle.Reset(isolate, object);
+  }
+  CHECK_EQ(before + 1, CcTest::i_isolate()
+                           ->global_handles()
+                           ->NumberOfOnStackHandlesForTesting());
+}
+
+V8_NOINLINE void TracedGlobalDestructorTest(TestEmbedderHeapTracer* tracer) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::Global<v8::Object> observer;
+  {
+    v8::TracedGlobal<v8::Value> stack_handle;
+    {
+      v8::HandleScope scope(isolate);
+      v8::Local<v8::Object> object(ConstructTraceableJSApiObject(
+          isolate->GetCurrentContext(), nullptr, nullptr));
+      stack_handle.Reset(isolate, object);
+      observer.Reset(isolate, object);
+      observer.SetWeak();
+    }
+    CHECK(!observer.IsEmpty());
+    heap::InvokeMarkSweep();
+    CHECK(!observer.IsEmpty());
+  }
+  heap::InvokeMarkSweep();
+  CHECK(observer.IsEmpty());
+}
+
+}  // namespace
+
+TEST(TracedReferenceOnStack) {
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  TestEmbedderHeapTracer tracer;
+  heap::TemporaryEmbedderHeapTracerScope tracer_scope(CcTest::isolate(),
+                                                      &tracer);
+  tracer.SetStackStart(&manual_gc);
+  OnStackTest<v8::TracedReference<v8::Value>>(&tracer);
+}
+
+TEST(TracedGlobalOnStack) {
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  TestEmbedderHeapTracer tracer;
+  heap::TemporaryEmbedderHeapTracerScope tracer_scope(CcTest::isolate(),
+                                                      &tracer);
+  tracer.SetStackStart(&manual_gc);
+  OnStackTest<v8::TracedGlobal<v8::Value>>(&tracer);
+}
+
+TEST(TracedReferenceCleaned) {
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  TestEmbedderHeapTracer tracer;
+  heap::TemporaryEmbedderHeapTracerScope tracer_scope(CcTest::isolate(),
+                                                      &tracer);
+  tracer.SetStackStart(&manual_gc);
+  TracedReferenceCleanedTest<v8::TracedReference<v8::Value>>(&tracer);
+}
+
+TEST(TracedGlobalCleaned) {
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  TestEmbedderHeapTracer tracer;
+  heap::TemporaryEmbedderHeapTracerScope tracer_scope(CcTest::isolate(),
+                                                      &tracer);
+  tracer.SetStackStart(&manual_gc);
+  TracedReferenceCleanedTest<v8::TracedGlobal<v8::Value>>(&tracer);
+}
+
+TEST(TracedReferenceMove) {
+  using ReferenceType = v8::TracedReference<v8::Value>;
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  TestEmbedderHeapTracer tracer;
+  heap::TemporaryEmbedderHeapTracerScope tracer_scope(CcTest::isolate(),
+                                                      &tracer);
+  tracer.SetStackStart(&manual_gc);
+  StackToHeapTest<ReferenceType>(&tracer, Operation::kMove,
+                                 TargetHandling::kNonInitialized);
+  StackToHeapTest<ReferenceType>(&tracer, Operation::kMove,
+                                 TargetHandling::kInitializedYoungGen);
+  StackToHeapTest<ReferenceType>(&tracer, Operation::kMove,
+                                 TargetHandling::kInitializedOldGen);
+  HeapToStackTest<ReferenceType>(&tracer, Operation::kMove,
+                                 TargetHandling::kNonInitialized);
+  HeapToStackTest<ReferenceType>(&tracer, Operation::kMove,
+                                 TargetHandling::kInitializedYoungGen);
+  HeapToStackTest<ReferenceType>(&tracer, Operation::kMove,
+                                 TargetHandling::kInitializedOldGen);
+  StackToStackTest<ReferenceType>(&tracer, Operation::kMove,
+                                  TargetHandling::kNonInitialized);
+  StackToStackTest<ReferenceType>(&tracer, Operation::kMove,
+                                  TargetHandling::kInitializedYoungGen);
+  StackToStackTest<ReferenceType>(&tracer, Operation::kMove,
+                                  TargetHandling::kInitializedOldGen);
+}
+
+TEST(TracedReferenceCopy) {
+  using ReferenceType = v8::TracedReference<v8::Value>;
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  TestEmbedderHeapTracer tracer;
+  heap::TemporaryEmbedderHeapTracerScope tracer_scope(CcTest::isolate(),
+                                                      &tracer);
+  tracer.SetStackStart(&manual_gc);
+  StackToHeapTest<ReferenceType>(&tracer, Operation::kCopy,
+                                 TargetHandling::kNonInitialized);
+  StackToHeapTest<ReferenceType>(&tracer, Operation::kCopy,
+                                 TargetHandling::kInitializedYoungGen);
+  StackToHeapTest<ReferenceType>(&tracer, Operation::kCopy,
+                                 TargetHandling::kInitializedOldGen);
+  HeapToStackTest<ReferenceType>(&tracer, Operation::kCopy,
+                                 TargetHandling::kNonInitialized);
+  HeapToStackTest<ReferenceType>(&tracer, Operation::kCopy,
+                                 TargetHandling::kInitializedYoungGen);
+  HeapToStackTest<ReferenceType>(&tracer, Operation::kCopy,
+                                 TargetHandling::kInitializedOldGen);
+  StackToStackTest<ReferenceType>(&tracer, Operation::kCopy,
+                                  TargetHandling::kNonInitialized);
+  StackToStackTest<ReferenceType>(&tracer, Operation::kCopy,
+                                  TargetHandling::kInitializedYoungGen);
+  StackToStackTest<ReferenceType>(&tracer, Operation::kCopy,
+                                  TargetHandling::kInitializedOldGen);
+}
+
+TEST(TracedGlobalMove) {
+  using ReferenceType = v8::TracedGlobal<v8::Value>;
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  TestEmbedderHeapTracer tracer;
+  heap::TemporaryEmbedderHeapTracerScope tracer_scope(CcTest::isolate(),
+                                                      &tracer);
+  tracer.SetStackStart(&manual_gc);
+  StackToHeapTest<ReferenceType>(&tracer, Operation::kMove,
+                                 TargetHandling::kNonInitialized);
+  StackToHeapTest<ReferenceType>(&tracer, Operation::kMove,
+                                 TargetHandling::kInitializedYoungGen);
+  StackToHeapTest<ReferenceType>(&tracer, Operation::kMove,
+                                 TargetHandling::kInitializedOldGen);
+  HeapToStackTest<ReferenceType>(&tracer, Operation::kMove,
+                                 TargetHandling::kNonInitialized);
+  HeapToStackTest<ReferenceType>(&tracer, Operation::kMove,
+                                 TargetHandling::kInitializedYoungGen);
+  HeapToStackTest<ReferenceType>(&tracer, Operation::kMove,
+                                 TargetHandling::kInitializedOldGen);
+  StackToStackTest<ReferenceType>(&tracer, Operation::kMove,
+                                  TargetHandling::kNonInitialized);
+  StackToStackTest<ReferenceType>(&tracer, Operation::kMove,
+                                  TargetHandling::kInitializedYoungGen);
+  StackToStackTest<ReferenceType>(&tracer, Operation::kMove,
+                                  TargetHandling::kInitializedOldGen);
+}
+
+TEST(TracedGlobalCopy) {
+  using ReferenceType = v8::TracedGlobal<v8::Value>;
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  TestEmbedderHeapTracer tracer;
+  heap::TemporaryEmbedderHeapTracerScope tracer_scope(CcTest::isolate(),
+                                                      &tracer);
+  tracer.SetStackStart(&manual_gc);
+  StackToHeapTest<ReferenceType>(&tracer, Operation::kCopy,
+                                 TargetHandling::kNonInitialized);
+  StackToHeapTest<ReferenceType>(&tracer, Operation::kCopy,
+                                 TargetHandling::kInitializedYoungGen);
+  StackToHeapTest<ReferenceType>(&tracer, Operation::kCopy,
+                                 TargetHandling::kInitializedOldGen);
+  HeapToStackTest<ReferenceType>(&tracer, Operation::kCopy,
+                                 TargetHandling::kNonInitialized);
+  HeapToStackTest<ReferenceType>(&tracer, Operation::kCopy,
+                                 TargetHandling::kInitializedYoungGen);
+  HeapToStackTest<ReferenceType>(&tracer, Operation::kCopy,
+                                 TargetHandling::kInitializedOldGen);
+  StackToStackTest<ReferenceType>(&tracer, Operation::kCopy,
+                                  TargetHandling::kNonInitialized);
+  StackToStackTest<ReferenceType>(&tracer, Operation::kCopy,
+                                  TargetHandling::kInitializedYoungGen);
+  StackToStackTest<ReferenceType>(&tracer, Operation::kCopy,
+                                  TargetHandling::kInitializedOldGen);
+}
+
+TEST(TracedGlobalDestructor) {
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  TestEmbedderHeapTracer tracer;
+  heap::TemporaryEmbedderHeapTracerScope tracer_scope(CcTest::isolate(),
+                                                      &tracer);
+  tracer.SetStackStart(&manual_gc);
+  TracedGlobalDestructorTest(&tracer);
+}
+
+TEST(NotifyEmptyStack) {
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  TestEmbedderHeapTracer tracer;
+  heap::TemporaryEmbedderHeapTracerScope tracer_scope(CcTest::isolate(),
+                                                      &tracer);
+  tracer.SetStackStart(&manual_gc);
+  TracedReferenceNotifyEmptyStackTest(&tracer);
+}
+
 }  // namespace heap
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/heap/test-heap.cc b/deps/v8/test/cctest/heap/test-heap.cc
index 53454f3e2f409a..5eaa28404e97f0 100644
--- a/deps/v8/test/cctest/heap/test-heap.cc
+++ b/deps/v8/test/cctest/heap/test-heap.cc
@@ -192,7 +192,7 @@ HEAP_TEST(TestNewSpaceRefsInCopiedCode) {
   Handle<HeapNumber> value = factory->NewHeapNumber(1.000123);
   CHECK(Heap::InYoungGeneration(*value));
 
-  i::byte buffer[i::Assembler::kMinimalBufferSize];
+  i::byte buffer[i::Assembler::kDefaultBufferSize];
   MacroAssembler masm(isolate, v8::internal::CodeObjectRequired::kYes,
                       ExternalAssemblerBuffer(buffer, sizeof(buffer)));
   // Add a new-space reference to the code.
@@ -925,7 +925,7 @@ TEST(JSArray) {
 
   // Set array length to 0.
   JSArray::SetLength(array, 0);
-  CHECK_EQ(Smi::kZero, array->length());
+  CHECK_EQ(Smi::zero(), array->length());
   // Must be in fast mode.
   CHECK(array->HasSmiOrObjectElements());
 
@@ -1677,7 +1677,8 @@ TEST(TestAlignedAllocation) {
     CHECK(IsAligned(obj.address(), kDoubleAlignment));
     // There is a filler object before the object.
     filler = HeapObject::FromAddress(start);
-    CHECK(obj != filler && filler.IsFiller() && filler.Size() == kTaggedSize);
+    CHECK(obj != filler && filler.IsFreeSpaceOrFiller() &&
+          filler.Size() == kTaggedSize);
     CHECK_EQ(kTaggedSize + double_misalignment, *top_addr - start);
 
     // Similarly for kDoubleUnaligned.
@@ -1690,7 +1691,8 @@ TEST(TestAlignedAllocation) {
     CHECK(IsAligned(obj.address() + kTaggedSize, kDoubleAlignment));
     // There is a filler object before the object.
     filler = HeapObject::FromAddress(start);
-    CHECK(obj != filler && filler.IsFiller() && filler.Size() == kTaggedSize);
+    CHECK(obj != filler && filler.IsFreeSpaceOrFiller() &&
+          filler.Size() == kTaggedSize);
     CHECK_EQ(kTaggedSize + double_misalignment, *top_addr - start);
   }
 }
@@ -1751,9 +1753,10 @@ TEST(TestAlignedOverAllocation) {
     CHECK(IsAligned(obj.address(), kDoubleAlignment));
     filler = HeapObject::FromAddress(start);
     CHECK(obj != filler);
-    CHECK(filler.IsFiller());
+    CHECK(filler.IsFreeSpaceOrFiller());
     CHECK_EQ(kTaggedSize, filler.Size());
-    CHECK(obj != filler && filler.IsFiller() && filler.Size() == kTaggedSize);
+    CHECK(obj != filler && filler.IsFreeSpaceOrFiller() &&
+          filler.Size() == kTaggedSize);
 
     // Similarly for kDoubleUnaligned.
     start = AlignOldSpace(kDoubleUnaligned, 0);
@@ -1765,7 +1768,8 @@ TEST(TestAlignedOverAllocation) {
     obj = OldSpaceAllocateAligned(kTaggedSize, kDoubleUnaligned);
     CHECK(IsAligned(obj.address() + kTaggedSize, kDoubleAlignment));
     filler = HeapObject::FromAddress(start);
-    CHECK(obj != filler && filler.IsFiller() && filler.Size() == kTaggedSize);
+    CHECK(obj != filler && filler.IsFreeSpaceOrFiller() &&
+          filler.Size() == kTaggedSize);
   }
 }
 
@@ -2267,8 +2271,10 @@ TEST(IdleNotificationFinishMarking) {
   do {
     marking->V8Step(kStepSizeInMs, IncrementalMarking::NO_GC_VIA_STACK_GUARD,
                     StepOrigin::kV8);
-  } while (
-      !CcTest::heap()->mark_compact_collector()->marking_worklist()->IsEmpty());
+  } while (!CcTest::heap()
+                ->mark_compact_collector()
+                ->marking_worklists()
+                ->IsEmpty());
 
   marking->SetWeakClosureWasOverApproximatedForTesting(true);
 
@@ -2561,8 +2567,7 @@ TEST(OptimizedPretenuringDoubleArrayProperties) {
            ReadOnlyRoots(CcTest::heap()).empty_property_array());
 }
 
-
-TEST(OptimizedPretenuringdoubleArrayLiterals) {
+TEST(OptimizedPretenuringDoubleArrayLiterals) {
   FLAG_allow_natives_syntax = true;
   FLAG_expose_gc = true;
   CcTest::InitializeVM();
@@ -2572,7 +2577,7 @@ TEST(OptimizedPretenuringdoubleArrayLiterals) {
     return;
   v8::HandleScope scope(CcTest::isolate());
 
-  // Grow new space unitl maximum capacity reached.
+  // Grow new space until maximum capacity reached.
   while (!CcTest::heap()->new_space()->IsAtMaximumCapacity()) {
     CcTest::heap()->new_space()->Grow();
   }
@@ -2603,7 +2608,6 @@ TEST(OptimizedPretenuringdoubleArrayLiterals) {
   CHECK(CcTest::heap()->InOldSpace(*o));
 }
 
-
 TEST(OptimizedPretenuringNestedMixedArrayLiterals) {
   FLAG_allow_natives_syntax = true;
   FLAG_expose_gc = true;
@@ -3556,9 +3560,9 @@ TEST(Regress169928) {
   array_data->set(0, Smi::FromInt(1));
   array_data->set(1, Smi::FromInt(2));
 
-  heap::AllocateAllButNBytes(
+  heap::FillCurrentPageButNBytes(
       CcTest::heap()->new_space(),
-      JSArray::kSize + AllocationMemento::kSize + kTaggedSize);
+      JSArray::kHeaderSize + AllocationMemento::kSize + kTaggedSize);
 
   Handle<JSArray> array =
       factory->NewJSArrayWithElements(array_data, PACKED_SMI_ELEMENTS);
@@ -4336,7 +4340,7 @@ TEST(NextCodeLinkInCodeDataContainerIsCleared) {
 }
 
 static Handle<Code> DummyOptimizedCode(Isolate* isolate) {
-  i::byte buffer[i::Assembler::kMinimalBufferSize];
+  i::byte buffer[i::Assembler::kDefaultBufferSize];
   MacroAssembler masm(isolate, v8::internal::CodeObjectRequired::kYes,
                       ExternalAssemblerBuffer(buffer, sizeof(buffer)));
   CodeDesc desc;
@@ -5398,19 +5402,32 @@ HEAP_TEST(Regress589413) {
   // Fill the new space with byte arrays with elements looking like pointers.
   const int M = 256;
   ByteArray byte_array;
+  Page* young_page = nullptr;
   while (AllocateByteArrayForTest(heap, M, AllocationType::kYoung)
              .To(&byte_array)) {
+    // Only allocate objects on one young page as a rough estimate on
+    // how much memory can be promoted into the old generation.
+    // Otherwise we would crash when forcing promotion of all young
+    // live objects.
+    if (!young_page) young_page = Page::FromHeapObject(byte_array);
+    if (Page::FromHeapObject(byte_array) != young_page) break;
+
     for (int j = 0; j < M; j++) {
       byte_array.set(j, 0x31);
     }
     // Add the array in root set.
     handle(byte_array, isolate);
   }
-  // Make sure the byte arrays will be promoted on the next GC.
-  CcTest::CollectGarbage(NEW_SPACE);
-  // This number is close to large free list category threshold.
-  const int N = 0x3EEE;
+
   {
+    // Ensure that incremental marking is not started unexpectedly.
+    AlwaysAllocateScope always_allocate(isolate);
+
+    // Make sure the byte arrays will be promoted on the next GC.
+    CcTest::CollectGarbage(NEW_SPACE);
+    // This number is close to large free list category threshold.
+    const int N = 0x3EEE;
+
     std::vector<FixedArray> arrays;
     std::set<Page*> pages;
     FixedArray array;
@@ -5423,7 +5440,7 @@ HEAP_TEST(Regress589413) {
       // Add the array in root set.
       handle(array, isolate);
     }
-    // Expand and full one complete page with fixed arrays.
+    // Expand and fill one complete page with fixed arrays.
     heap->set_force_oom(false);
     while (
         AllocateFixedArrayForTest(heap, N, AllocationType::kOld).To(&array)) {
@@ -5437,7 +5454,6 @@ HEAP_TEST(Regress589413) {
     // Expand and mark the new page as evacuation candidate.
     heap->set_force_oom(false);
     {
-      AlwaysAllocateScope always_allocate(isolate);
       Handle<HeapObject> ec_obj =
           factory->NewFixedArray(5000, AllocationType::kOld);
       Page* ec_page = Page::FromHeapObject(*ec_obj);
@@ -5451,11 +5467,13 @@ HEAP_TEST(Regress589413) {
         }
       }
     }
+    CHECK(heap->incremental_marking()->IsStopped());
     heap::SimulateIncrementalMarking(heap);
     for (size_t j = 0; j < arrays.size(); j++) {
       heap->RightTrimFixedArray(arrays[j], N - 1);
     }
   }
+
   // Force allocation from the free list.
   heap->set_force_oom(true);
   CcTest::CollectGarbage(OLD_SPACE);
@@ -5806,7 +5824,7 @@ TEST(ContinuousLeftTrimFixedArrayInBlackArea) {
   for (int i = 0; i < 10; i++) {
     trimmed = heap->LeftTrimFixedArray(previous, 1);
     HeapObject filler = HeapObject::FromAddress(previous.address());
-    CHECK(filler.IsFiller());
+    CHECK(filler.IsFreeSpaceOrFiller());
     CHECK(marking_state->IsBlack(trimmed));
     CHECK(marking_state->IsBlack(previous));
     previous = trimmed;
@@ -5817,7 +5835,7 @@ TEST(ContinuousLeftTrimFixedArrayInBlackArea) {
     for (int j = 0; j < 10; j++) {
       trimmed = heap->LeftTrimFixedArray(previous, i);
       HeapObject filler = HeapObject::FromAddress(previous.address());
-      CHECK(filler.IsFiller());
+      CHECK(filler.IsFreeSpaceOrFiller());
       CHECK(marking_state->IsBlack(trimmed));
       CHECK(marking_state->IsBlack(previous));
       previous = trimmed;
@@ -5873,7 +5891,7 @@ TEST(ContinuousRightTrimFixedArrayInBlackArea) {
   isolate->heap()->RightTrimFixedArray(*array, 1);
 
   HeapObject filler = HeapObject::FromAddress(previous);
-  CHECK(filler.IsFiller());
+  CHECK(filler.IsFreeSpaceOrFiller());
   CHECK(marking_state->IsImpossible(filler));
 
   // Trim 10 times by one, two, and three word.
@@ -5882,7 +5900,7 @@ TEST(ContinuousRightTrimFixedArrayInBlackArea) {
       previous -= kTaggedSize * i;
       isolate->heap()->RightTrimFixedArray(*array, i);
       HeapObject filler = HeapObject::FromAddress(previous);
-      CHECK(filler.IsFiller());
+      CHECK(filler.IsFreeSpaceOrFiller());
       CHECK(marking_state->IsWhite(filler));
     }
   }
@@ -6338,7 +6356,7 @@ HEAP_TEST(Regress5831) {
   for (int i = 0; i < kMaxIterations; i++) {
     Handle<Code> code = GenerateDummyImmovableCode(isolate);
     array = FixedArray::SetAndGrow(isolate, array, i, code);
-    CHECK(heap->code_space()->Contains(code->address()) ||
+    CHECK(heap->code_space()->Contains(*code) ||
           heap->code_lo_space()->Contains(*code));
     if (heap->code_lo_space()->Contains(*code)) {
       overflowed_into_lospace = true;
@@ -6508,6 +6526,36 @@ UNINITIALIZED_TEST(OutOfMemoryIneffectiveGC) {
   isolate->Dispose();
 }
 
+UNINITIALIZED_TEST(OutOfMemoryIneffectiveGCRunningJS) {
+  if (!FLAG_detect_ineffective_gcs_near_heap_limit) return;
+  if (FLAG_stress_incremental_marking) return;
+
+  FLAG_max_old_space_size = 5;
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  v8::Isolate* isolate = v8::Isolate::New(create_params);
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+  oom_isolate = i_isolate;
+
+  isolate->SetOOMErrorHandler(OOMCallback);
+
+  v8::Isolate::Scope isolate_scope(isolate);
+  v8::HandleScope handle_scope(isolate);
+  v8::Context::New(isolate)->Enter();
+
+  // Test that source positions are not collected as part of a failing GC, which
+  // will fail as allocation is disallowed. If the test works, this should call
+  // OOMCallback and terminate without crashing.
+  CompileRun(R"javascript(
+      var array = [];
+      for(var i = 20000; i < 40000; ++i) {
+        array.push(new Array(i));
+      }
+      )javascript");
+
+  FATAL("Should not get here as OOMCallback should be called");
+}
+
 HEAP_TEST(Regress779503) {
   // The following regression test ensures that the Scavenger does not allocate
   // over invalid slots. More specific, the Scavenger should not sweep a page
@@ -6542,7 +6590,8 @@ HEAP_TEST(Regress779503) {
     // currently scavenging.
     heap->delay_sweeper_tasks_for_testing_ = true;
     CcTest::CollectGarbage(OLD_SPACE);
-    CHECK(Heap::InYoungGeneration(*byte_array));
+    CHECK(FLAG_always_promote_young_mc ? !Heap::InYoungGeneration(*byte_array)
+                                       : Heap::InYoungGeneration(*byte_array));
   }
   // Scavenging and sweeping the same page will crash as slots will be
   // overridden.
diff --git a/deps/v8/test/cctest/heap/test-lab.cc b/deps/v8/test/cctest/heap/test-lab.cc
index 4c1b154b61d398..6f39298a339ecd 100644
--- a/deps/v8/test/cctest/heap/test-lab.cc
+++ b/deps/v8/test/cctest/heap/test-lab.cc
@@ -30,7 +30,7 @@ static void VerifyIterable(v8::internal::Address base,
   size_t counter = 0;
   while (base < limit) {
     object = HeapObject::FromAddress(base);
-    CHECK(object.IsFiller());
+    CHECK(object.IsFreeSpaceOrFiller());
     CHECK_LT(counter, expected_size.size());
     CHECK_EQ(expected_size[counter], object.Size());
     base += object.Size();
diff --git a/deps/v8/test/cctest/heap/test-mark-compact.cc b/deps/v8/test/cctest/heap/test-mark-compact.cc
index b4d8c1b04e9afc..0f55034fded57f 100644
--- a/deps/v8/test/cctest/heap/test-mark-compact.cc
+++ b/deps/v8/test/cctest/heap/test-mark-compact.cc
@@ -72,6 +72,7 @@ TEST(Promotion) {
 }
 
 HEAP_TEST(NoPromotion) {
+  if (FLAG_always_promote_young_mc) return;
   // Page promotion allows pages to be moved to old space even in the case of
   // OOM scenarios.
   FLAG_page_promotion = false;
@@ -370,7 +371,7 @@ TEST(Regress5829) {
   IncrementalMarking::MarkingState* marking_state = marking->marking_state();
   for (auto object_and_size :
        LiveObjectRange<kGreyObjects>(page, marking_state->bitmap(page))) {
-    CHECK(!object_and_size.first.IsFiller());
+    CHECK(!object_and_size.first.IsFreeSpaceOrFiller());
   }
 }
 
diff --git a/deps/v8/test/cctest/heap/test-memory-measurement.cc b/deps/v8/test/cctest/heap/test-memory-measurement.cc
new file mode 100644
index 00000000000000..0b862c51048ee7
--- /dev/null
+++ b/deps/v8/test/cctest/heap/test-memory-measurement.cc
@@ -0,0 +1,135 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/memory-measurement-inl.h"
+#include "src/heap/memory-measurement.h"
+#include "test/cctest/cctest.h"
+#include "test/cctest/heap/heap-tester.h"
+#include "test/cctest/heap/heap-utils.h"
+
+namespace v8 {
+namespace internal {
+namespace heap {
+
+namespace {
+Handle<NativeContext> GetNativeContext(Isolate* isolate,
+                                       v8::Local<v8::Context> v8_context) {
+  Handle<Context> context = v8::Utils::OpenHandle(*v8_context);
+  return handle(context->native_context(), isolate);
+}
+}  // anonymous namespace
+
+TEST(NativeContextInferrerGlobalObject) {
+  LocalContext env;
+  Isolate* isolate = CcTest::i_isolate();
+  HandleScope handle_scope(isolate);
+  Handle<NativeContext> native_context = GetNativeContext(isolate, env.local());
+  Handle<JSGlobalObject> global =
+      handle(native_context->global_object(), isolate);
+  NativeContextInferrer inferrer;
+  Address inferred_context = 0;
+  CHECK(inferrer.Infer(isolate, global->map(), *global, &inferred_context));
+  CHECK_EQ(native_context->ptr(), inferred_context);
+}
+
+TEST(NativeContextInferrerJSFunction) {
+  LocalContext env;
+  Isolate* isolate = CcTest::i_isolate();
+  HandleScope scope(isolate);
+  Handle<NativeContext> native_context = GetNativeContext(isolate, env.local());
+  v8::Local<v8::Value> result = CompileRun("(function () { return 1; })");
+  Handle<Object> object = Utils::OpenHandle(*result);
+  Handle<HeapObject> function = Handle<HeapObject>::cast(object);
+  NativeContextInferrer inferrer;
+  Address inferred_context = 0;
+  CHECK(inferrer.Infer(isolate, function->map(), *function, &inferred_context));
+  CHECK_EQ(native_context->ptr(), inferred_context);
+}
+
+TEST(NativeContextInferrerJSObject) {
+  LocalContext env;
+  Isolate* isolate = CcTest::i_isolate();
+  HandleScope scope(isolate);
+  Handle<NativeContext> native_context = GetNativeContext(isolate, env.local());
+  v8::Local<v8::Value> result = CompileRun("({a : 10})");
+  Handle<Object> object = Utils::OpenHandle(*result);
+  Handle<HeapObject> function = Handle<HeapObject>::cast(object);
+  NativeContextInferrer inferrer;
+  Address inferred_context = 0;
+  // TODO(ulan): Enable this test once we have more precise native
+  // context inference.
+  CHECK(inferrer.Infer(isolate, function->map(), *function, &inferred_context));
+  CHECK_EQ(native_context->ptr(), inferred_context);
+}
+
+TEST(NativeContextStatsMerge) {
+  LocalContext env;
+  Isolate* isolate = CcTest::i_isolate();
+  HandleScope scope(isolate);
+  Handle<NativeContext> native_context = GetNativeContext(isolate, env.local());
+  v8::Local<v8::Value> result = CompileRun("({a : 10})");
+  Handle<HeapObject> object =
+      Handle<HeapObject>::cast(Utils::OpenHandle(*result));
+  NativeContextStats stats1, stats2;
+  stats1.IncrementSize(native_context->ptr(), object->map(), *object, 10);
+  stats2.IncrementSize(native_context->ptr(), object->map(), *object, 20);
+  stats1.Merge(stats2);
+  CHECK_EQ(30, stats1.Get(native_context->ptr()));
+}
+
+TEST(NativeContextStatsArrayBuffers) {
+  LocalContext env;
+  Isolate* isolate = CcTest::i_isolate();
+  HandleScope scope(isolate);
+  Handle<NativeContext> native_context = GetNativeContext(isolate, env.local());
+  v8::Local<v8::ArrayBuffer> array_buffer =
+      v8::ArrayBuffer::New(CcTest::isolate(), 1000);
+  Handle<JSArrayBuffer> i_array_buffer = Utils::OpenHandle(*array_buffer);
+  NativeContextStats stats;
+  stats.IncrementSize(native_context->ptr(), i_array_buffer->map(),
+                      *i_array_buffer, 10);
+  CHECK_EQ(1010, stats.Get(native_context->ptr()));
+}
+
+namespace {
+
+class TestResource : public v8::String::ExternalStringResource {
+ public:
+  explicit TestResource(uint16_t* data) : data_(data), length_(0) {
+    while (data[length_]) ++length_;
+  }
+
+  ~TestResource() override { i::DeleteArray(data_); }
+
+  const uint16_t* data() const override { return data_; }
+
+  size_t length() const override { return length_; }
+
+ private:
+  uint16_t* data_;
+  size_t length_;
+};
+
+}  // anonymous namespace
+
+TEST(NativeContextStatsExternalString) {
+  LocalContext env;
+  Isolate* isolate = CcTest::i_isolate();
+  HandleScope scope(isolate);
+  Handle<NativeContext> native_context = GetNativeContext(isolate, env.local());
+  const char* c_source = "0123456789";
+  uint16_t* two_byte_source = AsciiToTwoByteString(c_source);
+  TestResource* resource = new TestResource(two_byte_source);
+  Local<v8::String> string =
+      v8::String::NewExternalTwoByte(CcTest::isolate(), resource)
+          .ToLocalChecked();
+  Handle<String> i_string = Utils::OpenHandle(*string);
+  NativeContextStats stats;
+  stats.IncrementSize(native_context->ptr(), i_string->map(), *i_string, 10);
+  CHECK_EQ(10 + 10 * 2, stats.Get(native_context->ptr()));
+}
+
+}  // namespace heap
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/heap/test-page-promotion.cc b/deps/v8/test/cctest/heap/test-page-promotion.cc
index c31fc39c2e45b8..2cc42d1f1c7d56 100644
--- a/deps/v8/test/cctest/heap/test-page-promotion.cc
+++ b/deps/v8/test/cctest/heap/test-page-promotion.cc
@@ -101,7 +101,7 @@ UNINITIALIZED_TEST(PagePromotion_NewToOld) {
 }
 
 UNINITIALIZED_TEST(PagePromotion_NewToNew) {
-  if (!i::FLAG_page_promotion) return;
+  if (!i::FLAG_page_promotion || FLAG_always_promote_young_mc) return;
 
   v8::Isolate* isolate = NewIsolateForPagePromotion();
   Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
@@ -129,7 +129,7 @@ UNINITIALIZED_TEST(PagePromotion_NewToNew) {
 }
 
 UNINITIALIZED_TEST(PagePromotion_NewToNewJSArrayBuffer) {
-  if (!i::FLAG_page_promotion) return;
+  if (!i::FLAG_page_promotion || FLAG_always_promote_young_mc) return;
 
   // Test makes sure JSArrayBuffer backing stores are still tracked after
   // new-to-new promotion.
@@ -167,7 +167,8 @@ UNINITIALIZED_TEST(PagePromotion_NewToNewJSArrayBuffer) {
     CHECK(heap->new_space()->ToSpaceContainsSlow(buffer->address()));
     CHECK(to_be_promoted_page->Contains(first_object->address()));
     CHECK(to_be_promoted_page->Contains(buffer->address()));
-    CHECK(ArrayBufferTracker::IsTracked(*buffer));
+    if (!V8_ARRAY_BUFFER_EXTENSION_BOOL)
+      CHECK(ArrayBufferTracker::IsTracked(*buffer));
   }
   isolate->Dispose();
 }
@@ -212,13 +213,14 @@ UNINITIALIZED_TEST(PagePromotion_NewToOldJSArrayBuffer) {
     CHECK(heap->old_space()->ContainsSlow(buffer->address()));
     CHECK(to_be_promoted_page->Contains(first_object->address()));
     CHECK(to_be_promoted_page->Contains(buffer->address()));
-    CHECK(ArrayBufferTracker::IsTracked(*buffer));
+    if (!V8_ARRAY_BUFFER_EXTENSION_BOOL)
+      CHECK(ArrayBufferTracker::IsTracked(*buffer));
   }
   isolate->Dispose();
 }
 
 UNINITIALIZED_HEAP_TEST(Regress658718) {
-  if (!i::FLAG_page_promotion) return;
+  if (!i::FLAG_page_promotion || FLAG_always_promote_young_mc) return;
 
   v8::Isolate* isolate = NewIsolateForPagePromotion(4, 8);
   Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
diff --git a/deps/v8/test/cctest/heap/test-spaces.cc b/deps/v8/test/cctest/heap/test-spaces.cc
index a99f7abbb53e26..56649dd1dd5d9b 100644
--- a/deps/v8/test/cctest/heap/test-spaces.cc
+++ b/deps/v8/test/cctest/heap/test-spaces.cc
@@ -290,13 +290,13 @@ TEST(OldSpace) {
   delete s;
 }
 
-TEST(LargeObjectSpace) {
+TEST(OldLargeObjectSpace) {
   // This test does not initialize allocated objects, which confuses the
   // incremental marker.
   FLAG_incremental_marking = false;
   v8::V8::Initialize();
 
-  LargeObjectSpace* lo = CcTest::heap()->lo_space();
+  OldLargeObjectSpace* lo = CcTest::heap()->lo_space();
   CHECK_NOT_NULL(lo);
 
   int lo_size = Page::kPageSize;
@@ -406,7 +406,7 @@ static HeapObject AllocateUnaligned(PagedSpace* space, int size) {
   return filler;
 }
 
-static HeapObject AllocateUnaligned(LargeObjectSpace* space, int size) {
+static HeapObject AllocateUnaligned(OldLargeObjectSpace* space, int size) {
   AllocationResult allocation = space->AllocateRaw(size);
   CHECK(!allocation.IsRetry());
   HeapObject filler;
@@ -512,8 +512,8 @@ UNINITIALIZED_TEST(AllocationObserver) {
     // classes inheriting from PagedSpace.
     testAllocationObserver<PagedSpace>(i_isolate,
                                        i_isolate->heap()->old_space());
-    testAllocationObserver<LargeObjectSpace>(i_isolate,
-                                             i_isolate->heap()->lo_space());
+    testAllocationObserver<OldLargeObjectSpace>(i_isolate,
+                                                i_isolate->heap()->lo_space());
   }
   isolate->Dispose();
 }
diff --git a/deps/v8/test/cctest/heap/test-unmapper.cc b/deps/v8/test/cctest/heap/test-unmapper.cc
index 89d163b36c5e6b..a28e812a99e3bb 100644
--- a/deps/v8/test/cctest/heap/test-unmapper.cc
+++ b/deps/v8/test/cctest/heap/test-unmapper.cc
@@ -32,10 +32,6 @@ class MockPlatformForUnmapper : public TestPlatform {
     worker_tasks_.clear();
   }
 
-  void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override {
-    task_ = task;
-  }
-
   void CallOnWorkerThread(std::unique_ptr<Task> task) override {
     worker_tasks_.push_back(std::move(task));
   }
diff --git a/deps/v8/test/cctest/heap/test-weak-references.cc b/deps/v8/test/cctest/heap/test-weak-references.cc
index b3ec8cbf5abbde..91ccab6abf40e4 100644
--- a/deps/v8/test/cctest/heap/test-weak-references.cc
+++ b/deps/v8/test/cctest/heap/test-weak-references.cc
@@ -19,8 +19,8 @@ namespace heap {
 Handle<LoadHandler> CreateLoadHandlerForTest(
     Factory* factory, AllocationType allocation = AllocationType::kYoung) {
   Handle<LoadHandler> result = factory->NewLoadHandler(1, allocation);
-  result->set_smi_handler(Smi::kZero);
-  result->set_validity_cell(Smi::kZero);
+  result->set_smi_handler(Smi::zero());
+  result->set_validity_cell(Smi::zero());
   result->set_data1(MaybeObject::FromSmi(Smi::zero()));
   return result;
 }
@@ -37,7 +37,8 @@ TEST(WeakReferencesBasic) {
   MaybeObject code_object = lh->data1();
   CHECK(code_object->IsSmi());
   CcTest::CollectAllGarbage();
-  CHECK(Heap::InYoungGeneration(*lh));
+  CHECK(FLAG_always_promote_young_mc ? !Heap::InYoungGeneration(*lh)
+                                     : Heap::InYoungGeneration(*lh));
   CHECK_EQ(code_object, lh->data1());
 
   {
diff --git a/deps/v8/test/cctest/interpreter/bytecode-expectations-printer.cc b/deps/v8/test/cctest/interpreter/bytecode-expectations-printer.cc
index a271df4f6746c8..6d2e6974722b8b 100644
--- a/deps/v8/test/cctest/interpreter/bytecode-expectations-printer.cc
+++ b/deps/v8/test/cctest/interpreter/bytecode-expectations-printer.cc
@@ -295,7 +295,7 @@ void BytecodeExpectationsPrinter::PrintConstant(
     *stream << i::HeapObject::cast(*constant).map().instance_type();
     if (constant->IsHeapNumber()) {
       *stream << " [";
-      i::HeapNumber::cast(*constant).HeapNumberPrint(*stream);
+      i::HeapNumber::cast(*constant).HeapNumberShortPrint(*stream);
       *stream << "]";
     } else if (constant->IsString()) {
       *stream << " [";
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ArrayLiterals.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ArrayLiterals.golden
index 7b1de53911fb3e..067979d20d49a5 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ArrayLiterals.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ArrayLiterals.golden
@@ -143,7 +143,7 @@ snippet: "
 "
 frame size: 6
 parameter count: 1
-bytecode array length: 68
+bytecode array length: 75
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(CreateArrayLiteral), U8(0), U8(0), U8(37),
@@ -153,6 +153,8 @@ bytecodes: [
                 B(LdaConstant), U8(2),
   /*   67 S> */ B(Star), R(1),
                 B(GetIterator), R(0), U8(2), U8(4),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(4),
                 B(LdaNamedProperty), R(4), U8(3), U8(6),
                 B(Star), R(3),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
index 0e7cac1ad906f0..8691944b205a00 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
@@ -16,12 +16,12 @@ frame size: 8
 parameter count: 1
 bytecode array length: 148
 bytecodes: [
+  /*   17 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(Mov), R(closure), R(1),
                 B(Mov), R(this), R(2),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(1), U8(2),
                 B(Star), R(0),
-  /*   17 E> */ B(StackCheck),
                 B(Mov), R(context), R(3),
                 B(Mov), R(context), R(4),
                 B(Ldar), R(0),
@@ -45,7 +45,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(4),
                 B(PushContext), R(5),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(7),
                 B(Mov), R(0), R(6),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorReject), R(6), U8(2),
@@ -84,7 +84,7 @@ bytecodes: [
   /*   22 S> */ B(Return),
 ]
 constant pool: [
-  Smi [30],
+  Smi [29],
   Smi [16],
   Smi [7],
   SCOPE_INFO_TYPE,
@@ -106,12 +106,12 @@ frame size: 8
 parameter count: 1
 bytecode array length: 193
 bytecodes: [
+  /*   17 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(1),
                 B(Mov), R(this), R(2),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(1), U8(2),
                 B(Star), R(0),
-  /*   17 E> */ B(StackCheck),
                 B(Mov), R(context), R(3),
                 B(Mov), R(context), R(4),
                 B(Ldar), R(0),
@@ -152,7 +152,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(4),
                 B(PushContext), R(5),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(7),
                 B(Mov), R(0), R(6),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorReject), R(6), U8(2),
@@ -191,8 +191,8 @@ bytecodes: [
   /*   31 S> */ B(Return),
 ]
 constant pool: [
-  Smi [30],
-  Smi [75],
+  Smi [29],
+  Smi [74],
   Smi [16],
   Smi [7],
   Smi [16],
@@ -214,14 +214,14 @@ snippet: "
 "
 frame size: 19
 parameter count: 1
-bytecode array length: 357
+bytecode array length: 364
 bytecodes: [
+  /*   17 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(4),
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(0),
-  /*   17 E> */ B(StackCheck),
                 B(Mov), R(context), R(6),
                 B(Mov), R(context), R(7),
                 B(Ldar), R(0),
@@ -239,6 +239,8 @@ bytecodes: [
   /*   36 S> */ B(CreateArrayLiteral), U8(4), U8(0), U8(37),
                 B(Star), R(10),
                 B(GetIterator), R(10), U8(1), U8(3),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(9),
                 B(LdaNamedProperty), R(9), U8(5), U8(5),
                 B(Star), R(8),
@@ -296,7 +298,7 @@ bytecodes: [
                 B(Mov), R(context), R(16),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(17),
                 B(LdaConstant), U8(11),
                 B(Star), R(18),
@@ -332,7 +334,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(7),
                 B(PushContext), R(8),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(10),
                 B(Mov), R(0), R(9),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorReject), R(9), U8(2),
@@ -371,8 +373,8 @@ bytecodes: [
   /*   50 S> */ B(Return),
 ]
 constant pool: [
-  Smi [30],
-  Smi [136],
+  Smi [29],
+  Smi [142],
   Smi [16],
   Smi [7],
   ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
@@ -386,16 +388,16 @@ constant pool: [
   Smi [6],
   Smi [9],
   SCOPE_INFO_TYPE,
-  Smi [262],
+  Smi [269],
   Smi [6],
   Smi [9],
   Smi [23],
 ]
 handlers: [
-  [20, 303, 311],
-  [23, 267, 269],
-  [80, 167, 175],
-  [199, 232, 234],
+  [20, 310, 318],
+  [23, 274, 276],
+  [87, 174, 182],
+  [206, 239, 241],
 ]
 
 ---
@@ -408,12 +410,12 @@ frame size: 17
 parameter count: 1
 bytecode array length: 467
 bytecodes: [
+  /*   44 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(5),
                 B(Mov), R(closure), R(1),
                 B(Mov), R(this), R(2),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(1), U8(2),
                 B(Star), R(0),
-  /*   44 E> */ B(StackCheck),
                 B(Mov), R(context), R(3),
                 B(Mov), R(context), R(4),
                 B(Ldar), R(0),
@@ -553,7 +555,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(4),
                 B(PushContext), R(5),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(7),
                 B(Mov), R(0), R(6),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorReject), R(6), U8(2),
@@ -592,11 +594,11 @@ bytecodes: [
   /*   60 S> */ B(Return),
 ]
 constant pool: [
-  Smi [30],
-  Smi [158],
-  Smi [230],
-  Smi [280],
-  Smi [339],
+  Smi [29],
+  Smi [157],
+  Smi [229],
+  Smi [279],
+  Smi [338],
   Smi [16],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["g"],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncModules.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncModules.golden
index 7cbe661b940dde..6d88ba285a2360 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncModules.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncModules.golden
@@ -16,6 +16,7 @@ frame size: 8
 parameter count: 2
 bytecode array length: 142
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(LdaConstant), U8(2),
                 B(Star), R(3),
@@ -26,7 +27,6 @@ bytecodes: [
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionEnter), R(3), U8(2),
                 B(Star), R(0),
-  /*    0 E> */ B(StackCheck),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(3),
                 B(Star), R(3),
@@ -67,7 +67,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(3),
                 B(PushContext), R(4),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(6),
                 B(LdaTrue),
                 B(Star), R(7),
@@ -76,8 +76,8 @@ bytecodes: [
   /*   10 S> */ B(Return),
 ]
 constant pool: [
-  Smi [36],
-  Smi [80],
+  Smi [35],
+  Smi [79],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
@@ -95,6 +95,7 @@ frame size: 8
 parameter count: 2
 bytecode array length: 152
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(LdaConstant), U8(2),
                 B(Star), R(3),
@@ -105,7 +106,6 @@ bytecodes: [
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionEnter), R(3), U8(2),
                 B(Star), R(0),
-  /*    0 E> */ B(StackCheck),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(3),
                 B(Star), R(3),
@@ -149,7 +149,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(3),
                 B(PushContext), R(4),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(6),
                 B(LdaTrue),
                 B(Star), R(7),
@@ -158,8 +158,8 @@ bytecodes: [
   /*   21 S> */ B(Return),
 ]
 constant pool: [
-  Smi [36],
-  Smi [90],
+  Smi [35],
+  Smi [89],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
@@ -182,6 +182,7 @@ frame size: 9
 parameter count: 2
 bytecode array length: 153
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(LdaConstant), U8(2),
                 B(Star), R(4),
@@ -194,7 +195,6 @@ bytecodes: [
                 B(Star), R(0),
                 B(CreateClosure), U8(3), U8(0), U8(0),
                 B(Star), R(1),
-  /*    0 E> */ B(StackCheck),
                 B(Ldar), R(0),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(4),
@@ -237,7 +237,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(4),
                 B(PushContext), R(5),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(7),
                 B(LdaTrue),
                 B(Star), R(8),
@@ -246,8 +246,8 @@ bytecodes: [
   /*   54 S> */ B(Return),
 ]
 constant pool: [
-  Smi [44],
-  Smi [88],
+  Smi [43],
+  Smi [87],
   SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   Smi [10],
@@ -267,6 +267,7 @@ frame size: 9
 parameter count: 2
 bytecode array length: 164
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(LdaConstant), U8(2),
                 B(Star), R(4),
@@ -281,7 +282,6 @@ bytecodes: [
                 B(Star), R(4),
                 B(CallRuntime), U16(Runtime::kGetModuleNamespace), R(4), U8(1),
                 B(Star), R(1),
-  /*    0 E> */ B(StackCheck),
                 B(Ldar), R(0),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(4),
@@ -326,7 +326,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(4),
                 B(PushContext), R(5),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(7),
                 B(LdaTrue),
                 B(Star), R(8),
@@ -335,8 +335,8 @@ bytecodes: [
   /*   49 S> */ B(Return),
 ]
 constant pool: [
-  Smi [48],
-  Smi [102],
+  Smi [47],
+  Smi [101],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/BasicLoops.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/BasicLoops.golden
index 488f7a7ebd1b55..a5f97d46c4e5fd 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/BasicLoops.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/BasicLoops.golden
@@ -703,19 +703,19 @@ bytecodes: [
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(2),
   /*   73 S> */ B(LdaSmi), I8(1),
-  /*   73 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   73 E> */ B(StaCurrentContextSlot), U8(2),
   /*  102 S> */ B(Mov), R(2), R(1),
-  /*  106 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*  106 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(JumpIfToBooleanFalse), U8(6),
   /*  113 S> */ B(PopContext), R(3),
                 B(Jump), U8(10),
-  /*  126 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*  126 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(Inc), U8(0),
-  /*  127 E> */ B(StaCurrentContextSlot), U8(4),
+  /*  127 E> */ B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(3),
                 B(JumpLoop), U8(41), I8(0),
                 B(LdaUndefined),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/BreakableBlocks.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/BreakableBlocks.golden
index b6184f084f9b82..18814169b9fc75 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/BreakableBlocks.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/BreakableBlocks.golden
@@ -107,11 +107,11 @@ bytecodes: [
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(1),
   /*   53 S> */ B(LdaSmi), I8(10),
-  /*   53 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   53 E> */ B(StaCurrentContextSlot), U8(2),
   /*   85 S> */ B(Mov), R(1), R(0),
                 B(Ldar), R(1),
   /*   88 S> */ B(Jump), U8(2),
@@ -143,31 +143,31 @@ frame size: 4
 parameter count: 1
 bytecode array length: 53
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
-  /*   30 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(2),
   /*   42 S> */ B(LdaSmi), I8(1),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
                 B(CreateBlockContext), U8(1),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(CreateClosure), U8(2), U8(0), U8(2),
                 B(Star), R(1),
   /*   76 S> */ B(LdaSmi), I8(2),
-  /*   76 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   76 E> */ B(StaCurrentContextSlot), U8(2),
   /*  113 S> */ B(Mov), R(1), R(0),
-  /*  118 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*  118 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(JumpIfToBooleanFalse), U8(6),
   /*  125 S> */ B(PopContext), R(3),
                 B(Jump), U8(8),
   /*  142 S> */ B(LdaSmi), I8(3),
-  /*  144 E> */ B(StaCurrentContextSlot), U8(4),
+  /*  144 E> */ B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(3),
   /*  155 S> */ B(LdaSmi), I8(4),
-  /*  157 E> */ B(StaCurrentContextSlot), U8(4),
+  /*  157 E> */ B(StaCurrentContextSlot), U8(2),
                 B(LdaUndefined),
   /*  162 S> */ B(Return),
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CallAndSpread.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CallAndSpread.golden
index b86d4e61b1f7a8..4d3d1eb7d60eb5 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CallAndSpread.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CallAndSpread.golden
@@ -67,7 +67,7 @@ snippet: "
 "
 frame size: 8
 parameter count: 1
-bytecode array length: 94
+bytecode array length: 101
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   34 S> */ B(LdaGlobal), U8(0), U8(0),
@@ -81,9 +81,11 @@ bytecodes: [
   /*   49 S> */ B(CreateArrayLiteral), U8(4), U8(5), U8(37),
                 B(Star), R(7),
                 B(GetIterator), R(7), U8(6), U8(8),
+                B(Mov), R(0), R(2),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(6),
                 B(LdaNamedProperty), R(6), U8(5), U8(10),
-                B(Mov), R(0), R(2),
                 B(Star), R(5),
                 B(CallProperty0), R(5), R(6), U8(19),
                 B(Star), R(7),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CallLookupSlot.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CallLookupSlot.golden
index b06520351b199a..4b48871fd23a7d 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CallLookupSlot.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CallLookupSlot.golden
@@ -13,15 +13,15 @@ frame size: 10
 parameter count: 1
 bytecode array length: 75
 bytecodes: [
-                B(CreateFunctionContext), U8(0), U8(3),
+  /*   30 E> */ B(StackCheck),
+                B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(6),
-                B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
-  /*   30 E> */ B(StackCheck),
+                B(Ldar), R(0),
+                B(StaCurrentContextSlot), U8(4),
   /*   34 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   36 E> */ B(StaLookupSlot), U8(2), U8(0),
   /*   52 S> */ B(LdaLookupGlobalSlot), U8(3), U8(0), U8(1),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassAndSuperClass.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassAndSuperClass.golden
index 1dd2c099eba6ad..702163012338df 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassAndSuperClass.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassAndSuperClass.golden
@@ -24,8 +24,8 @@ frame size: 6
 parameter count: 1
 bytecode array length: 34
 bytecodes: [
-                B(Mov), R(closure), R(0),
   /*   99 E> */ B(StackCheck),
+                B(Mov), R(closure), R(0),
   /*  104 S> */ B(LdaConstant), U8(0),
   /*  111 E> */ B(LdaKeyedProperty), R(closure), U8(1),
                 B(Star), R(4),
@@ -64,8 +64,8 @@ frame size: 5
 parameter count: 1
 bytecode array length: 47
 bytecodes: [
-                B(Mov), R(closure), R(0),
   /*  125 E> */ B(StackCheck),
+                B(Mov), R(closure), R(0),
   /*  130 S> */ B(LdaConstant), U8(0),
   /*  130 E> */ B(LdaKeyedProperty), R(closure), U8(0),
                 B(Star), R(2),
@@ -108,8 +108,8 @@ frame size: 6
 parameter count: 1
 bytecode array length: 40
 bytecodes: [
-                B(Mov), R(closure), R(1),
   /*  113 E> */ B(StackCheck),
+                B(Mov), R(closure), R(1),
   /*  118 S> */ B(Ldar), R(1),
                 B(GetSuperConstructor), R(3),
                 B(LdaSmi), I8(1),
@@ -151,8 +151,8 @@ frame size: 5
 parameter count: 1
 bytecode array length: 36
 bytecodes: [
-                B(Mov), R(closure), R(1),
   /*  112 E> */ B(StackCheck),
+                B(Mov), R(closure), R(1),
   /*  117 S> */ B(Ldar), R(1),
                 B(GetSuperConstructor), R(3),
                 B(Ldar), R(0),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassDeclarations.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassDeclarations.golden
index cd439d5d141ed3..d785701c0d1972 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassDeclarations.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassDeclarations.golden
@@ -96,13 +96,13 @@ frame size: 11
 parameter count: 1
 bytecode array length: 84
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(2),
                 B(PushContext), R(1),
-  /*   30 E> */ B(StackCheck),
   /*   43 S> */ B(LdaConstant), U8(1),
-  /*   43 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   43 E> */ B(StaCurrentContextSlot), U8(2),
   /*   57 S> */ B(LdaConstant), U8(2),
-  /*   57 E> */ B(StaCurrentContextSlot), U8(5),
+  /*   57 E> */ B(StaCurrentContextSlot), U8(3),
                 B(CreateBlockContext), U8(3),
                 B(PushContext), R(2),
                 B(LdaTheHole),
@@ -111,11 +111,11 @@ bytecodes: [
                 B(Star), R(3),
                 B(LdaConstant), U8(4),
                 B(Star), R(4),
-  /*   75 S> */ B(LdaImmutableContextSlot), R(2), U8(4), U8(0),
+  /*   75 S> */ B(LdaImmutableContextSlot), R(2), U8(2), U8(0),
                 B(ToName), R(7),
                 B(CreateClosure), U8(6), U8(1), U8(2),
                 B(Star), R(8),
-  /*  106 S> */ B(LdaImmutableContextSlot), R(2), U8(5), U8(0),
+  /*  106 S> */ B(LdaImmutableContextSlot), R(2), U8(3), U8(0),
                 B(ToName), R(9),
                 B(LdaConstant), U8(7),
                 B(TestEqualStrict), R(9), U8(0),
@@ -155,11 +155,11 @@ frame size: 7
 parameter count: 1
 bytecode array length: 49
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
-  /*   30 E> */ B(StackCheck),
   /*   46 S> */ B(LdaZero),
-  /*   46 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   46 E> */ B(StaCurrentContextSlot), U8(2),
                 B(CreateBlockContext), U8(1),
                 B(PushContext), R(2),
                 B(LdaTheHole),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CompoundExpressions.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CompoundExpressions.golden
index c4b600629c0c27..b8e9ebdb04543c 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CompoundExpressions.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CompoundExpressions.golden
@@ -104,15 +104,15 @@ frame size: 1
 parameter count: 1
 bytecode array length: 23
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
-  /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
   /*   45 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
-  /*   75 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*   75 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(BitwiseOrSmi), I8(24), U8(0),
-  /*   77 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   77 E> */ B(StaCurrentContextSlot), U8(2),
                 B(LdaUndefined),
   /*   84 S> */ B(Return),
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ConstVariable.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ConstVariable.golden
index 86d9b5b2ec0271..0393f7407eeeb9 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ConstVariable.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ConstVariable.golden
@@ -50,9 +50,9 @@ frame size: 2
 parameter count: 1
 bytecode array length: 21
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(LdaTheHole),
                 B(Star), R(0),
-  /*   30 E> */ B(StackCheck),
   /*   44 S> */ B(LdaSmi), I8(20),
                 B(Star), R(1),
                 B(Ldar), R(0),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ConstVariableContextSlot.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ConstVariableContextSlot.golden
index f35ff24b399f5c..3f07cbfd5fd1a0 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ConstVariableContextSlot.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ConstVariableContextSlot.golden
@@ -13,13 +13,13 @@ frame size: 1
 parameter count: 1
 bytecode array length: 15
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
-  /*   30 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(2),
   /*   44 S> */ B(LdaSmi), I8(10),
-  /*   44 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   44 E> */ B(StaCurrentContextSlot), U8(2),
                 B(LdaUndefined),
   /*   74 S> */ B(Return),
 ]
@@ -37,14 +37,14 @@ frame size: 1
 parameter count: 1
 bytecode array length: 16
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
-  /*   30 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(2),
   /*   44 S> */ B(LdaSmi), I8(10),
-  /*   44 E> */ B(StaCurrentContextSlot), U8(4),
-  /*   74 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
+  /*   44 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   74 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
   /*   83 S> */ B(Return),
 ]
 constant pool: [
@@ -61,17 +61,17 @@ frame size: 2
 parameter count: 1
 bytecode array length: 26
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
-  /*   30 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(2),
   /*   44 S> */ B(LdaSmi), I8(20),
                 B(Star), R(1),
-                B(LdaCurrentContextSlot), U8(4),
+                B(LdaCurrentContextSlot), U8(2),
   /*   47 E> */ B(ThrowReferenceErrorIfHole), U8(1),
                 B(CallRuntime), U16(Runtime::kThrowConstAssignError), R(0), U8(0),
-  /*   44 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   44 E> */ B(StaCurrentContextSlot), U8(2),
                 B(LdaUndefined),
   /*   80 S> */ B(Return),
 ]
@@ -90,13 +90,13 @@ frame size: 1
 parameter count: 1
 bytecode array length: 22
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
-  /*   30 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(2),
   /*   44 S> */ B(LdaSmi), I8(10),
-  /*   44 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   44 E> */ B(StaCurrentContextSlot), U8(2),
   /*   48 S> */ B(LdaSmi), I8(20),
   /*   50 E> */ B(CallRuntime), U16(Runtime::kThrowConstAssignError), R(0), U8(0),
                 B(LdaUndefined),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextParameters.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextParameters.golden
index 6e9969db079ffa..c4fa209b337c9d 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextParameters.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextParameters.golden
@@ -15,11 +15,11 @@ frame size: 1
 parameter count: 2
 bytecode array length: 15
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(4),
-  /*   10 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(2),
   /*   19 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   51 S> */ B(Return),
 ]
@@ -39,14 +39,14 @@ frame size: 2
 parameter count: 2
 bytecode array length: 19
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(4),
-  /*   10 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(2),
   /*   27 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
-  /*   53 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*   53 S> */ B(LdaCurrentContextSlot), U8(2),
   /*   65 S> */ B(Return),
 ]
 constant pool: [
@@ -65,13 +65,13 @@ frame size: 1
 parameter count: 5
 bytecode array length: 19
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(2),
                 B(PushContext), R(0),
                 B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
                 B(Ldar), R(arg2),
-                B(StaCurrentContextSlot), U8(4),
-  /*   10 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(2),
   /*   29 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   60 S> */ B(Return),
 ]
@@ -91,11 +91,11 @@ frame size: 1
 parameter count: 1
 bytecode array length: 15
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
-  /*   10 E> */ B(StackCheck),
   /*   26 S> */ B(Ldar), R(this),
-  /*   26 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   26 E> */ B(StaCurrentContextSlot), U8(2),
   /*   32 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   64 S> */ B(Return),
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden
index 2161a38a5079ec..88be31af43c274 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden
@@ -13,9 +13,9 @@ frame size: 1
 parameter count: 1
 bytecode array length: 11
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
-  /*   30 E> */ B(StackCheck),
   /*   41 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   70 S> */ B(Return),
 ]
@@ -34,11 +34,11 @@ frame size: 1
 parameter count: 1
 bytecode array length: 15
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
-  /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
   /*   45 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   74 S> */ B(Return),
 ]
@@ -57,13 +57,13 @@ frame size: 1
 parameter count: 1
 bytecode array length: 19
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(2),
                 B(PushContext), R(0),
-  /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
   /*   53 S> */ B(LdaSmi), I8(2),
-  /*   53 E> */ B(StaCurrentContextSlot), U8(5),
+  /*   53 E> */ B(StaCurrentContextSlot), U8(3),
   /*   56 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   91 S> */ B(Return),
 ]
@@ -82,13 +82,13 @@ frame size: 2
 parameter count: 1
 bytecode array length: 18
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
-  /*   30 E> */ B(StackCheck),
   /*   41 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(1),
   /*   64 E> */ B(CallUndefinedReceiver0), R(1), U8(0),
-  /*   68 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*   68 S> */ B(LdaCurrentContextSlot), U8(2),
   /*   77 S> */ B(Return),
 ]
 constant pool: [
@@ -108,19 +108,19 @@ frame size: 2
 parameter count: 1
 bytecode array length: 29
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
-  /*   30 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(2),
   /*   56 S> */ B(LdaSmi), I8(1),
-  /*   56 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   56 E> */ B(StaCurrentContextSlot), U8(2),
                 B(CreateBlockContext), U8(1),
                 B(PushContext), R(1),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
   /*   69 S> */ B(LdaSmi), I8(2),
-  /*   69 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   69 E> */ B(StaCurrentContextSlot), U8(2),
   /*   72 S> */ B(CreateClosure), U8(2), U8(0), U8(2),
   /*  101 S> */ B(Return),
 ]
@@ -385,530 +385,536 @@ snippet: "
   var a1143 = 0;
   var a1144 = 0;
   var a1145 = 0;
+  var a1146 = 0;
+  var a1147 = 0;
   eval();
   var b = 100;
   return b
 "
 frame size: 3
 parameter count: 1
-bytecode array length: 788
+bytecode array length: 797
 bytecodes: [
-                B(CreateFunctionContext), U8(0), U8(254),
+  /*   30 E> */ B(StackCheck),
+                B(Wide), B(CreateFunctionContext), U16(0), U16(256),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(CreateUnmappedArguments),
                 B(Wide), B(StaCurrentContextSlot), U16(257),
                 B(Ldar), R(0),
-                B(StaCurrentContextSlot), U8(5),
-  /*   30 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(3),
   /*   59 S> */ B(LdaZero),
-  /*   59 E> */ B(StaCurrentContextSlot), U8(6),
+  /*   59 E> */ B(StaCurrentContextSlot), U8(4),
   /*   73 S> */ B(LdaZero),
-  /*   73 E> */ B(StaCurrentContextSlot), U8(7),
+  /*   73 E> */ B(StaCurrentContextSlot), U8(5),
   /*   87 S> */ B(LdaZero),
-  /*   87 E> */ B(StaCurrentContextSlot), U8(8),
+  /*   87 E> */ B(StaCurrentContextSlot), U8(6),
   /*  101 S> */ B(LdaZero),
-  /*  101 E> */ B(StaCurrentContextSlot), U8(9),
+  /*  101 E> */ B(StaCurrentContextSlot), U8(7),
   /*  115 S> */ B(LdaZero),
-  /*  115 E> */ B(StaCurrentContextSlot), U8(10),
+  /*  115 E> */ B(StaCurrentContextSlot), U8(8),
   /*  129 S> */ B(LdaZero),
-  /*  129 E> */ B(StaCurrentContextSlot), U8(11),
+  /*  129 E> */ B(StaCurrentContextSlot), U8(9),
   /*  143 S> */ B(LdaZero),
-  /*  143 E> */ B(StaCurrentContextSlot), U8(12),
+  /*  143 E> */ B(StaCurrentContextSlot), U8(10),
   /*  157 S> */ B(LdaZero),
-  /*  157 E> */ B(StaCurrentContextSlot), U8(13),
+  /*  157 E> */ B(StaCurrentContextSlot), U8(11),
   /*  171 S> */ B(LdaZero),
-  /*  171 E> */ B(StaCurrentContextSlot), U8(14),
+  /*  171 E> */ B(StaCurrentContextSlot), U8(12),
   /*  185 S> */ B(LdaZero),
-  /*  185 E> */ B(StaCurrentContextSlot), U8(15),
+  /*  185 E> */ B(StaCurrentContextSlot), U8(13),
   /*  199 S> */ B(LdaZero),
-  /*  199 E> */ B(StaCurrentContextSlot), U8(16),
+  /*  199 E> */ B(StaCurrentContextSlot), U8(14),
   /*  213 S> */ B(LdaZero),
-  /*  213 E> */ B(StaCurrentContextSlot), U8(17),
+  /*  213 E> */ B(StaCurrentContextSlot), U8(15),
   /*  227 S> */ B(LdaZero),
-  /*  227 E> */ B(StaCurrentContextSlot), U8(18),
+  /*  227 E> */ B(StaCurrentContextSlot), U8(16),
   /*  241 S> */ B(LdaZero),
-  /*  241 E> */ B(StaCurrentContextSlot), U8(19),
+  /*  241 E> */ B(StaCurrentContextSlot), U8(17),
   /*  255 S> */ B(LdaZero),
-  /*  255 E> */ B(StaCurrentContextSlot), U8(20),
+  /*  255 E> */ B(StaCurrentContextSlot), U8(18),
   /*  269 S> */ B(LdaZero),
-  /*  269 E> */ B(StaCurrentContextSlot), U8(21),
+  /*  269 E> */ B(StaCurrentContextSlot), U8(19),
   /*  283 S> */ B(LdaZero),
-  /*  283 E> */ B(StaCurrentContextSlot), U8(22),
+  /*  283 E> */ B(StaCurrentContextSlot), U8(20),
   /*  297 S> */ B(LdaZero),
-  /*  297 E> */ B(StaCurrentContextSlot), U8(23),
+  /*  297 E> */ B(StaCurrentContextSlot), U8(21),
   /*  311 S> */ B(LdaZero),
-  /*  311 E> */ B(StaCurrentContextSlot), U8(24),
+  /*  311 E> */ B(StaCurrentContextSlot), U8(22),
   /*  325 S> */ B(LdaZero),
-  /*  325 E> */ B(StaCurrentContextSlot), U8(25),
+  /*  325 E> */ B(StaCurrentContextSlot), U8(23),
   /*  339 S> */ B(LdaZero),
-  /*  339 E> */ B(StaCurrentContextSlot), U8(26),
+  /*  339 E> */ B(StaCurrentContextSlot), U8(24),
   /*  353 S> */ B(LdaZero),
-  /*  353 E> */ B(StaCurrentContextSlot), U8(27),
+  /*  353 E> */ B(StaCurrentContextSlot), U8(25),
   /*  367 S> */ B(LdaZero),
-  /*  367 E> */ B(StaCurrentContextSlot), U8(28),
+  /*  367 E> */ B(StaCurrentContextSlot), U8(26),
   /*  381 S> */ B(LdaZero),
-  /*  381 E> */ B(StaCurrentContextSlot), U8(29),
+  /*  381 E> */ B(StaCurrentContextSlot), U8(27),
   /*  395 S> */ B(LdaZero),
-  /*  395 E> */ B(StaCurrentContextSlot), U8(30),
+  /*  395 E> */ B(StaCurrentContextSlot), U8(28),
   /*  409 S> */ B(LdaZero),
-  /*  409 E> */ B(StaCurrentContextSlot), U8(31),
+  /*  409 E> */ B(StaCurrentContextSlot), U8(29),
   /*  423 S> */ B(LdaZero),
-  /*  423 E> */ B(StaCurrentContextSlot), U8(32),
+  /*  423 E> */ B(StaCurrentContextSlot), U8(30),
   /*  437 S> */ B(LdaZero),
-  /*  437 E> */ B(StaCurrentContextSlot), U8(33),
+  /*  437 E> */ B(StaCurrentContextSlot), U8(31),
   /*  451 S> */ B(LdaZero),
-  /*  451 E> */ B(StaCurrentContextSlot), U8(34),
+  /*  451 E> */ B(StaCurrentContextSlot), U8(32),
   /*  465 S> */ B(LdaZero),
-  /*  465 E> */ B(StaCurrentContextSlot), U8(35),
+  /*  465 E> */ B(StaCurrentContextSlot), U8(33),
   /*  479 S> */ B(LdaZero),
-  /*  479 E> */ B(StaCurrentContextSlot), U8(36),
+  /*  479 E> */ B(StaCurrentContextSlot), U8(34),
   /*  493 S> */ B(LdaZero),
-  /*  493 E> */ B(StaCurrentContextSlot), U8(37),
+  /*  493 E> */ B(StaCurrentContextSlot), U8(35),
   /*  507 S> */ B(LdaZero),
-  /*  507 E> */ B(StaCurrentContextSlot), U8(38),
+  /*  507 E> */ B(StaCurrentContextSlot), U8(36),
   /*  521 S> */ B(LdaZero),
-  /*  521 E> */ B(StaCurrentContextSlot), U8(39),
+  /*  521 E> */ B(StaCurrentContextSlot), U8(37),
   /*  535 S> */ B(LdaZero),
-  /*  535 E> */ B(StaCurrentContextSlot), U8(40),
+  /*  535 E> */ B(StaCurrentContextSlot), U8(38),
   /*  549 S> */ B(LdaZero),
-  /*  549 E> */ B(StaCurrentContextSlot), U8(41),
+  /*  549 E> */ B(StaCurrentContextSlot), U8(39),
   /*  563 S> */ B(LdaZero),
-  /*  563 E> */ B(StaCurrentContextSlot), U8(42),
+  /*  563 E> */ B(StaCurrentContextSlot), U8(40),
   /*  577 S> */ B(LdaZero),
-  /*  577 E> */ B(StaCurrentContextSlot), U8(43),
+  /*  577 E> */ B(StaCurrentContextSlot), U8(41),
   /*  591 S> */ B(LdaZero),
-  /*  591 E> */ B(StaCurrentContextSlot), U8(44),
+  /*  591 E> */ B(StaCurrentContextSlot), U8(42),
   /*  605 S> */ B(LdaZero),
-  /*  605 E> */ B(StaCurrentContextSlot), U8(45),
+  /*  605 E> */ B(StaCurrentContextSlot), U8(43),
   /*  619 S> */ B(LdaZero),
-  /*  619 E> */ B(StaCurrentContextSlot), U8(46),
+  /*  619 E> */ B(StaCurrentContextSlot), U8(44),
   /*  633 S> */ B(LdaZero),
-  /*  633 E> */ B(StaCurrentContextSlot), U8(47),
+  /*  633 E> */ B(StaCurrentContextSlot), U8(45),
   /*  647 S> */ B(LdaZero),
-  /*  647 E> */ B(StaCurrentContextSlot), U8(48),
+  /*  647 E> */ B(StaCurrentContextSlot), U8(46),
   /*  661 S> */ B(LdaZero),
-  /*  661 E> */ B(StaCurrentContextSlot), U8(49),
+  /*  661 E> */ B(StaCurrentContextSlot), U8(47),
   /*  675 S> */ B(LdaZero),
-  /*  675 E> */ B(StaCurrentContextSlot), U8(50),
+  /*  675 E> */ B(StaCurrentContextSlot), U8(48),
   /*  689 S> */ B(LdaZero),
-  /*  689 E> */ B(StaCurrentContextSlot), U8(51),
+  /*  689 E> */ B(StaCurrentContextSlot), U8(49),
   /*  703 S> */ B(LdaZero),
-  /*  703 E> */ B(StaCurrentContextSlot), U8(52),
+  /*  703 E> */ B(StaCurrentContextSlot), U8(50),
   /*  717 S> */ B(LdaZero),
-  /*  717 E> */ B(StaCurrentContextSlot), U8(53),
+  /*  717 E> */ B(StaCurrentContextSlot), U8(51),
   /*  731 S> */ B(LdaZero),
-  /*  731 E> */ B(StaCurrentContextSlot), U8(54),
+  /*  731 E> */ B(StaCurrentContextSlot), U8(52),
   /*  745 S> */ B(LdaZero),
-  /*  745 E> */ B(StaCurrentContextSlot), U8(55),
+  /*  745 E> */ B(StaCurrentContextSlot), U8(53),
   /*  759 S> */ B(LdaZero),
-  /*  759 E> */ B(StaCurrentContextSlot), U8(56),
+  /*  759 E> */ B(StaCurrentContextSlot), U8(54),
   /*  773 S> */ B(LdaZero),
-  /*  773 E> */ B(StaCurrentContextSlot), U8(57),
+  /*  773 E> */ B(StaCurrentContextSlot), U8(55),
   /*  787 S> */ B(LdaZero),
-  /*  787 E> */ B(StaCurrentContextSlot), U8(58),
+  /*  787 E> */ B(StaCurrentContextSlot), U8(56),
   /*  801 S> */ B(LdaZero),
-  /*  801 E> */ B(StaCurrentContextSlot), U8(59),
+  /*  801 E> */ B(StaCurrentContextSlot), U8(57),
   /*  815 S> */ B(LdaZero),
-  /*  815 E> */ B(StaCurrentContextSlot), U8(60),
+  /*  815 E> */ B(StaCurrentContextSlot), U8(58),
   /*  829 S> */ B(LdaZero),
-  /*  829 E> */ B(StaCurrentContextSlot), U8(61),
+  /*  829 E> */ B(StaCurrentContextSlot), U8(59),
   /*  843 S> */ B(LdaZero),
-  /*  843 E> */ B(StaCurrentContextSlot), U8(62),
+  /*  843 E> */ B(StaCurrentContextSlot), U8(60),
   /*  857 S> */ B(LdaZero),
-  /*  857 E> */ B(StaCurrentContextSlot), U8(63),
+  /*  857 E> */ B(StaCurrentContextSlot), U8(61),
   /*  871 S> */ B(LdaZero),
-  /*  871 E> */ B(StaCurrentContextSlot), U8(64),
+  /*  871 E> */ B(StaCurrentContextSlot), U8(62),
   /*  885 S> */ B(LdaZero),
-  /*  885 E> */ B(StaCurrentContextSlot), U8(65),
+  /*  885 E> */ B(StaCurrentContextSlot), U8(63),
   /*  899 S> */ B(LdaZero),
-  /*  899 E> */ B(StaCurrentContextSlot), U8(66),
+  /*  899 E> */ B(StaCurrentContextSlot), U8(64),
   /*  913 S> */ B(LdaZero),
-  /*  913 E> */ B(StaCurrentContextSlot), U8(67),
+  /*  913 E> */ B(StaCurrentContextSlot), U8(65),
   /*  927 S> */ B(LdaZero),
-  /*  927 E> */ B(StaCurrentContextSlot), U8(68),
+  /*  927 E> */ B(StaCurrentContextSlot), U8(66),
   /*  941 S> */ B(LdaZero),
-  /*  941 E> */ B(StaCurrentContextSlot), U8(69),
+  /*  941 E> */ B(StaCurrentContextSlot), U8(67),
   /*  955 S> */ B(LdaZero),
-  /*  955 E> */ B(StaCurrentContextSlot), U8(70),
+  /*  955 E> */ B(StaCurrentContextSlot), U8(68),
   /*  969 S> */ B(LdaZero),
-  /*  969 E> */ B(StaCurrentContextSlot), U8(71),
+  /*  969 E> */ B(StaCurrentContextSlot), U8(69),
   /*  983 S> */ B(LdaZero),
-  /*  983 E> */ B(StaCurrentContextSlot), U8(72),
+  /*  983 E> */ B(StaCurrentContextSlot), U8(70),
   /*  997 S> */ B(LdaZero),
-  /*  997 E> */ B(StaCurrentContextSlot), U8(73),
+  /*  997 E> */ B(StaCurrentContextSlot), U8(71),
   /* 1011 S> */ B(LdaZero),
-  /* 1011 E> */ B(StaCurrentContextSlot), U8(74),
+  /* 1011 E> */ B(StaCurrentContextSlot), U8(72),
   /* 1025 S> */ B(LdaZero),
-  /* 1025 E> */ B(StaCurrentContextSlot), U8(75),
+  /* 1025 E> */ B(StaCurrentContextSlot), U8(73),
   /* 1039 S> */ B(LdaZero),
-  /* 1039 E> */ B(StaCurrentContextSlot), U8(76),
+  /* 1039 E> */ B(StaCurrentContextSlot), U8(74),
   /* 1053 S> */ B(LdaZero),
-  /* 1053 E> */ B(StaCurrentContextSlot), U8(77),
+  /* 1053 E> */ B(StaCurrentContextSlot), U8(75),
   /* 1067 S> */ B(LdaZero),
-  /* 1067 E> */ B(StaCurrentContextSlot), U8(78),
+  /* 1067 E> */ B(StaCurrentContextSlot), U8(76),
   /* 1081 S> */ B(LdaZero),
-  /* 1081 E> */ B(StaCurrentContextSlot), U8(79),
+  /* 1081 E> */ B(StaCurrentContextSlot), U8(77),
   /* 1095 S> */ B(LdaZero),
-  /* 1095 E> */ B(StaCurrentContextSlot), U8(80),
+  /* 1095 E> */ B(StaCurrentContextSlot), U8(78),
   /* 1109 S> */ B(LdaZero),
-  /* 1109 E> */ B(StaCurrentContextSlot), U8(81),
+  /* 1109 E> */ B(StaCurrentContextSlot), U8(79),
   /* 1123 S> */ B(LdaZero),
-  /* 1123 E> */ B(StaCurrentContextSlot), U8(82),
+  /* 1123 E> */ B(StaCurrentContextSlot), U8(80),
   /* 1137 S> */ B(LdaZero),
-  /* 1137 E> */ B(StaCurrentContextSlot), U8(83),
+  /* 1137 E> */ B(StaCurrentContextSlot), U8(81),
   /* 1151 S> */ B(LdaZero),
-  /* 1151 E> */ B(StaCurrentContextSlot), U8(84),
+  /* 1151 E> */ B(StaCurrentContextSlot), U8(82),
   /* 1165 S> */ B(LdaZero),
-  /* 1165 E> */ B(StaCurrentContextSlot), U8(85),
+  /* 1165 E> */ B(StaCurrentContextSlot), U8(83),
   /* 1179 S> */ B(LdaZero),
-  /* 1179 E> */ B(StaCurrentContextSlot), U8(86),
+  /* 1179 E> */ B(StaCurrentContextSlot), U8(84),
   /* 1193 S> */ B(LdaZero),
-  /* 1193 E> */ B(StaCurrentContextSlot), U8(87),
+  /* 1193 E> */ B(StaCurrentContextSlot), U8(85),
   /* 1207 S> */ B(LdaZero),
-  /* 1207 E> */ B(StaCurrentContextSlot), U8(88),
+  /* 1207 E> */ B(StaCurrentContextSlot), U8(86),
   /* 1221 S> */ B(LdaZero),
-  /* 1221 E> */ B(StaCurrentContextSlot), U8(89),
+  /* 1221 E> */ B(StaCurrentContextSlot), U8(87),
   /* 1235 S> */ B(LdaZero),
-  /* 1235 E> */ B(StaCurrentContextSlot), U8(90),
+  /* 1235 E> */ B(StaCurrentContextSlot), U8(88),
   /* 1249 S> */ B(LdaZero),
-  /* 1249 E> */ B(StaCurrentContextSlot), U8(91),
+  /* 1249 E> */ B(StaCurrentContextSlot), U8(89),
   /* 1263 S> */ B(LdaZero),
-  /* 1263 E> */ B(StaCurrentContextSlot), U8(92),
+  /* 1263 E> */ B(StaCurrentContextSlot), U8(90),
   /* 1277 S> */ B(LdaZero),
-  /* 1277 E> */ B(StaCurrentContextSlot), U8(93),
+  /* 1277 E> */ B(StaCurrentContextSlot), U8(91),
   /* 1291 S> */ B(LdaZero),
-  /* 1291 E> */ B(StaCurrentContextSlot), U8(94),
+  /* 1291 E> */ B(StaCurrentContextSlot), U8(92),
   /* 1305 S> */ B(LdaZero),
-  /* 1305 E> */ B(StaCurrentContextSlot), U8(95),
+  /* 1305 E> */ B(StaCurrentContextSlot), U8(93),
   /* 1319 S> */ B(LdaZero),
-  /* 1319 E> */ B(StaCurrentContextSlot), U8(96),
+  /* 1319 E> */ B(StaCurrentContextSlot), U8(94),
   /* 1333 S> */ B(LdaZero),
-  /* 1333 E> */ B(StaCurrentContextSlot), U8(97),
+  /* 1333 E> */ B(StaCurrentContextSlot), U8(95),
   /* 1347 S> */ B(LdaZero),
-  /* 1347 E> */ B(StaCurrentContextSlot), U8(98),
+  /* 1347 E> */ B(StaCurrentContextSlot), U8(96),
   /* 1361 S> */ B(LdaZero),
-  /* 1361 E> */ B(StaCurrentContextSlot), U8(99),
+  /* 1361 E> */ B(StaCurrentContextSlot), U8(97),
   /* 1375 S> */ B(LdaZero),
-  /* 1375 E> */ B(StaCurrentContextSlot), U8(100),
+  /* 1375 E> */ B(StaCurrentContextSlot), U8(98),
   /* 1389 S> */ B(LdaZero),
-  /* 1389 E> */ B(StaCurrentContextSlot), U8(101),
+  /* 1389 E> */ B(StaCurrentContextSlot), U8(99),
   /* 1403 S> */ B(LdaZero),
-  /* 1403 E> */ B(StaCurrentContextSlot), U8(102),
+  /* 1403 E> */ B(StaCurrentContextSlot), U8(100),
   /* 1417 S> */ B(LdaZero),
-  /* 1417 E> */ B(StaCurrentContextSlot), U8(103),
+  /* 1417 E> */ B(StaCurrentContextSlot), U8(101),
   /* 1431 S> */ B(LdaZero),
-  /* 1431 E> */ B(StaCurrentContextSlot), U8(104),
+  /* 1431 E> */ B(StaCurrentContextSlot), U8(102),
   /* 1445 S> */ B(LdaZero),
-  /* 1445 E> */ B(StaCurrentContextSlot), U8(105),
+  /* 1445 E> */ B(StaCurrentContextSlot), U8(103),
   /* 1459 S> */ B(LdaZero),
-  /* 1459 E> */ B(StaCurrentContextSlot), U8(106),
+  /* 1459 E> */ B(StaCurrentContextSlot), U8(104),
   /* 1473 S> */ B(LdaZero),
-  /* 1473 E> */ B(StaCurrentContextSlot), U8(107),
+  /* 1473 E> */ B(StaCurrentContextSlot), U8(105),
   /* 1487 S> */ B(LdaZero),
-  /* 1487 E> */ B(StaCurrentContextSlot), U8(108),
+  /* 1487 E> */ B(StaCurrentContextSlot), U8(106),
   /* 1501 S> */ B(LdaZero),
-  /* 1501 E> */ B(StaCurrentContextSlot), U8(109),
+  /* 1501 E> */ B(StaCurrentContextSlot), U8(107),
   /* 1516 S> */ B(LdaZero),
-  /* 1516 E> */ B(StaCurrentContextSlot), U8(110),
+  /* 1516 E> */ B(StaCurrentContextSlot), U8(108),
   /* 1531 S> */ B(LdaZero),
-  /* 1531 E> */ B(StaCurrentContextSlot), U8(111),
+  /* 1531 E> */ B(StaCurrentContextSlot), U8(109),
   /* 1546 S> */ B(LdaZero),
-  /* 1546 E> */ B(StaCurrentContextSlot), U8(112),
+  /* 1546 E> */ B(StaCurrentContextSlot), U8(110),
   /* 1561 S> */ B(LdaZero),
-  /* 1561 E> */ B(StaCurrentContextSlot), U8(113),
+  /* 1561 E> */ B(StaCurrentContextSlot), U8(111),
   /* 1576 S> */ B(LdaZero),
-  /* 1576 E> */ B(StaCurrentContextSlot), U8(114),
+  /* 1576 E> */ B(StaCurrentContextSlot), U8(112),
   /* 1591 S> */ B(LdaZero),
-  /* 1591 E> */ B(StaCurrentContextSlot), U8(115),
+  /* 1591 E> */ B(StaCurrentContextSlot), U8(113),
   /* 1606 S> */ B(LdaZero),
-  /* 1606 E> */ B(StaCurrentContextSlot), U8(116),
+  /* 1606 E> */ B(StaCurrentContextSlot), U8(114),
   /* 1621 S> */ B(LdaZero),
-  /* 1621 E> */ B(StaCurrentContextSlot), U8(117),
+  /* 1621 E> */ B(StaCurrentContextSlot), U8(115),
   /* 1636 S> */ B(LdaZero),
-  /* 1636 E> */ B(StaCurrentContextSlot), U8(118),
+  /* 1636 E> */ B(StaCurrentContextSlot), U8(116),
   /* 1651 S> */ B(LdaZero),
-  /* 1651 E> */ B(StaCurrentContextSlot), U8(119),
+  /* 1651 E> */ B(StaCurrentContextSlot), U8(117),
   /* 1666 S> */ B(LdaZero),
-  /* 1666 E> */ B(StaCurrentContextSlot), U8(120),
+  /* 1666 E> */ B(StaCurrentContextSlot), U8(118),
   /* 1681 S> */ B(LdaZero),
-  /* 1681 E> */ B(StaCurrentContextSlot), U8(121),
+  /* 1681 E> */ B(StaCurrentContextSlot), U8(119),
   /* 1696 S> */ B(LdaZero),
-  /* 1696 E> */ B(StaCurrentContextSlot), U8(122),
+  /* 1696 E> */ B(StaCurrentContextSlot), U8(120),
   /* 1711 S> */ B(LdaZero),
-  /* 1711 E> */ B(StaCurrentContextSlot), U8(123),
+  /* 1711 E> */ B(StaCurrentContextSlot), U8(121),
   /* 1726 S> */ B(LdaZero),
-  /* 1726 E> */ B(StaCurrentContextSlot), U8(124),
+  /* 1726 E> */ B(StaCurrentContextSlot), U8(122),
   /* 1741 S> */ B(LdaZero),
-  /* 1741 E> */ B(StaCurrentContextSlot), U8(125),
+  /* 1741 E> */ B(StaCurrentContextSlot), U8(123),
   /* 1756 S> */ B(LdaZero),
-  /* 1756 E> */ B(StaCurrentContextSlot), U8(126),
+  /* 1756 E> */ B(StaCurrentContextSlot), U8(124),
   /* 1771 S> */ B(LdaZero),
-  /* 1771 E> */ B(StaCurrentContextSlot), U8(127),
+  /* 1771 E> */ B(StaCurrentContextSlot), U8(125),
   /* 1786 S> */ B(LdaZero),
-  /* 1786 E> */ B(StaCurrentContextSlot), U8(128),
+  /* 1786 E> */ B(StaCurrentContextSlot), U8(126),
   /* 1801 S> */ B(LdaZero),
-  /* 1801 E> */ B(StaCurrentContextSlot), U8(129),
+  /* 1801 E> */ B(StaCurrentContextSlot), U8(127),
   /* 1816 S> */ B(LdaZero),
-  /* 1816 E> */ B(StaCurrentContextSlot), U8(130),
+  /* 1816 E> */ B(StaCurrentContextSlot), U8(128),
   /* 1831 S> */ B(LdaZero),
-  /* 1831 E> */ B(StaCurrentContextSlot), U8(131),
+  /* 1831 E> */ B(StaCurrentContextSlot), U8(129),
   /* 1846 S> */ B(LdaZero),
-  /* 1846 E> */ B(StaCurrentContextSlot), U8(132),
+  /* 1846 E> */ B(StaCurrentContextSlot), U8(130),
   /* 1861 S> */ B(LdaZero),
-  /* 1861 E> */ B(StaCurrentContextSlot), U8(133),
+  /* 1861 E> */ B(StaCurrentContextSlot), U8(131),
   /* 1876 S> */ B(LdaZero),
-  /* 1876 E> */ B(StaCurrentContextSlot), U8(134),
+  /* 1876 E> */ B(StaCurrentContextSlot), U8(132),
   /* 1891 S> */ B(LdaZero),
-  /* 1891 E> */ B(StaCurrentContextSlot), U8(135),
+  /* 1891 E> */ B(StaCurrentContextSlot), U8(133),
   /* 1906 S> */ B(LdaZero),
-  /* 1906 E> */ B(StaCurrentContextSlot), U8(136),
+  /* 1906 E> */ B(StaCurrentContextSlot), U8(134),
   /* 1921 S> */ B(LdaZero),
-  /* 1921 E> */ B(StaCurrentContextSlot), U8(137),
+  /* 1921 E> */ B(StaCurrentContextSlot), U8(135),
   /* 1936 S> */ B(LdaZero),
-  /* 1936 E> */ B(StaCurrentContextSlot), U8(138),
+  /* 1936 E> */ B(StaCurrentContextSlot), U8(136),
   /* 1951 S> */ B(LdaZero),
-  /* 1951 E> */ B(StaCurrentContextSlot), U8(139),
+  /* 1951 E> */ B(StaCurrentContextSlot), U8(137),
   /* 1966 S> */ B(LdaZero),
-  /* 1966 E> */ B(StaCurrentContextSlot), U8(140),
+  /* 1966 E> */ B(StaCurrentContextSlot), U8(138),
   /* 1981 S> */ B(LdaZero),
-  /* 1981 E> */ B(StaCurrentContextSlot), U8(141),
+  /* 1981 E> */ B(StaCurrentContextSlot), U8(139),
   /* 1996 S> */ B(LdaZero),
-  /* 1996 E> */ B(StaCurrentContextSlot), U8(142),
+  /* 1996 E> */ B(StaCurrentContextSlot), U8(140),
   /* 2011 S> */ B(LdaZero),
-  /* 2011 E> */ B(StaCurrentContextSlot), U8(143),
+  /* 2011 E> */ B(StaCurrentContextSlot), U8(141),
   /* 2026 S> */ B(LdaZero),
-  /* 2026 E> */ B(StaCurrentContextSlot), U8(144),
+  /* 2026 E> */ B(StaCurrentContextSlot), U8(142),
   /* 2041 S> */ B(LdaZero),
-  /* 2041 E> */ B(StaCurrentContextSlot), U8(145),
+  /* 2041 E> */ B(StaCurrentContextSlot), U8(143),
   /* 2056 S> */ B(LdaZero),
-  /* 2056 E> */ B(StaCurrentContextSlot), U8(146),
+  /* 2056 E> */ B(StaCurrentContextSlot), U8(144),
   /* 2071 S> */ B(LdaZero),
-  /* 2071 E> */ B(StaCurrentContextSlot), U8(147),
+  /* 2071 E> */ B(StaCurrentContextSlot), U8(145),
   /* 2086 S> */ B(LdaZero),
-  /* 2086 E> */ B(StaCurrentContextSlot), U8(148),
+  /* 2086 E> */ B(StaCurrentContextSlot), U8(146),
   /* 2101 S> */ B(LdaZero),
-  /* 2101 E> */ B(StaCurrentContextSlot), U8(149),
+  /* 2101 E> */ B(StaCurrentContextSlot), U8(147),
   /* 2116 S> */ B(LdaZero),
-  /* 2116 E> */ B(StaCurrentContextSlot), U8(150),
+  /* 2116 E> */ B(StaCurrentContextSlot), U8(148),
   /* 2131 S> */ B(LdaZero),
-  /* 2131 E> */ B(StaCurrentContextSlot), U8(151),
+  /* 2131 E> */ B(StaCurrentContextSlot), U8(149),
   /* 2146 S> */ B(LdaZero),
-  /* 2146 E> */ B(StaCurrentContextSlot), U8(152),
+  /* 2146 E> */ B(StaCurrentContextSlot), U8(150),
   /* 2161 S> */ B(LdaZero),
-  /* 2161 E> */ B(StaCurrentContextSlot), U8(153),
+  /* 2161 E> */ B(StaCurrentContextSlot), U8(151),
   /* 2176 S> */ B(LdaZero),
-  /* 2176 E> */ B(StaCurrentContextSlot), U8(154),
+  /* 2176 E> */ B(StaCurrentContextSlot), U8(152),
   /* 2191 S> */ B(LdaZero),
-  /* 2191 E> */ B(StaCurrentContextSlot), U8(155),
+  /* 2191 E> */ B(StaCurrentContextSlot), U8(153),
   /* 2206 S> */ B(LdaZero),
-  /* 2206 E> */ B(StaCurrentContextSlot), U8(156),
+  /* 2206 E> */ B(StaCurrentContextSlot), U8(154),
   /* 2221 S> */ B(LdaZero),
-  /* 2221 E> */ B(StaCurrentContextSlot), U8(157),
+  /* 2221 E> */ B(StaCurrentContextSlot), U8(155),
   /* 2236 S> */ B(LdaZero),
-  /* 2236 E> */ B(StaCurrentContextSlot), U8(158),
+  /* 2236 E> */ B(StaCurrentContextSlot), U8(156),
   /* 2251 S> */ B(LdaZero),
-  /* 2251 E> */ B(StaCurrentContextSlot), U8(159),
+  /* 2251 E> */ B(StaCurrentContextSlot), U8(157),
   /* 2266 S> */ B(LdaZero),
-  /* 2266 E> */ B(StaCurrentContextSlot), U8(160),
+  /* 2266 E> */ B(StaCurrentContextSlot), U8(158),
   /* 2281 S> */ B(LdaZero),
-  /* 2281 E> */ B(StaCurrentContextSlot), U8(161),
+  /* 2281 E> */ B(StaCurrentContextSlot), U8(159),
   /* 2296 S> */ B(LdaZero),
-  /* 2296 E> */ B(StaCurrentContextSlot), U8(162),
+  /* 2296 E> */ B(StaCurrentContextSlot), U8(160),
   /* 2311 S> */ B(LdaZero),
-  /* 2311 E> */ B(StaCurrentContextSlot), U8(163),
+  /* 2311 E> */ B(StaCurrentContextSlot), U8(161),
   /* 2326 S> */ B(LdaZero),
-  /* 2326 E> */ B(StaCurrentContextSlot), U8(164),
+  /* 2326 E> */ B(StaCurrentContextSlot), U8(162),
   /* 2341 S> */ B(LdaZero),
-  /* 2341 E> */ B(StaCurrentContextSlot), U8(165),
+  /* 2341 E> */ B(StaCurrentContextSlot), U8(163),
   /* 2356 S> */ B(LdaZero),
-  /* 2356 E> */ B(StaCurrentContextSlot), U8(166),
+  /* 2356 E> */ B(StaCurrentContextSlot), U8(164),
   /* 2371 S> */ B(LdaZero),
-  /* 2371 E> */ B(StaCurrentContextSlot), U8(167),
+  /* 2371 E> */ B(StaCurrentContextSlot), U8(165),
   /* 2386 S> */ B(LdaZero),
-  /* 2386 E> */ B(StaCurrentContextSlot), U8(168),
+  /* 2386 E> */ B(StaCurrentContextSlot), U8(166),
   /* 2401 S> */ B(LdaZero),
-  /* 2401 E> */ B(StaCurrentContextSlot), U8(169),
+  /* 2401 E> */ B(StaCurrentContextSlot), U8(167),
   /* 2416 S> */ B(LdaZero),
-  /* 2416 E> */ B(StaCurrentContextSlot), U8(170),
+  /* 2416 E> */ B(StaCurrentContextSlot), U8(168),
   /* 2431 S> */ B(LdaZero),
-  /* 2431 E> */ B(StaCurrentContextSlot), U8(171),
+  /* 2431 E> */ B(StaCurrentContextSlot), U8(169),
   /* 2446 S> */ B(LdaZero),
-  /* 2446 E> */ B(StaCurrentContextSlot), U8(172),
+  /* 2446 E> */ B(StaCurrentContextSlot), U8(170),
   /* 2461 S> */ B(LdaZero),
-  /* 2461 E> */ B(StaCurrentContextSlot), U8(173),
+  /* 2461 E> */ B(StaCurrentContextSlot), U8(171),
   /* 2476 S> */ B(LdaZero),
-  /* 2476 E> */ B(StaCurrentContextSlot), U8(174),
+  /* 2476 E> */ B(StaCurrentContextSlot), U8(172),
   /* 2491 S> */ B(LdaZero),
-  /* 2491 E> */ B(StaCurrentContextSlot), U8(175),
+  /* 2491 E> */ B(StaCurrentContextSlot), U8(173),
   /* 2506 S> */ B(LdaZero),
-  /* 2506 E> */ B(StaCurrentContextSlot), U8(176),
+  /* 2506 E> */ B(StaCurrentContextSlot), U8(174),
   /* 2521 S> */ B(LdaZero),
-  /* 2521 E> */ B(StaCurrentContextSlot), U8(177),
+  /* 2521 E> */ B(StaCurrentContextSlot), U8(175),
   /* 2536 S> */ B(LdaZero),
-  /* 2536 E> */ B(StaCurrentContextSlot), U8(178),
+  /* 2536 E> */ B(StaCurrentContextSlot), U8(176),
   /* 2551 S> */ B(LdaZero),
-  /* 2551 E> */ B(StaCurrentContextSlot), U8(179),
+  /* 2551 E> */ B(StaCurrentContextSlot), U8(177),
   /* 2566 S> */ B(LdaZero),
-  /* 2566 E> */ B(StaCurrentContextSlot), U8(180),
+  /* 2566 E> */ B(StaCurrentContextSlot), U8(178),
   /* 2581 S> */ B(LdaZero),
-  /* 2581 E> */ B(StaCurrentContextSlot), U8(181),
+  /* 2581 E> */ B(StaCurrentContextSlot), U8(179),
   /* 2596 S> */ B(LdaZero),
-  /* 2596 E> */ B(StaCurrentContextSlot), U8(182),
+  /* 2596 E> */ B(StaCurrentContextSlot), U8(180),
   /* 2611 S> */ B(LdaZero),
-  /* 2611 E> */ B(StaCurrentContextSlot), U8(183),
+  /* 2611 E> */ B(StaCurrentContextSlot), U8(181),
   /* 2626 S> */ B(LdaZero),
-  /* 2626 E> */ B(StaCurrentContextSlot), U8(184),
+  /* 2626 E> */ B(StaCurrentContextSlot), U8(182),
   /* 2641 S> */ B(LdaZero),
-  /* 2641 E> */ B(StaCurrentContextSlot), U8(185),
+  /* 2641 E> */ B(StaCurrentContextSlot), U8(183),
   /* 2656 S> */ B(LdaZero),
-  /* 2656 E> */ B(StaCurrentContextSlot), U8(186),
+  /* 2656 E> */ B(StaCurrentContextSlot), U8(184),
   /* 2671 S> */ B(LdaZero),
-  /* 2671 E> */ B(StaCurrentContextSlot), U8(187),
+  /* 2671 E> */ B(StaCurrentContextSlot), U8(185),
   /* 2686 S> */ B(LdaZero),
-  /* 2686 E> */ B(StaCurrentContextSlot), U8(188),
+  /* 2686 E> */ B(StaCurrentContextSlot), U8(186),
   /* 2701 S> */ B(LdaZero),
-  /* 2701 E> */ B(StaCurrentContextSlot), U8(189),
+  /* 2701 E> */ B(StaCurrentContextSlot), U8(187),
   /* 2716 S> */ B(LdaZero),
-  /* 2716 E> */ B(StaCurrentContextSlot), U8(190),
+  /* 2716 E> */ B(StaCurrentContextSlot), U8(188),
   /* 2731 S> */ B(LdaZero),
-  /* 2731 E> */ B(StaCurrentContextSlot), U8(191),
+  /* 2731 E> */ B(StaCurrentContextSlot), U8(189),
   /* 2746 S> */ B(LdaZero),
-  /* 2746 E> */ B(StaCurrentContextSlot), U8(192),
+  /* 2746 E> */ B(StaCurrentContextSlot), U8(190),
   /* 2761 S> */ B(LdaZero),
-  /* 2761 E> */ B(StaCurrentContextSlot), U8(193),
+  /* 2761 E> */ B(StaCurrentContextSlot), U8(191),
   /* 2776 S> */ B(LdaZero),
-  /* 2776 E> */ B(StaCurrentContextSlot), U8(194),
+  /* 2776 E> */ B(StaCurrentContextSlot), U8(192),
   /* 2791 S> */ B(LdaZero),
-  /* 2791 E> */ B(StaCurrentContextSlot), U8(195),
+  /* 2791 E> */ B(StaCurrentContextSlot), U8(193),
   /* 2806 S> */ B(LdaZero),
-  /* 2806 E> */ B(StaCurrentContextSlot), U8(196),
+  /* 2806 E> */ B(StaCurrentContextSlot), U8(194),
   /* 2821 S> */ B(LdaZero),
-  /* 2821 E> */ B(StaCurrentContextSlot), U8(197),
+  /* 2821 E> */ B(StaCurrentContextSlot), U8(195),
   /* 2836 S> */ B(LdaZero),
-  /* 2836 E> */ B(StaCurrentContextSlot), U8(198),
+  /* 2836 E> */ B(StaCurrentContextSlot), U8(196),
   /* 2851 S> */ B(LdaZero),
-  /* 2851 E> */ B(StaCurrentContextSlot), U8(199),
+  /* 2851 E> */ B(StaCurrentContextSlot), U8(197),
   /* 2866 S> */ B(LdaZero),
-  /* 2866 E> */ B(StaCurrentContextSlot), U8(200),
+  /* 2866 E> */ B(StaCurrentContextSlot), U8(198),
   /* 2881 S> */ B(LdaZero),
-  /* 2881 E> */ B(StaCurrentContextSlot), U8(201),
+  /* 2881 E> */ B(StaCurrentContextSlot), U8(199),
   /* 2896 S> */ B(LdaZero),
-  /* 2896 E> */ B(StaCurrentContextSlot), U8(202),
+  /* 2896 E> */ B(StaCurrentContextSlot), U8(200),
   /* 2911 S> */ B(LdaZero),
-  /* 2911 E> */ B(StaCurrentContextSlot), U8(203),
+  /* 2911 E> */ B(StaCurrentContextSlot), U8(201),
   /* 2926 S> */ B(LdaZero),
-  /* 2926 E> */ B(StaCurrentContextSlot), U8(204),
+  /* 2926 E> */ B(StaCurrentContextSlot), U8(202),
   /* 2941 S> */ B(LdaZero),
-  /* 2941 E> */ B(StaCurrentContextSlot), U8(205),
+  /* 2941 E> */ B(StaCurrentContextSlot), U8(203),
   /* 2956 S> */ B(LdaZero),
-  /* 2956 E> */ B(StaCurrentContextSlot), U8(206),
+  /* 2956 E> */ B(StaCurrentContextSlot), U8(204),
   /* 2971 S> */ B(LdaZero),
-  /* 2971 E> */ B(StaCurrentContextSlot), U8(207),
+  /* 2971 E> */ B(StaCurrentContextSlot), U8(205),
   /* 2986 S> */ B(LdaZero),
-  /* 2986 E> */ B(StaCurrentContextSlot), U8(208),
+  /* 2986 E> */ B(StaCurrentContextSlot), U8(206),
   /* 3001 S> */ B(LdaZero),
-  /* 3001 E> */ B(StaCurrentContextSlot), U8(209),
+  /* 3001 E> */ B(StaCurrentContextSlot), U8(207),
   /* 3016 S> */ B(LdaZero),
-  /* 3016 E> */ B(StaCurrentContextSlot), U8(210),
+  /* 3016 E> */ B(StaCurrentContextSlot), U8(208),
   /* 3031 S> */ B(LdaZero),
-  /* 3031 E> */ B(StaCurrentContextSlot), U8(211),
+  /* 3031 E> */ B(StaCurrentContextSlot), U8(209),
   /* 3046 S> */ B(LdaZero),
-  /* 3046 E> */ B(StaCurrentContextSlot), U8(212),
+  /* 3046 E> */ B(StaCurrentContextSlot), U8(210),
   /* 3061 S> */ B(LdaZero),
-  /* 3061 E> */ B(StaCurrentContextSlot), U8(213),
+  /* 3061 E> */ B(StaCurrentContextSlot), U8(211),
   /* 3076 S> */ B(LdaZero),
-  /* 3076 E> */ B(StaCurrentContextSlot), U8(214),
+  /* 3076 E> */ B(StaCurrentContextSlot), U8(212),
   /* 3091 S> */ B(LdaZero),
-  /* 3091 E> */ B(StaCurrentContextSlot), U8(215),
+  /* 3091 E> */ B(StaCurrentContextSlot), U8(213),
   /* 3106 S> */ B(LdaZero),
-  /* 3106 E> */ B(StaCurrentContextSlot), U8(216),
+  /* 3106 E> */ B(StaCurrentContextSlot), U8(214),
   /* 3121 S> */ B(LdaZero),
-  /* 3121 E> */ B(StaCurrentContextSlot), U8(217),
+  /* 3121 E> */ B(StaCurrentContextSlot), U8(215),
   /* 3136 S> */ B(LdaZero),
-  /* 3136 E> */ B(StaCurrentContextSlot), U8(218),
+  /* 3136 E> */ B(StaCurrentContextSlot), U8(216),
   /* 3151 S> */ B(LdaZero),
-  /* 3151 E> */ B(StaCurrentContextSlot), U8(219),
+  /* 3151 E> */ B(StaCurrentContextSlot), U8(217),
   /* 3166 S> */ B(LdaZero),
-  /* 3166 E> */ B(StaCurrentContextSlot), U8(220),
+  /* 3166 E> */ B(StaCurrentContextSlot), U8(218),
   /* 3181 S> */ B(LdaZero),
-  /* 3181 E> */ B(StaCurrentContextSlot), U8(221),
+  /* 3181 E> */ B(StaCurrentContextSlot), U8(219),
   /* 3196 S> */ B(LdaZero),
-  /* 3196 E> */ B(StaCurrentContextSlot), U8(222),
+  /* 3196 E> */ B(StaCurrentContextSlot), U8(220),
   /* 3211 S> */ B(LdaZero),
-  /* 3211 E> */ B(StaCurrentContextSlot), U8(223),
+  /* 3211 E> */ B(StaCurrentContextSlot), U8(221),
   /* 3226 S> */ B(LdaZero),
-  /* 3226 E> */ B(StaCurrentContextSlot), U8(224),
+  /* 3226 E> */ B(StaCurrentContextSlot), U8(222),
   /* 3241 S> */ B(LdaZero),
-  /* 3241 E> */ B(StaCurrentContextSlot), U8(225),
+  /* 3241 E> */ B(StaCurrentContextSlot), U8(223),
   /* 3256 S> */ B(LdaZero),
-  /* 3256 E> */ B(StaCurrentContextSlot), U8(226),
+  /* 3256 E> */ B(StaCurrentContextSlot), U8(224),
   /* 3271 S> */ B(LdaZero),
-  /* 3271 E> */ B(StaCurrentContextSlot), U8(227),
+  /* 3271 E> */ B(StaCurrentContextSlot), U8(225),
   /* 3286 S> */ B(LdaZero),
-  /* 3286 E> */ B(StaCurrentContextSlot), U8(228),
+  /* 3286 E> */ B(StaCurrentContextSlot), U8(226),
   /* 3301 S> */ B(LdaZero),
-  /* 3301 E> */ B(StaCurrentContextSlot), U8(229),
+  /* 3301 E> */ B(StaCurrentContextSlot), U8(227),
   /* 3316 S> */ B(LdaZero),
-  /* 3316 E> */ B(StaCurrentContextSlot), U8(230),
+  /* 3316 E> */ B(StaCurrentContextSlot), U8(228),
   /* 3331 S> */ B(LdaZero),
-  /* 3331 E> */ B(StaCurrentContextSlot), U8(231),
+  /* 3331 E> */ B(StaCurrentContextSlot), U8(229),
   /* 3346 S> */ B(LdaZero),
-  /* 3346 E> */ B(StaCurrentContextSlot), U8(232),
+  /* 3346 E> */ B(StaCurrentContextSlot), U8(230),
   /* 3361 S> */ B(LdaZero),
-  /* 3361 E> */ B(StaCurrentContextSlot), U8(233),
+  /* 3361 E> */ B(StaCurrentContextSlot), U8(231),
   /* 3376 S> */ B(LdaZero),
-  /* 3376 E> */ B(StaCurrentContextSlot), U8(234),
+  /* 3376 E> */ B(StaCurrentContextSlot), U8(232),
   /* 3391 S> */ B(LdaZero),
-  /* 3391 E> */ B(StaCurrentContextSlot), U8(235),
+  /* 3391 E> */ B(StaCurrentContextSlot), U8(233),
   /* 3406 S> */ B(LdaZero),
-  /* 3406 E> */ B(StaCurrentContextSlot), U8(236),
+  /* 3406 E> */ B(StaCurrentContextSlot), U8(234),
   /* 3421 S> */ B(LdaZero),
-  /* 3421 E> */ B(StaCurrentContextSlot), U8(237),
+  /* 3421 E> */ B(StaCurrentContextSlot), U8(235),
   /* 3436 S> */ B(LdaZero),
-  /* 3436 E> */ B(StaCurrentContextSlot), U8(238),
+  /* 3436 E> */ B(StaCurrentContextSlot), U8(236),
   /* 3451 S> */ B(LdaZero),
-  /* 3451 E> */ B(StaCurrentContextSlot), U8(239),
+  /* 3451 E> */ B(StaCurrentContextSlot), U8(237),
   /* 3466 S> */ B(LdaZero),
-  /* 3466 E> */ B(StaCurrentContextSlot), U8(240),
+  /* 3466 E> */ B(StaCurrentContextSlot), U8(238),
   /* 3481 S> */ B(LdaZero),
-  /* 3481 E> */ B(StaCurrentContextSlot), U8(241),
+  /* 3481 E> */ B(StaCurrentContextSlot), U8(239),
   /* 3496 S> */ B(LdaZero),
-  /* 3496 E> */ B(StaCurrentContextSlot), U8(242),
+  /* 3496 E> */ B(StaCurrentContextSlot), U8(240),
   /* 3511 S> */ B(LdaZero),
-  /* 3511 E> */ B(StaCurrentContextSlot), U8(243),
+  /* 3511 E> */ B(StaCurrentContextSlot), U8(241),
   /* 3526 S> */ B(LdaZero),
-  /* 3526 E> */ B(StaCurrentContextSlot), U8(244),
+  /* 3526 E> */ B(StaCurrentContextSlot), U8(242),
   /* 3541 S> */ B(LdaZero),
-  /* 3541 E> */ B(StaCurrentContextSlot), U8(245),
+  /* 3541 E> */ B(StaCurrentContextSlot), U8(243),
   /* 3556 S> */ B(LdaZero),
-  /* 3556 E> */ B(StaCurrentContextSlot), U8(246),
+  /* 3556 E> */ B(StaCurrentContextSlot), U8(244),
   /* 3571 S> */ B(LdaZero),
-  /* 3571 E> */ B(StaCurrentContextSlot), U8(247),
+  /* 3571 E> */ B(StaCurrentContextSlot), U8(245),
   /* 3586 S> */ B(LdaZero),
-  /* 3586 E> */ B(StaCurrentContextSlot), U8(248),
+  /* 3586 E> */ B(StaCurrentContextSlot), U8(246),
   /* 3601 S> */ B(LdaZero),
-  /* 3601 E> */ B(StaCurrentContextSlot), U8(249),
+  /* 3601 E> */ B(StaCurrentContextSlot), U8(247),
   /* 3616 S> */ B(LdaZero),
-  /* 3616 E> */ B(StaCurrentContextSlot), U8(250),
+  /* 3616 E> */ B(StaCurrentContextSlot), U8(248),
   /* 3631 S> */ B(LdaZero),
-  /* 3631 E> */ B(StaCurrentContextSlot), U8(251),
+  /* 3631 E> */ B(StaCurrentContextSlot), U8(249),
   /* 3646 S> */ B(LdaZero),
-  /* 3646 E> */ B(StaCurrentContextSlot), U8(252),
+  /* 3646 E> */ B(StaCurrentContextSlot), U8(250),
   /* 3661 S> */ B(LdaZero),
-  /* 3661 E> */ B(StaCurrentContextSlot), U8(253),
+  /* 3661 E> */ B(StaCurrentContextSlot), U8(251),
   /* 3676 S> */ B(LdaZero),
-  /* 3676 E> */ B(StaCurrentContextSlot), U8(254),
+  /* 3676 E> */ B(StaCurrentContextSlot), U8(252),
   /* 3691 S> */ B(LdaZero),
-  /* 3691 E> */ B(StaCurrentContextSlot), U8(255),
-  /* 3694 S> */ B(LdaGlobal), U8(1), U8(0),
+  /* 3691 E> */ B(StaCurrentContextSlot), U8(253),
+  /* 3706 S> */ B(LdaZero),
+  /* 3706 E> */ B(StaCurrentContextSlot), U8(254),
+  /* 3721 S> */ B(LdaZero),
+  /* 3721 E> */ B(StaCurrentContextSlot), U8(255),
+  /* 3724 S> */ B(LdaGlobal), U8(1), U8(0),
                 B(Star), R(2),
-  /* 3694 E> */ B(CallUndefinedReceiver0), R(2), U8(2),
-  /* 3710 S> */ B(LdaSmi), I8(100),
-  /* 3710 E> */ B(Wide), B(StaCurrentContextSlot), U16(256),
-  /* 3715 S> */ B(Wide), B(LdaCurrentContextSlot), U16(256),
-  /* 3723 S> */ B(Return),
+  /* 3724 E> */ B(CallUndefinedReceiver0), R(2), U8(2),
+  /* 3740 S> */ B(LdaSmi), I8(100),
+  /* 3740 E> */ B(Wide), B(StaCurrentContextSlot), U16(256),
+  /* 3745 S> */ B(Wide), B(LdaCurrentContextSlot), U16(256),
+  /* 3753 S> */ B(Return),
 ]
 constant pool: [
   SCOPE_INFO_TYPE,
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CountOperators.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CountOperators.golden
index 8fdd8d4a183c22..7a397e95af7f84 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CountOperators.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CountOperators.golden
@@ -209,16 +209,16 @@ frame size: 2
 parameter count: 1
 bytecode array length: 23
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
-  /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
   /*   53 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
-  /*   78 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*   78 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(Inc), U8(0),
-  /*   87 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   87 E> */ B(StaCurrentContextSlot), U8(2),
   /*   89 S> */ B(Return),
 ]
 constant pool: [
@@ -236,18 +236,18 @@ frame size: 3
 parameter count: 1
 bytecode array length: 29
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
-  /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
   /*   53 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
-  /*   78 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*   78 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(ToNumeric), U8(0),
                 B(Star), R(2),
                 B(Dec), U8(0),
-  /*   86 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   86 E> */ B(StaCurrentContextSlot), U8(2),
                 B(Ldar), R(2),
   /*   89 S> */ B(Return),
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CreateArguments.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CreateArguments.golden
index 8440089ec954ca..cc4909beffa0b5 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CreateArguments.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CreateArguments.golden
@@ -15,9 +15,9 @@ frame size: 1
 parameter count: 1
 bytecode array length: 5
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   10 E> */ B(StackCheck),
   /*   32 S> */ B(Return),
 ]
 constant pool: [
@@ -34,9 +34,9 @@ frame size: 1
 parameter count: 1
 bytecode array length: 9
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   10 E> */ B(StackCheck),
   /*   15 S> */ B(LdaZero),
   /*   31 E> */ B(LdaKeyedProperty), R(0), U8(0),
   /*   35 S> */ B(Return),
@@ -55,9 +55,9 @@ frame size: 1
 parameter count: 1
 bytecode array length: 5
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateUnmappedArguments),
                 B(Star), R(0),
-  /*   10 E> */ B(StackCheck),
   /*   46 S> */ B(Return),
 ]
 constant pool: [
@@ -74,13 +74,13 @@ frame size: 2
 parameter count: 2
 bytecode array length: 18
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   10 E> */ B(StackCheck),
   /*   16 S> */ B(LdaZero),
   /*   32 E> */ B(LdaKeyedProperty), R(0), U8(0),
   /*   36 S> */ B(Return),
@@ -100,17 +100,17 @@ frame size: 2
 parameter count: 4
 bytecode array length: 22
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(3),
                 B(PushContext), R(1),
                 B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(6),
+                B(StaCurrentContextSlot), U8(4),
                 B(Ldar), R(arg1),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
                 B(Ldar), R(arg2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   10 E> */ B(StackCheck),
   /*   39 S> */ B(Return),
 ]
 constant pool: [
@@ -128,9 +128,9 @@ frame size: 1
 parameter count: 4
 bytecode array length: 5
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateUnmappedArguments),
                 B(Star), R(0),
-  /*   10 E> */ B(StackCheck),
   /*   53 S> */ B(Return),
 ]
 constant pool: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CreateRestParameter.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CreateRestParameter.golden
index 37daec48ad5c19..14ce4e20a4a0d7 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CreateRestParameter.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CreateRestParameter.golden
@@ -15,9 +15,9 @@ frame size: 2
 parameter count: 1
 bytecode array length: 7
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateRestParameter),
                 B(Star), R(1),
-  /*   10 E> */ B(StackCheck),
                 B(Star), R(0),
   /*   42 S> */ B(Return),
 ]
@@ -35,9 +35,9 @@ frame size: 3
 parameter count: 2
 bytecode array length: 13
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateRestParameter),
                 B(Star), R(2),
-  /*   10 E> */ B(StackCheck),
                 B(Mov), R(arg0), R(0),
                 B(Mov), R(2), R(1),
   /*   29 S> */ B(Ldar), R(1),
@@ -57,9 +57,9 @@ frame size: 3
 parameter count: 2
 bytecode array length: 15
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateRestParameter),
                 B(Star), R(2),
-  /*   10 E> */ B(StackCheck),
                 B(Mov), R(arg0), R(0),
                 B(Mov), R(2), R(1),
   /*   29 S> */ B(LdaZero),
@@ -80,11 +80,11 @@ frame size: 5
 parameter count: 2
 bytecode array length: 27
 bytecodes: [
+  /*   10 E> */ B(StackCheck),
                 B(CreateUnmappedArguments),
                 B(Star), R(3),
                 B(CreateRestParameter),
                 B(Star), R(2),
-  /*   10 E> */ B(StackCheck),
                 B(Mov), R(arg0), R(0),
                 B(Mov), R(2), R(1),
   /*   29 S> */ B(LdaZero),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/DeclareGlobals.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/DeclareGlobals.golden
index ed7249dbe28551..fb36d01f984eb4 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/DeclareGlobals.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/DeclareGlobals.golden
@@ -10,19 +10,17 @@ top level: yes
 snippet: "
   var a = 1;
 "
-frame size: 4
+frame size: 3
 parameter count: 1
-bytecode array length: 23
+bytecode array length: 20
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
-                B(LdaZero),
-                B(Star), R(2),
-                B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(1), U8(3),
-  /*    0 E> */ B(StackCheck),
+                B(Mov), R(closure), R(2),
+                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(1), U8(2),
   /*    8 S> */ B(LdaSmi), I8(1),
-  /*    8 E> */ B(StaGlobal), U8(1), U8(2),
+  /*    8 E> */ B(StaGlobal), U8(1), U8(0),
                 B(LdaUndefined),
   /*   11 S> */ B(Return),
 ]
@@ -37,17 +35,15 @@ handlers: [
 snippet: "
   function f() {}
 "
-frame size: 3
+frame size: 2
 parameter count: 1
-bytecode array length: 18
+bytecode array length: 15
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(LdaConstant), U8(0),
                 B(Star), R(0),
-                B(LdaZero),
-                B(Star), R(1),
-                B(Mov), R(closure), R(2),
-                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(0), U8(3),
-  /*    0 E> */ B(StackCheck),
+                B(Mov), R(closure), R(1),
+                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(0), U8(2),
                 B(LdaUndefined),
   /*   16 S> */ B(Return),
 ]
@@ -62,21 +58,19 @@ snippet: "
   var a = 1;
   a=2;
 "
-frame size: 4
+frame size: 3
 parameter count: 1
-bytecode array length: 29
+bytecode array length: 26
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
-                B(LdaZero),
-                B(Star), R(2),
-                B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(1), U8(3),
-  /*    0 E> */ B(StackCheck),
+                B(Mov), R(closure), R(2),
+                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(1), U8(2),
   /*    8 S> */ B(LdaSmi), I8(1),
-  /*    8 E> */ B(StaGlobal), U8(1), U8(2),
+  /*    8 E> */ B(StaGlobal), U8(1), U8(0),
   /*   11 S> */ B(LdaSmi), I8(2),
-  /*   12 E> */ B(StaGlobal), U8(1), U8(2),
+  /*   12 E> */ B(StaGlobal), U8(1), U8(0),
                 B(Star), R(0),
   /*   16 S> */ B(Return),
 ]
@@ -92,17 +86,15 @@ snippet: "
   function f() {}
   f();
 "
-frame size: 4
+frame size: 3
 parameter count: 1
-bytecode array length: 27
+bytecode array length: 24
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
-                B(LdaZero),
-                B(Star), R(2),
-                B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(1), U8(3),
-  /*    0 E> */ B(StackCheck),
+                B(Mov), R(closure), R(2),
+                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(1), U8(2),
   /*   16 S> */ B(LdaGlobal), U8(1), U8(0),
                 B(Star), R(1),
   /*   16 E> */ B(CallUndefinedReceiver0), R(1), U8(2),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/Delete.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/Delete.golden
index 4af18ededdd134..2d1ad15fe2cca0 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/Delete.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/Delete.golden
@@ -100,13 +100,13 @@ frame size: 2
 parameter count: 1
 bytecode array length: 25
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
-  /*   30 E> */ B(StackCheck),
   /*   56 S> */ B(CreateObjectLiteral), U8(1), U8(0), U8(41),
-  /*   56 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   56 E> */ B(StaCurrentContextSlot), U8(2),
   /*   64 S> */ B(CreateClosure), U8(2), U8(0), U8(2),
-  /*   93 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
+  /*   93 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(1),
                 B(LdaSmi), I8(1),
                 B(DeletePropertyStrict), R(1),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/DestructuringAssignment.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/DestructuringAssignment.golden
index b4c9a75ef1cbe5..8f23cff964f7d7 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/DestructuringAssignment.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/DestructuringAssignment.golden
@@ -12,17 +12,19 @@ snippet: "
 "
 frame size: 14
 parameter count: 1
-bytecode array length: 160
+bytecode array length: 167
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   45 S> */ B(CreateArrayLiteral), U8(0), U8(0), U8(37),
                 B(Star), R(1),
   /*   60 S> */ B(GetIterator), R(1), U8(1), U8(3),
+                B(Mov), R(1), R(2),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(4),
                 B(LdaNamedProperty), R(4), U8(1), U8(5),
                 B(Star), R(3),
                 B(LdaFalse),
-                B(Mov), R(1), R(2),
                 B(Star), R(5),
                 B(Mov), R(context), R(8),
   /*   57 S> */ B(Ldar), R(5),
@@ -61,7 +63,7 @@ bytecodes: [
                 B(Mov), R(context), R(11),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(12),
                 B(LdaConstant), U8(5),
                 B(Star), R(13),
@@ -97,8 +99,8 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [28, 70, 78],
-  [102, 135, 137],
+  [35, 77, 85],
+  [109, 142, 144],
 ]
 
 ---
@@ -108,17 +110,19 @@ snippet: "
 "
 frame size: 15
 parameter count: 1
-bytecode array length: 246
+bytecode array length: 253
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   48 S> */ B(CreateArrayLiteral), U8(0), U8(0), U8(37),
                 B(Star), R(2),
   /*   69 S> */ B(GetIterator), R(2), U8(1), U8(3),
+                B(Mov), R(2), R(3),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(5),
                 B(LdaNamedProperty), R(5), U8(1), U8(5),
                 B(Star), R(4),
                 B(LdaFalse),
-                B(Mov), R(2), R(3),
                 B(Star), R(6),
                 B(Mov), R(context), R(9),
                 B(Ldar), R(6),
@@ -191,7 +195,7 @@ bytecodes: [
                 B(Mov), R(context), R(12),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(13),
                 B(LdaConstant), U8(5),
                 B(Star), R(14),
@@ -227,8 +231,8 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [28, 156, 164],
-  [188, 221, 223],
+  [35, 163, 171],
+  [195, 228, 230],
 ]
 
 ---
@@ -238,7 +242,7 @@ snippet: "
 "
 frame size: 16
 parameter count: 1
-bytecode array length: 211
+bytecode array length: 218
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   40 S> */ B(CreateEmptyObjectLiteral),
@@ -246,11 +250,13 @@ bytecodes: [
   /*   51 S> */ B(CreateArrayLiteral), U8(0), U8(0), U8(37),
                 B(Star), R(2),
   /*   68 S> */ B(GetIterator), R(2), U8(1), U8(3),
+                B(Mov), R(2), R(3),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(5),
                 B(LdaNamedProperty), R(5), U8(1), U8(5),
                 B(Star), R(4),
                 B(LdaFalse),
-                B(Mov), R(2), R(3),
                 B(Star), R(6),
                 B(Mov), R(context), R(9),
   /*   59 S> */ B(Ldar), R(6),
@@ -308,7 +314,7 @@ bytecodes: [
                 B(Mov), R(context), R(13),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(14),
                 B(LdaConstant), U8(6),
                 B(Star), R(15),
@@ -345,8 +351,8 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [31, 121, 129],
-  [153, 186, 188],
+  [38, 128, 136],
+  [160, 193, 195],
 ]
 
 ---
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/Eval.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/Eval.golden
index 6bd20762ab490f..a8609261a7625a 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/Eval.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/Eval.golden
@@ -13,15 +13,15 @@ frame size: 10
 parameter count: 1
 bytecode array length: 59
 bytecodes: [
-                B(CreateFunctionContext), U8(0), U8(3),
+  /*   30 E> */ B(StackCheck),
+                B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(6),
-                B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
-  /*   30 E> */ B(StackCheck),
+                B(Ldar), R(0),
+                B(StaCurrentContextSlot), U8(4),
   /*   34 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star), R(2),
                 B(LdaConstant), U8(2),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
index 43b6c0ed229b3a..df9074524b593c 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
@@ -18,12 +18,12 @@ frame size: 19
 parameter count: 1
 bytecode array length: 321
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(4),
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionEnter), R(4), U8(2),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
                 B(Mov), R(context), R(4),
   /*   43 S> */ B(CreateArrayLiteral), U8(2), U8(0), U8(37),
                 B(Star), R(7),
@@ -93,7 +93,7 @@ bytecodes: [
                 B(Mov), R(context), R(15),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(16),
                 B(LdaConstant), U8(9),
                 B(Star), R(17),
@@ -145,7 +145,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(4),
                 B(PushContext), R(5),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(7),
                 B(LdaTrue),
                 B(Star), R(8),
@@ -154,8 +154,8 @@ bytecodes: [
   /*   57 S> */ B(Return),
 ]
 constant pool: [
-  Smi [96],
-  Smi [225],
+  Smi [95],
+  Smi [224],
   ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   SYMBOL_TYPE,
@@ -183,12 +183,12 @@ frame size: 19
 parameter count: 1
 bytecode array length: 342
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(4),
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionEnter), R(4), U8(2),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
                 B(Mov), R(context), R(4),
   /*   43 S> */ B(CreateArrayLiteral), U8(2), U8(0), U8(37),
                 B(Star), R(7),
@@ -260,7 +260,7 @@ bytecodes: [
                 B(Mov), R(context), R(15),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(16),
                 B(LdaConstant), U8(9),
                 B(Star), R(17),
@@ -318,7 +318,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(4),
                 B(PushContext), R(5),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(7),
                 B(LdaTrue),
                 B(Star), R(8),
@@ -327,8 +327,8 @@ bytecodes: [
   /*   68 S> */ B(Return),
 ]
 constant pool: [
-  Smi [96],
-  Smi [229],
+  Smi [95],
+  Smi [228],
   ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   SYMBOL_TYPE,
@@ -361,12 +361,12 @@ frame size: 19
 parameter count: 1
 bytecode array length: 337
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(4),
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionEnter), R(4), U8(2),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
                 B(Mov), R(context), R(4),
   /*   43 S> */ B(CreateArrayLiteral), U8(2), U8(0), U8(37),
                 B(Star), R(7),
@@ -443,7 +443,7 @@ bytecodes: [
                 B(Mov), R(context), R(15),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(16),
                 B(LdaConstant), U8(9),
                 B(Star), R(17),
@@ -495,7 +495,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(4),
                 B(PushContext), R(5),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(7),
                 B(LdaTrue),
                 B(Star), R(8),
@@ -504,8 +504,8 @@ bytecodes: [
   /*  114 S> */ B(Return),
 ]
 constant pool: [
-  Smi [96],
-  Smi [241],
+  Smi [95],
+  Smi [240],
   ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   SYMBOL_TYPE,
@@ -532,19 +532,21 @@ snippet: "
 "
 frame size: 15
 parameter count: 1
-bytecode array length: 246
+bytecode array length: 253
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(Mov), R(closure), R(2),
                 B(Mov), R(this), R(3),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionEnter), R(2), U8(2),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
                 B(Mov), R(context), R(2),
   /*   31 S> */ B(CreateObjectLiteral), U8(0), U8(0), U8(41),
                 B(Star), R(1),
   /*   68 S> */ B(CreateArrayLiteral), U8(1), U8(1), U8(37),
                 B(Star), R(5),
                 B(GetIterator), R(5), U8(2), U8(4),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(4),
                 B(LdaNamedProperty), R(4), U8(2), U8(6),
                 B(Star), R(3),
@@ -590,7 +592,7 @@ bytecodes: [
                 B(Mov), R(context), R(12),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(13),
                 B(LdaConstant), U8(7),
                 B(Star), R(14),
@@ -634,7 +636,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(2),
                 B(PushContext), R(3),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(5),
                 B(LdaFalse),
                 B(Star), R(6),
@@ -656,8 +658,8 @@ constant pool: [
   SCOPE_INFO_TYPE,
 ]
 handlers: [
-  [16, 218, 218],
-  [46, 99, 107],
-  [131, 164, 166],
+  [16, 225, 225],
+  [53, 106, 114],
+  [138, 171, 173],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
index 6c599df00cc6e8..7be4c0bdea543f 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
@@ -11,12 +11,14 @@ snippet: "
 "
 frame size: 13
 parameter count: 1
-bytecode array length: 158
+bytecode array length: 165
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   48 S> */ B(CreateArrayLiteral), U8(0), U8(0), U8(37),
                 B(Star), R(4),
                 B(GetIterator), R(4), U8(1), U8(3),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(3),
                 B(LdaNamedProperty), R(3), U8(1), U8(5),
                 B(Star), R(2),
@@ -58,7 +60,7 @@ bytecodes: [
                 B(Mov), R(context), R(10),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(11),
                 B(LdaConstant), U8(5),
                 B(Star), R(12),
@@ -94,8 +96,8 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [25, 68, 76],
-  [100, 133, 135],
+  [32, 75, 83],
+  [107, 140, 142],
 ]
 
 ---
@@ -105,12 +107,14 @@ snippet: "
 "
 frame size: 14
 parameter count: 1
-bytecode array length: 166
+bytecode array length: 173
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaConstant), U8(0),
                 B(Star), R(0),
   /*   68 S> */ B(GetIterator), R(0), U8(0), U8(2),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(4),
                 B(LdaNamedProperty), R(4), U8(1), U8(4),
                 B(Star), R(3),
@@ -154,7 +158,7 @@ bytecodes: [
                 B(Mov), R(context), R(11),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(12),
                 B(LdaConstant), U8(5),
                 B(Star), R(13),
@@ -194,8 +198,8 @@ constant pool: [
   Smi [9],
 ]
 handlers: [
-  [23, 70, 78],
-  [102, 135, 137],
+  [30, 77, 85],
+  [109, 142, 144],
 ]
 
 ---
@@ -207,12 +211,14 @@ snippet: "
 "
 frame size: 13
 parameter count: 1
-bytecode array length: 174
+bytecode array length: 181
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   48 S> */ B(CreateArrayLiteral), U8(0), U8(0), U8(37),
                 B(Star), R(4),
                 B(GetIterator), R(4), U8(1), U8(3),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(3),
                 B(LdaNamedProperty), R(3), U8(1), U8(5),
                 B(Star), R(2),
@@ -261,7 +267,7 @@ bytecodes: [
                 B(Mov), R(context), R(10),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(11),
                 B(LdaConstant), U8(5),
                 B(Star), R(12),
@@ -297,8 +303,8 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [25, 84, 92],
-  [116, 149, 151],
+  [32, 91, 99],
+  [123, 156, 158],
 ]
 
 ---
@@ -308,7 +314,7 @@ snippet: "
 "
 frame size: 13
 parameter count: 1
-bytecode array length: 180
+bytecode array length: 187
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(CreateObjectLiteral), U8(0), U8(0), U8(41),
@@ -316,6 +322,8 @@ bytecodes: [
   /*   77 S> */ B(CreateArrayLiteral), U8(1), U8(1), U8(37),
                 B(Star), R(3),
                 B(GetIterator), R(3), U8(2), U8(4),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(2),
                 B(LdaNamedProperty), R(2), U8(2), U8(6),
                 B(Star), R(1),
@@ -361,7 +369,7 @@ bytecodes: [
                 B(Mov), R(context), R(10),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(11),
                 B(LdaConstant), U8(7),
                 B(Star), R(12),
@@ -403,7 +411,7 @@ constant pool: [
   Smi [9],
 ]
 handlers: [
-  [31, 84, 92],
-  [116, 149, 151],
+  [38, 91, 99],
+  [123, 156, 158],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
index c643232d4bae92..1f1cf6a3328116 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
@@ -15,10 +15,12 @@ snippet: "
 "
 frame size: 15
 parameter count: 2
-bytecode array length: 155
+bytecode array length: 162
 bytecodes: [
   /*   10 E> */ B(StackCheck),
   /*   34 S> */ B(GetIterator), R(arg0), U8(0), U8(2),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(5),
                 B(LdaNamedProperty), R(5), U8(0), U8(4),
                 B(Star), R(4),
@@ -61,7 +63,7 @@ bytecodes: [
                 B(Mov), R(context), R(12),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(13),
                 B(LdaConstant), U8(4),
                 B(Star), R(14),
@@ -96,8 +98,8 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [19, 65, 73],
-  [97, 130, 132],
+  [26, 72, 80],
+  [104, 137, 139],
 ]
 
 ---
@@ -109,26 +111,28 @@ snippet: "
 "
 frame size: 20
 parameter count: 2
-bytecode array length: 239
+bytecode array length: 246
 bytecodes: [
-                B(CreateFunctionContext), U8(0), U8(4),
+  /*   10 E> */ B(StackCheck),
+                B(CreateFunctionContext), U8(0), U8(5),
                 B(PushContext), R(2),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(5),
-                B(Ldar), R(arg0),
                 B(StaCurrentContextSlot), U8(4),
+                B(Ldar), R(arg0),
+                B(StaCurrentContextSlot), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(7),
-                B(Ldar), R(1),
                 B(StaCurrentContextSlot), U8(6),
-  /*   10 E> */ B(StackCheck),
+                B(Ldar), R(1),
+                B(StaCurrentContextSlot), U8(5),
                 B(CreateBlockContext), U8(1),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
-  /*   34 S> */ B(LdaContextSlot), R(3), U8(4), U8(0),
+                B(StaCurrentContextSlot), U8(2),
+  /*   34 S> */ B(LdaContextSlot), R(3), U8(3), U8(0),
                 B(Star), R(6),
                 B(GetIterator), R(6), U8(0), U8(2),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(5),
                 B(LdaNamedProperty), R(5), U8(2), U8(4),
                 B(Star), R(4),
@@ -152,9 +156,9 @@ bytecodes: [
                 B(CreateBlockContext), U8(5),
                 B(PushContext), R(11),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
   /*   29 S> */ B(Ldar), R(0),
-  /*   29 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   29 E> */ B(StaCurrentContextSlot), U8(2),
   /*   41 S> */ B(LdaLookupGlobalSlot), U8(6), U8(12), U8(3),
                 B(Star), R(12),
                 B(LdaConstant), U8(7),
@@ -192,7 +196,7 @@ bytecodes: [
                 B(Mov), R(context), R(13),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(14),
                 B(LdaConstant), U8(9),
                 B(Star), R(15),
@@ -233,8 +237,8 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [52, 147, 155],
-  [179, 212, 214],
+  [59, 154, 162],
+  [186, 219, 221],
 ]
 
 ---
@@ -246,10 +250,12 @@ snippet: "
 "
 frame size: 14
 parameter count: 2
-bytecode array length: 172
+bytecode array length: 179
 bytecodes: [
   /*   10 E> */ B(StackCheck),
   /*   34 S> */ B(GetIterator), R(arg0), U8(0), U8(2),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(3),
                 B(LdaNamedProperty), R(3), U8(0), U8(4),
                 B(Star), R(2),
@@ -273,9 +279,9 @@ bytecodes: [
                 B(CreateBlockContext), U8(3),
                 B(PushContext), R(9),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
   /*   29 S> */ B(Ldar), R(0),
-  /*   29 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   29 E> */ B(StaCurrentContextSlot), U8(2),
   /*   41 S> */ B(CreateClosure), U8(4), U8(0), U8(2),
                 B(Star), R(10),
   /*   67 E> */ B(CallUndefinedReceiver0), R(10), U8(12),
@@ -300,7 +306,7 @@ bytecodes: [
                 B(Mov), R(context), R(11),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(12),
                 B(LdaConstant), U8(6),
                 B(Star), R(13),
@@ -337,8 +343,8 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [19, 82, 90],
-  [114, 147, 149],
+  [26, 89, 97],
+  [121, 154, 156],
 ]
 
 ---
@@ -350,10 +356,12 @@ snippet: "
 "
 frame size: 17
 parameter count: 2
-bytecode array length: 166
+bytecode array length: 173
 bytecodes: [
   /*   10 E> */ B(StackCheck),
   /*   41 S> */ B(GetIterator), R(arg0), U8(0), U8(2),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(7),
                 B(LdaNamedProperty), R(7), U8(0), U8(4),
                 B(Star), R(6),
@@ -400,7 +408,7 @@ bytecodes: [
                 B(Mov), R(context), R(14),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(15),
                 B(LdaConstant), U8(6),
                 B(Star), R(16),
@@ -437,8 +445,8 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [19, 76, 84],
-  [108, 141, 143],
+  [26, 83, 91],
+  [115, 148, 150],
 ]
 
 ---
@@ -450,14 +458,14 @@ snippet: "
 "
 frame size: 16
 parameter count: 2
-bytecode array length: 196
+bytecode array length: 203
 bytecodes: [
+  /*   11 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(Mov), R(closure), R(5),
                 B(Mov), R(this), R(6),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(5), U8(2),
                 B(Star), R(0),
-  /*   11 E> */ B(StackCheck),
   /*   11 E> */ B(SuspendGenerator), R(0), R(0), U8(5), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(5),
                 B(Star), R(5),
@@ -468,6 +476,8 @@ bytecodes: [
                 B(Ldar), R(5),
   /*   55 S> */ B(Return),
   /*   35 S> */ B(GetIterator), R(arg0), U8(0), U8(2),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(6),
                 B(LdaNamedProperty), R(6), U8(3), U8(4),
                 B(Star), R(5),
@@ -510,7 +520,7 @@ bytecodes: [
                 B(Mov), R(context), R(13),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(14),
                 B(LdaConstant), U8(7),
                 B(Star), R(15),
@@ -538,7 +548,7 @@ bytecodes: [
   /*   55 S> */ B(Return),
 ]
 constant pool: [
-  Smi [22],
+  Smi [21],
   Smi [10],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
@@ -548,8 +558,8 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [60, 106, 114],
-  [138, 171, 173],
+  [67, 113, 121],
+  [145, 178, 180],
 ]
 
 ---
@@ -561,14 +571,14 @@ snippet: "
 "
 frame size: 15
 parameter count: 2
-bytecode array length: 240
+bytecode array length: 247
 bytecodes: [
+  /*   11 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(4),
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(0),
-  /*   11 E> */ B(StackCheck),
   /*   11 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(4),
                 B(Star), R(4),
@@ -579,6 +589,8 @@ bytecodes: [
                 B(Ldar), R(4),
   /*   49 S> */ B(Return),
   /*   35 S> */ B(GetIterator), R(arg0), U8(0), U8(2),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(5),
                 B(LdaNamedProperty), R(5), U8(4), U8(4),
                 B(Star), R(4),
@@ -635,7 +647,7 @@ bytecodes: [
                 B(Mov), R(context), R(12),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(13),
                 B(LdaConstant), U8(10),
                 B(Star), R(14),
@@ -665,8 +677,8 @@ bytecodes: [
   /*   49 S> */ B(Return),
 ]
 constant pool: [
-  Smi [22],
-  Smi [113],
+  Smi [21],
+  Smi [119],
   Smi [10],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
@@ -680,8 +692,8 @@ constant pool: [
   Smi [9],
 ]
 handlers: [
-  [60, 144, 152],
-  [176, 209, 211],
+  [67, 151, 159],
+  [183, 216, 218],
 ]
 
 ---
@@ -693,15 +705,17 @@ snippet: "
 "
 frame size: 17
 parameter count: 2
-bytecode array length: 210
+bytecode array length: 217
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(Mov), R(closure), R(5),
                 B(Mov), R(this), R(6),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionEnter), R(5), U8(2),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
                 B(Mov), R(context), R(5),
   /*   40 S> */ B(GetIterator), R(arg0), U8(0), U8(2),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(7),
                 B(LdaNamedProperty), R(7), U8(0), U8(4),
                 B(Star), R(6),
@@ -744,7 +758,7 @@ bytecodes: [
                 B(Mov), R(context), R(14),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(15),
                 B(LdaConstant), U8(4),
                 B(Star), R(16),
@@ -782,7 +796,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(5),
                 B(PushContext), R(6),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(8),
                 B(LdaFalse),
                 B(Star), R(9),
@@ -799,9 +813,9 @@ constant pool: [
   SCOPE_INFO_TYPE,
 ]
 handlers: [
-  [16, 182, 182],
-  [34, 80, 88],
-  [112, 145, 147],
+  [16, 189, 189],
+  [41, 87, 95],
+  [119, 152, 154],
 ]
 
 ---
@@ -813,16 +827,18 @@ snippet: "
 "
 frame size: 16
 parameter count: 2
-bytecode array length: 246
+bytecode array length: 253
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(Mov), R(closure), R(4),
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionEnter), R(4), U8(2),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
                 B(Mov), R(context), R(4),
   /*   40 S> */ B(GetIterator), R(arg0), U8(0), U8(2),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(6),
                 B(LdaNamedProperty), R(6), U8(1), U8(4),
                 B(Star), R(5),
@@ -877,7 +893,7 @@ bytecodes: [
                 B(Mov), R(context), R(13),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(14),
                 B(LdaConstant), U8(5),
                 B(Star), R(15),
@@ -915,7 +931,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(4),
                 B(PushContext), R(5),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(7),
                 B(LdaTrue),
                 B(Star), R(8),
@@ -924,7 +940,7 @@ bytecodes: [
   /*   54 S> */ B(Return),
 ]
 constant pool: [
-  Smi [91],
+  Smi [97],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
@@ -933,8 +949,8 @@ constant pool: [
   SCOPE_INFO_TYPE,
 ]
 handlers: [
-  [20, 218, 218],
-  [38, 116, 124],
-  [148, 181, 183],
+  [20, 225, 225],
+  [45, 123, 131],
+  [155, 188, 190],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
index ca3ef0bef309f5..c84e6ec0ebf722 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
@@ -15,12 +15,12 @@ frame size: 3
 parameter count: 1
 bytecode array length: 44
 bytecodes: [
+  /*   11 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(Mov), R(closure), R(1),
                 B(Mov), R(this), R(2),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(1), U8(2),
                 B(Star), R(0),
-  /*   11 E> */ B(StackCheck),
   /*   11 E> */ B(SuspendGenerator), R(0), R(0), U8(1), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(1),
                 B(Star), R(1),
@@ -34,7 +34,7 @@ bytecodes: [
   /*   16 S> */ B(Return),
 ]
 constant pool: [
-  Smi [22],
+  Smi [21],
   Smi [10],
   Smi [7],
 ]
@@ -50,12 +50,12 @@ frame size: 3
 parameter count: 1
 bytecode array length: 80
 bytecodes: [
+  /*   11 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(1),
                 B(Mov), R(this), R(2),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(1), U8(2),
                 B(Star), R(0),
-  /*   11 E> */ B(StackCheck),
   /*   11 E> */ B(SuspendGenerator), R(0), R(0), U8(1), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(1),
                 B(Star), R(1),
@@ -83,8 +83,8 @@ bytecodes: [
   /*   25 S> */ B(Return),
 ]
 constant pool: [
-  Smi [22],
-  Smi [58],
+  Smi [21],
+  Smi [57],
   Smi [10],
   Smi [7],
   Smi [10],
@@ -100,14 +100,14 @@ snippet: "
 "
 frame size: 15
 parameter count: 1
-bytecode array length: 246
+bytecode array length: 253
 bytecodes: [
+  /*   11 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(4),
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(0),
-  /*   11 E> */ B(StackCheck),
   /*   11 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(4),
                 B(Star), R(4),
@@ -120,6 +120,8 @@ bytecodes: [
   /*   30 S> */ B(CreateArrayLiteral), U8(4), U8(0), U8(37),
                 B(Star), R(6),
                 B(GetIterator), R(6), U8(1), U8(3),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(5),
                 B(LdaNamedProperty), R(5), U8(5), U8(5),
                 B(Star), R(4),
@@ -176,7 +178,7 @@ bytecodes: [
                 B(Mov), R(context), R(12),
                 B(TestTypeOf), U8(6),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(159),
+                B(Wide), B(LdaSmi), I16(160),
                 B(Star), R(13),
                 B(LdaConstant), U8(11),
                 B(Star), R(14),
@@ -206,8 +208,8 @@ bytecodes: [
   /*   44 S> */ B(Return),
 ]
 constant pool: [
-  Smi [22],
-  Smi [119],
+  Smi [21],
+  Smi [125],
   Smi [10],
   Smi [7],
   ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
@@ -222,8 +224,8 @@ constant pool: [
   Smi [9],
 ]
 handlers: [
-  [66, 150, 158],
-  [182, 215, 217],
+  [73, 157, 165],
+  [189, 222, 224],
 ]
 
 ---
@@ -234,14 +236,14 @@ snippet: "
 "
 frame size: 7
 parameter count: 1
-bytecode array length: 198
+bytecode array length: 205
 bytecodes: [
+  /*   38 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(1),
                 B(Mov), R(this), R(2),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(1), U8(2),
                 B(Star), R(0),
-  /*   38 E> */ B(StackCheck),
   /*   38 E> */ B(SuspendGenerator), R(0), R(0), U8(1), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(1),
                 B(Star), R(1),
@@ -256,6 +258,8 @@ bytecodes: [
   /*   50 E> */ B(CallUndefinedReceiver0), R(5), U8(2),
                 B(Star), R(6),
                 B(GetIterator), R(6), U8(4), U8(6),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(3),
                 B(LdaNamedProperty), R(3), U8(5), U8(8),
                 B(Star), R(5),
@@ -311,8 +315,8 @@ bytecodes: [
   /*   54 S> */ B(Return),
 ]
 constant pool: [
-  Smi [22],
-  Smi [166],
+  Smi [21],
+  Smi [172],
   Smi [10],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["g"],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/IIFEWithOneshotOpt.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/IIFEWithOneshotOpt.golden
index 9bffe3bf790923..56b6e0afac192c 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/IIFEWithOneshotOpt.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/IIFEWithOneshotOpt.golden
@@ -23,9 +23,9 @@ frame size: 3
 parameter count: 1
 bytecode array length: 40
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
   /*   29 S> */ B(CreateEmptyObjectLiteral),
   /*   31 E> */ B(StaGlobal), U8(0), U8(0),
   /*   45 S> */ B(LdaGlobal), U8(0), U8(2),
@@ -67,9 +67,9 @@ frame size: 3
 parameter count: 1
 bytecode array length: 69
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
   /*   29 S> */ B(CreateEmptyObjectLiteral),
   /*   31 E> */ B(StaGlobal), U8(0), U8(0),
   /*   50 S> */ B(LdaZero),
@@ -126,9 +126,9 @@ frame size: 3
 parameter count: 1
 bytecode array length: 70
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
   /*   29 S> */ B(CreateEmptyObjectLiteral),
   /*   31 E> */ B(StaGlobal), U8(0), U8(0),
   /*   45 S> */ B(LdaSmi), I8(4),
@@ -185,9 +185,9 @@ frame size: 3
 parameter count: 1
 bytecode array length: 70
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
   /*   29 S> */ B(CreateEmptyObjectLiteral),
   /*   31 E> */ B(StaGlobal), U8(0), U8(0),
   /*   45 S> */ B(LdaSmi), I8(4),
@@ -246,9 +246,9 @@ frame size: 4
 parameter count: 1
 bytecode array length: 71
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
   /*   29 S> */ B(LdaConstant), U8(0),
                 B(Star), R(2),
                 B(LdaSmi), I8(41),
@@ -299,9 +299,9 @@ frame size: 5
 parameter count: 1
 bytecode array length: 24
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
   /*   29 S> */ B(LdaConstant), U8(0),
                 B(Star), R(3),
                 B(LdaSmi), I8(4),
@@ -332,9 +332,9 @@ frame size: 5
 parameter count: 1
 bytecode array length: 24
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
   /*   29 S> */ B(LdaConstant), U8(0),
                 B(Star), R(3),
                 B(LdaSmi), I8(37),
@@ -376,9 +376,9 @@ frame size: 8
 parameter count: 1
 bytecode array length: 137
 bytecodes: [
+  /*  237 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*  237 E> */ B(StackCheck),
   /*  255 S> */ B(LdaNamedPropertyNoFeedback), R(this), U8(0),
                 B(Star), R(1),
   /*  255 E> */ B(CallNoFeedback), R(1), R(this), U8(1),
@@ -471,9 +471,9 @@ frame size: 8
 parameter count: 1
 bytecode array length: 140
 bytecodes: [
+  /*  189 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*  189 E> */ B(StackCheck),
   /*  202 S> */ B(LdaUndefined),
                 B(Star), R(2),
                 B(LdaGlobal), U8(0), U8(0),
@@ -569,9 +569,9 @@ frame size: 2
 parameter count: 1
 bytecode array length: 43
 bytecodes: [
+  /*   79 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   79 E> */ B(StackCheck),
   /*   93 S> */ B(CreateEmptyObjectLiteral),
   /*   95 E> */ B(StaGlobal), U8(0), U8(0),
   /*  111 S> */ B(LdaGlobal), U8(0), U8(2),
@@ -618,9 +618,9 @@ frame size: 2
 parameter count: 1
 bytecode array length: 43
 bytecodes: [
+  /*   76 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   76 E> */ B(StackCheck),
   /*   92 S> */ B(CreateEmptyObjectLiteral),
   /*   94 E> */ B(StaGlobal), U8(0), U8(0),
   /*  112 S> */ B(LdaGlobal), U8(0), U8(2),
@@ -753,14 +753,14 @@ frame size: 3
 parameter count: 2
 bytecode array length: 27
 bytecodes: [
+  /*   46 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   46 E> */ B(StackCheck),
-  /*   53 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*   53 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(Star), R(2),
                 B(LdaSmi), I8(3),
   /*   57 E> */ B(StaNamedPropertyNoFeedback), R(2), U8(1), U8(0),
@@ -786,14 +786,14 @@ frame size: 3
 parameter count: 2
 bytecode array length: 27
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   30 E> */ B(StackCheck),
-  /*   37 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*   37 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(Star), R(2),
                 B(LdaSmi), I8(3),
   /*   41 E> */ B(StaNamedPropertyNoFeedback), R(2), U8(1), U8(0),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/IIFEWithoutOneshotOpt.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/IIFEWithoutOneshotOpt.golden
index 54a3fa4917dcc3..c3b8dcc22f99bd 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/IIFEWithoutOneshotOpt.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/IIFEWithoutOneshotOpt.golden
@@ -22,9 +22,9 @@ frame size: 3
 parameter count: 1
 bytecode array length: 42
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
   /*   29 S> */ B(CreateEmptyObjectLiteral),
   /*   31 E> */ B(StaGlobal), U8(0), U8(0),
   /*   45 S> */ B(LdaGlobal), U8(0), U8(2),
@@ -70,9 +70,9 @@ frame size: 3
 parameter count: 1
 bytecode array length: 65
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
   /*   29 S> */ B(CreateObjectLiteral), U8(0), U8(0), U8(41),
   /*   31 E> */ B(StaGlobal), U8(1), U8(1),
   /*   93 S> */ B(LdaGlobal), U8(1), U8(3),
@@ -130,9 +130,9 @@ frame size: 8
 parameter count: 1
 bytecode array length: 144
 bytecodes: [
+  /*  237 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*  237 E> */ B(StackCheck),
   /*  255 S> */ B(LdaNamedProperty), R(this), U8(0), U8(0),
                 B(Star), R(1),
   /*  255 E> */ B(CallProperty0), R(1), R(this), U8(2),
@@ -223,9 +223,9 @@ frame size: 7
 parameter count: 1
 bytecode array length: 126
 bytecodes: [
+  /*  189 E> */ B(StackCheck),
                 B(CreateMappedArguments),
                 B(Star), R(0),
-  /*  189 E> */ B(StackCheck),
   /*  202 S> */ B(LdaGlobal), U8(0), U8(0),
                 B(Star), R(1),
   /*  202 E> */ B(CallUndefinedReceiver0), R(1), U8(2),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/LetVariable.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/LetVariable.golden
index 1b62c4c0634d27..a7900cf8ebe40d 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/LetVariable.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/LetVariable.golden
@@ -50,9 +50,9 @@ frame size: 2
 parameter count: 1
 bytecode array length: 17
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(LdaTheHole),
                 B(Star), R(0),
-  /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(20),
                 B(Star), R(1),
                 B(Ldar), R(0),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/LetVariableContextSlot.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/LetVariableContextSlot.golden
index e6bf0f717e56bd..61f898d5d78ad1 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/LetVariableContextSlot.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/LetVariableContextSlot.golden
@@ -13,13 +13,13 @@ frame size: 1
 parameter count: 1
 bytecode array length: 15
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
-  /*   30 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(2),
   /*   42 S> */ B(LdaSmi), I8(10),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
                 B(LdaUndefined),
   /*   72 S> */ B(Return),
 ]
@@ -37,14 +37,14 @@ frame size: 1
 parameter count: 1
 bytecode array length: 16
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
-  /*   30 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(2),
   /*   42 S> */ B(LdaSmi), I8(10),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(4),
-  /*   72 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
+  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   72 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
   /*   81 S> */ B(Return),
 ]
 constant pool: [
@@ -61,18 +61,18 @@ frame size: 2
 parameter count: 1
 bytecode array length: 25
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
-  /*   30 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(2),
   /*   42 S> */ B(LdaSmi), I8(20),
                 B(Star), R(1),
-                B(LdaCurrentContextSlot), U8(4),
+                B(LdaCurrentContextSlot), U8(2),
   /*   45 E> */ B(ThrowReferenceErrorIfHole), U8(1),
                 B(Ldar), R(1),
-                B(StaCurrentContextSlot), U8(4),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
+  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
                 B(LdaUndefined),
   /*   78 S> */ B(Return),
 ]
@@ -91,15 +91,15 @@ frame size: 1
 parameter count: 1
 bytecode array length: 19
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
-  /*   30 E> */ B(StackCheck),
+                B(StaCurrentContextSlot), U8(2),
   /*   42 S> */ B(LdaSmi), I8(10),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
   /*   46 S> */ B(LdaSmi), I8(20),
-  /*   48 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   48 E> */ B(StaCurrentContextSlot), U8(2),
                 B(LdaUndefined),
   /*   80 S> */ B(Return),
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/LookupSlot.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/LookupSlot.golden
index 0d2e6ba7b2b6ce..f7da45c224a65c 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/LookupSlot.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/LookupSlot.golden
@@ -14,15 +14,15 @@ frame size: 10
 parameter count: 1
 bytecode array length: 63
 bytecodes: [
-                B(CreateFunctionContext), U8(0), U8(3),
+  /*   10 E> */ B(StackCheck),
+                B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(6),
-                B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
-  /*   10 E> */ B(StackCheck),
+                B(Ldar), R(0),
+                B(StaCurrentContextSlot), U8(4),
   /*   14 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star), R(2),
                 B(LdaConstant), U8(2),
@@ -59,15 +59,15 @@ frame size: 10
 parameter count: 1
 bytecode array length: 64
 bytecodes: [
-                B(CreateFunctionContext), U8(0), U8(3),
+  /*   10 E> */ B(StackCheck),
+                B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(6),
-                B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
-  /*   10 E> */ B(StackCheck),
+                B(Ldar), R(0),
+                B(StaCurrentContextSlot), U8(4),
   /*   14 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star), R(2),
                 B(LdaConstant), U8(2),
@@ -105,15 +105,15 @@ frame size: 10
 parameter count: 1
 bytecode array length: 64
 bytecodes: [
-                B(CreateFunctionContext), U8(0), U8(3),
+  /*   10 E> */ B(StackCheck),
+                B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(6),
-                B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
-  /*   10 E> */ B(StackCheck),
+                B(Ldar), R(0),
+                B(StaCurrentContextSlot), U8(4),
   /*   14 S> */ B(LdaSmi), I8(20),
   /*   16 E> */ B(StaLookupSlot), U8(1), U8(0),
   /*   22 S> */ B(LdaLookupGlobalSlot), U8(2), U8(0), U8(1),
@@ -156,15 +156,15 @@ frame size: 10
 parameter count: 1
 bytecode array length: 63
 bytecodes: [
-                B(CreateFunctionContext), U8(0), U8(3),
+  /*   38 E> */ B(StackCheck),
+                B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(6),
-                B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
-  /*   38 E> */ B(StackCheck),
+                B(Ldar), R(0),
+                B(StaCurrentContextSlot), U8(4),
   /*   44 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star), R(2),
                 B(LdaConstant), U8(2),
@@ -181,7 +181,7 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kResolvePossiblyDirectEval), R(4), U8(6),
                 B(Star), R(2),
   /*   44 E> */ B(CallUndefinedReceiver1), R(2), R(3), U8(2),
-  /*   66 S> */ B(LdaLookupContextSlot), U8(3), U8(6), U8(1),
+  /*   66 S> */ B(LdaLookupContextSlot), U8(3), U8(4), U8(1),
   /*   75 S> */ B(Return),
 ]
 constant pool: [
@@ -206,15 +206,15 @@ frame size: 10
 parameter count: 1
 bytecode array length: 63
 bytecodes: [
-                B(CreateFunctionContext), U8(0), U8(3),
+  /*   34 E> */ B(StackCheck),
+                B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(6),
-                B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
-  /*   34 E> */ B(StackCheck),
+                B(Ldar), R(0),
+                B(StaCurrentContextSlot), U8(4),
   /*   40 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star), R(2),
                 B(LdaConstant), U8(2),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/Modules.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/Modules.golden
index 55a56a88b3c441..b21dea1dcbbf1f 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/Modules.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/Modules.golden
@@ -15,6 +15,7 @@ frame size: 5
 parameter count: 2
 bytecode array length: 62
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
                 B(Star), R(3),
@@ -25,7 +26,6 @@ bytecodes: [
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
-  /*    0 E> */ B(StackCheck),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(3),
                 B(Star), R(3),
@@ -40,7 +40,7 @@ bytecodes: [
   /*   14 S> */ B(Return),
 ]
 constant pool: [
-  Smi [36],
+  Smi [35],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
@@ -56,6 +56,7 @@ frame size: 5
 parameter count: 2
 bytecode array length: 62
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
                 B(Star), R(3),
@@ -66,7 +67,6 @@ bytecodes: [
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
-  /*    0 E> */ B(StackCheck),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(3),
                 B(Star), R(3),
@@ -81,7 +81,7 @@ bytecodes: [
   /*   25 S> */ B(Return),
 ]
 constant pool: [
-  Smi [36],
+  Smi [35],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
@@ -99,6 +99,7 @@ frame size: 6
 parameter count: 2
 bytecode array length: 92
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
                 B(Star), R(4),
@@ -109,7 +110,6 @@ bytecodes: [
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(0),
-  /*    0 E> */ B(StackCheck),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(4),
                 B(Star), R(4),
@@ -137,7 +137,7 @@ bytecodes: [
   /*   65 S> */ B(Return),
 ]
 constant pool: [
-  Smi [36],
+  Smi [35],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
@@ -156,6 +156,7 @@ frame size: 6
 parameter count: 2
 bytecode array length: 90
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
                 B(Star), R(4),
@@ -166,7 +167,6 @@ bytecodes: [
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(0),
-  /*    0 E> */ B(StackCheck),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(4),
                 B(Star), R(4),
@@ -193,7 +193,7 @@ bytecodes: [
   /*   50 S> */ B(Return),
 ]
 constant pool: [
-  Smi [36],
+  Smi [35],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
@@ -211,6 +211,7 @@ frame size: 6
 parameter count: 2
 bytecode array length: 96
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
                 B(Star), R(4),
@@ -223,7 +224,6 @@ bytecodes: [
                 B(Star), R(0),
                 B(LdaTheHole),
                 B(StaModuleVariable), I8(1), U8(0),
-  /*    0 E> */ B(StackCheck),
                 B(Ldar), R(0),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(4),
@@ -251,7 +251,7 @@ bytecodes: [
   /*   50 S> */ B(Return),
 ]
 constant pool: [
-  Smi [42],
+  Smi [41],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
@@ -269,6 +269,7 @@ frame size: 6
 parameter count: 2
 bytecode array length: 100
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
                 B(Star), R(4),
@@ -281,7 +282,6 @@ bytecodes: [
                 B(Star), R(0),
                 B(LdaTheHole),
                 B(StaModuleVariable), I8(1), U8(0),
-  /*    0 E> */ B(StackCheck),
                 B(Ldar), R(0),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(4),
@@ -309,7 +309,7 @@ bytecodes: [
   /*   52 S> */ B(Return),
 ]
 constant pool: [
-  Smi [42],
+  Smi [41],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
@@ -325,6 +325,7 @@ frame size: 5
 parameter count: 2
 bytecode array length: 75
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
                 B(Star), R(3),
@@ -337,7 +338,6 @@ bytecodes: [
                 B(Star), R(0),
                 B(LdaTheHole),
                 B(StaModuleVariable), I8(1), U8(0),
-  /*    0 E> */ B(StackCheck),
                 B(Ldar), R(0),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(3),
@@ -355,7 +355,7 @@ bytecodes: [
   /*   33 S> */ B(Return),
 ]
 constant pool: [
-  Smi [42],
+  Smi [41],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
@@ -372,6 +372,7 @@ frame size: 7
 parameter count: 2
 bytecode array length: 96
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
                 B(Star), R(3),
@@ -384,7 +385,6 @@ bytecodes: [
                 B(Star), R(0),
                 B(LdaTheHole),
                 B(StaModuleVariable), I8(1), U8(0),
-  /*    0 E> */ B(StackCheck),
                 B(Ldar), R(0),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(3),
@@ -411,7 +411,7 @@ bytecodes: [
   /*   27 S> */ B(Return),
 ]
 constant pool: [
-  Smi [42],
+  Smi [41],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
@@ -429,6 +429,7 @@ frame size: 5
 parameter count: 2
 bytecode array length: 62
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
                 B(Star), R(3),
@@ -439,7 +440,6 @@ bytecodes: [
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
-  /*    0 E> */ B(StackCheck),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(3),
                 B(Star), R(3),
@@ -454,7 +454,7 @@ bytecodes: [
   /*   31 S> */ B(Return),
 ]
 constant pool: [
-  Smi [36],
+  Smi [35],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
@@ -470,6 +470,7 @@ frame size: 5
 parameter count: 2
 bytecode array length: 62
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
                 B(Star), R(3),
@@ -480,7 +481,6 @@ bytecodes: [
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
-  /*    0 E> */ B(StackCheck),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(3),
                 B(Star), R(3),
@@ -495,7 +495,7 @@ bytecodes: [
   /*   20 S> */ B(Return),
 ]
 constant pool: [
-  Smi [36],
+  Smi [35],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
@@ -512,6 +512,7 @@ frame size: 8
 parameter count: 2
 bytecode array length: 89
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
                 B(Star), R(4),
@@ -526,7 +527,6 @@ bytecodes: [
                 B(Star), R(4),
                 B(CallRuntime), U16(Runtime::kGetModuleNamespace), R(4), U8(1),
                 B(Star), R(1),
-  /*    0 E> */ B(StackCheck),
                 B(Ldar), R(0),
   /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(4),
@@ -546,7 +546,7 @@ bytecodes: [
   /*   46 S> */ B(Return),
 ]
 constant pool: [
-  Smi [48],
+  Smi [47],
   SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/NewAndSpread.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/NewAndSpread.golden
index c29b74c0e29b8d..2d994ac1004ee6 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/NewAndSpread.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/NewAndSpread.golden
@@ -92,7 +92,7 @@ snippet: "
 "
 frame size: 7
 parameter count: 1
-bytecode array length: 115
+bytecode array length: 122
 bytecodes: [
   /*   30 E> */ B(StackCheck),
                 B(CreateBlockContext), U8(0),
@@ -115,10 +115,12 @@ bytecodes: [
   /*  101 S> */ B(CreateArrayLiteral), U8(5), U8(1), U8(37),
                 B(Star), R(6),
                 B(GetIterator), R(6), U8(2), U8(4),
+                B(Mov), R(4), R(1),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(5),
                 B(LdaNamedProperty), R(5), U8(6), U8(6),
                 B(Star), R(4),
-                B(Mov), R(0), R(1),
                 B(CallProperty0), R(4), R(5), U8(15),
                 B(Star), R(6),
                 B(JumpIfJSReceiver), U8(7),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/OuterContextVariables.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/OuterContextVariables.golden
index c2aed3d1586d7c..146715e03aaf0c 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/OuterContextVariables.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/OuterContextVariables.golden
@@ -23,9 +23,9 @@ parameter count: 1
 bytecode array length: 13
 bytecodes: [
   /*   97 E> */ B(StackCheck),
-  /*  102 S> */ B(LdaImmutableContextSlot), R(context), U8(4), U8(1),
+  /*  102 S> */ B(LdaImmutableContextSlot), R(context), U8(2), U8(1),
                 B(Star), R(0),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
   /*  118 E> */ B(Mul), R(0), U8(0),
   /*  129 S> */ B(Return),
 ]
@@ -51,8 +51,8 @@ parameter count: 1
 bytecode array length: 9
 bytecodes: [
   /*   97 E> */ B(StackCheck),
-  /*  102 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
-  /*  111 E> */ B(StaContextSlot), R(context), U8(4), U8(1),
+  /*  102 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
+  /*  111 E> */ B(StaContextSlot), R(context), U8(2), U8(1),
                 B(LdaUndefined),
   /*  123 S> */ B(Return),
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateAccessorAccess.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateAccessorAccess.golden
index 6fc00999a59662..ff4c2559496c90 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateAccessorAccess.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateAccessorAccess.golden
@@ -22,43 +22,44 @@ snippet: "
   var test = A;
   new test;
 "
-frame size: 6
+frame size: 7
 parameter count: 1
-bytecode array length: 95
+bytecode array length: 98
 bytecodes: [
   /*   67 E> */ B(StackCheck),
-                B(LdaCurrentContextSlot), U8(5),
+                B(LdaCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
-                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(2),
-  /*   76 S> */ B(LdaCurrentContextSlot), U8(4),
-                B(Star), R(3),
-                B(LdaCurrentContextSlot), U8(5),
-  /*   81 E> */ B(LdaKeyedProperty), R(this), U8(0),
-                B(CallRuntime), U16(Runtime::kLoadPrivateGetter), R(3), U8(1),
+                B(Mov), R(context), R(2),
+                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
+  /*   76 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(Star), R(4),
-                B(CallProperty0), R(4), R(this), U8(2),
+                B(LdaCurrentContextSlot), U8(3),
+  /*   81 E> */ B(LdaKeyedProperty), R(this), U8(0),
+                B(CallRuntime), U16(Runtime::kLoadPrivateGetter), R(4), U8(1),
+                B(Star), R(5),
+                B(CallProperty0), R(5), R(this), U8(2),
                 B(Inc), U8(4),
-                B(Star), R(4),
-  /*   83 E> */ B(CallRuntime), U16(Runtime::kLoadPrivateSetter), R(3), U8(1),
                 B(Star), R(5),
-                B(CallProperty1), R(5), R(this), R(4), U8(5),
+  /*   83 E> */ B(CallRuntime), U16(Runtime::kLoadPrivateSetter), R(4), U8(1),
+                B(Star), R(6),
+                B(CallProperty1), R(6), R(this), R(5), U8(5),
   /*   91 S> */ B(LdaSmi), I8(1),
-                B(Star), R(2),
-                B(LdaCurrentContextSlot), U8(4),
-                B(Star), R(4),
-                B(LdaCurrentContextSlot), U8(5),
-  /*   96 E> */ B(LdaKeyedProperty), R(this), U8(7),
-                B(CallRuntime), U16(Runtime::kLoadPrivateSetter), R(4), U8(1),
-                B(Star), R(5),
-                B(CallProperty1), R(5), R(this), R(2), U8(9),
-  /*  108 S> */ B(LdaCurrentContextSlot), U8(4),
                 B(Star), R(3),
-                B(LdaCurrentContextSlot), U8(5),
-  /*  120 E> */ B(LdaKeyedProperty), R(this), U8(11),
-                B(CallRuntime), U16(Runtime::kLoadPrivateGetter), R(3), U8(1),
+                B(LdaCurrentContextSlot), U8(2),
+                B(Star), R(5),
+                B(LdaCurrentContextSlot), U8(3),
+  /*   96 E> */ B(LdaKeyedProperty), R(this), U8(7),
+                B(CallRuntime), U16(Runtime::kLoadPrivateSetter), R(5), U8(1),
+                B(Star), R(6),
+                B(CallProperty1), R(6), R(this), R(3), U8(9),
+  /*  108 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(Star), R(4),
-                B(CallProperty0), R(4), R(this), U8(13),
+                B(LdaCurrentContextSlot), U8(3),
+  /*  120 E> */ B(LdaKeyedProperty), R(this), U8(11),
+                B(CallRuntime), U16(Runtime::kLoadPrivateGetter), R(4), U8(1),
+                B(Star), R(5),
+                B(CallProperty0), R(5), R(this), U8(13),
   /*  123 S> */ B(Return),
 ]
 constant pool: [
@@ -75,20 +76,21 @@ snippet: "
   var test = B;
   new test;
 "
-frame size: 4
+frame size: 5
 parameter count: 1
-bytecode array length: 29
+bytecode array length: 32
 bytecodes: [
   /*   48 E> */ B(StackCheck),
-                B(LdaCurrentContextSlot), U8(5),
+                B(LdaCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
-                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(2),
-  /*   53 S> */ B(Wide), B(LdaSmi), I16(263),
-                B(Star), R(2),
-                B(LdaConstant), U8(0),
+                B(Mov), R(context), R(2),
+                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
+  /*   53 S> */ B(Wide), B(LdaSmi), I16(265),
                 B(Star), R(3),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(2), U8(2),
+                B(LdaConstant), U8(0),
+                B(Star), R(4),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(3), U8(2),
                 B(Throw),
 ]
 constant pool: [
@@ -106,20 +108,21 @@ snippet: "
   var test = C;
   new test;
 "
-frame size: 4
+frame size: 5
 parameter count: 1
-bytecode array length: 29
+bytecode array length: 32
 bytecodes: [
   /*   41 E> */ B(StackCheck),
-                B(LdaCurrentContextSlot), U8(5),
+                B(LdaCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
-                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(2),
-  /*   46 S> */ B(Wide), B(LdaSmi), I16(262),
-                B(Star), R(2),
-                B(LdaConstant), U8(0),
+                B(Mov), R(context), R(2),
+                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
+  /*   46 S> */ B(Wide), B(LdaSmi), I16(264),
                 B(Star), R(3),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(2), U8(2),
+                B(LdaConstant), U8(0),
+                B(Star), R(4),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(3), U8(2),
                 B(Throw),
 ]
 constant pool: [
@@ -137,20 +140,21 @@ snippet: "
   var test = D;
   new test;
 "
-frame size: 4
+frame size: 5
 parameter count: 1
-bytecode array length: 29
+bytecode array length: 32
 bytecodes: [
   /*   48 E> */ B(StackCheck),
-                B(LdaCurrentContextSlot), U8(5),
+                B(LdaCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
-                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(2),
-  /*   53 S> */ B(Wide), B(LdaSmi), I16(263),
-                B(Star), R(2),
-                B(LdaConstant), U8(0),
+                B(Mov), R(context), R(2),
+                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
+  /*   53 S> */ B(Wide), B(LdaSmi), I16(265),
                 B(Star), R(3),
-  /*   61 E> */ B(CallRuntime), U16(Runtime::kNewTypeError), R(2), U8(2),
+                B(LdaConstant), U8(0),
+                B(Star), R(4),
+  /*   61 E> */ B(CallRuntime), U16(Runtime::kNewTypeError), R(3), U8(2),
                 B(Throw),
 ]
 constant pool: [
@@ -168,20 +172,21 @@ snippet: "
   var test = E;
   new test;
 "
-frame size: 5
+frame size: 6
 parameter count: 1
-bytecode array length: 29
+bytecode array length: 32
 bytecodes: [
   /*   41 E> */ B(StackCheck),
-                B(LdaCurrentContextSlot), U8(5),
+                B(LdaCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
-                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(2),
-  /*   46 S> */ B(Wide), B(LdaSmi), I16(262),
-                B(Star), R(3),
-                B(LdaConstant), U8(0),
+                B(Mov), R(context), R(2),
+                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
+  /*   46 S> */ B(Wide), B(LdaSmi), I16(264),
                 B(Star), R(4),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(3), U8(2),
+                B(LdaConstant), U8(0),
+                B(Star), R(5),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(4), U8(2),
                 B(Throw),
 ]
 constant pool: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateAccessorDeclaration.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateAccessorDeclaration.golden
index 2c0af93787ef71..cf12be82ba9483 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateAccessorDeclaration.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateAccessorDeclaration.golden
@@ -24,8 +24,8 @@ bytecodes: [
                 B(PushContext), R(1),
                 B(LdaConstant), U8(2),
                 B(Star), R(3),
-                B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(3), U8(1),
-                B(StaCurrentContextSlot), U8(5),
+                B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(3), U8(1),
+                B(StaCurrentContextSlot), U8(3),
                 B(LdaTheHole),
                 B(Star), R(6),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -40,7 +40,7 @@ bytecodes: [
                 B(CreateClosure), U8(5), U8(2), U8(2),
                 B(Star), R(6),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(5), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(2), R(0),
                 B(LdaUndefined),
@@ -74,8 +74,8 @@ bytecodes: [
                 B(PushContext), R(1),
                 B(LdaConstant), U8(2),
                 B(Star), R(3),
-                B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(3), U8(1),
-                B(StaCurrentContextSlot), U8(5),
+                B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(3), U8(1),
+                B(StaCurrentContextSlot), U8(3),
                 B(LdaTheHole),
                 B(Star), R(6),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -90,7 +90,7 @@ bytecodes: [
                 B(LdaNull),
                 B(Star), R(6),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(5), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(2), R(0),
                 B(LdaUndefined),
@@ -123,8 +123,8 @@ bytecodes: [
                 B(PushContext), R(1),
                 B(LdaConstant), U8(2),
                 B(Star), R(3),
-                B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(3), U8(1),
-                B(StaCurrentContextSlot), U8(5),
+                B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(3), U8(1),
+                B(StaCurrentContextSlot), U8(3),
                 B(LdaTheHole),
                 B(Star), R(6),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -139,7 +139,7 @@ bytecodes: [
                 B(CreateClosure), U8(4), U8(1), U8(2),
                 B(Star), R(6),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(5), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(2), R(0),
                 B(LdaUndefined),
@@ -178,8 +178,8 @@ bytecodes: [
                 B(PushContext), R(2),
                 B(LdaConstant), U8(2),
                 B(Star), R(4),
-                B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(5),
+                B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
+                B(StaCurrentContextSlot), U8(3),
                 B(LdaTheHole),
                 B(Star), R(7),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -194,15 +194,15 @@ bytecodes: [
                 B(CreateClosure), U8(5), U8(2), U8(2),
                 B(Star), R(7),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(6), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(2),
                 B(Mov), R(3), R(0),
   /*   38 E> */ B(CreateBlockContext), U8(6),
                 B(PushContext), R(2),
                 B(LdaConstant), U8(8),
                 B(Star), R(4),
-                B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(5),
+                B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
+                B(StaCurrentContextSlot), U8(3),
   /*  118 E> */ B(CreateClosure), U8(9), U8(3), U8(2),
                 B(Star), R(3),
                 B(LdaConstant), U8(7),
@@ -216,7 +216,7 @@ bytecodes: [
                 B(CreateClosure), U8(11), U8(5), U8(2),
                 B(Star), R(7),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(6), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(2),
                 B(Mov), R(3), R(1),
                 B(LdaUndefined),
@@ -273,8 +273,8 @@ bytecodes: [
                 B(PushContext), R(2),
                 B(LdaConstant), U8(6),
                 B(Star), R(4),
-                B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(5),
+                B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
+                B(StaCurrentContextSlot), U8(3),
   /*   77 E> */ B(CreateClosure), U8(7), U8(2), U8(2),
                 B(Star), R(3),
                 B(LdaConstant), U8(5),
@@ -290,7 +290,7 @@ bytecodes: [
                 B(LdaNull),
                 B(Star), R(7),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(6), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(2),
                 B(Mov), R(3), R(1),
   /*  122 S> */ B(Ldar), R(1),
@@ -347,8 +347,8 @@ bytecodes: [
                 B(PushContext), R(2),
                 B(LdaConstant), U8(6),
                 B(Star), R(4),
-                B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(5),
+                B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
+                B(StaCurrentContextSlot), U8(3),
   /*   80 E> */ B(CreateClosure), U8(7), U8(2), U8(2),
                 B(Star), R(3),
                 B(LdaConstant), U8(5),
@@ -364,7 +364,7 @@ bytecodes: [
                 B(Ldar), R(5),
                 B(StaNamedProperty), R(7), U8(9), U8(0),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(6), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(2),
                 B(Mov), R(3), R(1),
   /*  126 S> */ B(Ldar), R(1),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFields.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFields.golden
index 62603a93f84c90..90ae0a6688127d 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFields.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFields.golden
@@ -34,7 +34,7 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star), R(4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaTheHole),
                 B(Star), R(6),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -56,7 +56,7 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star), R(4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaTheHole),
                 B(Star), R(6),
                 B(CreateClosure), U8(8), U8(2), U8(2),
@@ -140,7 +140,7 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star), R(5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(5), U8(1),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaTheHole),
                 B(Star), R(11),
                 B(CreateClosure), U8(4), U8(0), U8(2),
@@ -170,13 +170,13 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star), R(5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(5), U8(1),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaConstant), U8(10),
                 B(Star), R(5),
                 B(LdaConstant), U8(10),
                 B(Star), R(5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(5), U8(1),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
                 B(LdaTheHole),
                 B(Star), R(11),
                 B(CreateClosure), U8(12), U8(3), U8(2),
@@ -210,7 +210,7 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star), R(5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(5), U8(1),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
   /*  356 E> */ B(CreateClosure), U8(19), U8(8), U8(2),
                 B(Star), R(4),
                 B(LdaConstant), U8(18),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateMethodAccess.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateMethodAccess.golden
index d41b3421879890..0d03fe72a985fb 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateMethodAccess.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateMethodAccess.golden
@@ -17,20 +17,21 @@ snippet: "
   var test = A;
   new A;
 "
-frame size: 3
+frame size: 4
 parameter count: 1
-bytecode array length: 28
+bytecode array length: 31
 bytecodes: [
   /*   44 E> */ B(StackCheck),
-                B(LdaCurrentContextSlot), U8(5),
+                B(LdaCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
-                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(2),
-  /*   49 S> */ B(LdaCurrentContextSlot), U8(5),
+                B(Mov), R(context), R(2),
+                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
+  /*   49 S> */ B(LdaCurrentContextSlot), U8(3),
   /*   61 E> */ B(LdaKeyedProperty), R(this), U8(0),
-                B(LdaCurrentContextSlot), U8(4),
-                B(Star), R(2),
-  /*   63 E> */ B(CallAnyReceiver), R(2), R(this), U8(1), U8(2),
+                B(LdaCurrentContextSlot), U8(2),
+                B(Star), R(3),
+  /*   63 E> */ B(CallAnyReceiver), R(3), R(this), U8(1), U8(2),
   /*   66 S> */ B(Return),
 ]
 constant pool: [
@@ -48,20 +49,21 @@ snippet: "
   var test = B;
   new test;
 "
-frame size: 4
+frame size: 5
 parameter count: 1
-bytecode array length: 29
+bytecode array length: 32
 bytecodes: [
   /*   44 E> */ B(StackCheck),
-                B(LdaCurrentContextSlot), U8(5),
+                B(LdaCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
-                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(2),
-  /*   49 S> */ B(Wide), B(LdaSmi), I16(261),
-                B(Star), R(2),
-                B(LdaConstant), U8(0),
+                B(Mov), R(context), R(2),
+                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
+  /*   49 S> */ B(Wide), B(LdaSmi), I16(263),
                 B(Star), R(3),
-  /*   57 E> */ B(CallRuntime), U16(Runtime::kNewTypeError), R(2), U8(2),
+                B(LdaConstant), U8(0),
+                B(Star), R(4),
+  /*   57 E> */ B(CallRuntime), U16(Runtime::kNewTypeError), R(3), U8(2),
                 B(Throw),
 ]
 constant pool: [
@@ -80,20 +82,21 @@ snippet: "
   var test = C;
   new test;
 "
-frame size: 4
+frame size: 5
 parameter count: 1
-bytecode array length: 29
+bytecode array length: 32
 bytecodes: [
   /*   44 E> */ B(StackCheck),
-                B(LdaCurrentContextSlot), U8(5),
+                B(LdaCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
-                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(2),
-  /*   49 S> */ B(Wide), B(LdaSmi), I16(261),
-                B(Star), R(2),
-                B(LdaConstant), U8(0),
+                B(Mov), R(context), R(2),
+                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
+  /*   49 S> */ B(Wide), B(LdaSmi), I16(263),
                 B(Star), R(3),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(2), U8(2),
+                B(LdaConstant), U8(0),
+                B(Star), R(4),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(3), U8(2),
                 B(Throw),
 ]
 constant pool: [
@@ -102,3 +105,45 @@ constant pool: [
 handlers: [
 ]
 
+---
+snippet: "
+  class D {
+    #d() { return 1; }
+    constructor() { (() => this)().#d(); }
+  }
+
+  var test = D;
+  new test;
+"
+frame size: 6
+parameter count: 1
+bytecode array length: 58
+bytecodes: [
+  /*   44 E> */ B(StackCheck),
+                B(CreateFunctionContext), U8(0), U8(1),
+                B(PushContext), R(0),
+                B(Ldar), R(this),
+                B(StaCurrentContextSlot), U8(2),
+                B(LdaContextSlot), R(0), U8(3), U8(0),
+                B(Star), R(2),
+                B(Mov), R(this), R(1),
+                B(Mov), R(0), R(3),
+                B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(1), U8(3),
+  /*   49 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
+                B(Star), R(5),
+  /*   61 E> */ B(CallUndefinedReceiver0), R(5), U8(0),
+                B(Star), R(5),
+                B(LdaContextSlot), R(0), U8(3), U8(0),
+  /*   63 E> */ B(LdaKeyedProperty), R(5), U8(2),
+                B(LdaContextSlot), R(0), U8(2), U8(0),
+                B(Star), R(4),
+  /*   66 E> */ B(CallAnyReceiver), R(4), R(5), U8(1), U8(4),
+                B(LdaUndefined),
+  /*   70 S> */ B(Return),
+]
+constant pool: [
+  SCOPE_INFO_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+]
+handlers: [
+]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateMethodDeclaration.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateMethodDeclaration.golden
index 6456245741fa69..ef7c245d463399 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateMethodDeclaration.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateMethodDeclaration.golden
@@ -23,8 +23,8 @@ bytecodes: [
                 B(PushContext), R(1),
                 B(LdaConstant), U8(2),
                 B(Star), R(3),
-                B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(3), U8(1),
-                B(StaCurrentContextSlot), U8(5),
+                B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(3), U8(1),
+                B(StaCurrentContextSlot), U8(3),
                 B(LdaTheHole),
                 B(Star), R(6),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -35,7 +35,7 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(3),
                 B(Star), R(4),
                 B(CreateClosure), U8(4), U8(1), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(5), R(0),
                 B(LdaUndefined),
@@ -71,8 +71,8 @@ bytecodes: [
                 B(PushContext), R(2),
                 B(LdaConstant), U8(2),
                 B(Star), R(4),
-                B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(5),
+                B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
+                B(StaCurrentContextSlot), U8(3),
                 B(LdaTheHole),
                 B(Star), R(7),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -83,15 +83,15 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kDefineClass), R(5), U8(3),
                 B(Star), R(5),
                 B(CreateClosure), U8(4), U8(1), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(2),
                 B(Mov), R(6), R(0),
   /*   38 E> */ B(CreateBlockContext), U8(5),
                 B(PushContext), R(2),
                 B(LdaConstant), U8(7),
                 B(Star), R(4),
-                B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(5),
+                B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
+                B(StaCurrentContextSlot), U8(3),
   /*   93 E> */ B(CreateClosure), U8(8), U8(2), U8(2),
                 B(Star), R(3),
                 B(LdaConstant), U8(6),
@@ -101,7 +101,7 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kDefineClass), R(5), U8(3),
                 B(Star), R(5),
                 B(CreateClosure), U8(9), U8(3), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(2),
                 B(Mov), R(6), R(1),
                 B(LdaUndefined),
@@ -155,8 +155,8 @@ bytecodes: [
                 B(PushContext), R(2),
                 B(LdaConstant), U8(6),
                 B(Star), R(4),
-                B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(5),
+                B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
+                B(StaCurrentContextSlot), U8(3),
   /*   77 E> */ B(CreateClosure), U8(7), U8(2), U8(2),
                 B(Star), R(3),
                 B(LdaConstant), U8(5),
@@ -166,7 +166,7 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kDefineClass), R(5), U8(3),
                 B(Star), R(5),
                 B(CreateClosure), U8(8), U8(3), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(Star), R(6),
                 B(Ldar), R(5),
                 B(StaNamedProperty), R(6), U8(9), U8(0),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PublicClassFields.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PublicClassFields.golden
index 4b893861bf09cc..ab5fcf5c4c3c46 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/PublicClassFields.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PublicClassFields.golden
@@ -29,7 +29,7 @@ bytecodes: [
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaTheHole),
                 B(Star), R(6),
                 B(CreateClosure), U8(2), U8(0), U8(2),
@@ -37,7 +37,7 @@ bytecodes: [
                 B(LdaConstant), U8(1),
                 B(Star), R(4),
   /*   60 S> */ B(LdaConstant), U8(3),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(Star), R(7),
                 B(Mov), R(3), R(5),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(4),
@@ -50,7 +50,7 @@ bytecodes: [
   /*   38 E> */ B(CreateBlockContext), U8(6),
                 B(PushContext), R(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaTheHole),
                 B(Star), R(6),
                 B(CreateClosure), U8(8), U8(2), U8(2),
@@ -58,7 +58,7 @@ bytecodes: [
                 B(LdaConstant), U8(7),
                 B(Star), R(4),
   /*   99 S> */ B(LdaConstant), U8(3),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(Star), R(7),
                 B(Mov), R(3), R(5),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(4),
@@ -128,7 +128,7 @@ bytecodes: [
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaTheHole),
                 B(Star), R(11),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -143,7 +143,7 @@ bytecodes: [
                 B(LdaConstant), U8(1),
                 B(Star), R(5),
   /*   77 S> */ B(LdaConstant), U8(5),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(Star), R(8),
                 B(Mov), R(4), R(6),
                 B(Mov), R(10), R(7),
@@ -157,7 +157,7 @@ bytecodes: [
   /*   38 E> */ B(CreateBlockContext), U8(8),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaTheHole),
                 B(Star), R(11),
                 B(CreateClosure), U8(11), U8(3), U8(2),
@@ -172,7 +172,7 @@ bytecodes: [
                 B(LdaConstant), U8(9),
                 B(Star), R(5),
   /*  133 S> */ B(LdaConstant), U8(5),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(Star), R(8),
                 B(CreateClosure), U8(13), U8(5), U8(2),
                 B(Star), R(9),
@@ -188,13 +188,13 @@ bytecodes: [
   /*   90 E> */ B(CreateBlockContext), U8(15),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
   /*  236 E> */ B(CreateClosure), U8(17), U8(7), U8(2),
                 B(Star), R(4),
                 B(LdaConstant), U8(16),
                 B(Star), R(5),
   /*  256 S> */ B(LdaConstant), U8(5),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(Star), R(8),
                 B(Mov), R(4), R(6),
                 B(Mov), R(1), R(7),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/StandardForLoop.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/StandardForLoop.golden
index 1a4ad60629aa6e..82a43ae36c6afe 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/StandardForLoop.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/StandardForLoop.golden
@@ -48,22 +48,22 @@ frame size: 15
 parameter count: 1
 bytecode array length: 165
 bytecodes: [
-                B(CreateFunctionContext), U8(0), U8(3),
+  /*   10 E> */ B(StackCheck),
+                B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(4),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(6),
-                B(Ldar), R(3),
                 B(StaCurrentContextSlot), U8(5),
-  /*   10 E> */ B(StackCheck),
+                B(Ldar), R(3),
+                B(StaCurrentContextSlot), U8(4),
                 B(CreateBlockContext), U8(1),
                 B(PushContext), R(5),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
   /*   30 S> */ B(LdaZero),
-  /*   30 E> */ B(StaCurrentContextSlot), U8(4),
-                B(LdaCurrentContextSlot), U8(4),
+  /*   30 E> */ B(StaCurrentContextSlot), U8(2),
+                B(LdaCurrentContextSlot), U8(2),
                 B(Star), R(0),
                 B(LdaSmi), I8(1),
                 B(Star), R(1),
@@ -71,21 +71,21 @@ bytecodes: [
                 B(CreateBlockContext), U8(2),
                 B(PushContext), R(6),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(Ldar), R(0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaSmi), I8(1),
                 B(TestEqual), R(1), U8(0),
                 B(JumpIfFalse), U8(7),
                 B(LdaZero),
                 B(Star), R(1),
                 B(Jump), U8(8),
-  /*   43 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*   43 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(Inc), U8(1),
-  /*   43 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   43 E> */ B(StaCurrentContextSlot), U8(2),
                 B(LdaSmi), I8(1),
                 B(Star), R(2),
-  /*   35 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*   35 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(Star), R(7),
                 B(LdaSmi), I8(10),
   /*   35 E> */ B(TestLessThan), R(7), U8(2),
@@ -115,7 +115,7 @@ bytecodes: [
   /*   48 E> */ B(CallUndefinedReceiver1), R(7), R(8), U8(6),
                 B(LdaZero),
                 B(Star), R(2),
-                B(LdaCurrentContextSlot), U8(4),
+                B(LdaCurrentContextSlot), U8(2),
                 B(Star), R(0),
                 B(JumpLoop), U8(56), I8(1),
                 B(LdaSmi), I8(1),
@@ -160,21 +160,21 @@ bytecodes: [
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(4),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(Ldar), R(0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaSmi), I8(1),
                 B(TestEqual), R(1), U8(0),
                 B(JumpIfFalse), U8(7),
                 B(LdaZero),
                 B(Star), R(1),
                 B(Jump), U8(8),
-  /*   43 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*   43 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(Inc), U8(1),
-  /*   43 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   43 E> */ B(StaCurrentContextSlot), U8(2),
                 B(LdaSmi), I8(1),
                 B(Star), R(2),
-  /*   35 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*   35 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(Star), R(5),
                 B(LdaSmi), I8(10),
   /*   35 E> */ B(TestLessThan), R(5), U8(2),
@@ -191,7 +191,7 @@ bytecodes: [
   /*   74 E> */ B(CallUndefinedReceiver0), R(5), U8(4),
                 B(LdaZero),
                 B(Star), R(2),
-                B(LdaCurrentContextSlot), U8(4),
+                B(LdaCurrentContextSlot), U8(2),
                 B(Star), R(0),
                 B(JumpLoop), U8(24), I8(1),
                 B(LdaSmi), I8(1),
@@ -262,12 +262,12 @@ frame size: 5
 parameter count: 1
 bytecode array length: 67
 bytecodes: [
+  /*   11 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(Mov), R(closure), R(3),
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
-  /*   11 E> */ B(StackCheck),
   /*   11 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(3),
                 B(Star), R(3),
@@ -292,7 +292,7 @@ bytecodes: [
   /*   62 S> */ B(Return),
 ]
 constant pool: [
-  Smi [22],
+  Smi [21],
   Smi [10],
   Smi [7],
 ]
@@ -310,12 +310,12 @@ frame size: 4
 parameter count: 1
 bytecode array length: 99
 bytecodes: [
+  /*   11 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(2),
                 B(Mov), R(this), R(3),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(2), U8(2),
                 B(Star), R(0),
-  /*   11 E> */ B(StackCheck),
   /*   11 E> */ B(SuspendGenerator), R(0), R(0), U8(2), U8(0),
                 B(ResumeGenerator), R(0), R(0), U8(2),
                 B(Star), R(2),
@@ -352,8 +352,8 @@ bytecodes: [
   /*   56 S> */ B(Return),
 ]
 constant pool: [
-  Smi [22],
-  Smi [68],
+  Smi [21],
+  Smi [67],
   Smi [10],
   Smi [7],
   Smi [10],
@@ -373,11 +373,11 @@ frame size: 8
 parameter count: 1
 bytecode array length: 81
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(Mov), R(closure), R(3),
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionEnter), R(3), U8(2),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
                 B(Mov), R(context), R(3),
   /*   36 S> */ B(LdaZero),
                 B(Star), R(1),
@@ -404,7 +404,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(3),
                 B(PushContext), R(4),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(6),
                 B(LdaFalse),
                 B(Star), R(7),
@@ -430,12 +430,12 @@ frame size: 7
 parameter count: 1
 bytecode array length: 117
 bytecodes: [
+  /*   16 E> */ B(StackCheck),
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(Mov), R(closure), R(2),
                 B(Mov), R(this), R(3),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionEnter), R(2), U8(2),
                 B(Star), R(0),
-  /*   16 E> */ B(StackCheck),
                 B(Mov), R(context), R(2),
   /*   36 S> */ B(LdaZero),
                 B(Star), R(1),
@@ -474,7 +474,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(2),
                 B(PushContext), R(3),
-                B(LdaImmutableCurrentContextSlot), U8(4),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(5),
                 B(LdaTrue),
                 B(Star), R(6),
@@ -483,7 +483,7 @@ bytecodes: [
   /*   61 S> */ B(Return),
 ]
 constant pool: [
-  Smi [46],
+  Smi [45],
   SCOPE_INFO_TYPE,
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticClassFields.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticClassFields.golden
index f47a70135848ca..e456906b2b759f 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticClassFields.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticClassFields.golden
@@ -33,9 +33,9 @@ bytecodes: [
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
                 B(LdaTheHole),
                 B(Star), R(6),
                 B(CreateClosure), U8(2), U8(0), U8(2),
@@ -43,7 +43,7 @@ bytecodes: [
                 B(LdaConstant), U8(1),
                 B(Star), R(4),
   /*   60 S> */ B(LdaConstant), U8(3),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(Star), R(7),
   /*   92 S> */ B(LdaConstant), U8(4),
                 B(Star), R(8),
@@ -53,7 +53,7 @@ bytecodes: [
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
                 B(Ldar), R(8),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(5),
                 B(Star), R(4),
                 B(CreateClosure), U8(6), U8(1), U8(2),
@@ -67,9 +67,9 @@ bytecodes: [
   /*   38 E> */ B(CreateBlockContext), U8(9),
                 B(PushContext), R(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
                 B(LdaTheHole),
                 B(Star), R(6),
                 B(CreateClosure), U8(11), U8(3), U8(2),
@@ -77,7 +77,7 @@ bytecodes: [
                 B(LdaConstant), U8(10),
                 B(Star), R(4),
   /*  131 S> */ B(LdaConstant), U8(3),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(Star), R(7),
   /*  176 S> */ B(LdaConstant), U8(4),
                 B(Star), R(8),
@@ -87,7 +87,7 @@ bytecodes: [
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
                 B(Ldar), R(8),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(5),
                 B(Star), R(4),
                 B(CreateClosure), U8(12), U8(4), U8(2),
@@ -168,9 +168,9 @@ bytecodes: [
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
                 B(LdaTheHole),
                 B(Star), R(11),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -185,7 +185,7 @@ bytecodes: [
                 B(LdaConstant), U8(1),
                 B(Star), R(5),
   /*   77 S> */ B(LdaConstant), U8(5),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(Star), R(8),
   /*  109 S> */ B(LdaConstant), U8(6),
                 B(Star), R(9),
@@ -196,7 +196,7 @@ bytecodes: [
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
                 B(Ldar), R(9),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(5), U8(5),
                 B(Star), R(5),
                 B(CreateClosure), U8(8), U8(2), U8(2),
@@ -210,9 +210,9 @@ bytecodes: [
   /*   38 E> */ B(CreateBlockContext), U8(11),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
                 B(LdaTheHole),
                 B(Star), R(11),
                 B(CreateClosure), U8(14), U8(4), U8(2),
@@ -227,7 +227,7 @@ bytecodes: [
                 B(LdaConstant), U8(12),
                 B(Star), R(5),
   /*  165 S> */ B(LdaConstant), U8(5),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(Star), R(8),
   /*  210 S> */ B(LdaConstant), U8(6),
                 B(Star), R(9),
@@ -238,7 +238,7 @@ bytecodes: [
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
                 B(Ldar), R(9),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
                 B(CreateClosure), U8(16), U8(6), U8(2),
                 B(Star), R(10),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(5), U8(6),
@@ -254,15 +254,15 @@ bytecodes: [
   /*  122 E> */ B(CreateBlockContext), U8(19),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
   /*  313 E> */ B(CreateClosure), U8(21), U8(9), U8(2),
                 B(Star), R(4),
                 B(LdaConstant), U8(20),
                 B(Star), R(5),
   /*  333 S> */ B(LdaConstant), U8(5),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(Star), R(8),
   /*  378 S> */ B(LdaConstant), U8(6),
                 B(Star), R(9),
@@ -273,7 +273,7 @@ bytecodes: [
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
                 B(Ldar), R(9),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(5), U8(5),
                 B(Star), R(5),
                 B(CreateClosure), U8(22), U8(10), U8(2),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticPrivateMethodAccess.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticPrivateMethodAccess.golden
index 888fca1cf88d52..70628162df9a40 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticPrivateMethodAccess.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticPrivateMethodAccess.golden
@@ -22,17 +22,17 @@ parameter count: 1
 bytecode array length: 36
 bytecodes: [
   /*   51 E> */ B(StackCheck),
-  /*   56 S> */ B(LdaCurrentContextSlot), U8(5),
+  /*   56 S> */ B(LdaCurrentContextSlot), U8(3),
                 B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(1),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(259),
+                B(Wide), B(LdaSmi), I16(261),
                 B(Star), R(2),
                 B(LdaConstant), U8(0),
                 B(Star), R(3),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(2), U8(2),
                 B(Throw),
-                B(LdaCurrentContextSlot), U8(4),
+                B(LdaCurrentContextSlot), U8(2),
                 B(Star), R(0),
   /*   70 E> */ B(CallAnyReceiver), R(0), R(1), U8(1), U8(0),
   /*   73 S> */ B(Return),
@@ -58,7 +58,7 @@ parameter count: 1
 bytecode array length: 17
 bytecodes: [
   /*   51 E> */ B(StackCheck),
-  /*   56 S> */ B(Wide), B(LdaSmi), I16(261),
+  /*   56 S> */ B(Wide), B(LdaSmi), I16(263),
                 B(Star), R(0),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
@@ -86,7 +86,7 @@ parameter count: 1
 bytecode array length: 17
 bytecodes: [
   /*   51 E> */ B(StackCheck),
-  /*   56 S> */ B(Wide), B(LdaSmi), I16(261),
+  /*   56 S> */ B(Wide), B(LdaSmi), I16(263),
                 B(Star), R(0),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
@@ -120,13 +120,13 @@ parameter count: 1
 bytecode array length: 143
 bytecodes: [
   /*   81 E> */ B(StackCheck),
-  /*   90 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*   90 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(Star), R(1),
-                B(LdaCurrentContextSlot), U8(5),
+                B(LdaCurrentContextSlot), U8(3),
   /*   94 E> */ B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(0),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(259),
+                B(Wide), B(LdaSmi), I16(261),
                 B(Star), R(2),
                 B(LdaConstant), U8(0),
                 B(Star), R(3),
@@ -142,13 +142,13 @@ bytecodes: [
                 B(CallProperty1), R(3), R(0), R(2), U8(3),
   /*  105 S> */ B(LdaSmi), I8(1),
                 B(Star), R(0),
-                B(LdaCurrentContextSlot), U8(4),
+                B(LdaCurrentContextSlot), U8(2),
                 B(Star), R(2),
-                B(LdaCurrentContextSlot), U8(5),
+                B(LdaCurrentContextSlot), U8(3),
   /*  109 E> */ B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(1),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(260),
+                B(Wide), B(LdaSmi), I16(262),
                 B(Star), R(3),
                 B(LdaConstant), U8(0),
                 B(Star), R(4),
@@ -157,13 +157,13 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kLoadPrivateSetter), R(2), U8(1),
                 B(Star), R(3),
                 B(CallProperty1), R(3), R(1), R(0), U8(5),
-  /*  122 S> */ B(LdaCurrentContextSlot), U8(4),
+  /*  122 S> */ B(LdaCurrentContextSlot), U8(2),
                 B(Star), R(1),
-                B(LdaCurrentContextSlot), U8(5),
+                B(LdaCurrentContextSlot), U8(3),
   /*  133 E> */ B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(0),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(259),
+                B(Wide), B(LdaSmi), I16(261),
                 B(Star), R(2),
                 B(LdaConstant), U8(0),
                 B(Star), R(3),
@@ -194,7 +194,7 @@ parameter count: 1
 bytecode array length: 17
 bytecodes: [
   /*   55 E> */ B(StackCheck),
-  /*   60 S> */ B(Wide), B(LdaSmi), I16(263),
+  /*   60 S> */ B(Wide), B(LdaSmi), I16(265),
                 B(Star), R(0),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
@@ -221,7 +221,7 @@ parameter count: 1
 bytecode array length: 17
 bytecodes: [
   /*   48 E> */ B(StackCheck),
-  /*   53 S> */ B(Wide), B(LdaSmi), I16(262),
+  /*   53 S> */ B(Wide), B(LdaSmi), I16(264),
                 B(Star), R(0),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
@@ -248,7 +248,7 @@ parameter count: 1
 bytecode array length: 17
 bytecodes: [
   /*   55 E> */ B(StackCheck),
-  /*   60 S> */ B(Wide), B(LdaSmi), I16(263),
+  /*   60 S> */ B(Wide), B(LdaSmi), I16(265),
                 B(Star), R(0),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
@@ -275,7 +275,7 @@ parameter count: 1
 bytecode array length: 17
 bytecodes: [
   /*   41 E> */ B(StackCheck),
-  /*   46 S> */ B(Wide), B(LdaSmi), I16(262),
+  /*   46 S> */ B(Wide), B(LdaSmi), I16(264),
                 B(Star), R(1),
                 B(LdaConstant), U8(0),
                 B(Star), R(2),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticPrivateMethodDeclaration.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticPrivateMethodDeclaration.golden
index fda73f08d2c66f..b074e54243cdaa 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticPrivateMethodDeclaration.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticPrivateMethodDeclaration.golden
@@ -31,7 +31,7 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kDefineClass), R(3), U8(3),
                 B(Star), R(3),
                 B(CreateClosure), U8(3), U8(1), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(4), R(0),
                 B(LdaUndefined),
@@ -75,7 +75,7 @@ bytecodes: [
                 B(LdaNull),
                 B(Star), R(5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(4), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(2), R(0),
                 B(LdaUndefined),
@@ -119,7 +119,7 @@ bytecodes: [
                 B(CreateClosure), U8(3), U8(1), U8(2),
                 B(Star), R(5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(4), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(2), R(0),
                 B(LdaUndefined),
@@ -164,7 +164,7 @@ bytecodes: [
                 B(CreateClosure), U8(4), U8(2), U8(2),
                 B(Star), R(5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(4), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(2), R(0),
                 B(LdaUndefined),
@@ -198,8 +198,8 @@ bytecodes: [
                 B(PushContext), R(1),
                 B(LdaConstant), U8(2),
                 B(Star), R(3),
-                B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(3), U8(1),
-                B(StaCurrentContextSlot), U8(6),
+                B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(3), U8(1),
+                B(StaCurrentContextSlot), U8(4),
                 B(LdaTheHole),
                 B(Star), R(6),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -210,9 +210,9 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(3),
                 B(Star), R(4),
                 B(CreateClosure), U8(4), U8(1), U8(2),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlot), U8(2),
                 B(CreateClosure), U8(5), U8(2), U8(2),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlot), U8(3),
                 B(PopContext), R(1),
                 B(Mov), R(5), R(0),
                 B(LdaUndefined),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/StringConcat.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/StringConcat.golden
index 7279eb9f68f22a..3fa52040a87978 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/StringConcat.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/StringConcat.golden
@@ -172,9 +172,9 @@ frame size: 4
 parameter count: 1
 bytecode array length: 42
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateClosure), U8(0), U8(0), U8(2),
                 B(Star), R(2),
-  /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
                 B(Star), R(0),
   /*   53 S> */ B(LdaSmi), I8(2),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/SuperCallAndSpread.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/SuperCallAndSpread.golden
index 2ec0a8baa5e757..2fd27fcce1b2f4 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/SuperCallAndSpread.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/SuperCallAndSpread.golden
@@ -21,10 +21,10 @@ frame size: 5
 parameter count: 1
 bytecode array length: 19
 bytecodes: [
+  /*   93 E> */ B(StackCheck),
                 B(CreateRestParameter),
                 B(Star), R(2),
                 B(Mov), R(closure), R(1),
-  /*   93 E> */ B(StackCheck),
   /*   93 S> */ B(Ldar), R(1),
                 B(GetSuperConstructor), R(4),
                 B(Ldar), R(0),
@@ -53,10 +53,10 @@ frame size: 9
 parameter count: 1
 bytecode array length: 40
 bytecodes: [
+  /*  128 E> */ B(StackCheck),
                 B(CreateRestParameter),
                 B(Star), R(3),
                 B(Mov), R(closure), R(1),
-  /*  128 E> */ B(StackCheck),
                 B(Mov), R(3), R(2),
   /*  140 S> */ B(Ldar), R(closure),
                 B(GetSuperConstructor), R(5),
@@ -93,12 +93,12 @@ snippet: "
 "
 frame size: 11
 parameter count: 1
-bytecode array length: 112
+bytecode array length: 119
 bytecodes: [
+  /*  128 E> */ B(StackCheck),
                 B(CreateRestParameter),
                 B(Star), R(3),
                 B(Mov), R(closure), R(1),
-  /*  128 E> */ B(StackCheck),
                 B(Mov), R(3), R(2),
   /*  140 S> */ B(Ldar), R(closure),
                 B(GetSuperConstructor), R(5),
@@ -112,10 +112,12 @@ bytecodes: [
                 B(Inc), U8(3),
   /*  152 S> */ B(Star), R(6),
                 B(GetIterator), R(3), U8(4), U8(6),
+                B(Mov), R(1), R(4),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(9),
                 B(LdaNamedProperty), R(9), U8(0), U8(8),
                 B(Star), R(8),
-                B(Mov), R(1), R(4),
                 B(CallProperty0), R(8), R(9), U8(14),
                 B(Star), R(10),
                 B(JumpIfJSReceiver), U8(7),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/TemplateLiterals.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/TemplateLiterals.golden
index e78c81cfe24d7b..c85f155947d374 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/TemplateLiterals.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/TemplateLiterals.golden
@@ -191,9 +191,9 @@ frame size: 4
 parameter count: 1
 bytecode array length: 45
 bytecodes: [
+  /*   30 E> */ B(StackCheck),
                 B(CreateClosure), U8(0), U8(0), U8(2),
                 B(Star), R(2),
-  /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
                 B(Star), R(0),
   /*   53 S> */ B(LdaSmi), I8(2),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ThisFunction.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ThisFunction.golden
index 3e7bb57f0550b5..6c65fda8724928 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ThisFunction.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ThisFunction.golden
@@ -35,8 +35,8 @@ frame size: 1
 parameter count: 1
 bytecode array length: 7
 bytecodes: [
-                B(Mov), R(closure), R(0),
   /*   21 E> */ B(StackCheck),
+                B(Mov), R(closure), R(0),
   /*   26 S> */ B(Ldar), R(0),
   /*   35 S> */ B(Return),
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/TopLevelObjectLiterals.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/TopLevelObjectLiterals.golden
index 30d304e0a2da04..c3e04111aad765 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/TopLevelObjectLiterals.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/TopLevelObjectLiterals.golden
@@ -10,23 +10,21 @@ top level: yes
 snippet: "
   var a = { func: function() { } };
 "
-frame size: 4
+frame size: 3
 parameter count: 1
-bytecode array length: 37
+bytecode array length: 34
 bytecodes: [
+  /*    0 E> */ B(StackCheck),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
-                B(LdaZero),
-                B(Star), R(2),
-                B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(1), U8(3),
-  /*    0 E> */ B(StackCheck),
-  /*    8 S> */ B(CreateObjectLiteral), U8(1), U8(2), U8(41),
+                B(Mov), R(closure), R(2),
+                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(1), U8(2),
+  /*    8 S> */ B(CreateObjectLiteral), U8(1), U8(0), U8(41),
                 B(Star), R(1),
   /*   16 E> */ B(CreateClosure), U8(2), U8(0), U8(0),
-                B(StaNamedOwnProperty), R(1), U8(3), U8(3),
+                B(StaNamedOwnProperty), R(1), U8(3), U8(1),
                 B(Ldar), R(1),
-  /*    8 E> */ B(StaGlobal), U8(4), U8(5),
+  /*    8 E> */ B(StaGlobal), U8(4), U8(3),
                 B(LdaUndefined),
   /*   34 S> */ B(Return),
 ]
diff --git a/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc b/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc
index be0b129418707b..b883753dc5aeb7 100644
--- a/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc
+++ b/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc
@@ -59,14 +59,13 @@ namespace interpreter {
 #define REPEAT_64_UNIQUE_VARS() REPEAT_32_UNIQUE_VARS() REPEAT_32_UNIQUE_VARS()
 #define REPEAT_128_UNIQUE_VARS() REPEAT_64_UNIQUE_VARS() REPEAT_64_UNIQUE_VARS()
 
-#define REPEAT_250_UNIQUE_VARS() \
+#define REPEAT_252_UNIQUE_VARS() \
   REPEAT_128_UNIQUE_VARS()       \
   REPEAT_64_UNIQUE_VARS()        \
   REPEAT_32_UNIQUE_VARS()        \
   REPEAT_16_UNIQUE_VARS()        \
   REPEAT_8_UNIQUE_VARS()         \
-  UNIQUE_VAR()                   \
-  UNIQUE_VAR()
+  REPEAT_4_UNIQUE_VARS()
 
 #define REPEAT_2_LOAD_UNIQUE_PROPERTY() \
   LOAD_UNIQUE_PROPERTY() LOAD_UNIQUE_PROPERTY()
@@ -1736,10 +1735,10 @@ TEST(CallNew) {
 }
 
 TEST(ContextVariables) {
-  // The wide check below relies on MIN_CONTEXT_SLOTS + 3 + 249 == 256, if this
+  // The wide check below relies on MIN_CONTEXT_SLOTS + 3 + 250 == 256, if this
   // ever changes, the REPEAT_XXX should be changed to output the correct number
   // of unique variables to trigger the wide slot load / store.
-  STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS + 3 + 249 == 256);
+  STATIC_ASSERT(Context::MIN_CONTEXT_EXTENDED_SLOTS + 3 + 250 == 256);
 
   InitializedIgnitionHandleScope scope;
   BytecodeExpectationsPrinter printer(CcTest::isolate());
@@ -1757,7 +1756,7 @@ TEST(ContextVariables) {
     "{ let b = 2; return function() { a + b; }; }\n",
 
     "'use strict';\n"
-    REPEAT_250_UNIQUE_VARS()
+    REPEAT_252_UNIQUE_VARS()
     "eval();\n"
     "var b = 100;\n"
     "return b\n",
@@ -2822,6 +2821,14 @@ TEST(PrivateMethodAccess) {
       "}\n"
       "\n"
       "var test = C;\n"
+      "new test;\n",
+
+      "class D {\n"
+      "  #d() { return 1; }\n"
+      "  constructor() { (() => this)().#d(); }\n"
+      "}\n"
+      "\n"
+      "var test = D;\n"
       "new test;\n"};
 
   CHECK(CompareTexts(BuildActual(printer, snippets),
@@ -3548,7 +3555,7 @@ TEST(TemplateLiterals) {
 #undef REPEAT_32_UNIQUE_VARS
 #undef REPEAT_64_UNIQUE_VARS
 #undef REPEAT_128_UNIQUE_VARS
-#undef REPEAT_250_UNIQUE_VARS
+#undef REPEAT_252_UNIQUE_VARS
 #undef LOAD_UNIQUE_PROPERTY
 #undef REPEAT_2_LOAD_UNIQUE_PROPERTY
 #undef REPEAT_4_LOAD_UNIQUE_PROPERTY
diff --git a/deps/v8/test/cctest/interpreter/test-interpreter.cc b/deps/v8/test/cctest/interpreter/test-interpreter.cc
index 0ddc8fe6087b13..8f687fdc8b3fd5 100644
--- a/deps/v8/test/cctest/interpreter/test-interpreter.cc
+++ b/deps/v8/test/cctest/interpreter/test-interpreter.cc
@@ -170,7 +170,7 @@ TEST(InterpreterLoadLiteral) {
 
     builder.LoadLiteral(-2.1e19).Return();
 
-    ast_factory.Internalize(isolate);
+    ast_factory.Internalize(isolate->factory());
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
     InterpreterTester tester(isolate, bytecode_array);
@@ -189,13 +189,14 @@ TEST(InterpreterLoadLiteral) {
     const AstRawString* raw_string = ast_factory.GetOneByteString("String");
     builder.LoadLiteral(raw_string).Return();
 
-    ast_factory.Internalize(isolate);
+    ast_factory.Internalize(isolate->factory());
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
     InterpreterTester tester(isolate, bytecode_array);
     auto callable = tester.GetCallable<>();
     Handle<Object> return_val = callable().ToHandleChecked();
-    CHECK(i::String::cast(*return_val).Equals(*raw_string->string()));
+    CHECK(i::String::cast(*return_val)
+              .Equals(*raw_string->string().get<Factory>()));
   }
 }
 
@@ -222,18 +223,15 @@ TEST(InterpreterLoadStoreRegisters) {
   }
 }
 
-
 static const Token::Value kShiftOperators[] = {
     Token::Value::SHL, Token::Value::SAR, Token::Value::SHR};
 
-
 static const Token::Value kArithmeticOperators[] = {
     Token::Value::BIT_OR, Token::Value::BIT_XOR, Token::Value::BIT_AND,
     Token::Value::SHL,    Token::Value::SAR,     Token::Value::SHR,
     Token::Value::ADD,    Token::Value::SUB,     Token::Value::MUL,
     Token::Value::DIV,    Token::Value::MOD};
 
-
 static double BinaryOpC(Token::Value op, double lhs, double rhs) {
   switch (op) {
     case Token::Value::ADD:
@@ -537,7 +535,7 @@ TEST(InterpreterStringAdd) {
     builder.LoadLiteral(test_cases[i].lhs).StoreAccumulatorInRegister(reg);
     LoadLiteralForTest(&builder, test_cases[i].rhs);
     builder.BinaryOperation(Token::Value::ADD, reg, GetIndex(slot)).Return();
-    ast_factory.Internalize(isolate);
+    ast_factory.Internalize(isolate->factory());
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
     InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -605,7 +603,7 @@ TEST(InterpreterParameter8) {
       .BinaryOperation(Token::Value::ADD, builder.Parameter(5), GetIndex(slot5))
       .BinaryOperation(Token::Value::ADD, builder.Parameter(6), GetIndex(slot6))
       .Return();
-  ast_factory.Internalize(isolate);
+  ast_factory.Internalize(isolate->factory());
   Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
   InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -745,7 +743,7 @@ TEST(InterpreterBinaryOpTypeFeedback) {
     LoadLiteralForTest(&builder, test_case.arg2);
     builder.BinaryOperation(test_case.op, reg, GetIndex(slot0)).Return();
 
-    ast_factory.Internalize(isolate);
+    ast_factory.Internalize(isolate->factory());
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
     InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -851,7 +849,7 @@ TEST(InterpreterBinaryOpSmiTypeFeedback) {
         .BinaryOperation(test_case.op, reg, GetIndex(slot0))
         .Return();
 
-    ast_factory.Internalize(isolate);
+    ast_factory.Internalize(isolate->factory());
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
     InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -1032,7 +1030,9 @@ TEST(InterpreterLoadGlobal) {
   // Test loading a global.
   std::string source(
       "var global = 321;\n"
-      "function " + InterpreterTester::function_name() + "() {\n"
+      "function " +
+      InterpreterTester::function_name() +
+      "() {\n"
       "  return global;\n"
       "}");
   InterpreterTester tester(isolate, source.c_str());
@@ -1050,7 +1050,9 @@ TEST(InterpreterStoreGlobal) {
   // Test storing to a global.
   std::string source(
       "var global = 321;\n"
-      "function " + InterpreterTester::function_name() + "() {\n"
+      "function " +
+      InterpreterTester::function_name() +
+      "() {\n"
       "  global = 999;\n"
       "}");
   InterpreterTester tester(isolate, source.c_str());
@@ -1071,7 +1073,9 @@ TEST(InterpreterCallGlobal) {
   // Test calling a global function.
   std::string source(
       "function g_add(a, b) { return a + b; }\n"
-      "function " + InterpreterTester::function_name() + "() {\n"
+      "function " +
+      InterpreterTester::function_name() +
+      "() {\n"
       "  return g_add(5, 10);\n"
       "}");
   InterpreterTester tester(isolate, source.c_str());
@@ -1088,7 +1092,9 @@ TEST(InterpreterLoadUnallocated) {
   // Test loading an unallocated global.
   std::string source(
       "unallocated = 123;\n"
-      "function " + InterpreterTester::function_name() + "() {\n"
+      "function " +
+      InterpreterTester::function_name() +
+      "() {\n"
       "  return unallocated;\n"
       "}");
   InterpreterTester tester(isolate, source.c_str());
@@ -1106,7 +1112,9 @@ TEST(InterpreterStoreUnallocated) {
   // Test storing to an unallocated global.
   std::string source(
       "unallocated = 321;\n"
-      "function " + InterpreterTester::function_name() + "() {\n"
+      "function " +
+      InterpreterTester::function_name() +
+      "() {\n"
       "  unallocated = 999;\n"
       "}");
   InterpreterTester tester(isolate, source.c_str());
@@ -1138,7 +1146,7 @@ TEST(InterpreterLoadNamedProperty) {
   BytecodeArrayBuilder builder(zone, 1, 0, &feedback_spec);
 
   builder.LoadNamedProperty(builder.Receiver(), name, GetIndex(slot)).Return();
-  ast_factory.Internalize(isolate);
+  ast_factory.Internalize(isolate->factory());
   Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
   InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -1192,7 +1200,7 @@ TEST(InterpreterLoadKeyedProperty) {
   builder.LoadLiteral(key)
       .LoadKeyedProperty(builder.Receiver(), GetIndex(slot))
       .Return();
-  ast_factory.Internalize(isolate);
+  ast_factory.Internalize(isolate->factory());
   Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
   InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -1235,7 +1243,7 @@ TEST(InterpreterStoreNamedProperty) {
       .StoreNamedProperty(builder.Receiver(), name, GetIndex(slot),
                           LanguageMode::kStrict)
       .Return();
-  ast_factory.Internalize(isolate);
+  ast_factory.Internalize(isolate->factory());
   Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
   InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -1300,7 +1308,7 @@ TEST(InterpreterStoreKeyedProperty) {
       .StoreKeyedProperty(builder.Receiver(), Register(0), GetIndex(slot),
                           i::LanguageMode::kSloppy)
       .Return();
-  ast_factory.Internalize(isolate);
+  ast_factory.Internalize(isolate->factory());
   Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
   InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -1360,7 +1368,7 @@ TEST(InterpreterCall) {
     builder.CallProperty(reg, args, call_slot_index);
 
     builder.Return();
-    ast_factory.Internalize(isolate);
+    ast_factory.Internalize(isolate->factory());
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
     InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -1382,7 +1390,7 @@ TEST(InterpreterCall) {
         .MoveRegister(builder.Receiver(), args[0]);
     builder.CallProperty(reg, args, call_slot_index);
     builder.Return();
-    ast_factory.Internalize(isolate);
+    ast_factory.Internalize(isolate->factory());
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
     InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -1416,7 +1424,7 @@ TEST(InterpreterCall) {
 
     builder.Return();
 
-    ast_factory.Internalize(isolate);
+    ast_factory.Internalize(isolate->factory());
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
     InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -1465,7 +1473,7 @@ TEST(InterpreterCall) {
 
     builder.Return();
 
-    ast_factory.Internalize(isolate);
+    ast_factory.Internalize(isolate->factory());
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
     InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -1675,15 +1683,15 @@ TEST(InterpreterJumpConstantWith16BitOperand) {
   for (int i = 0; i < 6600; i++) {
     builder.LoadLiteral(Smi::zero());  // 1-byte
     builder.BinaryOperation(Token::Value::ADD, scratch,
-                            GetIndex(slot));              // 6-bytes
-    builder.StoreAccumulatorInRegister(scratch);          // 4-bytes
-    builder.MoveRegister(scratch, reg);                   // 6-bytes
+                            GetIndex(slot));      // 6-bytes
+    builder.StoreAccumulatorInRegister(scratch);  // 4-bytes
+    builder.MoveRegister(scratch, reg);           // 6-bytes
   }
   builder.Bind(&done);
   builder.LoadAccumulatorWithRegister(reg);
   builder.Return();
 
-  ast_factory.Internalize(isolate);
+  ast_factory.Internalize(isolate->factory());
   Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
   BytecodeArrayIterator iterator(bytecode_array);
 
@@ -1727,7 +1735,7 @@ TEST(InterpreterJumpWith32BitOperand) {
   builder.Bind(&done);
   builder.Return();
 
-  ast_factory.Internalize(isolate);
+  ast_factory.Internalize(isolate->factory());
   Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
   BytecodeArrayIterator iterator(bytecode_array);
@@ -1865,7 +1873,7 @@ TEST(InterpreterHeapNumberComparisons) {
             .CompareOperation(comparison, r0, GetIndex(slot))
             .Return();
 
-        ast_factory.Internalize(isolate);
+        ast_factory.Internalize(isolate->factory());
         Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
         InterpreterTester tester(isolate, bytecode_array, metadata);
         auto callable = tester.GetCallable<>();
@@ -1912,7 +1920,7 @@ TEST(InterpreterBigIntComparisons) {
             .CompareOperation(comparison, r0, GetIndex(slot))
             .Return();
 
-        ast_factory.Internalize(isolate);
+        ast_factory.Internalize(isolate->factory());
         Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
         InterpreterTester tester(isolate, bytecode_array, metadata);
         auto callable = tester.GetCallable<>();
@@ -1960,7 +1968,7 @@ TEST(InterpreterStringComparisons) {
             .CompareOperation(comparison, r0, GetIndex(slot))
             .Return();
 
-        ast_factory.Internalize(isolate);
+        ast_factory.Internalize(isolate->factory());
         Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
         InterpreterTester tester(isolate, bytecode_array, metadata);
         auto callable = tester.GetCallable<>();
@@ -2072,7 +2080,7 @@ TEST(InterpreterMixedComparisons) {
             builder.CompareOperation(comparison, lhs_reg, GetIndex(slot))
                 .Return();
 
-            ast_factory.Internalize(isolate);
+            ast_factory.Internalize(isolate->factory());
             Handle<BytecodeArray> bytecode_array =
                 builder.ToBytecodeArray(isolate);
             InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -2287,7 +2295,7 @@ TEST(InterpreterTestIn) {
         .CompareOperation(Token::Value::IN, r0, GetIndex(slot))
         .Return();
 
-    ast_factory.Internalize(isolate);
+    ast_factory.Internalize(isolate->factory());
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
     InterpreterTester tester(isolate, bytecode_array, metadata);
     auto callable = tester.GetCallable<>();
@@ -2345,7 +2353,7 @@ TEST(InterpreterUnaryNotNonBoolean) {
     Register r0(0);
     LoadLiteralForTest(&builder, object_type_tuples[i].first);
     builder.LogicalNot(ToBooleanMode::kConvertToBoolean).Return();
-    ast_factory.Internalize(isolate);
+    ast_factory.Internalize(isolate->factory());
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
     InterpreterTester tester(isolate, bytecode_array);
     auto callable = tester.GetCallable<>();
@@ -2431,15 +2439,16 @@ TEST(InterpreterFunctionLiteral) {
   Isolate* isolate = handles.main_isolate();
 
   // Test calling a function literal.
-  std::string source(
-      "function " + InterpreterTester::function_name() + "(a) {\n"
-      "  return (function(x){ return x + 2; })(a);\n"
-      "}");
+  std::string source("function " + InterpreterTester::function_name() +
+                     "(a) {\n"
+                     "  return (function(x){ return x + 2; })(a);\n"
+                     "}");
   InterpreterTester tester(isolate, source.c_str());
   auto callable = tester.GetCallable<Handle<Object>>();
 
-  Handle<i::Object> return_val = callable(
-      Handle<Smi>(Smi::FromInt(3), handles.main_isolate())).ToHandleChecked();
+  Handle<i::Object> return_val =
+      callable(Handle<Smi>(Smi::FromInt(3), handles.main_isolate()))
+          .ToHandleChecked();
   CHECK_EQ(Smi::cast(*return_val), Smi::FromInt(5));
 }
 
@@ -2449,8 +2458,7 @@ TEST(InterpreterRegExpLiterals) {
   Factory* factory = isolate->factory();
 
   std::pair<const char*, Handle<Object>> literals[] = {
-      std::make_pair("return /abd/.exec('cccabbdd');\n",
-                     factory->null_value()),
+      std::make_pair("return /abd/.exec('cccabbdd');\n", factory->null_value()),
       std::make_pair("return /ab+d/.exec('cccabbdd')[0];\n",
                      factory->NewStringFromStaticChars("abbd")),
       std::make_pair("return /AbC/i.exec('ssaBC')[0];\n",
@@ -2477,8 +2485,7 @@ TEST(InterpreterArrayLiterals) {
   Factory* factory = isolate->factory();
 
   std::pair<const char*, Handle<Object>> literals[] = {
-      std::make_pair("return [][0];\n",
-                     factory->undefined_value()),
+      std::make_pair("return [][0];\n", factory->undefined_value()),
       std::make_pair("return [1, 3, 2][1];\n",
                      handle(Smi::FromInt(3), isolate)),
       std::make_pair("return ['a', 'b', 'c'][2];\n",
@@ -2488,8 +2495,7 @@ TEST(InterpreterArrayLiterals) {
       std::make_pair("return [[1, 2, 3], ['a', 'b', 'c']][1][0];\n",
                      factory->NewStringFromStaticChars("a")),
       std::make_pair("var t = 't'; return [[t, t + 'est'], [1 + t]][0][1];\n",
-                     factory->NewStringFromStaticChars("test"))
-  };
+                     factory->NewStringFromStaticChars("test"))};
 
   for (size_t i = 0; i < arraysize(literals); i++) {
     std::string source(InterpreterTester::SourceForBody(literals[i].first));
@@ -2507,8 +2513,7 @@ TEST(InterpreterObjectLiterals) {
   Factory* factory = isolate->factory();
 
   std::pair<const char*, Handle<Object>> literals[] = {
-      std::make_pair("return { }.name;",
-                     factory->undefined_value()),
+      std::make_pair("return { }.name;", factory->undefined_value()),
       std::make_pair("return { name: 'string', val: 9.2 }.name;",
                      factory->NewStringFromStaticChars("string")),
       std::make_pair("var a = 15; return { name: 'string', val: a }.val;",
@@ -2569,7 +2574,7 @@ TEST(InterpreterConstruct) {
   auto callable = tester.GetCallable<>();
 
   Handle<Object> return_val = callable().ToHandleChecked();
-  CHECK_EQ(Smi::cast(*return_val), Smi::kZero);
+  CHECK_EQ(Smi::cast(*return_val), Smi::zero());
 }
 
 TEST(InterpreterConstructWithArgument) {
@@ -2636,7 +2641,7 @@ TEST(InterpreterContextVariables) {
                      "  return a + b; }",
                      handle(Smi::FromInt(30), isolate)),
       std::make_pair("'use strict';" + unique_vars.str() +
-                     "eval(); var b = 100; return b;",
+                         "eval(); var b = 100; return b;",
                      handle(Smi::FromInt(100), isolate)),
   };
 
@@ -2718,8 +2723,7 @@ TEST(InterpreterComma) {
 
   std::pair<const char*, Handle<Object>> literals[] = {
       std::make_pair("var a; return 0, a;\n", factory->undefined_value()),
-      std::make_pair("return 'a', 2.2, 3;\n",
-                     handle(Smi::FromInt(3), isolate)),
+      std::make_pair("return 'a', 2.2, 3;\n", handle(Smi::FromInt(3), isolate)),
       std::make_pair("return 'a', 'b', 'c';\n",
                      factory->NewStringFromStaticChars("c")),
       std::make_pair("return 3.2, 2.3, 4.5;\n", factory->NewNumber(4.5)),
@@ -2774,10 +2778,10 @@ TEST(InterpreterLogicalAnd) {
       std::make_pair("var a, b = 10; return a && b;\n",
                      factory->undefined_value()),
       std::make_pair("var a = 0, b = 10; return a && b / a;\n",
-                     handle(Smi::kZero, isolate)),
+                     handle(Smi::zero(), isolate)),
       std::make_pair("var a = '0', b = 10; return a && b;\n",
                      handle(Smi::FromInt(10), isolate)),
-      std::make_pair("return 0.0 && 3.2;\n", handle(Smi::kZero, isolate)),
+      std::make_pair("return 0.0 && 3.2;\n", handle(Smi::zero(), isolate)),
       std::make_pair("return 'a' && 'b';\n",
                      factory->NewStringFromStaticChars("b")),
       std::make_pair("return 'a' && 0 || 'b', 'c';\n",
@@ -2885,10 +2889,8 @@ TEST(InterpreterThrow) {
   Factory* factory = isolate->factory();
 
   std::pair<const char*, Handle<Object>> throws[] = {
-      std::make_pair("throw undefined;\n",
-                     factory->undefined_value()),
-      std::make_pair("throw 1;\n",
-                     handle(Smi::FromInt(1), isolate)),
+      std::make_pair("throw undefined;\n", factory->undefined_value()),
+      std::make_pair("throw 1;\n", handle(Smi::FromInt(1), isolate)),
       std::make_pair("throw 'Error';\n",
                      factory->NewStringFromStaticChars("Error")),
       std::make_pair("var a = true; if (a) { throw 'Error'; }\n",
@@ -2930,7 +2932,8 @@ TEST(InterpreterCountOperators) {
       std::make_pair("var a = 'string'; return a--;", factory->nan_value()),
       std::make_pair("var a = true; return ++a;",
                      handle(Smi::FromInt(2), isolate)),
-      std::make_pair("var a = false; return a--;", handle(Smi::kZero, isolate)),
+      std::make_pair("var a = false; return a--;",
+                     handle(Smi::zero(), isolate)),
       std::make_pair("var a = { val: 11 }; return ++a.val;",
                      handle(Smi::FromInt(12), isolate)),
       std::make_pair("var a = { val: 11 }; return a.val--;",
@@ -3130,10 +3133,8 @@ TEST(InterpreterConditional) {
   Isolate* isolate = handles.main_isolate();
 
   std::pair<const char*, Handle<Object>> conditional[] = {
-      std::make_pair("return true ? 2 : 3;",
-                     handle(Smi::FromInt(2), isolate)),
-      std::make_pair("return false ? 2 : 3;",
-                     handle(Smi::FromInt(3), isolate)),
+      std::make_pair("return true ? 2 : 3;", handle(Smi::FromInt(2), isolate)),
+      std::make_pair("return false ? 2 : 3;", handle(Smi::FromInt(3), isolate)),
       std::make_pair("var a = 1; return a ? 20 : 30;",
                      handle(Smi::FromInt(20), isolate)),
       std::make_pair("var a = 1; return a ? 20 : 30;",
@@ -4073,14 +4074,15 @@ TEST(InterpreterLookupSlot) {
   Factory* factory = isolate->factory();
 
   // TODO(mythria): Add more tests when we have support for eval/with.
-  const char* function_prologue = "var f;"
-                                  "var x = 1;"
-                                  "function f1() {"
-                                  "  eval(\"function t() {";
-  const char* function_epilogue = "        }; f = t;\");"
-                                  "}"
-                                  "f1();";
-
+  const char* function_prologue =
+      "var f;"
+      "var x = 1;"
+      "function f1() {"
+      "  eval(\"function t() {";
+  const char* function_epilogue =
+      "        }; f = t;\");"
+      "}"
+      "f1();";
 
   std::pair<const char*, Handle<Object>> lookup_slot[] = {
       {"return x;", handle(Smi::FromInt(1), isolate)},
@@ -4114,19 +4116,19 @@ TEST(InterpreterLookupContextSlot) {
   std::tuple<const char*, const char*, Handle<Object>> lookup_slot[] = {
       // Eval in inner context.
       std::make_tuple("var x = 0;", "eval(''); return x;",
-                      handle(Smi::kZero, isolate)),
+                      handle(Smi::zero(), isolate)),
       std::make_tuple("var x = 0;", "eval('var x = 1'); return x;",
                       handle(Smi::FromInt(1), isolate)),
       std::make_tuple("var x = 0;",
                       "'use strict'; eval('var x = 1'); return x;",
-                      handle(Smi::kZero, isolate)),
+                      handle(Smi::zero(), isolate)),
       // Eval in outer context.
       std::make_tuple("var x = 0; eval('');", "return x;",
-                      handle(Smi::kZero, isolate)),
+                      handle(Smi::zero(), isolate)),
       std::make_tuple("var x = 0; eval('var x = 1');", "return x;",
                       handle(Smi::FromInt(1), isolate)),
       std::make_tuple("'use strict'; var x = 0; eval('var x = 1');",
-                      "return x;", handle(Smi::kZero, isolate)),
+                      "return x;", handle(Smi::zero(), isolate)),
   };
 
   for (size_t i = 0; i < arraysize(lookup_slot); i++) {
@@ -4156,18 +4158,18 @@ TEST(InterpreterLookupGlobalSlot) {
   std::tuple<const char*, const char*, Handle<Object>> lookup_slot[] = {
       // Eval in inner context.
       std::make_tuple("x = 0;", "eval(''); return x;",
-                      handle(Smi::kZero, isolate)),
+                      handle(Smi::zero(), isolate)),
       std::make_tuple("x = 0;", "eval('var x = 1'); return x;",
                       handle(Smi::FromInt(1), isolate)),
       std::make_tuple("x = 0;", "'use strict'; eval('var x = 1'); return x;",
-                      handle(Smi::kZero, isolate)),
+                      handle(Smi::zero(), isolate)),
       // Eval in outer context.
       std::make_tuple("x = 0; eval('');", "return x;",
-                      handle(Smi::kZero, isolate)),
+                      handle(Smi::zero(), isolate)),
       std::make_tuple("x = 0; eval('var x = 1');", "return x;",
                       handle(Smi::FromInt(1), isolate)),
       std::make_tuple("'use strict'; x = 0; eval('var x = 1');", "return x;",
-                      handle(Smi::kZero, isolate)),
+                      handle(Smi::zero(), isolate)),
   };
 
   for (size_t i = 0; i < arraysize(lookup_slot); i++) {
@@ -4261,18 +4263,19 @@ TEST(InterpreterDeleteLookupSlot) {
   Factory* factory = isolate->factory();
 
   // TODO(mythria): Add more tests when we have support for eval/with.
-  const char* function_prologue = "var f;"
-                                  "var x = 1;"
-                                  "y = 10;"
-                                  "var obj = {val:10};"
-                                  "var z = 30;"
-                                  "function f1() {"
-                                  "  var z = 20;"
-                                  "  eval(\"function t() {";
-  const char* function_epilogue = "        }; f = t;\");"
-                                  "}"
-                                  "f1();";
-
+  const char* function_prologue =
+      "var f;"
+      "var x = 1;"
+      "y = 10;"
+      "var obj = {val:10};"
+      "var z = 30;"
+      "function f1() {"
+      "  var z = 20;"
+      "  eval(\"function t() {";
+  const char* function_epilogue =
+      "        }; f = t;\");"
+      "}"
+      "f1();";
 
   std::pair<const char*, Handle<Object>> delete_lookup_slot[] = {
       {"return delete x;", factory->false_value()},
diff --git a/deps/v8/test/cctest/manually-externalized-buffer.h b/deps/v8/test/cctest/manually-externalized-buffer.h
index b5eeed7382fe70..2ffdd36a77d6df 100644
--- a/deps/v8/test/cctest/manually-externalized-buffer.h
+++ b/deps/v8/test/cctest/manually-externalized-buffer.h
@@ -15,16 +15,16 @@ namespace testing {
 // externalized in a test.
 struct ManuallyExternalizedBuffer {
   Handle<JSArrayBuffer> buffer_;
-  v8::ArrayBuffer::Contents contents_;
+  std::shared_ptr<v8::BackingStore> backing_store_;
 
   explicit ManuallyExternalizedBuffer(Handle<JSArrayBuffer> buffer)
       : buffer_(buffer),
-        contents_(v8::Utils::ToLocal(buffer_)->Externalize()) {}
+        backing_store_(v8::Utils::ToLocal(buffer_)->GetBackingStore()) {}
   ~ManuallyExternalizedBuffer() {
-    contents_.Deleter()(contents_.Data(), contents_.ByteLength(),
-                        contents_.DeleterData());
+    // Nothing to be done. The reference to the backing store will be
+    // dropped automatically.
   }
-  void* backing_store() { return contents_.Data(); }
+  void* backing_store() { return backing_store_->Data(); }
 };
 
 }  // namespace testing
diff --git a/deps/v8/test/cctest/parsing/test-preparser.cc b/deps/v8/test/cctest/parsing/test-preparser.cc
index 0aae61065405f8..da5f744f33d56e 100644
--- a/deps/v8/test/cctest/parsing/test-preparser.cc
+++ b/deps/v8/test/cctest/parsing/test-preparser.cc
@@ -708,7 +708,7 @@ TEST(PreParserScopeAnalysis) {
           isolate);
 
       // Parse the lazy function using the scope data.
-      i::ParseInfo using_scope_data(isolate, shared);
+      i::ParseInfo using_scope_data(isolate, *shared);
       using_scope_data.set_lazy_compile();
       using_scope_data.set_consumed_preparse_data(
           i::ConsumedPreparseData::For(isolate, produced_data_on_heap));
@@ -724,7 +724,7 @@ TEST(PreParserScopeAnalysis) {
       CHECK(i::DeclarationScope::Analyze(&using_scope_data));
 
       // Parse the lazy function again eagerly to produce baseline data.
-      i::ParseInfo not_using_scope_data(isolate, shared);
+      i::ParseInfo not_using_scope_data(isolate, *shared);
       not_using_scope_data.set_lazy_compile();
       CHECK(i::parsing::ParseFunction(&not_using_scope_data, shared, isolate));
 
@@ -759,11 +759,11 @@ TEST(Regress753896) {
   i::Handle<i::String> source = factory->InternalizeUtf8String(
       "function lazy() { let v = 0; if (true) { var v = 0; } }");
   i::Handle<i::Script> script = factory->NewScript(source);
-  i::ParseInfo info(isolate, script);
+  i::ParseInfo info(isolate, *script);
 
   // We don't assert that parsing succeeded or that it failed; currently the
   // error is not detected inside lazy functions, but it might be in the future.
-  i::parsing::ParseProgram(&info, isolate);
+  i::parsing::ParseProgram(&info, script, isolate);
 }
 
 TEST(ProducingAndConsumingByteData) {
diff --git a/deps/v8/test/cctest/test-accessor-assembler.cc b/deps/v8/test/cctest/test-accessor-assembler.cc
index 6183ef970c551e..4b415514030f90 100644
--- a/deps/v8/test/cctest/test-accessor-assembler.cc
+++ b/deps/v8/test/cctest/test-accessor-assembler.cc
@@ -28,9 +28,10 @@ void TestStubCacheOffsetCalculation(StubCache::Table table) {
   AccessorAssembler m(data.state());
 
   {
-    Node* name = m.Parameter(0);
-    Node* map = m.Parameter(1);
-    Node* primary_offset = m.StubCachePrimaryOffsetForTesting(name, map);
+    TNode<Name> name = m.CAST(m.Parameter(0));
+    TNode<Map> map = m.CAST(m.Parameter(1));
+    TNode<IntPtrT> primary_offset =
+        m.StubCachePrimaryOffsetForTesting(name, map);
     Node* result;
     if (table == StubCache::kPrimary) {
       result = primary_offset;
@@ -59,7 +60,6 @@ void TestStubCacheOffsetCalculation(StubCache::Table table) {
   };
 
   Handle<Map> maps[] = {
-      Handle<Map>(Map(), isolate),
       factory->cell_map(),
       Map::Create(isolate, 0),
       factory->meta_map(),
@@ -128,8 +128,8 @@ TEST(TryProbeStubCache) {
   stub_cache.Clear();
 
   {
-    Node* receiver = m.Parameter(0);
-    TNode<Object> name = m.CAST(m.Parameter(1));
+    TNode<Object> receiver = m.CAST(m.Parameter(0));
+    TNode<Name> name = m.CAST(m.Parameter(1));
     TNode<MaybeObject> expected_handler =
         m.UncheckedCast<MaybeObject>(m.Parameter(2));
 
diff --git a/deps/v8/test/cctest/test-api-array-buffer.cc b/deps/v8/test/cctest/test-api-array-buffer.cc
index 9afdf047f07b73..3a3f2c142994e8 100644
--- a/deps/v8/test/cctest/test-api-array-buffer.cc
+++ b/deps/v8/test/cctest/test-api-array-buffer.cc
@@ -48,15 +48,31 @@ Local<TypedArray> CreateAndCheck(Local<v8::ArrayBuffer> ab, int byteOffset,
 
 std::shared_ptr<v8::BackingStore> Externalize(Local<v8::ArrayBuffer> ab) {
   std::shared_ptr<v8::BackingStore> backing_store = ab->GetBackingStore();
+  // Keep the tests until the deprecated functions are removed.
+#if __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated"
+#endif
   ab->Externalize(backing_store);
   CHECK(ab->IsExternal());
+#if __clang__
+#pragma clang diagnostic pop
+#endif
   return backing_store;
 }
 
 std::shared_ptr<v8::BackingStore> Externalize(Local<v8::SharedArrayBuffer> ab) {
   std::shared_ptr<v8::BackingStore> backing_store = ab->GetBackingStore();
+  // Keep the tests until the deprecated functions are removed.
+#if __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated"
+#endif
   ab->Externalize(backing_store);
   CHECK(ab->IsExternal());
+#if __clang__
+#pragma clang diagnostic pop
+#endif
   return backing_store;
 }
 
@@ -70,7 +86,6 @@ THREADED_TEST(ArrayBuffer_ApiInternalToExternal) {
   Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, 1024);
   CheckInternalFieldsAreZero(ab);
   CHECK_EQ(1024, ab->ByteLength());
-  CHECK(!ab->IsExternal());
   CcTest::CollectAllGarbage();
 
   std::shared_ptr<v8::BackingStore> backing_store = Externalize(ab);
@@ -110,7 +125,6 @@ THREADED_TEST(ArrayBuffer_JSInternalToExternal) {
   Local<v8::ArrayBuffer> ab1 = Local<v8::ArrayBuffer>::Cast(result);
   CheckInternalFieldsAreZero(ab1);
   CHECK_EQ(2, ab1->ByteLength());
-  CHECK(!ab1->IsExternal());
   std::shared_ptr<v8::BackingStore> backing_store = Externalize(ab1);
 
   result = CompileRun("ab1.byteLength");
@@ -144,11 +158,19 @@ THREADED_TEST(ArrayBuffer_External) {
 
   i::ScopedVector<uint8_t> my_data(100);
   memset(my_data.begin(), 0, 100);
+  // Keep the tests until the deprecated functions are removed.
+#if __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated"
+#endif
   Local<v8::ArrayBuffer> ab3 =
       v8::ArrayBuffer::New(isolate, my_data.begin(), 100);
   CheckInternalFieldsAreZero(ab3);
   CHECK_EQ(100, ab3->ByteLength());
   CHECK(ab3->IsExternal());
+#if __clang__
+#pragma clang diagnostic pop
+#endif
 
   CHECK(env->Global()->Set(env.local(), v8_str("ab3"), ab3).FromJust());
 
@@ -174,10 +196,7 @@ THREADED_TEST(ArrayBuffer_DisableDetach) {
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope handle_scope(isolate);
 
-  i::ScopedVector<uint8_t> my_data(100);
-  memset(my_data.begin(), 0, 100);
-  Local<v8::ArrayBuffer> ab =
-      v8::ArrayBuffer::New(isolate, my_data.begin(), 100);
+  Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, 100);
   CHECK(ab->IsDetachable());
 
   i::Handle<i::JSArrayBuffer> buf = v8::Utils::OpenHandle(*ab);
@@ -285,7 +304,15 @@ THREADED_TEST(ArrayBuffer_AllocationInformation) {
 
   const size_t ab_size = 1024;
   Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, ab_size);
+#if __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated"
+#endif
   v8::ArrayBuffer::Contents contents(ab->GetContents());
+#if __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated"
+#endif
 
   // Array buffers should have normal allocation mode.
   CHECK_EQ(contents.AllocationMode(),
@@ -308,7 +335,6 @@ THREADED_TEST(ArrayBuffer_ExternalizeEmpty) {
   Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, 2);
   CheckInternalFieldsAreZero(ab);
   CHECK_EQ(2, ab->ByteLength());
-  CHECK(!ab->IsExternal());
 
   // Externalize the buffer (taking ownership of the backing store memory).
   std::shared_ptr<v8::BackingStore> backing_store = Externalize(ab);
@@ -332,7 +358,6 @@ THREADED_TEST(SharedArrayBuffer_ApiInternalToExternal) {
   Local<v8::SharedArrayBuffer> ab = v8::SharedArrayBuffer::New(isolate, 1024);
   CheckInternalFieldsAreZero(ab);
   CHECK_EQ(1024, ab->ByteLength());
-  CHECK(!ab->IsExternal());
   CcTest::CollectAllGarbage();
 
   std::shared_ptr<v8::BackingStore> backing_store = Externalize(ab);
@@ -550,6 +575,7 @@ THREADED_TEST(ArrayBuffer_NewBackingStore) {
   v8::HandleScope handle_scope(isolate);
   std::shared_ptr<v8::BackingStore> backing_store =
       v8::ArrayBuffer::NewBackingStore(isolate, 100);
+  CHECK(!backing_store->IsShared());
   Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, backing_store);
   CHECK_EQ(backing_store.get(), ab->GetBackingStore().get());
 }
@@ -560,6 +586,7 @@ THREADED_TEST(SharedArrayBuffer_NewBackingStore) {
   v8::HandleScope handle_scope(isolate);
   std::shared_ptr<v8::BackingStore> backing_store =
       v8::SharedArrayBuffer::NewBackingStore(isolate, 100);
+  CHECK(backing_store->IsShared());
   Local<v8::SharedArrayBuffer> ab =
       v8::SharedArrayBuffer::New(isolate, backing_store);
   CHECK_EQ(backing_store.get(), ab->GetBackingStore().get());
@@ -609,6 +636,40 @@ TEST(SharedArrayBuffer_NewBackingStore_CustomDeleter) {
   CHECK(backing_store_custom_called);
 }
 
+THREADED_TEST(BackingStore_NotShared) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope handle_scope(isolate);
+  Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, 8);
+  CHECK(!ab->GetBackingStore()->IsShared());
+  CHECK(!v8::ArrayBuffer::NewBackingStore(isolate, 8)->IsShared());
+  backing_store_custom_called = false;
+  backing_store_custom_data = malloc(100);
+  backing_store_custom_length = 100;
+  CHECK(!v8::ArrayBuffer::NewBackingStore(
+             backing_store_custom_data, backing_store_custom_length,
+             BackingStoreCustomDeleter,
+             reinterpret_cast<void*>(backing_store_custom_deleter_data))
+             ->IsShared());
+}
+
+THREADED_TEST(BackingStore_Shared) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope handle_scope(isolate);
+  Local<v8::SharedArrayBuffer> ab = v8::SharedArrayBuffer::New(isolate, 8);
+  CHECK(ab->GetBackingStore()->IsShared());
+  CHECK(v8::SharedArrayBuffer::NewBackingStore(isolate, 8)->IsShared());
+  backing_store_custom_called = false;
+  backing_store_custom_data = malloc(100);
+  backing_store_custom_length = 100;
+  CHECK(v8::SharedArrayBuffer::NewBackingStore(
+            backing_store_custom_data, backing_store_custom_length,
+            BackingStoreCustomDeleter,
+            reinterpret_cast<void*>(backing_store_custom_deleter_data))
+            ->IsShared());
+}
+
 class DummyAllocator final : public v8::ArrayBuffer::Allocator {
  public:
   DummyAllocator() : allocator_(NewDefaultAllocator()) {}
diff --git a/deps/v8/test/cctest/test-api-interceptors.cc b/deps/v8/test/cctest/test-api-interceptors.cc
index cbf9f75be59603..e1b2444d911a9d 100644
--- a/deps/v8/test/cctest/test-api-interceptors.cc
+++ b/deps/v8/test/cctest/test-api-interceptors.cc
@@ -95,16 +95,16 @@ void SymbolAccessorGetter(Local<Name> name,
                           const v8::PropertyCallbackInfo<v8::Value>& info) {
   CHECK(name->IsSymbol());
   Local<Symbol> sym = Local<Symbol>::Cast(name);
-  if (sym->Name()->IsUndefined()) return;
-  SimpleAccessorGetter(Local<String>::Cast(sym->Name()), info);
+  if (sym->Description()->IsUndefined()) return;
+  SimpleAccessorGetter(Local<String>::Cast(sym->Description()), info);
 }
 
 void SymbolAccessorSetter(Local<Name> name, Local<Value> value,
                           const v8::PropertyCallbackInfo<void>& info) {
   CHECK(name->IsSymbol());
   Local<Symbol> sym = Local<Symbol>::Cast(name);
-  if (sym->Name()->IsUndefined()) return;
-  SimpleAccessorSetter(Local<String>::Cast(sym->Name()), value, info);
+  if (sym->Description()->IsUndefined()) return;
+  SimpleAccessorSetter(Local<String>::Cast(sym->Description()), value, info);
 }
 
 void InterceptorGetter(Local<Name> generic_name,
@@ -154,7 +154,7 @@ void GenericInterceptorGetter(Local<Name> generic_name,
                               const v8::PropertyCallbackInfo<v8::Value>& info) {
   Local<String> str;
   if (generic_name->IsSymbol()) {
-    Local<Value> name = Local<Symbol>::Cast(generic_name)->Name();
+    Local<Value> name = Local<Symbol>::Cast(generic_name)->Description();
     if (name->IsUndefined()) return;
     str = String::Concat(info.GetIsolate(), v8_str("_sym_"),
                          Local<String>::Cast(name));
@@ -175,7 +175,7 @@ void GenericInterceptorSetter(Local<Name> generic_name, Local<Value> value,
                               const v8::PropertyCallbackInfo<v8::Value>& info) {
   Local<String> str;
   if (generic_name->IsSymbol()) {
-    Local<Value> name = Local<Symbol>::Cast(generic_name)->Name();
+    Local<Value> name = Local<Symbol>::Cast(generic_name)->Description();
     if (name->IsUndefined()) return;
     str = String::Concat(info.GetIsolate(), v8_str("_sym_"),
                          Local<String>::Cast(name));
diff --git a/deps/v8/test/cctest/test-api-stack-traces.cc b/deps/v8/test/cctest/test-api-stack-traces.cc
index 26941793c66daa..bceba18c4a5910 100644
--- a/deps/v8/test/cctest/test-api-stack-traces.cc
+++ b/deps/v8/test/cctest/test-api-stack-traces.cc
@@ -250,31 +250,31 @@ static void AnalyzeStackInNativeCode(
     v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(
         args.GetIsolate(), 5, v8::StackTrace::kOverview);
     CHECK_EQ(3, stackTrace->GetFrameCount());
-    checkStackFrame(nullptr, "function.name", 1, 1, true, false,
+    checkStackFrame(nullptr, "function.name", 3, 1, true, false,
                     stackTrace->GetFrame(isolate, 0));
   } else if (testGroup == kDisplayName) {
     v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(
         args.GetIsolate(), 5, v8::StackTrace::kOverview);
     CHECK_EQ(3, stackTrace->GetFrameCount());
-    checkStackFrame(nullptr, "function.displayName", 1, 1, true, false,
+    checkStackFrame(nullptr, "function.displayName", 3, 1, true, false,
                     stackTrace->GetFrame(isolate, 0));
   } else if (testGroup == kFunctionNameAndDisplayName) {
     v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(
         args.GetIsolate(), 5, v8::StackTrace::kOverview);
     CHECK_EQ(3, stackTrace->GetFrameCount());
-    checkStackFrame(nullptr, "function.displayName", 1, 1, true, false,
+    checkStackFrame(nullptr, "function.displayName", 3, 1, true, false,
                     stackTrace->GetFrame(isolate, 0));
   } else if (testGroup == kDisplayNameIsNotString) {
     v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(
         args.GetIsolate(), 5, v8::StackTrace::kOverview);
     CHECK_EQ(3, stackTrace->GetFrameCount());
-    checkStackFrame(nullptr, "function.name", 1, 1, true, false,
+    checkStackFrame(nullptr, "function.name", 3, 1, true, false,
                     stackTrace->GetFrame(isolate, 0));
   } else if (testGroup == kFunctionNameIsNotString) {
     v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(
         args.GetIsolate(), 5, v8::StackTrace::kOverview);
     CHECK_EQ(3, stackTrace->GetFrameCount());
-    checkStackFrame(nullptr, "", 1, 1, true, false,
+    checkStackFrame(nullptr, "", 3, 1, true, false,
                     stackTrace->GetFrame(isolate, 0));
   }
 }
diff --git a/deps/v8/test/cctest/test-api-typed-array.cc b/deps/v8/test/cctest/test-api-typed-array.cc
index 117089d566b377..59c7137525d619 100644
--- a/deps/v8/test/cctest/test-api-typed-array.cc
+++ b/deps/v8/test/cctest/test-api-typed-array.cc
@@ -359,15 +359,12 @@ void TypedArrayTestHelper(i::ExternalArrayType array_type, int64_t low,
                           int64_t high) {
   const int kElementCount = 50;
 
-  i::ScopedVector<ElementType> backing_store(kElementCount + 2);
-
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope handle_scope(isolate);
 
   Local<ArrayBufferType> ab =
-      ArrayBufferType::New(isolate, backing_store.begin(),
-                           (kElementCount + 2) * sizeof(ElementType));
+      ArrayBufferType::New(isolate, (kElementCount + 2) * sizeof(ElementType));
   Local<TypedArray> ta =
       TypedArray::New(ab, 2 * sizeof(ElementType), kElementCount);
   CheckInternalFieldsAreZero<v8::ArrayBufferView>(ta);
@@ -376,7 +373,8 @@ void TypedArrayTestHelper(i::ExternalArrayType array_type, int64_t low,
   CHECK_EQ(kElementCount * sizeof(ElementType), ta->ByteLength());
   CHECK(ab->Equals(env.local(), ta->Buffer()).FromJust());
 
-  ElementType* data = backing_store.begin() + 2;
+  ElementType* data =
+      reinterpret_cast<ElementType*>(ab->GetBackingStore()->Data()) + 2;
   for (int i = 0; i < kElementCount; i++) {
     data[i] = static_cast<ElementType>(i);
   }
@@ -435,14 +433,11 @@ THREADED_TEST(Uint8ClampedArray) {
 THREADED_TEST(DataView) {
   const int kSize = 50;
 
-  i::ScopedVector<uint8_t> backing_store(kSize + 2);
-
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope handle_scope(isolate);
 
-  Local<v8::ArrayBuffer> ab =
-      v8::ArrayBuffer::New(isolate, backing_store.begin(), 2 + kSize);
+  Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, 2 + kSize);
   Local<v8::DataView> dv = v8::DataView::New(ab, 2, kSize);
   CheckInternalFieldsAreZero<v8::ArrayBufferView>(dv);
   CHECK_EQ(2u, dv->ByteOffset());
@@ -508,14 +503,12 @@ THREADED_TEST(SharedDataView) {
   i::FLAG_harmony_sharedarraybuffer = true;
   const int kSize = 50;
 
-  i::ScopedVector<uint8_t> backing_store(kSize + 2);
-
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope handle_scope(isolate);
 
   Local<v8::SharedArrayBuffer> ab =
-      v8::SharedArrayBuffer::New(isolate, backing_store.begin(), 2 + kSize);
+      v8::SharedArrayBuffer::New(isolate, 2 + kSize);
   Local<v8::DataView> dv = v8::DataView::New(ab, 2, kSize);
   CheckInternalFieldsAreZero<v8::ArrayBufferView>(dv);
   CHECK_EQ(2u, dv->ByteOffset());
diff --git a/deps/v8/test/cctest/test-api-wasm.cc b/deps/v8/test/cctest/test-api-wasm.cc
new file mode 100644
index 00000000000000..4dc84254bcf0bd
--- /dev/null
+++ b/deps/v8/test/cctest/test-api-wasm.cc
@@ -0,0 +1,167 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <memory>
+
+#include "include/v8.h"
+#include "src/api/api-inl.h"
+#include "src/handles/global-handles.h"
+#include "test/cctest/cctest.h"
+
+namespace {
+
+bool wasm_streaming_callback_got_called = false;
+bool wasm_streaming_data_got_collected = false;
+
+void WasmStreamingTestFinalizer(const v8::WeakCallbackInfo<void>& data) {
+  CHECK(!wasm_streaming_data_got_collected);
+  wasm_streaming_data_got_collected = true;
+  i::GlobalHandles::Destroy(reinterpret_cast<i::Address*>(data.GetParameter()));
+}
+
+void WasmStreamingCallbackTestCallbackIsCalled(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  CHECK(!wasm_streaming_callback_got_called);
+  wasm_streaming_callback_got_called = true;
+
+  i::Handle<i::Object> global_handle =
+      reinterpret_cast<i::Isolate*>(args.GetIsolate())
+          ->global_handles()
+          ->Create(*v8::Utils::OpenHandle(*args.Data()));
+  i::GlobalHandles::MakeWeak(global_handle.location(), global_handle.location(),
+                             WasmStreamingTestFinalizer,
+                             v8::WeakCallbackType::kParameter);
+}
+
+void WasmStreamingCallbackTestOnBytesReceived(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  std::shared_ptr<v8::WasmStreaming> streaming =
+      v8::WasmStreaming::Unpack(args.GetIsolate(), args.Data());
+
+  // The first bytes of the WebAssembly magic word.
+  const uint8_t bytes[]{0x00, 0x61, 0x73};
+  streaming->OnBytesReceived(bytes, arraysize(bytes));
+}
+
+void WasmStreamingCallbackTestFinishWithSuccess(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  std::shared_ptr<v8::WasmStreaming> streaming =
+      v8::WasmStreaming::Unpack(args.GetIsolate(), args.Data());
+  // The bytes of a minimal WebAssembly module.
+  const uint8_t bytes[]{0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00};
+  streaming->OnBytesReceived(bytes, arraysize(bytes));
+  streaming->Finish();
+}
+
+void WasmStreamingCallbackTestFinishWithFailure(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  std::shared_ptr<v8::WasmStreaming> streaming =
+      v8::WasmStreaming::Unpack(args.GetIsolate(), args.Data());
+  streaming->Finish();
+}
+
+void WasmStreamingCallbackTestAbortWithReject(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  std::shared_ptr<v8::WasmStreaming> streaming =
+      v8::WasmStreaming::Unpack(args.GetIsolate(), args.Data());
+  streaming->Abort(v8::Object::New(args.GetIsolate()));
+}
+
+void WasmStreamingCallbackTestAbortNoReject(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  std::shared_ptr<v8::WasmStreaming> streaming =
+      v8::WasmStreaming::Unpack(args.GetIsolate(), args.Data());
+  streaming->Abort({});
+}
+
+void TestWasmStreaming(v8::WasmStreamingCallback callback,
+                       v8::Promise::PromiseState expected_state) {
+  CcTest::isolate()->SetWasmStreamingCallback(callback);
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
+
+  // Call {WebAssembly.compileStreaming} with {null} as parameter. The parameter
+  // is only really processed by the embedder, so for this test the value is
+  // irrelevant.
+  v8::Local<v8::Promise> promise = v8::Local<v8::Promise>::Cast(
+      CompileRun("WebAssembly.compileStreaming(null)"));
+
+  EmptyMessageQueues(isolate);
+  CHECK_EQ(expected_state, promise->State());
+}
+
+}  // namespace
+
+TEST(WasmStreamingCallback) {
+  TestWasmStreaming(WasmStreamingCallbackTestCallbackIsCalled,
+                    v8::Promise::kPending);
+  CHECK(wasm_streaming_callback_got_called);
+  CcTest::CollectAllAvailableGarbage();
+  CHECK(wasm_streaming_data_got_collected);
+}
+
+TEST(WasmStreamingOnBytesReceived) {
+  TestWasmStreaming(WasmStreamingCallbackTestOnBytesReceived,
+                    v8::Promise::kPending);
+}
+
+TEST(WasmStreamingFinishWithSuccess) {
+  TestWasmStreaming(WasmStreamingCallbackTestFinishWithSuccess,
+                    v8::Promise::kFulfilled);
+}
+
+TEST(WasmStreamingFinishWithFailure) {
+  TestWasmStreaming(WasmStreamingCallbackTestFinishWithFailure,
+                    v8::Promise::kRejected);
+}
+
+TEST(WasmStreamingAbortWithReject) {
+  TestWasmStreaming(WasmStreamingCallbackTestAbortWithReject,
+                    v8::Promise::kRejected);
+}
+
+TEST(WasmStreamingAbortWithoutReject) {
+  TestWasmStreaming(WasmStreamingCallbackTestAbortNoReject,
+                    v8::Promise::kPending);
+}
+
+namespace {
+
+bool wasm_threads_enabled_value = false;
+
+bool MockWasmThreadsEnabledCallback(v8::Local<v8::Context>) {
+  return wasm_threads_enabled_value;
+}
+
+}  // namespace
+
+TEST(TestSetWasmThreadsEnabledCallback) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::Context> context = v8::Context::New(CcTest::isolate());
+  i::Handle<i::Context> i_context = v8::Utils::OpenHandle(*context);
+
+  // {Isolate::AreWasmThreadsEnabled} calls the callback set by the embedder if
+  // such a callback exists. Otherwise it returns
+  // {FLAG_experimental_wasm_threads}. First we test that the flag is returned
+  // correctly if no callback is set. Then we test that the flag is ignored if
+  // the callback is set.
+
+  i::FLAG_experimental_wasm_threads = false;
+  CHECK(!i_isolate->AreWasmThreadsEnabled(i_context));
+
+  i::FLAG_experimental_wasm_threads = true;
+  CHECK(i_isolate->AreWasmThreadsEnabled(i_context));
+
+  isolate->SetWasmThreadsEnabledCallback(MockWasmThreadsEnabledCallback);
+  wasm_threads_enabled_value = false;
+  CHECK(!i_isolate->AreWasmThreadsEnabled(i_context));
+
+  wasm_threads_enabled_value = true;
+  i::FLAG_experimental_wasm_threads = false;
+  CHECK(i_isolate->AreWasmThreadsEnabled(i_context));
+}
diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index bafdd6ce3b7194..5f84bfffcdfa65 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -65,7 +65,6 @@
 #include "src/profiler/cpu-profiler.h"
 #include "src/strings/unicode-inl.h"
 #include "src/utils/utils.h"
-#include "src/wasm/wasm-js.h"
 #include "test/cctest/heap/heap-tester.h"
 #include "test/cctest/heap/heap-utils.h"
 #include "test/cctest/wasm/wasm-run-utils.h"
@@ -166,9 +165,6 @@ UNINITIALIZED_TEST(InitializeAndDisposeMultiple) {
   for (int i = 0; i < 3; ++i) CHECK(v8::V8::Dispose());
 }
 
-// Tests that Smi::kZero is set up properly.
-UNINITIALIZED_TEST(SmiZero) { CHECK_EQ(i::Smi::kZero, i::Smi::kZero); }
-
 THREADED_TEST(Handles) {
   v8::HandleScope scope(CcTest::isolate());
   Local<Context> local_env;
@@ -2554,25 +2550,23 @@ void SymbolAccessorGetter(Local<Name> name,
                           const v8::PropertyCallbackInfo<v8::Value>& info) {
   CHECK(name->IsSymbol());
   Local<Symbol> sym = Local<Symbol>::Cast(name);
-  if (sym->Name()->IsUndefined())
-    return;
-  SimpleAccessorGetter(Local<String>::Cast(sym->Name()), info);
+  if (sym->Description()->IsUndefined()) return;
+  SimpleAccessorGetter(Local<String>::Cast(sym->Description()), info);
 }
 
 void SymbolAccessorSetter(Local<Name> name, Local<Value> value,
                           const v8::PropertyCallbackInfo<void>& info) {
   CHECK(name->IsSymbol());
   Local<Symbol> sym = Local<Symbol>::Cast(name);
-  if (sym->Name()->IsUndefined())
-    return;
-  SimpleAccessorSetter(Local<String>::Cast(sym->Name()), value, info);
+  if (sym->Description()->IsUndefined()) return;
+  SimpleAccessorSetter(Local<String>::Cast(sym->Description()), value, info);
 }
 
 void SymbolAccessorGetterReturnsDefault(
     Local<Name> name, const v8::PropertyCallbackInfo<v8::Value>& info) {
   CHECK(name->IsSymbol());
   Local<Symbol> sym = Local<Symbol>::Cast(name);
-  if (sym->Name()->IsUndefined()) return;
+  if (sym->Description()->IsUndefined()) return;
   info.GetReturnValue().Set(info.Data());
 }
 
@@ -2592,7 +2586,7 @@ THREADED_TEST(AccessorIsPreservedOnAttributeChange) {
   CompileRun("Object.defineProperty(a, 'length', { writable: false });");
   CHECK_EQ(0, a->map().instance_descriptors().number_of_descriptors());
   // But we should still have an AccessorInfo.
-  i::Handle<i::String> name(v8::Utils::OpenHandle(*v8_str("length")));
+  i::Handle<i::String> name = CcTest::i_isolate()->factory()->length_string();
   i::LookupIterator it(CcTest::i_isolate(), a, name,
                        i::LookupIterator::OWN_SKIP_INTERCEPTOR);
   CHECK_EQ(i::LookupIterator::ACCESSOR, it.state());
@@ -3201,7 +3195,8 @@ THREADED_TEST(SymbolProperties) {
   CHECK(!sym1->StrictEquals(sym2));
   CHECK(!sym2->StrictEquals(sym1));
 
-  CHECK(sym2->Name()->Equals(env.local(), v8_str("my-symbol")).FromJust());
+  CHECK(
+      sym2->Description()->Equals(env.local(), v8_str("my-symbol")).FromJust());
 
   v8::Local<v8::Value> sym_val = sym2;
   CHECK(sym_val->IsSymbol());
@@ -4362,6 +4357,15 @@ THREADED_TEST(HandleEquality) {
   global2.Reset();
 }
 
+THREADED_TEST(HandleEqualityPrimitives) {
+  v8::HandleScope scope(CcTest::isolate());
+  // Local::operator== works like strict equality except for primitives.
+  CHECK_NE(v8_str("str"), v8_str("str"));
+  CHECK_NE(v8::Number::New(CcTest::isolate(), 0.5),
+           v8::Number::New(CcTest::isolate(), 0.5));
+  CHECK_EQ(v8::Number::New(CcTest::isolate(), 1),
+           v8::Number::New(CcTest::isolate(), 1));
+}
 
 THREADED_TEST(LocalHandle) {
   v8::HandleScope scope(CcTest::isolate());
@@ -8899,7 +8903,7 @@ TEST(CompilationErrorUsingTryCatchHandler) {
   LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
   v8::TryCatch try_catch(env->GetIsolate());
-  v8_compile("This doesn't &*&@#$&*^ compile.");
+  CHECK(v8_try_compile("This doesn't &*&@#$&*^ compile.").IsEmpty());
   CHECK(*try_catch.Exception());
   CHECK(try_catch.HasCaught());
 }
@@ -14027,7 +14031,7 @@ void CheckIsSymbolAt(v8::Isolate* isolate, v8::Local<v8::Array> properties,
           .ToLocalChecked();
   CHECK(value->IsSymbol());
   v8::String::Utf8Value symbol_name(isolate,
-                                    Local<Symbol>::Cast(value)->Name());
+                                    Local<Symbol>::Cast(value)->Description());
   if (strcmp(name, *symbol_name) != 0) {
     FATAL("properties[%u] was Symbol('%s') instead of Symbol('%s').", index,
           name, *symbol_name);
@@ -18815,14 +18819,28 @@ TEST(RegExp) {
   v8::Local<v8::Value> value(CompileRun("re.property"));
   CHECK_EQ(32, value->Int32Value(context.local()).FromJust());
 
-  v8::TryCatch try_catch(context->GetIsolate());
-  CHECK(v8::RegExp::New(context.local(), v8_str("foo["), v8::RegExp::kNone)
-            .IsEmpty());
-  CHECK(try_catch.HasCaught());
-  CHECK(context->Global()
-            ->Set(context.local(), v8_str("ex"), try_catch.Exception())
-            .FromJust());
-  ExpectTrue("ex instanceof SyntaxError");
+  {
+    v8::TryCatch try_catch(context->GetIsolate());
+    CHECK(v8::RegExp::New(context.local(), v8_str("foo["), v8::RegExp::kNone)
+              .IsEmpty());
+    CHECK(try_catch.HasCaught());
+    CHECK(context->Global()
+              ->Set(context.local(), v8_str("ex"), try_catch.Exception())
+              .FromJust());
+    ExpectTrue("ex instanceof SyntaxError");
+  }
+
+  // RegExp::Exec.
+  {
+    v8::Local<v8::RegExp> regexp =
+        v8::RegExp::New(context.local(), v8_str("a.c"), {}).ToLocalChecked();
+    v8::Local<v8::Object> result0 =
+        regexp->Exec(context.local(), v8_str("abc")).ToLocalChecked();
+    CHECK(result0->IsArray());
+    v8::Local<v8::Object> result1 =
+        regexp->Exec(context.local(), v8_str("abd")).ToLocalChecked();
+    CHECK(result1->IsNull());
+  }
 }
 
 
@@ -19259,35 +19277,51 @@ void CheckCodeGenerationDisallowed() {
 
 char first_fourty_bytes[41];
 
-bool CodeGenerationAllowed(Local<Context> context, Local<String> source) {
+v8::ModifyCodeGenerationFromStringsResult CodeGenerationAllowed(
+    Local<Context> context, Local<Value> source) {
   String::Utf8Value str(CcTest::isolate(), source);
   size_t len = std::min(sizeof(first_fourty_bytes) - 1,
                         static_cast<size_t>(str.length()));
   strncpy(first_fourty_bytes, *str, len);
   first_fourty_bytes[len] = 0;
   ApiTestFuzzer::Fuzz();
-  return true;
+  return {true, {}};
 }
 
-bool CodeGenerationDisallowed(Local<Context> context, Local<String> source) {
+v8::ModifyCodeGenerationFromStringsResult CodeGenerationDisallowed(
+    Local<Context> context, Local<Value> source) {
   ApiTestFuzzer::Fuzz();
-  return false;
+  return {false, {}};
 }
 
-v8::MaybeLocal<String> ModifyCodeGeneration(Local<Context> context,
-                                            Local<Value> source) {
-  // For testing purposes, deny all odd-length strings and replace '2' with '3'
+v8::ModifyCodeGenerationFromStringsResult ModifyCodeGeneration(
+    Local<Context> context, Local<Value> source) {
+  // Allow (passthrough, unmodified) all objects that are not strings.
+  if (!source->IsString()) {
+    return {/* codegen_allowed= */ true, v8::MaybeLocal<String>()};
+  }
+
   String::Utf8Value utf8(context->GetIsolate(), source);
-  DCHECK(utf8.length());
-  if (utf8.length() == 0 || utf8.length() % 2 != 0)
-    return v8::MaybeLocal<String>();
+  DCHECK_GT(utf8.length(), 0);
+
+  // Allow (unmodified) all strings that contain "44".
+  if (strstr(*utf8, "44") != nullptr) {
+    return {/* codegen_allowed= */ true, v8::MaybeLocal<String>()};
+  }
 
+  // Deny all odd-length strings.
+  if (utf8.length() == 0 || utf8.length() % 2 != 0) {
+    return {/* codegen_allowed= */ false, v8::MaybeLocal<String>()};
+  }
+
+  // Allow even-length strings and modify them by replacing all '2' with '3'.
   for (char* i = *utf8; *i != '\0'; i++) {
     if (*i == '2') *i = '3';
   }
-  return String::NewFromUtf8(context->GetIsolate(), *utf8,
-                             v8::NewStringType::kNormal)
-      .ToLocalChecked();
+  return {/* codegen_allowed= */ true,
+          String::NewFromUtf8(context->GetIsolate(), *utf8,
+                              v8::NewStringType::kNormal)
+              .ToLocalChecked()};
 }
 
 THREADED_TEST(AllowCodeGenFromStrings) {
@@ -19309,13 +19343,13 @@ THREADED_TEST(AllowCodeGenFromStrings) {
 
   // Disallow but setting a global callback that will allow the calls.
   context->AllowCodeGenerationFromStrings(false);
-  context->GetIsolate()->SetAllowCodeGenerationFromStringsCallback(
+  context->GetIsolate()->SetModifyCodeGenerationFromStringsCallback(
       &CodeGenerationAllowed);
   CHECK(!context->IsCodeGenerationFromStringsAllowed());
   CheckCodeGenerationAllowed();
 
   // Set a callback that disallows the code generation.
-  context->GetIsolate()->SetAllowCodeGenerationFromStringsCallback(
+  context->GetIsolate()->SetModifyCodeGenerationFromStringsCallback(
       &CodeGenerationDisallowed);
   CHECK(!context->IsCodeGenerationFromStringsAllowed());
   CheckCodeGenerationDisallowed();
@@ -19339,6 +19373,12 @@ TEST(ModifyCodeGenFromStrings) {
   result = CompileRun("var f = new Function('return 42;'); f()");
   CHECK_EQ(43, result->Int32Value(context.local()).FromJust());
 
+  result = CompileRun("eval(43)");
+  CHECK_EQ(43, result->Int32Value(context.local()).FromJust());
+
+  result = CompileRun("var f = new Function('return 44;'); f();");
+  CHECK_EQ(44, result->Int32Value(context.local()).FromJust());
+
   // Test 'disallowed' cases.
   TryCatch try_catch(CcTest::isolate());
   result = CompileRun("eval('123')");
@@ -19359,7 +19399,7 @@ TEST(SetErrorMessageForCodeGenFromStrings) {
 
   Local<String> message = v8_str("Message");
   Local<String> expected_message = v8_str("Uncaught EvalError: Message");
-  context->GetIsolate()->SetAllowCodeGenerationFromStringsCallback(
+  context->GetIsolate()->SetModifyCodeGenerationFromStringsCallback(
       &CodeGenerationDisallowed);
   context->AllowCodeGenerationFromStrings(false);
   context->SetErrorMessageForCodeGenerationFromStrings(message);
@@ -19375,7 +19415,7 @@ TEST(CaptureSourceForCodeGenFromStrings) {
   v8::HandleScope scope(context->GetIsolate());
   TryCatch try_catch(context->GetIsolate());
 
-  context->GetIsolate()->SetAllowCodeGenerationFromStringsCallback(
+  context->GetIsolate()->SetModifyCodeGenerationFromStringsCallback(
       &CodeGenerationAllowed);
   context->AllowCodeGenerationFromStrings(false);
   CompileRun("eval('42')");
@@ -23943,6 +23983,34 @@ TEST(CreateSyntheticModuleGC) {
   }
 }
 
+TEST(CreateSyntheticModuleGCName) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::Isolate::Scope iscope(isolate);
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::Context> context = v8::Context::New(isolate);
+  v8::Context::Scope cscope(context);
+
+  Local<Module> module;
+
+  {
+    v8::EscapableHandleScope inner_scope(isolate);
+    std::vector<v8::Local<v8::String>> export_names{v8_str("default")};
+    v8::Local<v8::String> module_name =
+        v8_str("CreateSyntheticModuleGCName-TestSyntheticModule");
+    module = inner_scope.Escape(v8::Module::CreateSyntheticModule(
+        isolate, module_name, export_names,
+        UnexpectedSyntheticModuleEvaluationStepsCallback));
+  }
+
+  CcTest::CollectAllGarbage();
+#ifdef VERIFY_HEAP
+  i::Handle<i::HeapObject> i_module =
+      i::Handle<i::HeapObject>::cast(v8::Utils::OpenHandle(*module));
+  i_module->HeapObjectVerify(reinterpret_cast<i::Isolate*>(isolate));
+#endif
+}
+
 TEST(SyntheticModuleSetExports) {
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
@@ -25861,124 +25929,6 @@ TEST(PersistentValueMap) {
   map.Set("key", value);
 }
 
-namespace {
-
-bool wasm_streaming_callback_got_called = false;
-bool wasm_streaming_data_got_collected = false;
-
-void WasmStreamingTestFinalizer(const v8::WeakCallbackInfo<void>& data) {
-  CHECK(!wasm_streaming_data_got_collected);
-  wasm_streaming_data_got_collected = true;
-  i::GlobalHandles::Destroy(reinterpret_cast<i::Address*>(data.GetParameter()));
-}
-
-void WasmStreamingCallbackTestCallbackIsCalled(
-    const v8::FunctionCallbackInfo<v8::Value>& args) {
-  CHECK(!wasm_streaming_callback_got_called);
-  wasm_streaming_callback_got_called = true;
-
-  i::Handle<i::Object> global_handle =
-      reinterpret_cast<i::Isolate*>(args.GetIsolate())
-          ->global_handles()
-          ->Create(*v8::Utils::OpenHandle(*args.Data()));
-  i::GlobalHandles::MakeWeak(global_handle.location(), global_handle.location(),
-                             WasmStreamingTestFinalizer,
-                             v8::WeakCallbackType::kParameter);
-}
-
-void WasmStreamingCallbackTestOnBytesReceived(
-    const v8::FunctionCallbackInfo<v8::Value>& args) {
-  std::shared_ptr<v8::WasmStreaming> streaming =
-      v8::WasmStreaming::Unpack(args.GetIsolate(), args.Data());
-
-  // The first bytes of the WebAssembly magic word.
-  const uint8_t bytes[]{0x00, 0x61, 0x73};
-  streaming->OnBytesReceived(bytes, arraysize(bytes));
-}
-
-void WasmStreamingCallbackTestFinishWithSuccess(
-    const v8::FunctionCallbackInfo<v8::Value>& args) {
-  std::shared_ptr<v8::WasmStreaming> streaming =
-      v8::WasmStreaming::Unpack(args.GetIsolate(), args.Data());
-  // The bytes of a minimal WebAssembly module.
-  const uint8_t bytes[]{0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00};
-  streaming->OnBytesReceived(bytes, arraysize(bytes));
-  streaming->Finish();
-}
-
-void WasmStreamingCallbackTestFinishWithFailure(
-    const v8::FunctionCallbackInfo<v8::Value>& args) {
-  std::shared_ptr<v8::WasmStreaming> streaming =
-      v8::WasmStreaming::Unpack(args.GetIsolate(), args.Data());
-  streaming->Finish();
-}
-
-void WasmStreamingCallbackTestAbortWithReject(
-    const v8::FunctionCallbackInfo<v8::Value>& args) {
-  std::shared_ptr<v8::WasmStreaming> streaming =
-      v8::WasmStreaming::Unpack(args.GetIsolate(), args.Data());
-  streaming->Abort(v8::Object::New(args.GetIsolate()));
-}
-
-void WasmStreamingCallbackTestAbortNoReject(
-    const v8::FunctionCallbackInfo<v8::Value>& args) {
-  std::shared_ptr<v8::WasmStreaming> streaming =
-      v8::WasmStreaming::Unpack(args.GetIsolate(), args.Data());
-  streaming->Abort({});
-}
-
-void TestWasmStreaming(v8::WasmStreamingCallback callback,
-                       v8::Promise::PromiseState expected_state) {
-  CcTest::isolate()->SetWasmStreamingCallback(callback);
-  LocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-
-  // Call {WebAssembly.compileStreaming} with {null} as parameter. The parameter
-  // is only really processed by the embedder, so for this test the value is
-  // irrelevant.
-  v8::Local<v8::Promise> promise = v8::Local<v8::Promise>::Cast(
-      CompileRun("WebAssembly.compileStreaming(null)"));
-
-  EmptyMessageQueues(isolate);
-  CHECK_EQ(expected_state, promise->State());
-}
-
-}  // namespace
-
-TEST(WasmStreamingCallback) {
-  TestWasmStreaming(WasmStreamingCallbackTestCallbackIsCalled,
-                    v8::Promise::kPending);
-  CHECK(wasm_streaming_callback_got_called);
-  CcTest::CollectAllAvailableGarbage();
-  CHECK(wasm_streaming_data_got_collected);
-}
-
-TEST(WasmStreamingOnBytesReceived) {
-  TestWasmStreaming(WasmStreamingCallbackTestOnBytesReceived,
-                    v8::Promise::kPending);
-}
-
-TEST(WasmStreamingFinishWithSuccess) {
-  TestWasmStreaming(WasmStreamingCallbackTestFinishWithSuccess,
-                    v8::Promise::kFulfilled);
-}
-
-TEST(WasmStreamingFinishWithFailure) {
-  TestWasmStreaming(WasmStreamingCallbackTestFinishWithFailure,
-                    v8::Promise::kRejected);
-}
-
-TEST(WasmStreamingAbortWithReject) {
-  TestWasmStreaming(WasmStreamingCallbackTestAbortWithReject,
-                    v8::Promise::kRejected);
-}
-
-TEST(WasmStreamingAbortWithoutReject) {
-  TestWasmStreaming(WasmStreamingCallbackTestAbortNoReject,
-                    v8::Promise::kPending);
-}
-
 enum class AtomicsWaitCallbackAction {
   Interrupt,
   StopAndThrowInFirstCall,
@@ -26283,26 +26233,6 @@ TEST(WasmI64AtomicWaitCallback) {
 }  // namespace internal
 }  // namespace v8
 
-// TODO(mstarzinger): Move this into a test-api-wasm.cc file when this large
-// test file is being split up into chunks.
-TEST(WasmModuleObjectCompileFailure) {
-  LocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-
-  {
-    v8::TryCatch try_catch(isolate);
-    uint8_t buffer[] = {0xDE, 0xAD, 0xBE, 0xEF};
-    v8::MemorySpan<const uint8_t> serialized_module;
-    v8::MemorySpan<const uint8_t> wire_bytes = {buffer, arraysize(buffer)};
-    v8::MaybeLocal<v8::WasmModuleObject> maybe_module =
-        v8::WasmModuleObject::DeserializeOrCompile(isolate, serialized_module,
-                                                   wire_bytes);
-    CHECK(maybe_module.IsEmpty());
-    CHECK(try_catch.HasCaught());
-  }
-}
-
 TEST(BigIntAPI) {
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
@@ -26417,75 +26347,64 @@ TEST(BigIntAPI) {
   }
 }
 
-namespace {
-
-bool wasm_threads_enabled_value = false;
-
-bool MockWasmThreadsEnabledCallback(Local<Context>) {
-  return wasm_threads_enabled_value;
-}
-
-}  // namespace
-
-TEST(TestSetWasmThreadsEnabledCallback) {
+TEST(TestGetUnwindState) {
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  v8::HandleScope scope(isolate);
-  v8::Local<Context> context = Context::New(CcTest::isolate());
-  i::Handle<i::Context> i_context = v8::Utils::OpenHandle(*context);
 
-  // {Isolate::AreWasmThreadsEnabled} calls the callback set by the embedder if
-  // such a callback exists. Otherwise it returns
-  // {FLAG_experimental_wasm_threads}. First we test that the flag is returned
-  // correctly if no callback is set. Then we test that the flag is ignored if
-  // the callback is set.
+// Ignore deprecation warnings so that we can keep the tests for now.
+// TODO(petermarshall): Remove this once the deprecated API is gone.
+#if __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated"
+#endif
+  v8::UnwindState unwind_state = isolate->GetUnwindState();
+#if __clang__
+#pragma clang diagnostic pop
+#endif
+  v8::MemoryRange builtins_range = unwind_state.embedded_code_range;
 
-  i::FLAG_experimental_wasm_threads = false;
-  CHECK(!i_isolate->AreWasmThreadsEnabled(i_context));
+  // Check that each off-heap builtin is within the builtins code range.
+  for (int id = 0; id < i::Builtins::builtin_count; id++) {
+    if (!i::Builtins::IsIsolateIndependent(id)) continue;
+    i::Code builtin = i_isolate->builtins()->builtin(id);
+    i::Address start = builtin.InstructionStart();
+    i::Address end = start + builtin.InstructionSize();
 
-  i::FLAG_experimental_wasm_threads = true;
-  CHECK(i_isolate->AreWasmThreadsEnabled(i_context));
+    i::Address builtins_start =
+        reinterpret_cast<i::Address>(builtins_range.start);
+    CHECK(start >= builtins_start &&
+          end < builtins_start + builtins_range.length_in_bytes);
+  }
 
-  isolate->SetWasmThreadsEnabledCallback(MockWasmThreadsEnabledCallback);
-  wasm_threads_enabled_value = false;
-  CHECK(!i_isolate->AreWasmThreadsEnabled(i_context));
+  v8::JSEntryStub js_entry_stub = unwind_state.js_entry_stub;
 
-  wasm_threads_enabled_value = true;
-  i::FLAG_experimental_wasm_threads = false;
-  CHECK(i_isolate->AreWasmThreadsEnabled(i_context));
+  CHECK_EQ(i_isolate->heap()->builtin(i::Builtins::kJSEntry).InstructionStart(),
+           reinterpret_cast<i::Address>(js_entry_stub.code.start));
 }
 
-TEST(TestGetUnwindState) {
+TEST(GetJSEntryStubs) {
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
 
-  v8::UnwindState unwind_state = isolate->GetUnwindState();
-  v8::MemoryRange builtins_range = unwind_state.embedded_code_range;
-
-  // Check that each off-heap builtin is within the builtins code range.
-  if (i::FLAG_embedded_builtins) {
-    for (int id = 0; id < i::Builtins::builtin_count; id++) {
-      if (!i::Builtins::IsIsolateIndependent(id)) continue;
-      i::Code builtin = i_isolate->builtins()->builtin(id);
-      i::Address start = builtin.InstructionStart();
-      i::Address end = start + builtin.InstructionSize();
-
-      i::Address builtins_start =
-          reinterpret_cast<i::Address>(builtins_range.start);
-      CHECK(start >= builtins_start &&
-            end < builtins_start + builtins_range.length_in_bytes);
-    }
-  } else {
-    CHECK_EQ(nullptr, builtins_range.start);
-    CHECK_EQ(0, builtins_range.length_in_bytes);
-  }
-
-  v8::JSEntryStub js_entry_stub = unwind_state.js_entry_stub;
+  v8::JSEntryStubs entry_stubs = isolate->GetJSEntryStubs();
 
+  v8::JSEntryStub entry_stub = entry_stubs.js_entry_stub;
   CHECK_EQ(i_isolate->heap()->builtin(i::Builtins::kJSEntry).InstructionStart(),
-           reinterpret_cast<i::Address>(js_entry_stub.code.start));
+           reinterpret_cast<i::Address>(entry_stub.code.start));
+
+  v8::JSEntryStub construct_stub = entry_stubs.js_construct_entry_stub;
+  CHECK_EQ(i_isolate->heap()
+               ->builtin(i::Builtins::kJSConstructEntry)
+               .InstructionStart(),
+           reinterpret_cast<i::Address>(construct_stub.code.start));
+
+  v8::JSEntryStub microtask_stub = entry_stubs.js_run_microtasks_entry_stub;
+  CHECK_EQ(i_isolate->heap()
+               ->builtin(i::Builtins::kJSRunMicrotasksEntry)
+               .InstructionStart(),
+           reinterpret_cast<i::Address>(microtask_stub.code.start));
 }
 
 TEST(MicrotaskContextShouldBeNativeContext) {
diff --git a/deps/v8/test/cctest/test-assembler-arm.cc b/deps/v8/test/cctest/test-assembler-arm.cc
index bae39ba2aded77..5550a11f8e54eb 100644
--- a/deps/v8/test/cctest/test-assembler-arm.cc
+++ b/deps/v8/test/cctest/test-assembler-arm.cc
@@ -1335,12 +1335,12 @@ TEST(15) {
     __ add(r4, r0, Operand(static_cast<int32_t>(offsetof(T, vmovl_s32))));
     __ vst1(Neon8, NeonListOperand(q3), NeonMemOperand(r4));
     // Narrow what we widened.
-    __ vqmovn(NeonU16, d0, q2);
+    __ vqmovn(NeonU16, NeonU16, d0, q2);
     __ vstr(d0, r0, offsetof(T, vqmovn_u16));
     __ vmov(d1, d0);
-    __ vqmovn(NeonS8, d2, q0);
+    __ vqmovn(NeonS8, NeonS8, d2, q0);
     __ vstr(d2, r0, offsetof(T, vqmovn_s8));
-    __ vqmovn(NeonS32, d4, q3);
+    __ vqmovn(NeonS32, NeonS32, d4, q3);
     __ vstr(d4, r0, offsetof(T, vqmovn_s32));
 
     // ARM core register to scalar.
diff --git a/deps/v8/test/cctest/test-assembler-arm64.cc b/deps/v8/test/cctest/test-assembler-arm64.cc
index 44ee286587ccc4..88138153172c19 100644
--- a/deps/v8/test/cctest/test-assembler-arm64.cc
+++ b/deps/v8/test/cctest/test-assembler-arm64.cc
@@ -11818,27 +11818,27 @@ TEST(register_bit) {
   // teardown.
 
   // Simple tests.
-  CHECK(x0.bit() == (1ULL << 0));
-  CHECK(x1.bit() == (1ULL << 1));
-  CHECK(x10.bit() == (1ULL << 10));
+  CHECK_EQ(x0.bit(), 1ULL << 0);
+  CHECK_EQ(x1.bit(), 1ULL << 1);
+  CHECK_EQ(x10.bit(), 1ULL << 10);
 
   // AAPCS64 definitions.
-  CHECK(fp.bit() == (1ULL << kFramePointerRegCode));
-  CHECK(lr.bit() == (1ULL << kLinkRegCode));
+  CHECK_EQ(fp.bit(), 1ULL << kFramePointerRegCode);
+  CHECK_EQ(lr.bit(), 1ULL << kLinkRegCode);
 
   // Fixed (hardware) definitions.
-  CHECK(xzr.bit() == (1ULL << kZeroRegCode));
+  CHECK_EQ(xzr.bit(), 1ULL << kZeroRegCode);
 
   // Internal ABI definitions.
-  CHECK(sp.bit() == (1ULL << kSPRegInternalCode));
-  CHECK(sp.bit() != xzr.bit());
+  CHECK_EQ(sp.bit(), 1ULL << kSPRegInternalCode);
+  CHECK_NE(sp.bit(), xzr.bit());
 
   // xn.bit() == wn.bit() at all times, for the same n.
-  CHECK(x0.bit() == w0.bit());
-  CHECK(x1.bit() == w1.bit());
-  CHECK(x10.bit() == w10.bit());
-  CHECK(xzr.bit() == wzr.bit());
-  CHECK(sp.bit() == wsp.bit());
+  CHECK_EQ(x0.bit(), w0.bit());
+  CHECK_EQ(x1.bit(), w1.bit());
+  CHECK_EQ(x10.bit(), w10.bit());
+  CHECK_EQ(xzr.bit(), wzr.bit());
+  CHECK_EQ(sp.bit(), wsp.bit());
 }
 
 TEST(peek_poke_simple) {
@@ -12189,7 +12189,7 @@ static void PushPopSimpleHelper(int reg_count, int reg_size,
           case 2:  __ Pop(r[i], r[i+1]);         break;
           case 1:  __ Pop(r[i]);                 break;
           default:
-            CHECK(i == reg_count);
+            CHECK_EQ(i, reg_count);
             break;
         }
         break;
@@ -12338,7 +12338,7 @@ static void PushPopFPSimpleHelper(int reg_count, int reg_size,
           case 2:  __ Pop(v[i], v[i+1]);         break;
           case 1:  __ Pop(v[i]);                 break;
           default:
-            CHECK(i == reg_count);
+            CHECK_EQ(i, reg_count);
             break;
         }
         break;
@@ -12872,12 +12872,12 @@ TEST(copy_noop) {
 TEST(noreg) {
   // This test doesn't generate any code, but it verifies some invariants
   // related to NoReg.
-  CHECK(NoReg.Is(NoVReg));
-  CHECK(NoVReg.Is(NoReg));
-  CHECK(NoReg.Is(NoCPUReg));
-  CHECK(NoCPUReg.Is(NoReg));
-  CHECK(NoVReg.Is(NoCPUReg));
-  CHECK(NoCPUReg.Is(NoVReg));
+  CHECK_EQ(NoReg, NoVReg);
+  CHECK_EQ(NoVReg, NoReg);
+  CHECK_EQ(NoReg, NoCPUReg);
+  CHECK_EQ(NoCPUReg, NoReg);
+  CHECK_EQ(NoVReg, NoCPUReg);
+  CHECK_EQ(NoCPUReg, NoVReg);
 
   CHECK(NoReg.IsNone());
   CHECK(NoVReg.IsNone());
@@ -13337,24 +13337,24 @@ TEST(vreg) {
 TEST(isvalid) {
   // This test doesn't generate any code, but it verifies some invariants
   // related to IsValid().
-  CHECK(!NoReg.IsValid());
-  CHECK(!NoVReg.IsValid());
-  CHECK(!NoCPUReg.IsValid());
+  CHECK(!NoReg.is_valid());
+  CHECK(!NoVReg.is_valid());
+  CHECK(!NoCPUReg.is_valid());
 
-  CHECK(x0.IsValid());
-  CHECK(w0.IsValid());
-  CHECK(x30.IsValid());
-  CHECK(w30.IsValid());
-  CHECK(xzr.IsValid());
-  CHECK(wzr.IsValid());
+  CHECK(x0.is_valid());
+  CHECK(w0.is_valid());
+  CHECK(x30.is_valid());
+  CHECK(w30.is_valid());
+  CHECK(xzr.is_valid());
+  CHECK(wzr.is_valid());
 
-  CHECK(sp.IsValid());
-  CHECK(wsp.IsValid());
+  CHECK(sp.is_valid());
+  CHECK(wsp.is_valid());
 
-  CHECK(d0.IsValid());
-  CHECK(s0.IsValid());
-  CHECK(d31.IsValid());
-  CHECK(s31.IsValid());
+  CHECK(d0.is_valid());
+  CHECK(s0.is_valid());
+  CHECK(d31.is_valid());
+  CHECK(s31.is_valid());
 
   CHECK(x0.IsRegister());
   CHECK(w0.IsRegister());
@@ -13376,20 +13376,20 @@ TEST(isvalid) {
 
   // Test the same as before, but using CPURegister types. This shouldn't make
   // any difference.
-  CHECK(static_cast<CPURegister>(x0).IsValid());
-  CHECK(static_cast<CPURegister>(w0).IsValid());
-  CHECK(static_cast<CPURegister>(x30).IsValid());
-  CHECK(static_cast<CPURegister>(w30).IsValid());
-  CHECK(static_cast<CPURegister>(xzr).IsValid());
-  CHECK(static_cast<CPURegister>(wzr).IsValid());
+  CHECK(static_cast<CPURegister>(x0).is_valid());
+  CHECK(static_cast<CPURegister>(w0).is_valid());
+  CHECK(static_cast<CPURegister>(x30).is_valid());
+  CHECK(static_cast<CPURegister>(w30).is_valid());
+  CHECK(static_cast<CPURegister>(xzr).is_valid());
+  CHECK(static_cast<CPURegister>(wzr).is_valid());
 
-  CHECK(static_cast<CPURegister>(sp).IsValid());
-  CHECK(static_cast<CPURegister>(wsp).IsValid());
+  CHECK(static_cast<CPURegister>(sp).is_valid());
+  CHECK(static_cast<CPURegister>(wsp).is_valid());
 
-  CHECK(static_cast<CPURegister>(d0).IsValid());
-  CHECK(static_cast<CPURegister>(s0).IsValid());
-  CHECK(static_cast<CPURegister>(d31).IsValid());
-  CHECK(static_cast<CPURegister>(s31).IsValid());
+  CHECK(static_cast<CPURegister>(d0).is_valid());
+  CHECK(static_cast<CPURegister>(s0).is_valid());
+  CHECK(static_cast<CPURegister>(d31).is_valid());
+  CHECK(static_cast<CPURegister>(s31).is_valid());
 
   CHECK(static_cast<CPURegister>(x0).IsRegister());
   CHECK(static_cast<CPURegister>(w0).IsRegister());
@@ -13497,10 +13497,10 @@ TEST(cpureglist_utils_x) {
 
   CHECK(!test.IsEmpty());
 
-  CHECK(test.type() == x0.type());
+  CHECK_EQ(test.type(), x0.type());
 
-  CHECK(test.PopHighestIndex().Is(x3));
-  CHECK(test.PopLowestIndex().Is(x0));
+  CHECK_EQ(test.PopHighestIndex(), x3);
+  CHECK_EQ(test.PopLowestIndex(), x0);
 
   CHECK(test.IncludesAliasOf(x1));
   CHECK(test.IncludesAliasOf(x2));
@@ -13511,8 +13511,8 @@ TEST(cpureglist_utils_x) {
   CHECK(!test.IncludesAliasOf(w0));
   CHECK(!test.IncludesAliasOf(w3));
 
-  CHECK(test.PopHighestIndex().Is(x2));
-  CHECK(test.PopLowestIndex().Is(x1));
+  CHECK_EQ(test.PopHighestIndex(), x2);
+  CHECK_EQ(test.PopLowestIndex(), x1);
 
   CHECK(!test.IncludesAliasOf(x1));
   CHECK(!test.IncludesAliasOf(x2));
@@ -13562,10 +13562,10 @@ TEST(cpureglist_utils_w) {
 
   CHECK(!test.IsEmpty());
 
-  CHECK(test.type() == w10.type());
+  CHECK_EQ(test.type(), w10.type());
 
-  CHECK(test.PopHighestIndex().Is(w13));
-  CHECK(test.PopLowestIndex().Is(w10));
+  CHECK_EQ(test.PopHighestIndex(), w13);
+  CHECK_EQ(test.PopLowestIndex(), w10);
 
   CHECK(test.IncludesAliasOf(x11));
   CHECK(test.IncludesAliasOf(x12));
@@ -13576,8 +13576,8 @@ TEST(cpureglist_utils_w) {
   CHECK(!test.IncludesAliasOf(w10));
   CHECK(!test.IncludesAliasOf(w13));
 
-  CHECK(test.PopHighestIndex().Is(w12));
-  CHECK(test.PopLowestIndex().Is(w11));
+  CHECK_EQ(test.PopHighestIndex(), w12);
+  CHECK_EQ(test.PopLowestIndex(), w11);
 
   CHECK(!test.IncludesAliasOf(x11));
   CHECK(!test.IncludesAliasOf(x12));
@@ -13628,10 +13628,10 @@ TEST(cpureglist_utils_d) {
 
   CHECK(!test.IsEmpty());
 
-  CHECK(test.type() == d20.type());
+  CHECK_EQ(test.type(), d20.type());
 
-  CHECK(test.PopHighestIndex().Is(d23));
-  CHECK(test.PopLowestIndex().Is(d20));
+  CHECK_EQ(test.PopHighestIndex(), d23);
+  CHECK_EQ(test.PopLowestIndex(), d20);
 
   CHECK(test.IncludesAliasOf(d21));
   CHECK(test.IncludesAliasOf(d22));
@@ -13642,8 +13642,8 @@ TEST(cpureglist_utils_d) {
   CHECK(!test.IncludesAliasOf(s20));
   CHECK(!test.IncludesAliasOf(s23));
 
-  CHECK(test.PopHighestIndex().Is(d22));
-  CHECK(test.PopLowestIndex().Is(d21));
+  CHECK_EQ(test.PopHighestIndex(), d22);
+  CHECK_EQ(test.PopLowestIndex(), d21);
 
   CHECK(!test.IncludesAliasOf(d21));
   CHECK(!test.IncludesAliasOf(d22));
@@ -14700,11 +14700,11 @@ TEST(pool_size) {
   for (RelocIterator it(*code, pool_mask); !it.done(); it.next()) {
     RelocInfo* info = it.rinfo();
     if (RelocInfo::IsConstPool(info->rmode())) {
-      CHECK(info->data() == constant_pool_size);
+      CHECK_EQ(info->data(), constant_pool_size);
       ++pool_count;
     }
     if (RelocInfo::IsVeneerPool(info->rmode())) {
-      CHECK(info->data() == veneer_pool_size);
+      CHECK_EQ(info->data(), veneer_pool_size);
       ++pool_count;
     }
   }
diff --git a/deps/v8/test/cctest/test-code-pages.cc b/deps/v8/test/cctest/test-code-pages.cc
new file mode 100644
index 00000000000000..93eddb0a4c967f
--- /dev/null
+++ b/deps/v8/test/cctest/test-code-pages.cc
@@ -0,0 +1,542 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/api/api-inl.h"
+#include "src/codegen/code-desc.h"
+#include "src/common/globals.h"
+#include "src/execution/isolate.h"
+#include "src/handles/handles-inl.h"
+#include "src/heap/factory.h"
+#include "src/heap/spaces.h"
+#include "src/libsampler/sampler.h"
+#include "test/cctest/cctest.h"
+
+namespace v8 {
+namespace internal {
+namespace test_code_pages {
+
+// We have three levels of support which have different behaviors to test.
+// 1 - Have code range. ARM64 and x64
+// 2 - Have code pages. ARM32 only
+// 3 - Nothing - This feature does not work on other platforms.
+#if defined(V8_TARGET_ARCH_ARM)
+static const bool kHaveCodeRange = false;
+static const bool kHaveCodePages = true;
+#else
+static const bool kHaveCodeRange = kRequiresCodeRange;
+static const bool kHaveCodePages = false;
+#endif  // defined(V8_TARGET_ARCH_ARM)
+
+static const char* foo_source = R"(
+  function foo%d(a, b) {
+    let x = a * b;
+    let y = x ^ b;
+    let z = y / a;
+    return x + y - z;
+  };
+  %%PrepareFunctionForOptimization(foo%d);
+  foo%d(1, 2);
+  foo%d(1, 2);
+  %%OptimizeFunctionOnNextCall(foo%d);
+  foo%d(1, 2);
+)";
+
+std::string getFooCode(int n) {
+  constexpr size_t kMaxSize = 512;
+  char foo_replaced[kMaxSize];
+  CHECK_LE(n, 999999);
+  snprintf(foo_replaced, kMaxSize, foo_source, n, n, n, n, n, n);
+
+  return std::string(foo_replaced);
+}
+
+namespace {
+
+bool PagesHasExactPage(std::vector<MemoryRange>* pages, Address search_page) {
+  void* addr = reinterpret_cast<void*>(search_page);
+  auto it =
+      std::find_if(pages->begin(), pages->end(),
+                   [addr](const MemoryRange& r) { return r.start == addr; });
+  return it != pages->end();
+}
+
+bool PagesHasExactPage(std::vector<MemoryRange>* pages, Address search_page,
+                       size_t size) {
+  void* addr = reinterpret_cast<void*>(search_page);
+  auto it = std::find_if(pages->begin(), pages->end(),
+                         [addr, size](const MemoryRange& r) {
+                           return r.start == addr && r.length_in_bytes == size;
+                         });
+  return it != pages->end();
+}
+
+bool PagesContainsAddress(std::vector<MemoryRange>* pages,
+                          Address search_address) {
+  byte* addr = reinterpret_cast<byte*>(search_address);
+  auto it =
+      std::find_if(pages->begin(), pages->end(), [addr](const MemoryRange& r) {
+        const byte* page_start = reinterpret_cast<const byte*>(r.start);
+        const byte* page_end = page_start + r.length_in_bytes;
+        return addr >= page_start && addr < page_end;
+      });
+  return it != pages->end();
+}
+
+}  // namespace
+
+TEST(CodeRangeCorrectContents) {
+  if (!kHaveCodeRange) return;
+
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+
+  std::vector<MemoryRange>* pages = i_isolate->GetCodePages();
+
+  const base::AddressRegion& code_range =
+      i_isolate->heap()->memory_allocator()->code_range();
+  CHECK(!code_range.is_empty());
+  // We should only have the code range and the embedded code range.
+  CHECK_EQ(2, pages->size());
+  CHECK(PagesHasExactPage(pages, code_range.begin(), code_range.size()));
+  CHECK(PagesHasExactPage(pages,
+                          reinterpret_cast<Address>(i_isolate->embedded_blob()),
+                          i_isolate->embedded_blob_size()));
+}
+
+TEST(CodePagesCorrectContents) {
+  if (!kHaveCodePages) return;
+
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+
+  std::vector<MemoryRange>* pages = i_isolate->GetCodePages();
+  // There might be other pages already.
+  CHECK_GE(pages->size(), 1);
+
+  const base::AddressRegion& code_range =
+      i_isolate->heap()->memory_allocator()->code_range();
+  CHECK(code_range.is_empty());
+
+  // We should have the embedded code range even when there is no regular code
+  // range.
+  CHECK(PagesHasExactPage(pages,
+                          reinterpret_cast<Address>(i_isolate->embedded_blob()),
+                          i_isolate->embedded_blob_size()));
+}
+
+TEST(OptimizedCodeWithCodeRange) {
+  if (!kHaveCodeRange) return;
+
+  FLAG_allow_natives_syntax = true;
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+  HandleScope scope(i_isolate);
+
+  std::string foo_str = getFooCode(1);
+  CompileRun(foo_str.c_str());
+  v8::Local<v8::Function> local_foo = v8::Local<v8::Function>::Cast(
+      env.local()->Global()->Get(env.local(), v8_str("foo1")).ToLocalChecked());
+  Handle<JSFunction> foo =
+      Handle<JSFunction>::cast(v8::Utils::OpenHandle(*local_foo));
+
+  AbstractCode abstract_code = foo->abstract_code();
+  // We don't produce optimized code when run with --no-opt.
+  if (!abstract_code.IsCode() && FLAG_opt == false) return;
+  CHECK(abstract_code.IsCode());
+  Code foo_code = abstract_code.GetCode();
+
+  CHECK(i_isolate->heap()->InSpace(foo_code, CODE_SPACE));
+
+  std::vector<MemoryRange>* pages = i_isolate->GetCodePages();
+  CHECK(PagesContainsAddress(pages, foo_code.address()));
+}
+
+TEST(OptimizedCodeWithCodePages) {
+  if (!kHaveCodePages) return;
+  // We don't want incremental marking to start which could cause the code to
+  // not be collected on the CollectGarbage() call.
+  ManualGCScope manual_gc_scope;
+  FLAG_allow_natives_syntax = true;
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+
+  const void* created_page = nullptr;
+  int num_foos_created = 0;
+
+  {
+    HandleScope scope(i_isolate);
+
+    size_t num_code_pages = 0;
+    size_t initial_num_code_pages = 0;
+
+    // Keep generating new code until a new code page is added to the list.
+    for (int n = 0; n < 999999; n++) {
+      // Compile and optimize the code and get a reference to it.
+      std::string foo_str = getFooCode(n);
+      char foo_name[10];
+      snprintf(foo_name, sizeof(foo_name), "foo%d", n);
+      CompileRun(foo_str.c_str());
+      v8::Local<v8::Function> local_foo =
+          v8::Local<v8::Function>::Cast(env.local()
+                                            ->Global()
+                                            ->Get(env.local(), v8_str(foo_name))
+                                            .ToLocalChecked());
+      Handle<JSFunction> foo =
+          Handle<JSFunction>::cast(v8::Utils::OpenHandle(*local_foo));
+
+      AbstractCode abstract_code = foo->abstract_code();
+      // We don't produce optimized code when run with --no-opt.
+      if (!abstract_code.IsCode() && FLAG_opt == false) return;
+      CHECK(abstract_code.IsCode());
+      Code foo_code = abstract_code.GetCode();
+
+      CHECK(i_isolate->heap()->InSpace(foo_code, CODE_SPACE));
+
+      // Check that the generated code ended up in one of the code pages
+      // returned by GetCodePages().
+      byte* foo_code_ptr = reinterpret_cast<byte*>(foo_code.address());
+      std::vector<MemoryRange>* pages = i_isolate->GetCodePages();
+
+      // Wait until after we have created the first function to take the initial
+      // number of pages so that this test isn't brittle to irrelevant
+      // implementation details.
+      if (n == 0) {
+        initial_num_code_pages = pages->size();
+      }
+      num_code_pages = pages->size();
+
+      // Check that the code object was allocation on any of the pages returned
+      // by GetCodePages().
+      auto it = std::find_if(
+          pages->begin(), pages->end(), [foo_code_ptr](const MemoryRange& r) {
+            const byte* page_start = reinterpret_cast<const byte*>(r.start);
+            const byte* page_end = page_start + r.length_in_bytes;
+            return foo_code_ptr >= page_start && foo_code_ptr < page_end;
+          });
+      CHECK_NE(it, pages->end());
+
+      // Store the page that was created just for our functions - we expect it
+      // to be removed later.
+      if (num_code_pages > initial_num_code_pages) {
+        created_page = it->start;
+        num_foos_created = n + 1;
+        break;
+      }
+    }
+    CHECK_NOT_NULL(created_page);
+  }
+
+  // Now delete all our foos and force a GC and check that the page is removed
+  // from the list.
+  {
+    HandleScope scope(i_isolate);
+    for (int n = 0; n < num_foos_created; n++) {
+      char foo_name[10];
+      snprintf(foo_name, sizeof(foo_name), "foo%d", n);
+      env.local()
+          ->Global()
+          ->Set(env.local(), v8_str(foo_name), Undefined(isolate))
+          .Check();
+    }
+  }
+
+  CcTest::CollectGarbage(CODE_SPACE);
+
+  std::vector<MemoryRange>* pages = i_isolate->GetCodePages();
+  auto it = std::find_if(
+      pages->begin(), pages->end(),
+      [created_page](const MemoryRange& r) { return r.start == created_page; });
+  CHECK_EQ(it, pages->end());
+}
+
+TEST(LargeCodeObject) {
+  if (!kHaveCodeRange && !kHaveCodePages) return;
+  // We don't want incremental marking to start which could cause the code to
+  // not be collected on the CollectGarbage() call.
+  ManualGCScope manual_gc_scope;
+
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+
+  // Create a big function that ends up in CODE_LO_SPACE.
+  const int instruction_size = Page::kPageSize + 1;
+  STATIC_ASSERT(instruction_size > kMaxRegularHeapObjectSize);
+  std::unique_ptr<byte[]> instructions(new byte[instruction_size]);
+
+  CodeDesc desc;
+  desc.buffer = instructions.get();
+  desc.buffer_size = instruction_size;
+  desc.instr_size = instruction_size;
+  desc.reloc_size = 0;
+  desc.constant_pool_size = 0;
+  desc.unwinding_info = nullptr;
+  desc.unwinding_info_size = 0;
+  desc.origin = nullptr;
+
+  Address stale_code_address;
+
+  {
+    HandleScope scope(i_isolate);
+    Handle<Code> foo_code =
+        Factory::CodeBuilder(i_isolate, desc, Code::WASM_FUNCTION).Build();
+
+    CHECK(i_isolate->heap()->InSpace(*foo_code, CODE_LO_SPACE));
+
+    std::vector<MemoryRange>* pages = i_isolate->GetCodePages();
+
+    if (kHaveCodeRange) {
+      CHECK(PagesContainsAddress(pages, foo_code->address()));
+    } else {
+      CHECK(PagesHasExactPage(pages, foo_code->address()));
+    }
+
+    stale_code_address = foo_code->address();
+  }
+
+  // Delete the large code object.
+  CcTest::CollectGarbage(CODE_LO_SPACE);
+  CHECK(!i_isolate->heap()->InSpaceSlow(stale_code_address, CODE_LO_SPACE));
+
+  // Check that it was removed from CodePages.
+  std::vector<MemoryRange>* pages = i_isolate->GetCodePages();
+  CHECK(!PagesHasExactPage(pages, stale_code_address));
+}
+
+static constexpr size_t kBufSize = v8::Isolate::kMinCodePagesBufferSize;
+
+class SignalSender : public sampler::Sampler {
+ public:
+  explicit SignalSender(v8::Isolate* isolate) : sampler::Sampler(isolate) {}
+
+  // Called during the signal/thread suspension.
+  void SampleStack(const v8::RegisterState& regs) override {
+    MemoryRange* code_pages_copy = code_pages_copy_.load();
+    CHECK_NOT_NULL(code_pages_copy);
+    size_t num_pages = isolate_->CopyCodePages(kBufSize, code_pages_copy);
+    CHECK_LE(num_pages, kBufSize);
+    sample_semaphore_.Signal();
+  }
+
+  // Called on the sampling thread to trigger a sample. Blocks until the sample
+  // is finished.
+  void SampleIntoVector(MemoryRange output_buffer[]) {
+    code_pages_copy_.store(output_buffer);
+    DoSample();
+    sample_semaphore_.Wait();
+    code_pages_copy_.store(nullptr);
+  }
+
+ private:
+  base::Semaphore sample_semaphore_{0};
+  std::atomic<MemoryRange*> code_pages_copy_{nullptr};
+};
+
+class SamplingThread : public base::Thread {
+ public:
+  explicit SamplingThread(SignalSender* signal_sender)
+      : base::Thread(base::Thread::Options("SamplingThread")),
+        signal_sender_(signal_sender) {}
+
+  // Blocks until a sample is taken.
+  void TriggerSample() { signal_sender_->SampleIntoVector(code_pages_copy_); }
+
+  void Run() override {
+    while (running_.load()) {
+      TriggerSample();
+    }
+  }
+
+  // Called from the main thread. Blocks until a sample is taken. Not
+  // thread-safe so do not call while this thread is running.
+  static std::vector<MemoryRange> DoSynchronousSample(v8::Isolate* isolate) {
+    MemoryRange code_pages_copy[kBufSize];
+    size_t num_pages = isolate->CopyCodePages(kBufSize, code_pages_copy);
+    DCHECK_LE(num_pages, kBufSize);
+    return std::vector<MemoryRange>{code_pages_copy,
+                                    &code_pages_copy[num_pages]};
+  }
+
+  void Stop() { running_.store(false); }
+
+ private:
+  std::atomic_bool running_{true};
+  SignalSender* signal_sender_;
+  MemoryRange code_pages_copy_[kBufSize];
+};
+
+TEST(LargeCodeObjectWithSignalHandler) {
+  if (!kHaveCodeRange && !kHaveCodePages) return;
+  // We don't want incremental marking to start which could cause the code to
+  // not be collected on the CollectGarbage() call.
+  ManualGCScope manual_gc_scope;
+
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+
+  // Create a big function that ends up in CODE_LO_SPACE.
+  const int instruction_size = Page::kPageSize + 1;
+  STATIC_ASSERT(instruction_size > kMaxRegularHeapObjectSize);
+  std::unique_ptr<byte[]> instructions(new byte[instruction_size]);
+
+  CodeDesc desc;
+  desc.buffer = instructions.get();
+  desc.buffer_size = instruction_size;
+  desc.instr_size = instruction_size;
+  desc.reloc_size = 0;
+  desc.constant_pool_size = 0;
+  desc.unwinding_info = nullptr;
+  desc.unwinding_info_size = 0;
+  desc.origin = nullptr;
+
+  Address stale_code_address;
+
+  SignalSender signal_sender(isolate);
+  signal_sender.Start();
+  // Take an initial sample.
+  std::vector<MemoryRange> initial_pages =
+      SamplingThread::DoSynchronousSample(isolate);
+  SamplingThread sampling_thread(&signal_sender);
+
+  sampling_thread.StartSynchronously();
+
+  {
+    HandleScope scope(i_isolate);
+    Handle<Code> foo_code =
+        Factory::CodeBuilder(i_isolate, desc, Code::WASM_FUNCTION).Build();
+
+    CHECK(i_isolate->heap()->InSpace(*foo_code, CODE_LO_SPACE));
+
+    // Do a synchronous sample to ensure that we capture the state with the
+    // extra code page.
+    sampling_thread.Stop();
+    sampling_thread.Join();
+
+    // Check that the page was added.
+    std::vector<MemoryRange> pages =
+        SamplingThread::DoSynchronousSample(isolate);
+    if (kHaveCodeRange) {
+      CHECK(PagesContainsAddress(&pages, foo_code->address()));
+    } else {
+      CHECK(PagesHasExactPage(&pages, foo_code->address()));
+    }
+
+    stale_code_address = foo_code->address();
+  }
+
+  // Start async sampling again to detect threading issues.
+  sampling_thread.StartSynchronously();
+
+  // Delete the large code object.
+  CcTest::CollectGarbage(CODE_LO_SPACE);
+  CHECK(!i_isolate->heap()->InSpaceSlow(stale_code_address, CODE_LO_SPACE));
+
+  sampling_thread.Stop();
+  sampling_thread.Join();
+
+  std::vector<MemoryRange> pages = SamplingThread::DoSynchronousSample(isolate);
+  CHECK(!PagesHasExactPage(&pages, stale_code_address));
+
+  signal_sender.Stop();
+}
+
+TEST(Sorted) {
+  if (!kHaveCodeRange && !kHaveCodePages) return;
+  // We don't want incremental marking to start which could cause the code to
+  // not be collected on the CollectGarbage() call.
+  ManualGCScope manual_gc_scope;
+
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+
+  // Create a big function that ends up in CODE_LO_SPACE.
+  const int instruction_size = Page::kPageSize + 1;
+  STATIC_ASSERT(instruction_size > kMaxRegularHeapObjectSize);
+  std::unique_ptr<byte[]> instructions(new byte[instruction_size]);
+
+  CodeDesc desc;
+  desc.buffer = instructions.get();
+  desc.buffer_size = instruction_size;
+  desc.instr_size = instruction_size;
+  desc.reloc_size = 0;
+  desc.constant_pool_size = 0;
+  desc.unwinding_info = nullptr;
+  desc.unwinding_info_size = 0;
+  desc.origin = nullptr;
+
+  // Take an initial sample.
+  std::vector<MemoryRange> initial_pages =
+      SamplingThread::DoSynchronousSample(isolate);
+  size_t initial_num_pages = initial_pages.size();
+
+  auto compare = [](const MemoryRange& a, const MemoryRange& b) {
+    return a.start < b.start;
+  };
+  {
+    HandleScope outer_scope(i_isolate);
+    Handle<Code> code1, code3;
+    Address code2_address;
+
+    code1 = Factory::CodeBuilder(i_isolate, desc, Code::WASM_FUNCTION).Build();
+    CHECK(i_isolate->heap()->InSpace(*code1, CODE_LO_SPACE));
+
+    {
+      HandleScope scope(i_isolate);
+
+      // Create three large code objects, we'll delete the middle one and check
+      // everything is still sorted.
+      Handle<Code> code2 =
+          Factory::CodeBuilder(i_isolate, desc, Code::WASM_FUNCTION).Build();
+      CHECK(i_isolate->heap()->InSpace(*code2, CODE_LO_SPACE));
+      code3 =
+          Factory::CodeBuilder(i_isolate, desc, Code::WASM_FUNCTION).Build();
+      CHECK(i_isolate->heap()->InSpace(*code3, CODE_LO_SPACE));
+
+      code2_address = code2->address();
+      CHECK(i_isolate->heap()->InSpaceSlow(code1->address(), CODE_LO_SPACE));
+      CHECK(i_isolate->heap()->InSpaceSlow(code2->address(), CODE_LO_SPACE));
+      CHECK(i_isolate->heap()->InSpaceSlow(code3->address(), CODE_LO_SPACE));
+
+      // Check that the pages were added.
+      std::vector<MemoryRange> pages =
+          SamplingThread::DoSynchronousSample(isolate);
+      if (kHaveCodeRange) {
+        CHECK_EQ(pages.size(), initial_num_pages);
+      } else {
+        CHECK_EQ(pages.size(), initial_num_pages + 3);
+      }
+
+      CHECK(std::is_sorted(pages.begin(), pages.end(), compare));
+
+      code3 = scope.CloseAndEscape(code3);
+    }
+    CHECK(i_isolate->heap()->InSpaceSlow(code1->address(), CODE_LO_SPACE));
+    CHECK(i_isolate->heap()->InSpaceSlow(code2_address, CODE_LO_SPACE));
+    CHECK(i_isolate->heap()->InSpaceSlow(code3->address(), CODE_LO_SPACE));
+    // Delete code2.
+    CcTest::CollectGarbage(CODE_LO_SPACE);
+    CHECK(i_isolate->heap()->InSpaceSlow(code1->address(), CODE_LO_SPACE));
+    CHECK(!i_isolate->heap()->InSpaceSlow(code2_address, CODE_LO_SPACE));
+    CHECK(i_isolate->heap()->InSpaceSlow(code3->address(), CODE_LO_SPACE));
+
+    std::vector<MemoryRange> pages =
+        SamplingThread::DoSynchronousSample(isolate);
+    if (kHaveCodeRange) {
+      CHECK_EQ(pages.size(), initial_num_pages);
+    } else {
+      CHECK_EQ(pages.size(), initial_num_pages + 2);
+    }
+    CHECK(std::is_sorted(pages.begin(), pages.end(), compare));
+  }
+}
+
+}  // namespace test_code_pages
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/test-code-stub-assembler.cc b/deps/v8/test/cctest/test-code-stub-assembler.cc
index 45512eaf5698a9..623ff0d0f36d54 100644
--- a/deps/v8/test/cctest/test-code-stub-assembler.cc
+++ b/deps/v8/test/cctest/test-code-stub-assembler.cc
@@ -40,6 +40,7 @@ using Label = CodeAssemblerLabel;
 using Variable = CodeAssemblerVariable;
 template <class T>
 using TVariable = TypedCodeAssemblerVariable<T>;
+using PromiseResolvingFunctions = TorqueStructPromiseResolvingFunctions;
 
 Handle<String> MakeString(const char* str) {
   Isolate* isolate = CcTest::i_isolate();
@@ -70,7 +71,7 @@ TEST(CallCFunction) {
   CodeStubAssembler m(asm_tester.state());
 
   {
-    TNode<ExternalReference> const fun_constant = m.ExternalConstant(
+    const TNode<ExternalReference> fun_constant = m.ExternalConstant(
         ExternalReference::Create(reinterpret_cast<Address>(sum10)));
 
     MachineType type_intptr = MachineType::IntPtr();
@@ -104,7 +105,7 @@ TEST(CallCFunctionWithCallerSavedRegisters) {
   CodeStubAssembler m(asm_tester.state());
 
   {
-    TNode<ExternalReference> const fun_constant = m.ExternalConstant(
+    const TNode<ExternalReference> fun_constant = m.ExternalConstant(
         ExternalReference::Create(reinterpret_cast<Address>(sum3)));
 
     MachineType type_intptr = MachineType::IntPtr();
@@ -325,6 +326,104 @@ TEST(IsValidPositiveSmi) {
 #endif
 }
 
+TEST(ConvertToRelativeIndex) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+
+  const int kNumParams = 3;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  CodeStubAssembler m(asm_tester.state());
+
+  enum Result { kFound, kNotFound };
+  {
+    TNode<Number> index = m.CAST(m.Parameter(0));
+    TNode<Number> length_number = m.CAST(m.Parameter(1));
+    TNode<Number> expected_relative_index = m.CAST(m.Parameter(2));
+
+    TNode<UintPtrT> length = m.ChangeUintPtrNumberToUintPtr(length_number);
+    TNode<UintPtrT> expected =
+        m.ChangeUintPtrNumberToUintPtr(expected_relative_index);
+
+    TNode<UintPtrT> result = m.ConvertToRelativeIndex(index, length);
+
+    m.Return(m.SelectBooleanConstant(m.WordEqual(result, expected)));
+  }
+
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+
+  const double kMaxSmi = static_cast<double>(kSmiMaxValue);
+  const double kMaxInt32 =
+      static_cast<double>(std::numeric_limits<int32_t>::max());
+  const double kMaxUInt32 =
+      static_cast<double>(std::numeric_limits<uint32_t>::max());
+  const double kMaxUIntPtr =
+      static_cast<double>(std::numeric_limits<uintptr_t>::max());
+
+  struct {
+    double index;
+    double length;
+    double expected_result;
+  } test_cases[] = {
+      // Simple Smi-range cases.
+      {0, 0, 0},
+      {0, 42, 0},
+      {5, 42, 5},
+      {100, 42, 42},
+      {-10, 153, 153 - 10},
+      {-200, 153, 0},
+      // Beyond Smi-range index cases.
+      {0, kMaxSmi, 0},
+      {-153, kMaxSmi, kMaxSmi - 153},
+      {kMaxSmi + 153, kMaxSmi, kMaxSmi},
+      {kMaxSmi * 33, kMaxSmi, kMaxSmi},
+      {-kMaxSmi, kMaxSmi, 0},
+      {-kMaxSmi - 1, kMaxSmi, 0},
+      {-kMaxSmi - 153, kMaxSmi, 0},
+      {-kMaxSmi * 33, kMaxSmi, 0},
+      {-std::numeric_limits<double>::infinity(), 153, 0},
+      {std::numeric_limits<double>::infinity(), 424242, 424242},
+      // Beyond Smi-range length cases.
+      {kMaxSmi + 2, kMaxSmi + 1, kMaxSmi + 1},
+      {-kMaxSmi + 2, kMaxSmi + 1, 3},
+      {kMaxInt32 + 1, kMaxInt32, kMaxInt32},
+      {-kMaxInt32 + 1, kMaxInt32, 1},
+      {kMaxUInt32 + 1, kMaxUInt32, kMaxUInt32},
+      {-42, kMaxUInt32, kMaxUInt32 - 42},
+      {-kMaxUInt32 - 1, kMaxUInt32, 0},
+      {-kMaxUInt32, kMaxUInt32, 0},
+      {-kMaxUInt32 + 1, kMaxUInt32, 1},
+      {-kMaxUInt32 + 5, kMaxUInt32, 5},
+      {-kMaxUInt32 + 5, kMaxUInt32 + 1, 6},
+      {-kMaxSmi * 33, kMaxSmi * 153, kMaxSmi * (153 - 33)},
+      {0, kMaxSafeInteger, 0},
+      {kMaxSmi, kMaxSafeInteger, kMaxSmi},
+      {kMaxSmi * 153, kMaxSafeInteger, kMaxSmi * 153},
+      {-10, kMaxSafeInteger, kMaxSafeInteger - 10},
+      {-kMaxSafeInteger, kMaxSafeInteger, 0},
+      {-kMaxSafeInteger + 1, kMaxSafeInteger, 1},
+      {-kMaxSafeInteger + 42, kMaxSafeInteger, 42},
+      {kMaxSafeInteger - 153, kMaxSafeInteger, kMaxSafeInteger - 153},
+      {kMaxSafeInteger - 1, kMaxSafeInteger, kMaxSafeInteger - 1},
+      {kMaxSafeInteger, kMaxSafeInteger, kMaxSafeInteger},
+      {kMaxSafeInteger + 1, kMaxSafeInteger, kMaxSafeInteger},
+      {kMaxSafeInteger + 42, kMaxSafeInteger, kMaxSafeInteger},
+      {kMaxSafeInteger * 11, kMaxSafeInteger, kMaxSafeInteger},
+  };
+
+  Factory* factory = isolate->factory();
+  for (size_t i = 0; i < arraysize(test_cases); i++) {
+    if (test_cases[i].length > kMaxUIntPtr) {
+      // Test cases where length does not fit into uintptr are not valid, so
+      // skip them instead of ifdef'ing the test cases above.
+      continue;
+    }
+    Handle<Object> index = factory->NewNumber(test_cases[i].index);
+    Handle<Object> length = factory->NewNumber(test_cases[i].length);
+    Handle<Object> expected = factory->NewNumber(test_cases[i].expected_result);
+
+    ft.CheckTrue(index, length, expected);
+  }
+}
+
 TEST(FixedArrayAccessSmiIndex) {
   Isolate* isolate(CcTest::InitIsolateOnce());
   CodeAssemblerTester asm_tester(isolate);
@@ -368,7 +467,7 @@ TEST(DecodeWordFromWord32) {
   CodeAssemblerTester asm_tester(isolate);
   CodeStubAssembler m(asm_tester.state());
 
-  using TestBitField = BitField<unsigned, 3, 3>;
+  using TestBitField = base::BitField<unsigned, 3, 3>;
   m.Return(m.SmiTag(
       m.Signed(m.DecodeWordFromWord32<TestBitField>(m.Int32Constant(0x2F)))));
   FunctionTester ft(asm_tester.GenerateCode());
@@ -401,7 +500,8 @@ TEST(ComputeIntegerHash) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   CodeStubAssembler m(asm_tester.state());
 
-  m.Return(m.SmiFromInt32(m.ComputeSeededHash(m.SmiUntag(m.Parameter(0)))));
+  m.Return(m.SmiFromInt32(m.UncheckedCast<Int32T>(
+      m.ComputeSeededHash(m.SmiUntag(m.Parameter(0))))));
 
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
 
@@ -496,6 +596,7 @@ TEST(TryToName) {
     {
       TYPED_VARIABLE_DEF(IntPtrT, var_index, &m);
       TYPED_VARIABLE_DEF(Name, var_unique, &m);
+      TYPED_VARIABLE_DEF(IntPtrT, var_expected, &m);
 
       m.TryToName(key, &if_keyisindex, &var_index, &if_keyisunique, &var_unique,
                   &if_bailout);
@@ -504,9 +605,26 @@ TEST(TryToName) {
       m.GotoIfNot(m.TaggedEqual(expected_result,
                                 m.SmiConstant(Smi::FromInt(kKeyIsIndex))),
                   &failed);
-      m.Branch(
-          m.IntPtrEqual(m.SmiUntag(m.CAST(expected_arg)), var_index.value()),
-          &passed, &failed);
+
+      Label if_expectedissmi(&m), if_expectedisheapnumber(&m), check_result(&m);
+      m.Branch(m.TaggedIsSmi(expected_arg), &if_expectedissmi,
+               &if_expectedisheapnumber);
+
+      m.BIND(&if_expectedissmi);
+      var_expected = m.SmiUntag(m.CAST(expected_arg));
+      m.Goto(&check_result);
+
+      m.BIND(&if_expectedisheapnumber);
+      CSA_ASSERT(&m, m.IsHeapNumber(m.CAST(expected_arg)));
+      TNode<Float64T> value = m.LoadHeapNumberValue(m.CAST(expected_arg));
+      // We know this to be safe as all expected values are in intptr
+      // range.
+      var_expected = m.UncheckedCast<IntPtrT>(m.ChangeFloat64ToUintPtr(value));
+      m.Goto(&check_result);
+
+      m.BIND(&check_result);
+      m.Branch(m.IntPtrEqual(var_expected.value(), var_index.value()), &passed,
+               &failed);
 
       m.BIND(&if_keyisunique);
       m.GotoIfNot(m.TaggedEqual(expected_result,
@@ -536,7 +654,7 @@ TEST(TryToName) {
 
   {
     // TryToName(<zero smi>) => if_keyisindex: smi value.
-    Handle<Object> key(Smi::kZero, isolate);
+    Handle<Object> key(Smi::zero(), isolate);
     ft.CheckTrue(key, expect_index, key);
   }
 
@@ -609,12 +727,29 @@ TEST(TryToName) {
   }
 
   {
-    // TryToName(<internalized uncacheable number string>) => bailout
+    // TryToName(<internalized uncacheable number string greater than
+    // array index>) => is_keyisunique: <internalized string>.
+    Handle<Object> key =
+        isolate->factory()->InternalizeUtf8String("4294967296");
+    ft.CheckTrue(key, expect_unique, key);
+  }
+
+  {
+    // TryToName(<internalized uncacheable number string greater than
+    // INT_MAX but less than array index>) => bailout.
     Handle<Object> key =
         isolate->factory()->InternalizeUtf8String("4294967294");
     ft.CheckTrue(key, expect_bailout);
   }
 
+  {
+    // TryToName(<internalized uncacheable number string less than
+    // INT_MAX>) => bailout
+    Handle<Object> key =
+        isolate->factory()->InternalizeUtf8String("2147483647");
+    ft.CheckTrue(key, expect_bailout);
+  }
+
   {
     // TryToName(<non-internalized number string>) => if_keyisindex: number.
     Handle<String> key = isolate->factory()->NewStringFromAsciiChecked("153");
@@ -627,7 +762,7 @@ TEST(TryToName) {
   }
 
   {
-    // TryToName(<number string without cached index>) => bailout.
+    // TryToName(<number string without cached index>) => is_keyisindex: number.
     Handle<String> key = isolate->factory()->NewStringFromAsciiChecked("153");
     CHECK(!key->HasHashCode());
     ft.CheckTrue(key, expect_bailout);
@@ -679,7 +814,8 @@ void TestEntryToIndex() {
        entry = entry * 1.01 + 1) {
     Handle<Object> result =
         ft.Call(handle(Smi::FromInt(entry), isolate)).ToHandleChecked();
-    CHECK_EQ(Dictionary::EntryToIndex(entry), Smi::ToInt(*result));
+    CHECK_EQ(Dictionary::EntryToIndex(InternalIndex(entry)),
+             Smi::ToInt(*result));
   }
 }
 
@@ -759,10 +895,10 @@ void TestNameDictionaryLookup() {
   }
 
   for (size_t i = 0; i < arraysize(keys); i++) {
-    int entry = dictionary->FindEntry(isolate, keys[i]);
+    InternalIndex entry = dictionary->FindEntry(isolate, keys[i]);
     int name_index =
         Dictionary::EntryToIndex(entry) + Dictionary::kEntryKeyIndex;
-    CHECK_NE(Dictionary::kNotFound, entry);
+    CHECK(entry.is_found());
 
     Handle<Object> expected_name_index(Smi::FromInt(name_index), isolate);
     ft.CheckTrue(dictionary, keys[i], expect_found, expected_name_index);
@@ -781,8 +917,8 @@ void TestNameDictionaryLookup() {
   };
 
   for (size_t i = 0; i < arraysize(non_existing_keys); i++) {
-    int entry = dictionary->FindEntry(isolate, non_existing_keys[i]);
-    CHECK_EQ(Dictionary::kNotFound, entry);
+    InternalIndex entry = dictionary->FindEntry(isolate, non_existing_keys[i]);
+    CHECK(entry.is_not_found());
 
     ft.CheckTrue(dictionary, non_existing_keys[i], expect_not_found);
   }
@@ -851,8 +987,7 @@ TEST(NumberDictionaryLookup) {
   for (int i = 0; i < kKeysCount; i++) {
     int random_key = rand_gen.NextInt(Smi::kMaxValue);
     keys[i] = static_cast<uint32_t>(random_key);
-    if (dictionary->FindEntry(isolate, keys[i]) != NumberDictionary::kNotFound)
-      continue;
+    if (dictionary->FindEntry(isolate, keys[i]).is_found()) continue;
 
     dictionary = NumberDictionary::Add(isolate, dictionary, keys[i], fake_value,
                                        fake_details);
@@ -860,19 +995,19 @@ TEST(NumberDictionaryLookup) {
 
   // Now try querying existing keys.
   for (int i = 0; i < kKeysCount; i++) {
-    int entry = dictionary->FindEntry(isolate, keys[i]);
-    CHECK_NE(NumberDictionary::kNotFound, entry);
+    InternalIndex entry = dictionary->FindEntry(isolate, keys[i]);
+    CHECK(entry.is_found());
 
     Handle<Object> key(Smi::FromInt(keys[i]), isolate);
-    Handle<Object> expected_entry(Smi::FromInt(entry), isolate);
+    Handle<Object> expected_entry(Smi::FromInt(entry.as_int()), isolate);
     ft.CheckTrue(dictionary, key, expect_found, expected_entry);
   }
 
   // Now try querying random keys which do not exist in the dictionary.
   for (int i = 0; i < kKeysCount;) {
     int random_key = rand_gen.NextInt(Smi::kMaxValue);
-    int entry = dictionary->FindEntry(isolate, random_key);
-    if (entry != NumberDictionary::kNotFound) continue;
+    InternalIndex entry = dictionary->FindEntry(isolate, random_key);
+    if (entry.is_found()) continue;
     i++;
 
     Handle<Object> key(Smi::FromInt(random_key), isolate);
@@ -1262,11 +1397,11 @@ TEST(TryGetOwnProperty) {
   Handle<Symbol> not_found_symbol = factory->NewSymbol();
   Handle<Symbol> bailout_symbol = factory->NewSymbol();
   {
-    Node* object = m.Parameter(0);
-    Node* unique_name = m.Parameter(1);
-    Node* context = m.Parameter(kNumParams + 2);
+    TNode<JSReceiver> object = m.CAST(m.Parameter(0));
+    TNode<Name> unique_name = m.CAST(m.Parameter(1));
+    TNode<Context> context = m.CAST(m.Parameter(kNumParams + 2));
 
-    Variable var_value(&m, MachineRepresentation::kTagged);
+    TVariable<Object> var_value(&m);
     Label if_found(&m), if_not_found(&m), if_bailout(&m);
 
     TNode<Map> map = m.LoadMap(object);
@@ -1277,7 +1412,7 @@ TEST(TryGetOwnProperty) {
                         &if_bailout);
 
     m.BIND(&if_found);
-    m.Return(var_value.value());
+    m.Return(m.UncheckedCast<Object>(var_value.value()));
 
     m.BIND(&if_not_found);
     m.Return(m.HeapConstant(not_found_symbol));
@@ -1482,7 +1617,7 @@ TEST(TryLookupElement) {
 
   enum Result { kFound, kAbsent, kNotFound, kBailout };
   {
-    Node* object = m.Parameter(0);
+    TNode<HeapObject> object = m.CAST(m.Parameter(0));
     TNode<IntPtrT> index = m.SmiUntag(m.Parameter(1));
     TNode<MaybeObject> expected_result =
         m.UncheckedCast<MaybeObject>(m.Parameter(2));
@@ -1526,7 +1661,7 @@ TEST(TryLookupElement) {
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
 
   Factory* factory = isolate->factory();
-  Handle<Object> smi0(Smi::kZero, isolate);
+  Handle<Object> smi0(Smi::zero(), isolate);
   Handle<Object> smi1(Smi::FromInt(1), isolate);
   Handle<Object> smi7(Smi::FromInt(7), isolate);
   Handle<Object> smi13(Smi::FromInt(13), isolate);
@@ -1545,15 +1680,13 @@ TEST(TryLookupElement) {
   CHECK(!JSReceiver::HasElement(object, index).FromJust()); \
   ft.CheckTrue(object, smi##index, expect_not_found);
 
-#define CHECK_ABSENT(object, index)                                        \
-  {                                                                        \
-    bool success;                                                          \
-    Handle<Smi> smi(Smi::FromInt(index), isolate);                         \
-    LookupIterator it =                                                    \
-        LookupIterator::PropertyOrElement(isolate, object, smi, &success); \
-    CHECK(success);                                                        \
-    CHECK(!JSReceiver::HasProperty(&it).FromJust());                       \
-    ft.CheckTrue(object, smi, expect_absent);                              \
+#define CHECK_ABSENT(object, index)                  \
+  {                                                  \
+    Handle<Smi> smi(Smi::FromInt(index), isolate);   \
+    LookupIterator::Key key(isolate, smi);           \
+    LookupIterator it(isolate, object, key);         \
+    CHECK(!JSReceiver::HasProperty(&it).FromJust()); \
+    ft.CheckTrue(object, smi, expect_absent);        \
   }
 
   {
@@ -1622,11 +1755,11 @@ TEST(TryLookupElement) {
     CHECK_ABSENT(object, 13);
     CHECK_ABSENT(object, 42);
 
-    v8::ArrayBuffer::Contents contents = buffer->Externalize();
-    buffer->Detach();
-    contents.Deleter()(contents.Data(), contents.ByteLength(),
-                       contents.DeleterData());
-
+    {
+      std::shared_ptr<v8::BackingStore> backing_store =
+          buffer->GetBackingStore();
+      buffer->Detach();
+    }
     CHECK_ABSENT(object, 0);
     CHECK_ABSENT(object, 1);
     CHECK_ABSENT(object, -10);
@@ -1681,6 +1814,7 @@ TEST(TryLookupElement) {
 
 #undef CHECK_FOUND
 #undef CHECK_NOT_FOUND
+#undef CHECK_ABSENT
 
   {
     Handle<JSArray> handler = factory->NewJSArray(0);
@@ -1713,9 +1847,9 @@ TEST(AllocateJSObjectFromMap) {
   CodeStubAssembler m(asm_tester.state());
 
   {
-    Node* map = m.Parameter(0);
-    Node* properties = m.Parameter(1);
-    Node* elements = m.Parameter(2);
+    TNode<Map> map = m.CAST(m.Parameter(0));
+    TNode<HeapObject> properties = m.CAST(m.Parameter(1));
+    TNode<FixedArray> elements = m.CAST(m.Parameter(2));
 
     TNode<JSObject> result =
         m.AllocateJSObjectFromMap(map, properties, elements);
@@ -1776,7 +1910,6 @@ TEST(AllocateJSObjectFromMap) {
     isolate->heap()->Verify();
 #endif
   }
-#undef VERIFY
 }
 
 TEST(AllocateNameDictionary) {
@@ -1867,9 +2000,10 @@ TEST(OneToTwoByteStringCopy) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   StringBuiltinsAssembler m(asm_tester.state());
 
-  m.CopyStringCharacters(m.Parameter(0), m.Parameter(1), m.IntPtrConstant(0),
-                         m.IntPtrConstant(0), m.IntPtrConstant(5),
-                         String::ONE_BYTE_ENCODING, String::TWO_BYTE_ENCODING);
+  m.CopyStringCharacters<String>(m.CAST(m.Parameter(0)), m.CAST(m.Parameter(1)),
+                                 m.IntPtrConstant(0), m.IntPtrConstant(0),
+                                 m.IntPtrConstant(5), String::ONE_BYTE_ENCODING,
+                                 String::TWO_BYTE_ENCODING);
   m.Return(m.SmiConstant(Smi::FromInt(0)));
 
   Handle<String> string1 = isolate->factory()->InternalizeUtf8String("abcde");
@@ -1899,9 +2033,10 @@ TEST(OneToOneByteStringCopy) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   StringBuiltinsAssembler m(asm_tester.state());
 
-  m.CopyStringCharacters(m.Parameter(0), m.Parameter(1), m.IntPtrConstant(0),
-                         m.IntPtrConstant(0), m.IntPtrConstant(5),
-                         String::ONE_BYTE_ENCODING, String::ONE_BYTE_ENCODING);
+  m.CopyStringCharacters<String>(m.CAST(m.Parameter(0)), m.CAST(m.Parameter(1)),
+                                 m.IntPtrConstant(0), m.IntPtrConstant(0),
+                                 m.IntPtrConstant(5), String::ONE_BYTE_ENCODING,
+                                 String::ONE_BYTE_ENCODING);
   m.Return(m.SmiConstant(Smi::FromInt(0)));
 
   Handle<String> string1 = isolate->factory()->InternalizeUtf8String("abcde");
@@ -1931,9 +2066,10 @@ TEST(OneToOneByteStringCopyNonZeroStart) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   StringBuiltinsAssembler m(asm_tester.state());
 
-  m.CopyStringCharacters(m.Parameter(0), m.Parameter(1), m.IntPtrConstant(0),
-                         m.IntPtrConstant(3), m.IntPtrConstant(2),
-                         String::ONE_BYTE_ENCODING, String::ONE_BYTE_ENCODING);
+  m.CopyStringCharacters<String>(m.CAST(m.Parameter(0)), m.CAST(m.Parameter(1)),
+                                 m.IntPtrConstant(0), m.IntPtrConstant(3),
+                                 m.IntPtrConstant(2), String::ONE_BYTE_ENCODING,
+                                 String::ONE_BYTE_ENCODING);
   m.Return(m.SmiConstant(Smi::FromInt(0)));
 
   Handle<String> string1 = isolate->factory()->InternalizeUtf8String("abcde");
@@ -1960,9 +2096,10 @@ TEST(TwoToTwoByteStringCopy) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   StringBuiltinsAssembler m(asm_tester.state());
 
-  m.CopyStringCharacters(m.Parameter(0), m.Parameter(1), m.IntPtrConstant(0),
-                         m.IntPtrConstant(0), m.IntPtrConstant(5),
-                         String::TWO_BYTE_ENCODING, String::TWO_BYTE_ENCODING);
+  m.CopyStringCharacters<String>(m.CAST(m.Parameter(0)), m.CAST(m.Parameter(1)),
+                                 m.IntPtrConstant(0), m.IntPtrConstant(0),
+                                 m.IntPtrConstant(5), String::TWO_BYTE_ENCODING,
+                                 String::TWO_BYTE_ENCODING);
   m.Return(m.SmiConstant(Smi::FromInt(0)));
 
   uc16 array1[] = {2000, 2001, 2002, 2003, 2004};
@@ -2312,7 +2449,7 @@ TEST(IsPromiseHookEnabled) {
   CHECK_EQ(ReadOnlyRoots(isolate).false_value(), *result);
 }
 
-TEST(AllocateAndInitJSPromise) {
+TEST(NewJSPromise) {
   Isolate* isolate(CcTest::InitIsolateOnce());
 
   const int kNumParams = 1;
@@ -2320,7 +2457,7 @@ TEST(AllocateAndInitJSPromise) {
   PromiseBuiltinsAssembler m(asm_tester.state());
 
   Node* const context = m.Parameter(kNumParams + 2);
-  TNode<JSPromise> const promise = m.AllocateAndInitJSPromise(m.CAST(context));
+  const TNode<JSPromise> promise = m.NewJSPromise(m.CAST(context));
   m.Return(promise);
 
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
@@ -2329,7 +2466,7 @@ TEST(AllocateAndInitJSPromise) {
   CHECK(result->IsJSPromise());
 }
 
-TEST(AllocateAndSetJSPromise) {
+TEST(NewJSPromise2) {
   Isolate* isolate(CcTest::InitIsolateOnce());
 
   const int kNumParams = 1;
@@ -2337,8 +2474,8 @@ TEST(AllocateAndSetJSPromise) {
   PromiseBuiltinsAssembler m(asm_tester.state());
 
   Node* const context = m.Parameter(kNumParams + 2);
-  TNode<JSPromise> const promise = m.AllocateAndSetJSPromise(
-      m.CAST(context), v8::Promise::kRejected, m.SmiConstant(1));
+  const TNode<JSPromise> promise =
+      m.NewJSPromise(m.CAST(context), v8::Promise::kRejected, m.SmiConstant(1));
   m.Return(promise);
 
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
@@ -2400,8 +2537,8 @@ TEST(PromiseHasHandler) {
   PromiseBuiltinsAssembler m(asm_tester.state());
 
   Node* const context = m.Parameter(kNumParams + 2);
-  TNode<JSPromise> const promise =
-      m.AllocateAndInitJSPromise(m.CAST(context), m.UndefinedConstant());
+  const TNode<JSPromise> promise =
+      m.NewJSPromise(m.CAST(context), m.UndefinedConstant());
   m.Return(m.SelectBooleanConstant(m.PromiseHasHandler(promise)));
 
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
@@ -2417,13 +2554,13 @@ TEST(CreatePromiseResolvingFunctionsContext) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   PromiseBuiltinsAssembler m(asm_tester.state());
 
-  Node* const context = m.Parameter(kNumParams + 2);
-  TNode<NativeContext> const native_context = m.LoadNativeContext(context);
+  const TNode<Context> context = m.CAST(m.Parameter(kNumParams + 2));
+  const TNode<NativeContext> native_context = m.LoadNativeContext(context);
   const TNode<JSPromise> promise =
-      m.AllocateAndInitJSPromise(m.CAST(context), m.UndefinedConstant());
-  TNode<Context> const promise_context =
+      m.NewJSPromise(context, m.UndefinedConstant());
+  const TNode<Context> promise_context =
       m.CreatePromiseResolvingFunctionsContext(
-          promise, m.BooleanConstant(false), native_context);
+          context, promise, m.BooleanConstant(false), native_context);
   m.Return(promise_context);
 
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
@@ -2432,7 +2569,6 @@ TEST(CreatePromiseResolvingFunctionsContext) {
   CHECK(result->IsContext());
   Handle<Context> context_js = Handle<Context>::cast(result);
   CHECK_EQ(isolate->native_context()->scope_info(), context_js->scope_info());
-  CHECK_EQ(ReadOnlyRoots(isolate).the_hole_value(), context_js->extension());
   CHECK_EQ(*isolate->native_context(), context_js->native_context());
   CHECK(context_js->get(PromiseBuiltins::kPromiseSlot).IsJSPromise());
   CHECK_EQ(ReadOnlyRoots(isolate).false_value(),
@@ -2447,12 +2583,12 @@ TEST(CreatePromiseResolvingFunctions) {
   PromiseBuiltinsAssembler m(asm_tester.state());
 
   Node* const context = m.Parameter(kNumParams + 2);
-  TNode<NativeContext> const native_context = m.LoadNativeContext(context);
+  const TNode<NativeContext> native_context = m.LoadNativeContext(context);
   const TNode<JSPromise> promise =
-      m.AllocateAndInitJSPromise(m.CAST(context), m.UndefinedConstant());
-  Node *resolve, *reject;
-  std::tie(resolve, reject) = m.CreatePromiseResolvingFunctions(
-      promise, m.BooleanConstant(false), native_context);
+      m.NewJSPromise(m.CAST(context), m.UndefinedConstant());
+  PromiseResolvingFunctions funcs = m.CreatePromiseResolvingFunctions(
+      m.CAST(context), promise, m.BooleanConstant(false), native_context);
+  Node *resolve = funcs.resolve, *reject = funcs.reject;
   TNode<IntPtrT> const kSize = m.IntPtrConstant(2);
   TNode<FixedArray> const arr =
       m.Cast(m.AllocateFixedArray(PACKED_ELEMENTS, kSize));
@@ -2473,8 +2609,8 @@ TEST(NewElementsCapacity) {
   Isolate* isolate(CcTest::InitIsolateOnce());
   CodeAssemblerTester asm_tester(isolate, 1);
   CodeStubAssembler m(asm_tester.state());
-  m.Return(m.SmiTag(m.CalculateNewElementsCapacity(
-      m.SmiUntag(m.Parameter(0)), CodeStubAssembler::INTPTR_PARAMETERS)));
+  m.Return(
+      m.SmiTag(m.CalculateNewElementsCapacity(m.SmiUntag(m.Parameter(0)))));
 
   FunctionTester ft(asm_tester.GenerateCode(), 1);
   Handle<Smi> test_value = Handle<Smi>(Smi::FromInt(0), isolate);
@@ -2503,8 +2639,8 @@ TEST(NewElementsCapacitySmi) {
   Isolate* isolate(CcTest::InitIsolateOnce());
   CodeAssemblerTester asm_tester(isolate, 1);
   CodeStubAssembler m(asm_tester.state());
-  m.Return(m.CalculateNewElementsCapacity(m.Parameter(0),
-                                          CodeStubAssembler::SMI_PARAMETERS));
+  m.Return(
+      m.CalculateNewElementsCapacity(m.UncheckedCast<Smi>(m.Parameter(0))));
 
   FunctionTester ft(asm_tester.GenerateCode(), 1);
   Handle<Smi> test_value = Handle<Smi>(Smi::FromInt(0), isolate);
@@ -2536,18 +2672,18 @@ TEST(AllocateFunctionWithMapAndContext) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   PromiseBuiltinsAssembler m(asm_tester.state());
 
-  Node* const context = m.Parameter(kNumParams + 2);
-  TNode<NativeContext> const native_context = m.LoadNativeContext(context);
+  const TNode<Context> context = m.CAST(m.Parameter(kNumParams + 2));
+  const TNode<NativeContext> native_context = m.LoadNativeContext(context);
   const TNode<JSPromise> promise =
-      m.AllocateAndInitJSPromise(m.CAST(context), m.UndefinedConstant());
+      m.NewJSPromise(context, m.UndefinedConstant());
   TNode<Context> promise_context = m.CreatePromiseResolvingFunctionsContext(
-      promise, m.BooleanConstant(false), native_context);
+      context, promise, m.BooleanConstant(false), native_context);
   TNode<Object> resolve_info = m.LoadContextElement(
       native_context,
       Context::PROMISE_CAPABILITY_DEFAULT_RESOLVE_SHARED_FUN_INDEX);
-  TNode<Object> const map = m.LoadContextElement(
+  const TNode<Object> map = m.LoadContextElement(
       native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
-  TNode<JSFunction> const resolve = m.AllocateFunctionWithMapAndContext(
+  const TNode<JSFunction> resolve = m.AllocateFunctionWithMapAndContext(
       m.CAST(map), m.CAST(resolve_info), promise_context);
   m.Return(resolve);
 
@@ -2574,19 +2710,13 @@ TEST(CreatePromiseGetCapabilitiesExecutorContext) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   PromiseBuiltinsAssembler m(asm_tester.state());
 
-  Node* const context = m.Parameter(kNumParams + 2);
-  TNode<NativeContext> const native_context = m.LoadNativeContext(context);
-
-  TNode<Map> const map = m.PromiseCapabilityMapConstant();
-  Node* const capability = m.AllocateStruct(map);
-  m.StoreObjectFieldNoWriteBarrier(
-      capability, PromiseCapability::kPromiseOffset, m.UndefinedConstant());
-  m.StoreObjectFieldNoWriteBarrier(
-      capability, PromiseCapability::kResolveOffset, m.UndefinedConstant());
-  m.StoreObjectFieldNoWriteBarrier(capability, PromiseCapability::kRejectOffset,
-                                   m.UndefinedConstant());
-  Node* const executor_context =
-      m.CreatePromiseGetCapabilitiesExecutorContext(capability, native_context);
+  TNode<Context> context = m.CAST(m.Parameter(kNumParams + 2));
+  TNode<NativeContext> native_context = m.LoadNativeContext(context);
+
+  TNode<PromiseCapability> capability = m.CreatePromiseCapability(
+      m.UndefinedConstant(), m.UndefinedConstant(), m.UndefinedConstant());
+  TNode<Context> executor_context =
+      m.CreatePromiseCapabilitiesExecutorContext(native_context, capability);
   m.Return(executor_context);
 
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
@@ -2596,7 +2726,6 @@ TEST(CreatePromiseGetCapabilitiesExecutorContext) {
   Handle<Context> context_js = Handle<Context>::cast(result_obj);
   CHECK_EQ(PromiseBuiltins::kCapabilitiesContextLength, context_js->length());
   CHECK_EQ(isolate->native_context()->scope_info(), context_js->scope_info());
-  CHECK_EQ(ReadOnlyRoots(isolate).the_hole_value(), context_js->extension());
   CHECK_EQ(*isolate->native_context(), context_js->native_context());
   CHECK(
       context_js->get(PromiseBuiltins::kCapabilitySlot).IsPromiseCapability());
@@ -2611,12 +2740,12 @@ TEST(NewPromiseCapability) {
     PromiseBuiltinsAssembler m(asm_tester.state());
 
     Node* const context = m.Parameter(kNumParams + 2);
-    TNode<NativeContext> const native_context = m.LoadNativeContext(context);
-    TNode<Object> const promise_constructor =
+    const TNode<NativeContext> native_context = m.LoadNativeContext(context);
+    const TNode<Object> promise_constructor =
         m.LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
 
-    TNode<Oddball> const debug_event = m.TrueConstant();
-    TNode<Object> const capability =
+    const TNode<Oddball> debug_event = m.TrueConstant();
+    const TNode<Object> capability =
         m.CallBuiltin(Builtins::kNewPromiseCapability, context,
                       promise_constructor, debug_event);
     m.Return(capability);
@@ -2644,7 +2773,6 @@ TEST(NewPromiseCapability) {
     for (auto&& callback : callbacks) {
       Handle<Context> context(Context::cast(callback->context()), isolate);
       CHECK_EQ(isolate->native_context()->scope_info(), context->scope_info());
-      CHECK_EQ(ReadOnlyRoots(isolate).the_hole_value(), context->extension());
       CHECK_EQ(*isolate->native_context(), context->native_context());
       CHECK_EQ(PromiseBuiltins::kPromiseContextLength, context->length());
       CHECK_EQ(context->get(PromiseBuiltins::kPromiseSlot), result->promise());
@@ -2659,8 +2787,8 @@ TEST(NewPromiseCapability) {
     Node* const context = m.Parameter(kNumParams + 2);
 
     Node* const constructor = m.Parameter(1);
-    TNode<Oddball> const debug_event = m.TrueConstant();
-    TNode<Object> const capability = m.CallBuiltin(
+    const TNode<Oddball> debug_event = m.TrueConstant();
+    const TNode<Object> capability = m.CallBuiltin(
         Builtins::kNewPromiseCapability, context, constructor, debug_event);
     m.Return(capability);
 
@@ -2725,12 +2853,11 @@ TEST(DirectMemoryTest8BitWord32Immediate) {
   const int element_count = 8;
   Label bad(&m);
 
-  TNode<IntPtrT> buffer_node =
-      m.IntPtrConstant(reinterpret_cast<intptr_t>(buffer));
+  TNode<RawPtrT> buffer_node = m.PointerConstant(buffer);
   for (size_t i = 0; i < element_count; ++i) {
     for (size_t j = 0; j < element_count; ++j) {
-      Node* loaded = m.LoadBufferObject(buffer_node, static_cast<int>(i),
-                                        MachineType::Uint8());
+      TNode<Uint8T> loaded =
+          m.LoadBufferData<Uint8T>(buffer_node, static_cast<int>(i));
       TNode<Word32T> masked = m.Word32And(loaded, m.Int32Constant(buffer[j]));
       if ((buffer[j] & buffer[i]) != 0) {
         m.GotoIf(m.Word32Equal(masked, m.Int32Constant(0)), &bad);
@@ -2758,13 +2885,11 @@ TEST(DirectMemoryTest16BitWord32Immediate) {
   const int element_count = 8;
   Label bad(&m);
 
-  TNode<IntPtrT> buffer_node =
-      m.IntPtrConstant(reinterpret_cast<intptr_t>(buffer));
+  TNode<RawPtrT> buffer_node = m.PointerConstant(buffer);
   for (size_t i = 0; i < element_count; ++i) {
     for (size_t j = 0; j < element_count; ++j) {
-      Node* loaded =
-          m.LoadBufferObject(buffer_node, static_cast<int>(i * sizeof(int16_t)),
-                             MachineType::Uint16());
+      TNode<Uint16T> loaded = m.LoadBufferData<Uint16T>(
+          buffer_node, static_cast<int>(i * sizeof(int16_t)));
       TNode<Word32T> masked = m.Word32And(loaded, m.Int32Constant(buffer[j]));
       if ((buffer[j] & buffer[i]) != 0) {
         m.GotoIf(m.Word32Equal(masked, m.Int32Constant(0)), &bad);
@@ -2791,19 +2916,17 @@ TEST(DirectMemoryTest8BitWord32) {
   int8_t buffer[] = {1, 2, 4, 8, 17, 33, 65, 127, 67, 38};
   const int element_count = 10;
   Label bad(&m);
-  Node* constants[element_count];
+  TNode<Uint32T> constants[element_count];
 
-  TNode<IntPtrT> buffer_node =
-      m.IntPtrConstant(reinterpret_cast<intptr_t>(buffer));
+  TNode<RawPtrT> buffer_node = m.PointerConstant(buffer);
   for (size_t i = 0; i < element_count; ++i) {
-    constants[i] = m.LoadBufferObject(buffer_node, static_cast<int>(i),
-                                      MachineType::Uint8());
+    constants[i] = m.LoadBufferData<Uint8T>(buffer_node, static_cast<int>(i));
   }
 
   for (size_t i = 0; i < element_count; ++i) {
     for (size_t j = 0; j < element_count; ++j) {
-      Node* loaded = m.LoadBufferObject(buffer_node, static_cast<int>(i),
-                                        MachineType::Uint8());
+      TNode<Uint8T> loaded =
+          m.LoadBufferData<Uint8T>(buffer_node, static_cast<int>(i));
       TNode<Word32T> masked = m.Word32And(loaded, constants[j]);
       if ((buffer[j] & buffer[i]) != 0) {
         m.GotoIf(m.Word32Equal(masked, m.Int32Constant(0)), &bad);
@@ -2837,23 +2960,19 @@ TEST(DirectMemoryTest16BitWord32) {
   int16_t buffer[] = {1, 2, 4, 8, 12345, 33, 65, 255, 67, 3823};
   const int element_count = 10;
   Label bad(&m);
-  Node* constants[element_count];
+  TNode<Uint32T> constants[element_count];
 
-  TNode<IntPtrT> buffer_node1 =
-      m.IntPtrConstant(reinterpret_cast<intptr_t>(buffer));
+  TNode<RawPtrT> buffer_node1 = m.PointerConstant(buffer);
   for (size_t i = 0; i < element_count; ++i) {
-    constants[i] =
-        m.LoadBufferObject(buffer_node1, static_cast<int>(i * sizeof(int16_t)),
-                           MachineType::Uint16());
+    constants[i] = m.LoadBufferData<Uint16T>(
+        buffer_node1, static_cast<int>(i * sizeof(int16_t)));
   }
-  TNode<IntPtrT> buffer_node2 =
-      m.IntPtrConstant(reinterpret_cast<intptr_t>(buffer));
+  TNode<RawPtrT> buffer_node2 = m.PointerConstant(buffer);
 
   for (size_t i = 0; i < element_count; ++i) {
     for (size_t j = 0; j < element_count; ++j) {
-      Node* loaded = m.LoadBufferObject(buffer_node1,
-                                        static_cast<int>(i * sizeof(int16_t)),
-                                        MachineType::Uint16());
+      Node* loaded = m.LoadBufferData<Uint16T>(
+          buffer_node1, static_cast<int>(i * sizeof(int16_t)));
       TNode<Word32T> masked = m.Word32And(loaded, constants[j]);
       if ((buffer[j] & buffer[i]) != 0) {
         m.GotoIf(m.Word32Equal(masked, m.Int32Constant(0)), &bad);
@@ -2862,9 +2981,8 @@ TEST(DirectMemoryTest16BitWord32) {
       }
 
       // Force a memory access relative to a high-number register.
-      loaded = m.LoadBufferObject(buffer_node2,
-                                  static_cast<int>(i * sizeof(int16_t)),
-                                  MachineType::Uint16());
+      loaded = m.LoadBufferData<Uint16T>(buffer_node2,
+                                         static_cast<int>(i * sizeof(int16_t)));
       masked = m.Word32And(loaded, constants[j]);
       if ((buffer[j] & buffer[i]) != 0) {
         m.GotoIf(m.Word32Equal(masked, m.Int32Constant(0)), &bad);
@@ -2914,40 +3032,6 @@ TEST(LoadJSArrayElementsMap) {
   }
 }
 
-TEST(AllocateStruct) {
-  Isolate* isolate(CcTest::InitIsolateOnce());
-
-  const int kNumParams = 3;
-  CodeAssemblerTester asm_tester(isolate, kNumParams);
-  CodeStubAssembler m(asm_tester.state());
-
-  {
-    Node* map = m.Parameter(0);
-    Node* result = m.AllocateStruct(map);
-
-    m.Return(result);
-  }
-
-  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
-
-  Handle<Map> maps[] = {
-      handle(ReadOnlyRoots(isolate).tuple3_map(), isolate),
-      handle(ReadOnlyRoots(isolate).tuple2_map(), isolate),
-  };
-
-  {
-    for (size_t i = 0; i < 2; i++) {
-      Handle<Map> map = maps[i];
-      Handle<Struct> result =
-          Handle<Struct>::cast(ft.Call(map).ToHandleChecked());
-      CHECK_EQ(result->map(), *map);
-#ifdef VERIFY_HEAP
-      isolate->heap()->Verify();
-#endif
-    }
-  }
-}
-
 TEST(GotoIfNotWhiteSpaceOrLineTerminator) {
   Isolate* isolate(CcTest::InitIsolateOnce());
 
@@ -3398,7 +3482,7 @@ TEST(SingleInputPhiElimination) {
     m.BIND(&temp_label);
     m.Goto(&end_label);
     m.BIND(&end_label);
-    m.Return(temp1.value());
+    m.Return(m.UncheckedCast<Object>(temp1.value()));
   }
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
   // Generating code without an assert is enough to make sure that the
@@ -3412,8 +3496,7 @@ TEST(SmallOrderedHashMapAllocate) {
   {
     CodeStubAssembler m(asm_tester.state());
     TNode<Smi> capacity = m.CAST(m.Parameter(0));
-    m.Return(m.AllocateSmallOrderedHashTable<SmallOrderedHashMap>(
-        m.SmiToIntPtr(capacity)));
+    m.Return(m.AllocateSmallOrderedHashMap(m.SmiToIntPtr(capacity)));
   }
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
 
@@ -3451,8 +3534,7 @@ TEST(SmallOrderedHashSetAllocate) {
   {
     CodeStubAssembler m(asm_tester.state());
     TNode<Smi> capacity = m.CAST(m.Parameter(0));
-    m.Return(m.AllocateSmallOrderedHashTable<SmallOrderedHashSet>(
-        m.SmiToIntPtr(capacity)));
+    m.Return(m.AllocateSmallOrderedHashSet(m.SmiToIntPtr(capacity)));
   }
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
 
@@ -3533,7 +3615,6 @@ TEST(IsDoubleElementsKind) {
 }
 
 TEST(TestCallBuiltinInlineTrampoline) {
-  if (!i::FLAG_embedded_builtins) return;
   Isolate* isolate(CcTest::InitIsolateOnce());
   const int kNumParams = 1;
   CodeAssemblerTester asm_tester(isolate, kNumParams);
@@ -3557,8 +3638,9 @@ TEST(TestCallBuiltinInlineTrampoline) {
                        Handle<String>::cast(result.ToHandleChecked())));
 }
 
-TEST(TestCallBuiltinIndirectLoad) {
-  if (!i::FLAG_embedded_builtins) return;
+// TODO(v8:9821): Remove the option to disable inlining off-heap trampolines
+// along with this test.
+DISABLED_TEST(TestCallBuiltinIndirectLoad) {
   Isolate* isolate(CcTest::InitIsolateOnce());
   const int kNumParams = 1;
   CodeAssemblerTester asm_tester(isolate, kNumParams);
@@ -3582,6 +3664,43 @@ TEST(TestCallBuiltinIndirectLoad) {
                        Handle<String>::cast(result.ToHandleChecked())));
 }
 
+TEST(InstructionSchedulingCallerSavedRegisters) {
+  // This is a regression test for v8:9775, where TF's instruction scheduler
+  // incorrectly moved pure operations in between a ArchSaveCallerRegisters and
+  // a ArchRestoreCallerRegisters instruction.
+  bool old_turbo_instruction_scheduling = FLAG_turbo_instruction_scheduling;
+  FLAG_turbo_instruction_scheduling = true;
+
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  const int kNumParams = 1;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  CodeStubAssembler m(asm_tester.state());
+
+  {
+    Node* x = m.SmiUntag(m.Parameter(0));
+    Node* y = m.WordOr(m.WordShr(x, 1), m.IntPtrConstant(1));
+    TNode<ExternalReference> isolate_ptr =
+        m.ExternalConstant(ExternalReference::isolate_address(isolate));
+    m.CallCFunctionWithCallerSavedRegisters(
+        m.ExternalConstant(
+            ExternalReference::smi_lexicographic_compare_function()),
+        MachineType::Int32(), kSaveFPRegs,
+        std::make_pair(MachineType::Pointer(), isolate_ptr),
+        std::make_pair(MachineType::TaggedSigned(), m.SmiConstant(0)),
+        std::make_pair(MachineType::TaggedSigned(), m.SmiConstant(0)));
+    m.Return(m.SmiTag(m.Signed(m.WordOr(x, y))));
+  }
+
+  AssemblerOptions options = AssemblerOptions::Default(isolate);
+  FunctionTester ft(asm_tester.GenerateCode(options), kNumParams);
+  Handle<Object> input = isolate->factory()->NewNumber(8);
+  MaybeHandle<Object> result = ft.Call(input);
+  CHECK(result.ToHandleChecked()->IsSmi());
+  CHECK_EQ(result.ToHandleChecked()->Number(), 13);
+
+  FLAG_turbo_instruction_scheduling = old_turbo_instruction_scheduling;
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-compiler.cc b/deps/v8/test/cctest/test-compiler.cc
index bd2766518b8dee..8593a1761702a7 100644
--- a/deps/v8/test/cctest/test-compiler.cc
+++ b/deps/v8/test/cctest/test-compiler.cc
@@ -27,9 +27,12 @@
 
 #include <stdlib.h>
 #include <wchar.h>
+#include <memory>
 
 #include "src/init/v8.h"
 
+#include "include/v8-profiler.h"
+#include "include/v8.h"
 #include "src/api/api-inl.h"
 #include "src/codegen/compilation-cache.h"
 #include "src/codegen/compiler.h"
@@ -39,6 +42,7 @@
 #include "src/interpreter/interpreter.h"
 #include "src/objects/allocation-site-inl.h"
 #include "src/objects/objects-inl.h"
+#include "src/objects/shared-function-info.h"
 #include "test/cctest/cctest.h"
 
 namespace v8 {
@@ -1058,5 +1062,71 @@ TEST(DecideToPretenureDuringCompilation) {
   isolate->Dispose();
 }
 
+namespace {
+
+// Dummy external source stream which returns the whole source in one go.
+class DummySourceStream : public v8::ScriptCompiler::ExternalSourceStream {
+ public:
+  explicit DummySourceStream(const char* source) : done_(false) {
+    source_length_ = static_cast<int>(strlen(source));
+    source_buffer_ = source;
+  }
+
+  size_t GetMoreData(const uint8_t** dest) override {
+    if (done_) {
+      return 0;
+    }
+    uint8_t* buf = new uint8_t[source_length_ + 1];
+    memcpy(buf, source_buffer_, source_length_ + 1);
+    *dest = buf;
+    done_ = true;
+    return source_length_;
+  }
+
+ private:
+  int source_length_;
+  const char* source_buffer_;
+  bool done_;
+};
+
+}  // namespace
+
+// Tests that doing something that causes source positions to need to be
+// collected after a background compilation task has started does result in
+// source positions being collected.
+TEST(ProfilerEnabledDuringBackgroundCompile) {
+  CcTest::InitializeVM();
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+  const char* source = "var a = 0;";
+
+  v8::ScriptCompiler::StreamedSource streamed_source(
+      std::make_unique<DummySourceStream>(source),
+      v8::ScriptCompiler::StreamedSource::UTF8);
+  std::unique_ptr<v8::ScriptCompiler::ScriptStreamingTask> task(
+      v8::ScriptCompiler::StartStreamingScript(isolate, &streamed_source));
+
+  // Run the background compilation task on the main thread.
+  task->Run();
+
+  // Enable the CPU profiler.
+  auto* cpu_profiler = v8::CpuProfiler::New(isolate, v8::kStandardNaming);
+  v8::Local<v8::String> profile = v8_str("profile");
+  cpu_profiler->StartProfiling(profile);
+
+  // Finalize the background compilation task ensuring it completed
+  // successfully.
+  v8::Local<v8::Script> script =
+      v8::ScriptCompiler::Compile(isolate->GetCurrentContext(),
+                                  &streamed_source, v8_str(source),
+                                  v8::ScriptOrigin(v8_str("foo")))
+          .ToLocalChecked();
+
+  i::Handle<i::Object> obj = Utils::OpenHandle(*script);
+  CHECK(i::JSFunction::cast(*obj).shared().AreSourcePositionsAvailable());
+
+  cpu_profiler->StopProfiling(profile);
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-conversions.cc b/deps/v8/test/cctest/test-conversions.cc
index 2bf07888af004d..72a604b96af4ae 100644
--- a/deps/v8/test/cctest/test-conversions.cc
+++ b/deps/v8/test/cctest/test-conversions.cc
@@ -312,10 +312,10 @@ TEST(ExponentNumberStr) {
   CHECK_EQ(1e-106, StringToDouble(".000001e-100", NO_FLAGS));
 }
 
-using OneBit1 = BitField<uint32_t, 0, 1>;
-using OneBit2 = BitField<uint32_t, 7, 1>;
-using EightBit1 = BitField<uint32_t, 0, 8>;
-using EightBit2 = BitField<uint32_t, 13, 8>;
+using OneBit1 = base::BitField<uint32_t, 0, 1>;
+using OneBit2 = base::BitField<uint32_t, 7, 1>;
+using EightBit1 = base::BitField<uint32_t, 0, 8>;
+using EightBit2 = base::BitField<uint32_t, 13, 8>;
 
 TEST(BitField) {
   uint32_t x;
@@ -350,8 +350,8 @@ TEST(BitField) {
   CHECK(!EightBit2::is_valid(256));
 }
 
-using UpperBits = BitField64<int, 61, 3>;
-using MiddleBits = BitField64<int, 31, 2>;
+using UpperBits = base::BitField64<int, 61, 3>;
+using MiddleBits = base::BitField64<int, 31, 2>;
 
 TEST(BitField64) {
   uint64_t x;
diff --git a/deps/v8/test/cctest/test-cpu-profiler.cc b/deps/v8/test/cctest/test-cpu-profiler.cc
index c0d43b21a1a8b5..b329a841a61f93 100644
--- a/deps/v8/test/cctest/test-cpu-profiler.cc
+++ b/deps/v8/test/cctest/test-cpu-profiler.cc
@@ -166,10 +166,10 @@ TEST(CodeEvents) {
 
   i::HandleScope scope(isolate);
 
-  i::AbstractCode aaa_code = CreateCode(&env);
-  i::AbstractCode comment_code = CreateCode(&env);
-  i::AbstractCode comment2_code = CreateCode(&env);
-  i::AbstractCode moved_code = CreateCode(&env);
+  i::Handle<i::AbstractCode> aaa_code(CreateCode(&env), isolate);
+  i::Handle<i::AbstractCode> comment_code(CreateCode(&env), isolate);
+  i::Handle<i::AbstractCode> comment2_code(CreateCode(&env), isolate);
+  i::Handle<i::AbstractCode> moved_code(CreateCode(&env), isolate);
 
   CpuProfilesCollection* profiles = new CpuProfilesCollection(isolate);
   ProfilerCodeObserver code_observer(isolate);
@@ -186,34 +186,34 @@ TEST(CodeEvents) {
   const char* aaa_str = "aaa";
   i::Handle<i::String> aaa_name = factory->NewStringFromAsciiChecked(aaa_str);
   profiler_listener.CodeCreateEvent(i::Logger::FUNCTION_TAG, aaa_code,
-                                    *aaa_name);
+                                    aaa_name);
   profiler_listener.CodeCreateEvent(i::Logger::BUILTIN_TAG, comment_code,
                                     "comment");
   profiler_listener.CodeCreateEvent(i::Logger::BUILTIN_TAG, comment2_code,
                                     "comment2");
-  profiler_listener.CodeMoveEvent(comment2_code, moved_code);
+  profiler_listener.CodeMoveEvent(*comment2_code, *moved_code);
 
   // Enqueue a tick event to enable code events processing.
-  EnqueueTickSampleEvent(processor, aaa_code.InstructionStart());
+  EnqueueTickSampleEvent(processor, aaa_code->InstructionStart());
 
   isolate->logger()->RemoveCodeEventListener(&profiler_listener);
   processor->StopSynchronously();
 
   // Check the state of profile generator.
   CodeEntry* aaa =
-      generator->code_map()->FindEntry(aaa_code.InstructionStart());
+      generator->code_map()->FindEntry(aaa_code->InstructionStart());
   CHECK(aaa);
   CHECK_EQ(0, strcmp(aaa_str, aaa->name()));
 
   CodeEntry* comment =
-      generator->code_map()->FindEntry(comment_code.InstructionStart());
+      generator->code_map()->FindEntry(comment_code->InstructionStart());
   CHECK(comment);
   CHECK_EQ(0, strcmp("comment", comment->name()));
 
-  CHECK(!generator->code_map()->FindEntry(comment2_code.InstructionStart()));
+  CHECK(!generator->code_map()->FindEntry(comment2_code->InstructionStart()));
 
   CodeEntry* comment2 =
-      generator->code_map()->FindEntry(moved_code.InstructionStart());
+      generator->code_map()->FindEntry(moved_code->InstructionStart());
   CHECK(comment2);
   CHECK_EQ(0, strcmp("comment2", comment2->name()));
 }
@@ -229,9 +229,9 @@ TEST(TickEvents) {
   i::Isolate* isolate = CcTest::i_isolate();
   i::HandleScope scope(isolate);
 
-  i::AbstractCode frame1_code = CreateCode(&env);
-  i::AbstractCode frame2_code = CreateCode(&env);
-  i::AbstractCode frame3_code = CreateCode(&env);
+  i::Handle<i::AbstractCode> frame1_code(CreateCode(&env), isolate);
+  i::Handle<i::AbstractCode> frame2_code(CreateCode(&env), isolate);
+  i::Handle<i::AbstractCode> frame3_code(CreateCode(&env), isolate);
 
   CpuProfilesCollection* profiles = new CpuProfilesCollection(isolate);
   ProfilerCodeObserver code_observer(isolate);
@@ -251,14 +251,14 @@ TEST(TickEvents) {
   profiler_listener.CodeCreateEvent(i::Logger::STUB_TAG, frame2_code, "ccc");
   profiler_listener.CodeCreateEvent(i::Logger::BUILTIN_TAG, frame3_code, "ddd");
 
-  EnqueueTickSampleEvent(processor, frame1_code.raw_instruction_start());
+  EnqueueTickSampleEvent(processor, frame1_code->raw_instruction_start());
   EnqueueTickSampleEvent(
       processor,
-      frame2_code.raw_instruction_start() + frame2_code.ExecutableSize() / 2,
-      frame1_code.raw_instruction_start() + frame1_code.ExecutableSize() / 2);
-  EnqueueTickSampleEvent(processor, frame3_code.raw_instruction_end() - 1,
-                         frame2_code.raw_instruction_end() - 1,
-                         frame1_code.raw_instruction_end() - 1);
+      frame2_code->raw_instruction_start() + frame2_code->ExecutableSize() / 2,
+      frame1_code->raw_instruction_start() + frame1_code->ExecutableSize() / 2);
+  EnqueueTickSampleEvent(processor, frame3_code->raw_instruction_end() - 1,
+                         frame2_code->raw_instruction_end() - 1,
+                         frame1_code->raw_instruction_end() - 1);
 
   isolate->logger()->RemoveCodeEventListener(&profiler_listener);
   processor->StopSynchronously();
@@ -303,7 +303,7 @@ TEST(Issue1398) {
   i::Isolate* isolate = CcTest::i_isolate();
   i::HandleScope scope(isolate);
 
-  i::AbstractCode code = CreateCode(&env);
+  i::Handle<i::AbstractCode> code(CreateCode(&env), isolate);
 
   CpuProfilesCollection* profiles = new CpuProfilesCollection(isolate);
   ProfilerCodeObserver code_observer(isolate);
@@ -321,11 +321,11 @@ TEST(Issue1398) {
   profiler_listener.CodeCreateEvent(i::Logger::BUILTIN_TAG, code, "bbb");
 
   v8::internal::TickSample sample;
-  sample.pc = reinterpret_cast<void*>(code.InstructionStart());
+  sample.pc = reinterpret_cast<void*>(code->InstructionStart());
   sample.tos = nullptr;
   sample.frames_count = TickSample::kMaxFramesCount;
   for (unsigned i = 0; i < sample.frames_count; ++i) {
-    sample.stack[i] = reinterpret_cast<void*>(code.InstructionStart());
+    sample.stack[i] = reinterpret_cast<void*>(code->InstructionStart());
   }
   sample.timestamp = base::TimeTicks::HighResolutionNow();
   processor->AddSample(sample);
@@ -1169,9 +1169,9 @@ static void TickLines(bool optimize) {
   CHECK(!func->shared().abstract_code().is_null());
   CHECK(!optimize || func->IsOptimized() ||
         !CcTest::i_isolate()->use_optimizer());
-  i::AbstractCode code = func->abstract_code();
-  CHECK(!code.is_null());
-  i::Address code_address = code.raw_instruction_start();
+  i::Handle<i::AbstractCode> code(func->abstract_code(), isolate);
+  CHECK(!code->is_null());
+  i::Address code_address = code->raw_instruction_start();
   CHECK_NE(code_address, kNullAddress);
 
   CpuProfilesCollection* profiles = new CpuProfilesCollection(isolate);
@@ -1197,7 +1197,8 @@ static void TickLines(bool optimize) {
   int line = 1;
   int column = 1;
   profiler_listener.CodeCreateEvent(i::Logger::FUNCTION_TAG, code,
-                                    func->shared(), *str, line, column);
+                                    handle(func->shared(), isolate), str, line,
+                                    column);
 
   // Enqueue a tick event to enable code events processing.
   EnqueueTickSampleEvent(processor, code_address);
@@ -1784,13 +1785,6 @@ static const char* inlining_test_source2 = R"(
     level1();
   )";
 
-// The simulator builds are extremely slow. We run them with fewer iterations.
-#ifdef USE_SIMULATOR
-const double load_factor = 0.01;
-#else
-const double load_factor = 1.0;
-#endif
-
 // [Top down]:
 //     0  (root):0 0 #1
 //    13    start:34 6 #3
@@ -1818,31 +1812,24 @@ const double load_factor = 1.0;
 TEST(Inlining2) {
   FLAG_allow_natives_syntax = true;
   v8::Isolate* isolate = CcTest::isolate();
+  LocalContext env;
   v8::CpuProfiler::UseDetailedSourcePositionsForProfiling(isolate);
   v8::HandleScope scope(isolate);
-  v8::Local<v8::Context> env = CcTest::NewContext({PROFILER_EXTENSION_ID});
-  v8::Context::Scope context_scope(env);
+  ProfilerHelper helper(env.local());
 
   CompileRun(inlining_test_source2);
-  v8::Local<v8::Function> function = GetFunction(env, "start");
-
-  v8::CpuProfiler* profiler = v8::CpuProfiler::New(CcTest::isolate());
-  v8::Local<v8::String> profile_name = v8_str("inlining");
-  profiler->StartProfiling(
-      profile_name,
-      v8::CpuProfilingOptions{v8::CpuProfilingMode::kCallerLineNumbers});
+  v8::Local<v8::Function> function = GetFunction(env.local(), "start");
 
-  v8::Local<v8::Value> args[] = {
-      v8::Integer::New(env->GetIsolate(), 50000 * load_factor)};
-  function->Call(env, env->Global(), arraysize(args), args).ToLocalChecked();
-  v8::CpuProfile* profile = profiler->StopProfiling(profile_name);
+  v8::Local<v8::Value> args[] = {v8::Integer::New(env->GetIsolate(), 20)};
+  static const unsigned min_samples = 4000;
+  static const unsigned min_ext_samples = 0;
+  v8::CpuProfile* profile =
+      helper.Run(function, args, arraysize(args), min_samples, min_ext_samples,
+                 v8::CpuProfilingMode::kCallerLineNumbers);
   CHECK(profile);
 
-  // Dump collected profile to have a better diagnostic in case of failure.
-  reinterpret_cast<i::CpuProfile*>(profile)->Print();
-
   const v8::CpuProfileNode* root = profile->GetTopDownRoot();
-  const v8::CpuProfileNode* start_node = GetChild(env, root, "start");
+  const v8::CpuProfileNode* start_node = GetChild(env.local(), root, "start");
 
   NameLinePair l421_a17[] = {{"level1", 27},
                              {"level2", 23},
@@ -1874,7 +1861,6 @@ TEST(Inlining2) {
   CheckBranch(start_node, action_direct, arraysize(action_direct));
 
   profile->Delete();
-  profiler->Dispose();
 }
 
 static const char* cross_script_source_a = R"(
@@ -1914,50 +1900,45 @@ static const char* cross_script_source_b = R"(
 TEST(CrossScriptInliningCallerLineNumbers) {
   i::FLAG_allow_natives_syntax = true;
   v8::Isolate* isolate = CcTest::isolate();
+  LocalContext env;
   v8::CpuProfiler::UseDetailedSourcePositionsForProfiling(isolate);
   v8::HandleScope scope(isolate);
-  v8::Local<v8::Context> env = CcTest::NewContext({PROFILER_EXTENSION_ID});
-  v8::Context::Scope context_scope(env);
+  ProfilerHelper helper(env.local());
 
   v8::Local<v8::Script> script_a =
       CompileWithOrigin(cross_script_source_a, "script_a", false);
   v8::Local<v8::Script> script_b =
       CompileWithOrigin(cross_script_source_b, "script_b", false);
 
-  script_a->Run(env).ToLocalChecked();
-  script_b->Run(env).ToLocalChecked();
+  script_a->Run(env.local()).ToLocalChecked();
+  script_b->Run(env.local()).ToLocalChecked();
 
-  v8::Local<v8::Function> function = GetFunction(env, "start");
-
-  v8::CpuProfiler* profiler = v8::CpuProfiler::New(CcTest::isolate());
-  v8::Local<v8::String> profile_name = v8_str("inlining");
-  profiler->StartProfiling(profile_name,
-                           v8::CpuProfilingMode::kCallerLineNumbers);
+  v8::Local<v8::Function> function = GetFunction(env.local(), "start");
 
-  v8::Local<v8::Value> args[] = {
-      v8::Integer::New(env->GetIsolate(), 20000 * load_factor)};
-  function->Call(env, env->Global(), arraysize(args), args).ToLocalChecked();
-  v8::CpuProfile* profile = profiler->StopProfiling(profile_name);
+  v8::Local<v8::Value> args[] = {v8::Integer::New(env->GetIsolate(), 10)};
+  static const unsigned min_samples = 1000;
+  static const unsigned min_ext_samples = 0;
+  v8::CpuProfile* profile =
+      helper.Run(function, args, arraysize(args), min_samples, min_ext_samples,
+                 v8::CpuProfilingMode::kCallerLineNumbers);
   CHECK(profile);
 
-  // Dump collected profile to have a better diagnostic in case of failure.
-  reinterpret_cast<i::CpuProfile*>(profile)->Print();
-
   const v8::CpuProfileNode* root = profile->GetTopDownRoot();
-  const v8::CpuProfileNode* start_node = GetChild(env, root, "start");
+  const v8::CpuProfileNode* start_node = GetChild(env.local(), root, "start");
   CHECK_EQ(0, strcmp("script_b", start_node->GetScriptResourceNameStr()));
 
   NameLinePair l19_a10[] = {{"level1", 11}, {"action", 15}};
   CheckBranch(start_node, l19_a10, arraysize(l19_a10));
 
-  const v8::CpuProfileNode* level1_node = GetChild(env, start_node, "level1");
+  const v8::CpuProfileNode* level1_node =
+      GetChild(env.local(), start_node, "level1");
   CHECK_EQ(0, strcmp("script_a", level1_node->GetScriptResourceNameStr()));
 
-  const v8::CpuProfileNode* action_node = GetChild(env, level1_node, "action");
+  const v8::CpuProfileNode* action_node =
+      GetChild(env.local(), level1_node, "action");
   CHECK_EQ(0, strcmp("script_a", action_node->GetScriptResourceNameStr()));
 
   profile->Delete();
-  profiler->Dispose();
 }
 
 static const char* cross_script_source_c = R"(
@@ -2009,9 +1990,9 @@ static const char* cross_script_source_f = R"(
 
 TEST(CrossScriptInliningCallerLineNumbers2) {
   i::FLAG_allow_natives_syntax = true;
+  LocalContext env;
   v8::HandleScope scope(CcTest::isolate());
-  v8::Local<v8::Context> env = CcTest::NewContext({PROFILER_EXTENSION_ID});
-  v8::Context::Scope context_scope(env);
+  ProfilerHelper helper(env.local());
 
   v8::Local<v8::Script> script_c =
       CompileWithOrigin(cross_script_source_c, "script_c", false);
@@ -2022,45 +2003,42 @@ TEST(CrossScriptInliningCallerLineNumbers2) {
   v8::Local<v8::Script> script_f =
       CompileWithOrigin(cross_script_source_f, "script_f", false);
 
-  script_c->Run(env).ToLocalChecked();
-  script_d->Run(env).ToLocalChecked();
-  script_e->Run(env).ToLocalChecked();
-  script_f->Run(env).ToLocalChecked();
-
-  v8::Local<v8::Function> function = GetFunction(env, "start");
+  script_c->Run(env.local()).ToLocalChecked();
+  script_d->Run(env.local()).ToLocalChecked();
+  script_e->Run(env.local()).ToLocalChecked();
+  script_f->Run(env.local()).ToLocalChecked();
 
-  v8::CpuProfiler* profiler = v8::CpuProfiler::New(CcTest::isolate());
-  v8::Local<v8::String> profile_name = v8_str("inlining");
-  profiler->StartProfiling(profile_name,
-                           v8::CpuProfilingMode::kCallerLineNumbers);
+  v8::Local<v8::Function> function = GetFunction(env.local(), "start");
 
-  v8::Local<v8::Value> args[] = {
-      v8::Integer::New(env->GetIsolate(), 20000 * load_factor)};
-  function->Call(env, env->Global(), arraysize(args), args).ToLocalChecked();
-  v8::CpuProfile* profile = profiler->StopProfiling(profile_name);
+  v8::Local<v8::Value> args[] = {v8::Integer::New(env->GetIsolate(), 10)};
+  static const unsigned min_samples = 1000;
+  static const unsigned min_ext_samples = 0;
+  v8::CpuProfile* profile =
+      helper.Run(function, args, arraysize(args), min_samples, min_ext_samples,
+                 v8::CpuProfilingMode::kCallerLineNumbers);
   CHECK(profile);
 
-  // Dump collected profile to have a better diagnostic in case of failure.
-  reinterpret_cast<i::CpuProfile*>(profile)->Print();
-
   const v8::CpuProfileNode* root = profile->GetTopDownRoot();
-  const v8::CpuProfileNode* start_node = GetChild(env, root, "start");
+  const v8::CpuProfileNode* start_node = GetChild(env.local(), root, "start");
   CHECK_EQ(0, strcmp("script_f", start_node->GetScriptResourceNameStr()));
 
-  const v8::CpuProfileNode* level1_node = GetChild(env, start_node, "level1");
+  const v8::CpuProfileNode* level1_node =
+      GetChild(env.local(), start_node, "level1");
   CHECK_EQ(0, strcmp("script_e", level1_node->GetScriptResourceNameStr()));
 
-  const v8::CpuProfileNode* level2_node = GetChild(env, level1_node, "level2");
+  const v8::CpuProfileNode* level2_node =
+      GetChild(env.local(), level1_node, "level2");
   CHECK_EQ(0, strcmp("script_d", level2_node->GetScriptResourceNameStr()));
 
-  const v8::CpuProfileNode* level3_node = GetChild(env, level2_node, "level3");
+  const v8::CpuProfileNode* level3_node =
+      GetChild(env.local(), level2_node, "level3");
   CHECK_EQ(0, strcmp("script_c", level3_node->GetScriptResourceNameStr()));
 
-  const v8::CpuProfileNode* action_node = GetChild(env, level3_node, "action");
+  const v8::CpuProfileNode* action_node =
+      GetChild(env.local(), level3_node, "action");
   CHECK_EQ(0, strcmp("script_c", action_node->GetScriptResourceNameStr()));
 
   profile->Delete();
-  profiler->Dispose();
 }
 
 // [Top down]:
diff --git a/deps/v8/test/cctest/test-debug-helper.cc b/deps/v8/test/cctest/test-debug-helper.cc
index 560db1b0d21217..513b9ac1b94a9a 100644
--- a/deps/v8/test/cctest/test-debug-helper.cc
+++ b/deps/v8/test/cctest/test-debug-helper.cc
@@ -43,16 +43,21 @@ d::MemoryAccessResult ReadMemory(uintptr_t address, uint8_t* destination,
   return d::MemoryAccessResult::kOk;
 }
 
+void CheckPropBase(const d::PropertyBase& property, const char* expected_type,
+                   const char* expected_name) {
+  CHECK(property.type == std::string("v8::internal::TaggedValue") ||
+        property.type == std::string(expected_type));
+  CHECK(property.decompressed_type == std::string(expected_type));
+  CHECK(property.name == std::string(expected_name));
+}
+
 void CheckProp(const d::ObjectProperty& property, const char* expected_type,
                const char* expected_name,
                d::PropertyKind expected_kind = d::PropertyKind::kSingle,
                size_t expected_num_values = 1) {
+  CheckPropBase(property, expected_type, expected_name);
   CHECK_EQ(property.num_values, expected_num_values);
-  CHECK(property.type == std::string("v8::internal::TaggedValue") ||
-        property.type == std::string(expected_type));
-  CHECK(property.decompressed_type == std::string(expected_type));
   CHECK(property.kind == expected_kind);
-  CHECK(property.name == std::string(expected_name));
 }
 
 template <typename TValue>
@@ -62,10 +67,56 @@ void CheckProp(const d::ObjectProperty& property, const char* expected_type,
   CHECK(*reinterpret_cast<TValue*>(property.address) == expected_value);
 }
 
-bool StartsWith(std::string full_string, std::string prefix) {
+bool StartsWith(const std::string& full_string, const std::string& prefix) {
   return full_string.substr(0, prefix.size()) == prefix;
 }
 
+bool Contains(const std::string& full_string, const std::string& substr) {
+  return full_string.find(substr) != std::string::npos;
+}
+
+void CheckStructProp(const d::StructProperty& property,
+                     const char* expected_type, const char* expected_name,
+                     size_t expected_offset, uint8_t expected_num_bits = 0,
+                     uint8_t expected_shift_bits = 0) {
+  CheckPropBase(property, expected_type, expected_name);
+  CHECK_EQ(property.offset, expected_offset);
+  CHECK_EQ(property.num_bits, expected_num_bits);
+  CHECK_EQ(property.shift_bits, expected_shift_bits);
+}
+
+const d::ObjectProperty& FindProp(const d::ObjectPropertiesResult& props,
+                                  std::string name) {
+  for (size_t i = 0; i < props.num_properties; ++i) {
+    if (name == props.properties[i]->name) {
+      return *props.properties[i];
+    }
+  }
+  CHECK_WITH_MSG(false, ("property '" + name + "' not found").c_str());
+  UNREACHABLE();
+}
+
+template <typename TValue>
+TValue ReadProp(const d::ObjectPropertiesResult& props, std::string name) {
+  const d::ObjectProperty& prop = FindProp(props, name);
+  return *reinterpret_cast<TValue*>(prop.address);
+}
+
+// A simple implementation of ExternalStringResource that lets us control the
+// result of IsCacheable().
+class StringResource : public v8::String::ExternalStringResource {
+ public:
+  explicit StringResource(bool cacheable) : cacheable_(cacheable) {}
+  const uint16_t* data() const override {
+    return reinterpret_cast<const uint16_t*>(u"abcde");
+  }
+  size_t length() const override { return 5; }
+  bool IsCacheable() const override { return cacheable_; }
+
+ private:
+  bool cacheable_;
+};
+
 }  // namespace
 
 TEST(GetObjectProperties) {
@@ -126,7 +177,7 @@ TEST(GetObjectProperties) {
     // deterministic locations within the heap reservation.
     CHECK(COMPRESS_POINTERS_BOOL
               ? StartsWith(props->brief, "EmptyFixedArray")
-              : StartsWith(props->brief, "maybe EmptyFixedArray"));
+              : Contains(props->brief, "maybe EmptyFixedArray"));
 
     // Provide a heap first page so the API can be more sure.
     heap_addresses.read_only_space_first_page =
@@ -236,7 +287,7 @@ TEST(GetObjectProperties) {
     alphabet.substr(3,20) + alphabet.toUpperCase().substr(5,15) + "7")");
   o = v8::Utils::OpenHandle(*v);
   props = d::GetObjectProperties(o->ptr(), &ReadMemory, heap_addresses);
-  CHECK(StartsWith(props->brief, "\"defghijklmnopqrstuvwFGHIJKLMNOPQRST7\""));
+  CHECK(Contains(props->brief, "\"defghijklmnopqrstuvwFGHIJKLMNOPQRST7\""));
 
   // Cause a failure when reading the "second" pointer within the top-level
   // ConsString.
@@ -245,15 +296,104 @@ TEST(GetObjectProperties) {
     uintptr_t second_address = props->properties[4]->address;
     MemoryFailureRegion failure(second_address, second_address + 4);
     props = d::GetObjectProperties(o->ptr(), &ReadMemory, heap_addresses);
-    CHECK(
-        StartsWith(props->brief, "\"defghijklmnopqrstuvwFGHIJKLMNOPQRST...\""));
+    CHECK(Contains(props->brief, "\"defghijklmnopqrstuvwFGHIJKLMNOPQRST...\""));
   }
 
   // Build a very long string.
   v = CompileRun("'a'.repeat(1000)");
   o = v8::Utils::OpenHandle(*v);
   props = d::GetObjectProperties(o->ptr(), &ReadMemory, heap_addresses);
-  CHECK(std::string(props->brief).substr(79, 7) == std::string("aa...\" "));
+  CHECK(Contains(props->brief, "\"" + std::string(80, 'a') + "...\""));
+
+  // GetObjectProperties can read cacheable external strings.
+  auto external_string =
+      v8::String::NewExternalTwoByte(isolate, new StringResource(true));
+  o = v8::Utils::OpenHandle(*external_string.ToLocalChecked());
+  props = d::GetObjectProperties(o->ptr(), &ReadMemory, heap_addresses);
+  CHECK(Contains(props->brief, "\"abcde\""));
+  // GetObjectProperties cannot read uncacheable external strings.
+  external_string =
+      v8::String::NewExternalTwoByte(isolate, new StringResource(false));
+  o = v8::Utils::OpenHandle(*external_string.ToLocalChecked());
+  props = d::GetObjectProperties(o->ptr(), &ReadMemory, heap_addresses);
+  CHECK_EQ(std::string(props->brief).find("\""), std::string::npos);
+
+  // Build a basic JS object and get its properties.
+  v = CompileRun("({a: 1, b: 2})");
+  o = v8::Utils::OpenHandle(*v);
+  props = d::GetObjectProperties(o->ptr(), &ReadMemory, heap_addresses);
+
+  // Objects constructed from literals get their properties placed inline, so
+  // the GetObjectProperties response should include an array.
+  const d::ObjectProperty& prop = FindProp(*props, "in-object properties");
+  CheckProp(prop, "v8::internal::Object", "in-object properties",
+            d::PropertyKind::kArrayOfKnownSize, 2);
+  // The second item in that array is the SMI value 2 from the object literal.
+  props2 =
+      d::GetObjectProperties(reinterpret_cast<i::Tagged_t*>(prop.address)[1],
+                             &ReadMemory, heap_addresses);
+  CHECK(props2->brief == std::string("2 (0x2)"));
+
+  // Verify the result for a heap object field which is itself a struct: the
+  // "descriptors" field on a DescriptorArray.
+  // Start by getting the object's map and the map's descriptor array.
+  props = d::GetObjectProperties(ReadProp<i::Tagged_t>(*props, "map"),
+                                 &ReadMemory, heap_addresses);
+  props = d::GetObjectProperties(
+      ReadProp<i::Tagged_t>(*props, "instance_descriptors"), &ReadMemory,
+      heap_addresses);
+  // It should have at least two descriptors (possibly plus slack).
+  CheckProp(*props->properties[1], "uint16_t", "number_of_all_descriptors");
+  uint16_t number_of_all_descriptors =
+      *reinterpret_cast<uint16_t*>(props->properties[1]->address);
+  CHECK_GE(number_of_all_descriptors, 2);
+  // The "descriptors" property should describe the struct layout for each
+  // element in the array.
+  const d::ObjectProperty& descriptors = *props->properties[6];
+  // No C++ type is reported directly because there may not be an actual C++
+  // struct with this layout, hence the empty string in this check.
+  CheckProp(descriptors, /*type=*/"", "descriptors",
+            d::PropertyKind::kArrayOfKnownSize, number_of_all_descriptors);
+  CHECK_EQ(descriptors.size, 3 * i::kTaggedSize);
+  CHECK_EQ(descriptors.num_struct_fields, 3);
+  CheckStructProp(*descriptors.struct_fields[0],
+                  "v8::internal::PrimitiveHeapObject", "key",
+                  0 * i::kTaggedSize);
+  CheckStructProp(*descriptors.struct_fields[1], "v8::internal::Object",
+                  "details", 1 * i::kTaggedSize);
+  CheckStructProp(*descriptors.struct_fields[2], "v8::internal::Object",
+                  "value", 2 * i::kTaggedSize);
+
+  // Build a basic JS function and get its properties. This will allow us to
+  // exercise bitfield functionality.
+  v = CompileRun("(function () {})");
+  o = v8::Utils::OpenHandle(*v);
+  props = d::GetObjectProperties(o->ptr(), &ReadMemory, heap_addresses);
+  props = d::GetObjectProperties(
+      ReadProp<i::Tagged_t>(*props, "shared_function_info"), &ReadMemory,
+      heap_addresses);
+  const d::ObjectProperty& flags = FindProp(*props, "flags");
+  CheckStructProp(*flags.struct_fields[0], "v8::internal::FunctionKind",
+                  "function_kind", 0, 5, 0);
+  CheckStructProp(*flags.struct_fields[1], "bool", "is_native", 0, 1, 5);
+  CheckStructProp(*flags.struct_fields[2], "bool", "is_strict", 0, 1, 6);
+}
+
+TEST(ListObjectClasses) {
+  CcTest::InitializeVM();
+
+  // The ListObjectClasses result will change as classes are added, removed, or
+  // renamed. Just check that a few expected classes are included in the list,
+  // and that there are no duplicates.
+  const d::ClassList* class_list = d::ListObjectClasses();
+  std::unordered_set<std::string> class_set;
+  for (size_t i = 0; i < class_list->num_class_names; ++i) {
+    CHECK_WITH_MSG(class_set.insert(class_list->class_names[i]).second,
+                   "there should be no duplicate entries");
+  }
+  CHECK_NE(class_set.find("v8::internal::HeapObject"), class_set.end());
+  CHECK_NE(class_set.find("v8::internal::String"), class_set.end());
+  CHECK_NE(class_set.find("v8::internal::JSRegExp"), class_set.end());
 }
 
 }  // namespace internal
diff --git a/deps/v8/test/cctest/test-debug.cc b/deps/v8/test/cctest/test-debug.cc
index c76f922d8616c3..4aae4294dadc67 100644
--- a/deps/v8/test/cctest/test-debug.cc
+++ b/deps/v8/test/cctest/test-debug.cc
@@ -36,7 +36,6 @@
 #include "src/deoptimizer/deoptimizer.h"
 #include "src/execution/frames.h"
 #include "src/objects/objects-inl.h"
-#include "src/snapshot/natives.h"
 #include "src/snapshot/snapshot.h"
 #include "src/utils/utils.h"
 #include "test/cctest/cctest.h"
@@ -4711,16 +4710,22 @@ TEST(Regress517592) {
   v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
 }
 
+namespace {
+std::string FromString(v8::Isolate* isolate, v8::Local<v8::String> str) {
+  v8::String::Utf8Value utf8(isolate, str);
+  return std::string(*utf8);
+}
+}  // namespace
+
 TEST(GetPrivateFields) {
   LocalContext env;
   v8::Isolate* v8_isolate = CcTest::isolate();
-  v8::internal::Isolate* isolate = CcTest::i_isolate();
   v8::HandleScope scope(v8_isolate);
   v8::Local<v8::Context> context = env.local();
   v8::Local<v8::String> source = v8_str(
       "var X = class {\n"
-      "  #foo = 1;\n"
-      "  #bar = function() {};\n"
+      "  #field_number = 1;\n"
+      "  #field_function = function() {};\n"
       "}\n"
       "var x = new X()");
   CompileRun(source);
@@ -4728,49 +4733,55 @@ TEST(GetPrivateFields) {
       env->Global()
           ->Get(context, v8_str(env->GetIsolate(), "x"))
           .ToLocalChecked());
-  v8::Local<v8::Array> private_names =
-      v8::debug::GetPrivateFields(context, object).ToLocalChecked();
-
-  for (int i = 0; i < 4; i = i + 2) {
-    Handle<v8::internal::JSReceiver> private_name =
-        v8::Utils::OpenHandle(*private_names->Get(context, i)
-                                   .ToLocalChecked()
-                                   ->ToObject(context)
-                                   .ToLocalChecked());
-    Handle<v8::internal::JSPrimitiveWrapper> private_value =
-        Handle<v8::internal::JSPrimitiveWrapper>::cast(private_name);
-    Handle<v8::internal::Symbol> priv_symbol(
-        v8::internal::Symbol::cast(private_value->value()), isolate);
-    CHECK(priv_symbol->is_private_name());
+  std::vector<v8::Local<v8::Value>> names;
+  std::vector<v8::Local<v8::Value>> values;
+  CHECK(v8::debug::GetPrivateMembers(context, object, &names, &values));
+
+  CHECK_EQ(names.size(), 2);
+  for (int i = 0; i < 2; i++) {
+    v8::Local<v8::Value> name = names[i];
+    v8::Local<v8::Value> value = values[i];
+    CHECK(name->IsString());
+    std::string name_str = FromString(v8_isolate, name.As<v8::String>());
+    if (name_str == "#field_number") {
+      CHECK(value->Equals(context, v8_num(1)).FromJust());
+    } else {
+      CHECK_EQ(name_str, "#field_function");
+      CHECK(value->IsFunction());
+    }
   }
 
   source = v8_str(
       "var Y = class {\n"
-      "  #baz = 2;\n"
+      "  #base_field_number = 2;\n"
       "}\n"
       "var X = class extends Y{\n"
-      "  #foo = 1;\n"
-      "  #bar = function() {};\n"
+      "  #field_number = 1;\n"
+      "  #field_function = function() {};\n"
       "}\n"
       "var x = new X()");
   CompileRun(source);
+  names.clear();
+  values.clear();
   object = v8::Local<v8::Object>::Cast(
       env->Global()
           ->Get(context, v8_str(env->GetIsolate(), "x"))
           .ToLocalChecked());
-  private_names = v8::debug::GetPrivateFields(context, object).ToLocalChecked();
-
-  for (int i = 0; i < 6; i = i + 2) {
-    Handle<v8::internal::JSReceiver> private_name =
-        v8::Utils::OpenHandle(*private_names->Get(context, i)
-                                   .ToLocalChecked()
-                                   ->ToObject(context)
-                                   .ToLocalChecked());
-    Handle<v8::internal::JSPrimitiveWrapper> private_value =
-        Handle<v8::internal::JSPrimitiveWrapper>::cast(private_name);
-    Handle<v8::internal::Symbol> priv_symbol(
-        v8::internal::Symbol::cast(private_value->value()), isolate);
-    CHECK(priv_symbol->is_private_name());
+  CHECK(v8::debug::GetPrivateMembers(context, object, &names, &values));
+
+  CHECK_EQ(names.size(), 3);
+  for (int i = 0; i < 3; i++) {
+    v8::Local<v8::Value> name = names[i];
+    v8::Local<v8::Value> value = values[i];
+    std::string name_str = FromString(v8_isolate, name.As<v8::String>());
+    if (name_str == "#base_field_number") {
+      CHECK(value->Equals(context, v8_num(2)).FromJust());
+    } else if (name_str == "#field_number") {
+      CHECK(value->Equals(context, v8_num(1)).FromJust());
+    } else {
+      CHECK_EQ(name_str, "#field_function");
+      CHECK(value->IsFunction());
+    }
   }
 
   source = v8_str(
@@ -4780,27 +4791,167 @@ TEST(GetPrivateFields) {
       "  }"
       "}\n"
       "var X = class extends Y{\n"
-      "  #foo = 1;\n"
-      "  #bar = function() {};\n"
+      "  #field_number = 1;\n"
+      "  #field_function = function() {};\n"
       "}\n"
       "var x = new X()");
   CompileRun(source);
+  names.clear();
+  values.clear();
   object = v8::Local<v8::Object>::Cast(
       env->Global()
           ->Get(context, v8_str(env->GetIsolate(), "x"))
           .ToLocalChecked());
-  private_names = v8::debug::GetPrivateFields(context, object).ToLocalChecked();
-
-  for (int i = 0; i < 4; i = i + 2) {
-    Handle<v8::internal::JSReceiver> private_name =
-        v8::Utils::OpenHandle(*private_names->Get(context, i)
-                                   .ToLocalChecked()
-                                   ->ToObject(context)
-                                   .ToLocalChecked());
-    Handle<v8::internal::JSPrimitiveWrapper> private_value =
-        Handle<v8::internal::JSPrimitiveWrapper>::cast(private_name);
-    Handle<v8::internal::Symbol> priv_symbol(
-        v8::internal::Symbol::cast(private_value->value()), isolate);
-    CHECK(priv_symbol->is_private_name());
+  CHECK(v8::debug::GetPrivateMembers(context, object, &names, &values));
+
+  CHECK_EQ(names.size(), 2);
+  for (int i = 0; i < 2; i++) {
+    v8::Local<v8::Value> name = names[i];
+    v8::Local<v8::Value> value = values[i];
+    CHECK(name->IsString());
+    std::string name_str = FromString(v8_isolate, name.As<v8::String>());
+    if (name_str == "#field_number") {
+      CHECK(value->Equals(context, v8_num(1)).FromJust());
+    } else {
+      CHECK_EQ(name_str, "#field_function");
+      CHECK(value->IsFunction());
+    }
+  }
+}
+
+TEST(GetPrivateMethodsAndAccessors) {
+  i::FLAG_harmony_private_methods = true;
+  LocalContext env;
+  v8::Isolate* v8_isolate = CcTest::isolate();
+  v8::HandleScope scope(v8_isolate);
+  v8::Local<v8::Context> context = env.local();
+
+  v8::Local<v8::String> source = v8_str(
+      "var X = class {\n"
+      "  #method() { }\n"
+      "  get #accessor() { }\n"
+      "  set #accessor(val) { }\n"
+      "  get #readOnly() { }\n"
+      "  set #writeOnly(val) { }\n"
+      "}\n"
+      "var x = new X()");
+  CompileRun(source);
+  v8::Local<v8::Object> object = v8::Local<v8::Object>::Cast(
+      env->Global()
+          ->Get(context, v8_str(env->GetIsolate(), "x"))
+          .ToLocalChecked());
+  std::vector<v8::Local<v8::Value>> names;
+  std::vector<v8::Local<v8::Value>> values;
+  CHECK(v8::debug::GetPrivateMembers(context, object, &names, &values));
+
+  CHECK_EQ(names.size(), 4);
+  for (int i = 0; i < 4; i++) {
+    v8::Local<v8::Value> name = names[i];
+    v8::Local<v8::Value> value = values[i];
+    CHECK(name->IsString());
+    std::string name_str = FromString(v8_isolate, name.As<v8::String>());
+    if (name_str == "#method") {
+      CHECK(value->IsFunction());
+    } else {
+      CHECK(v8::debug::AccessorPair::IsAccessorPair(value));
+      v8::Local<v8::debug::AccessorPair> accessors =
+          value.As<v8::debug::AccessorPair>();
+      if (name_str == "#accessor") {
+        CHECK(accessors->getter()->IsFunction());
+        CHECK(accessors->setter()->IsFunction());
+      } else if (name_str == "#readOnly") {
+        CHECK(accessors->getter()->IsFunction());
+        CHECK(accessors->setter()->IsNull());
+      } else {
+        CHECK_EQ(name_str, "#writeOnly");
+        CHECK(accessors->getter()->IsNull());
+        CHECK(accessors->setter()->IsFunction());
+      }
+    }
+  }
+
+  source = v8_str(
+      "var Y = class {\n"
+      "  #method() {}\n"
+      "  get #accessor() {}\n"
+      "  set #accessor(val) {};\n"
+      "}\n"
+      "var X = class extends Y{\n"
+      "  get #readOnly() {}\n"
+      "  set #writeOnly(val) {};\n"
+      "}\n"
+      "var x = new X()");
+  CompileRun(source);
+  names.clear();
+  values.clear();
+  object = v8::Local<v8::Object>::Cast(
+      env->Global()
+          ->Get(context, v8_str(env->GetIsolate(), "x"))
+          .ToLocalChecked());
+  CHECK(v8::debug::GetPrivateMembers(context, object, &names, &values));
+
+  CHECK_EQ(names.size(), 4);
+  for (int i = 0; i < 4; i++) {
+    v8::Local<v8::Value> name = names[i];
+    v8::Local<v8::Value> value = values[i];
+    CHECK(name->IsString());
+    std::string name_str = FromString(v8_isolate, name.As<v8::String>());
+    if (name_str == "#method") {
+      CHECK(value->IsFunction());
+    } else {
+      CHECK(v8::debug::AccessorPair::IsAccessorPair(value));
+      v8::Local<v8::debug::AccessorPair> accessors =
+          value.As<v8::debug::AccessorPair>();
+      if (name_str == "#accessor") {
+        CHECK(accessors->getter()->IsFunction());
+        CHECK(accessors->setter()->IsFunction());
+      } else if (name_str == "#readOnly") {
+        CHECK(accessors->getter()->IsFunction());
+        CHECK(accessors->setter()->IsNull());
+      } else {
+        CHECK_EQ(name_str, "#writeOnly");
+        CHECK(accessors->getter()->IsNull());
+        CHECK(accessors->setter()->IsFunction());
+      }
+    }
+  }
+
+  source = v8_str(
+      "var Y = class {\n"
+      "  constructor() {"
+      "    return new Proxy({}, {});"
+      "  }"
+      "}\n"
+      "var X = class extends Y{\n"
+      "  #method() {}\n"
+      "  get #accessor() {}\n"
+      "  set #accessor(val) {};\n"
+      "}\n"
+      "var x = new X()");
+  CompileRun(source);
+  names.clear();
+  values.clear();
+  object = v8::Local<v8::Object>::Cast(
+      env->Global()
+          ->Get(context, v8_str(env->GetIsolate(), "x"))
+          .ToLocalChecked());
+  CHECK(v8::debug::GetPrivateMembers(context, object, &names, &values));
+
+  CHECK_EQ(names.size(), 2);
+  for (int i = 0; i < 2; i++) {
+    v8::Local<v8::Value> name = names[i];
+    v8::Local<v8::Value> value = values[i];
+    CHECK(name->IsString());
+    std::string name_str = FromString(v8_isolate, name.As<v8::String>());
+    if (name_str == "#method") {
+      CHECK(value->IsFunction());
+    } else {
+      CHECK_EQ(name_str, "#accessor");
+      CHECK(v8::debug::AccessorPair::IsAccessorPair(value));
+      v8::Local<v8::debug::AccessorPair> accessors =
+          value.As<v8::debug::AccessorPair>();
+      CHECK(accessors->getter()->IsFunction());
+      CHECK(accessors->setter()->IsFunction());
+    }
   }
 }
diff --git a/deps/v8/test/cctest/test-dictionary.cc b/deps/v8/test/cctest/test-dictionary.cc
index 1f4a4c59a094e1..b9c3aab75abba1 100644
--- a/deps/v8/test/cctest/test-dictionary.cc
+++ b/deps/v8/test/cctest/test-dictionary.cc
@@ -84,7 +84,7 @@ static void TestHashMap(Handle<HashMap> table) {
     Handle<JSObject> value = factory->NewJSArray(11);
     table = HashMap::Put(table, key, value);
     CHECK_EQ(table->NumberOfElements(), i + 1);
-    CHECK_NE(table->FindEntry(isolate, key), HashMap::kNotFound);
+    CHECK(table->FindEntry(isolate, key).is_found());
     CHECK_EQ(table->Lookup(key), *value);
     CHECK(key->GetIdentityHash().IsSmi());
   }
@@ -94,7 +94,7 @@ static void TestHashMap(Handle<HashMap> table) {
   for (int i = 0; i < 100; i++) {
     Handle<JSReceiver> key = factory->NewJSArray(7);
     CHECK(key->GetOrCreateIdentityHash(isolate).IsSmi());
-    CHECK_EQ(table->FindEntry(isolate, key), HashMap::kNotFound);
+    CHECK(table->FindEntry(isolate, key).is_not_found());
     CHECK_EQ(table->Lookup(key), roots.the_hole_value());
     CHECK(key->GetIdentityHash().IsSmi());
   }
@@ -189,9 +189,8 @@ TEST(HashSet) {
 class ObjectHashTableTest: public ObjectHashTable {
  public:
   explicit ObjectHashTableTest(ObjectHashTable o) : ObjectHashTable(o) {}
-  ObjectHashTableTest* operator->() { return this; }
 
-  void insert(int entry, int key, int value) {
+  void insert(InternalIndex entry, int key, int value) {
     set(EntryToIndex(entry), Smi::FromInt(key));
     set(EntryToIndex(entry) + 1, Smi::FromInt(value));
   }
@@ -217,7 +216,7 @@ TEST(HashTableRehash) {
     ObjectHashTableTest t(*table);
     int capacity = t.capacity();
     for (int i = 0; i < capacity - 1; i++) {
-      t.insert(i, i * i, i);
+      t.insert(InternalIndex(i), i * i, i);
     }
     t.Rehash(ReadOnlyRoots(isolate));
     for (int i = 0; i < capacity - 1; i++) {
@@ -230,7 +229,7 @@ TEST(HashTableRehash) {
     ObjectHashTableTest t(*table);
     int capacity = t.capacity();
     for (int i = 0; i < capacity / 2; i++) {
-      t.insert(i, i * i, i);
+      t.insert(InternalIndex(i), i * i, i);
     }
     t.Rehash(ReadOnlyRoots(isolate));
     for (int i = 0; i < capacity / 2; i++) {
@@ -308,7 +307,8 @@ TEST(MaximumClonedShallowObjectProperties) {
   // not in large-object space.
   const int max_capacity = NameDictionary::ComputeCapacity(
       ConstructorBuiltins::kMaximumClonedShallowObjectProperties);
-  const int max_literal_entry = max_capacity / NameDictionary::kEntrySize;
+  const InternalIndex max_literal_entry(max_capacity /
+                                        NameDictionary::kEntrySize);
   const int max_literal_index = NameDictionary::EntryToIndex(max_literal_entry);
   CHECK_LE(NameDictionary::OffsetOfElementAt(max_literal_index),
            kMaxRegularHeapObjectSize);
diff --git a/deps/v8/test/cctest/test-disasm-arm.cc b/deps/v8/test/cctest/test-disasm-arm.cc
index 16dee03f506338..0cb5bcf029b9f1 100644
--- a/deps/v8/test/cctest/test-disasm-arm.cc
+++ b/deps/v8/test/cctest/test-disasm-arm.cc
@@ -997,9 +997,14 @@ TEST(Neon) {
       COMPARE(vmovl(NeonS16, q4, d2), "f2908a12       vmovl.s16 q4, d2");
       COMPARE(vmovl(NeonU32, q4, d2), "f3a08a12       vmovl.u32 q4, d2");
 
-      COMPARE(vqmovn(NeonU8, d16, q8), "f3f202e0       vqmovn.u16 d16, q8");
-      COMPARE(vqmovn(NeonS16, d16, q8), "f3f602a0       vqmovn.s32 d16, q8");
-      COMPARE(vqmovn(NeonU32, d2, q4), "f3ba22c8       vqmovn.u64 d2, q4");
+      COMPARE(vqmovn(NeonU8, NeonU8, d16, q8),
+              "f3f202e0       vqmovn.u16 d16, q8");
+      COMPARE(vqmovn(NeonS16, NeonS16, d16, q8),
+              "f3f602a0       vqmovn.s32 d16, q8");
+      COMPARE(vqmovn(NeonU32, NeonU32, d2, q4),
+              "f3ba22c8       vqmovn.u64 d2, q4");
+      COMPARE(vqmovn(NeonU32, NeonS32, d2, q4),
+              "f3ba2248       vqmovun.s64 d2, q4");
 
       COMPARE(vmov(NeonS8, d0, 0, r0), "ee400b10       vmov.8 d0[0], r0");
       COMPARE(vmov(NeonU8, d1, 1, r1), "ee411b30       vmov.8 d1[1], r1");
@@ -1038,6 +1043,10 @@ TEST(Neon) {
               "f22e01fe       vmov q0, q15");
       COMPARE(vmov(q8, q9),
               "f26201f2       vmov q8, q9");
+      COMPARE(vmov(q1, 0),
+              "f2802050       vmov.i32 q1, 0");
+      COMPARE(vmov(q1, 0x0000001200000012),
+              "f2812052       vmov.i32 q1, 18");
       COMPARE(vmvn(q0, q15),
               "f3b005ee       vmvn q0, q15");
       COMPARE(vmvn(q8, q9),
@@ -1098,6 +1107,8 @@ TEST(Neon) {
               "f340e170       veor q15, q0, q8");
       COMPARE(vand(q15, q0, q8),
               "f240e170       vand q15, q0, q8");
+      COMPARE(vbic(q15, q0, q8),
+              "f250e170       vbic q15, q0, q8");
       COMPARE(vorr(q15, q0, q8),
               "f260e170       vorr q15, q0, q8");
       COMPARE(vmin(q15, q0, q8),
@@ -1160,12 +1171,20 @@ TEST(Neon) {
               "f2142970       vmul.i16 q1, q2, q8");
       COMPARE(vmul(Neon32, q15, q0, q8),
               "f260e970       vmul.i32 q15, q0, q8");
+
+      COMPARE(vmull(NeonU32, q15, d0, d8),
+              "f3e0ec08       vmull.u32 q15, d0, d8");
+      COMPARE(vmlal(NeonU32, q15, d0, d8),
+              "f3e0e808       vmlal.u32 q15, d0, d8");
+
       COMPARE(vshl(NeonS8, q15, q0, 6),
               "f2cee550       vshl.i8 q15, q0, #6");
       COMPARE(vshl(NeonU16, q15, q0, 10),
               "f2dae550       vshl.i16 q15, q0, #10");
       COMPARE(vshl(NeonS32, q15, q0, 17),
               "f2f1e550       vshl.i32 q15, q0, #17");
+      COMPARE(vshl(NeonS64, q15, q0, 40),
+              "f2e8e5d0       vshl.i64 q15, q0, #40");
       COMPARE(vshl(NeonS8, q15, q0, q1),
               "f242e440       vshl.s8 q15, q0, q1");
       COMPARE(vshl(NeonU16, q15, q2, q3),
@@ -1178,6 +1197,10 @@ TEST(Neon) {
               "f3d6e050       vshr.u16 q15, q0, #10");
       COMPARE(vshr(NeonS32, q15, q0, 17),
               "f2efe050       vshr.s32 q15, q0, #17");
+      COMPARE(vshr(NeonS64, q15, q0, 40),
+              "f2d8e0d0       vshr.s64 q15, q0, #40");
+      COMPARE(vshr(NeonU64, q15, q0, 40),
+              "f3d8e0d0       vshr.u64 q15, q0, #40");
       COMPARE(vsli(Neon64, d2, d0, 32),
               "f3a02590       vsli.64 d2, d0, #32");
       COMPARE(vsli(Neon32, d7, d8, 17),
@@ -1224,6 +1247,12 @@ TEST(Neon) {
               "f3142360       vcgt.u16 q1, q2, q8");
       COMPARE(vcgt(NeonS32, q15, q0, q8),
               "f260e360       vcgt.s32 q15, q0, q8");
+      COMPARE(vrhadd(NeonU8, q0, q1, q2),
+              "f3020144       vrhadd.u8 q0, q1, q2");
+      COMPARE(vrhadd(NeonU16, q1, q2, q8),
+              "f3142160       vrhadd.u16 q1, q2, q8");
+      COMPARE(vrhadd(NeonU32, q15, q0, q8),
+              "f360e160       vrhadd.u32 q15, q0, q8");
       COMPARE(vbsl(q0, q1, q2),
               "f3120154       vbsl q0, q1, q2");
       COMPARE(vbsl(q15, q0, q8),
diff --git a/deps/v8/test/cctest/test-disasm-ia32.cc b/deps/v8/test/cctest/test-disasm-ia32.cc
index 563d3a87cf6703..686b1e122e4c2e 100644
--- a/deps/v8/test/cctest/test-disasm-ia32.cc
+++ b/deps/v8/test/cctest/test-disasm-ia32.cc
@@ -136,7 +136,7 @@ TEST(DisasmIa320) {
   __ push(Immediate(23456));
   __ push(ecx);
   __ push(esi);
-  __ push(Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
+  __ push(Operand(ebp, StandardFrameConstants::kFunctionOffset));
   __ push(Operand(ebx, ecx, times_4, 0));
   __ push(Operand(ebx, ecx, times_4, 0));
   __ push(Operand(ebx, ecx, times_4, 10000));
@@ -291,7 +291,7 @@ TEST(DisasmIa320) {
   __ bind(&L2);
   __ call(Operand(ebx, ecx, times_4, 10000));
   __ nop();
-  Handle<Code> ic = BUILTIN_CODE(isolate, LoadIC);
+  Handle<Code> ic = BUILTIN_CODE(isolate, ArrayFrom);
   __ call(ic, RelocInfo::CODE_TARGET);
   __ nop();
   __ call(FUNCTION_ADDR(DummyStaticFunction), RelocInfo::RUNTIME_ENTRY);
@@ -535,9 +535,7 @@ TEST(DisasmIa320) {
     __ psraw(xmm0, 17);
     __ psrad(xmm0, 17);
     __ psllq(xmm0, 17);
-    __ psllq(xmm0, xmm1);
     __ psrlq(xmm0, 17);
-    __ psrlq(xmm0, xmm1);
 
     __ pshufhw(xmm5, xmm1, 5);
     __ pshufhw(xmm5, Operand(edx, 4), 5);
@@ -581,6 +579,8 @@ TEST(DisasmIa320) {
       CpuFeatureScope scope(&assm, SSE3);
       __ haddps(xmm1, xmm0);
       __ haddps(xmm1, Operand(ebx, ecx, times_4, 10000));
+      __ movddup(xmm1, Operand(eax, 5));
+      __ movddup(xmm1, xmm2);
     }
   }
 
@@ -735,6 +735,7 @@ TEST(DisasmIa320) {
 
       __ vpsllw(xmm0, xmm7, 21);
       __ vpslld(xmm0, xmm7, 21);
+      __ vpsllq(xmm0, xmm7, 21);
       __ vpsrlw(xmm0, xmm7, 21);
       __ vpsrld(xmm0, xmm7, 21);
       __ vpsrlq(xmm0, xmm7, 21);
@@ -771,6 +772,9 @@ TEST(DisasmIa320) {
       __ vcvttps2dq(xmm1, xmm0);
       __ vcvttps2dq(xmm1, Operand(ebx, ecx, times_4, 10000));
 
+      __ vmovddup(xmm1, xmm2);
+      __ vmovddup(xmm1, Operand(ebx, ecx, times_4, 10000));
+      __ vbroadcastss(xmm1, Operand(ebx, ecx, times_4, 10000));
       __ vmovdqu(xmm0, Operand(ebx, ecx, times_4, 10000));
       __ vmovdqu(Operand(ebx, ecx, times_4, 10000), xmm0);
       __ vmovd(xmm0, edi);
diff --git a/deps/v8/test/cctest/test-disasm-x64.cc b/deps/v8/test/cctest/test-disasm-x64.cc
index 86d98d8daf97bb..5e85cb5a082fe0 100644
--- a/deps/v8/test/cctest/test-disasm-x64.cc
+++ b/deps/v8/test/cctest/test-disasm-x64.cc
@@ -149,7 +149,7 @@ TEST(DisasmX64) {
   __ pushq(Immediate(23456));
   __ pushq(rcx);
   __ pushq(rsi);
-  __ pushq(Operand(rbp, JavaScriptFrameConstants::kFunctionOffset));
+  __ pushq(Operand(rbp, StandardFrameConstants::kFunctionOffset));
   __ pushq(Operand(rbx, rcx, times_4, 0));
   __ pushq(Operand(rbx, rcx, times_4, 0));
   __ pushq(Operand(rbx, rcx, times_4, 10000));
@@ -182,13 +182,24 @@ TEST(DisasmX64) {
   __ decq(rdx);
   __ cdq();
 
+  __ repstosl();
   __ repstosq();
 
   __ nop();
   __ idivq(rdx);
   __ mull(rdx);
   __ mulq(rdx);
+
+  __ negb(rdx);
+  __ negb(r10);
+  __ negw(rdx);
+  __ negl(rdx);
   __ negq(rdx);
+  __ negb(Operand(rsp, 12));
+  __ negw(Operand(rsp, 12));
+  __ negl(Operand(rsp, 12));
+  __ negb(Operand(rsp, 12));
+
   __ notq(rdx);
   __ testq(Operand(rbx, rcx, times_4, 10000), rdx);
 
@@ -268,7 +279,6 @@ TEST(DisasmX64) {
 
   __ xorq(rdx, Immediate(12345));
   __ xorq(rdx, Operand(rbx, rcx, times_8, 10000));
-  __ pshufw(xmm5, xmm1, 3);
   __ hlt();
   __ int3();
   __ ret(0);
@@ -283,13 +293,11 @@ TEST(DisasmX64) {
   __ call(&L2);
   __ nop();
   __ bind(&L2);
-  // TODO(mstarzinger): The following is protected.
-  // __ call(Operand(rbx, rcx, times_4, 10000));
+  __ call(rcx);
   __ nop();
-  Handle<Code> ic = BUILTIN_CODE(isolate, LoadIC);
+  Handle<Code> ic = BUILTIN_CODE(isolate, ArrayFrom);
   __ call(ic, RelocInfo::CODE_TARGET);
   __ nop();
-  __ nop();
 
   __ jmp(&L1);
   __ jmp(Operand(rbx, rcx, times_4, 10000));
@@ -394,42 +402,21 @@ TEST(DisasmX64) {
     __ movdqu(Operand(rsp, 12), xmm0);
     __ shufps(xmm0, xmm9, 0x0);
 
-    // logic operation
-    __ andps(xmm0, xmm1);
-    __ andps(xmm0, Operand(rbx, rcx, times_4, 10000));
-    __ andnps(xmm0, xmm1);
-    __ andnps(xmm0, Operand(rbx, rcx, times_4, 10000));
-    __ orps(xmm0, xmm1);
-    __ orps(xmm0, Operand(rbx, rcx, times_4, 10000));
-    __ xorps(xmm0, xmm1);
-    __ xorps(xmm0, Operand(rbx, rcx, times_4, 10000));
-
-    // Arithmetic operation
-    __ addss(xmm1, xmm0);
-    __ addss(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ mulss(xmm1, xmm0);
-    __ mulss(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ subss(xmm1, xmm0);
-    __ subss(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ divss(xmm1, xmm0);
-    __ divss(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ maxss(xmm1, xmm0);
-    __ maxss(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ minss(xmm1, xmm0);
-    __ minss(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ sqrtss(xmm1, xmm0);
-    __ sqrtss(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ addps(xmm1, xmm0);
-    __ addps(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ subps(xmm1, xmm0);
-    __ subps(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ mulps(xmm1, xmm0);
-    __ mulps(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ divps(xmm1, xmm0);
-    __ divps(xmm1, Operand(rbx, rcx, times_4, 10000));
-
     __ ucomiss(xmm0, xmm1);
     __ ucomiss(xmm0, Operand(rbx, rcx, times_4, 10000));
+
+#define EMIT_SSE_INSTR(instruction, notUsed1, notUsed2) \
+  __ instruction(xmm1, xmm0);                           \
+  __ instruction(xmm1, Operand(rbx, rcx, times_4, 10000));
+    SSE_BINOP_INSTRUCTION_LIST(EMIT_SSE_INSTR)
+    SSE_UNOP_INSTRUCTION_LIST(EMIT_SSE_INSTR)
+#undef EMIT_SSE_INSTR
+
+#define EMIT_SSE_INSTR(instruction, notUsed1, notUsed2, notUse3) \
+  __ instruction(xmm1, xmm0);                                    \
+  __ instruction(xmm1, Operand(rbx, rcx, times_4, 10000));
+    SSE_INSTRUCTION_LIST_SS(EMIT_SSE_INSTR)
+#undef EMIT_SSE_INSTR
   }
 
   // SSE2 instructions
@@ -448,20 +435,6 @@ TEST(DisasmX64) {
     __ movdqa(xmm0, Operand(rbx, rcx, times_4, 10000));
     __ movdqa(Operand(rbx, rcx, times_4, 10000), xmm0);
 
-    __ addsd(xmm1, xmm0);
-    __ addsd(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ mulsd(xmm1, xmm0);
-    __ mulsd(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ subsd(xmm1, xmm0);
-    __ subsd(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ divsd(xmm1, xmm0);
-    __ divsd(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ minsd(xmm1, xmm0);
-    __ minsd(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ maxsd(xmm1, xmm0);
-    __ maxsd(xmm1, Operand(rbx, rcx, times_4, 10000));
-    __ sqrtsd(xmm1, xmm0);
-    __ sqrtsd(xmm1, Operand(rbx, rcx, times_4, 10000));
     __ ucomisd(xmm0, xmm1);
 
     __ andpd(xmm0, xmm1);
@@ -471,11 +444,6 @@ TEST(DisasmX64) {
     __ xorpd(xmm0, xmm1);
     __ xorpd(xmm0, Operand(rbx, rcx, times_4, 10000));
 
-    __ pslld(xmm0, 6);
-    __ psrld(xmm0, 6);
-    __ psllq(xmm0, 6);
-    __ psrlq(xmm0, 6);
-
     __ pcmpeqd(xmm1, xmm0);
 
     __ punpckldq(xmm1, xmm11);
@@ -490,7 +458,14 @@ TEST(DisasmX64) {
   __ instruction(xmm5, Operand(rdx, 4));
 
     SSE2_INSTRUCTION_LIST(EMIT_SSE2_INSTR)
+    SSE2_INSTRUCTION_LIST_SD(EMIT_SSE2_INSTR)
 #undef EMIT_SSE2_INSTR
+
+#define EMIT_SSE2_SHIFT_IMM(instruction, notUsed1, notUsed2, notUsed3, \
+                            notUsed4)                                  \
+  __ instruction(xmm3, 0xA3);
+    SSE2_INSTRUCTION_LIST_SHIFT_IMM(EMIT_SSE2_SHIFT_IMM)
+#undef EMIT_SSE2_SHIFT_IMM
   }
 
   // cmov.
@@ -528,6 +503,11 @@ TEST(DisasmX64) {
   __ instruction(xmm5, xmm1);                                                 \
   __ instruction(xmm5, Operand(rdx, 4));
 
+#define EMIT_SSE34_IMM_INSTR(instruction, notUsed1, notUsed2, notUsed3, \
+                             notUsed4)                                  \
+  __ instruction(rbx, xmm15, 0);                                        \
+  __ instruction(Operand(rax, 10), xmm0, 1);
+
   {
     if (CpuFeatures::IsSupported(SSSE3)) {
       CpuFeatureScope scope(&assm, SSSE3);
@@ -541,11 +521,7 @@ TEST(DisasmX64) {
     if (CpuFeatures::IsSupported(SSE4_1)) {
       CpuFeatureScope scope(&assm, SSE4_1);
       __ insertps(xmm5, xmm1, 123);
-      __ extractps(rax, xmm1, 0);
-      __ pextrw(rbx, xmm2, 1);
       __ pinsrw(xmm2, rcx, 1);
-      __ pextrd(rbx, xmm15, 0);
-      __ pextrd(r12, xmm0, 1);
       __ pextrq(r12, xmm0, 1);
       __ pinsrd(xmm9, r9, 0);
       __ pinsrd(xmm5, Operand(rax, 4), 1);
@@ -583,17 +559,10 @@ TEST(DisasmX64) {
       __ cmpnlepd(xmm5, xmm1);
       __ cmpnlepd(xmm5, Operand(rbx, rcx, times_4, 10000));
 
-      __ minps(xmm5, xmm1);
-      __ minps(xmm5, Operand(rdx, 4));
-      __ maxps(xmm5, xmm1);
-      __ maxps(xmm5, Operand(rdx, 4));
-      __ rcpps(xmm5, xmm1);
-      __ rcpps(xmm5, Operand(rdx, 4));
-      __ sqrtps(xmm5, xmm1);
-      __ sqrtps(xmm5, Operand(rdx, 4));
       __ movups(xmm5, xmm1);
       __ movups(xmm5, Operand(rdx, 4));
       __ movups(Operand(rdx, 4), xmm5);
+      __ movlhps(xmm5, xmm1);
       __ pmulld(xmm5, xmm1);
       __ pmulld(xmm5, Operand(rdx, 4));
       __ pmullw(xmm5, xmm1);
@@ -606,8 +575,12 @@ TEST(DisasmX64) {
       __ cvtps2dq(xmm5, Operand(rdx, 4));
       __ cvtdq2ps(xmm5, xmm1);
       __ cvtdq2ps(xmm5, Operand(rdx, 4));
+      __ blendvpd(xmm5, xmm1);
+      __ blendvpd(xmm5, Operand(rdx, 4));
 
       SSE4_INSTRUCTION_LIST(EMIT_SSE34_INSTR)
+      SSE4_PMOV_INSTRUCTION_LIST(EMIT_SSE34_INSTR)
+      SSE4_EXTRACT_INSTRUCTION_LIST(EMIT_SSE34_IMM_INSTR)
     }
   }
 
@@ -619,6 +592,7 @@ TEST(DisasmX64) {
     }
   }
 #undef EMIT_SSE34_INSTR
+#undef EMIT_SSE34_IMM_INSTR
 
   // AVX instruction
   {
@@ -658,6 +632,9 @@ TEST(DisasmX64) {
       __ vmovsd(xmm9, Operand(rbx, rcx, times_4, 10000));
       __ vmovsd(Operand(rbx, rcx, times_4, 10000), xmm0);
 
+      __ vmovdqu(xmm9, Operand(rbx, rcx, times_4, 10000));
+      __ vmovdqu(Operand(rbx, rcx, times_4, 10000), xmm0);
+
       __ vaddsd(xmm0, xmm1, xmm2);
       __ vaddsd(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
       __ vmulsd(xmm0, xmm1, xmm2);
@@ -670,6 +647,7 @@ TEST(DisasmX64) {
       __ vminsd(xmm9, xmm1, Operand(rbx, rcx, times_8, 10000));
       __ vmaxsd(xmm8, xmm1, xmm2);
       __ vmaxsd(xmm9, xmm1, Operand(rbx, rcx, times_1, 10000));
+      __ vroundss(xmm9, xmm1, xmm2, kRoundDown);
       __ vroundsd(xmm8, xmm3, xmm0, kRoundDown);
       __ vsqrtsd(xmm8, xmm1, xmm2);
       __ vsqrtsd(xmm9, xmm1, Operand(rbx, rcx, times_1, 10000));
@@ -698,6 +676,7 @@ TEST(DisasmX64) {
       __ vmovups(xmm5, xmm1);
       __ vmovups(xmm5, Operand(rdx, 4));
       __ vmovups(Operand(rdx, 4), xmm5);
+      __ vmovlhps(xmm1, xmm3, xmm5);
 
       __ vandps(xmm0, xmm9, xmm2);
       __ vandps(xmm9, xmm1, Operand(rbx, rcx, times_4, 10000));
@@ -717,8 +696,6 @@ TEST(DisasmX64) {
 
       __ vpcmpeqd(xmm0, xmm15, xmm5);
       __ vpcmpeqd(xmm15, xmm0, Operand(rbx, rcx, times_4, 10000));
-      __ vpsllq(xmm0, xmm15, 21);
-      __ vpsrlq(xmm15, xmm0, 21);
 
       __ vcmpps(xmm5, xmm4, xmm1, 1);
       __ vcmpps(xmm5, xmm4, Operand(rbx, rcx, times_4, 10000), 1);
@@ -749,6 +726,20 @@ TEST(DisasmX64) {
       __ vcmpnlepd(xmm5, xmm4, xmm1);
       __ vcmpnlepd(xmm5, xmm4, Operand(rbx, rcx, times_4, 10000));
 
+#define EMIT_SSE_UNOP_AVXINSTR(instruction, notUsed1, notUsed2) \
+  __ v##instruction(xmm10, xmm1);                               \
+  __ v##instruction(xmm10, Operand(rbx, rcx, times_4, 10000));
+
+      SSE_UNOP_INSTRUCTION_LIST(EMIT_SSE_UNOP_AVXINSTR)
+#undef EMIT_SSE_UNOP_AVXINSTR
+
+#define EMIT_SSE_BINOP_AVXINSTR(instruction, notUsed1, notUsed2) \
+  __ v##instruction(xmm10, xmm5, xmm1);                          \
+  __ v##instruction(xmm10, xmm5, Operand(rbx, rcx, times_4, 10000));
+
+      SSE_BINOP_INSTRUCTION_LIST(EMIT_SSE_BINOP_AVXINSTR)
+#undef EMIT_SSE_BINOP_AVXINSTR
+
 #define EMIT_SSE2_AVXINSTR(instruction, notUsed1, notUsed2, notUsed3) \
   __ v##instruction(xmm10, xmm5, xmm1);                               \
   __ v##instruction(xmm10, xmm5, Operand(rdx, 4));
@@ -761,20 +752,35 @@ TEST(DisasmX64) {
       SSE2_INSTRUCTION_LIST(EMIT_SSE2_AVXINSTR)
       SSSE3_INSTRUCTION_LIST(EMIT_SSE34_AVXINSTR)
       SSE4_INSTRUCTION_LIST(EMIT_SSE34_AVXINSTR)
+      SSE4_2_INSTRUCTION_LIST(EMIT_SSE34_AVXINSTR)
 #undef EMIT_SSE2_AVXINSTR
 #undef EMIT_SSE34_AVXINSTR
 
+#define EMIT_SSE4_PMOV_AVXINSTR(instruction, notUsed1, notUsed2, notUsed3, \
+                                notUsed4)                                  \
+  __ v##instruction(xmm10, xmm1);                                          \
+  __ v##instruction(xmm10, Operand(rdx, 4));
+      SSE4_PMOV_INSTRUCTION_LIST(EMIT_SSE4_PMOV_AVXINSTR)
+#undef EMIT_SSE4_PMOV_AVXINSTR
+
+#define EMIT_SSE2_SHIFT_IMM_AVX(instruction, notUsed1, notUsed2, notUsed3, \
+                                notUsed4)                                  \
+  __ v##instruction(xmm0, xmm15, 21);
+      SSE2_INSTRUCTION_LIST_SHIFT_IMM(EMIT_SSE2_SHIFT_IMM_AVX)
+#undef EMIT_SSE2_SHIFT_IMM_AVX
+
+      __ vinsertps(xmm1, xmm2, xmm3, 1);
+      __ vinsertps(xmm1, xmm2, Operand(rbx, rcx, times_4, 10000), 1);
+      __ vextractps(rax, xmm1, 1);
+
       __ vlddqu(xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vpsllw(xmm0, xmm15, 21);
-      __ vpsrlw(xmm0, xmm15, 21);
-      __ vpsraw(xmm0, xmm15, 21);
-      __ vpsrad(xmm0, xmm15, 21);
       __ vpextrb(rax, xmm2, 12);
       __ vpextrb(Operand(rbx, rcx, times_4, 10000), xmm2, 12);
       __ vpextrw(rax, xmm2, 5);
       __ vpextrw(Operand(rbx, rcx, times_4, 10000), xmm2, 5);
       __ vpextrd(rax, xmm2, 2);
       __ vpextrd(Operand(rbx, rcx, times_4, 10000), xmm2, 2);
+      __ vpextrq(rax, xmm2, 2);
 
       __ vpinsrb(xmm1, xmm2, rax, 12);
       __ vpinsrb(xmm1, xmm2, Operand(rbx, rcx, times_4, 10000), 12);
@@ -782,7 +788,21 @@ TEST(DisasmX64) {
       __ vpinsrw(xmm1, xmm2, Operand(rbx, rcx, times_4, 10000), 5);
       __ vpinsrd(xmm1, xmm2, rax, 2);
       __ vpinsrd(xmm1, xmm2, Operand(rbx, rcx, times_4, 10000), 2);
+      __ vpinsrq(xmm1, xmm2, rax, 9);
+      __ vpinsrq(xmm1, xmm2, Operand(rbx, rcx, times_4, 10000), 9);
       __ vpshufd(xmm1, xmm2, 85);
+      __ vpshuflw(xmm1, xmm2, 85);
+      __ vpshuflw(xmm1, Operand(rbx, rcx, times_4, 10000), 85);
+      __ vshufps(xmm3, xmm2, xmm3, 3);
+      __ vpblendw(xmm1, xmm2, xmm3, 23);
+      __ vpblendw(xmm1, xmm2, Operand(rbx, rcx, times_4, 10000), 23);
+      __ vpalignr(xmm1, xmm2, xmm3, 4);
+
+      __ vblendvpd(xmm1, xmm2, xmm3, xmm4);
+
+      __ vmovddup(xmm1, xmm2);
+      __ vmovddup(xmm1, Operand(rbx, rcx, times_4, 10000));
+      __ vbroadcastss(xmm1, Operand(rbx, rcx, times_4, 10000));
     }
   }
 
@@ -790,68 +810,12 @@ TEST(DisasmX64) {
   {
     if (CpuFeatures::IsSupported(FMA3)) {
       CpuFeatureScope scope(&assm, FMA3);
-      __ vfmadd132sd(xmm0, xmm1, xmm2);
-      __ vfmadd132sd(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfmadd213sd(xmm0, xmm1, xmm2);
-      __ vfmadd213sd(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfmadd231sd(xmm0, xmm1, xmm2);
-      __ vfmadd231sd(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-
-      __ vfmadd132sd(xmm9, xmm10, xmm11);
-      __ vfmadd132sd(xmm9, xmm10, Operand(r9, r11, times_4, 10000));
-      __ vfmadd213sd(xmm9, xmm10, xmm11);
-      __ vfmadd213sd(xmm9, xmm10, Operand(r9, r11, times_4, 10000));
-      __ vfmadd231sd(xmm9, xmm10, xmm11);
-      __ vfmadd231sd(xmm9, xmm10, Operand(r9, r11, times_4, 10000));
-
-      __ vfmsub132sd(xmm0, xmm1, xmm2);
-      __ vfmsub132sd(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfmsub213sd(xmm0, xmm1, xmm2);
-      __ vfmsub213sd(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfmsub231sd(xmm0, xmm1, xmm2);
-      __ vfmsub231sd(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-
-      __ vfnmadd132sd(xmm0, xmm1, xmm2);
-      __ vfnmadd132sd(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfnmadd213sd(xmm0, xmm1, xmm2);
-      __ vfnmadd213sd(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfnmadd231sd(xmm0, xmm1, xmm2);
-      __ vfnmadd231sd(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-
-      __ vfnmsub132sd(xmm0, xmm1, xmm2);
-      __ vfnmsub132sd(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfnmsub213sd(xmm0, xmm1, xmm2);
-      __ vfnmsub213sd(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfnmsub231sd(xmm0, xmm1, xmm2);
-      __ vfnmsub231sd(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-
-      __ vfmadd132ss(xmm0, xmm1, xmm2);
-      __ vfmadd132ss(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfmadd213ss(xmm0, xmm1, xmm2);
-      __ vfmadd213ss(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfmadd231ss(xmm0, xmm1, xmm2);
-      __ vfmadd231ss(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-
-      __ vfmsub132ss(xmm0, xmm1, xmm2);
-      __ vfmsub132ss(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfmsub213ss(xmm0, xmm1, xmm2);
-      __ vfmsub213ss(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfmsub231ss(xmm0, xmm1, xmm2);
-      __ vfmsub231ss(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-
-      __ vfnmadd132ss(xmm0, xmm1, xmm2);
-      __ vfnmadd132ss(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfnmadd213ss(xmm0, xmm1, xmm2);
-      __ vfnmadd213ss(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfnmadd231ss(xmm0, xmm1, xmm2);
-      __ vfnmadd231ss(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-
-      __ vfnmsub132ss(xmm0, xmm1, xmm2);
-      __ vfnmsub132ss(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfnmsub213ss(xmm0, xmm1, xmm2);
-      __ vfnmsub213ss(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
-      __ vfnmsub231ss(xmm0, xmm1, xmm2);
-      __ vfnmsub231ss(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
+#define EMIT_FMA(instr, notUsed1, notUsed2, notUsed3, notUsed4, notUsed5, \
+                 notUsed6)                                                \
+  __ instr(xmm9, xmm10, xmm11);                                           \
+  __ instr(xmm9, xmm10, Operand(rbx, rcx, times_4, 10000));
+      FMA_INSTRUCTION_LIST(EMIT_FMA)
+#undef EMIT_FMA
     }
   }
 
@@ -965,6 +929,18 @@ TEST(DisasmX64) {
     __ cmpxchgq(Operand(rbx, rcx, times_4, 10000), rax);
   }
 
+  // xadd.
+  {
+    __ xaddb(Operand(rsp, 12), rax);
+    __ xaddw(Operand(rsp, 12), rax);
+    __ xaddl(Operand(rsp, 12), rax);
+    __ xaddq(Operand(rsp, 12), rax);
+    __ xaddb(Operand(rbx, rcx, times_4, 10000), rax);
+    __ xaddw(Operand(rbx, rcx, times_4, 10000), rax);
+    __ xaddl(Operand(rbx, rcx, times_4, 10000), rax);
+    __ xaddq(Operand(rbx, rcx, times_4, 10000), rax);
+  }
+
   // lock prefix.
   {
     __ lock();
diff --git a/deps/v8/test/cctest/test-extra.js b/deps/v8/test/cctest/test-extra.js
deleted file mode 100644
index f36910822859a6..00000000000000
--- a/deps/v8/test/cctest/test-extra.js
+++ /dev/null
@@ -1,122 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-(function (global, binding, v8) {
-  'use strict';
-  binding.testExtraShouldReturnFive = function() {
-    return 5;
-  };
-
-  binding.testExtraShouldCallToRuntime = function() {
-    return binding.runtime(3);
-  };
-
-  binding.testFunctionToString = function() {
-    function foo() { return 1; }
-    return foo.toString();
-  };
-
-  binding.testStackTrace = function(f) {
-    return f();
-  }
-
-  // Exercise all of the extras utils:
-  // - v8.createPrivateSymbol
-  // - v8.uncurryThis
-  // - v8.InternalPackedArray
-  // - v8.createPromise, v8.resolvePromise, v8.rejectPromise
-
-  const Object = global.Object;
-  const hasOwn = v8.uncurryThis(Object.prototype.hasOwnProperty);
-
-  const Function = global.Function;
-  const call = v8.uncurryThis(Function.prototype.call);
-  const apply = v8.uncurryThis(Function.prototype.apply);
-
-  const Promise = global.Promise;
-  const Promise_resolve = Promise.resolve.bind(Promise);
-
-  const arrayToTest = new v8.InternalPackedArray();
-  arrayToTest.push(1);
-  arrayToTest.push(2);
-  arrayToTest.pop();
-  arrayToTest.unshift("a", "b", "c");
-  arrayToTest.shift();
-  arrayToTest.splice(0, 1);
-  const slicedArray = arrayToTest.slice();
-  const arraysOK = arrayToTest.length === 2 && arrayToTest[0] === "c" &&
-      arrayToTest[1] === 1 && slicedArray.length === 2 &&
-      slicedArray[0] === "c" && slicedArray[1] === 1;
-
-  binding.testCreatePromise = function() {
-    return v8.createPromise();
-  }
-
-  binding.testCreatePromiseWithParent = function(parent) {
-    return v8.createPromise(parent);
-  }
-
-  binding.testRejectPromise = function(promise, reason) {
-    return v8.rejectPromise(promise, reason);
-  }
-
-  binding.testResolvePromise = function(promise, resolution) {
-    return v8.resolvePromise(promise, resolution);
-  }
-
-  binding.testExtraCanUseUtils = function() {
-    const fulfilledPromise = v8.createPromise();
-    v8.resolvePromise(
-      fulfilledPromise,
-      hasOwn({ test: 'test' }, 'test') ? 1 : -1,
-      undefined  // pass an extra arg to test arguments adapter frame
-    );
-
-    const fulfilledPromise2 = Promise_resolve(call(function (arg1, arg2) {
-      return (this.prop === arg1 && arg1 === 'value' && arg2) ? 2 : -1;
-    }, { prop: 'value' }, 'value', arraysOK));
-
-    const rejectedPromise = v8.createPromise();
-    v8.rejectPromise(rejectedPromise, apply(function (arg1, arg2) {
-      return (arg1 === arg2 && arg2 === 'x') ? 3 : -1;
-    }, null, ['x', 'x']));
-
-    const rejectedButHandledPromise = v8.createPromise();
-    v8.rejectPromise(rejectedButHandledPromise, 4);
-    v8.markPromiseAsHandled(rejectedButHandledPromise);
-
-    function promiseStateToString(promise) {
-      switch (v8.promiseState(promise)) {
-        case v8.kPROMISE_PENDING:
-          return "pending";
-        case v8.kPROMISE_FULFILLED:
-          return "fulfilled";
-        case v8.kPROMISE_REJECTED:
-          return "rejected";
-        default:
-          throw new Error("Unexpected value for promiseState");
-      }
-    }
-
-    let promiseStates = promiseStateToString(new Promise(() => {})) + ' ' +
-                        promiseStateToString(fulfilledPromise) + ' ' +
-                        promiseStateToString(rejectedPromise);
-
-    const uncurryThis = v8.uncurryThis(function (a, b, c, d, e) {
-      return (this + a + b + c + d + e) === 21;
-    })(1, 2, 3, 4, 5, 6);
-
-    return {
-      privateSymbol: v8.createPrivateSymbol('sym'),
-      fulfilledPromise, // should be fulfilled with 1
-      fulfilledPromise2, // should be fulfilled with 2
-      rejectedPromise, // should be rejected with 3
-      rejectedButHandledPromise, // should be rejected but have a handler
-      promiseStates, // should be the string "pending fulfilled rejected"
-      promiseIsPromise: v8.isPromise(fulfilledPromise), // should be true
-      thenableIsPromise: v8.isPromise({ then() { } }),  // should be false
-      uncurryThis // should be true
-    };
-  };
-})
diff --git a/deps/v8/test/cctest/test-field-type-tracking.cc b/deps/v8/test/cctest/test-field-type-tracking.cc
index 9eb9071d77c7b4..9deb1ff70cf336 100644
--- a/deps/v8/test/cctest/test-field-type-tracking.cc
+++ b/deps/v8/test/cctest/test-field-type-tracking.cc
@@ -515,7 +515,7 @@ TEST(ReconfigureAccessorToNonExistingDataField) {
       isolate, map, first, kData, NONE, Representation::None(), none_type);
   CHECK_EQ(*new_map, *new_map2);
 
-  Handle<Object> value(Smi::kZero, isolate);
+  Handle<Object> value(Smi::zero(), isolate);
   Handle<Map> prepared_map = Map::PrepareForDataProperty(
       isolate, new_map, first, PropertyConstness::kConst, value);
   // None to Smi generalization is trivial, map does not change.
@@ -2660,7 +2660,7 @@ TEST(TransitionDataFieldToDataField) {
 
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
-  Handle<Object> value1 = handle(Smi::kZero, isolate);
+  Handle<Object> value1 = handle(Smi::zero(), isolate);
   TransitionToDataFieldOperator transition_op1(
       PropertyConstness::kMutable, Representation::Smi(), any_type, value1);
 
diff --git a/deps/v8/test/cctest/test-global-handles.cc b/deps/v8/test/cctest/test-global-handles.cc
index 98a66bf535084e..a3c8fb7bde6238 100644
--- a/deps/v8/test/cctest/test-global-handles.cc
+++ b/deps/v8/test/cctest/test-global-handles.cc
@@ -50,7 +50,7 @@ class NonRootingEmbedderHeapTracer final : public v8::EmbedderHeapTracer {
   bool AdvanceTracing(double deadline_in_ms) final { return true; }
   bool IsTracingDone() final { return true; }
   void TracePrologue(TraceFlags) final {}
-  void TraceEpilogue() final {}
+  void TraceEpilogue(TraceSummary*) final {}
   void EnterFinalPause(EmbedderStackState) final {}
 
   bool IsRootForNonTracingGC(const v8::TracedGlobal<v8::Value>& handle) final {
diff --git a/deps/v8/test/cctest/test-heap-profiler.cc b/deps/v8/test/cctest/test-heap-profiler.cc
index 7784a7f855f715..4d70d66724741c 100644
--- a/deps/v8/test/cctest/test-heap-profiler.cc
+++ b/deps/v8/test/cctest/test-heap-profiler.cc
@@ -839,13 +839,24 @@ TEST(HeapSnapshotEphemeron) {
   const v8::HeapGraphNode* key = GetProperty(
       env->GetIsolate(), global, v8::HeapGraphEdge::kProperty, "key");
   CHECK(key);
+  const v8::HeapGraphNode* weakmap = GetProperty(
+      env->GetIsolate(), global, v8::HeapGraphEdge::kProperty, "wm");
+  CHECK(weakmap);
+  const v8::HeapGraphNode* weakmap_table = GetProperty(
+      env->GetIsolate(), weakmap, v8::HeapGraphEdge::kInternal, "table");
+  CHECK(weakmap_table);
   bool success = false;
   for (int i = 0, count = key->GetChildrenCount(); i < count; ++i) {
     const v8::HeapGraphEdge* edge = key->GetChild(i);
     const v8::HeapGraphNode* child = edge->GetToNode();
     if (!strcmp("ValueClass", GetName(child))) {
       v8::String::Utf8Value edge_name(CcTest::isolate(), edge->GetName());
-      CHECK(EndsWith(*edge_name, " / key KeyClass in WeakMap"));
+      std::stringstream end_of_label;
+      end_of_label << "/ part of key (KeyClass @" << key->GetId()
+                   << ") -> value (ValueClass @" << child->GetId()
+                   << ") pair in WeakMap (table @" << weakmap_table->GetId()
+                   << ")";
+      CHECK(EndsWith(*edge_name, end_of_label.str().c_str()));
       success = true;
       break;
     }
@@ -2580,7 +2591,7 @@ TEST(ManyLocalsInSharedContext) {
       env->GetIsolate(), ok_object, v8::HeapGraphEdge::kInternal, "context");
   CHECK(context_object);
   // Check the objects are not duplicated in the context.
-  CHECK_EQ(v8::internal::Context::MIN_CONTEXT_SLOTS + num_objects - 1,
+  CHECK_EQ(v8::internal::Context::MIN_CONTEXT_EXTENDED_SLOTS + num_objects - 1,
            context_object->GetChildrenCount());
   // Check all the objects have got their names.
   // ... well check just every 15th because otherwise it's too slow in debug.
@@ -2712,7 +2723,7 @@ TEST(CheckCodeNames) {
   CHECK(ValidateSnapshot(snapshot));
 
   const char* builtin_path1[] = {"::(GC roots)", "::(Builtins)",
-                                 "::(KeyedLoadIC_Slow builtin)"};
+                                 "::(KeyedLoadIC_PolymorphicName builtin)"};
   const v8::HeapGraphNode* node = GetNodeByPath(
       env->GetIsolate(), snapshot, builtin_path1, arraysize(builtin_path1));
   CHECK(node);
@@ -3027,16 +3038,12 @@ TEST(ArrayBufferSharedBackingStore) {
 
   v8::Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, 1024);
   CHECK_EQ(1024, static_cast<int>(ab->ByteLength()));
-  CHECK(!ab->IsExternal());
-  v8::ArrayBuffer::Contents ab_contents = ab->Externalize();
-  CHECK(ab->IsExternal());
+  std::shared_ptr<v8::BackingStore> backing_store = ab->GetBackingStore();
 
-  CHECK_EQ(1024, static_cast<int>(ab_contents.ByteLength()));
-  void* data = ab_contents.Data();
+  CHECK_EQ(1024, static_cast<int>(backing_store->ByteLength()));
+  void* data = backing_store->Data();
   CHECK_NOT_NULL(data);
-  v8::Local<v8::ArrayBuffer> ab2 =
-      v8::ArrayBuffer::New(isolate, data, ab_contents.ByteLength());
-  CHECK(ab2->IsExternal());
+  v8::Local<v8::ArrayBuffer> ab2 = v8::ArrayBuffer::New(isolate, backing_store);
   env->Global()->Set(env.local(), v8_str("ab1"), ab).FromJust();
   env->Global()->Set(env.local(), v8_str("ab2"), ab2).FromJust();
 
@@ -3062,8 +3069,6 @@ TEST(ArrayBufferSharedBackingStore) {
   CHECK(ab2_data);
   CHECK_EQ(ab1_data, ab2_data);
   CHECK_EQ(2, GetRetainersCount(snapshot, ab1_data));
-  ab_contents.Deleter()(ab_contents.Data(), ab_contents.ByteLength(),
-                        ab_contents.DeleterData());
 }
 
 
diff --git a/deps/v8/test/cctest/test-intl.cc b/deps/v8/test/cctest/test-intl.cc
index f3162411d377fe..7824fd657c86d1 100644
--- a/deps/v8/test/cctest/test-intl.cc
+++ b/deps/v8/test/cctest/test-intl.cc
@@ -130,7 +130,7 @@ TEST(GetStringOption) {
   }
 
   Handle<String> key = isolate->factory()->NewStringFromAsciiChecked("foo");
-  v8::internal::LookupIterator it(isolate, options, key);
+  LookupIterator it(isolate, options, key);
   CHECK(Object::SetProperty(&it, Handle<Smi>(Smi::FromInt(42), isolate),
                             StoreOrigin::kMaybeKeyed,
                             Just(ShouldThrow::kThrowOnError))
@@ -188,7 +188,7 @@ TEST(GetBoolOption) {
 
   Handle<String> key = isolate->factory()->NewStringFromAsciiChecked("foo");
   {
-    v8::internal::LookupIterator it(isolate, options, key);
+    LookupIterator it(isolate, options, key);
     Handle<Object> false_value =
         handle(i::ReadOnlyRoots(isolate).false_value(), isolate);
     Object::SetProperty(isolate, options, key, false_value,
@@ -203,7 +203,7 @@ TEST(GetBoolOption) {
   }
 
   {
-    v8::internal::LookupIterator it(isolate, options, key);
+    LookupIterator it(isolate, options, key);
     Handle<Object> true_value =
         handle(i::ReadOnlyRoots(isolate).true_value(), isolate);
     Object::SetProperty(isolate, options, key, true_value,
diff --git a/deps/v8/test/cctest/test-js-weak-refs.cc b/deps/v8/test/cctest/test-js-weak-refs.cc
index 9e44c3ad204db7..db43f46e71f190 100644
--- a/deps/v8/test/cctest/test-js-weak-refs.cc
+++ b/deps/v8/test/cctest/test-js-weak-refs.cc
@@ -124,18 +124,26 @@ void VerifyWeakCellChain(Isolate* isolate, Object list_head, int n_args, ...) {
 
 // Like VerifyWeakCellChain but verifies the chain created with key_list_prev
 // and key_list_next instead of prev and next.
-void VerifyWeakCellKeyChain(Isolate* isolate, Object list_head, int n_args,
-                            ...) {
+void VerifyWeakCellKeyChain(Isolate* isolate, SimpleNumberDictionary key_map,
+                            Object unregister_token, int n_args, ...) {
   CHECK_GE(n_args, 0);
 
   va_list args;
   va_start(args, n_args);
 
+  Object hash = unregister_token.GetHash();
+  InternalIndex entry = InternalIndex::NotFound();
+  if (!hash.IsUndefined(isolate)) {
+    uint32_t key = Smi::ToInt(hash);
+    entry = key_map.FindEntry(isolate, key);
+  }
   if (n_args == 0) {
     // Verify empty list
-    CHECK(list_head.IsTheHole(isolate));
+    CHECK(entry.is_not_found());
   } else {
+    CHECK(entry.is_found());
     WeakCell current = WeakCell::cast(Object(va_arg(args, Address)));
+    Object list_head = key_map.ValueAt(entry);
     CHECK_EQ(current, list_head);
     CHECK(current.key_list_prev().IsUndefined(isolate));
 
@@ -201,48 +209,45 @@ TEST(TestRegisterWithKey) {
   Handle<JSObject> js_object =
       isolate->factory()->NewJSObject(isolate->object_function());
 
-  Handle<JSObject> key1 = CreateKey("key1", isolate);
-  Handle<JSObject> key2 = CreateKey("key2", isolate);
+  Handle<JSObject> token1 = CreateKey("token1", isolate);
+  Handle<JSObject> token2 = CreateKey("token2", isolate);
   Handle<Object> undefined =
       handle(ReadOnlyRoots(isolate).undefined_value(), isolate);
 
   // Register a weak reference with a key and verify internal data structures.
   Handle<WeakCell> weak_cell1 = FinalizationGroupRegister(
-      finalization_group, js_object, undefined, key1, isolate);
+      finalization_group, js_object, undefined, token1, isolate);
 
   {
-    CHECK(finalization_group->key_map().IsObjectHashTable());
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 1, *weak_cell1);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key2), 0);
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 1, *weak_cell1);
+    VerifyWeakCellKeyChain(isolate, key_map, *token2, 0);
   }
 
   // Register another weak reference with a different key and verify internal
   // data structures.
   Handle<WeakCell> weak_cell2 = FinalizationGroupRegister(
-      finalization_group, js_object, undefined, key2, isolate);
+      finalization_group, js_object, undefined, token2, isolate);
 
   {
-    CHECK(finalization_group->key_map().IsObjectHashTable());
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 1, *weak_cell1);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key2), 1, *weak_cell2);
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 1, *weak_cell1);
+    VerifyWeakCellKeyChain(isolate, key_map, *token2, 1, *weak_cell2);
   }
 
-  // Register another weak reference with key1 and verify internal data
+  // Register another weak reference with token1 and verify internal data
   // structures.
   Handle<WeakCell> weak_cell3 = FinalizationGroupRegister(
-      finalization_group, js_object, undefined, key1, isolate);
+      finalization_group, js_object, undefined, token1, isolate);
 
   {
-    CHECK(finalization_group->key_map().IsObjectHashTable());
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 2, *weak_cell3,
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 2, *weak_cell3,
                            *weak_cell1);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key2), 1, *weak_cell2);
+    VerifyWeakCellKeyChain(isolate, key_map, *token2, 1, *weak_cell2);
   }
 }
 
@@ -385,14 +390,14 @@ TEST(TestJSFinalizationGroupPopClearedCellHoldings2) {
       ConstructJSFinalizationGroup(isolate);
   Handle<JSObject> js_object =
       isolate->factory()->NewJSObject(isolate->object_function());
-  Handle<JSObject> key1 = CreateKey("key1", isolate);
+  Handle<JSObject> token1 = CreateKey("token1", isolate);
 
   Handle<Object> holdings1 = factory->NewStringFromAsciiChecked("holdings1");
   Handle<WeakCell> weak_cell1 = FinalizationGroupRegister(
-      finalization_group, js_object, holdings1, key1, isolate);
+      finalization_group, js_object, holdings1, token1, isolate);
   Handle<Object> holdings2 = factory->NewStringFromAsciiChecked("holdings2");
   Handle<WeakCell> weak_cell2 = FinalizationGroupRegister(
-      finalization_group, js_object, holdings2, key1, isolate);
+      finalization_group, js_object, holdings2, token1, isolate);
 
   NullifyWeakCell(weak_cell1, isolate);
   NullifyWeakCell(weak_cell2, isolate);
@@ -400,9 +405,9 @@ TEST(TestJSFinalizationGroupPopClearedCellHoldings2) {
   // Nullifying doesn't affect the key chains (just moves WeakCells from
   // active_cells to cleared_cells).
   {
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 2, *weak_cell2,
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 2, *weak_cell2,
                            *weak_cell1);
   }
 
@@ -411,9 +416,9 @@ TEST(TestJSFinalizationGroupPopClearedCellHoldings2) {
   CHECK_EQ(cleared1, *holdings2);
 
   {
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 1, *weak_cell1);
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 1, *weak_cell1);
   }
 
   Object cleared2 =
@@ -421,9 +426,9 @@ TEST(TestJSFinalizationGroupPopClearedCellHoldings2) {
   CHECK_EQ(cleared2, *holdings1);
 
   {
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 0);
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 0);
   }
 }
 
@@ -438,39 +443,39 @@ TEST(TestUnregisterActiveCells) {
   Handle<JSObject> js_object =
       isolate->factory()->NewJSObject(isolate->object_function());
 
-  Handle<JSObject> key1 = CreateKey("key1", isolate);
-  Handle<JSObject> key2 = CreateKey("key2", isolate);
+  Handle<JSObject> token1 = CreateKey("token1", isolate);
+  Handle<JSObject> token2 = CreateKey("token2", isolate);
   Handle<Object> undefined =
       handle(ReadOnlyRoots(isolate).undefined_value(), isolate);
 
   Handle<WeakCell> weak_cell1a = FinalizationGroupRegister(
-      finalization_group, js_object, undefined, key1, isolate);
+      finalization_group, js_object, undefined, token1, isolate);
   Handle<WeakCell> weak_cell1b = FinalizationGroupRegister(
-      finalization_group, js_object, undefined, key1, isolate);
+      finalization_group, js_object, undefined, token1, isolate);
 
   Handle<WeakCell> weak_cell2a = FinalizationGroupRegister(
-      finalization_group, js_object, undefined, key2, isolate);
+      finalization_group, js_object, undefined, token2, isolate);
   Handle<WeakCell> weak_cell2b = FinalizationGroupRegister(
-      finalization_group, js_object, undefined, key2, isolate);
+      finalization_group, js_object, undefined, token2, isolate);
 
   VerifyWeakCellChain(isolate, finalization_group->active_cells(), 4,
                       *weak_cell2b, *weak_cell2a, *weak_cell1b, *weak_cell1a);
   VerifyWeakCellChain(isolate, finalization_group->cleared_cells(), 0);
   {
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 2, *weak_cell1b,
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 2, *weak_cell1b,
                            *weak_cell1a);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key2), 2, *weak_cell2b,
+    VerifyWeakCellKeyChain(isolate, key_map, *token2, 2, *weak_cell2b,
                            *weak_cell2a);
   }
 
-  JSFinalizationGroup::Unregister(finalization_group, key1, isolate);
+  JSFinalizationGroup::Unregister(finalization_group, token1, isolate);
   {
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 0);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key2), 2, *weak_cell2b,
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 0);
+    VerifyWeakCellKeyChain(isolate, key_map, *token2, 2, *weak_cell2b,
                            *weak_cell2a);
   }
 
@@ -491,20 +496,20 @@ TEST(TestUnregisterActiveAndClearedCells) {
   Handle<JSObject> js_object =
       isolate->factory()->NewJSObject(isolate->object_function());
 
-  Handle<JSObject> key1 = CreateKey("key1", isolate);
-  Handle<JSObject> key2 = CreateKey("key2", isolate);
+  Handle<JSObject> token1 = CreateKey("token1", isolate);
+  Handle<JSObject> token2 = CreateKey("token2", isolate);
   Handle<Object> undefined =
       handle(ReadOnlyRoots(isolate).undefined_value(), isolate);
 
   Handle<WeakCell> weak_cell1a = FinalizationGroupRegister(
-      finalization_group, js_object, undefined, key1, isolate);
+      finalization_group, js_object, undefined, token1, isolate);
   Handle<WeakCell> weak_cell1b = FinalizationGroupRegister(
-      finalization_group, js_object, undefined, key1, isolate);
+      finalization_group, js_object, undefined, token1, isolate);
 
   Handle<WeakCell> weak_cell2a = FinalizationGroupRegister(
-      finalization_group, js_object, undefined, key2, isolate);
+      finalization_group, js_object, undefined, token2, isolate);
   Handle<WeakCell> weak_cell2b = FinalizationGroupRegister(
-      finalization_group, js_object, undefined, key2, isolate);
+      finalization_group, js_object, undefined, token2, isolate);
 
   NullifyWeakCell(weak_cell2a, isolate);
 
@@ -513,26 +518,26 @@ TEST(TestUnregisterActiveAndClearedCells) {
   VerifyWeakCellChain(isolate, finalization_group->cleared_cells(), 1,
                       *weak_cell2a);
   {
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 2, *weak_cell1b,
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 2, *weak_cell1b,
                            *weak_cell1a);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key2), 2, *weak_cell2b,
+    VerifyWeakCellKeyChain(isolate, key_map, *token2, 2, *weak_cell2b,
                            *weak_cell2a);
   }
 
-  JSFinalizationGroup::Unregister(finalization_group, key2, isolate);
+  JSFinalizationGroup::Unregister(finalization_group, token2, isolate);
 
   // Both weak_cell2a and weak_cell2b removed.
   VerifyWeakCellChain(isolate, finalization_group->active_cells(), 2,
                       *weak_cell1b, *weak_cell1a);
   VerifyWeakCellChain(isolate, finalization_group->cleared_cells(), 0);
   {
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 2, *weak_cell1b,
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 2, *weak_cell1b,
                            *weak_cell1a);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key2), 0);
+    VerifyWeakCellKeyChain(isolate, key_map, *token2, 0);
   }
 }
 
@@ -547,40 +552,40 @@ TEST(TestWeakCellUnregisterTwice) {
   Handle<JSObject> js_object =
       isolate->factory()->NewJSObject(isolate->object_function());
 
-  Handle<JSObject> key1 = CreateKey("key1", isolate);
+  Handle<JSObject> token1 = CreateKey("token1", isolate);
   Handle<Object> undefined =
       handle(ReadOnlyRoots(isolate).undefined_value(), isolate);
 
   Handle<WeakCell> weak_cell1 = FinalizationGroupRegister(
-      finalization_group, js_object, undefined, key1, isolate);
+      finalization_group, js_object, undefined, token1, isolate);
 
   VerifyWeakCellChain(isolate, finalization_group->active_cells(), 1,
                       *weak_cell1);
   VerifyWeakCellChain(isolate, finalization_group->cleared_cells(), 0);
   {
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 1, *weak_cell1);
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 1, *weak_cell1);
   }
 
-  JSFinalizationGroup::Unregister(finalization_group, key1, isolate);
+  JSFinalizationGroup::Unregister(finalization_group, token1, isolate);
 
   VerifyWeakCellChain(isolate, finalization_group->active_cells(), 0);
   VerifyWeakCellChain(isolate, finalization_group->cleared_cells(), 0);
   {
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 0);
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 0);
   }
 
-  JSFinalizationGroup::Unregister(finalization_group, key1, isolate);
+  JSFinalizationGroup::Unregister(finalization_group, token1, isolate);
 
   VerifyWeakCellChain(isolate, finalization_group->active_cells(), 0);
   VerifyWeakCellChain(isolate, finalization_group->cleared_cells(), 0);
   {
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 0);
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 0);
   }
 }
 
@@ -595,10 +600,10 @@ TEST(TestWeakCellUnregisterPopped) {
       ConstructJSFinalizationGroup(isolate);
   Handle<JSObject> js_object =
       isolate->factory()->NewJSObject(isolate->object_function());
-  Handle<JSObject> key1 = CreateKey("key1", isolate);
+  Handle<JSObject> token1 = CreateKey("token1", isolate);
   Handle<Object> holdings1 = factory->NewStringFromAsciiChecked("holdings1");
   Handle<WeakCell> weak_cell1 = FinalizationGroupRegister(
-      finalization_group, js_object, holdings1, key1, isolate);
+      finalization_group, js_object, holdings1, token1, isolate);
 
   NullifyWeakCell(weak_cell1, isolate);
 
@@ -610,19 +615,19 @@ TEST(TestWeakCellUnregisterPopped) {
   VerifyWeakCellChain(isolate, finalization_group->active_cells(), 0);
   VerifyWeakCellChain(isolate, finalization_group->cleared_cells(), 0);
   {
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 0);
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 0);
   }
 
-  JSFinalizationGroup::Unregister(finalization_group, key1, isolate);
+  JSFinalizationGroup::Unregister(finalization_group, token1, isolate);
 
   VerifyWeakCellChain(isolate, finalization_group->active_cells(), 0);
   VerifyWeakCellChain(isolate, finalization_group->cleared_cells(), 0);
   {
-    Handle<ObjectHashTable> key_map =
-        handle(ObjectHashTable::cast(finalization_group->key_map()), isolate);
-    VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 0);
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 0);
   }
 }
 
@@ -634,9 +639,9 @@ TEST(TestWeakCellUnregisterNonexistentKey) {
   HandleScope outer_scope(isolate);
   Handle<JSFinalizationGroup> finalization_group =
       ConstructJSFinalizationGroup(isolate);
-  Handle<JSObject> key1 = CreateKey("key1", isolate);
+  Handle<JSObject> token1 = CreateKey("token1", isolate);
 
-  JSFinalizationGroup::Unregister(finalization_group, key1, isolate);
+  JSFinalizationGroup::Unregister(finalization_group, token1, isolate);
 }
 
 TEST(TestJSWeakRef) {
@@ -776,5 +781,69 @@ TEST(TestJSWeakRefKeepDuringJobIncrementalMarking) {
   CHECK(weak_ref->target().IsUndefined(isolate));
 }
 
+TEST(TestRemoveUnregisterToken) {
+  FLAG_harmony_weak_refs = true;
+  CcTest::InitializeVM();
+  LocalContext context;
+  Isolate* isolate = CcTest::i_isolate();
+  HandleScope outer_scope(isolate);
+  Handle<JSFinalizationGroup> finalization_group =
+      ConstructJSFinalizationGroup(isolate);
+  Handle<JSObject> js_object =
+      isolate->factory()->NewJSObject(isolate->object_function());
+
+  Handle<JSObject> token1 = CreateKey("token1", isolate);
+  Handle<JSObject> token2 = CreateKey("token2", isolate);
+  Handle<Object> undefined =
+      handle(ReadOnlyRoots(isolate).undefined_value(), isolate);
+
+  Handle<WeakCell> weak_cell1a = FinalizationGroupRegister(
+      finalization_group, js_object, undefined, token1, isolate);
+  Handle<WeakCell> weak_cell1b = FinalizationGroupRegister(
+      finalization_group, js_object, undefined, token1, isolate);
+
+  Handle<WeakCell> weak_cell2a = FinalizationGroupRegister(
+      finalization_group, js_object, undefined, token2, isolate);
+  Handle<WeakCell> weak_cell2b = FinalizationGroupRegister(
+      finalization_group, js_object, undefined, token2, isolate);
+
+  NullifyWeakCell(weak_cell2a, isolate);
+
+  VerifyWeakCellChain(isolate, finalization_group->active_cells(), 3,
+                      *weak_cell2b, *weak_cell1b, *weak_cell1a);
+  VerifyWeakCellChain(isolate, finalization_group->cleared_cells(), 1,
+                      *weak_cell2a);
+  {
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 2, *weak_cell1b,
+                           *weak_cell1a);
+    VerifyWeakCellKeyChain(isolate, key_map, *token2, 2, *weak_cell2b,
+                           *weak_cell2a);
+  }
+
+  finalization_group->RemoveUnregisterToken(
+      JSReceiver::cast(*token2), isolate,
+      [undefined](WeakCell matched_cell) {
+        matched_cell.set_unregister_token(*undefined);
+      },
+      [](HeapObject, ObjectSlot, Object) {});
+
+  // Both weak_cell2a and weak_cell2b remain on the weak cell chains.
+  VerifyWeakCellChain(isolate, finalization_group->active_cells(), 3,
+                      *weak_cell2b, *weak_cell1b, *weak_cell1a);
+  VerifyWeakCellChain(isolate, finalization_group->cleared_cells(), 1,
+                      *weak_cell2a);
+
+  // But both weak_cell2a and weak_cell2b are removed from the key chain.
+  {
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_group->key_map());
+    VerifyWeakCellKeyChain(isolate, key_map, *token1, 2, *weak_cell1b,
+                           *weak_cell1a);
+    VerifyWeakCellKeyChain(isolate, key_map, *token2, 0);
+  }
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-log.cc b/deps/v8/test/cctest/test-log.cc
index 26d574b4353e41..80a6530dd7a368 100644
--- a/deps/v8/test/cctest/test-log.cc
+++ b/deps/v8/test/cctest/test-log.cc
@@ -38,7 +38,6 @@
 #include "src/logging/log.h"
 #include "src/objects/objects-inl.h"
 #include "src/profiler/cpu-profiler.h"
-#include "src/snapshot/natives.h"
 #include "src/utils/ostreams.h"
 #include "src/utils/version.h"
 #include "test/cctest/cctest.h"
@@ -171,7 +170,7 @@ class ScopedLoggerInitializer {
       // conditions will be triggered.
       if (address_column >= columns.size()) continue;
       uintptr_t address =
-          strtoll(columns.at(address_column).c_str(), nullptr, 16);
+          strtoull(columns.at(address_column).c_str(), nullptr, 16);
       if (address == 0) continue;
       if (!allow_duplicates) {
         auto match = map.find(address);
@@ -461,11 +460,13 @@ UNINITIALIZED_TEST(Issue539892) {
         : CodeEventLogger(isolate) {}
 
     void CodeMoveEvent(i::AbstractCode from, i::AbstractCode to) override {}
-    void CodeDisableOptEvent(i::AbstractCode code,
-                             i::SharedFunctionInfo shared) override {}
+    void CodeDisableOptEvent(i::Handle<i::AbstractCode> code,
+                             i::Handle<i::SharedFunctionInfo> shared) override {
+    }
 
    private:
-    void LogRecordedBuffer(i::AbstractCode code, i::SharedFunctionInfo shared,
+    void LogRecordedBuffer(i::Handle<i::AbstractCode> code,
+                           i::MaybeHandle<i::SharedFunctionInfo> maybe_shared,
                            const char* name, int length) override {}
     void LogRecordedBuffer(const i::wasm::WasmCode* code, const char* name,
                            int length) override {}
diff --git a/deps/v8/test/cctest/test-macro-assembler-x64.cc b/deps/v8/test/cctest/test-macro-assembler-x64.cc
index e238c8c021ba2e..609b72f3ef91ee 100644
--- a/deps/v8/test/cctest/test-macro-assembler-x64.cc
+++ b/deps/v8/test/cctest/test-macro-assembler-x64.cc
@@ -187,7 +187,7 @@ void TestSmiCompare(MacroAssembler* masm, Label* exit, int id, int x, int y) {
 TEST(SmiCompare) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope handles(isolate);
-  auto buffer = AllocateAssemblerBuffer(2 * Assembler::kMinimalBufferSize);
+  auto buffer = AllocateAssemblerBuffer(2 * Assembler::kDefaultBufferSize);
   MacroAssembler assembler(isolate, v8::internal::CodeObjectRequired::kYes,
                            buffer->CreateView());
 
@@ -243,7 +243,7 @@ TEST(SmiTag) {
   __ movq(rax, Immediate(1));  // Test number.
   __ movq(rcx, Immediate(0));
   __ SmiTag(rcx);
-  __ Set(rdx, Smi::kZero.ptr());
+  __ Set(rdx, Smi::zero().ptr());
   __ cmp_tagged(rcx, rdx);
   __ j(not_equal, &exit);
 
diff --git a/deps/v8/test/cctest/test-modules.cc b/deps/v8/test/cctest/test-modules.cc
index d7cb6e610e5530..3d668360bd00e9 100644
--- a/deps/v8/test/cctest/test-modules.cc
+++ b/deps/v8/test/cctest/test-modules.cc
@@ -258,49 +258,49 @@ TEST(ModuleEvaluationError1) {
               .FromJust());
     CHECK_EQ(Module::kInstantiated, module->GetStatus());
 
-    MaybeLocal<Value> result_1;
     {
       v8::TryCatch inner_try_catch(isolate);
-      result_1 = module->Evaluate(env.local());
+      MaybeLocal<Value> result = module->Evaluate(env.local());
       CHECK_EQ(Module::kErrored, module->GetStatus());
       Local<Value> exception = module->GetException();
       CHECK(exception->StrictEquals(v8_str("boom")));
       ExpectInt32("Object.x", 1);
-      CHECK(inner_try_catch.HasCaught());
-      CHECK(inner_try_catch.Exception()->StrictEquals(v8_str("boom")));
+
+      if (i::FLAG_harmony_top_level_await) {
+        // With top level await, we do not throw and errored evaluation returns
+        // a rejected promise with the exception.
+        CHECK(!inner_try_catch.HasCaught());
+        Local<Promise> promise = Local<Promise>::Cast(result.ToLocalChecked());
+        CHECK_EQ(promise->State(), v8::Promise::kRejected);
+        CHECK_EQ(promise->Result(), module->GetException());
+      } else {
+        CHECK(inner_try_catch.HasCaught());
+        CHECK(inner_try_catch.Exception()->StrictEquals(v8_str("boom")));
+        CHECK(result.IsEmpty());
+      }
     }
 
-    MaybeLocal<Value> result_2;
     {
       v8::TryCatch inner_try_catch(isolate);
-      result_2 = module->Evaluate(env.local());
+      MaybeLocal<Value> result = module->Evaluate(env.local());
       CHECK_EQ(Module::kErrored, module->GetStatus());
       Local<Value> exception = module->GetException();
       CHECK(exception->StrictEquals(v8_str("boom")));
       ExpectInt32("Object.x", 1);
 
       if (i::FLAG_harmony_top_level_await) {
-        // With top level await we do not rethrow the exception.
+        // With top level await, we do not throw and errored evaluation returns
+        // a rejected promise with the exception.
         CHECK(!inner_try_catch.HasCaught());
+        Local<Promise> promise = Local<Promise>::Cast(result.ToLocalChecked());
+        CHECK_EQ(promise->State(), v8::Promise::kRejected);
+        CHECK_EQ(promise->Result(), module->GetException());
       } else {
         CHECK(inner_try_catch.HasCaught());
         CHECK(inner_try_catch.Exception()->StrictEquals(v8_str("boom")));
+        CHECK(result.IsEmpty());
       }
     }
-    if (i::FLAG_harmony_top_level_await) {
-      // With top level await, errored evaluation returns a rejected promise
-      // with the exception.
-      Local<Promise> promise_1 =
-          Local<Promise>::Cast(result_1.ToLocalChecked());
-      Local<Promise> promise_2 =
-          Local<Promise>::Cast(result_2.ToLocalChecked());
-      CHECK_EQ(promise_1->State(), v8::Promise::kRejected);
-      CHECK_EQ(promise_2->State(), v8::Promise::kRejected);
-      CHECK_EQ(promise_1->Result(), module->GetException());
-      CHECK_EQ(promise_2->Result(), module->GetException());
-    } else {
-      CHECK(result_1.IsEmpty() && result_2.IsEmpty());
-    }
 
     CHECK(!try_catch.HasCaught());
   }
@@ -342,15 +342,25 @@ TEST(ModuleEvaluationError2) {
               .FromJust());
     CHECK_EQ(Module::kInstantiated, failure_module->GetStatus());
 
-    MaybeLocal<Value> result_1;
     {
       v8::TryCatch inner_try_catch(isolate);
-      result_1 = failure_module->Evaluate(env.local());
+      MaybeLocal<Value> result = failure_module->Evaluate(env.local());
       CHECK_EQ(Module::kErrored, failure_module->GetStatus());
       Local<Value> exception = failure_module->GetException();
       CHECK(exception->StrictEquals(v8_str("boom")));
-      CHECK(inner_try_catch.HasCaught());
-      CHECK(inner_try_catch.Exception()->StrictEquals(v8_str("boom")));
+
+      if (i::FLAG_harmony_top_level_await) {
+        // With top level await, we do not throw and errored evaluation returns
+        // a rejected promise with the exception.
+        CHECK(!inner_try_catch.HasCaught());
+        Local<Promise> promise = Local<Promise>::Cast(result.ToLocalChecked());
+        CHECK_EQ(promise->State(), v8::Promise::kRejected);
+        CHECK_EQ(promise->Result(), failure_module->GetException());
+      } else {
+        CHECK(inner_try_catch.HasCaught());
+        CHECK(inner_try_catch.Exception()->StrictEquals(v8_str("boom")));
+        CHECK(result.IsEmpty());
+      }
     }
 
     Local<String> dependent_text =
@@ -367,39 +377,28 @@ TEST(ModuleEvaluationError2) {
               .FromJust());
     CHECK_EQ(Module::kInstantiated, dependent_module->GetStatus());
 
-    MaybeLocal<Value> result_2;
     {
       v8::TryCatch inner_try_catch(isolate);
-      result_2 = dependent_module->Evaluate(env.local());
+      MaybeLocal<Value> result = dependent_module->Evaluate(env.local());
       CHECK_EQ(Module::kErrored, dependent_module->GetStatus());
       Local<Value> exception = dependent_module->GetException();
       CHECK(exception->StrictEquals(v8_str("boom")));
       CHECK_EQ(exception, failure_module->GetException());
 
       if (i::FLAG_harmony_top_level_await) {
-        // With top level await we do not rethrow the exception.
+        // With top level await, we do not throw and errored evaluation returns
+        // a rejected promise with the exception.
         CHECK(!inner_try_catch.HasCaught());
+        Local<Promise> promise = Local<Promise>::Cast(result.ToLocalChecked());
+        CHECK_EQ(promise->State(), v8::Promise::kRejected);
+        CHECK_EQ(promise->Result(), failure_module->GetException());
       } else {
         CHECK(inner_try_catch.HasCaught());
         CHECK(inner_try_catch.Exception()->StrictEquals(v8_str("boom")));
+        CHECK(result.IsEmpty());
       }
     }
 
-    if (i::FLAG_harmony_top_level_await) {
-      // With top level await, errored evaluation returns a rejected promise
-      // with the exception.
-      Local<Promise> promise_1 =
-          Local<Promise>::Cast(result_1.ToLocalChecked());
-      Local<Promise> promise_2 =
-          Local<Promise>::Cast(result_2.ToLocalChecked());
-      CHECK_EQ(promise_1->State(), v8::Promise::kRejected);
-      CHECK_EQ(promise_2->State(), v8::Promise::kRejected);
-      CHECK_EQ(promise_1->Result(), failure_module->GetException());
-      CHECK_EQ(promise_2->Result(), failure_module->GetException());
-    } else {
-      CHECK(result_1.IsEmpty() && result_2.IsEmpty());
-    }
-
     CHECK(!try_catch.HasCaught());
   }
   i::FLAG_harmony_top_level_await = prev_top_level_await;
@@ -886,4 +885,99 @@ TEST(ModuleEvaluationTopLevelAwaitDynamicImportError) {
   i::FLAG_harmony_dynamic_import = previous_dynamic_import_flag_value;
 }
 
+TEST(TerminateExecutionTopLevelAwaitSync) {
+  bool previous_top_level_await_flag_value = i::FLAG_harmony_top_level_await;
+  i::FLAG_harmony_top_level_await = true;
+
+  Isolate* isolate = CcTest::isolate();
+  HandleScope scope(isolate);
+  LocalContext env;
+  v8::TryCatch try_catch(isolate);
+
+  env.local()
+      ->Global()
+      ->Set(env.local(), v8_str("terminate"),
+            v8::Function::New(env.local(),
+                              [](const v8::FunctionCallbackInfo<Value>& info) {
+                                info.GetIsolate()->TerminateExecution();
+                              })
+                .ToLocalChecked())
+      .ToChecked();
+
+  Local<String> source_text = v8_str("terminate(); while (true) {}");
+  ScriptOrigin origin = ModuleOrigin(v8_str("file.js"), CcTest::isolate());
+  ScriptCompiler::Source source(source_text, origin);
+  Local<Module> module =
+      ScriptCompiler::CompileModule(isolate, &source).ToLocalChecked();
+  CHECK(module
+            ->InstantiateModule(env.local(),
+                                CompileSpecifierAsModuleResolveCallback)
+            .FromJust());
+
+  CHECK(module->Evaluate(env.local()).IsEmpty());
+  CHECK(try_catch.HasCaught());
+  CHECK(try_catch.HasTerminated());
+  CHECK_EQ(module->GetStatus(), Module::kErrored);
+  CHECK_EQ(module->GetException(), v8::Null(isolate));
+
+  i::FLAG_harmony_top_level_await = previous_top_level_await_flag_value;
+}
+
+TEST(TerminateExecutionTopLevelAwaitAsync) {
+  bool previous_top_level_await_flag_value = i::FLAG_harmony_top_level_await;
+  i::FLAG_harmony_top_level_await = true;
+
+  Isolate* isolate = CcTest::isolate();
+  HandleScope scope(isolate);
+  LocalContext env;
+  v8::TryCatch try_catch(isolate);
+
+  env.local()
+      ->Global()
+      ->Set(env.local(), v8_str("terminate"),
+            v8::Function::New(env.local(),
+                              [](const v8::FunctionCallbackInfo<Value>& info) {
+                                info.GetIsolate()->TerminateExecution();
+                              })
+                .ToLocalChecked())
+      .ToChecked();
+
+  Local<Promise::Resolver> eval_promise =
+      Promise::Resolver::New(env.local()).ToLocalChecked();
+  env.local()
+      ->Global()
+      ->Set(env.local(), v8_str("evalPromise"), eval_promise)
+      .ToChecked();
+
+  Local<String> source_text =
+      v8_str("await evalPromise; terminate(); while (true) {}");
+  ScriptOrigin origin = ModuleOrigin(v8_str("file.js"), CcTest::isolate());
+  ScriptCompiler::Source source(source_text, origin);
+  Local<Module> module =
+      ScriptCompiler::CompileModule(isolate, &source).ToLocalChecked();
+  CHECK(module
+            ->InstantiateModule(env.local(),
+                                CompileSpecifierAsModuleResolveCallback)
+            .FromJust());
+
+  Local<Promise> promise =
+      Local<Promise>::Cast(module->Evaluate(env.local()).ToLocalChecked());
+  CHECK_EQ(module->GetStatus(), Module::kEvaluated);
+  CHECK_EQ(promise->State(), Promise::PromiseState::kPending);
+  CHECK(!try_catch.HasCaught());
+  CHECK(!try_catch.HasTerminated());
+
+  eval_promise->Resolve(env.local(), v8::Undefined(isolate)).ToChecked();
+
+  CHECK(try_catch.HasCaught());
+  CHECK(try_catch.HasTerminated());
+  CHECK_EQ(promise->State(), Promise::PromiseState::kPending);
+
+  // The termination exception doesn't trigger the module's
+  // catch handler, so the module isn't transitioned to kErrored.
+  CHECK_EQ(module->GetStatus(), Module::kEvaluated);
+
+  i::FLAG_harmony_top_level_await = previous_top_level_await_flag_value;
+}
+
 }  // anonymous namespace
diff --git a/deps/v8/test/cctest/test-parsing.cc b/deps/v8/test/cctest/test-parsing.cc
index 18f15af477f6e6..2decf108acede6 100644
--- a/deps/v8/test/cctest/test-parsing.cc
+++ b/deps/v8/test/cctest/test-parsing.cc
@@ -907,7 +907,7 @@ void TestScanRegExp(const char* re_source, const char* expected) {
       HashSeed(CcTest::i_isolate()));
   const i::AstRawString* current_symbol =
       scanner.CurrentSymbol(&ast_value_factory);
-  ast_value_factory.Internalize(CcTest::i_isolate());
+  ast_value_factory.Internalize(CcTest::i_isolate()->factory());
   i::Handle<i::String> val = current_symbol->string();
   i::DisallowHeapAllocation no_alloc;
   i::String::FlatContent content = val->GetFlatContent(no_alloc);
@@ -1056,12 +1056,12 @@ TEST(ScopeUsesArgumentsSuperThis) {
           factory->NewStringFromUtf8(i::CStrVector(program.begin()))
               .ToHandleChecked();
       i::Handle<i::Script> script = factory->NewScript(source);
-      i::ParseInfo info(isolate, script);
+      i::ParseInfo info(isolate, *script);
       // The information we're checking is only produced when eager parsing.
       info.set_allow_lazy_parsing(false);
-      CHECK(i::parsing::ParseProgram(&info, isolate));
+      CHECK(i::parsing::ParseProgram(&info, script, isolate));
       CHECK(i::Rewriter::Rewrite(&info));
-      info.ast_value_factory()->Internalize(isolate);
+      info.ast_value_factory()->Internalize(isolate->factory());
       CHECK(i::DeclarationScope::Analyze(&info));
       i::DeclarationScope::AllocateScopeInfos(&info, isolate);
       CHECK_NOT_NULL(info.literal());
@@ -1121,11 +1121,11 @@ static void CheckParsesToNumber(const char* source) {
 
   i::Handle<i::Script> script = factory->NewScript(source_code);
 
-  i::ParseInfo info(isolate, script);
+  i::ParseInfo info(isolate, *script);
   info.set_allow_lazy_parsing(false);
   info.set_toplevel(true);
 
-  CHECK(i::parsing::ParseProgram(&info, isolate));
+  CHECK(i::parsing::ParseProgram(&info, script, isolate));
 
   CHECK_EQ(1, info.scope()->declarations()->LengthForTest());
   i::Declaration* decl = info.scope()->declarations()->AtForTest(0);
@@ -1431,9 +1431,9 @@ TEST(ScopePositions) {
             .ToHandleChecked();
     CHECK_EQ(source->length(), kProgramSize);
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(isolate, script);
+    i::ParseInfo info(isolate, *script);
     info.set_language_mode(source_data[i].language_mode);
-    i::parsing::ParseProgram(&info, isolate);
+    i::parsing::ParseProgram(&info, script, isolate);
     CHECK_NOT_NULL(info.literal());
 
     // Check scope types and positions.
@@ -1477,8 +1477,8 @@ TEST(DiscardFunctionBody) {
     i::Handle<i::String> source_code =
         factory->NewStringFromUtf8(i::CStrVector(source)).ToHandleChecked();
     i::Handle<i::Script> script = factory->NewScript(source_code);
-    i::ParseInfo info(isolate, script);
-    i::parsing::ParseProgram(&info, isolate);
+    i::ParseInfo info(isolate, *script);
+    i::parsing::ParseProgram(&info, script, isolate);
     function = info.literal();
     CHECK_NOT_NULL(function);
     CHECK_EQ(1, function->body()->length());
@@ -1601,10 +1601,10 @@ void TestParserSyncWithFlags(i::Handle<i::String> source,
   {
     SetGlobalFlags(flags);
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(isolate, script);
+    i::ParseInfo info(isolate, *script);
     info.set_allow_lazy_parsing(flags.contains(kAllowLazy));
     if (is_module) info.set_module();
-    i::parsing::ParseProgram(&info, isolate);
+    i::parsing::ParseProgram(&info, script, isolate);
     function = info.literal();
   }
 
@@ -1802,7 +1802,7 @@ TEST(StrictOctal) {
       "    01;               \n"
       "  };                  \n"
       "};                    \n";
-  v8_compile(v8_str(script));
+  CHECK(v8_try_compile(v8_str(script)).IsEmpty());
   CHECK(try_catch.HasCaught());
   v8::String::Utf8Value exception(isolate, try_catch.Exception());
   CHECK_EQ(0,
@@ -3308,17 +3308,17 @@ TEST(SerializationOfMaybeAssignmentFlag) {
   v8::Local<v8::Value> v = CompileRun(src);
   i::Handle<i::Object> o = v8::Utils::OpenHandle(*v);
   i::Handle<i::JSFunction> f = i::Handle<i::JSFunction>::cast(o);
-  i::Context context = f->context();
+  i::Handle<i::Context> context(f->context(), isolate);
   i::AstValueFactory avf(&zone, isolate->ast_string_constants(),
                          HashSeed(isolate));
   const i::AstRawString* name = avf.GetOneByteString("result");
-  avf.Internalize(isolate);
+  avf.Internalize(isolate->factory());
   i::Handle<i::String> str = name->string();
   CHECK(str->IsInternalizedString());
   i::DeclarationScope* script_scope =
       new (&zone) i::DeclarationScope(&zone, &avf);
   i::Scope* s = i::Scope::DeserializeScopeChain(
-      isolate, &zone, context.scope_info(), script_scope, &avf,
+      isolate, &zone, context->scope_info(), script_scope, &avf,
       i::Scope::DeserializationMode::kIncludingVariables);
   CHECK(s != script_scope);
   CHECK_NOT_NULL(name);
@@ -3358,16 +3358,16 @@ TEST(IfArgumentsArrayAccessedThenParametersMaybeAssigned) {
   v8::Local<v8::Value> v = CompileRun(src);
   i::Handle<i::Object> o = v8::Utils::OpenHandle(*v);
   i::Handle<i::JSFunction> f = i::Handle<i::JSFunction>::cast(o);
-  i::Context context = f->context();
+  i::Handle<i::Context> context(f->context(), isolate);
   i::AstValueFactory avf(&zone, isolate->ast_string_constants(),
                          HashSeed(isolate));
   const i::AstRawString* name_x = avf.GetOneByteString("x");
-  avf.Internalize(isolate);
+  avf.Internalize(isolate->factory());
 
   i::DeclarationScope* script_scope =
       new (&zone) i::DeclarationScope(&zone, &avf);
   i::Scope* s = i::Scope::DeserializeScopeChain(
-      isolate, &zone, context.scope_info(), script_scope, &avf,
+      isolate, &zone, context->scope_info(), script_scope, &avf,
       i::Scope::DeserializationMode::kIncludingVariables);
   CHECK(s != script_scope);
 
@@ -3519,7 +3519,7 @@ TEST(InnerAssignment) {
           i::Handle<i::SharedFunctionInfo> shared =
               i::handle(f->shared(), isolate);
           info =
-              std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, shared));
+              std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, *shared));
           CHECK(i::parsing::ParseFunction(info.get(), shared, isolate));
         } else {
           i::Handle<i::String> source =
@@ -3528,9 +3528,9 @@ TEST(InnerAssignment) {
           printf("\n");
           i::Handle<i::Script> script = factory->NewScript(source);
           info =
-              std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, script));
+              std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, *script));
           info->set_allow_lazy_parsing(false);
-          CHECK(i::parsing::ParseProgram(info.get(), isolate));
+          CHECK(i::parsing::ParseProgram(info.get(), script, isolate));
         }
         CHECK(i::Compiler::Analyze(info.get()));
         CHECK_NOT_NULL(info->literal());
@@ -3636,7 +3636,7 @@ TEST(MaybeAssignedParameters) {
       i::Handle<i::Object> o = v8::Utils::OpenHandle(*v);
       i::Handle<i::JSFunction> f = i::Handle<i::JSFunction>::cast(o);
       i::Handle<i::SharedFunctionInfo> shared = i::handle(f->shared(), isolate);
-      info = std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, shared));
+      info = std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, *shared));
       info->set_allow_lazy_parsing(allow_lazy);
       CHECK(i::parsing::ParseFunction(info.get(), shared, isolate));
       CHECK(i::Compiler::Analyze(info.get()));
@@ -3673,11 +3673,11 @@ static void TestMaybeAssigned(Input input, const char* variable, bool module,
   i::Handle<i::Script> script = factory->NewScript(string);
 
   std::unique_ptr<i::ParseInfo> info;
-  info = std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, script));
+  info = std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, *script));
   info->set_module(module);
   info->set_allow_lazy_parsing(allow_lazy_parsing);
 
-  CHECK(i::parsing::ParseProgram(info.get(), isolate));
+  CHECK(i::parsing::ParseProgram(info.get(), script, isolate));
   CHECK(i::Compiler::Analyze(info.get()));
 
   CHECK_NOT_NULL(info->literal());
@@ -7428,9 +7428,9 @@ TEST(BasicImportExportParsing) {
     // Show that parsing as a module works
     {
       i::Handle<i::Script> script = factory->NewScript(source);
-      i::ParseInfo info(isolate, script);
+      i::ParseInfo info(isolate, *script);
       info.set_module();
-      if (!i::parsing::ParseProgram(&info, isolate)) {
+      if (!i::parsing::ParseProgram(&info, script, isolate)) {
         i::Handle<i::JSObject> exception_handle(
             i::JSObject::cast(isolate->pending_exception()), isolate);
         i::Handle<i::String> message_string = i::Handle<i::String>::cast(
@@ -7451,8 +7451,8 @@ TEST(BasicImportExportParsing) {
     // And that parsing a script does not.
     {
       i::Handle<i::Script> script = factory->NewScript(source);
-      i::ParseInfo info(isolate, script);
-      CHECK(!i::parsing::ParseProgram(&info, isolate));
+      i::ParseInfo info(isolate, *script);
+      CHECK(!i::parsing::ParseProgram(&info, script, isolate));
       isolate->clear_pending_exception();
     }
   }
@@ -7488,9 +7488,9 @@ TEST(NamespaceExportParsing) {
     i::Handle<i::String> source =
         factory->NewStringFromAsciiChecked(kSources[i]);
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(isolate, script);
+    i::ParseInfo info(isolate, *script);
     info.set_module();
-    CHECK(i::parsing::ParseProgram(&info, isolate));
+    CHECK(i::parsing::ParseProgram(&info, script, isolate));
   }
 }
 
@@ -7583,9 +7583,9 @@ TEST(ImportExportParsingErrors) {
         factory->NewStringFromAsciiChecked(kErrorSources[i]);
 
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(isolate, script);
+    i::ParseInfo info(isolate, *script);
     info.set_module();
-    CHECK(!i::parsing::ParseProgram(&info, isolate));
+    CHECK(!i::parsing::ParseProgram(&info, script, isolate));
     isolate->clear_pending_exception();
   }
 }
@@ -7619,9 +7619,9 @@ TEST(ModuleTopLevelFunctionDecl) {
         factory->NewStringFromAsciiChecked(kErrorSources[i]);
 
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(isolate, script);
+    i::ParseInfo info(isolate, *script);
     info.set_module();
-    CHECK(!i::parsing::ParseProgram(&info, isolate));
+    CHECK(!i::parsing::ParseProgram(&info, script, isolate));
     isolate->clear_pending_exception();
   }
 }
@@ -7816,9 +7816,9 @@ TEST(ModuleParsingInternals) {
       "export {foob};";
   i::Handle<i::String> source = factory->NewStringFromAsciiChecked(kSource);
   i::Handle<i::Script> script = factory->NewScript(source);
-  i::ParseInfo info(isolate, script);
+  i::ParseInfo info(isolate, *script);
   info.set_module();
-  CHECK(i::parsing::ParseProgram(&info, isolate));
+  CHECK(i::parsing::ParseProgram(&info, script, isolate));
   CHECK(i::Compiler::Analyze(&info));
   i::FunctionLiteral* func = info.literal();
   i::ModuleScope* module_scope = func->scope()->AsModuleScope();
@@ -8059,8 +8059,8 @@ void TestLanguageMode(const char* source,
 
   i::Handle<i::Script> script =
       factory->NewScript(factory->NewStringFromAsciiChecked(source));
-  i::ParseInfo info(isolate, script);
-  i::parsing::ParseProgram(&info, isolate);
+  i::ParseInfo info(isolate, *script);
+  i::parsing::ParseProgram(&info, script, isolate);
   CHECK_NOT_NULL(info.literal());
   CHECK_EQ(expected_language_mode, info.literal()->language_mode());
 }
@@ -9967,6 +9967,8 @@ TEST(AsyncAwait) {
     "(async(a = await => 1), async(a) => 1)",
     "async(a = await => 1, b = async() => 1);",
 
+    "async (x = class { p = await }) => {};",
+
     nullptr
   };
   // clang-format on
@@ -10838,9 +10840,9 @@ TEST(NoPessimisticContextAllocation) {
       printf("\n");
 
       i::Handle<i::Script> script = factory->NewScript(source);
-      i::ParseInfo info(isolate, script);
+      i::ParseInfo info(isolate, *script);
 
-      CHECK(i::parsing::ParseProgram(&info, isolate));
+      CHECK(i::parsing::ParseProgram(&info, script, isolate));
       CHECK(i::Compiler::Analyze(&info));
       CHECK_NOT_NULL(info.literal());
 
@@ -11398,10 +11400,10 @@ TEST(LexicalLoopVariable) {
     i::Handle<i::String> source =
         factory->NewStringFromUtf8(i::CStrVector(program)).ToHandleChecked();
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(isolate, script);
+    i::ParseInfo info(isolate, *script);
 
     info.set_allow_lazy_parsing(false);
-    CHECK(i::parsing::ParseProgram(&info, isolate));
+    CHECK(i::parsing::ParseProgram(&info, script, isolate));
     CHECK(i::Rewriter::Rewrite(&info));
     CHECK(i::DeclarationScope::Analyze(&info));
     i::DeclarationScope::AllocateScopeInfos(&info, isolate);
diff --git a/deps/v8/test/cctest/test-poison-disasm-arm64.cc b/deps/v8/test/cctest/test-poison-disasm-arm64.cc
index 32f4315e3a0b48..9e2ee91ef4292d 100644
--- a/deps/v8/test/cctest/test-poison-disasm-arm64.cc
+++ b/deps/v8/test/cctest/test-poison-disasm-arm64.cc
@@ -29,6 +29,7 @@ TEST(DisasmPoisonMonomorphicLoad) {
 
   i::FLAG_allow_natives_syntax = true;
   i::FLAG_untrusted_code_mitigations = true;
+  i::FLAG_debug_code = false;
 
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
@@ -78,6 +79,7 @@ TEST(DisasmPoisonPolymorphicLoad) {
 
   i::FLAG_allow_natives_syntax = true;
   i::FLAG_untrusted_code_mitigations = true;
+  i::FLAG_debug_code = false;
 
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
diff --git a/deps/v8/test/cctest/test-regexp.cc b/deps/v8/test/cctest/test-regexp.cc
index 95e752bece7a2d..907c89fa0cf03e 100644
--- a/deps/v8/test/cctest/test-regexp.cc
+++ b/deps/v8/test/cctest/test-regexp.cc
@@ -643,7 +643,8 @@ static Handle<JSRegExp> CreateJSRegExp(Handle<String> source, Handle<Code> code,
       Handle<JSRegExp>::cast(factory->NewJSObject(constructor));
 
   factory->SetRegExpIrregexpData(regexp, JSRegExp::IRREGEXP, source,
-                                 JSRegExp::kNone, 0);
+                                 JSRegExp::kNone, 0,
+                                 JSRegExp::kNoBacktrackLimit);
   regexp->SetDataAt(is_unicode ? JSRegExp::kIrregexpUC16CodeIndex
                                : JSRegExp::kIrregexpLatin1CodeIndex,
                     *code);
@@ -1284,8 +1285,8 @@ TEST(MacroAssembler) {
       Vector<const uc16>(str1, 6)).ToHandleChecked();
 
   CHECK(IrregexpInterpreter::MatchInternal(isolate, *array, *f1_16, captures, 5,
-                                           0,
-                                           RegExp::CallOrigin::kFromRuntime));
+                                           0, RegExp::CallOrigin::kFromRuntime,
+                                           JSRegExp::kNoBacktrackLimit));
   CHECK_EQ(0, captures[0]);
   CHECK_EQ(3, captures[1]);
   CHECK_EQ(1, captures[2]);
@@ -1296,9 +1297,9 @@ TEST(MacroAssembler) {
   Handle<String> f2_16 = factory->NewStringFromTwoByte(
       Vector<const uc16>(str2, 6)).ToHandleChecked();
 
-  CHECK(!IrregexpInterpreter::MatchInternal(isolate, *array, *f2_16, captures,
-                                            5, 0,
-                                            RegExp::CallOrigin::kFromRuntime));
+  CHECK(!IrregexpInterpreter::MatchInternal(
+      isolate, *array, *f2_16, captures, 5, 0, RegExp::CallOrigin::kFromRuntime,
+      JSRegExp::kNoBacktrackLimit));
   CHECK_EQ(42, captures[0]);
 }
 
diff --git a/deps/v8/test/cctest/test-serialize.cc b/deps/v8/test/cctest/test-serialize.cc
index e2ab99679639c7..f37b6235041aaa 100644
--- a/deps/v8/test/cctest/test-serialize.cc
+++ b/deps/v8/test/cctest/test-serialize.cc
@@ -49,7 +49,6 @@
 #include "src/objects/objects-inl.h"
 #include "src/runtime/runtime.h"
 #include "src/snapshot/code-serializer.h"
-#include "src/snapshot/natives.h"
 #include "src/snapshot/partial-deserializer.h"
 #include "src/snapshot/partial-serializer.h"
 #include "src/snapshot/read-only-deserializer.h"
@@ -3176,8 +3175,8 @@ UNINITIALIZED_TEST(SnapshotCreatorTemplates) {
                creator.AddContext(context, v8::SerializeInternalFieldsCallback(
                                                SerializeInternalFields,
                                                reinterpret_cast<void*>(2000))));
-      CHECK_EQ(0u, creator.AddTemplate(callback));
-      CHECK_EQ(1u, creator.AddTemplate(global_template));
+      CHECK_EQ(0u, creator.AddData(callback));
+      CHECK_EQ(1u, creator.AddData(global_template));
     }
     blob =
         creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
@@ -3212,7 +3211,8 @@ UNINITIALIZED_TEST(SnapshotCreatorTemplates) {
 
         // Retrieve the snapshotted object template.
         v8::Local<v8::ObjectTemplate> obj_template =
-            v8::ObjectTemplate::FromSnapshot(isolate, 1).ToLocalChecked();
+            isolate->GetDataFromSnapshotOnce<v8::ObjectTemplate>(1)
+                .ToLocalChecked();
         CHECK(!obj_template.IsEmpty());
         v8::Local<v8::Object> object =
             obj_template->NewInstance(context).ToLocalChecked();
@@ -3224,7 +3224,8 @@ UNINITIALIZED_TEST(SnapshotCreatorTemplates) {
 
         // Retrieve the snapshotted function template.
         v8::Local<v8::FunctionTemplate> fun_template =
-            v8::FunctionTemplate::FromSnapshot(isolate, 0).ToLocalChecked();
+            isolate->GetDataFromSnapshotOnce<v8::FunctionTemplate>(0)
+                .ToLocalChecked();
         CHECK(!fun_template.IsEmpty());
         v8::Local<v8::Function> fun =
             fun_template->GetFunction(context).ToLocalChecked();
@@ -3270,9 +3271,11 @@ UNINITIALIZED_TEST(SnapshotCreatorTemplates) {
                  v8::Local<v8::External>::Cast(b2)->Value());
         CHECK(c2->IsInt32() && c2->Int32Value(context).FromJust() == 35);
 
-        // Accessing out of bound returns empty MaybeHandle.
-        CHECK(v8::ObjectTemplate::FromSnapshot(isolate, 2).IsEmpty());
-        CHECK(v8::FunctionTemplate::FromSnapshot(isolate, 2).IsEmpty());
+        // Calling GetDataFromSnapshotOnce again returns an empty MaybeLocal.
+        CHECK(
+            isolate->GetDataFromSnapshotOnce<v8::ObjectTemplate>(1).IsEmpty());
+        CHECK(isolate->GetDataFromSnapshotOnce<v8::FunctionTemplate>(0)
+                  .IsEmpty());
         CHECK(v8::Context::FromSnapshot(isolate, 1).IsEmpty());
 
         for (auto data : deserialized_data) delete data;
@@ -3993,5 +3996,53 @@ UNINITIALIZED_TEST(SnapshotCreatorAnonClassWithKeep) {
   delete[] blob.data;
 }
 
+class DisableLazySourcePositionScope {
+ public:
+  DisableLazySourcePositionScope()
+      : backup_value_(FLAG_enable_lazy_source_positions) {
+    FLAG_enable_lazy_source_positions = false;
+  }
+  ~DisableLazySourcePositionScope() {
+    FLAG_enable_lazy_source_positions = backup_value_;
+  }
+
+ private:
+  bool backup_value_;
+};
+
+UNINITIALIZED_TEST(NoStackFrameCacheSerialization) {
+  // Checks that exceptions caught are not cached in the
+  // stack frame cache during serialization. The individual frames
+  // can point to JSFunction objects, which need to be stored in a
+  // context snapshot, *not* isolate snapshot.
+  DisableAlwaysOpt();
+  DisableLazySourcePositionScope lazy_scope;
+
+  v8::SnapshotCreator creator;
+  v8::Isolate* isolate = creator.GetIsolate();
+  isolate->SetCaptureStackTraceForUncaughtExceptions(true);
+  {
+    v8::HandleScope handle_scope(isolate);
+    {
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope context_scope(context);
+      v8::TryCatch try_catch(isolate);
+      CompileRun(R"(
+        function foo() { throw new Error('bar'); }
+        function bar() {
+          foo();
+        }
+        bar();
+      )");
+
+      creator.SetDefaultContext(context);
+    }
+  }
+  v8::StartupData blob =
+      creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kKeep);
+
+  delete[] blob.data;
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-strings.cc b/deps/v8/test/cctest/test-strings.cc
index f64c044a0c9bf5..a3f3b89347c074 100644
--- a/deps/v8/test/cctest/test-strings.cc
+++ b/deps/v8/test/cctest/test-strings.cc
@@ -1922,12 +1922,14 @@ TEST(HashArrayIndexStrings) {
 #if V8_TARGET_ARCH_32_BIT
     {"4294967295", false, 0, false, 0},  // Valid length but not index.
     {"4294967296", false, 0, false, 0},
-    {"18446744073709551615", false, 0, false, 0},
+    {"9007199254740991", false, 0, false, 0},
 #else
     {"4294967295", false, 0, true, 4294967295u},
     {"4294967296", false, 0, true, 4294967296ull},
-    {"18446744073709551615", false, 0, true, 18446744073709551615ull},
+    {"9007199254740991", false, 0, true, 9007199254740991ull},
 #endif
+    {"9007199254740992", false, 0, false, 0},
+    {"18446744073709551615", false, 0, false, 0},
     {"18446744073709551616", false, 0, false, 0}
   };
   for (int i = 0, n = arraysize(tests); i < n; i++) {
diff --git a/deps/v8/test/cctest/test-thread-termination.cc b/deps/v8/test/cctest/test-thread-termination.cc
index db9b5c928a49e3..f7cd09848eb8a9 100644
--- a/deps/v8/test/cctest/test-thread-termination.cc
+++ b/deps/v8/test/cctest/test-thread-termination.cc
@@ -760,9 +760,9 @@ void InnerTryCallTerminate(const v8::FunctionCallbackInfo<v8::Value>& args) {
                             v8::Utils::OpenHandle((*global)), 0, nullptr,
                             i::Execution::MessageHandling::kReport, &exception);
   CHECK(result.is_null());
-  // TryCall ignores terminate execution, but rerequests the interrupt.
-  CHECK(!args.GetIsolate()->IsExecutionTerminating());
-  CHECK(CompileRun("1 + 1;").IsEmpty());
+  CHECK(exception.is_null());
+  // TryCall reschedules the termination exception.
+  CHECK(args.GetIsolate()->IsExecutionTerminating());
 }
 
 
@@ -781,7 +781,10 @@ TEST(TerminationInInnerTryCall) {
     v8::TryCatch try_catch(isolate);
     CompileRun("inner_try_call_terminate()");
     CHECK(try_catch.HasTerminated());
+    // Any further exectutions in this TryCatch scope would fail.
+    CHECK(isolate->IsExecutionTerminating());
   }
+  // Leaving the TryCatch cleared the termination exception.
   v8::Maybe<int32_t> result =
       CompileRun("2 + 2")->Int32Value(isolate->GetCurrentContext());
   CHECK_EQ(4, result.FromJust());
@@ -811,11 +814,12 @@ TEST(TerminateAndTryCall) {
             ->Get(isolate->GetCurrentContext(), v8_str("terminate"))
             .ToLocalChecked();
     CHECK(value->IsFunction());
-    // The first stack check after terminate has been re-requested fails.
+    // Any further executions in this TryCatch scope fail.
+    CHECK(!isolate->IsExecutionTerminating());
     CHECK(CompileRun("1 + 1").IsEmpty());
     CHECK(isolate->IsExecutionTerminating());
   }
-  // V8 then recovers.
+  // Leaving the TryCatch cleared the termination exception.
   v8::Maybe<int32_t> result =
       CompileRun("2 + 2")->Int32Value(isolate->GetCurrentContext());
   CHECK_EQ(4, result.FromJust());
@@ -894,26 +898,32 @@ TEST(TerminateInMicrotask) {
       isolate, TerminateCurrentThread, DoLoopCancelTerminate);
   v8::Local<v8::Context> context1 = v8::Context::New(isolate, nullptr, global);
   v8::Local<v8::Context> context2 = v8::Context::New(isolate, nullptr, global);
-  v8::TryCatch try_catch(isolate);
   {
-    v8::Context::Scope context_scope(context1);
-    CHECK(!isolate->IsExecutionTerminating());
-    CHECK(!CompileRun("Promise.resolve().then(function() {"
-                      "terminate(); loop(); fail();})")
-               .IsEmpty());
-    CHECK(!try_catch.HasCaught());
-  }
-  {
-    v8::Context::Scope context_scope(context2);
-    CHECK(context2 == isolate->GetCurrentContext());
-    CHECK(context2 == isolate->GetEnteredOrMicrotaskContext());
-    CHECK(!isolate->IsExecutionTerminating());
-    isolate->RunMicrotasks();
-    CHECK(context2 == isolate->GetCurrentContext());
-    CHECK(context2 == isolate->GetEnteredOrMicrotaskContext());
-    CHECK(try_catch.HasCaught());
-    CHECK(try_catch.HasTerminated());
+    v8::TryCatch try_catch(isolate);
+    {
+      v8::Context::Scope context_scope(context1);
+      CHECK(!isolate->IsExecutionTerminating());
+      CHECK(!CompileRun("Promise.resolve().then(function() {"
+                        "terminate(); loop(); fail();})")
+                 .IsEmpty());
+      CHECK(!try_catch.HasCaught());
+    }
+    {
+      v8::Context::Scope context_scope(context2);
+      CHECK(context2 == isolate->GetCurrentContext());
+      CHECK(context2 == isolate->GetEnteredOrMicrotaskContext());
+      CHECK(!isolate->IsExecutionTerminating());
+      isolate->RunMicrotasks();
+      CHECK(context2 == isolate->GetCurrentContext());
+      CHECK(context2 == isolate->GetEnteredOrMicrotaskContext());
+      CHECK(try_catch.HasCaught());
+      CHECK(try_catch.HasTerminated());
+      // Any further exectutions in this TryCatch scope would fail.
+      CHECK(isolate->IsExecutionTerminating());
+      CHECK(!CcTest::i_isolate()->stack_guard()->CheckTerminateExecution());
+    }
   }
+  CHECK(!CcTest::i_isolate()->stack_guard()->CheckTerminateExecution());
   CHECK(!isolate->IsExecutionTerminating());
 }
 
@@ -932,8 +942,8 @@ TEST(TerminateInApiMicrotask) {
   v8::Local<v8::ObjectTemplate> global = CreateGlobalTemplate(
       isolate, TerminateCurrentThread, DoLoopCancelTerminate);
   v8::Local<v8::Context> context = v8::Context::New(isolate, nullptr, global);
-  v8::TryCatch try_catch(isolate);
   {
+    v8::TryCatch try_catch(isolate);
     v8::Context::Scope context_scope(context);
     CHECK(!isolate->IsExecutionTerminating());
     isolate->EnqueueMicrotask(TerminationMicrotask);
@@ -941,6 +951,7 @@ TEST(TerminateInApiMicrotask) {
     isolate->RunMicrotasks();
     CHECK(try_catch.HasCaught());
     CHECK(try_catch.HasTerminated());
+    CHECK(isolate->IsExecutionTerminating());
   }
   CHECK(!isolate->IsExecutionTerminating());
 }
diff --git a/deps/v8/test/cctest/test-typedarrays.cc b/deps/v8/test/cctest/test-typedarrays.cc
index 5e715b75e0902c..867d0f90b9574c 100644
--- a/deps/v8/test/cctest/test-typedarrays.cc
+++ b/deps/v8/test/cctest/test-typedarrays.cc
@@ -78,10 +78,20 @@ TEST(AllocateNotExternal) {
   void* memory = reinterpret_cast<Isolate*>(env->GetIsolate())
                      ->array_buffer_allocator()
                      ->Allocate(1024);
+
+// Keep the test until the functions are removed.
+#if __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated"
+#endif
   v8::Local<v8::ArrayBuffer> buffer =
       v8::ArrayBuffer::New(env->GetIsolate(), memory, 1024,
                            v8::ArrayBufferCreationMode::kInternalized);
   CHECK(!buffer->IsExternal());
+#if __clang__
+#pragma clang diagnostic pop
+#endif
+
   CHECK_EQ(memory, buffer->GetBackingStore()->Data());
 }
 
diff --git a/deps/v8/test/cctest/test-unwinder-code-pages.cc b/deps/v8/test/cctest/test-unwinder-code-pages.cc
new file mode 100644
index 00000000000000..6177be6de87246
--- /dev/null
+++ b/deps/v8/test/cctest/test-unwinder-code-pages.cc
@@ -0,0 +1,596 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/v8.h"
+
+#include "src/api/api-inl.h"
+#include "src/builtins/builtins.h"
+#include "src/execution/isolate.h"
+#include "src/heap/spaces.h"
+#include "src/objects/code-inl.h"
+#include "test/cctest/cctest.h"
+
+namespace v8 {
+namespace internal {
+namespace test_unwinder_code_pages {
+
+static const void* fake_stack_base = nullptr;
+
+TEST(Unwind_BadState_Fail_CodePagesAPI) {
+  JSEntryStubs entry_stubs;  // Fields are intialized to nullptr.
+  RegisterState register_state;
+  size_t pages_length = 0;
+  MemoryRange* code_pages = nullptr;
+
+  bool unwound = v8::Unwinder::TryUnwindV8Frames(
+      entry_stubs, pages_length, code_pages, &register_state, fake_stack_base);
+  CHECK(!unwound);
+  // The register state should not change when unwinding fails.
+  CHECK_NULL(register_state.fp);
+  CHECK_NULL(register_state.sp);
+  CHECK_NULL(register_state.pc);
+}
+
+TEST(Unwind_BuiltinPCInMiddle_Success_CodePagesAPI) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+
+  JSEntryStubs entry_stubs = isolate->GetJSEntryStubs();
+  MemoryRange code_pages[v8::Isolate::kMinCodePagesBufferSize];
+  size_t pages_length =
+      isolate->CopyCodePages(arraysize(code_pages), code_pages);
+  CHECK_LE(pages_length, arraysize(code_pages));
+  RegisterState register_state;
+
+  uintptr_t stack[3];
+  void* stack_base = stack + arraysize(stack);
+  stack[0] = reinterpret_cast<uintptr_t>(stack + 2);  // saved FP (rbp).
+  stack[1] = 202;  // Return address into C++ code.
+  stack[2] = 303;  // The SP points here in the caller's frame.
+
+  register_state.sp = stack;
+  register_state.fp = stack;
+
+  // Put the current PC inside of a valid builtin.
+  Code builtin = i_isolate->builtins()->builtin(Builtins::kStringEqual);
+  const uintptr_t offset = 40;
+  CHECK_LT(offset, builtin.InstructionSize());
+  register_state.pc =
+      reinterpret_cast<void*>(builtin.InstructionStart() + offset);
+
+  bool unwound = v8::Unwinder::TryUnwindV8Frames(
+      entry_stubs, pages_length, code_pages, &register_state, stack_base);
+  CHECK(unwound);
+  CHECK_EQ(reinterpret_cast<void*>(stack + 2), register_state.fp);
+  CHECK_EQ(reinterpret_cast<void*>(stack + 2), register_state.sp);
+  CHECK_EQ(reinterpret_cast<void*>(202), register_state.pc);
+}
+
+// The unwinder should be able to unwind even if we haven't properly set up the
+// current frame, as long as there is another JS frame underneath us (i.e. as
+// long as the PC isn't in JSEntry). This test puts the PC at the start
+// of a JS builtin and creates a fake JSEntry frame before it on the stack. The
+// unwinder should be able to unwind to the C++ frame before the JSEntry frame.
+TEST(Unwind_BuiltinPCAtStart_Success_CodePagesAPI) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+
+  JSEntryStubs entry_stubs = isolate->GetJSEntryStubs();
+  MemoryRange code_pages[v8::Isolate::kMinCodePagesBufferSize];
+  RegisterState register_state;
+
+  const size_t code_length = 40;
+  uintptr_t code[code_length] = {0};
+
+  // We use AddCodeRange so that |code| is inserted in order.
+  i_isolate->AddCodeRange(reinterpret_cast<Address>(code),
+                          code_length * sizeof(uintptr_t));
+  size_t pages_length =
+      isolate->CopyCodePages(arraysize(code_pages), code_pages);
+  CHECK_LE(pages_length, arraysize(code_pages));
+
+  uintptr_t stack[6];
+  void* stack_base = stack + arraysize(stack);
+  stack[0] = 101;
+  // Return address into JS code. It doesn't matter that this is not actually in
+  // JSEntry, because we only check that for the top frame.
+  stack[1] = reinterpret_cast<uintptr_t>(code + 10);
+  stack[2] = reinterpret_cast<uintptr_t>(stack + 5);  // saved FP (rbp).
+  stack[3] = 303;  // Return address into C++ code.
+  stack[4] = 404;
+  stack[5] = 505;
+
+  register_state.sp = stack;
+  register_state.fp = stack + 2;  // FP to the JSEntry frame.
+
+  // Put the current PC at the start of a valid builtin, so that we are setting
+  // up the frame.
+  Code builtin = i_isolate->builtins()->builtin(Builtins::kStringEqual);
+  register_state.pc = reinterpret_cast<void*>(builtin.InstructionStart());
+
+  bool unwound = v8::Unwinder::TryUnwindV8Frames(
+      entry_stubs, pages_length, code_pages, &register_state, stack_base);
+
+  CHECK(unwound);
+  CHECK_EQ(reinterpret_cast<void*>(stack + 5), register_state.fp);
+  CHECK_EQ(reinterpret_cast<void*>(stack + 4), register_state.sp);
+  CHECK_EQ(reinterpret_cast<void*>(303), register_state.pc);
+}
+
+const char* foo_source = R"(
+  function foo(a, b) {
+    let x = a * b;
+    let y = x ^ b;
+    let z = y / a;
+    return x + y - z;
+  };
+  %PrepareFunctionForOptimization(foo);
+  foo(1, 2);
+  foo(1, 2);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(1, 2);
+)";
+
+bool PagesContainsAddress(size_t length, MemoryRange* pages,
+                          Address search_address) {
+  byte* addr = reinterpret_cast<byte*>(search_address);
+  auto it = std::find_if(pages, pages + length, [addr](const MemoryRange& r) {
+    const byte* page_start = reinterpret_cast<const byte*>(r.start);
+    const byte* page_end = page_start + r.length_in_bytes;
+    return addr >= page_start && addr < page_end;
+  });
+  return it != pages + length;
+}
+
+// Check that we can unwind when the pc is within an optimized code object on
+// the V8 heap.
+TEST(Unwind_CodeObjectPCInMiddle_Success_CodePagesAPI) {
+  FLAG_allow_natives_syntax = true;
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+  HandleScope scope(i_isolate);
+
+  JSEntryStubs entry_stubs = isolate->GetJSEntryStubs();
+  MemoryRange code_pages[v8::Isolate::kMinCodePagesBufferSize];
+  RegisterState register_state;
+
+  uintptr_t stack[3];
+  void* stack_base = stack + arraysize(stack);
+  stack[0] = reinterpret_cast<uintptr_t>(stack + 2);  // saved FP (rbp).
+  stack[1] = 202;  // Return address into C++ code.
+  stack[2] = 303;  // The SP points here in the caller's frame.
+
+  register_state.sp = stack;
+  register_state.fp = stack;
+
+  // Create an on-heap code object. Make sure we run the function so that it is
+  // compiled and not just marked for lazy compilation.
+  CompileRun(foo_source);
+  v8::Local<v8::Function> local_foo = v8::Local<v8::Function>::Cast(
+      env.local()->Global()->Get(env.local(), v8_str("foo")).ToLocalChecked());
+  Handle<JSFunction> foo =
+      Handle<JSFunction>::cast(v8::Utils::OpenHandle(*local_foo));
+
+  // Put the current PC inside of the created code object.
+  AbstractCode abstract_code = foo->abstract_code();
+  // We don't produce optimized code when run with --no-opt.
+  if (!abstract_code.IsCode() && FLAG_opt == false) return;
+  CHECK(abstract_code.IsCode());
+
+  Code code = abstract_code.GetCode();
+  // We don't want the offset too early or it could be the `push rbp`
+  // instruction (which is not at the start of generated code, because the lazy
+  // deopt check happens before frame setup).
+  const uintptr_t offset = code.InstructionSize() - 20;
+  CHECK_LT(offset, code.InstructionSize());
+  Address pc = code.InstructionStart() + offset;
+  register_state.pc = reinterpret_cast<void*>(pc);
+
+  // Get code pages from the API now that the code obejct exists and check that
+  // our code objects is on one of the pages.
+  size_t pages_length =
+      isolate->CopyCodePages(arraysize(code_pages), code_pages);
+  CHECK_LE(pages_length, arraysize(code_pages));
+  CHECK(PagesContainsAddress(pages_length, code_pages, pc));
+
+  bool unwound = v8::Unwinder::TryUnwindV8Frames(
+      entry_stubs, pages_length, code_pages, &register_state, stack_base);
+  CHECK(unwound);
+  CHECK_EQ(reinterpret_cast<void*>(stack + 2), register_state.fp);
+  CHECK_EQ(reinterpret_cast<void*>(stack + 2), register_state.sp);
+  CHECK_EQ(reinterpret_cast<void*>(202), register_state.pc);
+}
+
+// If the PC is within JSEntry but we haven't set up the frame yet, then we
+// cannot unwind.
+TEST(Unwind_JSEntryBeforeFrame_Fail_CodePagesAPI) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+
+  JSEntryStubs entry_stubs = isolate->GetJSEntryStubs();
+  MemoryRange code_pages[1];
+  size_t pages_length = 1;
+  RegisterState register_state;
+
+  const size_t code_length = 40;
+  uintptr_t code[code_length] = {0};
+  code_pages[0].start = code;
+  code_pages[0].length_in_bytes = code_length * sizeof(uintptr_t);
+
+  // Pretend that it takes 5 instructions to set up the frame in JSEntry.
+  entry_stubs.js_entry_stub.code.start = code + 10;
+  entry_stubs.js_entry_stub.code.length_in_bytes = 10 * sizeof(uintptr_t);
+
+  uintptr_t stack[10];
+  void* stack_base = stack + arraysize(stack);
+  stack[0] = 101;
+  stack[1] = 111;
+  stack[2] = 121;
+  stack[3] = 131;
+  stack[4] = 141;
+  stack[5] = 151;
+  stack[6] = 100;  // Return address into C++ code.
+  stack[7] = 303;  // The SP points here in the caller's frame.
+  stack[8] = 404;
+  stack[9] = 505;
+
+  register_state.sp = stack + 5;
+  register_state.fp = stack + 9;
+
+  // Put the current PC inside of JSEntry, before the frame is set up.
+  register_state.pc = code + 12;
+  bool unwound = v8::Unwinder::TryUnwindV8Frames(
+      entry_stubs, pages_length, code_pages, &register_state, stack_base);
+  CHECK(!unwound);
+  // The register state should not change when unwinding fails.
+  CHECK_EQ(reinterpret_cast<void*>(stack + 9), register_state.fp);
+  CHECK_EQ(reinterpret_cast<void*>(stack + 5), register_state.sp);
+  CHECK_EQ(code + 12, register_state.pc);
+
+  // Change the PC to a few instructions later, after the frame is set up.
+  register_state.pc = code + 16;
+  unwound = v8::Unwinder::TryUnwindV8Frames(
+      entry_stubs, pages_length, code_pages, &register_state, stack_base);
+  // TODO(petermarshall): More precisely check position within JSEntry rather
+  // than just assuming the frame is unreadable.
+  CHECK(!unwound);
+  // The register state should not change when unwinding fails.
+  CHECK_EQ(reinterpret_cast<void*>(stack + 9), register_state.fp);
+  CHECK_EQ(reinterpret_cast<void*>(stack + 5), register_state.sp);
+  CHECK_EQ(code + 16, register_state.pc);
+}
+
+TEST(Unwind_OneJSFrame_Success_CodePagesAPI) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+
+  JSEntryStubs entry_stubs = isolate->GetJSEntryStubs();
+  MemoryRange code_pages[1];
+  size_t pages_length = 1;
+  RegisterState register_state;
+
+  // Use a fake code range so that we can initialize it to 0s.
+  const size_t code_length = 40;
+  uintptr_t code[code_length] = {0};
+  code_pages[0].start = code;
+  code_pages[0].length_in_bytes = code_length * sizeof(uintptr_t);
+
+  // Our fake stack has two frames - one C++ frame and one JS frame (on top).
+  // The stack grows from high addresses to low addresses.
+  uintptr_t stack[10];
+  void* stack_base = stack + arraysize(stack);
+  stack[0] = 101;
+  stack[1] = 111;
+  stack[2] = 121;
+  stack[3] = 131;
+  stack[4] = 141;
+  stack[5] = reinterpret_cast<uintptr_t>(stack + 9);  // saved FP (rbp).
+  stack[6] = 100;  // Return address into C++ code.
+  stack[7] = 303;  // The SP points here in the caller's frame.
+  stack[8] = 404;
+  stack[9] = 505;
+
+  register_state.sp = stack;
+  register_state.fp = stack + 5;
+
+  // Put the current PC inside of the code range so it looks valid.
+  register_state.pc = code + 30;
+
+  bool unwound = v8::Unwinder::TryUnwindV8Frames(
+      entry_stubs, pages_length, code_pages, &register_state, stack_base);
+
+  CHECK(unwound);
+  CHECK_EQ(reinterpret_cast<void*>(stack + 9), register_state.fp);
+  CHECK_EQ(reinterpret_cast<void*>(stack + 7), register_state.sp);
+  CHECK_EQ(reinterpret_cast<void*>(100), register_state.pc);
+}
+
+// Creates a fake stack with two JS frames on top of a C++ frame and checks that
+// the unwinder correctly unwinds past the JS frames and returns the C++ frame's
+// details.
+TEST(Unwind_TwoJSFrames_Success_CodePagesAPI) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+
+  JSEntryStubs entry_stubs = isolate->GetJSEntryStubs();
+  MemoryRange code_pages[1];
+  size_t pages_length = 1;
+  RegisterState register_state;
+
+  // Use a fake code range so that we can initialize it to 0s.
+  const size_t code_length = 40;
+  uintptr_t code[code_length] = {0};
+  code_pages[0].start = code;
+  code_pages[0].length_in_bytes = code_length * sizeof(uintptr_t);
+
+  // Our fake stack has three frames - one C++ frame and two JS frames (on top).
+  // The stack grows from high addresses to low addresses.
+  uintptr_t stack[10];
+  void* stack_base = stack + arraysize(stack);
+  stack[0] = 101;
+  stack[1] = 111;
+  stack[2] = reinterpret_cast<uintptr_t>(stack + 5);  // saved FP (rbp).
+  // The fake return address is in the JS code range.
+  stack[3] = reinterpret_cast<uintptr_t>(code + 10);
+  stack[4] = 141;
+  stack[5] = reinterpret_cast<uintptr_t>(stack + 9);  // saved FP (rbp).
+  stack[6] = 100;  // Return address into C++ code.
+  stack[7] = 303;  // The SP points here in the caller's frame.
+  stack[8] = 404;
+  stack[9] = 505;
+
+  register_state.sp = stack;
+  register_state.fp = stack + 2;
+
+  // Put the current PC inside of the code range so it looks valid.
+  register_state.pc = code + 30;
+
+  bool unwound = v8::Unwinder::TryUnwindV8Frames(
+      entry_stubs, pages_length, code_pages, &register_state, stack_base);
+
+  CHECK(unwound);
+  CHECK_EQ(reinterpret_cast<void*>(stack + 9), register_state.fp);
+  CHECK_EQ(reinterpret_cast<void*>(stack + 7), register_state.sp);
+  CHECK_EQ(reinterpret_cast<void*>(100), register_state.pc);
+}
+
+// If the PC is in JSEntry then the frame might not be set up correctly, meaning
+// we can't unwind the stack properly.
+TEST(Unwind_JSEntry_Fail_CodePagesAPI) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+
+  JSEntryStubs entry_stubs = isolate->GetJSEntryStubs();
+  MemoryRange code_pages[v8::Isolate::kMinCodePagesBufferSize];
+  size_t pages_length =
+      isolate->CopyCodePages(arraysize(code_pages), code_pages);
+  CHECK_LE(pages_length, arraysize(code_pages));
+  RegisterState register_state;
+
+  Code js_entry = i_isolate->heap()->builtin(Builtins::kJSEntry);
+  byte* start = reinterpret_cast<byte*>(js_entry.InstructionStart());
+  register_state.pc = start + 10;
+
+  bool unwound = v8::Unwinder::TryUnwindV8Frames(
+      entry_stubs, pages_length, code_pages, &register_state, fake_stack_base);
+  CHECK(!unwound);
+  // The register state should not change when unwinding fails.
+  CHECK_NULL(register_state.fp);
+  CHECK_NULL(register_state.sp);
+  CHECK_EQ(start + 10, register_state.pc);
+}
+
+TEST(Unwind_StackBounds_Basic_CodePagesAPI) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+
+  JSEntryStubs entry_stubs = isolate->GetJSEntryStubs();
+  MemoryRange code_pages[1];
+  size_t pages_length = 1;
+  RegisterState register_state;
+
+  const size_t code_length = 10;
+  uintptr_t code[code_length] = {0};
+  code_pages[0].start = code;
+  code_pages[0].length_in_bytes = code_length * sizeof(uintptr_t);
+
+  uintptr_t stack[3];
+  stack[0] = reinterpret_cast<uintptr_t>(stack + 2);  // saved FP (rbp).
+  stack[1] = 202;  // Return address into C++ code.
+  stack[2] = 303;  // The SP points here in the caller's frame.
+
+  register_state.sp = stack;
+  register_state.fp = stack;
+  register_state.pc = code;
+
+  void* wrong_stack_base = reinterpret_cast<void*>(
+      reinterpret_cast<uintptr_t>(stack) - sizeof(uintptr_t));
+  bool unwound = v8::Unwinder::TryUnwindV8Frames(
+      entry_stubs, pages_length, code_pages, &register_state, wrong_stack_base);
+  CHECK(!unwound);
+
+  // Correct the stack base and unwinding should succeed.
+  void* correct_stack_base = stack + arraysize(stack);
+  unwound =
+      v8::Unwinder::TryUnwindV8Frames(entry_stubs, pages_length, code_pages,
+                                      &register_state, correct_stack_base);
+  CHECK(unwound);
+}
+
+TEST(Unwind_StackBounds_WithUnwinding_CodePagesAPI) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+
+  JSEntryStubs entry_stubs = isolate->GetJSEntryStubs();
+  MemoryRange code_pages[1];
+  size_t pages_length = 1;
+  RegisterState register_state;
+
+  // Use a fake code range so that we can initialize it to 0s.
+  const size_t code_length = 40;
+  uintptr_t code[code_length] = {0};
+  code_pages[0].start = code;
+  code_pages[0].length_in_bytes = code_length * sizeof(uintptr_t);
+
+  // Our fake stack has two frames - one C++ frame and one JS frame (on top).
+  // The stack grows from high addresses to low addresses.
+  uintptr_t stack[11];
+  void* stack_base = stack + arraysize(stack);
+  stack[0] = 101;
+  stack[1] = 111;
+  stack[2] = 121;
+  stack[3] = 131;
+  stack[4] = 141;
+  stack[5] = reinterpret_cast<uintptr_t>(stack + 9);  // saved FP (rbp).
+  stack[6] = reinterpret_cast<uintptr_t>(code + 20);  // JS code.
+  stack[7] = 303;  // The SP points here in the caller's frame.
+  stack[8] = 404;
+  stack[9] = reinterpret_cast<uintptr_t>(stack) +
+             (12 * sizeof(uintptr_t));                 // saved FP (OOB).
+  stack[10] = reinterpret_cast<uintptr_t>(code + 20);  // JS code.
+
+  register_state.sp = stack;
+  register_state.fp = stack + 5;
+
+  // Put the current PC inside of the code range so it looks valid.
+  register_state.pc = code + 30;
+
+  // Unwind will fail because stack[9] FP points outside of the stack.
+  bool unwound = v8::Unwinder::TryUnwindV8Frames(
+      entry_stubs, pages_length, code_pages, &register_state, stack_base);
+  CHECK(!unwound);
+
+  // Change the return address so that it is not in range. We will not range
+  // check the stack[9] FP value because we have finished unwinding and the
+  // contents of rbp does not necessarily have to be the FP in this case.
+  stack[10] = 202;
+  unwound = v8::Unwinder::TryUnwindV8Frames(
+      entry_stubs, pages_length, code_pages, &register_state, stack_base);
+  CHECK(unwound);
+}
+
+TEST(PCIsInV8_BadState_Fail_CodePagesAPI) {
+  void* pc = nullptr;
+  size_t pages_length = 0;
+  MemoryRange* code_pages = nullptr;
+
+  CHECK(!v8::Unwinder::PCIsInV8(pages_length, code_pages, pc));
+}
+
+TEST(PCIsInV8_ValidStateNullPC_Fail_CodePagesAPI) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+
+  void* pc = nullptr;
+
+  MemoryRange code_pages[v8::Isolate::kMinCodePagesBufferSize];
+  size_t pages_length =
+      isolate->CopyCodePages(arraysize(code_pages), code_pages);
+  CHECK_LE(pages_length, arraysize(code_pages));
+
+  CHECK(!v8::Unwinder::PCIsInV8(pages_length, code_pages, pc));
+}
+
+void TestRangeBoundaries(size_t pages_length, MemoryRange* code_pages,
+                         byte* range_start, size_t range_length) {
+  void* pc = range_start - 1;
+  CHECK(!v8::Unwinder::PCIsInV8(pages_length, code_pages, pc));
+  pc = range_start;
+  CHECK(v8::Unwinder::PCIsInV8(pages_length, code_pages, pc));
+  pc = range_start + 1;
+  CHECK(v8::Unwinder::PCIsInV8(pages_length, code_pages, pc));
+  pc = range_start + range_length - 1;
+  CHECK(v8::Unwinder::PCIsInV8(pages_length, code_pages, pc));
+  pc = range_start + range_length;
+  CHECK(!v8::Unwinder::PCIsInV8(pages_length, code_pages, pc));
+  pc = range_start + range_length + 1;
+  CHECK(!v8::Unwinder::PCIsInV8(pages_length, code_pages, pc));
+}
+
+TEST(PCIsInV8_InAllCodePages_CodePagesAPI) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+
+  MemoryRange code_pages[v8::Isolate::kMinCodePagesBufferSize];
+  size_t pages_length =
+      isolate->CopyCodePages(arraysize(code_pages), code_pages);
+  CHECK_LE(pages_length, arraysize(code_pages));
+
+  for (size_t i = 0; i < pages_length; i++) {
+    byte* range_start =
+        const_cast<byte*>(reinterpret_cast<const byte*>(code_pages[i].start));
+    size_t range_length = code_pages[i].length_in_bytes;
+    TestRangeBoundaries(pages_length, code_pages, range_start, range_length);
+  }
+}
+
+// PCIsInV8 doesn't check if the PC is in JSEntry directly. It's assumed that
+// the CodeRange or EmbeddedCodeRange contain JSEntry.
+TEST(PCIsInV8_InJSEntryRange_CodePagesAPI) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+
+  MemoryRange code_pages[v8::Isolate::kMinCodePagesBufferSize];
+  size_t pages_length =
+      isolate->CopyCodePages(arraysize(code_pages), code_pages);
+  CHECK_LE(pages_length, arraysize(code_pages));
+
+  Code js_entry = i_isolate->heap()->builtin(Builtins::kJSEntry);
+  byte* start = reinterpret_cast<byte*>(js_entry.InstructionStart());
+  size_t length = js_entry.InstructionSize();
+
+  void* pc = start;
+  CHECK(v8::Unwinder::PCIsInV8(pages_length, code_pages, pc));
+  pc = start + 1;
+  CHECK(v8::Unwinder::PCIsInV8(pages_length, code_pages, pc));
+  pc = start + length - 1;
+  CHECK(v8::Unwinder::PCIsInV8(pages_length, code_pages, pc));
+}
+
+// Large code objects can be allocated in large object space. Check that this is
+// inside the CodeRange.
+TEST(PCIsInV8_LargeCodeObject_CodePagesAPI) {
+  FLAG_allow_natives_syntax = true;
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+  HandleScope scope(i_isolate);
+
+  // Create a big function that ends up in CODE_LO_SPACE.
+  const int instruction_size = Page::kPageSize + 1;
+  STATIC_ASSERT(instruction_size > kMaxRegularHeapObjectSize);
+  std::unique_ptr<byte[]> instructions(new byte[instruction_size]);
+
+  CodeDesc desc;
+  desc.buffer = instructions.get();
+  desc.buffer_size = instruction_size;
+  desc.instr_size = instruction_size;
+  desc.reloc_size = 0;
+  desc.constant_pool_size = 0;
+  desc.unwinding_info = nullptr;
+  desc.unwinding_info_size = 0;
+  desc.origin = nullptr;
+  Handle<Code> foo_code =
+      Factory::CodeBuilder(i_isolate, desc, Code::WASM_FUNCTION).Build();
+
+  CHECK(i_isolate->heap()->InSpace(*foo_code, CODE_LO_SPACE));
+  byte* start = reinterpret_cast<byte*>(foo_code->InstructionStart());
+
+  MemoryRange code_pages[v8::Isolate::kMinCodePagesBufferSize];
+  size_t pages_length =
+      isolate->CopyCodePages(arraysize(code_pages), code_pages);
+  CHECK_LE(pages_length, arraysize(code_pages));
+
+  void* pc = start;
+  CHECK(v8::Unwinder::PCIsInV8(pages_length, code_pages, pc));
+}
+
+}  // namespace test_unwinder_code_pages
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/test-unwinder.cc b/deps/v8/test/cctest/test-unwinder.cc
index c452db3c87c23c..ffe46f4ca2fb5b 100644
--- a/deps/v8/test/cctest/test-unwinder.cc
+++ b/deps/v8/test/cctest/test-unwinder.cc
@@ -15,14 +15,22 @@ namespace v8 {
 namespace internal {
 namespace test_unwinder {
 
-static void* unlimited_stack_base = std::numeric_limits<void*>::max();
+static const void* fake_stack_base = nullptr;
+
+// Ignore deprecation warnings so that we can keep the tests for now.
+// TODO(petermarshall): Delete all the tests here when the old API is removed to
+// reduce the duplication.
+#if __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated"
+#endif
 
 TEST(Unwind_BadState_Fail) {
   UnwindState unwind_state;  // Fields are intialized to nullptr.
   RegisterState register_state;
 
   bool unwound = v8::Unwinder::TryUnwindV8Frames(unwind_state, &register_state,
-                                                 unlimited_stack_base);
+                                                 fake_stack_base);
   CHECK(!unwound);
   // The register state should not change when unwinding fails.
   CHECK_NULL(register_state.fp);
@@ -341,7 +349,7 @@ TEST(Unwind_JSEntry_Fail) {
   register_state.pc = start + 10;
 
   bool unwound = v8::Unwinder::TryUnwindV8Frames(unwind_state, &register_state,
-                                                 unlimited_stack_base);
+                                                 fake_stack_base);
   CHECK(!unwound);
   // The register state should not change when unwinding fails.
   CHECK_NULL(register_state.fp);
@@ -541,6 +549,10 @@ TEST(PCIsInV8_LargeCodeObject) {
   CHECK(v8::Unwinder::PCIsInV8(unwind_state, pc));
 }
 
+#if __clang__
+#pragma clang diagnostic pop
+#endif
+
 }  // namespace test_unwinder
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-utils-arm64.cc b/deps/v8/test/cctest/test-utils-arm64.cc
index b6a4aad3bf134b..1fc0add43fcf20 100644
--- a/deps/v8/test/cctest/test-utils-arm64.cc
+++ b/deps/v8/test/cctest/test-utils-arm64.cc
@@ -289,9 +289,9 @@ void Clobber(MacroAssembler* masm, RegList reg_list, uint64_t const value) {
     if (reg_list & (1ULL << i)) {
       Register xn = Register::Create(i, kXRegSizeInBits);
       // We should never write into sp here.
-      CHECK(!xn.Is(sp));
+      CHECK_NE(xn, sp);
       if (!xn.IsZero()) {
-        if (!first.IsValid()) {
+        if (!first.is_valid()) {
           // This is the first register we've hit, so construct the literal.
           __ Mov(xn, value);
           first = xn;
@@ -311,7 +311,7 @@ void ClobberFP(MacroAssembler* masm, RegList reg_list, double const value) {
   for (unsigned i = 0; i < kNumberOfVRegisters; i++) {
     if (reg_list & (1ULL << i)) {
       VRegister dn = VRegister::Create(i, kDRegSizeInBits);
-      if (!first.IsValid()) {
+      if (!first.is_valid()) {
         // This is the first register we've hit, so construct the literal.
         __ Fmov(dn, value);
         first = dn;
diff --git a/deps/v8/test/cctest/test-utils.cc b/deps/v8/test/cctest/test-utils.cc
index 628ed1ba4f2906..3abab9430dc3c9 100644
--- a/deps/v8/test/cctest/test-utils.cc
+++ b/deps/v8/test/cctest/test-utils.cc
@@ -32,6 +32,7 @@
 #include "src/init/v8.h"
 
 #include "src/api/api-inl.h"
+#include "src/base/bit-field.h"
 #include "src/base/platform/platform.h"
 #include "src/numbers/conversions.h"
 #include "test/cctest/cctest.h"
@@ -79,7 +80,7 @@ TEST(Utils1) {
 
 
 TEST(BitSetComputer) {
-  using BoolComputer = BitSetComputer<bool, 1, kSmiValueSize, uint32_t>;
+  using BoolComputer = base::BitSetComputer<bool, 1, kSmiValueSize, uint32_t>;
   CHECK_EQ(0, BoolComputer::word_count(0));
   CHECK_EQ(1, BoolComputer::word_count(8));
   CHECK_EQ(2, BoolComputer::word_count(50));
@@ -97,7 +98,7 @@ TEST(BitSetComputer) {
 
   // Lets store 2 bits per item with 3000 items and verify the values are
   // correct.
-  using TwoBits = BitSetComputer<unsigned char, 2, 8, unsigned char>;
+  using TwoBits = base::BitSetComputer<unsigned char, 2, 8, unsigned char>;
   const int words = 750;
   CHECK_EQ(words, TwoBits::word_count(3000));
   const int offset = 10;
diff --git a/deps/v8/test/cctest/test-weakmaps.cc b/deps/v8/test/cctest/test-weakmaps.cc
index 4b1feaeef1e54b..d0f1cb2fe38aac 100644
--- a/deps/v8/test/cctest/test-weakmaps.cc
+++ b/deps/v8/test/cctest/test-weakmaps.cc
@@ -150,14 +150,14 @@ TEST(Shrinking) {
 
 namespace {
 bool EphemeronHashTableContainsKey(EphemeronHashTable table, HeapObject key) {
-  for (int i = 0; i < table.Capacity(); ++i) {
+  for (InternalIndex i : table.IterateEntries()) {
     if (table.KeyAt(i) == key) return true;
   }
   return false;
 }
 }  // namespace
 
-TEST(WeakMapPromotion) {
+TEST(WeakMapPromotionMarkCompact) {
   LocalContext context;
   Isolate* isolate = GetIsolateFrom(&context);
   Factory* factory = isolate->factory();
@@ -165,7 +165,10 @@ TEST(WeakMapPromotion) {
   Handle<JSWeakMap> weakmap = isolate->factory()->NewJSWeakMap();
 
   CcTest::CollectAllGarbage();
-  CHECK(ObjectInYoungGeneration(weakmap->table()));
+
+  CHECK(FLAG_always_promote_young_mc
+            ? !ObjectInYoungGeneration(weakmap->table())
+            : ObjectInYoungGeneration(weakmap->table()));
 
   Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
   Handle<JSObject> object = factory->NewJSObjectFromMap(map);
@@ -177,7 +180,8 @@ TEST(WeakMapPromotion) {
       EphemeronHashTable::cast(weakmap->table()), *object));
   CcTest::CollectAllGarbage();
 
-  CHECK(ObjectInYoungGeneration(*object));
+  CHECK(FLAG_always_promote_young_mc ? !ObjectInYoungGeneration(*object)
+                                     : ObjectInYoungGeneration(*object));
   CHECK(!ObjectInYoungGeneration(weakmap->table()));
   CHECK(EphemeronHashTableContainsKey(
       EphemeronHashTable::cast(weakmap->table()), *object));
@@ -196,7 +200,7 @@ TEST(WeakMapScavenge) {
   HandleScope scope(isolate);
   Handle<JSWeakMap> weakmap = isolate->factory()->NewJSWeakMap();
 
-  CcTest::CollectAllGarbage();
+  heap::GcAndSweep(isolate->heap(), NEW_SPACE);
   CHECK(ObjectInYoungGeneration(weakmap->table()));
 
   Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
diff --git a/deps/v8/test/cctest/test-weaksets.cc b/deps/v8/test/cctest/test-weaksets.cc
index a65405d9efea42..1ab219205f6e94 100644
--- a/deps/v8/test/cctest/test-weaksets.cc
+++ b/deps/v8/test/cctest/test-weaksets.cc
@@ -48,7 +48,7 @@ static Isolate* GetIsolateFrom(LocalContext* context) {
 
 static Handle<JSWeakSet> AllocateJSWeakSet(Isolate* isolate) {
   Factory* factory = isolate->factory();
-  Handle<Map> map = factory->NewMap(JS_WEAK_SET_TYPE, JSWeakSet::kSize);
+  Handle<Map> map = factory->NewMap(JS_WEAK_SET_TYPE, JSWeakSet::kHeaderSize);
   Handle<JSObject> weakset_obj = factory->NewJSObjectFromMap(map);
   Handle<JSWeakSet> weakset(JSWeakSet::cast(*weakset_obj), isolate);
   // Do not leak handles for the hash table, it would make entries strong.
diff --git a/deps/v8/test/cctest/torque/test-torque.cc b/deps/v8/test/cctest/torque/test-torque.cc
index 5cf70f3374796c..4e94fe21f0d93a 100644
--- a/deps/v8/test/cctest/torque/test-torque.cc
+++ b/deps/v8/test/cctest/torque/test-torque.cc
@@ -631,6 +631,111 @@ TEST(TestBranchOnBoolOptimization) {
   asm_tester.GenerateCode();
 }
 
+TEST(TestBitFieldLoad) {
+  CcTest::InitializeVM();
+  Isolate* isolate(CcTest::i_isolate());
+  i::HandleScope scope(isolate);
+  const int kNumParams = 5;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  TestTorqueAssembler m(asm_tester.state());
+  {
+    // Untag all of the parameters to get plain integer values.
+    TNode<Uint8T> val =
+        m.UncheckedCast<Uint8T>(m.Unsigned(m.SmiToInt32(m.Parameter(0))));
+    TNode<BoolT> expected_a =
+        m.UncheckedCast<BoolT>(m.Unsigned(m.SmiToInt32(m.Parameter(1))));
+    TNode<Uint16T> expected_b =
+        m.UncheckedCast<Uint16T>(m.Unsigned(m.SmiToInt32(m.Parameter(2))));
+    TNode<Uint32T> expected_c =
+        m.UncheckedCast<Uint32T>(m.Unsigned(m.SmiToInt32(m.Parameter(3))));
+    TNode<BoolT> expected_d =
+        m.UncheckedCast<BoolT>(m.Unsigned(m.SmiToInt32(m.Parameter(4))));
+
+    // Call the Torque-defined macro, which verifies that reading each bitfield
+    // out of val yields the correct result.
+    m.TestBitFieldLoad(val, expected_a, expected_b, expected_c, expected_d);
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+
+  // Test every possible bit combination for this 8-bit value.
+  for (int a = 0; a <= 1; ++a) {
+    for (int b = 0; b <= 7; ++b) {
+      for (int c = 0; c <= 7; ++c) {
+        for (int d = 0; d <= 1; ++d) {
+          int val = a | ((b & 7) << 1) | (c << 4) | (d << 7);
+          ft.Call(ft.Val(val), ft.Val(a), ft.Val(b), ft.Val(c), ft.Val(d));
+        }
+      }
+    }
+  }
+}
+
+TEST(TestBitFieldStore) {
+  CcTest::InitializeVM();
+  Isolate* isolate(CcTest::i_isolate());
+  i::HandleScope scope(isolate);
+  const int kNumParams = 1;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  TestTorqueAssembler m(asm_tester.state());
+  {
+    // Untag the parameters to get a plain integer value.
+    TNode<Uint8T> val =
+        m.UncheckedCast<Uint8T>(m.Unsigned(m.SmiToInt32(m.Parameter(0))));
+
+    m.TestBitFieldStore(val);
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+
+  // Test every possible bit combination for this 8-bit value.
+  for (int i = 0; i < 256; ++i) {
+    ft.Call(ft.Val(i));
+  }
+}
+
+TEST(TestBitFieldUintptrOps) {
+  CcTest::InitializeVM();
+  Isolate* isolate(CcTest::i_isolate());
+  i::HandleScope scope(isolate);
+  const int kNumParams = 2;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  TestTorqueAssembler m(asm_tester.state());
+  {
+    // Untag the parameters to get a plain integer value.
+    TNode<Uint32T> val2 =
+        m.UncheckedCast<Uint32T>(m.Unsigned(m.SmiToInt32(m.Parameter(0))));
+    TNode<UintPtrT> val3 = m.UncheckedCast<UintPtrT>(
+        m.ChangeUint32ToWord(m.Unsigned(m.SmiToInt32(m.Parameter(1)))));
+
+    m.TestBitFieldUintptrOps(val2, val3);
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+
+  // Construct the expected test values.
+  int val2 = 3 | (61 << 5);
+  int val3 = 1 | (500 << 1) | (0x1cc << 10);
+
+  ft.Call(ft.Val(val2), ft.Val(val3));
+}
+
+TEST(TestTestParentFrameArguments) {
+  CcTest::InitializeVM();
+  Isolate* isolate(CcTest::i_isolate());
+  i::HandleScope scope(isolate);
+  Handle<Context> context =
+      Utils::OpenHandle(*v8::Isolate::GetCurrent()->GetCurrentContext());
+  CodeAssemblerTester asm_tester(isolate, 1);
+  TestTorqueAssembler m(asm_tester.state());
+  {
+    m.TestParentFrameArguments(
+        m.UncheckedCast<Context>(m.HeapConstant(context)));
+    m.Return(m.UndefinedConstant());
+  }
+  asm_tester.GenerateCode();
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/OWNERS b/deps/v8/test/cctest/wasm/OWNERS
index 16b08f3b3b743a..0b1c176e04a878 100644
--- a/deps/v8/test/cctest/wasm/OWNERS
+++ b/deps/v8/test/cctest/wasm/OWNERS
@@ -1,5 +1,3 @@
-ahaas@chromium.org
-clemensb@chromium.org
-titzer@chromium.org
+file:../../../src/wasm/OWNERS
 
 # COMPONENT: Blink>JavaScript>WebAssembly
diff --git a/deps/v8/test/cctest/wasm/test-compilation-cache.cc b/deps/v8/test/cctest/wasm/test-compilation-cache.cc
new file mode 100644
index 00000000000000..416b4e9df2945a
--- /dev/null
+++ b/deps/v8/test/cctest/wasm/test-compilation-cache.cc
@@ -0,0 +1,100 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/api/api-inl.h"
+#include "src/init/v8.h"
+
+#include "src/wasm/wasm-code-manager.h"
+#include "src/wasm/wasm-engine.h"
+#include "src/wasm/wasm-module-builder.h"
+
+#include "test/cctest/cctest.h"
+
+#include "test/common/wasm/test-signatures.h"
+#include "test/common/wasm/wasm-macro-gen.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+namespace {
+
+class TestResolver : public CompilationResultResolver {
+ public:
+  explicit TestResolver(std::atomic<int>* pending)
+      : native_module_(nullptr), pending_(pending) {}
+
+  void OnCompilationSucceeded(i::Handle<i::WasmModuleObject> module) override {
+    if (!module.is_null()) {
+      native_module_ = module->shared_native_module();
+      pending_->fetch_sub(1);
+    }
+  }
+
+  void OnCompilationFailed(i::Handle<i::Object> error_reason) override {
+    CHECK(false);
+  }
+
+  std::shared_ptr<NativeModule> native_module() { return native_module_; }
+
+ private:
+  std::shared_ptr<NativeModule> native_module_;
+  std::atomic<int>* pending_;
+};
+
+// Create a valid module such that the bytes depend on {n}.
+ZoneBuffer GetValidModuleBytes(Zone* zone, int n) {
+  ZoneBuffer buffer(zone);
+  TestSignatures sigs;
+  WasmModuleBuilder builder(zone);
+  {
+    WasmFunctionBuilder* f = builder.AddFunction(sigs.v_v());
+    uint8_t code[] = {kExprI32Const, n, kExprDrop, kExprEnd};
+    f->EmitCode(code, arraysize(code));
+  }
+  builder.WriteTo(&buffer);
+  return buffer;
+}
+
+}  // namespace
+
+TEST(TestAsyncCache) {
+  CcTest::InitializeVM();
+  i::HandleScope internal_scope_(CcTest::i_isolate());
+  AccountingAllocator allocator;
+  Zone zone(&allocator, "CompilationCacheTester");
+
+  auto bufferA = GetValidModuleBytes(&zone, 0);
+  auto bufferB = GetValidModuleBytes(&zone, 1);
+
+  std::atomic<int> pending(3);
+  auto resolverA1 = std::make_shared<TestResolver>(&pending);
+  auto resolverA2 = std::make_shared<TestResolver>(&pending);
+  auto resolverB = std::make_shared<TestResolver>(&pending);
+
+  CcTest::i_isolate()->wasm_engine()->AsyncCompile(
+      CcTest::i_isolate(), WasmFeatures::All(), resolverA1,
+      ModuleWireBytes(bufferA.begin(), bufferA.end()), true,
+      "WebAssembly.compile");
+  CcTest::i_isolate()->wasm_engine()->AsyncCompile(
+      CcTest::i_isolate(), WasmFeatures::All(), resolverA2,
+      ModuleWireBytes(bufferA.begin(), bufferA.end()), true,
+      "WebAssembly.compile");
+  CcTest::i_isolate()->wasm_engine()->AsyncCompile(
+      CcTest::i_isolate(), WasmFeatures::All(), resolverB,
+      ModuleWireBytes(bufferB.begin(), bufferB.end()), true,
+      "WebAssembly.compile");
+
+  while (pending > 0) {
+    v8::platform::PumpMessageLoop(i::V8::GetCurrentPlatform(),
+                                  CcTest::isolate());
+  }
+
+  CHECK_EQ(resolverA1->native_module(), resolverA2->native_module());
+  CHECK_NE(resolverA1->native_module(), resolverB->native_module());
+}
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-jump-table-assembler.cc b/deps/v8/test/cctest/wasm/test-jump-table-assembler.cc
index d3aa75a64ef7d7..5ff91bc7786f64 100644
--- a/deps/v8/test/cctest/wasm/test-jump-table-assembler.cc
+++ b/deps/v8/test/cctest/wasm/test-jump-table-assembler.cc
@@ -32,7 +32,8 @@ constexpr int kJumpTableSlotCount = 128;
 constexpr uint32_t kJumpTableSize =
     JumpTableAssembler::SizeForNumberOfSlots(kJumpTableSlotCount);
 
-constexpr size_t kThunkBufferSize = AssemblerBase::kMinimalBufferSize;
+// Must be a safe commit page size.
+constexpr size_t kThunkBufferSize = 4 * KB;
 
 #if V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_X64
 constexpr uint32_t kAvailableBufferSlots =
diff --git a/deps/v8/test/cctest/wasm/test-liftoff-inspection.cc b/deps/v8/test/cctest/wasm/test-liftoff-inspection.cc
new file mode 100644
index 00000000000000..3bbc639ca55bc3
--- /dev/null
+++ b/deps/v8/test/cctest/wasm/test-liftoff-inspection.cc
@@ -0,0 +1,324 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/wasm/baseline/liftoff-compiler.h"
+#include "src/wasm/wasm-debug.h"
+#include "test/cctest/cctest.h"
+#include "test/cctest/wasm/wasm-run-utils.h"
+#include "test/common/wasm/wasm-macro-gen.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+namespace {
+
+class LiftoffCompileEnvironment {
+ public:
+  LiftoffCompileEnvironment()
+      : isolate_(CcTest::InitIsolateOnce()),
+        handle_scope_(isolate_),
+        zone_(isolate_->allocator(), ZONE_NAME),
+        module_builder_(&zone_, nullptr, ExecutionTier::kLiftoff,
+                        kRuntimeExceptionSupport, kNoLowerSimd) {
+    // Add a table of length 1, for indirect calls.
+    module_builder_.AddIndirectFunctionTable(nullptr, 1);
+  }
+
+  struct TestFunction {
+    OwnedVector<uint8_t> body_bytes;
+    WasmFunction* function;
+    FunctionBody body;
+  };
+
+  void CheckDeterministicCompilation(
+      std::initializer_list<ValueType> return_types,
+      std::initializer_list<ValueType> param_types,
+      std::initializer_list<uint8_t> raw_function_bytes) {
+    auto test_func = AddFunction(return_types, param_types, raw_function_bytes);
+
+    // Now compile the function with Liftoff two times.
+    CompilationEnv env = module_builder_.CreateCompilationEnv();
+    WasmFeatures detected1;
+    WasmFeatures detected2;
+    WasmCompilationResult result1 = ExecuteLiftoffCompilation(
+        isolate_->allocator(), &env, test_func.body,
+        test_func.function->func_index, isolate_->counters(), &detected1);
+    WasmCompilationResult result2 = ExecuteLiftoffCompilation(
+        isolate_->allocator(), &env, test_func.body,
+        test_func.function->func_index, isolate_->counters(), &detected2);
+
+    CHECK(result1.succeeded());
+    CHECK(result2.succeeded());
+
+    // Check that the generated code matches.
+    auto code1 =
+        VectorOf(result1.code_desc.buffer, result1.code_desc.instr_size);
+    auto code2 =
+        VectorOf(result2.code_desc.buffer, result2.code_desc.instr_size);
+    CHECK_EQ(code1, code2);
+    CHECK_EQ(detected1, detected2);
+  }
+
+  DebugSideTable GenerateDebugSideTable(
+      std::initializer_list<ValueType> return_types,
+      std::initializer_list<ValueType> param_types,
+      std::initializer_list<uint8_t> raw_function_bytes) {
+    auto test_func = AddFunction(return_types, param_types, raw_function_bytes);
+
+    CompilationEnv env = module_builder_.CreateCompilationEnv();
+    return GenerateLiftoffDebugSideTable(CcTest::i_isolate()->allocator(), &env,
+                                         test_func.body);
+  }
+
+ private:
+  OwnedVector<uint8_t> GenerateFunctionBody(
+      std::initializer_list<uint8_t> raw_function_bytes) {
+    // Build the function bytes by prepending the locals decl and appending an
+    // "end" opcode.
+    OwnedVector<uint8_t> function_bytes =
+        OwnedVector<uint8_t>::New(raw_function_bytes.size() + 2);
+    function_bytes[0] = WASM_NO_LOCALS;
+    std::copy(raw_function_bytes.begin(), raw_function_bytes.end(),
+              &function_bytes[1]);
+    function_bytes[raw_function_bytes.size() + 1] = WASM_END;
+    return function_bytes;
+  }
+
+  FunctionSig* AddSig(std::initializer_list<ValueType> return_types,
+                      std::initializer_list<ValueType> param_types) {
+    ValueType* storage =
+        zone_.NewArray<ValueType>(return_types.size() + param_types.size());
+    std::copy(return_types.begin(), return_types.end(), storage);
+    std::copy(param_types.begin(), param_types.end(),
+              storage + return_types.size());
+    FunctionSig* sig = new (&zone_)
+        FunctionSig{return_types.size(), param_types.size(), storage};
+    module_builder_.AddSignature(sig);
+    return sig;
+  }
+
+  TestFunction AddFunction(std::initializer_list<ValueType> return_types,
+                           std::initializer_list<ValueType> param_types,
+                           std::initializer_list<uint8_t> raw_function_bytes) {
+    OwnedVector<uint8_t> function_bytes =
+        GenerateFunctionBody(raw_function_bytes);
+    FunctionSig* sig = AddSig(return_types, param_types);
+    int func_index =
+        module_builder_.AddFunction(sig, "f", TestingModuleBuilder::kWasm);
+    WasmFunction* function = module_builder_.GetFunctionAt(func_index);
+    function->code = {module_builder_.AddBytes(function_bytes.as_vector()),
+                      static_cast<uint32_t>(function_bytes.size())};
+    FunctionBody body{function->sig, 0, function_bytes.begin(),
+                      function_bytes.end()};
+    return {std::move(function_bytes), function, body};
+  }
+
+  Isolate* isolate_;
+  HandleScope handle_scope_;
+  Zone zone_;
+  TestingModuleBuilder module_builder_;
+};
+
+struct DebugSideTableEntry {
+  std::vector<ValueType> stack_types;
+  std::vector<std::pair<int, int>> constants;
+
+  bool operator==(const DebugSideTableEntry& other) const {
+    return stack_types == other.stack_types && constants == other.constants;
+  }
+};
+
+// Debug builds will print the vector of DebugSideTableEntry.
+#ifdef DEBUG
+std::ostream& operator<<(std::ostream& out, const DebugSideTableEntry& entry) {
+  out << "{stack types [";
+  const char* comma = "";
+  for (ValueType type : entry.stack_types) {
+    out << comma << ValueTypes::TypeName(type);
+    comma = ", ";
+  }
+  comma = "";
+  out << "], constants: [";
+  for (auto& c : entry.constants) {
+    out << comma << "<" << c.first << ", " << c.second << ">";
+    comma = ", ";
+  }
+  return out << "]}";
+}
+
+std::ostream& operator<<(std::ostream& out,
+                         const std::vector<DebugSideTableEntry>& entries) {
+  return out << PrintCollection(entries);
+}
+#endif  // DEBUG
+
+void CheckDebugSideTable(std::vector<ValueType> expected_local_types,
+                         std::vector<DebugSideTableEntry> expected_entries,
+                         const wasm::DebugSideTable& debug_side_table) {
+  std::vector<ValueType> local_types;
+  for (int i = 0; i < debug_side_table.num_locals(); ++i) {
+    local_types.push_back(debug_side_table.local_type(i));
+  }
+  std::vector<DebugSideTableEntry> entries;
+  for (auto& entry : debug_side_table.entries()) {
+    std::vector<ValueType> stack_types;
+    for (int i = 0; i < entry.stack_height(); ++i) {
+      stack_types.push_back(entry.stack_type(i));
+    }
+    std::vector<std::pair<int, int>> constants;
+    int locals_plus_stack =
+        debug_side_table.num_locals() + entry.stack_height();
+    for (int i = 0; i < locals_plus_stack; ++i) {
+      if (entry.IsConstant(i)) constants.emplace_back(i, entry.GetConstant(i));
+    }
+    entries.push_back({std::move(stack_types), std::move(constants)});
+  }
+  CHECK_EQ(expected_local_types, local_types);
+  CHECK_EQ(expected_entries, entries);
+}
+
+}  // namespace
+
+TEST(Liftoff_deterministic_simple) {
+  LiftoffCompileEnvironment env;
+  env.CheckDeterministicCompilation(
+      {kWasmI32}, {kWasmI32, kWasmI32},
+      {WASM_I32_ADD(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))});
+}
+
+TEST(Liftoff_deterministic_call) {
+  LiftoffCompileEnvironment env;
+  env.CheckDeterministicCompilation(
+      {kWasmI32}, {kWasmI32},
+      {WASM_I32_ADD(WASM_CALL_FUNCTION(0, WASM_GET_LOCAL(0)),
+                    WASM_GET_LOCAL(0))});
+}
+
+TEST(Liftoff_deterministic_indirect_call) {
+  LiftoffCompileEnvironment env;
+  env.CheckDeterministicCompilation(
+      {kWasmI32}, {kWasmI32},
+      {WASM_I32_ADD(WASM_CALL_INDIRECT(0, WASM_GET_LOCAL(0), WASM_I32V_1(47)),
+                    WASM_GET_LOCAL(0))});
+}
+
+TEST(Liftoff_deterministic_loop) {
+  LiftoffCompileEnvironment env;
+  env.CheckDeterministicCompilation(
+      {kWasmI32}, {kWasmI32},
+      {WASM_LOOP(WASM_BR_IF(0, WASM_GET_LOCAL(0))), WASM_GET_LOCAL(0)});
+}
+
+TEST(Liftoff_deterministic_trap) {
+  LiftoffCompileEnvironment env;
+  env.CheckDeterministicCompilation(
+      {kWasmI32}, {kWasmI32, kWasmI32},
+      {WASM_I32_DIVS(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))});
+}
+
+TEST(Liftoff_debug_side_table_simple) {
+  LiftoffCompileEnvironment env;
+  auto debug_side_table = env.GenerateDebugSideTable(
+      {kWasmI32}, {kWasmI32, kWasmI32},
+      {WASM_I32_ADD(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))});
+  CheckDebugSideTable({kWasmI32, kWasmI32},
+                      {
+                          // OOL stack check, stack: {}
+                          {{}, {}},
+                      },
+                      debug_side_table);
+}
+
+TEST(Liftoff_debug_side_table_call) {
+  LiftoffCompileEnvironment env;
+  auto debug_side_table = env.GenerateDebugSideTable(
+      {kWasmI32}, {kWasmI32},
+      {WASM_I32_ADD(WASM_CALL_FUNCTION(0, WASM_GET_LOCAL(0)),
+                    WASM_GET_LOCAL(0))});
+  CheckDebugSideTable({kWasmI32},
+                      {
+                          // call, stack: {}
+                          {{}, {}},
+                          // OOL stack check, stack: {}
+                          {{}, {}},
+                      },
+                      debug_side_table);
+}
+
+TEST(Liftoff_debug_side_table_call_const) {
+  LiftoffCompileEnvironment env;
+  constexpr int kConst = 13;
+  auto debug_side_table = env.GenerateDebugSideTable(
+      {kWasmI32}, {kWasmI32},
+      {WASM_SET_LOCAL(0, WASM_I32V_1(kConst)),
+       WASM_I32_ADD(WASM_CALL_FUNCTION(0, WASM_GET_LOCAL(0)),
+                    WASM_GET_LOCAL(0))});
+  CheckDebugSideTable({kWasmI32},
+                      {
+                          // call, stack: {}, local0 is kConst
+                          {{}, {{0, kConst}}},
+                          // OOL stack check, stack: {}
+                          {{}, {}},
+                      },
+                      debug_side_table);
+}
+
+TEST(Liftoff_debug_side_table_indirect_call) {
+  LiftoffCompileEnvironment env;
+  constexpr int kConst = 47;
+  auto debug_side_table = env.GenerateDebugSideTable(
+      {kWasmI32}, {kWasmI32},
+      {WASM_I32_ADD(WASM_CALL_INDIRECT(0, WASM_I32V_1(47), WASM_GET_LOCAL(0)),
+                    WASM_GET_LOCAL(0))});
+  CheckDebugSideTable({kWasmI32},
+                      {
+                          // indirect call, stack: {}
+                          {{}, {}},
+                          // OOL stack check, stack: {}
+                          {{}, {}},
+                          // OOL trap (invalid index), stack: {kConst}
+                          {{kWasmI32}, {{1, kConst}}},
+                          // OOL trap (sig mismatch), stack: {kConst}
+                          {{kWasmI32}, {{1, kConst}}},
+                      },
+                      debug_side_table);
+}
+
+TEST(Liftoff_debug_side_table_loop) {
+  LiftoffCompileEnvironment env;
+  constexpr int kConst = 42;
+  auto debug_side_table = env.GenerateDebugSideTable(
+      {kWasmI32}, {kWasmI32},
+      {WASM_I32V_1(kConst), WASM_LOOP(WASM_BR_IF(0, WASM_GET_LOCAL(0)))});
+  CheckDebugSideTable({kWasmI32},
+                      {
+                          // OOL stack check, stack: {}
+                          {{}, {}},
+                          // OOL loop stack check, stack: {kConst}
+                          {{kWasmI32}, {{1, kConst}}},
+                      },
+                      debug_side_table);
+}
+
+TEST(Liftoff_debug_side_table_trap) {
+  LiftoffCompileEnvironment env;
+  auto debug_side_table = env.GenerateDebugSideTable(
+      {kWasmI32}, {kWasmI32, kWasmI32},
+      {WASM_I32_DIVS(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))});
+  CheckDebugSideTable({kWasmI32, kWasmI32},
+                      {
+                          // OOL stack check, stack: {}
+                          {{}, {}},
+                          // OOL trap (div by zero), stack: {}
+                          {{}, {}},
+                          // OOL trap (result unrepresentable), stack: {}
+                          {{}, {}},
+                      },
+                      debug_side_table);
+}
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-64.cc b/deps/v8/test/cctest/wasm/test-run-wasm-64.cc
index 09d1eb7fda07fc..94fa0a31b2277e 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-64.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-64.cc
@@ -735,7 +735,6 @@ WASM_EXEC_TEST(I64SConvertF32) {
 }
 
 WASM_EXEC_TEST(I64SConvertSatF32) {
-  EXPERIMENTAL_FLAG_SCOPE(sat_f2i_conversions);
   WasmRunner<int64_t, float> r(execution_tier);
   BUILD(r, WASM_I64_SCONVERT_SAT_F32(WASM_GET_LOCAL(0)));
   FOR_FLOAT32_INPUTS(i) {
@@ -770,7 +769,6 @@ WASM_EXEC_TEST(I64SConvertF64) {
 }
 
 WASM_EXEC_TEST(I64SConvertSatF64) {
-  EXPERIMENTAL_FLAG_SCOPE(sat_f2i_conversions);
   WasmRunner<int64_t, double> r(execution_tier);
   BUILD(r, WASM_I64_SCONVERT_SAT_F64(WASM_GET_LOCAL(0)));
   FOR_FLOAT64_INPUTS(i) {
@@ -805,7 +803,6 @@ WASM_EXEC_TEST(I64UConvertF32) {
 }
 
 WASM_EXEC_TEST(I64UConvertSatF32) {
-  EXPERIMENTAL_FLAG_SCOPE(sat_f2i_conversions);
   WasmRunner<int64_t, float> r(execution_tier);
   BUILD(r, WASM_I64_UCONVERT_SAT_F32(WASM_GET_LOCAL(0)));
   FOR_FLOAT32_INPUTS(i) {
@@ -840,7 +837,6 @@ WASM_EXEC_TEST(I64UConvertF64) {
 }
 
 WASM_EXEC_TEST(I64UConvertSatF64) {
-  EXPERIMENTAL_FLAG_SCOPE(sat_f2i_conversions);
   WasmRunner<int64_t, double> r(execution_tier);
   BUILD(r, WASM_I64_UCONVERT_SAT_F64(WASM_GET_LOCAL(0)));
   FOR_FLOAT64_INPUTS(i) {
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc b/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
index 748adc4a67a09c..082c5d07c9ece4 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
@@ -694,6 +694,64 @@ WASM_EXEC_TEST(AtomicCompareExchangeNoConsideredEffectful) {
   CHECK_EQ(1, r.Call());
 }
 
+WASM_EXEC_TEST(I64AtomicLoadUseOnlyLowWord) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint32_t> r(execution_tier);
+  uint64_t* memory =
+      r.builder().AddMemoryElems<uint64_t>(kWasmPageSize / sizeof(uint64_t));
+  memory[1] = 0x1234567890abcdeful;
+  r.builder().SetHasSharedMemory();
+  // Test that we can use just the low word of an I64AtomicLoad.
+  BUILD(r,
+        WASM_I32_CONVERT_I64(WASM_ATOMICS_LOAD_OP(
+            kExprI64AtomicLoad, WASM_I32V(8), MachineRepresentation::kWord64)));
+  CHECK_EQ(0x90abcdef, r.Call());
+}
+
+WASM_EXEC_TEST(I64AtomicLoadUseOnlyHighWord) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint32_t> r(execution_tier);
+  uint64_t* memory =
+      r.builder().AddMemoryElems<uint64_t>(kWasmPageSize / sizeof(uint64_t));
+  memory[1] = 0x1234567890abcdeful;
+  r.builder().SetHasSharedMemory();
+  // Test that we can use just the high word of an I64AtomicLoad.
+  BUILD(r, WASM_I32_CONVERT_I64(WASM_I64_ROR(
+               WASM_ATOMICS_LOAD_OP(kExprI64AtomicLoad, WASM_I32V(8),
+                                    MachineRepresentation::kWord64),
+               WASM_I64V(32))));
+  CHECK_EQ(0x12345678, r.Call());
+}
+
+WASM_EXEC_TEST(I64AtomicAddUseOnlyLowWord) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint32_t> r(execution_tier);
+  uint64_t* memory =
+      r.builder().AddMemoryElems<uint64_t>(kWasmPageSize / sizeof(uint64_t));
+  memory[1] = 0x1234567890abcdeful;
+  r.builder().SetHasSharedMemory();
+  // Test that we can use just the low word of an I64AtomicLoad.
+  BUILD(r, WASM_I32_CONVERT_I64(
+               WASM_ATOMICS_BINOP(kExprI64AtomicAdd, WASM_I32V(8), WASM_I64V(1),
+                                  MachineRepresentation::kWord64)));
+  CHECK_EQ(0x90abcdef, r.Call());
+}
+
+WASM_EXEC_TEST(I64AtomicAddUseOnlyHighWord) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint32_t> r(execution_tier);
+  uint64_t* memory =
+      r.builder().AddMemoryElems<uint64_t>(kWasmPageSize / sizeof(uint64_t));
+  memory[1] = 0x1234567890abcdeful;
+  r.builder().SetHasSharedMemory();
+  // Test that we can use just the high word of an I64AtomicLoad.
+  BUILD(r, WASM_I32_CONVERT_I64(WASM_I64_ROR(
+               WASM_ATOMICS_BINOP(kExprI64AtomicAdd, WASM_I32V(8), WASM_I64V(1),
+                                  MachineRepresentation::kWord64),
+               WASM_I64V(32))));
+  CHECK_EQ(0x12345678, r.Call());
+}
+
 }  // namespace test_run_wasm_atomics_64
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-bulk-memory.cc b/deps/v8/test/cctest/wasm/test-run-wasm-bulk-memory.cc
index d2ac3434dfff8b..ab826df7d7e220 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-bulk-memory.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-bulk-memory.cc
@@ -95,14 +95,13 @@ WASM_EXEC_TEST(MemoryInitOutOfBoundsData) {
 
   const uint32_t last_5_bytes = kWasmPageSize - 5;
 
-  // Write all values up to the out-of-bounds write.
+  // Failing memory.init should not have any effect.
   CHECK_EQ(0xDEADBEEF, r.Call(kWasmPageSize - 5, 0, 6));
-  CheckMemoryEquals(&r.builder(), last_5_bytes, {0, 1, 2, 3, 4});
+  CheckMemoryEquals(&r.builder(), last_5_bytes, {0, 0, 0, 0, 0});
 
-  // Write all values up to the out-of-bounds read.
   r.builder().BlankMemory();
   CHECK_EQ(0xDEADBEEF, r.Call(0, 5, 6));
-  CheckMemoryEqualsFollowedByZeroes(&r.builder(), {5, 6, 7, 8, 9});
+  CheckMemoryEquals(&r.builder(), last_5_bytes, {0, 0, 0, 0, 0});
 }
 
 WASM_EXEC_TEST(MemoryInitOutOfBounds) {
@@ -129,9 +128,9 @@ WASM_EXEC_TEST(MemoryInitOutOfBounds) {
   CHECK_EQ(0xDEADBEEF, r.Call(1000, 0, kWasmPageSize));
   CHECK_EQ(0xDEADBEEF, r.Call(kWasmPageSize, 0, 1));
 
-  // Copy 0 out-of-bounds succeeds.
-  CHECK_EQ(0, r.Call(kWasmPageSize + 1, 0, 0));
-  CHECK_EQ(0, r.Call(0, kWasmPageSize + 1, 0));
+  // Copy 0 out-of-bounds fails if target is invalid.
+  CHECK_EQ(0xDEADBEEF, r.Call(kWasmPageSize + 1, 0, 0));
+  CHECK_EQ(0xDEADBEEF, r.Call(0, kWasmPageSize + 1, 0));
 
   // Make sure bounds aren't checked with 32-bit wrapping.
   CHECK_EQ(0xDEADBEEF, r.Call(1, 1, 0xFFFFFFFF));
@@ -203,24 +202,19 @@ WASM_EXEC_TEST(MemoryCopyOutOfBoundsData) {
 
   const uint32_t last_5_bytes = kWasmPageSize - 5;
 
-  // Copy with source < destination. Copy would happen backwards,
-  // but the first byte to copy is out-of-bounds, so no data should be written.
+  CheckMemoryEquals(&r.builder(), last_5_bytes, {0, 0, 0, 0, 0});
   CHECK_EQ(0xDEADBEEF, r.Call(last_5_bytes, 0, 6));
   CheckMemoryEquals(&r.builder(), last_5_bytes, {0, 0, 0, 0, 0});
 
-  // Copy overlapping with destination < source. Copy will happen forwards, up
-  // to the out-of-bounds access.
   r.builder().BlankMemory();
   memcpy(mem + last_5_bytes, data, 5);
   CHECK_EQ(0xDEADBEEF, r.Call(0, last_5_bytes, kWasmPageSize));
-  CheckMemoryEquals(&r.builder(), 0, {11, 22, 33, 44, 55});
+  CheckMemoryEquals(&r.builder(), last_5_bytes, {11, 22, 33, 44, 55});
 
-  // Copy overlapping with source < destination. Copy would happen backwards,
-  // but the first byte to copy is out-of-bounds, so no data should be written.
   r.builder().BlankMemory();
-  memcpy(mem, data, 5);
+  memcpy(mem + last_5_bytes, data, 5);
   CHECK_EQ(0xDEADBEEF, r.Call(last_5_bytes, 0, kWasmPageSize));
-  CheckMemoryEquals(&r.builder(), last_5_bytes, {0, 0, 0, 0, 0});
+  CheckMemoryEquals(&r.builder(), last_5_bytes, {11, 22, 33, 44, 55});
 }
 
 WASM_EXEC_TEST(MemoryCopyOutOfBounds) {
@@ -245,9 +239,9 @@ WASM_EXEC_TEST(MemoryCopyOutOfBounds) {
   CHECK_EQ(0xDEADBEEF, r.Call(1000, 0, kWasmPageSize));
   CHECK_EQ(0xDEADBEEF, r.Call(kWasmPageSize, 0, 1));
 
-  // Copy 0 out-of-bounds always succeeds.
-  CHECK_EQ(0, r.Call(kWasmPageSize + 1, 0, 0));
-  CHECK_EQ(0, r.Call(0, kWasmPageSize + 1, 0));
+  // Copy 0 out-of-bounds fails if target is invalid.
+  CHECK_EQ(0xDEADBEEF, r.Call(kWasmPageSize + 1, 0, 0));
+  CHECK_EQ(0xDEADBEEF, r.Call(0, kWasmPageSize + 1, 0));
 
   // Make sure bounds aren't checked with 32-bit wrapping.
   CHECK_EQ(0xDEADBEEF, r.Call(1, 1, 0xFFFFFFFF));
@@ -301,7 +295,7 @@ WASM_EXEC_TEST(MemoryFillOutOfBoundsData) {
       kExprI32Const, 0);
   const byte v = 123;
   CHECK_EQ(0xDEADBEEF, r.Call(kWasmPageSize - 5, v, 999));
-  CheckMemoryEquals(&r.builder(), kWasmPageSize - 6, {0, v, v, v, v, v});
+  CheckMemoryEquals(&r.builder(), kWasmPageSize - 6, {0, 0, 0, 0, 0, 0});
 }
 
 WASM_EXEC_TEST(MemoryFillOutOfBounds) {
@@ -320,8 +314,8 @@ WASM_EXEC_TEST(MemoryFillOutOfBounds) {
   CHECK_EQ(0xDEADBEEF, r.Call(1000, v, kWasmPageSize));
   CHECK_EQ(0xDEADBEEF, r.Call(kWasmPageSize, v, 1));
 
-  // Fill 0 out-of-bounds succeeds.
-  CHECK_EQ(0, r.Call(kWasmPageSize + 1, v, 0));
+  // Fill 0 out-of-bounds still fails.
+  CHECK_EQ(0xDEADBEEF, r.Call(kWasmPageSize + 1, v, 0));
 
   // Make sure bounds aren't checked with 32-bit wrapping.
   CHECK_EQ(0xDEADBEEF, r.Call(1, v, 0xFFFFFFFF));
@@ -336,7 +330,7 @@ WASM_EXEC_TEST(DataDropTwice) {
   BUILD(r, WASM_DATA_DROP(0), kExprI32Const, 0);
 
   CHECK_EQ(0, r.Call());
-  CHECK_EQ(0xDEADBEEF, r.Call());
+  CHECK_EQ(0, r.Call());
 }
 
 WASM_EXEC_TEST(DataDropThenMemoryInit) {
@@ -444,7 +438,7 @@ void TestTableInitElems(ExecutionTier execution_tier, int table_index) {
 
   WasmFunctionCompiler& call = r.NewFunction(sigs.i_i(), "call");
   BUILD(call,
-        WASM_CALL_INDIRECT_TABLE0(table_index, sig_index, WASM_GET_LOCAL(0)));
+        WASM_CALL_INDIRECT_TABLE(table_index, sig_index, WASM_GET_LOCAL(0)));
   const uint32_t call_index = call.function_index();
 
   BUILD(r,
@@ -516,7 +510,7 @@ void TestTableInitOob(ExecutionTier execution_tier, int table_index) {
 
   WasmFunctionCompiler& call = r.NewFunction(sigs.i_i(), "call");
   BUILD(call,
-        WASM_CALL_INDIRECT_TABLE0(table_index, sig_index, WASM_GET_LOCAL(0)));
+        WASM_CALL_INDIRECT_TABLE(table_index, sig_index, WASM_GET_LOCAL(0)));
   const uint32_t call_index = call.function_index();
 
   BUILD(r,
@@ -532,17 +526,16 @@ void TestTableInitOob(ExecutionTier execution_tier, int table_index) {
 
   CheckTableCall(isolate, table, &r, call_index, null, null, null, null, null);
 
-  // Write all values up to the out-of-bounds write.
+  // Out-of-bounds table.init should not have any effect.
   r.CheckCallViaJS(0xDEADBEEF, 3, 0, 3);
-  CheckTableCall(isolate, table, &r, call_index, null, null, null, 0, 1);
+  CheckTableCall(isolate, table, &r, call_index, null, null, null, null, null);
 
-  // Write all values up to the out-of-bounds read.
   r.CheckCallViaJS(0xDEADBEEF, 0, 3, 3);
-  CheckTableCall(isolate, table, &r, call_index, 3, 4, null, 0, 1);
+  CheckTableCall(isolate, table, &r, call_index, null, null, null, null, null);
 
-  // 0-count is never oob.
-  r.CheckCallViaJS(0, kTableSize + 1, 0, 0);
-  r.CheckCallViaJS(0, 0, kTableSize + 1, 0);
+  // 0-count is still oob if target is invalid.
+  r.CheckCallViaJS(0xDEADBEEF, kTableSize + 1, 0, 0);
+  r.CheckCallViaJS(0xDEADBEEF, 0, kTableSize + 1, 0);
 
   r.CheckCallViaJS(0xDEADBEEF, 0, 0, 6);
   r.CheckCallViaJS(0xDEADBEEF, 0, 1, 5);
@@ -678,7 +671,7 @@ void TestTableCopyCalls(ExecutionTier execution_tier, int table_dst,
 
   WasmFunctionCompiler& call = r.NewFunction(sigs.i_i(), "call");
   BUILD(call,
-        WASM_CALL_INDIRECT_TABLE0(table_dst, sig_index, WASM_GET_LOCAL(0)));
+        WASM_CALL_INDIRECT_TABLE(table_dst, sig_index, WASM_GET_LOCAL(0)));
   const uint32_t call_index = call.function_index();
 
   BUILD(r,
@@ -772,23 +765,18 @@ void TestTableCopyOobWrites(ExecutionTier execution_tier, int table_dst,
 
   CheckTable(isolate, table, f0, f1, f2, f3, f4);
 
-  // Non-overlapping, src < dst. Because of src < dst, we copy backwards.
-  // Therefore the first access already traps, and the table is not changed.
+  // Failing table.copy should not have any effect.
   r.CheckCallViaJS(0xDEADBEEF, 3, 0, 3);
   CheckTable(isolate, table, f0, f1, f2, f3, f4);
 
-  // Non-overlapping, dst < src.
   r.CheckCallViaJS(0xDEADBEEF, 0, 4, 2);
-  CheckTable(isolate, table, f4, f1, f2, f3, f4);
+  CheckTable(isolate, table, f0, f1, f2, f3, f4);
 
-  // Overlapping, src < dst. This is required to copy backward, but the first
-  // access will be out-of-bounds, so nothing changes.
   r.CheckCallViaJS(0xDEADBEEF, 3, 0, 99);
-  CheckTable(isolate, table, f4, f1, f2, f3, f4);
+  CheckTable(isolate, table, f0, f1, f2, f3, f4);
 
-  // Overlapping, dst < src.
   r.CheckCallViaJS(0xDEADBEEF, 0, 1, 99);
-  CheckTable(isolate, table, f1, f2, f3, f4, f4);
+  CheckTable(isolate, table, f0, f1, f2, f3, f4);
 }
 
 WASM_EXEC_TEST(TableCopyOobWritesFrom0To0) {
@@ -833,8 +821,8 @@ void TestTableCopyOob1(ExecutionTier execution_tier, int table_dst,
 
   {
     const uint32_t big = 1000000;
-    r.CheckCallViaJS(0, big, 0, 0);
-    r.CheckCallViaJS(0, 0, big, 0);
+    r.CheckCallViaJS(0xDEADBEEF, big, 0, 0);
+    r.CheckCallViaJS(0xDEADBEEF, 0, big, 0);
   }
 
   for (uint32_t big = 4294967295; big > 1000; big >>= 1) {
@@ -877,19 +865,21 @@ WASM_EXEC_TEST(ElemDropTwice) {
   BUILD(r, WASM_ELEM_DROP(0), kExprI32Const, 0);
 
   r.CheckCallViaJS(0);
-  r.CheckCallViaJS(0xDEADBEEF);
+  r.CheckCallViaJS(0);
 }
 
 WASM_EXEC_TEST(ElemDropThenTableInit) {
   EXPERIMENTAL_FLAG_SCOPE(bulk_memory);
-  WasmRunner<uint32_t> r(execution_tier);
+  WasmRunner<uint32_t, uint32_t> r(execution_tier);
   r.builder().AddIndirectFunctionTable(nullptr, 1);
   r.builder().AddPassiveElementSegment({});
-  BUILD(r, WASM_ELEM_DROP(0),
-        WASM_TABLE_INIT(0, 0, WASM_I32V_1(0), WASM_I32V_1(0), WASM_I32V_1(0)),
-        kExprI32Const, 0);
+  BUILD(
+      r, WASM_ELEM_DROP(0),
+      WASM_TABLE_INIT(0, 0, WASM_I32V_1(0), WASM_I32V_1(0), WASM_GET_LOCAL(0)),
+      kExprI32Const, 0);
 
-  r.CheckCallViaJS(0xDEADBEEF);
+  r.CheckCallViaJS(0, 0);
+  r.CheckCallViaJS(0xDEADBEEF, 1);
 }
 
 }  // namespace test_run_wasm_bulk_memory
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-exceptions.cc b/deps/v8/test/cctest/wasm/test-run-wasm-exceptions.cc
index 4d7983cc8f1a08..745196210aa270 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-exceptions.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-exceptions.cc
@@ -81,15 +81,16 @@ WASM_EXEC_TEST(TryCatchCallIndirect) {
                                        arraysize(indirect_function_table));
 
   // Build the main test function.
-  BUILD(r, WASM_TRY_CATCH_T(
-               kWasmI32,
-               WASM_STMTS(WASM_I32V(kResult1),
-                          WASM_IF(WASM_I32_EQZ(WASM_GET_LOCAL(0)),
-                                  WASM_STMTS(WASM_CALL_INDIRECT2(
-                                                 sig_index, WASM_GET_LOCAL(0),
-                                                 WASM_I32V(7), WASM_I32V(9)),
-                                             WASM_DROP))),
-               WASM_STMTS(WASM_DROP, WASM_I32V(kResult0))));
+  BUILD(r,
+        WASM_TRY_CATCH_T(
+            kWasmI32,
+            WASM_STMTS(WASM_I32V(kResult1),
+                       WASM_IF(WASM_I32_EQZ(WASM_GET_LOCAL(0)),
+                               WASM_STMTS(WASM_CALL_INDIRECT(
+                                              sig_index, WASM_I32V(7),
+                                              WASM_I32V(9), WASM_GET_LOCAL(0)),
+                                          WASM_DROP))),
+            WASM_STMTS(WASM_DROP, WASM_I32V(kResult0))));
 
   // Need to call through JS to allow for creation of stack traces.
   r.CheckCallViaJS(kResult0, 0);
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-interpreter.cc b/deps/v8/test/cctest/wasm/test-run-wasm-interpreter.cc
index 1b64135cb80ba0..0c5474142c3a00 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-interpreter.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-interpreter.cc
@@ -229,16 +229,16 @@ TEST(Run_Wasm_returnCallIndirectFactorial) {
   r.builder().AddIndirectFunctionTable(indirect_function_table,
                                        arraysize(indirect_function_table));
 
-  BUILD(r, WASM_RETURN_CALL_INDIRECT(sig_index, WASM_I32V(0), WASM_GET_LOCAL(0),
-                                     WASM_I32V(1)));
+  BUILD(r, WASM_RETURN_CALL_INDIRECT(sig_index, WASM_GET_LOCAL(0), WASM_I32V(1),
+                                     WASM_ZERO));
 
-  BUILD(fact_aux_fn,
-        WASM_IF_ELSE_I(
-            WASM_I32_EQ(WASM_I32V(1), WASM_GET_LOCAL(0)), WASM_GET_LOCAL(1),
-            WASM_RETURN_CALL_INDIRECT(
-                sig_index, WASM_I32V(0),
-                WASM_I32_SUB(WASM_GET_LOCAL(0), WASM_I32V(1)),
-                WASM_I32_MUL(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)))));
+  BUILD(
+      fact_aux_fn,
+      WASM_IF_ELSE_I(
+          WASM_I32_EQ(WASM_I32V(1), WASM_GET_LOCAL(0)), WASM_GET_LOCAL(1),
+          WASM_RETURN_CALL_INDIRECT(
+              sig_index, WASM_I32_SUB(WASM_GET_LOCAL(0), WASM_I32V(1)),
+              WASM_I32_MUL(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)), WASM_ZERO)));
 
   uint32_t test_values[] = {1, 2, 5, 10, 20};
 
@@ -449,7 +449,6 @@ TEST(ReferenceTypeLocals) {
     BUILD(r, WASM_REF_IS_NULL(WASM_TEE_LOCAL(0, WASM_REF_NULL)));
     CHECK_EQ(1, r.Call());
   }
-  // TODO(mstarzinger): Test and support global anyref variables.
 }
 
 TEST(TestPossibleNondeterminism) {
@@ -576,7 +575,7 @@ TEST(WasmInterpreterActivations) {
   CHECK_EQ(2, thread->NumActivations());
   CHECK_EQ(2, thread->GetFrameCount());
   CHECK_EQ(WasmInterpreter::TRAPPED, thread->Run());
-  thread->RaiseException(isolate, handle(Smi::kZero, isolate));
+  thread->RaiseException(isolate, handle(Smi::zero(), isolate));
   CHECK_EQ(1, thread->GetFrameCount());
   CHECK_EQ(2, thread->NumActivations());
   thread->FinishActivation(act1);
@@ -584,7 +583,7 @@ TEST(WasmInterpreterActivations) {
   CHECK_EQ(1, thread->GetFrameCount());
   CHECK_EQ(1, thread->NumActivations());
   CHECK_EQ(WasmInterpreter::TRAPPED, thread->Run());
-  thread->RaiseException(isolate, handle(Smi::kZero, isolate));
+  thread->RaiseException(isolate, handle(Smi::zero(), isolate));
   CHECK_EQ(0, thread->GetFrameCount());
   CHECK_EQ(1, thread->NumActivations());
   thread->FinishActivation(act0);
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-js.cc b/deps/v8/test/cctest/wasm/test-run-wasm-js.cc
index a06c2f87206069..0db42c69b4cfa4 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-js.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-js.cc
@@ -147,9 +147,8 @@ WASM_EXEC_TEST(Run_IndirectCallJSFunction) {
   r.builder().AddIndirectFunctionTable(indirect_function_table,
                                        arraysize(indirect_function_table));
 
-  BUILD(rc_fn,
-        WASM_CALL_INDIRECT3(sig_index, WASM_I32V(js_index), WASM_I32V(left),
-                            WASM_I32V(right), WASM_GET_LOCAL(0)));
+  BUILD(rc_fn, WASM_CALL_INDIRECT(sig_index, WASM_I32V(left), WASM_I32V(right),
+                                  WASM_GET_LOCAL(0), WASM_I32V(js_index)));
 
   Handle<Object> args_left[] = {isolate->factory()->NewNumber(1)};
   r.CheckCallApplyViaJS(left, rc_fn.function_index(), args_left, 1);
@@ -545,9 +544,9 @@ void RunPickerTest(ExecutionTier tier, bool indirect) {
     r.builder().AddIndirectFunctionTable(indirect_function_table,
                                          arraysize(indirect_function_table));
 
-    BUILD(rc_fn, WASM_RETURN_CALL_INDIRECT(sig_index, WASM_I32V(js_index),
-                                           WASM_I32V(left), WASM_I32V(right),
-                                           WASM_GET_LOCAL(0)));
+    BUILD(rc_fn, WASM_RETURN_CALL_INDIRECT(sig_index, WASM_I32V(left),
+                                           WASM_I32V(right), WASM_GET_LOCAL(0),
+                                           WASM_I32V(js_index)));
   } else {
     BUILD(rc_fn,
           WASM_RETURN_CALL_FUNCTION(js_index, WASM_I32V(left), WASM_I32V(right),
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-module.cc b/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
index 5f70ab6c7b8a77..ea080a7a122aa2 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
@@ -942,46 +942,6 @@ TEST(MemoryWithOOBEmptyDataSegment) {
   Cleanup();
 }
 
-TEST(AtomicOpDisassembly) {
-  {
-    EXPERIMENTAL_FLAG_SCOPE(threads);
-    TestSignatures sigs;
-    Isolate* isolate = CcTest::InitIsolateOnce();
-    v8::internal::AccountingAllocator allocator;
-    Zone zone(&allocator, ZONE_NAME);
-
-    WasmModuleBuilder* builder = new (&zone) WasmModuleBuilder(&zone);
-    builder->SetHasSharedMemory();
-    builder->SetMaxMemorySize(16);
-    WasmFunctionBuilder* f = builder->AddFunction(sigs.i_i());
-    ExportAsMain(f);
-    byte code[] = {
-        WASM_ATOMICS_STORE_OP(kExprI32AtomicStore, WASM_ZERO, WASM_GET_LOCAL(0),
-                              MachineRepresentation::kWord32),
-        WASM_ATOMICS_LOAD_OP(kExprI32AtomicLoad, WASM_ZERO,
-                             MachineRepresentation::kWord32)};
-    EMIT_CODE_WITH_END(f, code);
-
-    HandleScope scope(isolate);
-    ZoneBuffer buffer(&zone);
-    builder->WriteTo(&buffer);
-    testing::SetupIsolateForWasmModule(isolate);
-
-    ErrorThrower thrower(isolate, "Test");
-    auto enabled_features = WasmFeaturesFromIsolate(isolate);
-    Handle<WasmModuleObject> module_object =
-        isolate->wasm_engine()
-            ->SyncCompile(isolate, enabled_features, &thrower,
-                          ModuleWireBytes(buffer.begin(), buffer.end()))
-            .ToHandleChecked();
-    NativeModule* native_module = module_object->native_module();
-    ModuleWireBytes wire_bytes(native_module->wire_bytes());
-
-    DisassembleWasmFunction(native_module->module(), wire_bytes, 0);
-  }
-  Cleanup();
-}
-
 #undef EMIT_CODE_WITH_END
 
 }  // namespace test_run_wasm_module
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-sign-extension.cc b/deps/v8/test/cctest/wasm/test-run-wasm-sign-extension.cc
index 71b5285439e68a..d6a6478f451eaf 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-sign-extension.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-sign-extension.cc
@@ -10,9 +10,7 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-// TODO(gdeepti): Enable tests to run in the interpreter.
 WASM_EXEC_TEST(I32SExtendI8) {
-  EXPERIMENTAL_FLAG_SCOPE(se);
   WasmRunner<int32_t, int32_t> r(execution_tier);
   BUILD(r, WASM_I32_SIGN_EXT_I8(WASM_GET_LOCAL(0)));
   CHECK_EQ(0, r.Call(0));
@@ -23,7 +21,6 @@ WASM_EXEC_TEST(I32SExtendI8) {
 }
 
 WASM_EXEC_TEST(I32SExtendI16) {
-  EXPERIMENTAL_FLAG_SCOPE(se);
   WasmRunner<int32_t, int32_t> r(execution_tier);
   BUILD(r, WASM_I32_SIGN_EXT_I16(WASM_GET_LOCAL(0)));
   CHECK_EQ(0, r.Call(0));
@@ -34,7 +31,6 @@ WASM_EXEC_TEST(I32SExtendI16) {
 }
 
 WASM_EXEC_TEST(I64SExtendI8) {
-  EXPERIMENTAL_FLAG_SCOPE(se);
   WasmRunner<int64_t, int64_t> r(execution_tier);
   BUILD(r, WASM_I64_SIGN_EXT_I8(WASM_GET_LOCAL(0)));
   CHECK_EQ(0, r.Call(0));
@@ -45,7 +41,6 @@ WASM_EXEC_TEST(I64SExtendI8) {
 }
 
 WASM_EXEC_TEST(I64SExtendI16) {
-  EXPERIMENTAL_FLAG_SCOPE(se);
   WasmRunner<int64_t, int64_t> r(execution_tier);
   BUILD(r, WASM_I64_SIGN_EXT_I16(WASM_GET_LOCAL(0)));
   CHECK_EQ(0, r.Call(0));
@@ -56,7 +51,6 @@ WASM_EXEC_TEST(I64SExtendI16) {
 }
 
 WASM_EXEC_TEST(I64SExtendI32) {
-  EXPERIMENTAL_FLAG_SCOPE(se);
   WasmRunner<int64_t, int64_t> r(execution_tier);
   BUILD(r, WASM_I64_SIGN_EXT_I32(WASM_GET_LOCAL(0)));
   CHECK_EQ(0, r.Call(0));
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-simd-liftoff.cc b/deps/v8/test/cctest/wasm/test-run-wasm-simd-liftoff.cc
new file mode 100644
index 00000000000000..33e5ee3ce85a08
--- /dev/null
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-simd-liftoff.cc
@@ -0,0 +1,96 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// This file contains tests that run only on Liftoff, and each test verifies
+// that the code was compiled by Liftoff. The default behavior is that each
+// function is first attempted to be compiled by Liftoff, and if it fails, fall
+// back to TurboFan. However we want to enforce that Liftoff is the tier that
+// compiles these functions, in order to verify correctness of SIMD
+// implementation in Liftoff.
+
+#include "test/cctest/cctest.h"
+#include "test/cctest/wasm/wasm-run-utils.h"
+#include "test/common/wasm/test-signatures.h"
+#include "test/common/wasm/wasm-macro-gen.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+namespace test_run_wasm_simd_liftoff {
+
+#define WASM_SIMD_LIFTOFF_TEST(name) \
+  void RunWasm_##name##_Impl();      \
+  TEST(RunWasm_##name##_liftoff) {   \
+    EXPERIMENTAL_FLAG_SCOPE(simd);   \
+    RunWasm_##name##_Impl();         \
+  }                                  \
+  void RunWasm_##name##_Impl()
+
+WASM_SIMD_LIFTOFF_TEST(S128Local) {
+  WasmRunner<int32_t> r(ExecutionTier::kLiftoff, kNoLowerSimd);
+  byte temp1 = r.AllocateLocal(kWasmS128);
+  BUILD(r, WASM_SET_LOCAL(temp1, WASM_GET_LOCAL(temp1)), WASM_ONE);
+  CHECK_EQ(1, r.Call());
+  r.CheckUsedExecutionTier(ExecutionTier::kLiftoff);
+}
+
+WASM_SIMD_LIFTOFF_TEST(S128Global) {
+  WasmRunner<int32_t> r(ExecutionTier::kLiftoff, kNoLowerSimd);
+
+  int32_t* g0 = r.builder().AddGlobal<int32_t>(kWasmS128);
+  int32_t* g1 = r.builder().AddGlobal<int32_t>(kWasmS128);
+  BUILD(r, WASM_SET_GLOBAL(1, WASM_GET_GLOBAL(0)), WASM_ONE);
+
+  int32_t expected = 0x1234;
+  for (int i = 0; i < 4; i++) {
+    WriteLittleEndianValue<int32_t>(&g0[i], expected);
+  }
+  r.Call();
+  r.CheckUsedExecutionTier(ExecutionTier::kLiftoff);
+  for (int i = 0; i < 4; i++) {
+    int32_t actual = ReadLittleEndianValue<int32_t>(&g1[i]);
+    CHECK_EQ(actual, expected);
+  }
+}
+
+WASM_SIMD_LIFTOFF_TEST(S128Param) {
+  // Test how SIMD parameters in functions are processed. There is no easy way
+  // to specify a SIMD value when initializing a WasmRunner, so we manually
+  // add a new function with the right signature, and call it from main.
+  WasmRunner<int32_t> r(ExecutionTier::kLiftoff, kNoLowerSimd);
+  TestSignatures sigs;
+  // We use a temp local to materialize a SIMD value, since at this point
+  // Liftoff does not support any SIMD operations.
+  byte temp1 = r.AllocateLocal(kWasmS128);
+  WasmFunctionCompiler& simd_func = r.NewFunction(sigs.i_s());
+  BUILD(simd_func, WASM_ONE);
+
+  BUILD(r,
+        WASM_CALL_FUNCTION(simd_func.function_index(), WASM_GET_LOCAL(temp1)));
+
+  CHECK_EQ(1, r.Call());
+  r.CheckUsedExecutionTier(ExecutionTier::kLiftoff);
+}
+
+WASM_SIMD_LIFTOFF_TEST(S128Return) {
+  // Test how functions returning SIMD values are processed.
+  WasmRunner<int32_t> r(ExecutionTier::kLiftoff, kNoLowerSimd);
+  TestSignatures sigs;
+  WasmFunctionCompiler& simd_func = r.NewFunction(sigs.s_i());
+  byte temp1 = simd_func.AllocateLocal(kWasmS128);
+  BUILD(simd_func, WASM_GET_LOCAL(temp1));
+
+  BUILD(r, WASM_CALL_FUNCTION(simd_func.function_index(), WASM_ONE), kExprDrop,
+        WASM_ONE);
+
+  CHECK_EQ(1, r.Call());
+  r.CheckUsedExecutionTier(ExecutionTier::kLiftoff);
+}
+
+#undef WASM_SIMD_LIFTOFF_TEST
+
+}  // namespace test_run_wasm_simd_liftoff
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc b/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
index d76c4c36438976..c8cc836b871b3c 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
@@ -58,6 +58,27 @@ using Int8ShiftOp = int8_t (*)(int8_t, int);
   }                                                                   \
   void RunWasm_##name##_Impl(LowerSimd lower_simd, ExecutionTier execution_tier)
 
+#define WASM_SIMD_TEST_WITH_LIFTOFF(name)                             \
+  void RunWasm_##name##_Impl(LowerSimd lower_simd,                    \
+                             ExecutionTier execution_tier);           \
+  TEST(RunWasm_##name##_turbofan) {                                   \
+    EXPERIMENTAL_FLAG_SCOPE(simd);                                    \
+    RunWasm_##name##_Impl(kNoLowerSimd, ExecutionTier::kTurbofan);    \
+  }                                                                   \
+  TEST(RunWasm_##name##_liftoff) {                                    \
+    EXPERIMENTAL_FLAG_SCOPE(simd);                                    \
+    RunWasm_##name##_Impl(kNoLowerSimd, ExecutionTier::kLiftoff);     \
+  }                                                                   \
+  TEST(RunWasm_##name##_interpreter) {                                \
+    EXPERIMENTAL_FLAG_SCOPE(simd);                                    \
+    RunWasm_##name##_Impl(kNoLowerSimd, ExecutionTier::kInterpreter); \
+  }                                                                   \
+  TEST(RunWasm_##name##_simd_lowered) {                               \
+    EXPERIMENTAL_FLAG_SCOPE(simd);                                    \
+    RunWasm_##name##_Impl(kLowerSimd, ExecutionTier::kTurbofan);      \
+  }                                                                   \
+  void RunWasm_##name##_Impl(LowerSimd lower_simd, ExecutionTier execution_tier)
+
 // Generic expected value functions.
 template <typename T, typename = typename std::enable_if<
                           std::is_floating_point<T>::value>::type>
@@ -227,13 +248,6 @@ T Narrow(int64_t value) {
   return Clamp<T>(value);
 }
 
-template <typename T>
-T UnsignedNarrow(int64_t value) {
-  static_assert(sizeof(int64_t) > sizeof(T), "T must be int32_t or smaller");
-  using UnsignedT = typename std::make_unsigned<T>::type;
-  return static_cast<T>(Clamp<UnsignedT>(value & 0xFFFFFFFFu));
-}
-
 template <typename T>
 T AddSaturate(T a, T b) {
   return Clamp<T>(Widen(a) + Widen(b));
@@ -286,7 +300,11 @@ T Sqrt(T a) {
   return std::sqrt(a);
 }
 
-#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_IA32
+template <typename T>
+T AndNot(T a, T b) {
+  return a & ~b;
+}
+
 // only used for F64x2 tests below
 int64_t Equal(double a, double b) { return a == b ? -1 : 0; }
 
@@ -384,7 +402,6 @@ bool ExpectFused(ExecutionTier tier) {
 #endif
 }
 #endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
-#endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_IA32
 
 }  // namespace
 
@@ -472,6 +489,11 @@ bool ExpectFused(ExecutionTier tier) {
 #define WASM_SIMD_F32x4_QFMA(a, b, c) a, b, c, WASM_SIMD_OP(kExprF32x4Qfma)
 #define WASM_SIMD_F32x4_QFMS(a, b, c) a, b, c, WASM_SIMD_OP(kExprF32x4Qfms)
 
+#define WASM_SIMD_LOAD_SPLAT(opcode, index) \
+  index, WASM_SIMD_OP(opcode), ZERO_ALIGNMENT, ZERO_OFFSET
+#define WASM_SIMD_LOAD_EXTEND(opcode, index) \
+  index, WASM_SIMD_OP(opcode), ZERO_ALIGNMENT, ZERO_OFFSET
+
 // Runs tests of compiled code, using the interpreter as a reference.
 #define WASM_SIMD_COMPILED_TEST(name)                              \
   void RunWasm_##name##_Impl(LowerSimd lower_simd,                 \
@@ -523,7 +545,27 @@ bool IsExtreme(float x) {
          (abs_x < kSmallFloatThreshold || abs_x > kLargeFloatThreshold);
 }
 
-WASM_SIMD_TEST(F32x4Splat) {
+WASM_SIMD_TEST(S128Globals) {
+  WasmRunner<int32_t> r(execution_tier, lower_simd);
+  // Set up a global to hold input and output vectors.
+  int32_t* g0 = r.builder().AddGlobal<int32_t>(kWasmS128);
+  int32_t* g1 = r.builder().AddGlobal<int32_t>(kWasmS128);
+  BUILD(r, WASM_SET_GLOBAL(1, WASM_GET_GLOBAL(0)), WASM_ONE);
+
+  FOR_INT32_INPUTS(x) {
+    for (int i = 0; i < 4; i++) {
+      WriteLittleEndianValue<int32_t>(&g0[i], x);
+    }
+    r.Call();
+    int32_t expected = x;
+    for (int i = 0; i < 4; i++) {
+      int32_t actual = ReadLittleEndianValue<int32_t>(&g1[i]);
+      CHECK_EQ(actual, expected);
+    }
+  }
+}
+
+WASM_SIMD_TEST_WITH_LIFTOFF(F32x4Splat) {
   WasmRunner<int32_t, float> r(execution_tier, lower_simd);
   // Set up a global to hold output vector.
   float* g = r.builder().AddGlobal<float>(kWasmS128);
@@ -891,8 +933,6 @@ WASM_SIMD_TEST_NO_LOWERING(F32x4Qfms) {
 }
 #endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
 
-#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_IA32
-#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
 WASM_SIMD_TEST_NO_LOWERING(I64x2Splat) {
   WasmRunner<int32_t, int64_t> r(execution_tier, lower_simd);
   // Set up a global to hold output vector.
@@ -1046,6 +1086,7 @@ WASM_SIMD_TEST_NO_LOWERING(I64x2Sub) {
                     base::SubWithWraparound);
 }
 
+#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
 WASM_SIMD_TEST_NO_LOWERING(I64x2Eq) {
   RunI64x2BinOpTest(execution_tier, lower_simd, kExprI64x2Eq, Equal);
 }
@@ -1111,18 +1152,6 @@ WASM_SIMD_TEST_NO_LOWERING(F64x2Splat) {
   }
 }
 
-#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
-WASM_SIMD_TEST_NO_LOWERING(F64x2ExtractLaneWithI64x2) {
-  WasmRunner<int64_t> r(execution_tier, lower_simd);
-  BUILD(r, WASM_IF_ELSE_L(
-               WASM_F64_EQ(WASM_SIMD_F64x2_EXTRACT_LANE(
-                               0, WASM_SIMD_I64x2_SPLAT(WASM_I64V(1e15))),
-                           WASM_F64_REINTERPRET_I64(WASM_I64V(1e15))),
-               WASM_I64V(1), WASM_I64V(0)));
-  CHECK_EQ(1, r.Call());
-}
-#endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
-
 WASM_SIMD_TEST_NO_LOWERING(F64x2ExtractLane) {
   WasmRunner<double, double> r(execution_tier, lower_simd);
   byte param1 = 0;
@@ -1145,36 +1174,50 @@ WASM_SIMD_TEST_NO_LOWERING(F64x2ExtractLane) {
   }
 }
 
-#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
-WASM_SIMD_TEST_NO_LOWERING(I64x2ExtractWithF64x2) {
-  WasmRunner<int64_t> r(execution_tier, lower_simd);
-  BUILD(r, WASM_IF_ELSE_L(
-               WASM_I64_EQ(WASM_SIMD_I64x2_EXTRACT_LANE(
-                               0, WASM_SIMD_F64x2_SPLAT(WASM_F64(1e15))),
-                           WASM_I64_REINTERPRET_F64(WASM_F64(1e15))),
-               WASM_I64V(1), WASM_I64V(0)));
-  CHECK_EQ(1, r.Call());
-}
-#endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
-
 WASM_SIMD_TEST_NO_LOWERING(F64x2ReplaceLane) {
   WasmRunner<int32_t> r(execution_tier, lower_simd);
-  // Set up a global to hold input/output vector.
-  double* g = r.builder().AddGlobal<double>(kWasmS128);
+  // Set up globals to hold input/output vector.
+  double* g0 = r.builder().AddGlobal<double>(kWasmS128);
+  double* g1 = r.builder().AddGlobal<double>(kWasmS128);
   // Build function to replace each lane with its (FP) index.
   byte temp1 = r.AllocateLocal(kWasmS128);
   BUILD(r, WASM_SET_LOCAL(temp1, WASM_SIMD_F64x2_SPLAT(WASM_F64(1e100))),
-        WASM_SET_LOCAL(temp1, WASM_SIMD_F64x2_REPLACE_LANE(
-                                  0, WASM_GET_LOCAL(temp1), WASM_F64(0.0f))),
+        // Replace lane 0.
         WASM_SET_GLOBAL(0, WASM_SIMD_F64x2_REPLACE_LANE(
+                               0, WASM_GET_LOCAL(temp1), WASM_F64(0.0f))),
+        // Replace lane 1.
+        WASM_SET_GLOBAL(1, WASM_SIMD_F64x2_REPLACE_LANE(
                                1, WASM_GET_LOCAL(temp1), WASM_F64(1.0f))),
         WASM_ONE);
 
   r.Call();
-  for (int i = 0; i < 2; i++) {
-    CHECK_EQ(static_cast<double>(i), ReadLittleEndianValue<double>(&g[i]));
-  }
+  CHECK_EQ(0., ReadLittleEndianValue<double>(&g0[0]));
+  CHECK_EQ(1e100, ReadLittleEndianValue<double>(&g0[1]));
+  CHECK_EQ(1e100, ReadLittleEndianValue<double>(&g1[0]));
+  CHECK_EQ(1., ReadLittleEndianValue<double>(&g1[1]));
+}
+
+#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
+WASM_SIMD_TEST_NO_LOWERING(F64x2ExtractLaneWithI64x2) {
+  WasmRunner<int64_t> r(execution_tier, lower_simd);
+  BUILD(r, WASM_IF_ELSE_L(
+               WASM_F64_EQ(WASM_SIMD_F64x2_EXTRACT_LANE(
+                               0, WASM_SIMD_I64x2_SPLAT(WASM_I64V(1e15))),
+                           WASM_F64_REINTERPRET_I64(WASM_I64V(1e15))),
+               WASM_I64V(1), WASM_I64V(0)));
+  CHECK_EQ(1, r.Call());
+}
+
+WASM_SIMD_TEST_NO_LOWERING(I64x2ExtractWithF64x2) {
+  WasmRunner<int64_t> r(execution_tier, lower_simd);
+  BUILD(r, WASM_IF_ELSE_L(
+               WASM_I64_EQ(WASM_SIMD_I64x2_EXTRACT_LANE(
+                               0, WASM_SIMD_F64x2_SPLAT(WASM_F64(1e15))),
+                           WASM_I64_REINTERPRET_F64(WASM_F64(1e15))),
+               WASM_I64V(1), WASM_I64V(0)));
+  CHECK_EQ(1, r.Call());
 }
+#endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
 
 bool IsExtreme(double x) {
   double abs_x = std::fabs(x);
@@ -1374,7 +1417,12 @@ void RunF64x2CompareOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
   byte value1 = 0, value2 = 1;
   byte temp1 = r.AllocateLocal(kWasmS128);
   byte temp2 = r.AllocateLocal(kWasmS128);
+  // Make the lanes of each temp compare differently:
+  // temp1 = y, x and temp2 = y, y.
   BUILD(r, WASM_SET_LOCAL(temp1, WASM_SIMD_F64x2_SPLAT(WASM_GET_LOCAL(value1))),
+        WASM_SET_LOCAL(temp1,
+                       WASM_SIMD_F64x2_REPLACE_LANE(1, WASM_GET_LOCAL(temp1),
+                                                    WASM_GET_LOCAL(value2))),
         WASM_SET_LOCAL(temp2, WASM_SIMD_F64x2_SPLAT(WASM_GET_LOCAL(value2))),
         WASM_SET_GLOBAL(0, WASM_SIMD_BINOP(opcode, WASM_GET_LOCAL(temp1),
                                            WASM_GET_LOCAL(temp2))),
@@ -1387,10 +1435,10 @@ void RunF64x2CompareOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
       double diff = x - y;  // Model comparison as subtraction.
       if (!PlatformCanRepresent(diff)) continue;
       r.Call(x, y);
-      int64_t expected = expected_op(x, y);
-      for (int i = 0; i < 2; i++) {
-        CHECK_EQ(expected, ReadLittleEndianValue<int64_t>(&g[i]));
-      }
+      int64_t expected0 = expected_op(x, y);
+      int64_t expected1 = expected_op(y, y);
+      CHECK_EQ(expected0, ReadLittleEndianValue<int64_t>(&g[0]));
+      CHECK_EQ(expected1, ReadLittleEndianValue<int64_t>(&g[1]));
     }
   }
 }
@@ -1427,12 +1475,10 @@ WASM_SIMD_TEST_NO_LOWERING(F64x2Max) {
   RunF64x2BinOpTest(execution_tier, lower_simd, kExprF64x2Max, JSMax);
 }
 
-#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
 WASM_SIMD_TEST_NO_LOWERING(I64x2Mul) {
   RunI64x2BinOpTest(execution_tier, lower_simd, kExprI64x2Mul,
                     base::MulWithWraparound);
 }
-#endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
 
 #if V8_TARGET_ARCH_X64
 WASM_SIMD_TEST_NO_LOWERING(I64x2MinS) {
@@ -1503,7 +1549,6 @@ WASM_SIMD_TEST_NO_LOWERING(F64x2Qfms) {
   }
 }
 #endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
-#endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_IA32
 
 WASM_SIMD_TEST(I32x4Splat) {
   WasmRunner<int32_t, int32_t> r(execution_tier, lower_simd);
@@ -1562,6 +1607,16 @@ WASM_SIMD_TEST(I16x8Splat) {
       CHECK_EQ(actual, expected);
     }
   }
+
+  // Test values that do not fit in a int16.
+  FOR_INT32_INPUTS(x) {
+    r.Call(x);
+    int16_t expected = truncate_to_int16(x);
+    for (int i = 0; i < 8; i++) {
+      int16_t actual = ReadLittleEndianValue<int16_t>(&g[i]);
+      CHECK_EQ(actual, expected);
+    }
+  }
 }
 
 WASM_SIMD_TEST(I16x8ReplaceLane) {
@@ -1611,6 +1666,16 @@ WASM_SIMD_TEST(I8x16Splat) {
       CHECK_EQ(actual, expected);
     }
   }
+
+  // Test values that do not fit in a int16.
+  FOR_INT16_INPUTS(x) {
+    r.Call(x);
+    int8_t expected = truncate_to_int8(x);
+    for (int i = 0; i < 16; i++) {
+      int8_t actual = ReadLittleEndianValue<int8_t>(&g[i]);
+      CHECK_EQ(actual, expected);
+    }
+  }
 }
 
 WASM_SIMD_TEST(I8x16ReplaceLane) {
@@ -1838,6 +1903,11 @@ WASM_SIMD_TEST(S128Xor) {
   RunI32x4BinOpTest(execution_tier, lower_simd, kExprS128Xor, Xor);
 }
 
+// Bitwise operation, doesn't really matter what simd type we test it with.
+WASM_SIMD_TEST(S128AndNot) {
+  RunI32x4BinOpTest(execution_tier, lower_simd, kExprS128AndNot, AndNot);
+}
+
 WASM_SIMD_TEST(I32x4Eq) {
   RunI32x4BinOpTest(execution_tier, lower_simd, kExprI32x4Eq, Equal);
 }
@@ -1976,7 +2046,7 @@ WASM_SIMD_TEST(I16x8ConvertI32x4) {
   FOR_INT32_INPUTS(x) {
     r.Call(x);
     int16_t expected_signed = Narrow<int16_t>(x);
-    int16_t expected_unsigned = UnsignedNarrow<int16_t>(x);
+    int16_t expected_unsigned = Narrow<uint16_t>(x);
     for (int i = 0; i < 8; i++) {
       CHECK_EQ(expected_signed, ReadLittleEndianValue<int16_t>(&g0[i]));
       CHECK_EQ(expected_unsigned, ReadLittleEndianValue<int16_t>(&g1[i]));
@@ -2010,11 +2080,12 @@ WASM_SIMD_TEST(I16x8Neg) {
                    base::NegateWithWraparound);
 }
 
+template <typename T = int16_t, typename OpType = T (*)(T, T)>
 void RunI16x8BinOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
-                       WasmOpcode opcode, Int16BinOp expected_op) {
-  WasmRunner<int32_t, int32_t, int32_t> r(execution_tier, lower_simd);
+                       WasmOpcode opcode, OpType expected_op) {
+  WasmRunner<int32_t, T, T> r(execution_tier, lower_simd);
   // Global to hold output.
-  int16_t* g = r.builder().AddGlobal<int16_t>(kWasmS128);
+  T* g = r.builder().template AddGlobal<T>(kWasmS128);
   // Build fn to splat test values, perform binop, and write the result.
   byte value1 = 0, value2 = 1;
   byte temp1 = r.AllocateLocal(kWasmS128);
@@ -2025,12 +2096,12 @@ void RunI16x8BinOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
                                            WASM_GET_LOCAL(temp2))),
         WASM_ONE);
 
-  FOR_INT16_INPUTS(x) {
-    FOR_INT16_INPUTS(y) {
+  for (T x : compiler::ValueHelper::GetVector<T>()) {
+    for (T y : compiler::ValueHelper::GetVector<T>()) {
       r.Call(x, y);
-      int16_t expected = expected_op(x, y);
+      T expected = expected_op(x, y);
       for (int i = 0; i < 8; i++) {
-        CHECK_EQ(expected, ReadLittleEndianValue<int16_t>(&g[i]));
+        CHECK_EQ(expected, ReadLittleEndianValue<T>(&g[i]));
       }
     }
   }
@@ -2131,6 +2202,12 @@ WASM_SIMD_TEST(I16x8LeU) {
                     UnsignedLessEqual);
 }
 
+WASM_SIMD_TEST_NO_LOWERING(I16x8RoundingAverageU) {
+  RunI16x8BinOpTest<uint16_t>(execution_tier, lower_simd,
+                              kExprI16x8RoundingAverageU,
+                              base::RoundingAverageUnsigned);
+}
+
 void RunI16x8ShiftOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
                          WasmOpcode opcode, Int16ShiftOp expected_op) {
   // Intentionally shift by 16, should be no-op.
@@ -2219,7 +2296,7 @@ WASM_SIMD_TEST(I8x16ConvertI16x8) {
   FOR_INT16_INPUTS(x) {
     r.Call(x);
     int8_t expected_signed = Narrow<int8_t>(x);
-    int8_t expected_unsigned = UnsignedNarrow<int8_t>(x);
+    int8_t expected_unsigned = Narrow<uint8_t>(x);
     for (int i = 0; i < 16; i++) {
       CHECK_EQ(expected_signed, ReadLittleEndianValue<int8_t>(&g0[i]));
       CHECK_EQ(expected_unsigned, ReadLittleEndianValue<int8_t>(&g1[i]));
@@ -2227,11 +2304,12 @@ WASM_SIMD_TEST(I8x16ConvertI16x8) {
   }
 }
 
+template <typename T = int8_t, typename OpType = T (*)(T, T)>
 void RunI8x16BinOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
-                       WasmOpcode opcode, Int8BinOp expected_op) {
-  WasmRunner<int32_t, int32_t, int32_t> r(execution_tier, lower_simd);
+                       WasmOpcode opcode, OpType expected_op) {
+  WasmRunner<int32_t, T, T> r(execution_tier, lower_simd);
   // Global to hold output.
-  int8_t* g = r.builder().AddGlobal<int8_t>(kWasmS128);
+  T* g = r.builder().template AddGlobal<T>(kWasmS128);
   // Build fn to splat test values, perform binop, and write the result.
   byte value1 = 0, value2 = 1;
   byte temp1 = r.AllocateLocal(kWasmS128);
@@ -2242,12 +2320,12 @@ void RunI8x16BinOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
                                            WASM_GET_LOCAL(temp2))),
         WASM_ONE);
 
-  FOR_INT8_INPUTS(x) {
-    FOR_INT8_INPUTS(y) {
+  for (T x : compiler::ValueHelper::GetVector<T>()) {
+    for (T y : compiler::ValueHelper::GetVector<T>()) {
       r.Call(x, y);
-      int8_t expected = expected_op(x, y);
+      T expected = expected_op(x, y);
       for (int i = 0; i < 16; i++) {
-        CHECK_EQ(expected, ReadLittleEndianValue<int8_t>(&g[i]));
+        CHECK_EQ(expected, ReadLittleEndianValue<T>(&g[i]));
       }
     }
   }
@@ -2348,6 +2426,12 @@ WASM_SIMD_TEST(I8x16Mul) {
                     base::MulWithWraparound);
 }
 
+WASM_SIMD_TEST_NO_LOWERING(I8x16RoundingAverageU) {
+  RunI8x16BinOpTest<uint8_t>(execution_tier, lower_simd,
+                             kExprI8x16RoundingAverageU,
+                             base::RoundingAverageUnsigned);
+}
+
 void RunI8x16ShiftOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
                          WasmOpcode opcode, Int8ShiftOp expected_op) {
   // Intentionally shift by 8, should be no-op.
@@ -2687,7 +2771,6 @@ WASM_SIMD_TEST(S8x16Concat) {
   }
 }
 
-#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_ARM64
 struct SwizzleTestArgs {
   const Shuffle input;
   const Shuffle indices;
@@ -2741,7 +2824,6 @@ WASM_SIMD_TEST(S8x16Swizzle) {
     }
   }
 }
-#endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_ARM64
 
 // Combine 3 shuffles a, b, and c by applying both a and b and then applying c
 // to those two results.
@@ -3217,6 +3299,96 @@ WASM_SIMD_TEST(SimdLoadStoreLoadMemargOffset) {
   }
 }
 
+template <typename T>
+void RunLoadSplatTest(ExecutionTier execution_tier, LowerSimd lower_simd,
+                      WasmOpcode op) {
+  constexpr int lanes = 16 / sizeof(T);
+  constexpr int mem_index = 16;  // Load from mem index 16 (bytes).
+  WasmRunner<int32_t> r(execution_tier, lower_simd);
+  T* memory = r.builder().AddMemoryElems<T>(kWasmPageSize / sizeof(T));
+  T* global = r.builder().AddGlobal<T>(kWasmS128);
+  BUILD(r, WASM_SET_GLOBAL(0, WASM_SIMD_LOAD_SPLAT(op, WASM_I32V(mem_index))),
+        WASM_ONE);
+
+  for (T x : compiler::ValueHelper::GetVector<T>()) {
+    // 16-th byte in memory is lanes-th element (size T) of memory.
+    r.builder().WriteMemory(&memory[lanes], x);
+    r.Call();
+    for (int i = 0; i < lanes; i++) {
+      CHECK_EQ(x, ReadLittleEndianValue<T>(&global[i]));
+    }
+  }
+}
+
+WASM_SIMD_TEST_NO_LOWERING(S8x16LoadSplat) {
+  RunLoadSplatTest<int8_t>(execution_tier, lower_simd, kExprS8x16LoadSplat);
+}
+
+WASM_SIMD_TEST_NO_LOWERING(S16x8LoadSplat) {
+  RunLoadSplatTest<int16_t>(execution_tier, lower_simd, kExprS16x8LoadSplat);
+}
+
+WASM_SIMD_TEST_NO_LOWERING(S32x4LoadSplat) {
+  RunLoadSplatTest<int32_t>(execution_tier, lower_simd, kExprS32x4LoadSplat);
+}
+
+WASM_SIMD_TEST_NO_LOWERING(S64x2LoadSplat) {
+  RunLoadSplatTest<int64_t>(execution_tier, lower_simd, kExprS64x2LoadSplat);
+}
+
+template <typename S, typename T>
+void RunLoadExtendTest(ExecutionTier execution_tier, LowerSimd lower_simd,
+                       WasmOpcode op) {
+  constexpr int lanes_s = 16 / sizeof(S);
+  constexpr int lanes_t = 16 / sizeof(T);
+  constexpr int mem_index = 16;  // Load from mem index 16 (bytes).
+  WasmRunner<int32_t> r(execution_tier, lower_simd);
+  S* memory = r.builder().AddMemoryElems<S>(kWasmPageSize / sizeof(S));
+  T* global = r.builder().AddGlobal<T>(kWasmS128);
+  BUILD(r, WASM_SET_GLOBAL(0, WASM_SIMD_LOAD_EXTEND(op, WASM_I32V(mem_index))),
+        WASM_ONE);
+
+  for (S x : compiler::ValueHelper::GetVector<S>()) {
+    for (int i = 0; i < lanes_s; i++) {
+      // 16-th byte in memory is lanes-th element (size T) of memory.
+      r.builder().WriteMemory(&memory[lanes_s + i], x);
+    }
+    r.Call();
+    for (int i = 0; i < lanes_t; i++) {
+      CHECK_EQ(static_cast<T>(x), ReadLittleEndianValue<T>(&global[i]));
+    }
+  }
+}
+
+WASM_SIMD_TEST_NO_LOWERING(I16x8Load8x8U) {
+  RunLoadExtendTest<uint8_t, uint16_t>(execution_tier, lower_simd,
+                                       kExprI16x8Load8x8U);
+}
+
+WASM_SIMD_TEST_NO_LOWERING(I16x8Load8x8S) {
+  RunLoadExtendTest<int8_t, int16_t>(execution_tier, lower_simd,
+                                     kExprI16x8Load8x8S);
+}
+WASM_SIMD_TEST_NO_LOWERING(I32x4Load16x4U) {
+  RunLoadExtendTest<uint16_t, uint32_t>(execution_tier, lower_simd,
+                                        kExprI32x4Load16x4U);
+}
+
+WASM_SIMD_TEST_NO_LOWERING(I32x4Load16x4S) {
+  RunLoadExtendTest<int16_t, int32_t>(execution_tier, lower_simd,
+                                      kExprI32x4Load16x4S);
+}
+
+WASM_SIMD_TEST_NO_LOWERING(I64x2Load32x2U) {
+  RunLoadExtendTest<uint32_t, uint64_t>(execution_tier, lower_simd,
+                                        kExprI64x2Load32x2U);
+}
+
+WASM_SIMD_TEST_NO_LOWERING(I64x2Load32x2S) {
+  RunLoadExtendTest<int32_t, int64_t>(execution_tier, lower_simd,
+                                      kExprI64x2Load32x2S);
+}
+
 #if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_ARM64 || \
     V8_TARGET_ARCH_ARM
 #define WASM_SIMD_ANYTRUE_TEST(format, lanes, max, param_type)                \
@@ -3392,6 +3564,7 @@ WASM_EXTRACT_I16x8_TEST(S, UINT16) WASM_EXTRACT_I16x8_TEST(I, INT16)
 #undef WASM_EXTRACT_I8x16_TEST
 
 #undef WASM_SIMD_TEST
+#undef WASM_SIMD_TEST_WITH_LIFTOFF
 #undef WASM_SIMD_CHECK_LANE_S
 #undef WASM_SIMD_CHECK_LANE_U
 #undef TO_BYTE
@@ -3438,6 +3611,8 @@ WASM_EXTRACT_I16x8_TEST(S, UINT16) WASM_EXTRACT_I16x8_TEST(I, INT16)
 #undef WASM_SIMD_F64x2_QFMS
 #undef WASM_SIMD_F32x4_QFMA
 #undef WASM_SIMD_F32x4_QFMS
+#undef WASM_SIMD_LOAD_SPLAT
+#undef WASM_SIMD_LOAD_EXTEND
 
 }  // namespace test_run_wasm_simd
 }  // namespace wasm
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm.cc b/deps/v8/test/cctest/wasm/test-run-wasm.cc
index aa6195b8b3db68..b84322f190bc36 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm.cc
@@ -2508,13 +2508,12 @@ WASM_EXEC_TEST(ReturnCall_IndirectFactorial) {
                                   WASM_I32V(1), WASM_I32V(f_ind_index)));
 
   BUILD(f_ind_fn,
-        WASM_IF_ELSE_I(WASM_I32_LES(WASM_GET_LOCAL(0), WASM_I32V(1)),
-                       WASM_GET_LOCAL(1),
-                       WASM_RETURN_CALL_INDIRECT(
-                           sig_index, WASM_GET_LOCAL(2),
-                           WASM_I32_SUB(WASM_GET_LOCAL(0), WASM_I32V(1)),
-                           WASM_I32_MUL(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)),
-                           WASM_GET_LOCAL(2))));
+        WASM_IF_ELSE_I(
+            WASM_I32_LES(WASM_GET_LOCAL(0), WASM_I32V(1)), WASM_GET_LOCAL(1),
+            WASM_RETURN_CALL_INDIRECT(
+                sig_index, WASM_I32_SUB(WASM_GET_LOCAL(0), WASM_I32V(1)),
+                WASM_I32_MUL(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)),
+                WASM_GET_LOCAL(2), WASM_GET_LOCAL(2))));
 
   uint32_t test_values[] = {1, 2, 5, 10, 10000};
 
@@ -2944,8 +2943,8 @@ WASM_EXEC_TEST(SimpleCallIndirect) {
                                        arraysize(indirect_function_table));
 
   // Build the caller function.
-  BUILD(r, WASM_CALL_INDIRECT2(1, WASM_GET_LOCAL(0), WASM_I32V_2(66),
-                               WASM_I32V_1(22)));
+  BUILD(r, WASM_CALL_INDIRECT(1, WASM_I32V_2(66), WASM_I32V_1(22),
+                              WASM_GET_LOCAL(0)));
 
   CHECK_EQ(88, r.Call(0));
   CHECK_EQ(44, r.Call(1));
@@ -2977,11 +2976,11 @@ WASM_EXEC_TEST(MultipleCallIndirect) {
                                        arraysize(indirect_function_table));
 
   // Build the caller function.
-  BUILD(r, WASM_I32_ADD(
-               WASM_CALL_INDIRECT2(1, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
-                                   WASM_GET_LOCAL(2)),
-               WASM_CALL_INDIRECT2(1, WASM_GET_LOCAL(1), WASM_GET_LOCAL(2),
-                                   WASM_GET_LOCAL(0))));
+  BUILD(r,
+        WASM_I32_ADD(WASM_CALL_INDIRECT(1, WASM_GET_LOCAL(1), WASM_GET_LOCAL(2),
+                                        WASM_GET_LOCAL(0)),
+                     WASM_CALL_INDIRECT(1, WASM_GET_LOCAL(2), WASM_GET_LOCAL(0),
+                                        WASM_GET_LOCAL(1))));
 
   CHECK_EQ(5, r.Call(0, 1, 2));
   CHECK_EQ(19, r.Call(0, 1, 9));
@@ -3009,8 +3008,8 @@ WASM_EXEC_TEST(CallIndirect_EmptyTable) {
   r.builder().AddIndirectFunctionTable(nullptr, 0);
 
   // Build the caller function.
-  BUILD(r, WASM_CALL_INDIRECT2(1, WASM_GET_LOCAL(0), WASM_I32V_2(66),
-                               WASM_I32V_1(22)));
+  BUILD(r, WASM_CALL_INDIRECT(1, WASM_I32V_2(66), WASM_I32V_1(22),
+                              WASM_GET_LOCAL(0)));
 
   CHECK_TRAP(r.Call(0));
   CHECK_TRAP(r.Call(1));
@@ -3048,8 +3047,8 @@ WASM_EXEC_TEST(CallIndirect_canonical) {
                                        arraysize(indirect_function_table));
 
   // Build the caller function.
-  BUILD(r, WASM_CALL_INDIRECT2(1, WASM_GET_LOCAL(0), WASM_I32V_2(77),
-                               WASM_I32V_1(11)));
+  BUILD(r, WASM_CALL_INDIRECT(1, WASM_I32V_2(77), WASM_I32V_1(11),
+                              WASM_GET_LOCAL(0)));
 
   CHECK_EQ(88, r.Call(0));
   CHECK_EQ(66, r.Call(1));
@@ -3196,7 +3195,6 @@ WASM_EXEC_TEST(I32SConvertF32) {
 }
 
 WASM_EXEC_TEST(I32SConvertSatF32) {
-  EXPERIMENTAL_FLAG_SCOPE(sat_f2i_conversions);
   WasmRunner<int32_t, float> r(execution_tier);
   BUILD(r, WASM_I32_SCONVERT_SAT_F32(WASM_GET_LOCAL(0)));
 
@@ -3226,7 +3224,6 @@ WASM_EXEC_TEST(I32SConvertF64) {
 }
 
 WASM_EXEC_TEST(I32SConvertSatF64) {
-  EXPERIMENTAL_FLAG_SCOPE(sat_f2i_conversions);
   WasmRunner<int32_t, double> r(execution_tier);
   BUILD(r, WASM_I32_SCONVERT_SAT_F64(WASM_GET_LOCAL(0)));
   FOR_FLOAT64_INPUTS(i) {
@@ -3254,7 +3251,6 @@ WASM_EXEC_TEST(I32UConvertF32) {
 }
 
 WASM_EXEC_TEST(I32UConvertSatF32) {
-  EXPERIMENTAL_FLAG_SCOPE(sat_f2i_conversions);
   WasmRunner<uint32_t, float> r(execution_tier);
   BUILD(r, WASM_I32_UCONVERT_SAT_F32(WASM_GET_LOCAL(0)));
   FOR_FLOAT32_INPUTS(i) {
@@ -3282,7 +3278,6 @@ WASM_EXEC_TEST(I32UConvertF64) {
 }
 
 WASM_EXEC_TEST(I32UConvertSatF64) {
-  EXPERIMENTAL_FLAG_SCOPE(sat_f2i_conversions);
   WasmRunner<uint32_t, double> r(execution_tier);
   BUILD(r, WASM_I32_UCONVERT_SAT_F64(WASM_GET_LOCAL(0)));
   FOR_FLOAT64_INPUTS(i) {
diff --git a/deps/v8/test/cctest/wasm/test-streaming-compilation.cc b/deps/v8/test/cctest/wasm/test-streaming-compilation.cc
index f9089b7821c542..08c0c1dd466b0c 100644
--- a/deps/v8/test/cctest/wasm/test-streaming-compilation.cc
+++ b/deps/v8/test/cctest/wasm/test-streaming-compilation.cc
@@ -38,10 +38,6 @@ class MockPlatform final : public TestPlatform {
     return task_runner_;
   }
 
-  void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override {
-    task_runner_->PostTask(std::unique_ptr<Task>(task));
-  }
-
   void CallOnWorkerThread(std::unique_ptr<v8::Task> task) override {
     task_runner_->PostTask(std::move(task));
   }
@@ -131,7 +127,7 @@ class StreamTester {
     v8::Local<v8::Context> context = isolate->GetCurrentContext();
 
     stream_ = i_isolate->wasm_engine()->StartStreamingCompilation(
-        i_isolate, kAllWasmFeatures, v8::Utils::OpenHandle(*context),
+        i_isolate, WasmFeatures::All(), v8::Utils::OpenHandle(*context),
         "WebAssembly.compileStreaming()",
         std::make_shared<TestResolver>(&state_, &error_message_,
                                        &native_module_));
@@ -263,9 +259,10 @@ STREAM_TEST(TestAllBytesArriveAOTCompilerFinishesFirst) {
 
 size_t GetFunctionOffset(i::Isolate* isolate, const uint8_t* buffer,
                          size_t size, size_t index) {
-  ModuleResult result = DecodeWasmModule(
-      kAllWasmFeatures, buffer, buffer + size, false, ModuleOrigin::kWasmOrigin,
-      isolate->counters(), isolate->wasm_engine()->allocator());
+  ModuleResult result =
+      DecodeWasmModule(WasmFeatures::All(), buffer, buffer + size, false,
+                       ModuleOrigin::kWasmOrigin, isolate->counters(),
+                       isolate->wasm_engine()->allocator());
   CHECK(result.ok());
   const WasmFunction* func = &result.value()->functions[index];
   return func->code.offset();
diff --git a/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc b/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc
index 798e1d46dac07e..79c4c8eaecb4ae 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc
@@ -21,12 +21,29 @@ namespace wasm {
 
 namespace {
 
+debug::Location TranslateLocation(WasmRunnerBase* runner,
+                                  const debug::Location& loc) {
+  // Convert locations from {func_index, offset_in_func} to
+  // {0, offset_in_module}.
+  int func_index = loc.GetLineNumber();
+  int func_offset = runner->builder().GetFunctionAt(func_index)->code.offset();
+  int offset = loc.GetColumnNumber() + func_offset;
+  return {0, offset};
+}
+
 void CheckLocations(
-    NativeModule* native_module, debug::Location start, debug::Location end,
+    WasmRunnerBase* runner, NativeModule* native_module, debug::Location start,
+    debug::Location end,
     std::initializer_list<debug::Location> expected_locations_init) {
   std::vector<debug::BreakLocation> locations;
-  bool success = WasmModuleObject::GetPossibleBreakpoints(native_module, start,
-                                                          end, &locations);
+  std::vector<debug::Location> expected_locations;
+  for (auto loc : expected_locations_init) {
+    expected_locations.push_back(TranslateLocation(runner, loc));
+  }
+
+  bool success = WasmScript::GetPossibleBreakpoints(
+      native_module, TranslateLocation(runner, start),
+      TranslateLocation(runner, end), &locations);
   CHECK(success);
 
   printf("got %d locations: ", static_cast<int>(locations.size()));
@@ -36,7 +53,6 @@ void CheckLocations(
   }
   printf("\n");
 
-  std::vector<debug::Location> expected_locations(expected_locations_init);
   CHECK_EQ(expected_locations.size(), locations.size());
   for (size_t i = 0, e = locations.size(); i != e; ++i) {
     CHECK_EQ(expected_locations[i].GetLineNumber(),
@@ -46,11 +62,12 @@ void CheckLocations(
   }
 }
 
-void CheckLocationsFail(NativeModule* native_module, debug::Location start,
-                        debug::Location end) {
+void CheckLocationsFail(WasmRunnerBase* runner, NativeModule* native_module,
+                        debug::Location start, debug::Location end) {
   std::vector<debug::BreakLocation> locations;
-  bool success = WasmModuleObject::GetPossibleBreakpoints(native_module, start,
-                                                          end, &locations);
+  bool success = WasmScript::GetPossibleBreakpoints(
+      native_module, TranslateLocation(runner, start),
+      TranslateLocation(runner, end), &locations);
   CHECK(!success);
 }
 
@@ -133,7 +150,7 @@ Handle<BreakPoint> SetBreakpoint(WasmRunnerBase* runner, int function_index,
   Handle<BreakPoint> break_point =
       runner->main_isolate()->factory()->NewBreakPoint(
           break_index++, runner->main_isolate()->factory()->empty_string());
-  CHECK(WasmModuleObject::SetBreakPoint(script, &code_offset, break_point));
+  CHECK(WasmScript::SetBreakPoint(script, &code_offset, break_point));
   int set_byte_offset = code_offset - func_offset;
   CHECK_EQ(expected_set_byte_offset, set_byte_offset);
   // Also set breakpoint on the debug info of the instance directly, since the
@@ -153,7 +170,7 @@ void ClearBreakpoint(WasmRunnerBase* runner, int function_index,
   Handle<WasmInstanceObject> instance = runner->builder().instance_object();
   Handle<Script> script(instance->module_object().script(),
                         runner->main_isolate());
-  CHECK(WasmModuleObject::ClearBreakPoint(script, code_offset, break_point));
+  CHECK(WasmScript::ClearBreakPoint(script, code_offset, break_point));
   // Also clear breakpoint on the debug info of the instance directly, since the
   // instance chain is not setup properly in tests.
   Handle<WasmDebugInfo> debug_info =
@@ -263,6 +280,13 @@ std::vector<WasmValue> wasmVec(Args... args) {
   return std::vector<WasmValue>{arr.begin(), arr.end()};
 }
 
+int GetIntReturnValue(MaybeHandle<Object> retval) {
+  CHECK(!retval.is_null());
+  int result;
+  CHECK(retval.ToHandleChecked()->ToInt32(&result));
+  return result;
+}
+
 }  // namespace
 
 WASM_COMPILED_EXEC_TEST(WasmCollectPossibleBreakpoints) {
@@ -275,21 +299,21 @@ WASM_COMPILED_EXEC_TEST(WasmCollectPossibleBreakpoints) {
 
   std::vector<debug::Location> locations;
   // Check all locations for function 0.
-  CheckLocations(native_module, {0, 0}, {1, 0},
+  CheckLocations(&runner, native_module, {0, 0}, {0, 10},
                  {{0, 1}, {0, 2}, {0, 4}, {0, 6}, {0, 7}});
   // Check a range ending at an instruction.
-  CheckLocations(native_module, {0, 2}, {0, 4}, {{0, 2}});
+  CheckLocations(&runner, native_module, {0, 2}, {0, 4}, {{0, 2}});
   // Check a range ending one behind an instruction.
-  CheckLocations(native_module, {0, 2}, {0, 5}, {{0, 2}, {0, 4}});
+  CheckLocations(&runner, native_module, {0, 2}, {0, 5}, {{0, 2}, {0, 4}});
   // Check a range starting at an instruction.
-  CheckLocations(native_module, {0, 7}, {0, 8}, {{0, 7}});
+  CheckLocations(&runner, native_module, {0, 7}, {0, 8}, {{0, 7}});
   // Check from an instruction to beginning of next function.
-  CheckLocations(native_module, {0, 7}, {1, 0}, {{0, 7}});
+  CheckLocations(&runner, native_module, {0, 7}, {0, 10}, {{0, 7}});
   // Check from end of one function (no valid instruction position) to beginning
   // of next function. Must be empty, but not fail.
-  CheckLocations(native_module, {0, 8}, {1, 0}, {});
+  CheckLocations(&runner, native_module, {0, 8}, {0, 10}, {});
   // Check from one after the end of the function. Must fail.
-  CheckLocationsFail(native_module, {0, 9}, {1, 0});
+  CheckLocationsFail(&runner, native_module, {0, 9}, {0, 10});
 }
 
 WASM_COMPILED_EXEC_TEST(WasmSimpleBreak) {
@@ -307,10 +331,25 @@ WASM_COMPILED_EXEC_TEST(WasmSimpleBreak) {
   Handle<Object> global(isolate->context().global_object(), isolate);
   MaybeHandle<Object> retval =
       Execution::Call(isolate, main_fun_wrapper, global, 0, nullptr);
-  CHECK(!retval.is_null());
-  int result;
-  CHECK(retval.ToHandleChecked()->ToInt32(&result));
-  CHECK_EQ(14, result);
+  CHECK_EQ(14, GetIntReturnValue(retval));
+}
+
+WASM_COMPILED_EXEC_TEST(WasmNonBreakablePosition) {
+  WasmRunner<int> runner(execution_tier);
+  Isolate* isolate = runner.main_isolate();
+
+  BUILD(runner, WASM_RETURN1(WASM_I32V_2(1024)));
+
+  Handle<JSFunction> main_fun_wrapper =
+      runner.builder().WrapCode(runner.function_index());
+  SetBreakpoint(&runner, runner.function_index(), 2, 4);
+
+  BreakHandler count_breaks(isolate, {{4, BreakHandler::Continue}});
+
+  Handle<Object> global(isolate->context().global_object(), isolate);
+  MaybeHandle<Object> retval =
+      Execution::Call(isolate, main_fun_wrapper, global, 0, nullptr);
+  CHECK_EQ(1024, GetIntReturnValue(retval));
 }
 
 WASM_COMPILED_EXEC_TEST(WasmSimpleStepping) {
@@ -334,10 +373,7 @@ WASM_COMPILED_EXEC_TEST(WasmSimpleStepping) {
   Handle<Object> global(isolate->context().global_object(), isolate);
   MaybeHandle<Object> retval =
       Execution::Call(isolate, main_fun_wrapper, global, 0, nullptr);
-  CHECK(!retval.is_null());
-  int result;
-  CHECK(retval.ToHandleChecked()->ToInt32(&result));
-  CHECK_EQ(14, result);
+  CHECK_EQ(14, GetIntReturnValue(retval));
 }
 
 WASM_COMPILED_EXEC_TEST(WasmStepInAndOut) {
@@ -453,10 +489,7 @@ WASM_COMPILED_EXEC_TEST(WasmRemoveBreakPoint) {
   Handle<Object> global(isolate->context().global_object(), isolate);
   MaybeHandle<Object> retval =
       Execution::Call(isolate, main_fun_wrapper, global, 0, nullptr);
-  CHECK(!retval.is_null());
-  int result;
-  CHECK(retval.ToHandleChecked()->ToInt32(&result));
-  CHECK_EQ(14, result);
+  CHECK_EQ(14, GetIntReturnValue(retval));
 }
 
 WASM_COMPILED_EXEC_TEST(WasmRemoveLastBreakPoint) {
@@ -484,10 +517,7 @@ WASM_COMPILED_EXEC_TEST(WasmRemoveLastBreakPoint) {
   Handle<Object> global(isolate->context().global_object(), isolate);
   MaybeHandle<Object> retval =
       Execution::Call(isolate, main_fun_wrapper, global, 0, nullptr);
-  CHECK(!retval.is_null());
-  int result;
-  CHECK(retval.ToHandleChecked()->ToInt32(&result));
-  CHECK_EQ(14, result);
+  CHECK_EQ(14, GetIntReturnValue(retval));
 }
 
 WASM_COMPILED_EXEC_TEST(WasmRemoveAllBreakPoint) {
@@ -517,10 +547,7 @@ WASM_COMPILED_EXEC_TEST(WasmRemoveAllBreakPoint) {
   Handle<Object> global(isolate->context().global_object(), isolate);
   MaybeHandle<Object> retval =
       Execution::Call(isolate, main_fun_wrapper, global, 0, nullptr);
-  CHECK(!retval.is_null());
-  int result;
-  CHECK(retval.ToHandleChecked()->ToInt32(&result));
-  CHECK_EQ(14, result);
+  CHECK_EQ(14, GetIntReturnValue(retval));
 }
 
 }  // namespace wasm
diff --git a/deps/v8/test/cctest/wasm/test-wasm-codegen.cc b/deps/v8/test/cctest/wasm/test-wasm-codegen.cc
index d362cc5cf27cd3..a1ee553dbc9fac 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-codegen.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-codegen.cc
@@ -8,6 +8,7 @@
 // change the isolate in terms of callbacks allow_code_gen_callback and
 // allow_wasm_code_gen_callback.
 
+#include "src/api/api-inl.h"
 #include "src/wasm/wasm-module-builder.h"
 #include "src/wasm/wasm-objects-inl.h"
 #include "src/wasm/wasm-objects.h"
@@ -59,13 +60,37 @@ void BuildTrivialModule(Zone* zone, ZoneBuffer* buffer) {
 
 bool TestModule(Isolate* isolate, v8::MemorySpan<const uint8_t> wire_bytes) {
   HandleScope scope(isolate);
-
-  v8::MemorySpan<const uint8_t> serialized_module;
-  MaybeLocal<v8::WasmModuleObject> module =
-      v8::WasmModuleObject::DeserializeOrCompile(
-          reinterpret_cast<v8::Isolate*>(isolate), serialized_module,
-          wire_bytes);
-  return !module.IsEmpty();
+  v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
+  v8::Local<v8::Context> context =
+      Utils::ToLocal(Handle<Context>::cast(isolate->native_context()));
+
+  // Get the "WebAssembly.Module" function.
+  auto get_property = [context, v8_isolate](
+                          v8::Local<v8::Object> obj,
+                          const char* property_name) -> v8::Local<v8::Object> {
+    auto name = v8::String::NewFromUtf8(v8_isolate, property_name,
+                                        NewStringType::kInternalized)
+                    .ToLocalChecked();
+    return obj->Get(context, name).ToLocalChecked().As<v8::Object>();
+  };
+  auto wasm_class = get_property(context->Global(), "WebAssembly");
+  auto module_class = get_property(wasm_class, "Module");
+
+  // Create an arraybuffer with the wire bytes.
+  v8::Local<v8::ArrayBuffer> buf =
+      v8::ArrayBuffer::New(v8_isolate, wire_bytes.size());
+  memcpy(static_cast<uint8_t*>(buf->GetBackingStore()->Data()),
+         wire_bytes.data(), wire_bytes.size());
+
+  // Now call the "WebAssembly.Module" function with the array buffer. Return
+  // true if this succeeded, false otherwise.
+  v8::TryCatch try_catch(v8_isolate);
+  v8::Local<v8::Value> args[] = {buf};
+  MaybeLocal<Value> module_object =
+      module_class->CallAsConstructor(context, arraysize(args), args);
+
+  CHECK_EQ(try_catch.HasCaught(), module_object.IsEmpty());
+  return !module_object.IsEmpty();
 }
 
 }  // namespace
@@ -78,7 +103,6 @@ TEST(PropertiesOfCodegenCallbacks) {
   v8::MemorySpan<const uint8_t> wire_bytes = {buffer.begin(), buffer.size()};
   Isolate* isolate = CcTest::InitIsolateOnce();
   HandleScope scope(isolate);
-  testing::SetupIsolateForWasmModule(isolate);
 
   for (TestValue codegen : AllTestValues) {
     for (TestValue wasm_codegen : AllTestValues) {
@@ -94,6 +118,15 @@ TEST(PropertiesOfCodegenCallbacks) {
   }
 }
 
+TEST(WasmModuleObjectCompileFailure) {
+  const uint8_t wire_bytes_arr[] = {0xDE, 0xAD, 0xBE, 0xEF};
+  v8::MemorySpan<const uint8_t> wire_bytes = {wire_bytes_arr,
+                                              arraysize(wire_bytes_arr)};
+  Isolate* isolate = CcTest::InitIsolateOnce();
+  HandleScope scope(isolate);
+  CHECK(!TestModule(isolate, wire_bytes));
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-wasm-import-wrapper-cache.cc b/deps/v8/test/cctest/wasm/test-wasm-import-wrapper-cache.cc
index 15267215e1ab7d..a91778d68b76f0 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-import-wrapper-cache.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-import-wrapper-cache.cc
@@ -20,10 +20,11 @@ namespace test_wasm_import_wrapper_cache {
 
 std::shared_ptr<NativeModule> NewModule(Isolate* isolate) {
   std::shared_ptr<WasmModule> module(new WasmModule);
-  bool can_request_more = false;
-  size_t size = 16384;
-  return isolate->wasm_engine()->NewNativeModule(
-      isolate, kAllWasmFeatures, size, can_request_more, std::move(module));
+  constexpr size_t kCodeSizeEstimate = 16384;
+  auto native_module = isolate->wasm_engine()->NewNativeModule(
+      isolate, WasmFeatures::All(), std::move(module), kCodeSizeEstimate);
+  native_module->SetWireBytes({});
+  return native_module;
 }
 
 TEST(CacheHit) {
diff --git a/deps/v8/test/cctest/wasm/test-wasm-serialization.cc b/deps/v8/test/cctest/wasm/test-wasm-serialization.cc
index c6486650efe093..2a486303e89e6a 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-serialization.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-serialization.cc
@@ -15,6 +15,7 @@
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-objects-inl.h"
 #include "src/wasm/wasm-opcodes.h"
+#include "src/wasm/wasm-serialization.h"
 
 #include "test/cctest/cctest.h"
 #include "test/common/wasm/flag-utils.h"
@@ -27,22 +28,6 @@ namespace internal {
 namespace wasm {
 namespace test_wasm_serialization {
 
-namespace {
-void Cleanup(Isolate* isolate = CcTest::InitIsolateOnce()) {
-  // By sending a low memory notifications, we will try hard to collect all
-  // garbage and will therefore also invoke all weak callbacks of actually
-  // unreachable persistent handles.
-  reinterpret_cast<v8::Isolate*>(isolate)->LowMemoryNotification();
-}
-
-#define EMIT_CODE_WITH_END(f, code)  \
-  do {                               \
-    f->EmitCode(code, sizeof(code)); \
-    f->Emit(kExprEnd);               \
-  } while (false)
-
-}  // namespace
-
 // Approximate gtest TEST_F style, in case we adopt gtest.
 class WasmSerializationTest {
  public:
@@ -56,8 +41,8 @@ class WasmSerializationTest {
     TestSignatures sigs;
 
     WasmFunctionBuilder* f = builder->AddFunction(sigs.i_i());
-    byte code[] = {WASM_GET_LOCAL(0), kExprI32Const, 1, kExprI32Add};
-    EMIT_CODE_WITH_END(f, code);
+    byte code[] = {WASM_GET_LOCAL(0), kExprI32Const, 1, kExprI32Add, kExprEnd};
+    f->EmitCode(code, sizeof(code));
     builder->AddExport(CStrVector(kFunctionName), f);
 
     builder->WriteTo(buffer);
@@ -68,7 +53,7 @@ class WasmSerializationTest {
   void InvalidateVersion() {
     uint32_t* slot = reinterpret_cast<uint32_t*>(
         const_cast<uint8_t*>(serialized_bytes_.data()) +
-        SerializedCodeData::kVersionHashOffset);
+        WasmSerializer::kVersionHashOffset);
     *slot = Version::Hash() + 1;
   }
 
@@ -76,27 +61,24 @@ class WasmSerializationTest {
     memset(const_cast<uint8_t*>(wire_bytes_.data()), 0, wire_bytes_.size() / 2);
   }
 
-  void InvalidateLength() {
-    uint32_t* slot = reinterpret_cast<uint32_t*>(
-        const_cast<uint8_t*>(serialized_bytes_.data()) +
-        SerializedCodeData::kPayloadLengthOffset);
-    *slot = 0u;
+  void InvalidateNumFunctions() {
+    Address num_functions_slot =
+        reinterpret_cast<Address>(serialized_bytes_.data()) +
+        WasmSerializer::kHeaderSize;
+    CHECK_EQ(1, base::ReadUnalignedValue<uint32_t>(num_functions_slot));
+    base::WriteUnalignedValue<uint32_t>(num_functions_slot, 0);
   }
 
-  v8::MaybeLocal<v8::WasmModuleObject> Deserialize() {
-    ErrorThrower thrower(current_isolate(), "");
-    v8::MaybeLocal<v8::WasmModuleObject> deserialized =
-        v8::WasmModuleObject::DeserializeOrCompile(
-            current_isolate_v8(), serialized_bytes_, wire_bytes_);
-    return deserialized;
+  MaybeHandle<WasmModuleObject> Deserialize() {
+    return DeserializeNativeModule(CcTest::i_isolate(),
+                                   VectorOf(serialized_bytes_),
+                                   VectorOf(wire_bytes_), {});
   }
 
   void DeserializeAndRun() {
-    ErrorThrower thrower(current_isolate(), "");
-    v8::Local<v8::WasmModuleObject> deserialized_module;
-    CHECK(Deserialize().ToLocal(&deserialized_module));
-    Handle<WasmModuleObject> module_object = Handle<WasmModuleObject>::cast(
-        v8::Utils::OpenHandle(*deserialized_module));
+    ErrorThrower thrower(CcTest::i_isolate(), "");
+    Handle<WasmModuleObject> module_object;
+    CHECK(Deserialize().ToHandle(&module_object));
     {
       DisallowHeapAllocation assume_no_gc;
       Vector<const byte> deserialized_module_wire_bytes =
@@ -107,56 +89,67 @@ class WasmSerializationTest {
                0);
     }
     Handle<WasmInstanceObject> instance =
-        current_isolate()
+        CcTest::i_isolate()
             ->wasm_engine()
-            ->SyncInstantiate(current_isolate(), &thrower, module_object,
+            ->SyncInstantiate(CcTest::i_isolate(), &thrower, module_object,
                               Handle<JSReceiver>::null(),
                               MaybeHandle<JSArrayBuffer>())
             .ToHandleChecked();
     Handle<Object> params[1] = {
-        Handle<Object>(Smi::FromInt(41), current_isolate())};
+        Handle<Object>(Smi::FromInt(41), CcTest::i_isolate())};
     int32_t result = testing::CallWasmFunctionForTesting(
-        current_isolate(), instance, &thrower, kFunctionName, 1, params);
+        CcTest::i_isolate(), instance, &thrower, kFunctionName, 1, params);
     CHECK_EQ(42, result);
   }
 
-  Isolate* current_isolate() {
-    return reinterpret_cast<Isolate*>(current_isolate_v8_);
+  void CollectGarbage() {
+    // Try hard to collect all garbage and will therefore also invoke all weak
+    // callbacks of actually unreachable persistent handles.
+    CcTest::i_isolate()->heap()->CollectAllAvailableGarbage(
+        GarbageCollectionReason::kTesting);
   }
 
-  ~WasmSerializationTest() {
-    // Don't call from here if we move to gtest
-    TearDown();
-  }
-
-  v8::Isolate* current_isolate_v8() { return current_isolate_v8_; }
-
  private:
   static const char* kFunctionName;
 
   Zone* zone() { return &zone_; }
 
   void SetUp() {
+    CcTest::InitIsolateOnce();
     ZoneBuffer buffer(&zone_);
     WasmSerializationTest::BuildWireBytes(zone(), &buffer);
 
-    Isolate* serialization_isolate = CcTest::InitIsolateOnce();
+    v8::Isolate::CreateParams create_params;
+    create_params.array_buffer_allocator =
+        CcTest::i_isolate()->array_buffer_allocator();
+
+    v8::Isolate* serialization_v8_isolate = v8::Isolate::New(create_params);
+    Isolate* serialization_isolate =
+        reinterpret_cast<Isolate*>(serialization_v8_isolate);
     ErrorThrower thrower(serialization_isolate, "");
+    // Keep a weak pointer so we can check that the native module dies after
+    // serialization (when the isolate is disposed).
+    std::weak_ptr<NativeModule> weak_native_module;
     {
       HandleScope scope(serialization_isolate);
-      testing::SetupIsolateForWasmModule(serialization_isolate);
+      v8::Local<v8::Context> serialization_context =
+          v8::Context::New(serialization_v8_isolate);
+      serialization_context->Enter();
 
-      auto enabled_features = WasmFeaturesFromIsolate(serialization_isolate);
+      auto enabled_features = WasmFeatures::FromIsolate(serialization_isolate);
       MaybeHandle<WasmModuleObject> maybe_module_object =
           serialization_isolate->wasm_engine()->SyncCompile(
               serialization_isolate, enabled_features, &thrower,
               ModuleWireBytes(buffer.begin(), buffer.end()));
       Handle<WasmModuleObject> module_object =
           maybe_module_object.ToHandleChecked();
+      weak_native_module = module_object->shared_native_module();
+      // Check that the native module exists at this point.
+      CHECK(weak_native_module.lock());
 
       v8::Local<v8::Object> v8_module_obj =
           v8::Utils::ToLocal(Handle<JSObject>::cast(module_object));
-      CHECK(v8_module_obj->IsWebAssemblyCompiledModule());
+      CHECK(v8_module_obj->IsWasmModuleObject());
 
       v8::Local<v8::WasmModuleObject> v8_module_object =
           v8_module_obj.As<v8::WasmModuleObject>();
@@ -170,24 +163,23 @@ class WasmSerializationTest {
       // keep alive data_ until the end
       data_ = compiled_module.Serialize();
     }
+    // Dispose of serialization isolate to destroy the reference to the
+    // NativeModule, which removes it from the module cache in the wasm engine
+    // and forces de-serialization in the new isolate.
+    serialization_v8_isolate->Dispose();
+
+    // Busy-wait for the NativeModule to really die. Background threads might
+    // temporarily keep it alive (happens very rarely, see
+    // https://crbug.com/v8/10148).
+    while (weak_native_module.lock()) {
+    }
 
     serialized_bytes_ = {data_.buffer.get(), data_.size};
 
-    v8::Isolate::CreateParams create_params;
-    create_params.array_buffer_allocator =
-        serialization_isolate->array_buffer_allocator();
-
-    current_isolate_v8_ = v8::Isolate::New(create_params);
-    v8::HandleScope new_scope(current_isolate_v8());
+    v8::HandleScope new_scope(CcTest::isolate());
     v8::Local<v8::Context> deserialization_context =
-        v8::Context::New(current_isolate_v8());
+        v8::Context::New(CcTest::isolate());
     deserialization_context->Enter();
-    testing::SetupIsolateForWasmModule(current_isolate());
-  }
-
-  void TearDown() {
-    current_isolate_v8()->Dispose();
-    current_isolate_v8_ = nullptr;
   }
 
   v8::internal::AccountingAllocator allocator_;
@@ -195,7 +187,6 @@ class WasmSerializationTest {
   v8::OwnedBuffer data_;
   v8::MemorySpan<const uint8_t> wire_bytes_ = {nullptr, 0};
   v8::MemorySpan<const uint8_t> serialized_bytes_ = {nullptr, 0};
-  v8::Isolate* current_isolate_v8_;
 };
 
 const char* WasmSerializationTest::kFunctionName = "increment";
@@ -203,56 +194,51 @@ const char* WasmSerializationTest::kFunctionName = "increment";
 TEST(DeserializeValidModule) {
   WasmSerializationTest test;
   {
-    HandleScope scope(test.current_isolate());
+    HandleScope scope(CcTest::i_isolate());
     test.DeserializeAndRun();
   }
-  Cleanup(test.current_isolate());
-  Cleanup();
+  test.CollectGarbage();
 }
 
 TEST(DeserializeMismatchingVersion) {
   WasmSerializationTest test;
   {
-    HandleScope scope(test.current_isolate());
+    HandleScope scope(CcTest::i_isolate());
     test.InvalidateVersion();
-    test.DeserializeAndRun();
+    CHECK(test.Deserialize().is_null());
   }
-  Cleanup(test.current_isolate());
-  Cleanup();
+  test.CollectGarbage();
 }
 
 TEST(DeserializeNoSerializedData) {
   WasmSerializationTest test;
   {
-    HandleScope scope(test.current_isolate());
+    HandleScope scope(CcTest::i_isolate());
     test.ClearSerializedData();
-    test.DeserializeAndRun();
+    CHECK(test.Deserialize().is_null());
   }
-  Cleanup(test.current_isolate());
-  Cleanup();
+  test.CollectGarbage();
 }
 
-TEST(DeserializeInvalidLength) {
+TEST(DeserializeInvalidNumFunctions) {
   WasmSerializationTest test;
   {
-    HandleScope scope(test.current_isolate());
-    test.InvalidateLength();
-    test.DeserializeAndRun();
+    HandleScope scope(CcTest::i_isolate());
+    test.InvalidateNumFunctions();
+    CHECK(test.Deserialize().is_null());
   }
-  Cleanup(test.current_isolate());
-  Cleanup();
+  test.CollectGarbage();
 }
 
 TEST(DeserializeWireBytesAndSerializedDataInvalid) {
   WasmSerializationTest test;
   {
-    HandleScope scope(test.current_isolate());
+    HandleScope scope(CcTest::i_isolate());
     test.InvalidateVersion();
     test.InvalidateWireBytes();
-    test.Deserialize();
+    CHECK(test.Deserialize().is_null());
   }
-  Cleanup(test.current_isolate());
-  Cleanup();
+  test.CollectGarbage();
 }
 
 bool False(v8::Local<v8::Context> context, v8::Local<v8::String> source) {
@@ -262,17 +248,14 @@ bool False(v8::Local<v8::Context> context, v8::Local<v8::String> source) {
 TEST(BlockWasmCodeGenAtDeserialization) {
   WasmSerializationTest test;
   {
-    HandleScope scope(test.current_isolate());
-    test.current_isolate_v8()->SetAllowCodeGenerationFromStringsCallback(False);
-    v8::MaybeLocal<v8::WasmModuleObject> nothing = test.Deserialize();
-    CHECK(nothing.IsEmpty());
+    HandleScope scope(CcTest::i_isolate());
+    CcTest::isolate()->SetAllowWasmCodeGenerationCallback(False);
+    CHECK(test.Deserialize().is_null());
   }
-  Cleanup(test.current_isolate());
-  Cleanup();
+  test.CollectGarbage();
 }
 
 UNINITIALIZED_TEST(CompiledWasmModulesTransfer) {
-  FlagScope<bool> flag_scope_engine(&FLAG_wasm_shared_engine, true);
   i::wasm::WasmEngine::InitializeOncePerProcess();
   v8::internal::AccountingAllocator allocator;
   Zone zone(&allocator, ZONE_NAME);
@@ -292,7 +275,7 @@ UNINITIALIZED_TEST(CompiledWasmModulesTransfer) {
     Isolate* from_i_isolate = reinterpret_cast<Isolate*>(from_isolate);
     testing::SetupIsolateForWasmModule(from_i_isolate);
     ErrorThrower thrower(from_i_isolate, "TestCompiledWasmModulesTransfer");
-    auto enabled_features = WasmFeaturesFromIsolate(from_i_isolate);
+    auto enabled_features = WasmFeatures::FromIsolate(from_i_isolate);
     MaybeHandle<WasmModuleObject> maybe_module_object =
         from_i_isolate->wasm_engine()->SyncCompile(
             from_i_isolate, enabled_features, &thrower,
@@ -327,8 +310,6 @@ UNINITIALIZED_TEST(CompiledWasmModulesTransfer) {
   from_isolate->Dispose();
 }
 
-#undef EMIT_CODE_WITH_END
-
 }  // namespace test_wasm_serialization
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/test/cctest/wasm/test-wasm-shared-engine.cc b/deps/v8/test/cctest/wasm/test-wasm-shared-engine.cc
index 2d6e93039704c6..badeb8e7a018f7 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-shared-engine.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-shared-engine.cc
@@ -186,8 +186,8 @@ void PumpMessageLoop(SharedEngineIsolate* isolate) {
 
 Handle<WasmInstanceObject> CompileAndInstantiateAsync(
     SharedEngineIsolate* isolate, ZoneBuffer* buffer) {
-  Handle<Object> maybe_instance = handle(Smi::kZero, isolate->isolate());
-  auto enabled_features = WasmFeaturesFromIsolate(isolate->isolate());
+  Handle<Object> maybe_instance = handle(Smi::zero(), isolate->isolate());
+  auto enabled_features = WasmFeatures::FromIsolate(isolate->isolate());
   constexpr const char* kAPIMethodName = "Test.CompileAndInstantiateAsync";
   isolate->isolate()->wasm_engine()->AsyncCompile(
       isolate->isolate(), enabled_features,
@@ -350,7 +350,7 @@ TEST(SharedEngineRunThreadedTierUp) {
   threads.emplace_back(&engine, [module](SharedEngineIsolate* isolate) {
     HandleScope scope(isolate->isolate());
     Handle<WasmInstanceObject> instance = isolate->ImportInstance(module);
-    WasmFeatures detected = kNoWasmFeatures;
+    WasmFeatures detected = WasmFeatures::None();
     WasmCompilationUnit::CompileWasmFunction(
         isolate->isolate(), module.get(), &detected,
         &module->module()->functions[0], ExecutionTier::kTurbofan);
diff --git a/deps/v8/test/cctest/wasm/test-wasm-stack.cc b/deps/v8/test/cctest/wasm/test-wasm-stack.cc
index 2557978ae42db0..1ee1b3dfc6ef4d 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-stack.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-stack.cc
@@ -140,13 +140,12 @@ WASM_EXEC_TEST(CollectDetailedWasmStack_ExplicitThrowFromJs) {
                          Execution::MessageHandling::kReport, &maybe_exc);
   CHECK(returnObjMaybe.is_null());
 
-  // Line and column are 1-based, so add 1 for the expected wasm output.
   ExceptionInfo expected_exceptions[] = {
-      {"a", 3, 8},                                            // -
-      {"js", 4, 2},                                           // -
-      {"main", static_cast<int>(wasm_index_1) + 1, 8},        // -
-      {"call_main", static_cast<int>(wasm_index_2) + 1, 21},  // -
-      {"callFn", 1, 24}                                       // -
+      {"a", 3, 8},           // -
+      {"js", 4, 2},          // -
+      {"main", 1, 8},        // -
+      {"call_main", 1, 21},  // -
+      {"callFn", 1, 24}      // -
   };
   CheckExceptionInfos(isolate, maybe_exc.ToHandleChecked(),
                       expected_exceptions);
@@ -196,15 +195,15 @@ WASM_EXEC_TEST(CollectDetailedWasmStack_WasmError) {
     const int call_main_offset =
         r.builder().GetFunctionAt(wasm_index_2)->code.offset();
 
-    // Line and column are 1-based, so add 1 for the expected wasm output.
+    // Column is 1-based, so add 1 for the expected wasm output. Line number
+    // is always 1.
     const int expected_main_pos =
         unreachable_pos + main_offset + kMainLocalsLength + 1;
     const int expected_call_main_pos = call_main_offset + kMainLocalsLength + 1;
     ExceptionInfo expected_exceptions[] = {
-        {"main", static_cast<int>(wasm_index_1) + 1, expected_main_pos},  // -
-        {"call_main", static_cast<int>(wasm_index_2) + 1,
-         expected_call_main_pos},  // -
-        {"callFn", 1, 24}          //-
+        {"main", 1, expected_main_pos},            // -
+        {"call_main", 1, expected_call_main_pos},  // -
+        {"callFn", 1, 24}                          //-
     };
     CheckExceptionInfos(isolate, exception, expected_exceptions);
   }
diff --git a/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc b/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc
index 69aa517cce3137..21808b0557b8ff 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc
@@ -91,10 +91,9 @@ WASM_EXEC_TEST(Unreachable) {
                          Execution::MessageHandling::kReport, &maybe_exc);
   CHECK(returnObjMaybe.is_null());
 
-  // Line and column are 1-based, so add 1 for the expected wasm output.
   ExceptionInfo expected_exceptions[] = {
-      {"main", static_cast<int>(wasm_index) + 1, 7},  // --
-      {"callFn", 1, 24}                               // --
+      {"main", 1, 7},    // --
+      {"callFn", 1, 24}  // --
   };
   CheckExceptionInfos(isolate, maybe_exc.ToHandleChecked(),
                       expected_exceptions);
@@ -134,11 +133,10 @@ WASM_EXEC_TEST(IllegalLoad) {
                          Execution::MessageHandling::kReport, &maybe_exc);
   CHECK(returnObjMaybe.is_null());
 
-  // Line and column are 1-based, so add 1 for the expected wasm output.
   ExceptionInfo expected_exceptions[] = {
-      {"main", static_cast<int>(wasm_index_1) + 1, 13},       // --
-      {"call_main", static_cast<int>(wasm_index_2) + 1, 30},  // --
-      {"callFn", 1, 24}                                       // --
+      {"main", 1, 13},       // --
+      {"call_main", 1, 30},  // --
+      {"callFn", 1, 24}      // --
   };
   CheckExceptionInfos(isolate, maybe_exc.ToHandleChecked(),
                       expected_exceptions);
diff --git a/deps/v8/test/cctest/wasm/wasm-run-utils.cc b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
index 09d64e5d97b609..e2e6458da8a119 100644
--- a/deps/v8/test/cctest/wasm/wasm-run-utils.cc
+++ b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
@@ -22,7 +22,7 @@ TestingModuleBuilder::TestingModuleBuilder(
     : test_module_(std::make_shared<WasmModule>()),
       test_module_ptr_(test_module_.get()),
       isolate_(CcTest::InitIsolateOnce()),
-      enabled_features_(WasmFeaturesFromIsolate(isolate_)),
+      enabled_features_(WasmFeatures::FromIsolate(isolate_)),
       execution_tier_(tier),
       runtime_exception_support_(exception_support),
       lower_simd_(lower_simd) {
@@ -120,7 +120,7 @@ uint32_t TestingModuleBuilder::AddFunction(FunctionSig* sig, const char* name,
                 test_module_->num_declared_functions);
   if (name) {
     Vector<const byte> name_vec = Vector<const byte>::cast(CStrVector(name));
-    test_module_->AddFunctionNameForTesting(
+    test_module_->function_names.AddForTesting(
         index, {AddBytes(name_vec), static_cast<uint32_t>(name_vec.length())});
   }
   if (interpreter_) {
@@ -218,6 +218,10 @@ uint32_t TestingModuleBuilder::AddBytes(Vector<const byte> bytes) {
   OwnedVector<uint8_t> new_bytes = OwnedVector<uint8_t>::New(new_size);
   if (old_size > 0) {
     memcpy(new_bytes.start(), old_bytes.begin(), old_size);
+  } else {
+    // Set the unused byte. It is never decoded, but the bytes are used as the
+    // key in the native module cache.
+    new_bytes[0] = 0;
   }
   memcpy(new_bytes.start() + bytes_offset, bytes.begin(), bytes.length());
   native_module_->SetWireBytes(std::move(new_bytes));
@@ -241,7 +245,6 @@ uint32_t TestingModuleBuilder::AddPassiveDataSegment(Vector<const byte> bytes) {
   DCHECK_EQ(index, test_module_->data_segments.size());
   DCHECK_EQ(index, data_segment_starts_.size());
   DCHECK_EQ(index, data_segment_sizes_.size());
-  DCHECK_EQ(index, dropped_data_segments_.size());
 
   // Add a passive data segment. This isn't used by function compilation, but
   // but it keeps the index in sync. The data segment's source will not be
@@ -268,12 +271,10 @@ uint32_t TestingModuleBuilder::AddPassiveDataSegment(Vector<const byte> bytes) {
   }
   data_segment_starts_.push_back(new_data_address + old_data_size);
   data_segment_sizes_.push_back(bytes.length());
-  dropped_data_segments_.push_back(0);
 
   // The vector pointers may have moved, so update the instance object.
   instance_object_->set_data_segment_starts(data_segment_starts_.data());
   instance_object_->set_data_segment_sizes(data_segment_sizes_.data());
-  instance_object_->set_dropped_data_segments(dropped_data_segments_.data());
   return index;
 }
 
@@ -318,8 +319,12 @@ Handle<WasmInstanceObject> TestingModuleBuilder::InitInstanceObject() {
       isolate_->factory()->NewScript(isolate_->factory()->empty_string());
   script->set_type(Script::TYPE_WASM);
 
+  const bool kUsesLiftoff = true;
+  size_t code_size_estimate =
+      wasm::WasmCodeManager::EstimateNativeModuleCodeSize(test_module_.get(),
+                                                          kUsesLiftoff);
   auto native_module = isolate_->wasm_engine()->NewNativeModule(
-      isolate_, enabled_features_, test_module_);
+      isolate_, enabled_features_, test_module_, code_size_estimate);
   native_module->SetWireBytes(OwnedVector<const uint8_t>());
 
   Handle<WasmModuleObject> module_object =
@@ -342,14 +347,14 @@ void TestBuildingGraphWithBuilder(compiler::WasmGraphBuilder* builder,
   WasmFeatures unused_detected_features;
   FunctionBody body(sig, 0, start, end);
   DecodeResult result =
-      BuildTFGraph(zone->allocator(), kAllWasmFeatures, nullptr, builder,
+      BuildTFGraph(zone->allocator(), WasmFeatures::All(), nullptr, builder,
                    &unused_detected_features, body, nullptr);
   if (result.failed()) {
 #ifdef DEBUG
     if (!FLAG_trace_wasm_decoder) {
       // Retry the compilation with the tracing flag on, to help in debugging.
       FLAG_trace_wasm_decoder = true;
-      result = BuildTFGraph(zone->allocator(), kAllWasmFeatures, nullptr,
+      result = BuildTFGraph(zone->allocator(), WasmFeatures::All(), nullptr,
                             builder, &unused_detected_features, body, nullptr);
     }
 #endif
diff --git a/deps/v8/test/cctest/wasm/wasm-run-utils.h b/deps/v8/test/cctest/wasm/wasm-run-utils.h
index bf0dd711a65abb..b66f6ffa369f2a 100644
--- a/deps/v8/test/cctest/wasm/wasm-run-utils.h
+++ b/deps/v8/test/cctest/wasm/wasm-run-utils.h
@@ -249,7 +249,6 @@ class TestingModuleBuilder {
   std::vector<byte> data_segment_data_;
   std::vector<Address> data_segment_starts_;
   std::vector<uint32_t> data_segment_sizes_;
-  std::vector<byte> dropped_data_segments_;
   std::vector<byte> dropped_elem_segments_;
 
   const WasmGlobal* AddGlobal(ValueType type);
@@ -560,6 +559,13 @@ class WasmRunner : public WasmRunnerBase {
     CheckCallApplyViaJS(expected, function()->func_index, buffer, sizeof...(p));
   }
 
+  void CheckUsedExecutionTier(ExecutionTier expected_tier) {
+    // Liftoff can fail and fallback to Turbofan, so check that the function
+    // gets compiled by the tier requested, to guard against accidental success.
+    CHECK(compiled_);
+    CHECK_EQ(expected_tier, builder_.GetFunctionCode(0)->tier());
+  }
+
   Handle<Code> GetWrapperCode() { return wrapper_.GetWrapperCode(); }
 
  private:
diff --git a/deps/v8/test/common/assembler-tester.h b/deps/v8/test/common/assembler-tester.h
index 17e376ef60800d..966ee7da0b4955 100644
--- a/deps/v8/test/common/assembler-tester.h
+++ b/deps/v8/test/common/assembler-tester.h
@@ -74,7 +74,7 @@ class TestingAssemblerBuffer : public AssemblerBuffer {
 };
 
 static inline std::unique_ptr<TestingAssemblerBuffer> AllocateAssemblerBuffer(
-    size_t requested = v8::internal::AssemblerBase::kMinimalBufferSize,
+    size_t requested = v8::internal::AssemblerBase::kDefaultBufferSize,
     void* address = nullptr) {
   return std::make_unique<TestingAssemblerBuffer>(requested, address);
 }
diff --git a/deps/v8/test/common/types-fuzz.h b/deps/v8/test/common/types-fuzz.h
index f3acabb5adb580..21a7b7cafcdf9f 100644
--- a/deps/v8/test/common/types-fuzz.h
+++ b/deps/v8/test/common/types-fuzz.h
@@ -42,7 +42,7 @@ class Types {
  public:
   Types(Zone* zone, Isolate* isolate, v8::base::RandomNumberGenerator* rng)
       : zone_(zone),
-        js_heap_broker_(isolate, zone, FLAG_trace_heap_broker),
+        js_heap_broker_(isolate, zone, FLAG_trace_heap_broker, false),
         rng_(rng) {
 #define DECLARE_TYPE(name, value) \
   name = Type::name();            \
diff --git a/deps/v8/test/common/wasm/flag-utils.h b/deps/v8/test/common/wasm/flag-utils.h
index b9675a2130cd20..98830c33615be1 100644
--- a/deps/v8/test/common/wasm/flag-utils.h
+++ b/deps/v8/test/common/wasm/flag-utils.h
@@ -5,6 +5,8 @@
 #ifndef V8_TEST_COMMON_FLAG_UTILS_H
 #define V8_TEST_COMMON_FLAG_UTILS_H
 
+#include "src/wasm/wasm-features.h"
+
 namespace v8 {
 namespace internal {
 
@@ -26,6 +28,40 @@ class FlagScope {
 
 #define EXPERIMENTAL_FLAG_SCOPE(flag) FLAG_SCOPE(experimental_wasm_##flag)
 
+namespace wasm {
+
+class WasmFeatureScope {
+ public:
+  explicit WasmFeatureScope(WasmFeatures* features, WasmFeature feature,
+                            bool val = true)
+      : prev_(features->contains(feature)),
+        feature_(feature),
+        features_(features) {
+    set(val);
+  }
+  ~WasmFeatureScope() { set(prev_); }
+
+ private:
+  void set(bool val) {
+    if (val) {
+      features_->Add(feature_);
+    } else {
+      features_->Remove(feature_);
+    }
+  }
+
+  bool const prev_;
+  WasmFeature const feature_;
+  WasmFeatures* const features_;
+};
+
+#define WASM_FEATURE_SCOPE(feat) \
+  WasmFeatureScope feat##_scope(&this->enabled_features_, kFeature_##feat)
+
+#define WASM_FEATURE_SCOPE_VAL(feat, val) \
+  WasmFeatureScope feat##_scope(&this->enabled_features_, kFeature_##feat, val)
+
+}  // namespace wasm
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/test/common/wasm/test-signatures.h b/deps/v8/test/common/wasm/test-signatures.h
index dc04cdf56b2e4a..186327ef02c6c9 100644
--- a/deps/v8/test/common/wasm/test-signatures.h
+++ b/deps/v8/test/common/wasm/test-signatures.h
@@ -28,6 +28,8 @@ class TestSignatures {
         sig_i_r(1, 1, kIntAnyRefTypes4),
         sig_i_rr(1, 2, kIntAnyRefTypes4),
         sig_i_a(1, 1, kIntFuncRefTypes4),
+        sig_i_n(1, 1, kIntNullRefTypes4),
+        sig_i_s(1, 1, kIntSimd128Types4),
         sig_l_v(1, 0, kLongTypes4),
         sig_l_l(1, 1, kLongTypes4),
         sig_l_ll(1, 2, kLongTypes4),
@@ -40,12 +42,14 @@ class TestSignatures {
         sig_a_v(1, 0, kFuncTypes4),
         sig_r_r(1, 1, kRefTypes4),
         sig_a_a(1, 1, kFuncTypes4),
+        sig_n_v(1, 0, kIntNullRefTypes4 + 1),
         sig_v_v(0, 0, kIntTypes4),
         sig_v_i(0, 1, kIntTypes4),
         sig_v_ii(0, 2, kIntTypes4),
         sig_v_iii(0, 3, kIntTypes4),
         sig_v_r(0, 1, kRefTypes4),
         sig_v_a(0, 1, kFuncTypes4),
+        sig_v_n(0, 1, kIntNullRefTypes4 + 1),
         sig_s_i(1, 1, kSimd128IntTypes4),
         sig_ii_v(2, 0, kIntTypes4),
         sig_iii_v(3, 0, kIntTypes4) {
@@ -61,12 +65,16 @@ class TestSignatures {
     for (int i = 1; i < 4; i++) kIntDoubleTypes4[i] = kWasmF64;
     for (int i = 1; i < 4; i++) kIntAnyRefTypes4[i] = kWasmAnyRef;
     for (int i = 1; i < 4; i++) kIntFuncRefTypes4[i] = kWasmFuncRef;
+    for (int i = 1; i < 4; i++) kIntNullRefTypes4[i] = kWasmNullRef;
+    for (int i = 1; i < 4; i++) kIntSimd128Types4[i] = kWasmS128;
     for (int i = 0; i < 4; i++) kSimd128IntTypes4[i] = kWasmS128;
     kIntLongTypes4[0] = kWasmI32;
     kIntFloatTypes4[0] = kWasmI32;
     kIntDoubleTypes4[0] = kWasmI32;
     kIntAnyRefTypes4[0] = kWasmI32;
     kIntFuncRefTypes4[0] = kWasmI32;
+    kIntNullRefTypes4[0] = kWasmI32;
+    kIntSimd128Types4[0] = kWasmI32;
     kSimd128IntTypes4[1] = kWasmI32;
   }
 
@@ -87,6 +95,8 @@ class TestSignatures {
   FunctionSig* i_r() { return &sig_i_r; }
   FunctionSig* i_rr() { return &sig_i_rr; }
   FunctionSig* i_a() { return &sig_i_a; }
+  FunctionSig* i_n() { return &sig_i_n; }
+  FunctionSig* i_s() { return &sig_i_s; }
 
   FunctionSig* f_f() { return &sig_f_f; }
   FunctionSig* f_ff() { return &sig_f_ff; }
@@ -97,6 +107,7 @@ class TestSignatures {
   FunctionSig* a_v() { return &sig_a_v; }
   FunctionSig* r_r() { return &sig_r_r; }
   FunctionSig* a_a() { return &sig_a_a; }
+  FunctionSig* n_v() { return &sig_n_v; }
 
   FunctionSig* v_v() { return &sig_v_v; }
   FunctionSig* v_i() { return &sig_v_i; }
@@ -104,6 +115,7 @@ class TestSignatures {
   FunctionSig* v_iii() { return &sig_v_iii; }
   FunctionSig* v_r() { return &sig_v_r; }
   FunctionSig* v_a() { return &sig_v_a; }
+  FunctionSig* v_n() { return &sig_v_n; }
   FunctionSig* s_i() { return &sig_s_i; }
 
   FunctionSig* ii_v() { return &sig_ii_v; }
@@ -130,6 +142,8 @@ class TestSignatures {
   ValueType kIntDoubleTypes4[4];
   ValueType kIntAnyRefTypes4[4];
   ValueType kIntFuncRefTypes4[4];
+  ValueType kIntNullRefTypes4[4];
+  ValueType kIntSimd128Types4[4];
   ValueType kSimd128IntTypes4[4];
 
   FunctionSig sig_i_v;
@@ -144,6 +158,8 @@ class TestSignatures {
   FunctionSig sig_i_r;
   FunctionSig sig_i_rr;
   FunctionSig sig_i_a;
+  FunctionSig sig_i_n;
+  FunctionSig sig_i_s;
 
   FunctionSig sig_l_v;
   FunctionSig sig_l_l;
@@ -159,6 +175,7 @@ class TestSignatures {
   FunctionSig sig_a_v;
   FunctionSig sig_r_r;
   FunctionSig sig_a_a;
+  FunctionSig sig_n_v;
 
   FunctionSig sig_v_v;
   FunctionSig sig_v_i;
@@ -166,6 +183,7 @@ class TestSignatures {
   FunctionSig sig_v_iii;
   FunctionSig sig_v_r;
   FunctionSig sig_v_a;
+  FunctionSig sig_v_n;
   FunctionSig sig_s_i;
 
   FunctionSig sig_ii_v;
diff --git a/deps/v8/test/common/wasm/wasm-macro-gen.h b/deps/v8/test/common/wasm/wasm-macro-gen.h
index d007fbd0022229..5a914c79a2a6d6 100644
--- a/deps/v8/test/common/wasm/wasm-macro-gen.h
+++ b/deps/v8/test/common/wasm/wasm-macro-gen.h
@@ -410,29 +410,14 @@ inline WasmOpcode LoadStoreOpcodeOf(MachineType type, bool store) {
 
 #define TABLE_ZERO 0
 
-// TODO(titzer): change usages of these macros to put func last.
-#define WASM_CALL_INDIRECT0(index, func) \
-  func, kExprCallIndirect, static_cast<byte>(index), TABLE_ZERO
-#define WASM_CALL_INDIRECT1(index, func, a) \
-  a, func, kExprCallIndirect, static_cast<byte>(index), TABLE_ZERO
-#define WASM_CALL_INDIRECT2(index, func, a, b) \
-  a, b, func, kExprCallIndirect, static_cast<byte>(index), TABLE_ZERO
-#define WASM_CALL_INDIRECT3(index, func, a, b, c) \
-  a, b, c, func, kExprCallIndirect, static_cast<byte>(index), TABLE_ZERO
-#define WASM_CALL_INDIRECT4(index, func, a, b, c, d) \
-  a, b, c, d, func, kExprCallIndirect, static_cast<byte>(index), TABLE_ZERO
-#define WASM_CALL_INDIRECT5(index, func, a, b, c, d, e) \
-  a, b, c, d, e, func, kExprCallIndirect, static_cast<byte>(index), TABLE_ZERO
-#define WASM_CALL_INDIRECTN(arity, index, func, ...) \
-  __VA_ARGS__, func, kExprCallIndirect, static_cast<byte>(index), TABLE_ZERO
-#define WASM_CALL_INDIRECT_TABLE0(table, index, func) \
-  func, kExprCallIndirect, static_cast<byte>(index), static_cast<byte>(table)
-
-#define WASM_RETURN_CALL_INDIRECT0(index, func) \
-  func, kExprReturnCallIndirect, static_cast<byte>(index), TABLE_ZERO
-#define WASM_RETURN_CALL_INDIRECT(index, func, ...)                     \
-  __VA_ARGS__, func, kExprReturnCallIndirect, static_cast<byte>(index), \
-      TABLE_ZERO
+// Pass: sig_index, ...args, func_index
+#define WASM_CALL_INDIRECT(sig_index, ...) \
+  __VA_ARGS__, kExprCallIndirect, static_cast<byte>(sig_index), TABLE_ZERO
+#define WASM_CALL_INDIRECT_TABLE(table, sig_index, ...)         \
+  __VA_ARGS__, kExprCallIndirect, static_cast<byte>(sig_index), \
+      static_cast<byte>(table)
+#define WASM_RETURN_CALL_INDIRECT(sig_index, ...) \
+  __VA_ARGS__, kExprReturnCallIndirect, static_cast<byte>(sig_index), TABLE_ZERO
 
 #define WASM_NOT(x) x, kExprI32Eqz
 #define WASM_SEQ(...) __VA_ARGS__
diff --git a/deps/v8/test/common/wasm/wasm-module-runner.cc b/deps/v8/test/common/wasm/wasm-module-runner.cc
index d2869509cc6cd5..5495f9330a6aa4 100644
--- a/deps/v8/test/common/wasm/wasm-module-runner.cc
+++ b/deps/v8/test/common/wasm/wasm-module-runner.cc
@@ -29,7 +29,7 @@ uint32_t GetInitialMemSize(const WasmModule* module) {
 MaybeHandle<WasmModuleObject> CompileForTesting(Isolate* isolate,
                                                 ErrorThrower* thrower,
                                                 const ModuleWireBytes& bytes) {
-  auto enabled_features = WasmFeaturesFromIsolate(isolate);
+  auto enabled_features = WasmFeatures::FromIsolate(isolate);
   MaybeHandle<WasmModuleObject> module = isolate->wasm_engine()->SyncCompile(
       isolate, enabled_features, thrower, bytes);
   DCHECK_EQ(thrower->error(), module.is_null());
@@ -50,7 +50,7 @@ std::shared_ptr<WasmModule> DecodeWasmModuleForTesting(
     const byte* module_end, ModuleOrigin origin, bool verify_functions) {
   // Decode the module, but don't verify function bodies, since we'll
   // be compiling them anyway.
-  auto enabled_features = WasmFeaturesFromIsolate(isolate);
+  auto enabled_features = WasmFeatures::FromIsolate(isolate);
   ModuleResult decoding_result = DecodeWasmModule(
       enabled_features, module_start, module_end, verify_functions, origin,
       isolate->counters(), isolate->wasm_engine()->allocator());
@@ -103,11 +103,14 @@ bool InterpretWasmModuleForTesting(Isolate* isolate,
         break;
       case kWasmAnyRef:
       case kWasmFuncRef:
+      case kWasmNullRef:
       case kWasmExnRef:
         arguments[i] =
             WasmValue(Handle<Object>::cast(isolate->factory()->null_value()));
         break;
-      default:
+      case kWasmStmt:
+      case kWasmBottom:
+      case kWasmS128:
         UNREACHABLE();
     }
   }
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-local-repl-hole.js b/deps/v8/test/debugger/debug/debug-evaluate-local-repl-hole.js
new file mode 100644
index 00000000000000..61ee377b4049d4
--- /dev/null
+++ b/deps/v8/test/debugger/debug/debug-evaluate-local-repl-hole.js
@@ -0,0 +1,37 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test that *local* debug-evaluate properly works for REPL 'let'
+// re-declarations.
+
+Debug = debug.Debug
+
+let exception = null;
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    assertEquals(42, exec_state.frame(0).evaluate("x").value());
+  } catch (e) {
+    exception = e;
+    print(e + e.stack);
+  }
+}
+
+Debug.setListener(listener);
+
+// First script introduces a let-binding 'x'. The value of
+// 'x' lives in the ScriptContext of this REPL script.
+Debug.evaluateGlobalREPL('let x = 21;');
+
+// The second script re-declares 'x', but then breaks and
+// evaluates x.
+Debug.evaluateGlobalREPL(`
+  let x = 42;
+  (function foo() {
+    debugger;
+  })();
+`);
+
+Debug.setListener(null);
+assertNull(exception);
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-repl-mode-await.js b/deps/v8/test/debugger/debug/debug-evaluate-repl-mode-await.js
new file mode 100644
index 00000000000000..768c86be9dd2a0
--- /dev/null
+++ b/deps/v8/test/debugger/debug/debug-evaluate-repl-mode-await.js
@@ -0,0 +1,46 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Debug = debug.Debug
+
+const evaluate = Debug.evaluateGlobalREPL;
+
+(async () => {
+    // Test that the completion value of the REPL script is the resolve value of the
+    // promise returned by evalute.
+    let result = evaluate('5;');
+    assertPromiseResult(result, (value) => {
+        assertEquals(5, value);
+    }, assertUnreachable);
+
+    // Test that top-level await in REPL mode works.
+    result = evaluate('let x = await Promise.resolve(42);');
+    assertPromiseResult(result, (value) => {
+        assertEquals(undefined, value);
+        assertEquals(42, x);
+    }, assertUnreachable);
+
+    // Test that a throwing REPL script results in a rejected promise.
+    result = evaluate('throw new Error("ba dum tsh");');
+    assertPromiseResult(result, assertUnreachable, (error) => {
+        assertEquals("ba dum tsh", error.message);
+    });
+
+    // Test that a rejected promise throws.
+    result = evaluate('await Promise.reject("Reject promise!");');
+    assertPromiseResult(result, assertUnreachable, (error) => {
+        assertEquals('Reject promise!', error);
+    });
+
+    // Test that we can bind a promise in REPL mode.
+    await evaluate('let y = Promise.resolve(21);');
+    assertPromiseResult(y, (value) => {
+        assertEquals(21, value);
+    }, assertUnreachable);
+})().then(() => {
+    print("Async test completed successfully.");
+}).catch(e => {
+    print(e.stack);
+    %AbortJS("Async test is failing");
+});
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-repl-mode-optimized.js b/deps/v8/test/debugger/debug/debug-evaluate-repl-mode-optimized.js
new file mode 100644
index 00000000000000..cb06854dcf71a7
--- /dev/null
+++ b/deps/v8/test/debugger/debug/debug-evaluate-repl-mode-optimized.js
@@ -0,0 +1,32 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --opt
+
+Debug = debug.Debug
+
+const evaluate = Debug.evaluateGlobalREPL;
+const evaluateNonREPL = (source) => Debug.evaluateGlobal(source, false).value();
+
+// Test that a let declared variable 'x' bound by an optimized function is
+// updated properly.
+evaluate('let x = 42;');
+
+evaluate('function foo() { return x; }');
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(42, foo());
+assertOptimized(foo);
+
+evaluate('let x = 21');
+assertEquals(21, foo());
+
+// Test that we do not throw a 'use before declaration error' and
+// that the optimized code does not load the hole from the wrong
+// script context.
+evaluate('x; let x;');
+assertEquals(undefined, foo());
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-repl-mode.js b/deps/v8/test/debugger/debug/debug-evaluate-repl-mode.js
new file mode 100644
index 00000000000000..4001033ca68b3c
--- /dev/null
+++ b/deps/v8/test/debugger/debug/debug-evaluate-repl-mode.js
@@ -0,0 +1,314 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Debug = debug.Debug
+
+const evaluate = Debug.evaluateGlobalREPL;
+const evaluateNonREPL = (source) => Debug.evaluateGlobal(source, false).value();
+
+(async () => {
+
+// Declare let and get value
+let result;
+result = await evaluate("let x = 7;");
+result = await evaluate("x;");
+assertEquals(7, result);
+
+// Re-declare in the same script after declaration in another script.
+assertThrows(() => evaluate("let x = 8; let x = 9;"));
+result = await evaluate("x;");
+assertEquals(7, result);
+
+// Re-declare let as let
+assertDoesNotThrow(async () => result = await evaluate("let x = 8;"));
+result = await evaluate("x;");
+assertEquals(8, result);
+
+await evaluate("let x = 8;");
+
+// Close over let. Inner function is only pre-parsed.
+result = await evaluate("function getter() { return x; }");
+assertEquals(undefined, result);
+result = await evaluate("getter();");
+assertEquals(8, result);
+result = await evaluate("x = 9;");
+assertEquals(9, result);
+result = await evaluate("x;");
+assertEquals(9, result);
+result = await evaluate("getter();");
+assertEquals(9, result);
+// Modifies the original x; does not create a new one/shadow.
+result = await evaluate("let x = 10;");
+assertEquals(undefined, result);
+result = await evaluate("x;");
+assertEquals(10, result);
+result = await evaluate("getter();");
+assertEquals(10, result);
+
+await evaluate("let x = 10");
+
+// Check store from an inner scope.
+result = await evaluate("{ let z; x = 11; } x;");
+assertEquals(11, result);
+
+// Check re-declare from an inner scope does nothing.
+result = await evaluate("{ let z; let x = 12; } x;");
+assertEquals(11, result);
+
+assertThrowsAsync(evaluate("{ let qq = 10; } qq;"),
+    ReferenceError, "qq is not defined");
+
+// Re-declare in the same script (no previous declaration).
+assertThrows(() => result = evaluate("let y = 7; let y = 8;"),
+    SyntaxError, "Identifier 'y' has already been declared");
+
+// Check TDZ; use before initialization.
+// Do not check exact error message, it depends on the path taken through
+// the IC machinery and changes sometimes, causing the test to be flaky.
+assertThrowsAsync(evaluate("a; let a = 7;"), ReferenceError);
+assertThrowsAsync(evaluate("a;"), ReferenceError);
+// This is different to non-REPL mode, which throws the kUndefined error here.
+assertThrowsAsync(evaluate("a = 7;"),
+    ReferenceError, "Cannot access 'a' before initialization");
+
+result = await evaluate("let a = 8;");
+assertEquals(undefined, result);
+result = await evaluate("a;")
+assertEquals(8, result);
+
+// Check TDZ; store before initialization.
+assertThrowsAsync(evaluate("b = 10; let b;"),
+    ReferenceError, "Cannot access 'b' before initialization");
+// Check that b is still broken.
+assertThrowsAsync(evaluate("b = 10; let b;"),
+    ReferenceError, "Cannot access 'b' before initialization");
+// Check that b is still broken when the let defines a value.
+assertThrowsAsync(evaluate("b = 10; let b = 7;"),
+    ReferenceError, "Cannot access 'b' before initialization");
+result = await evaluate("let b = 11;");
+assertEquals(undefined, result);
+// We fixed 'b'!
+result = await evaluate("b;");
+assertEquals(11, result);
+
+// Check that class works the same. Internally there is no difference between
+// class and let so we don't test as extensively as for let.
+result = evaluate("class K {};");
+assertDoesNotThrow(() => result = evaluate("class K {};"));
+
+// many tests for normal/repl script interactions.
+
+// tests with let x = await
+
+// result = evaluate("toString;");
+
+// Re-declare let as const
+evaluate("let z = 10;");
+assertThrows(() => result = evaluate("const z = 9;"),
+    SyntaxError, "Identifier 'z' has already been declared");
+result = await evaluate("z;");
+assertEquals(10, result);
+
+// Re-declare const as const
+result = await evaluate("const c = 10;");
+assertThrows(() => result = evaluate("const c = 11;"),
+    SyntaxError, "Identifier 'c' has already been declared");
+result = await evaluate("c;");
+assertEquals(10, result);
+
+// Const vs. const in same script.
+assertThrows(() => result = evaluate("const d = 9; const d = 10;"),
+SyntaxError, "Identifier 'd' has already been declared");
+
+// Close over const
+result = await evaluate("const e = 10; function closure() { return e; }");
+result = await evaluate("e;");
+assertEquals(10, result);
+
+// Assign to const
+assertThrowsAsync(evaluate("e = 11;"),
+    TypeError, "Assignment to constant variable.");
+result = await evaluate("e;");
+assertEquals(10, result);
+result = await evaluate("closure();");
+assertEquals(10, result);
+
+// Assign to const in TDZ
+assertThrowsAsync(evaluate("f; const f = 11;"),
+    ReferenceError, "Cannot access 'f' before initialization");
+assertThrowsAsync(evaluate("f = 12;"),
+    TypeError, "Assignment to constant variable.");
+
+// Re-declare const as let
+result = await evaluate("const g = 12;");
+assertThrows(() => result = evaluate("let g = 13;"),
+    SyntaxError, "Identifier 'g' has already been declared");
+result = await evaluate("g;");
+assertEquals(12, result);
+
+// Let vs. const in the same script
+assertThrows(() => result = evaluate("let h = 13; const h = 14;"),
+    SyntaxError, "Identifier 'h' has already been declared");
+assertThrows(() => result = evaluate("const i = 13; let i = 14;"),
+    SyntaxError, "Identifier 'i' has already been declared");
+
+// Configurable properties of the global object can be re-declared as let.
+result = await evaluate(`Object.defineProperty(globalThis, 'j', {
+  value: 1,
+  configurable: true
+});`);
+result = await evaluate("j;");
+assertEquals(1, result);
+result = await evaluate("let j = 2;");
+result = await evaluate("j;");
+assertEquals(2, result);
+
+// Non-configurable properties of the global object (also created by plain old
+// top-level var declarations) cannot be re-declared as let.
+result = await evaluate(`Object.defineProperty(globalThis, 'k', {
+  value: 1,
+  configurable: false
+});`);
+result = await evaluate("k;");
+assertEquals(1, result);
+assertThrows(() => result = evaluate("let k = 2;"),
+    SyntaxError, "Identifier 'k' has already been declared");
+result = await evaluate("k;");
+assertEquals(1, result);
+
+// ... Except if you do it in the same script.
+result = await evaluate(`Object.defineProperty(globalThis, 'k2', {
+  value: 1,
+  configurable: false
+});
+let k2 = 2;`);
+result = await evaluate("k2;");
+assertEquals(2, result);
+result = await evaluate("globalThis.k2;");
+assertEquals(1, result);
+
+// But if the property is configurable then both versions are allowed.
+result = await evaluate(`Object.defineProperty(globalThis, 'k3', {
+  value: 1,
+  configurable: true
+});`);
+result = await evaluate("k3;");
+assertEquals(1, result);
+result = await evaluate("let k3 = 2;");
+result = await evaluate("k3;");
+assertEquals(2, result);
+result = await evaluate("globalThis.k3;");
+assertEquals(1, result);
+
+result = await evaluate(`Object.defineProperty(globalThis, 'k4', {
+  value: 1,
+  configurable: true
+});
+let k4 = 2;`);
+result = await evaluate("k4;");
+assertEquals(2, result);
+result = await evaluate("globalThis.k4;");
+assertEquals(1, result);
+
+// Check var followed by let in the same script.
+assertThrows(() => result = evaluate("var k5 = 1; let k5 = 2;"),
+SyntaxError, "Identifier 'k5' has already been declared");
+
+// In different scripts.
+result = await evaluate("var k6 = 1;");
+assertThrows(() => result = evaluate("let k6 = 2;"),
+    SyntaxError, "Identifier 'k6' has already been declared");
+
+// Check let followed by var in the same script.
+assertThrows(() => result = evaluate("let k7 = 1; var k7 = 2;"),
+SyntaxError, "Identifier 'k7' has already been declared");
+
+// In different scripts.
+result = evaluate("let k8 = 1;");
+assertThrows(() => result = evaluate("var k8 = 2;"),
+    SyntaxError, "Identifier 'k8' has already been declared");
+
+// Check var followed by var in the same script.
+result = await evaluate("var k9 = 1; var k9 = 2;");
+result = await evaluate("k9;");
+assertEquals(2, result);
+
+// In different scripts.
+result = await evaluate("var k10 = 1;");
+result = await evaluate("var k10 = 2;");
+result = await evaluate("k10;");
+assertEquals(2, result);
+result = await evaluate("globalThis.k10;");
+assertEquals(2, result);
+
+// typeof should not throw for undeclared variables
+result = await evaluate("typeof k11");
+assertEquals("undefined", result);
+
+// Test lets with names on the object prototype e.g. toString to make sure
+// it only works for own properties.
+// result = evaluate("let valueOf;");
+
+// REPL vs. non-REPL scripts
+
+// We can still read let values cross-mode.
+result = evaluateNonREPL("let l1 = 1; let l2 = 2; let l3 = 3;");
+result = await evaluate("l1;");
+assertEquals(1, result);
+
+// But we can't re-declare page script lets in a REPL script. We might want to
+// later.
+assertThrows(() => result = evaluate("let l1 = 2;"),
+    SyntaxError, "Identifier 'l1' has already been declared");
+
+assertThrows(() => result = evaluate("var l2 = 3;"),
+    SyntaxError, "Identifier 'l2' has already been declared");
+
+assertThrows(() => result = evaluate("const l3 = 4;"),
+    SyntaxError, "Identifier 'l3' has already been declared");
+
+// Re-declaring var across modes works.
+result = evaluateNonREPL("var l4 = 1; const l5 = 1;");
+result = await evaluate("var l4 = 2;");
+result = await evaluate("l4;");
+assertEquals(2, result);
+
+// Const doesn't.
+assertThrows(() => result = evaluate("const l5 = 2;"),
+    SyntaxError, "Identifier 'l5' has already been declared") ;
+result = await evaluate("l5;");
+assertEquals(1, result);
+
+// Now REPL followed by non-REPL
+result = await evaluate("let l6 = 1; const l7 = 2; let l8 = 3;");
+result = evaluateNonREPL("l7;");
+assertEquals(2, result);
+result = evaluateNonREPL("l6;");
+assertEquals(1, result);
+
+// Check that the pattern of `l9; let l9;` does not throw for REPL scripts.
+// If REPL scripts behaved the same as normal scripts, this case would
+// re-introduce the hole in 'l9's script context slot, causing the IC and feedback
+// to 'lie' about the current state.
+result = await evaluate("let l9;");
+result = await evaluate("l9; let l9;"),
+assertEquals(undefined, await evaluate('l9;'));
+
+// Check that binding and re-declaring a function via let works.
+result = evaluate("let fn1 = function() { return 21; }");
+assertEquals(21, fn1());
+result = evaluate("let fn1 = function() { return 42; }");
+assertEquals(42, fn1());
+
+// Check that lazily parsed functions that bind a REPL-let variable work.
+evaluate("let l10 = 21;");
+evaluate("let l10 = 42; function fn2() { return l10; }");
+evaluate("let l10 = 'foo';");
+assertEquals("foo", fn2());
+
+})().catch(e => {
+    print(e);
+    print(e.stack);
+    %AbortJS("Async test is failing");
+});
diff --git a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-async.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-async.js
index c7f55c148ca815..44c83e53b61f4c 100644
--- a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-async.js
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-async.js
@@ -31,7 +31,6 @@ function listener(event, exec_state, event_data, data) {
     fail("new Promise()");
     fail("generator()");
     fail("g.next()");
-    fail("async()");
     fail("Promise.resolve()");
     fail("Promise.reject()");
     fail("p.then(() => {})");
@@ -39,8 +38,15 @@ function listener(event, exec_state, event_data, data) {
     fail("p.finally(() => {})");
     fail("Promise.all([p, p])");
     fail("Promise.race([p, p])");
-    fail("(async function() {})()");
     fail("(async function() { await 1; })()");
+
+    // Calling (but not awaiting) non-side-effecting async functions
+    // should be fine.
+    function succeed(source) {
+      exec_state.frame(0).evaluate(source, true);
+    }
+    succeed("async()");
+    succeed("(async function() {})()");
   } catch (e) {
     exception = e;
     print(e, e.stack);
diff --git a/deps/v8/test/debugger/debug/wasm/debug-step-into-wasm.js b/deps/v8/test/debugger/debug/wasm/debug-step-into-wasm.js
new file mode 100644
index 00000000000000..71ae2a61e72e38
--- /dev/null
+++ b/deps/v8/test/debugger/debug/wasm/debug-step-into-wasm.js
@@ -0,0 +1,92 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+var builder = new WasmModuleBuilder();
+builder.addFunction('sub', kSig_i_ii)
+// input is 2 args of type int and output is int
+.addBody([
+  kExprLocalGet, 0, // local.get i0
+  kExprLocalGet, 1, // local.get i1
+  kExprI32Sub]) // i32.sub i0 i1
+.exportFunc();
+const instance = builder.instantiate();
+const wasm_f = instance.exports.sub;
+
+Debug = debug.Debug;
+
+var exception = null;
+var js_break_line = 0;
+var break_count = 0;
+var wasm_break_count = 0;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    print(event_data.sourceLineText());
+    print(event_data.functionName());
+    if (event_data.sourceLineText() == 'Debug.setListener(null);') {
+      return;
+    }
+    if (event_data.functionName() == 'f') {
+      break_count++;
+      assertTrue(
+        event_data.sourceLineText().indexOf(`Line ${js_break_line}.`) > 0);
+      js_break_line++;
+    } else {
+      assertTrue(event_data.functionName() == 'sub');
+      wasm_break_count++;
+    }
+    exec_state.prepareStep(Debug.StepAction.StepIn);
+  } catch (e) {
+    exception = e;
+    print(e);
+  }
+};
+
+function f() {
+  var result = wasm_f(3, 2); // Line 0.
+  result++; // Line 1.
+  return result; // Line 2.
+}
+assertEquals(2, f());
+
+Debug.setListener(listener);
+// Set a breakpoint on line 0.
+Debug.setBreakPoint(f, 1);
+// Set a breakpoint on line 2.
+Debug.setBreakPoint(f, 3);
+f();
+Debug.setListener(null);
+
+var break_count2 = 0;
+// In the second execution, only break at javascript frame.
+function listener2(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    print(event_data.sourceLineText());
+    if (event_data.sourceLineText() == 'Debug.setListener(null);') {
+      return;
+    }
+    print(event_data.functionName());
+    assertTrue(event_data.sourceLineText().indexOf(`Line `) > 0);
+    assertEquals(event_data.functionName(), 'f');
+    break_count2++;
+    exec_state.prepareStep(Debug.StepAction.StepOut);
+  } catch (e) {
+    exception = e;
+    print(e);
+  }
+};
+
+Debug.setListener(listener2);
+f();
+Debug.setListener(null);
+
+assertEquals(break_count, 3);
+assertEquals(js_break_line, 3);
+assertEquals(wasm_break_count, 4);
+assertEquals(break_count2, 2);
+assertNull(exception);
diff --git a/deps/v8/test/debugger/debug/wasm/frame-inspection.js b/deps/v8/test/debugger/debug/wasm/frame-inspection.js
index 882b7e38b03726..68aeeb5eacef12 100644
--- a/deps/v8/test/debugger/debug/wasm/frame-inspection.js
+++ b/deps/v8/test/debugger/debug/wasm/frame-inspection.js
@@ -14,8 +14,8 @@ var break_count = 0;
 const expected_frames = [
   // func-name; wasm?; pos; line; col
   ['call_debugger', false],        // --
-  ['wasm_2', true, 56, 2, 2],      // --
-  ['wasm_1', true, 52, 3, 2],      // --
+  ['wasm_2', true, 56, 1, 60],     // --
+  ['wasm_1', true, 52, 1, 55],     // --
   ['testFrameInspection', false],  // --
   ['', false]
 ];
diff --git a/deps/v8/test/debugger/debugger.status b/deps/v8/test/debugger/debugger.status
index 85e4cec3eef17b..d74b55dc6d7197 100644
--- a/deps/v8/test/debugger/debugger.status
+++ b/deps/v8/test/debugger/debugger.status
@@ -11,9 +11,6 @@
   # not work, but we expect it to not crash.
   'debug/debug-step-turbofan': [PASS, FAIL],
 
-  # BUG (v8:9721)
-  'debug/es6/generators-relocation': [FAIL],
-
   # Issue 3641: The new 'then' semantics suppress some exceptions.
   # These tests may be changed or removed when 'chain' is deprecated.
   'debug/es6/debug-promises/reject-with-throw-in-reject': [FAIL],
@@ -39,7 +36,7 @@
 
 ##############################################################################
 ['variant == stress', {
-  # TODO(jarin/mstarzinger): Functions with eval or debugger now get optimized
+  # TODO(turbofan): Functions with eval or debugger now get optimized
   # with Turbofan, which has issues with the debugger issues.
   'debug/debug-evaluate-locals': [FAIL],
 
@@ -131,18 +128,24 @@
   # TODO(v8:7777): Re-enable once wasm is supported in jitless mode.
   'debug/wasm/*': [SKIP],
   'regress/regress-crbug-840288': [SKIP],
+  'regress/regress-crbug-1032042': [SKIP],
   'wasm-*': [SKIP],
 }], # lite_mode or variant == jitless
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-
 ##############################################################################
 ['variant == turboprop', {
   # Deopts differently than TurboFan.
   'debug/debug-optimize': [SKIP],
 }],  # variant == turboprop
 
+##############################################################################
+# Liftoff needs to be enabled before running these tests.
+['arch in (s390, s390x, ppc, ppc64)', {
+  'regress/regress-crbug-1032042': [SKIP],
+  'regress/regress-crbug-840288': [SKIP],
+  'debug/wasm/debug-step-into-wasm': [SKIP],
+  'debug/wasm/asm-debug': [SKIP],
+  'debug/wasm/frame-inspection': [SKIP],
+}],
+
 ]
diff --git a/deps/v8/test/debugger/regress/regress-crbug-10132.js b/deps/v8/test/debugger/regress/regress-crbug-10132.js
new file mode 100644
index 00000000000000..b126837ebca3c1
--- /dev/null
+++ b/deps/v8/test/debugger/regress/regress-crbug-10132.js
@@ -0,0 +1,10 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --print-break-location
+
+// Ensure that --print-break-location correctly collects source positions on
+// breaking.
+debug.Debug
+debugger;
diff --git a/deps/v8/test/debugger/regress/regress-crbug-1032042.js b/deps/v8/test/debugger/regress/regress-crbug-1032042.js
new file mode 100644
index 00000000000000..4fc96e803845f7
--- /dev/null
+++ b/deps/v8/test/debugger/regress/regress-crbug-1032042.js
@@ -0,0 +1,44 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+const Debug = new DebugWrapper();
+Debug.enable();
+
+// Record the ID of the first script reported. This is to ignore
+// the (now deprecated) fake scripts that are generated for every
+// Wasm module.
+let scriptId;
+Debug.setListener((eventType, execState, eventData, data) => {
+    assertEquals(Debug.DebugEvent.AfterCompile, eventType);
+    if (scriptId === undefined) scriptId = eventData.scriptId;
+});
+
+// Create a simple Wasm script, which will be caught by the event listener.
+const builder = new WasmModuleBuilder();
+builder.addFunction('sub', kSig_i_ii)
+// input is 2 args of type int and output is int
+.addBody([
+  kExprLocalGet, 0, // local.get i0
+  kExprLocalGet, 1, // local.get i1
+  kExprI32Sub]) // i32.sub i0 i1
+.exportFunc();
+const instance = builder.instantiate();
+
+// By now we should have recorded the ID of the Wasm script above.
+assertNotEquals(undefined, scriptId);
+
+// Disable and re-enable the Debugger and collect the reported
+// script IDs.
+const scriptIds = new Set();
+Debug.disable();
+Debug.setListener((eventType, execState, eventData, data) => {
+    assertEquals(Debug.DebugEvent.AfterCompile, eventType);
+    scriptIds.add(eventData.scriptId);
+});
+Debug.enable();
+
+// Make sure the Wasm script was reported.
+assertTrue(scriptIds.has(scriptId));
diff --git a/deps/v8/test/debugger/regress/regress-crbug-840288.js b/deps/v8/test/debugger/regress/regress-crbug-840288.js
index ff08fd90d06b78..63470dad1a0837 100644
--- a/deps/v8/test/debugger/regress/regress-crbug-840288.js
+++ b/deps/v8/test/debugger/regress/regress-crbug-840288.js
@@ -9,7 +9,10 @@ Debug = debug.Debug
 function listener(event, exec_state, event_data, data) {
   if (event == Debug.DebugEvent.AfterCompile) {
     // The actual source doesn't matter, just don't crash.
-    assertEquals("func $main\nend\n", event_data.script().source());
+    var source = event_data.script().source();
+    // Source will be empty for the script representing the entire module,
+    // disassembly for the script representing just the function.
+    assertTrue(source == "func $main\nend\n" || source == "");
   }
 };
 
diff --git a/deps/v8/test/debugger/test-api.js b/deps/v8/test/debugger/test-api.js
index 511fb338161bc5..73f16e0acca5c1 100644
--- a/deps/v8/test/debugger/test-api.js
+++ b/deps/v8/test/debugger/test-api.js
@@ -634,6 +634,12 @@ class DebugWrapper {
     return this.reconstructRemoteObject(result);
   }
 
+  evaluateGlobalREPL(expr) {
+    return %RuntimeEvaluateREPL(expr).then(value => {
+      return value[".repl_result"];
+    });
+  }
+
   eventDataException(params) {
     switch (params.data.type) {
       case "string": {
diff --git a/deps/v8/test/fuzzer/fuzzer.status b/deps/v8/test/fuzzer/fuzzer.status
index 5a79a0171f7623..65e51c238b77cc 100644
--- a/deps/v8/test/fuzzer/fuzzer.status
+++ b/deps/v8/test/fuzzer/fuzzer.status
@@ -13,9 +13,4 @@
   'wasm_compile/*': [SKIP],
 }], # lite_mode or variant == jitless
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-
 ]
diff --git a/deps/v8/test/fuzzer/multi-return.cc b/deps/v8/test/fuzzer/multi-return.cc
index 26bb70fce70d47..da151e7115cfc5 100644
--- a/deps/v8/test/fuzzer/multi-return.cc
+++ b/deps/v8/test/fuzzer/multi-return.cc
@@ -142,8 +142,10 @@ std::shared_ptr<wasm::NativeModule> AllocateNativeModule(i::Isolate* isolate,
   // We have to add the code object to a NativeModule, because the
   // WasmCallDescriptor assumes that code is on the native heap and not
   // within a code object.
-  return isolate->wasm_engine()->NewNativeModule(
-      isolate, i::wasm::kAllWasmFeatures, code_size, false, std::move(module));
+  auto native_module = isolate->wasm_engine()->NewNativeModule(
+      isolate, i::wasm::WasmFeatures::All(), std::move(module), code_size);
+  native_module->SetWireBytes({});
+  return native_module;
 }
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
diff --git a/deps/v8/test/fuzzer/parser.cc b/deps/v8/test/fuzzer/parser.cc
index 1e89fb0e31de78..c411d933d6578f 100644
--- a/deps/v8/test/fuzzer/parser.cc
+++ b/deps/v8/test/fuzzer/parser.cc
@@ -19,18 +19,14 @@
 
 bool IsValidInput(const uint8_t* data, size_t size) {
   // Ignore too long inputs as they tend to find OOM or timeouts, not real bugs.
-  if (size > 2048) {
-    return false;
-  }
+  if (size > 2048) return false;
 
-  std::list<char> parentheses;
+  std::vector<char> parentheses;
   const char* ptr = reinterpret_cast<const char*>(data);
 
   for (size_t i = 0; i != size; ++i) {
     // Check that all characters in the data are valid.
-    if (!(std::isspace(ptr[i]) || std::isprint(ptr[i]))) {
-      return false;
-    }
+    if (!std::isspace(ptr[i]) && !std::isprint(ptr[i])) return false;
 
     // Check balance of parentheses in the data.
     switch (ptr[i]) {
@@ -40,15 +36,15 @@ bool IsValidInput(const uint8_t* data, size_t size) {
         parentheses.push_back(ptr[i]);
         break;
       case ')':
-        if (parentheses.back() != '(') return false;
+        if (parentheses.empty() || parentheses.back() != '(') return false;
         parentheses.pop_back();
         break;
       case ']':
-        if (parentheses.back() != '[') return false;
+        if (parentheses.empty() || parentheses.back() != '[') return false;
         parentheses.pop_back();
         break;
       case '}':
-        if (parentheses.back() != '{') return false;
+        if (parentheses.empty() || parentheses.back() != '{') return false;
         parentheses.pop_back();
         break;
       default:
@@ -84,8 +80,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
 
   v8::internal::Handle<v8::internal::Script> script =
       factory->NewScript(source.ToHandleChecked());
-  v8::internal::ParseInfo info(i_isolate, script);
-  if (!v8::internal::parsing::ParseProgram(&info, i_isolate)) {
+  v8::internal::ParseInfo info(i_isolate, *script);
+  if (!v8::internal::parsing::ParseProgram(&info, script, i_isolate)) {
     i_isolate->OptionalRescheduleException(true);
   }
   isolate->RequestGarbageCollectionForTesting(
diff --git a/deps/v8/test/fuzzer/wasm-async.cc b/deps/v8/test/fuzzer/wasm-async.cc
index 36e3757f59a1ae..e52b418784eb20 100644
--- a/deps/v8/test/fuzzer/wasm-async.cc
+++ b/deps/v8/test/fuzzer/wasm-async.cc
@@ -68,7 +68,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   testing::SetupIsolateForWasmModule(i_isolate);
 
   bool done = false;
-  auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
   constexpr const char* kAPIMethodName = "WasmAsyncFuzzer.compile";
   i_isolate->wasm_engine()->AsyncCompile(
       i_isolate, enabled_features,
diff --git a/deps/v8/test/fuzzer/wasm-compile.cc b/deps/v8/test/fuzzer/wasm-compile.cc
index 10e41e103936c2..3ffaa89203c04c 100644
--- a/deps/v8/test/fuzzer/wasm-compile.cc
+++ b/deps/v8/test/fuzzer/wasm-compile.cc
@@ -179,6 +179,13 @@ class WasmGenerator {
       case kExprF64LoadMem:
       case kExprI64StoreMem:
       case kExprF64StoreMem:
+      case kExprI64AtomicStore:
+      case kExprI64AtomicLoad:
+      case kExprI64AtomicAdd:
+      case kExprI64AtomicSub:
+      case kExprI64AtomicAnd:
+      case kExprI64AtomicOr:
+      case kExprI64AtomicXor:
         return 3;
       case kExprI32LoadMem:
       case kExprI64LoadMem32S:
@@ -187,6 +194,20 @@ class WasmGenerator {
       case kExprI32StoreMem:
       case kExprI64StoreMem32:
       case kExprF32StoreMem:
+      case kExprI32AtomicStore:
+      case kExprI64AtomicStore32U:
+      case kExprI32AtomicLoad:
+      case kExprI64AtomicLoad32U:
+      case kExprI32AtomicAdd:
+      case kExprI32AtomicSub:
+      case kExprI32AtomicAnd:
+      case kExprI32AtomicOr:
+      case kExprI32AtomicXor:
+      case kExprI64AtomicAdd32U:
+      case kExprI64AtomicSub32U:
+      case kExprI64AtomicAnd32U:
+      case kExprI64AtomicOr32U:
+      case kExprI64AtomicXor32U:
         return 2;
       case kExprI32LoadMem16S:
       case kExprI32LoadMem16U:
@@ -194,6 +215,20 @@ class WasmGenerator {
       case kExprI64LoadMem16U:
       case kExprI32StoreMem16:
       case kExprI64StoreMem16:
+      case kExprI32AtomicStore16U:
+      case kExprI64AtomicStore16U:
+      case kExprI32AtomicLoad16U:
+      case kExprI64AtomicLoad16U:
+      case kExprI32AtomicAdd16U:
+      case kExprI32AtomicSub16U:
+      case kExprI32AtomicAnd16U:
+      case kExprI32AtomicOr16U:
+      case kExprI32AtomicXor16U:
+      case kExprI64AtomicAdd16U:
+      case kExprI64AtomicSub16U:
+      case kExprI64AtomicAnd16U:
+      case kExprI64AtomicOr16U:
+      case kExprI64AtomicXor16U:
         return 1;
       case kExprI32LoadMem8S:
       case kExprI32LoadMem8U:
@@ -201,6 +236,20 @@ class WasmGenerator {
       case kExprI64LoadMem8U:
       case kExprI32StoreMem8:
       case kExprI64StoreMem8:
+      case kExprI32AtomicStore8U:
+      case kExprI64AtomicStore8U:
+      case kExprI32AtomicLoad8U:
+      case kExprI64AtomicLoad8U:
+      case kExprI32AtomicAdd8U:
+      case kExprI32AtomicSub8U:
+      case kExprI32AtomicAnd8U:
+      case kExprI32AtomicOr8U:
+      case kExprI32AtomicXor8U:
+      case kExprI64AtomicAdd8U:
+      case kExprI64AtomicSub8U:
+      case kExprI64AtomicAnd8U:
+      case kExprI64AtomicOr8U:
+      case kExprI64AtomicXor8U:
         return 0;
       default:
         return 0;
@@ -215,7 +264,24 @@ class WasmGenerator {
     // Generate the index and the arguments, if any.
     Generate<kWasmI32, arg_types...>(data);
 
-    builder_->Emit(memory_op);
+    if ((memory_op & 0xfe00) == 0xfe00) {
+      // This is an atomic-load or atomic-store.
+      builder_->EmitWithPrefix(memory_op);
+    } else {
+      builder_->Emit(memory_op);
+    }
+    builder_->EmitU32V(align);
+    builder_->EmitU32V(offset);
+  }
+
+  template <WasmOpcode Op, ValueType... Args>
+  void atomic_op(DataRange* data) {
+    const uint8_t align = data->get<uint8_t>() % (max_alignment(Op) + 1);
+    const uint32_t offset = data->get<uint32_t>();
+
+    Generate<Args...>(data);
+    builder_->EmitWithPrefix(Op);
+
     builder_->EmitU32V(align);
     builder_->EmitU32V(offset);
   }
@@ -413,15 +479,15 @@ class WasmGenerator {
 
   void grow_memory(DataRange* data);
 
-  using generate_fn = void (WasmGenerator::*const)(DataRange*);
+  using GenerateFn = void (WasmGenerator::*const)(DataRange*);
 
   template <size_t N>
-  void GenerateOneOf(generate_fn (&alternates)[N], DataRange* data) {
+  void GenerateOneOf(GenerateFn (&alternatives)[N], DataRange* data) {
     static_assert(N < std::numeric_limits<uint8_t>::max(),
-                  "Too many alternates. Replace with a bigger type if needed.");
+                  "Too many alternatives. Use a bigger type if needed.");
     const auto which = data->get<uint8_t>();
 
-    generate_fn alternate = alternates[which % N];
+    GenerateFn alternate = alternatives[which % N];
     (this->*alternate)(data);
   }
 
@@ -492,7 +558,7 @@ void WasmGenerator::Generate<kWasmStmt>(DataRange* data) {
   GeneratorRecursionScope rec_scope(this);
   if (recursion_limit_reached() || data->size() == 0) return;
 
-  constexpr generate_fn alternates[] = {
+  constexpr GenerateFn alternatives[] = {
       &WasmGenerator::sequence<kWasmStmt, kWasmStmt>,
       &WasmGenerator::sequence<kWasmStmt, kWasmStmt, kWasmStmt, kWasmStmt>,
       &WasmGenerator::sequence<kWasmStmt, kWasmStmt, kWasmStmt, kWasmStmt,
@@ -513,6 +579,13 @@ void WasmGenerator::Generate<kWasmStmt>(DataRange* data) {
       &WasmGenerator::memop<kExprI64StoreMem32, kWasmI64>,
       &WasmGenerator::memop<kExprF32StoreMem, kWasmF32>,
       &WasmGenerator::memop<kExprF64StoreMem, kWasmF64>,
+      &WasmGenerator::memop<kExprI32AtomicStore, kWasmI32>,
+      &WasmGenerator::memop<kExprI32AtomicStore8U, kWasmI32>,
+      &WasmGenerator::memop<kExprI32AtomicStore16U, kWasmI32>,
+      &WasmGenerator::memop<kExprI64AtomicStore, kWasmI64>,
+      &WasmGenerator::memop<kExprI64AtomicStore8U, kWasmI64>,
+      &WasmGenerator::memop<kExprI64AtomicStore16U, kWasmI64>,
+      &WasmGenerator::memop<kExprI64AtomicStore32U, kWasmI64>,
 
       &WasmGenerator::drop,
 
@@ -521,7 +594,7 @@ void WasmGenerator::Generate<kWasmStmt>(DataRange* data) {
       &WasmGenerator::set_local,
       &WasmGenerator::set_global};
 
-  GenerateOneOf(alternates, data);
+  GenerateOneOf(alternatives, data);
 }
 
 template <>
@@ -532,7 +605,7 @@ void WasmGenerator::Generate<kWasmI32>(DataRange* data) {
     return;
   }
 
-  constexpr generate_fn alternates[] = {
+  constexpr GenerateFn alternatives[] = {
       &WasmGenerator::i32_const<1>,
       &WasmGenerator::i32_const<2>,
       &WasmGenerator::i32_const<3>,
@@ -607,6 +680,25 @@ void WasmGenerator::Generate<kWasmI32>(DataRange* data) {
       &WasmGenerator::memop<kExprI32LoadMem8U>,
       &WasmGenerator::memop<kExprI32LoadMem16S>,
       &WasmGenerator::memop<kExprI32LoadMem16U>,
+      &WasmGenerator::memop<kExprI32AtomicLoad>,
+      &WasmGenerator::memop<kExprI32AtomicLoad8U>,
+      &WasmGenerator::memop<kExprI32AtomicLoad16U>,
+
+      &WasmGenerator::atomic_op<kExprI32AtomicAdd, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicSub, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicAnd, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicOr, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicXor, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicAdd8U, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicSub8U, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicAnd8U, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicOr8U, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicXor8U, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicAdd16U, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicSub16U, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicAnd16U, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicOr16U, kWasmI32, kWasmI32>,
+      &WasmGenerator::atomic_op<kExprI32AtomicXor16U, kWasmI32, kWasmI32>,
 
       &WasmGenerator::current_memory,
       &WasmGenerator::grow_memory,
@@ -619,7 +711,7 @@ void WasmGenerator::Generate<kWasmI32>(DataRange* data) {
 
       &WasmGenerator::call<kWasmI32>};
 
-  GenerateOneOf(alternates, data);
+  GenerateOneOf(alternatives, data);
 }
 
 template <>
@@ -630,7 +722,7 @@ void WasmGenerator::Generate<kWasmI64>(DataRange* data) {
     return;
   }
 
-  constexpr generate_fn alternates[] = {
+  constexpr GenerateFn alternatives[] = {
       &WasmGenerator::i64_const<1>,
       &WasmGenerator::i64_const<2>,
       &WasmGenerator::i64_const<3>,
@@ -678,6 +770,31 @@ void WasmGenerator::Generate<kWasmI64>(DataRange* data) {
       &WasmGenerator::memop<kExprI64LoadMem16U>,
       &WasmGenerator::memop<kExprI64LoadMem32S>,
       &WasmGenerator::memop<kExprI64LoadMem32U>,
+      &WasmGenerator::memop<kExprI64AtomicLoad>,
+      &WasmGenerator::memop<kExprI64AtomicLoad8U>,
+      &WasmGenerator::memop<kExprI64AtomicLoad16U>,
+      &WasmGenerator::memop<kExprI64AtomicLoad32U>,
+
+      &WasmGenerator::atomic_op<kExprI64AtomicAdd, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicSub, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicAnd, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicOr, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicXor, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicAdd8U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicSub8U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicAnd8U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicOr8U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicXor8U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicAdd16U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicSub16U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicAnd16U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicOr16U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicXor16U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicAdd32U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicSub32U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicAnd32U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicOr32U, kWasmI32, kWasmI64>,
+      &WasmGenerator::atomic_op<kExprI64AtomicXor32U, kWasmI32, kWasmI64>,
 
       &WasmGenerator::get_local<kWasmI64>,
       &WasmGenerator::tee_local<kWasmI64>,
@@ -687,7 +804,7 @@ void WasmGenerator::Generate<kWasmI64>(DataRange* data) {
 
       &WasmGenerator::call<kWasmI64>};
 
-  GenerateOneOf(alternates, data);
+  GenerateOneOf(alternatives, data);
 }
 
 template <>
@@ -698,14 +815,32 @@ void WasmGenerator::Generate<kWasmF32>(DataRange* data) {
     return;
   }
 
-  constexpr generate_fn alternates[] = {
+  constexpr GenerateFn alternatives[] = {
       &WasmGenerator::sequence<kWasmF32, kWasmStmt>,
       &WasmGenerator::sequence<kWasmStmt, kWasmF32>,
       &WasmGenerator::sequence<kWasmStmt, kWasmF32, kWasmStmt>,
 
+      &WasmGenerator::op<kExprF32Abs, kWasmF32>,
+      &WasmGenerator::op<kExprF32Neg, kWasmF32>,
+      &WasmGenerator::op<kExprF32Ceil, kWasmF32>,
+      &WasmGenerator::op<kExprF32Floor, kWasmF32>,
+      &WasmGenerator::op<kExprF32Trunc, kWasmF32>,
+      &WasmGenerator::op<kExprF32NearestInt, kWasmF32>,
+      &WasmGenerator::op<kExprF32Sqrt, kWasmF32>,
       &WasmGenerator::op<kExprF32Add, kWasmF32, kWasmF32>,
       &WasmGenerator::op<kExprF32Sub, kWasmF32, kWasmF32>,
       &WasmGenerator::op<kExprF32Mul, kWasmF32, kWasmF32>,
+      &WasmGenerator::op<kExprF32Div, kWasmF32, kWasmF32>,
+      &WasmGenerator::op<kExprF32Min, kWasmF32, kWasmF32>,
+      &WasmGenerator::op<kExprF32Max, kWasmF32, kWasmF32>,
+      &WasmGenerator::op<kExprF32CopySign, kWasmF32, kWasmF32>,
+
+      &WasmGenerator::op<kExprF32SConvertI32, kWasmI32>,
+      &WasmGenerator::op<kExprF32UConvertI32, kWasmI32>,
+      &WasmGenerator::op<kExprF32SConvertI64, kWasmI64>,
+      &WasmGenerator::op<kExprF32UConvertI64, kWasmI64>,
+      &WasmGenerator::op<kExprF32ConvertF64, kWasmF64>,
+      &WasmGenerator::op<kExprF32ReinterpretI32, kWasmI32>,
 
       &WasmGenerator::block<kWasmF32>,
       &WasmGenerator::loop<kWasmF32>,
@@ -722,7 +857,7 @@ void WasmGenerator::Generate<kWasmF32>(DataRange* data) {
 
       &WasmGenerator::call<kWasmF32>};
 
-  GenerateOneOf(alternates, data);
+  GenerateOneOf(alternatives, data);
 }
 
 template <>
@@ -733,14 +868,32 @@ void WasmGenerator::Generate<kWasmF64>(DataRange* data) {
     return;
   }
 
-  constexpr generate_fn alternates[] = {
+  constexpr GenerateFn alternatives[] = {
       &WasmGenerator::sequence<kWasmF64, kWasmStmt>,
       &WasmGenerator::sequence<kWasmStmt, kWasmF64>,
       &WasmGenerator::sequence<kWasmStmt, kWasmF64, kWasmStmt>,
 
+      &WasmGenerator::op<kExprF64Abs, kWasmF64>,
+      &WasmGenerator::op<kExprF64Neg, kWasmF64>,
+      &WasmGenerator::op<kExprF64Ceil, kWasmF64>,
+      &WasmGenerator::op<kExprF64Floor, kWasmF64>,
+      &WasmGenerator::op<kExprF64Trunc, kWasmF64>,
+      &WasmGenerator::op<kExprF64NearestInt, kWasmF64>,
+      &WasmGenerator::op<kExprF64Sqrt, kWasmF64>,
       &WasmGenerator::op<kExprF64Add, kWasmF64, kWasmF64>,
       &WasmGenerator::op<kExprF64Sub, kWasmF64, kWasmF64>,
       &WasmGenerator::op<kExprF64Mul, kWasmF64, kWasmF64>,
+      &WasmGenerator::op<kExprF64Div, kWasmF64, kWasmF64>,
+      &WasmGenerator::op<kExprF64Min, kWasmF64, kWasmF64>,
+      &WasmGenerator::op<kExprF64Max, kWasmF64, kWasmF64>,
+      &WasmGenerator::op<kExprF64CopySign, kWasmF64, kWasmF64>,
+
+      &WasmGenerator::op<kExprF64SConvertI32, kWasmI32>,
+      &WasmGenerator::op<kExprF64UConvertI32, kWasmI32>,
+      &WasmGenerator::op<kExprF64SConvertI64, kWasmI64>,
+      &WasmGenerator::op<kExprF64UConvertI64, kWasmI64>,
+      &WasmGenerator::op<kExprF64ConvertF32, kWasmF32>,
+      &WasmGenerator::op<kExprF64ReinterpretI64, kWasmI64>,
 
       &WasmGenerator::block<kWasmF64>,
       &WasmGenerator::loop<kWasmF64>,
@@ -757,7 +910,7 @@ void WasmGenerator::Generate<kWasmF64>(DataRange* data) {
 
       &WasmGenerator::call<kWasmF64>};
 
-  GenerateOneOf(alternates, data);
+  GenerateOneOf(alternatives, data);
 }
 
 void WasmGenerator::grow_memory(DataRange* data) {
@@ -850,6 +1003,8 @@ class WasmCompileFuzzer : public WasmExecutionFuzzer {
     }
 
     builder.SetMaxMemorySize(32);
+    // We enable shared memory to be able to test atomics.
+    builder.SetHasSharedMemory();
     builder.WriteTo(buffer);
 
     *num_args = 3;
diff --git a/deps/v8/test/fuzzer/wasm-fuzzer-common.cc b/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
index 35e942b2622906..9fbfa0b3c3b819 100644
--- a/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
+++ b/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
@@ -120,7 +120,7 @@ std::ostream& operator<<(std::ostream& os, const PrintName& name) {
 void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
                       bool compiles) {
   constexpr bool kVerifyFunctions = false;
-  auto enabled_features = i::wasm::WasmFeaturesFromIsolate(isolate);
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(isolate);
   ModuleResult module_res = DecodeWasmModule(
       enabled_features, wire_bytes.start(), wire_bytes.end(), kVerifyFunctions,
       ModuleOrigin::kWasmOrigin, isolate->counters(),
@@ -306,7 +306,7 @@ void WasmExecutionFuzzer::FuzzWasmModule(Vector<const uint8_t> data,
   ModuleWireBytes wire_bytes(buffer.begin(), buffer.end());
 
   // Compile with Turbofan here. Liftoff will be tested later.
-  auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
   MaybeHandle<WasmModuleObject> compiled_module;
   {
     // Explicitly enable Liftoff, disable tiering and set the tier_mask. This
diff --git a/deps/v8/test/fuzzer/wasm.cc b/deps/v8/test/fuzzer/wasm.cc
index e8aebbfbecc23f..5c68030408269f 100644
--- a/deps/v8/test/fuzzer/wasm.cc
+++ b/deps/v8/test/fuzzer/wasm.cc
@@ -53,7 +53,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   i::HandleScope scope(i_isolate);
   i::wasm::ErrorThrower thrower(i_isolate, "wasm fuzzer");
   i::Handle<i::WasmModuleObject> module_object;
-  auto enabled_features = i::wasm::WasmFeaturesFromIsolate(i_isolate);
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
   bool compiles =
       i_isolate->wasm_engine()
           ->SyncCompile(i_isolate, enabled_features, &thrower, wire_bytes)
diff --git a/deps/v8/test/inspector/BUILD.gn b/deps/v8/test/inspector/BUILD.gn
index f0ca9fd6936623..eb8c8f0863e8c6 100644
--- a/deps/v8/test/inspector/BUILD.gn
+++ b/deps/v8/test/inspector/BUILD.gn
@@ -42,6 +42,7 @@ v8_executable("inspector-test") {
     "json-parse.js",
     "protocol-test.js",
     "runtime/",
+    "runtime-call-stats/",
     "sessions/",
     "testcfg.py",
     "type-profiler/",
diff --git a/deps/v8/test/inspector/console/scoped-variables-expected.txt b/deps/v8/test/inspector/console/scoped-variables-expected.txt
index cbafd502ffed21..1659df4cd5581c 100644
--- a/deps/v8/test/inspector/console/scoped-variables-expected.txt
+++ b/deps/v8/test/inspector/console/scoped-variables-expected.txt
@@ -15,7 +15,7 @@ Evaluating 'let a = 239;'
         columnNumber : 0
         exception : {
             className : SyntaxError
-            description : SyntaxError: Identifier 'a' has already been declared     at <anonymous>:1:1
+            description : SyntaxError: Identifier 'a' has already been declared
             objectId : <objectId>
             subtype : error
             type : object
@@ -27,7 +27,7 @@ Evaluating 'let a = 239;'
     }
     result : {
         className : SyntaxError
-        description : SyntaxError: Identifier 'a' has already been declared     at <anonymous>:1:1
+        description : SyntaxError: Identifier 'a' has already been declared
         objectId : <objectId>
         subtype : error
         type : object
diff --git a/deps/v8/test/inspector/cpu-profiler/coverage-block-expected.txt b/deps/v8/test/inspector/cpu-profiler/coverage-block-expected.txt
index c99c1710afeeec..b5e90df2c7c483 100644
--- a/deps/v8/test/inspector/cpu-profiler/coverage-block-expected.txt
+++ b/deps/v8/test/inspector/cpu-profiler/coverage-block-expected.txt
@@ -6,6 +6,7 @@ Running test: testPreciseCountBaseline
     result : {
         result : [
         ]
+        timestamp : <timestamp>
     }
 }
 {
@@ -13,6 +14,7 @@ Running test: testPreciseCountBaseline
     result : {
         result : [
         ]
+        timestamp : <timestamp>
     }
 }
 
@@ -109,6 +111,7 @@ Running test: testPreciseCountCoverage
                 url : 
             }
         ]
+        timestamp : <timestamp>
     }
 }
 {
@@ -116,6 +119,7 @@ Running test: testPreciseCountCoverage
     result : {
         result : [
         ]
+        timestamp : <timestamp>
     }
 }
 
@@ -195,6 +199,7 @@ Running test: testPreciseCountCoverageIncremental
                 url : testPreciseCountCoverageIncremental
             }
         ]
+        timestamp : <timestamp>
     }
 }
 {
@@ -312,6 +317,7 @@ Running test: testPreciseCountCoverageIncremental
                 url : 
             }
         ]
+        timestamp : <timestamp>
     }
 }
 
@@ -711,6 +717,7 @@ Running test: testEnablePreciseCountCoverageAtPause
                 url : 
             }
         ]
+        timestamp : <timestamp>
     }
 }
 
@@ -780,6 +787,7 @@ Running test: testPreciseBinaryCoverage
                 url : testPreciseBinaryCoverage
             }
         ]
+        timestamp : <timestamp>
     }
 }
 {
@@ -866,6 +874,7 @@ Running test: testPreciseBinaryCoverage
                 url : 
             }
         ]
+        timestamp : <timestamp>
     }
 }
 
@@ -875,6 +884,7 @@ Running test: testPreciseEmptyScriptCoverageEntries
     result : {
         result : [
         ]
+        timestamp : <timestamp>
     }
 }
 
@@ -975,6 +985,7 @@ Running test: testPreciseCountCoveragePartial
                 url : testPreciseCountCoveragePartial
             }
         ]
+        timestamp : <timestamp>
     }
 }
 {
@@ -1027,5 +1038,6 @@ Running test: testPreciseCountCoveragePartial
                 url : 
             }
         ]
+        timestamp : <timestamp>
     }
 }
diff --git a/deps/v8/test/inspector/cpu-profiler/coverage-expected.txt b/deps/v8/test/inspector/cpu-profiler/coverage-expected.txt
index 15b4101a273b44..f25f1d8d7ab2b6 100644
--- a/deps/v8/test/inspector/cpu-profiler/coverage-expected.txt
+++ b/deps/v8/test/inspector/cpu-profiler/coverage-expected.txt
@@ -6,6 +6,7 @@ Running test: testPreciseCountBaseline
     result : {
         result : [
         ]
+        timestamp : <timestamp>
     }
 }
 {
@@ -13,6 +14,7 @@ Running test: testPreciseCountBaseline
     result : {
         result : [
         ]
+        timestamp : <timestamp>
     }
 }
 
@@ -99,6 +101,7 @@ Running test: testPreciseCountCoverage
                 url : 
             }
         ]
+        timestamp : <timestamp>
     }
 }
 {
@@ -106,6 +109,7 @@ Running test: testPreciseCountCoverage
     result : {
         result : [
         ]
+        timestamp : <timestamp>
     }
 }
 
@@ -505,6 +509,7 @@ Running test: testEnablePreciseCountCoverageAtPause
                 url : 
             }
         ]
+        timestamp : <timestamp>
     }
 }
 
@@ -574,6 +579,7 @@ Running test: testPreciseBinaryCoverage
                 url : testPreciseBinaryCoverage
             }
         ]
+        timestamp : <timestamp>
     }
 }
 {
@@ -660,6 +666,7 @@ Running test: testPreciseBinaryCoverage
                 url : 
             }
         ]
+        timestamp : <timestamp>
     }
 }
 
@@ -669,6 +676,7 @@ Running test: testPreciseEmptyScriptCoverageEntries
     result : {
         result : [
         ]
+        timestamp : <timestamp>
     }
 }
 
@@ -769,6 +777,7 @@ Running test: testPreciseCountCoveragePartial
                 url : testPreciseCountCoveragePartial
             }
         ]
+        timestamp : <timestamp>
     }
 }
 {
@@ -821,5 +830,6 @@ Running test: testPreciseCountCoveragePartial
                 url : 
             }
         ]
+        timestamp : <timestamp>
     }
 }
diff --git a/deps/v8/test/inspector/debugger/class-private-methods-expected.txt b/deps/v8/test/inspector/debugger/class-private-methods-expected.txt
new file mode 100644
index 00000000000000..d54076b6d53362
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/class-private-methods-expected.txt
@@ -0,0 +1,205 @@
+Test private class methods
+
+Running test: testScopesPaused
+privateProperties on the base class instance
+[
+    [0] : {
+        name : #inc
+        value : {
+            className : Function
+            description : #inc() { this.#field++; return this.#field; }
+            objectId : <objectId>
+            type : function
+        }
+    }
+    [1] : {
+        name : #writeOnly
+        set : {
+            className : Function
+            description : set #writeOnly(val) { this.#field = val; }
+            objectId : <objectId>
+            type : function
+        }
+    }
+    [2] : {
+        get : {
+            className : Function
+            description : get #readOnly() { return this.#field; }
+            objectId : <objectId>
+            type : function
+        }
+        name : #readOnly
+    }
+    [3] : {
+        get : {
+            className : Function
+            description : get #accessor() { return this.#field; }
+            objectId : <objectId>
+            type : function
+        }
+        name : #accessor
+        set : {
+            className : Function
+            description : set #accessor(val) { this.#field = val; }
+            objectId : <objectId>
+            type : function
+        }
+    }
+    [4] : {
+        name : #field
+        value : {
+            description : 2
+            type : number
+            value : 2
+        }
+    }
+]
+Evaluating private methods
+{
+    result : {
+        description : 3
+        type : number
+        value : 3
+    }
+}
+Evaluating private methods
+{
+    result : {
+        description : 4
+        type : number
+        value : 4
+    }
+}
+Evaluating private accessors
+{
+    result : {
+        description : 5
+        type : number
+        value : 5
+    }
+}
+Evaluating read-only accessor
+{
+    result : {
+        description : 5
+        type : number
+        value : 5
+    }
+}
+Evaluating write-only accessor
+{
+    result : {
+        description : 0
+        type : number
+        value : 0
+    }
+}
+privateProperties on the subclass instance
+[
+    [0] : {
+        name : #inc
+        value : {
+            className : Function
+            description : #inc() { this.#field++; return this.#field; }
+            objectId : <objectId>
+            type : function
+        }
+    }
+    [1] : {
+        name : #writeOnly
+        set : {
+            className : Function
+            description : set #writeOnly(val) { this.#field = val; }
+            objectId : <objectId>
+            type : function
+        }
+    }
+    [2] : {
+        get : {
+            className : Function
+            description : get #readOnly() { return this.#field; }
+            objectId : <objectId>
+            type : function
+        }
+        name : #readOnly
+    }
+    [3] : {
+        get : {
+            className : Function
+            description : get #accessor() { return this.#field; }
+            objectId : <objectId>
+            type : function
+        }
+        name : #accessor
+        set : {
+            className : Function
+            description : set #accessor(val) { this.#field = val; }
+            objectId : <objectId>
+            type : function
+        }
+    }
+    [4] : {
+        name : #field
+        value : {
+            description : 2
+            type : number
+            value : 2
+        }
+    }
+    [5] : {
+        name : #subclassMethod
+        value : {
+            className : Function
+            description : #subclassMethod() { return 'subclassMethod'; }
+            objectId : <objectId>
+            type : function
+        }
+    }
+    [6] : {
+        name : #inc
+        value : {
+            className : Function
+            description : #inc() { return 'subclass #inc'; }
+            objectId : <objectId>
+            type : function
+        }
+    }
+]
+Evaluating private methods in the base class from the subclass
+{
+    exceptionDetails : {
+        columnNumber : 4
+        exception : {
+            className : SyntaxError
+            description : SyntaxError: Private field '#subclassMethod' must be declared in an enclosing class     at B.fn (<anonymous>:16:7)     at run (<anonymous>:30:5)     at <anonymous>:1:1
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+        exceptionId : <exceptionId>
+        lineNumber : 0
+        scriptId : <scriptId>
+        text : Uncaught
+    }
+    result : {
+        className : SyntaxError
+        description : SyntaxError: Private field '#subclassMethod' must be declared in an enclosing class     at B.fn (<anonymous>:16:7)     at run (<anonymous>:30:5)     at <anonymous>:1:1
+        objectId : <objectId>
+        subtype : error
+        type : object
+    }
+}
+Evaluating private method in the subclass from the subclass
+{
+    result : {
+        type : string
+        value : subclassMethod
+    }
+}
+Evaluating private method shadowing the base class method
+{
+    result : {
+        type : string
+        value : subclass #inc
+    }
+}
diff --git a/deps/v8/test/inspector/debugger/class-private-methods-preview-expected.txt b/deps/v8/test/inspector/debugger/class-private-methods-preview-expected.txt
new file mode 100644
index 00000000000000..ddb1ec7329ff6a
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/class-private-methods-preview-expected.txt
@@ -0,0 +1,30 @@
+Check private methods in object preview.
+
+Running test: testPrivateMethods
+expression: new class extends class { constructor() { return new Proxy({}, {}); } } { #method() { return 1; } }
+[
+]
+expression: new class { #method() { return 1; } get #accessor() { } set #accessor(val) { } }
+[
+    [0] : {
+        name : #method
+        type : function
+        value :
+    }
+    [1] : {
+        name : #accessor
+        type : accessor
+    }
+]
+expression: new class extends class { #method() { return 1; } } { get #accessor() { } set #accessor(val) { } }
+[
+    [0] : {
+        name : #method
+        type : function
+        value :
+    }
+    [1] : {
+        name : #accessor
+        type : accessor
+    }
+]
diff --git a/deps/v8/test/inspector/debugger/class-private-methods-preview.js b/deps/v8/test/inspector/debugger/class-private-methods-preview.js
new file mode 100644
index 00000000000000..7a8dd87d7d27d9
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/class-private-methods-preview.js
@@ -0,0 +1,38 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --harmony-private-methods
+
+let {session, contextGroup, Protocol} = InspectorTest.start("Check private methods in object preview.");
+
+Protocol.Debugger.enable();
+Protocol.Runtime.enable();
+Protocol.Runtime.onConsoleAPICalled(dumpInternalProperties);
+
+contextGroup.setupInjectedScriptEnvironment();
+
+InspectorTest.runAsyncTestSuite([
+  async function testPrivateMethods() {
+    const expressions = [
+        "new class extends class { constructor() { return new Proxy({}, {}); } } { #method() { return 1; } }",
+        "new class { #method() { return 1; } get #accessor() { } set #accessor(val) { } }",
+        "new class extends class { #method() { return 1; } } { get #accessor() { } set #accessor(val) { } }",
+    ];
+    for (const expression of expressions) {
+      InspectorTest.log(`expression: ${expression}`);
+      await Protocol.Runtime.evaluate({
+        expression: `console.table(${expression})`,
+        generatePreview: true
+      });
+    }
+  }
+]);
+
+function dumpInternalProperties(message) {
+  try {
+    InspectorTest.logMessage(message.params.args[0].preview.properties);
+  } catch {
+    InspectorTest.logMessage(message);
+  }
+}
diff --git a/deps/v8/test/inspector/debugger/class-private-methods.js b/deps/v8/test/inspector/debugger/class-private-methods.js
new file mode 100644
index 00000000000000..7aa5f7a61f9a7b
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/class-private-methods.js
@@ -0,0 +1,139 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-private-methods
+
+let { session, contextGroup, Protocol } = InspectorTest.start(
+  "Test private class methods"
+);
+
+contextGroup.addScript(`
+function run() {
+  class A {
+    #field = 2;
+
+    #inc() { this.#field++; return this.#field; }
+
+    set #writeOnly(val) { this.#field = val; }
+
+    get #readOnly() { return this.#field; }
+
+    get #accessor() { return this.#field; }
+    set #accessor(val) { this.#field = val; }
+
+    fn() {
+      debugger;
+    }
+  };
+  const a = new A();
+  a.fn();
+
+
+  class B extends A {
+    #subclassMethod() { return 'subclassMethod'; }
+    #inc() { return 'subclass #inc'; }
+    test() { debugger; }
+  }
+
+  const b = new B();
+  b.fn();
+  b.test();
+}`);
+
+InspectorTest.runAsyncTestSuite([
+  async function testScopesPaused() {
+    Protocol.Debugger.enable();
+    Protocol.Runtime.evaluate({ expression: "run()" });
+
+    let {
+      params: { callFrames }
+    } = await Protocol.Debugger.oncePaused(); // inside a.fn()
+    let frame = callFrames[0];
+    let { result } = await Protocol.Runtime.getProperties({
+      objectId: frame.this.objectId
+    });
+
+    InspectorTest.log('privateProperties on the base class instance');
+    InspectorTest.logMessage(result.privateProperties);
+
+    ({ result } = await Protocol.Debugger.evaluateOnCallFrame({
+      expression: 'this.#inc();',
+      callFrameId: callFrames[0].callFrameId
+    }));
+
+    InspectorTest.log('Evaluating private methods');
+    InspectorTest.logObject(result);
+
+    ({ result } = await Protocol.Debugger.evaluateOnCallFrame({
+      expression: 'this.#inc();',
+      callFrameId: callFrames[0].callFrameId
+    }));
+
+    InspectorTest.log('Evaluating private methods');
+    InspectorTest.logObject(result);
+
+    ({ result } = await Protocol.Debugger.evaluateOnCallFrame({
+      expression: '++this.#accessor;',
+      callFrameId: callFrames[0].callFrameId
+    }));
+
+    InspectorTest.log('Evaluating private accessors');
+    InspectorTest.logObject(result);
+
+    ({ result } = await Protocol.Debugger.evaluateOnCallFrame({
+      expression: 'this.#readOnly;',
+      callFrameId: callFrames[0].callFrameId
+    }));
+
+    InspectorTest.log('Evaluating read-only accessor');
+    InspectorTest.logObject(result);
+
+    ({ result } = await Protocol.Debugger.evaluateOnCallFrame({
+      expression: 'this.#writeOnly = 0; this.#field;',
+      callFrameId: callFrames[0].callFrameId
+    }));
+
+    InspectorTest.log('Evaluating write-only accessor');
+    InspectorTest.logObject(result);
+
+    Protocol.Debugger.resume();
+    ({ params: { callFrames }  } = await Protocol.Debugger.oncePaused());  // b.fn();
+    frame = callFrames[0];
+
+    ({ result } = await Protocol.Runtime.getProperties({
+      objectId: frame.this.objectId
+    }));
+    InspectorTest.log('privateProperties on the subclass instance');
+    InspectorTest.logMessage(result.privateProperties);
+
+    ({ result } = await Protocol.Debugger.evaluateOnCallFrame({
+      expression: 'this.#subclassMethod();',
+      callFrameId: callFrames[0].callFrameId
+    }));
+
+    InspectorTest.log('Evaluating private methods in the base class from the subclass');
+    InspectorTest.logMessage(result);
+
+    Protocol.Debugger.resume();
+    ({ params: { callFrames }  } = await Protocol.Debugger.oncePaused());  // b.test();
+    ({ result } = await Protocol.Debugger.evaluateOnCallFrame({
+      expression: 'this.#subclassMethod();',
+      callFrameId: callFrames[0].callFrameId
+    }));
+
+    InspectorTest.log('Evaluating private method in the subclass from the subclass');
+    InspectorTest.logObject(result);
+
+    ({ result } = await Protocol.Debugger.evaluateOnCallFrame({
+      expression: 'this.#inc();',
+      callFrameId: callFrames[0].callFrameId
+    }));
+
+    InspectorTest.log('Evaluating private method shadowing the base class method');
+    InspectorTest.logObject(result);
+
+    Protocol.Debugger.resume();
+    Protocol.Debugger.disable();
+  }
+]);
diff --git a/deps/v8/test/inspector/debugger/pause-on-oom.js b/deps/v8/test/inspector/debugger/pause-on-oom.js
index 062c53b0d7dd21..81edfc8adec52f 100644
--- a/deps/v8/test/inspector/debugger/pause-on-oom.js
+++ b/deps/v8/test/inspector/debugger/pause-on-oom.js
@@ -11,7 +11,7 @@ var arr = [];
 var stop = false;
 function generateGarbage() {
   while(!stop) {
-    arr.push(42);
+    arr.push(new Array(1000));
   }
 }
 //# sourceURL=test.js`, 10, 26);
diff --git a/deps/v8/test/inspector/debugger/wasm-anyref-global.js b/deps/v8/test/inspector/debugger/wasm-anyref-global.js
index d9f63d2d2094c7..1c47cfc8d8d53a 100644
--- a/deps/v8/test/inspector/debugger/wasm-anyref-global.js
+++ b/deps/v8/test/inspector/debugger/wasm-anyref-global.js
@@ -13,7 +13,7 @@ let {session, contextGroup, Protocol} =
 
     let builder = new WasmModuleBuilder();
     builder.addImportedGlobal('m', 'global', kWasmAnyRef, false);
-    builder.addFunction('func', kSig_v_v)
+    let func = builder.addFunction('func', kSig_v_v)
         .addBody([
           kExprGlobalGet, 0,  //
           kExprDrop,          //
@@ -47,7 +47,7 @@ let {session, contextGroup, Protocol} =
 
     InspectorTest.log('Setting breakpoint in wasm.');
     await Protocol.Debugger.setBreakpoint(
-        {location: {scriptId, lineNumber: 2}});
+        {location: {scriptId, lineNumber: 0, columnNumber: func.body_offset}});
 
     InspectorTest.log('Running main.');
     Protocol.Runtime.evaluate({expression: 'instance.exports.main()'});
diff --git a/deps/v8/test/inspector/debugger/wasm-clone-module-expected.txt b/deps/v8/test/inspector/debugger/wasm-clone-module-expected.txt
index d07f035f7891c9..b437d1b253014e 100644
--- a/deps/v8/test/inspector/debugger/wasm-clone-module-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-clone-module-expected.txt
@@ -1,5 +1,5 @@
 Tests that cloning a module notifies the debugger
-Got URL: wasm://wasm/wasm-95d1e44e/wasm-95d1e44e-0
-Got URL: wasm://wasm/wasm-95d1e44e/wasm-95d1e44e-0
-Got URL: wasm://wasm/wasm-95d1e44e/wasm-95d1e44e-0
+Got URL: wasm://wasm/95d1e44e
+Got URL: wasm://wasm/95d1e44e
+Got URL: wasm://wasm/95d1e44e
 Done!
diff --git a/deps/v8/test/inspector/debugger/wasm-debug-command-expected.txt b/deps/v8/test/inspector/debugger/wasm-debug-command-expected.txt
new file mode 100644
index 00000000000000..eadcb7d67183a2
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-debug-command-expected.txt
@@ -0,0 +1,11 @@
+Tests debug command for wasm
+Installing code and global variable.
+Calling instantiate function.
+Waiting for wasm scripts to be parsed.
+Ignoring script with url v8://test/callInstantiate
+Got wasm script: wasm://wasm/fa045c1e
+paused No 1
+Script wasm://wasm/fa045c1e byte offset 35: Wasm opcode 0x20
+Debugger.resume
+exports.main returned!
+Finished!
diff --git a/deps/v8/test/inspector/debugger/wasm-debug-command.js b/deps/v8/test/inspector/debugger/wasm-debug-command.js
new file mode 100644
index 00000000000000..672631bca27c0f
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-debug-command.js
@@ -0,0 +1,97 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start('Tests debug command for wasm');
+session.setupScriptMap();
+
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+
+// wasm_A
+builder.addFunction('wasm_A', kSig_i_i)
+    .addBody([
+      // clang-format off
+      kExprLocalGet, 0,              // Line 1: get input
+      kExprI32Const, 1,              // Line 2: get constant 1
+      kExprI32Sub                    // Line 3: decrease
+      // clang-format on
+    ])
+    .exportAs('main');
+
+let module_bytes = builder.toArray();
+
+function instantiate(bytes) {
+  let buffer = new ArrayBuffer(bytes.length);
+  let view = new Uint8Array(buffer);
+  for (let i = 0; i < bytes.length; ++i) {
+    view[i] = bytes[i] | 0;
+  }
+
+  let module = new WebAssembly.Module(buffer);
+  // Set global variable.
+  instance = new WebAssembly.Instance(module);
+}
+
+let evalWithUrl = (code, url) => Protocol.Runtime.evaluate(
+    {'expression': code + '\n//# sourceURL=v8://test/' + url});
+
+let breakCount;
+
+Protocol.Debugger.onPaused(async message => {
+  breakCount++;
+  InspectorTest.log("paused No " + breakCount);
+  var frames = message.params.callFrames;
+  await session.logSourceLocation(frames[0].location);
+  let action= 'resume';
+  InspectorTest.log('Debugger.' + action)
+  await Protocol.Debugger[action]();
+})
+
+let breakpointId;
+
+contextGroup.addScript(`
+function test() {
+  debug(instance.exports.main);
+  instance.exports.main(3, 2);
+}
+//# sourceURL=test.js`);
+
+(async function Test() {
+  breakCount = 0;
+  breakpointId = 0;
+  await Protocol.Debugger.enable();
+  InspectorTest.log('Installing code and global variable.');
+  await evalWithUrl('var instance;\n' + instantiate.toString(), 'setup');
+  InspectorTest.log('Calling instantiate function.');
+  evalWithUrl(
+      'instantiate(' + JSON.stringify(module_bytes) + ')', 'callInstantiate');
+  const scriptId = await waitForWasmScript();
+  await Protocol.Runtime.evaluate({ expression: 'test()', includeCommandLineAPI: true});
+  InspectorTest.log('exports.main returned!');
+  InspectorTest.log('Finished!');
+  InspectorTest.completeTest();
+})();
+
+function printFailure(message) {
+  if (!message.result) {
+    InspectorTest.logMessage(message);
+  }
+  return message;
+}
+
+async function waitForWasmScript() {
+  InspectorTest.log('Waiting for wasm scripts to be parsed.');
+  while (true) {
+    let msg = await Protocol.Debugger.onceScriptParsed();
+    let url = msg.params.url;
+    if (!url.startsWith('wasm://')) {
+      InspectorTest.log('Ignoring script with url ' + url);
+      continue;
+    }
+    let scriptId = msg.params.scriptId;
+    InspectorTest.log('Got wasm script: ' + url);
+    return scriptId;
+  }
+}
diff --git a/deps/v8/test/inspector/debugger/wasm-get-breakable-locations-byte-offsets-expected.txt b/deps/v8/test/inspector/debugger/wasm-get-breakable-locations-byte-offsets-expected.txt
new file mode 100644
index 00000000000000..a0ff4a04a9dfe4
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-get-breakable-locations-byte-offsets-expected.txt
@@ -0,0 +1,83 @@
+Tests breakable locations in wasm
+Running testFunction...
+Script nr 0 parsed. URL: v8://test/setup
+Script nr 1 parsed. URL: v8://test/runTestFunction
+Script nr 2 parsed. URL: wasm://wasm/6a95b41e
+This is a wasm script (nr 0).
+Querying breakable locations for all wasm scripts now...
+Requesting all breakable locations in wasm script 0
+Bytecode matches!
+11 breakable location(s):
+[0] 0:40 || byte=1
+[1] 0:41 || byte=65
+[2] 0:43 || byte=33
+[3] 0:45 || byte=11
+[4] 0:48 || byte=32
+[5] 0:50 || byte=4
+[6] 0:52 || byte=2
+[7] 0:54 || byte=16
+[8] 0:56 || byte=11
+[9] 0:57 || byte=11
+[10] 0:58 || byte=11
+Requesting breakable locations in offsets [0,45)
+3 breakable location(s):
+[0] 0:40 || byte=1
+[1] 0:41 || byte=65
+[2] 0:43 || byte=33
+Requesting breakable locations in offsets [50,60)
+6 breakable location(s):
+[0] 0:50 || byte=4
+[1] 0:52 || byte=2
+[2] 0:54 || byte=16
+[3] 0:56 || byte=11
+[4] 0:57 || byte=11
+[5] 0:58 || byte=11
+Setting a breakpoint on each breakable location...
+Setting at wasm://wasm/6a95b41e:0:40
+Success!
+Setting at wasm://wasm/6a95b41e:0:41
+Success!
+Setting at wasm://wasm/6a95b41e:0:43
+Success!
+Setting at wasm://wasm/6a95b41e:0:45
+Success!
+Setting at wasm://wasm/6a95b41e:0:48
+Success!
+Setting at wasm://wasm/6a95b41e:0:50
+Success!
+Setting at wasm://wasm/6a95b41e:0:52
+Success!
+Setting at wasm://wasm/6a95b41e:0:54
+Success!
+Setting at wasm://wasm/6a95b41e:0:56
+Success!
+Setting at wasm://wasm/6a95b41e:0:57
+Success!
+Setting at wasm://wasm/6a95b41e:0:58
+Success!
+Running wasm code...
+Missing breakpoints: 11
+Script nr 3 parsed. URL: v8://test/runWasm
+Stopped at wasm://wasm/6a95b41e:0:48
+Missing breakpoints: 10
+Stopped at wasm://wasm/6a95b41e:0:50
+Missing breakpoints: 9
+Stopped at wasm://wasm/6a95b41e:0:52
+Missing breakpoints: 8
+Stopped at wasm://wasm/6a95b41e:0:54
+Missing breakpoints: 7
+Stopped at wasm://wasm/6a95b41e:0:40
+Missing breakpoints: 6
+Stopped at wasm://wasm/6a95b41e:0:41
+Missing breakpoints: 5
+Stopped at wasm://wasm/6a95b41e:0:43
+Missing breakpoints: 4
+Stopped at wasm://wasm/6a95b41e:0:45
+Missing breakpoints: 3
+Stopped at wasm://wasm/6a95b41e:0:56
+Missing breakpoints: 2
+Stopped at wasm://wasm/6a95b41e:0:57
+Missing breakpoints: 1
+Stopped at wasm://wasm/6a95b41e:0:58
+Missing breakpoints: 0
+Finished!
diff --git a/deps/v8/test/inspector/debugger/wasm-get-breakable-locations-byte-offsets.js b/deps/v8/test/inspector/debugger/wasm-get-breakable-locations-byte-offsets.js
new file mode 100644
index 00000000000000..86b2dc5aaabd66
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-get-breakable-locations-byte-offsets.js
@@ -0,0 +1,245 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+let {session, contextGroup, Protocol} = InspectorTest.start('Tests breakable locations in wasm');
+
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+
+// clang-format off
+var func_idx = builder.addFunction('helper', kSig_v_v)
+    .addLocals({ i32_count: 1 })
+    .addBody([
+        kExprNop,
+        kExprI32Const, 12,
+        kExprLocalSet, 0,
+    ]).index;
+
+builder.addFunction('main', kSig_v_i)
+    .addBody([
+        kExprLocalGet, 0,
+        kExprIf, kWasmStmt,
+        kExprBlock, kWasmStmt,
+        kExprCallFunction, func_idx,
+        kExprEnd,
+        kExprEnd
+    ]).exportAs('main');
+// clang-format on
+
+var module_bytes = builder.toArray();
+
+function testFunction(bytes) {
+  var buffer = new ArrayBuffer(bytes.length);
+  var view = new Uint8Array(buffer);
+  for (var i = 0; i < bytes.length; i++) {
+    view[i] = bytes[i] | 0;
+  }
+
+  var module = new WebAssembly.Module(buffer);
+  // Set global variable.
+  instance = new WebAssembly.Instance(module);
+}
+
+var evalWithUrl = (code, url) => Protocol.Runtime.evaluate(
+    {'expression': code + '\n//# sourceURL=v8://test/' + url});
+
+var setupCode = testFunction.toString() + ';\nvar module_bytes = ' +
+    JSON.stringify(module_bytes) + ';\nvar instance;';
+
+Protocol.Debugger.enable();
+Protocol.Debugger.onScriptParsed(handleScriptParsed);
+
+async function runTest() {
+  InspectorTest.log('Running testFunction...');
+  await evalWithUrl(setupCode, 'setup');
+  await evalWithUrl('testFunction(module_bytes)', 'runTestFunction');
+  await getBreakableLocationsForAllWasmScripts();
+  await setAllBreakableLocations();
+  InspectorTest.log('Running wasm code...');
+  // Begin executing code:
+  var promise = evalWithUrl('instance.exports.main(1)', 'runWasm');
+  await waitForAllPauses();
+  // Code should now complete
+  await promise;
+  InspectorTest.log('Finished!');
+}
+
+runTest()
+    .catch(reason => InspectorTest.log(`Failed: ${reason}`))
+    .then(InspectorTest.completeTest);
+
+var allBreakableLocations = [];
+
+var urls = {};
+var numScripts = 0;
+var wasmScripts = [];
+function handleScriptParsed(messageObject) {
+  var scriptId = messageObject.params.scriptId;
+  var url = messageObject.params.url;
+  urls[scriptId] = url;
+  InspectorTest.log('Script nr ' + numScripts + ' parsed. URL: ' + url);
+  ++numScripts;
+
+  if (url.startsWith('wasm://')) {
+    // Only want the full module script, not the function specific ones.
+    if (url.split('/').length == 4) {
+      InspectorTest.log('This is a wasm script (nr ' + wasmScripts.length + ').');
+      wasmScripts.push(scriptId);
+    }
+  }
+}
+
+function printFailure(message) {
+  if (!message.result) {
+    InspectorTest.logMessage(message);
+  }
+}
+
+function printBreakableLocations(message, expectedScriptId, bytecode) {
+  var locations = message.result.locations;
+  InspectorTest.log(locations.length + ' breakable location(s):');
+  for (var i = 0; i < locations.length; ++i) {
+    if (locations[i].scriptId != expectedScriptId) {
+      InspectorTest.log(
+          'SCRIPT ID MISMATCH!! ' + locations[i].scriptId + ' != ' +
+          expectedScriptId);
+    }
+    if (locations[i].lineNumber != 0) {
+      InspectorTest.log(`Unexpected line number: ${bytecode[locations[i].lineNumber]}`);
+    }
+    var line = `byte=${bytecode[locations[i].columnNumber]}`;
+    InspectorTest.log(
+        '[' + i + '] ' + locations[i].lineNumber + ':' +
+        locations[i].columnNumber + ' || ' + line);
+  }
+}
+
+function checkModuleBytes(encoded, bytecode) {
+  // Encode bytecode as base64.
+  var BASE = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+  var PAD = '=';
+  var ret = '';
+  var leftchar = 0;
+  var leftbits = 0;
+  for (var i = 0; i < bytecode.length; i++) {
+    leftchar = (leftchar << 8) | bytecode[i];
+    leftbits += 8;
+    while (leftbits >= 6) {
+      var curr = (leftchar >> (leftbits-6)) & 0x3f;
+      leftbits -= 6;
+      ret += BASE[curr];
+    }
+  }
+  if (leftbits == 2) {
+    ret += BASE[(leftchar&3) << 4];
+    ret += PAD + PAD;
+  } else if (leftbits == 4) {
+    ret += BASE[(leftchar&0xf) << 2];
+    ret += PAD;
+  }
+
+  // Check the base64 strings match.
+  if(ret == encoded) {
+    InspectorTest.log('Bytecode matches!');
+  } else {
+    InspectorTest.log('Original: ' + ret);
+    InspectorTest.log('Returned by API: ' + encoded);
+  }
+}
+
+async function checkGetBreakableLocations(wasmScriptNr) {
+  InspectorTest.log(
+    'Requesting all breakable locations in wasm script ' + wasmScriptNr);
+  var scriptId = wasmScripts[wasmScriptNr];
+
+  var msg = await Protocol.Debugger.getScriptSource({scriptId: scriptId});
+  checkModuleBytes(msg.result.bytecode, module_bytes);
+
+  msg = await Protocol.Debugger.getPossibleBreakpoints(
+      {start: {lineNumber: 0, columnNumber: 0, scriptId: scriptId}});
+  printFailure(msg);
+  allBreakableLocations.push(...msg.result.locations);
+  printBreakableLocations(msg, scriptId, module_bytes);
+
+  InspectorTest.log('Requesting breakable locations in offsets [0,45)');
+  msg = await Protocol.Debugger.getPossibleBreakpoints({
+      start: {lineNumber: 0, columnNumber: 0, scriptId: scriptId},
+      end: {lineNumber: 0, columnNumber: 45, scriptId: scriptId}});
+  printFailure(msg);
+  printBreakableLocations(msg, scriptId, module_bytes);
+
+  InspectorTest.log('Requesting breakable locations in offsets [50,60)');
+  msg = await Protocol.Debugger.getPossibleBreakpoints({
+      start: {lineNumber: 0, columnNumber: 50, scriptId: scriptId},
+      end: {lineNumber: 0, columnNumber: 60, scriptId: scriptId}});
+  printFailure(msg);
+  printBreakableLocations(msg, scriptId, module_bytes);
+}
+
+async function getBreakableLocationsForAllWasmScripts() {
+  InspectorTest.log('Querying breakable locations for all wasm scripts now...');
+  for (var wasmScriptNr = 0; wasmScriptNr < wasmScripts.length;
+       ++wasmScriptNr) {
+    await checkGetBreakableLocations(wasmScriptNr);
+  }
+}
+
+function locationMatches(loc1, loc2) {
+  return loc1.scriptId == loc2.scriptId && loc1.lineNumber == loc2.lineNumber &&
+      loc1.columnNumber == loc2.columnNumber;
+}
+
+function locationStr(loc) {
+  return urls[loc.scriptId] + ':' + loc.lineNumber + ':' + loc.columnNumber;
+}
+
+async function setBreakpoint(loc) {
+  InspectorTest.log('Setting at ' + locationStr(loc));
+
+  var msg = await Protocol.Debugger.setBreakpoint({ 'location': loc });
+  printFailure(msg);
+
+  if (locationMatches(loc, msg.result.actualLocation)) {
+    InspectorTest.log("Success!");
+  } else {
+    InspectorTest.log("Mismatch!");
+    InspectorTest.logMessage(msg);
+  }
+}
+
+async function setAllBreakableLocations() {
+  InspectorTest.log('Setting a breakpoint on each breakable location...');
+  for (var loc of allBreakableLocations) {
+    await setBreakpoint(loc);
+  }
+}
+
+function recordPausedLocation(msg) {
+  var topLocation = msg.params.callFrames[0].location;
+  InspectorTest.log('Stopped at ' + locationStr(topLocation));
+  for (var i = 0; i < allBreakableLocations.length; ++i) {
+    if (locationMatches(topLocation, allBreakableLocations[i])) {
+      allBreakableLocations.splice(i, 1);
+      break;
+    }
+  }
+}
+
+async function waitForAllPauses() {
+  var remaining = allBreakableLocations.length;
+  InspectorTest.log('Missing breakpoints: ' + remaining);
+  while (remaining > 0) {
+    recordPausedLocation(await Protocol.Debugger.oncePaused());
+    await Protocol.Debugger.resume();
+    remaining--;
+    InspectorTest.log('Missing breakpoints: ' + remaining);
+  }
+  if (allBreakableLocations.length != 0) {
+    InspectorTest.log('Did not hit all breakable locations: '
+                      + JSON.stringify(allBreakableLocations));
+  }
+}
diff --git a/deps/v8/test/inspector/debugger/wasm-get-breakable-locations-expected.txt b/deps/v8/test/inspector/debugger/wasm-get-breakable-locations-expected.txt
deleted file mode 100644
index 519d77911bd261..00000000000000
--- a/deps/v8/test/inspector/debugger/wasm-get-breakable-locations-expected.txt
+++ /dev/null
@@ -1,88 +0,0 @@
-Tests breakable locations in wasm
-Running testFunction...
-Script nr 0 parsed. URL: v8://test/setup
-Script nr 1 parsed. URL: v8://test/runTestFunction
-Script nr 2 parsed. URL: wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-0
-This is a wasm script (nr 0).
-Script nr 3 parsed. URL: wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1
-This is a wasm script (nr 1).
-Querying breakable locations for all wasm scripts now...
-Requesting all breakable locations in wasm script 0
-4 breakable location(s):
-[0] 2:2 ||   >nop
-[1] 3:2 ||   >i32.const 12
-[2] 4:2 ||   >local.set 0
-[3] 5:0 || >end
-Requesting breakable locations in lines [0,3)
-1 breakable location(s):
-[0] 2:2 ||   >nop
-Requesting breakable locations in lines [4,6)
-2 breakable location(s):
-[0] 4:2 ||   >local.set 0
-[1] 5:0 || >end
-Requesting all breakable locations in wasm script 1
-7 breakable location(s):
-[0] 1:2 ||   >local.get 0
-[1] 2:2 ||   >if
-[2] 3:4 ||     >block
-[3] 4:6 ||       >call 0
-[4] 5:4 ||     >end
-[5] 6:2 ||   >end
-[6] 7:0 || >end
-Requesting breakable locations in lines [0,3)
-2 breakable location(s):
-[0] 1:2 ||   >local.get 0
-[1] 2:2 ||   >if
-Requesting breakable locations in lines [4,6)
-2 breakable location(s):
-[0] 4:6 ||       >call 0
-[1] 5:4 ||     >end
-Setting a breakpoint on each breakable location...
-Setting at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-0:2:2
-Success!
-Setting at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-0:3:2
-Success!
-Setting at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-0:4:2
-Success!
-Setting at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-0:5:0
-Success!
-Setting at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:1:2
-Success!
-Setting at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:2:2
-Success!
-Setting at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:3:4
-Success!
-Setting at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:4:6
-Success!
-Setting at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:5:4
-Success!
-Setting at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:6:2
-Success!
-Setting at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:7:0
-Success!
-Running wasm code...
-Missing breakpoints: 11
-Script nr 4 parsed. URL: v8://test/runWasm
-Stopped at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:1:2
-Missing breakpoints: 10
-Stopped at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:2:2
-Missing breakpoints: 9
-Stopped at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:3:4
-Missing breakpoints: 8
-Stopped at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:4:6
-Missing breakpoints: 7
-Stopped at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-0:2:2
-Missing breakpoints: 6
-Stopped at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-0:3:2
-Missing breakpoints: 5
-Stopped at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-0:4:2
-Missing breakpoints: 4
-Stopped at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-0:5:0
-Missing breakpoints: 3
-Stopped at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:5:4
-Missing breakpoints: 2
-Stopped at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:6:2
-Missing breakpoints: 1
-Stopped at wasm://wasm/wasm-6a95b41e/wasm-6a95b41e-1:7:0
-Missing breakpoints: 0
-Finished!
diff --git a/deps/v8/test/inspector/debugger/wasm-get-breakable-locations.js b/deps/v8/test/inspector/debugger/wasm-get-breakable-locations.js
deleted file mode 100644
index 62f50749f32031..00000000000000
--- a/deps/v8/test/inspector/debugger/wasm-get-breakable-locations.js
+++ /dev/null
@@ -1,209 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm
-
-let {session, contextGroup, Protocol} = InspectorTest.start('Tests breakable locations in wasm');
-
-utils.load('test/mjsunit/wasm/wasm-module-builder.js');
-
-var builder = new WasmModuleBuilder();
-
-// clang-format off
-var func_idx = builder.addFunction('helper', kSig_v_v)
-    .addLocals({i32_count: 1})
-    .addBody([
-        kExprNop,
-        kExprI32Const, 12,
-        kExprLocalSet, 0,
-    ]).index;
-
-builder.addFunction('main', kSig_v_i)
-    .addBody([
-        kExprLocalGet, 0,
-        kExprIf, kWasmStmt,
-          kExprBlock, kWasmStmt,
-            kExprCallFunction, func_idx,
-          kExprEnd,
-        kExprEnd
-    ]).exportAs('main');
-// clang-format on
-
-var module_bytes = builder.toArray();
-
-function testFunction(bytes) {
-  var buffer = new ArrayBuffer(bytes.length);
-  var view = new Uint8Array(buffer);
-  for (var i = 0; i < bytes.length; i++) {
-    view[i] = bytes[i] | 0;
-  }
-
-  var module = new WebAssembly.Module(buffer);
-  // Set global variable.
-  instance = new WebAssembly.Instance(module);
-}
-
-var evalWithUrl = (code, url) => Protocol.Runtime.evaluate(
-    {'expression': code + '\n//# sourceURL=v8://test/' + url});
-
-var setupCode = testFunction.toString() + ';\nvar module_bytes = ' +
-    JSON.stringify(module_bytes) + ';\nvar instance;';
-
-Protocol.Debugger.enable();
-Protocol.Debugger.onScriptParsed(handleScriptParsed);
-InspectorTest.log('Running testFunction...');
-evalWithUrl(setupCode, 'setup')
-    .then(() => evalWithUrl('testFunction(module_bytes)', 'runTestFunction'))
-    .then(getBreakableLocationsForAllWasmScripts)
-    .then(setAllBreakableLocations)
-    .then(() => InspectorTest.log('Running wasm code...'))
-    .then(() => (evalWithUrl('instance.exports.main(1)', 'runWasm'), 0))
-    .then(waitForAllPauses)
-    .then(() => InspectorTest.log('Finished!'))
-    .then(InspectorTest.completeTest);
-
-var allBreakableLocations = [];
-
-var urls = {};
-var numScripts = 0;
-var wasmScripts = [];
-function handleScriptParsed(messageObject) {
-  var scriptId = messageObject.params.scriptId;
-  var url = messageObject.params.url;
-  urls[scriptId] = url;
-  InspectorTest.log('Script nr ' + numScripts + ' parsed. URL: ' + url);
-  ++numScripts;
-
-  if (url.startsWith('wasm://')) {
-    InspectorTest.log('This is a wasm script (nr ' + wasmScripts.length + ').');
-    wasmScripts.push(scriptId);
-  }
-}
-
-function printFailure(message) {
-  if (!message.result) {
-    InspectorTest.logMessage(message);
-  }
-  return message;
-}
-
-function printBreakableLocations(message, expectedScriptId, source) {
-  var lines = source.split('\n');
-  var locations = message.result.locations;
-  InspectorTest.log(locations.length + ' breakable location(s):');
-  for (var i = 0; i < locations.length; ++i) {
-    if (locations[i].scriptId != expectedScriptId) {
-      InspectorTest.log(
-          'SCRIPT ID MISMATCH!! ' + locations[i].scriptId + ' != ' +
-          expectedScriptId);
-    }
-    var line = '<illegal line number>';
-    if (locations[i].lineNumber < lines.length) {
-      line = lines[locations[i].lineNumber];
-      if (locations[i].columnNumber < line.length) {
-        line = line.substr(0, locations[i].columnNumber) + '>' +
-            line.substr(locations[i].columnNumber);
-      }
-    }
-    InspectorTest.log(
-        '[' + i + '] ' + locations[i].lineNumber + ':' +
-        locations[i].columnNumber + ' || ' + line);
-  }
-}
-
-function checkGetBreakableLocations(wasmScriptNr) {
-  InspectorTest.log(
-      'Requesting all breakable locations in wasm script ' + wasmScriptNr);
-  var scriptId = wasmScripts[wasmScriptNr];
-  var source;
-  return Protocol.Debugger.getScriptSource({scriptId: scriptId})
-      .then(msg => source = msg.result.scriptSource)
-      .then(
-          () => Protocol.Debugger.getPossibleBreakpoints(
-              {start: {lineNumber: 0, columnNumber: 0, scriptId: scriptId}}))
-      .then(printFailure)
-      .then(msg => (allBreakableLocations.push(...msg.result.locations), msg))
-      .then(msg => printBreakableLocations(msg, scriptId, source))
-      .then(
-          () => InspectorTest.log(
-              'Requesting breakable locations in lines [0,3)'))
-      .then(() => Protocol.Debugger.getPossibleBreakpoints({
-        start: {lineNumber: 0, columnNumber: 0, scriptId: scriptId},
-        end: {lineNumber: 3, columnNumber: 0, scriptId: scriptId}
-      }))
-      .then(printFailure)
-      .then(msg => printBreakableLocations(msg, scriptId, source))
-      .then(
-          () => InspectorTest.log(
-              'Requesting breakable locations in lines [4,6)'))
-      .then(() => Protocol.Debugger.getPossibleBreakpoints({
-        start: {lineNumber: 4, columnNumber: 0, scriptId: scriptId},
-        end: {lineNumber: 6, columnNumber: 0, scriptId: scriptId}
-      }))
-      .then(printFailure)
-      .then(msg => printBreakableLocations(msg, scriptId, source));
-}
-
-function getBreakableLocationsForAllWasmScripts() {
-  InspectorTest.log('Querying breakable locations for all wasm scripts now...');
-  var promise = Promise.resolve();
-  for (var wasmScriptNr = 0; wasmScriptNr < wasmScripts.length;
-       ++wasmScriptNr) {
-    promise = promise.then(checkGetBreakableLocations.bind(null, wasmScriptNr));
-  }
-  return promise;
-}
-
-function locationMatches(loc1, loc2) {
-  return loc1.scriptId == loc2.scriptId && loc1.lineNumber == loc2.lineNumber &&
-      loc1.columnNumber == loc2.columnNumber;
-}
-
-function locationStr(loc) {
-  return urls[loc.scriptId] + ':' + loc.lineNumber + ':' + loc.columnNumber;
-}
-
-function setBreakpoint(loc) {
-  InspectorTest.log('Setting at ' + locationStr(loc));
-  function check(msg) {
-    if (locationMatches(loc, msg.result.actualLocation)) {
-      InspectorTest.log("Success!");
-    } else {
-      InspectorTest.log("Mismatch!");
-      InspectorTest.logMessage(msg);
-    }
-  }
-  return Protocol.Debugger.setBreakpoint({'location': loc})
-      .then(printFailure)
-      .then(check);
-}
-
-function setAllBreakableLocations() {
-  InspectorTest.log('Setting a breakpoint on each breakable location...');
-  var promise = Promise.resolve();
-  for (var loc of allBreakableLocations) {
-    promise = promise.then(setBreakpoint.bind(null, loc));
-  }
-  return promise;
-}
-
-function removePausedLocation(msg) {
-  var topLocation = msg.params.callFrames[0].location;
-  InspectorTest.log('Stopped at ' + locationStr(topLocation));
-  for (var i = 0; i < allBreakableLocations.length; ++i) {
-    if (locationMatches(topLocation, allBreakableLocations[i])) {
-      allBreakableLocations.splice(i, 1);
-      --i;
-    }
-  }
-}
-
-function waitForAllPauses() {
-  InspectorTest.log('Missing breakpoints: ' + allBreakableLocations.length);
-  if (allBreakableLocations.length == 0) return;
-  return Protocol.Debugger.oncePaused()
-      .then(removePausedLocation)
-      .then(Protocol.Debugger.resume())
-      .then(waitForAllPauses);
-}
diff --git a/deps/v8/test/inspector/debugger/wasm-imports-expected.txt b/deps/v8/test/inspector/debugger/wasm-imports-expected.txt
index d67d49742c9855..eb6b119dc3131e 100644
--- a/deps/v8/test/inspector/debugger/wasm-imports-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-imports-expected.txt
@@ -4,17 +4,11 @@ Calling instantiate function for module A.
 Waiting for wasm script to be parsed.
 Got wasm script!
 Setting breakpoint in line 1:
-func $func
-  #nop
-end
-
+Script wasm://wasm/1871020e byte offset 33: Wasm opcode 0x1
 Calling instantiate function for module B.
 Calling main function on module B.
-Paused at 1:2.
-func $func
-  #nop
-end
-
+Paused at 0:33.
+Script wasm://wasm/1871020e byte offset 33: Wasm opcode 0x1
 Getting current stack trace via "new Error().stack".
 Error
     at v8://test/getStack:1:1
diff --git a/deps/v8/test/inspector/debugger/wasm-imports.js b/deps/v8/test/inspector/debugger/wasm-imports.js
index 0d83917fa9c27f..2efa7fdcbbad4f 100644
--- a/deps/v8/test/inspector/debugger/wasm-imports.js
+++ b/deps/v8/test/inspector/debugger/wasm-imports.js
@@ -12,10 +12,9 @@ utils.load('test/mjsunit/wasm/wasm-module-builder.js');
 // This failed before (http://crbug.com/v8/5971).
 
 var builder_a = new WasmModuleBuilder();
-var func_idx = builder_a.addFunction('func', kSig_v_v)
+var func = builder_a.addFunction('func', kSig_v_v)
                    .addBody([kExprNop])
-                   .exportFunc()
-                   .index;
+                   .exportFunc();
 var module_a_bytes = builder_a.toArray();
 
 var builder_b = new WasmModuleBuilder();
@@ -60,7 +59,8 @@ Protocol.Debugger.enable()
     .then(url => (InspectorTest.log('Setting breakpoint in line 1:'), url))
     .then(
         url =>
-            Protocol.Debugger.setBreakpointByUrl({lineNumber: 1, url: url}))
+            Protocol.Debugger.setBreakpointByUrl(
+                {lineNumber: 0, columnNumber: func.body_offset, url: url}))
     .then(printFailure)
     .then(msg => session.logSourceLocations(msg.result.locations))
     .then(() => InspectorTest.log('Calling instantiate function for module B.'))
diff --git a/deps/v8/test/inspector/debugger/wasm-remove-breakpoint-expected.txt b/deps/v8/test/inspector/debugger/wasm-remove-breakpoint-expected.txt
new file mode 100644
index 00000000000000..1554054e46fc13
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-remove-breakpoint-expected.txt
@@ -0,0 +1,19 @@
+Tests remove breakpoint from wasm scripts.
+Installing code and global variable.
+Calling instantiate function.
+Waiting for wasm scripts to be parsed.
+Ignoring script with url v8://test/callInstantiate
+Got wasm script: wasm://wasm/fa045c1e
+Setting breakpoint on line 3 of wasm function
+{
+    columnNumber : 39
+    lineNumber : 0
+    scriptId : <scriptId>
+}
+BreakpointId: 4:0:39:6
+paused No 1
+Script wasm://wasm/fa045c1e byte offset 39: Wasm opcode 0x6b
+Remove breakpoint with breakpointId: 4:0:39:6
+Debugger.resume
+exports.main returned!
+Finished!
diff --git a/deps/v8/test/inspector/debugger/wasm-remove-breakpoint.js b/deps/v8/test/inspector/debugger/wasm-remove-breakpoint.js
new file mode 100644
index 00000000000000..bfbf79af3ae5a8
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-remove-breakpoint.js
@@ -0,0 +1,107 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start('Tests remove breakpoint from wasm scripts.');
+session.setupScriptMap();
+
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+
+// wasm_A
+let func = builder.addFunction('wasm_A', kSig_i_i)
+    .addBody([
+      // clang-format off
+      kExprLocalGet, 0,              // Line 1: get input
+      kExprI32Const, 1,              // Line 2: get constant 1
+      kExprI32Sub                    // Line 3: decrease
+      // clang-format on
+    ])
+    .exportAs('main');
+
+let module_bytes = builder.toArray();
+
+function instantiate(bytes) {
+  let buffer = new ArrayBuffer(bytes.length);
+  let view = new Uint8Array(buffer);
+  for (let i = 0; i < bytes.length; ++i) {
+    view[i] = bytes[i] | 0;
+  }
+
+  let module = new WebAssembly.Module(buffer);
+  // Set global variable.
+  instance = new WebAssembly.Instance(module);
+}
+
+let evalWithUrl = (code, url) => Protocol.Runtime.evaluate(
+    {'expression': code + '\n//# sourceURL=v8://test/' + url});
+
+let breakCount = 0;
+let breakpointId = 0;
+
+Protocol.Debugger.onPaused(async message => {
+  breakCount++;
+  InspectorTest.log("paused No " + breakCount);
+  var frames = message.params.callFrames;
+  await session.logSourceLocation(frames[0].location);
+  if (breakCount == 1) {
+    InspectorTest.log('Remove breakpoint with breakpointId: ' + breakpointId);
+    await Protocol.Debugger.removeBreakpoint({breakpointId});
+  }
+  let action= 'resume';
+  InspectorTest.log('Debugger.' + action)
+  await Protocol.Debugger[action]();
+})
+
+contextGroup.addScript(`
+function test() {
+  instance.exports.main(1);
+  instance.exports.main(1);
+}
+//# sourceURL=test.js`);
+
+(async function Test() {
+  await Protocol.Debugger.enable();
+  InspectorTest.log('Installing code and global variable.');
+  await evalWithUrl('var instance;\n' + instantiate.toString(), 'setup');
+  InspectorTest.log('Calling instantiate function.');
+  evalWithUrl(
+      'instantiate(' + JSON.stringify(module_bytes) + ')', 'callInstantiate');
+  const scriptId = await waitForWasmScript();
+  InspectorTest.log(
+      'Setting breakpoint on line 3 of wasm function');
+  let msg = await Protocol.Debugger.setBreakpoint(
+      {'location': {'scriptId': scriptId, 'lineNumber': 0, 'columnNumber': func.body_offset + 4}});
+  printFailure(msg);
+  InspectorTest.logMessage(msg.result.actualLocation);
+  InspectorTest.logMessage('BreakpointId: '+ msg.result.breakpointId);
+  breakpointId = msg.result.breakpointId;
+  await Protocol.Runtime.evaluate({ expression: 'test()' });
+  await Protocol.Runtime.evaluate({ expression: 'test()' });
+  InspectorTest.log('exports.main returned!');
+  InspectorTest.log('Finished!');
+  InspectorTest.completeTest();
+})();
+
+function printFailure(message) {
+  if (!message.result) {
+    InspectorTest.logMessage(message);
+  }
+  return message;
+}
+
+async function waitForWasmScript() {
+  InspectorTest.log('Waiting for wasm scripts to be parsed.');
+  while (true) {
+    let msg = await Protocol.Debugger.onceScriptParsed();
+    let url = msg.params.url;
+    if (!url.startsWith('wasm://')) {
+      InspectorTest.log('Ignoring script with url ' + url);
+      continue;
+    }
+    let scriptId = msg.params.scriptId;
+    InspectorTest.log('Got wasm script: ' + url);
+    return scriptId;
+  }
+}
diff --git a/deps/v8/test/inspector/debugger/wasm-scope-info-expected.txt b/deps/v8/test/inspector/debugger/wasm-scope-info-expected.txt
index cc2df0326c2693..1ab0977e1f5328 100644
--- a/deps/v8/test/inspector/debugger/wasm-scope-info-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-scope-info-expected.txt
@@ -1,284 +1,308 @@
 Test retrieving scope information when pausing in wasm functions
-Installing code and global variable.
 Calling instantiate function.
 Waiting for wasm script to be parsed.
 Got wasm script!
-Setting breakpoint on line 2 (first instruction)
+Setting breakpoint on first instruction of second function
 {
-    columnNumber : 2
-    lineNumber : 2
+    columnNumber : 69
+    lineNumber : 0
     scriptId : <scriptId>
 }
 Paused:
-(local i32 i64 f64)
-  #i32.const 11
-  local.set 0
-
+Script wasm://wasm/a6e9de16 byte offset 69: Wasm opcode 0x41
 Scope:
-at func (2:2):
+at func (0:69):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 4 (number), "local#1": 0 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 4 (number), "local#1": 0 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
    stack: 
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  i32.const 11
-  #local.set 0
-  i32.const 47
-
+Script wasm://wasm/a6e9de16 byte offset 71: Wasm opcode 0x21
 Scope:
-at func (3:2):
+at func (0:71):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 4 (number), "local#1": 0 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 4 (number), "local#1": 0 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
    stack: "0": 11 (number)
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  local.set 0
-  #i32.const 47
-  local.set 1
-
+Script wasm://wasm/a6e9de16 byte offset 73: Wasm opcode 0x41
 Scope:
-at func (4:2):
+at func (0:73):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 0 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 0 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
    stack: 
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  i32.const 47
-  #local.set 1
-  i64.const 9223372036854775807
-
+Script wasm://wasm/a6e9de16 byte offset 75: Wasm opcode 0x21
 Scope:
-at func (5:2):
+at func (0:75):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 0 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 0 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
    stack: "0": 47 (number)
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  local.set 1
-  #i64.const 9223372036854775807
-  local.set 2
-
+Script wasm://wasm/a6e9de16 byte offset 77: Wasm opcode 0x42
 Scope:
-at func (6:2):
+at func (0:77):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
    stack: 
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  i64.const 9223372036854775807
-  #local.set 2
-  i64.const -9223372036854775808
-
+Script wasm://wasm/a6e9de16 byte offset 88: Wasm opcode 0x21
 Scope:
-at func (7:2):
+at func (0:88):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
    stack: "0": 9223372036854775807 (string)
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  local.set 2
-  #i64.const -9223372036854775808
-  local.set 2
-
+Script wasm://wasm/a6e9de16 byte offset 90: Wasm opcode 0x42
 Scope:
-at func (8:2):
+at func (0:90):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": 9223372036854775807 (string), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": 9223372036854775807 (string), "unicode☼f64": 0 (number)
    stack: 
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  i64.const -9223372036854775808
-  #local.set 2
-  i32.const 1
-
+Script wasm://wasm/a6e9de16 byte offset 101: Wasm opcode 0x21
 Scope:
-at func (9:2):
+at func (0:101):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": 9223372036854775807 (string), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": 9223372036854775807 (string), "unicode☼f64": 0 (number)
    stack: "0": -9223372036854775808 (string)
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  local.set 2
-  #i32.const 1
-  f64.convert_i32_u
-
+Script wasm://wasm/a6e9de16 byte offset 103: Wasm opcode 0x41
 Scope:
-at func (10:2):
+at func (0:103):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
    stack: 
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  i32.const 1
-  #f64.convert_i32_u
-  i32.const 7
-
+Script wasm://wasm/a6e9de16 byte offset 105: Wasm opcode 0xb8
 Scope:
-at func (11:2):
+at func (0:105):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
    stack: "0": 1 (number)
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  f64.convert_i32_u
-  #i32.const 7
-  f64.convert_i32_u
-
+Script wasm://wasm/a6e9de16 byte offset 106: Wasm opcode 0x41
 Scope:
-at func (12:2):
+at func (0:106):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
    stack: "0": 1 (number)
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  i32.const 7
-  #f64.convert_i32_u
-  f64.div
-
+Script wasm://wasm/a6e9de16 byte offset 108: Wasm opcode 0xb8
 Scope:
-at func (13:2):
+at func (0:108):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
    stack: "0": 1 (number), "1": 7 (number)
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  f64.convert_i32_u
-  #f64.div
-  local.set 3
-
+Script wasm://wasm/a6e9de16 byte offset 109: Wasm opcode 0xa3
 Scope:
-at func (14:2):
+at func (0:109):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
    stack: "0": 1 (number), "1": 7 (number)
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  f64.div
-  #local.set 3
-  i32.const 15
-
+Script wasm://wasm/a6e9de16 byte offset 110: Wasm opcode 0x21
 Scope:
-at func (15:2):
+at func (0:110):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
    stack: "0": 0.14285714285714285 (number)
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  local.set 3
-  #i32.const 15
-  global.set 0
-
+Script wasm://wasm/a6e9de16 byte offset 112: Wasm opcode 0x41
 Scope:
-at func (16:2):
+at func (0:112):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0.14285714285714285 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0.14285714285714285 (number)
    stack: 
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  i32.const 15
-  #global.set 0
-end
-
+Script wasm://wasm/a6e9de16 byte offset 114: Wasm opcode 0x24
 Scope:
-at func (17:2):
+at func (0:114):
  - scope (global):
    globals: "global#0": 0 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0.14285714285714285 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0.14285714285714285 (number)
    stack: "0": 15 (number)
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-  global.set 0
-#end
-
-
+Script wasm://wasm/a6e9de16 byte offset 116: Wasm opcode 0xb
 Scope:
-at func (18:0):
+at func (0:116):
  - scope (global):
    globals: "global#0": 15 (number)
  - scope (local):
-   locals: "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0.14285714285714285 (number)
+   locals: "0": 0 (number), "i32Arg": 11 (number), "local#1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0.14285714285714285 (number)
    stack: 
+at call_func (0:58):
+ - scope (global):
+   globals: "global#0": 15 (number)
+ - scope (local):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
+Paused:
+instance.exports.main(4)#
+
+Scope:
+at (anonymous) (0:24):
+ - scope (global):
+   -- skipped globals
+
 exports.main returned. Test finished.
diff --git a/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff-expected.txt b/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff-expected.txt
new file mode 100644
index 00000000000000..74d3016a5487bc
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff-expected.txt
@@ -0,0 +1,145 @@
+Test retrieving scope information from compiled Liftoff frames
+Installing instantiate code.
+Waiting for wasm script to be parsed.
+Calling instantiate function.
+Got wasm script!
+Setting breakpoint on line 2 (first instruction) of third function
+{
+    columnNumber : 85
+    lineNumber : 0
+    scriptId : <scriptId>
+}
+Paused:
+Script wasm://wasm/89d60696 byte offset 85: Wasm opcode 0x20
+Scope:
+at C (interpreted) (0:85):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
+   locals: "i32_arg": 42 (number), "i32_local": 0 (number)
+   stack:
+at B (liftoff) (0:76):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
+   locals: "0": 0 (number), "i32_arg": 42 (number), "i32_local": 0 (number), "f32_local": 7.199999809265137 (number), "local#5": 0 (number)
+   stack: "0": 42 (number), "1": 3 (number)
+at A (liftoff) (0:54):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
+   locals: "arg#0": 42 (number)
+   stack:
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped globals
+
+Paused:
+Script wasm://wasm/89d60696 byte offset 87: Wasm opcode 0x24
+Scope:
+at C (interpreted) (0:87):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
+   locals: "i32_arg": 42 (number), "i32_local": 0 (number)
+   stack: "0": 42 (number)
+at B (liftoff) (0:76):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
+   locals: "0": 0 (number), "i32_arg": 42 (number), "i32_local": 0 (number), "f32_local": 7.199999809265137 (number), "local#5": 0 (number)
+   stack: "0": 42 (number), "1": 3 (number)
+at A (liftoff) (0:54):
+ - scope (global):
+   globals: "global#0": 0 (number)
+ - scope (local):
+   locals: "arg#0": 42 (number)
+   stack:
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped globals
+
+Paused:
+Script wasm://wasm/89d60696 byte offset 89: Wasm opcode 0x41
+Scope:
+at C (interpreted) (0:89):
+ - scope (global):
+   globals: "global#0": 42 (number)
+ - scope (local):
+   locals: "i32_arg": 42 (number), "i32_local": 0 (number)
+   stack:
+at B (liftoff) (0:76):
+ - scope (global):
+   globals: "global#0": 42 (number)
+ - scope (local):
+   locals: "0": 0 (number), "i32_arg": 42 (number), "i32_local": 0 (number), "f32_local": 7.199999809265137 (number), "local#5": 0 (number)
+   stack: "0": 42 (number), "1": 3 (number)
+at A (liftoff) (0:54):
+ - scope (global):
+   globals: "global#0": 42 (number)
+ - scope (local):
+   locals: "arg#0": 42 (number)
+   stack:
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped globals
+
+Paused:
+Script wasm://wasm/89d60696 byte offset 91: Wasm opcode 0x21
+Scope:
+at C (interpreted) (0:91):
+ - scope (global):
+   globals: "global#0": 42 (number)
+ - scope (local):
+   locals: "i32_arg": 42 (number), "i32_local": 0 (number)
+   stack: "0": 47 (number)
+at B (liftoff) (0:76):
+ - scope (global):
+   globals: "global#0": 42 (number)
+ - scope (local):
+   locals: "0": 0 (number), "i32_arg": 42 (number), "i32_local": 0 (number), "f32_local": 7.199999809265137 (number), "local#5": 0 (number)
+   stack: "0": 42 (number), "1": 3 (number)
+at A (liftoff) (0:54):
+ - scope (global):
+   globals: "global#0": 42 (number)
+ - scope (local):
+   locals: "arg#0": 42 (number)
+   stack:
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped globals
+
+Paused:
+Script wasm://wasm/89d60696 byte offset 93: Wasm opcode 0xb
+Scope:
+at C (interpreted) (0:93):
+ - scope (global):
+   globals: "global#0": 42 (number)
+ - scope (local):
+   locals: "i32_arg": 42 (number), "i32_local": 47 (number)
+   stack:
+at B (liftoff) (0:76):
+ - scope (global):
+   globals: "global#0": 42 (number)
+ - scope (local):
+   locals: "0": 0 (number), "i32_arg": 42 (number), "i32_local": 0 (number), "f32_local": 7.199999809265137 (number), "local#5": 0 (number)
+   stack: "0": 42 (number), "1": 3 (number)
+at A (liftoff) (0:54):
+ - scope (global):
+   globals: "global#0": 42 (number)
+ - scope (local):
+   locals: "arg#0": 42 (number)
+   stack:
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped globals
+
+Paused:
+instance.exports.main(42)#
+
+Scope:
+at (anonymous) (0:25):
+ - scope (global):
+   -- skipped globals
+
+exports.main returned. Test finished.
diff --git a/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff.js b/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff.js
new file mode 100644
index 00000000000000..a945d776269399
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff.js
@@ -0,0 +1,171 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// TODO(clemensb): In the long term this test should also work without any
+// flags, once we tier down to Liftoff when the debugger is enabled.
+// Flags: --liftoff --no-wasm-tier-up
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+    'Test retrieving scope information from compiled Liftoff frames');
+session.setupScriptMap();
+Protocol.Debugger.enable();
+Protocol.Debugger.onPaused(printPauseLocationsAndContinue);
+
+let evaluate = code => Protocol.Runtime.evaluate({expression: code});
+
+let breakpointLocation = -1;
+
+(async function test() {
+  // Instantiate wasm and wait for three wasm scripts for the three functions.
+  instantiateWasm();
+  let scriptIds = await waitForWasmScripts();
+
+  // Set a breakpoint.
+  InspectorTest.log(
+      'Setting breakpoint on line 2 (first instruction) of third function');
+  let breakpoint = await Protocol.Debugger.setBreakpoint(
+      {'location': {'scriptId': scriptIds[0], 'lineNumber': 0, 'columnNumber': breakpointLocation}});
+  printIfFailure(breakpoint);
+  InspectorTest.logMessage(breakpoint.result.actualLocation);
+
+  // Now run the wasm code.
+  await evaluate('instance.exports.main(42)');
+  InspectorTest.log('exports.main returned. Test finished.');
+  InspectorTest.completeTest();
+})();
+
+async function printPauseLocationsAndContinue(msg) {
+  let loc = msg.params.callFrames[0].location;
+  InspectorTest.log('Paused:');
+  await session.logSourceLocation(loc);
+  InspectorTest.log('Scope:');
+  for (var frame of msg.params.callFrames) {
+    var isWasmFrame = /^wasm/.test(frame.url);
+    var functionName = frame.functionName || '(anonymous)';
+    var lineNumber = frame.location.lineNumber;
+    var columnNumber = frame.location.columnNumber;
+    InspectorTest.log(`at ${functionName} (${lineNumber}:${columnNumber}):`);
+    for (var scope of frame.scopeChain) {
+      InspectorTest.logObject(' - scope (' + scope.type + '):');
+      if (!isWasmFrame && scope.type == 'global') {
+        // Skip global scope for non wasm-functions.
+        InspectorTest.logObject('   -- skipped globals');
+        continue;
+      }
+      var properties = await Protocol.Runtime.getProperties(
+          {'objectId': scope.object.objectId});
+      await dumpScopeProperties(properties);
+    }
+  }
+  InspectorTest.log();
+  Protocol.Debugger.stepOver();
+}
+
+async function instantiateWasm() {
+  utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+  var builder = new WasmModuleBuilder();
+  // Also add a global, so we have some global scope.
+  builder.addGlobal(kWasmI32, true);
+
+  // Add two functions without breakpoint, to check that locals and operand
+  // stack values are shown correctly in Liftoff code.
+  // Function A will have its parameter spilled to the stack, because it calls
+  // function B.
+  // Function B has a local with a constant value (not using a register), the
+  // parameter will be held in a register.
+  builder.addFunction('A (liftoff)', kSig_v_i)
+      .addBody([
+        // Call function 'B', forwarding param 0.
+        kExprLocalGet, 0, kExprCallFunction, 1
+      ])
+      .exportAs('main');
+
+  builder.addFunction('B (liftoff)', kSig_v_i)
+      .addLocals(
+          {i32_count: 1, f32_count: 4},
+          ['i32_arg', 'i32_local', 'f32_local', '0', '0'])
+      .addBody([
+        // Load a parameter and a constant onto the operand stack.
+        kExprLocalGet, 0, kExprI32Const, 3,
+        // Set local 2 to 7.2.
+        ...wasmF32Const(7.2), kExprLocalSet, 2,
+        // Call function 'C', forwarding param 0.
+        kExprLocalGet, 0, kExprCallFunction, 2,
+        // Drop the two operand stack values.
+        kExprDrop, kExprDrop
+      ]);
+
+  // A third function which will be stepped through.
+  let func = builder.addFunction('C (interpreted)', kSig_v_i)
+      .addLocals({i32_count: 1}, ['i32_arg', 'i32_local'])
+      .addBody([
+        // Set global 0 to param 0.
+        kExprLocalGet, 0, kExprGlobalSet, 0,
+        // Set local 1 to 47.
+        kExprI32Const, 47, kExprLocalSet, 1,
+      ]);
+
+  var module_bytes = builder.toArray();
+  breakpointLocation = func.body_offset;
+
+  function instantiate(bytes) {
+    var buffer = new ArrayBuffer(bytes.length);
+    var view = new Uint8Array(buffer);
+    for (var i = 0; i < bytes.length; ++i) {
+      view[i] = bytes[i] | 0;
+    }
+
+    var module = new WebAssembly.Module(buffer);
+    return new WebAssembly.Instance(module);
+  }
+
+  InspectorTest.log('Installing instantiate code.');
+  await evaluate(instantiate.toString());
+  InspectorTest.log('Calling instantiate function.');
+  evaluate('var instance = instantiate(' + JSON.stringify(module_bytes) + ');');
+}
+
+function printIfFailure(message) {
+  if (!message.result) {
+    InspectorTest.logMessage(message);
+  }
+  return message;
+}
+
+async function waitForWasmScripts() {
+  InspectorTest.log('Waiting for wasm script to be parsed.');
+  let wasm_script_ids = [];
+  while (wasm_script_ids.length < 1) {
+    let script_msg = await Protocol.Debugger.onceScriptParsed();
+    let url = script_msg.params.url;
+    if (url.startsWith('wasm://')) {
+      InspectorTest.log('Got wasm script!');
+      wasm_script_ids.push(script_msg.params.scriptId);
+    }
+  }
+  return wasm_script_ids;
+}
+
+async function getScopeValues(value) {
+  if (value.type != 'object') {
+    InspectorTest.log('Expected object. Found:');
+    InspectorTest.logObject(value);
+    return;
+  }
+
+  let msg = await Protocol.Runtime.getProperties({objectId: value.objectId});
+  printIfFailure(msg);
+  let printProperty = elem => '"' + elem.name + '"' +
+      ': ' + elem.value.value + ' (' + elem.value.type + ')';
+  return msg.result.result.map(printProperty).join(', ');
+}
+
+async function dumpScopeProperties(message) {
+  printIfFailure(message);
+  for (var value of message.result.result) {
+    var value_str = await getScopeValues(value.value);
+    InspectorTest.log('   ' + value.name + ': ' + value_str);
+  }
+}
diff --git a/deps/v8/test/inspector/debugger/wasm-scope-info.js b/deps/v8/test/inspector/debugger/wasm-scope-info.js
index 2a5e2961ac68e3..693fb002778e04 100644
--- a/deps/v8/test/inspector/debugger/wasm-scope-info.js
+++ b/deps/v8/test/inspector/debugger/wasm-scope-info.js
@@ -2,43 +2,92 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Disable Liftoff to get deterministic (non-existing) scope information for
+// compiled frames.
+// Flags: --no-liftoff
+
 let {session, contextGroup, Protocol} = InspectorTest.start(
     'Test retrieving scope information when pausing in wasm functions');
 session.setupScriptMap();
 Protocol.Debugger.enable();
+Protocol.Debugger.onPaused(printPauseLocationsAndContinue);
 
 let evaluate = code => Protocol.Runtime.evaluate({expression: code});
 
+let breakpointLocation = undefined;  // Will be set by {instantiateWasm}.
+
 (async function test() {
-  let scriptId = await instantiateWasm();
-  await setBreakpoint(scriptId);
-  printPauseLocationsAndContinue();
+  // Instantiate wasm and wait for three wasm scripts for the three functions.
+  instantiateWasm();
+  let scriptIds = await waitForWasmScripts();
+
+  // Set a breakpoint.
+  InspectorTest.log(
+      'Setting breakpoint on first instruction of second function');
+  let breakpoint = await Protocol.Debugger.setBreakpoint({
+    'location' : {
+      'scriptId' : scriptIds[0],
+      'lineNumber' : 0,
+      'columnNumber' : breakpointLocation
+    }
+  });
+  printIfFailure(breakpoint);
+  InspectorTest.logMessage(breakpoint.result.actualLocation);
+
+  // Now run the wasm code.
   await evaluate('instance.exports.main(4)');
   InspectorTest.log('exports.main returned. Test finished.');
   InspectorTest.completeTest();
 })();
 
-async function printPauseLocationsAndContinue() {
-  while (true) {
-    let msg = await Protocol.Debugger.oncePaused();
-    let loc = msg.params.callFrames[0].location;
-    InspectorTest.log('Paused:');
-    await session.logSourceLocation(loc);
-    await dumpScopeChainsOnPause(msg);
-    Protocol.Debugger.stepOver();
+async function printPauseLocationsAndContinue(msg) {
+  let loc = msg.params.callFrames[0].location;
+  InspectorTest.log('Paused:');
+  await session.logSourceLocation(loc);
+  InspectorTest.log('Scope:');
+  for (var frame of msg.params.callFrames) {
+    var isWasmFrame = /^wasm/.test(frame.url);
+    var functionName = frame.functionName || '(anonymous)';
+    var lineNumber = frame.location.lineNumber;
+    var columnNumber = frame.location.columnNumber;
+    InspectorTest.log(`at ${functionName} (${lineNumber}:${columnNumber}):`);
+    for (var scope of frame.scopeChain) {
+      InspectorTest.logObject(' - scope (' + scope.type + '):');
+      if (!isWasmFrame && scope.type == 'global') {
+        // Skip global scope for non wasm-functions.
+        InspectorTest.logObject('   -- skipped globals');
+        continue;
+      }
+      var properties = await Protocol.Runtime.getProperties(
+          {'objectId': scope.object.objectId});
+      await dumpScopeProperties(properties);
+    }
   }
+  InspectorTest.log();
+  Protocol.Debugger.stepOver();
 }
 
 async function instantiateWasm() {
   utils.load('test/mjsunit/wasm/wasm-module-builder.js');
 
   var builder = new WasmModuleBuilder();
+  // Also add a global, so we have some global scope.
   builder.addGlobal(kWasmI32, true);
 
-  builder.addFunction('func', kSig_v_i)
+  // Add a function without breakpoint, to check that locals are shown
+  // correctly in compiled code.
+  builder.addFunction('call_func', kSig_v_i).addLocals({f32_count: 1}).addBody([
+    // Set local 1 to 7.2.
+    ...wasmF32Const(7.2), kExprLocalSet, 1,
+    // Call function 'func', forwarding param 0.
+    kExprLocalGet, 0, kExprCallFunction, 1
+  ]).exportAs('main');
+
+  // A second function which will be stepped through.
+  let func = builder.addFunction('func', kSig_v_i)
       .addLocals(
-          {i32_count: 1, i64_count: 1, f64_count: 1},
-          ['i32Arg', undefined, 'i64_local', 'unicode☼f64'])
+          {i32_count: 1, i64_count: 1, f64_count: 3},
+          ['i32Arg', undefined, 'i64_local', 'unicode☼f64', '0', '0'])
       .addBody([
         // Set param 0 to 11.
         kExprI32Const, 11, kExprLocalSet, 0,
@@ -56,10 +105,10 @@ async function instantiateWasm() {
 
         // Set global 0 to 15
         kExprI32Const, 15, kExprGlobalSet, 0,
-      ])
-      .exportAs('main');
+      ]);
 
-  var module_bytes = builder.toArray();
+  let moduleBytes = builder.toArray();
+  breakpointLocation = func.body_offset;
 
   function instantiate(bytes) {
     var buffer = new ArrayBuffer(bytes.length);
@@ -69,43 +118,32 @@ async function instantiateWasm() {
     }
 
     var module = new WebAssembly.Module(buffer);
-    // Set global variable.
-    instance = new WebAssembly.Instance(module);
+    return new WebAssembly.Instance(module);
   }
 
-  InspectorTest.log('Installing code and global variable.');
-  await evaluate('var instance;\n' + instantiate.toString());
   InspectorTest.log('Calling instantiate function.');
-  evaluate('instantiate(' + JSON.stringify(module_bytes) + ')');
-  return waitForWasmScript();
+  evaluate(`var instance = (${instantiate})(${JSON.stringify(moduleBytes)})`);
 }
 
-async function setBreakpoint(scriptId) {
-  InspectorTest.log('Setting breakpoint on line 2 (first instruction)');
-  let breakpoint = await Protocol.Debugger.setBreakpoint(
-      {'location': {'scriptId': scriptId, 'lineNumber': 2}});
-  printFailure(breakpoint);
-  InspectorTest.logMessage(breakpoint.result.actualLocation);
-}
-
-function printFailure(message) {
+function printIfFailure(message) {
   if (!message.result) {
     InspectorTest.logMessage(message);
   }
   return message;
 }
 
-async function waitForWasmScript() {
+async function waitForWasmScripts() {
   InspectorTest.log('Waiting for wasm script to be parsed.');
-  while (true) {
+  let wasm_script_ids = [];
+  while (wasm_script_ids.length < 1) {
     let script_msg = await Protocol.Debugger.onceScriptParsed();
     let url = script_msg.params.url;
-    if (!url.startsWith('wasm://')) {
-      continue;
+    if (url.startsWith('wasm://')) {
+      InspectorTest.log('Got wasm script!');
+      wasm_script_ids.push(script_msg.params.scriptId);
     }
-    InspectorTest.log('Got wasm script!');
-    return script_msg.params.scriptId;
   }
+  return wasm_script_ids;
 }
 
 async function getScopeValues(value) {
@@ -116,39 +154,16 @@ async function getScopeValues(value) {
   }
 
   let msg = await Protocol.Runtime.getProperties({objectId: value.objectId});
-  printFailure(msg);
+  printIfFailure(msg);
   let printProperty = elem => '"' + elem.name + '"' +
       ': ' + elem.value.value + ' (' + elem.value.type + ')';
   return msg.result.result.map(printProperty).join(', ');
 }
 
 async function dumpScopeProperties(message) {
-  printFailure(message);
+  printIfFailure(message);
   for (var value of message.result.result) {
     var value_str = await getScopeValues(value.value);
     InspectorTest.log('   ' + value.name + ': ' + value_str);
   }
 }
-
-async function dumpScopeChainsOnPause(message) {
-  InspectorTest.log(`Scope:`);
-  for (var frame of message.params.callFrames) {
-    var isWasmFrame = /^wasm/.test(frame.url);
-    var functionName = frame.functionName || '(anonymous)';
-    var lineNumber = frame.location ? frame.location.lineNumber : frame.lineNumber;
-    var columnNumber = frame.location ? frame.location.columnNumber : frame.columnNumber;
-    InspectorTest.log(`at ${functionName} (${lineNumber}:${columnNumber}):`);
-    for (var scope of frame.scopeChain) {
-      InspectorTest.logObject(' - scope (' + scope.type + '):');
-      if (!isWasmFrame && scope.type == 'global') {
-        // Skip global scope for non wasm-functions.
-        InspectorTest.logObject('   -- skipped globals');
-        continue;
-      }
-      var properties = await Protocol.Runtime.getProperties(
-          {'objectId': scope.object.objectId});
-      await dumpScopeProperties(properties);
-    }
-  }
-  InspectorTest.log();
-}
diff --git a/deps/v8/test/inspector/debugger/wasm-scripts-expected.txt b/deps/v8/test/inspector/debugger/wasm-scripts-expected.txt
index 210292c858e9e3..3918e210a3636b 100644
--- a/deps/v8/test/inspector/debugger/wasm-scripts-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-scripts-expected.txt
@@ -1,72 +1,52 @@
 Tests how wasm scripts are reported
-Check that each inspector gets two wasm scripts at module creation time.
-Session #1: Script #0 parsed. URL: wasm://wasm/wasm-f608ae1e/wasm-f608ae1e-0. Source map URL:
-Session #1: Script #1 parsed. URL: wasm://wasm/wasm-f608ae1e/wasm-f608ae1e-1. Source map URL:
-Session #2: Script #0 parsed. URL: wasm://wasm/wasm-f608ae1e/wasm-f608ae1e-0. Source map URL:
-Session #2: Script #1 parsed. URL: wasm://wasm/wasm-f608ae1e/wasm-f608ae1e-1. Source map URL:
-Session #1: Script #2 parsed. URL: wasm://wasm/wasm-74f86b7e. Source map URL: wasm://dwarf
-Session #2: Script #2 parsed. URL: wasm://wasm/wasm-74f86b7e. Source map URL: wasm://dwarf
-Session #1: Script #3 parsed. URL: wasm://wasm/wasm-3754e3fe. Source map URL: abc
-Session #2: Script #3 parsed. URL: wasm://wasm/wasm-3754e3fe. Source map URL: abc
-Session #1: Script #4 parsed. URL: wasm://wasm/wasm-2bd2e40e. Source map URL: abc
-Session #2: Script #4 parsed. URL: wasm://wasm/wasm-2bd2e40e. Source map URL: abc
-Session #1: Script #5 parsed. URL: wasm://wasm/wasm-f568e726. Source map URL: abc
-Session #2: Script #5 parsed. URL: wasm://wasm/wasm-f568e726. Source map URL: abc
-Session #1: Source for wasm://wasm/wasm-f608ae1e/wasm-f608ae1e-0:
-func $nopFunction
-  nop
-end
-
-Session #1: Source for wasm://wasm/wasm-f608ae1e/wasm-f608ae1e-1:
-func $main
-  block
-    i32.const 2
-    drop
-  end
-end
-
-Session #2: Source for wasm://wasm/wasm-f608ae1e/wasm-f608ae1e-0:
-func $nopFunction
-  nop
-end
-
-Session #2: Source for wasm://wasm/wasm-f608ae1e/wasm-f608ae1e-1:
-func $main
-  block
-    i32.const 2
-    drop
-  end
-end
-
-Session #1: Source for wasm://wasm/wasm-74f86b7e:
+Check that each inspector gets a wasm script at module creation time.
+Session #1: Script #0 parsed. URL: wasm://wasm/f608ae1e. Source map URL:
+Session #2: Script #0 parsed. URL: wasm://wasm/f608ae1e. Source map URL:
+Session #1: Script #1 parsed. URL: wasm://wasm/74f86b7e. Source map URL: wasm://dwarf
+Session #2: Script #1 parsed. URL: wasm://wasm/74f86b7e. Source map URL: wasm://dwarf
+Session #1: Script #2 parsed. URL: wasm://wasm/3754e3fe. Source map URL: abc
+Session #2: Script #2 parsed. URL: wasm://wasm/3754e3fe. Source map URL: abc
+Session #1: Script #3 parsed. URL: wasm://wasm/2bd2e40e. Source map URL: abc
+Session #2: Script #3 parsed. URL: wasm://wasm/2bd2e40e. Source map URL: abc
+Session #1: Script #4 parsed. URL: wasm://wasm/f568e726. Source map URL: abc
+Session #2: Script #4 parsed. URL: wasm://wasm/f568e726. Source map URL: abc
+Session #1: Source for wasm://wasm/f608ae1e:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
+Session #2: Source for wasm://wasm/f608ae1e:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
+Session #1: Source for wasm://wasm/74f86b7e:
 Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 11 0b 2e 64 65 62 75 67 5f 69 6e 66 6f 01 02 03 04 05 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
 Imports: []
 Exports: [main: function]
-Session #2: Source for wasm://wasm/wasm-74f86b7e:
+Session #2: Source for wasm://wasm/74f86b7e:
 Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 11 0b 2e 64 65 62 75 67 5f 69 6e 66 6f 01 02 03 04 05 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
 Imports: []
 Exports: [main: function]
-Session #1: Source for wasm://wasm/wasm-3754e3fe:
+Session #1: Source for wasm://wasm/3754e3fe:
 Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 15 10 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
 Imports: []
 Exports: [main: function]
-Session #2: Source for wasm://wasm/wasm-3754e3fe:
+Session #2: Source for wasm://wasm/3754e3fe:
 Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 15 10 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
 Imports: []
 Exports: [main: function]
-Session #1: Source for wasm://wasm/wasm-2bd2e40e:
+Session #1: Source for wasm://wasm/2bd2e40e:
 Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 11 0b 2e 64 65 62 75 67 5f 69 6e 66 6f 01 02 03 04 05 00 15 10 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
 Imports: []
 Exports: [main: function]
-Session #2: Source for wasm://wasm/wasm-2bd2e40e:
+Session #2: Source for wasm://wasm/2bd2e40e:
 Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 11 0b 2e 64 65 62 75 67 5f 69 6e 66 6f 01 02 03 04 05 00 15 10 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
 Imports: []
 Exports: [main: function]
-Session #1: Source for wasm://wasm/wasm-f568e726:
+Session #1: Source for wasm://wasm/f568e726:
 Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 15 10 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 03 61 62 63 00 11 0b 2e 64 65 62 75 67 5f 69 6e 66 6f 01 02 03 04 05 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
 Imports: []
 Exports: [main: function]
-Session #2: Source for wasm://wasm/wasm-f568e726:
+Session #2: Source for wasm://wasm/f568e726:
 Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 15 10 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 03 61 62 63 00 11 0b 2e 64 65 62 75 67 5f 69 6e 66 6f 01 02 03 04 05 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
 Imports: []
 Exports: [main: function]
diff --git a/deps/v8/test/inspector/debugger/wasm-scripts-with-name-expected.txt b/deps/v8/test/inspector/debugger/wasm-scripts-with-name-expected.txt
new file mode 100644
index 00000000000000..f655ff17e7f73b
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-scripts-with-name-expected.txt
@@ -0,0 +1,7 @@
+Tests how wasm scripts are reported with name
+Check that the inspector gets four wasm scripts at module creation time.
+Session #1: Script #0 parsed. URL: wasm://wasm/49a8663e.
+Session #1: Script #1 parsed. URL: wasm://wasm/moduleName-aea4a206.
+Session #1: Source for wasm://wasm/49a8663e:
+
+Session #1: Source for wasm://wasm/moduleName-aea4a206:
diff --git a/deps/v8/test/inspector/debugger/wasm-scripts-with-name.js b/deps/v8/test/inspector/debugger/wasm-scripts-with-name.js
new file mode 100644
index 00000000000000..7cf17190c08fe8
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-scripts-with-name.js
@@ -0,0 +1,75 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+InspectorTest.log("Tests how wasm scripts are reported with name");
+
+let contextGroup = new InspectorTest.ContextGroup();
+let sessions = [
+  // Main session.
+  trackScripts(),
+];
+
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addFunction('nopFunction', kSig_v_v).addBody([kExprNop]);
+var module_bytes = builder.toArray();
+builder.setName('moduleName');
+var module_bytes_with_name = builder.toArray();
+
+function testFunction(bytes) {
+  // Compilation triggers registration of wasm scripts.
+  new WebAssembly.Module(new Uint8Array(bytes));
+}
+
+contextGroup.addScript(testFunction.toString(), 0, 0, 'v8://test/testFunction');
+contextGroup.addScript('var module_bytes = ' + JSON.stringify(module_bytes));
+contextGroup.addScript('var module_bytes_with_name = ' + JSON.stringify(module_bytes_with_name));
+
+InspectorTest.log(
+    'Check that the inspector gets four wasm scripts at module creation time.');
+
+sessions[0].Protocol.Runtime
+    .evaluate({
+      'expression': '//# sourceURL=v8://test/runTestRunction\n' +
+          'testFunction(module_bytes); testFunction(module_bytes_with_name);'
+    })
+    .then(() => (
+      // At this point all scripts were parsed.
+      // Stop tracking and wait for script sources in each session.
+      Promise.all(sessions.map(session => session.getScripts()))
+    ))
+    .catch(err => {
+      InspectorTest.log(err.stack);
+    })
+    .then(() => InspectorTest.completeTest());
+
+function trackScripts(debuggerParams) {
+  let {id: sessionId, Protocol} = contextGroup.connect();
+  let scripts = [];
+
+  Protocol.Debugger.enable(debuggerParams);
+  Protocol.Debugger.onScriptParsed(handleScriptParsed);
+
+  async function loadScript({url, scriptId}) {
+    InspectorTest.log(`Session #${sessionId}: Script #${scripts.length} parsed. URL: ${url}.`);
+    let scriptSource;
+    ({result: {scriptSource}} = await Protocol.Debugger.getScriptSource({scriptId}));
+    InspectorTest.log(`Session #${sessionId}: Source for ${url}:`);
+    InspectorTest.log(scriptSource);
+  }
+
+  function handleScriptParsed({params}) {
+    if (params.url.startsWith("wasm://")) {
+      scripts.push(loadScript(params));
+    }
+  }
+
+  return {
+    Protocol,
+    getScripts: () => Promise.all(scripts),
+  };
+}
diff --git a/deps/v8/test/inspector/debugger/wasm-scripts.js b/deps/v8/test/inspector/debugger/wasm-scripts.js
index 72d886b0e5e98d..6a342922a89469 100644
--- a/deps/v8/test/inspector/debugger/wasm-scripts.js
+++ b/deps/v8/test/inspector/debugger/wasm-scripts.js
@@ -38,7 +38,7 @@ function testFunction(bytes) {
 contextGroup.addScript(testFunction.toString(), 0, 0, 'v8://test/testFunction');
 
 InspectorTest.log(
-    'Check that each inspector gets two wasm scripts at module creation time.');
+    'Check that each inspector gets a wasm script at module creation time.');
 
 // Sample .debug_info section.
 // Content doesn't matter, as we don't try to parse it in V8,
@@ -78,30 +78,6 @@ sessions[0].Protocol.Runtime
     })
     .then(() => InspectorTest.completeTest());
 
-function decodeBase64(base64) {
-  const LOOKUP = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
-
-  const paddingLength = base64.match(/=*$/)[0].length;
-  const bytesLength = base64.length * 0.75 - paddingLength;
-
-  let bytes = new Uint8Array(bytesLength);
-
-  for (let i = 0, p = 0; i < base64.length; i += 4, p += 3) {
-    let bits = 0;
-    for (let j = 0; j < 4; j++) {
-      bits <<= 6;
-      const c = base64[i + j];
-      if (c !== '=') bits |= LOOKUP.indexOf(c);
-    }
-    for (let j = p + 2; j >= p; j--) {
-      if (j < bytesLength) bytes[j] = bits;
-      bits >>= 8;
-    }
-  }
-
-  return bytes;
-}
-
 function trackScripts(debuggerParams) {
   let {id: sessionId, Protocol} = contextGroup.connect();
   let scripts = [];
@@ -111,11 +87,14 @@ function trackScripts(debuggerParams) {
 
   async function loadScript({url, scriptId, sourceMapURL}) {
     InspectorTest.log(`Session #${sessionId}: Script #${scripts.length} parsed. URL: ${url}. Source map URL: ${sourceMapURL}`);
-    let scriptSource;
-    if (sourceMapURL) {
-      let {result: {bytecode}} = await Protocol.Debugger.getWasmBytecode({scriptId});
+    let {result: {scriptSource, bytecode}} = await Protocol.Debugger.getScriptSource({scriptId});
+    if (bytecode) {
+      if (scriptSource) {
+        InspectorTest.log('Unexpected scriptSource with bytecode: ');
+        InspectorTest.log(scriptSource);
+      }
       // Binary value is represented as base64 in JSON, decode it.
-      bytecode = decodeBase64(bytecode);
+      bytecode = InspectorTest.decodeBase64(bytecode);
       // Check that it can be parsed back to a WebAssembly module.
       let module = new WebAssembly.Module(bytecode);
       scriptSource = `
@@ -123,15 +102,13 @@ Raw: ${Array.from(bytecode, b => ('0' + b.toString(16)).slice(-2)).join(' ')}
 Imports: [${WebAssembly.Module.imports(module).map(i => `${i.name}: ${i.kind} from "${i.module}"`).join(', ')}]
 Exports: [${WebAssembly.Module.exports(module).map(e => `${e.name}: ${e.kind}`).join(', ')}]
       `.trim();
-    } else {
-      ({result: {scriptSource}} = await Protocol.Debugger.getScriptSource({scriptId}));
     }
     InspectorTest.log(`Session #${sessionId}: Source for ${url}:`);
     InspectorTest.log(scriptSource);
   }
 
   function handleScriptParsed({params}) {
-    if (params.url.startsWith("wasm://")) {
+    if (params.url.startsWith('wasm://')) {
       scripts.push(loadScript(params));
     }
   }
diff --git a/deps/v8/test/inspector/debugger/wasm-set-breakpoint-expected.txt b/deps/v8/test/inspector/debugger/wasm-set-breakpoint-expected.txt
index 29ee78c65ad3a3..b53a17610b9319 100644
--- a/deps/v8/test/inspector/debugger/wasm-set-breakpoint-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-set-breakpoint-expected.txt
@@ -1,58 +1,38 @@
 Tests stepping through wasm scripts.
 Instantiating.
-Waiting for two wasm scripts (ignoring first non-wasm script).
-Source of script wasm://wasm/wasm-18214bfe/wasm-18214bfe-0:
-1: func $wasm_A
-2:   nop
-3:   nop
-4: end
-
-Source of script wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:
-1: func $wasm_B (param i32)
-2:   loop
-3:     local.get 0
-4:     if
-5:       local.get 0
-6:       i32.const 1
-7:       i32.sub
-8:       local.set 0
-9:       call 0
-10:       br 1
-11:     end
-12:   end
-13: end
-
-Setting breakpoint on line 8 on script wasm://wasm/wasm-18214bfe/wasm-18214bfe-1
-Setting breakpoint on line 7 on script wasm://wasm/wasm-18214bfe/wasm-18214bfe-1
-Setting breakpoint on line 6 on script wasm://wasm/wasm-18214bfe/wasm-18214bfe-1
-Setting breakpoint on line 5 on script wasm://wasm/wasm-18214bfe/wasm-18214bfe-1
-Setting breakpoint on line 3 on script wasm://wasm/wasm-18214bfe/wasm-18214bfe-1
-Setting breakpoint on line 4 on script wasm://wasm/wasm-18214bfe/wasm-18214bfe-1
+Waiting for wasm script (ignoring first non-wasm script).
+Setting breakpoint at offset 54 on script wasm://wasm/18214bfe
+Setting breakpoint at offset 53 on script wasm://wasm/18214bfe
+Setting breakpoint at offset 51 on script wasm://wasm/18214bfe
+Setting breakpoint at offset 49 on script wasm://wasm/18214bfe
+Setting breakpoint at offset 45 on script wasm://wasm/18214bfe
+Setting breakpoint at offset 47 on script wasm://wasm/18214bfe
 Calling main(4)
-Breaking on line 3
-Breaking on line 4
-Breaking on line 5
-Breaking on line 6
-Breaking on line 7
-Breaking on line 8
-Breaking on line 3
-Breaking on line 4
-Breaking on line 5
-Breaking on line 6
-Breaking on line 7
-Breaking on line 8
-Breaking on line 3
-Breaking on line 4
-Breaking on line 5
-Breaking on line 6
-Breaking on line 7
-Breaking on line 8
-Breaking on line 3
-Breaking on line 4
-Breaking on line 5
-Breaking on line 6
-Breaking on line 7
-Breaking on line 8
-Breaking on line 3
+Breaking on byte offset 45
+Breaking on byte offset 47
+Breaking on byte offset 49
+Breaking on byte offset 51
+Breaking on byte offset 53
+Breaking on byte offset 54
+Breaking on byte offset 45
+Breaking on byte offset 47
+Breaking on byte offset 49
+Breaking on byte offset 51
+Breaking on byte offset 53
+Breaking on byte offset 54
+Breaking on byte offset 45
+Breaking on byte offset 47
+Breaking on byte offset 49
+Breaking on byte offset 51
+Breaking on byte offset 53
+Breaking on byte offset 54
+Breaking on byte offset 45
+Breaking on byte offset 47
+Breaking on byte offset 49
+Breaking on byte offset 51
+Breaking on byte offset 53
+Breaking on byte offset 54
+Breaking on byte offset 45
+Breaking on byte offset 47
 exports.main returned!
 Finished!
diff --git a/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff-expected.txt b/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff-expected.txt
new file mode 100644
index 00000000000000..735fc49f44f744
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff-expected.txt
@@ -0,0 +1,12 @@
+Tests stepping through wasm scripts.
+Instantiating.
+Waiting for wasm script (ignoring first non-wasm script).
+Setting breakpoint at offset 54 on script wasm://wasm/18214bfe
+Setting breakpoint at offset 53 on script wasm://wasm/18214bfe
+Setting breakpoint at offset 51 on script wasm://wasm/18214bfe
+Setting breakpoint at offset 49 on script wasm://wasm/18214bfe
+Setting breakpoint at offset 45 on script wasm://wasm/18214bfe
+Setting breakpoint at offset 47 on script wasm://wasm/18214bfe
+Calling main(4)
+exports.main returned!
+Finished!
diff --git a/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff.js b/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff.js
new file mode 100644
index 00000000000000..ce70f9192103ad
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff.js
@@ -0,0 +1,93 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --debug-in-liftoff
+
+const {session, contextGroup, Protocol} =
+    InspectorTest.start('Tests stepping through wasm scripts.');
+
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+
+const func_a_idx =
+    builder.addFunction('wasm_A', kSig_v_v).addBody([kExprNop, kExprNop]).index;
+
+// wasm_B calls wasm_A <param0> times.
+const func_b = builder.addFunction('wasm_B', kSig_v_i)
+    .addBody([
+      // clang-format off
+      kExprLoop, kWasmStmt,               // while
+        kExprLocalGet, 0,                 // -
+        kExprIf, kWasmStmt,               // if <param0> != 0
+          kExprLocalGet, 0,               // -
+          kExprI32Const, 1,               // -
+          kExprI32Sub,                    // -
+          kExprLocalSet, 0,               // decrease <param0>
+          kExprCallFunction, func_a_idx,  // -
+          kExprBr, 1,                     // continue
+          kExprEnd,                       // -
+        kExprEnd,                         // break
+      // clang-format on
+    ])
+    .exportAs('main');
+
+const module_bytes = builder.toArray();
+
+function instantiate(bytes) {
+  let buffer = new ArrayBuffer(bytes.length);
+  let view = new Uint8Array(buffer);
+  for (let i = 0; i < bytes.length; ++i) {
+    view[i] = bytes[i] | 0;
+  }
+
+  let module = new WebAssembly.Module(buffer);
+  return new WebAssembly.Instance(module);
+}
+
+const getResult = msg => msg.result || InspectorTest.logMessage(msg);
+
+const evalWithUrl = (code, url) =>
+    Protocol.Runtime
+        .evaluate({'expression': code + '\n//# sourceURL=v8://test/' + url})
+        .then(getResult);
+
+function setBreakpoint(offset, script) {
+  InspectorTest.log(
+      'Setting breakpoint at offset ' + offset + ' on script ' + script.url);
+  return Protocol.Debugger
+      .setBreakpoint(
+          {'location': {'scriptId': script.scriptId, 'lineNumber': 0, 'columnNumber': offset}})
+      .then(getResult);
+}
+
+Protocol.Debugger.onPaused(pause_msg => {
+  let loc = pause_msg.params.callFrames[0].location;
+  if (loc.lineNumber != 0) {
+    InspectorTest.log('Unexpected line number: ' + loc.lineNumber);
+  }
+  InspectorTest.log('Breaking on byte offset ' + loc.columnNumber);
+  Protocol.Debugger.resume();
+});
+
+(async function test() {
+  await Protocol.Debugger.enable();
+  InspectorTest.log('Instantiating.');
+  // Spawn asynchronously:
+  let instantiate_code = 'const instance = (' + instantiate + ')(' +
+      JSON.stringify(module_bytes) + ');';
+  evalWithUrl(instantiate_code, 'instantiate');
+  InspectorTest.log(
+      'Waiting for wasm script (ignoring first non-wasm script).');
+  // Ignore javascript and full module wasm script, get scripts for functions.
+  const [, {params: wasm_script}] = await Protocol.Debugger.onceScriptParsed(2);
+  for (offset of [11, 10, 8, 6, 2, 4]) {
+    await setBreakpoint(func_b.body_offset + offset, wasm_script);
+  }
+  InspectorTest.log('Calling main(4)');
+  await evalWithUrl('instance.exports.main(4)', 'runWasm');
+  InspectorTest.log('exports.main returned!');
+  InspectorTest.log('Finished!');
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/wasm-set-breakpoint.js b/deps/v8/test/inspector/debugger/wasm-set-breakpoint.js
index 1696a0f59ce022..0c73cf5dba207a 100644
--- a/deps/v8/test/inspector/debugger/wasm-set-breakpoint.js
+++ b/deps/v8/test/inspector/debugger/wasm-set-breakpoint.js
@@ -13,7 +13,7 @@ const func_a_idx =
     builder.addFunction('wasm_A', kSig_v_v).addBody([kExprNop, kExprNop]).index;
 
 // wasm_B calls wasm_A <param0> times.
-builder.addFunction('wasm_B', kSig_v_i)
+const func_b = builder.addFunction('wasm_B', kSig_v_i)
     .addBody([
       // clang-format off
       kExprLoop, kWasmStmt,               // while
@@ -51,18 +51,21 @@ const evalWithUrl = (code, url) =>
         .evaluate({'expression': code + '\n//# sourceURL=v8://test/' + url})
         .then(getResult);
 
-function setBreakpoint(line, script) {
+function setBreakpoint(offset, script) {
   InspectorTest.log(
-      'Setting breakpoint on line ' + line + ' on script ' + script.url);
+      'Setting breakpoint at offset ' + offset + ' on script ' + script.url);
   return Protocol.Debugger
       .setBreakpoint(
-          {'location': {'scriptId': script.scriptId, 'lineNumber': line}})
+          {'location': {'scriptId': script.scriptId, 'lineNumber': 0, 'columnNumber': offset}})
       .then(getResult);
 }
 
 Protocol.Debugger.onPaused(pause_msg => {
   let loc = pause_msg.params.callFrames[0].location;
-  InspectorTest.log('Breaking on line ' + loc.lineNumber);
+  if (loc.lineNumber != 0) {
+    InspectorTest.log('Unexpected line number: ' + loc.lineNumber);
+  }
+  InspectorTest.log('Breaking on byte offset ' + loc.columnNumber);
   Protocol.Debugger.resume();
 });
 
@@ -74,19 +77,11 @@ Protocol.Debugger.onPaused(pause_msg => {
       JSON.stringify(module_bytes) + ');';
   evalWithUrl(instantiate_code, 'instantiate');
   InspectorTest.log(
-      'Waiting for two wasm scripts (ignoring first non-wasm script).');
-  const [, {params: wasm_script_a}, {params: wasm_script_b}] =
-      await Protocol.Debugger.onceScriptParsed(3);
-  for (script of [wasm_script_a, wasm_script_b]) {
-    InspectorTest.log('Source of script ' + script.url + ':');
-    let src_msg =
-        await Protocol.Debugger.getScriptSource({scriptId: script.scriptId});
-    let lines = getResult(src_msg).scriptSource.replace(/\s+$/, '').split('\n');
-    InspectorTest.log(
-        lines.map((line, nr) => (nr + 1) + ': ' + line).join('\n') + '\n');
-  }
-  for (line of [8, 7, 6, 5, 3, 4]) {
-    await setBreakpoint(line, wasm_script_b);
+      'Waiting for wasm script (ignoring first non-wasm script).');
+  // Ignore javascript and full module wasm script, get scripts for functions.
+  const [, {params: wasm_script}] = await Protocol.Debugger.onceScriptParsed(2);
+  for (offset of [11, 10, 8, 6, 2, 4]) {
+    await setBreakpoint(func_b.body_offset + offset, wasm_script);
   }
   InspectorTest.log('Calling main(4)');
   await evalWithUrl('instance.exports.main(4)', 'runWasm');
diff --git a/deps/v8/test/inspector/debugger/wasm-source-expected.txt b/deps/v8/test/inspector/debugger/wasm-source-expected.txt
index b140be087641a5..e81fa564dcc7cb 100644
--- a/deps/v8/test/inspector/debugger/wasm-source-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-source-expected.txt
@@ -1,10 +1,10 @@
 Tests how wasm scrips report the source
-Check that inspector gets disassembled wasm code
+Check that inspector gets wasm bytecode
 Paused on debugger!
 Number of frames: 5
 [0]     debugger;
-[1]   call 0
-[2]     call_indirect 2
+[1] Wasm offset 72: 0x10
+[2] Wasm offset 81: 0x11
 [3]   instance.exports.main();
 [4] testFunction(module_bytes)
 Finished.
diff --git a/deps/v8/test/inspector/debugger/wasm-source.js b/deps/v8/test/inspector/debugger/wasm-source.js
index 6c5b14c4becd43..55da49f446da60 100644
--- a/deps/v8/test/inspector/debugger/wasm-source.js
+++ b/deps/v8/test/inspector/debugger/wasm-source.js
@@ -51,30 +51,37 @@ contextGroup.addScript('var module_bytes = ' + JSON.stringify(module_bytes));
 
 Protocol.Debugger.enable();
 Protocol.Debugger.onPaused(handleDebuggerPaused);
-InspectorTest.log('Check that inspector gets disassembled wasm code');
+InspectorTest.log('Check that inspector gets wasm bytecode');
 Protocol.Runtime.evaluate({'expression': 'testFunction(module_bytes)'});
 
-function handleDebuggerPaused(message) {
+async function handleDebuggerPaused(message) {
   InspectorTest.log('Paused on debugger!');
   var frames = message.params.callFrames;
   InspectorTest.log('Number of frames: ' + frames.length);
-  function dumpSourceLine(frameId, sourceMessage) {
+  async function dumpSourceLine(frameId, sourceMessage) {
     if (sourceMessage.error) InspectorTest.logObject(sourceMessage);
     var text = sourceMessage.result.scriptSource;
     var lineNr = frames[frameId].location.lineNumber;
-    var line = text.split('\n')[lineNr];
-    InspectorTest.log('[' + frameId + '] ' + line);
+    if (text) {
+      var line = text.split('\n')[lineNr];
+      InspectorTest.log('[' + frameId + '] ' + line);
+    } else {
+      if (lineNr != 0) {
+        InspectorTest.log('Unexpected line number in wasm: ' + lineNr);
+      }
+      let byteOffset = frames[frameId].location.columnNumber;
+      let data = InspectorTest.decodeBase64(sourceMessage.result.bytecode);
+      // Print a byte, which can be compared to the expected wasm opcode.
+      InspectorTest.log('[' + frameId + '] Wasm offset ' + byteOffset
+                        + ': 0x' + data[byteOffset].toString(16));
+    }
   }
-  function next(frameId) {
-    if (frameId == frames.length) return Promise.resolve();
-    return Protocol.Debugger
-        .getScriptSource({scriptId: frames[frameId].location.scriptId})
-        .then(dumpSourceLine.bind(null, frameId))
-        .then(() => next(frameId + 1));
-  }
-  function finished() {
-    InspectorTest.log('Finished.');
-    InspectorTest.completeTest();
+
+  for (let frameId = 0; frameId < frames.length; frameId++) {
+    result = await Protocol.Debugger
+        .getScriptSource({scriptId: frames[frameId].location.scriptId});
+    await dumpSourceLine(frameId, result);
   }
-  next(0).then(finished);
+  InspectorTest.log('Finished.');
+  InspectorTest.completeTest();
 }
diff --git a/deps/v8/test/inspector/debugger/wasm-stack-expected.txt b/deps/v8/test/inspector/debugger/wasm-stack-expected.txt
index 1d6f51b9976dfd..364a319b930fdc 100644
--- a/deps/v8/test/inspector/debugger/wasm-stack-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-stack-expected.txt
@@ -3,8 +3,8 @@ Running testFunction with generated wasm bytes...
 Paused on 'debugger;'
 Number of frames: 5
   - [0] {"functionName":"call_debugger","function_lineNumber":1,"function_columnNumber":24,"lineNumber":2,"columnNumber":4}
-  - [1] {"functionName":"call_func","lineNumber":1,"columnNumber":2}
-  - [2] {"functionName":"main","lineNumber":2,"columnNumber":4}
+  - [1] {"functionName":"call_func","lineNumber":0,"columnNumber":55}
+  - [2] {"functionName":"main","lineNumber":0,"columnNumber":62}
   - [3] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":14,"columnNumber":19}
   - [4] {"functionName":"","function_lineNumber":0,"function_columnNumber":0,"lineNumber":0,"columnNumber":0}
 Getting v8-generated stack trace...
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets-expected.txt b/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets-expected.txt
new file mode 100644
index 00000000000000..409e7cc00248c9
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets-expected.txt
@@ -0,0 +1,300 @@
+Tests stepping through wasm scripts by byte offsets
+Setting up global instance variable.
+Got wasm script: wasm://wasm/7dfc8356
+Setting breakpoint on offset 59 (should be propagated to 60, the offset of the call), url wasm://wasm/7dfc8356
+{
+    columnNumber : 60
+    lineNumber : 0
+    scriptId : <scriptId>
+}
+Paused at wasm://wasm/7dfc8356:0:60
+at wasm_B (0:60):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":3}
+   stack: {"0":1024}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:39
+at wasm_A (0:39):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1024}
+   stack: {}
+at wasm_B (0:60):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":3}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepOver called
+Paused at wasm://wasm/7dfc8356:0:40
+at wasm_A (0:40):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1024}
+   stack: {}
+at wasm_B (0:60):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":3}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepOut called
+Paused at wasm://wasm/7dfc8356:0:62
+at wasm_B (0:62):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":3}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepOut called
+Paused at wasm://wasm/7dfc8356:0:60
+at wasm_B (0:60):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":2}
+   stack: {"0":1024}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepOver called
+Paused at wasm://wasm/7dfc8356:0:62
+at wasm_B (0:62):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":2}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:44
+at wasm_B (0:44):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":2}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.resume called
+Paused at wasm://wasm/7dfc8356:0:60
+at wasm_B (0:60):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1}
+   stack: {"0":1024}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:39
+at wasm_A (0:39):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1024}
+   stack: {}
+at wasm_B (0:60):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepOut called
+Paused at wasm://wasm/7dfc8356:0:62
+at wasm_B (0:62):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:44
+at wasm_B (0:44):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:46
+at wasm_B (0:46):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:48
+at wasm_B (0:48):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1}
+   stack: {"0":1}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:50
+at wasm_B (0:50):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:52
+at wasm_B (0:52):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1}
+   stack: {"0":1}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:54
+at wasm_B (0:54):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1}
+   stack: {"0":1,"1":1}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:55
+at wasm_B (0:55):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1}
+   stack: {"0":0}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:57
+at wasm_B (0:57):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":0}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:60
+at wasm_B (0:60):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":0}
+   stack: {"0":1024}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:39
+at wasm_A (0:39):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1024}
+   stack: {}
+at wasm_B (0:60):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":0}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:40
+at wasm_A (0:40):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1024}
+   stack: {}
+at wasm_B (0:60):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":0}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:41
+at wasm_A (0:41):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":1024}
+   stack: {}
+at wasm_B (0:60):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":0}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.stepInto called
+Paused at wasm://wasm/7dfc8356:0:62
+at wasm_B (0:62):
+ - scope (global):
+   -- skipped
+ - scope (local):
+   locals: {"arg#0":0}
+   stack: {}
+at (anonymous) (0:17):
+ - scope (global):
+   -- skipped
+Debugger.resume called
+exports.main returned!
+Finished!
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets.js b/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets.js
new file mode 100644
index 00000000000000..738544d418f756
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets.js
@@ -0,0 +1,124 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+    InspectorTest.start('Tests stepping through wasm scripts by byte offsets');
+
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+
+var func_a_idx =
+    builder.addFunction('wasm_A', kSig_v_i).addBody([kExprNop, kExprNop]).index;
+
+// wasm_B calls wasm_A <param0> times.
+builder.addFunction('wasm_B', kSig_v_i)
+    .addBody([
+      // clang-format off
+      kExprLoop, kWasmStmt,               // while
+        kExprLocalGet, 0,                 // -
+        kExprIf, kWasmStmt,               // if <param0> != 0
+          kExprLocalGet, 0,               // -
+          kExprI32Const, 1,               // -
+          kExprI32Sub,                    // -
+          kExprLocalSet, 0,               // decrease <param0>
+          ...wasmI32Const(1024),          // some longer i32 const (2 byte imm)
+          kExprCallFunction, func_a_idx,  // -
+          kExprBr, 1,                     // continue
+          kExprEnd,                       // -
+        kExprEnd,                         // break
+      // clang-format on
+    ])
+    .exportAs('main');
+
+
+var module_bytes = builder.toArray();
+
+function instantiate(bytes) {
+  var buffer = new ArrayBuffer(bytes.length);
+  var view = new Uint8Array(buffer);
+  for (var i = 0; i < bytes.length; ++i) {
+    view[i] = bytes[i] | 0;
+  }
+
+  var module = new WebAssembly.Module(buffer);
+  // Set global variable.
+  instance = new WebAssembly.Instance(module);
+}
+
+(async function test() {
+  for (const action of ['stepInto', 'stepOver', 'stepOut', 'resume'])
+    InspectorTest.logProtocolCommandCalls('Debugger.' + action);
+
+  await Protocol.Debugger.enable();
+  InspectorTest.log('Setting up global instance variable.');
+  Protocol.Runtime.evaluate({
+    expression: `var instance;` +
+        `(${instantiate.toString()})(${JSON.stringify(module_bytes)})`
+  });
+  const [, {params: wasmScript}] = await Protocol.Debugger.onceScriptParsed(2);
+
+  InspectorTest.log('Got wasm script: ' + wasmScript.url);
+
+  // Set the breakpoint on a non-breakable position. This should resolve to the
+  // next instruction.
+  InspectorTest.log(
+      `Setting breakpoint on offset 59 (should be propagated to 60, the ` +
+      `offset of the call), url ${wasmScript.url}`);
+  const bpmsg = await Protocol.Debugger.setBreakpoint({
+    location: {scriptId: wasmScript.scriptId, lineNumber: 0, columnNumber: 59}
+  });
+
+  const actualLocation = bpmsg.result.actualLocation;
+  InspectorTest.logMessage(actualLocation);
+  Protocol.Runtime.evaluate({ expression: 'instance.exports.main(4)' });
+  await waitForPauseAndStep('stepInto');  // into call to wasm_A
+  await waitForPauseAndStep('stepOver');  // over first nop
+  await waitForPauseAndStep('stepOut');   // out of wasm_A
+  await waitForPauseAndStep('stepOut');   // out of wasm_B, stop on breakpoint
+  await waitForPauseAndStep('stepOver');  // over call
+  await waitForPauseAndStep('stepInto');  // == stepOver br
+  await waitForPauseAndStep('resume');    // to next breakpoint (3rd iteration)
+  await waitForPauseAndStep('stepInto');  // into wasm_A
+  await waitForPauseAndStep('stepOut');   // out to wasm_B
+  // Now step 10 times, until we are in wasm_A again.
+  for (let i = 0; i < 10; ++i) await waitForPauseAndStep('stepInto');
+  // 3 more times, back to wasm_B.
+  for (let i = 0; i < 3; ++i) await waitForPauseAndStep('stepInto');
+  // Then just resume.
+  await waitForPauseAndStep('resume');
+  InspectorTest.log('exports.main returned!');
+  InspectorTest.log('Finished!');
+})().catch(reason => InspectorTest.log(`Failed: ${reason}`))
+    .finally(InspectorTest.completeTest);
+
+async function waitForPauseAndStep(stepAction) {
+  const {params: {callFrames}} = await Protocol.Debugger.oncePaused();
+  const topFrame = callFrames[0];
+  InspectorTest.log(
+      `Paused at ${topFrame.url}:${topFrame.location.lineNumber}:${topFrame.location.columnNumber}`);
+  for (var frame of callFrames) {
+    const functionName = frame.functionName || '(anonymous)';
+    const lineNumber = frame.location.lineNumber;
+    const columnNumber = frame.location.columnNumber;
+    InspectorTest.log(`at ${functionName} (${lineNumber}:${columnNumber}):`);
+    for (var scope of frame.scopeChain) {
+      InspectorTest.logObject(' - scope (' + scope.type + '):');
+      if (scope.type === 'global') {
+        InspectorTest.logObject('   -- skipped');
+      } else {
+        const {result: {result: {value}}} =
+          await Protocol.Runtime.callFunctionOn({
+            objectId: scope.object.objectId,
+            functionDeclaration: 'function() { return this; }',
+            returnByValue: true
+          });
+        if (value.locals)
+          InspectorTest.log(`   locals: ${JSON.stringify(value.locals)}`);
+        InspectorTest.log(`   stack: ${JSON.stringify(value.stack)}`);
+      }
+    }
+  }
+  Protocol.Debugger[stepAction]();
+}
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping-expected.txt b/deps/v8/test/inspector/debugger/wasm-stepping-expected.txt
deleted file mode 100644
index 4a1fd58f2b7e4d..00000000000000
--- a/deps/v8/test/inspector/debugger/wasm-stepping-expected.txt
+++ /dev/null
@@ -1,330 +0,0 @@
-Tests stepping through wasm scripts
-Installing code an global variable.
-Calling instantiate function.
-Waiting for two wasm scripts to be parsed.
-Ignoring script with url v8://test/callInstantiate
-Got wasm script: wasm://wasm/wasm-18214bfe/wasm-18214bfe-0
-Requesting source for wasm://wasm/wasm-18214bfe/wasm-18214bfe-0...
-Got wasm script: wasm://wasm/wasm-18214bfe/wasm-18214bfe-1
-Requesting source for wasm://wasm/wasm-18214bfe/wasm-18214bfe-1...
-func $wasm_A
-  nop
-  nop
-end
-
-func $wasm_B (param i32)
-  loop
-    local.get 0
-    if
-      local.get 0
-      i32.const 1
-      i32.sub
-      local.set 0
-      call 0
-      br 1
-    end
-  end
-end
-
-Setting breakpoint on line 7 (on the setlocal before the call), url wasm://wasm/wasm-18214bfe/wasm-18214bfe-1
-{
-    columnNumber : 6
-    lineNumber : 7
-    scriptId : <scriptId>
-}
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:7:6:       >local.set 0
-at wasm_B (7:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":4} (Object)
-   stack: {"0":3} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:8:6:       >call 0
-at wasm_B (8:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":3} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-0:1:2:   >nop
-at wasm_A (1:2):
- - scope (global):
-   -- skipped
- - scope (local):
-   stack: {} (Object)
-at wasm_B (8:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":3} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepOver called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-0:2:2:   >nop
-at wasm_A (2:2):
- - scope (global):
-   -- skipped
- - scope (local):
-   stack: {} (Object)
-at wasm_B (8:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":3} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepOut called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:9:6:       >br 1
-at wasm_B (9:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":3} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepOut called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:7:6:       >local.set 0
-at wasm_B (7:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":3} (Object)
-   stack: {"0":2} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepOver called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:8:6:       >call 0
-at wasm_B (8:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":2} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepOver called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:9:6:       >br 1
-at wasm_B (9:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":2} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.resume called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:7:6:       >local.set 0
-at wasm_B (7:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":2} (Object)
-   stack: {"0":1} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:8:6:       >call 0
-at wasm_B (8:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":1} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-0:1:2:   >nop
-at wasm_A (1:2):
- - scope (global):
-   -- skipped
- - scope (local):
-   stack: {} (Object)
-at wasm_B (8:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":1} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepOut called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:9:6:       >br 1
-at wasm_B (9:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":1} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:1:2:   >loop
-at wasm_B (1:2):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":1} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:2:4:     >local.get 0
-at wasm_B (2:4):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":1} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:3:4:     >if
-at wasm_B (3:4):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":1} (Object)
-   stack: {"0":1} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:4:6:       >local.get 0
-at wasm_B (4:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":1} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:5:6:       >i32.const 1
-at wasm_B (5:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":1} (Object)
-   stack: {"0":1} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:6:6:       >i32.sub
-at wasm_B (6:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":1} (Object)
-   stack: {"0":1,"1":1} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:7:6:       >local.set 0
-at wasm_B (7:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":1} (Object)
-   stack: {"0":0} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:8:6:       >call 0
-at wasm_B (8:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":0} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-0:1:2:   >nop
-at wasm_A (1:2):
- - scope (global):
-   -- skipped
- - scope (local):
-   stack: {} (Object)
-at wasm_B (8:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":0} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-0:2:2:   >nop
-at wasm_A (2:2):
- - scope (global):
-   -- skipped
- - scope (local):
-   stack: {} (Object)
-at wasm_B (8:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":0} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-0:3:0: >end
-at wasm_A (3:0):
- - scope (global):
-   -- skipped
- - scope (local):
-   stack: {} (Object)
-at wasm_B (8:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":0} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.stepInto called
-Paused at wasm://wasm/wasm-18214bfe/wasm-18214bfe-1:9:6:       >br 1
-at wasm_B (9:6):
- - scope (global):
-   -- skipped
- - scope (local):
-   locals: {"arg#0":0} (Object)
-   stack: {} (Object)
-at (anonymous) (0:17):
- - scope (global):
-   -- skipped
-Debugger.resume called
-exports.main returned!
-Finished!
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping-in-from-js-expected.txt b/deps/v8/test/inspector/debugger/wasm-stepping-in-from-js-expected.txt
new file mode 100644
index 00000000000000..422aa8b9f32036
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-stepping-in-from-js-expected.txt
@@ -0,0 +1,32 @@
+Tests stepping from javascript into wasm
+Installing code and global variable.
+Calling instantiate function.
+Waiting for wasm scripts to be parsed.
+Ignoring script with url v8://test/callInstantiate
+Got wasm script: wasm://wasm/fa045c1e
+Setting breakpoint on line 3 of wasm function
+{
+    columnNumber : 37
+    lineNumber : 0
+    scriptId : <scriptId>
+}
+paused
+function test() {
+  #debugger;
+  instance.exports.main(1);
+
+Debugger.stepInto
+paused
+  debugger;
+  #instance.exports.main(1);
+}
+
+Debugger.stepInto
+paused
+Script wasm://wasm/fa045c1e byte offset 35: Wasm opcode 0x20
+Debugger.resume
+paused
+Script wasm://wasm/fa045c1e byte offset 37: Wasm opcode 0x41
+Debugger.resume
+exports.main returned!
+Finished!
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping-in-from-js.js b/deps/v8/test/inspector/debugger/wasm-stepping-in-from-js.js
new file mode 100644
index 00000000000000..f8c0b9dbbb1e80
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-stepping-in-from-js.js
@@ -0,0 +1,104 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start('Tests stepping from javascript into wasm');
+session.setupScriptMap();
+
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+
+// wasm_A
+let func = builder.addFunction('wasm_A', kSig_i_i)
+    .addBody([
+      // clang-format off
+      kExprLocalGet, 0,              // Line 1: get input
+      kExprI32Const, 1,              // Line 2: get constant 1
+      kExprI32Sub                    // Line 3: decrease
+      // clang-format on
+    ])
+    .exportAs('main');
+
+let module_bytes = builder.toArray();
+
+function instantiate(bytes) {
+  let buffer = new ArrayBuffer(bytes.length);
+  let view = new Uint8Array(buffer);
+  for (let i = 0; i < bytes.length; ++i) {
+    view[i] = bytes[i] | 0;
+  }
+
+  let module = new WebAssembly.Module(buffer);
+  // Set global variable.
+  instance = new WebAssembly.Instance(module);
+}
+
+let evalWithUrl = (code, url) => Protocol.Runtime.evaluate(
+    {'expression': code + '\n//# sourceURL=v8://test/' + url});
+
+Protocol.Debugger.onPaused(async message => {
+  InspectorTest.log("paused");
+  var frames = message.params.callFrames;
+  await session.logSourceLocation(frames[0].location);
+  let action = step_actions.shift() || 'resume';
+  InspectorTest.log('Debugger.' + action)
+  await Protocol.Debugger[action]();
+})
+
+let step_actions = [
+  'stepInto',  // # debugger
+  'stepInto',  // step into instance.exports.main(1)
+  'resume',    // move to breakpoint
+  // then just resume.
+  'resume',
+];
+
+contextGroup.addScript(`
+function test() {
+  debugger;
+  instance.exports.main(1);
+}
+//# sourceURL=test.js`);
+
+(async function Test() {
+  await Protocol.Debugger.enable();
+  InspectorTest.log('Installing code and global variable.');
+  await evalWithUrl('var instance;\n' + instantiate.toString(), 'setup');
+  InspectorTest.log('Calling instantiate function.');
+  evalWithUrl(
+      'instantiate(' + JSON.stringify(module_bytes) + ')', 'callInstantiate');
+  const scriptId = await waitForWasmScript();
+  InspectorTest.log(
+      'Setting breakpoint on line 3 of wasm function');
+  let msg = await Protocol.Debugger.setBreakpoint(
+      {'location': {'scriptId': scriptId, 'lineNumber': 0, 'columnNumber': 2 + func.body_offset}});
+  printFailure(msg);
+  InspectorTest.logMessage(msg.result.actualLocation);
+  await Protocol.Runtime.evaluate({ expression: 'test()' });
+  InspectorTest.log('exports.main returned!');
+  InspectorTest.log('Finished!');
+  InspectorTest.completeTest();
+})();
+
+function printFailure(message) {
+  if (!message.result) {
+    InspectorTest.logMessage(message);
+  }
+  return message;
+}
+
+async function waitForWasmScript() {
+  InspectorTest.log('Waiting for wasm scripts to be parsed.');
+  while (true) {
+    let msg = await Protocol.Debugger.onceScriptParsed();
+    let url = msg.params.url;
+    if (!url.startsWith('wasm://')) {
+      InspectorTest.log('Ignoring script with url ' + url);
+      continue;
+    }
+    let scriptId = msg.params.scriptId;
+    InspectorTest.log('Got wasm script: ' + url);
+    return scriptId;
+  }
+}
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping-to-js-expected.txt b/deps/v8/test/inspector/debugger/wasm-stepping-to-js-expected.txt
new file mode 100644
index 00000000000000..962456cabf9c8a
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-stepping-to-js-expected.txt
@@ -0,0 +1,62 @@
+Tests stepping to javascript from wasm
+Installing code and global variable.
+Calling instantiate function.
+Waiting for wasm scripts to be parsed.
+Ignoring script with url v8://test/callInstantiate
+Got wasm script: wasm://wasm/485e942e
+Setting breakpoint at start of wasm function
+{
+    columnNumber : 33
+    lineNumber : 0
+    scriptId : <scriptId>
+}
+Start run 1
+paused
+function test() {
+  #debugger;
+  instance.exports.main();
+
+Debugger.resume
+paused
+Script wasm://wasm/485e942e byte offset 33: Wasm opcode 0x1
+Debugger.stepOut
+paused
+  instance.exports.main();
+  var x = #1;
+  x++;
+
+Debugger.resume
+exports.main returned!
+Finished run 1!
+
+Start run 2
+paused
+function test() {
+  #debugger;
+  instance.exports.main();
+
+Debugger.resume
+paused
+Script wasm://wasm/485e942e byte offset 33: Wasm opcode 0x1
+Debugger.stepOver
+paused
+Script wasm://wasm/485e942e byte offset 34: Wasm opcode 0xb
+Debugger.resume
+exports.main returned!
+Finished run 2!
+
+Start run 3
+paused
+function test() {
+  #debugger;
+  instance.exports.main();
+
+Debugger.resume
+paused
+Script wasm://wasm/485e942e byte offset 33: Wasm opcode 0x1
+Debugger.stepInto
+paused
+Script wasm://wasm/485e942e byte offset 34: Wasm opcode 0xb
+Debugger.resume
+exports.main returned!
+Finished run 3!
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping-to-js.js b/deps/v8/test/inspector/debugger/wasm-stepping-to-js.js
new file mode 100644
index 00000000000000..f480e4e567da5a
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-stepping-to-js.js
@@ -0,0 +1,123 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start('Tests stepping to javascript from wasm');
+session.setupScriptMap();
+
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+
+// wasm_A
+let func = builder.addFunction('wasm_A', kSig_v_v)
+    .addBody([
+      // clang-format off
+      kExprNop,   // Line 1
+      // clang-format on
+    ])
+    .exportAs('main');
+
+let module_bytes = builder.toArray();
+
+function instantiate(bytes) {
+  let buffer = new ArrayBuffer(bytes.length);
+  let view = new Uint8Array(buffer);
+  for (let i = 0; i < bytes.length; ++i) {
+    view[i] = bytes[i] | 0;
+  }
+
+  let module = new WebAssembly.Module(buffer);
+  // Set global variable.
+  instance = new WebAssembly.Instance(module);
+}
+
+let evalWithUrl = (code, url) => Protocol.Runtime.evaluate(
+    {'expression': code + '\n//# sourceURL=v8://test/' + url});
+
+Protocol.Debugger.onPaused(async message => {
+  InspectorTest.log("paused");
+  var frames = message.params.callFrames;
+  await session.logSourceLocation(frames[0].location);
+  let action = step_actions.shift() || 'resume';
+  InspectorTest.log('Debugger.' + action)
+  await Protocol.Debugger[action]();
+})
+
+let step_actions = [
+  // start of run 1
+  'resume',    // move to breakpoint
+  // then get back to Javascript.
+  'stepOut',
+  'resume',
+  // end of run 1
+
+  // start of run 2
+  'resume',    // move to breakpoint
+  // then get back to Javascript.
+  'stepOver',
+  'resume',
+  // end of run 2
+
+  // start of run 3
+  'resume',    // move to breakpoint
+  // then get back to Javascript.
+  'stepInto',
+  'resume',
+  // end of run 3
+];
+
+contextGroup.addScript(`
+function test() {
+  debugger;
+  instance.exports.main();
+  var x = 1;
+  x++;
+}
+//# sourceURL=test.js`);
+
+(async function Test() {
+  await Protocol.Debugger.enable();
+  InspectorTest.log('Installing code and global variable.');
+  await evalWithUrl('var instance;\n' + instantiate.toString(), 'setup');
+  InspectorTest.log('Calling instantiate function.');
+  evalWithUrl(
+      'instantiate(' + JSON.stringify(module_bytes) + ')', 'callInstantiate');
+  const scriptId = await waitForWasmScript();
+  InspectorTest.log(
+      'Setting breakpoint at start of wasm function');
+  let msg = await Protocol.Debugger.setBreakpoint(
+      {'location': {'scriptId': scriptId, 'lineNumber': 0, 'columnNumber': func.body_offset}});
+  printFailure(msg);
+  InspectorTest.logMessage(msg.result.actualLocation);
+
+  for (var i=1; i<=3; i++) {
+    InspectorTest.log('Start run '+ i);
+    await Protocol.Runtime.evaluate({ expression: 'test()' });
+    InspectorTest.log('exports.main returned!');
+    InspectorTest.log('Finished run '+ i +'!\n');
+  }
+  InspectorTest.completeTest();
+})();
+
+function printFailure(message) {
+  if (!message.result) {
+    InspectorTest.logMessage(message);
+  }
+  return message;
+}
+
+async function waitForWasmScript() {
+  InspectorTest.log('Waiting for wasm scripts to be parsed.');
+  while (true) {
+    let msg = await Protocol.Debugger.onceScriptParsed();
+    let url = msg.params.url;
+    if (!url.startsWith('wasm://')) {
+      InspectorTest.log('Ignoring script with url ' + url);
+      continue;
+    }
+    let scriptId = msg.params.scriptId;
+    InspectorTest.log('Got wasm script: ' + url);
+    return scriptId;
+  }
+}
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping-with-source-map-expected.txt b/deps/v8/test/inspector/debugger/wasm-stepping-with-source-map-expected.txt
index 325049fffb58be..7d4f3a71ed539c 100644
--- a/deps/v8/test/inspector/debugger/wasm-stepping-with-source-map-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-stepping-with-source-map-expected.txt
@@ -1,16 +1,16 @@
 Tests stepping through wasm scripts with source maps
 Installing code an global variable and instantiate.
-Got wasm script: wasm://wasm/wasm-3697f0fe
+Got wasm script: wasm://wasm/3697f0fe
 Script sourceMapURL: abc
-Requesting source for wasm://wasm/wasm-3697f0fe...
+Requesting source for wasm://wasm/3697f0fe...
 Source retrieved without error: true
-Setting breakpoint on offset 54 (on the setlocal before the call), url wasm://wasm/wasm-3697f0fe
+Setting breakpoint on offset 54 (on the setlocal before the call), url wasm://wasm/3697f0fe
 {
     columnNumber : 54
     lineNumber : 0
     scriptId : <scriptId>
 }
-Paused at wasm://wasm/wasm-3697f0fe:0:54
+Paused at wasm://wasm/3697f0fe:0:54
 at wasm_B (0:54):
  - scope (global):
    -- skipped
@@ -21,7 +21,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:56
+Paused at wasm://wasm/3697f0fe:0:56
 at wasm_B (0:56):
  - scope (global):
    -- skipped
@@ -32,7 +32,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:38
+Paused at wasm://wasm/3697f0fe:0:38
 at wasm_A (0:38):
  - scope (global):
    -- skipped
@@ -48,7 +48,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepOver called
-Paused at wasm://wasm/wasm-3697f0fe:0:39
+Paused at wasm://wasm/3697f0fe:0:39
 at wasm_A (0:39):
  - scope (global):
    -- skipped
@@ -64,7 +64,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepOut called
-Paused at wasm://wasm/wasm-3697f0fe:0:58
+Paused at wasm://wasm/3697f0fe:0:58
 at wasm_B (0:58):
  - scope (global):
    -- skipped
@@ -75,7 +75,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepOut called
-Paused at wasm://wasm/wasm-3697f0fe:0:54
+Paused at wasm://wasm/3697f0fe:0:54
 at wasm_B (0:54):
  - scope (global):
    -- skipped
@@ -86,7 +86,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepOver called
-Paused at wasm://wasm/wasm-3697f0fe:0:56
+Paused at wasm://wasm/3697f0fe:0:56
 at wasm_B (0:56):
  - scope (global):
    -- skipped
@@ -97,7 +97,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepOver called
-Paused at wasm://wasm/wasm-3697f0fe:0:58
+Paused at wasm://wasm/3697f0fe:0:58
 at wasm_B (0:58):
  - scope (global):
    -- skipped
@@ -108,7 +108,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.resume called
-Paused at wasm://wasm/wasm-3697f0fe:0:54
+Paused at wasm://wasm/3697f0fe:0:54
 at wasm_B (0:54):
  - scope (global):
    -- skipped
@@ -119,7 +119,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:56
+Paused at wasm://wasm/3697f0fe:0:56
 at wasm_B (0:56):
  - scope (global):
    -- skipped
@@ -130,7 +130,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:38
+Paused at wasm://wasm/3697f0fe:0:38
 at wasm_A (0:38):
  - scope (global):
    -- skipped
@@ -146,7 +146,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepOut called
-Paused at wasm://wasm/wasm-3697f0fe:0:58
+Paused at wasm://wasm/3697f0fe:0:58
 at wasm_B (0:58):
  - scope (global):
    -- skipped
@@ -157,7 +157,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:43
+Paused at wasm://wasm/3697f0fe:0:43
 at wasm_B (0:43):
  - scope (global):
    -- skipped
@@ -168,7 +168,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:45
+Paused at wasm://wasm/3697f0fe:0:45
 at wasm_B (0:45):
  - scope (global):
    -- skipped
@@ -179,7 +179,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:47
+Paused at wasm://wasm/3697f0fe:0:47
 at wasm_B (0:47):
  - scope (global):
    -- skipped
@@ -190,7 +190,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:49
+Paused at wasm://wasm/3697f0fe:0:49
 at wasm_B (0:49):
  - scope (global):
    -- skipped
@@ -201,7 +201,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:51
+Paused at wasm://wasm/3697f0fe:0:51
 at wasm_B (0:51):
  - scope (global):
    -- skipped
@@ -212,7 +212,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:53
+Paused at wasm://wasm/3697f0fe:0:53
 at wasm_B (0:53):
  - scope (global):
    -- skipped
@@ -223,7 +223,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:54
+Paused at wasm://wasm/3697f0fe:0:54
 at wasm_B (0:54):
  - scope (global):
    -- skipped
@@ -234,7 +234,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:56
+Paused at wasm://wasm/3697f0fe:0:56
 at wasm_B (0:56):
  - scope (global):
    -- skipped
@@ -245,7 +245,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:38
+Paused at wasm://wasm/3697f0fe:0:38
 at wasm_A (0:38):
  - scope (global):
    -- skipped
@@ -261,7 +261,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:39
+Paused at wasm://wasm/3697f0fe:0:39
 at wasm_A (0:39):
  - scope (global):
    -- skipped
@@ -277,7 +277,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:40
+Paused at wasm://wasm/3697f0fe:0:40
 at wasm_A (0:40):
  - scope (global):
    -- skipped
@@ -293,7 +293,7 @@ at (anonymous) (0:17):
  - scope (global):
    -- skipped
 Debugger.stepInto called
-Paused at wasm://wasm/wasm-3697f0fe:0:58
+Paused at wasm://wasm/3697f0fe:0:58
 at wasm_B (0:58):
  - scope (global):
    -- skipped
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping.js b/deps/v8/test/inspector/debugger/wasm-stepping.js
deleted file mode 100644
index 01d83b6696fbd3..00000000000000
--- a/deps/v8/test/inspector/debugger/wasm-stepping.js
+++ /dev/null
@@ -1,194 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-let {session, contextGroup, Protocol} = InspectorTest.start('Tests stepping through wasm scripts');
-
-utils.load('test/mjsunit/wasm/wasm-module-builder.js');
-
-let builder = new WasmModuleBuilder();
-
-let func_a_idx =
-    builder.addFunction('wasm_A', kSig_v_v).addBody([kExprNop, kExprNop]).index;
-
-// wasm_B calls wasm_A <param0> times.
-builder.addFunction('wasm_B', kSig_v_i)
-    .addBody([
-      // clang-format off
-      kExprLoop, kWasmStmt,               // while
-        kExprLocalGet, 0,                 // -
-        kExprIf, kWasmStmt,               // if <param0> != 0
-          kExprLocalGet, 0,               // -
-          kExprI32Const, 1,               // -
-          kExprI32Sub,                    // -
-          kExprLocalSet, 0,               // decrease <param0>
-          kExprCallFunction, func_a_idx,  // -
-          kExprBr, 1,                     // continue
-          kExprEnd,                       // -
-        kExprEnd,                         // break
-      // clang-format on
-    ])
-    .exportAs('main');
-
-let module_bytes = builder.toArray();
-
-function instantiate(bytes) {
-  let buffer = new ArrayBuffer(bytes.length);
-  let view = new Uint8Array(buffer);
-  for (let i = 0; i < bytes.length; ++i) {
-    view[i] = bytes[i] | 0;
-  }
-
-  let module = new WebAssembly.Module(buffer);
-  // Set global variable.
-  instance = new WebAssembly.Instance(module);
-}
-
-let evalWithUrl = (code, url) => Protocol.Runtime.evaluate(
-    {'expression': code + '\n//# sourceURL=v8://test/' + url});
-
-Protocol.Debugger.onPaused(handlePaused);
-let wasm_B_scriptId;
-let step_actions = [
-  'stepInto',  // == stepOver, to call instruction
-  'stepInto',  // into call to wasm_A
-  'stepOver',  // over first nop
-  'stepOut',   // out of wasm_A
-  'stepOut',   // out of wasm_B, stop on breakpoint again
-  'stepOver',  // to call
-  'stepOver',  // over call
-  'resume',    // to next breakpoint (third iteration)
-  'stepInto',  // to call
-  'stepInto',  // into wasm_A
-  'stepOut',   // out to wasm_B
-  // now step 9 times, until we are in wasm_A again.
-  'stepInto', 'stepInto', 'stepInto', 'stepInto', 'stepInto', 'stepInto',
-  'stepInto', 'stepInto', 'stepInto',
-  // 3 more times, back to wasm_B.
-  'stepInto', 'stepInto', 'stepInto',
-  // then just resume.
-  'resume'
-];
-for (let action of step_actions) {
-  InspectorTest.logProtocolCommandCalls('Debugger.' + action)
-}
-let sources = {};
-let urls = {};
-let afterTwoSourcesCallback;
-
-(async function Test() {
-  await Protocol.Debugger.enable();
-  InspectorTest.log('Installing code an global variable.');
-  await evalWithUrl('var instance;\n' + instantiate.toString(), 'setup');
-  InspectorTest.log('Calling instantiate function.');
-  evalWithUrl(
-      'instantiate(' + JSON.stringify(module_bytes) + ')', 'callInstantiate');
-  await waitForTwoWasmScripts();
-  InspectorTest.log(
-      'Setting breakpoint on line 7 (on the setlocal before the call), url ' +
-      urls[wasm_B_scriptId]);
-  let msg = await Protocol.Debugger.setBreakpoint(
-      {'location': {'scriptId': wasm_B_scriptId, 'lineNumber': 7}});
-  printFailure(msg);
-  InspectorTest.logMessage(msg.result.actualLocation);
-  await evalWithUrl('instance.exports.main(4)', 'runWasm');
-  InspectorTest.log('exports.main returned!');
-  InspectorTest.log('Finished!');
-  InspectorTest.completeTest();
-})();
-
-function printFailure(message) {
-  if (!message.result) {
-    InspectorTest.logMessage(message);
-  }
-  return message;
-}
-
-async function waitForTwoWasmScripts() {
-  let num = 0;
-  InspectorTest.log('Waiting for two wasm scripts to be parsed.');
-  let source_promises = [];
-  async function getWasmSource(scriptId) {
-    let msg = await Protocol.Debugger.getScriptSource({scriptId: scriptId});
-    printFailure(msg);
-    InspectorTest.log(msg.result.scriptSource);
-    sources[scriptId] = msg.result.scriptSource;
-  }
-  while (num < 2) {
-    let msg = await Protocol.Debugger.onceScriptParsed();
-    let url = msg.params.url;
-    if (!url.startsWith('wasm://')) {
-      InspectorTest.log('Ignoring script with url ' + url);
-      continue;
-    }
-    num += 1;
-    let scriptId = msg.params.scriptId;
-    urls[scriptId] = url;
-    InspectorTest.log('Got wasm script: ' + url);
-    if (url.substr(-2) == '-1') wasm_B_scriptId = scriptId;
-    InspectorTest.log('Requesting source for ' + url + '...');
-    source_promises.push(getWasmSource(scriptId));
-  }
-  await Promise.all(source_promises);
-}
-
-function printPauseLocation(scriptId, lineNr, columnNr) {
-  let lines = sources[scriptId].split('\n');
-  let line = '<illegal line number>';
-  if (lineNr < lines.length) {
-    line = lines[lineNr];
-    if (columnNr < line.length) {
-      line = line.substr(0, columnNr) + '>' + line.substr(columnNr);
-    }
-  }
-  InspectorTest.log(
-      'Paused at ' + urls[scriptId] + ':' + lineNr + ':' + columnNr + ': ' +
-      line);
-}
-
-async function getValueString(value) {
-  if (value.type == 'object') {
-    let msg = await Protocol.Runtime.callFunctionOn({
-      objectId: value.objectId,
-      functionDeclaration: 'function () { return JSON.stringify(this); }'
-    });
-    printFailure(msg);
-    return msg.result.result.value + ' (' + value.description + ')';
-  }
-  return value.value + ' (' + value.type + ')';
-}
-
-async function dumpProperties(message) {
-  printFailure(message);
-  for (let value of message.result.result) {
-    let value_str = await getValueString(value.value);
-    InspectorTest.log('   ' + value.name + ': ' + value_str);
-  }
-}
-
-async function dumpScopeChainsOnPause(message) {
-  for (let frame of message.params.callFrames) {
-    let functionName = frame.functionName || '(anonymous)';
-    let lineNumber = frame.location ? frame.location.lineNumber : frame.lineNumber;
-    let columnNumber = frame.location ? frame.location.columnNumber : frame.columnNumber;
-    InspectorTest.log(`at ${functionName} (${lineNumber}:${columnNumber}):`);
-    for (let scope of frame.scopeChain) {
-      InspectorTest.logObject(' - scope (' + scope.type + '):');
-      if (scope.type == 'global') {
-        InspectorTest.logObject('   -- skipped');
-      } else {
-        let properties = await Protocol.Runtime.getProperties(
-            {'objectId': scope.object.objectId});
-        await dumpProperties(properties);
-      }
-    }
-  }
-}
-
-async function handlePaused(msg) {
-  let loc = msg.params.callFrames[0].location;
-  printPauseLocation(loc.scriptId, loc.lineNumber, loc.columnNumber);
-  await dumpScopeChainsOnPause(msg);
-  let action = step_actions.shift() || 'resume';
-  await Protocol.Debugger[action]();
-}
diff --git a/deps/v8/test/inspector/inspector-test.cc b/deps/v8/test/inspector/inspector-test.cc
index 0f39bc9417a9b2..075744a40e0d5b 100644
--- a/deps/v8/test/inspector/inspector-test.cc
+++ b/deps/v8/test/inspector/inspector-test.cc
@@ -378,7 +378,7 @@ class UtilsExtension : public IsolateData::SetupGlobalTask {
       v8::Local<v8::String> str_obj;
 
       if (arg->IsSymbol()) {
-        arg = v8::Local<v8::Symbol>::Cast(arg)->Name();
+        arg = v8::Local<v8::Symbol>::Cast(arg)->Description();
       }
       if (!arg->ToString(args.GetIsolate()->GetCurrentContext())
                .ToLocal(&str_obj)) {
diff --git a/deps/v8/test/inspector/inspector.status b/deps/v8/test/inspector/inspector.status
index 621fc163e5729c..8fe52411aad80b 100644
--- a/deps/v8/test/inspector/inspector.status
+++ b/deps/v8/test/inspector/inspector.status
@@ -12,9 +12,6 @@
   'cpu-profiler/coverage-block': [PASS, ['lite_mode == True', SKIP]],
   'cpu-profiler/coverage': [PASS, ['lite_mode == True', SKIP]],
 
-  # Bad OOM timing on noembed builds (https://crbug.com/v8/8494).
-  'debugger/pause-on-oom': [PASS, ['embedded_builtins == False', SKIP]],
-
   # https://crbug.com/v8/9029
   'debugger/script-on-after-compile-snapshot': [SKIP],
 }],  # ALWAYS
@@ -70,21 +67,22 @@
   '*': [SKIP],
 }],  # variant == no_wasm_traps
 
+##############################################################################
+['arch == ppc or arch == ppc64', {
+  # Liftoff needs to be enabled before running these tests.
+  'debugger/wasm-scope-info-liftoff': [SKIP],
+  'debugger/wasm-set-breakpoint-liftoff': [SKIP],
+}],  # 'arch == ppc or arch == ppc64'
+
 ##############################################################################
 ['arch == s390 or arch == s390x', {
   # Stack manipulations in LiveEdit is not implemented for this arch.
   'debugger/set-script-source-stack-padding': [SKIP],
+  # Liftoff needs to be enabled before running these tests.
+  'debugger/wasm-scope-info-liftoff': [SKIP],
+  'debugger/wasm-set-breakpoint-liftoff': [SKIP],
 }],  # 'arch == s390 or arch == s390x'
 
 ##############################################################################
-['no_snap == True', {
-  # https://crbug.com/v8/8521
-  'debugger/pause-on-oom': [SKIP],
-}],
-
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
 
 ]
diff --git a/deps/v8/test/inspector/print-method-not-found-expected.txt b/deps/v8/test/inspector/print-method-not-found-expected.txt
new file mode 100644
index 00000000000000..3589e398325694
--- /dev/null
+++ b/deps/v8/test/inspector/print-method-not-found-expected.txt
@@ -0,0 +1,2 @@
+Test that the test runner prints if a non-existent method is called
+Error: Called non-existent method. 'Runtime.method_does_not_exist' wasn't found code: -32601
\ No newline at end of file
diff --git a/deps/v8/test/inspector/print-method-not-found.js b/deps/v8/test/inspector/print-method-not-found.js
new file mode 100644
index 00000000000000..d10f1880df7544
--- /dev/null
+++ b/deps/v8/test/inspector/print-method-not-found.js
@@ -0,0 +1,14 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const {Protocol} = InspectorTest.start(
+  'Test that the test runner prints if a non-existent method is called');
+
+(async function test() {
+  await Protocol.Runtime.method_does_not_exist();
+
+  // This will only be called if the test fails, because the test runner should
+  // call completeTest() if the method does not exist.
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/protocol-test.js b/deps/v8/test/inspector/protocol-test.js
index ba7c26295c4df1..71e32f2f4e6f27 100644
--- a/deps/v8/test/inspector/protocol-test.js
+++ b/deps/v8/test/inspector/protocol-test.js
@@ -105,6 +105,30 @@ InspectorTest.logObject = function(object, title) {
   InspectorTest.log(lines.join("\n"));
 }
 
+InspectorTest.decodeBase64 = function(base64) {
+  const LOOKUP = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+
+  const paddingLength = base64.match(/=*$/)[0].length;
+  const bytesLength = base64.length * 0.75 - paddingLength;
+
+  let bytes = new Uint8Array(bytesLength);
+
+  for (let i = 0, p = 0; i < base64.length; i += 4, p += 3) {
+    let bits = 0;
+    for (let j = 0; j < 4; j++) {
+      bits <<= 6;
+      const c = base64[i + j];
+      if (c !== '=') bits |= LOOKUP.indexOf(c);
+    }
+    for (let j = p + 2; j >= p; j--) {
+      if (j < bytesLength) bytes[j] = bits;
+      bits >>= 8;
+    }
+  }
+
+  return bytes;
+}
+
 InspectorTest.ContextGroup = class {
   constructor() {
     this.id = utils.createContextGroup();
@@ -239,21 +263,32 @@ InspectorTest.Session = class {
     }
   }
 
-  logSourceLocation(location, forceSourceRequest) {
+  async getScriptWithSource(scriptId, forceSourceRequest) {
+    var script = this._scriptMap.get(scriptId);
+    if (forceSourceRequest || !(script.scriptSource || script.bytecode)) {
+      var message = await this.Protocol.Debugger.getScriptSource({ scriptId });
+      script.scriptSource = message.result.scriptSource;
+      if (message.result.bytecode) {
+        script.bytecode = InspectorTest.decodeBase64(message.result.bytecode);
+      }
+    }
+    return script;
+  }
+
+  async logSourceLocation(location, forceSourceRequest) {
     var scriptId = location.scriptId;
     if (!this._scriptMap || !this._scriptMap.has(scriptId)) {
       InspectorTest.log("setupScriptMap should be called before Protocol.Debugger.enable.");
       InspectorTest.completeTest();
     }
-    var script = this._scriptMap.get(scriptId);
-    if (!script.scriptSource || forceSourceRequest) {
-      return this.Protocol.Debugger.getScriptSource({ scriptId })
-          .then(message => script.scriptSource = message.result.scriptSource)
-          .then(dumpSourceWithLocation);
-    }
-    return Promise.resolve().then(dumpSourceWithLocation);
+    var script = await this.getScriptWithSource(scriptId, forceSourceRequest);
 
-    function dumpSourceWithLocation() {
+    if (script.bytecode) {
+      if (location.lineNumber != 0) {
+        InspectorTest.log('Unexpected wasm line number: ' + location.lineNumber);
+      }
+      InspectorTest.log(`Script ${script.url} byte offset ${location.columnNumber}: Wasm opcode 0x${script.bytecode[location.columnNumber].toString(16)}`);
+    } else {
       var lines = script.scriptSource.split('\n');
       var line = lines[location.lineNumber];
       line = line.slice(0, location.columnNumber) + '#' + (line.slice(location.columnNumber) || '');
@@ -272,11 +307,7 @@ InspectorTest.Session = class {
   async logBreakLocations(inputLocations) {
     let locations = inputLocations.slice();
     let scriptId = locations[0].scriptId;
-    let script = this._scriptMap.get(scriptId);
-    if (!script.scriptSource) {
-      let message = await this.Protocol.Debugger.getScriptSource({scriptId});
-      script.scriptSource = message.result.scriptSource;
-    }
+    let script = await this.getScriptWithSource(scriptId);
     let lines = script.scriptSource.split('\n');
     locations = locations.sort((loc1, loc2) => {
       if (loc2.lineNumber !== loc1.lineNumber) return loc2.lineNumber - loc1.lineNumber;
@@ -358,6 +389,12 @@ InspectorTest.Session = class {
     var messageObject = JSON.parse(messageString);
     if (InspectorTest._dumpInspectorProtocolMessages)
       utils.print("backend: " + JSON.stringify(messageObject));
+    const kMethodNotFound = -32601;
+    if (messageObject.error && messageObject.error.code === kMethodNotFound) {
+      InspectorTest.log(`Error: Called non-existent method. ${
+          messageObject.error.message} code: ${messageObject.error.code}`);
+      InspectorTest.completeTest();
+    }
     try {
       var messageId = messageObject["id"];
       if (typeof messageId === "number") {
diff --git a/deps/v8/test/inspector/runtime-call-stats/collection-expected.txt b/deps/v8/test/inspector/runtime-call-stats/collection-expected.txt
new file mode 100644
index 00000000000000..ba963ba627db3f
--- /dev/null
+++ b/deps/v8/test/inspector/runtime-call-stats/collection-expected.txt
@@ -0,0 +1,2 @@
+Test RunTimeCallStats collection using Profiler.getRuntimeCallStats.
+PASSED
diff --git a/deps/v8/test/inspector/runtime-call-stats/collection.js b/deps/v8/test/inspector/runtime-call-stats/collection.js
new file mode 100644
index 00000000000000..b3cadc5c3fc5b3
--- /dev/null
+++ b/deps/v8/test/inspector/runtime-call-stats/collection.js
@@ -0,0 +1,83 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+    'Test RunTimeCallStats collection using Profiler.getRuntimeCallStats.');
+
+var source =
+`
+function fib(x) {
+  if (x < 2) return 1;
+  return fib(x-1) + fib(x-2);
+}
+fib(5);
+`;
+
+function buildCounterMap(result) {
+  let counterMap = new Map();
+
+  let counters = result.result.result;
+  for (const {name, value} of counters) {
+    counterMap.set(name, value);
+  }
+
+  return counterMap;
+}
+
+function compareCounterMaps(counterMap, counterMap2) {
+  // Check for counters that are present in the first map but are not found
+  // in the the second map
+  for (let counter of counterMap.keys()) {
+    if (!counterMap2.has(counter)) {
+      InspectorTest.log(`Counter ${counter} is missing`);
+      return false;
+    }
+  }
+
+  // Check for the counter value changes
+  let counterValueIncreased = false;
+  for (let [counter, value2] of counterMap2) {
+    let value = counterMap.get(counter);
+    if (value !== undefined) {
+      if (value2 < value) {
+        InspectorTest.log(`Counter ${counter} value decreased: ${value} -> ${value2}`);
+        return false;
+      }
+      if (value2 > value) {
+        counterValueIncreased = true;
+      }
+    }
+  }
+
+  if (!counterValueIncreased && counterMap.size === counterMap2.size) {
+    InspectorTest.log(`No counter values has increased or added`);
+    return false;
+  }
+
+  return true;
+}
+
+(async function test() {
+  await Protocol.Runtime.enable();
+  await Protocol.Profiler.enableRuntimeCallStats();
+
+  let counterMap = buildCounterMap(await Protocol.Profiler.getRuntimeCallStats());
+
+  await Protocol.Runtime.evaluate({ expression: source, sourceURL: arguments.callee.name, persistScript: true });
+
+  let counterMap2 = buildCounterMap(await Protocol.Profiler.getRuntimeCallStats());
+  const check1 = compareCounterMaps(counterMap, counterMap2);
+
+  await Protocol.Runtime.evaluate({ expression: source, sourceURL: arguments.callee.name, persistScript: true });
+
+  let counterMap3 = buildCounterMap(await Protocol.Profiler.getRuntimeCallStats());
+  const check2 = compareCounterMaps(counterMap2, counterMap3);
+
+  await Protocol.Profiler.disableRuntimeCallStats();
+  await Protocol.Runtime.disable();
+
+  InspectorTest.log(check1 && check2 ? 'PASSED' : 'FAILED');
+
+  InspectorTest.completeTest();
+})().catch(e => InspectorTest.log('caught: ' + e));
diff --git a/deps/v8/test/inspector/runtime-call-stats/enable-disable-expected.txt b/deps/v8/test/inspector/runtime-call-stats/enable-disable-expected.txt
new file mode 100644
index 00000000000000..0ee15dbedf60b6
--- /dev/null
+++ b/deps/v8/test/inspector/runtime-call-stats/enable-disable-expected.txt
@@ -0,0 +1,6 @@
+Test RunTimeCallStats collection enabling and disabling.
+Expected error: "RuntimeCallStats collection is not enabled."
+Expected error: "RuntimeCallStats collection already enabled."
+Some counters reported
+Expected error: "RuntimeCallStats collection is not enabled."
+Less counters reported
diff --git a/deps/v8/test/inspector/runtime-call-stats/enable-disable.js b/deps/v8/test/inspector/runtime-call-stats/enable-disable.js
new file mode 100644
index 00000000000000..3dde945a01be3a
--- /dev/null
+++ b/deps/v8/test/inspector/runtime-call-stats/enable-disable.js
@@ -0,0 +1,51 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+    'Test RunTimeCallStats collection enabling and disabling.');
+
+var source =
+`
+function fib(x) {
+  if (x < 2) return 1;
+  return fib(x-1) + fib(x-2);
+}
+fib(5);
+`;
+
+function logErrorMessage(result) {
+  InspectorTest.log('Expected error: "' + result.error.message + '"');
+}
+
+(async function test() {
+  await Protocol.Runtime.enable();
+
+  // This should fail with "not enabled" error.
+  logErrorMessage(await Protocol.Profiler.getRuntimeCallStats());
+
+  // This should fail with "already enabled" error.
+  await Protocol.Profiler.enableRuntimeCallStats();
+  logErrorMessage(await Protocol.Profiler.enableRuntimeCallStats());
+
+  // The result should not be empty.
+  await Protocol.Runtime.evaluate({ expression: source, sourceURL: arguments.callee.name, persistScript: true });
+  const counters = (await Protocol.Profiler.getRuntimeCallStats()).result.result;
+  if (counters.length > 0)
+    InspectorTest.log('Some counters reported');
+  await Protocol.Profiler.disableRuntimeCallStats();
+
+  // This should fail with "not enabled" error too.
+  logErrorMessage(await Protocol.Profiler.getRuntimeCallStats());
+
+  // The result should not be empty and have smaller amount of counters than
+  // the first result.
+  await Protocol.Profiler.enableRuntimeCallStats();
+  const counters2 = (await Protocol.Profiler.getRuntimeCallStats()).result.result;
+  if (counters2.length > 0 && counters2.length < counters.length)
+    InspectorTest.log('Less counters reported');
+  await Protocol.Profiler.disableRuntimeCallStats();
+
+  await Protocol.Runtime.disable();
+  InspectorTest.completeTest();
+})().catch(e => InspectorTest.log('caught: ' + e));
diff --git a/deps/v8/test/inspector/runtime/await-promise-expected.txt b/deps/v8/test/inspector/runtime/await-promise-expected.txt
index 975ef8177ebb38..e040f50266e650 100644
--- a/deps/v8/test/inspector/runtime/await-promise-expected.txt
+++ b/deps/v8/test/inspector/runtime/await-promise-expected.txt
@@ -120,12 +120,3 @@ Running test: testResolvedWithoutArgsPromise
         }
     }
 }
-
-Running test: testGarbageCollectedPromise
-{
-    error : {
-        code : -32000
-        message : Promise was collected
-    }
-    id : <messageId>
-}
diff --git a/deps/v8/test/inspector/runtime/await-promise.js b/deps/v8/test/inspector/runtime/await-promise.js
index 2caeb3d76e6e52..cb7174d89dd356 100644
--- a/deps/v8/test/inspector/runtime/await-promise.js
+++ b/deps/v8/test/inspector/runtime/await-promise.js
@@ -117,28 +117,6 @@ function testSuite()
         .then(result => Protocol.Runtime.awaitPromise({ promiseObjectId: result.result.result.objectId, returnByValue: true, generatePreview: false }))
         .then(result => InspectorTest.logMessage(result))
         .then(() => next());
-    },
-
-    function testGarbageCollectedPromise(next)
-    {
-      Protocol.Runtime.evaluate({ expression: "new Promise(() => undefined)" })
-        .then(result => scheduleGCAndawaitPromise(result))
-        .then(result => InspectorTest.logMessage(result))
-        .then(() => next());
-
-      function scheduleGCAndawaitPromise(result)
-      {
-        var objectId = result.result.result.objectId;
-        var promise = Protocol.Runtime.awaitPromise({ promiseObjectId: objectId });
-        gcPromise(objectId);
-        return promise;
-      }
-
-      function gcPromise(objectId)
-      {
-        Protocol.Runtime.releaseObject({ objectId: objectId})
-          .then(() => Protocol.Runtime.evaluate({ expression: "gc()" }));
-      }
     }
   ]);
 }
diff --git a/deps/v8/test/inspector/runtime/evaluate-new-function-error-expected.txt b/deps/v8/test/inspector/runtime/evaluate-new-function-error-expected.txt
index 70191eac96f867..d95db1863607b5 100644
--- a/deps/v8/test/inspector/runtime/evaluate-new-function-error-expected.txt
+++ b/deps/v8/test/inspector/runtime/evaluate-new-function-error-expected.txt
@@ -6,19 +6,19 @@ Tests that Runtime.evaluate has the correct error line number for 'new Function(
             columnNumber : 3
             exception : {
                 className : TypeError
-                description : TypeError: 0 is not a function     at eval (eval at <anonymous> (:1:1), <anonymous>:1:4)     at <anonymous>:1:22
+                description : TypeError: 0 is not a function     at eval (eval at <anonymous> (:1:1), <anonymous>:3:4)     at <anonymous>:1:22
                 objectId : <objectId>
                 subtype : error
                 type : object
             }
             exceptionId : <exceptionId>
-            lineNumber : 0
+            lineNumber : 2
             scriptId : <scriptId>
             text : Uncaught
         }
         result : {
             className : TypeError
-            description : TypeError: 0 is not a function     at eval (eval at <anonymous> (:1:1), <anonymous>:1:4)     at <anonymous>:1:22
+            description : TypeError: 0 is not a function     at eval (eval at <anonymous> (:1:1), <anonymous>:3:4)     at <anonymous>:1:22
             objectId : <objectId>
             subtype : error
             type : object
diff --git a/deps/v8/test/inspector/runtime/evaluate-repl-await-expected.txt b/deps/v8/test/inspector/runtime/evaluate-repl-await-expected.txt
new file mode 100644
index 00000000000000..af98683c501974
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-repl-await-expected.txt
@@ -0,0 +1,81 @@
+Tests that top-level await in Runtime.evaluate REPL mode includes stack trace.
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : 0
+            exception : {
+                type : undefined
+            }
+            exceptionId : <exceptionId>
+            lineNumber : 0
+            scriptId : <scriptId>
+            stackTrace : {
+                callFrames : [
+                    [0] : {
+                        columnNumber : 0
+                        functionName :
+                        lineNumber : 0
+                        scriptId : <scriptId>
+                        url :
+                    }
+                ]
+            }
+            text : Uncaught
+        }
+        result : {
+            type : undefined
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : 6
+            exception : {
+                className : Error
+                description : Error: ba dum tsh     at bar (<anonymous>:3:13)     at foo (<anonymous>:7:7)     at <anonymous>:10:5
+                objectId : <objectId>
+                subtype : error
+                type : object
+            }
+            exceptionId : <exceptionId>
+            lineNumber : 2
+            scriptId : <scriptId>
+            stackTrace : {
+                callFrames : [
+                    [0] : {
+                        columnNumber : 12
+                        functionName : bar
+                        lineNumber : 2
+                        scriptId : <scriptId>
+                        url :
+                    }
+                    [1] : {
+                        columnNumber : 6
+                        functionName : foo
+                        lineNumber : 6
+                        scriptId : <scriptId>
+                        url :
+                    }
+                    [2] : {
+                        columnNumber : 4
+                        functionName :
+                        lineNumber : 9
+                        scriptId : <scriptId>
+                        url :
+                    }
+                ]
+            }
+            text : Uncaught
+        }
+        result : {
+            className : Error
+            description : Error: ba dum tsh     at bar (<anonymous>:3:13)     at foo (<anonymous>:7:7)     at <anonymous>:10:5
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+    }
+}
diff --git a/deps/v8/test/inspector/runtime/evaluate-repl-await.js b/deps/v8/test/inspector/runtime/evaluate-repl-await.js
new file mode 100644
index 00000000000000..77cf25d3a344b9
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-repl-await.js
@@ -0,0 +1,34 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {Protocol} = InspectorTest.start(
+  "Tests that top-level await in Runtime.evaluate REPL mode includes stack trace.");
+
+Protocol.Debugger.enable();
+Protocol.Runtime.enable();
+
+(async function() {
+  evaluateRepl('throw undefined;');
+
+  evaluateRepl(`
+    function bar() {
+      throw new Error('ba dum tsh');
+    }
+
+    function foo() {
+      bar();
+    }
+
+    foo();
+  `);
+
+  InspectorTest.completeTest();
+})();
+
+async function evaluateRepl(expression) {
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: expression,
+    replMode: true,
+  }));
+}
diff --git a/deps/v8/test/inspector/runtime/evaluate-repl-mode-expected.txt b/deps/v8/test/inspector/runtime/evaluate-repl-mode-expected.txt
new file mode 100644
index 00000000000000..664899bd27722d
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-repl-mode-expected.txt
@@ -0,0 +1,65 @@
+Tests that Runtime.evaluate works with REPL mode.
+Test 'let' re-declaration
+SyntaxError in REPL mode does not crash the parser
+{
+    id : <messageId>
+    result : {
+        result : {
+            type : undefined
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        result : {
+            description : 21
+            type : number
+            value : 21
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        result : {
+            type : undefined
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        result : {
+            description : 42
+            type : number
+            value : 42
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : 10
+            exception : {
+                className : SyntaxError
+                description : SyntaxError: Unexpected token 'const'
+                objectId : <objectId>
+                subtype : error
+                type : object
+            }
+            exceptionId : <exceptionId>
+            lineNumber : 0
+            scriptId : <scriptId>
+            text : Uncaught
+        }
+        result : {
+            className : SyntaxError
+            description : SyntaxError: Unexpected token 'const'
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+    }
+}
diff --git a/deps/v8/test/inspector/runtime/evaluate-repl-mode-side-effecting-expected.txt b/deps/v8/test/inspector/runtime/evaluate-repl-mode-side-effecting-expected.txt
new file mode 100644
index 00000000000000..3b7b668b415bf4
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-repl-mode-side-effecting-expected.txt
@@ -0,0 +1,96 @@
+Tests that Runtime.evaluate with REPL mode correctly detects side-effects.
+Test "let" declaration is side-effecting
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : -1
+            exception : {
+                className : EvalError
+                description : EvalError: Possible side-effect in debug-evaluate
+                objectId : <objectId>
+                subtype : error
+                type : object
+            }
+            exceptionId : <exceptionId>
+            lineNumber : -1
+            scriptId : <scriptId>
+            text : Uncaught
+        }
+        result : {
+            className : EvalError
+            description : EvalError: Possible side-effect in debug-evaluate
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+    }
+}
+Test "const" declaration is side-effecting
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : -1
+            exception : {
+                className : EvalError
+                description : EvalError: Possible side-effect in debug-evaluate
+                objectId : <objectId>
+                subtype : error
+                type : object
+            }
+            exceptionId : <exceptionId>
+            lineNumber : -1
+            scriptId : <scriptId>
+            text : Uncaught
+        }
+        result : {
+            className : EvalError
+            description : EvalError: Possible side-effect in debug-evaluate
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+    }
+}
+Test "const" with side-effects works afterwards
+{
+    id : <messageId>
+    result : {
+        result : {
+            type : undefined
+        }
+    }
+}
+Test side-effect free expressions can be eagerly evaluated
+{
+    id : <messageId>
+    result : {
+        result : {
+            description : 3
+            type : number
+            value : 3
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        result : {
+            type : string
+            value : hello REPL
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        result : {
+            className : Promise
+            description : Promise
+            objectId : <objectId>
+            subtype : promise
+            type : object
+        }
+    }
+}
diff --git a/deps/v8/test/inspector/runtime/evaluate-repl-mode-side-effecting.js b/deps/v8/test/inspector/runtime/evaluate-repl-mode-side-effecting.js
new file mode 100644
index 00000000000000..704eb3461319a5
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-repl-mode-side-effecting.js
@@ -0,0 +1,42 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {Protocol} = InspectorTest.start(
+  'Tests that Runtime.evaluate with REPL mode correctly detects side-effects.');
+
+Protocol.Runtime.enable();
+(async function() {
+  InspectorTest.log('Test "let" declaration is side-effecting');
+  await evaluateRepl('let x = 21;');
+
+  InspectorTest.log('Test "const" declaration is side-effecting');
+  await evaluateRepl('const y = 42;');
+
+  InspectorTest.log('Test "const" with side-effects works afterwards');
+  await evaluateReplWithSideEffects('const y = 42;');
+
+  InspectorTest.log('Test side-effect free expressions can be eagerly evaluated');
+  await evaluateRepl('1 + 2');
+  await evaluateRepl('"hello " + "REPL"');
+
+  await evaluateRepl('(async function foo() { return 42; })();');
+
+  InspectorTest.completeTest();
+})();
+
+async function evaluateRepl(expression) {
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: expression,
+    replMode: true,
+    throwOnSideEffect: true
+  }));
+}
+
+async function evaluateReplWithSideEffects(expression) {
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: expression,
+    replMode: true,
+    throwOnSideEffect: false
+  }));
+}
diff --git a/deps/v8/test/inspector/runtime/evaluate-repl-mode.js b/deps/v8/test/inspector/runtime/evaluate-repl-mode.js
new file mode 100644
index 00000000000000..d0492f0875a0f4
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-repl-mode.js
@@ -0,0 +1,28 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {Protocol} = InspectorTest.start(
+  "Tests that Runtime.evaluate works with REPL mode.");
+
+Protocol.Runtime.enable();
+(async function() {
+  InspectorTest.log("Test 'let' re-declaration");
+  evaluateRepl('let x = 21;');
+  evaluateRepl('x;');
+  evaluateRepl('let x = 42;');
+  evaluateRepl('x;');
+
+  // Regression test for crbug.com/1040034.
+  InspectorTest.log("SyntaxError in REPL mode does not crash the parser");
+  evaluateRepl('if (true) const x');
+
+  InspectorTest.completeTest();
+})();
+
+async function evaluateRepl(expression) {
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: expression,
+    replMode: true,
+  }));
+}
diff --git a/deps/v8/test/inspector/runtime/regression-1052721-expected.txt b/deps/v8/test/inspector/runtime/regression-1052721-expected.txt
new file mode 100644
index 00000000000000..054ad0bb1938f8
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/regression-1052721-expected.txt
@@ -0,0 +1,12 @@
+Deleting REPL let does not crash V8 crbug.com/105271
+
+Running test: deleteReplLetDeclaration
+{
+    id : <messageId>
+    result : {
+        result : {
+            type : boolean
+            value : false
+        }
+    }
+}
diff --git a/deps/v8/test/inspector/runtime/regression-1052721.js b/deps/v8/test/inspector/runtime/regression-1052721.js
new file mode 100644
index 00000000000000..b0eb4d543a288a
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/regression-1052721.js
@@ -0,0 +1,17 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start('Deleting REPL let does not crash V8 crbug.com/105271');
+
+InspectorTest.runAsyncTestSuite([
+  async function deleteReplLetDeclaration() {
+    await Protocol.Runtime.enable();
+    const response = await Protocol.Runtime.evaluate({
+      expression: 'let x = 1; delete x;',
+      replMode: true,
+    });
+    InspectorTest.logMessage(response);
+    await Protocol.Runtime.disable();
+  }
+]);
diff --git a/deps/v8/test/inspector/type-profiler/type-profile.js b/deps/v8/test/inspector/type-profiler/type-profile.js
index 7754b4c6cb7943..c8ae080b1b40a0 100644
--- a/deps/v8/test/inspector/type-profiler/type-profile.js
+++ b/deps/v8/test/inspector/type-profiler/type-profile.js
@@ -30,7 +30,7 @@ let {session, contextGroup, Protocol} = InspectorTest.start("Test collecting typ
   await session.logTypeProfile(typeProfiles.result.result[0],
     source);
 
-  Protocol.Profiler.stoptTypeProfile();
+  Protocol.Profiler.stopTypeProfile();
   Protocol.Profiler.disable();
   await Protocol.Runtime.disable();
   InspectorTest.completeTest();
diff --git a/deps/v8/test/intl/OWNERS b/deps/v8/test/intl/OWNERS
index 9c966e6b62d048..1fac3a18414b52 100644
--- a/deps/v8/test/intl/OWNERS
+++ b/deps/v8/test/intl/OWNERS
@@ -1,4 +1,4 @@
-cira@chromium.org
-mnita@google.com
+ftang@chromium.org
+jshin@chromium.org
 
 # COMPONENT: Blink>JavaScript>Internationalization
diff --git a/deps/v8/test/intl/date-format/check-calendar.js b/deps/v8/test/intl/date-format/check-calendar.js
index f9e5565f600f43..8654e380359249 100644
--- a/deps/v8/test/intl/date-format/check-calendar.js
+++ b/deps/v8/test/intl/date-format/check-calendar.js
@@ -67,7 +67,7 @@ validCalendar.forEach(function(calendar) {
   locales.forEach(function(base) {
     let l = base + "-u-ca-" + calendar;
     let dtf = new Intl.DateTimeFormat([base], {calendar});
-    assertEquals(l, dtf.resolvedOptions().locale);
+    assertEquals(base, dtf.resolvedOptions().locale);
 
     // Test the formatting result is the same as passing in via u-ca-
     // in the locale.
diff --git a/deps/v8/test/intl/date-format/check-numbering-system.js b/deps/v8/test/intl/date-format/check-numbering-system.js
index aa6ac8728e29a4..c17a84fff151ff 100644
--- a/deps/v8/test/intl/date-format/check-numbering-system.js
+++ b/deps/v8/test/intl/date-format/check-numbering-system.js
@@ -74,7 +74,7 @@ validNumberingSystem.forEach(function(numberingSystem) {
   locales.forEach(function(base) {
     let l = base + "-u-nu-" + numberingSystem;
     let dtf = new Intl.DateTimeFormat([base], {numberingSystem});
-    assertEquals(l, dtf.resolvedOptions().locale);
+    assertEquals(base, dtf.resolvedOptions().locale);
     assertEquals(numberingSystem, dtf.resolvedOptions().numberingSystem);
 
     // Test the formatting result is the same as passing in via u-nu-
diff --git a/deps/v8/test/intl/date-format/date_style_time_style_hour_cycle.js b/deps/v8/test/intl/date-format/date_style_time_style_hour_cycle.js
new file mode 100644
index 00000000000000..2606236d4c7b6e
--- /dev/null
+++ b/deps/v8/test/intl/date-format/date_style_time_style_hour_cycle.js
@@ -0,0 +1,54 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let midnight = new Date(2019, 3, 4, 0);
+let noon = new Date(2019, 3, 4, 12);
+
+let df_11_dt = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", dateStyle: "short", hourCycle: "h11"})
+assertEquals("h11", df_11_dt.resolvedOptions().hourCycle);
+assertEquals("4/4/19, 0:00 AM", df_11_dt.format(midnight));
+assertEquals("4/4/19, 0:00 PM", df_11_dt.format(noon));
+
+let df_12_dt = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", dateStyle: "short", hourCycle: "h12"})
+assertEquals("h12", df_12_dt.resolvedOptions().hourCycle);
+assertEquals("4/4/19, 12:00 AM", df_12_dt.format(midnight));
+assertEquals("4/4/19, 12:00 PM", df_12_dt.format(noon));
+
+let df_23_dt = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", dateStyle: "short", hourCycle: "h23"})
+assertEquals("h23", df_23_dt.resolvedOptions().hourCycle);
+assertEquals("4/4/19, 00:00", df_23_dt.format(midnight));
+assertEquals("4/4/19, 12:00" ,df_23_dt.format(noon));
+
+let df_24_dt = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", dateStyle: "short", hourCycle: "h24"})
+assertEquals("h24", df_24_dt.resolvedOptions().hourCycle);
+assertEquals("4/4/19, 24:00", df_24_dt.format(midnight));
+assertEquals("4/4/19, 12:00", df_24_dt.format(noon));
+
+let df_11_ja_dt = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", dateStyle: "short", hourCycle: "h11"})
+assertEquals("h11", df_11_ja_dt.resolvedOptions().hourCycle);
+assertEquals("2019/04/04 午前0:00", df_11_ja_dt.format(midnight));
+assertEquals("2019/04/04 午後0:00", df_11_ja_dt.format(noon));
+
+let df_12_ja_dt = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", dateStyle: "short", hourCycle: "h12"})
+assertEquals("h12", df_12_ja_dt.resolvedOptions().hourCycle);
+assertEquals("2019/04/04 午前12:00", df_12_ja_dt.format(midnight));
+assertEquals("2019/04/04 午後12:00", df_12_ja_dt.format(noon));
+
+let df_23_ja_dt = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", dateStyle: "short", hourCycle: "h23"})
+assertEquals("h23", df_23_ja_dt.resolvedOptions().hourCycle);
+assertEquals("2019/04/04 0:00", df_23_ja_dt.format(midnight));
+assertEquals("2019/04/04 12:00", df_23_ja_dt.format(noon));
+
+let df_24_ja_dt = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", dateStyle: "short", hourCycle: "h24"})
+assertEquals("h24", df_24_ja_dt.resolvedOptions().hourCycle);
+assertEquals("2019/04/04 24:00", df_24_ja_dt.format(midnight));
+assertEquals("2019/04/04 12:00", df_24_ja_dt.format(noon));
diff --git a/deps/v8/test/intl/date-format/format_range_hour_cycle.js b/deps/v8/test/intl/date-format/format_range_hour_cycle.js
new file mode 100644
index 00000000000000..044db412a68f63
--- /dev/null
+++ b/deps/v8/test/intl/date-format/format_range_hour_cycle.js
@@ -0,0 +1,149 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let midnight = new Date(2019, 3, 4, 0);
+let noon = new Date(2019, 3, 4, 12);
+let df_11 = new Intl.DateTimeFormat(
+    "en", {hour: "numeric", minute: "numeric", hourCycle: "h11"})
+assertEquals("h11", df_11.resolvedOptions().hourCycle);
+assertEquals("0:00 AM", df_11.formatRange(midnight, midnight));
+assertEquals("0:00 PM", df_11.formatRange(noon, noon));
+
+let df_11_t = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", hourCycle: "h11"})
+assertEquals("h11", df_11_t.resolvedOptions().hourCycle);
+assertEquals("0:00 AM", df_11_t.formatRange(midnight, midnight));
+assertEquals("0:00 PM", df_11_t.formatRange(noon, noon));
+
+let df_11_dt = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", dateStyle: "short", hourCycle: "h11"})
+assertEquals("h11", df_11_dt.resolvedOptions().hourCycle);
+assertEquals("4/4/19, 0:00 AM", df_11_dt.formatRange(midnight, midnight));
+assertEquals("4/4/19, 0:00 PM", df_11_dt.formatRange(noon, noon));
+
+let df_12 = new Intl.DateTimeFormat(
+    "en", {hour: "numeric", minute: "numeric", hourCycle: "h12"})
+assertEquals("h12", df_12.resolvedOptions().hourCycle);
+assertEquals("12:00 AM", df_12.formatRange(midnight, midnight));
+assertEquals("12:00 PM", df_12.formatRange(noon, noon));
+
+let df_12_t = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", hourCycle: "h12"})
+assertEquals("h12", df_12_t.resolvedOptions().hourCycle);
+assertEquals("12:00 AM", df_12_t.formatRange(midnight, midnight));
+assertEquals("12:00 PM", df_12_t.formatRange(noon, noon));
+
+let df_12_dt = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", dateStyle: "short", hourCycle: "h12"})
+assertEquals("h12", df_12_dt.resolvedOptions().hourCycle);
+assertEquals("4/4/19, 12:00 AM", df_12_dt.formatRange(midnight, midnight));
+assertEquals("4/4/19, 12:00 PM", df_12_dt.formatRange(noon, noon));
+
+let df_23 = new Intl.DateTimeFormat(
+    "en", {hour: "numeric", minute: "numeric", hourCycle: "h23"})
+assertEquals("h23", df_23.resolvedOptions().hourCycle);
+assertEquals("00:00", df_23.formatRange(midnight, midnight));
+assertEquals("12:00" ,df_23.formatRange(noon, noon));
+
+let df_23_t = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", hourCycle: "h23"})
+assertEquals("h23", df_23_t.resolvedOptions().hourCycle);
+assertEquals("00:00", df_23_t.formatRange(midnight, midnight));
+assertEquals("12:00" ,df_23_t.formatRange(noon, noon));
+
+let df_23_dt = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", dateStyle: "short", hourCycle: "h23"})
+assertEquals("h23", df_23_dt.resolvedOptions().hourCycle);
+assertEquals("4/4/19, 00:00", df_23_dt.formatRange(midnight, midnight));
+assertEquals("4/4/19, 12:00" ,df_23_dt.formatRange(noon, noon));
+
+let df_24 = new Intl.DateTimeFormat(
+    "en", {hour: "numeric", minute: "numeric", hourCycle: "h24"})
+assertEquals("h24", df_24.resolvedOptions().hourCycle);
+assertEquals("24:00", df_24.formatRange(midnight, midnight));
+assertEquals("12:00", df_24.formatRange(noon, noon));
+
+let df_24_t = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", hourCycle: "h24"})
+assertEquals("h24", df_24_t.resolvedOptions().hourCycle);
+assertEquals("24:00", df_24_t.formatRange(midnight, midnight));
+assertEquals("12:00", df_24_t.formatRange(noon, noon));
+
+let df_24_dt = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", dateStyle: "short", hourCycle: "h24"})
+assertEquals("h24", df_24_dt.resolvedOptions().hourCycle);
+assertEquals("4/4/19, 24:00", df_24_dt.formatRange(midnight, midnight));
+assertEquals("4/4/19, 12:00", df_24_dt.formatRange(noon, noon));
+
+let df_11_ja = new Intl.DateTimeFormat(
+    "ja-JP", {hour: "numeric", minute: "numeric", hourCycle: "h11"})
+assertEquals("h11", df_11_ja.resolvedOptions().hourCycle);
+assertEquals("午前0:00", df_11_ja.formatRange(midnight, midnight));
+assertEquals("午後0:00", df_11_ja.formatRange(noon, noon));
+
+let df_11_ja_t = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", hourCycle: "h11"})
+assertEquals("h11", df_11_ja_t.resolvedOptions().hourCycle);
+assertEquals("午前0:00", df_11_ja_t.formatRange(midnight, midnight));
+assertEquals("午後0:00", df_11_ja_t.formatRange(noon, noon));
+
+let df_11_ja_dt = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", dateStyle: "short", hourCycle: "h11"})
+assertEquals("h11", df_11_ja_dt.resolvedOptions().hourCycle);
+assertEquals("2019/04/04 午前0:00", df_11_ja_dt.formatRange(midnight, midnight));
+assertEquals("2019/04/04 午後0:00", df_11_ja_dt.formatRange(noon, noon));
+
+let df_12_ja = new Intl.DateTimeFormat(
+    "ja-JP", {hour: "numeric", minute: "numeric", hourCycle: "h12"})
+assertEquals("h12", df_12_ja.resolvedOptions().hourCycle);
+assertEquals("午前12:00", df_12_ja.formatRange(midnight, midnight));
+assertEquals("午後12:00", df_12_ja.formatRange(noon, noon));
+
+let df_12_ja_t = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", hourCycle: "h12"})
+assertEquals("h12", df_12_ja_t.resolvedOptions().hourCycle);
+assertEquals("午前12:00", df_12_ja_t.formatRange(midnight, midnight));
+assertEquals("午後12:00", df_12_ja_t.formatRange(noon, noon));
+
+let df_12_ja_dt = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", dateStyle: "short", hourCycle: "h12"})
+assertEquals("h12", df_12_ja_dt.resolvedOptions().hourCycle);
+assertEquals("2019/04/04 午前12:00", df_12_ja_dt.formatRange(midnight, midnight));
+assertEquals("2019/04/04 午後12:00", df_12_ja_dt.formatRange(noon, noon));
+
+let df_23_ja = new Intl.DateTimeFormat(
+    "ja-JP", {hour: "numeric", minute: "numeric", hourCycle: "h23"})
+assertEquals("h23", df_23_ja.resolvedOptions().hourCycle);
+assertEquals("0:00", df_23_ja.formatRange(midnight, midnight));
+assertEquals("12:00", df_23_ja.formatRange(noon, noon));
+
+let df_23_ja_t = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", hourCycle: "h23"})
+assertEquals("h23", df_23_ja_t.resolvedOptions().hourCycle);
+assertEquals("0:00", df_23_ja_t.formatRange(midnight, midnight));
+assertEquals("12:00", df_23_ja_t.formatRange(noon, noon));
+
+let df_23_ja_dt = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", dateStyle: "short", hourCycle: "h23"})
+assertEquals("h23", df_23_ja_dt.resolvedOptions().hourCycle);
+assertEquals("2019/04/04 0:00", df_23_ja_dt.formatRange(midnight, midnight));
+assertEquals("2019/04/04 12:00", df_23_ja_dt.formatRange(noon, noon));
+
+let df_24_ja = new Intl.DateTimeFormat(
+    "ja-JP", {hour: "numeric", minute: "numeric", hourCycle: "h24"})
+assertEquals("h24", df_24_ja.resolvedOptions().hourCycle);
+assertEquals("24:00", df_24_ja.formatRange(midnight, midnight));
+assertEquals("12:00", df_24_ja.formatRange(noon, noon));
+
+let df_24_ja_t = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", hourCycle: "h24"})
+assertEquals("h24", df_24_ja_t.resolvedOptions().hourCycle);
+assertEquals("24:00", df_24_ja_t.formatRange(midnight, midnight));
+assertEquals("12:00", df_24_ja_t.formatRange(noon, noon));
+
+let df_24_ja_dt = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", dateStyle: "short", hourCycle: "h24"})
+assertEquals("h24", df_24_ja_dt.resolvedOptions().hourCycle);
+assertEquals("2019/04/04 24:00", df_24_ja_dt.formatRange(midnight, midnight));
+assertEquals("2019/04/04 12:00", df_24_ja_dt.formatRange(noon, noon));
diff --git a/deps/v8/test/intl/date-format/hour_cycle.js b/deps/v8/test/intl/date-format/hour_cycle.js
new file mode 100644
index 00000000000000..6b97ec4e8b6bd1
--- /dev/null
+++ b/deps/v8/test/intl/date-format/hour_cycle.js
@@ -0,0 +1,53 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let midnight = new Date(2019, 3, 4, 0);
+let noon = new Date(2019, 3, 4, 12);
+let df_11 = new Intl.DateTimeFormat(
+    "en", {hour: "numeric", minute: "numeric", hourCycle: "h11"})
+assertEquals("h11", df_11.resolvedOptions().hourCycle);
+assertEquals("0:00 AM", df_11.format(midnight));
+assertEquals("0:00 PM", df_11.format(noon));
+
+let df_12 = new Intl.DateTimeFormat(
+    "en", {hour: "numeric", minute: "numeric", hourCycle: "h12"})
+assertEquals("h12", df_12.resolvedOptions().hourCycle);
+assertEquals("12:00 AM", df_12.format(midnight));
+assertEquals("12:00 PM", df_12.format(noon));
+
+let df_23 = new Intl.DateTimeFormat(
+    "en", {hour: "numeric", minute: "numeric", hourCycle: "h23"})
+assertEquals("h23", df_23.resolvedOptions().hourCycle);
+assertEquals("00:00", df_23.format(midnight));
+assertEquals("12:00" ,df_23.format(noon));
+
+let df_24 = new Intl.DateTimeFormat(
+    "en", {hour: "numeric", minute: "numeric", hourCycle: "h24"})
+assertEquals("h24", df_24.resolvedOptions().hourCycle);
+assertEquals("24:00", df_24.format(midnight));
+assertEquals("12:00", df_24.format(noon));
+
+let df_11_ja = new Intl.DateTimeFormat(
+    "ja-JP", {hour: "numeric", minute: "numeric", hourCycle: "h11"})
+assertEquals("h11", df_11_ja.resolvedOptions().hourCycle);
+assertEquals("午前0:00", df_11_ja.format(midnight));
+assertEquals("午後0:00", df_11_ja.format(noon));
+
+let df_12_ja = new Intl.DateTimeFormat(
+    "ja-JP", {hour: "numeric", minute: "numeric", hourCycle: "h12"})
+assertEquals("h12", df_12_ja.resolvedOptions().hourCycle);
+assertEquals("午前12:00", df_12_ja.format(midnight));
+assertEquals("午後12:00", df_12_ja.format(noon));
+
+let df_23_ja = new Intl.DateTimeFormat(
+    "ja-JP", {hour: "numeric", minute: "numeric", hourCycle: "h23"})
+assertEquals("h23", df_23_ja.resolvedOptions().hourCycle);
+assertEquals("0:00", df_23_ja.format(midnight));
+assertEquals("12:00", df_23_ja.format(noon));
+
+let df_24_ja = new Intl.DateTimeFormat(
+    "ja-JP", {hour: "numeric", minute: "numeric", hourCycle: "h24"})
+assertEquals("h24", df_24_ja.resolvedOptions().hourCycle);
+assertEquals("24:00", df_24_ja.format(midnight));
+assertEquals("12:00", df_24_ja.format(noon));
diff --git a/deps/v8/test/intl/date-format/time_style_hour_cycle.js b/deps/v8/test/intl/date-format/time_style_hour_cycle.js
new file mode 100644
index 00000000000000..de3d825129aecb
--- /dev/null
+++ b/deps/v8/test/intl/date-format/time_style_hour_cycle.js
@@ -0,0 +1,54 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let midnight = new Date(2019, 3, 4, 0);
+let noon = new Date(2019, 3, 4, 12);
+
+let df_11_t = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", hourCycle: "h11"})
+assertEquals("h11", df_11_t.resolvedOptions().hourCycle);
+assertEquals("0:00 AM", df_11_t.format(midnight));
+assertEquals("0:00 PM", df_11_t.format(noon));
+
+let df_12_t = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", hourCycle: "h12"})
+assertEquals("h12", df_12_t.resolvedOptions().hourCycle);
+assertEquals("12:00 AM", df_12_t.format(midnight));
+assertEquals("12:00 PM", df_12_t.format(noon));
+
+let df_23_t = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", hourCycle: "h23"})
+assertEquals("h23", df_23_t.resolvedOptions().hourCycle);
+assertEquals("00:00", df_23_t.format(midnight));
+assertEquals("12:00" ,df_23_t.format(noon));
+
+let df_24_t = new Intl.DateTimeFormat(
+    "en", {timeStyle: "short", hourCycle: "h24"})
+assertEquals("h24", df_24_t.resolvedOptions().hourCycle);
+assertEquals("24:00", df_24_t.format(midnight));
+assertEquals("12:00", df_24_t.format(noon));
+
+let df_11_ja_t = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", hourCycle: "h11"})
+assertEquals("h11", df_11_ja_t.resolvedOptions().hourCycle);
+assertEquals("午前0:00", df_11_ja_t.format(midnight));
+assertEquals("午後0:00", df_11_ja_t.format(noon));
+
+let df_12_ja_t = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", hourCycle: "h12"})
+assertEquals("h12", df_12_ja_t.resolvedOptions().hourCycle);
+assertEquals("午前12:00", df_12_ja_t.format(midnight));
+assertEquals("午後12:00", df_12_ja_t.format(noon));
+
+let df_23_ja_t = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", hourCycle: "h23"})
+assertEquals("h23", df_23_ja_t.resolvedOptions().hourCycle);
+assertEquals("0:00", df_23_ja_t.format(midnight));
+assertEquals("12:00", df_23_ja_t.format(noon));
+
+let df_24_ja_t = new Intl.DateTimeFormat(
+    "ja-JP", {timeStyle: "short", hourCycle: "h24"})
+assertEquals("h24", df_24_ja_t.resolvedOptions().hourCycle);
+assertEquals("24:00", df_24_ja_t.format(midnight));
+assertEquals("12:00", df_24_ja_t.format(noon));
diff --git a/deps/v8/test/intl/displaynames/constructor-order.js b/deps/v8/test/intl/displaynames/constructor-order.js
new file mode 100644
index 00000000000000..6951b5fddb9d58
--- /dev/null
+++ b/deps/v8/test/intl/displaynames/constructor-order.js
@@ -0,0 +1,26 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-displaynames
+
+// Throws only once during construction.
+// Check for all getters to prevent regression.
+// Preserve the order of getter initialization.
+let getCount = 0;
+
+new Intl.DisplayNames(['en-US'], {
+  get localeMatcher() {
+    assertEquals(0, getCount++);
+  },
+  get style() {
+    assertEquals(1, getCount++);
+  },
+  get type() {
+    assertEquals(2, getCount++);
+  },
+  get fallback() {
+    assertEquals(3, getCount++);
+  },
+});
+assertEquals(4, getCount);
diff --git a/deps/v8/test/intl/displaynames/constructor.js b/deps/v8/test/intl/displaynames/constructor.js
new file mode 100644
index 00000000000000..c86fa479febd9c
--- /dev/null
+++ b/deps/v8/test/intl/displaynames/constructor.js
@@ -0,0 +1,89 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-displaynames
+// DisplayNames constructor can't be called as function.
+assertThrows(() => Intl.DisplayNames('sr'), TypeError);
+
+assertDoesNotThrow(() => new Intl.DisplayNames('sr', {}));
+
+assertDoesNotThrow(() => new Intl.DisplayNames([], {}));
+
+assertDoesNotThrow(() => new Intl.DisplayNames(['fr', 'ar'], {}));
+
+assertDoesNotThrow(() => new Intl.DisplayNames({0: 'ja', 1:'fr'}, {}));
+
+assertDoesNotThrow(() => new Intl.DisplayNames({1: 'ja', 2:'fr'}, {}));
+
+assertDoesNotThrow(() => new Intl.DisplayNames('sr'));
+
+assertDoesNotThrow(() => new Intl.DisplayNames());
+
+assertDoesNotThrow(
+    () => new Intl.DisplayNames(
+        'sr', {
+          localeMatcher: 'lookup',
+          style: 'short',
+          type: 'language',
+          fallback: 'code',
+        }));
+
+
+assertDoesNotThrow(
+    () => new Intl.DisplayNames('sr', {localeMatcher: 'lookup'}));
+
+assertDoesNotThrow(
+    () => new Intl.DisplayNames('sr', {localeMatcher: 'best fit'}));
+
+assertThrows(
+    () => new Intl.DisplayNames('sr', {localeMatcher: 'hello'}),
+    RangeError);
+
+assertThrows(
+    () => new Intl.DisplayNames('sr', {localeMatcher: 'look up'}),
+    RangeError);
+
+assertThrows(
+    () => new Intl.DisplayNames('sr', {localeMatcher: 'bestfit'}),
+    RangeError);
+
+
+assertDoesNotThrow(
+    () => new Intl.DisplayNames('sr', {style: 'long'}));
+
+assertDoesNotThrow(
+    () => new Intl.DisplayNames('sr', {style: 'short'}));
+
+assertDoesNotThrow(
+    () => new Intl.DisplayNames('sr', {style: 'narrow'}));
+
+assertThrows(
+    () => new Intl.DisplayNames('sr', {style: 'giant'}),
+    RangeError);
+
+assertDoesNotThrow(
+    () => new Intl.DisplayNames('sr', {fallback: 'code'}));
+
+assertDoesNotThrow(
+    () => new Intl.DisplayNames('sr', {fallback: 'none'}));
+
+assertThrows(
+    () => new Intl.DisplayNames('sr', {fallback: 'never'}),
+    RangeError);
+
+assertDoesNotThrow(
+    () => new Intl.DisplayNames('sr', {type: 'language'}));
+
+assertDoesNotThrow(
+    () => new Intl.DisplayNames('sr', {type: 'region'}));
+
+assertDoesNotThrow(
+    () => new Intl.DisplayNames('sr', {type: 'script'}));
+
+assertDoesNotThrow(
+    () => new Intl.DisplayNames('sr', {type: 'currency'}));
+
+assertThrows(
+    () => new Intl.DisplayNames('sr', {type: ''}),
+    RangeError);
diff --git a/deps/v8/test/intl/displaynames/resolved-options.js b/deps/v8/test/intl/displaynames/resolved-options.js
new file mode 100644
index 00000000000000..dd8988375ac9fc
--- /dev/null
+++ b/deps/v8/test/intl/displaynames/resolved-options.js
@@ -0,0 +1,48 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-displaynames
+
+let displayNames = new Intl.DisplayNames();
+// The default style is 'long'
+assertEquals('long', displayNames.resolvedOptions().style);
+
+// The default type is 'language'
+assertEquals('language', displayNames.resolvedOptions().type);
+
+// The default fallback is 'code'
+assertEquals('code', displayNames.resolvedOptions().fallback);
+
+const styles = ["long", "short", "narrow"];
+const types = ["language", "region", "script", "currency"];
+const fallbacks = ["code", "none"];
+
+styles.forEach(function(style) {
+  assertEquals(style,
+      (new Intl.DisplayNames(['sr'], {style})).resolvedOptions().style);
+  assertEquals(types[0],
+      (new Intl.DisplayNames(['sr'], {style})).resolvedOptions().type);
+  assertEquals(fallbacks[0],
+      (new Intl.DisplayNames(['sr'], {style})).resolvedOptions().fallback);
+  types.forEach(function(type) {
+    assertEquals(style,
+        (new Intl.DisplayNames(['sr'], {style, type})).resolvedOptions().style);
+    assertEquals(type,
+        (new Intl.DisplayNames(['sr'], {style, type})).resolvedOptions().type);
+    assertEquals(fallbacks[0],
+        (new Intl.DisplayNames(
+            ['sr'], {style, type})).resolvedOptions().fallback);
+    fallbacks.forEach(function(fallback) {
+      assertEquals(style,
+          (new Intl.DisplayNames(
+              ['sr'], {style, type, fallback})).resolvedOptions().style);
+      assertEquals(type,
+          (new Intl.DisplayNames(
+              ['sr'], {style, type, fallback})).resolvedOptions().type);
+      assertEquals(fallback,
+          (new Intl.DisplayNames(
+              ['sr'], {style, type, fallback})).resolvedOptions().fallback);
+    });
+  });
+});
diff --git a/deps/v8/test/intl/displaynames/supported-locale.js b/deps/v8/test/intl/displaynames/supported-locale.js
new file mode 100644
index 00000000000000..d392bedd1141dd
--- /dev/null
+++ b/deps/v8/test/intl/displaynames/supported-locale.js
@@ -0,0 +1,22 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-displaynames
+
+assertEquals(typeof Intl.DisplayNames.supportedLocalesOf, "function",
+             "Intl.DisplayNames.supportedLocalesOf should be a function");
+
+var undef = Intl.DisplayNames.supportedLocalesOf();
+assertEquals([], undef);
+
+var empty = Intl.DisplayNames.supportedLocalesOf([]);
+assertEquals([], empty);
+
+var strLocale = Intl.DisplayNames.supportedLocalesOf('sr');
+assertEquals('sr', strLocale[0]);
+
+var multiLocale = ['sr-Thai-RS', 'de', 'zh-CN'];
+assertEquals(multiLocale,
+    Intl.DisplayNames.supportedLocalesOf(multiLocale,
+      {localeMatcher: "lookup"}));
diff --git a/deps/v8/test/intl/general/supported-locales-of.js b/deps/v8/test/intl/general/supported-locales-of.js
index 84984c1d25ecc7..aeb5f328e7b208 100644
--- a/deps/v8/test/intl/general/supported-locales-of.js
+++ b/deps/v8/test/intl/general/supported-locales-of.js
@@ -51,7 +51,8 @@ for (const service of services) {
   assertEquals("sr", strLocale[0]);
 
   var locales = ["sr-Thai-RS", "de", "zh-CN"];
-  let multiLocale = service.supportedLocalesOf(locales);
+  let multiLocale = service.supportedLocalesOf(
+      locales, {localeMatcher: "lookup"});
   assertEquals("sr-Thai-RS", multiLocale[0]);
   assertEquals("de", multiLocale[1]);
   assertEquals("zh-CN", multiLocale[2]);
diff --git a/deps/v8/test/intl/intl.status b/deps/v8/test/intl/intl.status
index 669f5d93d541fd..6437de45db28e5 100644
--- a/deps/v8/test/intl/intl.status
+++ b/deps/v8/test/intl/intl.status
@@ -36,6 +36,9 @@
 
   # https://code.google.com/p/v8/issues/detail?id=9312
   'regress-9312': [FAIL],
+
+  # http://crbug/v8/9930
+  'date-format/format_range_hour_cycle': [FAIL],
 }],  # ALWAYS
 
 ['variant == no_wasm_traps', {
@@ -68,8 +71,4 @@
   'relative-time-format/resolved-options-nu-extended': [FAIL],
 }],  # 'system == android'
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
 ]
diff --git a/deps/v8/test/intl/list-format/supported-locale.js b/deps/v8/test/intl/list-format/supported-locale.js
index 0aebeb86a1179f..010b1e172002f3 100644
--- a/deps/v8/test/intl/list-format/supported-locale.js
+++ b/deps/v8/test/intl/list-format/supported-locale.js
@@ -15,4 +15,5 @@ var strLocale = Intl.ListFormat.supportedLocalesOf('sr');
 assertEquals('sr', strLocale[0]);
 
 var multiLocale = ['sr-Thai-RS', 'de', 'zh-CN'];
-assertEquals(multiLocale, Intl.ListFormat.supportedLocalesOf(multiLocale));
+assertEquals(multiLocale,
+    Intl.ListFormat.supportedLocalesOf(multiLocale, {localeMatcher: "lookup"}));
diff --git a/deps/v8/test/intl/number-format/check-numbering-system.js b/deps/v8/test/intl/number-format/check-numbering-system.js
index c9df98a671c1a8..78c9a6d8d54492 100644
--- a/deps/v8/test/intl/number-format/check-numbering-system.js
+++ b/deps/v8/test/intl/number-format/check-numbering-system.js
@@ -75,7 +75,7 @@ validNumberingSystem.forEach(function(numberingSystem) {
   locales.forEach(function(base) {
     let l = base + "-u-nu-" + numberingSystem;
     let nf = new Intl.NumberFormat([base], {numberingSystem});
-    assertEquals(l, nf.resolvedOptions().locale);
+    assertEquals(base, nf.resolvedOptions().locale);
     assertEquals(numberingSystem, nf.resolvedOptions().numberingSystem);
 
     // Test the formatting result is the same as passing in via u-nu-
diff --git a/deps/v8/test/intl/number-format/unified/notation-engineering-formatToParts.js b/deps/v8/test/intl/number-format/unified/notation-engineering-formatToParts.js
index da91f4ba9639d5..d24ec264a80431 100644
--- a/deps/v8/test/intl/number-format/unified/notation-engineering-formatToParts.js
+++ b/deps/v8/test/intl/number-format/unified/notation-engineering-formatToParts.js
@@ -138,36 +138,21 @@ assertEquals("0", parts[3].value);
 assertEquals(4, parts.length);
 
 parts = nf.formatToParts(Infinity);
-// [{type: "infinity", value: "∞"}, {type: "exponentSeparator", value: "E"},
-//  {type: "exponentInteger", value: "0"}]
+// [{type: "infinity", value: "∞"}]
 assertEquals("infinity", parts[0].type);
 assertEquals("∞", parts[0].value);
-assertEquals("exponentSeparator", parts[1].type);
-assertEquals("E", parts[1].value);
-assertEquals("exponentInteger", parts[2].type);
-assertEquals("0", parts[2].value);
-assertEquals(3, parts.length);
+assertEquals(1, parts.length);
 
 parts = nf.formatToParts(-Infinity);
-// [{type: "minusSign", value: "-"}, {type: "infinity", value: "∞"},
-//  {type: "exponentSeparator", value: "E"}, {type: "exponentInteger", value: "0"}]
+// [{type: "minusSign", value: "-"}, {type: "infinity", value: "∞"}]
 assertEquals("minusSign", parts[0].type);
 assertEquals("-", parts[0].value);
 assertEquals("infinity", parts[1].type);
 assertEquals("∞", parts[1].value);
-assertEquals("exponentSeparator", parts[2].type);
-assertEquals("E", parts[2].value);
-assertEquals("exponentInteger", parts[3].type);
-assertEquals("0", parts[3].value);
-assertEquals(4, parts.length);
+assertEquals(2, parts.length);
 
 parts = nf.formatToParts(NaN);
-// [{type: "nan", value: "NaN"}, {type: "exponentSeparator", value: "E"},
-//  {type: "exponentInteger", value: "0"}]
+// [{type: "nan", value: "NaN"}]
 assertEquals("nan", parts[0].type);
 assertEquals("NaN", parts[0].value);
-assertEquals("exponentSeparator", parts[1].type);
-assertEquals("E", parts[1].value);
-assertEquals("exponentInteger", parts[2].type);
-assertEquals("0", parts[2].value);
-assertEquals(3, parts.length);
+assertEquals(1, parts.length);
diff --git a/deps/v8/test/intl/number-format/unified/notation-scientific-formatToParts.js b/deps/v8/test/intl/number-format/unified/notation-scientific-formatToParts.js
index ade723dbe37e82..1e4b491cd99776 100644
--- a/deps/v8/test/intl/number-format/unified/notation-scientific-formatToParts.js
+++ b/deps/v8/test/intl/number-format/unified/notation-scientific-formatToParts.js
@@ -140,36 +140,21 @@ assertEquals("0", parts[3].value);
 assertEquals(4, parts.length);
 
 parts = nf.formatToParts(Infinity);
-// [{type: "infinity", value: "∞"}, {type: "exponentSeparator", value: "E"},
-//  {type: "exponentInteger", value: "0"}]
+// [{type: "infinity", value: "∞"}]
 assertEquals("infinity", parts[0].type);
 assertEquals("∞", parts[0].value);
-assertEquals("exponentSeparator", parts[1].type);
-assertEquals("E", parts[1].value);
-assertEquals("exponentInteger", parts[2].type);
-assertEquals("0", parts[2].value);
-assertEquals(3, parts.length);
+assertEquals(1, parts.length);
 
 parts = nf.formatToParts(-Infinity);
-// [{type: "minusSign", value: "-"}, {type: "infinity", value: "∞"},
-//  {type: "exponentSeparator", value: "E"}, {type: "exponentInteger", value: "0"}]
+// [{type: "minusSign", value: "-"}, {type: "infinity", value: "∞"}]
 assertEquals("minusSign", parts[0].type);
 assertEquals("-", parts[0].value);
 assertEquals("infinity", parts[1].type);
 assertEquals("∞", parts[1].value);
-assertEquals("exponentSeparator", parts[2].type);
-assertEquals("E", parts[2].value);
-assertEquals("exponentInteger", parts[3].type);
-assertEquals("0", parts[3].value);
-assertEquals(4, parts.length);
+assertEquals(2, parts.length);
 
 parts = nf.formatToParts(NaN);
-// [{type: "nan", value: "NaN"}, {type: "exponentSeparator", value: "E"},
-//  {type: "exponentInteger", value: "0"}]
+// [{type: "nan", value: "NaN"}]
 assertEquals("nan", parts[0].type);
 assertEquals("NaN", parts[0].value);
-assertEquals("exponentSeparator", parts[1].type);
-assertEquals("E", parts[1].value);
-assertEquals("exponentInteger", parts[2].type);
-assertEquals("0", parts[2].value);
-assertEquals(3, parts.length);
+assertEquals(1, parts.length);
diff --git a/deps/v8/test/intl/regress-9887.js b/deps/v8/test/intl/regress-9887.js
new file mode 100644
index 00000000000000..4ef31f85bc4d0d
--- /dev/null
+++ b/deps/v8/test/intl/regress-9887.js
@@ -0,0 +1,68 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-add-calendar-numbering-system
+
+let intlClasses = [
+    Intl.RelativeTimeFormat,
+    Intl.NumberFormat,
+    Intl.DateTimeFormat
+];
+
+// Check "nu" on Intl.RelativeTimeFormat, Intl.NumberFormat and
+// Intl.DateTimeFormat
+intlClasses.forEach(function(cls) {
+  let o1 = (new cls("en")).resolvedOptions();
+  assertEquals('latn', o1.numberingSystem);
+
+  let o2 = (new cls("en-u-nu-arab")).resolvedOptions();
+  assertEquals("arab", o2.numberingSystem);
+  assertEquals("en-u-nu-arab", o2.locale);
+
+  let o3 = (new cls(
+      "en-u-nu-arab", {numberingSystem: 'thai'})).resolvedOptions();
+  assertEquals("thai", o3.numberingSystem);
+  assertEquals("en", o3.locale);
+
+  let o4 = (new cls(
+      "en", {numberingSystem: 'bali'})).resolvedOptions();
+  assertEquals("bali", o4.numberingSystem);
+  assertEquals("en", o4.locale);
+
+  let o5 = (new cls("ar-SA")).resolvedOptions();
+  assertEquals('arab', o5.numberingSystem);
+
+
+  let o6 = (new cls(
+      "ar-SA-u-nu-arab", {numberingSystem: 'thai'})).resolvedOptions();
+  assertEquals("thai", o6.numberingSystem);
+  assertEquals("ar-SA", o6.locale);
+
+  let o7 = (new cls(
+      "ar-SA-u-nu-arab", {numberingSystem: 'arab'})).resolvedOptions();
+  assertEquals("arab", o7.numberingSystem);
+  assertEquals("ar-SA-u-nu-arab", o7.locale);
+});
+
+// Check "ca" on Intl.DateTimeFormat
+cls = Intl.DateTimeFormat;
+let o1 = (new cls("en")).resolvedOptions();
+assertEquals('gregory', o1.calendar);
+
+let o2 = (new cls("en-u-ca-roc")).resolvedOptions();
+assertEquals("roc", o2.calendar);
+assertEquals("en-u-ca-roc", o2.locale);
+
+let o3 = (new cls(
+    "en-u-ca-roc", {calendar: 'chinese'})).resolvedOptions();
+assertEquals("chinese", o3.calendar);
+assertEquals("en", o3.locale);
+
+let o4 = (new cls(
+    "en", {calendar: 'japanese'})).resolvedOptions();
+assertEquals("japanese", o4.calendar);
+assertEquals("en", o4.locale);
+
+let o5 = (new cls("fa")).resolvedOptions();
+assertEquals('persian', o5.calendar);
diff --git a/deps/v8/test/intl/regress-9912.js b/deps/v8/test/intl/regress-9912.js
new file mode 100644
index 00000000000000..63639e91c5621d
--- /dev/null
+++ b/deps/v8/test/intl/regress-9912.js
@@ -0,0 +1,26 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let df = new Intl.DateTimeFormat("en");
+
+// A modern date
+let d1 = new Date(2019, 3, 4);
+let d2 = new Date(2019, 4, 5);
+assertEquals(df.format(d1), df.formatRange(d1, d1));
+assertEquals(df.format(d2), df.formatRange(d2, d2));
+assertEquals("4/4/2019 – 5/5/2019", df.formatRange(d1, d2));
+
+// An old date just before the Julian / Gregorian switch
+let d3 = new Date(1582, 8, 13);
+let d4 = new Date(1582, 9, 14);
+assertEquals(df.format(d3), df.formatRange(d3, d3));
+assertEquals(df.format(d4), df.formatRange(d4, d4));
+assertEquals("9/13/1582 – 10/14/1582", df.formatRange(d3, d4));
+
+// An older date
+let d5 = new Date(1000, 0, 1);
+let d6 = new Date(1001, 1, 2);
+assertEquals(df.format(d5), df.formatRange(d5, d5));
+assertEquals(df.format(d6), df.formatRange(d6, d6));
+assertEquals("1/1/1000 – 2/2/1001", df.formatRange(d5, d6));
diff --git a/deps/v8/test/intl/relative-time-format/check-numbering-system.js b/deps/v8/test/intl/relative-time-format/check-numbering-system.js
index 91f4b3aee0071b..f6c2f4f29c58c0 100644
--- a/deps/v8/test/intl/relative-time-format/check-numbering-system.js
+++ b/deps/v8/test/intl/relative-time-format/check-numbering-system.js
@@ -73,7 +73,7 @@ validNumberingSystem.forEach(function(numberingSystem) {
   locales.forEach(function(base) {
     let l = base + "-u-nu-" + numberingSystem;
     let nf = new Intl.RelativeTimeFormat([base], {numberingSystem});
-    assertEquals(l, nf.resolvedOptions().locale);
+    assertEquals(base, nf.resolvedOptions().locale);
     assertEquals(numberingSystem, nf.resolvedOptions().numberingSystem);
 
     // Test the formatting result is the same as passing in via u-nu-
diff --git a/deps/v8/test/intl/relative-time-format/supported-locale.js b/deps/v8/test/intl/relative-time-format/supported-locale.js
index 5c177b477710e1..f062c67c31fa05 100644
--- a/deps/v8/test/intl/relative-time-format/supported-locale.js
+++ b/deps/v8/test/intl/relative-time-format/supported-locale.js
@@ -15,4 +15,6 @@ var strLocale = Intl.RelativeTimeFormat.supportedLocalesOf('sr');
 assertEquals('sr', strLocale[0]);
 
 var multiLocale = ['sr-Thai-RS', 'de', 'zh-CN'];
-assertEquals(multiLocale, Intl.RelativeTimeFormat.supportedLocalesOf(multiLocale));
+assertEquals(multiLocale,
+    Intl.RelativeTimeFormat.supportedLocalesOf(multiLocale,
+      {localeMatcher: "lookup"}));
diff --git a/deps/v8/test/intl/segmenter/supported-locale.js b/deps/v8/test/intl/segmenter/supported-locale.js
index 9197b6a8156a22..b1a035315649ac 100644
--- a/deps/v8/test/intl/segmenter/supported-locale.js
+++ b/deps/v8/test/intl/segmenter/supported-locale.js
@@ -19,4 +19,5 @@ const strLocale = Intl.Segmenter.supportedLocalesOf("sr");
 assertEquals("sr", strLocale[0]);
 
 const multiLocale = ["sr-Thai-RS", "de", "zh-CN"];
-assertEquals(multiLocale, Intl.Segmenter.supportedLocalesOf(multiLocale));
+assertEquals(multiLocale,
+    Intl.Segmenter.supportedLocalesOf(multiLocale, {localeMatcher: "lookup"}));
diff --git a/deps/v8/test/js-perf-test/BigInt/add.js b/deps/v8/test/js-perf-test/BigInt/add.js
index f0397f2393da88..a18bf9127070c1 100644
--- a/deps/v8/test/js-perf-test/BigInt/add.js
+++ b/deps/v8/test/js-perf-test/BigInt/add.js
@@ -56,6 +56,7 @@ function SetUpTestAddTypeError() {
   initial_sum = 42n;
 }
 
+
 function TestAddTypeError() {
   let sum = initial_sum;
   for (let i = 0; i < SLOW_TEST_ITERATIONS; ++i) {
@@ -73,6 +74,7 @@ function SetUpTestAddZero() {
   initial_sum = 42n;
 }
 
+
 function TestAddZero() {
   let sum = initial_sum;
 
@@ -91,6 +93,7 @@ function SetUpTestAddSameSign(bits) {
   a = SmallRandomBigIntWithBits(bits);
 }
 
+
 function TestAddSameSign() {
   let sum = initial_sum;
 
@@ -109,6 +112,7 @@ function SetUpTestAddDifferentSign(bits) {
   a = -SmallRandomBigIntWithBits(bits);
 }
 
+
 function TestAddDifferentSign() {
   let sum = initial_sum;
 
@@ -131,6 +135,7 @@ function SetUpTestAddRandom() {
   }
 }
 
+
 function TestAddRandom() {
   let sum = 0n;
 
diff --git a/deps/v8/test/js-perf-test/BigInt/as-uint-n.js b/deps/v8/test/js-perf-test/BigInt/as-uint-n.js
index f69d4978db49e2..9c174f7b8eb99f 100644
--- a/deps/v8/test/js-perf-test/BigInt/as-uint-n.js
+++ b/deps/v8/test/js-perf-test/BigInt/as-uint-n.js
@@ -6,6 +6,8 @@
 
 load('bigint-util.js');
 
+let random_bigints = [];
+
 // This dummy ensures that the feedback for benchmark.run() in the Measure
 // function from base.js is not monomorphic, thereby preventing the benchmarks
 // below from being inlined. This ensures consistent behavior and comparable
diff --git a/deps/v8/test/js-perf-test/BigInt/bigint-util.js b/deps/v8/test/js-perf-test/BigInt/bigint-util.js
index 7e426060c10ef3..71bc61c480b81e 100644
--- a/deps/v8/test/js-perf-test/BigInt/bigint-util.js
+++ b/deps/v8/test/js-perf-test/BigInt/bigint-util.js
@@ -4,6 +4,12 @@
 
 "use strict";
 
+// Test configuration.
+const TEST_ITERATIONS = 1000;
+const SLOW_TEST_ITERATIONS = 50;
+const BITS_CASES = [32, 64, 128, 256, 512, 1024, 2048, 4096, 8192];
+const RANDOM_BIGINTS_MAX_BITS = 64 * 100;
+
 
 function RandomHexDigit(allow_zero) {
   const chars = allow_zero ? '0123456789ABCDEF' : '123456789ABCDEF';
diff --git a/deps/v8/test/js-perf-test/BigInt/run.js b/deps/v8/test/js-perf-test/BigInt/run.js
index 2f2cc30285d2b1..621b947dae8385 100644
--- a/deps/v8/test/js-perf-test/BigInt/run.js
+++ b/deps/v8/test/js-perf-test/BigInt/run.js
@@ -5,16 +5,13 @@
 "use strict";
 
 load('../base.js');
-load('test-config.js');
-load('to-boolean.js');
-load('add.js');
-load('as-uint-n.js');
-
+load(arguments[0] + '.js');
 
 var success = true;
 
+
 function PrintResult(name, result) {
-  print(name + '-BigInt(Score): ' + result);
+  print(`BigInt-${name}(Score): ${result}`);
 }
 
 
diff --git a/deps/v8/test/js-perf-test/BigInt/subtract.js b/deps/v8/test/js-perf-test/BigInt/subtract.js
new file mode 100644
index 00000000000000..076da37a8c4a1e
--- /dev/null
+++ b/deps/v8/test/js-perf-test/BigInt/subtract.js
@@ -0,0 +1,148 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+load('bigint-util.js');
+
+let initial_diff = 0n;
+let a = 0n;
+let random_bigints = [];
+
+// This dummy ensures that the feedback for benchmark.run() in the Measure
+// function from base.js is not monomorphic, thereby preventing the benchmarks
+// below from being inlined. This ensures consistent behavior and comparable
+// results.
+new BenchmarkSuite('Prevent-Inline-Dummy', [10000], [
+  new Benchmark('Prevent-Inline-Dummy', true, false, 0, () => {})
+]);
+
+
+new BenchmarkSuite('Subtract-TypeError', [10000], [
+  new Benchmark('Subtract-TypeError', true, false, 0, TestSubtractTypeError,
+    SetUpTestSubtractTypeError)
+]);
+
+
+new BenchmarkSuite('Subtract-Zero', [1000], [
+  new Benchmark('Subtract-Zero', true, false, 0, TestSubtractZero,
+    SetUpTestSubtractZero)
+]);
+
+
+BITS_CASES.forEach((d) => {
+  new BenchmarkSuite(`Subtract-SameSign-${d}`, [1000], [
+    new Benchmark(`Subtract-SameSign-${d}`, true, false, 0,
+      TestSubtractSameSign, () => SetUpTestSubtractSameSign(d))
+  ]);
+});
+
+
+BITS_CASES.forEach((d) => {
+  new BenchmarkSuite(`Subtract-DifferentSign-${d}`, [1000], [
+    new Benchmark(`Subtract-DifferentSign-${d}`, true, false, 0,
+      TestSubtractDifferentSign, () => SetUpTestSubtractDifferentSign(d))
+  ]);
+});
+
+
+new BenchmarkSuite('Subtract-Random', [1000], [
+  new Benchmark('Subtract-Random', true, false, 0, TestSubtractRandom,
+    SetUpTestSubtractRandom)
+]);
+
+
+function SetUpTestSubtractSameSign(bits) {
+  // Subtract a small random negative value from the maximal negative number to
+  // make sure the result stays negative.
+  initial_diff = -MaxBigIntWithBits(bits);
+  a = -SmallRandomBigIntWithBits(bits);
+}
+
+
+function TestSubtractSameSign() {
+  let diff = initial_diff;
+
+  for (let i = 0; i < TEST_ITERATIONS; ++i) {
+    diff = diff - a;
+  }
+
+  return diff;
+}
+
+
+function SetUpTestSubtractDifferentSign(bits) {
+  // Subtract a small random negative value from a small positive value so that
+  // the differnce stays positive but does not grow in digits.
+  initial_diff = SmallRandomBigIntWithBits(bits);
+  a = -SmallRandomBigIntWithBits(bits);
+}
+
+
+function TestSubtractDifferentSign() {
+  let diff = initial_diff;
+
+  for (let i = 0; i < TEST_ITERATIONS; ++i) {
+    diff = diff - a;
+  }
+
+  return diff;
+}
+
+
+function SetUpTestSubtractRandom() {
+  random_bigints = [];
+  // RandomBigIntWithBits needs multiples of 4 bits.
+  const max_in_4bits = RANDOM_BIGINTS_MAX_BITS / 4;
+  for (let i = 0; i < TEST_ITERATIONS; ++i) {
+    const bits = Math.floor(Math.random() * max_in_4bits) * 4;
+    const bigint = RandomBigIntWithBits(bits);
+    random_bigints.push(Math.random() < 0.5 ? -bigint : bigint);
+  }
+}
+
+
+function TestSubtractRandom() {
+  let diff = 0n;
+
+  for (let i = 0; i < TEST_ITERATIONS; ++i) {
+    diff = diff - random_bigints[i];
+  }
+
+  return diff;
+}
+
+
+function SetUpTestSubtractTypeError() {
+  initial_diff = 42n;
+}
+
+
+function TestSubtractTypeError() {
+  let diff = initial_diff;
+  for (let i = 0; i < SLOW_TEST_ITERATIONS; ++i) {
+    try {
+      diff = 0 - diff;
+    }
+    catch(e) {
+    }
+  }
+  return diff;
+}
+
+
+function SetUpTestSubtractZero() {
+  initial_diff = 42n;
+}
+
+
+function TestSubtractZero() {
+  let diff = initial_diff;
+
+  for (let i = 0; i < TEST_ITERATIONS; ++i) {
+    diff = diff - 0n;
+  }
+
+  return diff;
+}
diff --git a/deps/v8/test/js-perf-test/BigInt/test-config.js b/deps/v8/test/js-perf-test/BigInt/test-config.js
deleted file mode 100644
index 8d77e70431433f..00000000000000
--- a/deps/v8/test/js-perf-test/BigInt/test-config.js
+++ /dev/null
@@ -1,10 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-"use strict";
-
-const TEST_ITERATIONS = 1000;
-const SLOW_TEST_ITERATIONS = 50;
-const BITS_CASES = [32, 64, 128, 256, 512, 1024, 2048, 4096, 8192];
-const RANDOM_BIGINTS_MAX_BITS = 64 * 100;
diff --git a/deps/v8/test/js-perf-test/BigInt/to-boolean.js b/deps/v8/test/js-perf-test/BigInt/to-boolean.js
index 031c292a7d9f62..c396da65b8de3e 100644
--- a/deps/v8/test/js-perf-test/BigInt/to-boolean.js
+++ b/deps/v8/test/js-perf-test/BigInt/to-boolean.js
@@ -13,16 +13,19 @@ new BenchmarkSuite('Prevent-Inline-Dummy', [10000], [
   new Benchmark('Prevent-Inline-Dummy', true, false, 0, () => {})
 ]);
 
-new BenchmarkSuite('BigInt-ToBoolean', [10000], [
-  new Benchmark('BigInt-ToBoolean', true, false, 0, TestToBoolean),
+
+new BenchmarkSuite('ToBoolean', [10000], [
+  new Benchmark('ToBoolean', true, false, 0, TestToBoolean),
 ]);
 
-new BenchmarkSuite('BigInt-BooleanConstructor', [10000], [
-  new Benchmark('BigInt-BooleanConstructor', true, false, 0, TestBooleanConstructor),
+
+new BenchmarkSuite('BooleanConstructor', [10000], [
+  new Benchmark('BooleanConstructor', true, false, 0, TestBooleanConstructor),
 ]);
 
-new BenchmarkSuite('BigInt-NewBooleanConstructor', [10000], [
-  new Benchmark('BigInt-NewBooleanConstructor', true, false, 0, TestNewBooleanConstructor),
+
+new BenchmarkSuite('NewBooleanConstructor', [10000], [
+  new Benchmark('NewBooleanConstructor', true, false, 0, TestNewBooleanConstructor),
 ]);
 
 
diff --git a/deps/v8/test/js-perf-test/JSTests1.json b/deps/v8/test/js-perf-test/JSTests1.json
index 9ac44cdfb8cb55..d8c8a0468407c4 100644
--- a/deps/v8/test/js-perf-test/JSTests1.json
+++ b/deps/v8/test/js-perf-test/JSTests1.json
@@ -48,53 +48,101 @@
     {
       "name": "BigInt",
       "path": ["BigInt"],
-      "main": "run.js",
-      "resources": [
-        "bigint-util.js",
-        "test-config.js",
-        "to-boolean.js",
-        "add.js",
-        "as-uint-n.js"
-      ],
-      "results_regexp": "^%s\\-BigInt\\(Score\\): (.+)$",
       "tests": [
-        { "name": "BigInt-ToBoolean" },
-        { "name": "BigInt-BooleanConstructor" },
-        { "name": "BigInt-NewBooleanConstructor" },
-        { "name": "Add-TypeError" },
-        { "name": "Add-Zero" },
-        { "name": "Add-SameSign-32" },
-        { "name": "Add-DifferentSign-32" },
-        { "name": "Add-SameSign-64" },
-        { "name": "Add-DifferentSign-64" },
-        { "name": "Add-SameSign-128" },
-        { "name": "Add-DifferentSign-128" },
-        { "name": "Add-SameSign-256" },
-        { "name": "Add-DifferentSign-256" },
-        { "name": "Add-SameSign-512" },
-        { "name": "Add-DifferentSign-512" },
-        { "name": "Add-SameSign-1024" },
-        { "name": "Add-DifferentSign-1024" },
-        { "name": "Add-SameSign-2048" },
-        { "name": "Add-DifferentSign-2048" },
-        { "name": "Add-SameSign-4096" },
-        { "name": "Add-DifferentSign-4096" },
-        { "name": "Add-SameSign-8192" },
-        { "name": "Add-DifferentSign-8192" },
-        { "name": "Add-Random" },
-        { "name": "AsUint64-32" },
-        { "name": "AsUint64-64" },
-        { "name": "AsUint64-128" },
-        { "name": "AsUint64-256" },
-        { "name": "AsUint32-32" },
-        { "name": "AsUint32-64" },
-        { "name": "AsUint32-128" },
-        { "name": "AsUint32-256" },
-        { "name": "AsUint8-32" },
-        { "name": "AsUint8-64" },
-        { "name": "AsUint8-128" },
-        { "name": "AsUint8-256" }
-    ]
+        {
+          "name": "ToBoolean",
+          "main": "run.js",
+          "resources": ["to-boolean.js"],
+          "test_flags": ["to-boolean"],
+          "results_regexp": "^BigInt\\-%s\\(Score\\): (.+)$",
+          "tests": [
+            { "name": "ToBoolean" },
+            { "name": "BooleanConstructor" },
+            { "name": "NewBooleanConstructor" }
+          ]
+        },
+        {
+          "name": "Add",
+          "main": "run.js",
+          "resources": ["add.js", "bigint-util.js"],
+          "test_flags": ["add"],
+          "results_regexp": "^BigInt\\-%s\\(Score\\): (.+)$",
+          "tests": [
+            { "name": "Add-TypeError" },
+            { "name": "Add-Zero" },
+            { "name": "Add-SameSign-32" },
+            { "name": "Add-DifferentSign-32" },
+            { "name": "Add-SameSign-64" },
+            { "name": "Add-DifferentSign-64" },
+            { "name": "Add-SameSign-128" },
+            { "name": "Add-DifferentSign-128" },
+            { "name": "Add-SameSign-256" },
+            { "name": "Add-DifferentSign-256" },
+            { "name": "Add-SameSign-512" },
+            { "name": "Add-DifferentSign-512" },
+            { "name": "Add-SameSign-1024" },
+            { "name": "Add-DifferentSign-1024" },
+            { "name": "Add-SameSign-2048" },
+            { "name": "Add-DifferentSign-2048" },
+            { "name": "Add-SameSign-4096" },
+            { "name": "Add-DifferentSign-4096" },
+            { "name": "Add-SameSign-8192" },
+            { "name": "Add-DifferentSign-8192" },
+            { "name": "Add-Random" }
+          ]
+        },
+        {
+          "name": "Subtract",
+          "main": "run.js",
+          "resources": ["subtract.js", "bigint-util.js"],
+          "test_flags": ["subtract"],
+          "results_regexp": "^BigInt\\-%s\\(Score\\): (.+)$",
+          "tests": [
+            { "name": "Subtract-TypeError" },
+            { "name": "Subtract-Zero" },
+            { "name": "Subtract-SameSign-32" },
+            { "name": "Subtract-DifferentSign-32" },
+            { "name": "Subtract-SameSign-64" },
+            { "name": "Subtract-DifferentSign-64" },
+            { "name": "Subtract-SameSign-128" },
+            { "name": "Subtract-DifferentSign-128" },
+            { "name": "Subtract-SameSign-256" },
+            { "name": "Subtract-DifferentSign-256" },
+            { "name": "Subtract-SameSign-512" },
+            { "name": "Subtract-DifferentSign-512" },
+            { "name": "Subtract-SameSign-1024" },
+            { "name": "Subtract-DifferentSign-1024" },
+            { "name": "Subtract-SameSign-2048" },
+            { "name": "Subtract-DifferentSign-2048" },
+            { "name": "Subtract-SameSign-4096" },
+            { "name": "Subtract-DifferentSign-4096" },
+            { "name": "Subtract-SameSign-8192" },
+            { "name": "Subtract-DifferentSign-8192" },
+            { "name": "Subtract-Random" }
+          ]
+        },
+        {
+          "name": "AsUintN",
+          "main": "run.js",
+          "resources": ["as-uint-n.js", "bigint-util.js"],
+          "test_flags": ["as-uint-n"],
+          "results_regexp": "^BigInt\\-%s\\(Score\\): (.+)$",
+          "tests": [
+            { "name": "AsUint64-32" },
+            { "name": "AsUint64-64" },
+            { "name": "AsUint64-128" },
+            { "name": "AsUint64-256" },
+            { "name": "AsUint32-32" },
+            { "name": "AsUint32-64" },
+            { "name": "AsUint32-128" },
+            { "name": "AsUint32-256" },
+            { "name": "AsUint8-32" },
+            { "name": "AsUint8-64" },
+            { "name": "AsUint8-128" },
+            { "name": "AsUint8-256" }
+          ]
+        }
+      ]
     },
     {
       "name": "BigInt-Jitless",
@@ -104,11 +152,12 @@
         "to-boolean.js"
       ],
       "flags": ["--jitless"],
-      "results_regexp": "^%s\\-BigInt\\(Score\\): (.+)$",
+      "results_regexp": "^BigInt\\-%s\\(Score\\): (.+)$",
+      "test_flags": ["to-boolean"],
       "tests": [
-        { "name": "BigInt-ToBoolean" },
-        { "name": "BigInt-BooleanConstructor" },
-        { "name": "BigInt-NewBooleanConstructor" }
+        { "name": "ToBoolean" },
+        { "name": "BooleanConstructor" },
+        { "name": "NewBooleanConstructor" }
       ]
     },
     {
diff --git a/deps/v8/test/message/fail/string-prototype-matchall-no-flags.js b/deps/v8/test/message/fail/string-prototype-matchall-no-flags.js
new file mode 100644
index 00000000000000..1dfde4cf2dae0d
--- /dev/null
+++ b/deps/v8/test/message/fail/string-prototype-matchall-no-flags.js
@@ -0,0 +1,5 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"foo".matchAll({[Symbol.match]: true});
diff --git a/deps/v8/test/message/fail/string-prototype-matchall-no-flags.out b/deps/v8/test/message/fail/string-prototype-matchall-no-flags.out
new file mode 100644
index 00000000000000..617868aa021473
--- /dev/null
+++ b/deps/v8/test/message/fail/string-prototype-matchall-no-flags.out
@@ -0,0 +1,6 @@
+*%(basename)s:5: TypeError: The .flags property of the argument to String.prototype.matchAll cannot be null or undefined
+"foo".matchAll({[Symbol.match]: true});
+      ^
+TypeError: The .flags property of the argument to String.prototype.matchAll cannot be null or undefined
+    at String.matchAll (<anonymous>)
+    at *%(basename)s:5:7
diff --git a/deps/v8/test/message/fail/wasm-exception-rethrow.out b/deps/v8/test/message/fail/wasm-exception-rethrow.out
index 0133ee6bd7865c..c4c68e5b717109 100644
--- a/deps/v8/test/message/fail/wasm-exception-rethrow.out
+++ b/deps/v8/test/message/fail/wasm-exception-rethrow.out
@@ -1,4 +1,4 @@
-wasm-function[0]:5: RuntimeError: wasm exception
+wasm-function[0]:0x32: RuntimeError: wasm exception
 RuntimeError: wasm exception
     at rethrow0 (wasm-function[0]:0x32)
     at *%(basename)s:21:18
diff --git a/deps/v8/test/message/fail/wasm-exception-throw.out b/deps/v8/test/message/fail/wasm-exception-throw.out
index 0c302cb3c49112..c94ae248c0b6d1 100644
--- a/deps/v8/test/message/fail/wasm-exception-throw.out
+++ b/deps/v8/test/message/fail/wasm-exception-throw.out
@@ -1,4 +1,4 @@
-wasm-function[0]:3: RuntimeError: wasm exception
+wasm-function[0]:0x2e: RuntimeError: wasm exception
 RuntimeError: wasm exception
     at throw0 (wasm-function[0]:0x2e)
     at *%(basename)s:17:18
diff --git a/deps/v8/test/message/fail/wasm-function-name.out b/deps/v8/test/message/fail/wasm-function-name.out
index 19770670c2f2c0..3f4956a26e0d5e 100644
--- a/deps/v8/test/message/fail/wasm-function-name.out
+++ b/deps/v8/test/message/fail/wasm-function-name.out
@@ -1,5 +1,4 @@
-wasm-function[0]:1: RuntimeError: unreachable
+wasm-function[0]:0x22: RuntimeError: unreachable
 RuntimeError: unreachable
     at main (wasm-function[0]:0x22)
     at *%(basename)s:{NUMBER}:31
-
diff --git a/deps/v8/test/message/fail/wasm-module-and-function-name.out b/deps/v8/test/message/fail/wasm-module-and-function-name.out
index d77049d633ba63..1f25c57271dc72 100644
--- a/deps/v8/test/message/fail/wasm-module-and-function-name.out
+++ b/deps/v8/test/message/fail/wasm-module-and-function-name.out
@@ -1,4 +1,4 @@
-wasm-function[0]:1: RuntimeError: unreachable
+wasm-function[0]:0x22: RuntimeError: unreachable
 RuntimeError: unreachable
     at test-module.main (wasm-function[0]:0x22)
     at *%(basename)s:{NUMBER}:31
diff --git a/deps/v8/test/message/fail/wasm-module-name.out b/deps/v8/test/message/fail/wasm-module-name.out
index 5ed57721e464ae..763bec5592b6f4 100644
--- a/deps/v8/test/message/fail/wasm-module-name.out
+++ b/deps/v8/test/message/fail/wasm-module-name.out
@@ -1,5 +1,4 @@
-wasm-function[0]:1: RuntimeError: unreachable
+wasm-function[0]:0x22: RuntimeError: unreachable
 RuntimeError: unreachable
     at test-module (wasm-function[0]:0x22)
     at *%(basename)s:{NUMBER}:31
-
diff --git a/deps/v8/test/message/fail/wasm-no-name.out b/deps/v8/test/message/fail/wasm-no-name.out
index cc68ab0f8f52aa..37836cc49595a7 100644
--- a/deps/v8/test/message/fail/wasm-no-name.out
+++ b/deps/v8/test/message/fail/wasm-no-name.out
@@ -1,5 +1,4 @@
-wasm-function[0]:1: RuntimeError: unreachable
+wasm-function[0]:0x22: RuntimeError: unreachable
 RuntimeError: unreachable
     at wasm-function[0]:0x22
     at *%(basename)s:{NUMBER}:31
-
diff --git a/deps/v8/test/message/fail/wasm-trap.js b/deps/v8/test/message/fail/wasm-trap.js
index 6fdb582dd0cf12..3ccedeec1e82f2 100644
--- a/deps/v8/test/message/fail/wasm-trap.js
+++ b/deps/v8/test/message/fail/wasm-trap.js
@@ -7,6 +7,9 @@
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 var builder = new WasmModuleBuilder();
+// Add a dummy function to make the main function index 1.
+builder.addFunction('dummy', kSig_i_v)
+    .addBody([kExprI32Const, 0]);
 builder.addFunction('main', kSig_i_v)
     .addBody([kExprI32Const, 2, kExprI32Const, 0, kExprI32DivU])
     .exportFunc();
diff --git a/deps/v8/test/message/fail/wasm-trap.out b/deps/v8/test/message/fail/wasm-trap.out
index 7f72baee90bcce..66048388e4d820 100644
--- a/deps/v8/test/message/fail/wasm-trap.out
+++ b/deps/v8/test/message/fail/wasm-trap.out
@@ -1,5 +1,4 @@
-wasm-function[0]:5: RuntimeError: divide by zero
+wasm-function[1]:0x30: RuntimeError: divide by zero
 RuntimeError: divide by zero
-    at main (wasm-function[0]:0x26)
+    at main (wasm-function[1]:0x30)
     at *%(basename)s:{NUMBER}:16
-
diff --git a/deps/v8/test/message/message.status b/deps/v8/test/message/message.status
index 45f0347b4ca577..fd6f282ecca6e3 100644
--- a/deps/v8/test/message/message.status
+++ b/deps/v8/test/message/message.status
@@ -37,11 +37,11 @@
   'fail/modules-skip*': [SKIP],
 }],  # ALWAYS
 
-# Liftoff is currently only sufficiently implemented on x64 and ia32.
+# Liftoff is currently only sufficiently implemented on x64, ia32, arm, arm64.
 # TODO(clemensb): Implement on all other platforms (crbug.com/v8/6600).
-['arch != x64 and arch != ia32', {
+['arch != x64 and arch != ia32 and arch != arm64 and arch != arm', {
   'wasm-trace-memory-liftoff': [SKIP],
-}], # arch != x64 and arch != ia32
+}], # arch != x64 and arch != ia32 and arch != arm64 and arch != arm
 
 ['variant == code_serializer', {
   # TODO(yangguo): Code serializer output is incompatible with all message
@@ -64,9 +64,4 @@
   'asm-*': [SKIP],
 }], # lite_mode or variant == jitless
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-
 ]
diff --git a/deps/v8/test/message/wasm-trace-memory-liftoff.out b/deps/v8/test/message/wasm-trace-memory-liftoff.out
index cdd8e765d92f39..76364cdfaf679e 100644
--- a/deps/v8/test/message/wasm-trace-memory-liftoff.out
+++ b/deps/v8/test/message/wasm-trace-memory-liftoff.out
@@ -8,4 +8,4 @@ liftoff     func:     4+0x5      store to 00000004 val:  i8:171 / ab
 liftoff     func:     0+0x3     load from 00000002 val: i32:1454047232 / 56ab0000
 liftoff     func:     2+0x3     load from 00000002 val: f32:94008244174848.000000 / 56ab0000
 turbofan    func:     6+0x7      store to 00000004 val: s128:48879 48879 48879 48879 / 0000beef 0000beef 0000beef 0000beef
-turbofan    func:     5+0x3     load from 00000002 val: s128:-1091633152 -1091633152 -1091633152 -1091633152 / beef0000 beef0000 beef0000 beef0000
+liftoff     func:     5+0x3     load from 00000002 val: s128:-1091633152 -1091633152 -1091633152 -1091633152 / beef0000 beef0000 beef0000 beef0000
diff --git a/deps/v8/test/message/wasm-trace-memory.js b/deps/v8/test/message/wasm-trace-memory.js
index de2f1159e9ef10..4102dad6f0160f 100644
--- a/deps/v8/test/message/wasm-trace-memory.js
+++ b/deps/v8/test/message/wasm-trace-memory.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --no-stress-opt --trace-wasm-memory --no-liftoff --no-future
-// Flags: --no-wasm-tier-up --experimental-wasm-simd
+// Flags: --experimental-wasm-simd
 
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
diff --git a/deps/v8/test/mjsunit/asm/regress-1027595.js b/deps/v8/test/mjsunit/asm/regress-1027595.js
new file mode 100644
index 00000000000000..f194ab511f22eb
--- /dev/null
+++ b/deps/v8/test/mjsunit/asm/regress-1027595.js
@@ -0,0 +1,44 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestF32StoreConvertsF64ToF32() {
+  function Module(stdlib, foreign, heap) {
+    'use asm';
+    var f32 = new stdlib.Float32Array(heap);
+    function f(a) {
+      a = +a;
+      f32[0] = f32[1] = a;
+    }
+    return f;
+  }
+  var buffer = new ArrayBuffer(0x10000);
+  var f = Module(this, {}, buffer);
+  assertDoesNotThrow(() => f(23.42));
+  var view = new Float32Array(buffer);
+  assertEquals(Math.fround(23.42), view[0]);
+  assertEquals(Math.fround(23.42), view[1]);
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestF64StoreConvertsF32ToF64() {
+  function Module(stdlib, foreign, heap) {
+    'use asm';
+    var fround = stdlib.Math.fround;
+    var f64 = new stdlib.Float64Array(heap);
+    function f(a) {
+      a = fround(a);
+      f64[0] = f64[1] = a;
+    }
+    return f;
+  }
+  var buffer = new ArrayBuffer(0x10000);
+  var f = Module(this, {}, buffer);
+  assertDoesNotThrow(() => f(23.42));
+  var view = new Float64Array(buffer);
+  assertEquals(Math.fround(23.42), view[0]);
+  assertEquals(Math.fround(23.42), view[1]);
+  assertTrue(%IsAsmWasmCode(Module));
+})();
diff --git a/deps/v8/test/mjsunit/async-stack-traces.js b/deps/v8/test/mjsunit/async-stack-traces.js
index 2932cfc1da2473..e9b0bf7e3970ad 100644
--- a/deps/v8/test/mjsunit/async-stack-traces.js
+++ b/deps/v8/test/mjsunit/async-stack-traces.js
@@ -317,3 +317,40 @@
     await test(one);
   })());
 })();
+
+// Basic test for reject.
+(function() {
+  async function one(x) {
+    await two(x);
+  }
+
+  async function two(x) {
+    try {
+      await Promise.reject(new Error());
+      assertUnreachable();
+    } catch (e) {
+      throw new Error();
+    }
+  }
+
+  async function test(f) {
+    try {
+      await f(1);
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async () => {
+    %PrepareFunctionForOptimization(one);
+    %PrepareFunctionForOptimization(two);
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
diff --git a/deps/v8/test/mjsunit/check-bounds-array-index.js b/deps/v8/test/mjsunit/check-bounds-array-index.js
new file mode 100644
index 00000000000000..c5b849b8c0ad45
--- /dev/null
+++ b/deps/v8/test/mjsunit/check-bounds-array-index.js
@@ -0,0 +1,31 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+let arr = [1, 2, 3];
+
+function f(useArrayIndex) {
+  let index = useArrayIndex ? '1': '4294967296';
+  return arr[index];
+}
+
+%PrepareFunctionForOptimization(f);
+f(true);
+f(true);
+
+%OptimizeFunctionOnNextCall(f);
+f(false);
+assertUnoptimized(f);
+
+%PrepareFunctionForOptimization(f);
+f(true);
+f(true);
+
+%OptimizeFunctionOnNextCall(f);
+f(true);
+
+// no deopt here
+f(false);
+assertOptimized(f);
diff --git a/deps/v8/test/mjsunit/check-bounds-string-from-char-code-at.js b/deps/v8/test/mjsunit/check-bounds-string-from-char-code-at.js
new file mode 100644
index 00000000000000..3fc2cf17ac6acd
--- /dev/null
+++ b/deps/v8/test/mjsunit/check-bounds-string-from-char-code-at.js
@@ -0,0 +1,31 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+let string = "foobar";
+
+function f(useArrayIndex) {
+  let index = useArrayIndex ? '1': '4294967296';
+  return string.charCodeAt(index);
+}
+
+%PrepareFunctionForOptimization(f);
+f(true);
+f(true);
+
+%OptimizeFunctionOnNextCall(f);
+f(false);
+assertUnoptimized(f);
+
+%PrepareFunctionForOptimization(f);
+f(true);
+f(true);
+
+%OptimizeFunctionOnNextCall(f);
+f(true);
+
+// no deopt here
+f(false);
+assertOptimized(f);
diff --git a/deps/v8/test/mjsunit/collect-type-profile-undefined-feedback-vector.js b/deps/v8/test/mjsunit/collect-type-profile-undefined-feedback-vector.js
new file mode 100644
index 00000000000000..f78f241c74ed0f
--- /dev/null
+++ b/deps/v8/test/mjsunit/collect-type-profile-undefined-feedback-vector.js
@@ -0,0 +1,11 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, b, c) {
+  return 'bye';
+};
+
+%CollectTypeProfile(0, f, undefined);
diff --git a/deps/v8/test/mjsunit/compiler/bigint-int64-lowered.js b/deps/v8/test/mjsunit/compiler/bigint-int64-lowered.js
index abbfa8cfd05cae..52db368899b301 100644
--- a/deps/v8/test/mjsunit/compiler/bigint-int64-lowered.js
+++ b/deps/v8/test/mjsunit/compiler/bigint-int64-lowered.js
@@ -39,6 +39,10 @@ function TestInt64LoweredOperations() {
   assertEquals(14n, BigInt.asUintN(32, 8n + 6n));
   assertEquals(813n, BigInt.asUintN(10, 1013n + -200n));
   assertEquals(15n, BigInt.asUintN(4, -319n + 302n));
+  assertEquals(32n, BigInt.asUintN(64, (2n ** 100n + 64n) - 32n));
+  assertEquals(2n ** 64n - 32n, BigInt.asUintN(64, 32n - (2n ** 100n + 64n)));
+  assertEquals(11n, BigInt.asUintN(4, 800n - 789n));
+  assertEquals(5n, BigInt.asUintN(4, 789n - 800n));
 
   for (let i = 0; i < 2; ++i) {
     let x = 32n; // x = 32n
@@ -46,7 +50,7 @@ function TestInt64LoweredOperations() {
       x = BigInt.asUintN(64, x + 3n); // x = 35n
       const y = x + -8n + x; // x = 35n, y = 62n
       x = BigInt.asUintN(6, y + x); // x = 33n, y = 62n
-      x = -9n + y + -x; // x = 20n
+      x = -9n + y - x; // x = 20n
       x = BigInt.asUintN(10000 * i, x); // x = 20n
     } else {
       x = x + 400n; // x = 432n
@@ -71,6 +75,7 @@ function TestInt64LoweredOperations() {
 function OptimizeAndTest(fn) {
   %PrepareFunctionForOptimization(fn);
   %PrepareFunctionForOptimization(assertEquals);
+  %PrepareFunctionForOptimization(deepEquals);
   fn();
   fn();
   %OptimizeFunctionOnNextCall(fn);
diff --git a/deps/v8/test/mjsunit/compiler/bound-functions-serialize.js b/deps/v8/test/mjsunit/compiler/bound-functions-serialize.js
new file mode 100644
index 00000000000000..319c9aa738c431
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/bound-functions-serialize.js
@@ -0,0 +1,31 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --concurrent-inlining
+// Flags: --opt --noalways-opt --noturboprop
+class C {};
+const c = new C;
+const getPrototypeOf = Object.getPrototypeOf;
+
+function bar(f) {
+  return f();
+}
+function foo() {
+  return bar(getPrototypeOf.bind(undefined, c));
+}
+
+%PrepareFunctionForOptimization(foo);
+%PrepareFunctionForOptimization(bar);
+bar(function() {});
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+assertOptimized(foo);
+
+c.prop = 42;
+// Assert that the call reducer optimized the call to Object.getPrototypeOf
+// by asserting that foo gets deopted when c's previous map becomes
+// unstable.
+foo();
+assertUnoptimized(foo);
diff --git a/deps/v8/test/mjsunit/compiler/catch-block-load.js b/deps/v8/test/mjsunit/compiler/catch-block-load.js
new file mode 100644
index 00000000000000..c753b2aaa06c39
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/catch-block-load.js
@@ -0,0 +1,67 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const obj = { a: 42 };
+
+function boom() {
+  throw "boom";
+}
+
+// Ensure that we optimize the monomorphic case.
+(function() {
+  function bar(x) {
+    try {
+      boom();
+      ++i;
+    } catch(_) {
+      %TurbofanStaticAssert(x.a == 42);
+      return x.a;
+    }
+  }
+
+  function foo() {
+    return bar(obj);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  %PrepareFunctionForOptimization(bar);
+
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+// And the megamorphic case.
+(function() {
+  function bar(x) {
+    try {
+      boom();
+      ++i;
+    } catch(_) {
+      %TurbofanStaticAssert(x.a == 42);
+      return x.a;
+    }
+  }
+
+  function foo() {
+    return bar(obj);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  %PrepareFunctionForOptimization(bar);
+
+  bar({b: 42});
+  bar({c: 42});
+  bar({d: 42});
+  bar({e: 42});
+  bar({f: 42});
+
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
diff --git a/deps/v8/test/mjsunit/compiler/construct-bound-function.js b/deps/v8/test/mjsunit/compiler/construct-bound-function.js
new file mode 100644
index 00000000000000..94abd80cfb5c8d
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/construct-bound-function.js
@@ -0,0 +1,34 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+class C extends Object {
+  bla() {}
+}
+
+const bla = C.prototype.bla;
+
+function bar(c) {
+  %TurbofanStaticAssert(c.bla === bla);
+}
+
+const boundC = C.bind(null);
+function foo() {
+  let c = new boundC();
+  bar(c);
+}
+%PrepareFunctionForOptimization(foo);
+%PrepareFunctionForOptimization(bar);
+%PrepareFunctionForOptimization(C);
+bar({});
+bar({a:1});
+bar({aa:1});
+bar({aaa:1});
+bar({aaaa:1});
+bar({aaaaa:1});
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/compiler/construct-object.js b/deps/v8/test/mjsunit/compiler/construct-object.js
new file mode 100644
index 00000000000000..f074781bfc2200
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/construct-object.js
@@ -0,0 +1,30 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+Object.prototype.bla = function() {}
+
+const bla = Object.prototype.bla;
+
+function bar(c) {
+  %TurbofanStaticAssert(c.bla === bla);
+}
+
+function foo() {
+  var c = new Object();
+  bar(c);
+}
+%PrepareFunctionForOptimization(foo);
+%PrepareFunctionForOptimization(bar);
+bar({});
+bar({a:1});
+bar({aa:1});
+bar({aaa:1});
+bar({aaaa:1});
+bar({aaaaa:1});
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/compiler/construct-receiver.js b/deps/v8/test/mjsunit/compiler/construct-receiver.js
new file mode 100644
index 00000000000000..e030745a255715
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/construct-receiver.js
@@ -0,0 +1,29 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class C {
+  bla() {};
+  constructor() { %TurbofanStaticAssert(this.bla === bla); }
+}
+const bla = C.prototype.bla;
+function bar(f) { return new f; }
+var CC = C;
+function foo() { return bar(CC); }
+
+%PrepareFunctionForOptimization(C);
+%PrepareFunctionForOptimization(bla);
+%PrepareFunctionForOptimization(foo);
+%PrepareFunctionForOptimization(bar);
+
+// Make {this.bla} in C megamorphic
+new class extends C { constructor() { super(); this.a = 1 } }
+new class extends C { constructor() { super(); this.b = 1 } }
+new class extends C { constructor() { super(); this.c = 1 } }
+new class extends C { constructor() { super(); this.d = 1 } }
+
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/compiler/deopt-array-builtins.js b/deps/v8/test/mjsunit/compiler/deopt-array-builtins.js
index 68158e05e3fdef..3f32293d3bb418 100644
--- a/deps/v8/test/mjsunit/compiler/deopt-array-builtins.js
+++ b/deps/v8/test/mjsunit/compiler/deopt-array-builtins.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-flush-bytecode --no-stress-flush-bytecode
 
 /* Test MapCheck behavior */
 
diff --git a/deps/v8/test/mjsunit/compiler/inline-accessors2.js b/deps/v8/test/mjsunit/compiler/inline-accessors2.js
index c13cf83e5d0baf..01b2e4018a9921 100644
--- a/deps/v8/test/mjsunit/compiler/inline-accessors2.js
+++ b/deps/v8/test/mjsunit/compiler/inline-accessors2.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --inline-accessors
+// Flags: --allow-natives-syntax
 
 var accessorCallCount, setterArgument, setterValue, obj, forceDeopt;
 
diff --git a/deps/v8/test/mjsunit/compiler/is-being-interpreted-1.js b/deps/v8/test/mjsunit/compiler/is-being-interpreted-1.js
new file mode 100644
index 00000000000000..cc93eede862476
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/is-being-interpreted-1.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+
+function bar() { return foo(); }
+function foo() { return %IsBeingInterpreted(); }
+
+%PrepareFunctionForOptimization(bar);
+%PrepareFunctionForOptimization(foo);
+
+assertTrue(bar());
+assertTrue(bar());
+%OptimizeFunctionOnNextCall(bar);
+assertFalse(bar());
diff --git a/deps/v8/test/mjsunit/compiler/is-being-interpreted-2.js b/deps/v8/test/mjsunit/compiler/is-being-interpreted-2.js
new file mode 100644
index 00000000000000..9d996eb94a65c9
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/is-being-interpreted-2.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-turbo-inlining --opt --no-always-opt
+
+
+function bar() { return foo(); }
+function foo() { return %IsBeingInterpreted(); }
+
+%PrepareFunctionForOptimization(bar);
+%PrepareFunctionForOptimization(foo);
+
+assertTrue(bar());
+assertTrue(bar());
+%OptimizeFunctionOnNextCall(bar);
+assertTrue(bar());
diff --git a/deps/v8/test/mjsunit/compiler/js-create-arguments.js b/deps/v8/test/mjsunit/compiler/js-create-arguments.js
new file mode 100644
index 00000000000000..e37ac06a5588a7
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/js-create-arguments.js
@@ -0,0 +1,41 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+class C extends Object {
+  bla() {}
+}
+
+const bla = C.prototype.bla;
+
+function bar(c) {
+  %TurbofanStaticAssert(c.bla === bla);
+}
+
+function foo() {
+  let c = new C(...arguments);
+  bar(c);
+}
+
+%PrepareFunctionForOptimization(bar);
+%PrepareFunctionForOptimization(C);
+%PrepareFunctionForOptimization(main);
+%PrepareFunctionForOptimization(foo);
+
+bar({});
+bar({a:1});
+bar({aa:1});
+bar({aaa:1});
+bar({aaaa:1});
+bar({aaaaa:1});
+
+function main() {
+  return foo(1,2,3);
+};
+
+main();
+main();
+%OptimizeFunctionOnNextCall(main);
+main();
diff --git a/deps/v8/test/mjsunit/compiler/js-create.js b/deps/v8/test/mjsunit/compiler/js-create.js
new file mode 100644
index 00000000000000..6ddc1d164cebe2
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/js-create.js
@@ -0,0 +1,33 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+class C extends Object {
+  bla() {}
+}
+
+const bla = C.prototype.bla;
+
+function bar(c) {
+  %TurbofanStaticAssert(c.bla === bla);
+}
+
+function foo() {
+  var c = new C();
+  bar(c);
+}
+%PrepareFunctionForOptimization(foo);
+%PrepareFunctionForOptimization(bar);
+%PrepareFunctionForOptimization(C);
+bar({});
+bar({a:1});
+bar({aa:1});
+bar({aaa:1});
+bar({aaaa:1});
+bar({aaaaa:1});
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/compiler/number-comparison-truncations.js b/deps/v8/test/mjsunit/compiler/number-comparison-truncations.js
index f0df98a0cdc856..a056d5a0266c72 100644
--- a/deps/v8/test/mjsunit/compiler/number-comparison-truncations.js
+++ b/deps/v8/test/mjsunit/compiler/number-comparison-truncations.js
@@ -31,13 +31,8 @@
 // kIdentifyZeros truncation.
 (function() {
   // Produce a SpeculativeNumberEqual with Number feedback.
-  function bar(x, y) { return x === y; }
-  %EnsureFeedbackVectorForFunction(bar);
-  bar(0.1, 0.5);
-  bar(-0, 100);
-
   function foo(x, y) {
-    if (bar(x * y, 0)) return 0;
+    if (x * y === -0) return 0;
     return 1;
   }
 
@@ -83,13 +78,8 @@
 // kIdentifyZeros truncation.
 (function() {
   // Produce a SpeculativeNumberLessThan with Number feedback.
-  function bar(x, y) { return x < y; }
-  %EnsureFeedbackVectorForFunction(bar);
-  bar(0.1, 0.5);
-  bar(-0, 100);
-
   function foo(x, y) {
-    if (bar(x * y, 0)) return 0;
+    if (x * y < -0) return 0;
     return 1;
   }
 
@@ -135,13 +125,8 @@
 // kIdentifyZeros truncation.
 (function() {
   // Produce a SpeculativeNumberLessThanOrEqual with Number feedback.
-  function bar(x, y) { return x <= y; }
-  %EnsureFeedbackVectorForFunction(bar);
-  bar(0.1, 0.5);
-  bar(-0, 100);
-
   function foo(x, y) {
-    if (bar(x * y, 0)) return 0;
+    if (x * y <= -0) return 0;
     return 1;
   }
 
diff --git a/deps/v8/test/mjsunit/compiler/opt-higher-order-functions.js b/deps/v8/test/mjsunit/compiler/opt-higher-order-functions.js
new file mode 100644
index 00000000000000..3fdcabe504f11a
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/opt-higher-order-functions.js
@@ -0,0 +1,250 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+"use strict";
+const mathAbs = Math.abs;
+const mathImul = Math.imul;
+
+
+// Testing: FunctionPrototypeApply
+function TestFunctionPrototypeApplyHelper() {
+  return mathAbs.apply(undefined, arguments);
+}
+
+function TestFunctionPrototypeApply(x) {
+  return TestFunctionPrototypeApplyHelper(x);
+}
+
+%PrepareFunctionForOptimization(TestFunctionPrototypeApplyHelper);
+%PrepareFunctionForOptimization(TestFunctionPrototypeApply);
+assertEquals(TestFunctionPrototypeApply(-13), 13);
+assertEquals(TestFunctionPrototypeApply(42), 42);
+%OptimizeFunctionOnNextCall(TestFunctionPrototypeApply);
+assertEquals(TestFunctionPrototypeApply(-13), 13);
+assertOptimized(TestFunctionPrototypeApply);
+TestFunctionPrototypeApply("abc");
+assertUnoptimized(TestFunctionPrototypeApply);
+
+
+// Testing: FunctionPrototypeCall
+function TestFunctionPrototypeCall(x) {
+  return mathAbs.call(undefined, x);
+}
+
+%PrepareFunctionForOptimization(TestFunctionPrototypeCall);
+TestFunctionPrototypeCall(42);
+TestFunctionPrototypeCall(52);
+%OptimizeFunctionOnNextCall(TestFunctionPrototypeCall);
+TestFunctionPrototypeCall(12);
+assertOptimized(TestFunctionPrototypeCall);
+TestFunctionPrototypeCall("abc");
+assertUnoptimized(TestFunctionPrototypeCall);
+
+
+// Testing: ArrayForEach
+function TestArrayForEach(x) {
+  x.forEach(mathAbs);
+}
+
+%PrepareFunctionForOptimization(TestArrayForEach);
+TestArrayForEach([1, 3, -4]);
+TestArrayForEach([-9, 9, 0]);
+%OptimizeFunctionOnNextCall(TestArrayForEach);
+TestArrayForEach([1, 3, -4]);
+assertOptimized(TestArrayForEach);
+TestArrayForEach(["abc", "xy"]);
+assertUnoptimized(TestArrayForEach);
+
+
+// Testing: ArrayReduce
+function TestArrayReduce(x) {
+  return x.reduce(mathImul);
+}
+
+%PrepareFunctionForOptimization(TestArrayReduce);
+assertEquals(TestArrayReduce([1, 2, -3, 4]), -24);
+assertEquals(TestArrayReduce([3, 5, 7]), 105);
+%OptimizeFunctionOnNextCall(TestArrayReduce);
+assertEquals(TestArrayReduce([1, 2, -3, 4]), -24);
+assertOptimized(TestArrayReduce);
+TestArrayReduce(["abc", "xy"]);
+assertUnoptimized(TestArrayReduce);
+
+
+// Testing: ArrayReduceRight
+function TestArrayReduceRight(x) {
+  return x.reduceRight(mathImul);
+}
+
+%PrepareFunctionForOptimization(TestArrayReduceRight);
+assertEquals(TestArrayReduceRight([1, 2, -3, 4]), -24);
+assertEquals(TestArrayReduceRight([3, 5, 7]), 105);
+%OptimizeFunctionOnNextCall(TestArrayReduceRight);
+assertEquals(TestArrayReduceRight([1, 2, -3, 4]), -24);
+assertOptimized(TestArrayReduceRight);
+TestArrayReduceRight(["abc", "xy"]);
+assertUnoptimized(TestArrayReduceRight);
+
+
+// Testing: ArrayMap
+function TestArrayMap(x) {
+  return x.map(mathAbs);
+}
+
+%PrepareFunctionForOptimization(TestArrayMap);
+assertEquals(TestArrayMap([1, -2, -3, 4]), [1, 2, 3, 4]);
+assertEquals(TestArrayMap([5, -5, 5, -5]), [5, 5, 5, 5]);
+%OptimizeFunctionOnNextCall(TestArrayMap);
+assertEquals(TestArrayMap([1, -2, 3, -4]), [1, 2, 3, 4]);
+assertOptimized(TestArrayMap);
+TestArrayMap(["abc", "xy"]);
+assertUnoptimized(TestArrayMap);
+
+
+// Testing: ArrayFilter
+function TestArrayFilter(x) {
+  return x.filter(mathAbs);
+}
+
+%PrepareFunctionForOptimization(TestArrayFilter);
+assertEquals(TestArrayFilter([-2, 0, 3, -4]), [-2, 3, -4]);
+assertEquals(TestArrayFilter([0, 1, 1, 0]), [1, 1]);
+%OptimizeFunctionOnNextCall(TestArrayFilter);
+assertEquals(TestArrayFilter([-2, 0, 3, -4]), [-2, 3, -4]);
+assertOptimized(TestArrayFilter);
+TestArrayFilter(["abc", "xy"]);
+assertUnoptimized(TestArrayFilter);
+
+
+// Testing: ArrayFind
+function TestArrayFind(x) {
+  return x.find(mathAbs);
+}
+
+%PrepareFunctionForOptimization(TestArrayFind);
+assertEquals(TestArrayFind([0, 0, -3, 12]), -3);
+assertEquals(TestArrayFind([0, -18]), -18);
+%OptimizeFunctionOnNextCall(TestArrayFind);
+assertEquals(TestArrayFind([0, 0, -3, 12]), -3);
+assertOptimized(TestArrayFind);
+TestArrayFind(["", "abc", "xy"]);
+assertUnoptimized(TestArrayFind);
+
+
+// Testing: ArrayFindIndex
+function TestArrayFindIndex(x) {
+  return x.findIndex(mathAbs);
+}
+
+%PrepareFunctionForOptimization(TestArrayFindIndex);
+assertEquals(TestArrayFindIndex([0, 0, -3, 12]), 2);
+assertEquals(TestArrayFindIndex([0, -18]), 1);
+%OptimizeFunctionOnNextCall(TestArrayFindIndex);
+assertEquals(TestArrayFindIndex([0, 0, -3, 12]), 2);
+assertOptimized(TestArrayFindIndex);
+TestArrayFindIndex(["", "abc", "xy"]);
+assertUnoptimized(TestArrayFindIndex);
+
+
+// Testing: ArrayEvery
+function TestArrayEvery(x) {
+  return x.every(mathAbs);
+}
+
+%PrepareFunctionForOptimization(TestArrayEvery);
+assertEquals(TestArrayEvery([3, 0, -9]), false);
+assertEquals(TestArrayEvery([2, 12, -1]), true);
+%OptimizeFunctionOnNextCall(TestArrayEvery);
+assertEquals(TestArrayEvery([3, 0, -9]), false);
+assertOptimized(TestArrayEvery);
+TestArrayEvery(["abc", "xy"]);
+assertUnoptimized(TestArrayEvery);
+
+
+// Testing: ArraySome
+function TestArraySome(x) {
+  return x.some(mathAbs);
+}
+
+%PrepareFunctionForOptimization(TestArraySome);
+assertEquals(TestArraySome([3, 0, -9]), true);
+assertEquals(TestArraySome([0, 0]), false);
+%OptimizeFunctionOnNextCall(TestArraySome);
+assertEquals(TestArraySome([3, 0, -9]), true);
+assertOptimized(TestArraySome);
+TestArraySome(["abc", "xy"]);
+assertUnoptimized(TestArraySome);
+
+
+// Testing: JSCall (JSFunction)
+const boundMathImul = mathImul.bind(undefined, -3);
+function TestJSCallWithJSFunction(x) {
+  return boundMathImul(x);
+}
+
+%PrepareFunctionForOptimization(TestJSCallWithJSFunction);
+assertEquals(TestJSCallWithJSFunction(-14), 42);
+assertEquals(TestJSCallWithJSFunction(14), -42);
+%OptimizeFunctionOnNextCall(TestJSCallWithJSFunction);
+assertEquals(TestJSCallWithJSFunction(-14), 42);
+assertOptimized(TestJSCallWithJSFunction);
+TestJSCallWithJSFunction("abc");
+assertUnoptimized(TestJSCallWithJSFunction);
+
+
+// Testing: JSCall (JSBoundFunction)
+function TestJSCallWithJSBoundFunction(x) {
+  return mathImul.bind(undefined, -3)(x);
+}
+
+%PrepareFunctionForOptimization(TestJSCallWithJSBoundFunction);
+assertEquals(TestJSCallWithJSBoundFunction(-14), 42);
+assertEquals(TestJSCallWithJSBoundFunction(14), -42);
+%OptimizeFunctionOnNextCall(TestJSCallWithJSBoundFunction);
+assertEquals(TestJSCallWithJSBoundFunction(-14), 42);
+assertOptimized(TestJSCallWithJSBoundFunction);
+TestJSCallWithJSBoundFunction("abc");
+assertUnoptimized(TestJSCallWithJSBoundFunction);
+
+
+// Testing: ReflectApply
+function TestReflectApplyHelper() {
+  return Reflect.apply(mathAbs, undefined, arguments);
+}
+
+function TestReflectApply(x) {
+  return TestReflectApplyHelper(x);
+}
+
+%PrepareFunctionForOptimization(TestReflectApplyHelper);
+%PrepareFunctionForOptimization(TestReflectApply);
+assertEquals(TestReflectApply(-9), 9);
+assertEquals(TestReflectApply(7), 7);
+%OptimizeFunctionOnNextCall(TestReflectApply);
+assertEquals(TestReflectApply(-9), 9);
+assertOptimized(TestReflectApply);
+TestReflectApply("abc");
+assertUnoptimized(TestReflectApply);
+
+
+// Testing: CallWithSpread
+function TestCallWithSpreadHelper() {
+  return mathImul(...arguments);
+}
+
+function TestCallWithSpread(x) {
+  return TestCallWithSpreadHelper(x, x);
+}
+
+%PrepareFunctionForOptimization(TestCallWithSpreadHelper);
+%PrepareFunctionForOptimization(TestCallWithSpread);
+assertEquals(TestCallWithSpread(-13), 169);
+assertEquals(TestCallWithSpread(7), 49);
+%OptimizeFunctionOnNextCall(TestCallWithSpread);
+assertEquals(TestCallWithSpread(-13), 169);
+assertOptimized(TestCallWithSpread);
+TestCallWithSpread("abc");
+assertUnoptimized(TestCallWithSpread);
diff --git a/deps/v8/test/mjsunit/compiler/regress-1024936.js b/deps/v8/test/mjsunit/compiler/regress-1024936.js
new file mode 100644
index 00000000000000..dc309fd92dd351
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1024936.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Object.defineProperty(Number.prototype, "v", { get: constructor });
+function get_v(num) {
+  return num.v;
+}
+
+let n = new Number(42);
+%PrepareFunctionForOptimization(get_v);
+get_v(n);
+get_v(n);
+%OptimizeFunctionOnNextCall(get_v);
+get_v(n);
diff --git a/deps/v8/test/mjsunit/compiler/regress-1028208.js b/deps/v8/test/mjsunit/compiler/regress-1028208.js
new file mode 100644
index 00000000000000..7a79ff53c53851
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1028208.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-use-ic --interrupt-budget=100 --always-osr
+
+const num_iterations = 1000;
+let i = 0;
+const re = /foo.bar/;
+const RegExpPrototypeExec = RegExp.prototype.exec;
+re.exec = function gaga(str) {
+    return (i++ < num_iterations) ? RegExpPrototypeExec.call(re, str) : null;
+};
+re.__defineGetter__("global", () => true);
+"foo*bar".match(re);
diff --git a/deps/v8/test/mjsunit/compiler/regress-1028862.js b/deps/v8/test/mjsunit/compiler/regress-1028862.js
new file mode 100644
index 00000000000000..1b6177901ecae8
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1028862.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  for (let i = 0; i < 5; i++) {
+    // Only allocate feedback vector after the first round so that we get Smi
+    // feedback for the modulus operation.
+    if (i == 1) %PrepareFunctionForOptimization(foo);
+    1 == new Date(42).getMilliseconds() % i;
+  }
+}
+
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/compiler/regress-1034768 b/deps/v8/test/mjsunit/compiler/regress-1034768
new file mode 100644
index 00000000000000..36ecb94eea8f19
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1034768
@@ -0,0 +1,24 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --max-serializer-nesting=4
+function f1() {
+  return 1;
+}
+
+function f2() { return f1(); }
+function f3() { return f2(); }
+function f4() { return f3(); }
+function f5() { return f4(); }
+
+%PrepareFunctionForOptimization(f1);
+%PrepareFunctionForOptimization(f2);
+%PrepareFunctionForOptimization(f3);
+%PrepareFunctionForOptimization(f4);
+%PrepareFunctionForOptimization(f5);
+
+f5();
+f5();
+%OptimizeFunctionOnNextCall(f5);
+f5();
diff --git a/deps/v8/test/mjsunit/compiler/regress-1037771.js b/deps/v8/test/mjsunit/compiler/regress-1037771.js
new file mode 100644
index 00000000000000..86785a1d22d703
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1037771.js
@@ -0,0 +1,30 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --interrupt-budget=1024
+
+async function* r() {
+  for (var l = "" in { goo: ()=>{} }) {
+    for (let n = 0; n < 500; (t ? -500 : 0)) {
+      n++;
+      if (n > 1) break;
+      try {
+        r.blabadfasdfasdfsdafsdsadf();
+      } catch (e) {
+        for (let n = 0; n < 500; n++);
+        for (let n in t) {
+          return t[n];
+        }
+      }
+      try { r(n, null) } catch (e) {}
+    }
+  }
+}
+let t = r();
+t.return({
+  get then() {
+    let n = r();
+    n.next();
+  }
+});
diff --git a/deps/v8/test/mjsunit/compiler/regress-1051017.js b/deps/v8/test/mjsunit/compiler/regress-1051017.js
new file mode 100644
index 00000000000000..142b563f9eda1d
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1051017.js
@@ -0,0 +1,48 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+function foo1() {
+  var x = -Infinity;
+  var i = 0;
+  for (; i < 1; i += x) {
+    if (i == -Infinity) x = +Infinity;
+  }
+  return i;
+}
+
+%PrepareFunctionForOptimization(foo1);
+assertEquals(NaN, foo1());
+assertEquals(NaN, foo1());
+%OptimizeFunctionOnNextCall(foo1);
+assertEquals(NaN, foo1());
+
+
+function foo2() {
+  var i = -Infinity;
+  for (; i <= 42; i += Infinity) { }
+  return i;
+}
+
+%PrepareFunctionForOptimization(foo2);
+assertEquals(NaN, foo2());
+assertEquals(NaN, foo2());
+%OptimizeFunctionOnNextCall(foo2);
+assertEquals(NaN, foo2());
+
+
+function foo3(b) {
+  var k = 0;
+  let str = b ? "42" : "0";
+  for (var i = str; i < 1 && k++ < 1; i -= 0) { }
+  return i;
+}
+
+%PrepareFunctionForOptimization(foo3);
+assertEquals(0, foo3());
+assertEquals(0, foo3());
+%OptimizeFunctionOnNextCall(foo3);
+assertEquals(0, foo3());
diff --git a/deps/v8/test/mjsunit/compiler/regress-1053604.js b/deps/v8/test/mjsunit/compiler/regress-1053604.js
new file mode 100644
index 00000000000000..ef87fbe31643c7
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1053604.js
@@ -0,0 +1,30 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let a = [0, 1, 2, 3, 4];
+
+function empty() {}
+
+function f(p) {
+  a.pop(Reflect.construct(empty, arguments, p));
+}
+
+let p = new Proxy(Object, {
+    get: () => (a[0] = 1.1, Object.prototype)
+});
+
+function main(p) {
+  f(p);
+}
+
+%PrepareFunctionForOptimization(empty);
+%PrepareFunctionForOptimization(f);
+%PrepareFunctionForOptimization(main);
+
+main(empty);
+main(empty);
+%OptimizeFunctionOnNextCall(main);
+main(p);
diff --git a/deps/v8/test/mjsunit/compiler/regress-9945-1.js b/deps/v8/test/mjsunit/compiler/regress-9945-1.js
new file mode 100644
index 00000000000000..46ef6aa42ed7e7
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-9945-1.js
@@ -0,0 +1,66 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+// Flags: --concurrent-recompilation --block-concurrent-recompilation
+
+function foo(x) { bar(x) }
+function bar(x) { x.p }
+
+%PrepareFunctionForOptimization(foo);
+%PrepareFunctionForOptimization(bar);
+
+// Create map transitions such that a's final map is not stable.
+var dummy = [];
+dummy.p = 0;
+dummy.q = 0;
+
+var a = [];
+a.p = 42;
+
+var b = [];
+b.p = 42;
+
+// Warm-up.
+foo(a);
+foo(a);
+
+// Trigger optimization of bar but don't yet complete it.
+%OptimizeFunctionOnNextCall(bar, "concurrent");
+foo(a);
+%PrepareFunctionForOptimization(bar);
+
+// Change a's map from PACKED_SMI_ELEMENTS to PACKED_ELEMENTS and run bar in the
+// interpreter (via foo) s.t. bar's load feedback changes accordingly.
+a[0] = {};
+foo(a);
+assertUnoptimized(bar, "no sync");
+
+// Now finish the optimization of bar, which was based on the old
+// PACKED_SMI_ELEMENTS feedback.
+%UnblockConcurrentRecompilation();
+assertOptimized(bar);
+// If we were to call the optimized bar now, it would deopt.
+
+// Instead we trigger optimization of foo, which will inline bar (this time
+// based on the new PACKED_ELEMENTS map.
+%OptimizeFunctionOnNextCall(foo);
+foo(a);
+assertOptimized(foo);
+%PrepareFunctionForOptimization(foo);
+assertOptimized(bar);
+
+// Now call the optimized foo on an object that has the old PACKED_SMI_ELEMENTS
+// map. This will lead to an eager deopt of foo when the inlined bar sees that
+// old map.
+foo(b);
+assertUnoptimized(foo);
+assertOptimized(bar);
+
+// Now ensure there is no deopt-loop. There used to be a deopt-loop because, as
+// a result of over-eager checkpoint elimination, we used to deopt into foo
+// (right before the call to bar) rather than into bar (right before the load).
+%OptimizeFunctionOnNextCall(foo);
+foo(b);
+assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/compiler/regress-9945-2.js b/deps/v8/test/mjsunit/compiler/regress-9945-2.js
new file mode 100644
index 00000000000000..005553a3ee8698
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-9945-2.js
@@ -0,0 +1,71 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+////////////////////////////////////////////////////////////////////////////////
+// This is a variant of regress-99540-1.js that does not rely on concurrent
+// recompilation.
+////////////////////////////////////////////////////////////////////////////////
+
+function mkbar() { return function(x) { x.p } }
+var bar = mkbar();
+function foo(x) { bar(x) }
+
+%PrepareFunctionForOptimization(foo);
+%PrepareFunctionForOptimization(bar);
+%PrepareFunctionForOptimization(mkbar);
+
+// Create map transitions such that a's final map is not stable.
+var dummy = [];
+dummy.p = 0;
+dummy.q = 0;
+
+var a = [];
+a.p = 42;
+
+var b = [];
+b.p = 42;
+
+// Warm-up.
+foo(a);
+foo(a);
+
+// Trigger optimization of bar, based on PACKED_SMI_ELEMENTS feedback.
+%OptimizeFunctionOnNextCall(bar);
+bar(a);
+assertOptimized(bar);
+%PrepareFunctionForOptimization(bar);
+
+// Change a's map from PACKED_SMI_ELEMENTS to PACKED_ELEMENTS and run new
+// instance of mkbar() in the interpreter s.t. bar's load feedback changes
+// accordingly (thanks to feedback vector sharing).
+a[0] = {};
+mkbar()(a);
+assertOptimized(bar);
+// If we were to call the optimized bar now, it would deopt.
+
+// Instead we trigger optimization of foo, which will inline bar (this time
+// based on the new PACKED_ELEMENTS map.
+assertOptimized(bar);
+%OptimizeFunctionOnNextCall(foo);
+assertOptimized(bar);
+foo(a);
+assertOptimized(bar);
+assertOptimized(foo);
+%PrepareFunctionForOptimization(foo);
+
+// Now call the optimized foo on an object that has the old PACKED_SMI_ELEMENTS
+// map. This will lead to an eager deopt of foo when the inlined bar sees that
+// old map.
+foo(b);
+assertUnoptimized(foo);
+assertOptimized(bar);
+
+// Now ensure there is no deopt-loop. There used to be a deopt-loop because, as
+// a result of over-eager checkpoint elimination, we used to deopt into foo
+// (right before the call to bar) rather than into bar (right before the load).
+%OptimizeFunctionOnNextCall(foo);
+foo(b);
+assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/compiler/regress-bound-functions.js b/deps/v8/test/mjsunit/compiler/regress-bound-functions.js
new file mode 100644
index 00000000000000..e06bc9f3d4c1d7
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-bound-functions.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  return Array.prototype.sort.bind([]);
+}
+
+function bar() {
+  return foo();
+}
+
+%PrepareFunctionForOptimization(foo);
+%PrepareFunctionForOptimization(bar);
+bar();
+bar();
+%OptimizeFunctionOnNextCall(bar);
+bar();
diff --git a/deps/v8/test/mjsunit/compiler/serializer-accessors.js b/deps/v8/test/mjsunit/compiler/serializer-accessors.js
new file mode 100644
index 00000000000000..da5b426c0138c2
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/serializer-accessors.js
@@ -0,0 +1,37 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+var expect_interpreted = true;
+
+class C {
+  get prop() {
+    return 42;
+  }
+  set prop(v) {
+    assertEquals(expect_interpreted, %IsBeingInterpreted());
+    %TurbofanStaticAssert(v === 43);
+  }
+}
+
+const c = new C();
+
+function foo() {
+  assertEquals(expect_interpreted, %IsBeingInterpreted());
+  %TurbofanStaticAssert(c.prop === 42);
+  c.prop = 43;
+}
+
+%PrepareFunctionForOptimization(
+    Object.getOwnPropertyDescriptor(C.prototype, 'prop').get);
+%PrepareFunctionForOptimization(
+    Object.getOwnPropertyDescriptor(C.prototype, 'prop').set);
+%PrepareFunctionForOptimization(foo);
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+expect_interpreted = false;
+foo();
diff --git a/deps/v8/test/mjsunit/compiler/serializer-apply.js b/deps/v8/test/mjsunit/compiler/serializer-apply.js
new file mode 100644
index 00000000000000..20154b09ba8fc9
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/serializer-apply.js
@@ -0,0 +1,27 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+function apply(arg) {
+  "use strict";
+  return arg.apply(this, arguments);
+}
+
+function bar() {
+  function foo(self, arg) {
+    %TurbofanStaticAssert(arg === 42);
+    return %IsBeingInterpreted();
+  }
+  %PrepareFunctionForOptimization(foo);
+
+  return apply(foo, 42);
+}
+
+%PrepareFunctionForOptimization(bar);
+%PrepareFunctionForOptimization(apply);
+assertTrue(bar());
+assertTrue(bar());
+%OptimizeFunctionOnNextCall(bar);
+assertFalse(bar());
diff --git a/deps/v8/test/mjsunit/compiler/serializer-call.js b/deps/v8/test/mjsunit/compiler/serializer-call.js
new file mode 100644
index 00000000000000..d4299a68801cb0
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/serializer-call.js
@@ -0,0 +1,27 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+function call(cb) {
+  return cb.call(this, 42);
+}
+
+function bar() {
+  function foo(arg) {
+    %TurbofanStaticAssert(arg === 42);
+    return %IsBeingInterpreted();
+  }
+  %PrepareFunctionForOptimization(foo);
+
+  return call(foo);
+}
+
+
+%PrepareFunctionForOptimization(bar);
+%PrepareFunctionForOptimization(call);
+assertTrue(bar());
+assertTrue(bar());
+%OptimizeFunctionOnNextCall(bar);
+assertFalse(bar());
diff --git a/deps/v8/test/mjsunit/compiler/serializer-dead-after-jump.js b/deps/v8/test/mjsunit/compiler/serializer-dead-after-jump.js
new file mode 100644
index 00000000000000..5f47d4174b5350
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/serializer-dead-after-jump.js
@@ -0,0 +1,37 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+function f(x) {
+  %TurbofanStaticAssert(x.foo === 42);
+  return %IsBeingInterpreted();
+}
+
+function main(b, ret) {
+  const x = new Object();
+  const y = x;
+  if (b) {
+    return ret;
+  } else {
+    x.foo = 42;
+    return f(y);
+  }
+}
+
+
+%PrepareFunctionForOptimization(f);
+%PrepareFunctionForOptimization(main);
+
+f({a: 1});
+f({b: 1});
+f({c: 1});
+f({d: 1});
+
+assertTrue(main(true, true));
+assertTrue(main(true, true));
+assertTrue(main(false, true));
+assertTrue(main(false, true));
+%OptimizeFunctionOnNextCall(main);
+assertFalse(main(false));
diff --git a/deps/v8/test/mjsunit/compiler/serializer-dead-after-return.js b/deps/v8/test/mjsunit/compiler/serializer-dead-after-return.js
new file mode 100644
index 00000000000000..d8d65eb5cffd44
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/serializer-dead-after-return.js
@@ -0,0 +1,35 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+function f(x) {
+  %TurbofanStaticAssert(x.foo === 42);
+  return %IsBeingInterpreted();
+}
+
+function main(b, ret) {
+  const x = new Object();
+  const y = x;
+  if (b) return ret;
+
+  x.foo = 42;
+  return f(y);
+}
+
+
+%PrepareFunctionForOptimization(f);
+%PrepareFunctionForOptimization(main);
+
+f({a: 1});
+f({b: 1});
+f({c: 1});
+f({d: 1});
+
+assertTrue(main(true, true));
+assertTrue(main(true, true));
+assertTrue(main(false, true));
+assertTrue(main(false, true));
+%OptimizeFunctionOnNextCall(main);
+assertFalse(main(false));
diff --git a/deps/v8/test/mjsunit/compiler/serializer-feedback-propagation-1.js b/deps/v8/test/mjsunit/compiler/serializer-feedback-propagation-1.js
new file mode 100644
index 00000000000000..13e88639dbc125
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/serializer-feedback-propagation-1.js
@@ -0,0 +1,27 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var obj = Object.create(Object.create({blu: 42}));
+obj.bla = 1;
+
+function bar(o) {
+  return o.blu;
+}
+
+function foo(o) {
+  o.bla;
+  %TurbofanStaticAssert(bar(o) == 42);
+}
+
+%PrepareFunctionForOptimization(bar);
+%PrepareFunctionForOptimization(foo);
+bar({});
+bar({bla: 1});
+bar({blu: 1});
+bar({blo: 1});
+foo(obj);
+%OptimizeFunctionOnNextCall(foo);
+foo(obj);
diff --git a/deps/v8/test/mjsunit/compiler/serializer-feedback-propagation-2.js b/deps/v8/test/mjsunit/compiler/serializer-feedback-propagation-2.js
new file mode 100644
index 00000000000000..5622719f7d49b4
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/serializer-feedback-propagation-2.js
@@ -0,0 +1,32 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var obj = Object.create(Object.create({blu: 42}));
+obj.bla = 1;
+
+function bar(o) {
+  return o.blu;
+}
+
+function baz(o) {
+  return o.bla;
+}
+
+function foo(o) {
+  baz(o);
+  %TurbofanStaticAssert(bar(o) == 42);
+}
+
+%PrepareFunctionForOptimization(bar);
+%PrepareFunctionForOptimization(baz);
+%PrepareFunctionForOptimization(foo);
+bar({});
+bar({bla: 1});
+bar({blu: 1});
+bar({blo: 1});
+foo(obj);
+%OptimizeFunctionOnNextCall(foo);
+foo(obj);
diff --git a/deps/v8/test/mjsunit/compiler/serializer-transition-propagation.js b/deps/v8/test/mjsunit/compiler/serializer-transition-propagation.js
new file mode 100644
index 00000000000000..f9790cd0ac2963
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/serializer-transition-propagation.js
@@ -0,0 +1,54 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+var expect_interpreted = true;
+
+function C() {
+  this.a = 1;
+  assertEquals(expect_interpreted, %IsBeingInterpreted());
+  %TurbofanStaticAssert(this.x == 42);
+};
+
+function D() {
+  this.x = 42;
+  C.call(this);
+};
+
+function E() {
+  D.call(this);
+}
+
+function F() {
+  E.call(this);
+};
+
+function G() {
+  F.call(this);
+};
+
+function foo() {
+  new D;
+}
+
+%PrepareFunctionForOptimization(C);
+%PrepareFunctionForOptimization(D);
+%PrepareFunctionForOptimization(E);
+%PrepareFunctionForOptimization(F);
+%PrepareFunctionForOptimization(G);
+%PrepareFunctionForOptimization(foo);
+
+// Make 'this.x' access in C megamorhpic.
+new C;
+new D;
+new E;
+new F;
+new G;
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+expect_interpreted = false;
+foo();
diff --git a/deps/v8/test/mjsunit/compiler/typed-array-constructor.js b/deps/v8/test/mjsunit/compiler/typed-array-constructor.js
index fac56632f30d30..a70457259486ba 100644
--- a/deps/v8/test/mjsunit/compiler/typed-array-constructor.js
+++ b/deps/v8/test/mjsunit/compiler/typed-array-constructor.js
@@ -4,7 +4,7 @@
 
 // Flags: --allow-natives-syntax
 
-const limit = %MaxSmi() + 1;
+const limit = %TypedArrayMaxLength() + 1;
 
 (function() {
   function foo() {
diff --git a/deps/v8/test/mjsunit/constant-folding-2.js b/deps/v8/test/mjsunit/constant-folding-2.js
index a0c0feda022462..68b05fd7c473b8 100644
--- a/deps/v8/test/mjsunit/constant-folding-2.js
+++ b/deps/v8/test/mjsunit/constant-folding-2.js
@@ -278,7 +278,6 @@ test(function stringCodePointAt() {
 }, 10);
 
 test(function stringFromCodePoint() {
-  assertEquals(String.fromCodePoint(""), "\0");
   assertEquals(String.fromCodePoint(), "");
   assertEquals(String.fromCodePoint(-0), "\0");
   assertEquals(String.fromCodePoint(0), "\0");
diff --git a/deps/v8/test/mjsunit/cross-realm-builtin-call.js b/deps/v8/test/mjsunit/cross-realm-builtin-call.js
new file mode 100644
index 00000000000000..c450e789f2d7ce
--- /dev/null
+++ b/deps/v8/test/mjsunit/cross-realm-builtin-call.js
@@ -0,0 +1,29 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function check(x) { assertEquals(x, "foo"); }
+
+var r = Realm.createAllowCrossRealmAccess();
+var f = Realm.eval(r, `
+    function f(func) {
+      // The call to Function.prototype.apply is across native contexts so
+      // cannot be elided. However the compiler should be able to call the
+      // builtin directly rather than via the trampoline Code object. This isn't
+      // easy to test, but here we at least check that it doesn't crash due to
+      // calling a builtin Code object incorrectly (Function.Prototype.apply).
+      return func.apply(undefined, ["foo"]);
+    }
+
+    f;`);
+
+%PrepareFunctionForOptimization(f);
+
+f(check);
+f(check);
+
+%OptimizeFunctionOnNextCall(f);
+
+f(check);
diff --git a/deps/v8/test/mjsunit/d8/d8-performance-measure-memory.js b/deps/v8/test/mjsunit/d8/d8-performance-measure-memory.js
deleted file mode 100644
index baf6479fff3b06..00000000000000
--- a/deps/v8/test/mjsunit/d8/d8-performance-measure-memory.js
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Test the performance.measureMemory() function of d8.  This test only makes
-// sense with d8.
-
-load('test/mjsunit/mjsunit.js');
-
-function assertLessThanOrEqual(a, b) {
-  assertTrue(a <= b, `Expected ${a} <= ${b}`);
-}
-
-function checkMeasureMemoryResult(result) {
-  assertTrue('total' in result);
-  assertTrue('jsMemoryEstimate' in result.total);
-  assertTrue('jsMemoryRange' in result.total);
-  assertEquals('number', typeof result.total.jsMemoryEstimate);
-  assertEquals(2, result.total.jsMemoryRange.length);
-  assertEquals('number', typeof result.total.jsMemoryRange[0]);
-  assertEquals('number', typeof result.total.jsMemoryRange[1]);
-  assertLessThanOrEqual(result.total.jsMemoryRange[0],
-                        result.total.jsMemoryRange[1]);
-  assertLessThanOrEqual(result.total.jsMemoryRange[0],
-                        result.total.jsMemoryEstimate);
-  assertLessThanOrEqual(result.total.jsMemoryEstimate,
-                        result.total.jsMemoryRange[1]);
-}
-
-if (this.performance && performance.measureMemory) {
-  assertPromiseResult((async () => {
-    let result = await performance.measureMemory();
-    checkMeasureMemoryResult(result);
-  })());
-
-  assertPromiseResult((async () => {
-    let result = await performance.measureMemory({detailed: false});
-    checkMeasureMemoryResult(result);
-  })());
-
-  assertPromiseResult((async () => {
-    let result = await performance.measureMemory({detailed: true});
-    // TODO(ulan): Also check the detailed results once measureMemory
-    // supports them.
-    checkMeasureMemoryResult(result);
-  })());
-}
diff --git a/deps/v8/test/mjsunit/debugPrint.js b/deps/v8/test/mjsunit/debugPrint.js
index 3ab93e547a41c1..682a41463c845e 100644
--- a/deps/v8/test/mjsunit/debugPrint.js
+++ b/deps/v8/test/mjsunit/debugPrint.js
@@ -30,6 +30,8 @@ var objects = [
     this,
     true, false, null, undefined,
     1, -1, 1.1, -2.2, -0, 0,
+    9007199254740991.0, 9007199254740991.0 + 10,
+    -9007199254740992.0, -9007199254740992.0 - 10,
     Infinity, -Infinity, NaN,
     "aasdfasdfasdfasdf", "a"+"b",
     {}, {1:1}, {a:1}, {1:1, 2:2}, Object.create(null),
diff --git a/deps/v8/test/mjsunit/es6/array-concat-arity.js b/deps/v8/test/mjsunit/es6/array-concat-arity.js
new file mode 100644
index 00000000000000..4687d285f5b54d
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-arity.js
@@ -0,0 +1,6 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+assertEquals(1, Array.prototype.concat.length);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-array-subclass.js b/deps/v8/test/mjsunit/es6/array-concat-array-subclass.js
new file mode 100644
index 00000000000000..9e0c2ef1bea720
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-array-subclass.js
@@ -0,0 +1,20 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+// If @@isConcatSpreadable is not used, the value of IsArray(O)
+// is used to determine the spreadable property.
+class A extends Array {}
+var obj = [].concat(new A(1, 2, 3), new A(4, 5, 6), new A(7, 8, 9));
+assertEquals(9, obj.length);
+for (var i = 0; i < obj.length; ++i) {
+  assertEquals(i + 1, obj[i]);
+}
+
+// TODO(caitp): when concat is called on instances of classes which extend
+// Array, they should:
+//
+// - return an instance of the class, rather than an Array instance (if from
+//   same Realm)
+// - always treat such classes as concat-spreadable
diff --git a/deps/v8/test/mjsunit/es6/array-concat-arraylike-length-throws.js b/deps/v8/test/mjsunit/es6/array-concat-arraylike-length-throws.js
new file mode 100644
index 00000000000000..77fa9303534e47
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-arraylike-length-throws.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var obj = {
+  "length": {valueOf: null, toString: null},
+  "1": "A",
+  "3": "B",
+  "5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+var obj2 = { length: 3, "0": "0", "1": "1", "2": "2" };
+var arr = ["X", "Y", "Z"];
+assertThrows(function() {
+  Array.prototype.concat.call(obj, obj2, arr);
+}, TypeError);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-arraylike-length-tostring-throws.js b/deps/v8/test/mjsunit/es6/array-concat-arraylike-length-tostring-throws.js
new file mode 100644
index 00000000000000..8df418469b6ea4
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-arraylike-length-tostring-throws.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+function MyError() {}
+var obj = {
+  "length": { toString: function() {
+      throw new MyError();
+    }, valueOf: null
+  },
+  "1": "A",
+  "3": "B",
+  "5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+assertThrows(function() {
+  [].concat(obj);
+}, MyError);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-arraylike-length-valueof-throws.js b/deps/v8/test/mjsunit/es6/array-concat-arraylike-length-valueof-throws.js
new file mode 100644
index 00000000000000..ee4415c36516d8
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-arraylike-length-valueof-throws.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+function MyError() {}
+var obj = {
+  "length": { valueOf: function() {
+    throw new MyError();
+  }, toString: null
+},
+"1": "A",
+"3": "B",
+"5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+assertThrows(function() {
+  [].concat(obj);
+}, MyError);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-arraylike-negative-length.js b/deps/v8/test/mjsunit/es6/array-concat-arraylike-negative-length.js
new file mode 100644
index 00000000000000..1b74f1753d2b92
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-arraylike-negative-length.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var obj = {
+  "length": -6,
+  "1": "A",
+  "3": "B",
+  "5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+assertEquals([], [].concat(obj));
+obj.length = -6.7;
+assertEquals([], [].concat(obj));
+obj.length = "-6";
+assertEquals([], [].concat(obj));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-arraylike-primitive-nonnumber-length.js b/deps/v8/test/mjsunit/es6/array-concat-arraylike-primitive-nonnumber-length.js
new file mode 100644
index 00000000000000..e27ab8e4ad1fac
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-arraylike-primitive-nonnumber-length.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var obj = {
+  "1": "A",
+  "3": "B",
+  "5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+obj.length = {toString: function() { return "SIX"; }, valueOf: null };
+assertEquals([], [].concat(obj));
+obj.length = {toString: null, valueOf: function() { return "SIX"; } };
+assertEquals([], [].concat(obj));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-arraylike-string-length.js b/deps/v8/test/mjsunit/es6/array-concat-arraylike-string-length.js
new file mode 100644
index 00000000000000..471dcb99eb1b00
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-arraylike-string-length.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var obj = {
+  "length": "6",
+  "1": "A",
+  "3": "B",
+  "5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+var obj2 = { length: 3, "0": "0", "1": "1", "2": "2" };
+var arr = ["X", "Y", "Z"];
+assertEquals([void 0, "A", void 0, "B", void 0, "C",
+             { "length": 3, "0": "0", "1": "1", "2": "2" },
+             "X", "Y", "Z"], Array.prototype.concat.call(obj, obj2, arr));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-arraylike.js b/deps/v8/test/mjsunit/es6/array-concat-arraylike.js
new file mode 100644
index 00000000000000..0ad3eb52936d10
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-arraylike.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var obj = {
+  "length": 6,
+  "1": "A",
+  "3": "B",
+  "5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+var obj2 = { length: 3, "0": "0", "1": "1", "2": "2" };
+var arr = ["X", "Y", "Z"];
+assertEquals([void 0, "A", void 0, "B", void 0, "C",
+             { "length": 3, "0": "0", "1": "1", "2": "2" },
+             "X", "Y", "Z"], Array.prototype.concat.call(obj, obj2, arr));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-descriptor.js b/deps/v8/test/mjsunit/es6/array-concat-descriptor.js
new file mode 100644
index 00000000000000..873cc4c0f11fca
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-descriptor.js
@@ -0,0 +1,7 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var desc = Object.getOwnPropertyDescriptor(Array.prototype, 'concat');
+assertEquals(false, desc.enumerable);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-holey-array.js b/deps/v8/test/mjsunit/es6/array-concat-holey-array.js
new file mode 100644
index 00000000000000..31c2ba1bd9a579
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-holey-array.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var arr = [];
+arr[4] = "Item 4";
+arr[8] = "Item 8";
+var arr2 = [".", "!", "?"];
+assertEquals([void 0, void 0, void 0, void 0, "Item 4", void 0, void 0,
+              void 0, "Item 8", ".", "!", "?"], arr.concat(arr2));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-isconcatspreadable-getter-throws.js b/deps/v8/test/mjsunit/es6/array-concat-isconcatspreadable-getter-throws.js
new file mode 100644
index 00000000000000..88fe5d93c40bcb
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-isconcatspreadable-getter-throws.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+function MyError() {}
+var obj = {};
+Object.defineProperty(obj, Symbol.isConcatSpreadable, {
+  get: function() { throw new MyError(); }
+});
+
+assertThrows(function() {
+  [].concat(obj);
+}, MyError);
+
+assertThrows(function() {
+  Array.prototype.concat.call(obj, 1, 2, 3);
+}, MyError);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-length-throws.js b/deps/v8/test/mjsunit/es6/array-concat-length-throws.js
new file mode 100644
index 00000000000000..ecacfdd857a4e0
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-length-throws.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+function MyError() {}
+var obj = {};
+obj[Symbol.isConcatSpreadable] = true;
+Object.defineProperty(obj, "length", {
+  get: function() { throw new MyError(); }
+});
+
+assertThrows(function() {
+  [].concat(obj);
+}, MyError);
+
+assertThrows(function() {
+  Array.prototype.concat.call(obj, 1, 2, 3);
+}, MyError);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-no-prototype.js b/deps/v8/test/mjsunit/es6/array-concat-no-prototype.js
new file mode 100644
index 00000000000000..135e8ea5f24f8a
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-no-prototype.js
@@ -0,0 +1,6 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+assertEquals(void 0, Array.prototype.concat.prototype);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-nonarray.js b/deps/v8/test/mjsunit/es6/array-concat-nonarray.js
new file mode 100644
index 00000000000000..761692fd418ae5
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-nonarray.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+class NonArray {
+  constructor() { Array.apply(this, arguments); }
+};
+
+var obj = new NonArray(1,2,3);
+var result = Array.prototype.concat.call(obj, 4, 5, 6);
+assertEquals(Array, result.constructor);
+assertEquals([obj,4,5,6], result);
+assertFalse(result instanceof NonArray);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-sloppy-arguments-holey.js b/deps/v8/test/mjsunit/es6/array-concat-sloppy-arguments-holey.js
new file mode 100644
index 00000000000000..ac160fc1f36f33
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-sloppy-arguments-holey.js
@@ -0,0 +1,8 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var args = (function(a) { return arguments; })(1,2,3);
+delete args[1];
+args[Symbol.isConcatSpreadable] = true;
+assertEquals([1, void 0, 3, 1, void 0, 3], [].concat(args, args));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-sloppy-arguments-throws.js b/deps/v8/test/mjsunit/es6/array-concat-sloppy-arguments-throws.js
new file mode 100644
index 00000000000000..10d9954d3c03d6
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-sloppy-arguments-throws.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function MyError() {}
+var args = (function(a) { return arguments; })(1,2,3);
+Object.defineProperty(args, 0, {
+  get: function() { throw new MyError(); }
+});
+args[Symbol.isConcatSpreadable] = true;
+assertThrows(function() {
+  return [].concat(args, args);
+}, MyError);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-sloppy-arguments-with-dupes.js b/deps/v8/test/mjsunit/es6/array-concat-sloppy-arguments-with-dupes.js
new file mode 100644
index 00000000000000..4634cac705472b
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-sloppy-arguments-with-dupes.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var args = (function(a, a, a) { return arguments; })(1,2,3);
+args[Symbol.isConcatSpreadable] = true;
+assertEquals([1, 2, 3, 1, 2, 3], [].concat(args, args));
+
+Object.defineProperty(args, "length", { value: 6 });
+assertEquals([1, 2, 3, void 0, void 0, void 0], [].concat(args));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-sloppy-arguments.js b/deps/v8/test/mjsunit/es6/array-concat-sloppy-arguments.js
new file mode 100644
index 00000000000000..b77833f885490e
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-sloppy-arguments.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var args = (function(a, b, c) { return arguments; })(1,2,3);
+args[Symbol.isConcatSpreadable] = true;
+assertEquals([1, 2, 3, 1, 2, 3], [].concat(args, args));
+
+Object.defineProperty(args, "length", { value: 6 });
+assertEquals([1, 2, 3, void 0, void 0, void 0], [].concat(args));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-spreadable-arraylike-proxy-bogus-length.js b/deps/v8/test/mjsunit/es6/array-concat-spreadable-arraylike-proxy-bogus-length.js
new file mode 100644
index 00000000000000..f5512c9a6d8766
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-spreadable-arraylike-proxy-bogus-length.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Note: concat does not currently support species so there is no difference
+// between [].concat(foo) and Array.prototype.concat.apply(foo).
+
+var getTrap = function(t, key) {
+  if (key === "length") return Symbol();
+  if (key === "2") return "baz";
+  if (key === "3") return "bar";
+};
+var target = [];
+var obj = new Proxy(target, {get: getTrap, has: () => true});
+
+assertThrows(() => [].concat(obj), TypeError);
+assertThrows(() => Array.prototype.concat.apply(obj), TypeError);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-spreadable-arraylike-proxy-length.js b/deps/v8/test/mjsunit/es6/array-concat-spreadable-arraylike-proxy-length.js
new file mode 100644
index 00000000000000..7d401ead9aba26
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-spreadable-arraylike-proxy-length.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Note: concat does not currently support species so there is no difference
+// between [].concat(foo) and Array.prototype.concat.apply(foo).
+
+var getTrap = function(t, key) {
+  if (key === "length") return {[Symbol.toPrimitive]() {return 3}};
+  if (key === "2") return "baz";
+  if (key === "3") return "bar";
+};
+var target = [];
+var obj = new Proxy(target, {get: getTrap, has: () => true});
+
+assertEquals([undefined, undefined, "baz"], [].concat(obj));
+assertEquals([undefined, undefined, "baz"], Array.prototype.concat.apply(obj))
diff --git a/deps/v8/test/mjsunit/es6/array-concat-spreadable-arraylike-proxy.js b/deps/v8/test/mjsunit/es6/array-concat-spreadable-arraylike-proxy.js
new file mode 100644
index 00000000000000..3d10f359e03d4b
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-spreadable-arraylike-proxy.js
@@ -0,0 +1,44 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Note: concat does not currently support species so there is no difference
+// between [].concat(foo) and Array.prototype.concat.apply(foo).
+
+var log = [];
+var logger = {};
+var handler = new Proxy({}, logger);
+
+logger.get = function(t, trap, r) {
+  return function(...args) {
+    log.push([trap, ...args]);
+    return Reflect[trap](...args);
+  }
+};
+
+var target = ["a", "b"];
+target[Symbol.isConcatSpreadable] = undefined;
+var obj = new Proxy(target, handler);
+
+log.length = 0;
+assertEquals(["a", "b"], [].concat(obj));
+assertEquals(6, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+assertEquals(["get", target, "length", obj], log[1]);
+assertEquals(["has", target, "0"], log[2]);
+assertEquals(["get", target, "0", obj], log[3]);
+assertEquals(["has", target, "1"], log[4]);
+assertEquals(["get", target, "1", obj], log[5]);
+
+log.length = 0;
+assertEquals(["a", "b"], Array.prototype.concat.apply(obj));
+assertEquals(7, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, "constructor", obj], log[0]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[1]);
+assertEquals(["get", target, "length", obj], log[2]);
+assertEquals(["has", target, "0"], log[3]);
+assertEquals(["get", target, "0", obj], log[4]);
+assertEquals(["has", target, "1"], log[5]);
+assertEquals(["get", target, "1", obj], log[6]);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-spreadable-boolean-wrapper.js b/deps/v8/test/mjsunit/es6/array-concat-spreadable-boolean-wrapper.js
new file mode 100644
index 00000000000000..cdd0d4a7ae6647
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-spreadable-boolean-wrapper.js
@@ -0,0 +1,26 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var bool = new Boolean(true)
+// Boolean wrapper objects are not concat-spreadable by default
+assertEquals([bool], [].concat(bool));
+
+// Boolean wrapper objects may be individually concat-spreadable
+bool[Symbol.isConcatSpreadable] = true;
+bool.length = 3;
+bool[0] = 1, bool[1] = 2, bool[2] = 3;
+assertEquals([1, 2, 3], [].concat(bool));
+
+Boolean.prototype[Symbol.isConcatSpreadable] = true;
+// Boolean wrapper objects may be concat-spreadable
+assertEquals([], [].concat(new Boolean(true)));
+Boolean.prototype[0] = 1;
+Boolean.prototype[1] = 2;
+Boolean.prototype[2] = 3;
+Boolean.prototype.length = 3;
+assertEquals([1,2,3], [].concat(new Boolean(true)));
+
+// Boolean values are never concat-spreadable
+assertEquals([true], [].concat(true));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-spreadable-function.js b/deps/v8/test/mjsunit/es6/array-concat-spreadable-function.js
new file mode 100644
index 00000000000000..9b64fc63aa06c2
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-spreadable-function.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var fn = function(a, b, c) {}
+// Functions are not concat-spreadable by default
+assertEquals([fn], [].concat(fn));
+
+// Functions may be individually concat-spreadable
+fn[Symbol.isConcatSpreadable] = true;
+fn[0] = 1, fn[1] = 2, fn[2] = 3;
+assertEquals([1, 2, 3], [].concat(fn));
+
+Function.prototype[Symbol.isConcatSpreadable] = true;
+// Functions may be concat-spreadable
+assertEquals([void 0, void 0, void 0], [].concat(function(a,b,c) {}));
+Function.prototype[0] = 1;
+Function.prototype[1] = 2;
+Function.prototype[2] = 3;
+assertEquals([1,2,3], [].concat(function(a, b, c) {}));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-spreadable-nonarraylike-proxy.js b/deps/v8/test/mjsunit/es6/array-concat-spreadable-nonarraylike-proxy.js
new file mode 100644
index 00000000000000..ecbe4488d74f44
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-spreadable-nonarraylike-proxy.js
@@ -0,0 +1,60 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Note: concat does not currently support species so there is no difference
+// between [].concat(foo) and Array.prototype.concat.apply(foo).
+
+var log = [];
+var logger = {};
+var handler = new Proxy({}, logger);
+
+logger.get = function(t, trap, r) {
+  return function(...args) {
+    log.push([trap, ...args]);
+    return Reflect[trap](...args);
+  }
+};
+
+var target = {0: "a", 1: "b", [Symbol.isConcatSpreadable]: "truish"};
+var obj = new Proxy(target, handler);
+
+log.length = 0;
+assertEquals([], [].concat(obj));
+assertEquals(2, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+assertEquals(["get", target, "length", obj], log[1]);
+
+log.length = 0;
+assertEquals([], Array.prototype.concat.apply(obj));
+assertEquals(2, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+assertEquals(["get", target, "length", obj], log[1]);
+
+target.length = 3;
+
+log.length = 0;
+assertEquals(["a", "b", undefined], [].concat(obj));
+assertEquals(7, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+assertEquals(["get", target, "length", obj], log[1]);
+assertEquals(["has", target, "0"], log[2]);
+assertEquals(["get", target, "0", obj], log[3]);
+assertEquals(["has", target, "1"], log[4]);
+assertEquals(["get", target, "1", obj], log[5]);
+assertEquals(["has", target, "2"], log[6]);
+
+log.length = 0;
+assertEquals(["a", "b", undefined], Array.prototype.concat.apply(obj));
+assertEquals(7, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+assertEquals(["get", target, "length", obj], log[1]);
+assertEquals(["has", target, "0"], log[2]);
+assertEquals(["get", target, "0", obj], log[3]);
+assertEquals(["has", target, "1"], log[4]);
+assertEquals(["get", target, "1", obj], log[5]);
+assertEquals(["has", target, "2"], log[6]);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-spreadable-number-wrapper.js b/deps/v8/test/mjsunit/es6/array-concat-spreadable-number-wrapper.js
new file mode 100644
index 00000000000000..a0b0eb40be569f
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-spreadable-number-wrapper.js
@@ -0,0 +1,26 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var num = new Number(true)
+// Number wrapper objects are not concat-spreadable by default
+assertEquals([num], [].concat(num));
+
+// Number wrapper objects may be individually concat-spreadable
+num[Symbol.isConcatSpreadable] = true;
+num.length = 3;
+num[0] = 1, num[1] = 2, num[2] = 3;
+assertEquals([1, 2, 3], [].concat(num));
+
+Number.prototype[Symbol.isConcatSpreadable] = true;
+// Number wrapper objects may be concat-spreadable
+assertEquals([], [].concat(new Number(123)));
+Number.prototype[0] = 1;
+Number.prototype[1] = 2;
+Number.prototype[2] = 3;
+Number.prototype.length = 3;
+assertEquals([1,2,3], [].concat(new Number(123)));
+
+// Number values are never concat-spreadable
+assertEquals([true], [].concat(true));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-spreadable-regexp.js b/deps/v8/test/mjsunit/es6/array-concat-spreadable-regexp.js
new file mode 100644
index 00000000000000..73a61e4d8860a7
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-spreadable-regexp.js
@@ -0,0 +1,23 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var re = /abc/;
+// RegExps are not concat-spreadable by default
+assertEquals([re], [].concat(re));
+
+// RegExps may be individually concat-spreadable
+re[Symbol.isConcatSpreadable] = true;
+re[0] = 1, re[1] = 2, re[2] = 3, re.length = 3;
+assertEquals([1, 2, 3], [].concat(re));
+
+// RegExps may be concat-spreadable
+RegExp.prototype[Symbol.isConcatSpreadable] = true;
+RegExp.prototype.length = 3;
+
+assertEquals([void 0, void 0, void 0], [].concat(/abc/));
+RegExp.prototype[0] = 1;
+RegExp.prototype[1] = 2;
+RegExp.prototype[2] = 3;
+assertEquals([1,2,3], [].concat(/abc/));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-spreadable-sparse-object.js b/deps/v8/test/mjsunit/es6/array-concat-spreadable-sparse-object.js
new file mode 100644
index 00000000000000..c10b0024034bda
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-spreadable-sparse-object.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var obj = { length: 5 };
+obj[Symbol.isConcatSpreadable] = true;
+assertEquals([void 0, void 0, void 0, void 0, void 0], [].concat(obj));
+
+obj.length = 4000;
+assertEquals(new Array(4000), [].concat(obj));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-spreadable-string-wrapper.js b/deps/v8/test/mjsunit/es6/array-concat-spreadable-string-wrapper.js
new file mode 100644
index 00000000000000..b176576bd90171
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-spreadable-string-wrapper.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var str1 = new String("yuck\uD83D\uDCA9")
+// String wrapper objects are not concat-spreadable by default
+assertEquals([str1], [].concat(str1));
+
+// String wrapper objects may be individually concat-spreadable
+str1[Symbol.isConcatSpreadable] = true;
+assertEquals(["y", "u", "c", "k", "\uD83D", "\uDCA9"],
+             [].concat(str1));
+
+String.prototype[Symbol.isConcatSpreadable] = true;
+// String wrapper objects may be concat-spreadable
+assertEquals(["y", "u", "c", "k", "\uD83D", "\uDCA9"],
+             [].concat(new String("yuck\uD83D\uDCA9")));
+
+// String values are never concat-spreadable
+assertEquals(["yuck\uD83D\uDCA9"], [].concat("yuck\uD83D\uDCA9"));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-strict-arguments.js b/deps/v8/test/mjsunit/es6/array-concat-strict-arguments.js
new file mode 100644
index 00000000000000..4180a94a2eadba
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-strict-arguments.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var args = (function(a, b, c) { "use strict"; return arguments; })(1,2,3);
+args[Symbol.isConcatSpreadable] = true;
+assertEquals([1, 2, 3, 1, 2, 3], [].concat(args, args));
+
+Object.defineProperty(args, "length", { value: 6 });
+assertEquals([1, 2, 3, void 0, void 0, void 0], [].concat(args));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-typedarray.js b/deps/v8/test/mjsunit/es6/array-concat-typedarray.js
new file mode 100644
index 00000000000000..11db768769f1b2
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-typedarray.js
@@ -0,0 +1,49 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function testConcatTypedArray(type, elems, modulo) {
+  "use strict";
+  var items = new Array(elems);
+  var ta_by_len = new type(elems);
+  for (var i = 0; i < elems; ++i) {
+    ta_by_len[i] = items[i] = modulo === false ? i : elems % modulo;
+  }
+  var ta = new type(items);
+  assertEquals([ta, ta], [].concat(ta, ta));
+  ta[Symbol.isConcatSpreadable] = true;
+  assertEquals(items, [].concat(ta));
+
+  assertEquals([ta_by_len, ta_by_len], [].concat(ta_by_len, ta_by_len));
+  ta_by_len[Symbol.isConcatSpreadable] = true;
+  assertEquals(items, [].concat(ta_by_len));
+
+  // TypedArray with fake `length`.
+  ta = new type(1);
+  var defValue = ta[0];
+  var expected = new Array(4000);
+  expected[0] = defValue;
+
+  Object.defineProperty(ta, "length", { value: 4000 });
+  ta[Symbol.isConcatSpreadable] = true;
+  assertEquals(expected, [].concat(ta));
+}
+
+(function testConcatSmallTypedArray() {
+  var length = 1;
+  testConcatTypedArray(Uint8Array, length, Math.pow(2, 8));
+  testConcatTypedArray(Uint16Array, length, Math.pow(2, 16));
+  testConcatTypedArray(Uint32Array, length,  Math.pow(2, 32));
+  testConcatTypedArray(Float32Array, length, false);
+  testConcatTypedArray(Float64Array, length, false);
+})();
+
+
+(function testConcatLargeTypedArray() {
+  var length = 4000;
+  testConcatTypedArray(Uint8Array, length, Math.pow(2, 8));
+  testConcatTypedArray(Uint16Array, length, Math.pow(2, 16));
+  testConcatTypedArray(Uint32Array, length,  Math.pow(2, 32));
+  testConcatTypedArray(Float32Array, length, false);
+  testConcatTypedArray(Float64Array, length, false);
+})();
diff --git a/deps/v8/test/mjsunit/es6/array-concat-unspreadable-array-subclass.js b/deps/v8/test/mjsunit/es6/array-concat-unspreadable-array-subclass.js
new file mode 100644
index 00000000000000..f3778320f74995
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-unspreadable-array-subclass.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+class A extends Array {
+  get [Symbol.isConcatSpreadable]() { return false; }
+}
+var obj = [].concat(new A(1, 2, 3), new A(4, 5, 6), new A(7, 8, 9));
+assertEquals(3, obj.length);
+assertEquals(3, obj[0].length);
+assertEquals(3, obj[1].length);
+assertEquals(3, obj[2].length);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-unspreadable-array.js b/deps/v8/test/mjsunit/es6/array-concat-unspreadable-array.js
new file mode 100644
index 00000000000000..dc8070160da770
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-unspreadable-array.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var array = [1, 2, 3];
+assertEquals(array, [].concat(array));
+assertEquals(array, array.concat([]));
+array[Symbol.isConcatSpreadable] = false;
+assertEquals([[1,2,3]], [].concat(array));
+assertEquals([[1,2,3]], array.concat([]));
diff --git a/deps/v8/test/mjsunit/es6/array-concat-unspreadable-arraylike-proxy.js b/deps/v8/test/mjsunit/es6/array-concat-unspreadable-arraylike-proxy.js
new file mode 100644
index 00000000000000..1ecb82a86fe11f
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-unspreadable-arraylike-proxy.js
@@ -0,0 +1,34 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Note: concat does not currently support species so there is no difference
+// between [].concat(foo) and Array.prototype.concat.apply(foo).
+
+var log = [];
+var logger = {};
+var handler = new Proxy({}, logger);
+
+logger.get = function(t, trap, r) {
+  return function(...args) {
+    log.push([trap, ...args]);
+    return Reflect[trap](...args);
+  }
+};
+
+var target = ["a", "b"];
+target[Symbol.isConcatSpreadable] = "";
+var obj = new Proxy(target, handler);
+
+log.length = 0;
+assertEquals([obj], [].concat(obj));
+assertEquals(1, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+
+log.length = 0;
+assertEquals([obj], Array.prototype.concat.apply(obj));
+assertEquals(2, log.length);  // An extra read for the constructor
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, "constructor", obj], log[0]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[1]);
diff --git a/deps/v8/test/mjsunit/es6/array-concat-unspreadable-nonarraylike-proxy.js b/deps/v8/test/mjsunit/es6/array-concat-unspreadable-nonarraylike-proxy.js
new file mode 100644
index 00000000000000..f1aca835e8a1b5
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-concat-unspreadable-nonarraylike-proxy.js
@@ -0,0 +1,32 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Note: concat does not currently support species so there is no difference
+// between [].concat(foo) and Array.prototype.concat.apply(foo).
+
+var log = [];
+var logger = {};
+var handler = new Proxy({}, logger);
+
+logger.get = function(t, trap, r) {
+  return function(...args) {
+    log.push([trap, ...args]);
+    return Reflect[trap](...args);
+  }
+};
+
+var target = {0: "a", 1: "b"};
+var obj = new Proxy(target, handler);
+
+log.length = 0;
+assertEquals([obj], [].concat(obj));
+assertEquals(1, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+
+log.length = 0;
+assertEquals([obj], Array.prototype.concat.apply(obj));
+assertEquals(1, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
diff --git a/deps/v8/test/mjsunit/es6/array-concat.js b/deps/v8/test/mjsunit/es6/array-concat.js
deleted file mode 100644
index f57c10e03eb848..00000000000000
--- a/deps/v8/test/mjsunit/es6/array-concat.js
+++ /dev/null
@@ -1,896 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-(function testArrayConcatArity() {
-  "use strict";
-  assertEquals(1, Array.prototype.concat.length);
-})();
-
-
-(function testArrayConcatNoPrototype() {
-  "use strict";
-  assertEquals(void 0, Array.prototype.concat.prototype);
-})();
-
-
-(function testArrayConcatDescriptor() {
-  "use strict";
-  var desc = Object.getOwnPropertyDescriptor(Array.prototype, 'concat');
-  assertEquals(false, desc.enumerable);
-})();
-
-(function testNonConcatSpreadableArray() {
-  "use strict"
-  var array = [1, 2, 3];
-  assertEquals(array, [].concat(array));
-  assertEquals(array, array.concat([]));
-  array[Symbol.isConcatSpreadable] = false;
-  assertEquals([[1,2,3]], [].concat(array));
-  assertEquals([[1,2,3]], array.concat([]));
-})();
-
-(function testConcatArrayLike() {
-  "use strict";
-  var obj = {
-    "length": 6,
-    "1": "A",
-    "3": "B",
-    "5": "C"
-  };
-  obj[Symbol.isConcatSpreadable] = true;
-  var obj2 = { length: 3, "0": "0", "1": "1", "2": "2" };
-  var arr = ["X", "Y", "Z"];
-  assertEquals([void 0, "A", void 0, "B", void 0, "C",
-               { "length": 3, "0": "0", "1": "1", "2": "2" },
-               "X", "Y", "Z"], Array.prototype.concat.call(obj, obj2, arr));
-})();
-
-
-(function testConcatArrayLikeStringLength() {
-  "use strict";
-  var obj = {
-    "length": "6",
-    "1": "A",
-    "3": "B",
-    "5": "C"
-  };
-  obj[Symbol.isConcatSpreadable] = true;
-  var obj2 = { length: 3, "0": "0", "1": "1", "2": "2" };
-  var arr = ["X", "Y", "Z"];
-  assertEquals([void 0, "A", void 0, "B", void 0, "C",
-               { "length": 3, "0": "0", "1": "1", "2": "2" },
-               "X", "Y", "Z"], Array.prototype.concat.call(obj, obj2, arr));
-})();
-
-
-(function testConcatArrayLikeNegativeLength() {
-  "use strict";
-  var obj = {
-    "length": -6,
-    "1": "A",
-    "3": "B",
-    "5": "C"
-  };
-  obj[Symbol.isConcatSpreadable] = true;
-  assertEquals([], [].concat(obj));
-  obj.length = -6.7;
-  assertEquals([], [].concat(obj));
-  obj.length = "-6";
-  assertEquals([], [].concat(obj));
-})();
-
-
-(function testConcatArrayLikeToLengthThrows() {
-  "use strict";
-  var obj = {
-    "length": {valueOf: null, toString: null},
-    "1": "A",
-    "3": "B",
-    "5": "C"
-  };
-  obj[Symbol.isConcatSpreadable] = true;
-  var obj2 = { length: 3, "0": "0", "1": "1", "2": "2" };
-  var arr = ["X", "Y", "Z"];
-  assertThrows(function() {
-    Array.prototype.concat.call(obj, obj2, arr);
-  }, TypeError);
-})();
-
-
-(function testConcatArrayLikePrimitiveNonNumberLength() {
-  "use strict";
-  var obj = {
-    "1": "A",
-    "3": "B",
-    "5": "C"
-  };
-  obj[Symbol.isConcatSpreadable] = true;
-  obj.length = {toString: function() { return "SIX"; }, valueOf: null };
-  assertEquals([], [].concat(obj));
-  obj.length = {toString: null, valueOf: function() { return "SIX"; } };
-  assertEquals([], [].concat(obj));
-})();
-
-
-(function testConcatArrayLikeLengthToStringThrows() {
-  "use strict";
-  function MyError() {}
-  var obj = {
-    "length": { toString: function() {
-        throw new MyError();
-      }, valueOf: null
-    },
-    "1": "A",
-    "3": "B",
-    "5": "C"
-  };
-  obj[Symbol.isConcatSpreadable] = true;
-  assertThrows(function() {
-    [].concat(obj);
-  }, MyError);
-})();
-
-
-(function testConcatArrayLikeLengthValueOfThrows() {
-  "use strict";
-  function MyError() {}
-  var obj = {
-    "length": { valueOf: function() {
-      throw new MyError();
-    }, toString: null
-  },
-  "1": "A",
-  "3": "B",
-  "5": "C"
-};
-obj[Symbol.isConcatSpreadable] = true;
-assertThrows(function() {
-  [].concat(obj);
-}, MyError);
-})();
-
-
-(function testConcatHoleyArray() {
-  "use strict";
-  var arr = [];
-  arr[4] = "Item 4";
-  arr[8] = "Item 8";
-  var arr2 = [".", "!", "?"];
-  assertEquals([void 0, void 0, void 0, void 0, "Item 4", void 0, void 0,
-                void 0, "Item 8", ".", "!", "?"], arr.concat(arr2));
-})();
-
-
-(function testIsConcatSpreadableGetterThrows() {
-  "use strict";
-  function MyError() {}
-  var obj = {};
-  Object.defineProperty(obj, Symbol.isConcatSpreadable, {
-    get: function() { throw new MyError(); }
-  });
-
-  assertThrows(function() {
-    [].concat(obj);
-  }, MyError);
-
-  assertThrows(function() {
-    Array.prototype.concat.call(obj, 1, 2, 3);
-  }, MyError);
-})();
-
-
-(function testConcatLengthThrows() {
-  "use strict";
-  function MyError() {}
-  var obj = {};
-  obj[Symbol.isConcatSpreadable] = true;
-  Object.defineProperty(obj, "length", {
-    get: function() { throw new MyError(); }
-  });
-
-  assertThrows(function() {
-    [].concat(obj);
-  }, MyError);
-
-  assertThrows(function() {
-    Array.prototype.concat.call(obj, 1, 2, 3);
-  }, MyError);
-})();
-
-
-(function testConcatArraySubclass() {
-  "use strict";
-  // If @@isConcatSpreadable is not used, the value of IsArray(O)
-  // is used to determine the spreadable property.
-  class A extends Array {}
-  var obj = [].concat(new A(1, 2, 3), new A(4, 5, 6), new A(7, 8, 9));
-  assertEquals(9, obj.length);
-  for (var i = 0; i < obj.length; ++i) {
-    assertEquals(i + 1, obj[i]);
-  }
-
-  // TODO(caitp): when concat is called on instances of classes which extend
-  // Array, they should:
-  //
-  // - return an instance of the class, rather than an Array instance (if from
-  //   same Realm)
-  // - always treat such classes as concat-spreadable
-})();
-
-
-(function testConcatArraySubclassOptOut() {
-  "use strict";
-  class A extends Array {
-    get [Symbol.isConcatSpreadable]() { return false; }
-  }
-  var obj = [].concat(new A(1, 2, 3), new A(4, 5, 6), new A(7, 8, 9));
-  assertEquals(3, obj.length);
-  assertEquals(3, obj[0].length);
-  assertEquals(3, obj[1].length);
-  assertEquals(3, obj[2].length);
-})();
-
-
-(function testConcatNonArray() {
-  "use strict";
-  class NonArray {
-    constructor() { Array.apply(this, arguments); }
-  };
-
-  var obj = new NonArray(1,2,3);
-  var result = Array.prototype.concat.call(obj, 4, 5, 6);
-  assertEquals(Array, result.constructor);
-  assertEquals([obj,4,5,6], result);
-  assertFalse(result instanceof NonArray);
-})();
-
-
-function testConcatTypedArray(type, elems, modulo) {
-  "use strict";
-  var items = new Array(elems);
-  var ta_by_len = new type(elems);
-  for (var i = 0; i < elems; ++i) {
-    ta_by_len[i] = items[i] = modulo === false ? i : elems % modulo;
-  }
-  var ta = new type(items);
-  assertEquals([ta, ta], [].concat(ta, ta));
-  ta[Symbol.isConcatSpreadable] = true;
-  assertEquals(items, [].concat(ta));
-
-  assertEquals([ta_by_len, ta_by_len], [].concat(ta_by_len, ta_by_len));
-  ta_by_len[Symbol.isConcatSpreadable] = true;
-  assertEquals(items, [].concat(ta_by_len));
-
-  // TypedArray with fake `length`.
-  ta = new type(1);
-  var defValue = ta[0];
-  var expected = new Array(4000);
-  expected[0] = defValue;
-
-  Object.defineProperty(ta, "length", { value: 4000 });
-  ta[Symbol.isConcatSpreadable] = true;
-  assertEquals(expected, [].concat(ta));
-}
-
-(function testConcatSmallTypedArray() {
-  var length = 1;
-  testConcatTypedArray(Uint8Array, length, Math.pow(2, 8));
-  testConcatTypedArray(Uint16Array, length, Math.pow(2, 16));
-  testConcatTypedArray(Uint32Array, length,  Math.pow(2, 32));
-  testConcatTypedArray(Float32Array, length, false);
-  testConcatTypedArray(Float64Array, length, false);
-})();
-
-
-(function testConcatLargeTypedArray() {
-  var length = 4000;
-  testConcatTypedArray(Uint8Array, length, Math.pow(2, 8));
-  testConcatTypedArray(Uint16Array, length, Math.pow(2, 16));
-  testConcatTypedArray(Uint32Array, length,  Math.pow(2, 32));
-  testConcatTypedArray(Float32Array, length, false);
-  testConcatTypedArray(Float64Array, length, false);
-})();
-
-
-(function testConcatStrictArguments() {
-  var args = (function(a, b, c) { "use strict"; return arguments; })(1,2,3);
-  args[Symbol.isConcatSpreadable] = true;
-  assertEquals([1, 2, 3, 1, 2, 3], [].concat(args, args));
-
-  Object.defineProperty(args, "length", { value: 6 });
-  assertEquals([1, 2, 3, void 0, void 0, void 0], [].concat(args));
-})();
-
-
-(function testConcatSloppyArguments() {
-  var args = (function(a, b, c) { return arguments; })(1,2,3);
-  args[Symbol.isConcatSpreadable] = true;
-  assertEquals([1, 2, 3, 1, 2, 3], [].concat(args, args));
-
-  Object.defineProperty(args, "length", { value: 6 });
-  assertEquals([1, 2, 3, void 0, void 0, void 0], [].concat(args));
-})();
-
-
-(function testConcatSloppyArgumentsWithDupes() {
-  var args = (function(a, a, a) { return arguments; })(1,2,3);
-  args[Symbol.isConcatSpreadable] = true;
-  assertEquals([1, 2, 3, 1, 2, 3], [].concat(args, args));
-
-  Object.defineProperty(args, "length", { value: 6 });
-  assertEquals([1, 2, 3, void 0, void 0, void 0], [].concat(args));
-})();
-
-
-(function testConcatSloppyArgumentsThrows() {
-  function MyError() {}
-  var args = (function(a) { return arguments; })(1,2,3);
-  Object.defineProperty(args, 0, {
-    get: function() { throw new MyError(); }
-  });
-  args[Symbol.isConcatSpreadable] = true;
-  assertThrows(function() {
-    return [].concat(args, args);
-  }, MyError);
-})();
-
-
-(function testConcatHoleySloppyArguments() {
-  var args = (function(a) { return arguments; })(1,2,3);
-  delete args[1];
-  args[Symbol.isConcatSpreadable] = true;
-  assertEquals([1, void 0, 3, 1, void 0, 3], [].concat(args, args));
-})();
-
-
-(function testConcatSpreadableStringWrapper() {
-  "use strict";
-  var str1 = new String("yuck\uD83D\uDCA9")
-  // String wrapper objects are not concat-spreadable by default
-  assertEquals([str1], [].concat(str1));
-
-  // String wrapper objects may be individually concat-spreadable
-  str1[Symbol.isConcatSpreadable] = true;
-  assertEquals(["y", "u", "c", "k", "\uD83D", "\uDCA9"],
-               [].concat(str1));
-
-  String.prototype[Symbol.isConcatSpreadable] = true;
-  // String wrapper objects may be concat-spreadable
-  assertEquals(["y", "u", "c", "k", "\uD83D", "\uDCA9"],
-               [].concat(new String("yuck\uD83D\uDCA9")));
-
-  // String values are never concat-spreadable
-  assertEquals(["yuck\uD83D\uDCA9"], [].concat("yuck\uD83D\uDCA9"));
-  delete String.prototype[Symbol.isConcatSpreadable];
-})();
-
-
-(function testConcatSpreadableBooleanWrapper() {
-  "use strict";
-  var bool = new Boolean(true)
-  // Boolean wrapper objects are not concat-spreadable by default
-  assertEquals([bool], [].concat(bool));
-
-  // Boolean wrapper objects may be individually concat-spreadable
-  bool[Symbol.isConcatSpreadable] = true;
-  bool.length = 3;
-  bool[0] = 1, bool[1] = 2, bool[2] = 3;
-  assertEquals([1, 2, 3], [].concat(bool));
-
-  Boolean.prototype[Symbol.isConcatSpreadable] = true;
-  // Boolean wrapper objects may be concat-spreadable
-  assertEquals([], [].concat(new Boolean(true)));
-  Boolean.prototype[0] = 1;
-  Boolean.prototype[1] = 2;
-  Boolean.prototype[2] = 3;
-  Boolean.prototype.length = 3;
-  assertEquals([1,2,3], [].concat(new Boolean(true)));
-
-  // Boolean values are never concat-spreadable
-  assertEquals([true], [].concat(true));
-  delete Boolean.prototype[Symbol.isConcatSpreadable];
-  delete Boolean.prototype[0];
-  delete Boolean.prototype[1];
-  delete Boolean.prototype[2];
-  delete Boolean.prototype.length;
-})();
-
-
-(function testConcatSpreadableNumberWrapper() {
-  "use strict";
-  var num = new Number(true)
-  // Number wrapper objects are not concat-spreadable by default
-  assertEquals([num], [].concat(num));
-
-  // Number wrapper objects may be individually concat-spreadable
-  num[Symbol.isConcatSpreadable] = true;
-  num.length = 3;
-  num[0] = 1, num[1] = 2, num[2] = 3;
-  assertEquals([1, 2, 3], [].concat(num));
-
-  Number.prototype[Symbol.isConcatSpreadable] = true;
-  // Number wrapper objects may be concat-spreadable
-  assertEquals([], [].concat(new Number(123)));
-  Number.prototype[0] = 1;
-  Number.prototype[1] = 2;
-  Number.prototype[2] = 3;
-  Number.prototype.length = 3;
-  assertEquals([1,2,3], [].concat(new Number(123)));
-
-  // Number values are never concat-spreadable
-  assertEquals([true], [].concat(true));
-  delete Number.prototype[Symbol.isConcatSpreadable];
-  delete Number.prototype[0];
-  delete Number.prototype[1];
-  delete Number.prototype[2];
-  delete Number.prototype.length;
-})();
-
-
-(function testConcatSpreadableFunction() {
-  "use strict";
-  var fn = function(a, b, c) {}
-  // Functions are not concat-spreadable by default
-  assertEquals([fn], [].concat(fn));
-
-  // Functions may be individually concat-spreadable
-  fn[Symbol.isConcatSpreadable] = true;
-  fn[0] = 1, fn[1] = 2, fn[2] = 3;
-  assertEquals([1, 2, 3], [].concat(fn));
-
-  Function.prototype[Symbol.isConcatSpreadable] = true;
-  // Functions may be concat-spreadable
-  assertEquals([void 0, void 0, void 0], [].concat(function(a,b,c) {}));
-  Function.prototype[0] = 1;
-  Function.prototype[1] = 2;
-  Function.prototype[2] = 3;
-  assertEquals([1,2,3], [].concat(function(a, b, c) {}));
-
-  delete Function.prototype[Symbol.isConcatSpreadable];
-  delete Function.prototype[0];
-  delete Function.prototype[1];
-  delete Function.prototype[2];
-})();
-
-
-(function testConcatSpreadableRegExp() {
-  "use strict";
-  var re = /abc/;
-  // RegExps are not concat-spreadable by default
-  assertEquals([re], [].concat(re));
-
-  // RegExps may be individually concat-spreadable
-  re[Symbol.isConcatSpreadable] = true;
-  re[0] = 1, re[1] = 2, re[2] = 3, re.length = 3;
-  assertEquals([1, 2, 3], [].concat(re));
-
-  // RegExps may be concat-spreadable
-  RegExp.prototype[Symbol.isConcatSpreadable] = true;
-  RegExp.prototype.length = 3;
-
-  assertEquals([void 0, void 0, void 0], [].concat(/abc/));
-  RegExp.prototype[0] = 1;
-  RegExp.prototype[1] = 2;
-  RegExp.prototype[2] = 3;
-  assertEquals([1,2,3], [].concat(/abc/));
-
-  delete RegExp.prototype[Symbol.isConcatSpreadable];
-  delete RegExp.prototype[0];
-  delete RegExp.prototype[1];
-  delete RegExp.prototype[2];
-  delete RegExp.prototype.length;
-})();
-
-
-(function testArrayConcatSpreadableSparseObject() {
-  "use strict";
-  var obj = { length: 5 };
-  obj[Symbol.isConcatSpreadable] = true;
-  assertEquals([void 0, void 0, void 0, void 0, void 0], [].concat(obj));
-
-  obj.length = 4000;
-  assertEquals(new Array(4000), [].concat(obj));
-})();
-
-
-// ES5 tests
-(function testArrayConcatES5() {
-  "use strict";
-  var poses;
-  var pos;
-
-  poses = [140, 4000000000];
-  while (pos = poses.shift()) {
-    var a = new Array(pos);
-    var array_proto = [];
-    a.__proto__ = array_proto;
-    assertEquals(pos, a.length);
-    a.push('foo');
-    assertEquals(pos + 1, a.length);
-    var b = ['bar'];
-    var c = a.concat(b);
-    assertEquals(pos + 2, c.length);
-    assertEquals("undefined", typeof(c[pos - 1]));
-    assertEquals("foo", c[pos]);
-    assertEquals("bar", c[pos + 1]);
-
-    // Can we fool the system by putting a number in a string?
-    var onetwofour = "124";
-    a[onetwofour] = 'doo';
-    assertEquals(a[124], 'doo');
-    c = a.concat(b);
-    assertEquals(c[124], 'doo');
-
-    // If we put a number in the prototype, then the spec says it should be
-    // copied on concat.
-    array_proto["123"] = 'baz';
-    assertEquals(a[123], 'baz');
-
-    c = a.concat(b);
-    assertEquals(pos + 2, c.length);
-    assertEquals("baz", c[123]);
-    assertEquals("undefined", typeof(c[pos - 1]));
-    assertEquals("foo", c[pos]);
-    assertEquals("bar", c[pos + 1]);
-
-    // When we take the number off the prototype it disappears from a, but
-    // the concat put it in c itself.
-    array_proto["123"] = undefined;
-    assertEquals("undefined", typeof(a[123]));
-    assertEquals("baz", c[123]);
-
-    // If the element of prototype is shadowed, the element on the instance
-    // should be copied, but not the one on the prototype.
-    array_proto[123] = 'baz';
-    a[123] = 'xyz';
-    assertEquals('xyz', a[123]);
-    c = a.concat(b);
-    assertEquals('xyz', c[123]);
-
-    // Non-numeric properties on the prototype or the array shouldn't get
-    // copied.
-    array_proto.moe = 'joe';
-    a.ben = 'jerry';
-    assertEquals(a["moe"], 'joe');
-    assertEquals(a["ben"], 'jerry');
-    c = a.concat(b);
-    // ben was not copied
-    assertEquals("undefined", typeof(c.ben));
-
-    // When we take moe off the prototype it disappears from all arrays.
-    array_proto.moe = undefined;
-    assertEquals("undefined", typeof(c.moe));
-
-    // Negative indices don't get concated.
-    a[-1] = 'minus1';
-    assertEquals("minus1", a[-1]);
-    assertEquals("undefined", typeof(a[0xffffffff]));
-    c = a.concat(b);
-    assertEquals("undefined", typeof(c[-1]));
-    assertEquals("undefined", typeof(c[0xffffffff]));
-    assertEquals(c.length, a.length + 1);
-  }
-
-  poses = [140, 4000000000];
-  while (pos = poses.shift()) {
-    var a = new Array(pos);
-    assertEquals(pos, a.length);
-    a.push('foo');
-    assertEquals(pos + 1, a.length);
-    var b = ['bar'];
-    var c = a.concat(b);
-    assertEquals(pos + 2, c.length);
-    assertEquals("undefined", typeof(c[pos - 1]));
-    assertEquals("foo", c[pos]);
-    assertEquals("bar", c[pos + 1]);
-
-    // Can we fool the system by putting a number in a string?
-    var onetwofour = "124";
-    a[onetwofour] = 'doo';
-    assertEquals(a[124], 'doo');
-    c = a.concat(b);
-    assertEquals(c[124], 'doo');
-
-    // If we put a number in the prototype, then the spec says it should be
-    // copied on concat.
-    Array.prototype["123"] = 'baz';
-    assertEquals(a[123], 'baz');
-
-    c = a.concat(b);
-    assertEquals(pos + 2, c.length);
-    assertEquals("baz", c[123]);
-    assertEquals("undefined", typeof(c[pos - 1]));
-    assertEquals("foo", c[pos]);
-    assertEquals("bar", c[pos + 1]);
-
-    // When we take the number off the prototype it disappears from a, but
-    // the concat put it in c itself.
-    Array.prototype["123"] = undefined;
-    assertEquals("undefined", typeof(a[123]));
-    assertEquals("baz", c[123]);
-
-    // If the element of prototype is shadowed, the element on the instance
-    // should be copied, but not the one on the prototype.
-    Array.prototype[123] = 'baz';
-    a[123] = 'xyz';
-    assertEquals('xyz', a[123]);
-    c = a.concat(b);
-    assertEquals('xyz', c[123]);
-
-    // Non-numeric properties on the prototype or the array shouldn't get
-    // copied.
-    Array.prototype.moe = 'joe';
-    a.ben = 'jerry';
-    assertEquals(a["moe"], 'joe');
-    assertEquals(a["ben"], 'jerry');
-    c = a.concat(b);
-    // ben was not copied
-    assertEquals("undefined", typeof(c.ben));
-    // moe was not copied, but we can see it through the prototype
-    assertEquals("joe", c.moe);
-
-    // When we take moe off the prototype it disappears from all arrays.
-    Array.prototype.moe = undefined;
-    assertEquals("undefined", typeof(c.moe));
-
-    // Negative indices don't get concated.
-    a[-1] = 'minus1';
-    assertEquals("minus1", a[-1]);
-    assertEquals("undefined", typeof(a[0xffffffff]));
-    c = a.concat(b);
-    assertEquals("undefined", typeof(c[-1]));
-    assertEquals("undefined", typeof(c[0xffffffff]));
-    assertEquals(c.length, a.length + 1);
-
-  }
-
-  a = [];
-  c = a.concat('Hello');
-  assertEquals(1, c.length);
-  assertEquals("Hello", c[0]);
-  assertEquals("Hello", c.toString());
-
-  // Check that concat preserves holes.
-  var holey = [void 0,'a',,'c'].concat(['d',,'f',[0,,2],void 0])
-  assertEquals(9, holey.length);  // hole in embedded array is ignored
-  for (var i = 0; i < holey.length; i++) {
-    if (i == 2 || i == 5) {
-      assertFalse(i in holey);
-    } else {
-      assertTrue(i in holey);
-    }
-  }
-
-  // Polluted prototype from prior tests.
-  delete Array.prototype[123];
-
-  // Check that concat reads getters in the correct order.
-  var arr1 = [,2];
-  var arr2 = [1,3];
-  var r1 = [].concat(arr1, arr2);  // [,2,1,3]
-  assertEquals([,2,1,3], r1);
-
-  // Make first array change length of second array.
-  Object.defineProperty(arr1, 0, {get: function() {
-        arr2.push("X");
-        return undefined;
-      }, configurable: true})
-  var r2 = [].concat(arr1, arr2);  // [undefined,2,1,3,"X"]
-  assertEquals([undefined,2,1,3,"X"], r2);
-
-  // Make first array change length of second array massively.
-  arr2.length = 2;
-  Object.defineProperty(arr1, 0, {get: function() {
-        arr2[500000] = "X";
-        return undefined;
-      }, configurable: true})
-  var r3 = [].concat(arr1, arr2);  // [undefined,2,1,3,"X"]
-  var expected = [undefined,2,1,3];
-  expected[500000 + 2] = "X";
-
-  assertEquals(expected, r3);
-
-  var arr3 = [];
-  var trace = [];
-  var expectedTrace = []
-  function mkGetter(i) { return function() { trace.push(i); }; }
-  arr3.length = 10000;
-  for (var i = 0; i < 100; i++) {
-    Object.defineProperty(arr3, i * i, {get: mkGetter(i)});
-    expectedTrace[i] = i;
-    expectedTrace[100 + i] = i;
-  }
-  var r4 = [0].concat(arr3, arr3);
-  assertEquals(1 + arr3.length * 2, r4.length);
-  assertEquals(expectedTrace, trace);
-
-  // Clean up.
-  delete Array.prototype[123];
-  delete Array.prototype["123"];
-  delete Array.prototype["moe"];
-})();
-
-
-
-
-////////////////////////////////////////////////////////////////////////////////
-// Tests with proxies
-
-// Note: concat does not currently support species so there is no difference
-// between [].concat(foo) and Array.prototype.concat.apply(foo).
-
-
-var log = [];
-var logger = {};
-var handler = new Proxy({}, logger);
-
-logger.get = function(t, trap, r) {
-  return function(...args) {
-    log.push([trap, ...args]);
-    return Reflect[trap](...args);
-  }
-};
-
-
-(function testUnspreadableNonArrayLikeProxy() {
-  var target = {0: "a", 1: "b"};
-  var obj = new Proxy(target, handler);
-
-  log.length = 0;
-  assertEquals([obj], [].concat(obj));
-  assertEquals(1, log.length);
-  for (var i in log) assertSame(target, log[i][1]);
-  assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
-
-  log.length = 0;
-  assertEquals([obj], Array.prototype.concat.apply(obj));
-  assertEquals(1, log.length);
-  for (var i in log) assertSame(target, log[i][1]);
-  assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
-})();
-
-
-(function testSpreadableNonArrayLikeProxy() {
-  var target = {0: "a", 1: "b", [Symbol.isConcatSpreadable]: "truish"};
-  var obj = new Proxy(target, handler);
-
-  log.length = 0;
-  assertEquals([], [].concat(obj));
-  assertEquals(2, log.length);
-  for (var i in log) assertSame(target, log[i][1]);
-  assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
-  assertEquals(["get", target, "length", obj], log[1]);
-
-  log.length = 0;
-  assertEquals([], Array.prototype.concat.apply(obj));
-  assertEquals(2, log.length);
-  for (var i in log) assertSame(target, log[i][1]);
-  assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
-  assertEquals(["get", target, "length", obj], log[1]);
-
-  target.length = 3;
-
-  log.length = 0;
-  assertEquals(["a", "b", undefined], [].concat(obj));
-  assertEquals(7, log.length);
-  for (var i in log) assertSame(target, log[i][1]);
-  assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
-  assertEquals(["get", target, "length", obj], log[1]);
-  assertEquals(["has", target, "0"], log[2]);
-  assertEquals(["get", target, "0", obj], log[3]);
-  assertEquals(["has", target, "1"], log[4]);
-  assertEquals(["get", target, "1", obj], log[5]);
-  assertEquals(["has", target, "2"], log[6]);
-
-  log.length = 0;
-  assertEquals(["a", "b", undefined], Array.prototype.concat.apply(obj));
-  assertEquals(7, log.length);
-  for (var i in log) assertSame(target, log[i][1]);
-  assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
-  assertEquals(["get", target, "length", obj], log[1]);
-  assertEquals(["has", target, "0"], log[2]);
-  assertEquals(["get", target, "0", obj], log[3]);
-  assertEquals(["has", target, "1"], log[4]);
-  assertEquals(["get", target, "1", obj], log[5]);
-  assertEquals(["has", target, "2"], log[6]);
-})();
-
-
-(function testUnspreadableArrayLikeProxy() {
-  var target = ["a", "b"];
-  target[Symbol.isConcatSpreadable] = "";
-  var obj = new Proxy(target, handler);
-
-  log.length = 0;
-  assertEquals([obj], [].concat(obj));
-  assertEquals(1, log.length);
-  for (var i in log) assertSame(target, log[i][1]);
-  assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
-
-  log.length = 0;
-  assertEquals([obj], Array.prototype.concat.apply(obj));
-  assertEquals(2, log.length);  // An extra read for the constructor
-  for (var i in log) assertSame(target, log[i][1]);
-  assertEquals(["get", target, "constructor", obj], log[0]);
-  assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[1]);
-})();
-
-
-(function testSpreadableArrayLikeProxy() {
-  var target = ["a", "b"];
-  target[Symbol.isConcatSpreadable] = undefined;
-  var obj = new Proxy(target, handler);
-
-  log.length = 0;
-  assertEquals(["a", "b"], [].concat(obj));
-  assertEquals(6, log.length);
-  for (var i in log) assertSame(target, log[i][1]);
-  assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
-  assertEquals(["get", target, "length", obj], log[1]);
-  assertEquals(["has", target, "0"], log[2]);
-  assertEquals(["get", target, "0", obj], log[3]);
-  assertEquals(["has", target, "1"], log[4]);
-  assertEquals(["get", target, "1", obj], log[5]);
-
-  log.length = 0;
-  assertEquals(["a", "b"], Array.prototype.concat.apply(obj));
-  assertEquals(7, log.length);
-  for (var i in log) assertSame(target, log[i][1]);
-  assertEquals(["get", target, "constructor", obj], log[0]);
-  assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[1]);
-  assertEquals(["get", target, "length", obj], log[2]);
-  assertEquals(["has", target, "0"], log[3]);
-  assertEquals(["get", target, "0", obj], log[4]);
-  assertEquals(["has", target, "1"], log[5]);
-  assertEquals(["get", target, "1", obj], log[6]);
-})();
-
-
-(function testSpreadableArrayLikeProxyWithNontrivialLength() {
-  var getTrap = function(t, key) {
-    if (key === "length") return {[Symbol.toPrimitive]() {return 3}};
-    if (key === "2") return "baz";
-    if (key === "3") return "bar";
-  };
-  var target = [];
-  var obj = new Proxy(target, {get: getTrap, has: () => true});
-
-  assertEquals([undefined, undefined, "baz"], [].concat(obj));
-  assertEquals([undefined, undefined, "baz"], Array.prototype.concat.apply(obj))
-})();
-
-
-(function testSpreadableArrayLikeProxyWithBogusLength() {
-  var getTrap = function(t, key) {
-    if (key === "length") return Symbol();
-    if (key === "2") return "baz";
-    if (key === "3") return "bar";
-  };
-  var target = [];
-  var obj = new Proxy(target, {get: getTrap, has: () => true});
-
-  assertThrows(() => [].concat(obj), TypeError);
-  assertThrows(() => Array.prototype.concat.apply(obj), TypeError);
-})();
-
-(function testConcatRevokedProxy() {
-  "use strict";
-  var target = [];
-  var handler = {
-    get(_, name) {
-      if (name === Symbol.isConcatSpreadable) {
-        p.revoke();
-      }
-      return target[name];
-    }
-  }
-
-  p = Proxy.revocable(target, handler);
-  target = {};
-  target.__proto__ = p.proxy;
-  assertThrows(function() { [].concat({ __proto__: p.proxy }); }, TypeError);
-
-  target = [];
-  var p = Proxy.revocable(target, handler);
-  assertThrows(function() { [].concat(p.proxy); }, TypeError);
-})();
diff --git a/deps/v8/test/mjsunit/es6/array-spread-large-holey.js b/deps/v8/test/mjsunit/es6/array-spread-large-holey.js
index c319c187dfab6a..6246ef8f468e1f 100644
--- a/deps/v8/test/mjsunit/es6/array-spread-large-holey.js
+++ b/deps/v8/test/mjsunit/es6/array-spread-large-holey.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 // Test spreading of large holey arrays, which are supposedly allocated in
-// LargeObjectSpace. Holes should be replaced with undefined.
+// OldLargeObjectSpace. Holes should be replaced with undefined.
 
 var arr = new Array(2e5);
 
diff --git a/deps/v8/test/mjsunit/es6/block-sloppy-function.js b/deps/v8/test/mjsunit/es6/block-sloppy-function.js
index 5d22cd85c006c9..00f35d53d1c433 100644
--- a/deps/v8/test/mjsunit/es6/block-sloppy-function.js
+++ b/deps/v8/test/mjsunit/es6/block-sloppy-function.js
@@ -496,6 +496,32 @@
   assertEquals(4, f());
 })();
 
+(function noHoistingIfLetOutsideSimpleCatch() {
+  assertThrows(()=>f, ReferenceError);
+
+  let f = 2;
+
+  assertEquals(2, f);
+
+  try {
+    throw 0;
+  } catch (f) {
+    {
+      assertEquals(4, f());
+
+      function f() {
+        return 4;
+      }
+
+      assertEquals(4, f());
+    }
+
+    assertEquals(0, f);
+  }
+
+  assertEquals(2, f);
+})();
+
 (function noHoistingThroughComplexCatch() {
   try {
     throw 0;
diff --git a/deps/v8/test/mjsunit/es6/classes.js b/deps/v8/test/mjsunit/es6/classes.js
index de7312ce275ed1..eb25f07685f30d 100644
--- a/deps/v8/test/mjsunit/es6/classes.js
+++ b/deps/v8/test/mjsunit/es6/classes.js
@@ -37,7 +37,7 @@
   literal = { __proto__: class {} };
   assertEquals('', literal.__proto__.name);
   assertEquals(
-      '', Object.getOwnPropertyDescriptor(literal.__proto__, 'name').value);
+      undefined, Object.getOwnPropertyDescriptor(literal.__proto__, 'name'));
 
   literal = { __proto__: class F {} };
   assertEquals('F', literal.__proto__.name);
diff --git a/deps/v8/test/mjsunit/es6/default-parameters-destructuring.js b/deps/v8/test/mjsunit/es6/default-parameters-destructuring.js
index 50071f0e346c0a..780185527f3a01 100644
--- a/deps/v8/test/mjsunit/es6/default-parameters-destructuring.js
+++ b/deps/v8/test/mjsunit/es6/default-parameters-destructuring.js
@@ -7,16 +7,16 @@
   var x = 1;
 
   function f41({[eval("var x = 2; 'a'")]: w}, z = x) { return z; }
-  assertEquals(1, f41({}));
-  assertEquals(1, f41({a: 0}));
+  assertEquals(2, f41({}));
+  assertEquals(2, f41({a: 0}));
   function f42({[eval("var x = 2; 'a'")]: w}, z = eval("x")) { return z; }
-  assertEquals(1, f42({}));
-  assertEquals(1, f42({a: 0}));
+  assertEquals(2, f42({}));
+  assertEquals(2, f42({a: 0}));
   function f43({a: w = eval("var x = 2")}, z = x) { return z; }
-  assertEquals(1, f43({}));
+  assertEquals(2, f43({}));
   assertEquals(1, f43({a: 0}));
   function f44({a: w = eval("var x = 2")}, z = eval("x")) { return z; }
-  assertEquals(1, f44({}));
+  assertEquals(2, f44({}));
   assertEquals(1, f44({a: 0}));
 
   function f5({a = eval("var x = 2"), b = x}) { return b; }
@@ -39,16 +39,16 @@
   assertEquals(1, f74({a: 0}));
 
   var g41 = ({[eval("var x = 2; 'a'")]: w}, z = x) => { return z; };
-  assertEquals(1, g41({}));
-  assertEquals(1, g41({a: 0}));
+  assertEquals(2, g41({}));
+  assertEquals(2, g41({a: 0}));
   var g42 = ({[eval("var x = 2; 'a'")]: w}, z = eval("x")) => { return z; };
-  assertEquals(1, g42({}));
-  assertEquals(1, g42({a: 0}));
+  assertEquals(2, g42({}));
+  assertEquals(2, g42({a: 0}));
   var g43 = ({a: w = eval("var x = 2")}, z = x) => { return z; };
-  assertEquals(1, g43({}));
+  assertEquals(2, g43({}));
   assertEquals(1, g43({a: 0}));
   var g44 = ({a: w = eval("var x = 2")}, z = eval("x")) => { return z; };
-  assertEquals(1, g44({}));
+  assertEquals(2, g44({}));
   assertEquals(1, g44({a: 0}));
 
   var g5 = ({a = eval("var x = 2"), b = x}) => { return b; };
diff --git a/deps/v8/test/mjsunit/es6/default-parameters.js b/deps/v8/test/mjsunit/es6/default-parameters.js
index c0fe031c039b76..fcd9cd83db6f32 100644
--- a/deps/v8/test/mjsunit/es6/default-parameters.js
+++ b/deps/v8/test/mjsunit/es6/default-parameters.js
@@ -169,23 +169,23 @@
   var x = 1;
 
   function f1(y = eval("var x = 2")) { with ({}) { return x; } }
-  assertEquals(1, f1());
+  assertEquals(2, f1());
   function f2(y = eval("var x = 2"), z = x) { return z; }
-  assertEquals(1, f2());
+  assertEquals(2, f2());
   assertEquals(1, f2(0));
   function f3(y = eval("var x = 2"), z = eval("x")) { return z; }
-  assertEquals(1, f3());
+  assertEquals(2, f3());
   assertEquals(1, f3(0));
   function f8(y = (eval("var x = 2"), x)) { return y; }
   assertEquals(2, f8());
   assertEquals(0, f8(0));
 
   function f11(z = eval("var y = 2")) { return y; }
-  assertThrows(f11, ReferenceError);
-  function f12(z = eval("var y = 2"), b = y) {}
-  assertThrows(f12, ReferenceError);
-  function f13(z = eval("var y = 2"), b = eval("y")) {}
-  assertThrows(f13, ReferenceError);
+  assertEquals(2, f11());
+  function f12(z = eval("var y = 2"), b = y) { return b; }
+  assertEquals(2, f12());
+  function f13(z = eval("var y = 2"), b = eval("y")) { return b; }
+  assertEquals(2, f13());
 
   function f21(f = () => x) { eval("var x = 2"); return f() }
   assertEquals(1, f21());
@@ -195,23 +195,23 @@
   assertEquals(3, f22(() => 3));
 
   var g1 = (y = eval("var x = 2")) => { with ({}) { return x; } };
-  assertEquals(1, g1());
+  assertEquals(2, g1());
   var g2 = (y = eval("var x = 2"), z = x) => { return z; };
-  assertEquals(1, g2());
+  assertEquals(2, g2());
   assertEquals(1, g2(0));
   var g3 = (y = eval("var x = 2"), z = eval("x")) => { return z; };
-  assertEquals(1, g3());
+  assertEquals(2, g3());
   assertEquals(1, g3(0));
   var g8 = (y = (eval("var x = 2"), x)) => { return y; };
   assertEquals(2, g8());
   assertEquals(0, g8(0));
 
   var g11 = (z = eval("var y = 2")) => { return y; };
-  assertThrows(g11, ReferenceError);
-  var g12 = (z = eval("var y = 2"), b = y) => {};
-  assertThrows(g12, ReferenceError);
-  var g13 = (z = eval("var y = 2"), b = eval("y")) => {};
-  assertThrows(g13, ReferenceError);
+  assertEquals(2, g11());
+  var g12 = (z = eval("var y = 2"), b = y) => { return b; };
+  assertEquals(2, g12());
+  var g13 = (z = eval("var y = 2"), b = eval("y")) => { return b; };
+  assertEquals(2, g13());
 
   var g21 = (f = () => x) => { eval("var x = 2"); return f() };
   assertEquals(1, g21());
diff --git a/deps/v8/test/mjsunit/es6/function-name.js b/deps/v8/test/mjsunit/es6/function-name.js
index 71f4da52f10900..c292edf0cd3be9 100644
--- a/deps/v8/test/mjsunit/es6/function-name.js
+++ b/deps/v8/test/mjsunit/es6/function-name.js
@@ -394,7 +394,7 @@
 })();
 
 (function testClassNameOrder() {
-  assertEquals(['length', 'prototype', 'name'], Object.getOwnPropertyNames(class {}));
+  assertEquals(['length', 'prototype'], Object.getOwnPropertyNames(class {}));
 
   var tmp = {'': class {}};
   var Tmp = tmp[''];
diff --git a/deps/v8/test/mjsunit/es6/generator-destructuring.js b/deps/v8/test/mjsunit/es6/generator-destructuring.js
index 44730ac97065e0..c6623ea0b18859 100644
--- a/deps/v8/test/mjsunit/es6/generator-destructuring.js
+++ b/deps/v8/test/mjsunit/es6/generator-destructuring.js
@@ -162,23 +162,23 @@
   var x = 1;
 
   function* f1(y = eval("var x = 2")) { with ({}) { return x; } }
-  assertEquals(1, f1().next().value);
+  assertEquals(2, f1().next().value);
   function* f2(y = eval("var x = 2"), z = x) { return z; }
-  assertEquals(1, f2().next().value);
+  assertEquals(2, f2().next().value);
   assertEquals(1, f2(0).next().value);
   function* f3(y = eval("var x = 2"), z = eval("x")) { return z; }
-  assertEquals(1, f3().next().value);
+  assertEquals(2, f3().next().value);
   assertEquals(1, f3(0).next().value);
   function* f8(y = (eval("var x = 2"), x)) { return y; }
   assertEquals(2, f8().next().value);
   assertEquals(0, f8(0).next().value);
 
   function* f11(z = eval("var y = 2")) { return y; }
-  assertThrows(() => f11().next(), ReferenceError);
-  function* f12(z = eval("var y = 2"), b = y) {}
-  assertThrows(() => f12().next(), ReferenceError);
-  function* f13(z = eval("var y = 2"), b = eval("y")) {}
-  assertThrows(() => f13().next(), ReferenceError);
+  assertEquals(2, f11().next().value);
+  function* f12(z = eval("var y = 2"), b = y) { return b; }
+  assertEquals(2, f12().next().value);
+  function* f13(z = eval("var y = 2"), b = eval("y")) { return b; }
+  assertEquals(2, f13().next().value);
 
   function* f21(f = () => x) { eval("var x = 2"); return f() }
   assertEquals(1, f21().next().value);
diff --git a/deps/v8/test/mjsunit/es6/global-proto-proxy.js b/deps/v8/test/mjsunit/es6/global-proto-proxy.js
index 8de1a7ae0dde7e..1fcb9fb434e511 100644
--- a/deps/v8/test/mjsunit/es6/global-proto-proxy.js
+++ b/deps/v8/test/mjsunit/es6/global-proto-proxy.js
@@ -8,7 +8,7 @@ var global = this;
   var calledGet = false;
   var calledHas = false;
   var calledSet = false;
-  var target = {};
+  var target = {getGlobal: 1};
   var assertEquals = global.assertEquals;
   var proxy = new Proxy(target, {
     has(target, property) {
@@ -35,7 +35,8 @@ var global = this;
   assertTrue(calledSet);
   "findGlobal" in global;
   assertTrue(calledHas);
+  assertEquals("number", typeof(makeGlobal));
   var deletedOwn = delete makeGlobal;
   assertTrue(deletedOwn);
-  assertEquals(void 0, makeGlobal);
+  assertEquals("undefined", typeof(makeGlobal));
 })();
diff --git a/deps/v8/test/mjsunit/es6/iterator-eager-deopt.js b/deps/v8/test/mjsunit/es6/iterator-eager-deopt.js
index fe004c8c6d4edf..f3425c364a087f 100644
--- a/deps/v8/test/mjsunit/es6/iterator-eager-deopt.js
+++ b/deps/v8/test/mjsunit/es6/iterator-eager-deopt.js
@@ -17,10 +17,9 @@ var iteratorAfterEagerDeoptCount = 0;
 function foo(obj) {
     // The following for-of loop uses the iterator protocol to iterate
     // over the 'obj'.
-    // The GetIterator bytecode invovlves 3 steps:
+    // The GetIterator bytecode invovlves 2 steps:
     // 1. method = GetMethod(obj, @@iterator)
-    // 2. iterator = Call(method, obj)
-    // 3. if(!IsJSReceiver(iterator)) throw SymbolIteratorInvalid.
+    // 2. iterator = Call(method, obj).
     for(var x of obj){}
 }
 
diff --git a/deps/v8/test/mjsunit/es6/iterator-invalid-receiver-opt.js b/deps/v8/test/mjsunit/es6/iterator-invalid-receiver-opt.js
deleted file mode 100644
index fac416b5b5c63b..00000000000000
--- a/deps/v8/test/mjsunit/es6/iterator-invalid-receiver-opt.js
+++ /dev/null
@@ -1,51 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// The GetIterator bytecode is used to implement a part of the iterator
-// protocol (https://tc39.es/ecma262/#sec-getiterator).
-// Here, call to the @@iterator property returns invalid JS receiver.
-// This test ensures that the optimized version of the GetIterator bytecode
-// incorporates exception handling mechanism without deoptimizing.
-
-// Flags: --allow-natives-syntax --opt
-
-var iteratorCount = 0;
-var exceptionCount = 0;
-
-function foo(obj) {
-    // The following for-of loop uses the iterator protocol to iterate
-    // over the 'obj'.
-    // The GetIterator bytecode invovlves 3 steps:
-    // 1. method = GetMethod(obj, @@iterator)
-    // 2. iterator = Call(method, obj)
-    // 3. if(!IsJSReceiver(iterator)) throw SymbolIteratorInvalid.
-     try{
-        for(let a of obj){
-            assertUnreachable();
-        }
-    } catch(e){
-        exceptionCount++;
-    }
-}
-
-// This iterator retuns '3' which is not a valid JSReceiver
-var iterator = function() {
-    iteratorCount++;
-    return 3;
-}
-
-let y = {
-    get [Symbol.iterator]() {
-       return iterator;
-    }
-};
-
-%PrepareFunctionForOptimization(foo);
-foo(y);
-foo(y);
-%OptimizeFunctionOnNextCall(foo);
-foo(y);
-assertOptimized(foo);
-assertEquals(iteratorCount, 3);
-assertEquals(exceptionCount, 3);
diff --git a/deps/v8/test/mjsunit/es6/iterator-lazy-deopt.js b/deps/v8/test/mjsunit/es6/iterator-lazy-deopt.js
index f2b39a208d181e..94edbbc5950a2d 100644
--- a/deps/v8/test/mjsunit/es6/iterator-lazy-deopt.js
+++ b/deps/v8/test/mjsunit/es6/iterator-lazy-deopt.js
@@ -18,10 +18,9 @@ var getIteratorCount = 0;
 function foo(obj) {
     // The following for-of loop uses the iterator protocol to iterate
     // over the 'obj'.
-    // The GetIterator bytecode invovlves 3 steps:
+    // The GetIterator bytecode invovlves 2 steps:
     // 1. method = GetMethod(obj, @@iterator)
-    // 2. iterator = Call(method, obj)
-    // 3. if(!IsJSReceiver(iterator)) throw SymbolIteratorInvalid.
+    // 2. iterator = Call(method, obj).
     for(var x of obj){}
 }
 
diff --git a/deps/v8/test/mjsunit/es6/throw-type-error-function-restrictions.js b/deps/v8/test/mjsunit/es6/throw-type-error-function-restrictions.js
index 0eeb9591b2dbb2..7f67747f2919e5 100644
--- a/deps/v8/test/mjsunit/es6/throw-type-error-function-restrictions.js
+++ b/deps/v8/test/mjsunit/es6/throw-type-error-function-restrictions.js
@@ -5,12 +5,8 @@
 var throwTypeErrorFunction =
     Object.getOwnPropertyDescriptor(Function.prototype, 'arguments').get;
 
-var nameDesc =
-    Object.getOwnPropertyDescriptor(throwTypeErrorFunction, 'name');
-assertEquals('', nameDesc.value);
-assertFalse(nameDesc.configurable);
-assertFalse(nameDesc.enumerable);
-assertFalse(nameDesc.writable);
+assertFalse(
+    Object.prototype.hasOwnProperty.call(throwTypeErrorFunction, 'name'));
 assertThrows(function() {
   'use strict';
   throwTypeErrorFunction.name = 'foo';
diff --git a/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
index e6be924d8e7aa7..444ed0ad0cb6ab 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
@@ -211,8 +211,8 @@ tests.push(function TestFromTypedArraySpeciesDetachsBuffer(constr) {
   assertThrows(() => new constr(a1));
 });
 
-tests.push(function TestLengthIsMaxSmi(constr) {
-  var myObject = { 0: 5, 1: 6, length: %MaxSmi() + 1 };
+tests.push(function TestTypedArrayMaxLength(constr) {
+  var myObject = { 0: 5, 1: 6, length: %TypedArrayMaxLength() + 1 };
 
   assertThrows(function() {
     new constr(myObject);
diff --git a/deps/v8/test/mjsunit/es6/typedarray-detached.js b/deps/v8/test/mjsunit/es6/typedarray-detached.js
index bd8e2a1766a68d..8148e206b34c14 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-detached.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-detached.js
@@ -27,7 +27,8 @@ function TestArrayBufferCreation() {
   assertThrows(function() { new ArrayBuffer(-2.567); }, RangeError);
 
   assertThrows(function() {
-    var ab1 = new ArrayBuffer(0xFFFFFFFFFFFF)
+    let kArrayBufferByteLengthLimit = %ArrayBufferMaxByteLength() + 1;
+    var ab1 = new ArrayBuffer(kArrayBufferByteLengthLimit);
   }, RangeError);
 
   var ab = new ArrayBuffer();
diff --git a/deps/v8/test/mjsunit/es6/typedarray.js b/deps/v8/test/mjsunit/es6/typedarray.js
index 1da65a5d65ff65..4db5276c848b31 100644
--- a/deps/v8/test/mjsunit/es6/typedarray.js
+++ b/deps/v8/test/mjsunit/es6/typedarray.js
@@ -47,7 +47,8 @@ function TestArrayBufferCreation() {
   assertThrows(function() { new ArrayBuffer(-2.567); }, RangeError);
 
   assertThrows(function() {
-    var ab1 = new ArrayBuffer(0xFFFFFFFFFFFF)
+    let kArrayBufferByteLengthLimit = %ArrayBufferMaxByteLength() + 1;
+    var ab1 = new ArrayBuffer(kArrayBufferByteLengthLimit);
   }, RangeError);
 
   var ab = new ArrayBuffer();
@@ -991,8 +992,9 @@ for(i = 0; i < typedArrayConstructors.length; i++) {
 })();
 
 (function TestBufferLengthTooLong() {
+  const kLength = %TypedArrayMaxLength() + 1;
   try {
-    var buf = new ArrayBuffer(2147483648);
+    var buf = new ArrayBuffer(kLength);
   } catch (e) {
     // The ArrayBuffer allocation fails on 32-bit archs, so no need to try to
     // construct the typed array.
diff --git a/deps/v8/test/mjsunit/es8/async-destructuring.js b/deps/v8/test/mjsunit/es8/async-destructuring.js
index d5e90eb0576f0c..232cf5ae78f70d 100644
--- a/deps/v8/test/mjsunit/es8/async-destructuring.js
+++ b/deps/v8/test/mjsunit/es8/async-destructuring.js
@@ -329,23 +329,23 @@ function assertEqualsAsync(expected, run, msg) {
   var x = 1;
 
   async function f1(y = eval("var x = 2")) { with ({}) { return x; } }
-  assertEqualsAsync(1, () => f1());
+  assertEqualsAsync(2, () => f1());
   async function f2(y = eval("var x = 2"), z = x) { return z; }
-  assertEqualsAsync(1, () => f2());
+  assertEqualsAsync(2, () => f2());
   assertEqualsAsync(1, () => f2(0));
   async function f3(y = eval("var x = 2"), z = eval("x")) { return z; }
-  assertEqualsAsync(1, () => f3());
+  assertEqualsAsync(2, () => f3());
   assertEqualsAsync(1, () => f3(0));
   async function f8(y = (eval("var x = 2"), x)) { return y; }
   assertEqualsAsync(2, () => f8());
   assertEqualsAsync(0, () => f8(0));
 
   async function f11(z = eval("var y = 2")) { return y; }
-  assertThrowsAsync(f11, ReferenceError);
-  async function f12(z = eval("var y = 2"), b = y) {}
-  assertThrowsAsync(f12, ReferenceError);
-  async function f13(z = eval("var y = 2"), b = eval("y")) {}
-  assertThrowsAsync(f13, ReferenceError);
+  assertEqualsAsync(2, () => f11());
+  async function f12(z = eval("var y = 2"), b = y) { return b; }
+  assertEqualsAsync(2, () => f12());
+  async function f13(z = eval("var y = 2"), b = eval("y")) { return b; }
+  assertEqualsAsync(2, () => f13());
 
   async function f21(f = () => x) { eval("var x = 2"); return f() }
   assertEqualsAsync(1, () => f21());
@@ -355,23 +355,23 @@ function assertEqualsAsync(expected, run, msg) {
   assertEqualsAsync(3, () => f22(() => 3));
 
   var g1 = async (y = eval("var x = 2")) => { with ({}) { return x; } };
-  assertEqualsAsync(1, () => g1());
+  assertEqualsAsync(2, () => g1());
   var g2 = async (y = eval("var x = 2"), z = x) => { return z; };
-  assertEqualsAsync(1, () => g2());
+  assertEqualsAsync(2, () => g2());
   assertEqualsAsync(1, () => g2(0));
   var g3 = async (y = eval("var x = 2"), z = eval("x")) => { return z; };
-  assertEqualsAsync(1, () => g3());
+  assertEqualsAsync(2, () => g3());
   assertEqualsAsync(1, () => g3(0));
   var g8 = async (y = (eval("var x = 2"), x)) => { return y; };
   assertEqualsAsync(2, () => g8());
   assertEqualsAsync(0, () => g8(0));
 
   var g11 = async (z = eval("var y = 2")) => { return y; };
-  assertThrowsAsync(g11, ReferenceError);
-  var g12 = async (z = eval("var y = 2"), b = y) => {};
-  assertThrowsAsync(g12, ReferenceError);
-  var g13 = async (z = eval("var y = 2"), b = eval("y")) => {};
-  assertThrowsAsync(g13, ReferenceError);
+  assertEqualsAsync(2, () => g11());
+  var g12 = async (z = eval("var y = 2"), b = y) => { return b; };
+  assertEqualsAsync(2, () => g12());
+  var g13 = async (z = eval("var y = 2"), b = eval("y")) => { return b; };
+  assertEqualsAsync(2, () => g13());
 
   var g21 = async (f = () => x) => { eval("var x = 2"); return f() };
   assertEqualsAsync(1, () => g21());
diff --git a/deps/v8/test/mjsunit/fast-prototype.js b/deps/v8/test/mjsunit/fast-prototype.js
index eb3331f6741825..341ea9dc118256 100644
--- a/deps/v8/test/mjsunit/fast-prototype.js
+++ b/deps/v8/test/mjsunit/fast-prototype.js
@@ -91,7 +91,7 @@ function test(use_new, add_first, set__proto__) {
 }
 %EnsureFeedbackVectorForFunction(test);
 
-// TODO(mstarzinger): This test fails easily if gc happens at the wrong time.
+// This test fails easily if gc happens at the wrong time.
 gc();
 
 function test_fast_prototype() {
diff --git a/deps/v8/test/mjsunit/filter-element-kinds.js b/deps/v8/test/mjsunit/filter-element-kinds.js
index 24dd31a5d11a82..f3243e939359dc 100644
--- a/deps/v8/test/mjsunit/filter-element-kinds.js
+++ b/deps/v8/test/mjsunit/filter-element-kinds.js
@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --expose-gc --opt --no-always-opt
+// Flags: --no-force-slow-path
 
 var elements_kind = {
   fast_smi_only            :  'fast smi only elements',
diff --git a/deps/v8/test/mjsunit/for-in-special-cases.js b/deps/v8/test/mjsunit/for-in-special-cases.js
index 27129e1aac7161..744c948b94beba 100644
--- a/deps/v8/test/mjsunit/for-in-special-cases.js
+++ b/deps/v8/test/mjsunit/for-in-special-cases.js
@@ -141,3 +141,149 @@ for_in_string_prototype();
     assertEquals(['prop2', 'prop1'], Accumulate(derived2));
   }
 })();
+
+(function for_in_prototype_itself_change() {
+  let prototype1 = {prop: 0, prop1: 1};
+  let derived1 = {prop2: 2, prop3: 3};
+
+  Object.setPrototypeOf(derived1, prototype1);
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop2', 'prop3', 'prop', 'prop1'], Accumulate(derived1));
+  }
+
+  prototype1.prop3 = 3;
+  let derived2 = {prop4: 4, prop5: 5};
+  Object.setPrototypeOf(derived2, prototype1);
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop4', 'prop5', 'prop', 'prop1', 'prop3'], Accumulate(derived2));
+  }
+})();
+
+(function for_in_prototype_change_property() {
+  let prototype1 = {prop: 0, prop1: 1};
+  let derived1 = {prop2: 2, prop3: 3};
+
+  Object.setPrototypeOf(derived1, prototype1);
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop2', 'prop3', 'prop', 'prop1'], Accumulate(derived1));
+  }
+
+  prototype1.__proto__ = {prop4: 4, prop5: 5};
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop2', 'prop3', 'prop', 'prop1', 'prop4', 'prop5'], Accumulate(derived1));
+  }
+
+  derived1.__proto__ = {prop6: 6, prop7: 7};
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop2', 'prop3', 'prop6', 'prop7'], Accumulate(derived1));
+  }
+})();
+
+(function for_in_prototype_change_element() {
+  let prototype1 = {prop: 0, prop1: 1};
+  let derived1 = {prop2: 2, prop3: 3};
+
+  Object.setPrototypeOf(derived1, prototype1);
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop2', 'prop3', 'prop', 'prop1'], Accumulate(derived1));
+  }
+
+  prototype1[0] = 4;
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop2', 'prop3', '0', 'prop', 'prop1'], Accumulate(derived1));
+  }
+
+  derived1.__proto__ = {1: 1, 3: 3};
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop2', 'prop3', '1', '3'], Accumulate(derived1));
+  }
+})();
+
+(function for_in_non_enumerable1() {
+  let prototype1 = {prop: 0};
+  let derived1 = Object.create(prototype1, {
+    prop1: {enumerable: false, configurable: true, value: 1},
+  });
+  Object.setPrototypeOf(derived1, prototype1);
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop'], Accumulate(derived1));
+  }
+
+  let derived2 = {prop2: 2};
+  Object.setPrototypeOf(derived2, prototype1);
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop2', 'prop'], Accumulate(derived2));
+  }
+})();
+
+(function for_in_non_enumerable2() {
+  let prototype1 = {prop: 0};
+  let derived1 = {prop1: 1};
+  Object.setPrototypeOf(derived1, prototype1);
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop1', 'prop'], Accumulate(derived1));
+  }
+
+  let derived2 = Object.create(prototype1, {
+    prop: {enumerable: false, configurable: true, value: 0},
+    prop2: {enumerable: true, configurable: true, value: 2}
+  });
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop2'], Accumulate(derived2));
+  }
+})();
+
+(function for_in_same_key1() {
+  let prototype1 = {prop: 0, prop1: 1};
+  let derived1 = {prop: 0, prop2: 1};
+  Object.setPrototypeOf(derived1, prototype1);
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop', 'prop2', 'prop1'], Accumulate(derived1));
+  }
+
+  let derived2 = {prop3: 3, prop4: 4};
+  Object.setPrototypeOf(derived2, prototype1);
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop3', 'prop4', 'prop', 'prop1'], Accumulate(derived2));
+  }
+})();
+
+(function for_in_same_key2() {
+  let prototype1 = {prop: 0, prop1: 1};
+  let derived1 = {prop2: 2, prop3: 3};
+  Object.setPrototypeOf(derived1, prototype1);
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop2', 'prop3', 'prop', 'prop1'], Accumulate(derived1));
+  }
+
+  let derived2 = {prop: 0, prop4: 4};
+  Object.setPrototypeOf(derived2, prototype1);
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop', 'prop4', 'prop1'], Accumulate(derived2));
+  }
+})();
+
+(function for_in_redefine_property() {
+  Object.prototype.prop = 0;
+  let object1 = {prop1: 1, prop2: 2};
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop1', 'prop2', 'prop'], Accumulate(object1));
+  }
+
+  let object2 = {prop3: 3, prop4: 4};
+  Object.defineProperty(object2,
+    'prop', {enumerable: false, configurable: true, value: 0});
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop3', 'prop4'], Accumulate(object2));
+  }
+})();
+
+(function for_in_empty_property() {
+  let prototype1 = {prop: 0};
+  let derived1 = Object.create(prototype1, {
+    prop: {enumerable: false, configurable: true, value: 0}
+  });
+  for (let i = 0; i < 3; i++) {
+    assertEquals([], Accumulate(derived1));
+  }
+})();
diff --git a/deps/v8/test/mjsunit/global-load-with-proxy.js b/deps/v8/test/mjsunit/global-load-with-proxy.js
new file mode 100644
index 00000000000000..6f0c2df8e2c823
--- /dev/null
+++ b/deps/v8/test/mjsunit/global-load-with-proxy.js
@@ -0,0 +1,183 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var get_count = 0;
+var has_count = 0;
+var property_descriptor_count = 0;
+globalThis.__proto__ = new Proxy({},
+                                 {get() {get_count++},
+                                  has() {has_count++;},
+                                  getOwnPropertyDescriptor() {property_desciptor_count++}});
+function checkCounts(count) {
+  assertEquals(has_count, count);
+  assertEquals(get_count, 0);
+  assertEquals(property_descriptor_count, 0);
+}
+
+function load_lookup_global_error() {
+  eval("var b = 10");
+  x;
+}
+assertThrows(load_lookup_global_error, ReferenceError);
+checkCounts(1);
+
+%EnsureFeedbackVectorForFunction(load_lookup_global_error);
+assertThrows(load_lookup_global_error, ReferenceError);
+checkCounts(2);
+assertThrows(load_lookup_global_error, ReferenceError);
+checkCounts(3);
+
+function load_global_error() {
+  x;
+}
+assertThrows(load_global_error, ReferenceError);
+checkCounts(4);
+
+%EnsureFeedbackVectorForFunction(load_global_error);
+assertThrows(load_global_error, ReferenceError);
+checkCounts(5);
+assertThrows(load_global_error, ReferenceError);
+checkCounts(6);
+
+
+// Check when the object is present on the proxy.
+get_count = 0;
+has_count = 0;
+property_descriptor_count = 0;
+
+globalThis.__proto__ = new Proxy({},
+                                 {get() {get_count++; return 10;},
+                                  has() {has_count++; return true;},
+                                  getOwnPropertyDescriptor() {property_desciptor_count++}});
+function checkCountsWithGet(count) {
+  assertEquals(has_count, count);
+  assertEquals(get_count, count);
+  assertEquals(property_descriptor_count, 0);
+}
+
+function load_lookup_global() {
+  eval("var b = 10");
+  return x;
+}
+assertEquals(load_lookup_global(), 10);
+checkCountsWithGet(1);
+
+%EnsureFeedbackVectorForFunction(load_lookup_global);
+assertEquals(load_lookup_global(), 10);
+checkCountsWithGet(2);
+assertEquals(load_lookup_global(), 10);
+checkCountsWithGet(3);
+
+function load_global() {
+  return x;
+}
+assertEquals(load_global(), 10);
+checkCountsWithGet(4);
+
+%EnsureFeedbackVectorForFunction(load_global);
+assertEquals(load_global(), 10);
+checkCountsWithGet(5);
+assertEquals(load_global(), 10);
+checkCountsWithGet(6);
+
+// Check unbound variable access inside typeof
+get_count = 0;
+has_count = 0;
+property_descriptor_count = 0;
+
+globalThis.__proto__ = new Proxy({},
+                                 {get() {get_count++},
+                                  has() {has_count++;},
+                                  getOwnPropertyDescriptor() {property_desciptor_count++}});
+function checkCountsInsideTypeof(count) {
+  assertEquals(has_count, count);
+  assertEquals(get_count, 0);
+  assertEquals(property_descriptor_count, 0);
+}
+
+function load_lookup_inside_typeof() {
+  eval("var b = 10");
+  return typeof(x);
+}
+assertEquals(load_lookup_inside_typeof(), "undefined");
+checkCountsInsideTypeof(1);
+
+%EnsureFeedbackVectorForFunction(load_lookup_inside_typeof);
+assertEquals(load_lookup_inside_typeof(), "undefined");
+checkCountsInsideTypeof(2);
+assertEquals(load_lookup_inside_typeof(), "undefined");
+checkCountsInsideTypeof(3);
+
+function load_inside_typeof() {
+  return typeof(x);
+}
+assertEquals(load_inside_typeof(), "undefined");
+checkCountsInsideTypeof(4);
+
+%EnsureFeedbackVectorForFunction(load_inside_typeof);
+assertEquals(load_inside_typeof(), "undefined");
+checkCountsInsideTypeof(5);
+assertEquals(load_inside_typeof(), "undefined");
+checkCountsInsideTypeof(6);
+
+// Check bound variable access inside typeof
+get_count = 0;
+has_count = 0;
+property_descriptor_count = 0;
+
+globalThis.__proto__ = new Proxy({},
+                                 {get() {get_count++; return 10;},
+                                  has() {has_count++; return true;},
+                                  getOwnPropertyDescriptor() {property_desciptor_count++}});
+
+function checkCountsBoundVarInsideTypeof(count) {
+  assertEquals(has_count, count);
+  assertEquals(get_count, count);
+  assertEquals(property_descriptor_count, 0);
+}
+
+function load_lookup_number_inside_typeof() {
+  eval("var b = 10");
+  return typeof(x);
+}
+assertEquals(load_lookup_number_inside_typeof(), "number");
+checkCountsBoundVarInsideTypeof(1);
+
+%EnsureFeedbackVectorForFunction(load_lookup_number_inside_typeof);
+assertEquals(load_lookup_number_inside_typeof(), "number");
+checkCountsBoundVarInsideTypeof(2);
+assertEquals(load_lookup_number_inside_typeof(), "number");
+checkCountsBoundVarInsideTypeof(3);
+
+function load_number_inside_typeof() {
+  return typeof(x);
+}
+assertEquals(load_number_inside_typeof(), "number");
+checkCountsBoundVarInsideTypeof(4);
+
+%EnsureFeedbackVectorForFunction(load_inside_typeof);
+assertEquals(load_number_inside_typeof(), "number");
+checkCountsBoundVarInsideTypeof(5);
+assertEquals(load_number_inside_typeof(), "number");
+checkCountsBoundVarInsideTypeof(6);
+
+// Check that if has property returns true we don't throw even when get property
+// says otherwise.
+
+globalThis.__proto__ = new Proxy({},
+                                 {has() {has_count++; return true;},
+                                  getOwnPropertyDescriptor() {property_desciptor_count++}});
+
+function load_lookup_global_has_property() {
+  eval("var b = 10");
+  return x;
+}
+assertEquals(load_lookup_global_has_property(), undefined);
+
+function load_global_has_property() {
+  return x;
+}
+assertEquals(load_global_has_property(), undefined);
diff --git a/deps/v8/test/mjsunit/harmony/bigint/property-names.js b/deps/v8/test/mjsunit/harmony/bigint/property-names.js
new file mode 100644
index 00000000000000..8c1763053ce5a9
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/bigint/property-names.js
@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var { 9007199254740991n: it } = { 9007199254740991n: 1 };
+
+assertEquals(it, 1);
diff --git a/deps/v8/test/mjsunit/harmony/eval-param-scoping.js b/deps/v8/test/mjsunit/harmony/eval-param-scoping.js
new file mode 100644
index 00000000000000..b69314ced4d717
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/eval-param-scoping.js
@@ -0,0 +1,24 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f0(a = eval("var b"), b) { }
+assertThrows(f0, SyntaxError);
+
+function f1(a = eval("var b = 0"), b) { }
+assertThrows(f1, SyntaxError);
+
+function f2(a = eval("function b(){}"), b) { }
+assertThrows(f2, SyntaxError);
+
+function f3(a = eval("{ function b(){} }"), b) { return b }
+assertEquals(undefined, f3());
+
+function f4(b, a = eval("var b = 0")) { return b }
+assertThrows(f4, SyntaxError);
+
+function f5(b, a = eval("function b(){}")) { return b }
+assertThrows(f5, SyntaxError);
+
+function f6(b, a = eval("{ function b(){} }")) { return b }
+assertEquals(42, f6(42));
diff --git a/deps/v8/test/mjsunit/harmony/optional-chaining-this.js b/deps/v8/test/mjsunit/harmony/optional-chaining-this.js
new file mode 100644
index 00000000000000..bc5497e274c33d
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/optional-chaining-this.js
@@ -0,0 +1,24 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-optional-chaining
+
+const o = { m() { return this; }, p: 42 };
+const p = { o: o };
+
+function id(x) { return x; }
+
+assertEquals(o?.m().p, 42);
+assertEquals((o?.m)().p, 42);
+assertEquals(o?.m(), (o?.m)());
+assertEquals(p?.o?.m().p, 42);
+assertEquals((p?.o?.m)().p, 42);
+assertEquals(p?.o?.m(), (p?.o?.m)());
+
+assertEquals(o?.[id('m')]().p, 42);
+assertEquals((o?.[id('m')])().p, 42);
+assertEquals(o?.[id('m')](), (o?.[id('m')])());
+assertEquals(p?.[id('o')]?.[id('m')]().p, 42);
+assertEquals((p?.[id('o')]?.[id('m')])().p, 42);
+assertEquals(p?.[id('o')]?.[id('m')](), (p?.[id('o')]?.[id('m')])());
diff --git a/deps/v8/test/mjsunit/harmony/optional-chaining.js b/deps/v8/test/mjsunit/harmony/optional-chaining.js
index 72b0559e0042ae..a6121f5fcbb17f 100644
--- a/deps/v8/test/mjsunit/harmony/optional-chaining.js
+++ b/deps/v8/test/mjsunit/harmony/optional-chaining.js
@@ -101,6 +101,7 @@ shouldThrowSyntaxError('function foo() { new?.target; }');
 
 shouldThrowSyntaxError('function tag() {} tag?.``;');
 shouldThrowSyntaxError('const o = { tag() {} }; o?.tag``;');
+shouldThrowSyntaxError('class A { #foo = "hi"; constructor() { this?.#foo; } }')
 
 const o2 = {
   count: 0,
diff --git a/deps/v8/test/mjsunit/harmony/regexp-match-indices.js b/deps/v8/test/mjsunit/harmony/regexp-match-indices.js
index cc3710ce7ecd3d..61d3c9d0d01679 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-match-indices.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-match-indices.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --harmony-regexp-match-indices
+// Flags: --harmony-regexp-match-indices --expose-gc --stack-size=100
 
 // Sanity test.
 {
@@ -103,3 +103,44 @@
 
   assertEquals(m.indices.groups, {'Z': [4, 5]})
 }
+
+// Test atomic regexp.
+{
+  const m = /undefined/.exec();
+
+  assertEquals(m.indices, [[0, 9]]);
+}
+
+// Test deleting unrelated fields does not break.
+{
+  const m = /undefined/.exec();
+  delete m['index'];
+  gc();
+  assertEquals(m.indices, [[0, 9]]);
+}
+
+// Stack overflow.
+{
+  const re = /a+(?<Z>z)?/;
+  const m = re.exec("xaaaz");
+
+  function rec() {
+    try {
+      return rec();
+    } catch (e) {
+      assertEquals(m.indices, [[1, 5], [4, 5]]);
+      assertEquals(m.indices.groups, {'Z': [4, 5]})
+      return true;
+    }
+  }
+  assertTrue(rec());
+}
+
+// Match between matches.
+{
+  const re = /a+(?<A>zz)?(?<B>ii)?/;
+  const m = re.exec("xaaazzii");
+  assertTrue(/b+(?<C>cccc)?/.test("llllllbbbbbbcccc"));
+  assertEquals(m.indices, [[1, 8], [4, 6], [6, 8]]);
+  assertEquals(m.indices.groups, {'A': [4, 6], 'B': [6, 8]});
+}
diff --git a/deps/v8/test/mjsunit/harmony/sharedarraybuffer.js b/deps/v8/test/mjsunit/harmony/sharedarraybuffer.js
index 6fa8494f886df7..7b66118a73f22f 100644
--- a/deps/v8/test/mjsunit/harmony/sharedarraybuffer.js
+++ b/deps/v8/test/mjsunit/harmony/sharedarraybuffer.js
@@ -25,8 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --harmony-sharedarraybuffer
-
+// Flags: --harmony-sharedarraybuffer --allow-natives-syntax
 
 // SharedArrayBuffer
 
@@ -48,7 +47,8 @@ function TestArrayBufferCreation() {
   assertThrows(function() { new SharedArrayBuffer(-2.567); }, RangeError);
 
   assertThrows(function() {
-    var ab1 = new SharedArrayBuffer(0xFFFFFFFFFFFF)
+    let kArrayBufferByteLengthLimit = %ArrayBufferMaxByteLength() + 1;
+    var ab1 = new SharedArrayBuffer(kArrayBufferByteLengthLimit);
   }, RangeError);
 
   var sab = new SharedArrayBuffer();
diff --git a/deps/v8/test/mjsunit/harmony/string-matchAll.js b/deps/v8/test/mjsunit/harmony/string-matchAll.js
index 39c2d0dfe3cfd2..e9b39ba46c3b70 100644
--- a/deps/v8/test/mjsunit/harmony/string-matchAll.js
+++ b/deps/v8/test/mjsunit/harmony/string-matchAll.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 (function TestReceiverNonString() {
-  const iter = 'a'.matchAll(/./);
+  const iter = 'a'.matchAll(/./g);
   assertThrows(
     () => iter.next.call(0),
     TypeError
@@ -12,7 +12,7 @@
 
 
 (function TestAncestry() {
-  const iterProto = Object.getPrototypeOf('a'.matchAll(/./));
+  const iterProto = Object.getPrototypeOf('a'.matchAll(/./g));
   const arrProto = Object.getPrototypeOf([][Symbol.iterator]());
 
   assertSame(Object.getPrototypeOf(iterProto), Object.getPrototypeOf(arrProto));
@@ -24,20 +24,14 @@ function TestNoMatch(string, regex_or_string) {
   assertSame(undefined, next_result.value);
   assertTrue(next_result.done);
 }
-TestNoMatch('a', /b/);
 TestNoMatch('a', /b/g);
 TestNoMatch('a', 'b');
 
 
 (function NonGlobalRegex() {
-  const iter = 'ab'.matchAll(/./);
-  let next_result = iter.next();
-  assertEquals(['a'], next_result.value);
-  assertFalse(next_result.done);
-
-  next_result = iter.next();
-  assertEquals(undefined, next_result.value);
-  assertTrue(next_result.done);
+  assertThrows(
+      () => { const iter = 'ab'.matchAll(/./); },
+      TypeError);
 })();
 
 
diff --git a/deps/v8/test/mjsunit/harmony/string-replaceAll.js b/deps/v8/test/mjsunit/harmony/string-replaceAll.js
new file mode 100644
index 00000000000000..644f7406f04cd0
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/string-replaceAll.js
@@ -0,0 +1,109 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --harmony-string-replaceall --allow-natives-syntax
+
+assertEquals('a-b-c-d', 'a+b+c+d'.replaceAll('+', '-'));
+assertEquals('aaaa', 'abcd'.replaceAll(/./g, 'a'));
+assertEquals('', ''.replaceAll('a', 'b'));
+assertEquals('b', ''.replaceAll('', 'b'));
+assertEquals('_x_x_x_', 'xxx'.replaceAll('', '_'));
+assertEquals('yx', 'xxx'.replaceAll('xx', 'y'));
+assertEquals('xxxx', 'xx'.replaceAll('xx', '$&$&'));
+assertEquals('ii', '.+*$.+*$'.replaceAll('.+*$', 'i'));
+
+{
+  // Non regexp search value with replace method.
+  const nonRegExpSearchValue = {
+    [Symbol.replace]: (string, replacer) => {
+      assertEquals(string, 'barbar');
+      assertEquals(replacer, 'moo');
+      return 'foo'
+    },
+    toString: () => {
+      // Verify toString is not called.
+      unreachable();
+    }
+  };
+  assertEquals('foo', 'barbar'.replaceAll(nonRegExpSearchValue, 'moo'));
+}
+
+{
+  // A custom regexp with non coercible flags.
+  class RegExpNonCoercibleFlags extends RegExp {
+    constructor() {
+      super();
+    }
+
+    static get [Symbol.species]() {
+      return RegExp;
+    }
+
+    get flags() { return null; }
+  };
+  assertThrows(
+      () => { assertEquals(
+          'foo',
+          'barbar'.replaceAll(new RegExpNonCoercibleFlags, 'moo')); },
+      TypeError);
+}
+
+{
+  // Non regexp search value with replace property
+  const nonRegExpSearchValue = {
+    [Symbol.replace]: "doh",
+    toString: () => {
+      // Verify toString is not called.
+      unreachable();
+    }
+  };
+  assertThrows(
+      () => { 'barbar'.replaceAll(nonRegExpSearchValue, 'moo'); },
+      TypeError);
+}
+
+{
+  // Non callable, non string replace value.
+  const nonCallableNonStringReplace = {
+    toString: () => {
+      return 'boo';
+    },
+  };
+  assertEquals('booboo', 'moomoo'.replaceAll('moo', nonCallableNonStringReplace));
+}
+
+{
+  const positions = [];
+  assertEquals('bcb', 'aca'.replaceAll('a',
+                                       (searchString, position, string) => {
+    assertEquals('a', searchString);
+    assertEquals('aca', string);
+    positions.push(position);
+    return 'b';
+  }));
+  assertEquals(positions, [0,2]);
+}
+
+(function NonGlobalRegex() {
+  assertThrows(
+      () => { 'ab'.replaceAll(/./, '.'); },
+      TypeError);
+  assertThrows(
+      () => { 'ab'.replaceAll(/./y, '.'); },
+      TypeError);
+})();
+
+// Tests for stickiness gotcha.
+assertEquals('o ppercase!', 'No Uppercase!'.replaceAll(/[A-Z]/g,  ''));
+assertEquals('o Uppercase?', 'No Uppercase?'.replaceAll(/[A-Z]/gy, ''));
+assertEquals(' UPPERCASE!', 'NO UPPERCASE!'.replaceAll(/[A-Z]/gy, ''));
+
+// Tests for slow path.
+assertEquals('a', 'a'.replaceAll(%ConstructConsString('abcdefghijklmn',
+                                                      'def'), 'b'));
+assertEquals('b', 'abcdefghijklmndef'.replaceAll(
+    %ConstructConsString('abcdefghijklmn', 'def'), 'b'));
+
+assertEquals('aaaaaaaaaaaaaaaaaa', 'aaaaaaaaaaaaaaaaaa'.replaceAll(
+    %ConstructConsString('abcdefghijklmn', 'def'), 'b'));
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/weak-unregistertoken.js b/deps/v8/test/mjsunit/harmony/weakrefs/weak-unregistertoken.js
new file mode 100644
index 00000000000000..8fdc803c560ba7
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/weak-unregistertoken.js
@@ -0,0 +1,22 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+var FG = new FinalizationGroup (function (iter) { globalThis.FGRan = true; });
+{
+  let obj = {};
+  // obj is its own unregister token and becomes unreachable after this
+  // block. If the unregister token is held strongly this test will not
+  // terminate.
+  FG.register(obj, 42, obj);
+}
+function tryAgain() {
+  gc();
+  if (globalThis.FGRan || FG.cleanupSome()) {
+    return;
+  }
+  setTimeout(tryAgain, 0);
+}
+tryAgain();
diff --git a/deps/v8/test/mjsunit/measure-memory-multiple-realms.js b/deps/v8/test/mjsunit/measure-memory-multiple-realms.js
new file mode 100644
index 00000000000000..8029a4acfb70f0
--- /dev/null
+++ b/deps/v8/test/mjsunit/measure-memory-multiple-realms.js
@@ -0,0 +1,42 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+load('test/mjsunit/mjsunit.js');
+
+function assertLessThanOrEqual(a, b) {
+  assertTrue(a <= b, `Expected ${a} <= ${b}`);
+}
+
+function createRealmAndAllocate(bytes) {
+  let realm = Realm.createAllowCrossRealmAccess();
+  Realm.eval(realm, `
+    this.numbers = [.1];
+    for (let i = 0; i < ${bytes} / 8; ++i) {
+      this.numbers.push(0.1);
+    }
+  `);
+}
+
+if (this.performance && performance.measureMemory) {
+  let number_of_realms = 3;
+  let realms = [];
+  let bytes_to_allocate = 1024 * 1024;
+  for (let i = 0; i < number_of_realms; i++) {
+    realms.push(createRealmAndAllocate(bytes_to_allocate));
+  }
+  assertPromiseResult((async () => {
+    let result = await performance.measureMemory({detailed: true});
+    print(JSON.stringify(result));
+    assertEquals(number_of_realms, result.other.length);
+    for (let other of result.other) {
+      // TODO(ulan): compare against bytes_to_allocate once
+      // we have more accurate native context inference.
+      assertLessThanOrEqual(0, other.jsMemoryEstimate);
+    }
+  })());
+  // Force a GC to complete memory measurement.
+  gc();
+}
diff --git a/deps/v8/test/mjsunit/measure-memory.js b/deps/v8/test/mjsunit/measure-memory.js
new file mode 100644
index 00000000000000..9160b372ccf65f
--- /dev/null
+++ b/deps/v8/test/mjsunit/measure-memory.js
@@ -0,0 +1,59 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+load('test/mjsunit/mjsunit.js');
+
+function assertLessThanOrEqual(a, b) {
+  assertTrue(a <= b, `Expected ${a} <= ${b}`);
+}
+
+function checkMeasureMemoryResultField(field) {
+  assertTrue('jsMemoryEstimate' in field);
+  assertTrue('jsMemoryRange' in field);
+  assertEquals('number', typeof field.jsMemoryEstimate);
+  assertEquals(2, field.jsMemoryRange.length);
+  assertEquals('number', typeof field.jsMemoryRange[0]);
+  assertEquals('number', typeof field.jsMemoryRange[1]);
+  assertLessThanOrEqual(field.jsMemoryRange[0],
+                        field.jsMemoryRange[1]);
+  assertLessThanOrEqual(field.jsMemoryRange[0],
+                        field.jsMemoryEstimate);
+  assertLessThanOrEqual(field.jsMemoryEstimate,
+                        field.jsMemoryRange[1]);
+}
+
+function checkMeasureMemoryResult(result, detailed) {
+  assertTrue('total' in result);
+  checkMeasureMemoryResultField(result.total);
+  if (detailed) {
+    assertTrue('current' in result);
+    checkMeasureMemoryResultField(result.current);
+    assertTrue('other' in result);
+    for (let other of result.other) {
+      checkMeasureMemoryResultField(other);
+    }
+  }
+}
+
+if (this.performance && performance.measureMemory) {
+  assertPromiseResult((async () => {
+    let result = await performance.measureMemory();
+    checkMeasureMemoryResult(result, false);
+  })());
+
+  assertPromiseResult((async () => {
+    let result = await performance.measureMemory({detailed: false});
+    checkMeasureMemoryResult(result, false);
+  })());
+
+  assertPromiseResult((async () => {
+    let result = await performance.measureMemory({detailed: true});
+    print(JSON.stringify(result));
+    checkMeasureMemoryResult(result, true);
+  })());
+  // Force a GC to complete memory measurement.
+  gc();
+}
diff --git a/deps/v8/test/mjsunit/mjsunit.status b/deps/v8/test/mjsunit/mjsunit.status
index 4fbc027c69c1a7..a5bae5476d7350 100644
--- a/deps/v8/test/mjsunit/mjsunit.status
+++ b/deps/v8/test/mjsunit/mjsunit.status
@@ -39,109 +39,57 @@
   'bugs/*': [FAIL],
 
   ##############################################################################
-  # Fails.
-  'regress/regress-1119': [FAIL],
+  # Open bugs.
 
-  # Issue 1719: Slow to collect arrays over several contexts.
-  'regress/regress-524': [SKIP],
-  # When that bug is fixed, revert the expectation to:
-  # Skip long running test in debug.
-  # regress/regress-524: [PASS, ['mode == debug', SKIP]],
-
-  # This test non-deterministically runs out of memory on Windows ia32.
-  'regress/regress-crbug-160010': [SKIP],
+  # BUG(v8:2989).
+  'regress/regress-2989': [FAIL, NO_VARIANTS, ['lite_mode == True', SKIP]],
 
   # Issue 3784: setters-on-elements is flaky
   'setters-on-elements': [PASS, FAIL],
 
-  # Issue 9380: Memory leaks of shared WebAssembly.Memory objects
-  'wasm/shared-memory-worker-gc': [SKIP],
-
-  ##############################################################################
-  # Too slow in debug mode with --stress-opt mode.
-  'regress/regress-create-exception': [PASS, ['mode == debug', SKIP]],
-
-  ##############################################################################
-  # Too slow in debug mode for validation of elements.
-  'regress/regress-430201': [PASS, ['mode == debug', SKIP], ['tsan', SKIP]],
-  'regress/regress-430201b': [PASS, ['mode == debug', SKIP]],
-  'regress/regress-716044': [PASS, ['mode == debug', SKIP]],
+  # https://crbug.com/v8/7697
+  'array-literal-feedback': [PASS, FAIL],
 
-  ##############################################################################
-  # Too slow in debug mode for GC stress mode.
-  'regress/regress-crbug-217858': [PASS, ['mode == debug', SKIP]],
+  # https://crbug.com/v8/7775
+  'allocation-site-info': [SKIP],
 
-  # Too slow in debug mode and under turbofan.
-  'regress/regress-4595': [PASS, NO_VARIANTS, ['mode == debug', SKIP]],
+  # BUG(v8:8169)
+  'external-backing-store-gc': [SKIP],
 
-  # Too slow in debug mode, due to large allocations.
-  'regress/regress-crbug-941743': [PASS, ['mode == debug', SKIP], ['(arch == arm or arch == arm64 or arch == mipsel or arch == mips64el) and simulator_run == True', SKIP]],
+  # BUG(v8:9260)
+  'tools/profviz': [SKIP],
 
-  # Too slow in debug mode BUG(v8:9506): times out.
-  'wasm/shared-memory-worker-explicit-gc-stress': [PASS, ['mode == debug', SKIP], ['tsan', SKIP]],
-  'wasm/shared-memory-worker-gc-stress': [PASS, ['mode == debug', SKIP]],
+  # Issue 9380: Memory leaks of shared WebAssembly.Memory objects
+  'wasm/shared-memory-worker-gc': [SKIP],
 
-  # Slow in simulator runs.
-  'random-bit-correlations': [PASS, ['simulator_run == True', SLOW]],
+  # crbug.com/v8/10120: This test is meant to pass (only) in no_i18n builds,
+  # but currently doesn't:
+  'es6/unicode-regexp-ignore-case-noi18n': [FAIL],
+  # Once the bug is fixed, the expectations should be:
+  # 'es6/unicode-regexp-ignore-case-noi18n': [PASS, ['no_i18n == False', FAIL]],
 
   ##############################################################################
-  # Only RegExp stuff tested, no need for extensive optimizing compiler tests.
-  'regexp-global': [PASS, NO_VARIANTS],
-  'third_party/regexp-pcre/regexp-pcre': [PASS, NO_VARIANTS],
-
-  ##############################################################################
-  # No need to waste time for this test.
+  # Tests where variants make no sense.
+  'd8/enable-tracing': [PASS, NO_VARIANTS],
+  'd8/d8-os': [PASS, NO_VARIANTS],
   'd8/d8-performance-now': [PASS, NO_VARIANTS],
+  'regexp-global': [PASS, NO_VARIANTS],
+  'regress/regress-4595': [PASS, NO_VARIANTS],
   'regress/regress-crbug-491062': [PASS, NO_VARIANTS],
+  'third_party/regexp-pcre/regexp-pcre': [PASS, NO_VARIANTS],
+  'tools/compiler-trace-flags': [PASS, NO_VARIANTS],
+  'tools/dumpcpp': [PASS, NO_VARIANTS],
+  'tools/tickprocessor': [PASS, NO_VARIANTS],
 
   # Issue 488: this test sometimes times out.
   # TODO(arm): This seems to flush out a bug on arm with simulator.
-  'array-constructor': [PASS, SLOW, ['arch == arm and simulator_run == True', SKIP]],
-
-  # Very slow test
-  'regress/regress-crbug-808192' : [PASS, SLOW, NO_VARIANTS, ['mode == debug or arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips64 or arch == mips or arch == s390 or arch == s390x or arch == ppc or arch == ppc64', SKIP]],
-
-  # Very slow on ARM and MIPS, contains no architecture dependent code.
-  'unicode-case-overoptimization': [PASS, NO_VARIANTS, ['arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips64 or arch == mips', SKIP]],
-  'regress/regress-3976': [PASS, NO_VARIANTS, ['arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips64 or arch == mips', SKIP]],
-  'regress/regress-crbug-482998': [PASS, NO_VARIANTS, ['arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips', SKIP]],
-  'regress/regress-740784': [PASS, NO_VARIANTS, ['arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips', SKIP]],
-
-  # This test allocates a 2G block of memory and if there are multiple
-  # variants this can lead to OOM.
-  'regress/regress-crbug-514081': [PASS, NO_VARIANTS],
+  'array-constructor': [PASS, SLOW, ['arch == arm and simulator_run', SKIP]],
 
   ##############################################################################
-  # Skip long running tests that time out in debug mode.
-  'generated-transition-stub': [PASS, ['mode == debug', SKIP]],
-  'migrations': [SKIP],
-  'array-functions-prototype-misc': [PASS, SLOW, ['mode == debug', SKIP]],
-  'compiler/regress-9017': [PASS, SLOW],
-  'compiler/regress-808472': [PASS, ['mode == debug', SKIP]],
+  # Long-running tests.
+  # We really should find better solutions for these.
   'es6/promise-all-overflow-1': [SKIP],
-  'es6/promise-all-overflow-2': [PASS, SLOW, ['mode == debug or arch != x64', SKIP]],
-
-  ##############################################################################
-  # This test sets the umask on a per-process basis and hence cannot be
-  # used in multi-threaded runs.
-  # On android there is no /tmp directory.
-  # Currently d8-os generates a temporary directory name using Math.random(), so
-  # we cannot run several variants of d8-os simultaneously, since all of them
-  # get the same random seed and would generate the same directory name. Besides
-  # that, it doesn't make sense to run several variants of d8-os anyways.
-  'd8/d8-os': [PASS, NO_VARIANTS, ['isolates or arch == android_arm or arch == android_arm64 or arch == android_ia32', SKIP]],
-  'tools/tickprocessor': [PASS, NO_VARIANTS, ['arch == android_arm or arch == android_arm64 or arch == android_ia32', SKIP]],
-  'tools/dumpcpp': [PASS, NO_VARIANTS, ['arch == android_arm or arch == android_arm64 or arch == android_ia32', SKIP]],
-
-  ##############################################################################
-  # These tests generate files in the test directory, so we cannot run several
-  # variants of them simultaneously. Additionally they should not be affected by
-  # variants.
-  'd8/enable-tracing': [PASS, NO_VARIANTS],
-  'tools/compiler-trace-flags': [PASS, NO_VARIANTS],
-
-  ##############################################################################
-  # Long running test that reproduces memory leak and should be run manually.
+  'migrations': [SKIP],
   'regress/regress-2073': [SKIP],
 
   ##############################################################################
@@ -155,33 +103,31 @@
   'compiler/alloc-number-debug': [PASS, ['mode == release', SKIP]],
   'regress/regress-634-debug': [PASS, ['mode == release', SKIP]],
 
-  # BUG(v8:2989).
-  'regress/regress-2989': [FAIL, NO_VARIANTS, ['lite_mode == True', SKIP]],
-
   # This test variant makes only sense on arm.
-  'math-floor-of-div-nosudiv': [PASS, SLOW, ['arch not in [arm, arm64, android_arm, android_arm64]', SKIP]],
-
-  # Too slow for slow variants.
-  'asm/embenchen/*': [PASS, SLOW, NO_VARIANTS],
-  'asm/poppler/*': [PASS, SLOW, NO_VARIANTS],
-  'asm/sqlite3/*': [PASS, SLOW, NO_VARIANTS],
+  'math-floor-of-div-nosudiv': [PASS, SLOW, ['arch not in [arm, arm64]', SKIP]],
 
   # OOM flakes in isolates tests because too many largish heaps are created.
   'asm/asm-heap': [PASS, NO_VARIANTS, ['isolates', SKIP]],
 
   # Slow tests.
+  'array-functions-prototype-misc': [PASS, SLOW],
+  'asm/embenchen/*': [PASS, SLOW, NO_VARIANTS],
+  'asm/poppler/*': [PASS, SLOW, NO_VARIANTS],
+  'asm/sqlite3/*': [PASS, SLOW, NO_VARIANTS],
+  'compiler/regress-9017': [PASS, SLOW],
+  'es6/promise-all-overflow-2': [PASS, SLOW, ['arch != x64', SKIP]],
   'copy-on-write-assert': [PASS, SLOW],
   'es6/typedarray-construct-offset-not-smi': [PASS, SLOW],
   'harmony/futex': [PASS, SLOW],
   'harmony/regexp-property-script-extensions': [PASS, SLOW],
   'ignition/regress-672027': [PASS, SLOW],
   'md5': [PASS, SLOW],
-  'numops-fuzz-part*': [PASS, ['mode == debug', SLOW]],
   'readonly': [PASS, SLOW],
   'regress/regress-1122': [PASS, SLOW],
   'regress/regress-605470': [PASS, SLOW],
   'regress/regress-655573': [PASS, SLOW],
   'regress/regress-1200351': [PASS, SLOW],
+  'regress/regress-crbug-808192': [PASS, SLOW, NO_VARIANTS, ['arch not in (ia32, x64)', SKIP]],
   'regress/regress-crbug-918301': [PASS, SLOW, NO_VARIANTS, ['mode != release or dcheck_always_on', SKIP], ['(arch == arm or arch == arm64) and simulator_run', SKIP], ['tsan', SKIP]],
   'regress/wasm/regress-810973': [PASS, SLOW],
   'string-replace-gc': [PASS, SLOW],
@@ -190,89 +136,89 @@
   'wasm/embenchen/*': [PASS, SLOW],
   'wasm/grow-memory': [PASS, SLOW],
   'wasm/unreachable-validation': [PASS, SLOW],
-  'wasm/atomics-stress': [PASS, SLOW, NO_VARIANTS, ['mode != release or dcheck_always_on', SKIP], ['(arch == arm or arch == arm64) and simulator_run', SKIP], ['tsan', SKIP]],
-  'wasm/atomics64-stress': [PASS, SLOW, NO_VARIANTS, ['mode != release or dcheck_always_on', SKIP], ['(arch == arm or arch == arm64) and simulator_run', SKIP], ['tsan', SKIP]],
+  'wasm/atomics-stress': [PASS, SLOW, NO_VARIANTS, ['mode != release or dcheck_always_on', SKIP], ['tsan', SKIP]],
+  'wasm/atomics64-stress': [PASS, SLOW, NO_VARIANTS, ['mode != release or dcheck_always_on', SKIP], ['tsan', SKIP]],
   'wasm/compare-exchange-stress': [PASS, SLOW, NO_VARIANTS],
   'wasm/compare-exchange64-stress': [PASS, SLOW, NO_VARIANTS],
 
-  # worker creation/shutdown is very slow in debug mode
-  'd8/d8-worker-shutdown*': [PASS, ['mode == debug', SLOW], ['no_snap', SKIP]],
-
-  # case-insensitive unicode regexp relies on case mapping provided by ICU.
-  'es6/unicode-regexp-ignore-case': [PASS, ['no_i18n == True', FAIL]],
-  'es6/unicode-regexp-ignore-case-noi18n': [FAIL, ['no_i18n == True', PASS]],
-  'regress/regress-5036': [PASS, ['no_i18n == True', FAIL]],
-  'es7/regexp-ui-word': [PASS, ['no_i18n == True', FAIL]],
-  'regexp-modifiers-i18n': [PASS, ['no_i18n == True', FAIL]],
-  'regexp-modifiers-autogenerated-i18n': [PASS, ['no_i18n == True', FAIL]],
-  # desugaring regexp property class relies on ICU.
-  'harmony/regexp-property-*': [PASS, ['no_i18n == True', FAIL]],
-  'regress/regress-793588': [PASS, ['no_i18n == True', FAIL]],
-
-  # noi18n build cannot parse characters in supplementary plane.
-  'harmony/regexp-named-captures': [PASS, ['no_i18n == True', FAIL]],
-
-  # noi18n cannot turn on ICU backend for Date
-  'icu-date-to-string': [PASS, ['no_i18n == True', SKIP]],
-  'icu-date-lord-howe': [PASS, ['no_i18n == True', SKIP]],
-  'tzoffset-transition-apia': [PASS, ['no_i18n == True', SKIP]],
-  'tzoffset-transition-lord-howe': [PASS, ['no_i18n == True', SKIP]],
-  'tzoffset-transition-moscow': [PASS, ['no_i18n == True', SKIP]],
-  'tzoffset-transition-new-york': [PASS, ['no_i18n == True', SKIP]],
-  'tzoffset-seoul': [PASS, ['no_i18n == True', SKIP]],
+  # Very slow on ARM and MIPS, contains no architecture dependent code.
+  'unicode-case-overoptimization': [PASS, NO_VARIANTS, ['arch in (arm, arm64, mipsel, mips64el, mips64, mips)', SKIP]],
+  'regress/regress-3976': [PASS, NO_VARIANTS, ['arch in (arm, arm64, mipsel, mips64el, mips64, mips)', SKIP]],
+  'regress/regress-crbug-482998': [PASS, NO_VARIANTS, ['arch in (arm, arm64, mipsel, mips64el, mips)', SKIP]],
+  'regress/regress-740784': [PASS, NO_VARIANTS, ['arch in (arm, arm64, mipsel, mips64el, mips)', SKIP]],
 
   # TODO(bmeurer): Flaky timeouts (sometimes <1s, sometimes >3m).
   'unicodelctest': [PASS, NO_VARIANTS],
   'unicodelctest-no-optimization': [PASS, NO_VARIANTS],
 
-  # TODO(vogelheim): big-object-literal exceeds the stack in debug builds,
-  #                  which makes the test useless.
-  'big-object-literal': [PASS, ['mode == debug', SKIP]],
-
-  # Runs out of stack space in debug builds.
-  'big-array-literal': [PASS, ['mode == debug', SKIP]],
-
-  # BUG(v8:6306).
-  'wasm/huge-memory': [SKIP],
-
-  # Allocates a huge string and then flattens it, very slow in debug mode.
-  'regress/regress-752764': [PASS, ['mode == debug', SLOW]],
+  # Test is only enabled on ASAN. Takes too long on many other bots.
+  'regress/regress-crbug-9161': [PASS, SLOW, ['asan == False', SKIP]],
 
-  # https://crbug.com/v8/7697
-  'array-literal-feedback': [PASS, FAIL],
+  # OOM with too many isolates/memory objects (https://crbug.com/1010272)
+  # Predictable tests fail due to race between postMessage and GrowMemory
+  'regress/wasm/regress-1010272': [PASS, NO_VARIANTS, ['system == android', SKIP], ['predictable', SKIP]],
+}],  # ALWAYS
 
-  # https://crbug.com/v8/7775
-  'allocation-site-info': [SKIP],
+##############################################################################
+['mode == debug', {
+  # Skip slow tests in debug mode.
+  'array-functions-prototype-misc': [SKIP],
+  'compiler/regress-808472': [SKIP],
+  'es6/promise-all-overflow-2': [SKIP],
+  'generated-transition-stub': [SKIP],
+  'regress/regress-524': [SKIP],
+  'regress/regress-4595': [SKIP],
+  'regress/regress-430201': [SKIP],
+  'regress/regress-430201b': [SKIP],
+  'regress/regress-716044': [SKIP],
+  'regress/regress-crbug-217858': [SKIP],
+  'regress/regress-crbug-808192': [SKIP],
+  'regress/regress-crbug-941743': [SKIP],
+  'regress/regress-create-exception': [SKIP],
 
-  # BUG(v8:8169)
-  'external-backing-store-gc': [SKIP],
+  # These tests run out of stack space in debug mode.
+  'big-array-literal': [SKIP],
+  'big-object-literal': [SKIP],
 
-  # Test is only enabled on ASAN. Takes too long on many other bots.
-  'regress/regress-crbug-9161': [SKIP],
+  # Too slow in debug mode BUG(v8:9506): times out.
+  'wasm/shared-memory-worker-explicit-gc-stress': [SKIP],
+  'wasm/shared-memory-worker-gc-stress': [SKIP],
 
-  # BUG(v8:9260)
-  'tools/profviz': [SKIP],
+  # For these tests, making them as slow is enough:
+  'numops-fuzz-part*': [SLOW],
 
-  # Test doesn't work on 32-bit architectures (it would require a
-  # regexp pattern with too many captures).
-  'regress/regress-976627': [FAIL, ['arch == x64 or arch == arm64 or arch == mips64el or arch == ppc64 or arch == s390x', PASS]],
-}],  # ALWAYS
+  # worker creation/shutdown is very slow in debug mode
+  'd8/d8-worker-shutdown*': [SLOW],
+  # Allocates a huge string and then flattens it.
+  'regress/regress-752764': [SLOW],
+}],  # mode == debug
 
-['novfp3 == True', {
+['novfp3', {
   'asm/embenchen/box2d': [SKIP],
   'asm/embenchen/zlib': [SKIP],
   'asm/embenchen/memops': [SKIP],
   'asm/embenchen/lua_binarytrees': [SKIP],
-}],  # novfp3 == True
+}],  # novfp3
 
 ##############################################################################
-# TODO(ahaas): Port multiple return values to ARM, MIPS, S390 and PPC
-['arch == arm or arch == arm64 or arch == mips or arch == mips64 or arch == mipsel or arch == mips64el or arch == s390 or arch == s390x or arch == ppc or arch == ppc64', {
+# TODO(ahaas): Port multiple return values to MIPS, S390 and PPC
+['arch in (mips, mips64, mipsel, mips64el, s390, s390x, ppc, ppc64)', {
   'wasm/multi-value': [SKIP],
 }],
 
 ##############################################################################
-['gc_stress == True', {
+['simulator_run', {
+  # Skip/annotate tests that are too slow on simulators.
+  'random-bit-correlations': [SLOW],
+  'regress/regress-crbug-941743': [SKIP],
+  'regress/regress-crbug-1041232': [SKIP],
+  'regress/wasm/regress-1010272': [SKIP],
+  'wasm/atomics-stress': [SKIP],
+  'wasm/atomics64-stress': [SKIP],
+}],  # simulator_run
+
+##############################################################################
+['gc_stress', {
   # Skip tests not suitable for GC stress.
   'allocation-site-info': [SKIP],
   'array-constructor-feedback': [SKIP],
@@ -308,7 +254,7 @@
   'code-coverage-ad-hoc': [SKIP],
   'code-coverage-precise': [SKIP],
 
-  # TODO(mstarzinger): Takes too long with TF.
+  # Takes too long with TF.
   'array-sort': [PASS, NO_VARIANTS],
   'regress/regress-91008': [PASS, NO_VARIANTS],
   'regress/regress-transcendental': [PASS, ['arch == arm64', NO_VARIANTS]],
@@ -343,7 +289,10 @@
   'es6/regress/regress-crbug-465671-null': [SKIP],
   'regress/regress-148378': [SKIP],
   'regress/regress-crbug-762472': [SKIP],
-}],  # 'gc_stress == True'
+
+  # BUG(v8:10035)
+  'compiler/deopt-array-builtins': [SKIP],
+}],  # 'gc_stress'
 
 ##############################################################################
 ['lite_mode or variant == jitless', {
@@ -360,6 +309,8 @@
   'regress/wasm/*': [SKIP],
   'regress/regress-8947': [SKIP],
   'regress/regress-9165': [SKIP],
+  'regress/regress-9209': [SKIP],
+  'regress/regress-1034394': [SKIP],
   'regress/regress-v8-9106': [SKIP],
   'wasm/*': [SKIP],
 
@@ -369,6 +320,7 @@
   'asm/call-stdlib': [SKIP],
   'asm/call-annotation': [SKIP],
   'asm/global-imports': [SKIP],
+  'asm/regress-1027595': [SKIP],
   'asm/regress-913822': [SKIP],
   'asm/regress-937650': [SKIP],
   'asm/regress-9531': [SKIP],
@@ -378,6 +330,7 @@
   'regress/regress-6700': [SKIP],
   'regress/regress-6838-2': [SKIP],
   'regress/regress-6838-3': [SKIP],
+  'regress/regress-6838-4': [SKIP],
   'regress/regress-9022': [SKIP],
   'regress/regress-9832': [SKIP],
   'regress/regress-crbug-934138': [SKIP],
@@ -399,6 +352,17 @@
   'regexp-tier-up-multiple': [SKIP],
   'regress/regress-996234': [SKIP],
 
+  # Tests that depend on optimization (beyond doing assertOptimized).
+  'compiler/is-being-interpreted-*': [SKIP],
+  'compiler/serializer-accessors': [SKIP],
+  'compiler/serializer-apply': [SKIP],
+  'compiler/serializer-call': [SKIP],
+  'compiler/serializer-dead-after-jump': [SKIP],
+  'compiler/serializer-dead-after-return': [SKIP],
+  'compiler/serializer-transition-propagation': [SKIP],
+  'regress/regress-1049982-1': [SKIP],
+  'regress/regress-1049982-2': [SKIP],
+
   # These tests check that we can trace the compiler.
   'tools/compiler-trace-flags': [SKIP],
   'tools/compiler-trace-flags-wasm': [SKIP],
@@ -408,12 +372,40 @@
 
   # Slow with pointer compression.
   'regress/regress-crbug-319860': [PASS, ['pointer_compression', SLOW]],
+
+  # Flag --interpreted-frames-native-stack incompatible with jitless
+  'regress/regress-10138': [SKIP],
 }],  # 'lite_mode or variant == jitless'
 
+##############################################################################
+['no_i18n', {
+  # case-insensitive unicode regexp relies on case mapping provided by ICU.
+  'es6/unicode-regexp-ignore-case': [FAIL],
+  'regress/regress-5036': [FAIL],
+  'es7/regexp-ui-word': [FAIL],
+  'regexp-modifiers-i18n': [FAIL],
+  'regexp-modifiers-autogenerated-i18n': [FAIL],
+  # desugaring regexp property class relies on ICU.
+  'harmony/regexp-property-*': [FAIL],
+  'harmony/regexp-property-invalid': [PASS],
+  'regress/regress-793588': [FAIL],
+
+  # noi18n build cannot parse characters in supplementary plane.
+  'harmony/regexp-named-captures': [FAIL],
+
+  # noi18n cannot turn on ICU backend for Date
+  'icu-date-to-string': [SKIP],
+  'icu-date-lord-howe': [SKIP],
+  'tzoffset-transition-apia': [SKIP],
+  'tzoffset-transition-lord-howe': [SKIP],
+  'tzoffset-transition-moscow': [SKIP],
+  'tzoffset-transition-new-york': [SKIP],
+  'tzoffset-seoul': [SKIP],
+}],  # 'no_i18n'
+
 ##############################################################################
 ['is_full_debug', {
   # Tests too slow in non-optimized debug mode.
-  'compiler/regress-9017': [SKIP],
   'regress/regress-2790': [SKIP],
   'regress/regress-331444': [SKIP],
   'regress/regress-740784': [SKIP],
@@ -430,7 +422,15 @@
 }],  # 'byteorder == big'
 
 ##############################################################################
-['arch == arm64 or arch == android_arm64', {
+# 32-bit platforms
+['arch in (ia32, arm, mips, mipsel)', {
+  # Needs >2GB of available contiguous memory.
+  'wasm/huge-memory': [SKIP],
+  'wasm/huge-typedarray': [SKIP],
+}],  # 'arch in (ia32, arm, mips, mipsel)'
+
+##############################################################################
+['arch == arm64', {
 
   # Requires bigger stack size in the Genesis and if stack size is increased,
   # the test requires too much time to run.  However, the problem test covers
@@ -442,7 +442,6 @@
   # tests.
   'asm/embenchen/box2d': [SKIP],
   'asm/embenchen/lua_binarytrees': [SKIP],
-  'big-object-literal': [SKIP],
   'compiler/regress-arguments': [SKIP],
   'compiler/regress-gvn': [SKIP],
   'compiler/regress-4': [SKIP],
@@ -474,12 +473,11 @@
   'array-reduce': [PASS, SLOW],
   'array-sort': [PASS, SLOW],
   'array-splice': [PASS, SLOW],
-  'array-store-and-grow': [PASS, SLOW],
   'compiler/alloc-number': [PASS, SLOW],
   'compiler/osr-with-args': [PASS, SLOW],
+  'frozen-array-reduce': [PASS, SLOW],
   'generated-transition-stub': [PASS, SLOW],
   'json2': [PASS, SLOW],
-  'large-object-literal-slow-elements': [PASS, SLOW],
   'math-floor-of-div-nosudiv': [PASS, SLOW],
   'math-floor-of-div': [PASS, SLOW],
   'messages': [PASS, SLOW],
@@ -490,30 +488,25 @@
   'regress/regress-create-exception': [PASS, SLOW],
   'regress/regress-json-stringify-gc': [PASS, SLOW],
   'string-indexof-2': [PASS, SLOW],
-  'unbox-double-arrays': [PASS, SLOW],
   'unicodelctest-no-optimization': [PASS, SLOW],
   'unicodelctest': [PASS, SLOW],
   'unicode-test': [PASS, SLOW],
   'wasm/atomics': [PASS, SLOW],
   'whitespaces': [PASS, SLOW],
 
+  # BUG(v8:10032).
+  'array-store-and-grow': [PASS, SLOW],
+
   # BUG(v8:7247).
   'regress/regress-779407': [PASS, SLOW, NO_VARIANTS],
 }],  # 'arch == arm64'
 
 ##############################################################################
 ['arch == arm64 and simulator_run', {
-  # Slow in simulator builds
-  'compiler/osr-follow': [PASS, SLOW],
-  'es6/array-concat': [PASS, SLOW],
-  'non-extensible-array-reduce': [PASS, SLOW],
-  'regress/regress-454725': [PASS, SLOW],
-  'regress/regress-708247': [PASS, SLOW],
   'compiler/osr-big': [PASS, SLOW],
-  'frozen-array-reduce': [PASS, SLOW],
-  'json': [PASS, SLOW],
-  'sealed-array-reduce': [PASS, SLOW],
+  'regress/regress-454725': [PASS, SLOW],
   'try': [PASS, SLOW],
+  'non-extensible-array-reduce': [PASS, SLOW],
 }],  # 'arch == arm64 and simulator_run'
 
 ##############################################################################
@@ -534,7 +527,6 @@
 ['asan == True', {
   # Skip tests not suitable for ASAN.
   'big-array-literal': [SKIP],
-  'big-object-literal': [SKIP],
   'regress/regress-crbug-178790': [SKIP],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=4639
@@ -554,9 +546,6 @@
   # https://bugs.chromium.org/p/v8/issues/detail?id=7102
   # Flaky due to huge string allocation.
   'regress/regress-748069': [SKIP],
-
-  # Test is tailored for ASAN. Takes too long on many other bots.
-  'regress/regress-crbug-9161': [PASS, SLOW],
 }],  # 'asan == True'
 
 ##############################################################################
@@ -584,6 +573,7 @@
 
 ##############################################################################
 ['tsan == True', {
+
   # https://bugs.chromium.org/p/v8/issues/detail?id=7102
   # Flaky due to huge string allocation.
   'regress/regress-748069': [SKIP],
@@ -609,9 +599,9 @@
   'es6/large-classes-properties': [SKIP],
 
   # Slow tests.
-  'compiler/regress-9017': [PASS, SLOW],
   'es6/block-conflicts-sloppy': [PASS, SLOW],
   'math-floor-part1': [PASS, SLOW],
+  'regress/regress-430201': [SKIP],
   'regress/regress-500980': [PASS, SLOW],
 
   # BUG(v8:9506): times out.
@@ -619,15 +609,15 @@
 }],  # 'tsan == True'
 
 ##############################################################################
-['arch == arm or arch == android_arm', {
+['arch == arm', {
 
   # Slow tests which times out in debug mode.
   'try': [PASS, ['mode == debug', SKIP]],
   'array-constructor': [PASS, ['mode == debug', SKIP]],
-  'regress/regress-1122': [PASS, SLOW, ['mode == debug and arch == android_arm', SKIP]],
+  'regress/regress-1122': [PASS, SLOW, ['mode == debug', SKIP]],
 
   # Flaky test that can hit compilation-time stack overflow in debug mode.
-  'unicode-test': [PASS, ['mode == debug', PASS, FAIL]],
+  'unicode-test': [PASS, ['mode == debug', FAIL]],
 
   # Slow in release mode on ARM.
   'compiler/regress-stacktrace-methods': [PASS, SLOW],
@@ -635,7 +625,6 @@
 
   # Long running tests. Skipping because having them timeout takes too long on
   # the buildbot.
-  'big-object-literal': [SKIP],
   'compiler/alloc-number': [SKIP],
   'regress/regress-490': [SKIP],
   'regress/regress-create-exception': [SKIP],
@@ -660,10 +649,10 @@
   'regress/regress-json-stringify-gc': [PASS, SLOW],
   'string-indexof-2': [PASS, SLOW],
   'wasm/atomics': [PASS, SLOW],
-}],  # 'arch == arm or arch == android_arm'
+}],  # 'arch == arm
 
 ##############################################################################
-['(arch == mipsel or arch == mips or arch == mips64el or arch == mips64) and simulator_run != True', {
+['arch in (mipsel, mips, mips64el, mips64) and not simulator_run', {
   # These tests fail occasionally on the buildbots because they consume
   # a large amount of memory if executed in parallel. Therefore we
   # run only a single instance of these tests
@@ -671,10 +660,10 @@
   'regress/regress-599717': [PASS, NO_VARIANTS],
   'regress/regress-599414-array-concat-fast-path': [PASS, NO_VARIANTS],
   'array-functions-prototype-misc': [PASS, NO_VARIANTS],
-}],  # 'arch == mipsel or arch == mips or arch == mips64el or arch == mips64'
+}],  # 'arch in (mipsel, mips, mips64el, mips64)'
 
 ##############################################################################
-['arch == mipsel or arch == mips or arch == mips64el or arch == mips64 or arch == ppc or arch == ppc64', {
+['arch in (mipsel, mips, mips64el, mips64, ppc, ppc64)', {
   # These tests fail because qNaN and sNaN values are encoded differently on
   # MIPS and ARM/x86 architectures
   'wasm/float-constant-folding': [SKIP],
@@ -771,15 +760,9 @@
   'regress/regress-779407': [SKIP],
 }],  # 'arch == mips64el or arch == mips64'
 
-['(arch == mips64el or arch == mips64) and simulator_run', {
-  # Slow tests which have flaky timeout on simulator.
-  'wasm/atomics64-stress': [SKIP],
-}],  # '(arch == mips64el or arch == mips64) and simulator_run'
-
 ##############################################################################
 ['system == windows', {
-  # TODO(mstarzinger): Too slow with turbo fan.
-  'big-object-literal': [SKIP],
+  # Too slow with turbo fan.
   'math-floor-of-div': [PASS, ['mode == debug', SKIP]],
   'math-floor-of-div-nosudiv': [PASS, ['mode == debug', SKIP]],
   'unicodelctest': [PASS, ['mode == debug', SKIP]],
@@ -805,30 +788,41 @@
   'icu-date-lord-howe': [SKIP],
   'regress/regress-6288': [SKIP],
   # OOM:
-  'regress/regress-748069': [FAIL],
   'regress/regress-752764': [FAIL],
   # Flaky OOM:
   'regress/regress-779407': [SKIP],
   'regress/regress-852258': [SKIP],
 }],  # 'system == android'
 
-##############################################################################
-['system == macos', {
-  # BUG(v8:5333)
-  'big-object-literal': [SKIP],
-}],  # 'system == macos'
-
 ##############################################################################
 ['isolates', {
   # Slow tests.
   'es6/typedarray-of': [PASS, SLOW],
   'regress/regress-crbug-854299': [PASS, SLOW],
 
+  # Currently d8-os generates a temporary directory name using Math.random(), so
+  # we cannot run several variants of d8-os simultaneously, since all of them
+  # get the same random seed and would generate the same directory name.
+  'd8/d8-os': [SKIP],
+
   # Runs flakily OOM because multiple isolates are involved which create many
   # wasm memories each. Before running OOM on a wasm memory allocation we
   # trigger a GC, but only in the isolate allocating the new memory.
   'wasm/module-memory': [SKIP],
   'wasm/shared-memory-gc-stress': [SKIP],
+
+  # Redirection to the interpreter is non-deterministic with multiple isolates.
+  'wasm/interpreter-mixed': [SKIP],
+  'wasm/worker-interpreter': [SKIP],
+
+  # The {FreezeWasmLazyCompilation} runtime function sets a flag in the native
+  # module, which causes a data-race if the native module is shared between
+  # isolates.
+  'wasm/lazy-compilation': [SKIP],
+
+  # Tier down/up Wasm NativeModule in debugging is non-deterministic with
+  # multiple isolates (https://crbug.com/v8/10099).
+  'wasm/tier-down-to-liftoff': [SKIP],
 }],  # 'isolates'
 
 ##############################################################################
@@ -843,6 +837,11 @@
   'deopt-recursive-lazy-once': [SKIP],
   'deopt-recursive-soft-once': [SKIP],
   'code-coverage-block-opt': [SKIP],
+  'compiler/serializer-apply': [SKIP],
+  'compiler/serializer-call': [SKIP],
+  'compiler/serializer-dead-after-jump': [SKIP],
+  'compiler/serializer-dead-after-return': [SKIP],
+  'compiler/serializer-transition-propagation': [SKIP],
 
   # Bounds check triggers forced deopt for array constructors.
   'array-constructor-feedback': [SKIP],
@@ -858,6 +857,9 @@
 
   # Too slow tests.
   'regress/regress-740784': [SKIP],
+
+  # https://crbug.com/v8/9984
+  'compiler/opt-higher-order-functions': [SKIP],
 }],  # 'deopt_fuzzer'
 
 ##############################################################################
@@ -884,6 +886,11 @@
   # Tests that fail some assertions due to checking internal state sensitive
   # to GC.
   'compiler/native-context-specialization-hole-check': [SKIP],
+  'compiler/serializer-apply': [SKIP],
+  'compiler/serializer-call': [SKIP],
+  'compiler/serializer-dead-after-jump': [SKIP],
+  'compiler/serializer-dead-after-return': [SKIP],
+  'compiler/serializer-transition-propagation': [SKIP],
   'opt-elements-kind': [SKIP],
   'regress/regress-trap-allocation-memento': [SKIP],
   'regress/regress-v8-9267-*': [SKIP],
@@ -930,9 +937,6 @@
   # Deadlocks on predictable platform (https://crbug.com/v8/9760).
   'wasm/async-compile': [SKIP],
   'wasm/streaming-compile': [SKIP],
-
-  # Race between postMessage and wasm memory.grow. (https://crbug.com/1010272).
-  'regress/wasm/regress-1010272': [SKIP],
 }],  # 'predictable == True'
 
 ##############################################################################
@@ -941,15 +945,12 @@
   # take too long with the simulator.
   'regress/regress-1132': [SKIP],
   'regress/regress-740784': [SKIP],
-  'regress/regress-crbug-941743': [SKIP],
   'regress/regress-crbug-482998': [PASS, SLOW],
   'regress/regress-91008': [PASS, SLOW],
   'regress/regress-779407': [PASS, SLOW],
   'harmony/regexp-property-lu-ui': [PASS, SLOW],
   'whitespaces': [PASS, SLOW],
   'generated-transition-stub': [PASS, SLOW],
-  'wasm/atomics-stress': [SKIP],
-  'wasm/atomics64-stress': [SKIP],
 }],  # 'simulator_run and (arch in [ppc64, s390x])'
 
 ##############################################################################
@@ -976,7 +977,6 @@
 ['variant == stress', {
   # Slow tests.
   'array-natives-elements': [SKIP],
-  'big-object-literal': [SKIP],
   'es6/array-iterator-turbo': [SKIP],
   'ignition/regress-599001-verifyheap': [SKIP],
   'unicode-test': [SKIP],
@@ -1025,6 +1025,13 @@
   'wasm/grow-memory': [SKIP],
 }],  # variant == nooptimization and (arch == arm or arch == arm64) and simulator_run
 
+##############################################################################
+['variant == nooptimization', {
+  # Tests that depend on optimization (beyond doing assertOptimized).
+  'regress/regress-1049982-1': [SKIP],
+  'regress/regress-1049982-2': [SKIP],
+}],  # variant == nooptimization
+
 ##############################################################################
 ['(arch == arm or arch == arm64)', {
   # Flaky tests: https://crbug.com/v8/8090
@@ -1063,7 +1070,7 @@
 ['no_harness', {
     # skip assertion tests since the stack trace is broken if mjsunit is
     # included in the snapshot
-    'mjsunit-assertion-error' : [SKIP],
+    'mjsunit-assertion-error': [SKIP],
 }], # no_harness
 
 ##############################################################################
@@ -1076,41 +1083,18 @@
 # Liftoff is currently only sufficiently implemented on x64, ia32, arm64 and
 # arm.
 # TODO(clemensb): Implement on all other platforms (crbug.com/v8/6600).
-['arch != x64 and arch != ia32 and arch != arm64 and arch != arm', {
+['arch not in (x64, ia32, arm64, arm)', {
   'wasm/liftoff': [SKIP],
   'wasm/tier-up-testing-flag': [SKIP],
-}], # arch != x64 and arch != ia32 and arch != arm64 and arch != arm
+  'wasm/tier-down-to-liftoff': [SKIP],
+}], # arch not in (x64, ia32, arm64, arm)
 
 ##############################################################################
-['variant == slow_path and gc_stress', {
-  # Slow tests.
-  'regress/regress-crbug-493779': [SKIP],
-  'string-replace-gc': [SKIP],
-}],  # variant == slow_path
-
-##############################################################################
-['arch == x64', {
-  # TODO: Flaky test: crbug.com/v8/7899
-  'wasm/asm-wasm-i32': [SKIP],
-  'wasm/asm-wasm-f64': [SKIP],
-}], # arch == x64
-
-##############################################################################
-['arch not in [x64, arm, arm64] or system != linux', {
-  # Unwinding info writer is only supported on x64, arm, and arm64 Linux
-  'regress/regress-913844': [SKIP],
+['system != linux', {
+  # Multi-mapped mock allocator is only available on Linux.
+  'regress/regress-crbug-1041232': [SKIP],
 }],
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-
-['not embedded_builtins', {
-  # Explicitly sets jitless flag.
-  'regress/regress-992389': [SKIP],
-}], # not embedded_builtins
-
 ##############################################################################
 ['variant == turboprop', {
   # Deopts differently than TurboFan.
@@ -1118,14 +1102,28 @@
   'compiler/native-context-specialization-hole-check': [SKIP],
   'compiler/number-comparison-truncations': [SKIP],
   'compiler/redundancy-elimination': [SKIP],
+  'compiler/regress-9945-*': [SKIP],
 
   # Static asserts for optimizations don't hold due to removed optimization
   # phases.
   'compiler/concurrent-inlining-1': [SKIP],
   'compiler/concurrent-inlining-2': [SKIP],
+  'compiler/constant-fold-add-static': [SKIP],
   'compiler/diamond-followedby-branch': [SKIP],
+  'compiler/is-being-interpreted-*': [SKIP],
   'compiler/load-elimination-const-field': [SKIP],
-  'compiler/constant-fold-add-static': [SKIP],
+  'compiler/serializer-accessors': [SKIP],
+  'compiler/serializer-apply': [SKIP],
+  'compiler/serializer-call': [SKIP],
+  'compiler/serializer-dead-after-jump': [SKIP],
+  'compiler/serializer-dead-after-return': [SKIP],
+  'compiler/serializer-feedback-propagation-*': [SKIP],
+  'compiler/serializer-transition-propagation': [SKIP],
+
+  # Some tests rely on inlining.
+  'compiler/opt-higher-order-functions': [SKIP],
+  'regress/regress-1049982-1': [SKIP],
+  'regress/regress-1049982-2': [SKIP],
 }],  # variant == turboprop
 
 ##############################################################################
diff --git a/deps/v8/test/mjsunit/modules-reset.js b/deps/v8/test/mjsunit/modules-reset.js
new file mode 100644
index 00000000000000..ab2020fb85cf2d
--- /dev/null
+++ b/deps/v8/test/mjsunit/modules-reset.js
@@ -0,0 +1,8 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+import("./modules-skip-reset1.js").then(() => %AbortJS("must throw"));
+import("./modules-skip-reset3.js").then(() => %AbortJS("must throw"));
diff --git a/deps/v8/test/mjsunit/modules-skip-reset1.js b/deps/v8/test/mjsunit/modules-skip-reset1.js
new file mode 100644
index 00000000000000..17831de78b5dda
--- /dev/null
+++ b/deps/v8/test/mjsunit/modules-skip-reset1.js
@@ -0,0 +1,7 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {a} from "./modules-skip-reset2.js";
+import {b} from "./modules-skip-reset3.js";
+export let c = 42;
diff --git a/deps/v8/test/mjsunit/modules-skip-reset2.js b/deps/v8/test/mjsunit/modules-skip-reset2.js
new file mode 100644
index 00000000000000..d49d703357cbe2
--- /dev/null
+++ b/deps/v8/test/mjsunit/modules-skip-reset2.js
@@ -0,0 +1,5 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export {a} from "./modules-skip-reset2.js";
diff --git a/deps/v8/test/mjsunit/modules-skip-reset3.js b/deps/v8/test/mjsunit/modules-skip-reset3.js
new file mode 100644
index 00000000000000..5ff4b2f88de150
--- /dev/null
+++ b/deps/v8/test/mjsunit/modules-skip-reset3.js
@@ -0,0 +1,6 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {c} from "./modules-skip-reset1.js";
+export let b = 23;
diff --git a/deps/v8/test/mjsunit/object-is.js b/deps/v8/test/mjsunit/object-is.js
index c57542f4780657..078e2b111f71ea 100644
--- a/deps/v8/test/mjsunit/object-is.js
+++ b/deps/v8/test/mjsunit/object-is.js
@@ -25,23 +25,15 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Test both the Harmony egal operator and it's function equivalent.
-
-function TestEgal(expected, x, y) {
-  // TODO(mstarzinger): Once we have the egal operator, we can test it here.
-  assertSame(expected, Object.is(x, y));
-}
-
 var test_set = [ {}, [], Infinity, -Infinity, "s", "ア", 0, 0/-1, null,
     undefined, true, false, Symbol("foo"), NaN ];
 for (var i = 0; i < test_set.length; i++) {
   for (var j = 0; j < test_set.length; j++) {
     if (i == j) {
       assertSame(test_set[i], test_set[j]);
-      TestEgal(true, test_set[i], test_set[j]);
+      assertTrue(Object.is(test_set[i], test_set[j]));
     } else {
-      TestEgal(false, test_set[i], test_set[j]);
-      TestEgal(false, test_set[j], test_set[i]);
+      assertFalse(Object.is(test_set[i], test_set[j]));
     }
   }
 }
diff --git a/deps/v8/test/mjsunit/optimized-foreach.js b/deps/v8/test/mjsunit/optimized-foreach.js
index c47bd03741b03e..3f39d3cd2e996e 100644
--- a/deps/v8/test/mjsunit/optimized-foreach.js
+++ b/deps/v8/test/mjsunit/optimized-foreach.js
@@ -30,7 +30,6 @@ var eagerDeoptInCalled = function(deopt) {
   };
   a.forEach(sum);
 };
-;
 %PrepareFunctionForOptimization(eagerDeoptInCalled);
 eagerDeoptInCalled();
 eagerDeoptInCalled();
@@ -51,7 +50,6 @@ var eagerDeoptInCalled = function(deopt) {
   };
   a.forEach(sum);
 };
-;
 %PrepareFunctionForOptimization(eagerDeoptInCalled);
 eagerDeoptInCalled();
 eagerDeoptInCalled();
@@ -75,7 +73,6 @@ var eagerDeoptInCalled = function(deopt) {
   };
   a_noescape.forEach(sum);
 };
-;
 %PrepareFunctionForOptimization(eagerDeoptInCalled);
 eagerDeoptInCalled();
 eagerDeoptInCalled();
@@ -104,7 +101,6 @@ var lazyDeopt = function(deopt) {
   %NeverOptimizeFunction(sum);
   b.forEach(sum);
 };
-;
 %PrepareFunctionForOptimization(lazyDeopt);
 lazyDeopt();
 lazyDeopt();
@@ -126,7 +122,6 @@ var lazyDeopt = function(deopt) {
   };
   b.forEach(sum);
 };
-;
 %PrepareFunctionForOptimization(lazyDeopt);
 lazyDeopt();
 lazyDeopt();
@@ -150,7 +145,6 @@ var lazyDeopt = function(deopt) {
   %NeverOptimizeFunction(sum);
   b.forEach(sum);
 };
-;
 %PrepareFunctionForOptimization(lazyDeopt);
 lazyDeopt();
 lazyDeopt();
@@ -175,7 +169,6 @@ var lazyDeopt = function(deopt) {
   };
   c.forEach(sum);
 };
-;
 %PrepareFunctionForOptimization(lazyDeopt);
 lazyDeopt();
 lazyDeopt();
@@ -204,7 +197,6 @@ var lazyDeopt = function(deopt) {
     caught = true;
   }
 };
-;
 %PrepareFunctionForOptimization(lazyDeopt);
 lazyDeopt();
 lazyDeopt();
@@ -234,7 +226,6 @@ var lazyDeopt = function(deopt) {
     caught = true;
   }
 };
-;
 %PrepareFunctionForOptimization(lazyDeopt);
 lazyDeopt();
 lazyDeopt();
@@ -287,14 +278,12 @@ var lazyDeopt = function foobar(deopt) {
     result += v;
     if (i == 1) {
       var e = new Error();
-      print(e.stack);
       assertTrue(re.exec(e.stack) !== null);
     }
   };
   var o = [1, 2, 3];
   b.forEach(sum);
 };
-;
 %PrepareFunctionForOptimization(lazyDeopt);
 lazyDeopt();
 lazyDeopt();
@@ -318,7 +307,6 @@ var lazyDeopt = function(deopt) {
   var o = [1, 2, 3];
   b.forEach(sum);
 };
-;
 %PrepareFunctionForOptimization(lazyDeopt);
 lazyDeopt();
 lazyDeopt();
@@ -343,7 +331,6 @@ var lazyDeopt = function(deopt) {
   var o = [1, 2, 3];
   b.forEach(sum);
 };
-;
 %PrepareFunctionForOptimization(lazyDeopt);
 lazyDeopt();
 lazyDeopt();
@@ -365,7 +352,6 @@ var lazyDeopt = function() {
   };
   a.forEach(sum);
 };
-;
 %PrepareFunctionForOptimization(lazyDeopt);
 assertThrows(() => lazyDeopt());
 assertThrows(() => lazyDeopt());
diff --git a/deps/v8/test/mjsunit/regexp-backtrack-limit.js b/deps/v8/test/mjsunit/regexp-backtrack-limit.js
new file mode 100644
index 00000000000000..4cd743784d559f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regexp-backtrack-limit.js
@@ -0,0 +1,31 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const kNoBacktrackLimit = 0;  // To match JSRegExp::kNoBacktrackLimit.
+const re0 = %NewRegExpWithBacktrackLimit("(\\d+)+x", "", kNoBacktrackLimit);
+const re1 = %NewRegExpWithBacktrackLimit("(\\d+)+x", "", 50);
+
+// Backtracks remain below the limit on this subject string.
+{
+  let s = "3333ax3333x";
+  assertArrayEquals(["3333x", "3333"], re0.exec(s));
+  assertEquals(["3333x", "3333"], re1.exec(s));
+}
+
+// A longer subject exceeds the limit.
+{
+  let s = "333333333ax3333x";
+  assertArrayEquals(["3333x", "3333"], re0.exec(s));
+  assertEquals(null, re1.exec(s));
+}
+
+// ATOM regexp construction with a limit; in this case the limit should just be
+// ignored, ATOMs never backtrack.
+{
+  const re = %NewRegExpWithBacktrackLimit("ax", "", 50);
+  let s = "3333ax3333x";
+  assertArrayEquals(["ax"], re.exec(s));
+}
diff --git a/deps/v8/test/mjsunit/regexp-override-symbol-match-all.js b/deps/v8/test/mjsunit/regexp-override-symbol-match-all.js
index 10a78a6b618a7f..23ec3aaff53c63 100644
--- a/deps/v8/test/mjsunit/regexp-override-symbol-match-all.js
+++ b/deps/v8/test/mjsunit/regexp-override-symbol-match-all.js
@@ -4,7 +4,7 @@
 
 var s = "baa";
 
-assertEquals([["b"]], [...s.matchAll(/./)]);
+assertEquals([["b"], ["a"], ["a"]], [...s.matchAll(/./g)]);
 
 RegExp.prototype[Symbol.matchAll] = () => 42;
-assertEquals(42, s.matchAll(/a./));
+assertEquals(42, s.matchAll(/a./g));
diff --git a/deps/v8/test/mjsunit/regress-crbug-1025468.js b/deps/v8/test/mjsunit/regress-crbug-1025468.js
new file mode 100644
index 00000000000000..bbfe72c4c09994
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress-crbug-1025468.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+  class H {
+    ['h']() {}
+  }
+  let h = H.prototype.h;
+  h[1024] = {};
+  h["XXX"] = {};
+  h[-1] = {};
+}
+f();
+f();
diff --git a/deps/v8/test/mjsunit/regress-v8-8445-2.js b/deps/v8/test/mjsunit/regress-v8-8445-2.js
index e37c7a02ea325f..a6145805d39507 100644
--- a/deps/v8/test/mjsunit/regress-v8-8445-2.js
+++ b/deps/v8/test/mjsunit/regress-v8-8445-2.js
@@ -8,7 +8,7 @@ class MyRegExp {
   exec() { return null; }
 }
 
-var r = /c/;
+var r = /c/g;
 
 assertEquals(["ab", ""], "abc".split(r));
 assertEquals([["c"]], [..."c".matchAll(r)]);
@@ -18,10 +18,10 @@ r.constructor =  { [Symbol.species] : MyRegExp };
 assertEquals(["abc"], "abc".split(r));
 assertEquals([], [..."c".matchAll(r)]);
 
-assertEquals(["ab", ""], "abc".split(/c/));
-assertEquals([["c"]], [..."c".matchAll(/c/)]);
+assertEquals(["ab", ""], "abc".split(/c/g));
+assertEquals([["c"]], [..."c".matchAll(/c/g)]);
 
 RegExp.prototype.constructor =  { [Symbol.species] : MyRegExp };
 
-assertEquals(["abc"], "abc".split(/c/));
-assertEquals([], [..."c".matchAll(/c/)]);
+assertEquals(["abc"], "abc".split(/c/g));
+assertEquals([], [..."c".matchAll(/c/g)]);
diff --git a/deps/v8/test/mjsunit/regress-v8-8445.js b/deps/v8/test/mjsunit/regress-v8-8445.js
index 94443be2318373..1bed026d4229f0 100644
--- a/deps/v8/test/mjsunit/regress-v8-8445.js
+++ b/deps/v8/test/mjsunit/regress-v8-8445.js
@@ -8,10 +8,10 @@ class MyRegExp {
   exec() { return null; }
 }
 
-assertEquals(["ab", ""], "abc".split(/c/));
-assertEquals([["a"]], [..."a".matchAll(/a/)]);
+assertEquals(["ab", ""], "abc".split(/c/g));
+assertEquals([["a"]], [..."a".matchAll(/a/g)]);
 
 Object.defineProperty(RegExp, Symbol.species, { get() { return MyRegExp; }});
 
-assertEquals(["abc"], "abc".split(/c/));
-assertEquals([], [..."a".matchAll(/a/)]);
+assertEquals(["abc"], "abc".split(/c/g));
+assertEquals([], [..."a".matchAll(/a/g)]);
diff --git a/deps/v8/test/mjsunit/regress/large-indices.js b/deps/v8/test/mjsunit/regress/large-indices.js
new file mode 100644
index 00000000000000..2baa9e99d8ed8c
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/large-indices.js
@@ -0,0 +1,139 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// crbug.com/1026974
+(function() {
+  function store(obj, key) {
+    obj[key] = 10;
+  }
+  %PrepareFunctionForOptimization(store);
+  for (let i = 0; i < 3; i++) {
+    let obj = {}
+    store(obj, 1152921506754330624);
+    assertEquals(["1152921506754330600"], Object.keys(obj));
+  }
+})();
+(function() {
+  function store(obj, key) {
+    obj[key] = 10;
+  }
+  %PrepareFunctionForOptimization(store);
+  for (let i = 0; i < 3; i++) {
+    let obj2 = new Int32Array(0);
+    store(obj2, 1152921506754330624);
+    assertEquals([], Object.keys(obj2));
+    store(obj2, "1152921506754330624");
+    assertEquals(["1152921506754330624"], Object.keys(obj2));
+  }
+})();
+
+// crbug.com/1026729
+(function() {
+  let key = 0xFFFFFFFF;
+  let object = {};
+  assertFalse(object.hasOwnProperty(key));
+  let proxy = new Proxy({}, {});
+  assertFalse(proxy.hasOwnProperty(key));
+})();
+
+// crbug.com/1026909
+(function() {
+  function load(obj, key) {
+    return obj[key];
+  }
+  %PrepareFunctionForOptimization(load);
+  const array = new Float64Array();
+  assertEquals(undefined, load(array, 'monomorphic'));
+  assertEquals(undefined, load(array, '4294967296'));
+})();
+
+// crbug.com/1026856
+(function() {
+  let key = 0xFFFFFFFF;
+  let receiver = new Int32Array();
+  var value = {};
+  var target = {};
+  Reflect.set(target, key, value, receiver);
+})();
+
+// crbug.com/1028213
+(function() {
+  function load(obj, key) {
+    return obj[key];
+  }
+  %PrepareFunctionForOptimization(load);
+  let obj = function() {};
+  obj.__proto__ = new Int8Array(1);
+  let key = Object(4294967297);
+  for (let i = 0; i < 3; i++) {
+    load(obj, key);
+  }
+})();
+(function() {
+  function load(obj, key) {
+    return obj[key];
+  }
+  %PrepareFunctionForOptimization(load);
+  let obj = new String("abc");
+  obj.__proto__ = new Int8Array(1);
+  let key = Object(4294967297);
+  for (let i = 0; i < 3; i++) {
+    load(obj, key);
+  }
+})();
+
+// crbug.com/1027461#c12
+(function() {
+  let arr = new Int32Array(2);
+  Object.defineProperty(arr, "foo", {get:function() { this.valueOf = 1; }});
+  arr[9007199254740991] = 1;
+  Object.values(arr);
+
+  let obj = [1, 2, 3];
+  Object.defineProperty(obj, 2, {get:function() { this.valueOf = 1; }});
+  obj[9007199254740991] = 1;
+  Object.values(obj);
+})();
+
+// crbug.com/1027461#c18
+(function() {
+  const v7 = Object(1);
+  v7[4294967297] = 1;
+  const v8 = Object.assign({}, v7);
+})();
+
+// crbug.com/1029369
+(function () {
+  let obj = {};
+  function AddProperty(o, k) {
+    Object.defineProperty(o, k, {});
+    if (!o.hasOwnProperty(k)) throw "Bug!";
+  }
+  AddProperty(obj, "1");  // Force dictionary-mode elements.
+  AddProperty(obj, 4294967295);
+})();
+
+// crbug.com/1029338
+(function() {
+  var __v_11 = {};
+  __v_11.__defineGetter__(4294967295, function () {});
+  __v_12 = Object.entries(__v_11);
+})();
+
+// crbug.com/1031175
+(function() {
+  var key = 4294967295;
+  var obj = {
+    boom() {
+      super[key]++;
+    },
+    bang() {
+      super["4294967295"]++;
+    }
+  }
+  obj.boom();
+  obj.bang();
+})();
diff --git a/deps/v8/test/mjsunit/regress/nativeerror-tostring.js b/deps/v8/test/mjsunit/regress/nativeerror-tostring.js
new file mode 100644
index 00000000000000..7adeee0920a66d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/nativeerror-tostring.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[
+  EvalError, RangeError, ReferenceError,
+  SyntaxError, TypeError, URIError,
+].forEach((NativeError) => {
+  assertFalse(NativeError.prototype.hasOwnProperty('toString'));
+  assertEquals(NativeError.prototype.toString, Error.prototype.toString);
+});
diff --git a/deps/v8/test/mjsunit/regress/regress-10138.js b/deps/v8/test/mjsunit/regress/regress-10138.js
new file mode 100644
index 00000000000000..807d77c128bc8b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-10138.js
@@ -0,0 +1,19 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax --interpreted-frames-native-stack
+
+function f() {
+  g();
+}
+
+function g() {
+  %DeoptimizeFunction(f);
+  %DeoptimizeFunction(f);
+}
+
+%PrepareFunctionForOptimization(f);
+f(); f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/deps/v8/test/mjsunit/regress/regress-1016450.js b/deps/v8/test/mjsunit/regress/regress-1016450.js
new file mode 100644
index 00000000000000..a98f2744a573d9
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1016450.js
@@ -0,0 +1,29 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+let g = 0;
+
+function f(x) {
+  let y = BigInt.asUintN(64, 15n);
+  // Introduce a side effect to force the construction of a FrameState that
+  // captures the value of y.
+  g = 42;
+  try {
+    return x + y;
+  } catch(_) {
+    return y;
+  }
+}
+
+
+%PrepareFunctionForOptimization(f);
+assertEquals(16n, f(1n));
+assertEquals(17n, f(2n));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(16n, f(1n));
+assertOptimized(f);
+assertEquals(15n, f(0));
+assertUnoptimized(f);
diff --git a/deps/v8/test/mjsunit/regress/regress-1018592.js b/deps/v8/test/mjsunit/regress/regress-1018592.js
new file mode 100644
index 00000000000000..be772ed953e48f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1018592.js
@@ -0,0 +1,6 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const re = /()()()()(?<aaaab>)1/;
+"111a1a".replace(re, () => {}) ;
diff --git a/deps/v8/test/mjsunit/regress/regress-1018871.js b/deps/v8/test/mjsunit/regress/regress-1018871.js
new file mode 100644
index 00000000000000..302429de2a6158
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1018871.js
@@ -0,0 +1,14 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var v_this = this;
+function f() {
+  var obj = {y: 0};
+  var proxy = new Proxy(obj, {
+    has() { y; },
+  });
+  Object.setPrototypeOf(v_this, proxy);
+  x;
+}
+assertThrows(f, RangeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-1020031.js b/deps/v8/test/mjsunit/regress/regress-1020031.js
new file mode 100644
index 00000000000000..1da0aee2d82126
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1020031.js
@@ -0,0 +1,28 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --expose-gc --allow-natives-syntax --predictable --stack-size=300
+
+function* f() {
+  try {
+    g();
+  } catch {}
+}
+
+function g() {
+  try {
+    for (var i of f());
+  } catch {
+    gc();
+  }
+}
+
+%PrepareFunctionForOptimization(g);
+g();
+g();
+g();
+// Brittle repro: depends on exact placement of OptimizeFunctionOnNextCall and
+// --stack-size.
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/deps/v8/test/mjsunit/regress/regress-1021712.js b/deps/v8/test/mjsunit/regress/regress-1021712.js
new file mode 100644
index 00000000000000..46672530220047
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1021712.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+function f() {
+  Promise.prototype.then.call()
+}
+
+
+%PrepareFunctionForOptimization(f);
+try {
+  f();
+} catch (e) {}
+%OptimizeFunctionOnNextCall(f);
+assertThrows(() => f(), TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-1028191.js b/deps/v8/test/mjsunit/regress/regress-1028191.js
new file mode 100644
index 00000000000000..543028ac3f7404
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1028191.js
@@ -0,0 +1,23 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+function f(a, b, c) {
+  let x = BigInt.asUintN(64, a + b);
+  try {
+    x + c;
+  } catch(_) {
+    eval();
+  }
+  return x;
+}
+
+%PrepareFunctionForOptimization(f);
+assertEquals(f(3n, 5n), 8n);
+assertEquals(f(8n, 12n), 20n);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(f(2n, 3n), 5n);
diff --git a/deps/v8/test/mjsunit/regress/regress-1029530.js b/deps/v8/test/mjsunit/regress/regress-1029530.js
new file mode 100644
index 00000000000000..918a9ecbb4db85
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1029530.js
@@ -0,0 +1,40 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --interrupt-budget=1024
+
+{
+  function f() {
+    const b = BigInt.asUintN(4,3n);
+    let i = 0;
+    while(i < 1) {
+      i + 1;
+      i = b;
+    }
+  }
+
+  %PrepareFunctionForOptimization(f);
+  f();
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  f();
+}
+
+
+{
+  function f() {
+    const b = BigInt.asUintN(4,10n);
+    let i = 0.1;
+    while(i < 1.8) {
+      i + 1;
+      i = b;
+    }
+  }
+
+  %PrepareFunctionForOptimization(f);
+  f();
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  f();
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-1029576.js b/deps/v8/test/mjsunit/regress/regress-1029576.js
new file mode 100644
index 00000000000000..8c93aa175f9362
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1029576.js
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  try {
+    return BigInt.asUintN(8);
+  } catch(_) {
+    return 42n;
+  }
+}
+
+%PrepareFunctionForOptimization(f);
+assertEquals(42n, f());
+assertEquals(42n, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(42n, f());
diff --git a/deps/v8/test/mjsunit/regress/regress-1033966.js b/deps/v8/test/mjsunit/regress/regress-1033966.js
new file mode 100644
index 00000000000000..9e8f42cee5b5d5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1033966.js
@@ -0,0 +1,6 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var regexp = Realm.global(Realm.createAllowCrossRealmAccess()).RegExp;
+regexp.prototype.constructor = 1;
diff --git a/deps/v8/test/mjsunit/regress/regress-1034394.js b/deps/v8/test/mjsunit/regress/regress-1034394.js
new file mode 100644
index 00000000000000..99519d8ffe1b1c
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1034394.js
@@ -0,0 +1,29 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// Construct a big table switch. The code size will overflow 4096 bytes.
+const NUM_CASES = 3073;
+
+let body = [];
+// Add one block, so we can jump to this block or to the function end.
+body.push(kExprBlock);
+body.push(kWasmStmt);
+
+// Add the big BrTable.
+body.push(kExprLocalGet, 0);
+body.push(kExprBrTable, ...wasmSignedLeb(NUM_CASES));
+for (let i = 0; i < NUM_CASES + 1; i++) {
+  body.push(i % 2);
+}
+
+// End the block.
+body.push(kExprEnd);
+
+// Create a module for this.
+let builder = new WasmModuleBuilder();
+builder.addFunction('main', kSig_v_i).addBody(body).exportFunc();
+let instance = builder.instantiate();
+instance.exports.main(0);
diff --git a/deps/v8/test/mjsunit/regress/regress-1034449.js b/deps/v8/test/mjsunit/regress/regress-1034449.js
new file mode 100644
index 00000000000000..c4af2a4a602a82
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1034449.js
@@ -0,0 +1,29 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+function f(len) {
+  return new Array(len);
+}
+
+%PrepareFunctionForOptimization(f);
+assertEquals(3, f(3).length);
+assertEquals(18, f(18).length);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(4, f(4).length);
+assertOptimized(f);
+let a = f("8");
+assertUnoptimized(f);
+assertEquals(1, a.length);
+assertEquals("8", a[0]);
+
+// Check there is no deopt loop.
+%PrepareFunctionForOptimization(f);
+assertEquals(1, f(1).length);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(8, f(8).length);
+assertOptimized(f);
+assertEquals(1, f("8").length);
+assertOptimized(f);
diff --git a/deps/v8/test/mjsunit/regress/regress-1038573.js b/deps/v8/test/mjsunit/regress/regress-1038573.js
new file mode 100644
index 00000000000000..83a130b65b3c5b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1038573.js
@@ -0,0 +1,30 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+(function(){
+  function f(x) {
+    return "abcd".charCodeAt(BigInt.asUintN(64, 10n));
+  }
+
+  %PrepareFunctionForOptimization(f);
+  try { f(1); } catch(e) {}
+  try { f(1); } catch(e) {}
+  %OptimizeFunctionOnNextCall(f);
+  assertThrows(f, TypeError);
+})();
+
+
+(function(){
+  function f(x) {
+    return "abcd".charCodeAt(BigInt.asUintN(2, 10n));
+  }
+
+  %PrepareFunctionForOptimization(f);
+  try { f(1); } catch(e) {}
+  try { f(1); } catch(e) {}
+  %OptimizeFunctionOnNextCall(f);
+  assertThrows(f, TypeError);
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-1038588.js b/deps/v8/test/mjsunit/regress/regress-1038588.js
new file mode 100644
index 00000000000000..ffa787a7ddaa37
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1038588.js
@@ -0,0 +1,9 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo(arg){
+  const x = 0;
+  eval("var arg, x;");
+}
+assertThrows(foo, SyntaxError);
diff --git a/deps/v8/test/mjsunit/regress/regress-1040403.js b/deps/v8/test/mjsunit/regress/regress-1040403.js
new file mode 100644
index 00000000000000..f9f7019a84784e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1040403.js
@@ -0,0 +1,15 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --trace-turbo-graph --noconcurrent-recompilation
+
+function bytes() {
+}
+function __f_4622() {
+  var __v_22507 = {
+  };
+}
+%PrepareFunctionForOptimization(__f_4622);
+%OptimizeFunctionOnNextCall(__f_4622);
+42 |  __f_4622();
diff --git a/deps/v8/test/mjsunit/regress/regress-1044919.js b/deps/v8/test/mjsunit/regress/regress-1044919.js
new file mode 100644
index 00000000000000..d55b5b2fd7323d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1044919.js
@@ -0,0 +1,23 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function main() {
+  eval();
+  function foo() {
+    bla = [];
+    bla.__proto__ = '';
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  Object.defineProperty(this, 'bla',
+      {value: bla, configurable: false, writable: true});
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+  Object.defineProperty(this, 'bla',
+      {value: bla, configurable: false, writable: false});
+  foo();
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-1049982-1.js b/deps/v8/test/mjsunit/regress/regress-1049982-1.js
new file mode 100644
index 00000000000000..dd170386dba406
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1049982-1.js
@@ -0,0 +1,31 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+const xs = [1,2,3,4,5,6,7,8,9];
+let deopt = false;
+
+function g(acc, x, i) {
+  if (deopt) {
+    assertFalse(%IsBeingInterpreted());
+    Array.prototype.x = 42;  // Trigger a lazy deopt.
+    deopt = false;
+  }
+  return acc + x;
+}
+
+function f() {
+  return xs.reduce(g, 0);
+}
+
+%PrepareFunctionForOptimization(f);
+%PrepareFunctionForOptimization(g);
+assertEquals(45, f());
+assertEquals(45, f());
+%OptimizeFunctionOnNextCall(f);
+
+deopt = true;
+assertEquals(45, f());
+assertEquals(45, f());
diff --git a/deps/v8/test/mjsunit/regress/regress-1049982-2.js b/deps/v8/test/mjsunit/regress/regress-1049982-2.js
new file mode 100644
index 00000000000000..90e96b8d5b465d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1049982-2.js
@@ -0,0 +1,31 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+const xs = [1,2,3,4,5,6,7,8,9];
+let deopt = false;
+
+function g(acc, x, i) {
+  if (deopt) {
+    assertFalse(%IsBeingInterpreted());
+    Array.prototype.x = 42;  // Trigger a lazy deopt.
+    deopt = false;
+  }
+  return acc + x;
+}
+
+function f() {
+  return xs.reduceRight(g, 0);
+}
+
+%PrepareFunctionForOptimization(f);
+%PrepareFunctionForOptimization(g);
+assertEquals(45, f());
+assertEquals(45, f());
+%OptimizeFunctionOnNextCall(f);
+
+deopt = true;
+assertEquals(45, f());
+assertEquals(45, f());
diff --git a/deps/v8/test/mjsunit/regress/regress-1119.js b/deps/v8/test/mjsunit/regress/regress-1119.js
deleted file mode 100644
index 1163ca042e4cd7..00000000000000
--- a/deps/v8/test/mjsunit/regress/regress-1119.js
+++ /dev/null
@@ -1,44 +0,0 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Test runtime declaration of properties with var which are intercepted
-// by JS accessors.
-
-this.__defineSetter__("x", function() { hasBeenInvoked = true; });
-this.__defineSetter__("y", function() { throw 'exception'; });
-
-var hasBeenInvoked = false;
-eval("try { } catch (e) { var x = false; }");
-assertTrue(hasBeenInvoked);
-
-// This has to run in global scope, so cannot use assertThrows...
-try {
-  eval("try { } catch (e) { var y = false; }");
-  assertUnreachable();
-} catch (e) {
-  assertEquals('exception', e);
-}
diff --git a/deps/v8/test/mjsunit/regress/regress-319722-ArrayBuffer.js b/deps/v8/test/mjsunit/regress/regress-319722-ArrayBuffer.js
index 4a48a61ab38516..e9fb57eaa85392 100644
--- a/deps/v8/test/mjsunit/regress/regress-319722-ArrayBuffer.js
+++ b/deps/v8/test/mjsunit/regress/regress-319722-ArrayBuffer.js
@@ -26,32 +26,36 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --nostress-opt --allow-natives-syntax --mock-arraybuffer-allocator
-var maxSize = %MaxSmi() + 1;
-var ab;
+
+let kArrayBufferByteLengthLimit = %ArrayBufferMaxByteLength() + 1;
+let kTypedArrayLengthLimit = %TypedArrayMaxLength() + 1;
 
 // Allocate the largest ArrayBuffer we can on this architecture.
-for (k = 8; k >= 1 && ab == null; k = k/2) {
-  try {
-    ab = new ArrayBuffer(maxSize * k);
-  } catch (e) {
-    ab = null;
-  }
-}
+let ab = new ArrayBuffer(kArrayBufferByteLengthLimit - 1);
 
-assertTrue(ab != null);
+function TestArray(constr, elementSize) {
+  assertEquals(kArrayBufferByteLengthLimit % elementSize, 0);
+  let bufferSizeLength = kArrayBufferByteLengthLimit / elementSize;
+
+  let minUnallocatableSize =
+      kTypedArrayLengthLimit < bufferSizeLength
+        ? kTypedArrayLengthLimit
+        : bufferSizeLength;
 
-function TestArray(constr) {
   assertThrows(function() {
-    new constr(ab, 0, maxSize);
+    new constr(ab, 0, minUnallocatableSize);
   }, RangeError);
+
+  // This one must succeed.
+  new constr(ab, 0, minUnallocatableSize - 1);
 }
 
-TestArray(Uint8Array);
-TestArray(Int8Array);
-TestArray(Uint16Array);
-TestArray(Int16Array);
-TestArray(Uint32Array);
-TestArray(Int32Array);
-TestArray(Float32Array);
-TestArray(Float64Array);
-TestArray(Uint8ClampedArray);
+TestArray(Uint8Array, 1);
+TestArray(Int8Array, 1);
+TestArray(Uint16Array, 2);
+TestArray(Int16Array, 2);
+TestArray(Uint32Array, 4);
+TestArray(Int32Array, 4);
+TestArray(Float32Array, 4);
+TestArray(Float64Array, 8);
+TestArray(Uint8ClampedArray, 1);
diff --git a/deps/v8/test/mjsunit/regress/regress-319722-TypedArrays.js b/deps/v8/test/mjsunit/regress/regress-319722-TypedArrays.js
index 0445e2d2cf0dd4..b0864907fc174f 100644
--- a/deps/v8/test/mjsunit/regress/regress-319722-TypedArrays.js
+++ b/deps/v8/test/mjsunit/regress/regress-319722-TypedArrays.js
@@ -1,4 +1,3 @@
-
 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
@@ -26,20 +25,34 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --nostress-opt --allow-natives-syntax
-var maxSize = %MaxSmi() + 1;
-function TestArray(constr) {
+// Flags: --nostress-opt --allow-natives-syntax --mock-arraybuffer-allocator
+
+let kArrayBufferByteLengthLimit = %ArrayBufferMaxByteLength() + 1;
+let kTypedArrayLengthLimit = %TypedArrayMaxLength() + 1;
+
+function TestArray(constr, elementSize) {
+  assertEquals(kArrayBufferByteLengthLimit % elementSize, 0);
+  let bufferSizeLength = kArrayBufferByteLengthLimit / elementSize;
+
+  let minUnallocatableSize =
+      kTypedArrayLengthLimit < bufferSizeLength
+        ? kTypedArrayLengthLimit
+        : bufferSizeLength;
+
   assertThrows(function() {
-    new constr(maxSize);
+    new constr(minUnallocatableSize);
   }, RangeError);
+
+  // This one must succeed.
+  new constr(minUnallocatableSize - 1);
 }
 
-TestArray(Uint8Array);
-TestArray(Int8Array);
-TestArray(Uint16Array);
-TestArray(Int16Array);
-TestArray(Uint32Array);
-TestArray(Int32Array);
-TestArray(Float32Array);
-TestArray(Float64Array);
-TestArray(Uint8ClampedArray);
+TestArray(Uint8Array, 1);
+TestArray(Int8Array, 1);
+TestArray(Uint16Array, 2);
+TestArray(Int16Array, 2);
+TestArray(Uint32Array, 4);
+TestArray(Int32Array, 4);
+TestArray(Float32Array, 4);
+TestArray(Float64Array, 8);
+TestArray(Uint8ClampedArray, 1);
diff --git a/deps/v8/test/mjsunit/regress/regress-599717.js b/deps/v8/test/mjsunit/regress/regress-599717.js
index 51831860e93c22..1ccca1a058aeab 100644
--- a/deps/v8/test/mjsunit/regress/regress-599717.js
+++ b/deps/v8/test/mjsunit/regress/regress-599717.js
@@ -18,9 +18,11 @@ try {
   var __v_12 = new ArrayBuffer(2147483648);
   ok = true;
 } catch (e) {
-  // Can happen on 32 bit systems.
+  // Can happen if the allocation fails.
 }
 if (ok) {
   var module = __f_61(this, null, __v_12);
-  assertTrue(%IsAsmWasmCode(__f_61));
+  // This fails AsmJS memory size validation because of kV8MaxWasmMemoryPages
+  // value.
+  assertFalse(%IsAsmWasmCode(__f_61));
 }
diff --git a/deps/v8/test/mjsunit/regress/regress-678917.js b/deps/v8/test/mjsunit/regress/regress-678917.js
index a8ce04212bcc8f..8b21cf366d5a0a 100644
--- a/deps/v8/test/mjsunit/regress/regress-678917.js
+++ b/deps/v8/test/mjsunit/regress/regress-678917.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --max-old-space-size=1600 --nostress-incremental-marking
+// Flags: --max-old-space-size=2000 --nostress-incremental-marking
 
 // This test uses a lot of memory and fails with flaky OOM when run
 // with --stress-incremental-marking on TSAN.
diff --git a/deps/v8/test/mjsunit/regress/regress-6838-4.js b/deps/v8/test/mjsunit/regress/regress-6838-4.js
new file mode 100644
index 00000000000000..6c6f8e0f7381ad
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-6838-4.js
@@ -0,0 +1,79 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestMinusZeroIsDouble() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / +-0;
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(-Infinity, f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMinusZeroIsDoubleBracketed() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / (-0);
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(-Infinity, f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMinusZeroIsDoubleMultDouble1() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / (-0 * 1.0);
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(-Infinity, f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMinusZeroIsDoubleMultDouble2() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / (1.0 * -0);
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(-Infinity, f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMinusZeroIsDoubleMultInt() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / (-0 * 1);
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertFalse(%IsAsmWasmCode(Module));
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-7773.js b/deps/v8/test/mjsunit/regress/regress-7773.js
index 6f047711bf5c31..7930ae91063f39 100644
--- a/deps/v8/test/mjsunit/regress/regress-7773.js
+++ b/deps/v8/test/mjsunit/regress/regress-7773.js
@@ -43,8 +43,8 @@
     configurable: true
   };
 
-  // Anonymous classes do have a "name" property by default with a value of ''.
-  assertEquals(descriptor, Object.getOwnPropertyDescriptor(class {}, 'name'));
+  // Anonymous classes do not have a "name" property by default.
+  assertSame(undefined, Object.getOwnPropertyDescriptor(class {}, 'name'));
   descriptor.value = 'C';
   assertEquals(descriptor, Object.getOwnPropertyDescriptor(class C {}, 'name'));
 
@@ -55,9 +55,8 @@
 
   let b = { __proto__: class {} };
   assertSame('', b.__proto__.name);
-  descriptor.value = '';
-  assertEquals(
-      descriptor, Object.getOwnPropertyDescriptor(b.__proto__, 'name'));
+  assertSame(
+      undefined, Object.getOwnPropertyDescriptor(b.__proto__, 'name'));
 
   let c = { fn: class F {} };
   assertSame('F', c.fn.name);
diff --git a/deps/v8/test/mjsunit/regress/regress-863810.js b/deps/v8/test/mjsunit/regress/regress-863810.js
index 3bec6f5ae97672..07c05992311fc1 100644
--- a/deps/v8/test/mjsunit/regress/regress-863810.js
+++ b/deps/v8/test/mjsunit/regress/regress-863810.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --no-liftoff --no-wasm-tier-up --no-future --debug-code
+// Flags: --no-liftoff --no-future --debug-code
 
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
diff --git a/deps/v8/test/mjsunit/regress/regress-9209.js b/deps/v8/test/mjsunit/regress/regress-9209.js
new file mode 100644
index 00000000000000..92e3658ca78143
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-9209.js
@@ -0,0 +1,14 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addImport("d8", "quit", kSig_v_v)
+builder.addFunction('do_not_crash', kSig_v_v)
+        .addBody([kExprCallFunction, 0])
+        .exportFunc();
+builder.instantiate({d8: {quit: quit}}).exports.do_not_crash();
diff --git a/deps/v8/test/mjsunit/regress/regress-976627.js b/deps/v8/test/mjsunit/regress/regress-976627.js
deleted file mode 100644
index 1dde87e196c960..00000000000000
--- a/deps/v8/test/mjsunit/regress/regress-976627.js
+++ /dev/null
@@ -1,40 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --young-generation-large-objects
-
-function v2() {
-    const v8 = Symbol || 9007199254740991;
-    function v9(v10,v11,v12) {
-    }
-    const v16 = String();
-    const v100 = String();//add
-    const v106 = String();// add
-    const v116 = String();// add
-    const v17 = Int32Array();
-    const v18 = Map();
-    const v19 = [];
-    const v20 = v18.values();
-    function v21(v22,v23,v24,v25,v26) {
-    }
-    function v28(v29,v30,v31) {
-        function v32(v33,v34,v35,v36) {
-        }
-        let v39 = 0;
-        do {
-            const v40 = v32();
-            function v99() {
-            }
-        } while (v39 < 8);
-    }
-    const v41 = Promise();
-}
-const v46 = ["has",13.37,-9007199254740991,Reflect];
-for (let v50 = 64; v50 <= 2000; v50++) {
-    v46.push(v50,v2);
-}
-const v54 = RegExp(v46);
-const v55 = v54.exec();
-
-assertTrue(%HasElementsInALargeObjectSpace(v55));
diff --git a/deps/v8/test/mjsunit/regress/regress-chromium-1040238.js b/deps/v8/test/mjsunit/regress/regress-chromium-1040238.js
new file mode 100644
index 00000000000000..3ac20276b76ac3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-chromium-1040238.js
@@ -0,0 +1,26 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class MyPromise extends Promise {
+  static resolve() {
+    return {
+      then() {
+        throw "then throws";
+      }
+    };
+  }
+}
+
+let myIterable = {
+  [Symbol.iterator]() {
+    return {
+      next() {
+          return {};
+      },
+      get return() { return {}; },
+    };
+  }
+};
+
+MyPromise.race(myIterable);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1015372.js b/deps/v8/test/mjsunit/regress/regress-crbug-1015372.js
new file mode 100644
index 00000000000000..149c1b9131ad54
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1015372.js
@@ -0,0 +1,45 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function opt(flag) {
+    function inline() {
+      (function () {
+        flag()
+      })();
+      (flag) = 1;
+    }
+    inline();
+  }
+  assertThrows(opt, TypeError);
+})();
+
+(function() {
+  function opt(flag){
+      function inline() {
+          var f = (function() {
+              return flag;
+          });
+          function g(x) {
+            (flag) = x;
+          }
+
+          return [f,g];
+      }
+      return inline();
+  }
+  [f, g] = opt(1);
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(1, f());
+  assertEquals(1, f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(1, f());
+
+  g(2);
+
+  assertEquals(2, f());
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1016056.js b/deps/v8/test/mjsunit/regress/regress-crbug-1016056.js
new file mode 100644
index 00000000000000..8e2d290f634cba
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1016056.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(args) {
+  eval();
+  return arguments[0];
+}
+%PrepareFunctionForOptimization(f);
+function g() {
+  return f(1);
+}
+%PrepareFunctionForOptimization(g);
+assertEquals(1, g());
+%OptimizeFunctionOnNextCall(g);
+assertEquals(1, g());
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1017159.js b/deps/v8/test/mjsunit/regress/regress-crbug-1017159.js
new file mode 100644
index 00000000000000..27d6ce97d951ee
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1017159.js
@@ -0,0 +1,27 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function* foo() {
+  __v_1 = foo.x;   // LdaNamedProperty
+  for (;;) {
+    try {
+      yield;
+      try {
+        __v_0 == "object";
+        __v_1[__getRandomProperty()]();
+      } catch(e) {
+        print();
+      }
+    } catch(e) {
+      "Caught: " + e;
+    }
+    break;
+  }
+};
+
+%PrepareFunctionForOptimization(foo);
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1018611-2.js b/deps/v8/test/mjsunit/regress/regress-crbug-1018611-2.js
new file mode 100644
index 00000000000000..260689f384686b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1018611-2.js
@@ -0,0 +1,5 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("({a, b: ([c])}) => { }", SyntaxError);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1018611.js b/deps/v8/test/mjsunit/regress/regress-crbug-1018611.js
new file mode 100644
index 00000000000000..a79c394f6e6806
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1018611.js
@@ -0,0 +1,5 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("(l-(c))=>", SyntaxError);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1020162.js b/deps/v8/test/mjsunit/regress/regress-crbug-1020162.js
new file mode 100644
index 00000000000000..3cee43ca69b0cf
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1020162.js
@@ -0,0 +1,7 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --throws
+
+((get = foo.get(...a, a), b) => 0)();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1020983.js b/deps/v8/test/mjsunit/regress/regress-crbug-1020983.js
new file mode 100644
index 00000000000000..0e0f6086004567
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1020983.js
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-osr
+
+function opt() {
+    for (let i = 0; i < 5000; i++) {
+        try {
+                    try {
+                        throw 1
+                    } finally {
+                        E
+                    }
+        } catch {}
+    }
+eval()
+}
+    opt()
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1022695.js b/deps/v8/test/mjsunit/regress/regress-crbug-1022695.js
new file mode 100644
index 00000000000000..96a2048ec58032
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1022695.js
@@ -0,0 +1,14 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(() => {
+  (function (foo, foreign) {
+      'use asm';
+      var f = foreign.toString;
+      function get() {
+          f();
+      }
+      return get;
+  })(this, new Error())();
+});
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1024099.js b/deps/v8/test/mjsunit/regress/regress-crbug-1024099.js
new file mode 100644
index 00000000000000..72be01b15dc214
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1024099.js
@@ -0,0 +1,16 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let len = 0x20000;
+let ar = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT * len));
+ar[7] = -13;
+ar[0x1673] = -42;
+ar[0x1f875] = -153;
+
+ar.sort();
+
+assertEquals(ar[0], -153);
+assertEquals(ar[1], -42);
+assertEquals(ar[2], -13);
+assertEquals(ar[3], 0);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1024282.js b/deps/v8/test/mjsunit/regress/regress-crbug-1024282.js
new file mode 100644
index 00000000000000..4aa28201a8a706
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1024282.js
@@ -0,0 +1,28 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+assertThrows = function assertThrows(code) {};
+%PrepareFunctionForOptimization(assertThrows);
+
+function foo(val) {
+  var arr = [];
+  function bar() {
+    function m1() {}
+    %PrepareFunctionForOptimization(m1);
+    assertThrows(m1);
+    0 in arr;
+  }
+  %PrepareFunctionForOptimization(bar);
+  bar();  // virtual context distance of 1 from native_context
+  gc();
+  bar(true);
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1027025.js b/deps/v8/test/mjsunit/regress/regress-crbug-1027025.js
new file mode 100644
index 00000000000000..ecf51b6ebd65fe
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1027025.js
@@ -0,0 +1,13 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --future --no-lazy-feedback-allocation
+
+// This test ensures that KeyedAccessStoreMode gets computed correctly for cases when there are multiple Smi Handlers in the FeedbackNexus
+function __f_11(b) {
+  [,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ...b];
+}
+Array.prototype.__defineSetter__("0", () => {});
+__f_11([, 3.3]);
+for (var __v_17 = 0; __v_17 < 100000; __v_17++);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1028396.js b/deps/v8/test/mjsunit/regress/regress-crbug-1028396.js
new file mode 100644
index 00000000000000..007b050f69e7f3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1028396.js
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+(function () {
+  var GeneratorFunction = function* () {}.constructor;
+  class MyFunc extends GeneratorFunction {
+    constructor(...args) {
+      super(...args);
+      this.o = {};
+      this.o = {};
+    }
+  }
+  var f = new MyFunc("'use strict'; yield 153;");
+  gc();
+  var f = new MyFunc("'use strict'; yield 153;");
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1028593.js b/deps/v8/test/mjsunit/regress/regress-crbug-1028593.js
new file mode 100644
index 00000000000000..33e56055df6185
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1028593.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  try {
+    return "number".charCodeAt(0n);
+  } catch(e) {}
+}
+%PrepareFunctionForOptimization(foo);
+for (let i = 0; i < 3; i++) {
+  foo();
+}
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1028863.js b/deps/v8/test/mjsunit/regress/regress-crbug-1028863.js
new file mode 100644
index 00000000000000..d2106635920a8f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1028863.js
@@ -0,0 +1,24 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function write(begin, end, step) {
+  for (var i = begin; i >= end; i += step) {
+    step = end - begin;
+    begin >>>= 805306382;
+  }
+}
+
+function bar() {
+  for (let i = 0; i < 10000; i++) {
+    write(Infinity, 1, 1);
+  }
+}
+
+%PrepareFunctionForOptimization(write);
+%PrepareFunctionForOptimization(bar);
+bar();
+%OptimizeFunctionOnNextCall(bar);
+bar();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1029077.js b/deps/v8/test/mjsunit/regress/regress-crbug-1029077.js
new file mode 100644
index 00000000000000..c67f1515a4675f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1029077.js
@@ -0,0 +1,5 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+JSON.parse('[{"a": 2.1, "b": 1, "c": "hello"}, {"a": null, "b": 2, "c": {"a": 2.1, "b": 1.1, "c": "hello"}}]')
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1029658.js b/deps/v8/test/mjsunit/regress/regress-crbug-1029658.js
new file mode 100644
index 00000000000000..98486b129772f6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1029658.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+delete Float64Array.prototype.__proto__[Symbol.iterator];
+let ar = new Float64Array();
+Object.defineProperty(ar, "length", {
+  get: function () { return 121567939849373; }
+});
+
+try { Float64Array.from(ar); } catch (e) {}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1031479.js b/deps/v8/test/mjsunit/regress/regress-crbug-1031479.js
new file mode 100644
index 00000000000000..4d2f2730207d79
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1031479.js
@@ -0,0 +1,37 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --interrupt-budget=200 --stack-size=200 --budget-for-feedback-vector-allocation=100 --expose-gc --stress-flush-bytecode
+
+var i = 0;
+function main() {
+function v0() {
+   function v10(a) {
+        i++;
+        var cur_i = i;
+        try {
+            // This triggers the use of old closure that was installed in the
+            // earlier invocation of v10 and causes an infinite recursion. At
+            // some point we throw from here.
+            [].e = 1;
+
+            // Throw when the new closure is on the stack to trigger a OSR on
+            // the new closure
+            if (cur_i == 2) throw 1;
+        } catch(v22) {
+            // This loop triggers OSR.
+            for (const v24 in "c19rXGEC2E") {
+            }
+        }
+   }
+   const v25 = v10(1);
+   // We install v10's closure here. The bytecode for v10 gets flushed on gc()
+   const v21 = Object.defineProperty([].__proto__,"e",{set:v10});
+}
+const v26 = v0();
+// With --stress-flush-bytecode GC flushes the bytecode for v0 and v10
+gc();
+assertThrows(v0, TypeError);
+}
+main();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1034203.js b/deps/v8/test/mjsunit/regress/regress-crbug-1034203.js
new file mode 100644
index 00000000000000..c22b82c2254ca1
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1034203.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(optimized) {
+  class C {
+    ['h']() {}
+  }
+  let h = C.prototype.h;
+  h.bind();
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1034973.js b/deps/v8/test/mjsunit/regress/regress-crbug-1034973.js
new file mode 100644
index 00000000000000..cd7de8f4c229ca
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1034973.js
@@ -0,0 +1,6 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let x = 0;
+let a = {x, 0:({x:4e14,y:4}), x};
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1035331.js b/deps/v8/test/mjsunit/regress/regress-crbug-1035331.js
new file mode 100644
index 00000000000000..a5f12f5fc8d852
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1035331.js
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+const obj = new class C extends async function () {}.constructor {}();
+delete obj.name;
+
+Number.prototype.__proto__ = obj;
+function foo() {
+  return obj.bind();
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+obj[undefined] = Map, gc();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1038140.js b/deps/v8/test/mjsunit/regress/regress-crbug-1038140.js
new file mode 100644
index 00000000000000..aec43744a1d872
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1038140.js
@@ -0,0 +1,6 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Promise.resolve = function() { return {}; };
+Promise.race([function() {}]);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1038178.js b/deps/v8/test/mjsunit/regress/regress-crbug-1038178.js
new file mode 100644
index 00000000000000..0362f69bcda3ad
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1038178.js
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function opt(){
+    (new (function(){
+        try{
+            r.c>new class extends(W.y.h){}
+            l.g.e._
+            function _(){}[]=({[l](){}}),c()
+        }catch(x){}
+    }));
+    (((function(){})())?.v)()
+}
+%PrepareFunctionForOptimization(opt)
+assertThrows(opt());
+assertThrows(opt());
+%OptimizeFunctionOnNextCall(opt)
+assertThrows(opt());
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1041210.js b/deps/v8/test/mjsunit/regress/regress-crbug-1041210.js
new file mode 100644
index 00000000000000..d3388c745bf8a1
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1041210.js
@@ -0,0 +1,9 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --stress-lazy-source-positions
+
+with ({}) {
+  (() => eval())();
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1041232.js b/deps/v8/test/mjsunit/regress/regress-crbug-1041232.js
new file mode 100644
index 00000000000000..4bb958730af0d3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1041232.js
@@ -0,0 +1,38 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --multi-mapped-mock-allocator
+
+// Chosen for stress runs on 32-bit systems. Physical memory is not an issue
+// thanks to the mock allocator, but virtual address space is still limited.
+let kSize = 128 * 1024 * 1024;
+// Must be >= MultiMappedMockAllocator::kChunkSize in d8.cc.
+let kChunkSize = 2 * 1024 * 1024;
+let a = new Uint8Array(kSize);
+
+for (let i = 0; i < kChunkSize; i++) {
+  a[i] = 42;
+}
+
+// Check that OOB accesses return undefined and all array elements are 42.
+// Importantly, nothing crashes.
+assertEquals(undefined, a[-kChunkSize - 1]);
+assertEquals(undefined, a[-kChunkSize]);
+assertEquals(undefined, a[-1]);
+assertEquals(42, a[0]);
+assertEquals(42, a[1]);
+// If this fails, then you probably tried to run this test without the
+// multi-mapped mock allocator.
+assertEquals(42, a[kChunkSize]);
+assertEquals(42, a[kChunkSize + 1]);
+assertEquals(42, a[kChunkSize + 1]);
+assertEquals(42, a[kSize - kChunkSize]);
+assertEquals(42, a[kSize - 1]);
+assertEquals(undefined, a[kSize]);
+assertEquals(undefined, a[kSize + 1]);
+assertEquals(undefined, a[kSize + kChunkSize]);
+assertEquals(undefined, a[kSize + kSize]);
+
+// Check that excessive requests throw (crbug.com/1042173, crbug.com/1042151).
+assertThrows(() => new ArrayBuffer(Number.MAX_SAFE_INTEGER));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1041251.js b/deps/v8/test/mjsunit/regress/regress-crbug-1041251.js
new file mode 100644
index 00000000000000..8e1628876df2c8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1041251.js
@@ -0,0 +1,14 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let v0 = [0, 1];
+v0.constructor = {
+  [Symbol.species]: function() {
+    let v1 = [2];
+    Object.defineProperty(v1, "length", {writable: false});
+    return v1;
+  }
+}
+
+assertThrows(() => Array.prototype.map.call(v0, function() {}), TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1041616.js b/deps/v8/test/mjsunit/regress/regress-crbug-1041616.js
new file mode 100644
index 00000000000000..b7d0ce318dd2df
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1041616.js
@@ -0,0 +1,17 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+global = 0;
+
+(function foo() {
+  function bar() {
+    let context_allocated = 0;
+    with ({}) {
+      f = function() { ++global; }
+    }
+    function baz() { return foo(context_allocated); };
+    f();
+  };
+  bar();
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1044909.js b/deps/v8/test/mjsunit/regress/regress-crbug-1044909.js
new file mode 100644
index 00000000000000..312643b4af9dc2
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1044909.js
@@ -0,0 +1,15 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function main() {
+  const v2 = Object.prototype;
+  v2[4294967296] = {};
+  const v12 = {get: function() {}};
+  Object.defineProperty(v2, 4294967296, v12);
+  const v15 = {...v2};
+}
+%PrepareFunctionForOptimization(main);
+main();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1044911.js b/deps/v8/test/mjsunit/regress/regress-crbug-1044911.js
new file mode 100644
index 00000000000000..020caefd994f81
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1044911.js
@@ -0,0 +1,12 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let a = [0];
+let l = {
+  valueOf: function() {
+    Object.freeze(a);
+    return 1;
+  }
+};
+a.length = l;
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1050046.js b/deps/v8/test/mjsunit/regress/regress-crbug-1050046.js
new file mode 100644
index 00000000000000..a1d2e53e241e0f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1050046.js
@@ -0,0 +1,13 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var __v_6 = new Boolean();
+ __v_6.first = 0;
+ __v_6.prop = 1;
+for (var __v_2 in __v_6) {
+ delete __v_6.prop;
+ gc();
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-109362.js b/deps/v8/test/mjsunit/regress/regress-crbug-109362.js
index 54bae56a1a6178..cf7cd4e5fa737d 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-109362.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-109362.js
@@ -19,7 +19,7 @@ function test(expectation, f) {
 1 + reference_error //@ sourceURL=evaltest
 })
 */
-test("1:5", new Function(
+test("3:5", new Function(
     '1 + reference_error //@ sourceURL=evaltest'));
 /*
 (function(x
@@ -28,7 +28,7 @@ test("1:5", new Function(
  1 + reference_error //@ sourceURL=evaltest
 })
 */
-test("2:6", new Function(
+test("4:6", new Function(
     'x', '\n 1 + reference_error //@ sourceURL=evaltest'));
 /*
 (function(x
@@ -40,7 +40,7 @@ test("2:6", new Function(
  1 + reference_error //@ sourceURL=evaltest
 })
 */
-test("5:6", new Function(
+test("7:6", new Function(
     'x\n\n', "z//\n", "y", '\n 1 + reference_error //@ sourceURL=evaltest'));
 /*
 (function(x/\*,z//
@@ -49,7 +49,7 @@ test("5:6", new Function(
 1 + reference_error //@ sourceURL=evaltest
 })
 */
-test("2:5", new Function(
+test("4:5", new Function(
     'x/*', "z//\n", "y*/", '1 + reference_error //@ sourceURL=evaltest'));
 /*
 (function () {
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-134609.js b/deps/v8/test/mjsunit/regress/regress-crbug-134609.js
index 01129ae687bdd4..e00bda73b5efd9 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-134609.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-134609.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --inline-accessors
+// Flags: --allow-natives-syntax
 
 var forceDeopt = {x: 0};
 
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-160010.js b/deps/v8/test/mjsunit/regress/regress-crbug-160010.js
deleted file mode 100644
index 586bddd7c23c38..00000000000000
--- a/deps/v8/test/mjsunit/regress/regress-crbug-160010.js
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-var str = "a";
-for (var i = 0; i < 28; i++) {
-  str += str;
-  %FlattenString(str);  // Evil performance hack
-}
-JSON.stringify(str);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-493779.js b/deps/v8/test/mjsunit/regress/regress-crbug-493779.js
index 1071ed23ac95a5..3a5f1cfa5303b2 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-493779.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-493779.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --enable-slow-asserts
+// Flags: --enable-slow-asserts --no-force-slow-path
 
 var s = "\u1234-------";
 for (var i = 0; i < 17; i++) {
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-754175.js b/deps/v8/test/mjsunit/regress/regress-crbug-754175.js
index 5490ba35b91589..1dc392fa366933 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-754175.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-754175.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --mock-arraybuffer-allocator
+// Flags: --mock-arraybuffer-allocator --allow-natives-syntax
 
 function Module(stdlib, foreign, buffer) {
   "use asm";
@@ -10,9 +10,10 @@ function Module(stdlib, foreign, buffer) {
   function foo() { return heap[23] | 0 }
   return { foo:foo };
 }
+const kLength = Math.max(0x100000000, %TypedArrayMaxLength() + 1);
 function instantiate() {
   // On 32-bit architectures buffer allocation will throw.
-  var buffer = new ArrayBuffer(0x100000000);
+  var buffer = new ArrayBuffer(kLength);
   // On 64-bit architectures instantiation will throw.
   var module = Module(this, {}, buffer);
 }
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-899464.js b/deps/v8/test/mjsunit/regress/regress-crbug-899464.js
index b2f594ce8015b4..65e94f9f16218e 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-899464.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-899464.js
@@ -2,4 +2,4 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-''.matchAll(/./u);
+''.matchAll(/./ug);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-913212.js b/deps/v8/test/mjsunit/regress/regress-crbug-913212.js
index 2de99d6efc894b..4087bb6ea03e3c 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-913212.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-913212.js
@@ -4,6 +4,9 @@
 
 const globalThis = this;
 Object.setPrototypeOf(this, new Proxy({}, {
+  has() { return true; },
+  getOwnPropertyDescriptor() {
+    assertUnreachable("getOwnPropertyDescriptor shouldn't be called."); },
   get(target, prop, receiver) {
     assertTrue(receiver === globalThis);
   }
diff --git a/deps/v8/test/mjsunit/regress/regress-v8-10072.js b/deps/v8/test/mjsunit/regress/regress-v8-10072.js
new file mode 100644
index 00000000000000..0afb83012d811e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-v8-10072.js
@@ -0,0 +1,5 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertNull(/(?<=a[^b]*)./.exec('a'));
diff --git a/deps/v8/test/mjsunit/regress/regress-v8-9534.js b/deps/v8/test/mjsunit/regress/regress-v8-9534.js
new file mode 100644
index 00000000000000..430a78bff637e7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-v8-9534.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stack-size=50
+
+let i = 0;
+function f() {
+  i++;
+  if (i > 10) {
+    %PrepareFunctionForOptimization(f);
+    %OptimizeFunctionOnNextCall(f);
+  }
+
+  new Promise(f);
+  return f.x;
+}
+f();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1026680.js b/deps/v8/test/mjsunit/regress/wasm/regress-1026680.js
new file mode 100644
index 00000000000000..5d2e4335c83926
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1026680.js
@@ -0,0 +1,31 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+  const builder = new WasmModuleBuilder();
+  builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
+  builder.addType(makeSig([], []));
+  // Generate function 1 (out of 2).
+  builder.addFunction(undefined, 0 /* sig */)
+    .addBodyWithEnd([
+// signature: i_iii
+// body:
+kExprCallFunction, 0x01, // function #1: v_v
+kExprI32Const, 0x00,
+kExprEnd,   // @5
+            ]);
+  // Generate function 2 (out of 2).
+  builder.addFunction(undefined, 1 /* sig */)
+    .addLocals({f32_count: 1}).addLocals({i32_count: 13})
+    .addBodyWithEnd([
+// signature: v_v
+// body:
+kExprEnd,   // @5
+            ]);
+  builder.addExport('main', 0);
+  const instance = builder.instantiate();
+  print(instance.exports.main(1, 2, 3));
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1027410.js b/deps/v8/test/mjsunit/regress/wasm/regress-1027410.js
new file mode 100644
index 00000000000000..dd9a2f40b827fa
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1027410.js
@@ -0,0 +1,56 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+  const builder = new WasmModuleBuilder();
+  builder.addType(makeSig([kWasmF64, kWasmF64, kWasmI32, kWasmI32], [kWasmI32]));
+  builder.addType(makeSig([], [kWasmF64]));
+  // Generate function 1 (out of 2).
+  builder.addFunction(undefined, 0 /* sig */)
+    .addBodyWithEnd([
+// signature: i_ddii
+// body:
+kExprI32Const, 0x01,
+kExprEnd,   // @3
+            ]);
+  // Generate function 2 (out of 2).
+  builder.addFunction(undefined, 1 /* sig */)
+    .addLocals({f64_count: 8})
+    .addBodyWithEnd([
+// signature: d_v
+// body:
+kExprBlock, kWasmF64,   // @3 f64
+  kExprBlock, kWasmStmt,   // @5
+    kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x3f,
+    kExprLocalTee, 0x00,
+    kExprLocalTee, 0x01,
+    kExprLocalTee, 0x02,
+    kExprLocalTee, 0x03,
+    kExprLocalTee, 0x04,
+    kExprLocalTee, 0x05,
+    kExprLocalTee, 0x06,
+    kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x3f,
+    kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x3f,
+    kExprLocalTee, 0x07,
+    kExprI32Const, 0x00,
+    kExprIf, kWasmI32,   // @52 i32
+      kExprI32Const, 0x00,
+    kExprElse,   // @56
+      kExprI32Const, 0x00,
+      kExprEnd,   // @59
+    kExprBrIf, 0x01,   // depth=1
+    kExprI32UConvertF64,
+    kExprI32Const, 0x00,
+    kExprCallFunction, 0x00, // function #0: i_ddii
+    kExprDrop,
+    kExprUnreachable,
+    kExprEnd,   // @70
+  kExprUnreachable,
+  kExprEnd,   // @72
+kExprEnd,   // @73
+            ]);
+  assertDoesNotThrow(function() { builder.instantiate(); });
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1029642.js b/deps/v8/test/mjsunit/regress/wasm/regress-1029642.js
new file mode 100644
index 00000000000000..b05a79120452e6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1029642.js
@@ -0,0 +1,67 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-staging
+
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js')
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(0, 0, false);
+builder.addType(makeSig([kWasmF32, kWasmF32, kWasmF64], [kWasmF64]));
+// Generate function 1 (out of 1).
+builder.addFunction(undefined, 0 /* sig */)
+  .addBodyWithEnd([
+// signature: d_ffdl
+// body:
+kExprLoop, kWasmF64,   // @15 f64
+  kExprLoop, kWasmF64,   // @17 f64
+    kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    kExprI32Const, 0,
+    kExprIf, kWasmF64,   // @251 f64
+      kExprLoop, kWasmF64,   // @253 f64
+        kExprI32Const, 0,
+        kExprIf, kWasmI32,   // @267 i32
+          kExprMemorySize, 0x00,
+          kExprMemoryGrow, 0x00,
+        kExprElse,   // @273
+          kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+          kExprI32SConvertF32,
+          kExprEnd,   // @282
+        kExprDrop,
+        kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        kExprI32Const, 0x00,
+        kExprBrIf, 0x01,   // depth=1
+        kExprI32SConvertF64,
+        kExprF64SConvertI32,
+        kExprEnd,   // @311
+    kExprElse,   // @312
+      kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      kExprEnd,   // @322
+    kExprF64Max,
+    kExprF64Max,
+    kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+    kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+    kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    kExprCallFunction, 0x00, // function #0: d_ffdl
+    kExprF64Max,
+    kExprF64Max,
+    kExprF64Max,
+    kExprI32Const, 0x00,
+    kExprF64SConvertI32,
+    kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    kExprF64Max,
+    kExprF64Max,
+    kExprEnd,   // @1374
+  kExprEnd,   // @1375
+kExprEnd,   // @1376
+    ]);
+builder.addExport('main', 0);
+builder.toModule();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1030103.js b/deps/v8/test/mjsunit/regress/wasm/regress-1030103.js
new file mode 100644
index 00000000000000..8998849db3125d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1030103.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --log-code
+
+(function(foo, foreign) {
+  'use asm';
+  var fn = foreign.fn;
+  function f() { }
+  return f;
+})(this, {fn: x => x});
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1032753.js b/deps/v8/test/mjsunit/regress/wasm/regress-1032753.js
new file mode 100644
index 00000000000000..40db38307ceb40
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1032753.js
@@ -0,0 +1,9 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --perf-prof --perf-prof-delete-file
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+new WasmModuleBuilder().instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1033948.js b/deps/v8/test/mjsunit/regress/wasm/regress-1033948.js
new file mode 100644
index 00000000000000..cafb8cd54401f2
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1033948.js
@@ -0,0 +1,13 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const desc = {
+  get mutable() {
+    throw "foo";
+  },
+  get value() {
+    console.trace();
+  }
+};
+assertThrowsEquals(() => new WebAssembly.Global(desc), "foo");
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1045737.js b/deps/v8/test/mjsunit/regress/wasm/regress-1045737.js
new file mode 100644
index 00000000000000..621fa75ab8960b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1045737.js
@@ -0,0 +1,25 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-staging --liftoff --no-wasm-tier-up
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false, true);
+builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
+// Generate function 1 (out of 1).
+builder.addFunction(undefined, 0 /* sig */).addBodyWithEnd([
+  // signature: i_iii
+  // body:
+  kExprI32Const, 0x00, kExprI64Const, 0xc2, 0xe6, 0x00, kAtomicPrefix,
+  kExprI64AtomicAdd8U, 0x00, 0xb6, 0x0e, kExprF32SConvertI64,
+  kExprI32SConvertF32,
+  kExprEnd,  // @14
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(instance.exports.main(1, 2, 3), 0);
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-724846.js b/deps/v8/test/mjsunit/regress/wasm/regress-724846.js
index b215b6021a750a..93220a1c9c6ce9 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-724846.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-724846.js
@@ -4,7 +4,7 @@
 
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
-// Flags: --wasm-max-mem-pages=49152
+// Flags: --wasm-max-mem-pages=49151
 
 let builder = new WasmModuleBuilder();
 const num_pages = 49152;
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-8059.js b/deps/v8/test/mjsunit/regress/wasm/regress-8059.js
index 4ee9cd3c431d18..8c6b6931a59727 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-8059.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-8059.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --no-wasm-disable-structured-cloning
-
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function TestPostModule() {
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-8533.js b/deps/v8/test/mjsunit/regress/wasm/regress-8533.js
index da5f44925af3dc..a39d7e883614f1 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-8533.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-8533.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --wasm-shared-engine --no-wasm-disable-structured-cloning --allow-natives-syntax --experimental-wasm-threads
+// Flags: --allow-natives-syntax --experimental-wasm-threads
 
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-864509.js b/deps/v8/test/mjsunit/regress/wasm/regress-864509.js
index 45e9e0b898355c..b18c6619d4a6e6 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-864509.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-864509.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --liftoff --no-wasm-tier-up --no-future --wasm-tier-mask-for-testing=2
+// Flags: --liftoff --no-wasm-tier-up --wasm-tier-mask-for-testing=2
 
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-9759.js b/deps/v8/test/mjsunit/regress/wasm/regress-9759.js
index 9d1f86a48dd000..05bb26f7ff8d36 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-9759.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-9759.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --no-wasm-tier-up --no-liftoff
+// Flags: --no-liftoff --no-force-slow-path
 
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
diff --git a/deps/v8/test/mjsunit/runtime-call-stats.js b/deps/v8/test/mjsunit/runtime-call-stats.js
new file mode 100644
index 00000000000000..e962cde5efb480
--- /dev/null
+++ b/deps/v8/test/mjsunit/runtime-call-stats.js
@@ -0,0 +1,36 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --runtime-calls-stats --expose-gc
+
+// Try to exercise the runtime stats code for optimization and GC.
+
+// Optimize some functions both in the foreground and in the background.
+function test(x) {
+  return 1 + Math.sin(x);
+}
+
+function testConcurrent(x) {
+  return 1 + Math.cos(x);
+}
+
+%PrepareFunctionForOptimization(test);
+test(0.5);
+test(0.6);
+%OptimizeFunctionOnNextCall(test);
+for (var i = 0; i < 100; ++i) {
+  test(0.7);
+}
+
+%PrepareFunctionForOptimization(testConcurrent);
+testConcurrent(0.5);
+testConcurrent(0.6);
+%OptimizeFunctionOnNextCall(testConcurrent, 'concurrent');
+for (var i = 0; i < 100; ++i) {
+  testConcurrent(0.7);
+}
+
+%GetOptimizationStatus(testConcurrent, 'sync');
+
+gc();
diff --git a/deps/v8/test/mjsunit/string-replace-gc.js b/deps/v8/test/mjsunit/string-replace-gc.js
index 56b6a09da1e482..7b2c7177c662e4 100644
--- a/deps/v8/test/mjsunit/string-replace-gc.js
+++ b/deps/v8/test/mjsunit/string-replace-gc.js
@@ -27,7 +27,7 @@
 
 // Regression test for the r1513 fix.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --no-force-slow-path
 
 var foo = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
 assertEquals(39, foo.length);
diff --git a/deps/v8/test/mjsunit/wasm/OWNERS b/deps/v8/test/mjsunit/wasm/OWNERS
index c400f97de0620e..a89e5f10561a45 100644
--- a/deps/v8/test/mjsunit/wasm/OWNERS
+++ b/deps/v8/test/mjsunit/wasm/OWNERS
@@ -1,3 +1 @@
-ahaas@chromium.org
-clemensb@chromium.org
-titzer@chromium.org
+file:../../../src/wasm/OWNERS
diff --git a/deps/v8/test/mjsunit/wasm/asm-wasm-names.js b/deps/v8/test/mjsunit/wasm/asm-wasm-names.js
index 838f42fde428c0..ad7cecc8585cd0 100644
--- a/deps/v8/test/mjsunit/wasm/asm-wasm-names.js
+++ b/deps/v8/test/mjsunit/wasm/asm-wasm-names.js
@@ -13,3 +13,16 @@ function Module(stdlib, foreign, buffer) {
 var func = Module({}, {}, new ArrayBuffer(65536)).bar;
 assertEquals("Module", Module.name);
 assertEquals("foo", func.name);
+assertEquals("function foo() {}", func.toString());
+
+function imp() {}
+function Module2(stdlib, imports) {
+  "use asm";
+  var imp = imports.imp;
+  function bar() {}
+  return {bar: bar};
+}
+
+var bar = Module2({}, {imp: imp}).bar;
+assertEquals("bar", bar.name);
+assertEquals("function bar() {}", bar.toString());
diff --git a/deps/v8/test/mjsunit/wasm/asm-wasm-stack.js b/deps/v8/test/mjsunit/wasm/asm-wasm-stack.js
index 5a05f42dd6f204..b416aaa141eb3d 100644
--- a/deps/v8/test/mjsunit/wasm/asm-wasm-stack.js
+++ b/deps/v8/test/mjsunit/wasm/asm-wasm-stack.js
@@ -148,7 +148,7 @@ function generateOverflowWasmFromAsmJs() {
   }
   assertInstanceof(e, RangeError, 'RangeError should have been thrown');
   checkTopFunctionsOnCallsites(e, [
-    ['f', 133, 13],  // --
+    ['f', 133,  3],  // --
     ['f', 135, 12],  // --
     ['f', 135, 12],  // --
     ['f', 135, 12]   // --
diff --git a/deps/v8/test/mjsunit/wasm/asm-with-wasm-off.js b/deps/v8/test/mjsunit/wasm/asm-with-wasm-off.js
index 2fec37d6e89da3..8c1e7dd85f0533 100644
--- a/deps/v8/test/mjsunit/wasm/asm-with-wasm-off.js
+++ b/deps/v8/test/mjsunit/wasm/asm-with-wasm-off.js
@@ -4,10 +4,10 @@
 
 // Flags: --noexpose-wasm --validate-asm --allow-natives-syntax
 
-// NOTE: This is in its own file because it calls %DisallowCodegenFromStrings,
-// which messes with the isolate's state.
+// NOTE: This is in its own file because it calls %DisallowWasmCodegen, which
+// messes with the isolate's state.
 (function testAsmWithWasmOff() {
-  %DisallowCodegenFromStrings(true);
+  %DisallowWasmCodegen(true);
   function Module() {
     'use asm';
     function foo() {
diff --git a/deps/v8/test/mjsunit/wasm/atomics-non-shared.js b/deps/v8/test/mjsunit/wasm/atomics-non-shared.js
new file mode 100644
index 00000000000000..d4fb826cea008a
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/atomics-non-shared.js
@@ -0,0 +1,60 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads --wasm-atomics-on-non-shared-memory
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+// TODO(gdeepti): If non-shared atomics are moving forward, ensure that
+// the tests here are more comprehensive -i.e. reuse atomics.js/atomics64.js
+// and cctests to run on both shared/non-shared memory.
+
+(function TestCompileGenericAtomicOp() {
+  print(arguments.callee.name);
+  let memory = new WebAssembly.Memory({initial: 0, maximum: 10});
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("main", kSig_i_ii)
+    .addBody([
+      kExprLocalGet, 0,
+      kExprLocalGet, 1,
+      kAtomicPrefix,
+      kExprI32AtomicAdd, 2, 0]);
+  builder.addImportedMemory("m", "imported_mem");
+  let module = new WebAssembly.Module(builder.toBuffer());
+})();
+
+(function TestCompileWasmAtomicNotify() {
+  print(arguments.callee.name);
+  let memory = new WebAssembly.Memory({initial: 0, maximum: 10});
+  let builder = new WasmModuleBuilder();
+  builder.addImportedMemory("m", "memory", 0, 20);
+  builder.addFunction("main", kSig_i_ii)
+    .addBody([
+      kExprLocalGet, 0,
+      kExprLocalGet, 1,
+      kAtomicPrefix,
+      kExprAtomicNotify, 0, 0])
+    .exportAs("main");
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module, {m: {memory}});
+})();
+
+(function TestCompileWasmI32AtomicWait() {
+  print(arguments.callee.name);
+  let memory = new WebAssembly.Memory({initial: 0, maximum: 10});
+  let builder = new WasmModuleBuilder();
+  builder.addImportedMemory("m", "memory", 0, 20);
+  builder.addFunction("main",
+    makeSig([kWasmI32, kWasmI32, kWasmF64], [kWasmI32]))
+    .addBody([
+      kExprLocalGet, 0,
+      kExprLocalGet, 1,
+      kExprLocalGet, 2,
+      kExprI64SConvertF64,
+      kAtomicPrefix,
+      kExprI32AtomicWait, 0, 0])
+      .exportAs("main");
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module, {m: {memory}});
+})();
diff --git a/deps/v8/test/mjsunit/wasm/bulk-memory.js b/deps/v8/test/mjsunit/wasm/bulk-memory.js
index 53ca1454b6fdfe..065cbfd22f3868 100644
--- a/deps/v8/test/mjsunit/wasm/bulk-memory.js
+++ b/deps/v8/test/mjsunit/wasm/bulk-memory.js
@@ -64,11 +64,11 @@ function getMemoryInit(mem, segment_data) {
   builder.addMemory(1);
   builder.addPassiveDataSegment([1, 2, 3]);
   builder.addDataSegment(0, [4, 5, 6]);
-  builder.addFunction('init', kSig_v_v)
+  builder.addFunction('init', kSig_v_i)
       .addBody([
         kExprI32Const, 0,  // Dest.
         kExprI32Const, 0,  // Source.
-        kExprI32Const, 0,  // Size in bytes.
+        kExprLocalGet, 0,  // Size in bytes.
         kNumericPrefix, kExprMemoryInit,
         1,  // Data segment index.
         0,  // Memory index.
@@ -79,7 +79,12 @@ function getMemoryInit(mem, segment_data) {
   // is a trap, not a validation error.
   const instance = builder.instantiate();
 
-  assertTraps(kTrapDataSegmentDropped, () => instance.exports.init());
+  // Initialization succeeds, because source address and size are 0
+  // which is valid on a dropped segment.
+  instance.exports.init(0);
+
+  // Initialization fails, because the segment is implicitly dropped.
+  assertTraps(kTrapMemOutOfBounds, () => instance.exports.init(1));
 })();
 
 (function TestDataDropOnActiveSegment() {
@@ -95,7 +100,8 @@ function getMemoryInit(mem, segment_data) {
       .exportAs('drop');
 
   const instance = builder.instantiate();
-  assertTraps(kTrapDataSegmentDropped, () => instance.exports.drop());
+  // Drop on passive segment is equivalent to double drop which is allowed.
+  instance.exports.drop();
 })();
 
 function getMemoryCopy(mem) {
@@ -163,7 +169,9 @@ function getMemoryFill(mem) {
       .exportAs('drop');
 
   const instance = builder.instantiate();
-  assertTraps(kTrapElemSegmentDropped, () => instance.exports.drop());
+  // Segment already got dropped after initialization and is therefore
+  // not active anymore.
+  instance.exports.drop();
 })();
 
 (function TestLazyDataSegmentBoundsCheck() {
@@ -176,38 +184,14 @@ function getMemoryFill(mem) {
 
   assertEquals(0, view[kPageSize - 1]);
 
-  // Instantiation fails, but still modifies memory.
-  assertThrows(() => builder.instantiate({m: {memory}}), WebAssembly.LinkError);
+  // Instantiation fails, memory remains unmodified.
+  assertThrows(() => builder.instantiate({m: {memory}}), WebAssembly.RuntimeError);
 
-  assertEquals(42, view[kPageSize - 1]);
+  assertEquals(0, view[kPageSize - 1]);
   // The second segment is not initialized.
   assertEquals(0, view[0]);
 })();
 
-(function TestLazyElementSegmentBoundsCheck() {
-  const table = new WebAssembly.Table({initial: 3, element: 'anyfunc'});
-  const builder = new WasmModuleBuilder();
-  builder.addImportedTable('m', 'table', 1);
-  const f = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 42]);
-
-  const tableIndex = 0;
-  const isGlobal = false;
-  builder.addElementSegment(tableIndex, 2, isGlobal, [f.index, f.index]);
-  builder.addElementSegment(tableIndex, 0, isGlobal, [f.index, f.index]);
-
-  assertEquals(null, table.get(0));
-  assertEquals(null, table.get(1));
-  assertEquals(null, table.get(2));
-
-  // Instantiation fails, but still modifies the table.
-  assertThrows(() => builder.instantiate({m: {table}}), WebAssembly.LinkError);
-
-  // The second segment is not initialized.
-  assertEquals(null, table.get(0));
-  assertEquals(null, table.get(1));
-  assertEquals(42, table.get(2)());
-})();
-
 (function TestLazyDataAndElementSegments() {
   const table = new WebAssembly.Table({initial: 1, element: 'anyfunc'});
   const memory = new WebAssembly.Memory({initial: 1});
@@ -226,8 +210,7 @@ function getMemoryFill(mem) {
   // Instantiation fails, but still modifies the table. The memory is not
   // modified, since data segments are initialized after element segments.
   assertThrows(
-      () => builder.instantiate({m: {memory, table}}), WebAssembly.LinkError);
+      () => builder.instantiate({m: {memory, table}}), WebAssembly.RuntimeError);
 
-  assertEquals(42, table.get(0)());
   assertEquals(0, view[0]);
 })();
diff --git a/deps/v8/test/mjsunit/wasm/disallow-codegen.js b/deps/v8/test/mjsunit/wasm/disallow-codegen.js
index c1dfb8a6e33acc..ed1177600dacda 100644
--- a/deps/v8/test/mjsunit/wasm/disallow-codegen.js
+++ b/deps/v8/test/mjsunit/wasm/disallow-codegen.js
@@ -18,33 +18,17 @@ let buffer = (function CreateBuffer() {
   return builder.toBuffer();
 })();
 
-%DisallowCodegenFromStrings(true);
 %DisallowWasmCodegen(true);
 
-async function SyncTestOk() {
+function SyncTestOk() {
   print('sync module compile (ok)...');
-  %DisallowCodegenFromStrings(false);
   %DisallowWasmCodegen(false);
   let module = new WebAssembly.Module(buffer);
   assertInstanceof(module, WebAssembly.Module);
 }
 
-async function SyncTestFail() {
-  print('sync module compile (fail)...');
-  %DisallowCodegenFromStrings(true);
-  %DisallowWasmCodegen(false);
-  try {
-    let module = new WebAssembly.Module(buffer);
-    assertUnreachable();
-  } catch (e) {
-    print("  " + e);
-    assertInstanceof(e, WebAssembly.CompileError);
-  }
-}
-
-async function SyncTestWasmFail(disallow_codegen) {
+function SyncTestWasmFail() {
   print('sync wasm module compile (fail)...');
-  %DisallowCodegenFromStrings(disallow_codegen);
   %DisallowWasmCodegen(true);
   try {
     let module = new WebAssembly.Module(buffer);
@@ -57,7 +41,6 @@ async function SyncTestWasmFail(disallow_codegen) {
 
 async function AsyncTestOk() {
   print('async module compile (ok)...');
-  %DisallowCodegenFromStrings(false);
   %DisallowWasmCodegen(false);
   let promise = WebAssembly.compile(buffer);
   assertPromiseResult(
@@ -66,7 +49,6 @@ async function AsyncTestOk() {
 
 async function AsyncTestWithInstantiateOk() {
   print('async module instantiate (ok)...');
-  %DisallowCodegenFromStrings(false);
   %DisallowWasmCodegen(false);
   let promise = WebAssembly.instantiate(buffer);
   assertPromiseResult(
@@ -74,35 +56,8 @@ async function AsyncTestWithInstantiateOk() {
       module => assertInstanceof(module.instance, WebAssembly.Instance));
 }
 
-async function AsyncTestFail() {
-  print('async module compile (fail)...');
-  %DisallowCodegenFromStrings(true);
-  %DisallowWasmCodegen(false);
-  try {
-    let m = await WebAssembly.compile(buffer);
-    assertUnreachable();
-  } catch (e) {
-    print("  " + e);
-    assertInstanceof(e, WebAssembly.CompileError);
-  }
-}
-
-async function AsyncTestWithInstantiateFail() {
-  print('async module instantiate (fail)...');
-  %DisallowCodegenFromStrings(true);
-  %DisallowWasmCodegen(false);
-  try {
-    let m = await WebAssembly.instantiate(buffer);
-    assertUnreachable();
-  } catch (e) {
-    print("  " + e);
-    assertInstanceof(e, WebAssembly.CompileError);
-  }
-}
-
-async function AsyncTestWasmFail(disallow_codegen) {
+async function AsyncTestWasmFail() {
   print('async wasm module compile (fail)...');
-  %DisallowCodegenFromStrings(disallow_codegen);
   %DisallowWasmCodegen(true);
   try {
     let m = await WebAssembly.compile(buffer);
@@ -113,9 +68,8 @@ async function AsyncTestWasmFail(disallow_codegen) {
   }
 }
 
-async function AsyncTestWasmWithInstantiateFail(disallow_codegen) {
+async function AsyncTestWasmWithInstantiateFail() {
   print('async wasm module instantiate (fail)...');
-  %DisallowCodegenFromStrings(disallow_codegen);
   %DisallowWasmCodegen(true);
   try {
     let m = await WebAssembly.instantiate(buffer);
@@ -130,20 +84,18 @@ async function StreamingTestOk() {
   print('streaming module compile (ok)...');
   // TODO(titzer): compileStreaming must be supplied by embedder.
   // (and it takes a response, not a buffer)
-  %DisallowCodegenFromStrings(false);
   %DisallowWasmCodegen(false);
   if ("Function" != typeof WebAssembly.compileStreaming) {
     print("  no embedder for streaming compilation");
     return;
   }
   let promise = WebAssembly.compileStreaming(buffer);
-  assertPromiseResult(
+  await assertPromiseResult(
     promise, module => assertInstanceof(module, WebAssembly.Module));
 }
 
 async function StreamingTestFail() {
   print('streaming module compile (fail)...');
-  %DisallowCodegenFromStrings(true);
   %DisallowWasmCodegen(false);
   // TODO(titzer): compileStreaming must be supplied by embedder.
   // (and it takes a response, not a buffer)
@@ -161,9 +113,8 @@ async function StreamingTestFail() {
 }
 
 
-async function StreamingTestWasmFail(disallow_codegen) {
+async function StreamingTestWasmFail() {
   print('streaming wasm module compile (fail)...');
-  %DisallowCodegenFromStrings(disallow_codegen);
   %DisallowWasmCodegen(true);
   // TODO(titzer): compileStreaming must be supplied by embedder.
   // (and it takes a response, not a buffer)
@@ -181,23 +132,14 @@ async function StreamingTestWasmFail(disallow_codegen) {
 }
 
 async function RunAll() {
-  await SyncTestOk();
-  await SyncTestFail();
-  await AsyncTestOk();
-  await AsyncTestWithInstantiateOk();
-  await AsyncTestFail();
-  await AsyncTestWithInstantiateFail();
+  SyncTestOk();
+  AsyncTestOk();
   await StreamingTestOk();
   await StreamingTestFail();
-
-  disallow_codegen = false;
-  for (count = 0; count < 2; ++count) {
-    SyncTestWasmFail(disallow_codegen);
-    AsyncTestWasmFail(disallow_codegen);
-    AsyncTestWasmWithInstantiateFail(disallow_codegen);
-    StreamingTestWasmFail(disallow_codegen)
-    disallow_codegen = true;
-  }
+  SyncTestWasmFail();
+  await AsyncTestWasmFail();
+  await AsyncTestWasmWithInstantiateFail();
+  await StreamingTestWasmFail()
 }
 
 assertPromiseResult(RunAll());
diff --git a/deps/v8/test/mjsunit/wasm/empirical_max_memory.js b/deps/v8/test/mjsunit/wasm/empirical_max_memory.js
index 59e15f84644a86..ba6e3d90bb4123 100644
--- a/deps/v8/test/mjsunit/wasm/empirical_max_memory.js
+++ b/deps/v8/test/mjsunit/wasm/empirical_max_memory.js
@@ -6,10 +6,10 @@
 
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
-let k1MiB = 1 * 1024 * 1024;
 let k1GiB = 1 * 1024 * 1024 * 1024;
 let k4GiB = 4 * k1GiB;
-let kMaxMemory = 2 * k1GiB - kPageSize; // TODO(titzer): raise this to 4GiB
+// TODO(4153): Raise this to 4GiB, but only on 64-bit platforms.
+let kMaxMemory = 2 * k1GiB - kPageSize;
 
 (function Test() {
   var memory;
@@ -36,20 +36,19 @@ let kMaxMemory = 2 * k1GiB - kPageSize; // TODO(titzer): raise this to 4GiB
 
   function probe(a, f) {
     print("------------------------");
-    let stride = kPageSize;
+    let stride = kPageSize * 32;  // Don't check every page to save time.
     let max = kMaxMemory;
     for (let i = 0; i < max; i += stride) {
       a.store(i, f(i));
     }
     for (let i = 0; i < max; i += stride) {
-      //    print(`${i} = ${f(i)}`);
       assertEquals(f(i), a.load(i));
     }
   }
 
   try {
     let kPages = kMaxMemory / kPageSize;
-    memory = new WebAssembly.Memory({initial: kPages, maximum: kPages});
+    memory = new WebAssembly.Memory({ initial: kPages, maximum: kPages });
   } catch (e) {
     print("OOM: sorry, best effort max memory size test.");
     return;
diff --git a/deps/v8/test/mjsunit/wasm/exceptions-anyref.js b/deps/v8/test/mjsunit/wasm/exceptions-anyref.js
index ccda100f65d1ea..b18b11aac06c2e 100644
--- a/deps/v8/test/mjsunit/wasm/exceptions-anyref.js
+++ b/deps/v8/test/mjsunit/wasm/exceptions-anyref.js
@@ -143,3 +143,42 @@ load("test/mjsunit/wasm/exceptions-utils.js");
   assertEquals(2.3, instance.exports.throw_catch_param(2.3));
   assertEquals("str", instance.exports.throw_catch_param("str"));
 })();
+
+// Test storing and loading to/from an exception type table.
+(function TestTableExnRef() {
+  let kSig_e_i = makeSig([kWasmI32], [kWasmExnRef]);
+  let kSig_v_ie = makeSig([kWasmI32, kWasmExnRef], []);
+  let builder = new WasmModuleBuilder();
+  let table = builder.addTable(kWasmExnRef, 2).exportAs("table");
+  builder.addFunction("table_load", kSig_e_i)
+      .addBody([
+        kExprLocalGet, 0,
+        kExprTableGet, table.index
+      ]).exportFunc();
+  builder.addFunction("table_store", kSig_v_ie)
+      .addBody([
+        kExprLocalGet, 0,
+        kExprLocalGet, 1,
+        kExprTableSet, table.index
+      ]).exportFunc();
+  let instance = builder.instantiate();
+  let e0 = new Error("my encapsulated error");
+  let e1 = new Error("my other encapsulated error");
+
+  assertNull(instance.exports.table_load(0));
+  assertNull(instance.exports.table_load(1));
+  assertNull(instance.exports.table.get(0));
+  assertNull(instance.exports.table.get(1));
+
+  instance.exports.table_store(0, e0);
+  assertSame(e0, instance.exports.table_load(0));
+  assertNull(instance.exports.table_load(1));
+  assertSame(e0, instance.exports.table.get(0));
+  assertNull(instance.exports.table.get(1));
+
+  instance.exports.table.set(1, e1);
+  assertSame(e0, instance.exports.table_load(0));
+  assertSame(e1, instance.exports.table_load(1));
+  assertSame(e0, instance.exports.table.get(0));
+  assertSame(e1, instance.exports.table.get(1));
+})();
diff --git a/deps/v8/test/mjsunit/wasm/exceptions-simd.js b/deps/v8/test/mjsunit/wasm/exceptions-simd.js
index 00fc725f5de522..6fb7283d7420a9 100644
--- a/deps/v8/test/mjsunit/wasm/exceptions-simd.js
+++ b/deps/v8/test/mjsunit/wasm/exceptions-simd.js
@@ -8,6 +8,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 load("test/mjsunit/wasm/exceptions-utils.js");
 
 (function TestThrowS128Default() {
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
   var kSig_v_s = makeSig([kWasmS128], []);
   var except = builder.addException(kSig_v_s);
@@ -25,6 +26,7 @@ load("test/mjsunit/wasm/exceptions-utils.js");
 })();
 
 (function TestThrowCatchS128Default() {
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
   var kSig_v_s = makeSig([kWasmS128], []);
   var except = builder.addException(kSig_v_s);
@@ -38,13 +40,45 @@ load("test/mjsunit/wasm/exceptions-utils.js");
           kExprBrOnExn, 0, except,
           kExprRethrow,
         kExprEnd,
-        // TODO(mstarzinger): Actually return some compressed form of the s128
-        // value here to make sure it is extracted properly from the exception.
-        kExprDrop,
-        kExprI32Const, 1,
+        kExprLocalGet, 0,
+        kSimdPrefix, kExprI32x4Eq,
+        kSimdPrefix, kExprS1x4AllTrue,
       ])
       .exportFunc();
   var instance = builder.instantiate();
 
   assertEquals(1, instance.exports.throw_catch_simd());
 })();
+
+(function TestThrowCatchS128WithValue() {
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  var kSig_v_s = makeSig([kWasmS128], []);
+  var except = builder.addException(kSig_v_s);
+  const in_idx = 0x10;   // Input index in memory.
+  const out_idx = 0x20;  // Output index in memory.
+  builder.addImportedMemory("env", "memory");
+  builder.addFunction("throw_catch_simd", kSig_v_v)
+      .addBody([
+        kExprI32Const, out_idx,
+        kExprTry, kWasmS128,
+          kExprI32Const, in_idx,
+          kSimdPrefix, kExprS128LoadMem, 0, 0,
+          kExprThrow, 0,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
+        kExprEnd,
+        kSimdPrefix, kExprS128StoreMem, 0, 0,
+      ])
+      .exportFunc();
+  var memory = new WebAssembly.Memory({initial: 1});
+  var instance = builder.instantiate({env: {memory:memory}});
+
+  var ref = [0x01, 0x12, 0x23, 0x34, 0x45, 0x56, 0x67, 0x78,
+             0x89, 0x9a, 0xab, 0xbc, 0xcd, 0xde, 0xef, 0xf0];
+  var array = new Uint8Array(memory.buffer);
+  array.set(ref, in_idx);  // Store reference value in memory.
+  instance.exports.throw_catch_simd();
+  assertArrayEquals(ref, array.slice(out_idx, out_idx + 0x10));
+})();
diff --git a/deps/v8/test/mjsunit/wasm/futex-interpreter.js b/deps/v8/test/mjsunit/wasm/futex-interpreter.js
new file mode 100644
index 00000000000000..738e62a0a575f1
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/futex-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads --allow-natives-syntax
+// Flags: --wasm-interpret-all
+
+// This is a wrapper for existing futex tests with the --wasm-interpret-all
+// flag added. If we ever decide to add a test variant for this, this file can
+// be removed.
+
+load("test/mjsunit/wasm/futex.js");
diff --git a/deps/v8/test/mjsunit/wasm/grow-shared-memory.js b/deps/v8/test/mjsunit/wasm/grow-shared-memory.js
index 3c9d72b499c072..b5c86cb5efb0b2 100644
--- a/deps/v8/test/mjsunit/wasm/grow-shared-memory.js
+++ b/deps/v8/test/mjsunit/wasm/grow-shared-memory.js
@@ -344,3 +344,9 @@ let workerHelpers = assertTrue.toString() + assertIsWasmSharedMemory.toString();
   assertEquals(memory.grow(1), 1);
   assertInstanceof(memory.buffer, SharedArrayBuffer);
 })();
+
+(function TestSharedMemoryGrowByZero() {
+  const memory = new WebAssembly.Memory({
+    "initial": 1, "maximum": 2, "shared": true });
+  assertEquals(memory.grow(0), 1);
+})();
diff --git a/deps/v8/test/mjsunit/wasm/huge-memory.js b/deps/v8/test/mjsunit/wasm/huge-memory.js
index 6c145d70cb8492..6488ce370fea33 100644
--- a/deps/v8/test/mjsunit/wasm/huge-memory.js
+++ b/deps/v8/test/mjsunit/wasm/huge-memory.js
@@ -3,6 +3,8 @@
 // found in the LICENSE file.
 
 // Flags: --wasm-max-mem-pages=49152
+// Save some memory on Linux; other platforms ignore this flag.
+// Flags: --multi-mapped-mock-allocator
 
 // This test makes sure things don't break once we support >2GB wasm memories.
 load("test/mjsunit/wasm/wasm-module-builder.js");
diff --git a/deps/v8/test/mjsunit/wasm/huge-typedarray.js b/deps/v8/test/mjsunit/wasm/huge-typedarray.js
new file mode 100644
index 00000000000000..5188b4f19144bd
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/huge-typedarray.js
@@ -0,0 +1,26 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-max-mem-pages=65536
+
+// Currently, the only way to create a huge TypedArray is via a
+// WebAssembly Memory object.
+
+const kNumPages = 65536;
+const kWasmPageSize = 65536;
+const kBytes = kNumPages * kWasmPageSize;
+const kArrayLength = kBytes - 1;
+assertEquals(2 ** 32, kBytes);
+assertEquals(0xFFFFFFFF, kArrayLength);
+
+var mem = new WebAssembly.Memory({ initial: kNumPages });
+var buffer = mem.buffer;
+var array = new Uint8Array(buffer, 0, kArrayLength);
+
+assertEquals(kBytes, buffer.byteLength);
+assertEquals(kArrayLength, array.length);
+assertEquals(undefined, array[-1]);
+assertEquals(0, array[0]);
+assertEquals(0, array[kArrayLength - 1]);
+assertEquals(undefined, array[kArrayLength]);
diff --git a/deps/v8/test/mjsunit/wasm/import-function.js b/deps/v8/test/mjsunit/wasm/import-function.js
index 6bbad8a2221100..0d6ee4d988d31b 100644
--- a/deps/v8/test/mjsunit/wasm/import-function.js
+++ b/deps/v8/test/mjsunit/wasm/import-function.js
@@ -384,3 +384,59 @@ testImportName('');
   new WebAssembly.Instance(module, {q: {imp: exp.f}});
   assertEquals(11, new Uint8Array(exp.mem.buffer)[0], 'memory changed to 11');
 })();
+
+(function testImportWrapperWorksWithStrictAndSloppy() {
+  function jsSloppyMatch(x) {
+    assertSame(globalThis, this);
+    return x - 4;
+  }
+
+  function jsStrictMatch(x) {
+    "use strict";
+
+    assertEquals(undefined, this);
+    return x - 4;
+  }
+
+  function jsSloppyMismatch(x, y) {
+    assertSame(globalThis, this);
+    assertEquals(undefined, y);
+    return x - 4;
+  }
+
+  function jsStrictMismatch(x, y) {
+    "use strict";
+
+    assertEquals(undefined, this);
+    assertEquals(undefined, y);
+    return x - 4;
+  }
+
+  const builder = new WasmModuleBuilder();
+  const functionIndex = builder.addImport("imports", "jsFun", kSig_i_i);
+  builder.addFunction('wasmFun', kSig_i_i)
+    .addBody([
+      kExprLocalGet, 0,
+      kExprI32Const, 2,
+      kExprI32Mul,
+      kExprCallFunction, functionIndex
+    ])
+    .exportFunc();
+  const module = builder.toModule();
+
+  print("Running matching sloppy function");
+  const instanceSloppyMatch = new WebAssembly.Instance(module, {imports: {jsFun: jsSloppyMatch}});
+  assertEquals(42, instanceSloppyMatch.exports.wasmFun(23));
+
+  print("Running matching strict function");
+  const instanceStrictMatch = new WebAssembly.Instance(module, {imports: {jsFun: jsStrictMatch}});
+  assertEquals(42, instanceStrictMatch.exports.wasmFun(23));
+
+  print("Running mismatching sloppy function");
+  const instanceSloppyMismatch = new WebAssembly.Instance(module, {imports: {jsFun: jsSloppyMismatch}});
+  assertEquals(42, instanceSloppyMismatch.exports.wasmFun(23));
+
+  print("Running mismatching strict function");
+  const instanceStrictMismatch = new WebAssembly.Instance(module, {imports: {jsFun: jsStrictMismatch}});
+  assertEquals(42, instanceStrictMismatch.exports.wasmFun(23));
+})();
diff --git a/deps/v8/test/mjsunit/wasm/interpreter-mixed.js b/deps/v8/test/mjsunit/wasm/interpreter-mixed.js
index 27df605d466904..2d15e03c79868b 100644
--- a/deps/v8/test/mjsunit/wasm/interpreter-mixed.js
+++ b/deps/v8/test/mjsunit/wasm/interpreter-mixed.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --expose-gc
 
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
@@ -144,28 +144,32 @@ function redirectToInterpreter(
   // Three runs: Break in instance 1, break in instance 2, or both.
   for (let run = 0; run < 3; ++run) {
     print(" - run " + run);
-    let [instance1, instance2] = createTwoInstancesCallingEachOther();
-
-    let interpreted_before_1 = %WasmNumInterpretedCalls(instance1);
-    let interpreted_before_2 = %WasmNumInterpretedCalls(instance2);
-    // Call plus_two, which calls plus_one.
-    assertEquals(9, instance2.exports.plus_two(7));
-
-    // Nothing interpreted:
-    assertEquals(interpreted_before_1, %WasmNumInterpretedCalls(instance1));
-    assertEquals(interpreted_before_2, %WasmNumInterpretedCalls(instance2));
-
-    // Now redirect functions to the interpreter.
-    redirectToInterpreter(instance1, instance2, run != 1, run != 0);
-
-    // Call plus_two, which calls plus_one.
-    assertEquals(9, instance2.exports.plus_two(7));
-
-    // TODO(6668): Fix patching of instances which imported others' code.
-    //assertEquals(interpreted_before_1 + (run == 1 ? 0 : 1),
-    //             %WasmNumInterpretedCalls(instance1));
-    assertEquals(interpreted_before_2 + (run == 0 ? 0 : 1),
-                 %WasmNumInterpretedCalls(instance2));
+    (() => {
+      // Trigger a GC to ensure that the underlying native module is not a cached
+      // one from a previous run, with functions already redirected to the
+      // interpreter. This is not observable from pure JavaScript, but this is
+      // observable with the internal runtime functions used in this test.
+      // Run in a local scope to ensure previous native modules are
+      // unreachable.
+      gc();
+      let [instance1, instance2] = createTwoInstancesCallingEachOther();
+      let interpreted_before_1 = %WasmNumInterpretedCalls(instance1);
+      let interpreted_before_2 = %WasmNumInterpretedCalls(instance2);
+      // Call plus_two, which calls plus_one.
+      assertEquals(9, instance2.exports.plus_two(7));
+      // Nothing interpreted:
+      assertEquals(interpreted_before_1, %WasmNumInterpretedCalls(instance1));
+      assertEquals(interpreted_before_2, %WasmNumInterpretedCalls(instance2));
+      // Now redirect functions to the interpreter.
+      redirectToInterpreter(instance1, instance2, run != 1, run != 0);
+      // Call plus_two, which calls plus_one.
+      assertEquals(9, instance2.exports.plus_two(7));
+      // TODO(6668): Fix patching of instances which imported others' code.
+      //assertEquals(interpreted_before_1 + (run == 1 ? 0 : 1),
+      //             %WasmNumInterpretedCalls(instance1));
+      assertEquals(interpreted_before_2 + (run == 0 ? 0 : 1),
+                   %WasmNumInterpretedCalls(instance2))
+    })();
   }
 })();
 
diff --git a/deps/v8/test/mjsunit/wasm/js-api.js b/deps/v8/test/mjsunit/wasm/js-api.js
index 031f2e07ec2d39..bf9eb3978146ba 100644
--- a/deps/v8/test/mjsunit/wasm/js-api.js
+++ b/deps/v8/test/mjsunit/wasm/js-api.js
@@ -18,6 +18,15 @@ function assertArrayBuffer(val, expected) {
   }
 }
 
+function isConstructor(value) {
+  var p = new Proxy(value, { construct: () => ({}) });
+  try {
+    return new p, true;
+  } catch(e) {
+    return false;
+  }
+}
+
 let emptyModuleBinary = (() => {
   var builder = new WasmModuleBuilder();
   return new Int8Array(builder.toBuffer());
@@ -77,6 +86,7 @@ let CompileError = WebAssembly.CompileError;
 assertEq(CompileError, compileErrorDesc.value);
 assertEq(CompileError.length, 1);
 assertEq(CompileError.name, 'CompileError');
+assertTrue(isConstructor(CompileError));
 let compileError = new CompileError;
 assertTrue(compileError instanceof CompileError);
 assertTrue(compileError instanceof Error);
@@ -95,6 +105,7 @@ let RuntimeError = WebAssembly.RuntimeError;
 assertEq(RuntimeError, runtimeErrorDesc.value);
 assertEq(RuntimeError.length, 1);
 assertEq(RuntimeError.name, 'RuntimeError');
+assertTrue(isConstructor(RuntimeError));
 let runtimeError = new RuntimeError;
 assertTrue(runtimeError instanceof RuntimeError);
 assertTrue(runtimeError instanceof Error);
@@ -112,6 +123,7 @@ let LinkError = WebAssembly.LinkError;
 assertEq(LinkError, linkErrorDesc.value);
 assertEq(LinkError.length, 1);
 assertEq(LinkError.name, 'LinkError');
+assertTrue(isConstructor(LinkError));
 let linkError = new LinkError;
 assertTrue(linkError instanceof LinkError);
 assertTrue(linkError instanceof Error);
@@ -131,6 +143,7 @@ let Module = WebAssembly.Module;
 assertEq(Module, moduleDesc.value);
 assertEq(Module.length, 1);
 assertEq(Module.name, 'Module');
+assertTrue(isConstructor(Module));
 assertThrows(
     () => Module(), TypeError, /must be invoked with 'new'/);
 assertThrows(
@@ -184,6 +197,7 @@ assertTrue(moduleImportsDesc.configurable);
 // 'WebAssembly.Module.imports' method
 let moduleImports = moduleImportsDesc.value;
 assertEq(moduleImports.length, 1);
+assertFalse(isConstructor(moduleImports));
 assertThrows(
     () => moduleImports(), TypeError, /Argument 0 must be a WebAssembly.Module/);
 assertThrows(
@@ -231,6 +245,7 @@ assertTrue(moduleExportsDesc.configurable);
 // 'WebAssembly.Module.exports' method
 let moduleExports = moduleExportsDesc.value;
 assertEq(moduleExports.length, 1);
+assertFalse(isConstructor(moduleExports));
 assertThrows(
     () => moduleExports(), TypeError, /Argument 0 must be a WebAssembly.Module/);
 assertThrows(
@@ -274,8 +289,10 @@ assertTrue(moduleCustomSectionsDesc.writable);
 assertTrue(moduleCustomSectionsDesc.enumerable);
 assertTrue(moduleCustomSectionsDesc.configurable);
 
+// 'WebAssembly.Module.customSections' method
 let moduleCustomSections = moduleCustomSectionsDesc.value;
 assertEq(moduleCustomSections.length, 2);
+assertFalse(isConstructor(moduleCustomSections));
 assertThrows(
     () => moduleCustomSections(), TypeError, /Argument 0 must be a WebAssembly.Module/);
 assertThrows(
@@ -334,7 +351,7 @@ let Instance = WebAssembly.Instance;
 assertEq(Instance, instanceDesc.value);
 assertEq(Instance.length, 1);
 assertEq(Instance.name, 'Instance');
-
+assertTrue(isConstructor(Instance));
 assertThrows(
     () => Instance(), TypeError, /must be invoked with 'new'/);
 assertThrows(
@@ -380,6 +397,10 @@ assertEq(Object.getPrototypeOf(exportingInstance), instanceProto);
 let instanceExportsDesc =
     Object.getOwnPropertyDescriptor(instanceProto, 'exports');
 assertEq(typeof instanceExportsDesc.get, 'function');
+assertEq(instanceExportsDesc.get.name, 'get exports');
+assertEq(instanceExportsDesc.get.length, 0);
+assertFalse(isConstructor(instanceExportsDesc.get));
+assertFalse('prototype' in instanceExportsDesc.get);
 assertEq(instanceExportsDesc.set, undefined);
 assertTrue(instanceExportsDesc.enumerable);
 assertTrue(instanceExportsDesc.configurable);
@@ -410,6 +431,7 @@ let Memory = WebAssembly.Memory;
 assertEq(Memory, memoryDesc.value);
 assertEq(Memory.length, 1);
 assertEq(Memory.name, 'Memory');
+assertTrue(isConstructor(Memory));
 assertThrows(
     () => Memory(), TypeError, /must be invoked with 'new'/);
 assertThrows(
@@ -456,6 +478,10 @@ assertEq(Object.getPrototypeOf(mem1), memoryProto);
 // 'WebAssembly.Memory.prototype.buffer' accessor property
 let bufferDesc = Object.getOwnPropertyDescriptor(memoryProto, 'buffer');
 assertEq(typeof bufferDesc.get, 'function');
+assertEq(bufferDesc.get.name, 'get buffer');
+assertEq(bufferDesc.get.length, 0);
+assertFalse(isConstructor(bufferDesc.get));
+assertFalse('prototype' in bufferDesc.get);
 assertEq(bufferDesc.set, undefined);
 assertTrue(bufferDesc.enumerable);
 assertTrue(bufferDesc.configurable);
@@ -476,9 +502,9 @@ assertTrue(memGrowDesc.enumerable);
 assertTrue(memGrowDesc.configurable);
 
 // 'WebAssembly.Memory.prototype.grow' method
-
 let memGrow = memGrowDesc.value;
 assertEq(memGrow.length, 1);
+assertFalse(isConstructor(memGrow));
 assertThrows(
     () => memGrow.call(), TypeError, /Receiver is not a WebAssembly.Memory/);
 assertThrows(
@@ -550,6 +576,7 @@ let Table = WebAssembly.Table;
 assertEq(Table, tableDesc.value);
 assertEq(Table.length, 1);
 assertEq(Table.name, 'Table');
+assertTrue(isConstructor(Table));
 assertThrows(
     () => Table(), TypeError, /must be invoked with 'new'/);
 assertThrows(
@@ -608,6 +635,10 @@ assertEq(Object.getPrototypeOf(tbl1), tableProto);
 // 'WebAssembly.Table.prototype.length' accessor data property
 let lengthDesc = Object.getOwnPropertyDescriptor(tableProto, 'length');
 assertEq(typeof lengthDesc.get, 'function');
+assertEq(lengthDesc.get.name, 'get length');
+assertEq(lengthDesc.get.length, 0);
+assertFalse(isConstructor(lengthDesc.get));
+assertFalse('prototype' in lengthDesc.get);
 assertEq(lengthDesc.set, undefined);
 assertTrue(lengthDesc.enumerable);
 assertTrue(lengthDesc.configurable);
@@ -631,6 +662,7 @@ assertTrue(getDesc.configurable);
 // 'WebAssembly.Table.prototype.get' method
 let get = getDesc.value;
 assertEq(get.length, 1);
+assertFalse(isConstructor(get));
 assertThrows(
     () => get.call(), TypeError, /Receiver is not a WebAssembly.Table/);
 assertThrows(
@@ -660,6 +692,7 @@ assertTrue(setDesc.configurable);
 // 'WebAssembly.Table.prototype.set' method
 let set = setDesc.value;
 assertEq(set.length, 2);
+assertFalse(isConstructor(set));
 assertThrows(
     () => set.call(), TypeError, /Receiver is not a WebAssembly.Table/);
 assertThrows(
@@ -714,6 +747,7 @@ assertTrue(tblGrowDesc.configurable);
 // 'WebAssembly.Table.prototype.grow' method
 let tblGrow = tblGrowDesc.value;
 assertEq(tblGrow.length, 1);
+assertFalse(isConstructor(tblGrow));
 assertThrows(
     () => tblGrow.call(), TypeError, /Receiver is not a WebAssembly.Table/);
 assertThrows(
@@ -760,6 +794,7 @@ let compile = WebAssembly.compile;
 assertEq(compile, compileDesc.value);
 assertEq(compile.length, 1);
 assertEq(compile.name, 'compile');
+assertFalse(isConstructor(compile));
 function assertCompileError(args, err, msg) {
   assertThrowsAsync(compile(...args), err /* TODO , msg */);
 }
@@ -802,6 +837,7 @@ let instantiate = WebAssembly.instantiate;
 assertEq(instantiate, instantiateDesc.value);
 assertEq(instantiate.length, 1);
 assertEq(instantiate.name, 'instantiate');
+assertFalse(isConstructor(instantiate));
 function assertInstantiateError(args, err, msg) {
   assertThrowsAsync(instantiate(...args), err /* TODO , msg */);
 }
@@ -913,3 +949,17 @@ assertInstantiateSuccess(
   assertThrows(() => new WebAssembly.Global({ value: "i64" }, 1n), TypeError,
                /Can't set the value/);
 })();
+
+(function TestAccessorFunctions() {
+  function testAccessorFunction(obj, prop, accessor) {
+    var desc = Object.getOwnPropertyDescriptor(obj, prop);
+    assertSame('function', typeof desc[accessor]);
+    assertFalse(desc[accessor].hasOwnProperty('prototype'));
+    assertFalse(isConstructor(desc[accessor]));
+  }
+  testAccessorFunction(WebAssembly.Global.prototype, "value", "get");
+  testAccessorFunction(WebAssembly.Global.prototype, "value", "set");
+  testAccessorFunction(WebAssembly.Instance.prototype, "exports", "get");
+  testAccessorFunction(WebAssembly.Memory.prototype, "buffer", "get");
+  testAccessorFunction(WebAssembly.Table.prototype, "length", "get");
+})();
diff --git a/deps/v8/test/mjsunit/wasm/liftoff.js b/deps/v8/test/mjsunit/wasm/liftoff.js
index 04eeffbea27ca7..77fdddec3f3821 100644
--- a/deps/v8/test/mjsunit/wasm/liftoff.js
+++ b/deps/v8/test/mjsunit/wasm/liftoff.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --liftoff --no-future --no-wasm-tier-up
+// Flags: --allow-natives-syntax --liftoff --no-wasm-tier-up
 
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
diff --git a/deps/v8/test/mjsunit/wasm/multi-value-interpreter.js b/deps/v8/test/mjsunit/wasm/multi-value-interpreter.js
new file mode 100644
index 00000000000000..53f5cfbbde2679
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/multi-value-interpreter.js
@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-mv --wasm-interpret-all
+
+load("test/mjsunit/wasm/multi-value.js");
diff --git a/deps/v8/test/mjsunit/wasm/multi-value.js b/deps/v8/test/mjsunit/wasm/multi-value.js
index e6a7ae99a5cc4c..ca7467b7591ada 100644
--- a/deps/v8/test/mjsunit/wasm/multi-value.js
+++ b/deps/v8/test/mjsunit/wasm/multi-value.js
@@ -66,6 +66,49 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
   assertEquals(instance.exports.main(1, 4), 5);
 })();
 
+(function MultiBlockUnreachableTest() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_il_v = builder.addType(makeSig([], [kWasmI32, kWasmI64]));
+
+  builder.addFunction("main", kSig_i_v)
+    .addBody([
+      kExprBlock, sig_il_v,
+      kExprI32Const, 1,
+      kExprI64Const, 1,
+      kExprBr, 0,
+      kExprI32Const, 1,
+      kExprI64Const, 1,
+      kExprEnd,
+      kExprDrop])
+    .exportAs("main");
+
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module);
+  assertEquals(instance.exports.main(1, 2), 1);
+})();
+
+(function MultiBlockUnreachableTypeErrorTest() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_il_v = builder.addType(makeSig([], [kWasmI32, kWasmI64]));
+
+  builder.addFunction("main", kSig_i_v)
+    .addBody([
+      kExprBlock, sig_il_v,
+      kExprI32Const, 1,
+      kExprI64Const, 1,
+      kExprBr, 0,
+      kExprI64Const, 1,
+      kExprI32Const, 1,
+      // Wrong order: expect i32, i64.
+      kExprEnd,
+      kExprDrop])
+    .exportAs("main");
+
+  assertThrows(() => new WebAssembly.Module(builder.toBuffer()),
+      WebAssembly.CompileError, /expected type i64, found i32.const/);
+})();
 
 (function MultiLoopResultTest() {
   print("MultiLoopResultTest");
@@ -252,6 +295,24 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
   assertEquals(instance.exports.main(1), 6);
 })();
 
+(function MultiIfOneArmedNoTypeCheckTest() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_i_l = builder.addType(kSig_i_l);
+
+  builder.addFunction("main", kSig_i_v)
+    .addBody([
+      kExprI64Const, 0,
+      kExprI32Const, 0,
+      kExprIf, sig_i_l,
+      kExprDrop,
+      kExprI32Const, 0,
+      kExprEnd]);
+
+  assertThrows(() => new WebAssembly.Module(builder.toBuffer()),
+      WebAssembly.CompileError, /expected i32, got i64/);
+})();
+
 (function MultiResultTest() {
   print("MultiResultTest");
   let builder = new WasmModuleBuilder();
@@ -341,6 +402,62 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
   assertEquals(instance.exports.main(10), 200);
 })();
 
+(function MultiBrTableTest() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_ii_v = builder.addType(kSig_v_v);
+
+  builder.addFunction("main", kSig_ii_v)
+    .addBody([
+      kExprI32Const, 1, kExprI32Const, 2,
+      kExprI32Const, 0,
+      kExprBrTable, 1, 0, 0,
+    ])
+    .exportAs("main");
+
+  let instance = builder.instantiate();
+  assertEquals(instance.exports.main(), [1, 2]);
+})();
+
+(function MultiUnreachablePolymorphicTest() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_v_i = builder.addType(kSig_v_i);
+  let sig_i_i = builder.addType(kSig_i_i);
+
+  builder.addFunction("block", kSig_v_v)
+    .addBody([
+      kExprReturn,
+      kExprBlock, sig_v_i,
+      kExprDrop,
+      kExprEnd
+    ])
+    .exportAs("block");
+  builder.addFunction("if_else", kSig_v_v)
+    .addBody([
+      kExprReturn,
+      kExprIf, sig_v_i,
+      kExprDrop,
+      kExprElse,
+      kExprDrop,
+      kExprEnd
+    ])
+    .exportAs("if_else");
+  builder.addFunction("loop", kSig_v_v)
+    .addBody([
+      kExprReturn,
+      kExprLoop, sig_i_i,
+      kExprEnd,
+      kExprDrop
+    ])
+    .exportAs("loop");
+  // TODO(thibaudm): Create eh + mv mjsunit test and add try/catch case.
+  let instance = builder.instantiate();
+  instance.exports.block();
+  instance.exports.if_else();
+  instance.exports.loop();
+})();
+
 (function MultiWasmToJSReturnTest() {
   print(arguments.callee.name);
   let builder = new WasmModuleBuilder();
diff --git a/deps/v8/test/mjsunit/wasm/nullref-interpreter.js b/deps/v8/test/mjsunit/wasm/nullref-interpreter.js
new file mode 100644
index 00000000000000..f0411394a78ee6
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/nullref-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-anyref -experimental-wasm-eh
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for an existing reference types test case that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/nullref.js");
diff --git a/deps/v8/test/mjsunit/wasm/nullref.js b/deps/v8/test/mjsunit/wasm/nullref.js
new file mode 100644
index 00000000000000..49017bfbf58aa0
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/nullref.js
@@ -0,0 +1,400 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-anyref --experimental-wasm-eh
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let kSig_n_n = makeSig([kWasmNullRef], [kWasmNullRef]);
+let kSig_r_n = makeSig([kWasmNullRef], [kWasmAnyRef]);
+let kSig_a_n = makeSig([kWasmNullRef], [kWasmAnyFunc]);
+let kSig_e_n = makeSig([kWasmNullRef], [kWasmExnRef]);
+let kSig_n_v = makeSig([], [kWasmNullRef]);
+let kSig_n_r = makeSig([kWasmAnyRef], [kWasmNullRef]);
+let kSig_n_a = makeSig([kWasmAnyFunc], [kWasmNullRef]);
+let kSig_n_e = makeSig([kWasmExnRef], [kWasmNullRef]);
+let kSig_v_n = makeSig([kWasmNullRef], []);
+let kSig_v_in = makeSig([kWasmI32, kWasmNullRef], []);
+let kSig_n_i = makeSig([kWasmI32], [kWasmNullRef]);
+let kSig_r_i = makeSig([kWasmI32], [kWasmAnyRef]);
+let kSig_e_i = makeSig([kWasmI32], [kWasmExnRef]);
+let kSig_n_nni = makeSig([kWasmNullRef, kWasmNullRef, kWasmI32], [kWasmNullRef]);
+let kSig_r_nni = makeSig([kWasmNullRef, kWasmNullRef, kWasmI32], [kWasmAnyRef]);
+let kSig_a_nni = makeSig([kWasmNullRef, kWasmNullRef, kWasmI32], [kWasmAnyFunc]);
+let kSig_e_nni = makeSig([kWasmNullRef, kWasmNullRef, kWasmI32], [kWasmExnRef]);
+
+(function testNullRefIdentityFunction() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('nullRef', kSig_n_n)
+      .addBody([kExprLocalGet, 0])
+      .exportFunc();
+  builder.addFunction('anyRef', kSig_r_n)
+      .addBody([kExprLocalGet, 0])
+      .exportFunc();
+  builder.addFunction('funcRef', kSig_a_n)
+      .addBody([kExprLocalGet, 0])
+      .exportFunc();
+  builder.addFunction('exnRef', kSig_e_n)
+      .addBody([kExprLocalGet, 0])
+      .exportFunc();
+
+  const instance = builder.instantiate();
+
+  assertThrows(() => instance.exports.nullRef(a => a), TypeError);
+  assertThrows(() => instance.exports.nullRef(print), TypeError);
+  assertThrows(() => instance.exports.nullRef({'hello': 'world'}), TypeError);
+  assertEquals(null, instance.exports.nullRef(null));
+  assertEquals(null, instance.exports.anyRef(null));
+  assertEquals(null, instance.exports.funcRef(null));
+  assertEquals(null, instance.exports.exnRef(null));
+})();
+
+(function testNullRefFromAnyRefFail() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_n_r);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprLocalGet, 0])
+      .exportFunc();
+
+  assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
+})();
+
+(function testNullRefFromFuncRefFail() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_n_a);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprLocalGet, 0])
+      .exportFunc();
+
+  assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
+})();
+
+(function testNullRefFromExnRefFail() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_n_e);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprLocalGet, 0])
+      .exportFunc();
+
+  assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
+})();
+
+(function testNullRefDefaultValue() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_n_v);
+  builder.addFunction('main', sig_index)
+      .addLocals({nullref_count: 1})
+      .addBody([kExprLocalGet, 0])
+      .exportFunc();
+
+  const main = builder.instantiate().exports.main;
+  assertEquals(null, main());
+})();
+
+(function testNullRefFromAnyRefFail() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_n_v);
+  builder.addFunction('main', sig_index)
+      .addLocals({anyref_count: 1})
+      .addBody([kExprLocalGet, 0])
+      .exportFunc();
+
+  assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
+})();
+
+(function testNullRefFromFuncRefFail() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_n_v);
+  builder.addFunction('main', sig_index)
+      .addLocals({anyfunc_count: 1})
+      .addBody([kExprLocalGet, 0])
+      .exportFunc();
+
+  assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
+})();
+
+(function testNullRefFromExnRefFail() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_n_v);
+  builder.addFunction('main', sig_index)
+      .addLocals({exnref_count: 1})
+      .addBody([kExprLocalGet, 0])
+      .exportFunc();
+
+  assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
+})();
+
+(function testAssignNullRefToNullRefLocal() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_n_n);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprRefNull, kExprLocalSet, 0, kExprLocalGet, 0])
+      .exportFunc();
+
+  const main = builder.instantiate().exports.main;
+  assertEquals(null, main(null));
+})();
+
+(function testImplicitReturnNullRefAsNullRef() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_n_v);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprRefNull])
+      .exportFunc();
+
+  const main = builder.instantiate().exports.main;
+  assertEquals(null, main());
+})();
+
+(function testExplicitReturnNullRefAsNullRef() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_n_v);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprRefNull, kExprReturn])
+      .exportFunc();
+
+  const main = builder.instantiate().exports.main;
+  assertEquals(null, main());
+})();
+
+(function testGetNullRefGlobal() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const initialized = builder.addGlobal(kWasmNullRef, true)
+      .exportAs('initialized');
+  initialized.init = null;
+  const uninitialized = builder.addGlobal(kWasmNullRef, true)
+      .exportAs('uninitialized');
+  const sig_n_v = builder.addType(kSig_n_v);
+  const sig_v_n = builder.addType(kSig_v_n);
+  const sig_v_v = builder.addType(kSig_v_v);
+  builder.addFunction('get_initialized', sig_n_v)
+      .addBody([kExprGlobalGet, initialized.index])
+      .exportFunc();
+  builder.addFunction('get_uninitialized', sig_n_v)
+      .addBody([kExprGlobalGet, initialized.index])
+      .exportFunc();
+  builder.addFunction('set_initialized', sig_v_n)
+      .addBody([kExprLocalGet, 0, kExprGlobalSet, initialized.index])
+      .exportFunc();
+  builder.addFunction('reset_initialized', sig_v_v)
+      .addBody([kExprRefNull, kExprGlobalSet, initialized.index])
+      .exportFunc();
+
+  const instance = builder.instantiate();
+  assertTrue(instance.exports.initialized instanceof WebAssembly.Global);
+  assertTrue(instance.exports.uninitialized instanceof WebAssembly.Global);
+  assertEquals(instance.exports.initialized.value, null);
+  assertEquals(instance.exports.uninitialized.value, null);
+  assertEquals(null, instance.exports.get_initialized());
+  assertEquals(null, instance.exports.get_uninitialized());
+
+  instance.exports.set_initialized(null);
+  assertEquals(instance.exports.initialized.value, null);
+  assertEquals(null, instance.exports.get_initialized());
+
+  instance.exports.reset_initialized();
+  assertEquals(instance.exports.initialized.value, null);
+  assertEquals(null, instance.exports.get_initialized());
+})();
+
+(function testGetNullRefImportedGlobal() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const global_index = builder.addImportedGlobal("foo", "bar",
+      kWasmNullRef);
+  const sig_n_v = builder.addType(kSig_n_v);
+  const sig_v_n = builder.addType(kSig_v_n);
+  const sig_v_v = builder.addType(kSig_v_v);
+  builder.addFunction('get', sig_n_v)
+      .addBody([kExprGlobalGet, global_index])
+      .exportFunc();
+
+  assertThrows(() => builder.instantiate(), TypeError);
+  assertThrows(() => builder.instantiate({foo: {}}), WebAssembly.LinkError);
+  assertThrows(() => builder.instantiate({foo: {bar: {}}}),
+      WebAssembly.LinkError);
+  assertThrows(() => builder.instantiate({foo: {bar: a => a}}),
+      WebAssembly.LinkError);
+
+  const instance = builder.instantiate({foo: {bar: null}});
+  assertEquals(null, instance.exports.get());
+})();
+
+(function testNullRefTable() {
+  print(arguments.callee.name);
+  let table = new WebAssembly.Table({element: "nullref", initial: 2});
+
+  assertEquals(null, table.get(0));
+  table.set(1, null);
+  assertEquals(null, table.get(1));
+  assertThrows(() => table.set(2, null), RangeError);
+
+  table.grow(2);
+
+  assertEquals(null, table.get(2));
+  table.set(3, null);
+  assertEquals(null, table.get(3));
+  assertThrows(() => table.set(4, null), RangeError);
+
+  assertThrows(() => table.set(0, {}), TypeError);
+  assertThrows(() => table.set(0, a => a), TypeError);
+})();
+
+(function testAddNullRefTable() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const table = builder.addTable(kWasmNullRef, 3, 10);
+  builder.addFunction('set_null', kSig_v_i)
+      .addBody([kExprLocalGet, 0, kExprRefNull, kExprTableSet, table.index])
+      .exportFunc();
+  builder.addFunction('set', kSig_v_in)
+      .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprTableSet, table.index])
+      .exportFunc();
+  builder.addFunction('get_null', kSig_n_i)
+      .addBody([kExprLocalGet, 0, kExprTableGet, table.index])
+      .exportFunc();
+  builder.addFunction('get_any', kSig_r_i)
+      .addBody([kExprLocalGet, 0, kExprTableGet, table.index])
+      .exportFunc();
+  builder.addFunction('get_func', kSig_a_i)
+      .addBody([kExprLocalGet, 0, kExprTableGet, table.index])
+      .exportFunc();
+  builder.addFunction('get_exn', kSig_e_i)
+      .addBody([kExprLocalGet, 0, kExprTableGet, table.index])
+      .exportFunc();
+
+  const instance = builder.instantiate();
+  instance.exports.set_null(1);
+  instance.exports.set(2, null);
+
+  assertEquals(null, instance.exports.get_null(0));
+  assertEquals(null, instance.exports.get_null(1));
+  assertEquals(null, instance.exports.get_null(2));
+  assertEquals(null, instance.exports.get_any(0));
+  assertEquals(null, instance.exports.get_any(1));
+  assertEquals(null, instance.exports.get_any(2));
+  assertEquals(null, instance.exports.get_func(0));
+  assertEquals(null, instance.exports.get_func(1));
+  assertEquals(null, instance.exports.get_func(2));
+  assertEquals(null, instance.exports.get_exn(0));
+  assertEquals(null, instance.exports.get_exn(1));
+  assertEquals(null, instance.exports.get_exn(2));
+})();
+
+(function testImportNullRefTable() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const table_index = builder.addImportedTable("imp", "table", 2, 10,
+      kWasmNullRef);
+  builder.addFunction('get_null', kSig_n_i)
+      .addBody([kExprLocalGet, 0, kExprTableGet, table_index])
+      .exportFunc();
+  builder.addFunction('get_any', kSig_r_i)
+      .addBody([kExprLocalGet, 0, kExprTableGet, table_index])
+      .exportFunc();
+  builder.addFunction('get_func', kSig_a_i)
+      .addBody([kExprLocalGet, 0, kExprTableGet, table_index])
+      .exportFunc();
+  builder.addFunction('get_exn', kSig_e_i)
+      .addBody([kExprLocalGet, 0, kExprTableGet, table_index])
+      .exportFunc();
+
+  let table_func = new WebAssembly.Table({element: "anyfunc", initial: 2,
+      maximum: 10});
+  assertThrows(() => builder.instantiate({imp: {table: table_func}}),
+      WebAssembly.LinkError, /imported table does not match the expected type/);
+
+  let table_any = new WebAssembly.Table({element: "anyref", initial: 2,
+      maximum: 10});
+  assertThrows(() => builder.instantiate({imp: {table: table_any}}),
+      WebAssembly.LinkError, /imported table does not match the expected type/);
+
+  let table_null = new WebAssembly.Table({element: "nullref", initial: 2,
+      maximum: 10});
+  table_null.set(1, null);
+  const instance = builder.instantiate({imp: {table: table_null}});
+
+  assertEquals(null, instance.exports.get_null(0));
+  assertEquals(null, instance.exports.get_null(1));
+  assertEquals(null, instance.exports.get_any(0));
+  assertEquals(null, instance.exports.get_any(1));
+  assertEquals(null, instance.exports.get_func(0));
+  assertEquals(null, instance.exports.get_func(1));
+  assertEquals(null, instance.exports.get_exn(0));
+  assertEquals(null, instance.exports.get_exn(1));
+
+  assertThrows(() => instance.exports.get_null(2), WebAssembly.RuntimeError);
+  table_null.grow(1);
+  assertEquals(null, instance.exports.get_null(2));
+})();
+
+(function testImportNullRefTableIntoAnyRefTable() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const table_index = builder.addImportedTable("imp", "table", 2, 10,
+      kWasmAnyRef);
+  builder.addFunction('get', kSig_r_v)
+      .addBody([kExprI32Const, 0, kExprTableGet, table_index])
+      .exportFunc();
+
+  let table_null = new WebAssembly.Table({element: "nullref", initial: 2,
+      maximum: 10});
+  assertThrows(() => builder.instantiate({imp: {table: table_null}}),
+      WebAssembly.LinkError, /imported table does not match the expected type/);
+})();
+
+(function testSelectNullRef() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('select_null', kSig_n_nni)
+      .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprLocalGet, 2,
+          kExprSelectWithType, 1, kWasmNullRef])
+      .exportFunc();
+  builder.addFunction('select_any', kSig_r_nni)
+      .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprLocalGet, 2,
+          kExprSelectWithType, 1, kWasmAnyRef])
+      .exportFunc();
+  builder.addFunction('select_func', kSig_a_nni)
+      .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprLocalGet, 2,
+          kExprSelectWithType, 1, kWasmAnyFunc])
+      .exportFunc();
+  builder.addFunction('select_exn', kSig_e_nni)
+      .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprLocalGet, 2,
+          kExprSelectWithType, 1, kWasmExnRef])
+      .exportFunc();
+  builder.addFunction('select_null_as_any', kSig_r_nni)
+      .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprLocalGet, 2,
+          kExprSelectWithType, 1, kWasmNullRef])
+      .exportFunc();
+  builder.addFunction('select_null_as_func', kSig_a_nni)
+      .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprLocalGet, 2,
+          kExprSelectWithType, 1, kWasmNullRef])
+      .exportFunc();
+  builder.addFunction('select_null_as_exn', kSig_e_nni)
+      .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprLocalGet, 2,
+          kExprSelectWithType, 1, kWasmNullRef])
+      .exportFunc();
+
+  const instance = builder.instantiate();
+
+  assertEquals(null, instance.exports.select_null(null, null, 0));
+  assertEquals(null, instance.exports.select_any(null, null, 0));
+  assertEquals(null, instance.exports.select_func(null, null, 0));
+  assertEquals(null, instance.exports.select_exn(null, null, 0));
+  assertEquals(null, instance.exports.select_null_as_any(null, null, 0));
+  assertEquals(null, instance.exports.select_null_as_func(null, null, 0));
+  assertEquals(null, instance.exports.select_null_as_exn(null, null, 0));
+})();
diff --git a/deps/v8/test/mjsunit/wasm/stack.js b/deps/v8/test/mjsunit/wasm/stack.js
index 7e592e7ef271fa..d6ae8541a60e7b 100644
--- a/deps/v8/test/mjsunit/wasm/stack.js
+++ b/deps/v8/test/mjsunit/wasm/stack.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm
+// Flags: --expose-wasm --no-force-slow-path
 
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
@@ -23,7 +23,7 @@ function verifyStack(frames, expected) {
     assertContains(exp[4], frames[i].getFileName(), "["+i+"].getFileName()");
     var toString;
     if (exp[0]) {
-      toString = "wasm-function[" + exp[2] + "]:" + exp[5];
+      toString = "wasm-function[" + exp[6] + "]:" + exp[5];
       if (exp[1] !== null) toString = exp[1] + " (" + toString + ")";
     } else {
       toString = exp[4] + ":" + exp[2] + ":";
@@ -88,9 +88,9 @@ Error.prepareStackTrace = function(error, frames) {
   module.exports.main();
 
   verifyStack(stack, [
-      // isWasm           function   line  pos        file  offset
+      // isWasm           function   line  pos        file  offset funcIndex
       [   false,           "STACK",    38,   0, "stack.js"],
-      [    true,            "main",     1,   1,       null, '0x86'],
+      [    true,            "main",     0,   1,       null, '0x86',        1],
       [   false, "testStackFrames",    88,   0, "stack.js"],
       [   false,              null,    97,   0, "stack.js"]
   ]);
@@ -103,8 +103,8 @@ Error.prepareStackTrace = function(error, frames) {
   } catch (e) {
     assertContains("unreachable", e.message);
     verifyStack(e.stack, [
-        // isWasm               function   line  pos        file  offset
-        [    true,    "exec_unreachable",    2,    1,       null, '0x8b'],
+        // isWasm               function   line  pos        file  offset funcIndex
+        [    true,    "exec_unreachable",    0,    1,       null, '0x8b',        2],
         [   false, "testWasmUnreachable",  101,    0, "stack.js"],
         [   false,                  null,  112,    0, "stack.js"]
     ]);
@@ -118,9 +118,9 @@ Error.prepareStackTrace = function(error, frames) {
   } catch (e) {
     assertContains("out of bounds", e.message);
     verifyStack(e.stack, [
-        // isWasm                  function   line  pos        file  offset
-        [    true,                     null,     3,   3,       null, '0x91'],
-        [    true, "call_mem_out_of_bounds",     4,   1,       null, '0x97'],
+        // isWasm                  function   line  pos        file  offset funcIndex
+        [    true,                     null,     0,   3,       null, '0x91',        3],
+        [    true, "call_mem_out_of_bounds",     0,   1,       null, '0x97',        4],
         [   false, "testWasmMemOutOfBounds",   116,   0, "stack.js"],
         [   false,                     null,   128,   0, "stack.js"]
     ]);
@@ -147,11 +147,11 @@ Error.prepareStackTrace = function(error, frames) {
     assertEquals("Maximum call stack size exceeded", e.message, "trap reason");
     assertTrue(e.stack.length >= 4, "expected at least 4 stack entries");
     verifyStack(e.stack.splice(0, 4), [
-        // isWasm     function  line  pos  file  offset
-        [    true, "recursion",    0,   0, null, '0x34'],
-        [    true, "recursion",    0,   3, null, '0x37'],
-        [    true, "recursion",    0,   3, null, '0x37'],
-        [    true, "recursion",    0,   3, null, '0x37']
+        // isWasm     function  line  pos  file  offset funcIndex
+        [    true, "recursion",    0,   0, null, '0x34',        0],
+        [    true, "recursion",    0,   3, null, '0x37',        0],
+        [    true, "recursion",    0,   3, null, '0x37',        0],
+        [    true, "recursion",    0,   3, null, '0x37',        0]
     ]);
   }
 })();
@@ -175,10 +175,10 @@ Error.prepareStackTrace = function(error, frames) {
     assertEquals('unreachable', e.message, 'trap reason');
     let hexOffset = '0x' + (unreachable_pos + 0x25).toString(16);
     verifyStack(e.stack, [
-      // isWasm, function, line, pos, file, offset
-      [true, 'main', 0, unreachable_pos + 1, null, hexOffset],  // -
-      [false, 'testBigOffset', 172, 0, 'stack.js'],             //-
-      [false, null, 184, 0, 'stack.js']
+      // isWasm         function line                  pos        file     offset funcIndex
+      [    true,          'main',   0, unreachable_pos + 1,       null, hexOffset,        0],
+      [   false, 'testBigOffset', 172,                   0, 'stack.js'],
+      [   false,            null, 184,                   0, 'stack.js']
     ]);
   }
 })();
diff --git a/deps/v8/test/mjsunit/wasm/streaming-error-position.js b/deps/v8/test/mjsunit/wasm/streaming-error-position.js
index 77c1b46e85fc2d..80a41481aad282 100644
--- a/deps/v8/test/mjsunit/wasm/streaming-error-position.js
+++ b/deps/v8/test/mjsunit/wasm/streaming-error-position.js
@@ -8,22 +8,25 @@
 
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
-function module(bytes) {
-  let buffer = bytes;
-  if (typeof buffer === 'string') {
-    buffer = new ArrayBuffer(bytes.length);
-    let view = new Uint8Array(buffer);
-    for (let i = 0; i < bytes.length; ++i) {
-      view[i] = bytes.charCodeAt(i);
-    }
-  }
-  return new WebAssembly.Module(buffer);
+function testErrorPositionAsyncOnly(bytes, pos, message) {
+  let buffer = bytes.trunc_buffer();
+  // Only test the streaming decoder since this kind of error is out of sync
+  // with the non-streaming decoder, hence errors cannot be compared.
+  assertThrowsAsync(
+      WebAssembly.compile(buffer), WebAssembly.CompileError,
+      new RegExp(message + '.*@\\+' + pos));
 }
 
-function testErrorPosition(bytes, pos, test_name) {
+function testErrorPosition(bytes, pos, message) {
+  let buffer = bytes.trunc_buffer();
+  // First check the non-streaming decoder as a reference.
+  assertThrows(
+      () => new WebAssembly.Module(buffer), WebAssembly.CompileError,
+      new RegExp(message + '.*@\\+' + pos));
+  // Next test the actual streaming decoder.
   assertThrowsAsync(
-      WebAssembly.compile(bytes.trunc_buffer()), WebAssembly.CompileError,
-      new RegExp('@\\+' + pos));
+      WebAssembly.compile(buffer), WebAssembly.CompileError,
+      new RegExp(message + '.*@\\+' + pos));
 }
 
 (function testInvalidMagic() {
@@ -32,7 +35,7 @@ function testErrorPosition(bytes, pos, test_name) {
     kWasmH0, kWasmH1 + 1, kWasmH2, kWasmH3, kWasmV0, kWasmV1, kWasmV2, kWasmV3
   ]);
   // Error at pos==0 because that's where the magic word is.
-  testErrorPosition(bytes, 0, 'testInvalidMagic');
+  testErrorPosition(bytes, 0, 'expected magic word');
 })();
 
 (function testInvalidVersion() {
@@ -41,7 +44,7 @@ function testErrorPosition(bytes, pos, test_name) {
     kWasmH0, kWasmH1, kWasmH2, kWasmH3, kWasmV0, kWasmV1 + 1, kWasmV2, kWasmV3
   ]);
   // Error at pos==4 because that's where the version word is.
-  testErrorPosition(bytes, 4, 'testInvalidVersion');
+  testErrorPosition(bytes, 4, 'expected version');
 })();
 
 (function testSectionLengthInvalidVarint() {
@@ -50,7 +53,7 @@ function testErrorPosition(bytes, pos, test_name) {
   bytes.emit_u8(kTypeSectionCode);
   bytes.emit_bytes([0x80, 0x80, 0x80, 0x80, 0x80, 0x00]);
   let pos = bytes.length - 1 - 1;
-  testErrorPosition(bytes, pos, 'testSectionLengthInvalidVarint');
+  testErrorPosition(bytes, pos, 'expected section length');
 })();
 
 (function testSectionLengthTooBig() {
@@ -59,7 +62,7 @@ function testErrorPosition(bytes, pos, test_name) {
   bytes.emit_u8(kTypeSectionCode);
   bytes.emit_u32v(0xffffff23);
   let pos = bytes.length - 1;
-  testErrorPosition(bytes, pos, 'testSectionLengthTooBig');
+  testErrorPositionAsyncOnly(bytes, pos, 'maximum function size');
 })();
 
 (function testFunctionsCountInvalidVarint() {
@@ -83,7 +86,7 @@ function testErrorPosition(bytes, pos, test_name) {
   bytes.emit_bytes([0x80, 0x80, 0x80, 0x80, 0x80, 0x00]);
 
   let pos = bytes.length - 1 - 1;
-  testErrorPosition(bytes, pos, 'testFunctionsCountInvalidVarint');
+  testErrorPositionAsyncOnly(bytes, pos, 'expected functions count');
 })();
 
 (function testFunctionsCountTooBig() {
@@ -107,7 +110,7 @@ function testErrorPosition(bytes, pos, test_name) {
   bytes.emit_u32v(0xffffff23);
 
   let pos = bytes.length - 1;
-  testErrorPosition(bytes, pos, 'testFunctionsCountTooBig');
+  testErrorPositionAsyncOnly(bytes, pos, 'maximum function size');
 })();
 
 (function testFunctionsCountDoesNotMatch() {
@@ -131,7 +134,7 @@ function testErrorPosition(bytes, pos, test_name) {
   bytes.emit_u32v(5);
 
   let pos = bytes.length - 1;
-  testErrorPosition(bytes, pos, 'testFunctionsCountDoesNotMatch');
+  testErrorPositionAsyncOnly(bytes, pos, 'function body count 5 mismatch');
 })();
 
 (function testBodySizeInvalidVarint() {
@@ -160,7 +163,7 @@ function testErrorPosition(bytes, pos, test_name) {
   bytes.emit_bytes([0x80, 0x80, 0x80, 0x80, 0x80, 0x00]);
 
   let pos = bytes.length - 1 - 1;
-  testErrorPosition(bytes, pos, 'testBodySizeInvalidVarint');
+  testErrorPositionAsyncOnly(bytes, pos, 'expected body size');
 })();
 
 (function testBodySizeTooBig() {
@@ -189,7 +192,7 @@ function testErrorPosition(bytes, pos, test_name) {
   bytes.emit_u32v(0xffffff23);
 
   let pos = bytes.length - 1;
-  testErrorPosition(bytes, pos, 'testBodySizeTooBig');
+  testErrorPositionAsyncOnly(bytes, pos, 'maximum function size');
 })();
 
 (function testBodySizeDoesNotFit() {
@@ -218,7 +221,7 @@ function testErrorPosition(bytes, pos, test_name) {
   bytes.emit_u32v(20);
 
   let pos = bytes.length - 1;
-  testErrorPosition(bytes, pos, 'testBodySizeDoesNotFit');
+  testErrorPositionAsyncOnly(bytes, pos, 'not enough code section bytes');
 })();
 
 (function testBodySizeIsZero() {
@@ -247,7 +250,7 @@ function testErrorPosition(bytes, pos, test_name) {
   bytes.emit_u32v(0);
 
   let pos = bytes.length - 1;
-  testErrorPosition(bytes, pos, 'testBodySizeIsZero');
+  testErrorPositionAsyncOnly(bytes, pos, 'invalid function length');
 })();
 
 (function testStaleCodeSectionBytes() {
@@ -277,7 +280,7 @@ function testErrorPosition(bytes, pos, test_name) {
   ]);
 
   let pos = bytes.length - 1;
-  testErrorPosition(bytes, pos, 'testStaleCodeSectionBytes');
+  testErrorPositionAsyncOnly(bytes, pos, 'not all code section bytes were used');
 })();
 
 (function testInvalidCode() {
@@ -299,7 +302,7 @@ function testErrorPosition(bytes, pos, test_name) {
   ]);
   bytes.emit_bytes([
       kCodeSectionCode,  // section id
-      6,                 // section length (too big)
+      6,                 // section length
       1,                 // functions count
       4,                 // body size
       0,                 // locals count
@@ -309,7 +312,46 @@ function testErrorPosition(bytes, pos, test_name) {
 
   // Find error at the index of kExprLocalGet.
   let pos = bytes.length - 1 - 1;
-  testErrorPosition(bytes, pos, 'testInvalidCode');
+  testErrorPosition(bytes, pos, 'invalid local index');
+})();
+
+(function testCodeSectionRepeats() {
+  let bytes = new Binary;
+  bytes.emit_header();
+  bytes.emit_bytes([
+      kTypeSectionCode,       // section id
+      4,                      // section length
+      1,                      // number of types
+      kWasmFunctionTypeForm,  // type
+      0,                      // number of parameter
+      0                       // number of returns
+  ]);
+  bytes.emit_bytes([
+      kFunctionSectionCode,  // section id
+      2,                     // section length
+      1,                     // number of functions
+      0                      // signature index
+  ]);
+  bytes.emit_bytes([
+      kCodeSectionCode,  // section id
+      4,                 // section length
+      1,                 // functions count
+      2,                 // body size
+      0,                 // locals count
+      kExprEnd           // body
+  ]);
+  let pos = bytes.length;
+  bytes.emit_bytes([
+      kCodeSectionCode,  // section id (repeating)
+      4,                 // section length
+      1,                 // functions count
+      2,                 // body size
+      0,                 // locals count
+      kExprEnd           // body
+  ]);
+
+  // Find error at the second kCodeSectionCode.
+  testErrorPositionAsyncOnly(bytes, pos, 'code section can only appear once');
 })();
 
 (function testCodeSectionSizeZero() {
@@ -331,12 +373,12 @@ function testErrorPosition(bytes, pos, test_name) {
   ]);
   bytes.emit_bytes([
       kCodeSectionCode,  // section id
-      0,                 // section length (too big)
+      0,                 // section length (empty)
   ]);
 
-  // Find error at the index of kExprLocalGet.
+  // Find error at the code section length.
   let pos = bytes.length - 1;
-  testErrorPosition(bytes, pos, 'testCodeSectionSizeZero');
+  testErrorPositionAsyncOnly(bytes, pos, 'code section cannot have size 0');
 })();
 
 (function testInvalidSection() {
@@ -353,5 +395,5 @@ function testErrorPosition(bytes, pos, test_name) {
   ]);
 
   let pos = bytes.length - 1 - 1;
-  testErrorPosition(bytes, pos, 'testInvalidSection');
+  testErrorPositionAsyncOnly(bytes, pos, 'invalid local type');
 })();
diff --git a/deps/v8/test/mjsunit/wasm/table-copy-anyref.js b/deps/v8/test/mjsunit/wasm/table-copy-anyref.js
index 8b2546a594da72..5fe9c24d55b2bb 100644
--- a/deps/v8/test/mjsunit/wasm/table-copy-anyref.js
+++ b/deps/v8/test/mjsunit/wasm/table-copy-anyref.js
@@ -59,7 +59,7 @@ assertTable([1000, 1001, 1002, 1003, 1004]);
 // Non-overlapping, dst < src.
 resetTable();
 assertTraps(kTrapTableOutOfBounds, () => instance.exports.copy(0, 4, 2));
-assertTable([1004, 1001, 1002, 1003, 1004]);
+assertTable([1000, 1001, 1002, 1003, 1004]);
 
 // Overlapping, src < dst. This is required to copy backward, but the first
 // access will be out-of-bounds, so nothing changes.
@@ -70,4 +70,4 @@ assertTable([1000, 1001, 1002, 1003, 1004]);
 // Overlapping, dst < src.
 resetTable();
 assertTraps(kTrapTableOutOfBounds, () => instance.exports.copy(0, 1, 99));
-assertTable([1001, 1002, 1003, 1004, 1004]);
+assertTable([1000, 1001, 1002, 1003, 1004]);
diff --git a/deps/v8/test/mjsunit/wasm/tier-down-to-liftoff.js b/deps/v8/test/mjsunit/wasm/tier-down-to-liftoff.js
new file mode 100644
index 00000000000000..bfd973c60744ad
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/tier-down-to-liftoff.js
@@ -0,0 +1,51 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --liftoff --wasm-tier-up --no-stress-opt
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const num_functions = 2;
+
+function create_builder(delta = 0) {
+  const builder = new WasmModuleBuilder();
+  for (let i = 0; i < num_functions; ++i) {
+    builder.addFunction('f' + i, kSig_i_v)
+        .addBody(wasmI32Const(i + delta))
+        .exportFunc();
+  }
+  return builder;
+}
+
+function check(instance) {
+  %WasmTierDownModule(instance);
+  for (let i = 0; i < num_functions; ++i) {
+    assertTrue(%IsLiftoffFunction(instance.exports['f' + i]));
+  }
+
+  for (let i = 0; i < num_functions; ++i) {
+    %WasmTierUpFunction(instance, i);
+    assertTrue(%IsLiftoffFunction(instance.exports['f' + i]));
+  }
+
+  %WasmTierUpModule(instance);
+  for (let i = 0; i < num_functions; ++i) {
+    assertFalse(%IsLiftoffFunction(instance.exports['f' + i]));
+  }
+}
+
+(function testTierDownToLiftoff() {
+  print(arguments.callee.name);
+  const instance = create_builder().instantiate();
+  check(instance);
+})();
+
+// Use slightly different module for this test to avoid sharing native module.
+async function testTierDownToLiftoffAsync() {
+  print(arguments.callee.name);
+  const instance = await create_builder(num_functions).asyncInstantiate();
+  check(instance);
+}
+
+assertPromiseResult(testTierDownToLiftoffAsync());
diff --git a/deps/v8/test/mjsunit/wasm/type-reflection-with-anyref.js b/deps/v8/test/mjsunit/wasm/type-reflection-with-anyref.js
index 863a59aaa4ef88..98e7b8fb852947 100644
--- a/deps/v8/test/mjsunit/wasm/type-reflection-with-anyref.js
+++ b/deps/v8/test/mjsunit/wasm/type-reflection-with-anyref.js
@@ -41,6 +41,38 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
   assertEquals(2, Object.getOwnPropertyNames(type).length);
 })();
 
+(function TestFunctionGlobalGetAndSet() {
+  let builder = new WasmModuleBuilder();
+  let fun1 = new WebAssembly.Function({parameters:[], results:["i32"]}, _ => 7);
+  let fun2 = new WebAssembly.Function({parameters:[], results:["i32"]}, _ => 9);
+  builder.addGlobal(kWasmAnyFunc, true).exportAs("f");
+  builder.addFunction('get_global', kSig_a_v)
+      .addBody([
+        kExprGlobalGet, 0,
+      ])
+      .exportFunc();
+  builder.addFunction('set_global', kSig_v_a)
+      .addBody([
+        kExprLocalGet, 0,
+        kExprGlobalSet, 0,
+      ])
+      .exportFunc();
+  let instance = builder.instantiate();
+
+  // Test getting and setting "funcref" global via WebAssembly.
+  assertEquals(null, instance.exports.get_global());
+  instance.exports.set_global(fun1);
+  assertEquals(fun1, instance.exports.get_global());
+
+  // Test getting and setting "funcref" global via JavaScript.
+  assertEquals(fun1, instance.exports.f.value);
+  instance.exports.f.value = fun2;
+  assertEquals(fun2, instance.exports.f.value);
+
+  // Test the full round-trip of an "funcref" global.
+  assertEquals(fun2, instance.exports.get_global());
+})();
+
 // This is an extension of "type-reflection.js/TestFunctionTableSetAndCall" to
 // multiple table indexes. If --experimental-wasm-anyref is enabled by default
 // this test case can supersede the other one.
diff --git a/deps/v8/test/mjsunit/wasm/wasm-module-builder.js b/deps/v8/test/mjsunit/wasm/wasm-module-builder.js
index b4d7cae41ba022..432353239d40b5 100644
--- a/deps/v8/test/mjsunit/wasm/wasm-module-builder.js
+++ b/deps/v8/test/mjsunit/wasm/wasm-module-builder.js
@@ -3,10 +3,8 @@
 // found in the LICENSE file.
 
 // Used for encoding f32 and double constants to bits.
-let f32_view = new Float32Array(1);
-let f32_bytes_view = new Uint8Array(f32_view.buffer);
-let f64_view = new Float64Array(1);
-let f64_bytes_view = new Uint8Array(f64_view.buffer);
+let byte_view = new Uint8Array(8);
+let data_view = new DataView(byte_view.buffer);
 
 // The bytes function receives one of
 //  - several arguments, each of which is either a number or a string of length
@@ -101,6 +99,7 @@ let kWasmF64 = 0x7c;
 let kWasmS128 = 0x7b;
 let kWasmAnyRef = 0x6f;
 let kWasmAnyFunc = 0x70;
+let kWasmNullRef = 0x6e;
 let kWasmExnRef = 0x68;
 
 let kExternalFunction = 0;
@@ -210,6 +209,7 @@ let kExprReturnCall = 0x12;
 let kExprReturnCallIndirect = 0x13;
 let kExprDrop = 0x1a;
 let kExprSelect = 0x1b;
+let kExprSelectWithType = 0x1c;
 let kExprLocalGet = 0x20;
 let kExprLocalSet = 0x21;
 let kExprLocalTee = 0x22;
@@ -468,6 +468,8 @@ let kExprI64AtomicCompareExchange32U = 0x4e;
 let kExprS128LoadMem = 0x00;
 let kExprS128StoreMem = 0x01;
 let kExprI32x4Splat = 0x0c;
+let kExprI32x4Eq = 0x2c;
+let kExprS1x4AllTrue = 0x75;
 let kExprF32x4Min = 0x9e;
 
 // Compilation hint constants.
@@ -629,6 +631,7 @@ class WasmFunctionBuilder {
     this.body = [];
     this.locals = [];
     this.local_names = [];
+    this.body_offset = undefined;  // Not valid until module is serialized.
   }
 
   numLocalNames() {
@@ -799,8 +802,9 @@ class WasmModuleBuilder {
   }
 
   addTable(type, initial_size, max_size = undefined) {
-    if (type != kWasmAnyRef && type != kWasmAnyFunc) {
-      throw new Error('Tables must be of type kWasmAnyRef or kWasmAnyFunc');
+    if (type != kWasmAnyRef && type != kWasmAnyFunc && type != kWasmNullRef && type != kWasmExnRef) {
+      throw new Error(
+          'Tables must be of type kWasmAnyRef, kWasmAnyFunc, kWasmNullRef or kWasmExnRef');
     }
     let table = new WasmTableBuilder(this, type, initial_size, max_size);
     table.index = this.tables.length + this.num_imported_tables;
@@ -1074,16 +1078,17 @@ class WasmModuleBuilder {
               break;
             case kWasmF32:
               section.emit_u8(kExprF32Const);
-              f32_view[0] = global.init;
-              section.emit_bytes(f32_bytes_view);
+              data_view.setFloat32(0, global.init, true);
+              section.emit_bytes(byte_view.subarray(0, 4));
               break;
             case kWasmF64:
               section.emit_u8(kExprF64Const);
-              f64_view[0] = global.init;
-              section.emit_bytes(f64_bytes_view);
+              data_view.setFloat64(0, global.init, true);
+              section.emit_bytes(byte_view);
               break;
             case kWasmAnyFunc:
             case kWasmAnyRef:
+            case kWasmNullRef:
               if (global.function_index !== undefined) {
                 section.emit_u8(kExprRefFunc);
                 section.emit_u32v(global.function_index);
@@ -1240,6 +1245,7 @@ class WasmModuleBuilder {
     if (wasm.functions.length > 0) {
       // emit function bodies
       if (debug) print("emitting code @ " + binary.length);
+      let section_length = 0;
       binary.emit_section(kCodeSectionCode, section => {
         section.emit_u32v(wasm.functions.length);
         let header = new Binary;
@@ -1269,6 +1275,9 @@ class WasmModuleBuilder {
             if (l.anyfunc_count > 0) {
               local_decls.push({count: l.anyfunc_count, type: kWasmAnyFunc});
             }
+            if (l.nullref_count > 0) {
+              local_decls.push({count: l.nullref_count, type: kWasmNullRef});
+            }
             if (l.except_count > 0) {
               local_decls.push({count: l.except_count, type: kWasmExnRef});
             }
@@ -1282,9 +1291,15 @@ class WasmModuleBuilder {
 
           section.emit_u32v(header.length + func.body.length);
           section.emit_bytes(header.trunc_buffer());
+          // Set to section offset for now, will update.
+          func.body_offset = section.length;
           section.emit_bytes(func.body);
         }
+        section_length = section.length;
       });
+      for (let func of wasm.functions) {
+        func.body_offset += binary.length - section_length;
+      }
     }
 
     // Add data segments.
@@ -1412,18 +1427,18 @@ function wasmI32Const(val) {
 }
 
 function wasmF32Const(f) {
-  f32_view[0] = f;
+  // Write in little-endian order at offset 0.
+  data_view.setFloat32(0, f, true);
   return [
-    kExprF32Const, f32_bytes_view[0], f32_bytes_view[1], f32_bytes_view[2],
-    f32_bytes_view[3]
+    kExprF32Const, byte_view[0], byte_view[1], byte_view[2], byte_view[3]
   ];
 }
 
 function wasmF64Const(f) {
-  f64_view[0] = f;
+  // Write in little-endian order at offset 0.
+  data_view.setFloat64(0, f, true);
   return [
-    kExprF64Const, f64_bytes_view[0], f64_bytes_view[1], f64_bytes_view[2],
-    f64_bytes_view[3], f64_bytes_view[4], f64_bytes_view[5], f64_bytes_view[6],
-    f64_bytes_view[7]
+    kExprF64Const, byte_view[0], byte_view[1], byte_view[2],
+    byte_view[3], byte_view[4], byte_view[5], byte_view[6], byte_view[7]
   ];
 }
diff --git a/deps/v8/test/mjsunit/wasm/worker-interpreter.js b/deps/v8/test/mjsunit/wasm/worker-interpreter.js
index 9a7ab60756e395..276ff079b5689e 100644
--- a/deps/v8/test/mjsunit/wasm/worker-interpreter.js
+++ b/deps/v8/test/mjsunit/wasm/worker-interpreter.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --no-wasm-disable-structured-cloning
+// Flags: --allow-natives-syntax --expose-gc
 
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
@@ -12,6 +12,12 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
     .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprI32Add])
     .exportFunc();
 
+  // Trigger a GC to ensure that the underlying native module is not a cached
+  // one from a previous run, with functions already redirected to the
+  // interpreter. This is not observable from pure JavaScript, but this is
+  // observable with the internal runtime functions used in this test.
+  gc();
+
   let module = builder.toModule();
   let instance = new WebAssembly.Instance(module);
   let exp = instance.exports;
diff --git a/deps/v8/test/mjsunit/wasm/worker-module.js b/deps/v8/test/mjsunit/wasm/worker-module.js
index 76d84daabae90f..ac0be10bfc9208 100644
--- a/deps/v8/test/mjsunit/wasm/worker-module.js
+++ b/deps/v8/test/mjsunit/wasm/worker-module.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --wasm-shared-engine --no-wasm-disable-structured-cloning
-
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function TestPostModule() {
diff --git a/deps/v8/test/mkgrokdump/mkgrokdump.cc b/deps/v8/test/mkgrokdump/mkgrokdump.cc
index 5f39a063e4d7a0..8c46e9be0e1408 100644
--- a/deps/v8/test/mkgrokdump/mkgrokdump.cc
+++ b/deps/v8/test/mkgrokdump/mkgrokdump.cc
@@ -27,8 +27,7 @@ static const char* kHeader =
     "# List of known V8 instance types.\n";
 
 // Debug builds emit debug code, affecting code object sizes.
-// Embedded builtins cause objects to be allocated in different locations.
-#if defined(V8_EMBEDDED_BUILTINS) && !defined(DEBUG)
+#ifndef DEBUG
 static const char* kBuild = "shipping";
 #else
 static const char* kBuild = "non-shipping";
@@ -136,7 +135,7 @@ static int DumpHeapConstants(FILE* out, const char* argv0) {
         if (!object.IsMap()) continue;
         DumpKnownMap(out, heap, i::Heap::GetSpaceName(i::RO_SPACE), object);
       }
-      i::PagedSpaceObjectIterator iterator(heap->map_space());
+      i::PagedSpaceObjectIterator iterator(heap, heap->map_space());
       for (i::HeapObject object = iterator.Next(); !object.is_null();
            object = iterator.Next()) {
         if (!object.IsMap()) continue;
@@ -159,7 +158,7 @@ static int DumpHeapConstants(FILE* out, const char* argv0) {
 
       i::PagedSpaceIterator spit(heap);
       for (i::PagedSpace* s = spit.Next(); s != nullptr; s = spit.Next()) {
-        i::PagedSpaceObjectIterator it(s);
+        i::PagedSpaceObjectIterator it(heap, s);
         // Code objects are generally platform-dependent.
         if (s->identity() == i::CODE_SPACE || s->identity() == i::MAP_SPACE)
           continue;
diff --git a/deps/v8/test/mkgrokdump/mkgrokdump.status b/deps/v8/test/mkgrokdump/mkgrokdump.status
index 62453ad9792e8a..110cf6d15e090e 100644
--- a/deps/v8/test/mkgrokdump/mkgrokdump.status
+++ b/deps/v8/test/mkgrokdump/mkgrokdump.status
@@ -9,9 +9,4 @@
   '*': [SKIP],
 }],  # variant != default or arch != x64 or lite_mode
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-
 ]
diff --git a/deps/v8/test/mozilla/mozilla.status b/deps/v8/test/mozilla/mozilla.status
index 78630381f9f0af..cb556331bd09c3 100644
--- a/deps/v8/test/mozilla/mozilla.status
+++ b/deps/v8/test/mozilla/mozilla.status
@@ -332,7 +332,6 @@
 
   # Test that depends on timer resolution. Fails every now and then
   # if we're unlucky enough to get a context switch at a bad time.
-  # TODO(mstarzinger): Switch off TF on windows due to timeouts.
   'js1_5/extensions/regress-363258': [PASS, FAIL, ['system == windows', NO_VARIANTS]],
 
 
@@ -1011,10 +1010,13 @@
 
   #BUG(3837): Crashes due to C stack overflow.
   'js1_5/extensions/regress-355497': [SKIP],
-  # Slow test
-  'js1_5/Regress/regress-80981': [PASS, SLOW],
 }],  # 'arch == arm and simulator_run'
 
+['arch == arm64', {
+  # BUG(v8:9863)
+  'js1_5/Regress/regress-80981': [SKIP],
+}], # 'arch == arm64'
+
 ['arch == arm64 and simulator_run', {
 
   'js1_5/GC/regress-203278-2': [SKIP],
@@ -1037,9 +1039,6 @@
 
   #BUG(3152): Avoid C stack overflow.
   'js1_5/extensions/regress-355497': [FAIL_OK, '--sim-stack-size=512'],
-
-  # Slow without pointer compression
-  'js1_5/Regress/regress-80981': [PASS, ['not pointer_compression', SLOW]],
 }],  # 'arch == arm64 and simulator_run'
 
 ['system == android', {
@@ -1064,9 +1063,4 @@
   '*': [SKIP],
 }],  # variant == no_wasm_traps
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-
 ]
diff --git a/deps/v8/test/preparser/BUILD.gn b/deps/v8/test/preparser/BUILD.gn
deleted file mode 100644
index 7d158710978540..00000000000000
--- a/deps/v8/test/preparser/BUILD.gn
+++ /dev/null
@@ -1,16 +0,0 @@
-# Copyright 2018 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-group("v8_preparser") {
-  testonly = true
-
-  data_deps = [
-    "../..:d8",
-    "../../tools:v8_testrunner",
-  ]
-
-  data = [
-    "./",
-  ]
-}
diff --git a/deps/v8/test/preparser/OWNERS b/deps/v8/test/preparser/OWNERS
deleted file mode 100644
index 98e641fd889e07..00000000000000
--- a/deps/v8/test/preparser/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-marja@chromium.org
-verwaest@chromium.org
diff --git a/deps/v8/test/preparser/duplicate-parameter.pyt b/deps/v8/test/preparser/duplicate-parameter.pyt
deleted file mode 100644
index 4dfb7d691feead..00000000000000
--- a/deps/v8/test/preparser/duplicate-parameter.pyt
+++ /dev/null
@@ -1,90 +0,0 @@
-# Copyright 2011 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-# Templatated tests with duplicate parameter names.
-
-# ----------------------------------------------------------------------
-# Constants and utility functions
-
-# A template that performs the same strict-mode test in different
-# scopes (global scope, function scope, and nested function scope),
-# and in non-strict mode too.
-def DuplicateParameterTest(name, source):
-  expectation = "strict_param_dupe"
-  non_selfstrict = {"selfstrict":"", "id":"selfnormal"}
-
-  Template(name, '"use strict";\n' + source)(non_selfstrict, expectation)
-  Template(name + '-infunc',
-           'function foo() {\n "use strict";\n' + source +'\n}\n')(
-               non_selfstrict, expectation)
-  Template(name + '-infunc2',
-           'function foo() {\n "use strict";\n  function bar() {\n' +
-           source +'\n }\n}\n')(non_selfstrict, expectation)
-
-  selfstrict = {"selfstrict": "\"use strict\";", "id": "selfstrict"}
-  nestedstrict = {"selfstrict": "function bar(){\"use strict\";}",
-                  "id": "nestedstrict"}
-  selfstrictnestedclean = {"selfstrict": """
-      "use strict";
-      function bar(){}
-    """, "id": "selfstrictnestedclean"}
-  selftest = Template(name + '-$id', source)
-  selftest(selfstrict, expectation)
-  selftest(selfstrictnestedclean, expectation)
-  selftest(nestedstrict, None)
-  selftest(non_selfstrict, None)
-
-
-# ----------------------------------------------------------------------
-# Test templates
-
-DuplicateParameterTest("dups", """
-  function foo(a, a) { $selfstrict }
-""");
-
-DuplicateParameterTest("dups-apart", """
-  function foo(a, b, c, d, e, f, g, h, i, j, k, l, m, n, a) { $selfstrict }
-""");
-
-DuplicateParameterTest("dups-escaped", """
-  function foo(\u0061, b, c, d, e, f, g, h, i, j, k, l, m, n, a) { $selfstrict }
-""");
-
-DuplicateParameterTest("triples", """
-  function foo(a, b, c, d, e, f, g, h, a, i, j, k, l, m, n, a) { $selfstrict }
-""");
-
-DuplicateParameterTest("escapes", """
-  function foo(a, \u0061) { $selfstrict }
-""");
-
-DuplicateParameterTest("long-names", """
-  function foo(arglebargleglopglyfarglebargleglopglyfarglebargleglopglyfa,
-               arglebargleglopglyfarglebargleglopglyfarglebargleglopglyfa) {
-    $selfstrict
-  }
-""");
diff --git a/deps/v8/test/preparser/preparser.status b/deps/v8/test/preparser/preparser.status
deleted file mode 100644
index 792c4164332e26..00000000000000
--- a/deps/v8/test/preparser/preparser.status
+++ /dev/null
@@ -1,36 +0,0 @@
-# Copyright 2011 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-[
-[ALWAYS, {
-}],  # ALWAYS
-
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-]
diff --git a/deps/v8/test/preparser/strict-identifiers.pyt b/deps/v8/test/preparser/strict-identifiers.pyt
deleted file mode 100644
index 446980f701f84f..00000000000000
--- a/deps/v8/test/preparser/strict-identifiers.pyt
+++ /dev/null
@@ -1,288 +0,0 @@
-# Copyright 2011 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-# Templatated tests with eval/arguments/future reserved words.
-
-# ----------------------------------------------------------------------
-# Constants and utility functions
-
-reserved_words = [
-  'class',
-  'const', # Has other error message than other reserved words.
-  'enum',
-  'export',
-  'extends',
-  'import',
-  'super'
-  ]
-
-strict_reserved_words = [
-  'implements',
-  'interface',
-  'let',
-  'package',
-  'private',
-  'protected',
-  'public',
-  'static',
-  'yield'
-  ]
-
-assign_ops = {
-  "=": "assign",
-  "+=": "addeq",
-  "-=": "subeq",
-  "*=": "muleq",
-  "/=": "diveq",
-  "%=": "modeq",
-  "&=": "andeq",
-  "|=": "oreq",
-  "^=": "xoreq",
-  "<<=": "shleq",
-  ">>=": "asreq",
-  ">>>=": "lsreq"
-  }
-
-
-# A template that performs the same strict-mode test in different
-# scopes (global scope, function scope, and nested function scope).
-def StrictTemplate(name, source):
-  def MakeTests(replacement, expectation):
-    Template(name, '"use strict";\n' + source)(replacement, expectation)
-    Template(name + '-infunc',
-             'function foo() {\n "use strict";\n' + source +'\n}\n')(
-              replacement, expectation)
-    Template(name + '-infunc2',
-             'function foo() {\n "use strict";\n  function bar() {\n' +
-             source +'\n }\n}\n')(replacement, expectation)
-  return MakeTests
-
-# ----------------------------------------------------------------------
-# Test templates
-
-arg_name_own = Template("argument-name-own-$id", """
-  function foo($id) {
-    "use strict";
-  }
-""")
-
-arg_name_nested = Template("argument-name-nested-$id", """
-  function foo() {
-    "use strict";
-    function bar($id) { }
-  }
-""")
-
-func_name_own = Template("function-name-own-$id", """
-  function $id(foo) {
-    "use strict";
-  }
-""")
-
-func_name_nested = Template("function-name-nested-$id", """
-  function foo() {
-    "use strict";
-    function $id(bar) { }
-  }
-""")
-
-catch_var = StrictTemplate("catch-$id", """
-    try { } catch ($id) { }
-""")
-
-declare_var = StrictTemplate("var-$id", """
-  var $id = 42;
-""")
-
-assign_var = StrictTemplate("assign-$id-$opname", """
-  var x = $id $op 42;
-""")
-
-prefix_var = StrictTemplate("prefix-$opname-$id", """
-  var x = $op$id;
-""")
-
-postfix_var = StrictTemplate("postfix-$opname-$id", """
-  var x = $id$op;
-""")
-
-read_var = StrictTemplate("read-reserved-$id", """
-  var x = $id;
-""")
-
-setter_arg = StrictTemplate("setter-param-$id", """
-  var x = {set foo($id) { }};
-""")
-
-label_normal = Template("label-normal-$id", """
-  $id: '';
-""")
-
-label_strict = StrictTemplate("label-strict-$id", """
-  $id: '';
-""")
-
-break_normal = Template("break-normal-$id", """
-  $id: for (;false;) {
-    break $id;
-  }
-""")
-
-break_strict = StrictTemplate("break-strict-$id", """
-  $id: for (;false;) {
-    break $id;
-  }
-""")
-
-continue_normal = Template("continue-normal-$id", """
-  $id: for (;false;) {
-    continue $id;
-  }
-""")
-
-continue_strict = StrictTemplate("continue-strict-$id", """
-  $id: for (;false;) {
-    continue $id;
-  }
-""")
-
-non_strict_use = Template("nonstrict-$id", """
-  var $id = 42;
-  $id++;
-  $id--;
-  ++$id;
-  --$id;
-  $id += 10;
-  $id -= 10;
-  try {} catch ($id) { }
-  function $id($id) { }
-  var x = {$id: 42};
-  x = {get $id() {}, set $id(value) {}};
-  function foo() { "use strict;" }
-  var $id = 42;
-  $id++;
-  $id--;
-  ++$id;
-  --$id;
-  $id += 10;
-  $id -= 10;
-  try {} catch ($id) { }
-  function $id($id) { }
-  x = {$id: 42};
-  x = {get $id() {}, set $id(value) {}};
-  $id: '';
-""")
-
-identifier_name_source = """
-  var x = {$id: 42};
-  x = {get $id() {}, set $id(value) {}};
-  x.$id = 42;
-  function foo() { "use strict;" }
-  x = {$id: 42};
-  x = {get $id() {}, set $id(value) {}};
-  x.$id = 42;
-"""
-
-identifier_name = Template("identifier_name-$id", identifier_name_source)
-identifier_name_strict = StrictTemplate("identifier_name_strict-$id",
-                                        identifier_name_source)
-
-# ----------------------------------------------------------------------
-# Run tests
-
-# eval and arguments have specific exceptions for different uses.
-for id in ["eval", "arguments"]:
-  arg_name_own({"id": id}, "strict_param_name")
-  arg_name_nested({"id": id}, "strict_param_name")
-  func_name_own({"id": id}, "strict_function_name")
-  func_name_nested({"id": id}, "strict_function_name")
-  setter_arg({"id": id}, "strict_param_name")
-  for op in assign_ops.keys():
-    assign_var({"id": id, "op":op, "opname": assign_ops[op]},
-               "strict_lhs_assignment")
-  catch_var({"id": id}, "strict_catch_variable")
-  declare_var({"id": id}, "strict_var_name")
-  prefix_var({"id": id, "op":"++", "opname":"inc"}, "strict_lhs_prefix")
-  prefix_var({"id": id, "op":"--", "opname":"dec"}, "strict_lhs_prefix")
-  postfix_var({"id": id, "op":"++", "opname":"inc"}, "strict_lhs_postfix")
-  postfix_var({"id": id, "op":"--", "opname":"dec"}, "strict_lhs_postfix")
-  label_normal({"id": id}, None)
-  label_strict({"id": id}, None)
-  break_normal({"id": id}, None)
-  break_strict({"id": id}, None)
-  continue_normal({"id": id}, None)
-  continue_strict({"id": id}, None)
-  non_strict_use({"id": id}, None)
-
-
-# Reserved words just throw the same exception in all cases
-# (with "const" being special, as usual).
-for reserved_word in reserved_words + strict_reserved_words:
-  if (reserved_word in strict_reserved_words):
-    message = "strict_reserved_word"
-    label_message = None
-  elif (reserved_word == "const"):
-    message = "unexpected_token"
-    label_message = message
-  else:
-    message = "reserved_word"
-    label_message = message
-  arg_name_own({"id":reserved_word}, message)
-  arg_name_nested({"id":reserved_word}, message)
-  setter_arg({"id": reserved_word}, message)
-  func_name_own({"id":reserved_word}, message)
-  func_name_nested({"id":reserved_word}, message)
-  for op in assign_ops.keys():
-    assign_var({"id":reserved_word, "op":op, "opname": assign_ops[op]}, message)
-  catch_var({"id":reserved_word}, message)
-  declare_var({"id":reserved_word}, message)
-  prefix_var({"id":reserved_word, "op":"++", "opname":"inc"}, message)
-  prefix_var({"id":reserved_word, "op":"--", "opname":"dec"}, message)
-  postfix_var({"id":reserved_word, "op":"++", "opname":"inc"}, message)
-  postfix_var({"id":reserved_word, "op":"--", "opname":"dec"}, message)
-  read_var({"id": reserved_word}, message)
-  identifier_name({"id": reserved_word}, None);
-  identifier_name_strict({"id": reserved_word}, None);
-  label_normal({"id": reserved_word}, label_message)
-  break_normal({"id": reserved_word}, label_message)
-  continue_normal({"id": reserved_word}, label_message)
-  if (reserved_word == "const"):
-    # The error message for this case is different because
-    # ParseLabelledStatementOrExpression will try to parse this as an expression
-    # first, effectively disallowing the use in ParseVariableDeclarations, i.e.
-    # the preparser never sees that 'const' was intended to be a label.
-    label_strict({"id": reserved_word}, "strict_const")
-  else:
-    label_strict({"id": reserved_word}, message)
-  break_strict({"id": reserved_word}, message)
-  continue_strict({"id": reserved_word}, message)
-
-
-# Future reserved words in strict mode behave like normal identifiers
-# in a non strict context.
-for reserved_word in strict_reserved_words:
-  non_strict_use({"id": reserved_word}, None)
diff --git a/deps/v8/test/preparser/testcfg.py b/deps/v8/test/preparser/testcfg.py
deleted file mode 100644
index 0567564278e113..00000000000000
--- a/deps/v8/test/preparser/testcfg.py
+++ /dev/null
@@ -1,126 +0,0 @@
-# Copyright 2011 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-import os
-
-from testrunner.local import testsuite
-from testrunner.objects import testcase
-
-
-class VariantsGenerator(testsuite.VariantsGenerator):
-  def _get_variants(self, test):
-    return self._standard_variant
-
-
-class TestLoader(testsuite.TestLoader):
-  def _list_test_filenames(self):
-    for file in os.listdir(self.suite.root):
-      if file.endswith(".pyt"):
-        yield file[:-4]
-
-
-# TODO(tmrts): refactor the python template parsing then use the TestLoader.
-class TestSuite(testsuite.TestSuite):
-  def _ParsePythonTestTemplates(self, result, filename):
-    pathname = os.path.join(self.root, filename + ".pyt")
-    def Test(name, source, expectation):
-      source = source.replace("\n", " ")
-      path = os.path.join(filename, name)
-      if expectation:
-        template_flags = ["--throws"]
-      else:
-        template_flags = []
-      test = self._create_test(path, source, template_flags)
-      result.append(test)
-    def Template(name, source):
-      def MkTest(replacement, expectation):
-        testname = name
-        testsource = source
-        for key in replacement.keys():
-          testname = testname.replace("$" + key, replacement[key]);
-          testsource = testsource.replace("$" + key, replacement[key]);
-        Test(testname, testsource, expectation)
-      return MkTest
-    execfile(pathname, {"Test": Test, "Template": Template})
-
-  def ListTests(self):
-    result = []
-
-    filenames = self._test_loader._list_test_filenames()
-    for f in sorted(filenames):
-      self._ParsePythonTestTemplates(result, f)
-
-    # TODO: remove after converting to use a full TestLoader
-    self._test_loader.test_count_estimation = len(result)
-    return result
-
-  def _create_test(self, path, source, template_flags):
-    return self._test_loader._create_test(
-        path, self, source=source, template_flags=template_flags)
-
-  def _test_loader_class(self):
-    return TestLoader
-
-  def _test_class(self):
-    return TestCase
-
-  def _variants_gen_class(self):
-    return VariantsGenerator
-
-
-class TestCase(testcase.D8TestCase):
-  def __init__(self, suite, path, name, test_config, source, template_flags):
-    super(TestCase, self).__init__(suite, path, name, test_config)
-
-    self._source = source
-    self._template_flags = template_flags
-
-  def _get_cmd_params(self):
-    return (
-        self._get_files_params() +
-        self._get_extra_flags() +
-        ['-e', self._source] +
-        self._template_flags +
-        self._get_variant_flags() +
-        self._get_statusfile_flags() +
-        self._get_mode_flags() +
-        self._get_source_flags()
-    )
-
-  def _get_mode_flags(self):
-    return []
-
-  def is_source_available(self):
-    return True
-
-  def get_source(self):
-    return self._source
-
-
-def GetSuite(*args, **kwargs):
-  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/test262/local-tests/test/language/expressions/class/elements/private-field-on-nested-class.js b/deps/v8/test/test262/local-tests/test/language/expressions/class/elements/private-field-on-nested-class.js
deleted file mode 100644
index 8aafe6df386c9d..00000000000000
--- a/deps/v8/test/test262/local-tests/test/language/expressions/class/elements/private-field-on-nested-class.js
+++ /dev/null
@@ -1,45 +0,0 @@
-// This file was procedurally generated from the following sources:
-// - src/class-elements/private-field-on-nested-class.case
-// - src/class-elements/default/cls-expr.template
-/*---
-description: PrivateName CallExpression usage (private field) (field definitions in a class expression)
-esid: prod-FieldDefinition
-features: [class-fields-private, class-fields-public, class]
-flags: [generated]
-info: |
-    Updated Productions
-
-    CallExpression[Yield, Await]:
-      CoverCallExpressionAndAsyncArrowHead[?Yield, ?Await]
-      SuperCall[?Yield, ?Await]
-      CallExpression[?Yield, ?Await]Arguments[?Yield, ?Await]
-      CallExpression[?Yield, ?Await][Expression[+In, ?Yield, ?Await]]
-      CallExpression[?Yield, ?Await].IdentifierName
-      CallExpression[?Yield, ?Await]TemplateLiteral[?Yield, ?Await]
-      CallExpression[?Yield, ?Await].PrivateName
-
----*/
-
-
-var C = class {
-  #outer = 'test262';
-
-  B_withoutPrivateField = class {
-    method(o) {
-      return o.#outer;
-    }
-  }
-
-  B_withPrivateField = class {
-    #inner = 42;
-    method(o) {
-      return o.#outer;
-    }
-  }
-}
-
-let c = new C();
-let innerB1 = new c.B_withoutPrivateField();
-assert.sameValue(innerB1.method(c), 'test262');
-let innerB2 = new c.B_withPrivateField();
-assert.sameValue(innerB2.method(c), 'test262');
diff --git a/deps/v8/test/test262/local-tests/test/language/statements/class/elements/private-field-on-nested-class.js b/deps/v8/test/test262/local-tests/test/language/statements/class/elements/private-field-on-nested-class.js
deleted file mode 100644
index 3f22efeb7cd3f0..00000000000000
--- a/deps/v8/test/test262/local-tests/test/language/statements/class/elements/private-field-on-nested-class.js
+++ /dev/null
@@ -1,45 +0,0 @@
-// This file was procedurally generated from the following sources:
-// - src/class-elements/private-field-on-nested-class.case
-// - src/class-elements/default/cls-decl.template
-/*---
-description: PrivateName CallExpression usage (private field) (field definitions in a class declaration)
-esid: prod-FieldDefinition
-features: [class-fields-private, class-fields-public, class]
-flags: [generated]
-info: |
-    Updated Productions
-
-    CallExpression[Yield, Await]:
-      CoverCallExpressionAndAsyncArrowHead[?Yield, ?Await]
-      SuperCall[?Yield, ?Await]
-      CallExpression[?Yield, ?Await]Arguments[?Yield, ?Await]
-      CallExpression[?Yield, ?Await][Expression[+In, ?Yield, ?Await]]
-      CallExpression[?Yield, ?Await].IdentifierName
-      CallExpression[?Yield, ?Await]TemplateLiteral[?Yield, ?Await]
-      CallExpression[?Yield, ?Await].PrivateName
-
----*/
-
-
-class C {
-  #outer = 'test262';
-
-  B_withoutPrivateField = class {
-    method(o) {
-      return o.#outer;
-    }
-  }
-
-  B_withPrivateField = class {
-    #inner = 42;
-    method(o) {
-      return o.#outer;
-    }
-  }
-}
-
-let c = new C();
-let innerB1 = new c.B_withoutPrivateField();
-assert.sameValue(innerB1.method(c), 'test262');
-let innerB2 = new c.B_withPrivateField();
-assert.sameValue(innerB2.method(c), 'test262');
diff --git a/deps/v8/test/test262/test262.status b/deps/v8/test/test262/test262.status
index 3f82c49d1e91ed..99478a6dbf9881 100644
--- a/deps/v8/test/test262/test262.status
+++ b/deps/v8/test/test262/test262.status
@@ -146,6 +146,10 @@
   'built-ins/DataView/detached-buffer': [FAIL],
   'built-ins/DataView/prototype/byteLength/detached-buffer': [FAIL],
   'built-ins/DataView/prototype/byteOffset/detached-buffer': [FAIL],
+  # copyWithin should also throw on detached buffers
+  'built-ins/TypedArray/prototype/copyWithin/coerced-values-end-detached-prototype': [FAIL],
+  'built-ins/TypedArray/prototype/copyWithin/coerced-values-start-detached': [FAIL],
+  'built-ins/TypedArray/prototype/copyWithin/coerced-values-end-detached': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=4951
   'language/expressions/assignment/destructuring/iterator-destructuring-property-reference-target-evaluation-order': [FAIL],
@@ -463,6 +467,10 @@
   'language/expressions/async-generator/generator-created-after-decl-inst': [FAIL],
   'language/statements/async-generator/generator-created-after-decl-inst': [FAIL],
 
+  # https://bugs.chromium.org/p/v8/issues/detail?id=9875
+  'language/expressions/coalesce/tco-pos-undefined': [FAIL],
+  'language/expressions/coalesce/tco-pos-null': [FAIL],
+
   # https://github.com/tc39/test262/issues/2034
   'language/expressions/postfix-decrement/arguments': [SKIP],
   'language/expressions/postfix-decrement/arguments-nostrict': [SKIP],
@@ -493,40 +501,10 @@
   # These tests require exception handling support which is currently
   #  blocked on landing https://chromium-review.googlesource.com/c/v8/v8/+/1655655
   'built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-job-not-active-throws': [FAIL],
+  'built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-throws-in-callback': [FAIL],
   'built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-callback-throws': [FAIL],
   # 'built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-cleanup-callback-throws': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=8179
-  #
-  # The spec should be changed to make target === holding throw and then we should change these tests.
-  'built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings-and-target': [FAIL],
-  'built-ins/FinalizationGroup/prototype/register/holdings-same-as-target': [FAIL],
-  'built-ins/FinalizationGroup/prototype/register/return-undefined-register-itself': [FAIL],
-
-  # https://bugs.chromium.org/p/v8/issues/detail?id=8179
-  # Temporarily removed pending https://github.com/tc39/test262/issues/2339
-  #
-  # This test has target === holdings which throws, changing holdings to
-  #  { y } makes the test pass.
-  # 'built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-reference': [FAIL],
-
-  # https://github.com/tc39/test262/issues/2256
-  # Temporarily removed pending https://github.com/tc39/test262/issues/2339
-  # 'built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-unregister': [FAIL],
-
-  # https://github.com/tc39/test262/issues/2239
-  # Temporarily removed pending https://github.com/tc39/test262/issues/2339
-  # 'built-ins/WeakRef/prototype/deref/gc-cleanup-not-prevented-with-wr-deref': [FAIL],
-  # 'built-ins/FinalizationGroup/prototype/cleanupSome/gc-cleanup-not-prevented-with-wr-deref': [FAIL],
-
-  # https://github.com/tc39/test262/issues/2255
-  # Temporarily removed pending https://github.com/tc39/test262/issues/2339
-  # 'built-ins/FinalizationGroup/prototype/cleanupSome/iterator-holdings-multiple-values': [FAIL],
-
-  # https://github.com/tc39/test262/issues/2260
-  # Temporarily removed pending https://github.com/tc39/test262/issues/2339
-  # 'built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined-with-gc': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=9612
   'intl402/DateTimeFormat/prototype/formatRange/fractionalSecondDigits': [FAIL],
 
@@ -539,24 +517,45 @@
   'intl402/Locale/constructor-non-iana-canon': [FAIL],
   'intl402/Locale/likely-subtags-grandfathered': [FAIL],
 
+  # https://bugs.chromium.org/p/v8/issues/detail?id=9646
+  'built-ins/ThrowTypeError/name': [FAIL],
+  'language/expressions/class/name': [FAIL],
+
   # https://bugs.chromium.org/p/v8/issues/detail?id=9742
   'intl402/Locale/getters': [FAIL],
 
   # https://github.com/tc39/test262/pull/2349
   'intl402/Locale/constructor-options-region-valid': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=9741
-  'intl402/Locale/constructor-tag': [FAIL],
-
-  # https://bugs.chromium.org/p/v8/issues/detail?id=9800
-  'built-ins/String/prototype/matchAll/flags-undefined-throws': [FAIL],
-  'built-ins/String/prototype/matchAll/flags-nonglobal-throws': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=9818
   'built-ins/AsyncFunction/proto-from-ctor-realm': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=9819
-  'built-ins/Array/prototype/flatMap/array-like-objects-nested': [FAIL],
+  # https://bugs.chromium.org/p/v8/issues/detail?id=9808
+  'built-ins/AggregateError/*': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=10111
+  # super() should evaluate arguments before checking IsConstructable
+  'language/expressions/class/super-evaluation-order': [FAIL],
+
+  # Intl.NumberFormat(..., {signDisplay:'exceptZero'}).format(0.0001)
+  # produce +0 due to rounding
+  # https://bugs.chromium.org/p/v8/issues/detail?id=9515
+  'intl402/NumberFormat/prototype/format/signDisplay-en-US': [FAIL],
+  'intl402/NumberFormat/prototype/format/signDisplay-de-DE': [FAIL],
+  'intl402/NumberFormat/prototype/format/signDisplay-ja-JP': [FAIL],
+  'intl402/NumberFormat/prototype/format/signDisplay-ko-KR': [FAIL],
+  'intl402/NumberFormat/prototype/format/signDisplay-zh-TW': [FAIL],
+  'intl402/NumberFormat/prototype/format/signDisplay-rounding': [FAIL],
+  'intl402/NumberFormat/prototype/formatToParts/signDisplay-en-US': [FAIL],
+  'intl402/NumberFormat/prototype/formatToParts/signDisplay-de-DE': [FAIL],
+  'intl402/NumberFormat/prototype/formatToParts/signDisplay-ja-JP': [FAIL],
+  'intl402/NumberFormat/prototype/formatToParts/signDisplay-ko-KR': [FAIL],
+  'intl402/NumberFormat/prototype/formatToParts/signDisplay-zh-TW': [FAIL],
+
+  # Intl.NumberFormat constructor should throw RangeError
+  # https://bugs.chromium.org/p/v8/issues/detail?id=10112
+  'intl402/NumberFormat/constructor-order': [FAIL],
+  'intl402/NumberFormat/constructor-unit': [FAIL],
 
   ######################## NEEDS INVESTIGATION ###########################
 
@@ -662,8 +661,8 @@
 
 ['arch == arm or arch == mipsel or arch == mips or arch == arm64 or arch == mips64 or arch == mips64el', {
 
-  # TODO(mstarzinger): Causes stack overflow on simulators due to eager
-  # compilation of parenthesized function literals. Needs investigation.
+  # Causes stack overflow on simulators due to eager compilation of
+  # parenthesized function literals. Needs investigation.
   'language/statements/function/S13.2.1_A1_T1': [SKIP],
 
   # BUG(3251225): Tests that timeout with --noopt.
@@ -720,9 +719,4 @@
   'intl402/DateTimeFormat/prototype/resolvedOptions/basic': [SKIP],
 }],  # system == windows
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-
 ]
diff --git a/deps/v8/test/test262/testcfg.py b/deps/v8/test/test262/testcfg.py
index d70e644d9b9dc9..b971a22e5acf78 100644
--- a/deps/v8/test/test262/testcfg.py
+++ b/deps/v8/test/test262/testcfg.py
@@ -48,6 +48,8 @@
   'Intl.DateTimeFormat-dayPeriod': '--harmony-intl-dateformat-day-period',
   'Intl.DateTimeFormat-quarter': '--harmony-intl-dateformat-quarter',
   'Intl.DateTimeFormat-fractionalSecondDigits': '--harmony-intl-dateformat-fractional-second-digits',
+  'Intl.DisplayNames': '--harmony-intl-displaynames',
+  'String.prototype.replaceAll': '--harmony_string_replaceall',
   'Symbol.prototype.description': '--harmony-symbol-description',
   'export-star-as-namespace-from-module': '--harmony-namespace-exports',
   'Promise.allSettled': '--harmony-promise-all-settled',
@@ -61,6 +63,7 @@
   'regexp-named-groups': '--harmony-regexp-match-indices',
   'class-methods-private': '--harmony-private-methods',
   'class-static-methods-private': '--harmony-private-methods',
+  'coalesce-expression': '--harmony-nullish',
 }
 
 SKIPPED_FEATURES = set([])
diff --git a/deps/v8/test/torque/test-torque.tq b/deps/v8/test/torque/test-torque.tq
index 4fa106b9c55ed9..8948fd0eb05742 100644
--- a/deps/v8/test/torque/test-torque.tq
+++ b/deps/v8/test/torque/test-torque.tq
@@ -4,7 +4,9 @@
 
 namespace test {
   macro ElementsKindTestHelper1(kind: constexpr ElementsKind): bool {
-    if constexpr ((kind == UINT8_ELEMENTS) || (kind == UINT16_ELEMENTS)) {
+    if constexpr (
+        (kind == ElementsKind::UINT8_ELEMENTS) ||
+        (kind == ElementsKind::UINT16_ELEMENTS)) {
       return true;
     } else {
       return false;
@@ -12,7 +14,9 @@ namespace test {
   }
 
   macro ElementsKindTestHelper2(kind: constexpr ElementsKind): constexpr bool {
-    return ((kind == UINT8_ELEMENTS) || (kind == UINT16_ELEMENTS));
+    return (
+        (kind == ElementsKind::UINT8_ELEMENTS) ||
+        (kind == ElementsKind::UINT16_ELEMENTS));
   }
 
   macro LabelTestHelper1(): never
@@ -32,22 +36,27 @@ namespace test {
 
   @export
   macro TestConstexpr1() {
-    check(FromConstexpr<bool>(IsFastElementsKind(PACKED_SMI_ELEMENTS)));
+    check(FromConstexpr<bool>(
+        IsFastElementsKind(ElementsKind::PACKED_SMI_ELEMENTS)));
   }
 
   @export
   macro TestConstexprIf() {
-    check(ElementsKindTestHelper1(UINT8_ELEMENTS));
-    check(ElementsKindTestHelper1(UINT16_ELEMENTS));
-    check(!ElementsKindTestHelper1(UINT32_ELEMENTS));
+    check(ElementsKindTestHelper1(ElementsKind::UINT8_ELEMENTS));
+    check(ElementsKindTestHelper1(ElementsKind::UINT16_ELEMENTS));
+    check(!ElementsKindTestHelper1(ElementsKind::UINT32_ELEMENTS));
   }
 
   @export
   macro TestConstexprReturn() {
-    check(FromConstexpr<bool>(ElementsKindTestHelper2(UINT8_ELEMENTS)));
-    check(FromConstexpr<bool>(ElementsKindTestHelper2(UINT16_ELEMENTS)));
-    check(!FromConstexpr<bool>(ElementsKindTestHelper2(UINT32_ELEMENTS)));
-    check(FromConstexpr<bool>(!ElementsKindTestHelper2(UINT32_ELEMENTS)));
+    check(FromConstexpr<bool>(
+        ElementsKindTestHelper2(ElementsKind::UINT8_ELEMENTS)));
+    check(FromConstexpr<bool>(
+        ElementsKindTestHelper2(ElementsKind::UINT16_ELEMENTS)));
+    check(!FromConstexpr<bool>(
+        ElementsKindTestHelper2(ElementsKind::UINT32_ELEMENTS)));
+    check(FromConstexpr<bool>(
+        !ElementsKindTestHelper2(ElementsKind::UINT32_ELEMENTS)));
   }
 
   @export
@@ -465,7 +474,7 @@ namespace test {
     }
   }
 
-  type NumberOrFixedArray = Number | FixedArray;
+  type NumberOrFixedArray = Number|FixedArray;
   macro TypeswitchExample(implicit context: Context)(x: NumberOrFixedArray):
       int32 {
     let result: int32 = 0;
@@ -633,7 +642,7 @@ namespace test {
   macro TestCatch1(implicit context: Context)(): Smi {
     let r: Smi = 0;
     try {
-      ThrowTypeError(kInvalidArrayLength);
+      ThrowTypeError(MessageTemplate::kInvalidArrayLength);
     } catch (_e) {
       r = 1;
       return r;
@@ -642,7 +651,7 @@ namespace test {
 
   @export
   macro TestCatch2Wrapper(implicit context: Context)(): never {
-    ThrowTypeError(kInvalidArrayLength);
+    ThrowTypeError(MessageTemplate::kInvalidArrayLength);
   }
 
   @export
@@ -659,7 +668,7 @@ namespace test {
   @export
   macro TestCatch3WrapperWithLabel(implicit context: Context)():
       never labels _Abort {
-    ThrowTypeError(kInvalidArrayLength);
+    ThrowTypeError(MessageTemplate::kInvalidArrayLength);
   }
 
   @export
@@ -727,10 +736,10 @@ namespace test {
   }
 
   struct TestInner {
-    SetX(newValue: int32) {
+    macro SetX(newValue: int32) {
       this.x = newValue;
     }
-    GetX(): int32 {
+    macro GetX(): int32 {
       return this.x;
     }
     x: int32;
@@ -759,7 +768,7 @@ namespace test {
   }
 
   class InternalClass extends Struct {
-    Flip() labels NotASmi {
+    macro Flip() labels NotASmi {
       const tmp = Cast<Smi>(this.b) otherwise NotASmi;
       this.b = this.a;
       this.a = tmp;
@@ -781,10 +790,10 @@ namespace test {
   }
 
   struct StructWithConst {
-    TestMethod1(): int32 {
+    macro TestMethod1(): int32 {
       return this.b;
     }
-    TestMethod2(): Object {
+    macro TestMethod2(): Object {
       return this.a;
     }
     a: Object;
@@ -802,8 +811,16 @@ namespace test {
     check(x.TestMethod2() == Null);
   }
 
+  @export
+  macro TestParentFrameArguments(implicit context: Context)() {
+    const parentFrame = LoadParentFramePointer();
+    const castFrame = Cast<StandardFrame>(parentFrame) otherwise unreachable;
+    const arguments = GetFrameArguments(castFrame, 1);
+    ArgumentsIterator{arguments, current: 0};
+  }
+
   struct TestIterator {
-    Next(): Object labels NoMore {
+    macro Next(): Object labels NoMore {
       if (this.count-- == 0) goto NoMore;
       return TheHole;
     }
@@ -817,7 +834,7 @@ namespace test {
   }
 
   class SmiPair extends Struct {
-    GetA():&Smi {
+    macro GetA():&Smi {
       return & this.a;
     }
     a: Smi;
@@ -888,8 +905,7 @@ namespace test {
     let it = slice.Iterator();
     let count: Smi = 0;
     while (true) {
-      let ref = it.Next() otherwise break;
-      const value = UnsafeCast<Smi>(* ref);
+      const value = UnsafeCast<Smi>(it.Next() otherwise break);
       check(value == count + 7);
       count++;
     }
@@ -1028,4 +1044,80 @@ namespace test {
     }
   }
 
+  bitfield struct TestBitFieldStruct extends uint8 {
+    a: bool: 1 bit;
+    b: uint16: 3 bit;
+    c: uint32: 3 bit;
+    d: bool: 1 bit;
+  }
+
+  @export
+  macro TestBitFieldLoad(
+      val: TestBitFieldStruct, expectedA: bool, expectedB: uint16,
+      expectedC: uint32, expectedD: bool) {
+    check(val.a == expectedA);
+    check(val.b == expectedB);
+    check(val.c == expectedC);
+    check(val.d == expectedD);
+  }
+
+  @export
+  macro TestBitFieldStore(val: TestBitFieldStruct) {
+    let val: TestBitFieldStruct = val;  // Get a mutable local copy.
+    const a: bool = val.a;
+    const b: uint16 = val.b;
+    let c: uint32 = val.c;
+    const d: bool = val.d;
+
+    val.a = !a;
+    TestBitFieldLoad(val, !a, b, c, d);
+
+    c = Unsigned(7 - Signed(val.c));
+    val.c = c;
+    TestBitFieldLoad(val, !a, b, c, d);
+
+    val.d = val.b == val.c;
+    TestBitFieldLoad(val, !a, b, c, b == c);
+  }
+
+  // Some other bitfield structs, to verify getting uintptr values out of word32
+  // structs and vice versa.
+  bitfield struct TestBitFieldStruct2 extends uint32 {
+    a: uintptr: 5 bit;
+    b: uintptr: 6 bit;
+  }
+  bitfield struct TestBitFieldStruct3 extends uintptr {
+    c: bool: 1 bit;
+    d: uint32: 9 bit;
+    e: uintptr: 17 bit;
+  }
+
+  @export
+  macro TestBitFieldUintptrOps(
+      val2: TestBitFieldStruct2, val3: TestBitFieldStruct3) {
+    let val2: TestBitFieldStruct2 = val2;  // Get a mutable local copy.
+    let val3: TestBitFieldStruct3 = val3;  // Get a mutable local copy.
+
+    // Caller is expected to provide these exact values, so we can verify
+    // reading values before starting to write anything.
+    check(val2.a == 3);
+    check(val2.b == 61);
+    check(val3.c);
+    check(val3.d == 500);
+    check(val3.e == 0x1cc);
+
+    val2.b = 16;
+    check(val2.a == 3);
+    check(val2.b == 16);
+
+    val2.b++;
+    check(val2.a == 3);
+    check(val2.b == 17);
+
+    val3.d = 99;
+    val3.e = 1234;
+    check(val3.c);
+    check(val3.d == 99);
+    check(val3.e == 1234);
+  }
 }
diff --git a/deps/v8/test/unittests/BUILD.gn b/deps/v8/test/unittests/BUILD.gn
index 4ae76e1543847e..37c2bdae0286d8 100644
--- a/deps/v8/test/unittests/BUILD.gn
+++ b/deps/v8/test/unittests/BUILD.gn
@@ -4,6 +4,22 @@
 
 import("../../gni/v8.gni")
 
+if (is_fuchsia) {
+  import("//build/config/fuchsia/rules.gni")
+
+  fuchsia_package("v8_unittests_pkg") {
+    testonly = true
+    binary = ":unittests"
+    package_name_override = "v8_unittests"
+  }
+
+  fuchsia_package_runner("v8_unittests_fuchsia") {
+    testonly = true
+    package = ":v8_unittests_pkg"
+    package_name_override = "v8_unittests"
+  }
+}
+
 v8_executable("unittests") {
   testonly = true
 
@@ -22,9 +38,7 @@ v8_executable("unittests") {
     "//testing/gtest",
   ]
 
-  data_deps = [
-    "../../tools:v8_testrunner",
-  ]
+  data_deps = [ "../../tools:v8_testrunner" ]
 
   data = [
     "testcfg.py",
@@ -92,8 +106,6 @@ v8_source_set("unittests_sources") {
     "compiler/branch-elimination-unittest.cc",
     "compiler/bytecode-analysis-unittest.cc",
     "compiler/checkpoint-elimination-unittest.cc",
-    "compiler/code-assembler-unittest.cc",
-    "compiler/code-assembler-unittest.h",
     "compiler/common-operator-reducer-unittest.cc",
     "compiler/common-operator-unittest.cc",
     "compiler/compiler-test-utils.h",
@@ -101,7 +113,7 @@ v8_source_set("unittests_sources") {
     "compiler/control-equivalence-unittest.cc",
     "compiler/control-flow-optimizer-unittest.cc",
     "compiler/dead-code-elimination-unittest.cc",
-    "compiler/decompression-elimination-unittest.cc",
+    "compiler/decompression-optimizer-unittest.cc",
     "compiler/diamond-unittest.cc",
     "compiler/effect-control-linearizer-unittest.cc",
     "compiler/graph-reducer-unittest.cc",
@@ -159,8 +171,10 @@ v8_source_set("unittests_sources") {
     "heap/heap-unittest.cc",
     "heap/item-parallel-job-unittest.cc",
     "heap/marking-unittest.cc",
+    "heap/marking-worklist-unittest.cc",
     "heap/memory-reducer-unittest.cc",
     "heap/object-stats-unittest.cc",
+    "heap/off-thread-factory-unittest.cc",
     "heap/scavenge-job-unittest.cc",
     "heap/slot-set-unittest.cc",
     "heap/spaces-unittest.cc",
@@ -192,9 +206,11 @@ v8_source_set("unittests_sources") {
     "objects/object-unittest.cc",
     "objects/osr-optimized-code-cache-unittest.cc",
     "objects/value-serializer-unittest.cc",
+    "objects/weakarraylist-unittest.cc",
     "parser/ast-value-unittest.cc",
     "parser/preparser-unittest.cc",
     "profiler/strings-storage-unittest.cc",
+    "regress/regress-crbug-1041240-unittest.cc",
     "regress/regress-crbug-938251-unittest.cc",
     "run-all-unittests.cc",
     "strings/char-predicates-unittest.cc",
@@ -215,6 +231,7 @@ v8_source_set("unittests_sources") {
     "utils/detachable-vector-unittest.cc",
     "utils/locked-queue-unittest.cc",
     "utils/utils-unittest.cc",
+    "utils/vector-unittest.cc",
     "wasm/control-transfer-unittest.cc",
     "wasm/decoder-unittest.cc",
     "wasm/function-body-decoder-unittest.cc",
@@ -228,21 +245,11 @@ v8_source_set("unittests_sources") {
     "wasm/wasm-module-builder-unittest.cc",
     "wasm/wasm-module-sourcemap-unittest.cc",
     "wasm/wasm-opcodes-unittest.cc",
-    "wasm/wasm-text-unittest.cc",
     "zone/zone-allocator-unittest.cc",
     "zone/zone-chunk-list-unittest.cc",
     "zone/zone-unittest.cc",
   ]
 
-  if (use_jumbo_build) {
-    jumbo_excluded_sources = [
-      # TODO(mostynb@opera.com): figure out how to make this build in both
-      # modes.  Template issues on windows if we add a functional_unittest
-      # namespace as with the other files.
-      "base/functional-unittest.cc",
-    ]
-  }
-
   if (v8_current_cpu == "arm") {
     sources += [
       "assembler/turbo-assembler-arm-unittest.cc",
@@ -304,8 +311,7 @@ v8_source_set("unittests_sources") {
     "../..:v8_for_testing",
     "../..:v8_libbase",
     "../..:v8_libplatform",
-    "../../third_party/inspector_protocol:bindings_test",
-    "../../third_party/inspector_protocol:encoding_test",
+    "../../third_party/inspector_protocol:crdtp_test",
     "//build/win:default_exe_manifest",
     "//testing/gmock",
     "//testing/gtest",
diff --git a/deps/v8/test/unittests/api/resource-constraints-unittest.cc b/deps/v8/test/unittests/api/resource-constraints-unittest.cc
index 4c9b7f33dd33da..f9151edb948d91 100644
--- a/deps/v8/test/unittests/api/resource-constraints-unittest.cc
+++ b/deps/v8/test/unittests/api/resource-constraints-unittest.cc
@@ -44,9 +44,10 @@ TEST(ResourceConstraints, ConfigureDefaults) {
   const size_t KB = static_cast<size_t>(i::KB);
   const size_t MB = static_cast<size_t>(i::MB);
   const size_t pm = i::Heap::kPointerMultiplier;
+  const size_t hlm = i::Heap::kHeapLimitMultiplier;
   v8::ResourceConstraints constraints;
   constraints.ConfigureDefaults(2048u * MB, 0u);
-  ASSERT_EQ(512u * pm * MB, constraints.max_old_generation_size_in_bytes());
+  ASSERT_EQ(512u * hlm * MB, constraints.max_old_generation_size_in_bytes());
   ASSERT_EQ(3 * 4096 * pm * KB,
             constraints.max_young_generation_size_in_bytes());
   ASSERT_EQ(0u, constraints.initial_old_generation_size_in_bytes());
diff --git a/deps/v8/test/unittests/assembler/turbo-assembler-arm64-unittest.cc b/deps/v8/test/unittests/assembler/turbo-assembler-arm64-unittest.cc
index b78cc710378025..02a6a8e763c4e2 100644
--- a/deps/v8/test/unittests/assembler/turbo-assembler-arm64-unittest.cc
+++ b/deps/v8/test/unittests/assembler/turbo-assembler-arm64-unittest.cc
@@ -121,7 +121,7 @@ TEST_P(TurboAssemblerTestMoveObjectAndSlot, MoveObjectAndSlot) {
     Register dst_slot = test_case.dst_slot;
 
     Operand offset_operand(0);
-    if (test_case.offset_register.Is(no_reg)) {
+    if (test_case.offset_register == no_reg) {
       offset_operand = Operand(offset);
     } else {
       __ Mov(test_case.offset_register, Operand(offset));
@@ -131,7 +131,7 @@ TEST_P(TurboAssemblerTestMoveObjectAndSlot, MoveObjectAndSlot) {
     std::stringstream comment;
     comment << "-- " << test_case.comment << ": MoveObjectAndSlot("
             << dst_object << ", " << dst_slot << ", " << src_object << ", ";
-    if (test_case.offset_register.Is(no_reg)) {
+    if (test_case.offset_register == no_reg) {
       comment << "#" << offset;
     } else {
       comment << test_case.offset_register;
diff --git a/deps/v8/test/unittests/base/bits-unittest.cc b/deps/v8/test/unittests/base/bits-unittest.cc
index 6f787eb7278357..1e73ca01328282 100644
--- a/deps/v8/test/unittests/base/bits-unittest.cc
+++ b/deps/v8/test/unittests/base/bits-unittest.cc
@@ -117,7 +117,6 @@ TEST(Bits, CountTrailingZeros64) {
   EXPECT_EQ(36u, CountTrailingZeros(uint64_t{0xF0F0F0F000000000}));
 }
 
-
 TEST(Bits, IsPowerOfTwo32) {
   EXPECT_FALSE(IsPowerOfTwo(0U));
   TRACED_FORRANGE(uint32_t, shift, 0, 31) {
@@ -131,7 +130,6 @@ TEST(Bits, IsPowerOfTwo32) {
   EXPECT_FALSE(IsPowerOfTwo(0xFFFFFFFF));
 }
 
-
 TEST(Bits, IsPowerOfTwo64) {
   EXPECT_FALSE(IsPowerOfTwo(uint64_t{0}));
   TRACED_FORRANGE(uint32_t, shift, 0, 63) {
@@ -145,6 +143,23 @@ TEST(Bits, IsPowerOfTwo64) {
   EXPECT_FALSE(IsPowerOfTwo(uint64_t{0xFFFFFFFFFFFFFFFF}));
 }
 
+TEST(Bits, WhichPowerOfTwo32) {
+  TRACED_FORRANGE(int, shift, 0, 30) {
+    EXPECT_EQ(shift, WhichPowerOfTwo(int32_t{1} << shift));
+  }
+  TRACED_FORRANGE(int, shift, 0, 31) {
+    EXPECT_EQ(shift, WhichPowerOfTwo(uint32_t{1} << shift));
+  }
+}
+
+TEST(Bits, WhichPowerOfTwo64) {
+  TRACED_FORRANGE(int, shift, 0, 62) {
+    EXPECT_EQ(shift, WhichPowerOfTwo(int64_t{1} << shift));
+  }
+  TRACED_FORRANGE(int, shift, 0, 63) {
+    EXPECT_EQ(shift, WhichPowerOfTwo(uint64_t{1} << shift));
+  }
+}
 
 TEST(Bits, RoundUpToPowerOfTwo32) {
   TRACED_FORRANGE(uint32_t, shift, 0, 31) {
diff --git a/deps/v8/test/unittests/base/iterator-unittest.cc b/deps/v8/test/unittests/base/iterator-unittest.cc
index 955828e028255b..a2a0cedf841e18 100644
--- a/deps/v8/test/unittests/base/iterator-unittest.cc
+++ b/deps/v8/test/unittests/base/iterator-unittest.cc
@@ -20,7 +20,6 @@ TEST(IteratorTest, IteratorRangeEmpty) {
   EXPECT_EQ(0, r.size());
 }
 
-
 TEST(IteratorTest, IteratorRangeArray) {
   int array[10] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9};
   base::iterator_range<int*> r1(&array[0], &array[10]);
@@ -40,7 +39,6 @@ TEST(IteratorTest, IteratorRangeArray) {
   }
 }
 
-
 TEST(IteratorTest, IteratorRangeDeque) {
   using C = std::deque<int>;
   C c;
@@ -57,5 +55,18 @@ TEST(IteratorTest, IteratorRangeDeque) {
   EXPECT_EQ(2, std::count(r.begin(), r.end(), 2));
 }
 
+TEST(IteratorTest, IteratorTypeDeduction) {
+  base::iterator_range<char*> r;
+  auto r2 = make_iterator_range(r.begin(), r.end());
+  EXPECT_EQ(r2.begin(), r.begin());
+  EXPECT_EQ(r2.end(), r2.end());
+  auto I = r.begin(), E = r.end();
+  // Check that this compiles and does the correct thing even if the iterators
+  // are lvalues:
+  auto r3 = make_iterator_range(I, E);
+  EXPECT_TRUE((std::is_same<decltype(r2), decltype(r3)>::value));
+  EXPECT_EQ(r3.begin(), r.begin());
+  EXPECT_EQ(r3.end(), r2.end());
+}
 }  // namespace base
 }  // namespace v8
diff --git a/deps/v8/test/unittests/base/logging-unittest.cc b/deps/v8/test/unittests/base/logging-unittest.cc
index 762d6762cd65f2..157d84bac1d418 100644
--- a/deps/v8/test/unittests/base/logging-unittest.cc
+++ b/deps/v8/test/unittests/base/logging-unittest.cc
@@ -74,19 +74,32 @@ TEST(LoggingTest, CompareAgainstStaticConstPointer) {
   DCHECK_##name(lhs, rhs)
 
 namespace {
-std::string FailureMessage(const char* msg, const char* debug_msg) {
-  std::string regexp(msg);
-#ifdef DEBUG
-  regexp.append(" (").append(debug_msg).append(")");
-#endif
+std::string SanitizeRegexp(std::string msg) {
   size_t last_pos = 0;
   do {
-    size_t pos = regexp.find_first_of("(){}+*", last_pos);
+    size_t pos = msg.find_first_of("(){}+*", last_pos);
     if (pos == std::string::npos) break;
-    regexp.insert(pos, "\\");
+    msg.insert(pos, "\\");
     last_pos = pos + 2;
   } while (true);
-  return regexp;
+  return msg;
+}
+
+std::string FailureMessage(const char* msg, const char* lhs, const char* rhs) {
+  std::string full_msg(msg);
+#ifdef DEBUG
+  full_msg.append(" (").append(lhs).append(" vs. ").append(rhs);
+#endif
+  return SanitizeRegexp(std::move(full_msg));
+}
+
+std::string LongFailureMessage(const char* msg, const char* lhs,
+                               const char* rhs) {
+  std::string full_msg(msg);
+#ifdef DEBUG
+  full_msg.append("\n   ").append(lhs).append("\n vs.\n   ").append(rhs);
+#endif
+  return SanitizeRegexp(std::move(full_msg));
 }
 }  // namespace
 
@@ -107,7 +120,7 @@ TEST(LoggingTest, CompareWithDifferentSignedness) {
   // Check that the values are output correctly on error.
   ASSERT_DEATH_IF_SUPPORTED(
       ([&] { CHECK_GT(i32, u64); })(),
-      FailureMessage("Check failed: i32 > u64", "10 vs. 40"));
+      FailureMessage("Check failed: i32 > u64", "10", "40"));
 }
 
 TEST(LoggingTest, CompareWithReferenceType) {
@@ -125,7 +138,7 @@ TEST(LoggingTest, CompareWithReferenceType) {
   // Check that the values are output correctly on error.
   ASSERT_DEATH_IF_SUPPORTED(
       ([&] { CHECK_GT(*&i32, u64); })(),
-      FailureMessage("Check failed: *&i32 > u64", "10 vs. 40"));
+      FailureMessage("Check failed: *&i32 > u64", "10", "40"));
 }
 
 enum TestEnum1 { ONE, TWO };
@@ -172,27 +185,27 @@ TEST(LoggingTest, CompareClassTypes) {
   ASSERT_DEATH_IF_SUPPORTED(
       ([&] { CHECK_NE(TestClass1{}, TestClass1{}); })(),
       FailureMessage("Check failed: TestClass1{} != TestClass1{}",
-                     "<unprintable> vs. <unprintable>"));
+                     "<unprintable>", "<unprintable>"));
   ASSERT_DEATH_IF_SUPPORTED(
       ([&] { CHECK_LT(TestClass2{4}, TestClass2{3}); })(),
       FailureMessage("Check failed: TestClass2{4} < TestClass2{3}",
-                     "TestClass2(4) vs. TestClass2(3)"));
+                     "TestClass2(4)", "TestClass2(3)"));
 }
 
 TEST(LoggingDeathTest, OutputEnumValues) {
   ASSERT_DEATH_IF_SUPPORTED(
       ([&] { CHECK_EQ(ONE, TWO); })(),
-      FailureMessage("Check failed: ONE == TWO", "0 vs. 1"));
+      FailureMessage("Check failed: ONE == TWO", "0", "1"));
   ASSERT_DEATH_IF_SUPPORTED(
       ([&] { CHECK_NE(BAR, 2 + 3); })(),
-      FailureMessage("Check failed: BAR != 2 + 3", "5 vs. 5"));
+      FailureMessage("Check failed: BAR != 2 + 3", "5", "5"));
   ASSERT_DEATH_IF_SUPPORTED(
       ([&] { CHECK_EQ(TestEnum3::A, TestEnum3::B); })(),
-      FailureMessage("Check failed: TestEnum3::A == TestEnum3::B", "0 vs. 1"));
+      FailureMessage("Check failed: TestEnum3::A == TestEnum3::B", "0", "1"));
   ASSERT_DEATH_IF_SUPPORTED(
       ([&] { CHECK_GE(TestEnum4::FIRST, TestEnum4::SECOND); })(),
-      FailureMessage("Check failed: TestEnum4::FIRST >= TestEnum4::SECOND",
-                     "0 vs. 1"));
+      FailureMessage("Check failed: TestEnum4::FIRST >= TestEnum4::SECOND", "0",
+                     "1"));
 }
 
 enum TestEnum5 { TEST_A, TEST_B };
@@ -207,11 +220,31 @@ void operator<<(std::ostream& str, TestEnum6 val) {
 TEST(LoggingDeathTest, OutputEnumWithOutputOperator) {
   ASSERT_DEATH_IF_SUPPORTED(
       ([&] { CHECK_EQ(TEST_A, TEST_B); })(),
-      FailureMessage("Check failed: TEST_A == TEST_B", "A vs. B"));
+      FailureMessage("Check failed: TEST_A == TEST_B", "A", "B"));
   ASSERT_DEATH_IF_SUPPORTED(
       ([&] { CHECK_GE(TestEnum6::TEST_C, TestEnum6::TEST_D); })(),
       FailureMessage("Check failed: TestEnum6::TEST_C >= TestEnum6::TEST_D",
-                     "C vs. D"));
+                     "C", "D"));
+}
+
+TEST(LoggingDeathTest, OutputLongValues) {
+  constexpr size_t kMaxInlineLength = 50;  // see logging.h
+  std::string str1;
+  while (str1.length() < kMaxInlineLength) {
+    str1.push_back('a' + (str1.length() % 26));
+  }
+  std::string str2("abc");
+  ASSERT_DEATH_IF_SUPPORTED(
+      ([&] { CHECK_EQ(str1, str2); })(),
+      FailureMessage("Check failed: str1 == str2",
+                     "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwx",
+                     "abc"));
+  str1.push_back('X');
+  ASSERT_DEATH_IF_SUPPORTED(
+      ([&] { CHECK_EQ(str1, str2); })(),
+      LongFailureMessage("Check failed: str1 == str2",
+                         "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxX",
+                         "abc"));
 }
 
 TEST(LoggingDeathTest, FatalKills) {
diff --git a/deps/v8/test/unittests/base/region-allocator-unittest.cc b/deps/v8/test/unittests/base/region-allocator-unittest.cc
index 5024ac85ebdef0..caec4894c9b60f 100644
--- a/deps/v8/test/unittests/base/region-allocator-unittest.cc
+++ b/deps/v8/test/unittests/base/region-allocator-unittest.cc
@@ -16,7 +16,7 @@ using v8::internal::MB;
 
 class RegionAllocatorTest : public ::testing::TestWithParam<int> {};
 
-TEST(RegionAllocatorTest, SimpleAllocateRegionAt) {
+TEST_P(RegionAllocatorTest, SimpleAllocateRegionAt) {
   const size_t kPageSize = 4 * KB;
   const size_t kPageCount = 16;
   const size_t kSize = kPageSize * kPageCount;
@@ -50,7 +50,7 @@ TEST(RegionAllocatorTest, SimpleAllocateRegionAt) {
   CHECK_EQ(ra.AllocateRegion(kSize), kBegin);
 }
 
-TEST(RegionAllocatorTest, SimpleAllocateRegion) {
+TEST_P(RegionAllocatorTest, SimpleAllocateRegion) {
   const size_t kPageSize = 4 * KB;
   const size_t kPageCount = 16;
   const size_t kSize = kPageSize * kPageCount;
@@ -123,7 +123,7 @@ TEST_P(RegionAllocatorTest, AllocateRegionRandom) {
   CHECK_EQ(ra.AllocateRegion(kPageSize), RegionAllocator::kAllocationFailure);
 }
 
-TEST(RegionAllocatorTest, AllocateBigRegions) {
+TEST_P(RegionAllocatorTest, AllocateBigRegions) {
   const size_t kPageSize = 4 * KB;
   const size_t kPageCountLog = 10;
   const size_t kPageCount = (size_t{1} << kPageCountLog) - 1;
@@ -153,7 +153,7 @@ TEST(RegionAllocatorTest, AllocateBigRegions) {
   CHECK_EQ(ra.free_size(), 0);
 }
 
-TEST(RegionAllocatorTest, MergeLeftToRightCoalecsingRegions) {
+TEST_P(RegionAllocatorTest, MergeLeftToRightCoalecsingRegions) {
   const size_t kPageSize = 4 * KB;
   const size_t kPageCountLog = 10;
   const size_t kPageCount = (size_t{1} << kPageCountLog);
@@ -236,7 +236,7 @@ TEST_P(RegionAllocatorTest, MergeRightToLeftCoalecsingRegions) {
   CHECK_EQ(ra.AllocateRegion(kSize), kBegin);
 }
 
-TEST(RegionAllocatorTest, Fragmentation) {
+TEST_P(RegionAllocatorTest, Fragmentation) {
   const size_t kPageSize = 64 * KB;
   const size_t kPageCount = 9;
   const size_t kSize = kPageSize * kPageCount;
@@ -283,7 +283,7 @@ TEST(RegionAllocatorTest, Fragmentation) {
   CHECK_EQ(ra.AllocateRegion(kSize), kBegin);
 }
 
-TEST(RegionAllocatorTest, FindRegion) {
+TEST_P(RegionAllocatorTest, FindRegion) {
   const size_t kPageSize = 4 * KB;
   const size_t kPageCount = 16;
   const size_t kSize = kPageSize * kPageCount;
@@ -322,7 +322,7 @@ TEST(RegionAllocatorTest, FindRegion) {
   }
 }
 
-TEST(RegionAllocatorTest, TrimRegion) {
+TEST_P(RegionAllocatorTest, TrimRegion) {
   const size_t kPageSize = 4 * KB;
   const size_t kPageCount = 64;
   const size_t kSize = kPageSize * kPageCount;
@@ -352,5 +352,7 @@ TEST(RegionAllocatorTest, TrimRegion) {
   CHECK_EQ(ra.AllocateRegion(kSize), kBegin);
 }
 
+INSTANTIATE_TEST_SUITE_P(RegionAllocatorTest, RegionAllocatorTest,
+                         testing::Values(123));
 }  // namespace base
 }  // namespace v8
diff --git a/deps/v8/test/unittests/base/utils/random-number-generator-unittest.cc b/deps/v8/test/unittests/base/utils/random-number-generator-unittest.cc
index 453d788a6eb3ec..86850e0ae0c189 100644
--- a/deps/v8/test/unittests/base/utils/random-number-generator-unittest.cc
+++ b/deps/v8/test/unittests/base/utils/random-number-generator-unittest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <algorithm>
 #include <climits>
 
 #include "src/base/utils/random-number-generator.h"
diff --git a/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc b/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
index 954bdd5065fe34..0990f8c63bc6eb 100644
--- a/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
+++ b/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
@@ -137,23 +137,6 @@ class MockPlatform : public v8::Platform {
     UNREACHABLE();
   }
 
-  void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override {
-    base::MutexGuard lock(&mutex_);
-    foreground_tasks_.push_back(std::unique_ptr<Task>(task));
-  }
-
-  void CallDelayedOnForegroundThread(v8::Isolate* isolate, Task* task,
-                                     double delay_in_seconds) override {
-    UNREACHABLE();
-  }
-
-  void CallIdleOnForegroundThread(v8::Isolate* isolate,
-                                  IdleTask* task) override {
-    base::MutexGuard lock(&mutex_);
-    ASSERT_TRUE(idle_task_ == nullptr);
-    idle_task_ = task;
-  }
-
   bool IdleTasksEnabled(v8::Isolate* isolate) override { return true; }
 
   double MonotonicallyIncreasingTime() override {
@@ -289,6 +272,11 @@ class MockPlatform : public v8::Platform {
       platform_->foreground_tasks_.push_back(std::move(task));
     }
 
+    void PostNonNestableTask(std::unique_ptr<v8::Task> task) override {
+      // The mock platform does not nest tasks.
+      PostTask(std::move(task));
+    }
+
     void PostDelayedTask(std::unique_ptr<Task> task,
                          double delay_in_seconds) override {
       UNREACHABLE();
@@ -303,6 +291,8 @@ class MockPlatform : public v8::Platform {
 
     bool IdleTasksEnabled() override { return true; }
 
+    bool NonNestableTasksEnabled() const override { return false; }
+
    private:
     MockPlatform* platform_;
   };
diff --git a/deps/v8/test/unittests/compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc b/deps/v8/test/unittests/compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc
index ff59e79a60e0b8..d2ff7439e49d5e 100644
--- a/deps/v8/test/unittests/compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc
+++ b/deps/v8/test/unittests/compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc
@@ -42,7 +42,7 @@ class BlockingCompilationJob : public OptimizedCompilationJob {
   // OptimiziedCompilationJob implementation.
   Status PrepareJobImpl(Isolate* isolate) override { UNREACHABLE(); }
 
-  Status ExecuteJobImpl() override {
+  Status ExecuteJobImpl(RuntimeCallStats* stats) override {
     blocking_.SetValue(true);
     semaphore_.Wait();
     blocking_.SetValue(false);
diff --git a/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc b/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc
index d7a3a92c964b01..a779da083a5683 100644
--- a/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc
+++ b/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc
@@ -2955,10 +2955,9 @@ using InstructionSelectorStoreWithBarrierTest =
 TEST_P(InstructionSelectorStoreWithBarrierTest,
        StoreWithWriteBarrierParameters) {
   const WriteBarrierKind barrier_kind = GetParam();
-  StreamBuilder m(this, MachineType::Int32(),
-                  MachineType::TypeCompressedTaggedPointer(),
-                  MachineType::Int32(), MachineType::TypeCompressedTagged());
-  m.Store(MachineType::RepCompressedTagged(), m.Parameter(0), m.Parameter(1),
+  StreamBuilder m(this, MachineType::Int32(), MachineType::TaggedPointer(),
+                  MachineType::Int32(), MachineType::AnyTagged());
+  m.Store(MachineRepresentation::kTagged, m.Parameter(0), m.Parameter(1),
           m.Parameter(2), barrier_kind);
   m.Return(m.Int32Constant(0));
   Stream s = m.Build(kAllExceptNopInstructions);
@@ -2974,10 +2973,9 @@ TEST_P(InstructionSelectorStoreWithBarrierTest,
        StoreWithWriteBarrierImmediate) {
   const WriteBarrierKind barrier_kind = GetParam();
   TRACED_FOREACH(int32_t, index, kStoreWithBarrierImmediates) {
-    StreamBuilder m(this, MachineType::Int32(),
-                    MachineType::TypeCompressedTaggedPointer(),
-                    MachineType::TypeCompressedTagged());
-    m.Store(MachineType::RepCompressedTagged(), m.Parameter(0),
+    StreamBuilder m(this, MachineType::Int32(), MachineType::TaggedPointer(),
+                    MachineType::AnyTagged());
+    m.Store(MachineRepresentation::kTagged, m.Parameter(0),
             m.Int32Constant(index), m.Parameter(1), barrier_kind);
     m.Return(m.Int32Constant(0));
     Stream s = m.Build(kAllExceptNopInstructions);
diff --git a/deps/v8/test/unittests/compiler/backend/instruction-selector-unittest.cc b/deps/v8/test/unittests/compiler/backend/instruction-selector-unittest.cc
index c29979c600c112..95191819a8b0cb 100644
--- a/deps/v8/test/unittests/compiler/backend/instruction-selector-unittest.cc
+++ b/deps/v8/test/unittests/compiler/backend/instruction-selector-unittest.cc
@@ -41,12 +41,13 @@ InstructionSelectorTest::Stream InstructionSelectorTest::StreamBuilder::Build(
   SourcePositionTable source_position_table(graph());
   TickCounter tick_counter;
   size_t max_unoptimized_frame_height = 0;
+  size_t max_pushed_argument_count = 0;
   InstructionSelector selector(
       test_->zone(), node_count, &linkage, &sequence, schedule,
       &source_position_table, nullptr,
       InstructionSelector::kEnableSwitchJumpTable, &tick_counter,
-      &max_unoptimized_frame_height, source_position_mode, features,
-      InstructionSelector::kDisableScheduling,
+      &max_unoptimized_frame_height, &max_pushed_argument_count,
+      source_position_mode, features, InstructionSelector::kDisableScheduling,
       InstructionSelector::kEnableRootsRelativeAddressing,
       PoisoningMitigationLevel::kPoisonAll);
   selector.SelectInstructions();
diff --git a/deps/v8/test/unittests/compiler/code-assembler-unittest.cc b/deps/v8/test/unittests/compiler/code-assembler-unittest.cc
deleted file mode 100644
index 43dfd9876fd9ab..00000000000000
--- a/deps/v8/test/unittests/compiler/code-assembler-unittest.cc
+++ /dev/null
@@ -1,308 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "test/unittests/compiler/code-assembler-unittest.h"
-
-#include "src/codegen/code-factory.h"
-#include "src/codegen/interface-descriptors.h"
-#include "src/compiler/node.h"
-#include "src/execution/isolate.h"
-#include "src/objects/objects-inl.h"
-#include "test/unittests/compiler/compiler-test-utils.h"
-#include "test/unittests/compiler/node-test-utils.h"
-
-using ::testing::_;
-using ::testing::Eq;
-
-namespace v8 {
-namespace internal {
-namespace compiler {
-
-CodeAssemblerTestState::CodeAssemblerTestState(CodeAssemblerTest* test)
-    : CodeAssemblerState(test->isolate(), test->zone(), VoidDescriptor{},
-                         Code::STUB, "test",
-                         PoisoningMitigationLevel::kPoisonCriticalOnly) {}
-
-TARGET_TEST_F(CodeAssemblerTest, IntPtrAdd) {
-  CodeAssemblerTestState state(this);
-  CodeAssemblerForTest m(&state);
-  {
-    Node* a = m.Parameter(0);
-    TNode<IntPtrT> b = m.IntPtrConstant(1);
-    TNode<WordT> add = m.IntPtrAdd(a, b);
-    EXPECT_THAT(add, IsIntPtrAdd(Eq(a), Eq(b)));
-  }
-  // x + 0  =>  x
-  {
-    Node* a = m.Parameter(0);
-    TNode<IntPtrT> b = m.IntPtrConstant(0);
-    TNode<WordT> add = m.IntPtrAdd(a, b);
-    EXPECT_THAT(add, a);
-  }
-  // 0 + x  => x
-  {
-    Node* a = m.Parameter(0);
-    TNode<IntPtrT> b = m.IntPtrConstant(0);
-    TNode<WordT> add = m.IntPtrAdd(b, a);
-    EXPECT_THAT(add, a);
-  }
-  // CONST_a + CONST_b => CONST_c
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(22);
-    TNode<IntPtrT> b = m.IntPtrConstant(33);
-    TNode<IntPtrT> c = m.IntPtrAdd(a, b);
-    EXPECT_THAT(c, IsIntPtrConstant(55));
-  }
-}
-
-TARGET_TEST_F(CodeAssemblerTest, IntPtrSub) {
-  CodeAssemblerTestState state(this);
-  CodeAssemblerForTest m(&state);
-  {
-    Node* a = m.Parameter(0);
-    TNode<IntPtrT> b = m.IntPtrConstant(1);
-    TNode<WordT> sub = m.IntPtrSub(a, b);
-    EXPECT_THAT(sub, IsIntPtrSub(Eq(a), Eq(b)));
-  }
-  // x - 0  => x
-  {
-    Node* a = m.Parameter(0);
-    TNode<IntPtrT> b = m.IntPtrConstant(0);
-    TNode<WordT> c = m.IntPtrSub(a, b);
-    EXPECT_THAT(c, a);
-  }
-  // CONST_a - CONST_b  => CONST_c
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(100);
-    TNode<IntPtrT> b = m.IntPtrConstant(1);
-    TNode<IntPtrT> c = m.IntPtrSub(a, b);
-    EXPECT_THAT(c, IsIntPtrConstant(99));
-  }
-}
-
-TARGET_TEST_F(CodeAssemblerTest, IntPtrMul) {
-  CodeAssemblerTestState state(this);
-  CodeAssemblerForTest m(&state);
-  {
-    Node* a = m.Parameter(0);
-    TNode<IntPtrT> b = m.IntPtrConstant(100);
-    TNode<WordT> mul = m.IntPtrMul(a, b);
-    EXPECT_THAT(mul, IsIntPtrMul(Eq(a), Eq(b)));
-  }
-  // x * 1  => x
-  {
-    Node* a = m.Parameter(0);
-    TNode<IntPtrT> b = m.IntPtrConstant(1);
-    TNode<WordT> mul = m.IntPtrMul(a, b);
-    EXPECT_THAT(mul, a);
-  }
-  // 1 * x  => x
-  {
-    Node* a = m.Parameter(0);
-    TNode<IntPtrT> b = m.IntPtrConstant(1);
-    TNode<WordT> mul = m.IntPtrMul(b, a);
-    EXPECT_THAT(mul, a);
-  }
-  // CONST_a * CONST_b  => CONST_c
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(100);
-    TNode<IntPtrT> b = m.IntPtrConstant(5);
-    TNode<IntPtrT> c = m.IntPtrMul(a, b);
-    EXPECT_THAT(c, IsIntPtrConstant(500));
-  }
-  // x * 2^CONST  => x << CONST
-  {
-    Node* a = m.Parameter(0);
-    TNode<IntPtrT> b = m.IntPtrConstant(1 << 3);
-    TNode<WordT> c = m.IntPtrMul(a, b);
-    EXPECT_THAT(c, IsWordShl(a, IsIntPtrConstant(3)));
-  }
-  // 2^CONST * x  => x << CONST
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(1 << 3);
-    Node* b = m.Parameter(0);
-    TNode<WordT> c = m.IntPtrMul(a, b);
-    EXPECT_THAT(c, IsWordShl(b, IsIntPtrConstant(3)));
-  }
-}
-
-TARGET_TEST_F(CodeAssemblerTest, IntPtrDiv) {
-  CodeAssemblerTestState state(this);
-  CodeAssemblerForTest m(&state);
-  {
-    TNode<IntPtrT> a = m.UncheckedCast<IntPtrT>(m.Parameter(0));
-    TNode<IntPtrT> b = m.IntPtrConstant(100);
-    TNode<IntPtrT> div = m.IntPtrDiv(a, b);
-    EXPECT_THAT(div, IsIntPtrDiv(Matcher<Node*>(a), Matcher<Node*>(b)));
-  }
-  // x / 1  => x
-  {
-    TNode<IntPtrT> a = m.UncheckedCast<IntPtrT>(m.Parameter(0));
-    TNode<IntPtrT> b = m.IntPtrConstant(1);
-    TNode<IntPtrT> div = m.IntPtrDiv(a, b);
-    EXPECT_THAT(div, a);
-  }
-  // CONST_a / CONST_b  => CONST_c
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(100);
-    TNode<IntPtrT> b = m.IntPtrConstant(5);
-    TNode<IntPtrT> div = m.IntPtrDiv(a, b);
-    EXPECT_THAT(div, IsIntPtrConstant(20));
-  }
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(100);
-    TNode<IntPtrT> b = m.IntPtrConstant(5);
-    TNode<IntPtrT> div = m.IntPtrDiv(a, b);
-    EXPECT_THAT(div, IsIntPtrConstant(20));
-  }
-  // x / 2^CONST  => x >> CONST
-  {
-    TNode<IntPtrT> a = m.UncheckedCast<IntPtrT>(m.Parameter(0));
-    TNode<IntPtrT> b = m.IntPtrConstant(1 << 3);
-    TNode<IntPtrT> div = m.IntPtrDiv(a, b);
-    EXPECT_THAT(div, IsWordSar(Matcher<Node*>(a), IsIntPtrConstant(3)));
-  }
-}
-
-TARGET_TEST_F(CodeAssemblerTest, WordShl) {
-  CodeAssemblerTestState state(this);
-  CodeAssemblerForTest m(&state);
-  {
-    Node* a = m.Parameter(0);
-    TNode<WordT> add = m.WordShl(a, 10);
-    EXPECT_THAT(add, IsWordShl(a, IsIntPtrConstant(10)));
-  }
-  // x << 0  => x
-  {
-    Node* a = m.Parameter(0);
-    TNode<WordT> add = m.WordShl(a, 0);
-    EXPECT_THAT(add, a);
-  }
-  // CONST_a << CONST_b  => CONST_c
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(1024);
-    TNode<WordT> shl = m.WordShl(a, 2);
-    EXPECT_THAT(shl, IsIntPtrConstant(4096));
-  }
-}
-
-TARGET_TEST_F(CodeAssemblerTest, WordShr) {
-  CodeAssemblerTestState state(this);
-  CodeAssemblerForTest m(&state);
-  {
-    Node* a = m.Parameter(0);
-    TNode<WordT> shr = m.WordShr(a, 10);
-    EXPECT_THAT(shr, IsWordShr(a, IsIntPtrConstant(10)));
-  }
-  // x >> 0  => x
-  {
-    Node* a = m.Parameter(0);
-    TNode<WordT> shr = m.WordShr(a, 0);
-    EXPECT_THAT(shr, a);
-  }
-  // +CONST_a >> CONST_b  => CONST_c
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(4096);
-    TNode<IntPtrT> shr = m.WordShr(a, 2);
-    EXPECT_THAT(shr, IsIntPtrConstant(1024));
-  }
-  // -CONST_a >> CONST_b  => CONST_c
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(-1234);
-    TNode<IntPtrT> shr = m.WordShr(a, 2);
-    EXPECT_THAT(shr, IsIntPtrConstant(static_cast<uintptr_t>(-1234) >> 2));
-  }
-}
-
-TARGET_TEST_F(CodeAssemblerTest, WordSar) {
-  CodeAssemblerTestState state(this);
-  CodeAssemblerForTest m(&state);
-  {
-    Node* a = m.Parameter(0);
-    TNode<WordT> sar = m.WordSar(a, m.IntPtrConstant(10));
-    EXPECT_THAT(sar, IsWordSar(a, IsIntPtrConstant(10)));
-  }
-  // x >>> 0  => x
-  {
-    Node* a = m.Parameter(0);
-    TNode<WordT> sar = m.WordSar(a, m.IntPtrConstant(0));
-    EXPECT_THAT(sar, a);
-  }
-  // +CONST_a >>> CONST_b  => CONST_c
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(4096);
-    TNode<IntPtrT> sar = m.WordSar(a, m.IntPtrConstant(2));
-    EXPECT_THAT(sar, IsIntPtrConstant(1024));
-  }
-  // -CONST_a >>> CONST_b  => CONST_c
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(-1234);
-    TNode<IntPtrT> sar = m.WordSar(a, m.IntPtrConstant(2));
-    EXPECT_THAT(sar, IsIntPtrConstant(static_cast<intptr_t>(-1234) >> 2));
-  }
-}
-
-TARGET_TEST_F(CodeAssemblerTest, WordOr) {
-  CodeAssemblerTestState state(this);
-  CodeAssemblerForTest m(&state);
-  {
-    Node* a = m.Parameter(0);
-    TNode<WordT> z = m.WordOr(a, m.IntPtrConstant(8));
-    EXPECT_THAT(z, IsWordOr(a, IsIntPtrConstant(8)));
-  }
-  // x | 0  => x
-  {
-    Node* a = m.Parameter(0);
-    TNode<WordT> z = m.WordOr(a, m.IntPtrConstant(0));
-    EXPECT_THAT(z, a);
-  }
-  // 0 | x  => x
-  {
-    Node* a = m.Parameter(0);
-    TNode<WordT> z = m.WordOr(m.IntPtrConstant(0), a);
-    EXPECT_THAT(z, a);
-  }
-  // CONST_a | CONST_b  => CONST_c
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(3);
-    TNode<WordT> b = m.WordOr(a, m.IntPtrConstant(7));
-    EXPECT_THAT(b, IsIntPtrConstant(7));
-  }
-}
-
-TARGET_TEST_F(CodeAssemblerTest, WordAnd) {
-  CodeAssemblerTestState state(this);
-  CodeAssemblerForTest m(&state);
-  {
-    Node* a = m.Parameter(0);
-    TNode<WordT> z = m.WordAnd(a, m.IntPtrConstant(8));
-    EXPECT_THAT(z, IsWordAnd(a, IsIntPtrConstant(8)));
-  }
-  // CONST_a & CONST_b  => CONST_c
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(3);
-    TNode<IntPtrT> b = m.WordAnd(a, m.IntPtrConstant(7));
-    EXPECT_THAT(b, IsIntPtrConstant(3));
-  }
-}
-
-TARGET_TEST_F(CodeAssemblerTest, WordXor) {
-  CodeAssemblerTestState state(this);
-  CodeAssemblerForTest m(&state);
-  {
-    Node* a = m.Parameter(0);
-    TNode<WordT> z = m.WordXor(a, m.IntPtrConstant(8));
-    EXPECT_THAT(z, IsWordXor(a, IsIntPtrConstant(8)));
-  }
-  // CONST_a ^ CONST_b  => CONST_c
-  {
-    TNode<IntPtrT> a = m.IntPtrConstant(3);
-    TNode<WordT> b = m.WordXor(a, m.IntPtrConstant(7));
-    EXPECT_THAT(b, IsIntPtrConstant(4));
-  }
-}
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/code-assembler-unittest.h b/deps/v8/test/unittests/compiler/code-assembler-unittest.h
deleted file mode 100644
index 56f1959765b7f2..00000000000000
--- a/deps/v8/test/unittests/compiler/code-assembler-unittest.h
+++ /dev/null
@@ -1,37 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_UNITTESTS_COMPILER_CODE_ASSEMBLER_UNITTEST_H_
-#define V8_UNITTESTS_COMPILER_CODE_ASSEMBLER_UNITTEST_H_
-
-#include "src/compiler/code-assembler.h"
-#include "test/unittests/test-utils.h"
-#include "testing/gmock-support.h"
-
-namespace v8 {
-namespace internal {
-namespace compiler {
-
-class CodeAssemblerTest : public TestWithIsolateAndZone {
- public:
-  CodeAssemblerTest() = default;
-  ~CodeAssemblerTest() override = default;
-};
-
-class CodeAssemblerTestState : public CodeAssemblerState {
- public:
-  explicit CodeAssemblerTestState(CodeAssemblerTest* test);
-};
-
-class CodeAssemblerForTest : public CodeAssembler {
- public:
-  explicit CodeAssemblerForTest(CodeAssemblerTestState* state)
-      : CodeAssembler(state) {}
-};
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_UNITTESTS_COMPILER_CODE_ASSEMBLER_UNITTEST_H_
diff --git a/deps/v8/test/unittests/compiler/common-operator-reducer-unittest.cc b/deps/v8/test/unittests/compiler/common-operator-reducer-unittest.cc
index 690701cf569d6e..4deeef34c3697e 100644
--- a/deps/v8/test/unittests/compiler/common-operator-reducer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/common-operator-reducer-unittest.cc
@@ -29,7 +29,7 @@ class CommonOperatorReducerTest : public GraphTest {
   Reduction Reduce(
       AdvancedReducer::Editor* editor, Node* node,
       MachineOperatorBuilder::Flags flags = MachineOperatorBuilder::kNoFlags) {
-    JSHeapBroker broker(isolate(), zone(), FLAG_trace_heap_broker);
+    JSHeapBroker broker(isolate(), zone(), FLAG_trace_heap_broker, false);
     MachineOperatorBuilder machine(zone(), MachineType::PointerRepresentation(),
                                    flags);
     CommonOperatorReducer reducer(editor, graph(), &broker, common(), &machine,
diff --git a/deps/v8/test/unittests/compiler/constant-folding-reducer-unittest.cc b/deps/v8/test/unittests/compiler/constant-folding-reducer-unittest.cc
index 135e8e307f39da..dee5c56e825499 100644
--- a/deps/v8/test/unittests/compiler/constant-folding-reducer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/constant-folding-reducer-unittest.cc
@@ -63,7 +63,7 @@ class ConstantFoldingReducerTest : public TypedGraphTest {
  public:
   ConstantFoldingReducerTest()
       : TypedGraphTest(3),
-        broker_(isolate(), zone(), FLAG_trace_heap_broker),
+        broker_(isolate(), zone(), FLAG_trace_heap_broker, false),
         simplified_(zone()),
         deps_(&broker_, zone()) {}
   ~ConstantFoldingReducerTest() override = default;
diff --git a/deps/v8/test/unittests/compiler/decompression-elimination-unittest.cc b/deps/v8/test/unittests/compiler/decompression-elimination-unittest.cc
deleted file mode 100644
index fa938f76da3010..00000000000000
--- a/deps/v8/test/unittests/compiler/decompression-elimination-unittest.cc
+++ /dev/null
@@ -1,854 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/compiler/decompression-elimination.h"
-#include "src/compiler/node-properties.h"
-#include "src/compiler/simplified-operator.h"
-#include "test/unittests/compiler/graph-reducer-unittest.h"
-#include "test/unittests/compiler/graph-unittest.h"
-#include "test/unittests/compiler/node-test-utils.h"
-#include "testing/gmock-support.h"
-
-using testing::_;
-using testing::StrictMock;
-
-namespace v8 {
-namespace internal {
-namespace compiler {
-
-class DecompressionEliminationTest : public GraphTest {
- public:
-  DecompressionEliminationTest()
-      : GraphTest(),
-        machine_(zone(), MachineType::PointerRepresentation(),
-                 MachineOperatorBuilder::kNoFlags),
-        simplified_(zone()) {}
-  ~DecompressionEliminationTest() override = default;
-
- protected:
-  Reduction Reduce(StrictMock<MockAdvancedReducerEditor>* editor, Node* node) {
-    DecompressionElimination decompression_elimination(editor, graph(),
-                                                       machine(), common());
-    return decompression_elimination.Reduce(node);
-  }
-  Reduction Reduce(Node* node) {
-    StrictMock<MockAdvancedReducerEditor> editor;
-    return Reduce(&editor, node);
-  }
-  Node* GetUniqueValueUse(Node* node) {
-    Node* value_use = nullptr;
-    for (Edge edge : node->use_edges()) {
-      if (NodeProperties::IsValueEdge(edge)) {
-        if (value_use) {
-          return nullptr;
-        } else {
-          value_use = edge.from();
-        }
-      }
-    }
-    // Return the value use of node after the reduction, if there is exactly one
-    return value_use;
-  }
-
-  const Operator* DecompressionOpFromAccess(const ElementAccess access) {
-    switch (access.machine_type.representation()) {
-      case MachineRepresentation::kCompressed:
-        return machine()->ChangeCompressedToTagged();
-      case MachineRepresentation::kCompressedSigned:
-        return machine()->ChangeCompressedSignedToTaggedSigned();
-      case MachineRepresentation::kCompressedPointer:
-        return machine()->ChangeCompressedPointerToTaggedPointer();
-      default:
-        UNREACHABLE();
-    }
-  }
-
-  const Operator* CompressionOpFromAccess(const ElementAccess access) {
-    switch (access.machine_type.representation()) {
-      case MachineRepresentation::kCompressed:
-        return machine()->ChangeTaggedToCompressed();
-      case MachineRepresentation::kCompressedSigned:
-        return machine()->ChangeTaggedSignedToCompressedSigned();
-      case MachineRepresentation::kCompressedPointer:
-        return machine()->ChangeTaggedPointerToCompressedPointer();
-      default:
-        UNREACHABLE();
-    }
-  }
-
-  // 'Global' accesses used to simplify the tests.
-  ElementAccess const any_access = {kTaggedBase, kTaggedSize, Type::Any(),
-                                    MachineType::AnyCompressed(),
-                                    kNoWriteBarrier};
-  ElementAccess const signed_access = {kTaggedBase, kTaggedSize, Type::Any(),
-                                       MachineType::CompressedSigned(),
-                                       kNoWriteBarrier};
-  ElementAccess const pointer_access = {kTaggedBase, kTaggedSize, Type::Any(),
-                                        MachineType::CompressedPointer(),
-                                        kNoWriteBarrier};
-  const ElementAccess element_accesses[3] = {any_access, signed_access,
-                                             pointer_access};
-
-  MachineOperatorBuilder* machine() { return &machine_; }
-  SimplifiedOperatorBuilder* simplified() { return &simplified_; }
-
- private:
-  MachineOperatorBuilder machine_;
-  SimplifiedOperatorBuilder simplified_;
-};
-
-// -----------------------------------------------------------------------------
-// Direct Decompression & Compression.
-
-TEST_F(DecompressionEliminationTest, BasicDecompressionCompression) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-
-  // Pairs of <load, store> accesses
-  const std::pair<ElementAccess, ElementAccess> accesses[] = {
-      {any_access, any_access},        {signed_access, any_access},
-      {pointer_access, any_access},    {any_access, signed_access},
-      {signed_access, signed_access},  {any_access, pointer_access},
-      {pointer_access, pointer_access}};
-
-  for (size_t i = 0; i < arraysize(accesses); ++i) {
-    // Create the graph.
-    Node* load = graph()->NewNode(simplified()->LoadElement(accesses[i].first),
-                                  object, index, effect, control);
-    Node* change_to_tagged =
-        graph()->NewNode(DecompressionOpFromAccess(accesses[i].first), load);
-    Node* change_to_compressed = graph()->NewNode(
-        CompressionOpFromAccess(accesses[i].second), change_to_tagged);
-    effect =
-        graph()->NewNode(simplified()->StoreElement(accesses[i].second), object,
-                         index, change_to_compressed, effect, control);
-
-    // Reduce.
-    Reduction r = Reduce(change_to_compressed);
-    ASSERT_TRUE(r.Changed());
-    EXPECT_EQ(load, r.replacement());
-  }
-}
-
-// -----------------------------------------------------------------------------
-// Direct Compression & Decompression
-
-TEST_F(DecompressionEliminationTest, BasicCompressionDecompression) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-
-  // Pairs of <load, store> accesses
-  const std::pair<ElementAccess, ElementAccess> accesses[] = {
-      {any_access, any_access},        {signed_access, any_access},
-      {pointer_access, any_access},    {any_access, signed_access},
-      {signed_access, signed_access},  {any_access, pointer_access},
-      {pointer_access, pointer_access}};
-
-  for (size_t i = 0; i < arraysize(accesses); ++i) {
-    // Create the graph.
-    Node* load = graph()->NewNode(simplified()->LoadElement(accesses[i].first),
-                                  object, index, effect, control);
-    Node* change_to_compressed =
-        graph()->NewNode(CompressionOpFromAccess(accesses[i].first), load);
-    Node* change_to_tagged = graph()->NewNode(
-        DecompressionOpFromAccess(accesses[i].second), change_to_compressed);
-    effect = graph()->NewNode(simplified()->StoreElement(accesses[i].second),
-                              object, index, change_to_tagged, effect, control);
-
-    // Reduce.
-    Reduction r = Reduce(change_to_tagged);
-    ASSERT_TRUE(r.Changed());
-    EXPECT_EQ(load, r.replacement());
-  }
-}
-
-// -----------------------------------------------------------------------------
-// Compress after constant.
-
-TEST_F(DecompressionEliminationTest, CompressionAfterInt64Constant) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-
-  const int64_t constants[] = {static_cast<int64_t>(0x0000000000000000),
-                               static_cast<int64_t>(0x0000000000000001),
-                               static_cast<int64_t>(0x0000FFFFFFFF0000),
-                               static_cast<int64_t>(0x7FFFFFFFFFFFFFFF),
-                               static_cast<int64_t>(0x8000000000000000),
-                               static_cast<int64_t>(0x8000000000000001),
-                               static_cast<int64_t>(0x8000FFFFFFFF0000),
-                               static_cast<int64_t>(0x8FFFFFFFFFFFFFFF),
-                               static_cast<int64_t>(0xFFFFFFFFFFFFFFFF)};
-
-  // For every access.
-  for (size_t i = 0; i < arraysize(element_accesses); ++i) {
-    // For every Int64Constant.
-    for (size_t j = 0; j < arraysize(constants); ++j) {
-      // Create the graph.
-      Node* constant = graph()->NewNode(common()->Int64Constant(constants[j]));
-      Node* change_to_compressed = graph()->NewNode(
-          CompressionOpFromAccess(element_accesses[i]), constant);
-      effect = graph()->NewNode(simplified()->StoreElement(element_accesses[i]),
-                                object, index, change_to_compressed, effect,
-                                control);
-      // Reduce.
-      Reduction r = Reduce(change_to_compressed);
-      ASSERT_TRUE(r.Changed());
-      EXPECT_EQ(r.replacement()->opcode(), IrOpcode::kInt32Constant);
-    }
-  }
-}
-
-TEST_F(DecompressionEliminationTest, CompressionAfterHeapConstant) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-
-  const Handle<HeapNumber> heap_constants[] = {
-      factory()->NewHeapNumber(0.0),
-      factory()->NewHeapNumber(-0.0),
-      factory()->NewHeapNumber(11.2),
-      factory()->NewHeapNumber(-11.2),
-      factory()->NewHeapNumber(3.1415 + 1.4142),
-      factory()->NewHeapNumber(3.1415 - 1.4142),
-      factory()->NewHeapNumber(0x0000000000000000),
-      factory()->NewHeapNumber(0x0000000000000001),
-      factory()->NewHeapNumber(0x0000FFFFFFFF0000),
-      factory()->NewHeapNumber(0x7FFFFFFFFFFFFFFF),
-      factory()->NewHeapNumber(0x8000000000000000),
-      factory()->NewHeapNumber(0x8000000000000001),
-      factory()->NewHeapNumber(0x8000FFFFFFFF0000),
-      factory()->NewHeapNumber(0x8FFFFFFFFFFFFFFF),
-      factory()->NewHeapNumber(0xFFFFFFFFFFFFFFFF)};
-
-  // For every access.
-  for (size_t i = 0; i < arraysize(element_accesses); ++i) {
-    // For every HeapNumber.
-    for (size_t j = 0; j < arraysize(heap_constants); ++j) {
-      // Create the graph.
-      Node* constant =
-          graph()->NewNode(common()->HeapConstant(heap_constants[j]));
-      Node* change_to_compressed = graph()->NewNode(
-          CompressionOpFromAccess(element_accesses[i]), constant);
-      effect = graph()->NewNode(simplified()->StoreElement(element_accesses[i]),
-                                object, index, change_to_compressed, effect,
-                                control);
-      // Reduce.
-      Reduction r = Reduce(change_to_compressed);
-      ASSERT_TRUE(r.Changed());
-      EXPECT_EQ(r.replacement()->opcode(), IrOpcode::kCompressedHeapConstant);
-    }
-  }
-}
-
-// -----------------------------------------------------------------------------
-// Phi.
-
-TEST_F(DecompressionEliminationTest, PhiOneDecompress) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-  const int number_of_inputs = 1;
-
-  // For every access.
-  for (size_t i = 0; i < arraysize(element_accesses); ++i) {
-    // Create the graph.
-    Node* load =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* change_to_tagged =
-        graph()->NewNode(DecompressionOpFromAccess(element_accesses[i]), load);
-    Node* phi = graph()->NewNode(
-        common()->Phi(MachineRepresentation::kTagged, number_of_inputs),
-        change_to_tagged, control);
-
-    // Reduce.
-    StrictMock<MockAdvancedReducerEditor> editor;
-    EXPECT_CALL(editor, ReplaceWithValue(phi, _, _, _));
-    Reduction r = Reduce(&editor, phi);
-    ASSERT_TRUE(r.Changed());
-
-    // Get the actual decompress after the Phi, and check against the expected
-    // one.
-    Node* decompress = GetUniqueValueUse(phi);
-    EXPECT_EQ(DecompressionOpFromAccess(element_accesses[i]), decompress->op());
-  }
-}
-
-TEST_F(DecompressionEliminationTest, PhiThreeDecompressSameRepresentation) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-  const int number_of_inputs = 3;
-
-  // For every access.
-  for (size_t i = 0; i < arraysize(element_accesses); ++i) {
-    // Create the graph.
-    Node* load1 =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* load2 =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* load3 =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* change_to_tagged_1 =
-        graph()->NewNode(DecompressionOpFromAccess(element_accesses[i]), load1);
-    Node* change_to_tagged_2 =
-        graph()->NewNode(DecompressionOpFromAccess(element_accesses[i]), load2);
-    Node* change_to_tagged_3 =
-        graph()->NewNode(DecompressionOpFromAccess(element_accesses[i]), load3);
-
-    Node* phi = graph()->NewNode(
-        common()->Phi(MachineRepresentation::kTagged, number_of_inputs),
-        change_to_tagged_1, change_to_tagged_2, change_to_tagged_3, control);
-
-    // Reduce.
-    StrictMock<MockAdvancedReducerEditor> editor;
-    EXPECT_CALL(editor, ReplaceWithValue(phi, _, _, _));
-    Reduction r = Reduce(&editor, phi);
-    ASSERT_TRUE(r.Changed());
-
-    // Get the actual decompress after the Phi, and check against the expected
-    // one.
-    Node* decompress = GetUniqueValueUse(phi);
-    EXPECT_EQ(DecompressionOpFromAccess(element_accesses[i]), decompress->op());
-  }
-}
-
-TEST_F(DecompressionEliminationTest, PhiThreeDecompressOneAnyRepresentation) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-  const int number_of_inputs = 3;
-
-  // Signed and Pointer (and not Any) accesses.
-  const ElementAccess not_any_accesses[] = {signed_access, pointer_access};
-
-  // For every access.
-  for (size_t i = 0; i < arraysize(not_any_accesses); ++i) {
-    // Create the graph.
-    Node* load1 =
-        graph()->NewNode(simplified()->LoadElement(not_any_accesses[i]), object,
-                         index, effect, control);
-    Node* load2 =
-        graph()->NewNode(simplified()->LoadElement(not_any_accesses[i]), object,
-                         index, effect, control);
-    // Note that load3 loads a CompressedAny instead of not_any_accesses[i]
-    Node* load3 = graph()->NewNode(simplified()->LoadElement(any_access),
-                                   object, index, effect, control);
-    Node* change_to_tagged_1 =
-        graph()->NewNode(DecompressionOpFromAccess(not_any_accesses[i]), load1);
-    Node* change_to_tagged_2 =
-        graph()->NewNode(DecompressionOpFromAccess(not_any_accesses[i]), load2);
-    Node* change_to_tagged_3 =
-        graph()->NewNode(machine()->ChangeCompressedToTagged(), load3);
-
-    Node* phi = graph()->NewNode(
-        common()->Phi(MachineRepresentation::kTagged, number_of_inputs),
-        change_to_tagged_1, change_to_tagged_2, change_to_tagged_3, control);
-
-    // Reduce.
-    StrictMock<MockAdvancedReducerEditor> editor;
-    EXPECT_CALL(editor, ReplaceWithValue(phi, _, _, _));
-    Reduction r = Reduce(&editor, phi);
-    ASSERT_TRUE(r.Changed());
-
-    // Get the actual decompress after the Phi, and check against the expected
-    // one.
-    Node* decompress = GetUniqueValueUse(phi);
-    EXPECT_EQ(machine()->ChangeCompressedToTagged(), decompress->op());
-  }
-}
-
-TEST_F(DecompressionEliminationTest, PhiThreeInputsOneNotDecompressed) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-  const int number_of_inputs = 3;
-
-  // For every access.
-  for (size_t i = 0; i < arraysize(element_accesses); ++i) {
-    // Create the graph.
-    Node* load1 =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* load2 =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* load3 =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* change_to_tagged_1 =
-        graph()->NewNode(DecompressionOpFromAccess(element_accesses[i]), load1);
-    Node* change_to_tagged_2 =
-        graph()->NewNode(DecompressionOpFromAccess(element_accesses[i]), load2);
-
-    Node* phi = graph()->NewNode(
-        common()->Phi(MachineRepresentation::kTagged, number_of_inputs),
-        change_to_tagged_1, change_to_tagged_2, load3, control);
-
-    // Reduce.
-    Reduction r = Reduce(phi);
-    ASSERT_FALSE(r.Changed());
-  }
-}
-
-// In the case of having one decompress Signed and one Pointer, we have to
-// generate the conservative decompress any after the Phi.
-TEST_F(DecompressionEliminationTest, PhiTwoDecompressesOneSignedOnePointer) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-  const int number_of_inputs = 2;
-
-  // Create the graph.
-  Node* load1 = graph()->NewNode(simplified()->LoadElement(signed_access),
-                                 object, index, effect, control);
-  Node* load2 = graph()->NewNode(simplified()->LoadElement(pointer_access),
-                                 object, index, effect, control);
-  Node* change_to_tagged_1 =
-      graph()->NewNode(DecompressionOpFromAccess(signed_access), load1);
-  Node* change_to_tagged_2 =
-      graph()->NewNode(DecompressionOpFromAccess(pointer_access), load2);
-
-  Node* phi = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTagged, number_of_inputs),
-      change_to_tagged_1, change_to_tagged_2, control);
-
-  // Reduce.
-  StrictMock<MockAdvancedReducerEditor> editor;
-  EXPECT_CALL(editor, ReplaceWithValue(phi, _, _, _));
-  Reduction r = Reduce(&editor, phi);
-  ASSERT_TRUE(r.Changed());
-
-  // Get the actual decompress after the Phi, and check against the expected
-  // one.
-  Node* decompress = GetUniqueValueUse(phi);
-  EXPECT_EQ(machine()->ChangeCompressedToTagged(), decompress->op());
-}
-
-// -----------------------------------------------------------------------------
-// TypedStateValues.
-
-TEST_F(DecompressionEliminationTest, TypedStateValuesOneDecompress) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-  const int number_of_inputs = 1;
-  const ZoneVector<MachineType>* types =
-      new (graph()->zone()->New(sizeof(ZoneVector<MachineType>)))
-          ZoneVector<MachineType>(number_of_inputs, graph()->zone());
-  SparseInputMask dense = SparseInputMask::Dense();
-
-  // For every access.
-  for (size_t i = 0; i < arraysize(element_accesses); ++i) {
-    // Create the graph.
-    Node* load =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* change_to_tagged =
-        graph()->NewNode(DecompressionOpFromAccess(element_accesses[i]), load);
-    Node* typedStateValues = graph()->NewNode(
-        common()->TypedStateValues(types, dense), change_to_tagged);
-
-    // Reduce.
-    StrictMock<MockAdvancedReducerEditor> editor;
-    DecompressionElimination decompression_elimination(&editor, graph(),
-                                                       machine(), common());
-    Reduction r = decompression_elimination.Reduce(typedStateValues);
-    ASSERT_TRUE(r.Changed());
-    EXPECT_EQ(r.replacement()->InputAt(0), load);
-  }
-}
-
-TEST_F(DecompressionEliminationTest, TypedStateValuesTwoDecompresses) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-  const int number_of_inputs = 3;
-  const ZoneVector<MachineType>* types =
-      new (graph()->zone()->New(sizeof(ZoneVector<MachineType>)))
-          ZoneVector<MachineType>(number_of_inputs, graph()->zone());
-  SparseInputMask dense = SparseInputMask::Dense();
-
-  // For every access.
-  for (size_t i = 0; i < arraysize(element_accesses); ++i) {
-    // Create the graph.
-    Node* load1 =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* change_to_tagged_1 =
-        graph()->NewNode(DecompressionOpFromAccess(element_accesses[i]), load1);
-    Node* load2 =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* change_to_tagged_2 =
-        graph()->NewNode(DecompressionOpFromAccess(element_accesses[i]), load2);
-    Node* typedStateValues =
-        graph()->NewNode(common()->TypedStateValues(types, dense),
-                         change_to_tagged_1, load1, change_to_tagged_2);
-
-    // Reduce.
-    StrictMock<MockAdvancedReducerEditor> editor;
-    DecompressionElimination decompression_elimination(&editor, graph(),
-                                                       machine(), common());
-    Reduction r = decompression_elimination.Reduce(typedStateValues);
-    ASSERT_TRUE(r.Changed());
-    EXPECT_EQ(r.replacement()->InputAt(0), load1);
-    // Note that the input at index 1 didn't change.
-    EXPECT_EQ(r.replacement()->InputAt(1), load1);
-    EXPECT_EQ(r.replacement()->InputAt(2), load2);
-  }
-}
-
-TEST_F(DecompressionEliminationTest, TypedStateValuesAllDecompresses) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-  const int number_of_inputs = 3;
-  const ZoneVector<MachineType>* types =
-      new (graph()->zone()->New(sizeof(ZoneVector<MachineType>)))
-          ZoneVector<MachineType>(number_of_inputs, graph()->zone());
-  SparseInputMask dense = SparseInputMask::Dense();
-
-  // For every access.
-  for (size_t i = 0; i < arraysize(element_accesses); ++i) {
-    // Create the graph.
-    Node* load1 =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* change_to_tagged_1 =
-        graph()->NewNode(DecompressionOpFromAccess(element_accesses[i]), load1);
-    Node* load2 =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* change_to_tagged_2 =
-        graph()->NewNode(DecompressionOpFromAccess(element_accesses[i]), load2);
-    Node* load3 =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* change_to_tagged_3 =
-        graph()->NewNode(DecompressionOpFromAccess(element_accesses[i]), load3);
-    Node* typedStateValues = graph()->NewNode(
-        common()->TypedStateValues(types, dense), change_to_tagged_1,
-        change_to_tagged_2, change_to_tagged_3);
-
-    // Reduce.
-    StrictMock<MockAdvancedReducerEditor> editor;
-    DecompressionElimination decompression_elimination(&editor, graph(),
-                                                       machine(), common());
-    Reduction r = decompression_elimination.Reduce(typedStateValues);
-    ASSERT_TRUE(r.Changed());
-    EXPECT_EQ(r.replacement()->InputAt(0), load1);
-    EXPECT_EQ(r.replacement()->InputAt(1), load2);
-    EXPECT_EQ(r.replacement()->InputAt(2), load3);
-  }
-}
-
-TEST_F(DecompressionEliminationTest, TypedStateValuesNoDecompresses) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-  const int number_of_inputs = 3;
-  const ZoneVector<MachineType>* types =
-      new (graph()->zone()->New(sizeof(ZoneVector<MachineType>)))
-          ZoneVector<MachineType>(number_of_inputs, graph()->zone());
-  SparseInputMask dense = SparseInputMask::Dense();
-
-  // For every access.
-  for (size_t i = 0; i < arraysize(element_accesses); ++i) {
-    // Create the graph.
-    Node* load =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* typedStateValues = graph()->NewNode(
-        common()->TypedStateValues(types, dense), load, load, load);
-
-    // Reduce.
-    StrictMock<MockAdvancedReducerEditor> editor;
-    DecompressionElimination decompression_elimination(&editor, graph(),
-                                                       machine(), common());
-    Reduction r = decompression_elimination.Reduce(typedStateValues);
-    ASSERT_FALSE(r.Changed());
-  }
-}
-
-// -----------------------------------------------------------------------------
-// Word64Equal comparison of two decompressions.
-
-TEST_F(DecompressionEliminationTest, TwoDecompressionWord64Equal) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-
-  // For every decompression (lhs).
-  for (size_t i = 0; i < arraysize(element_accesses); ++i) {
-    // For every decompression (rhs)
-    for (size_t j = 0; j < arraysize(element_accesses); ++j) {
-      // Create the graph.
-      Node* load1 =
-          graph()->NewNode(simplified()->LoadElement(element_accesses[i]),
-                           object, index, effect, control);
-      Node* change_to_tagged_1 = graph()->NewNode(
-          DecompressionOpFromAccess(element_accesses[i]), load1);
-      Node* load2 =
-          graph()->NewNode(simplified()->LoadElement(element_accesses[j]),
-                           object, index, effect, control);
-      Node* change_to_tagged_2 = graph()->NewNode(
-          DecompressionOpFromAccess(element_accesses[i]), load2);
-      Node* comparison = graph()->NewNode(
-          machine()->Word64Equal(), change_to_tagged_1, change_to_tagged_2);
-      // Reduce.
-      Reduction r = Reduce(comparison);
-      ASSERT_TRUE(r.Changed());
-      EXPECT_EQ(r.replacement()->opcode(), IrOpcode::kWord32Equal);
-    }
-  }
-}
-
-// -----------------------------------------------------------------------------
-// Word64Equal comparison of two decompressions, where lhs == rhs.
-
-TEST_F(DecompressionEliminationTest, TwoDecompressionWord64EqualSameInput) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-
-  // For every access. (same for lhs and rhs)
-  for (size_t i = 0; i < arraysize(element_accesses); ++i) {
-    // Create the graph.
-    Node* load =
-        graph()->NewNode(simplified()->LoadElement(element_accesses[i]), object,
-                         index, effect, control);
-    Node* change_to_tagged =
-        graph()->NewNode(DecompressionOpFromAccess(element_accesses[i]), load);
-    Node* comparison = graph()->NewNode(machine()->Word64Equal(),
-                                        change_to_tagged, change_to_tagged);
-    // Reduce.
-    Reduction r = Reduce(comparison);
-    ASSERT_TRUE(r.Changed());
-    EXPECT_EQ(r.replacement()->opcode(), IrOpcode::kWord32Equal);
-  }
-}
-
-// -----------------------------------------------------------------------------
-// Word64Equal comparison of decompress and a constant.
-
-TEST_F(DecompressionEliminationTest, DecompressionConstantWord64Equal) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-
-  const int64_t constants[] = {static_cast<int64_t>(0x0000000000000000),
-                               static_cast<int64_t>(0x0000000000000001),
-                               static_cast<int64_t>(0x0000FFFFFFFF0000),
-                               static_cast<int64_t>(0x7FFFFFFFFFFFFFFF),
-                               static_cast<int64_t>(0x8000000000000000),
-                               static_cast<int64_t>(0x8000000000000001),
-                               static_cast<int64_t>(0x8000FFFFFFFF0000),
-                               static_cast<int64_t>(0x8FFFFFFFFFFFFFFF),
-                               static_cast<int64_t>(0xFFFFFFFFFFFFFFFF)};
-
-  // For every decompression (lhs).
-  for (size_t i = 0; i < arraysize(element_accesses); ++i) {
-    // For every constant (rhs).
-    for (size_t j = 0; j < arraysize(constants); ++j) {
-      // Test with both (lhs, rhs) combinations.
-      for (bool lhs_is_decompression : {false, true}) {
-        // Create the graph.
-        Node* load =
-            graph()->NewNode(simplified()->LoadElement(element_accesses[i]),
-                             object, index, effect, control);
-        Node* change_to_tagged = graph()->NewNode(
-            DecompressionOpFromAccess(element_accesses[i]), load);
-        Node* constant =
-            graph()->NewNode(common()->Int64Constant(constants[j]));
-
-        Node* lhs = lhs_is_decompression ? change_to_tagged : constant;
-        Node* rhs = lhs_is_decompression ? constant : change_to_tagged;
-        Node* comparison = graph()->NewNode(machine()->Word64Equal(), lhs, rhs);
-        // Reduce.
-        Reduction r = Reduce(comparison);
-        ASSERT_TRUE(r.Changed());
-        EXPECT_EQ(r.replacement()->opcode(), IrOpcode::kWord32Equal);
-      }
-    }
-  }
-}
-
-TEST_F(DecompressionEliminationTest, DecompressionHeapConstantWord64Equal) {
-  // Skip test if pointer compression is not enabled.
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-
-  // Define variables.
-  Node* const control = graph()->start();
-  Node* object = Parameter(Type::Any(), 0);
-  Node* effect = graph()->start();
-  Node* index = Parameter(Type::UnsignedSmall(), 1);
-
-  const Handle<HeapNumber> heap_constants[] = {
-      factory()->NewHeapNumber(0.0),
-      factory()->NewHeapNumber(-0.0),
-      factory()->NewHeapNumber(11.2),
-      factory()->NewHeapNumber(-11.2),
-      factory()->NewHeapNumber(3.1415 + 1.4142),
-      factory()->NewHeapNumber(3.1415 - 1.4142),
-      factory()->NewHeapNumber(0x0000000000000000),
-      factory()->NewHeapNumber(0x0000000000000001),
-      factory()->NewHeapNumber(0x0000FFFFFFFF0000),
-      factory()->NewHeapNumber(0x7FFFFFFFFFFFFFFF),
-      factory()->NewHeapNumber(0x8000000000000000),
-      factory()->NewHeapNumber(0x8000000000000001),
-      factory()->NewHeapNumber(0x8000FFFFFFFF0000),
-      factory()->NewHeapNumber(0x8FFFFFFFFFFFFFFF),
-      factory()->NewHeapNumber(0xFFFFFFFFFFFFFFFF)};
-
-  // For every decompression (lhs).
-  for (size_t i = 0; i < arraysize(element_accesses); ++i) {
-    // For every constant (rhs).
-    for (size_t j = 0; j < arraysize(heap_constants); ++j) {
-      // Test with both (lhs, rhs) combinations.
-      for (bool lhs_is_decompression : {false, true}) {
-        // Create the graph.
-        Node* load =
-            graph()->NewNode(simplified()->LoadElement(element_accesses[i]),
-                             object, index, effect, control);
-        Node* change_to_tagged = graph()->NewNode(
-            DecompressionOpFromAccess(element_accesses[i]), load);
-        Node* constant =
-            graph()->NewNode(common()->HeapConstant(heap_constants[j]));
-
-        Node* lhs = lhs_is_decompression ? change_to_tagged : constant;
-        Node* rhs = lhs_is_decompression ? constant : change_to_tagged;
-        Node* comparison = graph()->NewNode(machine()->Word64Equal(), lhs, rhs);
-        // Reduce.
-        Reduction r = Reduce(comparison);
-        ASSERT_TRUE(r.Changed());
-        EXPECT_EQ(r.replacement()->opcode(), IrOpcode::kWord32Equal);
-      }
-    }
-  }
-}
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/decompression-optimizer-unittest.cc b/deps/v8/test/unittests/compiler/decompression-optimizer-unittest.cc
new file mode 100644
index 00000000000000..46122ff1a4be63
--- /dev/null
+++ b/deps/v8/test/unittests/compiler/decompression-optimizer-unittest.cc
@@ -0,0 +1,494 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/decompression-optimizer.h"
+
+#include "test/unittests/compiler/graph-unittest.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+class DecompressionOptimizerTest : public GraphTest {
+ public:
+  DecompressionOptimizerTest()
+      : GraphTest(),
+        machine_(zone(), MachineType::PointerRepresentation(),
+                 MachineOperatorBuilder::kNoFlags) {}
+  ~DecompressionOptimizerTest() override = default;
+
+ protected:
+  void Reduce() {
+    DecompressionOptimizer decompression_optimizer(zone(), graph(), common(),
+                                                   machine());
+    decompression_optimizer.Reduce();
+  }
+
+  MachineRepresentation CompressedMachRep(MachineRepresentation mach_rep) {
+    if (mach_rep == MachineRepresentation::kTagged) {
+      return MachineRepresentation::kCompressed;
+    } else {
+      DCHECK_EQ(mach_rep, MachineRepresentation::kTaggedPointer);
+      return MachineRepresentation::kCompressedPointer;
+    }
+  }
+
+  MachineRepresentation CompressedMachRep(MachineType type) {
+    return CompressedMachRep(type.representation());
+  }
+
+  MachineRepresentation LoadMachRep(Node* node) {
+    return LoadRepresentationOf(node->op()).representation();
+  }
+  StoreRepresentation CreateStoreRep(MachineType type) {
+    return StoreRepresentation(type.representation(),
+                               WriteBarrierKind::kFullWriteBarrier);
+  }
+
+  const MachineType types[2] = {MachineType::AnyTagged(),
+                                MachineType::TaggedPointer()};
+
+  const Handle<HeapNumber> heap_constants[15] = {
+      factory()->NewHeapNumber(0.0),
+      factory()->NewHeapNumber(-0.0),
+      factory()->NewHeapNumber(11.2),
+      factory()->NewHeapNumber(-11.2),
+      factory()->NewHeapNumber(3.1415 + 1.4142),
+      factory()->NewHeapNumber(3.1415 - 1.4142),
+      factory()->NewHeapNumber(0x0000000000000000),
+      factory()->NewHeapNumber(0x0000000000000001),
+      factory()->NewHeapNumber(0x0000FFFFFFFF0000),
+      factory()->NewHeapNumber(0x7FFFFFFFFFFFFFFF),
+      factory()->NewHeapNumber(0x8000000000000000),
+      factory()->NewHeapNumber(0x8000000000000001),
+      factory()->NewHeapNumber(0x8000FFFFFFFF0000),
+      factory()->NewHeapNumber(0x8FFFFFFFFFFFFFFF),
+      factory()->NewHeapNumber(0xFFFFFFFFFFFFFFFF)};
+
+  MachineOperatorBuilder* machine() { return &machine_; }
+
+ private:
+  MachineOperatorBuilder machine_;
+};
+
+// -----------------------------------------------------------------------------
+// Direct Load into Store.
+
+TEST_F(DecompressionOptimizerTest, DirectLoadStore) {
+  // Define variables.
+  Node* const control = graph()->start();
+  Node* object = Parameter(Type::Any(), 0);
+  Node* effect = graph()->start();
+  Node* index = Parameter(Type::UnsignedSmall(), 1);
+
+  // Test for both AnyTagged and TaggedPointer.
+  for (size_t i = 0; i < arraysize(types); ++i) {
+    // Create the graph.
+    Node* base_pointer = graph()->NewNode(machine()->Load(types[i]), object,
+                                          index, effect, control);
+    Node* value = graph()->NewNode(machine()->Load(types[i]), base_pointer,
+                                   index, effect, control);
+    graph()->SetEnd(graph()->NewNode(machine()->Store(CreateStoreRep(types[i])),
+                                     object, index, value, effect, control));
+
+    // Change the nodes, and test the change.
+    Reduce();
+    EXPECT_EQ(LoadMachRep(base_pointer), types[i].representation());
+    EXPECT_EQ(LoadMachRep(value), CompressedMachRep(types[i]));
+  }
+}
+
+// -----------------------------------------------------------------------------
+// Word32 Operations.
+
+TEST_F(DecompressionOptimizerTest, Word32EqualTwoDecompresses) {
+  // Define variables.
+  Node* const control = graph()->start();
+  Node* object = Parameter(Type::Any(), 0);
+  Node* effect = graph()->start();
+  Node* index = Parameter(Type::UnsignedSmall(), 1);
+
+  // Test for both AnyTagged and TaggedPointer, for both loads.
+  for (size_t i = 0; i < arraysize(types); ++i) {
+    for (size_t j = 0; j < arraysize(types); ++j) {
+      // Create the graph.
+      Node* load_1 = graph()->NewNode(machine()->Load(types[i]), object, index,
+                                      effect, control);
+      Node* load_2 = graph()->NewNode(machine()->Load(types[j]), object, index,
+                                      effect, control);
+      Node* equal = graph()->NewNode(machine()->Word32Equal(), load_1, load_2);
+      graph()->SetEnd(equal);
+
+      // Change the nodes, and test the change.
+      Reduce();
+      EXPECT_EQ(LoadMachRep(load_1), CompressedMachRep(types[i]));
+      EXPECT_EQ(LoadMachRep(load_2), CompressedMachRep(types[j]));
+    }
+  }
+}
+
+TEST_F(DecompressionOptimizerTest, Word32EqualDecompressAndConstant) {
+  // Define variables.
+  Node* const control = graph()->start();
+  Node* object = Parameter(Type::Any(), 0);
+  Node* effect = graph()->start();
+  Node* index = Parameter(Type::UnsignedSmall(), 1);
+
+  // Test for both AnyTagged and TaggedPointer.
+  for (size_t i = 0; i < arraysize(types); ++i) {
+    for (size_t j = 0; j < arraysize(heap_constants); ++j) {
+      // Create the graph.
+      Node* load = graph()->NewNode(machine()->Load(types[i]), object, index,
+                                    effect, control);
+      Node* constant =
+          graph()->NewNode(common()->HeapConstant(heap_constants[j]));
+      Node* equal = graph()->NewNode(machine()->Word32Equal(), load, constant);
+      graph()->SetEnd(equal);
+
+      // Change the nodes, and test the change.
+      Reduce();
+      EXPECT_EQ(LoadMachRep(load), CompressedMachRep(types[i]));
+      EXPECT_EQ(constant->opcode(), IrOpcode::kCompressedHeapConstant);
+    }
+  }
+}
+
+TEST_F(DecompressionOptimizerTest, Word32AndSmiCheck) {
+  // Define variables.
+  Node* const control = graph()->start();
+  Node* object = Parameter(Type::Any(), 0);
+  Node* effect = graph()->start();
+  Node* index = Parameter(Type::UnsignedSmall(), 1);
+
+  // Test for both AnyTagged and TaggedPointer.
+  for (size_t i = 0; i < arraysize(types); ++i) {
+    // Create the graph.
+    Node* load = graph()->NewNode(machine()->Load(types[i]), object, index,
+                                  effect, control);
+    Node* smi_tag_mask = graph()->NewNode(common()->Int32Constant(kSmiTagMask));
+    Node* word32_and =
+        graph()->NewNode(machine()->Word32And(), load, smi_tag_mask);
+    Node* smi_tag = graph()->NewNode(common()->Int32Constant(kSmiTag));
+    graph()->SetEnd(
+        graph()->NewNode(machine()->Word32Equal(), word32_and, smi_tag));
+    // Change the nodes, and test the change.
+    Reduce();
+    EXPECT_EQ(LoadMachRep(load), CompressedMachRep(types[i]));
+  }
+}
+
+TEST_F(DecompressionOptimizerTest, Word32ShlSmiTag) {
+  // Define variables.
+  Node* const control = graph()->start();
+  Node* object = Parameter(Type::Any(), 0);
+  Node* effect = graph()->start();
+  Node* index = Parameter(Type::UnsignedSmall(), 1);
+
+  // Test only for AnyTagged, since TaggedPointer can't be Smi tagged.
+  // Create the graph.
+  Node* load = graph()->NewNode(machine()->Load(MachineType::AnyTagged()),
+                                object, index, effect, control);
+  Node* smi_shift_bits =
+      graph()->NewNode(common()->Int32Constant(kSmiShiftSize + kSmiTagSize));
+  Node* word32_shl =
+      graph()->NewNode(machine()->Word32Shl(), load, smi_shift_bits);
+  graph()->SetEnd(
+      graph()->NewNode(machine()->BitcastWord32ToWord64(), word32_shl));
+  // Change the nodes, and test the change.
+  Reduce();
+  EXPECT_EQ(LoadMachRep(load), CompressedMachRep(MachineType::AnyTagged()));
+}
+
+TEST_F(DecompressionOptimizerTest, Word32SarSmiUntag) {
+  // Define variables.
+  Node* const control = graph()->start();
+  Node* object = Parameter(Type::Any(), 0);
+  Node* effect = graph()->start();
+  Node* index = Parameter(Type::UnsignedSmall(), 1);
+
+  // Test only for AnyTagged, since TaggedPointer can't be Smi tagged.
+  // Create the graph.
+  Node* load = graph()->NewNode(machine()->Load(MachineType::AnyTagged()),
+                                object, index, effect, control);
+  Node* truncation = graph()->NewNode(machine()->TruncateInt64ToInt32(), load);
+  Node* smi_shift_bits =
+      graph()->NewNode(common()->Int32Constant(kSmiShiftSize + kSmiTagSize));
+  Node* word32_sar =
+      graph()->NewNode(machine()->Word32Sar(), truncation, smi_shift_bits);
+  graph()->SetEnd(
+      graph()->NewNode(machine()->ChangeInt32ToInt64(), word32_sar));
+  // Change the nodes, and test the change.
+  Reduce();
+  EXPECT_EQ(LoadMachRep(load), CompressedMachRep(MachineType::AnyTagged()));
+}
+
+// -----------------------------------------------------------------------------
+// FrameState and TypedStateValues interaction.
+
+TEST_F(DecompressionOptimizerTest, TypedStateValues) {
+  // Define variables.
+  Node* const control = graph()->start();
+  Node* object = Parameter(Type::Any(), 0);
+  Node* effect = graph()->start();
+  Node* index = Parameter(Type::UnsignedSmall(), 1);
+  const int number_of_inputs = 2;
+  const ZoneVector<MachineType>* types_for_state_values =
+      new (graph()->zone()->New(sizeof(ZoneVector<MachineType>)))
+          ZoneVector<MachineType>(number_of_inputs, graph()->zone());
+  SparseInputMask dense = SparseInputMask::Dense();
+
+  // Test for both AnyTagged and TaggedPointer.
+  for (size_t i = 0; i < arraysize(types); ++i) {
+    for (size_t j = 0; j < arraysize(heap_constants); ++j) {
+      // Create the graph.
+      Node* load = graph()->NewNode(machine()->Load(types[i]), object, index,
+                                    effect, control);
+      Node* constant_1 =
+          graph()->NewNode(common()->HeapConstant(heap_constants[j]));
+      Node* typed_state_values = graph()->NewNode(
+          common()->TypedStateValues(types_for_state_values, dense), load,
+          constant_1);
+      Node* constant_2 =
+          graph()->NewNode(common()->HeapConstant(heap_constants[j]));
+      graph()->SetEnd(graph()->NewNode(
+          common()->FrameState(BailoutId::None(),
+                               OutputFrameStateCombine::Ignore(), nullptr),
+          typed_state_values, typed_state_values, typed_state_values,
+          constant_2, UndefinedConstant(), graph()->start()));
+
+      // Change the nodes, and test the change.
+      Reduce();
+      EXPECT_EQ(LoadMachRep(load), CompressedMachRep(types[i]));
+      EXPECT_EQ(constant_1->opcode(), IrOpcode::kCompressedHeapConstant);
+      EXPECT_EQ(constant_2->opcode(), IrOpcode::kCompressedHeapConstant);
+    }
+  }
+}
+
+// -----------------------------------------------------------------------------
+// Phi
+
+TEST_F(DecompressionOptimizerTest, PhiDecompressOrNot) {
+  // Define variables.
+  Node* const control = graph()->start();
+  Node* object = Parameter(Type::Any(), 0);
+  Node* effect = graph()->start();
+  Node* index = Parameter(Type::UnsignedSmall(), 1);
+  const int number_of_inputs = 2;
+
+  // Test for both AnyTagged and TaggedPointer.
+  for (size_t i = 0; i < arraysize(types); ++i) {
+    for (size_t j = 0; j < arraysize(heap_constants); ++j) {
+      // Create the graph.
+      // Base pointer
+      Node* load_1 = graph()->NewNode(machine()->Load(types[i]), object, index,
+                                      effect, control);
+      Node* constant_1 =
+          graph()->NewNode(common()->HeapConstant(heap_constants[j]));
+      Node* phi_1 = graph()->NewNode(
+          common()->Phi(types[i].representation(), number_of_inputs), load_1,
+          constant_1, control);
+
+      // Value
+      Node* load_2 = graph()->NewNode(machine()->Load(types[i]), object, index,
+                                      effect, control);
+      Node* constant_2 =
+          graph()->NewNode(common()->HeapConstant(heap_constants[j]));
+      Node* phi_2 = graph()->NewNode(
+          common()->Phi(types[i].representation(), number_of_inputs), load_2,
+          constant_2, control);
+
+      graph()->SetEnd(
+          graph()->NewNode(machine()->Store(CreateStoreRep(types[i])), phi_1,
+                           index, phi_2, effect, control));
+
+      // Change the nodes, and test the change.
+      Reduce();
+      // Base pointer should not be compressed.
+      EXPECT_EQ(LoadMachRep(load_1), types[i].representation());
+      EXPECT_EQ(constant_1->opcode(), IrOpcode::kHeapConstant);
+      EXPECT_EQ(PhiRepresentationOf(phi_1->op()), types[i].representation());
+      // Value should be compressed.
+      EXPECT_EQ(LoadMachRep(load_2), CompressedMachRep(types[i]));
+      EXPECT_EQ(constant_2->opcode(), IrOpcode::kCompressedHeapConstant);
+      EXPECT_EQ(PhiRepresentationOf(phi_2->op()), CompressedMachRep(types[i]));
+    }
+  }
+}
+
+TEST_F(DecompressionOptimizerTest, CascadingPhi) {
+  // Define variables.
+  Node* const control = graph()->start();
+  Node* object = Parameter(Type::Any(), 0);
+  Node* effect = graph()->start();
+  Node* index = Parameter(Type::UnsignedSmall(), 1);
+  const int number_of_inputs = 2;
+
+  // Test for both AnyTagged and TaggedPointer.
+  for (size_t i = 0; i < arraysize(types); ++i) {
+    // Create the graph.
+    Node* load_1 = graph()->NewNode(machine()->Load(types[i]), object, index,
+                                    effect, control);
+    Node* load_2 = graph()->NewNode(machine()->Load(types[i]), object, index,
+                                    effect, control);
+    Node* load_3 = graph()->NewNode(machine()->Load(types[i]), object, index,
+                                    effect, control);
+    Node* load_4 = graph()->NewNode(machine()->Load(types[i]), object, index,
+                                    effect, control);
+
+    Node* phi_1 = graph()->NewNode(
+        common()->Phi(types[i].representation(), number_of_inputs), load_1,
+        load_2, control);
+    Node* phi_2 = graph()->NewNode(
+        common()->Phi(types[i].representation(), number_of_inputs), load_3,
+        load_4, control);
+
+    Node* final_phi = graph()->NewNode(
+        common()->Phi(types[i].representation(), number_of_inputs), phi_1,
+        phi_2, control);
+
+    // Value
+    graph()->SetEnd(final_phi);
+    // Change the nodes, and test the change.
+    Reduce();
+    // Loads are all compressed
+    EXPECT_EQ(LoadMachRep(load_1), CompressedMachRep(types[i]));
+    EXPECT_EQ(LoadMachRep(load_2), CompressedMachRep(types[i]));
+    EXPECT_EQ(LoadMachRep(load_3), CompressedMachRep(types[i]));
+    EXPECT_EQ(LoadMachRep(load_4), CompressedMachRep(types[i]));
+    // Phis too
+    EXPECT_EQ(PhiRepresentationOf(phi_1->op()), CompressedMachRep(types[i]));
+    EXPECT_EQ(PhiRepresentationOf(phi_2->op()), CompressedMachRep(types[i]));
+    EXPECT_EQ(PhiRepresentationOf(final_phi->op()),
+              CompressedMachRep(types[i]));
+  }
+}
+
+TEST_F(DecompressionOptimizerTest, PhiWithOneCompressedAndOneTagged) {
+  // Define variables.
+  Node* const control = graph()->start();
+  Node* object = Parameter(Type::Any(), 0);
+  Node* effect = graph()->start();
+  Node* index = Parameter(Type::UnsignedSmall(), 1);
+  const int number_of_inputs = 2;
+
+  // Test for both AnyTagged and TaggedPointer.
+  for (size_t i = 0; i < arraysize(types); ++i) {
+    for (size_t j = 0; j < arraysize(heap_constants); ++j) {
+      // Create the graph.
+      // Base pointer in load_2, and phi input for value
+      Node* load_1 = graph()->NewNode(machine()->Load(types[i]), object, index,
+                                      effect, control);
+
+      // load_2 blocks load_1 from being compressed.
+      Node* load_2 = graph()->NewNode(machine()->Load(types[i]), load_1, index,
+                                      effect, control);
+      Node* phi = graph()->NewNode(
+          common()->Phi(types[i].representation(), number_of_inputs), load_1,
+          load_2, control);
+
+      graph()->SetEnd(
+          graph()->NewNode(machine()->Store(CreateStoreRep(types[i])), object,
+                           index, phi, effect, control));
+
+      // Change the nodes, and test the change.
+      Reduce();
+      EXPECT_EQ(LoadMachRep(load_1), types[i].representation());
+      EXPECT_EQ(LoadMachRep(load_2), CompressedMachRep(types[i]));
+      EXPECT_EQ(PhiRepresentationOf(phi->op()), CompressedMachRep(types[i]));
+    }
+  }
+}
+
+// -----------------------------------------------------------------------------
+// Int cases.
+
+TEST_F(DecompressionOptimizerTest, Int32LessThanOrEqualFromSpeculative) {
+  // This case tests for what SpeculativeNumberLessThanOrEqual is lowered to.
+  // Define variables.
+  Node* const control = graph()->start();
+  Node* object = Parameter(Type::Any(), 0);
+  Node* effect = graph()->start();
+  Node* index = Parameter(Type::UnsignedSmall(), 1);
+
+  // Test only for AnyTagged, since TaggedPointer can't be a Smi.
+  // Create the graph.
+  Node* load = graph()->NewNode(machine()->Load(MachineType::AnyTagged()),
+                                object, index, effect, control);
+  Node* constant = graph()->NewNode(common()->Int64Constant(5));
+  graph()->SetEnd(
+      graph()->NewNode(machine()->Int32LessThanOrEqual(), load, constant));
+  // Change the nodes, and test the change.
+  Reduce();
+  EXPECT_EQ(LoadMachRep(load), CompressedMachRep(MachineType::AnyTagged()));
+}
+
+// -----------------------------------------------------------------------------
+// Bitcast cases.
+
+TEST_F(DecompressionOptimizerTest, BitcastTaggedToWord) {
+  // Define variables.
+  Node* const control = graph()->start();
+  Node* object = Parameter(Type::Any(), 0);
+  Node* effect = graph()->start();
+  Node* index = Parameter(Type::UnsignedSmall(), 1);
+
+  // Test for both AnyTagged and TaggedPointer, for both loads.
+  for (size_t i = 0; i < arraysize(types); ++i) {
+    for (size_t j = 0; j < arraysize(types); ++j) {
+      // Create the graph.
+      Node* load_1 = graph()->NewNode(machine()->Load(types[i]), object, index,
+                                      effect, control);
+      Node* bitcast_1 = graph()->NewNode(machine()->BitcastTaggedToWord(),
+                                         load_1, effect, control);
+      Node* load_2 = graph()->NewNode(machine()->Load(types[j]), object, index,
+                                      effect, control);
+      Node* bitcast_2 = graph()->NewNode(machine()->BitcastTaggedToWord(),
+                                         load_2, effect, control);
+      Node* equal =
+          graph()->NewNode(machine()->Word32Equal(), bitcast_1, bitcast_2);
+      graph()->SetEnd(equal);
+
+      // Change the nodes, and test the change.
+      Reduce();
+      EXPECT_EQ(LoadMachRep(load_1), CompressedMachRep(types[i]));
+      EXPECT_EQ(LoadMachRep(load_2), CompressedMachRep(types[j]));
+    }
+  }
+}
+
+TEST_F(DecompressionOptimizerTest, BitcastTaggedToWordForTagAndSmiBits) {
+  // Define variables.
+  Node* const control = graph()->start();
+  Node* object = Parameter(Type::Any(), 0);
+  Node* effect = graph()->start();
+  Node* index = Parameter(Type::UnsignedSmall(), 1);
+
+  // Test for both AnyTagged and TaggedPointer, for both loads.
+  for (size_t i = 0; i < arraysize(types); ++i) {
+    for (size_t j = 0; j < arraysize(types); ++j) {
+      // Create the graph.
+      Node* load_1 = graph()->NewNode(machine()->Load(types[i]), object, index,
+                                      effect, control);
+      Node* bitcast_1 = graph()->NewNode(
+          machine()->BitcastTaggedToWordForTagAndSmiBits(), load_1);
+      Node* load_2 = graph()->NewNode(machine()->Load(types[j]), object, index,
+                                      effect, control);
+      Node* bitcast_2 = graph()->NewNode(
+          machine()->BitcastTaggedToWordForTagAndSmiBits(), load_2);
+      Node* equal =
+          graph()->NewNode(machine()->Word32Equal(), bitcast_1, bitcast_2);
+      graph()->SetEnd(equal);
+
+      // Change the nodes, and test the change.
+      Reduce();
+      EXPECT_EQ(LoadMachRep(load_1), CompressedMachRep(types[i]));
+      EXPECT_EQ(LoadMachRep(load_2), CompressedMachRep(types[j]));
+    }
+  }
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/effect-control-linearizer-unittest.cc b/deps/v8/test/unittests/compiler/effect-control-linearizer-unittest.cc
index e658f281d762b4..925ae9b5e70d4b 100644
--- a/deps/v8/test/unittests/compiler/effect-control-linearizer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/effect-control-linearizer-unittest.cc
@@ -85,9 +85,9 @@ TEST_F(EffectControlLinearizerTest, SimpleLoad) {
   schedule.AddReturn(start, ret);
 
   // Run the state effect introducer.
-  LinearizeEffectControl(jsgraph(), &schedule, zone(), source_positions(),
-                         node_origins(),
-                         MaskArrayIndexEnable::kDoNotMaskArrayIndex);
+  LinearizeEffectControl(
+      jsgraph(), &schedule, zone(), source_positions(), node_origins(),
+      MaskArrayIndexEnable::kDoNotMaskArrayIndex, MaintainSchedule::kDiscard);
 
   EXPECT_THAT(load,
               IsLoadField(AccessBuilder::ForHeapNumberValue(), heap_number,
@@ -147,9 +147,9 @@ TEST_F(EffectControlLinearizerTest, DiamondLoad) {
   schedule.AddReturn(mblock, ret);
 
   // Run the state effect introducer.
-  LinearizeEffectControl(jsgraph(), &schedule, zone(), source_positions(),
-                         node_origins(),
-                         MaskArrayIndexEnable::kDoNotMaskArrayIndex);
+  LinearizeEffectControl(
+      jsgraph(), &schedule, zone(), source_positions(), node_origins(),
+      MaskArrayIndexEnable::kDoNotMaskArrayIndex, MaintainSchedule::kDiscard);
 
   // The effect input to the return should be an effect phi with the
   // newly introduced effectful change operators.
@@ -214,9 +214,9 @@ TEST_F(EffectControlLinearizerTest, LoopLoad) {
   schedule.AddReturn(rblock, ret);
 
   // Run the state effect introducer.
-  LinearizeEffectControl(jsgraph(), &schedule, zone(), source_positions(),
-                         node_origins(),
-                         MaskArrayIndexEnable::kDoNotMaskArrayIndex);
+  LinearizeEffectControl(
+      jsgraph(), &schedule, zone(), source_positions(), node_origins(),
+      MaskArrayIndexEnable::kDoNotMaskArrayIndex, MaintainSchedule::kDiscard);
 
   ASSERT_THAT(ret, IsReturn(load, load, if_true));
   EXPECT_THAT(load, IsLoadField(AccessBuilder::ForHeapNumberValue(),
@@ -277,9 +277,9 @@ TEST_F(EffectControlLinearizerTest, CloneBranch) {
   schedule.AddNode(mblock, merge);
   schedule.AddNode(mblock, graph()->end());
 
-  LinearizeEffectControl(jsgraph(), &schedule, zone(), source_positions(),
-                         node_origins(),
-                         MaskArrayIndexEnable::kDoNotMaskArrayIndex);
+  LinearizeEffectControl(
+      jsgraph(), &schedule, zone(), source_positions(), node_origins(),
+      MaskArrayIndexEnable::kDoNotMaskArrayIndex, MaintainSchedule::kDiscard);
 
   Capture<Node *> branch1_capture, branch2_capture;
   EXPECT_THAT(
diff --git a/deps/v8/test/unittests/compiler/graph-unittest.cc b/deps/v8/test/unittests/compiler/graph-unittest.cc
index ee6b7c02a3e92f..0008eadaf90ddc 100644
--- a/deps/v8/test/unittests/compiler/graph-unittest.cc
+++ b/deps/v8/test/unittests/compiler/graph-unittest.cc
@@ -18,7 +18,7 @@ GraphTest::GraphTest(int num_parameters)
     : canonical_(isolate()),
       common_(zone()),
       graph_(zone()),
-      broker_(isolate(), zone(), FLAG_trace_heap_broker),
+      broker_(isolate(), zone(), FLAG_trace_heap_broker, false),
       source_positions_(&graph_),
       node_origins_(&graph_) {
   graph()->SetStart(graph()->NewNode(common()->Start(num_parameters)));
@@ -90,9 +90,13 @@ Node* GraphTest::UndefinedConstant() {
 Node* GraphTest::EmptyFrameState() {
   Node* state_values =
       graph()->NewNode(common()->StateValues(0, SparseInputMask::Dense()));
+  FrameStateFunctionInfo const* function_info =
+      common()->CreateFrameStateFunctionInfo(
+          FrameStateType::kInterpretedFunction, 0, 0,
+          Handle<SharedFunctionInfo>());
   return graph()->NewNode(
       common()->FrameState(BailoutId::None(), OutputFrameStateCombine::Ignore(),
-                           nullptr),
+                           function_info),
       state_values, state_values, state_values, NumberConstant(0),
       UndefinedConstant(), graph()->start());
 }
diff --git a/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc b/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc
index 10643ddc8ba444..06078f240df9fe 100644
--- a/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc
@@ -37,7 +37,7 @@ class JSCallReducerTest : public TypedGraphTest {
     // TODO(titzer): mock the GraphReducer here for better unit testing.
     GraphReducer graph_reducer(zone(), graph(), tick_counter());
 
-    JSCallReducer reducer(&graph_reducer, &jsgraph, broker(),
+    JSCallReducer reducer(&graph_reducer, &jsgraph, broker(), zone(),
                           JSCallReducer::kNoFlags, &deps_);
     return reducer.Reduce(node);
   }
@@ -115,9 +115,9 @@ class JSCallReducerTest : public TypedGraphTest {
     Handle<FeedbackVector> vector =
         FeedbackVector::New(isolate(), shared, closure_feedback_cell_array);
     FeedbackSource feedback(vector, FeedbackSlot(0));
-    return javascript()->Call(arity, CallFrequency(), feedback,
-                              ConvertReceiverMode::kAny,
-                              SpeculationMode::kAllowSpeculation);
+    return javascript()->Call(
+        arity, CallFrequency(), feedback, ConvertReceiverMode::kAny,
+        SpeculationMode::kAllowSpeculation, CallFeedbackRelation::kRelated);
   }
 
  private:
diff --git a/deps/v8/test/unittests/compiler/js-create-lowering-unittest.cc b/deps/v8/test/unittests/compiler/js-create-lowering-unittest.cc
index fb5254903d75c2..d50278700f61aa 100644
--- a/deps/v8/test/unittests/compiler/js-create-lowering-unittest.cc
+++ b/deps/v8/test/unittests/compiler/js-create-lowering-unittest.cc
@@ -144,9 +144,9 @@ TEST_F(JSCreateLoweringTest, JSCreateArgumentsInlinedRestArray) {
       javascript()->CreateArguments(CreateArgumentsType::kRestParameter),
       closure, context, frame_state_inner, effect));
   ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(
-      r.replacement(),
-      IsFinishRegion(IsAllocate(IsNumberConstant(JSArray::kSize), _, _), _));
+  EXPECT_THAT(r.replacement(),
+              IsFinishRegion(
+                  IsAllocate(IsNumberConstant(JSArray::kHeaderSize), _, _), _));
 }
 
 // -----------------------------------------------------------------------------
@@ -182,11 +182,12 @@ TEST_F(JSCreateLoweringTest, JSCreateWithContext) {
       Reduce(graph()->NewNode(javascript()->CreateWithContext(scope_info),
                               object, context, effect, control));
   ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(),
-              IsFinishRegion(IsAllocate(IsNumberConstant(Context::SizeFor(
-                                            Context::MIN_CONTEXT_SLOTS)),
-                                        IsBeginRegion(_), control),
-                             _));
+  EXPECT_THAT(
+      r.replacement(),
+      IsFinishRegion(IsAllocate(IsNumberConstant(Context::SizeFor(
+                                    Context::MIN_CONTEXT_EXTENDED_SLOTS)),
+                                IsBeginRegion(_), control),
+                     _));
 }
 
 // -----------------------------------------------------------------------------
diff --git a/deps/v8/test/unittests/compiler/machine-operator-reducer-unittest.cc b/deps/v8/test/unittests/compiler/machine-operator-reducer-unittest.cc
index 7f3a6139946b36..bcf0a7101c3f1a 100644
--- a/deps/v8/test/unittests/compiler/machine-operator-reducer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/machine-operator-reducer-unittest.cc
@@ -1674,6 +1674,95 @@ TEST_F(MachineOperatorReducerTest, Int32MulWithOverflowWithConstant) {
   }
 }
 
+// -----------------------------------------------------------------------------
+// Int64Mul
+
+TEST_F(MachineOperatorReducerTest, Int64MulWithZero) {
+  Node* p0 = Parameter(0);
+  {
+    Node* mul = graph()->NewNode(machine()->Int64Mul(), Int64Constant(0), p0);
+
+    Reduction r = Reduce(mul);
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsInt64Constant(0));
+  }
+  {
+    Node* mul = graph()->NewNode(machine()->Int64Mul(), p0, Int64Constant(0));
+
+    Reduction r = Reduce(mul);
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsInt64Constant(0));
+  }
+}
+
+TEST_F(MachineOperatorReducerTest, Int64MulWithOne) {
+  Node* p0 = Parameter(0);
+  {
+    Node* mul = graph()->NewNode(machine()->Int64Mul(), Int64Constant(1), p0);
+
+    Reduction r = Reduce(mul);
+    ASSERT_TRUE(r.Changed());
+    EXPECT_EQ(p0, r.replacement());
+  }
+  {
+    Node* mul = graph()->NewNode(machine()->Int64Mul(), p0, Int64Constant(1));
+
+    Reduction r = Reduce(mul);
+    ASSERT_TRUE(r.Changed());
+    EXPECT_EQ(p0, r.replacement());
+  }
+}
+
+TEST_F(MachineOperatorReducerTest, Int64MulWithMinusOne) {
+  Node* p0 = Parameter(0);
+
+  {
+    Reduction r =
+        Reduce(graph()->NewNode(machine()->Int64Mul(), Int64Constant(-1), p0));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsInt64Sub(IsInt64Constant(0), p0));
+  }
+
+  {
+    Reduction r =
+        Reduce(graph()->NewNode(machine()->Int64Mul(), p0, Int64Constant(-1)));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsInt64Sub(IsInt64Constant(0), p0));
+  }
+}
+
+TEST_F(MachineOperatorReducerTest, Int64MulWithPowerOfTwo) {
+  Node* p0 = Parameter(0);
+
+  {
+    Reduction r =
+        Reduce(graph()->NewNode(machine()->Int64Mul(), Int64Constant(8), p0));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsWord64Shl(p0, IsInt64Constant(3)));
+  }
+
+  {
+    Reduction r =
+        Reduce(graph()->NewNode(machine()->Int64Mul(), p0, Int64Constant(8)));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsWord64Shl(p0, IsInt64Constant(3)));
+  }
+}
+
+TEST_F(MachineOperatorReducerTest, Int64MulWithConstant) {
+  TRACED_FOREACH(int64_t, x, kInt64Values) {
+    TRACED_FOREACH(int64_t, y, kInt64Values) {
+      Node* mul = graph()->NewNode(machine()->Int64Mul(), Int64Constant(x),
+                                   Int64Constant(y));
+
+      Reduction r = Reduce(mul);
+      ASSERT_TRUE(r.Changed());
+      EXPECT_THAT(r.replacement(),
+                  IsInt64Constant(base::MulWithWraparound(x, y)));
+    }
+  }
+}
+
 // -----------------------------------------------------------------------------
 // Int32LessThan
 
diff --git a/deps/v8/test/unittests/compiler/machine-operator-unittest.cc b/deps/v8/test/unittests/compiler/machine-operator-unittest.cc
index d0acbf341c37ae..e53050ad55fcde 100644
--- a/deps/v8/test/unittests/compiler/machine-operator-unittest.cc
+++ b/deps/v8/test/unittests/compiler/machine-operator-unittest.cc
@@ -245,7 +245,6 @@ const PureOperator kPureOperators[] = {
     PURE(Float64Equal, 2, 0, 1),              // --
     PURE(Float64LessThan, 2, 0, 1),           // --
     PURE(Float64LessThanOrEqual, 2, 0, 1),    // --
-    PURE(StackPointerGreaterThan, 1, 0, 1),   // --
     PURE(Float64ExtractLowWord32, 1, 0, 1),   // --
     PURE(Float64ExtractHighWord32, 1, 0, 1),  // --
     PURE(Float64InsertLowWord32, 2, 0, 1),    // --
diff --git a/deps/v8/test/unittests/compiler/node-test-utils.cc b/deps/v8/test/unittests/compiler/node-test-utils.cc
index 6fa4ce0cf07981..bddcea5743e22c 100644
--- a/deps/v8/test/unittests/compiler/node-test-utils.cc
+++ b/deps/v8/test/unittests/compiler/node-test-utils.cc
@@ -2203,8 +2203,6 @@ IS_UNOP_MATCHER(ChangeInt32ToFloat64)
 IS_UNOP_MATCHER(ChangeInt32ToInt64)
 IS_UNOP_MATCHER(ChangeUint32ToFloat64)
 IS_UNOP_MATCHER(ChangeUint32ToUint64)
-IS_UNOP_MATCHER(ChangeCompressedToTagged)
-IS_UNOP_MATCHER(ChangeCompressedPointerToTaggedPointer)
 IS_UNOP_MATCHER(TruncateFloat64ToFloat32)
 IS_UNOP_MATCHER(TruncateInt64ToInt32)
 IS_UNOP_MATCHER(Float32Abs)
diff --git a/deps/v8/test/unittests/compiler/node-test-utils.h b/deps/v8/test/unittests/compiler/node-test-utils.h
index a71aff913b3fdd..bf21427a5ce03f 100644
--- a/deps/v8/test/unittests/compiler/node-test-utils.h
+++ b/deps/v8/test/unittests/compiler/node-test-utils.h
@@ -426,9 +426,6 @@ Matcher<Node*> IsChangeInt32ToFloat64(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsChangeInt32ToInt64(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsChangeUint32ToFloat64(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsChangeUint32ToUint64(const Matcher<Node*>& input_matcher);
-Matcher<Node*> IsChangeCompressedToTagged(const Matcher<Node*>& input_matcher);
-Matcher<Node*> IsChangeCompressedPointerToTaggedPointer(
-    const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsTruncateFloat64ToFloat32(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsTruncateInt64ToInt32(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsFloat32Abs(const Matcher<Node*>& input_matcher);
diff --git a/deps/v8/test/unittests/compiler/redundancy-elimination-unittest.cc b/deps/v8/test/unittests/compiler/redundancy-elimination-unittest.cc
index 9655fc70b2cc95..62135dddceee21 100644
--- a/deps/v8/test/unittests/compiler/redundancy-elimination-unittest.cc
+++ b/deps/v8/test/unittests/compiler/redundancy-elimination-unittest.cc
@@ -298,36 +298,6 @@ TEST_F(RedundancyEliminationTest, CheckedFloat64ToInt64) {
   }
 }
 
-// -----------------------------------------------------------------------------
-// CheckedInt32ToCompressedSigned
-
-TEST_F(RedundancyEliminationTest, CheckedInt32ToCompressedSigned) {
-  if (!COMPRESS_POINTERS_BOOL) {
-    return;
-  }
-  TRACED_FOREACH(FeedbackSource, feedback1, vector_slot_pairs()) {
-    TRACED_FOREACH(FeedbackSource, feedback2, vector_slot_pairs()) {
-      Node* value = Parameter(0);
-      Node* effect = graph()->start();
-      Node* control = graph()->start();
-
-      Node* check1 = effect = graph()->NewNode(
-          simplified()->CheckedInt32ToCompressedSigned(feedback1), value,
-          effect, control);
-      Reduction r1 = Reduce(check1);
-      ASSERT_TRUE(r1.Changed());
-      EXPECT_EQ(r1.replacement(), check1);
-
-      Node* check2 = effect = graph()->NewNode(
-          simplified()->CheckedInt32ToCompressedSigned(feedback2), value,
-          effect, control);
-      Reduction r2 = Reduce(check2);
-      ASSERT_TRUE(r2.Changed());
-      EXPECT_EQ(r2.replacement(), check1);
-    }
-  }
-}
-
 // -----------------------------------------------------------------------------
 // CheckedInt32ToTaggedSigned
 
@@ -631,114 +601,6 @@ TEST_F(RedundancyEliminationTest, CheckedTaggedToTaggedSigned) {
   }
 }
 
-// -----------------------------------------------------------------------------
-// CheckedCompressedToTaggedPointer
-
-TEST_F(RedundancyEliminationTest, CheckedCompressedToTaggedPointer) {
-  TRACED_FOREACH(FeedbackSource, feedback1, vector_slot_pairs()) {
-    TRACED_FOREACH(FeedbackSource, feedback2, vector_slot_pairs()) {
-      Node* value = Parameter(0);
-      Node* effect = graph()->start();
-      Node* control = graph()->start();
-
-      Node* check1 = effect = graph()->NewNode(
-          simplified()->CheckedCompressedToTaggedPointer(feedback1), value,
-          effect, control);
-      Reduction r1 = Reduce(check1);
-      ASSERT_TRUE(r1.Changed());
-      EXPECT_EQ(r1.replacement(), check1);
-
-      Node* check2 = effect = graph()->NewNode(
-          simplified()->CheckedCompressedToTaggedPointer(feedback2), value,
-          effect, control);
-      Reduction r2 = Reduce(check2);
-      ASSERT_TRUE(r2.Changed());
-      EXPECT_EQ(r2.replacement(), check1);
-    }
-  }
-}
-
-// -----------------------------------------------------------------------------
-// CheckedCompressedToTaggedSigned
-
-TEST_F(RedundancyEliminationTest, CheckedCompressedToTaggedSigned) {
-  TRACED_FOREACH(FeedbackSource, feedback1, vector_slot_pairs()) {
-    TRACED_FOREACH(FeedbackSource, feedback2, vector_slot_pairs()) {
-      Node* value = Parameter(0);
-      Node* effect = graph()->start();
-      Node* control = graph()->start();
-
-      Node* check1 = effect = graph()->NewNode(
-          simplified()->CheckedCompressedToTaggedSigned(feedback1), value,
-          effect, control);
-      Reduction r1 = Reduce(check1);
-      ASSERT_TRUE(r1.Changed());
-      EXPECT_EQ(r1.replacement(), check1);
-
-      Node* check2 = effect = graph()->NewNode(
-          simplified()->CheckedCompressedToTaggedSigned(feedback2), value,
-          effect, control);
-      Reduction r2 = Reduce(check2);
-      ASSERT_TRUE(r2.Changed());
-      EXPECT_EQ(r2.replacement(), check1);
-    }
-  }
-}
-
-// -----------------------------------------------------------------------------
-// CheckedTaggedToCompressedPointer
-
-TEST_F(RedundancyEliminationTest, CheckedTaggedToCompressedPointer) {
-  TRACED_FOREACH(FeedbackSource, feedback1, vector_slot_pairs()) {
-    TRACED_FOREACH(FeedbackSource, feedback2, vector_slot_pairs()) {
-      Node* value = Parameter(0);
-      Node* effect = graph()->start();
-      Node* control = graph()->start();
-
-      Node* check1 = effect = graph()->NewNode(
-          simplified()->CheckedTaggedToCompressedPointer(feedback1), value,
-          effect, control);
-      Reduction r1 = Reduce(check1);
-      ASSERT_TRUE(r1.Changed());
-      EXPECT_EQ(r1.replacement(), check1);
-
-      Node* check2 = effect = graph()->NewNode(
-          simplified()->CheckedTaggedToCompressedPointer(feedback2), value,
-          effect, control);
-      Reduction r2 = Reduce(check2);
-      ASSERT_TRUE(r2.Changed());
-      EXPECT_EQ(r2.replacement(), check1);
-    }
-  }
-}
-
-// -----------------------------------------------------------------------------
-// CheckedTaggedToCompressedSigned
-
-TEST_F(RedundancyEliminationTest, CheckedTaggedToCompressedSigned) {
-  TRACED_FOREACH(FeedbackSource, feedback1, vector_slot_pairs()) {
-    TRACED_FOREACH(FeedbackSource, feedback2, vector_slot_pairs()) {
-      Node* value = Parameter(0);
-      Node* effect = graph()->start();
-      Node* control = graph()->start();
-
-      Node* check1 = effect = graph()->NewNode(
-          simplified()->CheckedTaggedToCompressedSigned(feedback1), value,
-          effect, control);
-      Reduction r1 = Reduce(check1);
-      ASSERT_TRUE(r1.Changed());
-      EXPECT_EQ(r1.replacement(), check1);
-
-      Node* check2 = effect = graph()->NewNode(
-          simplified()->CheckedTaggedToCompressedSigned(feedback2), value,
-          effect, control);
-      Reduction r2 = Reduce(check2);
-      ASSERT_TRUE(r2.Changed());
-      EXPECT_EQ(r2.replacement(), check1);
-    }
-  }
-}
-
 // -----------------------------------------------------------------------------
 // CheckedTruncateTaggedToWord32
 
diff --git a/deps/v8/test/unittests/compiler/simplified-operator-reducer-unittest.cc b/deps/v8/test/unittests/compiler/simplified-operator-reducer-unittest.cc
index e2d4f080f5c219..a55ebe05ec991b 100644
--- a/deps/v8/test/unittests/compiler/simplified-operator-reducer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/simplified-operator-reducer-unittest.cc
@@ -30,7 +30,7 @@ class SimplifiedOperatorReducerTest : public GraphTest {
 
  protected:
   Reduction Reduce(Node* node) {
-    JSHeapBroker broker(isolate(), zone(), FLAG_trace_heap_broker);
+    JSHeapBroker broker(isolate(), zone(), FLAG_trace_heap_broker, false);
     MachineOperatorBuilder machine(zone());
     JSOperatorBuilder javascript(zone());
     JSGraph jsgraph(isolate(), graph(), common(), &javascript, simplified(),
diff --git a/deps/v8/test/unittests/compiler/simplified-operator-unittest.cc b/deps/v8/test/unittests/compiler/simplified-operator-unittest.cc
index 9939c70c75c5f8..1b416628fcc73e 100644
--- a/deps/v8/test/unittests/compiler/simplified-operator-unittest.cc
+++ b/deps/v8/test/unittests/compiler/simplified-operator-unittest.cc
@@ -53,7 +53,6 @@ const PureOperator kPureOperators[] = {
     PURE(NumberShiftRightLogical, Operator::kNoProperties, 2),
     PURE(NumberToInt32, Operator::kNoProperties, 1),
     PURE(NumberToUint32, Operator::kNoProperties, 1),
-    PURE(ChangeCompressedSignedToInt32, Operator::kNoProperties, 1),
     PURE(ChangeTaggedSignedToInt32, Operator::kNoProperties, 1),
     PURE(ChangeTaggedToInt32, Operator::kNoProperties, 1),
     PURE(ChangeTaggedToUint32, Operator::kNoProperties, 1),
diff --git a/deps/v8/test/unittests/compiler/typer-unittest.cc b/deps/v8/test/unittests/compiler/typer-unittest.cc
index 23e4dbe5ae1a65..bfb65e7c5f0830 100644
--- a/deps/v8/test/unittests/compiler/typer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/typer-unittest.cc
@@ -22,7 +22,7 @@ class TyperTest : public TypedGraphTest {
  public:
   TyperTest()
       : TypedGraphTest(3),
-        broker_(isolate(), zone(), FLAG_trace_heap_broker),
+        broker_(isolate(), zone(), FLAG_trace_heap_broker, false),
         operation_typer_(&broker_, zone()),
         types_(zone(), isolate(), random_number_generator()),
         javascript_(zone()),
diff --git a/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc b/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc
index ba08701b59f823..829096ab231bc8 100644
--- a/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc
+++ b/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc
@@ -109,9 +109,10 @@ TEST(LocalEmbedderHeapTracer, EnterFinalPauseDefaultStackStateUnkown) {
   local_tracer.EnterFinalPause();
 }
 
-TEST(LocalEmbedderHeapTracer, EnterFinalPauseStackStateIsForwarded) {
+TEST_F(LocalEmbedderHeapTracerWithIsolate,
+       EnterFinalPauseStackStateIsForwarded) {
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
-  LocalEmbedderHeapTracer local_tracer(nullptr);
+  LocalEmbedderHeapTracer local_tracer(isolate());
   local_tracer.SetRemoteTracer(&remote_tracer);
   local_tracer.SetEmbedderStackStateForNextFinalization(
       EmbedderHeapTracer::kEmpty);
@@ -119,9 +120,9 @@ TEST(LocalEmbedderHeapTracer, EnterFinalPauseStackStateIsForwarded) {
   local_tracer.EnterFinalPause();
 }
 
-TEST(LocalEmbedderHeapTracer, TemporaryEmbedderStackState) {
+TEST_F(LocalEmbedderHeapTracerWithIsolate, TemporaryEmbedderStackState) {
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
-  LocalEmbedderHeapTracer local_tracer(nullptr);
+  LocalEmbedderHeapTracer local_tracer(isolate());
   local_tracer.SetRemoteTracer(&remote_tracer);
   // Default is unknown, see above.
   {
@@ -131,9 +132,10 @@ TEST(LocalEmbedderHeapTracer, TemporaryEmbedderStackState) {
   }
 }
 
-TEST(LocalEmbedderHeapTracer, TemporaryEmbedderStackStateRestores) {
+TEST_F(LocalEmbedderHeapTracerWithIsolate,
+       TemporaryEmbedderStackStateRestores) {
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
-  LocalEmbedderHeapTracer local_tracer(nullptr);
+  LocalEmbedderHeapTracer local_tracer(isolate());
   local_tracer.SetRemoteTracer(&remote_tracer);
   // Default is unknown, see above.
   {
@@ -149,9 +151,9 @@ TEST(LocalEmbedderHeapTracer, TemporaryEmbedderStackStateRestores) {
   }
 }
 
-TEST(LocalEmbedderHeapTracer, EnterFinalPauseStackStateResets) {
+TEST_F(LocalEmbedderHeapTracerWithIsolate, EnterFinalPauseStackStateResets) {
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
-  LocalEmbedderHeapTracer local_tracer(nullptr);
+  LocalEmbedderHeapTracer local_tracer(isolate());
   local_tracer.SetRemoteTracer(&remote_tracer);
   local_tracer.SetEmbedderStackStateForNextFinalization(
       EmbedderHeapTracer::kEmpty);
diff --git a/deps/v8/test/unittests/heap/heap-unittest.cc b/deps/v8/test/unittests/heap/heap-unittest.cc
index 76cab01a411bf8..12b5d3a7fedabe 100644
--- a/deps/v8/test/unittests/heap/heap-unittest.cc
+++ b/deps/v8/test/unittests/heap/heap-unittest.cc
@@ -23,20 +23,23 @@ TEST(Heap, YoungGenerationSizeFromOldGenerationSize) {
   const size_t MB = static_cast<size_t>(i::MB);
   const size_t KB = static_cast<size_t>(i::KB);
   const size_t pm = i::Heap::kPointerMultiplier;
+  const size_t hlm = i::Heap::kHeapLimitMultiplier;
   ASSERT_EQ(3 * 512u * pm * KB,
-            i::Heap::YoungGenerationSizeFromOldGenerationSize(128u * pm * MB));
+            i::Heap::YoungGenerationSizeFromOldGenerationSize(128u * hlm * MB));
   ASSERT_EQ(3 * 2048u * pm * KB,
-            i::Heap::YoungGenerationSizeFromOldGenerationSize(256u * pm * MB));
+            i::Heap::YoungGenerationSizeFromOldGenerationSize(256u * hlm * MB));
   ASSERT_EQ(3 * 4096u * pm * KB,
-            i::Heap::YoungGenerationSizeFromOldGenerationSize(512u * pm * MB));
-  ASSERT_EQ(3 * 8192u * pm * KB,
-            i::Heap::YoungGenerationSizeFromOldGenerationSize(1024u * pm * MB));
+            i::Heap::YoungGenerationSizeFromOldGenerationSize(512u * hlm * MB));
+  ASSERT_EQ(
+      3 * 8192u * pm * KB,
+      i::Heap::YoungGenerationSizeFromOldGenerationSize(1024u * hlm * MB));
 }
 
 TEST(Heap, GenerationSizesFromHeapSize) {
   const size_t MB = static_cast<size_t>(i::MB);
   const size_t KB = static_cast<size_t>(i::KB);
   const size_t pm = i::Heap::kPointerMultiplier;
+  const size_t hlm = i::Heap::kHeapLimitMultiplier;
   size_t old, young;
 
   i::Heap::GenerationSizesFromHeapSize(1 * KB, &young, &old);
@@ -48,45 +51,46 @@ TEST(Heap, GenerationSizesFromHeapSize) {
   ASSERT_EQ(1 * KB, old);
   ASSERT_EQ(3 * 512u * pm * KB, young);
 
-  i::Heap::GenerationSizesFromHeapSize(128 * pm * MB + 3 * 512 * pm * KB,
+  i::Heap::GenerationSizesFromHeapSize(128 * hlm * MB + 3 * 512 * pm * KB,
                                        &young, &old);
-  ASSERT_EQ(128u * pm * MB, old);
+  ASSERT_EQ(128u * hlm * MB, old);
   ASSERT_EQ(3 * 512u * pm * KB, young);
 
-  i::Heap::GenerationSizesFromHeapSize(256u * pm * MB + 3 * 2048 * pm * KB,
+  i::Heap::GenerationSizesFromHeapSize(256u * hlm * MB + 3 * 2048 * pm * KB,
                                        &young, &old);
-  ASSERT_EQ(256u * pm * MB, old);
+  ASSERT_EQ(256u * hlm * MB, old);
   ASSERT_EQ(3 * 2048u * pm * KB, young);
 
-  i::Heap::GenerationSizesFromHeapSize(512u * pm * MB + 3 * 4096 * pm * KB,
+  i::Heap::GenerationSizesFromHeapSize(512u * hlm * MB + 3 * 4096 * pm * KB,
                                        &young, &old);
-  ASSERT_EQ(512u * pm * MB, old);
+  ASSERT_EQ(512u * hlm * MB, old);
   ASSERT_EQ(3 * 4096u * pm * KB, young);
 
-  i::Heap::GenerationSizesFromHeapSize(1024u * pm * MB + 3 * 8192 * pm * KB,
+  i::Heap::GenerationSizesFromHeapSize(1024u * hlm * MB + 3 * 8192 * pm * KB,
                                        &young, &old);
-  ASSERT_EQ(1024u * pm * MB, old);
+  ASSERT_EQ(1024u * hlm * MB, old);
   ASSERT_EQ(3 * 8192u * pm * KB, young);
 }
 
 TEST(Heap, HeapSizeFromPhysicalMemory) {
   const size_t MB = static_cast<size_t>(i::MB);
   const size_t pm = i::Heap::kPointerMultiplier;
+  const size_t hlm = i::Heap::kHeapLimitMultiplier;
 
   // The expected value is old_generation_size + 3 * semi_space_size.
-  ASSERT_EQ(128 * pm * MB + 3 * 512 * pm * KB,
+  ASSERT_EQ(128 * hlm * MB + 3 * 512 * pm * KB,
             i::Heap::HeapSizeFromPhysicalMemory(0u));
-  ASSERT_EQ(128 * pm * MB + 3 * 512 * pm * KB,
+  ASSERT_EQ(128 * hlm * MB + 3 * 512 * pm * KB,
             i::Heap::HeapSizeFromPhysicalMemory(512u * MB));
-  ASSERT_EQ(256 * pm * MB + 3 * 2048 * pm * KB,
+  ASSERT_EQ(256 * hlm * MB + 3 * 2048 * pm * KB,
             i::Heap::HeapSizeFromPhysicalMemory(1024u * MB));
-  ASSERT_EQ(512 * pm * MB + 3 * 4096 * pm * KB,
+  ASSERT_EQ(512 * hlm * MB + 3 * 4096 * pm * KB,
             i::Heap::HeapSizeFromPhysicalMemory(2048u * MB));
   ASSERT_EQ(
-      1024 * pm * MB + 3 * 8192 * pm * KB,
+      1024 * hlm * MB + 3 * 8192 * pm * KB,
       i::Heap::HeapSizeFromPhysicalMemory(static_cast<uint64_t>(4096u) * MB));
   ASSERT_EQ(
-      1024 * pm * MB + 3 * 8192 * pm * KB,
+      1024 * hlm * MB + 3 * 8192 * pm * KB,
       i::Heap::HeapSizeFromPhysicalMemory(static_cast<uint64_t>(8192u) * MB));
 }
 
diff --git a/deps/v8/test/unittests/heap/marking-worklist-unittest.cc b/deps/v8/test/unittests/heap/marking-worklist-unittest.cc
new file mode 100644
index 00000000000000..91567edd4c3ee1
--- /dev/null
+++ b/deps/v8/test/unittests/heap/marking-worklist-unittest.cc
@@ -0,0 +1,135 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <cmath>
+#include <limits>
+
+#include "src/heap/heap-inl.h"
+#include "src/heap/heap.h"
+#include "src/heap/marking-worklist.h"
+#include "test/unittests/test-utils.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace v8 {
+namespace internal {
+
+using MarkingWorklistTest = TestWithContext;
+
+TEST_F(MarkingWorklistTest, PushPop) {
+  MarkingWorklistsHolder holder;
+  MarkingWorklists worklists(kMainThreadTask, &holder);
+  HeapObject pushed_object =
+      ReadOnlyRoots(i_isolate()->heap()).undefined_value();
+  worklists.Push(pushed_object);
+  HeapObject popped_object;
+  EXPECT_TRUE(worklists.Pop(&popped_object));
+  EXPECT_EQ(popped_object, pushed_object);
+}
+
+TEST_F(MarkingWorklistTest, PushPopOnHold) {
+  MarkingWorklistsHolder holder;
+  MarkingWorklists worklists(kMainThreadTask, &holder);
+  HeapObject pushed_object =
+      ReadOnlyRoots(i_isolate()->heap()).undefined_value();
+  worklists.PushOnHold(pushed_object);
+  HeapObject popped_object;
+  EXPECT_TRUE(worklists.PopOnHold(&popped_object));
+  EXPECT_EQ(popped_object, pushed_object);
+}
+
+TEST_F(MarkingWorklistTest, PushPopEmbedder) {
+  MarkingWorklistsHolder holder;
+  MarkingWorklists worklists(kMainThreadTask, &holder);
+  HeapObject pushed_object =
+      ReadOnlyRoots(i_isolate()->heap()).undefined_value();
+  worklists.PushEmbedder(pushed_object);
+  HeapObject popped_object;
+  EXPECT_TRUE(worklists.PopEmbedder(&popped_object));
+  EXPECT_EQ(popped_object, pushed_object);
+}
+
+TEST_F(MarkingWorklistTest, MergeOnHold) {
+  MarkingWorklistsHolder holder;
+  MarkingWorklists main_worklists(kMainThreadTask, &holder);
+  MarkingWorklists worker_worklists(kMainThreadTask + 1, &holder);
+  HeapObject pushed_object =
+      ReadOnlyRoots(i_isolate()->heap()).undefined_value();
+  worker_worklists.PushOnHold(pushed_object);
+  worker_worklists.FlushToGlobal();
+  main_worklists.MergeOnHold();
+  HeapObject popped_object;
+  EXPECT_TRUE(main_worklists.Pop(&popped_object));
+  EXPECT_EQ(popped_object, pushed_object);
+}
+
+TEST_F(MarkingWorklistTest, ShareWorkIfGlobalPoolIsEmpty) {
+  MarkingWorklistsHolder holder;
+  MarkingWorklists main_worklists(kMainThreadTask, &holder);
+  MarkingWorklists worker_worklists(kMainThreadTask + 1, &holder);
+  HeapObject pushed_object =
+      ReadOnlyRoots(i_isolate()->heap()).undefined_value();
+  main_worklists.Push(pushed_object);
+  main_worklists.ShareWorkIfGlobalPoolIsEmpty();
+  HeapObject popped_object;
+  EXPECT_TRUE(worker_worklists.Pop(&popped_object));
+  EXPECT_EQ(popped_object, pushed_object);
+}
+
+TEST_F(MarkingWorklistTest, ContextWorklistsPushPop) {
+  const Address context = 0xabcdef;
+  MarkingWorklistsHolder holder;
+  holder.CreateContextWorklists({context});
+  MarkingWorklists worklists(kMainThreadTask, &holder);
+  HeapObject pushed_object =
+      ReadOnlyRoots(i_isolate()->heap()).undefined_value();
+  worklists.SwitchToContext(context);
+  worklists.Push(pushed_object);
+  worklists.SwitchToShared();
+  HeapObject popped_object;
+  EXPECT_TRUE(worklists.Pop(&popped_object));
+  EXPECT_EQ(popped_object, pushed_object);
+  holder.ReleaseContextWorklists();
+}
+
+TEST_F(MarkingWorklistTest, ContextWorklistsEmpty) {
+  const Address context = 0xabcdef;
+  MarkingWorklistsHolder holder;
+  holder.CreateContextWorklists({context});
+  MarkingWorklists worklists(kMainThreadTask, &holder);
+  HeapObject pushed_object =
+      ReadOnlyRoots(i_isolate()->heap()).undefined_value();
+  worklists.SwitchToContext(context);
+  worklists.Push(pushed_object);
+  EXPECT_FALSE(worklists.IsEmpty());
+  worklists.SwitchToShared();
+  EXPECT_FALSE(worklists.IsEmpty());
+  HeapObject popped_object;
+  EXPECT_TRUE(worklists.Pop(&popped_object));
+  EXPECT_EQ(popped_object, pushed_object);
+  EXPECT_TRUE(worklists.IsEmpty());
+  holder.ReleaseContextWorklists();
+}
+
+TEST_F(MarkingWorklistTest, ContextWorklistCrossTask) {
+  const Address context1 = 0x1abcdef;
+  const Address context2 = 0x2abcdef;
+  MarkingWorklistsHolder holder;
+  holder.CreateContextWorklists({context1, context2});
+  MarkingWorklists main_worklists(kMainThreadTask, &holder);
+  MarkingWorklists worker_worklists(kMainThreadTask + 1, &holder);
+  HeapObject pushed_object =
+      ReadOnlyRoots(i_isolate()->heap()).undefined_value();
+  main_worklists.SwitchToContext(context1);
+  main_worklists.Push(pushed_object);
+  main_worklists.ShareWorkIfGlobalPoolIsEmpty();
+  worker_worklists.SwitchToContext(context2);
+  HeapObject popped_object;
+  EXPECT_TRUE(worker_worklists.Pop(&popped_object));
+  EXPECT_EQ(popped_object, pushed_object);
+  EXPECT_EQ(context1, worker_worklists.Context());
+  holder.ReleaseContextWorklists();
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/unittests/heap/off-thread-factory-unittest.cc b/deps/v8/test/unittests/heap/off-thread-factory-unittest.cc
new file mode 100644
index 00000000000000..2c7bd639a8465b
--- /dev/null
+++ b/deps/v8/test/unittests/heap/off-thread-factory-unittest.cc
@@ -0,0 +1,171 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <cmath>
+#include <iostream>
+#include <limits>
+#include <memory>
+
+#include "src/ast/ast-value-factory.h"
+#include "src/handles/handles-inl.h"
+#include "src/handles/handles.h"
+#include "src/heap/off-thread-factory.h"
+#include "src/objects/fixed-array.h"
+#include "src/objects/string.h"
+#include "test/unittests/test-utils.h"
+
+namespace v8 {
+namespace internal {
+
+class OffThreadFactoryTest : public TestWithIsolateAndZone {
+ public:
+  OffThreadFactoryTest()
+      : TestWithIsolateAndZone(), off_thread_factory_(isolate()) {}
+
+  OffThreadFactory* off_thread_factory() { return &off_thread_factory_; }
+
+  // We only internalize strings which are referred to in other slots, so create
+  // a wrapper pointing at the off_thread_string.
+  OffThreadHandle<FixedArray> WrapString(OffThreadHandle<String> string) {
+    // TODO(leszeks): Replace with a different factory method (e.g. FixedArray)
+    // once OffThreadFactory supports it.
+    return off_thread_factory()->StringWrapperForTest(string);
+  }
+
+ private:
+  OffThreadFactory off_thread_factory_;
+};
+
+TEST_F(OffThreadFactoryTest, HandleOrOffThreadHandle_IsNullWhenConstructed) {
+  // Default constructed HandleOrOffThreadHandles should be considered both null
+  // and uninitialized.
+  EXPECT_TRUE(HandleOrOffThreadHandle<HeapObject>().is_null());
+#ifdef DEBUG
+  EXPECT_TRUE(!HandleOrOffThreadHandle<HeapObject>().is_initialized());
+#endif
+
+  // Default constructed HandleOrOffThreadHandles should work as both null
+  // handles and null off-thread handles.
+  EXPECT_TRUE(HandleOrOffThreadHandle<HeapObject>().get<Factory>().is_null());
+  EXPECT_TRUE(
+      HandleOrOffThreadHandle<HeapObject>().get<OffThreadFactory>().is_null());
+}
+
+TEST_F(OffThreadFactoryTest, OneByteInternalizedString_IsAddedToStringTable) {
+  Vector<const uint8_t> string_vector = StaticCharVector("foo");
+  uint32_t hash_field = StringHasher::HashSequentialString<uint8_t>(
+      string_vector.begin(), string_vector.length(), HashSeed(isolate()));
+
+  OffThreadHandle<String> off_thread_string =
+      off_thread_factory()->NewOneByteInternalizedString(string_vector,
+                                                         hash_field);
+
+  OffThreadHandle<FixedArray> off_thread_wrapper =
+      off_thread_factory()->StringWrapperForTest(off_thread_string);
+
+  off_thread_factory()->FinishOffThread();
+
+  Handle<FixedArray> wrapper = handle(*off_thread_wrapper, isolate());
+  off_thread_factory()->Publish(isolate());
+
+  Handle<String> string = handle(String::cast(wrapper->get(0)), isolate());
+
+  EXPECT_TRUE(string->IsOneByteEqualTo(CStrVector("foo")));
+  EXPECT_TRUE(string->IsInternalizedString());
+
+  Handle<String> same_string = isolate()
+                                   ->factory()
+                                   ->NewStringFromOneByte(string_vector)
+                                   .ToHandleChecked();
+  EXPECT_NE(*string, *same_string);
+  EXPECT_FALSE(same_string->IsInternalizedString());
+
+  Handle<String> internalized_string =
+      isolate()->factory()->InternalizeString(same_string);
+  EXPECT_EQ(*string, *internalized_string);
+}
+
+TEST_F(OffThreadFactoryTest,
+       OneByteInternalizedString_DuplicateIsDeduplicated) {
+  Vector<const uint8_t> string_vector = StaticCharVector("foo");
+  uint32_t hash_field = StringHasher::HashSequentialString<uint8_t>(
+      string_vector.begin(), string_vector.length(), HashSeed(isolate()));
+
+  OffThreadHandle<String> off_thread_string_1 =
+      off_thread_factory()->NewOneByteInternalizedString(string_vector,
+                                                         hash_field);
+  OffThreadHandle<String> off_thread_string_2 =
+      off_thread_factory()->NewOneByteInternalizedString(string_vector,
+                                                         hash_field);
+
+  OffThreadHandle<FixedArray> off_thread_wrapper_1 =
+      WrapString(off_thread_string_1);
+  OffThreadHandle<FixedArray> off_thread_wrapper_2 =
+      WrapString(off_thread_string_2);
+
+  off_thread_factory()->FinishOffThread();
+
+  Handle<FixedArray> wrapper_1 = handle(*off_thread_wrapper_1, isolate());
+  Handle<FixedArray> wrapper_2 = handle(*off_thread_wrapper_2, isolate());
+  off_thread_factory()->Publish(isolate());
+
+  Handle<String> string_1 = handle(String::cast(wrapper_1->get(0)), isolate());
+  Handle<String> string_2 = handle(String::cast(wrapper_2->get(0)), isolate());
+
+  EXPECT_TRUE(string_1->IsOneByteEqualTo(CStrVector("foo")));
+  EXPECT_TRUE(string_1->IsInternalizedString());
+  EXPECT_EQ(*string_1, *string_2);
+}
+
+TEST_F(OffThreadFactoryTest, AstRawString_IsInternalized) {
+  AstValueFactory ast_value_factory(zone(), isolate()->ast_string_constants(),
+                                    HashSeed(isolate()));
+
+  const AstRawString* raw_string = ast_value_factory.GetOneByteString("foo");
+
+  ast_value_factory.Internalize(off_thread_factory());
+
+  OffThreadHandle<FixedArray> off_thread_wrapper =
+      WrapString(raw_string->string().get<OffThreadFactory>());
+
+  off_thread_factory()->FinishOffThread();
+
+  Handle<FixedArray> wrapper = handle(*off_thread_wrapper, isolate());
+  off_thread_factory()->Publish(isolate());
+
+  Handle<String> string = handle(String::cast(wrapper->get(0)), isolate());
+
+  EXPECT_TRUE(string->IsOneByteEqualTo(CStrVector("foo")));
+  EXPECT_TRUE(string->IsInternalizedString());
+}
+
+TEST_F(OffThreadFactoryTest, AstConsString_CreatesConsString) {
+  AstValueFactory ast_value_factory(zone(), isolate()->ast_string_constants(),
+                                    HashSeed(isolate()));
+
+  const AstRawString* foo_string = ast_value_factory.GetOneByteString("foo");
+  const AstRawString* bar_string =
+      ast_value_factory.GetOneByteString("bar-plus-padding-for-length");
+  const AstConsString* foobar_string =
+      ast_value_factory.NewConsString(foo_string, bar_string);
+
+  ast_value_factory.Internalize(off_thread_factory());
+
+  OffThreadHandle<FixedArray> off_thread_wrapper =
+      WrapString(foobar_string->string().get<OffThreadFactory>());
+
+  off_thread_factory()->FinishOffThread();
+
+  Handle<FixedArray> wrapper = handle(*off_thread_wrapper, isolate());
+  off_thread_factory()->Publish(isolate());
+
+  Handle<String> string = handle(String::cast(wrapper->get(0)), isolate());
+
+  EXPECT_TRUE(string->IsConsString());
+  EXPECT_TRUE(string->Equals(*isolate()->factory()->NewStringFromStaticChars(
+      "foobar-plus-padding-for-length")));
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/unittests/heap/slot-set-unittest.cc b/deps/v8/test/unittests/heap/slot-set-unittest.cc
index fa635705b3012c..b5e4a01ab44bfb 100644
--- a/deps/v8/test/unittests/heap/slot-set-unittest.cc
+++ b/deps/v8/test/unittests/heap/slot-set-unittest.cc
@@ -14,45 +14,78 @@
 namespace v8 {
 namespace internal {
 
+TEST(PossiblyEmptyBucketsTest, WordsForBuckets) {
+  EXPECT_EQ(
+      PossiblyEmptyBuckets::WordsForBuckets(PossiblyEmptyBuckets::kBitsPerWord),
+      1U);
+  EXPECT_EQ(PossiblyEmptyBuckets::WordsForBuckets(
+                PossiblyEmptyBuckets::kBitsPerWord - 1),
+            1U);
+  EXPECT_EQ(PossiblyEmptyBuckets::WordsForBuckets(
+                PossiblyEmptyBuckets::kBitsPerWord + 1),
+            2U);
+
+  EXPECT_EQ(PossiblyEmptyBuckets::WordsForBuckets(
+                5 * PossiblyEmptyBuckets::kBitsPerWord - 1),
+            5U);
+  EXPECT_EQ(PossiblyEmptyBuckets::WordsForBuckets(
+                5 * PossiblyEmptyBuckets::kBitsPerWord),
+            5U);
+  EXPECT_EQ(PossiblyEmptyBuckets::WordsForBuckets(
+                5 * PossiblyEmptyBuckets::kBitsPerWord + 1),
+            6U);
+}
+
+TEST(SlotSet, BucketsForSize) {
+  EXPECT_EQ(static_cast<size_t>(SlotSet::kBucketsRegularPage),
+            SlotSet::BucketsForSize(Page::kPageSize));
+
+  EXPECT_EQ(static_cast<size_t>(SlotSet::kBucketsRegularPage) * 2,
+            SlotSet::BucketsForSize(Page::kPageSize * 2));
+}
+
 TEST(SlotSet, InsertAndLookup1) {
-  SlotSet set;
+  SlotSet* set = SlotSet::Allocate(SlotSet::kBucketsRegularPage);
   for (int i = 0; i < Page::kPageSize; i += kTaggedSize) {
-    EXPECT_FALSE(set.Lookup(i));
+    EXPECT_FALSE(set->Lookup(i));
   }
   for (int i = 0; i < Page::kPageSize; i += kTaggedSize) {
-    set.Insert<AccessMode::ATOMIC>(i);
+    set->Insert<AccessMode::ATOMIC>(i);
   }
   for (int i = 0; i < Page::kPageSize; i += kTaggedSize) {
-    EXPECT_TRUE(set.Lookup(i));
+    EXPECT_TRUE(set->Lookup(i));
   }
+  SlotSet::Delete(set, SlotSet::kBucketsRegularPage);
 }
 
 TEST(SlotSet, InsertAndLookup2) {
-  SlotSet set;
+  SlotSet* set = SlotSet::Allocate(SlotSet::kBucketsRegularPage);
   for (int i = 0; i < Page::kPageSize; i += kTaggedSize) {
     if (i % 7 == 0) {
-      set.Insert<AccessMode::ATOMIC>(i);
+      set->Insert<AccessMode::ATOMIC>(i);
     }
   }
   for (int i = 0; i < Page::kPageSize; i += kTaggedSize) {
     if (i % 7 == 0) {
-      EXPECT_TRUE(set.Lookup(i));
+      EXPECT_TRUE(set->Lookup(i));
     } else {
-      EXPECT_FALSE(set.Lookup(i));
+      EXPECT_FALSE(set->Lookup(i));
     }
   }
+  SlotSet::Delete(set, SlotSet::kBucketsRegularPage);
 }
 
 TEST(SlotSet, Iterate) {
-  SlotSet set;
+  SlotSet* set = SlotSet::Allocate(SlotSet::kBucketsRegularPage);
+
   for (int i = 0; i < Page::kPageSize; i += kTaggedSize) {
     if (i % 7 == 0) {
-      set.Insert<AccessMode::ATOMIC>(i);
+      set->Insert<AccessMode::ATOMIC>(i);
     }
   }
 
-  set.Iterate(
-      kNullAddress,
+  set->Iterate(
+      kNullAddress, SlotSet::kBucketsRegularPage,
       [](MaybeObjectSlot slot) {
         if (slot.address() % 3 == 0) {
           return KEEP_SLOT;
@@ -64,56 +97,76 @@ TEST(SlotSet, Iterate) {
 
   for (int i = 0; i < Page::kPageSize; i += kTaggedSize) {
     if (i % 21 == 0) {
-      EXPECT_TRUE(set.Lookup(i));
+      EXPECT_TRUE(set->Lookup(i));
     } else {
-      EXPECT_FALSE(set.Lookup(i));
+      EXPECT_FALSE(set->Lookup(i));
     }
   }
+
+  SlotSet::Delete(set, SlotSet::kBucketsRegularPage);
 }
 
 TEST(SlotSet, Remove) {
-  SlotSet set;
+  SlotSet* set = SlotSet::Allocate(SlotSet::kBucketsRegularPage);
+
   for (int i = 0; i < Page::kPageSize; i += kTaggedSize) {
     if (i % 7 == 0) {
-      set.Insert<AccessMode::ATOMIC>(i);
+      set->Insert<AccessMode::ATOMIC>(i);
     }
   }
 
   for (int i = 0; i < Page::kPageSize; i += kTaggedSize) {
     if (i % 3 != 0) {
-      set.Remove(i);
+      set->Remove(i);
     }
   }
 
   for (int i = 0; i < Page::kPageSize; i += kTaggedSize) {
     if (i % 21 == 0) {
-      EXPECT_TRUE(set.Lookup(i));
+      EXPECT_TRUE(set->Lookup(i));
     } else {
-      EXPECT_FALSE(set.Lookup(i));
+      EXPECT_FALSE(set->Lookup(i));
     }
   }
+
+  SlotSet::Delete(set, SlotSet::kBucketsRegularPage);
+}
+
+TEST(PossiblyEmptyBuckets, ContainsAndInsert) {
+  static const int kBuckets = 100;
+  PossiblyEmptyBuckets possibly_empty_buckets;
+  possibly_empty_buckets.Insert(0, kBuckets);
+  int last = sizeof(uintptr_t) * kBitsPerByte - 2;
+  possibly_empty_buckets.Insert(last, kBuckets);
+  EXPECT_TRUE(possibly_empty_buckets.Contains(0));
+  EXPECT_TRUE(possibly_empty_buckets.Contains(last));
+  possibly_empty_buckets.Insert(last + 1, kBuckets);
+  EXPECT_TRUE(possibly_empty_buckets.Contains(0));
+  EXPECT_TRUE(possibly_empty_buckets.Contains(last));
+  EXPECT_TRUE(possibly_empty_buckets.Contains(last + 1));
 }
 
 void CheckRemoveRangeOn(uint32_t start, uint32_t end) {
-  SlotSet set;
+  SlotSet* set = SlotSet::Allocate(SlotSet::kBucketsRegularPage);
   uint32_t first = start == 0 ? 0 : start - kTaggedSize;
   uint32_t last = end == Page::kPageSize ? end - kTaggedSize : end;
   for (const auto mode :
        {SlotSet::FREE_EMPTY_BUCKETS, SlotSet::KEEP_EMPTY_BUCKETS}) {
     for (uint32_t i = first; i <= last; i += kTaggedSize) {
-      set.Insert<AccessMode::ATOMIC>(i);
+      set->Insert<AccessMode::ATOMIC>(i);
     }
-    set.RemoveRange(start, end, mode);
+    set->RemoveRange(start, end, SlotSet::kBucketsRegularPage, mode);
     if (first != start) {
-      EXPECT_TRUE(set.Lookup(first));
+      EXPECT_TRUE(set->Lookup(first));
     }
     if (last == end) {
-      EXPECT_TRUE(set.Lookup(last));
+      EXPECT_TRUE(set->Lookup(last));
     }
     for (uint32_t i = start; i < end; i += kTaggedSize) {
-      EXPECT_FALSE(set.Lookup(i));
+      EXPECT_FALSE(set->Lookup(i));
     }
   }
+  SlotSet::Delete(set, SlotSet::kBucketsRegularPage);
 }
 
 TEST(SlotSet, RemoveRange) {
@@ -132,15 +185,16 @@ TEST(SlotSet, RemoveRange) {
       }
     }
   }
-  SlotSet set;
+  SlotSet* set = SlotSet::Allocate(SlotSet::kBucketsRegularPage);
   for (const auto mode :
        {SlotSet::FREE_EMPTY_BUCKETS, SlotSet::KEEP_EMPTY_BUCKETS}) {
-    set.Insert<AccessMode::ATOMIC>(Page::kPageSize / 2);
-    set.RemoveRange(0, Page::kPageSize, mode);
+    set->Insert<AccessMode::ATOMIC>(Page::kPageSize / 2);
+    set->RemoveRange(0, Page::kPageSize, SlotSet::kBucketsRegularPage, mode);
     for (uint32_t i = 0; i < Page::kPageSize; i += kTaggedSize) {
-      EXPECT_FALSE(set.Lookup(i));
+      EXPECT_FALSE(set->Lookup(i));
     }
   }
+  SlotSet::Delete(set, SlotSet::kBucketsRegularPage);
 }
 
 TEST(TypedSlotSet, Iterate) {
diff --git a/deps/v8/test/unittests/heap/spaces-unittest.cc b/deps/v8/test/unittests/heap/spaces-unittest.cc
index c5acc6c43e17dd..296c85d7072d7f 100644
--- a/deps/v8/test/unittests/heap/spaces-unittest.cc
+++ b/deps/v8/test/unittests/heap/spaces-unittest.cc
@@ -2,9 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/heap/spaces.h"
+#include <memory>
+#include "src/common/globals.h"
 #include "src/execution/isolate.h"
 #include "src/heap/heap-inl.h"
 #include "src/heap/heap-write-barrier-inl.h"
+#include "src/heap/heap.h"
 #include "src/heap/spaces-inl.h"
 #include "test/unittests/test-utils.h"
 
@@ -19,7 +23,8 @@ TEST_F(SpacesTest, CompactionSpaceMerge) {
   EXPECT_TRUE(old_space != nullptr);
 
   CompactionSpace* compaction_space =
-      new CompactionSpace(heap, OLD_SPACE, NOT_EXECUTABLE);
+      new CompactionSpace(heap, OLD_SPACE, NOT_EXECUTABLE,
+                          LocalSpaceKind::kCompactionSpaceForMarkCompact);
   EXPECT_TRUE(compaction_space != nullptr);
 
   for (Page* p : *old_space) {
@@ -45,13 +50,235 @@ TEST_F(SpacesTest, CompactionSpaceMerge) {
   int pages_in_old_space = old_space->CountTotalPages();
   int pages_in_compaction_space = compaction_space->CountTotalPages();
   EXPECT_EQ(kExpectedPages, pages_in_compaction_space);
-  old_space->MergeCompactionSpace(compaction_space);
+  old_space->MergeLocalSpace(compaction_space);
   EXPECT_EQ(pages_in_old_space + pages_in_compaction_space,
             old_space->CountTotalPages());
 
   delete compaction_space;
 }
 
+class OffThreadAllocationThread final : public base::Thread {
+ public:
+  explicit OffThreadAllocationThread(Heap* heap)
+      : Thread(Options("OffThreadAllocationThread")), heap_(heap) {}
+  void Run() override {
+    off_thread_space_ = std::make_unique<OffThreadSpace>(heap_);
+    EXPECT_TRUE(off_thread_space_ != nullptr);
+
+    // Cannot loop until "Available()" since we initially have 0 bytes available
+    // and would thus neither grow, nor be able to allocate an object.
+    const int kNumObjects = 10;
+    const int kNumObjectsPerPage =
+        off_thread_space_->AreaSize() / kMaxRegularHeapObjectSize;
+    const int kExpectedPages =
+        (kNumObjects + kNumObjectsPerPage - 1) / kNumObjectsPerPage;
+    for (int i = 0; i < kNumObjects; i++) {
+      HeapObject object =
+          off_thread_space_->AllocateRawUnaligned(kMaxRegularHeapObjectSize)
+              .ToObjectChecked();
+      heap_->CreateFillerObjectAt(object.address(), kMaxRegularHeapObjectSize,
+                                  ClearRecordedSlots::kNo);
+    }
+    int pages_in_off_thread_space = off_thread_space_->CountTotalPages();
+    EXPECT_EQ(kExpectedPages, pages_in_off_thread_space);
+  }
+
+  OffThreadSpace* space() { return off_thread_space_.get(); }
+
+ private:
+  Heap* heap_;
+  std::unique_ptr<OffThreadSpace> off_thread_space_;
+};
+
+TEST_F(SpacesTest, OffThreadSpaceAllocate) {
+  Heap* heap = i_isolate()->heap();
+
+  static const int kNumThreads = 10;
+  std::unique_ptr<OffThreadAllocationThread> threads[10];
+  for (int i = 0; i < kNumThreads; ++i) {
+    threads[i] = std::make_unique<OffThreadAllocationThread>(heap);
+  }
+  for (int i = 0; i < kNumThreads; ++i) {
+    CHECK(threads[i]->Start());
+  }
+  for (int i = 0; i < kNumThreads; ++i) {
+    threads[i]->Join();
+  }
+}
+
+TEST_F(SpacesTest, OffThreadSpaceMerge) {
+  Heap* heap = i_isolate()->heap();
+  OldSpace* old_space = heap->old_space();
+  EXPECT_TRUE(old_space != nullptr);
+
+  static const int kNumThreads = 10;
+  std::unique_ptr<OffThreadAllocationThread> threads[10];
+  for (int i = 0; i < kNumThreads; ++i) {
+    threads[i] = std::make_unique<OffThreadAllocationThread>(heap);
+  }
+  for (int i = 0; i < kNumThreads; ++i) {
+    CHECK(threads[i]->Start());
+  }
+  for (int i = 0; i < kNumThreads; ++i) {
+    threads[i]->Join();
+  }
+
+  int pages_in_old_space = old_space->CountTotalPages();
+
+  int expected_merged_pages = 0;
+  for (int i = 0; i < kNumThreads; ++i) {
+    int pages_in_off_thread_space = threads[i]->space()->CountTotalPages();
+
+    old_space->MergeLocalSpace(threads[i]->space());
+    expected_merged_pages += pages_in_off_thread_space;
+  }
+
+  EXPECT_EQ(pages_in_old_space + expected_merged_pages,
+            old_space->CountTotalPages());
+}
+
+TEST_F(SpacesTest, OffThreadSpaceMergeDuringIncrementalMarking) {
+  Heap* heap = i_isolate()->heap();
+  OldSpace* old_space = heap->old_space();
+  EXPECT_TRUE(old_space != nullptr);
+
+  static const int kNumThreads = 10;
+  std::unique_ptr<OffThreadAllocationThread> threads[10];
+  for (int i = 0; i < kNumThreads; ++i) {
+    threads[i] = std::make_unique<OffThreadAllocationThread>(heap);
+  }
+  for (int i = 0; i < kNumThreads; ++i) {
+    CHECK(threads[i]->Start());
+  }
+  for (int i = 0; i < kNumThreads; ++i) {
+    threads[i]->Join();
+  }
+
+  heap->StartIncrementalMarking(Heap::kNoGCFlags,
+                                GarbageCollectionReason::kTesting);
+
+  int pages_in_old_space = old_space->CountTotalPages();
+
+  int expected_merged_pages = 0;
+  for (int i = 0; i < kNumThreads; ++i) {
+    int pages_in_off_thread_space = threads[i]->space()->CountTotalPages();
+
+    old_space->MergeLocalSpace(threads[i]->space());
+    expected_merged_pages += pages_in_off_thread_space;
+  }
+
+  heap->FinalizeIncrementalMarkingAtomically(GarbageCollectionReason::kTesting);
+
+  EXPECT_EQ(pages_in_old_space + expected_merged_pages,
+            old_space->CountTotalPages());
+}
+
+class LargeOffThreadAllocationThread final : public base::Thread {
+ public:
+  explicit LargeOffThreadAllocationThread(Heap* heap)
+      : Thread(Options("LargeOffThreadAllocationThread")), heap_(heap) {}
+  void Run() override {
+    off_thread_lo_space_ = std::make_unique<OffThreadLargeObjectSpace>(heap_);
+    EXPECT_TRUE(off_thread_lo_space_ != nullptr);
+
+    const int kNumObjects = 10;
+    const int kExpectedPages = kNumObjects;
+    for (int i = 0; i < kNumObjects; i++) {
+      HeapObject object =
+          off_thread_lo_space_
+              ->AllocateRaw(kMaxRegularHeapObjectSize + kTaggedSize)
+              .ToObjectChecked();
+      heap_->CreateFillerObjectAt(object.address(),
+                                  kMaxRegularHeapObjectSize + kTaggedSize,
+                                  ClearRecordedSlots::kNo);
+    }
+    int pages_in_off_thread_space = off_thread_lo_space_->PageCount();
+    EXPECT_EQ(kExpectedPages, pages_in_off_thread_space);
+  }
+
+  OffThreadLargeObjectSpace* space() { return off_thread_lo_space_.get(); }
+
+ private:
+  Heap* heap_;
+  std::unique_ptr<OffThreadLargeObjectSpace> off_thread_lo_space_;
+};
+
+TEST_F(SpacesTest, OffThreadLargeObjectSpaceAllocate) {
+  Heap* heap = i_isolate()->heap();
+
+  static const int kNumThreads = 10;
+  std::unique_ptr<LargeOffThreadAllocationThread> threads[10];
+  for (int i = 0; i < kNumThreads; ++i) {
+    threads[i] = std::make_unique<LargeOffThreadAllocationThread>(heap);
+  }
+  for (int i = 0; i < kNumThreads; ++i) {
+    CHECK(threads[i]->Start());
+  }
+  for (int i = 0; i < kNumThreads; ++i) {
+    threads[i]->Join();
+  }
+}
+
+TEST_F(SpacesTest, OffThreadLargeObjectSpaceMerge) {
+  Heap* heap = i_isolate()->heap();
+  OldLargeObjectSpace* lo_space = heap->lo_space();
+  EXPECT_TRUE(lo_space != nullptr);
+
+  static const int kNumThreads = 10;
+  std::unique_ptr<LargeOffThreadAllocationThread> threads[10];
+  for (int i = 0; i < kNumThreads; ++i) {
+    threads[i] = std::make_unique<LargeOffThreadAllocationThread>(heap);
+  }
+  for (int i = 0; i < kNumThreads; ++i) {
+    CHECK(threads[i]->Start());
+  }
+  for (int i = 0; i < kNumThreads; ++i) {
+    threads[i]->Join();
+  }
+
+  int pages_in_old_space = lo_space->PageCount();
+
+  int expected_merged_pages = 0;
+  for (int i = 0; i < kNumThreads; ++i) {
+    int pages_in_off_thread_space = threads[i]->space()->PageCount();
+
+    lo_space->MergeOffThreadSpace(threads[i]->space());
+    expected_merged_pages += pages_in_off_thread_space;
+  }
+
+  EXPECT_EQ(pages_in_old_space + expected_merged_pages, lo_space->PageCount());
+}
+
+TEST_F(SpacesTest, OffThreadLargeObjectSpaceMergeDuringIncrementalMarking) {
+  Heap* heap = i_isolate()->heap();
+  OldLargeObjectSpace* lo_space = heap->lo_space();
+  EXPECT_TRUE(lo_space != nullptr);
+
+  static const int kNumThreads = 10;
+  std::unique_ptr<LargeOffThreadAllocationThread> threads[10];
+  for (int i = 0; i < kNumThreads; ++i) {
+    threads[i] = std::make_unique<LargeOffThreadAllocationThread>(heap);
+  }
+  for (int i = 0; i < kNumThreads; ++i) {
+    CHECK(threads[i]->Start());
+  }
+  for (int i = 0; i < kNumThreads; ++i) {
+    threads[i]->Join();
+  }
+
+  int pages_in_old_space = lo_space->PageCount();
+
+  int expected_merged_pages = 0;
+  for (int i = 0; i < kNumThreads; ++i) {
+    int pages_in_off_thread_space = threads[i]->space()->PageCount();
+
+    lo_space->MergeOffThreadSpace(threads[i]->space());
+    expected_merged_pages += pages_in_off_thread_space;
+  }
+
+  EXPECT_EQ(pages_in_old_space + expected_merged_pages, lo_space->PageCount());
+}
+
 TEST_F(SpacesTest, WriteBarrierFromHeapObject) {
   constexpr Address address1 = Page::kPageSize;
   HeapObject object1 = HeapObject::unchecked_cast(Object(address1));
diff --git a/deps/v8/test/unittests/heap/unmapper-unittest.cc b/deps/v8/test/unittests/heap/unmapper-unittest.cc
index 6c3407b5356781..cd1344f8098629 100644
--- a/deps/v8/test/unittests/heap/unmapper-unittest.cc
+++ b/deps/v8/test/unittests/heap/unmapper-unittest.cc
@@ -242,6 +242,10 @@ class SequentialUnmapperTest : public TestWithIsolate {
     TestWithIsolate::TearDownTestCase();
     i::FLAG_concurrent_sweeping = old_flag_;
     CHECK(tracking_page_allocator_->IsEmpty());
+
+    // Restore the original v8::PageAllocator and delete the tracking one.
+    CHECK_EQ(tracking_page_allocator_,
+             SetPlatformPageAllocatorForTesting(old_page_allocator_));
     delete tracking_page_allocator_;
     tracking_page_allocator_ = nullptr;
   }
diff --git a/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc b/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc
index 667bfee64b5ac8..7591a30f6b890e 100644
--- a/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc
+++ b/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc
@@ -447,7 +447,7 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
 
   // Generate BytecodeArray.
   scope.SetScriptScopeInfo(factory->NewScopeInfo(1));
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   Handle<BytecodeArray> the_array = builder.ToBytecodeArray(isolate());
   CHECK_EQ(the_array->frame_size(),
            builder.total_register_count() * kSystemPointerSize);
@@ -493,7 +493,6 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
 #undef CHECK_BYTECODE_PRESENT
 }
 
-
 TEST_F(BytecodeArrayBuilderTest, FrameSizesLookGood) {
   for (int locals = 0; locals < 5; locals++) {
     for (int temps = 0; temps < 3; temps++) {
@@ -520,7 +519,6 @@ TEST_F(BytecodeArrayBuilderTest, FrameSizesLookGood) {
   }
 }
 
-
 TEST_F(BytecodeArrayBuilderTest, RegisterValues) {
   int index = 1;
 
@@ -532,7 +530,6 @@ TEST_F(BytecodeArrayBuilderTest, RegisterValues) {
   CHECK_EQ(actual_index, index);
 }
 
-
 TEST_F(BytecodeArrayBuilderTest, Parameters) {
   BytecodeArrayBuilder builder(zone(), 10, 0);
 
@@ -541,7 +538,6 @@ TEST_F(BytecodeArrayBuilderTest, Parameters) {
   CHECK_EQ(param8.index() - receiver.index(), 9);
 }
 
-
 TEST_F(BytecodeArrayBuilderTest, Constants) {
   BytecodeArrayBuilder builder(zone(), 1, 0);
   AstValueFactory ast_factory(zone(), isolate()->ast_string_constants(),
@@ -564,7 +560,7 @@ TEST_F(BytecodeArrayBuilderTest, Constants) {
       .LoadLiteral(nan)
       .Return();
 
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   Handle<BytecodeArray> array = builder.ToBytecodeArray(isolate());
   // Should only have one entry for each identical constant.
   EXPECT_EQ(4, array->constant_pool().length());
@@ -695,7 +691,6 @@ TEST_F(BytecodeArrayBuilderTest, ForwardJumps) {
   iterator.Advance();
 }
 
-
 TEST_F(BytecodeArrayBuilderTest, BackwardJumps) {
   BytecodeArrayBuilder builder(zone(), 1, 1);
 
diff --git a/deps/v8/test/unittests/interpreter/bytecode-array-iterator-unittest.cc b/deps/v8/test/unittests/interpreter/bytecode-array-iterator-unittest.cc
index b2eedd98074e81..23f0d08c1cf61c 100644
--- a/deps/v8/test/unittests/interpreter/bytecode-array-iterator-unittest.cc
+++ b/deps/v8/test/unittests/interpreter/bytecode-array-iterator-unittest.cc
@@ -73,7 +73,7 @@ TEST_F(BytecodeArrayIteratorTest, IteratesBytecodeArray) {
       .Return();
 
   // Test iterator sees the expected output from the builder.
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   BytecodeArrayIterator iterator(builder.ToBytecodeArray(isolate()));
   const int kPrefixByteSize = 1;
   int offset = 0;
diff --git a/deps/v8/test/unittests/interpreter/bytecode-array-random-iterator-unittest.cc b/deps/v8/test/unittests/interpreter/bytecode-array-random-iterator-unittest.cc
index 466062b56324b8..9553058d8d66bb 100644
--- a/deps/v8/test/unittests/interpreter/bytecode-array-random-iterator-unittest.cc
+++ b/deps/v8/test/unittests/interpreter/bytecode-array-random-iterator-unittest.cc
@@ -66,7 +66,7 @@ TEST_F(BytecodeArrayRandomIteratorTest, InvalidBeforeStart) {
       .Debugger()
       .Return();
 
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   Handle<BytecodeArray> bytecodeArray = builder.ToBytecodeArray(isolate());
   BytecodeArrayRandomIterator iterator(bytecodeArray, zone());
 
@@ -120,7 +120,7 @@ TEST_F(BytecodeArrayRandomIteratorTest, InvalidAfterEnd) {
       .Debugger()
       .Return();
 
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   Handle<BytecodeArray> bytecodeArray = builder.ToBytecodeArray(isolate());
   BytecodeArrayRandomIterator iterator(bytecodeArray, zone());
 
@@ -174,7 +174,7 @@ TEST_F(BytecodeArrayRandomIteratorTest, AccessesFirst) {
       .Debugger()
       .Return();
 
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   Handle<BytecodeArray> bytecodeArray = builder.ToBytecodeArray(isolate());
   BytecodeArrayRandomIterator iterator(bytecodeArray, zone());
 
@@ -233,7 +233,7 @@ TEST_F(BytecodeArrayRandomIteratorTest, AccessesLast) {
       .Debugger()
       .Return();
 
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   Handle<BytecodeArray> bytecodeArray = builder.ToBytecodeArray(isolate());
   BytecodeArrayRandomIterator iterator(bytecodeArray, zone());
 
@@ -294,7 +294,7 @@ TEST_F(BytecodeArrayRandomIteratorTest, RandomAccessValid) {
       .Return();
 
   // Test iterator sees the expected output from the builder.
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   BytecodeArrayRandomIterator iterator(builder.ToBytecodeArray(isolate()),
                                        zone());
   const int kPrefixByteSize = 1;
@@ -480,7 +480,7 @@ TEST_F(BytecodeArrayRandomIteratorTest, IteratesBytecodeArray) {
       .Return();
 
   // Test iterator sees the expected output from the builder.
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   BytecodeArrayRandomIterator iterator(builder.ToBytecodeArray(isolate()),
                                        zone());
   const int kPrefixByteSize = 1;
@@ -761,7 +761,7 @@ TEST_F(BytecodeArrayRandomIteratorTest, IteratesBytecodeArrayBackwards) {
       .Return();
 
   // Test iterator sees the expected output from the builder.
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   Handle<BytecodeArray> bytecodeArray = builder.ToBytecodeArray(isolate());
   BytecodeArrayRandomIterator iterator(bytecodeArray, zone());
   const int kPrefixByteSize = 1;
diff --git a/deps/v8/test/unittests/interpreter/constant-array-builder-unittest.cc b/deps/v8/test/unittests/interpreter/constant-array-builder-unittest.cc
index bfe83b03ca3f00..680479754adca9 100644
--- a/deps/v8/test/unittests/interpreter/constant-array-builder-unittest.cc
+++ b/deps/v8/test/unittests/interpreter/constant-array-builder-unittest.cc
@@ -40,7 +40,7 @@ TEST_F(ConstantArrayBuilderTest, AllocateAllEntries) {
     builder.Insert(i + 0.5);
   }
   CHECK_EQ(builder.size(), k16BitCapacity);
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   for (size_t i = 0; i < k16BitCapacity; i++) {
     CHECK_EQ(
         Handle<HeapNumber>::cast(builder.At(i, isolate()).ToHandleChecked())
@@ -90,7 +90,7 @@ TEST_F(ConstantArrayBuilderTest, ToLargeFixedArrayWithReservations) {
   for (int i = 0; i < kNumberOfElements; i++) {
     builder.CommitReservedEntry(builder.CreateReservedEntry(), Smi::FromInt(i));
   }
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   Handle<FixedArray> constant_array = builder.ToFixedArray(isolate());
   ASSERT_EQ(kNumberOfElements, constant_array->length());
   for (int i = 0; i < kNumberOfElements; i++) {
@@ -149,7 +149,7 @@ TEST_F(ConstantArrayBuilderTest, AllocateEntriesWithIdx8Reservations) {
       builder.DiscardReservedEntry(OperandSize::kByte);
     }
 
-    ast_factory.Internalize(isolate());
+    ast_factory.Internalize(isolate()->factory());
     Handle<FixedArray> constant_array = builder.ToFixedArray(isolate());
     CHECK_EQ(constant_array->length(),
              static_cast<int>(2 * k8BitCapacity + reserved));
@@ -203,7 +203,7 @@ TEST_F(ConstantArrayBuilderTest, AllocateEntriesWithWideReservations) {
       CHECK_EQ(builder.size(), i + 1);
     }
 
-    ast_factory.Internalize(isolate());
+    ast_factory.Internalize(isolate()->factory());
     Handle<FixedArray> constant_array = builder.ToFixedArray(isolate());
     CHECK_EQ(constant_array->length(),
              static_cast<int>(k8BitCapacity + reserved));
@@ -234,7 +234,7 @@ TEST_F(ConstantArrayBuilderTest, GapFilledWhenLowReservationCommitted) {
                                 Smi::FromInt(static_cast<int>(i)));
     CHECK_EQ(builder.size(), 2 * k8BitCapacity);
   }
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   Handle<FixedArray> constant_array = builder.ToFixedArray(isolate());
   CHECK_EQ(constant_array->length(), static_cast<int>(2 * k8BitCapacity));
   for (size_t i = 0; i < k8BitCapacity; i++) {
@@ -300,7 +300,7 @@ TEST_F(ConstantArrayBuilderTest, HolesWithUnusedReservations) {
     builder.DiscardReservedEntry(OperandSize::kByte);
   }
 
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   Handle<FixedArray> constant_array = builder.ToFixedArray(isolate());
   CHECK_EQ(constant_array->length(), k8BitCapacity + 1);
   for (int i = kNumberOfHoles; i < k8BitCapacity; i++) {
@@ -343,7 +343,7 @@ TEST_F(ConstantArrayBuilderTest, ReservationsAtAllScales) {
     builder.DiscardReservedEntry(OperandSize::kQuad);
   }
 
-  ast_factory.Internalize(isolate());
+  ast_factory.Internalize(isolate()->factory());
   Handle<FixedArray> constant_array = builder.ToFixedArray(isolate());
   CHECK_EQ(constant_array->length(), 65537);
   int count = 1;
diff --git a/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.cc b/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.cc
index 09d21e3095eb82..ebc6790a401a38 100644
--- a/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.cc
+++ b/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.cc
@@ -46,7 +46,7 @@ InterpreterAssemblerTest::InterpreterAssemblerForTest::
     GetAccumulator();
   }
   if (Bytecodes::WritesAccumulator(bytecode())) {
-    SetAccumulator(nullptr);
+    SetAccumulator(NullConstant());
   }
 }
 
@@ -406,20 +406,6 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadConstantPoolEntry) {
     {
       TNode<IntPtrT> index = m.IntPtrConstant(2);
       TNode<Object> load_constant = m.LoadConstantPoolEntry(index);
-      if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-        Matcher<Node*> constant_pool_matcher =
-            IsChangeCompressedToTagged(m.IsLoadFromObject(
-                MachineType::AnyCompressed(),
-                c::IsParameter(InterpreterDispatchDescriptor::kBytecodeArray),
-                c::IsIntPtrConstant(BytecodeArray::kConstantPoolOffset -
-                                    kHeapObjectTag)));
-        EXPECT_THAT(load_constant,
-                    IsChangeCompressedToTagged(m.IsLoad(
-                        MachineType::AnyCompressed(), constant_pool_matcher,
-                        c::IsIntPtrConstant(FixedArray::OffsetOfElementAt(2) -
-                                            kHeapObjectTag),
-                        LoadSensitivity::kCritical)));
-      } else {
         Matcher<Node*> constant_pool_matcher = m.IsLoadFromObject(
             MachineType::AnyTagged(),
             c::IsParameter(InterpreterDispatchDescriptor::kBytecodeArray),
@@ -431,29 +417,11 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadConstantPoolEntry) {
                      c::IsIntPtrConstant(FixedArray::OffsetOfElementAt(2) -
                                          kHeapObjectTag),
                      LoadSensitivity::kCritical));
-      }
     }
     {
       Node* index = m.Parameter(2);
       TNode<Object> load_constant =
           m.LoadConstantPoolEntry(m.ReinterpretCast<IntPtrT>(index));
-      if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-        Matcher<Node*> constant_pool_matcher =
-            IsChangeCompressedToTagged(m.IsLoadFromObject(
-                MachineType::AnyCompressed(),
-                c::IsParameter(InterpreterDispatchDescriptor::kBytecodeArray),
-                c::IsIntPtrConstant(BytecodeArray::kConstantPoolOffset -
-                                    kHeapObjectTag)));
-        EXPECT_THAT(
-            load_constant,
-            IsChangeCompressedToTagged(m.IsLoad(
-                MachineType::AnyCompressed(), constant_pool_matcher,
-                c::IsIntPtrAdd(
-                    c::IsIntPtrConstant(FixedArray::kHeaderSize -
-                                        kHeapObjectTag),
-                    c::IsWordShl(index, c::IsIntPtrConstant(kTaggedSizeLog2))),
-                LoadSensitivity::kCritical)));
-      } else {
         Matcher<Node*> constant_pool_matcher = m.IsLoadFromObject(
             MachineType::AnyTagged(),
             c::IsParameter(InterpreterDispatchDescriptor::kBytecodeArray),
@@ -468,7 +436,6 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadConstantPoolEntry) {
                                         kHeapObjectTag),
                     c::IsWordShl(index, c::IsIntPtrConstant(kTaggedSizeLog2))),
                 LoadSensitivity::kCritical));
-      }
     }
   }
 }
@@ -481,17 +448,10 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadObjectField) {
         m.ReinterpretCast<HeapObject>(m.IntPtrConstant(0xDEADBEEF));
     int offset = 16;
     TNode<Object> load_field = m.LoadObjectField(object, offset);
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      EXPECT_THAT(load_field,
-                  IsChangeCompressedToTagged(m.IsLoadFromObject(
-                      MachineType::AnyCompressed(), Eq(object),
-                      c::IsIntPtrConstant(offset - kHeapObjectTag))));
-    } else {
       EXPECT_THAT(
           load_field,
           m.IsLoadFromObject(MachineType::AnyTagged(), Eq(object),
                              c::IsIntPtrConstant(offset - kHeapObjectTag)));
-    }
   }
 }
 
@@ -573,18 +533,6 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadFeedbackVector) {
         m.IsLoad(MachineType::Pointer(), c::IsLoadParentFramePointer(),
                  c::IsIntPtrConstant(Register::function_closure().ToOperand() *
                                      kSystemPointerSize)));
-    if (COMPRESS_POINTERS_BOOL && FLAG_turbo_decompression_elimination) {
-      Matcher<Node*> load_vector_cell_matcher =
-          IsChangeCompressedPointerToTaggedPointer(m.IsLoadFromObject(
-              MachineType::CompressedPointer(), load_function_matcher,
-              c::IsIntPtrConstant(JSFunction::kFeedbackCellOffset -
-                                  kHeapObjectTag)));
-      EXPECT_THAT(
-          load_feedback_vector,
-          IsChangeCompressedPointerToTaggedPointer(m.IsLoadFromObject(
-              MachineType::CompressedPointer(), load_vector_cell_matcher,
-              c::IsIntPtrConstant(Cell::kValueOffset - kHeapObjectTag))));
-    } else {
       Matcher<Node*> load_vector_cell_matcher = m.IsLoadFromObject(
           MachineType::TaggedPointer(), load_function_matcher,
           c::IsIntPtrConstant(JSFunction::kFeedbackCellOffset -
@@ -594,7 +542,6 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadFeedbackVector) {
           m.IsLoadFromObject(
               MachineType::TaggedPointer(), load_vector_cell_matcher,
               c::IsIntPtrConstant(Cell::kValueOffset - kHeapObjectTag)));
-    }
   }
 }
 
diff --git a/deps/v8/test/unittests/libplatform/default-platform-unittest.cc b/deps/v8/test/unittests/libplatform/default-platform-unittest.cc
index cb219a4737aa21..2aa43de1adec96 100644
--- a/deps/v8/test/unittests/libplatform/default-platform-unittest.cc
+++ b/deps/v8/test/unittests/libplatform/default-platform-unittest.cc
@@ -45,196 +45,176 @@ class DefaultPlatformWithMockTime : public DefaultPlatform {
 
 double DefaultPlatformWithMockTime::mock_time_ = 0.0;
 
-}  // namespace
+template <typename Platform>
+class PlatformTest : public ::testing::Test {
+ public:
+  Isolate* isolate() { return reinterpret_cast<Isolate*>(dummy_); }
 
+  Platform* platform() { return &platform_; }
 
-TEST(DefaultPlatformTest, PumpMessageLoop) {
-  InSequence s;
+  std::shared_ptr<TaskRunner> task_runner() {
+    if (!task_runner_) {
+      task_runner_ = platform_.GetForegroundTaskRunner(isolate());
+    }
+    DCHECK_NOT_NULL(task_runner_);
+    return task_runner_;
+  }
 
-  int dummy;
-  Isolate* isolate = reinterpret_cast<Isolate*>(&dummy);
+  // These methods take ownership of the task. Tests might still reference them,
+  // if the tasks are expected to still exist.
+  void CallOnForegroundThread(Task* task) {
+    task_runner()->PostTask(std::unique_ptr<Task>(task));
+  }
+  void CallNonNestableOnForegroundThread(Task* task) {
+    task_runner()->PostNonNestableTask(std::unique_ptr<Task>(task));
+  }
+  void CallDelayedOnForegroundThread(Task* task, double delay_in_seconds) {
+    task_runner()->PostDelayedTask(std::unique_ptr<Task>(task),
+                                   delay_in_seconds);
+  }
+  void CallIdleOnForegroundThread(IdleTask* task) {
+    task_runner()->PostIdleTask(std::unique_ptr<IdleTask>(task));
+  }
 
-  DefaultPlatform platform;
-  EXPECT_FALSE(platform.PumpMessageLoop(isolate));
+  bool PumpMessageLoop() { return platform_.PumpMessageLoop(isolate()); }
+
+ private:
+  Platform platform_;
+  InSequence in_sequence_;
+  std::shared_ptr<TaskRunner> task_runner_;
+
+  int dummy_ = 0;
+};
+
+class DefaultPlatformTest : public PlatformTest<DefaultPlatform> {};
+class DefaultPlatformTestWithMockTime
+    : public PlatformTest<DefaultPlatformWithMockTime> {};
+
+}  // namespace
+
+TEST_F(DefaultPlatformTest, PumpMessageLoop) {
+  EXPECT_FALSE(platform()->PumpMessageLoop(isolate()));
 
   StrictMock<MockTask>* task = new StrictMock<MockTask>;
-  platform.CallOnForegroundThread(isolate, task);
+  CallOnForegroundThread(task);
   EXPECT_CALL(*task, Run());
   EXPECT_CALL(*task, Die());
-  EXPECT_TRUE(platform.PumpMessageLoop(isolate));
-  EXPECT_FALSE(platform.PumpMessageLoop(isolate));
+  EXPECT_TRUE(PumpMessageLoop());
+  EXPECT_FALSE(PumpMessageLoop());
 }
 
-TEST(DefaultPlatformTest, PumpMessageLoopWithTaskRunner) {
-  InSequence s;
-
-  int dummy;
-  Isolate* isolate = reinterpret_cast<Isolate*>(&dummy);
-
-  DefaultPlatform platform;
+TEST_F(DefaultPlatformTest, PumpMessageLoopWithTaskRunner) {
   std::shared_ptr<TaskRunner> taskrunner =
-      platform.GetForegroundTaskRunner(isolate);
-  EXPECT_FALSE(platform.PumpMessageLoop(isolate));
+      platform()->GetForegroundTaskRunner(isolate());
+  EXPECT_FALSE(PumpMessageLoop());
 
   StrictMock<MockTask>* task = new StrictMock<MockTask>;
   taskrunner->PostTask(std::unique_ptr<Task>(task));
   EXPECT_CALL(*task, Run());
   EXPECT_CALL(*task, Die());
-  EXPECT_TRUE(platform.PumpMessageLoop(isolate));
-  EXPECT_FALSE(platform.PumpMessageLoop(isolate));
+  EXPECT_TRUE(PumpMessageLoop());
+  EXPECT_FALSE(PumpMessageLoop());
 }
 
-TEST(DefaultPlatformTest, PumpMessageLoopDelayed) {
-  InSequence s;
-
-  int dummy;
-  Isolate* isolate = reinterpret_cast<Isolate*>(&dummy);
-
-  DefaultPlatformWithMockTime platform;
-  EXPECT_FALSE(platform.PumpMessageLoop(isolate));
-
-  StrictMock<MockTask>* task1 = new StrictMock<MockTask>;
-  StrictMock<MockTask>* task2 = new StrictMock<MockTask>;
-  platform.CallDelayedOnForegroundThread(isolate, task2, 100);
-  platform.CallDelayedOnForegroundThread(isolate, task1, 10);
-
-  EXPECT_FALSE(platform.PumpMessageLoop(isolate));
-
-  platform.IncreaseTime(11);
-  EXPECT_CALL(*task1, Run());
-  EXPECT_CALL(*task1, Die());
-  EXPECT_TRUE(platform.PumpMessageLoop(isolate));
-
-  EXPECT_FALSE(platform.PumpMessageLoop(isolate));
-
-  platform.IncreaseTime(90);
-  EXPECT_CALL(*task2, Run());
-  EXPECT_CALL(*task2, Die());
-  EXPECT_TRUE(platform.PumpMessageLoop(isolate));
+TEST_F(DefaultPlatformTest, PumpMessageLoopNested) {
+  EXPECT_FALSE(PumpMessageLoop());
+
+  StrictMock<MockTask>* nestable_task1 = new StrictMock<MockTask>;
+  StrictMock<MockTask>* non_nestable_task2 = new StrictMock<MockTask>;
+  StrictMock<MockTask>* nestable_task3 = new StrictMock<MockTask>;
+  StrictMock<MockTask>* non_nestable_task4 = new StrictMock<MockTask>;
+  CallOnForegroundThread(nestable_task1);
+  CallNonNestableOnForegroundThread(non_nestable_task2);
+  CallOnForegroundThread(nestable_task3);
+  CallNonNestableOnForegroundThread(non_nestable_task4);
+
+  // Nestable tasks are FIFO; non-nestable tasks are FIFO. A task being
+  // non-nestable may cause it to be executed later, but not earlier.
+  EXPECT_CALL(*nestable_task1, Run).WillOnce([this]() {
+    EXPECT_TRUE(PumpMessageLoop());
+  });
+  EXPECT_CALL(*nestable_task3, Run());
+  EXPECT_CALL(*nestable_task3, Die());
+  EXPECT_CALL(*nestable_task1, Die());
+  EXPECT_TRUE(PumpMessageLoop());
+  EXPECT_CALL(*non_nestable_task2, Run());
+  EXPECT_CALL(*non_nestable_task2, Die());
+  EXPECT_TRUE(PumpMessageLoop());
+  EXPECT_CALL(*non_nestable_task4, Run());
+  EXPECT_CALL(*non_nestable_task4, Die());
+  EXPECT_TRUE(PumpMessageLoop());
+
+  EXPECT_FALSE(PumpMessageLoop());
 }
 
-TEST(DefaultPlatformTest, PumpMessageLoopDelayedWithTaskRunner) {
-  InSequence s;
-
-  int dummy;
-  Isolate* isolate = reinterpret_cast<Isolate*>(&dummy);
-
-  DefaultPlatformWithMockTime platform;
-  std::shared_ptr<TaskRunner> taskrunner =
-      platform.GetForegroundTaskRunner(isolate);
-  EXPECT_FALSE(platform.PumpMessageLoop(isolate));
+TEST_F(DefaultPlatformTestWithMockTime, PumpMessageLoopDelayed) {
+  EXPECT_FALSE(PumpMessageLoop());
 
   StrictMock<MockTask>* task1 = new StrictMock<MockTask>;
   StrictMock<MockTask>* task2 = new StrictMock<MockTask>;
-  taskrunner->PostDelayedTask(std::unique_ptr<Task>(task2), 100);
-  taskrunner->PostDelayedTask(std::unique_ptr<Task>(task1), 10);
+  CallDelayedOnForegroundThread(task2, 100);
+  CallDelayedOnForegroundThread(task1, 10);
 
-  EXPECT_FALSE(platform.PumpMessageLoop(isolate));
+  EXPECT_FALSE(PumpMessageLoop());
 
-  platform.IncreaseTime(11);
+  platform()->IncreaseTime(11);
   EXPECT_CALL(*task1, Run());
   EXPECT_CALL(*task1, Die());
-  EXPECT_TRUE(platform.PumpMessageLoop(isolate));
+  EXPECT_TRUE(PumpMessageLoop());
 
-  EXPECT_FALSE(platform.PumpMessageLoop(isolate));
+  EXPECT_FALSE(PumpMessageLoop());
 
-  platform.IncreaseTime(90);
+  platform()->IncreaseTime(90);
   EXPECT_CALL(*task2, Run());
   EXPECT_CALL(*task2, Die());
-  EXPECT_TRUE(platform.PumpMessageLoop(isolate));
+  EXPECT_TRUE(PumpMessageLoop());
 }
 
-TEST(DefaultPlatformTest, PumpMessageLoopNoStarvation) {
-  InSequence s;
-
-  int dummy;
-  Isolate* isolate = reinterpret_cast<Isolate*>(&dummy);
-
-  DefaultPlatformWithMockTime platform;
-  EXPECT_FALSE(platform.PumpMessageLoop(isolate));
+TEST_F(DefaultPlatformTestWithMockTime, PumpMessageLoopNoStarvation) {
+  EXPECT_FALSE(PumpMessageLoop());
 
   StrictMock<MockTask>* task1 = new StrictMock<MockTask>;
   StrictMock<MockTask>* task2 = new StrictMock<MockTask>;
   StrictMock<MockTask>* task3 = new StrictMock<MockTask>;
-  platform.CallOnForegroundThread(isolate, task1);
-  platform.CallDelayedOnForegroundThread(isolate, task2, 10);
-  platform.IncreaseTime(11);
+  CallOnForegroundThread(task1);
+  CallDelayedOnForegroundThread(task2, 10);
+  platform()->IncreaseTime(11);
 
   EXPECT_CALL(*task1, Run());
   EXPECT_CALL(*task1, Die());
-  EXPECT_TRUE(platform.PumpMessageLoop(isolate));
+  EXPECT_TRUE(PumpMessageLoop());
 
-  platform.CallOnForegroundThread(isolate, task3);
+  CallOnForegroundThread(task3);
 
   EXPECT_CALL(*task2, Run());
   EXPECT_CALL(*task2, Die());
-  EXPECT_TRUE(platform.PumpMessageLoop(isolate));
+  EXPECT_TRUE(PumpMessageLoop());
   EXPECT_CALL(*task3, Run());
   EXPECT_CALL(*task3, Die());
-  EXPECT_TRUE(platform.PumpMessageLoop(isolate));
+  EXPECT_TRUE(PumpMessageLoop());
 }
 
-
-TEST(DefaultPlatformTest, PendingDelayedTasksAreDestroyedOnShutdown) {
-  InSequence s;
-
-  int dummy;
-  Isolate* isolate = reinterpret_cast<Isolate*>(&dummy);
-
-  {
-    DefaultPlatformWithMockTime platform;
-    StrictMock<MockTask>* task = new StrictMock<MockTask>;
-    platform.CallDelayedOnForegroundThread(isolate, task, 10);
-    EXPECT_CALL(*task, Die());
-  }
+TEST_F(DefaultPlatformTestWithMockTime,
+       PendingDelayedTasksAreDestroyedOnShutdown) {
+  StrictMock<MockTask>* task = new StrictMock<MockTask>;
+  CallDelayedOnForegroundThread(task, 10);
+  EXPECT_CALL(*task, Die());
 }
 
-TEST(DefaultPlatformTest, RunIdleTasks) {
-  InSequence s;
-
-  int dummy;
-  Isolate* isolate = reinterpret_cast<Isolate*>(&dummy);
-
-  DefaultPlatformWithMockTime platform;
-
+TEST_F(DefaultPlatformTestWithMockTime, RunIdleTasks) {
   StrictMock<MockIdleTask>* task = new StrictMock<MockIdleTask>;
-  platform.CallIdleOnForegroundThread(isolate, task);
+  CallIdleOnForegroundThread(task);
   EXPECT_CALL(*task, Run(42.0 + 23.0));
   EXPECT_CALL(*task, Die());
-  platform.IncreaseTime(23.0);
-  platform.RunIdleTasks(isolate, 42.0);
+  platform()->IncreaseTime(23.0);
+  platform()->RunIdleTasks(isolate(), 42.0);
 }
 
-TEST(DefaultPlatformTest, RunIdleTasksWithTaskRunner) {
-  InSequence s;
-
-  int dummy;
-  Isolate* isolate = reinterpret_cast<Isolate*>(&dummy);
-
-  DefaultPlatformWithMockTime platform;
-  std::shared_ptr<TaskRunner> taskrunner =
-      platform.GetForegroundTaskRunner(isolate);
-
+TEST_F(DefaultPlatformTestWithMockTime,
+       PendingIdleTasksAreDestroyedOnShutdown) {
   StrictMock<MockIdleTask>* task = new StrictMock<MockIdleTask>;
-  taskrunner->PostIdleTask(std::unique_ptr<IdleTask>(task));
-  EXPECT_CALL(*task, Run(42.0 + 23.0));
+  CallIdleOnForegroundThread(task);
   EXPECT_CALL(*task, Die());
-  platform.IncreaseTime(23.0);
-  platform.RunIdleTasks(isolate, 42.0);
-}
-
-TEST(DefaultPlatformTest, PendingIdleTasksAreDestroyedOnShutdown) {
-  InSequence s;
-
-  int dummy;
-  Isolate* isolate = reinterpret_cast<Isolate*>(&dummy);
-
-  {
-    DefaultPlatformWithMockTime platform;
-    StrictMock<MockIdleTask>* task = new StrictMock<MockIdleTask>;
-    platform.CallIdleOnForegroundThread(isolate, task);
-    EXPECT_CALL(*task, Die());
-  }
 }
 
 namespace {
@@ -259,7 +239,7 @@ class TestBackgroundTask : public Task {
 
 }  // namespace
 
-TEST(DefaultPlatformTest, RunBackgroundTask) {
+TEST(CustomDefaultPlatformTest, RunBackgroundTask) {
   DefaultPlatform platform;
   platform.SetThreadPoolSize(1);
 
@@ -273,7 +253,7 @@ TEST(DefaultPlatformTest, RunBackgroundTask) {
   EXPECT_TRUE(task_executed);
 }
 
-TEST(DefaultPlatformTest, PostForegroundTaskAfterPlatformTermination) {
+TEST(CustomDefaultPlatformTest, PostForegroundTaskAfterPlatformTermination) {
   std::shared_ptr<TaskRunner> foreground_taskrunner;
   {
     DefaultPlatformWithMockTime platform;
diff --git a/deps/v8/test/unittests/libplatform/default-worker-threads-task-runner-unittest.cc b/deps/v8/test/unittests/libplatform/default-worker-threads-task-runner-unittest.cc
index e9581cc80e7d17..8b00a407983f05 100644
--- a/deps/v8/test/unittests/libplatform/default-worker-threads-task-runner-unittest.cc
+++ b/deps/v8/test/unittests/libplatform/default-worker-threads-task-runner-unittest.cc
@@ -4,6 +4,7 @@
 
 #include "src/libplatform/default-worker-threads-task-runner.h"
 
+#include <algorithm>
 #include <vector>
 
 #include "include/v8-platform.h"
@@ -274,25 +275,5 @@ TEST(DefaultWorkerThreadsTaskRunnerUnittest, NoIdleTasks) {
   runner.Terminate();
 }
 
-TEST(DefaultWorkerThreadsTaskRunnerUnittest, RunsTasksOnCurrentThread) {
-  DefaultWorkerThreadsTaskRunner runner(1, RealTime);
-
-  base::Semaphore semaphore(0);
-
-  EXPECT_FALSE(runner.RunsTasksOnCurrentThread());
-
-  std::unique_ptr<TestTask> task1 = std::make_unique<TestTask>([&] {
-    EXPECT_TRUE(runner.RunsTasksOnCurrentThread());
-    semaphore.Signal();
-  });
-  runner.PostTask(std::move(task1));
-
-  semaphore.Wait();
-  EXPECT_FALSE(runner.RunsTasksOnCurrentThread());
-
-  runner.Terminate();
-  EXPECT_FALSE(runner.RunsTasksOnCurrentThread());
-}
-
 }  // namespace platform
 }  // namespace v8
diff --git a/deps/v8/test/unittests/objects/object-unittest.cc b/deps/v8/test/unittests/objects/object-unittest.cc
index b1768e09235afa..7fb606b0a20f3d 100644
--- a/deps/v8/test/unittests/objects/object-unittest.cc
+++ b/deps/v8/test/unittests/objects/object-unittest.cc
@@ -179,5 +179,43 @@ TEST_F(TestWithNativeContext, EmptyFunctionScopeInfo) {
             empty_function_scope_info->ContextLocalCount());
 }
 
+TEST_F(TestWithNativeContext, RecreateScopeInfoWithLocalsBlacklistWorks) {
+  // Create a JSFunction to get a {ScopeInfo} we can use for the test.
+  Handle<JSFunction> function = RunJS<JSFunction>("(function foo() {})");
+  Handle<ScopeInfo> original_scope_info(function->shared().scope_info(),
+                                        isolate());
+  ASSERT_FALSE(original_scope_info->HasLocalsBlackList());
+
+  Handle<String> foo_string =
+      isolate()->factory()->NewStringFromStaticChars("foo");
+  Handle<String> bar_string =
+      isolate()->factory()->NewStringFromStaticChars("bar");
+
+  Handle<StringSet> blacklist = StringSet::New(isolate());
+  StringSet::Add(isolate(), blacklist, foo_string);
+
+  Handle<ScopeInfo> scope_info = ScopeInfo::RecreateWithBlackList(
+      isolate(), original_scope_info, blacklist);
+
+  DisallowHeapAllocation no_gc;
+  EXPECT_TRUE(scope_info->HasLocalsBlackList());
+  EXPECT_TRUE(scope_info->LocalsBlackList().Has(isolate(), foo_string));
+  EXPECT_FALSE(scope_info->LocalsBlackList().Has(isolate(), bar_string));
+
+  EXPECT_EQ(original_scope_info->length() + 1, scope_info->length());
+
+  // Check that all variable fields *before* the blacklist stayed the same.
+  for (int i = ScopeInfo::kVariablePartIndex;
+       i < scope_info->LocalsBlackListIndex(); ++i) {
+    EXPECT_EQ(original_scope_info->get(i), scope_info->get(i));
+  }
+
+  // Check that all variable fields *after* the blacklist stayed the same.
+  for (int i = scope_info->LocalsBlackListIndex() + 1; i < scope_info->length();
+       ++i) {
+    EXPECT_EQ(original_scope_info->get(i - 1), scope_info->get(i));
+  }
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/objects/value-serializer-unittest.cc b/deps/v8/test/unittests/objects/value-serializer-unittest.cc
index d5583d5a69cc1e..fac266d3f99938 100644
--- a/deps/v8/test/unittests/objects/value-serializer-unittest.cc
+++ b/deps/v8/test/unittests/objects/value-serializer-unittest.cc
@@ -13,6 +13,7 @@
 #include "src/objects/backing-store.h"
 #include "src/objects/objects-inl.h"
 #include "src/wasm/wasm-objects.h"
+#include "src/wasm/wasm-result.h"
 #include "test/unittests/test-utils.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -76,9 +77,6 @@ class ValueSerializerTest : public TestWithIsolate {
     return deserialization_context_;
   }
 
-  bool ExpectInlineWasm() const { return expect_inline_wasm_; }
-  void SetExpectInlineWasm(bool value) { expect_inline_wasm_ = value; }
-
   // Overridden in more specific fixtures.
   virtual ValueSerializer::Delegate* GetSerializerDelegate() { return nullptr; }
   virtual void BeforeEncode(ValueSerializer*) {}
@@ -165,7 +163,6 @@ class ValueSerializerTest : public TestWithIsolate {
                                    static_cast<int>(data.size()),
                                    GetDeserializerDelegate());
     deserializer.SetSupportsLegacyWireFormat(true);
-    deserializer.SetExpectInlineWasm(ExpectInlineWasm());
     BeforeDecode(&deserializer);
     CHECK(deserializer.ReadHeader(context).FromMaybe(false));
     Local<Value> result;
@@ -187,7 +184,6 @@ class ValueSerializerTest : public TestWithIsolate {
                                    static_cast<int>(data.size()),
                                    GetDeserializerDelegate());
     deserializer.SetSupportsLegacyWireFormat(true);
-    deserializer.SetExpectInlineWasm(ExpectInlineWasm());
     BeforeDecode(&deserializer);
     CHECK(deserializer.ReadHeader(context).FromMaybe(false));
     CHECK_EQ(0u, deserializer.GetWireFormatVersion());
@@ -210,7 +206,6 @@ class ValueSerializerTest : public TestWithIsolate {
                                    static_cast<int>(data.size()),
                                    GetDeserializerDelegate());
     deserializer.SetSupportsLegacyWireFormat(true);
-    deserializer.SetExpectInlineWasm(ExpectInlineWasm());
     BeforeDecode(&deserializer);
     Maybe<bool> header_result = deserializer.ReadHeader(context);
     if (header_result.IsNothing()) {
@@ -259,8 +254,11 @@ class ValueSerializerTest : public TestWithIsolate {
 
   Local<Object> NewDummyUint8Array() {
     static uint8_t data[] = {4, 5, 6};
+    std::unique_ptr<v8::BackingStore> backing_store =
+        ArrayBuffer::NewBackingStore(
+            data, sizeof(data), [](void*, size_t, void*) {}, nullptr);
     Local<ArrayBuffer> ab =
-        ArrayBuffer::New(isolate(), static_cast<void*>(data), sizeof(data));
+        ArrayBuffer::New(isolate(), std::move(backing_store));
     return Uint8Array::New(ab, 0, sizeof(data));
   }
 
@@ -269,7 +267,6 @@ class ValueSerializerTest : public TestWithIsolate {
   Local<Context> deserialization_context_;
   Local<FunctionTemplate> host_object_constructor_template_;
   i::Isolate* isolate_;
-  bool expect_inline_wasm_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(ValueSerializerTest);
 };
@@ -1724,7 +1721,7 @@ class ValueSerializerTestWithArrayBufferTransfer : public ValueSerializerTest {
   ValueSerializerTestWithArrayBufferTransfer() {
     {
       Context::Scope scope(serialization_context());
-      input_buffer_ = ArrayBuffer::New(isolate(), nullptr, 0);
+      input_buffer_ = ArrayBuffer::New(isolate(), 0);
     }
     {
       Context::Scope scope(deserialization_context());
@@ -2022,7 +2019,15 @@ class ValueSerializerTestWithSharedArrayBufferClone
               std::move(backing_store));
       return Utils::ToLocalShared(buffer);
     } else {
-      return SharedArrayBuffer::New(isolate(), data, byte_length);
+      std::unique_ptr<v8::BackingStore> backing_store =
+          SharedArrayBuffer::NewBackingStore(
+              data, byte_length,
+              [](void*, size_t, void*) {
+                // Leak the buffer as it has the
+                // lifetime of the test.
+              },
+              nullptr);
+      return SharedArrayBuffer::New(isolate(), std::move(backing_store));
     }
   }
 
@@ -2442,7 +2447,7 @@ TEST_F(ValueSerializerTestWithHostArrayBufferView, RoundTripUint8ArrayInput) {
 
 // A simple module which exports an "increment" function.
 // Copied from test/mjsunit/wasm/incrementer.wasm.
-const unsigned char kIncrementerWasm[] = {
+constexpr uint8_t kIncrementerWasm[] = {
     0,   97, 115, 109, 1, 0,  0, 0, 1,   6,   1,  96,  1,   127, 1,   127,
     3,   2,  1,   0,   7, 13, 1, 9, 105, 110, 99, 114, 101, 109, 101, 110,
     116, 0,  0,   10,  9, 1,  7, 0, 32,  0,   65, 1,   106, 11,
@@ -2459,7 +2464,6 @@ class ValueSerializerTestWithWasm : public ValueSerializerTest {
   void Reset() {
     current_serializer_delegate_ = nullptr;
     transfer_modules_.clear();
-    SetExpectInlineWasm(false);
   }
 
   void EnableTransferSerialization() {
@@ -2547,16 +2551,21 @@ class ValueSerializerTestWithWasm : public ValueSerializerTest {
 
   Local<WasmModuleObject> MakeWasm() {
     Context::Scope scope(serialization_context());
-    return WasmModuleObject::DeserializeOrCompile(
-               isolate(), {nullptr, 0},
-               {kIncrementerWasm, sizeof(kIncrementerWasm)})
-        .ToLocalChecked();
+    i::wasm::ErrorThrower thrower(i_isolate(), "MakeWasm");
+    auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate());
+    i::MaybeHandle<i::JSObject> compiled =
+        i_isolate()->wasm_engine()->SyncCompile(
+            i_isolate(), enabled_features, &thrower,
+            i::wasm::ModuleWireBytes(i::ArrayVector(kIncrementerWasm)));
+    CHECK(!thrower.error());
+    return Local<WasmModuleObject>::Cast(
+        Utils::ToLocal(compiled.ToHandleChecked()));
   }
 
   void ExpectPass() {
     Local<Value> value = RoundTripTest(MakeWasm());
     Context::Scope scope(deserialization_context());
-    ASSERT_TRUE(value->IsWebAssemblyCompiledModule());
+    ASSERT_TRUE(value->IsWasmModuleObject());
     ExpectScriptTrue(
         "new WebAssembly.Instance(result).exports.increment(8) === 9");
   }
@@ -2665,18 +2674,8 @@ TEST_F(ValueSerializerTestWithWasm, RoundtripWasmTransfer) {
   ExpectPass();
 }
 
-TEST_F(ValueSerializerTestWithWasm, RountripWasmInline) {
-  SetExpectInlineWasm(true);
-  ExpectPass();
-}
-
-TEST_F(ValueSerializerTestWithWasm, CannotDeserializeWasmInlineData) {
-  ExpectFail();
-}
-
 TEST_F(ValueSerializerTestWithWasm, CannotTransferWasmWhenExpectingInline) {
   EnableTransferSerialization();
-  SetExpectInlineWasm(true);
   ExpectFail();
 }
 
@@ -2688,13 +2687,6 @@ TEST_F(ValueSerializerTestWithWasm, ComplexObjectDuplicateTransfer) {
   ExpectScriptTrue("result.mod1 === result.mod2");
 }
 
-TEST_F(ValueSerializerTestWithWasm, ComplexObjectDuplicateInline) {
-  SetExpectInlineWasm(true);
-  Local<Value> value = RoundTripTest(GetComplexObjectWithDuplicate());
-  VerifyComplexObject(value);
-  ExpectScriptTrue("result.mod1 === result.mod2");
-}
-
 TEST_F(ValueSerializerTestWithWasm, ComplexObjectWithManyTransfer) {
   EnableTransferSerialization();
   EnableTransferDeserialization();
@@ -2703,123 +2695,6 @@ TEST_F(ValueSerializerTestWithWasm, ComplexObjectWithManyTransfer) {
   ExpectScriptTrue("result.mod1 != result.mod2");
 }
 
-TEST_F(ValueSerializerTestWithWasm, ComplexObjectWithManyInline) {
-  SetExpectInlineWasm(true);
-  Local<Value> value = RoundTripTest(GetComplexObjectWithMany());
-  VerifyComplexObject(value);
-  ExpectScriptTrue("result.mod1 != result.mod2");
-}
-
-// As produced around Chrome 56.
-const unsigned char kSerializedIncrementerWasm[] = {
-    0xFF, 0x09, 0x3F, 0x00, 0x57, 0x79, 0x2D, 0x00, 0x61, 0x73, 0x6D, 0x0D,
-    0x00, 0x00, 0x00, 0x01, 0x06, 0x01, 0x60, 0x01, 0x7F, 0x01, 0x7F, 0x03,
-    0x02, 0x01, 0x00, 0x07, 0x0D, 0x01, 0x09, 0x69, 0x6E, 0x63, 0x72, 0x65,
-    0x6D, 0x65, 0x6E, 0x74, 0x00, 0x00, 0x0A, 0x08, 0x01, 0x06, 0x00, 0x20,
-    0x00, 0x41, 0x01, 0x6A, 0xF8, 0x04, 0xA1, 0x06, 0xDE, 0xC0, 0xC6, 0x44,
-    0x3C, 0x29, 0x00, 0x00, 0x00, 0x00, 0x1F, 0x02, 0x00, 0x00, 0x81, 0x4E,
-    0xCE, 0x7C, 0x05, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x30, 0x02,
-    0x00, 0x00, 0xB0, 0x25, 0x30, 0xE3, 0xF2, 0xDB, 0x2E, 0x48, 0x00, 0x00,
-    0x00, 0x80, 0xE8, 0x00, 0x00, 0x80, 0xE0, 0x01, 0x00, 0x80, 0x00, 0x00,
-    0x00, 0x80, 0x00, 0x00, 0x00, 0x80, 0x07, 0x08, 0x00, 0x00, 0x09, 0x04,
-    0x10, 0x02, 0x00, 0x00, 0x00, 0x00, 0x01, 0x3C, 0x8C, 0xC0, 0x00, 0x00,
-    0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x01, 0x10, 0x8C, 0xC0, 0x00, 0x00,
-    0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x70, 0x94, 0x01, 0x0C, 0x8B,
-    0xC1, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x25, 0xDC, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x9E, 0x01, 0x10, 0x8C, 0xC0, 0x00, 0x00,
-    0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x84, 0xC0, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x05, 0x7D, 0x01, 0x1A, 0xE1, 0x02, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x23, 0x88, 0x42, 0x32, 0x03,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x63, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3E, 0x00, 0x00, 0x00, 0x04, 0x00,
-    0x00, 0x02, 0xA1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF,
-    0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x49, 0x3B, 0xA5, 0x60, 0x0C, 0x00,
-    0x00, 0x0F, 0x86, 0x04, 0x00, 0x00, 0x00, 0x83, 0xC0, 0x01, 0xC3, 0x55,
-    0x48, 0x89, 0xE5, 0x49, 0xBA, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00,
-    0x00, 0x41, 0x52, 0x48, 0x83, 0xEC, 0x08, 0x48, 0x89, 0x45, 0xF0, 0x48,
-    0xBB, 0xB0, 0x67, 0xC6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x33, 0xC0, 0x48,
-    0xBE, 0xE1, 0x57, 0x81, 0x85, 0xF6, 0x14, 0x00, 0x00, 0xE8, 0xFC, 0x3C,
-    0xEA, 0xFF, 0x48, 0x8B, 0x45, 0xF0, 0x48, 0x8B, 0xE5, 0x5D, 0xEB, 0xBF,
-    0x66, 0x90, 0x01, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x44, 0x00,
-    0x00, 0x00, 0xFF, 0xFF, 0xFF, 0x0F, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x0F, 0x20, 0x84, 0x0F, 0x7D, 0x01, 0x0D, 0x00, 0x0F, 0x04,
-    0x6D, 0x08, 0x0F, 0xF0, 0x02, 0x80, 0x94, 0x01, 0x0C, 0x8B, 0xC1, 0x00,
-    0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0xED, 0xA9, 0x2D, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x9E, 0xE0, 0x38, 0x1A, 0x61, 0x03, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x23, 0x88, 0x42, 0x32, 0x03, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x9A, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x4E, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00,
-    0x02, 0xF9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF,
-    0xFF, 0x00, 0x00, 0x00, 0x00, 0x55, 0x48, 0x89, 0xE5, 0x56, 0x57, 0x48,
-    0x8B, 0x45, 0x10, 0xE8, 0x11, 0xED, 0xED, 0xFF, 0xA8, 0x01, 0x0F, 0x85,
-    0x2D, 0x00, 0x00, 0x00, 0x48, 0xC1, 0xE8, 0x20, 0xC5, 0xF9, 0x57, 0xC0,
-    0xC5, 0xFB, 0x2A, 0xC0, 0xC4, 0xE1, 0xFB, 0x2C, 0xC0, 0x48, 0x83, 0xF8,
-    0x01, 0x0F, 0x80, 0x34, 0x00, 0x00, 0x00, 0x8B, 0xC0, 0xE8, 0x27, 0xFE,
-    0xFF, 0xFF, 0x48, 0xC1, 0xE0, 0x20, 0x48, 0x8B, 0xE5, 0x5D, 0xC2, 0x10,
-    0x00, 0x49, 0x39, 0x45, 0xA0, 0x0F, 0x84, 0x07, 0x00, 0x00, 0x00, 0xC5,
-    0xFB, 0x10, 0x40, 0x07, 0xEB, 0xCE, 0x49, 0xBA, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0xF8, 0x7F, 0xC4, 0xC1, 0xF9, 0x6E, 0xC2, 0xEB, 0xBD, 0x48,
-    0x83, 0xEC, 0x08, 0xC5, 0xFB, 0x11, 0x04, 0x24, 0xE8, 0xCC, 0xFE, 0xFF,
-    0xFF, 0x48, 0x83, 0xC4, 0x08, 0xEB, 0xB8, 0x66, 0x90, 0x02, 0x00, 0x00,
-    0x00, 0x03, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF,
-    0x0F, 0x39, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0x0F, 0xFF, 0xFF, 0x00,
-    0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0F, 0x20, 0x84,
-    0x0F, 0xCC, 0x6E, 0x7D, 0x01, 0x72, 0x98, 0x00, 0x0F, 0xDC, 0x6D, 0x0C,
-    0x0F, 0xB0, 0x84, 0x0D, 0x04, 0x84, 0xE3, 0xC0, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x84, 0xE0, 0x84, 0x84, 0x18, 0x2F, 0x2F, 0x2F,
-    0x2F, 0x2F};
-
-TEST_F(ValueSerializerTestWithWasm, DecodeWasmModule) {
-  if ((true)) return;  // TODO(mtrofin): fix this test
-  std::vector<uint8_t> raw(
-      kSerializedIncrementerWasm,
-      kSerializedIncrementerWasm + sizeof(kSerializedIncrementerWasm));
-  Local<Value> value = DecodeTest(raw);
-  ASSERT_TRUE(value->IsWebAssemblyCompiledModule());
-  ExpectScriptTrue(
-      "new WebAssembly.Instance(result).exports.increment(8) === 9");
-}
-
-// As above, but with empty compiled data. Should work due to fallback to wire
-// data.
-const unsigned char kSerializedIncrementerWasmWithInvalidCompiledData[] = {
-    0xFF, 0x09, 0x3F, 0x00, 0x57, 0x79, 0x2D, 0x00, 0x61, 0x73, 0x6D,
-    0x0D, 0x00, 0x00, 0x00, 0x01, 0x06, 0x01, 0x60, 0x01, 0x7F, 0x01,
-    0x7F, 0x03, 0x02, 0x01, 0x00, 0x07, 0x0D, 0x01, 0x09, 0x69, 0x6E,
-    0x63, 0x72, 0x65, 0x6D, 0x65, 0x6E, 0x74, 0x00, 0x00, 0x0A, 0x08,
-    0x01, 0x06, 0x00, 0x20, 0x00, 0x41, 0x01, 0x6A, 0x00};
-
-TEST_F(ValueSerializerTestWithWasm, DecodeWasmModuleWithInvalidCompiledData) {
-  if ((true)) return;  // TODO(titzer): regenerate this test
-  std::vector<uint8_t> raw(
-      kSerializedIncrementerWasmWithInvalidCompiledData,
-      kSerializedIncrementerWasmWithInvalidCompiledData +
-          sizeof(kSerializedIncrementerWasmWithInvalidCompiledData));
-  Local<Value> value = DecodeTest(raw);
-  ASSERT_TRUE(value->IsWebAssemblyCompiledModule());
-  ExpectScriptTrue(
-      "new WebAssembly.Instance(result).exports.increment(8) === 9");
-}
-
-// As above, but also with empty wire data. Should fail.
-const unsigned char kSerializedIncrementerWasmInvalid[] = {
-    0xFF, 0x09, 0x3F, 0x00, 0x57, 0x79, 0x00, 0x00};
-
-TEST_F(ValueSerializerTestWithWasm,
-       DecodeWasmModuleWithInvalidCompiledAndWireData) {
-  std::vector<uint8_t> raw(kSerializedIncrementerWasmInvalid,
-                           kSerializedIncrementerWasmInvalid +
-                               sizeof(kSerializedIncrementerWasmInvalid));
-  InvalidDecodeTest(raw);
-}
-
-TEST_F(ValueSerializerTestWithWasm, DecodeWasmModuleWithInvalidDataLength) {
-  InvalidDecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x57, 0x79, 0x7F, 0x00});
-  InvalidDecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x57, 0x79, 0x00, 0x7F});
-}
-
 class ValueSerializerTestWithLimitedMemory : public ValueSerializerTest {
  protected:
 // GMock doesn't use the "override" keyword.
diff --git a/deps/v8/test/unittests/objects/weakarraylist-unittest.cc b/deps/v8/test/unittests/objects/weakarraylist-unittest.cc
new file mode 100644
index 00000000000000..6543a88c85aed3
--- /dev/null
+++ b/deps/v8/test/unittests/objects/weakarraylist-unittest.cc
@@ -0,0 +1,59 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/factory.h"
+#include "test/unittests/test-utils.h"
+
+namespace v8 {
+namespace internal {
+
+using WeakArrayListTest = TestWithIsolate;
+
+TEST_F(WeakArrayListTest, Compact) {
+  Handle<WeakArrayList> list = isolate()->factory()->NewWeakArrayList(10);
+  EXPECT_EQ(list->length(), 0);
+  EXPECT_EQ(list->capacity(), 10);
+
+  MaybeObject some_object =
+      MaybeObject::FromObject(*isolate()->factory()->empty_fixed_array());
+  MaybeObject weak_ref = MaybeObject::MakeWeak(some_object);
+  MaybeObject smi = MaybeObject::FromSmi(Smi::FromInt(0));
+  MaybeObject cleared_ref = HeapObjectReference::ClearedValue(isolate());
+  list->Set(0, weak_ref);
+  list->Set(1, smi);
+  list->Set(2, cleared_ref);
+  list->Set(3, cleared_ref);
+  list->set_length(5);
+
+  list->Compact(isolate());
+  EXPECT_EQ(list->length(), 3);
+  EXPECT_EQ(list->capacity(), 10);
+}
+
+TEST_F(WeakArrayListTest, OutOfPlaceCompact) {
+  Handle<WeakArrayList> list = isolate()->factory()->NewWeakArrayList(20);
+  EXPECT_EQ(list->length(), 0);
+  EXPECT_EQ(list->capacity(), 20);
+
+  MaybeObject some_object =
+      MaybeObject::FromObject(*isolate()->factory()->empty_fixed_array());
+  MaybeObject weak_ref = MaybeObject::MakeWeak(some_object);
+  MaybeObject smi = MaybeObject::FromSmi(Smi::FromInt(0));
+  MaybeObject cleared_ref = HeapObjectReference::ClearedValue(isolate());
+  list->Set(0, weak_ref);
+  list->Set(1, smi);
+  list->Set(2, cleared_ref);
+  list->Set(3, smi);
+  list->Set(4, cleared_ref);
+  list->set_length(6);
+
+  Handle<WeakArrayList> compacted =
+      isolate()->factory()->CompactWeakArrayList(list, 4);
+  EXPECT_EQ(list->length(), 6);
+  EXPECT_EQ(compacted->length(), 4);
+  EXPECT_EQ(compacted->capacity(), 4);
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/unittests/regress/regress-crbug-1041240-unittest.cc b/deps/v8/test/unittests/regress/regress-crbug-1041240-unittest.cc
new file mode 100644
index 00000000000000..0f99632df5084e
--- /dev/null
+++ b/deps/v8/test/unittests/regress/regress-crbug-1041240-unittest.cc
@@ -0,0 +1,20 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/execution/isolate.h"
+#include "src/heap/factory.h"
+#include "test/unittests/test-utils.h"
+
+namespace v8 {
+namespace internal {
+
+using NewUninitializedFixedArrayTest = TestWithIsolateAndZone;
+
+TEST_F(NewUninitializedFixedArrayTest, ThrowOnNegativeLength) {
+  ASSERT_DEATH_IF_SUPPORTED({ factory()->NewUninitializedFixedArray(-1); },
+                            "Fatal javascript OOM in invalid array length");
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/unittests/run-all-unittests.cc b/deps/v8/test/unittests/run-all-unittests.cc
index ca142b4e46d664..2511cdd1303e18 100644
--- a/deps/v8/test/unittests/run-all-unittests.cc
+++ b/deps/v8/test/unittests/run-all-unittests.cc
@@ -38,6 +38,10 @@ int main(int argc, char** argv) {
   // Don't catch SEH exceptions and continue as the following tests might hang
   // in an broken environment on windows.
   testing::GTEST_FLAG(catch_exceptions) = false;
+
+  // Most V8 unit-tests are multi-threaded, so enable thread-safe death-tests.
+  testing::FLAGS_gtest_death_test_style = "threadsafe";
+
   testing::InitGoogleMock(&argc, argv);
   testing::AddGlobalTestEnvironment(new DefaultPlatformEnvironment);
   v8::V8::SetFlagsFromCommandLine(&argc, argv, true);
diff --git a/deps/v8/test/unittests/strings/unicode-unittest.cc b/deps/v8/test/unittests/strings/unicode-unittest.cc
index d4018997303e98..a294704e33e4dc 100644
--- a/deps/v8/test/unittests/strings/unicode-unittest.cc
+++ b/deps/v8/test/unittests/strings/unicode-unittest.cc
@@ -31,7 +31,7 @@ void DecodeUtf16(const std::vector<uint8_t>& bytes,
   Utf8Decoder decoder(utf8_data);
 
   std::vector<uint16_t> utf16(decoder.utf16_length());
-  decoder.Decode(&utf16[0], utf8_data);
+  decoder.Decode(utf16.data(), utf8_data);
 
   // Decode back into code points
   for (size_t i = 0; i < utf16.size(); i++) {
@@ -48,8 +48,8 @@ void DecodeIncrementally(const std::vector<byte>& bytes,
                          std::vector<unibrow::uchar>* output) {
   unibrow::Utf8::Utf8IncrementalBuffer buffer = 0;
   unibrow::Utf8::State state = unibrow::Utf8::State::kAccept;
-  const byte* cursor = &bytes[0];
-  const byte* end = &bytes[bytes.size()];
+  const byte* cursor = bytes.data();
+  const byte* end = bytes.data() + bytes.size();
   while (cursor < end) {
     unibrow::uchar result =
         unibrow::Utf8::ValueOfIncremental(&cursor, &state, &buffer);
diff --git a/deps/v8/test/unittests/test-helpers.cc b/deps/v8/test/unittests/test-helpers.cc
index 1011c39fc51d7b..2d9149402fea3d 100644
--- a/deps/v8/test/unittests/test-helpers.cc
+++ b/deps/v8/test/unittests/test-helpers.cc
@@ -49,20 +49,19 @@ Handle<SharedFunctionInfo> CreateSharedFunctionInfo(
   // Make sure we have an outer scope info, even though it's empty
   shared->set_raw_outer_scope_info_or_feedback_metadata(
       ScopeInfo::Empty(isolate));
-  SharedFunctionInfo::SetScript(shared, script, function_literal_id);
+  shared->SetScript(ReadOnlyRoots(isolate), *script, function_literal_id);
   return scope.CloseAndEscape(shared);
 }
 
 std::unique_ptr<ParseInfo> OuterParseInfoForShared(
     Isolate* isolate, Handle<SharedFunctionInfo> shared) {
-  Handle<Script> script =
-      Handle<Script>::cast(handle(shared->script(), isolate));
+  Script script = Script::cast(shared->script());
   std::unique_ptr<ParseInfo> result =
       std::make_unique<ParseInfo>(isolate, script);
 
   // Create a character stream to simulate the parser having done so for the
   // to-level ParseProgram.
-  Handle<String> source(String::cast(script->source()), isolate);
+  Handle<String> source(String::cast(script.source()), isolate);
   std::unique_ptr<Utf16CharacterStream> stream(
       ScannerStream::For(isolate, source));
   result->set_character_stream(std::move(stream));
diff --git a/deps/v8/test/unittests/torque/ls-json-unittest.cc b/deps/v8/test/unittests/torque/ls-json-unittest.cc
index 7883c136682f91..aca88ad33adce2 100644
--- a/deps/v8/test/unittests/torque/ls-json-unittest.cc
+++ b/deps/v8/test/unittests/torque/ls-json-unittest.cc
@@ -99,7 +99,10 @@ TEST(LanguageServerJson, TestJsonObjects) {
 // issue with exceptions enabled for Torque.
 // TODO(szuend): Remove the OS check when errors are reported differently,
 //               or the issue is resolved.
-#if !defined(V8_OS_WIN)
+// TODO(almuthanna): These tests were skipped because they cause a crash when
+// they are ran on Fuchsia. This issue should be solved later on
+// Ticket: https://crbug.com/1028617
+#if !defined(V8_OS_WIN) && !defined(V8_TARGET_OS_FUCHSIA)
 using ::testing::HasSubstr;
 TEST(LanguageServerJson, ParserError) {
   JsonParserResult result = ParseJson("{]");
diff --git a/deps/v8/test/unittests/torque/ls-server-data-unittest.cc b/deps/v8/test/unittests/torque/ls-server-data-unittest.cc
index 7e23f6dcf4eb97..28efbe0195fe7e 100644
--- a/deps/v8/test/unittests/torque/ls-server-data-unittest.cc
+++ b/deps/v8/test/unittests/torque/ls-server-data-unittest.cc
@@ -79,6 +79,10 @@ TEST(LanguageServer, GotoTypeDefinitionNoDataForFile) {
   EXPECT_FALSE(LanguageServerData::FindDefinition(test_id, {0, 0}));
 }
 
+// TODO(almuthanna): This test was skipped because it causes a crash when it is
+// ran on Fuchsia. This issue should be solved later on
+// Ticket: https://crbug.com/1028617
+#if !defined(V8_TARGET_OS_FUCHSIA)
 TEST(LanguageServer, GotoLabelDefinitionInSignature) {
   const std::string source =
       "type void;\n"
@@ -99,6 +103,7 @@ TEST(LanguageServer, GotoLabelDefinitionInSignature) {
   ASSERT_TRUE(maybe_position.has_value());
   EXPECT_EQ(*maybe_position, (SourcePosition{id, {5, 19}, {5, 26}}));
 }
+#endif
 
 TEST(LanguageServer, GotoLabelDefinitionInTryBlock) {
   const std::string source =
@@ -122,6 +127,10 @@ TEST(LanguageServer, GotoLabelDefinitionInTryBlock) {
   EXPECT_EQ(*maybe_position, (SourcePosition{id, {7, 8}, {7, 15}}));
 }
 
+// TODO(almuthanna): This test was skipped because it causes a crash when it is
+// ran on Fuchsia. This issue should be solved later on
+// Ticket: https://crbug.com/1028617
+#if !defined(V8_TARGET_OS_FUCHSIA)
 TEST(LanguageServer, GotoDefinitionClassSuperType) {
   const std::string source =
       "type void;\n"
@@ -138,6 +147,7 @@ TEST(LanguageServer, GotoDefinitionClassSuperType) {
   ASSERT_TRUE(maybe_position.has_value());
   EXPECT_EQ(*maybe_position, (SourcePosition{id, {2, 5}, {2, 11}}));
 }
+#endif
 
 TEST(LanguageServer, GotoLabelDefinitionInSignatureGotoStmt) {
   const std::string source =
diff --git a/deps/v8/test/unittests/torque/torque-unittest.cc b/deps/v8/test/unittests/torque/torque-unittest.cc
index 22ee7543213f09..5180e301cc1047 100644
--- a/deps/v8/test/unittests/torque/torque-unittest.cc
+++ b/deps/v8/test/unittests/torque/torque-unittest.cc
@@ -25,13 +25,19 @@ namespace torque_internal {
     const object: HeapObject;
     const offset: intptr;
   }
+  type UninitializedHeapObject extends HeapObject;
 }
 
-type Tagged generates 'TNode<Object>' constexpr 'ObjectPtr';
-type Smi extends Tagged generates 'TNode<Smi>' constexpr 'Smi';
+type Tagged generates 'TNode<MaybeObject>' constexpr 'MaybeObject';
+type StrongTagged extends Tagged
+    generates 'TNode<Object>' constexpr 'ObjectPtr';
+type Smi extends StrongTagged generates 'TNode<Smi>' constexpr 'Smi';
+type WeakHeapObject extends Tagged;
+type Weak<T : type extends HeapObject> extends WeakHeapObject;
+type Uninitialized extends Tagged;
 
 @abstract
-extern class HeapObject extends Tagged {
+extern class HeapObject extends StrongTagged {
   map: Map;
 }
 type Map extends HeapObject generates 'TNode<Map>';
@@ -64,6 +70,43 @@ type Code extends HeapObject generates 'TNode<Code>';
 type BuiltinPtr extends Smi generates 'TNode<BuiltinPtr>';
 type Context extends HeapObject generates 'TNode<Context>';
 type NativeContext extends Context;
+
+struct float64_or_hole {
+  is_hole: bool;
+  value: float64;
+}
+
+intrinsic %FromConstexpr<To: type, From: type>(b: From): To;
+intrinsic %RawDownCast<To: type, From: type>(x: From): To;
+intrinsic %RawConstexprCast<To: type, From: type>(f: From): To;
+extern macro SmiConstant(constexpr Smi): Smi;
+extern macro TaggedToSmi(Object): Smi
+    labels CastError;
+extern macro TaggedToHeapObject(Object): HeapObject
+    labels CastError;
+
+extern macro IntPtrConstant(constexpr int31): intptr;
+
+macro FromConstexpr<To: type, From: type>(o: From): To;
+FromConstexpr<Smi, constexpr Smi>(s: constexpr Smi): Smi {
+  return SmiConstant(s);
+}
+FromConstexpr<Smi, constexpr int31>(s: constexpr int31): Smi {
+  return %FromConstexpr<Smi>(s);
+}
+FromConstexpr<intptr, constexpr int31>(i: constexpr int31): intptr {
+  return IntPtrConstant(i);
+}
+
+macro Cast<A : type extends Object>(implicit context: Context)(o: Object): A
+    labels CastError {
+  return Cast<A>(TaggedToHeapObject(o) otherwise CastError)
+      otherwise CastError;
+}
+Cast<Smi>(o: Object): Smi
+    labels CastError {
+  return TaggedToSmi(o) otherwise CastError;
+}
 )";
 
 TorqueCompilerResult TestCompileTorque(std::string source) {
@@ -87,13 +130,68 @@ void ExpectSuccessfulCompilation(std::string source) {
 }
 
 template <class T>
-void ExpectFailingCompilation(
-    std::string source, ::testing::PolymorphicMatcher<T> message_pattern) {
+using MatcherVector =
+    std::vector<std::pair<::testing::PolymorphicMatcher<T>, LineAndColumn>>;
+
+template <class T>
+void ExpectFailingCompilation(std::string source,
+                              MatcherVector<T> message_patterns) {
   TorqueCompilerResult result = TestCompileTorque(std::move(source));
   ASSERT_FALSE(result.messages.empty());
-  EXPECT_THAT(result.messages[0].message, message_pattern);
+  EXPECT_GE(result.messages.size(), message_patterns.size());
+  size_t limit = message_patterns.size();
+  if (result.messages.size() < limit) {
+    limit = result.messages.size();
+  }
+  for (size_t i = 0; i < limit; ++i) {
+    EXPECT_THAT(result.messages[i].message, message_patterns[i].first);
+    if (message_patterns[i].second != LineAndColumn::Invalid()) {
+      base::Optional<SourcePosition> actual = result.messages[i].position;
+      EXPECT_TRUE(actual.has_value());
+      EXPECT_EQ(actual->start, message_patterns[i].second);
+    }
+  }
+}
+
+template <class T>
+void ExpectFailingCompilation(
+    std::string source, ::testing::PolymorphicMatcher<T> message_pattern) {
+  ExpectFailingCompilation(
+      source, MatcherVector<T>{{message_pattern, LineAndColumn::Invalid()}});
 }
 
+// TODO(almuthanna): the definition of this function is skipped on Fuchsia
+// because it causes an 'unused function' exception upon buidling gn
+// Ticket: https://crbug.com/1028617
+#if !defined(V8_TARGET_OS_FUCHSIA)
+int CountPreludeLines() {
+  static int result = -1;
+  if (result == -1) {
+    std::string prelude(kTestTorquePrelude);
+    result = static_cast<int>(std::count(prelude.begin(), prelude.end(), '\n'));
+  }
+  return result;
+}
+#endif
+
+using SubstrWithPosition =
+    std::pair<::testing::PolymorphicMatcher<
+                  ::testing::internal::HasSubstrMatcher<std::string>>,
+              LineAndColumn>;
+
+// TODO(almuthanna): the definition of this function is skipped on Fuchsia
+// because it causes an 'unused function' exception upon buidling gn
+// Ticket: https://crbug.com/1028617
+#if !defined(V8_TARGET_OS_FUCHSIA)
+SubstrWithPosition SubstrTester(const std::string& message, int line, int col) {
+  // Change line and column from 1-based to 0-based.
+  return {::testing::HasSubstr(message),
+          LineAndColumn{line + CountPreludeLines() - 1, col - 1}};
+}
+#endif
+
+using SubstrVector = std::vector<SubstrWithPosition>;
+
 }  // namespace
 
 TEST(Torque, Prelude) { ExpectSuccessfulCompilation(""); }
@@ -182,6 +280,10 @@ TEST(Torque, TypeDeclarationOrder) {
   )");
 }
 
+// TODO(almuthanna): These tests were skipped because they cause a crash when
+// they are ran on Fuchsia. This issue should be solved later on
+// Ticket: https://crbug.com/1028617
+#if !defined(V8_TARGET_OS_FUCHSIA)
 TEST(Torque, ConditionalFields) {
   // This class should throw alignment errors if @if decorators aren't
   // working.
@@ -226,6 +328,7 @@ TEST(Torque, DoubleUnderScorePrefixIllegalForIdentifiers) {
   )",
                            HasSubstr("Lexer Error"));
 }
+#endif
 
 TEST(Torque, UnusedLetBindingLintError) {
   ExpectFailingCompilation(R"(
@@ -244,6 +347,10 @@ TEST(Torque, UnderscorePrefixSilencesUnusedWarning) {
   )");
 }
 
+// TODO(almuthanna): This test was skipped because it causes a crash when it is
+// ran on Fuchsia. This issue should be solved later on
+// Ticket: https://crbug.com/1028617
+#if !defined(V8_TARGET_OS_FUCHSIA)
 TEST(Torque, UsingUnderscorePrefixedIdentifierError) {
   ExpectFailingCompilation(R"(
     @export macro Foo(y: Smi) {
@@ -253,6 +360,7 @@ TEST(Torque, UsingUnderscorePrefixedIdentifierError) {
   )",
                            HasSubstr("Trying to reference '_x'"));
 }
+#endif
 
 TEST(Torque, UnusedArgumentLintError) {
   ExpectFailingCompilation(R"(
@@ -294,10 +402,15 @@ TEST(Torque, NoUnusedWarningForVariablesOnlyUsedInAsserts) {
   )");
 }
 
+// TODO(almuthanna): This test was skipped because it causes a crash when it is
+// ran on Fuchsia. This issue should be solved later on
+// Ticket: https://crbug.com/1028617
+#if !defined(V8_TARGET_OS_FUCHSIA)
 TEST(Torque, ImportNonExistentFile) {
   ExpectFailingCompilation(R"(import "foo/bar.tq")",
                            HasSubstr("File 'foo/bar.tq' not found."));
 }
+#endif
 
 TEST(Torque, LetShouldBeConstLintError) {
   ExpectFailingCompilation(R"(
@@ -318,6 +431,188 @@ TEST(Torque, LetShouldBeConstIsSkippedForStructs) {
   )");
 }
 
+// TODO(almuthanna): These tests were skipped because they cause a crash when
+// they are ran on Fuchsia. This issue should be solved later on
+// Ticket: https://crbug.com/1028617
+#if !defined(V8_TARGET_OS_FUCHSIA)
+TEST(Torque, GenericAbstractType) {
+  ExpectSuccessfulCompilation(R"(
+    type Foo<T: type> extends HeapObject;
+    extern macro F1(HeapObject);
+    macro F2<T: type>(x: Foo<T>) {
+      F1(x);
+    }
+    @export
+    macro F3(a: Foo<Smi>, b: Foo<HeapObject>){
+      F2(a);
+      F2(b);
+    }
+  )");
+
+  ExpectFailingCompilation(R"(
+    type Foo<T: type> extends HeapObject;
+    macro F1<T: type>(x: Foo<T>) {}
+    @export
+    macro F2(a: Foo<Smi>) {
+      F1<HeapObject>(a);
+    })",
+                           HasSubstr("cannot find suitable callable"));
+
+  ExpectFailingCompilation(R"(
+    type Foo<T: type> extends HeapObject;
+    extern macro F1(Foo<HeapObject>);
+    @export
+    macro F2(a: Foo<Smi>) {
+      F1(a);
+    })",
+                           HasSubstr("cannot find suitable callable"));
+}
+
+TEST(Torque, SpecializationRequesters) {
+  ExpectFailingCompilation(
+      R"(
+    macro A<T: type extends HeapObject>() {}
+    macro B<T: type>() {
+      A<T>();
+    }
+    macro C<T: type>() {
+      B<T>();
+    }
+    macro D() {
+      C<Smi>();
+    }
+  )",
+      SubstrVector{
+          SubstrTester("cannot find suitable callable", 4, 7),
+          SubstrTester("Note: in specialization B<Smi> requested here", 7, 7),
+          SubstrTester("Note: in specialization C<Smi> requested here", 10,
+                       7)});
+
+  ExpectFailingCompilation(
+      R"(
+    extern macro RetVal(): Object;
+    builtin A<T: type extends HeapObject>(implicit context: Context)(): Object {
+      return RetVal();
+    }
+    builtin B<T: type>(implicit context: Context)(): Object {
+      return A<T>();
+    }
+    builtin C<T: type>(implicit context: Context)(): Object {
+      return B<T>();
+    }
+    builtin D(implicit context: Context)(): Object {
+      return C<Smi>();
+    }
+  )",
+      SubstrVector{
+          SubstrTester("cannot find suitable callable", 7, 14),
+          SubstrTester("Note: in specialization B<Smi> requested here", 10, 14),
+          SubstrTester("Note: in specialization C<Smi> requested here", 13,
+                       14)});
+
+  ExpectFailingCompilation(
+      R"(
+    struct A<T: type extends HeapObject> {}
+    struct B<T: type> {
+      a: A<T>;
+    }
+    struct C<T: type> {
+      b: B<T>;
+    }
+    struct D {
+      c: C<Smi>;
+    }
+  )",
+      SubstrVector{
+          SubstrTester("Could not instantiate generic", 4, 10),
+          SubstrTester("Note: in specialization B<Smi> requested here", 7, 10),
+          SubstrTester("Note: in specialization C<Smi> requested here", 10,
+                       10)});
+
+  ExpectFailingCompilation(
+      R"(
+    macro A<T: type extends HeapObject>() {}
+    macro B<T: type>() {
+      A<T>();
+    }
+    struct C<T: type> {
+      macro Method() {
+        B<T>();
+      }
+    }
+    macro D(_b: C<Smi>) {}
+  )",
+      SubstrVector{
+          SubstrTester("cannot find suitable callable", 4, 7),
+          SubstrTester("Note: in specialization B<Smi> requested here", 8, 9),
+          SubstrTester("Note: in specialization C<Smi> requested here", 11,
+                       5)});
+}
+#endif
+
+TEST(Torque, Enums) {
+  ExpectSuccessfulCompilation(R"(
+    extern enum MyEnum {
+      kValue0,
+      kValue1,
+      kValue2,
+      kValue3
+    }
+  )");
+
+  ExpectFailingCompilation(R"(
+    extern enum MyEmptyEnum {
+    }
+  )",
+                           HasSubstr("unexpected token \"}\""));
+}
+
+TEST(Torque, EnumInTypeswitch) {
+  ExpectSuccessfulCompilation(R"(
+    extern enum MyEnum extends Smi {
+      kA,
+      kB,
+      kC
+    }
+
+    @export
+    macro Test(implicit context: Context)(v : MyEnum): Smi {
+      typeswitch(v) {
+        case (MyEnum::kA | MyEnum::kB): {
+          return 1;
+        }
+        case (MyEnum::kC): {
+          return 2;
+        }
+      }
+    }
+  )");
+
+  ExpectSuccessfulCompilation(R"(
+    extern enum MyEnum extends Smi {
+      kA,
+      kB,
+      kC,
+      ...
+    }
+
+    @export
+    macro Test(implicit context: Context)(v : MyEnum): Smi {
+      typeswitch(v) {
+         case (MyEnum::kC): {
+          return 2;
+        }
+        case (MyEnum::kA | MyEnum::kB): {
+          return 1;
+        }
+       case (MyEnum): {
+          return 0;
+        }
+      }
+    }
+  )");
+}
+
 }  // namespace torque
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/unittests.status b/deps/v8/test/unittests/unittests.status
index 08022d56897cea..8d5aac70d93e5a 100644
--- a/deps/v8/test/unittests/unittests.status
+++ b/deps/v8/test/unittests/unittests.status
@@ -3,6 +3,7 @@
 # found in the LICENSE file.
 
 [
+##############################################################################
 ['system == macos and asan', {
   # BUG(820416).
   'BitsDeathTest*': [SKIP],
@@ -24,10 +25,6 @@
 }], # lite_mode or variant == jitless
 
 ##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-
 ['system == windows and asan', {
   # BUG(893437).
   'Torque*': [SKIP],
@@ -45,4 +42,10 @@
   'BackingStoreTest.RacyGrowWasmMemoryInPlace': [SKIP],
 }],  # tsan == True
 
+##############################################################################
+['not pointer_compression', {
+  # Tests are irrelevant without pointer compression
+  'DecompressionOptimizerTest.*': [SKIP],
+}], # not pointer_compression
+
 ]
diff --git a/deps/v8/test/unittests/utils/allocation-unittest.cc b/deps/v8/test/unittests/utils/allocation-unittest.cc
index d60aeef7b2594f..8110b1f2cd4171 100644
--- a/deps/v8/test/unittests/utils/allocation-unittest.cc
+++ b/deps/v8/test/unittests/utils/allocation-unittest.cc
@@ -110,6 +110,10 @@ sigjmp_buf MemoryAllocationPermissionsTest::continuation_;
 
 }  // namespace
 
+// TODO(almuthanna): This test was skipped because it causes a crash when it is
+// ran on Fuchsia. This issue should be solved later on
+// Ticket: https://crbug.com/1028617
+#if !defined(V8_TARGET_OS_FUCHSIA)
 TEST_F(MemoryAllocationPermissionsTest, DoTest) {
   TestPermissions(PageAllocator::Permission::kNoAccess, false, false);
   TestPermissions(PageAllocator::Permission::kRead, true, false);
@@ -117,6 +121,8 @@ TEST_F(MemoryAllocationPermissionsTest, DoTest) {
   TestPermissions(PageAllocator::Permission::kReadWriteExecute, true, true);
   TestPermissions(PageAllocator::Permission::kReadExecute, true, false);
 }
+#endif
+
 #endif  // V8_OS_POSIX
 
 // Basic tests of allocation.
diff --git a/deps/v8/test/unittests/utils/utils-unittest.cc b/deps/v8/test/unittests/utils/utils-unittest.cc
index 98771da9c9cb70..ecc29b06308f24 100644
--- a/deps/v8/test/unittests/utils/utils-unittest.cc
+++ b/deps/v8/test/unittests/utils/utils-unittest.cc
@@ -4,6 +4,7 @@
 
 #include <limits>
 
+#include "src/base/bounds.h"
 #include "src/utils/utils.h"
 #include "testing/gtest-support.h"
 
@@ -134,8 +135,8 @@ TYPED_TEST(UtilsTest, PassesFilterTest) {
 
 TEST(UtilsTest, IsInBounds) {
 // for column consistency and terseness
-#define INB(x, y, z) EXPECT_TRUE(IsInBounds(x, y, z))
-#define OOB(x, y, z) EXPECT_FALSE(IsInBounds(x, y, z))
+#define INB(x, y, z) EXPECT_TRUE(base::IsInBounds(x, y, z))
+#define OOB(x, y, z) EXPECT_FALSE(base::IsInBounds(x, y, z))
   INB(0, 0, 1);
   INB(0, 1, 1);
   INB(1, 0, 1);
diff --git a/deps/v8/test/unittests/utils/vector-unittest.cc b/deps/v8/test/unittests/utils/vector-unittest.cc
new file mode 100644
index 00000000000000..75af40d6b5eea6
--- /dev/null
+++ b/deps/v8/test/unittests/utils/vector-unittest.cc
@@ -0,0 +1,77 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/utils/utils.h"
+#include "testing/gtest-support.h"
+
+namespace v8 {
+namespace internal {
+
+TEST(VectorTest, Factories) {
+  auto vec = CStrVector("foo");
+  EXPECT_EQ(3u, vec.size());
+  EXPECT_EQ(0, memcmp(vec.begin(), "foo", 3));
+
+  vec = ArrayVector("foo");
+  EXPECT_EQ(4u, vec.size());
+  EXPECT_EQ(0, memcmp(vec.begin(), "foo\0", 4));
+
+  vec = CStrVector("foo\0\0");
+  EXPECT_EQ(3u, vec.size());
+  EXPECT_EQ(0, memcmp(vec.begin(), "foo", 3));
+
+  vec = CStrVector("");
+  EXPECT_EQ(0u, vec.size());
+
+  vec = CStrVector("\0");
+  EXPECT_EQ(0u, vec.size());
+}
+
+// Test operator== and operator!= on different Vector types.
+TEST(VectorTest, Equals) {
+  auto foo1 = CStrVector("foo");
+  auto foo2 = ArrayVector("ffoo") + 1;
+  CHECK_EQ(4, foo2.size());  // Includes trailing '\0'.
+  foo2.Truncate(foo2.size() - 1);
+  // This is a requirement for the test.
+  CHECK_NE(foo1.begin(), foo2.begin());
+  CHECK_EQ(foo1, foo2);
+
+  // Compare Vector<char> against Vector<const char>.
+  char arr1[] = {'a', 'b', 'c'};
+  char arr2[] = {'a', 'b', 'c'};
+  char arr3[] = {'a', 'b', 'd'};
+  Vector<char> vec1_char = ArrayVector(arr1);
+  Vector<const char> vec1_const_char = vec1_char;
+  Vector<char> vec2_char = ArrayVector(arr2);
+  Vector<char> vec3_char = ArrayVector(arr3);
+  CHECK_NE(vec1_char.begin(), vec2_char.begin());
+  // Note: We directly call operator== and operator!= here (without CHECK_EQ or
+  // CHECK_NE) to have full control over the arguments.
+  CHECK(vec1_char == vec1_const_char);
+  CHECK(vec1_char == vec2_char);
+  CHECK(vec1_const_char == vec2_char);
+  CHECK(vec1_const_char != vec3_char);
+  CHECK(vec3_char != vec2_char);
+  CHECK(vec3_char != vec1_const_char);
+}
+
+TEST(OwnedVectorConstruction, Equals) {
+  auto int_vec = OwnedVector<int>::New(4);
+  CHECK_EQ(4, int_vec.size());
+  auto find_non_zero = [](int i) { return i != 0; };
+  CHECK_EQ(int_vec.end(),
+           std::find_if(int_vec.begin(), int_vec.end(), find_non_zero));
+
+  constexpr int kInit[] = {4, 11, 3};
+  auto init_vec1 = OwnedVector<int>::Of(kInit);
+  // Note: {const int} should also work: We initialize the owned vector, but
+  // afterwards it's non-modifyable.
+  auto init_vec2 = OwnedVector<const int>::Of(ArrayVector(kInit));
+  CHECK_EQ(init_vec1.as_vector(), ArrayVector(kInit));
+  CHECK_EQ(init_vec1.as_vector(), init_vec2.as_vector());
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/unittests/wasm/OWNERS b/deps/v8/test/unittests/wasm/OWNERS
index 16b08f3b3b743a..0b1c176e04a878 100644
--- a/deps/v8/test/unittests/wasm/OWNERS
+++ b/deps/v8/test/unittests/wasm/OWNERS
@@ -1,5 +1,3 @@
-ahaas@chromium.org
-clemensb@chromium.org
-titzer@chromium.org
+file:../../../src/wasm/OWNERS
 
 # COMPONENT: Blink>JavaScript>WebAssembly
diff --git a/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc b/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
index 7e55283b614de0..de3f82533525ad 100644
--- a/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
@@ -38,8 +38,8 @@ static const byte kCodeGetLocal1[] = {kExprLocalGet, 1};
 static const byte kCodeSetLocal0[] = {WASM_SET_LOCAL(0, WASM_ZERO)};
 static const byte kCodeTeeLocal0[] = {WASM_TEE_LOCAL(0, WASM_ZERO)};
 
-static const ValueType kValueTypes[] = {kWasmI32, kWasmI64, kWasmF32, kWasmF64,
-                                        kWasmAnyRef};
+static const ValueType kValueTypes[] = {kWasmI32, kWasmI64,    kWasmF32,
+                                        kWasmF64, kWasmAnyRef, kWasmNullRef};
 static const MachineType machineTypes[] = {
     MachineType::Int8(),   MachineType::Uint8(),  MachineType::Int16(),
     MachineType::Uint16(), MachineType::Int32(),  MachineType::Uint32(),
@@ -60,7 +60,7 @@ class FunctionBodyDecoderTest : public TestWithZone {
   using LocalsDecl = std::pair<uint32_t, ValueType>;
   // All features are disabled by default and must be activated with
   // a WASM_FEATURE_SCOPE in individual tests.
-  WasmFeatures enabled_features_;
+  WasmFeatures enabled_features_ = WasmFeatures::None();
 
   FunctionBodyDecoderTest() : module(nullptr), local_decls(zone()) {}
 
@@ -117,7 +117,7 @@ class FunctionBodyDecoderTest : public TestWithZone {
 
     // Validate the code.
     FunctionBody body(sig, 0, code.begin(), code.end());
-    WasmFeatures unused_detected_features;
+    WasmFeatures unused_detected_features = WasmFeatures::None();
     DecodeResult result =
         VerifyWasmCode(zone()->allocator(), enabled_features_, module,
                        &unused_detected_features, body);
@@ -200,17 +200,6 @@ class FunctionBodyDecoderTest : public TestWithZone {
 
 namespace {
 
-class EnableBoolScope {
- public:
-  bool prev_;
-  bool* ptr_;
-  explicit EnableBoolScope(bool* ptr) : prev_(*ptr), ptr_(ptr) { *ptr = true; }
-  ~EnableBoolScope() { *ptr_ = prev_; }
-};
-
-#define WASM_FEATURE_SCOPE(feat) \
-  EnableBoolScope feat##_scope(&this->enabled_features_.feat);
-
 constexpr size_t kMaxByteSizedLeb128 = 127;
 
 // A helper for tests that require a module environment for functions,
@@ -254,7 +243,7 @@ class TestModuleBuilder {
 
   byte AddTable(ValueType type, uint32_t initial_size, bool has_maximum_size,
                 uint32_t maximum_size) {
-    CHECK(type == kWasmAnyRef || type == kWasmFuncRef);
+    CHECK(type == kWasmAnyRef || type == kWasmFuncRef || type == kWasmNullRef);
     mod.tables.emplace_back();
     WasmTable& table = mod.tables.back();
     table.type = type;
@@ -307,6 +296,7 @@ TEST_F(FunctionBodyDecoderTest, Int32Const1) {
 TEST_F(FunctionBodyDecoderTest, RefNull) {
   WASM_FEATURE_SCOPE(anyref);
   ExpectValidates(sigs.r_v(), {kExprRefNull});
+  ExpectValidates(sigs.n_v(), {kExprRefNull});
 }
 
 TEST_F(FunctionBodyDecoderTest, RefFunc) {
@@ -1358,7 +1348,6 @@ TEST_F(FunctionBodyDecoderTest, MacrosInt64) {
 }
 
 TEST_F(FunctionBodyDecoderTest, AllSimpleExpressions) {
-  WASM_FEATURE_SCOPE(se);
   WASM_FEATURE_SCOPE(anyref);
 // Test all simple expressions which are described by a signature.
 #define DECODE_TEST(name, opcode, sig)                      \
@@ -1625,15 +1614,15 @@ TEST_F(FunctionBodyDecoderTest, SimpleIndirectReturnCalls) {
   builder.AddTable(kWasmFuncRef, 20, true, 30);
   module = builder.module();
 
-  byte f0 = builder.AddSignature(sigs.i_v());
-  byte f1 = builder.AddSignature(sigs.i_i());
-  byte f2 = builder.AddSignature(sigs.i_ii());
+  byte sig0 = builder.AddSignature(sigs.i_v());
+  byte sig1 = builder.AddSignature(sigs.i_i());
+  byte sig2 = builder.AddSignature(sigs.i_ii());
 
-  ExpectValidates(sig, {WASM_RETURN_CALL_INDIRECT0(f0, WASM_ZERO)});
-  ExpectValidates(sig,
-                  {WASM_RETURN_CALL_INDIRECT(f1, WASM_ZERO, WASM_I32V_1(22))});
-  ExpectValidates(sig, {WASM_RETURN_CALL_INDIRECT(
-                           f2, WASM_ZERO, WASM_I32V_1(32), WASM_I32V_2(72))});
+  ExpectValidates(sig, {WASM_RETURN_CALL_INDIRECT(sig0, WASM_ZERO)});
+  ExpectValidates(
+      sig, {WASM_RETURN_CALL_INDIRECT(sig1, WASM_I32V_1(22), WASM_ZERO)});
+  ExpectValidates(sig, {WASM_RETURN_CALL_INDIRECT(sig2, WASM_I32V_1(32),
+                                                  WASM_I32V_2(72), WASM_ZERO)});
 }
 
 TEST_F(FunctionBodyDecoderTest, IndirectReturnCallsOutOfBounds) {
@@ -1644,18 +1633,18 @@ TEST_F(FunctionBodyDecoderTest, IndirectReturnCallsOutOfBounds) {
   builder.AddTable(kWasmFuncRef, 20, false, 20);
   module = builder.module();
 
-  ExpectFailure(sig, {WASM_RETURN_CALL_INDIRECT0(0, WASM_ZERO)});
+  ExpectFailure(sig, {WASM_RETURN_CALL_INDIRECT(0, WASM_ZERO)});
   builder.AddSignature(sigs.i_v());
-  ExpectValidates(sig, {WASM_RETURN_CALL_INDIRECT0(0, WASM_ZERO)});
+  ExpectValidates(sig, {WASM_RETURN_CALL_INDIRECT(0, WASM_ZERO)});
 
   ExpectFailure(sig,
-                {WASM_RETURN_CALL_INDIRECT(1, WASM_ZERO, WASM_I32V_1(22))});
+                {WASM_RETURN_CALL_INDIRECT(1, WASM_I32V_1(22), WASM_ZERO)});
   builder.AddSignature(sigs.i_i());
   ExpectValidates(sig,
-                  {WASM_RETURN_CALL_INDIRECT(1, WASM_ZERO, WASM_I32V_1(27))});
+                  {WASM_RETURN_CALL_INDIRECT(1, WASM_I32V_1(27), WASM_ZERO)});
 
   ExpectFailure(sig,
-                {WASM_RETURN_CALL_INDIRECT(2, WASM_ZERO, WASM_I32V_1(27))});
+                {WASM_RETURN_CALL_INDIRECT(2, WASM_I32V_1(27), WASM_ZERO)});
 }
 
 TEST_F(FunctionBodyDecoderTest, IndirectReturnCallsWithMismatchedSigs3) {
@@ -1666,27 +1655,27 @@ TEST_F(FunctionBodyDecoderTest, IndirectReturnCallsWithMismatchedSigs3) {
   builder.InitializeTable();
   module = builder.module();
 
-  byte f0 = builder.AddFunction(sigs.i_f());
+  byte sig0 = builder.AddSignature(sigs.i_f());
 
   ExpectFailure(sig,
-                {WASM_RETURN_CALL_INDIRECT(f0, WASM_ZERO, WASM_I32V_1(17))});
+                {WASM_RETURN_CALL_INDIRECT(sig0, WASM_I32V_1(17), WASM_ZERO)});
   ExpectFailure(sig,
-                {WASM_RETURN_CALL_INDIRECT(f0, WASM_ZERO, WASM_I64V_1(27))});
+                {WASM_RETURN_CALL_INDIRECT(sig0, WASM_I64V_1(27), WASM_ZERO)});
   ExpectFailure(sig,
-                {WASM_RETURN_CALL_INDIRECT(f0, WASM_ZERO, WASM_F64(37.2))});
+                {WASM_RETURN_CALL_INDIRECT(sig0, WASM_F64(37.2), WASM_ZERO)});
 
-  ExpectFailure(sig, {WASM_RETURN_CALL_INDIRECT0(f0, WASM_I32V_1(17))});
-  ExpectFailure(sig, {WASM_RETURN_CALL_INDIRECT0(f0, WASM_I64V_1(27))});
-  ExpectFailure(sig, {WASM_RETURN_CALL_INDIRECT0(f0, WASM_F64(37.2))});
+  ExpectFailure(sig, {WASM_RETURN_CALL_INDIRECT(sig0, WASM_I32V_1(17))});
+  ExpectFailure(sig, {WASM_RETURN_CALL_INDIRECT(sig0, WASM_I64V_1(27))});
+  ExpectFailure(sig, {WASM_RETURN_CALL_INDIRECT(sig0, WASM_F64(37.2))});
 
-  byte f1 = builder.AddFunction(sigs.i_d());
+  byte sig1 = builder.AddFunction(sigs.i_d());
 
   ExpectFailure(sig,
-                {WASM_RETURN_CALL_INDIRECT(f1, WASM_ZERO, WASM_I32V_1(16))});
+                {WASM_RETURN_CALL_INDIRECT(sig1, WASM_I32V_1(16), WASM_ZERO)});
   ExpectFailure(sig,
-                {WASM_RETURN_CALL_INDIRECT(f1, WASM_ZERO, WASM_I64V_1(16))});
+                {WASM_RETURN_CALL_INDIRECT(sig1, WASM_I64V_1(16), WASM_ZERO)});
   ExpectFailure(sig,
-                {WASM_RETURN_CALL_INDIRECT(f1, WASM_ZERO, WASM_F32(17.6))});
+                {WASM_RETURN_CALL_INDIRECT(sig1, WASM_F32(17.6), WASM_ZERO)});
 }
 
 TEST_F(FunctionBodyDecoderTest, IndirectReturnCallsWithoutTableCrash) {
@@ -1696,15 +1685,15 @@ TEST_F(FunctionBodyDecoderTest, IndirectReturnCallsWithoutTableCrash) {
   TestModuleBuilder builder;
   module = builder.module();
 
-  byte f0 = builder.AddSignature(sigs.i_v());
-  byte f1 = builder.AddSignature(sigs.i_i());
-  byte f2 = builder.AddSignature(sigs.i_ii());
+  byte sig0 = builder.AddSignature(sigs.i_v());
+  byte sig1 = builder.AddSignature(sigs.i_i());
+  byte sig2 = builder.AddSignature(sigs.i_ii());
 
-  ExpectFailure(sig, {WASM_RETURN_CALL_INDIRECT0(f0, WASM_ZERO)});
+  ExpectFailure(sig, {WASM_RETURN_CALL_INDIRECT(sig0, WASM_ZERO)});
   ExpectFailure(sig,
-                {WASM_RETURN_CALL_INDIRECT(f1, WASM_ZERO, WASM_I32V_1(22))});
-  ExpectFailure(sig, {WASM_RETURN_CALL_INDIRECT(f2, WASM_ZERO, WASM_I32V_1(32),
-                                                WASM_I32V_2(72))});
+                {WASM_RETURN_CALL_INDIRECT(sig1, WASM_I32V_1(22), WASM_ZERO)});
+  ExpectFailure(sig, {WASM_RETURN_CALL_INDIRECT(sig2, WASM_I32V_1(32),
+                                                WASM_I32V_2(72), WASM_ZERO)});
 }
 
 TEST_F(FunctionBodyDecoderTest, IncompleteIndirectReturnCall) {
@@ -1750,7 +1739,8 @@ TEST_F(FunctionBodyDecoderTest, MultiReturnType) {
 
           ExpectValidates(&sig_cd_v, {WASM_CALL_FUNCTION0(0)});
 
-          if (a == c && b == d) {
+          if (ValueTypes::IsSubType(kValueTypes[c], kValueTypes[a]) &&
+              ValueTypes::IsSubType(kValueTypes[d], kValueTypes[b])) {
             ExpectValidates(&sig_ab_v, {WASM_CALL_FUNCTION0(0)});
           } else {
             ExpectFailure(&sig_ab_v, {WASM_CALL_FUNCTION0(0)});
@@ -1767,14 +1757,14 @@ TEST_F(FunctionBodyDecoderTest, SimpleIndirectCalls) {
   builder.AddTable(kWasmFuncRef, 20, false, 20);
   module = builder.module();
 
-  byte f0 = builder.AddSignature(sigs.i_v());
-  byte f1 = builder.AddSignature(sigs.i_i());
-  byte f2 = builder.AddSignature(sigs.i_ii());
+  byte sig0 = builder.AddSignature(sigs.i_v());
+  byte sig1 = builder.AddSignature(sigs.i_i());
+  byte sig2 = builder.AddSignature(sigs.i_ii());
 
-  ExpectValidates(sig, {WASM_CALL_INDIRECT0(f0, WASM_ZERO)});
-  ExpectValidates(sig, {WASM_CALL_INDIRECT1(f1, WASM_ZERO, WASM_I32V_1(22))});
-  ExpectValidates(sig, {WASM_CALL_INDIRECT2(f2, WASM_ZERO, WASM_I32V_1(32),
-                                            WASM_I32V_2(72))});
+  ExpectValidates(sig, {WASM_CALL_INDIRECT(sig0, WASM_ZERO)});
+  ExpectValidates(sig, {WASM_CALL_INDIRECT(sig1, WASM_I32V_1(22), WASM_ZERO)});
+  ExpectValidates(sig, {WASM_CALL_INDIRECT(sig2, WASM_I32V_1(32),
+                                           WASM_I32V_2(72), WASM_ZERO)});
 }
 
 TEST_F(FunctionBodyDecoderTest, IndirectCallsOutOfBounds) {
@@ -1783,15 +1773,15 @@ TEST_F(FunctionBodyDecoderTest, IndirectCallsOutOfBounds) {
   builder.AddTable(kWasmFuncRef, 20, false, 20);
   module = builder.module();
 
-  ExpectFailure(sig, {WASM_CALL_INDIRECT0(0, WASM_ZERO)});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(0, WASM_ZERO)});
   builder.AddSignature(sigs.i_v());
-  ExpectValidates(sig, {WASM_CALL_INDIRECT0(0, WASM_ZERO)});
+  ExpectValidates(sig, {WASM_CALL_INDIRECT(0, WASM_ZERO)});
 
-  ExpectFailure(sig, {WASM_CALL_INDIRECT1(1, WASM_ZERO, WASM_I32V_1(22))});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(1, WASM_I32V_1(22), WASM_ZERO)});
   builder.AddSignature(sigs.i_i());
-  ExpectValidates(sig, {WASM_CALL_INDIRECT1(1, WASM_ZERO, WASM_I32V_1(27))});
+  ExpectValidates(sig, {WASM_CALL_INDIRECT(1, WASM_I32V_1(27), WASM_ZERO)});
 
-  ExpectFailure(sig, {WASM_CALL_INDIRECT1(2, WASM_ZERO, WASM_I32V_1(27))});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(2, WASM_I32V_1(27), WASM_ZERO)});
 }
 
 TEST_F(FunctionBodyDecoderTest, IndirectCallsWithMismatchedSigs3) {
@@ -1800,21 +1790,21 @@ TEST_F(FunctionBodyDecoderTest, IndirectCallsWithMismatchedSigs3) {
   builder.InitializeTable();
   module = builder.module();
 
-  byte f0 = builder.AddFunction(sigs.i_f());
+  byte sig0 = builder.AddSignature(sigs.i_f());
 
-  ExpectFailure(sig, {WASM_CALL_INDIRECT1(f0, WASM_ZERO, WASM_I32V_1(17))});
-  ExpectFailure(sig, {WASM_CALL_INDIRECT1(f0, WASM_ZERO, WASM_I64V_1(27))});
-  ExpectFailure(sig, {WASM_CALL_INDIRECT1(f0, WASM_ZERO, WASM_F64(37.2))});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(sig0, WASM_I32V_1(17), WASM_ZERO)});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(sig0, WASM_I64V_1(27), WASM_ZERO)});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(sig0, WASM_F64(37.2), WASM_ZERO)});
 
-  ExpectFailure(sig, {WASM_CALL_INDIRECT0(f0, WASM_I32V_1(17))});
-  ExpectFailure(sig, {WASM_CALL_INDIRECT0(f0, WASM_I64V_1(27))});
-  ExpectFailure(sig, {WASM_CALL_INDIRECT0(f0, WASM_F64(37.2))});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(sig0, WASM_I32V_1(17))});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(sig0, WASM_I64V_1(27))});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(sig0, WASM_F64(37.2))});
 
-  byte f1 = builder.AddFunction(sigs.i_d());
+  byte sig1 = builder.AddFunction(sigs.i_d());
 
-  ExpectFailure(sig, {WASM_CALL_INDIRECT1(f1, WASM_ZERO, WASM_I32V_1(16))});
-  ExpectFailure(sig, {WASM_CALL_INDIRECT1(f1, WASM_ZERO, WASM_I64V_1(16))});
-  ExpectFailure(sig, {WASM_CALL_INDIRECT1(f1, WASM_ZERO, WASM_F32(17.6))});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(sig1, WASM_I32V_1(16), WASM_ZERO)});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(sig1, WASM_I64V_1(16), WASM_ZERO)});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(sig1, WASM_F32(17.6), WASM_ZERO)});
 }
 
 TEST_F(FunctionBodyDecoderTest, IndirectCallsWithoutTableCrash) {
@@ -1822,14 +1812,14 @@ TEST_F(FunctionBodyDecoderTest, IndirectCallsWithoutTableCrash) {
   TestModuleBuilder builder;
   module = builder.module();
 
-  byte f0 = builder.AddSignature(sigs.i_v());
-  byte f1 = builder.AddSignature(sigs.i_i());
-  byte f2 = builder.AddSignature(sigs.i_ii());
+  byte sig0 = builder.AddSignature(sigs.i_v());
+  byte sig1 = builder.AddSignature(sigs.i_i());
+  byte sig2 = builder.AddSignature(sigs.i_ii());
 
-  ExpectFailure(sig, {WASM_CALL_INDIRECT0(f0, WASM_ZERO)});
-  ExpectFailure(sig, {WASM_CALL_INDIRECT1(f1, WASM_ZERO, WASM_I32V_1(22))});
-  ExpectFailure(sig, {WASM_CALL_INDIRECT2(f2, WASM_ZERO, WASM_I32V_1(32),
-                                          WASM_I32V_2(72))});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(sig0, WASM_ZERO)});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(sig1, WASM_I32V_1(22), WASM_ZERO)});
+  ExpectFailure(sig, {WASM_CALL_INDIRECT(sig2, WASM_I32V_1(32), WASM_I32V_2(72),
+                                         WASM_ZERO)});
 }
 
 TEST_F(FunctionBodyDecoderTest, IncompleteIndirectCall) {
@@ -1996,7 +1986,8 @@ TEST_F(FunctionBodyDecoderTest, AllGetGlobalCombinations) {
       TestModuleBuilder builder;
       module = builder.module();
       builder.AddGlobal(global_type);
-      Validate(local_type == global_type, &sig, {WASM_GET_GLOBAL(0)});
+      Validate(ValueTypes::IsSubType(global_type, local_type), &sig,
+               {WASM_GET_GLOBAL(0)});
     }
   }
 }
@@ -2010,7 +2001,7 @@ TEST_F(FunctionBodyDecoderTest, AllSetGlobalCombinations) {
       TestModuleBuilder builder;
       module = builder.module();
       builder.AddGlobal(global_type);
-      Validate(local_type == global_type, &sig,
+      Validate(ValueTypes::IsSubType(local_type, global_type), &sig,
                {WASM_SET_GLOBAL(0, WASM_GET_LOCAL(0))});
     }
   }
@@ -2024,11 +2015,14 @@ TEST_F(FunctionBodyDecoderTest, TableSet) {
   byte tab_func1 = builder.AddTable(kWasmFuncRef, 20, true, 30);
   byte tab_func2 = builder.AddTable(kWasmFuncRef, 10, false, 20);
   byte tab_ref2 = builder.AddTable(kWasmAnyRef, 10, false, 20);
-  ValueType sig_types[]{kWasmAnyRef, kWasmFuncRef, kWasmI32};
-  FunctionSig sig(0, 3, sig_types);
+  byte tab_null1 = builder.AddTable(kWasmNullRef, 10, true, 20);
+  byte tab_null2 = builder.AddTable(kWasmNullRef, 10, false, 20);
+  ValueType sig_types[]{kWasmAnyRef, kWasmFuncRef, kWasmNullRef, kWasmI32};
+  FunctionSig sig(0, 4, sig_types);
   byte local_ref = 0;
   byte local_func = 1;
-  byte local_int = 2;
+  byte local_null = 2;
+  byte local_int = 3;
   ExpectValidates(&sig, {WASM_TABLE_SET(tab_ref1, WASM_I32V(6),
                                         WASM_GET_LOCAL(local_ref))});
   ExpectValidates(&sig, {WASM_TABLE_SET(tab_func1, WASM_I32V(5),
@@ -2051,12 +2045,42 @@ TEST_F(FunctionBodyDecoderTest, TableSet) {
                                       WASM_GET_LOCAL(local_int))});
   ExpectFailure(&sig, {WASM_TABLE_SET(tab_func1, WASM_I32V(3),
                                       WASM_GET_LOCAL(local_int))});
+
+  // We can store nullref values as funcref or anyref but not the other way
+  // round.
+  ExpectValidates(&sig, {WASM_TABLE_SET(tab_null1, WASM_I32V(3),
+                                        WASM_GET_LOCAL(local_null))});
+  ExpectValidates(&sig, {WASM_TABLE_SET(tab_ref1, WASM_I32V(8),
+                                        WASM_GET_LOCAL(local_null))});
+  ExpectValidates(&sig, {WASM_TABLE_SET(tab_func1, WASM_I32V(8),
+                                        WASM_GET_LOCAL(local_null))});
+  ExpectFailure(&sig, {WASM_TABLE_SET(tab_null1, WASM_I32V(3),
+                                      WASM_GET_LOCAL(local_ref))});
+  ExpectFailure(&sig, {WASM_TABLE_SET(tab_null1, WASM_I32V(3),
+                                      WASM_GET_LOCAL(local_func))});
+  ExpectFailure(&sig, {WASM_TABLE_SET(tab_null1, WASM_I32V(3),
+                                      WASM_GET_LOCAL(local_int))});
+  ExpectValidates(&sig, {WASM_TABLE_SET(tab_null2, WASM_I32V(3),
+                                        WASM_GET_LOCAL(local_null))});
+  ExpectValidates(&sig, {WASM_TABLE_SET(tab_ref2, WASM_I32V(8),
+                                        WASM_GET_LOCAL(local_null))});
+  ExpectValidates(&sig, {WASM_TABLE_SET(tab_func2, WASM_I32V(8),
+                                        WASM_GET_LOCAL(local_null))});
+  ExpectFailure(&sig, {WASM_TABLE_SET(tab_null2, WASM_I32V(3),
+                                      WASM_GET_LOCAL(local_ref))});
+  ExpectFailure(&sig, {WASM_TABLE_SET(tab_null2, WASM_I32V(3),
+                                      WASM_GET_LOCAL(local_func))});
+  ExpectFailure(&sig, {WASM_TABLE_SET(tab_null2, WASM_I32V(3),
+                                      WASM_GET_LOCAL(local_int))});
+
   // Out-of-bounds table index should fail.
   byte oob_tab = 37;
   ExpectFailure(
       &sig, {WASM_TABLE_SET(oob_tab, WASM_I32V(9), WASM_GET_LOCAL(local_ref))});
   ExpectFailure(&sig, {WASM_TABLE_SET(oob_tab, WASM_I32V(3),
                                       WASM_GET_LOCAL(local_func))});
+  ExpectFailure(&sig, {WASM_TABLE_SET(oob_tab, WASM_I32V(3),
+                                      WASM_GET_LOCAL(local_null))});
 }
 
 TEST_F(FunctionBodyDecoderTest, TableGet) {
@@ -2374,7 +2398,8 @@ TEST_F(FunctionBodyDecoderTest, Break_TypeCheckAll1) {
           sig.GetReturn(), WASM_IF(WASM_ZERO, WASM_BRV(0, WASM_GET_LOCAL(0))),
           WASM_GET_LOCAL(1))};
 
-      Validate(i == j, &sig, code);
+      Validate(ValueTypes::IsSubType(kValueTypes[j], kValueTypes[i]), &sig,
+               code);
     }
   }
 }
@@ -2388,7 +2413,8 @@ TEST_F(FunctionBodyDecoderTest, Break_TypeCheckAll2) {
                                     WASM_BRV_IF_ZERO(0, WASM_GET_LOCAL(0)),
                                     WASM_GET_LOCAL(1))};
 
-      Validate(i == j, &sig, code);
+      Validate(ValueTypes::IsSubType(kValueTypes[j], kValueTypes[i]), &sig,
+               code);
     }
   }
 }
@@ -2402,7 +2428,8 @@ TEST_F(FunctionBodyDecoderTest, Break_TypeCheckAll3) {
                                     WASM_GET_LOCAL(1),
                                     WASM_BRV_IF_ZERO(0, WASM_GET_LOCAL(0)))};
 
-      Validate(i == j, &sig, code);
+      Validate(ValueTypes::IsSubType(kValueTypes[j], kValueTypes[i]), &sig,
+               code);
     }
   }
 }
@@ -2446,7 +2473,8 @@ TEST_F(FunctionBodyDecoderTest, BreakIf_val_type) {
           types[1], WASM_BRV_IF(0, WASM_GET_LOCAL(1), WASM_GET_LOCAL(2)),
           WASM_DROP, WASM_GET_LOCAL(0))};
 
-      Validate(i == j, &sig, code);
+      Validate(ValueTypes::IsSubType(kValueTypes[j], kValueTypes[i]), &sig,
+               code);
     }
   }
 }
@@ -2677,7 +2705,7 @@ TEST_F(FunctionBodyDecoderTest, Select_fail2) {
     ValueType type = kValueTypes[i];
     if (type == kWasmI32) continue;
     // Select without specified type is only allowed for number types.
-    if (type == kWasmAnyRef) continue;
+    if (type == kWasmAnyRef || type == kWasmNullRef) continue;
 
     ValueType types[] = {type, kWasmI32, type};
     FunctionSig sig(1, 2, types);
@@ -2825,40 +2853,40 @@ TEST_F(FunctionBodyDecoderTest, MultiValBlock1) {
   WASM_FEATURE_SCOPE(mv);
   TestModuleBuilder builder;
   module = builder.module();
-  byte f0 = builder.AddSignature(sigs.ii_v());
+  byte sig0 = builder.AddSignature(sigs.ii_v());
   ExpectValidates(
       sigs.i_ii(),
-      {WASM_BLOCK_X(f0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)), kExprI32Add});
-  ExpectFailure(sigs.i_ii(), {WASM_BLOCK_X(f0, WASM_NOP), kExprI32Add});
+      {WASM_BLOCK_X(sig0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)), kExprI32Add});
+  ExpectFailure(sigs.i_ii(), {WASM_BLOCK_X(sig0, WASM_NOP), kExprI32Add});
   ExpectFailure(sigs.i_ii(),
-                {WASM_BLOCK_X(f0, WASM_GET_LOCAL(0)), kExprI32Add});
+                {WASM_BLOCK_X(sig0, WASM_GET_LOCAL(0)), kExprI32Add});
   ExpectFailure(sigs.i_ii(),
-                {WASM_BLOCK_X(f0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
+                {WASM_BLOCK_X(sig0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
                               WASM_GET_LOCAL(0)),
                  kExprI32Add});
   ExpectFailure(
       sigs.i_ii(),
-      {WASM_BLOCK_X(f0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)), kExprF32Add});
+      {WASM_BLOCK_X(sig0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)), kExprF32Add});
 }
 
 TEST_F(FunctionBodyDecoderTest, MultiValBlock2) {
   WASM_FEATURE_SCOPE(mv);
   TestModuleBuilder builder;
   module = builder.module();
-  byte f0 = builder.AddSignature(sigs.ii_v());
+  byte sig0 = builder.AddSignature(sigs.ii_v());
   ExpectValidates(sigs.i_ii(),
-                  {WASM_BLOCK_X(f0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)),
+                  {WASM_BLOCK_X(sig0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)),
                    WASM_I32_ADD(WASM_NOP, WASM_NOP)});
-  ExpectFailure(sigs.i_ii(),
-                {WASM_BLOCK_X(f0, WASM_NOP), WASM_I32_ADD(WASM_NOP, WASM_NOP)});
-  ExpectFailure(sigs.i_ii(), {WASM_BLOCK_X(f0, WASM_GET_LOCAL(0)),
+  ExpectFailure(sigs.i_ii(), {WASM_BLOCK_X(sig0, WASM_NOP),
+                              WASM_I32_ADD(WASM_NOP, WASM_NOP)});
+  ExpectFailure(sigs.i_ii(), {WASM_BLOCK_X(sig0, WASM_GET_LOCAL(0)),
                               WASM_I32_ADD(WASM_NOP, WASM_NOP)});
   ExpectFailure(sigs.i_ii(),
-                {WASM_BLOCK_X(f0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
+                {WASM_BLOCK_X(sig0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
                               WASM_GET_LOCAL(0)),
                  WASM_I32_ADD(WASM_NOP, WASM_NOP)});
   ExpectFailure(sigs.i_ii(),
-                {WASM_BLOCK_X(f0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)),
+                {WASM_BLOCK_X(sig0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)),
                  WASM_F32_ADD(WASM_NOP, WASM_NOP)});
 }
 
@@ -2866,10 +2894,10 @@ TEST_F(FunctionBodyDecoderTest, MultiValBlockBr) {
   WASM_FEATURE_SCOPE(mv);
   TestModuleBuilder builder;
   module = builder.module();
-  byte f0 = builder.AddSignature(sigs.ii_v());
-  ExpectFailure(sigs.i_ii(),
-                {WASM_BLOCK_X(f0, WASM_GET_LOCAL(0), WASM_BR(0)), kExprI32Add});
-  ExpectValidates(sigs.i_ii(), {WASM_BLOCK_X(f0, WASM_GET_LOCAL(0),
+  byte sig0 = builder.AddSignature(sigs.ii_v());
+  ExpectFailure(sigs.i_ii(), {WASM_BLOCK_X(sig0, WASM_GET_LOCAL(0), WASM_BR(0)),
+                              kExprI32Add});
+  ExpectValidates(sigs.i_ii(), {WASM_BLOCK_X(sig0, WASM_GET_LOCAL(0),
                                              WASM_GET_LOCAL(1), WASM_BR(0)),
                                 kExprI32Add});
 }
@@ -2878,77 +2906,78 @@ TEST_F(FunctionBodyDecoderTest, MultiValLoop1) {
   WASM_FEATURE_SCOPE(mv);
   TestModuleBuilder builder;
   module = builder.module();
-  byte f0 = builder.AddSignature(sigs.ii_v());
+  byte sig0 = builder.AddSignature(sigs.ii_v());
   ExpectValidates(
       sigs.i_ii(),
-      {WASM_LOOP_X(f0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)), kExprI32Add});
-  ExpectFailure(sigs.i_ii(), {WASM_LOOP_X(f0, WASM_NOP), kExprI32Add});
-  ExpectFailure(sigs.i_ii(), {WASM_LOOP_X(f0, WASM_GET_LOCAL(0)), kExprI32Add});
-  ExpectFailure(sigs.i_ii(), {WASM_LOOP_X(f0, WASM_GET_LOCAL(0),
+      {WASM_LOOP_X(sig0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)), kExprI32Add});
+  ExpectFailure(sigs.i_ii(), {WASM_LOOP_X(sig0, WASM_NOP), kExprI32Add});
+  ExpectFailure(sigs.i_ii(),
+                {WASM_LOOP_X(sig0, WASM_GET_LOCAL(0)), kExprI32Add});
+  ExpectFailure(sigs.i_ii(), {WASM_LOOP_X(sig0, WASM_GET_LOCAL(0),
                                           WASM_GET_LOCAL(1), WASM_GET_LOCAL(0)),
                               kExprI32Add});
   ExpectFailure(
       sigs.i_ii(),
-      {WASM_LOOP_X(f0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)), kExprF32Add});
+      {WASM_LOOP_X(sig0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)), kExprF32Add});
 }
 
 TEST_F(FunctionBodyDecoderTest, MultiValIf) {
   WASM_FEATURE_SCOPE(mv);
   TestModuleBuilder builder;
   module = builder.module();
-  byte f0 = builder.AddSignature(sigs.ii_v());
+  byte sig0 = builder.AddSignature(sigs.ii_v());
   ExpectValidates(
       sigs.i_ii(),
-      {WASM_IF_ELSE_X(f0, WASM_GET_LOCAL(0),
+      {WASM_IF_ELSE_X(sig0, WASM_GET_LOCAL(0),
                       WASM_SEQ(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)),
                       WASM_SEQ(WASM_GET_LOCAL(1), WASM_GET_LOCAL(0))),
        kExprI32Add});
-  ExpectFailure(
-      sigs.i_ii(),
-      {WASM_IF_ELSE_X(f0, WASM_GET_LOCAL(0), WASM_NOP, WASM_NOP), kExprI32Add});
   ExpectFailure(sigs.i_ii(),
-                {WASM_IF_ELSE_X(f0, WASM_GET_LOCAL(0), WASM_NOP,
+                {WASM_IF_ELSE_X(sig0, WASM_GET_LOCAL(0), WASM_NOP, WASM_NOP),
+                 kExprI32Add});
+  ExpectFailure(sigs.i_ii(),
+                {WASM_IF_ELSE_X(sig0, WASM_GET_LOCAL(0), WASM_NOP,
                                 WASM_SEQ(WASM_GET_LOCAL(1), WASM_GET_LOCAL(0))),
                  kExprI32Add});
   ExpectFailure(
       sigs.i_ii(),
-      {WASM_IF_ELSE_X(f0, WASM_GET_LOCAL(0),
+      {WASM_IF_ELSE_X(sig0, WASM_GET_LOCAL(0),
                       WASM_SEQ(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)), WASM_NOP),
        kExprI32Add});
   ExpectFailure(sigs.i_ii(),
-                {WASM_IF_ELSE_X(f0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(0),
+                {WASM_IF_ELSE_X(sig0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(0),
                                 WASM_GET_LOCAL(1)),
                  kExprI32Add});
   ExpectFailure(sigs.i_ii(),
-                {WASM_IF_ELSE_X(f0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(0),
+                {WASM_IF_ELSE_X(sig0, WASM_GET_LOCAL(0), WASM_GET_LOCAL(0),
                                 WASM_SEQ(WASM_GET_LOCAL(1), WASM_GET_LOCAL(0))),
                  kExprI32Add});
   ExpectFailure(sigs.i_ii(),
-                {WASM_IF_ELSE_X(f0, WASM_GET_LOCAL(0),
+                {WASM_IF_ELSE_X(sig0, WASM_GET_LOCAL(0),
                                 WASM_SEQ(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)),
                                 WASM_GET_LOCAL(1)),
                  kExprI32Add});
   ExpectFailure(
       sigs.i_ii(),
       {WASM_IF_ELSE_X(
-           f0, WASM_GET_LOCAL(0),
+           sig0, WASM_GET_LOCAL(0),
            WASM_SEQ(WASM_GET_LOCAL(0), WASM_GET_LOCAL(0), WASM_GET_LOCAL(0)),
            WASM_SEQ(WASM_GET_LOCAL(1), WASM_GET_LOCAL(0), WASM_GET_LOCAL(0))),
        kExprI32Add});
   ExpectFailure(sigs.i_ii(),
-                {WASM_IF_ELSE_X(f0, WASM_GET_LOCAL(0),
+                {WASM_IF_ELSE_X(sig0, WASM_GET_LOCAL(0),
                                 WASM_SEQ(WASM_GET_LOCAL(0), WASM_GET_LOCAL(0),
                                          WASM_GET_LOCAL(0)),
                                 WASM_SEQ(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))),
                  kExprI32Add});
   ExpectFailure(sigs.i_ii(),
-                {WASM_IF_ELSE_X(f0, WASM_GET_LOCAL(0),
+                {WASM_IF_ELSE_X(sig0, WASM_GET_LOCAL(0),
                                 WASM_SEQ(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)),
                                 WASM_SEQ(WASM_GET_LOCAL(1), WASM_GET_LOCAL(1),
                                          WASM_GET_LOCAL(1))),
                  kExprI32Add});
   ExpectFailure(sigs.i_ii(),
-                {WASM_IF_ELSE_X(f0, WASM_GET_LOCAL(0),
+                {WASM_IF_ELSE_X(sig0, WASM_GET_LOCAL(0),
                                 WASM_SEQ(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)),
                                 WASM_SEQ(WASM_GET_LOCAL(1), WASM_GET_LOCAL(0))),
                  kExprF32Add});
@@ -2958,28 +2987,28 @@ TEST_F(FunctionBodyDecoderTest, BlockParam) {
   WASM_FEATURE_SCOPE(mv);
   TestModuleBuilder builder;
   module = builder.module();
-  byte f1 = builder.AddSignature(sigs.i_i());
-  byte f2 = builder.AddSignature(sigs.i_ii());
+  byte sig1 = builder.AddSignature(sigs.i_i());
+  byte sig2 = builder.AddSignature(sigs.i_ii());
   ExpectValidates(
       sigs.i_ii(),
-      {WASM_GET_LOCAL(0),
-       WASM_BLOCK_X(f1, WASM_GET_LOCAL(1), WASM_I32_ADD(WASM_NOP, WASM_NOP))});
+      {WASM_GET_LOCAL(0), WASM_BLOCK_X(sig1, WASM_GET_LOCAL(1),
+                                       WASM_I32_ADD(WASM_NOP, WASM_NOP))});
   ExpectValidates(sigs.i_ii(),
                   {WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
-                   WASM_BLOCK_X(f2, WASM_I32_ADD(WASM_NOP, WASM_NOP))});
+                   WASM_BLOCK_X(sig2, WASM_I32_ADD(WASM_NOP, WASM_NOP))});
   ExpectValidates(sigs.i_ii(), {WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
-                                WASM_BLOCK_X(f1, WASM_NOP),
+                                WASM_BLOCK_X(sig1, WASM_NOP),
                                 WASM_I32_ADD(WASM_NOP, WASM_NOP)});
-  ExpectFailure(sigs.i_ii(),
-                {WASM_BLOCK_X(f1, WASM_NOP), WASM_RETURN1(WASM_GET_LOCAL(0))});
-  ExpectFailure(sigs.i_ii(), {WASM_BLOCK_X(f1, WASM_GET_LOCAL(0)),
+  ExpectFailure(sigs.i_ii(), {WASM_BLOCK_X(sig1, WASM_NOP),
+                              WASM_RETURN1(WASM_GET_LOCAL(0))});
+  ExpectFailure(sigs.i_ii(), {WASM_BLOCK_X(sig1, WASM_GET_LOCAL(0)),
                               WASM_RETURN1(WASM_GET_LOCAL(0))});
   ExpectFailure(
       sigs.i_ii(),
-      {WASM_GET_LOCAL(0), WASM_BLOCK_X(f2, WASM_I32_ADD(WASM_NOP, WASM_NOP)),
+      {WASM_GET_LOCAL(0), WASM_BLOCK_X(sig2, WASM_I32_ADD(WASM_NOP, WASM_NOP)),
        WASM_RETURN1(WASM_GET_LOCAL(0))});
   ExpectFailure(sigs.i_ii(),
-                {WASM_GET_LOCAL(0), WASM_BLOCK_X(f1, WASM_F32_NEG(WASM_NOP)),
+                {WASM_GET_LOCAL(0), WASM_BLOCK_X(sig1, WASM_F32_NEG(WASM_NOP)),
                  WASM_RETURN1(WASM_GET_LOCAL(0))});
 }
 
@@ -2987,26 +3016,27 @@ TEST_F(FunctionBodyDecoderTest, LoopParam) {
   WASM_FEATURE_SCOPE(mv);
   TestModuleBuilder builder;
   module = builder.module();
-  byte f1 = builder.AddSignature(sigs.i_i());
-  byte f2 = builder.AddSignature(sigs.i_ii());
+  byte sig1 = builder.AddSignature(sigs.i_i());
+  byte sig2 = builder.AddSignature(sigs.i_ii());
   ExpectValidates(sigs.i_ii(), {WASM_GET_LOCAL(0),
-                                WASM_LOOP_X(f1, WASM_GET_LOCAL(1),
+                                WASM_LOOP_X(sig1, WASM_GET_LOCAL(1),
                                             WASM_I32_ADD(WASM_NOP, WASM_NOP))});
   ExpectValidates(sigs.i_ii(),
                   {WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
-                   WASM_LOOP_X(f2, WASM_I32_ADD(WASM_NOP, WASM_NOP))});
+                   WASM_LOOP_X(sig2, WASM_I32_ADD(WASM_NOP, WASM_NOP))});
   ExpectValidates(sigs.i_ii(), {WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
-                                WASM_LOOP_X(f1, WASM_NOP),
+                                WASM_LOOP_X(sig1, WASM_NOP),
                                 WASM_I32_ADD(WASM_NOP, WASM_NOP)});
   ExpectFailure(sigs.i_ii(),
-                {WASM_LOOP_X(f1, WASM_NOP), WASM_RETURN1(WASM_GET_LOCAL(0))});
-  ExpectFailure(sigs.i_ii(), {WASM_LOOP_X(f1, WASM_GET_LOCAL(0)),
-                              WASM_RETURN1(WASM_GET_LOCAL(0))});
-  ExpectFailure(sigs.i_ii(), {WASM_GET_LOCAL(0),
-                              WASM_LOOP_X(f2, WASM_I32_ADD(WASM_NOP, WASM_NOP)),
+                {WASM_LOOP_X(sig1, WASM_NOP), WASM_RETURN1(WASM_GET_LOCAL(0))});
+  ExpectFailure(sigs.i_ii(), {WASM_LOOP_X(sig1, WASM_GET_LOCAL(0)),
                               WASM_RETURN1(WASM_GET_LOCAL(0))});
+  ExpectFailure(
+      sigs.i_ii(),
+      {WASM_GET_LOCAL(0), WASM_LOOP_X(sig2, WASM_I32_ADD(WASM_NOP, WASM_NOP)),
+       WASM_RETURN1(WASM_GET_LOCAL(0))});
   ExpectFailure(sigs.i_ii(),
-                {WASM_GET_LOCAL(0), WASM_LOOP_X(f1, WASM_F32_NEG(WASM_NOP)),
+                {WASM_GET_LOCAL(0), WASM_LOOP_X(sig1, WASM_F32_NEG(WASM_NOP)),
                  WASM_RETURN1(WASM_GET_LOCAL(0))});
 }
 
@@ -3014,22 +3044,23 @@ TEST_F(FunctionBodyDecoderTest, LoopParamBr) {
   WASM_FEATURE_SCOPE(mv);
   TestModuleBuilder builder;
   module = builder.module();
-  byte f1 = builder.AddSignature(sigs.i_i());
-  byte f2 = builder.AddSignature(sigs.i_ii());
+  byte sig1 = builder.AddSignature(sigs.i_i());
+  byte sig2 = builder.AddSignature(sigs.i_ii());
   ExpectValidates(sigs.i_ii(),
-                  {WASM_GET_LOCAL(0), WASM_LOOP_X(f1, WASM_BR(0))});
+                  {WASM_GET_LOCAL(0), WASM_LOOP_X(sig1, WASM_BR(0))});
   ExpectValidates(
       sigs.i_ii(),
-      {WASM_GET_LOCAL(0), WASM_LOOP_X(f1, WASM_BRV(0, WASM_GET_LOCAL(1)))});
+      {WASM_GET_LOCAL(0), WASM_LOOP_X(sig1, WASM_BRV(0, WASM_GET_LOCAL(1)))});
   ExpectValidates(sigs.i_ii(), {WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
-                                WASM_LOOP_X(f2, WASM_BR(0))});
-  ExpectValidates(sigs.i_ii(), {WASM_GET_LOCAL(0),
-                                WASM_LOOP_X(f1, WASM_BLOCK_X(f1, WASM_BR(1)))});
+                                WASM_LOOP_X(sig2, WASM_BR(0))});
+  ExpectValidates(
+      sigs.i_ii(),
+      {WASM_GET_LOCAL(0), WASM_LOOP_X(sig1, WASM_BLOCK_X(sig1, WASM_BR(1)))});
   ExpectFailure(sigs.i_ii(),
-                {WASM_GET_LOCAL(0), WASM_LOOP_X(f1, WASM_BLOCK(WASM_BR(1))),
+                {WASM_GET_LOCAL(0), WASM_LOOP_X(sig1, WASM_BLOCK(WASM_BR(1))),
                  WASM_RETURN1(WASM_GET_LOCAL(0))});
   ExpectFailure(sigs.i_ii(), {WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
-                              WASM_LOOP_X(f2, WASM_BLOCK_X(f1, WASM_BR(1))),
+                              WASM_LOOP_X(sig2, WASM_BLOCK_X(sig1, WASM_BR(1))),
                               WASM_RETURN1(WASM_GET_LOCAL(0))});
 }
 
@@ -3037,29 +3068,30 @@ TEST_F(FunctionBodyDecoderTest, IfParam) {
   WASM_FEATURE_SCOPE(mv);
   TestModuleBuilder builder;
   module = builder.module();
-  byte f1 = builder.AddSignature(sigs.i_i());
-  byte f2 = builder.AddSignature(sigs.i_ii());
+  byte sig1 = builder.AddSignature(sigs.i_i());
+  byte sig2 = builder.AddSignature(sigs.i_ii());
   ExpectValidates(sigs.i_ii(),
                   {WASM_GET_LOCAL(0),
-                   WASM_IF_X(f1, WASM_GET_LOCAL(0),
+                   WASM_IF_X(sig1, WASM_GET_LOCAL(0),
                              WASM_I32_ADD(WASM_NOP, WASM_GET_LOCAL(1)))});
   ExpectValidates(sigs.i_ii(),
                   {WASM_GET_LOCAL(0),
-                   WASM_IF_ELSE_X(f1, WASM_GET_LOCAL(0),
+                   WASM_IF_ELSE_X(sig1, WASM_GET_LOCAL(0),
                                   WASM_I32_ADD(WASM_NOP, WASM_GET_LOCAL(1)),
                                   WASM_I32_EQZ(WASM_NOP))});
   ExpectValidates(
       sigs.i_ii(),
       {WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
-       WASM_IF_ELSE_X(f2, WASM_GET_LOCAL(0), WASM_I32_ADD(WASM_NOP, WASM_NOP),
+       WASM_IF_ELSE_X(sig2, WASM_GET_LOCAL(0), WASM_I32_ADD(WASM_NOP, WASM_NOP),
                       WASM_I32_MUL(WASM_NOP, WASM_NOP))});
   ExpectValidates(sigs.i_ii(), {WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
-                                WASM_IF_X(f1, WASM_GET_LOCAL(0), WASM_NOP),
-                                WASM_I32_ADD(WASM_NOP, WASM_NOP)});
-  ExpectValidates(sigs.i_ii(), {WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
-                                WASM_IF_ELSE_X(f1, WASM_GET_LOCAL(0), WASM_NOP,
-                                               WASM_I32_EQZ(WASM_NOP)),
+                                WASM_IF_X(sig1, WASM_GET_LOCAL(0), WASM_NOP),
                                 WASM_I32_ADD(WASM_NOP, WASM_NOP)});
+  ExpectValidates(sigs.i_ii(),
+                  {WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
+                   WASM_IF_ELSE_X(sig1, WASM_GET_LOCAL(0), WASM_NOP,
+                                  WASM_I32_EQZ(WASM_NOP)),
+                   WASM_I32_ADD(WASM_NOP, WASM_NOP)});
 }
 
 TEST_F(FunctionBodyDecoderTest, Regression709741) {
@@ -3071,7 +3103,7 @@ TEST_F(FunctionBodyDecoderTest, Regression709741) {
     FunctionBody body(sigs.v_v(), 0, code, code + i);
     WasmFeatures unused_detected_features;
     DecodeResult result =
-        VerifyWasmCode(zone()->allocator(), kAllWasmFeatures, nullptr,
+        VerifyWasmCode(zone()->allocator(), WasmFeatures::All(), nullptr,
                        &unused_detected_features, body);
     if (result.ok()) {
       std::ostringstream str;
@@ -3121,6 +3153,20 @@ TEST_F(FunctionBodyDecoderTest, DataDrop) {
   ExpectFailure(sigs.v_v(), {WASM_DATA_DROP(1)});
 }
 
+TEST_F(FunctionBodyDecoderTest, DataSegmentIndexUnsigned) {
+  TestModuleBuilder builder;
+  builder.InitializeMemory();
+  builder.SetDataSegmentCount(65);
+  module = builder.module();
+
+  WASM_FEATURE_SCOPE(bulk_memory);
+  // Make sure that the index is interpreted as an unsigned number; 64 is
+  // interpreted as -64 when decoded as a signed LEB.
+  ExpectValidates(sigs.v_v(),
+                  {WASM_MEMORY_INIT(64, WASM_ZERO, WASM_ZERO, WASM_ZERO)});
+  ExpectValidates(sigs.v_v(), {WASM_DATA_DROP(64)});
+}
+
 TEST_F(FunctionBodyDecoderTest, MemoryCopy) {
   TestModuleBuilder builder;
   builder.InitializeMemory();
@@ -3196,6 +3242,22 @@ TEST_F(FunctionBodyDecoderTest, ElemDrop) {
   ExpectFailure(sigs.v_v(), {WASM_ELEM_DROP(1)});
 }
 
+TEST_F(FunctionBodyDecoderTest, ElemSegmentIndexUnsigned) {
+  TestModuleBuilder builder;
+  builder.InitializeTable();
+  for (int i = 0; i < 65; ++i) {
+    builder.AddPassiveElementSegment();
+  }
+  module = builder.module();
+
+  WASM_FEATURE_SCOPE(bulk_memory);
+  // Make sure that the index is interpreted as an unsigned number; 64 is
+  // interpreted as -64 when decoded as a signed LEB.
+  ExpectValidates(sigs.v_v(),
+                  {WASM_TABLE_INIT(0, 64, WASM_ZERO, WASM_ZERO, WASM_ZERO)});
+  ExpectValidates(sigs.v_v(), {WASM_ELEM_DROP(64)});
+}
+
 TEST_F(FunctionBodyDecoderTest, TableCopy) {
   TestModuleBuilder builder;
   builder.InitializeTable();
@@ -3212,22 +3274,37 @@ TEST_F(FunctionBodyDecoderTest, TableGrow) {
   TestModuleBuilder builder;
   byte tab_func = builder.AddTable(kWasmFuncRef, 10, true, 20);
   byte tab_ref = builder.AddTable(kWasmAnyRef, 10, true, 20);
+  byte tab_null = builder.AddTable(kWasmNullRef, 10, true, 20);
 
   module = builder.module();
 
   ExpectFailure(sigs.i_a(),
                 {WASM_TABLE_GROW(tab_func, WASM_REF_NULL, WASM_ONE)});
+  ExpectFailure(sigs.i_n(),
+                {WASM_TABLE_GROW(tab_null, WASM_REF_NULL, WASM_ONE)});
   WASM_FEATURE_SCOPE(anyref);
   ExpectValidates(sigs.i_a(),
                   {WASM_TABLE_GROW(tab_func, WASM_REF_NULL, WASM_ONE)});
   ExpectValidates(sigs.i_r(),
                   {WASM_TABLE_GROW(tab_ref, WASM_REF_NULL, WASM_ONE)});
+  ExpectValidates(sigs.i_n(),
+                  {WASM_TABLE_GROW(tab_null, WASM_REF_NULL, WASM_ONE)});
   // FuncRef table cannot be initialized with an anyref value.
   ExpectFailure(sigs.i_r(),
                 {WASM_TABLE_GROW(tab_func, WASM_GET_LOCAL(0), WASM_ONE)});
-  // Anyref table can be initialized with an funcref value.
+  // FuncRef table can be initialized with a nullref value.
+  ExpectValidates(sigs.i_n(),
+                  {WASM_TABLE_GROW(tab_func, WASM_GET_LOCAL(0), WASM_ONE)});
+  // Anyref table can be initialized with an funcref or nullref value.
   ExpectValidates(sigs.i_a(),
                   {WASM_TABLE_GROW(tab_ref, WASM_GET_LOCAL(0), WASM_ONE)});
+  ExpectValidates(sigs.i_n(),
+                  {WASM_TABLE_GROW(tab_ref, WASM_GET_LOCAL(0), WASM_ONE)});
+  // NullRef table cannot be initialized with an funcref or anyref value.
+  ExpectFailure(sigs.i_a(),
+                {WASM_TABLE_GROW(tab_null, WASM_GET_LOCAL(0), WASM_ONE)});
+  ExpectFailure(sigs.i_r(),
+                {WASM_TABLE_GROW(tab_null, WASM_GET_LOCAL(0), WASM_ONE)});
   // Check that the table index gets verified.
   ExpectFailure(sigs.i_r(),
                 {WASM_TABLE_GROW(tab_ref + 2, WASM_REF_NULL, WASM_ONE)});
@@ -3249,22 +3326,32 @@ TEST_F(FunctionBodyDecoderTest, TableFill) {
   TestModuleBuilder builder;
   byte tab_func = builder.AddTable(kWasmFuncRef, 10, true, 20);
   byte tab_ref = builder.AddTable(kWasmAnyRef, 10, true, 20);
+  byte tab_null = builder.AddTable(kWasmNullRef, 10, true, 20);
 
   module = builder.module();
 
   ExpectFailure(sigs.v_a(),
                 {WASM_TABLE_FILL(tab_func, WASM_ONE, WASM_REF_NULL, WASM_ONE)});
+  ExpectFailure(sigs.v_n(),
+                {WASM_TABLE_FILL(tab_null, WASM_ONE, WASM_REF_NULL, WASM_ONE)});
   WASM_FEATURE_SCOPE(anyref);
   ExpectValidates(sigs.v_a(), {WASM_TABLE_FILL(tab_func, WASM_ONE,
                                                WASM_REF_NULL, WASM_ONE)});
   ExpectValidates(sigs.v_r(), {WASM_TABLE_FILL(tab_ref, WASM_ONE, WASM_REF_NULL,
                                                WASM_ONE)});
+  ExpectValidates(sigs.v_n(), {WASM_TABLE_FILL(tab_null, WASM_ONE,
+                                               WASM_REF_NULL, WASM_ONE)});
   // FuncRef table cannot be initialized with an anyref value.
   ExpectFailure(sigs.v_r(), {WASM_TABLE_FILL(tab_func, WASM_ONE,
                                              WASM_GET_LOCAL(0), WASM_ONE)});
-  // Anyref table can be initialized with an funcref value.
+  // FuncRef table can be initialized with an nullref value.
+  ExpectValidates(sigs.v_n(), {WASM_TABLE_FILL(tab_func, WASM_ONE,
+                                               WASM_GET_LOCAL(0), WASM_ONE)});
+  // Anyref table can be initialized with an funcref or nullref value.
   ExpectValidates(sigs.v_a(), {WASM_TABLE_FILL(tab_ref, WASM_ONE,
                                                WASM_GET_LOCAL(0), WASM_ONE)});
+  ExpectValidates(sigs.v_n(), {WASM_TABLE_FILL(tab_ref, WASM_ONE,
+                                               WASM_GET_LOCAL(0), WASM_ONE)});
   // Check that the table index gets verified.
   ExpectFailure(sigs.v_r(), {WASM_TABLE_FILL(tab_ref + 2, WASM_ONE,
                                              WASM_REF_NULL, WASM_ONE)});
@@ -3807,7 +3894,6 @@ TEST_F(BytecodeIteratorTest, WithLocalDecls) {
   EXPECT_FALSE(iter.has_next());
 }
 
-#undef WASM_FEATURE_SCOPE
 #undef B1
 #undef B2
 #undef B3
diff --git a/deps/v8/test/unittests/wasm/module-decoder-unittest.cc b/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
index 25eb1210749cc5..f88beef7942501 100644
--- a/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
@@ -168,12 +168,13 @@ struct ValueTypePair {
     {kLocalF32, kWasmF32},          // --
     {kLocalF64, kWasmF64},          // --
     {kLocalFuncRef, kWasmFuncRef},  // --
-    {kLocalAnyRef, kWasmAnyRef}     // --
+    {kLocalAnyRef, kWasmAnyRef},    // --
+    {kLocalNullRef, kWasmNullRef}   // --
 };
 
 class WasmModuleVerifyTest : public TestWithIsolateAndZone {
  public:
-  WasmFeatures enabled_features_;
+  WasmFeatures enabled_features_ = WasmFeatures::None();
 
   ModuleResult DecodeModule(const byte* module_start, const byte* module_end) {
     // Add the wasm magic and version number automatically.
@@ -199,25 +200,6 @@ class WasmModuleVerifyTest : public TestWithIsolateAndZone {
   }
 };
 
-namespace {
-class EnableBoolScope {
- public:
-  bool prev_;
-  bool* ptr_;
-  explicit EnableBoolScope(bool* ptr, bool val = true)
-      : prev_(*ptr), ptr_(ptr) {
-    *ptr = val;
-  }
-  ~EnableBoolScope() { *ptr_ = prev_; }
-};
-
-#define WASM_FEATURE_SCOPE(feat) \
-  EnableBoolScope feat##_scope(&this->enabled_features_.feat)
-
-#define WASM_FEATURE_SCOPE_VAL(feat, val) \
-  EnableBoolScope feat##_scope(&this->enabled_features_.feat, val)
-}  // namespace
-
 TEST_F(WasmModuleVerifyTest, WrongMagic) {
   for (uint32_t x = 1; x; x <<= 1) {
     const byte data[] = {U32_LE(kWasmMagic ^ x), U32_LE(kWasmVersion)};
@@ -343,6 +325,34 @@ TEST_F(WasmModuleVerifyTest, FuncRefGlobal) {
   }
 }
 
+TEST_F(WasmModuleVerifyTest, NullRefGlobal) {
+  WASM_FEATURE_SCOPE(anyref);
+  static const byte data[] = {
+      // sig#0 ---------------------------------------------------------------
+      SIGNATURES_SECTION_VOID_VOID,
+      // funcs ---------------------------------------------------------------
+      TWO_EMPTY_FUNCTIONS(SIG_INDEX(0)),
+      SECTION(Global,                    // --
+              ENTRY_COUNT(1),            // --
+              kLocalNullRef,             // local type
+              0,                         // immutable
+              WASM_INIT_EXPR_REF_NULL),  // init
+      TWO_EMPTY_BODIES};
+  {
+    // Should decode to one global.
+    ModuleResult result = DecodeModule(data, data + sizeof(data));
+    EXPECT_OK(result);
+    EXPECT_EQ(1u, result.value()->globals.size());
+    EXPECT_EQ(2u, result.value()->functions.size());
+    EXPECT_EQ(0u, result.value()->data_segments.size());
+
+    const WasmGlobal* global = &result.value()->globals[0];
+    EXPECT_EQ(kWasmNullRef, global->type);
+    EXPECT_FALSE(global->mutability);
+    EXPECT_EQ(WasmInitExpr::kRefNullConst, global->init.kind);
+  }
+}
+
 TEST_F(WasmModuleVerifyTest, InvalidFuncRefGlobal) {
   WASM_FEATURE_SCOPE(anyref);
   static const byte data[] = {
@@ -359,6 +369,27 @@ TEST_F(WasmModuleVerifyTest, InvalidFuncRefGlobal) {
   EXPECT_FAILURE(data);
 }
 
+TEST_F(WasmModuleVerifyTest, InvalidNullRefGlobal) {
+  WASM_FEATURE_SCOPE(anyref);
+  // Initialize nullref from funcref
+  static const byte data[] = {
+      // sig#0 ---------------------------------------------------------------
+      SIGNATURES_SECTION_VOID_VOID,
+      // funcs ---------------------------------------------------------------
+      TWO_EMPTY_FUNCTIONS(SIG_INDEX(0)),
+      SECTION(Global,                       // --
+              ENTRY_COUNT(1),               // --
+              kLocalNullRef,                // local type
+              0,                            // immutable
+              WASM_INIT_EXPR_REF_FUNC(1)),  // init
+      TWO_EMPTY_BODIES};
+
+  ModuleResult result = DecodeModule(data, data + sizeof(data));
+  EXPECT_NOT_OK(
+      result,
+      "type error in global initialization, expected nullref, got funcref");
+}
+
 TEST_F(WasmModuleVerifyTest, AnyRefGlobalWithGlobalInit) {
   WASM_FEATURE_SCOPE(anyref);
   static const byte data[] = {
@@ -392,6 +423,40 @@ TEST_F(WasmModuleVerifyTest, AnyRefGlobalWithGlobalInit) {
   }
 }
 
+TEST_F(WasmModuleVerifyTest, NullRefGlobalWithGlobalInit) {
+  WASM_FEATURE_SCOPE(anyref);
+  static const byte data[] = {
+      SECTION(Import,           // --
+              ENTRY_COUNT(1),   // number of imports
+              ADD_COUNT('m'),   // module name
+              ADD_COUNT('n'),   // global name
+              kExternalGlobal,  // import kind
+              kLocalNullRef,    // type
+              0),               // mutability
+      SECTION(Global,           // --
+              ENTRY_COUNT(1),
+              kLocalNullRef,  // local type
+              0,              // immutable
+              WASM_INIT_EXPR_GLOBAL(0)),
+  };
+
+  {
+    // Should decode to exactly one global.
+    ModuleResult result = DecodeModule(data, data + sizeof(data));
+    std::cout << result.error().message() << std::endl;
+    EXPECT_OK(result);
+    EXPECT_EQ(2u, result.value()->globals.size());
+    EXPECT_EQ(0u, result.value()->functions.size());
+    EXPECT_EQ(0u, result.value()->data_segments.size());
+
+    const WasmGlobal* global = &result.value()->globals.back();
+
+    EXPECT_EQ(kWasmNullRef, global->type);
+    EXPECT_FALSE(global->mutability);
+    EXPECT_EQ(WasmInitExpr::kGlobalIndex, global->init.kind);
+  }
+}
+
 TEST_F(WasmModuleVerifyTest, Global_invalid_type) {
   static const byte data[] = {
       SECTION(Global,                      // --
@@ -1426,7 +1491,7 @@ TEST_F(WasmModuleVerifyTest, TieringCompilationHints) {
 
 class WasmSignatureDecodeTest : public TestWithZone {
  public:
-  WasmFeatures enabled_features_;
+  WasmFeatures enabled_features_ = WasmFeatures::None();
 
   FunctionSig* DecodeSig(const byte* start, const byte* end) {
     return DecodeWasmSignatureForTesting(enabled_features_, zone(), start, end);
@@ -1570,7 +1635,7 @@ TEST_F(WasmSignatureDecodeTest, Fail_off_end) {
 TEST_F(WasmSignatureDecodeTest, Fail_anyref_without_flag) {
   // Disable AnyRef support and check that decoding fails.
   WASM_FEATURE_SCOPE_VAL(anyref, false);
-  byte ref_types[] = {kLocalFuncRef, kLocalAnyRef};
+  byte ref_types[] = {kLocalFuncRef, kLocalAnyRef, kLocalNullRef};
   for (byte invalid_type : ref_types) {
     for (size_t i = 0;; i++) {
       byte data[] = {SIG_ENTRY_x_xx(kLocalI32, kLocalI32, kLocalI32)};
@@ -2356,6 +2421,14 @@ TEST_F(WasmModuleVerifyTest, MultipleNameSections) {
   EXPECT_EQ(3u, result.value()->name.length());
 }
 
+TEST_F(WasmModuleVerifyTest, BadNameSection) {
+  static const byte data[] = {SECTION_NAMES(
+      0, ADD_COUNT(ADD_COUNT('s', 'r', 'c', '/', 'x', 0xff, 'z', '.', 'c')))};
+  ModuleResult result = DecodeModule(data, data + sizeof(data));
+  EXPECT_TRUE(result.ok());
+  EXPECT_EQ(0u, result.value()->name.length());
+}
+
 TEST_F(WasmModuleVerifyTest, PassiveDataSegment) {
   static const byte data[] = {
       // memory declaration ----------------------------------------------------
@@ -2538,8 +2611,6 @@ TEST_F(WasmModuleVerifyTest, DataCountSegmentCount_omitted) {
   EXPECT_NOT_OK(result, "data segments count 0 mismatch (1 expected)");
 }
 
-#undef WASM_FEATURE_SCOPE
-#undef WASM_FEATURE_SCOPE_VAL
 #undef EXPECT_INIT_EXPR
 #undef EXPECT_INIT_EXPR_FAIL
 #undef WASM_INIT_EXPR_I32V_1
diff --git a/deps/v8/test/unittests/wasm/streaming-decoder-unittest.cc b/deps/v8/test/unittests/wasm/streaming-decoder-unittest.cc
index 7e8068095e8d31..2c12d0934d3941 100644
--- a/deps/v8/test/unittests/wasm/streaming-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/streaming-decoder-unittest.cc
@@ -57,7 +57,8 @@ class MockStreamingProcessor : public StreamingProcessor {
   }
 
   bool ProcessCodeSectionHeader(int num_functions, uint32_t offset,
-                                std::shared_ptr<WireBytesStorage>) override {
+                                std::shared_ptr<WireBytesStorage>,
+                                int code_section_length) override {
     return true;
   }
 
@@ -608,14 +609,13 @@ TEST_F(WasmStreamingDecoderTest, TwoCodeSections) {
       0x1,                   // Number of Functions
       0x1,                   // Function Length
       0x0,                   // Function
-      kCodeSectionCode,      // Section ID      -- ERROR (where it should be)
-      0x3,                   // Section Length  -- ERROR (where it is reported)
+      kCodeSectionCode,      // Section ID      -- ERROR
+      0x3,                   // Section Length
       0x1,                   // Number of Functions
       0x1,                   // Function Length
       0x0,                   // Function
   };
-  // TODO(wasm): This should report at the second kCodeSectionCode.
-  ExpectFailure(ArrayVector(data), sizeof(data) - 4,
+  ExpectFailure(ArrayVector(data), sizeof(data) - 5,
                 "code section can only appear once");
 }
 
@@ -651,14 +651,13 @@ TEST_F(WasmStreamingDecoderTest, UnknownSectionSandwich) {
       0x1,                   // Name Length
       0x1,                   // Name
       0x0,                   // Content
-      kCodeSectionCode,      // Section ID     -- ERROR (where it should be)
-      0x3,                   // Section Length -- ERROR (where it is reported)
+      kCodeSectionCode,      // Section ID     -- ERROR
+      0x3,                   // Section Length
       0x1,                   // Number of Functions
       0x1,                   // Function Length
       0x0,                   // Function
   };
-  // TODO(wasm): This should report at the second kCodeSectionCode.
-  ExpectFailure(ArrayVector(data), sizeof(data) - 4,
+  ExpectFailure(ArrayVector(data), sizeof(data) - 5,
                 "code section can only appear once");
 }
 
diff --git a/deps/v8/test/unittests/wasm/trap-handler-x64-unittest.cc b/deps/v8/test/unittests/wasm/trap-handler-x64-unittest.cc
index d43ade2b0e22d8..9c72b68e199483 100644
--- a/deps/v8/test/unittests/wasm/trap-handler-x64-unittest.cc
+++ b/deps/v8/test/unittests/wasm/trap-handler-x64-unittest.cc
@@ -4,7 +4,7 @@
 
 #include "include/v8config.h"
 
-#if V8_OS_LINUX
+#if V8_OS_LINUX || V8_OS_FREEBSD
 #include <signal.h>
 #include <ucontext.h>
 #elif V8_OS_MACOSX
@@ -41,7 +41,7 @@ namespace wasm {
 namespace {
 constexpr Register scratch = r10;
 bool g_test_handler_executed = false;
-#if V8_OS_LINUX || V8_OS_MACOSX
+#if V8_OS_LINUX || V8_OS_MACOSX || V8_OS_FREEBSD
 struct sigaction g_old_segv_action;
 struct sigaction g_old_fpe_action;
 struct sigaction g_old_bus_action;  // We get SIGBUS on Mac sometimes.
@@ -88,12 +88,12 @@ class TrapHandlerTest : public TestWithIsolate,
     crash_address_ = reinterpret_cast<Address>(backing_store_->buffer_start()) +
                      backing_store_->byte_length() + 32;
     // Allocate a buffer for the generated code.
-    buffer_ = AllocateAssemblerBuffer(AssemblerBase::kMinimalBufferSize,
+    buffer_ = AllocateAssemblerBuffer(AssemblerBase::kDefaultBufferSize,
                                       GetRandomMmapAddr());
 
     InitRecoveryCode();
 
-#if V8_OS_LINUX || V8_OS_MACOSX
+#if V8_OS_LINUX || V8_OS_MACOSX || V8_OS_FREEBSD
     // Set up a signal handler to recover from the expected crash.
     struct sigaction action;
     action.sa_sigaction = SignalHandler;
@@ -121,7 +121,7 @@ class TrapHandlerTest : public TestWithIsolate,
     // Clean up the trap handler
     trap_handler::RemoveTrapHandler();
     if (!g_test_handler_executed) {
-#if V8_OS_LINUX || V8_OS_MACOSX
+#if V8_OS_LINUX || V8_OS_MACOSX || V8_OS_FREEBSD
       // The test handler cleans up the signal handler setup in the test. If the
       // test handler was not called, we have to do the cleanup ourselves.
       CHECK_EQ(0, sigaction(SIGSEGV, &g_old_segv_action, nullptr));
@@ -138,7 +138,7 @@ class TrapHandlerTest : public TestWithIsolate,
     // Create a code snippet where we can jump to to recover from a signal or
     // exception. The code snippet only consists of a return statement.
     recovery_buffer_ = AllocateAssemblerBuffer(
-        AssemblerBase::kMinimalBufferSize, GetRandomMmapAddr());
+        AssemblerBase::kDefaultBufferSize, GetRandomMmapAddr());
 
     MacroAssembler masm(nullptr, AssemblerOptions{}, CodeObjectRequired::kNo,
                         recovery_buffer_->CreateView());
@@ -152,7 +152,7 @@ class TrapHandlerTest : public TestWithIsolate,
         reinterpret_cast<Address>(desc.buffer + recovery_offset);
   }
 
-#if V8_OS_LINUX || V8_OS_MACOSX
+#if V8_OS_LINUX || V8_OS_MACOSX || V8_OS_FREEBSD
   static void SignalHandler(int signal, siginfo_t* info, void* context) {
     if (g_use_as_first_chance_handler) {
       if (v8::TryHandleWebAssemblyTrapPosix(signal, info, context)) {
@@ -171,8 +171,12 @@ class TrapHandlerTest : public TestWithIsolate,
     ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
 #if V8_OS_LINUX
     uc->uc_mcontext.gregs[REG_RIP] = g_recovery_address;
-#else  // V8_OS_MACOSX
+#elif V8_OS_MACOSX
     uc->uc_mcontext->__ss.__rip = g_recovery_address;
+#elif V8_OS_FREEBSD
+    uc->uc_mcontext.mc_rip = g_recovery_address;
+#else
+#error Unsupported platform
 #endif
   }
 #endif
@@ -256,6 +260,10 @@ class TrapHandlerTest : public TestWithIsolate,
   std::unique_ptr<TestingAssemblerBuffer> recovery_buffer_;
 };
 
+// TODO(almuthanna): These tests were skipped because they cause a crash when
+// they are ran on Fuchsia. This issue should be solved later on
+// Ticket: https://crbug.com/1028617
+#if !defined(V8_TARGET_OS_FUCHSIA)
 TEST_P(TrapHandlerTest, TestTrapHandlerRecovery) {
   // Test that the wasm trap handler can recover a memory access violation in
   // wasm code (we fake the wasm code and the access violation).
@@ -413,6 +421,7 @@ TEST_P(TrapHandlerTest, TestCrashInWasmWrongCrashType) {
     *trap_handler::GetThreadInWasmThreadLocalAddress() = 0;
   }
 }
+#endif
 
 class CodeRunner : public v8::base::Thread {
  public:
@@ -426,6 +435,10 @@ class CodeRunner : public v8::base::Thread {
   TestingAssemblerBuffer* buffer_;
 };
 
+// TODO(almuthanna): This test was skipped because it causes a crash when it is
+// ran on Fuchsia. This issue should be solved later on
+// Ticket: https://crbug.com/1028617
+#if !defined(V8_TARGET_OS_FUCHSIA)
 TEST_P(TrapHandlerTest, TestCrashInOtherThread) {
   // Test setup:
   // The current thread enters wasm land (sets the thread_in_wasm flag)
@@ -460,6 +473,7 @@ TEST_P(TrapHandlerTest, TestCrashInOtherThread) {
   // Reset the thread-in-wasm flag.
   *trap_handler::GetThreadInWasmThreadLocalAddress() = 0;
 }
+#endif
 
 INSTANTIATE_TEST_SUITE_P(Traps, TrapHandlerTest,
                          ::testing::Values(kDefault, kCallback),
diff --git a/deps/v8/test/unittests/wasm/wasm-macro-gen-unittest.cc b/deps/v8/test/unittests/wasm/wasm-macro-gen-unittest.cc
index d1087c02a678ca..850001c1ccaf1d 100644
--- a/deps/v8/test/unittests/wasm/wasm-macro-gen-unittest.cc
+++ b/deps/v8/test/unittests/wasm/wasm-macro-gen-unittest.cc
@@ -133,12 +133,12 @@ TEST_F(WasmMacroGenTest, CallFunction) {
 }
 
 TEST_F(WasmMacroGenTest, CallIndirect) {
-  EXPECT_SIZE(5, WASM_CALL_INDIRECT0(0, WASM_ZERO));
-  EXPECT_SIZE(5, WASM_CALL_INDIRECT0(1, WASM_ZERO));
-  EXPECT_SIZE(5, WASM_CALL_INDIRECT0(11, WASM_ZERO));
+  EXPECT_SIZE(5, WASM_CALL_INDIRECT(0, WASM_ZERO));
+  EXPECT_SIZE(5, WASM_CALL_INDIRECT(1, WASM_ZERO));
+  EXPECT_SIZE(5, WASM_CALL_INDIRECT(11, WASM_ZERO));
 
-  EXPECT_SIZE(7, WASM_CALL_INDIRECT1(0, WASM_ZERO, WASM_ZERO));
-  EXPECT_SIZE(9, WASM_CALL_INDIRECT2(1, WASM_ZERO, WASM_ZERO, WASM_ZERO));
+  EXPECT_SIZE(7, WASM_CALL_INDIRECT(0, WASM_ZERO, WASM_ZERO));
+  EXPECT_SIZE(9, WASM_CALL_INDIRECT(1, WASM_ZERO, WASM_ZERO, WASM_ZERO));
 }
 
 TEST_F(WasmMacroGenTest, Int32Ops) {
diff --git a/deps/v8/test/unittests/wasm/wasm-text-unittest.cc b/deps/v8/test/unittests/wasm/wasm-text-unittest.cc
deleted file mode 100644
index e960b730a5fecf..00000000000000
--- a/deps/v8/test/unittests/wasm/wasm-text-unittest.cc
+++ /dev/null
@@ -1,121 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <sstream>
-
-#include "test/unittests/test-utils.h"
-
-#include "src/wasm/module-decoder.h"
-#include "src/wasm/wasm-module-builder.h"
-#include "src/wasm/wasm-module.h"
-#include "src/wasm/wasm-opcodes.h"
-#include "src/wasm/wasm-text.h"
-#include "test/common/wasm/test-signatures.h"
-
-namespace v8 {
-namespace internal {
-namespace wasm {
-
-class WasmTextTest : public TestWithIsolateAndZone {
- public:
-  TestSignatures sigs;
-  WasmFeatures enabled_features_;
-
-  void TestInstruction(const byte* func_start, size_t func_size) {
-    WasmModuleBuilder mb(zone());
-    auto* fb = mb.AddFunction(sigs.v_v());
-    fb->EmitCode(func_start, static_cast<uint32_t>(func_size));
-    fb->Emit(kExprEnd);
-
-    ZoneBuffer buffer(zone());
-    mb.WriteTo(&buffer);
-
-    ModuleWireBytes wire_bytes(
-        Vector<const byte>(buffer.begin(), buffer.size()));
-
-    ModuleResult result = DecodeWasmModule(
-        enabled_features_, buffer.begin(), buffer.end(), false, kWasmOrigin,
-        isolate()->counters(), isolate()->wasm_engine()->allocator());
-    EXPECT_TRUE(result.ok());
-
-    std::stringstream ss;
-    PrintWasmText(result.value().get(), wire_bytes, 0, ss, nullptr);
-  }
-};
-
-TEST_F(WasmTextTest, EveryOpcodeCanBeDecoded) {
-  static const struct {
-    WasmOpcode opcode;
-    const char* debug_name;
-  } kValues[] = {
-#define DECLARE_ELEMENT(name, opcode, sig) {kExpr##name, "kExpr" #name},
-      FOREACH_OPCODE(DECLARE_ELEMENT)};
-#undef DECLARE_ELEMENT
-
-  for (const auto& value : kValues) {
-    // Pad with 0 for any immediate values. If they're not needed, they'll be
-    // interpreted as unreachable.
-    byte data[20] = {0};
-
-    printf("%s\n", value.debug_name);
-    switch (value.opcode) {
-      // Instructions that have a special case because they affect the control
-      // depth.
-      case kExprBlock:
-      case kExprLoop:
-      case kExprIf:
-      case kExprTry:
-        data[0] = value.opcode;
-        data[1] = kLocalVoid;
-        data[2] = kExprEnd;
-        break;
-      case kExprElse:
-        data[0] = kExprIf;
-        data[1] = value.opcode;
-        data[2] = kExprEnd;
-        break;
-      case kExprCatch:
-        data[0] = kExprTry;
-        data[1] = value.opcode;
-        data[2] = kExprEnd;
-        break;
-      case kExprEnd:
-        break;
-
-      // Instructions with special requirements for immediates.
-      case kExprSelectWithType:
-        data[0] = kExprSelectWithType;
-        data[1] = 1;
-        data[2] = kLocalI32;
-        break;
-
-      default: {
-        if (value.opcode >= 0x100) {
-          data[0] = value.opcode >> 8;        // Prefix byte.
-          byte opcode = value.opcode & 0xff;  // Actual opcode.
-          if (opcode >= 0x80) {
-            // Opcode with prefix, and needs to be LEB encoded (3 bytes).
-            // For now, this can only be in the range [0x80, 0xff], which means
-            // that the third byte is always 1.
-            data[1] = (opcode & 0x7f) | 0x80;
-            data[2] = 1;
-          } else {
-            // Opcode with prefix (2 bytes).
-            data[1] = opcode;
-          }
-        } else {
-          // Single-byte opcode.
-          data[0] = value.opcode;
-        }
-        break;
-      }
-    }
-
-    TestInstruction(data, arraysize(data));
-  }
-}
-
-}  // namespace wasm
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/test/wasm-api-tests/table.cc b/deps/v8/test/wasm-api-tests/table.cc
index bfd5e14a8db460..5f6faaed249375 100644
--- a/deps/v8/test/wasm-api-tests/table.cc
+++ b/deps/v8/test/wasm-api-tests/table.cc
@@ -44,7 +44,7 @@ TEST_F(WasmCapiTest, Table) {
   ValueType reps[] = {kWasmI32, kWasmI32, kWasmI32};
   FunctionSig call_sig(1, 2, reps);
   byte call_code[] = {
-      WASM_CALL_INDIRECT1(sig_i_i_index, WASM_GET_LOCAL(1), WASM_GET_LOCAL(0))};
+      WASM_CALL_INDIRECT(sig_i_i_index, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))};
   AddExportedFunction(CStrVector("call_indirect"), call_code, sizeof(call_code),
                       &call_sig);
   byte f_code[] = {WASM_GET_LOCAL(0)};
diff --git a/deps/v8/test/wasm-api-tests/traps.cc b/deps/v8/test/wasm-api-tests/traps.cc
index e6e425fc4c6bcf..34ce7d07aa6792 100644
--- a/deps/v8/test/wasm-api-tests/traps.cc
+++ b/deps/v8/test/wasm-api-tests/traps.cc
@@ -58,7 +58,7 @@ TEST_F(WasmCapiTest, Traps) {
   i::Isolate* isolate =
       reinterpret_cast<::wasm::StoreImpl*>(store())->i_isolate();
   ModuleResult result = DecodeWasmModule(
-      kAllWasmFeatures, wire_bytes()->begin(), wire_bytes()->end(), false,
+      WasmFeatures::All(), wire_bytes()->begin(), wire_bytes()->end(), false,
       ModuleOrigin::kWasmOrigin, isolate->counters(),
       isolate->wasm_engine()->allocator());
   ASSERT_TRUE(result.ok());
diff --git a/deps/v8/test/wasm-api-tests/wasm-api-tests.status b/deps/v8/test/wasm-api-tests/wasm-api-tests.status
index 72aedb73680256..a5d554103fb91f 100644
--- a/deps/v8/test/wasm-api-tests/wasm-api-tests.status
+++ b/deps/v8/test/wasm-api-tests/wasm-api-tests.status
@@ -8,9 +8,4 @@
   '*': [SKIP],
 }], # lite_mode or variant == jitless
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-
 ]
diff --git a/deps/v8/test/wasm-js/testcfg.py b/deps/v8/test/wasm-js/testcfg.py
index 61e55477f9c565..a4cb262c33a054 100644
--- a/deps/v8/test/wasm-js/testcfg.py
+++ b/deps/v8/test/wasm-js/testcfg.py
@@ -31,6 +31,10 @@
                     'name': 'JS-BigInt-integration',
                     'flags': ['--experimental-wasm-bigint']
                   },
+                  {
+                    'name': 'multi-value',
+                    'flags': ['--experimental-wasm-mv']
+                  },
                   ]
 
 
diff --git a/deps/v8/test/wasm-js/tests.tar.gz.sha1 b/deps/v8/test/wasm-js/tests.tar.gz.sha1
index 5001675b36ede1..b65f0c924f14ad 100644
--- a/deps/v8/test/wasm-js/tests.tar.gz.sha1
+++ b/deps/v8/test/wasm-js/tests.tar.gz.sha1
@@ -1 +1 @@
-2ecf4038f24fc08bd9da504f15942d3abb5ec685
\ No newline at end of file
+998b2870df79bf5ae83eb80aa6adb4ec3110d197
\ No newline at end of file
diff --git a/deps/v8/test/wasm-js/wasm-js.status b/deps/v8/test/wasm-js/wasm-js.status
index 5d219f6eedeb55..af13e5a1b365fa 100644
--- a/deps/v8/test/wasm-js/wasm-js.status
+++ b/deps/v8/test/wasm-js/wasm-js.status
@@ -9,7 +9,7 @@
   'proposals/reference-types/limits': [SKIP],
   # TODO(v8:9673): Enable these spec tests once they exist, and the out-dated
   # tests have been removed.
-  'proposals/JS-BigInt-integration/*': [SKIP],
+  'proposals/JS-BigInt-integration/module/params-long': [FAIL],
 }], # ALWAYS
 
 ['arch == s390 or arch == s390x or system == aix', {
@@ -24,9 +24,4 @@
   '*': [SKIP],
 }], # lite_mode or variant == jitless
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-
 ]
diff --git a/deps/v8/test/wasm-spec-tests/OWNERS b/deps/v8/test/wasm-spec-tests/OWNERS
index 8c66d1228872ba..95216bba4d43ad 100644
--- a/deps/v8/test/wasm-spec-tests/OWNERS
+++ b/deps/v8/test/wasm-spec-tests/OWNERS
@@ -1,4 +1,3 @@
-ahaas@chromium.org
-clemensb@chromium.org
+file:../../src/wasm/OWNERS
 
 # COMPONENT: Blink>JavaScript>WebAssembly
diff --git a/deps/v8/test/wasm-spec-tests/testcfg.py b/deps/v8/test/wasm-spec-tests/testcfg.py
index 65131327b07d9f..29c80e8ddcb226 100644
--- a/deps/v8/test/wasm-spec-tests/testcfg.py
+++ b/deps/v8/test/wasm-spec-tests/testcfg.py
@@ -9,8 +9,7 @@
 
 proposal_flags = [{
                     'name': 'reference-types',
-                    'flags': ['--experimental-wasm-anyref',
-                              '--no-experimental-wasm-bulk-memory']
+                    'flags': ['--experimental-wasm-anyref']
                   },
                   {
                     'name': 'bulk-memory-operations',
@@ -25,6 +24,11 @@
                     'name': 'JS-BigInt-integration',
                     'flags': ['--experimental-wasm-bigint']
                   },
+                  {
+                    'name': 'multi-value',
+                    'flags': ['--experimental-wasm-mv',
+                              '--no-experimental-wasm-bulk-memory']
+                  },
                   ]
 
 class TestLoader(testsuite.JSTestLoader):
diff --git a/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1 b/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1
index c61881d0725463..b905b5674e1a4c 100644
--- a/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1
+++ b/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1
@@ -1 +1 @@
-f9bd936c708402051f87f4ac8940d1916112a15a
\ No newline at end of file
+61d66d9a4019b8799d4be29b82424c5e5a4fb8b2
\ No newline at end of file
diff --git a/deps/v8/test/wasm-spec-tests/wasm-spec-tests.status b/deps/v8/test/wasm-spec-tests/wasm-spec-tests.status
index a0b96847c0e1ae..ccf27ed6a7a3b0 100644
--- a/deps/v8/test/wasm-spec-tests/wasm-spec-tests.status
+++ b/deps/v8/test/wasm-spec-tests/wasm-spec-tests.status
@@ -6,6 +6,7 @@
 [ALWAYS, {
   #TODO(ahaas): Add additional stack checks on mips.
   'skip-stack-guard-page': [PASS, ['arch == mipsel or arch == mips64el or ((arch == ppc or arch == ppc64 or arch == s390 or arch == s390x) and simulator_run)', SKIP]],
+
   # TODO(v8:9144): The MVP behavior when bounds-checking segments changed in
   # the bulk-memory proposal. Since we've enabled bulk-memory by default, we
   # need to update to use its testsuite.
@@ -13,13 +14,25 @@
   'binary-leb128': [FAIL],
   'elem': [FAIL],
   'data': [FAIL],
-  # TODO(mstarzinger): Roll newest tests into "js-types" repository.
+
+  # TODO(wasm): Roll newest tests into "js-types" repository.
   'proposals/js-types/exports': [FAIL],
   'proposals/js-types/globals': [FAIL],
   'proposals/js-types/linking': [FAIL],
-  # TODO(v8:9673): Enable these spec tests once they exist, and the out-dated
-  # tests have been removed.
-  'proposals/JS-BigInt-integration/*': [SKIP],
+
+  # TODO(thibaudm): Spec tests do not check multi-return functions correctly.
+  'proposals/multi-value/call': [FAIL],
+  'proposals/multi-value/if': [FAIL],
+  'proposals/multi-value/func': [FAIL],
+
+  # TODO(v8:10156): Spec tests are failing after rebasing the reference-types
+  # proposal on the bulk-operations proposal.
+  'proposals/reference-types/elem': [FAIL],
+  'proposals/reference-types/ref_func': [FAIL],
+  'proposals/reference-types/table_fill': [FAIL],
+  'proposals/reference-types/table_grow': [FAIL],
+  'proposals/reference-types/select': [FAIL],
+  'proposals/reference-types/br_table': [FAIL],
 }],  # ALWAYS
 
 ['arch == mipsel or arch == mips64el or arch == mips or arch == mips64', {
@@ -39,6 +52,18 @@
   'proposals/js-types/float_exprs': [SKIP],
   'proposals/js-types/float_misc': [SKIP],
   'proposals/js-types/conversions': [SKIP],
+  'proposals/JS-BigInt-integration/f32': [SKIP],
+  'proposals/JS-BigInt-integration/f64': [SKIP],
+  'proposals/bulk-memory-operations/f32': [SKIP],
+  'proposals/bulk-memory-operations/f64': [SKIP],
+  'proposals/multi-value/f32': [SKIP],
+  'proposals/multi-value/f64': [SKIP],
+  'proposals/reference-types/f32': [SKIP],
+  'proposals/reference-types/f64': [SKIP],
+  'proposals/JS-BigInt-integration/float_misc': [SKIP],
+  'proposals/bulk-memory-operations/float_misc': [SKIP],
+  'proposals/multi-value/float_misc': [SKIP],
+  'proposals/reference-types/float_misc': [SKIP],
 }],  # 'arch == mipsel or arch == mips64el or arch == mips or arch == mips64'
 
 ['(arch == mipsel or arch == mips64el or arch == mips or arch == mips64) and not simulator_run', {
@@ -47,22 +72,27 @@
   'conversions': [SKIP],
 }],  # '(arch == mipsel or arch == mips64el or arch == mips or arch == mips64) and not simulator_run'
 
-['arch == arm and not simulator_run', {
-  # Too slow on chromebooks.
-  'br_table': [SKIP],
-}],  # 'arch == arm and not simulator_run'
-
 ['arch == ppc or arch == ppc64', {
   # These tests fail because ppc float min and max doesn't convert sNaN to qNaN.
   'f32': [SKIP],
   'f64': [SKIP],
   'proposals/js-types/f32': [SKIP],
   'proposals/js-types/f64': [SKIP],
+  'proposals/JS-BigInt-integration/f32': [SKIP],
+  'proposals/JS-BigInt-integration/f64': [SKIP],
+  'proposals/bulk-memory-operations/f32': [SKIP],
+  'proposals/bulk-memory-operations/f64': [SKIP],
+  'proposals/multi-value/f32': [SKIP],
+  'proposals/multi-value/f64': [SKIP],
+  'proposals/reference-types/f32': [SKIP],
+  'proposals/reference-types/f64': [SKIP],
   # This test fails because ppc float to double doesn't convert sNaN to qNaN.
   'conversions': [SKIP],
-  'proposals/reference-types/conversions':  [SKIP],
-  'proposals/bulk-memory-operations/conversions': [SKIP],
   'proposals/js-types/conversions': [SKIP],
+  'proposals/JS-BigInt-integration/conversions': [SKIP],
+  'proposals/bulk-memory-operations/conversions': [SKIP],
+  'proposals/multi-value/conversions': [SKIP],
+  'proposals/reference-types/conversions':  [SKIP],
 }],  # 'arch == ppc or arch == ppc64'
 
 ['arch == s390 or arch == s390x', {
@@ -71,6 +101,14 @@
   'f64': [SKIP],
   'proposals/js-types/f32': [SKIP],
   'proposals/js-types/f64': [SKIP],
+  'proposals/JS-BigInt-integration/f32': [SKIP],
+  'proposals/JS-BigInt-integration/f64': [SKIP],
+  'proposals/bulk-memory-operations/f32': [SKIP],
+  'proposals/bulk-memory-operations/f64': [SKIP],
+  'proposals/multi-value/f32': [SKIP],
+  'proposals/multi-value/f64': [SKIP],
+  'proposals/reference-types/f32': [SKIP],
+  'proposals/reference-types/f64': [SKIP],
 }],  # 'arch == s390 or arch == s390x'
 
 ##############################################################################
@@ -79,10 +117,5 @@
   '*': [SKIP],
 }], # lite_mode or variant == jitless
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-
 
 ]
diff --git a/deps/v8/test/webkit/class-syntax-call-expected.txt b/deps/v8/test/webkit/class-syntax-call-expected.txt
index 1b1e50aba062c2..977e2d2de510d9 100644
--- a/deps/v8/test/webkit/class-syntax-call-expected.txt
+++ b/deps/v8/test/webkit/class-syntax-call-expected.txt
@@ -8,9 +8,9 @@ PASS A() threw exception TypeError: Class constructor A cannot be invoked withou
 PASS new B did not throw exception.
 PASS B() threw exception TypeError: Class constructor B cannot be invoked without 'new'.
 PASS new (class { constructor() {} })() did not throw exception.
-PASS (class { constructor() {} })() threw exception TypeError: Class constructor  cannot be invoked without 'new'.
+PASS (class { constructor() {} })() threw exception TypeError: Class constructors cannot be invoked without 'new'.
 PASS new (class extends null { constructor() { super() } })() threw exception TypeError: Super constructor null of anonymous class is not a constructor.
-PASS (class extends null { constructor() { super() } })() threw exception TypeError: Class constructor  cannot be invoked without 'new'.
+PASS (class extends null { constructor() { super() } })() threw exception TypeError: Class constructors cannot be invoked without 'new'.
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/deps/v8/test/webkit/class-syntax-call.js b/deps/v8/test/webkit/class-syntax-call.js
index 7ded66fb3fff8f..a4f04de7577734 100644
--- a/deps/v8/test/webkit/class-syntax-call.js
+++ b/deps/v8/test/webkit/class-syntax-call.js
@@ -31,8 +31,8 @@ shouldThrow('A()', '"TypeError: Class constructor A cannot be invoked without \'
 shouldNotThrow('new B');
 shouldThrow('B()', '"TypeError: Class constructor B cannot be invoked without \'new\'"');
 shouldNotThrow('new (class { constructor() {} })()');
-shouldThrow('(class { constructor() {} })()', '"TypeError: Class constructor  cannot be invoked without \'new\'"');
+shouldThrow('(class { constructor() {} })()', '"TypeError: Class constructors cannot be invoked without \'new\'"');
 shouldThrow('new (class extends null { constructor() { super() } })()', '"TypeError: Super constructor null of anonymous class is not a constructor"');
-shouldThrow('(class extends null { constructor() { super() } })()', '"TypeError: Class constructor  cannot be invoked without \'new\'"');
+shouldThrow('(class extends null { constructor() { super() } })()', '"TypeError: Class constructors cannot be invoked without \'new\'"');
 
 var successfullyParsed = true;
diff --git a/deps/v8/test/webkit/sort-with-side-effecting-comparisons.js b/deps/v8/test/webkit/sort-with-side-effecting-comparisons.js
index 6794e322f5df20..d04f77a5273b2a 100644
--- a/deps/v8/test/webkit/sort-with-side-effecting-comparisons.js
+++ b/deps/v8/test/webkit/sort-with-side-effecting-comparisons.js
@@ -27,7 +27,7 @@ description(
 
 var array = [];
 
-for (var i = 0; i < 20000; ++i)
+for (var i = 0; i < 2000; ++i)
     array.push(i);
 
 array.sort(function(a, b) {
diff --git a/deps/v8/test/webkit/webkit.status b/deps/v8/test/webkit/webkit.status
index 014155e54c210b..b2938c89214935 100644
--- a/deps/v8/test/webkit/webkit.status
+++ b/deps/v8/test/webkit/webkit.status
@@ -136,10 +136,5 @@
   'fast/js/string-capitalization': [FAIL],
 }],  # variant == no_wasm_traps
 
-##############################################################################
-['variant == jitless and not embedded_builtins', {
-  '*': [SKIP],
-}], # variant == jitless and not embedded_builtins
-
 ##############################################################################
 ]
diff --git a/deps/v8/third_party/inspector_protocol/BUILD.gn b/deps/v8/third_party/inspector_protocol/BUILD.gn
index 28b2ea4fb4d211..9fcba22e046eae 100644
--- a/deps/v8/third_party/inspector_protocol/BUILD.gn
+++ b/deps/v8/third_party/inspector_protocol/BUILD.gn
@@ -2,55 +2,78 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-static_library("encoding") {
+import("../../gni/v8.gni")
+
+config("crdtp_config") {
+  visibility = [ "../../src/inspector:*" ]
+  configs = [ "../../:internal_config" ]
+  include_dirs = [ "../../include" ]
+}
+
+v8_source_set("crdtp") {
   sources = [
-    "encoding/encoding.cc",
-    "encoding/encoding.h",
+    "crdtp/cbor.cc",
+    "crdtp/cbor.h",
+    "crdtp/export.h",
+    "crdtp/glue.h",
+    "crdtp/json.cc",
+    "crdtp/json.h",
+    "crdtp/parser_handler.h",
+    "crdtp/serializable.cc",
+    "crdtp/serializable.h",
+    "crdtp/serializer_traits.h",
+    "crdtp/span.h",
+    "crdtp/status.cc",
+    "crdtp/status.h",
+  ]
+  configs = [ ":crdtp_config" ]
+  deps = [
+    ":crdtp_platform",
   ]
 }
 
-static_library("bindings") {
+# A small adapter library which only :crdtp may depend on.
+v8_source_set("crdtp_platform") {
+  visibility = [ ":crdtp" ]
   sources = [
-    "bindings/bindings.cc",
-    "bindings/bindings.h",
+    "crdtp/json_platform.h",
+    "crdtp/json_platform_v8.cc",
+  ]
+  public_deps = [
+    "../..:v8_libbase",
   ]
+  configs = [ ":crdtp_config" ]
 }
 
-# encoding_test is part of the unittests, defined in
-# test/unittests/BUILD.gn.
-
-import("../../gni/v8.gni")
-
-v8_source_set("encoding_test") {
+# These tests are linked into test/unittests.
+v8_source_set("crdtp_test") {
   sources = [
-    "encoding/encoding_test.cc",
-    "encoding/encoding_test_helper.h",
-  ]
-  configs = [
-    "../..:external_config",
-    "../..:internal_config_base",
+    "crdtp/cbor_test.cc",
+    "crdtp/glue_test.cc",
+    "crdtp/json_test.cc",
+    "crdtp/serializable_test.cc",
+    "crdtp/serializer_traits_test.cc",
+    "crdtp/span_test.cc",
+    "crdtp/status_test.cc",
+    "crdtp/status_test_support.cc",
+    "crdtp/status_test_support.h",
   ]
+  configs = [ ":crdtp_config" ]
   deps = [
-    ":encoding",
-    "../..:v8_libbase",
-    "../../src/inspector:inspector_string_conversions",
-    "//testing/gmock",
-    "//testing/gtest",
+    ":crdtp_test_platform",
   ]
   testonly = true
 }
 
-v8_source_set("bindings_test") {
+# A small adapter library which only :crdtp_test may depend on.
+v8_source_set("crdtp_test_platform") {
   sources = [
-    "bindings/bindings_test.cc",
-    "bindings/bindings_test_helper.h",
-  ]
-  configs = [
-    "../..:external_config",
-    "../..:internal_config_base",
+    "crdtp/test_platform.h",
+    "crdtp/test_platform_v8.cc",
   ]
-  deps = [
-    ":bindings",
+  configs = [ ":crdtp_config" ]
+  public_deps = [
+    ":crdtp",
     "../..:v8_libbase",
     "../../src/inspector:inspector_string_conversions",
     "//testing/gmock",
@@ -58,4 +81,3 @@ v8_source_set("bindings_test") {
   ]
   testonly = true
 }
-
diff --git a/deps/v8/third_party/inspector_protocol/OWNERS b/deps/v8/third_party/inspector_protocol/OWNERS
index 74da87a57b098d..cb4004036373c4 100644
--- a/deps/v8/third_party/inspector_protocol/OWNERS
+++ b/deps/v8/third_party/inspector_protocol/OWNERS
@@ -4,3 +4,4 @@ dgozman@chromium.org
 kozyatinskiy@chromium.org
 pfeldman@chromium.org
 yangguo@chromium.org
+johannes@chromium.org
diff --git a/deps/v8/third_party/inspector_protocol/README.md b/deps/v8/third_party/inspector_protocol/README.md
index 4482df7c894034..d15f719fdda32c 100644
--- a/deps/v8/third_party/inspector_protocol/README.md
+++ b/deps/v8/third_party/inspector_protocol/README.md
@@ -14,21 +14,5 @@ https://cs.chromium.org/chromium/src/v8/third_party/inspector_protocol/
 
 See also [Contributing to Chrome Devtools Protocol](https://docs.google.com/document/d/1c-COD2kaK__5iMM5SEx-PzNA7HFmgttcYfOHHX0HaOM/edit).
 
-We're working on enabling standalone builds for parts of this package for
-testing and development.
-If you're familiar with
-[Chromium's development process](https://www.chromium.org/developers/contributing-code)
-and have the depot_tools installed, you may use these commands
-to fetch the package (and dependencies) and build and run the tests:
-
-    fetch inspector_protocol
-    cd src
-    gn gen out/Release
-    ninja -C out/Release encoding_test bindings_test
-    out/Release/encoding_test
-    out/Release/bindings_test
-
-You'll probably also need to install g++, since Clang uses this to find the
-standard C++ headers. E.g.,
-
-    sudo apt-get install g++-8
+To build and run the tests of the crdtp library, see
+[CRDTP - Chrome DevTools Protocol](crdtp/README.md).
diff --git a/deps/v8/third_party/inspector_protocol/README.v8 b/deps/v8/third_party/inspector_protocol/README.v8
index 6a75bef675ea23..d9b68c0b17fca9 100644
--- a/deps/v8/third_party/inspector_protocol/README.v8
+++ b/deps/v8/third_party/inspector_protocol/README.v8
@@ -2,7 +2,7 @@ Name: inspector protocol
 Short Name: inspector_protocol
 URL: https://chromium.googlesource.com/deps/inspector_protocol/
 Version: 0
-Revision: a14dad30f0e5b0fc05911856d5a20b1ffe89fd9b
+Revision: 0213a8545f6362cd1cd5091cedf29747736552e8
 License: BSD
 License File: LICENSE
 Security Critical: no
diff --git a/deps/v8/third_party/inspector_protocol/bindings/bindings_test_helper.h b/deps/v8/third_party/inspector_protocol/bindings/bindings_test_helper.h
deleted file mode 100644
index f4ccd49a2dc6a9..00000000000000
--- a/deps/v8/third_party/inspector_protocol/bindings/bindings_test_helper.h
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2019 The V8 Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// This file is V8 specific, to make bindings_test.cc work.
-// It is not rolled from the upstream project.
-
-#ifndef V8_INSPECTOR_PROTOCOL_BINDINGS_BINDINGS_TEST_HELPER_H_
-#define V8_INSPECTOR_PROTOCOL_BINDINGS_BINDINGS_TEST_HELPER_H_
-
-#include <string>
-#include <vector>
-
-#include "src/base/logging.h"
-#include "testing/gmock/include/gmock/gmock.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-#endif  // V8_INSPECTOR_PROTOCOL_BINDINGS_BINDINGS_TEST_HELPER_H_
diff --git a/deps/v8/third_party/inspector_protocol/code_generator.py b/deps/v8/third_party/inspector_protocol/code_generator.py
index 5cf5a308c5e6a0..4260dbe5a411a7 100755
--- a/deps/v8/third_party/inspector_protocol/code_generator.py
+++ b/deps/v8/third_party/inspector_protocol/code_generator.py
@@ -112,16 +112,9 @@ def init_defaults(config_tuple, path, defaults):
       ".lib": False,
       ".lib.export_macro": "",
       ".lib.export_header": False,
-      # The encoding lib consists of encoding/encoding.h and
-      # encoding/encoding.cc in its subdirectory, which binaries
-      # must link / depend on.
-      ".encoding_lib.header": os.path.join(inspector_protocol_dir,
-                                           "encoding/encoding.h"),
-      ".encoding_lib.namespace": "",
-      # Ditto for bindings, see bindings/bindings.h.
-      ".bindings_lib.header": os.path.join(inspector_protocol_dir,
-                                           "bindings/bindings.h"),
-      ".bindings_lib.namespace": ""
+      ".crdtp": False,
+      ".crdtp.dir": os.path.join(inspector_protocol_dir, "crdtp"),
+      ".crdtp.namespace": "crdtp",
     }
     for key_value in config_values:
       parts = key_value.split("=")
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/cbor.cc b/deps/v8/third_party/inspector_protocol/crdtp/cbor.cc
new file mode 100644
index 00000000000000..5be7d61c5510f5
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/cbor.cc
@@ -0,0 +1,1044 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "cbor.h"
+
+#include <algorithm>
+#include <cassert>
+#include <cmath>
+#include <cstring>
+#include <limits>
+#include <stack>
+
+namespace v8_crdtp {
+namespace cbor {
+namespace {
+// Indicates the number of bits the "initial byte" needs to be shifted to the
+// right after applying |kMajorTypeMask| to produce the major type in the
+// lowermost bits.
+static constexpr uint8_t kMajorTypeBitShift = 5u;
+// Mask selecting the low-order 5 bits of the "initial byte", which is where
+// the additional information is encoded.
+static constexpr uint8_t kAdditionalInformationMask = 0x1f;
+// Mask selecting the high-order 3 bits of the "initial byte", which indicates
+// the major type of the encoded value.
+static constexpr uint8_t kMajorTypeMask = 0xe0;
+// Indicates the integer is in the following byte.
+static constexpr uint8_t kAdditionalInformation1Byte = 24u;
+// Indicates the integer is in the next 2 bytes.
+static constexpr uint8_t kAdditionalInformation2Bytes = 25u;
+// Indicates the integer is in the next 4 bytes.
+static constexpr uint8_t kAdditionalInformation4Bytes = 26u;
+// Indicates the integer is in the next 8 bytes.
+static constexpr uint8_t kAdditionalInformation8Bytes = 27u;
+
+// Encodes the initial byte, consisting of the |type| in the first 3 bits
+// followed by 5 bits of |additional_info|.
+constexpr uint8_t EncodeInitialByte(MajorType type, uint8_t additional_info) {
+  return (static_cast<uint8_t>(type) << kMajorTypeBitShift) |
+         (additional_info & kAdditionalInformationMask);
+}
+
+// TAG 24 indicates that what follows is a byte string which is
+// encoded in CBOR format. We use this as a wrapper for
+// maps and arrays, allowing us to skip them, because the
+// byte string carries its size (byte length).
+// https://tools.ietf.org/html/rfc7049#section-2.4.4.1
+static constexpr uint8_t kInitialByteForEnvelope =
+    EncodeInitialByte(MajorType::TAG, 24);
+// The initial byte for a byte string with at most 2^32 bytes
+// of payload. This is used for envelope encoding, even if
+// the byte string is shorter.
+static constexpr uint8_t kInitialByteFor32BitLengthByteString =
+    EncodeInitialByte(MajorType::BYTE_STRING, 26);
+
+// See RFC 7049 Section 2.2.1, indefinite length arrays / maps have additional
+// info = 31.
+static constexpr uint8_t kInitialByteIndefiniteLengthArray =
+    EncodeInitialByte(MajorType::ARRAY, 31);
+static constexpr uint8_t kInitialByteIndefiniteLengthMap =
+    EncodeInitialByte(MajorType::MAP, 31);
+// See RFC 7049 Section 2.3, Table 1; this is used for finishing indefinite
+// length maps / arrays.
+static constexpr uint8_t kStopByte =
+    EncodeInitialByte(MajorType::SIMPLE_VALUE, 31);
+
+// See RFC 7049 Section 2.3, Table 2.
+static constexpr uint8_t kEncodedTrue =
+    EncodeInitialByte(MajorType::SIMPLE_VALUE, 21);
+static constexpr uint8_t kEncodedFalse =
+    EncodeInitialByte(MajorType::SIMPLE_VALUE, 20);
+static constexpr uint8_t kEncodedNull =
+    EncodeInitialByte(MajorType::SIMPLE_VALUE, 22);
+static constexpr uint8_t kInitialByteForDouble =
+    EncodeInitialByte(MajorType::SIMPLE_VALUE, 27);
+
+// See RFC 7049 Table 3 and Section 2.4.4.2. This is used as a prefix for
+// arbitrary binary data encoded as BYTE_STRING.
+static constexpr uint8_t kExpectedConversionToBase64Tag =
+    EncodeInitialByte(MajorType::TAG, 22);
+
+// Writes the bytes for |v| to |out|, starting with the most significant byte.
+// See also: https://commandcenter.blogspot.com/2012/04/byte-order-fallacy.html
+template <typename T>
+void WriteBytesMostSignificantByteFirst(T v, std::vector<uint8_t>* out) {
+  for (int shift_bytes = sizeof(T) - 1; shift_bytes >= 0; --shift_bytes)
+    out->push_back(0xff & (v >> (shift_bytes * 8)));
+}
+
+// Extracts sizeof(T) bytes from |in| to extract a value of type T
+// (e.g. uint64_t, uint32_t, ...), most significant byte first.
+// See also: https://commandcenter.blogspot.com/2012/04/byte-order-fallacy.html
+template <typename T>
+T ReadBytesMostSignificantByteFirst(span<uint8_t> in) {
+  assert(in.size() >= sizeof(T));
+  T result = 0;
+  for (size_t shift_bytes = 0; shift_bytes < sizeof(T); ++shift_bytes)
+    result |= T(in[sizeof(T) - 1 - shift_bytes]) << (shift_bytes * 8);
+  return result;
+}
+}  // namespace
+
+namespace internals {
+// Reads the start of a token with definitive size from |bytes|.
+// |type| is the major type as specified in RFC 7049 Section 2.1.
+// |value| is the payload (e.g. for MajorType::UNSIGNED) or is the size
+// (e.g. for BYTE_STRING).
+// If successful, returns the number of bytes read. Otherwise returns 0.
+size_t ReadTokenStart(span<uint8_t> bytes, MajorType* type, uint64_t* value) {
+  if (bytes.empty())
+    return 0;
+  uint8_t initial_byte = bytes[0];
+  *type = MajorType((initial_byte & kMajorTypeMask) >> kMajorTypeBitShift);
+
+  uint8_t additional_information = initial_byte & kAdditionalInformationMask;
+  if (additional_information < 24) {
+    // Values 0-23 are encoded directly into the additional info of the
+    // initial byte.
+    *value = additional_information;
+    return 1;
+  }
+  if (additional_information == kAdditionalInformation1Byte) {
+    // Values 24-255 are encoded with one initial byte, followed by the value.
+    if (bytes.size() < 2)
+      return 0;
+    *value = ReadBytesMostSignificantByteFirst<uint8_t>(bytes.subspan(1));
+    return 2;
+  }
+  if (additional_information == kAdditionalInformation2Bytes) {
+    // Values 256-65535: 1 initial byte + 2 bytes payload.
+    if (bytes.size() < 1 + sizeof(uint16_t))
+      return 0;
+    *value = ReadBytesMostSignificantByteFirst<uint16_t>(bytes.subspan(1));
+    return 3;
+  }
+  if (additional_information == kAdditionalInformation4Bytes) {
+    // 32 bit uint: 1 initial byte + 4 bytes payload.
+    if (bytes.size() < 1 + sizeof(uint32_t))
+      return 0;
+    *value = ReadBytesMostSignificantByteFirst<uint32_t>(bytes.subspan(1));
+    return 5;
+  }
+  if (additional_information == kAdditionalInformation8Bytes) {
+    // 64 bit uint: 1 initial byte + 8 bytes payload.
+    if (bytes.size() < 1 + sizeof(uint64_t))
+      return 0;
+    *value = ReadBytesMostSignificantByteFirst<uint64_t>(bytes.subspan(1));
+    return 9;
+  }
+  return 0;
+}
+
+// Writes the start of a token with |type|. The |value| may indicate the size,
+// or it may be the payload if the value is an unsigned integer.
+void WriteTokenStart(MajorType type,
+                     uint64_t value,
+                     std::vector<uint8_t>* encoded) {
+  if (value < 24) {
+    // Values 0-23 are encoded directly into the additional info of the
+    // initial byte.
+    encoded->push_back(EncodeInitialByte(type, /*additional_info=*/value));
+    return;
+  }
+  if (value <= std::numeric_limits<uint8_t>::max()) {
+    // Values 24-255 are encoded with one initial byte, followed by the value.
+    encoded->push_back(EncodeInitialByte(type, kAdditionalInformation1Byte));
+    encoded->push_back(value);
+    return;
+  }
+  if (value <= std::numeric_limits<uint16_t>::max()) {
+    // Values 256-65535: 1 initial byte + 2 bytes payload.
+    encoded->push_back(EncodeInitialByte(type, kAdditionalInformation2Bytes));
+    WriteBytesMostSignificantByteFirst<uint16_t>(value, encoded);
+    return;
+  }
+  if (value <= std::numeric_limits<uint32_t>::max()) {
+    // 32 bit uint: 1 initial byte + 4 bytes payload.
+    encoded->push_back(EncodeInitialByte(type, kAdditionalInformation4Bytes));
+    WriteBytesMostSignificantByteFirst<uint32_t>(static_cast<uint32_t>(value),
+                                                 encoded);
+    return;
+  }
+  // 64 bit uint: 1 initial byte + 8 bytes payload.
+  encoded->push_back(EncodeInitialByte(type, kAdditionalInformation8Bytes));
+  WriteBytesMostSignificantByteFirst<uint64_t>(value, encoded);
+}
+}  // namespace internals
+
+// =============================================================================
+// Detecting CBOR content
+// =============================================================================
+
+uint8_t InitialByteForEnvelope() {
+  return kInitialByteForEnvelope;
+}
+
+uint8_t InitialByteFor32BitLengthByteString() {
+  return kInitialByteFor32BitLengthByteString;
+}
+
+bool IsCBORMessage(span<uint8_t> msg) {
+  return msg.size() >= 6 && msg[0] == InitialByteForEnvelope() &&
+         msg[1] == InitialByteFor32BitLengthByteString();
+}
+
+Status CheckCBORMessage(span<uint8_t> msg) {
+  if (msg.empty())
+    return Status(Error::CBOR_NO_INPUT, 0);
+  if (msg[0] != InitialByteForEnvelope())
+    return Status(Error::CBOR_INVALID_START_BYTE, 0);
+  if (msg.size() < 6 || msg[1] != InitialByteFor32BitLengthByteString())
+    return Status(Error::CBOR_INVALID_ENVELOPE, 1);
+  if (msg[2] == 0 && msg[3] == 0 && msg[4] == 0 && msg[5] == 0)
+    return Status(Error::CBOR_INVALID_ENVELOPE, 1);
+  if (msg.size() < 7 || msg[6] != EncodeIndefiniteLengthMapStart())
+    return Status(Error::CBOR_MAP_START_EXPECTED, 6);
+  return Status();
+}
+
+// =============================================================================
+// Encoding invidiual CBOR items
+// =============================================================================
+
+uint8_t EncodeTrue() {
+  return kEncodedTrue;
+}
+
+uint8_t EncodeFalse() {
+  return kEncodedFalse;
+}
+
+uint8_t EncodeNull() {
+  return kEncodedNull;
+}
+
+uint8_t EncodeIndefiniteLengthArrayStart() {
+  return kInitialByteIndefiniteLengthArray;
+}
+
+uint8_t EncodeIndefiniteLengthMapStart() {
+  return kInitialByteIndefiniteLengthMap;
+}
+
+uint8_t EncodeStop() {
+  return kStopByte;
+}
+
+void EncodeInt32(int32_t value, std::vector<uint8_t>* out) {
+  if (value >= 0) {
+    internals::WriteTokenStart(MajorType::UNSIGNED, value, out);
+  } else {
+    uint64_t representation = static_cast<uint64_t>(-(value + 1));
+    internals::WriteTokenStart(MajorType::NEGATIVE, representation, out);
+  }
+}
+
+void EncodeString16(span<uint16_t> in, std::vector<uint8_t>* out) {
+  uint64_t byte_length = static_cast<uint64_t>(in.size_bytes());
+  internals::WriteTokenStart(MajorType::BYTE_STRING, byte_length, out);
+  // When emitting UTF16 characters, we always write the least significant byte
+  // first; this is because it's the native representation for X86.
+  // TODO(johannes): Implement a more efficient thing here later, e.g.
+  // casting *iff* the machine has this byte order.
+  // The wire format for UTF16 chars will probably remain the same
+  // (least significant byte first) since this way we can have
+  // golden files, unittests, etc. that port easily and universally.
+  // See also:
+  // https://commandcenter.blogspot.com/2012/04/byte-order-fallacy.html
+  for (const uint16_t two_bytes : in) {
+    out->push_back(two_bytes);
+    out->push_back(two_bytes >> 8);
+  }
+}
+
+void EncodeString8(span<uint8_t> in, std::vector<uint8_t>* out) {
+  internals::WriteTokenStart(MajorType::STRING,
+                             static_cast<uint64_t>(in.size_bytes()), out);
+  out->insert(out->end(), in.begin(), in.end());
+}
+
+void EncodeFromLatin1(span<uint8_t> latin1, std::vector<uint8_t>* out) {
+  for (size_t ii = 0; ii < latin1.size(); ++ii) {
+    if (latin1[ii] <= 127)
+      continue;
+    // If there's at least one non-ASCII char, convert to UTF8.
+    std::vector<uint8_t> utf8(latin1.begin(), latin1.begin() + ii);
+    for (; ii < latin1.size(); ++ii) {
+      if (latin1[ii] <= 127) {
+        utf8.push_back(latin1[ii]);
+      } else {
+        // 0xC0 means it's a UTF8 sequence with 2 bytes.
+        utf8.push_back((latin1[ii] >> 6) | 0xc0);
+        utf8.push_back((latin1[ii] | 0x80) & 0xbf);
+      }
+    }
+    EncodeString8(SpanFrom(utf8), out);
+    return;
+  }
+  EncodeString8(latin1, out);
+}
+
+void EncodeFromUTF16(span<uint16_t> utf16, std::vector<uint8_t>* out) {
+  // If there's at least one non-ASCII char, encode as STRING16 (UTF16).
+  for (uint16_t ch : utf16) {
+    if (ch <= 127)
+      continue;
+    EncodeString16(utf16, out);
+    return;
+  }
+  // It's all US-ASCII, strip out every second byte and encode as UTF8.
+  internals::WriteTokenStart(MajorType::STRING,
+                             static_cast<uint64_t>(utf16.size()), out);
+  out->insert(out->end(), utf16.begin(), utf16.end());
+}
+
+void EncodeBinary(span<uint8_t> in, std::vector<uint8_t>* out) {
+  out->push_back(kExpectedConversionToBase64Tag);
+  uint64_t byte_length = static_cast<uint64_t>(in.size_bytes());
+  internals::WriteTokenStart(MajorType::BYTE_STRING, byte_length, out);
+  out->insert(out->end(), in.begin(), in.end());
+}
+
+// A double is encoded with a specific initial byte
+// (kInitialByteForDouble) plus the 64 bits of payload for its value.
+constexpr size_t kEncodedDoubleSize = 1 + sizeof(uint64_t);
+
+// An envelope is encoded with a specific initial byte
+// (kInitialByteForEnvelope), plus the start byte for a BYTE_STRING with a 32
+// bit wide length, plus a 32 bit length for that string.
+constexpr size_t kEncodedEnvelopeHeaderSize = 1 + 1 + sizeof(uint32_t);
+
+void EncodeDouble(double value, std::vector<uint8_t>* out) {
+  // The additional_info=27 indicates 64 bits for the double follow.
+  // See RFC 7049 Section 2.3, Table 1.
+  out->push_back(kInitialByteForDouble);
+  union {
+    double from_double;
+    uint64_t to_uint64;
+  } reinterpret;
+  reinterpret.from_double = value;
+  WriteBytesMostSignificantByteFirst<uint64_t>(reinterpret.to_uint64, out);
+}
+
+// =============================================================================
+// cbor::EnvelopeEncoder - for wrapping submessages
+// =============================================================================
+
+void EnvelopeEncoder::EncodeStart(std::vector<uint8_t>* out) {
+  assert(byte_size_pos_ == 0);
+  out->push_back(kInitialByteForEnvelope);
+  out->push_back(kInitialByteFor32BitLengthByteString);
+  byte_size_pos_ = out->size();
+  out->resize(out->size() + sizeof(uint32_t));
+}
+
+bool EnvelopeEncoder::EncodeStop(std::vector<uint8_t>* out) {
+  assert(byte_size_pos_ != 0);
+  // The byte size is the size of the payload, that is, all the
+  // bytes that were written past the byte size position itself.
+  uint64_t byte_size = out->size() - (byte_size_pos_ + sizeof(uint32_t));
+  // We store exactly 4 bytes, so at most INT32MAX, with most significant
+  // byte first.
+  if (byte_size > std::numeric_limits<uint32_t>::max())
+    return false;
+  for (int shift_bytes = sizeof(uint32_t) - 1; shift_bytes >= 0;
+       --shift_bytes) {
+    (*out)[byte_size_pos_++] = 0xff & (byte_size >> (shift_bytes * 8));
+  }
+  return true;
+}
+
+// =============================================================================
+// cbor::NewCBOREncoder - for encoding from a streaming parser
+// =============================================================================
+
+namespace {
+class CBOREncoder : public ParserHandler {
+ public:
+  CBOREncoder(std::vector<uint8_t>* out, Status* status)
+      : out_(out), status_(status) {
+    *status_ = Status();
+  }
+
+  void HandleMapBegin() override {
+    if (!status_->ok())
+      return;
+    envelopes_.emplace_back();
+    envelopes_.back().EncodeStart(out_);
+    out_->push_back(kInitialByteIndefiniteLengthMap);
+  }
+
+  void HandleMapEnd() override {
+    if (!status_->ok())
+      return;
+    out_->push_back(kStopByte);
+    assert(!envelopes_.empty());
+    if (!envelopes_.back().EncodeStop(out_)) {
+      HandleError(
+          Status(Error::CBOR_ENVELOPE_SIZE_LIMIT_EXCEEDED, out_->size()));
+      return;
+    }
+    envelopes_.pop_back();
+  }
+
+  void HandleArrayBegin() override {
+    if (!status_->ok())
+      return;
+    envelopes_.emplace_back();
+    envelopes_.back().EncodeStart(out_);
+    out_->push_back(kInitialByteIndefiniteLengthArray);
+  }
+
+  void HandleArrayEnd() override {
+    if (!status_->ok())
+      return;
+    out_->push_back(kStopByte);
+    assert(!envelopes_.empty());
+    if (!envelopes_.back().EncodeStop(out_)) {
+      HandleError(
+          Status(Error::CBOR_ENVELOPE_SIZE_LIMIT_EXCEEDED, out_->size()));
+      return;
+    }
+    envelopes_.pop_back();
+  }
+
+  void HandleString8(span<uint8_t> chars) override {
+    if (!status_->ok())
+      return;
+    EncodeString8(chars, out_);
+  }
+
+  void HandleString16(span<uint16_t> chars) override {
+    if (!status_->ok())
+      return;
+    EncodeFromUTF16(chars, out_);
+  }
+
+  void HandleBinary(span<uint8_t> bytes) override {
+    if (!status_->ok())
+      return;
+    EncodeBinary(bytes, out_);
+  }
+
+  void HandleDouble(double value) override {
+    if (!status_->ok())
+      return;
+    EncodeDouble(value, out_);
+  }
+
+  void HandleInt32(int32_t value) override {
+    if (!status_->ok())
+      return;
+    EncodeInt32(value, out_);
+  }
+
+  void HandleBool(bool value) override {
+    if (!status_->ok())
+      return;
+    // See RFC 7049 Section 2.3, Table 2.
+    out_->push_back(value ? kEncodedTrue : kEncodedFalse);
+  }
+
+  void HandleNull() override {
+    if (!status_->ok())
+      return;
+    // See RFC 7049 Section 2.3, Table 2.
+    out_->push_back(kEncodedNull);
+  }
+
+  void HandleError(Status error) override {
+    if (!status_->ok())
+      return;
+    *status_ = error;
+    out_->clear();
+  }
+
+ private:
+  std::vector<uint8_t>* out_;
+  std::vector<EnvelopeEncoder> envelopes_;
+  Status* status_;
+};
+}  // namespace
+
+std::unique_ptr<ParserHandler> NewCBOREncoder(std::vector<uint8_t>* out,
+                                              Status* status) {
+  return std::unique_ptr<ParserHandler>(new CBOREncoder(out, status));
+}
+
+// =============================================================================
+// cbor::CBORTokenizer - for parsing individual CBOR items
+// =============================================================================
+
+CBORTokenizer::CBORTokenizer(span<uint8_t> bytes) : bytes_(bytes) {
+  ReadNextToken(/*enter_envelope=*/false);
+}
+
+CBORTokenizer::~CBORTokenizer() {}
+
+CBORTokenTag CBORTokenizer::TokenTag() const {
+  return token_tag_;
+}
+
+void CBORTokenizer::Next() {
+  if (token_tag_ == CBORTokenTag::ERROR_VALUE ||
+      token_tag_ == CBORTokenTag::DONE)
+    return;
+  ReadNextToken(/*enter_envelope=*/false);
+}
+
+void CBORTokenizer::EnterEnvelope() {
+  assert(token_tag_ == CBORTokenTag::ENVELOPE);
+  ReadNextToken(/*enter_envelope=*/true);
+}
+
+Status CBORTokenizer::Status() const {
+  return status_;
+}
+
+// The following accessor functions ::GetInt32, ::GetDouble,
+// ::GetString8, ::GetString16WireRep, ::GetBinary, ::GetEnvelopeContents
+// assume that a particular token was recognized in ::ReadNextToken.
+// That's where all the error checking is done. By design,
+// the accessors (assuming the token was recognized) never produce
+// an error.
+
+int32_t CBORTokenizer::GetInt32() const {
+  assert(token_tag_ == CBORTokenTag::INT32);
+  // The range checks happen in ::ReadNextToken().
+  return static_cast<int32_t>(
+      token_start_type_ == MajorType::UNSIGNED
+          ? token_start_internal_value_
+          : -static_cast<int64_t>(token_start_internal_value_) - 1);
+}
+
+double CBORTokenizer::GetDouble() const {
+  assert(token_tag_ == CBORTokenTag::DOUBLE);
+  union {
+    uint64_t from_uint64;
+    double to_double;
+  } reinterpret;
+  reinterpret.from_uint64 = ReadBytesMostSignificantByteFirst<uint64_t>(
+      bytes_.subspan(status_.pos + 1));
+  return reinterpret.to_double;
+}
+
+span<uint8_t> CBORTokenizer::GetString8() const {
+  assert(token_tag_ == CBORTokenTag::STRING8);
+  auto length = static_cast<size_t>(token_start_internal_value_);
+  return bytes_.subspan(status_.pos + (token_byte_length_ - length), length);
+}
+
+span<uint8_t> CBORTokenizer::GetString16WireRep() const {
+  assert(token_tag_ == CBORTokenTag::STRING16);
+  auto length = static_cast<size_t>(token_start_internal_value_);
+  return bytes_.subspan(status_.pos + (token_byte_length_ - length), length);
+}
+
+span<uint8_t> CBORTokenizer::GetBinary() const {
+  assert(token_tag_ == CBORTokenTag::BINARY);
+  auto length = static_cast<size_t>(token_start_internal_value_);
+  return bytes_.subspan(status_.pos + (token_byte_length_ - length), length);
+}
+
+span<uint8_t> CBORTokenizer::GetEnvelope() const {
+  assert(token_tag_ == CBORTokenTag::ENVELOPE);
+  auto length = static_cast<size_t>(token_start_internal_value_);
+  return bytes_.subspan(status_.pos, length + kEncodedEnvelopeHeaderSize);
+}
+
+span<uint8_t> CBORTokenizer::GetEnvelopeContents() const {
+  assert(token_tag_ == CBORTokenTag::ENVELOPE);
+  auto length = static_cast<size_t>(token_start_internal_value_);
+  return bytes_.subspan(status_.pos + kEncodedEnvelopeHeaderSize, length);
+}
+
+// All error checking happens in ::ReadNextToken, so that the accessors
+// can avoid having to carry an error return value.
+//
+// With respect to checking the encoded lengths of strings, arrays, etc:
+// On the wire, CBOR uses 1,2,4, and 8 byte unsigned integers, so
+// we initially read them as uint64_t, usually into token_start_internal_value_.
+//
+// However, since these containers have a representation on the machine,
+// we need to do corresponding size computations on the input byte array,
+// output span (e.g. the payload for a string), etc., and size_t is
+// machine specific (in practice either 32 bit or 64 bit).
+//
+// Further, we must avoid overflowing size_t. Therefore, we use this
+// kMaxValidLength constant to:
+// - Reject values that are larger than the architecture specific
+//   max size_t (differs between 32 bit and 64 bit arch).
+// - Reserve at least one bit so that we can check against overflows
+//   when adding lengths (array / string length / etc.); we do this by
+//   ensuring that the inputs to an addition are <= kMaxValidLength,
+//   and then checking whether the sum went past it.
+//
+// See also
+// https://chromium.googlesource.com/chromium/src/+/master/docs/security/integer-semantics.md
+static const uint64_t kMaxValidLength =
+    std::min<uint64_t>(std::numeric_limits<uint64_t>::max() >> 2,
+                       std::numeric_limits<size_t>::max());
+
+void CBORTokenizer::ReadNextToken(bool enter_envelope) {
+  if (enter_envelope) {
+    status_.pos += kEncodedEnvelopeHeaderSize;
+  } else {
+    status_.pos =
+        status_.pos == Status::npos() ? 0 : status_.pos + token_byte_length_;
+  }
+  status_.error = Error::OK;
+  if (status_.pos >= bytes_.size()) {
+    token_tag_ = CBORTokenTag::DONE;
+    return;
+  }
+  const size_t remaining_bytes = bytes_.size() - status_.pos;
+  switch (bytes_[status_.pos]) {
+    case kStopByte:
+      SetToken(CBORTokenTag::STOP, 1);
+      return;
+    case kInitialByteIndefiniteLengthMap:
+      SetToken(CBORTokenTag::MAP_START, 1);
+      return;
+    case kInitialByteIndefiniteLengthArray:
+      SetToken(CBORTokenTag::ARRAY_START, 1);
+      return;
+    case kEncodedTrue:
+      SetToken(CBORTokenTag::TRUE_VALUE, 1);
+      return;
+    case kEncodedFalse:
+      SetToken(CBORTokenTag::FALSE_VALUE, 1);
+      return;
+    case kEncodedNull:
+      SetToken(CBORTokenTag::NULL_VALUE, 1);
+      return;
+    case kExpectedConversionToBase64Tag: {  // BINARY
+      const size_t bytes_read = internals::ReadTokenStart(
+          bytes_.subspan(status_.pos + 1), &token_start_type_,
+          &token_start_internal_value_);
+      if (!bytes_read || token_start_type_ != MajorType::BYTE_STRING ||
+          token_start_internal_value_ > kMaxValidLength) {
+        SetError(Error::CBOR_INVALID_BINARY);
+        return;
+      }
+      const uint64_t token_byte_length = token_start_internal_value_ +
+                                         /* tag before token start: */ 1 +
+                                         /* token start: */ bytes_read;
+      if (token_byte_length > remaining_bytes) {
+        SetError(Error::CBOR_INVALID_BINARY);
+        return;
+      }
+      SetToken(CBORTokenTag::BINARY, static_cast<size_t>(token_byte_length));
+      return;
+    }
+    case kInitialByteForDouble: {  // DOUBLE
+      if (kEncodedDoubleSize > remaining_bytes) {
+        SetError(Error::CBOR_INVALID_DOUBLE);
+        return;
+      }
+      SetToken(CBORTokenTag::DOUBLE, kEncodedDoubleSize);
+      return;
+    }
+    case kInitialByteForEnvelope: {  // ENVELOPE
+      if (kEncodedEnvelopeHeaderSize > remaining_bytes) {
+        SetError(Error::CBOR_INVALID_ENVELOPE);
+        return;
+      }
+      // The envelope must be a byte string with 32 bit length.
+      if (bytes_[status_.pos + 1] != kInitialByteFor32BitLengthByteString) {
+        SetError(Error::CBOR_INVALID_ENVELOPE);
+        return;
+      }
+      // Read the length of the byte string.
+      token_start_internal_value_ = ReadBytesMostSignificantByteFirst<uint32_t>(
+          bytes_.subspan(status_.pos + 2));
+      if (token_start_internal_value_ > kMaxValidLength) {
+        SetError(Error::CBOR_INVALID_ENVELOPE);
+        return;
+      }
+      uint64_t token_byte_length =
+          token_start_internal_value_ + kEncodedEnvelopeHeaderSize;
+      if (token_byte_length > remaining_bytes) {
+        SetError(Error::CBOR_INVALID_ENVELOPE);
+        return;
+      }
+      SetToken(CBORTokenTag::ENVELOPE, static_cast<size_t>(token_byte_length));
+      return;
+    }
+    default: {
+      const size_t bytes_read = internals::ReadTokenStart(
+          bytes_.subspan(status_.pos), &token_start_type_,
+          &token_start_internal_value_);
+      switch (token_start_type_) {
+        case MajorType::UNSIGNED:  // INT32.
+          // INT32 is a signed int32 (int32 makes sense for the
+          // inspector protocol, it's not a CBOR limitation), so we check
+          // against the signed max, so that the allowable values are
+          // 0, 1, 2, ... 2^31 - 1.
+          if (!bytes_read || std::numeric_limits<int32_t>::max() <
+                                 token_start_internal_value_) {
+            SetError(Error::CBOR_INVALID_INT32);
+            return;
+          }
+          SetToken(CBORTokenTag::INT32, bytes_read);
+          return;
+        case MajorType::NEGATIVE: {  // INT32.
+          // INT32 is a signed int32 (int32 makes sense for the
+          // inspector protocol, it's not a CBOR limitation); in CBOR, the
+          // negative values for INT32 are represented as NEGATIVE, that is, -1
+          // INT32 is represented as 1 << 5 | 0 (major type 1, additional info
+          // value 0).
+          // The represented allowed values range is -1 to -2^31.
+          // They are mapped into the encoded range of 0 to 2^31-1.
+          // We check the payload in token_start_internal_value_ against
+          // that range (2^31-1 is also known as
+          // std::numeric_limits<int32_t>::max()).
+          if (!bytes_read || token_start_internal_value_ >
+                                 std::numeric_limits<int32_t>::max()) {
+            SetError(Error::CBOR_INVALID_INT32);
+            return;
+          }
+          SetToken(CBORTokenTag::INT32, bytes_read);
+          return;
+        }
+        case MajorType::STRING: {  // STRING8.
+          if (!bytes_read || token_start_internal_value_ > kMaxValidLength) {
+            SetError(Error::CBOR_INVALID_STRING8);
+            return;
+          }
+          uint64_t token_byte_length = token_start_internal_value_ + bytes_read;
+          if (token_byte_length > remaining_bytes) {
+            SetError(Error::CBOR_INVALID_STRING8);
+            return;
+          }
+          SetToken(CBORTokenTag::STRING8,
+                   static_cast<size_t>(token_byte_length));
+          return;
+        }
+        case MajorType::BYTE_STRING: {  // STRING16.
+          // Length must be divisible by 2 since UTF16 is 2 bytes per
+          // character, hence the &1 check.
+          if (!bytes_read || token_start_internal_value_ > kMaxValidLength ||
+              token_start_internal_value_ & 1) {
+            SetError(Error::CBOR_INVALID_STRING16);
+            return;
+          }
+          uint64_t token_byte_length = token_start_internal_value_ + bytes_read;
+          if (token_byte_length > remaining_bytes) {
+            SetError(Error::CBOR_INVALID_STRING16);
+            return;
+          }
+          SetToken(CBORTokenTag::STRING16,
+                   static_cast<size_t>(token_byte_length));
+          return;
+        }
+        case MajorType::ARRAY:
+        case MajorType::MAP:
+        case MajorType::TAG:
+        case MajorType::SIMPLE_VALUE:
+          SetError(Error::CBOR_UNSUPPORTED_VALUE);
+          return;
+      }
+    }
+  }
+}
+
+void CBORTokenizer::SetToken(CBORTokenTag token_tag, size_t token_byte_length) {
+  token_tag_ = token_tag;
+  token_byte_length_ = token_byte_length;
+}
+
+void CBORTokenizer::SetError(Error error) {
+  token_tag_ = CBORTokenTag::ERROR_VALUE;
+  status_.error = error;
+}
+
+// =============================================================================
+// cbor::ParseCBOR - for receiving streaming parser events for CBOR messages
+// =============================================================================
+
+namespace {
+// When parsing CBOR, we limit recursion depth for objects and arrays
+// to this constant.
+static constexpr int kStackLimit = 300;
+
+// Below are three parsing routines for CBOR, which cover enough
+// to roundtrip JSON messages.
+bool ParseMap(int32_t stack_depth,
+              CBORTokenizer* tokenizer,
+              ParserHandler* out);
+bool ParseArray(int32_t stack_depth,
+                CBORTokenizer* tokenizer,
+                ParserHandler* out);
+bool ParseValue(int32_t stack_depth,
+                CBORTokenizer* tokenizer,
+                ParserHandler* out);
+bool ParseEnvelope(int32_t stack_depth,
+                   CBORTokenizer* tokenizer,
+                   ParserHandler* out);
+
+void ParseUTF16String(CBORTokenizer* tokenizer, ParserHandler* out) {
+  std::vector<uint16_t> value;
+  span<uint8_t> rep = tokenizer->GetString16WireRep();
+  for (size_t ii = 0; ii < rep.size(); ii += 2)
+    value.push_back((rep[ii + 1] << 8) | rep[ii]);
+  out->HandleString16(span<uint16_t>(value.data(), value.size()));
+  tokenizer->Next();
+}
+
+bool ParseUTF8String(CBORTokenizer* tokenizer, ParserHandler* out) {
+  assert(tokenizer->TokenTag() == CBORTokenTag::STRING8);
+  out->HandleString8(tokenizer->GetString8());
+  tokenizer->Next();
+  return true;
+}
+
+bool ParseEnvelope(int32_t stack_depth,
+                   CBORTokenizer* tokenizer,
+                   ParserHandler* out) {
+  assert(tokenizer->TokenTag() == CBORTokenTag::ENVELOPE);
+  // Before we enter the envelope, we save the position that we
+  // expect to see after we're done parsing the envelope contents.
+  // This way we can compare and produce an error if the contents
+  // didn't fit exactly into the envelope length.
+  size_t pos_past_envelope = tokenizer->Status().pos +
+                             kEncodedEnvelopeHeaderSize +
+                             tokenizer->GetEnvelopeContents().size();
+  tokenizer->EnterEnvelope();
+  switch (tokenizer->TokenTag()) {
+    case CBORTokenTag::ERROR_VALUE:
+      out->HandleError(tokenizer->Status());
+      return false;
+    case CBORTokenTag::MAP_START:
+      if (!ParseMap(stack_depth + 1, tokenizer, out))
+        return false;
+      break;  // Continue to check pos_past_envelope below.
+    case CBORTokenTag::ARRAY_START:
+      if (!ParseArray(stack_depth + 1, tokenizer, out))
+        return false;
+      break;  // Continue to check pos_past_envelope below.
+    default:
+      out->HandleError(Status{Error::CBOR_MAP_OR_ARRAY_EXPECTED_IN_ENVELOPE,
+                              tokenizer->Status().pos});
+      return false;
+  }
+  // The contents of the envelope parsed OK, now check that we're at
+  // the expected position.
+  if (pos_past_envelope != tokenizer->Status().pos) {
+    out->HandleError(Status{Error::CBOR_ENVELOPE_CONTENTS_LENGTH_MISMATCH,
+                            tokenizer->Status().pos});
+    return false;
+  }
+  return true;
+}
+
+bool ParseValue(int32_t stack_depth,
+                CBORTokenizer* tokenizer,
+                ParserHandler* out) {
+  if (stack_depth > kStackLimit) {
+    out->HandleError(
+        Status{Error::CBOR_STACK_LIMIT_EXCEEDED, tokenizer->Status().pos});
+    return false;
+  }
+  switch (tokenizer->TokenTag()) {
+    case CBORTokenTag::ERROR_VALUE:
+      out->HandleError(tokenizer->Status());
+      return false;
+    case CBORTokenTag::DONE:
+      out->HandleError(Status{Error::CBOR_UNEXPECTED_EOF_EXPECTED_VALUE,
+                              tokenizer->Status().pos});
+      return false;
+    case CBORTokenTag::ENVELOPE:
+      return ParseEnvelope(stack_depth, tokenizer, out);
+    case CBORTokenTag::TRUE_VALUE:
+      out->HandleBool(true);
+      tokenizer->Next();
+      return true;
+    case CBORTokenTag::FALSE_VALUE:
+      out->HandleBool(false);
+      tokenizer->Next();
+      return true;
+    case CBORTokenTag::NULL_VALUE:
+      out->HandleNull();
+      tokenizer->Next();
+      return true;
+    case CBORTokenTag::INT32:
+      out->HandleInt32(tokenizer->GetInt32());
+      tokenizer->Next();
+      return true;
+    case CBORTokenTag::DOUBLE:
+      out->HandleDouble(tokenizer->GetDouble());
+      tokenizer->Next();
+      return true;
+    case CBORTokenTag::STRING8:
+      return ParseUTF8String(tokenizer, out);
+    case CBORTokenTag::STRING16:
+      ParseUTF16String(tokenizer, out);
+      return true;
+    case CBORTokenTag::BINARY: {
+      out->HandleBinary(tokenizer->GetBinary());
+      tokenizer->Next();
+      return true;
+    }
+    case CBORTokenTag::MAP_START:
+      return ParseMap(stack_depth + 1, tokenizer, out);
+    case CBORTokenTag::ARRAY_START:
+      return ParseArray(stack_depth + 1, tokenizer, out);
+    default:
+      out->HandleError(
+          Status{Error::CBOR_UNSUPPORTED_VALUE, tokenizer->Status().pos});
+      return false;
+  }
+}
+
+// |bytes| must start with the indefinite length array byte, so basically,
+// ParseArray may only be called after an indefinite length array has been
+// detected.
+bool ParseArray(int32_t stack_depth,
+                CBORTokenizer* tokenizer,
+                ParserHandler* out) {
+  assert(tokenizer->TokenTag() == CBORTokenTag::ARRAY_START);
+  tokenizer->Next();
+  out->HandleArrayBegin();
+  while (tokenizer->TokenTag() != CBORTokenTag::STOP) {
+    if (tokenizer->TokenTag() == CBORTokenTag::DONE) {
+      out->HandleError(
+          Status{Error::CBOR_UNEXPECTED_EOF_IN_ARRAY, tokenizer->Status().pos});
+      return false;
+    }
+    if (tokenizer->TokenTag() == CBORTokenTag::ERROR_VALUE) {
+      out->HandleError(tokenizer->Status());
+      return false;
+    }
+    // Parse value.
+    if (!ParseValue(stack_depth, tokenizer, out))
+      return false;
+  }
+  out->HandleArrayEnd();
+  tokenizer->Next();
+  return true;
+}
+
+// |bytes| must start with the indefinite length array byte, so basically,
+// ParseArray may only be called after an indefinite length array has been
+// detected.
+bool ParseMap(int32_t stack_depth,
+              CBORTokenizer* tokenizer,
+              ParserHandler* out) {
+  assert(tokenizer->TokenTag() == CBORTokenTag::MAP_START);
+  out->HandleMapBegin();
+  tokenizer->Next();
+  while (tokenizer->TokenTag() != CBORTokenTag::STOP) {
+    if (tokenizer->TokenTag() == CBORTokenTag::DONE) {
+      out->HandleError(
+          Status{Error::CBOR_UNEXPECTED_EOF_IN_MAP, tokenizer->Status().pos});
+      return false;
+    }
+    if (tokenizer->TokenTag() == CBORTokenTag::ERROR_VALUE) {
+      out->HandleError(tokenizer->Status());
+      return false;
+    }
+    // Parse key.
+    if (tokenizer->TokenTag() == CBORTokenTag::STRING8) {
+      if (!ParseUTF8String(tokenizer, out))
+        return false;
+    } else if (tokenizer->TokenTag() == CBORTokenTag::STRING16) {
+      ParseUTF16String(tokenizer, out);
+    } else {
+      out->HandleError(
+          Status{Error::CBOR_INVALID_MAP_KEY, tokenizer->Status().pos});
+      return false;
+    }
+    // Parse value.
+    if (!ParseValue(stack_depth, tokenizer, out))
+      return false;
+  }
+  out->HandleMapEnd();
+  tokenizer->Next();
+  return true;
+}
+}  // namespace
+
+void ParseCBOR(span<uint8_t> bytes, ParserHandler* out) {
+  if (bytes.empty()) {
+    out->HandleError(Status{Error::CBOR_NO_INPUT, 0});
+    return;
+  }
+  CBORTokenizer tokenizer(bytes);
+  if (tokenizer.TokenTag() == CBORTokenTag::ERROR_VALUE) {
+    out->HandleError(tokenizer.Status());
+    return;
+  }
+  if (!ParseValue(/*stack_depth=*/0, &tokenizer, out))
+    return;
+  if (tokenizer.TokenTag() == CBORTokenTag::DONE)
+    return;
+  if (tokenizer.TokenTag() == CBORTokenTag::ERROR_VALUE) {
+    out->HandleError(tokenizer.Status());
+    return;
+  }
+  out->HandleError(Status{Error::CBOR_TRAILING_JUNK, tokenizer.Status().pos});
+}
+
+// =============================================================================
+// cbor::AppendString8EntryToMap - for limited in-place editing of messages
+// =============================================================================
+
+Status AppendString8EntryToCBORMap(span<uint8_t> string8_key,
+                                   span<uint8_t> string8_value,
+                                   std::vector<uint8_t>* cbor) {
+  // Careful below: Don't compare (*cbor)[idx] with a uint8_t, since
+  // it could be a char (signed!). Instead, use bytes.
+  span<uint8_t> bytes(reinterpret_cast<const uint8_t*>(cbor->data()),
+                      cbor->size());
+  CBORTokenizer tokenizer(bytes);
+  if (tokenizer.TokenTag() == CBORTokenTag::ERROR_VALUE)
+    return tokenizer.Status();
+  if (tokenizer.TokenTag() != CBORTokenTag::ENVELOPE)
+    return Status(Error::CBOR_INVALID_ENVELOPE, 0);
+  size_t envelope_size = tokenizer.GetEnvelopeContents().size();
+  size_t old_size = cbor->size();
+  if (old_size != envelope_size + kEncodedEnvelopeHeaderSize)
+    return Status(Error::CBOR_INVALID_ENVELOPE, 0);
+  if (envelope_size == 0 ||
+      (tokenizer.GetEnvelopeContents()[0] != EncodeIndefiniteLengthMapStart()))
+    return Status(Error::CBOR_MAP_START_EXPECTED, kEncodedEnvelopeHeaderSize);
+  if (bytes[bytes.size() - 1] != EncodeStop())
+    return Status(Error::CBOR_MAP_STOP_EXPECTED, cbor->size() - 1);
+  cbor->pop_back();
+  EncodeString8(string8_key, cbor);
+  EncodeString8(string8_value, cbor);
+  cbor->push_back(EncodeStop());
+  size_t new_envelope_size = envelope_size + (cbor->size() - old_size);
+  if (new_envelope_size > std::numeric_limits<uint32_t>::max())
+    return Status(Error::CBOR_ENVELOPE_SIZE_LIMIT_EXCEEDED, 0);
+  size_t size_pos = cbor->size() - new_envelope_size - sizeof(uint32_t);
+  uint8_t* out = reinterpret_cast<uint8_t*>(&cbor->at(size_pos));
+  *(out++) = (new_envelope_size >> 24) & 0xff;
+  *(out++) = (new_envelope_size >> 16) & 0xff;
+  *(out++) = (new_envelope_size >> 8) & 0xff;
+  *(out) = new_envelope_size & 0xff;
+  return Status();
+}
+}  // namespace cbor
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/encoding/encoding.h b/deps/v8/third_party/inspector_protocol/crdtp/cbor.h
similarity index 51%
rename from deps/v8/third_party/inspector_protocol/encoding/encoding.h
rename to deps/v8/third_party/inspector_protocol/crdtp/cbor.h
index 47f6d22e9b5186..cb96ae78219601 100644
--- a/deps/v8/third_party/inspector_protocol/encoding/encoding.h
+++ b/deps/v8/third_party/inspector_protocol/crdtp/cbor.h
@@ -2,202 +2,20 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_PROTOCOL_ENCODING_ENCODING_H_
-#define V8_INSPECTOR_PROTOCOL_ENCODING_ENCODING_H_
+#ifndef V8_CRDTP_CBOR_H_
+#define V8_CRDTP_CBOR_H_
 
-#include <algorithm>
 #include <cstddef>
 #include <cstdint>
-#include <cstring>
-#include <limits>
 #include <memory>
 #include <string>
 #include <vector>
 
-namespace v8_inspector_protocol_encoding {
-// This library is designed to be portable. The only allowed dependency
-// are the C/C++ standard libraries, up to C++11. We support both 32 bit
-// and 64 architectures.
-//
-// Types used below:
-// uint8_t: a byte, e.g. for raw bytes or UTF8 characters
-// uint16_t: two bytes, e.g. for UTF16 characters
-// For input parameters:
-//   span<uint8_t>: pointer to bytes and length
-//   span<uint16_t>: pointer to UTF16 chars and length
-// For output parameters:
-//   std::vector<uint8_t> - Owned segment of bytes / utf8 characters and length.
-//   std::string - Same, for compatibility, even though char is signed.
-
-// =============================================================================
-// span - sequence of bytes
-// =============================================================================
-
-// This template is similar to std::span, which will be included in C++20.
-template <typename T>
-class span {
- public:
-  using index_type = size_t;
-
-  span() : data_(nullptr), size_(0) {}
-  span(const T* data, index_type size) : data_(data), size_(size) {}
-
-  const T* data() const { return data_; }
-
-  const T* begin() const { return data_; }
-  const T* end() const { return data_ + size_; }
-
-  const T& operator[](index_type idx) const { return data_[idx]; }
-
-  span<T> subspan(index_type offset, index_type count) const {
-    return span(data_ + offset, count);
-  }
-
-  span<T> subspan(index_type offset) const {
-    return span(data_ + offset, size_ - offset);
-  }
-
-  bool empty() const { return size_ == 0; }
-
-  index_type size() const { return size_; }
-  index_type size_bytes() const { return size_ * sizeof(T); }
-
- private:
-  const T* data_;
-  index_type size_;
-};
-
-template <typename T>
-span<T> SpanFrom(const std::vector<T>& v) {
-  return span<T>(v.data(), v.size());
-}
-
-template <size_t N>
-span<uint8_t> SpanFrom(const char (&str)[N]) {
-  return span<uint8_t>(reinterpret_cast<const uint8_t*>(str), N - 1);
-}
-
-inline span<uint8_t> SpanFrom(const char* str) {
-  return str ? span<uint8_t>(reinterpret_cast<const uint8_t*>(str), strlen(str))
-             : span<uint8_t>();
-}
-
-inline span<uint8_t> SpanFrom(const std::string& v) {
-  return span<uint8_t>(reinterpret_cast<const uint8_t*>(v.data()), v.size());
-}
-
-// Less than / equality comparison functions for sorting / searching for byte
-// spans. These are similar to absl::string_view's < and == operators.
-inline bool SpanLessThan(span<uint8_t> x, span<uint8_t> y) noexcept {
-  auto min_size = std::min(x.size(), y.size());
-  const int r = min_size == 0 ? 0 : memcmp(x.data(), y.data(), min_size);
-  return (r < 0) || (r == 0 && x.size() < y.size());
-}
-
-inline bool SpanEquals(span<uint8_t> x, span<uint8_t> y) noexcept {
-  auto len = x.size();
-  if (len != y.size())
-    return false;
-  return x.data() == y.data() || len == 0 ||
-         std::memcmp(x.data(), y.data(), len) == 0;
-}
-
-// =============================================================================
-// Status and Error codes
-// =============================================================================
-enum class Error {
-  OK = 0,
-  // JSON parsing errors - json_parser.{h,cc}.
-  JSON_PARSER_UNPROCESSED_INPUT_REMAINS = 0x01,
-  JSON_PARSER_STACK_LIMIT_EXCEEDED = 0x02,
-  JSON_PARSER_NO_INPUT = 0x03,
-  JSON_PARSER_INVALID_TOKEN = 0x04,
-  JSON_PARSER_INVALID_NUMBER = 0x05,
-  JSON_PARSER_INVALID_STRING = 0x06,
-  JSON_PARSER_UNEXPECTED_ARRAY_END = 0x07,
-  JSON_PARSER_COMMA_OR_ARRAY_END_EXPECTED = 0x08,
-  JSON_PARSER_STRING_LITERAL_EXPECTED = 0x09,
-  JSON_PARSER_COLON_EXPECTED = 0x0a,
-  JSON_PARSER_UNEXPECTED_MAP_END = 0x0b,
-  JSON_PARSER_COMMA_OR_MAP_END_EXPECTED = 0x0c,
-  JSON_PARSER_VALUE_EXPECTED = 0x0d,
-
-  CBOR_INVALID_INT32 = 0x0e,
-  CBOR_INVALID_DOUBLE = 0x0f,
-  CBOR_INVALID_ENVELOPE = 0x10,
-  CBOR_ENVELOPE_CONTENTS_LENGTH_MISMATCH = 0x11,
-  CBOR_MAP_OR_ARRAY_EXPECTED_IN_ENVELOPE = 0x12,
-  CBOR_INVALID_STRING8 = 0x13,
-  CBOR_INVALID_STRING16 = 0x14,
-  CBOR_INVALID_BINARY = 0x15,
-  CBOR_UNSUPPORTED_VALUE = 0x16,
-  CBOR_NO_INPUT = 0x17,
-  CBOR_INVALID_START_BYTE = 0x18,
-  CBOR_UNEXPECTED_EOF_EXPECTED_VALUE = 0x19,
-  CBOR_UNEXPECTED_EOF_IN_ARRAY = 0x1a,
-  CBOR_UNEXPECTED_EOF_IN_MAP = 0x1b,
-  CBOR_INVALID_MAP_KEY = 0x1c,
-  CBOR_STACK_LIMIT_EXCEEDED = 0x1d,
-  CBOR_TRAILING_JUNK = 0x1e,
-  CBOR_MAP_START_EXPECTED = 0x1f,
-  CBOR_MAP_STOP_EXPECTED = 0x20,
-  CBOR_ARRAY_START_EXPECTED = 0x21,
-  CBOR_ENVELOPE_SIZE_LIMIT_EXCEEDED = 0x22,
-
-  BINDINGS_MANDATORY_FIELD_MISSING = 0x23,
-  BINDINGS_BOOL_VALUE_EXPECTED = 0x24,
-  BINDINGS_INT32_VALUE_EXPECTED = 0x25,
-  BINDINGS_DOUBLE_VALUE_EXPECTED = 0x26,
-  BINDINGS_STRING_VALUE_EXPECTED = 0x27,
-  BINDINGS_STRING8_VALUE_EXPECTED = 0x28,
-  BINDINGS_BINARY_VALUE_EXPECTED = 0x29,
-};
-
-// A status value with position that can be copied. The default status
-// is OK. Usually, error status values should come with a valid position.
-struct Status {
-  static constexpr size_t npos() { return std::numeric_limits<size_t>::max(); }
-
-  bool ok() const { return error == Error::OK; }
-
-  Error error = Error::OK;
-  size_t pos = npos();
-  Status(Error error, size_t pos) : error(error), pos(pos) {}
-  Status() = default;
-
-  // Returns a 7 bit US-ASCII string, either "OK" or an error message
-  // that includes the position.
-  std::string ToASCIIString() const;
-
- private:
-  std::string ToASCIIString(const char* msg) const;
-};
-
-// Handler interface for parser events emitted by a streaming parser.
-// See cbor::NewCBOREncoder, cbor::ParseCBOR, json::NewJSONEncoder,
-// json::ParseJSON.
-class StreamingParserHandler {
- public:
-  virtual ~StreamingParserHandler() = default;
-  virtual void HandleMapBegin() = 0;
-  virtual void HandleMapEnd() = 0;
-  virtual void HandleArrayBegin() = 0;
-  virtual void HandleArrayEnd() = 0;
-  virtual void HandleString8(span<uint8_t> chars) = 0;
-  virtual void HandleString16(span<uint16_t> chars) = 0;
-  virtual void HandleBinary(span<uint8_t> bytes) = 0;
-  virtual void HandleDouble(double value) = 0;
-  virtual void HandleInt32(int32_t value) = 0;
-  virtual void HandleBool(bool value) = 0;
-  virtual void HandleNull() = 0;
-
-  // The parser may send one error even after other events have already
-  // been received. Client code is reponsible to then discard the
-  // already processed events.
-  // |error| must be an eror, as in, |error.is_ok()| can't be true.
-  virtual void HandleError(Status error) = 0;
-};
+#include "export.h"
+#include "parser_handler.h"
+#include "span.h"
 
+namespace v8_crdtp {
 namespace cbor {
 // The binary encoding for the inspector protocol follows the CBOR specification
 // (RFC 7049). Additional constraints:
@@ -235,6 +53,15 @@ uint8_t InitialByteFor32BitLengthByteString();
 // Checks whether |msg| is a cbor message.
 bool IsCBORMessage(span<uint8_t> msg);
 
+// Performs a leightweight check of |msg|.
+// Disallows:
+// - Empty message
+// - Not starting with the two bytes 0xd8, 0x5a
+// - Empty envelope (all length bytes are 0)
+// - Not starting with a map after the envelope stanza
+// DevTools messages should pass this check.
+Status CheckCBORMessage(span<uint8_t> msg);
+
 // =============================================================================
 // Encoding individual CBOR items
 // =============================================================================
@@ -250,39 +77,32 @@ uint8_t EncodeStop();
 // Encodes |value| as |UNSIGNED| (major type 0) iff >= 0, or |NEGATIVE|
 // (major type 1) iff < 0.
 void EncodeInt32(int32_t value, std::vector<uint8_t>* out);
-void EncodeInt32(int32_t value, std::string* out);
 
 // Encodes a UTF16 string as a BYTE_STRING (major type 2). Each utf16
 // character in |in| is emitted with most significant byte first,
 // appending to |out|.
 void EncodeString16(span<uint16_t> in, std::vector<uint8_t>* out);
-void EncodeString16(span<uint16_t> in, std::string* out);
 
 // Encodes a UTF8 string |in| as STRING (major type 3).
 void EncodeString8(span<uint8_t> in, std::vector<uint8_t>* out);
-void EncodeString8(span<uint8_t> in, std::string* out);
 
 // Encodes the given |latin1| string as STRING8.
 // If any non-ASCII character is present, it will be represented
 // as a 2 byte UTF8 sequence.
 void EncodeFromLatin1(span<uint8_t> latin1, std::vector<uint8_t>* out);
-void EncodeFromLatin1(span<uint8_t> latin1, std::string* out);
 
 // Encodes the given |utf16| string as STRING8 if it's entirely US-ASCII.
 // Otherwise, encodes as STRING16.
 void EncodeFromUTF16(span<uint16_t> utf16, std::vector<uint8_t>* out);
-void EncodeFromUTF16(span<uint16_t> utf16, std::string* out);
 
 // Encodes arbitrary binary data in |in| as a BYTE_STRING (major type 2) with
 // definitive length, prefixed with tag 22 indicating expected conversion to
 // base64 (see RFC 7049, Table 3 and Section 2.4.4.2).
 void EncodeBinary(span<uint8_t> in, std::vector<uint8_t>* out);
-void EncodeBinary(span<uint8_t> in, std::string* out);
 
 // Encodes / decodes a double as Major type 7 (SIMPLE_VALUE),
 // with additional info = 27, followed by 8 bytes in big endian.
 void EncodeDouble(double value, std::vector<uint8_t>* out);
-void EncodeDouble(double value, std::string* out);
 
 // =============================================================================
 // cbor::EnvelopeEncoder - for wrapping submessages
@@ -301,11 +121,9 @@ class EnvelopeEncoder {
   // byte size in |byte_size_pos_|. Also emits empty bytes for the
   // byte sisze so that encoding can continue.
   void EncodeStart(std::vector<uint8_t>* out);
-  void EncodeStart(std::string* out);
   // This records the current size in |out| at position byte_size_pos_.
   // Returns true iff successful.
   bool EncodeStop(std::vector<uint8_t>* out);
-  bool EncodeStop(std::string* out);
 
  private:
   size_t byte_size_pos_ = 0;
@@ -319,11 +137,8 @@ class EnvelopeEncoder {
 // that drives it. The handler will encode into |out|, and iff an error occurs
 // it will set |status| to an error and clear |out|. Otherwise, |status.ok()|
 // will be |true|.
-std::unique_ptr<StreamingParserHandler> NewCBOREncoder(
-    std::vector<uint8_t>* out,
-    Status* status);
-std::unique_ptr<StreamingParserHandler> NewCBOREncoder(std::string* out,
-                                                       Status* status);
+std::unique_ptr<ParserHandler> NewCBOREncoder(std::vector<uint8_t>* out,
+                                              Status* status);
 
 // =============================================================================
 // cbor::CBORTokenizer - for parsing individual CBOR items
@@ -462,7 +277,7 @@ class CBORTokenizer {
 // |out|. If an error occurs, sends |out->HandleError|, and parsing stops.
 // The client is responsible for discarding the already received information in
 // that case.
-void ParseCBOR(span<uint8_t> bytes, StreamingParserHandler* out);
+void ParseCBOR(span<uint8_t> bytes, ParserHandler* out);
 
 // =============================================================================
 // cbor::AppendString8EntryToMap - for limited in-place editing of messages
@@ -474,9 +289,6 @@ void ParseCBOR(span<uint8_t> bytes, StreamingParserHandler* out);
 Status AppendString8EntryToCBORMap(span<uint8_t> string8_key,
                                    span<uint8_t> string8_value,
                                    std::vector<uint8_t>* cbor);
-Status AppendString8EntryToCBORMap(span<uint8_t> string8_key,
-                                   span<uint8_t> string8_value,
-                                   std::string* cbor);
 
 namespace internals {  // Exposed only for writing tests.
 size_t ReadTokenStart(span<uint8_t> bytes,
@@ -486,77 +298,8 @@ size_t ReadTokenStart(span<uint8_t> bytes,
 void WriteTokenStart(cbor::MajorType type,
                      uint64_t value,
                      std::vector<uint8_t>* encoded);
-void WriteTokenStart(cbor::MajorType type,
-                     uint64_t value,
-                     std::string* encoded);
 }  // namespace internals
 }  // namespace cbor
+}  // namespace v8_crdtp
 
-namespace json {
-// Client code must provide an instance. Implementation should delegate
-// to whatever is appropriate.
-class Platform {
- public:
-  virtual ~Platform() = default;
-  // Parses |str| into |result|. Returns false iff there are
-  // leftover characters or parsing errors.
-  virtual bool StrToD(const char* str, double* result) const = 0;
-
-  // Prints |value| in a format suitable for JSON.
-  virtual std::unique_ptr<char[]> DToStr(double value) const = 0;
-};
-
-// =============================================================================
-// json::NewJSONEncoder - for encoding streaming parser events as JSON
-// =============================================================================
-
-// Returns a handler object which will write ascii characters to |out|.
-// |status->ok()| will be false iff the handler routine HandleError() is called.
-// In that case, we'll stop emitting output.
-// Except for calling the HandleError routine at any time, the client
-// code must call the Handle* methods in an order in which they'd occur
-// in valid JSON; otherwise we may crash (the code uses assert).
-std::unique_ptr<StreamingParserHandler> NewJSONEncoder(
-    const Platform* platform,
-    std::vector<uint8_t>* out,
-    Status* status);
-std::unique_ptr<StreamingParserHandler> NewJSONEncoder(const Platform* platform,
-                                                       std::string* out,
-                                                       Status* status);
-
-// =============================================================================
-// json::ParseJSON - for receiving streaming parser events for JSON
-// =============================================================================
-
-void ParseJSON(const Platform& platform,
-               span<uint8_t> chars,
-               StreamingParserHandler* handler);
-void ParseJSON(const Platform& platform,
-               span<uint16_t> chars,
-               StreamingParserHandler* handler);
-
-// =============================================================================
-// json::ConvertCBORToJSON, json::ConvertJSONToCBOR - for transcoding
-// =============================================================================
-Status ConvertCBORToJSON(const Platform& platform,
-                         span<uint8_t> cbor,
-                         std::string* json);
-Status ConvertCBORToJSON(const Platform& platform,
-                         span<uint8_t> cbor,
-                         std::vector<uint8_t>* json);
-Status ConvertJSONToCBOR(const Platform& platform,
-                         span<uint8_t> json,
-                         std::vector<uint8_t>* cbor);
-Status ConvertJSONToCBOR(const Platform& platform,
-                         span<uint16_t> json,
-                         std::vector<uint8_t>* cbor);
-Status ConvertJSONToCBOR(const Platform& platform,
-                         span<uint8_t> json,
-                         std::string* cbor);
-Status ConvertJSONToCBOR(const Platform& platform,
-                         span<uint16_t> json,
-                         std::string* cbor);
-}  // namespace json
-}  // namespace v8_inspector_protocol_encoding
-
-#endif  // V8_INSPECTOR_PROTOCOL_ENCODING_ENCODING_H_
+#endif  // V8_CRDTP_CBOR_H_
diff --git a/deps/v8/third_party/inspector_protocol/encoding/encoding_test.cc b/deps/v8/third_party/inspector_protocol/crdtp/cbor_test.cc
similarity index 56%
rename from deps/v8/third_party/inspector_protocol/encoding/encoding_test.cc
rename to deps/v8/third_party/inspector_protocol/crdtp/cbor_test.cc
index 005e9dcf172ee8..613055f2152de9 100644
--- a/deps/v8/third_party/inspector_protocol/encoding/encoding_test.cc
+++ b/deps/v8/third_party/inspector_protocol/crdtp/cbor_test.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "encoding.h"
+#include "cbor.h"
 
 #include <array>
 #include <clocale>
@@ -13,151 +13,17 @@
 #include <iostream>
 #include <sstream>
 #include <string>
-
-#include "encoding_test_helper.h"
+#include "json.h"
+#include "parser_handler.h"
+#include "span.h"
+#include "status.h"
+#include "status_test_support.h"
+#include "test_platform.h"
 
 using testing::ElementsAreArray;
 
-namespace v8_inspector_protocol_encoding {
-
-class TestPlatform : public json::Platform {
-  bool StrToD(const char* str, double* result) const override {
-    // This is not thread-safe
-    // (see https://en.cppreference.com/w/cpp/locale/setlocale)
-    // but good enough for a unittest.
-    const char* saved_locale = std::setlocale(LC_NUMERIC, nullptr);
-    char* end;
-    *result = std::strtod(str, &end);
-    std::setlocale(LC_NUMERIC, saved_locale);
-    if (errno == ERANGE) {
-      // errno must be reset, e.g. see the example here:
-      // https://en.cppreference.com/w/cpp/string/byte/strtof
-      errno = 0;
-      return false;
-    }
-    return end == str + strlen(str);
-  }
-
-  std::unique_ptr<char[]> DToStr(double value) const override {
-    std::stringstream ss;
-    ss.imbue(std::locale("C"));
-    ss << value;
-    std::string str = ss.str();
-    std::unique_ptr<char[]> result(new char[str.size() + 1]);
-    memcpy(result.get(), str.c_str(), str.size() + 1);
-    return result;
-  }
-};
-
-const json::Platform& GetTestPlatform() {
-  static TestPlatform* platform = new TestPlatform;
-  return *platform;
-}
-
-// =============================================================================
-// span - sequence of bytes
-// =============================================================================
-
-template <typename T>
-class SpanTest : public ::testing::Test {};
-
-using TestTypes = ::testing::Types<uint8_t, uint16_t>;
-TYPED_TEST_SUITE(SpanTest, TestTypes);
-
-TYPED_TEST(SpanTest, Empty) {
-  span<TypeParam> empty;
-  EXPECT_TRUE(empty.empty());
-  EXPECT_EQ(0u, empty.size());
-  EXPECT_EQ(0u, empty.size_bytes());
-  EXPECT_EQ(empty.begin(), empty.end());
-}
-
-TYPED_TEST(SpanTest, SingleItem) {
-  TypeParam single_item = 42;
-  span<TypeParam> singular(&single_item, 1);
-  EXPECT_FALSE(singular.empty());
-  EXPECT_EQ(1u, singular.size());
-  EXPECT_EQ(sizeof(TypeParam), singular.size_bytes());
-  EXPECT_EQ(singular.begin() + 1, singular.end());
-  EXPECT_EQ(42, singular[0]);
-}
-
-TYPED_TEST(SpanTest, FiveItems) {
-  std::vector<TypeParam> test_input = {31, 32, 33, 34, 35};
-  span<TypeParam> five_items(test_input.data(), 5);
-  EXPECT_FALSE(five_items.empty());
-  EXPECT_EQ(5u, five_items.size());
-  EXPECT_EQ(sizeof(TypeParam) * 5, five_items.size_bytes());
-  EXPECT_EQ(five_items.begin() + 5, five_items.end());
-  EXPECT_EQ(31, five_items[0]);
-  EXPECT_EQ(32, five_items[1]);
-  EXPECT_EQ(33, five_items[2]);
-  EXPECT_EQ(34, five_items[3]);
-  EXPECT_EQ(35, five_items[4]);
-  span<TypeParam> three_items = five_items.subspan(2);
-  EXPECT_EQ(3u, three_items.size());
-  EXPECT_EQ(33, three_items[0]);
-  EXPECT_EQ(34, three_items[1]);
-  EXPECT_EQ(35, three_items[2]);
-  span<TypeParam> two_items = five_items.subspan(2, 2);
-  EXPECT_EQ(2u, two_items.size());
-  EXPECT_EQ(33, two_items[0]);
-  EXPECT_EQ(34, two_items[1]);
-}
-
-TEST(SpanFromTest, FromConstCharAndLiteral) {
-  // Testing this is useful because strlen(nullptr) is undefined.
-  EXPECT_EQ(nullptr, SpanFrom(nullptr).data());
-  EXPECT_EQ(0u, SpanFrom(nullptr).size());
-
-  const char* kEmpty = "";
-  EXPECT_EQ(kEmpty, reinterpret_cast<const char*>(SpanFrom(kEmpty).data()));
-  EXPECT_EQ(0u, SpanFrom(kEmpty).size());
-
-  const char* kFoo = "foo";
-  EXPECT_EQ(kFoo, reinterpret_cast<const char*>(SpanFrom(kFoo).data()));
-  EXPECT_EQ(3u, SpanFrom(kFoo).size());
-
-  EXPECT_EQ(3u, SpanFrom("foo").size());
-}
-
-TEST(SpanComparisons, ByteWiseLexicographicalOrder) {
-  // Compare the empty span.
-  EXPECT_FALSE(SpanLessThan(span<uint8_t>(), span<uint8_t>()));
-  EXPECT_TRUE(SpanEquals(span<uint8_t>(), span<uint8_t>()));
-
-  // Compare message with itself.
-  std::string msg = "Hello, world";
-  EXPECT_FALSE(SpanLessThan(SpanFrom(msg), SpanFrom(msg)));
-  EXPECT_TRUE(SpanEquals(SpanFrom(msg), SpanFrom(msg)));
-
-  // Compare message and copy.
-  EXPECT_FALSE(SpanLessThan(SpanFrom(msg), SpanFrom(std::string(msg))));
-  EXPECT_TRUE(SpanEquals(SpanFrom(msg), SpanFrom(std::string(msg))));
-
-  // Compare two messages. |lesser_msg| < |msg| because of the first
-  // byte ('A' < 'H').
-  std::string lesser_msg = "A lesser message.";
-  EXPECT_TRUE(SpanLessThan(SpanFrom(lesser_msg), SpanFrom(msg)));
-  EXPECT_FALSE(SpanLessThan(SpanFrom(msg), SpanFrom(lesser_msg)));
-  EXPECT_FALSE(SpanEquals(SpanFrom(msg), SpanFrom(lesser_msg)));
-}
-
-// =============================================================================
-// Status and Error codes
-// =============================================================================
-
-TEST(StatusTest, StatusToASCIIString) {
-  Status ok_status;
-  EXPECT_EQ("OK", ok_status.ToASCIIString());
-  Status json_error(Error::JSON_PARSER_COLON_EXPECTED, 42);
-  EXPECT_EQ("JSON: colon expected at position 42", json_error.ToASCIIString());
-  Status cbor_error(Error::CBOR_TRAILING_JUNK, 21);
-  EXPECT_EQ("CBOR: trailing junk at position 21", cbor_error.ToASCIIString());
-}
-
+namespace v8_crdtp {
 namespace cbor {
-
 // =============================================================================
 // Detecting CBOR content
 // =============================================================================
@@ -174,6 +40,73 @@ TEST(IsCBORMessage, SomeSmokeTests) {
   EXPECT_TRUE(IsCBORMessage(SpanFrom(one)));
 }
 
+TEST(CheckCBORMessage, SmallestValidExample) {
+  // The smallest example that we consider valid for this lightweight check is
+  // an empty dictionary inside of an envelope.
+  std::vector<uint8_t> empty_dict = {
+      0xd8, 0x5a, 0, 0, 0, 2, EncodeIndefiniteLengthMapStart(), EncodeStop()};
+  Status status = CheckCBORMessage(SpanFrom(empty_dict));
+  EXPECT_THAT(status, StatusIsOk());
+}
+
+TEST(CheckCBORMessage, ValidCBORButNotValidMessage) {
+  // The CBOR parser supports parsing values that aren't messages. E.g., this is
+  // the encoded unsigned int 7 (CBOR really encodes it as a single byte with
+  // value 7).
+  std::vector<uint8_t> not_a_message = {7};
+
+  // Show that the parser (happily) decodes it into JSON
+  std::string json;
+  Status status;
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&json, &status);
+  ParseCBOR(SpanFrom(not_a_message), json_writer.get());
+  EXPECT_THAT(status, StatusIsOk());
+  EXPECT_EQ("7", json);
+
+  // ... but it's not a message.
+  EXPECT_THAT(CheckCBORMessage(SpanFrom(not_a_message)),
+              StatusIs(Error::CBOR_INVALID_START_BYTE, 0));
+}
+
+TEST(CheckCBORMessage, EmptyMessage) {
+  std::vector<uint8_t> empty;
+  Status status = CheckCBORMessage(SpanFrom(empty));
+  EXPECT_THAT(status, StatusIs(Error::CBOR_NO_INPUT, 0));
+}
+
+TEST(CheckCBORMessage, InvalidStartByte) {
+  // Here we test that some actual json, which usually starts with {, is not
+  // considered CBOR. CBOR messages must start with 0xd8, 0x5a, the envelope
+  // start bytes.
+  Status status = CheckCBORMessage(SpanFrom("{\"msg\": \"Hello, world.\"}"));
+  EXPECT_THAT(status, StatusIs(Error::CBOR_INVALID_START_BYTE, 0));
+}
+
+TEST(CheckCBORMessage, InvalidEnvelopes) {
+  std::vector<uint8_t> bytes = {0xd8, 0x5a};
+  EXPECT_THAT(CheckCBORMessage(SpanFrom(bytes)),
+              StatusIs(Error::CBOR_INVALID_ENVELOPE, 1));
+  bytes = {0xd8, 0x5a, 0};
+  EXPECT_THAT(CheckCBORMessage(SpanFrom(bytes)),
+              StatusIs(Error::CBOR_INVALID_ENVELOPE, 1));
+  bytes = {0xd8, 0x5a, 0, 0};
+  EXPECT_THAT(CheckCBORMessage(SpanFrom(bytes)),
+              StatusIs(Error::CBOR_INVALID_ENVELOPE, 1));
+  bytes = {0xd8, 0x5a, 0, 0, 0};
+  EXPECT_THAT(CheckCBORMessage(SpanFrom(bytes)),
+              StatusIs(Error::CBOR_INVALID_ENVELOPE, 1));
+  bytes = {0xd8, 0x5a, 0, 0, 0, 0};
+  EXPECT_THAT(CheckCBORMessage(SpanFrom(bytes)),
+              StatusIs(Error::CBOR_INVALID_ENVELOPE, 1));
+}
+
+TEST(CheckCBORMessage, MapStartExpected) {
+  std::vector<uint8_t> bytes = {0xd8, 0x5a, 0, 0, 0, 1};
+  EXPECT_THAT(CheckCBORMessage(SpanFrom(bytes)),
+              StatusIs(Error::CBOR_MAP_START_EXPECTED, 6));
+}
+
 // =============================================================================
 // Encoding individual CBOR items
 // cbor::CBORTokenizer - for parsing individual CBOR items
@@ -299,7 +232,7 @@ TEST(EncodeDecodeInt32Test, CantRoundtripUint32) {
   CBORTokenizer tokenizer(SpanFrom(encoded));
   // 0xdeadbeef is > std::numerical_limits<int32_t>::max().
   EXPECT_EQ(CBORTokenTag::ERROR_VALUE, tokenizer.TokenTag());
-  EXPECT_EQ(Error::CBOR_INVALID_INT32, tokenizer.Status().error);
+  EXPECT_THAT(tokenizer.Status(), StatusIs(Error::CBOR_INVALID_INT32, 0u));
 }
 
 TEST(EncodeDecodeInt32Test, DecodeErrorCases) {
@@ -326,7 +259,7 @@ TEST(EncodeDecodeInt32Test, DecodeErrorCases) {
     SCOPED_TRACE(test.msg);
     CBORTokenizer tokenizer(SpanFrom(test.data));
     EXPECT_EQ(CBORTokenTag::ERROR_VALUE, tokenizer.TokenTag());
-    EXPECT_EQ(Error::CBOR_INVALID_INT32, tokenizer.Status().error);
+    EXPECT_THAT(tokenizer.Status(), StatusIs(Error::CBOR_INVALID_INT32, 0u));
   }
 }
 
@@ -488,7 +421,7 @@ TEST(EncodeDecodeString16Test, ErrorCases) {
     SCOPED_TRACE(test.msg);
     CBORTokenizer tokenizer(SpanFrom(test.data));
     EXPECT_EQ(CBORTokenTag::ERROR_VALUE, tokenizer.TokenTag());
-    EXPECT_EQ(Error::CBOR_INVALID_STRING16, tokenizer.Status().error);
+    EXPECT_THAT(tokenizer.Status(), StatusIs(Error::CBOR_INVALID_STRING16, 0u));
   }
 }
 
@@ -537,7 +470,7 @@ TEST(EncodeDecodeString8Test, ErrorCases) {
     SCOPED_TRACE(test.msg);
     CBORTokenizer tokenizer(SpanFrom(test.data));
     EXPECT_EQ(CBORTokenTag::ERROR_VALUE, tokenizer.TokenTag());
-    EXPECT_EQ(Error::CBOR_INVALID_STRING8, tokenizer.Status().error);
+    EXPECT_THAT(tokenizer.Status(), StatusIs(Error::CBOR_INVALID_STRING8, 0u));
   }
 }
 
@@ -612,7 +545,7 @@ TEST(EncodeDecodeBinaryTest, RoundtripsHelloWorld) {
   std::vector<uint8_t> decoded;
   CBORTokenizer tokenizer(SpanFrom(encoded));
   EXPECT_EQ(CBORTokenTag::BINARY, tokenizer.TokenTag());
-  EXPECT_EQ(0, static_cast<int>(tokenizer.Status().error));
+  EXPECT_THAT(tokenizer.Status(), StatusIsOk());
   decoded = std::vector<uint8_t>(tokenizer.GetBinary().begin(),
                                  tokenizer.GetBinary().end());
   EXPECT_THAT(decoded, ElementsAreArray(binary));
@@ -634,7 +567,7 @@ TEST(EncodeDecodeBinaryTest, ErrorCases) {
     SCOPED_TRACE(test.msg);
     CBORTokenizer tokenizer(SpanFrom(test.data));
     EXPECT_EQ(CBORTokenTag::ERROR_VALUE, tokenizer.TokenTag());
-    EXPECT_EQ(Error::CBOR_INVALID_BINARY, tokenizer.Status().error);
+    EXPECT_THAT(tokenizer.Status(), StatusIs(Error::CBOR_INVALID_BINARY, 0u));
   }
 }
 
@@ -757,20 +690,16 @@ TEST(EncodeDecodeEnvelopesTest, MessageWithNestingAndEnvelopeContentsAccess) {
 // cbor::NewCBOREncoder - for encoding from a streaming parser
 // =============================================================================
 
-void EncodeUTF8ForTest(const std::string& key, std::vector<uint8_t>* out) {
-  EncodeString8(SpanFrom(key), out);
-}
 TEST(JSONToCBOREncoderTest, SevenBitStrings) {
   // When a string can be represented as 7 bit ASCII, the encoder will use the
   // STRING (major Type 3) type, so the actual characters end up as bytes on the
   // wire.
   std::vector<uint8_t> encoded;
   Status status;
-  std::unique_ptr<StreamingParserHandler> encoder =
-      NewCBOREncoder(&encoded, &status);
+  std::unique_ptr<ParserHandler> encoder = NewCBOREncoder(&encoded, &status);
   std::vector<uint16_t> utf16 = {'f', 'o', 'o'};
   encoder->HandleString16(span<uint16_t>(utf16.data(), utf16.size()));
-  EXPECT_EQ(Error::OK, status.error);
+  EXPECT_THAT(status, StatusIsOk());
   // Here we assert that indeed, seven bit strings are represented as
   // bytes on the wire, "foo" is just "foo".
   EXPECT_THAT(encoded,
@@ -779,7 +708,7 @@ TEST(JSONToCBOREncoderTest, SevenBitStrings) {
 }
 
 TEST(JsonCborRoundtrip, EncodingDecoding) {
-  // Hits all the cases except binary and error in StreamingParserHandler, first
+  // Hits all the cases except binary and error in ParserHandler, first
   // parsing a JSON message into CBOR, then parsing it back from CBOR into JSON.
   std::string json =
       "{"
@@ -793,10 +722,9 @@ TEST(JsonCborRoundtrip, EncodingDecoding) {
       "}";
   std::vector<uint8_t> encoded;
   Status status;
-  std::unique_ptr<StreamingParserHandler> encoder =
-      NewCBOREncoder(&encoded, &status);
+  std::unique_ptr<ParserHandler> encoder = NewCBOREncoder(&encoded, &status);
   span<uint8_t> ascii_in = SpanFrom(json);
-  json::ParseJSON(GetTestPlatform(), ascii_in, encoder.get());
+  json::ParseJSON(ascii_in, encoder.get());
   std::vector<uint8_t> expected = {
       0xd8,            // envelope
       0x5a,            // byte string with 32 bit length
@@ -839,10 +767,10 @@ TEST(JsonCborRoundtrip, EncodingDecoding) {
 
   // And now we roundtrip, decoding the message we just encoded.
   std::string decoded;
-  std::unique_ptr<StreamingParserHandler> json_encoder =
-      NewJSONEncoder(&GetTestPlatform(), &decoded, &status);
+  std::unique_ptr<ParserHandler> json_encoder =
+      json::NewJSONEncoder(&decoded, &status);
   ParseCBOR(span<uint8_t>(encoded.data(), encoded.size()), json_encoder.get());
-  EXPECT_EQ(Error::OK, status.error);
+  EXPECT_THAT(status, StatusIsOk());
   EXPECT_EQ(json, decoded);
 }
 
@@ -855,21 +783,20 @@ TEST(JsonCborRoundtrip, MoreRoundtripExamples) {
     SCOPED_TRACE(std::string("example: ") + json);
     std::vector<uint8_t> encoded;
     Status status;
-    std::unique_ptr<StreamingParserHandler> encoder =
-        NewCBOREncoder(&encoded, &status);
+    std::unique_ptr<ParserHandler> encoder = NewCBOREncoder(&encoded, &status);
     span<uint8_t> ascii_in = SpanFrom(json);
-    ParseJSON(GetTestPlatform(), ascii_in, encoder.get());
+    json::ParseJSON(ascii_in, encoder.get());
     std::string decoded;
-    std::unique_ptr<StreamingParserHandler> json_writer =
-        NewJSONEncoder(&GetTestPlatform(), &decoded, &status);
+    std::unique_ptr<ParserHandler> json_writer =
+        json::NewJSONEncoder(&decoded, &status);
     ParseCBOR(span<uint8_t>(encoded.data(), encoded.size()), json_writer.get());
-    EXPECT_EQ(Error::OK, status.error);
+    EXPECT_THAT(status, StatusIsOk());
     EXPECT_EQ(json, decoded);
   }
 }
 
 TEST(JSONToCBOREncoderTest, HelloWorldBinary_WithTripToJson) {
-  // The StreamingParserHandler::HandleBinary is a special case: The JSON parser
+  // The ParserHandler::HandleBinary is a special case: The JSON parser
   // will never call this method, because JSON does not natively support the
   // binary type. So, we can't fully roundtrip. However, the other direction
   // works: binary will be rendered in JSON, as a base64 string. So, we make
@@ -878,8 +805,7 @@ TEST(JSONToCBOREncoderTest, HelloWorldBinary_WithTripToJson) {
   // containing "Hello, world.".
   std::vector<uint8_t> encoded;
   Status status;
-  std::unique_ptr<StreamingParserHandler> encoder =
-      NewCBOREncoder(&encoded, &status);
+  std::unique_ptr<ParserHandler> encoder = NewCBOREncoder(&encoded, &status);
   encoder->HandleMapBegin();
   // Emit a key.
   std::vector<uint16_t> key = {'f', 'o', 'o'};
@@ -889,15 +815,14 @@ TEST(JSONToCBOREncoderTest, HelloWorldBinary_WithTripToJson) {
   encoder->HandleBinary(SpanFrom(std::vector<uint8_t>{
       'H', 'e', 'l', 'l', 'o', ',', ' ', 'w', 'o', 'r', 'l', 'd', '.'}));
   encoder->HandleMapEnd();
-  EXPECT_EQ(Error::OK, status.error);
+  EXPECT_THAT(status, StatusIsOk());
 
   // Now drive the json writer via the CBOR decoder.
   std::string decoded;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &decoded, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&decoded, &status);
   ParseCBOR(SpanFrom(encoded), json_writer.get());
-  EXPECT_EQ(Error::OK, status.error);
-  EXPECT_EQ(Status::npos(), status.pos);
+  EXPECT_THAT(status, StatusIsOk());
   // "Hello, world." in base64 is "SGVsbG8sIHdvcmxkLg==".
   EXPECT_EQ("{\"foo\":\"SGVsbG8sIHdvcmxkLg==\"}", decoded);
 }
@@ -913,18 +838,18 @@ TEST(ParseCBORTest, ParseEmptyCBORMessage) {
   std::vector<uint8_t> in = {0xd8, 0x5a, 0, 0, 0, 2, 0xbf, 0xff};
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(in.data(), in.size()), json_writer.get());
-  EXPECT_EQ(Error::OK, status.error);
+  EXPECT_THAT(status, StatusIsOk());
   EXPECT_EQ("{}", out);
 }
 
 TEST(ParseCBORTest, ParseCBORHelloWorld) {
   const uint8_t kPayloadLen = 27;
   std::vector<uint8_t> bytes = {0xd8, 0x5a, 0, 0, 0, kPayloadLen};
-  bytes.push_back(0xbf);                            // start indef length map.
-  EncodeString8(SpanFrom("msg"), &bytes);           // key: msg
+  bytes.push_back(0xbf);                   // start indef length map.
+  EncodeString8(SpanFrom("msg"), &bytes);  // key: msg
   // Now write the value, the familiar "Hello, 🌎." where the globe is expressed
   // as two utf16 chars.
   bytes.push_back(/*major type=*/2 << 5 | /*additional info=*/20);
@@ -937,10 +862,10 @@ TEST(ParseCBORTest, ParseCBORHelloWorld) {
 
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::OK, status.error);
+  EXPECT_THAT(status, StatusIsOk());
   EXPECT_EQ("{\"msg\":\"Hello, \\ud83c\\udf0e.\"}", out);
 }
 
@@ -962,10 +887,10 @@ TEST(ParseCBORTest, UTF8IsSupportedInKeys) {
 
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::OK, status.error);
+  EXPECT_THAT(status, StatusIsOk());
   EXPECT_EQ("{\"\\ud83c\\udf0e\":\"\\u263e\"}", out);
 }
 
@@ -973,24 +898,10 @@ TEST(ParseCBORTest, NoInputError) {
   std::vector<uint8_t> in = {};
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(in.data(), in.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_NO_INPUT, status.error);
-  EXPECT_EQ("", out);
-}
-
-TEST(ParseCBORTest, InvalidStartByteError) {
-  // Here we test that some actual json, which usually starts with {,
-  // is not considered CBOR. CBOR messages must start with 0x5a, the
-  // envelope start byte.
-  std::string json = "{\"msg\": \"Hello, world.\"}";
-  std::string out;
-  Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
-  ParseCBOR(SpanFrom(json), json_writer.get());
-  EXPECT_EQ(Error::CBOR_INVALID_START_BYTE, status.error);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_NO_INPUT, 0u));
   EXPECT_EQ("", out);
 }
 
@@ -1003,11 +914,11 @@ TEST(ParseCBORTest, UnexpectedEofExpectedValueError) {
   EXPECT_EQ(kPayloadLen, bytes.size() - 6);
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_UNEXPECTED_EOF_EXPECTED_VALUE, status.error);
-  EXPECT_EQ(bytes.size(), status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_UNEXPECTED_EOF_EXPECTED_VALUE,
+                               bytes.size()));
   EXPECT_EQ("", out);
 }
 
@@ -1021,11 +932,11 @@ TEST(ParseCBORTest, UnexpectedEofInArrayError) {
   EXPECT_EQ(kPayloadLen, bytes.size() - 6);
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_UNEXPECTED_EOF_IN_ARRAY, status.error);
-  EXPECT_EQ(bytes.size(), status.pos);
+  EXPECT_THAT(status,
+              StatusIs(Error::CBOR_UNEXPECTED_EOF_IN_ARRAY, bytes.size()));
   EXPECT_EQ("", out);
 }
 
@@ -1036,47 +947,22 @@ TEST(ParseCBORTest, UnexpectedEofInMapError) {
   EXPECT_EQ(kPayloadLen, bytes.size() - 6);
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_UNEXPECTED_EOF_IN_MAP, status.error);
-  EXPECT_EQ(7u, status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_UNEXPECTED_EOF_IN_MAP, 7u));
   EXPECT_EQ("", out);
 }
 
-TEST(ParseCBORTest, TopLevelCantBeEmptyEnvelope) {
-  // Normally, an array would be allowed inside an envelope, but
-  // the top-level envelope is required to contain a map.
+TEST(ParseCBORTest, NoEmptyEnvelopesAllowed) {
   std::vector<uint8_t> bytes = {0xd8, 0x5a, 0, 0, 0, 0};  // envelope
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_MAP_START_EXPECTED, status.error);
-  EXPECT_EQ(bytes.size(), status.pos);
-  EXPECT_EQ("", out);
-}
-
-TEST(ParseCBORTest, MapStartExpectedAtTopLevel) {
-  // Normally, an array would be allowed inside an envelope, but
-  // the top-level envelope is required to contain a map.
-  constexpr uint8_t kPayloadLen = 1;
-  std::vector<uint8_t> bytes = {0xd8,
-                                0x5a,
-                                0,
-                                0,
-                                0,
-                                kPayloadLen,  // envelope
-                                EncodeIndefiniteLengthArrayStart()};
-  EXPECT_EQ(kPayloadLen, bytes.size() - 6);
-  std::string out;
-  Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
-  ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_MAP_START_EXPECTED, status.error);
-  EXPECT_EQ(6u, status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_MAP_OR_ARRAY_EXPECTED_IN_ENVELOPE,
+                               bytes.size()));
   EXPECT_EQ("", out);
 }
 
@@ -1102,11 +988,11 @@ TEST(ParseCBORTest, OnlyMapsAndArraysSupportedInsideEnvelopes) {
 
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_MAP_OR_ARRAY_EXPECTED_IN_ENVELOPE, status.error);
-  EXPECT_EQ(error_pos, status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_MAP_OR_ARRAY_EXPECTED_IN_ENVELOPE,
+                               error_pos));
   EXPECT_EQ("", out);
 }
 
@@ -1119,11 +1005,10 @@ TEST(ParseCBORTest, InvalidMapKeyError) {
   EXPECT_EQ(kPayloadLen, bytes.size() - 6);
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_INVALID_MAP_KEY, status.error);
-  EXPECT_EQ(7u, status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_INVALID_MAP_KEY, 7u));
   EXPECT_EQ("", out);
 }
 
@@ -1150,22 +1035,20 @@ TEST(ParseCBORTest, StackLimitExceededError) {
     std::vector<uint8_t> bytes = MakeNestedCBOR(3);
     std::string out;
     Status status;
-    std::unique_ptr<StreamingParserHandler> json_writer =
-        NewJSONEncoder(&GetTestPlatform(), &out, &status);
+    std::unique_ptr<ParserHandler> json_writer =
+        json::NewJSONEncoder(&out, &status);
     ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-    EXPECT_EQ(Error::OK, status.error);
-    EXPECT_EQ(Status::npos(), status.pos);
+    EXPECT_THAT(status, StatusIsOk());
     EXPECT_EQ("{\"key\":{\"key\":{\"key\":\"innermost_value\"}}}", out);
   }
   {  // Depth 300: no stack limit exceeded.
     std::vector<uint8_t> bytes = MakeNestedCBOR(300);
     std::string out;
     Status status;
-    std::unique_ptr<StreamingParserHandler> json_writer =
-        NewJSONEncoder(&GetTestPlatform(), &out, &status);
+    std::unique_ptr<ParserHandler> json_writer =
+        json::NewJSONEncoder(&out, &status);
     ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-    EXPECT_EQ(Error::OK, status.error);
-    EXPECT_EQ(Status::npos(), status.pos);
+    EXPECT_THAT(status, StatusIsOk());
   }
 
   // We just want to know the length of one opening map so we can compute
@@ -1181,21 +1064,21 @@ TEST(ParseCBORTest, StackLimitExceededError) {
     std::vector<uint8_t> bytes = MakeNestedCBOR(301);
     std::string out;
     Status status;
-    std::unique_ptr<StreamingParserHandler> json_writer =
-        NewJSONEncoder(&GetTestPlatform(), &out, &status);
+    std::unique_ptr<ParserHandler> json_writer =
+        json::NewJSONEncoder(&out, &status);
     ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-    EXPECT_EQ(Error::CBOR_STACK_LIMIT_EXCEEDED, status.error);
-    EXPECT_EQ(opening_segment_size * 301, status.pos);
+    EXPECT_THAT(status, StatusIs(Error::CBOR_STACK_LIMIT_EXCEEDED,
+                                 opening_segment_size * 301));
   }
   {  // Depth 320: still limit exceeded, and at the same pos as for 1001
     std::vector<uint8_t> bytes = MakeNestedCBOR(320);
     std::string out;
     Status status;
-    std::unique_ptr<StreamingParserHandler> json_writer =
-        NewJSONEncoder(&GetTestPlatform(), &out, &status);
+    std::unique_ptr<ParserHandler> json_writer =
+        json::NewJSONEncoder(&out, &status);
     ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-    EXPECT_EQ(Error::CBOR_STACK_LIMIT_EXCEEDED, status.error);
-    EXPECT_EQ(opening_segment_size * 301, status.pos);
+    EXPECT_THAT(status, StatusIs(Error::CBOR_STACK_LIMIT_EXCEEDED,
+                                 opening_segment_size * 301));
   }
 }
 
@@ -1210,11 +1093,10 @@ TEST(ParseCBORTest, UnsupportedValueError) {
 
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_UNSUPPORTED_VALUE, status.error);
-  EXPECT_EQ(error_pos, status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_UNSUPPORTED_VALUE, error_pos));
   EXPECT_EQ("", out);
 }
 
@@ -1233,11 +1115,10 @@ TEST(ParseCBORTest, InvalidString16Error) {
   EXPECT_EQ(kPayloadLen, bytes.size() - 6);
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_INVALID_STRING16, status.error);
-  EXPECT_EQ(error_pos, status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_INVALID_STRING16, error_pos));
   EXPECT_EQ("", out);
 }
 
@@ -1253,11 +1134,10 @@ TEST(ParseCBORTest, InvalidString8Error) {
   EXPECT_EQ(kPayloadLen, bytes.size() - 6);
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_INVALID_STRING8, status.error);
-  EXPECT_EQ(error_pos, status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_INVALID_STRING8, error_pos));
   EXPECT_EQ("", out);
 }
 
@@ -1275,11 +1155,10 @@ TEST(ParseCBORTest, InvalidBinaryError) {
   EXPECT_EQ(kPayloadLen, bytes.size() - 6);
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_INVALID_BINARY, status.error);
-  EXPECT_EQ(error_pos, status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_INVALID_BINARY, error_pos));
   EXPECT_EQ("", out);
 }
 
@@ -1296,11 +1175,10 @@ TEST(ParseCBORTest, InvalidDoubleError) {
   EXPECT_EQ(kPayloadLen, bytes.size() - 6);
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_INVALID_DOUBLE, status.error);
-  EXPECT_EQ(error_pos, status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_INVALID_DOUBLE, error_pos));
   EXPECT_EQ("", out);
 }
 
@@ -1317,11 +1195,10 @@ TEST(ParseCBORTest, InvalidSignedError) {
   EXPECT_EQ(kPayloadLen, bytes.size() - 6);
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_INVALID_INT32, status.error);
-  EXPECT_EQ(error_pos, status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_INVALID_INT32, error_pos));
   EXPECT_EQ("", out);
 }
 
@@ -1340,11 +1217,10 @@ TEST(ParseCBORTest, TrailingJunk) {
                              std::numeric_limits<uint64_t>::max(), &bytes);
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_TRAILING_JUNK, status.error);
-  EXPECT_EQ(error_pos, status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_TRAILING_JUNK, error_pos));
   EXPECT_EQ("", out);
 }
 
@@ -1363,11 +1239,11 @@ TEST(ParseCBORTest, EnvelopeContentsLengthMismatch) {
 
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(span<uint8_t>(bytes.data(), bytes.size()), json_writer.get());
-  EXPECT_EQ(Error::CBOR_ENVELOPE_CONTENTS_LENGTH_MISMATCH, status.error);
-  EXPECT_EQ(bytes.size(), status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_ENVELOPE_CONTENTS_LENGTH_MISMATCH,
+                               bytes.size()));
   EXPECT_EQ("", out);
 }
 
@@ -1381,7 +1257,7 @@ class AppendString8EntryToMapTest : public ::testing::Test {};
 using ContainerTestTypes = ::testing::Types<std::vector<uint8_t>, std::string>;
 TYPED_TEST_SUITE(AppendString8EntryToMapTest, ContainerTestTypes);
 
-TYPED_TEST(AppendString8EntryToMapTest, AppendsEntrySuccessfully) {
+TEST(AppendString8EntryToMapTest, AppendsEntrySuccessfully) {
   constexpr uint8_t kPayloadLen = 12;
   std::vector<uint8_t> bytes = {0xd8, 0x5a, 0, 0, 0, kPayloadLen,  // envelope
                                 0xbf};                             // map start
@@ -1391,722 +1267,88 @@ TYPED_TEST(AppendString8EntryToMapTest, AppendsEntrySuccessfully) {
   bytes.push_back(0xff);  // A perfectly fine cbor message.
   EXPECT_EQ(kPayloadLen, bytes.size() - pos_before_payload);
 
-  TypeParam msg(bytes.begin(), bytes.end());
+  std::vector<uint8_t> msg(bytes.begin(), bytes.end());
 
   Status status =
       AppendString8EntryToCBORMap(SpanFrom("foo"), SpanFrom("bar"), &msg);
-  EXPECT_EQ(Error::OK, status.error);
-  EXPECT_EQ(Status::npos(), status.pos);
+  EXPECT_THAT(status, StatusIsOk());
   std::string out;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(SpanFrom(msg), json_writer.get());
   EXPECT_EQ("{\"key\":\"value\",\"foo\":\"bar\"}", out);
-  EXPECT_EQ(Error::OK, status.error);
-  EXPECT_EQ(Status::npos(), status.pos);
+  EXPECT_THAT(status, StatusIsOk());
 }
 
 TYPED_TEST(AppendString8EntryToMapTest, AppendThreeEntries) {
   std::vector<uint8_t> encoded = {
       0xd8, 0x5a, 0, 0, 0, 2, EncodeIndefiniteLengthMapStart(), EncodeStop()};
-  EXPECT_EQ(Error::OK, AppendString8EntryToCBORMap(SpanFrom("key"),
-                                                   SpanFrom("value"), &encoded)
-                           .error);
-  EXPECT_EQ(Error::OK, AppendString8EntryToCBORMap(SpanFrom("key1"),
-                                                   SpanFrom("value1"), &encoded)
-                           .error);
-  EXPECT_EQ(Error::OK, AppendString8EntryToCBORMap(SpanFrom("key2"),
-                                                   SpanFrom("value2"), &encoded)
-                           .error);
+  EXPECT_THAT(
+      AppendString8EntryToCBORMap(SpanFrom("key"), SpanFrom("value"), &encoded),
+      StatusIsOk());
+  EXPECT_THAT(AppendString8EntryToCBORMap(SpanFrom("key1"), SpanFrom("value1"),
+                                          &encoded),
+              StatusIsOk());
+  EXPECT_THAT(AppendString8EntryToCBORMap(SpanFrom("key2"), SpanFrom("value2"),
+                                          &encoded),
+              StatusIsOk());
   TypeParam msg(encoded.begin(), encoded.end());
   std::string out;
   Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
+  std::unique_ptr<ParserHandler> json_writer =
+      json::NewJSONEncoder(&out, &status);
   ParseCBOR(SpanFrom(msg), json_writer.get());
   EXPECT_EQ("{\"key\":\"value\",\"key1\":\"value1\",\"key2\":\"value2\"}", out);
-  EXPECT_EQ(Error::OK, status.error);
-  EXPECT_EQ(Status::npos(), status.pos);
+  EXPECT_THAT(status, StatusIsOk());
 }
 
-TYPED_TEST(AppendString8EntryToMapTest, MapStartExpected_Error) {
-  std::vector<uint8_t> bytes = {
+TEST(AppendString8EntryToMapTest, MapStartExpected_Error) {
+  std::vector<uint8_t> msg = {
       0xd8, 0x5a, 0, 0, 0, 1, EncodeIndefiniteLengthArrayStart()};
-  TypeParam msg(bytes.begin(), bytes.end());
   Status status =
       AppendString8EntryToCBORMap(SpanFrom("key"), SpanFrom("value"), &msg);
-  EXPECT_EQ(Error::CBOR_MAP_START_EXPECTED, status.error);
-  EXPECT_EQ(6u, status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_MAP_START_EXPECTED, 6u));
 }
 
-TYPED_TEST(AppendString8EntryToMapTest, MapStopExpected_Error) {
-  std::vector<uint8_t> bytes = {
+TEST(AppendString8EntryToMapTest, MapStopExpected_Error) {
+  std::vector<uint8_t> msg = {
       0xd8, 0x5a, 0, 0, 0, 2, EncodeIndefiniteLengthMapStart(), 42};
-  TypeParam msg(bytes.begin(), bytes.end());
   Status status =
       AppendString8EntryToCBORMap(SpanFrom("key"), SpanFrom("value"), &msg);
-  EXPECT_EQ(Error::CBOR_MAP_STOP_EXPECTED, status.error);
-  EXPECT_EQ(7u, status.pos);
+  EXPECT_THAT(status, StatusIs(Error::CBOR_MAP_STOP_EXPECTED, 7u));
 }
 
-TYPED_TEST(AppendString8EntryToMapTest, InvalidEnvelope_Error) {
+TEST(AppendString8EntryToMapTest, InvalidEnvelope_Error) {
   {  // Second byte is wrong.
-    std::vector<uint8_t> bytes = {
+    std::vector<uint8_t> msg = {
         0x5a, 0, 0, 0, 2, EncodeIndefiniteLengthMapStart(), EncodeStop(), 0};
-    TypeParam msg(bytes.begin(), bytes.end());
     Status status =
         AppendString8EntryToCBORMap(SpanFrom("key"), SpanFrom("value"), &msg);
-    EXPECT_EQ(Error::CBOR_INVALID_ENVELOPE, status.error);
-    EXPECT_EQ(0u, status.pos);
+    EXPECT_THAT(status, StatusIs(Error::CBOR_INVALID_ENVELOPE, 0u));
   }
   {  // Second byte is wrong.
-    std::vector<uint8_t> bytes = {
+    std::vector<uint8_t> msg = {
         0xd8, 0x7a, 0, 0, 0, 2, EncodeIndefiniteLengthMapStart(), EncodeStop()};
-    TypeParam msg(bytes.begin(), bytes.end());
     Status status =
         AppendString8EntryToCBORMap(SpanFrom("key"), SpanFrom("value"), &msg);
-    EXPECT_EQ(Error::CBOR_INVALID_ENVELOPE, status.error);
-    EXPECT_EQ(0u, status.pos);
+    EXPECT_THAT(status, StatusIs(Error::CBOR_INVALID_ENVELOPE, 0u));
   }
   {  // Invalid envelope size example.
-    std::vector<uint8_t> bytes = {
+    std::vector<uint8_t> msg = {
         0xd8, 0x5a, 0, 0, 0, 3, EncodeIndefiniteLengthMapStart(), EncodeStop(),
     };
-    TypeParam msg(bytes.begin(), bytes.end());
     Status status =
         AppendString8EntryToCBORMap(SpanFrom("key"), SpanFrom("value"), &msg);
-    EXPECT_EQ(Error::CBOR_INVALID_ENVELOPE, status.error);
-    EXPECT_EQ(0u, status.pos);
+    EXPECT_THAT(status, StatusIs(Error::CBOR_INVALID_ENVELOPE, 0u));
   }
   {  // Invalid envelope size example.
-    std::vector<uint8_t> bytes = {
+    std::vector<uint8_t> msg = {
         0xd8, 0x5a, 0, 0, 0, 1, EncodeIndefiniteLengthMapStart(), EncodeStop(),
     };
-    TypeParam msg(bytes.begin(), bytes.end());
     Status status =
         AppendString8EntryToCBORMap(SpanFrom("key"), SpanFrom("value"), &msg);
-    EXPECT_EQ(Error::CBOR_INVALID_ENVELOPE, status.error);
-    EXPECT_EQ(0u, status.pos);
+    EXPECT_THAT(status, StatusIs(Error::CBOR_INVALID_ENVELOPE, 0u));
   }
 }
 }  // namespace cbor
-
-namespace json {
-
-// =============================================================================
-// json::NewJSONEncoder - for encoding streaming parser events as JSON
-// =============================================================================
-
-void WriteUTF8AsUTF16(StreamingParserHandler* writer, const std::string& utf8) {
-  writer->HandleString16(SpanFrom(UTF8ToUTF16(SpanFrom(utf8))));
-}
-
-TEST(JsonEncoder, OverlongEncodings) {
-  std::string out;
-  Status status;
-  std::unique_ptr<StreamingParserHandler> writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
-
-  // We encode 0x7f, which is the DEL ascii character, as a 4 byte UTF8
-  // sequence. This is called an overlong encoding, because only 1 byte
-  // is needed to represent 0x7f as UTF8.
-  std::vector<uint8_t> chars = {
-      0xf0,  // Starts 4 byte utf8 sequence
-      0x80,  // continuation byte
-      0x81,  // continuation byte w/ payload bit 7 set to 1.
-      0xbf,  // continuation byte w/ payload bits 0-6 set to 11111.
-  };
-  writer->HandleString8(SpanFrom(chars));
-  EXPECT_EQ("\"\"", out);  // Empty string means that 0x7f was rejected (good).
-}
-
-TEST(JsonEncoder, IncompleteUtf8Sequence) {
-  std::string out;
-  Status status;
-  std::unique_ptr<StreamingParserHandler> writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
-
-  writer->HandleArrayBegin();  // This emits [, which starts an array.
-
-  {  // 🌎 takes four bytes to encode in UTF-8. We test with the first three;
-    // This means we're trying to emit a string that consists solely of an
-    // incomplete UTF-8 sequence. So the string in the JSON output is empty.
-    std::string world_utf8 = "🌎";
-    ASSERT_EQ(4u, world_utf8.size());
-    std::vector<uint8_t> chars(world_utf8.begin(), world_utf8.begin() + 3);
-    writer->HandleString8(SpanFrom(chars));
-    EXPECT_EQ("[\"\"", out);  // Incomplete sequence rejected: empty string.
-  }
-
-  {  // This time, the incomplete sequence is at the end of the string.
-    std::string msg = "Hello, \xF0\x9F\x8C";
-    std::vector<uint8_t> chars(msg.begin(), msg.end());
-    writer->HandleString8(SpanFrom(chars));
-    EXPECT_EQ("[\"\",\"Hello, \"", out);  // Incomplete sequence dropped at end.
-  }
-}
-
-TEST(JsonStdStringWriterTest, HelloWorld) {
-  std::string out;
-  Status status;
-  std::unique_ptr<StreamingParserHandler> writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
-  writer->HandleMapBegin();
-  WriteUTF8AsUTF16(writer.get(), "msg1");
-  WriteUTF8AsUTF16(writer.get(), "Hello, 🌎.");
-  std::string key = "msg1-as-utf8";
-  std::string value = "Hello, 🌎.";
-  writer->HandleString8(SpanFrom(key));
-  writer->HandleString8(SpanFrom(value));
-  WriteUTF8AsUTF16(writer.get(), "msg2");
-  WriteUTF8AsUTF16(writer.get(), "\\\b\r\n\t\f\"");
-  WriteUTF8AsUTF16(writer.get(), "nested");
-  writer->HandleMapBegin();
-  WriteUTF8AsUTF16(writer.get(), "double");
-  writer->HandleDouble(3.1415);
-  WriteUTF8AsUTF16(writer.get(), "int");
-  writer->HandleInt32(-42);
-  WriteUTF8AsUTF16(writer.get(), "bool");
-  writer->HandleBool(false);
-  WriteUTF8AsUTF16(writer.get(), "null");
-  writer->HandleNull();
-  writer->HandleMapEnd();
-  WriteUTF8AsUTF16(writer.get(), "array");
-  writer->HandleArrayBegin();
-  writer->HandleInt32(1);
-  writer->HandleInt32(2);
-  writer->HandleInt32(3);
-  writer->HandleArrayEnd();
-  writer->HandleMapEnd();
-  EXPECT_TRUE(status.ok());
-  EXPECT_EQ(
-      "{\"msg1\":\"Hello, \\ud83c\\udf0e.\","
-      "\"msg1-as-utf8\":\"Hello, \\ud83c\\udf0e.\","
-      "\"msg2\":\"\\\\\\b\\r\\n\\t\\f\\\"\","
-      "\"nested\":{\"double\":3.1415,\"int\":-42,"
-      "\"bool\":false,\"null\":null},\"array\":[1,2,3]}",
-      out);
-}
-
-TEST(JsonStdStringWriterTest, RepresentingNonFiniteValuesAsNull) {
-  // JSON can't represent +Infinity, -Infinity, or NaN.
-  // So in practice it's mapped to null.
-  std::string out;
-  Status status;
-  std::unique_ptr<StreamingParserHandler> writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
-  writer->HandleMapBegin();
-  writer->HandleString8(SpanFrom("Infinity"));
-  writer->HandleDouble(std::numeric_limits<double>::infinity());
-  writer->HandleString8(SpanFrom("-Infinity"));
-  writer->HandleDouble(-std::numeric_limits<double>::infinity());
-  writer->HandleString8(SpanFrom("NaN"));
-  writer->HandleDouble(std::numeric_limits<double>::quiet_NaN());
-  writer->HandleMapEnd();
-  EXPECT_TRUE(status.ok());
-  EXPECT_EQ("{\"Infinity\":null,\"-Infinity\":null,\"NaN\":null}", out);
-}
-
-TEST(JsonStdStringWriterTest, BinaryEncodedAsJsonString) {
-  // The encoder emits binary submitted to StreamingParserHandler::HandleBinary
-  // as base64. The following three examples are taken from
-  // https://en.wikipedia.org/wiki/Base64.
-  {
-    std::string out;
-    Status status;
-    std::unique_ptr<StreamingParserHandler> writer =
-        NewJSONEncoder(&GetTestPlatform(), &out, &status);
-    writer->HandleBinary(SpanFrom(std::vector<uint8_t>({'M', 'a', 'n'})));
-    EXPECT_TRUE(status.ok());
-    EXPECT_EQ("\"TWFu\"", out);
-  }
-  {
-    std::string out;
-    Status status;
-    std::unique_ptr<StreamingParserHandler> writer =
-        NewJSONEncoder(&GetTestPlatform(), &out, &status);
-    writer->HandleBinary(SpanFrom(std::vector<uint8_t>({'M', 'a'})));
-    EXPECT_TRUE(status.ok());
-    EXPECT_EQ("\"TWE=\"", out);
-  }
-  {
-    std::string out;
-    Status status;
-    std::unique_ptr<StreamingParserHandler> writer =
-        NewJSONEncoder(&GetTestPlatform(), &out, &status);
-    writer->HandleBinary(SpanFrom(std::vector<uint8_t>({'M'})));
-    EXPECT_TRUE(status.ok());
-    EXPECT_EQ("\"TQ==\"", out);
-  }
-  {  // "Hello, world.", verified with base64decode.org.
-    std::string out;
-    Status status;
-    std::unique_ptr<StreamingParserHandler> writer =
-        NewJSONEncoder(&GetTestPlatform(), &out, &status);
-    writer->HandleBinary(SpanFrom(std::vector<uint8_t>(
-        {'H', 'e', 'l', 'l', 'o', ',', ' ', 'w', 'o', 'r', 'l', 'd', '.'})));
-    EXPECT_TRUE(status.ok());
-    EXPECT_EQ("\"SGVsbG8sIHdvcmxkLg==\"", out);
-  }
-}
-
-TEST(JsonStdStringWriterTest, HandlesErrors) {
-  // When an error is sent via HandleError, it saves it in the provided
-  // status and clears the output.
-  std::string out;
-  Status status;
-  std::unique_ptr<StreamingParserHandler> writer =
-      NewJSONEncoder(&GetTestPlatform(), &out, &status);
-  writer->HandleMapBegin();
-  WriteUTF8AsUTF16(writer.get(), "msg1");
-  writer->HandleError(Status{Error::JSON_PARSER_VALUE_EXPECTED, 42});
-  EXPECT_EQ(Error::JSON_PARSER_VALUE_EXPECTED, status.error);
-  EXPECT_EQ(42u, status.pos);
-  EXPECT_EQ("", out);
-}
-
-// We'd use Gmock but unfortunately it only handles copyable return types.
-class MockPlatform : public Platform {
- public:
-  // Not implemented.
-  bool StrToD(const char* str, double* result) const override { return false; }
-
-  // A map with pre-registered responses for DToSTr.
-  std::map<double, std::string> dtostr_responses_;
-
-  std::unique_ptr<char[]> DToStr(double value) const override {
-    auto it = dtostr_responses_.find(value);
-    CHECK(it != dtostr_responses_.end());
-    const std::string& str = it->second;
-    std::unique_ptr<char[]> response(new char[str.size() + 1]);
-    memcpy(response.get(), str.c_str(), str.size() + 1);
-    return response;
-  }
-};
-
-TEST(JsonStdStringWriterTest, DoubleToString) {
-  // This "broken" platform responds without the leading 0 before the
-  // decimal dot, so it'd be invalid JSON.
-  MockPlatform platform;
-  platform.dtostr_responses_[.1] = ".1";
-  platform.dtostr_responses_[-.7] = "-.7";
-
-  std::string out;
-  Status status;
-  std::unique_ptr<StreamingParserHandler> writer =
-      NewJSONEncoder(&platform, &out, &status);
-  writer->HandleArrayBegin();
-  writer->HandleDouble(.1);
-  writer->HandleDouble(-.7);
-  writer->HandleArrayEnd();
-  EXPECT_EQ("[0.1,-0.7]", out);
-}
-
-// =============================================================================
-// json::ParseJSON - for receiving streaming parser events for JSON
-// =============================================================================
-
-class Log : public StreamingParserHandler {
- public:
-  void HandleMapBegin() override { log_ << "map begin\n"; }
-
-  void HandleMapEnd() override { log_ << "map end\n"; }
-
-  void HandleArrayBegin() override { log_ << "array begin\n"; }
-
-  void HandleArrayEnd() override { log_ << "array end\n"; }
-
-  void HandleString8(span<uint8_t> chars) override {
-    log_ << "string8: " << std::string(chars.begin(), chars.end()) << "\n";
-  }
-
-  void HandleString16(span<uint16_t> chars) override {
-    log_ << "string16: " << UTF16ToUTF8(chars) << "\n";
-  }
-
-  void HandleBinary(span<uint8_t> bytes) override {
-    // JSON doesn't have native support for arbitrary bytes, so our parser will
-    // never call this.
-    CHECK(false);
-  }
-
-  void HandleDouble(double value) override {
-    log_ << "double: " << value << "\n";
-  }
-
-  void HandleInt32(int32_t value) override { log_ << "int: " << value << "\n"; }
-
-  void HandleBool(bool value) override { log_ << "bool: " << value << "\n"; }
-
-  void HandleNull() override { log_ << "null\n"; }
-
-  void HandleError(Status status) override { status_ = status; }
-
-  std::string str() const { return status_.ok() ? log_.str() : ""; }
-
-  Status status() const { return status_; }
-
- private:
-  std::ostringstream log_;
-  Status status_;
-};
-
-class JsonParserTest : public ::testing::Test {
- protected:
-  Log log_;
-};
-
-TEST_F(JsonParserTest, SimpleDictionary) {
-  std::string json = "{\"foo\": 42}";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_TRUE(log_.status().ok());
-  EXPECT_EQ(
-      "map begin\n"
-      "string16: foo\n"
-      "int: 42\n"
-      "map end\n",
-      log_.str());
-}
-
-TEST_F(JsonParserTest, UsAsciiDelCornerCase) {
-  // DEL (0x7f) is a 7 bit US-ASCII character, and while it is a control
-  // character according to Unicode, it's not considered a control
-  // character in https://tools.ietf.org/html/rfc7159#section-7, so
-  // it can be placed directly into the JSON string, without JSON escaping.
-  std::string json = "{\"foo\": \"a\x7f\"}";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_TRUE(log_.status().ok());
-  EXPECT_EQ(
-      "map begin\n"
-      "string16: foo\n"
-      "string16: a\x7f\n"
-      "map end\n",
-      log_.str());
-
-  // We've seen an implementation of UTF16ToUTF8 which would replace the DEL
-  // character with ' ', so this simple roundtrip tests the routines in
-  // encoding_test_helper.h, to make test failures of the above easier to
-  // diagnose.
-  std::vector<uint16_t> utf16 = UTF8ToUTF16(SpanFrom(json));
-  EXPECT_EQ(json, UTF16ToUTF8(SpanFrom(utf16)));
-}
-
-TEST_F(JsonParserTest, Whitespace) {
-  std::string json = "\n  {\n\"msg\"\n: \v\"Hello, world.\"\t\r}\t";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_TRUE(log_.status().ok());
-  EXPECT_EQ(
-      "map begin\n"
-      "string16: msg\n"
-      "string16: Hello, world.\n"
-      "map end\n",
-      log_.str());
-}
-
-TEST_F(JsonParserTest, NestedDictionary) {
-  std::string json = "{\"foo\": {\"bar\": {\"baz\": 1}, \"bar2\": 2}}";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_TRUE(log_.status().ok());
-  EXPECT_EQ(
-      "map begin\n"
-      "string16: foo\n"
-      "map begin\n"
-      "string16: bar\n"
-      "map begin\n"
-      "string16: baz\n"
-      "int: 1\n"
-      "map end\n"
-      "string16: bar2\n"
-      "int: 2\n"
-      "map end\n"
-      "map end\n",
-      log_.str());
-}
-
-TEST_F(JsonParserTest, Doubles) {
-  std::string json = "{\"foo\": 3.1415, \"bar\": 31415e-4}";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_TRUE(log_.status().ok());
-  EXPECT_EQ(
-      "map begin\n"
-      "string16: foo\n"
-      "double: 3.1415\n"
-      "string16: bar\n"
-      "double: 3.1415\n"
-      "map end\n",
-      log_.str());
-}
-
-TEST_F(JsonParserTest, Unicode) {
-  // Globe character. 0xF0 0x9F 0x8C 0x8E in utf8, 0xD83C 0xDF0E in utf16.
-  std::string json = "{\"msg\": \"Hello, \\uD83C\\uDF0E.\"}";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_TRUE(log_.status().ok());
-  EXPECT_EQ(
-      "map begin\n"
-      "string16: msg\n"
-      "string16: Hello, 🌎.\n"
-      "map end\n",
-      log_.str());
-}
-
-TEST_F(JsonParserTest, Unicode_ParseUtf16) {
-  // Globe character. utf8: 0xF0 0x9F 0x8C 0x8E; utf16: 0xD83C 0xDF0E.
-  // Crescent moon character. utf8: 0xF0 0x9F 0x8C 0x99; utf16: 0xD83C 0xDF19.
-
-  // We provide the moon with json escape, but the earth as utf16 input.
-  // Either way they arrive as utf8 (after decoding in log_.str()).
-  std::vector<uint16_t> json =
-      UTF8ToUTF16(SpanFrom("{\"space\": \"🌎 \\uD83C\\uDF19.\"}"));
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_TRUE(log_.status().ok());
-  EXPECT_EQ(
-      "map begin\n"
-      "string16: space\n"
-      "string16: 🌎 🌙.\n"
-      "map end\n",
-      log_.str());
-}
-
-TEST_F(JsonParserTest, Unicode_ParseUtf8) {
-  // Used below:
-  // гласность - example for 2 byte utf8, Russian word "glasnost"
-  // 屋 - example for 3 byte utf8, Chinese word for "house"
-  // 🌎 - example for 4 byte utf8: 0xF0 0x9F 0x8C 0x8E; utf16: 0xD83C 0xDF0E.
-  // 🌙 - example for escapes: utf8: 0xF0 0x9F 0x8C 0x99; utf16: 0xD83C 0xDF19.
-
-  // We provide the moon with json escape, but the earth as utf8 input.
-  // Either way they arrive as utf8 (after decoding in log_.str()).
-  std::string json =
-      "{"
-      "\"escapes\": \"\\uD83C\\uDF19\","
-      "\"2 byte\":\"гласность\","
-      "\"3 byte\":\"屋\","
-      "\"4 byte\":\"🌎\""
-      "}";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_TRUE(log_.status().ok());
-  EXPECT_EQ(
-      "map begin\n"
-      "string16: escapes\n"
-      "string16: 🌙\n"
-      "string16: 2 byte\n"
-      "string16: гласность\n"
-      "string16: 3 byte\n"
-      "string16: 屋\n"
-      "string16: 4 byte\n"
-      "string16: 🌎\n"
-      "map end\n",
-      log_.str());
-}
-
-TEST_F(JsonParserTest, UnprocessedInputRemainsError) {
-  // Trailing junk after the valid JSON.
-  std::string json = "{\"foo\": 3.1415} junk";
-  size_t junk_idx = json.find("junk");
-  EXPECT_NE(junk_idx, std::string::npos);
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_UNPROCESSED_INPUT_REMAINS, log_.status().error);
-  EXPECT_EQ(junk_idx, log_.status().pos);
-  EXPECT_EQ("", log_.str());
-}
-
-std::string MakeNestedJson(int depth) {
-  std::string json;
-  for (int ii = 0; ii < depth; ++ii)
-    json += "{\"foo\":";
-  json += "42";
-  for (int ii = 0; ii < depth; ++ii)
-    json += "}";
-  return json;
-}
-
-TEST_F(JsonParserTest, StackLimitExceededError_BelowLimit) {
-  // kStackLimit is 300 (see json_parser.cc). First let's
-  // try with a small nested example.
-  std::string json_3 = MakeNestedJson(3);
-  ParseJSON(GetTestPlatform(), SpanFrom(json_3), &log_);
-  EXPECT_TRUE(log_.status().ok());
-  EXPECT_EQ(
-      "map begin\n"
-      "string16: foo\n"
-      "map begin\n"
-      "string16: foo\n"
-      "map begin\n"
-      "string16: foo\n"
-      "int: 42\n"
-      "map end\n"
-      "map end\n"
-      "map end\n",
-      log_.str());
-}
-
-TEST_F(JsonParserTest, StackLimitExceededError_AtLimit) {
-  // Now with kStackLimit (300).
-  std::string json_limit = MakeNestedJson(300);
-  ParseJSON(GetTestPlatform(),
-            span<uint8_t>(reinterpret_cast<const uint8_t*>(json_limit.data()),
-                          json_limit.size()),
-            &log_);
-  EXPECT_TRUE(log_.status().ok());
-}
-
-TEST_F(JsonParserTest, StackLimitExceededError_AboveLimit) {
-  // Now with kStackLimit + 1 (301) - it exceeds in the innermost instance.
-  std::string exceeded = MakeNestedJson(301);
-  ParseJSON(GetTestPlatform(), SpanFrom(exceeded), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_STACK_LIMIT_EXCEEDED, log_.status().error);
-  EXPECT_EQ(strlen("{\"foo\":") * 301, log_.status().pos);
-}
-
-TEST_F(JsonParserTest, StackLimitExceededError_WayAboveLimit) {
-  // Now way past the limit. Still, the point of exceeding is 301.
-  std::string far_out = MakeNestedJson(320);
-  ParseJSON(GetTestPlatform(), SpanFrom(far_out), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_STACK_LIMIT_EXCEEDED, log_.status().error);
-  EXPECT_EQ(strlen("{\"foo\":") * 301, log_.status().pos);
-}
-
-TEST_F(JsonParserTest, NoInputError) {
-  std::string json = "";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_NO_INPUT, log_.status().error);
-  EXPECT_EQ(0u, log_.status().pos);
-  EXPECT_EQ("", log_.str());
-}
-
-TEST_F(JsonParserTest, InvalidTokenError) {
-  std::string json = "|";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_INVALID_TOKEN, log_.status().error);
-  EXPECT_EQ(0u, log_.status().pos);
-  EXPECT_EQ("", log_.str());
-}
-
-TEST_F(JsonParserTest, InvalidNumberError) {
-  // Mantissa exceeds max (the constant used here is int64_t max).
-  std::string json = "1E9223372036854775807";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_INVALID_NUMBER, log_.status().error);
-  EXPECT_EQ(0u, log_.status().pos);
-  EXPECT_EQ("", log_.str());
-}
-
-TEST_F(JsonParserTest, InvalidStringError) {
-  // \x22 is an unsupported escape sequence
-  std::string json = "\"foo\\x22\"";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_INVALID_STRING, log_.status().error);
-  EXPECT_EQ(0u, log_.status().pos);
-  EXPECT_EQ("", log_.str());
-}
-
-TEST_F(JsonParserTest, UnexpectedArrayEndError) {
-  std::string json = "[1,2,]";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_UNEXPECTED_ARRAY_END, log_.status().error);
-  EXPECT_EQ(5u, log_.status().pos);
-  EXPECT_EQ("", log_.str());
-}
-
-TEST_F(JsonParserTest, CommaOrArrayEndExpectedError) {
-  std::string json = "[1,2 2";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_COMMA_OR_ARRAY_END_EXPECTED,
-            log_.status().error);
-  EXPECT_EQ(5u, log_.status().pos);
-  EXPECT_EQ("", log_.str());
-}
-
-TEST_F(JsonParserTest, StringLiteralExpectedError) {
-  // There's an error because the key bar, a string, is not terminated.
-  std::string json = "{\"foo\": 3.1415, \"bar: 31415e-4}";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_STRING_LITERAL_EXPECTED, log_.status().error);
-  EXPECT_EQ(16u, log_.status().pos);
-  EXPECT_EQ("", log_.str());
-}
-
-TEST_F(JsonParserTest, ColonExpectedError) {
-  std::string json = "{\"foo\", 42}";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_COLON_EXPECTED, log_.status().error);
-  EXPECT_EQ(6u, log_.status().pos);
-  EXPECT_EQ("", log_.str());
-}
-
-TEST_F(JsonParserTest, UnexpectedMapEndError) {
-  std::string json = "{\"foo\": 42, }";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_UNEXPECTED_MAP_END, log_.status().error);
-  EXPECT_EQ(12u, log_.status().pos);
-  EXPECT_EQ("", log_.str());
-}
-
-TEST_F(JsonParserTest, CommaOrMapEndExpectedError) {
-  // The second separator should be a comma.
-  std::string json = "{\"foo\": 3.1415: \"bar\": 0}";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_COMMA_OR_MAP_END_EXPECTED, log_.status().error);
-  EXPECT_EQ(14u, log_.status().pos);
-  EXPECT_EQ("", log_.str());
-}
-
-TEST_F(JsonParserTest, ValueExpectedError) {
-  std::string json = "}";
-  ParseJSON(GetTestPlatform(), SpanFrom(json), &log_);
-  EXPECT_EQ(Error::JSON_PARSER_VALUE_EXPECTED, log_.status().error);
-  EXPECT_EQ(0u, log_.status().pos);
-  EXPECT_EQ("", log_.str());
-}
-
-template <typename T>
-class ConvertJSONToCBORTest : public ::testing::Test {};
-
-using ContainerTestTypes = ::testing::Types<std::vector<uint8_t>, std::string>;
-TYPED_TEST_SUITE(ConvertJSONToCBORTest, ContainerTestTypes);
-
-TYPED_TEST(ConvertJSONToCBORTest, RoundTripValidJson) {
-  std::string json_in = "{\"msg\":\"Hello, world.\",\"lst\":[1,2,3]}";
-  TypeParam json(json_in.begin(), json_in.end());
-  TypeParam cbor;
-  {
-    Status status = ConvertJSONToCBOR(GetTestPlatform(), SpanFrom(json), &cbor);
-    EXPECT_EQ(Error::OK, status.error);
-    EXPECT_EQ(Status::npos(), status.pos);
-  }
-  TypeParam roundtrip_json;
-  {
-    Status status =
-        ConvertCBORToJSON(GetTestPlatform(), SpanFrom(cbor), &roundtrip_json);
-    EXPECT_EQ(Error::OK, status.error);
-    EXPECT_EQ(Status::npos(), status.pos);
-  }
-  EXPECT_EQ(json, roundtrip_json);
-}
-
-TYPED_TEST(ConvertJSONToCBORTest, RoundTripValidJson16) {
-  std::vector<uint16_t> json16 = {
-      '{', '"', 'm', 's',    'g',    '"', ':', '"', 'H', 'e', 'l', 'l',
-      'o', ',', ' ', 0xd83c, 0xdf0e, '.', '"', ',', '"', 'l', 's', 't',
-      '"', ':', '[', '1',    ',',    '2', ',', '3', ']', '}'};
-  TypeParam cbor;
-  {
-    Status status = ConvertJSONToCBOR(
-        GetTestPlatform(), span<uint16_t>(json16.data(), json16.size()), &cbor);
-    EXPECT_EQ(Error::OK, status.error);
-    EXPECT_EQ(Status::npos(), status.pos);
-  }
-  TypeParam roundtrip_json;
-  {
-    Status status =
-        ConvertCBORToJSON(GetTestPlatform(), SpanFrom(cbor), &roundtrip_json);
-    EXPECT_EQ(Error::OK, status.error);
-    EXPECT_EQ(Status::npos(), status.pos);
-  }
-  std::string json = "{\"msg\":\"Hello, \\ud83c\\udf0e.\",\"lst\":[1,2,3]}";
-  TypeParam expected_json(json.begin(), json.end());
-  EXPECT_EQ(expected_json, roundtrip_json);
-}
-}  // namespace json
-}  // namespace v8_inspector_protocol_encoding
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/bindings/bindings.cc b/deps/v8/third_party/inspector_protocol/crdtp/export.h
similarity index 56%
rename from deps/v8/third_party/inspector_protocol/bindings/bindings.cc
rename to deps/v8/third_party/inspector_protocol/crdtp/export.h
index 7276805943c468..a97722e746d02c 100644
--- a/deps/v8/third_party/inspector_protocol/bindings/bindings.cc
+++ b/deps/v8/third_party/inspector_protocol/crdtp/export.h
@@ -2,4 +2,5 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "bindings.h"
+// This file is V8 specific. It's not rolled from the upstream project.
+// CRDTP doesn't export symbols from V8, so it's empty.
diff --git a/deps/v8/third_party/inspector_protocol/bindings/bindings.h b/deps/v8/third_party/inspector_protocol/crdtp/glue.h
similarity index 84%
rename from deps/v8/third_party/inspector_protocol/bindings/bindings.h
rename to deps/v8/third_party/inspector_protocol/crdtp/glue.h
index b24b59b0e18e37..359c355846c1a0 100644
--- a/deps/v8/third_party/inspector_protocol/bindings/bindings.h
+++ b/deps/v8/third_party/inspector_protocol/crdtp/glue.h
@@ -2,13 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_PROTOCOL_BINDINGS_BINDINGS_H_
-#define V8_INSPECTOR_PROTOCOL_BINDINGS_BINDINGS_H_
+#ifndef V8_CRDTP_GLUE_H_
+#define V8_CRDTP_GLUE_H_
 
 #include <cassert>
 #include <memory>
 
-namespace v8_inspector_protocol_bindings {
+namespace v8_crdtp {
 namespace glue {
 // =============================================================================
 // glue::detail::PtrMaybe, glue::detail::ValueMaybe, templates for optional
@@ -70,11 +70,11 @@ class ValueMaybe {
 };
 }  // namespace detail
 }  // namespace glue
-}  // namespace v8_inspector_protocol_bindings
+}  // namespace v8_crdtp
 
 #define PROTOCOL_DISALLOW_COPY(ClassName) \
-    private: \
-        ClassName(const ClassName&) = delete; \
-        ClassName& operator=(const ClassName&) = delete
+ private:                                 \
+  ClassName(const ClassName&) = delete;   \
+  ClassName& operator=(const ClassName&) = delete
 
-#endif  // V8_INSPECTOR_PROTOCOL_BINDINGS_BINDINGS_H_
+#endif  // V8_CRDTP_GLUE_H_
diff --git a/deps/v8/third_party/inspector_protocol/bindings/bindings_test.cc b/deps/v8/third_party/inspector_protocol/crdtp/glue_test.cc
similarity index 90%
rename from deps/v8/third_party/inspector_protocol/bindings/bindings_test.cc
rename to deps/v8/third_party/inspector_protocol/crdtp/glue_test.cc
index a39aa4d012d28f..95160352ca7482 100644
--- a/deps/v8/third_party/inspector_protocol/bindings/bindings_test.cc
+++ b/deps/v8/third_party/inspector_protocol/crdtp/glue_test.cc
@@ -2,14 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "bindings.h"
+#include "glue.h"
 
 #include <string>
 #include <vector>
 
-#include "bindings_test_helper.h"
+#include "test_platform.h"
 
-namespace v8_inspector_protocol_bindings {
+namespace v8_crdtp {
 namespace glue {
 // =============================================================================
 // glue::detail::PtrMaybe, glue::detail::ValueMaybe, templates for optional
@@ -41,4 +41,4 @@ TEST(PtrValueTest, SmokeTest) {
   EXPECT_EQ(out, 42);
 }
 }  // namespace glue
-}  // namespace v8_inspector_protocol_bindings
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/json.cc b/deps/v8/third_party/inspector_protocol/crdtp/json.cc
new file mode 100644
index 00000000000000..670195188179c7
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/json.cc
@@ -0,0 +1,1016 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "json.h"
+
+#include <algorithm>
+#include <cassert>
+#include <cmath>
+#include <cstring>
+#include <limits>
+#include <stack>
+
+#include "cbor.h"
+#include "json_platform.h"
+
+namespace v8_crdtp {
+namespace json {
+// =============================================================================
+// json::NewJSONEncoder - for encoding streaming parser events as JSON
+// =============================================================================
+
+namespace {
+// Prints |value| to |out| with 4 hex digits, most significant chunk first.
+template <typename C>
+void PrintHex(uint16_t value, C* out) {
+  for (int ii = 3; ii >= 0; --ii) {
+    int four_bits = 0xf & (value >> (4 * ii));
+    out->push_back(four_bits + ((four_bits <= 9) ? '0' : ('a' - 10)));
+  }
+}
+
+// In the writer below, we maintain a stack of State instances.
+// It is just enough to emit the appropriate delimiters and brackets
+// in JSON.
+enum class Container {
+  // Used for the top-level, initial state.
+  NONE,
+  // Inside a JSON object.
+  MAP,
+  // Inside a JSON array.
+  ARRAY
+};
+
+class State {
+ public:
+  explicit State(Container container) : container_(container) {}
+  void StartElement(std::vector<uint8_t>* out) { StartElementTmpl(out); }
+  void StartElement(std::string* out) { StartElementTmpl(out); }
+  Container container() const { return container_; }
+
+ private:
+  template <typename C>
+  void StartElementTmpl(C* out) {
+    assert(container_ != Container::NONE || size_ == 0);
+    if (size_ != 0) {
+      char delim = (!(size_ & 1) || container_ == Container::ARRAY) ? ',' : ':';
+      out->push_back(delim);
+    }
+    ++size_;
+  }
+
+  Container container_ = Container::NONE;
+  int size_ = 0;
+};
+
+constexpr char kBase64Table[] =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+    "abcdefghijklmnopqrstuvwxyz0123456789+/";
+
+template <typename C>
+void Base64Encode(const span<uint8_t>& in, C* out) {
+  // The following three cases are based on the tables in the example
+  // section in https://en.wikipedia.org/wiki/Base64. We process three
+  // input bytes at a time, emitting 4 output bytes at a time.
+  size_t ii = 0;
+
+  // While possible, process three input bytes.
+  for (; ii + 3 <= in.size(); ii += 3) {
+    uint32_t twentyfour_bits = (in[ii] << 16) | (in[ii + 1] << 8) | in[ii + 2];
+    out->push_back(kBase64Table[(twentyfour_bits >> 18)]);
+    out->push_back(kBase64Table[(twentyfour_bits >> 12) & 0x3f]);
+    out->push_back(kBase64Table[(twentyfour_bits >> 6) & 0x3f]);
+    out->push_back(kBase64Table[twentyfour_bits & 0x3f]);
+  }
+  if (ii + 2 <= in.size()) {  // Process two input bytes.
+    uint32_t twentyfour_bits = (in[ii] << 16) | (in[ii + 1] << 8);
+    out->push_back(kBase64Table[(twentyfour_bits >> 18)]);
+    out->push_back(kBase64Table[(twentyfour_bits >> 12) & 0x3f]);
+    out->push_back(kBase64Table[(twentyfour_bits >> 6) & 0x3f]);
+    out->push_back('=');  // Emit padding.
+    return;
+  }
+  if (ii + 1 <= in.size()) {  // Process a single input byte.
+    uint32_t twentyfour_bits = (in[ii] << 16);
+    out->push_back(kBase64Table[(twentyfour_bits >> 18)]);
+    out->push_back(kBase64Table[(twentyfour_bits >> 12) & 0x3f]);
+    out->push_back('=');  // Emit padding.
+    out->push_back('=');  // Emit padding.
+  }
+}
+
+// Implements a handler for JSON parser events to emit a JSON string.
+template <typename C>
+class JSONEncoder : public ParserHandler {
+ public:
+  JSONEncoder(C* out, Status* status) : out_(out), status_(status) {
+    *status_ = Status();
+    state_.emplace(Container::NONE);
+  }
+
+  void HandleMapBegin() override {
+    if (!status_->ok())
+      return;
+    assert(!state_.empty());
+    state_.top().StartElement(out_);
+    state_.emplace(Container::MAP);
+    Emit('{');
+  }
+
+  void HandleMapEnd() override {
+    if (!status_->ok())
+      return;
+    assert(state_.size() >= 2 && state_.top().container() == Container::MAP);
+    state_.pop();
+    Emit('}');
+  }
+
+  void HandleArrayBegin() override {
+    if (!status_->ok())
+      return;
+    state_.top().StartElement(out_);
+    state_.emplace(Container::ARRAY);
+    Emit('[');
+  }
+
+  void HandleArrayEnd() override {
+    if (!status_->ok())
+      return;
+    assert(state_.size() >= 2 && state_.top().container() == Container::ARRAY);
+    state_.pop();
+    Emit(']');
+  }
+
+  void HandleString16(span<uint16_t> chars) override {
+    if (!status_->ok())
+      return;
+    state_.top().StartElement(out_);
+    Emit('"');
+    for (const uint16_t ch : chars) {
+      if (ch == '"') {
+        Emit("\\\"");
+      } else if (ch == '\\') {
+        Emit("\\\\");
+      } else if (ch == '\b') {
+        Emit("\\b");
+      } else if (ch == '\f') {
+        Emit("\\f");
+      } else if (ch == '\n') {
+        Emit("\\n");
+      } else if (ch == '\r') {
+        Emit("\\r");
+      } else if (ch == '\t') {
+        Emit("\\t");
+      } else if (ch >= 32 && ch <= 126) {
+        Emit(ch);
+      } else {
+        Emit("\\u");
+        PrintHex(ch, out_);
+      }
+    }
+    Emit('"');
+  }
+
+  void HandleString8(span<uint8_t> chars) override {
+    if (!status_->ok())
+      return;
+    state_.top().StartElement(out_);
+    Emit('"');
+    for (size_t ii = 0; ii < chars.size(); ++ii) {
+      uint8_t c = chars[ii];
+      if (c == '"') {
+        Emit("\\\"");
+      } else if (c == '\\') {
+        Emit("\\\\");
+      } else if (c == '\b') {
+        Emit("\\b");
+      } else if (c == '\f') {
+        Emit("\\f");
+      } else if (c == '\n') {
+        Emit("\\n");
+      } else if (c == '\r') {
+        Emit("\\r");
+      } else if (c == '\t') {
+        Emit("\\t");
+      } else if (c >= 32 && c <= 126) {
+        Emit(c);
+      } else if (c < 32) {
+        Emit("\\u");
+        PrintHex(static_cast<uint16_t>(c), out_);
+      } else {
+        // Inspect the leading byte to figure out how long the utf8
+        // byte sequence is; while doing this initialize |codepoint|
+        // with the first few bits.
+        // See table in: https://en.wikipedia.org/wiki/UTF-8
+        // byte one is 110x xxxx -> 2 byte utf8 sequence
+        // byte one is 1110 xxxx -> 3 byte utf8 sequence
+        // byte one is 1111 0xxx -> 4 byte utf8 sequence
+        uint32_t codepoint;
+        int num_bytes_left;
+        if ((c & 0xe0) == 0xc0) {  // 2 byte utf8 sequence
+          num_bytes_left = 1;
+          codepoint = c & 0x1f;
+        } else if ((c & 0xf0) == 0xe0) {  // 3 byte utf8 sequence
+          num_bytes_left = 2;
+          codepoint = c & 0x0f;
+        } else if ((c & 0xf8) == 0xf0) {  // 4 byte utf8 sequence
+          codepoint = c & 0x07;
+          num_bytes_left = 3;
+        } else {
+          continue;  // invalid leading byte
+        }
+
+        // If we have enough bytes in our input, decode the remaining ones
+        // belonging to this Unicode character into |codepoint|.
+        if (ii + num_bytes_left >= chars.size())
+          continue;
+        bool invalid_byte_seen = false;
+        while (num_bytes_left > 0) {
+          c = chars[++ii];
+          --num_bytes_left;
+          // Check the next byte is a continuation byte, that is 10xx xxxx.
+          if ((c & 0xc0) != 0x80)
+            invalid_byte_seen = true;
+          codepoint = (codepoint << 6) | (c & 0x3f);
+        }
+        if (invalid_byte_seen)
+          continue;
+
+        // Disallow overlong encodings for ascii characters, as these
+        // would include " and other characters significant to JSON
+        // string termination / control.
+        if (codepoint <= 0x7f)
+          continue;
+        // Invalid in UTF8, and can't be represented in UTF16 anyway.
+        if (codepoint > 0x10ffff)
+          continue;
+
+        // So, now we transcode to UTF16,
+        // using the math described at https://en.wikipedia.org/wiki/UTF-16,
+        // for either one or two 16 bit characters.
+        if (codepoint <= 0xffff) {
+          Emit("\\u");
+          PrintHex(static_cast<uint16_t>(codepoint), out_);
+          continue;
+        }
+        codepoint -= 0x10000;
+        // high surrogate
+        Emit("\\u");
+        PrintHex(static_cast<uint16_t>((codepoint >> 10) + 0xd800), out_);
+        // low surrogate
+        Emit("\\u");
+        PrintHex(static_cast<uint16_t>((codepoint & 0x3ff) + 0xdc00), out_);
+      }
+    }
+    Emit('"');
+  }
+
+  void HandleBinary(span<uint8_t> bytes) override {
+    if (!status_->ok())
+      return;
+    state_.top().StartElement(out_);
+    Emit('"');
+    Base64Encode(bytes, out_);
+    Emit('"');
+  }
+
+  void HandleDouble(double value) override {
+    if (!status_->ok())
+      return;
+    state_.top().StartElement(out_);
+    // JSON cannot represent NaN or Infinity. So, for compatibility,
+    // we behave like the JSON object in web browsers: emit 'null'.
+    if (!std::isfinite(value)) {
+      Emit("null");
+      return;
+    }
+    std::string str_value = json::platform::DToStr(value);
+
+    // DToStr may fail to emit a 0 before the decimal dot. E.g. this is
+    // the case in base::NumberToString in Chromium (which is based on
+    // dmg_fp). So, much like
+    // https://cs.chromium.org/chromium/src/base/json/json_writer.cc
+    // we probe for this and emit the leading 0 anyway if necessary.
+    const char* chars = str_value.c_str();
+    if (chars[0] == '.') {
+      Emit('0');
+    } else if (chars[0] == '-' && chars[1] == '.') {
+      Emit("-0");
+      ++chars;
+    }
+    Emit(chars);
+  }
+
+  void HandleInt32(int32_t value) override {
+    if (!status_->ok())
+      return;
+    state_.top().StartElement(out_);
+    Emit(std::to_string(value));
+  }
+
+  void HandleBool(bool value) override {
+    if (!status_->ok())
+      return;
+    state_.top().StartElement(out_);
+    Emit(value ? "true" : "false");
+  }
+
+  void HandleNull() override {
+    if (!status_->ok())
+      return;
+    state_.top().StartElement(out_);
+    Emit("null");
+  }
+
+  void HandleError(Status error) override {
+    assert(!error.ok());
+    *status_ = error;
+    out_->clear();
+  }
+
+ private:
+  void Emit(char c) { out_->push_back(c); }
+  void Emit(const char* str) {
+    out_->insert(out_->end(), str, str + strlen(str));
+  }
+  void Emit(const std::string& str) {
+    out_->insert(out_->end(), str.begin(), str.end());
+  }
+
+  C* out_;
+  Status* status_;
+  std::stack<State> state_;
+};
+}  // namespace
+
+std::unique_ptr<ParserHandler> NewJSONEncoder(std::vector<uint8_t>* out,
+                                              Status* status) {
+  return std::unique_ptr<ParserHandler>(
+      new JSONEncoder<std::vector<uint8_t>>(out, status));
+}
+
+std::unique_ptr<ParserHandler> NewJSONEncoder(std::string* out,
+                                              Status* status) {
+  return std::unique_ptr<ParserHandler>(
+      new JSONEncoder<std::string>(out, status));
+}
+
+// =============================================================================
+// json::ParseJSON - for receiving streaming parser events for JSON.
+// =============================================================================
+
+namespace {
+const int kStackLimit = 300;
+
+enum Token {
+  ObjectBegin,
+  ObjectEnd,
+  ArrayBegin,
+  ArrayEnd,
+  StringLiteral,
+  Number,
+  BoolTrue,
+  BoolFalse,
+  NullToken,
+  ListSeparator,
+  ObjectPairSeparator,
+  InvalidToken,
+  NoInput
+};
+
+const char* const kNullString = "null";
+const char* const kTrueString = "true";
+const char* const kFalseString = "false";
+
+template <typename Char>
+class JsonParser {
+ public:
+  explicit JsonParser(ParserHandler* handler) : handler_(handler) {}
+
+  void Parse(const Char* start, size_t length) {
+    start_pos_ = start;
+    const Char* end = start + length;
+    const Char* tokenEnd = nullptr;
+    ParseValue(start, end, &tokenEnd, 0);
+    if (error_)
+      return;
+    if (tokenEnd != end) {
+      HandleError(Error::JSON_PARSER_UNPROCESSED_INPUT_REMAINS, tokenEnd);
+    }
+  }
+
+ private:
+  bool CharsToDouble(const uint16_t* chars, size_t length, double* result) {
+    std::string buffer;
+    buffer.reserve(length + 1);
+    for (size_t ii = 0; ii < length; ++ii) {
+      bool is_ascii = !(chars[ii] & ~0x7F);
+      if (!is_ascii)
+        return false;
+      buffer.push_back(static_cast<char>(chars[ii]));
+    }
+    return platform::StrToD(buffer.c_str(), result);
+  }
+
+  bool CharsToDouble(const uint8_t* chars, size_t length, double* result) {
+    std::string buffer(reinterpret_cast<const char*>(chars), length);
+    return platform::StrToD(buffer.c_str(), result);
+  }
+
+  static bool ParseConstToken(const Char* start,
+                              const Char* end,
+                              const Char** token_end,
+                              const char* token) {
+    // |token| is \0 terminated, it's one of the constants at top of the file.
+    while (start < end && *token != '\0' && *start++ == *token++) {
+    }
+    if (*token != '\0')
+      return false;
+    *token_end = start;
+    return true;
+  }
+
+  static bool ReadInt(const Char* start,
+                      const Char* end,
+                      const Char** token_end,
+                      bool allow_leading_zeros) {
+    if (start == end)
+      return false;
+    bool has_leading_zero = '0' == *start;
+    int length = 0;
+    while (start < end && '0' <= *start && *start <= '9') {
+      ++start;
+      ++length;
+    }
+    if (!length)
+      return false;
+    if (!allow_leading_zeros && length > 1 && has_leading_zero)
+      return false;
+    *token_end = start;
+    return true;
+  }
+
+  static bool ParseNumberToken(const Char* start,
+                               const Char* end,
+                               const Char** token_end) {
+    // We just grab the number here. We validate the size in DecodeNumber.
+    // According to RFC4627, a valid number is: [minus] int [frac] [exp]
+    if (start == end)
+      return false;
+    Char c = *start;
+    if ('-' == c)
+      ++start;
+
+    if (!ReadInt(start, end, &start, /*allow_leading_zeros=*/false))
+      return false;
+    if (start == end) {
+      *token_end = start;
+      return true;
+    }
+
+    // Optional fraction part
+    c = *start;
+    if ('.' == c) {
+      ++start;
+      if (!ReadInt(start, end, &start, /*allow_leading_zeros=*/true))
+        return false;
+      if (start == end) {
+        *token_end = start;
+        return true;
+      }
+      c = *start;
+    }
+
+    // Optional exponent part
+    if ('e' == c || 'E' == c) {
+      ++start;
+      if (start == end)
+        return false;
+      c = *start;
+      if ('-' == c || '+' == c) {
+        ++start;
+        if (start == end)
+          return false;
+      }
+      if (!ReadInt(start, end, &start, /*allow_leading_zeros=*/true))
+        return false;
+    }
+
+    *token_end = start;
+    return true;
+  }
+
+  static bool ReadHexDigits(const Char* start,
+                            const Char* end,
+                            const Char** token_end,
+                            int digits) {
+    if (end - start < digits)
+      return false;
+    for (int i = 0; i < digits; ++i) {
+      Char c = *start++;
+      if (!(('0' <= c && c <= '9') || ('a' <= c && c <= 'f') ||
+            ('A' <= c && c <= 'F')))
+        return false;
+    }
+    *token_end = start;
+    return true;
+  }
+
+  static bool ParseStringToken(const Char* start,
+                               const Char* end,
+                               const Char** token_end) {
+    while (start < end) {
+      Char c = *start++;
+      if ('\\' == c) {
+        if (start == end)
+          return false;
+        c = *start++;
+        // Make sure the escaped char is valid.
+        switch (c) {
+          case 'x':
+            if (!ReadHexDigits(start, end, &start, 2))
+              return false;
+            break;
+          case 'u':
+            if (!ReadHexDigits(start, end, &start, 4))
+              return false;
+            break;
+          case '\\':
+          case '/':
+          case 'b':
+          case 'f':
+          case 'n':
+          case 'r':
+          case 't':
+          case 'v':
+          case '"':
+            break;
+          default:
+            return false;
+        }
+      } else if ('"' == c) {
+        *token_end = start;
+        return true;
+      }
+    }
+    return false;
+  }
+
+  static bool SkipComment(const Char* start,
+                          const Char* end,
+                          const Char** comment_end) {
+    if (start == end)
+      return false;
+
+    if (*start != '/' || start + 1 >= end)
+      return false;
+    ++start;
+
+    if (*start == '/') {
+      // Single line comment, read to newline.
+      for (++start; start < end; ++start) {
+        if (*start == '\n' || *start == '\r') {
+          *comment_end = start + 1;
+          return true;
+        }
+      }
+      *comment_end = end;
+      // Comment reaches end-of-input, which is fine.
+      return true;
+    }
+
+    if (*start == '*') {
+      Char previous = '\0';
+      // Block comment, read until end marker.
+      for (++start; start < end; previous = *start++) {
+        if (previous == '*' && *start == '/') {
+          *comment_end = start + 1;
+          return true;
+        }
+      }
+      // Block comment must close before end-of-input.
+      return false;
+    }
+
+    return false;
+  }
+
+  static bool IsSpaceOrNewLine(Char c) {
+    // \v = vertial tab; \f = form feed page break.
+    return c == ' ' || c == '\n' || c == '\v' || c == '\f' || c == '\r' ||
+           c == '\t';
+  }
+
+  static void SkipWhitespaceAndComments(const Char* start,
+                                        const Char* end,
+                                        const Char** whitespace_end) {
+    while (start < end) {
+      if (IsSpaceOrNewLine(*start)) {
+        ++start;
+      } else if (*start == '/') {
+        const Char* comment_end = nullptr;
+        if (!SkipComment(start, end, &comment_end))
+          break;
+        start = comment_end;
+      } else {
+        break;
+      }
+    }
+    *whitespace_end = start;
+  }
+
+  static Token ParseToken(const Char* start,
+                          const Char* end,
+                          const Char** tokenStart,
+                          const Char** token_end) {
+    SkipWhitespaceAndComments(start, end, tokenStart);
+    start = *tokenStart;
+
+    if (start == end)
+      return NoInput;
+
+    switch (*start) {
+      case 'n':
+        if (ParseConstToken(start, end, token_end, kNullString))
+          return NullToken;
+        break;
+      case 't':
+        if (ParseConstToken(start, end, token_end, kTrueString))
+          return BoolTrue;
+        break;
+      case 'f':
+        if (ParseConstToken(start, end, token_end, kFalseString))
+          return BoolFalse;
+        break;
+      case '[':
+        *token_end = start + 1;
+        return ArrayBegin;
+      case ']':
+        *token_end = start + 1;
+        return ArrayEnd;
+      case ',':
+        *token_end = start + 1;
+        return ListSeparator;
+      case '{':
+        *token_end = start + 1;
+        return ObjectBegin;
+      case '}':
+        *token_end = start + 1;
+        return ObjectEnd;
+      case ':':
+        *token_end = start + 1;
+        return ObjectPairSeparator;
+      case '0':
+      case '1':
+      case '2':
+      case '3':
+      case '4':
+      case '5':
+      case '6':
+      case '7':
+      case '8':
+      case '9':
+      case '-':
+        if (ParseNumberToken(start, end, token_end))
+          return Number;
+        break;
+      case '"':
+        if (ParseStringToken(start + 1, end, token_end))
+          return StringLiteral;
+        break;
+    }
+    return InvalidToken;
+  }
+
+  static int HexToInt(Char c) {
+    if ('0' <= c && c <= '9')
+      return c - '0';
+    if ('A' <= c && c <= 'F')
+      return c - 'A' + 10;
+    if ('a' <= c && c <= 'f')
+      return c - 'a' + 10;
+    assert(false);  // Unreachable.
+    return 0;
+  }
+
+  static bool DecodeString(const Char* start,
+                           const Char* end,
+                           std::vector<uint16_t>* output) {
+    if (start == end)
+      return true;
+    if (start > end)
+      return false;
+    output->reserve(end - start);
+    while (start < end) {
+      uint16_t c = *start++;
+      // If the |Char| we're dealing with is really a byte, then
+      // we have utf8 here, and we need to check for multibyte characters
+      // and transcode them to utf16 (either one or two utf16 chars).
+      if (sizeof(Char) == sizeof(uint8_t) && c > 0x7f) {
+        // Inspect the leading byte to figure out how long the utf8
+        // byte sequence is; while doing this initialize |codepoint|
+        // with the first few bits.
+        // See table in: https://en.wikipedia.org/wiki/UTF-8
+        // byte one is 110x xxxx -> 2 byte utf8 sequence
+        // byte one is 1110 xxxx -> 3 byte utf8 sequence
+        // byte one is 1111 0xxx -> 4 byte utf8 sequence
+        uint32_t codepoint;
+        int num_bytes_left;
+        if ((c & 0xe0) == 0xc0) {  // 2 byte utf8 sequence
+          num_bytes_left = 1;
+          codepoint = c & 0x1f;
+        } else if ((c & 0xf0) == 0xe0) {  // 3 byte utf8 sequence
+          num_bytes_left = 2;
+          codepoint = c & 0x0f;
+        } else if ((c & 0xf8) == 0xf0) {  // 4 byte utf8 sequence
+          codepoint = c & 0x07;
+          num_bytes_left = 3;
+        } else {
+          return false;  // invalid leading byte
+        }
+
+        // If we have enough bytes in our inpput, decode the remaining ones
+        // belonging to this Unicode character into |codepoint|.
+        if (start + num_bytes_left > end)
+          return false;
+        while (num_bytes_left > 0) {
+          c = *start++;
+          --num_bytes_left;
+          // Check the next byte is a continuation byte, that is 10xx xxxx.
+          if ((c & 0xc0) != 0x80)
+            return false;
+          codepoint = (codepoint << 6) | (c & 0x3f);
+        }
+
+        // Disallow overlong encodings for ascii characters, as these
+        // would include " and other characters significant to JSON
+        // string termination / control.
+        if (codepoint <= 0x7f)
+          return false;
+        // Invalid in UTF8, and can't be represented in UTF16 anyway.
+        if (codepoint > 0x10ffff)
+          return false;
+
+        // So, now we transcode to UTF16,
+        // using the math described at https://en.wikipedia.org/wiki/UTF-16,
+        // for either one or two 16 bit characters.
+        if (codepoint <= 0xffff) {
+          output->push_back(codepoint);
+          continue;
+        }
+        codepoint -= 0x10000;
+        output->push_back((codepoint >> 10) + 0xd800);    // high surrogate
+        output->push_back((codepoint & 0x3ff) + 0xdc00);  // low surrogate
+        continue;
+      }
+      if ('\\' != c) {
+        output->push_back(c);
+        continue;
+      }
+      if (start == end)
+        return false;
+      c = *start++;
+
+      if (c == 'x') {
+        // \x is not supported.
+        return false;
+      }
+
+      switch (c) {
+        case '"':
+        case '/':
+        case '\\':
+          break;
+        case 'b':
+          c = '\b';
+          break;
+        case 'f':
+          c = '\f';
+          break;
+        case 'n':
+          c = '\n';
+          break;
+        case 'r':
+          c = '\r';
+          break;
+        case 't':
+          c = '\t';
+          break;
+        case 'v':
+          c = '\v';
+          break;
+        case 'u':
+          c = (HexToInt(*start) << 12) + (HexToInt(*(start + 1)) << 8) +
+              (HexToInt(*(start + 2)) << 4) + HexToInt(*(start + 3));
+          start += 4;
+          break;
+        default:
+          return false;
+      }
+      output->push_back(c);
+    }
+    return true;
+  }
+
+  void ParseValue(const Char* start,
+                  const Char* end,
+                  const Char** value_token_end,
+                  int depth) {
+    if (depth > kStackLimit) {
+      HandleError(Error::JSON_PARSER_STACK_LIMIT_EXCEEDED, start);
+      return;
+    }
+    const Char* token_start = nullptr;
+    const Char* token_end = nullptr;
+    Token token = ParseToken(start, end, &token_start, &token_end);
+    switch (token) {
+      case NoInput:
+        HandleError(Error::JSON_PARSER_NO_INPUT, token_start);
+        return;
+      case InvalidToken:
+        HandleError(Error::JSON_PARSER_INVALID_TOKEN, token_start);
+        return;
+      case NullToken:
+        handler_->HandleNull();
+        break;
+      case BoolTrue:
+        handler_->HandleBool(true);
+        break;
+      case BoolFalse:
+        handler_->HandleBool(false);
+        break;
+      case Number: {
+        double value;
+        if (!CharsToDouble(token_start, token_end - token_start, &value)) {
+          HandleError(Error::JSON_PARSER_INVALID_NUMBER, token_start);
+          return;
+        }
+        if (value >= std::numeric_limits<int32_t>::min() &&
+            value <= std::numeric_limits<int32_t>::max() &&
+            static_cast<int32_t>(value) == value)
+          handler_->HandleInt32(static_cast<int32_t>(value));
+        else
+          handler_->HandleDouble(value);
+        break;
+      }
+      case StringLiteral: {
+        std::vector<uint16_t> value;
+        bool ok = DecodeString(token_start + 1, token_end - 1, &value);
+        if (!ok) {
+          HandleError(Error::JSON_PARSER_INVALID_STRING, token_start);
+          return;
+        }
+        handler_->HandleString16(span<uint16_t>(value.data(), value.size()));
+        break;
+      }
+      case ArrayBegin: {
+        handler_->HandleArrayBegin();
+        start = token_end;
+        token = ParseToken(start, end, &token_start, &token_end);
+        while (token != ArrayEnd) {
+          ParseValue(start, end, &token_end, depth + 1);
+          if (error_)
+            return;
+
+          // After a list value, we expect a comma or the end of the list.
+          start = token_end;
+          token = ParseToken(start, end, &token_start, &token_end);
+          if (token == ListSeparator) {
+            start = token_end;
+            token = ParseToken(start, end, &token_start, &token_end);
+            if (token == ArrayEnd) {
+              HandleError(Error::JSON_PARSER_UNEXPECTED_ARRAY_END, token_start);
+              return;
+            }
+          } else if (token != ArrayEnd) {
+            // Unexpected value after list value. Bail out.
+            HandleError(Error::JSON_PARSER_COMMA_OR_ARRAY_END_EXPECTED,
+                        token_start);
+            return;
+          }
+        }
+        handler_->HandleArrayEnd();
+        break;
+      }
+      case ObjectBegin: {
+        handler_->HandleMapBegin();
+        start = token_end;
+        token = ParseToken(start, end, &token_start, &token_end);
+        while (token != ObjectEnd) {
+          if (token != StringLiteral) {
+            HandleError(Error::JSON_PARSER_STRING_LITERAL_EXPECTED,
+                        token_start);
+            return;
+          }
+          std::vector<uint16_t> key;
+          if (!DecodeString(token_start + 1, token_end - 1, &key)) {
+            HandleError(Error::JSON_PARSER_INVALID_STRING, token_start);
+            return;
+          }
+          handler_->HandleString16(span<uint16_t>(key.data(), key.size()));
+          start = token_end;
+
+          token = ParseToken(start, end, &token_start, &token_end);
+          if (token != ObjectPairSeparator) {
+            HandleError(Error::JSON_PARSER_COLON_EXPECTED, token_start);
+            return;
+          }
+          start = token_end;
+
+          ParseValue(start, end, &token_end, depth + 1);
+          if (error_)
+            return;
+          start = token_end;
+
+          // After a key/value pair, we expect a comma or the end of the
+          // object.
+          token = ParseToken(start, end, &token_start, &token_end);
+          if (token == ListSeparator) {
+            start = token_end;
+            token = ParseToken(start, end, &token_start, &token_end);
+            if (token == ObjectEnd) {
+              HandleError(Error::JSON_PARSER_UNEXPECTED_MAP_END, token_start);
+              return;
+            }
+          } else if (token != ObjectEnd) {
+            // Unexpected value after last object value. Bail out.
+            HandleError(Error::JSON_PARSER_COMMA_OR_MAP_END_EXPECTED,
+                        token_start);
+            return;
+          }
+        }
+        handler_->HandleMapEnd();
+        break;
+      }
+
+      default:
+        // We got a token that's not a value.
+        HandleError(Error::JSON_PARSER_VALUE_EXPECTED, token_start);
+        return;
+    }
+
+    SkipWhitespaceAndComments(token_end, end, value_token_end);
+  }
+
+  void HandleError(Error error, const Char* pos) {
+    assert(error != Error::OK);
+    if (!error_) {
+      handler_->HandleError(
+          Status{error, static_cast<size_t>(pos - start_pos_)});
+      error_ = true;
+    }
+  }
+
+  const Char* start_pos_ = nullptr;
+  bool error_ = false;
+  ParserHandler* handler_;
+};
+}  // namespace
+
+void ParseJSON(span<uint8_t> chars, ParserHandler* handler) {
+  JsonParser<uint8_t> parser(handler);
+  parser.Parse(chars.data(), chars.size());
+}
+
+void ParseJSON(span<uint16_t> chars, ParserHandler* handler) {
+  JsonParser<uint16_t> parser(handler);
+  parser.Parse(chars.data(), chars.size());
+}
+
+// =============================================================================
+// json::ConvertCBORToJSON, json::ConvertJSONToCBOR - for transcoding
+// =============================================================================
+template <typename C>
+Status ConvertCBORToJSONTmpl(span<uint8_t> cbor, C* json) {
+  Status status;
+  std::unique_ptr<ParserHandler> json_writer = NewJSONEncoder(json, &status);
+  cbor::ParseCBOR(cbor, json_writer.get());
+  return status;
+}
+
+Status ConvertCBORToJSON(span<uint8_t> cbor, std::vector<uint8_t>* json) {
+  return ConvertCBORToJSONTmpl(cbor, json);
+}
+
+Status ConvertCBORToJSON(span<uint8_t> cbor, std::string* json) {
+  return ConvertCBORToJSONTmpl(cbor, json);
+}
+
+template <typename T>
+Status ConvertJSONToCBORTmpl(span<T> json, std::vector<uint8_t>* cbor) {
+  Status status;
+  std::unique_ptr<ParserHandler> encoder = cbor::NewCBOREncoder(cbor, &status);
+  ParseJSON(json, encoder.get());
+  return status;
+}
+
+Status ConvertJSONToCBOR(span<uint8_t> json, std::vector<uint8_t>* cbor) {
+  return ConvertJSONToCBORTmpl(json, cbor);
+}
+
+Status ConvertJSONToCBOR(span<uint16_t> json, std::vector<uint8_t>* cbor) {
+  return ConvertJSONToCBORTmpl(json, cbor);
+}
+}  // namespace json
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/json.h b/deps/v8/third_party/inspector_protocol/crdtp/json.h
new file mode 100644
index 00000000000000..fa8522771f70cd
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/json.h
@@ -0,0 +1,51 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_CRDTP_JSON_H_
+#define V8_CRDTP_JSON_H_
+
+#include <memory>
+#include "export.h"
+#include "parser_handler.h"
+
+namespace v8_crdtp {
+namespace json {
+// =============================================================================
+// json::NewJSONEncoder - for encoding streaming parser events as JSON
+// =============================================================================
+
+// Returns a handler object which will write ascii characters to |out|.
+// |status->ok()| will be false iff the handler routine HandleError() is called.
+// In that case, we'll stop emitting output.
+// Except for calling the HandleError routine at any time, the client
+// code must call the Handle* methods in an order in which they'd occur
+// in valid JSON; otherwise we may crash (the code uses assert).
+std::unique_ptr<ParserHandler> NewJSONEncoder(std::vector<uint8_t>* out,
+                                              Status* status);
+
+std::unique_ptr<ParserHandler> NewJSONEncoder(std::string* out, Status* status);
+
+// =============================================================================
+// json::ParseJSON - for receiving streaming parser events for JSON
+// =============================================================================
+
+void ParseJSON(span<uint8_t> chars, ParserHandler* handler);
+
+void ParseJSON(span<uint16_t> chars, ParserHandler* handler);
+
+// =============================================================================
+// json::ConvertCBORToJSON, json::ConvertJSONToCBOR - for transcoding
+// =============================================================================
+
+Status ConvertCBORToJSON(span<uint8_t> cbor, std::string* json);
+
+Status ConvertCBORToJSON(span<uint8_t> cbor, std::vector<uint8_t>* json);
+
+Status ConvertJSONToCBOR(span<uint8_t> json, std::vector<uint8_t>* cbor);
+
+Status ConvertJSONToCBOR(span<uint16_t> json, std::vector<uint8_t>* cbor);
+}  // namespace json
+}  // namespace v8_crdtp
+
+#endif  // V8_CRDTP_JSON_H_
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/json_platform.h b/deps/v8/third_party/inspector_protocol/crdtp/json_platform.h
new file mode 100644
index 00000000000000..5a3be592855634
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/json_platform.h
@@ -0,0 +1,26 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_CRDTP_JSON_PLATFORM_H_
+#define V8_CRDTP_JSON_PLATFORM_H_
+
+#include <string>
+
+namespace v8_crdtp {
+namespace json {
+// These routines are implemented in json_platform.cc, or in a
+// platform-dependent (code-base dependent) custom replacement.
+// E.g., json_platform_chromium.cc, json_platform_v8.cc.
+namespace platform {
+// Parses |str| into |result|. Returns false iff there are
+// leftover characters or parsing errors.
+bool StrToD(const char* str, double* result);
+
+// Prints |value| in a format suitable for JSON.
+std::string DToStr(double value);
+}  // namespace platform
+}  // namespace json
+}  // namespace v8_crdtp
+
+#endif  // V8_CRDTP_JSON_PLATFORM_H_
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/json_platform_v8.cc b/deps/v8/third_party/inspector_protocol/crdtp/json_platform_v8.cc
new file mode 100644
index 00000000000000..97f80b4fc595ad
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/json_platform_v8.cc
@@ -0,0 +1,32 @@
+// Copyright 2019 The V8 Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This file is V8 specific. It's not rolled from the upstream project.
+
+#include "json_platform.h"
+
+#include <cmath>
+#include "../../../src/numbers/conversions.h"
+#include "../../../src/utils/vector.h"
+
+namespace v8_crdtp {
+namespace json {
+namespace platform {
+// Parses |str| into |result|. Returns false iff there are
+// leftover characters or parsing errors.
+bool StrToD(const char* str, double* result) {
+  *result = v8::internal::StringToDouble(str, v8::internal::NO_FLAGS);
+  return std::isfinite(*result);
+}
+
+// Prints |value| in a format suitable for JSON.
+std::string DToStr(double value) {
+  v8::internal::ScopedVector<char> buffer(
+      v8::internal::kDoubleToCStringMinBufferSize);
+  const char* str = v8::internal::DoubleToCString(value, buffer);
+  return (str == nullptr) ? "" : std::string(str);
+}
+}  // namespace platform
+}  // namespace json
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/json_test.cc b/deps/v8/third_party/inspector_protocol/crdtp/json_test.cc
new file mode 100644
index 00000000000000..d8742463debcfd
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/json_test.cc
@@ -0,0 +1,703 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "json.h"
+
+#include <array>
+#include <clocale>
+#include <cmath>
+#include <cstdlib>
+#include <cstring>
+#include <iomanip>
+#include <iostream>
+#include <sstream>
+#include <string>
+
+#include "cbor.h"
+#include "parser_handler.h"
+#include "span.h"
+#include "status.h"
+#include "status_test_support.h"
+#include "test_platform.h"
+
+namespace v8_crdtp {
+namespace json {
+// =============================================================================
+// json::NewJSONEncoder - for encoding streaming parser events as JSON
+// =============================================================================
+
+void WriteUTF8AsUTF16(ParserHandler* writer, const std::string& utf8) {
+  writer->HandleString16(SpanFrom(UTF8ToUTF16(SpanFrom(utf8))));
+}
+
+TEST(JsonEncoder, OverlongEncodings) {
+  std::string out;
+  Status status;
+  std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+
+  // We encode 0x7f, which is the DEL ascii character, as a 4 byte UTF8
+  // sequence. This is called an overlong encoding, because only 1 byte
+  // is needed to represent 0x7f as UTF8.
+  std::vector<uint8_t> chars = {
+      0xf0,  // Starts 4 byte utf8 sequence
+      0x80,  // continuation byte
+      0x81,  // continuation byte w/ payload bit 7 set to 1.
+      0xbf,  // continuation byte w/ payload bits 0-6 set to 11111.
+  };
+  writer->HandleString8(SpanFrom(chars));
+  EXPECT_EQ("\"\"", out);  // Empty string means that 0x7f was rejected (good).
+}
+
+TEST(JsonEncoder, NotAContinuationByte) {
+  std::string out;
+  Status status;
+  std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+
+  // |world| encodes the globe as a 4 byte UTF8 sequence. So, naturally, it'll
+  // have a start byte, followed by three continuation bytes.
+  std::string world = "🌎";
+  ASSERT_EQ(4u, world.size());
+  ASSERT_EQ(world[1] & 0xc0, 0x80);  // checks for continuation byte
+  ASSERT_EQ(world[2] & 0xc0, 0x80);
+  ASSERT_EQ(world[3] & 0xc0, 0x80);
+
+  // Now create a corrupted UTF8 string, starting with the first two bytes from
+  // |world|, followed by an ASCII message. Upon encountering '!', our decoder
+  // will realize that it's not a continuation byte; it'll skip to the end of
+  // this UTF8 sequence and continue with the next character. In this case, the
+  // 'H', of "Hello".
+  std::vector<uint8_t> chars;
+  chars.push_back(world[0]);
+  chars.push_back(world[1]);
+  chars.push_back('!');
+  chars.push_back('?');
+  chars.push_back('H');
+  chars.push_back('e');
+  chars.push_back('l');
+  chars.push_back('l');
+  chars.push_back('o');
+  writer->HandleString8(SpanFrom(chars));
+  EXPECT_EQ("\"Hello\"", out);  // "Hello" shows we restarted at 'H'.
+}
+
+TEST(JsonEncoder, EscapesLoneHighSurrogates) {
+  // This tests that the JSON encoder escapes lone high surrogates, i.e.
+  // invalid code points in the range from 0xD800 to 0xDBFF. In
+  // unescaped form, these cannot be represented in well-formed UTF-8 or
+  // UTF-16.
+  std::vector<uint16_t> chars = {'a', 0xd800, 'b', 0xdada, 'c', 0xdbff, 'd'};
+  std::string out;
+  Status status;
+  std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+  writer->HandleString16(span<uint16_t>(chars.data(), chars.size()));
+  EXPECT_EQ("\"a\\ud800b\\udadac\\udbffd\"", out);
+}
+
+TEST(JsonEncoder, EscapesLoneLowSurrogates) {
+  // This tests that the JSON encoder escapes lone low surrogates, i.e.
+  // invalid code points in the range from 0xDC00 to 0xDFFF. In
+  // unescaped form, these cannot be represented in well-formed UTF-8 or
+  // UTF-16.
+  std::vector<uint16_t> chars = {'a', 0xdc00, 'b', 0xdede, 'c', 0xdfff, 'd'};
+  std::string out;
+  Status status;
+  std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+  writer->HandleString16(span<uint16_t>(chars.data(), chars.size()));
+  EXPECT_EQ("\"a\\udc00b\\udedec\\udfffd\"", out);
+}
+
+TEST(JsonEncoder, EscapesFFFF) {
+  // This tests that the JSON encoder will escape the UTF16 input 0xffff as
+  // \uffff; useful to check this since it's an edge case.
+  std::vector<uint16_t> chars = {'a', 'b', 'c', 0xffff, 'd'};
+  std::string out;
+  Status status;
+  std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+  writer->HandleString16(span<uint16_t>(chars.data(), chars.size()));
+  EXPECT_EQ("\"abc\\uffffd\"", out);
+}
+
+TEST(JsonEncoder, IncompleteUtf8Sequence) {
+  std::string out;
+  Status status;
+  std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+
+  writer->HandleArrayBegin();  // This emits [, which starts an array.
+
+  {  // 🌎 takes four bytes to encode in UTF-8. We test with the first three;
+    // This means we're trying to emit a string that consists solely of an
+    // incomplete UTF-8 sequence. So the string in the JSON output is empty.
+    std::string world_utf8 = "🌎";
+    ASSERT_EQ(4u, world_utf8.size());
+    std::vector<uint8_t> chars(world_utf8.begin(), world_utf8.begin() + 3);
+    writer->HandleString8(SpanFrom(chars));
+    EXPECT_EQ("[\"\"", out);  // Incomplete sequence rejected: empty string.
+  }
+
+  {  // This time, the incomplete sequence is at the end of the string.
+    std::string msg = "Hello, \xF0\x9F\x8C";
+    std::vector<uint8_t> chars(msg.begin(), msg.end());
+    writer->HandleString8(SpanFrom(chars));
+    EXPECT_EQ("[\"\",\"Hello, \"", out);  // Incomplete sequence dropped at end.
+  }
+}
+
+TEST(JsonStdStringWriterTest, HelloWorld) {
+  std::string out;
+  Status status;
+  std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+  writer->HandleMapBegin();
+  WriteUTF8AsUTF16(writer.get(), "msg1");
+  WriteUTF8AsUTF16(writer.get(), "Hello, 🌎.");
+  std::string key = "msg1-as-utf8";
+  std::string value = "Hello, 🌎.";
+  writer->HandleString8(SpanFrom(key));
+  writer->HandleString8(SpanFrom(value));
+  WriteUTF8AsUTF16(writer.get(), "msg2");
+  WriteUTF8AsUTF16(writer.get(), "\\\b\r\n\t\f\"");
+  WriteUTF8AsUTF16(writer.get(), "nested");
+  writer->HandleMapBegin();
+  WriteUTF8AsUTF16(writer.get(), "double");
+  writer->HandleDouble(3.1415);
+  WriteUTF8AsUTF16(writer.get(), "int");
+  writer->HandleInt32(-42);
+  WriteUTF8AsUTF16(writer.get(), "bool");
+  writer->HandleBool(false);
+  WriteUTF8AsUTF16(writer.get(), "null");
+  writer->HandleNull();
+  writer->HandleMapEnd();
+  WriteUTF8AsUTF16(writer.get(), "array");
+  writer->HandleArrayBegin();
+  writer->HandleInt32(1);
+  writer->HandleInt32(2);
+  writer->HandleInt32(3);
+  writer->HandleArrayEnd();
+  writer->HandleMapEnd();
+  EXPECT_TRUE(status.ok());
+  EXPECT_EQ(
+      "{\"msg1\":\"Hello, \\ud83c\\udf0e.\","
+      "\"msg1-as-utf8\":\"Hello, \\ud83c\\udf0e.\","
+      "\"msg2\":\"\\\\\\b\\r\\n\\t\\f\\\"\","
+      "\"nested\":{\"double\":3.1415,\"int\":-42,"
+      "\"bool\":false,\"null\":null},\"array\":[1,2,3]}",
+      out);
+}
+
+TEST(JsonStdStringWriterTest, RepresentingNonFiniteValuesAsNull) {
+  // JSON can't represent +Infinity, -Infinity, or NaN.
+  // So in practice it's mapped to null.
+  std::string out;
+  Status status;
+  std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+  writer->HandleMapBegin();
+  writer->HandleString8(SpanFrom("Infinity"));
+  writer->HandleDouble(std::numeric_limits<double>::infinity());
+  writer->HandleString8(SpanFrom("-Infinity"));
+  writer->HandleDouble(-std::numeric_limits<double>::infinity());
+  writer->HandleString8(SpanFrom("NaN"));
+  writer->HandleDouble(std::numeric_limits<double>::quiet_NaN());
+  writer->HandleMapEnd();
+  EXPECT_TRUE(status.ok());
+  EXPECT_EQ("{\"Infinity\":null,\"-Infinity\":null,\"NaN\":null}", out);
+}
+
+TEST(JsonStdStringWriterTest, BinaryEncodedAsJsonString) {
+  // The encoder emits binary submitted to ParserHandler::HandleBinary
+  // as base64. The following three examples are taken from
+  // https://en.wikipedia.org/wiki/Base64.
+  {
+    std::string out;
+    Status status;
+    std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+    writer->HandleBinary(SpanFrom(std::vector<uint8_t>({'M', 'a', 'n'})));
+    EXPECT_TRUE(status.ok());
+    EXPECT_EQ("\"TWFu\"", out);
+  }
+  {
+    std::string out;
+    Status status;
+    std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+    writer->HandleBinary(SpanFrom(std::vector<uint8_t>({'M', 'a'})));
+    EXPECT_TRUE(status.ok());
+    EXPECT_EQ("\"TWE=\"", out);
+  }
+  {
+    std::string out;
+    Status status;
+    std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+    writer->HandleBinary(SpanFrom(std::vector<uint8_t>({'M'})));
+    EXPECT_TRUE(status.ok());
+    EXPECT_EQ("\"TQ==\"", out);
+  }
+  {  // "Hello, world.", verified with base64decode.org.
+    std::string out;
+    Status status;
+    std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+    writer->HandleBinary(SpanFrom(std::vector<uint8_t>(
+        {'H', 'e', 'l', 'l', 'o', ',', ' ', 'w', 'o', 'r', 'l', 'd', '.'})));
+    EXPECT_TRUE(status.ok());
+    EXPECT_EQ("\"SGVsbG8sIHdvcmxkLg==\"", out);
+  }
+}
+
+TEST(JsonStdStringWriterTest, HandlesErrors) {
+  // When an error is sent via HandleError, it saves it in the provided
+  // status and clears the output.
+  std::string out;
+  Status status;
+  std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+  writer->HandleMapBegin();
+  WriteUTF8AsUTF16(writer.get(), "msg1");
+  writer->HandleError(Status{Error::JSON_PARSER_VALUE_EXPECTED, 42});
+  EXPECT_THAT(status, StatusIs(Error::JSON_PARSER_VALUE_EXPECTED, 42u));
+  EXPECT_EQ("", out);
+}
+
+TEST(JsonStdStringWriterTest, DoubleToString_LeadingZero) {
+  // In JSON, .1 must be rendered as 0.1, and -.7 must be rendered as -0.7.
+  std::string out;
+  Status status;
+  std::unique_ptr<ParserHandler> writer = NewJSONEncoder(&out, &status);
+  writer->HandleArrayBegin();
+  writer->HandleDouble(.1);
+  writer->HandleDouble(-.7);
+  writer->HandleArrayEnd();
+  EXPECT_EQ("[0.1,-0.7]", out);
+}
+
+// =============================================================================
+// json::ParseJSON - for receiving streaming parser events for JSON
+// =============================================================================
+
+class Log : public ParserHandler {
+ public:
+  void HandleMapBegin() override { log_ << "map begin\n"; }
+
+  void HandleMapEnd() override { log_ << "map end\n"; }
+
+  void HandleArrayBegin() override { log_ << "array begin\n"; }
+
+  void HandleArrayEnd() override { log_ << "array end\n"; }
+
+  void HandleString8(span<uint8_t> chars) override {
+    log_ << "string8: " << std::string(chars.begin(), chars.end()) << "\n";
+  }
+
+  void HandleString16(span<uint16_t> chars) override {
+    raw_log_string16_.emplace_back(chars.begin(), chars.end());
+    log_ << "string16: " << UTF16ToUTF8(chars) << "\n";
+  }
+
+  void HandleBinary(span<uint8_t> bytes) override {
+    // JSON doesn't have native support for arbitrary bytes, so our parser will
+    // never call this.
+    CHECK(false);
+  }
+
+  void HandleDouble(double value) override {
+    log_ << "double: " << value << "\n";
+  }
+
+  void HandleInt32(int32_t value) override { log_ << "int: " << value << "\n"; }
+
+  void HandleBool(bool value) override { log_ << "bool: " << value << "\n"; }
+
+  void HandleNull() override { log_ << "null\n"; }
+
+  void HandleError(Status status) override { status_ = status; }
+
+  std::string str() const { return status_.ok() ? log_.str() : ""; }
+
+  std::vector<std::vector<uint16_t>> raw_log_string16() const {
+    return raw_log_string16_;
+  }
+
+  Status status() const { return status_; }
+
+ private:
+  std::ostringstream log_;
+  std::vector<std::vector<uint16_t>> raw_log_string16_;
+  Status status_;
+};
+
+class JsonParserTest : public ::testing::Test {
+ protected:
+  Log log_;
+};
+
+TEST_F(JsonParserTest, SimpleDictionary) {
+  std::string json = "{\"foo\": 42}";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_TRUE(log_.status().ok());
+  EXPECT_EQ(
+      "map begin\n"
+      "string16: foo\n"
+      "int: 42\n"
+      "map end\n",
+      log_.str());
+}
+
+TEST_F(JsonParserTest, UsAsciiDelCornerCase) {
+  // DEL (0x7f) is a 7 bit US-ASCII character, and while it is a control
+  // character according to Unicode, it's not considered a control
+  // character in https://tools.ietf.org/html/rfc7159#section-7, so
+  // it can be placed directly into the JSON string, without JSON escaping.
+  std::string json = "{\"foo\": \"a\x7f\"}";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_TRUE(log_.status().ok());
+  EXPECT_EQ(
+      "map begin\n"
+      "string16: foo\n"
+      "string16: a\x7f\n"
+      "map end\n",
+      log_.str());
+
+  // We've seen an implementation of UTF16ToUTF8 which would replace the DEL
+  // character with ' ', so this simple roundtrip tests the routines in
+  // encoding_test_helper.h, to make test failures of the above easier to
+  // diagnose.
+  std::vector<uint16_t> utf16 = UTF8ToUTF16(SpanFrom(json));
+  EXPECT_EQ(json, UTF16ToUTF8(SpanFrom(utf16)));
+}
+
+TEST_F(JsonParserTest, Whitespace) {
+  std::string json = "\n  {\n\"msg\"\n: \v\"Hello, world.\"\t\r}\t";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_TRUE(log_.status().ok());
+  EXPECT_EQ(
+      "map begin\n"
+      "string16: msg\n"
+      "string16: Hello, world.\n"
+      "map end\n",
+      log_.str());
+}
+
+TEST_F(JsonParserTest, NestedDictionary) {
+  std::string json = "{\"foo\": {\"bar\": {\"baz\": 1}, \"bar2\": 2}}";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_TRUE(log_.status().ok());
+  EXPECT_EQ(
+      "map begin\n"
+      "string16: foo\n"
+      "map begin\n"
+      "string16: bar\n"
+      "map begin\n"
+      "string16: baz\n"
+      "int: 1\n"
+      "map end\n"
+      "string16: bar2\n"
+      "int: 2\n"
+      "map end\n"
+      "map end\n",
+      log_.str());
+}
+
+TEST_F(JsonParserTest, Doubles) {
+  std::string json = "{\"foo\": 3.1415, \"bar\": 31415e-4}";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_TRUE(log_.status().ok());
+  EXPECT_EQ(
+      "map begin\n"
+      "string16: foo\n"
+      "double: 3.1415\n"
+      "string16: bar\n"
+      "double: 3.1415\n"
+      "map end\n",
+      log_.str());
+}
+
+TEST_F(JsonParserTest, Unicode) {
+  // Globe character. 0xF0 0x9F 0x8C 0x8E in utf8, 0xD83C 0xDF0E in utf16.
+  std::string json = "{\"msg\": \"Hello, \\uD83C\\uDF0E.\"}";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_TRUE(log_.status().ok());
+  EXPECT_EQ(
+      "map begin\n"
+      "string16: msg\n"
+      "string16: Hello, 🌎.\n"
+      "map end\n",
+      log_.str());
+}
+
+TEST_F(JsonParserTest, Unicode_ParseUtf16) {
+  // Globe character. utf8: 0xF0 0x9F 0x8C 0x8E; utf16: 0xD83C 0xDF0E.
+  // Crescent moon character. utf8: 0xF0 0x9F 0x8C 0x99; utf16: 0xD83C 0xDF19.
+
+  // We provide the moon with json escape, but the earth as utf16 input.
+  // Either way they arrive as utf8 (after decoding in log_.str()).
+  std::vector<uint16_t> json =
+      UTF8ToUTF16(SpanFrom("{\"space\": \"🌎 \\uD83C\\uDF19.\"}"));
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_TRUE(log_.status().ok());
+  EXPECT_EQ(
+      "map begin\n"
+      "string16: space\n"
+      "string16: 🌎 🌙.\n"
+      "map end\n",
+      log_.str());
+}
+
+TEST_F(JsonParserTest, Unicode_ParseUtf16_SingleEscapeUpToFFFF) {
+  // 0xFFFF is the max codepoint that can be represented as a single \u escape.
+  // One way to write this is \uffff, another way is to encode it as a 3 byte
+  // UTF-8 sequence (0xef 0xbf 0xbf). Both are equivalent.
+
+  // Example with both ways of encoding code point 0xFFFF in a JSON string.
+  std::string json = "{\"escape\": \"\xef\xbf\xbf or \\uffff\"}";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_TRUE(log_.status().ok());
+
+  // Shows both inputs result in equivalent output once converted to UTF-8.
+  EXPECT_EQ(
+      "map begin\n"
+      "string16: escape\n"
+      "string16: \xEF\xBF\xBF or \xEF\xBF\xBF\n"
+      "map end\n",
+      log_.str());
+
+  // Make an even stronger assertion: The parser represents \xffff as a single
+  // UTF-16 char.
+  ASSERT_EQ(2u, log_.raw_log_string16().size());
+  std::vector<uint16_t> expected = {0xffff, ' ', 'o', 'r', ' ', 0xffff};
+  EXPECT_EQ(expected, log_.raw_log_string16()[1]);
+}
+
+TEST_F(JsonParserTest, Unicode_ParseUtf8) {
+  // Used below:
+  // гласность - example for 2 byte utf8, Russian word "glasnost"
+  // 屋 - example for 3 byte utf8, Chinese word for "house"
+  // 🌎 - example for 4 byte utf8: 0xF0 0x9F 0x8C 0x8E; utf16: 0xD83C 0xDF0E.
+  // 🌙 - example for escapes: utf8: 0xF0 0x9F 0x8C 0x99; utf16: 0xD83C 0xDF19.
+
+  // We provide the moon with json escape, but the earth as utf8 input.
+  // Either way they arrive as utf8 (after decoding in log_.str()).
+  std::string json =
+      "{"
+      "\"escapes\": \"\\uD83C\\uDF19\","
+      "\"2 byte\":\"гласность\","
+      "\"3 byte\":\"屋\","
+      "\"4 byte\":\"🌎\""
+      "}";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_TRUE(log_.status().ok());
+  EXPECT_EQ(
+      "map begin\n"
+      "string16: escapes\n"
+      "string16: 🌙\n"
+      "string16: 2 byte\n"
+      "string16: гласность\n"
+      "string16: 3 byte\n"
+      "string16: 屋\n"
+      "string16: 4 byte\n"
+      "string16: 🌎\n"
+      "map end\n",
+      log_.str());
+}
+
+TEST_F(JsonParserTest, UnprocessedInputRemainsError) {
+  // Trailing junk after the valid JSON.
+  std::string json = "{\"foo\": 3.1415} junk";
+  size_t junk_idx = json.find("junk");
+  EXPECT_NE(junk_idx, std::string::npos);
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_THAT(log_.status(),
+              StatusIs(Error::JSON_PARSER_UNPROCESSED_INPUT_REMAINS, junk_idx));
+  EXPECT_EQ("", log_.str());
+}
+
+std::string MakeNestedJson(int depth) {
+  std::string json;
+  for (int ii = 0; ii < depth; ++ii)
+    json += "{\"foo\":";
+  json += "42";
+  for (int ii = 0; ii < depth; ++ii)
+    json += "}";
+  return json;
+}
+
+TEST_F(JsonParserTest, StackLimitExceededError_BelowLimit) {
+  // kStackLimit is 300 (see json_parser.cc). First let's
+  // try with a small nested example.
+  std::string json_3 = MakeNestedJson(3);
+  ParseJSON(SpanFrom(json_3), &log_);
+  EXPECT_TRUE(log_.status().ok());
+  EXPECT_EQ(
+      "map begin\n"
+      "string16: foo\n"
+      "map begin\n"
+      "string16: foo\n"
+      "map begin\n"
+      "string16: foo\n"
+      "int: 42\n"
+      "map end\n"
+      "map end\n"
+      "map end\n",
+      log_.str());
+}
+
+TEST_F(JsonParserTest, StackLimitExceededError_AtLimit) {
+  // Now with kStackLimit (300).
+  std::string json_limit = MakeNestedJson(300);
+  ParseJSON(span<uint8_t>(reinterpret_cast<const uint8_t*>(json_limit.data()),
+                          json_limit.size()),
+            &log_);
+  EXPECT_THAT(log_.status(), StatusIsOk());
+}
+
+TEST_F(JsonParserTest, StackLimitExceededError_AboveLimit) {
+  // Now with kStackLimit + 1 (301) - it exceeds in the innermost instance.
+  std::string exceeded = MakeNestedJson(301);
+  ParseJSON(SpanFrom(exceeded), &log_);
+  EXPECT_THAT(log_.status(), StatusIs(Error::JSON_PARSER_STACK_LIMIT_EXCEEDED,
+                                      strlen("{\"foo\":") * 301));
+}
+
+TEST_F(JsonParserTest, StackLimitExceededError_WayAboveLimit) {
+  // Now way past the limit. Still, the point of exceeding is 301.
+  std::string far_out = MakeNestedJson(320);
+  ParseJSON(SpanFrom(far_out), &log_);
+  EXPECT_THAT(log_.status(), StatusIs(Error::JSON_PARSER_STACK_LIMIT_EXCEEDED,
+                                      strlen("{\"foo\":") * 301));
+}
+
+TEST_F(JsonParserTest, NoInputError) {
+  std::string json = "";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_THAT(log_.status(), StatusIs(Error::JSON_PARSER_NO_INPUT, 0u));
+  EXPECT_EQ("", log_.str());
+}
+
+TEST_F(JsonParserTest, InvalidTokenError) {
+  std::string json = "|";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_THAT(log_.status(), StatusIs(Error::JSON_PARSER_INVALID_TOKEN, 0u));
+  EXPECT_EQ("", log_.str());
+}
+
+TEST_F(JsonParserTest, InvalidNumberError) {
+  // Mantissa exceeds max (the constant used here is int64_t max).
+  std::string json = "1E9223372036854775807";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_THAT(log_.status(), StatusIs(Error::JSON_PARSER_INVALID_NUMBER, 0u));
+  EXPECT_EQ("", log_.str());
+}
+
+TEST_F(JsonParserTest, InvalidStringError) {
+  // \x22 is an unsupported escape sequence
+  std::string json = "\"foo\\x22\"";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_THAT(log_.status(), StatusIs(Error::JSON_PARSER_INVALID_STRING, 0u));
+  EXPECT_EQ("", log_.str());
+}
+
+TEST_F(JsonParserTest, UnexpectedArrayEndError) {
+  std::string json = "[1,2,]";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_THAT(log_.status(),
+              StatusIs(Error::JSON_PARSER_UNEXPECTED_ARRAY_END, 5u));
+  EXPECT_EQ("", log_.str());
+}
+
+TEST_F(JsonParserTest, CommaOrArrayEndExpectedError) {
+  std::string json = "[1,2 2";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_THAT(log_.status(),
+              StatusIs(Error::JSON_PARSER_COMMA_OR_ARRAY_END_EXPECTED, 5u));
+  EXPECT_EQ("", log_.str());
+}
+
+TEST_F(JsonParserTest, StringLiteralExpectedError) {
+  // There's an error because the key bar, a string, is not terminated.
+  std::string json = "{\"foo\": 3.1415, \"bar: 31415e-4}";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_THAT(log_.status(),
+              StatusIs(Error::JSON_PARSER_STRING_LITERAL_EXPECTED, 16u));
+  EXPECT_EQ("", log_.str());
+}
+
+TEST_F(JsonParserTest, ColonExpectedError) {
+  std::string json = "{\"foo\", 42}";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_THAT(log_.status(), StatusIs(Error::JSON_PARSER_COLON_EXPECTED, 6u));
+  EXPECT_EQ("", log_.str());
+}
+
+TEST_F(JsonParserTest, UnexpectedMapEndError) {
+  std::string json = "{\"foo\": 42, }";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_THAT(log_.status(),
+              StatusIs(Error::JSON_PARSER_UNEXPECTED_MAP_END, 12u));
+  EXPECT_EQ("", log_.str());
+}
+
+TEST_F(JsonParserTest, CommaOrMapEndExpectedError) {
+  // The second separator should be a comma.
+  std::string json = "{\"foo\": 3.1415: \"bar\": 0}";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_THAT(log_.status(),
+              StatusIs(Error::JSON_PARSER_COMMA_OR_MAP_END_EXPECTED, 14u));
+  EXPECT_EQ("", log_.str());
+}
+
+TEST_F(JsonParserTest, ValueExpectedError) {
+  std::string json = "}";
+  ParseJSON(SpanFrom(json), &log_);
+  EXPECT_THAT(log_.status(), StatusIs(Error::JSON_PARSER_VALUE_EXPECTED, 0u));
+  EXPECT_EQ("", log_.str());
+}
+
+template <typename T>
+class ConvertJSONToCBORTest : public ::testing::Test {};
+
+using ContainerTestTypes = ::testing::Types<std::vector<uint8_t>, std::string>;
+TYPED_TEST_SUITE(ConvertJSONToCBORTest, ContainerTestTypes);
+
+TYPED_TEST(ConvertJSONToCBORTest, RoundTripValidJson) {
+  for (const std::string& json_in : {
+           "{\"msg\":\"Hello, world.\",\"lst\":[1,2,3]}",
+           "3.1415",
+           "false",
+           "true",
+           "\"Hello, world.\"",
+           "[1,2,3]",
+           "[]",
+       }) {
+    SCOPED_TRACE(json_in);
+    TypeParam json(json_in.begin(), json_in.end());
+    std::vector<uint8_t> cbor;
+    {
+      Status status = ConvertJSONToCBOR(SpanFrom(json), &cbor);
+      EXPECT_THAT(status, StatusIsOk());
+    }
+    TypeParam roundtrip_json;
+    {
+      Status status = ConvertCBORToJSON(SpanFrom(cbor), &roundtrip_json);
+      EXPECT_THAT(status, StatusIsOk());
+    }
+    EXPECT_EQ(json, roundtrip_json);
+  }
+}
+
+TYPED_TEST(ConvertJSONToCBORTest, RoundTripValidJson16) {
+  std::vector<uint16_t> json16 = {
+      '{', '"', 'm', 's',    'g',    '"', ':', '"', 'H', 'e', 'l', 'l',
+      'o', ',', ' ', 0xd83c, 0xdf0e, '.', '"', ',', '"', 'l', 's', 't',
+      '"', ':', '[', '1',    ',',    '2', ',', '3', ']', '}'};
+  std::vector<uint8_t> cbor;
+  {
+    Status status =
+        ConvertJSONToCBOR(span<uint16_t>(json16.data(), json16.size()), &cbor);
+    EXPECT_THAT(status, StatusIsOk());
+  }
+  TypeParam roundtrip_json;
+  {
+    Status status = ConvertCBORToJSON(SpanFrom(cbor), &roundtrip_json);
+    EXPECT_THAT(status, StatusIsOk());
+  }
+  std::string json = "{\"msg\":\"Hello, \\ud83c\\udf0e.\",\"lst\":[1,2,3]}";
+  TypeParam expected_json(json.begin(), json.end());
+  EXPECT_EQ(expected_json, roundtrip_json);
+}
+}  // namespace json
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/parser_handler.h b/deps/v8/third_party/inspector_protocol/crdtp/parser_handler.h
new file mode 100644
index 00000000000000..47bbe6d5e8a1e7
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/parser_handler.h
@@ -0,0 +1,39 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_CRDTP_PARSER_HANDLER_H_
+#define V8_CRDTP_PARSER_HANDLER_H_
+
+#include <cstdint>
+#include "span.h"
+#include "status.h"
+
+namespace v8_crdtp {
+// Handler interface for parser events emitted by a streaming parser.
+// See cbor::NewCBOREncoder, cbor::ParseCBOR, json::NewJSONEncoder,
+// json::ParseJSON.
+class ParserHandler {
+ public:
+  virtual ~ParserHandler() = default;
+  virtual void HandleMapBegin() = 0;
+  virtual void HandleMapEnd() = 0;
+  virtual void HandleArrayBegin() = 0;
+  virtual void HandleArrayEnd() = 0;
+  virtual void HandleString8(span<uint8_t> chars) = 0;
+  virtual void HandleString16(span<uint16_t> chars) = 0;
+  virtual void HandleBinary(span<uint8_t> bytes) = 0;
+  virtual void HandleDouble(double value) = 0;
+  virtual void HandleInt32(int32_t value) = 0;
+  virtual void HandleBool(bool value) = 0;
+  virtual void HandleNull() = 0;
+
+  // The parser may send one error even after other events have already
+  // been received. Client code is reponsible to then discard the
+  // already processed events.
+  // |error| must be an eror, as in, |error.is_ok()| can't be true.
+  virtual void HandleError(Status error) = 0;
+};
+}  // namespace v8_crdtp
+
+#endif  // V8_CRDTP_PARSER_HANDLER_H_
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/serializable.cc b/deps/v8/third_party/inspector_protocol/crdtp/serializable.cc
new file mode 100644
index 00000000000000..1df9eb291dae41
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/serializable.cc
@@ -0,0 +1,17 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "serializable.h"
+
+namespace v8_crdtp {
+// =============================================================================
+// Serializable - An object to be emitted as a sequence of bytes.
+// =============================================================================
+
+std::vector<uint8_t> Serializable::TakeSerialized() && {
+  std::vector<uint8_t> out;
+  AppendSerialized(&out);
+  return out;
+}
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/serializable.h b/deps/v8/third_party/inspector_protocol/crdtp/serializable.h
new file mode 100644
index 00000000000000..57faf4231637c3
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/serializable.h
@@ -0,0 +1,30 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_CRDTP_SERIALIZABLE_H_
+#define V8_CRDTP_SERIALIZABLE_H_
+
+#include <cstdint>
+#include <vector>
+#include "export.h"
+
+namespace v8_crdtp {
+// =============================================================================
+// Serializable - An object to be emitted as a sequence of bytes.
+// =============================================================================
+
+class Serializable {
+ public:
+  // The default implementation invokes AppendSerialized with an empty vector
+  // and returns it; some subclasses may override and move out internal state
+  // instead to avoid copying.
+  virtual std::vector<uint8_t> TakeSerialized() &&;
+
+  virtual void AppendSerialized(std::vector<uint8_t>* out) const = 0;
+
+  virtual ~Serializable() = default;
+};
+}  // namespace v8_crdtp
+
+#endif  // V8_CRDTP_SERIALIZABLE_H_
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/serializable_test.cc b/deps/v8/third_party/inspector_protocol/crdtp/serializable_test.cc
new file mode 100644
index 00000000000000..da49f175175aa0
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/serializable_test.cc
@@ -0,0 +1,41 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <cstdlib>
+#include <string>
+
+#include "serializable.h"
+#include "test_platform.h"
+
+namespace v8_crdtp {
+// =============================================================================
+// Serializable - An object to be emitted as a sequence of bytes.
+// =============================================================================
+
+namespace {
+// Tests the default behavior for ::TakeSerialized (to invoke
+// ::AppendSerialized).
+class SimpleExample : public Serializable {
+ public:
+  explicit SimpleExample(const std::vector<uint8_t>& contents)
+      : contents_(contents) {}
+
+  void AppendSerialized(std::vector<uint8_t>* out) const override {
+    out->insert(out->end(), contents_.begin(), contents_.end());
+  }
+
+ private:
+  std::vector<uint8_t> contents_;
+};
+}  // namespace
+
+TEST(SerializableTest, YieldsContents) {
+  std::vector<uint8_t> contents = {1, 2, 3};
+  SimpleExample foo(contents);
+  foo.AppendSerialized(&contents);  // Yields contents by appending.
+  EXPECT_THAT(contents, testing::ElementsAre(1, 2, 3, 1, 2, 3));
+  // Yields contents by returning.
+  EXPECT_THAT(std::move(foo).TakeSerialized(), testing::ElementsAre(1, 2, 3));
+}
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/serializer_traits.h b/deps/v8/third_party/inspector_protocol/crdtp/serializer_traits.h
new file mode 100644
index 00000000000000..cc275b54d6d780
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/serializer_traits.h
@@ -0,0 +1,158 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_CRDTP_SERIALIZER_TRAITS_H_
+#define V8_CRDTP_SERIALIZER_TRAITS_H_
+
+#include <memory>
+#include <string>
+#include <vector>
+#include "cbor.h"
+#include "glue.h"
+#include "span.h"
+
+namespace v8_crdtp {
+// =============================================================================
+// SerializerTraits - Encodes field values of protocol objects in CBOR.
+// =============================================================================
+//
+// A family of serialization functions which are used by FieldSerializerTraits
+// (below) to encode field values in CBOR. Conceptually, it's this:
+//
+// Serialize(bool value, std::vector<uint8_t>* out);
+// Serialize(int32_t value, std::vector<uint8_t>* out);
+// Serialize(double value, std::vector<uint8_t>* out);
+// ...
+//
+// However, if this was to use straight-forward overloading, implicit
+// type conversions would lead to ambiguity - e.g., a bool could be
+// represented as an int32_t, but it should really be encoded as a bool.
+// The template parameterized / specialized structs accomplish this.
+//
+// SerializerTraits<bool>::Serialize(bool value, std::vector<uint8_t>* out);
+// SerializerTraits<int32>::Serialize(int32_t value, std::vector<uint8_t>* out);
+// SerializerTraits<double>::Serialize(double value, std::vector<uint8_t>* out);
+template <typename T>
+struct SerializerTraits {
+  // |Serializable| (defined in serializable.h) already knows how to serialize
+  // to CBOR, so we can just delegate. This covers domain specific types,
+  // protocol::Binary, etc.
+  // However, we use duck-typing here, because Exported, which is part of the V8
+  // headers also comes with AppendSerialized, and logically it's the same type,
+  // but it lives in a different namespace (v8_inspector::protocol::Exported).
+  template <
+      typename LikeSerializable,
+      typename std::enable_if_t<std::is_member_pointer<decltype(
+                                    &LikeSerializable::AppendSerialized)>{},
+                                int> = 0>
+  static void Serialize(const LikeSerializable& value,
+                        std::vector<uint8_t>* out) {
+    value.AppendSerialized(out);
+  }
+};
+
+// This covers std::string, which is assumed to be UTF-8.
+// The two other string implementations that are used in the protocol bindings:
+// - WTF::String, for which the SerializerTraits specialization is located
+//   in third_party/blink/renderer/core/inspector/v8-inspector-string.h.
+// - v8_inspector::String16, implemented in v8/src/inspector/string-16.h
+//   along with its SerializerTraits specialization.
+template <>
+struct SerializerTraits<std::string> {
+  static void Serialize(const std::string& str, std::vector<uint8_t>* out) {
+    cbor::EncodeString8(SpanFrom(str), out);
+  }
+};
+
+template <>
+struct SerializerTraits<bool> {
+  static void Serialize(bool value, std::vector<uint8_t>* out) {
+    out->push_back(value ? cbor::EncodeTrue() : cbor::EncodeFalse());
+  }
+};
+
+template <>
+struct SerializerTraits<int32_t> {
+  static void Serialize(int32_t value, std::vector<uint8_t>* out) {
+    cbor::EncodeInt32(value, out);
+  }
+};
+
+template <>
+struct SerializerTraits<double> {
+  static void Serialize(double value, std::vector<uint8_t>* out) {
+    cbor::EncodeDouble(value, out);
+  }
+};
+
+template <typename T>
+struct SerializerTraits<std::vector<T>> {
+  static void Serialize(const std::vector<T>& value,
+                        std::vector<uint8_t>* out) {
+    out->push_back(cbor::EncodeIndefiniteLengthArrayStart());
+    for (const T& element : value)
+      SerializerTraits<T>::Serialize(element, out);
+    out->push_back(cbor::EncodeStop());
+  }
+};
+
+template <typename T>
+struct SerializerTraits<std::unique_ptr<T>> {
+  static void Serialize(const std::unique_ptr<T>& value,
+                        std::vector<uint8_t>* out) {
+    SerializerTraits<T>::Serialize(*value, out);
+  }
+};
+
+// =============================================================================
+// FieldSerializerTraits - Encodes fields of protocol objects in CBOR
+// =============================================================================
+//
+// The generated code (see TypeBuilder_cpp.template) invokes SerializeField,
+// which then instantiates the FieldSerializerTraits to emit the appropriate
+// existence checks / dereference for the field value. This avoids emitting
+// the field name if the value for an optional field isn't set.
+template <typename T>
+struct FieldSerializerTraits {
+  static void Serialize(span<uint8_t> field_name,
+                        const T& field_value,
+                        std::vector<uint8_t>* out) {
+    cbor::EncodeString8(field_name, out);
+    SerializerTraits<T>::Serialize(field_value, out);
+  }
+};
+
+template <typename T>
+struct FieldSerializerTraits<glue::detail::PtrMaybe<T>> {
+  static void Serialize(span<uint8_t> field_name,
+                        const glue::detail::PtrMaybe<T>& field_value,
+                        std::vector<uint8_t>* out) {
+    if (!field_value.isJust())
+      return;
+    cbor::EncodeString8(field_name, out);
+    SerializerTraits<T>::Serialize(*field_value.fromJust(), out);
+  }
+};
+
+template <typename T>
+struct FieldSerializerTraits<glue::detail::ValueMaybe<T>> {
+  static void Serialize(span<uint8_t> field_name,
+                        const glue::detail::ValueMaybe<T>& field_value,
+                        std::vector<uint8_t>* out) {
+    if (!field_value.isJust())
+      return;
+    cbor::EncodeString8(field_name, out);
+    SerializerTraits<T>::Serialize(field_value.fromJust(), out);
+  }
+};
+
+template <typename T>
+void SerializeField(span<uint8_t> field_name,
+                    const T& field_value,
+                    std::vector<uint8_t>* out) {
+  FieldSerializerTraits<T>::Serialize(field_name, field_value, out);
+}
+}  // namespace v8_crdtp
+
+#endif  // V8_CRDTP_SERIALIZER_TRAITS_H_
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/serializer_traits_test.cc b/deps/v8/third_party/inspector_protocol/crdtp/serializer_traits_test.cc
new file mode 100644
index 00000000000000..27810ccd5f4147
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/serializer_traits_test.cc
@@ -0,0 +1,227 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "serializer_traits.h"
+
+#include <array>
+#include "serializable.h"
+#include "test_platform.h"
+
+// The purpose of this test is to ensure that the
+// {Field}SerializerTraits<X>::Serialize methods invoke the appropriate
+// functions from cbor.h; so, it's usually sufficient to compare with what
+// cbor.h function invocations would produce, rather than making assertions on
+// the specific bytes emitted by the SerializerTraits code.
+
+namespace v8_crdtp {
+namespace {
+// =============================================================================
+// SerializerTraits - Encodes field values of protocol objects in CBOR.
+// =============================================================================
+
+TEST(SerializerTraits, Bool) {
+  std::vector<uint8_t> out;
+  SerializerTraits<bool>::Serialize(true, &out);
+  SerializerTraits<bool>::Serialize(false, &out);
+  EXPECT_THAT(out,
+              testing::ElementsAre(cbor::EncodeTrue(), cbor::EncodeFalse()));
+}
+
+TEST(SerializerTraits, Double) {
+  std::vector<uint8_t> out;
+  SerializerTraits<double>::Serialize(1.00001, &out);
+
+  std::vector<uint8_t> expected;
+  cbor::EncodeDouble(1.00001, &expected);
+
+  EXPECT_THAT(out, testing::ElementsAreArray(expected));
+}
+
+TEST(SerializerTraits, Int32) {
+  std::vector<uint8_t> out;
+  SerializerTraits<int32_t>::Serialize(42, &out);
+
+  std::vector<uint8_t> expected;
+  cbor::EncodeInt32(42, &expected);
+
+  EXPECT_THAT(out, testing::ElementsAreArray(expected));
+}
+
+TEST(SerializerTraits, VectorOfInt32) {
+  std::vector<int32_t> ints = {1, 2, 3};
+
+  std::vector<uint8_t> out;
+  SerializerTraits<std::vector<int32_t>>::Serialize(ints, &out);
+
+  std::vector<uint8_t> expected;
+  expected.push_back(cbor::EncodeIndefiniteLengthArrayStart());
+  for (int32_t v : ints)
+    cbor::EncodeInt32(v, &expected);
+  expected.push_back(cbor::EncodeStop());
+
+  EXPECT_THAT(out, testing::ElementsAreArray(expected));
+}
+
+// Foo is an example for a domain specific type.
+class Foo : public Serializable {
+ public:
+  Foo(int32_t value) : value(value) {}
+
+  int32_t value;
+
+  void AppendSerialized(std::vector<uint8_t>* out) const override {
+    // In production, this would be generated code which emits a
+    // CBOR map that has STRING8 keys corresponding to the field names
+    // and field values encoded using SerializerTraits::Serialize.
+    //
+    // For the test we simplify this drastically and just emit the field
+    // value, for conveniently testing std::vector<std::unique_ptr<Foo>>,
+    // as well as the convenience methods for raw pointer and unique_ptr.
+    SerializerTraits<int32_t>::Serialize(value, out);
+  }
+};
+
+TEST(SerializerTraits, VectorOfDomainSpecificType) {
+  std::vector<std::unique_ptr<Foo>> foos;
+  foos.push_back(std::make_unique<Foo>(1));
+  foos.push_back(std::make_unique<Foo>(2));
+  foos.push_back(std::make_unique<Foo>(3));
+
+  std::vector<uint8_t> out;
+  SerializerTraits<std::vector<std::unique_ptr<Foo>>>::Serialize(foos, &out);
+
+  std::vector<uint8_t> expected;
+  expected.push_back(cbor::EncodeIndefiniteLengthArrayStart());
+  for (int32_t v : {1, 2, 3})
+    cbor::EncodeInt32(v, &expected);
+  expected.push_back(cbor::EncodeStop());
+
+  EXPECT_THAT(out, testing::ElementsAreArray(expected));
+}
+
+TEST(SerializerTraits, ConstRefAndUniquePtr) {
+  // Shows that SerializerTraits<Foo> allows unique_ptr.
+  Foo foo(42);
+  auto bar = std::make_unique<Foo>(21);
+
+  std::vector<uint8_t> out;
+  // In this case, |foo| is taken as a const Foo&.
+  SerializerTraits<Foo>::Serialize(foo, &out);
+  // In this case, |bar| is taken as a const std::unique_ptr<Foo>&.
+  SerializerTraits<std::unique_ptr<Foo>>::Serialize(bar, &out);
+
+  std::vector<uint8_t> expected;
+  cbor::EncodeInt32(42, &expected);
+  cbor::EncodeInt32(21, &expected);
+
+  EXPECT_THAT(out, testing::ElementsAreArray(expected));
+}
+
+TEST(SerializerTraits, UTF8String) {
+  std::string msg = "Hello, 🌎.";
+
+  std::vector<uint8_t> out;
+  SerializerTraits<std::string>::Serialize(msg, &out);
+
+  std::vector<uint8_t> expected;
+  cbor::EncodeString8(SpanFrom(msg), &expected);
+
+  EXPECT_THAT(out, testing::ElementsAreArray(expected));
+}
+
+// A trivial model of Exported.
+// (see
+// https://cs.chromium.org/chromium/src/out/Debug/gen/v8/include/inspector/Debugger.h).
+struct Exported {
+  std::string msg;
+  void AppendSerialized(std::vector<uint8_t>* out) const {
+    cbor::EncodeString8(SpanFrom(msg), out);
+  }
+};
+
+TEST(SerializerTraits, Exported) {
+  Exported exported;
+  exported.msg = "Hello, world.";
+
+  std::vector<uint8_t> out;
+  SerializerTraits<Exported>::Serialize(exported, &out);
+
+  std::vector<uint8_t> expected;
+  cbor::EncodeString8(SpanFrom(exported.msg), &expected);
+
+  EXPECT_THAT(out, testing::ElementsAreArray(expected));
+}
+
+// =============================================================================
+// FieldSerializerTraits - Encodes fields of protocol objects in CBOR
+// =============================================================================
+TEST(FieldSerializerTraits, RequiredField) {
+  std::string value = "Hello, world.";
+
+  std::vector<uint8_t> out;
+  SerializeField(SpanFrom("msg"), value, &out);
+
+  std::vector<uint8_t> expected;
+  cbor::EncodeString8(SpanFrom("msg"), &expected);
+  cbor::EncodeString8(SpanFrom(value), &expected);
+
+  EXPECT_THAT(out, testing::ElementsAreArray(expected));
+}
+
+template <typename T>
+class FieldSerializerTraits_MaybeTest : public ::testing::Test {};
+using MaybeTypes =
+    ::testing::Types<glue::detail::ValueMaybe<bool>,
+                     glue::detail::ValueMaybe<double>,
+                     glue::detail::ValueMaybe<int32_t>,
+                     glue::detail::ValueMaybe<std::string>,
+                     glue::detail::PtrMaybe<Foo>,
+                     glue::detail::PtrMaybe<std::vector<std::unique_ptr<Foo>>>>;
+TYPED_TEST_SUITE(FieldSerializerTraits_MaybeTest, MaybeTypes);
+
+TYPED_TEST(FieldSerializerTraits_MaybeTest, NoOutputForFieldsIfNotJust) {
+  std::vector<uint8_t> out;
+  SerializeField(SpanFrom("maybe"), TypeParam(), &out);
+  EXPECT_THAT(out, testing::ElementsAreArray(std::vector<uint8_t>()));
+}
+
+TEST(FieldSerializerTraits, MaybeBool) {
+  std::vector<uint8_t> out;
+  SerializeField(SpanFrom("true"), glue::detail::ValueMaybe<bool>(true), &out);
+  SerializeField(SpanFrom("false"), glue::detail::ValueMaybe<bool>(false),
+                 &out);
+
+  std::vector<uint8_t> expected;
+  cbor::EncodeString8(SpanFrom("true"), &expected);
+  expected.push_back(cbor::EncodeTrue());
+  cbor::EncodeString8(SpanFrom("false"), &expected);
+  expected.push_back(cbor::EncodeFalse());
+
+  EXPECT_THAT(out, testing::ElementsAreArray(expected));
+}
+
+TEST(FieldSerializerTraits, MaybeDouble) {
+  std::vector<uint8_t> out;
+  SerializeField(SpanFrom("dbl"), glue::detail::ValueMaybe<double>(3.14), &out);
+
+  std::vector<uint8_t> expected;
+  cbor::EncodeString8(SpanFrom("dbl"), &expected);
+  cbor::EncodeDouble(3.14, &expected);
+
+  EXPECT_THAT(out, testing::ElementsAreArray(expected));
+}
+
+TEST(FieldSerializerTraits, MaybePtrFoo) {
+  std::vector<uint8_t> out;
+  SerializeField(SpanFrom("foo"),
+                 glue::detail::PtrMaybe<Foo>(std::make_unique<Foo>(42)), &out);
+
+  std::vector<uint8_t> expected;
+  cbor::EncodeString8(SpanFrom("foo"), &expected);
+  cbor::EncodeInt32(42, &expected);  // Simplified relative to production.
+
+  EXPECT_THAT(out, testing::ElementsAreArray(expected));
+}
+}  // namespace
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/span.h b/deps/v8/third_party/inspector_protocol/crdtp/span.h
new file mode 100644
index 00000000000000..cb94319d5f6362
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/span.h
@@ -0,0 +1,94 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_CRDTP_SPAN_H_
+#define V8_CRDTP_SPAN_H_
+
+#include <algorithm>
+#include <cstdint>
+#include <cstring>
+#include <string>
+#include <vector>
+
+namespace v8_crdtp {
+// =============================================================================
+// span - sequence of bytes
+// =============================================================================
+
+// This template is similar to std::span, which will be included in C++20.
+template <typename T>
+class span {
+ public:
+  using index_type = size_t;
+
+  constexpr span() : data_(nullptr), size_(0) {}
+  constexpr span(const T* data, index_type size) : data_(data), size_(size) {}
+
+  constexpr const T* data() const { return data_; }
+
+  constexpr const T* begin() const { return data_; }
+  constexpr const T* end() const { return data_ + size_; }
+
+  constexpr const T& operator[](index_type idx) const { return data_[idx]; }
+
+  constexpr span<T> subspan(index_type offset, index_type count) const {
+    return span(data_ + offset, count);
+  }
+
+  constexpr span<T> subspan(index_type offset) const {
+    return span(data_ + offset, size_ - offset);
+  }
+
+  constexpr bool empty() const { return size_ == 0; }
+
+  constexpr index_type size() const { return size_; }
+  constexpr index_type size_bytes() const { return size_ * sizeof(T); }
+
+ private:
+  const T* data_;
+  index_type size_;
+};
+
+template <size_t N>
+constexpr span<uint8_t> SpanFrom(const char (&str)[N]) {
+  return span<uint8_t>(reinterpret_cast<const uint8_t*>(str), N - 1);
+}
+
+constexpr inline span<uint8_t> SpanFrom(const char* str) {
+  return str ? span<uint8_t>(reinterpret_cast<const uint8_t*>(str), strlen(str))
+             : span<uint8_t>();
+}
+
+inline span<uint8_t> SpanFrom(const std::string& v) {
+  return span<uint8_t>(reinterpret_cast<const uint8_t*>(v.data()), v.size());
+}
+
+// This SpanFrom routine works for std::vector<uint8_t> and
+// std::vector<uint16_t>, but also for base::span<const uint8_t> in Chromium.
+template <typename C,
+          typename = std::enable_if_t<
+              std::is_unsigned<typename C::value_type>{} &&
+              std::is_member_function_pointer<decltype(&C::size)>{}>>
+inline span<typename C::value_type> SpanFrom(const C& v) {
+  return span<typename C::value_type>(v.data(), v.size());
+}
+
+// Less than / equality comparison functions for sorting / searching for byte
+// spans. These are similar to absl::string_view's < and == operators.
+constexpr inline bool SpanLessThan(span<uint8_t> x, span<uint8_t> y) noexcept {
+  auto min_size = std::min(x.size(), y.size());
+  const int r = min_size == 0 ? 0 : memcmp(x.data(), y.data(), min_size);
+  return (r < 0) || (r == 0 && x.size() < y.size());
+}
+
+constexpr inline bool SpanEquals(span<uint8_t> x, span<uint8_t> y) noexcept {
+  auto len = x.size();
+  if (len != y.size())
+    return false;
+  return x.data() == y.data() || len == 0 ||
+         std::memcmp(x.data(), y.data(), len) == 0;
+}
+}  // namespace v8_crdtp
+
+#endif  // V8_CRDTP_SPAN_H_
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/span_test.cc b/deps/v8/third_party/inspector_protocol/crdtp/span_test.cc
new file mode 100644
index 00000000000000..718f03f8854de5
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/span_test.cc
@@ -0,0 +1,148 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <cstdlib>
+#include <string>
+#include <unordered_map>
+
+#include "span.h"
+#include "test_platform.h"
+
+namespace v8_crdtp {
+// =============================================================================
+// span - sequence of bytes
+// =============================================================================
+
+template <typename T>
+class SpanTest : public ::testing::Test {};
+
+using TestTypes = ::testing::Types<uint8_t, uint16_t>;
+TYPED_TEST_SUITE(SpanTest, TestTypes);
+
+TYPED_TEST(SpanTest, Empty) {
+  span<TypeParam> empty;
+  EXPECT_TRUE(empty.empty());
+  EXPECT_EQ(0u, empty.size());
+  EXPECT_EQ(0u, empty.size_bytes());
+  EXPECT_EQ(empty.begin(), empty.end());
+}
+
+TYPED_TEST(SpanTest, SingleItem) {
+  TypeParam single_item = 42;
+  span<TypeParam> singular(&single_item, 1);
+  EXPECT_FALSE(singular.empty());
+  EXPECT_EQ(1u, singular.size());
+  EXPECT_EQ(sizeof(TypeParam), singular.size_bytes());
+  EXPECT_EQ(singular.begin() + 1, singular.end());
+  EXPECT_EQ(42, singular[0]);
+}
+
+TYPED_TEST(SpanTest, FiveItems) {
+  std::vector<TypeParam> test_input = {31, 32, 33, 34, 35};
+  span<TypeParam> five_items(test_input.data(), 5);
+  EXPECT_FALSE(five_items.empty());
+  EXPECT_EQ(5u, five_items.size());
+  EXPECT_EQ(sizeof(TypeParam) * 5, five_items.size_bytes());
+  EXPECT_EQ(five_items.begin() + 5, five_items.end());
+  EXPECT_EQ(31, five_items[0]);
+  EXPECT_EQ(32, five_items[1]);
+  EXPECT_EQ(33, five_items[2]);
+  EXPECT_EQ(34, five_items[3]);
+  EXPECT_EQ(35, five_items[4]);
+  span<TypeParam> three_items = five_items.subspan(2);
+  EXPECT_EQ(3u, three_items.size());
+  EXPECT_EQ(33, three_items[0]);
+  EXPECT_EQ(34, three_items[1]);
+  EXPECT_EQ(35, three_items[2]);
+  span<TypeParam> two_items = five_items.subspan(2, 2);
+  EXPECT_EQ(2u, two_items.size());
+  EXPECT_EQ(33, two_items[0]);
+  EXPECT_EQ(34, two_items[1]);
+}
+
+TEST(SpanFromTest, FromConstCharAndLiteral) {
+  // Testing this is useful because strlen(nullptr) is undefined.
+  EXPECT_EQ(nullptr, SpanFrom(nullptr).data());
+  EXPECT_EQ(0u, SpanFrom(nullptr).size());
+
+  const char* kEmpty = "";
+  EXPECT_EQ(kEmpty, reinterpret_cast<const char*>(SpanFrom(kEmpty).data()));
+  EXPECT_EQ(0u, SpanFrom(kEmpty).size());
+
+  const char* kFoo = "foo";
+  EXPECT_EQ(kFoo, reinterpret_cast<const char*>(SpanFrom(kFoo).data()));
+  EXPECT_EQ(3u, SpanFrom(kFoo).size());
+
+  EXPECT_EQ(3u, SpanFrom("foo").size());
+}
+
+TEST(SpanFromTest, FromVectorUint8AndUint16) {
+  std::vector<uint8_t> foo = {'f', 'o', 'o'};
+  span<uint8_t> foo_span = SpanFrom(foo);
+  EXPECT_EQ(foo.size(), foo_span.size());
+
+  std::vector<uint16_t> bar = {0xff, 0xef, 0xeb};
+  span<uint16_t> bar_span = SpanFrom(bar);
+  EXPECT_EQ(bar.size(), bar_span.size());
+}
+
+TEST(SpanComparisons, ByteWiseLexicographicalOrder) {
+  // Compare the empty span.
+  EXPECT_FALSE(SpanLessThan(span<uint8_t>(), span<uint8_t>()));
+  EXPECT_TRUE(SpanEquals(span<uint8_t>(), span<uint8_t>()));
+
+  // Compare message with itself.
+  std::string msg = "Hello, world";
+  EXPECT_FALSE(SpanLessThan(SpanFrom(msg), SpanFrom(msg)));
+  EXPECT_TRUE(SpanEquals(SpanFrom(msg), SpanFrom(msg)));
+
+  // Compare message and copy.
+  EXPECT_FALSE(SpanLessThan(SpanFrom(msg), SpanFrom(std::string(msg))));
+  EXPECT_TRUE(SpanEquals(SpanFrom(msg), SpanFrom(std::string(msg))));
+
+  // Compare two messages. |lesser_msg| < |msg| because of the first
+  // byte ('A' < 'H').
+  std::string lesser_msg = "A lesser message.";
+  EXPECT_TRUE(SpanLessThan(SpanFrom(lesser_msg), SpanFrom(msg)));
+  EXPECT_FALSE(SpanLessThan(SpanFrom(msg), SpanFrom(lesser_msg)));
+  EXPECT_FALSE(SpanEquals(SpanFrom(msg), SpanFrom(lesser_msg)));
+}
+
+// TODO(johannes): The following shows how the span can be used in an
+// std::unordered_map as a key. Once we have a production usage, we'll move
+// SpanHash, SpanEq, SpanHasher into the header.
+
+// A simple hash code, inspired by http://stackoverflow.com/q/1646807.
+constexpr inline size_t SpanHash(span<uint8_t> s) noexcept {
+  size_t hash = 17;
+  for (uint8_t c : s)
+    hash = 31 * hash + c;
+  return hash;
+}
+
+// Structs for making std::unordered_map with std::span<uint8_t> keys.
+struct SpanEq {
+  constexpr inline bool operator()(span<uint8_t> l, span<uint8_t> r) const {
+    return SpanEquals(l, r);
+  }
+};
+
+struct SpanHasher {
+  constexpr inline size_t operator()(span<uint8_t> s) const {
+    return SpanHash(s);
+  }
+};
+
+TEST(SpanHasherAndSpanEq, SpanAsKeyInUnorderedMap) {
+  // A very simple smoke test for unordered_map, storing three key/value pairs.
+  std::unordered_map<span<uint8_t>, int32_t, SpanHasher, SpanEq> a_map;
+  a_map[SpanFrom("foo")] = 1;
+  a_map[SpanFrom("bar")] = 2;
+  a_map[SpanFrom("baz")] = 3;
+  EXPECT_EQ(3u, a_map.size());
+  EXPECT_EQ(1, a_map[SpanFrom("foo")]);
+  EXPECT_EQ(2, a_map[SpanFrom("bar")]);
+  EXPECT_EQ(3, a_map[SpanFrom("baz")]);
+}
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/status.cc b/deps/v8/third_party/inspector_protocol/crdtp/status.cc
new file mode 100644
index 00000000000000..57cb7959859418
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/status.cc
@@ -0,0 +1,108 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "status.h"
+
+namespace v8_crdtp {
+// =============================================================================
+// Status and Error codes
+// =============================================================================
+
+std::string Status::ToASCIIString() const {
+  switch (error) {
+    case Error::OK:
+      return "OK";
+    case Error::JSON_PARSER_UNPROCESSED_INPUT_REMAINS:
+      return ToASCIIString("JSON: unprocessed input remains");
+    case Error::JSON_PARSER_STACK_LIMIT_EXCEEDED:
+      return ToASCIIString("JSON: stack limit exceeded");
+    case Error::JSON_PARSER_NO_INPUT:
+      return ToASCIIString("JSON: no input");
+    case Error::JSON_PARSER_INVALID_TOKEN:
+      return ToASCIIString("JSON: invalid token");
+    case Error::JSON_PARSER_INVALID_NUMBER:
+      return ToASCIIString("JSON: invalid number");
+    case Error::JSON_PARSER_INVALID_STRING:
+      return ToASCIIString("JSON: invalid string");
+    case Error::JSON_PARSER_UNEXPECTED_ARRAY_END:
+      return ToASCIIString("JSON: unexpected array end");
+    case Error::JSON_PARSER_COMMA_OR_ARRAY_END_EXPECTED:
+      return ToASCIIString("JSON: comma or array end expected");
+    case Error::JSON_PARSER_STRING_LITERAL_EXPECTED:
+      return ToASCIIString("JSON: string literal expected");
+    case Error::JSON_PARSER_COLON_EXPECTED:
+      return ToASCIIString("JSON: colon expected");
+    case Error::JSON_PARSER_UNEXPECTED_MAP_END:
+      return ToASCIIString("JSON: unexpected map end");
+    case Error::JSON_PARSER_COMMA_OR_MAP_END_EXPECTED:
+      return ToASCIIString("JSON: comma or map end expected");
+    case Error::JSON_PARSER_VALUE_EXPECTED:
+      return ToASCIIString("JSON: value expected");
+
+    case Error::CBOR_INVALID_INT32:
+      return ToASCIIString("CBOR: invalid int32");
+    case Error::CBOR_INVALID_DOUBLE:
+      return ToASCIIString("CBOR: invalid double");
+    case Error::CBOR_INVALID_ENVELOPE:
+      return ToASCIIString("CBOR: invalid envelope");
+    case Error::CBOR_ENVELOPE_CONTENTS_LENGTH_MISMATCH:
+      return ToASCIIString("CBOR: envelope contents length mismatch");
+    case Error::CBOR_MAP_OR_ARRAY_EXPECTED_IN_ENVELOPE:
+      return ToASCIIString("CBOR: map or array expected in envelope");
+    case Error::CBOR_INVALID_STRING8:
+      return ToASCIIString("CBOR: invalid string8");
+    case Error::CBOR_INVALID_STRING16:
+      return ToASCIIString("CBOR: invalid string16");
+    case Error::CBOR_INVALID_BINARY:
+      return ToASCIIString("CBOR: invalid binary");
+    case Error::CBOR_UNSUPPORTED_VALUE:
+      return ToASCIIString("CBOR: unsupported value");
+    case Error::CBOR_NO_INPUT:
+      return ToASCIIString("CBOR: no input");
+    case Error::CBOR_INVALID_START_BYTE:
+      return ToASCIIString("CBOR: invalid start byte");
+    case Error::CBOR_UNEXPECTED_EOF_EXPECTED_VALUE:
+      return ToASCIIString("CBOR: unexpected eof expected value");
+    case Error::CBOR_UNEXPECTED_EOF_IN_ARRAY:
+      return ToASCIIString("CBOR: unexpected eof in array");
+    case Error::CBOR_UNEXPECTED_EOF_IN_MAP:
+      return ToASCIIString("CBOR: unexpected eof in map");
+    case Error::CBOR_INVALID_MAP_KEY:
+      return ToASCIIString("CBOR: invalid map key");
+    case Error::CBOR_STACK_LIMIT_EXCEEDED:
+      return ToASCIIString("CBOR: stack limit exceeded");
+    case Error::CBOR_TRAILING_JUNK:
+      return ToASCIIString("CBOR: trailing junk");
+    case Error::CBOR_MAP_START_EXPECTED:
+      return ToASCIIString("CBOR: map start expected");
+    case Error::CBOR_MAP_STOP_EXPECTED:
+      return ToASCIIString("CBOR: map stop expected");
+    case Error::CBOR_ARRAY_START_EXPECTED:
+      return ToASCIIString("CBOR: array start expected");
+    case Error::CBOR_ENVELOPE_SIZE_LIMIT_EXCEEDED:
+      return ToASCIIString("CBOR: envelope size limit exceeded");
+
+    case Error::BINDINGS_MANDATORY_FIELD_MISSING:
+      return ToASCIIString("BINDINGS: mandatory field missing");
+    case Error::BINDINGS_BOOL_VALUE_EXPECTED:
+      return ToASCIIString("BINDINGS: bool value expected");
+    case Error::BINDINGS_INT32_VALUE_EXPECTED:
+      return ToASCIIString("BINDINGS: int32 value expected");
+    case Error::BINDINGS_DOUBLE_VALUE_EXPECTED:
+      return ToASCIIString("BINDINGS: double value expected");
+    case Error::BINDINGS_STRING_VALUE_EXPECTED:
+      return ToASCIIString("BINDINGS: string value expected");
+    case Error::BINDINGS_STRING8_VALUE_EXPECTED:
+      return ToASCIIString("BINDINGS: string8 value expected");
+    case Error::BINDINGS_BINARY_VALUE_EXPECTED:
+      return ToASCIIString("BINDINGS: binary value expected");
+  }
+  // Some compilers can't figure out that we can't get here.
+  return "INVALID ERROR CODE";
+}
+
+std::string Status::ToASCIIString(const char* msg) const {
+  return std::string(msg) + " at position " + std::to_string(pos);
+}
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/status.h b/deps/v8/third_party/inspector_protocol/crdtp/status.h
new file mode 100644
index 00000000000000..bf75615c09e97a
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/status.h
@@ -0,0 +1,88 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_CRDTP_STATUS_H_
+#define V8_CRDTP_STATUS_H_
+
+#include <cstddef>
+#include <limits>
+#include <string>
+
+#include "export.h"
+
+namespace v8_crdtp {
+// =============================================================================
+// Status and Error codes
+// =============================================================================
+
+enum class Error {
+  OK = 0,
+  // JSON parsing errors - json_parser.{h,cc}.
+  JSON_PARSER_UNPROCESSED_INPUT_REMAINS = 0x01,
+  JSON_PARSER_STACK_LIMIT_EXCEEDED = 0x02,
+  JSON_PARSER_NO_INPUT = 0x03,
+  JSON_PARSER_INVALID_TOKEN = 0x04,
+  JSON_PARSER_INVALID_NUMBER = 0x05,
+  JSON_PARSER_INVALID_STRING = 0x06,
+  JSON_PARSER_UNEXPECTED_ARRAY_END = 0x07,
+  JSON_PARSER_COMMA_OR_ARRAY_END_EXPECTED = 0x08,
+  JSON_PARSER_STRING_LITERAL_EXPECTED = 0x09,
+  JSON_PARSER_COLON_EXPECTED = 0x0a,
+  JSON_PARSER_UNEXPECTED_MAP_END = 0x0b,
+  JSON_PARSER_COMMA_OR_MAP_END_EXPECTED = 0x0c,
+  JSON_PARSER_VALUE_EXPECTED = 0x0d,
+
+  CBOR_INVALID_INT32 = 0x0e,
+  CBOR_INVALID_DOUBLE = 0x0f,
+  CBOR_INVALID_ENVELOPE = 0x10,
+  CBOR_ENVELOPE_CONTENTS_LENGTH_MISMATCH = 0x11,
+  CBOR_MAP_OR_ARRAY_EXPECTED_IN_ENVELOPE = 0x12,
+  CBOR_INVALID_STRING8 = 0x13,
+  CBOR_INVALID_STRING16 = 0x14,
+  CBOR_INVALID_BINARY = 0x15,
+  CBOR_UNSUPPORTED_VALUE = 0x16,
+  CBOR_NO_INPUT = 0x17,
+  CBOR_INVALID_START_BYTE = 0x18,
+  CBOR_UNEXPECTED_EOF_EXPECTED_VALUE = 0x19,
+  CBOR_UNEXPECTED_EOF_IN_ARRAY = 0x1a,
+  CBOR_UNEXPECTED_EOF_IN_MAP = 0x1b,
+  CBOR_INVALID_MAP_KEY = 0x1c,
+  CBOR_STACK_LIMIT_EXCEEDED = 0x1d,
+  CBOR_TRAILING_JUNK = 0x1e,
+  CBOR_MAP_START_EXPECTED = 0x1f,
+  CBOR_MAP_STOP_EXPECTED = 0x20,
+  CBOR_ARRAY_START_EXPECTED = 0x21,
+  CBOR_ENVELOPE_SIZE_LIMIT_EXCEEDED = 0x22,
+
+  BINDINGS_MANDATORY_FIELD_MISSING = 0x23,
+  BINDINGS_BOOL_VALUE_EXPECTED = 0x24,
+  BINDINGS_INT32_VALUE_EXPECTED = 0x25,
+  BINDINGS_DOUBLE_VALUE_EXPECTED = 0x26,
+  BINDINGS_STRING_VALUE_EXPECTED = 0x27,
+  BINDINGS_STRING8_VALUE_EXPECTED = 0x28,
+  BINDINGS_BINARY_VALUE_EXPECTED = 0x29,
+};
+
+// A status value with position that can be copied. The default status
+// is OK. Usually, error status values should come with a valid position.
+struct Status {
+  static constexpr size_t npos() { return std::numeric_limits<size_t>::max(); }
+
+  bool ok() const { return error == Error::OK; }
+
+  Error error = Error::OK;
+  size_t pos = npos();
+  Status(Error error, size_t pos) : error(error), pos(pos) {}
+  Status() = default;
+
+  // Returns a 7 bit US-ASCII string, either "OK" or an error message
+  // that includes the position.
+  std::string ToASCIIString() const;
+
+ private:
+  std::string ToASCIIString(const char* msg) const;
+};
+}  // namespace v8_crdtp
+
+#endif  // V8_CRDTP_STATUS_H_
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/status_test.cc b/deps/v8/third_party/inspector_protocol/crdtp/status_test.cc
new file mode 100644
index 00000000000000..420686c72fe4a7
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/status_test.cc
@@ -0,0 +1,29 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "status.h"
+#include "status_test_support.h"
+#include "test_platform.h"
+
+namespace v8_crdtp {
+// =============================================================================
+// Status and Error codes
+// =============================================================================
+
+TEST(StatusTest, StatusToASCIIString) {
+  Status ok_status;
+  EXPECT_EQ("OK", ok_status.ToASCIIString());
+  Status json_error(Error::JSON_PARSER_COLON_EXPECTED, 42);
+  EXPECT_EQ("JSON: colon expected at position 42", json_error.ToASCIIString());
+  Status cbor_error(Error::CBOR_TRAILING_JUNK, 21);
+  EXPECT_EQ("CBOR: trailing junk at position 21", cbor_error.ToASCIIString());
+}
+
+TEST(StatusTest, StatusTestSupport) {
+  Status ok_status;
+  EXPECT_THAT(ok_status, StatusIsOk());
+  Status json_error(Error::JSON_PARSER_COLON_EXPECTED, 42);
+  EXPECT_THAT(json_error, StatusIs(Error::JSON_PARSER_COLON_EXPECTED, 42));
+}
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/status_test_support.cc b/deps/v8/third_party/inspector_protocol/crdtp/status_test_support.cc
new file mode 100644
index 00000000000000..00362db24b6ede
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/status_test_support.cc
@@ -0,0 +1,50 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "status_test_support.h"
+
+namespace v8_crdtp {
+void PrintTo(const Status& status, std::ostream* os) {
+  *os << status.ToASCIIString() << " (error: 0x" << std::hex
+      << static_cast<int>(status.error) << ", "
+      << "pos: " << std::dec << status.pos << ")";
+}
+
+namespace {
+class StatusIsMatcher : public testing::MatcherInterface<Status> {
+ public:
+  explicit StatusIsMatcher(Status status) : expected_(status) {}
+
+  bool MatchAndExplain(Status status,
+                       testing::MatchResultListener* listener) const override {
+    return status.error == expected_.error && status.pos == expected_.pos;
+  }
+
+  void DescribeTo(std::ostream* os) const override {
+    *os << "equals to ";
+    PrintTo(expected_, os);
+  }
+
+ private:
+  Status expected_;
+};
+
+class StatusIsOkMatcher : public testing::MatcherInterface<Status> {
+  bool MatchAndExplain(Status status,
+                       testing::MatchResultListener* listener) const override {
+    return status.ok();
+  }
+
+  void DescribeTo(std::ostream* os) const override { *os << "is ok"; }
+};
+}  // namespace
+
+testing::Matcher<Status> StatusIsOk() {
+  return MakeMatcher(new StatusIsOkMatcher());
+}
+
+testing::Matcher<Status> StatusIs(Error error, size_t pos) {
+  return MakeMatcher(new StatusIsMatcher(Status(error, pos)));
+}
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/status_test_support.h b/deps/v8/third_party/inspector_protocol/crdtp/status_test_support.h
new file mode 100644
index 00000000000000..e9eef19a6852e0
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/status_test_support.h
@@ -0,0 +1,32 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_CRDTP_STATUS_TEST_SUPPORT_H_
+#define V8_CRDTP_STATUS_TEST_SUPPORT_H_
+
+#include <ostream>
+#include "status.h"
+#include "test_platform.h"
+
+namespace v8_crdtp {
+// Supports gtest, to conveniently match Status objects and
+// get useful error messages when tests fail.
+// Typically used with EXPECT_THAT, e.g.
+//
+// EXPECT_THAT(status, StatusIs(Error::JSON_PARSER_COLON_EXPECTED, 42));
+//
+// EXPECT_THAT(status, StatusIsOk());
+
+// Prints a |status|, including its generated error message, error code, and
+// position. This is used by gtest for pretty printing actual vs. expected.
+void PrintTo(const Status& status, std::ostream* os);
+
+// Matches any status with |status.ok()|.
+testing::Matcher<Status> StatusIsOk();
+
+// Matches any status with |error| and |pos|.
+testing::Matcher<Status> StatusIs(Error error, size_t pos);
+}  // namespace v8_crdtp
+
+#endif  // V8_CRDTP_STATUS_TEST_SUPPORT_H_
diff --git a/deps/v8/third_party/inspector_protocol/crdtp/test_platform.h b/deps/v8/third_party/inspector_protocol/crdtp/test_platform.h
new file mode 100644
index 00000000000000..c7dc7a8a7aa7b4
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/crdtp/test_platform.h
@@ -0,0 +1,26 @@
+// Copyright 2019 The V8 Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This file is V8 specific. It's not rolled from the upstream project.
+
+#ifndef V8_INSPECTOR_PROTOCOL_CRDTP_TEST_PLATFORM_H_
+#define V8_INSPECTOR_PROTOCOL_CRDTP_TEST_PLATFORM_H_
+
+#include <string>
+#include <vector>
+
+#include "span.h"
+#include "src/base/logging.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace v8_crdtp {
+
+std::string UTF16ToUTF8(span<uint16_t> in);
+
+std::vector<uint16_t> UTF8ToUTF16(span<uint8_t> in);
+
+}  // namespace v8_crdtp
+
+#endif  // V8_INSPECTOR_PROTOCOL_CRDTP_TEST_PLATFORM_H_
diff --git a/deps/v8/third_party/inspector_protocol/encoding/encoding_test_helper.h b/deps/v8/third_party/inspector_protocol/crdtp/test_platform_v8.cc
similarity index 50%
rename from deps/v8/third_party/inspector_protocol/encoding/encoding_test_helper.h
rename to deps/v8/third_party/inspector_protocol/crdtp/test_platform_v8.cc
index 84da2e72e87f5c..51752772edb85e 100644
--- a/deps/v8/third_party/inspector_protocol/encoding/encoding_test_helper.h
+++ b/deps/v8/third_party/inspector_protocol/crdtp/test_platform_v8.cc
@@ -2,21 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// This file is V8 specific, to make encoding_test.cc work.
-// It is not rolled from the upstream project.
+// This file is V8 specific. It's not rolled from the upstream project.
 
-#ifndef V8_INSPECTOR_PROTOCOL_ENCODING_ENCODING_TEST_HELPER_H_
-#define V8_INSPECTOR_PROTOCOL_ENCODING_ENCODING_TEST_HELPER_H_
+#include "test_platform.h"
 
-#include <string>
-#include <vector>
-
-#include "src/base/logging.h"
 #include "src/inspector/v8-string-conversions.h"
-#include "testing/gmock/include/gmock/gmock.h"
-#include "testing/gtest/include/gtest/gtest.h"
 
-namespace v8_inspector_protocol_encoding {
+namespace v8_crdtp {
 
 std::string UTF16ToUTF8(span<uint16_t> in) {
   return v8_inspector::UTF16ToUTF8(in.data(), in.size());
@@ -28,6 +20,4 @@ std::vector<uint16_t> UTF8ToUTF16(span<uint8_t> in) {
   return std::vector<uint16_t>(utf16.begin(), utf16.end());
 }
 
-}  // namespace v8_inspector_protocol_encoding
-
-#endif  // V8_INSPECTOR_PROTOCOL_ENCODING_ENCODING_TEST_HELPER_H_
+}  // namespace v8_crdtp
diff --git a/deps/v8/third_party/inspector_protocol/encoding/encoding.cc b/deps/v8/third_party/inspector_protocol/encoding/encoding.cc
deleted file mode 100644
index fcefb8dbb9c62d..00000000000000
--- a/deps/v8/third_party/inspector_protocol/encoding/encoding.cc
+++ /dev/null
@@ -1,2257 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "encoding.h"
-
-#include <algorithm>
-#include <cassert>
-#include <cmath>
-#include <cstring>
-#include <limits>
-#include <stack>
-
-namespace v8_inspector_protocol_encoding {
-// =============================================================================
-// Status and Error codes
-// =============================================================================
-
-std::string Status::ToASCIIString() const {
-  switch (error) {
-    case Error::OK:
-      return "OK";
-    case Error::JSON_PARSER_UNPROCESSED_INPUT_REMAINS:
-      return ToASCIIString("JSON: unprocessed input remains");
-    case Error::JSON_PARSER_STACK_LIMIT_EXCEEDED:
-      return ToASCIIString("JSON: stack limit exceeded");
-    case Error::JSON_PARSER_NO_INPUT:
-      return ToASCIIString("JSON: no input");
-    case Error::JSON_PARSER_INVALID_TOKEN:
-      return ToASCIIString("JSON: invalid token");
-    case Error::JSON_PARSER_INVALID_NUMBER:
-      return ToASCIIString("JSON: invalid number");
-    case Error::JSON_PARSER_INVALID_STRING:
-      return ToASCIIString("JSON: invalid string");
-    case Error::JSON_PARSER_UNEXPECTED_ARRAY_END:
-      return ToASCIIString("JSON: unexpected array end");
-    case Error::JSON_PARSER_COMMA_OR_ARRAY_END_EXPECTED:
-      return ToASCIIString("JSON: comma or array end expected");
-    case Error::JSON_PARSER_STRING_LITERAL_EXPECTED:
-      return ToASCIIString("JSON: string literal expected");
-    case Error::JSON_PARSER_COLON_EXPECTED:
-      return ToASCIIString("JSON: colon expected");
-    case Error::JSON_PARSER_UNEXPECTED_MAP_END:
-      return ToASCIIString("JSON: unexpected map end");
-    case Error::JSON_PARSER_COMMA_OR_MAP_END_EXPECTED:
-      return ToASCIIString("JSON: comma or map end expected");
-    case Error::JSON_PARSER_VALUE_EXPECTED:
-      return ToASCIIString("JSON: value expected");
-
-    case Error::CBOR_INVALID_INT32:
-      return ToASCIIString("CBOR: invalid int32");
-    case Error::CBOR_INVALID_DOUBLE:
-      return ToASCIIString("CBOR: invalid double");
-    case Error::CBOR_INVALID_ENVELOPE:
-      return ToASCIIString("CBOR: invalid envelope");
-    case Error::CBOR_ENVELOPE_CONTENTS_LENGTH_MISMATCH:
-      return ToASCIIString("CBOR: envelope contents length mismatch");
-    case Error::CBOR_MAP_OR_ARRAY_EXPECTED_IN_ENVELOPE:
-      return ToASCIIString("CBOR: map or array expected in envelope");
-    case Error::CBOR_INVALID_STRING8:
-      return ToASCIIString("CBOR: invalid string8");
-    case Error::CBOR_INVALID_STRING16:
-      return ToASCIIString("CBOR: invalid string16");
-    case Error::CBOR_INVALID_BINARY:
-      return ToASCIIString("CBOR: invalid binary");
-    case Error::CBOR_UNSUPPORTED_VALUE:
-      return ToASCIIString("CBOR: unsupported value");
-    case Error::CBOR_NO_INPUT:
-      return ToASCIIString("CBOR: no input");
-    case Error::CBOR_INVALID_START_BYTE:
-      return ToASCIIString("CBOR: invalid start byte");
-    case Error::CBOR_UNEXPECTED_EOF_EXPECTED_VALUE:
-      return ToASCIIString("CBOR: unexpected eof expected value");
-    case Error::CBOR_UNEXPECTED_EOF_IN_ARRAY:
-      return ToASCIIString("CBOR: unexpected eof in array");
-    case Error::CBOR_UNEXPECTED_EOF_IN_MAP:
-      return ToASCIIString("CBOR: unexpected eof in map");
-    case Error::CBOR_INVALID_MAP_KEY:
-      return ToASCIIString("CBOR: invalid map key");
-    case Error::CBOR_STACK_LIMIT_EXCEEDED:
-      return ToASCIIString("CBOR: stack limit exceeded");
-    case Error::CBOR_TRAILING_JUNK:
-      return ToASCIIString("CBOR: trailing junk");
-    case Error::CBOR_MAP_START_EXPECTED:
-      return ToASCIIString("CBOR: map start expected");
-    case Error::CBOR_MAP_STOP_EXPECTED:
-      return ToASCIIString("CBOR: map stop expected");
-    case Error::CBOR_ARRAY_START_EXPECTED:
-      return ToASCIIString("CBOR: array start expected");
-    case Error::CBOR_ENVELOPE_SIZE_LIMIT_EXCEEDED:
-      return ToASCIIString("CBOR: envelope size limit exceeded");
-
-    case Error::BINDINGS_MANDATORY_FIELD_MISSING:
-      return ToASCIIString("BINDINGS: mandatory field missing");
-    case Error::BINDINGS_BOOL_VALUE_EXPECTED:
-      return ToASCIIString("BINDINGS: bool value expected");
-    case Error::BINDINGS_INT32_VALUE_EXPECTED:
-      return ToASCIIString("BINDINGS: int32 value expected");
-    case Error::BINDINGS_DOUBLE_VALUE_EXPECTED:
-      return ToASCIIString("BINDINGS: double value expected");
-    case Error::BINDINGS_STRING_VALUE_EXPECTED:
-      return ToASCIIString("BINDINGS: string value expected");
-    case Error::BINDINGS_STRING8_VALUE_EXPECTED:
-      return ToASCIIString("BINDINGS: string8 value expected");
-    case Error::BINDINGS_BINARY_VALUE_EXPECTED:
-      return ToASCIIString("BINDINGS: binary value expected");
-  }
-  // Some compilers can't figure out that we can't get here.
-  return "INVALID ERROR CODE";
-}
-
-std::string Status::ToASCIIString(const char* msg) const {
-  return std::string(msg) + " at position " + std::to_string(pos);
-}
-
-namespace cbor {
-namespace {
-// Indicates the number of bits the "initial byte" needs to be shifted to the
-// right after applying |kMajorTypeMask| to produce the major type in the
-// lowermost bits.
-static constexpr uint8_t kMajorTypeBitShift = 5u;
-// Mask selecting the low-order 5 bits of the "initial byte", which is where
-// the additional information is encoded.
-static constexpr uint8_t kAdditionalInformationMask = 0x1f;
-// Mask selecting the high-order 3 bits of the "initial byte", which indicates
-// the major type of the encoded value.
-static constexpr uint8_t kMajorTypeMask = 0xe0;
-// Indicates the integer is in the following byte.
-static constexpr uint8_t kAdditionalInformation1Byte = 24u;
-// Indicates the integer is in the next 2 bytes.
-static constexpr uint8_t kAdditionalInformation2Bytes = 25u;
-// Indicates the integer is in the next 4 bytes.
-static constexpr uint8_t kAdditionalInformation4Bytes = 26u;
-// Indicates the integer is in the next 8 bytes.
-static constexpr uint8_t kAdditionalInformation8Bytes = 27u;
-
-// Encodes the initial byte, consisting of the |type| in the first 3 bits
-// followed by 5 bits of |additional_info|.
-constexpr uint8_t EncodeInitialByte(MajorType type, uint8_t additional_info) {
-  return (static_cast<uint8_t>(type) << kMajorTypeBitShift) |
-         (additional_info & kAdditionalInformationMask);
-}
-
-// TAG 24 indicates that what follows is a byte string which is
-// encoded in CBOR format. We use this as a wrapper for
-// maps and arrays, allowing us to skip them, because the
-// byte string carries its size (byte length).
-// https://tools.ietf.org/html/rfc7049#section-2.4.4.1
-static constexpr uint8_t kInitialByteForEnvelope =
-    EncodeInitialByte(MajorType::TAG, 24);
-// The initial byte for a byte string with at most 2^32 bytes
-// of payload. This is used for envelope encoding, even if
-// the byte string is shorter.
-static constexpr uint8_t kInitialByteFor32BitLengthByteString =
-    EncodeInitialByte(MajorType::BYTE_STRING, 26);
-
-// See RFC 7049 Section 2.2.1, indefinite length arrays / maps have additional
-// info = 31.
-static constexpr uint8_t kInitialByteIndefiniteLengthArray =
-    EncodeInitialByte(MajorType::ARRAY, 31);
-static constexpr uint8_t kInitialByteIndefiniteLengthMap =
-    EncodeInitialByte(MajorType::MAP, 31);
-// See RFC 7049 Section 2.3, Table 1; this is used for finishing indefinite
-// length maps / arrays.
-static constexpr uint8_t kStopByte =
-    EncodeInitialByte(MajorType::SIMPLE_VALUE, 31);
-
-// See RFC 7049 Section 2.3, Table 2.
-static constexpr uint8_t kEncodedTrue =
-    EncodeInitialByte(MajorType::SIMPLE_VALUE, 21);
-static constexpr uint8_t kEncodedFalse =
-    EncodeInitialByte(MajorType::SIMPLE_VALUE, 20);
-static constexpr uint8_t kEncodedNull =
-    EncodeInitialByte(MajorType::SIMPLE_VALUE, 22);
-static constexpr uint8_t kInitialByteForDouble =
-    EncodeInitialByte(MajorType::SIMPLE_VALUE, 27);
-
-// See RFC 7049 Table 3 and Section 2.4.4.2. This is used as a prefix for
-// arbitrary binary data encoded as BYTE_STRING.
-static constexpr uint8_t kExpectedConversionToBase64Tag =
-    EncodeInitialByte(MajorType::TAG, 22);
-
-// Writes the bytes for |v| to |out|, starting with the most significant byte.
-// See also: https://commandcenter.blogspot.com/2012/04/byte-order-fallacy.html
-template <typename T, class C>
-void WriteBytesMostSignificantByteFirst(T v, C* out) {
-  for (int shift_bytes = sizeof(T) - 1; shift_bytes >= 0; --shift_bytes)
-    out->push_back(0xff & (v >> (shift_bytes * 8)));
-}
-
-// Extracts sizeof(T) bytes from |in| to extract a value of type T
-// (e.g. uint64_t, uint32_t, ...), most significant byte first.
-// See also: https://commandcenter.blogspot.com/2012/04/byte-order-fallacy.html
-template <typename T>
-T ReadBytesMostSignificantByteFirst(span<uint8_t> in) {
-  assert(in.size() >= sizeof(T));
-  T result = 0;
-  for (size_t shift_bytes = 0; shift_bytes < sizeof(T); ++shift_bytes)
-    result |= T(in[sizeof(T) - 1 - shift_bytes]) << (shift_bytes * 8);
-  return result;
-}
-}  // namespace
-
-namespace internals {
-// Reads the start of a token with definitive size from |bytes|.
-// |type| is the major type as specified in RFC 7049 Section 2.1.
-// |value| is the payload (e.g. for MajorType::UNSIGNED) or is the size
-// (e.g. for BYTE_STRING).
-// If successful, returns the number of bytes read. Otherwise returns 0.
-size_t ReadTokenStart(span<uint8_t> bytes, MajorType* type, uint64_t* value) {
-  if (bytes.empty())
-    return 0;
-  uint8_t initial_byte = bytes[0];
-  *type = MajorType((initial_byte & kMajorTypeMask) >> kMajorTypeBitShift);
-
-  uint8_t additional_information = initial_byte & kAdditionalInformationMask;
-  if (additional_information < 24) {
-    // Values 0-23 are encoded directly into the additional info of the
-    // initial byte.
-    *value = additional_information;
-    return 1;
-  }
-  if (additional_information == kAdditionalInformation1Byte) {
-    // Values 24-255 are encoded with one initial byte, followed by the value.
-    if (bytes.size() < 2)
-      return 0;
-    *value = ReadBytesMostSignificantByteFirst<uint8_t>(bytes.subspan(1));
-    return 2;
-  }
-  if (additional_information == kAdditionalInformation2Bytes) {
-    // Values 256-65535: 1 initial byte + 2 bytes payload.
-    if (bytes.size() < 1 + sizeof(uint16_t))
-      return 0;
-    *value = ReadBytesMostSignificantByteFirst<uint16_t>(bytes.subspan(1));
-    return 3;
-  }
-  if (additional_information == kAdditionalInformation4Bytes) {
-    // 32 bit uint: 1 initial byte + 4 bytes payload.
-    if (bytes.size() < 1 + sizeof(uint32_t))
-      return 0;
-    *value = ReadBytesMostSignificantByteFirst<uint32_t>(bytes.subspan(1));
-    return 5;
-  }
-  if (additional_information == kAdditionalInformation8Bytes) {
-    // 64 bit uint: 1 initial byte + 8 bytes payload.
-    if (bytes.size() < 1 + sizeof(uint64_t))
-      return 0;
-    *value = ReadBytesMostSignificantByteFirst<uint64_t>(bytes.subspan(1));
-    return 9;
-  }
-  return 0;
-}
-
-// Writes the start of a token with |type|. The |value| may indicate the size,
-// or it may be the payload if the value is an unsigned integer.
-template <typename C>
-void WriteTokenStartTmpl(MajorType type, uint64_t value, C* encoded) {
-  if (value < 24) {
-    // Values 0-23 are encoded directly into the additional info of the
-    // initial byte.
-    encoded->push_back(EncodeInitialByte(type, /*additional_info=*/value));
-    return;
-  }
-  if (value <= std::numeric_limits<uint8_t>::max()) {
-    // Values 24-255 are encoded with one initial byte, followed by the value.
-    encoded->push_back(EncodeInitialByte(type, kAdditionalInformation1Byte));
-    encoded->push_back(value);
-    return;
-  }
-  if (value <= std::numeric_limits<uint16_t>::max()) {
-    // Values 256-65535: 1 initial byte + 2 bytes payload.
-    encoded->push_back(EncodeInitialByte(type, kAdditionalInformation2Bytes));
-    WriteBytesMostSignificantByteFirst<uint16_t>(value, encoded);
-    return;
-  }
-  if (value <= std::numeric_limits<uint32_t>::max()) {
-    // 32 bit uint: 1 initial byte + 4 bytes payload.
-    encoded->push_back(EncodeInitialByte(type, kAdditionalInformation4Bytes));
-    WriteBytesMostSignificantByteFirst<uint32_t>(static_cast<uint32_t>(value),
-                                                 encoded);
-    return;
-  }
-  // 64 bit uint: 1 initial byte + 8 bytes payload.
-  encoded->push_back(EncodeInitialByte(type, kAdditionalInformation8Bytes));
-  WriteBytesMostSignificantByteFirst<uint64_t>(value, encoded);
-}
-void WriteTokenStart(MajorType type,
-                     uint64_t value,
-                     std::vector<uint8_t>* encoded) {
-  WriteTokenStartTmpl(type, value, encoded);
-}
-void WriteTokenStart(MajorType type, uint64_t value, std::string* encoded) {
-  WriteTokenStartTmpl(type, value, encoded);
-}
-}  // namespace internals
-
-// =============================================================================
-// Detecting CBOR content
-// =============================================================================
-
-uint8_t InitialByteForEnvelope() {
-  return kInitialByteForEnvelope;
-}
-uint8_t InitialByteFor32BitLengthByteString() {
-  return kInitialByteFor32BitLengthByteString;
-}
-bool IsCBORMessage(span<uint8_t> msg) {
-  return msg.size() >= 6 && msg[0] == InitialByteForEnvelope() &&
-         msg[1] == InitialByteFor32BitLengthByteString();
-}
-
-// =============================================================================
-// Encoding invidiual CBOR items
-// =============================================================================
-
-uint8_t EncodeTrue() {
-  return kEncodedTrue;
-}
-uint8_t EncodeFalse() {
-  return kEncodedFalse;
-}
-uint8_t EncodeNull() {
-  return kEncodedNull;
-}
-
-uint8_t EncodeIndefiniteLengthArrayStart() {
-  return kInitialByteIndefiniteLengthArray;
-}
-
-uint8_t EncodeIndefiniteLengthMapStart() {
-  return kInitialByteIndefiniteLengthMap;
-}
-
-uint8_t EncodeStop() {
-  return kStopByte;
-}
-
-template <typename C>
-void EncodeInt32Tmpl(int32_t value, C* out) {
-  if (value >= 0) {
-    internals::WriteTokenStart(MajorType::UNSIGNED, value, out);
-  } else {
-    uint64_t representation = static_cast<uint64_t>(-(value + 1));
-    internals::WriteTokenStart(MajorType::NEGATIVE, representation, out);
-  }
-}
-void EncodeInt32(int32_t value, std::vector<uint8_t>* out) {
-  EncodeInt32Tmpl(value, out);
-}
-void EncodeInt32(int32_t value, std::string* out) {
-  EncodeInt32Tmpl(value, out);
-}
-
-template <typename C>
-void EncodeString16Tmpl(span<uint16_t> in, C* out) {
-  uint64_t byte_length = static_cast<uint64_t>(in.size_bytes());
-  internals::WriteTokenStart(MajorType::BYTE_STRING, byte_length, out);
-  // When emitting UTF16 characters, we always write the least significant byte
-  // first; this is because it's the native representation for X86.
-  // TODO(johannes): Implement a more efficient thing here later, e.g.
-  // casting *iff* the machine has this byte order.
-  // The wire format for UTF16 chars will probably remain the same
-  // (least significant byte first) since this way we can have
-  // golden files, unittests, etc. that port easily and universally.
-  // See also:
-  // https://commandcenter.blogspot.com/2012/04/byte-order-fallacy.html
-  for (const uint16_t two_bytes : in) {
-    out->push_back(two_bytes);
-    out->push_back(two_bytes >> 8);
-  }
-}
-void EncodeString16(span<uint16_t> in, std::vector<uint8_t>* out) {
-  EncodeString16Tmpl(in, out);
-}
-void EncodeString16(span<uint16_t> in, std::string* out) {
-  EncodeString16Tmpl(in, out);
-}
-
-template <typename C>
-void EncodeString8Tmpl(span<uint8_t> in, C* out) {
-  internals::WriteTokenStart(MajorType::STRING,
-                             static_cast<uint64_t>(in.size_bytes()), out);
-  out->insert(out->end(), in.begin(), in.end());
-}
-void EncodeString8(span<uint8_t> in, std::vector<uint8_t>* out) {
-  EncodeString8Tmpl(in, out);
-}
-void EncodeString8(span<uint8_t> in, std::string* out) {
-  EncodeString8Tmpl(in, out);
-}
-
-template <typename C>
-void EncodeFromLatin1Tmpl(span<uint8_t> latin1, C* out) {
-  for (size_t ii = 0; ii < latin1.size(); ++ii) {
-    if (latin1[ii] <= 127)
-      continue;
-    // If there's at least one non-ASCII char, convert to UTF8.
-    std::vector<uint8_t> utf8(latin1.begin(), latin1.begin() + ii);
-    for (; ii < latin1.size(); ++ii) {
-      if (latin1[ii] <= 127) {
-        utf8.push_back(latin1[ii]);
-      } else {
-        // 0xC0 means it's a UTF8 sequence with 2 bytes.
-        utf8.push_back((latin1[ii] >> 6) | 0xc0);
-        utf8.push_back((latin1[ii] | 0x80) & 0xbf);
-      }
-    }
-    EncodeString8(SpanFrom(utf8), out);
-    return;
-  }
-  EncodeString8(latin1, out);
-}
-void EncodeFromLatin1(span<uint8_t> latin1, std::vector<uint8_t>* out) {
-  EncodeFromLatin1Tmpl(latin1, out);
-}
-void EncodeFromLatin1(span<uint8_t> latin1, std::string* out) {
-  EncodeFromLatin1Tmpl(latin1, out);
-}
-
-template <typename C>
-void EncodeFromUTF16Tmpl(span<uint16_t> utf16, C* out) {
-  // If there's at least one non-ASCII char, encode as STRING16 (UTF16).
-  for (uint16_t ch : utf16) {
-    if (ch <= 127)
-      continue;
-    EncodeString16(utf16, out);
-    return;
-  }
-  // It's all US-ASCII, strip out every second byte and encode as UTF8.
-  internals::WriteTokenStart(MajorType::STRING,
-                             static_cast<uint64_t>(utf16.size()), out);
-  out->insert(out->end(), utf16.begin(), utf16.end());
-}
-void EncodeFromUTF16(span<uint16_t> utf16, std::vector<uint8_t>* out) {
-  EncodeFromUTF16Tmpl(utf16, out);
-}
-void EncodeFromUTF16(span<uint16_t> utf16, std::string* out) {
-  EncodeFromUTF16Tmpl(utf16, out);
-}
-
-template <typename C>
-void EncodeBinaryTmpl(span<uint8_t> in, C* out) {
-  out->push_back(kExpectedConversionToBase64Tag);
-  uint64_t byte_length = static_cast<uint64_t>(in.size_bytes());
-  internals::WriteTokenStart(MajorType::BYTE_STRING, byte_length, out);
-  out->insert(out->end(), in.begin(), in.end());
-}
-void EncodeBinary(span<uint8_t> in, std::vector<uint8_t>* out) {
-  EncodeBinaryTmpl(in, out);
-}
-void EncodeBinary(span<uint8_t> in, std::string* out) {
-  EncodeBinaryTmpl(in, out);
-}
-
-// A double is encoded with a specific initial byte
-// (kInitialByteForDouble) plus the 64 bits of payload for its value.
-constexpr size_t kEncodedDoubleSize = 1 + sizeof(uint64_t);
-
-// An envelope is encoded with a specific initial byte
-// (kInitialByteForEnvelope), plus the start byte for a BYTE_STRING with a 32
-// bit wide length, plus a 32 bit length for that string.
-constexpr size_t kEncodedEnvelopeHeaderSize = 1 + 1 + sizeof(uint32_t);
-
-template <typename C>
-void EncodeDoubleTmpl(double value, C* out) {
-  // The additional_info=27 indicates 64 bits for the double follow.
-  // See RFC 7049 Section 2.3, Table 1.
-  out->push_back(kInitialByteForDouble);
-  union {
-    double from_double;
-    uint64_t to_uint64;
-  } reinterpret;
-  reinterpret.from_double = value;
-  WriteBytesMostSignificantByteFirst<uint64_t>(reinterpret.to_uint64, out);
-}
-void EncodeDouble(double value, std::vector<uint8_t>* out) {
-  EncodeDoubleTmpl(value, out);
-}
-void EncodeDouble(double value, std::string* out) {
-  EncodeDoubleTmpl(value, out);
-}
-
-// =============================================================================
-// cbor::EnvelopeEncoder - for wrapping submessages
-// =============================================================================
-
-template <typename C>
-void EncodeStartTmpl(C* out, size_t* byte_size_pos) {
-  assert(*byte_size_pos == 0);
-  out->push_back(kInitialByteForEnvelope);
-  out->push_back(kInitialByteFor32BitLengthByteString);
-  *byte_size_pos = out->size();
-  out->resize(out->size() + sizeof(uint32_t));
-}
-
-void EnvelopeEncoder::EncodeStart(std::vector<uint8_t>* out) {
-  EncodeStartTmpl<std::vector<uint8_t>>(out, &byte_size_pos_);
-}
-
-void EnvelopeEncoder::EncodeStart(std::string* out) {
-  EncodeStartTmpl<std::string>(out, &byte_size_pos_);
-}
-
-template <typename C>
-bool EncodeStopTmpl(C* out, size_t* byte_size_pos) {
-  assert(*byte_size_pos != 0);
-  // The byte size is the size of the payload, that is, all the
-  // bytes that were written past the byte size position itself.
-  uint64_t byte_size = out->size() - (*byte_size_pos + sizeof(uint32_t));
-  // We store exactly 4 bytes, so at most INT32MAX, with most significant
-  // byte first.
-  if (byte_size > std::numeric_limits<uint32_t>::max())
-    return false;
-  for (int shift_bytes = sizeof(uint32_t) - 1; shift_bytes >= 0;
-       --shift_bytes) {
-    (*out)[(*byte_size_pos)++] = 0xff & (byte_size >> (shift_bytes * 8));
-  }
-  return true;
-}
-
-bool EnvelopeEncoder::EncodeStop(std::vector<uint8_t>* out) {
-  return EncodeStopTmpl(out, &byte_size_pos_);
-}
-
-bool EnvelopeEncoder::EncodeStop(std::string* out) {
-  return EncodeStopTmpl(out, &byte_size_pos_);
-}
-
-// =============================================================================
-// cbor::NewCBOREncoder - for encoding from a streaming parser
-// =============================================================================
-
-namespace {
-template <typename C>
-class CBOREncoder : public StreamingParserHandler {
- public:
-  CBOREncoder(C* out, Status* status) : out_(out), status_(status) {
-    *status_ = Status();
-  }
-
-  void HandleMapBegin() override {
-    if (!status_->ok())
-      return;
-    envelopes_.emplace_back();
-    envelopes_.back().EncodeStart(out_);
-    out_->push_back(kInitialByteIndefiniteLengthMap);
-  }
-
-  void HandleMapEnd() override {
-    if (!status_->ok())
-      return;
-    out_->push_back(kStopByte);
-    assert(!envelopes_.empty());
-    if (!envelopes_.back().EncodeStop(out_)) {
-      HandleError(
-          Status(Error::CBOR_ENVELOPE_SIZE_LIMIT_EXCEEDED, out_->size()));
-      return;
-    }
-    envelopes_.pop_back();
-  }
-
-  void HandleArrayBegin() override {
-    if (!status_->ok())
-      return;
-    envelopes_.emplace_back();
-    envelopes_.back().EncodeStart(out_);
-    out_->push_back(kInitialByteIndefiniteLengthArray);
-  }
-
-  void HandleArrayEnd() override {
-    if (!status_->ok())
-      return;
-    out_->push_back(kStopByte);
-    assert(!envelopes_.empty());
-    if (!envelopes_.back().EncodeStop(out_)) {
-      HandleError(
-          Status(Error::CBOR_ENVELOPE_SIZE_LIMIT_EXCEEDED, out_->size()));
-      return;
-    }
-    envelopes_.pop_back();
-  }
-
-  void HandleString8(span<uint8_t> chars) override {
-    if (!status_->ok())
-      return;
-    EncodeString8(chars, out_);
-  }
-
-  void HandleString16(span<uint16_t> chars) override {
-    if (!status_->ok())
-      return;
-    EncodeFromUTF16(chars, out_);
-  }
-
-  void HandleBinary(span<uint8_t> bytes) override {
-    if (!status_->ok())
-      return;
-    EncodeBinary(bytes, out_);
-  }
-
-  void HandleDouble(double value) override {
-    if (!status_->ok())
-      return;
-    EncodeDouble(value, out_);
-  }
-
-  void HandleInt32(int32_t value) override {
-    if (!status_->ok())
-      return;
-    EncodeInt32(value, out_);
-  }
-
-  void HandleBool(bool value) override {
-    if (!status_->ok())
-      return;
-    // See RFC 7049 Section 2.3, Table 2.
-    out_->push_back(value ? kEncodedTrue : kEncodedFalse);
-  }
-
-  void HandleNull() override {
-    if (!status_->ok())
-      return;
-    // See RFC 7049 Section 2.3, Table 2.
-    out_->push_back(kEncodedNull);
-  }
-
-  void HandleError(Status error) override {
-    if (!status_->ok())
-      return;
-    *status_ = error;
-    out_->clear();
-  }
-
- private:
-  C* out_;
-  std::vector<EnvelopeEncoder> envelopes_;
-  Status* status_;
-};
-}  // namespace
-
-std::unique_ptr<StreamingParserHandler> NewCBOREncoder(
-    std::vector<uint8_t>* out,
-    Status* status) {
-  return std::unique_ptr<StreamingParserHandler>(
-      new CBOREncoder<std::vector<uint8_t>>(out, status));
-}
-std::unique_ptr<StreamingParserHandler> NewCBOREncoder(std::string* out,
-                                                       Status* status) {
-  return std::unique_ptr<StreamingParserHandler>(
-      new CBOREncoder<std::string>(out, status));
-}
-
-// =============================================================================
-// cbor::CBORTokenizer - for parsing individual CBOR items
-// =============================================================================
-
-CBORTokenizer::CBORTokenizer(span<uint8_t> bytes) : bytes_(bytes) {
-  ReadNextToken(/*enter_envelope=*/false);
-}
-CBORTokenizer::~CBORTokenizer() {}
-
-CBORTokenTag CBORTokenizer::TokenTag() const {
-  return token_tag_;
-}
-
-void CBORTokenizer::Next() {
-  if (token_tag_ == CBORTokenTag::ERROR_VALUE ||
-      token_tag_ == CBORTokenTag::DONE)
-    return;
-  ReadNextToken(/*enter_envelope=*/false);
-}
-
-void CBORTokenizer::EnterEnvelope() {
-  assert(token_tag_ == CBORTokenTag::ENVELOPE);
-  ReadNextToken(/*enter_envelope=*/true);
-}
-
-Status CBORTokenizer::Status() const {
-  return status_;
-}
-
-// The following accessor functions ::GetInt32, ::GetDouble,
-// ::GetString8, ::GetString16WireRep, ::GetBinary, ::GetEnvelopeContents
-// assume that a particular token was recognized in ::ReadNextToken.
-// That's where all the error checking is done. By design,
-// the accessors (assuming the token was recognized) never produce
-// an error.
-
-int32_t CBORTokenizer::GetInt32() const {
-  assert(token_tag_ == CBORTokenTag::INT32);
-  // The range checks happen in ::ReadNextToken().
-  return static_cast<int32_t>(
-      token_start_type_ == MajorType::UNSIGNED
-          ? token_start_internal_value_
-          : -static_cast<int64_t>(token_start_internal_value_) - 1);
-}
-
-double CBORTokenizer::GetDouble() const {
-  assert(token_tag_ == CBORTokenTag::DOUBLE);
-  union {
-    uint64_t from_uint64;
-    double to_double;
-  } reinterpret;
-  reinterpret.from_uint64 = ReadBytesMostSignificantByteFirst<uint64_t>(
-      bytes_.subspan(status_.pos + 1));
-  return reinterpret.to_double;
-}
-
-span<uint8_t> CBORTokenizer::GetString8() const {
-  assert(token_tag_ == CBORTokenTag::STRING8);
-  auto length = static_cast<size_t>(token_start_internal_value_);
-  return bytes_.subspan(status_.pos + (token_byte_length_ - length), length);
-}
-
-span<uint8_t> CBORTokenizer::GetString16WireRep() const {
-  assert(token_tag_ == CBORTokenTag::STRING16);
-  auto length = static_cast<size_t>(token_start_internal_value_);
-  return bytes_.subspan(status_.pos + (token_byte_length_ - length), length);
-}
-
-span<uint8_t> CBORTokenizer::GetBinary() const {
-  assert(token_tag_ == CBORTokenTag::BINARY);
-  auto length = static_cast<size_t>(token_start_internal_value_);
-  return bytes_.subspan(status_.pos + (token_byte_length_ - length), length);
-}
-
-span<uint8_t> CBORTokenizer::GetEnvelope() const {
-  assert(token_tag_ == CBORTokenTag::ENVELOPE);
-  auto length = static_cast<size_t>(token_start_internal_value_);
-  return bytes_.subspan(status_.pos, length + kEncodedEnvelopeHeaderSize);
-}
-
-span<uint8_t> CBORTokenizer::GetEnvelopeContents() const {
-  assert(token_tag_ == CBORTokenTag::ENVELOPE);
-  auto length = static_cast<size_t>(token_start_internal_value_);
-  return bytes_.subspan(status_.pos + kEncodedEnvelopeHeaderSize, length);
-}
-
-// All error checking happens in ::ReadNextToken, so that the accessors
-// can avoid having to carry an error return value.
-//
-// With respect to checking the encoded lengths of strings, arrays, etc:
-// On the wire, CBOR uses 1,2,4, and 8 byte unsigned integers, so
-// we initially read them as uint64_t, usually into token_start_internal_value_.
-//
-// However, since these containers have a representation on the machine,
-// we need to do corresponding size computations on the input byte array,
-// output span (e.g. the payload for a string), etc., and size_t is
-// machine specific (in practice either 32 bit or 64 bit).
-//
-// Further, we must avoid overflowing size_t. Therefore, we use this
-// kMaxValidLength constant to:
-// - Reject values that are larger than the architecture specific
-//   max size_t (differs between 32 bit and 64 bit arch).
-// - Reserve at least one bit so that we can check against overflows
-//   when adding lengths (array / string length / etc.); we do this by
-//   ensuring that the inputs to an addition are <= kMaxValidLength,
-//   and then checking whether the sum went past it.
-//
-// See also
-// https://chromium.googlesource.com/chromium/src/+/master/docs/security/integer-semantics.md
-static const uint64_t kMaxValidLength =
-    std::min<uint64_t>(std::numeric_limits<uint64_t>::max() >> 2,
-                       std::numeric_limits<size_t>::max());
-
-void CBORTokenizer::ReadNextToken(bool enter_envelope) {
-  if (enter_envelope) {
-    status_.pos += kEncodedEnvelopeHeaderSize;
-  } else {
-    status_.pos =
-        status_.pos == Status::npos() ? 0 : status_.pos + token_byte_length_;
-  }
-  status_.error = Error::OK;
-  if (status_.pos >= bytes_.size()) {
-    token_tag_ = CBORTokenTag::DONE;
-    return;
-  }
-  const size_t remaining_bytes = bytes_.size() - status_.pos;
-  switch (bytes_[status_.pos]) {
-    case kStopByte:
-      SetToken(CBORTokenTag::STOP, 1);
-      return;
-    case kInitialByteIndefiniteLengthMap:
-      SetToken(CBORTokenTag::MAP_START, 1);
-      return;
-    case kInitialByteIndefiniteLengthArray:
-      SetToken(CBORTokenTag::ARRAY_START, 1);
-      return;
-    case kEncodedTrue:
-      SetToken(CBORTokenTag::TRUE_VALUE, 1);
-      return;
-    case kEncodedFalse:
-      SetToken(CBORTokenTag::FALSE_VALUE, 1);
-      return;
-    case kEncodedNull:
-      SetToken(CBORTokenTag::NULL_VALUE, 1);
-      return;
-    case kExpectedConversionToBase64Tag: {  // BINARY
-      const size_t bytes_read = internals::ReadTokenStart(
-          bytes_.subspan(status_.pos + 1), &token_start_type_,
-          &token_start_internal_value_);
-      if (!bytes_read || token_start_type_ != MajorType::BYTE_STRING ||
-          token_start_internal_value_ > kMaxValidLength) {
-        SetError(Error::CBOR_INVALID_BINARY);
-        return;
-      }
-      const uint64_t token_byte_length = token_start_internal_value_ +
-                                         /* tag before token start: */ 1 +
-                                         /* token start: */ bytes_read;
-      if (token_byte_length > remaining_bytes) {
-        SetError(Error::CBOR_INVALID_BINARY);
-        return;
-      }
-      SetToken(CBORTokenTag::BINARY, static_cast<size_t>(token_byte_length));
-      return;
-    }
-    case kInitialByteForDouble: {  // DOUBLE
-      if (kEncodedDoubleSize > remaining_bytes) {
-        SetError(Error::CBOR_INVALID_DOUBLE);
-        return;
-      }
-      SetToken(CBORTokenTag::DOUBLE, kEncodedDoubleSize);
-      return;
-    }
-    case kInitialByteForEnvelope: {  // ENVELOPE
-      if (kEncodedEnvelopeHeaderSize > remaining_bytes) {
-        SetError(Error::CBOR_INVALID_ENVELOPE);
-        return;
-      }
-      // The envelope must be a byte string with 32 bit length.
-      if (bytes_[status_.pos + 1] != kInitialByteFor32BitLengthByteString) {
-        SetError(Error::CBOR_INVALID_ENVELOPE);
-        return;
-      }
-      // Read the length of the byte string.
-      token_start_internal_value_ = ReadBytesMostSignificantByteFirst<uint32_t>(
-          bytes_.subspan(status_.pos + 2));
-      if (token_start_internal_value_ > kMaxValidLength) {
-        SetError(Error::CBOR_INVALID_ENVELOPE);
-        return;
-      }
-      uint64_t token_byte_length =
-          token_start_internal_value_ + kEncodedEnvelopeHeaderSize;
-      if (token_byte_length > remaining_bytes) {
-        SetError(Error::CBOR_INVALID_ENVELOPE);
-        return;
-      }
-      SetToken(CBORTokenTag::ENVELOPE, static_cast<size_t>(token_byte_length));
-      return;
-    }
-    default: {
-      const size_t bytes_read = internals::ReadTokenStart(
-          bytes_.subspan(status_.pos), &token_start_type_,
-          &token_start_internal_value_);
-      switch (token_start_type_) {
-        case MajorType::UNSIGNED:  // INT32.
-          // INT32 is a signed int32 (int32 makes sense for the
-          // inspector_protocol, it's not a CBOR limitation), so we check
-          // against the signed max, so that the allowable values are
-          // 0, 1, 2, ... 2^31 - 1.
-          if (!bytes_read || std::numeric_limits<int32_t>::max() <
-                                 token_start_internal_value_) {
-            SetError(Error::CBOR_INVALID_INT32);
-            return;
-          }
-          SetToken(CBORTokenTag::INT32, bytes_read);
-          return;
-        case MajorType::NEGATIVE: {  // INT32.
-          // INT32 is a signed int32 (int32 makes sense for the
-          // inspector_protocol, it's not a CBOR limitation); in CBOR, the
-          // negative values for INT32 are represented as NEGATIVE, that is, -1
-          // INT32 is represented as 1 << 5 | 0 (major type 1, additional info
-          // value 0).
-          // The represented allowed values range is -1 to -2^31.
-          // They are mapped into the encoded range of 0 to 2^31-1.
-          // We check the payload in token_start_internal_value_ against
-          // that range (2^31-1 is also known as
-          // std::numeric_limits<int32_t>::max()).
-          if (!bytes_read || token_start_internal_value_ >
-                                 std::numeric_limits<int32_t>::max()) {
-            SetError(Error::CBOR_INVALID_INT32);
-            return;
-          }
-          SetToken(CBORTokenTag::INT32, bytes_read);
-          return;
-        }
-        case MajorType::STRING: {  // STRING8.
-          if (!bytes_read || token_start_internal_value_ > kMaxValidLength) {
-            SetError(Error::CBOR_INVALID_STRING8);
-            return;
-          }
-          uint64_t token_byte_length = token_start_internal_value_ + bytes_read;
-          if (token_byte_length > remaining_bytes) {
-            SetError(Error::CBOR_INVALID_STRING8);
-            return;
-          }
-          SetToken(CBORTokenTag::STRING8,
-                   static_cast<size_t>(token_byte_length));
-          return;
-        }
-        case MajorType::BYTE_STRING: {  // STRING16.
-          // Length must be divisible by 2 since UTF16 is 2 bytes per
-          // character, hence the &1 check.
-          if (!bytes_read || token_start_internal_value_ > kMaxValidLength ||
-              token_start_internal_value_ & 1) {
-            SetError(Error::CBOR_INVALID_STRING16);
-            return;
-          }
-          uint64_t token_byte_length = token_start_internal_value_ + bytes_read;
-          if (token_byte_length > remaining_bytes) {
-            SetError(Error::CBOR_INVALID_STRING16);
-            return;
-          }
-          SetToken(CBORTokenTag::STRING16,
-                   static_cast<size_t>(token_byte_length));
-          return;
-        }
-        case MajorType::ARRAY:
-        case MajorType::MAP:
-        case MajorType::TAG:
-        case MajorType::SIMPLE_VALUE:
-          SetError(Error::CBOR_UNSUPPORTED_VALUE);
-          return;
-      }
-    }
-  }
-}
-
-void CBORTokenizer::SetToken(CBORTokenTag token_tag, size_t token_byte_length) {
-  token_tag_ = token_tag;
-  token_byte_length_ = token_byte_length;
-}
-
-void CBORTokenizer::SetError(Error error) {
-  token_tag_ = CBORTokenTag::ERROR_VALUE;
-  status_.error = error;
-}
-
-// =============================================================================
-// cbor::ParseCBOR - for receiving streaming parser events for CBOR messages
-// =============================================================================
-
-namespace {
-// When parsing CBOR, we limit recursion depth for objects and arrays
-// to this constant.
-static constexpr int kStackLimit = 300;
-
-// Below are three parsing routines for CBOR, which cover enough
-// to roundtrip JSON messages.
-bool ParseMap(int32_t stack_depth,
-              CBORTokenizer* tokenizer,
-              StreamingParserHandler* out);
-bool ParseArray(int32_t stack_depth,
-                CBORTokenizer* tokenizer,
-                StreamingParserHandler* out);
-bool ParseValue(int32_t stack_depth,
-                CBORTokenizer* tokenizer,
-                StreamingParserHandler* out);
-bool ParseEnvelope(int32_t stack_depth,
-                   CBORTokenizer* tokenizer,
-                   StreamingParserHandler* out);
-
-void ParseUTF16String(CBORTokenizer* tokenizer, StreamingParserHandler* out) {
-  std::vector<uint16_t> value;
-  span<uint8_t> rep = tokenizer->GetString16WireRep();
-  for (size_t ii = 0; ii < rep.size(); ii += 2)
-    value.push_back((rep[ii + 1] << 8) | rep[ii]);
-  out->HandleString16(span<uint16_t>(value.data(), value.size()));
-  tokenizer->Next();
-}
-
-bool ParseUTF8String(CBORTokenizer* tokenizer, StreamingParserHandler* out) {
-  assert(tokenizer->TokenTag() == CBORTokenTag::STRING8);
-  out->HandleString8(tokenizer->GetString8());
-  tokenizer->Next();
-  return true;
-}
-
-bool ParseEnvelope(int32_t stack_depth,
-                   CBORTokenizer* tokenizer,
-                   StreamingParserHandler* out) {
-  assert(tokenizer->TokenTag() == CBORTokenTag::ENVELOPE);
-  // Before we enter the envelope, we save the position that we
-  // expect to see after we're done parsing the envelope contents.
-  // This way we can compare and produce an error if the contents
-  // didn't fit exactly into the envelope length.
-  size_t pos_past_envelope = tokenizer->Status().pos +
-                             kEncodedEnvelopeHeaderSize +
-                             tokenizer->GetEnvelopeContents().size();
-  tokenizer->EnterEnvelope();
-  switch (tokenizer->TokenTag()) {
-    case CBORTokenTag::ERROR_VALUE:
-      out->HandleError(tokenizer->Status());
-      return false;
-    case CBORTokenTag::MAP_START:
-      if (!ParseMap(stack_depth + 1, tokenizer, out))
-        return false;
-      break;  // Continue to check pos_past_envelope below.
-    case CBORTokenTag::ARRAY_START:
-      if (stack_depth == 0) {  // Not allowed at the top level.
-        out->HandleError(
-            Status{Error::CBOR_MAP_START_EXPECTED, tokenizer->Status().pos});
-        return false;
-      }
-      if (!ParseArray(stack_depth + 1, tokenizer, out))
-        return false;
-      break;  // Continue to check pos_past_envelope below.
-    default:
-      out->HandleError(Status{
-          stack_depth == 0 ? Error::CBOR_MAP_START_EXPECTED
-                           : Error::CBOR_MAP_OR_ARRAY_EXPECTED_IN_ENVELOPE,
-          tokenizer->Status().pos});
-      return false;
-  }
-  // The contents of the envelope parsed OK, now check that we're at
-  // the expected position.
-  if (pos_past_envelope != tokenizer->Status().pos) {
-    out->HandleError(Status{Error::CBOR_ENVELOPE_CONTENTS_LENGTH_MISMATCH,
-                            tokenizer->Status().pos});
-    return false;
-  }
-  return true;
-}
-
-bool ParseValue(int32_t stack_depth,
-                CBORTokenizer* tokenizer,
-                StreamingParserHandler* out) {
-  if (stack_depth > kStackLimit) {
-    out->HandleError(
-        Status{Error::CBOR_STACK_LIMIT_EXCEEDED, tokenizer->Status().pos});
-    return false;
-  }
-  switch (tokenizer->TokenTag()) {
-    case CBORTokenTag::ERROR_VALUE:
-      out->HandleError(tokenizer->Status());
-      return false;
-    case CBORTokenTag::DONE:
-      out->HandleError(Status{Error::CBOR_UNEXPECTED_EOF_EXPECTED_VALUE,
-                              tokenizer->Status().pos});
-      return false;
-    case CBORTokenTag::ENVELOPE:
-      return ParseEnvelope(stack_depth, tokenizer, out);
-    case CBORTokenTag::TRUE_VALUE:
-      out->HandleBool(true);
-      tokenizer->Next();
-      return true;
-    case CBORTokenTag::FALSE_VALUE:
-      out->HandleBool(false);
-      tokenizer->Next();
-      return true;
-    case CBORTokenTag::NULL_VALUE:
-      out->HandleNull();
-      tokenizer->Next();
-      return true;
-    case CBORTokenTag::INT32:
-      out->HandleInt32(tokenizer->GetInt32());
-      tokenizer->Next();
-      return true;
-    case CBORTokenTag::DOUBLE:
-      out->HandleDouble(tokenizer->GetDouble());
-      tokenizer->Next();
-      return true;
-    case CBORTokenTag::STRING8:
-      return ParseUTF8String(tokenizer, out);
-    case CBORTokenTag::STRING16:
-      ParseUTF16String(tokenizer, out);
-      return true;
-    case CBORTokenTag::BINARY: {
-      out->HandleBinary(tokenizer->GetBinary());
-      tokenizer->Next();
-      return true;
-    }
-    case CBORTokenTag::MAP_START:
-      return ParseMap(stack_depth + 1, tokenizer, out);
-    case CBORTokenTag::ARRAY_START:
-      return ParseArray(stack_depth + 1, tokenizer, out);
-    default:
-      out->HandleError(
-          Status{Error::CBOR_UNSUPPORTED_VALUE, tokenizer->Status().pos});
-      return false;
-  }
-}
-
-// |bytes| must start with the indefinite length array byte, so basically,
-// ParseArray may only be called after an indefinite length array has been
-// detected.
-bool ParseArray(int32_t stack_depth,
-                CBORTokenizer* tokenizer,
-                StreamingParserHandler* out) {
-  assert(tokenizer->TokenTag() == CBORTokenTag::ARRAY_START);
-  tokenizer->Next();
-  out->HandleArrayBegin();
-  while (tokenizer->TokenTag() != CBORTokenTag::STOP) {
-    if (tokenizer->TokenTag() == CBORTokenTag::DONE) {
-      out->HandleError(
-          Status{Error::CBOR_UNEXPECTED_EOF_IN_ARRAY, tokenizer->Status().pos});
-      return false;
-    }
-    if (tokenizer->TokenTag() == CBORTokenTag::ERROR_VALUE) {
-      out->HandleError(tokenizer->Status());
-      return false;
-    }
-    // Parse value.
-    if (!ParseValue(stack_depth, tokenizer, out))
-      return false;
-  }
-  out->HandleArrayEnd();
-  tokenizer->Next();
-  return true;
-}
-
-// |bytes| must start with the indefinite length array byte, so basically,
-// ParseArray may only be called after an indefinite length array has been
-// detected.
-bool ParseMap(int32_t stack_depth,
-              CBORTokenizer* tokenizer,
-              StreamingParserHandler* out) {
-  assert(tokenizer->TokenTag() == CBORTokenTag::MAP_START);
-  out->HandleMapBegin();
-  tokenizer->Next();
-  while (tokenizer->TokenTag() != CBORTokenTag::STOP) {
-    if (tokenizer->TokenTag() == CBORTokenTag::DONE) {
-      out->HandleError(
-          Status{Error::CBOR_UNEXPECTED_EOF_IN_MAP, tokenizer->Status().pos});
-      return false;
-    }
-    if (tokenizer->TokenTag() == CBORTokenTag::ERROR_VALUE) {
-      out->HandleError(tokenizer->Status());
-      return false;
-    }
-    // Parse key.
-    if (tokenizer->TokenTag() == CBORTokenTag::STRING8) {
-      if (!ParseUTF8String(tokenizer, out))
-        return false;
-    } else if (tokenizer->TokenTag() == CBORTokenTag::STRING16) {
-      ParseUTF16String(tokenizer, out);
-    } else {
-      out->HandleError(
-          Status{Error::CBOR_INVALID_MAP_KEY, tokenizer->Status().pos});
-      return false;
-    }
-    // Parse value.
-    if (!ParseValue(stack_depth, tokenizer, out))
-      return false;
-  }
-  out->HandleMapEnd();
-  tokenizer->Next();
-  return true;
-}
-}  // namespace
-
-void ParseCBOR(span<uint8_t> bytes, StreamingParserHandler* out) {
-  if (bytes.empty()) {
-    out->HandleError(Status{Error::CBOR_NO_INPUT, 0});
-    return;
-  }
-  if (bytes[0] != kInitialByteForEnvelope) {
-    out->HandleError(Status{Error::CBOR_INVALID_START_BYTE, 0});
-    return;
-  }
-  CBORTokenizer tokenizer(bytes);
-  if (tokenizer.TokenTag() == CBORTokenTag::ERROR_VALUE) {
-    out->HandleError(tokenizer.Status());
-    return;
-  }
-  // We checked for the envelope start byte above, so the tokenizer
-  // must agree here, since it's not an error.
-  assert(tokenizer.TokenTag() == CBORTokenTag::ENVELOPE);
-  if (!ParseEnvelope(/*stack_depth=*/0, &tokenizer, out))
-    return;
-  if (tokenizer.TokenTag() == CBORTokenTag::DONE)
-    return;
-  if (tokenizer.TokenTag() == CBORTokenTag::ERROR_VALUE) {
-    out->HandleError(tokenizer.Status());
-    return;
-  }
-  out->HandleError(Status{Error::CBOR_TRAILING_JUNK, tokenizer.Status().pos});
-}
-
-// =============================================================================
-// cbor::AppendString8EntryToMap - for limited in-place editing of messages
-// =============================================================================
-
-template <typename C>
-Status AppendString8EntryToCBORMapTmpl(span<uint8_t> string8_key,
-                                       span<uint8_t> string8_value,
-                                       C* cbor) {
-  // Careful below: Don't compare (*cbor)[idx] with a uint8_t, since
-  // it could be a char (signed!). Instead, use bytes.
-  span<uint8_t> bytes(reinterpret_cast<const uint8_t*>(cbor->data()),
-                      cbor->size());
-  CBORTokenizer tokenizer(bytes);
-  if (tokenizer.TokenTag() == CBORTokenTag::ERROR_VALUE)
-    return tokenizer.Status();
-  if (tokenizer.TokenTag() != CBORTokenTag::ENVELOPE)
-    return Status(Error::CBOR_INVALID_ENVELOPE, 0);
-  size_t envelope_size = tokenizer.GetEnvelopeContents().size();
-  size_t old_size = cbor->size();
-  if (old_size != envelope_size + kEncodedEnvelopeHeaderSize)
-    return Status(Error::CBOR_INVALID_ENVELOPE, 0);
-  if (envelope_size == 0 ||
-      (tokenizer.GetEnvelopeContents()[0] != EncodeIndefiniteLengthMapStart()))
-    return Status(Error::CBOR_MAP_START_EXPECTED, kEncodedEnvelopeHeaderSize);
-  if (bytes[bytes.size() - 1] != EncodeStop())
-    return Status(Error::CBOR_MAP_STOP_EXPECTED, cbor->size() - 1);
-  cbor->pop_back();
-  EncodeString8(string8_key, cbor);
-  EncodeString8(string8_value, cbor);
-  cbor->push_back(EncodeStop());
-  size_t new_envelope_size = envelope_size + (cbor->size() - old_size);
-  if (new_envelope_size > std::numeric_limits<uint32_t>::max())
-    return Status(Error::CBOR_ENVELOPE_SIZE_LIMIT_EXCEEDED, 0);
-  size_t size_pos = cbor->size() - new_envelope_size - sizeof(uint32_t);
-  uint8_t* out = reinterpret_cast<uint8_t*>(&cbor->at(size_pos));
-  *(out++) = (new_envelope_size >> 24) & 0xff;
-  *(out++) = (new_envelope_size >> 16) & 0xff;
-  *(out++) = (new_envelope_size >> 8) & 0xff;
-  *(out) = new_envelope_size & 0xff;
-  return Status();
-}
-Status AppendString8EntryToCBORMap(span<uint8_t> string8_key,
-                                   span<uint8_t> string8_value,
-                                   std::vector<uint8_t>* cbor) {
-  return AppendString8EntryToCBORMapTmpl(string8_key, string8_value, cbor);
-}
-Status AppendString8EntryToCBORMap(span<uint8_t> string8_key,
-                                   span<uint8_t> string8_value,
-                                   std::string* cbor) {
-  return AppendString8EntryToCBORMapTmpl(string8_key, string8_value, cbor);
-}
-}  // namespace cbor
-
-namespace json {
-
-// =============================================================================
-// json::NewJSONEncoder - for encoding streaming parser events as JSON
-// =============================================================================
-
-namespace {
-// Prints |value| to |out| with 4 hex digits, most significant chunk first.
-template <typename C>
-void PrintHex(uint16_t value, C* out) {
-  for (int ii = 3; ii >= 0; --ii) {
-    int four_bits = 0xf & (value >> (4 * ii));
-    out->push_back(four_bits + ((four_bits <= 9) ? '0' : ('a' - 10)));
-  }
-}
-
-// In the writer below, we maintain a stack of State instances.
-// It is just enough to emit the appropriate delimiters and brackets
-// in JSON.
-enum class Container {
-  // Used for the top-level, initial state.
-  NONE,
-  // Inside a JSON object.
-  MAP,
-  // Inside a JSON array.
-  ARRAY
-};
-class State {
- public:
-  explicit State(Container container) : container_(container) {}
-  void StartElement(std::vector<uint8_t>* out) { StartElementTmpl(out); }
-  void StartElement(std::string* out) { StartElementTmpl(out); }
-  Container container() const { return container_; }
-
- private:
-  template <typename C>
-  void StartElementTmpl(C* out) {
-    assert(container_ != Container::NONE || size_ == 0);
-    if (size_ != 0) {
-      char delim = (!(size_ & 1) || container_ == Container::ARRAY) ? ',' : ':';
-      out->push_back(delim);
-    }
-    ++size_;
-  }
-
-  Container container_ = Container::NONE;
-  int size_ = 0;
-};
-
-constexpr char kBase64Table[] =
-    "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-    "abcdefghijklmnopqrstuvwxyz0123456789+/";
-
-template <typename C>
-void Base64Encode(const span<uint8_t>& in, C* out) {
-  // The following three cases are based on the tables in the example
-  // section in https://en.wikipedia.org/wiki/Base64. We process three
-  // input bytes at a time, emitting 4 output bytes at a time.
-  size_t ii = 0;
-
-  // While possible, process three input bytes.
-  for (; ii + 3 <= in.size(); ii += 3) {
-    uint32_t twentyfour_bits = (in[ii] << 16) | (in[ii + 1] << 8) | in[ii + 2];
-    out->push_back(kBase64Table[(twentyfour_bits >> 18)]);
-    out->push_back(kBase64Table[(twentyfour_bits >> 12) & 0x3f]);
-    out->push_back(kBase64Table[(twentyfour_bits >> 6) & 0x3f]);
-    out->push_back(kBase64Table[twentyfour_bits & 0x3f]);
-  }
-  if (ii + 2 <= in.size()) {  // Process two input bytes.
-    uint32_t twentyfour_bits = (in[ii] << 16) | (in[ii + 1] << 8);
-    out->push_back(kBase64Table[(twentyfour_bits >> 18)]);
-    out->push_back(kBase64Table[(twentyfour_bits >> 12) & 0x3f]);
-    out->push_back(kBase64Table[(twentyfour_bits >> 6) & 0x3f]);
-    out->push_back('=');  // Emit padding.
-    return;
-  }
-  if (ii + 1 <= in.size()) {  // Process a single input byte.
-    uint32_t twentyfour_bits = (in[ii] << 16);
-    out->push_back(kBase64Table[(twentyfour_bits >> 18)]);
-    out->push_back(kBase64Table[(twentyfour_bits >> 12) & 0x3f]);
-    out->push_back('=');  // Emit padding.
-    out->push_back('=');  // Emit padding.
-  }
-}
-
-// Implements a handler for JSON parser events to emit a JSON string.
-template <typename C>
-class JSONEncoder : public StreamingParserHandler {
- public:
-  JSONEncoder(const Platform* platform, C* out, Status* status)
-      : platform_(platform), out_(out), status_(status) {
-    *status_ = Status();
-    state_.emplace(Container::NONE);
-  }
-
-  void HandleMapBegin() override {
-    if (!status_->ok())
-      return;
-    assert(!state_.empty());
-    state_.top().StartElement(out_);
-    state_.emplace(Container::MAP);
-    Emit('{');
-  }
-
-  void HandleMapEnd() override {
-    if (!status_->ok())
-      return;
-    assert(state_.size() >= 2 && state_.top().container() == Container::MAP);
-    state_.pop();
-    Emit('}');
-  }
-
-  void HandleArrayBegin() override {
-    if (!status_->ok())
-      return;
-    state_.top().StartElement(out_);
-    state_.emplace(Container::ARRAY);
-    Emit('[');
-  }
-
-  void HandleArrayEnd() override {
-    if (!status_->ok())
-      return;
-    assert(state_.size() >= 2 && state_.top().container() == Container::ARRAY);
-    state_.pop();
-    Emit(']');
-  }
-
-  void HandleString16(span<uint16_t> chars) override {
-    if (!status_->ok())
-      return;
-    state_.top().StartElement(out_);
-    Emit('"');
-    for (const uint16_t ch : chars) {
-      if (ch == '"') {
-        Emit("\\\"");
-      } else if (ch == '\\') {
-        Emit("\\\\");
-      } else if (ch == '\b') {
-        Emit("\\b");
-      } else if (ch == '\f') {
-        Emit("\\f");
-      } else if (ch == '\n') {
-        Emit("\\n");
-      } else if (ch == '\r') {
-        Emit("\\r");
-      } else if (ch == '\t') {
-        Emit("\\t");
-      } else if (ch >= 32 && ch <= 126) {
-        Emit(ch);
-      } else {
-        Emit("\\u");
-        PrintHex(ch, out_);
-      }
-    }
-    Emit('"');
-  }
-
-  void HandleString8(span<uint8_t> chars) override {
-    if (!status_->ok())
-      return;
-    state_.top().StartElement(out_);
-    Emit('"');
-    for (size_t ii = 0; ii < chars.size(); ++ii) {
-      uint8_t c = chars[ii];
-      if (c == '"') {
-        Emit("\\\"");
-      } else if (c == '\\') {
-        Emit("\\\\");
-      } else if (c == '\b') {
-        Emit("\\b");
-      } else if (c == '\f') {
-        Emit("\\f");
-      } else if (c == '\n') {
-        Emit("\\n");
-      } else if (c == '\r') {
-        Emit("\\r");
-      } else if (c == '\t') {
-        Emit("\\t");
-      } else if (c >= 32 && c <= 126) {
-        Emit(c);
-      } else if (c < 32) {
-        Emit("\\u");
-        PrintHex(static_cast<uint16_t>(c), out_);
-      } else {
-        // Inspect the leading byte to figure out how long the utf8
-        // byte sequence is; while doing this initialize |codepoint|
-        // with the first few bits.
-        // See table in: https://en.wikipedia.org/wiki/UTF-8
-        // byte one is 110x xxxx -> 2 byte utf8 sequence
-        // byte one is 1110 xxxx -> 3 byte utf8 sequence
-        // byte one is 1111 0xxx -> 4 byte utf8 sequence
-        uint32_t codepoint;
-        int num_bytes_left;
-        if ((c & 0xe0) == 0xc0) {  // 2 byte utf8 sequence
-          num_bytes_left = 1;
-          codepoint = c & 0x1f;
-        } else if ((c & 0xf0) == 0xe0) {  // 3 byte utf8 sequence
-          num_bytes_left = 2;
-          codepoint = c & 0x0f;
-        } else if ((c & 0xf8) == 0xf0) {  // 4 byte utf8 sequence
-          codepoint = c & 0x07;
-          num_bytes_left = 3;
-        } else {
-          continue;  // invalid leading byte
-        }
-
-        // If we have enough bytes in our input, decode the remaining ones
-        // belonging to this Unicode character into |codepoint|.
-        if (ii + num_bytes_left >= chars.size())
-          continue;
-        while (num_bytes_left > 0) {
-          c = chars[++ii];
-          --num_bytes_left;
-          // Check the next byte is a continuation byte, that is 10xx xxxx.
-          if ((c & 0xc0) != 0x80)
-            continue;
-          codepoint = (codepoint << 6) | (c & 0x3f);
-        }
-
-        // Disallow overlong encodings for ascii characters, as these
-        // would include " and other characters significant to JSON
-        // string termination / control.
-        if (codepoint <= 0x7f)
-          continue;
-        // Invalid in UTF8, and can't be represented in UTF16 anyway.
-        if (codepoint > 0x10ffff)
-          continue;
-
-        // So, now we transcode to UTF16,
-        // using the math described at https://en.wikipedia.org/wiki/UTF-16,
-        // for either one or two 16 bit characters.
-        if (codepoint < 0xffff) {
-          Emit("\\u");
-          PrintHex(static_cast<uint16_t>(codepoint), out_);
-          continue;
-        }
-        codepoint -= 0x10000;
-        // high surrogate
-        Emit("\\u");
-        PrintHex(static_cast<uint16_t>((codepoint >> 10) + 0xd800), out_);
-        // low surrogate
-        Emit("\\u");
-        PrintHex(static_cast<uint16_t>((codepoint & 0x3ff) + 0xdc00), out_);
-      }
-    }
-    Emit('"');
-  }
-
-  void HandleBinary(span<uint8_t> bytes) override {
-    if (!status_->ok())
-      return;
-    state_.top().StartElement(out_);
-    Emit('"');
-    Base64Encode(bytes, out_);
-    Emit('"');
-  }
-
-  void HandleDouble(double value) override {
-    if (!status_->ok())
-      return;
-    state_.top().StartElement(out_);
-    // JSON cannot represent NaN or Infinity. So, for compatibility,
-    // we behave like the JSON object in web browsers: emit 'null'.
-    if (!std::isfinite(value)) {
-      Emit("null");
-      return;
-    }
-    std::unique_ptr<char[]> str_value = platform_->DToStr(value);
-
-    // DToStr may fail to emit a 0 before the decimal dot. E.g. this is
-    // the case in base::NumberToString in Chromium (which is based on
-    // dmg_fp). So, much like
-    // https://cs.chromium.org/chromium/src/base/json/json_writer.cc
-    // we probe for this and emit the leading 0 anyway if necessary.
-    const char* chars = str_value.get();
-    if (chars[0] == '.') {
-      Emit('0');
-    } else if (chars[0] == '-' && chars[1] == '.') {
-      Emit("-0");
-      ++chars;
-    }
-    Emit(chars);
-  }
-
-  void HandleInt32(int32_t value) override {
-    if (!status_->ok())
-      return;
-    state_.top().StartElement(out_);
-    Emit(std::to_string(value));
-  }
-
-  void HandleBool(bool value) override {
-    if (!status_->ok())
-      return;
-    state_.top().StartElement(out_);
-    Emit(value ? "true" : "false");
-  }
-
-  void HandleNull() override {
-    if (!status_->ok())
-      return;
-    state_.top().StartElement(out_);
-    Emit("null");
-  }
-
-  void HandleError(Status error) override {
-    assert(!error.ok());
-    *status_ = error;
-    out_->clear();
-  }
-
- private:
-  void Emit(char c) { out_->push_back(c); }
-  void Emit(const char* str) {
-    out_->insert(out_->end(), str, str + strlen(str));
-  }
-  void Emit(const std::string& str) {
-    out_->insert(out_->end(), str.begin(), str.end());
-  }
-
-  const Platform* platform_;
-  C* out_;
-  Status* status_;
-  std::stack<State> state_;
-};
-}  // namespace
-
-std::unique_ptr<StreamingParserHandler> NewJSONEncoder(
-    const Platform* platform,
-    std::vector<uint8_t>* out,
-    Status* status) {
-  return std::unique_ptr<StreamingParserHandler>(
-      new JSONEncoder<std::vector<uint8_t>>(platform, out, status));
-}
-std::unique_ptr<StreamingParserHandler> NewJSONEncoder(const Platform* platform,
-                                                       std::string* out,
-                                                       Status* status) {
-  return std::unique_ptr<StreamingParserHandler>(
-      new JSONEncoder<std::string>(platform, out, status));
-}
-
-// =============================================================================
-// json::ParseJSON - for receiving streaming parser events for JSON.
-// =============================================================================
-
-namespace {
-const int kStackLimit = 300;
-
-enum Token {
-  ObjectBegin,
-  ObjectEnd,
-  ArrayBegin,
-  ArrayEnd,
-  StringLiteral,
-  Number,
-  BoolTrue,
-  BoolFalse,
-  NullToken,
-  ListSeparator,
-  ObjectPairSeparator,
-  InvalidToken,
-  NoInput
-};
-
-const char* const kNullString = "null";
-const char* const kTrueString = "true";
-const char* const kFalseString = "false";
-
-template <typename Char>
-class JsonParser {
- public:
-  JsonParser(const Platform* platform, StreamingParserHandler* handler)
-      : platform_(platform), handler_(handler) {}
-
-  void Parse(const Char* start, size_t length) {
-    start_pos_ = start;
-    const Char* end = start + length;
-    const Char* tokenEnd = nullptr;
-    ParseValue(start, end, &tokenEnd, 0);
-    if (error_)
-      return;
-    if (tokenEnd != end) {
-      HandleError(Error::JSON_PARSER_UNPROCESSED_INPUT_REMAINS, tokenEnd);
-    }
-  }
-
- private:
-  bool CharsToDouble(const uint16_t* chars, size_t length, double* result) {
-    std::string buffer;
-    buffer.reserve(length + 1);
-    for (size_t ii = 0; ii < length; ++ii) {
-      bool is_ascii = !(chars[ii] & ~0x7F);
-      if (!is_ascii)
-        return false;
-      buffer.push_back(static_cast<char>(chars[ii]));
-    }
-    return platform_->StrToD(buffer.c_str(), result);
-  }
-
-  bool CharsToDouble(const uint8_t* chars, size_t length, double* result) {
-    std::string buffer(reinterpret_cast<const char*>(chars), length);
-    return platform_->StrToD(buffer.c_str(), result);
-  }
-
-  static bool ParseConstToken(const Char* start,
-                              const Char* end,
-                              const Char** token_end,
-                              const char* token) {
-    // |token| is \0 terminated, it's one of the constants at top of the file.
-    while (start < end && *token != '\0' && *start++ == *token++) {
-    }
-    if (*token != '\0')
-      return false;
-    *token_end = start;
-    return true;
-  }
-
-  static bool ReadInt(const Char* start,
-                      const Char* end,
-                      const Char** token_end,
-                      bool allow_leading_zeros) {
-    if (start == end)
-      return false;
-    bool has_leading_zero = '0' == *start;
-    int length = 0;
-    while (start < end && '0' <= *start && *start <= '9') {
-      ++start;
-      ++length;
-    }
-    if (!length)
-      return false;
-    if (!allow_leading_zeros && length > 1 && has_leading_zero)
-      return false;
-    *token_end = start;
-    return true;
-  }
-
-  static bool ParseNumberToken(const Char* start,
-                               const Char* end,
-                               const Char** token_end) {
-    // We just grab the number here. We validate the size in DecodeNumber.
-    // According to RFC4627, a valid number is: [minus] int [frac] [exp]
-    if (start == end)
-      return false;
-    Char c = *start;
-    if ('-' == c)
-      ++start;
-
-    if (!ReadInt(start, end, &start, /*allow_leading_zeros=*/false))
-      return false;
-    if (start == end) {
-      *token_end = start;
-      return true;
-    }
-
-    // Optional fraction part
-    c = *start;
-    if ('.' == c) {
-      ++start;
-      if (!ReadInt(start, end, &start, /*allow_leading_zeros=*/true))
-        return false;
-      if (start == end) {
-        *token_end = start;
-        return true;
-      }
-      c = *start;
-    }
-
-    // Optional exponent part
-    if ('e' == c || 'E' == c) {
-      ++start;
-      if (start == end)
-        return false;
-      c = *start;
-      if ('-' == c || '+' == c) {
-        ++start;
-        if (start == end)
-          return false;
-      }
-      if (!ReadInt(start, end, &start, /*allow_leading_zeros=*/true))
-        return false;
-    }
-
-    *token_end = start;
-    return true;
-  }
-
-  static bool ReadHexDigits(const Char* start,
-                            const Char* end,
-                            const Char** token_end,
-                            int digits) {
-    if (end - start < digits)
-      return false;
-    for (int i = 0; i < digits; ++i) {
-      Char c = *start++;
-      if (!(('0' <= c && c <= '9') || ('a' <= c && c <= 'f') ||
-            ('A' <= c && c <= 'F')))
-        return false;
-    }
-    *token_end = start;
-    return true;
-  }
-
-  static bool ParseStringToken(const Char* start,
-                               const Char* end,
-                               const Char** token_end) {
-    while (start < end) {
-      Char c = *start++;
-      if ('\\' == c) {
-        if (start == end)
-          return false;
-        c = *start++;
-        // Make sure the escaped char is valid.
-        switch (c) {
-          case 'x':
-            if (!ReadHexDigits(start, end, &start, 2))
-              return false;
-            break;
-          case 'u':
-            if (!ReadHexDigits(start, end, &start, 4))
-              return false;
-            break;
-          case '\\':
-          case '/':
-          case 'b':
-          case 'f':
-          case 'n':
-          case 'r':
-          case 't':
-          case 'v':
-          case '"':
-            break;
-          default:
-            return false;
-        }
-      } else if ('"' == c) {
-        *token_end = start;
-        return true;
-      }
-    }
-    return false;
-  }
-
-  static bool SkipComment(const Char* start,
-                          const Char* end,
-                          const Char** comment_end) {
-    if (start == end)
-      return false;
-
-    if (*start != '/' || start + 1 >= end)
-      return false;
-    ++start;
-
-    if (*start == '/') {
-      // Single line comment, read to newline.
-      for (++start; start < end; ++start) {
-        if (*start == '\n' || *start == '\r') {
-          *comment_end = start + 1;
-          return true;
-        }
-      }
-      *comment_end = end;
-      // Comment reaches end-of-input, which is fine.
-      return true;
-    }
-
-    if (*start == '*') {
-      Char previous = '\0';
-      // Block comment, read until end marker.
-      for (++start; start < end; previous = *start++) {
-        if (previous == '*' && *start == '/') {
-          *comment_end = start + 1;
-          return true;
-        }
-      }
-      // Block comment must close before end-of-input.
-      return false;
-    }
-
-    return false;
-  }
-
-  static bool IsSpaceOrNewLine(Char c) {
-    // \v = vertial tab; \f = form feed page break.
-    return c == ' ' || c == '\n' || c == '\v' || c == '\f' || c == '\r' ||
-           c == '\t';
-  }
-
-  static void SkipWhitespaceAndComments(const Char* start,
-                                        const Char* end,
-                                        const Char** whitespace_end) {
-    while (start < end) {
-      if (IsSpaceOrNewLine(*start)) {
-        ++start;
-      } else if (*start == '/') {
-        const Char* comment_end = nullptr;
-        if (!SkipComment(start, end, &comment_end))
-          break;
-        start = comment_end;
-      } else {
-        break;
-      }
-    }
-    *whitespace_end = start;
-  }
-
-  static Token ParseToken(const Char* start,
-                          const Char* end,
-                          const Char** tokenStart,
-                          const Char** token_end) {
-    SkipWhitespaceAndComments(start, end, tokenStart);
-    start = *tokenStart;
-
-    if (start == end)
-      return NoInput;
-
-    switch (*start) {
-      case 'n':
-        if (ParseConstToken(start, end, token_end, kNullString))
-          return NullToken;
-        break;
-      case 't':
-        if (ParseConstToken(start, end, token_end, kTrueString))
-          return BoolTrue;
-        break;
-      case 'f':
-        if (ParseConstToken(start, end, token_end, kFalseString))
-          return BoolFalse;
-        break;
-      case '[':
-        *token_end = start + 1;
-        return ArrayBegin;
-      case ']':
-        *token_end = start + 1;
-        return ArrayEnd;
-      case ',':
-        *token_end = start + 1;
-        return ListSeparator;
-      case '{':
-        *token_end = start + 1;
-        return ObjectBegin;
-      case '}':
-        *token_end = start + 1;
-        return ObjectEnd;
-      case ':':
-        *token_end = start + 1;
-        return ObjectPairSeparator;
-      case '0':
-      case '1':
-      case '2':
-      case '3':
-      case '4':
-      case '5':
-      case '6':
-      case '7':
-      case '8':
-      case '9':
-      case '-':
-        if (ParseNumberToken(start, end, token_end))
-          return Number;
-        break;
-      case '"':
-        if (ParseStringToken(start + 1, end, token_end))
-          return StringLiteral;
-        break;
-    }
-    return InvalidToken;
-  }
-
-  static int HexToInt(Char c) {
-    if ('0' <= c && c <= '9')
-      return c - '0';
-    if ('A' <= c && c <= 'F')
-      return c - 'A' + 10;
-    if ('a' <= c && c <= 'f')
-      return c - 'a' + 10;
-    assert(false);  // Unreachable.
-    return 0;
-  }
-
-  static bool DecodeString(const Char* start,
-                           const Char* end,
-                           std::vector<uint16_t>* output) {
-    if (start == end)
-      return true;
-    if (start > end)
-      return false;
-    output->reserve(end - start);
-    while (start < end) {
-      uint16_t c = *start++;
-      // If the |Char| we're dealing with is really a byte, then
-      // we have utf8 here, and we need to check for multibyte characters
-      // and transcode them to utf16 (either one or two utf16 chars).
-      if (sizeof(Char) == sizeof(uint8_t) && c > 0x7f) {
-        // Inspect the leading byte to figure out how long the utf8
-        // byte sequence is; while doing this initialize |codepoint|
-        // with the first few bits.
-        // See table in: https://en.wikipedia.org/wiki/UTF-8
-        // byte one is 110x xxxx -> 2 byte utf8 sequence
-        // byte one is 1110 xxxx -> 3 byte utf8 sequence
-        // byte one is 1111 0xxx -> 4 byte utf8 sequence
-        uint32_t codepoint;
-        int num_bytes_left;
-        if ((c & 0xe0) == 0xc0) {  // 2 byte utf8 sequence
-          num_bytes_left = 1;
-          codepoint = c & 0x1f;
-        } else if ((c & 0xf0) == 0xe0) {  // 3 byte utf8 sequence
-          num_bytes_left = 2;
-          codepoint = c & 0x0f;
-        } else if ((c & 0xf8) == 0xf0) {  // 4 byte utf8 sequence
-          codepoint = c & 0x07;
-          num_bytes_left = 3;
-        } else {
-          return false;  // invalid leading byte
-        }
-
-        // If we have enough bytes in our inpput, decode the remaining ones
-        // belonging to this Unicode character into |codepoint|.
-        if (start + num_bytes_left > end)
-          return false;
-        while (num_bytes_left > 0) {
-          c = *start++;
-          --num_bytes_left;
-          // Check the next byte is a continuation byte, that is 10xx xxxx.
-          if ((c & 0xc0) != 0x80)
-            return false;
-          codepoint = (codepoint << 6) | (c & 0x3f);
-        }
-
-        // Disallow overlong encodings for ascii characters, as these
-        // would include " and other characters significant to JSON
-        // string termination / control.
-        if (codepoint <= 0x7f)
-          return false;
-        // Invalid in UTF8, and can't be represented in UTF16 anyway.
-        if (codepoint > 0x10ffff)
-          return false;
-
-        // So, now we transcode to UTF16,
-        // using the math described at https://en.wikipedia.org/wiki/UTF-16,
-        // for either one or two 16 bit characters.
-        if (codepoint < 0xffff) {
-          output->push_back(codepoint);
-          continue;
-        }
-        codepoint -= 0x10000;
-        output->push_back((codepoint >> 10) + 0xd800);    // high surrogate
-        output->push_back((codepoint & 0x3ff) + 0xdc00);  // low surrogate
-        continue;
-      }
-      if ('\\' != c) {
-        output->push_back(c);
-        continue;
-      }
-      if (start == end)
-        return false;
-      c = *start++;
-
-      if (c == 'x') {
-        // \x is not supported.
-        return false;
-      }
-
-      switch (c) {
-        case '"':
-        case '/':
-        case '\\':
-          break;
-        case 'b':
-          c = '\b';
-          break;
-        case 'f':
-          c = '\f';
-          break;
-        case 'n':
-          c = '\n';
-          break;
-        case 'r':
-          c = '\r';
-          break;
-        case 't':
-          c = '\t';
-          break;
-        case 'v':
-          c = '\v';
-          break;
-        case 'u':
-          c = (HexToInt(*start) << 12) + (HexToInt(*(start + 1)) << 8) +
-              (HexToInt(*(start + 2)) << 4) + HexToInt(*(start + 3));
-          start += 4;
-          break;
-        default:
-          return false;
-      }
-      output->push_back(c);
-    }
-    return true;
-  }
-
-  void ParseValue(const Char* start,
-                  const Char* end,
-                  const Char** value_token_end,
-                  int depth) {
-    if (depth > kStackLimit) {
-      HandleError(Error::JSON_PARSER_STACK_LIMIT_EXCEEDED, start);
-      return;
-    }
-    const Char* token_start = nullptr;
-    const Char* token_end = nullptr;
-    Token token = ParseToken(start, end, &token_start, &token_end);
-    switch (token) {
-      case NoInput:
-        HandleError(Error::JSON_PARSER_NO_INPUT, token_start);
-        return;
-      case InvalidToken:
-        HandleError(Error::JSON_PARSER_INVALID_TOKEN, token_start);
-        return;
-      case NullToken:
-        handler_->HandleNull();
-        break;
-      case BoolTrue:
-        handler_->HandleBool(true);
-        break;
-      case BoolFalse:
-        handler_->HandleBool(false);
-        break;
-      case Number: {
-        double value;
-        if (!CharsToDouble(token_start, token_end - token_start, &value)) {
-          HandleError(Error::JSON_PARSER_INVALID_NUMBER, token_start);
-          return;
-        }
-        if (value >= std::numeric_limits<int32_t>::min() &&
-            value <= std::numeric_limits<int32_t>::max() &&
-            static_cast<int32_t>(value) == value)
-          handler_->HandleInt32(static_cast<int32_t>(value));
-        else
-          handler_->HandleDouble(value);
-        break;
-      }
-      case StringLiteral: {
-        std::vector<uint16_t> value;
-        bool ok = DecodeString(token_start + 1, token_end - 1, &value);
-        if (!ok) {
-          HandleError(Error::JSON_PARSER_INVALID_STRING, token_start);
-          return;
-        }
-        handler_->HandleString16(span<uint16_t>(value.data(), value.size()));
-        break;
-      }
-      case ArrayBegin: {
-        handler_->HandleArrayBegin();
-        start = token_end;
-        token = ParseToken(start, end, &token_start, &token_end);
-        while (token != ArrayEnd) {
-          ParseValue(start, end, &token_end, depth + 1);
-          if (error_)
-            return;
-
-          // After a list value, we expect a comma or the end of the list.
-          start = token_end;
-          token = ParseToken(start, end, &token_start, &token_end);
-          if (token == ListSeparator) {
-            start = token_end;
-            token = ParseToken(start, end, &token_start, &token_end);
-            if (token == ArrayEnd) {
-              HandleError(Error::JSON_PARSER_UNEXPECTED_ARRAY_END, token_start);
-              return;
-            }
-          } else if (token != ArrayEnd) {
-            // Unexpected value after list value. Bail out.
-            HandleError(Error::JSON_PARSER_COMMA_OR_ARRAY_END_EXPECTED,
-                        token_start);
-            return;
-          }
-        }
-        handler_->HandleArrayEnd();
-        break;
-      }
-      case ObjectBegin: {
-        handler_->HandleMapBegin();
-        start = token_end;
-        token = ParseToken(start, end, &token_start, &token_end);
-        while (token != ObjectEnd) {
-          if (token != StringLiteral) {
-            HandleError(Error::JSON_PARSER_STRING_LITERAL_EXPECTED,
-                        token_start);
-            return;
-          }
-          std::vector<uint16_t> key;
-          if (!DecodeString(token_start + 1, token_end - 1, &key)) {
-            HandleError(Error::JSON_PARSER_INVALID_STRING, token_start);
-            return;
-          }
-          handler_->HandleString16(span<uint16_t>(key.data(), key.size()));
-          start = token_end;
-
-          token = ParseToken(start, end, &token_start, &token_end);
-          if (token != ObjectPairSeparator) {
-            HandleError(Error::JSON_PARSER_COLON_EXPECTED, token_start);
-            return;
-          }
-          start = token_end;
-
-          ParseValue(start, end, &token_end, depth + 1);
-          if (error_)
-            return;
-          start = token_end;
-
-          // After a key/value pair, we expect a comma or the end of the
-          // object.
-          token = ParseToken(start, end, &token_start, &token_end);
-          if (token == ListSeparator) {
-            start = token_end;
-            token = ParseToken(start, end, &token_start, &token_end);
-            if (token == ObjectEnd) {
-              HandleError(Error::JSON_PARSER_UNEXPECTED_MAP_END, token_start);
-              return;
-            }
-          } else if (token != ObjectEnd) {
-            // Unexpected value after last object value. Bail out.
-            HandleError(Error::JSON_PARSER_COMMA_OR_MAP_END_EXPECTED,
-                        token_start);
-            return;
-          }
-        }
-        handler_->HandleMapEnd();
-        break;
-      }
-
-      default:
-        // We got a token that's not a value.
-        HandleError(Error::JSON_PARSER_VALUE_EXPECTED, token_start);
-        return;
-    }
-
-    SkipWhitespaceAndComments(token_end, end, value_token_end);
-  }
-
-  void HandleError(Error error, const Char* pos) {
-    assert(error != Error::OK);
-    if (!error_) {
-      handler_->HandleError(
-          Status{error, static_cast<size_t>(pos - start_pos_)});
-      error_ = true;
-    }
-  }
-
-  const Char* start_pos_ = nullptr;
-  bool error_ = false;
-  const Platform* platform_;
-  StreamingParserHandler* handler_;
-};
-}  // namespace
-
-void ParseJSON(const Platform& platform,
-               span<uint8_t> chars,
-               StreamingParserHandler* handler) {
-  JsonParser<uint8_t> parser(&platform, handler);
-  parser.Parse(chars.data(), chars.size());
-}
-
-void ParseJSON(const Platform& platform,
-               span<uint16_t> chars,
-               StreamingParserHandler* handler) {
-  JsonParser<uint16_t> parser(&platform, handler);
-  parser.Parse(chars.data(), chars.size());
-}
-
-// =============================================================================
-// json::ConvertCBORToJSON, json::ConvertJSONToCBOR - for transcoding
-// =============================================================================
-template <typename C>
-Status ConvertCBORToJSONTmpl(const Platform& platform,
-                             span<uint8_t> cbor,
-                             C* json) {
-  Status status;
-  std::unique_ptr<StreamingParserHandler> json_writer =
-      NewJSONEncoder(&platform, json, &status);
-  cbor::ParseCBOR(cbor, json_writer.get());
-  return status;
-}
-
-Status ConvertCBORToJSON(const Platform& platform,
-                         span<uint8_t> cbor,
-                         std::vector<uint8_t>* json) {
-  return ConvertCBORToJSONTmpl(platform, cbor, json);
-}
-Status ConvertCBORToJSON(const Platform& platform,
-                         span<uint8_t> cbor,
-                         std::string* json) {
-  return ConvertCBORToJSONTmpl(platform, cbor, json);
-}
-
-template <typename T, typename C>
-Status ConvertJSONToCBORTmpl(const Platform& platform, span<T> json, C* cbor) {
-  Status status;
-  std::unique_ptr<StreamingParserHandler> encoder =
-      cbor::NewCBOREncoder(cbor, &status);
-  ParseJSON(platform, json, encoder.get());
-  return status;
-}
-Status ConvertJSONToCBOR(const Platform& platform,
-                         span<uint8_t> json,
-                         std::string* cbor) {
-  return ConvertJSONToCBORTmpl(platform, json, cbor);
-}
-Status ConvertJSONToCBOR(const Platform& platform,
-                         span<uint16_t> json,
-                         std::string* cbor) {
-  return ConvertJSONToCBORTmpl(platform, json, cbor);
-}
-Status ConvertJSONToCBOR(const Platform& platform,
-                         span<uint8_t> json,
-                         std::vector<uint8_t>* cbor) {
-  return ConvertJSONToCBORTmpl(platform, json, cbor);
-}
-Status ConvertJSONToCBOR(const Platform& platform,
-                         span<uint16_t> json,
-                         std::vector<uint8_t>* cbor) {
-  return ConvertJSONToCBORTmpl(platform, json, cbor);
-}
-}  // namespace json
-}  // namespace v8_inspector_protocol_encoding
diff --git a/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_cpp.template b/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_cpp.template
index 84c3efd3a0e652..52aa4977a9d044 100644
--- a/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_cpp.template
+++ b/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_cpp.template
@@ -70,11 +70,11 @@ DispatcherBase::WeakPtr::~WeakPtr()
         m_dispatcher->m_weakPtrs.erase(this);
 }
 
-DispatcherBase::Callback::Callback(std::unique_ptr<DispatcherBase::WeakPtr> backendImpl, int callId, const String& method, const ProtocolMessage& message)
+DispatcherBase::Callback::Callback(std::unique_ptr<DispatcherBase::WeakPtr> backendImpl, int callId, const String& method, {{config.crdtp.namespace}}::span<uint8_t> message)
     : m_backendImpl(std::move(backendImpl))
     , m_callId(callId)
     , m_method(method)
-    , m_message(message) { }
+    , m_message(message.begin(), message.end()) { }
 
 DispatcherBase::Callback::~Callback() = default;
 
@@ -95,7 +95,7 @@ void DispatcherBase::Callback::fallThroughIfActive()
 {
     if (!m_backendImpl || !m_backendImpl->get())
         return;
-    m_backendImpl->get()->channel()->fallThrough(m_callId, m_method, m_message);
+    m_backendImpl->get()->channel()->fallThrough(m_callId, m_method, {{config.crdtp.namespace}}::SpanFrom(m_message));
     m_backendImpl = nullptr;
 }
 
@@ -142,14 +142,9 @@ public:
         return std::unique_ptr<ProtocolError>(new ProtocolError(code, errorMessage));
     }
 
-    String serializeToJSON() override
+    void AppendSerialized(std::vector<uint8_t>* out) const override
     {
-        return serialize()->serializeToJSON();
-    }
-
-    std::vector<uint8_t> serializeToBinary() override
-    {
-        return serialize()->serializeToBinary();
+        toDictionary()->AppendSerialized(out);
     }
 
     ~ProtocolError() override {}
@@ -161,7 +156,7 @@ private:
     {
     }
 
-    std::unique_ptr<DictionaryValue> serialize() {
+    std::unique_ptr<DictionaryValue> toDictionary() const {
         std::unique_ptr<protocol::DictionaryValue> error = DictionaryValue::create();
         error->setInteger("code", m_code);
         error->setString("message", m_errorMessage);
@@ -284,7 +279,7 @@ bool UberDispatcher::canDispatch(const String& in_method)
     return !!findDispatcher(method);
 }
 
-void UberDispatcher::dispatch(int callId, const String& in_method, std::unique_ptr<Value> parsedMessage, const ProtocolMessage& rawMessage)
+void UberDispatcher::dispatch(int callId, const String& in_method, std::unique_ptr<Value> parsedMessage, {{config.crdtp.namespace}}::span<uint8_t> rawMessage)
 {
     String method = in_method;
     auto redirectIt = m_redirects.find(method);
@@ -304,13 +299,13 @@ UberDispatcher::~UberDispatcher() = default;
 // static
 std::unique_ptr<Serializable> InternalResponse::createResponse(int callId, std::unique_ptr<Serializable> params)
 {
-    return std::unique_ptr<Serializable>(new InternalResponse(callId, String(), std::move(params)));
+    return std::unique_ptr<Serializable>(new InternalResponse(callId, nullptr, std::move(params)));
 }
 
 // static
-std::unique_ptr<Serializable> InternalResponse::createNotification(const String& notification, std::unique_ptr<Serializable> params)
+std::unique_ptr<Serializable> InternalResponse::createNotification(const char* method, std::unique_ptr<Serializable> params)
 {
-    return std::unique_ptr<Serializable>(new InternalResponse(0, notification, std::move(params)));
+    return std::unique_ptr<Serializable>(new InternalResponse(0, method, std::move(params)));
 }
 
 // static
@@ -319,37 +314,38 @@ std::unique_ptr<Serializable> InternalResponse::createErrorResponse(int callId,
     return ProtocolError::createErrorResponse(callId, code, message, nullptr);
 }
 
-String InternalResponse::serializeToJSON()
+void InternalResponse::AppendSerialized(std::vector<uint8_t>* out) const
 {
-    std::unique_ptr<DictionaryValue> result = DictionaryValue::create();
-    std::unique_ptr<Serializable> params(m_params ? std::move(m_params) : DictionaryValue::create());
-    if (m_notification.length()) {
-        result->setString("method", m_notification);
-        result->setValue("params", SerializedValue::fromJSON(params->serializeToJSON()));
+    using {{config.crdtp.namespace}}::cbor::NewCBOREncoder;
+    using {{config.crdtp.namespace}}::ParserHandler;
+    using {{config.crdtp.namespace}}::Status;
+    using {{config.crdtp.namespace}}::SpanFrom;
+
+    Status status;
+    std::unique_ptr<ParserHandler> encoder = NewCBOREncoder(out, &status);
+    encoder->HandleMapBegin();
+    if (m_method) {
+        encoder->HandleString8(SpanFrom("method"));
+        encoder->HandleString8(SpanFrom(m_method));
+        encoder->HandleString8(SpanFrom("params"));
     } else {
-        result->setInteger("id", m_callId);
-        result->setValue("result", SerializedValue::fromJSON(params->serializeToJSON()));
+        encoder->HandleString8(SpanFrom("id"));
+        encoder->HandleInt32(m_callId);
+        encoder->HandleString8(SpanFrom("result"));
     }
-    return result->serializeToJSON();
-}
-
-std::vector<uint8_t> InternalResponse::serializeToBinary()
-{
-    std::unique_ptr<DictionaryValue> result = DictionaryValue::create();
-    std::unique_ptr<Serializable> params(m_params ? std::move(m_params) : DictionaryValue::create());
-    if (m_notification.length()) {
-        result->setString("method", m_notification);
-        result->setValue("params", SerializedValue::fromBinary(params->serializeToBinary()));
+    if (m_params) {
+        m_params->AppendSerialized(out);
     } else {
-        result->setInteger("id", m_callId);
-        result->setValue("result", SerializedValue::fromBinary(params->serializeToBinary()));
+        encoder->HandleMapBegin();
+        encoder->HandleMapEnd();
     }
-    return result->serializeToBinary();
+    encoder->HandleMapEnd();
+    DCHECK(status.ok());
 }
 
-InternalResponse::InternalResponse(int callId, const String& notification, std::unique_ptr<Serializable> params)
+InternalResponse::InternalResponse(int callId, const char* method, std::unique_ptr<Serializable> params)
     : m_callId(callId)
-    , m_notification(notification)
+    , m_method(method)
     , m_params(params ? std::move(params) : nullptr)
 {
 }
diff --git a/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_h.template b/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_h.template
index 3862fb9a73a759..5231123afcde6b 100644
--- a/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_h.template
+++ b/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_h.template
@@ -11,6 +11,8 @@
 //#include "ErrorSupport.h"
 //#include "Values.h"
 
+#include "{{config.crdtp.dir}}/span.h"
+
 {% for namespace in config.protocol.namespace %}
 namespace {{namespace}} {
 {% endfor %}
@@ -71,7 +73,7 @@ public:
 
     class {{config.lib.export_macro}} Callback {
     public:
-        Callback(std::unique_ptr<WeakPtr> backendImpl, int callId, const String& method, const ProtocolMessage& message);
+        Callback(std::unique_ptr<WeakPtr> backendImpl, int callId, const String& method, {{config.crdtp.namespace}}::span<uint8_t> message);
         virtual ~Callback();
         void dispose();
 
@@ -83,14 +85,14 @@ public:
         std::unique_ptr<WeakPtr> m_backendImpl;
         int m_callId;
         String m_method;
-        ProtocolMessage m_message;
+        std::vector<uint8_t> m_message;
     };
 
     explicit DispatcherBase(FrontendChannel*);
     virtual ~DispatcherBase();
 
     virtual bool canDispatch(const String& method) = 0;
-    virtual void dispatch(int callId, const String& method, const ProtocolMessage& rawMessage, std::unique_ptr<protocol::DictionaryValue> messageObject) = 0;
+    virtual void dispatch(int callId, const String& method, {{config.crdtp.namespace}}::span<uint8_t> rawMessage, std::unique_ptr<protocol::DictionaryValue> messageObject) = 0;
     FrontendChannel* channel() { return m_frontendChannel; }
 
     void sendResponse(int callId, const DispatchResponse&, std::unique_ptr<protocol::DictionaryValue> result);
@@ -114,7 +116,7 @@ public:
     void setupRedirects(const std::unordered_map<String, String>&);
     bool parseCommand(Value* message, int* callId, String* method);
     bool canDispatch(const String& method);
-    void dispatch(int callId, const String& method, std::unique_ptr<Value> message, const ProtocolMessage& rawMessage);
+    void dispatch(int callId, const String& method, std::unique_ptr<Value> message, {{config.crdtp.namespace}}::span<uint8_t> rawMessage);
     FrontendChannel* channel() { return m_frontendChannel; }
     virtual ~UberDispatcher();
 
@@ -129,29 +131,23 @@ class InternalResponse : public Serializable {
     PROTOCOL_DISALLOW_COPY(InternalResponse);
 public:
     static std::unique_ptr<Serializable> createResponse(int callId, std::unique_ptr<Serializable> params);
-    static std::unique_ptr<Serializable> createNotification(const String& notification, std::unique_ptr<Serializable> params = nullptr);
+    static std::unique_ptr<Serializable> createNotification(const char* method, std::unique_ptr<Serializable> params = nullptr);
     static std::unique_ptr<Serializable> createErrorResponse(int callId, DispatchResponse::ErrorCode code, const String& message);
 
-    String serializeToJSON() override;
-    std::vector<uint8_t> serializeToBinary() override;
+    void AppendSerialized(std::vector<uint8_t>* out) const override;
 
     ~InternalResponse() override {}
 
 private:
-    InternalResponse(int callId, const String& notification, std::unique_ptr<Serializable> params);
+    InternalResponse(int callId, const char* method, std::unique_ptr<Serializable> params);
 
     int m_callId;
-    String m_notification;
+    const char* m_method = nullptr;
     std::unique_ptr<Serializable> m_params;
 };
 
 class InternalRawNotification : public Serializable {
 public:
-    static std::unique_ptr<InternalRawNotification> fromJSON(String notification)
-    {
-        return std::unique_ptr<InternalRawNotification>(new InternalRawNotification(std::move(notification)));
-    }
-
     static std::unique_ptr<InternalRawNotification> fromBinary(std::vector<uint8_t> notification)
     {
         return std::unique_ptr<InternalRawNotification>(new InternalRawNotification(std::move(notification)));
@@ -159,23 +155,19 @@ public:
 
     ~InternalRawNotification() override {}
 
-    String serializeToJSON() override
-    {
-        return std::move(m_jsonNotification);
+    std::vector<uint8_t> TakeSerialized() && override {
+        return std::move(m_binaryNotification);
     }
 
-    std::vector<uint8_t> serializeToBinary() override
+    void AppendSerialized(std::vector<uint8_t>* out) const override
     {
-        return std::move(m_binaryNotification);
+        out->insert(out->end(), m_binaryNotification.begin(), m_binaryNotification.end());
     }
 
 private:
-  explicit InternalRawNotification(String notification)
-    : m_jsonNotification(std::move(notification)) { }
   explicit InternalRawNotification(std::vector<uint8_t> notification)
     : m_binaryNotification(std::move(notification)) { }
 
-  String m_jsonNotification;
   std::vector<uint8_t> m_binaryNotification;
 };
 
diff --git a/deps/v8/third_party/inspector_protocol/lib/Forward_h.template b/deps/v8/third_party/inspector_protocol/lib/Forward_h.template
index 7cc47b4f0f09f2..aefc1a16e80a07 100644
--- a/deps/v8/third_party/inspector_protocol/lib/Forward_h.template
+++ b/deps/v8/third_party/inspector_protocol/lib/Forward_h.template
@@ -18,7 +18,7 @@
 #include <unordered_map>
 #include <unordered_set>
 
-#include "{{config.bindings_lib.header}}"
+#include "{{config.crdtp.dir}}/glue.h"
 
 {% for namespace in config.protocol.namespace %}
 namespace {{namespace}} {
@@ -57,8 +57,8 @@ template <typename T>
 using Array = typename detail::ArrayTypedef<T>::type;
 
 namespace detail {
-using {{config.bindings_lib.namespace}}::glue::detail::PtrMaybe;
-using {{config.bindings_lib.namespace}}::glue::detail::ValueMaybe;
+using {{config.crdtp.namespace}}::glue::detail::PtrMaybe;
+using {{config.crdtp.namespace}}::glue::detail::ValueMaybe;
 
 template <typename T>
 struct MaybeTypedef { typedef PtrMaybe<T> type; };
diff --git a/deps/v8/third_party/inspector_protocol/lib/FrontendChannel_h.template b/deps/v8/third_party/inspector_protocol/lib/FrontendChannel_h.template
index df104debadbe85..b677ecdd48f468 100644
--- a/deps/v8/third_party/inspector_protocol/lib/FrontendChannel_h.template
+++ b/deps/v8/third_party/inspector_protocol/lib/FrontendChannel_h.template
@@ -7,29 +7,22 @@
 #ifndef {{"_".join(config.protocol.namespace)}}_FrontendChannel_h
 #define {{"_".join(config.protocol.namespace)}}_FrontendChannel_h
 
+#include "{{config.crdtp.dir}}/serializable.h"
+#include "{{config.crdtp.dir}}/span.h"
+
 {% for namespace in config.protocol.namespace %}
 namespace {{namespace}} {
 {% endfor %}
 
-class {{config.lib.export_macro}} Serializable {
-public:
-    ProtocolMessage serialize(bool binary) {
-      if (binary)
-        return StringUtil::binaryToMessage(serializeToBinary());
-      else
-        return StringUtil::jsonToMessage(serializeToJSON());
-    }
-    virtual String serializeToJSON() = 0;
-    virtual std::vector<uint8_t> serializeToBinary() = 0;
-    virtual ~Serializable() = default;
-};
+using {{config.crdtp.namespace}}::Serializable;
 
 class {{config.lib.export_macro}} FrontendChannel {
 public:
     virtual ~FrontendChannel() { }
     virtual void sendProtocolResponse(int callId, std::unique_ptr<Serializable> message) = 0;
     virtual void sendProtocolNotification(std::unique_ptr<Serializable> message) = 0;
-    virtual void fallThrough(int callId, const String& method, const ProtocolMessage& message) = 0;
+
+    virtual void fallThrough(int callId, const String& method, {{config.crdtp.namespace}}::span<uint8_t> message) = 0;
     virtual void flushProtocolNotifications() = 0;
 };
 
diff --git a/deps/v8/third_party/inspector_protocol/lib/Object_cpp.template b/deps/v8/third_party/inspector_protocol/lib/Object_cpp.template
index 1640a11127b442..3fc36b9ee393b9 100644
--- a/deps/v8/third_party/inspector_protocol/lib/Object_cpp.template
+++ b/deps/v8/third_party/inspector_protocol/lib/Object_cpp.template
@@ -21,6 +21,11 @@ std::unique_ptr<Object> Object::fromValue(protocol::Value* value, ErrorSupport*
     return std::unique_ptr<Object>(new Object(std::unique_ptr<DictionaryValue>(dictionary)));
 }
 
+// Implements Serializable.
+void Object::AppendSerialized(std::vector<uint8_t>* out) const {
+    m_object->AppendSerialized(out);
+}
+
 std::unique_ptr<protocol::DictionaryValue> Object::toValue() const
 {
     return DictionaryValue::cast(m_object->clone());
diff --git a/deps/v8/third_party/inspector_protocol/lib/Object_h.template b/deps/v8/third_party/inspector_protocol/lib/Object_h.template
index ec953d0d4836a4..8a1a2e39f8ad15 100644
--- a/deps/v8/third_party/inspector_protocol/lib/Object_h.template
+++ b/deps/v8/third_party/inspector_protocol/lib/Object_h.template
@@ -11,16 +11,21 @@
 //#include "Forward.h"
 //#include "Values.h"
 
+#include "{{config.crdtp.dir}}/serializable.h"
+
 {% for namespace in config.protocol.namespace %}
 namespace {{namespace}} {
 {% endfor %}
 
-class {{config.lib.export_macro}} Object {
+class {{config.lib.export_macro}} Object : public {{config.crdtp.namespace}}::Serializable {
 public:
     static std::unique_ptr<Object> fromValue(protocol::Value*, ErrorSupport*);
     explicit Object(std::unique_ptr<protocol::DictionaryValue>);
     ~Object();
 
+    // Implements Serializable.
+    void AppendSerialized(std::vector<uint8_t>* out) const override;
+
     std::unique_ptr<protocol::DictionaryValue> toValue() const;
     std::unique_ptr<Object> clone() const;
 private:
diff --git a/deps/v8/third_party/inspector_protocol/lib/Values_cpp.template b/deps/v8/third_party/inspector_protocol/lib/Values_cpp.template
index 038992f6848058..91cd4719839d22 100644
--- a/deps/v8/third_party/inspector_protocol/lib/Values_cpp.template
+++ b/deps/v8/third_party/inspector_protocol/lib/Values_cpp.template
@@ -6,86 +6,37 @@
 
 //#include "Values.h"
 
-#include "{{config.encoding_lib.header}}"
+#include "{{config.crdtp.dir}}/cbor.h"
 
 {% for namespace in config.protocol.namespace %}
 namespace {{namespace}} {
 {% endfor %}
 
 namespace {
-
-const char* const nullValueString = "null";
-const char* const trueValueString = "true";
-const char* const falseValueString = "false";
-
-inline bool escapeChar(uint16_t c, StringBuilder* dst)
-{
-    switch (c) {
-    case '\b': StringUtil::builderAppend(*dst, "\\b"); break;
-    case '\f': StringUtil::builderAppend(*dst, "\\f"); break;
-    case '\n': StringUtil::builderAppend(*dst, "\\n"); break;
-    case '\r': StringUtil::builderAppend(*dst, "\\r"); break;
-    case '\t': StringUtil::builderAppend(*dst, "\\t"); break;
-    case '\\': StringUtil::builderAppend(*dst, "\\\\"); break;
-    case '"': StringUtil::builderAppend(*dst, "\\\""); break;
-    default:
-        return false;
-    }
-    return true;
-}
-
-const char hexDigits[17] = "0123456789ABCDEF";
-
-void appendUnsignedAsHex(uint16_t number, StringBuilder* dst)
-{
-    StringUtil::builderAppend(*dst, "\\u");
-    for (size_t i = 0; i < 4; ++i) {
-        uint16_t c = hexDigits[(number & 0xF000) >> 12];
-        StringUtil::builderAppend(*dst, c);
-        number <<= 4;
-    }
-}
-
-template <typename Char>
-void escapeStringForJSONInternal(const Char* str, unsigned len,
-                                 StringBuilder* dst)
-{
-    for (unsigned i = 0; i < len; ++i) {
-        Char c = str[i];
-        if (escapeChar(c, dst))
-            continue;
-        if (c < 32 || c > 126) {
-            appendUnsignedAsHex(c, dst);
-        } else {
-            StringUtil::builderAppend(*dst, c);
-        }
-    }
-}
-
 // When parsing CBOR, we limit recursion depth for objects and arrays
 // to this constant.
 static constexpr int kStackLimitValues = 1000;
 
-using {{config.encoding_lib.namespace}}::Error;
-using {{config.encoding_lib.namespace}}::Status;
-using {{config.encoding_lib.namespace}}::span;
+using {{config.crdtp.namespace}}::Error;
+using {{config.crdtp.namespace}}::Status;
+using {{config.crdtp.namespace}}::span;
 namespace cbor {
-using {{config.encoding_lib.namespace}}::cbor::CBORTokenTag;
-using {{config.encoding_lib.namespace}}::cbor::CBORTokenizer;
-using {{config.encoding_lib.namespace}}::cbor::EncodeBinary;
-using {{config.encoding_lib.namespace}}::cbor::EncodeDouble;
-using {{config.encoding_lib.namespace}}::cbor::EncodeFalse;
-using {{config.encoding_lib.namespace}}::cbor::EncodeFromLatin1;
-using {{config.encoding_lib.namespace}}::cbor::EncodeFromUTF16;
-using {{config.encoding_lib.namespace}}::cbor::EncodeIndefiniteLengthArrayStart;
-using {{config.encoding_lib.namespace}}::cbor::EncodeIndefiniteLengthMapStart;
-using {{config.encoding_lib.namespace}}::cbor::EncodeInt32;
-using {{config.encoding_lib.namespace}}::cbor::EncodeNull;
-using {{config.encoding_lib.namespace}}::cbor::EncodeStop;
-using {{config.encoding_lib.namespace}}::cbor::EncodeString8;
-using {{config.encoding_lib.namespace}}::cbor::EncodeTrue;
-using {{config.encoding_lib.namespace}}::cbor::EnvelopeEncoder;
-using {{config.encoding_lib.namespace}}::cbor::InitialByteForEnvelope;
+using {{config.crdtp.namespace}}::cbor::CBORTokenTag;
+using {{config.crdtp.namespace}}::cbor::CBORTokenizer;
+using {{config.crdtp.namespace}}::cbor::EncodeBinary;
+using {{config.crdtp.namespace}}::cbor::EncodeDouble;
+using {{config.crdtp.namespace}}::cbor::EncodeFalse;
+using {{config.crdtp.namespace}}::cbor::EncodeFromLatin1;
+using {{config.crdtp.namespace}}::cbor::EncodeFromUTF16;
+using {{config.crdtp.namespace}}::cbor::EncodeIndefiniteLengthArrayStart;
+using {{config.crdtp.namespace}}::cbor::EncodeIndefiniteLengthMapStart;
+using {{config.crdtp.namespace}}::cbor::EncodeInt32;
+using {{config.crdtp.namespace}}::cbor::EncodeNull;
+using {{config.crdtp.namespace}}::cbor::EncodeStop;
+using {{config.crdtp.namespace}}::cbor::EncodeString8;
+using {{config.crdtp.namespace}}::cbor::EncodeTrue;
+using {{config.crdtp.namespace}}::cbor::EnvelopeEncoder;
+using {{config.crdtp.namespace}}::cbor::InitialByteForEnvelope;
 }  // namespace cbor
 
 // Below are three parsing routines for CBOR, which cover enough
@@ -275,13 +226,7 @@ bool Value::asBinary(Binary*) const
     return false;
 }
 
-void Value::writeJSON(StringBuilder* output) const
-{
-    DCHECK(m_type == TypeNull);
-    StringUtil::builderAppend(*output, nullValueString, 4);
-}
-
-void Value::writeBinary(std::vector<uint8_t>* bytes) const {
+void Value::AppendSerialized(std::vector<uint8_t>* bytes) const {
     DCHECK(m_type == TypeNull);
     bytes->push_back(cbor::EncodeNull());
 }
@@ -291,24 +236,6 @@ std::unique_ptr<Value> Value::clone() const
     return Value::null();
 }
 
-String Value::toJSONString() const
-{
-    StringBuilder result;
-    StringUtil::builderReserve(result, 512);
-    writeJSON(&result);
-    return StringUtil::builderToString(result);
-}
-
-String Value::serializeToJSON() {
-    return toJSONString();
-}
-
-std::vector<uint8_t> Value::serializeToBinary() {
-    std::vector<uint8_t> bytes;
-    writeBinary(&bytes);
-    return bytes;
-}
-
 bool FundamentalValue::asBoolean(bool* output) const
 {
     if (type() != TypeBoolean)
@@ -338,26 +265,7 @@ bool FundamentalValue::asInteger(int* output) const
     return true;
 }
 
-void FundamentalValue::writeJSON(StringBuilder* output) const
-{
-    DCHECK(type() == TypeBoolean || type() == TypeInteger || type() == TypeDouble);
-    if (type() == TypeBoolean) {
-        if (m_boolValue)
-            StringUtil::builderAppend(*output, trueValueString, 4);
-        else
-            StringUtil::builderAppend(*output, falseValueString, 5);
-    } else if (type() == TypeDouble) {
-        if (!std::isfinite(m_doubleValue)) {
-            StringUtil::builderAppend(*output, nullValueString, 4);
-            return;
-        }
-        StringUtil::builderAppend(*output, StringUtil::fromDouble(m_doubleValue));
-    } else if (type() == TypeInteger) {
-        StringUtil::builderAppend(*output, StringUtil::fromInteger(m_integerValue));
-    }
-}
-
-void FundamentalValue::writeBinary(std::vector<uint8_t>* bytes) const {
+void FundamentalValue::AppendSerialized(std::vector<uint8_t>* bytes) const {
     switch (type()) {
     case TypeDouble:
         cbor::EncodeDouble(m_doubleValue, bytes);
@@ -391,12 +299,6 @@ bool StringValue::asString(String* output) const
     return true;
 }
 
-void StringValue::writeJSON(StringBuilder* output) const
-{
-    DCHECK(type() == TypeString);
-    StringUtil::builderAppendQuotedString(*output, m_stringValue);
-}
-
 namespace {
 // This routine distinguishes between the current encoding for a given
 // string |s|, and calls encoding routines that will
@@ -426,7 +328,7 @@ void EncodeString(const String& s, std::vector<uint8_t>* out) {
 }
 }  // namespace
 
-void StringValue::writeBinary(std::vector<uint8_t>* bytes) const {
+void StringValue::AppendSerialized(std::vector<uint8_t>* bytes) const {
   EncodeString(m_stringValue, bytes);
 }
 
@@ -441,13 +343,7 @@ bool BinaryValue::asBinary(Binary* output) const
     return true;
 }
 
-void BinaryValue::writeJSON(StringBuilder* output) const
-{
-    DCHECK(type() == TypeBinary);
-    StringUtil::builderAppendQuotedString(*output, m_binaryValue.toBase64());
-}
-
-void BinaryValue::writeBinary(std::vector<uint8_t>* bytes) const {
+void BinaryValue::AppendSerialized(std::vector<uint8_t>* bytes) const {
     cbor::EncodeBinary(span<uint8_t>(m_binaryValue.data(),
                                      m_binaryValue.size()), bytes);
 }
@@ -457,22 +353,6 @@ std::unique_ptr<Value> BinaryValue::clone() const
     return BinaryValue::create(m_binaryValue);
 }
 
-void SerializedValue::writeJSON(StringBuilder* output) const
-{
-    DCHECK(type() == TypeSerialized);
-    StringUtil::builderAppend(*output, m_serializedJSON);
-}
-
-void SerializedValue::writeBinary(std::vector<uint8_t>* output) const
-{
-    DCHECK(type() == TypeSerialized);
-    output->insert(output->end(), m_serializedBinary.begin(), m_serializedBinary.end());
-}
-
-std::unique_ptr<Value> SerializedValue::clone() const
-{
-    return std::unique_ptr<SerializedValue>(new SerializedValue(m_serializedJSON, m_serializedBinary));
-}
 
 DictionaryValue::~DictionaryValue()
 {
@@ -596,22 +476,7 @@ void DictionaryValue::remove(const String& name)
     m_order.erase(std::remove(m_order.begin(), m_order.end(), name), m_order.end());
 }
 
-void DictionaryValue::writeJSON(StringBuilder* output) const
-{
-    StringUtil::builderAppend(*output, '{');
-    for (size_t i = 0; i < m_order.size(); ++i) {
-        Dictionary::const_iterator it = m_data.find(m_order[i]);
-        CHECK(it != m_data.end());
-        if (i)
-            StringUtil::builderAppend(*output, ',');
-        StringUtil::builderAppendQuotedString(*output, it->first);
-        StringUtil::builderAppend(*output, ':');
-        it->second->writeJSON(output);
-    }
-    StringUtil::builderAppend(*output, '}');
-}
-
-void DictionaryValue::writeBinary(std::vector<uint8_t>* bytes) const {
+void DictionaryValue::AppendSerialized(std::vector<uint8_t>* bytes) const {
     cbor::EnvelopeEncoder encoder;
     encoder.EncodeStart(bytes);
     bytes->push_back(cbor::EncodeIndefiniteLengthMapStart());
@@ -620,7 +485,7 @@ void DictionaryValue::writeBinary(std::vector<uint8_t>* bytes) const {
         Dictionary::const_iterator value = m_data.find(key);
         DCHECK(value != m_data.cend() && value->second);
         EncodeString(key, bytes);
-        value->second->writeBinary(bytes);
+        value->second->AppendSerialized(bytes);
     }
     bytes->push_back(cbor::EncodeStop());
     encoder.EncodeStop(bytes);
@@ -647,25 +512,12 @@ ListValue::~ListValue()
 {
 }
 
-void ListValue::writeJSON(StringBuilder* output) const
-{
-    StringUtil::builderAppend(*output, '[');
-    bool first = true;
-    for (const std::unique_ptr<protocol::Value>& value : m_data) {
-        if (!first)
-            StringUtil::builderAppend(*output, ',');
-        value->writeJSON(output);
-        first = false;
-    }
-    StringUtil::builderAppend(*output, ']');
-}
-
-void ListValue::writeBinary(std::vector<uint8_t>* bytes) const {
+void ListValue::AppendSerialized(std::vector<uint8_t>* bytes) const {
     cbor::EnvelopeEncoder encoder;
     encoder.EncodeStart(bytes);
     bytes->push_back(cbor::EncodeIndefiniteLengthArrayStart());
     for (size_t i = 0; i < m_data.size(); ++i) {
-        m_data[i]->writeBinary(bytes);
+        m_data[i]->AppendSerialized(bytes);
     }
     bytes->push_back(cbor::EncodeStop());
     encoder.EncodeStop(bytes);
@@ -696,16 +548,6 @@ protocol::Value* ListValue::at(size_t index)
     return m_data[index].get();
 }
 
-void escapeLatinStringForJSON(const uint8_t* str, unsigned len, StringBuilder* dst)
-{
-    escapeStringForJSONInternal<uint8_t>(str, len, dst);
-}
-
-void escapeWideStringForJSON(const uint16_t* str, unsigned len, StringBuilder* dst)
-{
-    escapeStringForJSONInternal<uint16_t>(str, len, dst);
-}
-
 {% for namespace in config.protocol.namespace %}
 } // namespace {{namespace}}
 {% endfor %}
diff --git a/deps/v8/third_party/inspector_protocol/lib/Values_h.template b/deps/v8/third_party/inspector_protocol/lib/Values_h.template
index 4d6fde07d4df2c..41d326e71e94f9 100644
--- a/deps/v8/third_party/inspector_protocol/lib/Values_h.template
+++ b/deps/v8/third_party/inspector_protocol/lib/Values_h.template
@@ -39,7 +39,6 @@ public:
         TypeBinary,
         TypeObject,
         TypeArray,
-        TypeSerialized,
         TypeImported
     };
 
@@ -53,12 +52,8 @@ public:
     virtual bool asString(String* output) const;
     virtual bool asBinary(Binary* output) const;
 
-    virtual void writeJSON(StringBuilder* output) const;
-    virtual void writeBinary(std::vector<uint8_t>* bytes) const;
+    virtual void AppendSerialized(std::vector<uint8_t>* bytes) const override;
     virtual std::unique_ptr<Value> clone() const;
-    String toJSONString() const;
-    String serializeToJSON() override;
-    std::vector<uint8_t> serializeToBinary() override;
 
 protected:
     Value() : m_type(TypeNull) { }
@@ -91,8 +86,7 @@ public:
     bool asBoolean(bool* output) const override;
     bool asDouble(double* output) const override;
     bool asInteger(int* output) const override;
-    void writeJSON(StringBuilder* output) const override;
-    void writeBinary(std::vector<uint8_t>* bytes) const override;
+    void AppendSerialized(std::vector<uint8_t>* bytes) const override;
     std::unique_ptr<Value> clone() const override;
 
 private:
@@ -120,8 +114,7 @@ public:
     }
 
     bool asString(String* output) const override;
-    void writeJSON(StringBuilder* output) const override;
-    void writeBinary(std::vector<uint8_t>* bytes) const override;
+    void AppendSerialized(std::vector<uint8_t>* bytes) const override;
     std::unique_ptr<Value> clone() const override;
 
 private:
@@ -139,8 +132,7 @@ public:
     }
 
     bool asBinary(Binary* output) const override;
-    void writeJSON(StringBuilder* output) const override;
-    void writeBinary(std::vector<uint8_t>* bytes) const override;
+    void AppendSerialized(std::vector<uint8_t>* bytes) const override;
     std::unique_ptr<Value> clone() const override;
 
 private:
@@ -149,31 +141,6 @@ private:
     Binary m_binaryValue;
 };
 
-class {{config.lib.export_macro}} SerializedValue : public Value {
-public:
-    static std::unique_ptr<SerializedValue> fromJSON(const String& value)
-    {
-        return std::unique_ptr<SerializedValue>(new SerializedValue(value));
-    }
-
-    static std::unique_ptr<SerializedValue> fromBinary(std::vector<uint8_t> value)
-    {
-        return std::unique_ptr<SerializedValue>(new SerializedValue(std::move(value)));
-    }
-
-    void writeJSON(StringBuilder* output) const override;
-    void writeBinary(std::vector<uint8_t>* bytes) const override;
-    std::unique_ptr<Value> clone() const override;
-
-private:
-    explicit SerializedValue(const String& json) : Value(TypeSerialized), m_serializedJSON(json) { }
-    explicit SerializedValue(std::vector<uint8_t> binary) : Value(TypeSerialized), m_serializedBinary(std::move(binary)) { }
-    SerializedValue(const String& json, const std::vector<uint8_t>& binary)
-        : Value(TypeSerialized), m_serializedJSON(json), m_serializedBinary(binary) { }
-    String m_serializedJSON;
-    std::vector<uint8_t> m_serializedBinary;
-};
-
 class {{config.lib.export_macro}} DictionaryValue : public Value {
 public:
     using Entry = std::pair<String, Value*>;
@@ -194,8 +161,7 @@ public:
         return std::unique_ptr<DictionaryValue>(DictionaryValue::cast(value.release()));
     }
 
-    void writeJSON(StringBuilder* output) const override;
-    void writeBinary(std::vector<uint8_t>* bytes) const override;
+    void AppendSerialized(std::vector<uint8_t>* bytes) const override;
     std::unique_ptr<Value> clone() const override;
 
     size_t size() const { return m_data.size(); }
@@ -263,8 +229,7 @@ public:
 
     ~ListValue() override;
 
-    void writeJSON(StringBuilder* output) const override;
-    void writeBinary(std::vector<uint8_t>* bytes) const override;
+    void AppendSerialized(std::vector<uint8_t>* bytes) const override;
     std::unique_ptr<Value> clone() const override;
 
     void pushValue(std::unique_ptr<Value>);
@@ -278,9 +243,6 @@ private:
     std::vector<std::unique_ptr<Value>> m_data;
 };
 
-void escapeLatinStringForJSON(const uint8_t* str, unsigned len, StringBuilder* dst);
-void escapeWideStringForJSON(const uint16_t* str, unsigned len, StringBuilder* dst);
-
 {% for namespace in config.protocol.namespace %}
 } // namespace {{namespace}}
 {% endfor %}
diff --git a/deps/v8/third_party/inspector_protocol/lib/base_string_adapter_cc.template b/deps/v8/third_party/inspector_protocol/lib/base_string_adapter_cc.template
index 4619f32c3076ed..edd3da99a9d8ae 100644
--- a/deps/v8/third_party/inspector_protocol/lib/base_string_adapter_cc.template
+++ b/deps/v8/third_party/inspector_protocol/lib/base_string_adapter_cc.template
@@ -15,6 +15,7 @@
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
+#include "{{config.crdtp.dir}}/cbor.h"
 
 {% for namespace in config.protocol.namespace %}
 namespace {{namespace}} {
@@ -128,29 +129,6 @@ std::unique_ptr<base::Value> toBaseValue(Value* value, int depth) {
   return nullptr;
 }
 
-// static
-std::unique_ptr<Value> StringUtil::parseMessage(
-    const std::string& message, bool binary) {
-  if (binary) {
-    return Value::parseBinary(
-        reinterpret_cast<const uint8_t*>(message.data()),
-        message.length());
-  }
-  std::unique_ptr<base::Value> value = base::JSONReader::ReadDeprecated(message);
-  return toProtocolValue(value.get(), 1000);
-}
-
-// static
-ProtocolMessage StringUtil::jsonToMessage(String message) {
-  return message;
-}
-
-// static
-ProtocolMessage StringUtil::binaryToMessage(std::vector<uint8_t> message) {
-  // TODO(pfeldman): figure out what to do with this copy.
-  return std::string(reinterpret_cast<const char*>(message.data()), message.size());
-}
-
 StringBuilder::StringBuilder() {}
 
 StringBuilder::~StringBuilder() {}
@@ -167,16 +145,6 @@ void StringBuilder::append(const char* characters, size_t length) {
   string_.append(characters, length);
 }
 
-// static
-void StringUtil::builderAppendQuotedString(StringBuilder& builder,
-                                           const String& str) {
-  builder.append('"');
-  base::string16 str16 = base::UTF8ToUTF16(str);
-  escapeWideStringForJSON(reinterpret_cast<const uint16_t*>(&str16[0]),
-                          str16.length(), &builder);
-  builder.append('"');
-}
-
 std::string StringBuilder::toString() {
   return string_;
 }
@@ -199,6 +167,10 @@ Binary::Binary(const Binary& binary) : bytes_(binary.bytes_) {}
 Binary::Binary(scoped_refptr<base::RefCountedMemory> bytes) : bytes_(bytes) {}
 Binary::~Binary() {}
 
+void Binary::AppendSerialized(std::vector<uint8_t>* out) const {
+  crdtp::cbor::EncodeBinary(crdtp::span<uint8_t>(data(), size()), out);
+}
+
 String Binary::toBase64() const {
   std::string encoded;
   base::Base64Encode(
diff --git a/deps/v8/third_party/inspector_protocol/lib/base_string_adapter_h.template b/deps/v8/third_party/inspector_protocol/lib/base_string_adapter_h.template
index 6a9ba3867a58d9..32bd7ea233dff0 100644
--- a/deps/v8/third_party/inspector_protocol/lib/base_string_adapter_h.template
+++ b/deps/v8/third_party/inspector_protocol/lib/base_string_adapter_h.template
@@ -15,6 +15,8 @@
 #include "base/macros.h"
 #include "base/memory/ref_counted_memory.h"
 #include "base/strings/string_number_conversions.h"
+#include "{{config.crdtp.dir}}/serializable.h"
+
 {% if config.lib.export_header %}
 #include "{{config.lib.export_header}}"
 {% endif %}
@@ -30,7 +32,6 @@ namespace {{namespace}} {
 class Value;
 
 using String = std::string;
-using ProtocolMessage = std::string;
 
 class {{config.lib.export_macro}} StringBuilder {
  public:
@@ -83,8 +84,6 @@ class {{config.lib.export_macro}} StringUtil {
   static void builderAppend(StringBuilder& builder, const char* s, size_t len) {
     builder.append(s, len);
   }
-  static void builderAppendQuotedString(StringBuilder& builder,
-                                        const String& str);
   static void builderReserve(StringBuilder& builder, unsigned capacity) {
     builder.reserveCapacity(capacity);
   }
@@ -92,10 +91,6 @@ class {{config.lib.export_macro}} StringUtil {
     return builder.toString();
   }
 
-  static std::unique_ptr<Value> parseMessage(const std::string& message, bool binary);
-  static ProtocolMessage jsonToMessage(String message);
-  static ProtocolMessage binaryToMessage(std::vector<uint8_t> message);
-
   static String fromUTF8(const uint8_t* data, size_t length) {
     return std::string(reinterpret_cast<const char*>(data), length);
   }
@@ -111,12 +106,15 @@ class {{config.lib.export_macro}} StringUtil {
 };
 
 // A read-only sequence of uninterpreted bytes with reference-counted storage.
-class {{config.lib.export_macro}} Binary {
+class {{config.lib.export_macro}} Binary : public {{config.crdtp.namespace}}::Serializable {
  public:
   Binary(const Binary&);
   Binary();
   ~Binary();
 
+  // Implements Serializable.
+  void AppendSerialized(std::vector<uint8_t>* out) const override;
+
   const uint8_t* data() const { return bytes_->front(); }
   size_t size() const { return bytes_->size(); }
   scoped_refptr<base::RefCountedMemory> bytes() const { return bytes_; }
diff --git a/deps/v8/third_party/inspector_protocol/roll.py b/deps/v8/third_party/inspector_protocol/roll.py
index ba265198ce9c4c..ccf887a4d372ee 100755
--- a/deps/v8/third_party/inspector_protocol/roll.py
+++ b/deps/v8/third_party/inspector_protocol/roll.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python
-# Copyright 2019 The Chromium Authors. All rights reserved.
+# Copcright 2019 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
@@ -18,12 +18,28 @@
     'code_generator.py',
     'concatenate_protocols.py',
     'convert_protocol_to_json.py',
-    'encoding/encoding.h',
-    'encoding/encoding.cc',
-    'encoding/encoding_test.cc',
-    'bindings/bindings.h',
-    'bindings/bindings.cc',
-    'bindings/bindings_test.cc',
+    'crdtp/cbor.cc',
+    'crdtp/cbor.h',
+    'crdtp/cbor_test.cc',
+    'crdtp/glue.h',
+    'crdtp/glue_test.cc',
+    'crdtp/json.cc',
+    'crdtp/json.h',
+    'crdtp/json_platform.h',
+    'crdtp/json_test.cc',
+    'crdtp/parser_handler.h',
+    'crdtp/serializable.h',
+    'crdtp/serializable.cc',
+    'crdtp/serializable_test.cc',
+    'crdtp/serializer_traits.h',
+    'crdtp/serializer_traits_test.cc',
+    'crdtp/span.h',
+    'crdtp/span_test.cc',
+    'crdtp/status.cc',
+    'crdtp/status.h',
+    'crdtp/status_test.cc',
+    'crdtp/status_test_support.cc',
+    'crdtp/status_test_support.h',
     'inspector_protocol.gni',
     'inspector_protocol.gypi',
     'lib/*',
@@ -140,18 +156,13 @@ def main(argv):
   print('You said --force ... as you wish, modifying the destination.')
   for f in to_add + to_copy:
     contents = open(os.path.join(src_dir, f)).read()
+    contents = contents.replace('CRDTP_EXPORT ', '')
     contents = contents.replace(
-        'INSPECTOR_PROTOCOL_ENCODING_ENCODING_H_',
-        'V8_INSPECTOR_PROTOCOL_ENCODING_ENCODING_H_')
+        'CRDTP_',
+        'V8_CRDTP_')
     contents = contents.replace(
-        'namespace inspector_protocol_encoding',
-        'namespace v8_inspector_protocol_encoding')
-    contents = contents.replace(
-        'INSPECTOR_PROTOCOL_BINDINGS_BINDINGS_H_',
-        'V8_INSPECTOR_PROTOCOL_BINDINGS_BINDINGS_H_')
-    contents = contents.replace(
-        'namespace inspector_protocol_bindings',
-        'namespace v8_inspector_protocol_bindings')
+        'namespace crdtp',
+        'namespace v8_crdtp')
     open(os.path.join(dest_dir, f), 'w').write(contents)
     shutil.copymode(os.path.join(src_dir, f), os.path.join(dest_dir, f))
   for f in to_delete:
diff --git a/deps/v8/third_party/inspector_protocol/templates/Exported_h.template b/deps/v8/third_party/inspector_protocol/templates/Exported_h.template
index 765f6c2135b9c3..6481eef50c6889 100644
--- a/deps/v8/third_party/inspector_protocol/templates/Exported_h.template
+++ b/deps/v8/third_party/inspector_protocol/templates/Exported_h.template
@@ -20,8 +20,8 @@ namespace {{namespace}} {
 #define {{"_".join(config.protocol.namespace)}}_exported_api_h
 class {{config.exported.export_macro}} Exported {
 public:
-    virtual {{config.exported.string_out}} toJSONString() const = 0;
-    virtual void writeBinary(std::vector<uint8_t>* out) const = 0;
+    virtual void AppendSerialized(std::vector<uint8_t>* out) const = 0;
+
     virtual ~Exported() { }
 };
 #endif // !defined({{"_".join(config.protocol.namespace)}}_exported_api_h)
@@ -61,7 +61,6 @@ namespace {{param.name | to_title_case}}Enum {
 
 class {{config.exported.export_macro}} {{type.id}} : public Exported {
 public:
-    static std::unique_ptr<protocol::{{domain.domain}}::API::{{type.id}}> fromJSONString(const {{config.exported.string_in}}& json);
     static std::unique_ptr<protocol::{{domain.domain}}::API::{{type.id}}> fromBinary(const uint8_t* data, size_t length);
 };
   {% endfor %}
diff --git a/deps/v8/third_party/inspector_protocol/templates/Imported_h.template b/deps/v8/third_party/inspector_protocol/templates/Imported_h.template
index f2e576a9c470ae..b549388c8a980d 100644
--- a/deps/v8/third_party/inspector_protocol/templates/Imported_h.template
+++ b/deps/v8/third_party/inspector_protocol/templates/Imported_h.template
@@ -29,14 +29,10 @@ public:
         return std::unique_ptr<ImportedValue>(new ImportedValue(value));
     }
 
-    void writeJSON(StringBuilder* output) const override {
-        auto json = m_exported->toJSONString();
-        String local_json = ({{config.imported.from_imported_string % "std::move(json)"}});
-        StringUtil::builderAppend(*output, local_json);
-    }
-    void writeBinary(std::vector<uint8_t>* output) const override {
-        m_exported->writeBinary(output);
+    void AppendSerialized(std::vector<uint8_t>* output) const override {
+        m_exported->AppendSerialized(output);
     }
+
     std::unique_ptr<Value> clone() const override {
         return std::unique_ptr<Value>(new ImportedValue(m_exported));
     }
@@ -61,7 +57,7 @@ struct ValueConversions<{{"::".join(config.imported.namespace)}}::{{domain.domai
         }
 
         std::vector<uint8_t> binary;
-        value->writeBinary(&binary);
+        value->AppendSerialized(&binary);
         auto result = {{"::".join(config.imported.namespace)}}::{{domain.domain}}::API::{{type.id}}::fromBinary(binary.data(), binary.size());
         if (!result)
             errors->addError("cannot parse");
@@ -72,11 +68,6 @@ struct ValueConversions<{{"::".join(config.imported.namespace)}}::{{domain.domai
     {
         return ImportedValue::fromExported(exported);
     }
-
-    static std::unique_ptr<protocol::Value> toValue(const std::unique_ptr<{{"::".join(config.imported.namespace)}}::{{domain.domain}}::API::{{type.id}}>& value)
-    {
-        return toValue(value.get());
-    }
 };
 
   {% endfor %}
diff --git a/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_cpp.template b/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_cpp.template
index b1c3ab74e35e1d..eabafba7552051 100644
--- a/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_cpp.template
+++ b/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_cpp.template
@@ -8,6 +8,9 @@
 
 #include {{format_include(config.protocol.package, "Protocol")}}
 
+#include "{{config.crdtp.dir}}/cbor.h"
+#include "{{config.crdtp.dir}}/serializer_traits.h"
+
 {% for namespace in config.protocol.namespace %}
 namespace {{namespace}} {
 {% endfor %}
@@ -92,6 +95,18 @@ std::unique_ptr<protocol::DictionaryValue> {{type.id}}::toValue() const
     return result;
 }
 
+void {{type.id}}::AppendSerialized(std::vector<uint8_t>* out) const {
+    {{config.crdtp.namespace}}::cbor::EnvelopeEncoder envelope_encoder;
+    envelope_encoder.EncodeStart(out);
+    out->push_back({{config.crdtp.namespace}}::cbor::EncodeIndefiniteLengthMapStart());
+    {% for property in type.properties %}
+      {% set property_field = "m_" + property.name %}
+      {{config.crdtp.namespace}}::SerializeField({{config.crdtp.namespace}}::SpanFrom("{{property.name}}"), {{property_field}}, out);
+    {% endfor %}
+    out->push_back({{config.crdtp.namespace}}::cbor::EncodeStop());
+    envelope_encoder.EncodeStop(out);
+}
+
 std::unique_ptr<{{type.id}}> {{type.id}}::clone() const
 {
     ErrorSupport errors;
@@ -99,27 +114,6 @@ std::unique_ptr<{{type.id}}> {{type.id}}::clone() const
 }
     {% if protocol.is_exported(domain.domain, type.id) %}
 
-{{config.exported.string_out}} {{type.id}}::toJSONString() const
-{
-    String json = toValue()->serializeToJSON();
-    return {{config.exported.to_string_out % "json"}};
-}
-
-void {{type.id}}::writeBinary(std::vector<uint8_t>* out) const
-{
-    toValue()->writeBinary(out);
-}
-
-// static
-std::unique_ptr<API::{{type.id}}> API::{{type.id}}::fromJSONString(const {{config.exported.string_in}}& json)
-{
-    ErrorSupport errors;
-    std::unique_ptr<Value> value = StringUtil::parseJSON(json);
-    if (!value)
-        return nullptr;
-    return protocol::{{domain.domain}}::{{type.id}}::fromValue(value.get(), &errors);
-}
-
 // static
 std::unique_ptr<API::{{type.id}}> API::{{type.id}}::fromBinary(const uint8_t* data, size_t length)
 {
@@ -203,11 +197,6 @@ void Frontend::flush()
     m_frontendChannel->flushProtocolNotifications();
 }
 
-void Frontend::sendRawJSONNotification(String notification)
-{
-    m_frontendChannel->sendProtocolNotification(InternalRawNotification::fromJSON(std::move(notification)));
-}
-
 void Frontend::sendRawCBORNotification(std::vector<uint8_t> notification)
 {
     m_frontendChannel->sendProtocolNotification(InternalRawNotification::fromBinary(std::move(notification)));
@@ -231,11 +220,11 @@ public:
     }
     ~DispatcherImpl() override { }
     bool canDispatch(const String& method) override;
-    void dispatch(int callId, const String& method, const ProtocolMessage& message, std::unique_ptr<protocol::DictionaryValue> messageObject) override;
+    void dispatch(int callId, const String& method, {{config.crdtp.namespace}}::span<uint8_t> message, std::unique_ptr<protocol::DictionaryValue> messageObject) override;
     std::unordered_map<String, String>& redirects() { return m_redirects; }
 
 protected:
-    using CallHandler = void (DispatcherImpl::*)(int callId, const String& method, const ProtocolMessage& message, std::unique_ptr<DictionaryValue> messageObject, ErrorSupport* errors);
+    using CallHandler = void (DispatcherImpl::*)(int callId, const String& method, {{config.crdtp.namespace}}::span<uint8_t> message, std::unique_ptr<DictionaryValue> messageObject, ErrorSupport* errors);
     using DispatchMap = std::unordered_map<String, CallHandler>;
     DispatchMap m_dispatchMap;
     std::unordered_map<String, String> m_redirects;
@@ -243,7 +232,7 @@ protected:
   {% for command in domain.commands %}
     {% if "redirect" in command %}{% continue %}{% endif %}
     {% if not protocol.generate_command(domain.domain, command.name) %}{% continue %}{% endif %}
-    void {{command.name}}(int callId, const String& method, const ProtocolMessage& message, std::unique_ptr<DictionaryValue> requestMessageObject, ErrorSupport*);
+    void {{command.name}}(int callId, const String& method, {{config.crdtp.namespace}}::span<uint8_t> message, std::unique_ptr<DictionaryValue> requestMessageObject, ErrorSupport*);
   {% endfor %}
 
     Backend* m_backend;
@@ -253,7 +242,7 @@ bool DispatcherImpl::canDispatch(const String& method) {
     return m_dispatchMap.find(method) != m_dispatchMap.end();
 }
 
-void DispatcherImpl::dispatch(int callId, const String& method, const ProtocolMessage& message, std::unique_ptr<protocol::DictionaryValue> messageObject)
+void DispatcherImpl::dispatch(int callId, const String& method, {{config.crdtp.namespace}}::span<uint8_t> message, std::unique_ptr<protocol::DictionaryValue> messageObject)
 {
     std::unordered_map<String, CallHandler>::iterator it = m_dispatchMap.find(method);
     DCHECK(it != m_dispatchMap.end());
@@ -269,7 +258,7 @@ void DispatcherImpl::dispatch(int callId, const String& method, const ProtocolMe
 
 class {{command_name_title}}CallbackImpl : public Backend::{{command_name_title}}Callback, public DispatcherBase::Callback {
 public:
-    {{command_name_title}}CallbackImpl(std::unique_ptr<DispatcherBase::WeakPtr> backendImpl, int callId, const String& method, const ProtocolMessage& message)
+    {{command_name_title}}CallbackImpl(std::unique_ptr<DispatcherBase::WeakPtr> backendImpl, int callId, const String& method, {{config.crdtp.namespace}}::span<uint8_t> message)
         : DispatcherBase::Callback(std::move(backendImpl), callId, method, message) { }
 
     void sendSuccess(
@@ -307,7 +296,7 @@ public:
 };
     {% endif %}
 
-void DispatcherImpl::{{command.name}}(int callId, const String& method, const ProtocolMessage& message, std::unique_ptr<DictionaryValue> requestMessageObject, ErrorSupport* errors)
+void DispatcherImpl::{{command.name}}(int callId, const String& method, {{config.crdtp.namespace}}::span<uint8_t> message, std::unique_ptr<DictionaryValue> requestMessageObject, ErrorSupport* errors)
 {
     {% if "parameters" in command %}
     // Prepare input parameters.
diff --git a/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_h.template b/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_h.template
index 9d86d7a4ac0a5c..08615f8828460c 100644
--- a/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_h.template
+++ b/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_h.template
@@ -100,14 +100,8 @@ public:
     {% endfor %}
 
     std::unique_ptr<protocol::DictionaryValue> toValue() const;
-    String serializeToJSON() override { return toValue()->serializeToJSON(); }
-    std::vector<uint8_t> serializeToBinary() override { return toValue()->serializeToBinary(); }
-    String toJSON() const { return toValue()->toJSONString(); }
+    void AppendSerialized(std::vector<uint8_t>* out) const override;
     std::unique_ptr<{{type.id}}> clone() const;
-    {% if protocol.is_exported(domain.domain, type.id) %}
-    {{config.exported.string_out}} toJSONString() const override;
-    void writeBinary(std::vector<uint8_t>* out) const override;
-    {% endif %}
 
     template<int STATE>
     class {{type.id}}Builder {
@@ -269,7 +263,6 @@ public:
   {% endfor %}
 
     void flush();
-    void sendRawJSONNotification(String);
     void sendRawCBORNotification(std::vector<uint8_t>);
 private:
     FrontendChannel* m_frontendChannel;
diff --git a/deps/v8/third_party/v8/builtins/array-sort.tq b/deps/v8/third_party/v8/builtins/array-sort.tq
index 5a26bf0c640175..d920599e6e0409 100644
--- a/deps/v8/third_party/v8/builtins/array-sort.tq
+++ b/deps/v8/third_party/v8/builtins/array-sort.tq
@@ -15,12 +15,12 @@
 
 namespace array {
   class SortState extends Struct {
-    Compare(implicit context: Context)(x: JSAny, y: JSAny): Number {
+    macro Compare(implicit context: Context)(x: JSAny, y: JSAny): Number {
       const sortCompare: CompareBuiltinFn = this.sortComparePtr;
       return sortCompare(context, this.userCmpFn, x, y);
     }
 
-    CheckAccessor(implicit context: Context)() labels Bailout {
+    macro CheckAccessor(implicit context: Context)() labels Bailout {
       const canUseSameAccessorFn: CanUseSameAccessorFn =
           this.canUseSameAccessorFn;
 
@@ -31,7 +31,7 @@ namespace array {
       }
     }
 
-    ResetToGenericAccessor() {
+    macro ResetToGenericAccessor() {
       this.loadFn = Load<GenericElementsAccessor>;
       this.storeFn = Store<GenericElementsAccessor>;
       this.deleteFn = Delete<GenericElementsAccessor>;
@@ -47,7 +47,7 @@ namespace array {
     initialReceiverLength: Number;
 
     // If the user provided a comparison function, it is stored here.
-    userCmpFn: Undefined | Callable;
+    userCmpFn: Undefined|Callable;
 
     // Function pointer to the comparison function. This can either be a builtin
     // that calls the user-provided comparison function or "SortDefault", which
@@ -96,8 +96,8 @@ namespace array {
     numberOfUndefined: Smi;
   }
 
-  type FastSmiElements;
-  type FastObjectElements;
+  type FastSmiElements extends ElementsKind;
+  type FastObjectElements extends ElementsKind;
 
   // With the pre-processing step in Torque, the exact number of elements
   // to sort is unknown at the time the sort state is created.
@@ -108,9 +108,16 @@ namespace array {
       receiver: JSReceiver, initialReceiverLength: Number): intptr {
     // TODO(szuend): Implement full range sorting, not only up to MaxSmi.
     //               https://crbug.com/v8/7970.
-    let clampedReceiverLength: uintptr =
-        Convert<uintptr>(initialReceiverLength);
-    if (clampedReceiverLength > kSmiMaxValue) {
+    let clampedReceiverLength: uintptr;
+    try {
+      clampedReceiverLength =
+          ChangeSafeIntegerNumberToUintPtr(initialReceiverLength)
+          otherwise UIntPtrOverflow;
+      if (clampedReceiverLength > kSmiMaxValue) {
+        clampedReceiverLength = kSmiMaxValue;
+      }
+    }
+    label UIntPtrOverflow {
       clampedReceiverLength = kSmiMaxValue;
     }
 
@@ -132,7 +139,7 @@ namespace array {
   }
 
   transitioning macro NewSortState(implicit context: Context)(
-      receiver: JSReceiver, comparefn: Undefined | Callable,
+      receiver: JSReceiver, comparefn: Undefined|Callable,
       initialReceiverLength: Number): SortState {
     const sortComparePtr =
         comparefn != Undefined ? SortCompareUserFn : SortCompareDefault;
@@ -143,7 +150,6 @@ namespace array {
     let canUseSameAccessorFn: CanUseSameAccessorFn;
 
     try {
-      if (IsForceSlowPath()) goto Slow;
       const a: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
 
       // Copy copy-on-write (COW) arrays.
@@ -214,7 +220,7 @@ namespace array {
   // it is first requested, but it has always at least this size.
   const kSortStateTempSize: Smi = 32;
 
-  type LoadFn = builtin(Context, SortState, Smi) => (JSAny | TheHole);
+  type LoadFn = builtin(Context, SortState, Smi) => (JSAny|TheHole);
   type StoreFn = builtin(Context, SortState, Smi, JSAny) => Smi;
   type DeleteFn = builtin(Context, SortState, Smi) => Smi;
   type CanUseSameAccessorFn = builtin(Context, JSReceiver, Map, Number) =>
@@ -227,33 +233,33 @@ namespace array {
   // copied values from the prototype chain to the receiver if they were visible
   // through a hole.
 
-  transitioning builtin Load<ElementsAccessor: type>(
-      context: Context, sortState: SortState, index: Smi): JSAny | TheHole {
+  transitioning builtin Load<ElementsAccessor : type extends ElementsKind>(
+      context: Context, sortState: SortState, index: Smi): JSAny|TheHole {
     const receiver = sortState.receiver;
     if (!HasProperty_Inline(receiver, index)) return TheHole;
     return GetProperty(receiver, index);
   }
 
   Load<FastSmiElements>(context: Context, sortState: SortState, index: Smi):
-      JSAny | TheHole {
+      JSAny|TheHole {
     const object = UnsafeCast<JSObject>(sortState.receiver);
     const elements = UnsafeCast<FixedArray>(object.elements);
     return UnsafeCast<(JSAny | TheHole)>(elements.objects[index]);
   }
 
   Load<FastObjectElements>(context: Context, sortState: SortState, index: Smi):
-      JSAny | TheHole {
+      JSAny|TheHole {
     const object = UnsafeCast<JSObject>(sortState.receiver);
     const elements = UnsafeCast<FixedArray>(object.elements);
     return UnsafeCast<(JSAny | TheHole)>(elements.objects[index]);
   }
 
   Load<FastDoubleElements>(context: Context, sortState: SortState, index: Smi):
-      JSAny | TheHole {
+      JSAny|TheHole {
     try {
       const object = UnsafeCast<JSObject>(sortState.receiver);
       const elements = UnsafeCast<FixedDoubleArray>(object.elements);
-      const value = LoadDoubleWithHoleCheck(elements, index) otherwise IfHole;
+      const value = elements.floats[index].Value() otherwise IfHole;
       return AllocateHeapNumberWithValue(value);
     }
     label IfHole {
@@ -261,7 +267,7 @@ namespace array {
     }
   }
 
-  transitioning builtin Store<ElementsAccessor: type>(
+  transitioning builtin Store<ElementsAccessor : type extends ElementsKind>(
       context: Context, sortState: SortState, index: Smi, value: JSAny): Smi {
     SetProperty(sortState.receiver, index, value);
     return kSuccess;
@@ -294,10 +300,10 @@ namespace array {
     return kSuccess;
   }
 
-  transitioning builtin Delete<ElementsAccessor: type>(
+  transitioning builtin Delete<ElementsAccessor : type extends ElementsKind>(
       context: Context, sortState: SortState, index: Smi): Smi {
     const receiver = sortState.receiver;
-    DeleteProperty(receiver, index, kStrict);
+    DeleteProperty(receiver, index, LanguageMode::kStrict);
     return kSuccess;
   }
 
@@ -327,7 +333,7 @@ namespace array {
 
     const object = UnsafeCast<JSObject>(sortState.receiver);
     const elements = UnsafeCast<FixedDoubleArray>(object.elements);
-    StoreFixedDoubleArrayHoleSmi(elements, index);
+    elements.floats[index] = kDoubleHole;
     return kSuccess;
   }
 
@@ -340,10 +346,10 @@ namespace array {
     }
 
     // 5. Let xString be ? ToString(x).
-    const xString = ToString_Inline(context, x);
+    const xString = ToString_Inline(x);
 
     // 6. Let yString be ? ToString(y).
-    const yString = ToString_Inline(context, y);
+    const yString = ToString_Inline(y);
 
     // 7. Let xSmaller be the result of performing
     //    Abstract Relational Comparison xString < yString.
@@ -365,7 +371,7 @@ namespace array {
     const cmpfn = UnsafeCast<Callable>(comparefn);
 
     // a. Let v be ? ToNumber(? Call(comparefn, undefined, x, y)).
-    const v = ToNumber_Inline(context, Call(context, cmpfn, Undefined, x, y));
+    const v = ToNumber_Inline(Call(context, cmpfn, Undefined, x, y));
 
     // b. If v is NaN, return +0.
     if (NumberIsNaN(v)) return 0;
@@ -374,7 +380,7 @@ namespace array {
     return v;
   }
 
-  builtin CanUseSameAccessor<ElementsAccessor: type>(
+  builtin CanUseSameAccessor<ElementsAccessor : type extends ElementsKind>(
       context: Context, receiver: JSReceiver, initialReceiverMap: Map,
       initialReceiverLength: Number): Boolean {
     if (receiver.map != initialReceiverMap) return False;
@@ -1306,7 +1312,7 @@ namespace array {
     // are ignored.
     let numberOfUndefined: Smi = 0;
     for (let i: Smi = 0; i < receiverLength; ++i) {
-      const element: JSAny | TheHole = loadFn(context, sortState, i);
+      const element: JSAny|TheHole = loadFn(context, sortState, i);
 
       if (element == TheHole) {
         // Do nothing for holes. The result is that elements are
@@ -1382,13 +1388,13 @@ namespace array {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.sort
   transitioning javascript builtin
-  ArrayPrototypeSort(js-implicit context: Context, receiver: JSAny)(
+  ArrayPrototypeSort(js-implicit context: NativeContext, receiver: JSAny)(
       ...arguments): JSAny {
     // 1. If comparefn is not undefined and IsCallable(comparefn) is false,
     //    throw a TypeError exception.
     const comparefnObj: JSAny = arguments[0];
     const comparefn = Cast<(Undefined | Callable)>(comparefnObj) otherwise
-    ThrowTypeError(kBadSortComparisonFunction, comparefnObj);
+    ThrowTypeError(MessageTemplate::kBadSortComparisonFunction, comparefnObj);
 
     // 2. Let obj be ? ToObject(this value).
     const obj: JSReceiver = ToObject(context, receiver);
diff --git a/deps/v8/third_party/wasm-api/OWNERS b/deps/v8/third_party/wasm-api/OWNERS
index 596440f5322fb6..3f618f1ad56345 100644
--- a/deps/v8/third_party/wasm-api/OWNERS
+++ b/deps/v8/third_party/wasm-api/OWNERS
@@ -1,2 +1 @@
 jkummerow@chromium.org
-mstarzinger@chromium.org
diff --git a/deps/v8/third_party/zlib/BUILD.gn b/deps/v8/third_party/zlib/BUILD.gn
new file mode 100644
index 00000000000000..2414c8826f6dc7
--- /dev/null
+++ b/deps/v8/third_party/zlib/BUILD.gn
@@ -0,0 +1,383 @@
+# Copyright (c) 2013 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//build/config/compiler/compiler.gni")
+
+if (current_cpu == "arm" || current_cpu == "arm64") {
+  import("//build/config/arm.gni")
+}
+
+config("zlib_config") {
+  include_dirs = [ "." ]
+}
+
+config("zlib_internal_config") {
+  defines = [ "ZLIB_IMPLEMENTATION" ]
+}
+
+use_arm_neon_optimizations = false
+if (current_cpu == "arm" || current_cpu == "arm64") {
+  if (arm_use_neon) {
+    use_arm_neon_optimizations = true
+  }
+}
+
+use_x86_x64_optimizations =
+    (current_cpu == "x86" || current_cpu == "x64") && !is_ios
+
+config("zlib_adler32_simd_config") {
+  if (use_x86_x64_optimizations) {
+    defines = [ "ADLER32_SIMD_SSSE3" ]
+    if (is_win) {
+      defines += [ "X86_WINDOWS" ]
+    } else {
+      defines += [ "X86_NOT_WINDOWS" ]
+    }
+  } else if (use_arm_neon_optimizations) {
+    defines = [ "ADLER32_SIMD_NEON" ]
+  }
+}
+
+source_set("zlib_adler32_simd") {
+  visibility = [ ":*" ]
+
+  if (use_x86_x64_optimizations) {
+    sources = [
+      "adler32_simd.c",
+      "adler32_simd.h",
+    ]
+
+    if (!is_win || is_clang) {
+      cflags = [ "-mssse3" ]
+    }
+  }
+
+  if (use_arm_neon_optimizations) {
+    sources = [
+      "adler32_simd.c",
+      "adler32_simd.h",
+    ]
+    if (!is_debug) {
+      # Use optimize_speed (-O3) to output the _smallest_ code.
+      configs -= [ "//build/config/compiler:default_optimization" ]
+      configs += [ "//build/config/compiler:optimize_speed" ]
+    }
+  }
+
+  configs += [ ":zlib_internal_config" ]
+
+  public_configs = [ ":zlib_adler32_simd_config" ]
+}
+
+if (use_arm_neon_optimizations) {
+  config("zlib_arm_crc32_config") {
+    # Disabled for iPhone, as described in DDI0487C_a_armv8_arm:
+    #  "All implementations of the ARMv8.1 architecture are required to
+    #   implement the CRC32* instructions. These are optional in ARMv8.0."
+    if (!is_ios) {
+      defines = [ "CRC32_ARMV8_CRC32" ]
+      if (is_android) {
+        defines += [ "ARMV8_OS_ANDROID" ]
+      } else if (is_linux || is_chromeos) {
+        defines += [ "ARMV8_OS_LINUX" ]
+      } else if (is_fuchsia) {
+        defines += [ "ARMV8_OS_FUCHSIA" ]
+      } else if (is_win) {
+        defines += [ "ARMV8_OS_WINDOWS" ]
+      } else {
+        assert(false, "Unsupported ARM OS")
+      }
+    }
+  }
+
+  source_set("zlib_arm_crc32") {
+    visibility = [ ":*" ]
+
+    if (!is_ios) {
+      include_dirs = [ "." ]
+
+      if (!is_win && !is_clang) {
+        assert(!use_thin_lto,
+               "ThinLTO fails mixing different module-level targets")
+        cflags_c = [ "-march=armv8-a+crc" ]
+      }
+
+      sources = [
+        "crc32_simd.c",
+        "crc32_simd.h",
+      ]
+
+      if (!is_debug) {
+        configs -= [ "//build/config/compiler:default_optimization" ]
+        configs += [ "//build/config/compiler:optimize_speed" ]
+      }
+    }
+
+    configs += [ ":zlib_internal_config" ]
+
+    public_configs = [ ":zlib_arm_crc32_config" ]
+  }
+}
+
+config("zlib_inflate_chunk_simd_config") {
+  if (use_x86_x64_optimizations) {
+    defines = [ "INFLATE_CHUNK_SIMD_SSE2" ]
+
+    if (current_cpu == "x64") {
+      defines += [ "INFLATE_CHUNK_READ_64LE" ]
+    }
+  }
+
+  if (use_arm_neon_optimizations) {
+    defines = [ "INFLATE_CHUNK_SIMD_NEON" ]
+    if (current_cpu == "arm64") {
+      defines += [ "INFLATE_CHUNK_READ_64LE" ]
+    }
+  }
+}
+
+source_set("zlib_inflate_chunk_simd") {
+  visibility = [ ":*" ]
+
+  if (use_x86_x64_optimizations || use_arm_neon_optimizations) {
+    include_dirs = [ "." ]
+
+    sources = [
+      "contrib/optimizations/chunkcopy.h",
+      "contrib/optimizations/inffast_chunk.c",
+      "contrib/optimizations/inffast_chunk.h",
+      "contrib/optimizations/inflate.c",
+    ]
+
+    if (use_arm_neon_optimizations && !is_debug) {
+      # Here we trade better performance on newer/bigger ARMv8 cores
+      # for less perf on ARMv7, per crbug.com/772870#c40
+      configs -= [ "//build/config/compiler:default_optimization" ]
+      configs += [ "//build/config/compiler:optimize_speed" ]
+    }
+  }
+
+  configs -= [ "//build/config/compiler:chromium_code" ]
+  configs += [
+    ":zlib_internal_config",
+    "//build/config/compiler:no_chromium_code",
+  ]
+
+  public_configs = [ ":zlib_inflate_chunk_simd_config" ]
+}
+
+config("zlib_crc32_simd_config") {
+  if (use_x86_x64_optimizations) {
+    defines = [ "CRC32_SIMD_SSE42_PCLMUL" ]
+  }
+}
+
+source_set("zlib_crc32_simd") {
+  visibility = [ ":*" ]
+
+  if (use_x86_x64_optimizations) {
+    sources = [
+      "crc32_simd.c",
+      "crc32_simd.h",
+    ]
+
+    if (!is_win || is_clang) {
+      cflags = [
+        "-msse4.2",
+        "-mpclmul",
+      ]
+    }
+  }
+
+  configs += [ ":zlib_internal_config" ]
+
+  public_configs = [ ":zlib_crc32_simd_config" ]
+}
+
+source_set("zlib_x86_simd") {
+  visibility = [ ":*" ]
+
+  if (use_x86_x64_optimizations) {
+    sources = [
+      "crc_folding.c",
+      "fill_window_sse.c",
+    ]
+
+    if (!is_win || is_clang) {
+      cflags = [
+        "-msse4.2",
+        "-mpclmul",
+      ]
+    }
+  }
+
+  configs -= [ "//build/config/compiler:chromium_code" ]
+  configs += [
+    ":zlib_internal_config",
+    "//build/config/compiler:no_chromium_code",
+  ]
+}
+
+config("zlib_warnings") {
+  if (is_clang && use_x86_x64_optimizations) {
+    cflags = [ "-Wno-incompatible-pointer-types" ]
+  }
+}
+
+component("zlib") {
+  if (!is_win) {
+    # Don't stomp on "libzlib" on other platforms.
+    output_name = "chrome_zlib"
+  }
+
+  sources = [
+    "adler32.c",
+    "chromeconf.h",
+    "compress.c",
+    "contrib/optimizations/insert_string.h",
+    "cpu_features.c",
+    "cpu_features.h",
+    "crc32.c",
+    "crc32.h",
+    "deflate.c",
+    "deflate.h",
+    "gzclose.c",
+    "gzguts.h",
+    "gzlib.c",
+    "gzread.c",
+    "gzwrite.c",
+    "infback.c",
+    "inffast.c",
+    "inffast.h",
+    "inffixed.h",
+    "inflate.h",
+    "inftrees.c",
+    "inftrees.h",
+    "trees.c",
+    "trees.h",
+    "uncompr.c",
+    "zconf.h",
+    "zlib.h",
+    "zutil.c",
+    "zutil.h",
+  ]
+
+  defines = []
+  deps = []
+  if (!use_x86_x64_optimizations && !use_arm_neon_optimizations) {
+    # Apparently android_cronet bot builds with NEON disabled and
+    # we also should disable optimizations for iOS@x86 (a.k.a. simulator).
+    defines += [ "CPU_NO_SIMD" ]
+  }
+
+  if (is_ios) {
+    # iOS@ARM is a special case where we always have NEON but don't check
+    # for crypto extensions.
+    # TODO(cavalcantii): verify what is the current state of CPU features shipped
+    # on latest iOS devices.
+    defines += [ "ARM_OS_IOS" ]
+  }
+
+  if (use_x86_x64_optimizations || use_arm_neon_optimizations) {
+    deps += [
+      ":zlib_adler32_simd",
+      ":zlib_inflate_chunk_simd",
+    ]
+
+    if (use_x86_x64_optimizations) {
+      deps += [ ":zlib_crc32_simd" ]
+    } else if (use_arm_neon_optimizations) {
+      sources += [ "contrib/optimizations/slide_hash_neon.h" ]
+      deps += [ ":zlib_arm_crc32" ]
+    }
+  } else {
+    sources += [ "inflate.c" ]
+  }
+
+  if (is_android) {
+    import("//build/config/android/config.gni")
+    if (defined(android_ndk_root) && android_ndk_root != "") {
+      deps += [ "//third_party/android_ndk:cpu_features" ]
+    } else {
+      assert(false, "CPU detection requires the Android NDK")
+    }
+  }
+
+  configs -= [ "//build/config/compiler:chromium_code" ]
+  configs += [
+    ":zlib_internal_config",
+    "//build/config/compiler:no_chromium_code",
+
+    # Must be after no_chromium_code for warning flags to be ordered correctly.
+    ":zlib_warnings",
+  ]
+
+  public_configs = [ ":zlib_config" ]
+
+  deps += [ ":zlib_x86_simd" ]
+  allow_circular_includes_from = deps
+}
+
+config("minizip_warnings") {
+  visibility = [ ":*" ]
+
+  if (is_clang) {
+    # zlib uses `if ((a == b))` for some reason.
+    cflags = [ "-Wno-parentheses-equality" ]
+  }
+}
+
+static_library("minizip") {
+  sources = [
+    "contrib/minizip/ioapi.c",
+    "contrib/minizip/ioapi.h",
+    "contrib/minizip/iowin32.c",
+    "contrib/minizip/iowin32.h",
+    "contrib/minizip/unzip.c",
+    "contrib/minizip/unzip.h",
+    "contrib/minizip/zip.c",
+    "contrib/minizip/zip.h",
+  ]
+
+  if (!is_win) {
+    sources -= [
+      "contrib/minizip/iowin32.c",
+      "contrib/minizip/iowin32.h",
+    ]
+  }
+
+  if (is_mac || is_ios || is_android || is_nacl) {
+    # Mac, Android and the BSDs don't have fopen64, ftello64, or fseeko64. We
+    # use fopen, ftell, and fseek instead on these systems.
+    defines = [ "USE_FILE32API" ]
+  }
+
+  deps = [ ":zlib" ]
+
+  configs -= [ "//build/config/compiler:chromium_code" ]
+  configs += [
+    "//build/config/compiler:no_chromium_code",
+
+    # Must be after no_chromium_code for warning flags to be ordered correctly.
+    ":minizip_warnings",
+  ]
+
+  public_configs = [ ":zlib_config" ]
+}
+
+executable("zlib_bench") {
+  include_dirs = [ "." ]
+
+  sources = [ "contrib/bench/zlib_bench.cc" ]
+
+  if (!is_debug) {
+    configs -= [ "//build/config/compiler:default_optimization" ]
+    configs += [ "//build/config/compiler:optimize_speed" ]
+  }
+
+  configs -= [ "//build/config/compiler:chromium_code" ]
+  configs += [ "//build/config/compiler:no_chromium_code" ]
+
+  deps = [ ":zlib" ]
+}
diff --git a/deps/v8/third_party/zlib/LICENSE b/deps/v8/third_party/zlib/LICENSE
new file mode 100644
index 00000000000000..9f056865b5719d
--- /dev/null
+++ b/deps/v8/third_party/zlib/LICENSE
@@ -0,0 +1,19 @@
+version 1.2.11, January 15th, 2017
+
+Copyright (C) 1995-2017 Jean-loup Gailly and Mark Adler
+
+This software is provided 'as-is', without any express or implied
+warranty.  In no event will the authors be held liable for any damages
+arising from the use of this software.
+
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not
+   claim that you wrote the original software. If you use this software
+   in a product, an acknowledgment in the product documentation would be
+   appreciated but is not required.
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+3. This notice may not be removed or altered from any source distribution.
diff --git a/deps/v8/third_party/zlib/OWNERS b/deps/v8/third_party/zlib/OWNERS
new file mode 100644
index 00000000000000..22f4d8938efbc1
--- /dev/null
+++ b/deps/v8/third_party/zlib/OWNERS
@@ -0,0 +1,7 @@
+agl@chromium.org
+cavalcantii@chromium.org
+cblume@chromium.org
+mtklein@google.com
+scroggo@google.com
+
+# COMPONENT: Internals
diff --git a/deps/v8/third_party/zlib/README.chromium b/deps/v8/third_party/zlib/README.chromium
new file mode 100644
index 00000000000000..3d90f79be2ffc2
--- /dev/null
+++ b/deps/v8/third_party/zlib/README.chromium
@@ -0,0 +1,28 @@
+Name: zlib
+Short Name: zlib
+URL: http://zlib.net/
+Version: 1.2.11
+Security Critical: yes
+License: Custom license
+License File: LICENSE
+License Android Compatible: yes
+
+Description:
+"A massively spiffy yet delicately unobtrusive compression library."
+
+zlib is a free, general-purpose, legally unencumbered lossless data-compression
+library. zlib implements the "deflate" compression algorithm described by RFC
+1951, which combines the LZ77 (Lempel-Ziv) algorithm with Huffman coding. zlib
+also implements the zlib (RFC 1950) and gzip (RFC 1952) wrapper formats.
+
+Local Modifications:
+ - Only source code from the zlib distribution used to build the zlib and
+   minizip libraries are present. Many other files have been omitted. Only *.c
+   and *.h files from the upstream root directory and contrib/minizip were
+   imported.
+ - The contents of the google directory are original Chromium-specific
+   additions.
+ - Added chromeconf.h
+ - Plus the changes in 'patches' folder.
+ - Code in contrib/ other than contrib/minizip was added to match zlib's
+   contributor layout.
diff --git a/deps/v8/third_party/zlib/adler32.c b/deps/v8/third_party/zlib/adler32.c
new file mode 100644
index 00000000000000..696773a09d43d2
--- /dev/null
+++ b/deps/v8/third_party/zlib/adler32.c
@@ -0,0 +1,214 @@
+/* adler32.c -- compute the Adler-32 checksum of a data stream
+ * Copyright (C) 1995-2011, 2016 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/* @(#) $Id$ */
+
+#include "zutil.h"
+
+local uLong adler32_combine_ OF((uLong adler1, uLong adler2, z_off64_t len2));
+
+#define BASE 65521U     /* largest prime smaller than 65536 */
+#define NMAX 5552
+/* NMAX is the largest n such that 255n(n+1)/2 + (n+1)(BASE-1) <= 2^32-1 */
+
+#define DO1(buf,i)  {adler += (buf)[i]; sum2 += adler;}
+#define DO2(buf,i)  DO1(buf,i); DO1(buf,i+1);
+#define DO4(buf,i)  DO2(buf,i); DO2(buf,i+2);
+#define DO8(buf,i)  DO4(buf,i); DO4(buf,i+4);
+#define DO16(buf)   DO8(buf,0); DO8(buf,8);
+
+/* use NO_DIVIDE if your processor does not do division in hardware --
+   try it both ways to see which is faster */
+#ifdef NO_DIVIDE
+/* note that this assumes BASE is 65521, where 65536 % 65521 == 15
+   (thank you to John Reiser for pointing this out) */
+#  define CHOP(a) \
+    do { \
+        unsigned long tmp = a >> 16; \
+        a &= 0xffffUL; \
+        a += (tmp << 4) - tmp; \
+    } while (0)
+#  define MOD28(a) \
+    do { \
+        CHOP(a); \
+        if (a >= BASE) a -= BASE; \
+    } while (0)
+#  define MOD(a) \
+    do { \
+        CHOP(a); \
+        MOD28(a); \
+    } while (0)
+#  define MOD63(a) \
+    do { /* this assumes a is not negative */ \
+        z_off64_t tmp = a >> 32; \
+        a &= 0xffffffffL; \
+        a += (tmp << 8) - (tmp << 5) + tmp; \
+        tmp = a >> 16; \
+        a &= 0xffffL; \
+        a += (tmp << 4) - tmp; \
+        tmp = a >> 16; \
+        a &= 0xffffL; \
+        a += (tmp << 4) - tmp; \
+        if (a >= BASE) a -= BASE; \
+    } while (0)
+#else
+#  define MOD(a) a %= BASE
+#  define MOD28(a) a %= BASE
+#  define MOD63(a) a %= BASE
+#endif
+
+#include "cpu_features.h"
+#if defined(ADLER32_SIMD_SSSE3) || defined(ADLER32_SIMD_NEON)
+#include "adler32_simd.h"
+#endif
+
+/* ========================================================================= */
+uLong ZEXPORT adler32_z(adler, buf, len)
+    uLong adler;
+    const Bytef *buf;
+    z_size_t len;
+{
+    unsigned long sum2;
+    unsigned n;
+
+#if defined(ADLER32_SIMD_SSSE3)
+    if (x86_cpu_enable_ssse3 && buf && len >= 64)
+        return adler32_simd_(adler, buf, len);
+#elif defined(ADLER32_SIMD_NEON)
+    if (buf && len >= 64)
+        return adler32_simd_(adler, buf, len);
+#endif
+
+    /* split Adler-32 into component sums */
+    sum2 = (adler >> 16) & 0xffff;
+    adler &= 0xffff;
+
+    /* in case user likes doing a byte at a time, keep it fast */
+    if (len == 1) {
+        adler += buf[0];
+        if (adler >= BASE)
+            adler -= BASE;
+        sum2 += adler;
+        if (sum2 >= BASE)
+            sum2 -= BASE;
+        return adler | (sum2 << 16);
+    }
+
+#if defined(ADLER32_SIMD_SSSE3)
+    /*
+     * Use SSSE3 to compute the adler32. Since this routine can be
+     * freely used, check CPU features here. zlib convention is to
+     * call adler32(0, NULL, 0), before making calls to adler32().
+     * So this is a good early (and infrequent) place to cache CPU
+     * features for those later, more interesting adler32() calls.
+     */
+    if (buf == Z_NULL) {
+        if (!len) /* Assume user is calling adler32(0, NULL, 0); */
+            cpu_check_features();
+        return 1L;
+    }
+#else
+    /* initial Adler-32 value (deferred check for len == 1 speed) */
+    if (buf == Z_NULL)
+        return 1L;
+#endif
+
+    /* in case short lengths are provided, keep it somewhat fast */
+    if (len < 16) {
+        while (len--) {
+            adler += *buf++;
+            sum2 += adler;
+        }
+        if (adler >= BASE)
+            adler -= BASE;
+        MOD28(sum2);            /* only added so many BASE's */
+        return adler | (sum2 << 16);
+    }
+
+    /* do length NMAX blocks -- requires just one modulo operation */
+    while (len >= NMAX) {
+        len -= NMAX;
+        n = NMAX / 16;          /* NMAX is divisible by 16 */
+        do {
+            DO16(buf);          /* 16 sums unrolled */
+            buf += 16;
+        } while (--n);
+        MOD(adler);
+        MOD(sum2);
+    }
+
+    /* do remaining bytes (less than NMAX, still just one modulo) */
+    if (len) {                  /* avoid modulos if none remaining */
+        while (len >= 16) {
+            len -= 16;
+            DO16(buf);
+            buf += 16;
+        }
+        while (len--) {
+            adler += *buf++;
+            sum2 += adler;
+        }
+        MOD(adler);
+        MOD(sum2);
+    }
+
+    /* return recombined sums */
+    return adler | (sum2 << 16);
+}
+
+/* ========================================================================= */
+uLong ZEXPORT adler32(adler, buf, len)
+    uLong adler;
+    const Bytef *buf;
+    uInt len;
+{
+    return adler32_z(adler, buf, len);
+}
+
+/* ========================================================================= */
+local uLong adler32_combine_(adler1, adler2, len2)
+    uLong adler1;
+    uLong adler2;
+    z_off64_t len2;
+{
+    unsigned long sum1;
+    unsigned long sum2;
+    unsigned rem;
+
+    /* for negative len, return invalid adler32 as a clue for debugging */
+    if (len2 < 0)
+        return 0xffffffffUL;
+
+    /* the derivation of this formula is left as an exercise for the reader */
+    MOD63(len2);                /* assumes len2 >= 0 */
+    rem = (unsigned)len2;
+    sum1 = adler1 & 0xffff;
+    sum2 = rem * sum1;
+    MOD(sum2);
+    sum1 += (adler2 & 0xffff) + BASE - 1;
+    sum2 += ((adler1 >> 16) & 0xffff) + ((adler2 >> 16) & 0xffff) + BASE - rem;
+    if (sum1 >= BASE) sum1 -= BASE;
+    if (sum1 >= BASE) sum1 -= BASE;
+    if (sum2 >= ((unsigned long)BASE << 1)) sum2 -= ((unsigned long)BASE << 1);
+    if (sum2 >= BASE) sum2 -= BASE;
+    return sum1 | (sum2 << 16);
+}
+
+/* ========================================================================= */
+uLong ZEXPORT adler32_combine(adler1, adler2, len2)
+    uLong adler1;
+    uLong adler2;
+    z_off_t len2;
+{
+    return adler32_combine_(adler1, adler2, len2);
+}
+
+uLong ZEXPORT adler32_combine64(adler1, adler2, len2)
+    uLong adler1;
+    uLong adler2;
+    z_off64_t len2;
+{
+    return adler32_combine_(adler1, adler2, len2);
+}
diff --git a/deps/v8/third_party/zlib/adler32_simd.c b/deps/v8/third_party/zlib/adler32_simd.c
new file mode 100644
index 00000000000000..1354915cc099ad
--- /dev/null
+++ b/deps/v8/third_party/zlib/adler32_simd.c
@@ -0,0 +1,366 @@
+/* adler32_simd.c
+ *
+ * Copyright 2017 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the Chromium source repository LICENSE file.
+ *
+ * Per http://en.wikipedia.org/wiki/Adler-32 the adler32 A value (aka s1) is
+ * the sum of N input data bytes D1 ... DN,
+ *
+ *   A = A0 + D1 + D2 + ... + DN
+ *
+ * where A0 is the initial value.
+ *
+ * SSE2 _mm_sad_epu8() can be used for byte sums (see http://bit.ly/2wpUOeD,
+ * for example) and accumulating the byte sums can use SSE shuffle-adds (see
+ * the "Integer" section of http://bit.ly/2erPT8t for details). Arm NEON has
+ * similar instructions.
+ *
+ * The adler32 B value (aka s2) sums the A values from each step:
+ *
+ *   B0 + (A0 + D1) + (A0 + D1 + D2) + ... + (A0 + D1 + D2 + ... + DN) or
+ *
+ *       B0 + N.A0 + N.D1 + (N-1).D2 + (N-2).D3 + ... + (N-(N-1)).DN
+ *
+ * B0 being the initial value. For 32 bytes (ideal for garden-variety SIMD):
+ *
+ *   B = B0 + 32.A0 + [D1 D2 D3 ... D32] x [32 31 30 ... 1].
+ *
+ * Adjacent blocks of 32 input bytes can be iterated with the expressions to
+ * compute the adler32 s1 s2 of M >> 32 input bytes [1].
+ *
+ * As M grows, the s1 s2 sums grow. If left unchecked, they would eventually
+ * overflow the precision of their integer representation (bad). However, s1
+ * and s2 also need to be computed modulo the adler BASE value (reduced). If
+ * at most NMAX bytes are processed before a reduce, s1 s2 _cannot_ overflow
+ * a uint32_t type (the NMAX constraint) [2].
+ *
+ * [1] the iterative equations for s2 contain constant factors; these can be
+ * hoisted from the n-blocks do loop of the SIMD code.
+ *
+ * [2] zlib adler32_z() uses this fact to implement NMAX-block-based updates
+ * of the adler s1 s2 of uint32_t type (see adler32.c).
+ */
+
+#include "adler32_simd.h"
+
+/* Definitions from adler32.c: largest prime smaller than 65536 */
+#define BASE 65521U
+/* NMAX is the largest n such that 255n(n+1)/2 + (n+1)(BASE-1) <= 2^32-1 */
+#define NMAX 5552
+
+#if defined(ADLER32_SIMD_SSSE3)
+
+#include <tmmintrin.h>
+
+uint32_t ZLIB_INTERNAL adler32_simd_(  /* SSSE3 */
+    uint32_t adler,
+    const unsigned char *buf,
+    z_size_t len)
+{
+    /*
+     * Split Adler-32 into component sums.
+     */
+    uint32_t s1 = adler & 0xffff;
+    uint32_t s2 = adler >> 16;
+
+    /*
+     * Process the data in blocks.
+     */
+    const unsigned BLOCK_SIZE = 1 << 5;
+
+    z_size_t blocks = len / BLOCK_SIZE;
+    len -= blocks * BLOCK_SIZE;
+
+    while (blocks)
+    {
+        unsigned n = NMAX / BLOCK_SIZE;  /* The NMAX constraint. */
+        if (n > blocks)
+            n = (unsigned) blocks;
+        blocks -= n;
+
+        const __m128i tap1 =
+            _mm_setr_epi8(32,31,30,29,28,27,26,25,24,23,22,21,20,19,18,17);
+        const __m128i tap2 =
+            _mm_setr_epi8(16,15,14,13,12,11,10, 9, 8, 7, 6, 5, 4, 3, 2, 1);
+        const __m128i zero =
+            _mm_setr_epi8( 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+        const __m128i ones =
+            _mm_set_epi16( 1, 1, 1, 1, 1, 1, 1, 1);
+
+        /*
+         * Process n blocks of data. At most NMAX data bytes can be
+         * processed before s2 must be reduced modulo BASE.
+         */
+        __m128i v_ps = _mm_set_epi32(0, 0, 0, s1 * n);
+        __m128i v_s2 = _mm_set_epi32(0, 0, 0, s2);
+        __m128i v_s1 = _mm_set_epi32(0, 0, 0, 0);
+
+        do {
+            /*
+             * Load 32 input bytes.
+             */
+            const __m128i bytes1 = _mm_loadu_si128((__m128i*)(buf));
+            const __m128i bytes2 = _mm_loadu_si128((__m128i*)(buf + 16));
+
+            /*
+             * Add previous block byte sum to v_ps.
+             */
+            v_ps = _mm_add_epi32(v_ps, v_s1);
+
+            /*
+             * Horizontally add the bytes for s1, multiply-adds the
+             * bytes by [ 32, 31, 30, ... ] for s2.
+             */
+            v_s1 = _mm_add_epi32(v_s1, _mm_sad_epu8(bytes1, zero));
+            const __m128i mad1 = _mm_maddubs_epi16(bytes1, tap1);
+            v_s2 = _mm_add_epi32(v_s2, _mm_madd_epi16(mad1, ones));
+
+            v_s1 = _mm_add_epi32(v_s1, _mm_sad_epu8(bytes2, zero));
+            const __m128i mad2 = _mm_maddubs_epi16(bytes2, tap2);
+            v_s2 = _mm_add_epi32(v_s2, _mm_madd_epi16(mad2, ones));
+
+            buf += BLOCK_SIZE;
+
+        } while (--n);
+
+        v_s2 = _mm_add_epi32(v_s2, _mm_slli_epi32(v_ps, 5));
+
+        /*
+         * Sum epi32 ints v_s1(s2) and accumulate in s1(s2).
+         */
+
+#define S23O1 _MM_SHUFFLE(2,3,0,1)  /* A B C D -> B A D C */
+#define S1O32 _MM_SHUFFLE(1,0,3,2)  /* A B C D -> C D A B */
+
+        v_s1 = _mm_add_epi32(v_s1, _mm_shuffle_epi32(v_s1, S23O1));
+        v_s1 = _mm_add_epi32(v_s1, _mm_shuffle_epi32(v_s1, S1O32));
+
+        s1 += _mm_cvtsi128_si32(v_s1);
+
+        v_s2 = _mm_add_epi32(v_s2, _mm_shuffle_epi32(v_s2, S23O1));
+        v_s2 = _mm_add_epi32(v_s2, _mm_shuffle_epi32(v_s2, S1O32));
+
+        s2 = _mm_cvtsi128_si32(v_s2);
+
+#undef S23O1
+#undef S1O32
+
+        /*
+         * Reduce.
+         */
+        s1 %= BASE;
+        s2 %= BASE;
+    }
+
+    /*
+     * Handle leftover data.
+     */
+    if (len) {
+        if (len >= 16) {
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+
+            len -= 16;
+        }
+
+        while (len--) {
+            s2 += (s1 += *buf++);
+        }
+
+        if (s1 >= BASE)
+            s1 -= BASE;
+        s2 %= BASE;
+    }
+
+    /*
+     * Return the recombined sums.
+     */
+    return s1 | (s2 << 16);
+}
+
+#elif defined(ADLER32_SIMD_NEON)
+
+#include <arm_neon.h>
+
+uint32_t ZLIB_INTERNAL adler32_simd_(  /* NEON */
+    uint32_t adler,
+    const unsigned char *buf,
+    z_size_t len)
+{
+    /*
+     * Split Adler-32 into component sums.
+     */
+    uint32_t s1 = adler & 0xffff;
+    uint32_t s2 = adler >> 16;
+
+    /*
+     * Serially compute s1 & s2, until the data is 16-byte aligned.
+     */
+    if ((uintptr_t)buf & 15) {
+        while ((uintptr_t)buf & 15) {
+            s2 += (s1 += *buf++);
+            --len;
+        }
+
+        if (s1 >= BASE)
+            s1 -= BASE;
+        s2 %= BASE;
+    }
+
+    /*
+     * Process the data in blocks.
+     */
+    const unsigned BLOCK_SIZE = 1 << 5;
+
+    z_size_t blocks = len / BLOCK_SIZE;
+    len -= blocks * BLOCK_SIZE;
+
+    while (blocks)
+    {
+        unsigned n = NMAX / BLOCK_SIZE;  /* The NMAX constraint. */
+        if (n > blocks)
+            n = (unsigned) blocks;
+        blocks -= n;
+
+        /*
+         * Process n blocks of data. At most NMAX data bytes can be
+         * processed before s2 must be reduced modulo BASE.
+         */
+        uint32x4_t v_s2 = (uint32x4_t) { 0, 0, 0, s1 * n };
+        uint32x4_t v_s1 = (uint32x4_t) { 0, 0, 0, 0 };
+
+        uint16x8_t v_column_sum_1 = vdupq_n_u16(0);
+        uint16x8_t v_column_sum_2 = vdupq_n_u16(0);
+        uint16x8_t v_column_sum_3 = vdupq_n_u16(0);
+        uint16x8_t v_column_sum_4 = vdupq_n_u16(0);
+
+        do {
+            /*
+             * Load 32 input bytes.
+             */
+            const uint8x16_t bytes1 = vld1q_u8((uint8_t*)(buf));
+            const uint8x16_t bytes2 = vld1q_u8((uint8_t*)(buf + 16));
+
+            /*
+             * Add previous block byte sum to v_s2.
+             */
+            v_s2 = vaddq_u32(v_s2, v_s1);
+
+            /*
+             * Horizontally add the bytes for s1.
+             */
+            v_s1 = vpadalq_u16(v_s1, vpadalq_u8(vpaddlq_u8(bytes1), bytes2));
+
+            /*
+             * Vertically add the bytes for s2.
+             */
+            v_column_sum_1 = vaddw_u8(v_column_sum_1, vget_low_u8 (bytes1));
+            v_column_sum_2 = vaddw_u8(v_column_sum_2, vget_high_u8(bytes1));
+            v_column_sum_3 = vaddw_u8(v_column_sum_3, vget_low_u8 (bytes2));
+            v_column_sum_4 = vaddw_u8(v_column_sum_4, vget_high_u8(bytes2));
+
+            buf += BLOCK_SIZE;
+
+        } while (--n);
+
+        v_s2 = vshlq_n_u32(v_s2, 5);
+
+        /*
+         * Multiply-add bytes by [ 32, 31, 30, ... ] for s2.
+         */
+        v_s2 = vmlal_u16(v_s2, vget_low_u16 (v_column_sum_1),
+            (uint16x4_t) { 32, 31, 30, 29 });
+        v_s2 = vmlal_u16(v_s2, vget_high_u16(v_column_sum_1),
+            (uint16x4_t) { 28, 27, 26, 25 });
+        v_s2 = vmlal_u16(v_s2, vget_low_u16 (v_column_sum_2),
+            (uint16x4_t) { 24, 23, 22, 21 });
+        v_s2 = vmlal_u16(v_s2, vget_high_u16(v_column_sum_2),
+            (uint16x4_t) { 20, 19, 18, 17 });
+        v_s2 = vmlal_u16(v_s2, vget_low_u16 (v_column_sum_3),
+            (uint16x4_t) { 16, 15, 14, 13 });
+        v_s2 = vmlal_u16(v_s2, vget_high_u16(v_column_sum_3),
+            (uint16x4_t) { 12, 11, 10,  9 });
+        v_s2 = vmlal_u16(v_s2, vget_low_u16 (v_column_sum_4),
+            (uint16x4_t) {  8,  7,  6,  5 });
+        v_s2 = vmlal_u16(v_s2, vget_high_u16(v_column_sum_4),
+            (uint16x4_t) {  4,  3,  2,  1 });
+
+        /*
+         * Sum epi32 ints v_s1(s2) and accumulate in s1(s2).
+         */
+        uint32x2_t sum1 = vpadd_u32(vget_low_u32(v_s1), vget_high_u32(v_s1));
+        uint32x2_t sum2 = vpadd_u32(vget_low_u32(v_s2), vget_high_u32(v_s2));
+        uint32x2_t s1s2 = vpadd_u32(sum1, sum2);
+
+        s1 += vget_lane_u32(s1s2, 0);
+        s2 += vget_lane_u32(s1s2, 1);
+
+        /*
+         * Reduce.
+         */
+        s1 %= BASE;
+        s2 %= BASE;
+    }
+
+    /*
+     * Handle leftover data.
+     */
+    if (len) {
+        if (len >= 16) {
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+            s2 += (s1 += *buf++);
+
+            len -= 16;
+        }
+
+        while (len--) {
+            s2 += (s1 += *buf++);
+        }
+
+        if (s1 >= BASE)
+            s1 -= BASE;
+        s2 %= BASE;
+    }
+
+    /*
+     * Return the recombined sums.
+     */
+    return s1 | (s2 << 16);
+}
+
+#endif  /* ADLER32_SIMD_SSSE3 */
diff --git a/deps/v8/third_party/zlib/adler32_simd.h b/deps/v8/third_party/zlib/adler32_simd.h
new file mode 100644
index 00000000000000..52bb14d16751c8
--- /dev/null
+++ b/deps/v8/third_party/zlib/adler32_simd.h
@@ -0,0 +1,16 @@
+/* adler32_simd.h
+ *
+ * Copyright 2017 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the Chromium source repository LICENSE file.
+ */
+
+#include <stdint.h>
+
+#include "zconf.h"
+#include "zutil.h"
+
+uint32_t ZLIB_INTERNAL adler32_simd_(
+    uint32_t adler,
+    const unsigned char *buf,
+    z_size_t len);
diff --git a/deps/v8/third_party/zlib/chromeconf.h b/deps/v8/third_party/zlib/chromeconf.h
new file mode 100644
index 00000000000000..666093d696a583
--- /dev/null
+++ b/deps/v8/third_party/zlib/chromeconf.h
@@ -0,0 +1,195 @@
+/* Copyright 2017 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file. */
+
+#ifndef THIRD_PARTY_ZLIB_CHROMECONF_H_
+#define THIRD_PARTY_ZLIB_CHROMECONF_H_
+
+#if defined(COMPONENT_BUILD)
+#if defined(WIN32)
+#if defined(ZLIB_IMPLEMENTATION)
+#define ZEXTERN __declspec(dllexport)
+#else
+#define ZEXTERN __declspec(dllimport)
+#endif
+#elif defined(ZLIB_IMPLEMENTATION)
+#define ZEXTERN __attribute__((visibility("default")))
+#endif
+#endif
+
+/* Rename all zlib names with a Cr_z_ prefix. This is based on the Z_PREFIX
+ * option from zconf.h, but with a custom prefix. Where zconf.h would rename
+ * both a macro and its underscore-suffixed internal implementation (such as
+ * deflateInit2 and deflateInit2_), only the implementation is renamed here.
+ * The Byte type is also omitted.
+ *
+ * To generate this list, run
+ * sed -rn -e 's/^# *define +([^ ]+) +(z_[^ ]+)$/#define \1 Cr_\2/p' zconf.h
+ * (use -E instead of -r on macOS).
+ *
+ * gzread is also addressed by modifications in gzread.c and zlib.h. */
+
+#define Z_CR_PREFIX_SET
+
+#define _dist_code Cr_z__dist_code
+#define _length_code Cr_z__length_code
+#define _tr_align Cr_z__tr_align
+#define _tr_flush_bits Cr_z__tr_flush_bits
+#define _tr_flush_block Cr_z__tr_flush_block
+#define _tr_init Cr_z__tr_init
+#define _tr_stored_block Cr_z__tr_stored_block
+#define _tr_tally Cr_z__tr_tally
+#define adler32 Cr_z_adler32
+#define adler32_combine Cr_z_adler32_combine
+#define adler32_combine64 Cr_z_adler32_combine64
+#define adler32_z Cr_z_adler32_z
+#define compress Cr_z_compress
+#define compress2 Cr_z_compress2
+#define compressBound Cr_z_compressBound
+#define crc32 Cr_z_crc32
+#define crc32_combine Cr_z_crc32_combine
+#define crc32_combine64 Cr_z_crc32_combine64
+#define crc32_z Cr_z_crc32_z
+#define deflate Cr_z_deflate
+#define deflateBound Cr_z_deflateBound
+#define deflateCopy Cr_z_deflateCopy
+#define deflateEnd Cr_z_deflateEnd
+#define deflateGetDictionary Cr_z_deflateGetDictionary
+/* #undef deflateInit */
+/* #undef deflateInit2 */
+#define deflateInit2_ Cr_z_deflateInit2_
+#define deflateInit_ Cr_z_deflateInit_
+#define deflateParams Cr_z_deflateParams
+#define deflatePending Cr_z_deflatePending
+#define deflatePrime Cr_z_deflatePrime
+#define deflateReset Cr_z_deflateReset
+#define deflateResetKeep Cr_z_deflateResetKeep
+#define deflateSetDictionary Cr_z_deflateSetDictionary
+#define deflateSetHeader Cr_z_deflateSetHeader
+#define deflateTune Cr_z_deflateTune
+#define deflate_copyright Cr_z_deflate_copyright
+#define get_crc_table Cr_z_get_crc_table
+#define gz_error Cr_z_gz_error
+#define gz_intmax Cr_z_gz_intmax
+#define gz_strwinerror Cr_z_gz_strwinerror
+#define gzbuffer Cr_z_gzbuffer
+#define gzclearerr Cr_z_gzclearerr
+#define gzclose Cr_z_gzclose
+#define gzclose_r Cr_z_gzclose_r
+#define gzclose_w Cr_z_gzclose_w
+#define gzdirect Cr_z_gzdirect
+#define gzdopen Cr_z_gzdopen
+#define gzeof Cr_z_gzeof
+#define gzerror Cr_z_gzerror
+#define gzflush Cr_z_gzflush
+#define gzfread Cr_z_gzfread
+#define gzfwrite Cr_z_gzfwrite
+#define gzgetc Cr_z_gzgetc
+#define gzgetc_ Cr_z_gzgetc_
+#define gzgets Cr_z_gzgets
+#define gzoffset Cr_z_gzoffset
+#define gzoffset64 Cr_z_gzoffset64
+#define gzopen Cr_z_gzopen
+#define gzopen64 Cr_z_gzopen64
+#define gzopen_w Cr_z_gzopen_w
+#define gzprintf Cr_z_gzprintf
+#define gzputc Cr_z_gzputc
+#define gzputs Cr_z_gzputs
+#define gzread Cr_z_gzread
+#define gzrewind Cr_z_gzrewind
+#define gzseek Cr_z_gzseek
+#define gzseek64 Cr_z_gzseek64
+#define gzsetparams Cr_z_gzsetparams
+#define gztell Cr_z_gztell
+#define gztell64 Cr_z_gztell64
+#define gzungetc Cr_z_gzungetc
+#define gzvprintf Cr_z_gzvprintf
+#define gzwrite Cr_z_gzwrite
+#define inflate Cr_z_inflate
+#define inflateBack Cr_z_inflateBack
+#define inflateBackEnd Cr_z_inflateBackEnd
+/* #undef inflateBackInit */
+#define inflateBackInit_ Cr_z_inflateBackInit_
+#define inflateCodesUsed Cr_z_inflateCodesUsed
+#define inflateCopy Cr_z_inflateCopy
+#define inflateEnd Cr_z_inflateEnd
+#define inflateGetDictionary Cr_z_inflateGetDictionary
+#define inflateGetHeader Cr_z_inflateGetHeader
+/* #undef inflateInit */
+/* #undef inflateInit2 */
+#define inflateInit2_ Cr_z_inflateInit2_
+#define inflateInit_ Cr_z_inflateInit_
+#define inflateMark Cr_z_inflateMark
+#define inflatePrime Cr_z_inflatePrime
+#define inflateReset Cr_z_inflateReset
+#define inflateReset2 Cr_z_inflateReset2
+#define inflateResetKeep Cr_z_inflateResetKeep
+#define inflateSetDictionary Cr_z_inflateSetDictionary
+#define inflateSync Cr_z_inflateSync
+#define inflateSyncPoint Cr_z_inflateSyncPoint
+#define inflateUndermine Cr_z_inflateUndermine
+#define inflateValidate Cr_z_inflateValidate
+#define inflate_copyright Cr_z_inflate_copyright
+#define inflate_fast Cr_z_inflate_fast
+#define inflate_table Cr_z_inflate_table
+#define uncompress Cr_z_uncompress
+#define uncompress2 Cr_z_uncompress2
+#define zError Cr_z_zError
+#define zcalloc Cr_z_zcalloc
+#define zcfree Cr_z_zcfree
+#define zlibCompileFlags Cr_z_zlibCompileFlags
+#define zlibVersion Cr_z_zlibVersion
+/* #undef Byte */
+#define Bytef Cr_z_Bytef
+#define alloc_func Cr_z_alloc_func
+#define charf Cr_z_charf
+#define free_func Cr_z_free_func
+#define gzFile Cr_z_gzFile
+#define gz_header Cr_z_gz_header
+#define gz_headerp Cr_z_gz_headerp
+#define in_func Cr_z_in_func
+#define intf Cr_z_intf
+#define out_func Cr_z_out_func
+#define uInt Cr_z_uInt
+#define uIntf Cr_z_uIntf
+#define uLong Cr_z_uLong
+#define uLongf Cr_z_uLongf
+#define voidp Cr_z_voidp
+#define voidpc Cr_z_voidpc
+#define voidpf Cr_z_voidpf
+#define gz_header_s Cr_z_gz_header_s
+/* #undef internal_state */
+/* #undef z_off64_t */
+
+/* An exported symbol that isn't handled by Z_PREFIX in zconf.h */
+#define z_errmsg Cr_z_z_errmsg
+
+/* Symbols added in simd.patch */
+#define copy_with_crc Cr_z_copy_with_crc
+#define crc_finalize Cr_z_crc_finalize
+#define crc_fold_512to32 Cr_z_crc_fold_512to32
+#define crc_fold_copy Cr_z_crc_fold_copy
+#define crc_fold_init Cr_z_crc_fold_init
+#define crc_reset Cr_z_crc_reset
+#define fill_window_sse Cr_z_fill_window_sse
+#define deflate_read_buf Cr_z_deflate_read_buf
+#define x86_check_features Cr_z_x86_check_features
+#define x86_cpu_enable_simd Cr_z_x86_cpu_enable_simd
+
+/* Symbols added by adler_simd.c */
+#define adler32_simd_ Cr_z_adler32_simd_
+#define x86_cpu_enable_ssse3 Cr_z_x86_cpu_enable_ssse3
+
+/* Symbols added by contrib/optimizations/inffast_chunk */
+#define inflate_fast_chunk_ Cr_z_inflate_fast_chunk_
+
+/* Symbols added by crc32_simd.c */
+#define crc32_sse42_simd_ Cr_z_crc32_sse42_simd_
+
+/* Symbols added by armv8_crc32 */
+#define arm_cpu_enable_crc32 Cr_z_arm_cpu_enable_crc32
+#define arm_cpu_enable_pmull Cr_z_arm_cpu_enable_pmull
+#define arm_check_features Cr_z_arm_check_features
+#define armv8_crc32_little Cr_z_armv8_crc32_little
+
+#endif /* THIRD_PARTY_ZLIB_CHROMECONF_H_ */
diff --git a/deps/v8/third_party/zlib/compress.c b/deps/v8/third_party/zlib/compress.c
new file mode 100644
index 00000000000000..6e8517335da018
--- /dev/null
+++ b/deps/v8/third_party/zlib/compress.c
@@ -0,0 +1,96 @@
+/* compress.c -- compress a memory buffer
+ * Copyright (C) 1995-2005, 2014, 2016 Jean-loup Gailly, Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/* @(#) $Id$ */
+
+#define ZLIB_INTERNAL
+#include "zlib.h"
+
+/* ===========================================================================
+     Compresses the source buffer into the destination buffer. The level
+   parameter has the same meaning as in deflateInit.  sourceLen is the byte
+   length of the source buffer. Upon entry, destLen is the total size of the
+   destination buffer, which must be at least 0.1% larger than sourceLen plus
+   12 bytes. Upon exit, destLen is the actual size of the compressed buffer.
+
+     compress2 returns Z_OK if success, Z_MEM_ERROR if there was not enough
+   memory, Z_BUF_ERROR if there was not enough room in the output buffer,
+   Z_STREAM_ERROR if the level parameter is invalid.
+*/
+int ZEXPORT compress2 (dest, destLen, source, sourceLen, level)
+    Bytef *dest;
+    uLongf *destLen;
+    const Bytef *source;
+    uLong sourceLen;
+    int level;
+{
+    z_stream stream;
+    int err;
+    const uInt max = (uInt)-1;
+    uLong left;
+
+    left = *destLen;
+    *destLen = 0;
+
+    stream.zalloc = (alloc_func)0;
+    stream.zfree = (free_func)0;
+    stream.opaque = (voidpf)0;
+
+    err = deflateInit(&stream, level);
+    if (err != Z_OK) return err;
+
+    stream.next_out = dest;
+    stream.avail_out = 0;
+    stream.next_in = (z_const Bytef *)source;
+    stream.avail_in = 0;
+
+    do {
+        if (stream.avail_out == 0) {
+            stream.avail_out = left > (uLong)max ? max : (uInt)left;
+            left -= stream.avail_out;
+        }
+        if (stream.avail_in == 0) {
+            stream.avail_in = sourceLen > (uLong)max ? max : (uInt)sourceLen;
+            sourceLen -= stream.avail_in;
+        }
+        err = deflate(&stream, sourceLen ? Z_NO_FLUSH : Z_FINISH);
+    } while (err == Z_OK);
+
+    *destLen = stream.total_out;
+    deflateEnd(&stream);
+    return err == Z_STREAM_END ? Z_OK : err;
+}
+
+/* ===========================================================================
+ */
+int ZEXPORT compress (dest, destLen, source, sourceLen)
+    Bytef *dest;
+    uLongf *destLen;
+    const Bytef *source;
+    uLong sourceLen;
+{
+    return compress2(dest, destLen, source, sourceLen, Z_DEFAULT_COMPRESSION);
+}
+
+/* ===========================================================================
+     If the default memLevel or windowBits for deflateInit() is changed, then
+   this function needs to be updated.
+ */
+uLong ZEXPORT compressBound (sourceLen)
+    uLong sourceLen;
+{
+    sourceLen = sourceLen + (sourceLen >> 12) + (sourceLen >> 14) +
+                (sourceLen >> 25) + 13;
+    /* FIXME(cavalcantii): usage of CRC32 Castagnoli as a hash function
+     * for the hash table of symbols used for compression has a side effect
+     * where for compression level [4, 5] it will increase the output buffer size
+     * by 0.1% (i.e. less than 1%) for a high entropy input (i.e. random data).
+     * To avoid a scenario where client code would fail, for safety we increase
+     * the expected output size by 0.8% (i.e. 8x more than the worst scenario).
+     * See: http://crbug.com/990489
+     */
+    sourceLen += sourceLen >> 7; // Equivalent to 1.0078125
+    return sourceLen;
+}
diff --git a/deps/v8/third_party/zlib/contrib/minizip/ChangeLogUnzip b/deps/v8/third_party/zlib/contrib/minizip/ChangeLogUnzip
new file mode 100644
index 00000000000000..50ca6a9e0f32f0
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/ChangeLogUnzip
@@ -0,0 +1,67 @@
+Change in 1.01e (12 feb 05)
+- Fix in zipOpen2 for globalcomment (Rolf Kalbermatter)
+- Fix possible memory leak in unzip.c (Zoran Stevanovic)
+
+Change in 1.01b (20 may 04)
+- Integrate patch from Debian package (submited by Mark Brown)
+- Add tools mztools from Xavier Roche
+
+Change in 1.01 (8 may 04)
+- fix buffer overrun risk in unzip.c (Xavier Roche)
+- fix a minor buffer insecurity in minizip.c (Mike Whittaker)
+
+Change in 1.00: (10 sept 03)
+- rename to 1.00
+- cosmetic code change
+
+Change in 0.22: (19 May 03)
+- crypting support (unless you define NOCRYPT)
+- append file in existing zipfile
+
+Change in 0.21: (10 Mar 03)
+- bug fixes
+
+Change in 0.17: (27 Jan 02)
+- bug fixes
+
+Change in 0.16: (19 Jan 02)
+- Support of ioapi for virtualize zip file access
+
+Change in 0.15: (19 Mar 98)
+- fix memory leak in minizip.c
+
+Change in 0.14: (10 Mar 98)
+- fix bugs in minizip.c sample for zipping big file
+- fix problem in month in date handling
+- fix bug in unzlocal_GetCurrentFileInfoInternal in unzip.c for
+    comment handling
+
+Change in 0.13: (6 Mar 98)
+- fix bugs in zip.c
+- add real minizip sample
+
+Change in 0.12: (4 Mar 98)
+- add zip.c and zip.h for creates .zip file
+- fix change_file_date in miniunz.c for Unix (Jean-loup Gailly)
+- fix miniunz.c for file without specific record for directory
+
+Change in 0.11: (3 Mar 98)
+- fix bug in unzGetCurrentFileInfo for get extra field and comment
+- enhance miniunz sample, remove the bad unztst.c sample
+
+Change in 0.10: (2 Mar 98)
+- fix bug in unzReadCurrentFile
+- rename unzip* to unz* function and structure
+- remove Windows-like hungary notation variable name
+- modify some structure in unzip.h
+- add somes comment in source
+- remove unzipGetcCurrentFile function
+- replace ZUNZEXPORT by ZEXPORT
+- add unzGetLocalExtrafield for get the local extrafield info
+- add a new sample, miniunz.c
+
+Change in 0.4: (25 Feb 98)
+- suppress the type unzipFileInZip.
+  Only on file in the zipfile can be open at the same time
+- fix somes typo in code
+- added tm_unz structure in unzip_file_info (date/time in readable format)
diff --git a/deps/v8/third_party/zlib/contrib/minizip/Makefile b/deps/v8/third_party/zlib/contrib/minizip/Makefile
new file mode 100644
index 00000000000000..84eaad20d4fb19
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/Makefile
@@ -0,0 +1,25 @@
+CC=cc
+CFLAGS=-O -I../..
+
+UNZ_OBJS = miniunz.o unzip.o ioapi.o ../../libz.a
+ZIP_OBJS = minizip.o zip.o   ioapi.o ../../libz.a
+
+.c.o:
+	$(CC) -c $(CFLAGS) $*.c
+
+all: miniunz minizip
+
+miniunz:  $(UNZ_OBJS)
+	$(CC) $(CFLAGS) -o $@ $(UNZ_OBJS)
+
+minizip:  $(ZIP_OBJS)
+	$(CC) $(CFLAGS) -o $@ $(ZIP_OBJS)
+
+test:	miniunz minizip
+	./minizip test readme.txt
+	./miniunz -l test.zip
+	mv readme.txt readme.old
+	./miniunz test.zip
+
+clean:
+	/bin/rm -f *.o *~ minizip miniunz
diff --git a/deps/v8/third_party/zlib/contrib/minizip/crypt.h b/deps/v8/third_party/zlib/contrib/minizip/crypt.h
new file mode 100644
index 00000000000000..1e9e8200b201ff
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/crypt.h
@@ -0,0 +1,131 @@
+/* crypt.h -- base code for crypt/uncrypt ZIPfile
+
+
+   Version 1.01e, February 12th, 2005
+
+   Copyright (C) 1998-2005 Gilles Vollant
+
+   This code is a modified version of crypting code in Infozip distribution
+
+   The encryption/decryption parts of this source code (as opposed to the
+   non-echoing password parts) were originally written in Europe.  The
+   whole source package can be freely distributed, including from the USA.
+   (Prior to January 2000, re-export from the US was a violation of US law.)
+
+   This encryption code is a direct transcription of the algorithm from
+   Roger Schlafly, described by Phil Katz in the file appnote.txt.  This
+   file (appnote.txt) is distributed with the PKZIP program (even in the
+   version without encryption capabilities).
+
+   If you don't need crypting in your application, just define symbols
+   NOCRYPT and NOUNCRYPT.
+
+   This code support the "Traditional PKWARE Encryption".
+
+   The new AES encryption added on Zip format by Winzip (see the page
+   http://www.winzip.com/aes_info.htm ) and PKWare PKZip 5.x Strong
+   Encryption is not supported.
+*/
+
+#define CRC32(c, b) ((*(pcrc_32_tab+(((int)(c) ^ (b)) & 0xff))) ^ ((c) >> 8))
+
+/***********************************************************************
+ * Return the next byte in the pseudo-random sequence
+ */
+static int decrypt_byte(unsigned long* pkeys, const z_crc_t* pcrc_32_tab)
+{
+    unsigned temp;  /* POTENTIAL BUG:  temp*(temp^1) may overflow in an
+                     * unpredictable manner on 16-bit systems; not a problem
+                     * with any known compiler so far, though */
+
+    temp = ((unsigned)(*(pkeys+2)) & 0xffff) | 2;
+    return (int)(((temp * (temp ^ 1)) >> 8) & 0xff);
+}
+
+/***********************************************************************
+ * Update the encryption keys with the next byte of plain text
+ */
+static int update_keys(unsigned long* pkeys,const z_crc_t* pcrc_32_tab,int c)
+{
+    (*(pkeys+0)) = CRC32((*(pkeys+0)), c);
+    (*(pkeys+1)) += (*(pkeys+0)) & 0xff;
+    (*(pkeys+1)) = (*(pkeys+1)) * 134775813L + 1;
+    {
+      register int keyshift = (int)((*(pkeys+1)) >> 24);
+      (*(pkeys+2)) = CRC32((*(pkeys+2)), keyshift);
+    }
+    return c;
+}
+
+
+/***********************************************************************
+ * Initialize the encryption keys and the random header according to
+ * the given password.
+ */
+static void init_keys(const char* passwd,unsigned long* pkeys,const z_crc_t* pcrc_32_tab)
+{
+    *(pkeys+0) = 305419896L;
+    *(pkeys+1) = 591751049L;
+    *(pkeys+2) = 878082192L;
+    while (*passwd != '\0') {
+        update_keys(pkeys,pcrc_32_tab,(int)*passwd);
+        passwd++;
+    }
+}
+
+#define zdecode(pkeys,pcrc_32_tab,c) \
+    (update_keys(pkeys,pcrc_32_tab,c ^= decrypt_byte(pkeys,pcrc_32_tab)))
+
+#define zencode(pkeys,pcrc_32_tab,c,t) \
+    (t=decrypt_byte(pkeys,pcrc_32_tab), update_keys(pkeys,pcrc_32_tab,c), t^(c))
+
+#ifdef INCLUDECRYPTINGCODE_IFCRYPTALLOWED
+
+#define RAND_HEAD_LEN  12
+   /* "last resort" source for second part of crypt seed pattern */
+#  ifndef ZCR_SEED2
+#    define ZCR_SEED2 3141592654UL     /* use PI as default pattern */
+#  endif
+
+static int crypthead(const char* passwd,      /* password string */
+                     unsigned char* buf,      /* where to write header */
+                     int bufSize,
+                     unsigned long* pkeys,
+                     const z_crc_t* pcrc_32_tab,
+                     unsigned long crcForCrypting)
+{
+    int n;                       /* index in random header */
+    int t;                       /* temporary */
+    int c;                       /* random byte */
+    unsigned char header[RAND_HEAD_LEN-2]; /* random header */
+    static unsigned calls = 0;   /* ensure different random header each time */
+
+    if (bufSize<RAND_HEAD_LEN)
+      return 0;
+
+    /* First generate RAND_HEAD_LEN-2 random bytes. We encrypt the
+     * output of rand() to get less predictability, since rand() is
+     * often poorly implemented.
+     */
+    if (++calls == 1)
+    {
+        srand((unsigned)(time(NULL) ^ ZCR_SEED2));
+    }
+    init_keys(passwd, pkeys, pcrc_32_tab);
+    for (n = 0; n < RAND_HEAD_LEN-2; n++)
+    {
+        c = (rand() >> 7) & 0xff;
+        header[n] = (unsigned char)zencode(pkeys, pcrc_32_tab, c, t);
+    }
+    /* Encrypt random header (last two bytes is high word of crc) */
+    init_keys(passwd, pkeys, pcrc_32_tab);
+    for (n = 0; n < RAND_HEAD_LEN-2; n++)
+    {
+        buf[n] = (unsigned char)zencode(pkeys, pcrc_32_tab, header[n], t);
+    }
+    buf[n++] = (unsigned char)zencode(pkeys, pcrc_32_tab, (int)(crcForCrypting >> 16) & 0xff, t);
+    buf[n++] = (unsigned char)zencode(pkeys, pcrc_32_tab, (int)(crcForCrypting >> 24) & 0xff, t);
+    return n;
+}
+
+#endif
diff --git a/deps/v8/third_party/zlib/contrib/minizip/ioapi.c b/deps/v8/third_party/zlib/contrib/minizip/ioapi.c
new file mode 100644
index 00000000000000..543910b5e118a4
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/ioapi.c
@@ -0,0 +1,247 @@
+/* ioapi.h -- IO base function header for compress/uncompress .zip
+   part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Modifications for Zip64 support
+         Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com )
+
+         For more info read MiniZip_info.txt
+
+*/
+
+#if defined(_WIN32) && (!(defined(_CRT_SECURE_NO_WARNINGS)))
+        #define _CRT_SECURE_NO_WARNINGS
+#endif
+
+#if defined(__APPLE__) || defined(__Fuchsia__) || defined(IOAPI_NO_64)
+// In darwin and perhaps other BSD variants off_t is a 64 bit value, hence no need for specific 64 bit functions
+#define FOPEN_FUNC(filename, mode) fopen(filename, mode)
+#define FTELLO_FUNC(stream) ftello(stream)
+#define FSEEKO_FUNC(stream, offset, origin) fseeko(stream, offset, origin)
+#else
+#define FOPEN_FUNC(filename, mode) fopen64(filename, mode)
+#define FTELLO_FUNC(stream) ftello64(stream)
+#define FSEEKO_FUNC(stream, offset, origin) fseeko64(stream, offset, origin)
+#endif
+
+
+#include "ioapi.h"
+
+voidpf call_zopen64 (const zlib_filefunc64_32_def* pfilefunc,const void*filename,int mode)
+{
+    if (pfilefunc->zfile_func64.zopen64_file != NULL)
+        return (*(pfilefunc->zfile_func64.zopen64_file)) (pfilefunc->zfile_func64.opaque,filename,mode);
+    else
+    {
+        return (*(pfilefunc->zopen32_file))(pfilefunc->zfile_func64.opaque,(const char*)filename,mode);
+    }
+}
+
+long call_zseek64 (const zlib_filefunc64_32_def* pfilefunc,voidpf filestream, ZPOS64_T offset, int origin)
+{
+    if (pfilefunc->zfile_func64.zseek64_file != NULL)
+        return (*(pfilefunc->zfile_func64.zseek64_file)) (pfilefunc->zfile_func64.opaque,filestream,offset,origin);
+    else
+    {
+        uLong offsetTruncated = (uLong)offset;
+        if (offsetTruncated != offset)
+            return -1;
+        else
+            return (*(pfilefunc->zseek32_file))(pfilefunc->zfile_func64.opaque,filestream,offsetTruncated,origin);
+    }
+}
+
+ZPOS64_T call_ztell64 (const zlib_filefunc64_32_def* pfilefunc,voidpf filestream)
+{
+    if (pfilefunc->zfile_func64.zseek64_file != NULL)
+        return (*(pfilefunc->zfile_func64.ztell64_file)) (pfilefunc->zfile_func64.opaque,filestream);
+    else
+    {
+        uLong tell_uLong = (*(pfilefunc->ztell32_file))(pfilefunc->zfile_func64.opaque,filestream);
+        if ((tell_uLong) == MAXU32)
+            return (ZPOS64_T)-1;
+        else
+            return tell_uLong;
+    }
+}
+
+void fill_zlib_filefunc64_32_def_from_filefunc32(zlib_filefunc64_32_def* p_filefunc64_32,const zlib_filefunc_def* p_filefunc32)
+{
+    p_filefunc64_32->zfile_func64.zopen64_file = NULL;
+    p_filefunc64_32->zopen32_file = p_filefunc32->zopen_file;
+    p_filefunc64_32->zfile_func64.zerror_file = p_filefunc32->zerror_file;
+    p_filefunc64_32->zfile_func64.zread_file = p_filefunc32->zread_file;
+    p_filefunc64_32->zfile_func64.zwrite_file = p_filefunc32->zwrite_file;
+    p_filefunc64_32->zfile_func64.ztell64_file = NULL;
+    p_filefunc64_32->zfile_func64.zseek64_file = NULL;
+    p_filefunc64_32->zfile_func64.zclose_file = p_filefunc32->zclose_file;
+    p_filefunc64_32->zfile_func64.zerror_file = p_filefunc32->zerror_file;
+    p_filefunc64_32->zfile_func64.opaque = p_filefunc32->opaque;
+    p_filefunc64_32->zseek32_file = p_filefunc32->zseek_file;
+    p_filefunc64_32->ztell32_file = p_filefunc32->ztell_file;
+}
+
+
+
+static voidpf  ZCALLBACK fopen_file_func OF((voidpf opaque, const char* filename, int mode));
+static uLong   ZCALLBACK fread_file_func OF((voidpf opaque, voidpf stream, void* buf, uLong size));
+static uLong   ZCALLBACK fwrite_file_func OF((voidpf opaque, voidpf stream, const void* buf,uLong size));
+static ZPOS64_T ZCALLBACK ftell64_file_func OF((voidpf opaque, voidpf stream));
+static long    ZCALLBACK fseek64_file_func OF((voidpf opaque, voidpf stream, ZPOS64_T offset, int origin));
+static int     ZCALLBACK fclose_file_func OF((voidpf opaque, voidpf stream));
+static int     ZCALLBACK ferror_file_func OF((voidpf opaque, voidpf stream));
+
+static voidpf ZCALLBACK fopen_file_func (voidpf opaque, const char* filename, int mode)
+{
+    FILE* file = NULL;
+    const char* mode_fopen = NULL;
+    if ((mode & ZLIB_FILEFUNC_MODE_READWRITEFILTER)==ZLIB_FILEFUNC_MODE_READ)
+        mode_fopen = "rb";
+    else
+    if (mode & ZLIB_FILEFUNC_MODE_EXISTING)
+        mode_fopen = "r+b";
+    else
+    if (mode & ZLIB_FILEFUNC_MODE_CREATE)
+        mode_fopen = "wb";
+
+    if ((filename!=NULL) && (mode_fopen != NULL))
+        file = fopen(filename, mode_fopen);
+    return file;
+}
+
+static voidpf ZCALLBACK fopen64_file_func (voidpf opaque, const void* filename, int mode)
+{
+    FILE* file = NULL;
+    const char* mode_fopen = NULL;
+    if ((mode & ZLIB_FILEFUNC_MODE_READWRITEFILTER)==ZLIB_FILEFUNC_MODE_READ)
+        mode_fopen = "rb";
+    else
+    if (mode & ZLIB_FILEFUNC_MODE_EXISTING)
+        mode_fopen = "r+b";
+    else
+    if (mode & ZLIB_FILEFUNC_MODE_CREATE)
+        mode_fopen = "wb";
+
+    if ((filename!=NULL) && (mode_fopen != NULL))
+        file = FOPEN_FUNC((const char*)filename, mode_fopen);
+    return file;
+}
+
+
+static uLong ZCALLBACK fread_file_func (voidpf opaque, voidpf stream, void* buf, uLong size)
+{
+    uLong ret;
+    ret = (uLong)fread(buf, 1, (size_t)size, (FILE *)stream);
+    return ret;
+}
+
+static uLong ZCALLBACK fwrite_file_func (voidpf opaque, voidpf stream, const void* buf, uLong size)
+{
+    uLong ret;
+    ret = (uLong)fwrite(buf, 1, (size_t)size, (FILE *)stream);
+    return ret;
+}
+
+static long ZCALLBACK ftell_file_func (voidpf opaque, voidpf stream)
+{
+    long ret;
+    ret = ftell((FILE *)stream);
+    return ret;
+}
+
+
+static ZPOS64_T ZCALLBACK ftell64_file_func (voidpf opaque, voidpf stream)
+{
+    ZPOS64_T ret;
+    ret = FTELLO_FUNC((FILE *)stream);
+    return ret;
+}
+
+static long ZCALLBACK fseek_file_func (voidpf  opaque, voidpf stream, uLong offset, int origin)
+{
+    int fseek_origin=0;
+    long ret;
+    switch (origin)
+    {
+    case ZLIB_FILEFUNC_SEEK_CUR :
+        fseek_origin = SEEK_CUR;
+        break;
+    case ZLIB_FILEFUNC_SEEK_END :
+        fseek_origin = SEEK_END;
+        break;
+    case ZLIB_FILEFUNC_SEEK_SET :
+        fseek_origin = SEEK_SET;
+        break;
+    default: return -1;
+    }
+    ret = 0;
+    if (fseek((FILE *)stream, offset, fseek_origin) != 0)
+        ret = -1;
+    return ret;
+}
+
+static long ZCALLBACK fseek64_file_func (voidpf  opaque, voidpf stream, ZPOS64_T offset, int origin)
+{
+    int fseek_origin=0;
+    long ret;
+    switch (origin)
+    {
+    case ZLIB_FILEFUNC_SEEK_CUR :
+        fseek_origin = SEEK_CUR;
+        break;
+    case ZLIB_FILEFUNC_SEEK_END :
+        fseek_origin = SEEK_END;
+        break;
+    case ZLIB_FILEFUNC_SEEK_SET :
+        fseek_origin = SEEK_SET;
+        break;
+    default: return -1;
+    }
+    ret = 0;
+
+    if(FSEEKO_FUNC((FILE *)stream, offset, fseek_origin) != 0)
+                        ret = -1;
+
+    return ret;
+}
+
+
+static int ZCALLBACK fclose_file_func (voidpf opaque, voidpf stream)
+{
+    int ret;
+    ret = fclose((FILE *)stream);
+    return ret;
+}
+
+static int ZCALLBACK ferror_file_func (voidpf opaque, voidpf stream)
+{
+    int ret;
+    ret = ferror((FILE *)stream);
+    return ret;
+}
+
+void fill_fopen_filefunc (pzlib_filefunc_def)
+  zlib_filefunc_def* pzlib_filefunc_def;
+{
+    pzlib_filefunc_def->zopen_file = fopen_file_func;
+    pzlib_filefunc_def->zread_file = fread_file_func;
+    pzlib_filefunc_def->zwrite_file = fwrite_file_func;
+    pzlib_filefunc_def->ztell_file = ftell_file_func;
+    pzlib_filefunc_def->zseek_file = fseek_file_func;
+    pzlib_filefunc_def->zclose_file = fclose_file_func;
+    pzlib_filefunc_def->zerror_file = ferror_file_func;
+    pzlib_filefunc_def->opaque = NULL;
+}
+
+void fill_fopen64_filefunc (zlib_filefunc64_def*  pzlib_filefunc_def)
+{
+    pzlib_filefunc_def->zopen64_file = fopen64_file_func;
+    pzlib_filefunc_def->zread_file = fread_file_func;
+    pzlib_filefunc_def->zwrite_file = fwrite_file_func;
+    pzlib_filefunc_def->ztell64_file = ftell64_file_func;
+    pzlib_filefunc_def->zseek64_file = fseek64_file_func;
+    pzlib_filefunc_def->zclose_file = fclose_file_func;
+    pzlib_filefunc_def->zerror_file = ferror_file_func;
+    pzlib_filefunc_def->opaque = NULL;
+}
diff --git a/deps/v8/third_party/zlib/contrib/minizip/ioapi.h b/deps/v8/third_party/zlib/contrib/minizip/ioapi.h
new file mode 100644
index 00000000000000..c1b7a54847f552
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/ioapi.h
@@ -0,0 +1,208 @@
+/* ioapi.h -- IO base function header for compress/uncompress .zip
+   part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Modifications for Zip64 support
+         Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com )
+
+         For more info read MiniZip_info.txt
+
+         Changes
+
+    Oct-2009 - Defined ZPOS64_T to fpos_t on windows and u_int64_t on linux. (might need to find a better why for this)
+    Oct-2009 - Change to fseeko64, ftello64 and fopen64 so large files would work on linux.
+               More if/def section may be needed to support other platforms
+    Oct-2009 - Defined fxxxx64 calls to normal fopen/ftell/fseek so they would compile on windows.
+                          (but you should use iowin32.c for windows instead)
+
+*/
+
+#ifndef _ZLIBIOAPI64_H
+#define _ZLIBIOAPI64_H
+
+#if (!defined(_WIN32)) && (!defined(WIN32)) && (!defined(__APPLE__))
+
+  // Linux needs this to support file operation on files larger then 4+GB
+  // But might need better if/def to select just the platforms that needs them.
+
+        #ifndef __USE_FILE_OFFSET64
+                #define __USE_FILE_OFFSET64
+        #endif
+        #ifndef __USE_LARGEFILE64
+                #define __USE_LARGEFILE64
+        #endif
+        #ifndef _LARGEFILE64_SOURCE
+                #define _LARGEFILE64_SOURCE
+        #endif
+        #ifndef _FILE_OFFSET_BIT
+                #define _FILE_OFFSET_BIT 64
+        #endif
+
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include "third_party/zlib/zlib.h"
+
+#if defined(USE_FILE32API)
+#define fopen64 fopen
+#define ftello64 ftell
+#define fseeko64 fseek
+#else
+#ifdef __FreeBSD__
+#define fopen64 fopen
+#define ftello64 ftello
+#define fseeko64 fseeko
+#endif
+#ifdef _MSC_VER
+ #define fopen64 fopen
+ #if (_MSC_VER >= 1400) && (!(defined(NO_MSCVER_FILE64_FUNC)))
+  #define ftello64 _ftelli64
+  #define fseeko64 _fseeki64
+ #else // old MSC
+  #define ftello64 ftell
+  #define fseeko64 fseek
+ #endif
+#endif
+#endif
+
+/*
+#ifndef ZPOS64_T
+  #ifdef _WIN32
+                #define ZPOS64_T fpos_t
+  #else
+    #include <stdint.h>
+    #define ZPOS64_T uint64_t
+  #endif
+#endif
+*/
+
+#ifdef HAVE_MINIZIP64_CONF_H
+#include "mz64conf.h"
+#endif
+
+/* a type choosen by DEFINE */
+#ifdef HAVE_64BIT_INT_CUSTOM
+typedef  64BIT_INT_CUSTOM_TYPE ZPOS64_T;
+#else
+#ifdef HAS_STDINT_H
+#include "stdint.h"
+typedef uint64_t ZPOS64_T;
+#else
+
+/* Maximum unsigned 32-bit value used as placeholder for zip64 */
+#define MAXU32 0xffffffff
+
+#if defined(_MSC_VER) || defined(__BORLANDC__)
+typedef unsigned __int64 ZPOS64_T;
+#else
+typedef unsigned long long int ZPOS64_T;
+#endif
+#endif
+#endif
+
+
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+#define ZLIB_FILEFUNC_SEEK_CUR (1)
+#define ZLIB_FILEFUNC_SEEK_END (2)
+#define ZLIB_FILEFUNC_SEEK_SET (0)
+
+#define ZLIB_FILEFUNC_MODE_READ      (1)
+#define ZLIB_FILEFUNC_MODE_WRITE     (2)
+#define ZLIB_FILEFUNC_MODE_READWRITEFILTER (3)
+
+#define ZLIB_FILEFUNC_MODE_EXISTING (4)
+#define ZLIB_FILEFUNC_MODE_CREATE   (8)
+
+
+#ifndef ZCALLBACK
+ #if (defined(WIN32) || defined(_WIN32) || defined (WINDOWS) || defined (_WINDOWS)) && defined(CALLBACK) && defined (USEWINDOWS_CALLBACK)
+   #define ZCALLBACK CALLBACK
+ #else
+   #define ZCALLBACK
+ #endif
+#endif
+
+
+
+
+typedef voidpf   (ZCALLBACK *open_file_func)      OF((voidpf opaque, const char* filename, int mode));
+typedef uLong    (ZCALLBACK *read_file_func)      OF((voidpf opaque, voidpf stream, void* buf, uLong size));
+typedef uLong    (ZCALLBACK *write_file_func)     OF((voidpf opaque, voidpf stream, const void* buf, uLong size));
+typedef int      (ZCALLBACK *close_file_func)     OF((voidpf opaque, voidpf stream));
+typedef int      (ZCALLBACK *testerror_file_func) OF((voidpf opaque, voidpf stream));
+
+typedef long     (ZCALLBACK *tell_file_func)      OF((voidpf opaque, voidpf stream));
+typedef long     (ZCALLBACK *seek_file_func)      OF((voidpf opaque, voidpf stream, uLong offset, int origin));
+
+
+/* here is the "old" 32 bits structure structure */
+typedef struct zlib_filefunc_def_s
+{
+    open_file_func      zopen_file;
+    read_file_func      zread_file;
+    write_file_func     zwrite_file;
+    tell_file_func      ztell_file;
+    seek_file_func      zseek_file;
+    close_file_func     zclose_file;
+    testerror_file_func zerror_file;
+    voidpf              opaque;
+} zlib_filefunc_def;
+
+typedef ZPOS64_T (ZCALLBACK *tell64_file_func)    OF((voidpf opaque, voidpf stream));
+typedef long     (ZCALLBACK *seek64_file_func)    OF((voidpf opaque, voidpf stream, ZPOS64_T offset, int origin));
+typedef voidpf   (ZCALLBACK *open64_file_func)    OF((voidpf opaque, const void* filename, int mode));
+
+typedef struct zlib_filefunc64_def_s
+{
+    open64_file_func    zopen64_file;
+    read_file_func      zread_file;
+    write_file_func     zwrite_file;
+    tell64_file_func    ztell64_file;
+    seek64_file_func    zseek64_file;
+    close_file_func     zclose_file;
+    testerror_file_func zerror_file;
+    voidpf              opaque;
+} zlib_filefunc64_def;
+
+void fill_fopen64_filefunc OF((zlib_filefunc64_def* pzlib_filefunc_def));
+void fill_fopen_filefunc OF((zlib_filefunc_def* pzlib_filefunc_def));
+
+/* now internal definition, only for zip.c and unzip.h */
+typedef struct zlib_filefunc64_32_def_s
+{
+    zlib_filefunc64_def zfile_func64;
+    open_file_func      zopen32_file;
+    tell_file_func      ztell32_file;
+    seek_file_func      zseek32_file;
+} zlib_filefunc64_32_def;
+
+
+#define ZREAD64(filefunc,filestream,buf,size)     ((*((filefunc).zfile_func64.zread_file))   ((filefunc).zfile_func64.opaque,filestream,buf,size))
+#define ZWRITE64(filefunc,filestream,buf,size)    ((*((filefunc).zfile_func64.zwrite_file))  ((filefunc).zfile_func64.opaque,filestream,buf,size))
+//#define ZTELL64(filefunc,filestream)            ((*((filefunc).ztell64_file)) ((filefunc).opaque,filestream))
+//#define ZSEEK64(filefunc,filestream,pos,mode)   ((*((filefunc).zseek64_file)) ((filefunc).opaque,filestream,pos,mode))
+#define ZCLOSE64(filefunc,filestream)             ((*((filefunc).zfile_func64.zclose_file))  ((filefunc).zfile_func64.opaque,filestream))
+#define ZERROR64(filefunc,filestream)             ((*((filefunc).zfile_func64.zerror_file))  ((filefunc).zfile_func64.opaque,filestream))
+
+voidpf call_zopen64 OF((const zlib_filefunc64_32_def* pfilefunc,const void*filename,int mode));
+long    call_zseek64 OF((const zlib_filefunc64_32_def* pfilefunc,voidpf filestream, ZPOS64_T offset, int origin));
+ZPOS64_T call_ztell64 OF((const zlib_filefunc64_32_def* pfilefunc,voidpf filestream));
+
+void    fill_zlib_filefunc64_32_def_from_filefunc32(zlib_filefunc64_32_def* p_filefunc64_32,const zlib_filefunc_def* p_filefunc32);
+
+#define ZOPEN64(filefunc,filename,mode)         (call_zopen64((&(filefunc)),(filename),(mode)))
+#define ZTELL64(filefunc,filestream)            (call_ztell64((&(filefunc)),(filestream)))
+#define ZSEEK64(filefunc,filestream,pos,mode)   (call_zseek64((&(filefunc)),(filestream),(pos),(mode)))
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/deps/v8/third_party/zlib/contrib/minizip/iowin32.c b/deps/v8/third_party/zlib/contrib/minizip/iowin32.c
new file mode 100644
index 00000000000000..246ceb91a13942
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/iowin32.c
@@ -0,0 +1,469 @@
+/* iowin32.c -- IO base function header for compress/uncompress .zip
+     Version 1.1, February 14h, 2010
+     part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Modifications for Zip64 support
+         Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com )
+
+     For more info read MiniZip_info.txt
+
+*/
+
+#include <stdlib.h>
+
+#include "zlib.h"
+#include "ioapi.h"
+#include "iowin32.h"
+
+#ifndef INVALID_HANDLE_VALUE
+#define INVALID_HANDLE_VALUE (0xFFFFFFFF)
+#endif
+
+#ifndef INVALID_SET_FILE_POINTER
+#define INVALID_SET_FILE_POINTER ((DWORD)-1)
+#endif
+
+
+#ifdef _WIN32_WINNT
+#undef _WIN32_WINNT
+#define _WIN32_WINNT 0x601
+#endif
+
+#if _WIN32_WINNT >= _WIN32_WINNT_WIN8
+// see Include/shared/winapifamily.h in the Windows Kit
+#if defined(WINAPI_FAMILY_PARTITION) && (!(defined(IOWIN32_USING_WINRT_API)))
+#if WINAPI_FAMILY_ONE_PARTITION(WINAPI_FAMILY, WINAPI_PARTITION_APP)
+#define IOWIN32_USING_WINRT_API 1
+#endif
+#endif
+#endif
+
+voidpf  ZCALLBACK win32_open_file_func  OF((voidpf opaque, const char* filename, int mode));
+uLong   ZCALLBACK win32_read_file_func  OF((voidpf opaque, voidpf stream, void* buf, uLong size));
+uLong   ZCALLBACK win32_write_file_func OF((voidpf opaque, voidpf stream, const void* buf, uLong size));
+ZPOS64_T ZCALLBACK win32_tell64_file_func  OF((voidpf opaque, voidpf stream));
+long    ZCALLBACK win32_seek64_file_func  OF((voidpf opaque, voidpf stream, ZPOS64_T offset, int origin));
+int     ZCALLBACK win32_close_file_func OF((voidpf opaque, voidpf stream));
+int     ZCALLBACK win32_error_file_func OF((voidpf opaque, voidpf stream));
+
+typedef struct
+{
+    HANDLE hf;
+    int error;
+} WIN32FILE_IOWIN;
+
+
+static void win32_translate_open_mode(int mode,
+                                      DWORD* lpdwDesiredAccess,
+                                      DWORD* lpdwCreationDisposition,
+                                      DWORD* lpdwShareMode,
+                                      DWORD* lpdwFlagsAndAttributes)
+{
+    *lpdwDesiredAccess = *lpdwShareMode = *lpdwFlagsAndAttributes = *lpdwCreationDisposition = 0;
+
+    if ((mode & ZLIB_FILEFUNC_MODE_READWRITEFILTER)==ZLIB_FILEFUNC_MODE_READ)
+    {
+        *lpdwDesiredAccess = GENERIC_READ;
+        *lpdwCreationDisposition = OPEN_EXISTING;
+        *lpdwShareMode = FILE_SHARE_READ;
+    }
+    else if (mode & ZLIB_FILEFUNC_MODE_EXISTING)
+    {
+        *lpdwDesiredAccess = GENERIC_WRITE | GENERIC_READ;
+        *lpdwCreationDisposition = OPEN_EXISTING;
+    }
+    else if (mode & ZLIB_FILEFUNC_MODE_CREATE)
+    {
+        *lpdwDesiredAccess = GENERIC_WRITE | GENERIC_READ;
+        *lpdwCreationDisposition = CREATE_ALWAYS;
+    }
+}
+
+static voidpf win32_build_iowin(HANDLE hFile)
+{
+    voidpf ret=NULL;
+
+    if ((hFile != NULL) && (hFile != INVALID_HANDLE_VALUE))
+    {
+        WIN32FILE_IOWIN w32fiow;
+        w32fiow.hf = hFile;
+        w32fiow.error = 0;
+        ret = malloc(sizeof(WIN32FILE_IOWIN));
+
+        if (ret==NULL)
+            CloseHandle(hFile);
+        else
+            *((WIN32FILE_IOWIN*)ret) = w32fiow;
+    }
+    return ret;
+}
+
+voidpf ZCALLBACK win32_open64_file_func (voidpf opaque,const void* filename,int mode)
+{
+    const char* mode_fopen = NULL;
+    DWORD dwDesiredAccess,dwCreationDisposition,dwShareMode,dwFlagsAndAttributes ;
+    HANDLE hFile = NULL;
+
+    win32_translate_open_mode(mode,&dwDesiredAccess,&dwCreationDisposition,&dwShareMode,&dwFlagsAndAttributes);
+
+#ifdef IOWIN32_USING_WINRT_API
+#ifdef UNICODE
+    if ((filename!=NULL) && (dwDesiredAccess != 0))
+        hFile = CreateFile2((LPCTSTR)filename, dwDesiredAccess, dwShareMode, dwCreationDisposition, NULL);
+#else
+    if ((filename!=NULL) && (dwDesiredAccess != 0))
+    {
+        WCHAR filenameW[FILENAME_MAX + 0x200 + 1];
+        MultiByteToWideChar(CP_ACP,0,(const char*)filename,-1,filenameW,FILENAME_MAX + 0x200);
+        hFile = CreateFile2(filenameW, dwDesiredAccess, dwShareMode, dwCreationDisposition, NULL);
+    }
+#endif
+#else
+    if ((filename!=NULL) && (dwDesiredAccess != 0))
+        hFile = CreateFile((LPCTSTR)filename, dwDesiredAccess, dwShareMode, NULL, dwCreationDisposition, dwFlagsAndAttributes, NULL);
+#endif
+
+    return win32_build_iowin(hFile);
+}
+
+
+voidpf ZCALLBACK win32_open64_file_funcA (voidpf opaque,const void* filename,int mode)
+{
+    const char* mode_fopen = NULL;
+    DWORD dwDesiredAccess,dwCreationDisposition,dwShareMode,dwFlagsAndAttributes ;
+    HANDLE hFile = NULL;
+
+    win32_translate_open_mode(mode,&dwDesiredAccess,&dwCreationDisposition,&dwShareMode,&dwFlagsAndAttributes);
+
+#ifdef IOWIN32_USING_WINRT_API
+    if ((filename!=NULL) && (dwDesiredAccess != 0))
+    {
+        WCHAR filenameW[FILENAME_MAX + 0x200 + 1];
+        MultiByteToWideChar(CP_ACP,0,(const char*)filename,-1,filenameW,FILENAME_MAX + 0x200);
+        hFile = CreateFile2(filenameW, dwDesiredAccess, dwShareMode, dwCreationDisposition, NULL);
+    }
+#else
+    if ((filename!=NULL) && (dwDesiredAccess != 0))
+        hFile = CreateFileA((LPCSTR)filename, dwDesiredAccess, dwShareMode, NULL, dwCreationDisposition, dwFlagsAndAttributes, NULL);
+#endif
+
+    return win32_build_iowin(hFile);
+}
+
+
+voidpf ZCALLBACK win32_open64_file_funcW (voidpf opaque,const void* filename,int mode)
+{
+    const char* mode_fopen = NULL;
+    DWORD dwDesiredAccess,dwCreationDisposition,dwShareMode,dwFlagsAndAttributes ;
+    HANDLE hFile = NULL;
+
+    win32_translate_open_mode(mode,&dwDesiredAccess,&dwCreationDisposition,&dwShareMode,&dwFlagsAndAttributes);
+
+#ifdef IOWIN32_USING_WINRT_API
+    if ((filename!=NULL) && (dwDesiredAccess != 0))
+        hFile = CreateFile2((LPCWSTR)filename, dwDesiredAccess, dwShareMode, dwCreationDisposition,NULL);
+#else
+    if ((filename!=NULL) && (dwDesiredAccess != 0))
+        hFile = CreateFileW((LPCWSTR)filename, dwDesiredAccess, dwShareMode, NULL, dwCreationDisposition, dwFlagsAndAttributes, NULL);
+#endif
+
+    return win32_build_iowin(hFile);
+}
+
+
+voidpf ZCALLBACK win32_open_file_func (voidpf opaque,const char* filename,int mode)
+{
+    const char* mode_fopen = NULL;
+    DWORD dwDesiredAccess,dwCreationDisposition,dwShareMode,dwFlagsAndAttributes ;
+    HANDLE hFile = NULL;
+
+    win32_translate_open_mode(mode,&dwDesiredAccess,&dwCreationDisposition,&dwShareMode,&dwFlagsAndAttributes);
+
+#ifdef IOWIN32_USING_WINRT_API
+#ifdef UNICODE
+    if ((filename!=NULL) && (dwDesiredAccess != 0))
+        hFile = CreateFile2((LPCTSTR)filename, dwDesiredAccess, dwShareMode, dwCreationDisposition, NULL);
+#else
+    if ((filename!=NULL) && (dwDesiredAccess != 0))
+    {
+        WCHAR filenameW[FILENAME_MAX + 0x200 + 1];
+        MultiByteToWideChar(CP_ACP,0,(const char*)filename,-1,filenameW,FILENAME_MAX + 0x200);
+        hFile = CreateFile2(filenameW, dwDesiredAccess, dwShareMode, dwCreationDisposition, NULL);
+    }
+#endif
+#else
+    if ((filename!=NULL) && (dwDesiredAccess != 0))
+        hFile = CreateFile((LPCTSTR)filename, dwDesiredAccess, dwShareMode, NULL, dwCreationDisposition, dwFlagsAndAttributes, NULL);
+#endif
+
+    return win32_build_iowin(hFile);
+}
+
+
+uLong ZCALLBACK win32_read_file_func (voidpf opaque, voidpf stream, void* buf,uLong size)
+{
+    uLong ret=0;
+    HANDLE hFile = NULL;
+    if (stream!=NULL)
+        hFile = ((WIN32FILE_IOWIN*)stream) -> hf;
+
+    if (hFile != NULL)
+    {
+        if (!ReadFile(hFile, buf, size, &ret, NULL))
+        {
+            DWORD dwErr = GetLastError();
+            if (dwErr == ERROR_HANDLE_EOF)
+                dwErr = 0;
+            ((WIN32FILE_IOWIN*)stream) -> error=(int)dwErr;
+        }
+    }
+
+    return ret;
+}
+
+
+uLong ZCALLBACK win32_write_file_func (voidpf opaque,voidpf stream,const void* buf,uLong size)
+{
+    uLong ret=0;
+    HANDLE hFile = NULL;
+    if (stream!=NULL)
+        hFile = ((WIN32FILE_IOWIN*)stream) -> hf;
+
+    if (hFile != NULL)
+    {
+        if (!WriteFile(hFile, buf, size, &ret, NULL))
+        {
+            DWORD dwErr = GetLastError();
+            if (dwErr == ERROR_HANDLE_EOF)
+                dwErr = 0;
+            ((WIN32FILE_IOWIN*)stream) -> error=(int)dwErr;
+        }
+    }
+
+    return ret;
+}
+
+static BOOL MySetFilePointerEx(HANDLE hFile, LARGE_INTEGER pos, LARGE_INTEGER *newPos,  DWORD dwMoveMethod)
+{
+#ifdef IOWIN32_USING_WINRT_API
+    return SetFilePointerEx(hFile, pos, newPos, dwMoveMethod);
+#else
+    LONG lHigh = pos.HighPart;
+    DWORD dwNewPos = SetFilePointer(hFile, pos.LowPart, &lHigh, dwMoveMethod);
+    BOOL fOk = TRUE;
+    if (dwNewPos == 0xFFFFFFFF)
+        if (GetLastError() != NO_ERROR)
+            fOk = FALSE;
+    if ((newPos != NULL) && (fOk))
+    {
+        newPos->LowPart = dwNewPos;
+        newPos->HighPart = lHigh;
+    }
+    return fOk;
+#endif
+}
+
+long ZCALLBACK win32_tell_file_func (voidpf opaque,voidpf stream)
+{
+    long ret=-1;
+    HANDLE hFile = NULL;
+    if (stream!=NULL)
+        hFile = ((WIN32FILE_IOWIN*)stream) -> hf;
+    if (hFile != NULL)
+    {
+        LARGE_INTEGER pos;
+        pos.QuadPart = 0;
+
+        if (!MySetFilePointerEx(hFile, pos, &pos, FILE_CURRENT))
+        {
+            DWORD dwErr = GetLastError();
+            ((WIN32FILE_IOWIN*)stream) -> error=(int)dwErr;
+            ret = -1;
+        }
+        else
+            ret=(long)pos.LowPart;
+    }
+    return ret;
+}
+
+ZPOS64_T ZCALLBACK win32_tell64_file_func (voidpf opaque, voidpf stream)
+{
+    ZPOS64_T ret= (ZPOS64_T)-1;
+    HANDLE hFile = NULL;
+    if (stream!=NULL)
+        hFile = ((WIN32FILE_IOWIN*)stream)->hf;
+
+    if (hFile)
+    {
+        LARGE_INTEGER pos;
+        pos.QuadPart = 0;
+
+        if (!MySetFilePointerEx(hFile, pos, &pos, FILE_CURRENT))
+        {
+            DWORD dwErr = GetLastError();
+            ((WIN32FILE_IOWIN*)stream) -> error=(int)dwErr;
+            ret = (ZPOS64_T)-1;
+        }
+        else
+            ret=pos.QuadPart;
+    }
+    return ret;
+}
+
+
+long ZCALLBACK win32_seek_file_func (voidpf opaque,voidpf stream,uLong offset,int origin)
+{
+    DWORD dwMoveMethod=0xFFFFFFFF;
+    HANDLE hFile = NULL;
+
+    long ret=-1;
+    if (stream!=NULL)
+        hFile = ((WIN32FILE_IOWIN*)stream) -> hf;
+    switch (origin)
+    {
+    case ZLIB_FILEFUNC_SEEK_CUR :
+        dwMoveMethod = FILE_CURRENT;
+        break;
+    case ZLIB_FILEFUNC_SEEK_END :
+        dwMoveMethod = FILE_END;
+        break;
+    case ZLIB_FILEFUNC_SEEK_SET :
+        dwMoveMethod = FILE_BEGIN;
+        break;
+    default: return -1;
+    }
+
+    if (hFile != NULL)
+    {
+        LARGE_INTEGER pos;
+        pos.QuadPart = offset;
+        if (!MySetFilePointerEx(hFile, pos, NULL, dwMoveMethod))
+        {
+            DWORD dwErr = GetLastError();
+            ((WIN32FILE_IOWIN*)stream) -> error=(int)dwErr;
+            ret = -1;
+        }
+        else
+            ret=0;
+    }
+    return ret;
+}
+
+long ZCALLBACK win32_seek64_file_func (voidpf opaque, voidpf stream,ZPOS64_T offset,int origin)
+{
+    DWORD dwMoveMethod=0xFFFFFFFF;
+    HANDLE hFile = NULL;
+    long ret=-1;
+
+    if (stream!=NULL)
+        hFile = ((WIN32FILE_IOWIN*)stream)->hf;
+
+    switch (origin)
+    {
+        case ZLIB_FILEFUNC_SEEK_CUR :
+            dwMoveMethod = FILE_CURRENT;
+            break;
+        case ZLIB_FILEFUNC_SEEK_END :
+            dwMoveMethod = FILE_END;
+            break;
+        case ZLIB_FILEFUNC_SEEK_SET :
+            dwMoveMethod = FILE_BEGIN;
+            break;
+        default: return -1;
+    }
+
+    if (hFile)
+    {
+        LARGE_INTEGER pos;
+        pos.QuadPart = offset;
+        if (!MySetFilePointerEx(hFile, pos, NULL, dwMoveMethod))
+        {
+            DWORD dwErr = GetLastError();
+            ((WIN32FILE_IOWIN*)stream) -> error=(int)dwErr;
+            ret = -1;
+        }
+        else
+            ret=0;
+    }
+    return ret;
+}
+
+int ZCALLBACK win32_close_file_func (voidpf opaque, voidpf stream)
+{
+    int ret=-1;
+
+    if (stream!=NULL)
+    {
+        HANDLE hFile;
+        hFile = ((WIN32FILE_IOWIN*)stream) -> hf;
+        if (hFile != NULL)
+        {
+            CloseHandle(hFile);
+            ret=0;
+        }
+        free(stream);
+    }
+    return ret;
+}
+
+int ZCALLBACK win32_error_file_func (voidpf opaque,voidpf stream)
+{
+    int ret=-1;
+    if (stream!=NULL)
+    {
+        ret = ((WIN32FILE_IOWIN*)stream) -> error;
+    }
+    return ret;
+}
+
+void fill_win32_filefunc (zlib_filefunc_def* pzlib_filefunc_def)
+{
+    pzlib_filefunc_def->zopen_file = win32_open_file_func;
+    pzlib_filefunc_def->zread_file = win32_read_file_func;
+    pzlib_filefunc_def->zwrite_file = win32_write_file_func;
+    pzlib_filefunc_def->ztell_file = win32_tell_file_func;
+    pzlib_filefunc_def->zseek_file = win32_seek_file_func;
+    pzlib_filefunc_def->zclose_file = win32_close_file_func;
+    pzlib_filefunc_def->zerror_file = win32_error_file_func;
+    pzlib_filefunc_def->opaque = NULL;
+}
+
+void fill_win32_filefunc64(zlib_filefunc64_def* pzlib_filefunc_def)
+{
+    pzlib_filefunc_def->zopen64_file = win32_open64_file_func;
+    pzlib_filefunc_def->zread_file = win32_read_file_func;
+    pzlib_filefunc_def->zwrite_file = win32_write_file_func;
+    pzlib_filefunc_def->ztell64_file = win32_tell64_file_func;
+    pzlib_filefunc_def->zseek64_file = win32_seek64_file_func;
+    pzlib_filefunc_def->zclose_file = win32_close_file_func;
+    pzlib_filefunc_def->zerror_file = win32_error_file_func;
+    pzlib_filefunc_def->opaque = NULL;
+}
+
+
+void fill_win32_filefunc64A(zlib_filefunc64_def* pzlib_filefunc_def)
+{
+    pzlib_filefunc_def->zopen64_file = win32_open64_file_funcA;
+    pzlib_filefunc_def->zread_file = win32_read_file_func;
+    pzlib_filefunc_def->zwrite_file = win32_write_file_func;
+    pzlib_filefunc_def->ztell64_file = win32_tell64_file_func;
+    pzlib_filefunc_def->zseek64_file = win32_seek64_file_func;
+    pzlib_filefunc_def->zclose_file = win32_close_file_func;
+    pzlib_filefunc_def->zerror_file = win32_error_file_func;
+    pzlib_filefunc_def->opaque = NULL;
+}
+
+
+void fill_win32_filefunc64W(zlib_filefunc64_def* pzlib_filefunc_def)
+{
+    pzlib_filefunc_def->zopen64_file = win32_open64_file_funcW;
+    pzlib_filefunc_def->zread_file = win32_read_file_func;
+    pzlib_filefunc_def->zwrite_file = win32_write_file_func;
+    pzlib_filefunc_def->ztell64_file = win32_tell64_file_func;
+    pzlib_filefunc_def->zseek64_file = win32_seek64_file_func;
+    pzlib_filefunc_def->zclose_file = win32_close_file_func;
+    pzlib_filefunc_def->zerror_file = win32_error_file_func;
+    pzlib_filefunc_def->opaque = NULL;
+}
diff --git a/deps/v8/third_party/zlib/contrib/minizip/iowin32.h b/deps/v8/third_party/zlib/contrib/minizip/iowin32.h
new file mode 100644
index 00000000000000..0ca0969a7d09a4
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/iowin32.h
@@ -0,0 +1,28 @@
+/* iowin32.h -- IO base function header for compress/uncompress .zip
+     Version 1.1, February 14h, 2010
+     part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Modifications for Zip64 support
+         Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com )
+
+         For more info read MiniZip_info.txt
+
+*/
+
+#include <windows.h>
+
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void fill_win32_filefunc OF((zlib_filefunc_def* pzlib_filefunc_def));
+void fill_win32_filefunc64 OF((zlib_filefunc64_def* pzlib_filefunc_def));
+void fill_win32_filefunc64A OF((zlib_filefunc64_def* pzlib_filefunc_def));
+void fill_win32_filefunc64W OF((zlib_filefunc64_def* pzlib_filefunc_def));
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/deps/v8/third_party/zlib/contrib/minizip/miniunz.c b/deps/v8/third_party/zlib/contrib/minizip/miniunz.c
new file mode 100644
index 00000000000000..3d65401be5cdd7
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/miniunz.c
@@ -0,0 +1,660 @@
+/*
+   miniunz.c
+   Version 1.1, February 14h, 2010
+   sample part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Modifications of Unzip for Zip64
+         Copyright (C) 2007-2008 Even Rouault
+
+         Modifications for Zip64 support on both zip and unzip
+         Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com )
+*/
+
+#if (!defined(_WIN32)) && (!defined(WIN32)) && (!defined(__APPLE__))
+        #ifndef __USE_FILE_OFFSET64
+                #define __USE_FILE_OFFSET64
+        #endif
+        #ifndef __USE_LARGEFILE64
+                #define __USE_LARGEFILE64
+        #endif
+        #ifndef _LARGEFILE64_SOURCE
+                #define _LARGEFILE64_SOURCE
+        #endif
+        #ifndef _FILE_OFFSET_BIT
+                #define _FILE_OFFSET_BIT 64
+        #endif
+#endif
+
+#ifdef __APPLE__
+// In darwin and perhaps other BSD variants off_t is a 64 bit value, hence no need for specific 64 bit functions
+#define FOPEN_FUNC(filename, mode) fopen(filename, mode)
+#define FTELLO_FUNC(stream) ftello(stream)
+#define FSEEKO_FUNC(stream, offset, origin) fseeko(stream, offset, origin)
+#else
+#define FOPEN_FUNC(filename, mode) fopen64(filename, mode)
+#define FTELLO_FUNC(stream) ftello64(stream)
+#define FSEEKO_FUNC(stream, offset, origin) fseeko64(stream, offset, origin)
+#endif
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <errno.h>
+#include <fcntl.h>
+
+#ifdef _WIN32
+# include <direct.h>
+# include <io.h>
+#else
+# include <unistd.h>
+# include <utime.h>
+#endif
+
+
+#include "unzip.h"
+
+#define CASESENSITIVITY (0)
+#define WRITEBUFFERSIZE (8192)
+#define MAXFILENAME (256)
+
+#ifdef _WIN32
+#define USEWIN32IOAPI
+#include "iowin32.h"
+#endif
+/*
+  mini unzip, demo of unzip package
+
+  usage :
+  Usage : miniunz [-exvlo] file.zip [file_to_extract] [-d extractdir]
+
+  list the file in the zipfile, and print the content of FILE_ID.ZIP or README.TXT
+    if it exists
+*/
+
+
+/* change_file_date : change the date/time of a file
+    filename : the filename of the file where date/time must be modified
+    dosdate : the new date at the MSDos format (4 bytes)
+    tmu_date : the SAME new date at the tm_unz format */
+void change_file_date(filename,dosdate,tmu_date)
+    const char *filename;
+    uLong dosdate;
+    tm_unz tmu_date;
+{
+#ifdef _WIN32
+  HANDLE hFile;
+  FILETIME ftm,ftLocal,ftCreate,ftLastAcc,ftLastWrite;
+
+  hFile = CreateFileA(filename,GENERIC_READ | GENERIC_WRITE,
+                      0,NULL,OPEN_EXISTING,0,NULL);
+  GetFileTime(hFile,&ftCreate,&ftLastAcc,&ftLastWrite);
+  DosDateTimeToFileTime((WORD)(dosdate>>16),(WORD)dosdate,&ftLocal);
+  LocalFileTimeToFileTime(&ftLocal,&ftm);
+  SetFileTime(hFile,&ftm,&ftLastAcc,&ftm);
+  CloseHandle(hFile);
+#else
+#ifdef unix || __APPLE__
+  struct utimbuf ut;
+  struct tm newdate;
+  newdate.tm_sec = tmu_date.tm_sec;
+  newdate.tm_min=tmu_date.tm_min;
+  newdate.tm_hour=tmu_date.tm_hour;
+  newdate.tm_mday=tmu_date.tm_mday;
+  newdate.tm_mon=tmu_date.tm_mon;
+  if (tmu_date.tm_year > 1900)
+      newdate.tm_year=tmu_date.tm_year - 1900;
+  else
+      newdate.tm_year=tmu_date.tm_year ;
+  newdate.tm_isdst=-1;
+
+  ut.actime=ut.modtime=mktime(&newdate);
+  utime(filename,&ut);
+#endif
+#endif
+}
+
+
+/* mymkdir and change_file_date are not 100 % portable
+   As I don't know well Unix, I wait feedback for the unix portion */
+
+int mymkdir(dirname)
+    const char* dirname;
+{
+    int ret=0;
+#ifdef _WIN32
+    ret = _mkdir(dirname);
+#elif unix
+    ret = mkdir (dirname,0775);
+#elif __APPLE__
+    ret = mkdir (dirname,0775);
+#endif
+    return ret;
+}
+
+int makedir (newdir)
+    char *newdir;
+{
+  char *buffer ;
+  char *p;
+  int  len = (int)strlen(newdir);
+
+  if (len <= 0)
+    return 0;
+
+  buffer = (char*)malloc(len+1);
+        if (buffer==NULL)
+        {
+                printf("Error allocating memory\n");
+                return UNZ_INTERNALERROR;
+        }
+  strcpy(buffer,newdir);
+
+  if (buffer[len-1] == '/') {
+    buffer[len-1] = '\0';
+  }
+  if (mymkdir(buffer) == 0)
+    {
+      free(buffer);
+      return 1;
+    }
+
+  p = buffer+1;
+  while (1)
+    {
+      char hold;
+
+      while(*p && *p != '\\' && *p != '/')
+        p++;
+      hold = *p;
+      *p = 0;
+      if ((mymkdir(buffer) == -1) && (errno == ENOENT))
+        {
+          printf("couldn't create directory %s\n",buffer);
+          free(buffer);
+          return 0;
+        }
+      if (hold == 0)
+        break;
+      *p++ = hold;
+    }
+  free(buffer);
+  return 1;
+}
+
+void do_banner()
+{
+    printf("MiniUnz 1.01b, demo of zLib + Unz package written by Gilles Vollant\n");
+    printf("more info at http://www.winimage.com/zLibDll/unzip.html\n\n");
+}
+
+void do_help()
+{
+    printf("Usage : miniunz [-e] [-x] [-v] [-l] [-o] [-p password] file.zip [file_to_extr.] [-d extractdir]\n\n" \
+           "  -e  Extract without pathname (junk paths)\n" \
+           "  -x  Extract with pathname\n" \
+           "  -v  list files\n" \
+           "  -l  list files\n" \
+           "  -d  directory to extract into\n" \
+           "  -o  overwrite files without prompting\n" \
+           "  -p  extract crypted file using password\n\n");
+}
+
+void Display64BitsSize(ZPOS64_T n, int size_char)
+{
+  /* to avoid compatibility problem , we do here the conversion */
+  char number[21];
+  int offset=19;
+  int pos_string = 19;
+  number[20]=0;
+  for (;;) {
+      number[offset]=(char)((n%10)+'0');
+      if (number[offset] != '0')
+          pos_string=offset;
+      n/=10;
+      if (offset==0)
+          break;
+      offset--;
+  }
+  {
+      int size_display_string = 19-pos_string;
+      while (size_char > size_display_string)
+      {
+          size_char--;
+          printf(" ");
+      }
+  }
+
+  printf("%s",&number[pos_string]);
+}
+
+int do_list(uf)
+    unzFile uf;
+{
+    uLong i;
+    unz_global_info64 gi;
+    int err;
+
+    err = unzGetGlobalInfo64(uf,&gi);
+    if (err!=UNZ_OK)
+        printf("error %d with zipfile in unzGetGlobalInfo \n",err);
+    printf("  Length  Method     Size Ratio   Date    Time   CRC-32     Name\n");
+    printf("  ------  ------     ---- -----   ----    ----   ------     ----\n");
+    for (i=0;i<gi.number_entry;i++)
+    {
+        char filename_inzip[256];
+        unz_file_info64 file_info;
+        uLong ratio=0;
+        const char *string_method;
+        char charCrypt=' ';
+        err = unzGetCurrentFileInfo64(uf,&file_info,filename_inzip,sizeof(filename_inzip),NULL,0,NULL,0);
+        if (err!=UNZ_OK)
+        {
+            printf("error %d with zipfile in unzGetCurrentFileInfo\n",err);
+            break;
+        }
+        if (file_info.uncompressed_size>0)
+            ratio = (uLong)((file_info.compressed_size*100)/file_info.uncompressed_size);
+
+        /* display a '*' if the file is crypted */
+        if ((file_info.flag & 1) != 0)
+            charCrypt='*';
+
+        if (file_info.compression_method==0)
+            string_method="Stored";
+        else
+        if (file_info.compression_method==Z_DEFLATED)
+        {
+            uInt iLevel=(uInt)((file_info.flag & 0x6)/2);
+            if (iLevel==0)
+              string_method="Defl:N";
+            else if (iLevel==1)
+              string_method="Defl:X";
+            else if ((iLevel==2) || (iLevel==3))
+              string_method="Defl:F"; /* 2:fast , 3 : extra fast*/
+        }
+        else
+        if (file_info.compression_method==Z_BZIP2ED)
+        {
+              string_method="BZip2 ";
+        }
+        else
+            string_method="Unkn. ";
+
+        Display64BitsSize(file_info.uncompressed_size,7);
+        printf("  %6s%c",string_method,charCrypt);
+        Display64BitsSize(file_info.compressed_size,7);
+        printf(" %3lu%%  %2.2lu-%2.2lu-%2.2lu  %2.2lu:%2.2lu  %8.8lx   %s\n",
+                ratio,
+                (uLong)file_info.tmu_date.tm_mon + 1,
+                (uLong)file_info.tmu_date.tm_mday,
+                (uLong)file_info.tmu_date.tm_year % 100,
+                (uLong)file_info.tmu_date.tm_hour,(uLong)file_info.tmu_date.tm_min,
+                (uLong)file_info.crc,filename_inzip);
+        if ((i+1)<gi.number_entry)
+        {
+            err = unzGoToNextFile(uf);
+            if (err!=UNZ_OK)
+            {
+                printf("error %d with zipfile in unzGoToNextFile\n",err);
+                break;
+            }
+        }
+    }
+
+    return 0;
+}
+
+
+int do_extract_currentfile(uf,popt_extract_without_path,popt_overwrite,password)
+    unzFile uf;
+    const int* popt_extract_without_path;
+    int* popt_overwrite;
+    const char* password;
+{
+    char filename_inzip[256];
+    char* filename_withoutpath;
+    char* p;
+    int err=UNZ_OK;
+    FILE *fout=NULL;
+    void* buf;
+    uInt size_buf;
+
+    unz_file_info64 file_info;
+    uLong ratio=0;
+    err = unzGetCurrentFileInfo64(uf,&file_info,filename_inzip,sizeof(filename_inzip),NULL,0,NULL,0);
+
+    if (err!=UNZ_OK)
+    {
+        printf("error %d with zipfile in unzGetCurrentFileInfo\n",err);
+        return err;
+    }
+
+    size_buf = WRITEBUFFERSIZE;
+    buf = (void*)malloc(size_buf);
+    if (buf==NULL)
+    {
+        printf("Error allocating memory\n");
+        return UNZ_INTERNALERROR;
+    }
+
+    p = filename_withoutpath = filename_inzip;
+    while ((*p) != '\0')
+    {
+        if (((*p)=='/') || ((*p)=='\\'))
+            filename_withoutpath = p+1;
+        p++;
+    }
+
+    if ((*filename_withoutpath)=='\0')
+    {
+        if ((*popt_extract_without_path)==0)
+        {
+            printf("creating directory: %s\n",filename_inzip);
+            mymkdir(filename_inzip);
+        }
+    }
+    else
+    {
+        const char* write_filename;
+        int skip=0;
+
+        if ((*popt_extract_without_path)==0)
+            write_filename = filename_inzip;
+        else
+            write_filename = filename_withoutpath;
+
+        err = unzOpenCurrentFilePassword(uf,password);
+        if (err!=UNZ_OK)
+        {
+            printf("error %d with zipfile in unzOpenCurrentFilePassword\n",err);
+        }
+
+        if (((*popt_overwrite)==0) && (err==UNZ_OK))
+        {
+            char rep=0;
+            FILE* ftestexist;
+            ftestexist = FOPEN_FUNC(write_filename,"rb");
+            if (ftestexist!=NULL)
+            {
+                fclose(ftestexist);
+                do
+                {
+                    char answer[128];
+                    int ret;
+
+                    printf("The file %s exists. Overwrite ? [y]es, [n]o, [A]ll: ",write_filename);
+                    ret = scanf("%1s",answer);
+                    if (ret != 1)
+                    {
+                       exit(EXIT_FAILURE);
+                    }
+                    rep = answer[0] ;
+                    if ((rep>='a') && (rep<='z'))
+                        rep -= 0x20;
+                }
+                while ((rep!='Y') && (rep!='N') && (rep!='A'));
+            }
+
+            if (rep == 'N')
+                skip = 1;
+
+            if (rep == 'A')
+                *popt_overwrite=1;
+        }
+
+        if ((skip==0) && (err==UNZ_OK))
+        {
+            fout=FOPEN_FUNC(write_filename,"wb");
+            /* some zipfile don't contain directory alone before file */
+            if ((fout==NULL) && ((*popt_extract_without_path)==0) &&
+                                (filename_withoutpath!=(char*)filename_inzip))
+            {
+                char c=*(filename_withoutpath-1);
+                *(filename_withoutpath-1)='\0';
+                makedir(write_filename);
+                *(filename_withoutpath-1)=c;
+                fout=FOPEN_FUNC(write_filename,"wb");
+            }
+
+            if (fout==NULL)
+            {
+                printf("error opening %s\n",write_filename);
+            }
+        }
+
+        if (fout!=NULL)
+        {
+            printf(" extracting: %s\n",write_filename);
+
+            do
+            {
+                err = unzReadCurrentFile(uf,buf,size_buf);
+                if (err<0)
+                {
+                    printf("error %d with zipfile in unzReadCurrentFile\n",err);
+                    break;
+                }
+                if (err>0)
+                    if (fwrite(buf,err,1,fout)!=1)
+                    {
+                        printf("error in writing extracted file\n");
+                        err=UNZ_ERRNO;
+                        break;
+                    }
+            }
+            while (err>0);
+            if (fout)
+                    fclose(fout);
+
+            if (err==0)
+                change_file_date(write_filename,file_info.dosDate,
+                                 file_info.tmu_date);
+        }
+
+        if (err==UNZ_OK)
+        {
+            err = unzCloseCurrentFile (uf);
+            if (err!=UNZ_OK)
+            {
+                printf("error %d with zipfile in unzCloseCurrentFile\n",err);
+            }
+        }
+        else
+            unzCloseCurrentFile(uf); /* don't lose the error */
+    }
+
+    free(buf);
+    return err;
+}
+
+
+int do_extract(uf,opt_extract_without_path,opt_overwrite,password)
+    unzFile uf;
+    int opt_extract_without_path;
+    int opt_overwrite;
+    const char* password;
+{
+    uLong i;
+    unz_global_info64 gi;
+    int err;
+    FILE* fout=NULL;
+
+    err = unzGetGlobalInfo64(uf,&gi);
+    if (err!=UNZ_OK)
+        printf("error %d with zipfile in unzGetGlobalInfo \n",err);
+
+    for (i=0;i<gi.number_entry;i++)
+    {
+        if (do_extract_currentfile(uf,&opt_extract_without_path,
+                                      &opt_overwrite,
+                                      password) != UNZ_OK)
+            break;
+
+        if ((i+1)<gi.number_entry)
+        {
+            err = unzGoToNextFile(uf);
+            if (err!=UNZ_OK)
+            {
+                printf("error %d with zipfile in unzGoToNextFile\n",err);
+                break;
+            }
+        }
+    }
+
+    return 0;
+}
+
+int do_extract_onefile(uf,filename,opt_extract_without_path,opt_overwrite,password)
+    unzFile uf;
+    const char* filename;
+    int opt_extract_without_path;
+    int opt_overwrite;
+    const char* password;
+{
+    int err = UNZ_OK;
+    if (unzLocateFile(uf,filename,CASESENSITIVITY)!=UNZ_OK)
+    {
+        printf("file %s not found in the zipfile\n",filename);
+        return 2;
+    }
+
+    if (do_extract_currentfile(uf,&opt_extract_without_path,
+                                      &opt_overwrite,
+                                      password) == UNZ_OK)
+        return 0;
+    else
+        return 1;
+}
+
+
+int main(argc,argv)
+    int argc;
+    char *argv[];
+{
+    const char *zipfilename=NULL;
+    const char *filename_to_extract=NULL;
+    const char *password=NULL;
+    char filename_try[MAXFILENAME+16] = "";
+    int i;
+    int ret_value=0;
+    int opt_do_list=0;
+    int opt_do_extract=1;
+    int opt_do_extract_withoutpath=0;
+    int opt_overwrite=0;
+    int opt_extractdir=0;
+    const char *dirname=NULL;
+    unzFile uf=NULL;
+
+    do_banner();
+    if (argc==1)
+    {
+        do_help();
+        return 0;
+    }
+    else
+    {
+        for (i=1;i<argc;i++)
+        {
+            if ((*argv[i])=='-')
+            {
+                const char *p=argv[i]+1;
+
+                while ((*p)!='\0')
+                {
+                    char c=*(p++);;
+                    if ((c=='l') || (c=='L'))
+                        opt_do_list = 1;
+                    if ((c=='v') || (c=='V'))
+                        opt_do_list = 1;
+                    if ((c=='x') || (c=='X'))
+                        opt_do_extract = 1;
+                    if ((c=='e') || (c=='E'))
+                        opt_do_extract = opt_do_extract_withoutpath = 1;
+                    if ((c=='o') || (c=='O'))
+                        opt_overwrite=1;
+                    if ((c=='d') || (c=='D'))
+                    {
+                        opt_extractdir=1;
+                        dirname=argv[i+1];
+                    }
+
+                    if (((c=='p') || (c=='P')) && (i+1<argc))
+                    {
+                        password=argv[i+1];
+                        i++;
+                    }
+                }
+            }
+            else
+            {
+                if (zipfilename == NULL)
+                    zipfilename = argv[i];
+                else if ((filename_to_extract==NULL) && (!opt_extractdir))
+                        filename_to_extract = argv[i] ;
+            }
+        }
+    }
+
+    if (zipfilename!=NULL)
+    {
+
+#        ifdef USEWIN32IOAPI
+        zlib_filefunc64_def ffunc;
+#        endif
+
+        strncpy(filename_try, zipfilename,MAXFILENAME-1);
+        /* strncpy doesnt append the trailing NULL, of the string is too long. */
+        filename_try[ MAXFILENAME ] = '\0';
+
+#        ifdef USEWIN32IOAPI
+        fill_win32_filefunc64A(&ffunc);
+        uf = unzOpen2_64(zipfilename,&ffunc);
+#        else
+        uf = unzOpen64(zipfilename);
+#        endif
+        if (uf==NULL)
+        {
+            strcat(filename_try,".zip");
+#            ifdef USEWIN32IOAPI
+            uf = unzOpen2_64(filename_try,&ffunc);
+#            else
+            uf = unzOpen64(filename_try);
+#            endif
+        }
+    }
+
+    if (uf==NULL)
+    {
+        printf("Cannot open %s or %s.zip\n",zipfilename,zipfilename);
+        return 1;
+    }
+    printf("%s opened\n",filename_try);
+
+    if (opt_do_list==1)
+        ret_value = do_list(uf);
+    else if (opt_do_extract==1)
+    {
+#ifdef _WIN32
+        if (opt_extractdir && _chdir(dirname))
+#else
+        if (opt_extractdir && chdir(dirname))
+#endif
+        {
+          printf("Error changing into %s, aborting\n", dirname);
+          exit(-1);
+        }
+
+        if (filename_to_extract == NULL)
+            ret_value = do_extract(uf, opt_do_extract_withoutpath, opt_overwrite, password);
+        else
+            ret_value = do_extract_onefile(uf, filename_to_extract, opt_do_extract_withoutpath, opt_overwrite, password);
+    }
+
+    unzClose(uf);
+
+    return ret_value;
+}
diff --git a/deps/v8/third_party/zlib/contrib/minizip/minizip.c b/deps/v8/third_party/zlib/contrib/minizip/minizip.c
new file mode 100644
index 00000000000000..4288962ecef056
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/minizip.c
@@ -0,0 +1,520 @@
+/*
+   minizip.c
+   Version 1.1, February 14h, 2010
+   sample part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Modifications of Unzip for Zip64
+         Copyright (C) 2007-2008 Even Rouault
+
+         Modifications for Zip64 support on both zip and unzip
+         Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com )
+*/
+
+
+#if (!defined(_WIN32)) && (!defined(WIN32)) && (!defined(__APPLE__))
+        #ifndef __USE_FILE_OFFSET64
+                #define __USE_FILE_OFFSET64
+        #endif
+        #ifndef __USE_LARGEFILE64
+                #define __USE_LARGEFILE64
+        #endif
+        #ifndef _LARGEFILE64_SOURCE
+                #define _LARGEFILE64_SOURCE
+        #endif
+        #ifndef _FILE_OFFSET_BIT
+                #define _FILE_OFFSET_BIT 64
+        #endif
+#endif
+
+#ifdef __APPLE__
+// In darwin and perhaps other BSD variants off_t is a 64 bit value, hence no need for specific 64 bit functions
+#define FOPEN_FUNC(filename, mode) fopen(filename, mode)
+#define FTELLO_FUNC(stream) ftello(stream)
+#define FSEEKO_FUNC(stream, offset, origin) fseeko(stream, offset, origin)
+#else
+#define FOPEN_FUNC(filename, mode) fopen64(filename, mode)
+#define FTELLO_FUNC(stream) ftello64(stream)
+#define FSEEKO_FUNC(stream, offset, origin) fseeko64(stream, offset, origin)
+#endif
+
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <errno.h>
+#include <fcntl.h>
+
+#ifdef _WIN32
+# include <direct.h>
+# include <io.h>
+#else
+# include <unistd.h>
+# include <utime.h>
+# include <sys/types.h>
+# include <sys/stat.h>
+#endif
+
+#include "zip.h"
+
+#ifdef _WIN32
+        #define USEWIN32IOAPI
+        #include "iowin32.h"
+#endif
+
+
+
+#define WRITEBUFFERSIZE (16384)
+#define MAXFILENAME (256)
+
+#ifdef _WIN32
+uLong filetime(f, tmzip, dt)
+    char *f;                /* name of file to get info on */
+    tm_zip *tmzip;             /* return value: access, modific. and creation times */
+    uLong *dt;             /* dostime */
+{
+  int ret = 0;
+  {
+      FILETIME ftLocal;
+      HANDLE hFind;
+      WIN32_FIND_DATAA ff32;
+
+      hFind = FindFirstFileA(f,&ff32);
+      if (hFind != INVALID_HANDLE_VALUE)
+      {
+        FileTimeToLocalFileTime(&(ff32.ftLastWriteTime),&ftLocal);
+        FileTimeToDosDateTime(&ftLocal,((LPWORD)dt)+1,((LPWORD)dt)+0);
+        FindClose(hFind);
+        ret = 1;
+      }
+  }
+  return ret;
+}
+#else
+#ifdef unix || __APPLE__
+uLong filetime(f, tmzip, dt)
+    char *f;               /* name of file to get info on */
+    tm_zip *tmzip;         /* return value: access, modific. and creation times */
+    uLong *dt;             /* dostime */
+{
+  int ret=0;
+  struct stat s;        /* results of stat() */
+  struct tm* filedate;
+  time_t tm_t=0;
+
+  if (strcmp(f,"-")!=0)
+  {
+    char name[MAXFILENAME+1];
+    int len = strlen(f);
+    if (len > MAXFILENAME)
+      len = MAXFILENAME;
+
+    strncpy(name, f,MAXFILENAME-1);
+    /* strncpy doesnt append the trailing NULL, of the string is too long. */
+    name[ MAXFILENAME ] = '\0';
+
+    if (name[len - 1] == '/')
+      name[len - 1] = '\0';
+    /* not all systems allow stat'ing a file with / appended */
+    if (stat(name,&s)==0)
+    {
+      tm_t = s.st_mtime;
+      ret = 1;
+    }
+  }
+  filedate = localtime(&tm_t);
+
+  tmzip->tm_sec  = filedate->tm_sec;
+  tmzip->tm_min  = filedate->tm_min;
+  tmzip->tm_hour = filedate->tm_hour;
+  tmzip->tm_mday = filedate->tm_mday;
+  tmzip->tm_mon  = filedate->tm_mon ;
+  tmzip->tm_year = filedate->tm_year;
+
+  return ret;
+}
+#else
+uLong filetime(f, tmzip, dt)
+    char *f;                /* name of file to get info on */
+    tm_zip *tmzip;             /* return value: access, modific. and creation times */
+    uLong *dt;             /* dostime */
+{
+    return 0;
+}
+#endif
+#endif
+
+
+
+
+int check_exist_file(filename)
+    const char* filename;
+{
+    FILE* ftestexist;
+    int ret = 1;
+    ftestexist = FOPEN_FUNC(filename,"rb");
+    if (ftestexist==NULL)
+        ret = 0;
+    else
+        fclose(ftestexist);
+    return ret;
+}
+
+void do_banner()
+{
+    printf("MiniZip 1.1, demo of zLib + MiniZip64 package, written by Gilles Vollant\n");
+    printf("more info on MiniZip at http://www.winimage.com/zLibDll/minizip.html\n\n");
+}
+
+void do_help()
+{
+    printf("Usage : minizip [-o] [-a] [-0 to -9] [-p password] [-j] file.zip [files_to_add]\n\n" \
+           "  -o  Overwrite existing file.zip\n" \
+           "  -a  Append to existing file.zip\n" \
+           "  -0  Store only\n" \
+           "  -1  Compress faster\n" \
+           "  -9  Compress better\n\n" \
+           "  -j  exclude path. store only the file name.\n\n");
+}
+
+/* calculate the CRC32 of a file,
+   because to encrypt a file, we need known the CRC32 of the file before */
+int getFileCrc(const char* filenameinzip,void*buf,unsigned long size_buf,unsigned long* result_crc)
+{
+   unsigned long calculate_crc=0;
+   int err=ZIP_OK;
+   FILE * fin = FOPEN_FUNC(filenameinzip,"rb");
+
+   unsigned long size_read = 0;
+   unsigned long total_read = 0;
+   if (fin==NULL)
+   {
+       err = ZIP_ERRNO;
+   }
+
+    if (err == ZIP_OK)
+        do
+        {
+            err = ZIP_OK;
+            size_read = (int)fread(buf,1,size_buf,fin);
+            if (size_read < size_buf)
+                if (feof(fin)==0)
+            {
+                printf("error in reading %s\n",filenameinzip);
+                err = ZIP_ERRNO;
+            }
+
+            if (size_read>0)
+                calculate_crc = crc32(calculate_crc,buf,size_read);
+            total_read += size_read;
+
+        } while ((err == ZIP_OK) && (size_read>0));
+
+    if (fin)
+        fclose(fin);
+
+    *result_crc=calculate_crc;
+    printf("file %s crc %lx\n", filenameinzip, calculate_crc);
+    return err;
+}
+
+int isLargeFile(const char* filename)
+{
+  int largeFile = 0;
+  ZPOS64_T pos = 0;
+  FILE* pFile = FOPEN_FUNC(filename, "rb");
+
+  if(pFile != NULL)
+  {
+    int n = FSEEKO_FUNC(pFile, 0, SEEK_END);
+    pos = FTELLO_FUNC(pFile);
+
+                printf("File : %s is %lld bytes\n", filename, pos);
+
+    if(pos >= 0xffffffff)
+     largeFile = 1;
+
+                fclose(pFile);
+  }
+
+ return largeFile;
+}
+
+int main(argc,argv)
+    int argc;
+    char *argv[];
+{
+    int i;
+    int opt_overwrite=0;
+    int opt_compress_level=Z_DEFAULT_COMPRESSION;
+    int opt_exclude_path=0;
+    int zipfilenamearg = 0;
+    char filename_try[MAXFILENAME+16];
+    int zipok;
+    int err=0;
+    int size_buf=0;
+    void* buf=NULL;
+    const char* password=NULL;
+
+
+    do_banner();
+    if (argc==1)
+    {
+        do_help();
+        return 0;
+    }
+    else
+    {
+        for (i=1;i<argc;i++)
+        {
+            if ((*argv[i])=='-')
+            {
+                const char *p=argv[i]+1;
+
+                while ((*p)!='\0')
+                {
+                    char c=*(p++);;
+                    if ((c=='o') || (c=='O'))
+                        opt_overwrite = 1;
+                    if ((c=='a') || (c=='A'))
+                        opt_overwrite = 2;
+                    if ((c>='0') && (c<='9'))
+                        opt_compress_level = c-'0';
+                    if ((c=='j') || (c=='J'))
+                        opt_exclude_path = 1;
+
+                    if (((c=='p') || (c=='P')) && (i+1<argc))
+                    {
+                        password=argv[i+1];
+                        i++;
+                    }
+                }
+            }
+            else
+            {
+                if (zipfilenamearg == 0)
+                {
+                    zipfilenamearg = i ;
+                }
+            }
+        }
+    }
+
+    size_buf = WRITEBUFFERSIZE;
+    buf = (void*)malloc(size_buf);
+    if (buf==NULL)
+    {
+        printf("Error allocating memory\n");
+        return ZIP_INTERNALERROR;
+    }
+
+    if (zipfilenamearg==0)
+    {
+        zipok=0;
+    }
+    else
+    {
+        int i,len;
+        int dot_found=0;
+
+        zipok = 1 ;
+        strncpy(filename_try, argv[zipfilenamearg],MAXFILENAME-1);
+        /* strncpy doesnt append the trailing NULL, of the string is too long. */
+        filename_try[ MAXFILENAME ] = '\0';
+
+        len=(int)strlen(filename_try);
+        for (i=0;i<len;i++)
+            if (filename_try[i]=='.')
+                dot_found=1;
+
+        if (dot_found==0)
+            strcat(filename_try,".zip");
+
+        if (opt_overwrite==2)
+        {
+            /* if the file don't exist, we not append file */
+            if (check_exist_file(filename_try)==0)
+                opt_overwrite=1;
+        }
+        else
+        if (opt_overwrite==0)
+            if (check_exist_file(filename_try)!=0)
+            {
+                char rep=0;
+                do
+                {
+                    char answer[128];
+                    int ret;
+                    printf("The file %s exists. Overwrite ? [y]es, [n]o, [a]ppend : ",filename_try);
+                    ret = scanf("%1s",answer);
+                    if (ret != 1)
+                    {
+                       exit(EXIT_FAILURE);
+                    }
+                    rep = answer[0] ;
+                    if ((rep>='a') && (rep<='z'))
+                        rep -= 0x20;
+                }
+                while ((rep!='Y') && (rep!='N') && (rep!='A'));
+                if (rep=='N')
+                    zipok = 0;
+                if (rep=='A')
+                    opt_overwrite = 2;
+            }
+    }
+
+    if (zipok==1)
+    {
+        zipFile zf;
+        int errclose;
+#        ifdef USEWIN32IOAPI
+        zlib_filefunc64_def ffunc;
+        fill_win32_filefunc64A(&ffunc);
+        zf = zipOpen2_64(filename_try,(opt_overwrite==2) ? 2 : 0,NULL,&ffunc);
+#        else
+        zf = zipOpen64(filename_try,(opt_overwrite==2) ? 2 : 0);
+#        endif
+
+        if (zf == NULL)
+        {
+            printf("error opening %s\n",filename_try);
+            err= ZIP_ERRNO;
+        }
+        else
+            printf("creating %s\n",filename_try);
+
+        for (i=zipfilenamearg+1;(i<argc) && (err==ZIP_OK);i++)
+        {
+            if (!((((*(argv[i]))=='-') || ((*(argv[i]))=='/')) &&
+                  ((argv[i][1]=='o') || (argv[i][1]=='O') ||
+                   (argv[i][1]=='a') || (argv[i][1]=='A') ||
+                   (argv[i][1]=='p') || (argv[i][1]=='P') ||
+                   ((argv[i][1]>='0') || (argv[i][1]<='9'))) &&
+                  (strlen(argv[i]) == 2)))
+            {
+                FILE * fin;
+                int size_read;
+                const char* filenameinzip = argv[i];
+                const char *savefilenameinzip;
+                zip_fileinfo zi;
+                unsigned long crcFile=0;
+                int zip64 = 0;
+
+                zi.tmz_date.tm_sec = zi.tmz_date.tm_min = zi.tmz_date.tm_hour =
+                zi.tmz_date.tm_mday = zi.tmz_date.tm_mon = zi.tmz_date.tm_year = 0;
+                zi.dosDate = 0;
+                zi.internal_fa = 0;
+                zi.external_fa = 0;
+                filetime(filenameinzip,&zi.tmz_date,&zi.dosDate);
+
+/*
+                err = zipOpenNewFileInZip(zf,filenameinzip,&zi,
+                                 NULL,0,NULL,0,NULL / * comment * /,
+                                 (opt_compress_level != 0) ? Z_DEFLATED : 0,
+                                 opt_compress_level);
+*/
+                if ((password != NULL) && (err==ZIP_OK))
+                    err = getFileCrc(filenameinzip,buf,size_buf,&crcFile);
+
+                zip64 = isLargeFile(filenameinzip);
+
+                                                         /* The path name saved, should not include a leading slash. */
+               /*if it did, windows/xp and dynazip couldn't read the zip file. */
+                 savefilenameinzip = filenameinzip;
+                 while( savefilenameinzip[0] == '\\' || savefilenameinzip[0] == '/' )
+                 {
+                     savefilenameinzip++;
+                 }
+
+                 /*should the zip file contain any path at all?*/
+                 if( opt_exclude_path )
+                 {
+                     const char *tmpptr;
+                     const char *lastslash = 0;
+                     for( tmpptr = savefilenameinzip; *tmpptr; tmpptr++)
+                     {
+                         if( *tmpptr == '\\' || *tmpptr == '/')
+                         {
+                             lastslash = tmpptr;
+                         }
+                     }
+                     if( lastslash != NULL )
+                     {
+                         savefilenameinzip = lastslash+1; // base filename follows last slash.
+                     }
+                 }
+
+                 /**/
+                err = zipOpenNewFileInZip3_64(zf,savefilenameinzip,&zi,
+                                 NULL,0,NULL,0,NULL /* comment*/,
+                                 (opt_compress_level != 0) ? Z_DEFLATED : 0,
+                                 opt_compress_level,0,
+                                 /* -MAX_WBITS, DEF_MEM_LEVEL, Z_DEFAULT_STRATEGY, */
+                                 -MAX_WBITS, DEF_MEM_LEVEL, Z_DEFAULT_STRATEGY,
+                                 password,crcFile, zip64);
+
+                if (err != ZIP_OK)
+                    printf("error in opening %s in zipfile\n",filenameinzip);
+                else
+                {
+                    fin = FOPEN_FUNC(filenameinzip,"rb");
+                    if (fin==NULL)
+                    {
+                        err=ZIP_ERRNO;
+                        printf("error in opening %s for reading\n",filenameinzip);
+                    }
+                }
+
+                if (err == ZIP_OK)
+                    do
+                    {
+                        err = ZIP_OK;
+                        size_read = (int)fread(buf,1,size_buf,fin);
+                        if (size_read < size_buf)
+                            if (feof(fin)==0)
+                        {
+                            printf("error in reading %s\n",filenameinzip);
+                            err = ZIP_ERRNO;
+                        }
+
+                        if (size_read>0)
+                        {
+                            err = zipWriteInFileInZip (zf,buf,size_read);
+                            if (err<0)
+                            {
+                                printf("error in writing %s in the zipfile\n",
+                                                 filenameinzip);
+                            }
+
+                        }
+                    } while ((err == ZIP_OK) && (size_read>0));
+
+                if (fin)
+                    fclose(fin);
+
+                if (err<0)
+                    err=ZIP_ERRNO;
+                else
+                {
+                    err = zipCloseFileInZip(zf);
+                    if (err!=ZIP_OK)
+                        printf("error in closing %s in the zipfile\n",
+                                    filenameinzip);
+                }
+            }
+        }
+        errclose = zipClose(zf,NULL);
+        if (errclose != ZIP_OK)
+            printf("error in closing %s\n",filename_try);
+    }
+    else
+    {
+       do_help();
+    }
+
+    free(buf);
+    return 0;
+}
diff --git a/deps/v8/third_party/zlib/contrib/minizip/mztools.c b/deps/v8/third_party/zlib/contrib/minizip/mztools.c
new file mode 100644
index 00000000000000..8bf9cca326338a
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/mztools.c
@@ -0,0 +1,291 @@
+/*
+  Additional tools for Minizip
+  Code: Xavier Roche '2004
+  License: Same as ZLIB (www.gzip.org)
+*/
+
+/* Code */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "third_party/zlib/zlib.h"
+#include "unzip.h"
+
+#define READ_8(adr)  ((unsigned char)*(adr))
+#define READ_16(adr) ( READ_8(adr) | (READ_8(adr+1) << 8) )
+#define READ_32(adr) ( READ_16(adr) | (READ_16((adr)+2) << 16) )
+
+#define WRITE_8(buff, n) do { \
+  *((unsigned char*)(buff)) = (unsigned char) ((n) & 0xff); \
+} while(0)
+#define WRITE_16(buff, n) do { \
+  WRITE_8((unsigned char*)(buff), n); \
+  WRITE_8(((unsigned char*)(buff)) + 1, (n) >> 8); \
+} while(0)
+#define WRITE_32(buff, n) do { \
+  WRITE_16((unsigned char*)(buff), (n) & 0xffff); \
+  WRITE_16((unsigned char*)(buff) + 2, (n) >> 16); \
+} while(0)
+
+extern int ZEXPORT unzRepair(file, fileOut, fileOutTmp, nRecovered, bytesRecovered)
+const char* file;
+const char* fileOut;
+const char* fileOutTmp;
+uLong* nRecovered;
+uLong* bytesRecovered;
+{
+  int err = Z_OK;
+  FILE* fpZip = fopen(file, "rb");
+  FILE* fpOut = fopen(fileOut, "wb");
+  FILE* fpOutCD = fopen(fileOutTmp, "wb");
+  if (fpZip != NULL &&  fpOut != NULL) {
+    int entries = 0;
+    uLong totalBytes = 0;
+    char header[30];
+    char filename[1024];
+    char extra[1024];
+    int offset = 0;
+    int offsetCD = 0;
+    while ( fread(header, 1, 30, fpZip) == 30 ) {
+      int currentOffset = offset;
+
+      /* File entry */
+      if (READ_32(header) == 0x04034b50) {
+        unsigned int version = READ_16(header + 4);
+        unsigned int gpflag = READ_16(header + 6);
+        unsigned int method = READ_16(header + 8);
+        unsigned int filetime = READ_16(header + 10);
+        unsigned int filedate = READ_16(header + 12);
+        unsigned int crc = READ_32(header + 14); /* crc */
+        unsigned int cpsize = READ_32(header + 18); /* compressed size */
+        unsigned int uncpsize = READ_32(header + 22); /* uncompressed sz */
+        unsigned int fnsize = READ_16(header + 26); /* file name length */
+        unsigned int extsize = READ_16(header + 28); /* extra field length */
+        filename[0] = extra[0] = '\0';
+
+        /* Header */
+        if (fwrite(header, 1, 30, fpOut) == 30) {
+          offset += 30;
+        } else {
+          err = Z_ERRNO;
+          break;
+        }
+
+        /* Filename */
+        if (fnsize > 0) {
+          if (fnsize < sizeof(filename)) {
+            if (fread(filename, 1, fnsize, fpZip) == fnsize) {
+                if (fwrite(filename, 1, fnsize, fpOut) == fnsize) {
+                offset += fnsize;
+              } else {
+                err = Z_ERRNO;
+                break;
+              }
+            } else {
+              err = Z_ERRNO;
+              break;
+            }
+          } else {
+            err = Z_ERRNO;
+            break;
+          }
+        } else {
+          err = Z_STREAM_ERROR;
+          break;
+        }
+
+        /* Extra field */
+        if (extsize > 0) {
+          if (extsize < sizeof(extra)) {
+            if (fread(extra, 1, extsize, fpZip) == extsize) {
+              if (fwrite(extra, 1, extsize, fpOut) == extsize) {
+                offset += extsize;
+                } else {
+                err = Z_ERRNO;
+                break;
+              }
+            } else {
+              err = Z_ERRNO;
+              break;
+            }
+          } else {
+            err = Z_ERRNO;
+            break;
+          }
+        }
+
+        /* Data */
+        {
+          int dataSize = cpsize;
+          if (dataSize == 0) {
+            dataSize = uncpsize;
+          }
+          if (dataSize > 0) {
+            char* data = malloc(dataSize);
+            if (data != NULL) {
+              if ((int)fread(data, 1, dataSize, fpZip) == dataSize) {
+                if ((int)fwrite(data, 1, dataSize, fpOut) == dataSize) {
+                  offset += dataSize;
+                  totalBytes += dataSize;
+                } else {
+                  err = Z_ERRNO;
+                }
+              } else {
+                err = Z_ERRNO;
+              }
+              free(data);
+              if (err != Z_OK) {
+                break;
+              }
+            } else {
+              err = Z_MEM_ERROR;
+              break;
+            }
+          }
+        }
+
+        /* Central directory entry */
+        {
+          char header[46];
+          char* comment = "";
+          int comsize = (int) strlen(comment);
+          WRITE_32(header, 0x02014b50);
+          WRITE_16(header + 4, version);
+          WRITE_16(header + 6, version);
+          WRITE_16(header + 8, gpflag);
+          WRITE_16(header + 10, method);
+          WRITE_16(header + 12, filetime);
+          WRITE_16(header + 14, filedate);
+          WRITE_32(header + 16, crc);
+          WRITE_32(header + 20, cpsize);
+          WRITE_32(header + 24, uncpsize);
+          WRITE_16(header + 28, fnsize);
+          WRITE_16(header + 30, extsize);
+          WRITE_16(header + 32, comsize);
+          WRITE_16(header + 34, 0);     /* disk # */
+          WRITE_16(header + 36, 0);     /* int attrb */
+          WRITE_32(header + 38, 0);     /* ext attrb */
+          WRITE_32(header + 42, currentOffset);
+          /* Header */
+          if (fwrite(header, 1, 46, fpOutCD) == 46) {
+            offsetCD += 46;
+
+            /* Filename */
+            if (fnsize > 0) {
+              if (fwrite(filename, 1, fnsize, fpOutCD) == fnsize) {
+                offsetCD += fnsize;
+              } else {
+                err = Z_ERRNO;
+                break;
+              }
+            } else {
+              err = Z_STREAM_ERROR;
+              break;
+            }
+
+            /* Extra field */
+            if (extsize > 0) {
+              if (fwrite(extra, 1, extsize, fpOutCD) == extsize) {
+                offsetCD += extsize;
+              } else {
+                err = Z_ERRNO;
+                break;
+              }
+            }
+
+            /* Comment field */
+            if (comsize > 0) {
+              if ((int)fwrite(comment, 1, comsize, fpOutCD) == comsize) {
+                offsetCD += comsize;
+              } else {
+                err = Z_ERRNO;
+                break;
+              }
+            }
+
+
+          } else {
+            err = Z_ERRNO;
+            break;
+          }
+        }
+
+        /* Success */
+        entries++;
+
+      } else {
+        break;
+      }
+    }
+
+    /* Final central directory  */
+    {
+      int entriesZip = entries;
+      char header[22];
+      char* comment = ""; // "ZIP File recovered by zlib/minizip/mztools";
+      int comsize = (int) strlen(comment);
+      if (entriesZip > 0xffff) {
+        entriesZip = 0xffff;
+      }
+      WRITE_32(header, 0x06054b50);
+      WRITE_16(header + 4, 0);    /* disk # */
+      WRITE_16(header + 6, 0);    /* disk # */
+      WRITE_16(header + 8, entriesZip);   /* hack */
+      WRITE_16(header + 10, entriesZip);  /* hack */
+      WRITE_32(header + 12, offsetCD);    /* size of CD */
+      WRITE_32(header + 16, offset);      /* offset to CD */
+      WRITE_16(header + 20, comsize);     /* comment */
+
+      /* Header */
+      if (fwrite(header, 1, 22, fpOutCD) == 22) {
+
+        /* Comment field */
+        if (comsize > 0) {
+          if ((int)fwrite(comment, 1, comsize, fpOutCD) != comsize) {
+            err = Z_ERRNO;
+          }
+        }
+
+      } else {
+        err = Z_ERRNO;
+      }
+    }
+
+    /* Final merge (file + central directory) */
+    fclose(fpOutCD);
+    if (err == Z_OK) {
+      fpOutCD = fopen(fileOutTmp, "rb");
+      if (fpOutCD != NULL) {
+        int nRead;
+        char buffer[8192];
+        while ( (nRead = (int)fread(buffer, 1, sizeof(buffer), fpOutCD)) > 0) {
+          if ((int)fwrite(buffer, 1, nRead, fpOut) != nRead) {
+            err = Z_ERRNO;
+            break;
+          }
+        }
+        fclose(fpOutCD);
+      }
+    }
+
+    /* Close */
+    fclose(fpZip);
+    fclose(fpOut);
+
+    /* Wipe temporary file */
+    (void)remove(fileOutTmp);
+
+    /* Number of recovered entries */
+    if (err == Z_OK) {
+      if (nRecovered != NULL) {
+        *nRecovered = entries;
+      }
+      if (bytesRecovered != NULL) {
+        *bytesRecovered = totalBytes;
+      }
+    }
+  } else {
+    err = Z_STREAM_ERROR;
+  }
+  return err;
+}
diff --git a/deps/v8/third_party/zlib/contrib/minizip/mztools.h b/deps/v8/third_party/zlib/contrib/minizip/mztools.h
new file mode 100644
index 00000000000000..f295ffeda6afcf
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/mztools.h
@@ -0,0 +1,37 @@
+/*
+  Additional tools for Minizip
+  Code: Xavier Roche '2004
+  License: Same as ZLIB (www.gzip.org)
+*/
+
+#ifndef _zip_tools_H
+#define _zip_tools_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef _ZLIB_H
+#include "third_party/zlib/zlib.h"
+#endif
+
+#include "unzip.h"
+
+/* Repair a ZIP file (missing central directory)
+   file: file to recover
+   fileOut: output file after recovery
+   fileOutTmp: temporary file name used for recovery
+*/
+extern int ZEXPORT unzRepair(const char* file,
+                             const char* fileOut,
+                             const char* fileOutTmp,
+                             uLong* nRecovered,
+                             uLong* bytesRecovered);
+
+
+#ifdef __cplusplus
+}
+#endif
+
+
+#endif
diff --git a/deps/v8/third_party/zlib/contrib/minizip/unzip.c b/deps/v8/third_party/zlib/contrib/minizip/unzip.c
new file mode 100644
index 00000000000000..e8b2bc5c766c8a
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/unzip.c
@@ -0,0 +1,2117 @@
+/* unzip.c -- IO for uncompress .zip files using zlib
+   Version 1.1, February 14h, 2010
+   part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Modifications of Unzip for Zip64
+         Copyright (C) 2007-2008 Even Rouault
+
+         Modifications for Zip64 support on both zip and unzip
+         Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com )
+
+         For more info read MiniZip_info.txt
+
+
+  ------------------------------------------------------------------------------------
+  Decryption code comes from crypt.c by Info-ZIP but has been greatly reduced in terms of
+  compatibility with older software. The following is from the original crypt.c.
+  Code woven in by Terry Thorsen 1/2003.
+
+  Copyright (c) 1990-2000 Info-ZIP.  All rights reserved.
+
+  See the accompanying file LICENSE, version 2000-Apr-09 or later
+  (the contents of which are also included in zip.h) for terms of use.
+  If, for some reason, all these files are missing, the Info-ZIP license
+  also may be found at:  ftp://ftp.info-zip.org/pub/infozip/license.html
+
+        crypt.c (full version) by Info-ZIP.      Last revised:  [see crypt.h]
+
+  The encryption/decryption parts of this source code (as opposed to the
+  non-echoing password parts) were originally written in Europe.  The
+  whole source package can be freely distributed, including from the USA.
+  (Prior to January 2000, re-export from the US was a violation of US law.)
+
+        This encryption code is a direct transcription of the algorithm from
+  Roger Schlafly, described by Phil Katz in the file appnote.txt.  This
+  file (appnote.txt) is distributed with the PKZIP program (even in the
+  version without encryption capabilities).
+
+        ------------------------------------------------------------------------------------
+
+        Changes in unzip.c
+
+        2007-2008 - Even Rouault - Addition of cpl_unzGetCurrentFileZStreamPos
+  2007-2008 - Even Rouault - Decoration of symbol names unz* -> cpl_unz*
+  2007-2008 - Even Rouault - Remove old C style function prototypes
+  2007-2008 - Even Rouault - Add unzip support for ZIP64
+
+        Copyright (C) 2007-2008 Even Rouault
+
+
+        Oct-2009 - Mathias Svensson - Removed cpl_* from symbol names (Even Rouault added them but since this is now moved to a new project (minizip64) I renamed them again).
+  Oct-2009 - Mathias Svensson - Fixed problem if uncompressed size was > 4G and compressed size was <4G
+                                should only read the compressed/uncompressed size from the Zip64 format if
+                                the size from normal header was 0xFFFFFFFF
+  Oct-2009 - Mathias Svensson - Applied some bug fixes from paches recived from Gilles Vollant
+        Oct-2009 - Mathias Svensson - Applied support to unzip files with compression mathod BZIP2 (bzip2 lib is required)
+                                Patch created by Daniel Borca
+
+  Jan-2010 - back to unzip and minizip 1.0 name scheme, with compatibility layer
+
+  Copyright (C) 1998 - 2010 Gilles Vollant, Even Rouault, Mathias Svensson
+
+*/
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "third_party/zlib/zlib.h"
+#include "unzip.h"
+
+#ifdef STDC
+#  include <stddef.h>
+#  include <string.h>
+#  include <stdlib.h>
+#endif
+#ifdef NO_ERRNO_H
+    extern int errno;
+#else
+#   include <errno.h>
+#endif
+
+
+#ifndef local
+#  define local static
+#endif
+/* compile with -Dlocal if your debugger can't find static symbols */
+
+
+#ifndef CASESENSITIVITYDEFAULT_NO
+#  if !defined(unix) && !defined(CASESENSITIVITYDEFAULT_YES)
+#    define CASESENSITIVITYDEFAULT_NO
+#  endif
+#endif
+
+
+#ifndef UNZ_BUFSIZE
+#define UNZ_BUFSIZE (16384)
+#endif
+
+#ifndef UNZ_MAXFILENAMEINZIP
+#define UNZ_MAXFILENAMEINZIP (256)
+#endif
+
+#ifndef ALLOC
+# define ALLOC(size) (malloc(size))
+#endif
+#ifndef TRYFREE
+# define TRYFREE(p) {if (p) free(p);}
+#endif
+
+#define SIZECENTRALDIRITEM (0x2e)
+#define SIZEZIPLOCALHEADER (0x1e)
+
+
+const char unz_copyright[] =
+   " unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll";
+
+/* unz_file_info_interntal contain internal info about a file in zipfile*/
+typedef struct unz_file_info64_internal_s
+{
+    ZPOS64_T offset_curfile;/* relative offset of local header 8 bytes */
+} unz_file_info64_internal;
+
+
+/* file_in_zip_read_info_s contain internal information about a file in zipfile,
+    when reading and decompress it */
+typedef struct
+{
+    char  *read_buffer;         /* internal buffer for compressed data */
+    z_stream stream;            /* zLib stream structure for inflate */
+
+#ifdef HAVE_BZIP2
+    bz_stream bstream;          /* bzLib stream structure for bziped */
+#endif
+
+    ZPOS64_T pos_in_zipfile;       /* position in byte on the zipfile, for fseek*/
+    uLong stream_initialised;   /* flag set if stream structure is initialised*/
+
+    ZPOS64_T offset_local_extrafield;/* offset of the local extra field */
+    uInt  size_local_extrafield;/* size of the local extra field */
+    ZPOS64_T pos_local_extrafield;   /* position in the local extra field in read*/
+    ZPOS64_T total_out_64;
+
+    uLong crc32;                /* crc32 of all data uncompressed */
+    uLong crc32_wait;           /* crc32 we must obtain after decompress all */
+    ZPOS64_T rest_read_compressed; /* number of byte to be decompressed */
+    ZPOS64_T rest_read_uncompressed;/*number of byte to be obtained after decomp*/
+    zlib_filefunc64_32_def z_filefunc;
+    voidpf filestream;        /* io structore of the zipfile */
+    uLong compression_method;   /* compression method (0==store) */
+    ZPOS64_T byte_before_the_zipfile;/* byte before the zipfile, (>0 for sfx)*/
+    int   raw;
+} file_in_zip64_read_info_s;
+
+
+/* unz64_s contain internal information about the zipfile
+*/
+typedef struct
+{
+    zlib_filefunc64_32_def z_filefunc;
+    int is64bitOpenFunction;
+    voidpf filestream;        /* io structore of the zipfile */
+    unz_global_info64 gi;       /* public global information */
+    ZPOS64_T byte_before_the_zipfile;/* byte before the zipfile, (>0 for sfx)*/
+    ZPOS64_T num_file;             /* number of the current file in the zipfile*/
+    ZPOS64_T pos_in_central_dir;   /* pos of the current file in the central dir*/
+    ZPOS64_T current_file_ok;      /* flag about the usability of the current file*/
+    ZPOS64_T central_pos;          /* position of the beginning of the central dir*/
+
+    ZPOS64_T size_central_dir;     /* size of the central directory  */
+    ZPOS64_T offset_central_dir;   /* offset of start of central directory with
+                                   respect to the starting disk number */
+
+    unz_file_info64 cur_file_info; /* public info about the current file in zip*/
+    unz_file_info64_internal cur_file_info_internal; /* private info about it*/
+    file_in_zip64_read_info_s* pfile_in_zip_read; /* structure about the current
+                                        file if we are decompressing it */
+    int encrypted;
+
+    int isZip64;
+
+#    ifndef NOUNCRYPT
+    unsigned long keys[3];     /* keys defining the pseudo-random sequence */
+    const z_crc_t* pcrc_32_tab;
+#    endif
+} unz64_s;
+
+
+#ifndef NOUNCRYPT
+#include "crypt.h"
+#endif
+
+/* ===========================================================================
+     Read a byte from a gz_stream; update next_in and avail_in. Return EOF
+   for end of file.
+   IN assertion: the stream s has been successfully opened for reading.
+*/
+
+
+local int unz64local_getByte OF((
+    const zlib_filefunc64_32_def* pzlib_filefunc_def,
+    voidpf filestream,
+    int *pi));
+
+local int unz64local_getByte(const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream, int *pi)
+{
+    unsigned char c;
+    int err = (int)ZREAD64(*pzlib_filefunc_def,filestream,&c,1);
+    if (err==1)
+    {
+        *pi = (int)c;
+        return UNZ_OK;
+    }
+    else
+    {
+        if (ZERROR64(*pzlib_filefunc_def,filestream))
+            return UNZ_ERRNO;
+        else
+            return UNZ_EOF;
+    }
+}
+
+
+/* ===========================================================================
+   Reads a long in LSB order from the given gz_stream. Sets
+*/
+local int unz64local_getShort OF((
+    const zlib_filefunc64_32_def* pzlib_filefunc_def,
+    voidpf filestream,
+    uLong *pX));
+
+local int unz64local_getShort (const zlib_filefunc64_32_def* pzlib_filefunc_def,
+                             voidpf filestream,
+                             uLong *pX)
+{
+    uLong x ;
+    int i = 0;
+    int err;
+
+    err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x = (uLong)i;
+
+    if (err==UNZ_OK)
+        err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x |= ((uLong)i)<<8;
+
+    if (err==UNZ_OK)
+        *pX = x;
+    else
+        *pX = 0;
+    return err;
+}
+
+local int unz64local_getLong OF((
+    const zlib_filefunc64_32_def* pzlib_filefunc_def,
+    voidpf filestream,
+    uLong *pX));
+
+local int unz64local_getLong (const zlib_filefunc64_32_def* pzlib_filefunc_def,
+                            voidpf filestream,
+                            uLong *pX)
+{
+    uLong x ;
+    int i = 0;
+    int err;
+
+    err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x = (uLong)i;
+
+    if (err==UNZ_OK)
+        err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x |= ((uLong)i)<<8;
+
+    if (err==UNZ_OK)
+        err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x |= ((uLong)i)<<16;
+
+    if (err==UNZ_OK)
+        err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x += ((uLong)i)<<24;
+
+    if (err==UNZ_OK)
+        *pX = x;
+    else
+        *pX = 0;
+    return err;
+}
+
+local int unz64local_getLong64 OF((
+    const zlib_filefunc64_32_def* pzlib_filefunc_def,
+    voidpf filestream,
+    ZPOS64_T *pX));
+
+
+local int unz64local_getLong64 (const zlib_filefunc64_32_def* pzlib_filefunc_def,
+                            voidpf filestream,
+                            ZPOS64_T *pX)
+{
+    ZPOS64_T x ;
+    int i = 0;
+    int err;
+
+    err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x = (ZPOS64_T)i;
+
+    if (err==UNZ_OK)
+        err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x |= ((ZPOS64_T)i)<<8;
+
+    if (err==UNZ_OK)
+        err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x |= ((ZPOS64_T)i)<<16;
+
+    if (err==UNZ_OK)
+        err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x |= ((ZPOS64_T)i)<<24;
+
+    if (err==UNZ_OK)
+        err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x |= ((ZPOS64_T)i)<<32;
+
+    if (err==UNZ_OK)
+        err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x |= ((ZPOS64_T)i)<<40;
+
+    if (err==UNZ_OK)
+        err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x |= ((ZPOS64_T)i)<<48;
+
+    if (err==UNZ_OK)
+        err = unz64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x |= ((ZPOS64_T)i)<<56;
+
+    if (err==UNZ_OK)
+        *pX = x;
+    else
+        *pX = 0;
+    return err;
+}
+
+/* My own strcmpi / strcasecmp */
+local int strcmpcasenosensitive_internal (const char* fileName1, const char* fileName2)
+{
+    for (;;)
+    {
+        char c1=*(fileName1++);
+        char c2=*(fileName2++);
+        if ((c1>='a') && (c1<='z'))
+            c1 -= 0x20;
+        if ((c2>='a') && (c2<='z'))
+            c2 -= 0x20;
+        if (c1=='\0')
+            return ((c2=='\0') ? 0 : -1);
+        if (c2=='\0')
+            return 1;
+        if (c1<c2)
+            return -1;
+        if (c1>c2)
+            return 1;
+    }
+}
+
+
+#ifdef  CASESENSITIVITYDEFAULT_NO
+#define CASESENSITIVITYDEFAULTVALUE 2
+#else
+#define CASESENSITIVITYDEFAULTVALUE 1
+#endif
+
+#ifndef STRCMPCASENOSENTIVEFUNCTION
+#define STRCMPCASENOSENTIVEFUNCTION strcmpcasenosensitive_internal
+#endif
+
+/*
+   Compare two filename (fileName1,fileName2).
+   If iCaseSenisivity = 1, comparision is case sensitivity (like strcmp)
+   If iCaseSenisivity = 2, comparision is not case sensitivity (like strcmpi
+                                                                or strcasecmp)
+   If iCaseSenisivity = 0, case sensitivity is defaut of your operating system
+        (like 1 on Unix, 2 on Windows)
+
+*/
+extern int ZEXPORT unzStringFileNameCompare (const char*  fileName1,
+                                                 const char*  fileName2,
+                                                 int iCaseSensitivity)
+
+{
+    if (iCaseSensitivity==0)
+        iCaseSensitivity=CASESENSITIVITYDEFAULTVALUE;
+
+    if (iCaseSensitivity==1)
+        return strcmp(fileName1,fileName2);
+
+    return STRCMPCASENOSENTIVEFUNCTION(fileName1,fileName2);
+}
+
+#ifndef BUFREADCOMMENT
+#define BUFREADCOMMENT (0x400)
+#endif
+
+/*
+  Locate the Central directory of a zipfile (at the end, just before
+    the global comment)
+*/
+local ZPOS64_T unz64local_SearchCentralDir OF((const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream));
+local ZPOS64_T unz64local_SearchCentralDir(const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream)
+{
+    unsigned char* buf;
+    ZPOS64_T uSizeFile;
+    ZPOS64_T uBackRead;
+    ZPOS64_T uMaxBack=0xffff; /* maximum size of global comment */
+    ZPOS64_T uPosFound=0;
+
+    if (ZSEEK64(*pzlib_filefunc_def,filestream,0,ZLIB_FILEFUNC_SEEK_END) != 0)
+        return 0;
+
+
+    uSizeFile = ZTELL64(*pzlib_filefunc_def,filestream);
+
+    if (uMaxBack>uSizeFile)
+        uMaxBack = uSizeFile;
+
+    buf = (unsigned char*)ALLOC(BUFREADCOMMENT+4);
+    if (buf==NULL)
+        return 0;
+
+    uBackRead = 4;
+    while (uBackRead<uMaxBack)
+    {
+        uLong uReadSize;
+        ZPOS64_T uReadPos ;
+        int i;
+        if (uBackRead+BUFREADCOMMENT>uMaxBack)
+            uBackRead = uMaxBack;
+        else
+            uBackRead+=BUFREADCOMMENT;
+        uReadPos = uSizeFile-uBackRead ;
+
+        uReadSize = ((BUFREADCOMMENT+4) < (uSizeFile-uReadPos)) ?
+                     (BUFREADCOMMENT+4) : (uLong)(uSizeFile-uReadPos);
+        if (ZSEEK64(*pzlib_filefunc_def,filestream,uReadPos,ZLIB_FILEFUNC_SEEK_SET)!=0)
+            break;
+
+        if (ZREAD64(*pzlib_filefunc_def,filestream,buf,uReadSize)!=uReadSize)
+            break;
+
+        for (i=(int)uReadSize-3; (i--)>0;)
+            if (((*(buf+i))==0x50) && ((*(buf+i+1))==0x4b) &&
+                ((*(buf+i+2))==0x05) && ((*(buf+i+3))==0x06))
+            {
+                uPosFound = uReadPos+i;
+                break;
+            }
+
+        if (uPosFound!=0)
+            break;
+    }
+    TRYFREE(buf);
+    return uPosFound;
+}
+
+
+/*
+  Locate the Central directory 64 of a zipfile (at the end, just before
+    the global comment)
+*/
+local ZPOS64_T unz64local_SearchCentralDir64 OF((
+    const zlib_filefunc64_32_def* pzlib_filefunc_def,
+    voidpf filestream));
+
+local ZPOS64_T unz64local_SearchCentralDir64(const zlib_filefunc64_32_def* pzlib_filefunc_def,
+                                      voidpf filestream)
+{
+    unsigned char* buf;
+    ZPOS64_T uSizeFile;
+    ZPOS64_T uBackRead;
+    ZPOS64_T uMaxBack=0xffff; /* maximum size of global comment */
+    ZPOS64_T uPosFound=0;
+    uLong uL;
+                ZPOS64_T relativeOffset;
+
+    if (ZSEEK64(*pzlib_filefunc_def,filestream,0,ZLIB_FILEFUNC_SEEK_END) != 0)
+        return 0;
+
+
+    uSizeFile = ZTELL64(*pzlib_filefunc_def,filestream);
+
+    if (uMaxBack>uSizeFile)
+        uMaxBack = uSizeFile;
+
+    buf = (unsigned char*)ALLOC(BUFREADCOMMENT+4);
+    if (buf==NULL)
+        return 0;
+
+    uBackRead = 4;
+    while (uBackRead<uMaxBack)
+    {
+        uLong uReadSize;
+        ZPOS64_T uReadPos;
+        int i;
+        if (uBackRead+BUFREADCOMMENT>uMaxBack)
+            uBackRead = uMaxBack;
+        else
+            uBackRead+=BUFREADCOMMENT;
+        uReadPos = uSizeFile-uBackRead ;
+
+        uReadSize = ((BUFREADCOMMENT+4) < (uSizeFile-uReadPos)) ?
+                     (BUFREADCOMMENT+4) : (uLong)(uSizeFile-uReadPos);
+        if (ZSEEK64(*pzlib_filefunc_def,filestream,uReadPos,ZLIB_FILEFUNC_SEEK_SET)!=0)
+            break;
+
+        if (ZREAD64(*pzlib_filefunc_def,filestream,buf,uReadSize)!=uReadSize)
+            break;
+
+        for (i=(int)uReadSize-3; (i--)>0;)
+            if (((*(buf+i))==0x50) && ((*(buf+i+1))==0x4b) &&
+                ((*(buf+i+2))==0x06) && ((*(buf+i+3))==0x07))
+            {
+                uPosFound = uReadPos+i;
+                break;
+            }
+
+        if (uPosFound!=0)
+            break;
+    }
+    TRYFREE(buf);
+    if (uPosFound == 0)
+        return 0;
+
+    /* Zip64 end of central directory locator */
+    if (ZSEEK64(*pzlib_filefunc_def,filestream, uPosFound,ZLIB_FILEFUNC_SEEK_SET)!=0)
+        return 0;
+
+    /* the signature, already checked */
+    if (unz64local_getLong(pzlib_filefunc_def,filestream,&uL)!=UNZ_OK)
+        return 0;
+
+    /* number of the disk with the start of the zip64 end of  central directory */
+    if (unz64local_getLong(pzlib_filefunc_def,filestream,&uL)!=UNZ_OK)
+        return 0;
+    if (uL != 0)
+        return 0;
+
+    /* relative offset of the zip64 end of central directory record */
+    if (unz64local_getLong64(pzlib_filefunc_def,filestream,&relativeOffset)!=UNZ_OK)
+        return 0;
+
+    /* total number of disks */
+    if (unz64local_getLong(pzlib_filefunc_def,filestream,&uL)!=UNZ_OK)
+        return 0;
+    if (uL != 1)
+        return 0;
+
+    /* Goto end of central directory record */
+    if (ZSEEK64(*pzlib_filefunc_def,filestream, relativeOffset,ZLIB_FILEFUNC_SEEK_SET)!=0)
+        return 0;
+
+     /* the signature */
+    if (unz64local_getLong(pzlib_filefunc_def,filestream,&uL)!=UNZ_OK)
+        return 0;
+
+    if (uL != 0x06064b50)
+        return 0;
+
+    return relativeOffset;
+}
+
+/*
+  Open a Zip file. path contain the full pathname (by example,
+     on a Windows NT computer "c:\\test\\zlib114.zip" or on an Unix computer
+     "zlib/zlib114.zip".
+     If the zipfile cannot be opened (file doesn't exist or in not valid), the
+       return value is NULL.
+     Else, the return value is a unzFile Handle, usable with other function
+       of this unzip package.
+*/
+local unzFile unzOpenInternal (const void *path,
+                               zlib_filefunc64_32_def* pzlib_filefunc64_32_def,
+                               int is64bitOpenFunction)
+{
+    unz64_s us;
+    unz64_s *s;
+    ZPOS64_T central_pos;
+    uLong   uL;
+
+    uLong number_disk;          /* number of the current dist, used for
+                                   spaning ZIP, unsupported, always 0*/
+    uLong number_disk_with_CD;  /* number the the disk with central dir, used
+                                   for spaning ZIP, unsupported, always 0*/
+    ZPOS64_T number_entry_CD;      /* total number of entries in
+                                   the central dir
+                                   (same than number_entry on nospan) */
+
+    int err=UNZ_OK;
+
+    if (unz_copyright[0]!=' ')
+        return NULL;
+
+    us.z_filefunc.zseek32_file = NULL;
+    us.z_filefunc.ztell32_file = NULL;
+    if (pzlib_filefunc64_32_def==NULL)
+        fill_fopen64_filefunc(&us.z_filefunc.zfile_func64);
+    else
+        us.z_filefunc = *pzlib_filefunc64_32_def;
+    us.is64bitOpenFunction = is64bitOpenFunction;
+
+
+
+    us.filestream = ZOPEN64(us.z_filefunc,
+                                                 path,
+                                                 ZLIB_FILEFUNC_MODE_READ |
+                                                 ZLIB_FILEFUNC_MODE_EXISTING);
+    if (us.filestream==NULL)
+        return NULL;
+
+    central_pos = unz64local_SearchCentralDir64(&us.z_filefunc,us.filestream);
+    if (central_pos)
+    {
+        uLong uS;
+        ZPOS64_T uL64;
+
+        us.isZip64 = 1;
+
+        if (ZSEEK64(us.z_filefunc, us.filestream,
+                                      central_pos,ZLIB_FILEFUNC_SEEK_SET)!=0)
+        err=UNZ_ERRNO;
+
+        /* the signature, already checked */
+        if (unz64local_getLong(&us.z_filefunc, us.filestream,&uL)!=UNZ_OK)
+            err=UNZ_ERRNO;
+
+        /* size of zip64 end of central directory record */
+        if (unz64local_getLong64(&us.z_filefunc, us.filestream,&uL64)!=UNZ_OK)
+            err=UNZ_ERRNO;
+
+        /* version made by */
+        if (unz64local_getShort(&us.z_filefunc, us.filestream,&uS)!=UNZ_OK)
+            err=UNZ_ERRNO;
+
+        /* version needed to extract */
+        if (unz64local_getShort(&us.z_filefunc, us.filestream,&uS)!=UNZ_OK)
+            err=UNZ_ERRNO;
+
+        /* number of this disk */
+        if (unz64local_getLong(&us.z_filefunc, us.filestream,&number_disk)!=UNZ_OK)
+            err=UNZ_ERRNO;
+
+        /* number of the disk with the start of the central directory */
+        if (unz64local_getLong(&us.z_filefunc, us.filestream,&number_disk_with_CD)!=UNZ_OK)
+            err=UNZ_ERRNO;
+
+        /* total number of entries in the central directory on this disk */
+        if (unz64local_getLong64(&us.z_filefunc, us.filestream,&us.gi.number_entry)!=UNZ_OK)
+            err=UNZ_ERRNO;
+
+        /* total number of entries in the central directory */
+        if (unz64local_getLong64(&us.z_filefunc, us.filestream,&number_entry_CD)!=UNZ_OK)
+            err=UNZ_ERRNO;
+
+        if ((number_entry_CD!=us.gi.number_entry) ||
+            (number_disk_with_CD!=0) ||
+            (number_disk!=0))
+            err=UNZ_BADZIPFILE;
+
+        /* size of the central directory */
+        if (unz64local_getLong64(&us.z_filefunc, us.filestream,&us.size_central_dir)!=UNZ_OK)
+            err=UNZ_ERRNO;
+
+        /* offset of start of central directory with respect to the
+          starting disk number */
+        if (unz64local_getLong64(&us.z_filefunc, us.filestream,&us.offset_central_dir)!=UNZ_OK)
+            err=UNZ_ERRNO;
+
+        us.gi.size_comment = 0;
+    }
+    else
+    {
+        central_pos = unz64local_SearchCentralDir(&us.z_filefunc,us.filestream);
+        if (central_pos==0)
+            err=UNZ_ERRNO;
+
+        us.isZip64 = 0;
+
+        if (ZSEEK64(us.z_filefunc, us.filestream,
+                                        central_pos,ZLIB_FILEFUNC_SEEK_SET)!=0)
+            err=UNZ_ERRNO;
+
+        /* the signature, already checked */
+        if (unz64local_getLong(&us.z_filefunc, us.filestream,&uL)!=UNZ_OK)
+            err=UNZ_ERRNO;
+
+        /* number of this disk */
+        if (unz64local_getShort(&us.z_filefunc, us.filestream,&number_disk)!=UNZ_OK)
+            err=UNZ_ERRNO;
+
+        /* number of the disk with the start of the central directory */
+        if (unz64local_getShort(&us.z_filefunc, us.filestream,&number_disk_with_CD)!=UNZ_OK)
+            err=UNZ_ERRNO;
+
+        /* total number of entries in the central dir on this disk */
+        if (unz64local_getShort(&us.z_filefunc, us.filestream,&uL)!=UNZ_OK)
+            err=UNZ_ERRNO;
+        us.gi.number_entry = uL;
+
+        /* total number of entries in the central dir */
+        if (unz64local_getShort(&us.z_filefunc, us.filestream,&uL)!=UNZ_OK)
+            err=UNZ_ERRNO;
+        number_entry_CD = uL;
+
+        if ((number_entry_CD!=us.gi.number_entry) ||
+            (number_disk_with_CD!=0) ||
+            (number_disk!=0))
+            err=UNZ_BADZIPFILE;
+
+        /* size of the central directory */
+        if (unz64local_getLong(&us.z_filefunc, us.filestream,&uL)!=UNZ_OK)
+            err=UNZ_ERRNO;
+        us.size_central_dir = uL;
+
+        /* offset of start of central directory with respect to the
+            starting disk number */
+        if (unz64local_getLong(&us.z_filefunc, us.filestream,&uL)!=UNZ_OK)
+            err=UNZ_ERRNO;
+        us.offset_central_dir = uL;
+
+        /* zipfile comment length */
+        if (unz64local_getShort(&us.z_filefunc, us.filestream,&us.gi.size_comment)!=UNZ_OK)
+            err=UNZ_ERRNO;
+    }
+
+    if ((central_pos<us.offset_central_dir+us.size_central_dir) &&
+        (err==UNZ_OK))
+        err=UNZ_BADZIPFILE;
+
+    if (err!=UNZ_OK)
+    {
+        ZCLOSE64(us.z_filefunc, us.filestream);
+        return NULL;
+    }
+
+    us.byte_before_the_zipfile = central_pos -
+                            (us.offset_central_dir+us.size_central_dir);
+    us.central_pos = central_pos;
+    us.pfile_in_zip_read = NULL;
+    us.encrypted = 0;
+
+
+    s=(unz64_s*)ALLOC(sizeof(unz64_s));
+    if( s != NULL)
+    {
+        *s=us;
+        unzGoToFirstFile((unzFile)s);
+    }
+    return (unzFile)s;
+}
+
+
+extern unzFile ZEXPORT unzOpen2 (const char *path,
+                                        zlib_filefunc_def* pzlib_filefunc32_def)
+{
+    if (pzlib_filefunc32_def != NULL)
+    {
+        zlib_filefunc64_32_def zlib_filefunc64_32_def_fill;
+        fill_zlib_filefunc64_32_def_from_filefunc32(&zlib_filefunc64_32_def_fill,pzlib_filefunc32_def);
+        return unzOpenInternal(path, &zlib_filefunc64_32_def_fill, 0);
+    }
+    else
+        return unzOpenInternal(path, NULL, 0);
+}
+
+extern unzFile ZEXPORT unzOpen2_64 (const void *path,
+                                     zlib_filefunc64_def* pzlib_filefunc_def)
+{
+    if (pzlib_filefunc_def != NULL)
+    {
+        zlib_filefunc64_32_def zlib_filefunc64_32_def_fill;
+        zlib_filefunc64_32_def_fill.zfile_func64 = *pzlib_filefunc_def;
+        zlib_filefunc64_32_def_fill.ztell32_file = NULL;
+        zlib_filefunc64_32_def_fill.zseek32_file = NULL;
+        return unzOpenInternal(path, &zlib_filefunc64_32_def_fill, 1);
+    }
+    else
+        return unzOpenInternal(path, NULL, 1);
+}
+
+extern unzFile ZEXPORT unzOpen (const char *path)
+{
+    return unzOpenInternal(path, NULL, 0);
+}
+
+extern unzFile ZEXPORT unzOpen64 (const void *path)
+{
+    return unzOpenInternal(path, NULL, 1);
+}
+
+/*
+  Close a ZipFile opened with unzOpen.
+  If there is files inside the .Zip opened with unzOpenCurrentFile (see later),
+    these files MUST be closed with unzCloseCurrentFile before call unzClose.
+  return UNZ_OK if there is no problem. */
+extern int ZEXPORT unzClose (unzFile file)
+{
+    unz64_s* s;
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+
+    if (s->pfile_in_zip_read!=NULL)
+        unzCloseCurrentFile(file);
+
+    ZCLOSE64(s->z_filefunc, s->filestream);
+    TRYFREE(s);
+    return UNZ_OK;
+}
+
+
+/*
+  Write info about the ZipFile in the *pglobal_info structure.
+  No preparation of the structure is needed
+  return UNZ_OK if there is no problem. */
+extern int ZEXPORT unzGetGlobalInfo64 (unzFile file, unz_global_info64* pglobal_info)
+{
+    unz64_s* s;
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+    *pglobal_info=s->gi;
+    return UNZ_OK;
+}
+
+extern int ZEXPORT unzGetGlobalInfo (unzFile file, unz_global_info* pglobal_info32)
+{
+    unz64_s* s;
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+    /* to do : check if number_entry is not truncated */
+    pglobal_info32->number_entry = (uLong)s->gi.number_entry;
+    pglobal_info32->size_comment = s->gi.size_comment;
+    return UNZ_OK;
+}
+/*
+   Translate date/time from Dos format to tm_unz (readable more easilty)
+*/
+local void unz64local_DosDateToTmuDate (ZPOS64_T ulDosDate, tm_unz* ptm)
+{
+    ZPOS64_T uDate;
+    uDate = (ZPOS64_T)(ulDosDate>>16);
+    ptm->tm_mday = (uInt)(uDate&0x1f) ;
+    ptm->tm_mon =  (uInt)((((uDate)&0x1E0)/0x20)-1) ;
+    ptm->tm_year = (uInt)(((uDate&0x0FE00)/0x0200)+1980) ;
+
+    ptm->tm_hour = (uInt) ((ulDosDate &0xF800)/0x800);
+    ptm->tm_min =  (uInt) ((ulDosDate&0x7E0)/0x20) ;
+    ptm->tm_sec =  (uInt) (2*(ulDosDate&0x1f)) ;
+}
+
+/*
+  Get Info about the current file in the zipfile, with internal only info
+*/
+local int unz64local_GetCurrentFileInfoInternal OF((unzFile file,
+                                                  unz_file_info64 *pfile_info,
+                                                  unz_file_info64_internal
+                                                  *pfile_info_internal,
+                                                  char *szFileName,
+                                                  uLong fileNameBufferSize,
+                                                  void *extraField,
+                                                  uLong extraFieldBufferSize,
+                                                  char *szComment,
+                                                  uLong commentBufferSize));
+
+local int unz64local_GetCurrentFileInfoInternal (unzFile file,
+                                                  unz_file_info64 *pfile_info,
+                                                  unz_file_info64_internal
+                                                  *pfile_info_internal,
+                                                  char *szFileName,
+                                                  uLong fileNameBufferSize,
+                                                  void *extraField,
+                                                  uLong extraFieldBufferSize,
+                                                  char *szComment,
+                                                  uLong commentBufferSize)
+{
+    unz64_s* s;
+    unz_file_info64 file_info;
+    unz_file_info64_internal file_info_internal;
+    int err=UNZ_OK;
+    uLong uMagic;
+    long lSeek=0;
+    uLong uL;
+
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+    if (ZSEEK64(s->z_filefunc, s->filestream,
+              s->pos_in_central_dir+s->byte_before_the_zipfile,
+              ZLIB_FILEFUNC_SEEK_SET)!=0)
+        err=UNZ_ERRNO;
+
+
+    /* we check the magic */
+    if (err==UNZ_OK)
+    {
+        if (unz64local_getLong(&s->z_filefunc, s->filestream,&uMagic) != UNZ_OK)
+            err=UNZ_ERRNO;
+        else if (uMagic!=0x02014b50)
+            err=UNZ_BADZIPFILE;
+    }
+
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&file_info.version) != UNZ_OK)
+        err=UNZ_ERRNO;
+
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&file_info.version_needed) != UNZ_OK)
+        err=UNZ_ERRNO;
+
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&file_info.flag) != UNZ_OK)
+        err=UNZ_ERRNO;
+
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&file_info.compression_method) != UNZ_OK)
+        err=UNZ_ERRNO;
+
+    if (unz64local_getLong(&s->z_filefunc, s->filestream,&file_info.dosDate) != UNZ_OK)
+        err=UNZ_ERRNO;
+
+    unz64local_DosDateToTmuDate(file_info.dosDate,&file_info.tmu_date);
+
+    if (unz64local_getLong(&s->z_filefunc, s->filestream,&file_info.crc) != UNZ_OK)
+        err=UNZ_ERRNO;
+
+    if (unz64local_getLong(&s->z_filefunc, s->filestream,&uL) != UNZ_OK)
+        err=UNZ_ERRNO;
+    file_info.compressed_size = uL;
+
+    if (unz64local_getLong(&s->z_filefunc, s->filestream,&uL) != UNZ_OK)
+        err=UNZ_ERRNO;
+    file_info.uncompressed_size = uL;
+
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&file_info.size_filename) != UNZ_OK)
+        err=UNZ_ERRNO;
+
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&file_info.size_file_extra) != UNZ_OK)
+        err=UNZ_ERRNO;
+
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&file_info.size_file_comment) != UNZ_OK)
+        err=UNZ_ERRNO;
+
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&file_info.disk_num_start) != UNZ_OK)
+        err=UNZ_ERRNO;
+
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&file_info.internal_fa) != UNZ_OK)
+        err=UNZ_ERRNO;
+
+    if (unz64local_getLong(&s->z_filefunc, s->filestream,&file_info.external_fa) != UNZ_OK)
+        err=UNZ_ERRNO;
+
+                // relative offset of local header
+    if (unz64local_getLong(&s->z_filefunc, s->filestream,&uL) != UNZ_OK)
+        err=UNZ_ERRNO;
+    file_info_internal.offset_curfile = uL;
+
+    lSeek+=file_info.size_filename;
+    if ((err==UNZ_OK) && (szFileName!=NULL))
+    {
+        uLong uSizeRead ;
+        if (file_info.size_filename<fileNameBufferSize)
+        {
+            *(szFileName+file_info.size_filename)='\0';
+            uSizeRead = file_info.size_filename;
+        }
+        else
+            uSizeRead = fileNameBufferSize;
+
+        if ((file_info.size_filename>0) && (fileNameBufferSize>0))
+            if (ZREAD64(s->z_filefunc, s->filestream,szFileName,uSizeRead)!=uSizeRead)
+                err=UNZ_ERRNO;
+        lSeek -= uSizeRead;
+    }
+
+    // Read extrafield
+    if ((err==UNZ_OK) && (extraField!=NULL))
+    {
+        ZPOS64_T uSizeRead ;
+        if (file_info.size_file_extra<extraFieldBufferSize)
+            uSizeRead = file_info.size_file_extra;
+        else
+            uSizeRead = extraFieldBufferSize;
+
+        if (lSeek!=0)
+        {
+            if (ZSEEK64(s->z_filefunc, s->filestream,lSeek,ZLIB_FILEFUNC_SEEK_CUR)==0)
+                lSeek=0;
+            else
+                err=UNZ_ERRNO;
+        }
+
+        if ((file_info.size_file_extra>0) && (extraFieldBufferSize>0))
+            if (ZREAD64(s->z_filefunc, s->filestream,extraField,(uLong)uSizeRead)!=uSizeRead)
+                err=UNZ_ERRNO;
+
+        lSeek += file_info.size_file_extra - (uLong)uSizeRead;
+    }
+    else
+        lSeek += file_info.size_file_extra;
+
+
+    if ((err==UNZ_OK) && (file_info.size_file_extra != 0))
+    {
+                                uLong acc = 0;
+
+        // since lSeek now points to after the extra field we need to move back
+        lSeek -= file_info.size_file_extra;
+
+        if (lSeek!=0)
+        {
+            if (ZSEEK64(s->z_filefunc, s->filestream,lSeek,ZLIB_FILEFUNC_SEEK_CUR)==0)
+                lSeek=0;
+            else
+                err=UNZ_ERRNO;
+        }
+
+        while(acc < file_info.size_file_extra)
+        {
+            uLong headerId;
+                                                uLong dataSize;
+
+            if (unz64local_getShort(&s->z_filefunc, s->filestream,&headerId) != UNZ_OK)
+                err=UNZ_ERRNO;
+
+            if (unz64local_getShort(&s->z_filefunc, s->filestream,&dataSize) != UNZ_OK)
+                err=UNZ_ERRNO;
+
+            /* ZIP64 extra fields */
+            if (headerId == 0x0001)
+            {
+                                                        uLong uL;
+
+                                                                if(file_info.uncompressed_size == MAXU32)
+                                                                {
+                                                                        if (unz64local_getLong64(&s->z_filefunc, s->filestream,&file_info.uncompressed_size) != UNZ_OK)
+                                                                                        err=UNZ_ERRNO;
+                                                                }
+
+                                                                if(file_info.compressed_size == MAXU32)
+                                                                {
+                                                                        if (unz64local_getLong64(&s->z_filefunc, s->filestream,&file_info.compressed_size) != UNZ_OK)
+                                                                                  err=UNZ_ERRNO;
+                                                                }
+
+                                                                if(file_info_internal.offset_curfile == MAXU32)
+                                                                {
+                                                                        /* Relative Header offset */
+                                                                        if (unz64local_getLong64(&s->z_filefunc, s->filestream,&file_info_internal.offset_curfile) != UNZ_OK)
+                                                                                err=UNZ_ERRNO;
+                                                                }
+
+                                                                if(file_info.disk_num_start == MAXU32)
+                                                                {
+                                                                        /* Disk Start Number */
+                                                                        if (unz64local_getLong(&s->z_filefunc, s->filestream,&uL) != UNZ_OK)
+                                                                                err=UNZ_ERRNO;
+                                                                }
+
+            }
+            else
+            {
+                if (ZSEEK64(s->z_filefunc, s->filestream,dataSize,ZLIB_FILEFUNC_SEEK_CUR)!=0)
+                    err=UNZ_ERRNO;
+            }
+
+            acc += 2 + 2 + dataSize;
+        }
+    }
+
+    if ((err==UNZ_OK) && (szComment!=NULL))
+    {
+        uLong uSizeRead ;
+        if (file_info.size_file_comment<commentBufferSize)
+        {
+            *(szComment+file_info.size_file_comment)='\0';
+            uSizeRead = file_info.size_file_comment;
+        }
+        else
+            uSizeRead = commentBufferSize;
+
+        if (lSeek!=0)
+        {
+            if (ZSEEK64(s->z_filefunc, s->filestream,lSeek,ZLIB_FILEFUNC_SEEK_CUR)==0)
+                lSeek=0;
+            else
+                err=UNZ_ERRNO;
+        }
+
+        if ((file_info.size_file_comment>0) && (commentBufferSize>0))
+            if (ZREAD64(s->z_filefunc, s->filestream,szComment,uSizeRead)!=uSizeRead)
+                err=UNZ_ERRNO;
+        lSeek+=file_info.size_file_comment - uSizeRead;
+    }
+    else
+        lSeek+=file_info.size_file_comment;
+
+
+    if ((err==UNZ_OK) && (pfile_info!=NULL))
+        *pfile_info=file_info;
+
+    if ((err==UNZ_OK) && (pfile_info_internal!=NULL))
+        *pfile_info_internal=file_info_internal;
+
+    return err;
+}
+
+
+
+/*
+  Write info about the ZipFile in the *pglobal_info structure.
+  No preparation of the structure is needed
+  return UNZ_OK if there is no problem.
+*/
+extern int ZEXPORT unzGetCurrentFileInfo64 (unzFile file,
+                                          unz_file_info64 * pfile_info,
+                                          char * szFileName, uLong fileNameBufferSize,
+                                          void *extraField, uLong extraFieldBufferSize,
+                                          char* szComment,  uLong commentBufferSize)
+{
+    return unz64local_GetCurrentFileInfoInternal(file,pfile_info,NULL,
+                                                szFileName,fileNameBufferSize,
+                                                extraField,extraFieldBufferSize,
+                                                szComment,commentBufferSize);
+}
+
+extern int ZEXPORT unzGetCurrentFileInfo (unzFile file,
+                                          unz_file_info * pfile_info,
+                                          char * szFileName, uLong fileNameBufferSize,
+                                          void *extraField, uLong extraFieldBufferSize,
+                                          char* szComment,  uLong commentBufferSize)
+{
+    int err;
+    unz_file_info64 file_info64;
+    err = unz64local_GetCurrentFileInfoInternal(file,&file_info64,NULL,
+                                                szFileName,fileNameBufferSize,
+                                                extraField,extraFieldBufferSize,
+                                                szComment,commentBufferSize);
+    if ((err==UNZ_OK) && (pfile_info != NULL))
+    {
+        pfile_info->version = file_info64.version;
+        pfile_info->version_needed = file_info64.version_needed;
+        pfile_info->flag = file_info64.flag;
+        pfile_info->compression_method = file_info64.compression_method;
+        pfile_info->dosDate = file_info64.dosDate;
+        pfile_info->crc = file_info64.crc;
+
+        pfile_info->size_filename = file_info64.size_filename;
+        pfile_info->size_file_extra = file_info64.size_file_extra;
+        pfile_info->size_file_comment = file_info64.size_file_comment;
+
+        pfile_info->disk_num_start = file_info64.disk_num_start;
+        pfile_info->internal_fa = file_info64.internal_fa;
+        pfile_info->external_fa = file_info64.external_fa;
+
+        pfile_info->tmu_date = file_info64.tmu_date,
+
+
+        pfile_info->compressed_size = (uLong)file_info64.compressed_size;
+        pfile_info->uncompressed_size = (uLong)file_info64.uncompressed_size;
+
+    }
+    return err;
+}
+/*
+  Set the current file of the zipfile to the first file.
+  return UNZ_OK if there is no problem
+*/
+extern int ZEXPORT unzGoToFirstFile (unzFile file)
+{
+    int err=UNZ_OK;
+    unz64_s* s;
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+    s->pos_in_central_dir=s->offset_central_dir;
+    s->num_file=0;
+    err=unz64local_GetCurrentFileInfoInternal(file,&s->cur_file_info,
+                                             &s->cur_file_info_internal,
+                                             NULL,0,NULL,0,NULL,0);
+    s->current_file_ok = (err == UNZ_OK);
+    return err;
+}
+
+/*
+  Set the current file of the zipfile to the next file.
+  return UNZ_OK if there is no problem
+  return UNZ_END_OF_LIST_OF_FILE if the actual file was the latest.
+*/
+extern int ZEXPORT unzGoToNextFile (unzFile  file)
+{
+    unz64_s* s;
+    int err;
+
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+    if (!s->current_file_ok)
+        return UNZ_END_OF_LIST_OF_FILE;
+    if (s->gi.number_entry != 0xffff)    /* 2^16 files overflow hack */
+      if (s->num_file+1==s->gi.number_entry)
+        return UNZ_END_OF_LIST_OF_FILE;
+
+    s->pos_in_central_dir += SIZECENTRALDIRITEM + s->cur_file_info.size_filename +
+            s->cur_file_info.size_file_extra + s->cur_file_info.size_file_comment ;
+    s->num_file++;
+    err = unz64local_GetCurrentFileInfoInternal(file,&s->cur_file_info,
+                                               &s->cur_file_info_internal,
+                                               NULL,0,NULL,0,NULL,0);
+    s->current_file_ok = (err == UNZ_OK);
+    return err;
+}
+
+
+/*
+  Try locate the file szFileName in the zipfile.
+  For the iCaseSensitivity signification, see unzStringFileNameCompare
+
+  return value :
+  UNZ_OK if the file is found. It becomes the current file.
+  UNZ_END_OF_LIST_OF_FILE if the file is not found
+*/
+extern int ZEXPORT unzLocateFile (unzFile file, const char *szFileName, int iCaseSensitivity)
+{
+    unz64_s* s;
+    int err;
+
+    /* We remember the 'current' position in the file so that we can jump
+     * back there if we fail.
+     */
+    unz_file_info64 cur_file_infoSaved;
+    unz_file_info64_internal cur_file_info_internalSaved;
+    ZPOS64_T num_fileSaved;
+    ZPOS64_T pos_in_central_dirSaved;
+
+
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+
+    if (strlen(szFileName)>=UNZ_MAXFILENAMEINZIP)
+        return UNZ_PARAMERROR;
+
+    s=(unz64_s*)file;
+    if (!s->current_file_ok)
+        return UNZ_END_OF_LIST_OF_FILE;
+
+    /* Save the current state */
+    num_fileSaved = s->num_file;
+    pos_in_central_dirSaved = s->pos_in_central_dir;
+    cur_file_infoSaved = s->cur_file_info;
+    cur_file_info_internalSaved = s->cur_file_info_internal;
+
+    err = unzGoToFirstFile(file);
+
+    while (err == UNZ_OK)
+    {
+        char szCurrentFileName[UNZ_MAXFILENAMEINZIP+1];
+        err = unzGetCurrentFileInfo64(file,NULL,
+                                    szCurrentFileName,sizeof(szCurrentFileName)-1,
+                                    NULL,0,NULL,0);
+        if (err == UNZ_OK)
+        {
+            if (unzStringFileNameCompare(szCurrentFileName,
+                                            szFileName,iCaseSensitivity)==0)
+                return UNZ_OK;
+            err = unzGoToNextFile(file);
+        }
+    }
+
+    /* We failed, so restore the state of the 'current file' to where we
+     * were.
+     */
+    s->num_file = num_fileSaved ;
+    s->pos_in_central_dir = pos_in_central_dirSaved ;
+    s->cur_file_info = cur_file_infoSaved;
+    s->cur_file_info_internal = cur_file_info_internalSaved;
+    return err;
+}
+
+
+/*
+///////////////////////////////////////////
+// Contributed by Ryan Haksi (mailto://cryogen@infoserve.net)
+// I need random access
+//
+// Further optimization could be realized by adding an ability
+// to cache the directory in memory. The goal being a single
+// comprehensive file read to put the file I need in a memory.
+*/
+
+/*
+typedef struct unz_file_pos_s
+{
+    ZPOS64_T pos_in_zip_directory;   // offset in file
+    ZPOS64_T num_of_file;            // # of file
+} unz_file_pos;
+*/
+
+extern int ZEXPORT unzGetFilePos64(unzFile file, unz64_file_pos*  file_pos)
+{
+    unz64_s* s;
+
+    if (file==NULL || file_pos==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+    if (!s->current_file_ok)
+        return UNZ_END_OF_LIST_OF_FILE;
+
+    file_pos->pos_in_zip_directory  = s->pos_in_central_dir;
+    file_pos->num_of_file           = s->num_file;
+
+    return UNZ_OK;
+}
+
+extern int ZEXPORT unzGetFilePos(
+    unzFile file,
+    unz_file_pos* file_pos)
+{
+    unz64_file_pos file_pos64;
+    int err = unzGetFilePos64(file,&file_pos64);
+    if (err==UNZ_OK)
+    {
+        file_pos->pos_in_zip_directory = (uLong)file_pos64.pos_in_zip_directory;
+        file_pos->num_of_file = (uLong)file_pos64.num_of_file;
+    }
+    return err;
+}
+
+extern int ZEXPORT unzGoToFilePos64(unzFile file, const unz64_file_pos* file_pos)
+{
+    unz64_s* s;
+    int err;
+
+    if (file==NULL || file_pos==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+
+    /* jump to the right spot */
+    s->pos_in_central_dir = file_pos->pos_in_zip_directory;
+    s->num_file           = file_pos->num_of_file;
+
+    /* set the current file */
+    err = unz64local_GetCurrentFileInfoInternal(file,&s->cur_file_info,
+                                               &s->cur_file_info_internal,
+                                               NULL,0,NULL,0,NULL,0);
+    /* return results */
+    s->current_file_ok = (err == UNZ_OK);
+    return err;
+}
+
+extern int ZEXPORT unzGoToFilePos(
+    unzFile file,
+    unz_file_pos* file_pos)
+{
+    unz64_file_pos file_pos64;
+    if (file_pos == NULL)
+        return UNZ_PARAMERROR;
+
+    file_pos64.pos_in_zip_directory = file_pos->pos_in_zip_directory;
+    file_pos64.num_of_file = file_pos->num_of_file;
+    return unzGoToFilePos64(file,&file_pos64);
+}
+
+/*
+// Unzip Helper Functions - should be here?
+///////////////////////////////////////////
+*/
+
+/*
+  Read the local header of the current zipfile
+  Check the coherency of the local header and info in the end of central
+        directory about this file
+  store in *piSizeVar the size of extra info in local header
+        (filename and size of extra field data)
+*/
+local int unz64local_CheckCurrentFileCoherencyHeader (unz64_s* s, uInt* piSizeVar,
+                                                    ZPOS64_T * poffset_local_extrafield,
+                                                    uInt  * psize_local_extrafield)
+{
+    uLong uMagic,uData,uFlags;
+    uLong size_filename;
+    uLong size_extra_field;
+    int err=UNZ_OK;
+
+    *piSizeVar = 0;
+    *poffset_local_extrafield = 0;
+    *psize_local_extrafield = 0;
+
+    if (ZSEEK64(s->z_filefunc, s->filestream,s->cur_file_info_internal.offset_curfile +
+                                s->byte_before_the_zipfile,ZLIB_FILEFUNC_SEEK_SET)!=0)
+        return UNZ_ERRNO;
+
+
+    if (err==UNZ_OK)
+    {
+        if (unz64local_getLong(&s->z_filefunc, s->filestream,&uMagic) != UNZ_OK)
+            err=UNZ_ERRNO;
+        else if (uMagic!=0x04034b50)
+            err=UNZ_BADZIPFILE;
+    }
+
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&uData) != UNZ_OK)
+        err=UNZ_ERRNO;
+/*
+    else if ((err==UNZ_OK) && (uData!=s->cur_file_info.wVersion))
+        err=UNZ_BADZIPFILE;
+*/
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&uFlags) != UNZ_OK)
+        err=UNZ_ERRNO;
+
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&uData) != UNZ_OK)
+        err=UNZ_ERRNO;
+    else if ((err==UNZ_OK) && (uData!=s->cur_file_info.compression_method))
+        err=UNZ_BADZIPFILE;
+
+    if ((err==UNZ_OK) && (s->cur_file_info.compression_method!=0) &&
+/* #ifdef HAVE_BZIP2 */
+                         (s->cur_file_info.compression_method!=Z_BZIP2ED) &&
+/* #endif */
+                         (s->cur_file_info.compression_method!=Z_DEFLATED))
+        err=UNZ_BADZIPFILE;
+
+    if (unz64local_getLong(&s->z_filefunc, s->filestream,&uData) != UNZ_OK) /* date/time */
+        err=UNZ_ERRNO;
+
+    if (unz64local_getLong(&s->z_filefunc, s->filestream,&uData) != UNZ_OK) /* crc */
+        err=UNZ_ERRNO;
+    else if ((err==UNZ_OK) && (uData!=s->cur_file_info.crc) && ((uFlags & 8)==0))
+        err=UNZ_BADZIPFILE;
+
+    if (unz64local_getLong(&s->z_filefunc, s->filestream,&uData) != UNZ_OK) /* size compr */
+        err=UNZ_ERRNO;
+    else if (uData != 0xFFFFFFFF && (err==UNZ_OK) && (uData!=s->cur_file_info.compressed_size) && ((uFlags & 8)==0))
+        err=UNZ_BADZIPFILE;
+
+    if (unz64local_getLong(&s->z_filefunc, s->filestream,&uData) != UNZ_OK) /* size uncompr */
+        err=UNZ_ERRNO;
+    else if (uData != 0xFFFFFFFF && (err==UNZ_OK) && (uData!=s->cur_file_info.uncompressed_size) && ((uFlags & 8)==0))
+        err=UNZ_BADZIPFILE;
+
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&size_filename) != UNZ_OK)
+        err=UNZ_ERRNO;
+    else if ((err==UNZ_OK) && (size_filename!=s->cur_file_info.size_filename))
+        err=UNZ_BADZIPFILE;
+
+    *piSizeVar += (uInt)size_filename;
+
+    if (unz64local_getShort(&s->z_filefunc, s->filestream,&size_extra_field) != UNZ_OK)
+        err=UNZ_ERRNO;
+    *poffset_local_extrafield= s->cur_file_info_internal.offset_curfile +
+                                    SIZEZIPLOCALHEADER + size_filename;
+    *psize_local_extrafield = (uInt)size_extra_field;
+
+    *piSizeVar += (uInt)size_extra_field;
+
+    return err;
+}
+
+/*
+  Open for reading data the current file in the zipfile.
+  If there is no error and the file is opened, the return value is UNZ_OK.
+*/
+extern int ZEXPORT unzOpenCurrentFile3 (unzFile file, int* method,
+                                            int* level, int raw, const char* password)
+{
+    int err=UNZ_OK;
+    uInt iSizeVar;
+    unz64_s* s;
+    file_in_zip64_read_info_s* pfile_in_zip_read_info;
+    ZPOS64_T offset_local_extrafield;  /* offset of the local extra field */
+    uInt  size_local_extrafield;    /* size of the local extra field */
+#    ifndef NOUNCRYPT
+    char source[12];
+#    else
+    if (password != NULL)
+        return UNZ_PARAMERROR;
+#    endif
+
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+    if (!s->current_file_ok)
+        return UNZ_PARAMERROR;
+
+    if (s->pfile_in_zip_read != NULL)
+        unzCloseCurrentFile(file);
+
+    if (unz64local_CheckCurrentFileCoherencyHeader(s,&iSizeVar, &offset_local_extrafield,&size_local_extrafield)!=UNZ_OK)
+        return UNZ_BADZIPFILE;
+
+    pfile_in_zip_read_info = (file_in_zip64_read_info_s*)ALLOC(sizeof(file_in_zip64_read_info_s));
+    if (pfile_in_zip_read_info==NULL)
+        return UNZ_INTERNALERROR;
+
+    pfile_in_zip_read_info->read_buffer=(char*)ALLOC(UNZ_BUFSIZE);
+    pfile_in_zip_read_info->offset_local_extrafield = offset_local_extrafield;
+    pfile_in_zip_read_info->size_local_extrafield = size_local_extrafield;
+    pfile_in_zip_read_info->pos_local_extrafield=0;
+    pfile_in_zip_read_info->raw=raw;
+
+    if (pfile_in_zip_read_info->read_buffer==NULL)
+    {
+        TRYFREE(pfile_in_zip_read_info);
+        return UNZ_INTERNALERROR;
+    }
+
+    pfile_in_zip_read_info->stream_initialised=0;
+
+    if (method!=NULL)
+        *method = (int)s->cur_file_info.compression_method;
+
+    if (level!=NULL)
+    {
+        *level = 6;
+        switch (s->cur_file_info.flag & 0x06)
+        {
+          case 6 : *level = 1; break;
+          case 4 : *level = 2; break;
+          case 2 : *level = 9; break;
+        }
+    }
+
+    if ((s->cur_file_info.compression_method!=0) &&
+/* #ifdef HAVE_BZIP2 */
+        (s->cur_file_info.compression_method!=Z_BZIP2ED) &&
+/* #endif */
+        (s->cur_file_info.compression_method!=Z_DEFLATED))
+
+        err=UNZ_BADZIPFILE;
+
+    pfile_in_zip_read_info->crc32_wait=s->cur_file_info.crc;
+    pfile_in_zip_read_info->crc32=0;
+    pfile_in_zip_read_info->total_out_64=0;
+    pfile_in_zip_read_info->compression_method = s->cur_file_info.compression_method;
+    pfile_in_zip_read_info->filestream=s->filestream;
+    pfile_in_zip_read_info->z_filefunc=s->z_filefunc;
+    pfile_in_zip_read_info->byte_before_the_zipfile=s->byte_before_the_zipfile;
+
+    pfile_in_zip_read_info->stream.total_out = 0;
+
+    if ((s->cur_file_info.compression_method==Z_BZIP2ED) && (!raw))
+    {
+#ifdef HAVE_BZIP2
+      pfile_in_zip_read_info->bstream.bzalloc = (void *(*) (void *, int, int))0;
+      pfile_in_zip_read_info->bstream.bzfree = (free_func)0;
+      pfile_in_zip_read_info->bstream.opaque = (voidpf)0;
+      pfile_in_zip_read_info->bstream.state = (voidpf)0;
+
+      pfile_in_zip_read_info->stream.zalloc = (alloc_func)0;
+      pfile_in_zip_read_info->stream.zfree = (free_func)0;
+      pfile_in_zip_read_info->stream.opaque = (voidpf)0;
+      pfile_in_zip_read_info->stream.next_in = (voidpf)0;
+      pfile_in_zip_read_info->stream.avail_in = 0;
+
+      err=BZ2_bzDecompressInit(&pfile_in_zip_read_info->bstream, 0, 0);
+      if (err == Z_OK)
+        pfile_in_zip_read_info->stream_initialised=Z_BZIP2ED;
+      else
+      {
+        TRYFREE(pfile_in_zip_read_info);
+        return err;
+      }
+#else
+      pfile_in_zip_read_info->raw=1;
+#endif
+    }
+    else if ((s->cur_file_info.compression_method==Z_DEFLATED) && (!raw))
+    {
+      pfile_in_zip_read_info->stream.zalloc = (alloc_func)0;
+      pfile_in_zip_read_info->stream.zfree = (free_func)0;
+      pfile_in_zip_read_info->stream.opaque = (voidpf)0;
+      pfile_in_zip_read_info->stream.next_in = 0;
+      pfile_in_zip_read_info->stream.avail_in = 0;
+
+      err=inflateInit2(&pfile_in_zip_read_info->stream, -MAX_WBITS);
+      if (err == Z_OK)
+        pfile_in_zip_read_info->stream_initialised=Z_DEFLATED;
+      else
+      {
+        TRYFREE(pfile_in_zip_read_info);
+        return err;
+      }
+        /* windowBits is passed < 0 to tell that there is no zlib header.
+         * Note that in this case inflate *requires* an extra "dummy" byte
+         * after the compressed stream in order to complete decompression and
+         * return Z_STREAM_END.
+         * In unzip, i don't wait absolutely Z_STREAM_END because I known the
+         * size of both compressed and uncompressed data
+         */
+    }
+    pfile_in_zip_read_info->rest_read_compressed =
+            s->cur_file_info.compressed_size ;
+    pfile_in_zip_read_info->rest_read_uncompressed =
+            s->cur_file_info.uncompressed_size ;
+
+
+    pfile_in_zip_read_info->pos_in_zipfile =
+            s->cur_file_info_internal.offset_curfile + SIZEZIPLOCALHEADER +
+              iSizeVar;
+
+    pfile_in_zip_read_info->stream.avail_in = (uInt)0;
+
+    s->pfile_in_zip_read = pfile_in_zip_read_info;
+                s->encrypted = 0;
+
+#    ifndef NOUNCRYPT
+    if (password != NULL)
+    {
+        int i;
+        s->pcrc_32_tab = get_crc_table();
+        init_keys(password,s->keys,s->pcrc_32_tab);
+        if (ZSEEK64(s->z_filefunc, s->filestream,
+                  s->pfile_in_zip_read->pos_in_zipfile +
+                     s->pfile_in_zip_read->byte_before_the_zipfile,
+                  SEEK_SET)!=0)
+            return UNZ_INTERNALERROR;
+        if(ZREAD64(s->z_filefunc, s->filestream,source, 12)<12)
+            return UNZ_INTERNALERROR;
+
+        for (i = 0; i<12; i++)
+            zdecode(s->keys,s->pcrc_32_tab,source[i]);
+
+        s->pfile_in_zip_read->pos_in_zipfile+=12;
+        s->pfile_in_zip_read->rest_read_compressed-=12;
+        s->encrypted=1;
+    }
+#    endif
+
+
+    return UNZ_OK;
+}
+
+extern int ZEXPORT unzOpenCurrentFile (unzFile file)
+{
+    return unzOpenCurrentFile3(file, NULL, NULL, 0, NULL);
+}
+
+extern int ZEXPORT unzOpenCurrentFilePassword (unzFile file, const char*  password)
+{
+    return unzOpenCurrentFile3(file, NULL, NULL, 0, password);
+}
+
+extern int ZEXPORT unzOpenCurrentFile2 (unzFile file, int* method, int* level, int raw)
+{
+    return unzOpenCurrentFile3(file, method, level, raw, NULL);
+}
+
+/** Addition for GDAL : START */
+
+extern ZPOS64_T ZEXPORT unzGetCurrentFileZStreamPos64( unzFile file)
+{
+    unz64_s* s;
+    file_in_zip64_read_info_s* pfile_in_zip_read_info;
+    s=(unz64_s*)file;
+    if (file==NULL)
+        return 0; //UNZ_PARAMERROR;
+    pfile_in_zip_read_info=s->pfile_in_zip_read;
+    if (pfile_in_zip_read_info==NULL)
+        return 0; //UNZ_PARAMERROR;
+    return pfile_in_zip_read_info->pos_in_zipfile +
+                         pfile_in_zip_read_info->byte_before_the_zipfile;
+}
+
+/** Addition for GDAL : END */
+
+/*
+  Read bytes from the current file.
+  buf contain buffer where data must be copied
+  len the size of buf.
+
+  return the number of byte copied if somes bytes are copied
+  return 0 if the end of file was reached
+  return <0 with error code if there is an error
+    (UNZ_ERRNO for IO error, or zLib error for uncompress error)
+*/
+extern int ZEXPORT unzReadCurrentFile  (unzFile file, voidp buf, unsigned len)
+{
+    int err=UNZ_OK;
+    uInt iRead = 0;
+    unz64_s* s;
+    file_in_zip64_read_info_s* pfile_in_zip_read_info;
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+    pfile_in_zip_read_info=s->pfile_in_zip_read;
+
+    if (pfile_in_zip_read_info==NULL)
+        return UNZ_PARAMERROR;
+
+
+    if (pfile_in_zip_read_info->read_buffer == NULL)
+        return UNZ_END_OF_LIST_OF_FILE;
+    if (len==0)
+        return 0;
+
+    pfile_in_zip_read_info->stream.next_out = (Bytef*)buf;
+
+    pfile_in_zip_read_info->stream.avail_out = (uInt)len;
+
+    if ((len>pfile_in_zip_read_info->rest_read_compressed+
+           pfile_in_zip_read_info->stream.avail_in) &&
+         (pfile_in_zip_read_info->raw))
+        pfile_in_zip_read_info->stream.avail_out =
+            (uInt)pfile_in_zip_read_info->rest_read_compressed+
+            pfile_in_zip_read_info->stream.avail_in;
+
+    while (pfile_in_zip_read_info->stream.avail_out>0)
+    {
+        if ((pfile_in_zip_read_info->stream.avail_in==0) &&
+            (pfile_in_zip_read_info->rest_read_compressed>0))
+        {
+            uInt uReadThis = UNZ_BUFSIZE;
+            if (pfile_in_zip_read_info->rest_read_compressed<uReadThis)
+                uReadThis = (uInt)pfile_in_zip_read_info->rest_read_compressed;
+            if (uReadThis == 0)
+                return UNZ_EOF;
+            if (ZSEEK64(pfile_in_zip_read_info->z_filefunc,
+                      pfile_in_zip_read_info->filestream,
+                      pfile_in_zip_read_info->pos_in_zipfile +
+                         pfile_in_zip_read_info->byte_before_the_zipfile,
+                         ZLIB_FILEFUNC_SEEK_SET)!=0)
+                return UNZ_ERRNO;
+            if (ZREAD64(pfile_in_zip_read_info->z_filefunc,
+                      pfile_in_zip_read_info->filestream,
+                      pfile_in_zip_read_info->read_buffer,
+                      uReadThis)!=uReadThis)
+                return UNZ_ERRNO;
+
+
+#            ifndef NOUNCRYPT
+            if(s->encrypted)
+            {
+                uInt i;
+                for(i=0;i<uReadThis;i++)
+                  pfile_in_zip_read_info->read_buffer[i] =
+                      zdecode(s->keys,s->pcrc_32_tab,
+                              pfile_in_zip_read_info->read_buffer[i]);
+            }
+#            endif
+
+
+            pfile_in_zip_read_info->pos_in_zipfile += uReadThis;
+
+            pfile_in_zip_read_info->rest_read_compressed-=uReadThis;
+
+            pfile_in_zip_read_info->stream.next_in =
+                (Bytef*)pfile_in_zip_read_info->read_buffer;
+            pfile_in_zip_read_info->stream.avail_in = (uInt)uReadThis;
+        }
+
+        if ((pfile_in_zip_read_info->compression_method==0) || (pfile_in_zip_read_info->raw))
+        {
+            uInt uDoCopy,i ;
+
+            if ((pfile_in_zip_read_info->stream.avail_in == 0) &&
+                (pfile_in_zip_read_info->rest_read_compressed == 0))
+                return (iRead==0) ? UNZ_EOF : iRead;
+
+            if (pfile_in_zip_read_info->stream.avail_out <
+                            pfile_in_zip_read_info->stream.avail_in)
+                uDoCopy = pfile_in_zip_read_info->stream.avail_out ;
+            else
+                uDoCopy = pfile_in_zip_read_info->stream.avail_in ;
+
+            for (i=0;i<uDoCopy;i++)
+                *(pfile_in_zip_read_info->stream.next_out+i) =
+                        *(pfile_in_zip_read_info->stream.next_in+i);
+
+            pfile_in_zip_read_info->total_out_64 = pfile_in_zip_read_info->total_out_64 + uDoCopy;
+
+            pfile_in_zip_read_info->crc32 = crc32(pfile_in_zip_read_info->crc32,
+                                pfile_in_zip_read_info->stream.next_out,
+                                uDoCopy);
+            pfile_in_zip_read_info->rest_read_uncompressed-=uDoCopy;
+            pfile_in_zip_read_info->stream.avail_in -= uDoCopy;
+            pfile_in_zip_read_info->stream.avail_out -= uDoCopy;
+            pfile_in_zip_read_info->stream.next_out += uDoCopy;
+            pfile_in_zip_read_info->stream.next_in += uDoCopy;
+            pfile_in_zip_read_info->stream.total_out += uDoCopy;
+            iRead += uDoCopy;
+        }
+        else if (pfile_in_zip_read_info->compression_method==Z_BZIP2ED)
+        {
+#ifdef HAVE_BZIP2
+            uLong uTotalOutBefore,uTotalOutAfter;
+            const Bytef *bufBefore;
+            uLong uOutThis;
+
+            pfile_in_zip_read_info->bstream.next_in        = (char*)pfile_in_zip_read_info->stream.next_in;
+            pfile_in_zip_read_info->bstream.avail_in       = pfile_in_zip_read_info->stream.avail_in;
+            pfile_in_zip_read_info->bstream.total_in_lo32  = pfile_in_zip_read_info->stream.total_in;
+            pfile_in_zip_read_info->bstream.total_in_hi32  = 0;
+            pfile_in_zip_read_info->bstream.next_out       = (char*)pfile_in_zip_read_info->stream.next_out;
+            pfile_in_zip_read_info->bstream.avail_out      = pfile_in_zip_read_info->stream.avail_out;
+            pfile_in_zip_read_info->bstream.total_out_lo32 = pfile_in_zip_read_info->stream.total_out;
+            pfile_in_zip_read_info->bstream.total_out_hi32 = 0;
+
+            uTotalOutBefore = pfile_in_zip_read_info->bstream.total_out_lo32;
+            bufBefore = (const Bytef *)pfile_in_zip_read_info->bstream.next_out;
+
+            err=BZ2_bzDecompress(&pfile_in_zip_read_info->bstream);
+
+            uTotalOutAfter = pfile_in_zip_read_info->bstream.total_out_lo32;
+            uOutThis = uTotalOutAfter-uTotalOutBefore;
+
+            pfile_in_zip_read_info->total_out_64 = pfile_in_zip_read_info->total_out_64 + uOutThis;
+
+            pfile_in_zip_read_info->crc32 = crc32(pfile_in_zip_read_info->crc32,bufBefore, (uInt)(uOutThis));
+            pfile_in_zip_read_info->rest_read_uncompressed -= uOutThis;
+            iRead += (uInt)(uTotalOutAfter - uTotalOutBefore);
+
+            pfile_in_zip_read_info->stream.next_in   = (Bytef*)pfile_in_zip_read_info->bstream.next_in;
+            pfile_in_zip_read_info->stream.avail_in  = pfile_in_zip_read_info->bstream.avail_in;
+            pfile_in_zip_read_info->stream.total_in  = pfile_in_zip_read_info->bstream.total_in_lo32;
+            pfile_in_zip_read_info->stream.next_out  = (Bytef*)pfile_in_zip_read_info->bstream.next_out;
+            pfile_in_zip_read_info->stream.avail_out = pfile_in_zip_read_info->bstream.avail_out;
+            pfile_in_zip_read_info->stream.total_out = pfile_in_zip_read_info->bstream.total_out_lo32;
+
+            if (err==BZ_STREAM_END)
+              return (iRead==0) ? UNZ_EOF : iRead;
+            if (err!=BZ_OK)
+              break;
+#endif
+        } // end Z_BZIP2ED
+        else
+        {
+            ZPOS64_T uTotalOutBefore,uTotalOutAfter;
+            const Bytef *bufBefore;
+            ZPOS64_T uOutThis;
+            int flush=Z_SYNC_FLUSH;
+
+            uTotalOutBefore = pfile_in_zip_read_info->stream.total_out;
+            bufBefore = pfile_in_zip_read_info->stream.next_out;
+
+            /*
+            if ((pfile_in_zip_read_info->rest_read_uncompressed ==
+                     pfile_in_zip_read_info->stream.avail_out) &&
+                (pfile_in_zip_read_info->rest_read_compressed == 0))
+                flush = Z_FINISH;
+            */
+            err=inflate(&pfile_in_zip_read_info->stream,flush);
+
+            if ((err>=0) && (pfile_in_zip_read_info->stream.msg!=NULL))
+              err = Z_DATA_ERROR;
+
+            uTotalOutAfter = pfile_in_zip_read_info->stream.total_out;
+            uOutThis = uTotalOutAfter-uTotalOutBefore;
+
+            pfile_in_zip_read_info->total_out_64 = pfile_in_zip_read_info->total_out_64 + uOutThis;
+
+            pfile_in_zip_read_info->crc32 =
+                crc32(pfile_in_zip_read_info->crc32,bufBefore,
+                        (uInt)(uOutThis));
+
+            pfile_in_zip_read_info->rest_read_uncompressed -=
+                uOutThis;
+
+            iRead += (uInt)(uTotalOutAfter - uTotalOutBefore);
+
+            if (err==Z_STREAM_END)
+                return (iRead==0) ? UNZ_EOF : iRead;
+            if (err!=Z_OK)
+                break;
+        }
+    }
+
+    if (err==Z_OK)
+        return iRead;
+    return err;
+}
+
+
+/*
+  Give the current position in uncompressed data
+*/
+extern z_off_t ZEXPORT unztell (unzFile file)
+{
+    unz64_s* s;
+    file_in_zip64_read_info_s* pfile_in_zip_read_info;
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+    pfile_in_zip_read_info=s->pfile_in_zip_read;
+
+    if (pfile_in_zip_read_info==NULL)
+        return UNZ_PARAMERROR;
+
+    return (z_off_t)pfile_in_zip_read_info->stream.total_out;
+}
+
+extern ZPOS64_T ZEXPORT unztell64 (unzFile file)
+{
+
+    unz64_s* s;
+    file_in_zip64_read_info_s* pfile_in_zip_read_info;
+    if (file==NULL)
+        return (ZPOS64_T)-1;
+    s=(unz64_s*)file;
+    pfile_in_zip_read_info=s->pfile_in_zip_read;
+
+    if (pfile_in_zip_read_info==NULL)
+        return (ZPOS64_T)-1;
+
+    return pfile_in_zip_read_info->total_out_64;
+}
+
+
+/*
+  return 1 if the end of file was reached, 0 elsewhere
+*/
+extern int ZEXPORT unzeof (unzFile file)
+{
+    unz64_s* s;
+    file_in_zip64_read_info_s* pfile_in_zip_read_info;
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+    pfile_in_zip_read_info=s->pfile_in_zip_read;
+
+    if (pfile_in_zip_read_info==NULL)
+        return UNZ_PARAMERROR;
+
+    if (pfile_in_zip_read_info->rest_read_uncompressed == 0)
+        return 1;
+    else
+        return 0;
+}
+
+
+
+/*
+Read extra field from the current file (opened by unzOpenCurrentFile)
+This is the local-header version of the extra field (sometimes, there is
+more info in the local-header version than in the central-header)
+
+  if buf==NULL, it return the size of the local extra field that can be read
+
+  if buf!=NULL, len is the size of the buffer, the extra header is copied in
+    buf.
+  the return value is the number of bytes copied in buf, or (if <0)
+    the error code
+*/
+extern int ZEXPORT unzGetLocalExtrafield (unzFile file, voidp buf, unsigned len)
+{
+    unz64_s* s;
+    file_in_zip64_read_info_s* pfile_in_zip_read_info;
+    uInt read_now;
+    ZPOS64_T size_to_read;
+
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+    pfile_in_zip_read_info=s->pfile_in_zip_read;
+
+    if (pfile_in_zip_read_info==NULL)
+        return UNZ_PARAMERROR;
+
+    size_to_read = (pfile_in_zip_read_info->size_local_extrafield -
+                pfile_in_zip_read_info->pos_local_extrafield);
+
+    if (buf==NULL)
+        return (int)size_to_read;
+
+    if (len>size_to_read)
+        read_now = (uInt)size_to_read;
+    else
+        read_now = (uInt)len ;
+
+    if (read_now==0)
+        return 0;
+
+    if (ZSEEK64(pfile_in_zip_read_info->z_filefunc,
+              pfile_in_zip_read_info->filestream,
+              pfile_in_zip_read_info->offset_local_extrafield +
+              pfile_in_zip_read_info->pos_local_extrafield,
+              ZLIB_FILEFUNC_SEEK_SET)!=0)
+        return UNZ_ERRNO;
+
+    if (ZREAD64(pfile_in_zip_read_info->z_filefunc,
+              pfile_in_zip_read_info->filestream,
+              buf,read_now)!=read_now)
+        return UNZ_ERRNO;
+
+    return (int)read_now;
+}
+
+/*
+  Close the file in zip opened with unzOpenCurrentFile
+  Return UNZ_CRCERROR if all the file was read but the CRC is not good
+*/
+extern int ZEXPORT unzCloseCurrentFile (unzFile file)
+{
+    int err=UNZ_OK;
+
+    unz64_s* s;
+    file_in_zip64_read_info_s* pfile_in_zip_read_info;
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+    pfile_in_zip_read_info=s->pfile_in_zip_read;
+
+    if (pfile_in_zip_read_info==NULL)
+        return UNZ_PARAMERROR;
+
+
+    if ((pfile_in_zip_read_info->rest_read_uncompressed == 0) &&
+        (!pfile_in_zip_read_info->raw))
+    {
+        if (pfile_in_zip_read_info->crc32 != pfile_in_zip_read_info->crc32_wait)
+            err=UNZ_CRCERROR;
+    }
+
+
+    TRYFREE(pfile_in_zip_read_info->read_buffer);
+    pfile_in_zip_read_info->read_buffer = NULL;
+    if (pfile_in_zip_read_info->stream_initialised == Z_DEFLATED)
+        inflateEnd(&pfile_in_zip_read_info->stream);
+#ifdef HAVE_BZIP2
+    else if (pfile_in_zip_read_info->stream_initialised == Z_BZIP2ED)
+        BZ2_bzDecompressEnd(&pfile_in_zip_read_info->bstream);
+#endif
+
+
+    pfile_in_zip_read_info->stream_initialised = 0;
+    TRYFREE(pfile_in_zip_read_info);
+
+    s->pfile_in_zip_read=NULL;
+
+    return err;
+}
+
+
+/*
+  Get the global comment string of the ZipFile, in the szComment buffer.
+  uSizeBuf is the size of the szComment buffer.
+  return the number of byte copied or an error code <0
+*/
+extern int ZEXPORT unzGetGlobalComment (unzFile file, char * szComment, uLong uSizeBuf)
+{
+    unz64_s* s;
+    uLong uReadThis ;
+    if (file==NULL)
+        return (int)UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+
+    uReadThis = uSizeBuf;
+    if (uReadThis>s->gi.size_comment)
+        uReadThis = s->gi.size_comment;
+
+    if (ZSEEK64(s->z_filefunc,s->filestream,s->central_pos+22,ZLIB_FILEFUNC_SEEK_SET)!=0)
+        return UNZ_ERRNO;
+
+    if (uReadThis>0)
+    {
+      *szComment='\0';
+      if (ZREAD64(s->z_filefunc,s->filestream,szComment,uReadThis)!=uReadThis)
+        return UNZ_ERRNO;
+    }
+
+    if ((szComment != NULL) && (uSizeBuf > s->gi.size_comment))
+        *(szComment+s->gi.size_comment)='\0';
+    return (int)uReadThis;
+}
+
+/* Additions by RX '2004 */
+extern ZPOS64_T ZEXPORT unzGetOffset64(unzFile file)
+{
+    unz64_s* s;
+
+    if (file==NULL)
+          return 0; //UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+    if (!s->current_file_ok)
+      return 0;
+    if (s->gi.number_entry != 0 && s->gi.number_entry != 0xffff)
+      if (s->num_file==s->gi.number_entry)
+         return 0;
+    return s->pos_in_central_dir;
+}
+
+extern uLong ZEXPORT unzGetOffset (unzFile file)
+{
+    ZPOS64_T offset64;
+
+    if (file==NULL)
+          return 0; //UNZ_PARAMERROR;
+    offset64 = unzGetOffset64(file);
+    return (uLong)offset64;
+}
+
+extern int ZEXPORT unzSetOffset64(unzFile file, ZPOS64_T pos)
+{
+    unz64_s* s;
+    int err;
+
+    if (file==NULL)
+        return UNZ_PARAMERROR;
+    s=(unz64_s*)file;
+
+    s->pos_in_central_dir = pos;
+    s->num_file = s->gi.number_entry;      /* hack */
+    err = unz64local_GetCurrentFileInfoInternal(file,&s->cur_file_info,
+                                              &s->cur_file_info_internal,
+                                              NULL,0,NULL,0,NULL,0);
+    s->current_file_ok = (err == UNZ_OK);
+    return err;
+}
+
+extern int ZEXPORT unzSetOffset (unzFile file, uLong pos)
+{
+    return unzSetOffset64(file,pos);
+}
diff --git a/deps/v8/third_party/zlib/contrib/minizip/unzip.h b/deps/v8/third_party/zlib/contrib/minizip/unzip.h
new file mode 100644
index 00000000000000..3c0143529b9144
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/unzip.h
@@ -0,0 +1,437 @@
+/* unzip.h -- IO for uncompress .zip files using zlib
+   Version 1.1, February 14h, 2010
+   part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Modifications of Unzip for Zip64
+         Copyright (C) 2007-2008 Even Rouault
+
+         Modifications for Zip64 support on both zip and unzip
+         Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com )
+
+         For more info read MiniZip_info.txt
+
+         ---------------------------------------------------------------------------------
+
+        Condition of use and distribution are the same than zlib :
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+  ---------------------------------------------------------------------------------
+
+        Changes
+
+        See header of unzip64.c
+
+*/
+
+#ifndef _unz64_H
+#define _unz64_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef _ZLIB_H
+#include "third_party/zlib/zlib.h"
+#endif
+
+#ifndef  _ZLIBIOAPI_H
+#include "ioapi.h"
+#endif
+
+#ifdef HAVE_BZIP2
+#include "bzlib.h"
+#endif
+
+#define Z_BZIP2ED 12
+
+#if defined(STRICTUNZIP) || defined(STRICTZIPUNZIP)
+/* like the STRICT of WIN32, we define a pointer that cannot be converted
+    from (void*) without cast */
+typedef struct TagunzFile__ { int unused; } unzFile__;
+typedef unzFile__ *unzFile;
+#else
+typedef voidp unzFile;
+#endif
+
+
+#define UNZ_OK                          (0)
+#define UNZ_END_OF_LIST_OF_FILE         (-100)
+#define UNZ_ERRNO                       (Z_ERRNO)
+#define UNZ_EOF                         (0)
+#define UNZ_PARAMERROR                  (-102)
+#define UNZ_BADZIPFILE                  (-103)
+#define UNZ_INTERNALERROR               (-104)
+#define UNZ_CRCERROR                    (-105)
+
+/* tm_unz contain date/time info */
+typedef struct tm_unz_s
+{
+    uInt tm_sec;            /* seconds after the minute - [0,59] */
+    uInt tm_min;            /* minutes after the hour - [0,59] */
+    uInt tm_hour;           /* hours since midnight - [0,23] */
+    uInt tm_mday;           /* day of the month - [1,31] */
+    uInt tm_mon;            /* months since January - [0,11] */
+    uInt tm_year;           /* years - [1980..2044] */
+} tm_unz;
+
+/* unz_global_info structure contain global data about the ZIPfile
+   These data comes from the end of central dir */
+typedef struct unz_global_info64_s
+{
+    ZPOS64_T number_entry;         /* total number of entries in
+                                     the central dir on this disk */
+    uLong size_comment;         /* size of the global comment of the zipfile */
+} unz_global_info64;
+
+typedef struct unz_global_info_s
+{
+    uLong number_entry;         /* total number of entries in
+                                     the central dir on this disk */
+    uLong size_comment;         /* size of the global comment of the zipfile */
+} unz_global_info;
+
+/* unz_file_info contain information about a file in the zipfile */
+typedef struct unz_file_info64_s
+{
+    uLong version;              /* version made by                 2 bytes */
+    uLong version_needed;       /* version needed to extract       2 bytes */
+    uLong flag;                 /* general purpose bit flag        2 bytes */
+    uLong compression_method;   /* compression method              2 bytes */
+    uLong dosDate;              /* last mod file date in Dos fmt   4 bytes */
+    uLong crc;                  /* crc-32                          4 bytes */
+    ZPOS64_T compressed_size;   /* compressed size                 8 bytes */
+    ZPOS64_T uncompressed_size; /* uncompressed size               8 bytes */
+    uLong size_filename;        /* filename length                 2 bytes */
+    uLong size_file_extra;      /* extra field length              2 bytes */
+    uLong size_file_comment;    /* file comment length             2 bytes */
+
+    uLong disk_num_start;       /* disk number start               2 bytes */
+    uLong internal_fa;          /* internal file attributes        2 bytes */
+    uLong external_fa;          /* external file attributes        4 bytes */
+
+    tm_unz tmu_date;
+} unz_file_info64;
+
+typedef struct unz_file_info_s
+{
+    uLong version;              /* version made by                 2 bytes */
+    uLong version_needed;       /* version needed to extract       2 bytes */
+    uLong flag;                 /* general purpose bit flag        2 bytes */
+    uLong compression_method;   /* compression method              2 bytes */
+    uLong dosDate;              /* last mod file date in Dos fmt   4 bytes */
+    uLong crc;                  /* crc-32                          4 bytes */
+    uLong compressed_size;      /* compressed size                 4 bytes */
+    uLong uncompressed_size;    /* uncompressed size               4 bytes */
+    uLong size_filename;        /* filename length                 2 bytes */
+    uLong size_file_extra;      /* extra field length              2 bytes */
+    uLong size_file_comment;    /* file comment length             2 bytes */
+
+    uLong disk_num_start;       /* disk number start               2 bytes */
+    uLong internal_fa;          /* internal file attributes        2 bytes */
+    uLong external_fa;          /* external file attributes        4 bytes */
+
+    tm_unz tmu_date;
+} unz_file_info;
+
+extern int ZEXPORT unzStringFileNameCompare OF ((const char* fileName1,
+                                                 const char* fileName2,
+                                                 int iCaseSensitivity));
+/*
+   Compare two filename (fileName1,fileName2).
+   If iCaseSenisivity = 1, comparision is case sensitivity (like strcmp)
+   If iCaseSenisivity = 2, comparision is not case sensitivity (like strcmpi
+                                or strcasecmp)
+   If iCaseSenisivity = 0, case sensitivity is defaut of your operating system
+    (like 1 on Unix, 2 on Windows)
+*/
+
+
+extern unzFile ZEXPORT unzOpen OF((const char *path));
+extern unzFile ZEXPORT unzOpen64 OF((const void *path));
+/*
+  Open a Zip file. path contain the full pathname (by example,
+     on a Windows XP computer "c:\\zlib\\zlib113.zip" or on an Unix computer
+     "zlib/zlib113.zip".
+     If the zipfile cannot be opened (file don't exist or in not valid), the
+       return value is NULL.
+     Else, the return value is a unzFile Handle, usable with other function
+       of this unzip package.
+     the "64" function take a const void* pointer, because the path is just the
+       value passed to the open64_file_func callback.
+     Under Windows, if UNICODE is defined, using fill_fopen64_filefunc, the path
+       is a pointer to a wide unicode string (LPCTSTR is LPCWSTR), so const char*
+       does not describe the reality
+*/
+
+
+extern unzFile ZEXPORT unzOpen2 OF((const char *path,
+                                    zlib_filefunc_def* pzlib_filefunc_def));
+/*
+   Open a Zip file, like unzOpen, but provide a set of file low level API
+      for read/write the zip file (see ioapi.h)
+*/
+
+extern unzFile ZEXPORT unzOpen2_64 OF((const void *path,
+                                    zlib_filefunc64_def* pzlib_filefunc_def));
+/*
+   Open a Zip file, like unz64Open, but provide a set of file low level API
+      for read/write the zip file (see ioapi.h)
+*/
+
+extern int ZEXPORT unzClose OF((unzFile file));
+/*
+  Close a ZipFile opened with unzOpen.
+  If there is files inside the .Zip opened with unzOpenCurrentFile (see later),
+    these files MUST be closed with unzCloseCurrentFile before call unzClose.
+  return UNZ_OK if there is no problem. */
+
+extern int ZEXPORT unzGetGlobalInfo OF((unzFile file,
+                                        unz_global_info *pglobal_info));
+
+extern int ZEXPORT unzGetGlobalInfo64 OF((unzFile file,
+                                        unz_global_info64 *pglobal_info));
+/*
+  Write info about the ZipFile in the *pglobal_info structure.
+  No preparation of the structure is needed
+  return UNZ_OK if there is no problem. */
+
+
+extern int ZEXPORT unzGetGlobalComment OF((unzFile file,
+                                           char *szComment,
+                                           uLong uSizeBuf));
+/*
+  Get the global comment string of the ZipFile, in the szComment buffer.
+  uSizeBuf is the size of the szComment buffer.
+  return the number of byte copied or an error code <0
+*/
+
+
+/***************************************************************************/
+/* Unzip package allow you browse the directory of the zipfile */
+
+extern int ZEXPORT unzGoToFirstFile OF((unzFile file));
+/*
+  Set the current file of the zipfile to the first file.
+  return UNZ_OK if there is no problem
+*/
+
+extern int ZEXPORT unzGoToNextFile OF((unzFile file));
+/*
+  Set the current file of the zipfile to the next file.
+  return UNZ_OK if there is no problem
+  return UNZ_END_OF_LIST_OF_FILE if the actual file was the latest.
+*/
+
+extern int ZEXPORT unzLocateFile OF((unzFile file,
+                     const char *szFileName,
+                     int iCaseSensitivity));
+/*
+  Try locate the file szFileName in the zipfile.
+  For the iCaseSensitivity signification, see unzStringFileNameCompare
+
+  return value :
+  UNZ_OK if the file is found. It becomes the current file.
+  UNZ_END_OF_LIST_OF_FILE if the file is not found
+*/
+
+
+/* ****************************************** */
+/* Ryan supplied functions */
+/* unz_file_info contain information about a file in the zipfile */
+typedef struct unz_file_pos_s
+{
+    uLong pos_in_zip_directory;   /* offset in zip file directory */
+    uLong num_of_file;            /* # of file */
+} unz_file_pos;
+
+extern int ZEXPORT unzGetFilePos(
+    unzFile file,
+    unz_file_pos* file_pos);
+
+extern int ZEXPORT unzGoToFilePos(
+    unzFile file,
+    unz_file_pos* file_pos);
+
+typedef struct unz64_file_pos_s
+{
+    ZPOS64_T pos_in_zip_directory;   /* offset in zip file directory */
+    ZPOS64_T num_of_file;            /* # of file */
+} unz64_file_pos;
+
+extern int ZEXPORT unzGetFilePos64(
+    unzFile file,
+    unz64_file_pos* file_pos);
+
+extern int ZEXPORT unzGoToFilePos64(
+    unzFile file,
+    const unz64_file_pos* file_pos);
+
+/* ****************************************** */
+
+extern int ZEXPORT unzGetCurrentFileInfo64 OF((unzFile file,
+                         unz_file_info64 *pfile_info,
+                         char *szFileName,
+                         uLong fileNameBufferSize,
+                         void *extraField,
+                         uLong extraFieldBufferSize,
+                         char *szComment,
+                         uLong commentBufferSize));
+
+extern int ZEXPORT unzGetCurrentFileInfo OF((unzFile file,
+                         unz_file_info *pfile_info,
+                         char *szFileName,
+                         uLong fileNameBufferSize,
+                         void *extraField,
+                         uLong extraFieldBufferSize,
+                         char *szComment,
+                         uLong commentBufferSize));
+/*
+  Get Info about the current file
+  if pfile_info!=NULL, the *pfile_info structure will contain somes info about
+        the current file
+  if szFileName!=NULL, the filemane string will be copied in szFileName
+            (fileNameBufferSize is the size of the buffer)
+  if extraField!=NULL, the extra field information will be copied in extraField
+            (extraFieldBufferSize is the size of the buffer).
+            This is the Central-header version of the extra field
+  if szComment!=NULL, the comment string of the file will be copied in szComment
+            (commentBufferSize is the size of the buffer)
+*/
+
+
+/** Addition for GDAL : START */
+
+extern ZPOS64_T ZEXPORT unzGetCurrentFileZStreamPos64 OF((unzFile file));
+
+/** Addition for GDAL : END */
+
+
+/***************************************************************************/
+/* for reading the content of the current zipfile, you can open it, read data
+   from it, and close it (you can close it before reading all the file)
+   */
+
+extern int ZEXPORT unzOpenCurrentFile OF((unzFile file));
+/*
+  Open for reading data the current file in the zipfile.
+  If there is no error, the return value is UNZ_OK.
+*/
+
+extern int ZEXPORT unzOpenCurrentFilePassword OF((unzFile file,
+                                                  const char* password));
+/*
+  Open for reading data the current file in the zipfile.
+  password is a crypting password
+  If there is no error, the return value is UNZ_OK.
+*/
+
+extern int ZEXPORT unzOpenCurrentFile2 OF((unzFile file,
+                                           int* method,
+                                           int* level,
+                                           int raw));
+/*
+  Same than unzOpenCurrentFile, but open for read raw the file (not uncompress)
+    if raw==1
+  *method will receive method of compression, *level will receive level of
+     compression
+  note : you can set level parameter as NULL (if you did not want known level,
+         but you CANNOT set method parameter as NULL
+*/
+
+extern int ZEXPORT unzOpenCurrentFile3 OF((unzFile file,
+                                           int* method,
+                                           int* level,
+                                           int raw,
+                                           const char* password));
+/*
+  Same than unzOpenCurrentFile, but open for read raw the file (not uncompress)
+    if raw==1
+  *method will receive method of compression, *level will receive level of
+     compression
+  note : you can set level parameter as NULL (if you did not want known level,
+         but you CANNOT set method parameter as NULL
+*/
+
+
+extern int ZEXPORT unzCloseCurrentFile OF((unzFile file));
+/*
+  Close the file in zip opened with unzOpenCurrentFile
+  Return UNZ_CRCERROR if all the file was read but the CRC is not good
+*/
+
+extern int ZEXPORT unzReadCurrentFile OF((unzFile file,
+                      voidp buf,
+                      unsigned len));
+/*
+  Read bytes from the current file (opened by unzOpenCurrentFile)
+  buf contain buffer where data must be copied
+  len the size of buf.
+
+  return the number of byte copied if somes bytes are copied
+  return 0 if the end of file was reached
+  return <0 with error code if there is an error
+    (UNZ_ERRNO for IO error, or zLib error for uncompress error)
+*/
+
+extern z_off_t ZEXPORT unztell OF((unzFile file));
+
+extern ZPOS64_T ZEXPORT unztell64 OF((unzFile file));
+/*
+  Give the current position in uncompressed data
+*/
+
+extern int ZEXPORT unzeof OF((unzFile file));
+/*
+  return 1 if the end of file was reached, 0 elsewhere
+*/
+
+extern int ZEXPORT unzGetLocalExtrafield OF((unzFile file,
+                                             voidp buf,
+                                             unsigned len));
+/*
+  Read extra field from the current file (opened by unzOpenCurrentFile)
+  This is the local-header version of the extra field (sometimes, there is
+    more info in the local-header version than in the central-header)
+
+  if buf==NULL, it return the size of the local extra field
+
+  if buf!=NULL, len is the size of the buffer, the extra header is copied in
+    buf.
+  the return value is the number of bytes copied in buf, or (if <0)
+    the error code
+*/
+
+/***************************************************************************/
+
+/* Get the current file offset */
+extern ZPOS64_T ZEXPORT unzGetOffset64 (unzFile file);
+extern uLong ZEXPORT unzGetOffset (unzFile file);
+
+/* Set the current file offset */
+extern int ZEXPORT unzSetOffset64 (unzFile file, ZPOS64_T pos);
+extern int ZEXPORT unzSetOffset (unzFile file, uLong pos);
+
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _unz64_H */
diff --git a/deps/v8/third_party/zlib/contrib/minizip/zip.c b/deps/v8/third_party/zlib/contrib/minizip/zip.c
new file mode 100644
index 00000000000000..65c0c7251843c0
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/zip.c
@@ -0,0 +1,2007 @@
+/* zip.c -- IO on .zip files using zlib
+   Version 1.1, February 14h, 2010
+   part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Modifications for Zip64 support
+         Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com )
+
+         For more info read MiniZip_info.txt
+
+         Changes
+   Oct-2009 - Mathias Svensson - Remove old C style function prototypes
+   Oct-2009 - Mathias Svensson - Added Zip64 Support when creating new file archives
+   Oct-2009 - Mathias Svensson - Did some code cleanup and refactoring to get better overview of some functions.
+   Oct-2009 - Mathias Svensson - Added zipRemoveExtraInfoBlock to strip extra field data from its ZIP64 data
+                                 It is used when recreting zip archive with RAW when deleting items from a zip.
+                                 ZIP64 data is automatically added to items that needs it, and existing ZIP64 data need to be removed.
+   Oct-2009 - Mathias Svensson - Added support for BZIP2 as compression mode (bzip2 lib is required)
+   Jan-2010 - back to unzip and minizip 1.0 name scheme, with compatibility layer
+
+*/
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include "third_party/zlib/zlib.h"
+#include "zip.h"
+
+#ifdef STDC
+#  include <stddef.h>
+#  include <string.h>
+#  include <stdlib.h>
+#endif
+#ifdef NO_ERRNO_H
+    extern int errno;
+#else
+#   include <errno.h>
+#endif
+
+
+#ifndef local
+#  define local static
+#endif
+/* compile with -Dlocal if your debugger can't find static symbols */
+
+#ifndef VERSIONMADEBY
+# define VERSIONMADEBY   (0x0) /* platform depedent */
+#endif
+
+#ifndef Z_BUFSIZE
+#define Z_BUFSIZE (64*1024) //(16384)
+#endif
+
+#ifndef Z_MAXFILENAMEINZIP
+#define Z_MAXFILENAMEINZIP (256)
+#endif
+
+#ifndef ALLOC
+# define ALLOC(size) (malloc(size))
+#endif
+#ifndef TRYFREE
+# define TRYFREE(p) {if (p) free(p);}
+#endif
+
+/*
+#define SIZECENTRALDIRITEM (0x2e)
+#define SIZEZIPLOCALHEADER (0x1e)
+*/
+
+/* I've found an old Unix (a SunOS 4.1.3_U1) without all SEEK_* defined.... */
+
+
+// NOT sure that this work on ALL platform
+#define MAKEULONG64(a, b) ((ZPOS64_T)(((unsigned long)(a)) | ((ZPOS64_T)((unsigned long)(b))) << 32))
+
+#ifndef SEEK_CUR
+#define SEEK_CUR    1
+#endif
+
+#ifndef SEEK_END
+#define SEEK_END    2
+#endif
+
+#ifndef SEEK_SET
+#define SEEK_SET    0
+#endif
+
+#ifndef DEF_MEM_LEVEL
+#if MAX_MEM_LEVEL >= 8
+#  define DEF_MEM_LEVEL 8
+#else
+#  define DEF_MEM_LEVEL  MAX_MEM_LEVEL
+#endif
+#endif
+const char zip_copyright[] =" zip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll";
+
+
+#define SIZEDATA_INDATABLOCK (4096-(4*4))
+
+#define LOCALHEADERMAGIC    (0x04034b50)
+#define CENTRALHEADERMAGIC  (0x02014b50)
+#define ENDHEADERMAGIC      (0x06054b50)
+#define ZIP64ENDHEADERMAGIC      (0x6064b50)
+#define ZIP64ENDLOCHEADERMAGIC   (0x7064b50)
+
+#define FLAG_LOCALHEADER_OFFSET (0x06)
+#define CRC_LOCALHEADER_OFFSET  (0x0e)
+
+#define SIZECENTRALHEADER (0x2e) /* 46 */
+
+typedef struct linkedlist_datablock_internal_s
+{
+  struct linkedlist_datablock_internal_s* next_datablock;
+  uLong  avail_in_this_block;
+  uLong  filled_in_this_block;
+  uLong  unused; /* for future use and alignment */
+  unsigned char data[SIZEDATA_INDATABLOCK];
+} linkedlist_datablock_internal;
+
+typedef struct linkedlist_data_s
+{
+    linkedlist_datablock_internal* first_block;
+    linkedlist_datablock_internal* last_block;
+} linkedlist_data;
+
+
+typedef struct
+{
+    z_stream stream;            /* zLib stream structure for inflate */
+#ifdef HAVE_BZIP2
+    bz_stream bstream;          /* bzLib stream structure for bziped */
+#endif
+
+    int  stream_initialised;    /* 1 is stream is initialised */
+    uInt pos_in_buffered_data;  /* last written byte in buffered_data */
+
+    ZPOS64_T pos_local_header;     /* offset of the local header of the file
+                                     currenty writing */
+    char* central_header;       /* central header data for the current file */
+    uLong size_centralExtra;
+    uLong size_centralheader;   /* size of the central header for cur file */
+    uLong size_centralExtraFree; /* Extra bytes allocated to the centralheader but that are not used */
+    uLong flag;                 /* flag of the file currently writing */
+
+    int  method;                /* compression method of file currenty wr.*/
+    int  raw;                   /* 1 for directly writing raw data */
+    Byte buffered_data[Z_BUFSIZE];/* buffer contain compressed data to be writ*/
+    uLong dosDate;
+    uLong crc32;
+    int  encrypt;
+    int  zip64;               /* Add ZIP64 extened information in the extra field */
+    ZPOS64_T pos_zip64extrainfo;
+    ZPOS64_T totalCompressedData;
+    ZPOS64_T totalUncompressedData;
+#ifndef NOCRYPT
+    unsigned long keys[3];     /* keys defining the pseudo-random sequence */
+    const z_crc_t* pcrc_32_tab;
+    int crypt_header_size;
+#endif
+} curfile64_info;
+
+typedef struct
+{
+    zlib_filefunc64_32_def z_filefunc;
+    voidpf filestream;        /* io structore of the zipfile */
+    linkedlist_data central_dir;/* datablock with central dir in construction*/
+    int  in_opened_file_inzip;  /* 1 if a file in the zip is currently writ.*/
+    curfile64_info ci;            /* info on the file curretly writing */
+
+    ZPOS64_T begin_pos;            /* position of the beginning of the zipfile */
+    ZPOS64_T add_position_when_writing_offset;
+    ZPOS64_T number_entry;
+
+#ifndef NO_ADDFILEINEXISTINGZIP
+    char *globalcomment;
+#endif
+
+} zip64_internal;
+
+
+#ifndef NOCRYPT
+#define INCLUDECRYPTINGCODE_IFCRYPTALLOWED
+#include "crypt.h"
+#endif
+
+local linkedlist_datablock_internal* allocate_new_datablock()
+{
+    linkedlist_datablock_internal* ldi;
+    ldi = (linkedlist_datablock_internal*)
+                 ALLOC(sizeof(linkedlist_datablock_internal));
+    if (ldi!=NULL)
+    {
+        ldi->next_datablock = NULL ;
+        ldi->filled_in_this_block = 0 ;
+        ldi->avail_in_this_block = SIZEDATA_INDATABLOCK ;
+    }
+    return ldi;
+}
+
+local void free_datablock(linkedlist_datablock_internal* ldi)
+{
+    while (ldi!=NULL)
+    {
+        linkedlist_datablock_internal* ldinext = ldi->next_datablock;
+        TRYFREE(ldi);
+        ldi = ldinext;
+    }
+}
+
+local void init_linkedlist(linkedlist_data* ll)
+{
+    ll->first_block = ll->last_block = NULL;
+}
+
+local void free_linkedlist(linkedlist_data* ll)
+{
+    free_datablock(ll->first_block);
+    ll->first_block = ll->last_block = NULL;
+}
+
+
+local int add_data_in_datablock(linkedlist_data* ll, const void* buf, uLong len)
+{
+    linkedlist_datablock_internal* ldi;
+    const unsigned char* from_copy;
+
+    if (ll==NULL)
+        return ZIP_INTERNALERROR;
+
+    if (ll->last_block == NULL)
+    {
+        ll->first_block = ll->last_block = allocate_new_datablock();
+        if (ll->first_block == NULL)
+            return ZIP_INTERNALERROR;
+    }
+
+    ldi = ll->last_block;
+    from_copy = (unsigned char*)buf;
+
+    while (len>0)
+    {
+        uInt copy_this;
+        uInt i;
+        unsigned char* to_copy;
+
+        if (ldi->avail_in_this_block==0)
+        {
+            ldi->next_datablock = allocate_new_datablock();
+            if (ldi->next_datablock == NULL)
+                return ZIP_INTERNALERROR;
+            ldi = ldi->next_datablock ;
+            ll->last_block = ldi;
+        }
+
+        if (ldi->avail_in_this_block < len)
+            copy_this = (uInt)ldi->avail_in_this_block;
+        else
+            copy_this = (uInt)len;
+
+        to_copy = &(ldi->data[ldi->filled_in_this_block]);
+
+        for (i=0;i<copy_this;i++)
+            *(to_copy+i)=*(from_copy+i);
+
+        ldi->filled_in_this_block += copy_this;
+        ldi->avail_in_this_block -= copy_this;
+        from_copy += copy_this ;
+        len -= copy_this;
+    }
+    return ZIP_OK;
+}
+
+
+
+/****************************************************************************/
+
+#ifndef NO_ADDFILEINEXISTINGZIP
+/* ===========================================================================
+   Inputs a long in LSB order to the given file
+   nbByte == 1, 2 ,4 or 8 (byte, short or long, ZPOS64_T)
+*/
+
+local int zip64local_putValue OF((const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream, ZPOS64_T x, int nbByte));
+local int zip64local_putValue (const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream, ZPOS64_T x, int nbByte)
+{
+    unsigned char buf[8];
+    int n;
+    for (n = 0; n < nbByte; n++)
+    {
+        buf[n] = (unsigned char)(x & 0xff);
+        x >>= 8;
+    }
+    if (x != 0)
+      {     /* data overflow - hack for ZIP64 (X Roche) */
+      for (n = 0; n < nbByte; n++)
+        {
+          buf[n] = 0xff;
+        }
+      }
+
+    if (ZWRITE64(*pzlib_filefunc_def,filestream,buf,nbByte)!=(uLong)nbByte)
+        return ZIP_ERRNO;
+    else
+        return ZIP_OK;
+}
+
+local void zip64local_putValue_inmemory OF((void* dest, ZPOS64_T x, int nbByte));
+local void zip64local_putValue_inmemory (void* dest, ZPOS64_T x, int nbByte)
+{
+    unsigned char* buf=(unsigned char*)dest;
+    int n;
+    for (n = 0; n < nbByte; n++) {
+        buf[n] = (unsigned char)(x & 0xff);
+        x >>= 8;
+    }
+
+    if (x != 0)
+    {     /* data overflow - hack for ZIP64 */
+       for (n = 0; n < nbByte; n++)
+       {
+          buf[n] = 0xff;
+       }
+    }
+}
+
+/****************************************************************************/
+
+
+local uLong zip64local_TmzDateToDosDate(const tm_zip* ptm)
+{
+    uLong year = (uLong)ptm->tm_year;
+    if (year>=1980)
+        year-=1980;
+    else if (year>=80)
+        year-=80;
+    return
+      (uLong) (((ptm->tm_mday) + (32 * (ptm->tm_mon+1)) + (512 * year)) << 16) |
+        ((ptm->tm_sec/2) + (32* ptm->tm_min) + (2048 * (uLong)ptm->tm_hour));
+}
+
+
+/****************************************************************************/
+
+local int zip64local_getByte OF((const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream, int *pi));
+
+local int zip64local_getByte(const zlib_filefunc64_32_def* pzlib_filefunc_def,voidpf filestream,int* pi)
+{
+    unsigned char c;
+    int err = (int)ZREAD64(*pzlib_filefunc_def,filestream,&c,1);
+    if (err==1)
+    {
+        *pi = (int)c;
+        return ZIP_OK;
+    }
+    else
+    {
+        if (ZERROR64(*pzlib_filefunc_def,filestream))
+            return ZIP_ERRNO;
+        else
+            return ZIP_EOF;
+    }
+}
+
+
+/* ===========================================================================
+   Reads a long in LSB order from the given gz_stream. Sets
+*/
+local int zip64local_getShort OF((const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream, uLong *pX));
+
+local int zip64local_getShort (const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream, uLong* pX)
+{
+    uLong x ;
+    int i = 0;
+    int err;
+
+    err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x = (uLong)i;
+
+    if (err==ZIP_OK)
+        err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x += ((uLong)i)<<8;
+
+    if (err==ZIP_OK)
+        *pX = x;
+    else
+        *pX = 0;
+    return err;
+}
+
+local int zip64local_getLong OF((const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream, uLong *pX));
+
+local int zip64local_getLong (const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream, uLong* pX)
+{
+    uLong x ;
+    int i = 0;
+    int err;
+
+    err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x = (uLong)i;
+
+    if (err==ZIP_OK)
+        err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x += ((uLong)i)<<8;
+
+    if (err==ZIP_OK)
+        err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x += ((uLong)i)<<16;
+
+    if (err==ZIP_OK)
+        err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+    x += ((uLong)i)<<24;
+
+    if (err==ZIP_OK)
+        *pX = x;
+    else
+        *pX = 0;
+    return err;
+}
+
+local int zip64local_getLong64 OF((const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream, ZPOS64_T *pX));
+
+
+local int zip64local_getLong64 (const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream, ZPOS64_T *pX)
+{
+  ZPOS64_T x;
+  int i = 0;
+  int err;
+
+  err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+  x = (ZPOS64_T)i;
+
+  if (err==ZIP_OK)
+    err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+  x += ((ZPOS64_T)i)<<8;
+
+  if (err==ZIP_OK)
+    err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+  x += ((ZPOS64_T)i)<<16;
+
+  if (err==ZIP_OK)
+    err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+  x += ((ZPOS64_T)i)<<24;
+
+  if (err==ZIP_OK)
+    err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+  x += ((ZPOS64_T)i)<<32;
+
+  if (err==ZIP_OK)
+    err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+  x += ((ZPOS64_T)i)<<40;
+
+  if (err==ZIP_OK)
+    err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+  x += ((ZPOS64_T)i)<<48;
+
+  if (err==ZIP_OK)
+    err = zip64local_getByte(pzlib_filefunc_def,filestream,&i);
+  x += ((ZPOS64_T)i)<<56;
+
+  if (err==ZIP_OK)
+    *pX = x;
+  else
+    *pX = 0;
+
+  return err;
+}
+
+#ifndef BUFREADCOMMENT
+#define BUFREADCOMMENT (0x400)
+#endif
+/*
+  Locate the Central directory of a zipfile (at the end, just before
+    the global comment)
+*/
+local ZPOS64_T zip64local_SearchCentralDir OF((const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream));
+
+local ZPOS64_T zip64local_SearchCentralDir(const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream)
+{
+  unsigned char* buf;
+  ZPOS64_T uSizeFile;
+  ZPOS64_T uBackRead;
+  ZPOS64_T uMaxBack=0xffff; /* maximum size of global comment */
+  ZPOS64_T uPosFound=0;
+
+  if (ZSEEK64(*pzlib_filefunc_def,filestream,0,ZLIB_FILEFUNC_SEEK_END) != 0)
+    return 0;
+
+
+  uSizeFile = ZTELL64(*pzlib_filefunc_def,filestream);
+
+  if (uMaxBack>uSizeFile)
+    uMaxBack = uSizeFile;
+
+  buf = (unsigned char*)ALLOC(BUFREADCOMMENT+4);
+  if (buf==NULL)
+    return 0;
+
+  uBackRead = 4;
+  while (uBackRead<uMaxBack)
+  {
+    uLong uReadSize;
+    ZPOS64_T uReadPos ;
+    int i;
+    if (uBackRead+BUFREADCOMMENT>uMaxBack)
+      uBackRead = uMaxBack;
+    else
+      uBackRead+=BUFREADCOMMENT;
+    uReadPos = uSizeFile-uBackRead ;
+
+    uReadSize = ((BUFREADCOMMENT+4) < (uSizeFile-uReadPos)) ?
+      (BUFREADCOMMENT+4) : (uLong)(uSizeFile-uReadPos);
+    if (ZSEEK64(*pzlib_filefunc_def,filestream,uReadPos,ZLIB_FILEFUNC_SEEK_SET)!=0)
+      break;
+
+    if (ZREAD64(*pzlib_filefunc_def,filestream,buf,uReadSize)!=uReadSize)
+      break;
+
+    for (i=(int)uReadSize-3; (i--)>0;)
+      if (((*(buf+i))==0x50) && ((*(buf+i+1))==0x4b) &&
+        ((*(buf+i+2))==0x05) && ((*(buf+i+3))==0x06))
+      {
+        uPosFound = uReadPos+i;
+        break;
+      }
+
+      if (uPosFound!=0)
+        break;
+  }
+  TRYFREE(buf);
+  return uPosFound;
+}
+
+/*
+Locate the End of Zip64 Central directory locator and from there find the CD of a zipfile (at the end, just before
+the global comment)
+*/
+local ZPOS64_T zip64local_SearchCentralDir64 OF((const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream));
+
+local ZPOS64_T zip64local_SearchCentralDir64(const zlib_filefunc64_32_def* pzlib_filefunc_def, voidpf filestream)
+{
+  unsigned char* buf;
+  ZPOS64_T uSizeFile;
+  ZPOS64_T uBackRead;
+  ZPOS64_T uMaxBack=0xffff; /* maximum size of global comment */
+  ZPOS64_T uPosFound=0;
+  uLong uL;
+  ZPOS64_T relativeOffset;
+
+  if (ZSEEK64(*pzlib_filefunc_def,filestream,0,ZLIB_FILEFUNC_SEEK_END) != 0)
+    return 0;
+
+  uSizeFile = ZTELL64(*pzlib_filefunc_def,filestream);
+
+  if (uMaxBack>uSizeFile)
+    uMaxBack = uSizeFile;
+
+  buf = (unsigned char*)ALLOC(BUFREADCOMMENT+4);
+  if (buf==NULL)
+    return 0;
+
+  uBackRead = 4;
+  while (uBackRead<uMaxBack)
+  {
+    uLong uReadSize;
+    ZPOS64_T uReadPos;
+    int i;
+    if (uBackRead+BUFREADCOMMENT>uMaxBack)
+      uBackRead = uMaxBack;
+    else
+      uBackRead+=BUFREADCOMMENT;
+    uReadPos = uSizeFile-uBackRead ;
+
+    uReadSize = ((BUFREADCOMMENT+4) < (uSizeFile-uReadPos)) ?
+      (BUFREADCOMMENT+4) : (uLong)(uSizeFile-uReadPos);
+    if (ZSEEK64(*pzlib_filefunc_def,filestream,uReadPos,ZLIB_FILEFUNC_SEEK_SET)!=0)
+      break;
+
+    if (ZREAD64(*pzlib_filefunc_def,filestream,buf,uReadSize)!=uReadSize)
+      break;
+
+    for (i=(int)uReadSize-3; (i--)>0;)
+    {
+      // Signature "0x07064b50" Zip64 end of central directory locater
+      if (((*(buf+i))==0x50) && ((*(buf+i+1))==0x4b) && ((*(buf+i+2))==0x06) && ((*(buf+i+3))==0x07))
+      {
+        uPosFound = uReadPos+i;
+        break;
+      }
+    }
+
+      if (uPosFound!=0)
+        break;
+  }
+
+  TRYFREE(buf);
+  if (uPosFound == 0)
+    return 0;
+
+  /* Zip64 end of central directory locator */
+  if (ZSEEK64(*pzlib_filefunc_def,filestream, uPosFound,ZLIB_FILEFUNC_SEEK_SET)!=0)
+    return 0;
+
+  /* the signature, already checked */
+  if (zip64local_getLong(pzlib_filefunc_def,filestream,&uL)!=ZIP_OK)
+    return 0;
+
+  /* number of the disk with the start of the zip64 end of  central directory */
+  if (zip64local_getLong(pzlib_filefunc_def,filestream,&uL)!=ZIP_OK)
+    return 0;
+  if (uL != 0)
+    return 0;
+
+  /* relative offset of the zip64 end of central directory record */
+  if (zip64local_getLong64(pzlib_filefunc_def,filestream,&relativeOffset)!=ZIP_OK)
+    return 0;
+
+  /* total number of disks */
+  if (zip64local_getLong(pzlib_filefunc_def,filestream,&uL)!=ZIP_OK)
+    return 0;
+  if (uL != 1)
+    return 0;
+
+  /* Goto Zip64 end of central directory record */
+  if (ZSEEK64(*pzlib_filefunc_def,filestream, relativeOffset,ZLIB_FILEFUNC_SEEK_SET)!=0)
+    return 0;
+
+  /* the signature */
+  if (zip64local_getLong(pzlib_filefunc_def,filestream,&uL)!=ZIP_OK)
+    return 0;
+
+  if (uL != 0x06064b50) // signature of 'Zip64 end of central directory'
+    return 0;
+
+  return relativeOffset;
+}
+
+int LoadCentralDirectoryRecord(zip64_internal* pziinit)
+{
+  int err=ZIP_OK;
+  ZPOS64_T byte_before_the_zipfile;/* byte before the zipfile, (>0 for sfx)*/
+
+  ZPOS64_T size_central_dir;     /* size of the central directory  */
+  ZPOS64_T offset_central_dir;   /* offset of start of central directory */
+  ZPOS64_T central_pos;
+  uLong uL;
+
+  uLong number_disk;          /* number of the current dist, used for
+                              spaning ZIP, unsupported, always 0*/
+  uLong number_disk_with_CD;  /* number the the disk with central dir, used
+                              for spaning ZIP, unsupported, always 0*/
+  ZPOS64_T number_entry;
+  ZPOS64_T number_entry_CD;      /* total number of entries in
+                                the central dir
+                                (same than number_entry on nospan) */
+  uLong VersionMadeBy;
+  uLong VersionNeeded;
+  uLong size_comment;
+
+  int hasZIP64Record = 0;
+
+  // check first if we find a ZIP64 record
+  central_pos = zip64local_SearchCentralDir64(&pziinit->z_filefunc,pziinit->filestream);
+  if(central_pos > 0)
+  {
+    hasZIP64Record = 1;
+  }
+  else if(central_pos == 0)
+  {
+    central_pos = zip64local_SearchCentralDir(&pziinit->z_filefunc,pziinit->filestream);
+  }
+
+/* disable to allow appending to empty ZIP archive
+        if (central_pos==0)
+            err=ZIP_ERRNO;
+*/
+
+  if(hasZIP64Record)
+  {
+    ZPOS64_T sizeEndOfCentralDirectory;
+    if (ZSEEK64(pziinit->z_filefunc, pziinit->filestream, central_pos, ZLIB_FILEFUNC_SEEK_SET) != 0)
+      err=ZIP_ERRNO;
+
+    /* the signature, already checked */
+    if (zip64local_getLong(&pziinit->z_filefunc, pziinit->filestream,&uL)!=ZIP_OK)
+      err=ZIP_ERRNO;
+
+    /* size of zip64 end of central directory record */
+    if (zip64local_getLong64(&pziinit->z_filefunc, pziinit->filestream, &sizeEndOfCentralDirectory)!=ZIP_OK)
+      err=ZIP_ERRNO;
+
+    /* version made by */
+    if (zip64local_getShort(&pziinit->z_filefunc, pziinit->filestream, &VersionMadeBy)!=ZIP_OK)
+      err=ZIP_ERRNO;
+
+    /* version needed to extract */
+    if (zip64local_getShort(&pziinit->z_filefunc, pziinit->filestream, &VersionNeeded)!=ZIP_OK)
+      err=ZIP_ERRNO;
+
+    /* number of this disk */
+    if (zip64local_getLong(&pziinit->z_filefunc, pziinit->filestream,&number_disk)!=ZIP_OK)
+      err=ZIP_ERRNO;
+
+    /* number of the disk with the start of the central directory */
+    if (zip64local_getLong(&pziinit->z_filefunc, pziinit->filestream,&number_disk_with_CD)!=ZIP_OK)
+      err=ZIP_ERRNO;
+
+    /* total number of entries in the central directory on this disk */
+    if (zip64local_getLong64(&pziinit->z_filefunc, pziinit->filestream, &number_entry)!=ZIP_OK)
+      err=ZIP_ERRNO;
+
+    /* total number of entries in the central directory */
+    if (zip64local_getLong64(&pziinit->z_filefunc, pziinit->filestream,&number_entry_CD)!=ZIP_OK)
+      err=ZIP_ERRNO;
+
+    if ((number_entry_CD!=number_entry) || (number_disk_with_CD!=0) || (number_disk!=0))
+      err=ZIP_BADZIPFILE;
+
+    /* size of the central directory */
+    if (zip64local_getLong64(&pziinit->z_filefunc, pziinit->filestream,&size_central_dir)!=ZIP_OK)
+      err=ZIP_ERRNO;
+
+    /* offset of start of central directory with respect to the
+    starting disk number */
+    if (zip64local_getLong64(&pziinit->z_filefunc, pziinit->filestream,&offset_central_dir)!=ZIP_OK)
+      err=ZIP_ERRNO;
+
+    // TODO..
+    // read the comment from the standard central header.
+    size_comment = 0;
+  }
+  else
+  {
+    // Read End of central Directory info
+    if (ZSEEK64(pziinit->z_filefunc, pziinit->filestream, central_pos,ZLIB_FILEFUNC_SEEK_SET)!=0)
+      err=ZIP_ERRNO;
+
+    /* the signature, already checked */
+    if (zip64local_getLong(&pziinit->z_filefunc, pziinit->filestream,&uL)!=ZIP_OK)
+      err=ZIP_ERRNO;
+
+    /* number of this disk */
+    if (zip64local_getShort(&pziinit->z_filefunc, pziinit->filestream,&number_disk)!=ZIP_OK)
+      err=ZIP_ERRNO;
+
+    /* number of the disk with the start of the central directory */
+    if (zip64local_getShort(&pziinit->z_filefunc, pziinit->filestream,&number_disk_with_CD)!=ZIP_OK)
+      err=ZIP_ERRNO;
+
+    /* total number of entries in the central dir on this disk */
+    number_entry = 0;
+    if (zip64local_getShort(&pziinit->z_filefunc, pziinit->filestream, &uL)!=ZIP_OK)
+      err=ZIP_ERRNO;
+    else
+      number_entry = uL;
+
+    /* total number of entries in the central dir */
+    number_entry_CD = 0;
+    if (zip64local_getShort(&pziinit->z_filefunc, pziinit->filestream, &uL)!=ZIP_OK)
+      err=ZIP_ERRNO;
+    else
+      number_entry_CD = uL;
+
+    if ((number_entry_CD!=number_entry) || (number_disk_with_CD!=0) || (number_disk!=0))
+      err=ZIP_BADZIPFILE;
+
+    /* size of the central directory */
+    size_central_dir = 0;
+    if (zip64local_getLong(&pziinit->z_filefunc, pziinit->filestream, &uL)!=ZIP_OK)
+      err=ZIP_ERRNO;
+    else
+      size_central_dir = uL;
+
+    /* offset of start of central directory with respect to the starting disk number */
+    offset_central_dir = 0;
+    if (zip64local_getLong(&pziinit->z_filefunc, pziinit->filestream, &uL)!=ZIP_OK)
+      err=ZIP_ERRNO;
+    else
+      offset_central_dir = uL;
+
+
+    /* zipfile global comment length */
+    if (zip64local_getShort(&pziinit->z_filefunc, pziinit->filestream, &size_comment)!=ZIP_OK)
+      err=ZIP_ERRNO;
+  }
+
+  if ((central_pos<offset_central_dir+size_central_dir) &&
+    (err==ZIP_OK))
+    err=ZIP_BADZIPFILE;
+
+  if (err!=ZIP_OK)
+  {
+    ZCLOSE64(pziinit->z_filefunc, pziinit->filestream);
+    return ZIP_ERRNO;
+  }
+
+  if (size_comment>0)
+  {
+    pziinit->globalcomment = (char*)ALLOC(size_comment+1);
+    if (pziinit->globalcomment)
+    {
+      size_comment = ZREAD64(pziinit->z_filefunc, pziinit->filestream, pziinit->globalcomment,size_comment);
+      pziinit->globalcomment[size_comment]=0;
+    }
+  }
+
+  byte_before_the_zipfile = central_pos - (offset_central_dir+size_central_dir);
+  pziinit->add_position_when_writing_offset = byte_before_the_zipfile;
+
+  {
+    ZPOS64_T size_central_dir_to_read = size_central_dir;
+    size_t buf_size = SIZEDATA_INDATABLOCK;
+    void* buf_read = (void*)ALLOC(buf_size);
+    if (ZSEEK64(pziinit->z_filefunc, pziinit->filestream, offset_central_dir + byte_before_the_zipfile, ZLIB_FILEFUNC_SEEK_SET) != 0)
+      err=ZIP_ERRNO;
+
+    while ((size_central_dir_to_read>0) && (err==ZIP_OK))
+    {
+      ZPOS64_T read_this = SIZEDATA_INDATABLOCK;
+      if (read_this > size_central_dir_to_read)
+        read_this = size_central_dir_to_read;
+
+      if (ZREAD64(pziinit->z_filefunc, pziinit->filestream,buf_read,(uLong)read_this) != read_this)
+        err=ZIP_ERRNO;
+
+      if (err==ZIP_OK)
+        err = add_data_in_datablock(&pziinit->central_dir,buf_read, (uLong)read_this);
+
+      size_central_dir_to_read-=read_this;
+    }
+    TRYFREE(buf_read);
+  }
+  pziinit->begin_pos = byte_before_the_zipfile;
+  pziinit->number_entry = number_entry_CD;
+
+  if (ZSEEK64(pziinit->z_filefunc, pziinit->filestream, offset_central_dir+byte_before_the_zipfile,ZLIB_FILEFUNC_SEEK_SET) != 0)
+    err=ZIP_ERRNO;
+
+  return err;
+}
+
+
+#endif /* !NO_ADDFILEINEXISTINGZIP*/
+
+
+/************************************************************/
+extern zipFile ZEXPORT zipOpen3 (const void *pathname, int append, zipcharpc* globalcomment, zlib_filefunc64_32_def* pzlib_filefunc64_32_def)
+{
+    zip64_internal ziinit;
+    zip64_internal* zi;
+    int err=ZIP_OK;
+
+    ziinit.z_filefunc.zseek32_file = NULL;
+    ziinit.z_filefunc.ztell32_file = NULL;
+    if (pzlib_filefunc64_32_def==NULL)
+        fill_fopen64_filefunc(&ziinit.z_filefunc.zfile_func64);
+    else
+        ziinit.z_filefunc = *pzlib_filefunc64_32_def;
+
+    ziinit.filestream = ZOPEN64(ziinit.z_filefunc,
+                  pathname,
+                  (append == APPEND_STATUS_CREATE) ?
+                  (ZLIB_FILEFUNC_MODE_READ | ZLIB_FILEFUNC_MODE_WRITE | ZLIB_FILEFUNC_MODE_CREATE) :
+                    (ZLIB_FILEFUNC_MODE_READ | ZLIB_FILEFUNC_MODE_WRITE | ZLIB_FILEFUNC_MODE_EXISTING));
+
+    if (ziinit.filestream == NULL)
+        return NULL;
+
+    if (append == APPEND_STATUS_CREATEAFTER)
+        ZSEEK64(ziinit.z_filefunc,ziinit.filestream,0,SEEK_END);
+
+    ziinit.begin_pos = ZTELL64(ziinit.z_filefunc,ziinit.filestream);
+    ziinit.in_opened_file_inzip = 0;
+    ziinit.ci.stream_initialised = 0;
+    ziinit.number_entry = 0;
+    ziinit.add_position_when_writing_offset = 0;
+    init_linkedlist(&(ziinit.central_dir));
+
+
+
+    zi = (zip64_internal*)ALLOC(sizeof(zip64_internal));
+    if (zi==NULL)
+    {
+        ZCLOSE64(ziinit.z_filefunc,ziinit.filestream);
+        return NULL;
+    }
+
+    /* now we add file in a zipfile */
+#    ifndef NO_ADDFILEINEXISTINGZIP
+    ziinit.globalcomment = NULL;
+    if (append == APPEND_STATUS_ADDINZIP)
+    {
+      // Read and Cache Central Directory Records
+      err = LoadCentralDirectoryRecord(&ziinit);
+    }
+
+    if (globalcomment)
+    {
+      *globalcomment = ziinit.globalcomment;
+    }
+#    endif /* !NO_ADDFILEINEXISTINGZIP*/
+
+    if (err != ZIP_OK)
+    {
+#    ifndef NO_ADDFILEINEXISTINGZIP
+        TRYFREE(ziinit.globalcomment);
+#    endif /* !NO_ADDFILEINEXISTINGZIP*/
+        TRYFREE(zi);
+        return NULL;
+    }
+    else
+    {
+        *zi = ziinit;
+        return (zipFile)zi;
+    }
+}
+
+extern zipFile ZEXPORT zipOpen2 (const char *pathname, int append, zipcharpc* globalcomment, zlib_filefunc_def* pzlib_filefunc32_def)
+{
+    if (pzlib_filefunc32_def != NULL)
+    {
+        zlib_filefunc64_32_def zlib_filefunc64_32_def_fill;
+        fill_zlib_filefunc64_32_def_from_filefunc32(&zlib_filefunc64_32_def_fill,pzlib_filefunc32_def);
+        return zipOpen3(pathname, append, globalcomment, &zlib_filefunc64_32_def_fill);
+    }
+    else
+        return zipOpen3(pathname, append, globalcomment, NULL);
+}
+
+extern zipFile ZEXPORT zipOpen2_64 (const void *pathname, int append, zipcharpc* globalcomment, zlib_filefunc64_def* pzlib_filefunc_def)
+{
+    if (pzlib_filefunc_def != NULL)
+    {
+        zlib_filefunc64_32_def zlib_filefunc64_32_def_fill;
+        zlib_filefunc64_32_def_fill.zfile_func64 = *pzlib_filefunc_def;
+        zlib_filefunc64_32_def_fill.ztell32_file = NULL;
+        zlib_filefunc64_32_def_fill.zseek32_file = NULL;
+        return zipOpen3(pathname, append, globalcomment, &zlib_filefunc64_32_def_fill);
+    }
+    else
+        return zipOpen3(pathname, append, globalcomment, NULL);
+}
+
+
+
+extern zipFile ZEXPORT zipOpen (const char* pathname, int append)
+{
+    return zipOpen3((const void*)pathname,append,NULL,NULL);
+}
+
+extern zipFile ZEXPORT zipOpen64 (const void* pathname, int append)
+{
+    return zipOpen3(pathname,append,NULL,NULL);
+}
+
+int Write_LocalFileHeader(zip64_internal* zi, const char* filename, uInt size_extrafield_local, const void* extrafield_local)
+{
+  /* write the local header */
+  int err;
+  uInt size_filename = (uInt)strlen(filename);
+  uInt size_extrafield = size_extrafield_local;
+
+  err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)LOCALHEADERMAGIC, 4);
+
+  if (err==ZIP_OK)
+  {
+    if(zi->ci.zip64)
+      err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)45,2);/* version needed to extract */
+    else
+      err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)20,2);/* version needed to extract */
+  }
+
+  if (err==ZIP_OK)
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)zi->ci.flag,2);
+
+  if (err==ZIP_OK)
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)zi->ci.method,2);
+
+  if (err==ZIP_OK)
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)zi->ci.dosDate,4);
+
+  // CRC / Compressed size / Uncompressed size will be filled in later and rewritten later
+  if (err==ZIP_OK)
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)0,4); /* crc 32, unknown */
+  if (err==ZIP_OK)
+  {
+    if(zi->ci.zip64)
+      err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)0xFFFFFFFF,4); /* compressed size, unknown */
+    else
+      err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)0,4); /* compressed size, unknown */
+  }
+  if (err==ZIP_OK)
+  {
+    if(zi->ci.zip64)
+      err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)0xFFFFFFFF,4); /* uncompressed size, unknown */
+    else
+      err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)0,4); /* uncompressed size, unknown */
+  }
+
+  if (err==ZIP_OK)
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)size_filename,2);
+
+  if(zi->ci.zip64)
+  {
+    size_extrafield += 20;
+  }
+
+  if (err==ZIP_OK)
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)size_extrafield,2);
+
+  if ((err==ZIP_OK) && (size_filename > 0))
+  {
+    if (ZWRITE64(zi->z_filefunc,zi->filestream,filename,size_filename)!=size_filename)
+      err = ZIP_ERRNO;
+  }
+
+  if ((err==ZIP_OK) && (size_extrafield_local > 0))
+  {
+    if (ZWRITE64(zi->z_filefunc, zi->filestream, extrafield_local, size_extrafield_local) != size_extrafield_local)
+      err = ZIP_ERRNO;
+  }
+
+
+  if ((err==ZIP_OK) && (zi->ci.zip64))
+  {
+      // write the Zip64 extended info
+      short HeaderID = 1;
+      short DataSize = 16;
+      ZPOS64_T CompressedSize = 0;
+      ZPOS64_T UncompressedSize = 0;
+
+      // Remember position of Zip64 extended info for the local file header. (needed when we update size after done with file)
+      zi->ci.pos_zip64extrainfo = ZTELL64(zi->z_filefunc,zi->filestream);
+
+      err = zip64local_putValue(&zi->z_filefunc, zi->filestream, (short)HeaderID,2);
+      err = zip64local_putValue(&zi->z_filefunc, zi->filestream, (short)DataSize,2);
+
+      err = zip64local_putValue(&zi->z_filefunc, zi->filestream, (ZPOS64_T)UncompressedSize,8);
+      err = zip64local_putValue(&zi->z_filefunc, zi->filestream, (ZPOS64_T)CompressedSize,8);
+  }
+
+  return err;
+}
+
+/*
+ NOTE.
+ When writing RAW the ZIP64 extended information in extrafield_local and extrafield_global needs to be stripped
+ before calling this function it can be done with zipRemoveExtraInfoBlock
+
+ It is not done here because then we need to realloc a new buffer since parameters are 'const' and I want to minimize
+ unnecessary allocations.
+ */
+extern int ZEXPORT zipOpenNewFileInZip4_64 (zipFile file, const char* filename, const zip_fileinfo* zipfi,
+                                         const void* extrafield_local, uInt size_extrafield_local,
+                                         const void* extrafield_global, uInt size_extrafield_global,
+                                         const char* comment, int method, int level, int raw,
+                                         int windowBits,int memLevel, int strategy,
+                                         const char* password, uLong crcForCrypting,
+                                         uLong versionMadeBy, uLong flagBase, int zip64)
+{
+    zip64_internal* zi;
+    uInt size_filename;
+    uInt size_comment;
+    uInt i;
+    int err = ZIP_OK;
+
+#    ifdef NOCRYPT
+    (crcForCrypting);
+    if (password != NULL)
+        return ZIP_PARAMERROR;
+#    endif
+
+    if (file == NULL)
+        return ZIP_PARAMERROR;
+
+#ifdef HAVE_BZIP2
+    if ((method!=0) && (method!=Z_DEFLATED) && (method!=Z_BZIP2ED))
+      return ZIP_PARAMERROR;
+#else
+    if ((method!=0) && (method!=Z_DEFLATED))
+      return ZIP_PARAMERROR;
+#endif
+
+    zi = (zip64_internal*)file;
+
+    if (zi->in_opened_file_inzip == 1)
+    {
+        err = zipCloseFileInZip (file);
+        if (err != ZIP_OK)
+            return err;
+    }
+
+    if (filename==NULL)
+        filename="-";
+
+    if (comment==NULL)
+        size_comment = 0;
+    else
+        size_comment = (uInt)strlen(comment);
+
+    size_filename = (uInt)strlen(filename);
+
+    if (zipfi == NULL)
+        zi->ci.dosDate = 0;
+    else
+    {
+        if (zipfi->dosDate != 0)
+            zi->ci.dosDate = zipfi->dosDate;
+        else
+          zi->ci.dosDate = zip64local_TmzDateToDosDate(&zipfi->tmz_date);
+    }
+
+    zi->ci.flag = flagBase;
+    if ((level==8) || (level==9))
+      zi->ci.flag |= 2;
+    if (level==2)
+      zi->ci.flag |= 4;
+    if (level==1)
+      zi->ci.flag |= 6;
+    if (password != NULL)
+      zi->ci.flag |= 1;
+
+    zi->ci.crc32 = 0;
+    zi->ci.method = method;
+    zi->ci.encrypt = 0;
+    zi->ci.stream_initialised = 0;
+    zi->ci.pos_in_buffered_data = 0;
+    zi->ci.raw = raw;
+    zi->ci.pos_local_header = ZTELL64(zi->z_filefunc,zi->filestream);
+
+    zi->ci.size_centralheader = SIZECENTRALHEADER + size_filename + size_extrafield_global + size_comment;
+    zi->ci.size_centralExtraFree = 32; // Extra space we have reserved in case we need to add ZIP64 extra info data
+
+    zi->ci.central_header = (char*)ALLOC((uInt)zi->ci.size_centralheader + zi->ci.size_centralExtraFree);
+
+    zi->ci.size_centralExtra = size_extrafield_global;
+    zip64local_putValue_inmemory(zi->ci.central_header,(uLong)CENTRALHEADERMAGIC,4);
+    /* version info */
+    zip64local_putValue_inmemory(zi->ci.central_header+4,(uLong)versionMadeBy,2);
+    zip64local_putValue_inmemory(zi->ci.central_header+6,(uLong)20,2);
+    zip64local_putValue_inmemory(zi->ci.central_header+8,(uLong)zi->ci.flag,2);
+    zip64local_putValue_inmemory(zi->ci.central_header+10,(uLong)zi->ci.method,2);
+    zip64local_putValue_inmemory(zi->ci.central_header+12,(uLong)zi->ci.dosDate,4);
+    zip64local_putValue_inmemory(zi->ci.central_header+16,(uLong)0,4); /*crc*/
+    zip64local_putValue_inmemory(zi->ci.central_header+20,(uLong)0,4); /*compr size*/
+    zip64local_putValue_inmemory(zi->ci.central_header+24,(uLong)0,4); /*uncompr size*/
+    zip64local_putValue_inmemory(zi->ci.central_header+28,(uLong)size_filename,2);
+    zip64local_putValue_inmemory(zi->ci.central_header+30,(uLong)size_extrafield_global,2);
+    zip64local_putValue_inmemory(zi->ci.central_header+32,(uLong)size_comment,2);
+    zip64local_putValue_inmemory(zi->ci.central_header+34,(uLong)0,2); /*disk nm start*/
+
+    if (zipfi==NULL)
+        zip64local_putValue_inmemory(zi->ci.central_header+36,(uLong)0,2);
+    else
+        zip64local_putValue_inmemory(zi->ci.central_header+36,(uLong)zipfi->internal_fa,2);
+
+    if (zipfi==NULL)
+        zip64local_putValue_inmemory(zi->ci.central_header+38,(uLong)0,4);
+    else
+        zip64local_putValue_inmemory(zi->ci.central_header+38,(uLong)zipfi->external_fa,4);
+
+    if(zi->ci.pos_local_header >= 0xffffffff)
+      zip64local_putValue_inmemory(zi->ci.central_header+42,(uLong)0xffffffff,4);
+    else
+      zip64local_putValue_inmemory(zi->ci.central_header+42,(uLong)zi->ci.pos_local_header - zi->add_position_when_writing_offset,4);
+
+    for (i=0;i<size_filename;i++)
+        *(zi->ci.central_header+SIZECENTRALHEADER+i) = *(filename+i);
+
+    for (i=0;i<size_extrafield_global;i++)
+        *(zi->ci.central_header+SIZECENTRALHEADER+size_filename+i) =
+              *(((const char*)extrafield_global)+i);
+
+    for (i=0;i<size_comment;i++)
+        *(zi->ci.central_header+SIZECENTRALHEADER+size_filename+
+              size_extrafield_global+i) = *(comment+i);
+    if (zi->ci.central_header == NULL)
+        return ZIP_INTERNALERROR;
+
+    zi->ci.zip64 = zip64;
+    zi->ci.totalCompressedData = 0;
+    zi->ci.totalUncompressedData = 0;
+    zi->ci.pos_zip64extrainfo = 0;
+
+    err = Write_LocalFileHeader(zi, filename, size_extrafield_local, extrafield_local);
+
+#ifdef HAVE_BZIP2
+    zi->ci.bstream.avail_in = (uInt)0;
+    zi->ci.bstream.avail_out = (uInt)Z_BUFSIZE;
+    zi->ci.bstream.next_out = (char*)zi->ci.buffered_data;
+    zi->ci.bstream.total_in_hi32 = 0;
+    zi->ci.bstream.total_in_lo32 = 0;
+    zi->ci.bstream.total_out_hi32 = 0;
+    zi->ci.bstream.total_out_lo32 = 0;
+#endif
+
+    zi->ci.stream.avail_in = (uInt)0;
+    zi->ci.stream.avail_out = (uInt)Z_BUFSIZE;
+    zi->ci.stream.next_out = zi->ci.buffered_data;
+    zi->ci.stream.total_in = 0;
+    zi->ci.stream.total_out = 0;
+    zi->ci.stream.data_type = Z_BINARY;
+
+#ifdef HAVE_BZIP2
+    if ((err==ZIP_OK) && (zi->ci.method == Z_DEFLATED || zi->ci.method == Z_BZIP2ED) && (!zi->ci.raw))
+#else
+    if ((err==ZIP_OK) && (zi->ci.method == Z_DEFLATED) && (!zi->ci.raw))
+#endif
+    {
+        if(zi->ci.method == Z_DEFLATED)
+        {
+          zi->ci.stream.zalloc = (alloc_func)0;
+          zi->ci.stream.zfree = (free_func)0;
+          zi->ci.stream.opaque = (voidpf)0;
+
+          if (windowBits>0)
+              windowBits = -windowBits;
+
+          err = deflateInit2(&zi->ci.stream, level, Z_DEFLATED, windowBits, memLevel, strategy);
+
+          if (err==Z_OK)
+              zi->ci.stream_initialised = Z_DEFLATED;
+        }
+        else if(zi->ci.method == Z_BZIP2ED)
+        {
+#ifdef HAVE_BZIP2
+            // Init BZip stuff here
+          zi->ci.bstream.bzalloc = 0;
+          zi->ci.bstream.bzfree = 0;
+          zi->ci.bstream.opaque = (voidpf)0;
+
+          err = BZ2_bzCompressInit(&zi->ci.bstream, level, 0,35);
+          if(err == BZ_OK)
+            zi->ci.stream_initialised = Z_BZIP2ED;
+#endif
+        }
+
+    }
+
+#    ifndef NOCRYPT
+    zi->ci.crypt_header_size = 0;
+    if ((err==Z_OK) && (password != NULL))
+    {
+        unsigned char bufHead[RAND_HEAD_LEN];
+        unsigned int sizeHead;
+        zi->ci.encrypt = 1;
+        zi->ci.pcrc_32_tab = get_crc_table();
+        /*init_keys(password,zi->ci.keys,zi->ci.pcrc_32_tab);*/
+
+        sizeHead=crypthead(password,bufHead,RAND_HEAD_LEN,zi->ci.keys,zi->ci.pcrc_32_tab,crcForCrypting);
+        zi->ci.crypt_header_size = sizeHead;
+
+        if (ZWRITE64(zi->z_filefunc,zi->filestream,bufHead,sizeHead) != sizeHead)
+                err = ZIP_ERRNO;
+    }
+#    endif
+
+    if (err==Z_OK)
+        zi->in_opened_file_inzip = 1;
+    return err;
+}
+
+extern int ZEXPORT zipOpenNewFileInZip4 (zipFile file, const char* filename, const zip_fileinfo* zipfi,
+                                         const void* extrafield_local, uInt size_extrafield_local,
+                                         const void* extrafield_global, uInt size_extrafield_global,
+                                         const char* comment, int method, int level, int raw,
+                                         int windowBits,int memLevel, int strategy,
+                                         const char* password, uLong crcForCrypting,
+                                         uLong versionMadeBy, uLong flagBase)
+{
+    return zipOpenNewFileInZip4_64 (file, filename, zipfi,
+                                 extrafield_local, size_extrafield_local,
+                                 extrafield_global, size_extrafield_global,
+                                 comment, method, level, raw,
+                                 windowBits, memLevel, strategy,
+                                 password, crcForCrypting, versionMadeBy, flagBase, 0);
+}
+
+extern int ZEXPORT zipOpenNewFileInZip3 (zipFile file, const char* filename, const zip_fileinfo* zipfi,
+                                         const void* extrafield_local, uInt size_extrafield_local,
+                                         const void* extrafield_global, uInt size_extrafield_global,
+                                         const char* comment, int method, int level, int raw,
+                                         int windowBits,int memLevel, int strategy,
+                                         const char* password, uLong crcForCrypting)
+{
+    return zipOpenNewFileInZip4_64 (file, filename, zipfi,
+                                 extrafield_local, size_extrafield_local,
+                                 extrafield_global, size_extrafield_global,
+                                 comment, method, level, raw,
+                                 windowBits, memLevel, strategy,
+                                 password, crcForCrypting, VERSIONMADEBY, 0, 0);
+}
+
+extern int ZEXPORT zipOpenNewFileInZip3_64(zipFile file, const char* filename, const zip_fileinfo* zipfi,
+                                         const void* extrafield_local, uInt size_extrafield_local,
+                                         const void* extrafield_global, uInt size_extrafield_global,
+                                         const char* comment, int method, int level, int raw,
+                                         int windowBits,int memLevel, int strategy,
+                                         const char* password, uLong crcForCrypting, int zip64)
+{
+    return zipOpenNewFileInZip4_64 (file, filename, zipfi,
+                                 extrafield_local, size_extrafield_local,
+                                 extrafield_global, size_extrafield_global,
+                                 comment, method, level, raw,
+                                 windowBits, memLevel, strategy,
+                                 password, crcForCrypting, VERSIONMADEBY, 0, zip64);
+}
+
+extern int ZEXPORT zipOpenNewFileInZip2(zipFile file, const char* filename, const zip_fileinfo* zipfi,
+                                        const void* extrafield_local, uInt size_extrafield_local,
+                                        const void* extrafield_global, uInt size_extrafield_global,
+                                        const char* comment, int method, int level, int raw)
+{
+    return zipOpenNewFileInZip4_64 (file, filename, zipfi,
+                                 extrafield_local, size_extrafield_local,
+                                 extrafield_global, size_extrafield_global,
+                                 comment, method, level, raw,
+                                 -MAX_WBITS, DEF_MEM_LEVEL, Z_DEFAULT_STRATEGY,
+                                 NULL, 0, VERSIONMADEBY, 0, 0);
+}
+
+extern int ZEXPORT zipOpenNewFileInZip2_64(zipFile file, const char* filename, const zip_fileinfo* zipfi,
+                                        const void* extrafield_local, uInt size_extrafield_local,
+                                        const void* extrafield_global, uInt size_extrafield_global,
+                                        const char* comment, int method, int level, int raw, int zip64)
+{
+    return zipOpenNewFileInZip4_64 (file, filename, zipfi,
+                                 extrafield_local, size_extrafield_local,
+                                 extrafield_global, size_extrafield_global,
+                                 comment, method, level, raw,
+                                 -MAX_WBITS, DEF_MEM_LEVEL, Z_DEFAULT_STRATEGY,
+                                 NULL, 0, VERSIONMADEBY, 0, zip64);
+}
+
+extern int ZEXPORT zipOpenNewFileInZip64 (zipFile file, const char* filename, const zip_fileinfo* zipfi,
+                                        const void* extrafield_local, uInt size_extrafield_local,
+                                        const void*extrafield_global, uInt size_extrafield_global,
+                                        const char* comment, int method, int level, int zip64)
+{
+    return zipOpenNewFileInZip4_64 (file, filename, zipfi,
+                                 extrafield_local, size_extrafield_local,
+                                 extrafield_global, size_extrafield_global,
+                                 comment, method, level, 0,
+                                 -MAX_WBITS, DEF_MEM_LEVEL, Z_DEFAULT_STRATEGY,
+                                 NULL, 0, VERSIONMADEBY, 0, zip64);
+}
+
+extern int ZEXPORT zipOpenNewFileInZip (zipFile file, const char* filename, const zip_fileinfo* zipfi,
+                                        const void* extrafield_local, uInt size_extrafield_local,
+                                        const void*extrafield_global, uInt size_extrafield_global,
+                                        const char* comment, int method, int level)
+{
+    return zipOpenNewFileInZip4_64 (file, filename, zipfi,
+                                 extrafield_local, size_extrafield_local,
+                                 extrafield_global, size_extrafield_global,
+                                 comment, method, level, 0,
+                                 -MAX_WBITS, DEF_MEM_LEVEL, Z_DEFAULT_STRATEGY,
+                                 NULL, 0, VERSIONMADEBY, 0, 0);
+}
+
+local int zip64FlushWriteBuffer(zip64_internal* zi)
+{
+    int err=ZIP_OK;
+
+    if (zi->ci.encrypt != 0)
+    {
+#ifndef NOCRYPT
+        uInt i;
+        int t;
+        for (i=0;i<zi->ci.pos_in_buffered_data;i++)
+            zi->ci.buffered_data[i] = zencode(zi->ci.keys, zi->ci.pcrc_32_tab, zi->ci.buffered_data[i],t);
+#endif
+    }
+
+    if (ZWRITE64(zi->z_filefunc,zi->filestream,zi->ci.buffered_data,zi->ci.pos_in_buffered_data) != zi->ci.pos_in_buffered_data)
+      err = ZIP_ERRNO;
+
+    zi->ci.totalCompressedData += zi->ci.pos_in_buffered_data;
+
+#ifdef HAVE_BZIP2
+    if(zi->ci.method == Z_BZIP2ED)
+    {
+      zi->ci.totalUncompressedData += zi->ci.bstream.total_in_lo32;
+      zi->ci.bstream.total_in_lo32 = 0;
+      zi->ci.bstream.total_in_hi32 = 0;
+    }
+    else
+#endif
+    {
+      zi->ci.totalUncompressedData += zi->ci.stream.total_in;
+      zi->ci.stream.total_in = 0;
+    }
+
+
+    zi->ci.pos_in_buffered_data = 0;
+
+    return err;
+}
+
+extern int ZEXPORT zipWriteInFileInZip (zipFile file,const void* buf,unsigned int len)
+{
+    zip64_internal* zi;
+    int err=ZIP_OK;
+
+    if (file == NULL)
+        return ZIP_PARAMERROR;
+    zi = (zip64_internal*)file;
+
+    if (zi->in_opened_file_inzip == 0)
+        return ZIP_PARAMERROR;
+
+    zi->ci.crc32 = crc32(zi->ci.crc32,buf,(uInt)len);
+
+#ifdef HAVE_BZIP2
+    if(zi->ci.method == Z_BZIP2ED && (!zi->ci.raw))
+    {
+      zi->ci.bstream.next_in = (void*)buf;
+      zi->ci.bstream.avail_in = len;
+      err = BZ_RUN_OK;
+
+      while ((err==BZ_RUN_OK) && (zi->ci.bstream.avail_in>0))
+      {
+        if (zi->ci.bstream.avail_out == 0)
+        {
+          if (zip64FlushWriteBuffer(zi) == ZIP_ERRNO)
+            err = ZIP_ERRNO;
+          zi->ci.bstream.avail_out = (uInt)Z_BUFSIZE;
+          zi->ci.bstream.next_out = (char*)zi->ci.buffered_data;
+        }
+
+
+        if(err != BZ_RUN_OK)
+          break;
+
+        if ((zi->ci.method == Z_BZIP2ED) && (!zi->ci.raw))
+        {
+          uLong uTotalOutBefore_lo = zi->ci.bstream.total_out_lo32;
+//          uLong uTotalOutBefore_hi = zi->ci.bstream.total_out_hi32;
+          err=BZ2_bzCompress(&zi->ci.bstream,  BZ_RUN);
+
+          zi->ci.pos_in_buffered_data += (uInt)(zi->ci.bstream.total_out_lo32 - uTotalOutBefore_lo) ;
+        }
+      }
+
+      if(err == BZ_RUN_OK)
+        err = ZIP_OK;
+    }
+    else
+#endif
+    {
+      zi->ci.stream.next_in = (Bytef*)buf;
+      zi->ci.stream.avail_in = len;
+
+      while ((err==ZIP_OK) && (zi->ci.stream.avail_in>0))
+      {
+          if (zi->ci.stream.avail_out == 0)
+          {
+              if (zip64FlushWriteBuffer(zi) == ZIP_ERRNO)
+                  err = ZIP_ERRNO;
+              zi->ci.stream.avail_out = (uInt)Z_BUFSIZE;
+              zi->ci.stream.next_out = zi->ci.buffered_data;
+          }
+
+
+          if(err != ZIP_OK)
+              break;
+
+          if ((zi->ci.method == Z_DEFLATED) && (!zi->ci.raw))
+          {
+              uLong uTotalOutBefore = zi->ci.stream.total_out;
+              err=deflate(&zi->ci.stream,  Z_NO_FLUSH);
+              if(uTotalOutBefore > zi->ci.stream.total_out)
+              {
+                int bBreak = 0;
+                bBreak++;
+              }
+
+              zi->ci.pos_in_buffered_data += (uInt)(zi->ci.stream.total_out - uTotalOutBefore) ;
+          }
+          else
+          {
+              uInt copy_this,i;
+              if (zi->ci.stream.avail_in < zi->ci.stream.avail_out)
+                  copy_this = zi->ci.stream.avail_in;
+              else
+                  copy_this = zi->ci.stream.avail_out;
+
+              for (i = 0; i < copy_this; i++)
+                  *(((char*)zi->ci.stream.next_out)+i) =
+                      *(((const char*)zi->ci.stream.next_in)+i);
+              {
+                  zi->ci.stream.avail_in -= copy_this;
+                  zi->ci.stream.avail_out-= copy_this;
+                  zi->ci.stream.next_in+= copy_this;
+                  zi->ci.stream.next_out+= copy_this;
+                  zi->ci.stream.total_in+= copy_this;
+                  zi->ci.stream.total_out+= copy_this;
+                  zi->ci.pos_in_buffered_data += copy_this;
+              }
+          }
+      }// while(...)
+    }
+
+    return err;
+}
+
+extern int ZEXPORT zipCloseFileInZipRaw (zipFile file, uLong uncompressed_size, uLong crc32)
+{
+    return zipCloseFileInZipRaw64 (file, uncompressed_size, crc32);
+}
+
+extern int ZEXPORT zipCloseFileInZipRaw64 (zipFile file, ZPOS64_T uncompressed_size, uLong crc32)
+{
+    zip64_internal* zi;
+    ZPOS64_T compressed_size;
+    uLong invalidValue = 0xffffffff;
+    short datasize = 0;
+    int err=ZIP_OK;
+
+    if (file == NULL)
+        return ZIP_PARAMERROR;
+    zi = (zip64_internal*)file;
+
+    if (zi->in_opened_file_inzip == 0)
+        return ZIP_PARAMERROR;
+    zi->ci.stream.avail_in = 0;
+
+    if ((zi->ci.method == Z_DEFLATED) && (!zi->ci.raw))
+                {
+                        while (err==ZIP_OK)
+                        {
+                                uLong uTotalOutBefore;
+                                if (zi->ci.stream.avail_out == 0)
+                                {
+                                        if (zip64FlushWriteBuffer(zi) == ZIP_ERRNO)
+                                                err = ZIP_ERRNO;
+                                        zi->ci.stream.avail_out = (uInt)Z_BUFSIZE;
+                                        zi->ci.stream.next_out = zi->ci.buffered_data;
+                                }
+                                uTotalOutBefore = zi->ci.stream.total_out;
+                                err=deflate(&zi->ci.stream,  Z_FINISH);
+                                zi->ci.pos_in_buffered_data += (uInt)(zi->ci.stream.total_out - uTotalOutBefore) ;
+                        }
+                }
+    else if ((zi->ci.method == Z_BZIP2ED) && (!zi->ci.raw))
+    {
+#ifdef HAVE_BZIP2
+      err = BZ_FINISH_OK;
+      while (err==BZ_FINISH_OK)
+      {
+        uLong uTotalOutBefore;
+        if (zi->ci.bstream.avail_out == 0)
+        {
+          if (zip64FlushWriteBuffer(zi) == ZIP_ERRNO)
+            err = ZIP_ERRNO;
+          zi->ci.bstream.avail_out = (uInt)Z_BUFSIZE;
+          zi->ci.bstream.next_out = (char*)zi->ci.buffered_data;
+        }
+        uTotalOutBefore = zi->ci.bstream.total_out_lo32;
+        err=BZ2_bzCompress(&zi->ci.bstream,  BZ_FINISH);
+        if(err == BZ_STREAM_END)
+          err = Z_STREAM_END;
+
+        zi->ci.pos_in_buffered_data += (uInt)(zi->ci.bstream.total_out_lo32 - uTotalOutBefore);
+      }
+
+      if(err == BZ_FINISH_OK)
+        err = ZIP_OK;
+#endif
+    }
+
+    if (err==Z_STREAM_END)
+        err=ZIP_OK; /* this is normal */
+
+    if ((zi->ci.pos_in_buffered_data>0) && (err==ZIP_OK))
+                {
+        if (zip64FlushWriteBuffer(zi)==ZIP_ERRNO)
+            err = ZIP_ERRNO;
+                }
+
+    if ((zi->ci.method == Z_DEFLATED) && (!zi->ci.raw))
+    {
+        int tmp_err = deflateEnd(&zi->ci.stream);
+        if (err == ZIP_OK)
+            err = tmp_err;
+        zi->ci.stream_initialised = 0;
+    }
+#ifdef HAVE_BZIP2
+    else if((zi->ci.method == Z_BZIP2ED) && (!zi->ci.raw))
+    {
+      int tmperr = BZ2_bzCompressEnd(&zi->ci.bstream);
+                        if (err==ZIP_OK)
+                                err = tmperr;
+                        zi->ci.stream_initialised = 0;
+    }
+#endif
+
+    if (!zi->ci.raw)
+    {
+        crc32 = (uLong)zi->ci.crc32;
+        uncompressed_size = zi->ci.totalUncompressedData;
+    }
+    compressed_size = zi->ci.totalCompressedData;
+
+#    ifndef NOCRYPT
+    compressed_size += zi->ci.crypt_header_size;
+#    endif
+
+    // update Current Item crc and sizes,
+    if(compressed_size >= 0xffffffff || uncompressed_size >= 0xffffffff || zi->ci.pos_local_header >= 0xffffffff)
+    {
+      /*version Made by*/
+      zip64local_putValue_inmemory(zi->ci.central_header+4,(uLong)45,2);
+      /*version needed*/
+      zip64local_putValue_inmemory(zi->ci.central_header+6,(uLong)45,2);
+
+    }
+
+    zip64local_putValue_inmemory(zi->ci.central_header+16,crc32,4); /*crc*/
+
+
+    if(compressed_size >= 0xffffffff)
+      zip64local_putValue_inmemory(zi->ci.central_header+20, invalidValue,4); /*compr size*/
+    else
+      zip64local_putValue_inmemory(zi->ci.central_header+20, compressed_size,4); /*compr size*/
+
+    /// set internal file attributes field
+    if (zi->ci.stream.data_type == Z_ASCII)
+        zip64local_putValue_inmemory(zi->ci.central_header+36,(uLong)Z_ASCII,2);
+
+    if(uncompressed_size >= 0xffffffff)
+      zip64local_putValue_inmemory(zi->ci.central_header+24, invalidValue,4); /*uncompr size*/
+    else
+      zip64local_putValue_inmemory(zi->ci.central_header+24, uncompressed_size,4); /*uncompr size*/
+
+    // Add ZIP64 extra info field for uncompressed size
+    if(uncompressed_size >= 0xffffffff)
+      datasize += 8;
+
+    // Add ZIP64 extra info field for compressed size
+    if(compressed_size >= 0xffffffff)
+      datasize += 8;
+
+    // Add ZIP64 extra info field for relative offset to local file header of current file
+    if(zi->ci.pos_local_header >= 0xffffffff)
+      datasize += 8;
+
+    if(datasize > 0)
+    {
+      char* p = NULL;
+
+      if((uLong)(datasize + 4) > zi->ci.size_centralExtraFree)
+      {
+        // we can not write more data to the buffer that we have room for.
+        return ZIP_BADZIPFILE;
+      }
+
+      p = zi->ci.central_header + zi->ci.size_centralheader;
+
+      // Add Extra Information Header for 'ZIP64 information'
+      zip64local_putValue_inmemory(p, 0x0001, 2); // HeaderID
+      p += 2;
+      zip64local_putValue_inmemory(p, datasize, 2); // DataSize
+      p += 2;
+
+      if(uncompressed_size >= 0xffffffff)
+      {
+        zip64local_putValue_inmemory(p, uncompressed_size, 8);
+        p += 8;
+      }
+
+      if(compressed_size >= 0xffffffff)
+      {
+        zip64local_putValue_inmemory(p, compressed_size, 8);
+        p += 8;
+      }
+
+      if(zi->ci.pos_local_header >= 0xffffffff)
+      {
+        zip64local_putValue_inmemory(p, zi->ci.pos_local_header, 8);
+        p += 8;
+      }
+
+      // Update how much extra free space we got in the memory buffer
+      // and increase the centralheader size so the new ZIP64 fields are included
+      // ( 4 below is the size of HeaderID and DataSize field )
+      zi->ci.size_centralExtraFree -= datasize + 4;
+      zi->ci.size_centralheader += datasize + 4;
+
+      // Update the extra info size field
+      zi->ci.size_centralExtra += datasize + 4;
+      zip64local_putValue_inmemory(zi->ci.central_header+30,(uLong)zi->ci.size_centralExtra,2);
+    }
+
+    if (err==ZIP_OK)
+        err = add_data_in_datablock(&zi->central_dir, zi->ci.central_header, (uLong)zi->ci.size_centralheader);
+
+    free(zi->ci.central_header);
+
+    if (err==ZIP_OK)
+    {
+        // Update the LocalFileHeader with the new values.
+
+        ZPOS64_T cur_pos_inzip = ZTELL64(zi->z_filefunc,zi->filestream);
+
+        if (ZSEEK64(zi->z_filefunc,zi->filestream, zi->ci.pos_local_header + 14,ZLIB_FILEFUNC_SEEK_SET)!=0)
+            err = ZIP_ERRNO;
+
+        if (err==ZIP_OK)
+            err = zip64local_putValue(&zi->z_filefunc,zi->filestream,crc32,4); /* crc 32, unknown */
+
+        if(uncompressed_size >= 0xffffffff || compressed_size >= 0xffffffff )
+        {
+          if(zi->ci.pos_zip64extrainfo > 0)
+          {
+            // Update the size in the ZIP64 extended field.
+            if (ZSEEK64(zi->z_filefunc,zi->filestream, zi->ci.pos_zip64extrainfo + 4,ZLIB_FILEFUNC_SEEK_SET)!=0)
+              err = ZIP_ERRNO;
+
+            if (err==ZIP_OK) /* compressed size, unknown */
+              err = zip64local_putValue(&zi->z_filefunc, zi->filestream, uncompressed_size, 8);
+
+            if (err==ZIP_OK) /* uncompressed size, unknown */
+              err = zip64local_putValue(&zi->z_filefunc, zi->filestream, compressed_size, 8);
+          }
+          else
+              err = ZIP_BADZIPFILE; // Caller passed zip64 = 0, so no room for zip64 info -> fatal
+        }
+        else
+        {
+          if (err==ZIP_OK) /* compressed size, unknown */
+              err = zip64local_putValue(&zi->z_filefunc,zi->filestream,compressed_size,4);
+
+          if (err==ZIP_OK) /* uncompressed size, unknown */
+              err = zip64local_putValue(&zi->z_filefunc,zi->filestream,uncompressed_size,4);
+        }
+
+        if (ZSEEK64(zi->z_filefunc,zi->filestream, cur_pos_inzip,ZLIB_FILEFUNC_SEEK_SET)!=0)
+            err = ZIP_ERRNO;
+    }
+
+    zi->number_entry ++;
+    zi->in_opened_file_inzip = 0;
+
+    return err;
+}
+
+extern int ZEXPORT zipCloseFileInZip (zipFile file)
+{
+    return zipCloseFileInZipRaw (file,0,0);
+}
+
+int Write_Zip64EndOfCentralDirectoryLocator(zip64_internal* zi, ZPOS64_T zip64eocd_pos_inzip)
+{
+  int err = ZIP_OK;
+  ZPOS64_T pos = zip64eocd_pos_inzip - zi->add_position_when_writing_offset;
+
+  err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)ZIP64ENDLOCHEADERMAGIC,4);
+
+  /*num disks*/
+    if (err==ZIP_OK) /* number of the disk with the start of the central directory */
+      err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)0,4);
+
+  /*relative offset*/
+    if (err==ZIP_OK) /* Relative offset to the Zip64EndOfCentralDirectory */
+      err = zip64local_putValue(&zi->z_filefunc,zi->filestream, pos,8);
+
+  /*total disks*/ /* Do not support spawning of disk so always say 1 here*/
+    if (err==ZIP_OK) /* number of the disk with the start of the central directory */
+      err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)1,4);
+
+    return err;
+}
+
+int Write_Zip64EndOfCentralDirectoryRecord(zip64_internal* zi, uLong size_centraldir, ZPOS64_T centraldir_pos_inzip)
+{
+  int err = ZIP_OK;
+
+  uLong Zip64DataSize = 44;
+
+  err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)ZIP64ENDHEADERMAGIC,4);
+
+  if (err==ZIP_OK) /* size of this 'zip64 end of central directory' */
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(ZPOS64_T)Zip64DataSize,8); // why ZPOS64_T of this ?
+
+  if (err==ZIP_OK) /* version made by */
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)45,2);
+
+  if (err==ZIP_OK) /* version needed */
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)45,2);
+
+  if (err==ZIP_OK) /* number of this disk */
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)0,4);
+
+  if (err==ZIP_OK) /* number of the disk with the start of the central directory */
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)0,4);
+
+  if (err==ZIP_OK) /* total number of entries in the central dir on this disk */
+    err = zip64local_putValue(&zi->z_filefunc, zi->filestream, zi->number_entry, 8);
+
+  if (err==ZIP_OK) /* total number of entries in the central dir */
+    err = zip64local_putValue(&zi->z_filefunc, zi->filestream, zi->number_entry, 8);
+
+  if (err==ZIP_OK) /* size of the central directory */
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(ZPOS64_T)size_centraldir,8);
+
+  if (err==ZIP_OK) /* offset of start of central directory with respect to the starting disk number */
+  {
+    ZPOS64_T pos = centraldir_pos_inzip - zi->add_position_when_writing_offset;
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream, (ZPOS64_T)pos,8);
+  }
+  return err;
+}
+int Write_EndOfCentralDirectoryRecord(zip64_internal* zi, uLong size_centraldir, ZPOS64_T centraldir_pos_inzip)
+{
+  int err = ZIP_OK;
+
+  /*signature*/
+  err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)ENDHEADERMAGIC,4);
+
+  if (err==ZIP_OK) /* number of this disk */
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)0,2);
+
+  if (err==ZIP_OK) /* number of the disk with the start of the central directory */
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)0,2);
+
+  if (err==ZIP_OK) /* total number of entries in the central dir on this disk */
+  {
+    {
+      if(zi->number_entry >= 0xFFFF)
+        err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)0xffff,2); // use value in ZIP64 record
+      else
+        err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)zi->number_entry,2);
+    }
+  }
+
+  if (err==ZIP_OK) /* total number of entries in the central dir */
+  {
+    if(zi->number_entry >= 0xFFFF)
+      err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)0xffff,2); // use value in ZIP64 record
+    else
+      err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)zi->number_entry,2);
+  }
+
+  if (err==ZIP_OK) /* size of the central directory */
+    err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)size_centraldir,4);
+
+  if (err==ZIP_OK) /* offset of start of central directory with respect to the starting disk number */
+  {
+    ZPOS64_T pos = centraldir_pos_inzip - zi->add_position_when_writing_offset;
+    if(pos >= 0xffffffff)
+    {
+      err = zip64local_putValue(&zi->z_filefunc,zi->filestream, (uLong)0xffffffff,4);
+    }
+    else
+      err = zip64local_putValue(&zi->z_filefunc,zi->filestream, (uLong)(centraldir_pos_inzip - zi->add_position_when_writing_offset),4);
+  }
+
+   return err;
+}
+
+int Write_GlobalComment(zip64_internal* zi, const char* global_comment)
+{
+  int err = ZIP_OK;
+  uInt size_global_comment = 0;
+
+  if(global_comment != NULL)
+    size_global_comment = (uInt)strlen(global_comment);
+
+  err = zip64local_putValue(&zi->z_filefunc,zi->filestream,(uLong)size_global_comment,2);
+
+  if (err == ZIP_OK && size_global_comment > 0)
+  {
+    if (ZWRITE64(zi->z_filefunc,zi->filestream, global_comment, size_global_comment) != size_global_comment)
+      err = ZIP_ERRNO;
+  }
+  return err;
+}
+
+extern int ZEXPORT zipClose (zipFile file, const char* global_comment)
+{
+    zip64_internal* zi;
+    int err = 0;
+    uLong size_centraldir = 0;
+    ZPOS64_T centraldir_pos_inzip;
+    ZPOS64_T pos;
+
+    if (file == NULL)
+        return ZIP_PARAMERROR;
+
+    zi = (zip64_internal*)file;
+
+    if (zi->in_opened_file_inzip == 1)
+    {
+        err = zipCloseFileInZip (file);
+    }
+
+#ifndef NO_ADDFILEINEXISTINGZIP
+    if (global_comment==NULL)
+        global_comment = zi->globalcomment;
+#endif
+
+    centraldir_pos_inzip = ZTELL64(zi->z_filefunc,zi->filestream);
+
+    if (err==ZIP_OK)
+    {
+        linkedlist_datablock_internal* ldi = zi->central_dir.first_block;
+        while (ldi!=NULL)
+        {
+            if ((err==ZIP_OK) && (ldi->filled_in_this_block>0))
+            {
+                if (ZWRITE64(zi->z_filefunc,zi->filestream, ldi->data, ldi->filled_in_this_block) != ldi->filled_in_this_block)
+                    err = ZIP_ERRNO;
+            }
+
+            size_centraldir += ldi->filled_in_this_block;
+            ldi = ldi->next_datablock;
+        }
+    }
+    free_linkedlist(&(zi->central_dir));
+
+    pos = centraldir_pos_inzip - zi->add_position_when_writing_offset;
+    if(pos >= 0xffffffff || zi->number_entry > 0xFFFF)
+    {
+      ZPOS64_T Zip64EOCDpos = ZTELL64(zi->z_filefunc,zi->filestream);
+      Write_Zip64EndOfCentralDirectoryRecord(zi, size_centraldir, centraldir_pos_inzip);
+
+      Write_Zip64EndOfCentralDirectoryLocator(zi, Zip64EOCDpos);
+    }
+
+    if (err==ZIP_OK)
+      err = Write_EndOfCentralDirectoryRecord(zi, size_centraldir, centraldir_pos_inzip);
+
+    if(err == ZIP_OK)
+      err = Write_GlobalComment(zi, global_comment);
+
+    if (ZCLOSE64(zi->z_filefunc,zi->filestream) != 0)
+        if (err == ZIP_OK)
+            err = ZIP_ERRNO;
+
+#ifndef NO_ADDFILEINEXISTINGZIP
+    TRYFREE(zi->globalcomment);
+#endif
+    TRYFREE(zi);
+
+    return err;
+}
+
+extern int ZEXPORT zipRemoveExtraInfoBlock (char* pData, int* dataLen, short sHeader)
+{
+  char* p = pData;
+  int size = 0;
+  char* pNewHeader;
+  char* pTmp;
+  short header;
+  short dataSize;
+
+  int retVal = ZIP_OK;
+
+  if(pData == NULL || *dataLen < 4)
+    return ZIP_PARAMERROR;
+
+  pNewHeader = (char*)ALLOC(*dataLen);
+  pTmp = pNewHeader;
+
+  while(p < (pData + *dataLen))
+  {
+    header = *(short*)p;
+    dataSize = *(((short*)p)+1);
+
+    if( header == sHeader ) // Header found.
+    {
+      p += dataSize + 4; // skip it. do not copy to temp buffer
+    }
+    else
+    {
+      // Extra Info block should not be removed, So copy it to the temp buffer.
+      memcpy(pTmp, p, dataSize + 4);
+      p += dataSize + 4;
+      size += dataSize + 4;
+    }
+
+  }
+
+  if(size < *dataLen)
+  {
+    // clean old extra info block.
+    memset(pData,0, *dataLen);
+
+    // copy the new extra info block over the old
+    if(size > 0)
+      memcpy(pData, pNewHeader, size);
+
+    // set the new extra info size
+    *dataLen = size;
+
+    retVal = ZIP_OK;
+  }
+  else
+    retVal = ZIP_ERRNO;
+
+  TRYFREE(pNewHeader);
+
+  return retVal;
+}
diff --git a/deps/v8/third_party/zlib/contrib/minizip/zip.h b/deps/v8/third_party/zlib/contrib/minizip/zip.h
new file mode 100644
index 00000000000000..8c06c0aa7bb08b
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/minizip/zip.h
@@ -0,0 +1,362 @@
+/* zip.h -- IO on .zip files using zlib
+   Version 1.1, February 14h, 2010
+   part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html )
+
+         Modifications for Zip64 support
+         Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com )
+
+         For more info read MiniZip_info.txt
+
+         ---------------------------------------------------------------------------
+
+   Condition of use and distribution are the same than zlib :
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+        ---------------------------------------------------------------------------
+
+        Changes
+
+        See header of zip.h
+
+*/
+
+#ifndef _zip12_H
+#define _zip12_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+//#define HAVE_BZIP2
+
+#ifndef _ZLIB_H
+#include "third_party/zlib/zlib.h"
+#endif
+
+#ifndef _ZLIBIOAPI_H
+#include "ioapi.h"
+#endif
+
+#ifdef HAVE_BZIP2
+#include "bzlib.h"
+#endif
+
+#define Z_BZIP2ED 12
+
+#if defined(STRICTZIP) || defined(STRICTZIPUNZIP)
+/* like the STRICT of WIN32, we define a pointer that cannot be converted
+    from (void*) without cast */
+typedef struct TagzipFile__ { int unused; } zipFile__;
+typedef zipFile__ *zipFile;
+#else
+typedef voidp zipFile;
+#endif
+
+#define ZIP_OK                          (0)
+#define ZIP_EOF                         (0)
+#define ZIP_ERRNO                       (Z_ERRNO)
+#define ZIP_PARAMERROR                  (-102)
+#define ZIP_BADZIPFILE                  (-103)
+#define ZIP_INTERNALERROR               (-104)
+
+#ifndef DEF_MEM_LEVEL
+#  if MAX_MEM_LEVEL >= 8
+#    define DEF_MEM_LEVEL 8
+#  else
+#    define DEF_MEM_LEVEL  MAX_MEM_LEVEL
+#  endif
+#endif
+/* default memLevel */
+
+/* tm_zip contain date/time info */
+typedef struct tm_zip_s
+{
+    uInt tm_sec;            /* seconds after the minute - [0,59] */
+    uInt tm_min;            /* minutes after the hour - [0,59] */
+    uInt tm_hour;           /* hours since midnight - [0,23] */
+    uInt tm_mday;           /* day of the month - [1,31] */
+    uInt tm_mon;            /* months since January - [0,11] */
+    uInt tm_year;           /* years - [1980..2044] */
+} tm_zip;
+
+typedef struct
+{
+    tm_zip      tmz_date;       /* date in understandable format           */
+    uLong       dosDate;       /* if dos_date == 0, tmu_date is used      */
+/*    uLong       flag;        */   /* general purpose bit flag        2 bytes */
+
+    uLong       internal_fa;    /* internal file attributes        2 bytes */
+    uLong       external_fa;    /* external file attributes        4 bytes */
+} zip_fileinfo;
+
+typedef const char* zipcharpc;
+
+
+#define APPEND_STATUS_CREATE        (0)
+#define APPEND_STATUS_CREATEAFTER   (1)
+#define APPEND_STATUS_ADDINZIP      (2)
+
+extern zipFile ZEXPORT zipOpen OF((const char *pathname, int append));
+extern zipFile ZEXPORT zipOpen64 OF((const void *pathname, int append));
+/*
+  Create a zipfile.
+     pathname contain on Windows XP a filename like "c:\\zlib\\zlib113.zip" or on
+       an Unix computer "zlib/zlib113.zip".
+     if the file pathname exist and append==APPEND_STATUS_CREATEAFTER, the zip
+       will be created at the end of the file.
+         (useful if the file contain a self extractor code)
+     if the file pathname exist and append==APPEND_STATUS_ADDINZIP, we will
+       add files in existing zip (be sure you don't add file that doesn't exist)
+     If the zipfile cannot be opened, the return value is NULL.
+     Else, the return value is a zipFile Handle, usable with other function
+       of this zip package.
+*/
+
+/* Note : there is no delete function into a zipfile.
+   If you want delete file into a zipfile, you must open a zipfile, and create another
+   Of couse, you can use RAW reading and writing to copy the file you did not want delte
+*/
+
+extern zipFile ZEXPORT zipOpen2 OF((const char *pathname,
+                                   int append,
+                                   zipcharpc* globalcomment,
+                                   zlib_filefunc_def* pzlib_filefunc_def));
+
+extern zipFile ZEXPORT zipOpen2_64 OF((const void *pathname,
+                                   int append,
+                                   zipcharpc* globalcomment,
+                                   zlib_filefunc64_def* pzlib_filefunc_def));
+
+extern int ZEXPORT zipOpenNewFileInZip OF((zipFile file,
+                       const char* filename,
+                       const zip_fileinfo* zipfi,
+                       const void* extrafield_local,
+                       uInt size_extrafield_local,
+                       const void* extrafield_global,
+                       uInt size_extrafield_global,
+                       const char* comment,
+                       int method,
+                       int level));
+
+extern int ZEXPORT zipOpenNewFileInZip64 OF((zipFile file,
+                       const char* filename,
+                       const zip_fileinfo* zipfi,
+                       const void* extrafield_local,
+                       uInt size_extrafield_local,
+                       const void* extrafield_global,
+                       uInt size_extrafield_global,
+                       const char* comment,
+                       int method,
+                       int level,
+                       int zip64));
+
+/*
+  Open a file in the ZIP for writing.
+  filename : the filename in zip (if NULL, '-' without quote will be used
+  *zipfi contain supplemental information
+  if extrafield_local!=NULL and size_extrafield_local>0, extrafield_local
+    contains the extrafield data the the local header
+  if extrafield_global!=NULL and size_extrafield_global>0, extrafield_global
+    contains the extrafield data the the local header
+  if comment != NULL, comment contain the comment string
+  method contain the compression method (0 for store, Z_DEFLATED for deflate)
+  level contain the level of compression (can be Z_DEFAULT_COMPRESSION)
+  zip64 is set to 1 if a zip64 extended information block should be added to the local file header.
+                    this MUST be '1' if the uncompressed size is >= 0xffffffff.
+
+*/
+
+
+extern int ZEXPORT zipOpenNewFileInZip2 OF((zipFile file,
+                                            const char* filename,
+                                            const zip_fileinfo* zipfi,
+                                            const void* extrafield_local,
+                                            uInt size_extrafield_local,
+                                            const void* extrafield_global,
+                                            uInt size_extrafield_global,
+                                            const char* comment,
+                                            int method,
+                                            int level,
+                                            int raw));
+
+
+extern int ZEXPORT zipOpenNewFileInZip2_64 OF((zipFile file,
+                                            const char* filename,
+                                            const zip_fileinfo* zipfi,
+                                            const void* extrafield_local,
+                                            uInt size_extrafield_local,
+                                            const void* extrafield_global,
+                                            uInt size_extrafield_global,
+                                            const char* comment,
+                                            int method,
+                                            int level,
+                                            int raw,
+                                            int zip64));
+/*
+  Same than zipOpenNewFileInZip, except if raw=1, we write raw file
+ */
+
+extern int ZEXPORT zipOpenNewFileInZip3 OF((zipFile file,
+                                            const char* filename,
+                                            const zip_fileinfo* zipfi,
+                                            const void* extrafield_local,
+                                            uInt size_extrafield_local,
+                                            const void* extrafield_global,
+                                            uInt size_extrafield_global,
+                                            const char* comment,
+                                            int method,
+                                            int level,
+                                            int raw,
+                                            int windowBits,
+                                            int memLevel,
+                                            int strategy,
+                                            const char* password,
+                                            uLong crcForCrypting));
+
+extern int ZEXPORT zipOpenNewFileInZip3_64 OF((zipFile file,
+                                            const char* filename,
+                                            const zip_fileinfo* zipfi,
+                                            const void* extrafield_local,
+                                            uInt size_extrafield_local,
+                                            const void* extrafield_global,
+                                            uInt size_extrafield_global,
+                                            const char* comment,
+                                            int method,
+                                            int level,
+                                            int raw,
+                                            int windowBits,
+                                            int memLevel,
+                                            int strategy,
+                                            const char* password,
+                                            uLong crcForCrypting,
+                                            int zip64
+                                            ));
+
+/*
+  Same than zipOpenNewFileInZip2, except
+    windowBits,memLevel,,strategy : see parameter strategy in deflateInit2
+    password : crypting password (NULL for no crypting)
+    crcForCrypting : crc of file to compress (needed for crypting)
+ */
+
+extern int ZEXPORT zipOpenNewFileInZip4 OF((zipFile file,
+                                            const char* filename,
+                                            const zip_fileinfo* zipfi,
+                                            const void* extrafield_local,
+                                            uInt size_extrafield_local,
+                                            const void* extrafield_global,
+                                            uInt size_extrafield_global,
+                                            const char* comment,
+                                            int method,
+                                            int level,
+                                            int raw,
+                                            int windowBits,
+                                            int memLevel,
+                                            int strategy,
+                                            const char* password,
+                                            uLong crcForCrypting,
+                                            uLong versionMadeBy,
+                                            uLong flagBase
+                                            ));
+
+
+extern int ZEXPORT zipOpenNewFileInZip4_64 OF((zipFile file,
+                                            const char* filename,
+                                            const zip_fileinfo* zipfi,
+                                            const void* extrafield_local,
+                                            uInt size_extrafield_local,
+                                            const void* extrafield_global,
+                                            uInt size_extrafield_global,
+                                            const char* comment,
+                                            int method,
+                                            int level,
+                                            int raw,
+                                            int windowBits,
+                                            int memLevel,
+                                            int strategy,
+                                            const char* password,
+                                            uLong crcForCrypting,
+                                            uLong versionMadeBy,
+                                            uLong flagBase,
+                                            int zip64
+                                            ));
+/*
+  Same than zipOpenNewFileInZip4, except
+    versionMadeBy : value for Version made by field
+    flag : value for flag field (compression level info will be added)
+ */
+
+
+extern int ZEXPORT zipWriteInFileInZip OF((zipFile file,
+                       const void* buf,
+                       unsigned len));
+/*
+  Write data in the zipfile
+*/
+
+extern int ZEXPORT zipCloseFileInZip OF((zipFile file));
+/*
+  Close the current file in the zipfile
+*/
+
+extern int ZEXPORT zipCloseFileInZipRaw OF((zipFile file,
+                                            uLong uncompressed_size,
+                                            uLong crc32));
+
+extern int ZEXPORT zipCloseFileInZipRaw64 OF((zipFile file,
+                                            ZPOS64_T uncompressed_size,
+                                            uLong crc32));
+
+/*
+  Close the current file in the zipfile, for file opened with
+    parameter raw=1 in zipOpenNewFileInZip2
+  uncompressed_size and crc32 are value for the uncompressed size
+*/
+
+extern int ZEXPORT zipClose OF((zipFile file,
+                const char* global_comment));
+/*
+  Close the zipfile
+*/
+
+
+extern int ZEXPORT zipRemoveExtraInfoBlock OF((char* pData, int* dataLen, short sHeader));
+/*
+  zipRemoveExtraInfoBlock -  Added by Mathias Svensson
+
+  Remove extra information block from a extra information data for the local file header or central directory header
+
+  It is needed to remove ZIP64 extra information blocks when before data is written if using RAW mode.
+
+  0x0001 is the signature header for the ZIP64 extra information blocks
+
+  usage.
+                        Remove ZIP64 Extra information from a central director extra field data
+              zipRemoveExtraInfoBlock(pCenDirExtraFieldData, &nCenDirExtraFieldDataLen, 0x0001);
+
+                        Remove ZIP64 Extra information from a Local File Header extra field data
+        zipRemoveExtraInfoBlock(pLocalHeaderExtraFieldData, &nLocalHeaderExtraFieldDataLen, 0x0001);
+*/
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _zip64_H */
diff --git a/deps/v8/third_party/zlib/contrib/optimizations/chunkcopy.h b/deps/v8/third_party/zlib/contrib/optimizations/chunkcopy.h
new file mode 100644
index 00000000000000..38ba0ed8a27f45
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/optimizations/chunkcopy.h
@@ -0,0 +1,444 @@
+/* chunkcopy.h -- fast chunk copy and set operations
+ * Copyright (C) 2017 ARM, Inc.
+ * Copyright 2017 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the Chromium source repository LICENSE file.
+ */
+
+#ifndef CHUNKCOPY_H
+#define CHUNKCOPY_H
+
+#include <stdint.h>
+#include "zutil.h"
+
+#define Z_STATIC_ASSERT(name, assert) typedef char name[(assert) ? 1 : -1]
+
+#if __STDC_VERSION__ >= 199901L
+#define Z_RESTRICT restrict
+#else
+#define Z_RESTRICT
+#endif
+
+#if defined(__clang__) || defined(__GNUC__) || defined(__llvm__)
+#define Z_BUILTIN_MEMCPY __builtin_memcpy
+#else
+#define Z_BUILTIN_MEMCPY zmemcpy
+#endif
+
+#if defined(INFLATE_CHUNK_SIMD_NEON)
+#include <arm_neon.h>
+typedef uint8x16_t z_vec128i_t;
+#elif defined(INFLATE_CHUNK_SIMD_SSE2)
+#include <emmintrin.h>
+typedef __m128i z_vec128i_t;
+#else
+#error chunkcopy.h inflate chunk SIMD is not defined for your build target
+#endif
+
+/*
+ * chunk copy type: the z_vec128i_t type size should be exactly 128-bits
+ * and equal to CHUNKCOPY_CHUNK_SIZE.
+ */
+#define CHUNKCOPY_CHUNK_SIZE sizeof(z_vec128i_t)
+
+Z_STATIC_ASSERT(vector_128_bits_wide,
+                CHUNKCOPY_CHUNK_SIZE == sizeof(int8_t) * 16);
+
+/*
+ * Ask the compiler to perform a wide, unaligned load with a machine
+ * instruction appropriate for the z_vec128i_t type.
+ */
+static inline z_vec128i_t loadchunk(
+    const unsigned char FAR* s) {
+  z_vec128i_t v;
+  Z_BUILTIN_MEMCPY(&v, s, sizeof(v));
+  return v;
+}
+
+/*
+ * Ask the compiler to perform a wide, unaligned store with a machine
+ * instruction appropriate for the z_vec128i_t type.
+ */
+static inline void storechunk(
+    unsigned char FAR* d,
+    const z_vec128i_t v) {
+  Z_BUILTIN_MEMCPY(d, &v, sizeof(v));
+}
+
+/*
+ * Perform a memcpy-like operation, assuming that length is non-zero and that
+ * it's OK to overwrite at least CHUNKCOPY_CHUNK_SIZE bytes of output even if
+ * the length is shorter than this.
+ *
+ * It also guarantees that it will properly unroll the data if the distance
+ * between `out` and `from` is at least CHUNKCOPY_CHUNK_SIZE, which we rely on
+ * in chunkcopy_relaxed().
+ *
+ * Aside from better memory bus utilisation, this means that short copies
+ * (CHUNKCOPY_CHUNK_SIZE bytes or fewer) will fall straight through the loop
+ * without iteration, which will hopefully make the branch prediction more
+ * reliable.
+ */
+static inline unsigned char FAR* chunkcopy_core(
+    unsigned char FAR* out,
+    const unsigned char FAR* from,
+    unsigned len) {
+  const int bump = (--len % CHUNKCOPY_CHUNK_SIZE) + 1;
+  storechunk(out, loadchunk(from));
+  out += bump;
+  from += bump;
+  len /= CHUNKCOPY_CHUNK_SIZE;
+  while (len-- > 0) {
+    storechunk(out, loadchunk(from));
+    out += CHUNKCOPY_CHUNK_SIZE;
+    from += CHUNKCOPY_CHUNK_SIZE;
+  }
+  return out;
+}
+
+/*
+ * Like chunkcopy_core(), but avoid writing beyond of legal output.
+ *
+ * Accepts an additional pointer to the end of safe output.  A generic safe
+ * copy would use (out + len), but it's normally the case that the end of the
+ * output buffer is beyond the end of the current copy, and this can still be
+ * exploited.
+ */
+static inline unsigned char FAR* chunkcopy_core_safe(
+    unsigned char FAR* out,
+    const unsigned char FAR* from,
+    unsigned len,
+    unsigned char FAR* limit) {
+  Assert(out + len <= limit, "chunk copy exceeds safety limit");
+  if ((limit - out) < (ptrdiff_t)CHUNKCOPY_CHUNK_SIZE) {
+    const unsigned char FAR* Z_RESTRICT rfrom = from;
+    if (len & 8) {
+      Z_BUILTIN_MEMCPY(out, rfrom, 8);
+      out += 8;
+      rfrom += 8;
+    }
+    if (len & 4) {
+      Z_BUILTIN_MEMCPY(out, rfrom, 4);
+      out += 4;
+      rfrom += 4;
+    }
+    if (len & 2) {
+      Z_BUILTIN_MEMCPY(out, rfrom, 2);
+      out += 2;
+      rfrom += 2;
+    }
+    if (len & 1) {
+      *out++ = *rfrom++;
+    }
+    return out;
+  }
+  return chunkcopy_core(out, from, len);
+}
+
+/*
+ * Perform short copies until distance can be rewritten as being at least
+ * CHUNKCOPY_CHUNK_SIZE.
+ *
+ * Assumes it's OK to overwrite at least the first 2*CHUNKCOPY_CHUNK_SIZE
+ * bytes of output even if the copy is shorter than this.  This assumption
+ * holds within zlib inflate_fast(), which starts every iteration with at
+ * least 258 bytes of output space available (258 being the maximum length
+ * output from a single token; see inffast.c).
+ */
+static inline unsigned char FAR* chunkunroll_relaxed(
+    unsigned char FAR* out,
+    unsigned FAR* dist,
+    unsigned FAR* len) {
+  const unsigned char FAR* from = out - *dist;
+  while (*dist < *len && *dist < CHUNKCOPY_CHUNK_SIZE) {
+    storechunk(out, loadchunk(from));
+    out += *dist;
+    *len -= *dist;
+    *dist += *dist;
+  }
+  return out;
+}
+
+#if defined(INFLATE_CHUNK_SIMD_NEON)
+/*
+ * v_load64_dup(): load *src as an unaligned 64-bit int and duplicate it in
+ * every 64-bit component of the 128-bit result (64-bit int splat).
+ */
+static inline z_vec128i_t v_load64_dup(const void* src) {
+  return vcombine_u8(vld1_u8(src), vld1_u8(src));
+}
+
+/*
+ * v_load32_dup(): load *src as an unaligned 32-bit int and duplicate it in
+ * every 32-bit component of the 128-bit result (32-bit int splat).
+ */
+static inline z_vec128i_t v_load32_dup(const void* src) {
+  int32_t i32;
+  Z_BUILTIN_MEMCPY(&i32, src, sizeof(i32));
+  return vreinterpretq_u8_s32(vdupq_n_s32(i32));
+}
+
+/*
+ * v_load16_dup(): load *src as an unaligned 16-bit int and duplicate it in
+ * every 16-bit component of the 128-bit result (16-bit int splat).
+ */
+static inline z_vec128i_t v_load16_dup(const void* src) {
+  int16_t i16;
+  Z_BUILTIN_MEMCPY(&i16, src, sizeof(i16));
+  return vreinterpretq_u8_s16(vdupq_n_s16(i16));
+}
+
+/*
+ * v_load8_dup(): load the 8-bit int *src and duplicate it in every 8-bit
+ * component of the 128-bit result (8-bit int splat).
+ */
+static inline z_vec128i_t v_load8_dup(const void* src) {
+  return vld1q_dup_u8((const uint8_t*)src);
+}
+
+/*
+ * v_store_128(): store the 128-bit vec in a memory destination (that might
+ * not be 16-byte aligned) void* out.
+ */
+static inline void v_store_128(void* out, const z_vec128i_t vec) {
+  vst1q_u8(out, vec);
+}
+
+#elif defined(INFLATE_CHUNK_SIMD_SSE2)
+/*
+ * v_load64_dup(): load *src as an unaligned 64-bit int and duplicate it in
+ * every 64-bit component of the 128-bit result (64-bit int splat).
+ */
+static inline z_vec128i_t v_load64_dup(const void* src) {
+  int64_t i64;
+  Z_BUILTIN_MEMCPY(&i64, src, sizeof(i64));
+  return _mm_set1_epi64x(i64);
+}
+
+/*
+ * v_load32_dup(): load *src as an unaligned 32-bit int and duplicate it in
+ * every 32-bit component of the 128-bit result (32-bit int splat).
+ */
+static inline z_vec128i_t v_load32_dup(const void* src) {
+  int32_t i32;
+  Z_BUILTIN_MEMCPY(&i32, src, sizeof(i32));
+  return _mm_set1_epi32(i32);
+}
+
+/*
+ * v_load16_dup(): load *src as an unaligned 16-bit int and duplicate it in
+ * every 16-bit component of the 128-bit result (16-bit int splat).
+ */
+static inline z_vec128i_t v_load16_dup(const void* src) {
+  int16_t i16;
+  Z_BUILTIN_MEMCPY(&i16, src, sizeof(i16));
+  return _mm_set1_epi16(i16);
+}
+
+/*
+ * v_load8_dup(): load the 8-bit int *src and duplicate it in every 8-bit
+ * component of the 128-bit result (8-bit int splat).
+ */
+static inline z_vec128i_t v_load8_dup(const void* src) {
+  return _mm_set1_epi8(*(const char*)src);
+}
+
+/*
+ * v_store_128(): store the 128-bit vec in a memory destination (that might
+ * not be 16-byte aligned) void* out.
+ */
+static inline void v_store_128(void* out, const z_vec128i_t vec) {
+  _mm_storeu_si128((__m128i*)out, vec);
+}
+#endif
+
+/*
+ * Perform an overlapping copy which behaves as a memset() operation, but
+ * supporting periods other than one, and assume that length is non-zero and
+ * that it's OK to overwrite at least CHUNKCOPY_CHUNK_SIZE*3 bytes of output
+ * even if the length is shorter than this.
+ */
+static inline unsigned char FAR* chunkset_core(
+    unsigned char FAR* out,
+    unsigned period,
+    unsigned len) {
+  z_vec128i_t v;
+  const int bump = ((len - 1) % sizeof(v)) + 1;
+
+  switch (period) {
+    case 1:
+      v = v_load8_dup(out - 1);
+      v_store_128(out, v);
+      out += bump;
+      len -= bump;
+      while (len > 0) {
+        v_store_128(out, v);
+        out += sizeof(v);
+        len -= sizeof(v);
+      }
+      return out;
+    case 2:
+      v = v_load16_dup(out - 2);
+      v_store_128(out, v);
+      out += bump;
+      len -= bump;
+      if (len > 0) {
+        v = v_load16_dup(out - 2);
+        do {
+          v_store_128(out, v);
+          out += sizeof(v);
+          len -= sizeof(v);
+        } while (len > 0);
+      }
+      return out;
+    case 4:
+      v = v_load32_dup(out - 4);
+      v_store_128(out, v);
+      out += bump;
+      len -= bump;
+      if (len > 0) {
+        v = v_load32_dup(out - 4);
+        do {
+          v_store_128(out, v);
+          out += sizeof(v);
+          len -= sizeof(v);
+        } while (len > 0);
+      }
+      return out;
+    case 8:
+      v = v_load64_dup(out - 8);
+      v_store_128(out, v);
+      out += bump;
+      len -= bump;
+      if (len > 0) {
+        v = v_load64_dup(out - 8);
+        do {
+          v_store_128(out, v);
+          out += sizeof(v);
+          len -= sizeof(v);
+        } while (len > 0);
+      }
+      return out;
+  }
+  out = chunkunroll_relaxed(out, &period, &len);
+  return chunkcopy_core(out, out - period, len);
+}
+
+/*
+ * Perform a memcpy-like operation, but assume that length is non-zero and that
+ * it's OK to overwrite at least CHUNKCOPY_CHUNK_SIZE bytes of output even if
+ * the length is shorter than this.
+ *
+ * Unlike chunkcopy_core() above, no guarantee is made regarding the behaviour
+ * of overlapping buffers, regardless of the distance between the pointers.
+ * This is reflected in the `restrict`-qualified pointers, allowing the
+ * compiler to re-order loads and stores.
+ */
+static inline unsigned char FAR* chunkcopy_relaxed(
+    unsigned char FAR* Z_RESTRICT out,
+    const unsigned char FAR* Z_RESTRICT from,
+    unsigned len) {
+  return chunkcopy_core(out, from, len);
+}
+
+/*
+ * Like chunkcopy_relaxed(), but avoid writing beyond of legal output.
+ *
+ * Unlike chunkcopy_core_safe() above, no guarantee is made regarding the
+ * behaviour of overlapping buffers, regardless of the distance between the
+ * pointers.  This is reflected in the `restrict`-qualified pointers, allowing
+ * the compiler to re-order loads and stores.
+ *
+ * Accepts an additional pointer to the end of safe output.  A generic safe
+ * copy would use (out + len), but it's normally the case that the end of the
+ * output buffer is beyond the end of the current copy, and this can still be
+ * exploited.
+ */
+static inline unsigned char FAR* chunkcopy_safe(
+    unsigned char FAR* out,
+    const unsigned char FAR* Z_RESTRICT from,
+    unsigned len,
+    unsigned char FAR* limit) {
+  Assert(out + len <= limit, "chunk copy exceeds safety limit");
+  return chunkcopy_core_safe(out, from, len, limit);
+}
+
+/*
+ * Perform chunky copy within the same buffer, where the source and destination
+ * may potentially overlap.
+ *
+ * Assumes that len > 0 on entry, and that it's safe to write at least
+ * CHUNKCOPY_CHUNK_SIZE*3 bytes to the output.
+ */
+static inline unsigned char FAR* chunkcopy_lapped_relaxed(
+    unsigned char FAR* out,
+    unsigned dist,
+    unsigned len) {
+  if (dist < len && dist < CHUNKCOPY_CHUNK_SIZE) {
+    return chunkset_core(out, dist, len);
+  }
+  return chunkcopy_core(out, out - dist, len);
+}
+
+/*
+ * Behave like chunkcopy_lapped_relaxed(), but avoid writing beyond of legal
+ * output.
+ *
+ * Accepts an additional pointer to the end of safe output.  A generic safe
+ * copy would use (out + len), but it's normally the case that the end of the
+ * output buffer is beyond the end of the current copy, and this can still be
+ * exploited.
+ */
+static inline unsigned char FAR* chunkcopy_lapped_safe(
+    unsigned char FAR* out,
+    unsigned dist,
+    unsigned len,
+    unsigned char FAR* limit) {
+  Assert(out + len <= limit, "chunk copy exceeds safety limit");
+  if ((limit - out) < (ptrdiff_t)(3 * CHUNKCOPY_CHUNK_SIZE)) {
+    /* TODO(cavalcantii): try harder to optimise this */
+    while (len-- > 0) {
+      *out = *(out - dist);
+      out++;
+    }
+    return out;
+  }
+  return chunkcopy_lapped_relaxed(out, dist, len);
+}
+
+/*
+ * The chunk-copy code above deals with writing the decoded DEFLATE data to
+ * the output with SIMD methods to increase decode speed. Reading the input
+ * to the DEFLATE decoder with a wide, SIMD method can also increase decode
+ * speed. This option is supported on little endian machines, and reads the
+ * input data in 64-bit (8 byte) chunks.
+ */
+
+#ifdef INFLATE_CHUNK_READ_64LE
+/*
+ * Buffer the input in a uint64_t (8 bytes) in the wide input reading case.
+ */
+typedef uint64_t inflate_holder_t;
+
+/*
+ * Ask the compiler to perform a wide, unaligned load of a uint64_t using a
+ * machine instruction appropriate for the uint64_t type.
+ */
+static inline inflate_holder_t read64le(const unsigned char FAR *in) {
+    inflate_holder_t input;
+    Z_BUILTIN_MEMCPY(&input, in, sizeof(input));
+    return input;
+}
+#else
+/*
+ * Otherwise, buffer the input bits using zlib's default input buffer type.
+ */
+typedef unsigned long inflate_holder_t;
+
+#endif /* INFLATE_CHUNK_READ_64LE */
+
+#undef Z_STATIC_ASSERT
+#undef Z_RESTRICT
+#undef Z_BUILTIN_MEMCPY
+
+#endif /* CHUNKCOPY_H */
diff --git a/deps/v8/third_party/zlib/contrib/optimizations/inffast_chunk.c b/deps/v8/third_party/zlib/contrib/optimizations/inffast_chunk.c
new file mode 100644
index 00000000000000..4099edf3961d74
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/optimizations/inffast_chunk.c
@@ -0,0 +1,359 @@
+/* inffast_chunk.c -- fast decoding
+ * Copyright (C) 1995-2017 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+#include "zutil.h"
+#include "inftrees.h"
+#include "inflate.h"
+#include "contrib/optimizations/inffast_chunk.h"
+#include "contrib/optimizations/chunkcopy.h"
+
+#ifdef ASMINF
+#  pragma message("Assembler code may have bugs -- use at your own risk")
+#else
+
+/*
+   Decode literal, length, and distance codes and write out the resulting
+   literal and match bytes until either not enough input or output is
+   available, an end-of-block is encountered, or a data error is encountered.
+   When large enough input and output buffers are supplied to inflate(), for
+   example, a 16K input buffer and a 64K output buffer, more than 95% of the
+   inflate() execution time is spent in this routine.
+
+   Entry assumptions:
+
+        state->mode == LEN
+        strm->avail_in >= INFLATE_FAST_MIN_INPUT (6 or 8 bytes)
+        strm->avail_out >= INFLATE_FAST_MIN_OUTPUT (258 bytes)
+        start >= strm->avail_out
+        state->bits < 8
+        (state->hold >> state->bits) == 0
+        strm->next_out[0..strm->avail_out] does not overlap with
+              strm->next_in[0..strm->avail_in]
+        strm->state->window is allocated with an additional
+              CHUNKCOPY_CHUNK_SIZE-1 bytes of padding beyond strm->state->wsize
+
+   On return, state->mode is one of:
+
+        LEN -- ran out of enough output space or enough available input
+        TYPE -- reached end of block code, inflate() to interpret next block
+        BAD -- error in block data
+
+   Notes:
+
+    INFLATE_FAST_MIN_INPUT: 6 or 8 bytes
+
+    - The maximum input bits used by a length/distance pair is 15 bits for the
+      length code, 5 bits for the length extra, 15 bits for the distance code,
+      and 13 bits for the distance extra.  This totals 48 bits, or six bytes.
+      Therefore if strm->avail_in >= 6, then there is enough input to avoid
+      checking for available input while decoding.
+
+    - The wide input data reading option reads 64 input bits at a time. Thus,
+      if strm->avail_in >= 8, then there is enough input to avoid checking for
+      available input while decoding. Reading consumes the input with:
+
+          hold |= read64le(in) << bits;
+          in += 6;
+          bits += 48;
+
+      reporting 6 bytes of new input because |bits| is 0..15 (2 bytes rounded
+      up, worst case) and 6 bytes is enough to decode as noted above. At exit,
+      hold &= (1U << bits) - 1 drops excess input to keep the invariant:
+
+          (state->hold >> state->bits) == 0
+
+    INFLATE_FAST_MIN_OUTPUT: 258 bytes
+
+    - The maximum bytes that a single length/distance pair can output is 258
+      bytes, which is the maximum length that can be coded.  inflate_fast()
+      requires strm->avail_out >= 258 for each loop to avoid checking for
+      available output space while decoding.
+ */
+void ZLIB_INTERNAL inflate_fast_chunk_(strm, start)
+z_streamp strm;
+unsigned start;         /* inflate()'s starting value for strm->avail_out */
+{
+    struct inflate_state FAR *state;
+    z_const unsigned char FAR *in;      /* local strm->next_in */
+    z_const unsigned char FAR *last;    /* have enough input while in < last */
+    unsigned char FAR *out;     /* local strm->next_out */
+    unsigned char FAR *beg;     /* inflate()'s initial strm->next_out */
+    unsigned char FAR *end;     /* while out < end, enough space available */
+    unsigned char FAR *limit;   /* safety limit for chunky copies */
+#ifdef INFLATE_STRICT
+    unsigned dmax;              /* maximum distance from zlib header */
+#endif
+    unsigned wsize;             /* window size or zero if not using window */
+    unsigned whave;             /* valid bytes in the window */
+    unsigned wnext;             /* window write index */
+    unsigned char FAR *window;  /* allocated sliding window, if wsize != 0 */
+    inflate_holder_t hold;      /* local strm->hold */
+    unsigned bits;              /* local strm->bits */
+    code const FAR *lcode;      /* local strm->lencode */
+    code const FAR *dcode;      /* local strm->distcode */
+    unsigned lmask;             /* mask for first level of length codes */
+    unsigned dmask;             /* mask for first level of distance codes */
+    code here;                  /* retrieved table entry */
+    unsigned op;                /* code bits, operation, extra bits, or */
+                                /*  window position, window bytes to copy */
+    unsigned len;               /* match length, unused bytes */
+    unsigned dist;              /* match distance */
+    unsigned char FAR *from;    /* where to copy match from */
+
+    /* copy state to local variables */
+    state = (struct inflate_state FAR *)strm->state;
+    in = strm->next_in;
+    last = in + (strm->avail_in - (INFLATE_FAST_MIN_INPUT - 1));
+    out = strm->next_out;
+    beg = out - (start - strm->avail_out);
+    end = out + (strm->avail_out - (INFLATE_FAST_MIN_OUTPUT - 1));
+    limit = out + strm->avail_out;
+#ifdef INFLATE_STRICT
+    dmax = state->dmax;
+#endif
+    wsize = state->wsize;
+    whave = state->whave;
+    wnext = (state->wnext == 0 && whave >= wsize) ? wsize : state->wnext;
+    window = state->window;
+    hold = state->hold;
+    bits = state->bits;
+    lcode = state->lencode;
+    dcode = state->distcode;
+    lmask = (1U << state->lenbits) - 1;
+    dmask = (1U << state->distbits) - 1;
+
+    /* decode literals and length/distances until end-of-block or not enough
+       input data or output space */
+    do {
+        if (bits < 15) {
+#ifdef INFLATE_CHUNK_READ_64LE
+            hold |= read64le(in) << bits;
+            in += 6;
+            bits += 48;
+#else
+            hold += (unsigned long)(*in++) << bits;
+            bits += 8;
+            hold += (unsigned long)(*in++) << bits;
+            bits += 8;
+#endif
+        }
+        here = lcode[hold & lmask];
+      dolen:
+        op = (unsigned)(here.bits);
+        hold >>= op;
+        bits -= op;
+        op = (unsigned)(here.op);
+        if (op == 0) {                          /* literal */
+            Tracevv((stderr, here.val >= 0x20 && here.val < 0x7f ?
+                    "inflate:         literal '%c'\n" :
+                    "inflate:         literal 0x%02x\n", here.val));
+            *out++ = (unsigned char)(here.val);
+        }
+        else if (op & 16) {                     /* length base */
+            len = (unsigned)(here.val);
+            op &= 15;                           /* number of extra bits */
+            if (op) {
+                if (bits < op) {
+#ifdef INFLATE_CHUNK_READ_64LE
+                    hold |= read64le(in) << bits;
+                    in += 6;
+                    bits += 48;
+#else
+                    hold += (unsigned long)(*in++) << bits;
+                    bits += 8;
+#endif
+                }
+                len += (unsigned)hold & ((1U << op) - 1);
+                hold >>= op;
+                bits -= op;
+            }
+            Tracevv((stderr, "inflate:         length %u\n", len));
+            if (bits < 15) {
+#ifdef INFLATE_CHUNK_READ_64LE
+                hold |= read64le(in) << bits;
+                in += 6;
+                bits += 48;
+#else
+                hold += (unsigned long)(*in++) << bits;
+                bits += 8;
+                hold += (unsigned long)(*in++) << bits;
+                bits += 8;
+#endif
+            }
+            here = dcode[hold & dmask];
+          dodist:
+            op = (unsigned)(here.bits);
+            hold >>= op;
+            bits -= op;
+            op = (unsigned)(here.op);
+            if (op & 16) {                      /* distance base */
+                dist = (unsigned)(here.val);
+                op &= 15;                       /* number of extra bits */
+                if (bits < op) {
+#ifdef INFLATE_CHUNK_READ_64LE
+                    hold |= read64le(in) << bits;
+                    in += 6;
+                    bits += 48;
+#else
+                    hold += (unsigned long)(*in++) << bits;
+                    bits += 8;
+                    if (bits < op) {
+                        hold += (unsigned long)(*in++) << bits;
+                        bits += 8;
+                    }
+#endif
+                }
+                dist += (unsigned)hold & ((1U << op) - 1);
+#ifdef INFLATE_STRICT
+                if (dist > dmax) {
+                    strm->msg = (char *)"invalid distance too far back";
+                    state->mode = BAD;
+                    break;
+                }
+#endif
+                hold >>= op;
+                bits -= op;
+                Tracevv((stderr, "inflate:         distance %u\n", dist));
+                op = (unsigned)(out - beg);     /* max distance in output */
+                if (dist > op) {                /* see if copy from window */
+                    op = dist - op;             /* distance back in window */
+                    if (op > whave) {
+                        if (state->sane) {
+                            strm->msg =
+                                (char *)"invalid distance too far back";
+                            state->mode = BAD;
+                            break;
+                        }
+#ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR
+                        if (len <= op - whave) {
+                            do {
+                                *out++ = 0;
+                            } while (--len);
+                            continue;
+                        }
+                        len -= op - whave;
+                        do {
+                            *out++ = 0;
+                        } while (--op > whave);
+                        if (op == 0) {
+                            from = out - dist;
+                            do {
+                                *out++ = *from++;
+                            } while (--len);
+                            continue;
+                        }
+#endif
+                    }
+                    from = window;
+                    if (wnext >= op) {          /* contiguous in window */
+                        from += wnext - op;
+                    }
+                    else {                      /* wrap around window */
+                        op -= wnext;
+                        from += wsize - op;
+                        if (op < len) {         /* some from end of window */
+                            len -= op;
+                            out = chunkcopy_safe(out, from, op, limit);
+                            from = window;      /* more from start of window */
+                            op = wnext;
+                            /* This (rare) case can create a situation where
+                               the first chunkcopy below must be checked.
+                             */
+                        }
+                    }
+                    if (op < len) {             /* still need some from output */
+                        out = chunkcopy_safe(out, from, op, limit);
+                        len -= op;
+                        /* When dist is small the amount of data that can be
+                           copied from the window is also small, and progress
+                           towards the dangerous end of the output buffer is
+                           also small.  This means that for trivial memsets and
+                           for chunkunroll_relaxed() a safety check is
+                           unnecessary.  However, these conditions may not be
+                           entered at all, and in that case it's possible that
+                           the main copy is near the end.
+                          */
+                        out = chunkunroll_relaxed(out, &dist, &len);
+                        out = chunkcopy_safe(out, out - dist, len, limit);
+                    } else {
+                        /* from points to window, so there is no risk of
+                           overlapping pointers requiring memset-like behaviour
+                         */
+                        out = chunkcopy_safe(out, from, len, limit);
+                    }
+                }
+                else {
+                    /* Whole reference is in range of current output.  No
+                       range checks are necessary because we start with room
+                       for at least 258 bytes of output, so unroll and roundoff
+                       operations can write beyond `out+len` so long as they
+                       stay within 258 bytes of `out`.
+                     */
+                    out = chunkcopy_lapped_relaxed(out, dist, len);
+                }
+            }
+            else if ((op & 64) == 0) {          /* 2nd level distance code */
+                here = dcode[here.val + (hold & ((1U << op) - 1))];
+                goto dodist;
+            }
+            else {
+                strm->msg = (char *)"invalid distance code";
+                state->mode = BAD;
+                break;
+            }
+        }
+        else if ((op & 64) == 0) {              /* 2nd level length code */
+            here = lcode[here.val + (hold & ((1U << op) - 1))];
+            goto dolen;
+        }
+        else if (op & 32) {                     /* end-of-block */
+            Tracevv((stderr, "inflate:         end of block\n"));
+            state->mode = TYPE;
+            break;
+        }
+        else {
+            strm->msg = (char *)"invalid literal/length code";
+            state->mode = BAD;
+            break;
+        }
+    } while (in < last && out < end);
+
+    /* return unused bytes (on entry, bits < 8, so in won't go too far back) */
+    len = bits >> 3;
+    in -= len;
+    bits -= len << 3;
+    hold &= (1U << bits) - 1;
+
+    /* update state and return */
+    strm->next_in = in;
+    strm->next_out = out;
+    strm->avail_in = (unsigned)(in < last ?
+        (INFLATE_FAST_MIN_INPUT - 1) + (last - in) :
+        (INFLATE_FAST_MIN_INPUT - 1) - (in - last));
+    strm->avail_out = (unsigned)(out < end ?
+        (INFLATE_FAST_MIN_OUTPUT - 1) + (end - out) :
+        (INFLATE_FAST_MIN_OUTPUT - 1) - (out - end));
+    state->hold = hold;
+    state->bits = bits;
+
+    Assert((state->hold >> state->bits) == 0, "invalid input data state");
+    return;
+}
+
+/*
+   inflate_fast() speedups that turned out slower (on a PowerPC G3 750CXe):
+   - Using bit fields for code structure
+   - Different op definition to avoid & for extra bits (do & for table bits)
+   - Three separate decoding do-loops for direct, window, and wnext == 0
+   - Special case for distance > 1 copies to do overlapped load and store copy
+   - Explicit branch predictions (based on measured branch probabilities)
+   - Deferring match copy and interspersed it with decoding subsequent codes
+   - Swapping literal/length else
+   - Swapping window/direct else
+   - Larger unrolled copy loops (three is about right)
+   - Moving len -= 3 statement into middle of loop
+ */
+
+#endif /* !ASMINF */
diff --git a/deps/v8/third_party/zlib/contrib/optimizations/inffast_chunk.h b/deps/v8/third_party/zlib/contrib/optimizations/inffast_chunk.h
new file mode 100644
index 00000000000000..39c771b863c7ed
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/optimizations/inffast_chunk.h
@@ -0,0 +1,26 @@
+/* inffast_chunk.h -- header to use inffast_chunk.c
+ * Copyright (C) 1995-2003, 2010 Mark Adler
+ * Copyright (C) 2017 ARM, Inc.
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/* WARNING: this file should *not* be used by applications. It is
+   part of the implementation of the compression library and is
+   subject to change. Applications should only use zlib.h.
+ */
+
+#include "inffast.h"
+
+/* INFLATE_FAST_MIN_INPUT: the minimum number of input bytes needed so that
+   we can safely call inflate_fast() with only one up-front bounds check. One
+   length/distance code pair (15 bits for the length code, 5 bits for length
+   extra, 15 bits for the distance code, 13 bits for distance extra) requires
+   reading up to 48 input bits (6 bytes). The wide input data reading option
+   requires a little endian machine, and reads 64 input bits (8 bytes).
+*/
+#ifdef INFLATE_CHUNK_READ_64LE
+#undef INFLATE_FAST_MIN_INPUT
+#define INFLATE_FAST_MIN_INPUT 8
+#endif
+
+void ZLIB_INTERNAL inflate_fast_chunk_ OF((z_streamp strm, unsigned start));
diff --git a/deps/v8/third_party/zlib/contrib/optimizations/inflate.c b/deps/v8/third_party/zlib/contrib/optimizations/inflate.c
new file mode 100644
index 00000000000000..81d558bd6ef5fa
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/optimizations/inflate.c
@@ -0,0 +1,1583 @@
+/* inflate.c -- zlib decompression
+ * Copyright (C) 1995-2016 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/*
+ * Change history:
+ *
+ * 1.2.beta0    24 Nov 2002
+ * - First version -- complete rewrite of inflate to simplify code, avoid
+ *   creation of window when not needed, minimize use of window when it is
+ *   needed, make inffast.c even faster, implement gzip decoding, and to
+ *   improve code readability and style over the previous zlib inflate code
+ *
+ * 1.2.beta1    25 Nov 2002
+ * - Use pointers for available input and output checking in inffast.c
+ * - Remove input and output counters in inffast.c
+ * - Change inffast.c entry and loop from avail_in >= 7 to >= 6
+ * - Remove unnecessary second byte pull from length extra in inffast.c
+ * - Unroll direct copy to three copies per loop in inffast.c
+ *
+ * 1.2.beta2    4 Dec 2002
+ * - Change external routine names to reduce potential conflicts
+ * - Correct filename to inffixed.h for fixed tables in inflate.c
+ * - Make hbuf[] unsigned char to match parameter type in inflate.c
+ * - Change strm->next_out[-state->offset] to *(strm->next_out - state->offset)
+ *   to avoid negation problem on Alphas (64 bit) in inflate.c
+ *
+ * 1.2.beta3    22 Dec 2002
+ * - Add comments on state->bits assertion in inffast.c
+ * - Add comments on op field in inftrees.h
+ * - Fix bug in reuse of allocated window after inflateReset()
+ * - Remove bit fields--back to byte structure for speed
+ * - Remove distance extra == 0 check in inflate_fast()--only helps for lengths
+ * - Change post-increments to pre-increments in inflate_fast(), PPC biased?
+ * - Add compile time option, POSTINC, to use post-increments instead (Intel?)
+ * - Make MATCH copy in inflate() much faster for when inflate_fast() not used
+ * - Use local copies of stream next and avail values, as well as local bit
+ *   buffer and bit count in inflate()--for speed when inflate_fast() not used
+ *
+ * 1.2.beta4    1 Jan 2003
+ * - Split ptr - 257 statements in inflate_table() to avoid compiler warnings
+ * - Move a comment on output buffer sizes from inffast.c to inflate.c
+ * - Add comments in inffast.c to introduce the inflate_fast() routine
+ * - Rearrange window copies in inflate_fast() for speed and simplification
+ * - Unroll last copy for window match in inflate_fast()
+ * - Use local copies of window variables in inflate_fast() for speed
+ * - Pull out common wnext == 0 case for speed in inflate_fast()
+ * - Make op and len in inflate_fast() unsigned for consistency
+ * - Add FAR to lcode and dcode declarations in inflate_fast()
+ * - Simplified bad distance check in inflate_fast()
+ * - Added inflateBackInit(), inflateBack(), and inflateBackEnd() in new
+ *   source file infback.c to provide a call-back interface to inflate for
+ *   programs like gzip and unzip -- uses window as output buffer to avoid
+ *   window copying
+ *
+ * 1.2.beta5    1 Jan 2003
+ * - Improved inflateBack() interface to allow the caller to provide initial
+ *   input in strm.
+ * - Fixed stored blocks bug in inflateBack()
+ *
+ * 1.2.beta6    4 Jan 2003
+ * - Added comments in inffast.c on effectiveness of POSTINC
+ * - Typecasting all around to reduce compiler warnings
+ * - Changed loops from while (1) or do {} while (1) to for (;;), again to
+ *   make compilers happy
+ * - Changed type of window in inflateBackInit() to unsigned char *
+ *
+ * 1.2.beta7    27 Jan 2003
+ * - Changed many types to unsigned or unsigned short to avoid warnings
+ * - Added inflateCopy() function
+ *
+ * 1.2.0        9 Mar 2003
+ * - Changed inflateBack() interface to provide separate opaque descriptors
+ *   for the in() and out() functions
+ * - Changed inflateBack() argument and in_func typedef to swap the length
+ *   and buffer address return values for the input function
+ * - Check next_in and next_out for Z_NULL on entry to inflate()
+ *
+ * The history for versions after 1.2.0 are in ChangeLog in zlib distribution.
+ */
+
+#include "zutil.h"
+#include "inftrees.h"
+#include "inflate.h"
+#include "contrib/optimizations/inffast_chunk.h"
+#include "contrib/optimizations/chunkcopy.h"
+
+#ifdef MAKEFIXED
+#  ifndef BUILDFIXED
+#    define BUILDFIXED
+#  endif
+#endif
+
+/* function prototypes */
+local int inflateStateCheck OF((z_streamp strm));
+local void fixedtables OF((struct inflate_state FAR *state));
+local int updatewindow OF((z_streamp strm, const unsigned char FAR *end,
+                           unsigned copy));
+#ifdef BUILDFIXED
+   void makefixed OF((void));
+#endif
+local unsigned syncsearch OF((unsigned FAR *have, const unsigned char FAR *buf,
+                              unsigned len));
+
+local int inflateStateCheck(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+    if (strm == Z_NULL ||
+        strm->zalloc == (alloc_func)0 || strm->zfree == (free_func)0)
+        return 1;
+    state = (struct inflate_state FAR *)strm->state;
+    if (state == Z_NULL || state->strm != strm ||
+        state->mode < HEAD || state->mode > SYNC)
+        return 1;
+    return 0;
+}
+
+int ZEXPORT inflateResetKeep(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    strm->total_in = strm->total_out = state->total = 0;
+    strm->msg = Z_NULL;
+    if (state->wrap)        /* to support ill-conceived Java test suite */
+        strm->adler = state->wrap & 1;
+    state->mode = HEAD;
+    state->last = 0;
+    state->havedict = 0;
+    state->dmax = 32768U;
+    state->head = Z_NULL;
+    state->hold = 0;
+    state->bits = 0;
+    state->lencode = state->distcode = state->next = state->codes;
+    state->sane = 1;
+    state->back = -1;
+    Tracev((stderr, "inflate: reset\n"));
+    return Z_OK;
+}
+
+int ZEXPORT inflateReset(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    state->wsize = 0;
+    state->whave = 0;
+    state->wnext = 0;
+    return inflateResetKeep(strm);
+}
+
+int ZEXPORT inflateReset2(strm, windowBits)
+z_streamp strm;
+int windowBits;
+{
+    int wrap;
+    struct inflate_state FAR *state;
+
+    /* get the state */
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+
+    /* extract wrap request from windowBits parameter */
+    if (windowBits < 0) {
+        wrap = 0;
+        windowBits = -windowBits;
+    }
+    else {
+        wrap = (windowBits >> 4) + 5;
+#ifdef GUNZIP
+        if (windowBits < 48)
+            windowBits &= 15;
+#endif
+    }
+
+    /* set number of window bits, free window if different */
+    if (windowBits && (windowBits < 8 || windowBits > 15))
+        return Z_STREAM_ERROR;
+    if (state->window != Z_NULL && state->wbits != (unsigned)windowBits) {
+        ZFREE(strm, state->window);
+        state->window = Z_NULL;
+    }
+
+    /* update state and reset the rest of it */
+    state->wrap = wrap;
+    state->wbits = (unsigned)windowBits;
+    return inflateReset(strm);
+}
+
+int ZEXPORT inflateInit2_(strm, windowBits, version, stream_size)
+z_streamp strm;
+int windowBits;
+const char *version;
+int stream_size;
+{
+    int ret;
+    struct inflate_state FAR *state;
+
+    if (version == Z_NULL || version[0] != ZLIB_VERSION[0] ||
+        stream_size != (int)(sizeof(z_stream)))
+        return Z_VERSION_ERROR;
+    if (strm == Z_NULL) return Z_STREAM_ERROR;
+    strm->msg = Z_NULL;                 /* in case we return an error */
+    if (strm->zalloc == (alloc_func)0) {
+#ifdef Z_SOLO
+        return Z_STREAM_ERROR;
+#else
+        strm->zalloc = zcalloc;
+        strm->opaque = (voidpf)0;
+#endif
+    }
+    if (strm->zfree == (free_func)0)
+#ifdef Z_SOLO
+        return Z_STREAM_ERROR;
+#else
+        strm->zfree = zcfree;
+#endif
+    state = (struct inflate_state FAR *)
+            ZALLOC(strm, 1, sizeof(struct inflate_state));
+    if (state == Z_NULL) return Z_MEM_ERROR;
+    Tracev((stderr, "inflate: allocated\n"));
+    strm->state = (struct internal_state FAR *)state;
+    state->strm = strm;
+    state->window = Z_NULL;
+    state->mode = HEAD;     /* to pass state test in inflateReset2() */
+    state->check = 1L;      /* 1L is the result of adler32() zero length data */
+    ret = inflateReset2(strm, windowBits);
+    if (ret != Z_OK) {
+        ZFREE(strm, state);
+        strm->state = Z_NULL;
+    }
+    return ret;
+}
+
+int ZEXPORT inflateInit_(strm, version, stream_size)
+z_streamp strm;
+const char *version;
+int stream_size;
+{
+    return inflateInit2_(strm, DEF_WBITS, version, stream_size);
+}
+
+int ZEXPORT inflatePrime(strm, bits, value)
+z_streamp strm;
+int bits;
+int value;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    if (bits < 0) {
+        state->hold = 0;
+        state->bits = 0;
+        return Z_OK;
+    }
+    if (bits > 16 || state->bits + (uInt)bits > 32) return Z_STREAM_ERROR;
+    value &= (1L << bits) - 1;
+    state->hold += (unsigned)value << state->bits;
+    state->bits += (uInt)bits;
+    return Z_OK;
+}
+
+/*
+   Return state with length and distance decoding tables and index sizes set to
+   fixed code decoding.  Normally this returns fixed tables from inffixed.h.
+   If BUILDFIXED is defined, then instead this routine builds the tables the
+   first time it's called, and returns those tables the first time and
+   thereafter.  This reduces the size of the code by about 2K bytes, in
+   exchange for a little execution time.  However, BUILDFIXED should not be
+   used for threaded applications, since the rewriting of the tables and virgin
+   may not be thread-safe.
+ */
+local void fixedtables(state)
+struct inflate_state FAR *state;
+{
+#ifdef BUILDFIXED
+    static int virgin = 1;
+    static code *lenfix, *distfix;
+    static code fixed[544];
+
+    /* build fixed huffman tables if first call (may not be thread safe) */
+    if (virgin) {
+        unsigned sym, bits;
+        static code *next;
+
+        /* literal/length table */
+        sym = 0;
+        while (sym < 144) state->lens[sym++] = 8;
+        while (sym < 256) state->lens[sym++] = 9;
+        while (sym < 280) state->lens[sym++] = 7;
+        while (sym < 288) state->lens[sym++] = 8;
+        next = fixed;
+        lenfix = next;
+        bits = 9;
+        inflate_table(LENS, state->lens, 288, &(next), &(bits), state->work);
+
+        /* distance table */
+        sym = 0;
+        while (sym < 32) state->lens[sym++] = 5;
+        distfix = next;
+        bits = 5;
+        inflate_table(DISTS, state->lens, 32, &(next), &(bits), state->work);
+
+        /* do this just once */
+        virgin = 0;
+    }
+#else /* !BUILDFIXED */
+#   include "inffixed.h"
+#endif /* BUILDFIXED */
+    state->lencode = lenfix;
+    state->lenbits = 9;
+    state->distcode = distfix;
+    state->distbits = 5;
+}
+
+#ifdef MAKEFIXED
+#include <stdio.h>
+
+/*
+   Write out the inffixed.h that is #include'd above.  Defining MAKEFIXED also
+   defines BUILDFIXED, so the tables are built on the fly.  makefixed() writes
+   those tables to stdout, which would be piped to inffixed.h.  A small program
+   can simply call makefixed to do this:
+
+    void makefixed(void);
+
+    int main(void)
+    {
+        makefixed();
+        return 0;
+    }
+
+   Then that can be linked with zlib built with MAKEFIXED defined and run:
+
+    a.out > inffixed.h
+ */
+void makefixed()
+{
+    unsigned low, size;
+    struct inflate_state state;
+
+    fixedtables(&state);
+    puts("    /* inffixed.h -- table for decoding fixed codes");
+    puts("     * Generated automatically by makefixed().");
+    puts("     */");
+    puts("");
+    puts("    /* WARNING: this file should *not* be used by applications.");
+    puts("       It is part of the implementation of this library and is");
+    puts("       subject to change. Applications should only use zlib.h.");
+    puts("     */");
+    puts("");
+    size = 1U << 9;
+    printf("    static const code lenfix[%u] = {", size);
+    low = 0;
+    for (;;) {
+        if ((low % 7) == 0) printf("\n        ");
+        printf("{%u,%u,%d}", (low & 127) == 99 ? 64 : state.lencode[low].op,
+               state.lencode[low].bits, state.lencode[low].val);
+        if (++low == size) break;
+        putchar(',');
+    }
+    puts("\n    };");
+    size = 1U << 5;
+    printf("\n    static const code distfix[%u] = {", size);
+    low = 0;
+    for (;;) {
+        if ((low % 6) == 0) printf("\n        ");
+        printf("{%u,%u,%d}", state.distcode[low].op, state.distcode[low].bits,
+               state.distcode[low].val);
+        if (++low == size) break;
+        putchar(',');
+    }
+    puts("\n    };");
+}
+#endif /* MAKEFIXED */
+
+/*
+   Update the window with the last wsize (normally 32K) bytes written before
+   returning.  If window does not exist yet, create it.  This is only called
+   when a window is already in use, or when output has been written during this
+   inflate call, but the end of the deflate stream has not been reached yet.
+   It is also called to create a window for dictionary data when a dictionary
+   is loaded.
+
+   Providing output buffers larger than 32K to inflate() should provide a speed
+   advantage, since only the last 32K of output is copied to the sliding window
+   upon return from inflate(), and since all distances after the first 32K of
+   output will fall in the output data, making match copies simpler and faster.
+   The advantage may be dependent on the size of the processor's data caches.
+ */
+local int updatewindow(strm, end, copy)
+z_streamp strm;
+const Bytef *end;
+unsigned copy;
+{
+    struct inflate_state FAR *state;
+    unsigned dist;
+
+    state = (struct inflate_state FAR *)strm->state;
+
+    /* if it hasn't been done already, allocate space for the window */
+    if (state->window == Z_NULL) {
+        unsigned wsize = 1U << state->wbits;
+        state->window = (unsigned char FAR *)
+                        ZALLOC(strm, wsize + CHUNKCOPY_CHUNK_SIZE,
+                               sizeof(unsigned char));
+        if (state->window == Z_NULL) return 1;
+#ifdef INFLATE_CLEAR_UNUSED_UNDEFINED
+        /* Copies from the overflow portion of this buffer are undefined and
+           may cause analysis tools to raise a warning if we don't initialize
+           it.  However, this undefined data overwrites other undefined data
+           and is subsequently either overwritten or left deliberately
+           undefined at the end of decode; so there's really no point.
+         */
+        zmemzero(state->window + wsize, CHUNKCOPY_CHUNK_SIZE);
+#endif
+    }
+
+    /* if window not in use yet, initialize */
+    if (state->wsize == 0) {
+        state->wsize = 1U << state->wbits;
+        state->wnext = 0;
+        state->whave = 0;
+    }
+
+    /* copy state->wsize or less output bytes into the circular window */
+    if (copy >= state->wsize) {
+        zmemcpy(state->window, end - state->wsize, state->wsize);
+        state->wnext = 0;
+        state->whave = state->wsize;
+    }
+    else {
+        dist = state->wsize - state->wnext;
+        if (dist > copy) dist = copy;
+        zmemcpy(state->window + state->wnext, end - copy, dist);
+        copy -= dist;
+        if (copy) {
+            zmemcpy(state->window, end - copy, copy);
+            state->wnext = copy;
+            state->whave = state->wsize;
+        }
+        else {
+            state->wnext += dist;
+            if (state->wnext == state->wsize) state->wnext = 0;
+            if (state->whave < state->wsize) state->whave += dist;
+        }
+    }
+    return 0;
+}
+
+/* Macros for inflate(): */
+
+/* check function to use adler32() for zlib or crc32() for gzip */
+#ifdef GUNZIP
+#  define UPDATE(check, buf, len) \
+    (state->flags ? crc32(check, buf, len) : adler32(check, buf, len))
+#else
+#  define UPDATE(check, buf, len) adler32(check, buf, len)
+#endif
+
+/* check macros for header crc */
+#ifdef GUNZIP
+#  define CRC2(check, word) \
+    do { \
+        hbuf[0] = (unsigned char)(word); \
+        hbuf[1] = (unsigned char)((word) >> 8); \
+        check = crc32(check, hbuf, 2); \
+    } while (0)
+
+#  define CRC4(check, word) \
+    do { \
+        hbuf[0] = (unsigned char)(word); \
+        hbuf[1] = (unsigned char)((word) >> 8); \
+        hbuf[2] = (unsigned char)((word) >> 16); \
+        hbuf[3] = (unsigned char)((word) >> 24); \
+        check = crc32(check, hbuf, 4); \
+    } while (0)
+#endif
+
+/* Load registers with state in inflate() for speed */
+#define LOAD() \
+    do { \
+        put = strm->next_out; \
+        left = strm->avail_out; \
+        next = strm->next_in; \
+        have = strm->avail_in; \
+        hold = state->hold; \
+        bits = state->bits; \
+    } while (0)
+
+/* Restore state from registers in inflate() */
+#define RESTORE() \
+    do { \
+        strm->next_out = put; \
+        strm->avail_out = left; \
+        strm->next_in = next; \
+        strm->avail_in = have; \
+        state->hold = hold; \
+        state->bits = bits; \
+    } while (0)
+
+/* Clear the input bit accumulator */
+#define INITBITS() \
+    do { \
+        hold = 0; \
+        bits = 0; \
+    } while (0)
+
+/* Get a byte of input into the bit accumulator, or return from inflate()
+   if there is no input available. */
+#define PULLBYTE() \
+    do { \
+        if (have == 0) goto inf_leave; \
+        have--; \
+        hold += (unsigned long)(*next++) << bits; \
+        bits += 8; \
+    } while (0)
+
+/* Assure that there are at least n bits in the bit accumulator.  If there is
+   not enough available input to do that, then return from inflate(). */
+#define NEEDBITS(n) \
+    do { \
+        while (bits < (unsigned)(n)) \
+            PULLBYTE(); \
+    } while (0)
+
+/* Return the low n bits of the bit accumulator (n < 16) */
+#define BITS(n) \
+    ((unsigned)hold & ((1U << (n)) - 1))
+
+/* Remove n bits from the bit accumulator */
+#define DROPBITS(n) \
+    do { \
+        hold >>= (n); \
+        bits -= (unsigned)(n); \
+    } while (0)
+
+/* Remove zero to seven bits as needed to go to a byte boundary */
+#define BYTEBITS() \
+    do { \
+        hold >>= bits & 7; \
+        bits -= bits & 7; \
+    } while (0)
+
+/*
+   inflate() uses a state machine to process as much input data and generate as
+   much output data as possible before returning.  The state machine is
+   structured roughly as follows:
+
+    for (;;) switch (state) {
+    ...
+    case STATEn:
+        if (not enough input data or output space to make progress)
+            return;
+        ... make progress ...
+        state = STATEm;
+        break;
+    ...
+    }
+
+   so when inflate() is called again, the same case is attempted again, and
+   if the appropriate resources are provided, the machine proceeds to the
+   next state.  The NEEDBITS() macro is usually the way the state evaluates
+   whether it can proceed or should return.  NEEDBITS() does the return if
+   the requested bits are not available.  The typical use of the BITS macros
+   is:
+
+        NEEDBITS(n);
+        ... do something with BITS(n) ...
+        DROPBITS(n);
+
+   where NEEDBITS(n) either returns from inflate() if there isn't enough
+   input left to load n bits into the accumulator, or it continues.  BITS(n)
+   gives the low n bits in the accumulator.  When done, DROPBITS(n) drops
+   the low n bits off the accumulator.  INITBITS() clears the accumulator
+   and sets the number of available bits to zero.  BYTEBITS() discards just
+   enough bits to put the accumulator on a byte boundary.  After BYTEBITS()
+   and a NEEDBITS(8), then BITS(8) would return the next byte in the stream.
+
+   NEEDBITS(n) uses PULLBYTE() to get an available byte of input, or to return
+   if there is no input available.  The decoding of variable length codes uses
+   PULLBYTE() directly in order to pull just enough bytes to decode the next
+   code, and no more.
+
+   Some states loop until they get enough input, making sure that enough
+   state information is maintained to continue the loop where it left off
+   if NEEDBITS() returns in the loop.  For example, want, need, and keep
+   would all have to actually be part of the saved state in case NEEDBITS()
+   returns:
+
+    case STATEw:
+        while (want < need) {
+            NEEDBITS(n);
+            keep[want++] = BITS(n);
+            DROPBITS(n);
+        }
+        state = STATEx;
+    case STATEx:
+
+   As shown above, if the next state is also the next case, then the break
+   is omitted.
+
+   A state may also return if there is not enough output space available to
+   complete that state.  Those states are copying stored data, writing a
+   literal byte, and copying a matching string.
+
+   When returning, a "goto inf_leave" is used to update the total counters,
+   update the check value, and determine whether any progress has been made
+   during that inflate() call in order to return the proper return code.
+   Progress is defined as a change in either strm->avail_in or strm->avail_out.
+   When there is a window, goto inf_leave will update the window with the last
+   output written.  If a goto inf_leave occurs in the middle of decompression
+   and there is no window currently, goto inf_leave will create one and copy
+   output to the window for the next call of inflate().
+
+   In this implementation, the flush parameter of inflate() only affects the
+   return code (per zlib.h).  inflate() always writes as much as possible to
+   strm->next_out, given the space available and the provided input--the effect
+   documented in zlib.h of Z_SYNC_FLUSH.  Furthermore, inflate() always defers
+   the allocation of and copying into a sliding window until necessary, which
+   provides the effect documented in zlib.h for Z_FINISH when the entire input
+   stream available.  So the only thing the flush parameter actually does is:
+   when flush is set to Z_FINISH, inflate() cannot return Z_OK.  Instead it
+   will return Z_BUF_ERROR if it has not reached the end of the stream.
+ */
+
+int ZEXPORT inflate(strm, flush)
+z_streamp strm;
+int flush;
+{
+    struct inflate_state FAR *state;
+    z_const unsigned char FAR *next;    /* next input */
+    unsigned char FAR *put;     /* next output */
+    unsigned have, left;        /* available input and output */
+    unsigned long hold;         /* bit buffer */
+    unsigned bits;              /* bits in bit buffer */
+    unsigned in, out;           /* save starting available input and output */
+    unsigned copy;              /* number of stored or match bytes to copy */
+    unsigned char FAR *from;    /* where to copy match bytes from */
+    code here;                  /* current decoding table entry */
+    code last;                  /* parent table entry */
+    unsigned len;               /* length to copy for repeats, bits to drop */
+    int ret;                    /* return code */
+#ifdef GUNZIP
+    unsigned char hbuf[4];      /* buffer for gzip header crc calculation */
+#endif
+    static const unsigned short order[19] = /* permutation of code lengths */
+        {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
+
+    if (inflateStateCheck(strm) || strm->next_out == Z_NULL ||
+        (strm->next_in == Z_NULL && strm->avail_in != 0))
+        return Z_STREAM_ERROR;
+
+    state = (struct inflate_state FAR *)strm->state;
+    if (state->mode == TYPE) state->mode = TYPEDO;      /* skip check */
+    LOAD();
+    in = have;
+    out = left;
+    ret = Z_OK;
+    for (;;)
+        switch (state->mode) {
+        case HEAD:
+            if (state->wrap == 0) {
+                state->mode = TYPEDO;
+                break;
+            }
+            NEEDBITS(16);
+#ifdef GUNZIP
+            if ((state->wrap & 2) && hold == 0x8b1f) {  /* gzip header */
+                if (state->wbits == 0)
+                    state->wbits = 15;
+                state->check = crc32(0L, Z_NULL, 0);
+                CRC2(state->check, hold);
+                INITBITS();
+                state->mode = FLAGS;
+                break;
+            }
+            state->flags = 0;           /* expect zlib header */
+            if (state->head != Z_NULL)
+                state->head->done = -1;
+            if (!(state->wrap & 1) ||   /* check if zlib header allowed */
+#else
+            if (
+#endif
+                ((BITS(8) << 8) + (hold >> 8)) % 31) {
+                strm->msg = (char *)"incorrect header check";
+                state->mode = BAD;
+                break;
+            }
+            if (BITS(4) != Z_DEFLATED) {
+                strm->msg = (char *)"unknown compression method";
+                state->mode = BAD;
+                break;
+            }
+            DROPBITS(4);
+            len = BITS(4) + 8;
+            if (state->wbits == 0)
+                state->wbits = len;
+            if (len > 15 || len > state->wbits) {
+                strm->msg = (char *)"invalid window size";
+                state->mode = BAD;
+                break;
+            }
+            state->dmax = 1U << len;
+            Tracev((stderr, "inflate:   zlib header ok\n"));
+            strm->adler = state->check = adler32(0L, Z_NULL, 0);
+            state->mode = hold & 0x200 ? DICTID : TYPE;
+            INITBITS();
+            break;
+#ifdef GUNZIP
+        case FLAGS:
+            NEEDBITS(16);
+            state->flags = (int)(hold);
+            if ((state->flags & 0xff) != Z_DEFLATED) {
+                strm->msg = (char *)"unknown compression method";
+                state->mode = BAD;
+                break;
+            }
+            if (state->flags & 0xe000) {
+                strm->msg = (char *)"unknown header flags set";
+                state->mode = BAD;
+                break;
+            }
+            if (state->head != Z_NULL)
+                state->head->text = (int)((hold >> 8) & 1);
+            if ((state->flags & 0x0200) && (state->wrap & 4))
+                CRC2(state->check, hold);
+            INITBITS();
+            state->mode = TIME;
+        case TIME:
+            NEEDBITS(32);
+            if (state->head != Z_NULL)
+                state->head->time = hold;
+            if ((state->flags & 0x0200) && (state->wrap & 4))
+                CRC4(state->check, hold);
+            INITBITS();
+            state->mode = OS;
+        case OS:
+            NEEDBITS(16);
+            if (state->head != Z_NULL) {
+                state->head->xflags = (int)(hold & 0xff);
+                state->head->os = (int)(hold >> 8);
+            }
+            if ((state->flags & 0x0200) && (state->wrap & 4))
+                CRC2(state->check, hold);
+            INITBITS();
+            state->mode = EXLEN;
+        case EXLEN:
+            if (state->flags & 0x0400) {
+                NEEDBITS(16);
+                state->length = (unsigned)(hold);
+                if (state->head != Z_NULL)
+                    state->head->extra_len = (unsigned)hold;
+                if ((state->flags & 0x0200) && (state->wrap & 4))
+                    CRC2(state->check, hold);
+                INITBITS();
+            }
+            else if (state->head != Z_NULL)
+                state->head->extra = Z_NULL;
+            state->mode = EXTRA;
+        case EXTRA:
+            if (state->flags & 0x0400) {
+                copy = state->length;
+                if (copy > have) copy = have;
+                if (copy) {
+                    if (state->head != Z_NULL &&
+                        state->head->extra != Z_NULL) {
+                        len = state->head->extra_len - state->length;
+                        zmemcpy(state->head->extra + len, next,
+                                len + copy > state->head->extra_max ?
+                                state->head->extra_max - len : copy);
+                    }
+                    if ((state->flags & 0x0200) && (state->wrap & 4))
+                        state->check = crc32(state->check, next, copy);
+                    have -= copy;
+                    next += copy;
+                    state->length -= copy;
+                }
+                if (state->length) goto inf_leave;
+            }
+            state->length = 0;
+            state->mode = NAME;
+        case NAME:
+            if (state->flags & 0x0800) {
+                if (have == 0) goto inf_leave;
+                copy = 0;
+                do {
+                    len = (unsigned)(next[copy++]);
+                    if (state->head != Z_NULL &&
+                            state->head->name != Z_NULL &&
+                            state->length < state->head->name_max)
+                        state->head->name[state->length++] = (Bytef)len;
+                } while (len && copy < have);
+                if ((state->flags & 0x0200) && (state->wrap & 4))
+                    state->check = crc32(state->check, next, copy);
+                have -= copy;
+                next += copy;
+                if (len) goto inf_leave;
+            }
+            else if (state->head != Z_NULL)
+                state->head->name = Z_NULL;
+            state->length = 0;
+            state->mode = COMMENT;
+        case COMMENT:
+            if (state->flags & 0x1000) {
+                if (have == 0) goto inf_leave;
+                copy = 0;
+                do {
+                    len = (unsigned)(next[copy++]);
+                    if (state->head != Z_NULL &&
+                            state->head->comment != Z_NULL &&
+                            state->length < state->head->comm_max)
+                        state->head->comment[state->length++] = (Bytef)len;
+                } while (len && copy < have);
+                if ((state->flags & 0x0200) && (state->wrap & 4))
+                    state->check = crc32(state->check, next, copy);
+                have -= copy;
+                next += copy;
+                if (len) goto inf_leave;
+            }
+            else if (state->head != Z_NULL)
+                state->head->comment = Z_NULL;
+            state->mode = HCRC;
+        case HCRC:
+            if (state->flags & 0x0200) {
+                NEEDBITS(16);
+                if ((state->wrap & 4) && hold != (state->check & 0xffff)) {
+                    strm->msg = (char *)"header crc mismatch";
+                    state->mode = BAD;
+                    break;
+                }
+                INITBITS();
+            }
+            if (state->head != Z_NULL) {
+                state->head->hcrc = (int)((state->flags >> 9) & 1);
+                state->head->done = 1;
+            }
+            strm->adler = state->check = crc32(0L, Z_NULL, 0);
+            state->mode = TYPE;
+            break;
+#endif
+        case DICTID:
+            NEEDBITS(32);
+            strm->adler = state->check = ZSWAP32(hold);
+            INITBITS();
+            state->mode = DICT;
+        case DICT:
+            if (state->havedict == 0) {
+                RESTORE();
+                return Z_NEED_DICT;
+            }
+            strm->adler = state->check = adler32(0L, Z_NULL, 0);
+            state->mode = TYPE;
+        case TYPE:
+            if (flush == Z_BLOCK || flush == Z_TREES) goto inf_leave;
+        case TYPEDO:
+            if (state->last) {
+                BYTEBITS();
+                state->mode = CHECK;
+                break;
+            }
+            NEEDBITS(3);
+            state->last = BITS(1);
+            DROPBITS(1);
+            switch (BITS(2)) {
+            case 0:                             /* stored block */
+                Tracev((stderr, "inflate:     stored block%s\n",
+                        state->last ? " (last)" : ""));
+                state->mode = STORED;
+                break;
+            case 1:                             /* fixed block */
+                fixedtables(state);
+                Tracev((stderr, "inflate:     fixed codes block%s\n",
+                        state->last ? " (last)" : ""));
+                state->mode = LEN_;             /* decode codes */
+                if (flush == Z_TREES) {
+                    DROPBITS(2);
+                    goto inf_leave;
+                }
+                break;
+            case 2:                             /* dynamic block */
+                Tracev((stderr, "inflate:     dynamic codes block%s\n",
+                        state->last ? " (last)" : ""));
+                state->mode = TABLE;
+                break;
+            case 3:
+                strm->msg = (char *)"invalid block type";
+                state->mode = BAD;
+            }
+            DROPBITS(2);
+            break;
+        case STORED:
+            BYTEBITS();                         /* go to byte boundary */
+            NEEDBITS(32);
+            if ((hold & 0xffff) != ((hold >> 16) ^ 0xffff)) {
+                strm->msg = (char *)"invalid stored block lengths";
+                state->mode = BAD;
+                break;
+            }
+            state->length = (unsigned)hold & 0xffff;
+            Tracev((stderr, "inflate:       stored length %u\n",
+                    state->length));
+            INITBITS();
+            state->mode = COPY_;
+            if (flush == Z_TREES) goto inf_leave;
+        case COPY_:
+            state->mode = COPY;
+        case COPY:
+            copy = state->length;
+            if (copy) {
+                if (copy > have) copy = have;
+                if (copy > left) copy = left;
+                if (copy == 0) goto inf_leave;
+                zmemcpy(put, next, copy);
+                have -= copy;
+                next += copy;
+                left -= copy;
+                put += copy;
+                state->length -= copy;
+                break;
+            }
+            Tracev((stderr, "inflate:       stored end\n"));
+            state->mode = TYPE;
+            break;
+        case TABLE:
+            NEEDBITS(14);
+            state->nlen = BITS(5) + 257;
+            DROPBITS(5);
+            state->ndist = BITS(5) + 1;
+            DROPBITS(5);
+            state->ncode = BITS(4) + 4;
+            DROPBITS(4);
+#ifndef PKZIP_BUG_WORKAROUND
+            if (state->nlen > 286 || state->ndist > 30) {
+                strm->msg = (char *)"too many length or distance symbols";
+                state->mode = BAD;
+                break;
+            }
+#endif
+            Tracev((stderr, "inflate:       table sizes ok\n"));
+            state->have = 0;
+            state->mode = LENLENS;
+        case LENLENS:
+            while (state->have < state->ncode) {
+                NEEDBITS(3);
+                state->lens[order[state->have++]] = (unsigned short)BITS(3);
+                DROPBITS(3);
+            }
+            while (state->have < 19)
+                state->lens[order[state->have++]] = 0;
+            state->next = state->codes;
+            state->lencode = (const code FAR *)(state->next);
+            state->lenbits = 7;
+            ret = inflate_table(CODES, state->lens, 19, &(state->next),
+                                &(state->lenbits), state->work);
+            if (ret) {
+                strm->msg = (char *)"invalid code lengths set";
+                state->mode = BAD;
+                break;
+            }
+            Tracev((stderr, "inflate:       code lengths ok\n"));
+            state->have = 0;
+            state->mode = CODELENS;
+        case CODELENS:
+            while (state->have < state->nlen + state->ndist) {
+                for (;;) {
+                    here = state->lencode[BITS(state->lenbits)];
+                    if ((unsigned)(here.bits) <= bits) break;
+                    PULLBYTE();
+                }
+                if (here.val < 16) {
+                    DROPBITS(here.bits);
+                    state->lens[state->have++] = here.val;
+                }
+                else {
+                    if (here.val == 16) {
+                        NEEDBITS(here.bits + 2);
+                        DROPBITS(here.bits);
+                        if (state->have == 0) {
+                            strm->msg = (char *)"invalid bit length repeat";
+                            state->mode = BAD;
+                            break;
+                        }
+                        len = state->lens[state->have - 1];
+                        copy = 3 + BITS(2);
+                        DROPBITS(2);
+                    }
+                    else if (here.val == 17) {
+                        NEEDBITS(here.bits + 3);
+                        DROPBITS(here.bits);
+                        len = 0;
+                        copy = 3 + BITS(3);
+                        DROPBITS(3);
+                    }
+                    else {
+                        NEEDBITS(here.bits + 7);
+                        DROPBITS(here.bits);
+                        len = 0;
+                        copy = 11 + BITS(7);
+                        DROPBITS(7);
+                    }
+                    if (state->have + copy > state->nlen + state->ndist) {
+                        strm->msg = (char *)"invalid bit length repeat";
+                        state->mode = BAD;
+                        break;
+                    }
+                    while (copy--)
+                        state->lens[state->have++] = (unsigned short)len;
+                }
+            }
+
+            /* handle error breaks in while */
+            if (state->mode == BAD) break;
+
+            /* check for end-of-block code (better have one) */
+            if (state->lens[256] == 0) {
+                strm->msg = (char *)"invalid code -- missing end-of-block";
+                state->mode = BAD;
+                break;
+            }
+
+            /* build code tables -- note: do not change the lenbits or distbits
+               values here (9 and 6) without reading the comments in inftrees.h
+               concerning the ENOUGH constants, which depend on those values */
+            state->next = state->codes;
+            state->lencode = (const code FAR *)(state->next);
+            state->lenbits = 9;
+            ret = inflate_table(LENS, state->lens, state->nlen, &(state->next),
+                                &(state->lenbits), state->work);
+            if (ret) {
+                strm->msg = (char *)"invalid literal/lengths set";
+                state->mode = BAD;
+                break;
+            }
+            state->distcode = (const code FAR *)(state->next);
+            state->distbits = 6;
+            ret = inflate_table(DISTS, state->lens + state->nlen, state->ndist,
+                            &(state->next), &(state->distbits), state->work);
+            if (ret) {
+                strm->msg = (char *)"invalid distances set";
+                state->mode = BAD;
+                break;
+            }
+            Tracev((stderr, "inflate:       codes ok\n"));
+            state->mode = LEN_;
+            if (flush == Z_TREES) goto inf_leave;
+        case LEN_:
+            state->mode = LEN;
+        case LEN:
+            if (have >= INFLATE_FAST_MIN_INPUT &&
+                left >= INFLATE_FAST_MIN_OUTPUT) {
+                RESTORE();
+                inflate_fast_chunk_(strm, out);
+                LOAD();
+                if (state->mode == TYPE)
+                    state->back = -1;
+                break;
+            }
+            state->back = 0;
+            for (;;) {
+                here = state->lencode[BITS(state->lenbits)];
+                if ((unsigned)(here.bits) <= bits) break;
+                PULLBYTE();
+            }
+            if (here.op && (here.op & 0xf0) == 0) {
+                last = here;
+                for (;;) {
+                    here = state->lencode[last.val +
+                            (BITS(last.bits + last.op) >> last.bits)];
+                    if ((unsigned)(last.bits + here.bits) <= bits) break;
+                    PULLBYTE();
+                }
+                DROPBITS(last.bits);
+                state->back += last.bits;
+            }
+            DROPBITS(here.bits);
+            state->back += here.bits;
+            state->length = (unsigned)here.val;
+            if ((int)(here.op) == 0) {
+                Tracevv((stderr, here.val >= 0x20 && here.val < 0x7f ?
+                        "inflate:         literal '%c'\n" :
+                        "inflate:         literal 0x%02x\n", here.val));
+                state->mode = LIT;
+                break;
+            }
+            if (here.op & 32) {
+                Tracevv((stderr, "inflate:         end of block\n"));
+                state->back = -1;
+                state->mode = TYPE;
+                break;
+            }
+            if (here.op & 64) {
+                strm->msg = (char *)"invalid literal/length code";
+                state->mode = BAD;
+                break;
+            }
+            state->extra = (unsigned)(here.op) & 15;
+            state->mode = LENEXT;
+        case LENEXT:
+            if (state->extra) {
+                NEEDBITS(state->extra);
+                state->length += BITS(state->extra);
+                DROPBITS(state->extra);
+                state->back += state->extra;
+            }
+            Tracevv((stderr, "inflate:         length %u\n", state->length));
+            state->was = state->length;
+            state->mode = DIST;
+        case DIST:
+            for (;;) {
+                here = state->distcode[BITS(state->distbits)];
+                if ((unsigned)(here.bits) <= bits) break;
+                PULLBYTE();
+            }
+            if ((here.op & 0xf0) == 0) {
+                last = here;
+                for (;;) {
+                    here = state->distcode[last.val +
+                            (BITS(last.bits + last.op) >> last.bits)];
+                    if ((unsigned)(last.bits + here.bits) <= bits) break;
+                    PULLBYTE();
+                }
+                DROPBITS(last.bits);
+                state->back += last.bits;
+            }
+            DROPBITS(here.bits);
+            state->back += here.bits;
+            if (here.op & 64) {
+                strm->msg = (char *)"invalid distance code";
+                state->mode = BAD;
+                break;
+            }
+            state->offset = (unsigned)here.val;
+            state->extra = (unsigned)(here.op) & 15;
+            state->mode = DISTEXT;
+        case DISTEXT:
+            if (state->extra) {
+                NEEDBITS(state->extra);
+                state->offset += BITS(state->extra);
+                DROPBITS(state->extra);
+                state->back += state->extra;
+            }
+#ifdef INFLATE_STRICT
+            if (state->offset > state->dmax) {
+                strm->msg = (char *)"invalid distance too far back";
+                state->mode = BAD;
+                break;
+            }
+#endif
+            Tracevv((stderr, "inflate:         distance %u\n", state->offset));
+            state->mode = MATCH;
+        case MATCH:
+            if (left == 0) goto inf_leave;
+            copy = out - left;
+            if (state->offset > copy) {         /* copy from window */
+                copy = state->offset - copy;
+                if (copy > state->whave) {
+                    if (state->sane) {
+                        strm->msg = (char *)"invalid distance too far back";
+                        state->mode = BAD;
+                        break;
+                    }
+#ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR
+                    Trace((stderr, "inflate.c too far\n"));
+                    copy -= state->whave;
+                    if (copy > state->length) copy = state->length;
+                    if (copy > left) copy = left;
+                    left -= copy;
+                    state->length -= copy;
+                    do {
+                        *put++ = 0;
+                    } while (--copy);
+                    if (state->length == 0) state->mode = LEN;
+                    break;
+#endif
+                }
+                if (copy > state->wnext) {
+                    copy -= state->wnext;
+                    from = state->window + (state->wsize - copy);
+                }
+                else
+                    from = state->window + (state->wnext - copy);
+                if (copy > state->length) copy = state->length;
+                if (copy > left) copy = left;
+                put = chunkcopy_safe(put, from, copy, put + left);
+            }
+            else {                              /* copy from output */
+                copy = state->length;
+                if (copy > left) copy = left;
+                put = chunkcopy_lapped_safe(put, state->offset, copy, put + left);
+            }
+            left -= copy;
+            state->length -= copy;
+            if (state->length == 0) state->mode = LEN;
+            break;
+        case LIT:
+            if (left == 0) goto inf_leave;
+            *put++ = (unsigned char)(state->length);
+            left--;
+            state->mode = LEN;
+            break;
+        case CHECK:
+            if (state->wrap) {
+                NEEDBITS(32);
+                out -= left;
+                strm->total_out += out;
+                state->total += out;
+                if ((state->wrap & 4) && out)
+                    strm->adler = state->check =
+                        UPDATE(state->check, put - out, out);
+                out = left;
+                if ((state->wrap & 4) && (
+#ifdef GUNZIP
+                     state->flags ? hold :
+#endif
+                     ZSWAP32(hold)) != state->check) {
+                    strm->msg = (char *)"incorrect data check";
+                    state->mode = BAD;
+                    break;
+                }
+                INITBITS();
+                Tracev((stderr, "inflate:   check matches trailer\n"));
+            }
+#ifdef GUNZIP
+            state->mode = LENGTH;
+        case LENGTH:
+            if (state->wrap && state->flags) {
+                NEEDBITS(32);
+                if (hold != (state->total & 0xffffffffUL)) {
+                    strm->msg = (char *)"incorrect length check";
+                    state->mode = BAD;
+                    break;
+                }
+                INITBITS();
+                Tracev((stderr, "inflate:   length matches trailer\n"));
+            }
+#endif
+            state->mode = DONE;
+        case DONE:
+            ret = Z_STREAM_END;
+            goto inf_leave;
+        case BAD:
+            ret = Z_DATA_ERROR;
+            goto inf_leave;
+        case MEM:
+            return Z_MEM_ERROR;
+        case SYNC:
+        default:
+            return Z_STREAM_ERROR;
+        }
+
+    /*
+       Return from inflate(), updating the total counts and the check value.
+       If there was no progress during the inflate() call, return a buffer
+       error.  Call updatewindow() to create and/or update the window state.
+       Note: a memory error from inflate() is non-recoverable.
+     */
+  inf_leave:
+   /* We write a defined value in the unused space to help mark
+    * where the stream has ended. We don't use zeros as that can
+    * mislead clients relying on undefined behavior (i.e. assuming
+    * that the data is over when the buffer has a zero/null value).
+    */
+   if (left >= CHUNKCOPY_CHUNK_SIZE)
+      memset(put, 0x55, CHUNKCOPY_CHUNK_SIZE);
+   else
+      memset(put, 0x55, left);
+
+    RESTORE();
+    if (state->wsize || (out != strm->avail_out && state->mode < BAD &&
+            (state->mode < CHECK || flush != Z_FINISH)))
+        if (updatewindow(strm, strm->next_out, out - strm->avail_out)) {
+            state->mode = MEM;
+            return Z_MEM_ERROR;
+        }
+    in -= strm->avail_in;
+    out -= strm->avail_out;
+    strm->total_in += in;
+    strm->total_out += out;
+    state->total += out;
+    if ((state->wrap & 4) && out)
+        strm->adler = state->check =
+            UPDATE(state->check, strm->next_out - out, out);
+    strm->data_type = (int)state->bits + (state->last ? 64 : 0) +
+                      (state->mode == TYPE ? 128 : 0) +
+                      (state->mode == LEN_ || state->mode == COPY_ ? 256 : 0);
+    if (((in == 0 && out == 0) || flush == Z_FINISH) && ret == Z_OK)
+        ret = Z_BUF_ERROR;
+    return ret;
+}
+
+int ZEXPORT inflateEnd(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+    if (inflateStateCheck(strm))
+        return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    if (state->window != Z_NULL) ZFREE(strm, state->window);
+    ZFREE(strm, strm->state);
+    strm->state = Z_NULL;
+    Tracev((stderr, "inflate: end\n"));
+    return Z_OK;
+}
+
+int ZEXPORT inflateGetDictionary(strm, dictionary, dictLength)
+z_streamp strm;
+Bytef *dictionary;
+uInt *dictLength;
+{
+    struct inflate_state FAR *state;
+
+    /* check state */
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+
+    /* copy dictionary */
+    if (state->whave && dictionary != Z_NULL) {
+        zmemcpy(dictionary, state->window + state->wnext,
+                state->whave - state->wnext);
+        zmemcpy(dictionary + state->whave - state->wnext,
+                state->window, state->wnext);
+    }
+    if (dictLength != Z_NULL)
+        *dictLength = state->whave;
+    return Z_OK;
+}
+
+int ZEXPORT inflateSetDictionary(strm, dictionary, dictLength)
+z_streamp strm;
+const Bytef *dictionary;
+uInt dictLength;
+{
+    struct inflate_state FAR *state;
+    unsigned long dictid;
+    int ret;
+
+    /* check state */
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    if (state->wrap != 0 && state->mode != DICT)
+        return Z_STREAM_ERROR;
+
+    /* check for correct dictionary identifier */
+    if (state->mode == DICT) {
+        dictid = adler32(0L, Z_NULL, 0);
+        dictid = adler32(dictid, dictionary, dictLength);
+        if (dictid != state->check)
+            return Z_DATA_ERROR;
+    }
+
+    /* copy dictionary to window using updatewindow(), which will amend the
+       existing dictionary if appropriate */
+    ret = updatewindow(strm, dictionary + dictLength, dictLength);
+    if (ret) {
+        state->mode = MEM;
+        return Z_MEM_ERROR;
+    }
+    state->havedict = 1;
+    Tracev((stderr, "inflate:   dictionary set\n"));
+    return Z_OK;
+}
+
+int ZEXPORT inflateGetHeader(strm, head)
+z_streamp strm;
+gz_headerp head;
+{
+    struct inflate_state FAR *state;
+
+    /* check state */
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    if ((state->wrap & 2) == 0) return Z_STREAM_ERROR;
+
+    /* save header structure */
+    state->head = head;
+    head->done = 0;
+    return Z_OK;
+}
+
+/*
+   Search buf[0..len-1] for the pattern: 0, 0, 0xff, 0xff.  Return when found
+   or when out of input.  When called, *have is the number of pattern bytes
+   found in order so far, in 0..3.  On return *have is updated to the new
+   state.  If on return *have equals four, then the pattern was found and the
+   return value is how many bytes were read including the last byte of the
+   pattern.  If *have is less than four, then the pattern has not been found
+   yet and the return value is len.  In the latter case, syncsearch() can be
+   called again with more data and the *have state.  *have is initialized to
+   zero for the first call.
+ */
+local unsigned syncsearch(have, buf, len)
+unsigned FAR *have;
+const unsigned char FAR *buf;
+unsigned len;
+{
+    unsigned got;
+    unsigned next;
+
+    got = *have;
+    next = 0;
+    while (next < len && got < 4) {
+        if ((int)(buf[next]) == (got < 2 ? 0 : 0xff))
+            got++;
+        else if (buf[next])
+            got = 0;
+        else
+            got = 4 - got;
+        next++;
+    }
+    *have = got;
+    return next;
+}
+
+int ZEXPORT inflateSync(strm)
+z_streamp strm;
+{
+    unsigned len;               /* number of bytes to look at or looked at */
+    unsigned long in, out;      /* temporary to save total_in and total_out */
+    unsigned char buf[4];       /* to restore bit buffer to byte string */
+    struct inflate_state FAR *state;
+
+    /* check parameters */
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    if (strm->avail_in == 0 && state->bits < 8) return Z_BUF_ERROR;
+
+    /* if first time, start search in bit buffer */
+    if (state->mode != SYNC) {
+        state->mode = SYNC;
+        state->hold <<= state->bits & 7;
+        state->bits -= state->bits & 7;
+        len = 0;
+        while (state->bits >= 8) {
+            buf[len++] = (unsigned char)(state->hold);
+            state->hold >>= 8;
+            state->bits -= 8;
+        }
+        state->have = 0;
+        syncsearch(&(state->have), buf, len);
+    }
+
+    /* search available input */
+    len = syncsearch(&(state->have), strm->next_in, strm->avail_in);
+    strm->avail_in -= len;
+    strm->next_in += len;
+    strm->total_in += len;
+
+    /* return no joy or set up to restart inflate() on a new block */
+    if (state->have != 4) return Z_DATA_ERROR;
+    in = strm->total_in;  out = strm->total_out;
+    inflateReset(strm);
+    strm->total_in = in;  strm->total_out = out;
+    state->mode = TYPE;
+    return Z_OK;
+}
+
+/*
+   Returns true if inflate is currently at the end of a block generated by
+   Z_SYNC_FLUSH or Z_FULL_FLUSH. This function is used by one PPP
+   implementation to provide an additional safety check. PPP uses
+   Z_SYNC_FLUSH but removes the length bytes of the resulting empty stored
+   block. When decompressing, PPP checks that at the end of input packet,
+   inflate is waiting for these length bytes.
+ */
+int ZEXPORT inflateSyncPoint(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    return state->mode == STORED && state->bits == 0;
+}
+
+int ZEXPORT inflateCopy(dest, source)
+z_streamp dest;
+z_streamp source;
+{
+    struct inflate_state FAR *state;
+    struct inflate_state FAR *copy;
+    unsigned char FAR *window;
+    unsigned wsize;
+
+    /* check input */
+    if (inflateStateCheck(source) || dest == Z_NULL)
+        return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)source->state;
+
+    /* allocate space */
+    copy = (struct inflate_state FAR *)
+           ZALLOC(source, 1, sizeof(struct inflate_state));
+    if (copy == Z_NULL) return Z_MEM_ERROR;
+    window = Z_NULL;
+    if (state->window != Z_NULL) {
+        window = (unsigned char FAR *)
+                 ZALLOC(source, 1U << state->wbits, sizeof(unsigned char));
+        if (window == Z_NULL) {
+            ZFREE(source, copy);
+            return Z_MEM_ERROR;
+        }
+    }
+
+    /* copy state */
+    zmemcpy((voidpf)dest, (voidpf)source, sizeof(z_stream));
+    zmemcpy((voidpf)copy, (voidpf)state, sizeof(struct inflate_state));
+    copy->strm = dest;
+    if (state->lencode >= state->codes &&
+        state->lencode <= state->codes + ENOUGH - 1) {
+        copy->lencode = copy->codes + (state->lencode - state->codes);
+        copy->distcode = copy->codes + (state->distcode - state->codes);
+    }
+    copy->next = copy->codes + (state->next - state->codes);
+    if (window != Z_NULL) {
+        wsize = 1U << state->wbits;
+        zmemcpy(window, state->window, wsize);
+    }
+    copy->window = window;
+    dest->state = (struct internal_state FAR *)copy;
+    return Z_OK;
+}
+
+int ZEXPORT inflateUndermine(strm, subvert)
+z_streamp strm;
+int subvert;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+#ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR
+    state->sane = !subvert;
+    return Z_OK;
+#else
+    (void)subvert;
+    state->sane = 1;
+    return Z_DATA_ERROR;
+#endif
+}
+
+int ZEXPORT inflateValidate(strm, check)
+z_streamp strm;
+int check;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    if (check)
+        state->wrap |= 4;
+    else
+        state->wrap &= ~4;
+    return Z_OK;
+}
+
+long ZEXPORT inflateMark(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm))
+        return -(1L << 16);
+    state = (struct inflate_state FAR *)strm->state;
+    return (long)(((unsigned long)((long)state->back)) << 16) +
+        (state->mode == COPY ? state->length :
+            (state->mode == MATCH ? state->was - state->length : 0));
+}
+
+unsigned long ZEXPORT inflateCodesUsed(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+    if (inflateStateCheck(strm)) return (unsigned long)-1;
+    state = (struct inflate_state FAR *)strm->state;
+    return (unsigned long)(state->next - state->codes);
+}
diff --git a/deps/v8/third_party/zlib/contrib/optimizations/insert_string.h b/deps/v8/third_party/zlib/contrib/optimizations/insert_string.h
new file mode 100644
index 00000000000000..1826601b7fbf81
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/optimizations/insert_string.h
@@ -0,0 +1,122 @@
+/* insert_string.h
+ *
+ * Copyright 2019 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the Chromium source repository LICENSE file.
+ */
+#ifdef _MSC_VER
+#define INLINE __inline
+#else
+#define INLINE inline
+#endif
+
+#include "cpu_features.h"
+/* Optimized insert_string block */
+#if defined(CRC32_SIMD_SSE42_PCLMUL) || defined(CRC32_ARMV8_CRC32)
+#define TARGET_CPU_WITH_CRC
+// clang-format off
+#if defined(CRC32_SIMD_SSE42_PCLMUL)
+  /* Required to make MSVC bot build pass. */
+  #include <smmintrin.h>
+  #if defined(__GNUC__) || defined(__clang__)
+    #undef TARGET_CPU_WITH_CRC
+    #define TARGET_CPU_WITH_CRC __attribute__((target("sse4.2")))
+  #endif
+
+  #define _cpu_crc32_u32 _mm_crc32_u32
+
+#elif defined(CRC32_ARMV8_CRC32)
+  #if defined(__clang__)
+    #undef TARGET_CPU_WITH_CRC
+    #define __crc32cw __builtin_arm_crc32cw
+  #endif
+
+  #define _cpu_crc32_u32 __crc32cw
+
+  #if defined(__aarch64__)
+    #define TARGET_CPU_WITH_CRC __attribute__((target("crc")))
+  #else  // !defined(__aarch64__)
+    #define TARGET_CPU_WITH_CRC __attribute__((target("armv8-a,crc")))
+  #endif  // defined(__aarch64__)
+#endif
+// clang-format on
+TARGET_CPU_WITH_CRC
+local INLINE Pos insert_string_optimized(deflate_state* const s,
+                                         const Pos str) {
+  Pos ret;
+  unsigned *ip, val, h = 0;
+
+  ip = (unsigned*)&s->window[str];
+  val = *ip;
+
+  if (s->level >= 6)
+    val &= 0xFFFFFF;
+
+  /* Unlike the case of data integrity checks for GZIP format where the
+   * polynomial used is defined (https://tools.ietf.org/html/rfc1952#page-11),
+   * here it is just a hash function for the hash table used while
+   * performing compression.
+   */
+  h = _cpu_crc32_u32(h, val);
+
+  ret = s->head[h & s->hash_mask];
+  s->head[h & s->hash_mask] = str;
+  s->prev[str & s->w_mask] = ret;
+  return ret;
+}
+#endif /* Optimized insert_string block */
+
+/* ===========================================================================
+ * Update a hash value with the given input byte
+ * IN  assertion: all calls to UPDATE_HASH are made with consecutive input
+ *    characters, so that a running hash key can be computed from the previous
+ *    key instead of complete recalculation each time.
+ */
+#define UPDATE_HASH(s, h, c) (h = (((h) << s->hash_shift) ^ (c)) & s->hash_mask)
+
+/* ===========================================================================
+ * Insert string str in the dictionary and set match_head to the previous head
+ * of the hash chain (the most recent string with same hash key). Return
+ * the previous length of the hash chain.
+ * If this file is compiled with -DFASTEST, the compression level is forced
+ * to 1, and no hash chains are maintained.
+ * IN  assertion: all calls to INSERT_STRING are made with consecutive input
+ *    characters and the first MIN_MATCH bytes of str are valid (except for
+ *    the last MIN_MATCH-1 bytes of the input file).
+ */
+local INLINE Pos insert_string_c(deflate_state* const s, const Pos str) {
+  Pos ret;
+
+  UPDATE_HASH(s, s->ins_h, s->window[(str) + (MIN_MATCH - 1)]);
+#ifdef FASTEST
+  ret = s->head[s->ins_h];
+#else
+  ret = s->prev[str & s->w_mask] = s->head[s->ins_h];
+#endif
+  s->head[s->ins_h] = str;
+
+  return ret;
+}
+
+local INLINE Pos insert_string(deflate_state* const s, const Pos str) {
+/* String dictionary insertion: faster symbol hashing has a positive impact
+ * on data compression speeds (around 20% on Intel and 36% on Arm Cortex big
+ * cores).
+ * A misfeature is that the generated compressed output will differ from
+ * vanilla zlib (even though it is still valid 'DEFLATE-d' content).
+ *
+ * We offer here a way to disable the optimization if there is the expectation
+ * that compressed content should match when compared to vanilla zlib.
+ */
+#if !defined(CHROMIUM_ZLIB_NO_CASTAGNOLI)
+  /* TODO(cavalcantii): unify CPU features code. */
+#if defined(CRC32_ARMV8_CRC32)
+  if (arm_cpu_enable_crc32)
+    return insert_string_optimized(s, str);
+#elif defined(CRC32_SIMD_SSE42_PCLMUL)
+  if (x86_cpu_enable_simd)
+    return insert_string_optimized(s, str);
+#endif
+#endif
+  return insert_string_c(s, str);
+}
diff --git a/deps/v8/third_party/zlib/contrib/optimizations/slide_hash_neon.h b/deps/v8/third_party/zlib/contrib/optimizations/slide_hash_neon.h
new file mode 100644
index 00000000000000..26995d70f709e7
--- /dev/null
+++ b/deps/v8/third_party/zlib/contrib/optimizations/slide_hash_neon.h
@@ -0,0 +1,65 @@
+/* Copyright 2018 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the Chromium source repository LICENSE file.
+ */
+#ifndef __SLIDE_HASH__NEON__
+#define __SLIDE_HASH__NEON__
+
+#include "deflate.h"
+#include <arm_neon.h>
+
+inline static void ZLIB_INTERNAL neon_slide_hash_update(Posf *hash,
+                                                        const uInt hash_size,
+                                                        const ush w_size)
+{
+   /* NEON 'Q' registers allow to store 128 bits, so we can load 8x16-bits
+     * values. For further details, check:
+     * ARM DHT 0002A, section 1.3.2 NEON Registers.
+     */
+    const size_t chunk = sizeof(uint16x8_t) / sizeof(uint16_t);
+    /* Unrolling the operation yielded a compression performance boost in both
+     * ARMv7 (from 11.7% to 13.4%) and ARMv8 (from 3.7% to 7.5%) for HTML4
+     * content. For full benchmarking data, check: http://crbug.com/863257.
+     */
+    const size_t stride = 2*chunk;
+    const uint16x8_t v = vdupq_n_u16(w_size);
+
+    for (Posf *end = hash + hash_size; hash != end; hash += stride) {
+        uint16x8_t m_low = vld1q_u16(hash);
+        uint16x8_t m_high = vld1q_u16(hash + chunk);
+
+        /* The first 'q' in vqsubq_u16 makes these subtracts saturate to zero,
+         * replacing the ternary operator expression in the original code:
+         * (m >= wsize ? m - wsize : NIL).
+         */
+        m_low = vqsubq_u16(m_low, v);
+        m_high = vqsubq_u16(m_high, v);
+
+        vst1q_u16(hash, m_low);
+        vst1q_u16(hash + chunk, m_high);
+    }
+}
+
+
+inline static void ZLIB_INTERNAL neon_slide_hash(Posf *head, Posf *prev,
+                                                 const unsigned short w_size,
+                                                 const uInt hash_size)
+{
+    /*
+     * SIMD implementation for hash table rebase assumes:
+     * 1. hash chain offset (Pos) is 2 bytes.
+     * 2. hash table size is multiple of 32 bytes.
+     * #1 should be true as Pos is defined as "ush"
+     * #2 should be true as hash_bits are greater than 7
+     */
+    const size_t size = hash_size * sizeof(head[0]);
+    Assert(sizeof(Pos) == 2, "Wrong Pos size.");
+    Assert((size % sizeof(uint16x8_t) * 2) == 0, "Hash table size error.");
+
+    neon_slide_hash_update(head, hash_size, w_size);
+#ifndef FASTEST
+    neon_slide_hash_update(prev, w_size, w_size);
+#endif
+}
+
+#endif
diff --git a/deps/v8/third_party/zlib/cpu_features.c b/deps/v8/third_party/zlib/cpu_features.c
new file mode 100644
index 00000000000000..8a25dd29c824ac
--- /dev/null
+++ b/deps/v8/third_party/zlib/cpu_features.c
@@ -0,0 +1,145 @@
+/* cpu_features.c -- Processor features detection.
+ *
+ * Copyright 2018 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the Chromium source repository LICENSE file.
+ */
+
+#include "cpu_features.h"
+#include "zutil.h"
+
+#include <stdint.h>
+#if defined(_MSC_VER)
+#include <intrin.h>
+#elif defined(ADLER32_SIMD_SSSE3)
+#include <cpuid.h>
+#endif
+
+/* TODO(cavalcantii): remove checks for x86_flags on deflate.
+ */
+int ZLIB_INTERNAL arm_cpu_enable_crc32 = 0;
+int ZLIB_INTERNAL arm_cpu_enable_pmull = 0;
+int ZLIB_INTERNAL x86_cpu_enable_ssse3 = 0;
+int ZLIB_INTERNAL x86_cpu_enable_simd = 0;
+
+#if defined(ARMV8_OS_ANDROID) || defined(ARMV8_OS_LINUX) || defined(ARMV8_OS_FUCHSIA)
+#include <pthread.h>
+#endif
+
+#if defined(ARMV8_OS_ANDROID)
+#include <cpu-features.h>
+#elif defined(ARMV8_OS_LINUX)
+#include <asm/hwcap.h>
+#include <sys/auxv.h>
+#elif defined(ARMV8_OS_FUCHSIA)
+#include <zircon/features.h>
+#include <zircon/syscalls.h>
+#include <zircon/types.h>
+#elif defined(ARMV8_OS_WINDOWS) || defined(X86_WINDOWS)
+#include <windows.h>
+#elif !defined(_MSC_VER)
+#include <pthread.h>
+#else
+#error cpu_features.c CPU feature detection in not defined for your platform
+#endif
+
+#if !defined(CPU_NO_SIMD) && !defined(ARM_OS_IOS)
+static void _cpu_check_features(void);
+#endif
+
+#if defined(ARMV8_OS_ANDROID) || defined(ARMV8_OS_LINUX) || defined(ARMV8_OS_FUCHSIA) || defined(X86_NOT_WINDOWS)
+static pthread_once_t cpu_check_inited_once = PTHREAD_ONCE_INIT;
+void ZLIB_INTERNAL cpu_check_features(void)
+{
+    pthread_once(&cpu_check_inited_once, _cpu_check_features);
+}
+#elif defined(ARMV8_OS_WINDOWS) || defined(X86_WINDOWS)
+static INIT_ONCE cpu_check_inited_once = INIT_ONCE_STATIC_INIT;
+static BOOL CALLBACK _cpu_check_features_forwarder(PINIT_ONCE once, PVOID param, PVOID* context)
+{
+    _cpu_check_features();
+    return TRUE;
+}
+void ZLIB_INTERNAL cpu_check_features(void)
+{
+    InitOnceExecuteOnce(&cpu_check_inited_once, _cpu_check_features_forwarder,
+                        NULL, NULL);
+}
+#endif
+
+#if (defined(__ARM_NEON__) || defined(__ARM_NEON))
+/*
+ * iOS@ARM is a special case where we always have NEON but don't check
+ * for crypto extensions.
+ */
+#ifndef ARM_OS_IOS
+/*
+ * See http://bit.ly/2CcoEsr for run-time detection of ARM features and also
+ * crbug.com/931275 for android_getCpuFeatures() use in the Android sandbox.
+ */
+static void _cpu_check_features(void)
+{
+#if defined(ARMV8_OS_ANDROID) && defined(__aarch64__)
+    uint64_t features = android_getCpuFeatures();
+    arm_cpu_enable_crc32 = !!(features & ANDROID_CPU_ARM64_FEATURE_CRC32);
+    arm_cpu_enable_pmull = !!(features & ANDROID_CPU_ARM64_FEATURE_PMULL);
+#elif defined(ARMV8_OS_ANDROID) /* aarch32 */
+    uint64_t features = android_getCpuFeatures();
+    arm_cpu_enable_crc32 = !!(features & ANDROID_CPU_ARM_FEATURE_CRC32);
+    arm_cpu_enable_pmull = !!(features & ANDROID_CPU_ARM_FEATURE_PMULL);
+#elif defined(ARMV8_OS_LINUX) && defined(__aarch64__)
+    unsigned long features = getauxval(AT_HWCAP);
+    arm_cpu_enable_crc32 = !!(features & HWCAP_CRC32);
+    arm_cpu_enable_pmull = !!(features & HWCAP_PMULL);
+#elif defined(ARMV8_OS_LINUX) && (defined(__ARM_NEON) || defined(__ARM_NEON__))
+    /* Query HWCAP2 for ARMV8-A SoCs running in aarch32 mode */
+    unsigned long features = getauxval(AT_HWCAP2);
+    arm_cpu_enable_crc32 = !!(features & HWCAP2_CRC32);
+    arm_cpu_enable_pmull = !!(features & HWCAP2_PMULL);
+#elif defined(ARMV8_OS_FUCHSIA)
+    uint32_t features;
+    zx_status_t rc = zx_system_get_features(ZX_FEATURE_KIND_CPU, &features);
+    if (rc != ZX_OK || (features & ZX_ARM64_FEATURE_ISA_ASIMD) == 0)
+        return;  /* Report nothing if ASIMD(NEON) is missing */
+    arm_cpu_enable_crc32 = !!(features & ZX_ARM64_FEATURE_ISA_CRC32);
+    arm_cpu_enable_pmull = !!(features & ZX_ARM64_FEATURE_ISA_PMULL);
+#elif defined(ARMV8_OS_WINDOWS)
+    arm_cpu_enable_crc32 = IsProcessorFeaturePresent(PF_ARM_V8_CRC32_INSTRUCTIONS_AVAILABLE);
+    arm_cpu_enable_pmull = IsProcessorFeaturePresent(PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE);
+#endif
+}
+#endif
+#elif defined(X86_NOT_WINDOWS) || defined(X86_WINDOWS)
+/*
+ * iOS@x86 (i.e. emulator) is another special case where we disable
+ * SIMD optimizations.
+ */
+#ifndef CPU_NO_SIMD
+/* On x86 we simply use a instruction to check the CPU features.
+ * (i.e. CPUID).
+ */
+static void _cpu_check_features(void)
+{
+    int x86_cpu_has_sse2;
+    int x86_cpu_has_ssse3;
+    int x86_cpu_has_sse42;
+    int x86_cpu_has_pclmulqdq;
+    int abcd[4];
+#ifdef _MSC_VER
+    __cpuid(abcd, 1);
+#else
+    __cpuid(1, abcd[0], abcd[1], abcd[2], abcd[3]);
+#endif
+    x86_cpu_has_sse2 = abcd[3] & 0x4000000;
+    x86_cpu_has_ssse3 = abcd[2] & 0x000200;
+    x86_cpu_has_sse42 = abcd[2] & 0x100000;
+    x86_cpu_has_pclmulqdq = abcd[2] & 0x2;
+
+    x86_cpu_enable_ssse3 = x86_cpu_has_ssse3;
+
+    x86_cpu_enable_simd = x86_cpu_has_sse2 &&
+                          x86_cpu_has_sse42 &&
+                          x86_cpu_has_pclmulqdq;
+}
+#endif
+#endif
diff --git a/deps/v8/third_party/zlib/cpu_features.h b/deps/v8/third_party/zlib/cpu_features.h
new file mode 100644
index 00000000000000..2a4a797342e512
--- /dev/null
+++ b/deps/v8/third_party/zlib/cpu_features.h
@@ -0,0 +1,17 @@
+/* cpu_features.h -- Processor features detection.
+ *
+ * Copyright 2018 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the Chromium source repository LICENSE file.
+ */
+
+#include "zlib.h"
+
+/* TODO(cavalcantii): remove checks for x86_flags on deflate.
+ */
+extern int arm_cpu_enable_crc32;
+extern int arm_cpu_enable_pmull;
+extern int x86_cpu_enable_ssse3;
+extern int x86_cpu_enable_simd;
+
+void cpu_check_features(void);
diff --git a/deps/v8/third_party/zlib/crc32.c b/deps/v8/third_party/zlib/crc32.c
new file mode 100644
index 00000000000000..bd6964701bd6cd
--- /dev/null
+++ b/deps/v8/third_party/zlib/crc32.c
@@ -0,0 +1,527 @@
+/* crc32.c -- compute the CRC-32 of a data stream
+ * Copyright (C) 1995-2006, 2010, 2011, 2012, 2016 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ *
+ * Thanks to Rodney Brown <rbrown64@csc.com.au> for his contribution of faster
+ * CRC methods: exclusive-oring 32 bits of data at a time, and pre-computing
+ * tables for updating the shift register in one step with three exclusive-ors
+ * instead of four steps with four exclusive-ors.  This results in about a
+ * factor of two increase in speed on a Power PC G4 (PPC7455) using gcc -O3.
+ */
+
+/* @(#) $Id$ */
+
+/*
+  Note on the use of DYNAMIC_CRC_TABLE: there is no mutex or semaphore
+  protection on the static variables used to control the first-use generation
+  of the crc tables.  Therefore, if you #define DYNAMIC_CRC_TABLE, you should
+  first call get_crc_table() to initialize the tables before allowing more than
+  one thread to use crc32().
+
+  DYNAMIC_CRC_TABLE and MAKECRCH can be #defined to write out crc32.h.
+ */
+
+#ifdef MAKECRCH
+#  include <stdio.h>
+#  ifndef DYNAMIC_CRC_TABLE
+#    define DYNAMIC_CRC_TABLE
+#  endif /* !DYNAMIC_CRC_TABLE */
+#endif /* MAKECRCH */
+
+#include "deflate.h"
+#include "cpu_features.h"
+#include "zutil.h"      /* for STDC and FAR definitions */
+
+#if defined(CRC32_SIMD_SSE42_PCLMUL) || defined(CRC32_ARMV8_CRC32)
+#include "crc32_simd.h"
+#endif
+
+/* Definitions for doing the crc four data bytes at a time. */
+#if !defined(NOBYFOUR) && defined(Z_U4)
+#  define BYFOUR
+#endif
+#ifdef BYFOUR
+   local unsigned long crc32_little OF((unsigned long,
+                        const unsigned char FAR *, z_size_t));
+   local unsigned long crc32_big OF((unsigned long,
+                        const unsigned char FAR *, z_size_t));
+#  define TBLS 8
+#else
+#  define TBLS 1
+#endif /* BYFOUR */
+
+/* Local functions for crc concatenation */
+local unsigned long gf2_matrix_times OF((unsigned long *mat,
+                                         unsigned long vec));
+local void gf2_matrix_square OF((unsigned long *square, unsigned long *mat));
+local uLong crc32_combine_ OF((uLong crc1, uLong crc2, z_off64_t len2));
+
+
+#ifdef DYNAMIC_CRC_TABLE
+
+local volatile int crc_table_empty = 1;
+local z_crc_t FAR crc_table[TBLS][256];
+local void make_crc_table OF((void));
+#ifdef MAKECRCH
+   local void write_table OF((FILE *, const z_crc_t FAR *));
+#endif /* MAKECRCH */
+/*
+  Generate tables for a byte-wise 32-bit CRC calculation on the polynomial:
+  x^32+x^26+x^23+x^22+x^16+x^12+x^11+x^10+x^8+x^7+x^5+x^4+x^2+x+1.
+
+  Polynomials over GF(2) are represented in binary, one bit per coefficient,
+  with the lowest powers in the most significant bit.  Then adding polynomials
+  is just exclusive-or, and multiplying a polynomial by x is a right shift by
+  one.  If we call the above polynomial p, and represent a byte as the
+  polynomial q, also with the lowest power in the most significant bit (so the
+  byte 0xb1 is the polynomial x^7+x^3+x+1), then the CRC is (q*x^32) mod p,
+  where a mod b means the remainder after dividing a by b.
+
+  This calculation is done using the shift-register method of multiplying and
+  taking the remainder.  The register is initialized to zero, and for each
+  incoming bit, x^32 is added mod p to the register if the bit is a one (where
+  x^32 mod p is p+x^32 = x^26+...+1), and the register is multiplied mod p by
+  x (which is shifting right by one and adding x^32 mod p if the bit shifted
+  out is a one).  We start with the highest power (least significant bit) of
+  q and repeat for all eight bits of q.
+
+  The first table is simply the CRC of all possible eight bit values.  This is
+  all the information needed to generate CRCs on data a byte at a time for all
+  combinations of CRC register values and incoming bytes.  The remaining tables
+  allow for word-at-a-time CRC calculation for both big-endian and little-
+  endian machines, where a word is four bytes.
+*/
+local void make_crc_table()
+{
+    z_crc_t c;
+    int n, k;
+    z_crc_t poly;                       /* polynomial exclusive-or pattern */
+    /* terms of polynomial defining this crc (except x^32): */
+    static volatile int first = 1;      /* flag to limit concurrent making */
+    static const unsigned char p[] = {0,1,2,4,5,7,8,10,11,12,16,22,23,26};
+
+    /* See if another task is already doing this (not thread-safe, but better
+       than nothing -- significantly reduces duration of vulnerability in
+       case the advice about DYNAMIC_CRC_TABLE is ignored) */
+    if (first) {
+        first = 0;
+
+        /* make exclusive-or pattern from polynomial (0xedb88320UL) */
+        poly = 0;
+        for (n = 0; n < (int)(sizeof(p)/sizeof(unsigned char)); n++)
+            poly |= (z_crc_t)1 << (31 - p[n]);
+
+        /* generate a crc for every 8-bit value */
+        for (n = 0; n < 256; n++) {
+            c = (z_crc_t)n;
+            for (k = 0; k < 8; k++)
+                c = c & 1 ? poly ^ (c >> 1) : c >> 1;
+            crc_table[0][n] = c;
+        }
+
+#ifdef BYFOUR
+        /* generate crc for each value followed by one, two, and three zeros,
+           and then the byte reversal of those as well as the first table */
+        for (n = 0; n < 256; n++) {
+            c = crc_table[0][n];
+            crc_table[4][n] = ZSWAP32(c);
+            for (k = 1; k < 4; k++) {
+                c = crc_table[0][c & 0xff] ^ (c >> 8);
+                crc_table[k][n] = c;
+                crc_table[k + 4][n] = ZSWAP32(c);
+            }
+        }
+#endif /* BYFOUR */
+
+        crc_table_empty = 0;
+    }
+    else {      /* not first */
+        /* wait for the other guy to finish (not efficient, but rare) */
+        while (crc_table_empty)
+            ;
+    }
+
+#ifdef MAKECRCH
+    /* write out CRC tables to crc32.h */
+    {
+        FILE *out;
+
+        out = fopen("crc32.h", "w");
+        if (out == NULL) return;
+        fprintf(out, "/* crc32.h -- tables for rapid CRC calculation\n");
+        fprintf(out, " * Generated automatically by crc32.c\n */\n\n");
+        fprintf(out, "local const z_crc_t FAR ");
+        fprintf(out, "crc_table[TBLS][256] =\n{\n  {\n");
+        write_table(out, crc_table[0]);
+#  ifdef BYFOUR
+        fprintf(out, "#ifdef BYFOUR\n");
+        for (k = 1; k < 8; k++) {
+            fprintf(out, "  },\n  {\n");
+            write_table(out, crc_table[k]);
+        }
+        fprintf(out, "#endif\n");
+#  endif /* BYFOUR */
+        fprintf(out, "  }\n};\n");
+        fclose(out);
+    }
+#endif /* MAKECRCH */
+}
+
+#ifdef MAKECRCH
+local void write_table(out, table)
+    FILE *out;
+    const z_crc_t FAR *table;
+{
+    int n;
+
+    for (n = 0; n < 256; n++)
+        fprintf(out, "%s0x%08lxUL%s", n % 5 ? "" : "    ",
+                (unsigned long)(table[n]),
+                n == 255 ? "\n" : (n % 5 == 4 ? ",\n" : ", "));
+}
+#endif /* MAKECRCH */
+
+#else /* !DYNAMIC_CRC_TABLE */
+/* ========================================================================
+ * Tables of CRC-32s of all single-byte values, made by make_crc_table().
+ */
+#include "crc32.h"
+#endif /* DYNAMIC_CRC_TABLE */
+
+/* =========================================================================
+ * This function can be used by asm versions of crc32()
+ */
+const z_crc_t FAR * ZEXPORT get_crc_table()
+{
+#ifdef DYNAMIC_CRC_TABLE
+    if (crc_table_empty)
+        make_crc_table();
+#endif /* DYNAMIC_CRC_TABLE */
+    return (const z_crc_t FAR *)crc_table;
+}
+
+/* ========================================================================= */
+#define DO1 crc = crc_table[0][((int)crc ^ (*buf++)) & 0xff] ^ (crc >> 8)
+#define DO8 DO1; DO1; DO1; DO1; DO1; DO1; DO1; DO1
+
+/* ========================================================================= */
+unsigned long ZEXPORT crc32_z(crc, buf, len)
+    unsigned long crc;
+    const unsigned char FAR *buf;
+    z_size_t len;
+{
+    /*
+     * zlib convention is to call crc32(0, NULL, 0); before making
+     * calls to crc32(). So this is a good, early (and infrequent)
+     * place to cache CPU features if needed for those later, more
+     * interesting crc32() calls.
+     */
+#if defined(CRC32_SIMD_SSE42_PCLMUL)
+    /*
+     * Use x86 sse4.2+pclmul SIMD to compute the crc32. Since this
+     * routine can be freely used, check CPU features here.
+     */
+    if (buf == Z_NULL) {
+        if (!len) /* Assume user is calling crc32(0, NULL, 0); */
+            cpu_check_features();
+        return 0UL;
+    }
+
+    if (x86_cpu_enable_simd && len >= Z_CRC32_SSE42_MINIMUM_LENGTH) {
+        /* crc32 16-byte chunks */
+        z_size_t chunk_size = len & ~Z_CRC32_SSE42_CHUNKSIZE_MASK;
+        crc = ~crc32_sse42_simd_(buf, chunk_size, ~(uint32_t)crc);
+        /* check remaining data */
+        len -= chunk_size;
+        if (!len)
+            return crc;
+        /* Fall into the default crc32 for the remaining data. */
+        buf += chunk_size;
+    }
+#else
+    if (buf == Z_NULL) {
+        return 0UL;
+    }
+#endif /* CRC32_SIMD_SSE42_PCLMUL */
+
+#ifdef DYNAMIC_CRC_TABLE
+    if (crc_table_empty)
+        make_crc_table();
+#endif /* DYNAMIC_CRC_TABLE */
+
+#ifdef BYFOUR
+    if (sizeof(void *) == sizeof(ptrdiff_t)) {
+        z_crc_t endian;
+
+        endian = 1;
+        if (*((unsigned char *)(&endian)))
+            return crc32_little(crc, buf, len);
+        else
+            return crc32_big(crc, buf, len);
+    }
+#endif /* BYFOUR */
+    crc = crc ^ 0xffffffffUL;
+    while (len >= 8) {
+        DO8;
+        len -= 8;
+    }
+    if (len) do {
+        DO1;
+    } while (--len);
+    return crc ^ 0xffffffffUL;
+}
+
+/* ========================================================================= */
+unsigned long ZEXPORT crc32(crc, buf, len)
+    unsigned long crc;
+    const unsigned char FAR *buf;
+    uInt len;
+{
+#if defined(CRC32_ARMV8_CRC32)
+    /* We got to verify ARM CPU features, so exploit the common usage pattern
+     * of calling this function with Z_NULL for an initial valid crc value.
+     * This allows to cache the result of the feature check and avoid extraneous
+     * function calls.
+     * TODO: try to move this to crc32_z if we don't loose performance on ARM.
+     */
+    if (buf == Z_NULL) {
+        if (!len) /* Assume user is calling crc32(0, NULL, 0); */
+            cpu_check_features();
+        return 0UL;
+    }
+
+    if (arm_cpu_enable_crc32)
+        return armv8_crc32_little(crc, buf, len);
+#endif
+    return crc32_z(crc, buf, len);
+}
+
+#ifdef BYFOUR
+
+/*
+   This BYFOUR code accesses the passed unsigned char * buffer with a 32-bit
+   integer pointer type. This violates the strict aliasing rule, where a
+   compiler can assume, for optimization purposes, that two pointers to
+   fundamentally different types won't ever point to the same memory. This can
+   manifest as a problem only if one of the pointers is written to. This code
+   only reads from those pointers. So long as this code remains isolated in
+   this compilation unit, there won't be a problem. For this reason, this code
+   should not be copied and pasted into a compilation unit in which other code
+   writes to the buffer that is passed to these routines.
+ */
+
+/* ========================================================================= */
+#define DOLIT4 c ^= *buf4++; \
+        c = crc_table[3][c & 0xff] ^ crc_table[2][(c >> 8) & 0xff] ^ \
+            crc_table[1][(c >> 16) & 0xff] ^ crc_table[0][c >> 24]
+#define DOLIT32 DOLIT4; DOLIT4; DOLIT4; DOLIT4; DOLIT4; DOLIT4; DOLIT4; DOLIT4
+
+/* ========================================================================= */
+local unsigned long crc32_little(crc, buf, len)
+    unsigned long crc;
+    const unsigned char FAR *buf;
+    z_size_t len;
+{
+    register z_crc_t c;
+    register const z_crc_t FAR *buf4;
+
+    c = (z_crc_t)crc;
+    c = ~c;
+    while (len && ((ptrdiff_t)buf & 3)) {
+        c = crc_table[0][(c ^ *buf++) & 0xff] ^ (c >> 8);
+        len--;
+    }
+
+    buf4 = (const z_crc_t FAR *)(const void FAR *)buf;
+    while (len >= 32) {
+        DOLIT32;
+        len -= 32;
+    }
+    while (len >= 4) {
+        DOLIT4;
+        len -= 4;
+    }
+    buf = (const unsigned char FAR *)buf4;
+
+    if (len) do {
+        c = crc_table[0][(c ^ *buf++) & 0xff] ^ (c >> 8);
+    } while (--len);
+    c = ~c;
+    return (unsigned long)c;
+}
+
+/* ========================================================================= */
+#define DOBIG4 c ^= *buf4++; \
+        c = crc_table[4][c & 0xff] ^ crc_table[5][(c >> 8) & 0xff] ^ \
+            crc_table[6][(c >> 16) & 0xff] ^ crc_table[7][c >> 24]
+#define DOBIG32 DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4
+
+/* ========================================================================= */
+local unsigned long crc32_big(crc, buf, len)
+    unsigned long crc;
+    const unsigned char FAR *buf;
+    z_size_t len;
+{
+    register z_crc_t c;
+    register const z_crc_t FAR *buf4;
+
+    c = ZSWAP32((z_crc_t)crc);
+    c = ~c;
+    while (len && ((ptrdiff_t)buf & 3)) {
+        c = crc_table[4][(c >> 24) ^ *buf++] ^ (c << 8);
+        len--;
+    }
+
+    buf4 = (const z_crc_t FAR *)(const void FAR *)buf;
+    while (len >= 32) {
+        DOBIG32;
+        len -= 32;
+    }
+    while (len >= 4) {
+        DOBIG4;
+        len -= 4;
+    }
+    buf = (const unsigned char FAR *)buf4;
+
+    if (len) do {
+        c = crc_table[4][(c >> 24) ^ *buf++] ^ (c << 8);
+    } while (--len);
+    c = ~c;
+    return (unsigned long)(ZSWAP32(c));
+}
+
+#endif /* BYFOUR */
+
+#define GF2_DIM 32      /* dimension of GF(2) vectors (length of CRC) */
+
+/* ========================================================================= */
+local unsigned long gf2_matrix_times(mat, vec)
+    unsigned long *mat;
+    unsigned long vec;
+{
+    unsigned long sum;
+
+    sum = 0;
+    while (vec) {
+        if (vec & 1)
+            sum ^= *mat;
+        vec >>= 1;
+        mat++;
+    }
+    return sum;
+}
+
+/* ========================================================================= */
+local void gf2_matrix_square(square, mat)
+    unsigned long *square;
+    unsigned long *mat;
+{
+    int n;
+
+    for (n = 0; n < GF2_DIM; n++)
+        square[n] = gf2_matrix_times(mat, mat[n]);
+}
+
+/* ========================================================================= */
+local uLong crc32_combine_(crc1, crc2, len2)
+    uLong crc1;
+    uLong crc2;
+    z_off64_t len2;
+{
+    int n;
+    unsigned long row;
+    unsigned long even[GF2_DIM];    /* even-power-of-two zeros operator */
+    unsigned long odd[GF2_DIM];     /* odd-power-of-two zeros operator */
+
+    /* degenerate case (also disallow negative lengths) */
+    if (len2 <= 0)
+        return crc1;
+
+    /* put operator for one zero bit in odd */
+    odd[0] = 0xedb88320UL;          /* CRC-32 polynomial */
+    row = 1;
+    for (n = 1; n < GF2_DIM; n++) {
+        odd[n] = row;
+        row <<= 1;
+    }
+
+    /* put operator for two zero bits in even */
+    gf2_matrix_square(even, odd);
+
+    /* put operator for four zero bits in odd */
+    gf2_matrix_square(odd, even);
+
+    /* apply len2 zeros to crc1 (first square will put the operator for one
+       zero byte, eight zero bits, in even) */
+    do {
+        /* apply zeros operator for this bit of len2 */
+        gf2_matrix_square(even, odd);
+        if (len2 & 1)
+            crc1 = gf2_matrix_times(even, crc1);
+        len2 >>= 1;
+
+        /* if no more bits set, then done */
+        if (len2 == 0)
+            break;
+
+        /* another iteration of the loop with odd and even swapped */
+        gf2_matrix_square(odd, even);
+        if (len2 & 1)
+            crc1 = gf2_matrix_times(odd, crc1);
+        len2 >>= 1;
+
+        /* if no more bits set, then done */
+    } while (len2 != 0);
+
+    /* return combined crc */
+    crc1 ^= crc2;
+    return crc1;
+}
+
+/* ========================================================================= */
+uLong ZEXPORT crc32_combine(crc1, crc2, len2)
+    uLong crc1;
+    uLong crc2;
+    z_off_t len2;
+{
+    return crc32_combine_(crc1, crc2, len2);
+}
+
+uLong ZEXPORT crc32_combine64(crc1, crc2, len2)
+    uLong crc1;
+    uLong crc2;
+    z_off64_t len2;
+{
+    return crc32_combine_(crc1, crc2, len2);
+}
+
+ZLIB_INTERNAL void crc_reset(deflate_state *const s)
+{
+#ifdef ADLER32_SIMD_SSSE3
+    if (x86_cpu_enable_simd) {
+        crc_fold_init(s);
+        return;
+    }
+#endif
+    s->strm->adler = crc32(0L, Z_NULL, 0);
+}
+
+ZLIB_INTERNAL void crc_finalize(deflate_state *const s)
+{
+#ifdef ADLER32_SIMD_SSSE3
+    if (x86_cpu_enable_simd)
+        s->strm->adler = crc_fold_512to32(s);
+#endif
+}
+
+ZLIB_INTERNAL void copy_with_crc(z_streamp strm, Bytef *dst, long size)
+{
+#ifdef ADLER32_SIMD_SSSE3
+    if (x86_cpu_enable_simd) {
+        crc_fold_copy(strm->state, dst, strm->next_in, size);
+        return;
+    }
+#endif
+    zmemcpy(dst, strm->next_in, size);
+    strm->adler = crc32(strm->adler, dst, size);
+}
diff --git a/deps/v8/third_party/zlib/crc32.h b/deps/v8/third_party/zlib/crc32.h
new file mode 100644
index 00000000000000..9e0c7781025148
--- /dev/null
+++ b/deps/v8/third_party/zlib/crc32.h
@@ -0,0 +1,441 @@
+/* crc32.h -- tables for rapid CRC calculation
+ * Generated automatically by crc32.c
+ */
+
+local const z_crc_t FAR crc_table[TBLS][256] =
+{
+  {
+    0x00000000UL, 0x77073096UL, 0xee0e612cUL, 0x990951baUL, 0x076dc419UL,
+    0x706af48fUL, 0xe963a535UL, 0x9e6495a3UL, 0x0edb8832UL, 0x79dcb8a4UL,
+    0xe0d5e91eUL, 0x97d2d988UL, 0x09b64c2bUL, 0x7eb17cbdUL, 0xe7b82d07UL,
+    0x90bf1d91UL, 0x1db71064UL, 0x6ab020f2UL, 0xf3b97148UL, 0x84be41deUL,
+    0x1adad47dUL, 0x6ddde4ebUL, 0xf4d4b551UL, 0x83d385c7UL, 0x136c9856UL,
+    0x646ba8c0UL, 0xfd62f97aUL, 0x8a65c9ecUL, 0x14015c4fUL, 0x63066cd9UL,
+    0xfa0f3d63UL, 0x8d080df5UL, 0x3b6e20c8UL, 0x4c69105eUL, 0xd56041e4UL,
+    0xa2677172UL, 0x3c03e4d1UL, 0x4b04d447UL, 0xd20d85fdUL, 0xa50ab56bUL,
+    0x35b5a8faUL, 0x42b2986cUL, 0xdbbbc9d6UL, 0xacbcf940UL, 0x32d86ce3UL,
+    0x45df5c75UL, 0xdcd60dcfUL, 0xabd13d59UL, 0x26d930acUL, 0x51de003aUL,
+    0xc8d75180UL, 0xbfd06116UL, 0x21b4f4b5UL, 0x56b3c423UL, 0xcfba9599UL,
+    0xb8bda50fUL, 0x2802b89eUL, 0x5f058808UL, 0xc60cd9b2UL, 0xb10be924UL,
+    0x2f6f7c87UL, 0x58684c11UL, 0xc1611dabUL, 0xb6662d3dUL, 0x76dc4190UL,
+    0x01db7106UL, 0x98d220bcUL, 0xefd5102aUL, 0x71b18589UL, 0x06b6b51fUL,
+    0x9fbfe4a5UL, 0xe8b8d433UL, 0x7807c9a2UL, 0x0f00f934UL, 0x9609a88eUL,
+    0xe10e9818UL, 0x7f6a0dbbUL, 0x086d3d2dUL, 0x91646c97UL, 0xe6635c01UL,
+    0x6b6b51f4UL, 0x1c6c6162UL, 0x856530d8UL, 0xf262004eUL, 0x6c0695edUL,
+    0x1b01a57bUL, 0x8208f4c1UL, 0xf50fc457UL, 0x65b0d9c6UL, 0x12b7e950UL,
+    0x8bbeb8eaUL, 0xfcb9887cUL, 0x62dd1ddfUL, 0x15da2d49UL, 0x8cd37cf3UL,
+    0xfbd44c65UL, 0x4db26158UL, 0x3ab551ceUL, 0xa3bc0074UL, 0xd4bb30e2UL,
+    0x4adfa541UL, 0x3dd895d7UL, 0xa4d1c46dUL, 0xd3d6f4fbUL, 0x4369e96aUL,
+    0x346ed9fcUL, 0xad678846UL, 0xda60b8d0UL, 0x44042d73UL, 0x33031de5UL,
+    0xaa0a4c5fUL, 0xdd0d7cc9UL, 0x5005713cUL, 0x270241aaUL, 0xbe0b1010UL,
+    0xc90c2086UL, 0x5768b525UL, 0x206f85b3UL, 0xb966d409UL, 0xce61e49fUL,
+    0x5edef90eUL, 0x29d9c998UL, 0xb0d09822UL, 0xc7d7a8b4UL, 0x59b33d17UL,
+    0x2eb40d81UL, 0xb7bd5c3bUL, 0xc0ba6cadUL, 0xedb88320UL, 0x9abfb3b6UL,
+    0x03b6e20cUL, 0x74b1d29aUL, 0xead54739UL, 0x9dd277afUL, 0x04db2615UL,
+    0x73dc1683UL, 0xe3630b12UL, 0x94643b84UL, 0x0d6d6a3eUL, 0x7a6a5aa8UL,
+    0xe40ecf0bUL, 0x9309ff9dUL, 0x0a00ae27UL, 0x7d079eb1UL, 0xf00f9344UL,
+    0x8708a3d2UL, 0x1e01f268UL, 0x6906c2feUL, 0xf762575dUL, 0x806567cbUL,
+    0x196c3671UL, 0x6e6b06e7UL, 0xfed41b76UL, 0x89d32be0UL, 0x10da7a5aUL,
+    0x67dd4accUL, 0xf9b9df6fUL, 0x8ebeeff9UL, 0x17b7be43UL, 0x60b08ed5UL,
+    0xd6d6a3e8UL, 0xa1d1937eUL, 0x38d8c2c4UL, 0x4fdff252UL, 0xd1bb67f1UL,
+    0xa6bc5767UL, 0x3fb506ddUL, 0x48b2364bUL, 0xd80d2bdaUL, 0xaf0a1b4cUL,
+    0x36034af6UL, 0x41047a60UL, 0xdf60efc3UL, 0xa867df55UL, 0x316e8eefUL,
+    0x4669be79UL, 0xcb61b38cUL, 0xbc66831aUL, 0x256fd2a0UL, 0x5268e236UL,
+    0xcc0c7795UL, 0xbb0b4703UL, 0x220216b9UL, 0x5505262fUL, 0xc5ba3bbeUL,
+    0xb2bd0b28UL, 0x2bb45a92UL, 0x5cb36a04UL, 0xc2d7ffa7UL, 0xb5d0cf31UL,
+    0x2cd99e8bUL, 0x5bdeae1dUL, 0x9b64c2b0UL, 0xec63f226UL, 0x756aa39cUL,
+    0x026d930aUL, 0x9c0906a9UL, 0xeb0e363fUL, 0x72076785UL, 0x05005713UL,
+    0x95bf4a82UL, 0xe2b87a14UL, 0x7bb12baeUL, 0x0cb61b38UL, 0x92d28e9bUL,
+    0xe5d5be0dUL, 0x7cdcefb7UL, 0x0bdbdf21UL, 0x86d3d2d4UL, 0xf1d4e242UL,
+    0x68ddb3f8UL, 0x1fda836eUL, 0x81be16cdUL, 0xf6b9265bUL, 0x6fb077e1UL,
+    0x18b74777UL, 0x88085ae6UL, 0xff0f6a70UL, 0x66063bcaUL, 0x11010b5cUL,
+    0x8f659effUL, 0xf862ae69UL, 0x616bffd3UL, 0x166ccf45UL, 0xa00ae278UL,
+    0xd70dd2eeUL, 0x4e048354UL, 0x3903b3c2UL, 0xa7672661UL, 0xd06016f7UL,
+    0x4969474dUL, 0x3e6e77dbUL, 0xaed16a4aUL, 0xd9d65adcUL, 0x40df0b66UL,
+    0x37d83bf0UL, 0xa9bcae53UL, 0xdebb9ec5UL, 0x47b2cf7fUL, 0x30b5ffe9UL,
+    0xbdbdf21cUL, 0xcabac28aUL, 0x53b39330UL, 0x24b4a3a6UL, 0xbad03605UL,
+    0xcdd70693UL, 0x54de5729UL, 0x23d967bfUL, 0xb3667a2eUL, 0xc4614ab8UL,
+    0x5d681b02UL, 0x2a6f2b94UL, 0xb40bbe37UL, 0xc30c8ea1UL, 0x5a05df1bUL,
+    0x2d02ef8dUL
+#ifdef BYFOUR
+  },
+  {
+    0x00000000UL, 0x191b3141UL, 0x32366282UL, 0x2b2d53c3UL, 0x646cc504UL,
+    0x7d77f445UL, 0x565aa786UL, 0x4f4196c7UL, 0xc8d98a08UL, 0xd1c2bb49UL,
+    0xfaefe88aUL, 0xe3f4d9cbUL, 0xacb54f0cUL, 0xb5ae7e4dUL, 0x9e832d8eUL,
+    0x87981ccfUL, 0x4ac21251UL, 0x53d92310UL, 0x78f470d3UL, 0x61ef4192UL,
+    0x2eaed755UL, 0x37b5e614UL, 0x1c98b5d7UL, 0x05838496UL, 0x821b9859UL,
+    0x9b00a918UL, 0xb02dfadbUL, 0xa936cb9aUL, 0xe6775d5dUL, 0xff6c6c1cUL,
+    0xd4413fdfUL, 0xcd5a0e9eUL, 0x958424a2UL, 0x8c9f15e3UL, 0xa7b24620UL,
+    0xbea97761UL, 0xf1e8e1a6UL, 0xe8f3d0e7UL, 0xc3de8324UL, 0xdac5b265UL,
+    0x5d5daeaaUL, 0x44469febUL, 0x6f6bcc28UL, 0x7670fd69UL, 0x39316baeUL,
+    0x202a5aefUL, 0x0b07092cUL, 0x121c386dUL, 0xdf4636f3UL, 0xc65d07b2UL,
+    0xed705471UL, 0xf46b6530UL, 0xbb2af3f7UL, 0xa231c2b6UL, 0x891c9175UL,
+    0x9007a034UL, 0x179fbcfbUL, 0x0e848dbaUL, 0x25a9de79UL, 0x3cb2ef38UL,
+    0x73f379ffUL, 0x6ae848beUL, 0x41c51b7dUL, 0x58de2a3cUL, 0xf0794f05UL,
+    0xe9627e44UL, 0xc24f2d87UL, 0xdb541cc6UL, 0x94158a01UL, 0x8d0ebb40UL,
+    0xa623e883UL, 0xbf38d9c2UL, 0x38a0c50dUL, 0x21bbf44cUL, 0x0a96a78fUL,
+    0x138d96ceUL, 0x5ccc0009UL, 0x45d73148UL, 0x6efa628bUL, 0x77e153caUL,
+    0xbabb5d54UL, 0xa3a06c15UL, 0x888d3fd6UL, 0x91960e97UL, 0xded79850UL,
+    0xc7cca911UL, 0xece1fad2UL, 0xf5facb93UL, 0x7262d75cUL, 0x6b79e61dUL,
+    0x4054b5deUL, 0x594f849fUL, 0x160e1258UL, 0x0f152319UL, 0x243870daUL,
+    0x3d23419bUL, 0x65fd6ba7UL, 0x7ce65ae6UL, 0x57cb0925UL, 0x4ed03864UL,
+    0x0191aea3UL, 0x188a9fe2UL, 0x33a7cc21UL, 0x2abcfd60UL, 0xad24e1afUL,
+    0xb43fd0eeUL, 0x9f12832dUL, 0x8609b26cUL, 0xc94824abUL, 0xd05315eaUL,
+    0xfb7e4629UL, 0xe2657768UL, 0x2f3f79f6UL, 0x362448b7UL, 0x1d091b74UL,
+    0x04122a35UL, 0x4b53bcf2UL, 0x52488db3UL, 0x7965de70UL, 0x607eef31UL,
+    0xe7e6f3feUL, 0xfefdc2bfUL, 0xd5d0917cUL, 0xcccba03dUL, 0x838a36faUL,
+    0x9a9107bbUL, 0xb1bc5478UL, 0xa8a76539UL, 0x3b83984bUL, 0x2298a90aUL,
+    0x09b5fac9UL, 0x10aecb88UL, 0x5fef5d4fUL, 0x46f46c0eUL, 0x6dd93fcdUL,
+    0x74c20e8cUL, 0xf35a1243UL, 0xea412302UL, 0xc16c70c1UL, 0xd8774180UL,
+    0x9736d747UL, 0x8e2de606UL, 0xa500b5c5UL, 0xbc1b8484UL, 0x71418a1aUL,
+    0x685abb5bUL, 0x4377e898UL, 0x5a6cd9d9UL, 0x152d4f1eUL, 0x0c367e5fUL,
+    0x271b2d9cUL, 0x3e001cddUL, 0xb9980012UL, 0xa0833153UL, 0x8bae6290UL,
+    0x92b553d1UL, 0xddf4c516UL, 0xc4eff457UL, 0xefc2a794UL, 0xf6d996d5UL,
+    0xae07bce9UL, 0xb71c8da8UL, 0x9c31de6bUL, 0x852aef2aUL, 0xca6b79edUL,
+    0xd37048acUL, 0xf85d1b6fUL, 0xe1462a2eUL, 0x66de36e1UL, 0x7fc507a0UL,
+    0x54e85463UL, 0x4df36522UL, 0x02b2f3e5UL, 0x1ba9c2a4UL, 0x30849167UL,
+    0x299fa026UL, 0xe4c5aeb8UL, 0xfdde9ff9UL, 0xd6f3cc3aUL, 0xcfe8fd7bUL,
+    0x80a96bbcUL, 0x99b25afdUL, 0xb29f093eUL, 0xab84387fUL, 0x2c1c24b0UL,
+    0x350715f1UL, 0x1e2a4632UL, 0x07317773UL, 0x4870e1b4UL, 0x516bd0f5UL,
+    0x7a468336UL, 0x635db277UL, 0xcbfad74eUL, 0xd2e1e60fUL, 0xf9ccb5ccUL,
+    0xe0d7848dUL, 0xaf96124aUL, 0xb68d230bUL, 0x9da070c8UL, 0x84bb4189UL,
+    0x03235d46UL, 0x1a386c07UL, 0x31153fc4UL, 0x280e0e85UL, 0x674f9842UL,
+    0x7e54a903UL, 0x5579fac0UL, 0x4c62cb81UL, 0x8138c51fUL, 0x9823f45eUL,
+    0xb30ea79dUL, 0xaa1596dcUL, 0xe554001bUL, 0xfc4f315aUL, 0xd7626299UL,
+    0xce7953d8UL, 0x49e14f17UL, 0x50fa7e56UL, 0x7bd72d95UL, 0x62cc1cd4UL,
+    0x2d8d8a13UL, 0x3496bb52UL, 0x1fbbe891UL, 0x06a0d9d0UL, 0x5e7ef3ecUL,
+    0x4765c2adUL, 0x6c48916eUL, 0x7553a02fUL, 0x3a1236e8UL, 0x230907a9UL,
+    0x0824546aUL, 0x113f652bUL, 0x96a779e4UL, 0x8fbc48a5UL, 0xa4911b66UL,
+    0xbd8a2a27UL, 0xf2cbbce0UL, 0xebd08da1UL, 0xc0fdde62UL, 0xd9e6ef23UL,
+    0x14bce1bdUL, 0x0da7d0fcUL, 0x268a833fUL, 0x3f91b27eUL, 0x70d024b9UL,
+    0x69cb15f8UL, 0x42e6463bUL, 0x5bfd777aUL, 0xdc656bb5UL, 0xc57e5af4UL,
+    0xee530937UL, 0xf7483876UL, 0xb809aeb1UL, 0xa1129ff0UL, 0x8a3fcc33UL,
+    0x9324fd72UL
+  },
+  {
+    0x00000000UL, 0x01c26a37UL, 0x0384d46eUL, 0x0246be59UL, 0x0709a8dcUL,
+    0x06cbc2ebUL, 0x048d7cb2UL, 0x054f1685UL, 0x0e1351b8UL, 0x0fd13b8fUL,
+    0x0d9785d6UL, 0x0c55efe1UL, 0x091af964UL, 0x08d89353UL, 0x0a9e2d0aUL,
+    0x0b5c473dUL, 0x1c26a370UL, 0x1de4c947UL, 0x1fa2771eUL, 0x1e601d29UL,
+    0x1b2f0bacUL, 0x1aed619bUL, 0x18abdfc2UL, 0x1969b5f5UL, 0x1235f2c8UL,
+    0x13f798ffUL, 0x11b126a6UL, 0x10734c91UL, 0x153c5a14UL, 0x14fe3023UL,
+    0x16b88e7aUL, 0x177ae44dUL, 0x384d46e0UL, 0x398f2cd7UL, 0x3bc9928eUL,
+    0x3a0bf8b9UL, 0x3f44ee3cUL, 0x3e86840bUL, 0x3cc03a52UL, 0x3d025065UL,
+    0x365e1758UL, 0x379c7d6fUL, 0x35dac336UL, 0x3418a901UL, 0x3157bf84UL,
+    0x3095d5b3UL, 0x32d36beaUL, 0x331101ddUL, 0x246be590UL, 0x25a98fa7UL,
+    0x27ef31feUL, 0x262d5bc9UL, 0x23624d4cUL, 0x22a0277bUL, 0x20e69922UL,
+    0x2124f315UL, 0x2a78b428UL, 0x2bbade1fUL, 0x29fc6046UL, 0x283e0a71UL,
+    0x2d711cf4UL, 0x2cb376c3UL, 0x2ef5c89aUL, 0x2f37a2adUL, 0x709a8dc0UL,
+    0x7158e7f7UL, 0x731e59aeUL, 0x72dc3399UL, 0x7793251cUL, 0x76514f2bUL,
+    0x7417f172UL, 0x75d59b45UL, 0x7e89dc78UL, 0x7f4bb64fUL, 0x7d0d0816UL,
+    0x7ccf6221UL, 0x798074a4UL, 0x78421e93UL, 0x7a04a0caUL, 0x7bc6cafdUL,
+    0x6cbc2eb0UL, 0x6d7e4487UL, 0x6f38fadeUL, 0x6efa90e9UL, 0x6bb5866cUL,
+    0x6a77ec5bUL, 0x68315202UL, 0x69f33835UL, 0x62af7f08UL, 0x636d153fUL,
+    0x612bab66UL, 0x60e9c151UL, 0x65a6d7d4UL, 0x6464bde3UL, 0x662203baUL,
+    0x67e0698dUL, 0x48d7cb20UL, 0x4915a117UL, 0x4b531f4eUL, 0x4a917579UL,
+    0x4fde63fcUL, 0x4e1c09cbUL, 0x4c5ab792UL, 0x4d98dda5UL, 0x46c49a98UL,
+    0x4706f0afUL, 0x45404ef6UL, 0x448224c1UL, 0x41cd3244UL, 0x400f5873UL,
+    0x4249e62aUL, 0x438b8c1dUL, 0x54f16850UL, 0x55330267UL, 0x5775bc3eUL,
+    0x56b7d609UL, 0x53f8c08cUL, 0x523aaabbUL, 0x507c14e2UL, 0x51be7ed5UL,
+    0x5ae239e8UL, 0x5b2053dfUL, 0x5966ed86UL, 0x58a487b1UL, 0x5deb9134UL,
+    0x5c29fb03UL, 0x5e6f455aUL, 0x5fad2f6dUL, 0xe1351b80UL, 0xe0f771b7UL,
+    0xe2b1cfeeUL, 0xe373a5d9UL, 0xe63cb35cUL, 0xe7fed96bUL, 0xe5b86732UL,
+    0xe47a0d05UL, 0xef264a38UL, 0xeee4200fUL, 0xeca29e56UL, 0xed60f461UL,
+    0xe82fe2e4UL, 0xe9ed88d3UL, 0xebab368aUL, 0xea695cbdUL, 0xfd13b8f0UL,
+    0xfcd1d2c7UL, 0xfe976c9eUL, 0xff5506a9UL, 0xfa1a102cUL, 0xfbd87a1bUL,
+    0xf99ec442UL, 0xf85cae75UL, 0xf300e948UL, 0xf2c2837fUL, 0xf0843d26UL,
+    0xf1465711UL, 0xf4094194UL, 0xf5cb2ba3UL, 0xf78d95faUL, 0xf64fffcdUL,
+    0xd9785d60UL, 0xd8ba3757UL, 0xdafc890eUL, 0xdb3ee339UL, 0xde71f5bcUL,
+    0xdfb39f8bUL, 0xddf521d2UL, 0xdc374be5UL, 0xd76b0cd8UL, 0xd6a966efUL,
+    0xd4efd8b6UL, 0xd52db281UL, 0xd062a404UL, 0xd1a0ce33UL, 0xd3e6706aUL,
+    0xd2241a5dUL, 0xc55efe10UL, 0xc49c9427UL, 0xc6da2a7eUL, 0xc7184049UL,
+    0xc25756ccUL, 0xc3953cfbUL, 0xc1d382a2UL, 0xc011e895UL, 0xcb4dafa8UL,
+    0xca8fc59fUL, 0xc8c97bc6UL, 0xc90b11f1UL, 0xcc440774UL, 0xcd866d43UL,
+    0xcfc0d31aUL, 0xce02b92dUL, 0x91af9640UL, 0x906dfc77UL, 0x922b422eUL,
+    0x93e92819UL, 0x96a63e9cUL, 0x976454abUL, 0x9522eaf2UL, 0x94e080c5UL,
+    0x9fbcc7f8UL, 0x9e7eadcfUL, 0x9c381396UL, 0x9dfa79a1UL, 0x98b56f24UL,
+    0x99770513UL, 0x9b31bb4aUL, 0x9af3d17dUL, 0x8d893530UL, 0x8c4b5f07UL,
+    0x8e0de15eUL, 0x8fcf8b69UL, 0x8a809decUL, 0x8b42f7dbUL, 0x89044982UL,
+    0x88c623b5UL, 0x839a6488UL, 0x82580ebfUL, 0x801eb0e6UL, 0x81dcdad1UL,
+    0x8493cc54UL, 0x8551a663UL, 0x8717183aUL, 0x86d5720dUL, 0xa9e2d0a0UL,
+    0xa820ba97UL, 0xaa6604ceUL, 0xaba46ef9UL, 0xaeeb787cUL, 0xaf29124bUL,
+    0xad6fac12UL, 0xacadc625UL, 0xa7f18118UL, 0xa633eb2fUL, 0xa4755576UL,
+    0xa5b73f41UL, 0xa0f829c4UL, 0xa13a43f3UL, 0xa37cfdaaUL, 0xa2be979dUL,
+    0xb5c473d0UL, 0xb40619e7UL, 0xb640a7beUL, 0xb782cd89UL, 0xb2cddb0cUL,
+    0xb30fb13bUL, 0xb1490f62UL, 0xb08b6555UL, 0xbbd72268UL, 0xba15485fUL,
+    0xb853f606UL, 0xb9919c31UL, 0xbcde8ab4UL, 0xbd1ce083UL, 0xbf5a5edaUL,
+    0xbe9834edUL
+  },
+  {
+    0x00000000UL, 0xb8bc6765UL, 0xaa09c88bUL, 0x12b5afeeUL, 0x8f629757UL,
+    0x37def032UL, 0x256b5fdcUL, 0x9dd738b9UL, 0xc5b428efUL, 0x7d084f8aUL,
+    0x6fbde064UL, 0xd7018701UL, 0x4ad6bfb8UL, 0xf26ad8ddUL, 0xe0df7733UL,
+    0x58631056UL, 0x5019579fUL, 0xe8a530faUL, 0xfa109f14UL, 0x42acf871UL,
+    0xdf7bc0c8UL, 0x67c7a7adUL, 0x75720843UL, 0xcdce6f26UL, 0x95ad7f70UL,
+    0x2d111815UL, 0x3fa4b7fbUL, 0x8718d09eUL, 0x1acfe827UL, 0xa2738f42UL,
+    0xb0c620acUL, 0x087a47c9UL, 0xa032af3eUL, 0x188ec85bUL, 0x0a3b67b5UL,
+    0xb28700d0UL, 0x2f503869UL, 0x97ec5f0cUL, 0x8559f0e2UL, 0x3de59787UL,
+    0x658687d1UL, 0xdd3ae0b4UL, 0xcf8f4f5aUL, 0x7733283fUL, 0xeae41086UL,
+    0x525877e3UL, 0x40edd80dUL, 0xf851bf68UL, 0xf02bf8a1UL, 0x48979fc4UL,
+    0x5a22302aUL, 0xe29e574fUL, 0x7f496ff6UL, 0xc7f50893UL, 0xd540a77dUL,
+    0x6dfcc018UL, 0x359fd04eUL, 0x8d23b72bUL, 0x9f9618c5UL, 0x272a7fa0UL,
+    0xbafd4719UL, 0x0241207cUL, 0x10f48f92UL, 0xa848e8f7UL, 0x9b14583dUL,
+    0x23a83f58UL, 0x311d90b6UL, 0x89a1f7d3UL, 0x1476cf6aUL, 0xaccaa80fUL,
+    0xbe7f07e1UL, 0x06c36084UL, 0x5ea070d2UL, 0xe61c17b7UL, 0xf4a9b859UL,
+    0x4c15df3cUL, 0xd1c2e785UL, 0x697e80e0UL, 0x7bcb2f0eUL, 0xc377486bUL,
+    0xcb0d0fa2UL, 0x73b168c7UL, 0x6104c729UL, 0xd9b8a04cUL, 0x446f98f5UL,
+    0xfcd3ff90UL, 0xee66507eUL, 0x56da371bUL, 0x0eb9274dUL, 0xb6054028UL,
+    0xa4b0efc6UL, 0x1c0c88a3UL, 0x81dbb01aUL, 0x3967d77fUL, 0x2bd27891UL,
+    0x936e1ff4UL, 0x3b26f703UL, 0x839a9066UL, 0x912f3f88UL, 0x299358edUL,
+    0xb4446054UL, 0x0cf80731UL, 0x1e4da8dfUL, 0xa6f1cfbaUL, 0xfe92dfecUL,
+    0x462eb889UL, 0x549b1767UL, 0xec277002UL, 0x71f048bbUL, 0xc94c2fdeUL,
+    0xdbf98030UL, 0x6345e755UL, 0x6b3fa09cUL, 0xd383c7f9UL, 0xc1366817UL,
+    0x798a0f72UL, 0xe45d37cbUL, 0x5ce150aeUL, 0x4e54ff40UL, 0xf6e89825UL,
+    0xae8b8873UL, 0x1637ef16UL, 0x048240f8UL, 0xbc3e279dUL, 0x21e91f24UL,
+    0x99557841UL, 0x8be0d7afUL, 0x335cb0caUL, 0xed59b63bUL, 0x55e5d15eUL,
+    0x47507eb0UL, 0xffec19d5UL, 0x623b216cUL, 0xda874609UL, 0xc832e9e7UL,
+    0x708e8e82UL, 0x28ed9ed4UL, 0x9051f9b1UL, 0x82e4565fUL, 0x3a58313aUL,
+    0xa78f0983UL, 0x1f336ee6UL, 0x0d86c108UL, 0xb53aa66dUL, 0xbd40e1a4UL,
+    0x05fc86c1UL, 0x1749292fUL, 0xaff54e4aUL, 0x322276f3UL, 0x8a9e1196UL,
+    0x982bbe78UL, 0x2097d91dUL, 0x78f4c94bUL, 0xc048ae2eUL, 0xd2fd01c0UL,
+    0x6a4166a5UL, 0xf7965e1cUL, 0x4f2a3979UL, 0x5d9f9697UL, 0xe523f1f2UL,
+    0x4d6b1905UL, 0xf5d77e60UL, 0xe762d18eUL, 0x5fdeb6ebUL, 0xc2098e52UL,
+    0x7ab5e937UL, 0x680046d9UL, 0xd0bc21bcUL, 0x88df31eaUL, 0x3063568fUL,
+    0x22d6f961UL, 0x9a6a9e04UL, 0x07bda6bdUL, 0xbf01c1d8UL, 0xadb46e36UL,
+    0x15080953UL, 0x1d724e9aUL, 0xa5ce29ffUL, 0xb77b8611UL, 0x0fc7e174UL,
+    0x9210d9cdUL, 0x2aacbea8UL, 0x38191146UL, 0x80a57623UL, 0xd8c66675UL,
+    0x607a0110UL, 0x72cfaefeUL, 0xca73c99bUL, 0x57a4f122UL, 0xef189647UL,
+    0xfdad39a9UL, 0x45115eccUL, 0x764dee06UL, 0xcef18963UL, 0xdc44268dUL,
+    0x64f841e8UL, 0xf92f7951UL, 0x41931e34UL, 0x5326b1daUL, 0xeb9ad6bfUL,
+    0xb3f9c6e9UL, 0x0b45a18cUL, 0x19f00e62UL, 0xa14c6907UL, 0x3c9b51beUL,
+    0x842736dbUL, 0x96929935UL, 0x2e2efe50UL, 0x2654b999UL, 0x9ee8defcUL,
+    0x8c5d7112UL, 0x34e11677UL, 0xa9362eceUL, 0x118a49abUL, 0x033fe645UL,
+    0xbb838120UL, 0xe3e09176UL, 0x5b5cf613UL, 0x49e959fdUL, 0xf1553e98UL,
+    0x6c820621UL, 0xd43e6144UL, 0xc68bceaaUL, 0x7e37a9cfUL, 0xd67f4138UL,
+    0x6ec3265dUL, 0x7c7689b3UL, 0xc4caeed6UL, 0x591dd66fUL, 0xe1a1b10aUL,
+    0xf3141ee4UL, 0x4ba87981UL, 0x13cb69d7UL, 0xab770eb2UL, 0xb9c2a15cUL,
+    0x017ec639UL, 0x9ca9fe80UL, 0x241599e5UL, 0x36a0360bUL, 0x8e1c516eUL,
+    0x866616a7UL, 0x3eda71c2UL, 0x2c6fde2cUL, 0x94d3b949UL, 0x090481f0UL,
+    0xb1b8e695UL, 0xa30d497bUL, 0x1bb12e1eUL, 0x43d23e48UL, 0xfb6e592dUL,
+    0xe9dbf6c3UL, 0x516791a6UL, 0xccb0a91fUL, 0x740cce7aUL, 0x66b96194UL,
+    0xde0506f1UL
+  },
+  {
+    0x00000000UL, 0x96300777UL, 0x2c610eeeUL, 0xba510999UL, 0x19c46d07UL,
+    0x8ff46a70UL, 0x35a563e9UL, 0xa395649eUL, 0x3288db0eUL, 0xa4b8dc79UL,
+    0x1ee9d5e0UL, 0x88d9d297UL, 0x2b4cb609UL, 0xbd7cb17eUL, 0x072db8e7UL,
+    0x911dbf90UL, 0x6410b71dUL, 0xf220b06aUL, 0x4871b9f3UL, 0xde41be84UL,
+    0x7dd4da1aUL, 0xebe4dd6dUL, 0x51b5d4f4UL, 0xc785d383UL, 0x56986c13UL,
+    0xc0a86b64UL, 0x7af962fdUL, 0xecc9658aUL, 0x4f5c0114UL, 0xd96c0663UL,
+    0x633d0ffaUL, 0xf50d088dUL, 0xc8206e3bUL, 0x5e10694cUL, 0xe44160d5UL,
+    0x727167a2UL, 0xd1e4033cUL, 0x47d4044bUL, 0xfd850dd2UL, 0x6bb50aa5UL,
+    0xfaa8b535UL, 0x6c98b242UL, 0xd6c9bbdbUL, 0x40f9bcacUL, 0xe36cd832UL,
+    0x755cdf45UL, 0xcf0dd6dcUL, 0x593dd1abUL, 0xac30d926UL, 0x3a00de51UL,
+    0x8051d7c8UL, 0x1661d0bfUL, 0xb5f4b421UL, 0x23c4b356UL, 0x9995bacfUL,
+    0x0fa5bdb8UL, 0x9eb80228UL, 0x0888055fUL, 0xb2d90cc6UL, 0x24e90bb1UL,
+    0x877c6f2fUL, 0x114c6858UL, 0xab1d61c1UL, 0x3d2d66b6UL, 0x9041dc76UL,
+    0x0671db01UL, 0xbc20d298UL, 0x2a10d5efUL, 0x8985b171UL, 0x1fb5b606UL,
+    0xa5e4bf9fUL, 0x33d4b8e8UL, 0xa2c90778UL, 0x34f9000fUL, 0x8ea80996UL,
+    0x18980ee1UL, 0xbb0d6a7fUL, 0x2d3d6d08UL, 0x976c6491UL, 0x015c63e6UL,
+    0xf4516b6bUL, 0x62616c1cUL, 0xd8306585UL, 0x4e0062f2UL, 0xed95066cUL,
+    0x7ba5011bUL, 0xc1f40882UL, 0x57c40ff5UL, 0xc6d9b065UL, 0x50e9b712UL,
+    0xeab8be8bUL, 0x7c88b9fcUL, 0xdf1ddd62UL, 0x492dda15UL, 0xf37cd38cUL,
+    0x654cd4fbUL, 0x5861b24dUL, 0xce51b53aUL, 0x7400bca3UL, 0xe230bbd4UL,
+    0x41a5df4aUL, 0xd795d83dUL, 0x6dc4d1a4UL, 0xfbf4d6d3UL, 0x6ae96943UL,
+    0xfcd96e34UL, 0x468867adUL, 0xd0b860daUL, 0x732d0444UL, 0xe51d0333UL,
+    0x5f4c0aaaUL, 0xc97c0dddUL, 0x3c710550UL, 0xaa410227UL, 0x10100bbeUL,
+    0x86200cc9UL, 0x25b56857UL, 0xb3856f20UL, 0x09d466b9UL, 0x9fe461ceUL,
+    0x0ef9de5eUL, 0x98c9d929UL, 0x2298d0b0UL, 0xb4a8d7c7UL, 0x173db359UL,
+    0x810db42eUL, 0x3b5cbdb7UL, 0xad6cbac0UL, 0x2083b8edUL, 0xb6b3bf9aUL,
+    0x0ce2b603UL, 0x9ad2b174UL, 0x3947d5eaUL, 0xaf77d29dUL, 0x1526db04UL,
+    0x8316dc73UL, 0x120b63e3UL, 0x843b6494UL, 0x3e6a6d0dUL, 0xa85a6a7aUL,
+    0x0bcf0ee4UL, 0x9dff0993UL, 0x27ae000aUL, 0xb19e077dUL, 0x44930ff0UL,
+    0xd2a30887UL, 0x68f2011eUL, 0xfec20669UL, 0x5d5762f7UL, 0xcb676580UL,
+    0x71366c19UL, 0xe7066b6eUL, 0x761bd4feUL, 0xe02bd389UL, 0x5a7ada10UL,
+    0xcc4add67UL, 0x6fdfb9f9UL, 0xf9efbe8eUL, 0x43beb717UL, 0xd58eb060UL,
+    0xe8a3d6d6UL, 0x7e93d1a1UL, 0xc4c2d838UL, 0x52f2df4fUL, 0xf167bbd1UL,
+    0x6757bca6UL, 0xdd06b53fUL, 0x4b36b248UL, 0xda2b0dd8UL, 0x4c1b0aafUL,
+    0xf64a0336UL, 0x607a0441UL, 0xc3ef60dfUL, 0x55df67a8UL, 0xef8e6e31UL,
+    0x79be6946UL, 0x8cb361cbUL, 0x1a8366bcUL, 0xa0d26f25UL, 0x36e26852UL,
+    0x95770cccUL, 0x03470bbbUL, 0xb9160222UL, 0x2f260555UL, 0xbe3bbac5UL,
+    0x280bbdb2UL, 0x925ab42bUL, 0x046ab35cUL, 0xa7ffd7c2UL, 0x31cfd0b5UL,
+    0x8b9ed92cUL, 0x1daede5bUL, 0xb0c2649bUL, 0x26f263ecUL, 0x9ca36a75UL,
+    0x0a936d02UL, 0xa906099cUL, 0x3f360eebUL, 0x85670772UL, 0x13570005UL,
+    0x824abf95UL, 0x147ab8e2UL, 0xae2bb17bUL, 0x381bb60cUL, 0x9b8ed292UL,
+    0x0dbed5e5UL, 0xb7efdc7cUL, 0x21dfdb0bUL, 0xd4d2d386UL, 0x42e2d4f1UL,
+    0xf8b3dd68UL, 0x6e83da1fUL, 0xcd16be81UL, 0x5b26b9f6UL, 0xe177b06fUL,
+    0x7747b718UL, 0xe65a0888UL, 0x706a0fffUL, 0xca3b0666UL, 0x5c0b0111UL,
+    0xff9e658fUL, 0x69ae62f8UL, 0xd3ff6b61UL, 0x45cf6c16UL, 0x78e20aa0UL,
+    0xeed20dd7UL, 0x5483044eUL, 0xc2b30339UL, 0x612667a7UL, 0xf71660d0UL,
+    0x4d476949UL, 0xdb776e3eUL, 0x4a6ad1aeUL, 0xdc5ad6d9UL, 0x660bdf40UL,
+    0xf03bd837UL, 0x53aebca9UL, 0xc59ebbdeUL, 0x7fcfb247UL, 0xe9ffb530UL,
+    0x1cf2bdbdUL, 0x8ac2bacaUL, 0x3093b353UL, 0xa6a3b424UL, 0x0536d0baUL,
+    0x9306d7cdUL, 0x2957de54UL, 0xbf67d923UL, 0x2e7a66b3UL, 0xb84a61c4UL,
+    0x021b685dUL, 0x942b6f2aUL, 0x37be0bb4UL, 0xa18e0cc3UL, 0x1bdf055aUL,
+    0x8def022dUL
+  },
+  {
+    0x00000000UL, 0x41311b19UL, 0x82623632UL, 0xc3532d2bUL, 0x04c56c64UL,
+    0x45f4777dUL, 0x86a75a56UL, 0xc796414fUL, 0x088ad9c8UL, 0x49bbc2d1UL,
+    0x8ae8effaUL, 0xcbd9f4e3UL, 0x0c4fb5acUL, 0x4d7eaeb5UL, 0x8e2d839eUL,
+    0xcf1c9887UL, 0x5112c24aUL, 0x1023d953UL, 0xd370f478UL, 0x9241ef61UL,
+    0x55d7ae2eUL, 0x14e6b537UL, 0xd7b5981cUL, 0x96848305UL, 0x59981b82UL,
+    0x18a9009bUL, 0xdbfa2db0UL, 0x9acb36a9UL, 0x5d5d77e6UL, 0x1c6c6cffUL,
+    0xdf3f41d4UL, 0x9e0e5acdUL, 0xa2248495UL, 0xe3159f8cUL, 0x2046b2a7UL,
+    0x6177a9beUL, 0xa6e1e8f1UL, 0xe7d0f3e8UL, 0x2483dec3UL, 0x65b2c5daUL,
+    0xaaae5d5dUL, 0xeb9f4644UL, 0x28cc6b6fUL, 0x69fd7076UL, 0xae6b3139UL,
+    0xef5a2a20UL, 0x2c09070bUL, 0x6d381c12UL, 0xf33646dfUL, 0xb2075dc6UL,
+    0x715470edUL, 0x30656bf4UL, 0xf7f32abbUL, 0xb6c231a2UL, 0x75911c89UL,
+    0x34a00790UL, 0xfbbc9f17UL, 0xba8d840eUL, 0x79dea925UL, 0x38efb23cUL,
+    0xff79f373UL, 0xbe48e86aUL, 0x7d1bc541UL, 0x3c2ade58UL, 0x054f79f0UL,
+    0x447e62e9UL, 0x872d4fc2UL, 0xc61c54dbUL, 0x018a1594UL, 0x40bb0e8dUL,
+    0x83e823a6UL, 0xc2d938bfUL, 0x0dc5a038UL, 0x4cf4bb21UL, 0x8fa7960aUL,
+    0xce968d13UL, 0x0900cc5cUL, 0x4831d745UL, 0x8b62fa6eUL, 0xca53e177UL,
+    0x545dbbbaUL, 0x156ca0a3UL, 0xd63f8d88UL, 0x970e9691UL, 0x5098d7deUL,
+    0x11a9ccc7UL, 0xd2fae1ecUL, 0x93cbfaf5UL, 0x5cd76272UL, 0x1de6796bUL,
+    0xdeb55440UL, 0x9f844f59UL, 0x58120e16UL, 0x1923150fUL, 0xda703824UL,
+    0x9b41233dUL, 0xa76bfd65UL, 0xe65ae67cUL, 0x2509cb57UL, 0x6438d04eUL,
+    0xa3ae9101UL, 0xe29f8a18UL, 0x21cca733UL, 0x60fdbc2aUL, 0xafe124adUL,
+    0xeed03fb4UL, 0x2d83129fUL, 0x6cb20986UL, 0xab2448c9UL, 0xea1553d0UL,
+    0x29467efbUL, 0x687765e2UL, 0xf6793f2fUL, 0xb7482436UL, 0x741b091dUL,
+    0x352a1204UL, 0xf2bc534bUL, 0xb38d4852UL, 0x70de6579UL, 0x31ef7e60UL,
+    0xfef3e6e7UL, 0xbfc2fdfeUL, 0x7c91d0d5UL, 0x3da0cbccUL, 0xfa368a83UL,
+    0xbb07919aUL, 0x7854bcb1UL, 0x3965a7a8UL, 0x4b98833bUL, 0x0aa99822UL,
+    0xc9fab509UL, 0x88cbae10UL, 0x4f5def5fUL, 0x0e6cf446UL, 0xcd3fd96dUL,
+    0x8c0ec274UL, 0x43125af3UL, 0x022341eaUL, 0xc1706cc1UL, 0x804177d8UL,
+    0x47d73697UL, 0x06e62d8eUL, 0xc5b500a5UL, 0x84841bbcUL, 0x1a8a4171UL,
+    0x5bbb5a68UL, 0x98e87743UL, 0xd9d96c5aUL, 0x1e4f2d15UL, 0x5f7e360cUL,
+    0x9c2d1b27UL, 0xdd1c003eUL, 0x120098b9UL, 0x533183a0UL, 0x9062ae8bUL,
+    0xd153b592UL, 0x16c5f4ddUL, 0x57f4efc4UL, 0x94a7c2efUL, 0xd596d9f6UL,
+    0xe9bc07aeUL, 0xa88d1cb7UL, 0x6bde319cUL, 0x2aef2a85UL, 0xed796bcaUL,
+    0xac4870d3UL, 0x6f1b5df8UL, 0x2e2a46e1UL, 0xe136de66UL, 0xa007c57fUL,
+    0x6354e854UL, 0x2265f34dUL, 0xe5f3b202UL, 0xa4c2a91bUL, 0x67918430UL,
+    0x26a09f29UL, 0xb8aec5e4UL, 0xf99fdefdUL, 0x3accf3d6UL, 0x7bfde8cfUL,
+    0xbc6ba980UL, 0xfd5ab299UL, 0x3e099fb2UL, 0x7f3884abUL, 0xb0241c2cUL,
+    0xf1150735UL, 0x32462a1eUL, 0x73773107UL, 0xb4e17048UL, 0xf5d06b51UL,
+    0x3683467aUL, 0x77b25d63UL, 0x4ed7facbUL, 0x0fe6e1d2UL, 0xccb5ccf9UL,
+    0x8d84d7e0UL, 0x4a1296afUL, 0x0b238db6UL, 0xc870a09dUL, 0x8941bb84UL,
+    0x465d2303UL, 0x076c381aUL, 0xc43f1531UL, 0x850e0e28UL, 0x42984f67UL,
+    0x03a9547eUL, 0xc0fa7955UL, 0x81cb624cUL, 0x1fc53881UL, 0x5ef42398UL,
+    0x9da70eb3UL, 0xdc9615aaUL, 0x1b0054e5UL, 0x5a314ffcUL, 0x996262d7UL,
+    0xd85379ceUL, 0x174fe149UL, 0x567efa50UL, 0x952dd77bUL, 0xd41ccc62UL,
+    0x138a8d2dUL, 0x52bb9634UL, 0x91e8bb1fUL, 0xd0d9a006UL, 0xecf37e5eUL,
+    0xadc26547UL, 0x6e91486cUL, 0x2fa05375UL, 0xe836123aUL, 0xa9070923UL,
+    0x6a542408UL, 0x2b653f11UL, 0xe479a796UL, 0xa548bc8fUL, 0x661b91a4UL,
+    0x272a8abdUL, 0xe0bccbf2UL, 0xa18dd0ebUL, 0x62defdc0UL, 0x23efe6d9UL,
+    0xbde1bc14UL, 0xfcd0a70dUL, 0x3f838a26UL, 0x7eb2913fUL, 0xb924d070UL,
+    0xf815cb69UL, 0x3b46e642UL, 0x7a77fd5bUL, 0xb56b65dcUL, 0xf45a7ec5UL,
+    0x370953eeUL, 0x763848f7UL, 0xb1ae09b8UL, 0xf09f12a1UL, 0x33cc3f8aUL,
+    0x72fd2493UL
+  },
+  {
+    0x00000000UL, 0x376ac201UL, 0x6ed48403UL, 0x59be4602UL, 0xdca80907UL,
+    0xebc2cb06UL, 0xb27c8d04UL, 0x85164f05UL, 0xb851130eUL, 0x8f3bd10fUL,
+    0xd685970dUL, 0xe1ef550cUL, 0x64f91a09UL, 0x5393d808UL, 0x0a2d9e0aUL,
+    0x3d475c0bUL, 0x70a3261cUL, 0x47c9e41dUL, 0x1e77a21fUL, 0x291d601eUL,
+    0xac0b2f1bUL, 0x9b61ed1aUL, 0xc2dfab18UL, 0xf5b56919UL, 0xc8f23512UL,
+    0xff98f713UL, 0xa626b111UL, 0x914c7310UL, 0x145a3c15UL, 0x2330fe14UL,
+    0x7a8eb816UL, 0x4de47a17UL, 0xe0464d38UL, 0xd72c8f39UL, 0x8e92c93bUL,
+    0xb9f80b3aUL, 0x3cee443fUL, 0x0b84863eUL, 0x523ac03cUL, 0x6550023dUL,
+    0x58175e36UL, 0x6f7d9c37UL, 0x36c3da35UL, 0x01a91834UL, 0x84bf5731UL,
+    0xb3d59530UL, 0xea6bd332UL, 0xdd011133UL, 0x90e56b24UL, 0xa78fa925UL,
+    0xfe31ef27UL, 0xc95b2d26UL, 0x4c4d6223UL, 0x7b27a022UL, 0x2299e620UL,
+    0x15f32421UL, 0x28b4782aUL, 0x1fdeba2bUL, 0x4660fc29UL, 0x710a3e28UL,
+    0xf41c712dUL, 0xc376b32cUL, 0x9ac8f52eUL, 0xada2372fUL, 0xc08d9a70UL,
+    0xf7e75871UL, 0xae591e73UL, 0x9933dc72UL, 0x1c259377UL, 0x2b4f5176UL,
+    0x72f11774UL, 0x459bd575UL, 0x78dc897eUL, 0x4fb64b7fUL, 0x16080d7dUL,
+    0x2162cf7cUL, 0xa4748079UL, 0x931e4278UL, 0xcaa0047aUL, 0xfdcac67bUL,
+    0xb02ebc6cUL, 0x87447e6dUL, 0xdefa386fUL, 0xe990fa6eUL, 0x6c86b56bUL,
+    0x5bec776aUL, 0x02523168UL, 0x3538f369UL, 0x087faf62UL, 0x3f156d63UL,
+    0x66ab2b61UL, 0x51c1e960UL, 0xd4d7a665UL, 0xe3bd6464UL, 0xba032266UL,
+    0x8d69e067UL, 0x20cbd748UL, 0x17a11549UL, 0x4e1f534bUL, 0x7975914aUL,
+    0xfc63de4fUL, 0xcb091c4eUL, 0x92b75a4cUL, 0xa5dd984dUL, 0x989ac446UL,
+    0xaff00647UL, 0xf64e4045UL, 0xc1248244UL, 0x4432cd41UL, 0x73580f40UL,
+    0x2ae64942UL, 0x1d8c8b43UL, 0x5068f154UL, 0x67023355UL, 0x3ebc7557UL,
+    0x09d6b756UL, 0x8cc0f853UL, 0xbbaa3a52UL, 0xe2147c50UL, 0xd57ebe51UL,
+    0xe839e25aUL, 0xdf53205bUL, 0x86ed6659UL, 0xb187a458UL, 0x3491eb5dUL,
+    0x03fb295cUL, 0x5a456f5eUL, 0x6d2fad5fUL, 0x801b35e1UL, 0xb771f7e0UL,
+    0xeecfb1e2UL, 0xd9a573e3UL, 0x5cb33ce6UL, 0x6bd9fee7UL, 0x3267b8e5UL,
+    0x050d7ae4UL, 0x384a26efUL, 0x0f20e4eeUL, 0x569ea2ecUL, 0x61f460edUL,
+    0xe4e22fe8UL, 0xd388ede9UL, 0x8a36abebUL, 0xbd5c69eaUL, 0xf0b813fdUL,
+    0xc7d2d1fcUL, 0x9e6c97feUL, 0xa90655ffUL, 0x2c101afaUL, 0x1b7ad8fbUL,
+    0x42c49ef9UL, 0x75ae5cf8UL, 0x48e900f3UL, 0x7f83c2f2UL, 0x263d84f0UL,
+    0x115746f1UL, 0x944109f4UL, 0xa32bcbf5UL, 0xfa958df7UL, 0xcdff4ff6UL,
+    0x605d78d9UL, 0x5737bad8UL, 0x0e89fcdaUL, 0x39e33edbUL, 0xbcf571deUL,
+    0x8b9fb3dfUL, 0xd221f5ddUL, 0xe54b37dcUL, 0xd80c6bd7UL, 0xef66a9d6UL,
+    0xb6d8efd4UL, 0x81b22dd5UL, 0x04a462d0UL, 0x33cea0d1UL, 0x6a70e6d3UL,
+    0x5d1a24d2UL, 0x10fe5ec5UL, 0x27949cc4UL, 0x7e2adac6UL, 0x494018c7UL,
+    0xcc5657c2UL, 0xfb3c95c3UL, 0xa282d3c1UL, 0x95e811c0UL, 0xa8af4dcbUL,
+    0x9fc58fcaUL, 0xc67bc9c8UL, 0xf1110bc9UL, 0x740744ccUL, 0x436d86cdUL,
+    0x1ad3c0cfUL, 0x2db902ceUL, 0x4096af91UL, 0x77fc6d90UL, 0x2e422b92UL,
+    0x1928e993UL, 0x9c3ea696UL, 0xab546497UL, 0xf2ea2295UL, 0xc580e094UL,
+    0xf8c7bc9fUL, 0xcfad7e9eUL, 0x9613389cUL, 0xa179fa9dUL, 0x246fb598UL,
+    0x13057799UL, 0x4abb319bUL, 0x7dd1f39aUL, 0x3035898dUL, 0x075f4b8cUL,
+    0x5ee10d8eUL, 0x698bcf8fUL, 0xec9d808aUL, 0xdbf7428bUL, 0x82490489UL,
+    0xb523c688UL, 0x88649a83UL, 0xbf0e5882UL, 0xe6b01e80UL, 0xd1dadc81UL,
+    0x54cc9384UL, 0x63a65185UL, 0x3a181787UL, 0x0d72d586UL, 0xa0d0e2a9UL,
+    0x97ba20a8UL, 0xce0466aaUL, 0xf96ea4abUL, 0x7c78ebaeUL, 0x4b1229afUL,
+    0x12ac6fadUL, 0x25c6adacUL, 0x1881f1a7UL, 0x2feb33a6UL, 0x765575a4UL,
+    0x413fb7a5UL, 0xc429f8a0UL, 0xf3433aa1UL, 0xaafd7ca3UL, 0x9d97bea2UL,
+    0xd073c4b5UL, 0xe71906b4UL, 0xbea740b6UL, 0x89cd82b7UL, 0x0cdbcdb2UL,
+    0x3bb10fb3UL, 0x620f49b1UL, 0x55658bb0UL, 0x6822d7bbUL, 0x5f4815baUL,
+    0x06f653b8UL, 0x319c91b9UL, 0xb48adebcUL, 0x83e01cbdUL, 0xda5e5abfUL,
+    0xed3498beUL
+  },
+  {
+    0x00000000UL, 0x6567bcb8UL, 0x8bc809aaUL, 0xeeafb512UL, 0x5797628fUL,
+    0x32f0de37UL, 0xdc5f6b25UL, 0xb938d79dUL, 0xef28b4c5UL, 0x8a4f087dUL,
+    0x64e0bd6fUL, 0x018701d7UL, 0xb8bfd64aUL, 0xddd86af2UL, 0x3377dfe0UL,
+    0x56106358UL, 0x9f571950UL, 0xfa30a5e8UL, 0x149f10faUL, 0x71f8ac42UL,
+    0xc8c07bdfUL, 0xada7c767UL, 0x43087275UL, 0x266fcecdUL, 0x707fad95UL,
+    0x1518112dUL, 0xfbb7a43fUL, 0x9ed01887UL, 0x27e8cf1aUL, 0x428f73a2UL,
+    0xac20c6b0UL, 0xc9477a08UL, 0x3eaf32a0UL, 0x5bc88e18UL, 0xb5673b0aUL,
+    0xd00087b2UL, 0x6938502fUL, 0x0c5fec97UL, 0xe2f05985UL, 0x8797e53dUL,
+    0xd1878665UL, 0xb4e03addUL, 0x5a4f8fcfUL, 0x3f283377UL, 0x8610e4eaUL,
+    0xe3775852UL, 0x0dd8ed40UL, 0x68bf51f8UL, 0xa1f82bf0UL, 0xc49f9748UL,
+    0x2a30225aUL, 0x4f579ee2UL, 0xf66f497fUL, 0x9308f5c7UL, 0x7da740d5UL,
+    0x18c0fc6dUL, 0x4ed09f35UL, 0x2bb7238dUL, 0xc518969fUL, 0xa07f2a27UL,
+    0x1947fdbaUL, 0x7c204102UL, 0x928ff410UL, 0xf7e848a8UL, 0x3d58149bUL,
+    0x583fa823UL, 0xb6901d31UL, 0xd3f7a189UL, 0x6acf7614UL, 0x0fa8caacUL,
+    0xe1077fbeUL, 0x8460c306UL, 0xd270a05eUL, 0xb7171ce6UL, 0x59b8a9f4UL,
+    0x3cdf154cUL, 0x85e7c2d1UL, 0xe0807e69UL, 0x0e2fcb7bUL, 0x6b4877c3UL,
+    0xa20f0dcbUL, 0xc768b173UL, 0x29c70461UL, 0x4ca0b8d9UL, 0xf5986f44UL,
+    0x90ffd3fcUL, 0x7e5066eeUL, 0x1b37da56UL, 0x4d27b90eUL, 0x284005b6UL,
+    0xc6efb0a4UL, 0xa3880c1cUL, 0x1ab0db81UL, 0x7fd76739UL, 0x9178d22bUL,
+    0xf41f6e93UL, 0x03f7263bUL, 0x66909a83UL, 0x883f2f91UL, 0xed589329UL,
+    0x546044b4UL, 0x3107f80cUL, 0xdfa84d1eUL, 0xbacff1a6UL, 0xecdf92feUL,
+    0x89b82e46UL, 0x67179b54UL, 0x027027ecUL, 0xbb48f071UL, 0xde2f4cc9UL,
+    0x3080f9dbUL, 0x55e74563UL, 0x9ca03f6bUL, 0xf9c783d3UL, 0x176836c1UL,
+    0x720f8a79UL, 0xcb375de4UL, 0xae50e15cUL, 0x40ff544eUL, 0x2598e8f6UL,
+    0x73888baeUL, 0x16ef3716UL, 0xf8408204UL, 0x9d273ebcUL, 0x241fe921UL,
+    0x41785599UL, 0xafd7e08bUL, 0xcab05c33UL, 0x3bb659edUL, 0x5ed1e555UL,
+    0xb07e5047UL, 0xd519ecffUL, 0x6c213b62UL, 0x094687daUL, 0xe7e932c8UL,
+    0x828e8e70UL, 0xd49eed28UL, 0xb1f95190UL, 0x5f56e482UL, 0x3a31583aUL,
+    0x83098fa7UL, 0xe66e331fUL, 0x08c1860dUL, 0x6da63ab5UL, 0xa4e140bdUL,
+    0xc186fc05UL, 0x2f294917UL, 0x4a4ef5afUL, 0xf3762232UL, 0x96119e8aUL,
+    0x78be2b98UL, 0x1dd99720UL, 0x4bc9f478UL, 0x2eae48c0UL, 0xc001fdd2UL,
+    0xa566416aUL, 0x1c5e96f7UL, 0x79392a4fUL, 0x97969f5dUL, 0xf2f123e5UL,
+    0x05196b4dUL, 0x607ed7f5UL, 0x8ed162e7UL, 0xebb6de5fUL, 0x528e09c2UL,
+    0x37e9b57aUL, 0xd9460068UL, 0xbc21bcd0UL, 0xea31df88UL, 0x8f566330UL,
+    0x61f9d622UL, 0x049e6a9aUL, 0xbda6bd07UL, 0xd8c101bfUL, 0x366eb4adUL,
+    0x53090815UL, 0x9a4e721dUL, 0xff29cea5UL, 0x11867bb7UL, 0x74e1c70fUL,
+    0xcdd91092UL, 0xa8beac2aUL, 0x46111938UL, 0x2376a580UL, 0x7566c6d8UL,
+    0x10017a60UL, 0xfeaecf72UL, 0x9bc973caUL, 0x22f1a457UL, 0x479618efUL,
+    0xa939adfdUL, 0xcc5e1145UL, 0x06ee4d76UL, 0x6389f1ceUL, 0x8d2644dcUL,
+    0xe841f864UL, 0x51792ff9UL, 0x341e9341UL, 0xdab12653UL, 0xbfd69aebUL,
+    0xe9c6f9b3UL, 0x8ca1450bUL, 0x620ef019UL, 0x07694ca1UL, 0xbe519b3cUL,
+    0xdb362784UL, 0x35999296UL, 0x50fe2e2eUL, 0x99b95426UL, 0xfcdee89eUL,
+    0x12715d8cUL, 0x7716e134UL, 0xce2e36a9UL, 0xab498a11UL, 0x45e63f03UL,
+    0x208183bbUL, 0x7691e0e3UL, 0x13f65c5bUL, 0xfd59e949UL, 0x983e55f1UL,
+    0x2106826cUL, 0x44613ed4UL, 0xaace8bc6UL, 0xcfa9377eUL, 0x38417fd6UL,
+    0x5d26c36eUL, 0xb389767cUL, 0xd6eecac4UL, 0x6fd61d59UL, 0x0ab1a1e1UL,
+    0xe41e14f3UL, 0x8179a84bUL, 0xd769cb13UL, 0xb20e77abUL, 0x5ca1c2b9UL,
+    0x39c67e01UL, 0x80fea99cUL, 0xe5991524UL, 0x0b36a036UL, 0x6e511c8eUL,
+    0xa7166686UL, 0xc271da3eUL, 0x2cde6f2cUL, 0x49b9d394UL, 0xf0810409UL,
+    0x95e6b8b1UL, 0x7b490da3UL, 0x1e2eb11bUL, 0x483ed243UL, 0x2d596efbUL,
+    0xc3f6dbe9UL, 0xa6916751UL, 0x1fa9b0ccUL, 0x7ace0c74UL, 0x9461b966UL,
+    0xf10605deUL
+#endif
+  }
+};
diff --git a/deps/v8/third_party/zlib/crc32_simd.c b/deps/v8/third_party/zlib/crc32_simd.c
new file mode 100644
index 00000000000000..c8e5592f38ef1e
--- /dev/null
+++ b/deps/v8/third_party/zlib/crc32_simd.c
@@ -0,0 +1,243 @@
+/* crc32_simd.c
+ *
+ * Copyright 2017 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the Chromium source repository LICENSE file.
+ */
+
+#include "crc32_simd.h"
+
+#if defined(CRC32_SIMD_SSE42_PCLMUL)
+
+/*
+ * crc32_sse42_simd_(): compute the crc32 of the buffer, where the buffer
+ * length must be at least 64, and a multiple of 16. Based on:
+ *
+ * "Fast CRC Computation for Generic Polynomials Using PCLMULQDQ Instruction"
+ *  V. Gopal, E. Ozturk, et al., 2009, http://intel.ly/2ySEwL0
+ */
+
+#include <emmintrin.h>
+#include <smmintrin.h>
+#include <wmmintrin.h>
+
+uint32_t ZLIB_INTERNAL crc32_sse42_simd_(  /* SSE4.2+PCLMUL */
+    const unsigned char *buf,
+    z_size_t len,
+    uint32_t crc)
+{
+    /*
+     * Definitions of the bit-reflected domain constants k1,k2,k3, etc and
+     * the CRC32+Barrett polynomials given at the end of the paper.
+     */
+    static const uint64_t zalign(16) k1k2[] = { 0x0154442bd4, 0x01c6e41596 };
+    static const uint64_t zalign(16) k3k4[] = { 0x01751997d0, 0x00ccaa009e };
+    static const uint64_t zalign(16) k5k0[] = { 0x0163cd6124, 0x0000000000 };
+    static const uint64_t zalign(16) poly[] = { 0x01db710641, 0x01f7011641 };
+
+    __m128i x0, x1, x2, x3, x4, x5, x6, x7, x8, y5, y6, y7, y8;
+
+    /*
+     * There's at least one block of 64.
+     */
+    x1 = _mm_loadu_si128((__m128i *)(buf + 0x00));
+    x2 = _mm_loadu_si128((__m128i *)(buf + 0x10));
+    x3 = _mm_loadu_si128((__m128i *)(buf + 0x20));
+    x4 = _mm_loadu_si128((__m128i *)(buf + 0x30));
+
+    x1 = _mm_xor_si128(x1, _mm_cvtsi32_si128(crc));
+
+    x0 = _mm_load_si128((__m128i *)k1k2);
+
+    buf += 64;
+    len -= 64;
+
+    /*
+     * Parallel fold blocks of 64, if any.
+     */
+    while (len >= 64)
+    {
+        x5 = _mm_clmulepi64_si128(x1, x0, 0x00);
+        x6 = _mm_clmulepi64_si128(x2, x0, 0x00);
+        x7 = _mm_clmulepi64_si128(x3, x0, 0x00);
+        x8 = _mm_clmulepi64_si128(x4, x0, 0x00);
+
+        x1 = _mm_clmulepi64_si128(x1, x0, 0x11);
+        x2 = _mm_clmulepi64_si128(x2, x0, 0x11);
+        x3 = _mm_clmulepi64_si128(x3, x0, 0x11);
+        x4 = _mm_clmulepi64_si128(x4, x0, 0x11);
+
+        y5 = _mm_loadu_si128((__m128i *)(buf + 0x00));
+        y6 = _mm_loadu_si128((__m128i *)(buf + 0x10));
+        y7 = _mm_loadu_si128((__m128i *)(buf + 0x20));
+        y8 = _mm_loadu_si128((__m128i *)(buf + 0x30));
+
+        x1 = _mm_xor_si128(x1, x5);
+        x2 = _mm_xor_si128(x2, x6);
+        x3 = _mm_xor_si128(x3, x7);
+        x4 = _mm_xor_si128(x4, x8);
+
+        x1 = _mm_xor_si128(x1, y5);
+        x2 = _mm_xor_si128(x2, y6);
+        x3 = _mm_xor_si128(x3, y7);
+        x4 = _mm_xor_si128(x4, y8);
+
+        buf += 64;
+        len -= 64;
+    }
+
+    /*
+     * Fold into 128-bits.
+     */
+    x0 = _mm_load_si128((__m128i *)k3k4);
+
+    x5 = _mm_clmulepi64_si128(x1, x0, 0x00);
+    x1 = _mm_clmulepi64_si128(x1, x0, 0x11);
+    x1 = _mm_xor_si128(x1, x2);
+    x1 = _mm_xor_si128(x1, x5);
+
+    x5 = _mm_clmulepi64_si128(x1, x0, 0x00);
+    x1 = _mm_clmulepi64_si128(x1, x0, 0x11);
+    x1 = _mm_xor_si128(x1, x3);
+    x1 = _mm_xor_si128(x1, x5);
+
+    x5 = _mm_clmulepi64_si128(x1, x0, 0x00);
+    x1 = _mm_clmulepi64_si128(x1, x0, 0x11);
+    x1 = _mm_xor_si128(x1, x4);
+    x1 = _mm_xor_si128(x1, x5);
+
+    /*
+     * Single fold blocks of 16, if any.
+     */
+    while (len >= 16)
+    {
+        x2 = _mm_loadu_si128((__m128i *)buf);
+
+        x5 = _mm_clmulepi64_si128(x1, x0, 0x00);
+        x1 = _mm_clmulepi64_si128(x1, x0, 0x11);
+        x1 = _mm_xor_si128(x1, x2);
+        x1 = _mm_xor_si128(x1, x5);
+
+        buf += 16;
+        len -= 16;
+    }
+
+    /*
+     * Fold 128-bits to 64-bits.
+     */
+    x2 = _mm_clmulepi64_si128(x1, x0, 0x10);
+    x3 = _mm_setr_epi32(~0, 0, ~0, 0);
+    x1 = _mm_srli_si128(x1, 8);
+    x1 = _mm_xor_si128(x1, x2);
+
+    x0 = _mm_loadl_epi64((__m128i*)k5k0);
+
+    x2 = _mm_srli_si128(x1, 4);
+    x1 = _mm_and_si128(x1, x3);
+    x1 = _mm_clmulepi64_si128(x1, x0, 0x00);
+    x1 = _mm_xor_si128(x1, x2);
+
+    /*
+     * Barret reduce to 32-bits.
+     */
+    x0 = _mm_load_si128((__m128i*)poly);
+
+    x2 = _mm_and_si128(x1, x3);
+    x2 = _mm_clmulepi64_si128(x2, x0, 0x10);
+    x2 = _mm_and_si128(x2, x3);
+    x2 = _mm_clmulepi64_si128(x2, x0, 0x00);
+    x1 = _mm_xor_si128(x1, x2);
+
+    /*
+     * Return the crc32.
+     */
+    return _mm_extract_epi32(x1, 1);
+}
+
+#elif defined(CRC32_ARMV8_CRC32)
+
+/* CRC32 checksums using ARMv8-a crypto instructions.
+ *
+ * TODO: implement a version using the PMULL instruction.
+ */
+
+#if defined(__clang__)
+/* CRC32 intrinsics are #ifdef'ed out of arm_acle.h unless we build with an
+ * armv8 target, which is incompatible with ThinLTO optimizations on Android.
+ * (Namely, mixing and matching different module-level targets makes ThinLTO
+ * warn, and Android defaults to armv7-a. This restriction does not apply to
+ * function-level `target`s, however.)
+ *
+ * Since we only need four crc intrinsics, and since clang's implementation of
+ * those are just wrappers around compiler builtins, it's simplest to #define
+ * those builtins directly. If this #define list grows too much (or we depend on
+ * an intrinsic that isn't a trivial wrapper), we may have to find a better way
+ * to go about this.
+ *
+ * NOTE: clang currently complains that "'+soft-float-abi' is not a recognized
+ * feature for this target (ignoring feature)." This appears to be a harmless
+ * bug in clang.
+ */
+#define __crc32b __builtin_arm_crc32b
+#define __crc32d __builtin_arm_crc32d
+#define __crc32w __builtin_arm_crc32w
+#define __crc32cw __builtin_arm_crc32cw
+
+#if defined(__aarch64__)
+#define TARGET_ARMV8_WITH_CRC __attribute__((target("crc")))
+#else  // !defined(__aarch64__)
+#define TARGET_ARMV8_WITH_CRC __attribute__((target("armv8-a,crc")))
+#endif  // defined(__aarch64__)
+
+#elif defined(__GNUC__)
+/* For GCC, we are setting CRC extensions at module level, so ThinLTO is not
+ * allowed. We can just include arm_acle.h.
+ */
+#include <arm_acle.h>
+#define TARGET_ARMV8_WITH_CRC
+#else  // !defined(__GNUC__) && !defined(_aarch64__)
+#error ARM CRC32 SIMD extensions only supported for Clang and GCC
+#endif
+
+TARGET_ARMV8_WITH_CRC
+uint32_t ZLIB_INTERNAL armv8_crc32_little(unsigned long crc,
+                                          const unsigned char *buf,
+                                          z_size_t len)
+{
+    uint32_t c = (uint32_t) ~crc;
+
+    while (len && ((uintptr_t)buf & 7)) {
+        c = __crc32b(c, *buf++);
+        --len;
+    }
+
+    const uint64_t *buf8 = (const uint64_t *)buf;
+
+    while (len >= 64) {
+        c = __crc32d(c, *buf8++);
+        c = __crc32d(c, *buf8++);
+        c = __crc32d(c, *buf8++);
+        c = __crc32d(c, *buf8++);
+
+        c = __crc32d(c, *buf8++);
+        c = __crc32d(c, *buf8++);
+        c = __crc32d(c, *buf8++);
+        c = __crc32d(c, *buf8++);
+        len -= 64;
+    }
+
+    while (len >= 8) {
+        c = __crc32d(c, *buf8++);
+        len -= 8;
+    }
+
+    buf = (const unsigned char *)buf8;
+
+    while (len--) {
+        c = __crc32b(c, *buf++);
+    }
+
+    return ~c;
+}
+
+#endif
diff --git a/deps/v8/third_party/zlib/crc32_simd.h b/deps/v8/third_party/zlib/crc32_simd.h
new file mode 100644
index 00000000000000..315c2a45f41320
--- /dev/null
+++ b/deps/v8/third_party/zlib/crc32_simd.h
@@ -0,0 +1,35 @@
+/* crc32_simd.h
+ *
+ * Copyright 2017 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the Chromium source repository LICENSE file.
+ */
+
+#include <stdint.h>
+
+#include "zconf.h"
+#include "zutil.h"
+#include "deflate.h"
+
+/*
+ * crc32_sse42_simd_(): compute the crc32 of the buffer, where the buffer
+ * length must be at least 64, and a multiple of 16.
+ */
+uint32_t ZLIB_INTERNAL crc32_sse42_simd_(
+    const unsigned char *buf,
+    z_size_t len,
+    uint32_t crc);
+
+/*
+ * crc32_sse42_simd_ buffer size constraints: see the use in zlib/crc32.c
+ * for computing the crc32 of an arbitrary length buffer.
+ */
+#define Z_CRC32_SSE42_MINIMUM_LENGTH 64
+#define Z_CRC32_SSE42_CHUNKSIZE_MASK 15
+
+/*
+ * CRC32 checksums using ARMv8-a crypto instructions.
+ */
+uint32_t ZLIB_INTERNAL armv8_crc32_little(unsigned long crc,
+                                          const unsigned char* buf,
+                                          z_size_t len);
diff --git a/deps/v8/third_party/zlib/crc_folding.c b/deps/v8/third_party/zlib/crc_folding.c
new file mode 100644
index 00000000000000..48d77744aaf47d
--- /dev/null
+++ b/deps/v8/third_party/zlib/crc_folding.c
@@ -0,0 +1,493 @@
+/*
+ * Compute the CRC32 using a parallelized folding approach with the PCLMULQDQ
+ * instruction.
+ *
+ * A white paper describing this algorithm can be found at:
+ * http://www.intel.com/content/dam/www/public/us/en/documents/white-papers/fast-crc-computation-generic-polynomials-pclmulqdq-paper.pdf
+ *
+ * Copyright (C) 2013 Intel Corporation. All rights reserved.
+ * Authors:
+ * 	Wajdi Feghali   <wajdi.k.feghali@intel.com>
+ * 	Jim Guilford    <james.guilford@intel.com>
+ * 	Vinodh Gopal    <vinodh.gopal@intel.com>
+ * 	Erdinc Ozturk   <erdinc.ozturk@intel.com>
+ * 	Jim Kukunas     <james.t.kukunas@linux.intel.com>
+ *
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+#include "deflate.h"
+
+#include <inttypes.h>
+#include <emmintrin.h>
+#include <immintrin.h>
+#include <wmmintrin.h>
+
+#define CRC_LOAD(s) \
+    do { \
+        __m128i xmm_crc0 = _mm_loadu_si128((__m128i *)s->crc0 + 0);\
+        __m128i xmm_crc1 = _mm_loadu_si128((__m128i *)s->crc0 + 1);\
+        __m128i xmm_crc2 = _mm_loadu_si128((__m128i *)s->crc0 + 2);\
+        __m128i xmm_crc3 = _mm_loadu_si128((__m128i *)s->crc0 + 3);\
+        __m128i xmm_crc_part = _mm_loadu_si128((__m128i *)s->crc0 + 4);
+
+#define CRC_SAVE(s) \
+        _mm_storeu_si128((__m128i *)s->crc0 + 0, xmm_crc0);\
+        _mm_storeu_si128((__m128i *)s->crc0 + 1, xmm_crc1);\
+        _mm_storeu_si128((__m128i *)s->crc0 + 2, xmm_crc2);\
+        _mm_storeu_si128((__m128i *)s->crc0 + 3, xmm_crc3);\
+        _mm_storeu_si128((__m128i *)s->crc0 + 4, xmm_crc_part);\
+    } while (0);
+
+ZLIB_INTERNAL void crc_fold_init(deflate_state *const s)
+{
+    CRC_LOAD(s)
+
+    xmm_crc0 = _mm_cvtsi32_si128(0x9db42487);
+    xmm_crc1 = _mm_setzero_si128();
+    xmm_crc2 = _mm_setzero_si128();
+    xmm_crc3 = _mm_setzero_si128();
+
+    CRC_SAVE(s)
+
+    s->strm->adler = 0;
+}
+
+local void fold_1(deflate_state *const s,
+        __m128i *xmm_crc0, __m128i *xmm_crc1,
+        __m128i *xmm_crc2, __m128i *xmm_crc3)
+{
+    const __m128i xmm_fold4 = _mm_set_epi32(
+            0x00000001, 0x54442bd4,
+            0x00000001, 0xc6e41596);
+
+    __m128i x_tmp3;
+    __m128 ps_crc0, ps_crc3, ps_res;
+
+    x_tmp3 = *xmm_crc3;
+
+    *xmm_crc3 = *xmm_crc0;
+    *xmm_crc0 = _mm_clmulepi64_si128(*xmm_crc0, xmm_fold4, 0x01);
+    *xmm_crc3 = _mm_clmulepi64_si128(*xmm_crc3, xmm_fold4, 0x10);
+    ps_crc0 = _mm_castsi128_ps(*xmm_crc0);
+    ps_crc3 = _mm_castsi128_ps(*xmm_crc3);
+    ps_res = _mm_xor_ps(ps_crc0, ps_crc3);
+
+    *xmm_crc0 = *xmm_crc1;
+    *xmm_crc1 = *xmm_crc2;
+    *xmm_crc2 = x_tmp3;
+    *xmm_crc3 = _mm_castps_si128(ps_res);
+}
+
+local void fold_2(deflate_state *const s,
+        __m128i *xmm_crc0, __m128i *xmm_crc1,
+        __m128i *xmm_crc2, __m128i *xmm_crc3)
+{
+    const __m128i xmm_fold4 = _mm_set_epi32(
+            0x00000001, 0x54442bd4,
+            0x00000001, 0xc6e41596);
+
+    __m128i x_tmp3, x_tmp2;
+    __m128 ps_crc0, ps_crc1, ps_crc2, ps_crc3, ps_res31, ps_res20;
+
+    x_tmp3 = *xmm_crc3;
+    x_tmp2 = *xmm_crc2;
+
+    *xmm_crc3 = *xmm_crc1;
+    *xmm_crc1 = _mm_clmulepi64_si128(*xmm_crc1, xmm_fold4, 0x01);
+    *xmm_crc3 = _mm_clmulepi64_si128(*xmm_crc3, xmm_fold4, 0x10);
+    ps_crc3 = _mm_castsi128_ps(*xmm_crc3);
+    ps_crc1 = _mm_castsi128_ps(*xmm_crc1);
+    ps_res31= _mm_xor_ps(ps_crc3, ps_crc1);
+
+    *xmm_crc2 = *xmm_crc0;
+    *xmm_crc0 = _mm_clmulepi64_si128(*xmm_crc0, xmm_fold4, 0x01);
+    *xmm_crc2 = _mm_clmulepi64_si128(*xmm_crc2, xmm_fold4, 0x10);
+    ps_crc0 = _mm_castsi128_ps(*xmm_crc0);
+    ps_crc2 = _mm_castsi128_ps(*xmm_crc2);
+    ps_res20= _mm_xor_ps(ps_crc0, ps_crc2);
+
+    *xmm_crc0 = x_tmp2;
+    *xmm_crc1 = x_tmp3;
+    *xmm_crc2 = _mm_castps_si128(ps_res20);
+    *xmm_crc3 = _mm_castps_si128(ps_res31);
+}
+
+local void fold_3(deflate_state *const s,
+        __m128i *xmm_crc0, __m128i *xmm_crc1,
+        __m128i *xmm_crc2, __m128i *xmm_crc3)
+{
+    const __m128i xmm_fold4 = _mm_set_epi32(
+            0x00000001, 0x54442bd4,
+            0x00000001, 0xc6e41596);
+
+    __m128i x_tmp3;
+    __m128 ps_crc0, ps_crc1, ps_crc2, ps_crc3, ps_res32, ps_res21, ps_res10;
+
+    x_tmp3 = *xmm_crc3;
+
+    *xmm_crc3 = *xmm_crc2;
+    *xmm_crc2 = _mm_clmulepi64_si128(*xmm_crc2, xmm_fold4, 0x01);
+    *xmm_crc3 = _mm_clmulepi64_si128(*xmm_crc3, xmm_fold4, 0x10);
+    ps_crc2 = _mm_castsi128_ps(*xmm_crc2);
+    ps_crc3 = _mm_castsi128_ps(*xmm_crc3);
+    ps_res32 = _mm_xor_ps(ps_crc2, ps_crc3);
+
+    *xmm_crc2 = *xmm_crc1;
+    *xmm_crc1 = _mm_clmulepi64_si128(*xmm_crc1, xmm_fold4, 0x01);
+    *xmm_crc2 = _mm_clmulepi64_si128(*xmm_crc2, xmm_fold4, 0x10);
+    ps_crc1 = _mm_castsi128_ps(*xmm_crc1);
+    ps_crc2 = _mm_castsi128_ps(*xmm_crc2);
+    ps_res21= _mm_xor_ps(ps_crc1, ps_crc2);
+
+    *xmm_crc1 = *xmm_crc0;
+    *xmm_crc0 = _mm_clmulepi64_si128(*xmm_crc0, xmm_fold4, 0x01);
+    *xmm_crc1 = _mm_clmulepi64_si128(*xmm_crc1, xmm_fold4, 0x10);
+    ps_crc0 = _mm_castsi128_ps(*xmm_crc0);
+    ps_crc1 = _mm_castsi128_ps(*xmm_crc1);
+    ps_res10= _mm_xor_ps(ps_crc0, ps_crc1);
+
+    *xmm_crc0 = x_tmp3;
+    *xmm_crc1 = _mm_castps_si128(ps_res10);
+    *xmm_crc2 = _mm_castps_si128(ps_res21);
+    *xmm_crc3 = _mm_castps_si128(ps_res32);
+}
+
+local void fold_4(deflate_state *const s,
+        __m128i *xmm_crc0, __m128i *xmm_crc1,
+        __m128i *xmm_crc2, __m128i *xmm_crc3)
+{
+    const __m128i xmm_fold4 = _mm_set_epi32(
+            0x00000001, 0x54442bd4,
+            0x00000001, 0xc6e41596);
+
+    __m128i x_tmp0, x_tmp1, x_tmp2, x_tmp3;
+    __m128 ps_crc0, ps_crc1, ps_crc2, ps_crc3;
+    __m128 ps_t0, ps_t1, ps_t2, ps_t3;
+    __m128 ps_res0, ps_res1, ps_res2, ps_res3;
+
+    x_tmp0 = *xmm_crc0;
+    x_tmp1 = *xmm_crc1;
+    x_tmp2 = *xmm_crc2;
+    x_tmp3 = *xmm_crc3;
+
+    *xmm_crc0 = _mm_clmulepi64_si128(*xmm_crc0, xmm_fold4, 0x01);
+    x_tmp0 = _mm_clmulepi64_si128(x_tmp0, xmm_fold4, 0x10);
+    ps_crc0 = _mm_castsi128_ps(*xmm_crc0);
+    ps_t0 = _mm_castsi128_ps(x_tmp0);
+    ps_res0 = _mm_xor_ps(ps_crc0, ps_t0);
+
+    *xmm_crc1 = _mm_clmulepi64_si128(*xmm_crc1, xmm_fold4, 0x01);
+    x_tmp1 = _mm_clmulepi64_si128(x_tmp1, xmm_fold4, 0x10);
+    ps_crc1 = _mm_castsi128_ps(*xmm_crc1);
+    ps_t1 = _mm_castsi128_ps(x_tmp1);
+    ps_res1 = _mm_xor_ps(ps_crc1, ps_t1);
+
+    *xmm_crc2 = _mm_clmulepi64_si128(*xmm_crc2, xmm_fold4, 0x01);
+    x_tmp2 = _mm_clmulepi64_si128(x_tmp2, xmm_fold4, 0x10);
+    ps_crc2 = _mm_castsi128_ps(*xmm_crc2);
+    ps_t2 = _mm_castsi128_ps(x_tmp2);
+    ps_res2 = _mm_xor_ps(ps_crc2, ps_t2);
+
+    *xmm_crc3 = _mm_clmulepi64_si128(*xmm_crc3, xmm_fold4, 0x01);
+    x_tmp3 = _mm_clmulepi64_si128(x_tmp3, xmm_fold4, 0x10);
+    ps_crc3 = _mm_castsi128_ps(*xmm_crc3);
+    ps_t3 = _mm_castsi128_ps(x_tmp3);
+    ps_res3 = _mm_xor_ps(ps_crc3, ps_t3);
+
+    *xmm_crc0 = _mm_castps_si128(ps_res0);
+    *xmm_crc1 = _mm_castps_si128(ps_res1);
+    *xmm_crc2 = _mm_castps_si128(ps_res2);
+    *xmm_crc3 = _mm_castps_si128(ps_res3);
+}
+
+local const unsigned zalign(32) pshufb_shf_table[60] = {
+	0x84838281,0x88878685,0x8c8b8a89,0x008f8e8d, /* shl 15 (16 - 1)/shr1 */
+	0x85848382,0x89888786,0x8d8c8b8a,0x01008f8e, /* shl 14 (16 - 3)/shr2 */
+	0x86858483,0x8a898887,0x8e8d8c8b,0x0201008f, /* shl 13 (16 - 4)/shr3 */
+	0x87868584,0x8b8a8988,0x8f8e8d8c,0x03020100, /* shl 12 (16 - 4)/shr4 */
+	0x88878685,0x8c8b8a89,0x008f8e8d,0x04030201, /* shl 11 (16 - 5)/shr5 */
+	0x89888786,0x8d8c8b8a,0x01008f8e,0x05040302, /* shl 10 (16 - 6)/shr6 */
+	0x8a898887,0x8e8d8c8b,0x0201008f,0x06050403, /* shl  9 (16 - 7)/shr7 */
+	0x8b8a8988,0x8f8e8d8c,0x03020100,0x07060504, /* shl  8 (16 - 8)/shr8 */
+	0x8c8b8a89,0x008f8e8d,0x04030201,0x08070605, /* shl  7 (16 - 9)/shr9 */
+	0x8d8c8b8a,0x01008f8e,0x05040302,0x09080706, /* shl  6 (16 -10)/shr10*/
+	0x8e8d8c8b,0x0201008f,0x06050403,0x0a090807, /* shl  5 (16 -11)/shr11*/
+	0x8f8e8d8c,0x03020100,0x07060504,0x0b0a0908, /* shl  4 (16 -12)/shr12*/
+	0x008f8e8d,0x04030201,0x08070605,0x0c0b0a09, /* shl  3 (16 -13)/shr13*/
+	0x01008f8e,0x05040302,0x09080706,0x0d0c0b0a, /* shl  2 (16 -14)/shr14*/
+	0x0201008f,0x06050403,0x0a090807,0x0e0d0c0b  /* shl  1 (16 -15)/shr15*/
+};
+
+local void partial_fold(deflate_state *const s, const size_t len,
+        __m128i *xmm_crc0, __m128i *xmm_crc1,
+        __m128i *xmm_crc2, __m128i *xmm_crc3,
+        __m128i *xmm_crc_part)
+{
+
+    const __m128i xmm_fold4 = _mm_set_epi32(
+            0x00000001, 0x54442bd4,
+            0x00000001, 0xc6e41596);
+    const __m128i xmm_mask3 = _mm_set1_epi32(0x80808080);
+
+    __m128i xmm_shl, xmm_shr, xmm_tmp1, xmm_tmp2, xmm_tmp3;
+    __m128i xmm_a0_0, xmm_a0_1;
+    __m128 ps_crc3, psa0_0, psa0_1, ps_res;
+
+    xmm_shl = _mm_load_si128((__m128i *)pshufb_shf_table + (len - 1));
+    xmm_shr = xmm_shl;
+    xmm_shr = _mm_xor_si128(xmm_shr, xmm_mask3);
+
+    xmm_a0_0 = _mm_shuffle_epi8(*xmm_crc0, xmm_shl);
+
+    *xmm_crc0 = _mm_shuffle_epi8(*xmm_crc0, xmm_shr);
+    xmm_tmp1 = _mm_shuffle_epi8(*xmm_crc1, xmm_shl);
+    *xmm_crc0 = _mm_or_si128(*xmm_crc0, xmm_tmp1);
+
+    *xmm_crc1 = _mm_shuffle_epi8(*xmm_crc1, xmm_shr);
+    xmm_tmp2 = _mm_shuffle_epi8(*xmm_crc2, xmm_shl);
+    *xmm_crc1 = _mm_or_si128(*xmm_crc1, xmm_tmp2);
+
+    *xmm_crc2 = _mm_shuffle_epi8(*xmm_crc2, xmm_shr);
+    xmm_tmp3 = _mm_shuffle_epi8(*xmm_crc3, xmm_shl);
+    *xmm_crc2 = _mm_or_si128(*xmm_crc2, xmm_tmp3);
+
+    *xmm_crc3 = _mm_shuffle_epi8(*xmm_crc3, xmm_shr);
+    *xmm_crc_part = _mm_shuffle_epi8(*xmm_crc_part, xmm_shl);
+    *xmm_crc3 = _mm_or_si128(*xmm_crc3, *xmm_crc_part);
+
+    xmm_a0_1 = _mm_clmulepi64_si128(xmm_a0_0, xmm_fold4, 0x10);
+    xmm_a0_0 = _mm_clmulepi64_si128(xmm_a0_0, xmm_fold4, 0x01);
+
+    ps_crc3 = _mm_castsi128_ps(*xmm_crc3);
+    psa0_0 = _mm_castsi128_ps(xmm_a0_0);
+    psa0_1 = _mm_castsi128_ps(xmm_a0_1);
+
+    ps_res = _mm_xor_ps(ps_crc3, psa0_0);
+    ps_res = _mm_xor_ps(ps_res, psa0_1);
+
+    *xmm_crc3 = _mm_castps_si128(ps_res);
+}
+
+ZLIB_INTERNAL void crc_fold_copy(deflate_state *const s,
+        unsigned char *dst, const unsigned char *src, long len)
+{
+    unsigned long algn_diff;
+    __m128i xmm_t0, xmm_t1, xmm_t2, xmm_t3;
+
+    CRC_LOAD(s)
+
+    if (len < 16) {
+        if (len == 0)
+            return;
+        goto partial;
+    }
+
+    algn_diff = 0 - (uintptr_t)src & 0xF;
+    if (algn_diff) {
+        xmm_crc_part = _mm_loadu_si128((__m128i *)src);
+        _mm_storeu_si128((__m128i *)dst, xmm_crc_part);
+
+        dst += algn_diff;
+        src += algn_diff;
+        len -= algn_diff;
+
+        partial_fold(s, algn_diff, &xmm_crc0, &xmm_crc1, &xmm_crc2, &xmm_crc3,
+            &xmm_crc_part);
+    }
+
+    while ((len -= 64) >= 0) {
+        xmm_t0 = _mm_load_si128((__m128i *)src);
+        xmm_t1 = _mm_load_si128((__m128i *)src + 1);
+        xmm_t2 = _mm_load_si128((__m128i *)src + 2);
+        xmm_t3 = _mm_load_si128((__m128i *)src + 3);
+
+        fold_4(s, &xmm_crc0, &xmm_crc1, &xmm_crc2, &xmm_crc3);
+
+        _mm_storeu_si128((__m128i *)dst, xmm_t0);
+        _mm_storeu_si128((__m128i *)dst + 1, xmm_t1);
+        _mm_storeu_si128((__m128i *)dst + 2, xmm_t2);
+        _mm_storeu_si128((__m128i *)dst + 3, xmm_t3);
+
+        xmm_crc0 = _mm_xor_si128(xmm_crc0, xmm_t0);
+        xmm_crc1 = _mm_xor_si128(xmm_crc1, xmm_t1);
+        xmm_crc2 = _mm_xor_si128(xmm_crc2, xmm_t2);
+        xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_t3);
+
+        src += 64;
+        dst += 64;
+    }
+
+    /*
+     * len = num bytes left - 64
+     */
+    if (len + 16 >= 0) {
+        len += 16;
+
+        xmm_t0 = _mm_load_si128((__m128i *)src);
+        xmm_t1 = _mm_load_si128((__m128i *)src + 1);
+        xmm_t2 = _mm_load_si128((__m128i *)src + 2);
+
+        fold_3(s, &xmm_crc0, &xmm_crc1, &xmm_crc2, &xmm_crc3);
+
+        _mm_storeu_si128((__m128i *)dst, xmm_t0);
+        _mm_storeu_si128((__m128i *)dst + 1, xmm_t1);
+        _mm_storeu_si128((__m128i *)dst + 2, xmm_t2);
+
+        xmm_crc1 = _mm_xor_si128(xmm_crc1, xmm_t0);
+        xmm_crc2 = _mm_xor_si128(xmm_crc2, xmm_t1);
+        xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_t2);
+
+        if (len == 0)
+            goto done;
+
+        dst += 48;
+        src += 48;
+    } else if (len + 32 >= 0) {
+        len += 32;
+
+        xmm_t0 = _mm_load_si128((__m128i *)src);
+        xmm_t1 = _mm_load_si128((__m128i *)src + 1);
+
+        fold_2(s, &xmm_crc0, &xmm_crc1, &xmm_crc2, &xmm_crc3);
+
+        _mm_storeu_si128((__m128i *)dst, xmm_t0);
+        _mm_storeu_si128((__m128i *)dst + 1, xmm_t1);
+
+        xmm_crc2 = _mm_xor_si128(xmm_crc2, xmm_t0);
+        xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_t1);
+
+        if (len == 0)
+            goto done;
+
+        dst += 32;
+        src += 32;
+    } else if (len + 48 >= 0) {
+        len += 48;
+
+        xmm_t0 = _mm_load_si128((__m128i *)src);
+
+        fold_1(s, &xmm_crc0, &xmm_crc1, &xmm_crc2, &xmm_crc3);
+
+        _mm_storeu_si128((__m128i *)dst, xmm_t0);
+
+        xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_t0);
+
+        if (len == 0)
+            goto done;
+
+        dst += 16;
+        src += 16;
+    } else {
+        len += 64;
+        if (len == 0)
+            goto done;
+    }
+
+partial:
+
+#if defined(_MSC_VER)
+    /* VS does not permit the use of _mm_set_epi64x in 32-bit builds */
+    {
+        int32_t parts[4] = {0, 0, 0, 0};
+        memcpy(&parts, src, len);
+        xmm_crc_part = _mm_set_epi32(parts[3], parts[2], parts[1], parts[0]);
+    }
+#else
+    {
+        int64_t parts[2] = {0, 0};
+        memcpy(&parts, src, len);
+        xmm_crc_part = _mm_set_epi64x(parts[1], parts[0]);
+    }
+#endif
+
+    _mm_storeu_si128((__m128i *)dst, xmm_crc_part);
+    partial_fold(s, len, &xmm_crc0, &xmm_crc1, &xmm_crc2, &xmm_crc3,
+        &xmm_crc_part);
+done:
+    CRC_SAVE(s)
+}
+
+local const unsigned zalign(16) crc_k[] = {
+    0xccaa009e, 0x00000000, /* rk1 */
+    0x751997d0, 0x00000001, /* rk2 */
+    0xccaa009e, 0x00000000, /* rk5 */
+    0x63cd6124, 0x00000001, /* rk6 */
+    0xf7011640, 0x00000001, /* rk7 */
+    0xdb710640, 0x00000001  /* rk8 */
+};
+
+local const unsigned zalign(16) crc_mask[4] = {
+    0xFFFFFFFF, 0xFFFFFFFF, 0x00000000, 0x00000000
+};
+
+local const unsigned zalign(16) crc_mask2[4] = {
+    0x00000000, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF
+};
+
+unsigned ZLIB_INTERNAL crc_fold_512to32(deflate_state *const s)
+{
+    const __m128i xmm_mask  = _mm_load_si128((__m128i *)crc_mask);
+    const __m128i xmm_mask2 = _mm_load_si128((__m128i *)crc_mask2);
+
+    unsigned crc;
+    __m128i x_tmp0, x_tmp1, x_tmp2, crc_fold;
+
+    CRC_LOAD(s)
+
+    /*
+     * k1
+     */
+    crc_fold = _mm_load_si128((__m128i *)crc_k);
+
+    x_tmp0 = _mm_clmulepi64_si128(xmm_crc0, crc_fold, 0x10);
+    xmm_crc0 = _mm_clmulepi64_si128(xmm_crc0, crc_fold, 0x01);
+    xmm_crc1 = _mm_xor_si128(xmm_crc1, x_tmp0);
+    xmm_crc1 = _mm_xor_si128(xmm_crc1, xmm_crc0);
+
+    x_tmp1 = _mm_clmulepi64_si128(xmm_crc1, crc_fold, 0x10);
+    xmm_crc1 = _mm_clmulepi64_si128(xmm_crc1, crc_fold, 0x01);
+    xmm_crc2 = _mm_xor_si128(xmm_crc2, x_tmp1);
+    xmm_crc2 = _mm_xor_si128(xmm_crc2, xmm_crc1);
+
+    x_tmp2 = _mm_clmulepi64_si128(xmm_crc2, crc_fold, 0x10);
+    xmm_crc2 = _mm_clmulepi64_si128(xmm_crc2, crc_fold, 0x01);
+    xmm_crc3 = _mm_xor_si128(xmm_crc3, x_tmp2);
+    xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_crc2);
+
+    /*
+     * k5
+     */
+    crc_fold = _mm_load_si128((__m128i *)crc_k + 1);
+
+    xmm_crc0 = xmm_crc3;
+    xmm_crc3 = _mm_clmulepi64_si128(xmm_crc3, crc_fold, 0);
+    xmm_crc0 = _mm_srli_si128(xmm_crc0, 8);
+    xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_crc0);
+
+    xmm_crc0 = xmm_crc3;
+    xmm_crc3 = _mm_slli_si128(xmm_crc3, 4);
+    xmm_crc3 = _mm_clmulepi64_si128(xmm_crc3, crc_fold, 0x10);
+    xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_crc0);
+    xmm_crc3 = _mm_and_si128(xmm_crc3, xmm_mask2);
+
+    /*
+     * k7
+     */
+    xmm_crc1 = xmm_crc3;
+    xmm_crc2 = xmm_crc3;
+    crc_fold = _mm_load_si128((__m128i *)crc_k + 2);
+
+    xmm_crc3 = _mm_clmulepi64_si128(xmm_crc3, crc_fold, 0);
+    xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_crc2);
+    xmm_crc3 = _mm_and_si128(xmm_crc3, xmm_mask);
+
+    xmm_crc2 = xmm_crc3;
+    xmm_crc3 = _mm_clmulepi64_si128(xmm_crc3, crc_fold, 0x10);
+    xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_crc2);
+    xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_crc1);
+
+    crc = _mm_extract_epi32(xmm_crc3, 2);
+    return ~crc;
+    CRC_SAVE(s)
+}
diff --git a/deps/v8/third_party/zlib/deflate.c b/deps/v8/third_party/zlib/deflate.c
new file mode 100644
index 00000000000000..a20c42af7a37bb
--- /dev/null
+++ b/deps/v8/third_party/zlib/deflate.c
@@ -0,0 +1,2214 @@
+/* deflate.c -- compress data using the deflation algorithm
+ * Copyright (C) 1995-2017 Jean-loup Gailly and Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/*
+ *  ALGORITHM
+ *
+ *      The "deflation" process depends on being able to identify portions
+ *      of the input text which are identical to earlier input (within a
+ *      sliding window trailing behind the input currently being processed).
+ *
+ *      The most straightforward technique turns out to be the fastest for
+ *      most input files: try all possible matches and select the longest.
+ *      The key feature of this algorithm is that insertions into the string
+ *      dictionary are very simple and thus fast, and deletions are avoided
+ *      completely. Insertions are performed at each input character, whereas
+ *      string matches are performed only when the previous match ends. So it
+ *      is preferable to spend more time in matches to allow very fast string
+ *      insertions and avoid deletions. The matching algorithm for small
+ *      strings is inspired from that of Rabin & Karp. A brute force approach
+ *      is used to find longer strings when a small match has been found.
+ *      A similar algorithm is used in comic (by Jan-Mark Wams) and freeze
+ *      (by Leonid Broukhis).
+ *         A previous version of this file used a more sophisticated algorithm
+ *      (by Fiala and Greene) which is guaranteed to run in linear amortized
+ *      time, but has a larger average cost, uses more memory and is patented.
+ *      However the F&G algorithm may be faster for some highly redundant
+ *      files if the parameter max_chain_length (described below) is too large.
+ *
+ *  ACKNOWLEDGEMENTS
+ *
+ *      The idea of lazy evaluation of matches is due to Jan-Mark Wams, and
+ *      I found it in 'freeze' written by Leonid Broukhis.
+ *      Thanks to many people for bug reports and testing.
+ *
+ *  REFERENCES
+ *
+ *      Deutsch, L.P.,"DEFLATE Compressed Data Format Specification".
+ *      Available in http://tools.ietf.org/html/rfc1951
+ *
+ *      A description of the Rabin and Karp algorithm is given in the book
+ *         "Algorithms" by R. Sedgewick, Addison-Wesley, p252.
+ *
+ *      Fiala,E.R., and Greene,D.H.
+ *         Data Compression with Finite Windows, Comm.ACM, 32,4 (1989) 490-595
+ *
+ */
+
+/* @(#) $Id$ */
+#include <assert.h>
+#include "deflate.h"
+#include "cpu_features.h"
+#include "contrib/optimizations/insert_string.h"
+
+#if (defined(__ARM_NEON__) || defined(__ARM_NEON))
+#include "contrib/optimizations/slide_hash_neon.h"
+#endif
+#if defined(CRC32_ARMV8_CRC32)
+#include "crc32_simd.h"
+#endif
+
+const char deflate_copyright[] =
+   " deflate 1.2.11 Copyright 1995-2017 Jean-loup Gailly and Mark Adler ";
+/*
+  If you use the zlib library in a product, an acknowledgment is welcome
+  in the documentation of your product. If for some reason you cannot
+  include such an acknowledgment, I would appreciate that you keep this
+  copyright string in the executable of your product.
+ */
+
+/* ===========================================================================
+ *  Function prototypes.
+ */
+typedef enum {
+    need_more,      /* block not completed, need more input or more output */
+    block_done,     /* block flush performed */
+    finish_started, /* finish started, need only more output at next deflate */
+    finish_done     /* finish done, accept no more input or output */
+} block_state;
+
+typedef block_state (*compress_func) OF((deflate_state *s, int flush));
+/* Compression function. Returns the block state after the call. */
+
+local int deflateStateCheck      OF((z_streamp strm));
+local void slide_hash     OF((deflate_state *s));
+local void fill_window    OF((deflate_state *s));
+local block_state deflate_stored OF((deflate_state *s, int flush));
+local block_state deflate_fast   OF((deflate_state *s, int flush));
+#ifndef FASTEST
+local block_state deflate_slow   OF((deflate_state *s, int flush));
+#endif
+local block_state deflate_rle    OF((deflate_state *s, int flush));
+local block_state deflate_huff   OF((deflate_state *s, int flush));
+local void lm_init        OF((deflate_state *s));
+local void putShortMSB    OF((deflate_state *s, uInt b));
+local void flush_pending  OF((z_streamp strm));
+unsigned ZLIB_INTERNAL deflate_read_buf OF((z_streamp strm, Bytef *buf, unsigned size));
+#ifdef ASMV
+#  pragma message("Assembler code may have bugs -- use at your own risk")
+      void match_init OF((void)); /* asm code initialization */
+      uInt longest_match  OF((deflate_state *s, IPos cur_match));
+#else
+local uInt longest_match  OF((deflate_state *s, IPos cur_match));
+#endif
+
+#ifdef ZLIB_DEBUG
+local  void check_match OF((deflate_state *s, IPos start, IPos match,
+                            int length));
+#endif
+
+/* From crc32.c */
+extern void ZLIB_INTERNAL crc_reset(deflate_state *const s);
+extern void ZLIB_INTERNAL crc_finalize(deflate_state *const s);
+extern void ZLIB_INTERNAL copy_with_crc(z_streamp strm, Bytef *dst, long size);
+
+/* ===========================================================================
+ * Local data
+ */
+
+#define NIL 0
+/* Tail of hash chains */
+
+#ifndef TOO_FAR
+#  define TOO_FAR 4096
+#endif
+/* Matches of length 3 are discarded if their distance exceeds TOO_FAR */
+
+/* Values for max_lazy_match, good_match and max_chain_length, depending on
+ * the desired pack level (0..9). The values given below have been tuned to
+ * exclude worst case performance for pathological files. Better values may be
+ * found for specific files.
+ */
+typedef struct config_s {
+   ush good_length; /* reduce lazy search above this match length */
+   ush max_lazy;    /* do not perform lazy search above this match length */
+   ush nice_length; /* quit search above this match length */
+   ush max_chain;
+   compress_func func;
+} config;
+
+#ifdef FASTEST
+local const config configuration_table[2] = {
+/*      good lazy nice chain */
+/* 0 */ {0,    0,  0,    0, deflate_stored},  /* store only */
+/* 1 */ {4,    4,  8,    4, deflate_fast}}; /* max speed, no lazy matches */
+#else
+local const config configuration_table[10] = {
+/*      good lazy nice chain */
+/* 0 */ {0,    0,  0,    0, deflate_stored},  /* store only */
+/* 1 */ {4,    4,  8,    4, deflate_fast}, /* max speed, no lazy matches */
+/* 2 */ {4,    5, 16,    8, deflate_fast},
+/* 3 */ {4,    6, 32,   32, deflate_fast},
+
+/* 4 */ {4,    4, 16,   16, deflate_slow},  /* lazy matches */
+/* 5 */ {8,   16, 32,   32, deflate_slow},
+/* 6 */ {8,   16, 128, 128, deflate_slow},
+/* 7 */ {8,   32, 128, 256, deflate_slow},
+/* 8 */ {32, 128, 258, 1024, deflate_slow},
+/* 9 */ {32, 258, 258, 4096, deflate_slow}}; /* max compression */
+#endif
+
+/* Note: the deflate() code requires max_lazy >= MIN_MATCH and max_chain >= 4
+ * For deflate_fast() (levels <= 3) good is ignored and lazy has a different
+ * meaning.
+ */
+
+/* rank Z_BLOCK between Z_NO_FLUSH and Z_PARTIAL_FLUSH */
+#define RANK(f) (((f) * 2) - ((f) > 4 ? 9 : 0))
+
+/* ===========================================================================
+ * Initialize the hash table (avoiding 64K overflow for 16 bit systems).
+ * prev[] will be initialized on the fly.
+ */
+#define CLEAR_HASH(s) \
+    s->head[s->hash_size-1] = NIL; \
+    zmemzero((Bytef *)s->head, (unsigned)(s->hash_size-1)*sizeof(*s->head));
+
+/* ===========================================================================
+ * Slide the hash table when sliding the window down (could be avoided with 32
+ * bit values at the expense of memory usage). We slide even when level == 0 to
+ * keep the hash table consistent if we switch back to level > 0 later.
+ */
+local void slide_hash(s)
+    deflate_state *s;
+{
+#if (defined(__ARM_NEON__) || defined(__ARM_NEON))
+    /* NEON based hash table rebase. */
+    return neon_slide_hash(s->head, s->prev, s->w_size, s->hash_size);
+#endif
+    unsigned n, m;
+    Posf *p;
+    uInt wsize = s->w_size;
+
+    n = s->hash_size;
+    p = &s->head[n];
+    do {
+        m = *--p;
+        *p = (Pos)(m >= wsize ? m - wsize : NIL);
+    } while (--n);
+    n = wsize;
+#ifndef FASTEST
+    p = &s->prev[n];
+    do {
+        m = *--p;
+        *p = (Pos)(m >= wsize ? m - wsize : NIL);
+        /* If n is not on any hash chain, prev[n] is garbage but
+         * its value will never be used.
+         */
+    } while (--n);
+#endif
+}
+
+/* ========================================================================= */
+int ZEXPORT deflateInit_(strm, level, version, stream_size)
+    z_streamp strm;
+    int level;
+    const char *version;
+    int stream_size;
+{
+    return deflateInit2_(strm, level, Z_DEFLATED, MAX_WBITS, DEF_MEM_LEVEL,
+                         Z_DEFAULT_STRATEGY, version, stream_size);
+    /* To do: ignore strm->next_in if we use it as window */
+}
+
+/* ========================================================================= */
+int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
+                  version, stream_size)
+    z_streamp strm;
+    int  level;
+    int  method;
+    int  windowBits;
+    int  memLevel;
+    int  strategy;
+    const char *version;
+    int stream_size;
+{
+    unsigned window_padding = 8;
+    deflate_state *s;
+    int wrap = 1;
+    static const char my_version[] = ZLIB_VERSION;
+
+    // Needed to activate optimized insert_string() that helps compression
+    // for all wrapper formats (e.g. RAW, ZLIB, GZIP).
+    // Feature detection is not triggered while using RAW mode (i.e. we never
+    // call crc32() with a NULL buffer).
+#if defined(CRC32_ARMV8_CRC32) || defined(CRC32_SIMD_SSE42_PCLMUL)
+    cpu_check_features();
+#endif
+
+    if (version == Z_NULL || version[0] != my_version[0] ||
+        stream_size != sizeof(z_stream)) {
+        return Z_VERSION_ERROR;
+    }
+    if (strm == Z_NULL) return Z_STREAM_ERROR;
+
+    strm->msg = Z_NULL;
+    if (strm->zalloc == (alloc_func)0) {
+#ifdef Z_SOLO
+        return Z_STREAM_ERROR;
+#else
+        strm->zalloc = zcalloc;
+        strm->opaque = (voidpf)0;
+#endif
+    }
+    if (strm->zfree == (free_func)0)
+#ifdef Z_SOLO
+        return Z_STREAM_ERROR;
+#else
+        strm->zfree = zcfree;
+#endif
+
+#ifdef FASTEST
+    if (level != 0) level = 1;
+#else
+    if (level == Z_DEFAULT_COMPRESSION) level = 6;
+#endif
+
+    if (windowBits < 0) { /* suppress zlib wrapper */
+        wrap = 0;
+        windowBits = -windowBits;
+    }
+#ifdef GZIP
+    else if (windowBits > 15) {
+        wrap = 2;       /* write gzip wrapper instead */
+        windowBits -= 16;
+    }
+#endif
+    if (memLevel < 1 || memLevel > MAX_MEM_LEVEL || method != Z_DEFLATED ||
+        windowBits < 8 || windowBits > 15 || level < 0 || level > 9 ||
+        strategy < 0 || strategy > Z_FIXED || (windowBits == 8 && wrap != 1)) {
+        return Z_STREAM_ERROR;
+    }
+    if (windowBits == 8) windowBits = 9;  /* until 256-byte window bug fixed */
+    s = (deflate_state *) ZALLOC(strm, 1, sizeof(deflate_state));
+    if (s == Z_NULL) return Z_MEM_ERROR;
+    strm->state = (struct internal_state FAR *)s;
+    s->strm = strm;
+    s->status = INIT_STATE;     /* to pass state test in deflateReset() */
+
+    s->wrap = wrap;
+    s->gzhead = Z_NULL;
+    s->w_bits = (uInt)windowBits;
+    s->w_size = 1 << s->w_bits;
+    s->w_mask = s->w_size - 1;
+
+    if (x86_cpu_enable_simd) {
+        s->hash_bits = 15;
+    } else {
+        s->hash_bits = memLevel + 7;
+    }
+
+    s->hash_size = 1 << s->hash_bits;
+    s->hash_mask = s->hash_size - 1;
+    s->hash_shift =  ((s->hash_bits+MIN_MATCH-1)/MIN_MATCH);
+
+    s->window = (Bytef *) ZALLOC(strm,
+                                 s->w_size + window_padding,
+                                 2*sizeof(Byte));
+    s->prev   = (Posf *)  ZALLOC(strm, s->w_size, sizeof(Pos));
+    /* Avoid use of uninitialized value, see:
+     * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360
+     */
+    zmemzero(s->prev, s->w_size * sizeof(Pos));
+    s->head   = (Posf *)  ZALLOC(strm, s->hash_size, sizeof(Pos));
+
+    s->high_water = 0;      /* nothing written to s->window yet */
+
+    s->lit_bufsize = 1 << (memLevel + 6); /* 16K elements by default */
+
+    /* We overlay pending_buf and sym_buf. This works since the average size
+     * for length/distance pairs over any compressed block is assured to be 31
+     * bits or less.
+     *
+     * Analysis: The longest fixed codes are a length code of 8 bits plus 5
+     * extra bits, for lengths 131 to 257. The longest fixed distance codes are
+     * 5 bits plus 13 extra bits, for distances 16385 to 32768. The longest
+     * possible fixed-codes length/distance pair is then 31 bits total.
+     *
+     * sym_buf starts one-fourth of the way into pending_buf. So there are
+     * three bytes in sym_buf for every four bytes in pending_buf. Each symbol
+     * in sym_buf is three bytes -- two for the distance and one for the
+     * literal/length. As each symbol is consumed, the pointer to the next
+     * sym_buf value to read moves forward three bytes. From that symbol, up to
+     * 31 bits are written to pending_buf. The closest the written pending_buf
+     * bits gets to the next sym_buf symbol to read is just before the last
+     * code is written. At that time, 31*(n-2) bits have been written, just
+     * after 24*(n-2) bits have been consumed from sym_buf. sym_buf starts at
+     * 8*n bits into pending_buf. (Note that the symbol buffer fills when n-1
+     * symbols are written.) The closest the writing gets to what is unread is
+     * then n+14 bits. Here n is lit_bufsize, which is 16384 by default, and
+     * can range from 128 to 32768.
+     *
+     * Therefore, at a minimum, there are 142 bits of space between what is
+     * written and what is read in the overlain buffers, so the symbols cannot
+     * be overwritten by the compressed data. That space is actually 139 bits,
+     * due to the three-bit fixed-code block header.
+     *
+     * That covers the case where either Z_FIXED is specified, forcing fixed
+     * codes, or when the use of fixed codes is chosen, because that choice
+     * results in a smaller compressed block than dynamic codes. That latter
+     * condition then assures that the above analysis also covers all dynamic
+     * blocks. A dynamic-code block will only be chosen to be emitted if it has
+     * fewer bits than a fixed-code block would for the same set of symbols.
+     * Therefore its average symbol length is assured to be less than 31. So
+     * the compressed data for a dynamic block also cannot overwrite the
+     * symbols from which it is being constructed.
+     */
+    s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 4);
+    s->pending_buf_size = (ulg)s->lit_bufsize * 4;
+
+    if (s->window == Z_NULL || s->prev == Z_NULL || s->head == Z_NULL ||
+        s->pending_buf == Z_NULL) {
+        s->status = FINISH_STATE;
+        strm->msg = ERR_MSG(Z_MEM_ERROR);
+        deflateEnd (strm);
+        return Z_MEM_ERROR;
+    }
+    s->sym_buf = s->pending_buf + s->lit_bufsize;
+    s->sym_end = (s->lit_bufsize - 1) * 3;
+    /* We avoid equality with lit_bufsize*3 because of wraparound at 64K
+     * on 16 bit machines and because stored blocks are restricted to
+     * 64K-1 bytes.
+     */
+
+    s->level = level;
+    s->strategy = strategy;
+    s->method = (Byte)method;
+
+    return deflateReset(strm);
+}
+
+/* =========================================================================
+ * Check for a valid deflate stream state. Return 0 if ok, 1 if not.
+ */
+local int deflateStateCheck (strm)
+    z_streamp strm;
+{
+    deflate_state *s;
+    if (strm == Z_NULL ||
+        strm->zalloc == (alloc_func)0 || strm->zfree == (free_func)0)
+        return 1;
+    s = strm->state;
+    if (s == Z_NULL || s->strm != strm || (s->status != INIT_STATE &&
+#ifdef GZIP
+                                           s->status != GZIP_STATE &&
+#endif
+                                           s->status != EXTRA_STATE &&
+                                           s->status != NAME_STATE &&
+                                           s->status != COMMENT_STATE &&
+                                           s->status != HCRC_STATE &&
+                                           s->status != BUSY_STATE &&
+                                           s->status != FINISH_STATE))
+        return 1;
+    return 0;
+}
+
+/* ========================================================================= */
+int ZEXPORT deflateSetDictionary (strm, dictionary, dictLength)
+    z_streamp strm;
+    const Bytef *dictionary;
+    uInt  dictLength;
+{
+    deflate_state *s;
+    uInt str, n;
+    int wrap;
+    unsigned avail;
+    z_const unsigned char *next;
+
+    if (deflateStateCheck(strm) || dictionary == Z_NULL)
+        return Z_STREAM_ERROR;
+    s = strm->state;
+    wrap = s->wrap;
+    if (wrap == 2 || (wrap == 1 && s->status != INIT_STATE) || s->lookahead)
+        return Z_STREAM_ERROR;
+
+    /* when using zlib wrappers, compute Adler-32 for provided dictionary */
+    if (wrap == 1)
+        strm->adler = adler32(strm->adler, dictionary, dictLength);
+    s->wrap = 0;                    /* avoid computing Adler-32 in deflate_read_buf */
+
+    /* if dictionary would fill window, just replace the history */
+    if (dictLength >= s->w_size) {
+        if (wrap == 0) {            /* already empty otherwise */
+            CLEAR_HASH(s);
+            s->strstart = 0;
+            s->block_start = 0L;
+            s->insert = 0;
+        }
+        dictionary += dictLength - s->w_size;  /* use the tail */
+        dictLength = s->w_size;
+    }
+
+    /* insert dictionary into window and hash */
+    avail = strm->avail_in;
+    next = strm->next_in;
+    strm->avail_in = dictLength;
+    strm->next_in = (z_const Bytef *)dictionary;
+    fill_window(s);
+    while (s->lookahead >= MIN_MATCH) {
+        str = s->strstart;
+        n = s->lookahead - (MIN_MATCH-1);
+        do {
+            insert_string(s, str);
+            str++;
+        } while (--n);
+        s->strstart = str;
+        s->lookahead = MIN_MATCH-1;
+        fill_window(s);
+    }
+    s->strstart += s->lookahead;
+    s->block_start = (long)s->strstart;
+    s->insert = s->lookahead;
+    s->lookahead = 0;
+    s->match_length = s->prev_length = MIN_MATCH-1;
+    s->match_available = 0;
+    strm->next_in = next;
+    strm->avail_in = avail;
+    s->wrap = wrap;
+    return Z_OK;
+}
+
+/* ========================================================================= */
+int ZEXPORT deflateGetDictionary (strm, dictionary, dictLength)
+    z_streamp strm;
+    Bytef *dictionary;
+    uInt  *dictLength;
+{
+    deflate_state *s;
+    uInt len;
+
+    if (deflateStateCheck(strm))
+        return Z_STREAM_ERROR;
+    s = strm->state;
+    len = s->strstart + s->lookahead;
+    if (len > s->w_size)
+        len = s->w_size;
+    if (dictionary != Z_NULL && len)
+        zmemcpy(dictionary, s->window + s->strstart + s->lookahead - len, len);
+    if (dictLength != Z_NULL)
+        *dictLength = len;
+    return Z_OK;
+}
+
+/* ========================================================================= */
+int ZEXPORT deflateResetKeep (strm)
+    z_streamp strm;
+{
+    deflate_state *s;
+
+    if (deflateStateCheck(strm)) {
+        return Z_STREAM_ERROR;
+    }
+
+    strm->total_in = strm->total_out = 0;
+    strm->msg = Z_NULL; /* use zfree if we ever allocate msg dynamically */
+    strm->data_type = Z_UNKNOWN;
+
+    s = (deflate_state *)strm->state;
+    s->pending = 0;
+    s->pending_out = s->pending_buf;
+
+    if (s->wrap < 0) {
+        s->wrap = -s->wrap; /* was made negative by deflate(..., Z_FINISH); */
+    }
+    s->status =
+#ifdef GZIP
+        s->wrap == 2 ? GZIP_STATE :
+#endif
+        s->wrap ? INIT_STATE : BUSY_STATE;
+    strm->adler =
+#ifdef GZIP
+        s->wrap == 2 ? crc32(0L, Z_NULL, 0) :
+#endif
+        adler32(0L, Z_NULL, 0);
+    s->last_flush = Z_NO_FLUSH;
+
+    _tr_init(s);
+
+    return Z_OK;
+}
+
+/* ========================================================================= */
+int ZEXPORT deflateReset (strm)
+    z_streamp strm;
+{
+    int ret;
+
+    ret = deflateResetKeep(strm);
+    if (ret == Z_OK)
+        lm_init(strm->state);
+    return ret;
+}
+
+/* ========================================================================= */
+int ZEXPORT deflateSetHeader (strm, head)
+    z_streamp strm;
+    gz_headerp head;
+{
+    if (deflateStateCheck(strm) || strm->state->wrap != 2)
+        return Z_STREAM_ERROR;
+    strm->state->gzhead = head;
+    return Z_OK;
+}
+
+/* ========================================================================= */
+int ZEXPORT deflatePending (strm, pending, bits)
+    unsigned *pending;
+    int *bits;
+    z_streamp strm;
+{
+    if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
+    if (pending != Z_NULL)
+        *pending = strm->state->pending;
+    if (bits != Z_NULL)
+        *bits = strm->state->bi_valid;
+    return Z_OK;
+}
+
+/* ========================================================================= */
+int ZEXPORT deflatePrime (strm, bits, value)
+    z_streamp strm;
+    int bits;
+    int value;
+{
+    deflate_state *s;
+    int put;
+
+    if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
+    s = strm->state;
+    if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
+        return Z_BUF_ERROR;
+    do {
+        put = Buf_size - s->bi_valid;
+        if (put > bits)
+            put = bits;
+        s->bi_buf |= (ush)((value & ((1 << put) - 1)) << s->bi_valid);
+        s->bi_valid += put;
+        _tr_flush_bits(s);
+        value >>= put;
+        bits -= put;
+    } while (bits);
+    return Z_OK;
+}
+
+/* ========================================================================= */
+int ZEXPORT deflateParams(strm, level, strategy)
+    z_streamp strm;
+    int level;
+    int strategy;
+{
+    deflate_state *s;
+    compress_func func;
+
+    if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
+    s = strm->state;
+
+#ifdef FASTEST
+    if (level != 0) level = 1;
+#else
+    if (level == Z_DEFAULT_COMPRESSION) level = 6;
+#endif
+    if (level < 0 || level > 9 || strategy < 0 || strategy > Z_FIXED) {
+        return Z_STREAM_ERROR;
+    }
+    func = configuration_table[s->level].func;
+
+    if ((strategy != s->strategy || func != configuration_table[level].func) &&
+        s->high_water) {
+        /* Flush the last buffer: */
+        int err = deflate(strm, Z_BLOCK);
+        if (err == Z_STREAM_ERROR)
+            return err;
+        if (strm->avail_out == 0)
+            return Z_BUF_ERROR;
+    }
+    if (s->level != level) {
+        if (s->level == 0 && s->matches != 0) {
+            if (s->matches == 1)
+                slide_hash(s);
+            else
+                CLEAR_HASH(s);
+            s->matches = 0;
+        }
+        s->level = level;
+        s->max_lazy_match   = configuration_table[level].max_lazy;
+        s->good_match       = configuration_table[level].good_length;
+        s->nice_match       = configuration_table[level].nice_length;
+        s->max_chain_length = configuration_table[level].max_chain;
+    }
+    s->strategy = strategy;
+    return Z_OK;
+}
+
+/* ========================================================================= */
+int ZEXPORT deflateTune(strm, good_length, max_lazy, nice_length, max_chain)
+    z_streamp strm;
+    int good_length;
+    int max_lazy;
+    int nice_length;
+    int max_chain;
+{
+    deflate_state *s;
+
+    if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
+    s = strm->state;
+    s->good_match = (uInt)good_length;
+    s->max_lazy_match = (uInt)max_lazy;
+    s->nice_match = nice_length;
+    s->max_chain_length = (uInt)max_chain;
+    return Z_OK;
+}
+
+/* =========================================================================
+ * For the default windowBits of 15 and memLevel of 8, this function returns
+ * a close to exact, as well as small, upper bound on the compressed size.
+ * They are coded as constants here for a reason--if the #define's are
+ * changed, then this function needs to be changed as well.  The return
+ * value for 15 and 8 only works for those exact settings.
+ *
+ * For any setting other than those defaults for windowBits and memLevel,
+ * the value returned is a conservative worst case for the maximum expansion
+ * resulting from using fixed blocks instead of stored blocks, which deflate
+ * can emit on compressed data for some combinations of the parameters.
+ *
+ * This function could be more sophisticated to provide closer upper bounds for
+ * every combination of windowBits and memLevel.  But even the conservative
+ * upper bound of about 14% expansion does not seem onerous for output buffer
+ * allocation.
+ */
+uLong ZEXPORT deflateBound(strm, sourceLen)
+    z_streamp strm;
+    uLong sourceLen;
+{
+    deflate_state *s;
+    uLong complen, wraplen;
+
+    /* conservative upper bound for compressed data */
+    complen = sourceLen +
+              ((sourceLen + 7) >> 3) + ((sourceLen + 63) >> 6) + 5;
+
+    /* if can't get parameters, return conservative bound plus zlib wrapper */
+    if (deflateStateCheck(strm))
+        return complen + 6;
+
+    /* compute wrapper length */
+    s = strm->state;
+    switch (s->wrap) {
+    case 0:                                 /* raw deflate */
+        wraplen = 0;
+        break;
+    case 1:                                 /* zlib wrapper */
+        wraplen = 6 + (s->strstart ? 4 : 0);
+        break;
+#ifdef GZIP
+    case 2:                                 /* gzip wrapper */
+        wraplen = 18;
+        if (s->gzhead != Z_NULL) {          /* user-supplied gzip header */
+            Bytef *str;
+            if (s->gzhead->extra != Z_NULL)
+                wraplen += 2 + s->gzhead->extra_len;
+            str = s->gzhead->name;
+            if (str != Z_NULL)
+                do {
+                    wraplen++;
+                } while (*str++);
+            str = s->gzhead->comment;
+            if (str != Z_NULL)
+                do {
+                    wraplen++;
+                } while (*str++);
+            if (s->gzhead->hcrc)
+                wraplen += 2;
+        }
+        break;
+#endif
+    default:                                /* for compiler happiness */
+        wraplen = 6;
+    }
+
+    /* if not default parameters, return conservative bound */
+    if (s->w_bits != 15 || s->hash_bits != 8 + 7)
+        return complen + wraplen;
+
+    /* default settings: return tight bound for that case */
+    return sourceLen + (sourceLen >> 12) + (sourceLen >> 14) +
+           (sourceLen >> 25) + 13 - 6 + wraplen;
+}
+
+/* =========================================================================
+ * Put a short in the pending buffer. The 16-bit value is put in MSB order.
+ * IN assertion: the stream state is correct and there is enough room in
+ * pending_buf.
+ */
+local void putShortMSB (s, b)
+    deflate_state *s;
+    uInt b;
+{
+    put_byte(s, (Byte)(b >> 8));
+    put_byte(s, (Byte)(b & 0xff));
+}
+
+/* =========================================================================
+ * Flush as much pending output as possible. All deflate() output, except for
+ * some deflate_stored() output, goes through this function so some
+ * applications may wish to modify it to avoid allocating a large
+ * strm->next_out buffer and copying into it. (See also deflate_read_buf()).
+ */
+local void flush_pending(strm)
+    z_streamp strm;
+{
+    unsigned len;
+    deflate_state *s = strm->state;
+
+    _tr_flush_bits(s);
+    len = s->pending;
+    if (len > strm->avail_out) len = strm->avail_out;
+    if (len == 0) return;
+
+    zmemcpy(strm->next_out, s->pending_out, len);
+    strm->next_out  += len;
+    s->pending_out  += len;
+    strm->total_out += len;
+    strm->avail_out -= len;
+    s->pending      -= len;
+    if (s->pending == 0) {
+        s->pending_out = s->pending_buf;
+    }
+}
+
+/* ===========================================================================
+ * Update the header CRC with the bytes s->pending_buf[beg..s->pending - 1].
+ */
+#define HCRC_UPDATE(beg) \
+    do { \
+        if (s->gzhead->hcrc && s->pending > (beg)) \
+            strm->adler = crc32(strm->adler, s->pending_buf + (beg), \
+                                s->pending - (beg)); \
+    } while (0)
+
+/* ========================================================================= */
+int ZEXPORT deflate (strm, flush)
+    z_streamp strm;
+    int flush;
+{
+    int old_flush; /* value of flush param for previous deflate call */
+    deflate_state *s;
+
+    if (deflateStateCheck(strm) || flush > Z_BLOCK || flush < 0) {
+        return Z_STREAM_ERROR;
+    }
+    s = strm->state;
+
+    if (strm->next_out == Z_NULL ||
+        (strm->avail_in != 0 && strm->next_in == Z_NULL) ||
+        (s->status == FINISH_STATE && flush != Z_FINISH)) {
+        ERR_RETURN(strm, Z_STREAM_ERROR);
+    }
+    if (strm->avail_out == 0) ERR_RETURN(strm, Z_BUF_ERROR);
+
+    old_flush = s->last_flush;
+    s->last_flush = flush;
+
+    /* Flush as much pending output as possible */
+    if (s->pending != 0) {
+        flush_pending(strm);
+        if (strm->avail_out == 0) {
+            /* Since avail_out is 0, deflate will be called again with
+             * more output space, but possibly with both pending and
+             * avail_in equal to zero. There won't be anything to do,
+             * but this is not an error situation so make sure we
+             * return OK instead of BUF_ERROR at next call of deflate:
+             */
+            s->last_flush = -1;
+            return Z_OK;
+        }
+
+    /* Make sure there is something to do and avoid duplicate consecutive
+     * flushes. For repeated and useless calls with Z_FINISH, we keep
+     * returning Z_STREAM_END instead of Z_BUF_ERROR.
+     */
+    } else if (strm->avail_in == 0 && RANK(flush) <= RANK(old_flush) &&
+               flush != Z_FINISH) {
+        ERR_RETURN(strm, Z_BUF_ERROR);
+    }
+
+    /* User must not provide more input after the first FINISH: */
+    if (s->status == FINISH_STATE && strm->avail_in != 0) {
+        ERR_RETURN(strm, Z_BUF_ERROR);
+    }
+
+    /* Write the header */
+    if (s->status == INIT_STATE) {
+        /* zlib header */
+        uInt header = (Z_DEFLATED + ((s->w_bits-8)<<4)) << 8;
+        uInt level_flags;
+
+        if (s->strategy >= Z_HUFFMAN_ONLY || s->level < 2)
+            level_flags = 0;
+        else if (s->level < 6)
+            level_flags = 1;
+        else if (s->level == 6)
+            level_flags = 2;
+        else
+            level_flags = 3;
+        header |= (level_flags << 6);
+        if (s->strstart != 0) header |= PRESET_DICT;
+        header += 31 - (header % 31);
+
+        putShortMSB(s, header);
+
+        /* Save the adler32 of the preset dictionary: */
+        if (s->strstart != 0) {
+            putShortMSB(s, (uInt)(strm->adler >> 16));
+            putShortMSB(s, (uInt)(strm->adler & 0xffff));
+        }
+        strm->adler = adler32(0L, Z_NULL, 0);
+        s->status = BUSY_STATE;
+
+        /* Compression must start with an empty pending buffer */
+        flush_pending(strm);
+        if (s->pending != 0) {
+            s->last_flush = -1;
+            return Z_OK;
+        }
+    }
+#ifdef GZIP
+    if (s->status == GZIP_STATE) {
+        /* gzip header */
+        crc_reset(s);
+        put_byte(s, 31);
+        put_byte(s, 139);
+        put_byte(s, 8);
+        if (s->gzhead == Z_NULL) {
+            put_byte(s, 0);
+            put_byte(s, 0);
+            put_byte(s, 0);
+            put_byte(s, 0);
+            put_byte(s, 0);
+            put_byte(s, s->level == 9 ? 2 :
+                     (s->strategy >= Z_HUFFMAN_ONLY || s->level < 2 ?
+                      4 : 0));
+            put_byte(s, OS_CODE);
+            s->status = BUSY_STATE;
+
+            /* Compression must start with an empty pending buffer */
+            flush_pending(strm);
+            if (s->pending != 0) {
+                s->last_flush = -1;
+                return Z_OK;
+            }
+        }
+        else {
+            put_byte(s, (s->gzhead->text ? 1 : 0) +
+                     (s->gzhead->hcrc ? 2 : 0) +
+                     (s->gzhead->extra == Z_NULL ? 0 : 4) +
+                     (s->gzhead->name == Z_NULL ? 0 : 8) +
+                     (s->gzhead->comment == Z_NULL ? 0 : 16)
+                     );
+            put_byte(s, (Byte)(s->gzhead->time & 0xff));
+            put_byte(s, (Byte)((s->gzhead->time >> 8) & 0xff));
+            put_byte(s, (Byte)((s->gzhead->time >> 16) & 0xff));
+            put_byte(s, (Byte)((s->gzhead->time >> 24) & 0xff));
+            put_byte(s, s->level == 9 ? 2 :
+                     (s->strategy >= Z_HUFFMAN_ONLY || s->level < 2 ?
+                      4 : 0));
+            put_byte(s, s->gzhead->os & 0xff);
+            if (s->gzhead->extra != Z_NULL) {
+                put_byte(s, s->gzhead->extra_len & 0xff);
+                put_byte(s, (s->gzhead->extra_len >> 8) & 0xff);
+            }
+            if (s->gzhead->hcrc)
+                strm->adler = crc32(strm->adler, s->pending_buf,
+                                    s->pending);
+            s->gzindex = 0;
+            s->status = EXTRA_STATE;
+        }
+    }
+    if (s->status == EXTRA_STATE) {
+        if (s->gzhead->extra != Z_NULL) {
+            ulg beg = s->pending;   /* start of bytes to update crc */
+            uInt left = (s->gzhead->extra_len & 0xffff) - s->gzindex;
+            while (s->pending + left > s->pending_buf_size) {
+                uInt copy = s->pending_buf_size - s->pending;
+                zmemcpy(s->pending_buf + s->pending,
+                        s->gzhead->extra + s->gzindex, copy);
+                s->pending = s->pending_buf_size;
+                HCRC_UPDATE(beg);
+                s->gzindex += copy;
+                flush_pending(strm);
+                if (s->pending != 0) {
+                    s->last_flush = -1;
+                    return Z_OK;
+                }
+                beg = 0;
+                left -= copy;
+            }
+            zmemcpy(s->pending_buf + s->pending,
+                    s->gzhead->extra + s->gzindex, left);
+            s->pending += left;
+            HCRC_UPDATE(beg);
+            s->gzindex = 0;
+        }
+        s->status = NAME_STATE;
+    }
+    if (s->status == NAME_STATE) {
+        if (s->gzhead->name != Z_NULL) {
+            ulg beg = s->pending;   /* start of bytes to update crc */
+            int val;
+            do {
+                if (s->pending == s->pending_buf_size) {
+                    HCRC_UPDATE(beg);
+                    flush_pending(strm);
+                    if (s->pending != 0) {
+                        s->last_flush = -1;
+                        return Z_OK;
+                    }
+                    beg = 0;
+                }
+                val = s->gzhead->name[s->gzindex++];
+                put_byte(s, val);
+            } while (val != 0);
+            HCRC_UPDATE(beg);
+            s->gzindex = 0;
+        }
+        s->status = COMMENT_STATE;
+    }
+    if (s->status == COMMENT_STATE) {
+        if (s->gzhead->comment != Z_NULL) {
+            ulg beg = s->pending;   /* start of bytes to update crc */
+            int val;
+            do {
+                if (s->pending == s->pending_buf_size) {
+                    HCRC_UPDATE(beg);
+                    flush_pending(strm);
+                    if (s->pending != 0) {
+                        s->last_flush = -1;
+                        return Z_OK;
+                    }
+                    beg = 0;
+                }
+                val = s->gzhead->comment[s->gzindex++];
+                put_byte(s, val);
+            } while (val != 0);
+            HCRC_UPDATE(beg);
+        }
+        s->status = HCRC_STATE;
+    }
+    if (s->status == HCRC_STATE) {
+        if (s->gzhead->hcrc) {
+            if (s->pending + 2 > s->pending_buf_size) {
+                flush_pending(strm);
+                if (s->pending != 0) {
+                    s->last_flush = -1;
+                    return Z_OK;
+                }
+            }
+            put_byte(s, (Byte)(strm->adler & 0xff));
+            put_byte(s, (Byte)((strm->adler >> 8) & 0xff));
+            strm->adler = crc32(0L, Z_NULL, 0);
+        }
+        s->status = BUSY_STATE;
+
+        /* Compression must start with an empty pending buffer */
+        flush_pending(strm);
+        if (s->pending != 0) {
+            s->last_flush = -1;
+            return Z_OK;
+        }
+    }
+#endif
+
+    /* Start a new block or continue the current one.
+     */
+    if (strm->avail_in != 0 || s->lookahead != 0 ||
+        (flush != Z_NO_FLUSH && s->status != FINISH_STATE)) {
+        block_state bstate;
+
+        bstate = s->level == 0 ? deflate_stored(s, flush) :
+                 s->strategy == Z_HUFFMAN_ONLY ? deflate_huff(s, flush) :
+                 s->strategy == Z_RLE ? deflate_rle(s, flush) :
+                 (*(configuration_table[s->level].func))(s, flush);
+
+        if (bstate == finish_started || bstate == finish_done) {
+            s->status = FINISH_STATE;
+        }
+        if (bstate == need_more || bstate == finish_started) {
+            if (strm->avail_out == 0) {
+                s->last_flush = -1; /* avoid BUF_ERROR next call, see above */
+            }
+            return Z_OK;
+            /* If flush != Z_NO_FLUSH && avail_out == 0, the next call
+             * of deflate should use the same flush parameter to make sure
+             * that the flush is complete. So we don't have to output an
+             * empty block here, this will be done at next call. This also
+             * ensures that for a very small output buffer, we emit at most
+             * one empty block.
+             */
+        }
+        if (bstate == block_done) {
+            if (flush == Z_PARTIAL_FLUSH) {
+                _tr_align(s);
+            } else if (flush != Z_BLOCK) { /* FULL_FLUSH or SYNC_FLUSH */
+                _tr_stored_block(s, (char*)0, 0L, 0);
+                /* For a full flush, this empty block will be recognized
+                 * as a special marker by inflate_sync().
+                 */
+                if (flush == Z_FULL_FLUSH) {
+                    CLEAR_HASH(s);             /* forget history */
+                    if (s->lookahead == 0) {
+                        s->strstart = 0;
+                        s->block_start = 0L;
+                        s->insert = 0;
+                    }
+                }
+            }
+            flush_pending(strm);
+            if (strm->avail_out == 0) {
+              s->last_flush = -1; /* avoid BUF_ERROR at next call, see above */
+              return Z_OK;
+            }
+        }
+    }
+
+    if (flush != Z_FINISH) return Z_OK;
+    if (s->wrap <= 0) return Z_STREAM_END;
+
+    /* Write the trailer */
+#ifdef GZIP
+    if (s->wrap == 2) {
+        crc_finalize(s);
+        put_byte(s, (Byte)(strm->adler & 0xff));
+        put_byte(s, (Byte)((strm->adler >> 8) & 0xff));
+        put_byte(s, (Byte)((strm->adler >> 16) & 0xff));
+        put_byte(s, (Byte)((strm->adler >> 24) & 0xff));
+        put_byte(s, (Byte)(strm->total_in & 0xff));
+        put_byte(s, (Byte)((strm->total_in >> 8) & 0xff));
+        put_byte(s, (Byte)((strm->total_in >> 16) & 0xff));
+        put_byte(s, (Byte)((strm->total_in >> 24) & 0xff));
+    }
+    else
+#endif
+    {
+        putShortMSB(s, (uInt)(strm->adler >> 16));
+        putShortMSB(s, (uInt)(strm->adler & 0xffff));
+    }
+    flush_pending(strm);
+    /* If avail_out is zero, the application will call deflate again
+     * to flush the rest.
+     */
+    if (s->wrap > 0) s->wrap = -s->wrap; /* write the trailer only once! */
+    return s->pending != 0 ? Z_OK : Z_STREAM_END;
+}
+
+/* ========================================================================= */
+int ZEXPORT deflateEnd (strm)
+    z_streamp strm;
+{
+    int status;
+
+    if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
+
+    status = strm->state->status;
+
+    /* Deallocate in reverse order of allocations: */
+    TRY_FREE(strm, strm->state->pending_buf);
+    TRY_FREE(strm, strm->state->head);
+    TRY_FREE(strm, strm->state->prev);
+    TRY_FREE(strm, strm->state->window);
+
+    ZFREE(strm, strm->state);
+    strm->state = Z_NULL;
+
+    return status == BUSY_STATE ? Z_DATA_ERROR : Z_OK;
+}
+
+/* =========================================================================
+ * Copy the source state to the destination state.
+ * To simplify the source, this is not supported for 16-bit MSDOS (which
+ * doesn't have enough memory anyway to duplicate compression states).
+ */
+int ZEXPORT deflateCopy (dest, source)
+    z_streamp dest;
+    z_streamp source;
+{
+#ifdef MAXSEG_64K
+    return Z_STREAM_ERROR;
+#else
+    deflate_state *ds;
+    deflate_state *ss;
+
+
+    if (deflateStateCheck(source) || dest == Z_NULL) {
+        return Z_STREAM_ERROR;
+    }
+
+    ss = source->state;
+
+    zmemcpy((voidpf)dest, (voidpf)source, sizeof(z_stream));
+
+    ds = (deflate_state *) ZALLOC(dest, 1, sizeof(deflate_state));
+    if (ds == Z_NULL) return Z_MEM_ERROR;
+    dest->state = (struct internal_state FAR *) ds;
+    zmemcpy((voidpf)ds, (voidpf)ss, sizeof(deflate_state));
+    ds->strm = dest;
+
+    ds->window = (Bytef *) ZALLOC(dest, ds->w_size, 2*sizeof(Byte));
+    ds->prev   = (Posf *)  ZALLOC(dest, ds->w_size, sizeof(Pos));
+    ds->head   = (Posf *)  ZALLOC(dest, ds->hash_size, sizeof(Pos));
+    ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, 4);
+
+    if (ds->window == Z_NULL || ds->prev == Z_NULL || ds->head == Z_NULL ||
+        ds->pending_buf == Z_NULL) {
+        deflateEnd (dest);
+        return Z_MEM_ERROR;
+    }
+    /* following zmemcpy do not work for 16-bit MSDOS */
+    zmemcpy(ds->window, ss->window, ds->w_size * 2 * sizeof(Byte));
+    zmemcpy((voidpf)ds->prev, (voidpf)ss->prev, ds->w_size * sizeof(Pos));
+    zmemcpy((voidpf)ds->head, (voidpf)ss->head, ds->hash_size * sizeof(Pos));
+    zmemcpy(ds->pending_buf, ss->pending_buf, (uInt)ds->pending_buf_size);
+
+    ds->pending_out = ds->pending_buf + (ss->pending_out - ss->pending_buf);
+    ds->sym_buf = ds->pending_buf + ds->lit_bufsize;
+
+    ds->l_desc.dyn_tree = ds->dyn_ltree;
+    ds->d_desc.dyn_tree = ds->dyn_dtree;
+    ds->bl_desc.dyn_tree = ds->bl_tree;
+
+    return Z_OK;
+#endif /* MAXSEG_64K */
+}
+
+/* ===========================================================================
+ * Read a new buffer from the current input stream, update the adler32
+ * and total number of bytes read.  All deflate() input goes through
+ * this function so some applications may wish to modify it to avoid
+ * allocating a large strm->next_in buffer and copying from it.
+ * (See also flush_pending()).
+ */
+ZLIB_INTERNAL unsigned deflate_read_buf(strm, buf, size)
+    z_streamp strm;
+    Bytef *buf;
+    unsigned size;
+{
+    unsigned len = strm->avail_in;
+
+    if (len > size) len = size;
+    if (len == 0) return 0;
+
+    strm->avail_in  -= len;
+
+#ifdef GZIP
+    if (strm->state->wrap == 2)
+        copy_with_crc(strm, buf, len);
+    else
+#endif
+    {
+        zmemcpy(buf, strm->next_in, len);
+        if (strm->state->wrap == 1)
+            strm->adler = adler32(strm->adler, buf, len);
+    }
+    strm->next_in  += len;
+    strm->total_in += len;
+
+    return len;
+}
+
+/* ===========================================================================
+ * Initialize the "longest match" routines for a new zlib stream
+ */
+local void lm_init (s)
+    deflate_state *s;
+{
+    s->window_size = (ulg)2L*s->w_size;
+
+    CLEAR_HASH(s);
+
+    /* Set the default configuration parameters:
+     */
+    s->max_lazy_match   = configuration_table[s->level].max_lazy;
+    s->good_match       = configuration_table[s->level].good_length;
+    s->nice_match       = configuration_table[s->level].nice_length;
+    s->max_chain_length = configuration_table[s->level].max_chain;
+
+    s->strstart = 0;
+    s->block_start = 0L;
+    s->lookahead = 0;
+    s->insert = 0;
+    s->match_length = s->prev_length = MIN_MATCH-1;
+    s->match_available = 0;
+    s->ins_h = 0;
+#ifndef FASTEST
+#ifdef ASMV
+    match_init(); /* initialize the asm code */
+#endif
+#endif
+}
+
+#ifndef FASTEST
+/* ===========================================================================
+ * Set match_start to the longest match starting at the given string and
+ * return its length. Matches shorter or equal to prev_length are discarded,
+ * in which case the result is equal to prev_length and match_start is
+ * garbage.
+ * IN assertions: cur_match is the head of the hash chain for the current
+ *   string (strstart) and its distance is <= MAX_DIST, and prev_length >= 1
+ * OUT assertion: the match length is not greater than s->lookahead.
+ */
+#ifndef ASMV
+/* For 80x86 and 680x0, an optimized version will be provided in match.asm or
+ * match.S. The code will be functionally equivalent.
+ */
+local uInt longest_match(s, cur_match)
+    deflate_state *s;
+    IPos cur_match;                             /* current match */
+{
+    unsigned chain_length = s->max_chain_length;/* max hash chain length */
+    register Bytef *scan = s->window + s->strstart; /* current string */
+    register Bytef *match;                      /* matched string */
+    register int len;                           /* length of current match */
+    int best_len = (int)s->prev_length;         /* best match length so far */
+    int nice_match = s->nice_match;             /* stop if match long enough */
+    IPos limit = s->strstart > (IPos)MAX_DIST(s) ?
+        s->strstart - (IPos)MAX_DIST(s) : NIL;
+    /* Stop when cur_match becomes <= limit. To simplify the code,
+     * we prevent matches with the string of window index 0.
+     */
+    Posf *prev = s->prev;
+    uInt wmask = s->w_mask;
+
+#ifdef UNALIGNED_OK
+    /* Compare two bytes at a time. Note: this is not always beneficial.
+     * Try with and without -DUNALIGNED_OK to check.
+     */
+    register Bytef *strend = s->window + s->strstart + MAX_MATCH - 1;
+    register ush scan_start = *(ushf*)scan;
+    register ush scan_end   = *(ushf*)(scan+best_len-1);
+#else
+    register Bytef *strend = s->window + s->strstart + MAX_MATCH;
+    register Byte scan_end1  = scan[best_len-1];
+    register Byte scan_end   = scan[best_len];
+#endif
+
+    /* The code is optimized for HASH_BITS >= 8 and MAX_MATCH-2 multiple of 16.
+     * It is easy to get rid of this optimization if necessary.
+     */
+    Assert(s->hash_bits >= 8 && MAX_MATCH == 258, "Code too clever");
+
+    /* Do not waste too much time if we already have a good match: */
+    if (s->prev_length >= s->good_match) {
+        chain_length >>= 2;
+    }
+    /* Do not look for matches beyond the end of the input. This is necessary
+     * to make deflate deterministic.
+     */
+    if ((uInt)nice_match > s->lookahead) nice_match = (int)s->lookahead;
+
+    Assert((ulg)s->strstart <= s->window_size-MIN_LOOKAHEAD, "need lookahead");
+
+    do {
+        Assert(cur_match < s->strstart, "no future");
+        match = s->window + cur_match;
+
+        /* Skip to next match if the match length cannot increase
+         * or if the match length is less than 2.  Note that the checks below
+         * for insufficient lookahead only occur occasionally for performance
+         * reasons.  Therefore uninitialized memory will be accessed, and
+         * conditional jumps will be made that depend on those values.
+         * However the length of the match is limited to the lookahead, so
+         * the output of deflate is not affected by the uninitialized values.
+         */
+#if (defined(UNALIGNED_OK) && MAX_MATCH == 258)
+        /* This code assumes sizeof(unsigned short) == 2. Do not use
+         * UNALIGNED_OK if your compiler uses a different size.
+         */
+        if (*(ushf*)(match+best_len-1) != scan_end ||
+            *(ushf*)match != scan_start) continue;
+
+        /* It is not necessary to compare scan[2] and match[2] since they are
+         * always equal when the other bytes match, given that the hash keys
+         * are equal and that HASH_BITS >= 8. Compare 2 bytes at a time at
+         * strstart+3, +5, ... up to strstart+257. We check for insufficient
+         * lookahead only every 4th comparison; the 128th check will be made
+         * at strstart+257. If MAX_MATCH-2 is not a multiple of 8, it is
+         * necessary to put more guard bytes at the end of the window, or
+         * to check more often for insufficient lookahead.
+         */
+        Assert(scan[2] == match[2], "scan[2]?");
+        scan++, match++;
+        do {
+        } while (*(ushf*)(scan+=2) == *(ushf*)(match+=2) &&
+                 *(ushf*)(scan+=2) == *(ushf*)(match+=2) &&
+                 *(ushf*)(scan+=2) == *(ushf*)(match+=2) &&
+                 *(ushf*)(scan+=2) == *(ushf*)(match+=2) &&
+                 scan < strend);
+        /* The funny "do {}" generates better code on most compilers */
+
+        /* Here, scan <= window+strstart+257 */
+        Assert(scan <= s->window+(unsigned)(s->window_size-1), "wild scan");
+        if (*scan == *match) scan++;
+
+        len = (MAX_MATCH - 1) - (int)(strend-scan);
+        scan = strend - (MAX_MATCH-1);
+
+#else /* UNALIGNED_OK */
+
+        if (match[best_len]   != scan_end  ||
+            match[best_len-1] != scan_end1 ||
+            *match            != *scan     ||
+            *++match          != scan[1])      continue;
+
+        /* The check at best_len-1 can be removed because it will be made
+         * again later. (This heuristic is not always a win.)
+         * It is not necessary to compare scan[2] and match[2] since they
+         * are always equal when the other bytes match, given that
+         * the hash keys are equal and that HASH_BITS >= 8.
+         */
+        scan += 2, match++;
+        Assert(*scan == *match, "match[2]?");
+
+        /* We check for insufficient lookahead only every 8th comparison;
+         * the 256th check will be made at strstart+258.
+         */
+        do {
+        } while (*++scan == *++match && *++scan == *++match &&
+                 *++scan == *++match && *++scan == *++match &&
+                 *++scan == *++match && *++scan == *++match &&
+                 *++scan == *++match && *++scan == *++match &&
+                 scan < strend);
+
+        Assert(scan <= s->window+(unsigned)(s->window_size-1), "wild scan");
+
+        len = MAX_MATCH - (int)(strend - scan);
+        scan = strend - MAX_MATCH;
+
+#endif /* UNALIGNED_OK */
+
+        if (len > best_len) {
+            s->match_start = cur_match;
+            best_len = len;
+            if (len >= nice_match) break;
+#ifdef UNALIGNED_OK
+            scan_end = *(ushf*)(scan+best_len-1);
+#else
+            scan_end1  = scan[best_len-1];
+            scan_end   = scan[best_len];
+#endif
+        }
+    } while ((cur_match = prev[cur_match & wmask]) > limit
+             && --chain_length != 0);
+
+    if ((uInt)best_len <= s->lookahead) return (uInt)best_len;
+    return s->lookahead;
+}
+#endif /* ASMV */
+
+#else /* FASTEST */
+
+/* ---------------------------------------------------------------------------
+ * Optimized version for FASTEST only
+ */
+local uInt longest_match(s, cur_match)
+    deflate_state *s;
+    IPos cur_match;                             /* current match */
+{
+    register Bytef *scan = s->window + s->strstart; /* current string */
+    register Bytef *match;                       /* matched string */
+    register int len;                           /* length of current match */
+    register Bytef *strend = s->window + s->strstart + MAX_MATCH;
+
+    /* The code is optimized for HASH_BITS >= 8 and MAX_MATCH-2 multiple of 16.
+     * It is easy to get rid of this optimization if necessary.
+     */
+    Assert(s->hash_bits >= 8 && MAX_MATCH == 258, "Code too clever");
+
+    Assert((ulg)s->strstart <= s->window_size-MIN_LOOKAHEAD, "need lookahead");
+
+    Assert(cur_match < s->strstart, "no future");
+
+    match = s->window + cur_match;
+
+    /* Return failure if the match length is less than 2:
+     */
+    if (match[0] != scan[0] || match[1] != scan[1]) return MIN_MATCH-1;
+
+    /* The check at best_len-1 can be removed because it will be made
+     * again later. (This heuristic is not always a win.)
+     * It is not necessary to compare scan[2] and match[2] since they
+     * are always equal when the other bytes match, given that
+     * the hash keys are equal and that HASH_BITS >= 8.
+     */
+    scan += 2, match += 2;
+    Assert(*scan == *match, "match[2]?");
+
+    /* We check for insufficient lookahead only every 8th comparison;
+     * the 256th check will be made at strstart+258.
+     */
+    do {
+    } while (*++scan == *++match && *++scan == *++match &&
+             *++scan == *++match && *++scan == *++match &&
+             *++scan == *++match && *++scan == *++match &&
+             *++scan == *++match && *++scan == *++match &&
+             scan < strend);
+
+    Assert(scan <= s->window+(unsigned)(s->window_size-1), "wild scan");
+
+    len = MAX_MATCH - (int)(strend - scan);
+
+    if (len < MIN_MATCH) return MIN_MATCH - 1;
+
+    s->match_start = cur_match;
+    return (uInt)len <= s->lookahead ? (uInt)len : s->lookahead;
+}
+
+#endif /* FASTEST */
+
+#ifdef ZLIB_DEBUG
+
+#define EQUAL 0
+/* result of memcmp for equal strings */
+
+/* ===========================================================================
+ * Check that the match at match_start is indeed a match.
+ */
+local void check_match(s, start, match, length)
+    deflate_state *s;
+    IPos start, match;
+    int length;
+{
+    /* check that the match is indeed a match */
+    if (zmemcmp(s->window + match,
+                s->window + start, length) != EQUAL) {
+        fprintf(stderr, " start %u, match %u, length %d\n",
+                start, match, length);
+        do {
+            fprintf(stderr, "%c%c", s->window[match++], s->window[start++]);
+        } while (--length != 0);
+        z_error("invalid match");
+    }
+    if (z_verbose > 1) {
+        fprintf(stderr,"\\[%d,%d]", start-match, length);
+        do { putc(s->window[start++], stderr); } while (--length != 0);
+    }
+}
+#else
+#  define check_match(s, start, match, length)
+#endif /* ZLIB_DEBUG */
+
+/* ===========================================================================
+ * Fill the window when the lookahead becomes insufficient.
+ * Updates strstart and lookahead.
+ *
+ * IN assertion: lookahead < MIN_LOOKAHEAD
+ * OUT assertions: strstart <= window_size-MIN_LOOKAHEAD
+ *    At least one byte has been read, or avail_in == 0; reads are
+ *    performed for at least two bytes (required for the zip translate_eol
+ *    option -- not supported here).
+ */
+local void fill_window_c(deflate_state *s);
+
+local void fill_window(deflate_state *s)
+{
+#ifdef ADLER32_SIMD_SSSE3
+    if (x86_cpu_enable_simd) {
+        fill_window_sse(s);
+        return;
+    }
+#endif
+    fill_window_c(s);
+}
+
+local void fill_window_c(s)
+    deflate_state *s;
+{
+    unsigned n;
+    unsigned more;    /* Amount of free space at the end of the window. */
+    uInt wsize = s->w_size;
+
+    Assert(s->lookahead < MIN_LOOKAHEAD, "already enough lookahead");
+
+    do {
+        more = (unsigned)(s->window_size -(ulg)s->lookahead -(ulg)s->strstart);
+
+        /* Deal with !@#$% 64K limit: */
+        if (sizeof(int) <= 2) {
+            if (more == 0 && s->strstart == 0 && s->lookahead == 0) {
+                more = wsize;
+
+            } else if (more == (unsigned)(-1)) {
+                /* Very unlikely, but possible on 16 bit machine if
+                 * strstart == 0 && lookahead == 1 (input done a byte at time)
+                 */
+                more--;
+            }
+        }
+
+        /* If the window is almost full and there is insufficient lookahead,
+         * move the upper half to the lower one to make room in the upper half.
+         */
+        if (s->strstart >= wsize+MAX_DIST(s)) {
+
+            zmemcpy(s->window, s->window+wsize, (unsigned)wsize - more);
+            s->match_start -= wsize;
+            s->strstart    -= wsize; /* we now have strstart >= MAX_DIST */
+            s->block_start -= (long) wsize;
+            slide_hash(s);
+            more += wsize;
+        }
+        if (s->strm->avail_in == 0) break;
+
+        /* If there was no sliding:
+         *    strstart <= WSIZE+MAX_DIST-1 && lookahead <= MIN_LOOKAHEAD - 1 &&
+         *    more == window_size - lookahead - strstart
+         * => more >= window_size - (MIN_LOOKAHEAD-1 + WSIZE + MAX_DIST-1)
+         * => more >= window_size - 2*WSIZE + 2
+         * In the BIG_MEM or MMAP case (not yet supported),
+         *   window_size == input_size + MIN_LOOKAHEAD  &&
+         *   strstart + s->lookahead <= input_size => more >= MIN_LOOKAHEAD.
+         * Otherwise, window_size == 2*WSIZE so more >= 2.
+         * If there was sliding, more >= WSIZE. So in all cases, more >= 2.
+         */
+        Assert(more >= 2, "more < 2");
+
+        n = deflate_read_buf(s->strm, s->window + s->strstart + s->lookahead, more);
+        s->lookahead += n;
+
+        /* Initialize the hash value now that we have some input: */
+        if (s->lookahead + s->insert >= MIN_MATCH) {
+            uInt str = s->strstart - s->insert;
+            s->ins_h = s->window[str];
+            UPDATE_HASH(s, s->ins_h, s->window[str + 1]);
+#if MIN_MATCH != 3
+            Call UPDATE_HASH() MIN_MATCH-3 more times
+#endif
+            while (s->insert) {
+                UPDATE_HASH(s, s->ins_h, s->window[str + MIN_MATCH-1]);
+#ifndef FASTEST
+                s->prev[str & s->w_mask] = s->head[s->ins_h];
+#endif
+                s->head[s->ins_h] = (Pos)str;
+                str++;
+                s->insert--;
+                if (s->lookahead + s->insert < MIN_MATCH)
+                    break;
+            }
+        }
+        /* If the whole input has less than MIN_MATCH bytes, ins_h is garbage,
+         * but this is not important since only literal bytes will be emitted.
+         */
+
+    } while (s->lookahead < MIN_LOOKAHEAD && s->strm->avail_in != 0);
+
+    /* If the WIN_INIT bytes after the end of the current data have never been
+     * written, then zero those bytes in order to avoid memory check reports of
+     * the use of uninitialized (or uninitialised as Julian writes) bytes by
+     * the longest match routines.  Update the high water mark for the next
+     * time through here.  WIN_INIT is set to MAX_MATCH since the longest match
+     * routines allow scanning to strstart + MAX_MATCH, ignoring lookahead.
+     */
+    if (s->high_water < s->window_size) {
+        ulg curr = s->strstart + (ulg)(s->lookahead);
+        ulg init;
+
+        if (s->high_water < curr) {
+            /* Previous high water mark below current data -- zero WIN_INIT
+             * bytes or up to end of window, whichever is less.
+             */
+            init = s->window_size - curr;
+            if (init > WIN_INIT)
+                init = WIN_INIT;
+            zmemzero(s->window + curr, (unsigned)init);
+            s->high_water = curr + init;
+        }
+        else if (s->high_water < (ulg)curr + WIN_INIT) {
+            /* High water mark at or above current data, but below current data
+             * plus WIN_INIT -- zero out to current data plus WIN_INIT, or up
+             * to end of window, whichever is less.
+             */
+            init = (ulg)curr + WIN_INIT - s->high_water;
+            if (init > s->window_size - s->high_water)
+                init = s->window_size - s->high_water;
+            zmemzero(s->window + s->high_water, (unsigned)init);
+            s->high_water += init;
+        }
+    }
+
+    Assert((ulg)s->strstart <= s->window_size - MIN_LOOKAHEAD,
+           "not enough room for search");
+}
+
+/* ===========================================================================
+ * Flush the current block, with given end-of-file flag.
+ * IN assertion: strstart is set to the end of the current match.
+ */
+#define FLUSH_BLOCK_ONLY(s, last) { \
+   _tr_flush_block(s, (s->block_start >= 0L ? \
+                   (charf *)&s->window[(unsigned)s->block_start] : \
+                   (charf *)Z_NULL), \
+                (ulg)((long)s->strstart - s->block_start), \
+                (last)); \
+   s->block_start = s->strstart; \
+   flush_pending(s->strm); \
+   Tracev((stderr,"[FLUSH]")); \
+}
+
+/* Same but force premature exit if necessary. */
+#define FLUSH_BLOCK(s, last) { \
+   FLUSH_BLOCK_ONLY(s, last); \
+   if (s->strm->avail_out == 0) return (last) ? finish_started : need_more; \
+}
+
+/* Maximum stored block length in deflate format (not including header). */
+#define MAX_STORED 65535
+
+/* Minimum of a and b. */
+#define MIN(a, b) ((a) > (b) ? (b) : (a))
+
+/* ===========================================================================
+ * Copy without compression as much as possible from the input stream, return
+ * the current block state.
+ *
+ * In case deflateParams() is used to later switch to a non-zero compression
+ * level, s->matches (otherwise unused when storing) keeps track of the number
+ * of hash table slides to perform. If s->matches is 1, then one hash table
+ * slide will be done when switching. If s->matches is 2, the maximum value
+ * allowed here, then the hash table will be cleared, since two or more slides
+ * is the same as a clear.
+ *
+ * deflate_stored() is written to minimize the number of times an input byte is
+ * copied. It is most efficient with large input and output buffers, which
+ * maximizes the opportunites to have a single copy from next_in to next_out.
+ */
+local block_state deflate_stored(s, flush)
+    deflate_state *s;
+    int flush;
+{
+    /* Smallest worthy block size when not flushing or finishing. By default
+     * this is 32K. This can be as small as 507 bytes for memLevel == 1. For
+     * large input and output buffers, the stored block size will be larger.
+     */
+    unsigned min_block = MIN(s->pending_buf_size - 5, s->w_size);
+
+    /* Copy as many min_block or larger stored blocks directly to next_out as
+     * possible. If flushing, copy the remaining available input to next_out as
+     * stored blocks, if there is enough space.
+     */
+    unsigned len, left, have, last = 0;
+    unsigned used = s->strm->avail_in;
+    do {
+        /* Set len to the maximum size block that we can copy directly with the
+         * available input data and output space. Set left to how much of that
+         * would be copied from what's left in the window.
+         */
+        len = MAX_STORED;       /* maximum deflate stored block length */
+        have = (s->bi_valid + 42) >> 3;         /* number of header bytes */
+        if (s->strm->avail_out < have)          /* need room for header */
+            break;
+            /* maximum stored block length that will fit in avail_out: */
+        have = s->strm->avail_out - have;
+        left = s->strstart - s->block_start;    /* bytes left in window */
+        if (len > (ulg)left + s->strm->avail_in)
+            len = left + s->strm->avail_in;     /* limit len to the input */
+        if (len > have)
+            len = have;                         /* limit len to the output */
+
+        /* If the stored block would be less than min_block in length, or if
+         * unable to copy all of the available input when flushing, then try
+         * copying to the window and the pending buffer instead. Also don't
+         * write an empty block when flushing -- deflate() does that.
+         */
+        if (len < min_block && ((len == 0 && flush != Z_FINISH) ||
+                                flush == Z_NO_FLUSH ||
+                                len != left + s->strm->avail_in))
+            break;
+
+        /* Make a dummy stored block in pending to get the header bytes,
+         * including any pending bits. This also updates the debugging counts.
+         */
+        last = flush == Z_FINISH && len == left + s->strm->avail_in ? 1 : 0;
+        _tr_stored_block(s, (char *)0, 0L, last);
+
+        /* Replace the lengths in the dummy stored block with len. */
+        s->pending_buf[s->pending - 4] = len;
+        s->pending_buf[s->pending - 3] = len >> 8;
+        s->pending_buf[s->pending - 2] = ~len;
+        s->pending_buf[s->pending - 1] = ~len >> 8;
+
+        /* Write the stored block header bytes. */
+        flush_pending(s->strm);
+
+#ifdef ZLIB_DEBUG
+        /* Update debugging counts for the data about to be copied. */
+        s->compressed_len += len << 3;
+        s->bits_sent += len << 3;
+#endif
+
+        /* Copy uncompressed bytes from the window to next_out. */
+        if (left) {
+            if (left > len)
+                left = len;
+            zmemcpy(s->strm->next_out, s->window + s->block_start, left);
+            s->strm->next_out += left;
+            s->strm->avail_out -= left;
+            s->strm->total_out += left;
+            s->block_start += left;
+            len -= left;
+        }
+
+        /* Copy uncompressed bytes directly from next_in to next_out, updating
+         * the check value.
+         */
+        if (len) {
+            deflate_read_buf(s->strm, s->strm->next_out, len);
+            s->strm->next_out += len;
+            s->strm->avail_out -= len;
+            s->strm->total_out += len;
+        }
+    } while (last == 0);
+
+    /* Update the sliding window with the last s->w_size bytes of the copied
+     * data, or append all of the copied data to the existing window if less
+     * than s->w_size bytes were copied. Also update the number of bytes to
+     * insert in the hash tables, in the event that deflateParams() switches to
+     * a non-zero compression level.
+     */
+    used -= s->strm->avail_in;      /* number of input bytes directly copied */
+    if (used) {
+        /* If any input was used, then no unused input remains in the window,
+         * therefore s->block_start == s->strstart.
+         */
+        if (used >= s->w_size) {    /* supplant the previous history */
+            s->matches = 2;         /* clear hash */
+            zmemcpy(s->window, s->strm->next_in - s->w_size, s->w_size);
+            s->strstart = s->w_size;
+        }
+        else {
+            if (s->window_size - s->strstart <= used) {
+                /* Slide the window down. */
+                s->strstart -= s->w_size;
+                zmemcpy(s->window, s->window + s->w_size, s->strstart);
+                if (s->matches < 2)
+                    s->matches++;   /* add a pending slide_hash() */
+            }
+            zmemcpy(s->window + s->strstart, s->strm->next_in - used, used);
+            s->strstart += used;
+        }
+        s->block_start = s->strstart;
+        s->insert += MIN(used, s->w_size - s->insert);
+    }
+    if (s->high_water < s->strstart)
+        s->high_water = s->strstart;
+
+    /* If the last block was written to next_out, then done. */
+    if (last)
+        return finish_done;
+
+    /* If flushing and all input has been consumed, then done. */
+    if (flush != Z_NO_FLUSH && flush != Z_FINISH &&
+        s->strm->avail_in == 0 && (long)s->strstart == s->block_start)
+        return block_done;
+
+    /* Fill the window with any remaining input. */
+    have = s->window_size - s->strstart - 1;
+    if (s->strm->avail_in > have && s->block_start >= (long)s->w_size) {
+        /* Slide the window down. */
+        s->block_start -= s->w_size;
+        s->strstart -= s->w_size;
+        zmemcpy(s->window, s->window + s->w_size, s->strstart);
+        if (s->matches < 2)
+            s->matches++;           /* add a pending slide_hash() */
+        have += s->w_size;          /* more space now */
+    }
+    if (have > s->strm->avail_in)
+        have = s->strm->avail_in;
+    if (have) {
+        deflate_read_buf(s->strm, s->window + s->strstart, have);
+        s->strstart += have;
+    }
+    if (s->high_water < s->strstart)
+        s->high_water = s->strstart;
+
+    /* There was not enough avail_out to write a complete worthy or flushed
+     * stored block to next_out. Write a stored block to pending instead, if we
+     * have enough input for a worthy block, or if flushing and there is enough
+     * room for the remaining input as a stored block in the pending buffer.
+     */
+    have = (s->bi_valid + 42) >> 3;         /* number of header bytes */
+        /* maximum stored block length that will fit in pending: */
+    have = MIN(s->pending_buf_size - have, MAX_STORED);
+    min_block = MIN(have, s->w_size);
+    left = s->strstart - s->block_start;
+    if (left >= min_block ||
+        ((left || flush == Z_FINISH) && flush != Z_NO_FLUSH &&
+         s->strm->avail_in == 0 && left <= have)) {
+        len = MIN(left, have);
+        last = flush == Z_FINISH && s->strm->avail_in == 0 &&
+               len == left ? 1 : 0;
+        _tr_stored_block(s, (charf *)s->window + s->block_start, len, last);
+        s->block_start += len;
+        flush_pending(s->strm);
+    }
+
+    /* We've done all we can with the available input and output. */
+    return last ? finish_started : need_more;
+}
+
+/* ===========================================================================
+ * Compress as much as possible from the input stream, return the current
+ * block state.
+ * This function does not perform lazy evaluation of matches and inserts
+ * new strings in the dictionary only for unmatched strings or for short
+ * matches. It is used only for the fast compression options.
+ */
+local block_state deflate_fast(s, flush)
+    deflate_state *s;
+    int flush;
+{
+    IPos hash_head;       /* head of the hash chain */
+    int bflush;           /* set if current block must be flushed */
+
+    for (;;) {
+        /* Make sure that we always have enough lookahead, except
+         * at the end of the input file. We need MAX_MATCH bytes
+         * for the next match, plus MIN_MATCH bytes to insert the
+         * string following the next match.
+         */
+        if (s->lookahead < MIN_LOOKAHEAD) {
+            fill_window(s);
+            if (s->lookahead < MIN_LOOKAHEAD && flush == Z_NO_FLUSH) {
+                return need_more;
+            }
+            if (s->lookahead == 0) break; /* flush the current block */
+        }
+
+        /* Insert the string window[strstart .. strstart+2] in the
+         * dictionary, and set hash_head to the head of the hash chain:
+         */
+        hash_head = NIL;
+        if (s->lookahead >= MIN_MATCH) {
+            hash_head = insert_string(s, s->strstart);
+        }
+
+        /* Find the longest match, discarding those <= prev_length.
+         * At this point we have always match_length < MIN_MATCH
+         */
+        if (hash_head != NIL && s->strstart - hash_head <= MAX_DIST(s)) {
+            /* To simplify the code, we prevent matches with the string
+             * of window index 0 (in particular we have to avoid a match
+             * of the string with itself at the start of the input file).
+             */
+            s->match_length = longest_match (s, hash_head);
+            /* longest_match() sets match_start */
+        }
+        if (s->match_length >= MIN_MATCH) {
+            check_match(s, s->strstart, s->match_start, s->match_length);
+
+            _tr_tally_dist(s, s->strstart - s->match_start,
+                           s->match_length - MIN_MATCH, bflush);
+
+            s->lookahead -= s->match_length;
+
+            /* Insert new strings in the hash table only if the match length
+             * is not too large. This saves time but degrades compression.
+             */
+#ifndef FASTEST
+            if (s->match_length <= s->max_insert_length &&
+                s->lookahead >= MIN_MATCH) {
+                s->match_length--; /* string at strstart already in table */
+                do {
+                    s->strstart++;
+                    hash_head = insert_string(s, s->strstart);
+                    /* strstart never exceeds WSIZE-MAX_MATCH, so there are
+                     * always MIN_MATCH bytes ahead.
+                     */
+                } while (--s->match_length != 0);
+                s->strstart++;
+            } else
+#endif
+            {
+                s->strstart += s->match_length;
+                s->match_length = 0;
+                s->ins_h = s->window[s->strstart];
+                UPDATE_HASH(s, s->ins_h, s->window[s->strstart+1]);
+#if MIN_MATCH != 3
+                Call UPDATE_HASH() MIN_MATCH-3 more times
+#endif
+                /* If lookahead < MIN_MATCH, ins_h is garbage, but it does not
+                 * matter since it will be recomputed at next deflate call.
+                 */
+            }
+        } else {
+            /* No match, output a literal byte */
+            Tracevv((stderr,"%c", s->window[s->strstart]));
+            _tr_tally_lit (s, s->window[s->strstart], bflush);
+            s->lookahead--;
+            s->strstart++;
+        }
+        if (bflush) FLUSH_BLOCK(s, 0);
+    }
+    s->insert = s->strstart < MIN_MATCH-1 ? s->strstart : MIN_MATCH-1;
+    if (flush == Z_FINISH) {
+        FLUSH_BLOCK(s, 1);
+        return finish_done;
+    }
+    if (s->sym_next)
+        FLUSH_BLOCK(s, 0);
+    return block_done;
+}
+
+#ifndef FASTEST
+/* ===========================================================================
+ * Same as above, but achieves better compression. We use a lazy
+ * evaluation for matches: a match is finally adopted only if there is
+ * no better match at the next window position.
+ */
+local block_state deflate_slow(s, flush)
+    deflate_state *s;
+    int flush;
+{
+    IPos hash_head;          /* head of hash chain */
+    int bflush;              /* set if current block must be flushed */
+
+    /* Process the input block. */
+    for (;;) {
+        /* Make sure that we always have enough lookahead, except
+         * at the end of the input file. We need MAX_MATCH bytes
+         * for the next match, plus MIN_MATCH bytes to insert the
+         * string following the next match.
+         */
+        if (s->lookahead < MIN_LOOKAHEAD) {
+            fill_window(s);
+            if (s->lookahead < MIN_LOOKAHEAD && flush == Z_NO_FLUSH) {
+                return need_more;
+            }
+            if (s->lookahead == 0) break; /* flush the current block */
+        }
+
+        /* Insert the string window[strstart .. strstart+2] in the
+         * dictionary, and set hash_head to the head of the hash chain:
+         */
+        hash_head = NIL;
+        if (s->lookahead >= MIN_MATCH) {
+            hash_head = insert_string(s, s->strstart);
+        }
+
+        /* Find the longest match, discarding those <= prev_length.
+         */
+        s->prev_length = s->match_length, s->prev_match = s->match_start;
+        s->match_length = MIN_MATCH-1;
+
+        if (hash_head != NIL && s->prev_length < s->max_lazy_match &&
+            s->strstart - hash_head <= MAX_DIST(s)) {
+            /* To simplify the code, we prevent matches with the string
+             * of window index 0 (in particular we have to avoid a match
+             * of the string with itself at the start of the input file).
+             */
+            s->match_length = longest_match (s, hash_head);
+            /* longest_match() sets match_start */
+
+            if (s->match_length <= 5 && (s->strategy == Z_FILTERED
+#if TOO_FAR <= 32767
+                || (s->match_length == MIN_MATCH &&
+                    s->strstart - s->match_start > TOO_FAR)
+#endif
+                )) {
+
+                /* If prev_match is also MIN_MATCH, match_start is garbage
+                 * but we will ignore the current match anyway.
+                 */
+                s->match_length = MIN_MATCH-1;
+            }
+        }
+        /* If there was a match at the previous step and the current
+         * match is not better, output the previous match:
+         */
+        if (s->prev_length >= MIN_MATCH && s->match_length <= s->prev_length) {
+            uInt max_insert = s->strstart + s->lookahead - MIN_MATCH;
+            /* Do not insert strings in hash table beyond this. */
+
+            check_match(s, s->strstart-1, s->prev_match, s->prev_length);
+
+            _tr_tally_dist(s, s->strstart -1 - s->prev_match,
+                           s->prev_length - MIN_MATCH, bflush);
+
+            /* Insert in hash table all strings up to the end of the match.
+             * strstart-1 and strstart are already inserted. If there is not
+             * enough lookahead, the last two strings are not inserted in
+             * the hash table.
+             */
+            s->lookahead -= s->prev_length-1;
+            s->prev_length -= 2;
+            do {
+                if (++s->strstart <= max_insert) {
+                    hash_head = insert_string(s, s->strstart);
+                }
+            } while (--s->prev_length != 0);
+            s->match_available = 0;
+            s->match_length = MIN_MATCH-1;
+            s->strstart++;
+
+            if (bflush) FLUSH_BLOCK(s, 0);
+
+        } else if (s->match_available) {
+            /* If there was no match at the previous position, output a
+             * single literal. If there was a match but the current match
+             * is longer, truncate the previous match to a single literal.
+             */
+            Tracevv((stderr,"%c", s->window[s->strstart-1]));
+            _tr_tally_lit(s, s->window[s->strstart-1], bflush);
+            if (bflush) {
+                FLUSH_BLOCK_ONLY(s, 0);
+            }
+            s->strstart++;
+            s->lookahead--;
+            if (s->strm->avail_out == 0) return need_more;
+        } else {
+            /* There is no previous match to compare with, wait for
+             * the next step to decide.
+             */
+            s->match_available = 1;
+            s->strstart++;
+            s->lookahead--;
+        }
+    }
+    Assert (flush != Z_NO_FLUSH, "no flush?");
+    if (s->match_available) {
+        Tracevv((stderr,"%c", s->window[s->strstart-1]));
+        _tr_tally_lit(s, s->window[s->strstart-1], bflush);
+        s->match_available = 0;
+    }
+    s->insert = s->strstart < MIN_MATCH-1 ? s->strstart : MIN_MATCH-1;
+    if (flush == Z_FINISH) {
+        FLUSH_BLOCK(s, 1);
+        return finish_done;
+    }
+    if (s->sym_next)
+        FLUSH_BLOCK(s, 0);
+    return block_done;
+}
+#endif /* FASTEST */
+
+/* ===========================================================================
+ * For Z_RLE, simply look for runs of bytes, generate matches only of distance
+ * one.  Do not maintain a hash table.  (It will be regenerated if this run of
+ * deflate switches away from Z_RLE.)
+ */
+local block_state deflate_rle(s, flush)
+    deflate_state *s;
+    int flush;
+{
+    int bflush;             /* set if current block must be flushed */
+    uInt prev;              /* byte at distance one to match */
+    Bytef *scan, *strend;   /* scan goes up to strend for length of run */
+
+    for (;;) {
+        /* Make sure that we always have enough lookahead, except
+         * at the end of the input file. We need MAX_MATCH bytes
+         * for the longest run, plus one for the unrolled loop.
+         */
+        if (s->lookahead <= MAX_MATCH) {
+            fill_window(s);
+            if (s->lookahead <= MAX_MATCH && flush == Z_NO_FLUSH) {
+                return need_more;
+            }
+            if (s->lookahead == 0) break; /* flush the current block */
+        }
+
+        /* See how many times the previous byte repeats */
+        s->match_length = 0;
+        if (s->lookahead >= MIN_MATCH && s->strstart > 0) {
+            scan = s->window + s->strstart - 1;
+            prev = *scan;
+            if (prev == *++scan && prev == *++scan && prev == *++scan) {
+                strend = s->window + s->strstart + MAX_MATCH;
+                do {
+                } while (prev == *++scan && prev == *++scan &&
+                         prev == *++scan && prev == *++scan &&
+                         prev == *++scan && prev == *++scan &&
+                         prev == *++scan && prev == *++scan &&
+                         scan < strend);
+                s->match_length = MAX_MATCH - (uInt)(strend - scan);
+                if (s->match_length > s->lookahead)
+                    s->match_length = s->lookahead;
+            }
+            Assert(scan <= s->window+(uInt)(s->window_size-1), "wild scan");
+        }
+
+        /* Emit match if have run of MIN_MATCH or longer, else emit literal */
+        if (s->match_length >= MIN_MATCH) {
+            check_match(s, s->strstart, s->strstart - 1, s->match_length);
+
+            _tr_tally_dist(s, 1, s->match_length - MIN_MATCH, bflush);
+
+            s->lookahead -= s->match_length;
+            s->strstart += s->match_length;
+            s->match_length = 0;
+        } else {
+            /* No match, output a literal byte */
+            Tracevv((stderr,"%c", s->window[s->strstart]));
+            _tr_tally_lit (s, s->window[s->strstart], bflush);
+            s->lookahead--;
+            s->strstart++;
+        }
+        if (bflush) FLUSH_BLOCK(s, 0);
+    }
+    s->insert = 0;
+    if (flush == Z_FINISH) {
+        FLUSH_BLOCK(s, 1);
+        return finish_done;
+    }
+    if (s->sym_next)
+        FLUSH_BLOCK(s, 0);
+    return block_done;
+}
+
+/* ===========================================================================
+ * For Z_HUFFMAN_ONLY, do not look for matches.  Do not maintain a hash table.
+ * (It will be regenerated if this run of deflate switches away from Huffman.)
+ */
+local block_state deflate_huff(s, flush)
+    deflate_state *s;
+    int flush;
+{
+    int bflush;             /* set if current block must be flushed */
+
+    for (;;) {
+        /* Make sure that we have a literal to write. */
+        if (s->lookahead == 0) {
+            fill_window(s);
+            if (s->lookahead == 0) {
+                if (flush == Z_NO_FLUSH)
+                    return need_more;
+                break;      /* flush the current block */
+            }
+        }
+
+        /* Output a literal byte */
+        s->match_length = 0;
+        Tracevv((stderr,"%c", s->window[s->strstart]));
+        _tr_tally_lit (s, s->window[s->strstart], bflush);
+        s->lookahead--;
+        s->strstart++;
+        if (bflush) FLUSH_BLOCK(s, 0);
+    }
+    s->insert = 0;
+    if (flush == Z_FINISH) {
+        FLUSH_BLOCK(s, 1);
+        return finish_done;
+    }
+    if (s->sym_next)
+        FLUSH_BLOCK(s, 0);
+    return block_done;
+}
diff --git a/deps/v8/third_party/zlib/deflate.h b/deps/v8/third_party/zlib/deflate.h
new file mode 100644
index 00000000000000..78ffb00a29768e
--- /dev/null
+++ b/deps/v8/third_party/zlib/deflate.h
@@ -0,0 +1,356 @@
+/* deflate.h -- internal compression state
+ * Copyright (C) 1995-2016 Jean-loup Gailly
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/* WARNING: this file should *not* be used by applications. It is
+   part of the implementation of the compression library and is
+   subject to change. Applications should only use zlib.h.
+ */
+
+/* @(#) $Id$ */
+
+#ifndef DEFLATE_H
+#define DEFLATE_H
+
+#include "zutil.h"
+
+/* define NO_GZIP when compiling if you want to disable gzip header and
+   trailer creation by deflate().  NO_GZIP would be used to avoid linking in
+   the crc code when it is not needed.  For shared libraries, gzip encoding
+   should be left enabled. */
+#ifndef NO_GZIP
+#  define GZIP
+#endif
+
+/* ===========================================================================
+ * Internal compression state.
+ */
+
+#define LENGTH_CODES 29
+/* number of length codes, not counting the special END_BLOCK code */
+
+#define LITERALS  256
+/* number of literal bytes 0..255 */
+
+#define L_CODES (LITERALS+1+LENGTH_CODES)
+/* number of Literal or Length codes, including the END_BLOCK code */
+
+#define D_CODES   30
+/* number of distance codes */
+
+#define BL_CODES  19
+/* number of codes used to transfer the bit lengths */
+
+#define HEAP_SIZE (2*L_CODES+1)
+/* maximum heap size */
+
+#define MAX_BITS 15
+/* All codes must not exceed MAX_BITS bits */
+
+#define Buf_size 16
+/* size of bit buffer in bi_buf */
+
+#define INIT_STATE    42    /* zlib header -> BUSY_STATE */
+#ifdef GZIP
+#  define GZIP_STATE  57    /* gzip header -> BUSY_STATE | EXTRA_STATE */
+#endif
+#define EXTRA_STATE   69    /* gzip extra block -> NAME_STATE */
+#define NAME_STATE    73    /* gzip file name -> COMMENT_STATE */
+#define COMMENT_STATE 91    /* gzip comment -> HCRC_STATE */
+#define HCRC_STATE   103    /* gzip header CRC -> BUSY_STATE */
+#define BUSY_STATE   113    /* deflate -> FINISH_STATE */
+#define FINISH_STATE 666    /* stream complete */
+/* Stream status */
+
+
+/* Data structure describing a single value and its code string. */
+typedef struct ct_data_s {
+    union {
+        ush  freq;       /* frequency count */
+        ush  code;       /* bit string */
+    } fc;
+    union {
+        ush  dad;        /* father node in Huffman tree */
+        ush  len;        /* length of bit string */
+    } dl;
+} FAR ct_data;
+
+#define Freq fc.freq
+#define Code fc.code
+#define Dad  dl.dad
+#define Len  dl.len
+
+typedef struct static_tree_desc_s  static_tree_desc;
+
+typedef struct tree_desc_s {
+    ct_data *dyn_tree;           /* the dynamic tree */
+    int     max_code;            /* largest code with non zero frequency */
+    const static_tree_desc *stat_desc;  /* the corresponding static tree */
+} FAR tree_desc;
+
+typedef ush Pos;
+typedef Pos FAR Posf;
+typedef unsigned IPos;
+
+/* A Pos is an index in the character window. We use short instead of int to
+ * save space in the various tables. IPos is used only for parameter passing.
+ */
+
+typedef struct internal_state {
+    z_streamp strm;      /* pointer back to this zlib stream */
+    int   status;        /* as the name implies */
+    Bytef *pending_buf;  /* output still pending */
+    ulg   pending_buf_size; /* size of pending_buf */
+    Bytef *pending_out;  /* next pending byte to output to the stream */
+    ulg   pending;       /* nb of bytes in the pending buffer */
+    int   wrap;          /* bit 0 true for zlib, bit 1 true for gzip */
+    gz_headerp  gzhead;  /* gzip header information to write */
+    ulg   gzindex;       /* where in extra, name, or comment */
+    Byte  method;        /* can only be DEFLATED */
+    int   last_flush;    /* value of flush param for previous deflate call */
+    unsigned crc0[4 * 5];
+    /* used by deflate.c: */
+
+    uInt  w_size;        /* LZ77 window size (32K by default) */
+    uInt  w_bits;        /* log2(w_size)  (8..16) */
+    uInt  w_mask;        /* w_size - 1 */
+
+    Bytef *window;
+    /* Sliding window. Input bytes are read into the second half of the window,
+     * and move to the first half later to keep a dictionary of at least wSize
+     * bytes. With this organization, matches are limited to a distance of
+     * wSize-MAX_MATCH bytes, but this ensures that IO is always
+     * performed with a length multiple of the block size. Also, it limits
+     * the window size to 64K, which is quite useful on MSDOS.
+     * To do: use the user input buffer as sliding window.
+     */
+
+    ulg window_size;
+    /* Actual size of window: 2*wSize, except when the user input buffer
+     * is directly used as sliding window.
+     */
+
+    Posf *prev;
+    /* Link to older string with same hash index. To limit the size of this
+     * array to 64K, this link is maintained only for the last 32K strings.
+     * An index in this array is thus a window index modulo 32K.
+     */
+
+    Posf *head; /* Heads of the hash chains or NIL. */
+
+    uInt  ins_h;          /* hash index of string to be inserted */
+    uInt  hash_size;      /* number of elements in hash table */
+    uInt  hash_bits;      /* log2(hash_size) */
+    uInt  hash_mask;      /* hash_size-1 */
+
+    uInt  hash_shift;
+    /* Number of bits by which ins_h must be shifted at each input
+     * step. It must be such that after MIN_MATCH steps, the oldest
+     * byte no longer takes part in the hash key, that is:
+     *   hash_shift * MIN_MATCH >= hash_bits
+     */
+
+    long block_start;
+    /* Window position at the beginning of the current output block. Gets
+     * negative when the window is moved backwards.
+     */
+
+    uInt match_length;           /* length of best match */
+    IPos prev_match;             /* previous match */
+    int match_available;         /* set if previous match exists */
+    uInt strstart;               /* start of string to insert */
+    uInt match_start;            /* start of matching string */
+    uInt lookahead;              /* number of valid bytes ahead in window */
+
+    uInt prev_length;
+    /* Length of the best match at previous step. Matches not greater than this
+     * are discarded. This is used in the lazy match evaluation.
+     */
+
+    uInt max_chain_length;
+    /* To speed up deflation, hash chains are never searched beyond this
+     * length.  A higher limit improves compression ratio but degrades the
+     * speed.
+     */
+
+    uInt max_lazy_match;
+    /* Attempt to find a better match only when the current match is strictly
+     * smaller than this value. This mechanism is used only for compression
+     * levels >= 4.
+     */
+#   define max_insert_length  max_lazy_match
+    /* Insert new strings in the hash table only if the match length is not
+     * greater than this length. This saves time but degrades compression.
+     * max_insert_length is used only for compression levels <= 3.
+     */
+
+    int level;    /* compression level (1..9) */
+    int strategy; /* favor or force Huffman coding*/
+
+    uInt good_match;
+    /* Use a faster search when the previous match is longer than this */
+
+    int nice_match; /* Stop searching when current match exceeds this */
+
+                /* used by trees.c: */
+    /* Didn't use ct_data typedef below to suppress compiler warning */
+    struct ct_data_s dyn_ltree[HEAP_SIZE];   /* literal and length tree */
+    struct ct_data_s dyn_dtree[2*D_CODES+1]; /* distance tree */
+    struct ct_data_s bl_tree[2*BL_CODES+1];  /* Huffman tree for bit lengths */
+
+    struct tree_desc_s l_desc;               /* desc. for literal tree */
+    struct tree_desc_s d_desc;               /* desc. for distance tree */
+    struct tree_desc_s bl_desc;              /* desc. for bit length tree */
+
+    ush bl_count[MAX_BITS+1];
+    /* number of codes at each bit length for an optimal tree */
+
+    int heap[2*L_CODES+1];      /* heap used to build the Huffman trees */
+    int heap_len;               /* number of elements in the heap */
+    int heap_max;               /* element of largest frequency */
+    /* The sons of heap[n] are heap[2*n] and heap[2*n+1]. heap[0] is not used.
+     * The same heap array is used to build all trees.
+     */
+
+    uch depth[2*L_CODES+1];
+    /* Depth of each subtree used as tie breaker for trees of equal frequency
+     */
+
+    uchf *sym_buf;        /* buffer for distances and literals/lengths */
+
+    uInt  lit_bufsize;
+    /* Size of match buffer for literals/lengths.  There are 4 reasons for
+     * limiting lit_bufsize to 64K:
+     *   - frequencies can be kept in 16 bit counters
+     *   - if compression is not successful for the first block, all input
+     *     data is still in the window so we can still emit a stored block even
+     *     when input comes from standard input.  (This can also be done for
+     *     all blocks if lit_bufsize is not greater than 32K.)
+     *   - if compression is not successful for a file smaller than 64K, we can
+     *     even emit a stored file instead of a stored block (saving 5 bytes).
+     *     This is applicable only for zip (not gzip or zlib).
+     *   - creating new Huffman trees less frequently may not provide fast
+     *     adaptation to changes in the input data statistics. (Take for
+     *     example a binary file with poorly compressible code followed by
+     *     a highly compressible string table.) Smaller buffer sizes give
+     *     fast adaptation but have of course the overhead of transmitting
+     *     trees more frequently.
+     *   - I can't count above 4
+     */
+
+    uInt sym_next;      /* running index in sym_buf */
+    uInt sym_end;       /* symbol table full when sym_next reaches this */
+
+    ulg opt_len;        /* bit length of current block with optimal trees */
+    ulg static_len;     /* bit length of current block with static trees */
+    uInt matches;       /* number of string matches in current block */
+    uInt insert;        /* bytes at end of window left to insert */
+
+#ifdef ZLIB_DEBUG
+    ulg compressed_len; /* total bit length of compressed file mod 2^32 */
+    ulg bits_sent;      /* bit length of compressed data sent mod 2^32 */
+#endif
+
+    ush bi_buf;
+    /* Output buffer. bits are inserted starting at the bottom (least
+     * significant bits).
+     */
+    int bi_valid;
+    /* Number of valid bits in bi_buf.  All bits above the last valid bit
+     * are always zero.
+     */
+
+    ulg high_water;
+    /* High water mark offset in window for initialized bytes -- bytes above
+     * this are set to zero in order to avoid memory check warnings when
+     * longest match routines access bytes past the input.  This is then
+     * updated to the new high water mark.
+     */
+
+} FAR deflate_state;
+
+/* Output a byte on the stream.
+ * IN assertion: there is enough room in pending_buf.
+ */
+#define put_byte(s, c) {s->pending_buf[s->pending++] = (Bytef)(c);}
+
+
+#define MIN_LOOKAHEAD (MAX_MATCH+MIN_MATCH+1)
+/* Minimum amount of lookahead, except at the end of the input file.
+ * See deflate.c for comments about the MIN_MATCH+1.
+ */
+
+#define MAX_DIST(s)  ((s)->w_size-MIN_LOOKAHEAD)
+/* In order to simplify the code, particularly on 16 bit machines, match
+ * distances are limited to MAX_DIST instead of WSIZE.
+ */
+
+#define WIN_INIT MAX_MATCH
+/* Number of bytes after end of data in window to initialize in order to avoid
+   memory checker errors from longest match routines */
+
+        /* in trees.c */
+void ZLIB_INTERNAL _tr_init OF((deflate_state *s));
+int ZLIB_INTERNAL _tr_tally OF((deflate_state *s, unsigned dist, unsigned lc));
+void ZLIB_INTERNAL _tr_flush_block OF((deflate_state *s, charf *buf,
+                        ulg stored_len, int last));
+void ZLIB_INTERNAL _tr_flush_bits OF((deflate_state *s));
+void ZLIB_INTERNAL _tr_align OF((deflate_state *s));
+void ZLIB_INTERNAL _tr_stored_block OF((deflate_state *s, charf *buf,
+                        ulg stored_len, int last));
+
+#define d_code(dist) \
+   ((dist) < 256 ? _dist_code[dist] : _dist_code[256+((dist)>>7)])
+/* Mapping from a distance to a distance code. dist is the distance - 1 and
+ * must not have side effects. _dist_code[256] and _dist_code[257] are never
+ * used.
+ */
+
+#ifndef ZLIB_DEBUG
+/* Inline versions of _tr_tally for speed: */
+
+#if defined(GEN_TREES_H) || !defined(STDC)
+  extern uch ZLIB_INTERNAL _length_code[];
+  extern uch ZLIB_INTERNAL _dist_code[];
+#else
+  extern const uch ZLIB_INTERNAL _length_code[];
+  extern const uch ZLIB_INTERNAL _dist_code[];
+#endif
+
+# define _tr_tally_lit(s, c, flush) \
+  { uch cc = (c); \
+    s->sym_buf[s->sym_next++] = 0; \
+    s->sym_buf[s->sym_next++] = 0; \
+    s->sym_buf[s->sym_next++] = cc; \
+    s->dyn_ltree[cc].Freq++; \
+    flush = (s->sym_next == s->sym_end); \
+   }
+# define _tr_tally_dist(s, distance, length, flush) \
+  { uch len = (uch)(length); \
+    ush dist = (ush)(distance); \
+    s->sym_buf[s->sym_next++] = dist; \
+    s->sym_buf[s->sym_next++] = dist >> 8; \
+    s->sym_buf[s->sym_next++] = len; \
+    dist--; \
+    s->dyn_ltree[_length_code[len]+LITERALS+1].Freq++; \
+    s->dyn_dtree[d_code(dist)].Freq++; \
+    flush = (s->sym_next == s->sym_end); \
+  }
+#else
+# define _tr_tally_lit(s, c, flush) flush = _tr_tally(s, 0, c)
+# define _tr_tally_dist(s, distance, length, flush) \
+              flush = _tr_tally(s, distance, length)
+#endif
+
+/* Functions that are SIMD optimised on x86 */
+void ZLIB_INTERNAL crc_fold_init(deflate_state* const s);
+void ZLIB_INTERNAL crc_fold_copy(deflate_state* const s,
+                                 unsigned char* dst,
+                                 const unsigned char* src,
+                                 long len);
+unsigned ZLIB_INTERNAL crc_fold_512to32(deflate_state* const s);
+
+void ZLIB_INTERNAL fill_window_sse(deflate_state* s);
+
+#endif /* DEFLATE_H */
diff --git a/deps/v8/third_party/zlib/fill_window_sse.c b/deps/v8/third_party/zlib/fill_window_sse.c
new file mode 100644
index 00000000000000..ed1e5d1d6735b1
--- /dev/null
+++ b/deps/v8/third_party/zlib/fill_window_sse.c
@@ -0,0 +1,177 @@
+/*
+ * Fill Window with SSE2-optimized hash shifting
+ *
+ * Copyright (C) 2013 Intel Corporation
+ * Authors:
+ *  Arjan van de Ven    <arjan@linux.intel.com>
+ *  Jim Kukunas         <james.t.kukunas@linux.intel.com>
+ *
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+#include <immintrin.h>
+#include "deflate.h"
+
+#define UPDATE_HASH(s,h,i) \
+    {\
+        if (s->level < 6) { \
+            h = (3483 * (s->window[i]) +\
+                 23081* (s->window[i+1]) +\
+                 6954 * (s->window[i+2]) +\
+                 20947* (s->window[i+3])) & s->hash_mask;\
+        } else {\
+            h = (25881* (s->window[i]) +\
+                 24674* (s->window[i+1]) +\
+                 25811* (s->window[i+2])) & s->hash_mask;\
+        }\
+    }\
+
+extern int deflate_read_buf OF((z_streamp strm, Bytef *buf, unsigned size));
+
+void fill_window_sse(deflate_state *s)
+{
+    const __m128i xmm_wsize = _mm_set1_epi16(s->w_size);
+
+    register unsigned n;
+    register Posf *p;
+    unsigned more;    /* Amount of free space at the end of the window. */
+    uInt wsize = s->w_size;
+
+    Assert(s->lookahead < MIN_LOOKAHEAD, "already enough lookahead");
+
+    do {
+        more = (unsigned)(s->window_size -(ulg)s->lookahead -(ulg)s->strstart);
+
+        /* Deal with !@#$% 64K limit: */
+        if (sizeof(int) <= 2) {
+            if (more == 0 && s->strstart == 0 && s->lookahead == 0) {
+                more = wsize;
+
+            } else if (more == (unsigned)(-1)) {
+                /* Very unlikely, but possible on 16 bit machine if
+                 * strstart == 0 && lookahead == 1 (input done a byte at time)
+                 */
+                more--;
+            }
+        }
+
+        /* If the window is almost full and there is insufficient lookahead,
+         * move the upper half to the lower one to make room in the upper half.
+         */
+        if (s->strstart >= wsize+MAX_DIST(s)) {
+
+            zmemcpy(s->window, s->window+wsize, (unsigned)wsize);
+            s->match_start -= wsize;
+            s->strstart    -= wsize; /* we now have strstart >= MAX_DIST */
+            s->block_start -= (long) wsize;
+
+            /* Slide the hash table (could be avoided with 32 bit values
+               at the expense of memory usage). We slide even when level == 0
+               to keep the hash table consistent if we switch back to level > 0
+               later. (Using level 0 permanently is not an optimal usage of
+               zlib, so we don't care about this pathological case.)
+             */
+            n = s->hash_size;
+            p = &s->head[n];
+            p -= 8;
+            do {
+                __m128i value, result;
+
+                value = _mm_loadu_si128((__m128i *)p);
+                result = _mm_subs_epu16(value, xmm_wsize);
+                _mm_storeu_si128((__m128i *)p, result);
+
+                p -= 8;
+                n -= 8;
+            } while (n > 0);
+
+            n = wsize;
+#ifndef FASTEST
+            p = &s->prev[n];
+            p -= 8;
+            do {
+                __m128i value, result;
+
+                value = _mm_loadu_si128((__m128i *)p);
+                result = _mm_subs_epu16(value, xmm_wsize);
+                _mm_storeu_si128((__m128i *)p, result);
+
+                p -= 8;
+                n -= 8;
+            } while (n > 0);
+#endif
+            more += wsize;
+        }
+        if (s->strm->avail_in == 0) break;
+
+        /* If there was no sliding:
+         *    strstart <= WSIZE+MAX_DIST-1 && lookahead <= MIN_LOOKAHEAD - 1 &&
+         *    more == window_size - lookahead - strstart
+         * => more >= window_size - (MIN_LOOKAHEAD-1 + WSIZE + MAX_DIST-1)
+         * => more >= window_size - 2*WSIZE + 2
+         * In the BIG_MEM or MMAP case (not yet supported),
+         *   window_size == input_size + MIN_LOOKAHEAD  &&
+         *   strstart + s->lookahead <= input_size => more >= MIN_LOOKAHEAD.
+         * Otherwise, window_size == 2*WSIZE so more >= 2.
+         * If there was sliding, more >= WSIZE. So in all cases, more >= 2.
+         */
+        Assert(more >= 2, "more < 2");
+
+        n = deflate_read_buf(s->strm,
+                             s->window + s->strstart + s->lookahead,
+                             more);
+        s->lookahead += n;
+
+        /* Initialize the hash value now that we have some input: */
+        if (s->lookahead >= MIN_MATCH) {
+            uInt str = s->strstart;
+            s->ins_h = s->window[str];
+            if (str >= 1)
+                UPDATE_HASH(s, s->ins_h, str + 1 - (MIN_MATCH-1));
+#if MIN_MATCH != 3
+            Call UPDATE_HASH() MIN_MATCH-3 more times
+#endif
+        }
+        /* If the whole input has less than MIN_MATCH bytes, ins_h is garbage,
+         * but this is not important since only literal bytes will be emitted.
+         */
+
+    } while (s->lookahead < MIN_LOOKAHEAD && s->strm->avail_in != 0);
+
+    /* If the WIN_INIT bytes after the end of the current data have never been
+     * written, then zero those bytes in order to avoid memory check reports of
+     * the use of uninitialized (or uninitialised as Julian writes) bytes by
+     * the longest match routines.  Update the high water mark for the next
+     * time through here.  WIN_INIT is set to MAX_MATCH since the longest match
+     * routines allow scanning to strstart + MAX_MATCH, ignoring lookahead.
+     */
+    if (s->high_water < s->window_size) {
+        ulg curr = s->strstart + (ulg)(s->lookahead);
+        ulg init;
+
+        if (s->high_water < curr) {
+            /* Previous high water mark below current data -- zero WIN_INIT
+             * bytes or up to end of window, whichever is less.
+             */
+            init = s->window_size - curr;
+            if (init > WIN_INIT)
+                init = WIN_INIT;
+            zmemzero(s->window + curr, (unsigned)init);
+            s->high_water = curr + init;
+        }
+        else if (s->high_water < (ulg)curr + WIN_INIT) {
+            /* High water mark at or above current data, but below current data
+             * plus WIN_INIT -- zero out to current data plus WIN_INIT, or up
+             * to end of window, whichever is less.
+             */
+            init = (ulg)curr + WIN_INIT - s->high_water;
+            if (init > s->window_size - s->high_water)
+                init = s->window_size - s->high_water;
+            zmemzero(s->window + s->high_water, (unsigned)init);
+            s->high_water += init;
+        }
+    }
+
+    Assert((ulg)s->strstart <= s->window_size - MIN_LOOKAHEAD,
+           "not enough room for search");
+}
diff --git a/deps/v8/third_party/zlib/google/BUILD.gn b/deps/v8/third_party/zlib/google/BUILD.gn
new file mode 100644
index 00000000000000..a628d2f2d0d23c
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/BUILD.gn
@@ -0,0 +1,46 @@
+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//build_overrides/build.gni")
+
+if (build_with_chromium) {
+  static_library("zip") {
+    sources = [
+      "zip.cc",
+      "zip.h",
+      "zip_internal.cc",
+      "zip_internal.h",
+      "zip_reader.cc",
+      "zip_reader.h",
+      "zip_writer.cc",
+      "zip_writer.h",
+    ]
+    deps = [
+      "//base",
+      "//third_party/zlib:minizip",
+    ]
+  }
+
+  static_library("compression_utils") {
+    sources = [
+      "compression_utils.cc",
+      "compression_utils.h",
+    ]
+    deps = [
+      ":compression_utils_portable",
+      "//base",
+      "//third_party/zlib",
+    ]
+  }
+}
+
+# This allows other users of Chromium's zlib library, but don't use Chromium's
+# //base, to reuse some boilerplate code.
+static_library("compression_utils_portable") {
+  sources = [
+    "compression_utils_portable.cc",
+    "compression_utils_portable.h",
+  ]
+  deps = [ "//third_party/zlib" ]
+}
diff --git a/deps/v8/third_party/zlib/google/DEPS b/deps/v8/third_party/zlib/google/DEPS
new file mode 100644
index 00000000000000..144fbd149295b3
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/DEPS
@@ -0,0 +1,5 @@
+include_rules = [
+  '+base',
+  '+build',
+  '+testing',
+]
diff --git a/deps/v8/third_party/zlib/google/OWNERS b/deps/v8/third_party/zlib/google/OWNERS
new file mode 100644
index 00000000000000..1ca25314631124
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/OWNERS
@@ -0,0 +1,5 @@
+satorux@chromium.org
+
+# compression_utils*
+asvitkine@chromium.org
+isherman@chromium.org
diff --git a/deps/v8/third_party/zlib/google/compression_utils.cc b/deps/v8/third_party/zlib/google/compression_utils.cc
new file mode 100644
index 00000000000000..9f63a840167d47
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/compression_utils.cc
@@ -0,0 +1,116 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/zlib/google/compression_utils.h"
+
+#include "base/bit_cast.h"
+#include "base/logging.h"
+#include "base/process/memory.h"
+#include "base/strings/string_piece.h"
+#include "base/sys_byteorder.h"
+
+#include "third_party/zlib/google/compression_utils_portable.h"
+
+namespace compression {
+
+bool GzipCompress(base::StringPiece input,
+                  char* output_buffer,
+                  size_t output_buffer_size,
+                  size_t* compressed_size,
+                  void* (*malloc_fn)(size_t),
+                  void (*free_fn)(void*)) {
+  static_assert(sizeof(Bytef) == 1, "");
+
+  // uLongf can be larger than size_t.
+  uLongf compressed_size_long = static_cast<uLongf>(output_buffer_size);
+  if (zlib_internal::GzipCompressHelper(
+          bit_cast<Bytef*>(output_buffer), &compressed_size_long,
+          bit_cast<const Bytef*>(input.data()),
+          static_cast<uLongf>(input.size()), malloc_fn, free_fn) != Z_OK) {
+    return false;
+  }
+  // No overflow, as compressed_size_long <= output.size() which is a size_t.
+  *compressed_size = static_cast<size_t>(compressed_size_long);
+  return true;
+}
+
+bool GzipCompress(base::StringPiece input, std::string* output) {
+  // Not using std::vector<> because allocation failures are recoverable,
+  // which is hidden by std::vector<>.
+  static_assert(sizeof(Bytef) == 1, "");
+  const uLongf input_size = static_cast<uLongf>(input.size());
+
+  uLongf compressed_data_size =
+      zlib_internal::GzipExpectedCompressedSize(input_size);
+
+  Bytef* compressed_data;
+  if (!base::UncheckedMalloc(compressed_data_size,
+                             reinterpret_cast<void**>(&compressed_data))) {
+    return false;
+  }
+
+  if (zlib_internal::GzipCompressHelper(compressed_data, &compressed_data_size,
+                                        bit_cast<const Bytef*>(input.data()),
+                                        input_size, nullptr, nullptr) != Z_OK) {
+    free(compressed_data);
+    return false;
+  }
+
+  Bytef* resized_data =
+      reinterpret_cast<Bytef*>(realloc(compressed_data, compressed_data_size));
+  if (!resized_data) {
+    free(compressed_data);
+    return false;
+  }
+  output->assign(resized_data, resized_data + compressed_data_size);
+  DCHECK_EQ(input_size, GetUncompressedSize(*output));
+
+  free(resized_data);
+  return true;
+}
+
+bool GzipUncompress(const std::string& input, std::string* output) {
+  std::string uncompressed_output;
+  uLongf uncompressed_size = static_cast<uLongf>(GetUncompressedSize(input));
+  if (uncompressed_size > uncompressed_output.max_size())
+    return false;
+
+  uncompressed_output.resize(uncompressed_size);
+  if (zlib_internal::GzipUncompressHelper(
+          bit_cast<Bytef*>(uncompressed_output.data()), &uncompressed_size,
+          bit_cast<const Bytef*>(input.data()),
+          static_cast<uLongf>(input.length())) == Z_OK) {
+    output->swap(uncompressed_output);
+    return true;
+  }
+  return false;
+}
+
+bool GzipUncompress(base::StringPiece input, base::StringPiece output) {
+  uLongf uncompressed_size = GetUncompressedSize(input);
+  if (uncompressed_size > output.size())
+    return false;
+  return zlib_internal::GzipUncompressHelper(
+             bit_cast<Bytef*>(output.data()), &uncompressed_size,
+             bit_cast<const Bytef*>(input.data()),
+             static_cast<uLongf>(input.length())) == Z_OK;
+}
+
+bool GzipUncompress(base::StringPiece input, std::string* output) {
+  // Disallow in-place usage, i.e., |input| using |*output| as underlying data.
+  DCHECK_NE(input.data(), output->data());
+  uLongf uncompressed_size = GetUncompressedSize(input);
+  output->resize(uncompressed_size);
+  return zlib_internal::GzipUncompressHelper(
+             bit_cast<Bytef*>(output->data()), &uncompressed_size,
+             bit_cast<const Bytef*>(input.data()),
+             static_cast<uLongf>(input.length())) == Z_OK;
+}
+
+uint32_t GetUncompressedSize(base::StringPiece compressed_data) {
+  return zlib_internal::GetGzipUncompressedSize(
+      bit_cast<Bytef*>(compressed_data.data()), compressed_data.length());
+}
+
+}  // namespace compression
diff --git a/deps/v8/third_party/zlib/google/compression_utils.h b/deps/v8/third_party/zlib/google/compression_utils.h
new file mode 100644
index 00000000000000..516220719ff43c
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/compression_utils.h
@@ -0,0 +1,56 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_ZLIB_GOOGLE_COMPRESSION_UTILS_H_
+#define THIRD_PARTY_ZLIB_GOOGLE_COMPRESSION_UTILS_H_
+
+#include <string>
+
+#include "base/strings/string_piece.h"
+
+namespace compression {
+
+// Compresses the data in |input| using gzip, storing the result in
+// |output_buffer|, of size |output_buffer_size|. If the buffer is large enough
+// and compression succeeds, |compressed_size| points to the compressed data
+// size after the call.
+// |malloc_fn| and |free_fn| are pointers to malloc() and free()-like functions,
+// or nullptr to use the standard ones.
+// Returns true for success.
+bool GzipCompress(base::StringPiece input,
+                  char* output_buffer,
+                  size_t output_buffer_size,
+                  size_t* compressed_size,
+                  void* (*malloc_fn)(size_t),
+                  void (*free_fn)(void*));
+
+// Compresses the data in |input| using gzip, storing the result in |output|.
+// |input| and |output| are allowed to point to the same string (in-place
+// operation).
+// Returns true for success.
+bool GzipCompress(base::StringPiece input, std::string* output);
+
+// Uncompresses the data in |input| using gzip, storing the result in |output|.
+// |input| and |output| are allowed to be the same string (in-place operation).
+// Returns true for success.
+bool GzipUncompress(const std::string& input, std::string* output);
+
+// Like the above method, but uses base::StringPiece to avoid allocations if
+// needed. |output|'s size must be at least as large as the return value from
+// GetUncompressedSize.
+// Returns true for success.
+bool GzipUncompress(base::StringPiece input, base::StringPiece output);
+
+// Uncompresses the data in |input| using gzip, and writes the results to
+// |output|, which must NOT be the underlying string of |input|, and is resized
+// if necessary.
+// Returns true for success.
+bool GzipUncompress(base::StringPiece input, std::string* output);
+
+// Returns the uncompressed size from GZIP-compressed |compressed_data|.
+uint32_t GetUncompressedSize(base::StringPiece compressed_data);
+
+}  // namespace compression
+
+#endif  // THIRD_PARTY_ZLIB_GOOGLE_COMPRESSION_UTILS_H_
diff --git a/deps/v8/third_party/zlib/google/compression_utils_portable.cc b/deps/v8/third_party/zlib/google/compression_utils_portable.cc
new file mode 100644
index 00000000000000..191e349e31ad30
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/compression_utils_portable.cc
@@ -0,0 +1,205 @@
+/* compression_utils_portable.cc
+ *
+ * Copyright 2019 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the Chromium source repository LICENSE file.
+ */
+
+#include "third_party/zlib/google/compression_utils_portable.h"
+
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+namespace zlib_internal {
+
+// The difference in bytes between a zlib header and a gzip header.
+const size_t kGzipZlibHeaderDifferenceBytes = 16;
+
+// Pass an integer greater than the following get a gzip header instead of a
+// zlib header when calling deflateInit2() and inflateInit2().
+const int kWindowBitsToGetGzipHeader = 16;
+
+// This describes the amount of memory zlib uses to compress data. It can go
+// from 1 to 9, with 8 being the default. For details, see:
+// http://www.zlib.net/manual.html (search for memLevel).
+const int kZlibMemoryLevel = 8;
+
+// The expected compressed size is based on the input size factored by
+// internal Zlib constants (e.g. window size, etc) plus the wrapper
+// header size.
+uLongf GzipExpectedCompressedSize(uLongf input_size) {
+  return kGzipZlibHeaderDifferenceBytes + compressBound(input_size);
+}
+
+// The expected decompressed size is stored in the last
+// 4 bytes of |input| in LE. See https://tools.ietf.org/html/rfc1952#page-5
+uint32_t GetGzipUncompressedSize(const Bytef* compressed_data, size_t length) {
+  uint32_t size;
+  if (length < sizeof(size))
+    return 0;
+
+  memcpy(&size, &compressed_data[length - sizeof(size)], sizeof(size));
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+  return size;
+#else
+  return __builtin_bswap32(size);
+#endif
+}
+
+// The number of window bits determines the type of wrapper to use - see
+// https://cs.chromium.org/chromium/src/third_party/zlib/zlib.h?l=566
+inline int ZlibStreamWrapperType(WrapperType type) {
+  if (type == ZLIB)  // zlib DEFLATE stream wrapper
+    return MAX_WBITS;
+  if (type == GZIP)  // gzip DEFLATE stream wrapper
+    return MAX_WBITS + kWindowBitsToGetGzipHeader;
+  if (type == ZRAW)  // no wrapper, use raw DEFLATE
+    return -MAX_WBITS;
+  return 0;
+}
+
+int GzipCompressHelper(Bytef* dest,
+                       uLongf* dest_length,
+                       const Bytef* source,
+                       uLong source_length,
+                       void* (*malloc_fn)(size_t),
+                       void (*free_fn)(void*)) {
+  return CompressHelper(GZIP, dest, dest_length, source, source_length,
+                        Z_DEFAULT_COMPRESSION, malloc_fn, free_fn);
+}
+
+// This code is taken almost verbatim from third_party/zlib/compress.c. The only
+// difference is deflateInit2() is called which allows different window bits to
+// be set. > 16 causes a gzip header to be emitted rather than a zlib header,
+// and negative causes no header to emitted.
+//
+// Compression level can be a number from 1-9, with 1 being the fastest, 9 being
+// the best compression. The default, which the GZIP helper uses, is 6.
+int CompressHelper(WrapperType wrapper_type,
+                   Bytef* dest,
+                   uLongf* dest_length,
+                   const Bytef* source,
+                   uLong source_length,
+                   int compression_level,
+                   void* (*malloc_fn)(size_t),
+                   void (*free_fn)(void*)) {
+  if (compression_level < 1 || compression_level > 9) {
+    compression_level = Z_DEFAULT_COMPRESSION;
+  }
+
+  z_stream stream;
+
+  // FIXME(cavalcantii): z_const is not defined as 'const'.
+  stream.next_in = static_cast<z_const Bytef*>(const_cast<Bytef*>(source));
+  stream.avail_in = static_cast<uInt>(source_length);
+  stream.next_out = dest;
+  stream.avail_out = static_cast<uInt>(*dest_length);
+  if (static_cast<uLong>(stream.avail_out) != *dest_length)
+    return Z_BUF_ERROR;
+
+  // Cannot convert capturing lambdas to function pointers directly, hence the
+  // structure.
+  struct MallocFreeFunctions {
+    void* (*malloc_fn)(size_t);
+    void (*free_fn)(void*);
+  } malloc_free = {malloc_fn, free_fn};
+
+  if (malloc_fn) {
+    if (!free_fn)
+      return Z_BUF_ERROR;
+
+    auto zalloc = [](void* opaque, uInt items, uInt size) {
+      return reinterpret_cast<MallocFreeFunctions*>(opaque)->malloc_fn(items *
+                                                                       size);
+    };
+    auto zfree = [](void* opaque, void* address) {
+      return reinterpret_cast<MallocFreeFunctions*>(opaque)->free_fn(address);
+    };
+
+    stream.zalloc = static_cast<alloc_func>(zalloc);
+    stream.zfree = static_cast<free_func>(zfree);
+    stream.opaque = static_cast<voidpf>(&malloc_free);
+  } else {
+    stream.zalloc = static_cast<alloc_func>(0);
+    stream.zfree = static_cast<free_func>(0);
+    stream.opaque = static_cast<voidpf>(0);
+  }
+
+  int err = deflateInit2(&stream, compression_level, Z_DEFLATED,
+                         ZlibStreamWrapperType(wrapper_type), kZlibMemoryLevel,
+                         Z_DEFAULT_STRATEGY);
+  if (err != Z_OK)
+    return err;
+
+  // This has to exist outside of the if statement to prevent it going off the
+  // stack before deflate(), which will use this object.
+  gz_header gzip_header;
+  if (wrapper_type == GZIP) {
+    memset(&gzip_header, 0, sizeof(gzip_header));
+    err = deflateSetHeader(&stream, &gzip_header);
+    if (err != Z_OK)
+      return err;
+  }
+
+  err = deflate(&stream, Z_FINISH);
+  if (err != Z_STREAM_END) {
+    deflateEnd(&stream);
+    return err == Z_OK ? Z_BUF_ERROR : err;
+  }
+  *dest_length = stream.total_out;
+
+  err = deflateEnd(&stream);
+  return err;
+}
+
+int GzipUncompressHelper(Bytef* dest,
+                         uLongf* dest_length,
+                         const Bytef* source,
+                         uLong source_length) {
+  return UncompressHelper(GZIP, dest, dest_length, source, source_length);
+}
+
+// This code is taken almost verbatim from third_party/zlib/uncompr.c. The only
+// difference is inflateInit2() is called which allows different window bits to
+// be set. > 16 causes a gzip header to be emitted rather than a zlib header,
+// and negative causes no header to emitted.
+int UncompressHelper(WrapperType wrapper_type,
+                     Bytef* dest,
+                     uLongf* dest_length,
+                     const Bytef* source,
+                     uLong source_length) {
+  z_stream stream;
+
+  // FIXME(cavalcantii): z_const is not defined as 'const'.
+  stream.next_in = static_cast<z_const Bytef*>(const_cast<Bytef*>(source));
+  stream.avail_in = static_cast<uInt>(source_length);
+  if (static_cast<uLong>(stream.avail_in) != source_length)
+    return Z_BUF_ERROR;
+
+  stream.next_out = dest;
+  stream.avail_out = static_cast<uInt>(*dest_length);
+  if (static_cast<uLong>(stream.avail_out) != *dest_length)
+    return Z_BUF_ERROR;
+
+  stream.zalloc = static_cast<alloc_func>(0);
+  stream.zfree = static_cast<free_func>(0);
+
+  int err = inflateInit2(&stream, ZlibStreamWrapperType(wrapper_type));
+  if (err != Z_OK)
+    return err;
+
+  err = inflate(&stream, Z_FINISH);
+  if (err != Z_STREAM_END) {
+    inflateEnd(&stream);
+    if (err == Z_NEED_DICT || (err == Z_BUF_ERROR && stream.avail_in == 0))
+      return Z_DATA_ERROR;
+    return err;
+  }
+  *dest_length = stream.total_out;
+
+  err = inflateEnd(&stream);
+  return err;
+}
+
+}  // namespace zlib_internal
diff --git a/deps/v8/third_party/zlib/google/compression_utils_portable.h b/deps/v8/third_party/zlib/google/compression_utils_portable.h
new file mode 100644
index 00000000000000..cd004e86cf515c
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/compression_utils_portable.h
@@ -0,0 +1,59 @@
+/* compression_utils_portable.h
+ *
+ * Copyright 2019 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the Chromium source repository LICENSE file.
+ */
+#ifndef THIRD_PARTY_ZLIB_GOOGLE_COMPRESSION_UTILS_PORTABLE_H_
+#define THIRD_PARTY_ZLIB_GOOGLE_COMPRESSION_UTILS_PORTABLE_H_
+
+#include <stdint.h>
+
+#if defined(USE_SYSTEM_ZLIB)
+#include <zlib.h>
+#else
+#include "third_party/zlib/zlib.h"
+#endif
+
+namespace zlib_internal {
+
+enum WrapperType {
+  ZLIB,
+  GZIP,
+  ZRAW,
+};
+
+uLongf GzipExpectedCompressedSize(uLongf input_size);
+
+uint32_t GetGzipUncompressedSize(const Bytef* compressed_data, size_t length);
+
+int GzipCompressHelper(Bytef* dest,
+                       uLongf* dest_length,
+                       const Bytef* source,
+                       uLong source_length,
+                       void* (*malloc_fn)(size_t),
+                       void (*free_fn)(void*));
+
+int CompressHelper(WrapperType wrapper_type,
+                   Bytef* dest,
+                   uLongf* dest_length,
+                   const Bytef* source,
+                   uLong source_length,
+                   int compression_level,
+                   void* (*malloc_fn)(size_t),
+                   void (*free_fn)(void*));
+
+int GzipUncompressHelper(Bytef* dest,
+                         uLongf* dest_length,
+                         const Bytef* source,
+                         uLong source_length);
+
+int UncompressHelper(WrapperType wrapper_type,
+                     Bytef* dest,
+                     uLongf* dest_length,
+                     const Bytef* source,
+                     uLong source_length);
+
+}  // namespace zlib_internal
+
+#endif  // THIRD_PARTY_ZLIB_GOOGLE_COMPRESSION_UTILS_PORTABLE_H_
diff --git a/deps/v8/third_party/zlib/google/compression_utils_unittest.cc b/deps/v8/third_party/zlib/google/compression_utils_unittest.cc
new file mode 100644
index 00000000000000..b0e04b8c973633
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/compression_utils_unittest.cc
@@ -0,0 +1,104 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/zlib/google/compression_utils.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "base/logging.h"
+#include "base/stl_util.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace compression {
+
+namespace {
+
+// The data to be compressed by gzip. This is the hex representation of "hello
+// world".
+const uint8_t kData[] = {0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x20,
+                         0x77, 0x6f, 0x72, 0x6c, 0x64};
+
+// This is the string representation of gzip compressed string above. It was
+// obtained by running echo -n "hello world" | gzip -c | hexdump -e '8 1 ",
+// 0x%x"' followed by 0'ing out the OS byte (10th byte) in the header. This is
+// so that the test passes on all platforms (that run various OS'es).
+const uint8_t kCompressedData[] = {
+    0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xcb,
+    0x48, 0xcd, 0xc9, 0xc9, 0x57, 0x28, 0xcf, 0x2f, 0xca, 0x49, 0x01,
+    0x00, 0x85, 0x11, 0x4a, 0x0d, 0x0b, 0x00, 0x00, 0x00};
+
+}  // namespace
+
+TEST(CompressionUtilsTest, GzipCompression) {
+  std::string data(reinterpret_cast<const char*>(kData), base::size(kData));
+  std::string compressed_data;
+  EXPECT_TRUE(GzipCompress(data, &compressed_data));
+  std::string golden_compressed_data(
+      reinterpret_cast<const char*>(kCompressedData),
+      base::size(kCompressedData));
+  EXPECT_EQ(golden_compressed_data, compressed_data);
+}
+
+TEST(CompressionUtilsTest, GzipUncompression) {
+  std::string compressed_data(reinterpret_cast<const char*>(kCompressedData),
+                              base::size(kCompressedData));
+
+  std::string uncompressed_data;
+  EXPECT_TRUE(GzipUncompress(compressed_data, &uncompressed_data));
+
+  std::string golden_data(reinterpret_cast<const char*>(kData),
+                          base::size(kData));
+  EXPECT_EQ(golden_data, uncompressed_data);
+}
+
+TEST(CompressionUtilsTest, GzipUncompressionFromStringPieceToString) {
+  base::StringPiece compressed_data(
+      reinterpret_cast<const char*>(kCompressedData),
+      base::size(kCompressedData));
+
+  std::string uncompressed_data;
+  EXPECT_TRUE(GzipUncompress(compressed_data, &uncompressed_data));
+
+  std::string golden_data(reinterpret_cast<const char*>(kData),
+                          base::size(kData));
+  EXPECT_EQ(golden_data, uncompressed_data);
+}
+
+// Checks that compressing/decompressing input > 256 bytes works as expected.
+TEST(CompressionUtilsTest, LargeInput) {
+  const size_t kSize = 32 * 1024;
+
+  // Generate a data string of |kSize| for testing.
+  std::string data;
+  data.resize(kSize);
+  for (size_t i = 0; i < kSize; ++i)
+    data[i] = static_cast<char>(i & 0xFF);
+
+  std::string compressed_data;
+  EXPECT_TRUE(GzipCompress(data, &compressed_data));
+
+  std::string uncompressed_data;
+  EXPECT_TRUE(GzipUncompress(compressed_data, &uncompressed_data));
+
+  EXPECT_EQ(data, uncompressed_data);
+}
+
+TEST(CompressionUtilsTest, InPlace) {
+  const std::string original_data(reinterpret_cast<const char*>(kData),
+                                  base::size(kData));
+  const std::string golden_compressed_data(
+      reinterpret_cast<const char*>(kCompressedData),
+      base::size(kCompressedData));
+
+  std::string data(original_data);
+  EXPECT_TRUE(GzipCompress(data, &data));
+  EXPECT_EQ(golden_compressed_data, data);
+  EXPECT_TRUE(GzipUncompress(data, &data));
+  EXPECT_EQ(original_data, data);
+}
+
+}  // namespace compression
diff --git a/deps/v8/third_party/zlib/google/zip.cc b/deps/v8/third_party/zlib/google/zip.cc
new file mode 100644
index 00000000000000..907e5da72e974d
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/zip.cc
@@ -0,0 +1,271 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/zlib/google/zip.h"
+
+#include <list>
+#include <string>
+#include <vector>
+
+#include "base/bind.h"
+#include "base/files/file.h"
+#include "base/files/file_enumerator.h"
+#include "base/logging.h"
+#include "base/memory/ptr_util.h"
+#include "base/strings/string_util.h"
+#include "build/build_config.h"
+#include "third_party/zlib/google/zip_internal.h"
+#include "third_party/zlib/google/zip_reader.h"
+#include "third_party/zlib/google/zip_writer.h"
+
+namespace zip {
+namespace {
+
+bool IsHiddenFile(const base::FilePath& file_path) {
+  return file_path.BaseName().value()[0] == '.';
+}
+
+bool ExcludeNoFilesFilter(const base::FilePath& file_path) {
+  return true;
+}
+
+bool ExcludeHiddenFilesFilter(const base::FilePath& file_path) {
+  return !IsHiddenFile(file_path);
+}
+
+// Creates a directory at |extract_dir|/|entry_path|, including any parents.
+bool CreateDirectory(const base::FilePath& extract_dir,
+                     const base::FilePath& entry_path) {
+  return base::CreateDirectory(extract_dir.Append(entry_path));
+}
+
+// Creates a WriterDelegate that can write a file at |extract_dir|/|entry_path|.
+std::unique_ptr<WriterDelegate> CreateFilePathWriterDelegate(
+    const base::FilePath& extract_dir,
+    const base::FilePath& entry_path) {
+  return std::make_unique<FilePathWriterDelegate>(
+      extract_dir.Append(entry_path));
+}
+
+class DirectFileAccessor : public FileAccessor {
+ public:
+  explicit DirectFileAccessor(base::FilePath src_dir) : src_dir_(src_dir) {}
+  ~DirectFileAccessor() override = default;
+
+  std::vector<base::File> OpenFilesForReading(
+      const std::vector<base::FilePath>& paths) override {
+    std::vector<base::File> files;
+    for (const auto& path : paths) {
+      base::File file;
+      if (base::PathExists(path) && !base::DirectoryExists(path)) {
+        file = base::File(path, base::File::FLAG_OPEN | base::File::FLAG_READ);
+      }
+      files.push_back(std::move(file));
+    }
+    return files;
+  }
+
+  bool DirectoryExists(const base::FilePath& file) override {
+    return base::DirectoryExists(file);
+  }
+
+  std::vector<DirectoryContentEntry> ListDirectoryContent(
+      const base::FilePath& dir) override {
+    std::vector<DirectoryContentEntry> files;
+    base::FileEnumerator file_enumerator(
+        dir, false /* recursive */,
+        base::FileEnumerator::FILES | base::FileEnumerator::DIRECTORIES);
+    for (base::FilePath path = file_enumerator.Next(); !path.value().empty();
+         path = file_enumerator.Next()) {
+      files.push_back(DirectoryContentEntry(path, base::DirectoryExists(path)));
+    }
+    return files;
+  }
+
+  base::Time GetLastModifiedTime(const base::FilePath& path) override {
+    base::File::Info file_info;
+    if (!base::GetFileInfo(path, &file_info)) {
+      LOG(ERROR) << "Failed to retrieve file modification time for "
+                 << path.value();
+    }
+    return file_info.last_modified;
+  }
+
+ private:
+  base::FilePath src_dir_;
+
+  DISALLOW_COPY_AND_ASSIGN(DirectFileAccessor);
+};
+
+}  // namespace
+
+ZipParams::ZipParams(const base::FilePath& src_dir,
+                     const base::FilePath& dest_file)
+    : src_dir_(src_dir),
+      dest_file_(dest_file),
+      file_accessor_(new DirectFileAccessor(src_dir)) {}
+
+#if defined(OS_POSIX)
+// Does not take ownership of |fd|.
+ZipParams::ZipParams(const base::FilePath& src_dir, int dest_fd)
+    : src_dir_(src_dir),
+      dest_fd_(dest_fd),
+      file_accessor_(new DirectFileAccessor(src_dir)) {}
+#endif
+
+bool Zip(const ZipParams& params) {
+  // Using a pointer to avoid copies of a potentially large array.
+  const std::vector<base::FilePath>* files_to_add = &params.files_to_zip();
+  std::vector<base::FilePath> all_files;
+  if (files_to_add->empty()) {
+    // Include all files from the src_dir (modulo the src_dir itself and
+    // filtered and hidden files).
+
+    files_to_add = &all_files;
+    // Using a list so we can call push_back while iterating.
+    std::list<FileAccessor::DirectoryContentEntry> entries;
+    entries.push_back(FileAccessor::DirectoryContentEntry(
+        params.src_dir(), true /* is directory*/));
+    const FilterCallback& filter_callback = params.filter_callback();
+    for (auto iter = entries.begin(); iter != entries.end(); ++iter) {
+      const base::FilePath& entry_path = iter->path;
+      if (iter != entries.begin() &&  // Don't filter the root dir.
+          ((!params.include_hidden_files() && IsHiddenFile(entry_path)) ||
+           (filter_callback && !filter_callback.Run(entry_path)))) {
+        continue;
+      }
+
+      if (iter != entries.begin()) {  // Exclude the root dir from the ZIP file.
+        // Make the path relative for AddEntryToZip.
+        base::FilePath relative_path;
+        bool success =
+            params.src_dir().AppendRelativePath(entry_path, &relative_path);
+        DCHECK(success);
+        all_files.push_back(relative_path);
+      }
+
+      if (iter->is_directory) {
+        std::vector<FileAccessor::DirectoryContentEntry> subentries =
+            params.file_accessor()->ListDirectoryContent(entry_path);
+        entries.insert(entries.end(), subentries.begin(), subentries.end());
+      }
+    }
+  }
+
+  std::unique_ptr<internal::ZipWriter> zip_writer;
+#if defined(OS_POSIX)
+  if (params.dest_fd() != base::kInvalidPlatformFile) {
+    DCHECK(params.dest_file().empty());
+    zip_writer = internal::ZipWriter::CreateWithFd(
+        params.dest_fd(), params.src_dir(), params.file_accessor());
+    if (!zip_writer)
+      return false;
+  }
+#endif
+  if (!zip_writer) {
+    zip_writer = internal::ZipWriter::Create(
+        params.dest_file(), params.src_dir(), params.file_accessor());
+    if (!zip_writer)
+      return false;
+  }
+  return zip_writer->WriteEntries(*files_to_add);
+}
+
+bool Unzip(const base::FilePath& src_file, const base::FilePath& dest_dir) {
+  return UnzipWithFilterCallback(
+      src_file, dest_dir, base::BindRepeating(&ExcludeNoFilesFilter), true);
+}
+
+bool UnzipWithFilterCallback(const base::FilePath& src_file,
+                             const base::FilePath& dest_dir,
+                             const FilterCallback& filter_cb,
+                             bool log_skipped_files) {
+  base::File file(src_file, base::File::FLAG_OPEN | base::File::FLAG_READ);
+  if (!file.IsValid()) {
+    DLOG(WARNING) << "Failed to open " << src_file.value();
+    return false;
+  }
+  return UnzipWithFilterAndWriters(
+      file.GetPlatformFile(),
+      base::BindRepeating(&CreateFilePathWriterDelegate, dest_dir),
+      base::BindRepeating(&CreateDirectory, dest_dir), filter_cb,
+      log_skipped_files);
+}
+
+bool UnzipWithFilterAndWriters(const base::PlatformFile& src_file,
+                               const WriterFactory& writer_factory,
+                               const DirectoryCreator& directory_creator,
+                               const FilterCallback& filter_cb,
+                               bool log_skipped_files) {
+  ZipReader reader;
+  if (!reader.OpenFromPlatformFile(src_file)) {
+    DLOG(WARNING) << "Failed to open src_file " << src_file;
+    return false;
+  }
+  while (reader.HasMore()) {
+    if (!reader.OpenCurrentEntryInZip()) {
+      DLOG(WARNING) << "Failed to open the current file in zip";
+      return false;
+    }
+    const base::FilePath& entry_path = reader.current_entry_info()->file_path();
+    if (reader.current_entry_info()->is_unsafe()) {
+      DLOG(WARNING) << "Found an unsafe file in zip " << entry_path;
+      return false;
+    }
+    if (filter_cb.Run(entry_path)) {
+      if (reader.current_entry_info()->is_directory()) {
+        if (!directory_creator.Run(entry_path))
+          return false;
+      } else {
+        std::unique_ptr<WriterDelegate> writer = writer_factory.Run(entry_path);
+        if (!reader.ExtractCurrentEntry(writer.get(),
+                                        std::numeric_limits<uint64_t>::max())) {
+          DLOG(WARNING) << "Failed to extract " << entry_path;
+          return false;
+        }
+      }
+    } else if (log_skipped_files) {
+      DLOG(WARNING) << "Skipped file " << entry_path;
+    }
+
+    if (!reader.AdvanceToNextEntry()) {
+      DLOG(WARNING) << "Failed to advance to the next file";
+      return false;
+    }
+  }
+  return true;
+}
+
+bool ZipWithFilterCallback(const base::FilePath& src_dir,
+                           const base::FilePath& dest_file,
+                           const FilterCallback& filter_cb) {
+  DCHECK(base::DirectoryExists(src_dir));
+  ZipParams params(src_dir, dest_file);
+  params.set_filter_callback(filter_cb);
+  return Zip(params);
+}
+
+bool Zip(const base::FilePath& src_dir, const base::FilePath& dest_file,
+         bool include_hidden_files) {
+  if (include_hidden_files) {
+    return ZipWithFilterCallback(src_dir, dest_file,
+                                 base::BindRepeating(&ExcludeNoFilesFilter));
+  } else {
+    return ZipWithFilterCallback(
+        src_dir, dest_file, base::BindRepeating(&ExcludeHiddenFilesFilter));
+  }
+}
+
+#if defined(OS_POSIX)
+bool ZipFiles(const base::FilePath& src_dir,
+              const std::vector<base::FilePath>& src_relative_paths,
+              int dest_fd) {
+  DCHECK(base::DirectoryExists(src_dir));
+  ZipParams params(src_dir, dest_fd);
+  params.set_files_to_zip(src_relative_paths);
+  return Zip(params);
+}
+#endif  // defined(OS_POSIX)
+
+}  // namespace zip
diff --git a/deps/v8/third_party/zlib/google/zip.h b/deps/v8/third_party/zlib/google/zip.h
new file mode 100644
index 00000000000000..4f64a8aca883a8
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/zip.h
@@ -0,0 +1,181 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_ZLIB_GOOGLE_ZIP_H_
+#define THIRD_PARTY_ZLIB_GOOGLE_ZIP_H_
+
+#include <vector>
+
+#include "base/callback.h"
+#include "base/files/file_path.h"
+#include "base/files/platform_file.h"
+#include "base/time/time.h"
+#include "build/build_config.h"
+
+namespace base {
+class File;
+}
+
+namespace zip {
+
+class WriterDelegate;
+
+// Abstraction for file access operation required by Zip().
+// Can be passed to the ZipParams for providing custom access to the files,
+// for example over IPC.
+// If none is provided, the files are accessed directly.
+// All parameters paths are expected to be absolute.
+class FileAccessor {
+ public:
+  virtual ~FileAccessor() = default;
+
+  struct DirectoryContentEntry {
+    DirectoryContentEntry(const base::FilePath& path, bool is_directory)
+        : path(path), is_directory(is_directory) {}
+    base::FilePath path;
+    bool is_directory = false;
+  };
+
+  // Opens files specified in |paths|.
+  // Directories should be mapped to invalid files.
+  virtual std::vector<base::File> OpenFilesForReading(
+      const std::vector<base::FilePath>& paths) = 0;
+
+  virtual bool DirectoryExists(const base::FilePath& path) = 0;
+  virtual std::vector<DirectoryContentEntry> ListDirectoryContent(
+      const base::FilePath& dir_path) = 0;
+  virtual base::Time GetLastModifiedTime(const base::FilePath& path) = 0;
+};
+
+class ZipParams {
+ public:
+  ZipParams(const base::FilePath& src_dir, const base::FilePath& dest_file);
+#if defined(OS_POSIX)
+  // Does not take ownership of |dest_fd|.
+  ZipParams(const base::FilePath& src_dir, int dest_fd);
+
+  int dest_fd() const { return dest_fd_; }
+#endif
+
+  const base::FilePath& src_dir() const { return src_dir_; }
+
+  const base::FilePath& dest_file() const { return dest_file_; }
+
+  // Restricts the files actually zipped to the paths listed in
+  // |src_relative_paths|. They must be relative to the |src_dir| passed in the
+  // constructor and will be used as the file names in the created zip file. All
+  // source paths must be under |src_dir| in the file system hierarchy.
+  void set_files_to_zip(const std::vector<base::FilePath>& src_relative_paths) {
+    src_files_ = src_relative_paths;
+  }
+  const std::vector<base::FilePath>& files_to_zip() const { return src_files_; }
+
+  using FilterCallback = base::RepeatingCallback<bool(const base::FilePath&)>;
+  void set_filter_callback(FilterCallback filter_callback) {
+    filter_callback_ = filter_callback;
+  }
+  const FilterCallback& filter_callback() const { return filter_callback_; }
+
+  void set_include_hidden_files(bool include_hidden_files) {
+    include_hidden_files_ = include_hidden_files;
+  }
+  bool include_hidden_files() const { return include_hidden_files_; }
+
+  // Sets a custom file accessor for file operations. Default is to directly
+  // access the files (with fopen and the rest).
+  // Useful in cases where running in a sandbox process and file access has to
+  // go through IPC, for example.
+  void set_file_accessor(std::unique_ptr<FileAccessor> file_accessor) {
+    file_accessor_ = std::move(file_accessor);
+  }
+  FileAccessor* file_accessor() const { return file_accessor_.get(); }
+
+ private:
+  base::FilePath src_dir_;
+
+  base::FilePath dest_file_;
+#if defined(OS_POSIX)
+  int dest_fd_ = base::kInvalidPlatformFile;
+#endif
+
+  // The relative paths to the files that should be included in the zip file. If
+  // this is empty, all files in |src_dir_| are included.
+  std::vector<base::FilePath> src_files_;
+
+  // Filter used to exclude files from the ZIP file. Only effective when
+  // |src_files_| is empty.
+  FilterCallback filter_callback_;
+
+  // Whether hidden files should be included in the ZIP file. Only effective
+  // when |src_files_| is empty.
+  bool include_hidden_files_ = true;
+
+  // Abstraction around file system access used to read files. An implementation
+  // that accesses files directly is provided by default.
+  std::unique_ptr<FileAccessor> file_accessor_;
+};
+
+// Zip files specified into a ZIP archives. The source files and ZIP destination
+// files (as well as other settings) are specified in |params|.
+bool Zip(const ZipParams& params);
+
+// Zip the contents of src_dir into dest_file. src_path must be a directory.
+// An entry will *not* be created in the zip for the root folder -- children
+// of src_dir will be at the root level of the created zip. For each file in
+// src_dir, include it only if the callback |filter_cb| returns true. Otherwise
+// omit it.
+using FilterCallback = base::RepeatingCallback<bool(const base::FilePath&)>;
+bool ZipWithFilterCallback(const base::FilePath& src_dir,
+                           const base::FilePath& dest_file,
+                           const FilterCallback& filter_cb);
+
+// Convenience method for callers who don't need to set up the filter callback.
+// If |include_hidden_files| is true, files starting with "." are included.
+// Otherwise they are omitted.
+bool Zip(const base::FilePath& src_dir, const base::FilePath& dest_file,
+         bool include_hidden_files);
+
+#if defined(OS_POSIX)
+// Zips files listed in |src_relative_paths| to destination specified by file
+// descriptor |dest_fd|, without taking ownership of |dest_fd|. The paths listed
+// in |src_relative_paths| are relative to the |src_dir| and will be used as the
+// file names in the created zip file. All source paths must be under |src_dir|
+// in the file system hierarchy.
+bool ZipFiles(const base::FilePath& src_dir,
+              const std::vector<base::FilePath>& src_relative_paths,
+              int dest_fd);
+#endif  // defined(OS_POSIX)
+
+// Unzip the contents of zip_file into dest_dir.
+// For each file in zip_file, include it only if the callback |filter_cb|
+// returns true. Otherwise omit it.
+// If |log_skipped_files| is true, files skipped during extraction are printed
+// to debug log.
+using FilterCallback = base::RepeatingCallback<bool(const base::FilePath&)>;
+bool UnzipWithFilterCallback(const base::FilePath& zip_file,
+                             const base::FilePath& dest_dir,
+                             const FilterCallback& filter_cb,
+                             bool log_skipped_files);
+
+// Unzip the contents of zip_file, using the writers provided by writer_factory.
+// For each file in zip_file, include it only if the callback |filter_cb|
+// returns true. Otherwise omit it.
+// If |log_skipped_files| is true, files skipped during extraction are printed
+// to debug log.
+typedef base::RepeatingCallback<std::unique_ptr<WriterDelegate>(
+    const base::FilePath&)>
+    WriterFactory;
+typedef base::RepeatingCallback<bool(const base::FilePath&)> DirectoryCreator;
+bool UnzipWithFilterAndWriters(const base::PlatformFile& zip_file,
+                               const WriterFactory& writer_factory,
+                               const DirectoryCreator& directory_creator,
+                               const FilterCallback& filter_cb,
+                               bool log_skipped_files);
+
+// Unzip the contents of zip_file into dest_dir.
+bool Unzip(const base::FilePath& zip_file, const base::FilePath& dest_dir);
+
+}  // namespace zip
+
+#endif  // THIRD_PARTY_ZLIB_GOOGLE_ZIP_H_
diff --git a/deps/v8/third_party/zlib/google/zip_internal.cc b/deps/v8/third_party/zlib/google/zip_internal.cc
new file mode 100644
index 00000000000000..314740f5447c03
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/zip_internal.cc
@@ -0,0 +1,379 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/zlib/google/zip_internal.h"
+
+#include <stddef.h>
+
+#include <algorithm>
+
+#include "base/logging.h"
+#include "base/strings/utf_string_conversions.h"
+
+#if defined(USE_SYSTEM_MINIZIP)
+#include <minizip/ioapi.h>
+#include <minizip/unzip.h>
+#include <minizip/zip.h>
+#else
+#include "third_party/zlib/contrib/minizip/unzip.h"
+#include "third_party/zlib/contrib/minizip/zip.h"
+#if defined(OS_WIN)
+#include "third_party/zlib/contrib/minizip/iowin32.h"
+#elif defined(OS_POSIX)
+#include "third_party/zlib/contrib/minizip/ioapi.h"
+#endif  // defined(OS_POSIX)
+#endif  // defined(USE_SYSTEM_MINIZIP)
+
+namespace {
+
+#if defined(OS_WIN)
+typedef struct {
+  HANDLE hf;
+  int error;
+} WIN32FILE_IOWIN;
+
+// This function is derived from third_party/minizip/iowin32.c.
+// Its only difference is that it treats the char* as UTF8 and
+// uses the Unicode version of CreateFile.
+void* ZipOpenFunc(void *opaque, const char* filename, int mode) {
+  DWORD desired_access = 0, creation_disposition = 0;
+  DWORD share_mode = 0, flags_and_attributes = 0;
+  HANDLE file = 0;
+  void* ret = NULL;
+
+  if ((mode & ZLIB_FILEFUNC_MODE_READWRITEFILTER) == ZLIB_FILEFUNC_MODE_READ) {
+    desired_access = GENERIC_READ;
+    creation_disposition = OPEN_EXISTING;
+    share_mode = FILE_SHARE_READ;
+  } else if (mode & ZLIB_FILEFUNC_MODE_EXISTING) {
+    desired_access = GENERIC_WRITE | GENERIC_READ;
+    creation_disposition = OPEN_EXISTING;
+  } else if (mode & ZLIB_FILEFUNC_MODE_CREATE) {
+    desired_access = GENERIC_WRITE | GENERIC_READ;
+    creation_disposition = CREATE_ALWAYS;
+  }
+
+  base::string16 filename16 = base::UTF8ToUTF16(filename);
+  if ((filename != NULL) && (desired_access != 0)) {
+    file = CreateFile(filename16.c_str(), desired_access, share_mode,
+        NULL, creation_disposition, flags_and_attributes, NULL);
+  }
+
+  if (file == INVALID_HANDLE_VALUE)
+    file = NULL;
+
+  if (file != NULL) {
+    WIN32FILE_IOWIN file_ret;
+    file_ret.hf = file;
+    file_ret.error = 0;
+    ret = malloc(sizeof(WIN32FILE_IOWIN));
+    if (ret == NULL)
+      CloseHandle(file);
+    else
+      *(static_cast<WIN32FILE_IOWIN*>(ret)) = file_ret;
+  }
+  return ret;
+}
+#endif
+
+#if defined(OS_POSIX)
+// Callback function for zlib that opens a file stream from a file descriptor.
+// Since we do not own the file descriptor, dup it so that we can fdopen/fclose
+// a file stream.
+void* FdOpenFileFunc(void* opaque, const char* filename, int mode) {
+  FILE* file = NULL;
+  const char* mode_fopen = NULL;
+
+  if ((mode & ZLIB_FILEFUNC_MODE_READWRITEFILTER) == ZLIB_FILEFUNC_MODE_READ)
+    mode_fopen = "rb";
+  else if (mode & ZLIB_FILEFUNC_MODE_EXISTING)
+    mode_fopen = "r+b";
+  else if (mode & ZLIB_FILEFUNC_MODE_CREATE)
+    mode_fopen = "wb";
+
+  if ((filename != NULL) && (mode_fopen != NULL)) {
+    int fd = dup(*static_cast<int*>(opaque));
+    if (fd != -1)
+      file = fdopen(fd, mode_fopen);
+  }
+
+  return file;
+}
+
+int FdCloseFileFunc(void* opaque, void* stream) {
+  fclose(static_cast<FILE*>(stream));
+  free(opaque); // malloc'ed in FillFdOpenFileFunc()
+  return 0;
+}
+
+// Fills |pzlib_filecunc_def| appropriately to handle the zip file
+// referred to by |fd|.
+void FillFdOpenFileFunc(zlib_filefunc_def* pzlib_filefunc_def, int fd) {
+  fill_fopen_filefunc(pzlib_filefunc_def);
+  pzlib_filefunc_def->zopen_file = FdOpenFileFunc;
+  pzlib_filefunc_def->zclose_file = FdCloseFileFunc;
+  int* ptr_fd = static_cast<int*>(malloc(sizeof(fd)));
+  *ptr_fd = fd;
+  pzlib_filefunc_def->opaque = ptr_fd;
+}
+#endif  // defined(OS_POSIX)
+
+#if defined(OS_WIN)
+// Callback function for zlib that opens a file stream from a Windows handle.
+// Does not take ownership of the handle.
+void* HandleOpenFileFunc(void* opaque, const char* filename, int mode) {
+  WIN32FILE_IOWIN file_ret;
+  file_ret.hf = static_cast<HANDLE>(opaque);
+  file_ret.error = 0;
+  if (file_ret.hf == INVALID_HANDLE_VALUE)
+    return NULL;
+
+  void* ret = malloc(sizeof(WIN32FILE_IOWIN));
+  if (ret != NULL)
+    *(static_cast<WIN32FILE_IOWIN*>(ret)) = file_ret;
+  return ret;
+}
+
+int HandleCloseFileFunc(void* opaque, void* stream) {
+  free(stream); // malloc'ed in HandleOpenFileFunc()
+  return 0;
+}
+#endif
+
+// A struct that contains data required for zlib functions to extract files from
+// a zip archive stored in memory directly. The following I/O API functions
+// expect their opaque parameters refer to this struct.
+struct ZipBuffer {
+  const char* data;  // weak
+  size_t length;
+  size_t offset;
+};
+
+// Opens the specified file. When this function returns a non-NULL pointer, zlib
+// uses this pointer as a stream parameter while compressing or uncompressing
+// data. (Returning NULL represents an error.) This function initializes the
+// given opaque parameter and returns it because this parameter stores all
+// information needed for uncompressing data. (This function does not support
+// writing compressed data and it returns NULL for this case.)
+void* OpenZipBuffer(void* opaque, const char* /*filename*/, int mode) {
+  if ((mode & ZLIB_FILEFUNC_MODE_READWRITEFILTER) != ZLIB_FILEFUNC_MODE_READ) {
+    NOTREACHED();
+    return NULL;
+  }
+  ZipBuffer* buffer = static_cast<ZipBuffer*>(opaque);
+  if (!buffer || !buffer->data || !buffer->length)
+    return NULL;
+  buffer->offset = 0;
+  return opaque;
+}
+
+// Reads compressed data from the specified stream. This function copies data
+// refered by the opaque parameter and returns the size actually copied.
+uLong ReadZipBuffer(void* opaque, void* /*stream*/, void* buf, uLong size) {
+  ZipBuffer* buffer = static_cast<ZipBuffer*>(opaque);
+  DCHECK_LE(buffer->offset, buffer->length);
+  size_t remaining_bytes = buffer->length - buffer->offset;
+  if (!buffer || !buffer->data || !remaining_bytes)
+    return 0;
+  size = std::min(size, static_cast<uLong>(remaining_bytes));
+  memcpy(buf, &buffer->data[buffer->offset], size);
+  buffer->offset += size;
+  return size;
+}
+
+// Writes compressed data to the stream. This function always returns zero
+// because this implementation is only for reading compressed data.
+uLong WriteZipBuffer(void* /*opaque*/,
+                     void* /*stream*/,
+                     const void* /*buf*/,
+                     uLong /*size*/) {
+  NOTREACHED();
+  return 0;
+}
+
+// Returns the offset from the beginning of the data.
+long GetOffsetOfZipBuffer(void* opaque, void* /*stream*/) {
+  ZipBuffer* buffer = static_cast<ZipBuffer*>(opaque);
+  if (!buffer)
+    return -1;
+  return static_cast<long>(buffer->offset);
+}
+
+// Moves the current offset to the specified position.
+long SeekZipBuffer(void* opaque, void* /*stream*/, uLong offset, int origin) {
+  ZipBuffer* buffer = static_cast<ZipBuffer*>(opaque);
+  if (!buffer)
+    return -1;
+  if (origin == ZLIB_FILEFUNC_SEEK_CUR) {
+    buffer->offset = std::min(buffer->offset + static_cast<size_t>(offset),
+                              buffer->length);
+    return 0;
+  }
+  if (origin == ZLIB_FILEFUNC_SEEK_END) {
+    buffer->offset = (buffer->length > offset) ? buffer->length - offset : 0;
+    return 0;
+  }
+  if (origin == ZLIB_FILEFUNC_SEEK_SET) {
+    buffer->offset = std::min(buffer->length, static_cast<size_t>(offset));
+    return 0;
+  }
+  NOTREACHED();
+  return -1;
+}
+
+// Closes the input offset and deletes all resources used for compressing or
+// uncompressing data. This function deletes the ZipBuffer object referred by
+// the opaque parameter since zlib deletes the unzFile object and it does not
+// use this object any longer.
+int CloseZipBuffer(void* opaque, void* /*stream*/) {
+  if (opaque)
+    free(opaque);
+  return 0;
+}
+
+// Returns the last error happened when reading or writing data. This function
+// always returns zero, which means there are not any errors.
+int GetErrorOfZipBuffer(void* /*opaque*/, void* /*stream*/) {
+  return 0;
+}
+
+// Returns a zip_fileinfo struct with the time represented by |file_time|.
+zip_fileinfo TimeToZipFileInfo(const base::Time& file_time) {
+  base::Time::Exploded file_time_parts;
+  file_time.LocalExplode(&file_time_parts);
+
+  zip_fileinfo zip_info = {};
+  if (file_time_parts.year >= 1980) {
+    // This if check works around the handling of the year value in
+    // contrib/minizip/zip.c in function zip64local_TmzDateToDosDate
+    // It assumes that dates below 1980 are in the double digit format.
+    // Hence the fail safe option is to leave the date unset. Some programs
+    // might show the unset date as 1980-0-0 which is invalid.
+    zip_info.tmz_date.tm_year = file_time_parts.year;
+    zip_info.tmz_date.tm_mon = file_time_parts.month - 1;
+    zip_info.tmz_date.tm_mday = file_time_parts.day_of_month;
+    zip_info.tmz_date.tm_hour = file_time_parts.hour;
+    zip_info.tmz_date.tm_min = file_time_parts.minute;
+    zip_info.tmz_date.tm_sec = file_time_parts.second;
+  }
+
+  return zip_info;
+}
+}  // namespace
+
+namespace zip {
+namespace internal {
+
+unzFile OpenForUnzipping(const std::string& file_name_utf8) {
+  zlib_filefunc_def* zip_func_ptrs = NULL;
+#if defined(OS_WIN)
+  zlib_filefunc_def zip_funcs;
+  fill_win32_filefunc(&zip_funcs);
+  zip_funcs.zopen_file = ZipOpenFunc;
+  zip_func_ptrs = &zip_funcs;
+#endif
+  return unzOpen2(file_name_utf8.c_str(), zip_func_ptrs);
+}
+
+#if defined(OS_POSIX)
+unzFile OpenFdForUnzipping(int zip_fd) {
+  zlib_filefunc_def zip_funcs;
+  FillFdOpenFileFunc(&zip_funcs, zip_fd);
+  // Passing dummy "fd" filename to zlib.
+  return unzOpen2("fd", &zip_funcs);
+}
+#endif
+
+#if defined(OS_WIN)
+unzFile OpenHandleForUnzipping(HANDLE zip_handle) {
+  zlib_filefunc_def zip_funcs;
+  fill_win32_filefunc(&zip_funcs);
+  zip_funcs.zopen_file = HandleOpenFileFunc;
+  zip_funcs.zclose_file = HandleCloseFileFunc;
+  zip_funcs.opaque = zip_handle;
+  return unzOpen2("fd", &zip_funcs);
+}
+#endif
+
+// static
+unzFile PrepareMemoryForUnzipping(const std::string& data) {
+  if (data.empty())
+    return NULL;
+
+  ZipBuffer* buffer = static_cast<ZipBuffer*>(malloc(sizeof(ZipBuffer)));
+  if (!buffer)
+    return NULL;
+  buffer->data = data.data();
+  buffer->length = data.length();
+  buffer->offset = 0;
+
+  zlib_filefunc_def zip_functions;
+  zip_functions.zopen_file = OpenZipBuffer;
+  zip_functions.zread_file = ReadZipBuffer;
+  zip_functions.zwrite_file = WriteZipBuffer;
+  zip_functions.ztell_file = GetOffsetOfZipBuffer;
+  zip_functions.zseek_file = SeekZipBuffer;
+  zip_functions.zclose_file = CloseZipBuffer;
+  zip_functions.zerror_file = GetErrorOfZipBuffer;
+  zip_functions.opaque = static_cast<void*>(buffer);
+  return unzOpen2(NULL, &zip_functions);
+}
+
+zipFile OpenForZipping(const std::string& file_name_utf8, int append_flag) {
+  zlib_filefunc_def* zip_func_ptrs = NULL;
+#if defined(OS_WIN)
+  zlib_filefunc_def zip_funcs;
+  fill_win32_filefunc(&zip_funcs);
+  zip_funcs.zopen_file = ZipOpenFunc;
+  zip_func_ptrs = &zip_funcs;
+#endif
+  return zipOpen2(file_name_utf8.c_str(),
+                  append_flag,
+                  NULL,  // global comment
+                  zip_func_ptrs);
+}
+
+#if defined(OS_POSIX)
+zipFile OpenFdForZipping(int zip_fd, int append_flag) {
+  zlib_filefunc_def zip_funcs;
+  FillFdOpenFileFunc(&zip_funcs, zip_fd);
+  // Passing dummy "fd" filename to zlib.
+  return zipOpen2("fd", append_flag, NULL, &zip_funcs);
+}
+#endif
+
+bool ZipOpenNewFileInZip(zipFile zip_file,
+                         const std::string& str_path,
+                         base::Time last_modified_time) {
+  // Section 4.4.4 http://www.pkware.com/documents/casestudies/APPNOTE.TXT
+  // Setting the Language encoding flag so the file is told to be in utf-8.
+  const uLong LANGUAGE_ENCODING_FLAG = 0x1 << 11;
+
+  zip_fileinfo file_info = TimeToZipFileInfo(last_modified_time);
+  if (ZIP_OK != zipOpenNewFileInZip4(zip_file,          // file
+                                     str_path.c_str(),  // filename
+                                     &file_info,        // zip_fileinfo
+                                     NULL,              // extrafield_local,
+                                     0u,                // size_extrafield_local
+                                     NULL,              // extrafield_global
+                                     0u,          // size_extrafield_global
+                                     NULL,        // comment
+                                     Z_DEFLATED,  // method
+                                     Z_DEFAULT_COMPRESSION,  // level
+                                     0,                      // raw
+                                     -MAX_WBITS,             // windowBits
+                                     DEF_MEM_LEVEL,          // memLevel
+                                     Z_DEFAULT_STRATEGY,     // strategy
+                                     NULL,                   // password
+                                     0,                      // crcForCrypting
+                                     0,                      // versionMadeBy
+                                     LANGUAGE_ENCODING_FLAG)) {  // flagBase
+    DLOG(ERROR) << "Could not open zip file entry " << str_path;
+    return false;
+  }
+  return true;
+}
+
+}  // namespace internal
+}  // namespace zip
diff --git a/deps/v8/third_party/zlib/google/zip_internal.h b/deps/v8/third_party/zlib/google/zip_internal.h
new file mode 100644
index 00000000000000..49fb902a7408e7
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/zip_internal.h
@@ -0,0 +1,74 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_ZLIB_GOOGLE_ZIP_INTERNAL_H_
+#define THIRD_PARTY_ZLIB_GOOGLE_ZIP_INTERNAL_H_
+
+#include <string>
+
+#include "base/time/time.h"
+#include "build/build_config.h"
+
+#if defined(OS_WIN)
+#include <windows.h>
+#endif
+
+#if defined(USE_SYSTEM_MINIZIP)
+#include <minizip/unzip.h>
+#include <minizip/zip.h>
+#else
+#include "third_party/zlib/contrib/minizip/unzip.h"
+#include "third_party/zlib/contrib/minizip/zip.h"
+#endif
+
+namespace base {
+class FilePath;
+}
+
+// Utility functions and constants used internally for the zip file
+// library in the directory. Don't use them outside of the library.
+namespace zip {
+namespace internal {
+
+// Opens the given file name in UTF-8 for unzipping, with some setup for
+// Windows.
+unzFile OpenForUnzipping(const std::string& file_name_utf8);
+
+#if defined(OS_POSIX)
+// Opens the file referred to by |zip_fd| for unzipping.
+unzFile OpenFdForUnzipping(int zip_fd);
+#endif
+
+#if defined(OS_WIN)
+// Opens the file referred to by |zip_handle| for unzipping.
+unzFile OpenHandleForUnzipping(HANDLE zip_handle);
+#endif
+
+// Creates a custom unzFile object which reads data from the specified string.
+// This custom unzFile object overrides the I/O API functions of zlib so it can
+// read data from the specified string.
+unzFile PrepareMemoryForUnzipping(const std::string& data);
+
+// Opens the given file name in UTF-8 for zipping, with some setup for
+// Windows. |append_flag| will be passed to zipOpen2().
+zipFile OpenForZipping(const std::string& file_name_utf8, int append_flag);
+
+#if defined(OS_POSIX)
+// Opens the file referred to by |zip_fd| for zipping. |append_flag| will be
+// passed to zipOpen2().
+zipFile OpenFdForZipping(int zip_fd, int append_flag);
+#endif
+
+// Wrapper around zipOpenNewFileInZip4 which passes most common options.
+bool ZipOpenNewFileInZip(zipFile zip_file,
+                         const std::string& str_path,
+                         base::Time last_modified_time);
+
+const int kZipMaxPath = 256;
+const int kZipBufSize = 8192;
+
+}  // namespace internal
+}  // namespace zip
+
+#endif  // THIRD_PARTY_ZLIB_GOOGLE_ZIP_INTERNAL_H_
diff --git a/deps/v8/third_party/zlib/google/zip_reader.cc b/deps/v8/third_party/zlib/google/zip_reader.cc
new file mode 100644
index 00000000000000..8b4bb4aee782bf
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/zip_reader.cc
@@ -0,0 +1,502 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/zlib/google/zip_reader.h"
+
+#include <utility>
+
+#include "base/bind.h"
+#include "base/files/file.h"
+#include "base/logging.h"
+#include "base/macros.h"
+#include "base/single_thread_task_runner.h"
+#include "base/strings/string_util.h"
+#include "base/strings/utf_string_conversions.h"
+#include "base/threading/thread_task_runner_handle.h"
+#include "build/build_config.h"
+#include "third_party/zlib/google/zip_internal.h"
+
+#if defined(USE_SYSTEM_MINIZIP)
+#include <minizip/unzip.h>
+#else
+#include "third_party/zlib/contrib/minizip/unzip.h"
+#if defined(OS_WIN)
+#include "third_party/zlib/contrib/minizip/iowin32.h"
+#endif  // defined(OS_WIN)
+#endif  // defined(USE_SYSTEM_MINIZIP)
+
+namespace zip {
+
+namespace {
+
+// StringWriterDelegate --------------------------------------------------------
+
+// A writer delegate that writes no more than |max_read_bytes| to a given
+// std::string.
+class StringWriterDelegate : public WriterDelegate {
+ public:
+  StringWriterDelegate(size_t max_read_bytes, std::string* output);
+  ~StringWriterDelegate() override;
+
+  // WriterDelegate methods:
+
+  // Returns true.
+  bool PrepareOutput() override;
+
+  // Appends |num_bytes| bytes from |data| to the output string. Returns false
+  // if |num_bytes| will cause the string to exceed |max_read_bytes|.
+  bool WriteBytes(const char* data, int num_bytes) override;
+
+  void SetTimeModified(const base::Time& time) override;
+
+ private:
+  size_t max_read_bytes_;
+  std::string* output_;
+
+  DISALLOW_COPY_AND_ASSIGN(StringWriterDelegate);
+};
+
+StringWriterDelegate::StringWriterDelegate(size_t max_read_bytes,
+                                           std::string* output)
+    : max_read_bytes_(max_read_bytes),
+      output_(output) {
+}
+
+StringWriterDelegate::~StringWriterDelegate() {
+}
+
+bool StringWriterDelegate::PrepareOutput() {
+  return true;
+}
+
+bool StringWriterDelegate::WriteBytes(const char* data, int num_bytes) {
+  if (output_->size() + num_bytes > max_read_bytes_)
+    return false;
+  output_->append(data, num_bytes);
+  return true;
+}
+
+void StringWriterDelegate::SetTimeModified(const base::Time& time) {
+  // Do nothing.
+}
+
+}  // namespace
+
+// TODO(satorux): The implementation assumes that file names in zip files
+// are encoded in UTF-8. This is true for zip files created by Zip()
+// function in zip.h, but not true for user-supplied random zip files.
+ZipReader::EntryInfo::EntryInfo(const std::string& file_name_in_zip,
+                                const unz_file_info& raw_file_info)
+    : file_path_(base::FilePath::FromUTF8Unsafe(file_name_in_zip)),
+      is_directory_(false),
+      is_unsafe_(false),
+      is_encrypted_(false) {
+  original_size_ = raw_file_info.uncompressed_size;
+
+  // Directory entries in zip files end with "/".
+  is_directory_ = base::EndsWith(file_name_in_zip, "/",
+                                 base::CompareCase::INSENSITIVE_ASCII);
+
+  // Check the file name here for directory traversal issues.
+  is_unsafe_ = file_path_.ReferencesParent();
+
+  // We also consider that the file name is unsafe, if it's invalid UTF-8.
+  base::string16 file_name_utf16;
+  if (!base::UTF8ToUTF16(file_name_in_zip.data(), file_name_in_zip.size(),
+                         &file_name_utf16)) {
+    is_unsafe_ = true;
+  }
+
+  // We also consider that the file name is unsafe, if it's absolute.
+  // On Windows, IsAbsolute() returns false for paths starting with "/".
+  if (file_path_.IsAbsolute() ||
+      base::StartsWith(file_name_in_zip, "/",
+                       base::CompareCase::INSENSITIVE_ASCII))
+    is_unsafe_ = true;
+
+  // Whether the file is encrypted is bit 0 of the flag.
+  is_encrypted_ = raw_file_info.flag & 1;
+
+  // Construct the last modified time. The timezone info is not present in
+  // zip files, so we construct the time as local time.
+  base::Time::Exploded exploded_time = {};  // Zero-clear.
+  exploded_time.year = raw_file_info.tmu_date.tm_year;
+  // The month in zip file is 0-based, whereas ours is 1-based.
+  exploded_time.month = raw_file_info.tmu_date.tm_mon + 1;
+  exploded_time.day_of_month = raw_file_info.tmu_date.tm_mday;
+  exploded_time.hour = raw_file_info.tmu_date.tm_hour;
+  exploded_time.minute = raw_file_info.tmu_date.tm_min;
+  exploded_time.second = raw_file_info.tmu_date.tm_sec;
+  exploded_time.millisecond = 0;
+
+  if (!base::Time::FromLocalExploded(exploded_time, &last_modified_))
+    last_modified_ = base::Time::UnixEpoch();
+}
+
+ZipReader::ZipReader() {
+  Reset();
+}
+
+ZipReader::~ZipReader() {
+  Close();
+}
+
+bool ZipReader::Open(const base::FilePath& zip_file_path) {
+  DCHECK(!zip_file_);
+
+  // Use of "Unsafe" function does not look good, but there is no way to do
+  // this safely on Linux. See file_util.h for details.
+  zip_file_ = internal::OpenForUnzipping(zip_file_path.AsUTF8Unsafe());
+  if (!zip_file_) {
+    return false;
+  }
+
+  return OpenInternal();
+}
+
+bool ZipReader::OpenFromPlatformFile(base::PlatformFile zip_fd) {
+  DCHECK(!zip_file_);
+
+#if defined(OS_POSIX)
+  zip_file_ = internal::OpenFdForUnzipping(zip_fd);
+#elif defined(OS_WIN)
+  zip_file_ = internal::OpenHandleForUnzipping(zip_fd);
+#endif
+  if (!zip_file_) {
+    return false;
+  }
+
+  return OpenInternal();
+}
+
+bool ZipReader::OpenFromString(const std::string& data) {
+  zip_file_ = internal::PrepareMemoryForUnzipping(data);
+  if (!zip_file_)
+    return false;
+  return OpenInternal();
+}
+
+void ZipReader::Close() {
+  if (zip_file_) {
+    unzClose(zip_file_);
+  }
+  Reset();
+}
+
+bool ZipReader::HasMore() {
+  return !reached_end_;
+}
+
+bool ZipReader::AdvanceToNextEntry() {
+  DCHECK(zip_file_);
+
+  // Should not go further if we already reached the end.
+  if (reached_end_)
+    return false;
+
+  unz_file_pos position = {};
+  if (unzGetFilePos(zip_file_, &position) != UNZ_OK)
+    return false;
+  const int current_entry_index = position.num_of_file;
+  // If we are currently at the last entry, then the next position is the
+  // end of the zip file, so mark that we reached the end.
+  if (current_entry_index + 1 == num_entries_) {
+    reached_end_ = true;
+  } else {
+    DCHECK_LT(current_entry_index + 1, num_entries_);
+    if (unzGoToNextFile(zip_file_) != UNZ_OK) {
+      return false;
+    }
+  }
+  current_entry_info_.reset();
+  return true;
+}
+
+bool ZipReader::OpenCurrentEntryInZip() {
+  DCHECK(zip_file_);
+
+  unz_file_info raw_file_info = {};
+  char raw_file_name_in_zip[internal::kZipMaxPath] = {};
+  const int result = unzGetCurrentFileInfo(zip_file_,
+                                           &raw_file_info,
+                                           raw_file_name_in_zip,
+                                           sizeof(raw_file_name_in_zip) - 1,
+                                           NULL,  // extraField.
+                                           0,  // extraFieldBufferSize.
+                                           NULL,  // szComment.
+                                           0);  // commentBufferSize.
+  if (result != UNZ_OK)
+    return false;
+  if (raw_file_name_in_zip[0] == '\0')
+    return false;
+  current_entry_info_.reset(
+      new EntryInfo(raw_file_name_in_zip, raw_file_info));
+  return true;
+}
+
+bool ZipReader::ExtractCurrentEntry(WriterDelegate* delegate,
+                                    uint64_t num_bytes_to_extract) const {
+  DCHECK(zip_file_);
+
+  const int open_result = unzOpenCurrentFile(zip_file_);
+  if (open_result != UNZ_OK)
+    return false;
+
+  if (!delegate->PrepareOutput())
+    return false;
+  std::unique_ptr<char[]> buf(new char[internal::kZipBufSize]);
+
+  uint64_t remaining_capacity = num_bytes_to_extract;
+  bool entire_file_extracted = false;
+
+  while (remaining_capacity > 0) {
+    const int num_bytes_read =
+        unzReadCurrentFile(zip_file_, buf.get(), internal::kZipBufSize);
+
+    if (num_bytes_read == 0) {
+      entire_file_extracted = true;
+      break;
+    } else if (num_bytes_read < 0) {
+      // If num_bytes_read < 0, then it's a specific UNZ_* error code.
+      break;
+    } else if (num_bytes_read > 0) {
+      uint64_t num_bytes_to_write = std::min<uint64_t>(
+          remaining_capacity, base::checked_cast<uint64_t>(num_bytes_read));
+      if (!delegate->WriteBytes(buf.get(), num_bytes_to_write))
+        break;
+      if (remaining_capacity == base::checked_cast<uint64_t>(num_bytes_read)) {
+        // Ensures function returns true if the entire file has been read.
+        entire_file_extracted =
+            (unzReadCurrentFile(zip_file_, buf.get(), 1) == 0);
+      }
+      CHECK_GE(remaining_capacity, num_bytes_to_write);
+      remaining_capacity -= num_bytes_to_write;
+    }
+  }
+
+  unzCloseCurrentFile(zip_file_);
+
+  if (entire_file_extracted &&
+      current_entry_info()->last_modified() != base::Time::UnixEpoch()) {
+    delegate->SetTimeModified(current_entry_info()->last_modified());
+  }
+
+  return entire_file_extracted;
+}
+
+void ZipReader::ExtractCurrentEntryToFilePathAsync(
+    const base::FilePath& output_file_path,
+    SuccessCallback success_callback,
+    FailureCallback failure_callback,
+    const ProgressCallback& progress_callback) {
+  DCHECK(zip_file_);
+  DCHECK(current_entry_info_.get());
+
+  // If this is a directory, just create it and return.
+  if (current_entry_info()->is_directory()) {
+    if (base::CreateDirectory(output_file_path)) {
+      base::ThreadTaskRunnerHandle::Get()->PostTask(
+          FROM_HERE, std::move(success_callback));
+    } else {
+      DVLOG(1) << "Unzip failed: unable to create directory.";
+      base::ThreadTaskRunnerHandle::Get()->PostTask(
+          FROM_HERE, std::move(failure_callback));
+    }
+    return;
+  }
+
+  if (unzOpenCurrentFile(zip_file_) != UNZ_OK) {
+    DVLOG(1) << "Unzip failed: unable to open current zip entry.";
+    base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
+                                                  std::move(failure_callback));
+    return;
+  }
+
+  base::FilePath output_dir_path = output_file_path.DirName();
+  if (!base::CreateDirectory(output_dir_path)) {
+    DVLOG(1) << "Unzip failed: unable to create containing directory.";
+    base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
+                                                  std::move(failure_callback));
+    return;
+  }
+
+  const int flags = base::File::FLAG_CREATE_ALWAYS | base::File::FLAG_WRITE;
+  base::File output_file(output_file_path, flags);
+
+  if (!output_file.IsValid()) {
+    DVLOG(1) << "Unzip failed: unable to create platform file at "
+             << output_file_path.value();
+    base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
+                                                  std::move(failure_callback));
+    return;
+  }
+
+  base::ThreadTaskRunnerHandle::Get()->PostTask(
+      FROM_HERE,
+      base::BindOnce(&ZipReader::ExtractChunk, weak_ptr_factory_.GetWeakPtr(),
+                     Passed(std::move(output_file)),
+                     std::move(success_callback), std::move(failure_callback),
+                     progress_callback, 0 /* initial offset */));
+}
+
+bool ZipReader::ExtractCurrentEntryToString(uint64_t max_read_bytes,
+                                            std::string* output) const {
+  DCHECK(output);
+  DCHECK(zip_file_);
+
+  if (max_read_bytes == 0) {
+    output->clear();
+    return true;
+  }
+
+  if (current_entry_info()->is_directory()) {
+    output->clear();
+    return true;
+  }
+
+  // The original_size() is the best hint for the real size, so it saves
+  // doing reallocations for the common case when the uncompressed size is
+  // correct. However, we need to assume that the uncompressed size could be
+  // incorrect therefore this function needs to read as much data as possible.
+  std::string contents;
+  contents.reserve(
+      static_cast<size_t>(std::min(base::checked_cast<int64_t>(max_read_bytes),
+                                   current_entry_info()->original_size())));
+
+  StringWriterDelegate writer(max_read_bytes, &contents);
+  if (!ExtractCurrentEntry(&writer, max_read_bytes)) {
+    if (contents.length() < max_read_bytes) {
+      // There was an error in extracting entry. If ExtractCurrentEntry()
+      // returns false, the entire file was not read - in which case
+      // contents.length() should equal |max_read_bytes| unless an error
+      // occurred which caused extraction to be aborted.
+      output->clear();
+    } else {
+      // |num_bytes| is less than the length of current entry.
+      output->swap(contents);
+    }
+    return false;
+  }
+  output->swap(contents);
+  return true;
+}
+
+bool ZipReader::OpenInternal() {
+  DCHECK(zip_file_);
+
+  unz_global_info zip_info = {};  // Zero-clear.
+  if (unzGetGlobalInfo(zip_file_, &zip_info) != UNZ_OK) {
+    return false;
+  }
+  num_entries_ = zip_info.number_entry;
+  if (num_entries_ < 0)
+    return false;
+
+  // We are already at the end if the zip file is empty.
+  reached_end_ = (num_entries_ == 0);
+  return true;
+}
+
+void ZipReader::Reset() {
+  zip_file_ = NULL;
+  num_entries_ = 0;
+  reached_end_ = false;
+  current_entry_info_.reset();
+}
+
+void ZipReader::ExtractChunk(base::File output_file,
+                             SuccessCallback success_callback,
+                             FailureCallback failure_callback,
+                             const ProgressCallback& progress_callback,
+                             const int64_t offset) {
+  char buffer[internal::kZipBufSize];
+
+  const int num_bytes_read = unzReadCurrentFile(zip_file_,
+                                                buffer,
+                                                internal::kZipBufSize);
+
+  if (num_bytes_read == 0) {
+    unzCloseCurrentFile(zip_file_);
+    std::move(success_callback).Run();
+  } else if (num_bytes_read < 0) {
+    DVLOG(1) << "Unzip failed: error while reading zipfile "
+             << "(" << num_bytes_read << ")";
+    std::move(failure_callback).Run();
+  } else {
+    if (num_bytes_read != output_file.Write(offset, buffer, num_bytes_read)) {
+      DVLOG(1) << "Unzip failed: unable to write all bytes to target.";
+      std::move(failure_callback).Run();
+      return;
+    }
+
+    int64_t current_progress = offset + num_bytes_read;
+
+    progress_callback.Run(current_progress);
+
+    base::ThreadTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE,
+        base::BindOnce(&ZipReader::ExtractChunk, weak_ptr_factory_.GetWeakPtr(),
+                       Passed(std::move(output_file)),
+                       std::move(success_callback), std::move(failure_callback),
+                       progress_callback, current_progress));
+  }
+}
+
+// FileWriterDelegate ----------------------------------------------------------
+
+FileWriterDelegate::FileWriterDelegate(base::File* file) : file_(file) {}
+
+FileWriterDelegate::FileWriterDelegate(std::unique_ptr<base::File> file)
+    : file_(file.get()), owned_file_(std::move(file)) {}
+
+FileWriterDelegate::~FileWriterDelegate() {
+  if (!file_->SetLength(file_length_)) {
+    DVPLOG(1) << "Failed updating length of written file";
+  }
+}
+
+bool FileWriterDelegate::PrepareOutput() {
+  return file_->Seek(base::File::FROM_BEGIN, 0) >= 0;
+}
+
+bool FileWriterDelegate::WriteBytes(const char* data, int num_bytes) {
+  int bytes_written = file_->WriteAtCurrentPos(data, num_bytes);
+  if (bytes_written > 0)
+    file_length_ += bytes_written;
+  return bytes_written == num_bytes;
+}
+
+void FileWriterDelegate::SetTimeModified(const base::Time& time) {
+  file_->SetTimes(base::Time::Now(), time);
+}
+
+// FilePathWriterDelegate ------------------------------------------------------
+
+FilePathWriterDelegate::FilePathWriterDelegate(
+    const base::FilePath& output_file_path)
+    : output_file_path_(output_file_path) {}
+
+FilePathWriterDelegate::~FilePathWriterDelegate() {}
+
+bool FilePathWriterDelegate::PrepareOutput() {
+  // We can't rely on parent directory entries being specified in the
+  // zip, so we make sure they are created.
+  if (!base::CreateDirectory(output_file_path_.DirName()))
+    return false;
+
+  file_.Initialize(output_file_path_,
+                   base::File::FLAG_CREATE_ALWAYS | base::File::FLAG_WRITE);
+  return file_.IsValid();
+}
+
+bool FilePathWriterDelegate::WriteBytes(const char* data, int num_bytes) {
+  return num_bytes == file_.WriteAtCurrentPos(data, num_bytes);
+}
+
+void FilePathWriterDelegate::SetTimeModified(const base::Time& time) {
+  file_.Close();
+  base::TouchFile(output_file_path_, base::Time::Now(), time);
+}
+
+}  // namespace zip
diff --git a/deps/v8/third_party/zlib/google/zip_reader.h b/deps/v8/third_party/zlib/google/zip_reader.h
new file mode 100644
index 00000000000000..d442d428591e50
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/zip_reader.h
@@ -0,0 +1,301 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+#ifndef THIRD_PARTY_ZLIB_GOOGLE_ZIP_READER_H_
+#define THIRD_PARTY_ZLIB_GOOGLE_ZIP_READER_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <memory>
+#include <string>
+
+#include "base/callback.h"
+#include "base/files/file.h"
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
+#include "base/macros.h"
+#include "base/memory/weak_ptr.h"
+#include "base/time/time.h"
+
+#if defined(USE_SYSTEM_MINIZIP)
+#include <minizip/unzip.h>
+#else
+#include "third_party/zlib/contrib/minizip/unzip.h"
+#endif
+
+namespace zip {
+
+// A delegate interface used to stream out an entry; see
+// ZipReader::ExtractCurrentEntry.
+class WriterDelegate {
+ public:
+  virtual ~WriterDelegate() {}
+
+  // Invoked once before any data is streamed out to pave the way (e.g., to open
+  // the output file). Return false on failure to cancel extraction.
+  virtual bool PrepareOutput() = 0;
+
+  // Invoked to write the next chunk of data. Return false on failure to cancel
+  // extraction.
+  virtual bool WriteBytes(const char* data, int num_bytes) = 0;
+
+  // Sets the last-modified time of the data.
+  virtual void SetTimeModified(const base::Time& time) = 0;
+};
+
+// This class is used for reading zip files. A typical use case of this
+// class is to scan entries in a zip file and extract them. The code will
+// look like:
+//
+//   ZipReader reader;
+//   reader.Open(zip_file_path);
+//   while (reader.HasMore()) {
+//     reader.OpenCurrentEntryInZip();
+//     const base::FilePath& entry_path =
+//        reader.current_entry_info()->file_path();
+//     auto writer = CreateFilePathWriterDelegate(extract_dir, entry_path);
+//     reader.ExtractCurrentEntry(writer, std::numeric_limits<uint64_t>::max());
+//     reader.AdvanceToNextEntry();
+//   }
+//
+// For simplicity, error checking is omitted in the example code above. The
+// production code should check return values from all of these functions.
+//
+class ZipReader {
+ public:
+  // A callback that is called when the operation is successful.
+  using SuccessCallback = base::OnceClosure;
+  // A callback that is called when the operation fails.
+  using FailureCallback = base::OnceClosure;
+  // A callback that is called periodically during the operation with the number
+  // of bytes that have been processed so far.
+  using ProgressCallback = base::RepeatingCallback<void(int64_t)>;
+
+  // This class represents information of an entry (file or directory) in
+  // a zip file.
+  class EntryInfo {
+   public:
+    EntryInfo(const std::string& filename_in_zip,
+              const unz_file_info& raw_file_info);
+
+    // Returns the file path. The path is usually relative like
+    // "foo/bar.txt", but if it's absolute, is_unsafe() returns true.
+    const base::FilePath& file_path() const { return file_path_; }
+
+    // Returns the size of the original file (i.e. after uncompressed).
+    // Returns 0 if the entry is a directory.
+    // Note: this value should not be trusted, because it is stored as metadata
+    // in the zip archive and can be different from the real uncompressed size.
+    int64_t original_size() const { return original_size_; }
+
+    // Returns the last modified time. If the time stored in the zip file was
+    // not valid, the unix epoch will be returned.
+    //
+    // The time stored in the zip archive uses the MS-DOS date and time format.
+    // http://msdn.microsoft.com/en-us/library/ms724247(v=vs.85).aspx
+    // As such the following limitations apply:
+    // * only years from 1980 to 2107 can be represented.
+    // * the time stamp has a 2 second resolution.
+    // * there's no timezone information, so the time is interpreted as local.
+    base::Time last_modified() const { return last_modified_; }
+
+    // Returns true if the entry is a directory.
+    bool is_directory() const { return is_directory_; }
+
+    // Returns true if the entry is unsafe, like having ".." or invalid
+    // UTF-8 characters in its file name, or the file path is absolute.
+    bool is_unsafe() const { return is_unsafe_; }
+
+    // Returns true if the entry is encrypted.
+    bool is_encrypted() const { return is_encrypted_; }
+
+   private:
+    const base::FilePath file_path_;
+    int64_t original_size_;
+    base::Time last_modified_;
+    bool is_directory_;
+    bool is_unsafe_;
+    bool is_encrypted_;
+    DISALLOW_COPY_AND_ASSIGN(EntryInfo);
+  };
+
+  ZipReader();
+  ~ZipReader();
+
+  // Opens the zip file specified by |zip_file_path|. Returns true on
+  // success.
+  bool Open(const base::FilePath& zip_file_path);
+
+  // Opens the zip file referred to by the platform file |zip_fd|, without
+  // taking ownership of |zip_fd|. Returns true on success.
+  bool OpenFromPlatformFile(base::PlatformFile zip_fd);
+
+  // Opens the zip data stored in |data|. This class uses a weak reference to
+  // the given sring while extracting files, i.e. the caller should keep the
+  // string until it finishes extracting files.
+  bool OpenFromString(const std::string& data);
+
+  // Closes the currently opened zip file. This function is called in the
+  // destructor of the class, so you usually don't need to call this.
+  void Close();
+
+  // Returns true if there is at least one entry to read. This function is
+  // used to scan entries with AdvanceToNextEntry(), like:
+  //
+  // while (reader.HasMore()) {
+  //   // Do something with the current file here.
+  //   reader.AdvanceToNextEntry();
+  // }
+  bool HasMore();
+
+  // Advances the next entry. Returns true on success.
+  bool AdvanceToNextEntry();
+
+  // Opens the current entry in the zip file. On success, returns true and
+  // updates the the current entry state (i.e. current_entry_info() is
+  // updated). This function should be called before operations over the
+  // current entry like ExtractCurrentEntryToFile().
+  //
+  // Note that there is no CloseCurrentEntryInZip(). The the current entry
+  // state is reset automatically as needed.
+  bool OpenCurrentEntryInZip();
+
+  // Extracts |num_bytes_to_extract| bytes of the current entry to |delegate|,
+  // starting from the beginning of the entry. Return value specifies whether
+  // the entire file was extracted.
+  bool ExtractCurrentEntry(WriterDelegate* delegate,
+                           uint64_t num_bytes_to_extract) const;
+
+  // Asynchronously extracts the current entry to the given output file path.
+  // If the current entry is a directory it just creates the directory
+  // synchronously instead.  OpenCurrentEntryInZip() must be called beforehand.
+  // success_callback will be called on success and failure_callback will be
+  // called on failure.  progress_callback will be called at least once.
+  // Callbacks will be posted to the current MessageLoop in-order.
+  void ExtractCurrentEntryToFilePathAsync(
+      const base::FilePath& output_file_path,
+      SuccessCallback success_callback,
+      FailureCallback failure_callback,
+      const ProgressCallback& progress_callback);
+
+  // Extracts the current entry into memory. If the current entry is a
+  // directory, the |output| parameter is set to the empty string. If the
+  // current entry is a file, the |output| parameter is filled with its
+  // contents. OpenCurrentEntryInZip() must be called beforehand. Note: the
+  // |output| parameter can be filled with a big amount of data, avoid passing
+  // it around by value, but by reference or pointer. Note: the value returned
+  // by EntryInfo::original_size() cannot be trusted, so the real size of the
+  // uncompressed contents can be different. |max_read_bytes| limits the ammount
+  // of memory used to carry the entry. Returns true if the entire content is
+  // read. If the entry is bigger than |max_read_bytes|, returns false and
+  // |output| is filled with |max_read_bytes| of data. If an error occurs,
+  // returns false, and |output| is set to the empty string.
+  bool ExtractCurrentEntryToString(uint64_t max_read_bytes,
+                                   std::string* output) const;
+
+  // Returns the current entry info. Returns NULL if the current entry is
+  // not yet opened. OpenCurrentEntryInZip() must be called beforehand.
+  EntryInfo* current_entry_info() const {
+    return current_entry_info_.get();
+  }
+
+  // Returns the number of entries in the zip file.
+  // Open() must be called beforehand.
+  int num_entries() const { return num_entries_; }
+
+ private:
+  // Common code used both in Open and OpenFromFd.
+  bool OpenInternal();
+
+  // Resets the internal state.
+  void Reset();
+
+  // Extracts a chunk of the file to the target.  Will post a task for the next
+  // chunk and success/failure/progress callbacks as necessary.
+  void ExtractChunk(base::File target_file,
+                    SuccessCallback success_callback,
+                    FailureCallback failure_callback,
+                    const ProgressCallback& progress_callback,
+                    const int64_t offset);
+
+  unzFile zip_file_;
+  int num_entries_;
+  bool reached_end_;
+  std::unique_ptr<EntryInfo> current_entry_info_;
+
+  base::WeakPtrFactory<ZipReader> weak_ptr_factory_{this};
+
+  DISALLOW_COPY_AND_ASSIGN(ZipReader);
+};
+
+// A writer delegate that writes to a given File.
+class FileWriterDelegate : public WriterDelegate {
+ public:
+  // Constructs a FileWriterDelegate that manipulates |file|. The delegate will
+  // not own |file|, therefore the caller must guarantee |file| will outlive the
+  // delegate.
+  explicit FileWriterDelegate(base::File* file);
+
+  // Constructs a FileWriterDelegate that takes ownership of |file|.
+  explicit FileWriterDelegate(std::unique_ptr<base::File> file);
+
+  // Truncates the file to the number of bytes written.
+  ~FileWriterDelegate() override;
+
+  // WriterDelegate methods:
+
+  // Seeks to the beginning of the file, returning false if the seek fails.
+  bool PrepareOutput() override;
+
+  // Writes |num_bytes| bytes of |data| to the file, returning false on error or
+  // if not all bytes could be written.
+  bool WriteBytes(const char* data, int num_bytes) override;
+
+  // Sets the last-modified time of the data.
+  void SetTimeModified(const base::Time& time) override;
+
+  // Return the actual size of the file.
+  int64_t file_length() { return file_length_; }
+
+ private:
+  // The file the delegate modifies.
+  base::File* file_;
+
+  // The delegate can optionally own the file it modifies, in which case
+  // owned_file_ is set and file_ is an alias for owned_file_.
+  std::unique_ptr<base::File> owned_file_;
+
+  int64_t file_length_ = 0;
+
+  DISALLOW_COPY_AND_ASSIGN(FileWriterDelegate);
+};
+
+// A writer delegate that writes a file at a given path.
+class FilePathWriterDelegate : public WriterDelegate {
+ public:
+  explicit FilePathWriterDelegate(const base::FilePath& output_file_path);
+  ~FilePathWriterDelegate() override;
+
+  // WriterDelegate methods:
+
+  // Creates the output file and any necessary intermediate directories.
+  bool PrepareOutput() override;
+
+  // Writes |num_bytes| bytes of |data| to the file, returning false if not all
+  // bytes could be written.
+  bool WriteBytes(const char* data, int num_bytes) override;
+
+  // Sets the last-modified time of the data.
+  void SetTimeModified(const base::Time& time) override;
+
+ private:
+  base::FilePath output_file_path_;
+  base::File file_;
+
+  DISALLOW_COPY_AND_ASSIGN(FilePathWriterDelegate);
+};
+
+}  // namespace zip
+
+#endif  // THIRD_PARTY_ZLIB_GOOGLE_ZIP_READER_H_
diff --git a/deps/v8/third_party/zlib/google/zip_reader_unittest.cc b/deps/v8/third_party/zlib/google/zip_reader_unittest.cc
new file mode 100644
index 00000000000000..87190c7e0dee76
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/zip_reader_unittest.cc
@@ -0,0 +1,672 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/zlib/google/zip_reader.h"
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <set>
+#include <string>
+
+#include "base/bind.h"
+#include "base/files/file.h"
+#include "base/files/file_util.h"
+#include "base/files/scoped_temp_dir.h"
+#include "base/hash/md5.h"
+#include "base/logging.h"
+#include "base/path_service.h"
+#include "base/run_loop.h"
+#include "base/stl_util.h"
+#include "base/strings/stringprintf.h"
+#include "base/strings/utf_string_conversions.h"
+#include "base/test/task_environment.h"
+#include "base/time/time.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "testing/platform_test.h"
+#include "third_party/zlib/google/zip_internal.h"
+
+using ::testing::Return;
+using ::testing::_;
+
+namespace {
+
+const static std::string kQuuxExpectedMD5 = "d1ae4ac8a17a0e09317113ab284b57a6";
+
+class FileWrapper {
+ public:
+  typedef enum {
+    READ_ONLY,
+    READ_WRITE
+  } AccessMode;
+
+  FileWrapper(const base::FilePath& path, AccessMode mode) {
+    int flags = base::File::FLAG_READ;
+    if (mode == READ_ONLY)
+      flags |= base::File::FLAG_OPEN;
+    else
+      flags |= base::File::FLAG_WRITE | base::File::FLAG_CREATE_ALWAYS;
+
+    file_.Initialize(path, flags);
+  }
+
+  ~FileWrapper() {}
+
+  base::PlatformFile platform_file() { return file_.GetPlatformFile(); }
+
+  base::File* file() { return &file_; }
+
+ private:
+  base::File file_;
+};
+
+// A mock that provides methods that can be used as callbacks in asynchronous
+// unzip functions.  Tracks the number of calls and number of bytes reported.
+// Assumes that progress callbacks will be executed in-order.
+class MockUnzipListener : public base::SupportsWeakPtr<MockUnzipListener> {
+ public:
+  MockUnzipListener()
+      : success_calls_(0),
+        failure_calls_(0),
+        progress_calls_(0),
+        current_progress_(0) {
+  }
+
+  // Success callback for async functions.
+  void OnUnzipSuccess() {
+    success_calls_++;
+  }
+
+  // Failure callback for async functions.
+  void OnUnzipFailure() {
+    failure_calls_++;
+  }
+
+  // Progress callback for async functions.
+  void OnUnzipProgress(int64_t progress) {
+    DCHECK(progress > current_progress_);
+    progress_calls_++;
+    current_progress_ = progress;
+  }
+
+  int success_calls() { return success_calls_; }
+  int failure_calls() { return failure_calls_; }
+  int progress_calls() { return progress_calls_; }
+  int current_progress() { return current_progress_; }
+
+ private:
+  int success_calls_;
+  int failure_calls_;
+  int progress_calls_;
+
+  int64_t current_progress_;
+};
+
+class MockWriterDelegate : public zip::WriterDelegate {
+ public:
+  MOCK_METHOD0(PrepareOutput, bool());
+  MOCK_METHOD2(WriteBytes, bool(const char*, int));
+  MOCK_METHOD1(SetTimeModified, void(const base::Time&));
+};
+
+bool ExtractCurrentEntryToFilePath(zip::ZipReader* reader,
+                                   base::FilePath path) {
+  zip::FilePathWriterDelegate writer(path);
+  return reader->ExtractCurrentEntry(&writer,
+                                     std::numeric_limits<uint64_t>::max());
+}
+
+bool LocateAndOpenEntry(zip::ZipReader* reader,
+                        const base::FilePath& path_in_zip) {
+  // The underlying library can do O(1) access, but ZipReader does not expose
+  // that. O(N) access is acceptable for these tests.
+  while (reader->HasMore()) {
+    if (!reader->OpenCurrentEntryInZip())
+      return false;
+    if (reader->current_entry_info()->file_path() == path_in_zip)
+      return true;
+    reader->AdvanceToNextEntry();
+  }
+  return false;
+}
+
+}   // namespace
+
+namespace zip {
+
+// Make the test a PlatformTest to setup autorelease pools properly on Mac.
+class ZipReaderTest : public PlatformTest {
+ protected:
+  virtual void SetUp() {
+    PlatformTest::SetUp();
+
+    ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
+    test_dir_ = temp_dir_.GetPath();
+
+    ASSERT_TRUE(GetTestDataDirectory(&test_data_dir_));
+
+    test_zip_file_ = test_data_dir_.AppendASCII("test.zip");
+    encrypted_zip_file_ = test_data_dir_.AppendASCII("test_encrypted.zip");
+    evil_zip_file_ = test_data_dir_.AppendASCII("evil.zip");
+    evil_via_invalid_utf8_zip_file_ = test_data_dir_.AppendASCII(
+        "evil_via_invalid_utf8.zip");
+    evil_via_absolute_file_name_zip_file_ = test_data_dir_.AppendASCII(
+        "evil_via_absolute_file_name.zip");
+
+    test_zip_contents_.insert(base::FilePath(FILE_PATH_LITERAL("foo/")));
+    test_zip_contents_.insert(base::FilePath(FILE_PATH_LITERAL("foo/bar/")));
+    test_zip_contents_.insert(
+        base::FilePath(FILE_PATH_LITERAL("foo/bar/baz.txt")));
+    test_zip_contents_.insert(
+        base::FilePath(FILE_PATH_LITERAL("foo/bar/quux.txt")));
+    test_zip_contents_.insert(
+        base::FilePath(FILE_PATH_LITERAL("foo/bar.txt")));
+    test_zip_contents_.insert(base::FilePath(FILE_PATH_LITERAL("foo.txt")));
+    test_zip_contents_.insert(
+        base::FilePath(FILE_PATH_LITERAL("foo/bar/.hidden")));
+  }
+
+  virtual void TearDown() {
+    PlatformTest::TearDown();
+  }
+
+  bool GetTestDataDirectory(base::FilePath* path) {
+    bool success = base::PathService::Get(base::DIR_SOURCE_ROOT, path);
+    EXPECT_TRUE(success);
+    if (!success)
+      return false;
+    *path = path->AppendASCII("third_party");
+    *path = path->AppendASCII("zlib");
+    *path = path->AppendASCII("google");
+    *path = path->AppendASCII("test");
+    *path = path->AppendASCII("data");
+    return true;
+  }
+
+  bool CompareFileAndMD5(const base::FilePath& path,
+                         const std::string expected_md5) {
+    // Read the output file and compute the MD5.
+    std::string output;
+    if (!base::ReadFileToString(path, &output))
+      return false;
+    const std::string md5 = base::MD5String(output);
+    return expected_md5 == md5;
+  }
+
+  // The path to temporary directory used to contain the test operations.
+  base::FilePath test_dir_;
+  // The path to the test data directory where test.zip etc. are located.
+  base::FilePath test_data_dir_;
+  // The path to test.zip in the test data directory.
+  base::FilePath test_zip_file_;
+  // The path to test_encrypted.zip in the test data directory.
+  base::FilePath encrypted_zip_file_;
+  // The path to evil.zip in the test data directory.
+  base::FilePath evil_zip_file_;
+  // The path to evil_via_invalid_utf8.zip in the test data directory.
+  base::FilePath evil_via_invalid_utf8_zip_file_;
+  // The path to evil_via_absolute_file_name.zip in the test data directory.
+  base::FilePath evil_via_absolute_file_name_zip_file_;
+  std::set<base::FilePath> test_zip_contents_;
+
+  base::ScopedTempDir temp_dir_;
+
+  base::test::TaskEnvironment task_environment_;
+};
+
+TEST_F(ZipReaderTest, Open_ValidZipFile) {
+  ZipReader reader;
+  ASSERT_TRUE(reader.Open(test_zip_file_));
+}
+
+TEST_F(ZipReaderTest, Open_ValidZipPlatformFile) {
+  ZipReader reader;
+  FileWrapper zip_fd_wrapper(test_zip_file_, FileWrapper::READ_ONLY);
+  ASSERT_TRUE(reader.OpenFromPlatformFile(zip_fd_wrapper.platform_file()));
+}
+
+TEST_F(ZipReaderTest, Open_NonExistentFile) {
+  ZipReader reader;
+  ASSERT_FALSE(reader.Open(test_data_dir_.AppendASCII("nonexistent.zip")));
+}
+
+TEST_F(ZipReaderTest, Open_ExistentButNonZipFile) {
+  ZipReader reader;
+  ASSERT_FALSE(reader.Open(test_data_dir_.AppendASCII("create_test_zip.sh")));
+}
+
+// Iterate through the contents in the test zip file, and compare that the
+// contents collected from the zip reader matches the expected contents.
+TEST_F(ZipReaderTest, Iteration) {
+  std::set<base::FilePath> actual_contents;
+  ZipReader reader;
+  ASSERT_TRUE(reader.Open(test_zip_file_));
+  while (reader.HasMore()) {
+    ASSERT_TRUE(reader.OpenCurrentEntryInZip());
+    actual_contents.insert(reader.current_entry_info()->file_path());
+    ASSERT_TRUE(reader.AdvanceToNextEntry());
+  }
+  EXPECT_FALSE(reader.AdvanceToNextEntry());  // Shouldn't go further.
+  EXPECT_EQ(test_zip_contents_.size(),
+            static_cast<size_t>(reader.num_entries()));
+  EXPECT_EQ(test_zip_contents_.size(), actual_contents.size());
+  EXPECT_EQ(test_zip_contents_, actual_contents);
+}
+
+// Open the test zip file from a file descriptor, iterate through its contents,
+// and compare that they match the expected contents.
+TEST_F(ZipReaderTest, PlatformFileIteration) {
+  std::set<base::FilePath> actual_contents;
+  ZipReader reader;
+  FileWrapper zip_fd_wrapper(test_zip_file_, FileWrapper::READ_ONLY);
+  ASSERT_TRUE(reader.OpenFromPlatformFile(zip_fd_wrapper.platform_file()));
+  while (reader.HasMore()) {
+    ASSERT_TRUE(reader.OpenCurrentEntryInZip());
+    actual_contents.insert(reader.current_entry_info()->file_path());
+    ASSERT_TRUE(reader.AdvanceToNextEntry());
+  }
+  EXPECT_FALSE(reader.AdvanceToNextEntry());  // Shouldn't go further.
+  EXPECT_EQ(test_zip_contents_.size(),
+            static_cast<size_t>(reader.num_entries()));
+  EXPECT_EQ(test_zip_contents_.size(), actual_contents.size());
+  EXPECT_EQ(test_zip_contents_, actual_contents);
+}
+
+TEST_F(ZipReaderTest, current_entry_info_RegularFile) {
+  ZipReader reader;
+  ASSERT_TRUE(reader.Open(test_zip_file_));
+  base::FilePath target_path(FILE_PATH_LITERAL("foo/bar/quux.txt"));
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, target_path));
+  ZipReader::EntryInfo* current_entry_info = reader.current_entry_info();
+
+  EXPECT_EQ(target_path, current_entry_info->file_path());
+  EXPECT_EQ(13527, current_entry_info->original_size());
+
+  // The expected time stamp: 2009-05-29 06:22:20
+  base::Time::Exploded exploded = {};  // Zero-clear.
+  current_entry_info->last_modified().LocalExplode(&exploded);
+  EXPECT_EQ(2009, exploded.year);
+  EXPECT_EQ(5, exploded.month);
+  EXPECT_EQ(29, exploded.day_of_month);
+  EXPECT_EQ(6, exploded.hour);
+  EXPECT_EQ(22, exploded.minute);
+  EXPECT_EQ(20, exploded.second);
+  EXPECT_EQ(0, exploded.millisecond);
+
+  EXPECT_FALSE(current_entry_info->is_unsafe());
+  EXPECT_FALSE(current_entry_info->is_directory());
+}
+
+TEST_F(ZipReaderTest, current_entry_info_DotDotFile) {
+  ZipReader reader;
+  ASSERT_TRUE(reader.Open(evil_zip_file_));
+  base::FilePath target_path(FILE_PATH_LITERAL(
+      "../levilevilevilevilevilevilevilevilevilevilevilevil"));
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, target_path));
+  ZipReader::EntryInfo* current_entry_info = reader.current_entry_info();
+  EXPECT_EQ(target_path, current_entry_info->file_path());
+
+  // This file is unsafe because of ".." in the file name.
+  EXPECT_TRUE(current_entry_info->is_unsafe());
+  EXPECT_FALSE(current_entry_info->is_directory());
+}
+
+TEST_F(ZipReaderTest, current_entry_info_InvalidUTF8File) {
+  ZipReader reader;
+  ASSERT_TRUE(reader.Open(evil_via_invalid_utf8_zip_file_));
+  // The evil file is the 2nd file in the zip file.
+  // We cannot locate by the file name ".\x80.\\evil.txt",
+  // as FilePath may internally convert the string.
+  ASSERT_TRUE(reader.AdvanceToNextEntry());
+  ASSERT_TRUE(reader.OpenCurrentEntryInZip());
+  ZipReader::EntryInfo* current_entry_info = reader.current_entry_info();
+
+  // This file is unsafe because of invalid UTF-8 in the file name.
+  EXPECT_TRUE(current_entry_info->is_unsafe());
+  EXPECT_FALSE(current_entry_info->is_directory());
+}
+
+TEST_F(ZipReaderTest, current_entry_info_AbsoluteFile) {
+  ZipReader reader;
+  ASSERT_TRUE(reader.Open(evil_via_absolute_file_name_zip_file_));
+  base::FilePath target_path(FILE_PATH_LITERAL("/evil.txt"));
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, target_path));
+  ZipReader::EntryInfo* current_entry_info = reader.current_entry_info();
+  EXPECT_EQ(target_path, current_entry_info->file_path());
+
+  // This file is unsafe because of the absolute file name.
+  EXPECT_TRUE(current_entry_info->is_unsafe());
+  EXPECT_FALSE(current_entry_info->is_directory());
+}
+
+TEST_F(ZipReaderTest, current_entry_info_Directory) {
+  ZipReader reader;
+  ASSERT_TRUE(reader.Open(test_zip_file_));
+  base::FilePath target_path(FILE_PATH_LITERAL("foo/bar/"));
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, target_path));
+  ZipReader::EntryInfo* current_entry_info = reader.current_entry_info();
+
+  EXPECT_EQ(base::FilePath(FILE_PATH_LITERAL("foo/bar/")),
+            current_entry_info->file_path());
+  // The directory size should be zero.
+  EXPECT_EQ(0, current_entry_info->original_size());
+
+  // The expected time stamp: 2009-05-31 15:49:52
+  base::Time::Exploded exploded = {};  // Zero-clear.
+  current_entry_info->last_modified().LocalExplode(&exploded);
+  EXPECT_EQ(2009, exploded.year);
+  EXPECT_EQ(5, exploded.month);
+  EXPECT_EQ(31, exploded.day_of_month);
+  EXPECT_EQ(15, exploded.hour);
+  EXPECT_EQ(49, exploded.minute);
+  EXPECT_EQ(52, exploded.second);
+  EXPECT_EQ(0, exploded.millisecond);
+
+  EXPECT_FALSE(current_entry_info->is_unsafe());
+  EXPECT_TRUE(current_entry_info->is_directory());
+}
+
+TEST_F(ZipReaderTest, current_entry_info_EncryptedFile) {
+  ZipReader reader;
+  base::FilePath target_path(FILE_PATH_LITERAL("foo/bar/quux.txt"));
+
+  ASSERT_TRUE(reader.Open(encrypted_zip_file_));
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, target_path));
+  EXPECT_TRUE(reader.current_entry_info()->is_encrypted());
+  reader.Close();
+
+  ASSERT_TRUE(reader.Open(test_zip_file_));
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, target_path));
+  EXPECT_FALSE(reader.current_entry_info()->is_encrypted());
+}
+
+// Verifies that the ZipReader class can extract a file from a zip archive
+// stored in memory. This test opens a zip archive in a std::string object,
+// extracts its content, and verifies the content is the same as the expected
+// text.
+TEST_F(ZipReaderTest, OpenFromString) {
+  // A zip archive consisting of one file "test.txt", which is a 16-byte text
+  // file that contains "This is a test.\n".
+  const char kTestData[] =
+      "\x50\x4b\x03\x04\x0a\x00\x00\x00\x00\x00\xa4\x66\x24\x41\x13\xe8"
+      "\xcb\x27\x10\x00\x00\x00\x10\x00\x00\x00\x08\x00\x1c\x00\x74\x65"
+      "\x73\x74\x2e\x74\x78\x74\x55\x54\x09\x00\x03\x34\x89\x45\x50\x34"
+      "\x89\x45\x50\x75\x78\x0b\x00\x01\x04\x8e\xf0\x00\x00\x04\x88\x13"
+      "\x00\x00\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20\x74\x65\x73\x74"
+      "\x2e\x0a\x50\x4b\x01\x02\x1e\x03\x0a\x00\x00\x00\x00\x00\xa4\x66"
+      "\x24\x41\x13\xe8\xcb\x27\x10\x00\x00\x00\x10\x00\x00\x00\x08\x00"
+      "\x18\x00\x00\x00\x00\x00\x01\x00\x00\x00\xa4\x81\x00\x00\x00\x00"
+      "\x74\x65\x73\x74\x2e\x74\x78\x74\x55\x54\x05\x00\x03\x34\x89\x45"
+      "\x50\x75\x78\x0b\x00\x01\x04\x8e\xf0\x00\x00\x04\x88\x13\x00\x00"
+      "\x50\x4b\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00\x4e\x00\x00\x00"
+      "\x52\x00\x00\x00\x00\x00";
+  std::string data(kTestData, base::size(kTestData));
+  ZipReader reader;
+  ASSERT_TRUE(reader.OpenFromString(data));
+  base::FilePath target_path(FILE_PATH_LITERAL("test.txt"));
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, target_path));
+  ASSERT_TRUE(ExtractCurrentEntryToFilePath(&reader,
+                                            test_dir_.AppendASCII("test.txt")));
+
+  std::string actual;
+  ASSERT_TRUE(base::ReadFileToString(
+      test_dir_.AppendASCII("test.txt"), &actual));
+  EXPECT_EQ(std::string("This is a test.\n"), actual);
+}
+
+// Verifies that the asynchronous extraction to a file works.
+TEST_F(ZipReaderTest, ExtractToFileAsync_RegularFile) {
+  MockUnzipListener listener;
+
+  ZipReader reader;
+  base::FilePath target_file = test_dir_.AppendASCII("quux.txt");
+  base::FilePath target_path(FILE_PATH_LITERAL("foo/bar/quux.txt"));
+  ASSERT_TRUE(reader.Open(test_zip_file_));
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, target_path));
+  reader.ExtractCurrentEntryToFilePathAsync(
+      target_file,
+      base::BindOnce(&MockUnzipListener::OnUnzipSuccess, listener.AsWeakPtr()),
+      base::BindOnce(&MockUnzipListener::OnUnzipFailure, listener.AsWeakPtr()),
+      base::BindRepeating(&MockUnzipListener::OnUnzipProgress,
+                          listener.AsWeakPtr()));
+
+  EXPECT_EQ(0, listener.success_calls());
+  EXPECT_EQ(0, listener.failure_calls());
+  EXPECT_EQ(0, listener.progress_calls());
+
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_EQ(1, listener.success_calls());
+  EXPECT_EQ(0, listener.failure_calls());
+  EXPECT_LE(1, listener.progress_calls());
+
+  std::string output;
+  ASSERT_TRUE(base::ReadFileToString(test_dir_.AppendASCII("quux.txt"),
+                                     &output));
+  const std::string md5 = base::MD5String(output);
+  EXPECT_EQ(kQuuxExpectedMD5, md5);
+
+  int64_t file_size = 0;
+  ASSERT_TRUE(base::GetFileSize(target_file, &file_size));
+
+  EXPECT_EQ(file_size, listener.current_progress());
+}
+
+// Verifies that the asynchronous extraction to a file works.
+TEST_F(ZipReaderTest, ExtractToFileAsync_Directory) {
+  MockUnzipListener listener;
+
+  ZipReader reader;
+  base::FilePath target_file = test_dir_.AppendASCII("foo");
+  base::FilePath target_path(FILE_PATH_LITERAL("foo/"));
+  ASSERT_TRUE(reader.Open(test_zip_file_));
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, target_path));
+  reader.ExtractCurrentEntryToFilePathAsync(
+      target_file,
+      base::BindOnce(&MockUnzipListener::OnUnzipSuccess, listener.AsWeakPtr()),
+      base::BindOnce(&MockUnzipListener::OnUnzipFailure, listener.AsWeakPtr()),
+      base::BindRepeating(&MockUnzipListener::OnUnzipProgress,
+                          listener.AsWeakPtr()));
+
+  EXPECT_EQ(0, listener.success_calls());
+  EXPECT_EQ(0, listener.failure_calls());
+  EXPECT_EQ(0, listener.progress_calls());
+
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_EQ(1, listener.success_calls());
+  EXPECT_EQ(0, listener.failure_calls());
+  EXPECT_GE(0, listener.progress_calls());
+
+  ASSERT_TRUE(base::DirectoryExists(target_file));
+}
+
+TEST_F(ZipReaderTest, ExtractCurrentEntryToString) {
+  // test_mismatch_size.zip contains files with names from 0.txt to 7.txt with
+  // sizes from 0 to 7 bytes respectively, being the contents of each file a
+  // substring of "0123456" starting at '0'.
+  base::FilePath test_zip_file =
+      test_data_dir_.AppendASCII("test_mismatch_size.zip");
+
+  ZipReader reader;
+  std::string contents;
+  ASSERT_TRUE(reader.Open(test_zip_file));
+
+  for (size_t i = 0; i < 8; i++) {
+    SCOPED_TRACE(base::StringPrintf("Processing %d.txt", static_cast<int>(i)));
+
+    base::FilePath file_name = base::FilePath::FromUTF8Unsafe(
+        base::StringPrintf("%d.txt", static_cast<int>(i)));
+    ASSERT_TRUE(LocateAndOpenEntry(&reader, file_name));
+
+    if (i > 1) {
+      // Off by one byte read limit: must fail.
+      EXPECT_FALSE(reader.ExtractCurrentEntryToString(i - 1, &contents));
+    }
+
+    if (i > 0) {
+      // Exact byte read limit: must pass.
+      EXPECT_TRUE(reader.ExtractCurrentEntryToString(i, &contents));
+      EXPECT_EQ(base::StringPiece("0123456", i).as_string(), contents);
+    }
+
+    // More than necessary byte read limit: must pass.
+    EXPECT_TRUE(reader.ExtractCurrentEntryToString(16, &contents));
+    EXPECT_EQ(base::StringPiece("0123456", i).as_string(), contents);
+  }
+  reader.Close();
+}
+
+TEST_F(ZipReaderTest, ExtractPartOfCurrentEntry) {
+  // test_mismatch_size.zip contains files with names from 0.txt to 7.txt with
+  // sizes from 0 to 7 bytes respectively, being the contents of each file a
+  // substring of "0123456" starting at '0'.
+  base::FilePath test_zip_file =
+      test_data_dir_.AppendASCII("test_mismatch_size.zip");
+
+  ZipReader reader;
+  std::string contents;
+  ASSERT_TRUE(reader.Open(test_zip_file));
+
+  base::FilePath file_name0 = base::FilePath::FromUTF8Unsafe("0.txt");
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, file_name0));
+  EXPECT_TRUE(reader.ExtractCurrentEntryToString(0, &contents));
+  EXPECT_EQ("", contents);
+  EXPECT_TRUE(reader.ExtractCurrentEntryToString(1, &contents));
+  EXPECT_EQ("", contents);
+
+  base::FilePath file_name1 = base::FilePath::FromUTF8Unsafe("1.txt");
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, file_name1));
+  EXPECT_TRUE(reader.ExtractCurrentEntryToString(0, &contents));
+  EXPECT_EQ("", contents);
+  EXPECT_TRUE(reader.ExtractCurrentEntryToString(1, &contents));
+  EXPECT_EQ("0", contents);
+  EXPECT_TRUE(reader.ExtractCurrentEntryToString(2, &contents));
+  EXPECT_EQ("0", contents);
+
+  base::FilePath file_name4 = base::FilePath::FromUTF8Unsafe("4.txt");
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, file_name4));
+  EXPECT_TRUE(reader.ExtractCurrentEntryToString(0, &contents));
+  EXPECT_EQ("", contents);
+  EXPECT_FALSE(reader.ExtractCurrentEntryToString(2, &contents));
+  EXPECT_EQ("01", contents);
+  EXPECT_TRUE(reader.ExtractCurrentEntryToString(4, &contents));
+  EXPECT_EQ("0123", contents);
+  // Checks that entire file is extracted and function returns true when
+  // |max_read_bytes| is larger than file size.
+  EXPECT_TRUE(reader.ExtractCurrentEntryToString(5, &contents));
+  EXPECT_EQ("0123", contents);
+
+  reader.Close();
+}
+
+// This test exposes http://crbug.com/430959, at least on OS X
+TEST_F(ZipReaderTest, DISABLED_LeakDetectionTest) {
+  for (int i = 0; i < 100000; ++i) {
+    FileWrapper zip_fd_wrapper(test_zip_file_, FileWrapper::READ_ONLY);
+    ZipReader reader;
+    ASSERT_TRUE(reader.OpenFromPlatformFile(zip_fd_wrapper.platform_file()));
+  }
+}
+
+// Test that when WriterDelegate::PrepareMock returns false, no other methods on
+// the delegate are called and the extraction fails.
+TEST_F(ZipReaderTest, ExtractCurrentEntryPrepareFailure) {
+  testing::StrictMock<MockWriterDelegate> mock_writer;
+
+  EXPECT_CALL(mock_writer, PrepareOutput())
+      .WillOnce(Return(false));
+
+  base::FilePath target_path(FILE_PATH_LITERAL("foo/bar/quux.txt"));
+  ZipReader reader;
+
+  ASSERT_TRUE(reader.Open(test_zip_file_));
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, target_path));
+  ASSERT_FALSE(reader.ExtractCurrentEntry(
+      &mock_writer, std::numeric_limits<uint64_t>::max()));
+}
+
+// Test that when WriterDelegate::WriteBytes returns false, no other methods on
+// the delegate are called and the extraction fails.
+TEST_F(ZipReaderTest, ExtractCurrentEntryWriteBytesFailure) {
+  testing::StrictMock<MockWriterDelegate> mock_writer;
+
+  EXPECT_CALL(mock_writer, PrepareOutput())
+      .WillOnce(Return(true));
+  EXPECT_CALL(mock_writer, WriteBytes(_, _))
+      .WillOnce(Return(false));
+
+  base::FilePath target_path(FILE_PATH_LITERAL("foo/bar/quux.txt"));
+  ZipReader reader;
+
+  ASSERT_TRUE(reader.Open(test_zip_file_));
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, target_path));
+  ASSERT_FALSE(reader.ExtractCurrentEntry(
+      &mock_writer, std::numeric_limits<uint64_t>::max()));
+}
+
+// Test that extraction succeeds when the writer delegate reports all is well.
+TEST_F(ZipReaderTest, ExtractCurrentEntrySuccess) {
+  testing::StrictMock<MockWriterDelegate> mock_writer;
+
+  EXPECT_CALL(mock_writer, PrepareOutput())
+      .WillOnce(Return(true));
+  EXPECT_CALL(mock_writer, WriteBytes(_, _))
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(mock_writer, SetTimeModified(_));
+
+  base::FilePath target_path(FILE_PATH_LITERAL("foo/bar/quux.txt"));
+  ZipReader reader;
+
+  ASSERT_TRUE(reader.Open(test_zip_file_));
+  ASSERT_TRUE(LocateAndOpenEntry(&reader, target_path));
+  ASSERT_TRUE(reader.ExtractCurrentEntry(&mock_writer,
+                                         std::numeric_limits<uint64_t>::max()));
+}
+
+class FileWriterDelegateTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    ASSERT_TRUE(base::CreateTemporaryFile(&temp_file_path_));
+    file_.Initialize(temp_file_path_, (base::File::FLAG_CREATE_ALWAYS |
+                                       base::File::FLAG_READ |
+                                       base::File::FLAG_WRITE |
+                                       base::File::FLAG_TEMPORARY |
+                                       base::File::FLAG_DELETE_ON_CLOSE));
+    ASSERT_TRUE(file_.IsValid());
+  }
+
+  // Writes data to the file, leaving the current position at the end of the
+  // write.
+  void PopulateFile() {
+    static const char kSomeData[] = "this sure is some data.";
+    static const size_t kSomeDataLen = sizeof(kSomeData) - 1;
+    ASSERT_NE(-1LL, file_.Write(0LL, kSomeData, kSomeDataLen));
+  }
+
+  base::FilePath temp_file_path_;
+  base::File file_;
+};
+
+TEST_F(FileWriterDelegateTest, WriteToStartAndTruncate) {
+  // Write stuff and advance.
+  PopulateFile();
+
+  // This should rewind, write, then truncate.
+  static const char kSomeData[] = "short";
+  static const int kSomeDataLen = sizeof(kSomeData) - 1;
+  {
+    FileWriterDelegate writer(&file_);
+    ASSERT_TRUE(writer.PrepareOutput());
+    ASSERT_TRUE(writer.WriteBytes(kSomeData, kSomeDataLen));
+  }
+  ASSERT_EQ(kSomeDataLen, file_.GetLength());
+  char buf[kSomeDataLen] = {};
+  ASSERT_EQ(kSomeDataLen, file_.Read(0LL, buf, kSomeDataLen));
+  ASSERT_EQ(std::string(kSomeData), std::string(buf, kSomeDataLen));
+}
+
+}  // namespace zip
diff --git a/deps/v8/third_party/zlib/google/zip_unittest.cc b/deps/v8/third_party/zlib/google/zip_unittest.cc
new file mode 100644
index 00000000000000..7ea3c36c2a80f1
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/zip_unittest.cc
@@ -0,0 +1,559 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <map>
+#include <set>
+#include <string>
+#include <vector>
+
+#include "base/bind.h"
+#include "base/files/file.h"
+#include "base/files/file_enumerator.h"
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
+#include "base/files/scoped_temp_dir.h"
+#include "base/macros.h"
+#include "base/path_service.h"
+#include "base/strings/string_util.h"
+#include "base/strings/stringprintf.h"
+#include "build/build_config.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "testing/platform_test.h"
+#include "third_party/zlib/google/zip.h"
+#include "third_party/zlib/google/zip_reader.h"
+
+namespace {
+
+bool CreateFile(const std::string& content,
+                base::FilePath* file_path,
+                base::File* file) {
+  if (!base::CreateTemporaryFile(file_path))
+    return false;
+
+  if (base::WriteFile(*file_path, content.data(), content.size()) == -1)
+    return false;
+
+  *file = base::File(
+      *file_path, base::File::Flags::FLAG_OPEN | base::File::Flags::FLAG_READ);
+  return file->IsValid();
+}
+
+// A virtual file system containing:
+// /test
+// /test/foo.txt
+// /test/bar/bar1.txt
+// /test/bar/bar2.txt
+// Used to test providing a custom zip::FileAccessor when unzipping.
+class VirtualFileSystem : public zip::FileAccessor {
+ public:
+  static constexpr char kFooContent[] = "This is foo.";
+  static constexpr char kBar1Content[] = "This is bar.";
+  static constexpr char kBar2Content[] = "This is bar too.";
+
+  VirtualFileSystem() {
+    base::FilePath test_dir(FILE_PATH_LITERAL("/test"));
+    base::FilePath foo_txt_path = test_dir.Append(FILE_PATH_LITERAL("foo.txt"));
+
+    base::FilePath file_path;
+    base::File file;
+    bool success = CreateFile(kFooContent, &file_path, &file);
+    DCHECK(success);
+    files_[foo_txt_path] = std::move(file);
+
+    base::FilePath bar_dir = test_dir.Append(FILE_PATH_LITERAL("bar"));
+    base::FilePath bar1_txt_path =
+        bar_dir.Append(FILE_PATH_LITERAL("bar1.txt"));
+    success = CreateFile(kBar1Content, &file_path, &file);
+    DCHECK(success);
+    files_[bar1_txt_path] = std::move(file);
+
+    base::FilePath bar2_txt_path =
+        bar_dir.Append(FILE_PATH_LITERAL("bar2.txt"));
+    success = CreateFile(kBar2Content, &file_path, &file);
+    DCHECK(success);
+    files_[bar2_txt_path] = std::move(file);
+
+    file_tree_[test_dir] = std::vector<DirectoryContentEntry>{
+        DirectoryContentEntry(foo_txt_path, /*is_dir=*/false),
+        DirectoryContentEntry(bar_dir, /*is_dir=*/true)};
+    file_tree_[bar_dir] = std::vector<DirectoryContentEntry>{
+        DirectoryContentEntry(bar1_txt_path, /*is_dir=*/false),
+        DirectoryContentEntry(bar2_txt_path, /*is_dir=*/false)};
+  }
+  ~VirtualFileSystem() override = default;
+
+ private:
+  std::vector<base::File> OpenFilesForReading(
+      const std::vector<base::FilePath>& paths) override {
+    std::vector<base::File> files;
+    for (const auto& path : paths) {
+      auto iter = files_.find(path);
+      files.push_back(iter == files_.end() ? base::File()
+                                           : std::move(iter->second));
+    }
+    return files;
+  }
+
+  bool DirectoryExists(const base::FilePath& file) override {
+    return file_tree_.count(file) == 1 && files_.count(file) == 0;
+  }
+
+  std::vector<DirectoryContentEntry> ListDirectoryContent(
+      const base::FilePath& dir) override {
+    auto iter = file_tree_.find(dir);
+    if (iter == file_tree_.end()) {
+      NOTREACHED();
+      return std::vector<DirectoryContentEntry>();
+    }
+    return iter->second;
+  }
+
+  base::Time GetLastModifiedTime(const base::FilePath& path) override {
+    return base::Time::FromDoubleT(172097977);  // Some random date.
+  }
+
+  std::map<base::FilePath, std::vector<DirectoryContentEntry>> file_tree_;
+  std::map<base::FilePath, base::File> files_;
+
+  DISALLOW_COPY_AND_ASSIGN(VirtualFileSystem);
+};
+
+// static
+constexpr char VirtualFileSystem::kFooContent[];
+constexpr char VirtualFileSystem::kBar1Content[];
+constexpr char VirtualFileSystem::kBar2Content[];
+
+// Make the test a PlatformTest to setup autorelease pools properly on Mac.
+class ZipTest : public PlatformTest {
+ protected:
+  enum ValidYearType {
+    VALID_YEAR,
+    INVALID_YEAR
+  };
+
+  virtual void SetUp() {
+    PlatformTest::SetUp();
+
+    ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
+    test_dir_ = temp_dir_.GetPath();
+
+    base::FilePath zip_path(test_dir_);
+    zip_contents_.insert(zip_path.Append(FILE_PATH_LITERAL("foo.txt")));
+    zip_path = zip_path.Append(FILE_PATH_LITERAL("foo"));
+    zip_contents_.insert(zip_path);
+    zip_contents_.insert(zip_path.Append(FILE_PATH_LITERAL("bar.txt")));
+    zip_path = zip_path.Append(FILE_PATH_LITERAL("bar"));
+    zip_contents_.insert(zip_path);
+    zip_contents_.insert(zip_path.Append(FILE_PATH_LITERAL("baz.txt")));
+    zip_contents_.insert(zip_path.Append(FILE_PATH_LITERAL("quux.txt")));
+    zip_contents_.insert(zip_path.Append(FILE_PATH_LITERAL(".hidden")));
+
+    // Include a subset of files in |zip_file_list_| to test ZipFiles().
+    zip_file_list_.push_back(base::FilePath(FILE_PATH_LITERAL("foo.txt")));
+    zip_file_list_.push_back(
+        base::FilePath(FILE_PATH_LITERAL("foo/bar/quux.txt")));
+    zip_file_list_.push_back(
+        base::FilePath(FILE_PATH_LITERAL("foo/bar/.hidden")));
+  }
+
+  virtual void TearDown() {
+    PlatformTest::TearDown();
+  }
+
+  bool GetTestDataDirectory(base::FilePath* path) {
+    bool success = base::PathService::Get(base::DIR_SOURCE_ROOT, path);
+    EXPECT_TRUE(success);
+    if (!success)
+      return false;
+    *path = path->AppendASCII("third_party");
+    *path = path->AppendASCII("zlib");
+    *path = path->AppendASCII("google");
+    *path = path->AppendASCII("test");
+    *path = path->AppendASCII("data");
+    return true;
+  }
+
+  void TestUnzipFile(const base::FilePath::StringType& filename,
+                     bool expect_hidden_files) {
+    base::FilePath test_dir;
+    ASSERT_TRUE(GetTestDataDirectory(&test_dir));
+    TestUnzipFile(test_dir.Append(filename), expect_hidden_files);
+  }
+
+  void TestUnzipFile(const base::FilePath& path, bool expect_hidden_files) {
+    ASSERT_TRUE(base::PathExists(path)) << "no file " << path.value();
+    ASSERT_TRUE(zip::Unzip(path, test_dir_));
+
+    base::FilePath original_dir;
+    ASSERT_TRUE(GetTestDataDirectory(&original_dir));
+    original_dir = original_dir.AppendASCII("test");
+
+    base::FileEnumerator files(test_dir_, true,
+        base::FileEnumerator::FILES | base::FileEnumerator::DIRECTORIES);
+    base::FilePath unzipped_entry_path = files.Next();
+    size_t count = 0;
+    while (!unzipped_entry_path.value().empty()) {
+      EXPECT_EQ(zip_contents_.count(unzipped_entry_path), 1U)
+          << "Couldn't find " << unzipped_entry_path.value();
+      count++;
+
+      if (base::PathExists(unzipped_entry_path) &&
+          !base::DirectoryExists(unzipped_entry_path)) {
+        // It's a file, check its contents are what we zipped.
+        // TODO(774156): figure out why the commented out EXPECT_TRUE below
+        // fails on the build bots (but not on the try-bots).
+        base::FilePath relative_path;
+        bool append_relative_path_success =
+            test_dir_.AppendRelativePath(unzipped_entry_path, &relative_path);
+        if (!append_relative_path_success) {
+          LOG(ERROR) << "Append relative path failed, params: "
+                     << test_dir_.value() << " and "
+                     << unzipped_entry_path.value();
+        }
+        base::FilePath original_path = original_dir.Append(relative_path);
+        LOG(ERROR) << "Comparing original " << original_path.value()
+                   << " and unzipped file " << unzipped_entry_path.value()
+                   << " result: "
+                   << base::ContentsEqual(original_path, unzipped_entry_path);
+        // EXPECT_TRUE(base::ContentsEqual(original_path, unzipped_entry_path))
+        //    << "Contents differ between original " << original_path.value()
+        //    << " and unzipped file " << unzipped_entry_path.value();
+      }
+      unzipped_entry_path = files.Next();
+    }
+
+    size_t expected_count = 0;
+    for (std::set<base::FilePath>::iterator iter = zip_contents_.begin();
+         iter != zip_contents_.end(); ++iter) {
+      if (expect_hidden_files || iter->BaseName().value()[0] != '.')
+        ++expected_count;
+    }
+
+    EXPECT_EQ(expected_count, count);
+  }
+
+  // This function does the following:
+  // 1) Creates a test.txt file with the given last modification timestamp
+  // 2) Zips test.txt and extracts it back into a different location.
+  // 3) Confirms that test.txt in the output directory has the specified
+  //    last modification timestamp if it is valid (|valid_year| is true).
+  //    If the timestamp is not supported by the zip format, the last
+  //    modification defaults to the current time.
+  void TestTimeStamp(const char* date_time, ValidYearType valid_year) {
+    SCOPED_TRACE(std::string("TestTimeStamp(") + date_time + ")");
+    base::ScopedTempDir temp_dir;
+    ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
+
+    base::FilePath zip_file = temp_dir.GetPath().AppendASCII("out.zip");
+    base::FilePath src_dir = temp_dir.GetPath().AppendASCII("input");
+    base::FilePath out_dir = temp_dir.GetPath().AppendASCII("output");
+
+    base::FilePath src_file = src_dir.AppendASCII("test.txt");
+    base::FilePath out_file = out_dir.AppendASCII("test.txt");
+
+    EXPECT_TRUE(base::CreateDirectory(src_dir));
+    EXPECT_TRUE(base::CreateDirectory(out_dir));
+
+    base::Time test_mtime;
+    ASSERT_TRUE(base::Time::FromString(date_time, &test_mtime));
+
+    // Adjusting the current timestamp to the resolution that the zip file
+    // supports, which is 2 seconds. Note that between this call to Time::Now()
+    // and zip::Zip() the clock can advance a bit, hence the use of EXPECT_GE.
+    base::Time::Exploded now_parts;
+    base::Time::Now().LocalExplode(&now_parts);
+    now_parts.second = now_parts.second & ~1;
+    now_parts.millisecond = 0;
+    base::Time now_time;
+    EXPECT_TRUE(base::Time::FromLocalExploded(now_parts, &now_time));
+
+    EXPECT_EQ(1, base::WriteFile(src_file, "1", 1));
+    EXPECT_TRUE(base::TouchFile(src_file, base::Time::Now(), test_mtime));
+
+    EXPECT_TRUE(zip::Zip(src_dir, zip_file, true));
+    ASSERT_TRUE(zip::Unzip(zip_file, out_dir));
+
+    base::File::Info file_info;
+    EXPECT_TRUE(base::GetFileInfo(out_file, &file_info));
+    EXPECT_EQ(file_info.size, 1);
+
+    if (valid_year == VALID_YEAR) {
+      EXPECT_EQ(file_info.last_modified, test_mtime);
+    } else {
+      // Invalid date means the modification time will default to 'now'.
+      EXPECT_GE(file_info.last_modified, now_time);
+    }
+  }
+
+  // The path to temporary directory used to contain the test operations.
+  base::FilePath test_dir_;
+
+  base::ScopedTempDir temp_dir_;
+
+  // Hard-coded contents of a known zip file.
+  std::set<base::FilePath> zip_contents_;
+
+  // Hard-coded list of relative paths for a zip file created with ZipFiles.
+  std::vector<base::FilePath> zip_file_list_;
+};
+
+TEST_F(ZipTest, Unzip) {
+  TestUnzipFile(FILE_PATH_LITERAL("test.zip"), true);
+}
+
+TEST_F(ZipTest, UnzipUncompressed) {
+  TestUnzipFile(FILE_PATH_LITERAL("test_nocompress.zip"), true);
+}
+
+TEST_F(ZipTest, UnzipEvil) {
+  base::FilePath path;
+  ASSERT_TRUE(GetTestDataDirectory(&path));
+  path = path.AppendASCII("evil.zip");
+  // Unzip the zip file into a sub directory of test_dir_ so evil.zip
+  // won't create a persistent file outside test_dir_ in case of a
+  // failure.
+  base::FilePath output_dir = test_dir_.AppendASCII("out");
+  ASSERT_FALSE(zip::Unzip(path, output_dir));
+  base::FilePath evil_file = output_dir;
+  evil_file = evil_file.AppendASCII(
+      "../levilevilevilevilevilevilevilevilevilevilevilevil");
+  ASSERT_FALSE(base::PathExists(evil_file));
+}
+
+TEST_F(ZipTest, UnzipEvil2) {
+  base::FilePath path;
+  ASSERT_TRUE(GetTestDataDirectory(&path));
+  // The zip file contains an evil file with invalid UTF-8 in its file
+  // name.
+  path = path.AppendASCII("evil_via_invalid_utf8.zip");
+  // See the comment at UnzipEvil() for why we do this.
+  base::FilePath output_dir = test_dir_.AppendASCII("out");
+  // This should fail as it contains an evil file.
+  ASSERT_FALSE(zip::Unzip(path, output_dir));
+  base::FilePath evil_file = output_dir;
+  evil_file = evil_file.AppendASCII("../evil.txt");
+  ASSERT_FALSE(base::PathExists(evil_file));
+}
+
+TEST_F(ZipTest, UnzipWithFilter) {
+  auto filter = base::BindRepeating([](const base::FilePath& path) {
+    return path.BaseName().MaybeAsASCII() == "foo.txt";
+  });
+  base::FilePath path;
+  ASSERT_TRUE(GetTestDataDirectory(&path));
+  ASSERT_TRUE(zip::UnzipWithFilterCallback(path.AppendASCII("test.zip"),
+                                           test_dir_, filter, false));
+  // Only foo.txt should have been extracted. The following paths should not
+  // be extracted:
+  //   foo/
+  //   foo/bar.txt
+  //   foo/bar/
+  //   foo/bar/.hidden
+  //   foo/bar/baz.txt
+  //   foo/bar/quux.txt
+  ASSERT_TRUE(base::PathExists(test_dir_.AppendASCII("foo.txt")));
+  base::FileEnumerator extractedFiles(
+      test_dir_,
+      false,  // Do not enumerate recursively - the file must be in the root.
+      base::FileEnumerator::FileType::FILES);
+  int extracted_count = 0;
+  while (!extractedFiles.Next().empty())
+    ++extracted_count;
+  ASSERT_EQ(1, extracted_count);
+
+  base::FileEnumerator extractedDirs(
+      test_dir_,
+      false,  // Do not enumerate recursively - we require zero directories.
+      base::FileEnumerator::FileType::DIRECTORIES);
+  extracted_count = 0;
+  while (!extractedDirs.Next().empty())
+    ++extracted_count;
+  ASSERT_EQ(0, extracted_count);
+}
+
+TEST_F(ZipTest, UnzipWithDelegates) {
+  auto filter =
+      base::BindRepeating([](const base::FilePath& path) { return true; });
+  auto dir_creator = base::BindRepeating(
+      [](const base::FilePath& extract_dir, const base::FilePath& entry_path) {
+        return base::CreateDirectory(extract_dir.Append(entry_path));
+      },
+      test_dir_);
+  auto writer = base::BindRepeating(
+      [](const base::FilePath& extract_dir, const base::FilePath& entry_path)
+          -> std::unique_ptr<zip::WriterDelegate> {
+        return std::make_unique<zip::FilePathWriterDelegate>(
+            extract_dir.Append(entry_path));
+      },
+      test_dir_);
+  base::FilePath path;
+  ASSERT_TRUE(GetTestDataDirectory(&path));
+  base::File file(path.AppendASCII("test.zip"),
+                  base::File::Flags::FLAG_OPEN | base::File::Flags::FLAG_READ);
+  ASSERT_TRUE(zip::UnzipWithFilterAndWriters(file.GetPlatformFile(), writer,
+                                             dir_creator, filter, false));
+  base::FilePath dir = test_dir_;
+  base::FilePath dir_foo = dir.AppendASCII("foo");
+  base::FilePath dir_foo_bar = dir_foo.AppendASCII("bar");
+  ASSERT_TRUE(base::PathExists(dir.AppendASCII("foo.txt")));
+  ASSERT_TRUE(base::PathExists(dir_foo));
+  ASSERT_TRUE(base::PathExists(dir_foo.AppendASCII("bar.txt")));
+  ASSERT_TRUE(base::PathExists(dir_foo_bar));
+  ASSERT_TRUE(base::PathExists(dir_foo_bar.AppendASCII(".hidden")));
+  ASSERT_TRUE(base::PathExists(dir_foo_bar.AppendASCII("baz.txt")));
+  ASSERT_TRUE(base::PathExists(dir_foo_bar.AppendASCII("quux.txt")));
+}
+
+TEST_F(ZipTest, Zip) {
+  base::FilePath src_dir;
+  ASSERT_TRUE(GetTestDataDirectory(&src_dir));
+  src_dir = src_dir.AppendASCII("test");
+
+  base::ScopedTempDir temp_dir;
+  ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
+  base::FilePath zip_file = temp_dir.GetPath().AppendASCII("out.zip");
+
+  EXPECT_TRUE(zip::Zip(src_dir, zip_file, /*include_hidden_files=*/true));
+  TestUnzipFile(zip_file, true);
+}
+
+TEST_F(ZipTest, ZipIgnoreHidden) {
+  base::FilePath src_dir;
+  ASSERT_TRUE(GetTestDataDirectory(&src_dir));
+  src_dir = src_dir.AppendASCII("test");
+
+  base::ScopedTempDir temp_dir;
+  ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
+  base::FilePath zip_file = temp_dir.GetPath().AppendASCII("out.zip");
+
+  EXPECT_TRUE(zip::Zip(src_dir, zip_file, /*include_hidden_files=*/false));
+  TestUnzipFile(zip_file, false);
+}
+
+TEST_F(ZipTest, ZipNonASCIIDir) {
+  base::FilePath src_dir;
+  ASSERT_TRUE(GetTestDataDirectory(&src_dir));
+  src_dir = src_dir.AppendASCII("test");
+
+  base::ScopedTempDir temp_dir;
+  ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
+  // Append 'Тест' (in cyrillic).
+  base::FilePath src_dir_russian = temp_dir.GetPath().Append(
+      base::FilePath::FromUTF8Unsafe("\xD0\xA2\xD0\xB5\xD1\x81\xD1\x82"));
+  base::CopyDirectory(src_dir, src_dir_russian, true);
+  base::FilePath zip_file = temp_dir.GetPath().AppendASCII("out_russian.zip");
+
+  EXPECT_TRUE(zip::Zip(src_dir_russian, zip_file, true));
+  TestUnzipFile(zip_file, true);
+}
+
+TEST_F(ZipTest, ZipTimeStamp) {
+  // The dates tested are arbitrary, with some constraints. The zip format can
+  // only store years from 1980 to 2107 and an even number of seconds, due to it
+  // using the ms dos date format.
+
+  // Valid arbitrary date.
+  TestTimeStamp("23 Oct 1997 23:22:20", VALID_YEAR);
+
+  // Date before 1980, zip format limitation, must default to unix epoch.
+  TestTimeStamp("29 Dec 1979 21:00:10", INVALID_YEAR);
+
+  // Despite the minizip headers telling the maximum year should be 2044, it
+  // can actually go up to 2107. Beyond that, the dos date format cannot store
+  // the year (2107-1980=127). To test that limit, the input file needs to be
+  // touched, but the code that modifies the file access and modification times
+  // relies on time_t which is defined as long, therefore being in many
+  // platforms just a 4-byte integer, like 32-bit Mac OSX or linux. As such, it
+  // suffers from the year-2038 bug. Therefore 2038 is the highest we can test
+  // in all platforms reliably.
+  TestTimeStamp("02 Jan 2038 23:59:58", VALID_YEAR);
+}
+
+#if defined(OS_POSIX)
+TEST_F(ZipTest, ZipFiles) {
+  base::FilePath src_dir;
+  ASSERT_TRUE(GetTestDataDirectory(&src_dir));
+  src_dir = src_dir.AppendASCII("test");
+
+  base::ScopedTempDir temp_dir;
+  ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
+  base::FilePath zip_name = temp_dir.GetPath().AppendASCII("out.zip");
+
+  base::File zip_file(zip_name,
+                      base::File::FLAG_CREATE | base::File::FLAG_WRITE);
+  ASSERT_TRUE(zip_file.IsValid());
+  EXPECT_TRUE(zip::ZipFiles(src_dir, zip_file_list_,
+                            zip_file.GetPlatformFile()));
+  zip_file.Close();
+
+  zip::ZipReader reader;
+  EXPECT_TRUE(reader.Open(zip_name));
+  EXPECT_EQ(zip_file_list_.size(), static_cast<size_t>(reader.num_entries()));
+  for (size_t i = 0; i < zip_file_list_.size(); ++i) {
+    EXPECT_TRUE(reader.HasMore());
+    EXPECT_TRUE(reader.OpenCurrentEntryInZip());
+    const zip::ZipReader::EntryInfo* entry_info = reader.current_entry_info();
+    EXPECT_EQ(entry_info->file_path(), zip_file_list_[i]);
+    reader.AdvanceToNextEntry();
+  }
+}
+#endif  // defined(OS_POSIX)
+
+TEST_F(ZipTest, UnzipFilesWithIncorrectSize) {
+  base::FilePath test_data_folder;
+  ASSERT_TRUE(GetTestDataDirectory(&test_data_folder));
+
+  // test_mismatch_size.zip contains files with names from 0.txt to 7.txt with
+  // sizes from 0 to 7 bytes respectively, but the metadata in the zip file says
+  // the uncompressed size is 3 bytes. The ZipReader and minizip code needs to
+  // be clever enough to get all the data out.
+  base::FilePath test_zip_file =
+      test_data_folder.AppendASCII("test_mismatch_size.zip");
+
+  base::ScopedTempDir scoped_temp_dir;
+  ASSERT_TRUE(scoped_temp_dir.CreateUniqueTempDir());
+  const base::FilePath& temp_dir = scoped_temp_dir.GetPath();
+
+  ASSERT_TRUE(zip::Unzip(test_zip_file, temp_dir));
+  EXPECT_TRUE(base::DirectoryExists(temp_dir.AppendASCII("d")));
+
+  for (int i = 0; i < 8; i++) {
+    SCOPED_TRACE(base::StringPrintf("Processing %d.txt", i));
+    base::FilePath file_path = temp_dir.AppendASCII(
+        base::StringPrintf("%d.txt", i));
+    int64_t file_size = -1;
+    EXPECT_TRUE(base::GetFileSize(file_path, &file_size));
+    EXPECT_EQ(static_cast<int64_t>(i), file_size);
+  }
+}
+
+TEST_F(ZipTest, ZipWithFileAccessor) {
+  base::FilePath zip_file;
+  ASSERT_TRUE(base::CreateTemporaryFile(&zip_file));
+  zip::ZipParams params(base::FilePath(FILE_PATH_LITERAL("/test")), zip_file);
+  params.set_file_accessor(std::make_unique<VirtualFileSystem>());
+  ASSERT_TRUE(zip::Zip(params));
+
+  base::ScopedTempDir scoped_temp_dir;
+  ASSERT_TRUE(scoped_temp_dir.CreateUniqueTempDir());
+  const base::FilePath& temp_dir = scoped_temp_dir.GetPath();
+  ASSERT_TRUE(zip::Unzip(zip_file, temp_dir));
+  base::FilePath bar_dir = temp_dir.Append(FILE_PATH_LITERAL("bar"));
+  EXPECT_TRUE(base::DirectoryExists(bar_dir));
+  std::string file_content;
+  EXPECT_TRUE(base::ReadFileToString(
+      temp_dir.Append(FILE_PATH_LITERAL("foo.txt")), &file_content));
+  EXPECT_EQ(VirtualFileSystem::kFooContent, file_content);
+  EXPECT_TRUE(base::ReadFileToString(
+      bar_dir.Append(FILE_PATH_LITERAL("bar1.txt")), &file_content));
+  EXPECT_EQ(VirtualFileSystem::kBar1Content, file_content);
+  EXPECT_TRUE(base::ReadFileToString(
+      bar_dir.Append(FILE_PATH_LITERAL("bar2.txt")), &file_content));
+  EXPECT_EQ(VirtualFileSystem::kBar2Content, file_content);
+}
+
+}  // namespace
diff --git a/deps/v8/third_party/zlib/google/zip_writer.cc b/deps/v8/third_party/zlib/google/zip_writer.cc
new file mode 100644
index 00000000000000..1f2f073b30cb32
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/zip_writer.cc
@@ -0,0 +1,203 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/zlib/google/zip_writer.h"
+
+#include "base/files/file.h"
+#include "base/strings/string_util.h"
+#include "third_party/zlib/google/zip_internal.h"
+
+namespace zip {
+namespace internal {
+
+namespace {
+
+// Numbers of pending entries that trigger writting them to the ZIP file.
+constexpr size_t kMaxPendingEntriesCount = 50;
+
+bool AddFileContentToZip(zipFile zip_file,
+                         base::File file,
+                         const base::FilePath& file_path) {
+  int num_bytes;
+  char buf[zip::internal::kZipBufSize];
+  do {
+    num_bytes = file.ReadAtCurrentPos(buf, zip::internal::kZipBufSize);
+
+    if (num_bytes > 0) {
+      if (zipWriteInFileInZip(zip_file, buf, num_bytes) != ZIP_OK) {
+        DLOG(ERROR) << "Could not write data to zip for path "
+                    << file_path.value();
+        return false;
+      }
+    }
+  } while (num_bytes > 0);
+
+  return true;
+}
+
+bool OpenNewFileEntry(zipFile zip_file,
+                      const base::FilePath& path,
+                      bool is_directory,
+                      base::Time last_modified) {
+  std::string str_path = path.AsUTF8Unsafe();
+#if defined(OS_WIN)
+  base::ReplaceSubstringsAfterOffset(&str_path, 0u, "\\", "/");
+#endif
+  if (is_directory)
+    str_path += "/";
+
+  return zip::internal::ZipOpenNewFileInZip(zip_file, str_path, last_modified);
+}
+
+bool CloseNewFileEntry(zipFile zip_file) {
+  return zipCloseFileInZip(zip_file) == ZIP_OK;
+}
+
+bool AddFileEntryToZip(zipFile zip_file,
+                       const base::FilePath& path,
+                       base::File file) {
+  base::File::Info file_info;
+  if (!file.GetInfo(&file_info))
+    return false;
+
+  if (!OpenNewFileEntry(zip_file, path, /*is_directory=*/false,
+                        file_info.last_modified))
+    return false;
+
+  bool success = AddFileContentToZip(zip_file, std::move(file), path);
+  if (!CloseNewFileEntry(zip_file))
+    return false;
+
+  return success;
+}
+
+bool AddDirectoryEntryToZip(zipFile zip_file,
+                            const base::FilePath& path,
+                            base::Time last_modified) {
+  return OpenNewFileEntry(zip_file, path, /*is_directory=*/true,
+                          last_modified) &&
+         CloseNewFileEntry(zip_file);
+}
+
+}  // namespace
+
+#if defined(OS_POSIX)
+// static
+std::unique_ptr<ZipWriter> ZipWriter::CreateWithFd(
+    int zip_file_fd,
+    const base::FilePath& root_dir,
+    FileAccessor* file_accessor) {
+  DCHECK(zip_file_fd != base::kInvalidPlatformFile);
+  zipFile zip_file =
+      internal::OpenFdForZipping(zip_file_fd, APPEND_STATUS_CREATE);
+  if (!zip_file) {
+    DLOG(ERROR) << "Couldn't create ZIP file for FD " << zip_file_fd;
+    return nullptr;
+  }
+  return std::unique_ptr<ZipWriter>(
+      new ZipWriter(zip_file, root_dir, file_accessor));
+}
+#endif
+
+// static
+std::unique_ptr<ZipWriter> ZipWriter::Create(
+    const base::FilePath& zip_file_path,
+    const base::FilePath& root_dir,
+    FileAccessor* file_accessor) {
+  DCHECK(!zip_file_path.empty());
+  zipFile zip_file = internal::OpenForZipping(zip_file_path.AsUTF8Unsafe(),
+                                              APPEND_STATUS_CREATE);
+  if (!zip_file) {
+    DLOG(ERROR) << "Couldn't create ZIP file at path " << zip_file_path;
+    return nullptr;
+  }
+  return std::unique_ptr<ZipWriter>(
+      new ZipWriter(zip_file, root_dir, file_accessor));
+}
+
+ZipWriter::ZipWriter(zipFile zip_file,
+                     const base::FilePath& root_dir,
+                     FileAccessor* file_accessor)
+    : zip_file_(zip_file), root_dir_(root_dir), file_accessor_(file_accessor) {}
+
+ZipWriter::~ZipWriter() {
+  DCHECK(pending_entries_.empty());
+}
+
+bool ZipWriter::WriteEntries(const std::vector<base::FilePath>& paths) {
+  return AddEntries(paths) && Close();
+}
+
+bool ZipWriter::AddEntries(const std::vector<base::FilePath>& paths) {
+  DCHECK(zip_file_);
+  pending_entries_.insert(pending_entries_.end(), paths.begin(), paths.end());
+  return FlushEntriesIfNeeded(/*force=*/false);
+}
+
+bool ZipWriter::Close() {
+  bool success = FlushEntriesIfNeeded(/*force=*/true) &&
+                 zipClose(zip_file_, nullptr) == ZIP_OK;
+  zip_file_ = nullptr;
+  return success;
+}
+
+bool ZipWriter::FlushEntriesIfNeeded(bool force) {
+  if (pending_entries_.size() < kMaxPendingEntriesCount && !force)
+    return true;
+
+  while (pending_entries_.size() >= kMaxPendingEntriesCount ||
+         (force && !pending_entries_.empty())) {
+    size_t entry_count =
+        std::min(pending_entries_.size(), kMaxPendingEntriesCount);
+    std::vector<base::FilePath> relative_paths;
+    std::vector<base::FilePath> absolute_paths;
+    relative_paths.insert(relative_paths.begin(), pending_entries_.begin(),
+                          pending_entries_.begin() + entry_count);
+    for (auto iter = pending_entries_.begin();
+         iter != pending_entries_.begin() + entry_count; ++iter) {
+      // The FileAccessor requires absolute paths.
+      absolute_paths.push_back(root_dir_.Append(*iter));
+    }
+    pending_entries_.erase(pending_entries_.begin(),
+                           pending_entries_.begin() + entry_count);
+
+    // We don't know which paths are files and which ones are directories, and
+    // we want to avoid making a call to file_accessor_ for each entry. Open the
+    // files instead, invalid files are returned for directories.
+    std::vector<base::File> files =
+        file_accessor_->OpenFilesForReading(absolute_paths);
+    DCHECK_EQ(files.size(), relative_paths.size());
+    for (size_t i = 0; i < files.size(); i++) {
+      const base::FilePath& relative_path = relative_paths[i];
+      const base::FilePath& absolute_path = absolute_paths[i];
+      base::File file = std::move(files[i]);
+      if (file.IsValid()) {
+        if (!AddFileEntryToZip(zip_file_, relative_path, std::move(file))) {
+          LOG(ERROR) << "Failed to write file " << relative_path.value()
+                     << " to ZIP file.";
+          return false;
+        }
+      } else {
+        // Missing file or directory case.
+        base::Time last_modified =
+            file_accessor_->GetLastModifiedTime(absolute_path);
+        if (last_modified.is_null()) {
+          LOG(ERROR) << "Failed to write entry " << relative_path.value()
+                     << " to ZIP file.";
+          return false;
+        }
+        DCHECK(file_accessor_->DirectoryExists(absolute_path));
+        if (!AddDirectoryEntryToZip(zip_file_, relative_path, last_modified)) {
+          LOG(ERROR) << "Failed to write directory " << relative_path.value()
+                     << " to ZIP file.";
+          return false;
+        }
+      }
+    }
+  }
+  return true;
+}
+
+}  // namespace internal
+}  // namespace zip
diff --git a/deps/v8/third_party/zlib/google/zip_writer.h b/deps/v8/third_party/zlib/google/zip_writer.h
new file mode 100644
index 00000000000000..bd2a727b94d408
--- /dev/null
+++ b/deps/v8/third_party/zlib/google/zip_writer.h
@@ -0,0 +1,91 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_ZLIB_GOOGLE_ZIP_WRITER_H_
+#define THIRD_PARTY_ZLIB_GOOGLE_ZIP_WRITER_H_
+
+#include <memory>
+#include <vector>
+
+#include "base/files/file_path.h"
+#include "build/build_config.h"
+#include "third_party/zlib/google/zip.h"
+
+#if defined(USE_SYSTEM_MINIZIP)
+#include <minizip/unzip.h>
+#include <minizip/zip.h>
+#else
+#include "third_party/zlib/contrib/minizip/unzip.h"
+#include "third_party/zlib/contrib/minizip/zip.h"
+#endif
+
+namespace zip {
+namespace internal {
+
+// A class used to write entries to a ZIP file and buffering the reading of
+// files to limit the number of calls to the FileAccessor. This is for
+// performance reasons as these calls may be expensive when IPC based).
+// This class is so far internal and only used by zip.cc, but could be made
+// public if needed.
+class ZipWriter {
+ public:
+// Creates a writer that will write a ZIP file to |zip_file_fd|/|zip_file|
+// and which entries (specifies with AddEntries) are relative to |root_dir|.
+// All file reads are performed using |file_accessor|.
+#if defined(OS_POSIX)
+  static std::unique_ptr<ZipWriter> CreateWithFd(int zip_file_fd,
+                                                 const base::FilePath& root_dir,
+                                                 FileAccessor* file_accessor);
+#endif
+  static std::unique_ptr<ZipWriter> Create(const base::FilePath& zip_file,
+                                           const base::FilePath& root_dir,
+                                           FileAccessor* file_accessor);
+  ~ZipWriter();
+
+  // Writes the files at |paths| to the ZIP file and closes this Zip file.
+  // Note that the the FilePaths must be relative to |root_dir| specified in the
+  // Create method.
+  // Returns true if all entries were written successfuly.
+  bool WriteEntries(const std::vector<base::FilePath>& paths);
+
+ private:
+  ZipWriter(zipFile zip_file,
+            const base::FilePath& root_dir,
+            FileAccessor* file_accessor);
+
+  // Writes the pending entries to the ZIP file if there are at least
+  // |kMaxPendingEntriesCount| of them. If |force| is true, all pending entries
+  // are written regardless of how many there are.
+  // Returns false if writing an entry fails, true if no entry was written or
+  // there was no error writing entries.
+  bool FlushEntriesIfNeeded(bool force);
+
+  // Adds the files at |paths| to the ZIP file. These FilePaths must be relative
+  // to |root_dir| specified in the Create method.
+  bool AddEntries(const std::vector<base::FilePath>& paths);
+
+  // Closes the ZIP file.
+  // Returns true if successful, false otherwise (typically if an entry failed
+  // to be written).
+  bool Close();
+
+  // The entries that have been added but not yet written to the ZIP file.
+  std::vector<base::FilePath> pending_entries_;
+
+  // The actual zip file.
+  zipFile zip_file_;
+
+  // Path to the directory entry paths are relative to.
+  base::FilePath root_dir_;
+
+  // Abstraction over file access methods used to read files.
+  FileAccessor* file_accessor_;
+
+  DISALLOW_COPY_AND_ASSIGN(ZipWriter);
+};
+
+}  // namespace internal
+}  // namespace zip
+
+#endif  // THIRD_PARTY_ZLIB_GOOGLE_ZIP_WRITER_H_
\ No newline at end of file
diff --git a/deps/v8/third_party/zlib/gzclose.c b/deps/v8/third_party/zlib/gzclose.c
new file mode 100644
index 00000000000000..caeb99a3177f47
--- /dev/null
+++ b/deps/v8/third_party/zlib/gzclose.c
@@ -0,0 +1,25 @@
+/* gzclose.c -- zlib gzclose() function
+ * Copyright (C) 2004, 2010 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+#include "gzguts.h"
+
+/* gzclose() is in a separate file so that it is linked in only if it is used.
+   That way the other gzclose functions can be used instead to avoid linking in
+   unneeded compression or decompression routines. */
+int ZEXPORT gzclose(file)
+    gzFile file;
+{
+#ifndef NO_GZCOMPRESS
+    gz_statep state;
+
+    if (file == NULL)
+        return Z_STREAM_ERROR;
+    state = (gz_statep)file;
+
+    return state->mode == GZ_READ ? gzclose_r(file) : gzclose_w(file);
+#else
+    return gzclose_r(file);
+#endif
+}
diff --git a/deps/v8/third_party/zlib/gzguts.h b/deps/v8/third_party/zlib/gzguts.h
new file mode 100644
index 00000000000000..990a4d25149337
--- /dev/null
+++ b/deps/v8/third_party/zlib/gzguts.h
@@ -0,0 +1,218 @@
+/* gzguts.h -- zlib internal header definitions for gz* operations
+ * Copyright (C) 2004, 2005, 2010, 2011, 2012, 2013, 2016 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+#ifdef _LARGEFILE64_SOURCE
+#  ifndef _LARGEFILE_SOURCE
+#    define _LARGEFILE_SOURCE 1
+#  endif
+#  ifdef _FILE_OFFSET_BITS
+#    undef _FILE_OFFSET_BITS
+#  endif
+#endif
+
+#ifdef HAVE_HIDDEN
+#  define ZLIB_INTERNAL __attribute__((visibility ("hidden")))
+#else
+#  define ZLIB_INTERNAL
+#endif
+
+#include <stdio.h>
+#include "zlib.h"
+#ifdef STDC
+#  include <string.h>
+#  include <stdlib.h>
+#  include <limits.h>
+#endif
+
+#ifndef _POSIX_SOURCE
+#  define _POSIX_SOURCE
+#endif
+#include <fcntl.h>
+
+#ifdef _WIN32
+#  include <stddef.h>
+#endif
+
+#if defined(__TURBOC__) || defined(_MSC_VER) || defined(_WIN32)
+#  include <io.h>
+#endif
+
+#if defined(_WIN32) || defined(__CYGWIN__)
+#  define WIDECHAR
+#endif
+
+#ifdef WINAPI_FAMILY
+#  define open _open
+#  define read _read
+#  define write _write
+#  define close _close
+#endif
+
+#ifdef NO_DEFLATE       /* for compatibility with old definition */
+#  define NO_GZCOMPRESS
+#endif
+
+#if defined(STDC99) || (defined(__TURBOC__) && __TURBOC__ >= 0x550)
+#  ifndef HAVE_VSNPRINTF
+#    define HAVE_VSNPRINTF
+#  endif
+#endif
+
+#if defined(__CYGWIN__)
+#  ifndef HAVE_VSNPRINTF
+#    define HAVE_VSNPRINTF
+#  endif
+#endif
+
+#if defined(MSDOS) && defined(__BORLANDC__) && (BORLANDC > 0x410)
+#  ifndef HAVE_VSNPRINTF
+#    define HAVE_VSNPRINTF
+#  endif
+#endif
+
+#ifndef HAVE_VSNPRINTF
+#  ifdef MSDOS
+/* vsnprintf may exist on some MS-DOS compilers (DJGPP?),
+   but for now we just assume it doesn't. */
+#    define NO_vsnprintf
+#  endif
+#  ifdef __TURBOC__
+#    define NO_vsnprintf
+#  endif
+#  ifdef WIN32
+/* In Win32, vsnprintf is available as the "non-ANSI" _vsnprintf. */
+#    if !defined(vsnprintf) && !defined(NO_vsnprintf)
+#      if !defined(_MSC_VER) || ( defined(_MSC_VER) && _MSC_VER < 1500 )
+#         define vsnprintf _vsnprintf
+#      endif
+#    endif
+#  endif
+#  ifdef __SASC
+#    define NO_vsnprintf
+#  endif
+#  ifdef VMS
+#    define NO_vsnprintf
+#  endif
+#  ifdef __OS400__
+#    define NO_vsnprintf
+#  endif
+#  ifdef __MVS__
+#    define NO_vsnprintf
+#  endif
+#endif
+
+/* unlike snprintf (which is required in C99), _snprintf does not guarantee
+   null termination of the result -- however this is only used in gzlib.c where
+   the result is assured to fit in the space provided */
+#if defined(_MSC_VER) && _MSC_VER < 1900
+#  define snprintf _snprintf
+#endif
+
+#ifndef local
+#  define local static
+#endif
+/* since "static" is used to mean two completely different things in C, we
+   define "local" for the non-static meaning of "static", for readability
+   (compile with -Dlocal if your debugger can't find static symbols) */
+
+/* gz* functions always use library allocation functions */
+#ifndef STDC
+  extern voidp  malloc OF((uInt size));
+  extern void   free   OF((voidpf ptr));
+#endif
+
+/* get errno and strerror definition */
+#if defined UNDER_CE
+#  include <windows.h>
+#  define zstrerror() gz_strwinerror((DWORD)GetLastError())
+#else
+#  ifndef NO_STRERROR
+#    include <errno.h>
+#    define zstrerror() strerror(errno)
+#  else
+#    define zstrerror() "stdio error (consult errno)"
+#  endif
+#endif
+
+/* provide prototypes for these when building zlib without LFS */
+#if !defined(_LARGEFILE64_SOURCE) || _LFS64_LARGEFILE-0 == 0
+    ZEXTERN gzFile ZEXPORT gzopen64 OF((const char *, const char *));
+    ZEXTERN z_off64_t ZEXPORT gzseek64 OF((gzFile, z_off64_t, int));
+    ZEXTERN z_off64_t ZEXPORT gztell64 OF((gzFile));
+    ZEXTERN z_off64_t ZEXPORT gzoffset64 OF((gzFile));
+#endif
+
+/* default memLevel */
+#if MAX_MEM_LEVEL >= 8
+#  define DEF_MEM_LEVEL 8
+#else
+#  define DEF_MEM_LEVEL  MAX_MEM_LEVEL
+#endif
+
+/* default i/o buffer size -- double this for output when reading (this and
+   twice this must be able to fit in an unsigned type) */
+#define GZBUFSIZE 8192
+
+/* gzip modes, also provide a little integrity check on the passed structure */
+#define GZ_NONE 0
+#define GZ_READ 7247
+#define GZ_WRITE 31153
+#define GZ_APPEND 1     /* mode set to GZ_WRITE after the file is opened */
+
+/* values for gz_state how */
+#define LOOK 0      /* look for a gzip header */
+#define COPY 1      /* copy input directly */
+#define GZIP 2      /* decompress a gzip stream */
+
+/* internal gzip file state data structure */
+typedef struct {
+        /* exposed contents for gzgetc() macro */
+    struct gzFile_s x;      /* "x" for exposed */
+                            /* x.have: number of bytes available at x.next */
+                            /* x.next: next output data to deliver or write */
+                            /* x.pos: current position in uncompressed data */
+        /* used for both reading and writing */
+    int mode;               /* see gzip modes above */
+    int fd;                 /* file descriptor */
+    char *path;             /* path or fd for error messages */
+    unsigned size;          /* buffer size, zero if not allocated yet */
+    unsigned want;          /* requested buffer size, default is GZBUFSIZE */
+    unsigned char *in;      /* input buffer (double-sized when writing) */
+    unsigned char *out;     /* output buffer (double-sized when reading) */
+    int direct;             /* 0 if processing gzip, 1 if transparent */
+        /* just for reading */
+    int how;                /* 0: get header, 1: copy, 2: decompress */
+    z_off64_t start;        /* where the gzip data started, for rewinding */
+    int eof;                /* true if end of input file reached */
+    int past;               /* true if read requested past end */
+        /* just for writing */
+    int level;              /* compression level */
+    int strategy;           /* compression strategy */
+        /* seek request */
+    z_off64_t skip;         /* amount to skip (already rewound if backwards) */
+    int seek;               /* true if seek request pending */
+        /* error information */
+    int err;                /* error code */
+    char *msg;              /* error message */
+        /* zlib inflate or deflate stream */
+    z_stream strm;          /* stream structure in-place (not a pointer) */
+} gz_state;
+typedef gz_state FAR *gz_statep;
+
+/* shared functions */
+void ZLIB_INTERNAL gz_error OF((gz_statep, int, const char *));
+#if defined UNDER_CE
+char ZLIB_INTERNAL *gz_strwinerror OF((DWORD error));
+#endif
+
+/* GT_OFF(x), where x is an unsigned value, is true if x > maximum z_off64_t
+   value -- needed when comparing unsigned to z_off64_t, which is signed
+   (possible z_off64_t types off_t, off64_t, and long are all signed) */
+#ifdef INT_MAX
+#  define GT_OFF(x) (sizeof(int) == sizeof(z_off64_t) && (x) > INT_MAX)
+#else
+unsigned ZLIB_INTERNAL gz_intmax OF((void));
+#  define GT_OFF(x) (sizeof(int) == sizeof(z_off64_t) && (x) > gz_intmax())
+#endif
diff --git a/deps/v8/third_party/zlib/gzlib.c b/deps/v8/third_party/zlib/gzlib.c
new file mode 100644
index 00000000000000..4105e6aff92594
--- /dev/null
+++ b/deps/v8/third_party/zlib/gzlib.c
@@ -0,0 +1,637 @@
+/* gzlib.c -- zlib functions common to reading and writing gzip files
+ * Copyright (C) 2004-2017 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+#include "gzguts.h"
+
+#if defined(_WIN32) && !defined(__BORLANDC__) && !defined(__MINGW32__)
+#  define LSEEK _lseeki64
+#else
+#if defined(_LARGEFILE64_SOURCE) && _LFS64_LARGEFILE-0
+#  define LSEEK lseek64
+#else
+#  define LSEEK lseek
+#endif
+#endif
+
+/* Local functions */
+local void gz_reset OF((gz_statep));
+local gzFile gz_open OF((const void *, int, const char *));
+
+#if defined UNDER_CE
+
+/* Map the Windows error number in ERROR to a locale-dependent error message
+   string and return a pointer to it.  Typically, the values for ERROR come
+   from GetLastError.
+
+   The string pointed to shall not be modified by the application, but may be
+   overwritten by a subsequent call to gz_strwinerror
+
+   The gz_strwinerror function does not change the current setting of
+   GetLastError. */
+char ZLIB_INTERNAL *gz_strwinerror (error)
+     DWORD error;
+{
+    static char buf[1024];
+
+    wchar_t *msgbuf;
+    DWORD lasterr = GetLastError();
+    DWORD chars = FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM
+        | FORMAT_MESSAGE_ALLOCATE_BUFFER,
+        NULL,
+        error,
+        0, /* Default language */
+        (LPVOID)&msgbuf,
+        0,
+        NULL);
+    if (chars != 0) {
+        /* If there is an \r\n appended, zap it.  */
+        if (chars >= 2
+            && msgbuf[chars - 2] == '\r' && msgbuf[chars - 1] == '\n') {
+            chars -= 2;
+            msgbuf[chars] = 0;
+        }
+
+        if (chars > sizeof (buf) - 1) {
+            chars = sizeof (buf) - 1;
+            msgbuf[chars] = 0;
+        }
+
+        wcstombs(buf, msgbuf, chars + 1);
+        LocalFree(msgbuf);
+    }
+    else {
+        sprintf(buf, "unknown win32 error (%ld)", error);
+    }
+
+    SetLastError(lasterr);
+    return buf;
+}
+
+#endif /* UNDER_CE */
+
+/* Reset gzip file state */
+local void gz_reset(state)
+    gz_statep state;
+{
+    state->x.have = 0;              /* no output data available */
+    if (state->mode == GZ_READ) {   /* for reading ... */
+        state->eof = 0;             /* not at end of file */
+        state->past = 0;            /* have not read past end yet */
+        state->how = LOOK;          /* look for gzip header */
+    }
+    state->seek = 0;                /* no seek request pending */
+    gz_error(state, Z_OK, NULL);    /* clear error */
+    state->x.pos = 0;               /* no uncompressed data yet */
+    state->strm.avail_in = 0;       /* no input data yet */
+}
+
+/* Open a gzip file either by name or file descriptor. */
+local gzFile gz_open(path, fd, mode)
+    const void *path;
+    int fd;
+    const char *mode;
+{
+    gz_statep state;
+    z_size_t len;
+    int oflag;
+#ifdef O_CLOEXEC
+    int cloexec = 0;
+#endif
+#ifdef O_EXCL
+    int exclusive = 0;
+#endif
+
+    /* check input */
+    if (path == NULL)
+        return NULL;
+
+    /* allocate gzFile structure to return */
+    state = (gz_statep)malloc(sizeof(gz_state));
+    if (state == NULL)
+        return NULL;
+    state->size = 0;            /* no buffers allocated yet */
+    state->want = GZBUFSIZE;    /* requested buffer size */
+    state->msg = NULL;          /* no error message yet */
+
+    /* interpret mode */
+    state->mode = GZ_NONE;
+    state->level = Z_DEFAULT_COMPRESSION;
+    state->strategy = Z_DEFAULT_STRATEGY;
+    state->direct = 0;
+    while (*mode) {
+        if (*mode >= '0' && *mode <= '9')
+            state->level = *mode - '0';
+        else
+            switch (*mode) {
+            case 'r':
+                state->mode = GZ_READ;
+                break;
+#ifndef NO_GZCOMPRESS
+            case 'w':
+                state->mode = GZ_WRITE;
+                break;
+            case 'a':
+                state->mode = GZ_APPEND;
+                break;
+#endif
+            case '+':       /* can't read and write at the same time */
+                free(state);
+                return NULL;
+            case 'b':       /* ignore -- will request binary anyway */
+                break;
+#ifdef O_CLOEXEC
+            case 'e':
+                cloexec = 1;
+                break;
+#endif
+#ifdef O_EXCL
+            case 'x':
+                exclusive = 1;
+                break;
+#endif
+            case 'f':
+                state->strategy = Z_FILTERED;
+                break;
+            case 'h':
+                state->strategy = Z_HUFFMAN_ONLY;
+                break;
+            case 'R':
+                state->strategy = Z_RLE;
+                break;
+            case 'F':
+                state->strategy = Z_FIXED;
+                break;
+            case 'T':
+                state->direct = 1;
+                break;
+            default:        /* could consider as an error, but just ignore */
+                ;
+            }
+        mode++;
+    }
+
+    /* must provide an "r", "w", or "a" */
+    if (state->mode == GZ_NONE) {
+        free(state);
+        return NULL;
+    }
+
+    /* can't force transparent read */
+    if (state->mode == GZ_READ) {
+        if (state->direct) {
+            free(state);
+            return NULL;
+        }
+        state->direct = 1;      /* for empty file */
+    }
+
+    /* save the path name for error messages */
+#ifdef WIDECHAR
+    if (fd == -2) {
+        len = wcstombs(NULL, path, 0);
+        if (len == (z_size_t)-1)
+            len = 0;
+    }
+    else
+#endif
+        len = strlen((const char *)path);
+    state->path = (char *)malloc(len + 1);
+    if (state->path == NULL) {
+        free(state);
+        return NULL;
+    }
+#ifdef WIDECHAR
+    if (fd == -2)
+        if (len)
+            wcstombs(state->path, path, len + 1);
+        else
+            *(state->path) = 0;
+    else
+#endif
+#if !defined(NO_snprintf) && !defined(NO_vsnprintf)
+        (void)snprintf(state->path, len + 1, "%s", (const char *)path);
+#else
+        strcpy(state->path, path);
+#endif
+
+    /* compute the flags for open() */
+    oflag =
+#ifdef O_LARGEFILE
+        O_LARGEFILE |
+#endif
+#ifdef O_BINARY
+        O_BINARY |
+#endif
+#ifdef O_CLOEXEC
+        (cloexec ? O_CLOEXEC : 0) |
+#endif
+        (state->mode == GZ_READ ?
+         O_RDONLY :
+         (O_WRONLY | O_CREAT |
+#ifdef O_EXCL
+          (exclusive ? O_EXCL : 0) |
+#endif
+          (state->mode == GZ_WRITE ?
+           O_TRUNC :
+           O_APPEND)));
+
+    /* open the file with the appropriate flags (or just use fd) */
+    state->fd = fd > -1 ? fd : (
+#ifdef WIDECHAR
+        fd == -2 ? _wopen(path, oflag, 0666) :
+#endif
+        open((const char *)path, oflag, 0666));
+    if (state->fd == -1) {
+        free(state->path);
+        free(state);
+        return NULL;
+    }
+    if (state->mode == GZ_APPEND) {
+        LSEEK(state->fd, 0, SEEK_END);  /* so gzoffset() is correct */
+        state->mode = GZ_WRITE;         /* simplify later checks */
+    }
+
+    /* save the current position for rewinding (only if reading) */
+    if (state->mode == GZ_READ) {
+        state->start = LSEEK(state->fd, 0, SEEK_CUR);
+        if (state->start == -1) state->start = 0;
+    }
+
+    /* initialize stream */
+    gz_reset(state);
+
+    /* return stream */
+    return (gzFile)state;
+}
+
+/* -- see zlib.h -- */
+gzFile ZEXPORT gzopen(path, mode)
+    const char *path;
+    const char *mode;
+{
+    return gz_open(path, -1, mode);
+}
+
+/* -- see zlib.h -- */
+gzFile ZEXPORT gzopen64(path, mode)
+    const char *path;
+    const char *mode;
+{
+    return gz_open(path, -1, mode);
+}
+
+/* -- see zlib.h -- */
+gzFile ZEXPORT gzdopen(fd, mode)
+    int fd;
+    const char *mode;
+{
+    char *path;         /* identifier for error messages */
+    gzFile gz;
+
+    if (fd == -1 || (path = (char *)malloc(7 + 3 * sizeof(int))) == NULL)
+        return NULL;
+#if !defined(NO_snprintf) && !defined(NO_vsnprintf)
+    (void)snprintf(path, 7 + 3 * sizeof(int), "<fd:%d>", fd);
+#else
+    sprintf(path, "<fd:%d>", fd);   /* for debugging */
+#endif
+    gz = gz_open(path, fd, mode);
+    free(path);
+    return gz;
+}
+
+/* -- see zlib.h -- */
+#ifdef WIDECHAR
+gzFile ZEXPORT gzopen_w(path, mode)
+    const wchar_t *path;
+    const char *mode;
+{
+    return gz_open(path, -2, mode);
+}
+#endif
+
+/* -- see zlib.h -- */
+int ZEXPORT gzbuffer(file, size)
+    gzFile file;
+    unsigned size;
+{
+    gz_statep state;
+
+    /* get internal structure and check integrity */
+    if (file == NULL)
+        return -1;
+    state = (gz_statep)file;
+    if (state->mode != GZ_READ && state->mode != GZ_WRITE)
+        return -1;
+
+    /* make sure we haven't already allocated memory */
+    if (state->size != 0)
+        return -1;
+
+    /* check and set requested size */
+    if ((size << 1) < size)
+        return -1;              /* need to be able to double it */
+    if (size < 2)
+        size = 2;               /* need two bytes to check magic header */
+    state->want = size;
+    return 0;
+}
+
+/* -- see zlib.h -- */
+int ZEXPORT gzrewind(file)
+    gzFile file;
+{
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return -1;
+    state = (gz_statep)file;
+
+    /* check that we're reading and that there's no error */
+    if (state->mode != GZ_READ ||
+            (state->err != Z_OK && state->err != Z_BUF_ERROR))
+        return -1;
+
+    /* back up and start over */
+    if (LSEEK(state->fd, state->start, SEEK_SET) == -1)
+        return -1;
+    gz_reset(state);
+    return 0;
+}
+
+/* -- see zlib.h -- */
+z_off64_t ZEXPORT gzseek64(file, offset, whence)
+    gzFile file;
+    z_off64_t offset;
+    int whence;
+{
+    unsigned n;
+    z_off64_t ret;
+    gz_statep state;
+
+    /* get internal structure and check integrity */
+    if (file == NULL)
+        return -1;
+    state = (gz_statep)file;
+    if (state->mode != GZ_READ && state->mode != GZ_WRITE)
+        return -1;
+
+    /* check that there's no error */
+    if (state->err != Z_OK && state->err != Z_BUF_ERROR)
+        return -1;
+
+    /* can only seek from start or relative to current position */
+    if (whence != SEEK_SET && whence != SEEK_CUR)
+        return -1;
+
+    /* normalize offset to a SEEK_CUR specification */
+    if (whence == SEEK_SET)
+        offset -= state->x.pos;
+    else if (state->seek)
+        offset += state->skip;
+    state->seek = 0;
+
+    /* if within raw area while reading, just go there */
+    if (state->mode == GZ_READ && state->how == COPY &&
+            state->x.pos + offset >= 0) {
+        ret = LSEEK(state->fd, offset - state->x.have, SEEK_CUR);
+        if (ret == -1)
+            return -1;
+        state->x.have = 0;
+        state->eof = 0;
+        state->past = 0;
+        state->seek = 0;
+        gz_error(state, Z_OK, NULL);
+        state->strm.avail_in = 0;
+        state->x.pos += offset;
+        return state->x.pos;
+    }
+
+    /* calculate skip amount, rewinding if needed for back seek when reading */
+    if (offset < 0) {
+        if (state->mode != GZ_READ)         /* writing -- can't go backwards */
+            return -1;
+        offset += state->x.pos;
+        if (offset < 0)                     /* before start of file! */
+            return -1;
+        if (gzrewind(file) == -1)           /* rewind, then skip to offset */
+            return -1;
+    }
+
+    /* if reading, skip what's in output buffer (one less gzgetc() check) */
+    if (state->mode == GZ_READ) {
+        n = GT_OFF(state->x.have) || (z_off64_t)state->x.have > offset ?
+            (unsigned)offset : state->x.have;
+        state->x.have -= n;
+        state->x.next += n;
+        state->x.pos += n;
+        offset -= n;
+    }
+
+    /* request skip (if not zero) */
+    if (offset) {
+        state->seek = 1;
+        state->skip = offset;
+    }
+    return state->x.pos + offset;
+}
+
+/* -- see zlib.h -- */
+z_off_t ZEXPORT gzseek(file, offset, whence)
+    gzFile file;
+    z_off_t offset;
+    int whence;
+{
+    z_off64_t ret;
+
+    ret = gzseek64(file, (z_off64_t)offset, whence);
+    return ret == (z_off_t)ret ? (z_off_t)ret : -1;
+}
+
+/* -- see zlib.h -- */
+z_off64_t ZEXPORT gztell64(file)
+    gzFile file;
+{
+    gz_statep state;
+
+    /* get internal structure and check integrity */
+    if (file == NULL)
+        return -1;
+    state = (gz_statep)file;
+    if (state->mode != GZ_READ && state->mode != GZ_WRITE)
+        return -1;
+
+    /* return position */
+    return state->x.pos + (state->seek ? state->skip : 0);
+}
+
+/* -- see zlib.h -- */
+z_off_t ZEXPORT gztell(file)
+    gzFile file;
+{
+    z_off64_t ret;
+
+    ret = gztell64(file);
+    return ret == (z_off_t)ret ? (z_off_t)ret : -1;
+}
+
+/* -- see zlib.h -- */
+z_off64_t ZEXPORT gzoffset64(file)
+    gzFile file;
+{
+    z_off64_t offset;
+    gz_statep state;
+
+    /* get internal structure and check integrity */
+    if (file == NULL)
+        return -1;
+    state = (gz_statep)file;
+    if (state->mode != GZ_READ && state->mode != GZ_WRITE)
+        return -1;
+
+    /* compute and return effective offset in file */
+    offset = LSEEK(state->fd, 0, SEEK_CUR);
+    if (offset == -1)
+        return -1;
+    if (state->mode == GZ_READ)             /* reading */
+        offset -= state->strm.avail_in;     /* don't count buffered input */
+    return offset;
+}
+
+/* -- see zlib.h -- */
+z_off_t ZEXPORT gzoffset(file)
+    gzFile file;
+{
+    z_off64_t ret;
+
+    ret = gzoffset64(file);
+    return ret == (z_off_t)ret ? (z_off_t)ret : -1;
+}
+
+/* -- see zlib.h -- */
+int ZEXPORT gzeof(file)
+    gzFile file;
+{
+    gz_statep state;
+
+    /* get internal structure and check integrity */
+    if (file == NULL)
+        return 0;
+    state = (gz_statep)file;
+    if (state->mode != GZ_READ && state->mode != GZ_WRITE)
+        return 0;
+
+    /* return end-of-file state */
+    return state->mode == GZ_READ ? state->past : 0;
+}
+
+/* -- see zlib.h -- */
+const char * ZEXPORT gzerror(file, errnum)
+    gzFile file;
+    int *errnum;
+{
+    gz_statep state;
+
+    /* get internal structure and check integrity */
+    if (file == NULL)
+        return NULL;
+    state = (gz_statep)file;
+    if (state->mode != GZ_READ && state->mode != GZ_WRITE)
+        return NULL;
+
+    /* return error information */
+    if (errnum != NULL)
+        *errnum = state->err;
+    return state->err == Z_MEM_ERROR ? "out of memory" :
+                                       (state->msg == NULL ? "" : state->msg);
+}
+
+/* -- see zlib.h -- */
+void ZEXPORT gzclearerr(file)
+    gzFile file;
+{
+    gz_statep state;
+
+    /* get internal structure and check integrity */
+    if (file == NULL)
+        return;
+    state = (gz_statep)file;
+    if (state->mode != GZ_READ && state->mode != GZ_WRITE)
+        return;
+
+    /* clear error and end-of-file */
+    if (state->mode == GZ_READ) {
+        state->eof = 0;
+        state->past = 0;
+    }
+    gz_error(state, Z_OK, NULL);
+}
+
+/* Create an error message in allocated memory and set state->err and
+   state->msg accordingly.  Free any previous error message already there.  Do
+   not try to free or allocate space if the error is Z_MEM_ERROR (out of
+   memory).  Simply save the error message as a static string.  If there is an
+   allocation failure constructing the error message, then convert the error to
+   out of memory. */
+void ZLIB_INTERNAL gz_error(state, err, msg)
+    gz_statep state;
+    int err;
+    const char *msg;
+{
+    /* free previously allocated message and clear */
+    if (state->msg != NULL) {
+        if (state->err != Z_MEM_ERROR)
+            free(state->msg);
+        state->msg = NULL;
+    }
+
+    /* if fatal, set state->x.have to 0 so that the gzgetc() macro fails */
+    if (err != Z_OK && err != Z_BUF_ERROR)
+        state->x.have = 0;
+
+    /* set error code, and if no message, then done */
+    state->err = err;
+    if (msg == NULL)
+        return;
+
+    /* for an out of memory error, return literal string when requested */
+    if (err == Z_MEM_ERROR)
+        return;
+
+    /* construct error message with path */
+    if ((state->msg = (char *)malloc(strlen(state->path) + strlen(msg) + 3)) ==
+            NULL) {
+        state->err = Z_MEM_ERROR;
+        return;
+    }
+#if !defined(NO_snprintf) && !defined(NO_vsnprintf)
+    (void)snprintf(state->msg, strlen(state->path) + strlen(msg) + 3,
+                   "%s%s%s", state->path, ": ", msg);
+#else
+    strcpy(state->msg, state->path);
+    strcat(state->msg, ": ");
+    strcat(state->msg, msg);
+#endif
+}
+
+#ifndef INT_MAX
+/* portably return maximum value for an int (when limits.h presumed not
+   available) -- we need to do this to cover cases where 2's complement not
+   used, since C standard permits 1's complement and sign-bit representations,
+   otherwise we could just use ((unsigned)-1) >> 1 */
+unsigned ZLIB_INTERNAL gz_intmax()
+{
+    unsigned p, q;
+
+    p = 1;
+    do {
+        q = p;
+        p <<= 1;
+        p++;
+    } while (p > q);
+    return q >> 1;
+}
+#endif
diff --git a/deps/v8/third_party/zlib/gzread.c b/deps/v8/third_party/zlib/gzread.c
new file mode 100644
index 00000000000000..832d3ef98c5948
--- /dev/null
+++ b/deps/v8/third_party/zlib/gzread.c
@@ -0,0 +1,658 @@
+/* gzread.c -- zlib functions for reading gzip files
+ * Copyright (C) 2004, 2005, 2010, 2011, 2012, 2013, 2016 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+#include "gzguts.h"
+
+/* Local functions */
+local int gz_load OF((gz_statep, unsigned char *, unsigned, unsigned *));
+local int gz_avail OF((gz_statep));
+local int gz_look OF((gz_statep));
+local int gz_decomp OF((gz_statep));
+local int gz_fetch OF((gz_statep));
+local int gz_skip OF((gz_statep, z_off64_t));
+local z_size_t gz_read OF((gz_statep, voidp, z_size_t));
+
+/* Use read() to load a buffer -- return -1 on error, otherwise 0.  Read from
+   state->fd, and update state->eof, state->err, and state->msg as appropriate.
+   This function needs to loop on read(), since read() is not guaranteed to
+   read the number of bytes requested, depending on the type of descriptor. */
+local int gz_load(state, buf, len, have)
+    gz_statep state;
+    unsigned char *buf;
+    unsigned len;
+    unsigned *have;
+{
+    int ret;
+    unsigned get, max = ((unsigned)-1 >> 2) + 1;
+
+    *have = 0;
+    do {
+        get = len - *have;
+        if (get > max)
+            get = max;
+        ret = read(state->fd, buf + *have, get);
+        if (ret <= 0)
+            break;
+        *have += (unsigned)ret;
+    } while (*have < len);
+    if (ret < 0) {
+        gz_error(state, Z_ERRNO, zstrerror());
+        return -1;
+    }
+    if (ret == 0)
+        state->eof = 1;
+    return 0;
+}
+
+/* Load up input buffer and set eof flag if last data loaded -- return -1 on
+   error, 0 otherwise.  Note that the eof flag is set when the end of the input
+   file is reached, even though there may be unused data in the buffer.  Once
+   that data has been used, no more attempts will be made to read the file.
+   If strm->avail_in != 0, then the current data is moved to the beginning of
+   the input buffer, and then the remainder of the buffer is loaded with the
+   available data from the input file. */
+local int gz_avail(state)
+    gz_statep state;
+{
+    unsigned got;
+    z_streamp strm = &(state->strm);
+
+    if (state->err != Z_OK && state->err != Z_BUF_ERROR)
+        return -1;
+    if (state->eof == 0) {
+        if (strm->avail_in) {       /* copy what's there to the start */
+            unsigned char *p = state->in;
+            unsigned const char *q = strm->next_in;
+            unsigned n = strm->avail_in;
+            do {
+                *p++ = *q++;
+            } while (--n);
+        }
+        if (gz_load(state, state->in + strm->avail_in,
+                    state->size - strm->avail_in, &got) == -1)
+            return -1;
+        strm->avail_in += got;
+        strm->next_in = state->in;
+    }
+    return 0;
+}
+
+/* Look for gzip header, set up for inflate or copy.  state->x.have must be 0.
+   If this is the first time in, allocate required memory.  state->how will be
+   left unchanged if there is no more input data available, will be set to COPY
+   if there is no gzip header and direct copying will be performed, or it will
+   be set to GZIP for decompression.  If direct copying, then leftover input
+   data from the input buffer will be copied to the output buffer.  In that
+   case, all further file reads will be directly to either the output buffer or
+   a user buffer.  If decompressing, the inflate state will be initialized.
+   gz_look() will return 0 on success or -1 on failure. */
+local int gz_look(state)
+    gz_statep state;
+{
+    z_streamp strm = &(state->strm);
+
+    /* allocate read buffers and inflate memory */
+    if (state->size == 0) {
+        /* allocate buffers */
+        state->in = (unsigned char *)malloc(state->want);
+        state->out = (unsigned char *)malloc(state->want << 1);
+        if (state->in == NULL || state->out == NULL) {
+            free(state->out);
+            free(state->in);
+            gz_error(state, Z_MEM_ERROR, "out of memory");
+            return -1;
+        }
+        state->size = state->want;
+
+        /* allocate inflate memory */
+        state->strm.zalloc = Z_NULL;
+        state->strm.zfree = Z_NULL;
+        state->strm.opaque = Z_NULL;
+        state->strm.avail_in = 0;
+        state->strm.next_in = Z_NULL;
+        if (inflateInit2(&(state->strm), 15 + 16) != Z_OK) {    /* gunzip */
+            free(state->out);
+            free(state->in);
+            state->size = 0;
+            gz_error(state, Z_MEM_ERROR, "out of memory");
+            return -1;
+        }
+    }
+
+    /* get at least the magic bytes in the input buffer */
+    if (strm->avail_in < 2) {
+        if (gz_avail(state) == -1)
+            return -1;
+        if (strm->avail_in == 0)
+            return 0;
+    }
+
+    /* look for gzip magic bytes -- if there, do gzip decoding (note: there is
+       a logical dilemma here when considering the case of a partially written
+       gzip file, to wit, if a single 31 byte is written, then we cannot tell
+       whether this is a single-byte file, or just a partially written gzip
+       file -- for here we assume that if a gzip file is being written, then
+       the header will be written in a single operation, so that reading a
+       single byte is sufficient indication that it is not a gzip file) */
+    if (strm->avail_in > 1 &&
+            strm->next_in[0] == 31 && strm->next_in[1] == 139) {
+        inflateReset(strm);
+        state->how = GZIP;
+        state->direct = 0;
+        return 0;
+    }
+
+    /* no gzip header -- if we were decoding gzip before, then this is trailing
+       garbage.  Ignore the trailing garbage and finish. */
+    if (state->direct == 0) {
+        strm->avail_in = 0;
+        state->eof = 1;
+        state->x.have = 0;
+        return 0;
+    }
+
+    /* doing raw i/o, copy any leftover input to output -- this assumes that
+       the output buffer is larger than the input buffer, which also assures
+       space for gzungetc() */
+    state->x.next = state->out;
+    if (strm->avail_in) {
+        memcpy(state->x.next, strm->next_in, strm->avail_in);
+        state->x.have = strm->avail_in;
+        strm->avail_in = 0;
+    }
+    state->how = COPY;
+    state->direct = 1;
+    return 0;
+}
+
+/* Decompress from input to the provided next_out and avail_out in the state.
+   On return, state->x.have and state->x.next point to the just decompressed
+   data.  If the gzip stream completes, state->how is reset to LOOK to look for
+   the next gzip stream or raw data, once state->x.have is depleted.  Returns 0
+   on success, -1 on failure. */
+local int gz_decomp(state)
+    gz_statep state;
+{
+    int ret = Z_OK;
+    unsigned had;
+    z_streamp strm = &(state->strm);
+
+    /* fill output buffer up to end of deflate stream */
+    had = strm->avail_out;
+    do {
+        /* get more input for inflate() */
+        if (strm->avail_in == 0 && gz_avail(state) == -1)
+            return -1;
+        if (strm->avail_in == 0) {
+            gz_error(state, Z_BUF_ERROR, "unexpected end of file");
+            break;
+        }
+
+        /* decompress and handle errors */
+        ret = inflate(strm, Z_NO_FLUSH);
+        if (ret == Z_STREAM_ERROR || ret == Z_NEED_DICT) {
+            gz_error(state, Z_STREAM_ERROR,
+                     "internal error: inflate stream corrupt");
+            return -1;
+        }
+        if (ret == Z_MEM_ERROR) {
+            gz_error(state, Z_MEM_ERROR, "out of memory");
+            return -1;
+        }
+        if (ret == Z_DATA_ERROR) {              /* deflate stream invalid */
+            gz_error(state, Z_DATA_ERROR,
+                     strm->msg == NULL ? "compressed data error" : strm->msg);
+            return -1;
+        }
+    } while (strm->avail_out && ret != Z_STREAM_END);
+
+    /* update available output */
+    state->x.have = had - strm->avail_out;
+    state->x.next = strm->next_out - state->x.have;
+
+    /* if the gzip stream completed successfully, look for another */
+    if (ret == Z_STREAM_END)
+        state->how = LOOK;
+
+    /* good decompression */
+    return 0;
+}
+
+/* Fetch data and put it in the output buffer.  Assumes state->x.have is 0.
+   Data is either copied from the input file or decompressed from the input
+   file depending on state->how.  If state->how is LOOK, then a gzip header is
+   looked for to determine whether to copy or decompress.  Returns -1 on error,
+   otherwise 0.  gz_fetch() will leave state->how as COPY or GZIP unless the
+   end of the input file has been reached and all data has been processed.  */
+local int gz_fetch(state)
+    gz_statep state;
+{
+    z_streamp strm = &(state->strm);
+
+    do {
+        switch(state->how) {
+        case LOOK:      /* -> LOOK, COPY (only if never GZIP), or GZIP */
+            if (gz_look(state) == -1)
+                return -1;
+            if (state->how == LOOK)
+                return 0;
+            break;
+        case COPY:      /* -> COPY */
+            if (gz_load(state, state->out, state->size << 1, &(state->x.have))
+                    == -1)
+                return -1;
+            state->x.next = state->out;
+            return 0;
+        case GZIP:      /* -> GZIP or LOOK (if end of gzip stream) */
+            strm->avail_out = state->size << 1;
+            strm->next_out = state->out;
+            if (gz_decomp(state) == -1)
+                return -1;
+        }
+    } while (state->x.have == 0 && (!state->eof || strm->avail_in));
+    return 0;
+}
+
+/* Skip len uncompressed bytes of output.  Return -1 on error, 0 on success. */
+local int gz_skip(state, len)
+    gz_statep state;
+    z_off64_t len;
+{
+    unsigned n;
+
+    /* skip over len bytes or reach end-of-file, whichever comes first */
+    while (len)
+        /* skip over whatever is in output buffer */
+        if (state->x.have) {
+            n = GT_OFF(state->x.have) || (z_off64_t)state->x.have > len ?
+                (unsigned)len : state->x.have;
+            state->x.have -= n;
+            state->x.next += n;
+            state->x.pos += n;
+            len -= n;
+        }
+
+        /* output buffer empty -- return if we're at the end of the input */
+        else if (state->eof && state->strm.avail_in == 0)
+            break;
+
+        /* need more data to skip -- load up output buffer */
+        else {
+            /* get more output, looking for header if required */
+            if (gz_fetch(state) == -1)
+                return -1;
+        }
+    return 0;
+}
+
+/* Read len bytes into buf from file, or less than len up to the end of the
+   input.  Return the number of bytes read.  If zero is returned, either the
+   end of file was reached, or there was an error.  state->err must be
+   consulted in that case to determine which. */
+local z_size_t gz_read(state, buf, len)
+    gz_statep state;
+    voidp buf;
+    z_size_t len;
+{
+    z_size_t got;
+    unsigned n;
+
+    /* if len is zero, avoid unnecessary operations */
+    if (len == 0)
+        return 0;
+
+    /* process a skip request */
+    if (state->seek) {
+        state->seek = 0;
+        if (gz_skip(state, state->skip) == -1)
+            return 0;
+    }
+
+    /* get len bytes to buf, or less than len if at the end */
+    got = 0;
+    do {
+        /* set n to the maximum amount of len that fits in an unsigned int */
+        n = -1;
+        if (n > len)
+            n = len;
+
+        /* first just try copying data from the output buffer */
+        if (state->x.have) {
+            if (state->x.have < n)
+                n = state->x.have;
+            memcpy(buf, state->x.next, n);
+            state->x.next += n;
+            state->x.have -= n;
+        }
+
+        /* output buffer empty -- return if we're at the end of the input */
+        else if (state->eof && state->strm.avail_in == 0) {
+            state->past = 1;        /* tried to read past end */
+            break;
+        }
+
+        /* need output data -- for small len or new stream load up our output
+           buffer */
+        else if (state->how == LOOK || n < (state->size << 1)) {
+            /* get more output, looking for header if required */
+            if (gz_fetch(state) == -1)
+                return 0;
+            continue;       /* no progress yet -- go back to copy above */
+            /* the copy above assures that we will leave with space in the
+               output buffer, allowing at least one gzungetc() to succeed */
+        }
+
+        /* large len -- read directly into user buffer */
+        else if (state->how == COPY) {      /* read directly */
+            if (gz_load(state, (unsigned char *)buf, n, &n) == -1)
+                return 0;
+        }
+
+        /* large len -- decompress directly into user buffer */
+        else {  /* state->how == GZIP */
+            state->strm.avail_out = n;
+            state->strm.next_out = (unsigned char *)buf;
+            if (gz_decomp(state) == -1)
+                return 0;
+            n = state->x.have;
+            state->x.have = 0;
+        }
+
+        /* update progress */
+        len -= n;
+        buf = (char *)buf + n;
+        got += n;
+        state->x.pos += n;
+    } while (len);
+
+    /* return number of bytes read into user buffer */
+    return got;
+}
+
+/* -- see zlib.h -- */
+int ZEXPORT gzread(file, buf, len)
+    gzFile file;
+    voidp buf;
+    unsigned len;
+{
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return -1;
+    state = (gz_statep)file;
+
+    /* check that we're reading and that there's no (serious) error */
+    if (state->mode != GZ_READ ||
+            (state->err != Z_OK && state->err != Z_BUF_ERROR))
+        return -1;
+
+    /* since an int is returned, make sure len fits in one, otherwise return
+       with an error (this avoids a flaw in the interface) */
+    if ((int)len < 0) {
+        gz_error(state, Z_STREAM_ERROR, "request does not fit in an int");
+        return -1;
+    }
+
+    /* read len or fewer bytes to buf */
+    len = gz_read(state, buf, len);
+
+    /* check for an error */
+    if (len == 0 && state->err != Z_OK && state->err != Z_BUF_ERROR)
+        return -1;
+
+    /* return the number of bytes read (this is assured to fit in an int) */
+    return (int)len;
+}
+
+/* -- see zlib.h -- */
+z_size_t ZEXPORT gzfread(buf, size, nitems, file)
+    voidp buf;
+    z_size_t size;
+    z_size_t nitems;
+    gzFile file;
+{
+    z_size_t len;
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return 0;
+    state = (gz_statep)file;
+
+    /* check that we're reading and that there's no (serious) error */
+    if (state->mode != GZ_READ ||
+            (state->err != Z_OK && state->err != Z_BUF_ERROR))
+        return 0;
+
+    /* compute bytes to read -- error on overflow */
+    len = nitems * size;
+    if (size && len / size != nitems) {
+        gz_error(state, Z_STREAM_ERROR, "request does not fit in a size_t");
+        return 0;
+    }
+
+    /* read len or fewer bytes to buf, return the number of full items read */
+    return len ? gz_read(state, buf, len) / size : 0;
+}
+
+/* -- see zlib.h -- */
+#ifdef Z_PREFIX_SET
+#  undef z_gzgetc
+#else
+#  undef gzgetc
+#  ifdef Z_CR_PREFIX_SET
+#    define gzgetc Cr_z_gzgetc
+#  endif
+#endif
+
+int ZEXPORT gzgetc(file)
+    gzFile file;
+{
+    int ret;
+    unsigned char buf[1];
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return -1;
+    state = (gz_statep)file;
+
+    /* check that we're reading and that there's no (serious) error */
+    if (state->mode != GZ_READ ||
+        (state->err != Z_OK && state->err != Z_BUF_ERROR))
+        return -1;
+
+    /* try output buffer (no need to check for skip request) */
+    if (state->x.have) {
+        state->x.have--;
+        state->x.pos++;
+        return *(state->x.next)++;
+    }
+
+    /* nothing there -- try gz_read() */
+    ret = gz_read(state, buf, 1);
+    return ret < 1 ? -1 : buf[0];
+}
+
+int ZEXPORT gzgetc_(file)
+gzFile file;
+{
+    return gzgetc(file);
+}
+
+/* -- see zlib.h -- */
+int ZEXPORT gzungetc(c, file)
+    int c;
+    gzFile file;
+{
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return -1;
+    state = (gz_statep)file;
+
+    /* check that we're reading and that there's no (serious) error */
+    if (state->mode != GZ_READ ||
+        (state->err != Z_OK && state->err != Z_BUF_ERROR))
+        return -1;
+
+    /* process a skip request */
+    if (state->seek) {
+        state->seek = 0;
+        if (gz_skip(state, state->skip) == -1)
+            return -1;
+    }
+
+    /* can't push EOF */
+    if (c < 0)
+        return -1;
+
+    /* if output buffer empty, put byte at end (allows more pushing) */
+    if (state->x.have == 0) {
+        state->x.have = 1;
+        state->x.next = state->out + (state->size << 1) - 1;
+        state->x.next[0] = (unsigned char)c;
+        state->x.pos--;
+        state->past = 0;
+        return c;
+    }
+
+    /* if no room, give up (must have already done a gzungetc()) */
+    if (state->x.have == (state->size << 1)) {
+        gz_error(state, Z_DATA_ERROR, "out of room to push characters");
+        return -1;
+    }
+
+    /* slide output data if needed and insert byte before existing data */
+    if (state->x.next == state->out) {
+        unsigned char *src = state->out + state->x.have;
+        unsigned char *dest = state->out + (state->size << 1);
+        while (src > state->out)
+            *--dest = *--src;
+        state->x.next = dest;
+    }
+    state->x.have++;
+    state->x.next--;
+    state->x.next[0] = (unsigned char)c;
+    state->x.pos--;
+    state->past = 0;
+    return c;
+}
+
+/* -- see zlib.h -- */
+char * ZEXPORT gzgets(file, buf, len)
+    gzFile file;
+    char *buf;
+    int len;
+{
+    unsigned left, n;
+    char *str;
+    unsigned char *eol;
+    gz_statep state;
+
+    /* check parameters and get internal structure */
+    if (file == NULL || buf == NULL || len < 1)
+        return NULL;
+    state = (gz_statep)file;
+
+    /* check that we're reading and that there's no (serious) error */
+    if (state->mode != GZ_READ ||
+        (state->err != Z_OK && state->err != Z_BUF_ERROR))
+        return NULL;
+
+    /* process a skip request */
+    if (state->seek) {
+        state->seek = 0;
+        if (gz_skip(state, state->skip) == -1)
+            return NULL;
+    }
+
+    /* copy output bytes up to new line or len - 1, whichever comes first --
+       append a terminating zero to the string (we don't check for a zero in
+       the contents, let the user worry about that) */
+    str = buf;
+    left = (unsigned)len - 1;
+    if (left) do {
+        /* assure that something is in the output buffer */
+        if (state->x.have == 0 && gz_fetch(state) == -1)
+            return NULL;                /* error */
+        if (state->x.have == 0) {       /* end of file */
+            state->past = 1;            /* read past end */
+            break;                      /* return what we have */
+        }
+
+        /* look for end-of-line in current output buffer */
+        n = state->x.have > left ? left : state->x.have;
+        eol = (unsigned char *)memchr(state->x.next, '\n', n);
+        if (eol != NULL)
+            n = (unsigned)(eol - state->x.next) + 1;
+
+        /* copy through end-of-line, or remainder if not found */
+        memcpy(buf, state->x.next, n);
+        state->x.have -= n;
+        state->x.next += n;
+        state->x.pos += n;
+        left -= n;
+        buf += n;
+    } while (left && eol == NULL);
+
+    /* return terminated string, or if nothing, end of file */
+    if (buf == str)
+        return NULL;
+    buf[0] = 0;
+    return str;
+}
+
+/* -- see zlib.h -- */
+int ZEXPORT gzdirect(file)
+    gzFile file;
+{
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return 0;
+    state = (gz_statep)file;
+
+    /* if the state is not known, but we can find out, then do so (this is
+       mainly for right after a gzopen() or gzdopen()) */
+    if (state->mode == GZ_READ && state->how == LOOK && state->x.have == 0)
+        (void)gz_look(state);
+
+    /* return 1 if transparent, 0 if processing a gzip stream */
+    return state->direct;
+}
+
+/* -- see zlib.h -- */
+int ZEXPORT gzclose_r(file)
+    gzFile file;
+{
+    int ret, err;
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return Z_STREAM_ERROR;
+    state = (gz_statep)file;
+
+    /* check that we're reading */
+    if (state->mode != GZ_READ)
+        return Z_STREAM_ERROR;
+
+    /* free memory and close file */
+    if (state->size) {
+        inflateEnd(&(state->strm));
+        free(state->out);
+        free(state->in);
+    }
+    err = state->err == Z_BUF_ERROR ? Z_BUF_ERROR : Z_OK;
+    gz_error(state, Z_OK, NULL);
+    free(state->path);
+    ret = close(state->fd);
+    free(state);
+    return ret ? Z_ERRNO : err;
+}
diff --git a/deps/v8/third_party/zlib/gzwrite.c b/deps/v8/third_party/zlib/gzwrite.c
new file mode 100644
index 00000000000000..c7b5651d70b994
--- /dev/null
+++ b/deps/v8/third_party/zlib/gzwrite.c
@@ -0,0 +1,665 @@
+/* gzwrite.c -- zlib functions for writing gzip files
+ * Copyright (C) 2004-2017 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+#include "gzguts.h"
+
+/* Local functions */
+local int gz_init OF((gz_statep));
+local int gz_comp OF((gz_statep, int));
+local int gz_zero OF((gz_statep, z_off64_t));
+local z_size_t gz_write OF((gz_statep, voidpc, z_size_t));
+
+/* Initialize state for writing a gzip file.  Mark initialization by setting
+   state->size to non-zero.  Return -1 on a memory allocation failure, or 0 on
+   success. */
+local int gz_init(state)
+    gz_statep state;
+{
+    int ret;
+    z_streamp strm = &(state->strm);
+
+    /* allocate input buffer (double size for gzprintf) */
+    state->in = (unsigned char *)malloc(state->want << 1);
+    if (state->in == NULL) {
+        gz_error(state, Z_MEM_ERROR, "out of memory");
+        return -1;
+    }
+
+    /* only need output buffer and deflate state if compressing */
+    if (!state->direct) {
+        /* allocate output buffer */
+        state->out = (unsigned char *)malloc(state->want);
+        if (state->out == NULL) {
+            free(state->in);
+            gz_error(state, Z_MEM_ERROR, "out of memory");
+            return -1;
+        }
+
+        /* allocate deflate memory, set up for gzip compression */
+        strm->zalloc = Z_NULL;
+        strm->zfree = Z_NULL;
+        strm->opaque = Z_NULL;
+        ret = deflateInit2(strm, state->level, Z_DEFLATED,
+                           MAX_WBITS + 16, DEF_MEM_LEVEL, state->strategy);
+        if (ret != Z_OK) {
+            free(state->out);
+            free(state->in);
+            gz_error(state, Z_MEM_ERROR, "out of memory");
+            return -1;
+        }
+        strm->next_in = NULL;
+    }
+
+    /* mark state as initialized */
+    state->size = state->want;
+
+    /* initialize write buffer if compressing */
+    if (!state->direct) {
+        strm->avail_out = state->size;
+        strm->next_out = state->out;
+        state->x.next = strm->next_out;
+    }
+    return 0;
+}
+
+/* Compress whatever is at avail_in and next_in and write to the output file.
+   Return -1 if there is an error writing to the output file or if gz_init()
+   fails to allocate memory, otherwise 0.  flush is assumed to be a valid
+   deflate() flush value.  If flush is Z_FINISH, then the deflate() state is
+   reset to start a new gzip stream.  If gz->direct is true, then simply write
+   to the output file without compressing, and ignore flush. */
+local int gz_comp(state, flush)
+    gz_statep state;
+    int flush;
+{
+    int ret, writ;
+    unsigned have, put, max = ((unsigned)-1 >> 2) + 1;
+    z_streamp strm = &(state->strm);
+
+    /* allocate memory if this is the first time through */
+    if (state->size == 0 && gz_init(state) == -1)
+        return -1;
+
+    /* write directly if requested */
+    if (state->direct) {
+        while (strm->avail_in) {
+            put = strm->avail_in > max ? max : strm->avail_in;
+            writ = write(state->fd, strm->next_in, put);
+            if (writ < 0) {
+                gz_error(state, Z_ERRNO, zstrerror());
+                return -1;
+            }
+            strm->avail_in -= (unsigned)writ;
+            strm->next_in += writ;
+        }
+        return 0;
+    }
+
+    /* run deflate() on provided input until it produces no more output */
+    ret = Z_OK;
+    do {
+        /* write out current buffer contents if full, or if flushing, but if
+           doing Z_FINISH then don't write until we get to Z_STREAM_END */
+        if (strm->avail_out == 0 || (flush != Z_NO_FLUSH &&
+            (flush != Z_FINISH || ret == Z_STREAM_END))) {
+            while (strm->next_out > state->x.next) {
+                put = strm->next_out - state->x.next > (int)max ? max :
+                      (unsigned)(strm->next_out - state->x.next);
+                writ = write(state->fd, state->x.next, put);
+                if (writ < 0) {
+                    gz_error(state, Z_ERRNO, zstrerror());
+                    return -1;
+                }
+                state->x.next += writ;
+            }
+            if (strm->avail_out == 0) {
+                strm->avail_out = state->size;
+                strm->next_out = state->out;
+                state->x.next = state->out;
+            }
+        }
+
+        /* compress */
+        have = strm->avail_out;
+        ret = deflate(strm, flush);
+        if (ret == Z_STREAM_ERROR) {
+            gz_error(state, Z_STREAM_ERROR,
+                      "internal error: deflate stream corrupt");
+            return -1;
+        }
+        have -= strm->avail_out;
+    } while (have);
+
+    /* if that completed a deflate stream, allow another to start */
+    if (flush == Z_FINISH)
+        deflateReset(strm);
+
+    /* all done, no errors */
+    return 0;
+}
+
+/* Compress len zeros to output.  Return -1 on a write error or memory
+   allocation failure by gz_comp(), or 0 on success. */
+local int gz_zero(state, len)
+    gz_statep state;
+    z_off64_t len;
+{
+    int first;
+    unsigned n;
+    z_streamp strm = &(state->strm);
+
+    /* consume whatever's left in the input buffer */
+    if (strm->avail_in && gz_comp(state, Z_NO_FLUSH) == -1)
+        return -1;
+
+    /* compress len zeros (len guaranteed > 0) */
+    first = 1;
+    while (len) {
+        n = GT_OFF(state->size) || (z_off64_t)state->size > len ?
+            (unsigned)len : state->size;
+        if (first) {
+            memset(state->in, 0, n);
+            first = 0;
+        }
+        strm->avail_in = n;
+        strm->next_in = state->in;
+        state->x.pos += n;
+        if (gz_comp(state, Z_NO_FLUSH) == -1)
+            return -1;
+        len -= n;
+    }
+    return 0;
+}
+
+/* Write len bytes from buf to file.  Return the number of bytes written.  If
+   the returned value is less than len, then there was an error. */
+local z_size_t gz_write(state, buf, len)
+    gz_statep state;
+    voidpc buf;
+    z_size_t len;
+{
+    z_size_t put = len;
+
+    /* if len is zero, avoid unnecessary operations */
+    if (len == 0)
+        return 0;
+
+    /* allocate memory if this is the first time through */
+    if (state->size == 0 && gz_init(state) == -1)
+        return 0;
+
+    /* check for seek request */
+    if (state->seek) {
+        state->seek = 0;
+        if (gz_zero(state, state->skip) == -1)
+            return 0;
+    }
+
+    /* for small len, copy to input buffer, otherwise compress directly */
+    if (len < state->size) {
+        /* copy to input buffer, compress when full */
+        do {
+            unsigned have, copy;
+
+            if (state->strm.avail_in == 0)
+                state->strm.next_in = state->in;
+            have = (unsigned)((state->strm.next_in + state->strm.avail_in) -
+                              state->in);
+            copy = state->size - have;
+            if (copy > len)
+                copy = len;
+            memcpy(state->in + have, buf, copy);
+            state->strm.avail_in += copy;
+            state->x.pos += copy;
+            buf = (const char *)buf + copy;
+            len -= copy;
+            if (len && gz_comp(state, Z_NO_FLUSH) == -1)
+                return 0;
+        } while (len);
+    }
+    else {
+        /* consume whatever's left in the input buffer */
+        if (state->strm.avail_in && gz_comp(state, Z_NO_FLUSH) == -1)
+            return 0;
+
+        /* directly compress user buffer to file */
+        state->strm.next_in = (z_const Bytef *)buf;
+        do {
+            unsigned n = (unsigned)-1;
+            if (n > len)
+                n = len;
+            state->strm.avail_in = n;
+            state->x.pos += n;
+            if (gz_comp(state, Z_NO_FLUSH) == -1)
+                return 0;
+            len -= n;
+        } while (len);
+    }
+
+    /* input was all buffered or compressed */
+    return put;
+}
+
+/* -- see zlib.h -- */
+int ZEXPORT gzwrite(file, buf, len)
+    gzFile file;
+    voidpc buf;
+    unsigned len;
+{
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return 0;
+    state = (gz_statep)file;
+
+    /* check that we're writing and that there's no error */
+    if (state->mode != GZ_WRITE || state->err != Z_OK)
+        return 0;
+
+    /* since an int is returned, make sure len fits in one, otherwise return
+       with an error (this avoids a flaw in the interface) */
+    if ((int)len < 0) {
+        gz_error(state, Z_DATA_ERROR, "requested length does not fit in int");
+        return 0;
+    }
+
+    /* write len bytes from buf (the return value will fit in an int) */
+    return (int)gz_write(state, buf, len);
+}
+
+/* -- see zlib.h -- */
+z_size_t ZEXPORT gzfwrite(buf, size, nitems, file)
+    voidpc buf;
+    z_size_t size;
+    z_size_t nitems;
+    gzFile file;
+{
+    z_size_t len;
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return 0;
+    state = (gz_statep)file;
+
+    /* check that we're writing and that there's no error */
+    if (state->mode != GZ_WRITE || state->err != Z_OK)
+        return 0;
+
+    /* compute bytes to read -- error on overflow */
+    len = nitems * size;
+    if (size && len / size != nitems) {
+        gz_error(state, Z_STREAM_ERROR, "request does not fit in a size_t");
+        return 0;
+    }
+
+    /* write len bytes to buf, return the number of full items written */
+    return len ? gz_write(state, buf, len) / size : 0;
+}
+
+/* -- see zlib.h -- */
+int ZEXPORT gzputc(file, c)
+    gzFile file;
+    int c;
+{
+    unsigned have;
+    unsigned char buf[1];
+    gz_statep state;
+    z_streamp strm;
+
+    /* get internal structure */
+    if (file == NULL)
+        return -1;
+    state = (gz_statep)file;
+    strm = &(state->strm);
+
+    /* check that we're writing and that there's no error */
+    if (state->mode != GZ_WRITE || state->err != Z_OK)
+        return -1;
+
+    /* check for seek request */
+    if (state->seek) {
+        state->seek = 0;
+        if (gz_zero(state, state->skip) == -1)
+            return -1;
+    }
+
+    /* try writing to input buffer for speed (state->size == 0 if buffer not
+       initialized) */
+    if (state->size) {
+        if (strm->avail_in == 0)
+            strm->next_in = state->in;
+        have = (unsigned)((strm->next_in + strm->avail_in) - state->in);
+        if (have < state->size) {
+            state->in[have] = (unsigned char)c;
+            strm->avail_in++;
+            state->x.pos++;
+            return c & 0xff;
+        }
+    }
+
+    /* no room in buffer or not initialized, use gz_write() */
+    buf[0] = (unsigned char)c;
+    if (gz_write(state, buf, 1) != 1)
+        return -1;
+    return c & 0xff;
+}
+
+/* -- see zlib.h -- */
+int ZEXPORT gzputs(file, str)
+    gzFile file;
+    const char *str;
+{
+    int ret;
+    z_size_t len;
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return -1;
+    state = (gz_statep)file;
+
+    /* check that we're writing and that there's no error */
+    if (state->mode != GZ_WRITE || state->err != Z_OK)
+        return -1;
+
+    /* write string */
+    len = strlen(str);
+    ret = gz_write(state, str, len);
+    return ret == 0 && len != 0 ? -1 : ret;
+}
+
+#if defined(STDC) || defined(Z_HAVE_STDARG_H)
+#include <stdarg.h>
+
+/* -- see zlib.h -- */
+int ZEXPORTVA gzvprintf(gzFile file, const char *format, va_list va)
+{
+    int len;
+    unsigned left;
+    char *next;
+    gz_statep state;
+    z_streamp strm;
+
+    /* get internal structure */
+    if (file == NULL)
+        return Z_STREAM_ERROR;
+    state = (gz_statep)file;
+    strm = &(state->strm);
+
+    /* check that we're writing and that there's no error */
+    if (state->mode != GZ_WRITE || state->err != Z_OK)
+        return Z_STREAM_ERROR;
+
+    /* make sure we have some buffer space */
+    if (state->size == 0 && gz_init(state) == -1)
+        return state->err;
+
+    /* check for seek request */
+    if (state->seek) {
+        state->seek = 0;
+        if (gz_zero(state, state->skip) == -1)
+            return state->err;
+    }
+
+    /* do the printf() into the input buffer, put length in len -- the input
+       buffer is double-sized just for this function, so there is guaranteed to
+       be state->size bytes available after the current contents */
+    if (strm->avail_in == 0)
+        strm->next_in = state->in;
+    next = (char *)(state->in + (strm->next_in - state->in) + strm->avail_in);
+    next[state->size - 1] = 0;
+#ifdef NO_vsnprintf
+#  ifdef HAS_vsprintf_void
+    (void)vsprintf(next, format, va);
+    for (len = 0; len < state->size; len++)
+        if (next[len] == 0) break;
+#  else
+    len = vsprintf(next, format, va);
+#  endif
+#else
+#  ifdef HAS_vsnprintf_void
+    (void)vsnprintf(next, state->size, format, va);
+    len = strlen(next);
+#  else
+    len = vsnprintf(next, state->size, format, va);
+#  endif
+#endif
+
+    /* check that printf() results fit in buffer */
+    if (len == 0 || (unsigned)len >= state->size || next[state->size - 1] != 0)
+        return 0;
+
+    /* update buffer and position, compress first half if past that */
+    strm->avail_in += (unsigned)len;
+    state->x.pos += len;
+    if (strm->avail_in >= state->size) {
+        left = strm->avail_in - state->size;
+        strm->avail_in = state->size;
+        if (gz_comp(state, Z_NO_FLUSH) == -1)
+            return state->err;
+        memcpy(state->in, state->in + state->size, left);
+        strm->next_in = state->in;
+        strm->avail_in = left;
+    }
+    return len;
+}
+
+int ZEXPORTVA gzprintf(gzFile file, const char *format, ...)
+{
+    va_list va;
+    int ret;
+
+    va_start(va, format);
+    ret = gzvprintf(file, format, va);
+    va_end(va);
+    return ret;
+}
+
+#else /* !STDC && !Z_HAVE_STDARG_H */
+
+/* -- see zlib.h -- */
+int ZEXPORTVA gzprintf (file, format, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10,
+                       a11, a12, a13, a14, a15, a16, a17, a18, a19, a20)
+    gzFile file;
+    const char *format;
+    int a1, a2, a3, a4, a5, a6, a7, a8, a9, a10,
+        a11, a12, a13, a14, a15, a16, a17, a18, a19, a20;
+{
+    unsigned len, left;
+    char *next;
+    gz_statep state;
+    z_streamp strm;
+
+    /* get internal structure */
+    if (file == NULL)
+        return Z_STREAM_ERROR;
+    state = (gz_statep)file;
+    strm = &(state->strm);
+
+    /* check that can really pass pointer in ints */
+    if (sizeof(int) != sizeof(void *))
+        return Z_STREAM_ERROR;
+
+    /* check that we're writing and that there's no error */
+    if (state->mode != GZ_WRITE || state->err != Z_OK)
+        return Z_STREAM_ERROR;
+
+    /* make sure we have some buffer space */
+    if (state->size == 0 && gz_init(state) == -1)
+        return state->error;
+
+    /* check for seek request */
+    if (state->seek) {
+        state->seek = 0;
+        if (gz_zero(state, state->skip) == -1)
+            return state->error;
+    }
+
+    /* do the printf() into the input buffer, put length in len -- the input
+       buffer is double-sized just for this function, so there is guaranteed to
+       be state->size bytes available after the current contents */
+    if (strm->avail_in == 0)
+        strm->next_in = state->in;
+    next = (char *)(strm->next_in + strm->avail_in);
+    next[state->size - 1] = 0;
+#ifdef NO_snprintf
+#  ifdef HAS_sprintf_void
+    sprintf(next, format, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12,
+            a13, a14, a15, a16, a17, a18, a19, a20);
+    for (len = 0; len < size; len++)
+        if (next[len] == 0)
+            break;
+#  else
+    len = sprintf(next, format, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11,
+                  a12, a13, a14, a15, a16, a17, a18, a19, a20);
+#  endif
+#else
+#  ifdef HAS_snprintf_void
+    snprintf(next, state->size, format, a1, a2, a3, a4, a5, a6, a7, a8, a9,
+             a10, a11, a12, a13, a14, a15, a16, a17, a18, a19, a20);
+    len = strlen(next);
+#  else
+    len = snprintf(next, state->size, format, a1, a2, a3, a4, a5, a6, a7, a8,
+                   a9, a10, a11, a12, a13, a14, a15, a16, a17, a18, a19, a20);
+#  endif
+#endif
+
+    /* check that printf() results fit in buffer */
+    if (len == 0 || len >= state->size || next[state->size - 1] != 0)
+        return 0;
+
+    /* update buffer and position, compress first half if past that */
+    strm->avail_in += len;
+    state->x.pos += len;
+    if (strm->avail_in >= state->size) {
+        left = strm->avail_in - state->size;
+        strm->avail_in = state->size;
+        if (gz_comp(state, Z_NO_FLUSH) == -1)
+            return state->err;
+        memcpy(state->in, state->in + state->size, left);
+        strm->next_in = state->in;
+        strm->avail_in = left;
+    }
+    return (int)len;
+}
+
+#endif
+
+/* -- see zlib.h -- */
+int ZEXPORT gzflush(file, flush)
+    gzFile file;
+    int flush;
+{
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return Z_STREAM_ERROR;
+    state = (gz_statep)file;
+
+    /* check that we're writing and that there's no error */
+    if (state->mode != GZ_WRITE || state->err != Z_OK)
+        return Z_STREAM_ERROR;
+
+    /* check flush parameter */
+    if (flush < 0 || flush > Z_FINISH)
+        return Z_STREAM_ERROR;
+
+    /* check for seek request */
+    if (state->seek) {
+        state->seek = 0;
+        if (gz_zero(state, state->skip) == -1)
+            return state->err;
+    }
+
+    /* compress remaining data with requested flush */
+    (void)gz_comp(state, flush);
+    return state->err;
+}
+
+/* -- see zlib.h -- */
+int ZEXPORT gzsetparams(file, level, strategy)
+    gzFile file;
+    int level;
+    int strategy;
+{
+    gz_statep state;
+    z_streamp strm;
+
+    /* get internal structure */
+    if (file == NULL)
+        return Z_STREAM_ERROR;
+    state = (gz_statep)file;
+    strm = &(state->strm);
+
+    /* check that we're writing and that there's no error */
+    if (state->mode != GZ_WRITE || state->err != Z_OK)
+        return Z_STREAM_ERROR;
+
+    /* if no change is requested, then do nothing */
+    if (level == state->level && strategy == state->strategy)
+        return Z_OK;
+
+    /* check for seek request */
+    if (state->seek) {
+        state->seek = 0;
+        if (gz_zero(state, state->skip) == -1)
+            return state->err;
+    }
+
+    /* change compression parameters for subsequent input */
+    if (state->size) {
+        /* flush previous input with previous parameters before changing */
+        if (strm->avail_in && gz_comp(state, Z_BLOCK) == -1)
+            return state->err;
+        deflateParams(strm, level, strategy);
+    }
+    state->level = level;
+    state->strategy = strategy;
+    return Z_OK;
+}
+
+/* -- see zlib.h -- */
+int ZEXPORT gzclose_w(file)
+    gzFile file;
+{
+    int ret = Z_OK;
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return Z_STREAM_ERROR;
+    state = (gz_statep)file;
+
+    /* check that we're writing */
+    if (state->mode != GZ_WRITE)
+        return Z_STREAM_ERROR;
+
+    /* check for seek request */
+    if (state->seek) {
+        state->seek = 0;
+        if (gz_zero(state, state->skip) == -1)
+            ret = state->err;
+    }
+
+    /* flush, free memory, and close file */
+    if (gz_comp(state, Z_FINISH) == -1)
+        ret = state->err;
+    if (state->size) {
+        if (!state->direct) {
+            (void)deflateEnd(&(state->strm));
+            free(state->out);
+        }
+        free(state->in);
+    }
+    gz_error(state, Z_OK, NULL);
+    free(state->path);
+    if (close(state->fd) == -1)
+        ret = Z_ERRNO;
+    free(state);
+    return ret;
+}
diff --git a/deps/v8/third_party/zlib/infback.c b/deps/v8/third_party/zlib/infback.c
new file mode 100644
index 00000000000000..aab14b4848effa
--- /dev/null
+++ b/deps/v8/third_party/zlib/infback.c
@@ -0,0 +1,641 @@
+/* infback.c -- inflate using a call-back interface
+ * Copyright (C) 1995-2016 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/*
+   This code is largely copied from inflate.c.  Normally either infback.o or
+   inflate.o would be linked into an application--not both.  The interface
+   with inffast.c is retained so that optimized assembler-coded versions of
+   inflate_fast() can be used with either inflate.c or infback.c.
+ */
+
+#include "zutil.h"
+#include "inftrees.h"
+#include "inflate.h"
+#include "inffast.h"
+
+/* function prototypes */
+local void fixedtables OF((struct inflate_state FAR *state));
+
+/*
+   strm provides memory allocation functions in zalloc and zfree, or
+   Z_NULL to use the library memory allocation functions.
+
+   windowBits is in the range 8..15, and window is a user-supplied
+   window and output buffer that is 2**windowBits bytes.
+ */
+int ZEXPORT inflateBackInit_(strm, windowBits, window, version, stream_size)
+z_streamp strm;
+int windowBits;
+unsigned char FAR *window;
+const char *version;
+int stream_size;
+{
+    struct inflate_state FAR *state;
+
+    if (version == Z_NULL || version[0] != ZLIB_VERSION[0] ||
+        stream_size != (int)(sizeof(z_stream)))
+        return Z_VERSION_ERROR;
+    if (strm == Z_NULL || window == Z_NULL ||
+        windowBits < 8 || windowBits > 15)
+        return Z_STREAM_ERROR;
+    strm->msg = Z_NULL;                 /* in case we return an error */
+    if (strm->zalloc == (alloc_func)0) {
+#ifdef Z_SOLO
+        return Z_STREAM_ERROR;
+#else
+        strm->zalloc = zcalloc;
+        strm->opaque = (voidpf)0;
+#endif
+    }
+    if (strm->zfree == (free_func)0)
+#ifdef Z_SOLO
+        return Z_STREAM_ERROR;
+#else
+    strm->zfree = zcfree;
+#endif
+    state = (struct inflate_state FAR *)ZALLOC(strm, 1,
+                                               sizeof(struct inflate_state));
+    if (state == Z_NULL) return Z_MEM_ERROR;
+    Tracev((stderr, "inflate: allocated\n"));
+    strm->state = (struct internal_state FAR *)state;
+    state->dmax = 32768U;
+    state->wbits = (uInt)windowBits;
+    state->wsize = 1U << windowBits;
+    state->window = window;
+    state->wnext = 0;
+    state->whave = 0;
+    return Z_OK;
+}
+
+/*
+   Return state with length and distance decoding tables and index sizes set to
+   fixed code decoding.  Normally this returns fixed tables from inffixed.h.
+   If BUILDFIXED is defined, then instead this routine builds the tables the
+   first time it's called, and returns those tables the first time and
+   thereafter.  This reduces the size of the code by about 2K bytes, in
+   exchange for a little execution time.  However, BUILDFIXED should not be
+   used for threaded applications, since the rewriting of the tables and virgin
+   may not be thread-safe.
+ */
+local void fixedtables(state)
+struct inflate_state FAR *state;
+{
+#ifdef BUILDFIXED
+    static int virgin = 1;
+    static code *lenfix, *distfix;
+    static code fixed[544];
+
+    /* build fixed huffman tables if first call (may not be thread safe) */
+    if (virgin) {
+        unsigned sym, bits;
+        static code *next;
+
+        /* literal/length table */
+        sym = 0;
+        while (sym < 144) state->lens[sym++] = 8;
+        while (sym < 256) state->lens[sym++] = 9;
+        while (sym < 280) state->lens[sym++] = 7;
+        while (sym < 288) state->lens[sym++] = 8;
+        next = fixed;
+        lenfix = next;
+        bits = 9;
+        inflate_table(LENS, state->lens, 288, &(next), &(bits), state->work);
+
+        /* distance table */
+        sym = 0;
+        while (sym < 32) state->lens[sym++] = 5;
+        distfix = next;
+        bits = 5;
+        inflate_table(DISTS, state->lens, 32, &(next), &(bits), state->work);
+
+        /* do this just once */
+        virgin = 0;
+    }
+#else /* !BUILDFIXED */
+#   include "inffixed.h"
+#endif /* BUILDFIXED */
+    state->lencode = lenfix;
+    state->lenbits = 9;
+    state->distcode = distfix;
+    state->distbits = 5;
+}
+
+/* Macros for inflateBack(): */
+
+/* Load returned state from inflate_fast() */
+#define LOAD() \
+    do { \
+        put = strm->next_out; \
+        left = strm->avail_out; \
+        next = strm->next_in; \
+        have = strm->avail_in; \
+        hold = state->hold; \
+        bits = state->bits; \
+    } while (0)
+
+/* Set state from registers for inflate_fast() */
+#define RESTORE() \
+    do { \
+        strm->next_out = put; \
+        strm->avail_out = left; \
+        strm->next_in = next; \
+        strm->avail_in = have; \
+        state->hold = hold; \
+        state->bits = bits; \
+    } while (0)
+
+/* Clear the input bit accumulator */
+#define INITBITS() \
+    do { \
+        hold = 0; \
+        bits = 0; \
+    } while (0)
+
+/* Assure that some input is available.  If input is requested, but denied,
+   then return a Z_BUF_ERROR from inflateBack(). */
+#define PULL() \
+    do { \
+        if (have == 0) { \
+            have = in(in_desc, &next); \
+            if (have == 0) { \
+                next = Z_NULL; \
+                ret = Z_BUF_ERROR; \
+                goto inf_leave; \
+            } \
+        } \
+    } while (0)
+
+/* Get a byte of input into the bit accumulator, or return from inflateBack()
+   with an error if there is no input available. */
+#define PULLBYTE() \
+    do { \
+        PULL(); \
+        have--; \
+        hold += (unsigned long)(*next++) << bits; \
+        bits += 8; \
+    } while (0)
+
+/* Assure that there are at least n bits in the bit accumulator.  If there is
+   not enough available input to do that, then return from inflateBack() with
+   an error. */
+#define NEEDBITS(n) \
+    do { \
+        while (bits < (unsigned)(n)) \
+            PULLBYTE(); \
+    } while (0)
+
+/* Return the low n bits of the bit accumulator (n < 16) */
+#define BITS(n) \
+    ((unsigned)hold & ((1U << (n)) - 1))
+
+/* Remove n bits from the bit accumulator */
+#define DROPBITS(n) \
+    do { \
+        hold >>= (n); \
+        bits -= (unsigned)(n); \
+    } while (0)
+
+/* Remove zero to seven bits as needed to go to a byte boundary */
+#define BYTEBITS() \
+    do { \
+        hold >>= bits & 7; \
+        bits -= bits & 7; \
+    } while (0)
+
+/* Assure that some output space is available, by writing out the window
+   if it's full.  If the write fails, return from inflateBack() with a
+   Z_BUF_ERROR. */
+#define ROOM() \
+    do { \
+        if (left == 0) { \
+            put = state->window; \
+            left = state->wsize; \
+            state->whave = left; \
+            if (out(out_desc, put, left)) { \
+                ret = Z_BUF_ERROR; \
+                goto inf_leave; \
+            } \
+        } \
+    } while (0)
+
+/*
+   strm provides the memory allocation functions and window buffer on input,
+   and provides information on the unused input on return.  For Z_DATA_ERROR
+   returns, strm will also provide an error message.
+
+   in() and out() are the call-back input and output functions.  When
+   inflateBack() needs more input, it calls in().  When inflateBack() has
+   filled the window with output, or when it completes with data in the
+   window, it calls out() to write out the data.  The application must not
+   change the provided input until in() is called again or inflateBack()
+   returns.  The application must not change the window/output buffer until
+   inflateBack() returns.
+
+   in() and out() are called with a descriptor parameter provided in the
+   inflateBack() call.  This parameter can be a structure that provides the
+   information required to do the read or write, as well as accumulated
+   information on the input and output such as totals and check values.
+
+   in() should return zero on failure.  out() should return non-zero on
+   failure.  If either in() or out() fails, than inflateBack() returns a
+   Z_BUF_ERROR.  strm->next_in can be checked for Z_NULL to see whether it
+   was in() or out() that caused in the error.  Otherwise,  inflateBack()
+   returns Z_STREAM_END on success, Z_DATA_ERROR for an deflate format
+   error, or Z_MEM_ERROR if it could not allocate memory for the state.
+   inflateBack() can also return Z_STREAM_ERROR if the input parameters
+   are not correct, i.e. strm is Z_NULL or the state was not initialized.
+ */
+int ZEXPORT inflateBack(strm, in, in_desc, out, out_desc)
+z_streamp strm;
+in_func in;
+void FAR *in_desc;
+out_func out;
+void FAR *out_desc;
+{
+    struct inflate_state FAR *state;
+    z_const unsigned char FAR *next;    /* next input */
+    unsigned char FAR *put;     /* next output */
+    unsigned have, left;        /* available input and output */
+    unsigned long hold;         /* bit buffer */
+    unsigned bits;              /* bits in bit buffer */
+    unsigned copy;              /* number of stored or match bytes to copy */
+    unsigned char FAR *from;    /* where to copy match bytes from */
+    code here;                  /* current decoding table entry */
+    code last;                  /* parent table entry */
+    unsigned len;               /* length to copy for repeats, bits to drop */
+    int ret;                    /* return code */
+    static const unsigned short order[19] = /* permutation of code lengths */
+        {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
+
+    /* Check that the strm exists and that the state was initialized */
+    if (strm == Z_NULL || strm->state == Z_NULL)
+        return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+
+    /* Reset the state */
+    strm->msg = Z_NULL;
+    state->mode = TYPE;
+    state->last = 0;
+    state->whave = 0;
+    next = strm->next_in;
+    have = next != Z_NULL ? strm->avail_in : 0;
+    hold = 0;
+    bits = 0;
+    put = state->window;
+    left = state->wsize;
+
+    /* Inflate until end of block marked as last */
+    for (;;)
+        switch (state->mode) {
+        case TYPE:
+            /* determine and dispatch block type */
+            if (state->last) {
+                BYTEBITS();
+                state->mode = DONE;
+                break;
+            }
+            NEEDBITS(3);
+            state->last = BITS(1);
+            DROPBITS(1);
+            switch (BITS(2)) {
+            case 0:                             /* stored block */
+                Tracev((stderr, "inflate:     stored block%s\n",
+                        state->last ? " (last)" : ""));
+                state->mode = STORED;
+                break;
+            case 1:                             /* fixed block */
+                fixedtables(state);
+                Tracev((stderr, "inflate:     fixed codes block%s\n",
+                        state->last ? " (last)" : ""));
+                state->mode = LEN;              /* decode codes */
+                break;
+            case 2:                             /* dynamic block */
+                Tracev((stderr, "inflate:     dynamic codes block%s\n",
+                        state->last ? " (last)" : ""));
+                state->mode = TABLE;
+                break;
+            case 3:
+                strm->msg = (char *)"invalid block type";
+                state->mode = BAD;
+            }
+            DROPBITS(2);
+            break;
+
+        case STORED:
+            /* get and verify stored block length */
+            BYTEBITS();                         /* go to byte boundary */
+            NEEDBITS(32);
+            if ((hold & 0xffff) != ((hold >> 16) ^ 0xffff)) {
+                strm->msg = (char *)"invalid stored block lengths";
+                state->mode = BAD;
+                break;
+            }
+            state->length = (unsigned)hold & 0xffff;
+            Tracev((stderr, "inflate:       stored length %u\n",
+                    state->length));
+            INITBITS();
+
+            /* copy stored block from input to output */
+            while (state->length != 0) {
+                copy = state->length;
+                PULL();
+                ROOM();
+                if (copy > have) copy = have;
+                if (copy > left) copy = left;
+                zmemcpy(put, next, copy);
+                have -= copy;
+                next += copy;
+                left -= copy;
+                put += copy;
+                state->length -= copy;
+            }
+            Tracev((stderr, "inflate:       stored end\n"));
+            state->mode = TYPE;
+            break;
+
+        case TABLE:
+            /* get dynamic table entries descriptor */
+            NEEDBITS(14);
+            state->nlen = BITS(5) + 257;
+            DROPBITS(5);
+            state->ndist = BITS(5) + 1;
+            DROPBITS(5);
+            state->ncode = BITS(4) + 4;
+            DROPBITS(4);
+#ifndef PKZIP_BUG_WORKAROUND
+            if (state->nlen > 286 || state->ndist > 30) {
+                strm->msg = (char *)"too many length or distance symbols";
+                state->mode = BAD;
+                break;
+            }
+#endif
+            Tracev((stderr, "inflate:       table sizes ok\n"));
+
+            /* get code length code lengths (not a typo) */
+            state->have = 0;
+            while (state->have < state->ncode) {
+                NEEDBITS(3);
+                state->lens[order[state->have++]] = (unsigned short)BITS(3);
+                DROPBITS(3);
+            }
+            while (state->have < 19)
+                state->lens[order[state->have++]] = 0;
+            state->next = state->codes;
+            state->lencode = (code const FAR *)(state->next);
+            state->lenbits = 7;
+            ret = inflate_table(CODES, state->lens, 19, &(state->next),
+                                &(state->lenbits), state->work);
+            if (ret) {
+                strm->msg = (char *)"invalid code lengths set";
+                state->mode = BAD;
+                break;
+            }
+            Tracev((stderr, "inflate:       code lengths ok\n"));
+
+            /* get length and distance code code lengths */
+            state->have = 0;
+            while (state->have < state->nlen + state->ndist) {
+                for (;;) {
+                    here = state->lencode[BITS(state->lenbits)];
+                    if ((unsigned)(here.bits) <= bits) break;
+                    PULLBYTE();
+                }
+                if (here.val < 16) {
+                    DROPBITS(here.bits);
+                    state->lens[state->have++] = here.val;
+                }
+                else {
+                    if (here.val == 16) {
+                        NEEDBITS(here.bits + 2);
+                        DROPBITS(here.bits);
+                        if (state->have == 0) {
+                            strm->msg = (char *)"invalid bit length repeat";
+                            state->mode = BAD;
+                            break;
+                        }
+                        len = (unsigned)(state->lens[state->have - 1]);
+                        copy = 3 + BITS(2);
+                        DROPBITS(2);
+                    }
+                    else if (here.val == 17) {
+                        NEEDBITS(here.bits + 3);
+                        DROPBITS(here.bits);
+                        len = 0;
+                        copy = 3 + BITS(3);
+                        DROPBITS(3);
+                    }
+                    else {
+                        NEEDBITS(here.bits + 7);
+                        DROPBITS(here.bits);
+                        len = 0;
+                        copy = 11 + BITS(7);
+                        DROPBITS(7);
+                    }
+                    if (state->have + copy > state->nlen + state->ndist) {
+                        strm->msg = (char *)"invalid bit length repeat";
+                        state->mode = BAD;
+                        break;
+                    }
+                    while (copy--)
+                        state->lens[state->have++] = (unsigned short)len;
+                }
+            }
+
+            /* handle error breaks in while */
+            if (state->mode == BAD) break;
+
+            /* check for end-of-block code (better have one) */
+            if (state->lens[256] == 0) {
+                strm->msg = (char *)"invalid code -- missing end-of-block";
+                state->mode = BAD;
+                break;
+            }
+
+            /* build code tables -- note: do not change the lenbits or distbits
+               values here (9 and 6) without reading the comments in inftrees.h
+               concerning the ENOUGH constants, which depend on those values */
+            state->next = state->codes;
+            state->lencode = (code const FAR *)(state->next);
+            state->lenbits = 9;
+            ret = inflate_table(LENS, state->lens, state->nlen, &(state->next),
+                                &(state->lenbits), state->work);
+            if (ret) {
+                strm->msg = (char *)"invalid literal/lengths set";
+                state->mode = BAD;
+                break;
+            }
+            state->distcode = (code const FAR *)(state->next);
+            state->distbits = 6;
+            ret = inflate_table(DISTS, state->lens + state->nlen, state->ndist,
+                            &(state->next), &(state->distbits), state->work);
+            if (ret) {
+                strm->msg = (char *)"invalid distances set";
+                state->mode = BAD;
+                break;
+            }
+            Tracev((stderr, "inflate:       codes ok\n"));
+            state->mode = LEN;
+
+        case LEN:
+            /* use inflate_fast() if we have enough input and output */
+            if (have >= INFLATE_FAST_MIN_INPUT &&
+                left >= INFLATE_FAST_MIN_OUTPUT) {
+                RESTORE();
+                if (state->whave < state->wsize)
+                    state->whave = state->wsize - left;
+                inflate_fast(strm, state->wsize);
+                LOAD();
+                break;
+            }
+
+            /* get a literal, length, or end-of-block code */
+            for (;;) {
+                here = state->lencode[BITS(state->lenbits)];
+                if ((unsigned)(here.bits) <= bits) break;
+                PULLBYTE();
+            }
+            if (here.op && (here.op & 0xf0) == 0) {
+                last = here;
+                for (;;) {
+                    here = state->lencode[last.val +
+                            (BITS(last.bits + last.op) >> last.bits)];
+                    if ((unsigned)(last.bits + here.bits) <= bits) break;
+                    PULLBYTE();
+                }
+                DROPBITS(last.bits);
+            }
+            DROPBITS(here.bits);
+            state->length = (unsigned)here.val;
+
+            /* process literal */
+            if (here.op == 0) {
+                Tracevv((stderr, here.val >= 0x20 && here.val < 0x7f ?
+                        "inflate:         literal '%c'\n" :
+                        "inflate:         literal 0x%02x\n", here.val));
+                ROOM();
+                *put++ = (unsigned char)(state->length);
+                left--;
+                state->mode = LEN;
+                break;
+            }
+
+            /* process end of block */
+            if (here.op & 32) {
+                Tracevv((stderr, "inflate:         end of block\n"));
+                state->mode = TYPE;
+                break;
+            }
+
+            /* invalid code */
+            if (here.op & 64) {
+                strm->msg = (char *)"invalid literal/length code";
+                state->mode = BAD;
+                break;
+            }
+
+            /* length code -- get extra bits, if any */
+            state->extra = (unsigned)(here.op) & 15;
+            if (state->extra != 0) {
+                NEEDBITS(state->extra);
+                state->length += BITS(state->extra);
+                DROPBITS(state->extra);
+            }
+            Tracevv((stderr, "inflate:         length %u\n", state->length));
+
+            /* get distance code */
+            for (;;) {
+                here = state->distcode[BITS(state->distbits)];
+                if ((unsigned)(here.bits) <= bits) break;
+                PULLBYTE();
+            }
+            if ((here.op & 0xf0) == 0) {
+                last = here;
+                for (;;) {
+                    here = state->distcode[last.val +
+                            (BITS(last.bits + last.op) >> last.bits)];
+                    if ((unsigned)(last.bits + here.bits) <= bits) break;
+                    PULLBYTE();
+                }
+                DROPBITS(last.bits);
+            }
+            DROPBITS(here.bits);
+            if (here.op & 64) {
+                strm->msg = (char *)"invalid distance code";
+                state->mode = BAD;
+                break;
+            }
+            state->offset = (unsigned)here.val;
+
+            /* get distance extra bits, if any */
+            state->extra = (unsigned)(here.op) & 15;
+            if (state->extra != 0) {
+                NEEDBITS(state->extra);
+                state->offset += BITS(state->extra);
+                DROPBITS(state->extra);
+            }
+            if (state->offset > state->wsize - (state->whave < state->wsize ?
+                                                left : 0)) {
+                strm->msg = (char *)"invalid distance too far back";
+                state->mode = BAD;
+                break;
+            }
+            Tracevv((stderr, "inflate:         distance %u\n", state->offset));
+
+            /* copy match from window to output */
+            do {
+                ROOM();
+                copy = state->wsize - state->offset;
+                if (copy < left) {
+                    from = put + copy;
+                    copy = left - copy;
+                }
+                else {
+                    from = put - state->offset;
+                    copy = left;
+                }
+                if (copy > state->length) copy = state->length;
+                state->length -= copy;
+                left -= copy;
+                do {
+                    *put++ = *from++;
+                } while (--copy);
+            } while (state->length != 0);
+            break;
+
+        case DONE:
+            /* inflate stream terminated properly -- write leftover output */
+            ret = Z_STREAM_END;
+            if (left < state->wsize) {
+                if (out(out_desc, state->window, state->wsize - left))
+                    ret = Z_BUF_ERROR;
+            }
+            goto inf_leave;
+
+        case BAD:
+            ret = Z_DATA_ERROR;
+            goto inf_leave;
+
+        default:                /* can't happen, but makes compilers happy */
+            ret = Z_STREAM_ERROR;
+            goto inf_leave;
+        }
+
+    /* Return unused input */
+  inf_leave:
+    strm->next_in = next;
+    strm->avail_in = have;
+    return ret;
+}
+
+int ZEXPORT inflateBackEnd(strm)
+z_streamp strm;
+{
+    if (strm == Z_NULL || strm->state == Z_NULL || strm->zfree == (free_func)0)
+        return Z_STREAM_ERROR;
+    ZFREE(strm, strm->state);
+    strm->state = Z_NULL;
+    Tracev((stderr, "inflate: end\n"));
+    return Z_OK;
+}
diff --git a/deps/v8/third_party/zlib/inffast.c b/deps/v8/third_party/zlib/inffast.c
new file mode 100644
index 00000000000000..2797e8a03c5151
--- /dev/null
+++ b/deps/v8/third_party/zlib/inffast.c
@@ -0,0 +1,330 @@
+/* inffast.c -- fast decoding
+ * Copyright (C) 1995-2017 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+#include "zutil.h"
+#include "inftrees.h"
+#include "inflate.h"
+#include "inffast.h"
+
+#ifdef ASMINF
+#  pragma message("Assembler code may have bugs -- use at your own risk")
+#else
+
+/*
+   Decode literal, length, and distance codes and write out the resulting
+   literal and match bytes until either not enough input or output is
+   available, an end-of-block is encountered, or a data error is encountered.
+   When large enough input and output buffers are supplied to inflate(), for
+   example, a 16K input buffer and a 64K output buffer, more than 95% of the
+   inflate() execution time is spent in this routine.
+
+   Entry assumptions:
+
+        state->mode == LEN
+        strm->avail_in >= INFLATE_FAST_MIN_INPUT (6 bytes)
+        strm->avail_out >= INFLATE_FAST_MIN_OUTPUT (258 bytes)
+        start >= strm->avail_out
+        state->bits < 8
+
+   On return, state->mode is one of:
+
+        LEN -- ran out of enough output space or enough available input
+        TYPE -- reached end of block code, inflate() to interpret next block
+        BAD -- error in block data
+
+   Notes:
+
+    INFLATE_FAST_MIN_INPUT: 6 bytes
+
+    - The maximum input bits used by a length/distance pair is 15 bits for the
+      length code, 5 bits for the length extra, 15 bits for the distance code,
+      and 13 bits for the distance extra.  This totals 48 bits, or six bytes.
+      Therefore if strm->avail_in >= 6, then there is enough input to avoid
+      checking for available input while decoding.
+
+    INFLATE_FAST_MIN_OUTPUT: 258 bytes
+
+    - The maximum bytes that a single length/distance pair can output is 258
+      bytes, which is the maximum length that can be coded.  inflate_fast()
+      requires strm->avail_out >= 258 for each loop to avoid checking for
+      available output space while decoding.
+ */
+void ZLIB_INTERNAL inflate_fast(strm, start)
+z_streamp strm;
+unsigned start;         /* inflate()'s starting value for strm->avail_out */
+{
+    struct inflate_state FAR *state;
+    z_const unsigned char FAR *in;      /* local strm->next_in */
+    z_const unsigned char FAR *last;    /* have enough input while in < last */
+    unsigned char FAR *out;     /* local strm->next_out */
+    unsigned char FAR *beg;     /* inflate()'s initial strm->next_out */
+    unsigned char FAR *end;     /* while out < end, enough space available */
+#ifdef INFLATE_STRICT
+    unsigned dmax;              /* maximum distance from zlib header */
+#endif
+    unsigned wsize;             /* window size or zero if not using window */
+    unsigned whave;             /* valid bytes in the window */
+    unsigned wnext;             /* window write index */
+    unsigned char FAR *window;  /* allocated sliding window, if wsize != 0 */
+    unsigned long hold;         /* local strm->hold */
+    unsigned bits;              /* local strm->bits */
+    code const FAR *lcode;      /* local strm->lencode */
+    code const FAR *dcode;      /* local strm->distcode */
+    unsigned lmask;             /* mask for first level of length codes */
+    unsigned dmask;             /* mask for first level of distance codes */
+    code here;                  /* retrieved table entry */
+    unsigned op;                /* code bits, operation, extra bits, or */
+                                /*  window position, window bytes to copy */
+    unsigned len;               /* match length, unused bytes */
+    unsigned dist;              /* match distance */
+    unsigned char FAR *from;    /* where to copy match from */
+
+    /* copy state to local variables */
+    state = (struct inflate_state FAR *)strm->state;
+    in = strm->next_in;
+    last = in + (strm->avail_in - (INFLATE_FAST_MIN_INPUT - 1));
+    out = strm->next_out;
+    beg = out - (start - strm->avail_out);
+    end = out + (strm->avail_out - (INFLATE_FAST_MIN_OUTPUT - 1));
+#ifdef INFLATE_STRICT
+    dmax = state->dmax;
+#endif
+    wsize = state->wsize;
+    whave = state->whave;
+    wnext = state->wnext;
+    window = state->window;
+    hold = state->hold;
+    bits = state->bits;
+    lcode = state->lencode;
+    dcode = state->distcode;
+    lmask = (1U << state->lenbits) - 1;
+    dmask = (1U << state->distbits) - 1;
+
+    /* decode literals and length/distances until end-of-block or not enough
+       input data or output space */
+    do {
+        if (bits < 15) {
+            hold += (unsigned long)(*in++) << bits;
+            bits += 8;
+            hold += (unsigned long)(*in++) << bits;
+            bits += 8;
+        }
+        here = lcode[hold & lmask];
+      dolen:
+        op = (unsigned)(here.bits);
+        hold >>= op;
+        bits -= op;
+        op = (unsigned)(here.op);
+        if (op == 0) {                          /* literal */
+            Tracevv((stderr, here.val >= 0x20 && here.val < 0x7f ?
+                    "inflate:         literal '%c'\n" :
+                    "inflate:         literal 0x%02x\n", here.val));
+            *out++ = (unsigned char)(here.val);
+        }
+        else if (op & 16) {                     /* length base */
+            len = (unsigned)(here.val);
+            op &= 15;                           /* number of extra bits */
+            if (op) {
+                if (bits < op) {
+                    hold += (unsigned long)(*in++) << bits;
+                    bits += 8;
+                }
+                len += (unsigned)hold & ((1U << op) - 1);
+                hold >>= op;
+                bits -= op;
+            }
+            Tracevv((stderr, "inflate:         length %u\n", len));
+            if (bits < 15) {
+                hold += (unsigned long)(*in++) << bits;
+                bits += 8;
+                hold += (unsigned long)(*in++) << bits;
+                bits += 8;
+            }
+            here = dcode[hold & dmask];
+          dodist:
+            op = (unsigned)(here.bits);
+            hold >>= op;
+            bits -= op;
+            op = (unsigned)(here.op);
+            if (op & 16) {                      /* distance base */
+                dist = (unsigned)(here.val);
+                op &= 15;                       /* number of extra bits */
+                if (bits < op) {
+                    hold += (unsigned long)(*in++) << bits;
+                    bits += 8;
+                    if (bits < op) {
+                        hold += (unsigned long)(*in++) << bits;
+                        bits += 8;
+                    }
+                }
+                dist += (unsigned)hold & ((1U << op) - 1);
+#ifdef INFLATE_STRICT
+                if (dist > dmax) {
+                    strm->msg = (char *)"invalid distance too far back";
+                    state->mode = BAD;
+                    break;
+                }
+#endif
+                hold >>= op;
+                bits -= op;
+                Tracevv((stderr, "inflate:         distance %u\n", dist));
+                op = (unsigned)(out - beg);     /* max distance in output */
+                if (dist > op) {                /* see if copy from window */
+                    op = dist - op;             /* distance back in window */
+                    if (op > whave) {
+                        if (state->sane) {
+                            strm->msg =
+                                (char *)"invalid distance too far back";
+                            state->mode = BAD;
+                            break;
+                        }
+#ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR
+                        if (len <= op - whave) {
+                            do {
+                                *out++ = 0;
+                            } while (--len);
+                            continue;
+                        }
+                        len -= op - whave;
+                        do {
+                            *out++ = 0;
+                        } while (--op > whave);
+                        if (op == 0) {
+                            from = out - dist;
+                            do {
+                                *out++ = *from++;
+                            } while (--len);
+                            continue;
+                        }
+#endif
+                    }
+                    from = window;
+                    if (wnext == 0) {           /* very common case */
+                        from += wsize - op;
+                        if (op < len) {         /* some from window */
+                            len -= op;
+                            do {
+                                *out++ = *from++;
+                            } while (--op);
+                            from = out - dist;  /* rest from output */
+                        }
+                    }
+                    else if (wnext < op) {      /* wrap around window */
+                        from += wsize + wnext - op;
+                        op -= wnext;
+                        if (op < len) {         /* some from end of window */
+                            len -= op;
+                            do {
+                                *out++ = *from++;
+                            } while (--op);
+                            from = window;
+                            if (wnext < len) {  /* some from start of window */
+                                op = wnext;
+                                len -= op;
+                                do {
+                                    *out++ = *from++;
+                                } while (--op);
+                                from = out - dist;      /* rest from output */
+                            }
+                        }
+                    }
+                    else {                      /* contiguous in window */
+                        from += wnext - op;
+                        if (op < len) {         /* some from window */
+                            len -= op;
+                            do {
+                                *out++ = *from++;
+                            } while (--op);
+                            from = out - dist;  /* rest from output */
+                        }
+                    }
+                    while (len > 2) {
+                        *out++ = *from++;
+                        *out++ = *from++;
+                        *out++ = *from++;
+                        len -= 3;
+                    }
+                    if (len) {
+                        *out++ = *from++;
+                        if (len > 1)
+                            *out++ = *from++;
+                    }
+                }
+                else {
+                    from = out - dist;          /* copy direct from output */
+                    do {                        /* minimum length is three */
+                        *out++ = *from++;
+                        *out++ = *from++;
+                        *out++ = *from++;
+                        len -= 3;
+                    } while (len > 2);
+                    if (len) {
+                        *out++ = *from++;
+                        if (len > 1)
+                            *out++ = *from++;
+                    }
+                }
+            }
+            else if ((op & 64) == 0) {          /* 2nd level distance code */
+                here = dcode[here.val + (hold & ((1U << op) - 1))];
+                goto dodist;
+            }
+            else {
+                strm->msg = (char *)"invalid distance code";
+                state->mode = BAD;
+                break;
+            }
+        }
+        else if ((op & 64) == 0) {              /* 2nd level length code */
+            here = lcode[here.val + (hold & ((1U << op) - 1))];
+            goto dolen;
+        }
+        else if (op & 32) {                     /* end-of-block */
+            Tracevv((stderr, "inflate:         end of block\n"));
+            state->mode = TYPE;
+            break;
+        }
+        else {
+            strm->msg = (char *)"invalid literal/length code";
+            state->mode = BAD;
+            break;
+        }
+    } while (in < last && out < end);
+
+    /* return unused bytes (on entry, bits < 8, so in won't go too far back) */
+    len = bits >> 3;
+    in -= len;
+    bits -= len << 3;
+    hold &= (1U << bits) - 1;
+
+    /* update state and return */
+    strm->next_in = in;
+    strm->next_out = out;
+    strm->avail_in = (unsigned)(in < last ?
+        (INFLATE_FAST_MIN_INPUT - 1) + (last - in) :
+        (INFLATE_FAST_MIN_INPUT - 1) - (in - last));
+    strm->avail_out = (unsigned)(out < end ?
+        (INFLATE_FAST_MIN_OUTPUT - 1) + (end - out) :
+        (INFLATE_FAST_MIN_OUTPUT - 1) - (out - end));
+    state->hold = hold;
+    state->bits = bits;
+    return;
+}
+
+/*
+   inflate_fast() speedups that turned out slower (on a PowerPC G3 750CXe):
+   - Using bit fields for code structure
+   - Different op definition to avoid & for extra bits (do & for table bits)
+   - Three separate decoding do-loops for direct, window, and wnext == 0
+   - Special case for distance > 1 copies to do overlapped load and store copy
+   - Explicit branch predictions (based on measured branch probabilities)
+   - Deferring match copy and interspersed it with decoding subsequent codes
+   - Swapping literal/length else
+   - Swapping window/direct else
+   - Larger unrolled copy loops (three is about right)
+   - Moving len -= 3 statement into middle of loop
+ */
+
+#endif /* !ASMINF */
diff --git a/deps/v8/third_party/zlib/inffast.h b/deps/v8/third_party/zlib/inffast.h
new file mode 100644
index 00000000000000..c7c1c09808e5e9
--- /dev/null
+++ b/deps/v8/third_party/zlib/inffast.h
@@ -0,0 +1,26 @@
+/* inffast.h -- header to use inffast.c
+ * Copyright (C) 1995-2003, 2010 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/* WARNING: this file should *not* be used by applications. It is
+   part of the implementation of the compression library and is
+   subject to change. Applications should only use zlib.h.
+ */
+
+/* INFLATE_FAST_MIN_INPUT: the minimum number of input bytes needed so that
+   we can safely call inflate_fast() with only one up-front bounds check. One
+   length/distance code pair (15 bits for the length code, 5 bits for length
+   extra, 15 bits for the distance code, 13 bits for distance extra) requires
+   reading up to 48 input bits (6 bytes).
+*/
+#define INFLATE_FAST_MIN_INPUT 6
+
+/* INFLATE_FAST_MIN_OUTPUT: the minimum number of output bytes needed so that
+   we can safely call inflate_fast() with only one up-front bounds check. One
+   length/distance code pair can output up to 258 bytes, which is the maximum
+   length that can be coded.
+ */
+#define INFLATE_FAST_MIN_OUTPUT 258
+
+void ZLIB_INTERNAL inflate_fast OF((z_streamp strm, unsigned start));
diff --git a/deps/v8/third_party/zlib/inffixed.h b/deps/v8/third_party/zlib/inffixed.h
new file mode 100644
index 00000000000000..d6283277694802
--- /dev/null
+++ b/deps/v8/third_party/zlib/inffixed.h
@@ -0,0 +1,94 @@
+    /* inffixed.h -- table for decoding fixed codes
+     * Generated automatically by makefixed().
+     */
+
+    /* WARNING: this file should *not* be used by applications.
+       It is part of the implementation of this library and is
+       subject to change. Applications should only use zlib.h.
+     */
+
+    static const code lenfix[512] = {
+        {96,7,0},{0,8,80},{0,8,16},{20,8,115},{18,7,31},{0,8,112},{0,8,48},
+        {0,9,192},{16,7,10},{0,8,96},{0,8,32},{0,9,160},{0,8,0},{0,8,128},
+        {0,8,64},{0,9,224},{16,7,6},{0,8,88},{0,8,24},{0,9,144},{19,7,59},
+        {0,8,120},{0,8,56},{0,9,208},{17,7,17},{0,8,104},{0,8,40},{0,9,176},
+        {0,8,8},{0,8,136},{0,8,72},{0,9,240},{16,7,4},{0,8,84},{0,8,20},
+        {21,8,227},{19,7,43},{0,8,116},{0,8,52},{0,9,200},{17,7,13},{0,8,100},
+        {0,8,36},{0,9,168},{0,8,4},{0,8,132},{0,8,68},{0,9,232},{16,7,8},
+        {0,8,92},{0,8,28},{0,9,152},{20,7,83},{0,8,124},{0,8,60},{0,9,216},
+        {18,7,23},{0,8,108},{0,8,44},{0,9,184},{0,8,12},{0,8,140},{0,8,76},
+        {0,9,248},{16,7,3},{0,8,82},{0,8,18},{21,8,163},{19,7,35},{0,8,114},
+        {0,8,50},{0,9,196},{17,7,11},{0,8,98},{0,8,34},{0,9,164},{0,8,2},
+        {0,8,130},{0,8,66},{0,9,228},{16,7,7},{0,8,90},{0,8,26},{0,9,148},
+        {20,7,67},{0,8,122},{0,8,58},{0,9,212},{18,7,19},{0,8,106},{0,8,42},
+        {0,9,180},{0,8,10},{0,8,138},{0,8,74},{0,9,244},{16,7,5},{0,8,86},
+        {0,8,22},{64,8,0},{19,7,51},{0,8,118},{0,8,54},{0,9,204},{17,7,15},
+        {0,8,102},{0,8,38},{0,9,172},{0,8,6},{0,8,134},{0,8,70},{0,9,236},
+        {16,7,9},{0,8,94},{0,8,30},{0,9,156},{20,7,99},{0,8,126},{0,8,62},
+        {0,9,220},{18,7,27},{0,8,110},{0,8,46},{0,9,188},{0,8,14},{0,8,142},
+        {0,8,78},{0,9,252},{96,7,0},{0,8,81},{0,8,17},{21,8,131},{18,7,31},
+        {0,8,113},{0,8,49},{0,9,194},{16,7,10},{0,8,97},{0,8,33},{0,9,162},
+        {0,8,1},{0,8,129},{0,8,65},{0,9,226},{16,7,6},{0,8,89},{0,8,25},
+        {0,9,146},{19,7,59},{0,8,121},{0,8,57},{0,9,210},{17,7,17},{0,8,105},
+        {0,8,41},{0,9,178},{0,8,9},{0,8,137},{0,8,73},{0,9,242},{16,7,4},
+        {0,8,85},{0,8,21},{16,8,258},{19,7,43},{0,8,117},{0,8,53},{0,9,202},
+        {17,7,13},{0,8,101},{0,8,37},{0,9,170},{0,8,5},{0,8,133},{0,8,69},
+        {0,9,234},{16,7,8},{0,8,93},{0,8,29},{0,9,154},{20,7,83},{0,8,125},
+        {0,8,61},{0,9,218},{18,7,23},{0,8,109},{0,8,45},{0,9,186},{0,8,13},
+        {0,8,141},{0,8,77},{0,9,250},{16,7,3},{0,8,83},{0,8,19},{21,8,195},
+        {19,7,35},{0,8,115},{0,8,51},{0,9,198},{17,7,11},{0,8,99},{0,8,35},
+        {0,9,166},{0,8,3},{0,8,131},{0,8,67},{0,9,230},{16,7,7},{0,8,91},
+        {0,8,27},{0,9,150},{20,7,67},{0,8,123},{0,8,59},{0,9,214},{18,7,19},
+        {0,8,107},{0,8,43},{0,9,182},{0,8,11},{0,8,139},{0,8,75},{0,9,246},
+        {16,7,5},{0,8,87},{0,8,23},{64,8,0},{19,7,51},{0,8,119},{0,8,55},
+        {0,9,206},{17,7,15},{0,8,103},{0,8,39},{0,9,174},{0,8,7},{0,8,135},
+        {0,8,71},{0,9,238},{16,7,9},{0,8,95},{0,8,31},{0,9,158},{20,7,99},
+        {0,8,127},{0,8,63},{0,9,222},{18,7,27},{0,8,111},{0,8,47},{0,9,190},
+        {0,8,15},{0,8,143},{0,8,79},{0,9,254},{96,7,0},{0,8,80},{0,8,16},
+        {20,8,115},{18,7,31},{0,8,112},{0,8,48},{0,9,193},{16,7,10},{0,8,96},
+        {0,8,32},{0,9,161},{0,8,0},{0,8,128},{0,8,64},{0,9,225},{16,7,6},
+        {0,8,88},{0,8,24},{0,9,145},{19,7,59},{0,8,120},{0,8,56},{0,9,209},
+        {17,7,17},{0,8,104},{0,8,40},{0,9,177},{0,8,8},{0,8,136},{0,8,72},
+        {0,9,241},{16,7,4},{0,8,84},{0,8,20},{21,8,227},{19,7,43},{0,8,116},
+        {0,8,52},{0,9,201},{17,7,13},{0,8,100},{0,8,36},{0,9,169},{0,8,4},
+        {0,8,132},{0,8,68},{0,9,233},{16,7,8},{0,8,92},{0,8,28},{0,9,153},
+        {20,7,83},{0,8,124},{0,8,60},{0,9,217},{18,7,23},{0,8,108},{0,8,44},
+        {0,9,185},{0,8,12},{0,8,140},{0,8,76},{0,9,249},{16,7,3},{0,8,82},
+        {0,8,18},{21,8,163},{19,7,35},{0,8,114},{0,8,50},{0,9,197},{17,7,11},
+        {0,8,98},{0,8,34},{0,9,165},{0,8,2},{0,8,130},{0,8,66},{0,9,229},
+        {16,7,7},{0,8,90},{0,8,26},{0,9,149},{20,7,67},{0,8,122},{0,8,58},
+        {0,9,213},{18,7,19},{0,8,106},{0,8,42},{0,9,181},{0,8,10},{0,8,138},
+        {0,8,74},{0,9,245},{16,7,5},{0,8,86},{0,8,22},{64,8,0},{19,7,51},
+        {0,8,118},{0,8,54},{0,9,205},{17,7,15},{0,8,102},{0,8,38},{0,9,173},
+        {0,8,6},{0,8,134},{0,8,70},{0,9,237},{16,7,9},{0,8,94},{0,8,30},
+        {0,9,157},{20,7,99},{0,8,126},{0,8,62},{0,9,221},{18,7,27},{0,8,110},
+        {0,8,46},{0,9,189},{0,8,14},{0,8,142},{0,8,78},{0,9,253},{96,7,0},
+        {0,8,81},{0,8,17},{21,8,131},{18,7,31},{0,8,113},{0,8,49},{0,9,195},
+        {16,7,10},{0,8,97},{0,8,33},{0,9,163},{0,8,1},{0,8,129},{0,8,65},
+        {0,9,227},{16,7,6},{0,8,89},{0,8,25},{0,9,147},{19,7,59},{0,8,121},
+        {0,8,57},{0,9,211},{17,7,17},{0,8,105},{0,8,41},{0,9,179},{0,8,9},
+        {0,8,137},{0,8,73},{0,9,243},{16,7,4},{0,8,85},{0,8,21},{16,8,258},
+        {19,7,43},{0,8,117},{0,8,53},{0,9,203},{17,7,13},{0,8,101},{0,8,37},
+        {0,9,171},{0,8,5},{0,8,133},{0,8,69},{0,9,235},{16,7,8},{0,8,93},
+        {0,8,29},{0,9,155},{20,7,83},{0,8,125},{0,8,61},{0,9,219},{18,7,23},
+        {0,8,109},{0,8,45},{0,9,187},{0,8,13},{0,8,141},{0,8,77},{0,9,251},
+        {16,7,3},{0,8,83},{0,8,19},{21,8,195},{19,7,35},{0,8,115},{0,8,51},
+        {0,9,199},{17,7,11},{0,8,99},{0,8,35},{0,9,167},{0,8,3},{0,8,131},
+        {0,8,67},{0,9,231},{16,7,7},{0,8,91},{0,8,27},{0,9,151},{20,7,67},
+        {0,8,123},{0,8,59},{0,9,215},{18,7,19},{0,8,107},{0,8,43},{0,9,183},
+        {0,8,11},{0,8,139},{0,8,75},{0,9,247},{16,7,5},{0,8,87},{0,8,23},
+        {64,8,0},{19,7,51},{0,8,119},{0,8,55},{0,9,207},{17,7,15},{0,8,103},
+        {0,8,39},{0,9,175},{0,8,7},{0,8,135},{0,8,71},{0,9,239},{16,7,9},
+        {0,8,95},{0,8,31},{0,9,159},{20,7,99},{0,8,127},{0,8,63},{0,9,223},
+        {18,7,27},{0,8,111},{0,8,47},{0,9,191},{0,8,15},{0,8,143},{0,8,79},
+        {0,9,255}
+    };
+
+    static const code distfix[32] = {
+        {16,5,1},{23,5,257},{19,5,17},{27,5,4097},{17,5,5},{25,5,1025},
+        {21,5,65},{29,5,16385},{16,5,3},{24,5,513},{20,5,33},{28,5,8193},
+        {18,5,9},{26,5,2049},{22,5,129},{64,5,0},{16,5,2},{23,5,385},
+        {19,5,25},{27,5,6145},{17,5,7},{25,5,1537},{21,5,97},{29,5,24577},
+        {16,5,4},{24,5,769},{20,5,49},{28,5,12289},{18,5,13},{26,5,3073},
+        {22,5,193},{64,5,0}
+    };
diff --git a/deps/v8/third_party/zlib/inflate.c b/deps/v8/third_party/zlib/inflate.c
new file mode 100644
index 00000000000000..68902e81bd4be9
--- /dev/null
+++ b/deps/v8/third_party/zlib/inflate.c
@@ -0,0 +1,1563 @@
+/* inflate.c -- zlib decompression
+ * Copyright (C) 1995-2016 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/*
+ * Change history:
+ *
+ * 1.2.beta0    24 Nov 2002
+ * - First version -- complete rewrite of inflate to simplify code, avoid
+ *   creation of window when not needed, minimize use of window when it is
+ *   needed, make inffast.c even faster, implement gzip decoding, and to
+ *   improve code readability and style over the previous zlib inflate code
+ *
+ * 1.2.beta1    25 Nov 2002
+ * - Use pointers for available input and output checking in inffast.c
+ * - Remove input and output counters in inffast.c
+ * - Change inffast.c entry and loop from avail_in >= 7 to >= 6
+ * - Remove unnecessary second byte pull from length extra in inffast.c
+ * - Unroll direct copy to three copies per loop in inffast.c
+ *
+ * 1.2.beta2    4 Dec 2002
+ * - Change external routine names to reduce potential conflicts
+ * - Correct filename to inffixed.h for fixed tables in inflate.c
+ * - Make hbuf[] unsigned char to match parameter type in inflate.c
+ * - Change strm->next_out[-state->offset] to *(strm->next_out - state->offset)
+ *   to avoid negation problem on Alphas (64 bit) in inflate.c
+ *
+ * 1.2.beta3    22 Dec 2002
+ * - Add comments on state->bits assertion in inffast.c
+ * - Add comments on op field in inftrees.h
+ * - Fix bug in reuse of allocated window after inflateReset()
+ * - Remove bit fields--back to byte structure for speed
+ * - Remove distance extra == 0 check in inflate_fast()--only helps for lengths
+ * - Change post-increments to pre-increments in inflate_fast(), PPC biased?
+ * - Add compile time option, POSTINC, to use post-increments instead (Intel?)
+ * - Make MATCH copy in inflate() much faster for when inflate_fast() not used
+ * - Use local copies of stream next and avail values, as well as local bit
+ *   buffer and bit count in inflate()--for speed when inflate_fast() not used
+ *
+ * 1.2.beta4    1 Jan 2003
+ * - Split ptr - 257 statements in inflate_table() to avoid compiler warnings
+ * - Move a comment on output buffer sizes from inffast.c to inflate.c
+ * - Add comments in inffast.c to introduce the inflate_fast() routine
+ * - Rearrange window copies in inflate_fast() for speed and simplification
+ * - Unroll last copy for window match in inflate_fast()
+ * - Use local copies of window variables in inflate_fast() for speed
+ * - Pull out common wnext == 0 case for speed in inflate_fast()
+ * - Make op and len in inflate_fast() unsigned for consistency
+ * - Add FAR to lcode and dcode declarations in inflate_fast()
+ * - Simplified bad distance check in inflate_fast()
+ * - Added inflateBackInit(), inflateBack(), and inflateBackEnd() in new
+ *   source file infback.c to provide a call-back interface to inflate for
+ *   programs like gzip and unzip -- uses window as output buffer to avoid
+ *   window copying
+ *
+ * 1.2.beta5    1 Jan 2003
+ * - Improved inflateBack() interface to allow the caller to provide initial
+ *   input in strm.
+ * - Fixed stored blocks bug in inflateBack()
+ *
+ * 1.2.beta6    4 Jan 2003
+ * - Added comments in inffast.c on effectiveness of POSTINC
+ * - Typecasting all around to reduce compiler warnings
+ * - Changed loops from while (1) or do {} while (1) to for (;;), again to
+ *   make compilers happy
+ * - Changed type of window in inflateBackInit() to unsigned char *
+ *
+ * 1.2.beta7    27 Jan 2003
+ * - Changed many types to unsigned or unsigned short to avoid warnings
+ * - Added inflateCopy() function
+ *
+ * 1.2.0        9 Mar 2003
+ * - Changed inflateBack() interface to provide separate opaque descriptors
+ *   for the in() and out() functions
+ * - Changed inflateBack() argument and in_func typedef to swap the length
+ *   and buffer address return values for the input function
+ * - Check next_in and next_out for Z_NULL on entry to inflate()
+ *
+ * The history for versions after 1.2.0 are in ChangeLog in zlib distribution.
+ */
+
+#include "zutil.h"
+#include "inftrees.h"
+#include "inflate.h"
+#include "inffast.h"
+
+#ifdef MAKEFIXED
+#  ifndef BUILDFIXED
+#    define BUILDFIXED
+#  endif
+#endif
+
+/* function prototypes */
+local int inflateStateCheck OF((z_streamp strm));
+local void fixedtables OF((struct inflate_state FAR *state));
+local int updatewindow OF((z_streamp strm, const unsigned char FAR *end,
+                           unsigned copy));
+#ifdef BUILDFIXED
+   void makefixed OF((void));
+#endif
+local unsigned syncsearch OF((unsigned FAR *have, const unsigned char FAR *buf,
+                              unsigned len));
+
+local int inflateStateCheck(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+    if (strm == Z_NULL ||
+        strm->zalloc == (alloc_func)0 || strm->zfree == (free_func)0)
+        return 1;
+    state = (struct inflate_state FAR *)strm->state;
+    if (state == Z_NULL || state->strm != strm ||
+        state->mode < HEAD || state->mode > SYNC)
+        return 1;
+    return 0;
+}
+
+int ZEXPORT inflateResetKeep(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    strm->total_in = strm->total_out = state->total = 0;
+    strm->msg = Z_NULL;
+    if (state->wrap)        /* to support ill-conceived Java test suite */
+        strm->adler = state->wrap & 1;
+    state->mode = HEAD;
+    state->last = 0;
+    state->havedict = 0;
+    state->dmax = 32768U;
+    state->head = Z_NULL;
+    state->hold = 0;
+    state->bits = 0;
+    state->lencode = state->distcode = state->next = state->codes;
+    state->sane = 1;
+    state->back = -1;
+    Tracev((stderr, "inflate: reset\n"));
+    return Z_OK;
+}
+
+int ZEXPORT inflateReset(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    state->wsize = 0;
+    state->whave = 0;
+    state->wnext = 0;
+    return inflateResetKeep(strm);
+}
+
+int ZEXPORT inflateReset2(strm, windowBits)
+z_streamp strm;
+int windowBits;
+{
+    int wrap;
+    struct inflate_state FAR *state;
+
+    /* get the state */
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+
+    /* extract wrap request from windowBits parameter */
+    if (windowBits < 0) {
+        wrap = 0;
+        windowBits = -windowBits;
+    }
+    else {
+        wrap = (windowBits >> 4) + 5;
+#ifdef GUNZIP
+        if (windowBits < 48)
+            windowBits &= 15;
+#endif
+    }
+
+    /* set number of window bits, free window if different */
+    if (windowBits && (windowBits < 8 || windowBits > 15))
+        return Z_STREAM_ERROR;
+    if (state->window != Z_NULL && state->wbits != (unsigned)windowBits) {
+        ZFREE(strm, state->window);
+        state->window = Z_NULL;
+    }
+
+    /* update state and reset the rest of it */
+    state->wrap = wrap;
+    state->wbits = (unsigned)windowBits;
+    return inflateReset(strm);
+}
+
+int ZEXPORT inflateInit2_(strm, windowBits, version, stream_size)
+z_streamp strm;
+int windowBits;
+const char *version;
+int stream_size;
+{
+    int ret;
+    struct inflate_state FAR *state;
+
+    if (version == Z_NULL || version[0] != ZLIB_VERSION[0] ||
+        stream_size != (int)(sizeof(z_stream)))
+        return Z_VERSION_ERROR;
+    if (strm == Z_NULL) return Z_STREAM_ERROR;
+    strm->msg = Z_NULL;                 /* in case we return an error */
+    if (strm->zalloc == (alloc_func)0) {
+#ifdef Z_SOLO
+        return Z_STREAM_ERROR;
+#else
+        strm->zalloc = zcalloc;
+        strm->opaque = (voidpf)0;
+#endif
+    }
+    if (strm->zfree == (free_func)0)
+#ifdef Z_SOLO
+        return Z_STREAM_ERROR;
+#else
+        strm->zfree = zcfree;
+#endif
+    state = (struct inflate_state FAR *)
+            ZALLOC(strm, 1, sizeof(struct inflate_state));
+    if (state == Z_NULL) return Z_MEM_ERROR;
+    Tracev((stderr, "inflate: allocated\n"));
+    strm->state = (struct internal_state FAR *)state;
+    state->strm = strm;
+    state->window = Z_NULL;
+    state->mode = HEAD;     /* to pass state test in inflateReset2() */
+    state->check = 1L;      /* 1L is the result of adler32() zero length data */
+    ret = inflateReset2(strm, windowBits);
+    if (ret != Z_OK) {
+        ZFREE(strm, state);
+        strm->state = Z_NULL;
+    }
+    return ret;
+}
+
+int ZEXPORT inflateInit_(strm, version, stream_size)
+z_streamp strm;
+const char *version;
+int stream_size;
+{
+    return inflateInit2_(strm, DEF_WBITS, version, stream_size);
+}
+
+int ZEXPORT inflatePrime(strm, bits, value)
+z_streamp strm;
+int bits;
+int value;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    if (bits < 0) {
+        state->hold = 0;
+        state->bits = 0;
+        return Z_OK;
+    }
+    if (bits > 16 || state->bits + (uInt)bits > 32) return Z_STREAM_ERROR;
+    value &= (1L << bits) - 1;
+    state->hold += (unsigned)value << state->bits;
+    state->bits += (uInt)bits;
+    return Z_OK;
+}
+
+/*
+   Return state with length and distance decoding tables and index sizes set to
+   fixed code decoding.  Normally this returns fixed tables from inffixed.h.
+   If BUILDFIXED is defined, then instead this routine builds the tables the
+   first time it's called, and returns those tables the first time and
+   thereafter.  This reduces the size of the code by about 2K bytes, in
+   exchange for a little execution time.  However, BUILDFIXED should not be
+   used for threaded applications, since the rewriting of the tables and virgin
+   may not be thread-safe.
+ */
+local void fixedtables(state)
+struct inflate_state FAR *state;
+{
+#ifdef BUILDFIXED
+    static int virgin = 1;
+    static code *lenfix, *distfix;
+    static code fixed[544];
+
+    /* build fixed huffman tables if first call (may not be thread safe) */
+    if (virgin) {
+        unsigned sym, bits;
+        static code *next;
+
+        /* literal/length table */
+        sym = 0;
+        while (sym < 144) state->lens[sym++] = 8;
+        while (sym < 256) state->lens[sym++] = 9;
+        while (sym < 280) state->lens[sym++] = 7;
+        while (sym < 288) state->lens[sym++] = 8;
+        next = fixed;
+        lenfix = next;
+        bits = 9;
+        inflate_table(LENS, state->lens, 288, &(next), &(bits), state->work);
+
+        /* distance table */
+        sym = 0;
+        while (sym < 32) state->lens[sym++] = 5;
+        distfix = next;
+        bits = 5;
+        inflate_table(DISTS, state->lens, 32, &(next), &(bits), state->work);
+
+        /* do this just once */
+        virgin = 0;
+    }
+#else /* !BUILDFIXED */
+#   include "inffixed.h"
+#endif /* BUILDFIXED */
+    state->lencode = lenfix;
+    state->lenbits = 9;
+    state->distcode = distfix;
+    state->distbits = 5;
+}
+
+#ifdef MAKEFIXED
+#include <stdio.h>
+
+/*
+   Write out the inffixed.h that is #include'd above.  Defining MAKEFIXED also
+   defines BUILDFIXED, so the tables are built on the fly.  makefixed() writes
+   those tables to stdout, which would be piped to inffixed.h.  A small program
+   can simply call makefixed to do this:
+
+    void makefixed(void);
+
+    int main(void)
+    {
+        makefixed();
+        return 0;
+    }
+
+   Then that can be linked with zlib built with MAKEFIXED defined and run:
+
+    a.out > inffixed.h
+ */
+void makefixed()
+{
+    unsigned low, size;
+    struct inflate_state state;
+
+    fixedtables(&state);
+    puts("    /* inffixed.h -- table for decoding fixed codes");
+    puts("     * Generated automatically by makefixed().");
+    puts("     */");
+    puts("");
+    puts("    /* WARNING: this file should *not* be used by applications.");
+    puts("       It is part of the implementation of this library and is");
+    puts("       subject to change. Applications should only use zlib.h.");
+    puts("     */");
+    puts("");
+    size = 1U << 9;
+    printf("    static const code lenfix[%u] = {", size);
+    low = 0;
+    for (;;) {
+        if ((low % 7) == 0) printf("\n        ");
+        printf("{%u,%u,%d}", (low & 127) == 99 ? 64 : state.lencode[low].op,
+               state.lencode[low].bits, state.lencode[low].val);
+        if (++low == size) break;
+        putchar(',');
+    }
+    puts("\n    };");
+    size = 1U << 5;
+    printf("\n    static const code distfix[%u] = {", size);
+    low = 0;
+    for (;;) {
+        if ((low % 6) == 0) printf("\n        ");
+        printf("{%u,%u,%d}", state.distcode[low].op, state.distcode[low].bits,
+               state.distcode[low].val);
+        if (++low == size) break;
+        putchar(',');
+    }
+    puts("\n    };");
+}
+#endif /* MAKEFIXED */
+
+/*
+   Update the window with the last wsize (normally 32K) bytes written before
+   returning.  If window does not exist yet, create it.  This is only called
+   when a window is already in use, or when output has been written during this
+   inflate call, but the end of the deflate stream has not been reached yet.
+   It is also called to create a window for dictionary data when a dictionary
+   is loaded.
+
+   Providing output buffers larger than 32K to inflate() should provide a speed
+   advantage, since only the last 32K of output is copied to the sliding window
+   upon return from inflate(), and since all distances after the first 32K of
+   output will fall in the output data, making match copies simpler and faster.
+   The advantage may be dependent on the size of the processor's data caches.
+ */
+local int updatewindow(strm, end, copy)
+z_streamp strm;
+const Bytef *end;
+unsigned copy;
+{
+    struct inflate_state FAR *state;
+    unsigned dist;
+
+    state = (struct inflate_state FAR *)strm->state;
+
+    /* if it hasn't been done already, allocate space for the window */
+    if (state->window == Z_NULL) {
+        state->window = (unsigned char FAR *)
+                        ZALLOC(strm, 1U << state->wbits,
+                               sizeof(unsigned char));
+        if (state->window == Z_NULL) return 1;
+    }
+
+    /* if window not in use yet, initialize */
+    if (state->wsize == 0) {
+        state->wsize = 1U << state->wbits;
+        state->wnext = 0;
+        state->whave = 0;
+    }
+
+    /* copy state->wsize or less output bytes into the circular window */
+    if (copy >= state->wsize) {
+        zmemcpy(state->window, end - state->wsize, state->wsize);
+        state->wnext = 0;
+        state->whave = state->wsize;
+    }
+    else {
+        dist = state->wsize - state->wnext;
+        if (dist > copy) dist = copy;
+        zmemcpy(state->window + state->wnext, end - copy, dist);
+        copy -= dist;
+        if (copy) {
+            zmemcpy(state->window, end - copy, copy);
+            state->wnext = copy;
+            state->whave = state->wsize;
+        }
+        else {
+            state->wnext += dist;
+            if (state->wnext == state->wsize) state->wnext = 0;
+            if (state->whave < state->wsize) state->whave += dist;
+        }
+    }
+    return 0;
+}
+
+/* Macros for inflate(): */
+
+/* check function to use adler32() for zlib or crc32() for gzip */
+#ifdef GUNZIP
+#  define UPDATE(check, buf, len) \
+    (state->flags ? crc32(check, buf, len) : adler32(check, buf, len))
+#else
+#  define UPDATE(check, buf, len) adler32(check, buf, len)
+#endif
+
+/* check macros for header crc */
+#ifdef GUNZIP
+#  define CRC2(check, word) \
+    do { \
+        hbuf[0] = (unsigned char)(word); \
+        hbuf[1] = (unsigned char)((word) >> 8); \
+        check = crc32(check, hbuf, 2); \
+    } while (0)
+
+#  define CRC4(check, word) \
+    do { \
+        hbuf[0] = (unsigned char)(word); \
+        hbuf[1] = (unsigned char)((word) >> 8); \
+        hbuf[2] = (unsigned char)((word) >> 16); \
+        hbuf[3] = (unsigned char)((word) >> 24); \
+        check = crc32(check, hbuf, 4); \
+    } while (0)
+#endif
+
+/* Load registers with state in inflate() for speed */
+#define LOAD() \
+    do { \
+        put = strm->next_out; \
+        left = strm->avail_out; \
+        next = strm->next_in; \
+        have = strm->avail_in; \
+        hold = state->hold; \
+        bits = state->bits; \
+    } while (0)
+
+/* Restore state from registers in inflate() */
+#define RESTORE() \
+    do { \
+        strm->next_out = put; \
+        strm->avail_out = left; \
+        strm->next_in = next; \
+        strm->avail_in = have; \
+        state->hold = hold; \
+        state->bits = bits; \
+    } while (0)
+
+/* Clear the input bit accumulator */
+#define INITBITS() \
+    do { \
+        hold = 0; \
+        bits = 0; \
+    } while (0)
+
+/* Get a byte of input into the bit accumulator, or return from inflate()
+   if there is no input available. */
+#define PULLBYTE() \
+    do { \
+        if (have == 0) goto inf_leave; \
+        have--; \
+        hold += (unsigned long)(*next++) << bits; \
+        bits += 8; \
+    } while (0)
+
+/* Assure that there are at least n bits in the bit accumulator.  If there is
+   not enough available input to do that, then return from inflate(). */
+#define NEEDBITS(n) \
+    do { \
+        while (bits < (unsigned)(n)) \
+            PULLBYTE(); \
+    } while (0)
+
+/* Return the low n bits of the bit accumulator (n < 16) */
+#define BITS(n) \
+    ((unsigned)hold & ((1U << (n)) - 1))
+
+/* Remove n bits from the bit accumulator */
+#define DROPBITS(n) \
+    do { \
+        hold >>= (n); \
+        bits -= (unsigned)(n); \
+    } while (0)
+
+/* Remove zero to seven bits as needed to go to a byte boundary */
+#define BYTEBITS() \
+    do { \
+        hold >>= bits & 7; \
+        bits -= bits & 7; \
+    } while (0)
+
+/*
+   inflate() uses a state machine to process as much input data and generate as
+   much output data as possible before returning.  The state machine is
+   structured roughly as follows:
+
+    for (;;) switch (state) {
+    ...
+    case STATEn:
+        if (not enough input data or output space to make progress)
+            return;
+        ... make progress ...
+        state = STATEm;
+        break;
+    ...
+    }
+
+   so when inflate() is called again, the same case is attempted again, and
+   if the appropriate resources are provided, the machine proceeds to the
+   next state.  The NEEDBITS() macro is usually the way the state evaluates
+   whether it can proceed or should return.  NEEDBITS() does the return if
+   the requested bits are not available.  The typical use of the BITS macros
+   is:
+
+        NEEDBITS(n);
+        ... do something with BITS(n) ...
+        DROPBITS(n);
+
+   where NEEDBITS(n) either returns from inflate() if there isn't enough
+   input left to load n bits into the accumulator, or it continues.  BITS(n)
+   gives the low n bits in the accumulator.  When done, DROPBITS(n) drops
+   the low n bits off the accumulator.  INITBITS() clears the accumulator
+   and sets the number of available bits to zero.  BYTEBITS() discards just
+   enough bits to put the accumulator on a byte boundary.  After BYTEBITS()
+   and a NEEDBITS(8), then BITS(8) would return the next byte in the stream.
+
+   NEEDBITS(n) uses PULLBYTE() to get an available byte of input, or to return
+   if there is no input available.  The decoding of variable length codes uses
+   PULLBYTE() directly in order to pull just enough bytes to decode the next
+   code, and no more.
+
+   Some states loop until they get enough input, making sure that enough
+   state information is maintained to continue the loop where it left off
+   if NEEDBITS() returns in the loop.  For example, want, need, and keep
+   would all have to actually be part of the saved state in case NEEDBITS()
+   returns:
+
+    case STATEw:
+        while (want < need) {
+            NEEDBITS(n);
+            keep[want++] = BITS(n);
+            DROPBITS(n);
+        }
+        state = STATEx;
+    case STATEx:
+
+   As shown above, if the next state is also the next case, then the break
+   is omitted.
+
+   A state may also return if there is not enough output space available to
+   complete that state.  Those states are copying stored data, writing a
+   literal byte, and copying a matching string.
+
+   When returning, a "goto inf_leave" is used to update the total counters,
+   update the check value, and determine whether any progress has been made
+   during that inflate() call in order to return the proper return code.
+   Progress is defined as a change in either strm->avail_in or strm->avail_out.
+   When there is a window, goto inf_leave will update the window with the last
+   output written.  If a goto inf_leave occurs in the middle of decompression
+   and there is no window currently, goto inf_leave will create one and copy
+   output to the window for the next call of inflate().
+
+   In this implementation, the flush parameter of inflate() only affects the
+   return code (per zlib.h).  inflate() always writes as much as possible to
+   strm->next_out, given the space available and the provided input--the effect
+   documented in zlib.h of Z_SYNC_FLUSH.  Furthermore, inflate() always defers
+   the allocation of and copying into a sliding window until necessary, which
+   provides the effect documented in zlib.h for Z_FINISH when the entire input
+   stream available.  So the only thing the flush parameter actually does is:
+   when flush is set to Z_FINISH, inflate() cannot return Z_OK.  Instead it
+   will return Z_BUF_ERROR if it has not reached the end of the stream.
+ */
+
+int ZEXPORT inflate(strm, flush)
+z_streamp strm;
+int flush;
+{
+    struct inflate_state FAR *state;
+    z_const unsigned char FAR *next;    /* next input */
+    unsigned char FAR *put;     /* next output */
+    unsigned have, left;        /* available input and output */
+    unsigned long hold;         /* bit buffer */
+    unsigned bits;              /* bits in bit buffer */
+    unsigned in, out;           /* save starting available input and output */
+    unsigned copy;              /* number of stored or match bytes to copy */
+    unsigned char FAR *from;    /* where to copy match bytes from */
+    code here;                  /* current decoding table entry */
+    code last;                  /* parent table entry */
+    unsigned len;               /* length to copy for repeats, bits to drop */
+    int ret;                    /* return code */
+#ifdef GUNZIP
+    unsigned char hbuf[4];      /* buffer for gzip header crc calculation */
+#endif
+    static const unsigned short order[19] = /* permutation of code lengths */
+        {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
+
+    if (inflateStateCheck(strm) || strm->next_out == Z_NULL ||
+        (strm->next_in == Z_NULL && strm->avail_in != 0))
+        return Z_STREAM_ERROR;
+
+    state = (struct inflate_state FAR *)strm->state;
+    if (state->mode == TYPE) state->mode = TYPEDO;      /* skip check */
+    LOAD();
+    in = have;
+    out = left;
+    ret = Z_OK;
+    for (;;)
+        switch (state->mode) {
+        case HEAD:
+            if (state->wrap == 0) {
+                state->mode = TYPEDO;
+                break;
+            }
+            NEEDBITS(16);
+#ifdef GUNZIP
+            if ((state->wrap & 2) && hold == 0x8b1f) {  /* gzip header */
+                if (state->wbits == 0)
+                    state->wbits = 15;
+                state->check = crc32(0L, Z_NULL, 0);
+                CRC2(state->check, hold);
+                INITBITS();
+                state->mode = FLAGS;
+                break;
+            }
+            state->flags = 0;           /* expect zlib header */
+            if (state->head != Z_NULL)
+                state->head->done = -1;
+            if (!(state->wrap & 1) ||   /* check if zlib header allowed */
+#else
+            if (
+#endif
+                ((BITS(8) << 8) + (hold >> 8)) % 31) {
+                strm->msg = (char *)"incorrect header check";
+                state->mode = BAD;
+                break;
+            }
+            if (BITS(4) != Z_DEFLATED) {
+                strm->msg = (char *)"unknown compression method";
+                state->mode = BAD;
+                break;
+            }
+            DROPBITS(4);
+            len = BITS(4) + 8;
+            if (state->wbits == 0)
+                state->wbits = len;
+            if (len > 15 || len > state->wbits) {
+                strm->msg = (char *)"invalid window size";
+                state->mode = BAD;
+                break;
+            }
+            state->dmax = 1U << len;
+            Tracev((stderr, "inflate:   zlib header ok\n"));
+            strm->adler = state->check = adler32(0L, Z_NULL, 0);
+            state->mode = hold & 0x200 ? DICTID : TYPE;
+            INITBITS();
+            break;
+#ifdef GUNZIP
+        case FLAGS:
+            NEEDBITS(16);
+            state->flags = (int)(hold);
+            if ((state->flags & 0xff) != Z_DEFLATED) {
+                strm->msg = (char *)"unknown compression method";
+                state->mode = BAD;
+                break;
+            }
+            if (state->flags & 0xe000) {
+                strm->msg = (char *)"unknown header flags set";
+                state->mode = BAD;
+                break;
+            }
+            if (state->head != Z_NULL)
+                state->head->text = (int)((hold >> 8) & 1);
+            if ((state->flags & 0x0200) && (state->wrap & 4))
+                CRC2(state->check, hold);
+            INITBITS();
+            state->mode = TIME;
+        case TIME:
+            NEEDBITS(32);
+            if (state->head != Z_NULL)
+                state->head->time = hold;
+            if ((state->flags & 0x0200) && (state->wrap & 4))
+                CRC4(state->check, hold);
+            INITBITS();
+            state->mode = OS;
+        case OS:
+            NEEDBITS(16);
+            if (state->head != Z_NULL) {
+                state->head->xflags = (int)(hold & 0xff);
+                state->head->os = (int)(hold >> 8);
+            }
+            if ((state->flags & 0x0200) && (state->wrap & 4))
+                CRC2(state->check, hold);
+            INITBITS();
+            state->mode = EXLEN;
+        case EXLEN:
+            if (state->flags & 0x0400) {
+                NEEDBITS(16);
+                state->length = (unsigned)(hold);
+                if (state->head != Z_NULL)
+                    state->head->extra_len = (unsigned)hold;
+                if ((state->flags & 0x0200) && (state->wrap & 4))
+                    CRC2(state->check, hold);
+                INITBITS();
+            }
+            else if (state->head != Z_NULL)
+                state->head->extra = Z_NULL;
+            state->mode = EXTRA;
+        case EXTRA:
+            if (state->flags & 0x0400) {
+                copy = state->length;
+                if (copy > have) copy = have;
+                if (copy) {
+                    if (state->head != Z_NULL &&
+                        state->head->extra != Z_NULL) {
+                        len = state->head->extra_len - state->length;
+                        zmemcpy(state->head->extra + len, next,
+                                len + copy > state->head->extra_max ?
+                                state->head->extra_max - len : copy);
+                    }
+                    if ((state->flags & 0x0200) && (state->wrap & 4))
+                        state->check = crc32(state->check, next, copy);
+                    have -= copy;
+                    next += copy;
+                    state->length -= copy;
+                }
+                if (state->length) goto inf_leave;
+            }
+            state->length = 0;
+            state->mode = NAME;
+        case NAME:
+            if (state->flags & 0x0800) {
+                if (have == 0) goto inf_leave;
+                copy = 0;
+                do {
+                    len = (unsigned)(next[copy++]);
+                    if (state->head != Z_NULL &&
+                            state->head->name != Z_NULL &&
+                            state->length < state->head->name_max)
+                        state->head->name[state->length++] = (Bytef)len;
+                } while (len && copy < have);
+                if ((state->flags & 0x0200) && (state->wrap & 4))
+                    state->check = crc32(state->check, next, copy);
+                have -= copy;
+                next += copy;
+                if (len) goto inf_leave;
+            }
+            else if (state->head != Z_NULL)
+                state->head->name = Z_NULL;
+            state->length = 0;
+            state->mode = COMMENT;
+        case COMMENT:
+            if (state->flags & 0x1000) {
+                if (have == 0) goto inf_leave;
+                copy = 0;
+                do {
+                    len = (unsigned)(next[copy++]);
+                    if (state->head != Z_NULL &&
+                            state->head->comment != Z_NULL &&
+                            state->length < state->head->comm_max)
+                        state->head->comment[state->length++] = (Bytef)len;
+                } while (len && copy < have);
+                if ((state->flags & 0x0200) && (state->wrap & 4))
+                    state->check = crc32(state->check, next, copy);
+                have -= copy;
+                next += copy;
+                if (len) goto inf_leave;
+            }
+            else if (state->head != Z_NULL)
+                state->head->comment = Z_NULL;
+            state->mode = HCRC;
+        case HCRC:
+            if (state->flags & 0x0200) {
+                NEEDBITS(16);
+                if ((state->wrap & 4) && hold != (state->check & 0xffff)) {
+                    strm->msg = (char *)"header crc mismatch";
+                    state->mode = BAD;
+                    break;
+                }
+                INITBITS();
+            }
+            if (state->head != Z_NULL) {
+                state->head->hcrc = (int)((state->flags >> 9) & 1);
+                state->head->done = 1;
+            }
+            strm->adler = state->check = crc32(0L, Z_NULL, 0);
+            state->mode = TYPE;
+            break;
+#endif
+        case DICTID:
+            NEEDBITS(32);
+            strm->adler = state->check = ZSWAP32(hold);
+            INITBITS();
+            state->mode = DICT;
+        case DICT:
+            if (state->havedict == 0) {
+                RESTORE();
+                return Z_NEED_DICT;
+            }
+            strm->adler = state->check = adler32(0L, Z_NULL, 0);
+            state->mode = TYPE;
+        case TYPE:
+            if (flush == Z_BLOCK || flush == Z_TREES) goto inf_leave;
+        case TYPEDO:
+            if (state->last) {
+                BYTEBITS();
+                state->mode = CHECK;
+                break;
+            }
+            NEEDBITS(3);
+            state->last = BITS(1);
+            DROPBITS(1);
+            switch (BITS(2)) {
+            case 0:                             /* stored block */
+                Tracev((stderr, "inflate:     stored block%s\n",
+                        state->last ? " (last)" : ""));
+                state->mode = STORED;
+                break;
+            case 1:                             /* fixed block */
+                fixedtables(state);
+                Tracev((stderr, "inflate:     fixed codes block%s\n",
+                        state->last ? " (last)" : ""));
+                state->mode = LEN_;             /* decode codes */
+                if (flush == Z_TREES) {
+                    DROPBITS(2);
+                    goto inf_leave;
+                }
+                break;
+            case 2:                             /* dynamic block */
+                Tracev((stderr, "inflate:     dynamic codes block%s\n",
+                        state->last ? " (last)" : ""));
+                state->mode = TABLE;
+                break;
+            case 3:
+                strm->msg = (char *)"invalid block type";
+                state->mode = BAD;
+            }
+            DROPBITS(2);
+            break;
+        case STORED:
+            BYTEBITS();                         /* go to byte boundary */
+            NEEDBITS(32);
+            if ((hold & 0xffff) != ((hold >> 16) ^ 0xffff)) {
+                strm->msg = (char *)"invalid stored block lengths";
+                state->mode = BAD;
+                break;
+            }
+            state->length = (unsigned)hold & 0xffff;
+            Tracev((stderr, "inflate:       stored length %u\n",
+                    state->length));
+            INITBITS();
+            state->mode = COPY_;
+            if (flush == Z_TREES) goto inf_leave;
+        case COPY_:
+            state->mode = COPY;
+        case COPY:
+            copy = state->length;
+            if (copy) {
+                if (copy > have) copy = have;
+                if (copy > left) copy = left;
+                if (copy == 0) goto inf_leave;
+                zmemcpy(put, next, copy);
+                have -= copy;
+                next += copy;
+                left -= copy;
+                put += copy;
+                state->length -= copy;
+                break;
+            }
+            Tracev((stderr, "inflate:       stored end\n"));
+            state->mode = TYPE;
+            break;
+        case TABLE:
+            NEEDBITS(14);
+            state->nlen = BITS(5) + 257;
+            DROPBITS(5);
+            state->ndist = BITS(5) + 1;
+            DROPBITS(5);
+            state->ncode = BITS(4) + 4;
+            DROPBITS(4);
+#ifndef PKZIP_BUG_WORKAROUND
+            if (state->nlen > 286 || state->ndist > 30) {
+                strm->msg = (char *)"too many length or distance symbols";
+                state->mode = BAD;
+                break;
+            }
+#endif
+            Tracev((stderr, "inflate:       table sizes ok\n"));
+            state->have = 0;
+            state->mode = LENLENS;
+        case LENLENS:
+            while (state->have < state->ncode) {
+                NEEDBITS(3);
+                state->lens[order[state->have++]] = (unsigned short)BITS(3);
+                DROPBITS(3);
+            }
+            while (state->have < 19)
+                state->lens[order[state->have++]] = 0;
+            state->next = state->codes;
+            state->lencode = (const code FAR *)(state->next);
+            state->lenbits = 7;
+            ret = inflate_table(CODES, state->lens, 19, &(state->next),
+                                &(state->lenbits), state->work);
+            if (ret) {
+                strm->msg = (char *)"invalid code lengths set";
+                state->mode = BAD;
+                break;
+            }
+            Tracev((stderr, "inflate:       code lengths ok\n"));
+            state->have = 0;
+            state->mode = CODELENS;
+        case CODELENS:
+            while (state->have < state->nlen + state->ndist) {
+                for (;;) {
+                    here = state->lencode[BITS(state->lenbits)];
+                    if ((unsigned)(here.bits) <= bits) break;
+                    PULLBYTE();
+                }
+                if (here.val < 16) {
+                    DROPBITS(here.bits);
+                    state->lens[state->have++] = here.val;
+                }
+                else {
+                    if (here.val == 16) {
+                        NEEDBITS(here.bits + 2);
+                        DROPBITS(here.bits);
+                        if (state->have == 0) {
+                            strm->msg = (char *)"invalid bit length repeat";
+                            state->mode = BAD;
+                            break;
+                        }
+                        len = state->lens[state->have - 1];
+                        copy = 3 + BITS(2);
+                        DROPBITS(2);
+                    }
+                    else if (here.val == 17) {
+                        NEEDBITS(here.bits + 3);
+                        DROPBITS(here.bits);
+                        len = 0;
+                        copy = 3 + BITS(3);
+                        DROPBITS(3);
+                    }
+                    else {
+                        NEEDBITS(here.bits + 7);
+                        DROPBITS(here.bits);
+                        len = 0;
+                        copy = 11 + BITS(7);
+                        DROPBITS(7);
+                    }
+                    if (state->have + copy > state->nlen + state->ndist) {
+                        strm->msg = (char *)"invalid bit length repeat";
+                        state->mode = BAD;
+                        break;
+                    }
+                    while (copy--)
+                        state->lens[state->have++] = (unsigned short)len;
+                }
+            }
+
+            /* handle error breaks in while */
+            if (state->mode == BAD) break;
+
+            /* check for end-of-block code (better have one) */
+            if (state->lens[256] == 0) {
+                strm->msg = (char *)"invalid code -- missing end-of-block";
+                state->mode = BAD;
+                break;
+            }
+
+            /* build code tables -- note: do not change the lenbits or distbits
+               values here (9 and 6) without reading the comments in inftrees.h
+               concerning the ENOUGH constants, which depend on those values */
+            state->next = state->codes;
+            state->lencode = (const code FAR *)(state->next);
+            state->lenbits = 9;
+            ret = inflate_table(LENS, state->lens, state->nlen, &(state->next),
+                                &(state->lenbits), state->work);
+            if (ret) {
+                strm->msg = (char *)"invalid literal/lengths set";
+                state->mode = BAD;
+                break;
+            }
+            state->distcode = (const code FAR *)(state->next);
+            state->distbits = 6;
+            ret = inflate_table(DISTS, state->lens + state->nlen, state->ndist,
+                            &(state->next), &(state->distbits), state->work);
+            if (ret) {
+                strm->msg = (char *)"invalid distances set";
+                state->mode = BAD;
+                break;
+            }
+            Tracev((stderr, "inflate:       codes ok\n"));
+            state->mode = LEN_;
+            if (flush == Z_TREES) goto inf_leave;
+        case LEN_:
+            state->mode = LEN;
+        case LEN:
+            if (have >= INFLATE_FAST_MIN_INPUT &&
+                left >= INFLATE_FAST_MIN_OUTPUT) {
+                RESTORE();
+                inflate_fast(strm, out);
+                LOAD();
+                if (state->mode == TYPE)
+                    state->back = -1;
+                break;
+            }
+            state->back = 0;
+            for (;;) {
+                here = state->lencode[BITS(state->lenbits)];
+                if ((unsigned)(here.bits) <= bits) break;
+                PULLBYTE();
+            }
+            if (here.op && (here.op & 0xf0) == 0) {
+                last = here;
+                for (;;) {
+                    here = state->lencode[last.val +
+                            (BITS(last.bits + last.op) >> last.bits)];
+                    if ((unsigned)(last.bits + here.bits) <= bits) break;
+                    PULLBYTE();
+                }
+                DROPBITS(last.bits);
+                state->back += last.bits;
+            }
+            DROPBITS(here.bits);
+            state->back += here.bits;
+            state->length = (unsigned)here.val;
+            if ((int)(here.op) == 0) {
+                Tracevv((stderr, here.val >= 0x20 && here.val < 0x7f ?
+                        "inflate:         literal '%c'\n" :
+                        "inflate:         literal 0x%02x\n", here.val));
+                state->mode = LIT;
+                break;
+            }
+            if (here.op & 32) {
+                Tracevv((stderr, "inflate:         end of block\n"));
+                state->back = -1;
+                state->mode = TYPE;
+                break;
+            }
+            if (here.op & 64) {
+                strm->msg = (char *)"invalid literal/length code";
+                state->mode = BAD;
+                break;
+            }
+            state->extra = (unsigned)(here.op) & 15;
+            state->mode = LENEXT;
+        case LENEXT:
+            if (state->extra) {
+                NEEDBITS(state->extra);
+                state->length += BITS(state->extra);
+                DROPBITS(state->extra);
+                state->back += state->extra;
+            }
+            Tracevv((stderr, "inflate:         length %u\n", state->length));
+            state->was = state->length;
+            state->mode = DIST;
+        case DIST:
+            for (;;) {
+                here = state->distcode[BITS(state->distbits)];
+                if ((unsigned)(here.bits) <= bits) break;
+                PULLBYTE();
+            }
+            if ((here.op & 0xf0) == 0) {
+                last = here;
+                for (;;) {
+                    here = state->distcode[last.val +
+                            (BITS(last.bits + last.op) >> last.bits)];
+                    if ((unsigned)(last.bits + here.bits) <= bits) break;
+                    PULLBYTE();
+                }
+                DROPBITS(last.bits);
+                state->back += last.bits;
+            }
+            DROPBITS(here.bits);
+            state->back += here.bits;
+            if (here.op & 64) {
+                strm->msg = (char *)"invalid distance code";
+                state->mode = BAD;
+                break;
+            }
+            state->offset = (unsigned)here.val;
+            state->extra = (unsigned)(here.op) & 15;
+            state->mode = DISTEXT;
+        case DISTEXT:
+            if (state->extra) {
+                NEEDBITS(state->extra);
+                state->offset += BITS(state->extra);
+                DROPBITS(state->extra);
+                state->back += state->extra;
+            }
+#ifdef INFLATE_STRICT
+            if (state->offset > state->dmax) {
+                strm->msg = (char *)"invalid distance too far back";
+                state->mode = BAD;
+                break;
+            }
+#endif
+            Tracevv((stderr, "inflate:         distance %u\n", state->offset));
+            state->mode = MATCH;
+        case MATCH:
+            if (left == 0) goto inf_leave;
+            copy = out - left;
+            if (state->offset > copy) {         /* copy from window */
+                copy = state->offset - copy;
+                if (copy > state->whave) {
+                    if (state->sane) {
+                        strm->msg = (char *)"invalid distance too far back";
+                        state->mode = BAD;
+                        break;
+                    }
+#ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR
+                    Trace((stderr, "inflate.c too far\n"));
+                    copy -= state->whave;
+                    if (copy > state->length) copy = state->length;
+                    if (copy > left) copy = left;
+                    left -= copy;
+                    state->length -= copy;
+                    do {
+                        *put++ = 0;
+                    } while (--copy);
+                    if (state->length == 0) state->mode = LEN;
+                    break;
+#endif
+                }
+                if (copy > state->wnext) {
+                    copy -= state->wnext;
+                    from = state->window + (state->wsize - copy);
+                }
+                else
+                    from = state->window + (state->wnext - copy);
+                if (copy > state->length) copy = state->length;
+            }
+            else {                              /* copy from output */
+                from = put - state->offset;
+                copy = state->length;
+            }
+            if (copy > left) copy = left;
+            left -= copy;
+            state->length -= copy;
+            do {
+                *put++ = *from++;
+            } while (--copy);
+            if (state->length == 0) state->mode = LEN;
+            break;
+        case LIT:
+            if (left == 0) goto inf_leave;
+            *put++ = (unsigned char)(state->length);
+            left--;
+            state->mode = LEN;
+            break;
+        case CHECK:
+            if (state->wrap) {
+                NEEDBITS(32);
+                out -= left;
+                strm->total_out += out;
+                state->total += out;
+                if ((state->wrap & 4) && out)
+                    strm->adler = state->check =
+                        UPDATE(state->check, put - out, out);
+                out = left;
+                if ((state->wrap & 4) && (
+#ifdef GUNZIP
+                     state->flags ? hold :
+#endif
+                     ZSWAP32(hold)) != state->check) {
+                    strm->msg = (char *)"incorrect data check";
+                    state->mode = BAD;
+                    break;
+                }
+                INITBITS();
+                Tracev((stderr, "inflate:   check matches trailer\n"));
+            }
+#ifdef GUNZIP
+            state->mode = LENGTH;
+        case LENGTH:
+            if (state->wrap && state->flags) {
+                NEEDBITS(32);
+                if (hold != (state->total & 0xffffffffUL)) {
+                    strm->msg = (char *)"incorrect length check";
+                    state->mode = BAD;
+                    break;
+                }
+                INITBITS();
+                Tracev((stderr, "inflate:   length matches trailer\n"));
+            }
+#endif
+            state->mode = DONE;
+        case DONE:
+            ret = Z_STREAM_END;
+            goto inf_leave;
+        case BAD:
+            ret = Z_DATA_ERROR;
+            goto inf_leave;
+        case MEM:
+            return Z_MEM_ERROR;
+        case SYNC:
+        default:
+            return Z_STREAM_ERROR;
+        }
+
+    /*
+       Return from inflate(), updating the total counts and the check value.
+       If there was no progress during the inflate() call, return a buffer
+       error.  Call updatewindow() to create and/or update the window state.
+       Note: a memory error from inflate() is non-recoverable.
+     */
+  inf_leave:
+    RESTORE();
+    if (state->wsize || (out != strm->avail_out && state->mode < BAD &&
+            (state->mode < CHECK || flush != Z_FINISH)))
+        if (updatewindow(strm, strm->next_out, out - strm->avail_out)) {
+            state->mode = MEM;
+            return Z_MEM_ERROR;
+        }
+    in -= strm->avail_in;
+    out -= strm->avail_out;
+    strm->total_in += in;
+    strm->total_out += out;
+    state->total += out;
+    if ((state->wrap & 4) && out)
+        strm->adler = state->check =
+            UPDATE(state->check, strm->next_out - out, out);
+    strm->data_type = (int)state->bits + (state->last ? 64 : 0) +
+                      (state->mode == TYPE ? 128 : 0) +
+                      (state->mode == LEN_ || state->mode == COPY_ ? 256 : 0);
+    if (((in == 0 && out == 0) || flush == Z_FINISH) && ret == Z_OK)
+        ret = Z_BUF_ERROR;
+    return ret;
+}
+
+int ZEXPORT inflateEnd(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+    if (inflateStateCheck(strm))
+        return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    if (state->window != Z_NULL) ZFREE(strm, state->window);
+    ZFREE(strm, strm->state);
+    strm->state = Z_NULL;
+    Tracev((stderr, "inflate: end\n"));
+    return Z_OK;
+}
+
+int ZEXPORT inflateGetDictionary(strm, dictionary, dictLength)
+z_streamp strm;
+Bytef *dictionary;
+uInt *dictLength;
+{
+    struct inflate_state FAR *state;
+
+    /* check state */
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+
+    /* copy dictionary */
+    if (state->whave && dictionary != Z_NULL) {
+        zmemcpy(dictionary, state->window + state->wnext,
+                state->whave - state->wnext);
+        zmemcpy(dictionary + state->whave - state->wnext,
+                state->window, state->wnext);
+    }
+    if (dictLength != Z_NULL)
+        *dictLength = state->whave;
+    return Z_OK;
+}
+
+int ZEXPORT inflateSetDictionary(strm, dictionary, dictLength)
+z_streamp strm;
+const Bytef *dictionary;
+uInt dictLength;
+{
+    struct inflate_state FAR *state;
+    unsigned long dictid;
+    int ret;
+
+    /* check state */
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    if (state->wrap != 0 && state->mode != DICT)
+        return Z_STREAM_ERROR;
+
+    /* check for correct dictionary identifier */
+    if (state->mode == DICT) {
+        dictid = adler32(0L, Z_NULL, 0);
+        dictid = adler32(dictid, dictionary, dictLength);
+        if (dictid != state->check)
+            return Z_DATA_ERROR;
+    }
+
+    /* copy dictionary to window using updatewindow(), which will amend the
+       existing dictionary if appropriate */
+    ret = updatewindow(strm, dictionary + dictLength, dictLength);
+    if (ret) {
+        state->mode = MEM;
+        return Z_MEM_ERROR;
+    }
+    state->havedict = 1;
+    Tracev((stderr, "inflate:   dictionary set\n"));
+    return Z_OK;
+}
+
+int ZEXPORT inflateGetHeader(strm, head)
+z_streamp strm;
+gz_headerp head;
+{
+    struct inflate_state FAR *state;
+
+    /* check state */
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    if ((state->wrap & 2) == 0) return Z_STREAM_ERROR;
+
+    /* save header structure */
+    state->head = head;
+    head->done = 0;
+    return Z_OK;
+}
+
+/*
+   Search buf[0..len-1] for the pattern: 0, 0, 0xff, 0xff.  Return when found
+   or when out of input.  When called, *have is the number of pattern bytes
+   found in order so far, in 0..3.  On return *have is updated to the new
+   state.  If on return *have equals four, then the pattern was found and the
+   return value is how many bytes were read including the last byte of the
+   pattern.  If *have is less than four, then the pattern has not been found
+   yet and the return value is len.  In the latter case, syncsearch() can be
+   called again with more data and the *have state.  *have is initialized to
+   zero for the first call.
+ */
+local unsigned syncsearch(have, buf, len)
+unsigned FAR *have;
+const unsigned char FAR *buf;
+unsigned len;
+{
+    unsigned got;
+    unsigned next;
+
+    got = *have;
+    next = 0;
+    while (next < len && got < 4) {
+        if ((int)(buf[next]) == (got < 2 ? 0 : 0xff))
+            got++;
+        else if (buf[next])
+            got = 0;
+        else
+            got = 4 - got;
+        next++;
+    }
+    *have = got;
+    return next;
+}
+
+int ZEXPORT inflateSync(strm)
+z_streamp strm;
+{
+    unsigned len;               /* number of bytes to look at or looked at */
+    unsigned long in, out;      /* temporary to save total_in and total_out */
+    unsigned char buf[4];       /* to restore bit buffer to byte string */
+    struct inflate_state FAR *state;
+
+    /* check parameters */
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    if (strm->avail_in == 0 && state->bits < 8) return Z_BUF_ERROR;
+
+    /* if first time, start search in bit buffer */
+    if (state->mode != SYNC) {
+        state->mode = SYNC;
+        state->hold <<= state->bits & 7;
+        state->bits -= state->bits & 7;
+        len = 0;
+        while (state->bits >= 8) {
+            buf[len++] = (unsigned char)(state->hold);
+            state->hold >>= 8;
+            state->bits -= 8;
+        }
+        state->have = 0;
+        syncsearch(&(state->have), buf, len);
+    }
+
+    /* search available input */
+    len = syncsearch(&(state->have), strm->next_in, strm->avail_in);
+    strm->avail_in -= len;
+    strm->next_in += len;
+    strm->total_in += len;
+
+    /* return no joy or set up to restart inflate() on a new block */
+    if (state->have != 4) return Z_DATA_ERROR;
+    in = strm->total_in;  out = strm->total_out;
+    inflateReset(strm);
+    strm->total_in = in;  strm->total_out = out;
+    state->mode = TYPE;
+    return Z_OK;
+}
+
+/*
+   Returns true if inflate is currently at the end of a block generated by
+   Z_SYNC_FLUSH or Z_FULL_FLUSH. This function is used by one PPP
+   implementation to provide an additional safety check. PPP uses
+   Z_SYNC_FLUSH but removes the length bytes of the resulting empty stored
+   block. When decompressing, PPP checks that at the end of input packet,
+   inflate is waiting for these length bytes.
+ */
+int ZEXPORT inflateSyncPoint(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    return state->mode == STORED && state->bits == 0;
+}
+
+int ZEXPORT inflateCopy(dest, source)
+z_streamp dest;
+z_streamp source;
+{
+    struct inflate_state FAR *state;
+    struct inflate_state FAR *copy;
+    unsigned char FAR *window;
+    unsigned wsize;
+
+    /* check input */
+    if (inflateStateCheck(source) || dest == Z_NULL)
+        return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)source->state;
+
+    /* allocate space */
+    copy = (struct inflate_state FAR *)
+           ZALLOC(source, 1, sizeof(struct inflate_state));
+    if (copy == Z_NULL) return Z_MEM_ERROR;
+    window = Z_NULL;
+    if (state->window != Z_NULL) {
+        window = (unsigned char FAR *)
+                 ZALLOC(source, 1U << state->wbits, sizeof(unsigned char));
+        if (window == Z_NULL) {
+            ZFREE(source, copy);
+            return Z_MEM_ERROR;
+        }
+    }
+
+    /* copy state */
+    zmemcpy((voidpf)dest, (voidpf)source, sizeof(z_stream));
+    zmemcpy((voidpf)copy, (voidpf)state, sizeof(struct inflate_state));
+    copy->strm = dest;
+    if (state->lencode >= state->codes &&
+        state->lencode <= state->codes + ENOUGH - 1) {
+        copy->lencode = copy->codes + (state->lencode - state->codes);
+        copy->distcode = copy->codes + (state->distcode - state->codes);
+    }
+    copy->next = copy->codes + (state->next - state->codes);
+    if (window != Z_NULL) {
+        wsize = 1U << state->wbits;
+        zmemcpy(window, state->window, wsize);
+    }
+    copy->window = window;
+    dest->state = (struct internal_state FAR *)copy;
+    return Z_OK;
+}
+
+int ZEXPORT inflateUndermine(strm, subvert)
+z_streamp strm;
+int subvert;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+#ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR
+    state->sane = !subvert;
+    return Z_OK;
+#else
+    (void)subvert;
+    state->sane = 1;
+    return Z_DATA_ERROR;
+#endif
+}
+
+int ZEXPORT inflateValidate(strm, check)
+z_streamp strm;
+int check;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    if (check)
+        state->wrap |= 4;
+    else
+        state->wrap &= ~4;
+    return Z_OK;
+}
+
+long ZEXPORT inflateMark(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm))
+        return -(1L << 16);
+    state = (struct inflate_state FAR *)strm->state;
+    return (long)(((unsigned long)((long)state->back)) << 16) +
+        (state->mode == COPY ? state->length :
+            (state->mode == MATCH ? state->was - state->length : 0));
+}
+
+unsigned long ZEXPORT inflateCodesUsed(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+    if (inflateStateCheck(strm)) return (unsigned long)-1;
+    state = (struct inflate_state FAR *)strm->state;
+    return (unsigned long)(state->next - state->codes);
+}
diff --git a/deps/v8/third_party/zlib/inflate.h b/deps/v8/third_party/zlib/inflate.h
new file mode 100644
index 00000000000000..a46cce6b6d05ef
--- /dev/null
+++ b/deps/v8/third_party/zlib/inflate.h
@@ -0,0 +1,125 @@
+/* inflate.h -- internal inflate state definition
+ * Copyright (C) 1995-2016 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/* WARNING: this file should *not* be used by applications. It is
+   part of the implementation of the compression library and is
+   subject to change. Applications should only use zlib.h.
+ */
+
+/* define NO_GZIP when compiling if you want to disable gzip header and
+   trailer decoding by inflate().  NO_GZIP would be used to avoid linking in
+   the crc code when it is not needed.  For shared libraries, gzip decoding
+   should be left enabled. */
+#ifndef NO_GZIP
+#  define GUNZIP
+#endif
+
+/* Possible inflate modes between inflate() calls */
+typedef enum {
+    HEAD = 16180,   /* i: waiting for magic header */
+    FLAGS,      /* i: waiting for method and flags (gzip) */
+    TIME,       /* i: waiting for modification time (gzip) */
+    OS,         /* i: waiting for extra flags and operating system (gzip) */
+    EXLEN,      /* i: waiting for extra length (gzip) */
+    EXTRA,      /* i: waiting for extra bytes (gzip) */
+    NAME,       /* i: waiting for end of file name (gzip) */
+    COMMENT,    /* i: waiting for end of comment (gzip) */
+    HCRC,       /* i: waiting for header crc (gzip) */
+    DICTID,     /* i: waiting for dictionary check value */
+    DICT,       /* waiting for inflateSetDictionary() call */
+        TYPE,       /* i: waiting for type bits, including last-flag bit */
+        TYPEDO,     /* i: same, but skip check to exit inflate on new block */
+        STORED,     /* i: waiting for stored size (length and complement) */
+        COPY_,      /* i/o: same as COPY below, but only first time in */
+        COPY,       /* i/o: waiting for input or output to copy stored block */
+        TABLE,      /* i: waiting for dynamic block table lengths */
+        LENLENS,    /* i: waiting for code length code lengths */
+        CODELENS,   /* i: waiting for length/lit and distance code lengths */
+            LEN_,       /* i: same as LEN below, but only first time in */
+            LEN,        /* i: waiting for length/lit/eob code */
+            LENEXT,     /* i: waiting for length extra bits */
+            DIST,       /* i: waiting for distance code */
+            DISTEXT,    /* i: waiting for distance extra bits */
+            MATCH,      /* o: waiting for output space to copy string */
+            LIT,        /* o: waiting for output space to write literal */
+    CHECK,      /* i: waiting for 32-bit check value */
+    LENGTH,     /* i: waiting for 32-bit length (gzip) */
+    DONE,       /* finished check, done -- remain here until reset */
+    BAD,        /* got a data error -- remain here until reset */
+    MEM,        /* got an inflate() memory error -- remain here until reset */
+    SYNC        /* looking for synchronization bytes to restart inflate() */
+} inflate_mode;
+
+/*
+    State transitions between above modes -
+
+    (most modes can go to BAD or MEM on error -- not shown for clarity)
+
+    Process header:
+        HEAD -> (gzip) or (zlib) or (raw)
+        (gzip) -> FLAGS -> TIME -> OS -> EXLEN -> EXTRA -> NAME -> COMMENT ->
+                  HCRC -> TYPE
+        (zlib) -> DICTID or TYPE
+        DICTID -> DICT -> TYPE
+        (raw) -> TYPEDO
+    Read deflate blocks:
+            TYPE -> TYPEDO -> STORED or TABLE or LEN_ or CHECK
+            STORED -> COPY_ -> COPY -> TYPE
+            TABLE -> LENLENS -> CODELENS -> LEN_
+            LEN_ -> LEN
+    Read deflate codes in fixed or dynamic block:
+                LEN -> LENEXT or LIT or TYPE
+                LENEXT -> DIST -> DISTEXT -> MATCH -> LEN
+                LIT -> LEN
+    Process trailer:
+        CHECK -> LENGTH -> DONE
+ */
+
+/* State maintained between inflate() calls -- approximately 7K bytes, not
+   including the allocated sliding window, which is up to 32K bytes. */
+struct inflate_state {
+    z_streamp strm;             /* pointer back to this zlib stream */
+    inflate_mode mode;          /* current inflate mode */
+    int last;                   /* true if processing last block */
+    int wrap;                   /* bit 0 true for zlib, bit 1 true for gzip,
+                                   bit 2 true to validate check value */
+    int havedict;               /* true if dictionary provided */
+    int flags;                  /* gzip header method and flags (0 if zlib) */
+    unsigned dmax;              /* zlib header max distance (INFLATE_STRICT) */
+    unsigned long check;        /* protected copy of check value */
+    unsigned long total;        /* protected copy of output count */
+    gz_headerp head;            /* where to save gzip header information */
+        /* sliding window */
+    unsigned wbits;             /* log base 2 of requested window size */
+    unsigned wsize;             /* window size or zero if not using window */
+    unsigned whave;             /* valid bytes in the window */
+    unsigned wnext;             /* window write index */
+    unsigned char FAR *window;  /* allocated sliding window, if needed */
+        /* bit accumulator */
+    unsigned long hold;         /* input bit accumulator */
+    unsigned bits;              /* number of bits in "in" */
+        /* for string and stored block copying */
+    unsigned length;            /* literal or length of data to copy */
+    unsigned offset;            /* distance back to copy string from */
+        /* for table and code decoding */
+    unsigned extra;             /* extra bits needed */
+        /* fixed and dynamic code tables */
+    code const FAR *lencode;    /* starting table for length/literal codes */
+    code const FAR *distcode;   /* starting table for distance codes */
+    unsigned lenbits;           /* index bits for lencode */
+    unsigned distbits;          /* index bits for distcode */
+        /* dynamic table building */
+    unsigned ncode;             /* number of code length code lengths */
+    unsigned nlen;              /* number of length code lengths */
+    unsigned ndist;             /* number of distance code lengths */
+    unsigned have;              /* number of code lengths in lens[] */
+    code FAR *next;             /* next available space in codes[] */
+    unsigned short lens[320];   /* temporary storage for code lengths */
+    unsigned short work[288];   /* work area for code table building */
+    code codes[ENOUGH];         /* space for code tables */
+    int sane;                   /* if false, allow invalid distance too far */
+    int back;                   /* bits back of last unprocessed length/lit */
+    unsigned was;               /* initial length of match */
+};
diff --git a/deps/v8/third_party/zlib/inftrees.c b/deps/v8/third_party/zlib/inftrees.c
new file mode 100644
index 00000000000000..2ea08fc13ea8ec
--- /dev/null
+++ b/deps/v8/third_party/zlib/inftrees.c
@@ -0,0 +1,304 @@
+/* inftrees.c -- generate Huffman trees for efficient decoding
+ * Copyright (C) 1995-2017 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+#include "zutil.h"
+#include "inftrees.h"
+
+#define MAXBITS 15
+
+const char inflate_copyright[] =
+   " inflate 1.2.11 Copyright 1995-2017 Mark Adler ";
+/*
+  If you use the zlib library in a product, an acknowledgment is welcome
+  in the documentation of your product. If for some reason you cannot
+  include such an acknowledgment, I would appreciate that you keep this
+  copyright string in the executable of your product.
+ */
+
+/*
+   Build a set of tables to decode the provided canonical Huffman code.
+   The code lengths are lens[0..codes-1].  The result starts at *table,
+   whose indices are 0..2^bits-1.  work is a writable array of at least
+   lens shorts, which is used as a work area.  type is the type of code
+   to be generated, CODES, LENS, or DISTS.  On return, zero is success,
+   -1 is an invalid code, and +1 means that ENOUGH isn't enough.  table
+   on return points to the next available entry's address.  bits is the
+   requested root table index bits, and on return it is the actual root
+   table index bits.  It will differ if the request is greater than the
+   longest code or if it is less than the shortest code.
+ */
+int ZLIB_INTERNAL inflate_table(type, lens, codes, table, bits, work)
+codetype type;
+unsigned short FAR *lens;
+unsigned codes;
+code FAR * FAR *table;
+unsigned FAR *bits;
+unsigned short FAR *work;
+{
+    unsigned len;               /* a code's length in bits */
+    unsigned sym;               /* index of code symbols */
+    unsigned min, max;          /* minimum and maximum code lengths */
+    unsigned root;              /* number of index bits for root table */
+    unsigned curr;              /* number of index bits for current table */
+    unsigned drop;              /* code bits to drop for sub-table */
+    int left;                   /* number of prefix codes available */
+    unsigned used;              /* code entries in table used */
+    unsigned huff;              /* Huffman code */
+    unsigned incr;              /* for incrementing code, index */
+    unsigned fill;              /* index for replicating entries */
+    unsigned low;               /* low bits for current root entry */
+    unsigned mask;              /* mask for low root bits */
+    code here;                  /* table entry for duplication */
+    code FAR *next;             /* next available space in table */
+    const unsigned short FAR *base;     /* base value table to use */
+    const unsigned short FAR *extra;    /* extra bits table to use */
+    unsigned match;             /* use base and extra for symbol >= match */
+    unsigned short count[MAXBITS+1];    /* number of codes of each length */
+    unsigned short offs[MAXBITS+1];     /* offsets in table for each length */
+    static const unsigned short lbase[31] = { /* Length codes 257..285 base */
+        3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
+        35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258, 0, 0};
+    static const unsigned short lext[31] = { /* Length codes 257..285 extra */
+        16, 16, 16, 16, 16, 16, 16, 16, 17, 17, 17, 17, 18, 18, 18, 18,
+        19, 19, 19, 19, 20, 20, 20, 20, 21, 21, 21, 21, 16, 77, 202};
+    static const unsigned short dbase[32] = { /* Distance codes 0..29 base */
+        1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
+        257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
+        8193, 12289, 16385, 24577, 0, 0};
+    static const unsigned short dext[32] = { /* Distance codes 0..29 extra */
+        16, 16, 16, 16, 17, 17, 18, 18, 19, 19, 20, 20, 21, 21, 22, 22,
+        23, 23, 24, 24, 25, 25, 26, 26, 27, 27,
+        28, 28, 29, 29, 64, 64};
+
+    /*
+       Process a set of code lengths to create a canonical Huffman code.  The
+       code lengths are lens[0..codes-1].  Each length corresponds to the
+       symbols 0..codes-1.  The Huffman code is generated by first sorting the
+       symbols by length from short to long, and retaining the symbol order
+       for codes with equal lengths.  Then the code starts with all zero bits
+       for the first code of the shortest length, and the codes are integer
+       increments for the same length, and zeros are appended as the length
+       increases.  For the deflate format, these bits are stored backwards
+       from their more natural integer increment ordering, and so when the
+       decoding tables are built in the large loop below, the integer codes
+       are incremented backwards.
+
+       This routine assumes, but does not check, that all of the entries in
+       lens[] are in the range 0..MAXBITS.  The caller must assure this.
+       1..MAXBITS is interpreted as that code length.  zero means that that
+       symbol does not occur in this code.
+
+       The codes are sorted by computing a count of codes for each length,
+       creating from that a table of starting indices for each length in the
+       sorted table, and then entering the symbols in order in the sorted
+       table.  The sorted table is work[], with that space being provided by
+       the caller.
+
+       The length counts are used for other purposes as well, i.e. finding
+       the minimum and maximum length codes, determining if there are any
+       codes at all, checking for a valid set of lengths, and looking ahead
+       at length counts to determine sub-table sizes when building the
+       decoding tables.
+     */
+
+    /* accumulate lengths for codes (assumes lens[] all in 0..MAXBITS) */
+    for (len = 0; len <= MAXBITS; len++)
+        count[len] = 0;
+    for (sym = 0; sym < codes; sym++)
+        count[lens[sym]]++;
+
+    /* bound code lengths, force root to be within code lengths */
+    root = *bits;
+    for (max = MAXBITS; max >= 1; max--)
+        if (count[max] != 0) break;
+    if (root > max) root = max;
+    if (max == 0) {                     /* no symbols to code at all */
+        here.op = (unsigned char)64;    /* invalid code marker */
+        here.bits = (unsigned char)1;
+        here.val = (unsigned short)0;
+        *(*table)++ = here;             /* make a table to force an error */
+        *(*table)++ = here;
+        *bits = 1;
+        return 0;     /* no symbols, but wait for decoding to report error */
+    }
+    for (min = 1; min < max; min++)
+        if (count[min] != 0) break;
+    if (root < min) root = min;
+
+    /* check for an over-subscribed or incomplete set of lengths */
+    left = 1;
+    for (len = 1; len <= MAXBITS; len++) {
+        left <<= 1;
+        left -= count[len];
+        if (left < 0) return -1;        /* over-subscribed */
+    }
+    if (left > 0 && (type == CODES || max != 1))
+        return -1;                      /* incomplete set */
+
+    /* generate offsets into symbol table for each length for sorting */
+    offs[1] = 0;
+    for (len = 1; len < MAXBITS; len++)
+        offs[len + 1] = offs[len] + count[len];
+
+    /* sort symbols by length, by symbol order within each length */
+    for (sym = 0; sym < codes; sym++)
+        if (lens[sym] != 0) work[offs[lens[sym]]++] = (unsigned short)sym;
+
+    /*
+       Create and fill in decoding tables.  In this loop, the table being
+       filled is at next and has curr index bits.  The code being used is huff
+       with length len.  That code is converted to an index by dropping drop
+       bits off of the bottom.  For codes where len is less than drop + curr,
+       those top drop + curr - len bits are incremented through all values to
+       fill the table with replicated entries.
+
+       root is the number of index bits for the root table.  When len exceeds
+       root, sub-tables are created pointed to by the root entry with an index
+       of the low root bits of huff.  This is saved in low to check for when a
+       new sub-table should be started.  drop is zero when the root table is
+       being filled, and drop is root when sub-tables are being filled.
+
+       When a new sub-table is needed, it is necessary to look ahead in the
+       code lengths to determine what size sub-table is needed.  The length
+       counts are used for this, and so count[] is decremented as codes are
+       entered in the tables.
+
+       used keeps track of how many table entries have been allocated from the
+       provided *table space.  It is checked for LENS and DIST tables against
+       the constants ENOUGH_LENS and ENOUGH_DISTS to guard against changes in
+       the initial root table size constants.  See the comments in inftrees.h
+       for more information.
+
+       sym increments through all symbols, and the loop terminates when
+       all codes of length max, i.e. all codes, have been processed.  This
+       routine permits incomplete codes, so another loop after this one fills
+       in the rest of the decoding tables with invalid code markers.
+     */
+
+    /* set up for code type */
+    switch (type) {
+    case CODES:
+        base = extra = work;    /* dummy value--not used */
+        match = 20;
+        break;
+    case LENS:
+        base = lbase;
+        extra = lext;
+        match = 257;
+        break;
+    default:    /* DISTS */
+        base = dbase;
+        extra = dext;
+        match = 0;
+    }
+
+    /* initialize state for loop */
+    huff = 0;                   /* starting code */
+    sym = 0;                    /* starting code symbol */
+    len = min;                  /* starting code length */
+    next = *table;              /* current table to fill in */
+    curr = root;                /* current table index bits */
+    drop = 0;                   /* current bits to drop from code for index */
+    low = (unsigned)(-1);       /* trigger new sub-table when len > root */
+    used = 1U << root;          /* use root table entries */
+    mask = used - 1;            /* mask for comparing low */
+
+    /* check available table space */
+    if ((type == LENS && used > ENOUGH_LENS) ||
+        (type == DISTS && used > ENOUGH_DISTS))
+        return 1;
+
+    /* process all codes and make table entries */
+    for (;;) {
+        /* create table entry */
+        here.bits = (unsigned char)(len - drop);
+        if (work[sym] + 1U < match) {
+            here.op = (unsigned char)0;
+            here.val = work[sym];
+        }
+        else if (work[sym] >= match) {
+            here.op = (unsigned char)(extra[work[sym] - match]);
+            here.val = base[work[sym] - match];
+        }
+        else {
+            here.op = (unsigned char)(32 + 64);         /* end of block */
+            here.val = 0;
+        }
+
+        /* replicate for those indices with low len bits equal to huff */
+        incr = 1U << (len - drop);
+        fill = 1U << curr;
+        min = fill;                 /* save offset to next table */
+        do {
+            fill -= incr;
+            next[(huff >> drop) + fill] = here;
+        } while (fill != 0);
+
+        /* backwards increment the len-bit code huff */
+        incr = 1U << (len - 1);
+        while (huff & incr)
+            incr >>= 1;
+        if (incr != 0) {
+            huff &= incr - 1;
+            huff += incr;
+        }
+        else
+            huff = 0;
+
+        /* go to next symbol, update count, len */
+        sym++;
+        if (--(count[len]) == 0) {
+            if (len == max) break;
+            len = lens[work[sym]];
+        }
+
+        /* create new sub-table if needed */
+        if (len > root && (huff & mask) != low) {
+            /* if first time, transition to sub-tables */
+            if (drop == 0)
+                drop = root;
+
+            /* increment past last table */
+            next += min;            /* here min is 1 << curr */
+
+            /* determine length of next table */
+            curr = len - drop;
+            left = (int)(1 << curr);
+            while (curr + drop < max) {
+                left -= count[curr + drop];
+                if (left <= 0) break;
+                curr++;
+                left <<= 1;
+            }
+
+            /* check for enough space */
+            used += 1U << curr;
+            if ((type == LENS && used > ENOUGH_LENS) ||
+                (type == DISTS && used > ENOUGH_DISTS))
+                return 1;
+
+            /* point entry in root table to sub-table */
+            low = huff & mask;
+            (*table)[low].op = (unsigned char)curr;
+            (*table)[low].bits = (unsigned char)root;
+            (*table)[low].val = (unsigned short)(next - *table);
+        }
+    }
+
+    /* fill in remaining table entry if code is incomplete (guaranteed to have
+       at most one remaining entry, since if the code is incomplete, the
+       maximum code length that was allowed to get this far is one bit) */
+    if (huff != 0) {
+        here.op = (unsigned char)64;            /* invalid code marker */
+        here.bits = (unsigned char)(len - drop);
+        here.val = (unsigned short)0;
+        next[huff] = here;
+    }
+
+    /* set return parameters */
+    *table += used;
+    *bits = root;
+    return 0;
+}
diff --git a/deps/v8/third_party/zlib/inftrees.h b/deps/v8/third_party/zlib/inftrees.h
new file mode 100644
index 00000000000000..baa53a0b1a199c
--- /dev/null
+++ b/deps/v8/third_party/zlib/inftrees.h
@@ -0,0 +1,62 @@
+/* inftrees.h -- header to use inftrees.c
+ * Copyright (C) 1995-2005, 2010 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/* WARNING: this file should *not* be used by applications. It is
+   part of the implementation of the compression library and is
+   subject to change. Applications should only use zlib.h.
+ */
+
+/* Structure for decoding tables.  Each entry provides either the
+   information needed to do the operation requested by the code that
+   indexed that table entry, or it provides a pointer to another
+   table that indexes more bits of the code.  op indicates whether
+   the entry is a pointer to another table, a literal, a length or
+   distance, an end-of-block, or an invalid code.  For a table
+   pointer, the low four bits of op is the number of index bits of
+   that table.  For a length or distance, the low four bits of op
+   is the number of extra bits to get after the code.  bits is
+   the number of bits in this code or part of the code to drop off
+   of the bit buffer.  val is the actual byte to output in the case
+   of a literal, the base length or distance, or the offset from
+   the current table to the next table.  Each entry is four bytes. */
+typedef struct {
+    unsigned char op;           /* operation, extra bits, table bits */
+    unsigned char bits;         /* bits in this part of the code */
+    unsigned short val;         /* offset in table or code value */
+} code;
+
+/* op values as set by inflate_table():
+    00000000 - literal
+    0000tttt - table link, tttt != 0 is the number of table index bits
+    0001eeee - length or distance, eeee is the number of extra bits
+    01100000 - end of block
+    01000000 - invalid code
+ */
+
+/* Maximum size of the dynamic table.  The maximum number of code structures is
+   1444, which is the sum of 852 for literal/length codes and 592 for distance
+   codes.  These values were found by exhaustive searches using the program
+   examples/enough.c found in the zlib distribtution.  The arguments to that
+   program are the number of symbols, the initial root table size, and the
+   maximum bit length of a code.  "enough 286 9 15" for literal/length codes
+   returns returns 852, and "enough 30 6 15" for distance codes returns 592.
+   The initial root table size (9 or 6) is found in the fifth argument of the
+   inflate_table() calls in inflate.c and infback.c.  If the root table size is
+   changed, then these maximum sizes would be need to be recalculated and
+   updated. */
+#define ENOUGH_LENS 852
+#define ENOUGH_DISTS 592
+#define ENOUGH (ENOUGH_LENS+ENOUGH_DISTS)
+
+/* Type of code to build for inflate_table() */
+typedef enum {
+    CODES,
+    LENS,
+    DISTS
+} codetype;
+
+int ZLIB_INTERNAL inflate_table OF((codetype type, unsigned short FAR *lens,
+                             unsigned codes, code FAR * FAR *table,
+                             unsigned FAR *bits, unsigned short FAR *work));
diff --git a/deps/v8/third_party/zlib/patches/0000-build.patch b/deps/v8/third_party/zlib/patches/0000-build.patch
new file mode 100644
index 00000000000000..1e005375f5fb7b
--- /dev/null
+++ b/deps/v8/third_party/zlib/patches/0000-build.patch
@@ -0,0 +1,247 @@
+diff --git a/contrib/minizip/ioapi.h b/contrib/minizip/ioapi.h
+index 8dcbdb06e35a..c1b7a54847f5 100644
+--- a/contrib/minizip/ioapi.h
++++ b/contrib/minizip/ioapi.h
+@@ -43,7 +43,7 @@
+
+ #include <stdio.h>
+ #include <stdlib.h>
+-#include "zlib.h"
++#include "third_party/zlib/zlib.h"
+
+ #if defined(USE_FILE32API)
+ #define fopen64 fopen
+diff --git a/contrib/minizip/iowin32.c b/contrib/minizip/iowin32.c
+index 274f39eb1dd2..246ceb91a139 100644
+--- a/contrib/minizip/iowin32.c
++++ b/contrib/minizip/iowin32.c
+@@ -26,12 +26,19 @@
+ #endif
+
+
++#ifdef _WIN32_WINNT
++#undef _WIN32_WINNT
++#define _WIN32_WINNT 0x601
++#endif
++
++#if _WIN32_WINNT >= _WIN32_WINNT_WIN8
+ // see Include/shared/winapifamily.h in the Windows Kit
+ #if defined(WINAPI_FAMILY_PARTITION) && (!(defined(IOWIN32_USING_WINRT_API)))
+ #if WINAPI_FAMILY_ONE_PARTITION(WINAPI_FAMILY, WINAPI_PARTITION_APP)
+ #define IOWIN32_USING_WINRT_API 1
+ #endif
+ #endif
++#endif
+
+ voidpf  ZCALLBACK win32_open_file_func  OF((voidpf opaque, const char* filename, int mode));
+ uLong   ZCALLBACK win32_read_file_func  OF((voidpf opaque, voidpf stream, void* buf, uLong size));
+diff --git a/contrib/minizip/mztools.c b/contrib/minizip/mztools.c
+index 96891c2e0b71..8bf9cca32633 100644
+--- a/contrib/minizip/mztools.c
++++ b/contrib/minizip/mztools.c
+@@ -8,7 +8,7 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+-#include "zlib.h"
++#include "third_party/zlib/zlib.h"
+ #include "unzip.h"
+
+ #define READ_8(adr)  ((unsigned char)*(adr))
+diff --git a/contrib/minizip/mztools.h b/contrib/minizip/mztools.h
+index a49a426ec2fc..f295ffeda6af 100644
+--- a/contrib/minizip/mztools.h
++++ b/contrib/minizip/mztools.h
+@@ -12,7 +12,7 @@ extern "C" {
+ #endif
+
+ #ifndef _ZLIB_H
+-#include "zlib.h"
++#include "third_party/zlib/zlib.h"
+ #endif
+
+ #include "unzip.h"
+diff --git a/contrib/minizip/unzip.c b/contrib/minizip/unzip.c
+index bcfb9416ec35..199b4723fcfc 100644
+--- a/contrib/minizip/unzip.c
++++ b/contrib/minizip/unzip.c
+@@ -72,7 +72,7 @@
+         #define NOUNCRYPT
+ #endif
+
+-#include "zlib.h"
++#include "third_party/zlib/zlib.h"
+ #include "unzip.h"
+
+ #ifdef STDC
+@@ -1705,11 +1705,6 @@ extern int ZEXPORT unzReadCurrentFile  (unzFile file, voidp buf, unsigned len)
+
+     pfile_in_zip_read_info->stream.avail_out = (uInt)len;
+
+-    if ((len>pfile_in_zip_read_info->rest_read_uncompressed) &&
+-        (!(pfile_in_zip_read_info->raw)))
+-        pfile_in_zip_read_info->stream.avail_out =
+-            (uInt)pfile_in_zip_read_info->rest_read_uncompressed;
+-
+     if ((len>pfile_in_zip_read_info->rest_read_compressed+
+            pfile_in_zip_read_info->stream.avail_in) &&
+          (pfile_in_zip_read_info->raw))
+diff --git a/contrib/minizip/unzip.h b/contrib/minizip/unzip.h
+index 2104e3915074..3c0143529b91 100644
+--- a/contrib/minizip/unzip.h
++++ b/contrib/minizip/unzip.h
+@@ -48,7 +48,7 @@ extern "C" {
+ #endif
+
+ #ifndef _ZLIB_H
+-#include "zlib.h"
++#include "third_party/zlib/zlib.h"
+ #endif
+
+ #ifndef  _ZLIBIOAPI_H
+diff --git a/contrib/minizip/zip.c b/contrib/minizip/zip.c
+index 44e88a9cb989..65c0c7251843 100644
+--- a/contrib/minizip/zip.c
++++ b/contrib/minizip/zip.c
+@@ -26,7 +26,7 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <time.h>
+-#include "zlib.h"
++#include "third_party/zlib/zlib.h"
+ #include "zip.h"
+
+ #ifdef STDC
+diff --git a/contrib/minizip/zip.h b/contrib/minizip/zip.h
+index 8aaebb623430..8c06c0aa7bb0 100644
+--- a/contrib/minizip/zip.h
++++ b/contrib/minizip/zip.h
+@@ -47,7 +47,7 @@ extern "C" {
+ //#define HAVE_BZIP2
+
+ #ifndef _ZLIB_H
+-#include "zlib.h"
++#include "third_party/zlib/zlib.h"
+ #endif
+
+ #ifndef _ZLIBIOAPI_H
+diff --git a/gzread.c b/gzread.c
+index 956b91ea7d9e..832d3ef98c59 100644
+--- a/gzread.c
++++ b/gzread.c
+@@ -443,7 +443,11 @@ z_size_t ZEXPORT gzfread(buf, size, nitems, file)
+ #  undef z_gzgetc
+ #else
+ #  undef gzgetc
++#  ifdef Z_CR_PREFIX_SET
++#    define gzgetc Cr_z_gzgetc
++#  endif
+ #endif
++
+ int ZEXPORT gzgetc(file)
+     gzFile file;
+ {
+diff --git a/zconf.h b/zconf.h
+index 5e1d68a004e9..a7a815f575a7 100644
+--- a/zconf.h
++++ b/zconf.h
+@@ -8,6 +8,10 @@
+ #ifndef ZCONF_H
+ #define ZCONF_H
+
++/*
++ * This library is also built as a part of AOSP, which does not need to include
++ * chromeconf.h. This config does not want chromeconf.h, so it can set this
++ * macro to opt out. While this works today, there's no guarantee that building
++ * zlib outside of Chromium keeps working in the future.
++ */
++#if !defined(CHROMIUM_ZLIB_NO_CHROMECONF)
++/* This include does prefixing as below, but with an updated set of names.  Also
++ * sets up export macros in component builds. */
++#include "chromeconf.h"
++#endif
++
+ /*
+  * If you *really* need a unique prefix for all types and library functions,
+  * compile with -DZ_PREFIX. The "standard" zlib should be compiled without it.
+@@ -431,7 +434,7 @@ typedef uLong FAR uLongf;
+    typedef unsigned long z_crc_t;
+ #endif
+
+-#ifdef HAVE_UNISTD_H    /* may be set to #if 1 by ./configure */
++#if !defined(_WIN32)
+ #  define Z_HAVE_UNISTD_H
+ #endif
+
+diff --git a/zlib.h b/zlib.h
+index f09cdaf1e054..99fd467f6b1a 100644
+--- a/zlib.h
++++ b/zlib.h
+@@ -1824,6 +1824,11 @@ ZEXTERN int ZEXPORT gzgetc_ OF((gzFile file));  /* backward compatibility */
+ #  undef z_gzgetc
+ #  define z_gzgetc(g) \
+           ((g)->have ? ((g)->have--, (g)->pos++, *((g)->next)++) : (gzgetc)(g))
++#elif defined(Z_CR_PREFIX_SET)
++#    undef gzgetc
++#    define gzgetc(g) \
++          ((g)->have ? ((g)->have--, (g)->pos++, *((g)->next)++) \
++                     : (Cr_z_gzgetc)(g))
+ #else
+ #  define gzgetc(g) \
+           ((g)->have ? ((g)->have--, (g)->pos++, *((g)->next)++) : (gzgetc)(g))
+@@ -1853,11 +1858,29 @@ ZEXTERN int ZEXPORT gzgetc_ OF((gzFile file));  /* backward compatibility */
+ #    define z_adler32_combine z_adler32_combine64
+ #    define z_crc32_combine z_crc32_combine64
+ #  else
++#    ifdef gzopen
++#      undef gzopen
++#    endif
+ #    define gzopen gzopen64
++#    ifdef gzseek
++#      undef gzseek
++#    endif
+ #    define gzseek gzseek64
++#    ifdef gztell
++#      undef gztell
++#    endif
+ #    define gztell gztell64
++#    ifdef gzoffset
++#      undef gzoffset
++#    endif
+ #    define gzoffset gzoffset64
++#    ifdef adler32_combine
++#      undef adler32_combine
++#    endif
+ #    define adler32_combine adler32_combine64
++#    ifdef crc32_combine
++#      undef crc32_combine
++#    endif
+ #    define crc32_combine crc32_combine64
+ #  endif
+ #  ifndef Z_LARGE64
+diff --git a/zutil.h b/zutil.h
+index b079ea6a80f5..80375b8b6109 100644
+--- a/zutil.h
++++ b/zutil.h
+@@ -28,6 +28,21 @@
+ #  include <string.h>
+ #  include <stdlib.h>
+ #endif
++#ifdef NO_ERRNO_H
++#   ifdef _WIN32_WCE
++      /* The Microsoft C Run-Time Library for Windows CE doesn't have
++       * errno.  We define it as a global variable to simplify porting.
++       * Its value is always 0 and should not be used.  We rename it to
++       * avoid conflict with other libraries that use the same workaround.
++       */
++#     define errno z_errno
++#   endif
++    extern int errno;
++#else
++#  ifndef _WIN32_WCE
++#    include <errno.h>
++#  endif
++#endif
+
+ #ifdef Z_SOLO
+    typedef long ptrdiff_t;  /* guess -- will be caught if guess is wrong */
diff --git a/deps/v8/third_party/zlib/patches/0001-simd.patch b/deps/v8/third_party/zlib/patches/0001-simd.patch
new file mode 100644
index 00000000000000..5e88c46bb8776b
--- /dev/null
+++ b/deps/v8/third_party/zlib/patches/0001-simd.patch
@@ -0,0 +1,1214 @@
+diff --git a/crc32.c b/crc32.c
+index 9580440c0e6b..9162429cc7b4 100644
+--- a/crc32.c
++++ b/crc32.c
+@@ -28,6 +28,8 @@
+ #  endif /* !DYNAMIC_CRC_TABLE */
+ #endif /* MAKECRCH */
+
++#include "deflate.h"
++#include "x86.h"
+ #include "zutil.h"      /* for STDC and FAR definitions */
+
+ /* Definitions for doing the crc four data bytes at a time. */
+@@ -440,3 +442,28 @@ uLong ZEXPORT crc32_combine64(crc1, crc2, len2)
+ {
+     return crc32_combine_(crc1, crc2, len2);
+ }
++
++ZLIB_INTERNAL void crc_reset(deflate_state *const s)
++{
++    if (x86_cpu_enable_simd) {
++        crc_fold_init(s);
++        return;
++    }
++    s->strm->adler = crc32(0L, Z_NULL, 0);
++}
++
++ZLIB_INTERNAL void crc_finalize(deflate_state *const s)
++{
++    if (x86_cpu_enable_simd)
++        s->strm->adler = crc_fold_512to32(s);
++}
++
++ZLIB_INTERNAL void copy_with_crc(z_streamp strm, Bytef *dst, long size)
++{
++    if (x86_cpu_enable_simd) {
++        crc_fold_copy(strm->state, dst, strm->next_in, size);
++        return;
++    }
++    zmemcpy(dst, strm->next_in, size);
++    strm->adler = crc32(strm->adler, dst, size);
++}
+diff --git a/crc_folding.c b/crc_folding.c
+new file mode 100644
+index 000000000000..48d77744aaf4
+--- /dev/null
++++ b/crc_folding.c
+@@ -0,0 +1,493 @@
++/*
++ * Compute the CRC32 using a parallelized folding approach with the PCLMULQDQ
++ * instruction.
++ *
++ * A white paper describing this algorithm can be found at:
++ * http://www.intel.com/content/dam/www/public/us/en/documents/white-papers/fast-crc-computation-generic-polynomials-pclmulqdq-paper.pdf
++ *
++ * Copyright (C) 2013 Intel Corporation. All rights reserved.
++ * Authors:
++ * 	Wajdi Feghali   <wajdi.k.feghali@intel.com>
++ * 	Jim Guilford    <james.guilford@intel.com>
++ * 	Vinodh Gopal    <vinodh.gopal@intel.com>
++ * 	Erdinc Ozturk   <erdinc.ozturk@intel.com>
++ * 	Jim Kukunas     <james.t.kukunas@linux.intel.com>
++ *
++ * For conditions of distribution and use, see copyright notice in zlib.h
++ */
++
++#include "deflate.h"
++
++#include <inttypes.h>
++#include <emmintrin.h>
++#include <immintrin.h>
++#include <wmmintrin.h>
++
++#define CRC_LOAD(s) \
++    do { \
++        __m128i xmm_crc0 = _mm_loadu_si128((__m128i *)s->crc0 + 0);\
++        __m128i xmm_crc1 = _mm_loadu_si128((__m128i *)s->crc0 + 1);\
++        __m128i xmm_crc2 = _mm_loadu_si128((__m128i *)s->crc0 + 2);\
++        __m128i xmm_crc3 = _mm_loadu_si128((__m128i *)s->crc0 + 3);\
++        __m128i xmm_crc_part = _mm_loadu_si128((__m128i *)s->crc0 + 4);
++
++#define CRC_SAVE(s) \
++        _mm_storeu_si128((__m128i *)s->crc0 + 0, xmm_crc0);\
++        _mm_storeu_si128((__m128i *)s->crc0 + 1, xmm_crc1);\
++        _mm_storeu_si128((__m128i *)s->crc0 + 2, xmm_crc2);\
++        _mm_storeu_si128((__m128i *)s->crc0 + 3, xmm_crc3);\
++        _mm_storeu_si128((__m128i *)s->crc0 + 4, xmm_crc_part);\
++    } while (0);
++
++ZLIB_INTERNAL void crc_fold_init(deflate_state *const s)
++{
++    CRC_LOAD(s)
++
++    xmm_crc0 = _mm_cvtsi32_si128(0x9db42487);
++    xmm_crc1 = _mm_setzero_si128();
++    xmm_crc2 = _mm_setzero_si128();
++    xmm_crc3 = _mm_setzero_si128();
++
++    CRC_SAVE(s)
++
++    s->strm->adler = 0;
++}
++
++local void fold_1(deflate_state *const s,
++        __m128i *xmm_crc0, __m128i *xmm_crc1,
++        __m128i *xmm_crc2, __m128i *xmm_crc3)
++{
++    const __m128i xmm_fold4 = _mm_set_epi32(
++            0x00000001, 0x54442bd4,
++            0x00000001, 0xc6e41596);
++
++    __m128i x_tmp3;
++    __m128 ps_crc0, ps_crc3, ps_res;
++
++    x_tmp3 = *xmm_crc3;
++
++    *xmm_crc3 = *xmm_crc0;
++    *xmm_crc0 = _mm_clmulepi64_si128(*xmm_crc0, xmm_fold4, 0x01);
++    *xmm_crc3 = _mm_clmulepi64_si128(*xmm_crc3, xmm_fold4, 0x10);
++    ps_crc0 = _mm_castsi128_ps(*xmm_crc0);
++    ps_crc3 = _mm_castsi128_ps(*xmm_crc3);
++    ps_res = _mm_xor_ps(ps_crc0, ps_crc3);
++
++    *xmm_crc0 = *xmm_crc1;
++    *xmm_crc1 = *xmm_crc2;
++    *xmm_crc2 = x_tmp3;
++    *xmm_crc3 = _mm_castps_si128(ps_res);
++}
++
++local void fold_2(deflate_state *const s,
++        __m128i *xmm_crc0, __m128i *xmm_crc1,
++        __m128i *xmm_crc2, __m128i *xmm_crc3)
++{
++    const __m128i xmm_fold4 = _mm_set_epi32(
++            0x00000001, 0x54442bd4,
++            0x00000001, 0xc6e41596);
++
++    __m128i x_tmp3, x_tmp2;
++    __m128 ps_crc0, ps_crc1, ps_crc2, ps_crc3, ps_res31, ps_res20;
++
++    x_tmp3 = *xmm_crc3;
++    x_tmp2 = *xmm_crc2;
++
++    *xmm_crc3 = *xmm_crc1;
++    *xmm_crc1 = _mm_clmulepi64_si128(*xmm_crc1, xmm_fold4, 0x01);
++    *xmm_crc3 = _mm_clmulepi64_si128(*xmm_crc3, xmm_fold4, 0x10);
++    ps_crc3 = _mm_castsi128_ps(*xmm_crc3);
++    ps_crc1 = _mm_castsi128_ps(*xmm_crc1);
++    ps_res31= _mm_xor_ps(ps_crc3, ps_crc1);
++
++    *xmm_crc2 = *xmm_crc0;
++    *xmm_crc0 = _mm_clmulepi64_si128(*xmm_crc0, xmm_fold4, 0x01);
++    *xmm_crc2 = _mm_clmulepi64_si128(*xmm_crc2, xmm_fold4, 0x10);
++    ps_crc0 = _mm_castsi128_ps(*xmm_crc0);
++    ps_crc2 = _mm_castsi128_ps(*xmm_crc2);
++    ps_res20= _mm_xor_ps(ps_crc0, ps_crc2);
++
++    *xmm_crc0 = x_tmp2;
++    *xmm_crc1 = x_tmp3;
++    *xmm_crc2 = _mm_castps_si128(ps_res20);
++    *xmm_crc3 = _mm_castps_si128(ps_res31);
++}
++
++local void fold_3(deflate_state *const s,
++        __m128i *xmm_crc0, __m128i *xmm_crc1,
++        __m128i *xmm_crc2, __m128i *xmm_crc3)
++{
++    const __m128i xmm_fold4 = _mm_set_epi32(
++            0x00000001, 0x54442bd4,
++            0x00000001, 0xc6e41596);
++
++    __m128i x_tmp3;
++    __m128 ps_crc0, ps_crc1, ps_crc2, ps_crc3, ps_res32, ps_res21, ps_res10;
++
++    x_tmp3 = *xmm_crc3;
++
++    *xmm_crc3 = *xmm_crc2;
++    *xmm_crc2 = _mm_clmulepi64_si128(*xmm_crc2, xmm_fold4, 0x01);
++    *xmm_crc3 = _mm_clmulepi64_si128(*xmm_crc3, xmm_fold4, 0x10);
++    ps_crc2 = _mm_castsi128_ps(*xmm_crc2);
++    ps_crc3 = _mm_castsi128_ps(*xmm_crc3);
++    ps_res32 = _mm_xor_ps(ps_crc2, ps_crc3);
++
++    *xmm_crc2 = *xmm_crc1;
++    *xmm_crc1 = _mm_clmulepi64_si128(*xmm_crc1, xmm_fold4, 0x01);
++    *xmm_crc2 = _mm_clmulepi64_si128(*xmm_crc2, xmm_fold4, 0x10);
++    ps_crc1 = _mm_castsi128_ps(*xmm_crc1);
++    ps_crc2 = _mm_castsi128_ps(*xmm_crc2);
++    ps_res21= _mm_xor_ps(ps_crc1, ps_crc2);
++
++    *xmm_crc1 = *xmm_crc0;
++    *xmm_crc0 = _mm_clmulepi64_si128(*xmm_crc0, xmm_fold4, 0x01);
++    *xmm_crc1 = _mm_clmulepi64_si128(*xmm_crc1, xmm_fold4, 0x10);
++    ps_crc0 = _mm_castsi128_ps(*xmm_crc0);
++    ps_crc1 = _mm_castsi128_ps(*xmm_crc1);
++    ps_res10= _mm_xor_ps(ps_crc0, ps_crc1);
++
++    *xmm_crc0 = x_tmp3;
++    *xmm_crc1 = _mm_castps_si128(ps_res10);
++    *xmm_crc2 = _mm_castps_si128(ps_res21);
++    *xmm_crc3 = _mm_castps_si128(ps_res32);
++}
++
++local void fold_4(deflate_state *const s,
++        __m128i *xmm_crc0, __m128i *xmm_crc1,
++        __m128i *xmm_crc2, __m128i *xmm_crc3)
++{
++    const __m128i xmm_fold4 = _mm_set_epi32(
++            0x00000001, 0x54442bd4,
++            0x00000001, 0xc6e41596);
++
++    __m128i x_tmp0, x_tmp1, x_tmp2, x_tmp3;
++    __m128 ps_crc0, ps_crc1, ps_crc2, ps_crc3;
++    __m128 ps_t0, ps_t1, ps_t2, ps_t3;
++    __m128 ps_res0, ps_res1, ps_res2, ps_res3;
++
++    x_tmp0 = *xmm_crc0;
++    x_tmp1 = *xmm_crc1;
++    x_tmp2 = *xmm_crc2;
++    x_tmp3 = *xmm_crc3;
++
++    *xmm_crc0 = _mm_clmulepi64_si128(*xmm_crc0, xmm_fold4, 0x01);
++    x_tmp0 = _mm_clmulepi64_si128(x_tmp0, xmm_fold4, 0x10);
++    ps_crc0 = _mm_castsi128_ps(*xmm_crc0);
++    ps_t0 = _mm_castsi128_ps(x_tmp0);
++    ps_res0 = _mm_xor_ps(ps_crc0, ps_t0);
++
++    *xmm_crc1 = _mm_clmulepi64_si128(*xmm_crc1, xmm_fold4, 0x01);
++    x_tmp1 = _mm_clmulepi64_si128(x_tmp1, xmm_fold4, 0x10);
++    ps_crc1 = _mm_castsi128_ps(*xmm_crc1);
++    ps_t1 = _mm_castsi128_ps(x_tmp1);
++    ps_res1 = _mm_xor_ps(ps_crc1, ps_t1);
++
++    *xmm_crc2 = _mm_clmulepi64_si128(*xmm_crc2, xmm_fold4, 0x01);
++    x_tmp2 = _mm_clmulepi64_si128(x_tmp2, xmm_fold4, 0x10);
++    ps_crc2 = _mm_castsi128_ps(*xmm_crc2);
++    ps_t2 = _mm_castsi128_ps(x_tmp2);
++    ps_res2 = _mm_xor_ps(ps_crc2, ps_t2);
++
++    *xmm_crc3 = _mm_clmulepi64_si128(*xmm_crc3, xmm_fold4, 0x01);
++    x_tmp3 = _mm_clmulepi64_si128(x_tmp3, xmm_fold4, 0x10);
++    ps_crc3 = _mm_castsi128_ps(*xmm_crc3);
++    ps_t3 = _mm_castsi128_ps(x_tmp3);
++    ps_res3 = _mm_xor_ps(ps_crc3, ps_t3);
++
++    *xmm_crc0 = _mm_castps_si128(ps_res0);
++    *xmm_crc1 = _mm_castps_si128(ps_res1);
++    *xmm_crc2 = _mm_castps_si128(ps_res2);
++    *xmm_crc3 = _mm_castps_si128(ps_res3);
++}
++
++local const unsigned zalign(32) pshufb_shf_table[60] = {
++	0x84838281,0x88878685,0x8c8b8a89,0x008f8e8d, /* shl 15 (16 - 1)/shr1 */
++	0x85848382,0x89888786,0x8d8c8b8a,0x01008f8e, /* shl 14 (16 - 3)/shr2 */
++	0x86858483,0x8a898887,0x8e8d8c8b,0x0201008f, /* shl 13 (16 - 4)/shr3 */
++	0x87868584,0x8b8a8988,0x8f8e8d8c,0x03020100, /* shl 12 (16 - 4)/shr4 */
++	0x88878685,0x8c8b8a89,0x008f8e8d,0x04030201, /* shl 11 (16 - 5)/shr5 */
++	0x89888786,0x8d8c8b8a,0x01008f8e,0x05040302, /* shl 10 (16 - 6)/shr6 */
++	0x8a898887,0x8e8d8c8b,0x0201008f,0x06050403, /* shl  9 (16 - 7)/shr7 */
++	0x8b8a8988,0x8f8e8d8c,0x03020100,0x07060504, /* shl  8 (16 - 8)/shr8 */
++	0x8c8b8a89,0x008f8e8d,0x04030201,0x08070605, /* shl  7 (16 - 9)/shr9 */
++	0x8d8c8b8a,0x01008f8e,0x05040302,0x09080706, /* shl  6 (16 -10)/shr10*/
++	0x8e8d8c8b,0x0201008f,0x06050403,0x0a090807, /* shl  5 (16 -11)/shr11*/
++	0x8f8e8d8c,0x03020100,0x07060504,0x0b0a0908, /* shl  4 (16 -12)/shr12*/
++	0x008f8e8d,0x04030201,0x08070605,0x0c0b0a09, /* shl  3 (16 -13)/shr13*/
++	0x01008f8e,0x05040302,0x09080706,0x0d0c0b0a, /* shl  2 (16 -14)/shr14*/
++	0x0201008f,0x06050403,0x0a090807,0x0e0d0c0b  /* shl  1 (16 -15)/shr15*/
++};
++
++local void partial_fold(deflate_state *const s, const size_t len,
++        __m128i *xmm_crc0, __m128i *xmm_crc1,
++        __m128i *xmm_crc2, __m128i *xmm_crc3,
++        __m128i *xmm_crc_part)
++{
++
++    const __m128i xmm_fold4 = _mm_set_epi32(
++            0x00000001, 0x54442bd4,
++            0x00000001, 0xc6e41596);
++    const __m128i xmm_mask3 = _mm_set1_epi32(0x80808080);
++
++    __m128i xmm_shl, xmm_shr, xmm_tmp1, xmm_tmp2, xmm_tmp3;
++    __m128i xmm_a0_0, xmm_a0_1;
++    __m128 ps_crc3, psa0_0, psa0_1, ps_res;
++
++    xmm_shl = _mm_load_si128((__m128i *)pshufb_shf_table + (len - 1));
++    xmm_shr = xmm_shl;
++    xmm_shr = _mm_xor_si128(xmm_shr, xmm_mask3);
++
++    xmm_a0_0 = _mm_shuffle_epi8(*xmm_crc0, xmm_shl);
++
++    *xmm_crc0 = _mm_shuffle_epi8(*xmm_crc0, xmm_shr);
++    xmm_tmp1 = _mm_shuffle_epi8(*xmm_crc1, xmm_shl);
++    *xmm_crc0 = _mm_or_si128(*xmm_crc0, xmm_tmp1);
++
++    *xmm_crc1 = _mm_shuffle_epi8(*xmm_crc1, xmm_shr);
++    xmm_tmp2 = _mm_shuffle_epi8(*xmm_crc2, xmm_shl);
++    *xmm_crc1 = _mm_or_si128(*xmm_crc1, xmm_tmp2);
++
++    *xmm_crc2 = _mm_shuffle_epi8(*xmm_crc2, xmm_shr);
++    xmm_tmp3 = _mm_shuffle_epi8(*xmm_crc3, xmm_shl);
++    *xmm_crc2 = _mm_or_si128(*xmm_crc2, xmm_tmp3);
++
++    *xmm_crc3 = _mm_shuffle_epi8(*xmm_crc3, xmm_shr);
++    *xmm_crc_part = _mm_shuffle_epi8(*xmm_crc_part, xmm_shl);
++    *xmm_crc3 = _mm_or_si128(*xmm_crc3, *xmm_crc_part);
++
++    xmm_a0_1 = _mm_clmulepi64_si128(xmm_a0_0, xmm_fold4, 0x10);
++    xmm_a0_0 = _mm_clmulepi64_si128(xmm_a0_0, xmm_fold4, 0x01);
++
++    ps_crc3 = _mm_castsi128_ps(*xmm_crc3);
++    psa0_0 = _mm_castsi128_ps(xmm_a0_0);
++    psa0_1 = _mm_castsi128_ps(xmm_a0_1);
++
++    ps_res = _mm_xor_ps(ps_crc3, psa0_0);
++    ps_res = _mm_xor_ps(ps_res, psa0_1);
++
++    *xmm_crc3 = _mm_castps_si128(ps_res);
++}
++
++ZLIB_INTERNAL void crc_fold_copy(deflate_state *const s,
++        unsigned char *dst, const unsigned char *src, long len)
++{
++    unsigned long algn_diff;
++    __m128i xmm_t0, xmm_t1, xmm_t2, xmm_t3;
++
++    CRC_LOAD(s)
++
++    if (len < 16) {
++        if (len == 0)
++            return;
++        goto partial;
++    }
++
++    algn_diff = 0 - (uintptr_t)src & 0xF;
++    if (algn_diff) {
++        xmm_crc_part = _mm_loadu_si128((__m128i *)src);
++        _mm_storeu_si128((__m128i *)dst, xmm_crc_part);
++
++        dst += algn_diff;
++        src += algn_diff;
++        len -= algn_diff;
++
++        partial_fold(s, algn_diff, &xmm_crc0, &xmm_crc1, &xmm_crc2, &xmm_crc3,
++            &xmm_crc_part);
++    }
++
++    while ((len -= 64) >= 0) {
++        xmm_t0 = _mm_load_si128((__m128i *)src);
++        xmm_t1 = _mm_load_si128((__m128i *)src + 1);
++        xmm_t2 = _mm_load_si128((__m128i *)src + 2);
++        xmm_t3 = _mm_load_si128((__m128i *)src + 3);
++
++        fold_4(s, &xmm_crc0, &xmm_crc1, &xmm_crc2, &xmm_crc3);
++
++        _mm_storeu_si128((__m128i *)dst, xmm_t0);
++        _mm_storeu_si128((__m128i *)dst + 1, xmm_t1);
++        _mm_storeu_si128((__m128i *)dst + 2, xmm_t2);
++        _mm_storeu_si128((__m128i *)dst + 3, xmm_t3);
++
++        xmm_crc0 = _mm_xor_si128(xmm_crc0, xmm_t0);
++        xmm_crc1 = _mm_xor_si128(xmm_crc1, xmm_t1);
++        xmm_crc2 = _mm_xor_si128(xmm_crc2, xmm_t2);
++        xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_t3);
++
++        src += 64;
++        dst += 64;
++    }
++
++    /*
++     * len = num bytes left - 64
++     */
++    if (len + 16 >= 0) {
++        len += 16;
++
++        xmm_t0 = _mm_load_si128((__m128i *)src);
++        xmm_t1 = _mm_load_si128((__m128i *)src + 1);
++        xmm_t2 = _mm_load_si128((__m128i *)src + 2);
++
++        fold_3(s, &xmm_crc0, &xmm_crc1, &xmm_crc2, &xmm_crc3);
++
++        _mm_storeu_si128((__m128i *)dst, xmm_t0);
++        _mm_storeu_si128((__m128i *)dst + 1, xmm_t1);
++        _mm_storeu_si128((__m128i *)dst + 2, xmm_t2);
++
++        xmm_crc1 = _mm_xor_si128(xmm_crc1, xmm_t0);
++        xmm_crc2 = _mm_xor_si128(xmm_crc2, xmm_t1);
++        xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_t2);
++
++        if (len == 0)
++            goto done;
++
++        dst += 48;
++        src += 48;
++    } else if (len + 32 >= 0) {
++        len += 32;
++
++        xmm_t0 = _mm_load_si128((__m128i *)src);
++        xmm_t1 = _mm_load_si128((__m128i *)src + 1);
++
++        fold_2(s, &xmm_crc0, &xmm_crc1, &xmm_crc2, &xmm_crc3);
++
++        _mm_storeu_si128((__m128i *)dst, xmm_t0);
++        _mm_storeu_si128((__m128i *)dst + 1, xmm_t1);
++
++        xmm_crc2 = _mm_xor_si128(xmm_crc2, xmm_t0);
++        xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_t1);
++
++        if (len == 0)
++            goto done;
++
++        dst += 32;
++        src += 32;
++    } else if (len + 48 >= 0) {
++        len += 48;
++
++        xmm_t0 = _mm_load_si128((__m128i *)src);
++
++        fold_1(s, &xmm_crc0, &xmm_crc1, &xmm_crc2, &xmm_crc3);
++
++        _mm_storeu_si128((__m128i *)dst, xmm_t0);
++
++        xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_t0);
++
++        if (len == 0)
++            goto done;
++
++        dst += 16;
++        src += 16;
++    } else {
++        len += 64;
++        if (len == 0)
++            goto done;
++    }
++
++partial:
++
++#if defined(_MSC_VER)
++    /* VS does not permit the use of _mm_set_epi64x in 32-bit builds */
++    {
++        int32_t parts[4] = {0, 0, 0, 0};
++        memcpy(&parts, src, len);
++        xmm_crc_part = _mm_set_epi32(parts[3], parts[2], parts[1], parts[0]);
++    }
++#else
++    {
++        int64_t parts[2] = {0, 0};
++        memcpy(&parts, src, len);
++        xmm_crc_part = _mm_set_epi64x(parts[1], parts[0]);
++    }
++#endif
++
++    _mm_storeu_si128((__m128i *)dst, xmm_crc_part);
++    partial_fold(s, len, &xmm_crc0, &xmm_crc1, &xmm_crc2, &xmm_crc3,
++        &xmm_crc_part);
++done:
++    CRC_SAVE(s)
++}
++
++local const unsigned zalign(16) crc_k[] = {
++    0xccaa009e, 0x00000000, /* rk1 */
++    0x751997d0, 0x00000001, /* rk2 */
++    0xccaa009e, 0x00000000, /* rk5 */
++    0x63cd6124, 0x00000001, /* rk6 */
++    0xf7011640, 0x00000001, /* rk7 */
++    0xdb710640, 0x00000001  /* rk8 */
++};
++
++local const unsigned zalign(16) crc_mask[4] = {
++    0xFFFFFFFF, 0xFFFFFFFF, 0x00000000, 0x00000000
++};
++
++local const unsigned zalign(16) crc_mask2[4] = {
++    0x00000000, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF
++};
++
++unsigned ZLIB_INTERNAL crc_fold_512to32(deflate_state *const s)
++{
++    const __m128i xmm_mask  = _mm_load_si128((__m128i *)crc_mask);
++    const __m128i xmm_mask2 = _mm_load_si128((__m128i *)crc_mask2);
++
++    unsigned crc;
++    __m128i x_tmp0, x_tmp1, x_tmp2, crc_fold;
++
++    CRC_LOAD(s)
++
++    /*
++     * k1
++     */
++    crc_fold = _mm_load_si128((__m128i *)crc_k);
++
++    x_tmp0 = _mm_clmulepi64_si128(xmm_crc0, crc_fold, 0x10);
++    xmm_crc0 = _mm_clmulepi64_si128(xmm_crc0, crc_fold, 0x01);
++    xmm_crc1 = _mm_xor_si128(xmm_crc1, x_tmp0);
++    xmm_crc1 = _mm_xor_si128(xmm_crc1, xmm_crc0);
++
++    x_tmp1 = _mm_clmulepi64_si128(xmm_crc1, crc_fold, 0x10);
++    xmm_crc1 = _mm_clmulepi64_si128(xmm_crc1, crc_fold, 0x01);
++    xmm_crc2 = _mm_xor_si128(xmm_crc2, x_tmp1);
++    xmm_crc2 = _mm_xor_si128(xmm_crc2, xmm_crc1);
++
++    x_tmp2 = _mm_clmulepi64_si128(xmm_crc2, crc_fold, 0x10);
++    xmm_crc2 = _mm_clmulepi64_si128(xmm_crc2, crc_fold, 0x01);
++    xmm_crc3 = _mm_xor_si128(xmm_crc3, x_tmp2);
++    xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_crc2);
++
++    /*
++     * k5
++     */
++    crc_fold = _mm_load_si128((__m128i *)crc_k + 1);
++
++    xmm_crc0 = xmm_crc3;
++    xmm_crc3 = _mm_clmulepi64_si128(xmm_crc3, crc_fold, 0);
++    xmm_crc0 = _mm_srli_si128(xmm_crc0, 8);
++    xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_crc0);
++
++    xmm_crc0 = xmm_crc3;
++    xmm_crc3 = _mm_slli_si128(xmm_crc3, 4);
++    xmm_crc3 = _mm_clmulepi64_si128(xmm_crc3, crc_fold, 0x10);
++    xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_crc0);
++    xmm_crc3 = _mm_and_si128(xmm_crc3, xmm_mask2);
++
++    /*
++     * k7
++     */
++    xmm_crc1 = xmm_crc3;
++    xmm_crc2 = xmm_crc3;
++    crc_fold = _mm_load_si128((__m128i *)crc_k + 2);
++
++    xmm_crc3 = _mm_clmulepi64_si128(xmm_crc3, crc_fold, 0);
++    xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_crc2);
++    xmm_crc3 = _mm_and_si128(xmm_crc3, xmm_mask);
++
++    xmm_crc2 = xmm_crc3;
++    xmm_crc3 = _mm_clmulepi64_si128(xmm_crc3, crc_fold, 0x10);
++    xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_crc2);
++    xmm_crc3 = _mm_xor_si128(xmm_crc3, xmm_crc1);
++
++    crc = _mm_extract_epi32(xmm_crc3, 2);
++    return ~crc;
++    CRC_SAVE(s)
++}
+diff --git a/deflate.c b/deflate.c
+index 1ec761448de9..aa0c9c67a6dc 100644
+--- a/deflate.c
++++ b/deflate.c
+@@ -48,8 +48,9 @@
+  */
+
+ /* @(#) $Id$ */
+-
++#include <assert.h>
+ #include "deflate.h"
++#include "x86.h"
+
+ const char deflate_copyright[] =
+    " deflate 1.2.11 Copyright 1995-2017 Jean-loup Gailly and Mark Adler ";
+@@ -86,7 +87,7 @@ local block_state deflate_huff   OF((deflate_state *s, int flush));
+ local void lm_init        OF((deflate_state *s));
+ local void putShortMSB    OF((deflate_state *s, uInt b));
+ local void flush_pending  OF((z_streamp strm));
+-local unsigned read_buf   OF((z_streamp strm, Bytef *buf, unsigned size));
++unsigned ZLIB_INTERNAL deflate_read_buf OF((z_streamp strm, Bytef *buf, unsigned size));
+ #ifdef ASMV
+ #  pragma message("Assembler code may have bugs -- use at your own risk")
+       void match_init OF((void)); /* asm code initialization */
+@@ -100,6 +101,20 @@ local  void check_match OF((deflate_state *s, IPos start, IPos match,
+                             int length));
+ #endif
+
++/* From crc32.c */
++extern void ZLIB_INTERNAL crc_reset(deflate_state *const s);
++extern void ZLIB_INTERNAL crc_finalize(deflate_state *const s);
++extern void ZLIB_INTERNAL copy_with_crc(z_streamp strm, Bytef *dst, long size);
++
++#ifdef _MSC_VER
++#define INLINE __inline
++#else
++#define INLINE inline
++#endif
++
++/* Inline optimisation */
++local INLINE Pos insert_string_sse(deflate_state *const s, const Pos str);
++
+ /* ===========================================================================
+  * Local data
+  */
+@@ -162,7 +177,6 @@ local const config configuration_table[10] = {
+  */
+ #define UPDATE_HASH(s,h,c) (h = (((h)<<s->hash_shift) ^ (c)) & s->hash_mask)
+
+-
+ /* ===========================================================================
+  * Insert string str in the dictionary and set match_head to the previous head
+  * of the hash chain (the most recent string with same hash key). Return
+@@ -173,17 +187,28 @@ local const config configuration_table[10] = {
+  *    characters and the first MIN_MATCH bytes of str are valid (except for
+  *    the last MIN_MATCH-1 bytes of the input file).
+  */
++local INLINE Pos insert_string_c(deflate_state *const s, const Pos str)
++{
++    Pos ret;
++
++    UPDATE_HASH(s, s->ins_h, s->window[(str) + (MIN_MATCH-1)]);
+ #ifdef FASTEST
+-#define INSERT_STRING(s, str, match_head) \
+-   (UPDATE_HASH(s, s->ins_h, s->window[(str) + (MIN_MATCH-1)]), \
+-    match_head = s->head[s->ins_h], \
+-    s->head[s->ins_h] = (Pos)(str))
++    ret = s->head[s->ins_h];
+ #else
+-#define INSERT_STRING(s, str, match_head) \
+-   (UPDATE_HASH(s, s->ins_h, s->window[(str) + (MIN_MATCH-1)]), \
+-    match_head = s->prev[(str) & s->w_mask] = s->head[s->ins_h], \
+-    s->head[s->ins_h] = (Pos)(str))
++    ret = s->prev[str & s->w_mask] = s->head[s->ins_h];
+ #endif
++    s->head[s->ins_h] = str;
++
++    return ret;
++}
++
++local INLINE Pos insert_string(deflate_state *const s, const Pos str)
++{
++    if (x86_cpu_enable_simd)
++        return insert_string_sse(s, str);
++    return insert_string_c(s, str);
++}
++
+
+ /* ===========================================================================
+  * Initialize the hash table (avoiding 64K overflow for 16 bit systems).
+@@ -248,6 +273,7 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
+     const char *version;
+     int stream_size;
+ {
++    unsigned window_padding = 8;
+     deflate_state *s;
+     int wrap = 1;
+     static const char my_version[] = ZLIB_VERSION;
+@@ -257,6 +283,8 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
+      * output size for (length,distance) codes is <= 24 bits.
+      */
+
++    x86_check_features();
++
+     if (version == Z_NULL || version[0] != my_version[0] ||
+         stream_size != sizeof(z_stream)) {
+         return Z_VERSION_ERROR;
+@@ -313,12 +341,19 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
+     s->w_size = 1 << s->w_bits;
+     s->w_mask = s->w_size - 1;
+
+-    s->hash_bits = (uInt)memLevel + 7;
++    if (x86_cpu_enable_simd) {
++        s->hash_bits = 15;
++    } else {
++        s->hash_bits = memLevel + 7;
++    }
++
+     s->hash_size = 1 << s->hash_bits;
+     s->hash_mask = s->hash_size - 1;
+     s->hash_shift =  ((s->hash_bits+MIN_MATCH-1)/MIN_MATCH);
+
+-    s->window = (Bytef *) ZALLOC(strm, s->w_size, 2*sizeof(Byte));
++    s->window = (Bytef *) ZALLOC(strm,
++                                 s->w_size + window_padding,
++                                 2*sizeof(Byte));
+     s->prev   = (Posf *)  ZALLOC(strm, s->w_size, sizeof(Pos));
+     s->head   = (Posf *)  ZALLOC(strm, s->hash_size, sizeof(Pos));
+
+@@ -418,11 +453,7 @@ int ZEXPORT deflateSetDictionary (strm, dictionary, dictLength)
+         str = s->strstart;
+         n = s->lookahead - (MIN_MATCH-1);
+         do {
+-            UPDATE_HASH(s, s->ins_h, s->window[str + MIN_MATCH-1]);
+-#ifndef FASTEST
+-            s->prev[str & s->w_mask] = s->head[s->ins_h];
+-#endif
+-            s->head[s->ins_h] = (Pos)str;
++            insert_string(s, str);
+             str++;
+         } while (--n);
+         s->strstart = str;
+@@ -848,7 +879,7 @@ int ZEXPORT deflate (strm, flush)
+ #ifdef GZIP
+     if (s->status == GZIP_STATE) {
+         /* gzip header */
+-        strm->adler = crc32(0L, Z_NULL, 0);
++        crc_reset(s);
+         put_byte(s, 31);
+         put_byte(s, 139);
+         put_byte(s, 8);
+@@ -1049,6 +1080,7 @@ int ZEXPORT deflate (strm, flush)
+     /* Write the trailer */
+ #ifdef GZIP
+     if (s->wrap == 2) {
++        crc_finalize(s);
+         put_byte(s, (Byte)(strm->adler & 0xff));
+         put_byte(s, (Byte)((strm->adler >> 8) & 0xff));
+         put_byte(s, (Byte)((strm->adler >> 16) & 0xff));
+@@ -1161,7 +1193,7 @@ int ZEXPORT deflateCopy (dest, source)
+  * allocating a large strm->next_in buffer and copying from it.
+  * (See also flush_pending()).
+  */
+-local unsigned read_buf(strm, buf, size)
++ZLIB_INTERNAL unsigned deflate_read_buf(strm, buf, size)
+     z_streamp strm;
+     Bytef *buf;
+     unsigned size;
+@@ -1173,15 +1205,16 @@ local unsigned read_buf(strm, buf, size)
+
+     strm->avail_in  -= len;
+
+-    zmemcpy(buf, strm->next_in, len);
+-    if (strm->state->wrap == 1) {
+-        strm->adler = adler32(strm->adler, buf, len);
+-    }
+ #ifdef GZIP
+-    else if (strm->state->wrap == 2) {
+-        strm->adler = crc32(strm->adler, buf, len);
+-    }
++    if (strm->state->wrap == 2)
++        copy_with_crc(strm, buf, len);
++    else
+ #endif
++    {
++        zmemcpy(buf, strm->next_in, len);
++        if (strm->state->wrap == 1)
++            strm->adler = adler32(strm->adler, buf, len);
++    }
+     strm->next_in  += len;
+     strm->total_in += len;
+
+@@ -1479,7 +1512,19 @@ local void check_match(s, start, match, length)
+  *    performed for at least two bytes (required for the zip translate_eol
+  *    option -- not supported here).
+  */
+-local void fill_window(s)
++local void fill_window_c(deflate_state *s);
++
++local void fill_window(deflate_state *s)
++{
++    if (x86_cpu_enable_simd) {
++        fill_window_sse(s);
++        return;
++    }
++
++    fill_window_c(s);
++}
++
++local void fill_window_c(s)
+     deflate_state *s;
+ {
+     unsigned n;
+@@ -1847,7 +1892,7 @@ local block_state deflate_fast(s, flush)
+          */
+         hash_head = NIL;
+         if (s->lookahead >= MIN_MATCH) {
+-            INSERT_STRING(s, s->strstart, hash_head);
++            hash_head = insert_string(s, s->strstart);
+         }
+
+         /* Find the longest match, discarding those <= prev_length.
+@@ -1878,7 +1923,7 @@ local block_state deflate_fast(s, flush)
+                 s->match_length--; /* string at strstart already in table */
+                 do {
+                     s->strstart++;
+-                    INSERT_STRING(s, s->strstart, hash_head);
++                    hash_head = insert_string(s, s->strstart);
+                     /* strstart never exceeds WSIZE-MAX_MATCH, so there are
+                      * always MIN_MATCH bytes ahead.
+                      */
+@@ -1950,7 +1995,7 @@ local block_state deflate_slow(s, flush)
+          */
+         hash_head = NIL;
+         if (s->lookahead >= MIN_MATCH) {
+-            INSERT_STRING(s, s->strstart, hash_head);
++            hash_head = insert_string(s, s->strstart);
+         }
+
+         /* Find the longest match, discarding those <= prev_length.
+@@ -2001,7 +2046,7 @@ local block_state deflate_slow(s, flush)
+             s->prev_length -= 2;
+             do {
+                 if (++s->strstart <= max_insert) {
+-                    INSERT_STRING(s, s->strstart, hash_head);
++                    hash_head = insert_string(s, s->strstart);
+                 }
+             } while (--s->prev_length != 0);
+             s->match_available = 0;
+@@ -2161,3 +2206,37 @@ local block_state deflate_huff(s, flush)
+         FLUSH_BLOCK(s, 0);
+     return block_done;
+ }
++
++/* Safe to inline this as GCC/clang will use inline asm and Visual Studio will
++ * use intrinsic without extra params
++ */
++local INLINE Pos insert_string_sse(deflate_state *const s, const Pos str)
++{
++    Pos ret;
++    unsigned *ip, val, h = 0;
++
++    ip = (unsigned *)&s->window[str];
++    val = *ip;
++
++    if (s->level >= 6)
++        val &= 0xFFFFFF;
++
++/* Windows clang should use inline asm */
++#if defined(_MSC_VER) && !defined(__clang__)
++    h = _mm_crc32_u32(h, val);
++#elif defined(__i386__) || defined(__amd64__)
++    __asm__ __volatile__ (
++        "crc32 %1,%0\n\t"
++    : "+r" (h)
++    : "r" (val)
++    );
++#else
++    /* This should never happen */
++    assert(0);
++#endif
++
++    ret = s->head[h & s->hash_mask];
++    s->head[h & s->hash_mask] = str;
++    s->prev[str & s->w_mask] = ret;
++    return ret;
++}
+diff --git a/deflate.h b/deflate.h
+index 23ecdd312bc0..ab56df7663b6 100644
+--- a/deflate.h
++++ b/deflate.h
+@@ -109,7 +109,7 @@ typedef struct internal_state {
+     ulg   gzindex;       /* where in extra, name, or comment */
+     Byte  method;        /* can only be DEFLATED */
+     int   last_flush;    /* value of flush param for previous deflate call */
+-
++    unsigned zalign(16) crc0[4 * 5];
+                 /* used by deflate.c: */
+
+     uInt  w_size;        /* LZ77 window size (32K by default) */
+@@ -346,4 +346,14 @@ void ZLIB_INTERNAL _tr_stored_block OF((deflate_state *s, charf *buf,
+               flush = _tr_tally(s, distance, length)
+ #endif
+
++/* Functions that are SIMD optimised on x86 */
++void ZLIB_INTERNAL crc_fold_init(deflate_state* const s);
++void ZLIB_INTERNAL crc_fold_copy(deflate_state* const s,
++                                 unsigned char* dst,
++                                 const unsigned char* src,
++                                 long len);
++unsigned ZLIB_INTERNAL crc_fold_512to32(deflate_state* const s);
++
++void ZLIB_INTERNAL fill_window_sse(deflate_state* s);
++
+ #endif /* DEFLATE_H */
+diff --git a/fill_window_sse.c b/fill_window_sse.c
+new file mode 100644
+index 000000000000..949ccce1ba9c
+--- /dev/null
++++ b/fill_window_sse.c
+@@ -0,0 +1,177 @@
++/*
++ * Fill Window with SSE2-optimized hash shifting
++ *
++ * Copyright (C) 2013 Intel Corporation
++ * Authors:
++ *  Arjan van de Ven    <arjan@linux.intel.com>
++ *  Jim Kukunas         <james.t.kukunas@linux.intel.com>
++ *
++ * For conditions of distribution and use, see copyright notice in zlib.h
++ */
++
++#include <immintrin.h>
++#include "deflate.h"
++
++#define UPDATE_HASH(s,h,i) \
++    {\
++        if (s->level < 6) { \
++            h = (3483 * (s->window[i]) +\
++                 23081* (s->window[i+1]) +\
++                 6954 * (s->window[i+2]) +\
++                 20947* (s->window[i+3])) & s->hash_mask;\
++        } else {\
++            h = (25881* (s->window[i]) +\
++                 24674* (s->window[i+1]) +\
++                 25811* (s->window[i+2])) & s->hash_mask;\
++        }\
++    }\
++
++extern int deflate_read_buf OF((z_streamp strm, Bytef *buf, unsigned size));
++
++void fill_window_sse(deflate_state *s)
++{
++    const __m128i xmm_wsize = _mm_set1_epi16(s->w_size);
++
++    register unsigned n;
++    register Posf *p;
++    unsigned more;    /* Amount of free space at the end of the window. */
++    uInt wsize = s->w_size;
++
++    Assert(s->lookahead < MIN_LOOKAHEAD, "already enough lookahead");
++
++    do {
++        more = (unsigned)(s->window_size -(ulg)s->lookahead -(ulg)s->strstart);
++
++        /* Deal with !@#$% 64K limit: */
++        if (sizeof(int) <= 2) {
++            if (more == 0 && s->strstart == 0 && s->lookahead == 0) {
++                more = wsize;
++
++            } else if (more == (unsigned)(-1)) {
++                /* Very unlikely, but possible on 16 bit machine if
++                 * strstart == 0 && lookahead == 1 (input done a byte at time)
++                 */
++                more--;
++            }
++        }
++
++        /* If the window is almost full and there is insufficient lookahead,
++         * move the upper half to the lower one to make room in the upper half.
++         */
++        if (s->strstart >= wsize+MAX_DIST(s)) {
++
++            zmemcpy(s->window, s->window+wsize, (unsigned)wsize);
++            s->match_start -= wsize;
++            s->strstart    -= wsize; /* we now have strstart >= MAX_DIST */
++            s->block_start -= (long) wsize;
++
++            /* Slide the hash table (could be avoided with 32 bit values
++               at the expense of memory usage). We slide even when level == 0
++               to keep the hash table consistent if we switch back to level > 0
++               later. (Using level 0 permanently is not an optimal usage of
++               zlib, so we don't care about this pathological case.)
++             */
++            n = s->hash_size;
++            p = &s->head[n];
++            p -= 8;
++            do {
++                __m128i value, result;
++
++                value = _mm_loadu_si128((__m128i *)p);
++                result = _mm_subs_epu16(value, xmm_wsize);
++                _mm_storeu_si128((__m128i *)p, result);
++
++                p -= 8;
++                n -= 8;
++            } while (n > 0);
++
++            n = wsize;
++#ifndef FASTEST
++            p = &s->prev[n];
++            p -= 8;
++            do {
++                __m128i value, result;
++
++                value = _mm_loadu_si128((__m128i *)p);
++                result = _mm_subs_epu16(value, xmm_wsize);
++                _mm_storeu_si128((__m128i *)p, result);
++
++                p -= 8;
++                n -= 8;
++            } while (n > 0);
++#endif
++            more += wsize;
++        }
++        if (s->strm->avail_in == 0) break;
++
++        /* If there was no sliding:
++         *    strstart <= WSIZE+MAX_DIST-1 && lookahead <= MIN_LOOKAHEAD - 1 &&
++         *    more == window_size - lookahead - strstart
++         * => more >= window_size - (MIN_LOOKAHEAD-1 + WSIZE + MAX_DIST-1)
++         * => more >= window_size - 2*WSIZE + 2
++         * In the BIG_MEM or MMAP case (not yet supported),
++         *   window_size == input_size + MIN_LOOKAHEAD  &&
++         *   strstart + s->lookahead <= input_size => more >= MIN_LOOKAHEAD.
++         * Otherwise, window_size == 2*WSIZE so more >= 2.
++         * If there was sliding, more >= WSIZE. So in all cases, more >= 2.
++         */
++        Assert(more >= 2, "more < 2");
++
++        n = deflate_read_buf(s->strm,
++                             s->window + s->strstart + s->lookahead,
++                             more);
++        s->lookahead += n;
++
++        /* Initialize the hash value now that we have some input: */
++        if (s->lookahead >= MIN_MATCH) {
++            uInt str = s->strstart;
++            s->ins_h = s->window[str];
++            if (str >= 1)
++                UPDATE_HASH(s, s->ins_h, str + 1 - (MIN_MATCH-1));
++#if MIN_MATCH != 3
++            Call UPDATE_HASH() MIN_MATCH-3 more times
++#endif
++        }
++        /* If the whole input has less than MIN_MATCH bytes, ins_h is garbage,
++         * but this is not important since only literal bytes will be emitted.
++         */
++
++    } while (s->lookahead < MIN_LOOKAHEAD && s->strm->avail_in != 0);
++
++    /* If the WIN_INIT bytes after the end of the current data have never been
++     * written, then zero those bytes in order to avoid memory check reports of
++     * the use of uninitialized (or uninitialised as Julian writes) bytes by
++     * the longest match routines.  Update the high water mark for the next
++     * time through here.  WIN_INIT is set to MAX_MATCH since the longest match
++     * routines allow scanning to strstart + MAX_MATCH, ignoring lookahead.
++     */
++    if (s->high_water < s->window_size) {
++        ulg curr = s->strstart + (ulg)(s->lookahead);
++        ulg init;
++
++        if (s->high_water < curr) {
++            /* Previous high water mark below current data -- zero WIN_INIT
++             * bytes or up to end of window, whichever is less.
++             */
++            init = s->window_size - curr;
++            if (init > WIN_INIT)
++                init = WIN_INIT;
++            zmemzero(s->window + curr, (unsigned)init);
++            s->high_water = curr + init;
++        }
++        else if (s->high_water < (ulg)curr + WIN_INIT) {
++            /* High water mark at or above current data, but below current data
++             * plus WIN_INIT -- zero out to current data plus WIN_INIT, or up
++             * to end of window, whichever is less.
++             */
++            init = (ulg)curr + WIN_INIT - s->high_water;
++            if (init > s->window_size - s->high_water)
++                init = s->window_size - s->high_water;
++            zmemzero(s->window + s->high_water, (unsigned)init);
++            s->high_water += init;
++        }
++    }
++
++    Assert((ulg)s->strstart <= s->window_size - MIN_LOOKAHEAD,
++           "not enough room for search");
++}
+diff --git a/simd_stub.c b/simd_stub.c
+new file mode 100644
+index 000000000000..c6d46051498f
+--- /dev/null
++++ b/simd_stub.c
+@@ -0,0 +1,35 @@
++/* simd_stub.c -- stub implementations
++* Copyright (C) 2014 Intel Corporation
++* For conditions of distribution and use, see copyright notice in zlib.h
++*/
++#include <assert.h>
++
++#include "deflate.h"
++#include "x86.h"
++
++int ZLIB_INTERNAL x86_cpu_enable_simd = 0;
++
++void ZLIB_INTERNAL crc_fold_init(deflate_state *const s) {
++    assert(0);
++}
++
++void ZLIB_INTERNAL crc_fold_copy(deflate_state *const s,
++                                 unsigned char *dst,
++                                 const unsigned char *src,
++                                 long len) {
++    assert(0);
++}
++
++unsigned ZLIB_INTERNAL crc_fold_512to32(deflate_state *const s) {
++    assert(0);
++    return 0;
++}
++
++void ZLIB_INTERNAL fill_window_sse(deflate_state *s)
++{
++    assert(0);
++}
++
++void x86_check_features(void)
++{
++}
+diff --git a/x86.c b/x86.c
+new file mode 100644
+index 000000000000..e56fe8b85a39
+--- /dev/null
++++ b/x86.c
+@@ -0,0 +1,92 @@
++/*
++ * x86 feature check
++ *
++ * Copyright (C) 2013 Intel Corporation. All rights reserved.
++ * Author:
++ *  Jim Kukunas
++ *
++ * For conditions of distribution and use, see copyright notice in zlib.h
++ */
++
++#include "x86.h"
++#include "zutil.h"
++
++int ZLIB_INTERNAL x86_cpu_enable_simd = 0;
++
++#ifndef _MSC_VER
++#include <pthread.h>
++
++pthread_once_t cpu_check_inited_once = PTHREAD_ONCE_INIT;
++static void _x86_check_features(void);
++
++void x86_check_features(void)
++{
++  pthread_once(&cpu_check_inited_once, _x86_check_features);
++}
++
++static void _x86_check_features(void)
++{
++    int x86_cpu_has_sse2;
++    int x86_cpu_has_sse42;
++    int x86_cpu_has_pclmulqdq;
++    unsigned eax, ebx, ecx, edx;
++
++    eax = 1;
++#ifdef __i386__
++    __asm__ __volatile__ (
++        "xchg %%ebx, %1\n\t"
++        "cpuid\n\t"
++        "xchg %1, %%ebx\n\t"
++    : "+a" (eax), "=S" (ebx), "=c" (ecx), "=d" (edx)
++    );
++#else
++    __asm__ __volatile__ (
++        "cpuid\n\t"
++    : "+a" (eax), "=b" (ebx), "=c" (ecx), "=d" (edx)
++    );
++#endif  /* (__i386__) */
++
++    x86_cpu_has_sse2 = edx & 0x4000000;
++    x86_cpu_has_sse42 = ecx & 0x100000;
++    x86_cpu_has_pclmulqdq = ecx & 0x2;
++
++    x86_cpu_enable_simd = x86_cpu_has_sse2 &&
++                          x86_cpu_has_sse42 &&
++                          x86_cpu_has_pclmulqdq;
++}
++#else
++#include <intrin.h>
++#include <windows.h>
++
++static BOOL CALLBACK _x86_check_features(PINIT_ONCE once,
++                                         PVOID param,
++                                         PVOID *context);
++static INIT_ONCE cpu_check_inited_once = INIT_ONCE_STATIC_INIT;
++
++void x86_check_features(void)
++{
++    InitOnceExecuteOnce(&cpu_check_inited_once, _x86_check_features,
++                        NULL, NULL);
++}
++
++static BOOL CALLBACK _x86_check_features(PINIT_ONCE once,
++                                         PVOID param,
++                                         PVOID *context)
++{
++    int x86_cpu_has_sse2;
++    int x86_cpu_has_sse42;
++    int x86_cpu_has_pclmulqdq;
++    int regs[4];
++
++    __cpuid(regs, 1);
++
++    x86_cpu_has_sse2 = regs[3] & 0x4000000;
++    x86_cpu_has_sse42= regs[2] & 0x100000;
++    x86_cpu_has_pclmulqdq = regs[2] & 0x2;
++
++    x86_cpu_enable_simd = x86_cpu_has_sse2 &&
++                          x86_cpu_has_sse42 &&
++                          x86_cpu_has_pclmulqdq;
++    return TRUE;
++}
++#endif  /* _MSC_VER */
+diff --git a/x86.h b/x86.h
+new file mode 100644
+index 000000000000..ebcf10ab09d2
+--- /dev/null
++++ b/x86.h
+@@ -0,0 +1,15 @@
++/* x86.h -- check for x86 CPU features
++* Copyright (C) 2013 Intel Corporation Jim Kukunas
++* For conditions of distribution and use, see copyright notice in zlib.h
++*/
++
++#ifndef X86_H
++#define X86_H
++
++#include "zlib.h"
++
++extern int x86_cpu_enable_simd;
++
++void x86_check_features(void);
++
++#endif  /* X86_H */
+diff --git a/zutil.h b/zutil.h
+index 80375b8b6109..4425bcf75eb3 100644
+--- a/zutil.h
++++ b/zutil.h
+@@ -283,4 +283,10 @@ extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
+ #define ZSWAP32(q) ((((q) >> 24) & 0xff) + (((q) >> 8) & 0xff00) + \
+                     (((q) & 0xff00) << 8) + (((q) & 0xff) << 24))
+
++#ifdef _MSC_VER
++#define zalign(x) __declspec(align(x))
++#else
++#define zalign(x) __attribute__((aligned((x))))
++#endif
++
+ #endif /* ZUTIL_H */
diff --git a/deps/v8/third_party/zlib/patches/0002-uninitializedcheck.patch b/deps/v8/third_party/zlib/patches/0002-uninitializedcheck.patch
new file mode 100644
index 00000000000000..7c497839d30b87
--- /dev/null
+++ b/deps/v8/third_party/zlib/patches/0002-uninitializedcheck.patch
@@ -0,0 +1,27 @@
+From 1a03e7aec95d89c659fd91f195b99893b6458cd7 Mon Sep 17 00:00:00 2001
+From: Adenilson Cavalcanti <adenilson.cavalcanti@arm.com>
+Date: Wed, 27 Sep 2017 13:59:04 -0700
+Subject: [PATCH] Zlib patch: prevent uninitialized use of state->check
+
+No need to call the Adler32 checksum function, just set
+the struct field to the expected value.
+
+Upstream bug: madler/zlib#245
+---
+ third_party/zlib/inflate.c                             |  2 +-
+ 1 files changed, 1 insertion(+), 1 deletions(-)
+ delete mode 100644 third_party/zlib/patches/0002-uninitializedcheck.patch
+
+diff --git a/third_party/zlib/inflate.c b/third_party/zlib/inflate.c
+index bec9497..5c40cf1 100644
+--- a/third_party/zlib/inflate.c
++++ b/third_party/zlib/inflate.c
+@@ -228,7 +228,7 @@ int stream_size;
+     state->strm = strm;
+     state->window = Z_NULL;
+     state->mode = HEAD;     /* to pass state test in inflateReset2() */
+-    state->check = adler32(0L, Z_NULL, 0);
++    state->check = 1L;      /* 1L is the result of adler32() zero length data */
+     ret = inflateReset2(strm, windowBits);
+     if (ret != Z_OK) {
+         ZFREE(strm, state);
diff --git a/deps/v8/third_party/zlib/patches/0003-uninitializedjump.patch b/deps/v8/third_party/zlib/patches/0003-uninitializedjump.patch
new file mode 100644
index 00000000000000..5208319f708da4
--- /dev/null
+++ b/deps/v8/third_party/zlib/patches/0003-uninitializedjump.patch
@@ -0,0 +1,15 @@
+diff --git a/third_party/zlib/deflate.c b/third_party/zlib/deflate.c
+index a39e62787862..c6053fd1c7ea 100644
+--- a/third_party/zlib/deflate.c
++++ b/third_party/zlib/deflate.c
+@@ -318,6 +318,10 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
+                                  s->w_size + window_padding,
+                                  2*sizeof(Byte));
+     s->prev   = (Posf *)  ZALLOC(strm, s->w_size, sizeof(Pos));
++    /* Avoid use of uninitialized value, see:
++     * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360
++     */
++    zmemzero(s->prev, s->w_size * sizeof(Pos));
+     s->head   = (Posf *)  ZALLOC(strm, s->hash_size, sizeof(Pos));
+
+     s->high_water = 0;      /* nothing written to s->window yet */
diff --git a/deps/v8/third_party/zlib/patches/README b/deps/v8/third_party/zlib/patches/README
new file mode 100644
index 00000000000000..b21d309ff91984
--- /dev/null
+++ b/deps/v8/third_party/zlib/patches/README
@@ -0,0 +1,43 @@
+== Patches applied on top of zlib ==
+
+ - 0000-build.patch: changes from the upstream version, mostly related to the
+   build.
+ - 0001-simd.patch: integrate Intel SIMD optimizations from
+   https://github.com/jtkukunas/zlib/
+ - 0002-uninitializedcheck.patch: prevent uninitialized use of state->check
+
+== Procedure to create a patch file ==
+
+  Assuming you are working in a new feature branch:
+ - git format-patch master --stdout > foo.patch # where naming follows a growing
+                                                # number plus patch description.
+ - git add foo.patch
+ - git commit -a -m "Local patch."
+ - git rebase -i HEAD~2 # Squashing the second commit
+
+  As patches created in this way will feature a ChangeLog, there is no longer
+the need to append this file with a description of what the patch does. This
+should help to solve frequent conflicts in pending new patches on
+Chromium's zlib.
+
+  The plan for the near future is to better insulate the platform specific
+changes to ease update adoption with new releases of zlib. This insulation
+happens by making changes inside contrib/ rather than the root directory
+(where conflicts can happen).
+
+  If a change modifies enough things inside the root directory that the
+intention is not immediately clear, generate a .patch file to go with your
+change. If the change's modifications in the root directory are small, like:
+
+#ifdef FEATURE_FLAG
+use_special_feature();
+#elif
+use_default_behavior();
+#endif
+
+  then the intent is clear and a .patch file doesn't need to be generated (since
+it would not provide much value).
+
+  Ideally local changes should have a merge request featured in either:
+ - canonical zlib: https://github.com/madler/zlib/
+ - zlib-ng: https://github.com/Dead2/zlib-ng
diff --git a/deps/v8/third_party/zlib/trees.c b/deps/v8/third_party/zlib/trees.c
new file mode 100644
index 00000000000000..5f89d056ef9692
--- /dev/null
+++ b/deps/v8/third_party/zlib/trees.c
@@ -0,0 +1,1181 @@
+/* trees.c -- output deflated data using Huffman coding
+ * Copyright (C) 1995-2017 Jean-loup Gailly
+ * detect_data_type() function provided freely by Cosmin Truta, 2006
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/*
+ *  ALGORITHM
+ *
+ *      The "deflation" process uses several Huffman trees. The more
+ *      common source values are represented by shorter bit sequences.
+ *
+ *      Each code tree is stored in a compressed form which is itself
+ * a Huffman encoding of the lengths of all the code strings (in
+ * ascending order by source values).  The actual code strings are
+ * reconstructed from the lengths in the inflate process, as described
+ * in the deflate specification.
+ *
+ *  REFERENCES
+ *
+ *      Deutsch, L.P.,"'Deflate' Compressed Data Format Specification".
+ *      Available in ftp.uu.net:/pub/archiving/zip/doc/deflate-1.1.doc
+ *
+ *      Storer, James A.
+ *          Data Compression:  Methods and Theory, pp. 49-50.
+ *          Computer Science Press, 1988.  ISBN 0-7167-8156-5.
+ *
+ *      Sedgewick, R.
+ *          Algorithms, p290.
+ *          Addison-Wesley, 1983. ISBN 0-201-06672-6.
+ */
+
+/* @(#) $Id$ */
+
+/* #define GEN_TREES_H */
+
+#include "deflate.h"
+
+#ifdef ZLIB_DEBUG
+#  include <ctype.h>
+#endif
+
+/* ===========================================================================
+ * Constants
+ */
+
+#define MAX_BL_BITS 7
+/* Bit length codes must not exceed MAX_BL_BITS bits */
+
+#define END_BLOCK 256
+/* end of block literal code */
+
+#define REP_3_6      16
+/* repeat previous bit length 3-6 times (2 bits of repeat count) */
+
+#define REPZ_3_10    17
+/* repeat a zero length 3-10 times  (3 bits of repeat count) */
+
+#define REPZ_11_138  18
+/* repeat a zero length 11-138 times  (7 bits of repeat count) */
+
+local const int extra_lbits[LENGTH_CODES] /* extra bits for each length code */
+   = {0,0,0,0,0,0,0,0,1,1,1,1,2,2,2,2,3,3,3,3,4,4,4,4,5,5,5,5,0};
+
+local const int extra_dbits[D_CODES] /* extra bits for each distance code */
+   = {0,0,0,0,1,1,2,2,3,3,4,4,5,5,6,6,7,7,8,8,9,9,10,10,11,11,12,12,13,13};
+
+local const int extra_blbits[BL_CODES]/* extra bits for each bit length code */
+   = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,3,7};
+
+local const uch bl_order[BL_CODES]
+   = {16,17,18,0,8,7,9,6,10,5,11,4,12,3,13,2,14,1,15};
+/* The lengths of the bit length codes are sent in order of decreasing
+ * probability, to avoid transmitting the lengths for unused bit length codes.
+ */
+
+/* ===========================================================================
+ * Local data. These are initialized only once.
+ */
+
+#define DIST_CODE_LEN  512 /* see definition of array dist_code below */
+
+#if defined(GEN_TREES_H) || !defined(STDC)
+/* non ANSI compilers may not accept trees.h */
+
+local ct_data static_ltree[L_CODES+2];
+/* The static literal tree. Since the bit lengths are imposed, there is no
+ * need for the L_CODES extra codes used during heap construction. However
+ * The codes 286 and 287 are needed to build a canonical tree (see _tr_init
+ * below).
+ */
+
+local ct_data static_dtree[D_CODES];
+/* The static distance tree. (Actually a trivial tree since all codes use
+ * 5 bits.)
+ */
+
+uch _dist_code[DIST_CODE_LEN];
+/* Distance codes. The first 256 values correspond to the distances
+ * 3 .. 258, the last 256 values correspond to the top 8 bits of
+ * the 15 bit distances.
+ */
+
+uch _length_code[MAX_MATCH-MIN_MATCH+1];
+/* length code for each normalized match length (0 == MIN_MATCH) */
+
+local int base_length[LENGTH_CODES];
+/* First normalized length for each code (0 = MIN_MATCH) */
+
+local int base_dist[D_CODES];
+/* First normalized distance for each code (0 = distance of 1) */
+
+#else
+#  include "trees.h"
+#endif /* GEN_TREES_H */
+
+struct static_tree_desc_s {
+    const ct_data *static_tree;  /* static tree or NULL */
+    const intf *extra_bits;      /* extra bits for each code or NULL */
+    int     extra_base;          /* base index for extra_bits */
+    int     elems;               /* max number of elements in the tree */
+    int     max_length;          /* max bit length for the codes */
+};
+
+local const static_tree_desc  static_l_desc =
+{static_ltree, extra_lbits, LITERALS+1, L_CODES, MAX_BITS};
+
+local const static_tree_desc  static_d_desc =
+{static_dtree, extra_dbits, 0,          D_CODES, MAX_BITS};
+
+local const static_tree_desc  static_bl_desc =
+{(const ct_data *)0, extra_blbits, 0,   BL_CODES, MAX_BL_BITS};
+
+/* ===========================================================================
+ * Local (static) routines in this file.
+ */
+
+local void tr_static_init OF((void));
+local void init_block     OF((deflate_state *s));
+local void pqdownheap     OF((deflate_state *s, ct_data *tree, int k));
+local void gen_bitlen     OF((deflate_state *s, tree_desc *desc));
+local void gen_codes      OF((ct_data *tree, int max_code, ushf *bl_count));
+local void build_tree     OF((deflate_state *s, tree_desc *desc));
+local void scan_tree      OF((deflate_state *s, ct_data *tree, int max_code));
+local void send_tree      OF((deflate_state *s, ct_data *tree, int max_code));
+local int  build_bl_tree  OF((deflate_state *s));
+local void send_all_trees OF((deflate_state *s, int lcodes, int dcodes,
+                              int blcodes));
+local void compress_block OF((deflate_state *s, const ct_data *ltree,
+                              const ct_data *dtree));
+local int  detect_data_type OF((deflate_state *s));
+local unsigned bi_reverse OF((unsigned value, int length));
+local void bi_windup      OF((deflate_state *s));
+local void bi_flush       OF((deflate_state *s));
+
+#ifdef GEN_TREES_H
+local void gen_trees_header OF((void));
+#endif
+
+#ifndef ZLIB_DEBUG
+#  define send_code(s, c, tree) send_bits(s, tree[c].Code, tree[c].Len)
+   /* Send a code of the given tree. c and tree must not have side effects */
+
+#else /* !ZLIB_DEBUG */
+#  define send_code(s, c, tree) \
+     { if (z_verbose>2) fprintf(stderr,"\ncd %3d ",(c)); \
+       send_bits(s, tree[c].Code, tree[c].Len); }
+#endif
+
+/* ===========================================================================
+ * Output a short LSB first on the stream.
+ * IN assertion: there is enough room in pendingBuf.
+ */
+#define put_short(s, w) { \
+    put_byte(s, (uch)((w) & 0xff)); \
+    put_byte(s, (uch)((ush)(w) >> 8)); \
+}
+
+/* ===========================================================================
+ * Send a value on a given number of bits.
+ * IN assertion: length <= 16 and value fits in length bits.
+ */
+#ifdef ZLIB_DEBUG
+local void send_bits      OF((deflate_state *s, int value, int length));
+
+local void send_bits(s, value, length)
+    deflate_state *s;
+    int value;  /* value to send */
+    int length; /* number of bits */
+{
+    Tracevv((stderr," l %2d v %4x ", length, value));
+    Assert(length > 0 && length <= 15, "invalid length");
+    s->bits_sent += (ulg)length;
+
+    /* If not enough room in bi_buf, use (valid) bits from bi_buf and
+     * (16 - bi_valid) bits from value, leaving (width - (16-bi_valid))
+     * unused bits in value.
+     */
+    if (s->bi_valid > (int)Buf_size - length) {
+        s->bi_buf |= (ush)value << s->bi_valid;
+        put_short(s, s->bi_buf);
+        s->bi_buf = (ush)value >> (Buf_size - s->bi_valid);
+        s->bi_valid += length - Buf_size;
+    } else {
+        s->bi_buf |= (ush)value << s->bi_valid;
+        s->bi_valid += length;
+    }
+}
+#else /* !ZLIB_DEBUG */
+
+#define send_bits(s, value, length) \
+{ int len = length;\
+  if (s->bi_valid > (int)Buf_size - len) {\
+    int val = (int)value;\
+    s->bi_buf |= (ush)val << s->bi_valid;\
+    put_short(s, s->bi_buf);\
+    s->bi_buf = (ush)val >> (Buf_size - s->bi_valid);\
+    s->bi_valid += len - Buf_size;\
+  } else {\
+    s->bi_buf |= (ush)(value) << s->bi_valid;\
+    s->bi_valid += len;\
+  }\
+}
+#endif /* ZLIB_DEBUG */
+
+
+/* the arguments must not have side effects */
+
+/* ===========================================================================
+ * Initialize the various 'constant' tables.
+ */
+local void tr_static_init()
+{
+#if defined(GEN_TREES_H) || !defined(STDC)
+    static int static_init_done = 0;
+    int n;        /* iterates over tree elements */
+    int bits;     /* bit counter */
+    int length;   /* length value */
+    int code;     /* code value */
+    int dist;     /* distance index */
+    ush bl_count[MAX_BITS+1];
+    /* number of codes at each bit length for an optimal tree */
+
+    if (static_init_done) return;
+
+    /* For some embedded targets, global variables are not initialized: */
+#ifdef NO_INIT_GLOBAL_POINTERS
+    static_l_desc.static_tree = static_ltree;
+    static_l_desc.extra_bits = extra_lbits;
+    static_d_desc.static_tree = static_dtree;
+    static_d_desc.extra_bits = extra_dbits;
+    static_bl_desc.extra_bits = extra_blbits;
+#endif
+
+    /* Initialize the mapping length (0..255) -> length code (0..28) */
+    length = 0;
+    for (code = 0; code < LENGTH_CODES-1; code++) {
+        base_length[code] = length;
+        for (n = 0; n < (1<<extra_lbits[code]); n++) {
+            _length_code[length++] = (uch)code;
+        }
+    }
+    Assert (length == 256, "tr_static_init: length != 256");
+    /* Note that the length 255 (match length 258) can be represented
+     * in two different ways: code 284 + 5 bits or code 285, so we
+     * overwrite length_code[255] to use the best encoding:
+     */
+    _length_code[length-1] = (uch)code;
+
+    /* Initialize the mapping dist (0..32K) -> dist code (0..29) */
+    dist = 0;
+    for (code = 0 ; code < 16; code++) {
+        base_dist[code] = dist;
+        for (n = 0; n < (1<<extra_dbits[code]); n++) {
+            _dist_code[dist++] = (uch)code;
+        }
+    }
+    Assert (dist == 256, "tr_static_init: dist != 256");
+    dist >>= 7; /* from now on, all distances are divided by 128 */
+    for ( ; code < D_CODES; code++) {
+        base_dist[code] = dist << 7;
+        for (n = 0; n < (1<<(extra_dbits[code]-7)); n++) {
+            _dist_code[256 + dist++] = (uch)code;
+        }
+    }
+    Assert (dist == 256, "tr_static_init: 256+dist != 512");
+
+    /* Construct the codes of the static literal tree */
+    for (bits = 0; bits <= MAX_BITS; bits++) bl_count[bits] = 0;
+    n = 0;
+    while (n <= 143) static_ltree[n++].Len = 8, bl_count[8]++;
+    while (n <= 255) static_ltree[n++].Len = 9, bl_count[9]++;
+    while (n <= 279) static_ltree[n++].Len = 7, bl_count[7]++;
+    while (n <= 287) static_ltree[n++].Len = 8, bl_count[8]++;
+    /* Codes 286 and 287 do not exist, but we must include them in the
+     * tree construction to get a canonical Huffman tree (longest code
+     * all ones)
+     */
+    gen_codes((ct_data *)static_ltree, L_CODES+1, bl_count);
+
+    /* The static distance tree is trivial: */
+    for (n = 0; n < D_CODES; n++) {
+        static_dtree[n].Len = 5;
+        static_dtree[n].Code = bi_reverse((unsigned)n, 5);
+    }
+    static_init_done = 1;
+
+#  ifdef GEN_TREES_H
+    gen_trees_header();
+#  endif
+#endif /* defined(GEN_TREES_H) || !defined(STDC) */
+}
+
+/* ===========================================================================
+ * Genererate the file trees.h describing the static trees.
+ */
+#ifdef GEN_TREES_H
+#  ifndef ZLIB_DEBUG
+#    include <stdio.h>
+#  endif
+
+#  define SEPARATOR(i, last, width) \
+      ((i) == (last)? "\n};\n\n" :    \
+       ((i) % (width) == (width)-1 ? ",\n" : ", "))
+
+void gen_trees_header()
+{
+    FILE *header = fopen("trees.h", "w");
+    int i;
+
+    Assert (header != NULL, "Can't open trees.h");
+    fprintf(header,
+            "/* header created automatically with -DGEN_TREES_H */\n\n");
+
+    fprintf(header, "local const ct_data static_ltree[L_CODES+2] = {\n");
+    for (i = 0; i < L_CODES+2; i++) {
+        fprintf(header, "{{%3u},{%3u}}%s", static_ltree[i].Code,
+                static_ltree[i].Len, SEPARATOR(i, L_CODES+1, 5));
+    }
+
+    fprintf(header, "local const ct_data static_dtree[D_CODES] = {\n");
+    for (i = 0; i < D_CODES; i++) {
+        fprintf(header, "{{%2u},{%2u}}%s", static_dtree[i].Code,
+                static_dtree[i].Len, SEPARATOR(i, D_CODES-1, 5));
+    }
+
+    fprintf(header, "const uch ZLIB_INTERNAL _dist_code[DIST_CODE_LEN] = {\n");
+    for (i = 0; i < DIST_CODE_LEN; i++) {
+        fprintf(header, "%2u%s", _dist_code[i],
+                SEPARATOR(i, DIST_CODE_LEN-1, 20));
+    }
+
+    fprintf(header,
+        "const uch ZLIB_INTERNAL _length_code[MAX_MATCH-MIN_MATCH+1]= {\n");
+    for (i = 0; i < MAX_MATCH-MIN_MATCH+1; i++) {
+        fprintf(header, "%2u%s", _length_code[i],
+                SEPARATOR(i, MAX_MATCH-MIN_MATCH, 20));
+    }
+
+    fprintf(header, "local const int base_length[LENGTH_CODES] = {\n");
+    for (i = 0; i < LENGTH_CODES; i++) {
+        fprintf(header, "%1u%s", base_length[i],
+                SEPARATOR(i, LENGTH_CODES-1, 20));
+    }
+
+    fprintf(header, "local const int base_dist[D_CODES] = {\n");
+    for (i = 0; i < D_CODES; i++) {
+        fprintf(header, "%5u%s", base_dist[i],
+                SEPARATOR(i, D_CODES-1, 10));
+    }
+
+    fclose(header);
+}
+#endif /* GEN_TREES_H */
+
+/* ===========================================================================
+ * Initialize the tree data structures for a new zlib stream.
+ */
+void ZLIB_INTERNAL _tr_init(s)
+    deflate_state *s;
+{
+    tr_static_init();
+
+    s->l_desc.dyn_tree = s->dyn_ltree;
+    s->l_desc.stat_desc = &static_l_desc;
+
+    s->d_desc.dyn_tree = s->dyn_dtree;
+    s->d_desc.stat_desc = &static_d_desc;
+
+    s->bl_desc.dyn_tree = s->bl_tree;
+    s->bl_desc.stat_desc = &static_bl_desc;
+
+    s->bi_buf = 0;
+    s->bi_valid = 0;
+#ifdef ZLIB_DEBUG
+    s->compressed_len = 0L;
+    s->bits_sent = 0L;
+#endif
+
+    /* Initialize the first block of the first file: */
+    init_block(s);
+}
+
+/* ===========================================================================
+ * Initialize a new block.
+ */
+local void init_block(s)
+    deflate_state *s;
+{
+    int n; /* iterates over tree elements */
+
+    /* Initialize the trees. */
+    for (n = 0; n < L_CODES;  n++) s->dyn_ltree[n].Freq = 0;
+    for (n = 0; n < D_CODES;  n++) s->dyn_dtree[n].Freq = 0;
+    for (n = 0; n < BL_CODES; n++) s->bl_tree[n].Freq = 0;
+
+    s->dyn_ltree[END_BLOCK].Freq = 1;
+    s->opt_len = s->static_len = 0L;
+    s->sym_next = s->matches = 0;
+}
+
+#define SMALLEST 1
+/* Index within the heap array of least frequent node in the Huffman tree */
+
+
+/* ===========================================================================
+ * Remove the smallest element from the heap and recreate the heap with
+ * one less element. Updates heap and heap_len.
+ */
+#define pqremove(s, tree, top) \
+{\
+    top = s->heap[SMALLEST]; \
+    s->heap[SMALLEST] = s->heap[s->heap_len--]; \
+    pqdownheap(s, tree, SMALLEST); \
+}
+
+/* ===========================================================================
+ * Compares to subtrees, using the tree depth as tie breaker when
+ * the subtrees have equal frequency. This minimizes the worst case length.
+ */
+#define smaller(tree, n, m, depth) \
+   (tree[n].Freq < tree[m].Freq || \
+   (tree[n].Freq == tree[m].Freq && depth[n] <= depth[m]))
+
+/* ===========================================================================
+ * Restore the heap property by moving down the tree starting at node k,
+ * exchanging a node with the smallest of its two sons if necessary, stopping
+ * when the heap property is re-established (each father smaller than its
+ * two sons).
+ */
+local void pqdownheap(s, tree, k)
+    deflate_state *s;
+    ct_data *tree;  /* the tree to restore */
+    int k;               /* node to move down */
+{
+    int v = s->heap[k];
+    int j = k << 1;  /* left son of k */
+    while (j <= s->heap_len) {
+        /* Set j to the smallest of the two sons: */
+        if (j < s->heap_len &&
+            smaller(tree, s->heap[j+1], s->heap[j], s->depth)) {
+            j++;
+        }
+        /* Exit if v is smaller than both sons */
+        if (smaller(tree, v, s->heap[j], s->depth)) break;
+
+        /* Exchange v with the smallest son */
+        s->heap[k] = s->heap[j];  k = j;
+
+        /* And continue down the tree, setting j to the left son of k */
+        j <<= 1;
+    }
+    s->heap[k] = v;
+}
+
+/* ===========================================================================
+ * Compute the optimal bit lengths for a tree and update the total bit length
+ * for the current block.
+ * IN assertion: the fields freq and dad are set, heap[heap_max] and
+ *    above are the tree nodes sorted by increasing frequency.
+ * OUT assertions: the field len is set to the optimal bit length, the
+ *     array bl_count contains the frequencies for each bit length.
+ *     The length opt_len is updated; static_len is also updated if stree is
+ *     not null.
+ */
+local void gen_bitlen(s, desc)
+    deflate_state *s;
+    tree_desc *desc;    /* the tree descriptor */
+{
+    ct_data *tree        = desc->dyn_tree;
+    int max_code         = desc->max_code;
+    const ct_data *stree = desc->stat_desc->static_tree;
+    const intf *extra    = desc->stat_desc->extra_bits;
+    int base             = desc->stat_desc->extra_base;
+    int max_length       = desc->stat_desc->max_length;
+    int h;              /* heap index */
+    int n, m;           /* iterate over the tree elements */
+    int bits;           /* bit length */
+    int xbits;          /* extra bits */
+    ush f;              /* frequency */
+    int overflow = 0;   /* number of elements with bit length too large */
+
+    for (bits = 0; bits <= MAX_BITS; bits++) s->bl_count[bits] = 0;
+
+    /* In a first pass, compute the optimal bit lengths (which may
+     * overflow in the case of the bit length tree).
+     */
+    tree[s->heap[s->heap_max]].Len = 0; /* root of the heap */
+
+    for (h = s->heap_max+1; h < HEAP_SIZE; h++) {
+        n = s->heap[h];
+        bits = tree[tree[n].Dad].Len + 1;
+        if (bits > max_length) bits = max_length, overflow++;
+        tree[n].Len = (ush)bits;
+        /* We overwrite tree[n].Dad which is no longer needed */
+
+        if (n > max_code) continue; /* not a leaf node */
+
+        s->bl_count[bits]++;
+        xbits = 0;
+        if (n >= base) xbits = extra[n-base];
+        f = tree[n].Freq;
+        s->opt_len += (ulg)f * (unsigned)(bits + xbits);
+        if (stree) s->static_len += (ulg)f * (unsigned)(stree[n].Len + xbits);
+    }
+    if (overflow == 0) return;
+
+    Tracev((stderr,"\nbit length overflow\n"));
+    /* This happens for example on obj2 and pic of the Calgary corpus */
+
+    /* Find the first bit length which could increase: */
+    do {
+        bits = max_length-1;
+        while (s->bl_count[bits] == 0) bits--;
+        s->bl_count[bits]--;      /* move one leaf down the tree */
+        s->bl_count[bits+1] += 2; /* move one overflow item as its brother */
+        s->bl_count[max_length]--;
+        /* The brother of the overflow item also moves one step up,
+         * but this does not affect bl_count[max_length]
+         */
+        overflow -= 2;
+    } while (overflow > 0);
+
+    /* Now recompute all bit lengths, scanning in increasing frequency.
+     * h is still equal to HEAP_SIZE. (It is simpler to reconstruct all
+     * lengths instead of fixing only the wrong ones. This idea is taken
+     * from 'ar' written by Haruhiko Okumura.)
+     */
+    for (bits = max_length; bits != 0; bits--) {
+        n = s->bl_count[bits];
+        while (n != 0) {
+            m = s->heap[--h];
+            if (m > max_code) continue;
+            if ((unsigned) tree[m].Len != (unsigned) bits) {
+                Tracev((stderr,"code %d bits %d->%d\n", m, tree[m].Len, bits));
+                s->opt_len += ((ulg)bits - tree[m].Len) * tree[m].Freq;
+                tree[m].Len = (ush)bits;
+            }
+            n--;
+        }
+    }
+}
+
+/* ===========================================================================
+ * Generate the codes for a given tree and bit counts (which need not be
+ * optimal).
+ * IN assertion: the array bl_count contains the bit length statistics for
+ * the given tree and the field len is set for all tree elements.
+ * OUT assertion: the field code is set for all tree elements of non
+ *     zero code length.
+ */
+local void gen_codes (tree, max_code, bl_count)
+    ct_data *tree;             /* the tree to decorate */
+    int max_code;              /* largest code with non zero frequency */
+    ushf *bl_count;            /* number of codes at each bit length */
+{
+    ush next_code[MAX_BITS+1]; /* next code value for each bit length */
+    unsigned code = 0;         /* running code value */
+    int bits;                  /* bit index */
+    int n;                     /* code index */
+
+    /* The distribution counts are first used to generate the code values
+     * without bit reversal.
+     */
+    for (bits = 1; bits <= MAX_BITS; bits++) {
+        code = (code + bl_count[bits-1]) << 1;
+        next_code[bits] = (ush)code;
+    }
+    /* Check that the bit counts in bl_count are consistent. The last code
+     * must be all ones.
+     */
+    Assert (code + bl_count[MAX_BITS]-1 == (1<<MAX_BITS)-1,
+            "inconsistent bit counts");
+    Tracev((stderr,"\ngen_codes: max_code %d ", max_code));
+
+    for (n = 0;  n <= max_code; n++) {
+        int len = tree[n].Len;
+        if (len == 0) continue;
+        /* Now reverse the bits */
+        tree[n].Code = (ush)bi_reverse(next_code[len]++, len);
+
+        Tracecv(tree != static_ltree, (stderr,"\nn %3d %c l %2d c %4x (%x) ",
+             n, (isgraph(n) ? n : ' '), len, tree[n].Code, next_code[len]-1));
+    }
+}
+
+/* ===========================================================================
+ * Construct one Huffman tree and assigns the code bit strings and lengths.
+ * Update the total bit length for the current block.
+ * IN assertion: the field freq is set for all tree elements.
+ * OUT assertions: the fields len and code are set to the optimal bit length
+ *     and corresponding code. The length opt_len is updated; static_len is
+ *     also updated if stree is not null. The field max_code is set.
+ */
+local void build_tree(s, desc)
+    deflate_state *s;
+    tree_desc *desc; /* the tree descriptor */
+{
+    ct_data *tree         = desc->dyn_tree;
+    const ct_data *stree  = desc->stat_desc->static_tree;
+    int elems             = desc->stat_desc->elems;
+    int n, m;          /* iterate over heap elements */
+    int max_code = -1; /* largest code with non zero frequency */
+    int node;          /* new node being created */
+
+    /* Construct the initial heap, with least frequent element in
+     * heap[SMALLEST]. The sons of heap[n] are heap[2*n] and heap[2*n+1].
+     * heap[0] is not used.
+     */
+    s->heap_len = 0, s->heap_max = HEAP_SIZE;
+
+    for (n = 0; n < elems; n++) {
+        if (tree[n].Freq != 0) {
+            s->heap[++(s->heap_len)] = max_code = n;
+            s->depth[n] = 0;
+        } else {
+            tree[n].Len = 0;
+        }
+    }
+
+    /* The pkzip format requires that at least one distance code exists,
+     * and that at least one bit should be sent even if there is only one
+     * possible code. So to avoid special checks later on we force at least
+     * two codes of non zero frequency.
+     */
+    while (s->heap_len < 2) {
+        node = s->heap[++(s->heap_len)] = (max_code < 2 ? ++max_code : 0);
+        tree[node].Freq = 1;
+        s->depth[node] = 0;
+        s->opt_len--; if (stree) s->static_len -= stree[node].Len;
+        /* node is 0 or 1 so it does not have extra bits */
+    }
+    desc->max_code = max_code;
+
+    /* The elements heap[heap_len/2+1 .. heap_len] are leaves of the tree,
+     * establish sub-heaps of increasing lengths:
+     */
+    for (n = s->heap_len/2; n >= 1; n--) pqdownheap(s, tree, n);
+
+    /* Construct the Huffman tree by repeatedly combining the least two
+     * frequent nodes.
+     */
+    node = elems;              /* next internal node of the tree */
+    do {
+        pqremove(s, tree, n);  /* n = node of least frequency */
+        m = s->heap[SMALLEST]; /* m = node of next least frequency */
+
+        s->heap[--(s->heap_max)] = n; /* keep the nodes sorted by frequency */
+        s->heap[--(s->heap_max)] = m;
+
+        /* Create a new node father of n and m */
+        tree[node].Freq = tree[n].Freq + tree[m].Freq;
+        s->depth[node] = (uch)((s->depth[n] >= s->depth[m] ?
+                                s->depth[n] : s->depth[m]) + 1);
+        tree[n].Dad = tree[m].Dad = (ush)node;
+#ifdef DUMP_BL_TREE
+        if (tree == s->bl_tree) {
+            fprintf(stderr,"\nnode %d(%d), sons %d(%d) %d(%d)",
+                    node, tree[node].Freq, n, tree[n].Freq, m, tree[m].Freq);
+        }
+#endif
+        /* and insert the new node in the heap */
+        s->heap[SMALLEST] = node++;
+        pqdownheap(s, tree, SMALLEST);
+
+    } while (s->heap_len >= 2);
+
+    s->heap[--(s->heap_max)] = s->heap[SMALLEST];
+
+    /* At this point, the fields freq and dad are set. We can now
+     * generate the bit lengths.
+     */
+    gen_bitlen(s, (tree_desc *)desc);
+
+    /* The field len is now set, we can generate the bit codes */
+    gen_codes ((ct_data *)tree, max_code, s->bl_count);
+}
+
+/* ===========================================================================
+ * Scan a literal or distance tree to determine the frequencies of the codes
+ * in the bit length tree.
+ */
+local void scan_tree (s, tree, max_code)
+    deflate_state *s;
+    ct_data *tree;   /* the tree to be scanned */
+    int max_code;    /* and its largest code of non zero frequency */
+{
+    int n;                     /* iterates over all tree elements */
+    int prevlen = -1;          /* last emitted length */
+    int curlen;                /* length of current code */
+    int nextlen = tree[0].Len; /* length of next code */
+    int count = 0;             /* repeat count of the current code */
+    int max_count = 7;         /* max repeat count */
+    int min_count = 4;         /* min repeat count */
+
+    if (nextlen == 0) max_count = 138, min_count = 3;
+    tree[max_code+1].Len = (ush)0xffff; /* guard */
+
+    for (n = 0; n <= max_code; n++) {
+        curlen = nextlen; nextlen = tree[n+1].Len;
+        if (++count < max_count && curlen == nextlen) {
+            continue;
+        } else if (count < min_count) {
+            s->bl_tree[curlen].Freq += count;
+        } else if (curlen != 0) {
+            if (curlen != prevlen) s->bl_tree[curlen].Freq++;
+            s->bl_tree[REP_3_6].Freq++;
+        } else if (count <= 10) {
+            s->bl_tree[REPZ_3_10].Freq++;
+        } else {
+            s->bl_tree[REPZ_11_138].Freq++;
+        }
+        count = 0; prevlen = curlen;
+        if (nextlen == 0) {
+            max_count = 138, min_count = 3;
+        } else if (curlen == nextlen) {
+            max_count = 6, min_count = 3;
+        } else {
+            max_count = 7, min_count = 4;
+        }
+    }
+}
+
+/* ===========================================================================
+ * Send a literal or distance tree in compressed form, using the codes in
+ * bl_tree.
+ */
+local void send_tree (s, tree, max_code)
+    deflate_state *s;
+    ct_data *tree; /* the tree to be scanned */
+    int max_code;       /* and its largest code of non zero frequency */
+{
+    int n;                     /* iterates over all tree elements */
+    int prevlen = -1;          /* last emitted length */
+    int curlen;                /* length of current code */
+    int nextlen = tree[0].Len; /* length of next code */
+    int count = 0;             /* repeat count of the current code */
+    int max_count = 7;         /* max repeat count */
+    int min_count = 4;         /* min repeat count */
+
+    /* tree[max_code+1].Len = -1; */  /* guard already set */
+    if (nextlen == 0) max_count = 138, min_count = 3;
+
+    for (n = 0; n <= max_code; n++) {
+        curlen = nextlen; nextlen = tree[n+1].Len;
+        if (++count < max_count && curlen == nextlen) {
+            continue;
+        } else if (count < min_count) {
+            do { send_code(s, curlen, s->bl_tree); } while (--count != 0);
+
+        } else if (curlen != 0) {
+            if (curlen != prevlen) {
+                send_code(s, curlen, s->bl_tree); count--;
+            }
+            Assert(count >= 3 && count <= 6, " 3_6?");
+            send_code(s, REP_3_6, s->bl_tree); send_bits(s, count-3, 2);
+
+        } else if (count <= 10) {
+            send_code(s, REPZ_3_10, s->bl_tree); send_bits(s, count-3, 3);
+
+        } else {
+            send_code(s, REPZ_11_138, s->bl_tree); send_bits(s, count-11, 7);
+        }
+        count = 0; prevlen = curlen;
+        if (nextlen == 0) {
+            max_count = 138, min_count = 3;
+        } else if (curlen == nextlen) {
+            max_count = 6, min_count = 3;
+        } else {
+            max_count = 7, min_count = 4;
+        }
+    }
+}
+
+/* ===========================================================================
+ * Construct the Huffman tree for the bit lengths and return the index in
+ * bl_order of the last bit length code to send.
+ */
+local int build_bl_tree(s)
+    deflate_state *s;
+{
+    int max_blindex;  /* index of last bit length code of non zero freq */
+
+    /* Determine the bit length frequencies for literal and distance trees */
+    scan_tree(s, (ct_data *)s->dyn_ltree, s->l_desc.max_code);
+    scan_tree(s, (ct_data *)s->dyn_dtree, s->d_desc.max_code);
+
+    /* Build the bit length tree: */
+    build_tree(s, (tree_desc *)(&(s->bl_desc)));
+    /* opt_len now includes the length of the tree representations, except
+     * the lengths of the bit lengths codes and the 5+5+4 bits for the counts.
+     */
+
+    /* Determine the number of bit length codes to send. The pkzip format
+     * requires that at least 4 bit length codes be sent. (appnote.txt says
+     * 3 but the actual value used is 4.)
+     */
+    for (max_blindex = BL_CODES-1; max_blindex >= 3; max_blindex--) {
+        if (s->bl_tree[bl_order[max_blindex]].Len != 0) break;
+    }
+    /* Update opt_len to include the bit length tree and counts */
+    s->opt_len += 3*((ulg)max_blindex+1) + 5+5+4;
+    Tracev((stderr, "\ndyn trees: dyn %ld, stat %ld",
+            s->opt_len, s->static_len));
+
+    return max_blindex;
+}
+
+/* ===========================================================================
+ * Send the header for a block using dynamic Huffman trees: the counts, the
+ * lengths of the bit length codes, the literal tree and the distance tree.
+ * IN assertion: lcodes >= 257, dcodes >= 1, blcodes >= 4.
+ */
+local void send_all_trees(s, lcodes, dcodes, blcodes)
+    deflate_state *s;
+    int lcodes, dcodes, blcodes; /* number of codes for each tree */
+{
+    int rank;                    /* index in bl_order */
+
+    Assert (lcodes >= 257 && dcodes >= 1 && blcodes >= 4, "not enough codes");
+    Assert (lcodes <= L_CODES && dcodes <= D_CODES && blcodes <= BL_CODES,
+            "too many codes");
+    Tracev((stderr, "\nbl counts: "));
+    send_bits(s, lcodes-257, 5); /* not +255 as stated in appnote.txt */
+    send_bits(s, dcodes-1,   5);
+    send_bits(s, blcodes-4,  4); /* not -3 as stated in appnote.txt */
+    for (rank = 0; rank < blcodes; rank++) {
+        Tracev((stderr, "\nbl code %2d ", bl_order[rank]));
+        send_bits(s, s->bl_tree[bl_order[rank]].Len, 3);
+    }
+    Tracev((stderr, "\nbl tree: sent %ld", s->bits_sent));
+
+    send_tree(s, (ct_data *)s->dyn_ltree, lcodes-1); /* literal tree */
+    Tracev((stderr, "\nlit tree: sent %ld", s->bits_sent));
+
+    send_tree(s, (ct_data *)s->dyn_dtree, dcodes-1); /* distance tree */
+    Tracev((stderr, "\ndist tree: sent %ld", s->bits_sent));
+}
+
+/* ===========================================================================
+ * Send a stored block
+ */
+void ZLIB_INTERNAL _tr_stored_block(s, buf, stored_len, last)
+    deflate_state *s;
+    charf *buf;       /* input block */
+    ulg stored_len;   /* length of input block */
+    int last;         /* one if this is the last block for a file */
+{
+    send_bits(s, (STORED_BLOCK<<1)+last, 3);    /* send block type */
+    bi_windup(s);        /* align on byte boundary */
+    put_short(s, (ush)stored_len);
+    put_short(s, (ush)~stored_len);
+    zmemcpy(s->pending_buf + s->pending, (Bytef *)buf, stored_len);
+    s->pending += stored_len;
+#ifdef ZLIB_DEBUG
+    s->compressed_len = (s->compressed_len + 3 + 7) & (ulg)~7L;
+    s->compressed_len += (stored_len + 4) << 3;
+    s->bits_sent += 2*16;
+    s->bits_sent += stored_len<<3;
+#endif
+}
+
+/* ===========================================================================
+ * Flush the bits in the bit buffer to pending output (leaves at most 7 bits)
+ */
+void ZLIB_INTERNAL _tr_flush_bits(s)
+    deflate_state *s;
+{
+    bi_flush(s);
+}
+
+/* ===========================================================================
+ * Send one empty static block to give enough lookahead for inflate.
+ * This takes 10 bits, of which 7 may remain in the bit buffer.
+ */
+void ZLIB_INTERNAL _tr_align(s)
+    deflate_state *s;
+{
+    send_bits(s, STATIC_TREES<<1, 3);
+    send_code(s, END_BLOCK, static_ltree);
+#ifdef ZLIB_DEBUG
+    s->compressed_len += 10L; /* 3 for block type, 7 for EOB */
+#endif
+    bi_flush(s);
+}
+
+/* ===========================================================================
+ * Determine the best encoding for the current block: dynamic trees, static
+ * trees or store, and write out the encoded block.
+ */
+void ZLIB_INTERNAL _tr_flush_block(s, buf, stored_len, last)
+    deflate_state *s;
+    charf *buf;       /* input block, or NULL if too old */
+    ulg stored_len;   /* length of input block */
+    int last;         /* one if this is the last block for a file */
+{
+    ulg opt_lenb, static_lenb; /* opt_len and static_len in bytes */
+    int max_blindex = 0;  /* index of last bit length code of non zero freq */
+
+    /* Build the Huffman trees unless a stored block is forced */
+    if (s->level > 0) {
+
+        /* Check if the file is binary or text */
+        if (s->strm->data_type == Z_UNKNOWN)
+            s->strm->data_type = detect_data_type(s);
+
+        /* Construct the literal and distance trees */
+        build_tree(s, (tree_desc *)(&(s->l_desc)));
+        Tracev((stderr, "\nlit data: dyn %ld, stat %ld", s->opt_len,
+                s->static_len));
+
+        build_tree(s, (tree_desc *)(&(s->d_desc)));
+        Tracev((stderr, "\ndist data: dyn %ld, stat %ld", s->opt_len,
+                s->static_len));
+        /* At this point, opt_len and static_len are the total bit lengths of
+         * the compressed block data, excluding the tree representations.
+         */
+
+        /* Build the bit length tree for the above two trees, and get the index
+         * in bl_order of the last bit length code to send.
+         */
+        max_blindex = build_bl_tree(s);
+
+        /* Determine the best encoding. Compute the block lengths in bytes. */
+        opt_lenb = (s->opt_len+3+7)>>3;
+        static_lenb = (s->static_len+3+7)>>3;
+
+        Tracev((stderr, "\nopt %lu(%lu) stat %lu(%lu) stored %lu lit %u ",
+                opt_lenb, s->opt_len, static_lenb, s->static_len, stored_len,
+                s->sym_next / 3));
+
+        if (static_lenb <= opt_lenb) opt_lenb = static_lenb;
+
+    } else {
+        Assert(buf != (char*)0, "lost buf");
+        opt_lenb = static_lenb = stored_len + 5; /* force a stored block */
+    }
+
+#ifdef FORCE_STORED
+    if (buf != (char*)0) { /* force stored block */
+#else
+    if (stored_len+4 <= opt_lenb && buf != (char*)0) {
+                       /* 4: two words for the lengths */
+#endif
+        /* The test buf != NULL is only necessary if LIT_BUFSIZE > WSIZE.
+         * Otherwise we can't have processed more than WSIZE input bytes since
+         * the last block flush, because compression would have been
+         * successful. If LIT_BUFSIZE <= WSIZE, it is never too late to
+         * transform a block into a stored block.
+         */
+        _tr_stored_block(s, buf, stored_len, last);
+
+#ifdef FORCE_STATIC
+    } else if (static_lenb >= 0) { /* force static trees */
+#else
+    } else if (s->strategy == Z_FIXED || static_lenb == opt_lenb) {
+#endif
+        send_bits(s, (STATIC_TREES<<1)+last, 3);
+        compress_block(s, (const ct_data *)static_ltree,
+                       (const ct_data *)static_dtree);
+#ifdef ZLIB_DEBUG
+        s->compressed_len += 3 + s->static_len;
+#endif
+    } else {
+        send_bits(s, (DYN_TREES<<1)+last, 3);
+        send_all_trees(s, s->l_desc.max_code+1, s->d_desc.max_code+1,
+                       max_blindex+1);
+        compress_block(s, (const ct_data *)s->dyn_ltree,
+                       (const ct_data *)s->dyn_dtree);
+#ifdef ZLIB_DEBUG
+        s->compressed_len += 3 + s->opt_len;
+#endif
+    }
+    Assert (s->compressed_len == s->bits_sent, "bad compressed size");
+    /* The above check is made mod 2^32, for files larger than 512 MB
+     * and uLong implemented on 32 bits.
+     */
+    init_block(s);
+
+    if (last) {
+        bi_windup(s);
+#ifdef ZLIB_DEBUG
+        s->compressed_len += 7;  /* align on byte boundary */
+#endif
+    }
+    Tracev((stderr,"\ncomprlen %lu(%lu) ", s->compressed_len>>3,
+           s->compressed_len-7*last));
+}
+
+/* ===========================================================================
+ * Save the match info and tally the frequency counts. Return true if
+ * the current block must be flushed.
+ */
+int ZLIB_INTERNAL _tr_tally (s, dist, lc)
+    deflate_state *s;
+    unsigned dist;  /* distance of matched string */
+    unsigned lc;    /* match length-MIN_MATCH or unmatched char (if dist==0) */
+{
+    s->sym_buf[s->sym_next++] = dist;
+    s->sym_buf[s->sym_next++] = dist >> 8;
+    s->sym_buf[s->sym_next++] = lc;
+    if (dist == 0) {
+        /* lc is the unmatched char */
+        s->dyn_ltree[lc].Freq++;
+    } else {
+        s->matches++;
+        /* Here, lc is the match length - MIN_MATCH */
+        dist--;             /* dist = match distance - 1 */
+        Assert((ush)dist < (ush)MAX_DIST(s) &&
+               (ush)lc <= (ush)(MAX_MATCH-MIN_MATCH) &&
+               (ush)d_code(dist) < (ush)D_CODES,  "_tr_tally: bad match");
+
+        s->dyn_ltree[_length_code[lc]+LITERALS+1].Freq++;
+        s->dyn_dtree[d_code(dist)].Freq++;
+    }
+    return (s->sym_next == s->sym_end);
+}
+
+/* ===========================================================================
+ * Send the block data compressed using the given Huffman trees
+ */
+local void compress_block(s, ltree, dtree)
+    deflate_state *s;
+    const ct_data *ltree; /* literal tree */
+    const ct_data *dtree; /* distance tree */
+{
+    unsigned dist;      /* distance of matched string */
+    int lc;             /* match length or unmatched char (if dist == 0) */
+    unsigned sx = 0;    /* running index in sym_buf */
+    unsigned code;      /* the code to send */
+    int extra;          /* number of extra bits to send */
+
+    if (s->sym_next != 0) do {
+        dist = s->sym_buf[sx++] & 0xff;
+        dist += (unsigned)(s->sym_buf[sx++] & 0xff) << 8;
+        lc = s->sym_buf[sx++];
+        if (dist == 0) {
+            send_code(s, lc, ltree); /* send a literal byte */
+            Tracecv(isgraph(lc), (stderr," '%c' ", lc));
+        } else {
+            /* Here, lc is the match length - MIN_MATCH */
+            code = _length_code[lc];
+            send_code(s, code+LITERALS+1, ltree); /* send the length code */
+            extra = extra_lbits[code];
+            if (extra != 0) {
+                lc -= base_length[code];
+                send_bits(s, lc, extra);       /* send the extra length bits */
+            }
+            dist--; /* dist is now the match distance - 1 */
+            code = d_code(dist);
+            Assert (code < D_CODES, "bad d_code");
+
+            send_code(s, code, dtree);       /* send the distance code */
+            extra = extra_dbits[code];
+            if (extra != 0) {
+                dist -= (unsigned)base_dist[code];
+                send_bits(s, dist, extra);   /* send the extra distance bits */
+            }
+        } /* literal or match pair ? */
+
+        /* Check that the overlay between pending_buf and sym_buf is ok: */
+        Assert(s->pending < s->lit_bufsize + sx, "pendingBuf overflow");
+
+    } while (sx < s->sym_next);
+
+    send_code(s, END_BLOCK, ltree);
+}
+
+/* ===========================================================================
+ * Check if the data type is TEXT or BINARY, using the following algorithm:
+ * - TEXT if the two conditions below are satisfied:
+ *    a) There are no non-portable control characters belonging to the
+ *       "black list" (0..6, 14..25, 28..31).
+ *    b) There is at least one printable character belonging to the
+ *       "white list" (9 {TAB}, 10 {LF}, 13 {CR}, 32..255).
+ * - BINARY otherwise.
+ * - The following partially-portable control characters form a
+ *   "gray list" that is ignored in this detection algorithm:
+ *   (7 {BEL}, 8 {BS}, 11 {VT}, 12 {FF}, 26 {SUB}, 27 {ESC}).
+ * IN assertion: the fields Freq of dyn_ltree are set.
+ */
+local int detect_data_type(s)
+    deflate_state *s;
+{
+    /* black_mask is the bit mask of black-listed bytes
+     * set bits 0..6, 14..25, and 28..31
+     * 0xf3ffc07f = binary 11110011111111111100000001111111
+     */
+    unsigned long black_mask = 0xf3ffc07fUL;
+    int n;
+
+    /* Check for non-textual ("black-listed") bytes. */
+    for (n = 0; n <= 31; n++, black_mask >>= 1)
+        if ((black_mask & 1) && (s->dyn_ltree[n].Freq != 0))
+            return Z_BINARY;
+
+    /* Check for textual ("white-listed") bytes. */
+    if (s->dyn_ltree[9].Freq != 0 || s->dyn_ltree[10].Freq != 0
+            || s->dyn_ltree[13].Freq != 0)
+        return Z_TEXT;
+    for (n = 32; n < LITERALS; n++)
+        if (s->dyn_ltree[n].Freq != 0)
+            return Z_TEXT;
+
+    /* There are no "black-listed" or "white-listed" bytes:
+     * this stream either is empty or has tolerated ("gray-listed") bytes only.
+     */
+    return Z_BINARY;
+}
+
+/* ===========================================================================
+ * Reverse the first len bits of a code, using straightforward code (a faster
+ * method would use a table)
+ * IN assertion: 1 <= len <= 15
+ */
+local unsigned bi_reverse(code, len)
+    unsigned code; /* the value to invert */
+    int len;       /* its bit length */
+{
+    register unsigned res = 0;
+    do {
+        res |= code & 1;
+        code >>= 1, res <<= 1;
+    } while (--len > 0);
+    return res >> 1;
+}
+
+/* ===========================================================================
+ * Flush the bit buffer, keeping at most 7 bits in it.
+ */
+local void bi_flush(s)
+    deflate_state *s;
+{
+    if (s->bi_valid == 16) {
+        put_short(s, s->bi_buf);
+        s->bi_buf = 0;
+        s->bi_valid = 0;
+    } else if (s->bi_valid >= 8) {
+        put_byte(s, (Byte)s->bi_buf);
+        s->bi_buf >>= 8;
+        s->bi_valid -= 8;
+    }
+}
+
+/* ===========================================================================
+ * Flush the bit buffer and align the output on a byte boundary
+ */
+local void bi_windup(s)
+    deflate_state *s;
+{
+    if (s->bi_valid > 8) {
+        put_short(s, s->bi_buf);
+    } else if (s->bi_valid > 0) {
+        put_byte(s, (Byte)s->bi_buf);
+    }
+    s->bi_buf = 0;
+    s->bi_valid = 0;
+#ifdef ZLIB_DEBUG
+    s->bits_sent = (s->bits_sent+7) & ~7;
+#endif
+}
diff --git a/deps/v8/third_party/zlib/trees.h b/deps/v8/third_party/zlib/trees.h
new file mode 100644
index 00000000000000..45a749f0cc2347
--- /dev/null
+++ b/deps/v8/third_party/zlib/trees.h
@@ -0,0 +1,127 @@
+/* header created automatically with -DGEN_TREES_H */
+
+local const ct_data static_ltree[L_CODES+2] = {
+{{ 12},{  8}}, {{140},{  8}}, {{ 76},{  8}}, {{204},{  8}}, {{ 44},{  8}},
+{{172},{  8}}, {{108},{  8}}, {{236},{  8}}, {{ 28},{  8}}, {{156},{  8}},
+{{ 92},{  8}}, {{220},{  8}}, {{ 60},{  8}}, {{188},{  8}}, {{124},{  8}},
+{{252},{  8}}, {{  2},{  8}}, {{130},{  8}}, {{ 66},{  8}}, {{194},{  8}},
+{{ 34},{  8}}, {{162},{  8}}, {{ 98},{  8}}, {{226},{  8}}, {{ 18},{  8}},
+{{146},{  8}}, {{ 82},{  8}}, {{210},{  8}}, {{ 50},{  8}}, {{178},{  8}},
+{{114},{  8}}, {{242},{  8}}, {{ 10},{  8}}, {{138},{  8}}, {{ 74},{  8}},
+{{202},{  8}}, {{ 42},{  8}}, {{170},{  8}}, {{106},{  8}}, {{234},{  8}},
+{{ 26},{  8}}, {{154},{  8}}, {{ 90},{  8}}, {{218},{  8}}, {{ 58},{  8}},
+{{186},{  8}}, {{122},{  8}}, {{250},{  8}}, {{  6},{  8}}, {{134},{  8}},
+{{ 70},{  8}}, {{198},{  8}}, {{ 38},{  8}}, {{166},{  8}}, {{102},{  8}},
+{{230},{  8}}, {{ 22},{  8}}, {{150},{  8}}, {{ 86},{  8}}, {{214},{  8}},
+{{ 54},{  8}}, {{182},{  8}}, {{118},{  8}}, {{246},{  8}}, {{ 14},{  8}},
+{{142},{  8}}, {{ 78},{  8}}, {{206},{  8}}, {{ 46},{  8}}, {{174},{  8}},
+{{110},{  8}}, {{238},{  8}}, {{ 30},{  8}}, {{158},{  8}}, {{ 94},{  8}},
+{{222},{  8}}, {{ 62},{  8}}, {{190},{  8}}, {{126},{  8}}, {{254},{  8}},
+{{  1},{  8}}, {{129},{  8}}, {{ 65},{  8}}, {{193},{  8}}, {{ 33},{  8}},
+{{161},{  8}}, {{ 97},{  8}}, {{225},{  8}}, {{ 17},{  8}}, {{145},{  8}},
+{{ 81},{  8}}, {{209},{  8}}, {{ 49},{  8}}, {{177},{  8}}, {{113},{  8}},
+{{241},{  8}}, {{  9},{  8}}, {{137},{  8}}, {{ 73},{  8}}, {{201},{  8}},
+{{ 41},{  8}}, {{169},{  8}}, {{105},{  8}}, {{233},{  8}}, {{ 25},{  8}},
+{{153},{  8}}, {{ 89},{  8}}, {{217},{  8}}, {{ 57},{  8}}, {{185},{  8}},
+{{121},{  8}}, {{249},{  8}}, {{  5},{  8}}, {{133},{  8}}, {{ 69},{  8}},
+{{197},{  8}}, {{ 37},{  8}}, {{165},{  8}}, {{101},{  8}}, {{229},{  8}},
+{{ 21},{  8}}, {{149},{  8}}, {{ 85},{  8}}, {{213},{  8}}, {{ 53},{  8}},
+{{181},{  8}}, {{117},{  8}}, {{245},{  8}}, {{ 13},{  8}}, {{141},{  8}},
+{{ 77},{  8}}, {{205},{  8}}, {{ 45},{  8}}, {{173},{  8}}, {{109},{  8}},
+{{237},{  8}}, {{ 29},{  8}}, {{157},{  8}}, {{ 93},{  8}}, {{221},{  8}},
+{{ 61},{  8}}, {{189},{  8}}, {{125},{  8}}, {{253},{  8}}, {{ 19},{  9}},
+{{275},{  9}}, {{147},{  9}}, {{403},{  9}}, {{ 83},{  9}}, {{339},{  9}},
+{{211},{  9}}, {{467},{  9}}, {{ 51},{  9}}, {{307},{  9}}, {{179},{  9}},
+{{435},{  9}}, {{115},{  9}}, {{371},{  9}}, {{243},{  9}}, {{499},{  9}},
+{{ 11},{  9}}, {{267},{  9}}, {{139},{  9}}, {{395},{  9}}, {{ 75},{  9}},
+{{331},{  9}}, {{203},{  9}}, {{459},{  9}}, {{ 43},{  9}}, {{299},{  9}},
+{{171},{  9}}, {{427},{  9}}, {{107},{  9}}, {{363},{  9}}, {{235},{  9}},
+{{491},{  9}}, {{ 27},{  9}}, {{283},{  9}}, {{155},{  9}}, {{411},{  9}},
+{{ 91},{  9}}, {{347},{  9}}, {{219},{  9}}, {{475},{  9}}, {{ 59},{  9}},
+{{315},{  9}}, {{187},{  9}}, {{443},{  9}}, {{123},{  9}}, {{379},{  9}},
+{{251},{  9}}, {{507},{  9}}, {{  7},{  9}}, {{263},{  9}}, {{135},{  9}},
+{{391},{  9}}, {{ 71},{  9}}, {{327},{  9}}, {{199},{  9}}, {{455},{  9}},
+{{ 39},{  9}}, {{295},{  9}}, {{167},{  9}}, {{423},{  9}}, {{103},{  9}},
+{{359},{  9}}, {{231},{  9}}, {{487},{  9}}, {{ 23},{  9}}, {{279},{  9}},
+{{151},{  9}}, {{407},{  9}}, {{ 87},{  9}}, {{343},{  9}}, {{215},{  9}},
+{{471},{  9}}, {{ 55},{  9}}, {{311},{  9}}, {{183},{  9}}, {{439},{  9}},
+{{119},{  9}}, {{375},{  9}}, {{247},{  9}}, {{503},{  9}}, {{ 15},{  9}},
+{{271},{  9}}, {{143},{  9}}, {{399},{  9}}, {{ 79},{  9}}, {{335},{  9}},
+{{207},{  9}}, {{463},{  9}}, {{ 47},{  9}}, {{303},{  9}}, {{175},{  9}},
+{{431},{  9}}, {{111},{  9}}, {{367},{  9}}, {{239},{  9}}, {{495},{  9}},
+{{ 31},{  9}}, {{287},{  9}}, {{159},{  9}}, {{415},{  9}}, {{ 95},{  9}},
+{{351},{  9}}, {{223},{  9}}, {{479},{  9}}, {{ 63},{  9}}, {{319},{  9}},
+{{191},{  9}}, {{447},{  9}}, {{127},{  9}}, {{383},{  9}}, {{255},{  9}},
+{{511},{  9}}, {{  0},{  7}}, {{ 64},{  7}}, {{ 32},{  7}}, {{ 96},{  7}},
+{{ 16},{  7}}, {{ 80},{  7}}, {{ 48},{  7}}, {{112},{  7}}, {{  8},{  7}},
+{{ 72},{  7}}, {{ 40},{  7}}, {{104},{  7}}, {{ 24},{  7}}, {{ 88},{  7}},
+{{ 56},{  7}}, {{120},{  7}}, {{  4},{  7}}, {{ 68},{  7}}, {{ 36},{  7}},
+{{100},{  7}}, {{ 20},{  7}}, {{ 84},{  7}}, {{ 52},{  7}}, {{116},{  7}},
+{{  3},{  8}}, {{131},{  8}}, {{ 67},{  8}}, {{195},{  8}}, {{ 35},{  8}},
+{{163},{  8}}, {{ 99},{  8}}, {{227},{  8}}
+};
+
+local const ct_data static_dtree[D_CODES] = {
+{{ 0},{ 5}}, {{16},{ 5}}, {{ 8},{ 5}}, {{24},{ 5}}, {{ 4},{ 5}},
+{{20},{ 5}}, {{12},{ 5}}, {{28},{ 5}}, {{ 2},{ 5}}, {{18},{ 5}},
+{{10},{ 5}}, {{26},{ 5}}, {{ 6},{ 5}}, {{22},{ 5}}, {{14},{ 5}},
+{{30},{ 5}}, {{ 1},{ 5}}, {{17},{ 5}}, {{ 9},{ 5}}, {{25},{ 5}},
+{{ 5},{ 5}}, {{21},{ 5}}, {{13},{ 5}}, {{29},{ 5}}, {{ 3},{ 5}},
+{{19},{ 5}}, {{11},{ 5}}, {{27},{ 5}}, {{ 7},{ 5}}, {{23},{ 5}}
+};
+
+const uch ZLIB_INTERNAL _dist_code[DIST_CODE_LEN] = {
+ 0,  1,  2,  3,  4,  4,  5,  5,  6,  6,  6,  6,  7,  7,  7,  7,  8,  8,  8,  8,
+ 8,  8,  8,  8,  9,  9,  9,  9,  9,  9,  9,  9, 10, 10, 10, 10, 10, 10, 10, 10,
+10, 10, 10, 10, 10, 10, 10, 10, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11,
+11, 11, 11, 11, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12,
+12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 13, 13, 13, 13,
+13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13,
+13, 13, 13, 13, 13, 13, 13, 13, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14,
+14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14,
+14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14,
+14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 15, 15, 15, 15, 15, 15, 15, 15,
+15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15,
+15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15,
+15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15,  0,  0, 16, 17,
+18, 18, 19, 19, 20, 20, 20, 20, 21, 21, 21, 21, 22, 22, 22, 22, 22, 22, 22, 22,
+23, 23, 23, 23, 23, 23, 23, 23, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24,
+24, 24, 24, 24, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
+26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26,
+26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 27, 27, 27, 27, 27, 27, 27, 27,
+27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27,
+27, 27, 27, 27, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28,
+28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28,
+28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28,
+28, 28, 28, 28, 28, 28, 28, 28, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29,
+29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29,
+29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29,
+29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29
+};
+
+const uch ZLIB_INTERNAL _length_code[MAX_MATCH-MIN_MATCH+1]= {
+ 0,  1,  2,  3,  4,  5,  6,  7,  8,  8,  9,  9, 10, 10, 11, 11, 12, 12, 12, 12,
+13, 13, 13, 13, 14, 14, 14, 14, 15, 15, 15, 15, 16, 16, 16, 16, 16, 16, 16, 16,
+17, 17, 17, 17, 17, 17, 17, 17, 18, 18, 18, 18, 18, 18, 18, 18, 19, 19, 19, 19,
+19, 19, 19, 19, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20,
+21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 22, 22, 22, 22,
+22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 23, 23, 23, 23, 23, 23, 23, 23,
+23, 23, 23, 23, 23, 23, 23, 23, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24,
+24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24,
+25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
+25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 26, 26, 26, 26, 26, 26, 26, 26,
+26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26,
+26, 26, 26, 26, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27,
+27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 28
+};
+
+local const int base_length[LENGTH_CODES] = {
+0, 1, 2, 3, 4, 5, 6, 7, 8, 10, 12, 14, 16, 20, 24, 28, 32, 40, 48, 56,
+64, 80, 96, 112, 128, 160, 192, 224, 0
+};
+
+local const int base_dist[D_CODES] = {
+    0,     1,     2,     3,     4,     6,     8,    12,    16,    24,
+   32,    48,    64,    96,   128,   192,   256,   384,   512,   768,
+ 1024,  1536,  2048,  3072,  4096,  6144,  8192, 12288, 16384, 24576
+};
diff --git a/deps/v8/third_party/zlib/uncompr.c b/deps/v8/third_party/zlib/uncompr.c
new file mode 100644
index 00000000000000..f03a1a865e347d
--- /dev/null
+++ b/deps/v8/third_party/zlib/uncompr.c
@@ -0,0 +1,93 @@
+/* uncompr.c -- decompress a memory buffer
+ * Copyright (C) 1995-2003, 2010, 2014, 2016 Jean-loup Gailly, Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/* @(#) $Id$ */
+
+#define ZLIB_INTERNAL
+#include "zlib.h"
+
+/* ===========================================================================
+     Decompresses the source buffer into the destination buffer.  *sourceLen is
+   the byte length of the source buffer. Upon entry, *destLen is the total size
+   of the destination buffer, which must be large enough to hold the entire
+   uncompressed data. (The size of the uncompressed data must have been saved
+   previously by the compressor and transmitted to the decompressor by some
+   mechanism outside the scope of this compression library.) Upon exit,
+   *destLen is the size of the decompressed data and *sourceLen is the number
+   of source bytes consumed. Upon return, source + *sourceLen points to the
+   first unused input byte.
+
+     uncompress returns Z_OK if success, Z_MEM_ERROR if there was not enough
+   memory, Z_BUF_ERROR if there was not enough room in the output buffer, or
+   Z_DATA_ERROR if the input data was corrupted, including if the input data is
+   an incomplete zlib stream.
+*/
+int ZEXPORT uncompress2 (dest, destLen, source, sourceLen)
+    Bytef *dest;
+    uLongf *destLen;
+    const Bytef *source;
+    uLong *sourceLen;
+{
+    z_stream stream;
+    int err;
+    const uInt max = (uInt)-1;
+    uLong len, left;
+    Byte buf[1];    /* for detection of incomplete stream when *destLen == 0 */
+
+    len = *sourceLen;
+    if (*destLen) {
+        left = *destLen;
+        *destLen = 0;
+    }
+    else {
+        left = 1;
+        dest = buf;
+    }
+
+    stream.next_in = (z_const Bytef *)source;
+    stream.avail_in = 0;
+    stream.zalloc = (alloc_func)0;
+    stream.zfree = (free_func)0;
+    stream.opaque = (voidpf)0;
+
+    err = inflateInit(&stream);
+    if (err != Z_OK) return err;
+
+    stream.next_out = dest;
+    stream.avail_out = 0;
+
+    do {
+        if (stream.avail_out == 0) {
+            stream.avail_out = left > (uLong)max ? max : (uInt)left;
+            left -= stream.avail_out;
+        }
+        if (stream.avail_in == 0) {
+            stream.avail_in = len > (uLong)max ? max : (uInt)len;
+            len -= stream.avail_in;
+        }
+        err = inflate(&stream, Z_NO_FLUSH);
+    } while (err == Z_OK);
+
+    *sourceLen -= len + stream.avail_in;
+    if (dest != buf)
+        *destLen = stream.total_out;
+    else if (stream.total_out && err == Z_BUF_ERROR)
+        left = 1;
+
+    inflateEnd(&stream);
+    return err == Z_STREAM_END ? Z_OK :
+           err == Z_NEED_DICT ? Z_DATA_ERROR  :
+           err == Z_BUF_ERROR && left + stream.avail_out ? Z_DATA_ERROR :
+           err;
+}
+
+int ZEXPORT uncompress (dest, destLen, source, sourceLen)
+    Bytef *dest;
+    uLongf *destLen;
+    const Bytef *source;
+    uLong sourceLen;
+{
+    return uncompress2(dest, destLen, source, &sourceLen);
+}
diff --git a/deps/v8/third_party/zlib/zconf.h b/deps/v8/third_party/zlib/zconf.h
new file mode 100644
index 00000000000000..2d1d03ff951c92
--- /dev/null
+++ b/deps/v8/third_party/zlib/zconf.h
@@ -0,0 +1,549 @@
+/* zconf.h -- configuration of the zlib compression library
+ * Copyright (C) 1995-2016 Jean-loup Gailly, Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/* @(#) $Id$ */
+
+#ifndef ZCONF_H
+#define ZCONF_H
+
+/*
+ * This library is also built as a part of AOSP, which does not need to include
+ * chromeconf.h. This config does not want chromeconf.h, so it can set this
+ * macro to opt out. While this works today, there's no guarantee that building
+ * zlib outside of Chromium keeps working in the future.
+ */
+#if !defined(CHROMIUM_ZLIB_NO_CHROMECONF)
+/* This include does prefixing as below, but with an updated set of names.  Also
+ * sets up export macros in component builds. */
+#include "chromeconf.h"
+#endif
+
+/*
+ * If you *really* need a unique prefix for all types and library functions,
+ * compile with -DZ_PREFIX. The "standard" zlib should be compiled without it.
+ * Even better than compiling with -DZ_PREFIX would be to use configure to set
+ * this permanently in zconf.h using "./configure --zprefix".
+ */
+#ifdef Z_PREFIX     /* may be set to #if 1 by ./configure */
+#  define Z_PREFIX_SET
+
+/* all linked symbols and init macros */
+#  define _dist_code            z__dist_code
+#  define _length_code          z__length_code
+#  define _tr_align             z__tr_align
+#  define _tr_flush_bits        z__tr_flush_bits
+#  define _tr_flush_block       z__tr_flush_block
+#  define _tr_init              z__tr_init
+#  define _tr_stored_block      z__tr_stored_block
+#  define _tr_tally             z__tr_tally
+#  define adler32               z_adler32
+#  define adler32_combine       z_adler32_combine
+#  define adler32_combine64     z_adler32_combine64
+#  define adler32_z             z_adler32_z
+#  ifndef Z_SOLO
+#    define compress              z_compress
+#    define compress2             z_compress2
+#    define compressBound         z_compressBound
+#  endif
+#  define crc32                 z_crc32
+#  define crc32_combine         z_crc32_combine
+#  define crc32_combine64       z_crc32_combine64
+#  define crc32_z               z_crc32_z
+#  define deflate               z_deflate
+#  define deflateBound          z_deflateBound
+#  define deflateCopy           z_deflateCopy
+#  define deflateEnd            z_deflateEnd
+#  define deflateGetDictionary  z_deflateGetDictionary
+#  define deflateInit           z_deflateInit
+#  define deflateInit2          z_deflateInit2
+#  define deflateInit2_         z_deflateInit2_
+#  define deflateInit_          z_deflateInit_
+#  define deflateParams         z_deflateParams
+#  define deflatePending        z_deflatePending
+#  define deflatePrime          z_deflatePrime
+#  define deflateReset          z_deflateReset
+#  define deflateResetKeep      z_deflateResetKeep
+#  define deflateSetDictionary  z_deflateSetDictionary
+#  define deflateSetHeader      z_deflateSetHeader
+#  define deflateTune           z_deflateTune
+#  define deflate_copyright     z_deflate_copyright
+#  define get_crc_table         z_get_crc_table
+#  ifndef Z_SOLO
+#    define gz_error              z_gz_error
+#    define gz_intmax             z_gz_intmax
+#    define gz_strwinerror        z_gz_strwinerror
+#    define gzbuffer              z_gzbuffer
+#    define gzclearerr            z_gzclearerr
+#    define gzclose               z_gzclose
+#    define gzclose_r             z_gzclose_r
+#    define gzclose_w             z_gzclose_w
+#    define gzdirect              z_gzdirect
+#    define gzdopen               z_gzdopen
+#    define gzeof                 z_gzeof
+#    define gzerror               z_gzerror
+#    define gzflush               z_gzflush
+#    define gzfread               z_gzfread
+#    define gzfwrite              z_gzfwrite
+#    define gzgetc                z_gzgetc
+#    define gzgetc_               z_gzgetc_
+#    define gzgets                z_gzgets
+#    define gzoffset              z_gzoffset
+#    define gzoffset64            z_gzoffset64
+#    define gzopen                z_gzopen
+#    define gzopen64              z_gzopen64
+#    ifdef _WIN32
+#      define gzopen_w              z_gzopen_w
+#    endif
+#    define gzprintf              z_gzprintf
+#    define gzputc                z_gzputc
+#    define gzputs                z_gzputs
+#    define gzread                z_gzread
+#    define gzrewind              z_gzrewind
+#    define gzseek                z_gzseek
+#    define gzseek64              z_gzseek64
+#    define gzsetparams           z_gzsetparams
+#    define gztell                z_gztell
+#    define gztell64              z_gztell64
+#    define gzungetc              z_gzungetc
+#    define gzvprintf             z_gzvprintf
+#    define gzwrite               z_gzwrite
+#  endif
+#  define inflate               z_inflate
+#  define inflateBack           z_inflateBack
+#  define inflateBackEnd        z_inflateBackEnd
+#  define inflateBackInit       z_inflateBackInit
+#  define inflateBackInit_      z_inflateBackInit_
+#  define inflateCodesUsed      z_inflateCodesUsed
+#  define inflateCopy           z_inflateCopy
+#  define inflateEnd            z_inflateEnd
+#  define inflateGetDictionary  z_inflateGetDictionary
+#  define inflateGetHeader      z_inflateGetHeader
+#  define inflateInit           z_inflateInit
+#  define inflateInit2          z_inflateInit2
+#  define inflateInit2_         z_inflateInit2_
+#  define inflateInit_          z_inflateInit_
+#  define inflateMark           z_inflateMark
+#  define inflatePrime          z_inflatePrime
+#  define inflateReset          z_inflateReset
+#  define inflateReset2         z_inflateReset2
+#  define inflateResetKeep      z_inflateResetKeep
+#  define inflateSetDictionary  z_inflateSetDictionary
+#  define inflateSync           z_inflateSync
+#  define inflateSyncPoint      z_inflateSyncPoint
+#  define inflateUndermine      z_inflateUndermine
+#  define inflateValidate       z_inflateValidate
+#  define inflate_copyright     z_inflate_copyright
+#  define inflate_fast          z_inflate_fast
+#  define inflate_table         z_inflate_table
+#  ifndef Z_SOLO
+#    define uncompress            z_uncompress
+#    define uncompress2           z_uncompress2
+#  endif
+#  define zError                z_zError
+#  ifndef Z_SOLO
+#    define zcalloc               z_zcalloc
+#    define zcfree                z_zcfree
+#  endif
+#  define zlibCompileFlags      z_zlibCompileFlags
+#  define zlibVersion           z_zlibVersion
+
+/* all zlib typedefs in zlib.h and zconf.h */
+#  define Byte                  z_Byte
+#  define Bytef                 z_Bytef
+#  define alloc_func            z_alloc_func
+#  define charf                 z_charf
+#  define free_func             z_free_func
+#  ifndef Z_SOLO
+#    define gzFile                z_gzFile
+#  endif
+#  define gz_header             z_gz_header
+#  define gz_headerp            z_gz_headerp
+#  define in_func               z_in_func
+#  define intf                  z_intf
+#  define out_func              z_out_func
+#  define uInt                  z_uInt
+#  define uIntf                 z_uIntf
+#  define uLong                 z_uLong
+#  define uLongf                z_uLongf
+#  define voidp                 z_voidp
+#  define voidpc                z_voidpc
+#  define voidpf                z_voidpf
+
+/* all zlib structs in zlib.h and zconf.h */
+#  define gz_header_s           z_gz_header_s
+#  define internal_state        z_internal_state
+
+#endif
+
+#if defined(__MSDOS__) && !defined(MSDOS)
+#  define MSDOS
+#endif
+#if (defined(OS_2) || defined(__OS2__)) && !defined(OS2)
+#  define OS2
+#endif
+#if defined(_WINDOWS) && !defined(WINDOWS)
+#  define WINDOWS
+#endif
+#if defined(_WIN32) || defined(_WIN32_WCE) || defined(__WIN32__)
+#  ifndef WIN32
+#    define WIN32
+#  endif
+#endif
+#if (defined(MSDOS) || defined(OS2) || defined(WINDOWS)) && !defined(WIN32)
+#  if !defined(__GNUC__) && !defined(__FLAT__) && !defined(__386__)
+#    ifndef SYS16BIT
+#      define SYS16BIT
+#    endif
+#  endif
+#endif
+
+/*
+ * Compile with -DMAXSEG_64K if the alloc function cannot allocate more
+ * than 64k bytes at a time (needed on systems with 16-bit int).
+ */
+#ifdef SYS16BIT
+#  define MAXSEG_64K
+#endif
+#ifdef MSDOS
+#  define UNALIGNED_OK
+#endif
+
+#ifdef __STDC_VERSION__
+#  ifndef STDC
+#    define STDC
+#  endif
+#  if __STDC_VERSION__ >= 199901L
+#    ifndef STDC99
+#      define STDC99
+#    endif
+#  endif
+#endif
+#if !defined(STDC) && (defined(__STDC__) || defined(__cplusplus))
+#  define STDC
+#endif
+#if !defined(STDC) && (defined(__GNUC__) || defined(__BORLANDC__))
+#  define STDC
+#endif
+#if !defined(STDC) && (defined(MSDOS) || defined(WINDOWS) || defined(WIN32))
+#  define STDC
+#endif
+#if !defined(STDC) && (defined(OS2) || defined(__HOS_AIX__))
+#  define STDC
+#endif
+
+#if defined(__OS400__) && !defined(STDC)    /* iSeries (formerly AS/400). */
+#  define STDC
+#endif
+
+#ifndef STDC
+#  ifndef const /* cannot use !defined(STDC) && !defined(const) on Mac */
+#    define const       /* note: need a more gentle solution here */
+#  endif
+#endif
+
+#if defined(ZLIB_CONST) && !defined(z_const)
+#  define z_const const
+#else
+#  define z_const
+#endif
+
+#ifdef Z_SOLO
+   typedef unsigned long z_size_t;
+#else
+#  define z_longlong long long
+#  if defined(NO_SIZE_T)
+     typedef unsigned NO_SIZE_T z_size_t;
+#  elif defined(STDC)
+#    include <stddef.h>
+     typedef size_t z_size_t;
+#  else
+     typedef unsigned long z_size_t;
+#  endif
+#  undef z_longlong
+#endif
+
+/* Maximum value for memLevel in deflateInit2 */
+#ifndef MAX_MEM_LEVEL
+#  ifdef MAXSEG_64K
+#    define MAX_MEM_LEVEL 8
+#  else
+#    define MAX_MEM_LEVEL 9
+#  endif
+#endif
+
+/* Maximum value for windowBits in deflateInit2 and inflateInit2.
+ * WARNING: reducing MAX_WBITS makes minigzip unable to extract .gz files
+ * created by gzip. (Files created by minigzip can still be extracted by
+ * gzip.)
+ */
+#ifndef MAX_WBITS
+#  define MAX_WBITS   15 /* 32K LZ77 window */
+#endif
+
+/* The memory requirements for deflate are (in bytes):
+            (1 << (windowBits+2)) +  (1 << (memLevel+9))
+ that is: 128K for windowBits=15  +  128K for memLevel = 8  (default values)
+ plus a few kilobytes for small objects. For example, if you want to reduce
+ the default memory requirements from 256K to 128K, compile with
+     make CFLAGS="-O -DMAX_WBITS=14 -DMAX_MEM_LEVEL=7"
+ Of course this will generally degrade compression (there's no free lunch).
+
+   The memory requirements for inflate are (in bytes) 1 << windowBits
+ that is, 32K for windowBits=15 (default value) plus about 7 kilobytes
+ for small objects.
+*/
+
+                        /* Type declarations */
+
+#ifndef OF /* function prototypes */
+#  ifdef STDC
+#    define OF(args)  args
+#  else
+#    define OF(args)  ()
+#  endif
+#endif
+
+#ifndef Z_ARG /* function prototypes for stdarg */
+#  if defined(STDC) || defined(Z_HAVE_STDARG_H)
+#    define Z_ARG(args)  args
+#  else
+#    define Z_ARG(args)  ()
+#  endif
+#endif
+
+/* The following definitions for FAR are needed only for MSDOS mixed
+ * model programming (small or medium model with some far allocations).
+ * This was tested only with MSC; for other MSDOS compilers you may have
+ * to define NO_MEMCPY in zutil.h.  If you don't need the mixed model,
+ * just define FAR to be empty.
+ */
+#ifdef SYS16BIT
+#  if defined(M_I86SM) || defined(M_I86MM)
+     /* MSC small or medium model */
+#    define SMALL_MEDIUM
+#    ifdef _MSC_VER
+#      define FAR _far
+#    else
+#      define FAR far
+#    endif
+#  endif
+#  if (defined(__SMALL__) || defined(__MEDIUM__))
+     /* Turbo C small or medium model */
+#    define SMALL_MEDIUM
+#    ifdef __BORLANDC__
+#      define FAR _far
+#    else
+#      define FAR far
+#    endif
+#  endif
+#endif
+
+#if defined(WINDOWS) || defined(WIN32)
+   /* If building or using zlib as a DLL, define ZLIB_DLL.
+    * This is not mandatory, but it offers a little performance increase.
+    */
+#  ifdef ZLIB_DLL
+#    if defined(WIN32) && (!defined(__BORLANDC__) || (__BORLANDC__ >= 0x500))
+#      ifdef ZLIB_INTERNAL
+#        define ZEXTERN extern __declspec(dllexport)
+#      else
+#        define ZEXTERN extern __declspec(dllimport)
+#      endif
+#    endif
+#  endif  /* ZLIB_DLL */
+   /* If building or using zlib with the WINAPI/WINAPIV calling convention,
+    * define ZLIB_WINAPI.
+    * Caution: the standard ZLIB1.DLL is NOT compiled using ZLIB_WINAPI.
+    */
+#  ifdef ZLIB_WINAPI
+#    ifdef FAR
+#      undef FAR
+#    endif
+#    include <windows.h>
+     /* No need for _export, use ZLIB.DEF instead. */
+     /* For complete Windows compatibility, use WINAPI, not __stdcall. */
+#    define ZEXPORT WINAPI
+#    ifdef WIN32
+#      define ZEXPORTVA WINAPIV
+#    else
+#      define ZEXPORTVA FAR CDECL
+#    endif
+#  endif
+#endif
+
+#if defined (__BEOS__)
+#  ifdef ZLIB_DLL
+#    ifdef ZLIB_INTERNAL
+#      define ZEXPORT   __declspec(dllexport)
+#      define ZEXPORTVA __declspec(dllexport)
+#    else
+#      define ZEXPORT   __declspec(dllimport)
+#      define ZEXPORTVA __declspec(dllimport)
+#    endif
+#  endif
+#endif
+
+#ifndef ZEXTERN
+#  define ZEXTERN extern
+#endif
+#ifndef ZEXPORT
+#  define ZEXPORT
+#endif
+#ifndef ZEXPORTVA
+#  define ZEXPORTVA
+#endif
+
+#ifndef FAR
+#  define FAR
+#endif
+#ifndef far
+#  define far
+#endif
+
+#if !defined(__MACTYPES__)
+typedef unsigned char  Byte;  /* 8 bits */
+#endif
+typedef unsigned int   uInt;  /* 16 bits or more */
+typedef unsigned long  uLong; /* 32 bits or more */
+
+#ifdef SMALL_MEDIUM
+   /* Borland C/C++ and some old MSC versions ignore FAR inside typedef */
+#  define Bytef Byte FAR
+#else
+   typedef Byte  FAR Bytef;
+#endif
+typedef char  FAR charf;
+typedef int   FAR intf;
+typedef uInt  FAR uIntf;
+typedef uLong FAR uLongf;
+
+#ifdef STDC
+   typedef void const *voidpc;
+   typedef void FAR   *voidpf;
+   typedef void       *voidp;
+#else
+   typedef Byte const *voidpc;
+   typedef Byte FAR   *voidpf;
+   typedef Byte       *voidp;
+#endif
+
+#if !defined(Z_U4) && !defined(Z_SOLO) && defined(STDC)
+#  include <limits.h>
+#  if (UINT_MAX == 0xffffffffUL)
+#    define Z_U4 unsigned
+#  elif (ULONG_MAX == 0xffffffffUL)
+#    define Z_U4 unsigned long
+#  elif (USHRT_MAX == 0xffffffffUL)
+#    define Z_U4 unsigned short
+#  endif
+#endif
+
+#ifdef Z_U4
+   typedef Z_U4 z_crc_t;
+#else
+   typedef unsigned long z_crc_t;
+#endif
+
+#if !defined(_WIN32)
+#  define Z_HAVE_UNISTD_H
+#endif
+
+#ifdef HAVE_STDARG_H    /* may be set to #if 1 by ./configure */
+#  define Z_HAVE_STDARG_H
+#endif
+
+#ifdef STDC
+#  ifndef Z_SOLO
+#    include <sys/types.h>      /* for off_t */
+#  endif
+#endif
+
+#if defined(STDC) || defined(Z_HAVE_STDARG_H)
+#  ifndef Z_SOLO
+#    include <stdarg.h>         /* for va_list */
+#  endif
+#endif
+
+#ifdef _WIN32
+#  ifndef Z_SOLO
+#    include <stddef.h>         /* for wchar_t */
+#  endif
+#endif
+
+/* a little trick to accommodate both "#define _LARGEFILE64_SOURCE" and
+ * "#define _LARGEFILE64_SOURCE 1" as requesting 64-bit operations, (even
+ * though the former does not conform to the LFS document), but considering
+ * both "#undef _LARGEFILE64_SOURCE" and "#define _LARGEFILE64_SOURCE 0" as
+ * equivalently requesting no 64-bit operations
+ */
+#if defined(_LARGEFILE64_SOURCE) && -_LARGEFILE64_SOURCE - -1 == 1
+#  undef _LARGEFILE64_SOURCE
+#endif
+
+#if defined(__WATCOMC__) && !defined(Z_HAVE_UNISTD_H)
+#  define Z_HAVE_UNISTD_H
+#endif
+#ifndef Z_SOLO
+#  if defined(Z_HAVE_UNISTD_H) || defined(_LARGEFILE64_SOURCE)
+#    include <unistd.h>         /* for SEEK_*, off_t, and _LFS64_LARGEFILE */
+#    ifdef VMS
+#      include <unixio.h>       /* for off_t */
+#    endif
+#    ifndef z_off_t
+#      define z_off_t off_t
+#    endif
+#  endif
+#endif
+
+#if defined(_LFS64_LARGEFILE) && _LFS64_LARGEFILE-0
+#  define Z_LFS64
+#endif
+
+#if defined(_LARGEFILE64_SOURCE) && defined(Z_LFS64)
+#  define Z_LARGE64
+#endif
+
+#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS-0 == 64 && defined(Z_LFS64)
+#  define Z_WANT64
+#endif
+
+#if !defined(SEEK_SET) && !defined(Z_SOLO)
+#  define SEEK_SET        0       /* Seek from beginning of file.  */
+#  define SEEK_CUR        1       /* Seek from current position.  */
+#  define SEEK_END        2       /* Set file pointer to EOF plus "offset" */
+#endif
+
+#ifndef z_off_t
+#  define z_off_t long
+#endif
+
+#if !defined(_WIN32) && defined(Z_LARGE64)
+#  define z_off64_t off64_t
+#else
+#  if defined(_WIN32) && !defined(__GNUC__) && !defined(Z_SOLO)
+#    define z_off64_t __int64
+#  else
+#    define z_off64_t z_off_t
+#  endif
+#endif
+
+/* MVS linker does not support external names larger than 8 bytes */
+#if defined(__MVS__)
+  #pragma map(deflateInit_,"DEIN")
+  #pragma map(deflateInit2_,"DEIN2")
+  #pragma map(deflateEnd,"DEEND")
+  #pragma map(deflateBound,"DEBND")
+  #pragma map(inflateInit_,"ININ")
+  #pragma map(inflateInit2_,"ININ2")
+  #pragma map(inflateEnd,"INEND")
+  #pragma map(inflateSync,"INSY")
+  #pragma map(inflateSetDictionary,"INSEDI")
+  #pragma map(compressBound,"CMBND")
+  #pragma map(inflate_table,"INTABL")
+  #pragma map(inflate_fast,"INFA")
+  #pragma map(inflate_copyright,"INCOPY")
+#endif
+
+#endif /* ZCONF_H */
diff --git a/deps/v8/third_party/zlib/zlib.h b/deps/v8/third_party/zlib/zlib.h
new file mode 100644
index 00000000000000..99fd467f6b1a54
--- /dev/null
+++ b/deps/v8/third_party/zlib/zlib.h
@@ -0,0 +1,1935 @@
+/* zlib.h -- interface of the 'zlib' general purpose compression library
+  version 1.2.11, January 15th, 2017
+
+  Copyright (C) 1995-2017 Jean-loup Gailly and Mark Adler
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+  Jean-loup Gailly        Mark Adler
+  jloup@gzip.org          madler@alumni.caltech.edu
+
+
+  The data format used by the zlib library is described by RFCs (Request for
+  Comments) 1950 to 1952 in the files http://tools.ietf.org/html/rfc1950
+  (zlib format), rfc1951 (deflate format) and rfc1952 (gzip format).
+*/
+
+#ifndef ZLIB_H
+#define ZLIB_H
+
+#include "zconf.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define ZLIB_VERSION "1.2.11"
+#define ZLIB_VERNUM 0x12b0
+#define ZLIB_VER_MAJOR 1
+#define ZLIB_VER_MINOR 2
+#define ZLIB_VER_REVISION 11
+#define ZLIB_VER_SUBREVISION 0
+
+/*
+    The 'zlib' compression library provides in-memory compression and
+  decompression functions, including integrity checks of the uncompressed data.
+  This version of the library supports only one compression method (deflation)
+  but other algorithms will be added later and will have the same stream
+  interface.
+
+    Compression can be done in a single step if the buffers are large enough,
+  or can be done by repeated calls of the compression function.  In the latter
+  case, the application must provide more input and/or consume the output
+  (providing more output space) before each call.
+
+    The compressed data format used by default by the in-memory functions is
+  the zlib format, which is a zlib wrapper documented in RFC 1950, wrapped
+  around a deflate stream, which is itself documented in RFC 1951.
+
+    The library also supports reading and writing files in gzip (.gz) format
+  with an interface similar to that of stdio using the functions that start
+  with "gz".  The gzip format is different from the zlib format.  gzip is a
+  gzip wrapper, documented in RFC 1952, wrapped around a deflate stream.
+
+    This library can optionally read and write gzip and raw deflate streams in
+  memory as well.
+
+    The zlib format was designed to be compact and fast for use in memory
+  and on communications channels.  The gzip format was designed for single-
+  file compression on file systems, has a larger header than zlib to maintain
+  directory information, and uses a different, slower check method than zlib.
+
+    The library does not install any signal handler.  The decoder checks
+  the consistency of the compressed data, so the library should never crash
+  even in the case of corrupted input.
+*/
+
+typedef voidpf (*alloc_func) OF((voidpf opaque, uInt items, uInt size));
+typedef void   (*free_func)  OF((voidpf opaque, voidpf address));
+
+struct internal_state;
+
+typedef struct z_stream_s {
+    z_const Bytef *next_in;     /* next input byte */
+    uInt     avail_in;  /* number of bytes available at next_in */
+    uLong    total_in;  /* total number of input bytes read so far */
+
+    Bytef    *next_out; /* next output byte will go here */
+    uInt     avail_out; /* remaining free space at next_out */
+    uLong    total_out; /* total number of bytes output so far */
+
+    z_const char *msg;  /* last error message, NULL if no error */
+    struct internal_state FAR *state; /* not visible by applications */
+
+    alloc_func zalloc;  /* used to allocate the internal state */
+    free_func  zfree;   /* used to free the internal state */
+    voidpf     opaque;  /* private data object passed to zalloc and zfree */
+
+    int     data_type;  /* best guess about the data type: binary or text
+                           for deflate, or the decoding state for inflate */
+    uLong   adler;      /* Adler-32 or CRC-32 value of the uncompressed data */
+    uLong   reserved;   /* reserved for future use */
+} z_stream;
+
+typedef z_stream FAR *z_streamp;
+
+/*
+     gzip header information passed to and from zlib routines.  See RFC 1952
+  for more details on the meanings of these fields.
+*/
+typedef struct gz_header_s {
+    int     text;       /* true if compressed data believed to be text */
+    uLong   time;       /* modification time */
+    int     xflags;     /* extra flags (not used when writing a gzip file) */
+    int     os;         /* operating system */
+    Bytef   *extra;     /* pointer to extra field or Z_NULL if none */
+    uInt    extra_len;  /* extra field length (valid if extra != Z_NULL) */
+    uInt    extra_max;  /* space at extra (only when reading header) */
+    Bytef   *name;      /* pointer to zero-terminated file name or Z_NULL */
+    uInt    name_max;   /* space at name (only when reading header) */
+    Bytef   *comment;   /* pointer to zero-terminated comment or Z_NULL */
+    uInt    comm_max;   /* space at comment (only when reading header) */
+    int     hcrc;       /* true if there was or will be a header crc */
+    int     done;       /* true when done reading gzip header (not used
+                           when writing a gzip file) */
+} gz_header;
+
+typedef gz_header FAR *gz_headerp;
+
+/*
+     The application must update next_in and avail_in when avail_in has dropped
+   to zero.  It must update next_out and avail_out when avail_out has dropped
+   to zero.  The application must initialize zalloc, zfree and opaque before
+   calling the init function.  All other fields are set by the compression
+   library and must not be updated by the application.
+
+     The opaque value provided by the application will be passed as the first
+   parameter for calls of zalloc and zfree.  This can be useful for custom
+   memory management.  The compression library attaches no meaning to the
+   opaque value.
+
+     zalloc must return Z_NULL if there is not enough memory for the object.
+   If zlib is used in a multi-threaded application, zalloc and zfree must be
+   thread safe.  In that case, zlib is thread-safe.  When zalloc and zfree are
+   Z_NULL on entry to the initialization function, they are set to internal
+   routines that use the standard library functions malloc() and free().
+
+     On 16-bit systems, the functions zalloc and zfree must be able to allocate
+   exactly 65536 bytes, but will not be required to allocate more than this if
+   the symbol MAXSEG_64K is defined (see zconf.h).  WARNING: On MSDOS, pointers
+   returned by zalloc for objects of exactly 65536 bytes *must* have their
+   offset normalized to zero.  The default allocation function provided by this
+   library ensures this (see zutil.c).  To reduce memory requirements and avoid
+   any allocation of 64K objects, at the expense of compression ratio, compile
+   the library with -DMAX_WBITS=14 (see zconf.h).
+
+     The fields total_in and total_out can be used for statistics or progress
+   reports.  After compression, total_in holds the total size of the
+   uncompressed data and may be saved for use by the decompressor (particularly
+   if the decompressor wants to decompress everything in a single step).
+*/
+
+                        /* constants */
+
+#define Z_NO_FLUSH      0
+#define Z_PARTIAL_FLUSH 1
+#define Z_SYNC_FLUSH    2
+#define Z_FULL_FLUSH    3
+#define Z_FINISH        4
+#define Z_BLOCK         5
+#define Z_TREES         6
+/* Allowed flush values; see deflate() and inflate() below for details */
+
+#define Z_OK            0
+#define Z_STREAM_END    1
+#define Z_NEED_DICT     2
+#define Z_ERRNO        (-1)
+#define Z_STREAM_ERROR (-2)
+#define Z_DATA_ERROR   (-3)
+#define Z_MEM_ERROR    (-4)
+#define Z_BUF_ERROR    (-5)
+#define Z_VERSION_ERROR (-6)
+/* Return codes for the compression/decompression functions. Negative values
+ * are errors, positive values are used for special but normal events.
+ */
+
+#define Z_NO_COMPRESSION         0
+#define Z_BEST_SPEED             1
+#define Z_BEST_COMPRESSION       9
+#define Z_DEFAULT_COMPRESSION  (-1)
+/* compression levels */
+
+#define Z_FILTERED            1
+#define Z_HUFFMAN_ONLY        2
+#define Z_RLE                 3
+#define Z_FIXED               4
+#define Z_DEFAULT_STRATEGY    0
+/* compression strategy; see deflateInit2() below for details */
+
+#define Z_BINARY   0
+#define Z_TEXT     1
+#define Z_ASCII    Z_TEXT   /* for compatibility with 1.2.2 and earlier */
+#define Z_UNKNOWN  2
+/* Possible values of the data_type field for deflate() */
+
+#define Z_DEFLATED   8
+/* The deflate compression method (the only one supported in this version) */
+
+#define Z_NULL  0  /* for initializing zalloc, zfree, opaque */
+
+#define zlib_version zlibVersion()
+/* for compatibility with versions < 1.0.2 */
+
+
+                        /* basic functions */
+
+ZEXTERN const char * ZEXPORT zlibVersion OF((void));
+/* The application can compare zlibVersion and ZLIB_VERSION for consistency.
+   If the first character differs, the library code actually used is not
+   compatible with the zlib.h header file used by the application.  This check
+   is automatically made by deflateInit and inflateInit.
+ */
+
+/*
+ZEXTERN int ZEXPORT deflateInit OF((z_streamp strm, int level));
+
+     Initializes the internal stream state for compression.  The fields
+   zalloc, zfree and opaque must be initialized before by the caller.  If
+   zalloc and zfree are set to Z_NULL, deflateInit updates them to use default
+   allocation functions.
+
+     The compression level must be Z_DEFAULT_COMPRESSION, or between 0 and 9:
+   1 gives best speed, 9 gives best compression, 0 gives no compression at all
+   (the input data is simply copied a block at a time).  Z_DEFAULT_COMPRESSION
+   requests a default compromise between speed and compression (currently
+   equivalent to level 6).
+
+     deflateInit returns Z_OK if success, Z_MEM_ERROR if there was not enough
+   memory, Z_STREAM_ERROR if level is not a valid compression level, or
+   Z_VERSION_ERROR if the zlib library version (zlib_version) is incompatible
+   with the version assumed by the caller (ZLIB_VERSION).  msg is set to null
+   if there is no error message.  deflateInit does not perform any compression:
+   this will be done by deflate().
+*/
+
+
+ZEXTERN int ZEXPORT deflate OF((z_streamp strm, int flush));
+/*
+    deflate compresses as much data as possible, and stops when the input
+  buffer becomes empty or the output buffer becomes full.  It may introduce
+  some output latency (reading input without producing any output) except when
+  forced to flush.
+
+    The detailed semantics are as follows.  deflate performs one or both of the
+  following actions:
+
+  - Compress more input starting at next_in and update next_in and avail_in
+    accordingly.  If not all input can be processed (because there is not
+    enough room in the output buffer), next_in and avail_in are updated and
+    processing will resume at this point for the next call of deflate().
+
+  - Generate more output starting at next_out and update next_out and avail_out
+    accordingly.  This action is forced if the parameter flush is non zero.
+    Forcing flush frequently degrades the compression ratio, so this parameter
+    should be set only when necessary.  Some output may be provided even if
+    flush is zero.
+
+    Before the call of deflate(), the application should ensure that at least
+  one of the actions is possible, by providing more input and/or consuming more
+  output, and updating avail_in or avail_out accordingly; avail_out should
+  never be zero before the call.  The application can consume the compressed
+  output when it wants, for example when the output buffer is full (avail_out
+  == 0), or after each call of deflate().  If deflate returns Z_OK and with
+  zero avail_out, it must be called again after making room in the output
+  buffer because there might be more output pending. See deflatePending(),
+  which can be used if desired to determine whether or not there is more ouput
+  in that case.
+
+    Normally the parameter flush is set to Z_NO_FLUSH, which allows deflate to
+  decide how much data to accumulate before producing output, in order to
+  maximize compression.
+
+    If the parameter flush is set to Z_SYNC_FLUSH, all pending output is
+  flushed to the output buffer and the output is aligned on a byte boundary, so
+  that the decompressor can get all input data available so far.  (In
+  particular avail_in is zero after the call if enough output space has been
+  provided before the call.) Flushing may degrade compression for some
+  compression algorithms and so it should be used only when necessary.  This
+  completes the current deflate block and follows it with an empty stored block
+  that is three bits plus filler bits to the next byte, followed by four bytes
+  (00 00 ff ff).
+
+    If flush is set to Z_PARTIAL_FLUSH, all pending output is flushed to the
+  output buffer, but the output is not aligned to a byte boundary.  All of the
+  input data so far will be available to the decompressor, as for Z_SYNC_FLUSH.
+  This completes the current deflate block and follows it with an empty fixed
+  codes block that is 10 bits long.  This assures that enough bytes are output
+  in order for the decompressor to finish the block before the empty fixed
+  codes block.
+
+    If flush is set to Z_BLOCK, a deflate block is completed and emitted, as
+  for Z_SYNC_FLUSH, but the output is not aligned on a byte boundary, and up to
+  seven bits of the current block are held to be written as the next byte after
+  the next deflate block is completed.  In this case, the decompressor may not
+  be provided enough bits at this point in order to complete decompression of
+  the data provided so far to the compressor.  It may need to wait for the next
+  block to be emitted.  This is for advanced applications that need to control
+  the emission of deflate blocks.
+
+    If flush is set to Z_FULL_FLUSH, all output is flushed as with
+  Z_SYNC_FLUSH, and the compression state is reset so that decompression can
+  restart from this point if previous compressed data has been damaged or if
+  random access is desired.  Using Z_FULL_FLUSH too often can seriously degrade
+  compression.
+
+    If deflate returns with avail_out == 0, this function must be called again
+  with the same value of the flush parameter and more output space (updated
+  avail_out), until the flush is complete (deflate returns with non-zero
+  avail_out).  In the case of a Z_FULL_FLUSH or Z_SYNC_FLUSH, make sure that
+  avail_out is greater than six to avoid repeated flush markers due to
+  avail_out == 0 on return.
+
+    If the parameter flush is set to Z_FINISH, pending input is processed,
+  pending output is flushed and deflate returns with Z_STREAM_END if there was
+  enough output space.  If deflate returns with Z_OK or Z_BUF_ERROR, this
+  function must be called again with Z_FINISH and more output space (updated
+  avail_out) but no more input data, until it returns with Z_STREAM_END or an
+  error.  After deflate has returned Z_STREAM_END, the only possible operations
+  on the stream are deflateReset or deflateEnd.
+
+    Z_FINISH can be used in the first deflate call after deflateInit if all the
+  compression is to be done in a single step.  In order to complete in one
+  call, avail_out must be at least the value returned by deflateBound (see
+  below).  Then deflate is guaranteed to return Z_STREAM_END.  If not enough
+  output space is provided, deflate will not return Z_STREAM_END, and it must
+  be called again as described above.
+
+    deflate() sets strm->adler to the Adler-32 checksum of all input read
+  so far (that is, total_in bytes).  If a gzip stream is being generated, then
+  strm->adler will be the CRC-32 checksum of the input read so far.  (See
+  deflateInit2 below.)
+
+    deflate() may update strm->data_type if it can make a good guess about
+  the input data type (Z_BINARY or Z_TEXT).  If in doubt, the data is
+  considered binary.  This field is only for information purposes and does not
+  affect the compression algorithm in any manner.
+
+    deflate() returns Z_OK if some progress has been made (more input
+  processed or more output produced), Z_STREAM_END if all input has been
+  consumed and all output has been produced (only when flush is set to
+  Z_FINISH), Z_STREAM_ERROR if the stream state was inconsistent (for example
+  if next_in or next_out was Z_NULL or the state was inadvertently written over
+  by the application), or Z_BUF_ERROR if no progress is possible (for example
+  avail_in or avail_out was zero).  Note that Z_BUF_ERROR is not fatal, and
+  deflate() can be called again with more input and more output space to
+  continue compressing.
+*/
+
+
+ZEXTERN int ZEXPORT deflateEnd OF((z_streamp strm));
+/*
+     All dynamically allocated data structures for this stream are freed.
+   This function discards any unprocessed input and does not flush any pending
+   output.
+
+     deflateEnd returns Z_OK if success, Z_STREAM_ERROR if the
+   stream state was inconsistent, Z_DATA_ERROR if the stream was freed
+   prematurely (some input or output was discarded).  In the error case, msg
+   may be set but then points to a static string (which must not be
+   deallocated).
+*/
+
+
+/*
+ZEXTERN int ZEXPORT inflateInit OF((z_streamp strm));
+
+     Initializes the internal stream state for decompression.  The fields
+   next_in, avail_in, zalloc, zfree and opaque must be initialized before by
+   the caller.  In the current version of inflate, the provided input is not
+   read or consumed.  The allocation of a sliding window will be deferred to
+   the first call of inflate (if the decompression does not complete on the
+   first call).  If zalloc and zfree are set to Z_NULL, inflateInit updates
+   them to use default allocation functions.
+
+     inflateInit returns Z_OK if success, Z_MEM_ERROR if there was not enough
+   memory, Z_VERSION_ERROR if the zlib library version is incompatible with the
+   version assumed by the caller, or Z_STREAM_ERROR if the parameters are
+   invalid, such as a null pointer to the structure.  msg is set to null if
+   there is no error message.  inflateInit does not perform any decompression.
+   Actual decompression will be done by inflate().  So next_in, and avail_in,
+   next_out, and avail_out are unused and unchanged.  The current
+   implementation of inflateInit() does not process any header information --
+   that is deferred until inflate() is called.
+*/
+
+
+ZEXTERN int ZEXPORT inflate OF((z_streamp strm, int flush));
+/*
+    inflate decompresses as much data as possible, and stops when the input
+  buffer becomes empty or the output buffer becomes full.  It may introduce
+  some output latency (reading input without producing any output) except when
+  forced to flush.
+
+  The detailed semantics are as follows.  inflate performs one or both of the
+  following actions:
+
+  - Decompress more input starting at next_in and update next_in and avail_in
+    accordingly.  If not all input can be processed (because there is not
+    enough room in the output buffer), then next_in and avail_in are updated
+    accordingly, and processing will resume at this point for the next call of
+    inflate().
+
+  - Generate more output starting at next_out and update next_out and avail_out
+    accordingly.  inflate() provides as much output as possible, until there is
+    no more input data or no more space in the output buffer (see below about
+    the flush parameter).
+
+    Before the call of inflate(), the application should ensure that at least
+  one of the actions is possible, by providing more input and/or consuming more
+  output, and updating the next_* and avail_* values accordingly.  If the
+  caller of inflate() does not provide both available input and available
+  output space, it is possible that there will be no progress made.  The
+  application can consume the uncompressed output when it wants, for example
+  when the output buffer is full (avail_out == 0), or after each call of
+  inflate().  If inflate returns Z_OK and with zero avail_out, it must be
+  called again after making room in the output buffer because there might be
+  more output pending.
+
+    The flush parameter of inflate() can be Z_NO_FLUSH, Z_SYNC_FLUSH, Z_FINISH,
+  Z_BLOCK, or Z_TREES.  Z_SYNC_FLUSH requests that inflate() flush as much
+  output as possible to the output buffer.  Z_BLOCK requests that inflate()
+  stop if and when it gets to the next deflate block boundary.  When decoding
+  the zlib or gzip format, this will cause inflate() to return immediately
+  after the header and before the first block.  When doing a raw inflate,
+  inflate() will go ahead and process the first block, and will return when it
+  gets to the end of that block, or when it runs out of data.
+
+    The Z_BLOCK option assists in appending to or combining deflate streams.
+  To assist in this, on return inflate() always sets strm->data_type to the
+  number of unused bits in the last byte taken from strm->next_in, plus 64 if
+  inflate() is currently decoding the last block in the deflate stream, plus
+  128 if inflate() returned immediately after decoding an end-of-block code or
+  decoding the complete header up to just before the first byte of the deflate
+  stream.  The end-of-block will not be indicated until all of the uncompressed
+  data from that block has been written to strm->next_out.  The number of
+  unused bits may in general be greater than seven, except when bit 7 of
+  data_type is set, in which case the number of unused bits will be less than
+  eight.  data_type is set as noted here every time inflate() returns for all
+  flush options, and so can be used to determine the amount of currently
+  consumed input in bits.
+
+    The Z_TREES option behaves as Z_BLOCK does, but it also returns when the
+  end of each deflate block header is reached, before any actual data in that
+  block is decoded.  This allows the caller to determine the length of the
+  deflate block header for later use in random access within a deflate block.
+  256 is added to the value of strm->data_type when inflate() returns
+  immediately after reaching the end of the deflate block header.
+
+    inflate() should normally be called until it returns Z_STREAM_END or an
+  error.  However if all decompression is to be performed in a single step (a
+  single call of inflate), the parameter flush should be set to Z_FINISH.  In
+  this case all pending input is processed and all pending output is flushed;
+  avail_out must be large enough to hold all of the uncompressed data for the
+  operation to complete.  (The size of the uncompressed data may have been
+  saved by the compressor for this purpose.)  The use of Z_FINISH is not
+  required to perform an inflation in one step.  However it may be used to
+  inform inflate that a faster approach can be used for the single inflate()
+  call.  Z_FINISH also informs inflate to not maintain a sliding window if the
+  stream completes, which reduces inflate's memory footprint.  If the stream
+  does not complete, either because not all of the stream is provided or not
+  enough output space is provided, then a sliding window will be allocated and
+  inflate() can be called again to continue the operation as if Z_NO_FLUSH had
+  been used.
+
+     In this implementation, inflate() always flushes as much output as
+  possible to the output buffer, and always uses the faster approach on the
+  first call.  So the effects of the flush parameter in this implementation are
+  on the return value of inflate() as noted below, when inflate() returns early
+  when Z_BLOCK or Z_TREES is used, and when inflate() avoids the allocation of
+  memory for a sliding window when Z_FINISH is used.
+
+     If a preset dictionary is needed after this call (see inflateSetDictionary
+  below), inflate sets strm->adler to the Adler-32 checksum of the dictionary
+  chosen by the compressor and returns Z_NEED_DICT; otherwise it sets
+  strm->adler to the Adler-32 checksum of all output produced so far (that is,
+  total_out bytes) and returns Z_OK, Z_STREAM_END or an error code as described
+  below.  At the end of the stream, inflate() checks that its computed Adler-32
+  checksum is equal to that saved by the compressor and returns Z_STREAM_END
+  only if the checksum is correct.
+
+    inflate() can decompress and check either zlib-wrapped or gzip-wrapped
+  deflate data.  The header type is detected automatically, if requested when
+  initializing with inflateInit2().  Any information contained in the gzip
+  header is not retained unless inflateGetHeader() is used.  When processing
+  gzip-wrapped deflate data, strm->adler32 is set to the CRC-32 of the output
+  produced so far.  The CRC-32 is checked against the gzip trailer, as is the
+  uncompressed length, modulo 2^32.
+
+    inflate() returns Z_OK if some progress has been made (more input processed
+  or more output produced), Z_STREAM_END if the end of the compressed data has
+  been reached and all uncompressed output has been produced, Z_NEED_DICT if a
+  preset dictionary is needed at this point, Z_DATA_ERROR if the input data was
+  corrupted (input stream not conforming to the zlib format or incorrect check
+  value, in which case strm->msg points to a string with a more specific
+  error), Z_STREAM_ERROR if the stream structure was inconsistent (for example
+  next_in or next_out was Z_NULL, or the state was inadvertently written over
+  by the application), Z_MEM_ERROR if there was not enough memory, Z_BUF_ERROR
+  if no progress was possible or if there was not enough room in the output
+  buffer when Z_FINISH is used.  Note that Z_BUF_ERROR is not fatal, and
+  inflate() can be called again with more input and more output space to
+  continue decompressing.  If Z_DATA_ERROR is returned, the application may
+  then call inflateSync() to look for a good compression block if a partial
+  recovery of the data is to be attempted.
+*/
+
+
+ZEXTERN int ZEXPORT inflateEnd OF((z_streamp strm));
+/*
+     All dynamically allocated data structures for this stream are freed.
+   This function discards any unprocessed input and does not flush any pending
+   output.
+
+     inflateEnd returns Z_OK if success, or Z_STREAM_ERROR if the stream state
+   was inconsistent.
+*/
+
+
+                        /* Advanced functions */
+
+/*
+    The following functions are needed only in some special applications.
+*/
+
+/*
+ZEXTERN int ZEXPORT deflateInit2 OF((z_streamp strm,
+                                     int  level,
+                                     int  method,
+                                     int  windowBits,
+                                     int  memLevel,
+                                     int  strategy));
+
+     This is another version of deflateInit with more compression options.  The
+   fields next_in, zalloc, zfree and opaque must be initialized before by the
+   caller.
+
+     The method parameter is the compression method.  It must be Z_DEFLATED in
+   this version of the library.
+
+     The windowBits parameter is the base two logarithm of the window size
+   (the size of the history buffer).  It should be in the range 8..15 for this
+   version of the library.  Larger values of this parameter result in better
+   compression at the expense of memory usage.  The default value is 15 if
+   deflateInit is used instead.
+
+     For the current implementation of deflate(), a windowBits value of 8 (a
+   window size of 256 bytes) is not supported.  As a result, a request for 8
+   will result in 9 (a 512-byte window).  In that case, providing 8 to
+   inflateInit2() will result in an error when the zlib header with 9 is
+   checked against the initialization of inflate().  The remedy is to not use 8
+   with deflateInit2() with this initialization, or at least in that case use 9
+   with inflateInit2().
+
+     windowBits can also be -8..-15 for raw deflate.  In this case, -windowBits
+   determines the window size.  deflate() will then generate raw deflate data
+   with no zlib header or trailer, and will not compute a check value.
+
+     windowBits can also be greater than 15 for optional gzip encoding.  Add
+   16 to windowBits to write a simple gzip header and trailer around the
+   compressed data instead of a zlib wrapper.  The gzip header will have no
+   file name, no extra data, no comment, no modification time (set to zero), no
+   header crc, and the operating system will be set to the appropriate value,
+   if the operating system was determined at compile time.  If a gzip stream is
+   being written, strm->adler is a CRC-32 instead of an Adler-32.
+
+     For raw deflate or gzip encoding, a request for a 256-byte window is
+   rejected as invalid, since only the zlib header provides a means of
+   transmitting the window size to the decompressor.
+
+     The memLevel parameter specifies how much memory should be allocated
+   for the internal compression state.  memLevel=1 uses minimum memory but is
+   slow and reduces compression ratio; memLevel=9 uses maximum memory for
+   optimal speed.  The default value is 8.  See zconf.h for total memory usage
+   as a function of windowBits and memLevel.
+
+     The strategy parameter is used to tune the compression algorithm.  Use the
+   value Z_DEFAULT_STRATEGY for normal data, Z_FILTERED for data produced by a
+   filter (or predictor), Z_HUFFMAN_ONLY to force Huffman encoding only (no
+   string match), or Z_RLE to limit match distances to one (run-length
+   encoding).  Filtered data consists mostly of small values with a somewhat
+   random distribution.  In this case, the compression algorithm is tuned to
+   compress them better.  The effect of Z_FILTERED is to force more Huffman
+   coding and less string matching; it is somewhat intermediate between
+   Z_DEFAULT_STRATEGY and Z_HUFFMAN_ONLY.  Z_RLE is designed to be almost as
+   fast as Z_HUFFMAN_ONLY, but give better compression for PNG image data.  The
+   strategy parameter only affects the compression ratio but not the
+   correctness of the compressed output even if it is not set appropriately.
+   Z_FIXED prevents the use of dynamic Huffman codes, allowing for a simpler
+   decoder for special applications.
+
+     deflateInit2 returns Z_OK if success, Z_MEM_ERROR if there was not enough
+   memory, Z_STREAM_ERROR if any parameter is invalid (such as an invalid
+   method), or Z_VERSION_ERROR if the zlib library version (zlib_version) is
+   incompatible with the version assumed by the caller (ZLIB_VERSION).  msg is
+   set to null if there is no error message.  deflateInit2 does not perform any
+   compression: this will be done by deflate().
+*/
+
+ZEXTERN int ZEXPORT deflateSetDictionary OF((z_streamp strm,
+                                             const Bytef *dictionary,
+                                             uInt  dictLength));
+/*
+     Initializes the compression dictionary from the given byte sequence
+   without producing any compressed output.  When using the zlib format, this
+   function must be called immediately after deflateInit, deflateInit2 or
+   deflateReset, and before any call of deflate.  When doing raw deflate, this
+   function must be called either before any call of deflate, or immediately
+   after the completion of a deflate block, i.e. after all input has been
+   consumed and all output has been delivered when using any of the flush
+   options Z_BLOCK, Z_PARTIAL_FLUSH, Z_SYNC_FLUSH, or Z_FULL_FLUSH.  The
+   compressor and decompressor must use exactly the same dictionary (see
+   inflateSetDictionary).
+
+     The dictionary should consist of strings (byte sequences) that are likely
+   to be encountered later in the data to be compressed, with the most commonly
+   used strings preferably put towards the end of the dictionary.  Using a
+   dictionary is most useful when the data to be compressed is short and can be
+   predicted with good accuracy; the data can then be compressed better than
+   with the default empty dictionary.
+
+     Depending on the size of the compression data structures selected by
+   deflateInit or deflateInit2, a part of the dictionary may in effect be
+   discarded, for example if the dictionary is larger than the window size
+   provided in deflateInit or deflateInit2.  Thus the strings most likely to be
+   useful should be put at the end of the dictionary, not at the front.  In
+   addition, the current implementation of deflate will use at most the window
+   size minus 262 bytes of the provided dictionary.
+
+     Upon return of this function, strm->adler is set to the Adler-32 value
+   of the dictionary; the decompressor may later use this value to determine
+   which dictionary has been used by the compressor.  (The Adler-32 value
+   applies to the whole dictionary even if only a subset of the dictionary is
+   actually used by the compressor.) If a raw deflate was requested, then the
+   Adler-32 value is not computed and strm->adler is not set.
+
+     deflateSetDictionary returns Z_OK if success, or Z_STREAM_ERROR if a
+   parameter is invalid (e.g.  dictionary being Z_NULL) or the stream state is
+   inconsistent (for example if deflate has already been called for this stream
+   or if not at a block boundary for raw deflate).  deflateSetDictionary does
+   not perform any compression: this will be done by deflate().
+*/
+
+ZEXTERN int ZEXPORT deflateGetDictionary OF((z_streamp strm,
+                                             Bytef *dictionary,
+                                             uInt  *dictLength));
+/*
+     Returns the sliding dictionary being maintained by deflate.  dictLength is
+   set to the number of bytes in the dictionary, and that many bytes are copied
+   to dictionary.  dictionary must have enough space, where 32768 bytes is
+   always enough.  If deflateGetDictionary() is called with dictionary equal to
+   Z_NULL, then only the dictionary length is returned, and nothing is copied.
+   Similary, if dictLength is Z_NULL, then it is not set.
+
+     deflateGetDictionary() may return a length less than the window size, even
+   when more than the window size in input has been provided. It may return up
+   to 258 bytes less in that case, due to how zlib's implementation of deflate
+   manages the sliding window and lookahead for matches, where matches can be
+   up to 258 bytes long. If the application needs the last window-size bytes of
+   input, then that would need to be saved by the application outside of zlib.
+
+     deflateGetDictionary returns Z_OK on success, or Z_STREAM_ERROR if the
+   stream state is inconsistent.
+*/
+
+ZEXTERN int ZEXPORT deflateCopy OF((z_streamp dest,
+                                    z_streamp source));
+/*
+     Sets the destination stream as a complete copy of the source stream.
+
+     This function can be useful when several compression strategies will be
+   tried, for example when there are several ways of pre-processing the input
+   data with a filter.  The streams that will be discarded should then be freed
+   by calling deflateEnd.  Note that deflateCopy duplicates the internal
+   compression state which can be quite large, so this strategy is slow and can
+   consume lots of memory.
+
+     deflateCopy returns Z_OK if success, Z_MEM_ERROR if there was not
+   enough memory, Z_STREAM_ERROR if the source stream state was inconsistent
+   (such as zalloc being Z_NULL).  msg is left unchanged in both source and
+   destination.
+*/
+
+ZEXTERN int ZEXPORT deflateReset OF((z_streamp strm));
+/*
+     This function is equivalent to deflateEnd followed by deflateInit, but
+   does not free and reallocate the internal compression state.  The stream
+   will leave the compression level and any other attributes that may have been
+   set unchanged.
+
+     deflateReset returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent (such as zalloc or state being Z_NULL).
+*/
+
+ZEXTERN int ZEXPORT deflateParams OF((z_streamp strm,
+                                      int level,
+                                      int strategy));
+/*
+     Dynamically update the compression level and compression strategy.  The
+   interpretation of level and strategy is as in deflateInit2().  This can be
+   used to switch between compression and straight copy of the input data, or
+   to switch to a different kind of input data requiring a different strategy.
+   If the compression approach (which is a function of the level) or the
+   strategy is changed, and if any input has been consumed in a previous
+   deflate() call, then the input available so far is compressed with the old
+   level and strategy using deflate(strm, Z_BLOCK).  There are three approaches
+   for the compression levels 0, 1..3, and 4..9 respectively.  The new level
+   and strategy will take effect at the next call of deflate().
+
+     If a deflate(strm, Z_BLOCK) is performed by deflateParams(), and it does
+   not have enough output space to complete, then the parameter change will not
+   take effect.  In this case, deflateParams() can be called again with the
+   same parameters and more output space to try again.
+
+     In order to assure a change in the parameters on the first try, the
+   deflate stream should be flushed using deflate() with Z_BLOCK or other flush
+   request until strm.avail_out is not zero, before calling deflateParams().
+   Then no more input data should be provided before the deflateParams() call.
+   If this is done, the old level and strategy will be applied to the data
+   compressed before deflateParams(), and the new level and strategy will be
+   applied to the the data compressed after deflateParams().
+
+     deflateParams returns Z_OK on success, Z_STREAM_ERROR if the source stream
+   state was inconsistent or if a parameter was invalid, or Z_BUF_ERROR if
+   there was not enough output space to complete the compression of the
+   available input data before a change in the strategy or approach.  Note that
+   in the case of a Z_BUF_ERROR, the parameters are not changed.  A return
+   value of Z_BUF_ERROR is not fatal, in which case deflateParams() can be
+   retried with more output space.
+*/
+
+ZEXTERN int ZEXPORT deflateTune OF((z_streamp strm,
+                                    int good_length,
+                                    int max_lazy,
+                                    int nice_length,
+                                    int max_chain));
+/*
+     Fine tune deflate's internal compression parameters.  This should only be
+   used by someone who understands the algorithm used by zlib's deflate for
+   searching for the best matching string, and even then only by the most
+   fanatic optimizer trying to squeeze out the last compressed bit for their
+   specific input data.  Read the deflate.c source code for the meaning of the
+   max_lazy, good_length, nice_length, and max_chain parameters.
+
+     deflateTune() can be called after deflateInit() or deflateInit2(), and
+   returns Z_OK on success, or Z_STREAM_ERROR for an invalid deflate stream.
+ */
+
+ZEXTERN uLong ZEXPORT deflateBound OF((z_streamp strm,
+                                       uLong sourceLen));
+/*
+     deflateBound() returns an upper bound on the compressed size after
+   deflation of sourceLen bytes.  It must be called after deflateInit() or
+   deflateInit2(), and after deflateSetHeader(), if used.  This would be used
+   to allocate an output buffer for deflation in a single pass, and so would be
+   called before deflate().  If that first deflate() call is provided the
+   sourceLen input bytes, an output buffer allocated to the size returned by
+   deflateBound(), and the flush value Z_FINISH, then deflate() is guaranteed
+   to return Z_STREAM_END.  Note that it is possible for the compressed size to
+   be larger than the value returned by deflateBound() if flush options other
+   than Z_FINISH or Z_NO_FLUSH are used.
+*/
+
+ZEXTERN int ZEXPORT deflatePending OF((z_streamp strm,
+                                       unsigned *pending,
+                                       int *bits));
+/*
+     deflatePending() returns the number of bytes and bits of output that have
+   been generated, but not yet provided in the available output.  The bytes not
+   provided would be due to the available output space having being consumed.
+   The number of bits of output not provided are between 0 and 7, where they
+   await more bits to join them in order to fill out a full byte.  If pending
+   or bits are Z_NULL, then those values are not set.
+
+     deflatePending returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent.
+ */
+
+ZEXTERN int ZEXPORT deflatePrime OF((z_streamp strm,
+                                     int bits,
+                                     int value));
+/*
+     deflatePrime() inserts bits in the deflate output stream.  The intent
+   is that this function is used to start off the deflate output with the bits
+   leftover from a previous deflate stream when appending to it.  As such, this
+   function can only be used for raw deflate, and must be used before the first
+   deflate() call after a deflateInit2() or deflateReset().  bits must be less
+   than or equal to 16, and that many of the least significant bits of value
+   will be inserted in the output.
+
+     deflatePrime returns Z_OK if success, Z_BUF_ERROR if there was not enough
+   room in the internal buffer to insert the bits, or Z_STREAM_ERROR if the
+   source stream state was inconsistent.
+*/
+
+ZEXTERN int ZEXPORT deflateSetHeader OF((z_streamp strm,
+                                         gz_headerp head));
+/*
+     deflateSetHeader() provides gzip header information for when a gzip
+   stream is requested by deflateInit2().  deflateSetHeader() may be called
+   after deflateInit2() or deflateReset() and before the first call of
+   deflate().  The text, time, os, extra field, name, and comment information
+   in the provided gz_header structure are written to the gzip header (xflag is
+   ignored -- the extra flags are set according to the compression level).  The
+   caller must assure that, if not Z_NULL, name and comment are terminated with
+   a zero byte, and that if extra is not Z_NULL, that extra_len bytes are
+   available there.  If hcrc is true, a gzip header crc is included.  Note that
+   the current versions of the command-line version of gzip (up through version
+   1.3.x) do not support header crc's, and will report that it is a "multi-part
+   gzip file" and give up.
+
+     If deflateSetHeader is not used, the default gzip header has text false,
+   the time set to zero, and os set to 255, with no extra, name, or comment
+   fields.  The gzip header is returned to the default state by deflateReset().
+
+     deflateSetHeader returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent.
+*/
+
+/*
+ZEXTERN int ZEXPORT inflateInit2 OF((z_streamp strm,
+                                     int  windowBits));
+
+     This is another version of inflateInit with an extra parameter.  The
+   fields next_in, avail_in, zalloc, zfree and opaque must be initialized
+   before by the caller.
+
+     The windowBits parameter is the base two logarithm of the maximum window
+   size (the size of the history buffer).  It should be in the range 8..15 for
+   this version of the library.  The default value is 15 if inflateInit is used
+   instead.  windowBits must be greater than or equal to the windowBits value
+   provided to deflateInit2() while compressing, or it must be equal to 15 if
+   deflateInit2() was not used.  If a compressed stream with a larger window
+   size is given as input, inflate() will return with the error code
+   Z_DATA_ERROR instead of trying to allocate a larger window.
+
+     windowBits can also be zero to request that inflate use the window size in
+   the zlib header of the compressed stream.
+
+     windowBits can also be -8..-15 for raw inflate.  In this case, -windowBits
+   determines the window size.  inflate() will then process raw deflate data,
+   not looking for a zlib or gzip header, not generating a check value, and not
+   looking for any check values for comparison at the end of the stream.  This
+   is for use with other formats that use the deflate compressed data format
+   such as zip.  Those formats provide their own check values.  If a custom
+   format is developed using the raw deflate format for compressed data, it is
+   recommended that a check value such as an Adler-32 or a CRC-32 be applied to
+   the uncompressed data as is done in the zlib, gzip, and zip formats.  For
+   most applications, the zlib format should be used as is.  Note that comments
+   above on the use in deflateInit2() applies to the magnitude of windowBits.
+
+     windowBits can also be greater than 15 for optional gzip decoding.  Add
+   32 to windowBits to enable zlib and gzip decoding with automatic header
+   detection, or add 16 to decode only the gzip format (the zlib format will
+   return a Z_DATA_ERROR).  If a gzip stream is being decoded, strm->adler is a
+   CRC-32 instead of an Adler-32.  Unlike the gunzip utility and gzread() (see
+   below), inflate() will not automatically decode concatenated gzip streams.
+   inflate() will return Z_STREAM_END at the end of the gzip stream.  The state
+   would need to be reset to continue decoding a subsequent gzip stream.
+
+     inflateInit2 returns Z_OK if success, Z_MEM_ERROR if there was not enough
+   memory, Z_VERSION_ERROR if the zlib library version is incompatible with the
+   version assumed by the caller, or Z_STREAM_ERROR if the parameters are
+   invalid, such as a null pointer to the structure.  msg is set to null if
+   there is no error message.  inflateInit2 does not perform any decompression
+   apart from possibly reading the zlib header if present: actual decompression
+   will be done by inflate().  (So next_in and avail_in may be modified, but
+   next_out and avail_out are unused and unchanged.) The current implementation
+   of inflateInit2() does not process any header information -- that is
+   deferred until inflate() is called.
+*/
+
+ZEXTERN int ZEXPORT inflateSetDictionary OF((z_streamp strm,
+                                             const Bytef *dictionary,
+                                             uInt  dictLength));
+/*
+     Initializes the decompression dictionary from the given uncompressed byte
+   sequence.  This function must be called immediately after a call of inflate,
+   if that call returned Z_NEED_DICT.  The dictionary chosen by the compressor
+   can be determined from the Adler-32 value returned by that call of inflate.
+   The compressor and decompressor must use exactly the same dictionary (see
+   deflateSetDictionary).  For raw inflate, this function can be called at any
+   time to set the dictionary.  If the provided dictionary is smaller than the
+   window and there is already data in the window, then the provided dictionary
+   will amend what's there.  The application must insure that the dictionary
+   that was used for compression is provided.
+
+     inflateSetDictionary returns Z_OK if success, Z_STREAM_ERROR if a
+   parameter is invalid (e.g.  dictionary being Z_NULL) or the stream state is
+   inconsistent, Z_DATA_ERROR if the given dictionary doesn't match the
+   expected one (incorrect Adler-32 value).  inflateSetDictionary does not
+   perform any decompression: this will be done by subsequent calls of
+   inflate().
+*/
+
+ZEXTERN int ZEXPORT inflateGetDictionary OF((z_streamp strm,
+                                             Bytef *dictionary,
+                                             uInt  *dictLength));
+/*
+     Returns the sliding dictionary being maintained by inflate.  dictLength is
+   set to the number of bytes in the dictionary, and that many bytes are copied
+   to dictionary.  dictionary must have enough space, where 32768 bytes is
+   always enough.  If inflateGetDictionary() is called with dictionary equal to
+   Z_NULL, then only the dictionary length is returned, and nothing is copied.
+   Similary, if dictLength is Z_NULL, then it is not set.
+
+     inflateGetDictionary returns Z_OK on success, or Z_STREAM_ERROR if the
+   stream state is inconsistent.
+*/
+
+ZEXTERN int ZEXPORT inflateSync OF((z_streamp strm));
+/*
+     Skips invalid compressed data until a possible full flush point (see above
+   for the description of deflate with Z_FULL_FLUSH) can be found, or until all
+   available input is skipped.  No output is provided.
+
+     inflateSync searches for a 00 00 FF FF pattern in the compressed data.
+   All full flush points have this pattern, but not all occurrences of this
+   pattern are full flush points.
+
+     inflateSync returns Z_OK if a possible full flush point has been found,
+   Z_BUF_ERROR if no more input was provided, Z_DATA_ERROR if no flush point
+   has been found, or Z_STREAM_ERROR if the stream structure was inconsistent.
+   In the success case, the application may save the current current value of
+   total_in which indicates where valid compressed data was found.  In the
+   error case, the application may repeatedly call inflateSync, providing more
+   input each time, until success or end of the input data.
+*/
+
+ZEXTERN int ZEXPORT inflateCopy OF((z_streamp dest,
+                                    z_streamp source));
+/*
+     Sets the destination stream as a complete copy of the source stream.
+
+     This function can be useful when randomly accessing a large stream.  The
+   first pass through the stream can periodically record the inflate state,
+   allowing restarting inflate at those points when randomly accessing the
+   stream.
+
+     inflateCopy returns Z_OK if success, Z_MEM_ERROR if there was not
+   enough memory, Z_STREAM_ERROR if the source stream state was inconsistent
+   (such as zalloc being Z_NULL).  msg is left unchanged in both source and
+   destination.
+*/
+
+ZEXTERN int ZEXPORT inflateReset OF((z_streamp strm));
+/*
+     This function is equivalent to inflateEnd followed by inflateInit,
+   but does not free and reallocate the internal decompression state.  The
+   stream will keep attributes that may have been set by inflateInit2.
+
+     inflateReset returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent (such as zalloc or state being Z_NULL).
+*/
+
+ZEXTERN int ZEXPORT inflateReset2 OF((z_streamp strm,
+                                      int windowBits));
+/*
+     This function is the same as inflateReset, but it also permits changing
+   the wrap and window size requests.  The windowBits parameter is interpreted
+   the same as it is for inflateInit2.  If the window size is changed, then the
+   memory allocated for the window is freed, and the window will be reallocated
+   by inflate() if needed.
+
+     inflateReset2 returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent (such as zalloc or state being Z_NULL), or if
+   the windowBits parameter is invalid.
+*/
+
+ZEXTERN int ZEXPORT inflatePrime OF((z_streamp strm,
+                                     int bits,
+                                     int value));
+/*
+     This function inserts bits in the inflate input stream.  The intent is
+   that this function is used to start inflating at a bit position in the
+   middle of a byte.  The provided bits will be used before any bytes are used
+   from next_in.  This function should only be used with raw inflate, and
+   should be used before the first inflate() call after inflateInit2() or
+   inflateReset().  bits must be less than or equal to 16, and that many of the
+   least significant bits of value will be inserted in the input.
+
+     If bits is negative, then the input stream bit buffer is emptied.  Then
+   inflatePrime() can be called again to put bits in the buffer.  This is used
+   to clear out bits leftover after feeding inflate a block description prior
+   to feeding inflate codes.
+
+     inflatePrime returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent.
+*/
+
+ZEXTERN long ZEXPORT inflateMark OF((z_streamp strm));
+/*
+     This function returns two values, one in the lower 16 bits of the return
+   value, and the other in the remaining upper bits, obtained by shifting the
+   return value down 16 bits.  If the upper value is -1 and the lower value is
+   zero, then inflate() is currently decoding information outside of a block.
+   If the upper value is -1 and the lower value is non-zero, then inflate is in
+   the middle of a stored block, with the lower value equaling the number of
+   bytes from the input remaining to copy.  If the upper value is not -1, then
+   it is the number of bits back from the current bit position in the input of
+   the code (literal or length/distance pair) currently being processed.  In
+   that case the lower value is the number of bytes already emitted for that
+   code.
+
+     A code is being processed if inflate is waiting for more input to complete
+   decoding of the code, or if it has completed decoding but is waiting for
+   more output space to write the literal or match data.
+
+     inflateMark() is used to mark locations in the input data for random
+   access, which may be at bit positions, and to note those cases where the
+   output of a code may span boundaries of random access blocks.  The current
+   location in the input stream can be determined from avail_in and data_type
+   as noted in the description for the Z_BLOCK flush parameter for inflate.
+
+     inflateMark returns the value noted above, or -65536 if the provided
+   source stream state was inconsistent.
+*/
+
+ZEXTERN int ZEXPORT inflateGetHeader OF((z_streamp strm,
+                                         gz_headerp head));
+/*
+     inflateGetHeader() requests that gzip header information be stored in the
+   provided gz_header structure.  inflateGetHeader() may be called after
+   inflateInit2() or inflateReset(), and before the first call of inflate().
+   As inflate() processes the gzip stream, head->done is zero until the header
+   is completed, at which time head->done is set to one.  If a zlib stream is
+   being decoded, then head->done is set to -1 to indicate that there will be
+   no gzip header information forthcoming.  Note that Z_BLOCK or Z_TREES can be
+   used to force inflate() to return immediately after header processing is
+   complete and before any actual data is decompressed.
+
+     The text, time, xflags, and os fields are filled in with the gzip header
+   contents.  hcrc is set to true if there is a header CRC.  (The header CRC
+   was valid if done is set to one.) If extra is not Z_NULL, then extra_max
+   contains the maximum number of bytes to write to extra.  Once done is true,
+   extra_len contains the actual extra field length, and extra contains the
+   extra field, or that field truncated if extra_max is less than extra_len.
+   If name is not Z_NULL, then up to name_max characters are written there,
+   terminated with a zero unless the length is greater than name_max.  If
+   comment is not Z_NULL, then up to comm_max characters are written there,
+   terminated with a zero unless the length is greater than comm_max.  When any
+   of extra, name, or comment are not Z_NULL and the respective field is not
+   present in the header, then that field is set to Z_NULL to signal its
+   absence.  This allows the use of deflateSetHeader() with the returned
+   structure to duplicate the header.  However if those fields are set to
+   allocated memory, then the application will need to save those pointers
+   elsewhere so that they can be eventually freed.
+
+     If inflateGetHeader is not used, then the header information is simply
+   discarded.  The header is always checked for validity, including the header
+   CRC if present.  inflateReset() will reset the process to discard the header
+   information.  The application would need to call inflateGetHeader() again to
+   retrieve the header from the next gzip stream.
+
+     inflateGetHeader returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent.
+*/
+
+/*
+ZEXTERN int ZEXPORT inflateBackInit OF((z_streamp strm, int windowBits,
+                                        unsigned char FAR *window));
+
+     Initialize the internal stream state for decompression using inflateBack()
+   calls.  The fields zalloc, zfree and opaque in strm must be initialized
+   before the call.  If zalloc and zfree are Z_NULL, then the default library-
+   derived memory allocation routines are used.  windowBits is the base two
+   logarithm of the window size, in the range 8..15.  window is a caller
+   supplied buffer of that size.  Except for special applications where it is
+   assured that deflate was used with small window sizes, windowBits must be 15
+   and a 32K byte window must be supplied to be able to decompress general
+   deflate streams.
+
+     See inflateBack() for the usage of these routines.
+
+     inflateBackInit will return Z_OK on success, Z_STREAM_ERROR if any of
+   the parameters are invalid, Z_MEM_ERROR if the internal state could not be
+   allocated, or Z_VERSION_ERROR if the version of the library does not match
+   the version of the header file.
+*/
+
+typedef unsigned (*in_func) OF((void FAR *,
+                                z_const unsigned char FAR * FAR *));
+typedef int (*out_func) OF((void FAR *, unsigned char FAR *, unsigned));
+
+ZEXTERN int ZEXPORT inflateBack OF((z_streamp strm,
+                                    in_func in, void FAR *in_desc,
+                                    out_func out, void FAR *out_desc));
+/*
+     inflateBack() does a raw inflate with a single call using a call-back
+   interface for input and output.  This is potentially more efficient than
+   inflate() for file i/o applications, in that it avoids copying between the
+   output and the sliding window by simply making the window itself the output
+   buffer.  inflate() can be faster on modern CPUs when used with large
+   buffers.  inflateBack() trusts the application to not change the output
+   buffer passed by the output function, at least until inflateBack() returns.
+
+     inflateBackInit() must be called first to allocate the internal state
+   and to initialize the state with the user-provided window buffer.
+   inflateBack() may then be used multiple times to inflate a complete, raw
+   deflate stream with each call.  inflateBackEnd() is then called to free the
+   allocated state.
+
+     A raw deflate stream is one with no zlib or gzip header or trailer.
+   This routine would normally be used in a utility that reads zip or gzip
+   files and writes out uncompressed files.  The utility would decode the
+   header and process the trailer on its own, hence this routine expects only
+   the raw deflate stream to decompress.  This is different from the default
+   behavior of inflate(), which expects a zlib header and trailer around the
+   deflate stream.
+
+     inflateBack() uses two subroutines supplied by the caller that are then
+   called by inflateBack() for input and output.  inflateBack() calls those
+   routines until it reads a complete deflate stream and writes out all of the
+   uncompressed data, or until it encounters an error.  The function's
+   parameters and return types are defined above in the in_func and out_func
+   typedefs.  inflateBack() will call in(in_desc, &buf) which should return the
+   number of bytes of provided input, and a pointer to that input in buf.  If
+   there is no input available, in() must return zero -- buf is ignored in that
+   case -- and inflateBack() will return a buffer error.  inflateBack() will
+   call out(out_desc, buf, len) to write the uncompressed data buf[0..len-1].
+   out() should return zero on success, or non-zero on failure.  If out()
+   returns non-zero, inflateBack() will return with an error.  Neither in() nor
+   out() are permitted to change the contents of the window provided to
+   inflateBackInit(), which is also the buffer that out() uses to write from.
+   The length written by out() will be at most the window size.  Any non-zero
+   amount of input may be provided by in().
+
+     For convenience, inflateBack() can be provided input on the first call by
+   setting strm->next_in and strm->avail_in.  If that input is exhausted, then
+   in() will be called.  Therefore strm->next_in must be initialized before
+   calling inflateBack().  If strm->next_in is Z_NULL, then in() will be called
+   immediately for input.  If strm->next_in is not Z_NULL, then strm->avail_in
+   must also be initialized, and then if strm->avail_in is not zero, input will
+   initially be taken from strm->next_in[0 ..  strm->avail_in - 1].
+
+     The in_desc and out_desc parameters of inflateBack() is passed as the
+   first parameter of in() and out() respectively when they are called.  These
+   descriptors can be optionally used to pass any information that the caller-
+   supplied in() and out() functions need to do their job.
+
+     On return, inflateBack() will set strm->next_in and strm->avail_in to
+   pass back any unused input that was provided by the last in() call.  The
+   return values of inflateBack() can be Z_STREAM_END on success, Z_BUF_ERROR
+   if in() or out() returned an error, Z_DATA_ERROR if there was a format error
+   in the deflate stream (in which case strm->msg is set to indicate the nature
+   of the error), or Z_STREAM_ERROR if the stream was not properly initialized.
+   In the case of Z_BUF_ERROR, an input or output error can be distinguished
+   using strm->next_in which will be Z_NULL only if in() returned an error.  If
+   strm->next_in is not Z_NULL, then the Z_BUF_ERROR was due to out() returning
+   non-zero.  (in() will always be called before out(), so strm->next_in is
+   assured to be defined if out() returns non-zero.)  Note that inflateBack()
+   cannot return Z_OK.
+*/
+
+ZEXTERN int ZEXPORT inflateBackEnd OF((z_streamp strm));
+/*
+     All memory allocated by inflateBackInit() is freed.
+
+     inflateBackEnd() returns Z_OK on success, or Z_STREAM_ERROR if the stream
+   state was inconsistent.
+*/
+
+ZEXTERN uLong ZEXPORT zlibCompileFlags OF((void));
+/* Return flags indicating compile-time options.
+
+    Type sizes, two bits each, 00 = 16 bits, 01 = 32, 10 = 64, 11 = other:
+     1.0: size of uInt
+     3.2: size of uLong
+     5.4: size of voidpf (pointer)
+     7.6: size of z_off_t
+
+    Compiler, assembler, and debug options:
+     8: ZLIB_DEBUG
+     9: ASMV or ASMINF -- use ASM code
+     10: ZLIB_WINAPI -- exported functions use the WINAPI calling convention
+     11: 0 (reserved)
+
+    One-time table building (smaller code, but not thread-safe if true):
+     12: BUILDFIXED -- build static block decoding tables when needed
+     13: DYNAMIC_CRC_TABLE -- build CRC calculation tables when needed
+     14,15: 0 (reserved)
+
+    Library content (indicates missing functionality):
+     16: NO_GZCOMPRESS -- gz* functions cannot compress (to avoid linking
+                          deflate code when not needed)
+     17: NO_GZIP -- deflate can't write gzip streams, and inflate can't detect
+                    and decode gzip streams (to avoid linking crc code)
+     18-19: 0 (reserved)
+
+    Operation variations (changes in library functionality):
+     20: PKZIP_BUG_WORKAROUND -- slightly more permissive inflate
+     21: FASTEST -- deflate algorithm with only one, lowest compression level
+     22,23: 0 (reserved)
+
+    The sprintf variant used by gzprintf (zero is best):
+     24: 0 = vs*, 1 = s* -- 1 means limited to 20 arguments after the format
+     25: 0 = *nprintf, 1 = *printf -- 1 means gzprintf() not secure!
+     26: 0 = returns value, 1 = void -- 1 means inferred string length returned
+
+    Remainder:
+     27-31: 0 (reserved)
+ */
+
+#ifndef Z_SOLO
+
+                        /* utility functions */
+
+/*
+     The following utility functions are implemented on top of the basic
+   stream-oriented functions.  To simplify the interface, some default options
+   are assumed (compression level and memory usage, standard memory allocation
+   functions).  The source code of these utility functions can be modified if
+   you need special options.
+*/
+
+ZEXTERN int ZEXPORT compress OF((Bytef *dest,   uLongf *destLen,
+                                 const Bytef *source, uLong sourceLen));
+/*
+     Compresses the source buffer into the destination buffer.  sourceLen is
+   the byte length of the source buffer.  Upon entry, destLen is the total size
+   of the destination buffer, which must be at least the value returned by
+   compressBound(sourceLen).  Upon exit, destLen is the actual size of the
+   compressed data.  compress() is equivalent to compress2() with a level
+   parameter of Z_DEFAULT_COMPRESSION.
+
+     compress returns Z_OK if success, Z_MEM_ERROR if there was not
+   enough memory, Z_BUF_ERROR if there was not enough room in the output
+   buffer.
+*/
+
+ZEXTERN int ZEXPORT compress2 OF((Bytef *dest,   uLongf *destLen,
+                                  const Bytef *source, uLong sourceLen,
+                                  int level));
+/*
+     Compresses the source buffer into the destination buffer.  The level
+   parameter has the same meaning as in deflateInit.  sourceLen is the byte
+   length of the source buffer.  Upon entry, destLen is the total size of the
+   destination buffer, which must be at least the value returned by
+   compressBound(sourceLen).  Upon exit, destLen is the actual size of the
+   compressed data.
+
+     compress2 returns Z_OK if success, Z_MEM_ERROR if there was not enough
+   memory, Z_BUF_ERROR if there was not enough room in the output buffer,
+   Z_STREAM_ERROR if the level parameter is invalid.
+*/
+
+ZEXTERN uLong ZEXPORT compressBound OF((uLong sourceLen));
+/*
+     compressBound() returns an upper bound on the compressed size after
+   compress() or compress2() on sourceLen bytes.  It would be used before a
+   compress() or compress2() call to allocate the destination buffer.
+*/
+
+ZEXTERN int ZEXPORT uncompress OF((Bytef *dest,   uLongf *destLen,
+                                   const Bytef *source, uLong sourceLen));
+/*
+     Decompresses the source buffer into the destination buffer.  sourceLen is
+   the byte length of the source buffer.  Upon entry, destLen is the total size
+   of the destination buffer, which must be large enough to hold the entire
+   uncompressed data.  (The size of the uncompressed data must have been saved
+   previously by the compressor and transmitted to the decompressor by some
+   mechanism outside the scope of this compression library.) Upon exit, destLen
+   is the actual size of the uncompressed data.
+
+     uncompress returns Z_OK if success, Z_MEM_ERROR if there was not
+   enough memory, Z_BUF_ERROR if there was not enough room in the output
+   buffer, or Z_DATA_ERROR if the input data was corrupted or incomplete.  In
+   the case where there is not enough room, uncompress() will fill the output
+   buffer with the uncompressed data up to that point.
+*/
+
+ZEXTERN int ZEXPORT uncompress2 OF((Bytef *dest,   uLongf *destLen,
+                                    const Bytef *source, uLong *sourceLen));
+/*
+     Same as uncompress, except that sourceLen is a pointer, where the
+   length of the source is *sourceLen.  On return, *sourceLen is the number of
+   source bytes consumed.
+*/
+
+                        /* gzip file access functions */
+
+/*
+     This library supports reading and writing files in gzip (.gz) format with
+   an interface similar to that of stdio, using the functions that start with
+   "gz".  The gzip format is different from the zlib format.  gzip is a gzip
+   wrapper, documented in RFC 1952, wrapped around a deflate stream.
+*/
+
+typedef struct gzFile_s *gzFile;    /* semi-opaque gzip file descriptor */
+
+/*
+ZEXTERN gzFile ZEXPORT gzopen OF((const char *path, const char *mode));
+
+     Opens a gzip (.gz) file for reading or writing.  The mode parameter is as
+   in fopen ("rb" or "wb") but can also include a compression level ("wb9") or
+   a strategy: 'f' for filtered data as in "wb6f", 'h' for Huffman-only
+   compression as in "wb1h", 'R' for run-length encoding as in "wb1R", or 'F'
+   for fixed code compression as in "wb9F".  (See the description of
+   deflateInit2 for more information about the strategy parameter.)  'T' will
+   request transparent writing or appending with no compression and not using
+   the gzip format.
+
+     "a" can be used instead of "w" to request that the gzip stream that will
+   be written be appended to the file.  "+" will result in an error, since
+   reading and writing to the same gzip file is not supported.  The addition of
+   "x" when writing will create the file exclusively, which fails if the file
+   already exists.  On systems that support it, the addition of "e" when
+   reading or writing will set the flag to close the file on an execve() call.
+
+     These functions, as well as gzip, will read and decode a sequence of gzip
+   streams in a file.  The append function of gzopen() can be used to create
+   such a file.  (Also see gzflush() for another way to do this.)  When
+   appending, gzopen does not test whether the file begins with a gzip stream,
+   nor does it look for the end of the gzip streams to begin appending.  gzopen
+   will simply append a gzip stream to the existing file.
+
+     gzopen can be used to read a file which is not in gzip format; in this
+   case gzread will directly read from the file without decompression.  When
+   reading, this will be detected automatically by looking for the magic two-
+   byte gzip header.
+
+     gzopen returns NULL if the file could not be opened, if there was
+   insufficient memory to allocate the gzFile state, or if an invalid mode was
+   specified (an 'r', 'w', or 'a' was not provided, or '+' was provided).
+   errno can be checked to determine if the reason gzopen failed was that the
+   file could not be opened.
+*/
+
+ZEXTERN gzFile ZEXPORT gzdopen OF((int fd, const char *mode));
+/*
+     gzdopen associates a gzFile with the file descriptor fd.  File descriptors
+   are obtained from calls like open, dup, creat, pipe or fileno (if the file
+   has been previously opened with fopen).  The mode parameter is as in gzopen.
+
+     The next call of gzclose on the returned gzFile will also close the file
+   descriptor fd, just like fclose(fdopen(fd, mode)) closes the file descriptor
+   fd.  If you want to keep fd open, use fd = dup(fd_keep); gz = gzdopen(fd,
+   mode);.  The duplicated descriptor should be saved to avoid a leak, since
+   gzdopen does not close fd if it fails.  If you are using fileno() to get the
+   file descriptor from a FILE *, then you will have to use dup() to avoid
+   double-close()ing the file descriptor.  Both gzclose() and fclose() will
+   close the associated file descriptor, so they need to have different file
+   descriptors.
+
+     gzdopen returns NULL if there was insufficient memory to allocate the
+   gzFile state, if an invalid mode was specified (an 'r', 'w', or 'a' was not
+   provided, or '+' was provided), or if fd is -1.  The file descriptor is not
+   used until the next gz* read, write, seek, or close operation, so gzdopen
+   will not detect if fd is invalid (unless fd is -1).
+*/
+
+ZEXTERN int ZEXPORT gzbuffer OF((gzFile file, unsigned size));
+/*
+     Set the internal buffer size used by this library's functions.  The
+   default buffer size is 8192 bytes.  This function must be called after
+   gzopen() or gzdopen(), and before any other calls that read or write the
+   file.  The buffer memory allocation is always deferred to the first read or
+   write.  Three times that size in buffer space is allocated.  A larger buffer
+   size of, for example, 64K or 128K bytes will noticeably increase the speed
+   of decompression (reading).
+
+     The new buffer size also affects the maximum length for gzprintf().
+
+     gzbuffer() returns 0 on success, or -1 on failure, such as being called
+   too late.
+*/
+
+ZEXTERN int ZEXPORT gzsetparams OF((gzFile file, int level, int strategy));
+/*
+     Dynamically update the compression level or strategy.  See the description
+   of deflateInit2 for the meaning of these parameters.  Previously provided
+   data is flushed before the parameter change.
+
+     gzsetparams returns Z_OK if success, Z_STREAM_ERROR if the file was not
+   opened for writing, Z_ERRNO if there is an error writing the flushed data,
+   or Z_MEM_ERROR if there is a memory allocation error.
+*/
+
+ZEXTERN int ZEXPORT gzread OF((gzFile file, voidp buf, unsigned len));
+/*
+     Reads the given number of uncompressed bytes from the compressed file.  If
+   the input file is not in gzip format, gzread copies the given number of
+   bytes into the buffer directly from the file.
+
+     After reaching the end of a gzip stream in the input, gzread will continue
+   to read, looking for another gzip stream.  Any number of gzip streams may be
+   concatenated in the input file, and will all be decompressed by gzread().
+   If something other than a gzip stream is encountered after a gzip stream,
+   that remaining trailing garbage is ignored (and no error is returned).
+
+     gzread can be used to read a gzip file that is being concurrently written.
+   Upon reaching the end of the input, gzread will return with the available
+   data.  If the error code returned by gzerror is Z_OK or Z_BUF_ERROR, then
+   gzclearerr can be used to clear the end of file indicator in order to permit
+   gzread to be tried again.  Z_OK indicates that a gzip stream was completed
+   on the last gzread.  Z_BUF_ERROR indicates that the input file ended in the
+   middle of a gzip stream.  Note that gzread does not return -1 in the event
+   of an incomplete gzip stream.  This error is deferred until gzclose(), which
+   will return Z_BUF_ERROR if the last gzread ended in the middle of a gzip
+   stream.  Alternatively, gzerror can be used before gzclose to detect this
+   case.
+
+     gzread returns the number of uncompressed bytes actually read, less than
+   len for end of file, or -1 for error.  If len is too large to fit in an int,
+   then nothing is read, -1 is returned, and the error state is set to
+   Z_STREAM_ERROR.
+*/
+
+ZEXTERN z_size_t ZEXPORT gzfread OF((voidp buf, z_size_t size, z_size_t nitems,
+                                     gzFile file));
+/*
+     Read up to nitems items of size size from file to buf, otherwise operating
+   as gzread() does.  This duplicates the interface of stdio's fread(), with
+   size_t request and return types.  If the library defines size_t, then
+   z_size_t is identical to size_t.  If not, then z_size_t is an unsigned
+   integer type that can contain a pointer.
+
+     gzfread() returns the number of full items read of size size, or zero if
+   the end of the file was reached and a full item could not be read, or if
+   there was an error.  gzerror() must be consulted if zero is returned in
+   order to determine if there was an error.  If the multiplication of size and
+   nitems overflows, i.e. the product does not fit in a z_size_t, then nothing
+   is read, zero is returned, and the error state is set to Z_STREAM_ERROR.
+
+     In the event that the end of file is reached and only a partial item is
+   available at the end, i.e. the remaining uncompressed data length is not a
+   multiple of size, then the final partial item is nevetheless read into buf
+   and the end-of-file flag is set.  The length of the partial item read is not
+   provided, but could be inferred from the result of gztell().  This behavior
+   is the same as the behavior of fread() implementations in common libraries,
+   but it prevents the direct use of gzfread() to read a concurrently written
+   file, reseting and retrying on end-of-file, when size is not 1.
+*/
+
+ZEXTERN int ZEXPORT gzwrite OF((gzFile file,
+                                voidpc buf, unsigned len));
+/*
+     Writes the given number of uncompressed bytes into the compressed file.
+   gzwrite returns the number of uncompressed bytes written or 0 in case of
+   error.
+*/
+
+ZEXTERN z_size_t ZEXPORT gzfwrite OF((voidpc buf, z_size_t size,
+                                      z_size_t nitems, gzFile file));
+/*
+     gzfwrite() writes nitems items of size size from buf to file, duplicating
+   the interface of stdio's fwrite(), with size_t request and return types.  If
+   the library defines size_t, then z_size_t is identical to size_t.  If not,
+   then z_size_t is an unsigned integer type that can contain a pointer.
+
+     gzfwrite() returns the number of full items written of size size, or zero
+   if there was an error.  If the multiplication of size and nitems overflows,
+   i.e. the product does not fit in a z_size_t, then nothing is written, zero
+   is returned, and the error state is set to Z_STREAM_ERROR.
+*/
+
+ZEXTERN int ZEXPORTVA gzprintf Z_ARG((gzFile file, const char *format, ...));
+/*
+     Converts, formats, and writes the arguments to the compressed file under
+   control of the format string, as in fprintf.  gzprintf returns the number of
+   uncompressed bytes actually written, or a negative zlib error code in case
+   of error.  The number of uncompressed bytes written is limited to 8191, or
+   one less than the buffer size given to gzbuffer().  The caller should assure
+   that this limit is not exceeded.  If it is exceeded, then gzprintf() will
+   return an error (0) with nothing written.  In this case, there may also be a
+   buffer overflow with unpredictable consequences, which is possible only if
+   zlib was compiled with the insecure functions sprintf() or vsprintf()
+   because the secure snprintf() or vsnprintf() functions were not available.
+   This can be determined using zlibCompileFlags().
+*/
+
+ZEXTERN int ZEXPORT gzputs OF((gzFile file, const char *s));
+/*
+     Writes the given null-terminated string to the compressed file, excluding
+   the terminating null character.
+
+     gzputs returns the number of characters written, or -1 in case of error.
+*/
+
+ZEXTERN char * ZEXPORT gzgets OF((gzFile file, char *buf, int len));
+/*
+     Reads bytes from the compressed file until len-1 characters are read, or a
+   newline character is read and transferred to buf, or an end-of-file
+   condition is encountered.  If any characters are read or if len == 1, the
+   string is terminated with a null character.  If no characters are read due
+   to an end-of-file or len < 1, then the buffer is left untouched.
+
+     gzgets returns buf which is a null-terminated string, or it returns NULL
+   for end-of-file or in case of error.  If there was an error, the contents at
+   buf are indeterminate.
+*/
+
+ZEXTERN int ZEXPORT gzputc OF((gzFile file, int c));
+/*
+     Writes c, converted to an unsigned char, into the compressed file.  gzputc
+   returns the value that was written, or -1 in case of error.
+*/
+
+ZEXTERN int ZEXPORT gzgetc OF((gzFile file));
+/*
+     Reads one byte from the compressed file.  gzgetc returns this byte or -1
+   in case of end of file or error.  This is implemented as a macro for speed.
+   As such, it does not do all of the checking the other functions do.  I.e.
+   it does not check to see if file is NULL, nor whether the structure file
+   points to has been clobbered or not.
+*/
+
+ZEXTERN int ZEXPORT gzungetc OF((int c, gzFile file));
+/*
+     Push one character back onto the stream to be read as the first character
+   on the next read.  At least one character of push-back is allowed.
+   gzungetc() returns the character pushed, or -1 on failure.  gzungetc() will
+   fail if c is -1, and may fail if a character has been pushed but not read
+   yet.  If gzungetc is used immediately after gzopen or gzdopen, at least the
+   output buffer size of pushed characters is allowed.  (See gzbuffer above.)
+   The pushed character will be discarded if the stream is repositioned with
+   gzseek() or gzrewind().
+*/
+
+ZEXTERN int ZEXPORT gzflush OF((gzFile file, int flush));
+/*
+     Flushes all pending output into the compressed file.  The parameter flush
+   is as in the deflate() function.  The return value is the zlib error number
+   (see function gzerror below).  gzflush is only permitted when writing.
+
+     If the flush parameter is Z_FINISH, the remaining data is written and the
+   gzip stream is completed in the output.  If gzwrite() is called again, a new
+   gzip stream will be started in the output.  gzread() is able to read such
+   concatenated gzip streams.
+
+     gzflush should be called only when strictly necessary because it will
+   degrade compression if called too often.
+*/
+
+/*
+ZEXTERN z_off_t ZEXPORT gzseek OF((gzFile file,
+                                   z_off_t offset, int whence));
+
+     Sets the starting position for the next gzread or gzwrite on the given
+   compressed file.  The offset represents a number of bytes in the
+   uncompressed data stream.  The whence parameter is defined as in lseek(2);
+   the value SEEK_END is not supported.
+
+     If the file is opened for reading, this function is emulated but can be
+   extremely slow.  If the file is opened for writing, only forward seeks are
+   supported; gzseek then compresses a sequence of zeroes up to the new
+   starting position.
+
+     gzseek returns the resulting offset location as measured in bytes from
+   the beginning of the uncompressed stream, or -1 in case of error, in
+   particular if the file is opened for writing and the new starting position
+   would be before the current position.
+*/
+
+ZEXTERN int ZEXPORT    gzrewind OF((gzFile file));
+/*
+     Rewinds the given file. This function is supported only for reading.
+
+     gzrewind(file) is equivalent to (int)gzseek(file, 0L, SEEK_SET)
+*/
+
+/*
+ZEXTERN z_off_t ZEXPORT    gztell OF((gzFile file));
+
+     Returns the starting position for the next gzread or gzwrite on the given
+   compressed file.  This position represents a number of bytes in the
+   uncompressed data stream, and is zero when starting, even if appending or
+   reading a gzip stream from the middle of a file using gzdopen().
+
+     gztell(file) is equivalent to gzseek(file, 0L, SEEK_CUR)
+*/
+
+/*
+ZEXTERN z_off_t ZEXPORT gzoffset OF((gzFile file));
+
+     Returns the current offset in the file being read or written.  This offset
+   includes the count of bytes that precede the gzip stream, for example when
+   appending or when using gzdopen() for reading.  When reading, the offset
+   does not include as yet unused buffered input.  This information can be used
+   for a progress indicator.  On error, gzoffset() returns -1.
+*/
+
+ZEXTERN int ZEXPORT gzeof OF((gzFile file));
+/*
+     Returns true (1) if the end-of-file indicator has been set while reading,
+   false (0) otherwise.  Note that the end-of-file indicator is set only if the
+   read tried to go past the end of the input, but came up short.  Therefore,
+   just like feof(), gzeof() may return false even if there is no more data to
+   read, in the event that the last read request was for the exact number of
+   bytes remaining in the input file.  This will happen if the input file size
+   is an exact multiple of the buffer size.
+
+     If gzeof() returns true, then the read functions will return no more data,
+   unless the end-of-file indicator is reset by gzclearerr() and the input file
+   has grown since the previous end of file was detected.
+*/
+
+ZEXTERN int ZEXPORT gzdirect OF((gzFile file));
+/*
+     Returns true (1) if file is being copied directly while reading, or false
+   (0) if file is a gzip stream being decompressed.
+
+     If the input file is empty, gzdirect() will return true, since the input
+   does not contain a gzip stream.
+
+     If gzdirect() is used immediately after gzopen() or gzdopen() it will
+   cause buffers to be allocated to allow reading the file to determine if it
+   is a gzip file.  Therefore if gzbuffer() is used, it should be called before
+   gzdirect().
+
+     When writing, gzdirect() returns true (1) if transparent writing was
+   requested ("wT" for the gzopen() mode), or false (0) otherwise.  (Note:
+   gzdirect() is not needed when writing.  Transparent writing must be
+   explicitly requested, so the application already knows the answer.  When
+   linking statically, using gzdirect() will include all of the zlib code for
+   gzip file reading and decompression, which may not be desired.)
+*/
+
+ZEXTERN int ZEXPORT    gzclose OF((gzFile file));
+/*
+     Flushes all pending output if necessary, closes the compressed file and
+   deallocates the (de)compression state.  Note that once file is closed, you
+   cannot call gzerror with file, since its structures have been deallocated.
+   gzclose must not be called more than once on the same file, just as free
+   must not be called more than once on the same allocation.
+
+     gzclose will return Z_STREAM_ERROR if file is not valid, Z_ERRNO on a
+   file operation error, Z_MEM_ERROR if out of memory, Z_BUF_ERROR if the
+   last read ended in the middle of a gzip stream, or Z_OK on success.
+*/
+
+ZEXTERN int ZEXPORT gzclose_r OF((gzFile file));
+ZEXTERN int ZEXPORT gzclose_w OF((gzFile file));
+/*
+     Same as gzclose(), but gzclose_r() is only for use when reading, and
+   gzclose_w() is only for use when writing or appending.  The advantage to
+   using these instead of gzclose() is that they avoid linking in zlib
+   compression or decompression code that is not used when only reading or only
+   writing respectively.  If gzclose() is used, then both compression and
+   decompression code will be included the application when linking to a static
+   zlib library.
+*/
+
+ZEXTERN const char * ZEXPORT gzerror OF((gzFile file, int *errnum));
+/*
+     Returns the error message for the last error which occurred on the given
+   compressed file.  errnum is set to zlib error number.  If an error occurred
+   in the file system and not in the compression library, errnum is set to
+   Z_ERRNO and the application may consult errno to get the exact error code.
+
+     The application must not modify the returned string.  Future calls to
+   this function may invalidate the previously returned string.  If file is
+   closed, then the string previously returned by gzerror will no longer be
+   available.
+
+     gzerror() should be used to distinguish errors from end-of-file for those
+   functions above that do not distinguish those cases in their return values.
+*/
+
+ZEXTERN void ZEXPORT gzclearerr OF((gzFile file));
+/*
+     Clears the error and end-of-file flags for file.  This is analogous to the
+   clearerr() function in stdio.  This is useful for continuing to read a gzip
+   file that is being written concurrently.
+*/
+
+#endif /* !Z_SOLO */
+
+                        /* checksum functions */
+
+/*
+     These functions are not related to compression but are exported
+   anyway because they might be useful in applications using the compression
+   library.
+*/
+
+ZEXTERN uLong ZEXPORT adler32 OF((uLong adler, const Bytef *buf, uInt len));
+/*
+     Update a running Adler-32 checksum with the bytes buf[0..len-1] and
+   return the updated checksum.  If buf is Z_NULL, this function returns the
+   required initial value for the checksum.
+
+     An Adler-32 checksum is almost as reliable as a CRC-32 but can be computed
+   much faster.
+
+   Usage example:
+
+     uLong adler = adler32(0L, Z_NULL, 0);
+
+     while (read_buffer(buffer, length) != EOF) {
+       adler = adler32(adler, buffer, length);
+     }
+     if (adler != original_adler) error();
+*/
+
+ZEXTERN uLong ZEXPORT adler32_z OF((uLong adler, const Bytef *buf,
+                                    z_size_t len));
+/*
+     Same as adler32(), but with a size_t length.
+*/
+
+/*
+ZEXTERN uLong ZEXPORT adler32_combine OF((uLong adler1, uLong adler2,
+                                          z_off_t len2));
+
+     Combine two Adler-32 checksums into one.  For two sequences of bytes, seq1
+   and seq2 with lengths len1 and len2, Adler-32 checksums were calculated for
+   each, adler1 and adler2.  adler32_combine() returns the Adler-32 checksum of
+   seq1 and seq2 concatenated, requiring only adler1, adler2, and len2.  Note
+   that the z_off_t type (like off_t) is a signed integer.  If len2 is
+   negative, the result has no meaning or utility.
+*/
+
+ZEXTERN uLong ZEXPORT crc32   OF((uLong crc, const Bytef *buf, uInt len));
+/*
+     Update a running CRC-32 with the bytes buf[0..len-1] and return the
+   updated CRC-32.  If buf is Z_NULL, this function returns the required
+   initial value for the crc.  Pre- and post-conditioning (one's complement) is
+   performed within this function so it shouldn't be done by the application.
+
+   Usage example:
+
+     uLong crc = crc32(0L, Z_NULL, 0);
+
+     while (read_buffer(buffer, length) != EOF) {
+       crc = crc32(crc, buffer, length);
+     }
+     if (crc != original_crc) error();
+*/
+
+ZEXTERN uLong ZEXPORT crc32_z OF((uLong adler, const Bytef *buf,
+                                  z_size_t len));
+/*
+     Same as crc32(), but with a size_t length.
+*/
+
+/*
+ZEXTERN uLong ZEXPORT crc32_combine OF((uLong crc1, uLong crc2, z_off_t len2));
+
+     Combine two CRC-32 check values into one.  For two sequences of bytes,
+   seq1 and seq2 with lengths len1 and len2, CRC-32 check values were
+   calculated for each, crc1 and crc2.  crc32_combine() returns the CRC-32
+   check value of seq1 and seq2 concatenated, requiring only crc1, crc2, and
+   len2.
+*/
+
+
+                        /* various hacks, don't look :) */
+
+/* deflateInit and inflateInit are macros to allow checking the zlib version
+ * and the compiler's view of z_stream:
+ */
+ZEXTERN int ZEXPORT deflateInit_ OF((z_streamp strm, int level,
+                                     const char *version, int stream_size));
+ZEXTERN int ZEXPORT inflateInit_ OF((z_streamp strm,
+                                     const char *version, int stream_size));
+ZEXTERN int ZEXPORT deflateInit2_ OF((z_streamp strm, int  level, int  method,
+                                      int windowBits, int memLevel,
+                                      int strategy, const char *version,
+                                      int stream_size));
+ZEXTERN int ZEXPORT inflateInit2_ OF((z_streamp strm, int  windowBits,
+                                      const char *version, int stream_size));
+ZEXTERN int ZEXPORT inflateBackInit_ OF((z_streamp strm, int windowBits,
+                                         unsigned char FAR *window,
+                                         const char *version,
+                                         int stream_size));
+#ifdef Z_PREFIX_SET
+#  define z_deflateInit(strm, level) \
+          deflateInit_((strm), (level), ZLIB_VERSION, (int)sizeof(z_stream))
+#  define z_inflateInit(strm) \
+          inflateInit_((strm), ZLIB_VERSION, (int)sizeof(z_stream))
+#  define z_deflateInit2(strm, level, method, windowBits, memLevel, strategy) \
+          deflateInit2_((strm),(level),(method),(windowBits),(memLevel),\
+                        (strategy), ZLIB_VERSION, (int)sizeof(z_stream))
+#  define z_inflateInit2(strm, windowBits) \
+          inflateInit2_((strm), (windowBits), ZLIB_VERSION, \
+                        (int)sizeof(z_stream))
+#  define z_inflateBackInit(strm, windowBits, window) \
+          inflateBackInit_((strm), (windowBits), (window), \
+                           ZLIB_VERSION, (int)sizeof(z_stream))
+#else
+#  define deflateInit(strm, level) \
+          deflateInit_((strm), (level), ZLIB_VERSION, (int)sizeof(z_stream))
+#  define inflateInit(strm) \
+          inflateInit_((strm), ZLIB_VERSION, (int)sizeof(z_stream))
+#  define deflateInit2(strm, level, method, windowBits, memLevel, strategy) \
+          deflateInit2_((strm),(level),(method),(windowBits),(memLevel),\
+                        (strategy), ZLIB_VERSION, (int)sizeof(z_stream))
+#  define inflateInit2(strm, windowBits) \
+          inflateInit2_((strm), (windowBits), ZLIB_VERSION, \
+                        (int)sizeof(z_stream))
+#  define inflateBackInit(strm, windowBits, window) \
+          inflateBackInit_((strm), (windowBits), (window), \
+                           ZLIB_VERSION, (int)sizeof(z_stream))
+#endif
+
+#ifndef Z_SOLO
+
+/* gzgetc() macro and its supporting function and exposed data structure.  Note
+ * that the real internal state is much larger than the exposed structure.
+ * This abbreviated structure exposes just enough for the gzgetc() macro.  The
+ * user should not mess with these exposed elements, since their names or
+ * behavior could change in the future, perhaps even capriciously.  They can
+ * only be used by the gzgetc() macro.  You have been warned.
+ */
+struct gzFile_s {
+    unsigned have;
+    unsigned char *next;
+    z_off64_t pos;
+};
+ZEXTERN int ZEXPORT gzgetc_ OF((gzFile file));  /* backward compatibility */
+#ifdef Z_PREFIX_SET
+#  undef z_gzgetc
+#  define z_gzgetc(g) \
+          ((g)->have ? ((g)->have--, (g)->pos++, *((g)->next)++) : (gzgetc)(g))
+#elif defined(Z_CR_PREFIX_SET)
+#    undef gzgetc
+#    define gzgetc(g) \
+          ((g)->have ? ((g)->have--, (g)->pos++, *((g)->next)++) \
+                     : (Cr_z_gzgetc)(g))
+#else
+#  define gzgetc(g) \
+          ((g)->have ? ((g)->have--, (g)->pos++, *((g)->next)++) : (gzgetc)(g))
+#endif
+
+/* provide 64-bit offset functions if _LARGEFILE64_SOURCE defined, and/or
+ * change the regular functions to 64 bits if _FILE_OFFSET_BITS is 64 (if
+ * both are true, the application gets the *64 functions, and the regular
+ * functions are changed to 64 bits) -- in case these are set on systems
+ * without large file support, _LFS64_LARGEFILE must also be true
+ */
+#ifdef Z_LARGE64
+   ZEXTERN gzFile ZEXPORT gzopen64 OF((const char *, const char *));
+   ZEXTERN z_off64_t ZEXPORT gzseek64 OF((gzFile, z_off64_t, int));
+   ZEXTERN z_off64_t ZEXPORT gztell64 OF((gzFile));
+   ZEXTERN z_off64_t ZEXPORT gzoffset64 OF((gzFile));
+   ZEXTERN uLong ZEXPORT adler32_combine64 OF((uLong, uLong, z_off64_t));
+   ZEXTERN uLong ZEXPORT crc32_combine64 OF((uLong, uLong, z_off64_t));
+#endif
+
+#if !defined(ZLIB_INTERNAL) && defined(Z_WANT64)
+#  ifdef Z_PREFIX_SET
+#    define z_gzopen z_gzopen64
+#    define z_gzseek z_gzseek64
+#    define z_gztell z_gztell64
+#    define z_gzoffset z_gzoffset64
+#    define z_adler32_combine z_adler32_combine64
+#    define z_crc32_combine z_crc32_combine64
+#  else
+#    ifdef gzopen
+#      undef gzopen
+#    endif
+#    define gzopen gzopen64
+#    ifdef gzseek
+#      undef gzseek
+#    endif
+#    define gzseek gzseek64
+#    ifdef gztell
+#      undef gztell
+#    endif
+#    define gztell gztell64
+#    ifdef gzoffset
+#      undef gzoffset
+#    endif
+#    define gzoffset gzoffset64
+#    ifdef adler32_combine
+#      undef adler32_combine
+#    endif
+#    define adler32_combine adler32_combine64
+#    ifdef crc32_combine
+#      undef crc32_combine
+#    endif
+#    define crc32_combine crc32_combine64
+#  endif
+#  ifndef Z_LARGE64
+     ZEXTERN gzFile ZEXPORT gzopen64 OF((const char *, const char *));
+     ZEXTERN z_off_t ZEXPORT gzseek64 OF((gzFile, z_off_t, int));
+     ZEXTERN z_off_t ZEXPORT gztell64 OF((gzFile));
+     ZEXTERN z_off_t ZEXPORT gzoffset64 OF((gzFile));
+     ZEXTERN uLong ZEXPORT adler32_combine64 OF((uLong, uLong, z_off_t));
+     ZEXTERN uLong ZEXPORT crc32_combine64 OF((uLong, uLong, z_off_t));
+#  endif
+#else
+   ZEXTERN gzFile ZEXPORT gzopen OF((const char *, const char *));
+   ZEXTERN z_off_t ZEXPORT gzseek OF((gzFile, z_off_t, int));
+   ZEXTERN z_off_t ZEXPORT gztell OF((gzFile));
+   ZEXTERN z_off_t ZEXPORT gzoffset OF((gzFile));
+   ZEXTERN uLong ZEXPORT adler32_combine OF((uLong, uLong, z_off_t));
+   ZEXTERN uLong ZEXPORT crc32_combine OF((uLong, uLong, z_off_t));
+#endif
+
+#else /* Z_SOLO */
+
+   ZEXTERN uLong ZEXPORT adler32_combine OF((uLong, uLong, z_off_t));
+   ZEXTERN uLong ZEXPORT crc32_combine OF((uLong, uLong, z_off_t));
+
+#endif /* !Z_SOLO */
+
+/* undocumented functions */
+ZEXTERN const char   * ZEXPORT zError           OF((int));
+ZEXTERN int            ZEXPORT inflateSyncPoint OF((z_streamp));
+ZEXTERN const z_crc_t FAR * ZEXPORT get_crc_table    OF((void));
+ZEXTERN int            ZEXPORT inflateUndermine OF((z_streamp, int));
+ZEXTERN int            ZEXPORT inflateValidate OF((z_streamp, int));
+ZEXTERN unsigned long  ZEXPORT inflateCodesUsed OF ((z_streamp));
+ZEXTERN int            ZEXPORT inflateResetKeep OF((z_streamp));
+ZEXTERN int            ZEXPORT deflateResetKeep OF((z_streamp));
+#if (defined(_WIN32) || defined(__CYGWIN__)) && !defined(Z_SOLO)
+ZEXTERN gzFile         ZEXPORT gzopen_w OF((const wchar_t *path,
+                                            const char *mode));
+#endif
+#if defined(STDC) || defined(Z_HAVE_STDARG_H)
+#  ifndef Z_SOLO
+ZEXTERN int            ZEXPORTVA gzvprintf Z_ARG((gzFile file,
+                                                  const char *format,
+                                                  va_list va));
+#  endif
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* ZLIB_H */
diff --git a/deps/v8/third_party/zlib/zutil.c b/deps/v8/third_party/zlib/zutil.c
new file mode 100644
index 00000000000000..a76c6b0c7e557f
--- /dev/null
+++ b/deps/v8/third_party/zlib/zutil.c
@@ -0,0 +1,325 @@
+/* zutil.c -- target dependent utility functions for the compression library
+ * Copyright (C) 1995-2017 Jean-loup Gailly
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/* @(#) $Id$ */
+
+#include "zutil.h"
+#ifndef Z_SOLO
+#  include "gzguts.h"
+#endif
+
+z_const char * const z_errmsg[10] = {
+    (z_const char *)"need dictionary",     /* Z_NEED_DICT       2  */
+    (z_const char *)"stream end",          /* Z_STREAM_END      1  */
+    (z_const char *)"",                    /* Z_OK              0  */
+    (z_const char *)"file error",          /* Z_ERRNO         (-1) */
+    (z_const char *)"stream error",        /* Z_STREAM_ERROR  (-2) */
+    (z_const char *)"data error",          /* Z_DATA_ERROR    (-3) */
+    (z_const char *)"insufficient memory", /* Z_MEM_ERROR     (-4) */
+    (z_const char *)"buffer error",        /* Z_BUF_ERROR     (-5) */
+    (z_const char *)"incompatible version",/* Z_VERSION_ERROR (-6) */
+    (z_const char *)""
+};
+
+
+const char * ZEXPORT zlibVersion()
+{
+    return ZLIB_VERSION;
+}
+
+uLong ZEXPORT zlibCompileFlags()
+{
+    uLong flags;
+
+    flags = 0;
+    switch ((int)(sizeof(uInt))) {
+    case 2:     break;
+    case 4:     flags += 1;     break;
+    case 8:     flags += 2;     break;
+    default:    flags += 3;
+    }
+    switch ((int)(sizeof(uLong))) {
+    case 2:     break;
+    case 4:     flags += 1 << 2;        break;
+    case 8:     flags += 2 << 2;        break;
+    default:    flags += 3 << 2;
+    }
+    switch ((int)(sizeof(voidpf))) {
+    case 2:     break;
+    case 4:     flags += 1 << 4;        break;
+    case 8:     flags += 2 << 4;        break;
+    default:    flags += 3 << 4;
+    }
+    switch ((int)(sizeof(z_off_t))) {
+    case 2:     break;
+    case 4:     flags += 1 << 6;        break;
+    case 8:     flags += 2 << 6;        break;
+    default:    flags += 3 << 6;
+    }
+#ifdef ZLIB_DEBUG
+    flags += 1 << 8;
+#endif
+#if defined(ASMV) || defined(ASMINF)
+    flags += 1 << 9;
+#endif
+#ifdef ZLIB_WINAPI
+    flags += 1 << 10;
+#endif
+#ifdef BUILDFIXED
+    flags += 1 << 12;
+#endif
+#ifdef DYNAMIC_CRC_TABLE
+    flags += 1 << 13;
+#endif
+#ifdef NO_GZCOMPRESS
+    flags += 1L << 16;
+#endif
+#ifdef NO_GZIP
+    flags += 1L << 17;
+#endif
+#ifdef PKZIP_BUG_WORKAROUND
+    flags += 1L << 20;
+#endif
+#ifdef FASTEST
+    flags += 1L << 21;
+#endif
+#if defined(STDC) || defined(Z_HAVE_STDARG_H)
+#  ifdef NO_vsnprintf
+    flags += 1L << 25;
+#    ifdef HAS_vsprintf_void
+    flags += 1L << 26;
+#    endif
+#  else
+#    ifdef HAS_vsnprintf_void
+    flags += 1L << 26;
+#    endif
+#  endif
+#else
+    flags += 1L << 24;
+#  ifdef NO_snprintf
+    flags += 1L << 25;
+#    ifdef HAS_sprintf_void
+    flags += 1L << 26;
+#    endif
+#  else
+#    ifdef HAS_snprintf_void
+    flags += 1L << 26;
+#    endif
+#  endif
+#endif
+    return flags;
+}
+
+#ifdef ZLIB_DEBUG
+#include <stdlib.h>
+#  ifndef verbose
+#    define verbose 0
+#  endif
+int ZLIB_INTERNAL z_verbose = verbose;
+
+void ZLIB_INTERNAL z_error (m)
+    char *m;
+{
+    fprintf(stderr, "%s\n", m);
+    exit(1);
+}
+#endif
+
+/* exported to allow conversion of error code to string for compress() and
+ * uncompress()
+ */
+const char * ZEXPORT zError(err)
+    int err;
+{
+    return ERR_MSG(err);
+}
+
+#if defined(_WIN32_WCE)
+    /* The Microsoft C Run-Time Library for Windows CE doesn't have
+     * errno.  We define it as a global variable to simplify porting.
+     * Its value is always 0 and should not be used.
+     */
+    int errno = 0;
+#endif
+
+#ifndef HAVE_MEMCPY
+
+void ZLIB_INTERNAL zmemcpy(dest, source, len)
+    Bytef* dest;
+    const Bytef* source;
+    uInt  len;
+{
+    if (len == 0) return;
+    do {
+        *dest++ = *source++; /* ??? to be unrolled */
+    } while (--len != 0);
+}
+
+int ZLIB_INTERNAL zmemcmp(s1, s2, len)
+    const Bytef* s1;
+    const Bytef* s2;
+    uInt  len;
+{
+    uInt j;
+
+    for (j = 0; j < len; j++) {
+        if (s1[j] != s2[j]) return 2*(s1[j] > s2[j])-1;
+    }
+    return 0;
+}
+
+void ZLIB_INTERNAL zmemzero(dest, len)
+    Bytef* dest;
+    uInt  len;
+{
+    if (len == 0) return;
+    do {
+        *dest++ = 0;  /* ??? to be unrolled */
+    } while (--len != 0);
+}
+#endif
+
+#ifndef Z_SOLO
+
+#ifdef SYS16BIT
+
+#ifdef __TURBOC__
+/* Turbo C in 16-bit mode */
+
+#  define MY_ZCALLOC
+
+/* Turbo C malloc() does not allow dynamic allocation of 64K bytes
+ * and farmalloc(64K) returns a pointer with an offset of 8, so we
+ * must fix the pointer. Warning: the pointer must be put back to its
+ * original form in order to free it, use zcfree().
+ */
+
+#define MAX_PTR 10
+/* 10*64K = 640K */
+
+local int next_ptr = 0;
+
+typedef struct ptr_table_s {
+    voidpf org_ptr;
+    voidpf new_ptr;
+} ptr_table;
+
+local ptr_table table[MAX_PTR];
+/* This table is used to remember the original form of pointers
+ * to large buffers (64K). Such pointers are normalized with a zero offset.
+ * Since MSDOS is not a preemptive multitasking OS, this table is not
+ * protected from concurrent access. This hack doesn't work anyway on
+ * a protected system like OS/2. Use Microsoft C instead.
+ */
+
+voidpf ZLIB_INTERNAL zcalloc (voidpf opaque, unsigned items, unsigned size)
+{
+    voidpf buf;
+    ulg bsize = (ulg)items*size;
+
+    (void)opaque;
+
+    /* If we allocate less than 65520 bytes, we assume that farmalloc
+     * will return a usable pointer which doesn't have to be normalized.
+     */
+    if (bsize < 65520L) {
+        buf = farmalloc(bsize);
+        if (*(ush*)&buf != 0) return buf;
+    } else {
+        buf = farmalloc(bsize + 16L);
+    }
+    if (buf == NULL || next_ptr >= MAX_PTR) return NULL;
+    table[next_ptr].org_ptr = buf;
+
+    /* Normalize the pointer to seg:0 */
+    *((ush*)&buf+1) += ((ush)((uch*)buf-0) + 15) >> 4;
+    *(ush*)&buf = 0;
+    table[next_ptr++].new_ptr = buf;
+    return buf;
+}
+
+void ZLIB_INTERNAL zcfree (voidpf opaque, voidpf ptr)
+{
+    int n;
+
+    (void)opaque;
+
+    if (*(ush*)&ptr != 0) { /* object < 64K */
+        farfree(ptr);
+        return;
+    }
+    /* Find the original pointer */
+    for (n = 0; n < next_ptr; n++) {
+        if (ptr != table[n].new_ptr) continue;
+
+        farfree(table[n].org_ptr);
+        while (++n < next_ptr) {
+            table[n-1] = table[n];
+        }
+        next_ptr--;
+        return;
+    }
+    Assert(0, "zcfree: ptr not found");
+}
+
+#endif /* __TURBOC__ */
+
+
+#ifdef M_I86
+/* Microsoft C in 16-bit mode */
+
+#  define MY_ZCALLOC
+
+#if (!defined(_MSC_VER) || (_MSC_VER <= 600))
+#  define _halloc  halloc
+#  define _hfree   hfree
+#endif
+
+voidpf ZLIB_INTERNAL zcalloc (voidpf opaque, uInt items, uInt size)
+{
+    (void)opaque;
+    return _halloc((long)items, size);
+}
+
+void ZLIB_INTERNAL zcfree (voidpf opaque, voidpf ptr)
+{
+    (void)opaque;
+    _hfree(ptr);
+}
+
+#endif /* M_I86 */
+
+#endif /* SYS16BIT */
+
+
+#ifndef MY_ZCALLOC /* Any system without a special alloc function */
+
+#ifndef STDC
+extern voidp  malloc OF((uInt size));
+extern voidp  calloc OF((uInt items, uInt size));
+extern void   free   OF((voidpf ptr));
+#endif
+
+voidpf ZLIB_INTERNAL zcalloc (opaque, items, size)
+    voidpf opaque;
+    unsigned items;
+    unsigned size;
+{
+    (void)opaque;
+    return sizeof(uInt) > 2 ? (voidpf)malloc(items * size) :
+                              (voidpf)calloc(items, size);
+}
+
+void ZLIB_INTERNAL zcfree (opaque, ptr)
+    voidpf opaque;
+    voidpf ptr;
+{
+    (void)opaque;
+    free(ptr);
+}
+
+#endif /* MY_ZCALLOC */
+
+#endif /* !Z_SOLO */
diff --git a/deps/v8/third_party/zlib/zutil.h b/deps/v8/third_party/zlib/zutil.h
new file mode 100644
index 00000000000000..4425bcf75eb38c
--- /dev/null
+++ b/deps/v8/third_party/zlib/zutil.h
@@ -0,0 +1,292 @@
+/* zutil.h -- internal interface and configuration of the compression library
+ * Copyright (C) 1995-2016 Jean-loup Gailly, Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+/* WARNING: this file should *not* be used by applications. It is
+   part of the implementation of the compression library and is
+   subject to change. Applications should only use zlib.h.
+ */
+
+/* @(#) $Id$ */
+
+#ifndef ZUTIL_H
+#define ZUTIL_H
+
+#ifdef HAVE_HIDDEN
+#  define ZLIB_INTERNAL __attribute__((visibility ("hidden")))
+#else
+#  define ZLIB_INTERNAL
+#endif
+
+#include "zlib.h"
+
+#if defined(STDC) && !defined(Z_SOLO)
+#  if !(defined(_WIN32_WCE) && defined(_MSC_VER))
+#    include <stddef.h>
+#  endif
+#  include <string.h>
+#  include <stdlib.h>
+#endif
+#ifdef NO_ERRNO_H
+#   ifdef _WIN32_WCE
+      /* The Microsoft C Run-Time Library for Windows CE doesn't have
+       * errno.  We define it as a global variable to simplify porting.
+       * Its value is always 0 and should not be used.  We rename it to
+       * avoid conflict with other libraries that use the same workaround.
+       */
+#     define errno z_errno
+#   endif
+    extern int errno;
+#else
+#  ifndef _WIN32_WCE
+#    include <errno.h>
+#  endif
+#endif
+
+#ifdef Z_SOLO
+   typedef long ptrdiff_t;  /* guess -- will be caught if guess is wrong */
+#endif
+
+#ifndef local
+#  define local static
+#endif
+/* since "static" is used to mean two completely different things in C, we
+   define "local" for the non-static meaning of "static", for readability
+   (compile with -Dlocal if your debugger can't find static symbols) */
+
+typedef unsigned char  uch;
+typedef uch FAR uchf;
+typedef unsigned short ush;
+typedef ush FAR ushf;
+typedef unsigned long  ulg;
+
+extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
+/* (size given to avoid silly warnings with Visual C++) */
+
+#define ERR_MSG(err) z_errmsg[Z_NEED_DICT-(err)]
+
+#define ERR_RETURN(strm,err) \
+  return (strm->msg = ERR_MSG(err), (err))
+/* To be used only when the state is known to be valid */
+
+        /* common constants */
+
+#ifndef DEF_WBITS
+#  define DEF_WBITS MAX_WBITS
+#endif
+/* default windowBits for decompression. MAX_WBITS is for compression only */
+
+#if MAX_MEM_LEVEL >= 8
+#  define DEF_MEM_LEVEL 8
+#else
+#  define DEF_MEM_LEVEL  MAX_MEM_LEVEL
+#endif
+/* default memLevel */
+
+#define STORED_BLOCK 0
+#define STATIC_TREES 1
+#define DYN_TREES    2
+/* The three kinds of block type */
+
+#define MIN_MATCH  3
+#define MAX_MATCH  258
+/* The minimum and maximum match lengths */
+
+#define PRESET_DICT 0x20 /* preset dictionary flag in zlib header */
+
+        /* target dependencies */
+
+#if defined(MSDOS) || (defined(WINDOWS) && !defined(WIN32))
+#  define OS_CODE  0x00
+#  ifndef Z_SOLO
+#    if defined(__TURBOC__) || defined(__BORLANDC__)
+#      if (__STDC__ == 1) && (defined(__LARGE__) || defined(__COMPACT__))
+         /* Allow compilation with ANSI keywords only enabled */
+         void _Cdecl farfree( void *block );
+         void *_Cdecl farmalloc( unsigned long nbytes );
+#      else
+#        include <alloc.h>
+#      endif
+#    else /* MSC or DJGPP */
+#      include <malloc.h>
+#    endif
+#  endif
+#endif
+
+#ifdef AMIGA
+#  define OS_CODE  1
+#endif
+
+#if defined(VAXC) || defined(VMS)
+#  define OS_CODE  2
+#  define F_OPEN(name, mode) \
+     fopen((name), (mode), "mbc=60", "ctx=stm", "rfm=fix", "mrs=512")
+#endif
+
+#ifdef __370__
+#  if __TARGET_LIB__ < 0x20000000
+#    define OS_CODE 4
+#  elif __TARGET_LIB__ < 0x40000000
+#    define OS_CODE 11
+#  else
+#    define OS_CODE 8
+#  endif
+#endif
+
+#if defined(ATARI) || defined(atarist)
+#  define OS_CODE  5
+#endif
+
+#ifdef OS2
+#  define OS_CODE  6
+#  if defined(M_I86) && !defined(Z_SOLO)
+#    include <malloc.h>
+#  endif
+#endif
+
+#if defined(MACOS) || defined(TARGET_OS_MAC)
+#  define OS_CODE  7
+#  ifndef Z_SOLO
+#    if defined(__MWERKS__) && __dest_os != __be_os && __dest_os != __win32_os
+#      include <unix.h> /* for fdopen */
+#    else
+#      ifndef fdopen
+#        define fdopen(fd,mode) NULL /* No fdopen() */
+#      endif
+#    endif
+#  endif
+#endif
+
+#ifdef __acorn
+#  define OS_CODE 13
+#endif
+
+#if defined(WIN32) && !defined(__CYGWIN__)
+#  define OS_CODE  10
+#endif
+
+#ifdef _BEOS_
+#  define OS_CODE  16
+#endif
+
+#ifdef __TOS_OS400__
+#  define OS_CODE 18
+#endif
+
+#ifdef __APPLE__
+#  define OS_CODE 19
+#endif
+
+#if defined(_BEOS_) || defined(RISCOS)
+#  define fdopen(fd,mode) NULL /* No fdopen() */
+#endif
+
+#if (defined(_MSC_VER) && (_MSC_VER > 600)) && !defined __INTERIX
+#  if defined(_WIN32_WCE)
+#    define fdopen(fd,mode) NULL /* No fdopen() */
+#    ifndef _PTRDIFF_T_DEFINED
+       typedef int ptrdiff_t;
+#      define _PTRDIFF_T_DEFINED
+#    endif
+#  else
+#    define fdopen(fd,type)  _fdopen(fd,type)
+#  endif
+#endif
+
+#if defined(__BORLANDC__) && !defined(MSDOS)
+  #pragma warn -8004
+  #pragma warn -8008
+  #pragma warn -8066
+#endif
+
+/* provide prototypes for these when building zlib without LFS */
+#if !defined(_WIN32) && \
+    (!defined(_LARGEFILE64_SOURCE) || _LFS64_LARGEFILE-0 == 0)
+    ZEXTERN uLong ZEXPORT adler32_combine64 OF((uLong, uLong, z_off_t));
+    ZEXTERN uLong ZEXPORT crc32_combine64 OF((uLong, uLong, z_off_t));
+#endif
+
+        /* common defaults */
+
+#ifndef OS_CODE
+#  define OS_CODE  3     /* assume Unix */
+#endif
+
+#ifndef F_OPEN
+#  define F_OPEN(name, mode) fopen((name), (mode))
+#endif
+
+         /* functions */
+
+#if defined(pyr) || defined(Z_SOLO)
+#  define NO_MEMCPY
+#endif
+#if defined(SMALL_MEDIUM) && !defined(_MSC_VER) && !defined(__SC__)
+ /* Use our own functions for small and medium model with MSC <= 5.0.
+  * You may have to use the same strategy for Borland C (untested).
+  * The __SC__ check is for Symantec.
+  */
+#  define NO_MEMCPY
+#endif
+#if defined(STDC) && !defined(HAVE_MEMCPY) && !defined(NO_MEMCPY)
+#  define HAVE_MEMCPY
+#endif
+#ifdef HAVE_MEMCPY
+#  ifdef SMALL_MEDIUM /* MSDOS small or medium model */
+#    define zmemcpy _fmemcpy
+#    define zmemcmp _fmemcmp
+#    define zmemzero(dest, len) _fmemset(dest, 0, len)
+#  else
+#    define zmemcpy memcpy
+#    define zmemcmp memcmp
+#    define zmemzero(dest, len) memset(dest, 0, len)
+#  endif
+#else
+   void ZLIB_INTERNAL zmemcpy OF((Bytef* dest, const Bytef* source, uInt len));
+   int ZLIB_INTERNAL zmemcmp OF((const Bytef* s1, const Bytef* s2, uInt len));
+   void ZLIB_INTERNAL zmemzero OF((Bytef* dest, uInt len));
+#endif
+
+/* Diagnostic functions */
+#ifdef ZLIB_DEBUG
+#  include <stdio.h>
+   extern int ZLIB_INTERNAL z_verbose;
+   extern void ZLIB_INTERNAL z_error OF((char *m));
+#  define Assert(cond,msg) {if(!(cond)) z_error(msg);}
+#  define Trace(x) {if (z_verbose>=0) fprintf x ;}
+#  define Tracev(x) {if (z_verbose>0) fprintf x ;}
+#  define Tracevv(x) {if (z_verbose>1) fprintf x ;}
+#  define Tracec(c,x) {if (z_verbose>0 && (c)) fprintf x ;}
+#  define Tracecv(c,x) {if (z_verbose>1 && (c)) fprintf x ;}
+#else
+#  define Assert(cond,msg)
+#  define Trace(x)
+#  define Tracev(x)
+#  define Tracevv(x)
+#  define Tracec(c,x)
+#  define Tracecv(c,x)
+#endif
+
+#ifndef Z_SOLO
+   voidpf ZLIB_INTERNAL zcalloc OF((voidpf opaque, unsigned items,
+                                    unsigned size));
+   void ZLIB_INTERNAL zcfree  OF((voidpf opaque, voidpf ptr));
+#endif
+
+#define ZALLOC(strm, items, size) \
+           (*((strm)->zalloc))((strm)->opaque, (items), (size))
+#define ZFREE(strm, addr)  (*((strm)->zfree))((strm)->opaque, (voidpf)(addr))
+#define TRY_FREE(s, p) {if (p) ZFREE(s, p);}
+
+/* Reverse the bytes in a 32-bit value */
+#define ZSWAP32(q) ((((q) >> 24) & 0xff) + (((q) >> 8) & 0xff00) + \
+                    (((q) & 0xff00) << 8) + (((q) & 0xff) << 24))
+
+#ifdef _MSC_VER
+#define zalign(x) __declspec(align(x))
+#else
+#define zalign(x) __attribute__((aligned((x))))
+#endif
+
+#endif /* ZUTIL_H */
diff --git a/deps/v8/tools/SourceMap.js b/deps/v8/tools/SourceMap.js
index 9cbd37a7355324..46354506ec6523 100644
--- a/deps/v8/tools/SourceMap.js
+++ b/deps/v8/tools/SourceMap.js
@@ -325,8 +325,19 @@ WebInspector.SourceMap.prototype = {
 
         // Fix the sign.
         var negative = result & 1;
-        result >>= 1;
-        return negative ? -result : result;
+        // Use unsigned right shift, so that the 32nd bit is properly shifted
+        // to the 31st, and the 32nd becomes unset.
+        result >>>= 1;
+        if (negate) {
+          // We need to OR 0x80000000 here to ensure the 32nd bit (the sign bit
+          // in a 32bit int) is always set for negative numbers. If `result`
+          // were 1, (meaning `negate` is true and all other bits were zeros),
+          // `result` would now be 0. But -0 doesn't flip the 32nd bit as
+          // intended. All other numbers will successfully set the 32nd bit
+          // without issue, so doing this is a noop for them.
+          return -result | 0x80000000;
+        }
+        return result;
     },
 
     _VLQ_BASE_SHIFT: 5,
diff --git a/deps/v8/tools/adb-d8.py b/deps/v8/tools/adb-d8.py
index 4d4390fe05f48d..f2e67e85a6e6c0 100755
--- a/deps/v8/tools/adb-d8.py
+++ b/deps/v8/tools/adb-d8.py
@@ -61,7 +61,7 @@ def handle(self):
 
 
 def TransferD8ToDevice(adb, build_dir, device_d8_dir, verbose):
-  files_to_copy = ["d8", "natives_blob.bin", "snapshot_blob.bin"]
+  files_to_copy = ["d8", "snapshot_blob.bin"]
 
   # Pipe the output of md5sum from the local computer to the device, checking
   # the md5 hashes on the device.
diff --git a/deps/v8/tools/android-sync.sh b/deps/v8/tools/android-sync.sh
index 825b3c27de4a4d..dc93746538cc89 100755
--- a/deps/v8/tools/android-sync.sh
+++ b/deps/v8/tools/android-sync.sh
@@ -88,7 +88,6 @@ function sync_dir {
 echo -n "sync to $ANDROID_V8/$OUTDIR/$ARCH_MODE"
 sync_file "$OUTDIR/$ARCH_MODE/cctest"
 sync_file "$OUTDIR/$ARCH_MODE/d8"
-sync_file "$OUTDIR/$ARCH_MODE/natives_blob.bin"
 sync_file "$OUTDIR/$ARCH_MODE/snapshot_blob.bin"
 sync_file "$OUTDIR/$ARCH_MODE/unittests"
 echo ""
@@ -107,4 +106,3 @@ sync_dir tools/profviz
 sync_dir test/intl
 sync_dir test/message
 sync_dir test/mjsunit
-sync_dir test/preparser
diff --git a/deps/v8/tools/callstats.html b/deps/v8/tools/callstats.html
index 1ceca83db0e106..a7580c93196399 100644
--- a/deps/v8/tools/callstats.html
+++ b/deps/v8/tools/callstats.html
@@ -1719,7 +1719,7 @@
     Group.add('total', new Group('Total', /.*Total.*/, '#BBB'));
     Group.add('ic', new Group('IC', /.*IC_.*/, "#3366CC"));
     Group.add('optimize-background', new Group('Optimize-Background',
-        /(.*OptimizeConcurrent.*)|RecompileConcurrent.*/, "#702000"));
+        /(.*OptimizeBackground.*)/, "#702000"));
     Group.add('optimize', new Group('Optimize',
         /StackGuard|.*Optimize.*|.*Deoptimize.*|Recompile.*/, "#DC3912"));
     Group.add('compile-background', new Group('Compile-Background',
diff --git a/deps/v8/tools/callstats.py b/deps/v8/tools/callstats.py
index 7c5bd4a6f5843c..248970e81a85bc 100755
--- a/deps/v8/tools/callstats.py
+++ b/deps/v8/tools/callstats.py
@@ -29,6 +29,7 @@
 import sys
 import tempfile
 import operator
+from callstats_groups import RUNTIME_CALL_STATS_GROUPS
 
 import numpy
 import scipy
@@ -370,8 +371,7 @@ def read_stats(path, domain, args):
   if args.aggregate:
     groups = [
         ('Group-IC', re.compile(".*IC_.*")),
-        ('Group-OptimizeBackground',
-         re.compile(".*OptimizeConcurrent.*|RecompileConcurrent.*")),
+        ('Group-OptimizeBackground', re.compile(".*OptimizeBackground.*")),
         ('Group-Optimize',
          re.compile("StackGuard|.*Optimize.*|.*Deoptimize.*|Recompile.*")),
         ('Group-CompileBackground', re.compile("(.*CompileBackground.*)")),
diff --git a/deps/v8/tools/callstats_groups.py b/deps/v8/tools/callstats_groups.py
new file mode 100644
index 00000000000000..62898c61c80738
--- /dev/null
+++ b/deps/v8/tools/callstats_groups.py
@@ -0,0 +1,22 @@
+# Copyright 2019 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import re
+
+RUNTIME_CALL_STATS_GROUPS = [
+    ('Group-IC', re.compile(".*IC_.*")),
+    ('Group-OptimizeBackground', re.compile(".*OptimizeBackground.*")),
+    ('Group-Optimize',
+     re.compile("StackGuard|.*Optimize.*|.*Deoptimize.*|Recompile.*")),
+    ('Group-CompileBackground', re.compile("(.*CompileBackground.*)")),
+    ('Group-Compile', re.compile("(^Compile.*)|(.*_Compile.*)")),
+    ('Group-ParseBackground', re.compile(".*ParseBackground.*")),
+    ('Group-Parse', re.compile(".*Parse.*")),
+    ('Group-Callback', re.compile(".*Callback.*")),
+    ('Group-API', re.compile(".*API.*")),
+    ('Group-GC-Custom', re.compile("GC_Custom_.*")),
+    ('Group-GC-Background', re.compile(".*GC.*BACKGROUND.*")),
+    ('Group-GC', re.compile("GC_.*|AllocateInTargetSpace")),
+    ('Group-JavaScript', re.compile("JS_Execution")),
+    ('Group-Runtime', re.compile(".*"))]
diff --git a/deps/v8/tools/clusterfuzz/testdata/test_d8_1.py b/deps/v8/tools/clusterfuzz/testdata/baseline/d8.py
similarity index 100%
rename from deps/v8/tools/clusterfuzz/testdata/test_d8_1.py
rename to deps/v8/tools/clusterfuzz/testdata/baseline/d8.py
diff --git a/deps/v8/tools/clusterfuzz/testdata/v8_build_config.json b/deps/v8/tools/clusterfuzz/testdata/baseline/v8_build_config.json
similarity index 100%
rename from deps/v8/tools/clusterfuzz/testdata/v8_build_config.json
rename to deps/v8/tools/clusterfuzz/testdata/baseline/v8_build_config.json
diff --git a/deps/v8/tools/clusterfuzz/testdata/test_d8_2.py b/deps/v8/tools/clusterfuzz/testdata/build1/d8.py
similarity index 100%
rename from deps/v8/tools/clusterfuzz/testdata/test_d8_2.py
rename to deps/v8/tools/clusterfuzz/testdata/build1/d8.py
diff --git a/deps/v8/tools/clusterfuzz/testdata/build1/v8_build_config.json b/deps/v8/tools/clusterfuzz/testdata/build1/v8_build_config.json
new file mode 100644
index 00000000000000..ea27b1ccd7ae4f
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/testdata/build1/v8_build_config.json
@@ -0,0 +1 @@
+{"v8_current_cpu": "x64"}
diff --git a/deps/v8/tools/clusterfuzz/testdata/test_d8_3.py b/deps/v8/tools/clusterfuzz/testdata/build2/d8.py
similarity index 100%
rename from deps/v8/tools/clusterfuzz/testdata/test_d8_3.py
rename to deps/v8/tools/clusterfuzz/testdata/build2/d8.py
diff --git a/deps/v8/tools/clusterfuzz/testdata/build2/v8_build_config.json b/deps/v8/tools/clusterfuzz/testdata/build2/v8_build_config.json
new file mode 100644
index 00000000000000..ea27b1ccd7ae4f
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/testdata/build2/v8_build_config.json
@@ -0,0 +1 @@
+{"v8_current_cpu": "x64"}
diff --git a/deps/v8/tools/clusterfuzz/testdata/build3/d8.py b/deps/v8/tools/clusterfuzz/testdata/build3/d8.py
new file mode 100644
index 00000000000000..824b2224859a08
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/testdata/build3/d8.py
@@ -0,0 +1,17 @@
+# Copyright 2016 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# for py2/py3 compatibility
+from __future__ import print_function
+
+print("""
+1
+v8-foozzie source: name/to/a/file.js
+2
+v8-foozzie source: name/to/file.js
+  weird other error
+^
+3
+unknown
+""")
diff --git a/deps/v8/tools/clusterfuzz/testdata/build3/v8_build_config.json b/deps/v8/tools/clusterfuzz/testdata/build3/v8_build_config.json
new file mode 100644
index 00000000000000..2a9917a4338fc1
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/testdata/build3/v8_build_config.json
@@ -0,0 +1 @@
+{"v8_current_cpu": "x86"}
diff --git a/deps/v8/tools/clusterfuzz/v8_commands.py b/deps/v8/tools/clusterfuzz/v8_commands.py
index 0b3cae722b8430..e35ae1a871b063 100644
--- a/deps/v8/tools/clusterfuzz/v8_commands.py
+++ b/deps/v8/tools/clusterfuzz/v8_commands.py
@@ -4,11 +4,82 @@
 
 # Fork from commands.py and output.py in v8 test driver.
 
+import os
 import signal
 import subprocess
 import sys
 from threading import Event, Timer
 
+import v8_fuzz_config
+
+# List of default flags passed to each d8 run.
+DEFAULT_FLAGS = [
+  '--correctness-fuzzer-suppressions',
+  '--expose-gc',
+  '--allow-natives-syntax',
+  '--invoke-weak-callbacks',
+  '--omit-quit',
+  '--es-staging',
+  '--wasm-staging',
+  '--no-wasm-async-compilation',
+  '--suppress-asm-messages',
+]
+
+BASE_PATH = os.path.dirname(os.path.abspath(__file__))
+
+# List of files passed to each d8 run before the testcase.
+DEFAULT_FILES = [
+  os.path.join(BASE_PATH, 'v8_mock.js'),
+  os.path.join(BASE_PATH, 'v8_suppressions.js'),
+]
+
+# Architecture-specific mock file
+ARCH_MOCKS = os.path.join(BASE_PATH, 'v8_mock_archs.js')
+
+# Timeout in seconds for one d8 run.
+TIMEOUT = 3
+
+
+def _startup_files(options):
+  """Default files and optional architecture-specific mock file."""
+  files = DEFAULT_FILES[:]
+  if options.first.arch != options.second.arch:
+    files.append(ARCH_MOCKS)
+  return files
+
+
+class Command(object):
+  """Represents a configuration for running V8 multiple times with certain
+  flags and files.
+  """
+  def __init__(self, options, label, executable, config_flags):
+    self.label = label
+    self.executable = executable
+    self.config_flags = config_flags
+    self.common_flags =  DEFAULT_FLAGS[:]
+    self.common_flags.extend(['--random-seed', str(options.random_seed)])
+
+    self.files = _startup_files(options)
+
+  def run(self, testcase, verbose=False):
+    """Run the executable with a specific testcase."""
+    args = [self.executable] + self.flags + self.files + [testcase]
+    if verbose:
+      print('# Command line for %s comparison:' % self.label)
+      print(' '.join(args))
+    if self.executable.endswith('.py'):
+      # Wrap with python in tests.
+      args = [sys.executable] + args
+    return Execute(
+        args,
+        cwd=os.path.dirname(os.path.abspath(testcase)),
+        timeout=TIMEOUT,
+    )
+
+  @property
+  def flags(self):
+    return self.common_flags + self.config_flags
+
 
 class Output(object):
   def __init__(self, exit_code, timed_out, stdout, pid):
@@ -50,7 +121,6 @@ def kill_process():
     except OSError:
       sys.stderr.write('Error: Process %s already ended.\n' % process.pid)
 
-
   timer = Timer(timeout, kill_process)
   timer.start()
   stdout, _ = process.communicate()
diff --git a/deps/v8/tools/clusterfuzz/v8_foozzie.py b/deps/v8/tools/clusterfuzz/v8_foozzie.py
index 3b05d3829cb169..bf3d568cd67d72 100755
--- a/deps/v8/tools/clusterfuzz/v8_foozzie.py
+++ b/deps/v8/tools/clusterfuzz/v8_foozzie.py
@@ -20,6 +20,8 @@
 import sys
 import traceback
 
+from collections import namedtuple
+
 import v8_commands
 import v8_suppressions
 
@@ -58,7 +60,6 @@
   ignition_turbo_opt=[
     '--always-opt',
     '--no-liftoff',
-    '--no-wasm-tier-up',
     '--no-lazy-feedback-allocation'
   ],
   ignition_turbo_opt_eager=[
@@ -88,26 +89,13 @@
   ],
 )
 
-# Timeout in seconds for one d8 run.
-TIMEOUT = 3
-
 # Return codes.
 RETURN_PASS = 0
 RETURN_FAIL = 2
 
 BASE_PATH = os.path.dirname(os.path.abspath(__file__))
-PREAMBLE = [
-  os.path.join(BASE_PATH, 'v8_mock.js'),
-  os.path.join(BASE_PATH, 'v8_suppressions.js'),
-]
-ARCH_MOCKS = os.path.join(BASE_PATH, 'v8_mock_archs.js')
 SANITY_CHECKS = os.path.join(BASE_PATH, 'v8_sanity_checks.js')
 
-FLAGS = ['--correctness-fuzzer-suppressions', '--expose-gc',
-         '--allow-natives-syntax', '--invoke-weak-callbacks', '--omit-quit',
-         '--es-staging', '--wasm-staging', '--no-wasm-async-compilation',
-         '--suppress-asm-messages']
-
 SUPPORTED_ARCHS = ['ia32', 'x64', 'arm', 'arm64']
 
 # Output for suppressed failure case.
@@ -164,34 +152,71 @@ def infer_arch(d8):
   """
   with open(os.path.join(os.path.dirname(d8), 'v8_build_config.json')) as f:
     arch = json.load(f)['v8_current_cpu']
-  return 'ia32' if arch == 'x86' else arch
+  arch = 'ia32' if arch == 'x86' else arch
+  assert arch in SUPPORTED_ARCHS
+  return arch
+
+
+class ExecutionArgumentsConfig(object):
+  def __init__(self, label):
+    self.label = label
+
+  def add_arguments(self, parser, default_config):
+    def add_argument(flag_template, help_template, **kwargs):
+      parser.add_argument(
+          flag_template % self.label,
+          help=help_template % self.label,
+          **kwargs)
+
+    add_argument(
+        '--%s-config',
+        '%s configuration',
+        default=default_config)
+    add_argument(
+        '--%s-config-extra-flags',
+        'additional flags passed to the %s run',
+        action='append',
+        default=[])
+    add_argument(
+        '--%s-d8',
+        'optional path to %s d8 executable, '
+        'default: bundled in the directory of this script',
+        default='d8')
+
+  def make_options(self, options):
+    def get(name):
+      return getattr(options, '%s_%s' % (self.label, name))
+
+    config = get('config')
+    assert config in CONFIGS
+
+    d8 = get('d8')
+    if not os.path.isabs(d8):
+      d8 = os.path.join(BASE_PATH, d8)
+    assert os.path.exists(d8)
+
+    flags = CONFIGS[config] + get('config_extra_flags')
+
+    RunOptions = namedtuple('RunOptions', ['arch', 'config', 'd8', 'flags'])
+    return RunOptions(infer_arch(d8), config, d8, flags)
 
 
 def parse_args():
+  first_config_arguments = ExecutionArgumentsConfig('first')
+  second_config_arguments = ExecutionArgumentsConfig('second')
+
   parser = argparse.ArgumentParser()
   parser.add_argument(
     '--random-seed', type=int, required=True,
     help='random seed passed to both runs')
-  parser.add_argument(
-      '--first-config', help='first configuration', default='ignition')
-  parser.add_argument(
-      '--second-config', help='second configuration', default='ignition_turbo')
-  parser.add_argument(
-      '--first-config-extra-flags', action='append', default=[],
-      help='Additional flags to pass to the run of the first configuration')
-  parser.add_argument(
-      '--second-config-extra-flags', action='append', default=[],
-      help='Additional flags to pass to the run of the second configuration')
-  parser.add_argument(
-      '--first-d8', default='d8',
-      help='optional path to first d8 executable, '
-           'default: bundled in the same directory as this script')
-  parser.add_argument(
-      '--second-d8',
-      help='optional path to second d8 executable, default: same as first')
   parser.add_argument(
       '--skip-sanity-checks', default=False, action='store_true',
       help='skip sanity checks for testing purposes')
+
+  # Add arguments for each run configuration.
+  first_config_arguments.add_arguments(parser, 'ignition')
+  second_config_arguments.add_arguments(parser, 'ignition_turbo')
+
   parser.add_argument('testcase', help='path to test case')
   options = parser.parse_args()
 
@@ -200,33 +225,14 @@ def parse_args():
           os.path.isfile(options.testcase)), (
       'Test case %s doesn\'t exist' % options.testcase)
 
-  # Use first d8 as default for second d8.
-  options.second_d8 = options.second_d8 or options.first_d8
-
-  # Ensure absolute paths.
-  if not os.path.isabs(options.first_d8):
-    options.first_d8 = os.path.join(BASE_PATH, options.first_d8)
-  if not os.path.isabs(options.second_d8):
-    options.second_d8 = os.path.join(BASE_PATH, options.second_d8)
-
-  # Ensure executables exist.
-  assert os.path.exists(options.first_d8)
-  assert os.path.exists(options.second_d8)
+  options.first = first_config_arguments.make_options(options)
+  options.second = second_config_arguments.make_options(options)
 
   # Ensure we make a sane comparison.
-  if (options.first_d8 == options.second_d8 and
-      options.first_config == options.second_config):
+  if (options.first.d8 == options.second.d8 and
+      options.first.config == options.second.config):
     parser.error('Need either executable or config difference.')
 
-  # Infer architecture from build artifacts.
-  options.first_arch = infer_arch(options.first_d8)
-  options.second_arch = infer_arch(options.second_d8)
-
-  assert options.first_arch in SUPPORTED_ARCHS
-  assert options.second_arch in SUPPORTED_ARCHS
-  assert options.first_config in CONFIGS
-  assert options.second_config in CONFIGS
-
   return options
 
 
@@ -274,12 +280,12 @@ def fail_bailout(output, ignore_by_output_fun):
 
 
 def print_difference(
-    options, source_key, first_config_flags, second_config_flags,
+    options, source_key, first_command, second_command,
     first_config_output, second_config_output, difference, source=None):
   # The first three entries will be parsed by clusterfuzz. Format changes
   # will require changes on the clusterfuzz side.
-  first_config_label = '%s,%s' % (options.first_arch, options.first_config)
-  second_config_label = '%s,%s' % (options.second_arch, options.second_config)
+  first_config_label = '%s,%s' % (options.first.arch, options.first.config)
+  second_config_label = '%s,%s' % (options.second.arch, options.second.config)
   source_file_text = SOURCE_FILE_TEMPLATE % source if source else ''
   print((FAILURE_TEMPLATE % dict(
       configs='%s:%s' % (first_config_label, second_config_label),
@@ -288,8 +294,8 @@ def print_difference(
       suppression='', # We can't tie bugs to differences.
       first_config_label=first_config_label,
       second_config_label=second_config_label,
-      first_config_flags=' '.join(first_config_flags),
-      second_config_flags=' '.join(second_config_flags),
+      first_config_flags=' '.join(first_command.flags),
+      second_config_flags=' '.join(second_command.flags),
       first_config_output=
           first_config_output.stdout.decode('utf-8', 'replace'),
       second_config_output=
@@ -304,8 +310,8 @@ def main():
 
   # Suppressions are architecture and configuration specific.
   suppress = v8_suppressions.get_suppression(
-      options.first_arch, options.first_config,
-      options.second_arch, options.second_config,
+      options.first.arch, options.first.config,
+      options.second.arch, options.second.config,
   )
 
   # Static bailout based on test case content or metadata.
@@ -316,37 +322,16 @@ def main():
   if content_bailout(content, suppress.ignore_by_content):
     return RETURN_FAIL
 
-  # Set up runtime arguments.
-  common_flags = FLAGS + ['--random-seed', str(options.random_seed)]
-  first_config_flags = (common_flags + CONFIGS[options.first_config] +
-                        options.first_config_extra_flags)
-  second_config_flags = (common_flags + CONFIGS[options.second_config] +
-                         options.second_config_extra_flags)
-
-  def run_d8(d8, config_flags, config_label=None, testcase=options.testcase):
-    preamble = PREAMBLE[:]
-    if options.first_arch != options.second_arch:
-      preamble.append(ARCH_MOCKS)
-    args = [d8] + config_flags + preamble + [testcase]
-    if config_label:
-      print('# Command line for %s comparison:' % config_label)
-      print(' '.join(args))
-    if d8.endswith('.py'):
-      # Wrap with python in tests.
-      args = [sys.executable] + args
-    return v8_commands.Execute(
-        args,
-        cwd=os.path.dirname(os.path.abspath(testcase)),
-        timeout=TIMEOUT,
-    )
+  first_cmd = v8_commands.Command(
+      options,'first', options.first.d8, options.first.flags)
+  second_cmd = v8_commands.Command(
+      options, 'second', options.second.d8, options.second.flags)
 
   # Sanity checks. Run both configurations with the sanity-checks file only and
   # bail out early if different.
   if not options.skip_sanity_checks:
-    first_config_output = run_d8(
-        options.first_d8, first_config_flags, testcase=SANITY_CHECKS)
-    second_config_output = run_d8(
-        options.second_d8, second_config_flags, testcase=SANITY_CHECKS)
+    first_config_output = first_cmd.run(SANITY_CHECKS)
+    second_config_output = second_cmd.run(SANITY_CHECKS)
     difference, _ = suppress.diff(
         first_config_output.stdout, second_config_output.stdout)
     if difference:
@@ -354,18 +339,17 @@ def run_d8(d8, config_flags, config_label=None, testcase=options.testcase):
       # cases on this in case it's hit.
       source_key = 'sanity check failed'
       print_difference(
-          options, source_key, first_config_flags, second_config_flags,
+          options, source_key, first_cmd, second_cmd,
           first_config_output, second_config_output, difference)
       return RETURN_FAIL
 
-  first_config_output = run_d8(options.first_d8, first_config_flags, 'first')
+  first_config_output = first_cmd.run(options.testcase, verbose=True)
 
   # Early bailout based on first run's output.
   if pass_bailout(first_config_output, 1):
     return RETURN_PASS
 
-  second_config_output = run_d8(
-      options.second_d8, second_config_flags, 'second')
+  second_config_output = second_cmd.run(options.testcase, verbose=True)
 
   # Bailout based on second run's output.
   if pass_bailout(second_config_output, 2):
@@ -389,7 +373,7 @@ def run_d8(d8, config_flags, config_label=None, testcase=options.testcase):
       return RETURN_FAIL
 
     print_difference(
-        options, source_key, first_config_flags, second_config_flags,
+        options, source_key, first_cmd, second_cmd,
         first_config_output, second_config_output, difference, source)
     return RETURN_FAIL
 
diff --git a/deps/v8/tools/clusterfuzz/v8_foozzie_test.py b/deps/v8/tools/clusterfuzz/v8_foozzie_test.py
index 356f79a1c379b3..6fb3345bc39a5b 100755
--- a/deps/v8/tools/clusterfuzz/v8_foozzie_test.py
+++ b/deps/v8/tools/clusterfuzz/v8_foozzie_test.py
@@ -4,6 +4,7 @@
 # found in the LICENSE file.
 
 import os
+import random
 import subprocess
 import sys
 import unittest
@@ -33,18 +34,18 @@ def testConfig(self):
 
     When experiment distribution changes this test might change, too.
     """
-    class Rng(object):
-      def random(self):
-        return 0.5
     self.assertEqual(
         [
-          '--first-config=ignition_no_ic',
-          '--second-config=ignition_turbo',
+          '--first-config=ignition',
+          '--second-config=ignition_turbo_opt',
           '--second-d8=d8',
           '--second-config-extra-flags=--stress-scavenge=100',
           '--second-config-extra-flags=--no-regexp-tier-up',
+          '--second-config-extra-flags=--no-enable-ssse3',
+          '--second-config-extra-flags=--no-enable-bmi2',
+          '--second-config-extra-flags=--no-enable-lzcnt',
         ],
-        v8_fuzz_config.Config('foo', Rng(), 42).choose_foozzie_flags(),
+        v8_fuzz_config.Config('foo', random.Random(42)).choose_foozzie_flags(),
     )
 
 
@@ -119,12 +120,12 @@ def cut_verbose_output(stdout):
   return '\n'.join(stdout.split('\n')[4:])
 
 
-def run_foozzie(first_d8, second_d8, *extra_flags):
+def run_foozzie(second_d8_dir, *extra_flags):
   return subprocess.check_output([
     sys.executable, FOOZZIE,
     '--random-seed', '12345',
-    '--first-d8', os.path.join(TEST_DATA, first_d8),
-    '--second-d8', os.path.join(TEST_DATA, second_d8),
+    '--first-d8', os.path.join(TEST_DATA, 'baseline', 'd8.py'),
+    '--second-d8', os.path.join(TEST_DATA, second_d8_dir, 'd8.py'),
     '--first-config', 'ignition',
     '--second-config', 'ignition_turbo',
     os.path.join(TEST_DATA, 'fuzz-123.js'),
@@ -132,15 +133,26 @@ def run_foozzie(first_d8, second_d8, *extra_flags):
 
 
 class SystemTest(unittest.TestCase):
+  """This tests the whole correctness-fuzzing harness with fake build
+  artifacts.
+
+  Overview of fakes:
+    baseline: Example foozzie output including a syntax error.
+    build1: Difference to baseline is a stack trace differece expected to
+            be suppressed.
+    build2: Difference to baseline is a non-suppressed output difference
+            causing the script to fail.
+    build3: As build1 but with an architecture difference as well.
+  """
   def testSyntaxErrorDiffPass(self):
-    stdout = run_foozzie('test_d8_1.py', 'test_d8_2.py', '--skip-sanity-checks')
+    stdout = run_foozzie('build1', '--skip-sanity-checks')
     self.assertEquals('# V8 correctness - pass\n', cut_verbose_output(stdout))
 
   def testDifferentOutputFail(self):
     with open(os.path.join(TEST_DATA, 'failure_output.txt')) as f:
       expected_output = f.read()
     with self.assertRaises(subprocess.CalledProcessError) as ctx:
-      run_foozzie('test_d8_1.py', 'test_d8_3.py', '--skip-sanity-checks',
+      run_foozzie('build2', '--skip-sanity-checks',
                   '--first-config-extra-flags=--flag1',
                   '--first-config-extra-flags=--flag2=0',
                   '--second-config-extra-flags=--flag3')
@@ -152,10 +164,23 @@ def testSanityCheck(self):
     with open(os.path.join(TEST_DATA, 'sanity_check_output.txt')) as f:
       expected_output = f.read()
     with self.assertRaises(subprocess.CalledProcessError) as ctx:
-      run_foozzie('test_d8_1.py', 'test_d8_3.py')
+      run_foozzie('build2')
     e = ctx.exception
     self.assertEquals(v8_foozzie.RETURN_FAIL, e.returncode)
     self.assertEquals(expected_output, e.output)
 
+  def testDifferentArch(self):
+    """Test that the architecture-specific mocks are passed to both runs when
+    we use executables with different architectures.
+    """
+    # Build 3 simulates x86, while the baseline is x64.
+    stdout = run_foozzie('build3', '--skip-sanity-checks')
+    lines = stdout.split('\n')
+    # TODO(machenbach): Don't depend on the command-lines being printed in
+    # particular lines.
+    self.assertIn('v8_mock_archs.js', lines[1])
+    self.assertIn('v8_mock_archs.js', lines[3])
+
+
 if __name__ == '__main__':
   unittest.main()
diff --git a/deps/v8/tools/clusterfuzz/v8_fuzz_config.py b/deps/v8/tools/clusterfuzz/v8_fuzz_config.py
index 92bf0dd3aacd0a..cc68a7dd4c9e88 100644
--- a/deps/v8/tools/clusterfuzz/v8_fuzz_config.py
+++ b/deps/v8/tools/clusterfuzz/v8_fuzz_config.py
@@ -44,39 +44,42 @@
   (0.1, '--regexp-interpret-all'),
   (0.1, '--regexp-tier-up-ticks=10'),
   (0.1, '--regexp-tier-up-ticks=100'),
+  (0.1, '--turbo-instruction-scheduling'),
+  (0.1, '--turbo-stress-instruction-scheduling'),
+  (0.1, '--no-enable-sse3'),
+  (0.1, '--no-enable-ssse3'),
+  (0.1, '--no-enable-sse4_1'),
+  (0.1, '--no-enable-sse4_2'),
+  (0.1, '--no-enable-sahf'),
+  (0.1, '--no-enable-avx'),
+  (0.1, '--no-enable-fma3'),
+  (0.1, '--no-enable-bmi1'),
+  (0.1, '--no-enable-bmi2'),
+  (0.1, '--no-enable-lzcnt'),
+  (0.1, '--no-enable-popcnt'),
 ]
 
 class Config(object):
-  def __init__(self, name, rng=None, random_seed=None):
+  def __init__(self, name, rng=None):
     """
     Args:
       name: Name of the used fuzzer.
       rng: Random number generator for generating experiments.
       random_seed: Random-seed used for d8 throughout one fuzz session.
-      TODO(machenbach): Remove random_seed after a grace period of a couple of
-      days. We only have it to keep bisection stable. Afterwards we can just
-      use rng.
     """
     self.name = name
     self.rng = rng or random.Random()
-    self.random_seed = random_seed
 
   def choose_foozzie_flags(self):
     """Randomly chooses a configuration from FOOZZIE_EXPERIMENTS.
 
     Returns: List of flags to pass to v8_foozzie.py fuzz harness.
     """
-    # TODO(machenbach): Temporarily use same RNG state for all test cases in one
-    # fuzz session. See also TODO above.
-    if self.random_seed is not None:
-      flags_rng = random.Random(self.random_seed)
-    else:
-      flags_rng = random.Random()
 
     # Add additional flags to second config based on experiment percentages.
     extra_flags = []
     for p, flag in ADDITIONAL_FLAGS:
-      if flags_rng.random() < p:
+      if self.rng.random() < p:
         extra_flags.append('--second-config-extra-flags=%s' % flag)
 
     # Calculate flags determining the experiment.
diff --git a/deps/v8/tools/clusterfuzz/v8_mock.js b/deps/v8/tools/clusterfuzz/v8_mock.js
index 2f797dd89f0482..b805ccf772fede 100644
--- a/deps/v8/tools/clusterfuzz/v8_mock.js
+++ b/deps/v8/tools/clusterfuzz/v8_mock.js
@@ -78,10 +78,12 @@ var prettyPrinted = function prettyPrinted(msg) { return msg; };
   Date = new Proxy(Date, handler);
 })();
 
-// Mock performace.now().
-(function () {
-  performance.now = function () { return 1.2; }
-})();
+// Mock performance methods.
+performance.now = function () { return 1.2; }
+performance.measureMemory = function () { return []; }
+
+// Mock readline so that test cases don't hang.
+readline = function () { return "foo"; }
 
 // Mock stack traces.
 Error.prepareStackTrace = function (error, structuredStackTrace) {
diff --git a/deps/v8/tools/clusterfuzz/v8_mock_archs.js b/deps/v8/tools/clusterfuzz/v8_mock_archs.js
index acbaef821f86ad..33883775f5ab86 100644
--- a/deps/v8/tools/clusterfuzz/v8_mock_archs.js
+++ b/deps/v8/tools/clusterfuzz/v8_mock_archs.js
@@ -12,12 +12,14 @@
 
 // Mock maximum typed-array length and limit to 1MiB.
 (function () {
-  var mock = function(arrayType) {
-    var handler = {
+  // Math.min might be manipulated in test cases.
+  let min = Math.min;
+  let mock = function(arrayType) {
+    let handler = {
       construct: function(target, args) {
         for (let i = 0; i < args.length; i++) {
           if (typeof args[i] != "object") {
-            args[i] = Math.min(1048576, args[i]);
+            args[i] = min(1048576, args[i]);
           }
         }
         return new (
@@ -28,6 +30,7 @@
   }
 
   ArrayBuffer = mock(ArrayBuffer);
+  SharedArrayBuffer = mock(SharedArrayBuffer);
   Int8Array = mock(Int8Array);
   Uint8Array = mock(Uint8Array);
   Uint8ClampedArray = mock(Uint8ClampedArray);
@@ -43,7 +46,7 @@
 
 // Mock typed array set function and limit maximum offset to 1MiB.
 (function () {
-  var typedArrayTypes = [
+  let typedArrayTypes = [
     Int8Array,
     Uint8Array,
     Uint8ClampedArray,
diff --git a/deps/v8/tools/compare_torque_output.py b/deps/v8/tools/compare_torque_output.py
new file mode 100644
index 00000000000000..50e93a7538dfdb
--- /dev/null
+++ b/deps/v8/tools/compare_torque_output.py
@@ -0,0 +1,66 @@
+#!/usr/bin/env python
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+"""
+Compare two folders and print any differences between files to both a
+results file and stderr.
+
+Specifically we use this to compare the output of Torque generator for
+both x86 and x64 (-m32) toolchains.
+"""
+
+import difflib
+import filecmp
+import itertools
+import os
+import sys
+
+assert len(sys.argv) > 3
+
+folder1 = sys.argv[1]
+folder2 = sys.argv[2]
+results_file_name = sys.argv[3]
+
+with open(results_file_name, "w") as results_file:
+  def write(line):
+    # Print line to both results file and stderr
+    sys.stderr.write(line)
+    results_file.write(line)
+
+  def has_one_sided_diff(dcmp, side, side_list):
+    # Check that we do not have files only on one side of the comparison
+    if side_list:
+      write("Some files exist only in %s\n" % side)
+      for fl in side_list:
+        write(fl)
+    return side_list
+
+  def has_content_diff(dcmp):
+    # Check that we do not have content differences in the common files
+    _, diffs, _ = filecmp.cmpfiles(
+          dcmp.left, dcmp.right,
+          dcmp.common_files, shallow=False)
+    if diffs:
+      write("Found content differences between %s and %s\n" %
+        (dcmp.left, dcmp.right))
+      for name in diffs:
+        write("File diff %s\n" % name)
+        left_file = os.path.join(dcmp.left, name)
+        right_file = os.path.join(dcmp.right, name)
+        with open(left_file) as f1, open(right_file) as f2:
+          diff = difflib.unified_diff(
+              f1.readlines(), f2.readlines(),
+              dcmp.left, dcmp.right)
+          for l in itertools.islice(diff, 100):
+            write(l)
+        write("\n\n")
+    return diffs
+
+  dcmp = filecmp.dircmp(folder1, folder2)
+  has_diffs = has_one_sided_diff(dcmp, dcmp.left, dcmp.left_only) \
+    or has_one_sided_diff(dcmp, dcmp.right, dcmp.right_only) \
+    or has_content_diff(dcmp)
+
+if has_diffs:
+  sys.exit(1)
diff --git a/deps/v8/tools/concatenate-files.py b/deps/v8/tools/concatenate-files.py
deleted file mode 100644
index a5dbe45cccd7f1..00000000000000
--- a/deps/v8/tools/concatenate-files.py
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/usr/bin/env python
-#
-# Copyright 2014 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-# This utility concatenates several files into one. On Unix-like systems
-# it is equivalent to:
-#   cat file1 file2 file3 ...files... > target
-#
-# The reason for writing a separate utility is that 'cat' is not available
-# on all supported build platforms, but Python is, and hence this provides
-# us with an easy and uniform way of doing this on all platforms.
-
-# for py2/py3 compatibility
-from __future__ import print_function
-
-import optparse
-
-
-def Concatenate(filenames):
-  """Concatenate files.
-
-  Args:
-    files: Array of file names.
-           The last name is the target; all earlier ones are sources.
-
-  Returns:
-    True, if the operation was successful.
-  """
-  if len(filenames) < 2:
-    print("An error occurred generating %s:\nNothing to do." % filenames[-1])
-    return False
-
-  try:
-    with open(filenames[-1], "wb") as target:
-      for filename in filenames[:-1]:
-        with open(filename, "rb") as current:
-          target.write(current.read())
-    return True
-  except IOError as e:
-    print("An error occurred when writing %s:\n%s" % (filenames[-1], e))
-    return False
-
-
-def main():
-  parser = optparse.OptionParser()
-  parser.set_usage("""Concatenate several files into one.
-      Equivalent to: cat file1 ... > target.""")
-  (options, args) = parser.parse_args()
-  exit(0 if Concatenate(args) else 1)
-
-
-if __name__ == "__main__":
-  main()
diff --git a/deps/v8/tools/debug_helper/BUILD.gn b/deps/v8/tools/debug_helper/BUILD.gn
index 2fe5f0d8be0d21..10b94a52956286 100644
--- a/deps/v8/tools/debug_helper/BUILD.gn
+++ b/deps/v8/tools/debug_helper/BUILD.gn
@@ -86,6 +86,7 @@ v8_component("v8_debug_helper") {
     "get-object-properties.cc",
     "heap-constants.cc",
     "heap-constants.h",
+    "list-object-classes.cc",
   ]
 
   deps = [
diff --git a/deps/v8/tools/debug_helper/debug-helper-internal.h b/deps/v8/tools/debug_helper/debug-helper-internal.h
index e2161e25ba5cf3..9c498cd5d684c8 100644
--- a/deps/v8/tools/debug_helper/debug-helper-internal.h
+++ b/deps/v8/tools/debug_helper/debug-helper-internal.h
@@ -28,46 +28,98 @@ struct Value {
   TValue value;
 };
 
+// Internal version of API class v8::debug_helper::PropertyBase.
+class PropertyBase {
+ public:
+  PropertyBase(std::string name, std::string type,
+               std::string decompressed_type)
+      : name_(name), type_(type), decompressed_type_(decompressed_type) {}
+  void SetFieldsOnPublicView(d::PropertyBase* public_view) {
+    public_view->name = name_.c_str();
+    public_view->type = type_.c_str();
+    public_view->decompressed_type = decompressed_type_.c_str();
+  }
+
+ private:
+  std::string name_;
+  std::string type_;
+  std::string decompressed_type_;
+};
+
+// Internal version of API class v8::debug_helper::StructProperty.
+class StructProperty : public PropertyBase {
+ public:
+  StructProperty(std::string name, std::string type,
+                 std::string decompressed_type, size_t offset, uint8_t num_bits,
+                 uint8_t shift_bits)
+      : PropertyBase(std::move(name), std::move(type),
+                     std::move(decompressed_type)),
+        offset_(offset),
+        num_bits_(num_bits),
+        shift_bits_(shift_bits) {}
+
+  d::StructProperty* GetPublicView() {
+    PropertyBase::SetFieldsOnPublicView(&public_view_);
+    public_view_.offset = offset_;
+    public_view_.num_bits = num_bits_;
+    public_view_.shift_bits = shift_bits_;
+    return &public_view_;
+  }
+
+ private:
+  size_t offset_;
+  uint8_t num_bits_;
+  uint8_t shift_bits_;
+
+  d::StructProperty public_view_;
+};
+
 // Internal version of API class v8::debug_helper::ObjectProperty.
-class ObjectProperty {
+class ObjectProperty : public PropertyBase {
  public:
-  inline ObjectProperty(std::string name, std::string type,
-                        std::string decompressed_type, uintptr_t address,
-                        size_t num_values = 1,
-                        d::PropertyKind kind = d::PropertyKind::kSingle)
-      : name_(name),
-        type_(type),
-        decompressed_type_(decompressed_type),
+  ObjectProperty(std::string name, std::string type,
+                 std::string decompressed_type, uintptr_t address,
+                 size_t num_values, size_t size,
+                 std::vector<std::unique_ptr<StructProperty>> struct_fields,
+                 d::PropertyKind kind)
+      : PropertyBase(std::move(name), std::move(type),
+                     std::move(decompressed_type)),
         address_(address),
         num_values_(num_values),
+        size_(size),
+        struct_fields_(std::move(struct_fields)),
         kind_(kind) {}
 
-  inline d::ObjectProperty* GetPublicView() {
-    public_view_.name = name_.c_str();
-    public_view_.type = type_.c_str();
-    public_view_.decompressed_type = decompressed_type_.c_str();
+  d::ObjectProperty* GetPublicView() {
+    PropertyBase::SetFieldsOnPublicView(&public_view_);
     public_view_.address = address_;
     public_view_.num_values = num_values_;
+    public_view_.size = size_;
+    public_view_.num_struct_fields = struct_fields_.size();
+    struct_fields_raw_.clear();
+    for (const auto& property : struct_fields_) {
+      struct_fields_raw_.push_back(property->GetPublicView());
+    }
+    public_view_.struct_fields = struct_fields_raw_.data();
     public_view_.kind = kind_;
     return &public_view_;
   }
 
  private:
-  std::string name_;
-  std::string type_;
-  std::string decompressed_type_;
   uintptr_t address_;
   size_t num_values_;
+  size_t size_;
+  std::vector<std::unique_ptr<StructProperty>> struct_fields_;
   d::PropertyKind kind_;
 
   d::ObjectProperty public_view_;
+  std::vector<d::StructProperty*> struct_fields_raw_;
 };
 
 class ObjectPropertiesResult;
-using ObjectPropertiesResultInternal = ObjectPropertiesResult;
-
 struct ObjectPropertiesResultExtended : public d::ObjectPropertiesResult {
-  ObjectPropertiesResultInternal* base;  // Back reference for cleanup
+  // Back reference for cleanup.
+  v8_debug_helper_internal::ObjectPropertiesResult* base;
 };
 
 // Internal version of API class v8::debug_helper::ObjectPropertiesResult.
@@ -85,9 +137,9 @@ class ObjectPropertiesResult {
     guessed_types_ = std::move(guessed_types);
   }
 
-  inline void Prepend(const char* prefix) { brief_ = prefix + brief_; }
+  void Prepend(const char* prefix) { brief_ = prefix + brief_; }
 
-  inline d::ObjectPropertiesResult* GetPublicView() {
+  d::ObjectPropertiesResult* GetPublicView() {
     public_view_.type_check_result = type_check_result_;
     public_view_.brief = brief_.c_str();
     public_view_.type = type_.c_str();
@@ -125,7 +177,7 @@ class TqObjectVisitor;
 // Subclasses for specific object types are generated by the Torque compiler.
 class TqObject {
  public:
-  inline TqObject(uintptr_t address) : address_(address) {}
+  TqObject(uintptr_t address) : address_(address) {}
   virtual ~TqObject() = default;
   virtual std::vector<std::unique_ptr<ObjectProperty>> GetProperties(
       d::MemoryAccessor accessor) const;
@@ -138,7 +190,7 @@ class TqObject {
 };
 
 // In ptr-compr builds, returns whether the address looks like a compressed
-// pointer (sign-extended from 32 bits). Otherwise returns false because no
+// pointer (zero-extended from 32 bits). Otherwise returns false because no
 // pointers can be compressed.
 bool IsPointerCompressed(uintptr_t address);
 
@@ -151,6 +203,10 @@ uintptr_t EnsureDecompressed(uintptr_t address,
 // into the corresponding PropertyKind for the array.
 d::PropertyKind GetArrayKind(d::MemoryAccessResult mem_result);
 
+// List of fully-qualified names for every Object subtype, generated based on
+// Torque class definitions.
+extern const d::ClassList kObjectClassList;
+
 }  // namespace v8_debug_helper_internal
 
 #endif
diff --git a/deps/v8/tools/debug_helper/debug-helper.h b/deps/v8/tools/debug_helper/debug-helper.h
index 7d75843bf60374..cbdd6ff8816e3b 100644
--- a/deps/v8/tools/debug_helper/debug-helper.h
+++ b/deps/v8/tools/debug_helper/debug-helper.h
@@ -66,10 +66,12 @@ enum class PropertyKind {
   kArrayOfUnknownSizeDueToValidButInaccessibleMemory,
 };
 
-struct ObjectProperty {
+struct PropertyBase {
   const char* name;
 
-  // Statically-determined type, such as from .tq definition.
+  // Statically-determined type, such as from .tq definition. Can be an empty
+  // string if this property is itself a Torque-defined struct; in that case use
+  // |struct_fields| instead.
   const char* type;
 
   // In some cases, |type| may be a simple type representing a compressed
@@ -79,7 +81,22 @@ struct ObjectProperty {
   // to pass the |decompressed_type| value as the type_hint on a subsequent call
   // to GetObjectProperties.
   const char* decompressed_type;
+};
+
+struct StructProperty : public PropertyBase {
+  // The offset from the beginning of the struct to this field.
+  size_t offset;
+
+  // The number of bits that are present, if this value is a bitfield. Zero
+  // indicates that this value is not a bitfield (the full value is stored).
+  uint8_t num_bits;
 
+  // The number of bits by which this value has been left-shifted for storage as
+  // a bitfield.
+  uint8_t shift_bits;
+};
+
+struct ObjectProperty : public PropertyBase {
   // The address where the property value can be found in the debuggee's address
   // space, or the address of the first value for an array.
   uintptr_t address;
@@ -90,6 +107,17 @@ struct ObjectProperty {
   // versus num_values=1 and kind=kArrayOfKnownSize (one-element array).
   size_t num_values;
 
+  // The number of bytes occupied by a single instance of the value type for
+  // this property. This can also be used as the array stride because arrays are
+  // tightly packed like in C.
+  size_t size;
+
+  // If the property is a struct made up of several pieces of data packed
+  // together, then the |struct_fields| array contains descriptions of those
+  // fields.
+  size_t num_struct_fields;
+  StructProperty** struct_fields;
+
   PropertyKind kind;
 };
 
@@ -141,6 +169,12 @@ struct HeapAddresses {
   uintptr_t any_heap_pointer;
 };
 
+// Result type for ListObjectClasses.
+struct ClassList {
+  size_t num_class_names;
+  const char* const* class_names;  // Fully qualified class names.
+};
+
 }  // namespace debug_helper
 }  // namespace v8
 
@@ -154,6 +188,8 @@ _v8_debug_helper_GetObjectProperties(
     const char* type_hint);
 V8_DEBUG_HELPER_EXPORT void _v8_debug_helper_Free_ObjectPropertiesResult(
     v8::debug_helper::ObjectPropertiesResult* result);
+V8_DEBUG_HELPER_EXPORT const v8::debug_helper::ClassList*
+_v8_debug_helper_ListObjectClasses();
 }
 
 namespace v8 {
@@ -183,6 +219,11 @@ inline ObjectPropertiesResultPtr GetObjectProperties(
       object, memory_accessor, heap_addresses, type_hint));
 }
 
+// Get a list of all class names deriving from v8::internal::Object.
+inline const ClassList* ListObjectClasses() {
+  return _v8_debug_helper_ListObjectClasses();
+}
+
 }  // namespace debug_helper
 }  // namespace v8
 
diff --git a/deps/v8/tools/debug_helper/get-object-properties.cc b/deps/v8/tools/debug_helper/get-object-properties.cc
index 8eeeb840932722..f3bd4811f27205 100644
--- a/deps/v8/tools/debug_helper/get-object-properties.cc
+++ b/deps/v8/tools/debug_helper/get-object-properties.cc
@@ -16,129 +16,15 @@ namespace i = v8::internal;
 
 namespace v8_debug_helper_internal {
 
-// INSTANCE_TYPE_CHECKERS_SINGLE_BASE, trimmed down to only classes that have
-// layouts defined in .tq files (this subset relationship is asserted below).
-// For now, this is a hand-maintained list.
-// TODO(v8:7793): Torque should know enough about instance types to generate
-// this list.
-#define TQ_INSTANCE_TYPES_SINGLE_BASE(V)                       \
-  V(ByteArray, BYTE_ARRAY_TYPE)                                \
-  V(BytecodeArray, BYTECODE_ARRAY_TYPE)                        \
-  V(CallHandlerInfo, CALL_HANDLER_INFO_TYPE)                   \
-  V(Cell, CELL_TYPE)                                           \
-  V(DescriptorArray, DESCRIPTOR_ARRAY_TYPE)                    \
-  V(EmbedderDataArray, EMBEDDER_DATA_ARRAY_TYPE)               \
-  V(FeedbackCell, FEEDBACK_CELL_TYPE)                          \
-  V(FeedbackVector, FEEDBACK_VECTOR_TYPE)                      \
-  V(FixedDoubleArray, FIXED_DOUBLE_ARRAY_TYPE)                 \
-  V(Foreign, FOREIGN_TYPE)                                     \
-  V(FreeSpace, FREE_SPACE_TYPE)                                \
-  V(HeapNumber, HEAP_NUMBER_TYPE)                              \
-  V(JSArgumentsObject, JS_ARGUMENTS_OBJECT_TYPE)               \
-  V(JSArray, JS_ARRAY_TYPE)                                    \
-  V(JSArrayBuffer, JS_ARRAY_BUFFER_TYPE)                       \
-  V(JSArrayIterator, JS_ARRAY_ITERATOR_TYPE)                   \
-  V(JSAsyncFromSyncIterator, JS_ASYNC_FROM_SYNC_ITERATOR_TYPE) \
-  V(JSAsyncFunctionObject, JS_ASYNC_FUNCTION_OBJECT_TYPE)      \
-  V(JSAsyncGeneratorObject, JS_ASYNC_GENERATOR_OBJECT_TYPE)    \
-  V(JSBoundFunction, JS_BOUND_FUNCTION_TYPE)                   \
-  V(JSDataView, JS_DATA_VIEW_TYPE)                             \
-  V(JSDate, JS_DATE_TYPE)                                      \
-  V(JSFunction, JS_FUNCTION_TYPE)                              \
-  V(JSGlobalObject, JS_GLOBAL_OBJECT_TYPE)                     \
-  V(JSGlobalProxy, JS_GLOBAL_PROXY_TYPE)                       \
-  V(JSMap, JS_MAP_TYPE)                                        \
-  V(JSMessageObject, JS_MESSAGE_OBJECT_TYPE)                   \
-  V(JSModuleNamespace, JS_MODULE_NAMESPACE_TYPE)               \
-  V(JSPromise, JS_PROMISE_TYPE)                                \
-  V(JSProxy, JS_PROXY_TYPE)                                    \
-  V(JSRegExp, JS_REG_EXP_TYPE)                                 \
-  V(JSRegExpStringIterator, JS_REG_EXP_STRING_ITERATOR_TYPE)   \
-  V(JSSet, JS_SET_TYPE)                                        \
-  V(JSStringIterator, JS_STRING_ITERATOR_TYPE)                 \
-  V(JSTypedArray, JS_TYPED_ARRAY_TYPE)                         \
-  V(JSPrimitiveWrapper, JS_PRIMITIVE_WRAPPER_TYPE)             \
-  V(JSFinalizationGroup, JS_FINALIZATION_GROUP_TYPE)           \
-  V(JSFinalizationGroupCleanupIterator,                        \
-    JS_FINALIZATION_GROUP_CLEANUP_ITERATOR_TYPE)               \
-  V(JSWeakMap, JS_WEAK_MAP_TYPE)                               \
-  V(JSWeakRef, JS_WEAK_REF_TYPE)                               \
-  V(JSWeakSet, JS_WEAK_SET_TYPE)                               \
-  V(Map, MAP_TYPE)                                             \
-  V(Oddball, ODDBALL_TYPE)                                     \
-  V(PreparseData, PREPARSE_DATA_TYPE)                          \
-  V(PropertyArray, PROPERTY_ARRAY_TYPE)                        \
-  V(PropertyCell, PROPERTY_CELL_TYPE)                          \
-  V(SharedFunctionInfo, SHARED_FUNCTION_INFO_TYPE)             \
-  V(Symbol, SYMBOL_TYPE)                                       \
-  V(WasmExceptionObject, WASM_EXCEPTION_OBJECT_TYPE)           \
-  V(WasmGlobalObject, WASM_GLOBAL_OBJECT_TYPE)                 \
-  V(WasmMemoryObject, WASM_MEMORY_OBJECT_TYPE)                 \
-  V(WasmModuleObject, WASM_MODULE_OBJECT_TYPE)                 \
-  V(WasmTableObject, WASM_TABLE_OBJECT_TYPE)                   \
-  V(WeakArrayList, WEAK_ARRAY_LIST_TYPE)                       \
-  V(WeakCell, WEAK_CELL_TYPE)
-#ifdef V8_INTL_SUPPORT
-
-#define TQ_INSTANCE_TYPES_SINGLE_NOSTRUCTS(V)           \
-  TQ_INSTANCE_TYPES_SINGLE_BASE(V)                      \
-  V(JSV8BreakIterator, JS_V8_BREAK_ITERATOR_TYPE)       \
-  V(JSCollator, JS_COLLATOR_TYPE)                       \
-  V(JSDateTimeFormat, JS_DATE_TIME_FORMAT_TYPE)         \
-  V(JSListFormat, JS_LIST_FORMAT_TYPE)                  \
-  V(JSLocale, JS_LOCALE_TYPE)                           \
-  V(JSNumberFormat, JS_NUMBER_FORMAT_TYPE)              \
-  V(JSPluralRules, JS_PLURAL_RULES_TYPE)                \
-  V(JSRelativeTimeFormat, JS_RELATIVE_TIME_FORMAT_TYPE) \
-  V(JSSegmentIterator, JS_SEGMENT_ITERATOR_TYPE)        \
-  V(JSSegmenter, JS_SEGMENTER_TYPE)
-
+constexpr char kObject[] = "v8::internal::Object";
+constexpr char kTaggedValue[] = "v8::internal::TaggedValue";
+constexpr char kSmi[] = "v8::internal::Smi";
+constexpr char kHeapObject[] = "v8::internal::HeapObject";
+#ifdef V8_COMPRESS_POINTERS
+constexpr char kObjectAsStoredInHeap[] = "v8::internal::TaggedValue";
 #else
-
-#define TQ_INSTANCE_TYPES_SINGLE_NOSTRUCTS(V) TQ_INSTANCE_TYPES_SINGLE_BASE(V)
-
-#endif  // V8_INTL_SUPPORT
-
-// Used in the static assertion below.
-enum class InstanceTypeCheckersSingle {
-#define ENUM_VALUE(ClassName, INSTANCE_TYPE) k##ClassName = i::INSTANCE_TYPE,
-  INSTANCE_TYPE_CHECKERS_SINGLE(ENUM_VALUE)
-#undef ENUM_VALUE
-};
-
-// Verify that the instance type list above stays in sync with the truth.
-#define CHECK_VALUE(ClassName, INSTANCE_TYPE)                            \
-  static_assert(                                                         \
-      static_cast<i::InstanceType>(                                      \
-          InstanceTypeCheckersSingle::k##ClassName) == i::INSTANCE_TYPE, \
-      "TQ_INSTANCE_TYPES_SINGLE_NOSTRUCTS must be subset of "            \
-      "INSTANCE_TYPE_CHECKERS_SINGLE. Invalid class: " #ClassName);
-TQ_INSTANCE_TYPES_SINGLE_NOSTRUCTS(CHECK_VALUE)
-#undef CHECK_VALUE
-
-// Adapts one STRUCT_LIST_GENERATOR entry to (Name, NAME) format.
-#define STRUCT_INSTANCE_TYPE_ADAPTER(V, NAME, Name, name) V(Name, NAME)
-
-// Pairs of (ClassName, CLASS_NAME_TYPE) for every instance type that
-// corresponds to a single Torque-defined class. Note that all Struct-derived
-// classes are defined in Torque.
-#define TQ_INSTANCE_TYPES_SINGLE(V)     \
-  TQ_INSTANCE_TYPES_SINGLE_NOSTRUCTS(V) \
-  STRUCT_LIST_GENERATOR(STRUCT_INSTANCE_TYPE_ADAPTER, V)
-
-// Likewise, these are the subset of INSTANCE_TYPE_CHECKERS_RANGE that have
-// definitions in .tq files, rearranged with more specific things first. Also
-// includes JSObject and JSReceiver, which in the runtime are optimized to use
-// a one-sided check.
-#define TQ_INSTANCE_TYPES_RANGE(V)                                           \
-  V(Context, FIRST_CONTEXT_TYPE, LAST_CONTEXT_TYPE)                          \
-  V(FixedArray, FIRST_FIXED_ARRAY_TYPE, LAST_FIXED_ARRAY_TYPE)               \
-  V(Microtask, FIRST_MICROTASK_TYPE, LAST_MICROTASK_TYPE)                    \
-  V(String, FIRST_STRING_TYPE, LAST_STRING_TYPE)                             \
-  V(Name, FIRST_NAME_TYPE, LAST_NAME_TYPE)                                   \
-  V(WeakFixedArray, FIRST_WEAK_FIXED_ARRAY_TYPE, LAST_WEAK_FIXED_ARRAY_TYPE) \
-  V(JSObject, FIRST_JS_OBJECT_TYPE, LAST_JS_OBJECT_TYPE)                     \
-  V(JSReceiver, FIRST_JS_RECEIVER_TYPE, LAST_JS_RECEIVER_TYPE)
+constexpr char kObjectAsStoredInHeap[] = "v8::internal::Object";
+#endif
 
 std::string AppendAddressAndType(const std::string& brief, uintptr_t address,
                                  const char* type) {
@@ -148,6 +34,10 @@ std::string AppendAddressAndType(const std::string& brief, uintptr_t address,
                        : brief + " (" + brief_stream.str() + ")";
 }
 
+std::string JoinWithSpace(const std::string& a, const std::string& b) {
+  return a.empty() || b.empty() ? a + b : a + " " + b;
+}
+
 struct TypedObject {
   TypedObject(d::TypeCheckResult type_check_result,
               std::unique_ptr<TqObject> object)
@@ -173,8 +63,8 @@ TypedObject GetTypedObjectByHint(uintptr_t address,
             std::make_unique<Tq##ClassName>(address)};   \
   }
 
-  TQ_INSTANCE_TYPES_SINGLE(TYPE_NAME_CASE)
-  TQ_INSTANCE_TYPES_RANGE(TYPE_NAME_CASE)
+  TORQUE_INSTANCE_CHECKERS_SINGLE_FULLY_DEFINED(TYPE_NAME_CASE)
+  TORQUE_INSTANCE_CHECKERS_RANGE_FULLY_DEFINED(TYPE_NAME_CASE)
   STRING_CLASS_TYPES(TYPE_NAME_CASE)
 
 #undef TYPE_NAME_CASE
@@ -213,7 +103,7 @@ TypedObject GetTypedObjectByInstanceType(uintptr_t address,
 #define INSTANCE_TYPE_CASE(ClassName, INSTANCE_TYPE) \
   case i::INSTANCE_TYPE:                             \
     return {type_source, std::make_unique<Tq##ClassName>(address)};
-    TQ_INSTANCE_TYPES_SINGLE(INSTANCE_TYPE_CASE)
+    TORQUE_INSTANCE_CHECKERS_SINGLE_FULLY_DEFINED(INSTANCE_TYPE_CASE)
 #undef INSTANCE_TYPE_CASE
 
     default:
@@ -229,7 +119,7 @@ TypedObject GetTypedObjectByInstanceType(uintptr_t address,
   if (type >= i::FIRST_TYPE && type <= i::LAST_TYPE) {              \
     return {type_source, std::make_unique<Tq##ClassName>(address)}; \
   }
-      TQ_INSTANCE_TYPES_RANGE(INSTANCE_RANGE_CASE)
+      TORQUE_INSTANCE_CHECKERS_RANGE_FULLY_DEFINED(INSTANCE_RANGE_CASE)
 #undef INSTANCE_RANGE_CASE
 
       return {d::TypeCheckResult::kUnknownInstanceType,
@@ -263,7 +153,7 @@ TypedObject GetTypedHeapObject(uintptr_t address, d::MemoryAccessor accessor,
   // We can't read the Map, so check whether it is in the list of known Maps,
   // as another way to get its instance type.
   KnownInstanceType known_map_type =
-      FindKnownMapInstanceType(map_ptr.value, heap_addresses);
+      FindKnownMapInstanceTypes(map_ptr.value, heap_addresses);
   if (known_map_type.confidence == KnownInstanceType::Confidence::kHigh) {
     DCHECK_EQ(known_map_type.types.size(), 1);
     return GetTypedObjectByInstanceType(address, known_map_type.types[0],
@@ -302,25 +192,20 @@ TypedObject GetTypedHeapObject(uintptr_t address, d::MemoryAccessor accessor,
   return result;
 }
 
-#undef STRUCT_INSTANCE_TYPE_ADAPTER
-#undef TQ_INSTANCE_TYPES_SINGLE_BASE
-#undef TQ_INSTANCE_TYPES_SINGLE
-#undef TQ_INSTANCE_TYPES_SINGLE_NOSTRUCTS
-#undef TQ_INSTANCE_TYPES_RANGE
-
 // An object visitor that accumulates the first few characters of a string.
 class ReadStringVisitor : public TqObjectVisitor {
  public:
-  ReadStringVisitor(d::MemoryAccessor accessor,
-                    const d::HeapAddresses& heap_addresses)
-      : accessor_(accessor),
-        heap_addresses_(heap_addresses),
-        index_(0),
-        limit_(INT32_MAX),
-        done_(false) {}
+  static v8::base::Optional<std::string> Visit(
+      d::MemoryAccessor accessor, const d::HeapAddresses& heap_addresses,
+      const TqString* object) {
+    ReadStringVisitor visitor(accessor, heap_addresses);
+    object->Visit(&visitor);
+    return visitor.GetString();
+  }
 
   // Returns the result as UTF-8 once visiting is complete.
-  std::string GetString() {
+  v8::base::Optional<std::string> GetString() {
+    if (failed_) return {};
     std::vector<char> result(
         string_.size() * unibrow::Utf16::kMaxExtraUtf8BytesForOneUtf16CodeUnit);
     unsigned write_index = 0;
@@ -332,25 +217,40 @@ class ReadStringVisitor : public TqObjectVisitor {
                                 prev_char, /*replace_invalid=*/true);
       prev_char = character;
     }
-    return {result.data(), write_index};
+    return std::string(result.data(), write_index);
   }
 
-  template <typename T>
-  void ReadSeqString(const T* object) {
+  template <typename TChar>
+  Value<TChar> ReadCharacter(uintptr_t data_address, int32_t index) {
+    TChar value{};
+    d::MemoryAccessResult validity =
+        accessor_(data_address + index * sizeof(TChar),
+                  reinterpret_cast<uint8_t*>(&value), sizeof(value));
+    return {validity, value};
+  }
+
+  template <typename TChar>
+  void ReadStringCharacters(const TqString* object, uintptr_t data_address) {
     int32_t length = GetOrFinish(object->GetLengthValue(accessor_));
     for (; index_ < length && index_ < limit_ && !done_; ++index_) {
+      STATIC_ASSERT(sizeof(TChar) <= sizeof(char16_t));
       char16_t c = static_cast<char16_t>(
-          GetOrFinish(object->GetCharsValue(accessor_, index_)));
+          GetOrFinish(ReadCharacter<TChar>(data_address, index_)));
       if (!done_) AddCharacter(c);
     }
   }
 
+  template <typename TChar, typename TString>
+  void ReadSeqString(const TString* object) {
+    ReadStringCharacters<TChar>(object, object->GetCharsAddress());
+  }
+
   void VisitSeqOneByteString(const TqSeqOneByteString* object) override {
-    ReadSeqString(object);
+    ReadSeqString<char>(object);
   }
 
   void VisitSeqTwoByteString(const TqSeqTwoByteString* object) override {
-    ReadSeqString(object);
+    ReadSeqString<char16_t>(object);
   }
 
   void VisitConsString(const TqConsString* object) override {
@@ -389,13 +289,57 @@ class ReadStringVisitor : public TqObjectVisitor {
         .object->Visit(this);
   }
 
-  void VisitExternalString(const TqExternalString* object) override {
-    // TODO(v8:9376): External strings are very common and important when
-    // attempting to print the source of a function in the browser. For now
-    // we're just ignoring them, but eventually we'll want some kind of
-    // mechanism where the user of this library can provide a callback function
-    // that fetches data from external strings.
-    AddEllipsisAndFinish();
+  bool IsExternalStringCached(const TqExternalString* object) {
+    // The safest way to get the instance type is to use known map pointers, in
+    // case the map data is not available.
+    uintptr_t map = GetOrFinish(object->GetMapValue(accessor_));
+    if (done_) return false;
+    auto instance_types = FindKnownMapInstanceTypes(map, heap_addresses_);
+    // Exactly one of the matched instance types should be a string type,
+    // because all maps for string types are in the same space (read-only
+    // space). The "uncached" flag on that instance type tells us whether it's
+    // safe to read the cached data.
+    for (const auto& type : instance_types.types) {
+      if ((type & i::kIsNotStringMask) == i::kStringTag &&
+          (type & i::kStringRepresentationMask) == i::kExternalStringTag) {
+        return (type & i::kUncachedExternalStringMask) !=
+               i::kUncachedExternalStringTag;
+      }
+    }
+
+    // If for some reason we can't find an external string type here (maybe the
+    // caller provided an external string type as the type hint, but it doesn't
+    // actually match the in-memory map pointer), then we can't safely use the
+    // cached data.
+    return false;
+  }
+
+  template <typename TChar>
+  void ReadExternalString(const TqExternalString* object) {
+    // Cached external strings are easy to read; uncached external strings
+    // require knowledge of the embedder. For now, we only read cached external
+    // strings.
+    if (IsExternalStringCached(object)) {
+      uintptr_t data_address = reinterpret_cast<uintptr_t>(
+          GetOrFinish(object->GetResourceDataValue(accessor_)));
+      if (done_) return;
+      ReadStringCharacters<TChar>(object, data_address);
+    } else {
+      // TODO(v8:9376): Come up with some way that a caller with full knowledge
+      // of a particular embedder could provide a callback function for getting
+      // uncached string data.
+      AddEllipsisAndFinish();
+    }
+  }
+
+  void VisitExternalOneByteString(
+      const TqExternalOneByteString* object) override {
+    ReadExternalString<char>(object);
+  }
+
+  void VisitExternalTwoByteString(
+      const TqExternalTwoByteString* object) override {
+    ReadExternalString<char16_t>(object);
   }
 
   void VisitObject(const TqObject* object) override {
@@ -405,6 +349,15 @@ class ReadStringVisitor : public TqObjectVisitor {
   }
 
  private:
+  ReadStringVisitor(d::MemoryAccessor accessor,
+                    const d::HeapAddresses& heap_addresses)
+      : accessor_(accessor),
+        heap_addresses_(heap_addresses),
+        index_(0),
+        limit_(INT32_MAX),
+        done_(false),
+        failed_(false) {}
+
   // Unpacks a value that was fetched from the debuggee. If the value indicates
   // that it couldn't successfully fetch memory, then prevents further work.
   template <typename T>
@@ -417,8 +370,12 @@ class ReadStringVisitor : public TqObjectVisitor {
 
   void AddEllipsisAndFinish() {
     if (!done_) {
-      string_ += u"...";
       done_ = true;
+      if (string_.empty()) {
+        failed_ = true;
+      } else {
+        string_ += u"...";
+      }
     }
   }
 
@@ -462,29 +419,82 @@ class ReadStringVisitor : public TqObjectVisitor {
   int32_t index_;  // Index of next char to read.
   int32_t limit_;  // Don't read past this index (set by SlicedString).
   bool done_;      // Whether to stop further work.
+  bool failed_;    // Whether an error was encountered before any valid data.
 };
 
-// An object visitor that adds extra debugging information for some types.
+// An object visitor that supplies extra information for some types.
 class AddInfoVisitor : public TqObjectVisitor {
  public:
-  AddInfoVisitor(const std::string& brief, d::MemoryAccessor accessor,
-                 const d::HeapAddresses& heap_addresses)
-      : accessor_(accessor), brief_(brief), heap_addresses_(heap_addresses) {}
-
-  // Returns the brief object description, once visiting is complete.
-  const std::string& GetBrief() { return brief_; }
+  // Returns a descriptive string and a list of properties for the given object.
+  // Both may be empty, and are meant as an addition to, not a replacement for,
+  // the Torque-generated data about the object.
+  static std::pair<std::string, std::vector<std::unique_ptr<ObjectProperty>>>
+  Visit(const TqObject* object, d::MemoryAccessor accessor,
+        const d::HeapAddresses& heap_addresses) {
+    AddInfoVisitor visitor(accessor, heap_addresses);
+    object->Visit(&visitor);
+    return {std::move(visitor.brief_), std::move(visitor.properties_)};
+  }
 
   void VisitString(const TqString* object) override {
-    ReadStringVisitor visitor(accessor_, heap_addresses_);
-    object->Visit(&visitor);
-    if (!brief_.empty()) brief_ += " ";
-    brief_ += "\"" + visitor.GetString() + "\"";
+    auto str = ReadStringVisitor::Visit(accessor_, heap_addresses_, object);
+    if (str.has_value()) {
+      brief_ = "\"" + *str + "\"";
+    }
+  }
+
+  void VisitJSObject(const TqJSObject* object) override {
+    // JSObject and its subclasses can be followed directly by an array of
+    // property values. The start and end offsets of those values are described
+    // by a pair of values in its Map.
+    auto map_ptr = object->GetMapValue(accessor_);
+    if (map_ptr.validity != d::MemoryAccessResult::kOk) {
+      return;  // Can't read the JSObject. Nothing useful to do.
+    }
+    TqMap map(map_ptr.value);
+
+    // On JSObject instances, this value is the start of in-object properties.
+    // The constructor function index option is only for primitives.
+    auto start_offset =
+        map.GetInObjectPropertiesStartOrConstructorFunctionIndexValue(
+            accessor_);
+
+    // The total size of the object in memory. This may include over-allocated
+    // expansion space that doesn't correspond to any user-accessible property.
+    auto instance_size = map.GetInstanceSizeInWordsValue(accessor_);
+
+    if (start_offset.validity != d::MemoryAccessResult::kOk ||
+        instance_size.validity != d::MemoryAccessResult::kOk) {
+      return;  // Can't read the Map. Nothing useful to do.
+    }
+    int num_properties = instance_size.value - start_offset.value;
+    if (num_properties > 0) {
+      properties_.push_back(std::make_unique<ObjectProperty>(
+          "in-object properties", kObjectAsStoredInHeap, kObject,
+          object->GetMapAddress() + start_offset.value * i::kTaggedSize,
+          num_properties, i::kTaggedSize,
+          std::vector<std::unique_ptr<StructProperty>>(),
+          d::PropertyKind::kArrayOfKnownSize));
+    }
   }
 
  private:
+  AddInfoVisitor(d::MemoryAccessor accessor,
+                 const d::HeapAddresses& heap_addresses)
+      : accessor_(accessor), heap_addresses_(heap_addresses) {}
+
+  // Inputs used by this visitor:
+
   d::MemoryAccessor accessor_;
-  std::string brief_;
   const d::HeapAddresses& heap_addresses_;
+
+  // Outputs generated by this visitor:
+
+  // A brief description of the object.
+  std::string brief_;
+  // A list of extra properties to append after the automatic ones that are
+  // created for all Torque-defined class fields.
+  std::vector<std::unique_ptr<ObjectProperty>> properties_;
 };
 
 std::unique_ptr<ObjectPropertiesResult> GetHeapObjectPropertiesNotCompressed(
@@ -496,16 +506,15 @@ std::unique_ptr<ObjectPropertiesResult> GetHeapObjectPropertiesNotCompressed(
 
   TypedObject typed =
       GetTypedHeapObject(address, accessor, type_hint, heap_addresses);
+  auto props = typed.object->GetProperties(accessor);
 
-  // TODO(v8:9376): Many object types need additional data that is not included
-  // in their Torque layout definitions. For example, JSObject has an array of
-  // in-object properties after its Torque-defined fields, which at a minimum
-  // should be represented as an array in this response. If the relevant memory
-  // is available, we should instead represent those properties (and any out-of-
-  // object properties) using their JavaScript property names.
-  AddInfoVisitor visitor(brief, accessor, heap_addresses);
-  typed.object->Visit(&visitor);
-  brief = visitor.GetBrief();
+  // Use the AddInfoVisitor to get any extra properties or descriptive text that
+  // can't be directly derived from Torque class definitions.
+  auto extra_info =
+      AddInfoVisitor::Visit(typed.object.get(), accessor, heap_addresses);
+  brief = JoinWithSpace(brief, extra_info.first);
+  props.insert(props.end(), std::make_move_iterator(extra_info.second.begin()),
+               std::make_move_iterator(extra_info.second.end()));
 
   brief = AppendAddressAndType(brief, address, typed.object->GetName());
 
@@ -517,8 +526,8 @@ std::unique_ptr<ObjectPropertiesResult> GetHeapObjectPropertiesNotCompressed(
   }
 
   return std::make_unique<ObjectPropertiesResult>(
-      typed.type_check_result, brief, typed.object->GetName(),
-      typed.object->GetProperties(accessor), std::move(guessed_types));
+      typed.type_check_result, brief, typed.object->GetName(), std::move(props),
+      std::move(guessed_types));
 }
 
 std::unique_ptr<ObjectPropertiesResult> GetHeapObjectPropertiesMaybeCompressed(
@@ -540,10 +549,9 @@ std::unique_ptr<ObjectPropertiesResult> GetHeapObjectPropertiesMaybeCompressed(
   if (any_uncompressed_ptr == 0) {
     // We can't figure out the heap range. Just check for known objects.
     std::string brief = FindKnownObject(address, heap_addresses);
-    brief = AppendAddressAndType(brief, address, "v8::internal::TaggedValue");
+    brief = AppendAddressAndType(brief, address, kTaggedValue);
     return std::make_unique<ObjectPropertiesResult>(
-        d::TypeCheckResult::kUnableToDecompress, brief,
-        "v8::internal::TaggedValue");
+        d::TypeCheckResult::kUnableToDecompress, brief, kTaggedValue);
   }
 
   address = EnsureDecompressed(address, any_uncompressed_ptr);
@@ -557,8 +565,7 @@ std::unique_ptr<ObjectPropertiesResult> GetObjectProperties(
     const d::HeapAddresses& heap_addresses, const char* type_hint) {
   if (static_cast<uint32_t>(address) == i::kClearedWeakHeapObjectLower32) {
     return std::make_unique<ObjectPropertiesResult>(
-        d::TypeCheckResult::kWeakRef, "cleared weak ref",
-        "v8::internal::HeapObject");
+        d::TypeCheckResult::kWeakRef, "cleared weak ref", kHeapObject);
   }
   bool is_weak = (address & i::kHeapObjectTagMask) == i::kWeakHeapObjectTag;
   if (is_weak) {
@@ -579,8 +586,8 @@ std::unique_ptr<ObjectPropertiesResult> GetObjectProperties(
   int32_t value = i::PlatformSmiTagging::SmiToInt(address);
   std::stringstream stream;
   stream << value << " (0x" << std::hex << value << ")";
-  return std::make_unique<ObjectPropertiesResult>(
-      d::TypeCheckResult::kSmi, stream.str(), "v8::internal::Smi");
+  return std::make_unique<ObjectPropertiesResult>(d::TypeCheckResult::kSmi,
+                                                  stream.str(), kSmi);
 }
 
 }  // namespace v8_debug_helper_internal
diff --git a/deps/v8/tools/debug_helper/heap-constants.cc b/deps/v8/tools/debug_helper/heap-constants.cc
index 9b9ed04cc1bee9..edb47c80b1d170 100644
--- a/deps/v8/tools/debug_helper/heap-constants.cc
+++ b/deps/v8/tools/debug_helper/heap-constants.cc
@@ -49,7 +49,7 @@ std::string FindKnownObject(uintptr_t address,
   return result;
 }
 
-KnownInstanceType FindKnownMapInstanceType(
+KnownInstanceType FindKnownMapInstanceTypes(
     uintptr_t address, const d::HeapAddresses& heap_addresses) {
   uintptr_t containing_page = address & ~i::kPageAlignmentMask;
   uintptr_t offset_in_page = address & i::kPageAlignmentMask;
diff --git a/deps/v8/tools/debug_helper/heap-constants.h b/deps/v8/tools/debug_helper/heap-constants.h
index 6c1f17dc8296a8..fb2d20df12fe01 100644
--- a/deps/v8/tools/debug_helper/heap-constants.h
+++ b/deps/v8/tools/debug_helper/heap-constants.h
@@ -59,7 +59,7 @@ struct KnownInstanceType {
 
 // Returns information about the instance type of the Map at the given address,
 // based on the list of known Maps.
-KnownInstanceType FindKnownMapInstanceType(
+KnownInstanceType FindKnownMapInstanceTypes(
     uintptr_t address, const d::HeapAddresses& heap_addresses);
 
 }  // namespace v8_debug_helper_internal
diff --git a/deps/v8/tools/debug_helper/list-object-classes.cc b/deps/v8/tools/debug_helper/list-object-classes.cc
new file mode 100644
index 00000000000000..6285aeb2f52c2d
--- /dev/null
+++ b/deps/v8/tools/debug_helper/list-object-classes.cc
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "debug-helper-internal.h"
+#include "torque-generated/class-debug-readers-tq.h"
+
+namespace di = v8_debug_helper_internal;
+
+extern "C" {
+V8_DEBUG_HELPER_EXPORT const d::ClassList*
+_v8_debug_helper_ListObjectClasses() {
+  return &di::kObjectClassList;
+}
+}
diff --git a/deps/v8/tools/dev/gm.py b/deps/v8/tools/dev/gm.py
index 8269b94cc2ffef..67118368b4b4b4 100755
--- a/deps/v8/tools/dev/gm.py
+++ b/deps/v8/tools/dev/gm.py
@@ -52,7 +52,7 @@
 # Tests that run-tests.py would run by default that can be run with
 # BUILD_TARGETS_TESTS.
 DEFAULT_TESTS = ["cctest", "debugger", "intl", "message", "mjsunit",
-                 "preparser", "unittests"]
+                 "unittests"]
 # These can be suffixed to any <arch>.<mode> combo, or used standalone,
 # or used as global modifiers (affecting all <arch>.<mode> combos).
 ACTIONS = {
@@ -83,10 +83,11 @@
               "message": "d8",
               "mjsunit": "d8",
               "mozilla": "d8",
-              "preparser": "d8",
               "test262": "d8",
               "unittests": "unittests",
               "wasm-api-tests": "wasm_api_tests",
+              "wasm-js": "d8",
+              "wasm-spec-tests": "d8",
               "webkit": "d8"}
 
 OUTDIR = "out"
@@ -340,10 +341,12 @@ def ParseArg(self, argstring):
     targets = []
     actions = []
     tests = []
-    # Specifying a single unit test looks like "unittests/Foo.Bar".
-    if argstring.startswith("unittests/"):
+    # Specifying a single unit test looks like "unittests/Foo.Bar", test262
+    # tests have names like "S15.4.4.7_A4_T1", don't split these.
+    if argstring.startswith("unittests/") or argstring.startswith("test262/"):
       words = [argstring]
     else:
+      # Assume it's a word like "x64.release" -> split at the dot.
       words = argstring.split('.')
     if len(words) == 1:
       word = words[0]
diff --git a/deps/v8/tools/gcmole/BUILD.gn b/deps/v8/tools/gcmole/BUILD.gn
index ba2d67fd79cea2..fc7d81e561dbdc 100644
--- a/deps/v8/tools/gcmole/BUILD.gn
+++ b/deps/v8/tools/gcmole/BUILD.gn
@@ -31,6 +31,7 @@ group("v8_run_gcmole") {
     "../../third_party/icu/source/",
     "../../third_party/wasm-api/wasm.h",
     "../../third_party/wasm-api/wasm.hh",
+    "../../third_party/zlib/",
     "../../third_party/inspector_protocol/",
     "$target_gen_dir/../../",
     "$target_gen_dir/../../torque-generated/",
diff --git a/deps/v8/tools/gcmole/README b/deps/v8/tools/gcmole/README
index 48785b871af354..46b4717e3c1b1a 100644
--- a/deps/v8/tools/gcmole/README
+++ b/deps/v8/tools/gcmole/README
@@ -1,21 +1,37 @@
 DESCRIPTION -------------------------------------------------------------------
 
 gcmole is a simple static analysis tool used to find possible evaluation order 
-dependent GC-unsafe places in the V8 codebase.
+dependent GC-unsafe places in the V8 codebase and "stale" pointers to the heap
+(ones whose addresses got invalidated by the GC).
 
 For example the following code is GC-unsafe:
 
     Handle<Object> Foo();  // Assume Foo can trigger a GC.
-    void Bar(Object*, Object*);
+    void Bar(Object, Object);
 
     Handle<Object> baz;
     baz->Qux(*Foo());  // (a)
-    Bar(*Foo(), *baz);  // (b)
+    Bar(*Foo(), *baz); // (b)
 
 Both in cases (a) and (b) compiler is free to evaluate call arguments (that 
 includes receiver) in any order. That means it can dereference baz before 
 calling to Foo and save a raw pointer to a heap object in the register or 
-on the stack.  
+on the stack.
+
+In terms of the AST analysis that gcmole does, it warns about places in the
+code which result in 2 subtrees, the order of execution of which is undefined
+by C++, one of which causes a GC and the other dereferences a Handle to a raw
+Object (or its subclasses).
+
+The following code triggers a stale variable warning (assuming that the Foo
+function was detected as potentially allocating, as in the previous example):
+
+    JSObject raw_obj = ...;
+    Foo();
+    raw_obj.Print();
+
+Since Foo can trigger a GC, it might have moved the raw_obj. The solution is
+simply to store it as a Handle.
 
 PREREQUISITES -----------------------------------------------------------------
 
diff --git a/deps/v8/tools/gcmole/gcmole-test.cc b/deps/v8/tools/gcmole/gcmole-test.cc
index 3af1bac3b50b38..e0e2801f777e83 100644
--- a/deps/v8/tools/gcmole/gcmole-test.cc
+++ b/deps/v8/tools/gcmole/gcmole-test.cc
@@ -130,5 +130,88 @@ void TestFollowingVirtualFunctions(Isolate* isolate) {
   so_handle->Method(*base->VirtualCauseGC(obj1, isolate));
 }
 
+// --------- Test for correctly resolving static methods ----------
+
+class SomeClass {
+ public:
+  static Handle<Object> StaticCauseGC(Handle<Object> obj, Isolate* isolate) {
+    isolate->heap()->CollectGarbage(OLD_SPACE,
+                                    GarbageCollectionReason::kTesting);
+
+    return obj;
+  }
+};
+
+void TestFollowingStaticFunctions(Isolate* isolate) {
+  SomeObject so;
+  Handle<SomeObject> so_handle = handle(so, isolate);
+
+  Handle<JSObject> obj1 = isolate->factory()->NewJSObjectWithNullProto();
+  // Should cause warning.
+  so_handle->Method(*SomeClass::StaticCauseGC(obj1, isolate));
+}
+
+// --------- Test basic dead variable analysis ----------
+
+void TestDeadVarAnalysis(Isolate* isolate) {
+  JSObject raw_obj = *isolate->factory()->NewJSObjectWithNullProto();
+  CauseGCRaw(raw_obj, isolate);
+
+  // Should cause warning.
+  raw_obj.Print();
+}
+
+void TestGuardedDeadVarAnalysis(Isolate* isolate) {
+  JSObject raw_obj = *isolate->factory()->NewJSObjectWithNullProto();
+
+  // Note: having DisallowHeapAllocation with the same function as CauseGC
+  // normally doesn't make sense, but we want to test whether the gurads
+  // are recognized by GCMole.
+  DisallowHeapAllocation no_gc;
+  CauseGCRaw(raw_obj, isolate);
+
+  // Shouldn't cause warning.
+  raw_obj.Print();
+}
+
+void TestGuardedDeadVarAnalysisNotOnStack(Isolate* isolate) {
+  JSObject raw_obj = *isolate->factory()->NewJSObjectWithNullProto();
+
+  // {DisallowHeapAccess} has a {DisallowHeapAllocation} embedded as a member
+  // field, so both are treated equally by gcmole.
+  DisallowHeapAccess no_gc;
+  CauseGCRaw(raw_obj, isolate);
+
+  // Shouldn't cause warning.
+  raw_obj.Print();
+}
+
+void TestGuardedDeadVarAnalysisNested(JSObject raw_obj, Isolate* isolate) {
+  CauseGCRaw(raw_obj, isolate);
+
+  // Shouldn't cause warning.
+  raw_obj.Print();
+}
+
+void TestGuardedDeadVarAnalysisCaller(Isolate* isolate) {
+  DisallowHeapAccess no_gc;
+  JSObject raw_obj = *isolate->factory()->NewJSObjectWithNullProto();
+
+  TestGuardedDeadVarAnalysisNested(raw_obj, isolate);
+}
+
+JSObject GuardedAllocation(Isolate* isolate) {
+  DisallowHeapAllocation no_gc;
+  return *isolate->factory()->NewJSObjectWithNullProto();
+}
+
+void TestNestedDeadVarAnalysis(Isolate* isolate) {
+  JSObject raw_obj = GuardedAllocation(isolate);
+  CauseGCRaw(raw_obj, isolate);
+
+  // Should cause warning.
+  raw_obj.Print();
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/tools/gcmole/gcmole.cc b/deps/v8/tools/gcmole/gcmole.cc
index 806100d381f077..606c90bb582d57 100644
--- a/deps/v8/tools/gcmole/gcmole.cc
+++ b/deps/v8/tools/gcmole/gcmole.cc
@@ -45,6 +45,30 @@
 
 namespace {
 
+bool g_tracing_enabled = false;
+
+#define TRACE(str)                   \
+  do {                               \
+    if (g_tracing_enabled) {         \
+      std::cout << str << std::endl; \
+    }                                \
+  } while (false)
+
+#define TRACE_LLVM_TYPE(str, type)                                \
+  do {                                                            \
+    if (g_tracing_enabled) {                                      \
+      std::cout << str << " " << type.getAsString() << std::endl; \
+    }                                                             \
+  } while (false)
+
+#define TRACE_LLVM_DECL(str, decl)   \
+  do {                               \
+    if (g_tracing_enabled) {         \
+      std::cout << str << std::endl; \
+      decl->dump();                  \
+    }                                \
+  } while (false)
+
 typedef std::string MangledName;
 typedef std::set<MangledName> CalleesSet;
 typedef std::map<MangledName, MangledName> CalleesMap;
@@ -113,12 +137,74 @@ struct Resolver {
     clang::DeclContext::lookup_iterator end = result.end();
     for (clang::DeclContext::lookup_iterator i = result.begin(); i != end;
          i++) {
-      if (llvm::isa<T>(*i)) return llvm::cast<T>(*i);
+      if (llvm::isa<T>(*i)) {
+        return llvm::cast<T>(*i);
+      } else {
+        llvm::errs() << "Didn't match declaration template against "
+                     << (*i)->getNameAsString() << "\n";
+      }
     }
 
     return NULL;
   }
 
+  clang::CXXRecordDecl* ResolveTemplate(const char* n) {
+    clang::NamedDecl* initial_template = Resolve<clang::NamedDecl>(n);
+    if (!initial_template) return NULL;
+
+    clang::NamedDecl* underlying_template =
+        initial_template->getUnderlyingDecl();
+    if (!underlying_template) {
+      llvm::errs() << "Couldn't resolve underlying template\n";
+      return NULL;
+    }
+    const clang::TypeAliasDecl* type_alias_decl =
+        llvm::dyn_cast_or_null<clang::TypeAliasDecl>(underlying_template);
+    if (!type_alias_decl) {
+      llvm::errs() << "Couldn't resolve TypeAliasDecl\n";
+      return NULL;
+    }
+    const clang::Type* type = type_alias_decl->getTypeForDecl();
+    if (!type) {
+      llvm::errs() << "Couldn't resolve TypeAliasDecl to Type\n";
+      return NULL;
+    }
+    const clang::TypedefType* typedef_type =
+        llvm::dyn_cast_or_null<clang::TypedefType>(type);
+    if (!typedef_type) {
+      llvm::errs() << "Couldn't resolve TypedefType\n";
+      return NULL;
+    }
+    const clang::TypedefNameDecl* typedef_name_decl = typedef_type->getDecl();
+    if (!typedef_name_decl) {
+      llvm::errs() << "Couldn't resolve TypedefType to TypedefNameDecl\n";
+      return NULL;
+    }
+
+    clang::QualType underlying_type = typedef_name_decl->getUnderlyingType();
+    if (!llvm::isa<clang::TemplateSpecializationType>(underlying_type)) {
+      llvm::errs() << "Couldn't resolve TemplateSpecializationType\n";
+      return NULL;
+    }
+
+    const clang::TemplateSpecializationType* templ_specialization_type =
+        llvm::cast<clang::TemplateSpecializationType>(underlying_type);
+    if (!llvm::isa<clang::RecordType>(templ_specialization_type->desugar())) {
+      llvm::errs() << "Couldn't resolve RecordType\n";
+      return NULL;
+    }
+
+    const clang::RecordType* record_type =
+        llvm::cast<clang::RecordType>(templ_specialization_type->desugar());
+    clang::CXXRecordDecl* record_decl =
+        llvm::dyn_cast_or_null<clang::CXXRecordDecl>(record_type->getDecl());
+    if (!record_decl) {
+      llvm::errs() << "Couldn't resolve CXXRecordDecl\n";
+      return NULL;
+    }
+    return record_decl;
+  }
+
  private:
   clang::ASTContext& ctx_;
   clang::DeclContext* decl_ctx_;
@@ -272,7 +358,7 @@ static void LoadSuspectsWhitelist() {
   whitelist_loaded = true;
 }
 
-// Looks for exact match of the mangled name
+// Looks for exact match of the mangled name.
 static bool KnownToCauseGC(clang::MangleContext* ctx,
                            const clang::FunctionDecl* decl) {
   LoadGCSuspects();
@@ -287,7 +373,7 @@ static bool KnownToCauseGC(clang::MangleContext* ctx,
   return false;
 }
 
-// Looks for partial match of only the function name
+// Looks for partial match of only the function name.
 static bool SuspectedToCauseGC(clang::MangleContext* ctx,
                                const clang::FunctionDecl* decl) {
   LoadGCSuspects();
@@ -430,7 +516,7 @@ class Environment {
       std::cout << e.first;
       comma = true;
     }
-    std::cout << "}";
+    std::cout << "}" << std::endl;
   }
 
   static Environment* Allocate(const Environment& env) {
@@ -586,15 +672,19 @@ static std::string THIS ("this");
 
 class FunctionAnalyzer {
  public:
-  FunctionAnalyzer(clang::MangleContext* ctx,
-                   clang::CXXRecordDecl* object_decl,
+  FunctionAnalyzer(clang::MangleContext* ctx, clang::CXXRecordDecl* object_decl,
                    clang::CXXRecordDecl* maybe_object_decl,
-                   clang::CXXRecordDecl* smi_decl, clang::DiagnosticsEngine& d,
-                   clang::SourceManager& sm, bool dead_vars_analysis)
+                   clang::CXXRecordDecl* smi_decl,
+                   clang::CXXRecordDecl* no_gc_decl,
+                   clang::CXXRecordDecl* no_heap_access_decl,
+                   clang::DiagnosticsEngine& d, clang::SourceManager& sm,
+                   bool dead_vars_analysis)
       : ctx_(ctx),
         object_decl_(object_decl),
         maybe_object_decl_(maybe_object_decl),
         smi_decl_(smi_decl),
+        no_gc_decl_(no_gc_decl),
+        no_heap_access_decl_(no_heap_access_decl),
         d_(d),
         sm_(sm),
         block_(NULL),
@@ -729,7 +819,7 @@ class FunctionAnalyzer {
 
   DECL_VISIT_EXPR(ArraySubscriptExpr) {
     clang::Expr* exprs[2] = {expr->getBase(), expr->getIdx()};
-    return Par(expr, 2, exprs, env);
+    return Parallel(expr, 2, exprs, env);
   }
 
   bool IsRawPointerVar(clang::Expr* expr, std::string* var_name) {
@@ -749,14 +839,14 @@ class FunctionAnalyzer {
 
     switch (expr->getOpcode()) {
       case clang::BO_Comma:
-        return Seq(expr, 2, exprs, env);
+        return Sequential(expr, 2, exprs, env);
 
       case clang::BO_LAnd:
       case clang::BO_LOr:
         return ExprEffect::Merge(VisitExpr(lhs, env), VisitExpr(rhs, env));
 
       default:
-        return Par(expr, 2, exprs, env);
+        return Parallel(expr, 2, exprs, env);
     }
   }
 
@@ -797,7 +887,7 @@ class FunctionAnalyzer {
   DECL_VISIT_EXPR(ConstantExpr) { return VisitExpr(expr->getSubExpr(), env); }
 
   DECL_VISIT_EXPR(InitListExpr) {
-    return Seq(expr, expr->getNumInits(), expr->getInits(), env);
+    return Sequential(expr, expr->getNumInits(), expr->getInits(), env);
   }
 
   DECL_VISIT_EXPR(MemberExpr) {
@@ -813,11 +903,11 @@ class FunctionAnalyzer {
   }
 
   DECL_VISIT_EXPR(ParenListExpr) {
-    return Par(expr, expr->getNumExprs(), expr->getExprs(), env);
+    return Parallel(expr, expr->getNumExprs(), expr->getExprs(), env);
   }
 
   DECL_VISIT_EXPR(UnaryOperator) {
-    // TODO(mstarzinger): We are treating all expressions that look like
+    // TODO(gcmole): We are treating all expressions that look like
     // {&raw_pointer_var} as definitions of {raw_pointer_var}. This should be
     // changed to recognize less generic pattern:
     //
@@ -848,10 +938,10 @@ class FunctionAnalyzer {
     return Use(expr, expr->getDecl(), env);
   }
 
-  ExprEffect Par(clang::Expr* parent,
-                 int n,
-                 clang::Expr** exprs,
-                 const Environment& env) {
+  // Represents a node in the AST {parent} whose children {exprs} have
+  // undefined order of evaluation, e.g. array subscript or a binary operator.
+  ExprEffect Parallel(clang::Expr* parent, int n, clang::Expr** exprs,
+                      const Environment& env) {
     CallProps props;
 
     for (int i = 0; i < n; ++i) {
@@ -864,10 +954,10 @@ class FunctionAnalyzer {
         RepresentsRawPointerType(parent->getType()));
   }
 
-  ExprEffect Seq(clang::Stmt* parent,
-                 int n,
-                 clang::Expr** exprs,
-                 const Environment& env) {
+  // Represents a node in the AST {parent} whose children {exprs} are
+  // executed in sequence, e.g. a switch statement or an initializer list.
+  ExprEffect Sequential(clang::Stmt* parent, int n, clang::Expr** exprs,
+                        const Environment& env) {
     ExprEffect out = ExprEffect::None();
     Environment out_env = env;
     for (int i = 0; i < n; ++i) {
@@ -877,12 +967,24 @@ class FunctionAnalyzer {
     return out;
   }
 
+  // Represents a node in the AST {parent} which uses the variable {var_name},
+  // e.g. this expression or operator&.
+  // Here we observe the type in {var_type} of a previously declared variable
+  // and if it's a raw heap object type, we do the following:
+  // 1. If it got stale due to GC since its declaration, we report it as such.
+  // 2. Mark its raw usage in the ExprEffect returned by this function.
   ExprEffect Use(const clang::Expr* parent,
                  const clang::QualType& var_type,
                  const std::string& var_name,
                  const Environment& env) {
     if (RepresentsRawPointerType(var_type)) {
-      if (!env.IsAlive(var_name) && dead_vars_analysis_) {
+      // We currently care only about our internal pointer types and not about
+      // raw C++ pointers, because normally special care is taken when storing
+      // raw pointers to the managed heap. Furthermore, checking for raw
+      // pointers produces too many false positives in the dead variable
+      // analysis.
+      if (IsInternalPointerType(var_type) && !env.IsAlive(var_name) &&
+          !HasActiveGuard() && dead_vars_analysis_) {
         ReportUnsafe(parent, DEAD_VAR_MSG);
       }
       return ExprEffect::RawUse();
@@ -918,7 +1020,9 @@ class FunctionAnalyzer {
     }
   }
 
-
+  // After visiting the receiver and the arguments of the {call} node, this
+  // function might report a GC-unsafe usage (due to the undefined evaluation
+  // order of the receiver and the rest of the arguments).
   ExprEffect VisitCallExpr(clang::CallExpr* call,
                            const Environment& env) {
     CallProps props;
@@ -935,7 +1039,7 @@ class FunctionAnalyzer {
         llvm::dyn_cast_or_null<clang::CXXOperatorCallExpr>(call);
     if (opcall != NULL && opcall->isAssignmentOp() &&
         IsRawPointerVar(opcall->getArg(0), &var_name)) {
-      // TODO(mstarzinger): We are treating all assignment operator calls with
+      // TODO(gcmole): We are treating all assignment operator calls with
       // the left hand side looking like {raw_pointer_var} as safe independent
       // of the concrete assignment operator implementation. This should be
       // changed to be more narrow only if the assignment operator of the base
@@ -956,6 +1060,7 @@ class FunctionAnalyzer {
         out.setGC();
       }
 
+      // Support for virtual methods that might be GC suspects.
       clang::CXXMethodDecl* method =
           llvm::dyn_cast_or_null<clang::CXXMethodDecl>(callee);
       if (method != NULL && method->isVirtual()) {
@@ -969,6 +1074,10 @@ class FunctionAnalyzer {
               out.setGC();
             }
           } else {
+            // According to the documentation, {getDevirtualizedMethod} might
+            // return NULL, in which case we still want to use the partial
+            // match of the {method}'s name against the GC suspects in order
+            // to increase coverage.
             if (SuspectedToCauseGC(ctx_, method)) {
               out.setGC();
             }
@@ -1082,26 +1191,26 @@ class FunctionAnalyzer {
       out_ = Environment::Merge(out_, env);
     }
 
-    void Seq(clang::Stmt* a, clang::Stmt* b, clang::Stmt* c) {
+    void Sequential(clang::Stmt* a, clang::Stmt* b, clang::Stmt* c) {
       Environment a_out = owner_->VisitStmt(a, in());
       Environment b_out = owner_->VisitStmt(b, a_out);
       Environment c_out = owner_->VisitStmt(c, b_out);
       MergeOut(c_out);
     }
 
-    void Seq(clang::Stmt* a, clang::Stmt* b) {
+    void Sequential(clang::Stmt* a, clang::Stmt* b) {
       Environment a_out = owner_->VisitStmt(a, in());
       Environment b_out = owner_->VisitStmt(b, a_out);
       MergeOut(b_out);
     }
 
     void Loop(clang::Stmt* a, clang::Stmt* b, clang::Stmt* c) {
-      Seq(a, b, c);
+      Sequential(a, b, c);
       MergeIn(out());
     }
 
     void Loop(clang::Stmt* a, clang::Stmt* b) {
-      Seq(a, b);
+      Sequential(a, b);
       MergeIn(out());
     }
 
@@ -1126,6 +1235,7 @@ class FunctionAnalyzer {
   }
 
   DECL_VISIT_STMT(CompoundStmt) {
+    scopes_.push_back(GCGuard(stmt, false));
     Environment out = env;
     clang::CompoundStmt::body_iterator end = stmt->body_end();
     for (clang::CompoundStmt::body_iterator s = stmt->body_begin();
@@ -1133,6 +1243,7 @@ class FunctionAnalyzer {
          ++s) {
       out = VisitStmt(*s, out);
     }
+    scopes_.pop_back();
     return out;
   }
 
@@ -1171,7 +1282,7 @@ class FunctionAnalyzer {
 
   DECL_VISIT_STMT(SwitchStmt) {
     Block block (env, this);
-    block.Seq(stmt->getCond(), stmt->getBody());
+    block.Sequential(stmt->getCond(), stmt->getBody());
     return block.out();
   }
 
@@ -1225,42 +1336,38 @@ class FunctionAnalyzer {
     return record->getDefinition();
   }
 
-  bool IsRawPointerType(const clang::PointerType* type) {
-    const clang::CXXRecordDecl* record = type->getPointeeCXXRecordDecl();
-
+  bool IsDerivedFromInternalPointer(const clang::CXXRecordDecl* record) {
     const clang::CXXRecordDecl* definition = GetDefinitionOrNull(record);
     if (!definition) {
       return false;
     }
 
-    // TODO(mstarzinger): Unify the common parts of {IsRawPointerType} and
-    // {IsInternalPointerType} once gcmole is up and running again.
     bool result = (IsDerivedFrom(record, object_decl_) &&
                    !IsDerivedFrom(record, smi_decl_)) ||
                   IsDerivedFrom(record, maybe_object_decl_);
     return result;
   }
 
+  bool IsRawPointerType(const clang::PointerType* type) {
+    const clang::CXXRecordDecl* record = type->getPointeeCXXRecordDecl();
+    bool result = IsDerivedFromInternalPointer(record);
+    TRACE("is raw " << result << " " << record->getNameAsString());
+    return result;
+  }
+
   bool IsInternalPointerType(clang::QualType qtype) {
+    // Not yet assigned pointers can't get moved by the GC.
     if (qtype.isNull()) {
       return false;
     }
+    // nullptr can't get moved by the GC.
     if (qtype->isNullPtrType()) {
-      return true;
-    }
-
-    const clang::CXXRecordDecl* record = qtype->getAsCXXRecordDecl();
-
-    const clang::CXXRecordDecl* definition = GetDefinitionOrNull(record);
-    if (!definition) {
       return false;
     }
 
-    // TODO(mstarzinger): Unify the common parts of {IsRawPointerType} and
-    // {IsInternalPointerType} once gcmole is up and running again.
-    bool result = (IsDerivedFrom(record, object_decl_) &&
-                   !IsDerivedFrom(record, smi_decl_)) ||
-                  IsDerivedFrom(record, maybe_object_decl_);
+    const clang::CXXRecordDecl* record = qtype->getAsCXXRecordDecl();
+    bool result = IsDerivedFromInternalPointer(record);
+    TRACE_LLVM_TYPE("is internal " << result, qtype);
     return result;
   }
 
@@ -1276,17 +1383,40 @@ class FunctionAnalyzer {
     }
   }
 
-  Environment VisitDecl(clang::Decl* decl, const Environment& env) {
+  bool IsGCGuard(clang::QualType qtype) {
+    if (qtype.isNull()) {
+      return false;
+    }
+    if (qtype->isNullPtrType()) {
+      return false;
+    }
+
+    const clang::CXXRecordDecl* record = qtype->getAsCXXRecordDecl();
+    const clang::CXXRecordDecl* definition = GetDefinitionOrNull(record);
+
+    if (!definition) {
+      return false;
+    }
+
+    return (no_gc_decl_ && IsDerivedFrom(definition, no_gc_decl_)) ||
+           (no_heap_access_decl_ &&
+            IsDerivedFrom(definition, no_heap_access_decl_));
+  }
+
+  Environment VisitDecl(clang::Decl* decl, Environment& env) {
     if (clang::VarDecl* var = llvm::dyn_cast<clang::VarDecl>(decl)) {
       Environment out = var->hasInit() ? VisitStmt(var->getInit(), env) : env;
 
       if (RepresentsRawPointerType(var->getType())) {
         out = out.Define(var->getNameAsString());
       }
+      if (IsGCGuard(var->getType())) {
+        scopes_.back().has_guard = true;
+      }
 
       return out;
     }
-    // TODO(mstarzinger): handle other declarations?
+    // TODO(gcmole): handle other declarations?
     return env;
   }
 
@@ -1334,6 +1464,13 @@ class FunctionAnalyzer {
     block_ = block;
   }
 
+  bool HasActiveGuard() {
+    for (auto s : scopes_) {
+      if (s.has_guard) return true;
+    }
+    return false;
+  }
+
  private:
   void ReportUnsafe(const clang::Expr* expr, const std::string& msg) {
     d_.Report(clang::FullSourceLoc(expr->getExprLoc(), sm_),
@@ -1346,14 +1483,24 @@ class FunctionAnalyzer {
   clang::CXXRecordDecl* object_decl_;
   clang::CXXRecordDecl* maybe_object_decl_;
   clang::CXXRecordDecl* smi_decl_;
+  clang::CXXRecordDecl* no_gc_decl_;
+  clang::CXXRecordDecl* no_heap_access_decl_;
 
   clang::DiagnosticsEngine& d_;
   clang::SourceManager& sm_;
 
   Block* block_;
   bool dead_vars_analysis_;
-};
 
+  struct GCGuard {
+    clang::CompoundStmt* stmt = NULL;
+    bool has_guard = false;
+
+    GCGuard(clang::CompoundStmt* stmt_, bool has_guard_)
+        : stmt(stmt_), has_guard(has_guard_) {}
+  };
+  std::vector<GCGuard> scopes_;
+};
 
 class ProblemsFinder : public clang::ASTConsumer,
                        public clang::RecursiveASTVisitor<ProblemsFinder> {
@@ -1365,12 +1512,28 @@ class ProblemsFinder : public clang::ASTConsumer,
       if (args[i] == "--dead-vars") {
         dead_vars_analysis_ = true;
       }
+      if (args[i] == "--verbose") {
+        g_tracing_enabled = true;
+      }
     }
   }
 
   virtual void HandleTranslationUnit(clang::ASTContext &ctx) {
     Resolver r(ctx);
 
+    // It is a valid situation that no_gc_decl == NULL when the
+    // DisallowHeapAllocation is not included and can't be resolved.
+    // This is gracefully handled in the FunctionAnalyzer later.
+    clang::CXXRecordDecl* no_gc_decl =
+        r.ResolveNamespace("v8")
+            .ResolveNamespace("internal")
+            .ResolveTemplate("DisallowHeapAllocation");
+
+    clang::CXXRecordDecl* no_heap_access_decl =
+        r.ResolveNamespace("v8")
+            .ResolveNamespace("internal")
+            .Resolve<clang::CXXRecordDecl>("DisallowHeapAccess");
+
     clang::CXXRecordDecl* object_decl =
         r.ResolveNamespace("v8").ResolveNamespace("internal").
             Resolve<clang::CXXRecordDecl>("Object");
@@ -1391,10 +1554,14 @@ class ProblemsFinder : public clang::ASTConsumer,
 
     if (smi_decl != NULL) smi_decl = smi_decl->getDefinition();
 
+    if (no_heap_access_decl != NULL)
+      no_heap_access_decl = no_heap_access_decl->getDefinition();
+
     if (object_decl != NULL && smi_decl != NULL && maybe_object_decl != NULL) {
       function_analyzer_ = new FunctionAnalyzer(
           clang::ItaniumMangleContext::create(ctx, d_), object_decl,
-          maybe_object_decl, smi_decl, d_, sm_, dead_vars_analysis_);
+          maybe_object_decl, smi_decl, no_gc_decl, no_heap_access_decl, d_, sm_,
+          dead_vars_analysis_);
       TraverseDecl(ctx.getTranslationUnitDecl());
     } else {
       if (object_decl == NULL) {
@@ -1410,7 +1577,17 @@ class ProblemsFinder : public clang::ASTConsumer,
   }
 
   virtual bool VisitFunctionDecl(clang::FunctionDecl* decl) {
+    // Don't print tracing from includes, otherwise the output is too big.
+    bool tracing = g_tracing_enabled;
+    const auto& fileID = sm_.getFileID(decl->getLocation());
+    if (fileID != sm_.getMainFileID()) {
+      g_tracing_enabled = false;
+    }
+
+    TRACE("Visiting function " << decl->getNameAsString());
     function_analyzer_->AnalyzeFunction(decl);
+
+    g_tracing_enabled = tracing;
     return true;
   }
 
@@ -1453,3 +1630,11 @@ FindProblems("find-problems", "Find GC-unsafe places.");
 static clang::FrontendPluginRegistry::Add<
   Action<FunctionDeclarationFinder> >
 DumpCallees("dump-callees", "Dump callees for each function.");
+
+#undef TRACE
+#undef TRACE_LLVM_TYPE
+#undef TRACE_LLVM_DECL
+#undef DECL_VISIT_EXPR
+#undef IGNORE_EXPR
+#undef DECL_VISIT_STMT
+#undef IGNORE_STMT
diff --git a/deps/v8/tools/gcmole/gcmole.lua b/deps/v8/tools/gcmole/gcmole.lua
index 305a498b07d854..a09c3b61ad5161 100644
--- a/deps/v8/tools/gcmole/gcmole.lua
+++ b/deps/v8/tools/gcmole/gcmole.lua
@@ -44,6 +44,9 @@ local FLAGS = {
    -- TODO add some sort of whiteliste to filter out false positives.
    dead_vars = false;
 
+   -- Enable verbose tracing from the plugin itself.
+   verbose_trace = false;
+
    -- When building gcsuspects whitelist certain functions as if they
    -- can be causing GC. Currently used to reduce number of false
    -- positives in dead variables analysis. See TODO for WHITELIST
@@ -289,28 +292,36 @@ local ARCHITECTURES = {
 
 local gc, gc_caused, funcs
 
+-- Note that the gcsuspects file lists functions in the form:
+--  mangled_name,unmangled_function_name
+--
+-- This means that we can match just the function name by matching only
+-- after a comma.
 local WHITELIST = {
    -- The following functions call CEntryStub which is always present.
-   "MacroAssembler.*CallRuntime",
+   "MacroAssembler.*,CallRuntime",
    "CompileCallLoadPropertyWithInterceptor",
-   "CallIC.*GenerateMiss",
+   "CallIC.*,GenerateMiss",
 
    -- DirectCEntryStub is a special stub used on ARM.
    -- It is pinned and always present.
-   "DirectCEntryStub.*GenerateCall",
+   "DirectCEntryStub.*,GenerateCall",
 
    -- TODO GCMole currently is sensitive enough to understand that certain
    --      functions only cause GC and return Failure simulataneously.
    --      Callsites of such functions are safe as long as they are properly
    --      check return value and propagate the Failure to the caller.
    --      It should be possible to extend GCMole to understand this.
-   "Heap.*AllocateFunctionPrototype",
+   "Heap.*,TryEvacuateObject",
 
    -- Ignore all StateTag methods.
    "StateTag",
 
    -- Ignore printing of elements transition.
-   "PrintElementsTransition"
+   "PrintElementsTransition",
+
+   -- CodeCreateEvent receives AbstractCode (a raw ptr) as an argument.
+   "CodeCreateEvent",
 };
 
 local function AddCause(name, cause)
@@ -329,7 +340,7 @@ local function resolve(name)
       f = {}
       funcs[name] = f
 
-      if name:match "Collect.*Garbage" then
+      if name:match ",.*Collect.*Garbage" then
          gc[name] = true
          AddCause(name, "<GC>")
       end
@@ -443,8 +454,9 @@ local function CheckCorrectnessForArch(arch, for_test)
    log("** Searching for evaluation order problems%s for %s",
        FLAGS.dead_vars and " and dead variables" or "",
        arch)
-   local plugin_args
-   if FLAGS.dead_vars then plugin_args = { "--dead-vars" } end
+   local plugin_args = {}
+   if FLAGS.dead_vars then table.insert(plugin_args, "--dead-vars") end
+   if FLAGS.verbose_trace then table.insert(plugin_args, '--verbose') end
    InvokeClangPluginForEachFile(files,
                                 cfg:extend { plugin = "find-problems",
                                              plugin_args = plugin_args },
@@ -468,7 +480,8 @@ end
 local function TestRun()
    local errors, output = SafeCheckCorrectnessForArch('x64', true)
    if not errors then
-      log("** Test file should produce errors, but none were found.")
+      log("** Test file should produce errors, but none were found. Output:")
+      log(output)
       return false
    end
 
diff --git a/deps/v8/tools/gcmole/test-expectations.txt b/deps/v8/tools/gcmole/test-expectations.txt
index 36a026a12eb36e..82134743f6b80e 100644
--- a/deps/v8/tools/gcmole/test-expectations.txt
+++ b/deps/v8/tools/gcmole/test-expectations.txt
@@ -17,4 +17,7 @@ tools/gcmole/gcmole-test.cc:128:14: warning: Possible problem with evaluation or
 tools/gcmole/gcmole-test.cc:130:14: warning: Possible problem with evaluation order.
   so_handle->Method(*base->VirtualCauseGC(obj1, isolate));
              ^
-6 warnings generated.
+tools/gcmole/gcmole-test.cc:151:14: warning: Possible problem with evaluation order.
+  so_handle->Method(*SomeClass::StaticCauseGC(obj1, isolate));
+             ^
+7 warnings generated.
diff --git a/deps/v8/tools/gdbinit b/deps/v8/tools/gdbinit
index 53ead3e88195e7..f2d4a263cd2589 100644
--- a/deps/v8/tools/gdbinit
+++ b/deps/v8/tools/gdbinit
@@ -158,7 +158,7 @@ def dcheck_stop_handler(event):
   count = 0
   # limit stack scanning since they're usually shallow and otherwise stack
   # overflows can be very slow.
-  while frame is not None and count < 5:
+  while frame is not None and count < 7:
     count += 1
     if frame.name() == 'V8_Dcheck':
       frame_message = gdb.lookup_symbol('message', frame.block())[0]
diff --git a/deps/v8/tools/gen-postmortem-metadata.py b/deps/v8/tools/gen-postmortem-metadata.py
index 98ab941a415197..34000b05cd16e2 100644
--- a/deps/v8/tools/gen-postmortem-metadata.py
+++ b/deps/v8/tools/gen-postmortem-metadata.py
@@ -157,15 +157,15 @@
         'value': 'DICTIONARY_ELEMENTS' },
 
     { 'name': 'bit_field2_elements_kind_mask',
-        'value': 'Map::ElementsKindBits::kMask' },
+        'value': 'Map::Bits2::ElementsKindBits::kMask' },
     { 'name': 'bit_field2_elements_kind_shift',
-        'value': 'Map::ElementsKindBits::kShift' },
+        'value': 'Map::Bits2::ElementsKindBits::kShift' },
     { 'name': 'bit_field3_is_dictionary_map_shift',
-        'value': 'Map::IsDictionaryMapBit::kShift' },
+        'value': 'Map::Bits3::IsDictionaryMapBit::kShift' },
     { 'name': 'bit_field3_number_of_own_descriptors_mask',
-        'value': 'Map::NumberOfOwnDescriptorsBits::kMask' },
+        'value': 'Map::Bits3::NumberOfOwnDescriptorsBits::kMask' },
     { 'name': 'bit_field3_number_of_own_descriptors_shift',
-        'value': 'Map::NumberOfOwnDescriptorsBits::kShift' },
+        'value': 'Map::Bits3::NumberOfOwnDescriptorsBits::kShift' },
     { 'name': 'class_Map__instance_descriptors_offset',
         'value': 'Map::kInstanceDescriptorsOffset' },
 
@@ -176,9 +176,9 @@
     { 'name': 'off_fp_constant_pool',
         'value': 'StandardFrameConstants::kConstantPoolOffset' },
     { 'name': 'off_fp_function',
-        'value': 'JavaScriptFrameConstants::kFunctionOffset' },
+        'value': 'StandardFrameConstants::kFunctionOffset' },
     { 'name': 'off_fp_args',
-        'value': 'JavaScriptFrameConstants::kLastParameterOffset' },
+        'value': 'StandardFrameConstants::kFixedFrameSizeAboveFp' },
 
     { 'name': 'scopeinfo_idx_nparams',
         'value': 'ScopeInfo::kParameterCount' },
@@ -194,12 +194,8 @@
 
     { 'name': 'context_idx_scope_info',
         'value': 'Context::SCOPE_INFO_INDEX' },
-    { 'name': 'context_idx_native',
-        'value': 'Context::NATIVE_CONTEXT_INDEX' },
     { 'name': 'context_idx_prev',
         'value': 'Context::PREVIOUS_INDEX' },
-    { 'name': 'context_idx_ext',
-        'value': 'Context::EXTENSION_INDEX' },
     { 'name': 'context_min_slots',
         'value': 'Context::MIN_CONTEXT_SLOTS' },
     { 'name': 'native_context_embedder_data_offset',
@@ -230,15 +226,6 @@
 
     { 'name': 'class_SharedFunctionInfo__function_data__Object',
         'value': 'SharedFunctionInfo::kFunctionDataOffset' },
-
-    { 'name': 'class_ConsString__first_offset__int',
-        'value': 'ConsString::kFirstOffset' },
-    { 'name': 'class_ConsString__second_offset__int',
-        'value': 'ConsString::kSecondOffset' },
-    { 'name': 'class_SlicedString__offset_offset__int',
-        'value': 'SlicedString::kOffsetOffset' },
-    { 'name': 'class_ThinString__actual_offset__int',
-        'value': 'ThinString::kActualOffset' },
 ];
 
 #
@@ -276,7 +263,6 @@
     'ExternalString, resource, Object, kResourceOffset',
     'SeqOneByteString, chars, char, kHeaderSize',
     'SeqTwoByteString, chars, char, kHeaderSize',
-    'UncompiledData, inferred_name, String, kInferredNameOffset',
     'UncompiledData, start_position, int32_t, kStartPositionOffset',
     'UncompiledData, end_position, int32_t, kEndPositionOffset',
     'SharedFunctionInfo, raw_function_token_offset, int16_t, kFunctionTokenOffsetOffset',
@@ -288,6 +274,11 @@
     'Code, instruction_size, int, kInstructionSizeOffset',
     'String, length, int32_t, kLengthOffset',
     'DescriptorArray, header_size, uintptr_t, kHeaderSize',
+    'ConsString, first, String, kFirstOffset',
+    'ConsString, second, String, kSecondOffset',
+    'SlicedString, offset, SMI, kOffsetOffset',
+    'ThinString, actual, String, kActualOffset',
+    'Symbol, name, Object, kDescriptionOffset',
 ];
 
 #
diff --git a/deps/v8/tools/generate-runtime-call-stats.py b/deps/v8/tools/generate-runtime-call-stats.py
new file mode 100755
index 00000000000000..2f9ba17871eb95
--- /dev/null
+++ b/deps/v8/tools/generate-runtime-call-stats.py
@@ -0,0 +1,492 @@
+#!/usr/bin/python3
+# Copyright 2019 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Runs chromium/src/run_benchmark for a given story and extracts the generated
+# runtime call stats.
+
+import argparse
+import csv
+import json
+import os
+import pathlib
+import re
+import tabulate
+import shutil
+import statistics
+import subprocess
+import sys
+import tempfile
+import gzip
+
+from callstats_groups import RUNTIME_CALL_STATS_GROUPS
+
+
+def parse_args():
+  parser = argparse.ArgumentParser(
+      description="Run story and collect runtime call stats.")
+  parser.add_argument("story", metavar="story", nargs=1, help="story to run")
+  parser.add_argument(
+      "--group",
+      dest="group",
+      action="store_true",
+      help="group common stats together into buckets")
+  parser.add_argument(
+      "-r",
+      "--repeats",
+      dest="repeats",
+      metavar="N",
+      action="store",
+      type=int,
+      default=1,
+      help="number of times to run the story")
+  parser.add_argument(
+      "-v",
+      "--verbose",
+      dest="verbose",
+      action="store_true",
+      help="output benchmark runs to stdout")
+  parser.add_argument(
+      "--device",
+      dest="device",
+      action="store",
+      help="device to run the test on. Passed directly to run_benchmark")
+  parser.add_argument(
+      "-d",
+      "--dir",
+      dest="dir",
+      action="store",
+      help=("directory to look for already generated output in. This must "
+            "already exists and it won't re-run the benchmark"))
+  parser.add_argument(
+      "-f",
+      "--format",
+      dest="format",
+      action="store",
+      choices=["csv", "table"],
+      help="output as CSV")
+  parser.add_argument(
+      "-o",
+      "--output",
+      metavar="FILE",
+      dest="out_file",
+      action="store",
+      help="write table to FILE rather stdout")
+  parser.add_argument(
+      "--browser",
+      dest="browser",
+      metavar="BROWSER_TYPE",
+      action="store",
+      default="release",
+      help=("Passed directly to --browser option of run_benchmark. Ignored if "
+            "-executable is used"))
+  parser.add_argument(
+      "-e",
+      "--executable",
+      dest="executable",
+      metavar="EXECUTABLE",
+      action="store",
+      help=("path to executable to run. If not given it will pass '--browser "
+            "release' to run_benchmark"))
+  parser.add_argument(
+      "--chromium-dir",
+      dest="chromium_dir",
+      metavar="DIR",
+      action="store",
+      default=".",
+      help=("path to chromium directory. If not given, the script must be run "
+            "inside the chromium/src directory"))
+  parser.add_argument(
+      "--js-flags", dest="js_flags", action="store", help="flags to pass to v8")
+  parser.add_argument(
+      "--extra-browser-args",
+      dest="browser_args",
+      action="store",
+      help="flags to pass to chrome")
+  parser.add_argument(
+      "--benchmark",
+      dest="benchmark",
+      action="store",
+      default="v8.browsing_desktop",
+      help="benchmark to run")
+  parser.add_argument(
+      "--stdev",
+      dest="stdev",
+      action="store_true",
+      help="adds columns for the standard deviation")
+  parser.add_argument(
+      "--filter",
+      dest="filter",
+      action="append",
+      help="useable with --group to only show buckets specified by filter")
+  parser.add_argument(
+      "--retain",
+      dest="retain",
+      action="store",
+      default="json",
+      choices=["none", "json", "all"],
+      help=("controls artifacts to be retained after run. With none, all files "
+            "are deleted; only the json.gz file is retained for each run; and "
+            "all keep all files"))
+
+  return parser.parse_args()
+
+
+def process_trace(trace_file):
+  text_string = pathlib.Path(trace_file).read_text()
+  result = json.loads(text_string)
+
+  output = {}
+  result = result["traceEvents"]
+  for o in result:
+    o = o["args"]
+    if "runtime-call-stats" in o:
+      r = o["runtime-call-stats"]
+      for name in r:
+        count = r[name][0]
+        duration = r[name][1]
+        if name in output:
+          output[name]["count"] += count
+          output[name]["duration"] += duration
+        else:
+          output[name] = {"count": count, "duration": duration}
+
+  return output
+
+
+def run_benchmark(story,
+                  repeats=1,
+                  output_dir=".",
+                  verbose=False,
+                  js_flags=None,
+                  browser_args=None,
+                  chromium_dir=".",
+                  executable=None,
+                  benchmark="v8.browsing_desktop",
+                  device=None,
+                  browser="release"):
+
+  orig_chromium_dir = chromium_dir
+  xvfb = os.path.join(chromium_dir, "testing", "xvfb.py")
+  if not os.path.isfile(xvfb):
+    chromium_dir = os.path(chromium_dir, "src")
+    xvfb = os.path.join(chromium_dir, "testing", "xvfb.py")
+    if not os.path.isfile(xvfb):
+      print(("chromium_dir does not point to a valid chromium checkout: " +
+             orig_chromium_dir))
+      sys.exit(1)
+
+  command = [
+      xvfb,
+      os.path.join(chromium_dir, "tools", "perf", "run_benchmark"),
+      "run",
+      "--story",
+      story,
+      "--pageset-repeat",
+      str(repeats),
+      "--output-dir",
+      output_dir,
+      "--intermediate-dir",
+      os.path.join(output_dir, "artifacts"),
+      benchmark,
+  ]
+
+  if executable:
+    command += ["--browser-executable", executable]
+  else:
+    command += ["--browser", browser]
+
+  if device:
+    command += ["--device", device]
+  if browser_args:
+    command += ["--extra-browser-args", browser_args]
+  if js_flags:
+    command += ["--js-flags", js_flags]
+
+  if not benchmark.startswith("v8."):
+    # Most benchmarks by default don't collect runtime call stats so enable them
+    # manually.
+    categories = [
+        "v8",
+        "disabled-by-default-v8.runtime_stats",
+    ]
+
+    command += ["--extra-chrome-categories", ",".join(categories)]
+
+  print("Output directory: %s" % output_dir)
+  stdout = ""
+  print(f"Running: {' '.join(command)}\n")
+  proc = subprocess.Popen(
+      command,
+      stdout=subprocess.PIPE,
+      stderr=subprocess.PIPE,
+      universal_newlines=True)
+  proc.stderr.close()
+  status_matcher = re.compile(r"\[ +(\w+) +\]")
+  for line in iter(proc.stdout.readline, ""):
+    stdout += line
+    match = status_matcher.match(line)
+    if verbose or match:
+      print(line, end="")
+
+  proc.stdout.close()
+
+  if proc.wait() != 0:
+    print("\nrun_benchmark failed:")
+    # If verbose then everything has already been printed.
+    if not verbose:
+      print(stdout)
+    sys.exit(1)
+
+  print("\nrun_benchmark completed")
+
+
+def write_output(f, table, headers, run_count, format="table"):
+  if format == "csv":
+    # strip new lines from CSV output
+    headers = [h.replace("\n", " ") for h in headers]
+    writer = csv.writer(f)
+    writer.writerow(headers)
+    writer.writerows(table)
+  else:
+    # First column is name, and then they alternate between counts and durations
+    summary_count = len(headers) - 2 * run_count - 1
+    floatfmt = ("",) + (".0f", ".2f") * run_count + (".2f",) * summary_count
+    f.write(tabulate.tabulate(table, headers=headers, floatfmt=floatfmt))
+    f.write("\n")
+
+
+class Row:
+
+  def __init__(self, name, run_count):
+    self.name = name
+    self.durations = [0] * run_count
+    self.counts = [0] * run_count
+    self.mean_duration = None
+    self.mean_count = None
+    self.stdev_duration = None
+    self.stdev_count = None
+
+  def __repr__(self):
+    data_str = ", ".join(
+        str((c, d)) for (c, d) in zip(self.counts, self.durations))
+    return (f"{self.name}: {data_str}, mean_count: {self.mean_count}, " +
+            f"mean_duration: {self.mean_duration}")
+
+  def add_data(self, counts, durations):
+    self.counts = counts
+    self.durations = durations
+
+  def add_data_point(self, run, count, duration):
+    self.counts[run] = count
+    self.durations[run] = duration
+
+  def prepare(self, stdev=False):
+    if len(self.durations) > 1:
+      self.mean_duration = statistics.mean(self.durations)
+      self.mean_count = statistics.mean(self.counts)
+      if stdev:
+        self.stdev_duration = statistics.stdev(self.durations)
+        self.stdev_count = statistics.stdev(self.counts)
+
+  def as_list(self):
+    l = [self.name]
+    for (c, d) in zip(self.counts, self.durations):
+      l += [c, d]
+    if self.mean_duration is not None:
+      l += [self.mean_count]
+      if self.stdev_count is not None:
+        l += [self.stdev_count]
+      l += [self.mean_duration]
+      if self.stdev_duration is not None:
+        l += [self.stdev_duration]
+    return l
+
+  def key(self):
+    if self.mean_duration is not None:
+      return self.mean_duration
+    else:
+      return self.durations[0]
+
+
+class Bucket:
+
+  def __init__(self, name, run_count):
+    self.name = name
+    self.run_count = run_count
+    self.data = {}
+    self.table = None
+    self.total_row = None
+
+  def __repr__(self):
+    s = "Bucket: " + self.name + " {\n"
+    if self.table:
+      s += "\n  ".join(str(row) for row in self.table) + "\n"
+    elif self.data:
+      s += "\n  ".join(str(row) for row in self.data.values()) + "\n"
+    if self.total_row:
+      s += "  " + str(self.total_row) + "\n"
+    return s + "}"
+
+  def add_data_point(self, name, run, count, duration):
+    if name not in self.data:
+      self.data[name] = Row(name, self.run_count)
+
+    self.data[name].add_data_point(run, count, duration)
+
+  def prepare(self, stdev=False):
+    if self.data:
+      for row in self.data.values():
+        row.prepare(stdev)
+
+      self.table = sorted(self.data.values(), key=Row.key)
+      self.total_row = Row("Total", self.run_count)
+      self.total_row.add_data([
+          sum(r.counts[i]
+              for r in self.data.values())
+          for i in range(0, self.run_count)
+      ], [
+          sum(r.durations[i]
+              for r in self.data.values())
+          for i in range(0, self.run_count)
+      ])
+      self.total_row.prepare(stdev)
+
+  def as_list(self, add_bucket_titles=True, filter=None):
+    t = []
+    if filter is None or self.name in filter:
+      if add_bucket_titles:
+        t += [["\n"], [self.name]]
+      t += [r.as_list() for r in self.table]
+      t += [self.total_row.as_list()]
+    return t
+
+
+def collect_buckets(story, group=True, repeats=1, output_dir="."):
+  if group:
+    groups = RUNTIME_CALL_STATS_GROUPS
+  else:
+    groups = []
+
+  buckets = {}
+
+  for i in range(0, repeats):
+    story_dir = f"{story.replace(':', '_')}_{i + 1}"
+    trace_dir = os.path.join(output_dir, "artifacts", story_dir, "trace",
+                             "traceEvents")
+    trace_file = os.path.join(trace_dir, "results.json")
+
+    # this script always unzips the json file and stores the output in
+    # results.json so just re-use that if it already exists, otherwise unzip the
+    # one file found in the traceEvents directory.
+    if not os.path.isfile(trace_file):
+      trace_files = os.listdir(trace_dir)
+      if len(trace_files) != 1:
+        print("Expecting just one file but got: %s" % trace_files)
+        sys.exit(1)
+
+      gz_trace_file = os.path.join(trace_dir, trace_files[0])
+      trace_file = os.path.join(trace_dir, "results.json")
+
+      with gzip.open(gz_trace_file, "rb") as f_in:
+        with open(trace_file, "wb") as f_out:
+          shutil.copyfileobj(f_in, f_out)
+
+    output = process_trace(trace_file)
+    for name in output:
+      bucket_name = "Other"
+      for group in groups:
+        if group[1].match(name):
+          bucket_name = group[0]
+          break
+
+      value = output[name]
+      if bucket_name not in buckets:
+        bucket = Bucket(bucket_name, repeats)
+        buckets[bucket_name] = bucket
+      else:
+        bucket = buckets[bucket_name]
+
+      bucket.add_data_point(name, i, value["count"], value["duration"] / 1000.0)
+  return buckets
+
+
+def create_table(buckets, record_bucket_names=True, filter=None):
+  table = []
+  for bucket in buckets.values():
+    table += bucket.as_list(
+        add_bucket_titles=record_bucket_names, filter=filter)
+  return table
+
+
+def main():
+  args = parse_args()
+  story = args.story[0]
+
+  retain = args.retain
+  if args.dir is not None:
+    output_dir = args.dir
+    if not os.path.isdir(output_dir):
+      print("Specified output directory does not exist: " % output_dir)
+      sys.exit(1)
+  else:
+    output_dir = tempfile.mkdtemp(prefix="runtime_call_stats_")
+    run_benchmark(
+        story,
+        repeats=args.repeats,
+        output_dir=output_dir,
+        verbose=args.verbose,
+        js_flags=args.js_flags,
+        browser_args=args.browser_args,
+        chromium_dir=args.chromium_dir,
+        benchmark=args.benchmark,
+        executable=args.executable,
+        browser=args.browser,
+        device=args.device)
+
+  try:
+    buckets = collect_buckets(
+        story, group=args.group, repeats=args.repeats, output_dir=output_dir)
+
+    for b in buckets.values():
+      b.prepare(args.stdev)
+
+    table = create_table(
+        buckets, record_bucket_names=args.group, filter=args.filter)
+
+    headers = [""] + ["Count", "Duration\n(ms)"] * args.repeats
+    if args.repeats > 1:
+      if args.stdev:
+        headers += [
+            "Count\nMean", "Count\nStdev", "Duration\nMean (ms)",
+            "Duration\nStdev (ms)"
+        ]
+      else:
+        headers += ["Count\nMean", "Duration\nMean (ms)"]
+
+    if args.out_file:
+      with open(args.out_file, "w", newline="") as f:
+        write_output(f, table, headers, args.repeats, args.format)
+    else:
+      write_output(sys.stdout, table, headers, args.repeats, args.format)
+  finally:
+    if retain == "none":
+      shutil.rmtree(output_dir)
+    elif retain == "json":
+      # Delete all files bottom up except .json.gz files and attempt to delete
+      # subdirectories (ignoring errors).
+      for dir_name, subdir_list, file_list in os.walk(
+          output_dir, topdown=False):
+        for file_name in file_list:
+          if not file_name.endswith(".json.gz"):
+            os.remove(os.path.join(dir_name, file_name))
+        for subdir in subdir_list:
+          try:
+            os.rmdir(os.path.join(dir_name, subdir))
+          except OSError:
+            pass
+
+
+if __name__ == "__main__":
+  sys.exit(main())
diff --git a/deps/v8/tools/grokdump.py b/deps/v8/tools/grokdump.py
index 773622de76f388..1edfd353b59a3a 100755
--- a/deps/v8/tools/grokdump.py
+++ b/deps/v8/tools/grokdump.py
@@ -616,8 +616,12 @@ class MinidumpReader(object):
 
   def __init__(self, options, minidump_name):
     self.minidump_name = minidump_name
-    self.minidump_file = open(minidump_name, "r")
-    self.minidump = mmap.mmap(self.minidump_file.fileno(), 0, mmap.MAP_PRIVATE)
+    if sys.platform == 'win32':
+      self.minidump_file = open(minidump_name, "a+")
+      self.minidump = mmap.mmap(self.minidump_file.fileno(), 0)
+    else:
+      self.minidump_file = open(minidump_name, "r")
+      self.minidump = mmap.mmap(self.minidump_file.fileno(), 0, mmap.MAP_PRIVATE)
     self.header = MINIDUMP_HEADER.Read(self.minidump, 0)
     if self.header.signature != MinidumpReader._HEADER_MAGIC:
       print("Warning: Unsupported minidump header magic!", file=sys.stderr)
diff --git a/deps/v8/tools/heap-stats/categories.js b/deps/v8/tools/heap-stats/categories.js
index 0e876624881682..765d8f3a31f7e8 100644
--- a/deps/v8/tools/heap-stats/categories.js
+++ b/deps/v8/tools/heap-stats/categories.js
@@ -52,6 +52,7 @@ const CATEGORIES = new Map([
       'JS_GLOBAL_PROXY_TYPE',
       'JS_COLLATOR_TYPE',
       'JS_DATE_TIME_FORMAT_TYPE',
+      'JS_DISPLAY_NAMES_TYPE',
       'JS_LIST_FORMAT_TYPE',
       'JS_LOCALE_TYPE',
       'JS_NUMBER_FORMAT_TYPE',
diff --git a/deps/v8/tools/js2c.py b/deps/v8/tools/js2c.py
deleted file mode 100755
index 43a876e236edbf..00000000000000
--- a/deps/v8/tools/js2c.py
+++ /dev/null
@@ -1,369 +0,0 @@
-#!/usr/bin/env python
-#
-# Copyright 2012 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-# This is a utility for converting JavaScript source code into C-style
-# char arrays. It is used for embedded JavaScript code in the V8
-# library.
-
-# for py2/py3 compatibility
-from functools import reduce
-
-import os, re
-import optparse
-import textwrap
-
-
-class Error(Exception):
-  def __init__(self, msg):
-    Exception.__init__(self, msg)
-
-
-def ToCArray(byte_sequence):
-  result = []
-  for chr in byte_sequence:
-    result.append(str(ord(chr)))
-  joined = ", ".join(result)
-  return textwrap.fill(joined, 80)
-
-
-def RemoveCommentsEmptyLinesAndWhitespace(lines):
-  lines = re.sub(r'\n+', '\n', lines) # empty lines
-  lines = re.sub(r'//.*\n', '\n', lines) # end-of-line comments
-  lines = re.sub(re.compile(r'/\*.*?\*/', re.DOTALL), '', lines) # comments.
-  lines = re.sub(r'\s+\n', '\n', lines) # trailing whitespace
-  lines = re.sub(r'\n\s+', '\n', lines) # initial whitespace
-  return lines
-
-
-def ReadFile(filename):
-  file = open(filename, "rt")
-  try:
-    lines = file.read()
-  finally:
-    file.close()
-  return lines
-
-
-EVAL_PATTERN = re.compile(r'\beval\s*\(')
-WITH_PATTERN = re.compile(r'\bwith\s*\(')
-INVALID_ERROR_MESSAGE_PATTERN = re.compile(
-    r'Make(?!Generic)\w*Error\(([kA-Z]\w+)')
-NEW_ERROR_PATTERN = re.compile(r'new \$\w*Error\((?!\))')
-
-def Validate(lines):
-  # Because of simplified context setup, eval and with is not
-  # allowed in the natives files.
-  if EVAL_PATTERN.search(lines):
-    raise Error("Eval disallowed in natives.")
-  if WITH_PATTERN.search(lines):
-    raise Error("With statements disallowed in natives.")
-  invalid_error = INVALID_ERROR_MESSAGE_PATTERN.search(lines)
-  if invalid_error:
-    raise Error("Unknown error message template '%s'" % invalid_error.group(1))
-  if NEW_ERROR_PATTERN.search(lines):
-    raise Error("Error constructed without message template.")
-  # Pass lines through unchanged.
-  return lines
-
-
-def ExpandConstants(lines, constants):
-  for key, value in constants:
-    lines = key.sub(str(value), lines)
-  return lines
-
-
-HEADER_TEMPLATE = """\
-// Copyright 2011 Google Inc. All Rights Reserved.
-
-// This file was generated from .js source files by GYP.  If you
-// want to make changes to this file you should either change the
-// javascript source files or the GYP script.
-
-#include "src/init/v8.h"
-#include "src/snapshot/natives.h"
-#include "src/utils/utils.h"
-
-namespace v8 {
-namespace internal {
-
-%(sources_declaration)s\
-
-  template <>
-  int NativesCollection<%(type)s>::GetBuiltinsCount() {
-    return %(builtin_count)i;
-  }
-
-  template <>
-  int NativesCollection<%(type)s>::GetIndex(const char* name) {
-%(get_index_cases)s\
-    return -1;
-  }
-
-  template <>
-  Vector<const char> NativesCollection<%(type)s>::GetScriptSource(int index) {
-%(get_script_source_cases)s\
-    return Vector<const char>("", 0);
-  }
-
-  template <>
-  Vector<const char> NativesCollection<%(type)s>::GetScriptName(int index) {
-%(get_script_name_cases)s\
-    return Vector<const char>("", 0);
-  }
-
-  template <>
-  Vector<const char> NativesCollection<%(type)s>::GetScriptsSource() {
-    return Vector<const char>(sources, %(total_length)i);
-  }
-}  // internal
-}  // v8
-"""
-
-SOURCES_DECLARATION = """\
-  static const char sources[] = { %s };
-"""
-
-
-GET_INDEX_CASE = """\
-    if (strcmp(name, "%(id)s") == 0) return %(i)i;
-"""
-
-
-GET_SCRIPT_SOURCE_CASE = """\
-    if (index == %(i)i) return Vector<const char>(sources + %(offset)i, %(source_length)i);
-"""
-
-
-GET_SCRIPT_NAME_CASE = """\
-    if (index == %(i)i) return Vector<const char>("%(name)s", %(length)i);
-"""
-
-
-def BuildFilterChain():
-  """Build the chain of filter functions to be applied to the sources.
-
-  Returns:
-    A function (string -> string) that processes a source file.
-  """
-  filter_chain = [
-    RemoveCommentsEmptyLinesAndWhitespace,
-    Validate,
-  ]
-
-  def chain(f1, f2):
-    return lambda x: f2(f1(x))
-
-  return reduce(chain, filter_chain)
-
-def BuildExtraFilterChain():
-  return lambda x: RemoveCommentsEmptyLinesAndWhitespace(Validate(x))
-
-class Sources:
-  def __init__(self):
-    self.names = []
-    self.modules = []
-
-def PrepareSources(source_files, native_type, emit_js):
-  """Read, prepare and assemble the list of source files.
-
-  Args:
-    source_files: List of JavaScript-ish source files.
-    native_type: String corresponding to a NativeType enum value, allowing us
-        to treat different types of sources differently.
-    emit_js: True if we should skip the byte conversion and just leave the
-        sources as JS strings.
-
-  Returns:
-    An instance of Sources.
-  """
-  result = Sources()
-  filters = BuildFilterChain()
-
-  source_files_and_contents = [(f, ReadFile(f)) for f in source_files]
-
-  for (source, contents) in source_files_and_contents:
-    try:
-      lines = filters(contents)
-    except Error as e:
-      raise Error("In file %s:\n%s" % (source, str(e)))
-
-    result.modules.append(lines)
-
-    name = os.path.basename(source)[:-3]
-    result.names.append(name)
-
-  return result
-
-
-def BuildMetadata(sources, source_bytes, native_type):
-  """Build the meta data required to generate a libaries file.
-
-  Args:
-    sources: A Sources instance with the prepared sources.
-    source_bytes: A list of source bytes.
-        (The concatenation of all sources; might be compressed.)
-    native_type: The parameter for the NativesCollection template.
-
-  Returns:
-    A dictionary for use with HEADER_TEMPLATE.
-  """
-  total_length = len(source_bytes)
-  raw_sources = "".join(sources.modules)
-
-  # The sources are expected to be ASCII-only.
-  try:
-    raw_sources.encode('ascii')
-  except UnicodeEncodeError:
-    assert False
-
-  # Loop over modules and build up indices into the source blob:
-  get_index_cases = []
-  get_script_name_cases = []
-  get_script_source_cases = []
-  offset = 0
-  for i in range(len(sources.modules)):
-    native_name = "native %s.js" % sources.names[i]
-    d = {
-        "i": i,
-        "id": sources.names[i],
-        "name": native_name,
-        "length": len(native_name),
-        "offset": offset,
-        "source_length": len(sources.modules[i]),
-    }
-    get_index_cases.append(GET_INDEX_CASE % d)
-    get_script_name_cases.append(GET_SCRIPT_NAME_CASE % d)
-    get_script_source_cases.append(GET_SCRIPT_SOURCE_CASE % d)
-    offset += len(sources.modules[i])
-  assert offset == len(raw_sources)
-
-  metadata = {
-    "builtin_count": len(sources.modules),
-    "sources_declaration":
-        SOURCES_DECLARATION % ToCArray(
-          source_bytes if len(source_bytes) != 0 else "\0"),
-    "total_length": total_length,
-    "get_index_cases": "".join(get_index_cases),
-    "get_script_source_cases": "".join(get_script_source_cases),
-    "get_script_name_cases": "".join(get_script_name_cases),
-    "type": native_type,
-  }
-  return metadata
-
-
-def PutInt(blob_file, value):
-  assert(value >= 0 and value < (1 << 28))
-  if (value < 1 << 6):
-    size = 1
-  elif (value < 1 << 14):
-    size = 2
-  elif (value < 1 << 22):
-    size = 3
-  else:
-    size = 4
-  value_with_length = (value << 2) | (size - 1)
-
-  byte_sequence = bytearray()
-  for i in range(size):
-    byte_sequence.append(value_with_length & 255)
-    value_with_length >>= 8;
-  blob_file.write(byte_sequence)
-
-
-def PutStr(blob_file, value):
-  PutInt(blob_file, len(value.encode()))
-  blob_file.write(value.encode())
-
-
-def WriteStartupBlob(sources, startup_blob):
-  """Write a startup blob, as expected by V8 Initialize ...
-    TODO(vogelheim): Add proper method name.
-
-  Args:
-    sources: A Sources instance with the prepared sources.
-    startup_blob_file: Name of file to write the blob to.
-  """
-  output = open(startup_blob, "wb")
-
-  PutInt(output, len(sources.names))
-  for i in range(len(sources.names)):
-    PutStr(output, sources.names[i]);
-    PutStr(output, sources.modules[i]);
-
-  output.close()
-
-
-def JS2C(sources, target, native_type, raw_file, startup_blob, emit_js):
-  prepared_sources = PrepareSources(sources, native_type, emit_js)
-  sources_output = "".join(prepared_sources.modules)
-  metadata = BuildMetadata(prepared_sources, sources_output, native_type)
-
-  # Optionally emit raw file.
-  if raw_file:
-    output = open(raw_file, "w")
-    output.write(sources_output)
-    output.close()
-
-  if startup_blob:
-    WriteStartupBlob(prepared_sources, startup_blob)
-
-  # Emit resulting source file.
-  output = open(target, "w")
-  if emit_js:
-    output.write(sources_output)
-  else:
-    output.write(HEADER_TEMPLATE % metadata)
-  output.close()
-
-
-def main():
-  parser = optparse.OptionParser()
-  parser.add_option("--raw",
-                    help="file to write the processed sources array to.")
-  parser.add_option("--startup_blob",
-                    help="file to write the startup blob to.")
-  parser.add_option("--js",
-                    help="writes a JS file output instead of a C file",
-                    action="store_true", default=False, dest='js')
-  parser.add_option("--nojs", action="store_false", default=False, dest='js')
-  parser.set_usage("""js2c out.cc type sources.js ...
-        out.cc: C code to be generated.
-        type: type parameter for NativesCollection template.
-        sources.js: JS internal sources.""")
-  (options, args) = parser.parse_args()
-  JS2C(args[2:],
-       args[0],
-       args[1],
-       options.raw,
-       options.startup_blob,
-       options.js)
-
-
-if __name__ == "__main__":
-  main()
diff --git a/deps/v8/tools/mb/mb.py b/deps/v8/tools/mb/mb.py
index f66f82a8f38128..cd638bda274446 100755
--- a/deps/v8/tools/mb/mb.py
+++ b/deps/v8/tools/mb/mb.py
@@ -726,7 +726,6 @@ def RunGNGen(self, vals, compute_grit_inputs_for_analyze=False):
         return ret
 
     android = 'target_os="android"' in vals['gn_args']
-    fuchsia = 'target_os="fuchsia"' in vals['gn_args']
     for target in swarming_targets:
       if android:
         # Android targets may be either android_apk or executable. The former
@@ -736,11 +735,6 @@ def RunGNGen(self, vals, compute_grit_inputs_for_analyze=False):
         runtime_deps_targets = [
             target + '.runtime_deps',
             'obj/%s.stamp.runtime_deps' % label.replace(':', '/')]
-      elif fuchsia:
-        # Only emit a runtime deps file for the group() target on Fuchsia.
-        label = isolate_map[target]['label']
-        runtime_deps_targets = [
-          'obj/%s.stamp.runtime_deps' % label.replace(':', '/')]
       elif (isolate_map[target]['type'] == 'script' or
             isolate_map[target].get('label_type') == 'group'):
         # For script targets, the build target is usually a group,
diff --git a/deps/v8/tools/predictable_wrapper.py b/deps/v8/tools/predictable_wrapper.py
index 31b62c89d61737..bbb707f9019ab2 100644
--- a/deps/v8/tools/predictable_wrapper.py
+++ b/deps/v8/tools/predictable_wrapper.py
@@ -37,7 +37,8 @@ def allocation_str(stdout):
         return line
     return None
 
-  cmd = command.Command(args[0], args[1:], timeout=TIMEOUT)
+  cmd = command.Command(
+      args[0], args[1:], timeout=TIMEOUT, handle_sigterm=True)
 
   previous_allocations = None
   for run in range(1, MAX_TRIES + 1):
diff --git a/deps/v8/tools/regexp-sequences.py b/deps/v8/tools/regexp-sequences.py
index 56e83679a912aa..9f920dd0f02886 100755
--- a/deps/v8/tools/regexp-sequences.py
+++ b/deps/v8/tools/regexp-sequences.py
@@ -24,7 +24,7 @@ def parse(file, seqlen):
                   r'(:?\.|\()(?P<char>\.|\w)(:?\.|\)), bc = (?P<bc>\w+), .*')
   total = 0
   bc_cnt = [None] * seqlen
-  for i in xrange(seqlen):
+  for i in range(seqlen):
     bc_cnt[i] = {}
   last = [None] * seqlen
   with open(file) as f:
@@ -32,14 +32,14 @@ def parse(file, seqlen):
     while l:
       l = l.strip()
       if l.startswith("Start bytecode interpreter"):
-        for i in xrange(seqlen):
+        for i in range(seqlen):
           last[i] = collections.deque(maxlen=i+1)
 
       match = rx.search(l)
       if match:
         total += 1
         bc = match.group('bc')
-        for i in xrange(seqlen):
+        for i in range(seqlen):
           last[i].append(bc)
           key = ' --> '.join(last[i])
           bc_cnt[i][key] = bc_cnt[i].get(key,0) + 1
@@ -57,7 +57,7 @@ def print_most_common(d, seqlen, total):
 def main(argv):
   max_seq = 7
   bc_cnt, total = parse(argv[1],max_seq)
-  for i in xrange(max_seq):
+  for i in range(max_seq):
     print()
     print("Most common of length {}".format(i+1))
     print()
diff --git a/deps/v8/tools/release/common_includes.py b/deps/v8/tools/release/common_includes.py
index af4709bfeaa4c7..dbb3ba5f24b6eb 100644
--- a/deps/v8/tools/release/common_includes.py
+++ b/deps/v8/tools/release/common_includes.py
@@ -48,7 +48,6 @@
 from git_recipes import GitRecipesMixin
 from git_recipes import GitFailedException
 
-CHANGELOG_FILE = "ChangeLog"
 DAY_IN_SECONDS = 24 * 60 * 60
 PUSH_MSG_GIT_RE = re.compile(r".* \(based on (?P<git_rev>[a-fA-F0-9]+)\)$")
 PUSH_MSG_NEW_RE = re.compile(r"^Version \d+\.\d+\.\d+$")
@@ -93,99 +92,6 @@ def MSub(rexp, replacement, text):
   return re.sub(rexp, replacement, text, flags=re.MULTILINE)
 
 
-def Fill80(line):
-  # Replace tabs and remove surrounding space.
-  line = re.sub(r"\t", r"        ", line.strip())
-
-  # Format with 8 characters indentation and line width 80.
-  return textwrap.fill(line, width=80, initial_indent="        ",
-                       subsequent_indent="        ")
-
-
-def MakeComment(text):
-  return MSub(r"^( ?)", "#", text)
-
-
-def StripComments(text):
-  # Use split not splitlines to keep terminal newlines.
-  return "\n".join(filter(lambda x: not x.startswith("#"), text.split("\n")))
-
-
-def MakeChangeLogBody(commit_messages, auto_format=False):
-  result = ""
-  added_titles = set()
-  for (title, body, author) in commit_messages:
-    # TODO(machenbach): Better check for reverts. A revert should remove the
-    # original CL from the actual log entry.
-    title = title.strip()
-    if auto_format:
-      # Only add commits that set the LOG flag correctly.
-      log_exp = r"^[ \t]*LOG[ \t]*=[ \t]*(?:(?:Y(?:ES)?)|TRUE)"
-      if not re.search(log_exp, body, flags=re.I | re.M):
-        continue
-      # Never include reverts.
-      if title.startswith("Revert "):
-        continue
-      # Don't include duplicates.
-      if title in added_titles:
-        continue
-
-    # Add and format the commit's title and bug reference. Move dot to the end.
-    added_titles.add(title)
-    raw_title = re.sub(r"(\.|\?|!)$", "", title)
-    bug_reference = MakeChangeLogBugReference(body)
-    space = " " if bug_reference else ""
-    result += "%s\n" % Fill80("%s%s%s." % (raw_title, space, bug_reference))
-
-    # Append the commit's author for reference if not in auto-format mode.
-    if not auto_format:
-      result += "%s\n" % Fill80("(%s)" % author.strip())
-
-    result += "\n"
-  return result
-
-
-def MakeChangeLogBugReference(body):
-  """Grep for "BUG=xxxx" lines in the commit message and convert them to
-  "(issue xxxx)".
-  """
-  crbugs = []
-  v8bugs = []
-
-  def AddIssues(text):
-    ref = re.match(r"^BUG[ \t]*=[ \t]*(.+)$", text.strip())
-    if not ref:
-      return
-    for bug in ref.group(1).split(","):
-      bug = bug.strip()
-      match = re.match(r"^v8:(\d+)$", bug)
-      if match: v8bugs.append(int(match.group(1)))
-      else:
-        match = re.match(r"^(?:chromium:)?(\d+)$", bug)
-        if match: crbugs.append(int(match.group(1)))
-
-  # Add issues to crbugs and v8bugs.
-  map(AddIssues, body.splitlines())
-
-  # Filter duplicates, sort, stringify.
-  crbugs = map(str, sorted(set(crbugs)))
-  v8bugs = map(str, sorted(set(v8bugs)))
-
-  bug_groups = []
-  def FormatIssues(prefix, bugs):
-    if len(bugs) > 0:
-      plural = "s" if len(bugs) > 1 else ""
-      bug_groups.append("%sissue%s %s" % (prefix, plural, ", ".join(bugs)))
-
-  FormatIssues("", v8bugs)
-  FormatIssues("Chromium ", crbugs)
-
-  if len(bug_groups) > 0:
-    return "(%s)" % ", ".join(bug_groups)
-  else:
-    return ""
-
-
 def SortingKey(version):
   """Key for sorting version number strings: '3.11' > '3.2.1.1'"""
   version_keys = map(int, version.split("."))
@@ -282,9 +188,6 @@ def ReadClusterFuzzAPI(self, api_key, **params):
   def Sleep(self, seconds):
     time.sleep(seconds)
 
-  def GetDate(self):
-    return datetime.date.today().strftime("%Y-%m-%d")
-
   def GetUTCStamp(self):
     return time.mktime(datetime.datetime.utcnow().timetuple())
 
@@ -527,9 +430,6 @@ def ReadURL(self, url, params=None, retry_on=None, wait_plan=None):
     cmd = lambda: self._side_effect_handler.ReadURL(url, params)
     return self.Retry(cmd, retry_on, wait_plan)
 
-  def GetDate(self):
-    return self._side_effect_handler.GetDate()
-
   def Die(self, msg=""):
     if msg != "":
       print("Error: %s" % msg)
diff --git a/deps/v8/tools/release/create_release.py b/deps/v8/tools/release/create_release.py
index cbf07f448ae152..c323542525b2ac 100755
--- a/deps/v8/tools/release/create_release.py
+++ b/deps/v8/tools/release/create_release.py
@@ -77,62 +77,19 @@ def RunStep(self):
     self["last_push_master"] = self.GetLatestReleaseBase()
 
 
-class PrepareChangeLog(Step):
-  MESSAGE = "Prepare raw ChangeLog entry."
+class DeleteBranchRef(Step):
+  MESSAGE = "Delete branch ref."
 
   def RunStep(self):
-    self["date"] = self.GetDate()
-    output = "%s: Version %s\n\n" % (self["date"], self["version"])
-    TextToFile(output, self.Config("CHANGELOG_ENTRY_FILE"))
-    commits = self.GitLog(format="%H",
-        git_hash="%s..%s" % (self["last_push_master"],
-                             self["push_hash"]))
-
-    # Cache raw commit messages.
-    commit_messages = [
-      [
-        self.GitLog(n=1, format="%s", git_hash=commit),
-        self.GitLog(n=1, format="%B", git_hash=commit),
-        self.GitLog(n=1, format="%an", git_hash=commit),
-      ] for commit in commits.splitlines()
-    ]
-
-    # Auto-format commit messages.
-    body = MakeChangeLogBody(commit_messages, auto_format=True)
-    AppendToFile(body, self.Config("CHANGELOG_ENTRY_FILE"))
-
-    msg = ("        Performance and stability improvements on all platforms."
-           "\n#\n# The change log above is auto-generated. Please review if "
-           "all relevant\n# commit messages from the list below are included."
-           "\n# All lines starting with # will be stripped.\n#\n")
-    AppendToFile(msg, self.Config("CHANGELOG_ENTRY_FILE"))
-
-    # Include unformatted commit messages as a reference in a comment.
-    comment_body = MakeComment(MakeChangeLogBody(commit_messages))
-    AppendToFile(comment_body, self.Config("CHANGELOG_ENTRY_FILE"))
-
-
-class EditChangeLog(Step):
-  MESSAGE = "Edit ChangeLog entry."
-
-  def RunStep(self):
-    print ("Please press <Return> to have your EDITOR open the ChangeLog "
-           "entry, then edit its contents to your liking. When you're done, "
-           "save the file and exit your EDITOR. ")
-    self.ReadLine(default="")
-    self.Editor(self.Config("CHANGELOG_ENTRY_FILE"))
-
-    # Strip comments and reformat with correct indentation.
-    changelog_entry = FileToText(self.Config("CHANGELOG_ENTRY_FILE")).rstrip()
-    changelog_entry = StripComments(changelog_entry)
-    changelog_entry = "\n".join(map(Fill80, changelog_entry.splitlines()))
-    changelog_entry = changelog_entry.lstrip()
-
-    if changelog_entry == "":  # pragma: no cover
-      self.Die("Empty ChangeLog entry.")
-
-    # Safe new change log for adding it later to the candidates patch.
-    TextToFile(changelog_entry, self.Config("CHANGELOG_ENTRY_FILE"))
+    cmd = "push origin :refs/heads/%s" % self["version"]
+    if self._options.dry_run:
+      print("Dry run. Command:\ngit %s" % cmd)
+    else:
+      try:
+        self.Git(cmd)
+      except Exception:
+        # Be forgiving if branch ref does not exist.
+        pass
 
 
 class PushBranchRef(Step):
@@ -152,19 +109,7 @@ class MakeBranch(Step):
   def RunStep(self):
     self.Git("reset --hard origin/master")
     self.Git("new-branch work-branch --upstream origin/%s" % self["version"])
-    self.GitCheckoutFile(CHANGELOG_FILE, self["latest_version"])
     self.GitCheckoutFile(VERSION_FILE, self["latest_version"])
-    self.GitCheckoutFile(WATCHLISTS_FILE, self["latest_version"])
-
-
-class AddChangeLog(Step):
-  MESSAGE = "Add ChangeLog changes to release branch."
-
-  def RunStep(self):
-    changelog_entry = FileToText(self.Config("CHANGELOG_ENTRY_FILE"))
-    old_change_log = FileToText(os.path.join(self.default_cwd, CHANGELOG_FILE))
-    new_change_log = "%s\n\n\n%s" % (changelog_entry, old_change_log)
-    TextToFile(new_change_log, os.path.join(self.default_cwd, CHANGELOG_FILE))
 
 
 class SetVersion(Step):
@@ -188,30 +133,14 @@ def RunStep(self):
 
 
 class CommitBranch(Step):
-  MESSAGE = "Commit version and changelog to new branch."
+  MESSAGE = "Commit version to new branch."
 
   def RunStep(self):
-    # Convert the ChangeLog entry to commit message format.
-    text = FileToText(self.Config("CHANGELOG_ENTRY_FILE"))
-
-    # Remove date and trailing white space.
-    text = re.sub(r"^%s: " % self["date"], "", text.rstrip())
-
-    # Remove indentation and merge paragraphs into single long lines, keeping
-    # empty lines between them.
-    def SplitMapJoin(split_text, fun, join_text):
-      return lambda text: join_text.join(map(fun, text.split(split_text)))
-    text = SplitMapJoin(
-        "\n\n", SplitMapJoin("\n", str.strip, " "), "\n\n")(text)
-
-    if not text:  # pragma: no cover
-      self.Die("Commit message editing failed.")
-    text += "\n\nTBR=%s" % self._options.reviewer
-    self["commit_title"] = text.splitlines()[0]
+    self["commit_title"] = "Version %s" % self["version"]
+    text = "%s\n\nTBR=%s" % (self["commit_title"], self._options.reviewer)
     TextToFile(text, self.Config("COMMITMSG_FILE"))
 
     self.GitCommit(file_name=self.Config("COMMITMSG_FILE"))
-    os.remove(self.Config("CHANGELOG_ENTRY_FILE"))
 
 
 class LandBranch(Step):
@@ -280,8 +209,6 @@ def _ProcessOptions(self, options):  # pragma: no cover
   def _Config(self):
     return {
       "PERSISTFILE_BASENAME": "/tmp/create-releases-tempfile",
-      "CHANGELOG_ENTRY_FILE":
-          "/tmp/v8-create-releases-tempfile-changelog-entry",
       "COMMITMSG_FILE": "/tmp/v8-create-releases-tempfile-commitmsg",
     }
 
@@ -291,11 +218,9 @@ def _Steps(self):
       PrepareBranchRevision,
       IncrementVersion,
       DetectLastRelease,
-      PrepareChangeLog,
-      EditChangeLog,
+      DeleteBranchRef,
       PushBranchRef,
       MakeBranch,
-      AddChangeLog,
       SetVersion,
       EnableMergeWatchlist,
       CommitBranch,
diff --git a/deps/v8/tools/release/filter_build_files.py b/deps/v8/tools/release/filter_build_files.py
index 1afabe8262cd3c..65312b4b85f97e 100755
--- a/deps/v8/tools/release/filter_build_files.py
+++ b/deps/v8/tools/release/filter_build_files.py
@@ -32,7 +32,6 @@
 
 SUPPLEMENTARY_FILES = [
   'icudtl.dat',
-  'natives_blob.bin',
   'snapshot_blob.bin',
   'v8_build_config.json',
 ]
diff --git a/deps/v8/tools/release/merge_to_branch.py b/deps/v8/tools/release/merge_to_branch.py
index 64f2a1981d8db1..ab6967208f9415 100755
--- a/deps/v8/tools/release/merge_to_branch.py
+++ b/deps/v8/tools/release/merge_to_branch.py
@@ -145,7 +145,7 @@ def RunStep(self):
     if bug_aggregate:
       # TODO(machenbach): Use proper gerrit footer for bug after switch to
       # gerrit. Keep BUG= for now for backwards-compatibility.
-      msg_pieces.append("BUG=%s\nLOG=N\n" % bug_aggregate)
+      msg_pieces.append("BUG=%s\n" % bug_aggregate)
 
     msg_pieces.append("NOTRY=true\nNOPRESUBMIT=true\nNOTREECHECKS=true\n")
 
diff --git a/deps/v8/tools/release/push_to_candidates.py b/deps/v8/tools/release/push_to_candidates.py
deleted file mode 100755
index c7068962239208..00000000000000
--- a/deps/v8/tools/release/push_to_candidates.py
+++ /dev/null
@@ -1,400 +0,0 @@
-#!/usr/bin/env python
-# Copyright 2013 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-# for py2/py3 compatibility
-from __future__ import print_function
-
-import argparse
-import os
-import sys
-import tempfile
-import urllib2
-
-from common_includes import *
-
-PUSH_MSG_GIT_SUFFIX = " (based on %s)"
-
-
-class Preparation(Step):
-  MESSAGE = "Preparation."
-
-  def RunStep(self):
-    self.InitialEnvironmentChecks(self.default_cwd)
-    self.CommonPrepare()
-
-    if(self["current_branch"] == self.Config("CANDIDATESBRANCH")
-       or self["current_branch"] == self.Config("BRANCHNAME")):
-      print("Warning: Script started on branch %s" % self["current_branch"])
-
-    self.PrepareBranch()
-    self.DeleteBranch(self.Config("CANDIDATESBRANCH"))
-
-
-class FreshBranch(Step):
-  MESSAGE = "Create a fresh branch."
-
-  def RunStep(self):
-    self.GitCreateBranch(self.Config("BRANCHNAME"),
-                         self.vc.RemoteMasterBranch())
-
-
-class PreparePushRevision(Step):
-  MESSAGE = "Check which revision to push."
-
-  def RunStep(self):
-    if self._options.revision:
-      self["push_hash"] = self._options.revision
-    else:
-      self["push_hash"] = self.GitLog(n=1, format="%H", git_hash="HEAD")
-    if not self["push_hash"]:  # pragma: no cover
-      self.Die("Could not determine the git hash for the push.")
-
-
-class IncrementVersion(Step):
-  MESSAGE = "Increment version number."
-
-  def RunStep(self):
-    latest_version = self.GetLatestVersion()
-
-    # The version file on master can be used to bump up major/minor at
-    # branch time.
-    self.GitCheckoutFile(VERSION_FILE, self.vc.RemoteMasterBranch())
-    self.ReadAndPersistVersion("master_")
-    master_version = self.ArrayToVersion("master_")
-
-    # Use the highest version from master or from tags to determine the new
-    # version.
-    authoritative_version = sorted(
-        [master_version, latest_version], key=SortingKey)[1]
-    self.StoreVersion(authoritative_version, "authoritative_")
-
-    # Variables prefixed with 'new_' contain the new version numbers for the
-    # ongoing candidates push.
-    self["new_major"] = self["authoritative_major"]
-    self["new_minor"] = self["authoritative_minor"]
-    self["new_build"] = str(int(self["authoritative_build"]) + 1)
-
-    # Make sure patch level is 0 in a new push.
-    self["new_patch"] = "0"
-
-    self["version"] = "%s.%s.%s" % (self["new_major"],
-                                    self["new_minor"],
-                                    self["new_build"])
-
-    print ("Incremented version to %s" % self["version"])
-
-
-class DetectLastRelease(Step):
-  MESSAGE = "Detect commit ID of last release base."
-
-  def RunStep(self):
-    if self._options.last_master:
-      self["last_push_master"] = self._options.last_master
-    else:
-      self["last_push_master"] = self.GetLatestReleaseBase()
-
-
-class PrepareChangeLog(Step):
-  MESSAGE = "Prepare raw ChangeLog entry."
-
-  def RunStep(self):
-    self["date"] = self.GetDate()
-    output = "%s: Version %s\n\n" % (self["date"], self["version"])
-    TextToFile(output, self.Config("CHANGELOG_ENTRY_FILE"))
-    commits = self.GitLog(format="%H",
-        git_hash="%s..%s" % (self["last_push_master"],
-                             self["push_hash"]))
-
-    # Cache raw commit messages.
-    commit_messages = [
-      [
-        self.GitLog(n=1, format="%s", git_hash=commit),
-        self.GitLog(n=1, format="%B", git_hash=commit),
-        self.GitLog(n=1, format="%an", git_hash=commit),
-      ] for commit in commits.splitlines()
-    ]
-
-    # Auto-format commit messages.
-    body = MakeChangeLogBody(commit_messages, auto_format=True)
-    AppendToFile(body, self.Config("CHANGELOG_ENTRY_FILE"))
-
-    msg = ("        Performance and stability improvements on all platforms."
-           "\n#\n# The change log above is auto-generated. Please review if "
-           "all relevant\n# commit messages from the list below are included."
-           "\n# All lines starting with # will be stripped.\n#\n")
-    AppendToFile(msg, self.Config("CHANGELOG_ENTRY_FILE"))
-
-    # Include unformatted commit messages as a reference in a comment.
-    comment_body = MakeComment(MakeChangeLogBody(commit_messages))
-    AppendToFile(comment_body, self.Config("CHANGELOG_ENTRY_FILE"))
-
-
-class EditChangeLog(Step):
-  MESSAGE = "Edit ChangeLog entry."
-
-  def RunStep(self):
-    print ("Please press <Return> to have your EDITOR open the ChangeLog "
-           "entry, then edit its contents to your liking. When you're done, "
-           "save the file and exit your EDITOR. ")
-    self.ReadLine(default="")
-    self.Editor(self.Config("CHANGELOG_ENTRY_FILE"))
-
-    # Strip comments and reformat with correct indentation.
-    changelog_entry = FileToText(self.Config("CHANGELOG_ENTRY_FILE")).rstrip()
-    changelog_entry = StripComments(changelog_entry)
-    changelog_entry = "\n".join(map(Fill80, changelog_entry.splitlines()))
-    changelog_entry = changelog_entry.lstrip()
-
-    if changelog_entry == "":  # pragma: no cover
-      self.Die("Empty ChangeLog entry.")
-
-    # Safe new change log for adding it later to the candidates patch.
-    TextToFile(changelog_entry, self.Config("CHANGELOG_ENTRY_FILE"))
-
-
-class StragglerCommits(Step):
-  MESSAGE = ("Fetch straggler commits that sneaked in since this script was "
-             "started.")
-
-  def RunStep(self):
-    self.vc.Fetch()
-    self.GitCheckout(self.vc.RemoteMasterBranch())
-
-
-class SquashCommits(Step):
-  MESSAGE = "Squash commits into one."
-
-  def RunStep(self):
-    # Instead of relying on "git rebase -i", we'll just create a diff, because
-    # that's easier to automate.
-    TextToFile(self.GitDiff(self.vc.RemoteCandidateBranch(),
-                            self["push_hash"]),
-               self.Config("PATCH_FILE"))
-
-    # Convert the ChangeLog entry to commit message format.
-    text = FileToText(self.Config("CHANGELOG_ENTRY_FILE"))
-
-    # Remove date and trailing white space.
-    text = re.sub(r"^%s: " % self["date"], "", text.rstrip())
-
-    # Show the used master hash in the commit message.
-    suffix = PUSH_MSG_GIT_SUFFIX % self["push_hash"]
-    text = MSub(r"^(Version \d+\.\d+\.\d+)$", "\\1%s" % suffix, text)
-
-    # Remove indentation and merge paragraphs into single long lines, keeping
-    # empty lines between them.
-    def SplitMapJoin(split_text, fun, join_text):
-      return lambda text: join_text.join(map(fun, text.split(split_text)))
-    strip = lambda line: line.strip()
-    text = SplitMapJoin("\n\n", SplitMapJoin("\n", strip, " "), "\n\n")(text)
-
-    if not text:  # pragma: no cover
-      self.Die("Commit message editing failed.")
-    self["commit_title"] = text.splitlines()[0]
-    TextToFile(text, self.Config("COMMITMSG_FILE"))
-
-
-class NewBranch(Step):
-  MESSAGE = "Create a new branch from candidates."
-
-  def RunStep(self):
-    self.GitCreateBranch(self.Config("CANDIDATESBRANCH"),
-                         self.vc.RemoteCandidateBranch())
-
-
-class ApplyChanges(Step):
-  MESSAGE = "Apply squashed changes."
-
-  def RunStep(self):
-    self.ApplyPatch(self.Config("PATCH_FILE"))
-    os.remove(self.Config("PATCH_FILE"))
-    # The change log has been modified by the patch. Reset it to the version
-    # on candidates and apply the exact changes determined by this
-    # PrepareChangeLog step above.
-    self.GitCheckoutFile(CHANGELOG_FILE, self.vc.RemoteCandidateBranch())
-    # The version file has been modified by the patch. Reset it to the version
-    # on candidates.
-    self.GitCheckoutFile(VERSION_FILE, self.vc.RemoteCandidateBranch())
-
-
-class CommitSquash(Step):
-  MESSAGE = "Commit to local candidates branch."
-
-  def RunStep(self):
-    # Make a first commit with a slightly different title to not confuse
-    # the tagging.
-    msg = FileToText(self.Config("COMMITMSG_FILE")).splitlines()
-    msg[0] = msg[0].replace("(based on", "(squashed - based on")
-    self.GitCommit(message = "\n".join(msg))
-
-
-class PrepareVersionBranch(Step):
-  MESSAGE = "Prepare new branch to commit version and changelog file."
-
-  def RunStep(self):
-    self.GitCheckout("master")
-    self.Git("fetch")
-    self.GitDeleteBranch(self.Config("CANDIDATESBRANCH"))
-    self.GitCreateBranch(self.Config("CANDIDATESBRANCH"),
-                         self.vc.RemoteCandidateBranch())
-
-
-class AddChangeLog(Step):
-  MESSAGE = "Add ChangeLog changes to candidates branch."
-
-  def RunStep(self):
-    changelog_entry = FileToText(self.Config("CHANGELOG_ENTRY_FILE"))
-    old_change_log = FileToText(os.path.join(self.default_cwd, CHANGELOG_FILE))
-    new_change_log = "%s\n\n\n%s" % (changelog_entry, old_change_log)
-    TextToFile(new_change_log, os.path.join(self.default_cwd, CHANGELOG_FILE))
-    os.remove(self.Config("CHANGELOG_ENTRY_FILE"))
-
-
-class SetVersion(Step):
-  MESSAGE = "Set correct version for candidates."
-
-  def RunStep(self):
-    self.SetVersion(os.path.join(self.default_cwd, VERSION_FILE), "new_")
-
-
-class CommitCandidate(Step):
-  MESSAGE = "Commit version and changelog to local candidates branch."
-
-  def RunStep(self):
-    self.GitCommit(file_name = self.Config("COMMITMSG_FILE"))
-    os.remove(self.Config("COMMITMSG_FILE"))
-
-
-class SanityCheck(Step):
-  MESSAGE = "Sanity check."
-
-  def RunStep(self):
-    # TODO(machenbach): Run presubmit script here as it is now missing in the
-    # prepare push process.
-    if not self.Confirm("Please check if your local checkout is sane: Inspect "
-        "%s, compile, run tests. Do you want to commit this new candidates "
-        "revision to the repository?" % VERSION_FILE):
-      self.Die("Execution canceled.")  # pragma: no cover
-
-
-class Land(Step):
-  MESSAGE = "Land the patch."
-
-  def RunStep(self):
-    self.vc.CLLand()
-
-
-class TagRevision(Step):
-  MESSAGE = "Tag the new revision."
-
-  def RunStep(self):
-    self.vc.Tag(
-        self["version"], self.vc.RemoteCandidateBranch(), self["commit_title"])
-
-
-class CleanUp(Step):
-  MESSAGE = "Done!"
-
-  def RunStep(self):
-    print("Congratulations, you have successfully created the candidates "
-          "revision %s."
-          % self["version"])
-
-    self.CommonCleanup()
-    if self.Config("CANDIDATESBRANCH") != self["current_branch"]:
-      self.GitDeleteBranch(self.Config("CANDIDATESBRANCH"))
-
-
-class PushToCandidates(ScriptsBase):
-  def _PrepareOptions(self, parser):
-    group = parser.add_mutually_exclusive_group()
-    group.add_argument("-f", "--force",
-                      help="Don't prompt the user.",
-                      default=False, action="store_true")
-    group.add_argument("-m", "--manual",
-                      help="Prompt the user at every important step.",
-                      default=False, action="store_true")
-    parser.add_argument("-b", "--last-master",
-                        help=("The git commit ID of the last master "
-                              "revision that was pushed to candidates. This is"
-                              " used for the auto-generated ChangeLog entry."))
-    parser.add_argument("-l", "--last-push",
-                        help="The git commit ID of the last candidates push.")
-    parser.add_argument("-R", "--revision",
-                        help="The git commit ID to push (defaults to HEAD).")
-
-  def _ProcessOptions(self, options):  # pragma: no cover
-    if not options.manual and not options.reviewer:
-      print("A reviewer (-r) is required in (semi-)automatic mode.")
-      return False
-    if not options.manual and not options.author:
-      print("Specify your chromium.org email with -a in (semi-)automatic mode.")
-      return False
-
-    options.tbr_commit = not options.manual
-    return True
-
-  def _Config(self):
-    return {
-      "BRANCHNAME": "prepare-push",
-      "CANDIDATESBRANCH": "candidates-push",
-      "PERSISTFILE_BASENAME": "/tmp/v8-push-to-candidates-tempfile",
-      "CHANGELOG_ENTRY_FILE":
-          "/tmp/v8-push-to-candidates-tempfile-changelog-entry",
-      "PATCH_FILE": "/tmp/v8-push-to-candidates-tempfile-patch-file",
-      "COMMITMSG_FILE": "/tmp/v8-push-to-candidates-tempfile-commitmsg",
-    }
-
-  def _Steps(self):
-    return [
-      Preparation,
-      FreshBranch,
-      PreparePushRevision,
-      IncrementVersion,
-      DetectLastRelease,
-      PrepareChangeLog,
-      EditChangeLog,
-      StragglerCommits,
-      SquashCommits,
-      NewBranch,
-      ApplyChanges,
-      CommitSquash,
-      SanityCheck,
-      Land,
-      PrepareVersionBranch,
-      AddChangeLog,
-      SetVersion,
-      CommitCandidate,
-      Land,
-      TagRevision,
-      CleanUp,
-    ]
-
-
-if __name__ == "__main__":  # pragma: no cover
-  sys.exit(PushToCandidates().Run())
diff --git a/deps/v8/tools/release/roll_merge.py b/deps/v8/tools/release/roll_merge.py
index 2f03abb54c6e5a..064ba73df20f0d 100755
--- a/deps/v8/tools/release/roll_merge.py
+++ b/deps/v8/tools/release/roll_merge.py
@@ -129,7 +129,7 @@ def RunStep(self):
         bugs.extend(s.strip() for s in bug.split(","))
     bug_aggregate = ",".join(sorted(filter(lambda s: s and s != "none", bugs)))
     if bug_aggregate:
-      msg_pieces.append("BUG=%s\nLOG=N\n" % bug_aggregate)
+      msg_pieces.append("BUG=%s\n" % bug_aggregate)
 
     self["new_commit_msg"] = "".join(msg_pieces)
 
diff --git a/deps/v8/tools/release/test_scripts.py b/deps/v8/tools/release/test_scripts.py
index 62158d95528136..36ee6c1d4421a1 100755
--- a/deps/v8/tools/release/test_scripts.py
+++ b/deps/v8/tools/release/test_scripts.py
@@ -41,11 +41,9 @@
 import common_includes
 from common_includes import *
 import create_release
-from create_release import CreateRelease
+from create_release import *
 import merge_to_branch
 from merge_to_branch import MergeToBranch
-import push_to_candidates
-from push_to_candidates import *
 from auto_tag import AutoTag
 import roll_merge
 from roll_merge import RollMerge
@@ -53,13 +51,10 @@
 TEST_CONFIG = {
   "DEFAULT_CWD": None,
   "BRANCHNAME": "test-prepare-push",
-  "CANDIDATESBRANCH": "test-candidates-push",
-  "PERSISTFILE_BASENAME": "/tmp/test-v8-push-to-candidates-tempfile",
-  "CHANGELOG_ENTRY_FILE":
-      "/tmp/test-v8-push-to-candidates-tempfile-changelog-entry",
-  "PATCH_FILE": "/tmp/test-v8-push-to-candidates-tempfile-patch",
-  "COMMITMSG_FILE": "/tmp/test-v8-push-to-candidates-tempfile-commitmsg",
-  "CHROMIUM": "/tmp/test-v8-push-to-candidates-tempfile-chromium",
+  "PERSISTFILE_BASENAME": "/tmp/test-create-releases-tempfile",
+  "PATCH_FILE": "/tmp/test-v8-create-releases-tempfile-tempfile-patch",
+  "COMMITMSG_FILE": "/tmp/test-v8-create-releases-tempfile-commitmsg",
+  "CHROMIUM": "/tmp/test-create-releases-tempfile-chromium",
   "SETTINGS_LOCATION": None,
   "ALREADY_MERGING_SENTINEL_FILE":
       "/tmp/test-merge-to-branch-tempfile-already-merging",
@@ -98,142 +93,6 @@ def testNormalizeVersionTags(self):
                 ]
     self.assertEquals(expected, NormalizeVersionTags(input))
 
-  def testMakeComment(self):
-    self.assertEquals("#   Line 1\n#   Line 2\n#",
-                      MakeComment("    Line 1\n    Line 2\n"))
-    self.assertEquals("#Line 1\n#Line 2",
-                      MakeComment("Line 1\n Line 2"))
-
-  def testStripComments(self):
-    self.assertEquals("    Line 1\n    Line 3\n",
-        StripComments("    Line 1\n#   Line 2\n    Line 3\n#\n"))
-    self.assertEquals("\nLine 2 ### Test\n #",
-        StripComments("###\n# \n\n#  Line 1\nLine 2 ### Test\n #"))
-
-  def testMakeChangeLogBodySimple(self):
-    commits = [
-          ["Title text 1",
-           "Title text 1\n\nBUG=\n",
-           "author1@chromium.org"],
-          ["Title text 2.",
-           "Title text 2\n\nBUG=1234\n",
-           "author2@chromium.org"],
-        ]
-    self.assertEquals("        Title text 1.\n"
-                      "        (author1@chromium.org)\n\n"
-                      "        Title text 2 (Chromium issue 1234).\n"
-                      "        (author2@chromium.org)\n\n",
-                      MakeChangeLogBody(commits))
-
-  def testMakeChangeLogBodyEmpty(self):
-    self.assertEquals("", MakeChangeLogBody([]))
-
-  def testMakeChangeLogBodyAutoFormat(self):
-    commits = [
-          ["Title text 1!",
-           "Title text 1\nLOG=y\nBUG=\n",
-           "author1@chromium.org"],
-          ["Title text 2",
-           "Title text 2\n\nBUG=1234\n",
-           "author2@chromium.org"],
-          ["Title text 3",
-           "Title text 3\n\nBUG=1234\nLOG = Yes\n",
-           "author3@chromium.org"],
-          ["Title text 3",
-           "Title text 4\n\nBUG=1234\nLOG=\n",
-           "author4@chromium.org"],
-        ]
-    self.assertEquals("        Title text 1.\n\n"
-                      "        Title text 3 (Chromium issue 1234).\n\n",
-                      MakeChangeLogBody(commits, True))
-
-  def testRegressWrongLogEntryOnTrue(self):
-    body = """
-Check elimination: Learn from if(CompareMap(x)) on true branch.
-
-BUG=
-R=verwaest@chromium.org
-
-Committed: https://code.google.com/p/v8/source/detail?r=18210
-"""
-    self.assertEquals("", MakeChangeLogBody([["title", body, "author"]], True))
-
-  def testMakeChangeLogBugReferenceEmpty(self):
-    self.assertEquals("", MakeChangeLogBugReference(""))
-    self.assertEquals("", MakeChangeLogBugReference("LOG="))
-    self.assertEquals("", MakeChangeLogBugReference(" BUG ="))
-    self.assertEquals("", MakeChangeLogBugReference("BUG=none\t"))
-
-  def testMakeChangeLogBugReferenceSimple(self):
-    self.assertEquals("(issue 987654)",
-                      MakeChangeLogBugReference("BUG = v8:987654"))
-    self.assertEquals("(Chromium issue 987654)",
-                      MakeChangeLogBugReference("BUG=987654 "))
-
-  def testMakeChangeLogBugReferenceFromBody(self):
-    self.assertEquals("(Chromium issue 1234567)",
-                      MakeChangeLogBugReference("Title\n\nTBR=\nBUG=\n"
-                                                " BUG=\tchromium:1234567\t\n"
-                                                "R=somebody\n"))
-
-  def testMakeChangeLogBugReferenceMultiple(self):
-    # All issues should be sorted and grouped. Multiple references to the same
-    # issue should be filtered.
-    self.assertEquals("(issues 123, 234, Chromium issue 345)",
-                      MakeChangeLogBugReference("Title\n\n"
-                                                "BUG=v8:234\n"
-                                                "  BUG\t= 345, \tv8:234,\n"
-                                                "BUG=v8:123\n"
-                                                "R=somebody\n"))
-    self.assertEquals("(Chromium issues 123, 234)",
-                      MakeChangeLogBugReference("Title\n\n"
-                                                "BUG=234,,chromium:123 \n"
-                                                "R=somebody\n"))
-    self.assertEquals("(Chromium issues 123, 234)",
-                      MakeChangeLogBugReference("Title\n\n"
-                                                "BUG=chromium:234, , 123\n"
-                                                "R=somebody\n"))
-    self.assertEquals("(issues 345, 456)",
-                      MakeChangeLogBugReference("Title\n\n"
-                                                "\t\tBUG=v8:345,v8:456\n"
-                                                "R=somebody\n"))
-    self.assertEquals("(issue 123, Chromium issues 345, 456)",
-                      MakeChangeLogBugReference("Title\n\n"
-                                                "BUG=chromium:456\n"
-                                                "BUG = none\n"
-                                                "R=somebody\n"
-                                                "BUG=456,v8:123, 345"))
-
-  # TODO(machenbach): These test don't make much sense when the formatting is
-  # done later.
-  def testMakeChangeLogBugReferenceLong(self):
-    # -----------------00--------10--------20--------30--------
-    self.assertEquals("(issues 234, 1234567890, 1234567"
-                      "8901234567890, Chromium issues 12345678,"
-                      " 123456789)",
-                      MakeChangeLogBugReference("BUG=v8:234\n"
-                                                "BUG=v8:1234567890\n"
-                                                "BUG=v8:12345678901234567890\n"
-                                                "BUG=123456789\n"
-                                                "BUG=12345678\n"))
-    # -----------------00--------10--------20--------30--------
-    self.assertEquals("(issues 234, 1234567890, 1234567"
-                      "8901234567890, Chromium issues"
-                      " 123456789, 1234567890)",
-                      MakeChangeLogBugReference("BUG=v8:234\n"
-                                                "BUG=v8:12345678901234567890\n"
-                                                "BUG=v8:1234567890\n"
-                                                "BUG=123456789\n"
-                                                "BUG=1234567890\n"))
-    # -----------------00--------10--------20--------30--------
-    self.assertEquals("(Chromium issues 234, 1234567890"
-                      ", 12345678901234567, "
-                      "1234567890123456789)",
-                      MakeChangeLogBugReference("BUG=234\n"
-                                                "BUG=12345678901234567\n"
-                                                "BUG=1234567890123456789\n"
-                                                "BUG=1234567890\n"))
-
 
 def Cmd(*args, **kwargs):
   """Convenience function returning a shell command test expectation."""
@@ -278,6 +137,7 @@ def Expect(self, recipe):
 
   def Call(self, name, *args, **kwargs):  # pragma: no cover
     self._index += 1
+
     try:
       expected_call = self._recipe[self._index]
     except IndexError:
@@ -380,9 +240,9 @@ def MakeStep(self):
                     config=TEST_CONFIG, side_effect_handler=self,
                     options=options)
 
-  def RunStep(self, script=PushToCandidates, step_class=Step, args=None):
+  def RunStep(self, script=CreateRelease, step_class=Step, args=None):
     """Convenience wrapper."""
-    args = args if args is not None else ["-m"]
+    args = args if args is not None else ["-m", "-a=author", "-r=reviewer", ]
     return script(TEST_CONFIG, self, self._state).RunSteps([step_class], args)
 
   def Call(self, fun, *args, **kwargs):
@@ -405,9 +265,6 @@ def ReadURL(self, url, params):
   def Sleep(self, seconds):
     pass
 
-  def GetDate(self):
-    return "1999-07-31"
-
   def GetUTCStamp(self):
     return "1000000"
 
@@ -486,13 +343,13 @@ def testInitialEnvironmentChecks(self):
   def testTagTimeout(self):
     self.Expect([
       Cmd("git fetch", ""),
-      Cmd("git log -1 --format=%H --grep=\"Title\" origin/candidates", ""),
+      Cmd("git log -1 --format=%H --grep=\"Title\" origin/tag_name", ""),
       Cmd("git fetch", ""),
-      Cmd("git log -1 --format=%H --grep=\"Title\" origin/candidates", ""),
+      Cmd("git log -1 --format=%H --grep=\"Title\" origin/tag_name", ""),
       Cmd("git fetch", ""),
-      Cmd("git log -1 --format=%H --grep=\"Title\" origin/candidates", ""),
+      Cmd("git log -1 --format=%H --grep=\"Title\" origin/tag_name", ""),
       Cmd("git fetch", ""),
-      Cmd("git log -1 --format=%H --grep=\"Title\" origin/candidates", ""),
+      Cmd("git log -1 --format=%H --grep=\"Title\" origin/tag_name", ""),
     ])
     args = ["--branch", "candidates", "ab12345"]
     self._state["version"] = "tag_name"
@@ -530,84 +387,6 @@ def testRegex(self):
                           r"\g<space>3",
                           "//\n#define V8_BUILD_NUMBER  321\n"))
 
-  def testPreparePushRevision(self):
-    # Tests the default push hash used when the --revision option is not set.
-    self.Expect([
-      Cmd("git log -1 --format=%H HEAD", "push_hash")
-    ])
-
-    self.RunStep(PushToCandidates, PreparePushRevision)
-    self.assertEquals("push_hash", self._state["push_hash"])
-
-  def testPrepareChangeLog(self):
-    self.WriteFakeVersionFile()
-    TEST_CONFIG["CHANGELOG_ENTRY_FILE"] = self.MakeEmptyTempFile()
-
-    self.Expect([
-      Cmd("git log --format=%H 1234..push_hash", "rev1\nrev2\nrev3\nrev4"),
-      Cmd("git log -1 --format=%s rev1", "Title text 1"),
-      Cmd("git log -1 --format=%B rev1", "Title\n\nBUG=\nLOG=y\n"),
-      Cmd("git log -1 --format=%an rev1", "author1@chromium.org"),
-      Cmd("git log -1 --format=%s rev2", "Title text 2."),
-      Cmd("git log -1 --format=%B rev2", "Title\n\nBUG=123\nLOG= \n"),
-      Cmd("git log -1 --format=%an rev2", "author2@chromium.org"),
-      Cmd("git log -1 --format=%s rev3", "Title text 3"),
-      Cmd("git log -1 --format=%B rev3", "Title\n\nBUG=321\nLOG=true\n"),
-      Cmd("git log -1 --format=%an rev3", "author3@chromium.org"),
-      Cmd("git log -1 --format=%s rev4", "Title text 4"),
-      Cmd("git log -1 --format=%B rev4", "Title\n\nBUG=456\nLOG=N"),
-      Cmd("git log -1 --format=%an rev4", "author4@chromium.org"),
-    ])
-
-    self._state["last_push_master"] = "1234"
-    self._state["push_hash"] = "push_hash"
-    self._state["version"] = "3.22.5"
-    self.RunStep(PushToCandidates, PrepareChangeLog)
-
-    actual_cl = FileToText(TEST_CONFIG["CHANGELOG_ENTRY_FILE"])
-
-    expected_cl = """1999-07-31: Version 3.22.5
-
-        Title text 1.
-
-        Title text 3 (Chromium issue 321).
-
-        Performance and stability improvements on all platforms.
-#
-# The change log above is auto-generated. Please review if all relevant
-# commit messages from the list below are included.
-# All lines starting with # will be stripped.
-#
-#       Title text 1.
-#       (author1@chromium.org)
-#
-#       Title text 2 (Chromium issue 123).
-#       (author2@chromium.org)
-#
-#       Title text 3 (Chromium issue 321).
-#       (author3@chromium.org)
-#
-#       Title text 4 (Chromium issue 456).
-#       (author4@chromium.org)
-#
-#"""
-
-    self.assertEquals(expected_cl, actual_cl)
-
-  def testEditChangeLog(self):
-    TEST_CONFIG["CHANGELOG_ENTRY_FILE"] = self.MakeEmptyTempFile()
-    TextToFile("  New  \n\tLines  \n", TEST_CONFIG["CHANGELOG_ENTRY_FILE"])
-    os.environ["EDITOR"] = "vi"
-    self.Expect([
-      RL(""),  # Open editor.
-      Cmd("vi %s" % TEST_CONFIG["CHANGELOG_ENTRY_FILE"], ""),
-    ])
-
-    self.RunStep(PushToCandidates, EditChangeLog)
-
-    self.assertEquals("New\n        Lines",
-                      FileToText(TEST_CONFIG["CHANGELOG_ENTRY_FILE"]))
-
   TAGS = """
 4425.0
 0.0.0.0
@@ -626,64 +405,13 @@ def testIncrementVersion(self):
           "", cb=lambda: self.WriteFakeVersionFile(3, 22, 6)),
     ])
 
-    self.RunStep(PushToCandidates, IncrementVersion)
+    self.RunStep(CreateRelease, IncrementVersion)
 
     self.assertEquals("3", self._state["new_major"])
     self.assertEquals("22", self._state["new_minor"])
     self.assertEquals("7", self._state["new_build"])
     self.assertEquals("0", self._state["new_patch"])
 
-  def _TestSquashCommits(self, change_log, expected_msg):
-    TEST_CONFIG["CHANGELOG_ENTRY_FILE"] = self.MakeEmptyTempFile()
-    with open(TEST_CONFIG["CHANGELOG_ENTRY_FILE"], "w") as f:
-      f.write(change_log)
-
-    self.Expect([
-      Cmd("git diff origin/candidates hash1", "patch content"),
-    ])
-
-    self._state["push_hash"] = "hash1"
-    self._state["date"] = "1999-11-11"
-
-    self.RunStep(PushToCandidates, SquashCommits)
-    self.assertEquals(FileToText(TEST_CONFIG["COMMITMSG_FILE"]), expected_msg)
-
-    patch = FileToText(TEST_CONFIG["PATCH_FILE"])
-    self.assertTrue(re.search(r"patch content", patch))
-
-  def testSquashCommitsUnformatted(self):
-    change_log = """1999-11-11: Version 3.22.5
-
-        Log text 1.
-        Chromium issue 12345
-
-        Performance and stability improvements on all platforms.\n"""
-    commit_msg = """Version 3.22.5 (based on hash1)
-
-Log text 1. Chromium issue 12345
-
-Performance and stability improvements on all platforms."""
-    self._TestSquashCommits(change_log, commit_msg)
-
-  def testSquashCommitsFormatted(self):
-    change_log = """1999-11-11: Version 3.22.5
-
-        Long commit message that fills more than 80 characters (Chromium issue
-        12345).
-
-        Performance and stability improvements on all platforms.\n"""
-    commit_msg = """Version 3.22.5 (based on hash1)
-
-Long commit message that fills more than 80 characters (Chromium issue 12345).
-
-Performance and stability improvements on all platforms."""
-    self._TestSquashCommits(change_log, commit_msg)
-
-  def testSquashCommitsQuotationMarks(self):
-    change_log = """Line with "quotation marks".\n"""
-    commit_msg = """Line with "quotation marks"."""
-    self._TestSquashCommits(change_log, commit_msg)
-
   def testBootstrapper(self):
     work_dir = self.MakeEmptyTempDirectory()
     class FakeScript(ScriptsBase):
@@ -699,189 +427,16 @@ def _Steps(self):
     ])
     FakeScript(fake_config, self).Run(["--work-dir", work_dir])
 
-  def _PushToCandidates(self, force=False, manual=False):
-    TextToFile("", os.path.join(TEST_CONFIG["DEFAULT_CWD"], ".git"))
-
-    # The version file on master has build level 5, while the version
-    # file from candidates has build level 4.
-    self.WriteFakeVersionFile(build=5)
-
-    TEST_CONFIG["CHANGELOG_ENTRY_FILE"] = self.MakeEmptyTempFile()
-    master_change_log = "2014-03-17: Sentinel\n"
-    TextToFile(master_change_log,
-               os.path.join(TEST_CONFIG["DEFAULT_CWD"], CHANGELOG_FILE))
-    os.environ["EDITOR"] = "vi"
-
-    commit_msg_squashed = """Version 3.22.5 (squashed - based on push_hash)
-
-Log text 1 (issue 321).
-
-Performance and stability improvements on all platforms."""
-
-    commit_msg = """Version 3.22.5 (based on push_hash)
-
-Log text 1 (issue 321).
-
-Performance and stability improvements on all platforms."""
-
-    def ResetChangeLog():
-      """On 'git co -b new_branch origin/candidates',
-      and 'git checkout -- ChangeLog',
-      the ChangLog will be reset to its content on candidates."""
-      candidates_change_log = """1999-04-05: Version 3.22.4
-
-        Performance and stability improvements on all platforms.\n"""
-      TextToFile(candidates_change_log,
-                 os.path.join(TEST_CONFIG["DEFAULT_CWD"], CHANGELOG_FILE))
-
-    def ResetToCandidates():
-      ResetChangeLog()
-      self.WriteFakeVersionFile()
-
-    def CheckVersionCommit():
-      commit = FileToText(TEST_CONFIG["COMMITMSG_FILE"])
-      self.assertEquals(commit_msg, commit)
-      version = FileToText(
-          os.path.join(TEST_CONFIG["DEFAULT_CWD"], VERSION_FILE))
-      self.assertTrue(re.search(r"#define V8_MINOR_VERSION\s+22", version))
-      self.assertTrue(re.search(r"#define V8_BUILD_NUMBER\s+5", version))
-      self.assertFalse(re.search(r"#define V8_BUILD_NUMBER\s+6", version))
-      self.assertTrue(re.search(r"#define V8_PATCH_LEVEL\s+0", version))
-      self.assertTrue(
-          re.search(r"#define V8_IS_CANDIDATE_VERSION\s+0", version))
-
-      # Check that the change log on the candidates branch got correctly
-      # modified.
-      change_log = FileToText(
-          os.path.join(TEST_CONFIG["DEFAULT_CWD"], CHANGELOG_FILE))
-      self.assertEquals(
-"""1999-07-31: Version 3.22.5
-
-        Log text 1 (issue 321).
-
-        Performance and stability improvements on all platforms.
-
-
-1999-04-05: Version 3.22.4
-
-        Performance and stability improvements on all platforms.\n""",
-          change_log)
-
-    force_flag = " -f" if not manual else ""
-    expectations = []
-    if not force:
-      expectations.append(Cmd("which vi", "/usr/bin/vi"))
-    expectations += [
-      Cmd("git status -s -uno", ""),
-      Cmd("git checkout -f origin/master", ""),
-      Cmd("git fetch", ""),
-      Cmd("git branch", "  branch1\n* branch2\n"),
-      Cmd("git branch", "  branch1\n* branch2\n"),
-      Cmd(("git new-branch %s --upstream origin/master" %
-           TEST_CONFIG["BRANCHNAME"]), ""),
-      Cmd("git fetch origin +refs/tags/*:refs/tags/*", ""),
-      Cmd("git tag", self.TAGS),
-      Cmd("git checkout -f origin/master -- include/v8-version.h",
-          "", cb=self.WriteFakeVersionFile),
-      Cmd("git log -1 --format=%H 3.22.4", "release_hash\n"),
-      Cmd("git log -1 --format=%s release_hash",
-          "Version 3.22.4 (based on abc3)\n"),
-      Cmd("git log --format=%H abc3..push_hash", "rev1\n"),
-      Cmd("git log -1 --format=%s rev1", "Log text 1.\n"),
-      Cmd("git log -1 --format=%B rev1", "Text\nLOG=YES\nBUG=v8:321\nText\n"),
-      Cmd("git log -1 --format=%an rev1", "author1@chromium.org\n"),
-    ]
-    if manual:
-      expectations.append(RL(""))  # Open editor.
-    if not force:
-      expectations.append(
-          Cmd("vi %s" % TEST_CONFIG["CHANGELOG_ENTRY_FILE"], ""))
-    expectations += [
-      Cmd("git fetch", ""),
-      Cmd("git checkout -f origin/master", ""),
-      Cmd("git diff origin/candidates push_hash", "patch content\n"),
-      Cmd(("git new-branch %s --upstream origin/candidates" %
-           TEST_CONFIG["CANDIDATESBRANCH"]), "", cb=ResetToCandidates),
-      Cmd("git apply --index --reject \"%s\"" % TEST_CONFIG["PATCH_FILE"], ""),
-      Cmd("git checkout -f origin/candidates -- ChangeLog", "",
-          cb=ResetChangeLog),
-      Cmd("git checkout -f origin/candidates -- include/v8-version.h", "",
-          cb=self.WriteFakeVersionFile),
-      Cmd("git commit -am \"%s\"" % commit_msg_squashed, ""),
-    ]
-    if manual:
-      expectations.append(RL("Y"))  # Sanity check.
-    expectations += [
-      Cmd("git cl land -f --bypass-hooks", ""),
-      Cmd("git checkout -f master", ""),
-      Cmd("git fetch", ""),
-      Cmd("git branch -D %s" % TEST_CONFIG["CANDIDATESBRANCH"], ""),
-      Cmd(("git new-branch %s --upstream origin/candidates" %
-           TEST_CONFIG["CANDIDATESBRANCH"]), "", cb=ResetToCandidates),
-      Cmd("git commit -aF \"%s\"" % TEST_CONFIG["COMMITMSG_FILE"], "",
-          cb=CheckVersionCommit),
-      Cmd("git cl land -f --bypass-hooks", ""),
-      Cmd("git fetch", ""),
-      Cmd("git log -1 --format=%H --grep="
-          "\"Version 3.22.5 (based on push_hash)\""
-          " origin/candidates", "hsh_to_tag"),
-      Cmd("git tag 3.22.5 hsh_to_tag", ""),
-      Cmd("git push origin refs/tags/3.22.5:refs/tags/3.22.5", ""),
-      Cmd("git checkout -f origin/master", ""),
-      Cmd("git branch -D %s" % TEST_CONFIG["BRANCHNAME"], ""),
-      Cmd("git branch -D %s" % TEST_CONFIG["CANDIDATESBRANCH"], ""),
-    ]
-    self.Expect(expectations)
-
-    args = ["-a", "author@chromium.org", "--revision", "push_hash"]
-    if force: args.append("-f")
-    if manual: args.append("-m")
-    else: args += ["-r", "reviewer@chromium.org"]
-    PushToCandidates(TEST_CONFIG, self).Run(args)
-
-    cl = FileToText(os.path.join(TEST_CONFIG["DEFAULT_CWD"], CHANGELOG_FILE))
-    self.assertTrue(re.search(r"^\d\d\d\d\-\d+\-\d+: Version 3\.22\.5", cl))
-    self.assertTrue(re.search(r"        Log text 1 \(issue 321\).", cl))
-    self.assertTrue(re.search(r"1999\-04\-05: Version 3\.22\.4", cl))
-
-    # Note: The version file is on build number 5 again in the end of this test
-    # since the git command that merges to master is mocked out.
-
-  def testPushToCandidatesManual(self):
-    self._PushToCandidates(manual=True)
-
-  def testPushToCandidatesSemiAutomatic(self):
-    self._PushToCandidates()
-
-  def testPushToCandidatesForced(self):
-    self._PushToCandidates(force=True)
-
   def testCreateRelease(self):
     TextToFile("", os.path.join(TEST_CONFIG["DEFAULT_CWD"], ".git"))
 
     # The version file on master has build level 5.
     self.WriteFakeVersionFile(build=5)
 
-    master_change_log = "2014-03-17: Sentinel\n"
-    TextToFile(master_change_log,
-               os.path.join(TEST_CONFIG["DEFAULT_CWD"], CHANGELOG_FILE))
-
     commit_msg = """Version 3.22.5
 
-Log text 1 (issue 321).
-
-Performance and stability improvements on all platforms.
-
 TBR=reviewer@chromium.org"""
 
-    def ResetChangeLog():
-      last_change_log = """1999-04-05: Version 3.22.4
-
-        Performance and stability improvements on all platforms.\n"""
-      TextToFile(last_change_log,
-                 os.path.join(TEST_CONFIG["DEFAULT_CWD"], CHANGELOG_FILE))
-
-
     def CheckVersionCommit():
       commit = FileToText(TEST_CONFIG["COMMITMSG_FILE"])
       self.assertEquals(commit_msg, commit)
@@ -894,26 +449,9 @@ def CheckVersionCommit():
       self.assertTrue(
           re.search(r"#define V8_IS_CANDIDATE_VERSION\s+0", version))
 
-      # Check that the change log on the candidates branch got correctly
-      # modified.
-      change_log = FileToText(
-          os.path.join(TEST_CONFIG["DEFAULT_CWD"], CHANGELOG_FILE))
-      self.assertEquals(
-"""1999-07-31: Version 3.22.5
-
-        Log text 1 (issue 321).
-
-        Performance and stability improvements on all platforms.
-
-
-1999-04-05: Version 3.22.4
-
-        Performance and stability improvements on all platforms.\n""",
-          change_log)
-
     expectations = [
       Cmd("git fetch origin +refs/heads/*:refs/heads/*", ""),
-      Cmd("git checkout -f origin/master", ""),
+      Cmd("git checkout -f origin/master", "", cb=self.WriteFakeWatchlistsFile),
       Cmd("git branch", ""),
       Cmd("git fetch origin +refs/tags/*:refs/tags/*", ""),
       Cmd("git tag", self.TAGS),
@@ -923,17 +461,11 @@ def CheckVersionCommit():
       Cmd("git log -1 --format=%s release_hash", "Version 3.22.4\n"),
       Cmd("git log -1 --format=%H release_hash^", "abc3\n"),
       Cmd("git log --format=%H abc3..push_hash", "rev1\n"),
-      Cmd("git log -1 --format=%s rev1", "Log text 1.\n"),
-      Cmd("git log -1 --format=%B rev1", "Text\nLOG=YES\nBUG=v8:321\nText\n"),
-      Cmd("git log -1 --format=%an rev1", "author1@chromium.org\n"),
       Cmd("git push origin push_hash:refs/heads/3.22.5", ""),
       Cmd("git reset --hard origin/master", ""),
       Cmd("git new-branch work-branch --upstream origin/3.22.5", ""),
-      Cmd("git checkout -f 3.22.4 -- ChangeLog", "", cb=ResetChangeLog),
       Cmd("git checkout -f 3.22.4 -- include/v8-version.h", "",
           cb=self.WriteFakeVersionFile),
-      Cmd("git checkout -f 3.22.4 -- WATCHLISTS", "",
-          cb=self.WriteFakeWatchlistsFile),
       Cmd("git commit -aF \"%s\"" % TEST_CONFIG["COMMITMSG_FILE"], "",
           cb=CheckVersionCommit),
       Cmd("git cl upload --send-mail "
@@ -957,11 +489,6 @@ def CheckVersionCommit():
             "--revision", "push_hash"]
     CreateRelease(TEST_CONFIG, self).Run(args)
 
-    cl = FileToText(os.path.join(TEST_CONFIG["DEFAULT_CWD"], CHANGELOG_FILE))
-    self.assertTrue(re.search(r"^\d\d\d\d\-\d+\-\d+: Version 3\.22\.5", cl))
-    self.assertTrue(re.search(r"        Log text 1 \(issue 321\).", cl))
-    self.assertTrue(re.search(r"1999\-04\-05: Version 3\.22\.4", cl))
-
     # Note: The version file is on build number 5 again in the end of this test
     # since the git command that merges to master is mocked out.
 
@@ -1175,7 +702,6 @@ def VerifyPatch(patch):
 Revert "Something"
 
 BUG=123,234,345,456,567,v8:123
-LOG=N
 """
 
     def VerifyLand():
@@ -1219,7 +745,7 @@ def VerifyLand():
       Cmd("git log -1 --format=%s ab56789", "Revert \"Something\""),
       Cmd("git log -1 ab12345", "Title4\nBUG=123\nBUG=234"),
       Cmd("git log -1 ab23456", "Title2\n BUG = v8:123,345"),
-      Cmd("git log -1 ab34567", "Title3\nLOG=n\nBUG=567, 456"),
+      Cmd("git log -1 ab34567", "Title3\nBUG=567, 456"),
       Cmd("git log -1 ab45678", "Title1\nBUG="),
       Cmd("git log -1 ab56789", "Revert \"Something\"\nBUG=none"),
       Cmd("git log -1 -p ab12345", "patch4"),
@@ -1317,7 +843,6 @@ def VerifyPatch(patch):
 Revision: ab56789
 
 BUG=123,234,345,456,567,v8:123
-LOG=N
 NOTRY=true
 NOPRESUBMIT=true
 NOTREECHECKS=true
@@ -1357,7 +882,7 @@ def VerifyLand():
       Cmd("git log -1 --format=%s ab56789", "Revert \"Something\""),
       Cmd("git log -1 ab12345", "Title4\nBUG=123\nBUG=234"),
       Cmd("git log -1 ab23456", "Title2\n BUG = v8:123,345"),
-      Cmd("git log -1 ab34567", "Title3\nLOG=n\nBug: 567, 456,345"),
+      Cmd("git log -1 ab34567", "Title3\nBug: 567, 456,345"),
       Cmd("git log -1 ab45678", "Title1\nBug:"),
       Cmd("git log -1 ab56789", "Revert \"Something\"\nBUG=none"),
       Cmd("git log -1 -p ab12345", "patch4"),
diff --git a/deps/v8/tools/run_perf.py b/deps/v8/tools/run_perf.py
index a98dcae91a1f01..d7255a94d35b94 100644
--- a/deps/v8/tools/run_perf.py
+++ b/deps/v8/tools/run_perf.py
@@ -479,7 +479,8 @@ def GetCommand(self, cmd_prefix, shell_dir, extra_flags=None):
         cmd_prefix=cmd_prefix,
         shell=os.path.join(shell_dir, self.binary),
         args=self.GetCommandFlags(extra_flags=extra_flags),
-        timeout=self.timeout or 60)
+        timeout=self.timeout or 60,
+        handle_sigterm=True)
 
   def ProcessOutput(self, output, result_tracker, count):
     """Processes test run output and updates result tracker.
diff --git a/deps/v8/tools/testrunner/base_runner.py b/deps/v8/tools/testrunner/base_runner.py
index 6c2bcf8ae4c511..7ae2ac4eb40be0 100644
--- a/deps/v8/tools/testrunner/base_runner.py
+++ b/deps/v8/tools/testrunner/base_runner.py
@@ -61,7 +61,6 @@
     "wasm-js",
     "fuzzer",
     "message",
-    "preparser",
     "intl",
     "unittests",
     "wasm-api-tests",
@@ -77,7 +76,6 @@
     "wasm-js",
     "fuzzer",
     "message",
-    "preparser",
     "intl",
     "unittests",
     "wasm-api-tests",
@@ -88,7 +86,6 @@
     "mjsunit",
     "webkit",
     "message",
-    "preparser",
     "intl",
   ],
   # This needs to stay in sync with "v8_optimize_for_size" in test/BUILD.gn.
@@ -105,15 +102,17 @@
   ],
 }
 
-# Double the timeout for these:
-SLOW_ARCHS = ["arm",
-              "mips",
-              "mipsel",
-              "mips64",
-              "mips64el",
-              "s390",
-              "s390x",
-              "arm64"]
+# Increase the timeout for these:
+SLOW_ARCHS = [
+  "arm",
+  "arm64",
+  "mips",
+  "mipsel",
+  "mips64",
+  "mips64el",
+  "s390",
+  "s390x",
+]
 
 
 class ModeConfig(object):
@@ -194,14 +193,10 @@ def __init__(self, build_config):
     self.is_full_debug = build_config['is_full_debug']
     self.msan = build_config['is_msan']
     self.no_i18n = not build_config['v8_enable_i18n_support']
-    # TODO(https://crbug.com/v8/8531)
-    # 'v8_use_snapshot' was removed, 'no_snap' can be removed as well.
-    self.no_snap = False
     self.predictable = build_config['v8_enable_verify_predictable']
     self.tsan = build_config['is_tsan']
     # TODO(machenbach): We only have ubsan not ubsan_vptr.
     self.ubsan_vptr = build_config['is_ubsan_vptr']
-    self.embedded_builtins = build_config['v8_enable_embedded_builtins']
     self.verify_csa = build_config['v8_enable_verify_csa']
     self.lite_mode = build_config['v8_enable_lite_mode']
     self.pointer_compression = build_config['v8_enable_pointer_compression']
@@ -230,16 +225,12 @@ def __str__(self):
       detected_options.append('msan')
     if self.no_i18n:
       detected_options.append('no_i18n')
-    if self.no_snap:
-      detected_options.append('no_snap')
     if self.predictable:
       detected_options.append('predictable')
     if self.tsan:
       detected_options.append('tsan')
     if self.ubsan_vptr:
       detected_options.append('ubsan_vptr')
-    if self.embedded_builtins:
-      detected_options.append('embedded_builtins')
     if self.verify_csa:
       detected_options.append('verify_csa')
     if self.lite_mode:
@@ -354,9 +345,6 @@ def _add_parser_default_options(self, parser):
                            "color, mono)")
     parser.add_option("--json-test-results",
                       help="Path to a file for storing json results.")
-    parser.add_option("--junitout", help="File name of the JUnit output")
-    parser.add_option("--junittestsuite", default="v8tests",
-                      help="The testsuite name in the JUnit output file")
     parser.add_option("--exit-after-n-failures", type="int", default=100,
                       help="Exit after the first N failures instead of "
                            "running all tests. Pass 0 to disable this feature.")
@@ -701,7 +689,6 @@ def _get_statusfile_variables(self, options):
       "msan": self.build_config.msan,
       "no_harness": options.no_harness,
       "no_i18n": self.build_config.no_i18n,
-      "no_snap": self.build_config.no_snap,
       "novfp3": False,
       "optimize_for_size": "--optimize-for-size" in options.extra_flags,
       "predictable": self.build_config.predictable,
@@ -710,7 +697,6 @@ def _get_statusfile_variables(self, options):
       "system": self.target_os,
       "tsan": self.build_config.tsan,
       "ubsan_vptr": self.build_config.ubsan_vptr,
-      "embedded_builtins": self.build_config.embedded_builtins,
       "verify_csa": self.build_config.verify_csa,
       "lite_mode": self.build_config.lite_mode,
       "pointer_compression": self.build_config.pointer_compression,
@@ -736,7 +722,7 @@ def _timeout_scalefactor(self, options):
     """Increases timeout for slow build configurations."""
     factor = self.mode_options.timeout_scalefactor
     if self.build_config.arch in SLOW_ARCHS:
-      factor *= 4
+      factor *= 4.5
     if self.build_config.lite_mode:
       factor *= 2
     if self.build_config.predictable:
@@ -803,9 +789,6 @@ def _get_shard_info(self, options):
 
   def _create_progress_indicators(self, test_count, options):
     procs = [PROGRESS_INDICATORS[options.progress]()]
-    if options.junitout:
-      procs.append(progress.JUnitTestProgressIndicator(options.junitout,
-                                                       options.junittestsuite))
     if options.json_test_results:
       procs.append(progress.JsonTestProgressIndicator(
         self.framework_name,
diff --git a/deps/v8/tools/testrunner/local/command.py b/deps/v8/tools/testrunner/local/command.py
index b68252c1396c35..50403a0e5e6953 100644
--- a/deps/v8/tools/testrunner/local/command.py
+++ b/deps/v8/tools/testrunner/local/command.py
@@ -5,6 +5,7 @@
 # for py2/py3 compatibility
 from __future__ import print_function
 
+from contextlib import contextmanager
 import os
 import re
 import signal
@@ -39,9 +40,37 @@ class AbortException(Exception):
   pass
 
 
+@contextmanager
+def handle_sigterm(process, abort_fun, enabled):
+  """Call`abort_fun` on sigterm and restore previous handler to prevent
+  erroneous termination of an already terminated process.
+
+  Args:
+    process: The process to terminate.
+    abort_fun: Function taking two parameters: the process to terminate and
+        an array with a boolean for storing if an abort occured.
+    enabled: If False, this wrapper will be a no-op.
+  """
+  # Variable to communicate with the signal handler.
+  abort_occured = [False]
+  def handler(signum, frame):
+    abort_fun(process, abort_occured)
+
+  if enabled:
+    previous = signal.signal(signal.SIGTERM, handler)
+  try:
+    yield
+  finally:
+    if enabled:
+      signal.signal(signal.SIGTERM, previous)
+
+  if abort_occured[0]:
+    raise AbortException()
+
+
 class BaseCommand(object):
   def __init__(self, shell, args=None, cmd_prefix=None, timeout=60, env=None,
-               verbose=False, resources_func=None):
+               verbose=False, resources_func=None, handle_sigterm=False):
     """Initialize the command.
 
     Args:
@@ -52,6 +81,9 @@ def __init__(self, shell, args=None, cmd_prefix=None, timeout=60, env=None,
       env: Environment dict for execution.
       verbose: Print additional output.
       resources_func: Callable, returning all test files needed by this command.
+      handle_sigterm: Flag indicating if SIGTERM will be used to terminate the
+          underlying process. Should not be used from the main thread, e.g. when
+          using a command to list tests.
     """
     assert(timeout > 0)
 
@@ -61,6 +93,7 @@ def __init__(self, shell, args=None, cmd_prefix=None, timeout=60, env=None,
     self.timeout = timeout
     self.env = env or {}
     self.verbose = verbose
+    self.handle_sigterm = handle_sigterm
 
   def execute(self):
     if self.verbose:
@@ -68,26 +101,18 @@ def execute(self):
 
     process = self._start_process()
 
-    # Variable to communicate with the signal handler.
-    abort_occured = [False]
-    def handler(signum, frame):
-      self._abort(process, abort_occured)
-    signal.signal(signal.SIGTERM, handler)
-
-    # Variable to communicate with the timer.
-    timeout_occured = [False]
-    timer = threading.Timer(
-        self.timeout, self._abort, [process, timeout_occured])
-    timer.start()
+    with handle_sigterm(process, self._abort, self.handle_sigterm):
+      # Variable to communicate with the timer.
+      timeout_occured = [False]
+      timer = threading.Timer(
+          self.timeout, self._abort, [process, timeout_occured])
+      timer.start()
 
-    start_time = time.time()
-    stdout, stderr = process.communicate()
-    duration = time.time() - start_time
+      start_time = time.time()
+      stdout, stderr = process.communicate()
+      duration = time.time() - start_time
 
-    timer.cancel()
-
-    if abort_occured[0]:
-      raise AbortException()
+      timer.cancel()
 
     return output.Output(
       process.returncode,
@@ -128,14 +153,16 @@ def _kill_process(self, process):
 
   def _abort(self, process, abort_called):
     abort_called[0] = True
+    started_as = self.to_string(relative=True)
+    process_text = 'process %d started as:\n  %s\n' % (process.pid, started_as)
     try:
-      print('Attempting to kill process %s' % process.pid)
+      print('Attempting to kill ' + process_text)
       sys.stdout.flush()
       self._kill_process(process)
     except OSError as e:
       print(e)
+      print('Unruly ' + process_text)
       sys.stdout.flush()
-      pass
 
   def __str__(self):
     return self.to_string()
@@ -182,6 +209,22 @@ def _kill_process(self, process):
     process.kill()
 
 
+def taskkill_windows(process, verbose=False, force=True):
+  force_flag = ' /F' if force else ''
+  tk = subprocess.Popen(
+      'taskkill /T%s /PID %d' % (force_flag, process.pid),
+      stdout=subprocess.PIPE,
+      stderr=subprocess.PIPE,
+  )
+  stdout, stderr = tk.communicate()
+  if verbose:
+    print('Taskkill results for %d' % process.pid)
+    print(stdout)
+    print(stderr)
+    print('Return code: %d' % tk.returncode)
+    sys.stdout.flush()
+
+
 class WindowsCommand(BaseCommand):
   def _start_process(self, **kwargs):
     # Try to change the error mode to avoid dialogs on fatal errors. Don't
@@ -211,18 +254,7 @@ def _get_popen_args(self):
     return subprocess.list2cmdline(self._to_args_list())
 
   def _kill_process(self, process):
-    tk = subprocess.Popen(
-        'taskkill /T /F /PID %d' % process.pid,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
-    )
-    stdout, stderr = tk.communicate()
-    if self.verbose:
-      print('Taskkill results for %d' % process.pid)
-      print(stdout)
-      print(stderr)
-      print('Return code: %d' % tk.returncode)
-      sys.stdout.flush()
+    taskkill_windows(process, self.verbose)
 
 
 class AndroidCommand(BaseCommand):
@@ -230,7 +262,7 @@ class AndroidCommand(BaseCommand):
   driver = None
 
   def __init__(self, shell, args=None, cmd_prefix=None, timeout=60, env=None,
-               verbose=False, resources_func=None):
+               verbose=False, resources_func=None, handle_sigterm=False):
     """Initialize the command and all files that need to be pushed to the
     Android device.
     """
@@ -251,7 +283,7 @@ def __init__(self, shell, args=None, cmd_prefix=None, timeout=60, env=None,
 
     super(AndroidCommand, self).__init__(
         shell, args=rel_args, cmd_prefix=cmd_prefix, timeout=timeout, env=env,
-        verbose=verbose)
+        verbose=verbose, handle_sigterm=handle_sigterm)
 
   def execute(self, **additional_popen_kwargs):
     """Execute the command on the device.
diff --git a/deps/v8/tools/testrunner/local/junit_output.py b/deps/v8/tools/testrunner/local/junit_output.py
deleted file mode 100644
index 52f31ec422a69b..00000000000000
--- a/deps/v8/tools/testrunner/local/junit_output.py
+++ /dev/null
@@ -1,49 +0,0 @@
-# Copyright 2013 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-import xml.etree.ElementTree as xml
-
-
-class JUnitTestOutput:
-  def __init__(self, test_suite_name):
-    self.root = xml.Element("testsuite")
-    self.root.attrib["name"] = test_suite_name
-
-  def HasRunTest(self, test_name, test_cmd, test_duration, test_failure):
-    testCaseElement = xml.Element("testcase")
-    testCaseElement.attrib["name"] = test_name
-    testCaseElement.attrib["cmd"] = test_cmd
-    testCaseElement.attrib["time"] = str(round(test_duration, 3))
-    if len(test_failure):
-      failureElement = xml.Element("failure")
-      failureElement.text = test_failure
-      testCaseElement.append(failureElement)
-    self.root.append(testCaseElement)
-
-  def FinishAndWrite(self, f):
-    xml.ElementTree(self.root).write(f, "UTF-8")
diff --git a/deps/v8/tools/testrunner/local/pool.py b/deps/v8/tools/testrunner/local/pool.py
index 9defdd30eefca1..a6fb91f9128d5e 100644
--- a/deps/v8/tools/testrunner/local/pool.py
+++ b/deps/v8/tools/testrunner/local/pool.py
@@ -19,6 +19,7 @@
   from Queue import Empty  # Python 2
 
 from . import command
+from . import utils
 
 
 def setup_testing():
@@ -243,6 +244,13 @@ def abort(self):
     """
     self.abort_now = True
 
+  def _terminate_processes(self):
+    for p in self.processes:
+      if utils.IsWindows():
+        command.taskkill_windows(p, verbose=True, force=False)
+      else:
+        os.kill(p.pid, signal.SIGTERM)
+
   def _terminate(self):
     """Terminates execution and cleans up the queues.
 
@@ -267,8 +275,7 @@ def _terminate(self):
       self.work_queue.put("STOP")
 
     if self.abort_now:
-      for p in self.processes:
-        os.kill(p.pid, signal.SIGTERM)
+      self._terminate_processes()
 
     self.notify("Joining workers")
     for p in self.processes:
diff --git a/deps/v8/tools/testrunner/local/statusfile.py b/deps/v8/tools/testrunner/local/statusfile.py
index db07a628858857..f99941eb991542 100644
--- a/deps/v8/tools/testrunner/local/statusfile.py
+++ b/deps/v8/tools/testrunner/local/statusfile.py
@@ -60,7 +60,6 @@
 # Support arches, modes to be written as keywords instead of strings.
 VARIABLES = {ALWAYS: True}
 for var in ["debug", "release", "big", "little", "android",
-            "android_arm", "android_arm64", "android_ia32", "android_x64",
             "arm", "arm64", "ia32", "mips", "mipsel", "mips64", "mips64el",
             "x64", "ppc", "ppc64", "s390", "s390x", "macos", "windows",
             "linux", "aix", "r1", "r2", "r3", "r5", "r6"]:
diff --git a/deps/v8/tools/testrunner/local/variants.py b/deps/v8/tools/testrunner/local/variants.py
index 57c16c0af15971..c363c2a5eca9c3 100644
--- a/deps/v8/tools/testrunner/local/variants.py
+++ b/deps/v8/tools/testrunner/local/variants.py
@@ -23,16 +23,17 @@
   "nooptimization": [["--no-opt", "--liftoff", "--no-wasm-tier-up"]],
   "slow_path": [["--force-slow-path"]],
   "stress": [["--stress-opt", "--always-opt", "--no-liftoff",
-              "--no-wasm-tier-up", '--stress-lazy-source-positions']],
+              "--stress-lazy-source-positions"]],
   "stress_js_bg_compile_wasm_code_gc": [["--stress-background-compile",
-                                         "--wasm-code-gc",
                                          "--stress-wasm-code-gc"]],
-  "stress_incremental_marking":  [["--stress-incremental-marking"]],
+  "stress_incremental_marking": [["--stress-incremental-marking"]],
   # Trigger stress sampling allocation profiler with sample interval = 2^14
   "stress_sampling": [["--stress-sampling-allocation-profiler=16384"]],
   "trusted": [["--no-untrusted-code-mitigations"]],
   "no_wasm_traps": [["--no-wasm-trap-handler"]],
   "turboprop": [["--turboprop"]],
+  "instruction_scheduling": [["--turbo-instruction-scheduling"]],
+  "stress_instruction_scheduling": [["--turbo-stress-instruction-scheduling"]],
   "top_level_await": [["--harmony-top-level-await"]],
 }
 
diff --git a/deps/v8/tools/testrunner/objects/output.py b/deps/v8/tools/testrunner/objects/output.py
index 78aa63d4c97f5d..200f5462ec1932 100644
--- a/deps/v8/tools/testrunner/objects/output.py
+++ b/deps/v8/tools/testrunner/objects/output.py
@@ -66,6 +66,10 @@ def HasTimedOut(self):
   def IsSuccess(self):
     return not self.HasCrashed() and not self.HasTimedOut()
 
+  @property
+  def exit_code_string(self):
+    return "%d [%02X]" % (self.exit_code, self.exit_code & 0xffffffff)
+
 
 class _NullOutput(Output):
   """Useful to signal that the binary has not been run."""
diff --git a/deps/v8/tools/testrunner/objects/testcase.py b/deps/v8/tools/testrunner/objects/testcase.py
index 6d4dcd1352605e..2a75cf60c45ac8 100644
--- a/deps/v8/tools/testrunner/objects/testcase.py
+++ b/deps/v8/tools/testrunner/objects/testcase.py
@@ -271,6 +271,7 @@ def _create_cmd(self, shell, params, env, timeout):
       timeout=timeout,
       verbose=self._test_config.verbose,
       resources_func=self._get_resources,
+      handle_sigterm=True,
     )
 
   def _parse_source_flags(self, source=None):
diff --git a/deps/v8/tools/testrunner/standard_runner.py b/deps/v8/tools/testrunner/standard_runner.py
index 4d9c73f2fc06e0..0ca387000ca0fb 100755
--- a/deps/v8/tools/testrunner/standard_runner.py
+++ b/deps/v8/tools/testrunner/standard_runner.py
@@ -46,7 +46,8 @@
   # Shortcut for the two above ('more' first - it has the longer running tests)
   'exhaustive': MORE_VARIANTS + VARIANTS,
   # Additional variants, run on a subset of bots.
-  'extra': ['nooptimization', 'future', 'no_wasm_traps', 'turboprop'],
+  'extra': ['nooptimization', 'future', 'no_wasm_traps', 'turboprop',
+            'instruction_scheduling'],
 }
 
 GC_STRESS_FLAGS = ['--gc-interval=500', '--stress-compaction',
@@ -174,11 +175,6 @@ def _process_options(self, options):
     if self.build_config.asan:
       options.extra_flags.append('--invoke-weak-callbacks')
 
-    if self.build_config.no_snap:
-      # Speed up slow nosnap runs. Allocation verification is covered by
-      # running mksnapshot on other builders.
-      options.extra_flags.append('--no-turbo-verify-allocation')
-
     if options.novfp3:
       options.extra_flags.append('--noenable-vfp3')
 
diff --git a/deps/v8/tools/testrunner/testproc/fuzzer.py b/deps/v8/tools/testrunner/testproc/fuzzer.py
index 187145b4c8b360..271737897ac80a 100644
--- a/deps/v8/tools/testrunner/testproc/fuzzer.py
+++ b/deps/v8/tools/testrunner/testproc/fuzzer.py
@@ -8,6 +8,48 @@
 from . import base
 
 
+# Extra flags randomly added to all fuzz tests with numfuzz. List of tuples
+# (probability, flag).
+EXTRA_FLAGS = [
+  (0.1, '--always-opt'),
+  (0.1, '--assert-types'),
+  (0.1, '--cache=code'),
+  (0.1, '--force-slow-path'),
+  (0.2, '--future'),
+  (0.1, '--liftoff'),
+  (0.2, '--no-analyze-environment-liveness'),
+  (0.1, '--no-enable-sse3'),
+  (0.1, '--no-enable-ssse3'),
+  (0.1, '--no-enable-sse4_1'),
+  (0.1, '--no-enable-sse4_2'),
+  (0.1, '--no-enable-sahf'),
+  (0.1, '--no-enable-avx'),
+  (0.1, '--no-enable-fma3'),
+  (0.1, '--no-enable-bmi1'),
+  (0.1, '--no-enable-bmi2'),
+  (0.1, '--no-enable-lzcnt'),
+  (0.1, '--no-enable-popcnt'),
+  (0.1, '--no-liftoff'),
+  (0.1, '--no-opt'),
+  (0.2, '--no-regexp-tier-up'),
+  (0.1, '--no-wasm-tier-up'),
+  (0.1, '--regexp-interpret-all'),
+  (0.1, '--regexp-tier-up-ticks=10'),
+  (0.1, '--regexp-tier-up-ticks=100'),
+  (0.1, '--stress-background-compile'),
+  (0.1, '--stress-lazy-source-positions'),
+  (0.1, '--stress-wasm-code-gc'),
+  (0.1, '--turbo-instruction-scheduling'),
+  (0.1, '--turbo-stress-instruction-scheduling'),
+]
+
+def random_extra_flags(rng):
+  """Returns a random list of flags chosen from the configurations in
+  EXTRA_FLAGS.
+  """
+  return [flag for prob, flag in EXTRA_FLAGS if rng.random() < prob]
+
+
 class FuzzerConfig(object):
   def __init__(self, probability, analyzer, fuzzer):
     """
@@ -92,7 +134,6 @@ def _create_analysis_subtest(self, test):
       return self._create_subtest(test, 'analysis', flags=analysis_flags,
                                   keep_output=True)
 
-
   def _result_for(self, test, subtest, result):
     if not self._disable_analysis:
       if result is not None:
@@ -110,7 +151,7 @@ def _create_gen(self, test, analysis_result=None):
     # analysis phase at all, so no fuzzer has it's own analyzer.
     gens = []
     indexes = []
-    for i, fuzzer_config in enumerate(self._fuzzer_configs):
+    for fuzzer_config in self._fuzzer_configs:
       analysis_value = None
       if analysis_result and fuzzer_config.analyzer:
         analysis_value = fuzzer_config.analyzer.do_analysis(analysis_result)
@@ -132,7 +173,7 @@ def _create_gen(self, test, analysis_result=None):
       main_index = self._rng.choice(indexes)
       _, main_gen = gens[main_index]
 
-      flags = next(main_gen)
+      flags = random_extra_flags(self._rng) + next(main_gen)
       for index, (p, gen) in enumerate(gens):
         if index == main_index:
           continue
@@ -205,7 +246,7 @@ def do_analysis(self, result):
 class GcIntervalFuzzer(Fuzzer):
   def create_flags_generator(self, rng, test, analysis_value):
     if analysis_value:
-      value = analysis_value / 10
+      value = analysis_value // 10
     else:
       value = 10000
     while True:
@@ -260,7 +301,7 @@ def __init__(self, min_interval):
   def create_flags_generator(self, rng, test, analysis_value):
     while True:
       if analysis_value:
-        value = analysis_value / 2
+        value = analysis_value // 2
       else:
         value = 10000
       interval = rng.randint(self._min, max(value, self._min))
diff --git a/deps/v8/tools/testrunner/testproc/progress.py b/deps/v8/tools/testrunner/testproc/progress.py
index 3bb9744f1e4f0d..d2e8a360386c89 100644
--- a/deps/v8/tools/testrunner/testproc/progress.py
+++ b/deps/v8/tools/testrunner/testproc/progress.py
@@ -14,7 +14,6 @@
 import time
 
 from . import base
-from ..local import junit_output
 
 
 # Base dir of the build products for Release and Debug.
@@ -94,7 +93,7 @@ def finished(self):
         print(result.output.stdout.strip())
       print("Command: %s" % result.cmd.to_string())
       if result.output.HasCrashed():
-        print("exit code: %d" % result.output.exit_code)
+        print("exit code: %s" % result.output.exit_code_string)
         print("--- CRASHED ---")
         crashed += 1
       if result.output.HasTimedOut():
@@ -248,7 +247,7 @@ def _on_result_for(self, test, result):
         print(self._templates['stderr'] % stderr)
       print("Command: %s" % result.cmd.to_string(relative=True))
       if output.HasCrashed():
-        print("exit code: %d" % output.exit_code)
+        print("exit code: %s" % output.exit_code_string)
         print("--- CRASHED ---")
       if output.HasTimedOut():
         print("--- TIMEOUT ---")
@@ -269,7 +268,7 @@ def _print_progress(self, name):
       'progress': progress,
       'failed': self._failed,
       'test': name,
-      'mins': int(elapsed) / 60,
+      'mins': int(elapsed) // 60,
       'secs': int(elapsed) % 60
     }
     status = self._truncate(status, 78)
@@ -317,45 +316,6 @@ def _clear_line(self, last_length):
     print(("\r" + (" " * last_length) + "\r"), end='')
 
 
-class JUnitTestProgressIndicator(ProgressIndicator):
-  def __init__(self, junitout, junittestsuite):
-    super(JUnitTestProgressIndicator, self).__init__()
-    self._requirement = base.DROP_PASS_STDOUT
-
-    self.outputter = junit_output.JUnitTestOutput(junittestsuite)
-    if junitout:
-      self.outfile = open(junitout, "w")
-    else:
-      self.outfile = sys.stdout
-
-  def _on_result_for(self, test, result):
-    # TODO(majeski): Support for dummy/grouped results
-    fail_text = ""
-    output = result.output
-    if result.has_unexpected_output:
-      stdout = output.stdout.strip()
-      if len(stdout):
-        fail_text += "stdout:\n%s\n" % stdout
-      stderr = output.stderr.strip()
-      if len(stderr):
-        fail_text += "stderr:\n%s\n" % stderr
-      fail_text += "Command: %s" % result.cmd.to_string()
-      if output.HasCrashed():
-        fail_text += "exit code: %d\n--- CRASHED ---" % output.exit_code
-      if output.HasTimedOut():
-        fail_text += "--- TIMEOUT ---"
-    self.outputter.HasRunTest(
-        test_name=str(test),
-        test_cmd=result.cmd.to_string(relative=True),
-        test_duration=output.duration,
-        test_failure=fail_text)
-
-  def finished(self):
-    self.outputter.FinishAndWrite(self.outfile)
-    if self.outfile != sys.stdout:
-      self.outfile.close()
-
-
 class JsonTestProgressIndicator(ProgressIndicator):
   def __init__(self, framework_name, json_test_results, arch, mode):
     super(JsonTestProgressIndicator, self).__init__()
diff --git a/deps/v8/tools/torque/format-torque.py b/deps/v8/tools/torque/format-torque.py
index 3b90faa73ce392..fd51fa2eaf7559 100755
--- a/deps/v8/tools/torque/format-torque.py
+++ b/deps/v8/tools/torque/format-torque.py
@@ -24,14 +24,6 @@ def preprocess(input):
   input = re.sub(r'\bcase\s*(\([^{]*\))\s*:\s*deferred\s*{', r' if /*cAsEdEfF*/ \1 {', input)
   input = re.sub(r'\bcase\s*(\([^{]*\))\s*:\s*{', r' if /*cA*/ \1 {', input)
 
-  # Add extra space around | operators to fix union types later.
-  while True:
-    old = input
-    input = re.sub(r'(\w+\s*)\|(\s*\w+)',
-        r'\1|/**/\2', input)
-    if old == input:
-      break;
-
   input = re.sub(r'\bgenerates\s+\'([^\']+)\'\s*',
       r'_GeNeRaTeS00_/*\1@*/', input)
   input = re.sub(r'\bconstexpr\s+\'([^\']+)\'\s*',
@@ -77,13 +69,6 @@ def postprocess(output):
   output = re.sub(r'jS_iMpLiCiT_',
       r"js-implicit ", output)
 
-  while True:
-    old = output
-    output = re.sub(r'(\w+)\s{0,1}\|\s{0,1}/\*\*/(\s*\w+)',
-        r'\1 |\2', output)
-    if old == output:
-      break;
-
   output = re.sub(kPercentEscape, r'%', output)
 
   return output
diff --git a/deps/v8/tools/turbolizer/index.html b/deps/v8/tools/turbolizer/index.html
index f970a6df041476..268e51e0200ec0 100644
--- a/deps/v8/tools/turbolizer/index.html
+++ b/deps/v8/tools/turbolizer/index.html
@@ -9,7 +9,6 @@
   <title>V8 Turbolizer</title>
   <link rel="stylesheet" href="turbo-visualizer.css">
   <link rel="stylesheet" href="tabs.css">
-  <link rel="stylesheet" href="prettify.css">
   <link rel="icon" type="image/png" href="turbolizer.png">
 </head>
 
@@ -25,11 +24,11 @@
   </div>
   <div id="resizer-right" class="resizer"></div>
   <div id="right" class="content"></div>
-  <div id="source-collapse" class="collapse-pane">
+  <div id="show-hide-source" class="show-hide-pane">
     <input id="source-expand" type="image" title="show source" src="right-arrow.png" class="button-input invisible">
     <input id="source-shrink" type="image" title="hide source" src="left-arrow.png" class="button-input">
   </div>
-  <div id="disassembly-collapse" class="collapse-pane">
+  <div id="show-hide-disassembly" class="show-hide-pane">
     <input id="disassembly-expand" type="image" title="show disassembly" src="left-arrow.png" class="button-input invisible">
     <input id="disassembly-shrink" type="image" title="hide disassembly" src="right-arrow.png" class="button-input">
   </div>
@@ -40,7 +39,7 @@
       </text>
     </svg>
   </div>
-  <script src="https://cdn.rawgit.com/google/code-prettify/master/loader/run_prettify.js"></script>
+  <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script>
   <script src="build/turbolizer.js"></script>
 </body>
 </html>
diff --git a/deps/v8/tools/turbolizer/info-view.html b/deps/v8/tools/turbolizer/info-view.html
index dc9c177f6020eb..534860d54adad9 100644
--- a/deps/v8/tools/turbolizer/info-view.html
+++ b/deps/v8/tools/turbolizer/info-view.html
@@ -30,6 +30,22 @@
         <td>/</td>
         <td>Select search box</td>
       </tr>
+      <tr>
+        <td>i</td>
+        <td>Reveal node's input nodes</td>
+      </tr>
+      <tr>
+        <td>o</td>
+        <td>Reveal node's output nodes</td>
+      </tr>
+      <tr>
+        <td>s</td>
+        <td>Hide selected nodes</td>
+      </tr>
+      <tr>
+        <td>u</td>
+        <td>Hide unselected nodes</td>
+      </tr>
     </table>
   </div>
 </div>
@@ -65,21 +81,9 @@
         <td>Select effect output node</td>
       </tr>
       <tr>
-        <td>i</td>
-        <td>Reveal node's input nodes</td>
-      </tr>
-      <tr>
-        <td>o</td>
-        <td>Reveal node's output nodes</td>
-      </tr>
-      <tr>
-        <td>s</td>
+        <td>p</td>
         <td>Select node's origin node</td>
       </tr>
-      <tr>
-        <td>/</td>
-        <td>Select search box</td>
-      </tr>
     </table>
   </div>
 </div>
diff --git a/deps/v8/tools/turbolizer/package-lock.json b/deps/v8/tools/turbolizer/package-lock.json
index e30838aa3b292c..bb53aa7860fb05 100644
--- a/deps/v8/tools/turbolizer/package-lock.json
+++ b/deps/v8/tools/turbolizer/package-lock.json
@@ -11,242 +11,243 @@
       "dev": true
     },
     "@types/d3": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/@types/d3/-/d3-5.5.0.tgz",
-      "integrity": "sha512-Bz9EAhWnaO93jLYSAT13blgzwP5Z0grO5THBOXSMeWHIIFHA7ntJSLpHSCr1kDtQunEZKCYT9OfE+4lYY/PwlA==",
-      "requires": {
-        "@types/d3-array": "*",
-        "@types/d3-axis": "*",
-        "@types/d3-brush": "*",
-        "@types/d3-chord": "*",
-        "@types/d3-collection": "*",
-        "@types/d3-color": "*",
-        "@types/d3-contour": "*",
-        "@types/d3-dispatch": "*",
-        "@types/d3-drag": "*",
-        "@types/d3-dsv": "*",
-        "@types/d3-ease": "*",
-        "@types/d3-fetch": "*",
-        "@types/d3-force": "*",
-        "@types/d3-format": "*",
-        "@types/d3-geo": "*",
-        "@types/d3-hierarchy": "*",
-        "@types/d3-interpolate": "*",
-        "@types/d3-path": "*",
-        "@types/d3-polygon": "*",
-        "@types/d3-quadtree": "*",
-        "@types/d3-random": "*",
-        "@types/d3-scale": "*",
-        "@types/d3-scale-chromatic": "*",
-        "@types/d3-selection": "*",
-        "@types/d3-shape": "*",
-        "@types/d3-time": "*",
-        "@types/d3-time-format": "*",
-        "@types/d3-timer": "*",
-        "@types/d3-transition": "*",
-        "@types/d3-voronoi": "*",
-        "@types/d3-zoom": "*"
+      "version": "5.7.2",
+      "resolved": "https://registry.npmjs.org/@types/d3/-/d3-5.7.2.tgz",
+      "integrity": "sha512-7/wClB8ycneWGy3jdvLfXKTd5SoTg9hji7IdJ0RuO9xTY54YpJ8zlcFADcXhY1J3kCBwxp+/1jeN6a5OMwgYOw==",
+      "requires": {
+        "@types/d3-array": "1.2.7",
+        "@types/d3-axis": "1.0.12",
+        "@types/d3-brush": "1.0.10",
+        "@types/d3-chord": "1.0.9",
+        "@types/d3-collection": "1.0.8",
+        "@types/d3-color": "1.2.2",
+        "@types/d3-contour": "1.3.0",
+        "@types/d3-dispatch": "1.0.7",
+        "@types/d3-drag": "1.2.3",
+        "@types/d3-dsv": "1.0.36",
+        "@types/d3-ease": "1.0.9",
+        "@types/d3-fetch": "1.1.5",
+        "@types/d3-force": "1.2.1",
+        "@types/d3-format": "1.3.1",
+        "@types/d3-geo": "1.11.1",
+        "@types/d3-hierarchy": "1.1.6",
+        "@types/d3-interpolate": "1.3.1",
+        "@types/d3-path": "1.0.8",
+        "@types/d3-polygon": "1.0.7",
+        "@types/d3-quadtree": "1.0.7",
+        "@types/d3-random": "1.1.2",
+        "@types/d3-scale": "2.1.1",
+        "@types/d3-scale-chromatic": "1.3.1",
+        "@types/d3-selection": "1.4.1",
+        "@types/d3-shape": "1.3.2",
+        "@types/d3-time": "1.0.10",
+        "@types/d3-time-format": "2.1.1",
+        "@types/d3-timer": "1.0.9",
+        "@types/d3-transition": "1.1.4",
+        "@types/d3-voronoi": "1.1.9",
+        "@types/d3-zoom": "1.7.4"
       }
     },
     "@types/d3-array": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-1.2.4.tgz",
-      "integrity": "sha512-3r1fOAAb+SGfcOGXty/LGvoP0ovMec4UtGNUyHOSzYyvSGpmt+eNMxLowol/3HryusevznSfcHZebEShXMwsZA=="
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-1.2.7.tgz",
+      "integrity": "sha512-51vHWuUyDOi+8XuwPrTw3cFqyh2Slg9y8COYkRfjCPG9TfYqY0hoNPzv/8BrcAy0FeQBzqEo/D/8Nk2caOQJnA=="
     },
     "@types/d3-axis": {
-      "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/@types/d3-axis/-/d3-axis-1.0.11.tgz",
-      "integrity": "sha512-cuigApCyCwYJxaQPghj+BqaxzbdRdT/lpZBMtF7EuEIJ61NMQ8yvGnqFvHCIgJEmUu2Wb2wiZqy9kiHi3Ddftg==",
+      "version": "1.0.12",
+      "resolved": "https://registry.npmjs.org/@types/d3-axis/-/d3-axis-1.0.12.tgz",
+      "integrity": "sha512-BZISgSD5M8TgURyNtcPAmUB9sk490CO1Thb6/gIn0WZTt3Y50IssX+2Z0vTccoqZksUDTep0b+o4ofXslvNbqg==",
       "requires": {
-        "@types/d3-selection": "*"
+        "@types/d3-selection": "1.4.1"
       }
     },
     "@types/d3-brush": {
-      "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/@types/d3-brush/-/d3-brush-1.0.9.tgz",
-      "integrity": "sha512-mAx8IVc0luUHfk51pl0UN1vzybnAzLMUsvIwLt3fbsqqPkSXr+Pu1AxOPPeyNc27LhHJnfH/LCV7Jlv+Yzqu1A==",
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/@types/d3-brush/-/d3-brush-1.0.10.tgz",
+      "integrity": "sha512-J8jREATIrfJaAfhJivqaEKPnJsRlwwrOPje+ABqZFgamADjll+q9zaDXnYyjiGPPsiJEU+Qq9jQi5rECxIOfhg==",
       "requires": {
-        "@types/d3-selection": "*"
+        "@types/d3-selection": "1.4.1"
       }
     },
     "@types/d3-chord": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/d3-chord/-/d3-chord-1.0.8.tgz",
-      "integrity": "sha512-F0ftYOo7FenAIxsRjXLt8vbij0NLDuVcL+xaGY7R9jUmF2Mrpj1T5XukBI9Cad+Ei7YSxEWREIO+CYcaKCl2qQ=="
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/d3-chord/-/d3-chord-1.0.9.tgz",
+      "integrity": "sha512-UA6lI9CVW5cT5Ku/RV4hxoFn4mKySHm7HEgodtfRthAj1lt9rKZEPon58vyYfk+HIAm33DtJJgZwMXy2QgyPXw=="
     },
     "@types/d3-collection": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-collection/-/d3-collection-1.0.7.tgz",
-      "integrity": "sha512-vR3BT0GwHc5y93Jv6bxn3zoxP/vGu+GdXu/r1ApjbP9dLk9I2g6NiV7iP/QMQSuFZd0It0n/qWrfXHxCWwHIkg=="
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@types/d3-collection/-/d3-collection-1.0.8.tgz",
+      "integrity": "sha512-y5lGlazdc0HNO0F3UUX2DPE7OmYvd9Kcym4hXwrJcNUkDaypR5pX+apuMikl9LfTxKItJsY9KYvzBulpCKyvuQ=="
     },
     "@types/d3-color": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-1.2.1.tgz",
-      "integrity": "sha512-xwb1tqvYNWllbHuhMFhiXk63Imf+QNq/dJdmbXmr2wQVnwGenCuj3/0IWJ9hdIFQIqzvhT7T37cvx93jtAsDbQ=="
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-1.2.2.tgz",
+      "integrity": "sha512-6pBxzJ8ZP3dYEQ4YjQ+NVbQaOflfgXq/JbDiS99oLobM2o72uAST4q6yPxHv6FOTCRC/n35ktuo8pvw/S4M7sw=="
     },
     "@types/d3-contour": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/@types/d3-contour/-/d3-contour-1.3.0.tgz",
       "integrity": "sha512-AUCUIjEnC5lCGBM9hS+MryRaFLIrPls4Rbv6ktqbd+TK/RXZPwOy9rtBWmGpbeXcSOYCJTUDwNJuEnmYPJRxHQ==",
       "requires": {
-        "@types/d3-array": "*",
-        "@types/geojson": "*"
+        "@types/d3-array": "1.2.7",
+        "@types/geojson": "7946.0.7"
       }
     },
     "@types/d3-dispatch": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/@types/d3-dispatch/-/d3-dispatch-1.0.6.tgz",
-      "integrity": "sha512-xyWJQMr832vqhu6fD/YqX+MSFBWnkxasNhcStvlhqygXxj0cKqPft0wuGoH5TIq5ADXgP83qeNVa4R7bEYN3uA=="
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/@types/d3-dispatch/-/d3-dispatch-1.0.7.tgz",
+      "integrity": "sha512-M+z84G7UKwK6hEPnGCSccOg8zJ3Nk2hgDQ9sCstHXgsFU0sMxlIZVKqKB5oxUDbALqQG6ucg0G9e8cmOSlishg=="
     },
     "@types/d3-drag": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/@types/d3-drag/-/d3-drag-1.2.2.tgz",
-      "integrity": "sha512-+UKFeaMVTfSQvMO0PTzOyLXSr7OZbF2Rx1iNVwo2XsyiOsd4MSuLyJKUwRmGn67044QpbNzr+VD6/8iBBLExWw==",
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@types/d3-drag/-/d3-drag-1.2.3.tgz",
+      "integrity": "sha512-rWB5SPvkYVxW3sqUxHOJUZwifD0KqvKwvt1bhNqcLpW6Azsd0BJgRNcyVW8GAferaAk5r8dzeZnf9zKlg9+xMQ==",
       "requires": {
-        "@types/d3-selection": "*"
+        "@types/d3-selection": "1.4.1"
       }
     },
     "@types/d3-dsv": {
-      "version": "1.0.34",
-      "resolved": "https://registry.npmjs.org/@types/d3-dsv/-/d3-dsv-1.0.34.tgz",
-      "integrity": "sha512-/grhPLPFJ17GxH18EB8OSOlqcsLahz1xlKb08cVUu3OP83wBPxfoX2otVvLJDTL6BEP0kyTNsA2SdGrRhWwSBQ=="
+      "version": "1.0.36",
+      "resolved": "https://registry.npmjs.org/@types/d3-dsv/-/d3-dsv-1.0.36.tgz",
+      "integrity": "sha512-jbIWQ27QJcBNMZbQv0NSQMHnBDCmxghAxePxgyiPH1XPCRkOsTBei7jcdi3fDrUCGpCV3lKrSZFSlOkhUQVClA=="
     },
     "@types/d3-ease": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-ease/-/d3-ease-1.0.7.tgz",
-      "integrity": "sha1-k6MBhovp4VBh89RDQ7GrP4rLbwk="
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/d3-ease/-/d3-ease-1.0.9.tgz",
+      "integrity": "sha512-U5ADevQ+W6fy32FVZZC9EXallcV/Mi12A5Tkd0My5MrC7T8soMQEhlDAg88XUWm0zoCQlB4XV0en/24LvuDB4Q=="
     },
     "@types/d3-fetch": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-fetch/-/d3-fetch-1.1.4.tgz",
-      "integrity": "sha512-POR6AHGEjUk8VjHhU2HfcKxVKnZUIhhHjU65greJs34NlfmWfaDxE+6+ABeMsRCAWa/DRTRNe+1ExuMPBwb7/Q==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@types/d3-fetch/-/d3-fetch-1.1.5.tgz",
+      "integrity": "sha512-o9c0ItT5/Gl3wbNuVpzRnYX1t3RghzeWAjHUVLuyZJudiTxC4f/fC0ZPFWLQ2lVY8pAMmxpV8TJ6ETYCgPeI3A==",
       "requires": {
-        "@types/d3-dsv": "*"
+        "@types/d3-dsv": "1.0.36"
       }
     },
     "@types/d3-force": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@types/d3-force/-/d3-force-1.1.1.tgz",
-      "integrity": "sha512-ePkELuaFWY4yOuf+Bvx5Xd+ihFiYG4bdnW0BlvigovIm8Sob2t76e9RGO6lybQbv6AlW9Icn9HuZ9fmdzEoJyg=="
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-force/-/d3-force-1.2.1.tgz",
+      "integrity": "sha512-jqK+I36uz4kTBjyk39meed5y31Ab+tXYN/x1dn3nZEus9yOHCLc+VrcIYLc/aSQ0Y7tMPRlIhLetulME76EiiA=="
     },
     "@types/d3-format": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@types/d3-format/-/d3-format-1.3.0.tgz",
-      "integrity": "sha512-ZiY4j3iJvAdOwzwW24WjlZbUNvqOsnPAMfPBmdXqxj3uKJbrzBlRrdGl5uC89pZpFs9Dc92E81KcwG2uEgkIZA=="
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-format/-/d3-format-1.3.1.tgz",
+      "integrity": "sha512-KAWvReOKMDreaAwOjdfQMm0HjcUMlQG47GwqdVKgmm20vTd2pucj0a70c3gUSHrnsmo6H2AMrkBsZU2UhJLq8A=="
     },
     "@types/d3-geo": {
-      "version": "1.10.3",
-      "resolved": "https://registry.npmjs.org/@types/d3-geo/-/d3-geo-1.10.3.tgz",
-      "integrity": "sha512-hfdaxM2L0wA9mDZrrSf2o+DyhEpnJYCiAN+lHFtpfZOVCQrYBA5g33sGRpUbAvjSMyO5jkHbftMWPEhuCMChSg==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-geo/-/d3-geo-1.11.1.tgz",
+      "integrity": "sha512-Ox8WWOG3igDRoep/dNsGbOiSJYdUG3ew/6z0ETvHyAtXZVBjOE0S96zSSmzgl0gqQ3RdZjn2eeJOj9oRcMZPkQ==",
       "requires": {
-        "@types/geojson": "*"
+        "@types/geojson": "7946.0.7"
       }
     },
     "@types/d3-hierarchy": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@types/d3-hierarchy/-/d3-hierarchy-1.1.5.tgz",
-      "integrity": "sha512-DKhqURrURt2c7MsF9sHiF2wrWf2+yZR4Q9oIG026t/ZY4VWoM0Yd7UonaR+rygyReWcFSEjKC/+5A27TgD8R8g=="
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@types/d3-hierarchy/-/d3-hierarchy-1.1.6.tgz",
+      "integrity": "sha512-vvSaIDf/Ov0o3KwMT+1M8+WbnnlRiGjlGD5uvk83a1mPCTd/E5x12bUJ/oP55+wUY/4Kb5kc67rVpVGJ2KUHxg=="
     },
     "@types/d3-interpolate": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-1.3.0.tgz",
-      "integrity": "sha512-Ng4ds7kPSvP/c3W3J5PPUQlgewif1tGBqCeh5lgY+UG82Y7H9zQ8c2gILsEFDLg7wRGOwnuKZ940Q/LSN14w9w==",
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-1.3.1.tgz",
+      "integrity": "sha512-z8Zmi08XVwe8e62vP6wcA+CNuRhpuUU5XPEfqpG0hRypDE5BWNthQHB1UNWWDB7ojCbGaN4qBdsWp5kWxhT1IQ==",
       "requires": {
-        "@types/d3-color": "*"
+        "@types/d3-color": "1.2.2"
       }
     },
     "@types/d3-path": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-1.0.7.tgz",
-      "integrity": "sha512-U8dFRG+8WhkLJr2sxZ9Cw/5WeRgBnNqMxGdA1+Z0+ZG6tK0s75OQ4OXnxeyfKuh6E4wQPY8OAKr1+iNDx01BEQ=="
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-1.0.8.tgz",
+      "integrity": "sha512-AZGHWslq/oApTAHu9+yH/Bnk63y9oFOMROtqPAtxl5uB6qm1x2lueWdVEjsjjV3Qc2+QfuzKIwIR5MvVBakfzA=="
     },
     "@types/d3-polygon": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/@types/d3-polygon/-/d3-polygon-1.0.6.tgz",
-      "integrity": "sha512-E6Kyodn9JThgLq20nxSbEce9ow5/ePgm9PX2EO6W1INIL4DayM7cFaiG10DStuamjYAd0X4rntW2q+GRjiIktw=="
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/@types/d3-polygon/-/d3-polygon-1.0.7.tgz",
+      "integrity": "sha512-Xuw0eSjQQKs8jTiNbntWH0S+Xp+JyhqxmQ0YAQ3rDu6c3kKMFfgsaGN7Jv5u3zG6yVX/AsLP/Xs/QRjmi9g43Q=="
     },
     "@types/d3-quadtree": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/@types/d3-quadtree/-/d3-quadtree-1.0.6.tgz",
-      "integrity": "sha512-sphVuDdiSIaxLt9kQgebJW98pTktQ/xuN7Ysd8X68Rnjeg/q8+c36/ShlqU52qoKg9nob/JEHH1uQMdxURZidQ=="
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/@types/d3-quadtree/-/d3-quadtree-1.0.7.tgz",
+      "integrity": "sha512-0ajFawWicfjsaCLh6NzxOyVDYhQAmMFbsiI3MPGLInorauHFEh9/Cl6UHNf+kt/J1jfoxKY/ZJaKAoDpbvde5Q=="
     },
     "@types/d3-random": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@types/d3-random/-/d3-random-1.1.1.tgz",
-      "integrity": "sha512-jUPeBq1XKK9/5XasTvy5QAUwFeMsjma2yt/nP02yC2Tijovx7i/W5776U/HZugxc5SSmtpx4Z3g9KFVon0QrjQ=="
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-random/-/d3-random-1.1.2.tgz",
+      "integrity": "sha512-Jui+Zn28pQw/3EayPKaN4c/PqTvqNbIPjHkgIIFnxne1FdwNjfHtAIsZIBMKlquQNrrMjFzCrlF2gPs3xckqaA=="
     },
     "@types/d3-scale": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-2.1.0.tgz",
-      "integrity": "sha512-vLzRDF5lRxZdCLUOvmw90pkiuSsZdgroBQaat0Ov7Z7OnO9iJsPSm/TZw3wW6m2z/NhIn1E4N0RLNfEi1k4kAA==",
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-2.1.1.tgz",
+      "integrity": "sha512-kNTkbZQ+N/Ip8oX9PByXfDLoCSaZYm+VUOasbmsa6KD850/ziMdYepg/8kLg2plHzoLANdMqPoYQbvExevLUHg==",
       "requires": {
-        "@types/d3-time": "*"
+        "@types/d3-time": "1.0.10"
       }
     },
     "@types/d3-scale-chromatic": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@types/d3-scale-chromatic/-/d3-scale-chromatic-1.3.0.tgz",
-      "integrity": "sha512-JqQH5uu1kmdQEa6XSu7NYzQM71lL1YreBPS5o8SnmEDcBRKL6ooykXa8iFPPOEUiTah25ydi+cTrbsogBSMNSQ=="
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-scale-chromatic/-/d3-scale-chromatic-1.3.1.tgz",
+      "integrity": "sha512-Ny3rLbV5tnmqgW7w/poCcef4kXP8mHPo/p8EjTS5d9OUk8MlqAeRaM8eF7Vyv7QMLiIXNE94Pa1cMLSPkXQBoQ=="
     },
     "@types/d3-selection": {
-      "version": "1.3.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-selection/-/d3-selection-1.3.4.tgz",
-      "integrity": "sha512-WQ6Ivy7VuUlZ/Grqc8493ZxC+y/fpvZLy5+8ELvmCr2hll8eJPUqC05l6fgRRA7kjqlpbH7lbmvY6pRKf6yzxw=="
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-selection/-/d3-selection-1.4.1.tgz",
+      "integrity": "sha512-bv8IfFYo/xG6dxri9OwDnK3yCagYPeRIjTlrcdYJSx+FDWlCeBDepIHUpqROmhPtZ53jyna0aUajZRk0I3rXNA=="
     },
     "@types/d3-shape": {
-      "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-1.2.7.tgz",
-      "integrity": "sha512-b2jpGcddOseeNxchaR1SNLqA5xZAbgKix3cXiFeuGeYIEAEUu91UbtelCxOHIUTbNURFnjcbkf4plRbejNzVaQ==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-1.3.2.tgz",
+      "integrity": "sha512-LtD8EaNYCaBRzHzaAiIPrfcL3DdIysc81dkGlQvv7WQP3+YXV7b0JJTtR1U3bzeRieS603KF4wUo+ZkJVenh8w==",
       "requires": {
-        "@types/d3-path": "*"
+        "@types/d3-path": "1.0.8"
       }
     },
     "@types/d3-time": {
-      "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-1.0.9.tgz",
-      "integrity": "sha512-m+D4NbQdDlTVaO7QgXAnatR3IDxQYDMBtRhgSCi5rs9R1LPq1y7/2aqa1FJ2IWjFm1mOV63swDxonnCDlHgHMA=="
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-1.0.10.tgz",
+      "integrity": "sha512-aKf62rRQafDQmSiv1NylKhIMmznsjRN+MnXRXTqHoqm0U/UZzVpdrtRnSIfdiLS616OuC1soYeX1dBg2n1u8Xw=="
     },
     "@types/d3-time-format": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@types/d3-time-format/-/d3-time-format-2.1.0.tgz",
-      "integrity": "sha512-/myT3I7EwlukNOX2xVdMzb8FRgNzRMpsZddwst9Ld/VFe6LyJyRp0s32l/V9XoUzk+Gqu56F/oGk6507+8BxrA=="
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-time-format/-/d3-time-format-2.1.1.tgz",
+      "integrity": "sha512-tJSyXta8ZyJ52wDDHA96JEsvkbL6jl7wowGmuf45+fAkj5Y+SQOnz0N7/H68OWmPshPsAaWMQh+GAws44IzH3g=="
     },
     "@types/d3-timer": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/d3-timer/-/d3-timer-1.0.8.tgz",
-      "integrity": "sha512-AKUgQ/nljUFcUO2P3gK24weVI5XwUTdJvjoh8gJ0yxT4aJ+d7t2Or3TB+k9dEYl14BAjoj32D0ky+YzQSVszfg=="
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/d3-timer/-/d3-timer-1.0.9.tgz",
+      "integrity": "sha512-WvfJ3LFxBbWjqRGz9n7GJt08RrTHPJDVsIwwoCMROlqF+iDacYiAFjf9oqnq0mXpb2juA2N/qjKP+MKdal3YNQ=="
     },
     "@types/d3-transition": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@types/d3-transition/-/d3-transition-1.1.3.tgz",
-      "integrity": "sha512-1EukXNuVu/z2G1GZpZagzFJnie9C5zze17ox/vhTgGXNy46rYAm4UkhLLlUeeZ1ndq88k95SOeC8898RpKMLOQ==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@types/d3-transition/-/d3-transition-1.1.4.tgz",
+      "integrity": "sha512-/vsmKVUIXEyCcIXYAlw7bnYkIs9/J/nZbptRJFKUN3FdXq/dF6j9z9xXzerkyU6TDHLrMrwx9eGwdKyTIy/j9w==",
       "requires": {
-        "@types/d3-selection": "*"
+        "@types/d3-selection": "1.4.1"
       }
     },
     "@types/d3-voronoi": {
-      "version": "1.1.8",
-      "resolved": "https://registry.npmjs.org/@types/d3-voronoi/-/d3-voronoi-1.1.8.tgz",
-      "integrity": "sha512-zqNhW7QsYQGlfOdrwPNPG3Wk64zUa4epKRurkJ/dVc6oeXrB+iTDt8sRZ0KZKOOXvvfa1dcdB0e45TZeLBiodQ=="
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@types/d3-voronoi/-/d3-voronoi-1.1.9.tgz",
+      "integrity": "sha512-DExNQkaHd1F3dFPvGA/Aw2NGyjMln6E9QzsiqOcBgnE+VInYnFBHBBySbZQts6z6xD+5jTfKCP7M4OqMyVjdwQ=="
     },
     "@types/d3-zoom": {
-      "version": "1.7.3",
-      "resolved": "https://registry.npmjs.org/@types/d3-zoom/-/d3-zoom-1.7.3.tgz",
-      "integrity": "sha512-Tz7+z4+Id0MxERw/ozinC5QHJmGLARs9Mpi/7VVfiR+9AHcFGe9q+fjQa30/oPNY8WPuCh5p5uuXmBYAJ3y91Q==",
+      "version": "1.7.4",
+      "resolved": "https://registry.npmjs.org/@types/d3-zoom/-/d3-zoom-1.7.4.tgz",
+      "integrity": "sha512-5jnFo/itYhJeB2khO/lKe730kW/h2EbKMOvY0uNp3+7NdPm4w63DwPEMxifQZ7n902xGYK5DdU67FmToSoy4VA==",
       "requires": {
-        "@types/d3-interpolate": "*",
-        "@types/d3-selection": "*"
+        "@types/d3-interpolate": "1.3.1",
+        "@types/d3-selection": "1.4.1"
       }
     },
     "@types/estree": {
       "version": "0.0.39",
       "resolved": "https://registry.npmjs.org/@types/estree/-/estree-0.0.39.tgz",
-      "integrity": "sha512-EYNwp3bU+98cpU4lAWYYL7Zz+2gryWH1qbdDTidVd6hkiR6weksdbMadyXKXNPEkQFhXM+hVO9ZygomHXp+AIw=="
+      "integrity": "sha512-EYNwp3bU+98cpU4lAWYYL7Zz+2gryWH1qbdDTidVd6hkiR6weksdbMadyXKXNPEkQFhXM+hVO9ZygomHXp+AIw==",
+      "dev": true
     },
     "@types/geojson": {
-      "version": "7946.0.4",
-      "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.4.tgz",
-      "integrity": "sha512-MHmwBtCb7OCv1DSivz2UNJXPGU/1btAWRKlqJ2saEhVJkpkvqHMMaOpKg0v4sAbDWSQekHGvPVMM8nQ+Jen03Q=="
+      "version": "7946.0.7",
+      "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.7.tgz",
+      "integrity": "sha512-wE2v81i4C4Ol09RtsWFAqg3BUitWbHSpSlIo+bNdsCJijO9sjme+zm+73ZMCa/qMC8UEERxzGbvmr1cffo2SiQ=="
     },
     "@types/json5": {
       "version": "0.0.29",
@@ -256,9 +257,10 @@
       "optional": true
     },
     "@types/node": {
-      "version": "10.12.18",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-10.12.18.tgz",
-      "integrity": "sha512-fh+pAqt4xRzPfqA6eh3Z2y6fyZavRIumvjhaCL753+TVkGKGhpPeyrJG2JftD0T9q4GF00KjefsQ+PQNDdWQaQ=="
+      "version": "12.7.12",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.7.12.tgz",
+      "integrity": "sha512-KPYGmfD0/b1eXurQ59fXD1GBzhSQfz6/lKBxkaHX9dKTzjXbK68Zt7yGUxUsCS1jeTy/8aL+d9JEr+S54mpkWQ==",
+      "dev": true
     },
     "JSONStream": {
       "version": "1.3.5",
@@ -266,8 +268,8 @@
       "integrity": "sha512-E+iruNOY8VV9s4JEbe1aNEm6MiszPRr/UfcHMz0TQh1BXSxHK+ASV1R6W4HpjBhSeS+54PIsAMCBmwD06LLsqQ==",
       "dev": true,
       "requires": {
-        "jsonparse": "^1.2.0",
-        "through": ">=2.2.7 <3"
+        "jsonparse": "1.3.1",
+        "through": "2.3.8"
       }
     },
     "accepts": {
@@ -276,7 +278,7 @@
       "integrity": "sha1-63d99gEXI6OxTopywIBcjoZ0a9I=",
       "dev": true,
       "requires": {
-        "mime-types": "~2.1.18",
+        "mime-types": "2.1.21",
         "negotiator": "0.6.1"
       }
     },
@@ -286,7 +288,7 @@
       "integrity": "sha512-v+0wW9Wezwsyb0uF4aBVCjmSqit3Ru7PZFziGF0o2KwTvN2zWfTi3BRLq9EkJFdg3eBbyERXGTntVpBxH1J68Q==",
       "dev": true,
       "requires": {
-        "array-back": "^2.0.0"
+        "array-back": "2.0.0"
       }
     },
     "ansi-regex": {
@@ -301,7 +303,7 @@
       "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
       "dev": true,
       "requires": {
-        "color-convert": "^1.9.0"
+        "color-convert": "1.9.3"
       }
     },
     "any-promise": {
@@ -316,7 +318,7 @@
       "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
       "dev": true,
       "requires": {
-        "sprintf-js": "~1.0.2"
+        "sprintf-js": "1.0.3"
       }
     },
     "argv-tools": {
@@ -325,8 +327,8 @@
       "integrity": "sha512-Cc0dBvx4dvrjjKpyDA6w8RlNAw8Su30NvZbWl/Tv9ZALEVlLVkWQiHMi84Q0xNfpVuSaiQbYkdmWK8g1PLGhKw==",
       "dev": true,
       "requires": {
-        "array-back": "^2.0.0",
-        "find-replace": "^2.0.1"
+        "array-back": "2.0.0",
+        "find-replace": "2.0.1"
       }
     },
     "arr-diff": {
@@ -350,7 +352,7 @@
       "integrity": "sha512-eJv4pLLufP3g5kcZry0j6WXpIbzYw9GUB4mVJZno9wfwiBxbizTnHCw3VJb07cBihbFX48Y7oSrW9y+gt4glyw==",
       "dev": true,
       "requires": {
-        "typical": "^2.6.1"
+        "typical": "2.6.1"
       },
       "dependencies": {
         "typical": {
@@ -400,9 +402,9 @@
       "integrity": "sha1-Y/1D99weO7fONZR9uP42mj9Yx0s=",
       "dev": true,
       "requires": {
-        "chalk": "^1.1.3",
-        "esutils": "^2.0.2",
-        "js-tokens": "^3.0.2"
+        "chalk": "1.1.3",
+        "esutils": "2.0.2",
+        "js-tokens": "3.0.2"
       },
       "dependencies": {
         "ansi-styles": {
@@ -417,11 +419,11 @@
           "integrity": "sha1-qBFcVeSnAv5NFQq9OHKCKn4J/Jg=",
           "dev": true,
           "requires": {
-            "ansi-styles": "^2.2.1",
-            "escape-string-regexp": "^1.0.2",
-            "has-ansi": "^2.0.0",
-            "strip-ansi": "^3.0.0",
-            "supports-color": "^2.0.0"
+            "ansi-styles": "2.2.1",
+            "escape-string-regexp": "1.0.5",
+            "has-ansi": "2.0.0",
+            "strip-ansi": "3.0.1",
+            "supports-color": "2.0.0"
           }
         },
         "supports-color": {
@@ -443,13 +445,13 @@
       "resolved": "https://registry.npmjs.org/base/-/base-0.11.2.tgz",
       "integrity": "sha512-5T6P4xPgpp0YDFvSWwEZ4NoE3aM4QBQXDzmVbraCkFj8zHM+mba8SyqB5DbZWyR7mYHo6Y7BdQo3MoA4m0TeQg==",
       "requires": {
-        "cache-base": "^1.0.1",
-        "class-utils": "^0.3.5",
-        "component-emitter": "^1.2.1",
-        "define-property": "^1.0.0",
-        "isobject": "^3.0.1",
-        "mixin-deep": "^1.2.0",
-        "pascalcase": "^0.1.1"
+        "cache-base": "1.0.1",
+        "class-utils": "0.3.6",
+        "component-emitter": "1.2.1",
+        "define-property": "1.0.0",
+        "isobject": "3.0.1",
+        "mixin-deep": "1.3.2",
+        "pascalcase": "0.1.1"
       },
       "dependencies": {
         "define-property": {
@@ -457,7 +459,7 @@
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-1.0.0.tgz",
           "integrity": "sha1-dp66rz9KY6rTr56NMEybvnm/sOY=",
           "requires": {
-            "is-descriptor": "^1.0.0"
+            "is-descriptor": "1.0.2"
           }
         },
         "is-accessor-descriptor": {
@@ -465,7 +467,7 @@
           "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-1.0.0.tgz",
           "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
           "requires": {
-            "kind-of": "^6.0.0"
+            "kind-of": "6.0.2"
           }
         },
         "is-data-descriptor": {
@@ -473,7 +475,7 @@
           "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-1.0.0.tgz",
           "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
           "requires": {
-            "kind-of": "^6.0.0"
+            "kind-of": "6.0.2"
           }
         },
         "is-descriptor": {
@@ -481,9 +483,9 @@
           "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz",
           "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
           "requires": {
-            "is-accessor-descriptor": "^1.0.0",
-            "is-data-descriptor": "^1.0.0",
-            "kind-of": "^6.0.2"
+            "is-accessor-descriptor": "1.0.0",
+            "is-data-descriptor": "1.0.0",
+            "kind-of": "6.0.2"
           }
         }
       }
@@ -506,7 +508,7 @@
       "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
       "dev": true,
       "requires": {
-        "balanced-match": "^1.0.0",
+        "balanced-match": "1.0.0",
         "concat-map": "0.0.1"
       }
     },
@@ -515,16 +517,16 @@
       "resolved": "https://registry.npmjs.org/braces/-/braces-2.3.2.tgz",
       "integrity": "sha512-aNdbnj9P8PjdXU4ybaWLK2IF3jc/EoDYbC7AazW6to3TRsfXxscC9UXOB5iDiEQrkyIbWp2SLQda4+QAa7nc3w==",
       "requires": {
-        "arr-flatten": "^1.1.0",
-        "array-unique": "^0.3.2",
-        "extend-shallow": "^2.0.1",
-        "fill-range": "^4.0.0",
-        "isobject": "^3.0.1",
-        "repeat-element": "^1.1.2",
-        "snapdragon": "^0.8.1",
-        "snapdragon-node": "^2.0.1",
-        "split-string": "^3.0.2",
-        "to-regex": "^3.0.1"
+        "arr-flatten": "1.1.0",
+        "array-unique": "0.3.2",
+        "extend-shallow": "2.0.1",
+        "fill-range": "4.0.0",
+        "isobject": "3.0.1",
+        "repeat-element": "1.1.3",
+        "snapdragon": "0.8.2",
+        "snapdragon-node": "2.1.1",
+        "split-string": "3.1.0",
+        "to-regex": "3.0.2"
       },
       "dependencies": {
         "extend-shallow": {
@@ -532,7 +534,7 @@
           "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
           "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
           "requires": {
-            "is-extendable": "^0.1.0"
+            "is-extendable": "0.1.1"
           }
         }
       }
@@ -571,15 +573,15 @@
       "resolved": "https://registry.npmjs.org/cache-base/-/cache-base-1.0.1.tgz",
       "integrity": "sha512-AKcdTnFSWATd5/GCPRxr2ChwIJ85CeyrEyjRHlKxQ56d4XJMGym0uAiKn0xbLOGOl3+yRpOTi484dVCEc5AUzQ==",
       "requires": {
-        "collection-visit": "^1.0.0",
-        "component-emitter": "^1.2.1",
-        "get-value": "^2.0.6",
-        "has-value": "^1.0.0",
-        "isobject": "^3.0.1",
-        "set-value": "^2.0.0",
-        "to-object-path": "^0.3.0",
-        "union-value": "^1.0.0",
-        "unset-value": "^1.0.0"
+        "collection-visit": "1.0.0",
+        "component-emitter": "1.2.1",
+        "get-value": "2.0.6",
+        "has-value": "1.0.0",
+        "isobject": "3.0.1",
+        "set-value": "2.0.1",
+        "to-object-path": "0.3.0",
+        "union-value": "1.0.1",
+        "unset-value": "1.0.0"
       }
     },
     "cache-content-type": {
@@ -588,8 +590,8 @@
       "integrity": "sha512-IKufZ1o4Ut42YUrZSo8+qnMTrFuKkvyoLXUywKz9GJ5BrhOFGhLdkx9sG4KAnVvbY6kEcSFjLQul+DVmBm2bgA==",
       "dev": true,
       "requires": {
-        "mime-types": "^2.1.18",
-        "ylru": "^1.2.0"
+        "mime-types": "2.1.21",
+        "ylru": "1.2.1"
       }
     },
     "chai": {
@@ -598,12 +600,12 @@
       "integrity": "sha512-XQU3bhBukrOsQCuwZndwGcCVQHyZi53fQ6Ys1Fym7E4olpIqqZZhhoFJoaKVvV17lWQoXYwgWN2nF5crA8J2jw==",
       "dev": true,
       "requires": {
-        "assertion-error": "^1.1.0",
-        "check-error": "^1.0.2",
-        "deep-eql": "^3.0.1",
-        "get-func-name": "^2.0.0",
-        "pathval": "^1.1.0",
-        "type-detect": "^4.0.5"
+        "assertion-error": "1.1.0",
+        "check-error": "1.0.2",
+        "deep-eql": "3.0.1",
+        "get-func-name": "2.0.0",
+        "pathval": "1.1.0",
+        "type-detect": "4.0.8"
       }
     },
     "chalk": {
@@ -612,9 +614,9 @@
       "integrity": "sha512-ObN6h1v2fTJSmUXoS3nMQ92LbDK9be4TV+6G+omQlGJFdcUX5heKi1LZ1YnRMIgwTLEj3E24bT6tYni50rlCfQ==",
       "dev": true,
       "requires": {
-        "ansi-styles": "^3.2.1",
-        "escape-string-regexp": "^1.0.5",
-        "supports-color": "^5.3.0"
+        "ansi-styles": "3.2.1",
+        "escape-string-regexp": "1.0.5",
+        "supports-color": "5.4.0"
       }
     },
     "check-error": {
@@ -628,10 +630,10 @@
       "resolved": "https://registry.npmjs.org/class-utils/-/class-utils-0.3.6.tgz",
       "integrity": "sha512-qOhPa/Fj7s6TY8H8esGu5QNpMMQxz79h+urzrNYN6mn+9BnxlDGf5QZ+XeCDsxSjPqsSR56XOZOJmpeurnLMeg==",
       "requires": {
-        "arr-union": "^3.1.0",
-        "define-property": "^0.2.5",
-        "isobject": "^3.0.0",
-        "static-extend": "^0.1.1"
+        "arr-union": "3.1.0",
+        "define-property": "0.2.5",
+        "isobject": "3.0.1",
+        "static-extend": "0.1.2"
       },
       "dependencies": {
         "define-property": {
@@ -639,7 +641,7 @@
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
           "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
           "requires": {
-            "is-descriptor": "^0.1.0"
+            "is-descriptor": "0.1.6"
           }
         }
       }
@@ -650,8 +652,8 @@
       "integrity": "sha512-zAvJlR7roeMgpUIhMDYATYL90vz+9ffuyPr0+qq4LzcZ0Jq+gM+H1KdYKxerc6U2nhitiDEx79YiJlXdrooEOA==",
       "dev": true,
       "requires": {
-        "command-line-args": "^5.0.2",
-        "command-line-commands": "^2.0.1"
+        "command-line-args": "5.0.2",
+        "command-line-commands": "2.0.1"
       }
     },
     "co": {
@@ -666,10 +668,10 @@
       "integrity": "sha512-9ZIcixguuuKIptnY8yemEOuhb71L/lLf+Rl5JfJEUiDNJk0e02MBt7BPxR2GEh5mw8dPthQYR4jPI/BnS1MQgw==",
       "dev": true,
       "requires": {
-        "inflation": "^2.0.0",
-        "qs": "^6.5.2",
-        "raw-body": "^2.3.3",
-        "type-is": "^1.6.16"
+        "inflation": "2.0.0",
+        "qs": "6.5.2",
+        "raw-body": "2.3.3",
+        "type-is": "1.6.16"
       }
     },
     "collection-visit": {
@@ -677,8 +679,8 @@
       "resolved": "https://registry.npmjs.org/collection-visit/-/collection-visit-1.0.0.tgz",
       "integrity": "sha1-S8A3PBZLwykbTTaMgpzxqApZ3KA=",
       "requires": {
-        "map-visit": "^1.0.0",
-        "object-visit": "^1.0.0"
+        "map-visit": "1.0.0",
+        "object-visit": "1.0.1"
       }
     },
     "color-convert": {
@@ -702,11 +704,11 @@
       "integrity": "sha512-/qPcbL8zpqg53x4rAaqMFlRV4opN3pbla7I7k9x8kyOBMQoGT6WltjN6sXZuxOXw6DgdK7Ad+ijYS5gjcr7vlA==",
       "dev": true,
       "requires": {
-        "argv-tools": "^0.1.1",
-        "array-back": "^2.0.0",
-        "find-replace": "^2.0.1",
-        "lodash.camelcase": "^4.3.0",
-        "typical": "^2.6.1"
+        "argv-tools": "0.1.1",
+        "array-back": "2.0.0",
+        "find-replace": "2.0.1",
+        "lodash.camelcase": "4.3.0",
+        "typical": "2.6.1"
       },
       "dependencies": {
         "typical": {
@@ -723,7 +725,7 @@
       "integrity": "sha512-m8c2p1DrNd2ruIAggxd/y6DgygQayf6r8RHwchhXryaLF8I6koYjoYroVP+emeROE9DXN5b9sP1Gh+WtvTTdtQ==",
       "dev": true,
       "requires": {
-        "array-back": "^2.0.0"
+        "array-back": "2.0.0"
       }
     },
     "command-line-usage": {
@@ -732,10 +734,10 @@
       "integrity": "sha512-d8NrGylA5oCXSbGoKz05FkehDAzSmIm4K03S5VDh4d5lZAtTWfc3D1RuETtuQCn8129nYfJfDdF7P/lwcz1BlA==",
       "dev": true,
       "requires": {
-        "array-back": "^2.0.0",
-        "chalk": "^2.4.1",
-        "table-layout": "^0.4.3",
-        "typical": "^2.6.1"
+        "array-back": "2.0.0",
+        "chalk": "2.4.1",
+        "table-layout": "0.4.4",
+        "typical": "2.6.1"
       },
       "dependencies": {
         "typical": {
@@ -768,7 +770,7 @@
       "integrity": "sha512-4aE67DL33dSW9gw4CI2H/yTxqHLNcxp0yS6jB+4h+wr3e43+1z7vm0HU9qXOH8j+qjKuL8+UtkOxYQSMq60Ylw==",
       "dev": true,
       "requires": {
-        "mime-db": ">= 1.36.0 < 2"
+        "mime-db": "1.37.0"
       }
     },
     "concat-map": {
@@ -795,8 +797,8 @@
       "integrity": "sha512-J2JjH9T3PUNKPHknprxgCrCaZshIfxW2j49gq1E1CP5Micj1LppWAR2y9EHSQAzEiX84zOsScWNwUZ0b/ChlMw==",
       "dev": true,
       "requires": {
-        "depd": "~1.1.2",
-        "keygrip": "~1.0.2"
+        "depd": "1.1.2",
+        "keygrip": "1.0.3"
       }
     },
     "copy-descriptor": {
@@ -821,37 +823,37 @@
       "resolved": "https://registry.npmjs.org/d3/-/d3-5.7.0.tgz",
       "integrity": "sha512-8KEIfx+dFm8PlbJN9PI0suazrZ41QcaAufsKE9PRcqYPWLngHIyWJZX96n6IQKePGgeSu0l7rtlueSSNq8Zc3g==",
       "requires": {
-        "d3-array": "1",
-        "d3-axis": "1",
-        "d3-brush": "1",
-        "d3-chord": "1",
-        "d3-collection": "1",
-        "d3-color": "1",
-        "d3-contour": "1",
-        "d3-dispatch": "1",
-        "d3-drag": "1",
-        "d3-dsv": "1",
-        "d3-ease": "1",
-        "d3-fetch": "1",
-        "d3-force": "1",
-        "d3-format": "1",
-        "d3-geo": "1",
-        "d3-hierarchy": "1",
-        "d3-interpolate": "1",
-        "d3-path": "1",
-        "d3-polygon": "1",
-        "d3-quadtree": "1",
-        "d3-random": "1",
-        "d3-scale": "2",
-        "d3-scale-chromatic": "1",
-        "d3-selection": "1",
-        "d3-shape": "1",
-        "d3-time": "1",
-        "d3-time-format": "2",
-        "d3-timer": "1",
-        "d3-transition": "1",
-        "d3-voronoi": "1",
-        "d3-zoom": "1"
+        "d3-array": "1.2.4",
+        "d3-axis": "1.0.12",
+        "d3-brush": "1.0.6",
+        "d3-chord": "1.0.6",
+        "d3-collection": "1.0.7",
+        "d3-color": "1.2.3",
+        "d3-contour": "1.3.2",
+        "d3-dispatch": "1.0.5",
+        "d3-drag": "1.2.3",
+        "d3-dsv": "1.0.10",
+        "d3-ease": "1.0.5",
+        "d3-fetch": "1.1.2",
+        "d3-force": "1.1.2",
+        "d3-format": "1.3.2",
+        "d3-geo": "1.11.3",
+        "d3-hierarchy": "1.1.8",
+        "d3-interpolate": "1.3.2",
+        "d3-path": "1.0.7",
+        "d3-polygon": "1.0.5",
+        "d3-quadtree": "1.0.5",
+        "d3-random": "1.1.2",
+        "d3-scale": "2.1.2",
+        "d3-scale-chromatic": "1.3.3",
+        "d3-selection": "1.3.2",
+        "d3-shape": "1.2.2",
+        "d3-time": "1.0.10",
+        "d3-time-format": "2.1.3",
+        "d3-timer": "1.0.9",
+        "d3-transition": "1.1.3",
+        "d3-voronoi": "1.1.4",
+        "d3-zoom": "1.7.3"
       }
     },
     "d3-array": {
@@ -869,11 +871,11 @@
       "resolved": "https://registry.npmjs.org/d3-brush/-/d3-brush-1.0.6.tgz",
       "integrity": "sha512-lGSiF5SoSqO5/mYGD5FAeGKKS62JdA1EV7HPrU2b5rTX4qEJJtpjaGLJngjnkewQy7UnGstnFd3168wpf5z76w==",
       "requires": {
-        "d3-dispatch": "1",
-        "d3-drag": "1",
-        "d3-interpolate": "1",
-        "d3-selection": "1",
-        "d3-transition": "1"
+        "d3-dispatch": "1.0.5",
+        "d3-drag": "1.2.3",
+        "d3-interpolate": "1.3.2",
+        "d3-selection": "1.3.2",
+        "d3-transition": "1.1.3"
       }
     },
     "d3-chord": {
@@ -881,8 +883,8 @@
       "resolved": "https://registry.npmjs.org/d3-chord/-/d3-chord-1.0.6.tgz",
       "integrity": "sha512-JXA2Dro1Fxw9rJe33Uv+Ckr5IrAa74TlfDEhE/jfLOaXegMQFQTAgAw9WnZL8+HxVBRXaRGCkrNU7pJeylRIuA==",
       "requires": {
-        "d3-array": "1",
-        "d3-path": "1"
+        "d3-array": "1.2.4",
+        "d3-path": "1.0.7"
       }
     },
     "d3-collection": {
@@ -900,7 +902,7 @@
       "resolved": "https://registry.npmjs.org/d3-contour/-/d3-contour-1.3.2.tgz",
       "integrity": "sha512-hoPp4K/rJCu0ladiH6zmJUEz6+u3lgR+GSm/QdM2BBvDraU39Vr7YdDCicJcxP1z8i9B/2dJLgDC1NcvlF8WCg==",
       "requires": {
-        "d3-array": "^1.1.1"
+        "d3-array": "1.2.4"
       }
     },
     "d3-dispatch": {
@@ -913,8 +915,8 @@
       "resolved": "https://registry.npmjs.org/d3-drag/-/d3-drag-1.2.3.tgz",
       "integrity": "sha512-8S3HWCAg+ilzjJsNtWW1Mutl74Nmzhb9yU6igspilaJzeZVFktmY6oO9xOh5TDk+BM2KrNFjttZNoJJmDnkjkg==",
       "requires": {
-        "d3-dispatch": "1",
-        "d3-selection": "1"
+        "d3-dispatch": "1.0.5",
+        "d3-selection": "1.3.2"
       }
     },
     "d3-dsv": {
@@ -922,9 +924,9 @@
       "resolved": "https://registry.npmjs.org/d3-dsv/-/d3-dsv-1.0.10.tgz",
       "integrity": "sha512-vqklfpxmtO2ZER3fq/B33R/BIz3A1PV0FaZRuFM8w6jLo7sUX1BZDh73fPlr0s327rzq4H6EN1q9U+eCBCSN8g==",
       "requires": {
-        "commander": "2",
-        "iconv-lite": "0.4",
-        "rw": "1"
+        "commander": "2.15.1",
+        "iconv-lite": "0.4.23",
+        "rw": "1.3.3"
       }
     },
     "d3-ease": {
@@ -937,7 +939,7 @@
       "resolved": "https://registry.npmjs.org/d3-fetch/-/d3-fetch-1.1.2.tgz",
       "integrity": "sha512-S2loaQCV/ZeyTyIF2oP8D1K9Z4QizUzW7cWeAOAS4U88qOt3Ucf6GsmgthuYSdyB2HyEm4CeGvkQxWsmInsIVA==",
       "requires": {
-        "d3-dsv": "1"
+        "d3-dsv": "1.0.10"
       }
     },
     "d3-force": {
@@ -945,10 +947,10 @@
       "resolved": "https://registry.npmjs.org/d3-force/-/d3-force-1.1.2.tgz",
       "integrity": "sha512-p1vcHAUF1qH7yR+e8ip7Bs61AHjLeKkIn8Z2gzwU2lwEf2wkSpWdjXG0axudTHsVFnYGlMkFaEsVy2l8tAg1Gw==",
       "requires": {
-        "d3-collection": "1",
-        "d3-dispatch": "1",
-        "d3-quadtree": "1",
-        "d3-timer": "1"
+        "d3-collection": "1.0.7",
+        "d3-dispatch": "1.0.5",
+        "d3-quadtree": "1.0.5",
+        "d3-timer": "1.0.9"
       }
     },
     "d3-format": {
@@ -961,7 +963,7 @@
       "resolved": "https://registry.npmjs.org/d3-geo/-/d3-geo-1.11.3.tgz",
       "integrity": "sha512-n30yN9qSKREvV2fxcrhmHUdXP9TNH7ZZj3C/qnaoU0cVf/Ea85+yT7HY7i8ySPwkwjCNYtmKqQFTvLFngfkItQ==",
       "requires": {
-        "d3-array": "1"
+        "d3-array": "1.2.4"
       }
     },
     "d3-hierarchy": {
@@ -974,7 +976,7 @@
       "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-1.3.2.tgz",
       "integrity": "sha512-NlNKGopqaz9qM1PXh9gBF1KSCVh+jSFErrSlD/4hybwoNX/gt1d8CDbDW+3i+5UOHhjC6s6nMvRxcuoMVNgL2w==",
       "requires": {
-        "d3-color": "1"
+        "d3-color": "1.2.3"
       }
     },
     "d3-path": {
@@ -1002,12 +1004,12 @@
       "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-2.1.2.tgz",
       "integrity": "sha512-bESpd64ylaKzCDzvULcmHKZTlzA/6DGSVwx7QSDj/EnX9cpSevsdiwdHFYI9ouo9tNBbV3v5xztHS2uFeOzh8Q==",
       "requires": {
-        "d3-array": "^1.2.0",
-        "d3-collection": "1",
-        "d3-format": "1",
-        "d3-interpolate": "1",
-        "d3-time": "1",
-        "d3-time-format": "2"
+        "d3-array": "1.2.4",
+        "d3-collection": "1.0.7",
+        "d3-format": "1.3.2",
+        "d3-interpolate": "1.3.2",
+        "d3-time": "1.0.10",
+        "d3-time-format": "2.1.3"
       }
     },
     "d3-scale-chromatic": {
@@ -1015,8 +1017,8 @@
       "resolved": "https://registry.npmjs.org/d3-scale-chromatic/-/d3-scale-chromatic-1.3.3.tgz",
       "integrity": "sha512-BWTipif1CimXcYfT02LKjAyItX5gKiwxuPRgr4xM58JwlLocWbjPLI7aMEjkcoOQXMkYsmNsvv3d2yl/OKuHHw==",
       "requires": {
-        "d3-color": "1",
-        "d3-interpolate": "1"
+        "d3-color": "1.2.3",
+        "d3-interpolate": "1.3.2"
       }
     },
     "d3-selection": {
@@ -1029,7 +1031,7 @@
       "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-1.2.2.tgz",
       "integrity": "sha512-hUGEozlKecFZ2bOSNt7ENex+4Tk9uc/m0TtTEHBvitCBxUNjhzm5hS2GrrVRD/ae4IylSmxGeqX5tWC2rASMlQ==",
       "requires": {
-        "d3-path": "1"
+        "d3-path": "1.0.7"
       }
     },
     "d3-time": {
@@ -1042,7 +1044,7 @@
       "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-2.1.3.tgz",
       "integrity": "sha512-6k0a2rZryzGm5Ihx+aFMuO1GgelgIz+7HhB4PH4OEndD5q2zGn1mDfRdNrulspOfR6JXkb2sThhDK41CSK85QA==",
       "requires": {
-        "d3-time": "1"
+        "d3-time": "1.0.10"
       }
     },
     "d3-timer": {
@@ -1055,12 +1057,12 @@
       "resolved": "https://registry.npmjs.org/d3-transition/-/d3-transition-1.1.3.tgz",
       "integrity": "sha512-tEvo3qOXL6pZ1EzcXxFcPNxC/Ygivu5NoBY6mbzidATAeML86da+JfVIUzon3dNM6UX6zjDx+xbYDmMVtTSjuA==",
       "requires": {
-        "d3-color": "1",
-        "d3-dispatch": "1",
-        "d3-ease": "1",
-        "d3-interpolate": "1",
-        "d3-selection": "^1.1.0",
-        "d3-timer": "1"
+        "d3-color": "1.2.3",
+        "d3-dispatch": "1.0.5",
+        "d3-ease": "1.0.5",
+        "d3-interpolate": "1.3.2",
+        "d3-selection": "1.3.2",
+        "d3-timer": "1.0.9"
       }
     },
     "d3-voronoi": {
@@ -1073,11 +1075,11 @@
       "resolved": "https://registry.npmjs.org/d3-zoom/-/d3-zoom-1.7.3.tgz",
       "integrity": "sha512-xEBSwFx5Z9T3/VrwDkMt+mr0HCzv7XjpGURJ8lWmIC8wxe32L39eWHIasEe/e7Ox8MPU4p1hvH8PKN2olLzIBg==",
       "requires": {
-        "d3-dispatch": "1",
-        "d3-drag": "1",
-        "d3-interpolate": "1",
-        "d3-selection": "1",
-        "d3-transition": "1"
+        "d3-dispatch": "1.0.5",
+        "d3-drag": "1.2.3",
+        "d3-interpolate": "1.3.2",
+        "d3-selection": "1.3.2",
+        "d3-transition": "1.1.3"
       }
     },
     "debug": {
@@ -1100,7 +1102,7 @@
       "integrity": "sha512-+QeIQyN5ZuO+3Uk5DYh6/1eKO0m0YmJFGNmFHGACpf1ClL1nmlV/p4gNgbl2pJGxgXb4faqo6UE+M5ACEMyVcw==",
       "dev": true,
       "requires": {
-        "type-detect": "^4.0.0"
+        "type-detect": "4.0.8"
       }
     },
     "deep-equal": {
@@ -1133,8 +1135,8 @@
       "resolved": "https://registry.npmjs.org/define-property/-/define-property-2.0.2.tgz",
       "integrity": "sha512-jwK2UV4cnPpbcG7+VRARKTZPUWowwXA8bzH5NP6ud0oeAxyYPuGZUAC7hMugpCdz4BeSZl2Dl9k66CHJ/46ZYQ==",
       "requires": {
-        "is-descriptor": "^1.0.2",
-        "isobject": "^3.0.1"
+        "is-descriptor": "1.0.2",
+        "isobject": "3.0.1"
       },
       "dependencies": {
         "is-accessor-descriptor": {
@@ -1142,7 +1144,7 @@
           "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-1.0.0.tgz",
           "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
           "requires": {
-            "kind-of": "^6.0.0"
+            "kind-of": "6.0.2"
           }
         },
         "is-data-descriptor": {
@@ -1150,7 +1152,7 @@
           "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-1.0.0.tgz",
           "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
           "requires": {
-            "kind-of": "^6.0.0"
+            "kind-of": "6.0.2"
           }
         },
         "is-descriptor": {
@@ -1158,9 +1160,9 @@
           "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz",
           "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
           "requires": {
-            "is-accessor-descriptor": "^1.0.0",
-            "is-data-descriptor": "^1.0.0",
-            "kind-of": "^6.0.2"
+            "is-accessor-descriptor": "1.0.0",
+            "is-data-descriptor": "1.0.0",
+            "kind-of": "6.0.2"
           }
         }
       }
@@ -1241,13 +1243,13 @@
       "resolved": "https://registry.npmjs.org/expand-brackets/-/expand-brackets-2.1.4.tgz",
       "integrity": "sha1-t3c14xXOMPa27/D4OwQVGiJEliI=",
       "requires": {
-        "debug": "^2.3.3",
-        "define-property": "^0.2.5",
-        "extend-shallow": "^2.0.1",
-        "posix-character-classes": "^0.1.0",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.1"
+        "debug": "2.6.9",
+        "define-property": "0.2.5",
+        "extend-shallow": "2.0.1",
+        "posix-character-classes": "0.1.1",
+        "regex-not": "1.0.2",
+        "snapdragon": "0.8.2",
+        "to-regex": "3.0.2"
       },
       "dependencies": {
         "debug": {
@@ -1263,7 +1265,7 @@
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
           "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
           "requires": {
-            "is-descriptor": "^0.1.0"
+            "is-descriptor": "0.1.6"
           }
         },
         "extend-shallow": {
@@ -1271,7 +1273,7 @@
           "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
           "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
           "requires": {
-            "is-extendable": "^0.1.0"
+            "is-extendable": "0.1.1"
           }
         }
       }
@@ -1281,8 +1283,8 @@
       "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-3.0.2.tgz",
       "integrity": "sha1-Jqcarwc7OfshJxcnRhMcJwQCjbg=",
       "requires": {
-        "assign-symbols": "^1.0.0",
-        "is-extendable": "^1.0.1"
+        "assign-symbols": "1.0.0",
+        "is-extendable": "1.0.1"
       },
       "dependencies": {
         "is-extendable": {
@@ -1290,7 +1292,7 @@
           "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-1.0.1.tgz",
           "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
           "requires": {
-            "is-plain-object": "^2.0.4"
+            "is-plain-object": "2.0.4"
           }
         }
       }
@@ -1300,14 +1302,14 @@
       "resolved": "https://registry.npmjs.org/extglob/-/extglob-2.0.4.tgz",
       "integrity": "sha512-Nmb6QXkELsuBr24CJSkilo6UHHgbekK5UiZgfE6UHD3Eb27YC6oD+bhcT+tJ6cl8dmsgdQxnWlcry8ksBIBLpw==",
       "requires": {
-        "array-unique": "^0.3.2",
-        "define-property": "^1.0.0",
-        "expand-brackets": "^2.1.4",
-        "extend-shallow": "^2.0.1",
-        "fragment-cache": "^0.2.1",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.1"
+        "array-unique": "0.3.2",
+        "define-property": "1.0.0",
+        "expand-brackets": "2.1.4",
+        "extend-shallow": "2.0.1",
+        "fragment-cache": "0.2.1",
+        "regex-not": "1.0.2",
+        "snapdragon": "0.8.2",
+        "to-regex": "3.0.2"
       },
       "dependencies": {
         "define-property": {
@@ -1315,7 +1317,7 @@
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-1.0.0.tgz",
           "integrity": "sha1-dp66rz9KY6rTr56NMEybvnm/sOY=",
           "requires": {
-            "is-descriptor": "^1.0.0"
+            "is-descriptor": "1.0.2"
           }
         },
         "extend-shallow": {
@@ -1323,7 +1325,7 @@
           "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
           "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
           "requires": {
-            "is-extendable": "^0.1.0"
+            "is-extendable": "0.1.1"
           }
         },
         "is-accessor-descriptor": {
@@ -1331,7 +1333,7 @@
           "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-1.0.0.tgz",
           "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
           "requires": {
-            "kind-of": "^6.0.0"
+            "kind-of": "6.0.2"
           }
         },
         "is-data-descriptor": {
@@ -1339,7 +1341,7 @@
           "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-1.0.0.tgz",
           "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
           "requires": {
-            "kind-of": "^6.0.0"
+            "kind-of": "6.0.2"
           }
         },
         "is-descriptor": {
@@ -1347,9 +1349,9 @@
           "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz",
           "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
           "requires": {
-            "is-accessor-descriptor": "^1.0.0",
-            "is-data-descriptor": "^1.0.0",
-            "kind-of": "^6.0.2"
+            "is-accessor-descriptor": "1.0.0",
+            "is-data-descriptor": "1.0.0",
+            "kind-of": "6.0.2"
           }
         }
       }
@@ -1359,10 +1361,10 @@
       "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-4.0.0.tgz",
       "integrity": "sha1-1USBHUKPmOsGpj3EAtJAPDKMOPc=",
       "requires": {
-        "extend-shallow": "^2.0.1",
-        "is-number": "^3.0.0",
-        "repeat-string": "^1.6.1",
-        "to-regex-range": "^2.1.0"
+        "extend-shallow": "2.0.1",
+        "is-number": "3.0.0",
+        "repeat-string": "1.6.1",
+        "to-regex-range": "2.1.1"
       },
       "dependencies": {
         "extend-shallow": {
@@ -1370,7 +1372,7 @@
           "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
           "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
           "requires": {
-            "is-extendable": "^0.1.0"
+            "is-extendable": "0.1.1"
           }
         }
       }
@@ -1381,8 +1383,8 @@
       "integrity": "sha512-LzDo3Fpa30FLIBsh6DCDnMN1KW2g4QKkqKmejlImgWY67dDFPX/x9Kh/op/GK522DchQXEvDi/wD48HKW49XOQ==",
       "dev": true,
       "requires": {
-        "array-back": "^2.0.0",
-        "test-value": "^3.0.0"
+        "array-back": "2.0.0",
+        "test-value": "3.0.0"
       }
     },
     "for-in": {
@@ -1395,7 +1397,7 @@
       "resolved": "https://registry.npmjs.org/fragment-cache/-/fragment-cache-0.2.1.tgz",
       "integrity": "sha1-QpD60n8T6Jvn8zeZxrxaCr//DRk=",
       "requires": {
-        "map-cache": "^0.2.2"
+        "map-cache": "0.2.2"
       }
     },
     "fresh": {
@@ -1409,9 +1411,9 @@
       "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-7.0.1.tgz",
       "integrity": "sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==",
       "requires": {
-        "graceful-fs": "^4.1.2",
-        "jsonfile": "^4.0.0",
-        "universalify": "^0.1.0"
+        "graceful-fs": "4.1.15",
+        "jsonfile": "4.0.0",
+        "universalify": "0.1.2"
       }
     },
     "fs.realpath": {
@@ -1437,12 +1439,12 @@
       "integrity": "sha512-MJTUg1kjuLeQCJ+ccE4Vpa6kKVXkPYJ2mOCQyUuKLcLQsdrMCpBPUi8qVE6+YuaJkozeA9NusTAw3hLr8Xe5EQ==",
       "dev": true,
       "requires": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.0.4",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
+        "fs.realpath": "1.0.0",
+        "inflight": "1.0.6",
+        "inherits": "2.0.3",
+        "minimatch": "3.0.4",
+        "once": "1.4.0",
+        "path-is-absolute": "1.0.1"
       }
     },
     "graceful-fs": {
@@ -1462,7 +1464,7 @@
       "integrity": "sha1-NPUEnOHs3ysGSa8+8k5F7TVBbZE=",
       "dev": true,
       "requires": {
-        "ansi-regex": "^2.0.0"
+        "ansi-regex": "2.1.1"
       }
     },
     "has-flag": {
@@ -1476,9 +1478,9 @@
       "resolved": "https://registry.npmjs.org/has-value/-/has-value-1.0.0.tgz",
       "integrity": "sha1-GLKB2lhbHFxR3vJMkw7SmgvmsXc=",
       "requires": {
-        "get-value": "^2.0.6",
-        "has-values": "^1.0.0",
-        "isobject": "^3.0.0"
+        "get-value": "2.0.6",
+        "has-values": "1.0.0",
+        "isobject": "3.0.1"
       }
     },
     "has-values": {
@@ -1486,8 +1488,8 @@
       "resolved": "https://registry.npmjs.org/has-values/-/has-values-1.0.0.tgz",
       "integrity": "sha1-lbC2P+whRmGab+V/51Yo1aOe/k8=",
       "requires": {
-        "is-number": "^3.0.0",
-        "kind-of": "^4.0.0"
+        "is-number": "3.0.0",
+        "kind-of": "4.0.0"
       },
       "dependencies": {
         "kind-of": {
@@ -1495,7 +1497,7 @@
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-4.0.0.tgz",
           "integrity": "sha1-IIE989cSkosgc3hpGkUGb65y3Vc=",
           "requires": {
-            "is-buffer": "^1.1.5"
+            "is-buffer": "1.1.6"
           }
         }
       }
@@ -1512,8 +1514,8 @@
       "integrity": "sha512-tPVv62a6l3BbQoM/N5qo969l0OFxqpnQzNUPeYfTP6Spo4zkgWeDBD1D5thI7sDLg7jCCihXTLB0X8UtdyAy8A==",
       "dev": true,
       "requires": {
-        "deep-equal": "~1.0.1",
-        "http-errors": "~1.7.1"
+        "deep-equal": "1.0.1",
+        "http-errors": "1.7.1"
       }
     },
     "http-errors": {
@@ -1522,10 +1524,10 @@
       "integrity": "sha512-jWEUgtZWGSMba9I1N3gc1HmvpBUaNC9vDdA46yScAdp+C5rdEuKWUBLWTQpW9FwSWSbYYs++b6SDCxf9UEJzfw==",
       "dev": true,
       "requires": {
-        "depd": "~1.1.2",
+        "depd": "1.1.2",
         "inherits": "2.0.3",
         "setprototypeof": "1.1.0",
-        "statuses": ">= 1.5.0 < 2",
+        "statuses": "1.5.0",
         "toidentifier": "1.0.0"
       }
     },
@@ -1534,7 +1536,7 @@
       "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.23.tgz",
       "integrity": "sha512-neyTUVFtahjf0mB3dZT77u+8O0QB89jFdnBkd5P1JgYPbPaia3gXXOVL2fq8VyU2gMMD7SaN7QukTB/pmXYvDA==",
       "requires": {
-        "safer-buffer": ">= 2.1.2 < 3"
+        "safer-buffer": "2.1.2"
       }
     },
     "inflation": {
@@ -1549,8 +1551,8 @@
       "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=",
       "dev": true,
       "requires": {
-        "once": "^1.3.0",
-        "wrappy": "1"
+        "once": "1.4.0",
+        "wrappy": "1.0.2"
       }
     },
     "inherits": {
@@ -1564,7 +1566,7 @@
       "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-0.1.6.tgz",
       "integrity": "sha1-qeEss66Nh2cn7u84Q/igiXtcmNY=",
       "requires": {
-        "kind-of": "^3.0.2"
+        "kind-of": "3.2.2"
       },
       "dependencies": {
         "kind-of": {
@@ -1572,7 +1574,7 @@
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
           "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
           "requires": {
-            "is-buffer": "^1.1.5"
+            "is-buffer": "1.1.6"
           }
         }
       }
@@ -1587,7 +1589,7 @@
       "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-0.1.4.tgz",
       "integrity": "sha1-C17mSDiOLIYCgueT8YVv7D8wG1Y=",
       "requires": {
-        "kind-of": "^3.0.2"
+        "kind-of": "3.2.2"
       },
       "dependencies": {
         "kind-of": {
@@ -1595,7 +1597,7 @@
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
           "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
           "requires": {
-            "is-buffer": "^1.1.5"
+            "is-buffer": "1.1.6"
           }
         }
       }
@@ -1605,9 +1607,9 @@
       "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-0.1.6.tgz",
       "integrity": "sha512-avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==",
       "requires": {
-        "is-accessor-descriptor": "^0.1.6",
-        "is-data-descriptor": "^0.1.4",
-        "kind-of": "^5.0.0"
+        "is-accessor-descriptor": "0.1.6",
+        "is-data-descriptor": "0.1.4",
+        "kind-of": "5.1.0"
       },
       "dependencies": {
         "kind-of": {
@@ -1638,7 +1640,7 @@
       "resolved": "https://registry.npmjs.org/is-number/-/is-number-3.0.0.tgz",
       "integrity": "sha1-JP1iAaR4LPUFYcgQJ2r8fRLXEZU=",
       "requires": {
-        "kind-of": "^3.0.2"
+        "kind-of": "3.2.2"
       },
       "dependencies": {
         "kind-of": {
@@ -1646,7 +1648,7 @@
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
           "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
           "requires": {
-            "is-buffer": "^1.1.5"
+            "is-buffer": "1.1.6"
           }
         }
       }
@@ -1656,7 +1658,7 @@
       "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-2.0.4.tgz",
       "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
       "requires": {
-        "isobject": "^3.0.1"
+        "isobject": "3.0.1"
       }
     },
     "is-windows": {
@@ -1692,8 +1694,8 @@
       "integrity": "sha512-YfbcO7jXDdyj0DGxYVSlSeQNHbD7XPWvrVWeVUujrQEoZzWJIRrCPoyk6kL6IAjAG2IolMK4T0hNUe0HOUs5Jw==",
       "dev": true,
       "requires": {
-        "argparse": "^1.0.7",
-        "esprima": "^4.0.0"
+        "argparse": "1.0.10",
+        "esprima": "4.0.1"
       }
     },
     "json-stringify-safe": {
@@ -1709,7 +1711,7 @@
       "dev": true,
       "optional": true,
       "requires": {
-        "minimist": "^1.2.0"
+        "minimist": "1.2.0"
       }
     },
     "jsonfile": {
@@ -1717,7 +1719,7 @@
       "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-4.0.0.tgz",
       "integrity": "sha1-h3Gq4HmbZAdrdmQPygWPnBDjPss=",
       "requires": {
-        "graceful-fs": "^4.1.6"
+        "graceful-fs": "4.1.15"
       }
     },
     "jsonparse": {
@@ -1743,30 +1745,30 @@
       "integrity": "sha512-n9R5Eex4y0drUeqFTeCIeXyz8wjr2AxBo2Cq8LvmiXbJl4yDA5KIrecMPkhnmgACZnPXMRyCLbJoyLmpM9aFAw==",
       "dev": true,
       "requires": {
-        "accepts": "^1.3.5",
-        "cache-content-type": "^1.0.0",
-        "content-disposition": "~0.5.2",
-        "content-type": "^1.0.4",
-        "cookies": "~0.7.1",
-        "debug": "~3.1.0",
-        "delegates": "^1.0.0",
-        "depd": "^1.1.2",
-        "destroy": "^1.0.4",
-        "error-inject": "^1.0.0",
-        "escape-html": "^1.0.3",
-        "fresh": "~0.5.2",
-        "http-assert": "^1.3.0",
-        "http-errors": "^1.6.3",
-        "is-generator-function": "^1.0.7",
-        "koa-compose": "^4.1.0",
-        "koa-convert": "^1.2.0",
-        "koa-is-json": "^1.0.0",
-        "on-finished": "^2.3.0",
-        "only": "~0.0.2",
-        "parseurl": "^1.3.2",
-        "statuses": "^1.5.0",
-        "type-is": "^1.6.16",
-        "vary": "^1.1.2"
+        "accepts": "1.3.5",
+        "cache-content-type": "1.0.1",
+        "content-disposition": "0.5.2",
+        "content-type": "1.0.4",
+        "cookies": "0.7.2",
+        "debug": "3.1.0",
+        "delegates": "1.0.0",
+        "depd": "1.1.2",
+        "destroy": "1.0.4",
+        "error-inject": "1.0.0",
+        "escape-html": "1.0.3",
+        "fresh": "0.5.2",
+        "http-assert": "1.4.0",
+        "http-errors": "1.7.1",
+        "is-generator-function": "1.0.7",
+        "koa-compose": "4.1.0",
+        "koa-convert": "1.2.0",
+        "koa-is-json": "1.0.0",
+        "on-finished": "2.3.0",
+        "only": "0.0.2",
+        "parseurl": "1.3.2",
+        "statuses": "1.5.0",
+        "type-is": "1.6.16",
+        "vary": "1.1.2"
       }
     },
     "koa-bodyparser": {
@@ -1775,8 +1777,8 @@
       "integrity": "sha512-UIjPAlMZfNYDDe+4zBaOAUKYqkwAGcIU6r2ARf1UOXPAlfennQys5IiShaVeNf7KkVBlf88f2LeLvBFvKylttw==",
       "dev": true,
       "requires": {
-        "co-body": "^6.0.0",
-        "copy-to": "^2.0.1"
+        "co-body": "6.0.0",
+        "copy-to": "2.0.1"
       }
     },
     "koa-compose": {
@@ -1791,10 +1793,10 @@
       "integrity": "sha1-e36ykhuEd0a14SK6n1zYpnHo6jo=",
       "dev": true,
       "requires": {
-        "bytes": "^2.3.0",
-        "compressible": "^2.0.0",
-        "koa-is-json": "^1.0.0",
-        "statuses": "^1.0.0"
+        "bytes": "2.5.0",
+        "compressible": "2.0.15",
+        "koa-is-json": "1.0.0",
+        "statuses": "1.5.0"
       },
       "dependencies": {
         "bytes": {
@@ -1817,8 +1819,8 @@
       "integrity": "sha1-2kCHXfSd4FOQmNFwC1CCDOvNIdA=",
       "dev": true,
       "requires": {
-        "co": "^4.6.0",
-        "koa-compose": "^3.0.0"
+        "co": "4.6.0",
+        "koa-compose": "3.2.1"
       },
       "dependencies": {
         "koa-compose": {
@@ -1827,7 +1829,7 @@
           "integrity": "sha1-qFzLQLfZhtjlo0Wzoazo6rz1Tec=",
           "dev": true,
           "requires": {
-            "any-promise": "^1.1.0"
+            "any-promise": "1.3.0"
           }
         }
       }
@@ -1838,8 +1840,8 @@
       "integrity": "sha1-nvc4Ld1agqsN6xU0FckVg293HT8=",
       "dev": true,
       "requires": {
-        "etag": "^1.3.0",
-        "mz": "^2.1.0"
+        "etag": "1.8.1",
+        "mz": "2.7.0"
       }
     },
     "koa-is-json": {
@@ -1854,8 +1856,8 @@
       "integrity": "sha1-Nq8U5uofXWRtfESihXAcb4Wk/eQ=",
       "dev": true,
       "requires": {
-        "koa-is-json": "1",
-        "streaming-json-stringify": "3"
+        "koa-is-json": "1.0.0",
+        "streaming-json-stringify": "3.1.0"
       }
     },
     "koa-mock-response": {
@@ -1864,9 +1866,9 @@
       "integrity": "sha512-HmybRN1a3WqcSFvf7tycu2YhBIEHeqzm8bwcsShNWGsTgP86coZOpdI8aqYm/1DFsAQMctnpdWrva4rDr1Pibg==",
       "dev": true,
       "requires": {
-        "array-back": "^2.0.0",
-        "path-to-regexp": "^1.7.0",
-        "typical": "^2.6.1"
+        "array-back": "2.0.0",
+        "path-to-regexp": "1.7.0",
+        "typical": "2.6.1"
       },
       "dependencies": {
         "isarray": {
@@ -1898,7 +1900,7 @@
       "integrity": "sha1-CAUuDODYOdPEMXi5CluzQkvvH5k=",
       "dev": true,
       "requires": {
-        "morgan": "^1.6.1"
+        "morgan": "1.9.1"
       }
     },
     "koa-range": {
@@ -1907,7 +1909,7 @@
       "integrity": "sha1-NYjjSWRzqDmhvSZNKkKx2FvX/qw=",
       "dev": true,
       "requires": {
-        "stream-slice": "^0.1.2"
+        "stream-slice": "0.1.2"
       }
     },
     "koa-rewrite-75lb": {
@@ -1942,9 +1944,9 @@
       "integrity": "sha1-dimLmaa8+p44yrb+XHmocz51i84=",
       "dev": true,
       "requires": {
-        "debug": "*",
-        "methods": "~1.1.0",
-        "path-to-regexp": "^1.2.0"
+        "debug": "3.1.0",
+        "methods": "1.1.2",
+        "path-to-regexp": "1.7.0"
       },
       "dependencies": {
         "isarray": {
@@ -1970,10 +1972,10 @@
       "integrity": "sha512-3UetMBdaXSiw24qM2Mx5mKmxLKw5ZTPRjACjfhK6Haca55RKm9hr/uHDrkrxhSl5/S1CKI/RivZVIopiatZuTA==",
       "dev": true,
       "requires": {
-        "debug": "^2.6.3",
-        "http-errors": "^1.6.1",
-        "mz": "^2.6.0",
-        "resolve-path": "^1.4.0"
+        "debug": "2.6.9",
+        "http-errors": "1.7.1",
+        "mz": "2.7.0",
+        "resolve-path": "1.4.0"
       },
       "dependencies": {
         "debug": {
@@ -1993,8 +1995,8 @@
       "integrity": "sha512-JGmxTuPWy4bH7bt6gD/OMWkhprawvRmzJSr8TWKmTL4N7+IMv3s0SedeQi5S4ilxM9Bo6ptkCyXj/7wf+VS5tg==",
       "dev": true,
       "requires": {
-        "debug": "^3.1.0",
-        "koa-send": "^4.1.3"
+        "debug": "3.1.0",
+        "koa-send": "4.1.3"
       }
     },
     "load-module": {
@@ -2003,7 +2005,7 @@
       "integrity": "sha512-FmoAJI/RM4vmvIRk65g/SFCnGQC9BbALY3zy38Z0cMllNnra1+iCdxAf051LVymzE60/FweOo9or9XJiGgFshg==",
       "dev": true,
       "requires": {
-        "array-back": "^2.0.0"
+        "array-back": "2.0.0"
       }
     },
     "local-web-server": {
@@ -2012,24 +2014,24 @@
       "integrity": "sha512-m7Z5zlzZFxMyiK1W8xR5TJMh00Fy9z7Po8vilSQCpeU4LG2VMK667xCkASBUepFR9fPj6heUMBHu9P/TrwDqFw==",
       "dev": true,
       "requires": {
-        "lws": "^1.3.0",
-        "lws-basic-auth": "^0.1.1",
-        "lws-blacklist": "^0.3.0",
-        "lws-body-parser": "^0.2.4",
-        "lws-compress": "^0.2.1",
-        "lws-conditional-get": "^0.3.4",
-        "lws-cors": "^1.0.0",
-        "lws-index": "^0.4.0",
-        "lws-json": "^0.3.2",
-        "lws-log": "^0.3.2",
-        "lws-mime": "^0.2.2",
-        "lws-mock-response": "^0.5.1",
-        "lws-range": "^1.1.0",
-        "lws-request-monitor": "^0.1.5",
-        "lws-rewrite": "^0.4.1",
-        "lws-spa": "^0.3.0",
-        "lws-static": "^0.5.0",
-        "node-version-matches": "^1.0.0"
+        "lws": "1.3.0",
+        "lws-basic-auth": "0.1.1",
+        "lws-blacklist": "0.3.0",
+        "lws-body-parser": "0.2.4",
+        "lws-compress": "0.2.1",
+        "lws-conditional-get": "0.3.4",
+        "lws-cors": "1.0.0",
+        "lws-index": "0.4.0",
+        "lws-json": "0.3.2",
+        "lws-log": "0.3.2",
+        "lws-mime": "0.2.2",
+        "lws-mock-response": "0.5.1",
+        "lws-range": "1.1.0",
+        "lws-request-monitor": "0.1.5",
+        "lws-rewrite": "0.4.1",
+        "lws-spa": "0.3.0",
+        "lws-static": "0.5.0",
+        "node-version-matches": "1.0.0"
       }
     },
     "lodash.assignwith": {
@@ -2068,21 +2070,21 @@
       "integrity": "sha512-2gOJzVtgjg4mA1cyWnzkICR/NLuMD24sbRSwQeVZeVkadp0VOKTlpmnjvA1tQpkb1TGrcOS+N+3vKMJST8tt2w==",
       "dev": true,
       "requires": {
-        "ansi-escape-sequences": "^4.0.0",
-        "array-back": "^2.0.0",
-        "byte-size": "^4.0.3",
-        "cli-commands": "^0.4.0",
-        "command-line-args": "^5.0.2",
-        "command-line-usage": "^5.0.5",
-        "koa": "^2.5.2",
-        "load-module": "^1.0.0",
-        "lodash.assignwith": "^4.2.0",
-        "node-version-matches": "^1.0.0",
-        "opn": "^5.3.0",
-        "reduce-flatten": "^2.0.0",
-        "typical": "^3.0.0",
-        "walk-back": "^3.0.0",
-        "ws": "^5.2.1"
+        "ansi-escape-sequences": "4.0.0",
+        "array-back": "2.0.0",
+        "byte-size": "4.0.4",
+        "cli-commands": "0.4.0",
+        "command-line-args": "5.0.2",
+        "command-line-usage": "5.0.5",
+        "koa": "2.6.1",
+        "load-module": "1.0.0",
+        "lodash.assignwith": "4.2.0",
+        "node-version-matches": "1.0.0",
+        "opn": "5.4.0",
+        "reduce-flatten": "2.0.0",
+        "typical": "3.0.0",
+        "walk-back": "3.0.0",
+        "ws": "5.2.2"
       }
     },
     "lws-basic-auth": {
@@ -2091,7 +2093,7 @@
       "integrity": "sha512-npPpqkOFzJzB9yJ2pGXmiYOswH+0n86ro75WhromeGuNo0GfE18ZLI/VCOVWmBbeXp2pcnPIMUAdkNSgukpAww==",
       "dev": true,
       "requires": {
-        "basic-auth": "^1.1.0"
+        "basic-auth": "1.1.0"
       }
     },
     "lws-blacklist": {
@@ -2100,8 +2102,8 @@
       "integrity": "sha512-ZA8dujYaZwRNMBhgP+oGsZi9tum44Ba6VHsA3JrV1JVrjZ8c65kLaO/41rLBqQDKP3SDPu7dLity4YLwe1FuNQ==",
       "dev": true,
       "requires": {
-        "array-back": "^2.0.0",
-        "path-to-regexp": "^2.2.0"
+        "array-back": "2.0.0",
+        "path-to-regexp": "2.4.0"
       }
     },
     "lws-body-parser": {
@@ -2110,7 +2112,7 @@
       "integrity": "sha512-XKJzbzK97TUsewIPA5J2RpEk7kRoJcL+/Du6JlwzqIq84tWuXMfiT2a4Ncj12+tRWrdY2avV6d8uLhqlHLz1yg==",
       "dev": true,
       "requires": {
-        "koa-bodyparser": "^4.2.0"
+        "koa-bodyparser": "4.2.1"
       }
     },
     "lws-compress": {
@@ -2119,7 +2121,7 @@
       "integrity": "sha512-14++1o6U8upi3DLx9J2O2sFELsijEJF9utoFxSH4Stoo9SdU2Cxw6BtqQTrb9SEA6O6IsApzstdMYnq8floLSg==",
       "dev": true,
       "requires": {
-        "koa-compress": "^2.0.0"
+        "koa-compress": "2.0.0"
       }
     },
     "lws-conditional-get": {
@@ -2128,8 +2130,8 @@
       "integrity": "sha512-6asZSfM747snhdz4xexRllm09pebz8pjYeg2d5khLR53D/OJznZWHsIqW0JGiScJObri2D7+H4z7yRLBjokT7g==",
       "dev": true,
       "requires": {
-        "koa-conditional-get": "^2.0.0",
-        "koa-etag": "^3.0.0"
+        "koa-conditional-get": "2.0.0",
+        "koa-etag": "3.0.0"
       }
     },
     "lws-cors": {
@@ -2138,7 +2140,7 @@
       "integrity": "sha512-4C0m4lvYdAnpAa03tr9AqziB4d8SRPh4beQBuzPiefv7N9/tpVdrl9kgXrUe1hLHhISnVJ5MoOZuZ6wFeMiU4g==",
       "dev": true,
       "requires": {
-        "@koa/cors": "^2.2.1"
+        "@koa/cors": "2.2.2"
       }
     },
     "lws-index": {
@@ -2147,7 +2149,7 @@
       "integrity": "sha512-k+mkqgMSzx1ipzVpaxsAJU4Qe7R1kp1B/u+qC+d1Y3l+auBz+bLcIxL4dYKfaxLqiz0IFwg1dZwGzVm/dd7FFw==",
       "dev": true,
       "requires": {
-        "serve-index-75lb": "^2.0.0"
+        "serve-index-75lb": "2.0.1"
       }
     },
     "lws-json": {
@@ -2156,7 +2158,7 @@
       "integrity": "sha512-ElmCA8hi3GPMfxbtiI015PDHuJovhhcbXX/qTTTifXhopedAzIBzn/rF5dHZHE4k7HQDYfbiaPgPMbmpv9dMvQ==",
       "dev": true,
       "requires": {
-        "koa-json": "^2.0.2"
+        "koa-json": "2.0.2"
       }
     },
     "lws-log": {
@@ -2165,8 +2167,8 @@
       "integrity": "sha512-DRp4bFl4a7hjwR/RjARjhFLEXs8pIeqKbUvojaAl1hhfRBuW2JsDxRSKC+ViQN06CW4Qypg3ZsztMMR8dRO8dA==",
       "dev": true,
       "requires": {
-        "koa-morgan": "^1.0.1",
-        "stream-log-stats": "^2.0.2"
+        "koa-morgan": "1.0.1",
+        "stream-log-stats": "2.0.2"
       }
     },
     "lws-mime": {
@@ -2181,10 +2183,10 @@
       "integrity": "sha512-4R5Q1RmRglC0pqEwywrS5g62aKaLQsteMnShGmWU9aQ/737Bq0/3qbQ3mb8VbMk3lLzo3ZaNZ1DUsPgVvZaXNQ==",
       "dev": true,
       "requires": {
-        "array-back": "^2.0.0",
+        "array-back": "2.0.0",
         "koa-mock-response": "0.2.0",
-        "load-module": "^1.0.0",
-        "reduce-flatten": "^2.0.0"
+        "load-module": "1.0.0",
+        "reduce-flatten": "2.0.0"
       }
     },
     "lws-range": {
@@ -2193,7 +2195,7 @@
       "integrity": "sha512-Mpx6FdO58Z4l6DAXlATsC2zm10QvyGYElQvFd7P1xqUSTPoYG0wAxfjlpqI+Qdb2O7W4Ah21yESVnPEwae3SIw==",
       "dev": true,
       "requires": {
-        "koa-range": "^0.3.0"
+        "koa-range": "0.3.0"
       }
     },
     "lws-request-monitor": {
@@ -2202,7 +2204,7 @@
       "integrity": "sha512-u9eczHPowH17ftUjQ8ysutGDADNZdDD6k8wgFMzOB7/rRq1Is12lTYA4u8pfKZ8C2oyoy+HYsDSrOzTwespTlA==",
       "dev": true,
       "requires": {
-        "byte-size": "^4.0.2"
+        "byte-size": "4.0.4"
       }
     },
     "lws-rewrite": {
@@ -2211,13 +2213,13 @@
       "integrity": "sha512-EHUdbqfdwc4Baa7iXOdG2y815WC040Cing1GwhM9VsBL7lHtZ7zl3EHzjWFv3styoO3qNqZ4W0xCey4hoo/aYg==",
       "dev": true,
       "requires": {
-        "array-back": "^2.0.0",
-        "koa-rewrite-75lb": "^2.1.1",
-        "koa-route": "^3.2.0",
-        "path-to-regexp": "^1.7.0",
-        "req-then": "^0.6.4",
-        "stream-read-all": "^0.1.2",
-        "typical": "^2.6.1"
+        "array-back": "2.0.0",
+        "koa-rewrite-75lb": "2.1.1",
+        "koa-route": "3.2.0",
+        "path-to-regexp": "1.7.0",
+        "req-then": "0.6.4",
+        "stream-read-all": "0.1.2",
+        "typical": "2.6.1"
       },
       "dependencies": {
         "isarray": {
@@ -2249,8 +2251,8 @@
       "integrity": "sha512-8wxZl5dOI/CQsJ6oOG8Y7B4khjlQXfB7GlVkjYFPuOYM+JIw/QzMvezKjKweG0qGePmHJVHWa38+CyololV4aw==",
       "dev": true,
       "requires": {
-        "koa-route": "^3.2.0",
-        "koa-send": "^4.1.3"
+        "koa-route": "3.2.0",
+        "koa-send": "4.1.3"
       }
     },
     "lws-static": {
@@ -2259,7 +2261,7 @@
       "integrity": "sha512-r3QIeJfBox/hSJLSL7TPhNSZsTKE0r4mWYHbGZ+DwrBcKbLt1ljsh5NAtmJpsqCcjYpyOuD/DlsZ0yQY9VI8bA==",
       "dev": true,
       "requires": {
-        "koa-static": "^4.0.2"
+        "koa-static": "4.0.3"
       }
     },
     "make-error": {
@@ -2278,7 +2280,7 @@
       "resolved": "https://registry.npmjs.org/map-visit/-/map-visit-1.0.0.tgz",
       "integrity": "sha1-7Nyo8TFE5mDxtb1B8S80edmN+48=",
       "requires": {
-        "object-visit": "^1.0.0"
+        "object-visit": "1.0.1"
       }
     },
     "media-typer": {
@@ -2298,19 +2300,19 @@
       "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-3.1.10.tgz",
       "integrity": "sha512-MWikgl9n9M3w+bpsY3He8L+w9eF9338xRl8IAO5viDizwSzziFEyUzo2xrrloB64ADbTf8uA8vRqqttDTOmccg==",
       "requires": {
-        "arr-diff": "^4.0.0",
-        "array-unique": "^0.3.2",
-        "braces": "^2.3.1",
-        "define-property": "^2.0.2",
-        "extend-shallow": "^3.0.2",
-        "extglob": "^2.0.4",
-        "fragment-cache": "^0.2.1",
-        "kind-of": "^6.0.2",
-        "nanomatch": "^1.2.9",
-        "object.pick": "^1.3.0",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.2"
+        "arr-diff": "4.0.0",
+        "array-unique": "0.3.2",
+        "braces": "2.3.2",
+        "define-property": "2.0.2",
+        "extend-shallow": "3.0.2",
+        "extglob": "2.0.4",
+        "fragment-cache": "0.2.1",
+        "kind-of": "6.0.2",
+        "nanomatch": "1.2.13",
+        "object.pick": "1.3.0",
+        "regex-not": "1.0.2",
+        "snapdragon": "0.8.2",
+        "to-regex": "3.0.2"
       }
     },
     "mime-db": {
@@ -2325,7 +2327,7 @@
       "integrity": "sha512-3iL6DbwpyLzjR3xHSFNFeb9Nz/M8WDkX33t1GFQnFOllWk8pOrh/LSrB5OXlnlW5P9LH73X6loW/eogc+F5lJg==",
       "dev": true,
       "requires": {
-        "mime-db": "~1.37.0"
+        "mime-db": "1.37.0"
       }
     },
     "minimatch": {
@@ -2334,7 +2336,7 @@
       "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
       "dev": true,
       "requires": {
-        "brace-expansion": "^1.1.7"
+        "brace-expansion": "1.1.11"
       }
     },
     "minimist": {
@@ -2348,8 +2350,8 @@
       "resolved": "https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.2.tgz",
       "integrity": "sha512-WRoDn//mXBiJ1H40rqa3vH0toePwSsGb45iInWlTySa+Uu4k3tYUSxa2v1KqAiLtvlrSzaExqS1gtk96A9zvEA==",
       "requires": {
-        "for-in": "^1.0.2",
-        "is-extendable": "^1.0.1"
+        "for-in": "1.0.2",
+        "is-extendable": "1.0.1"
       },
       "dependencies": {
         "is-extendable": {
@@ -2357,7 +2359,7 @@
           "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-1.0.1.tgz",
           "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
           "requires": {
-            "is-plain-object": "^2.0.4"
+            "is-plain-object": "2.0.4"
           }
         }
       }
@@ -2404,11 +2406,11 @@
       "integrity": "sha512-HQStPIV4y3afTiCYVxirakhlCfGkI161c76kKFca7Fk1JusM//Qeo1ej2XaMniiNeaZklMVrh3vTtIzpzwbpmA==",
       "dev": true,
       "requires": {
-        "basic-auth": "~2.0.0",
+        "basic-auth": "2.0.1",
         "debug": "2.6.9",
-        "depd": "~1.1.2",
-        "on-finished": "~2.3.0",
-        "on-headers": "~1.0.1"
+        "depd": "1.1.2",
+        "on-finished": "2.3.0",
+        "on-headers": "1.0.1"
       },
       "dependencies": {
         "basic-auth": {
@@ -2442,9 +2444,9 @@
       "integrity": "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==",
       "dev": true,
       "requires": {
-        "any-promise": "^1.0.0",
-        "object-assign": "^4.0.1",
-        "thenify-all": "^1.0.0"
+        "any-promise": "1.3.0",
+        "object-assign": "4.1.1",
+        "thenify-all": "1.6.0"
       }
     },
     "nanomatch": {
@@ -2452,17 +2454,17 @@
       "resolved": "https://registry.npmjs.org/nanomatch/-/nanomatch-1.2.13.tgz",
       "integrity": "sha512-fpoe2T0RbHwBTBUOftAfBPaDEi06ufaUai0mE6Yn1kacc3SnTErfb/h+X94VXzI64rKFHYImXSvdwGGCmwOqCA==",
       "requires": {
-        "arr-diff": "^4.0.0",
-        "array-unique": "^0.3.2",
-        "define-property": "^2.0.2",
-        "extend-shallow": "^3.0.2",
-        "fragment-cache": "^0.2.1",
-        "is-windows": "^1.0.2",
-        "kind-of": "^6.0.2",
-        "object.pick": "^1.3.0",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.1"
+        "arr-diff": "4.0.0",
+        "array-unique": "0.3.2",
+        "define-property": "2.0.2",
+        "extend-shallow": "3.0.2",
+        "fragment-cache": "0.2.1",
+        "is-windows": "1.0.2",
+        "kind-of": "6.0.2",
+        "object.pick": "1.3.0",
+        "regex-not": "1.0.2",
+        "snapdragon": "0.8.2",
+        "to-regex": "3.0.2"
       }
     },
     "negotiator": {
@@ -2477,7 +2479,7 @@
       "integrity": "sha512-E1OQnAUB+BvEyNTXTWpUUMAWXYCa7yjiS64djOuTJEkm20yaQfNmWTfx/kvN6nC7fc0GQS182IaefOPxQvpxXg==",
       "dev": true,
       "requires": {
-        "semver": "^5.5.0"
+        "semver": "5.5.0"
       }
     },
     "object-assign": {
@@ -2491,9 +2493,9 @@
       "resolved": "https://registry.npmjs.org/object-copy/-/object-copy-0.1.0.tgz",
       "integrity": "sha1-fn2Fi3gb18mRpBupde04EnVOmYw=",
       "requires": {
-        "copy-descriptor": "^0.1.0",
-        "define-property": "^0.2.5",
-        "kind-of": "^3.0.3"
+        "copy-descriptor": "0.1.1",
+        "define-property": "0.2.5",
+        "kind-of": "3.2.2"
       },
       "dependencies": {
         "define-property": {
@@ -2501,7 +2503,7 @@
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
           "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
           "requires": {
-            "is-descriptor": "^0.1.0"
+            "is-descriptor": "0.1.6"
           }
         },
         "kind-of": {
@@ -2509,7 +2511,7 @@
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
           "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
           "requires": {
-            "is-buffer": "^1.1.5"
+            "is-buffer": "1.1.6"
           }
         }
       }
@@ -2519,7 +2521,7 @@
       "resolved": "https://registry.npmjs.org/object-visit/-/object-visit-1.0.1.tgz",
       "integrity": "sha1-95xEk68MU3e1n+OdOV5BBC3QRbs=",
       "requires": {
-        "isobject": "^3.0.0"
+        "isobject": "3.0.1"
       }
     },
     "object.pick": {
@@ -2527,7 +2529,7 @@
       "resolved": "https://registry.npmjs.org/object.pick/-/object.pick-1.3.0.tgz",
       "integrity": "sha1-h6EKxMFpS9Lhy/U1kaZhQftd10c=",
       "requires": {
-        "isobject": "^3.0.1"
+        "isobject": "3.0.1"
       }
     },
     "on-finished": {
@@ -2551,7 +2553,7 @@
       "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
       "dev": true,
       "requires": {
-        "wrappy": "1"
+        "wrappy": "1.0.2"
       }
     },
     "only": {
@@ -2566,7 +2568,7 @@
       "integrity": "sha512-YF9MNdVy/0qvJvDtunAOzFw9iasOQHpVthTCvGzxt61Il64AYSGdK+rYwld7NAfk9qJ7dt+hymBNSc9LNYS+Sw==",
       "dev": true,
       "requires": {
-        "is-wsl": "^1.1.0"
+        "is-wsl": "1.1.0"
       }
     },
     "parseurl": {
@@ -2638,10 +2640,10 @@
           "integrity": "sha1-i1VoC7S+KDoLW/TqLjhYC+HZMg0=",
           "dev": true,
           "requires": {
-            "depd": "~1.1.2",
+            "depd": "1.1.2",
             "inherits": "2.0.3",
             "setprototypeof": "1.1.0",
-            "statuses": ">= 1.4.0 < 2"
+            "statuses": "1.5.0"
           }
         }
       }
@@ -2652,13 +2654,13 @@
       "integrity": "sha512-tQtKA9WIAhBF3+VLAseyMqZeBjW0AHJoxOtYqSUZNJxauErmLbVm2FW1y+J/YA9dUrAC39ITejlZWhVIwawkKw==",
       "dev": true,
       "requires": {
-        "core-util-is": "~1.0.0",
-        "inherits": "~2.0.3",
-        "isarray": "~1.0.0",
-        "process-nextick-args": "~2.0.0",
-        "safe-buffer": "~5.1.1",
-        "string_decoder": "~1.1.1",
-        "util-deprecate": "~1.0.1"
+        "core-util-is": "1.0.2",
+        "inherits": "2.0.3",
+        "isarray": "1.0.0",
+        "process-nextick-args": "2.0.0",
+        "safe-buffer": "5.1.2",
+        "string_decoder": "1.1.1",
+        "util-deprecate": "1.0.2"
       }
     },
     "reduce-flatten": {
@@ -2672,8 +2674,8 @@
       "resolved": "https://registry.npmjs.org/regex-not/-/regex-not-1.0.2.tgz",
       "integrity": "sha512-J6SDjUgDxQj5NusnOtdFxDwN/+HWykR8GELwctJ7mdqhcyy1xEc4SRFHUXvxTp661YaVKAjfRLZ9cCqS6tn32A==",
       "requires": {
-        "extend-shallow": "^3.0.2",
-        "safe-regex": "^1.1.0"
+        "extend-shallow": "3.0.2",
+        "safe-regex": "1.1.0"
       }
     },
     "repeat-element": {
@@ -2692,11 +2694,11 @@
       "integrity": "sha512-Uf7xsK1qPqPUetESHemNQ7nGtgOxngSFtlcAOOkx0lDAo+XRZpEA9QDrGBdyOfGq4b+a0z/D5gR2VJ+pp/dzBA==",
       "dev": true,
       "requires": {
-        "array-back": "^2.0.0",
-        "defer-promise": "^1.0.1",
-        "lodash.pick": "^4.4.0",
-        "stream-read-all": "^0.1.0",
-        "typical": "^2.6.1"
+        "array-back": "2.0.0",
+        "defer-promise": "1.0.1",
+        "lodash.pick": "4.4.0",
+        "stream-read-all": "0.1.2",
+        "typical": "2.6.1"
       },
       "dependencies": {
         "typical": {
@@ -2712,7 +2714,7 @@
       "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.8.1.tgz",
       "integrity": "sha512-AicPrAC7Qu1JxPCZ9ZgCZlY35QgFnNqc+0LtbRNxnVw4TXvjQ72wnuL9JQcEBgXkI9JM8MsT9kaQoHcpCRJOYA==",
       "requires": {
-        "path-parse": "^1.0.5"
+        "path-parse": "1.0.5"
       }
     },
     "resolve-path": {
@@ -2721,7 +2723,7 @@
       "integrity": "sha1-xL2p9e+y/OZSR4c6s2u02DT+Fvc=",
       "dev": true,
       "requires": {
-        "http-errors": "~1.6.2",
+        "http-errors": "1.6.3",
         "path-is-absolute": "1.0.1"
       },
       "dependencies": {
@@ -2731,10 +2733,10 @@
           "integrity": "sha1-i1VoC7S+KDoLW/TqLjhYC+HZMg0=",
           "dev": true,
           "requires": {
-            "depd": "~1.1.2",
+            "depd": "1.1.2",
             "inherits": "2.0.3",
             "setprototypeof": "1.1.0",
-            "statuses": ">= 1.4.0 < 2"
+            "statuses": "1.5.0"
           }
         }
       }
@@ -2753,9 +2755,10 @@
       "version": "0.68.2",
       "resolved": "https://registry.npmjs.org/rollup/-/rollup-0.68.2.tgz",
       "integrity": "sha512-WgjNCXYv7ZbtStIap1+tz4pd2zwz0XYN//OILwEY6dINIFLVizK1iWdu+ZtUURL/OKnp8Lv2w8FBds8YihzX7Q==",
+      "dev": true,
       "requires": {
         "@types/estree": "0.0.39",
-        "@types/node": "*"
+        "@types/node": "12.7.12"
       }
     },
     "rollup-plugin-node-resolve": {
@@ -2763,9 +2766,9 @@
       "resolved": "https://registry.npmjs.org/rollup-plugin-node-resolve/-/rollup-plugin-node-resolve-4.0.0.tgz",
       "integrity": "sha512-7Ni+/M5RPSUBfUaP9alwYQiIKnKeXCOHiqBpKUl9kwp3jX5ZJtgXAait1cne6pGEVUUztPD6skIKH9Kq9sNtfw==",
       "requires": {
-        "builtin-modules": "^3.0.0",
-        "is-module": "^1.0.0",
-        "resolve": "^1.8.1"
+        "builtin-modules": "3.0.0",
+        "is-module": "1.0.0",
+        "resolve": "1.8.1"
       }
     },
     "rollup-plugin-typescript2": {
@@ -2789,7 +2792,7 @@
           "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.10.0.tgz",
           "integrity": "sha512-3sUr9aq5OfSg2S9pNtPA9hL1FVEAjvfOC4leW0SNf/mpnaakz2a9femSd6LqAww2RaFctwyf1lCqnTHuF1rxDg==",
           "requires": {
-            "path-parse": "^1.0.6"
+            "path-parse": "1.0.6"
           }
         }
       }
@@ -2799,8 +2802,8 @@
       "resolved": "https://registry.npmjs.org/rollup-pluginutils/-/rollup-pluginutils-2.4.1.tgz",
       "integrity": "sha512-wesMQ9/172IJDIW/lYWm0vW0LiKe5Ekjws481R7z9WTRtmO59cqyM/2uUlxvf6yzm/fElFmHUobeQOYz46dZJw==",
       "requires": {
-        "estree-walker": "^0.6.0",
-        "micromatch": "^3.1.10"
+        "estree-walker": "0.6.0",
+        "micromatch": "3.1.10"
       }
     },
     "rw": {
@@ -2819,7 +2822,7 @@
       "resolved": "https://registry.npmjs.org/safe-regex/-/safe-regex-1.1.0.tgz",
       "integrity": "sha1-QKNmnzsHfR6UPURinhV91IAjvy4=",
       "requires": {
-        "ret": "~0.1.10"
+        "ret": "0.1.15"
       }
     },
     "safer-buffer": {
@@ -2839,13 +2842,13 @@
       "integrity": "sha512-/d9r8bqJlFQcwy0a0nb1KnWAA+Mno+V+VaoKocdkbW5aXKRQd/+4bfnRhQRQr6uEoYwTRJ4xgztOyCJvWcpBpQ==",
       "dev": true,
       "requires": {
-        "accepts": "~1.3.4",
+        "accepts": "1.3.5",
         "batch": "0.6.1",
         "debug": "2.6.9",
-        "escape-html": "~1.0.3",
-        "http-errors": "~1.6.2",
-        "mime-types": "~2.1.18",
-        "parseurl": "~1.3.2"
+        "escape-html": "1.0.3",
+        "http-errors": "1.6.3",
+        "mime-types": "2.1.21",
+        "parseurl": "1.3.2"
       },
       "dependencies": {
         "debug": {
@@ -2863,10 +2866,10 @@
           "integrity": "sha1-i1VoC7S+KDoLW/TqLjhYC+HZMg0=",
           "dev": true,
           "requires": {
-            "depd": "~1.1.2",
+            "depd": "1.1.2",
             "inherits": "2.0.3",
             "setprototypeof": "1.1.0",
-            "statuses": ">= 1.4.0 < 2"
+            "statuses": "1.5.0"
           }
         }
       }
@@ -2876,10 +2879,10 @@
       "resolved": "https://registry.npmjs.org/set-value/-/set-value-2.0.1.tgz",
       "integrity": "sha512-JxHc1weCN68wRY0fhCoXpyK55m/XPHafOmK4UWD7m2CI14GMcFypt4w/0+NV5f/ZMby2F6S2wwA7fgynh9gWSw==",
       "requires": {
-        "extend-shallow": "^2.0.1",
-        "is-extendable": "^0.1.1",
-        "is-plain-object": "^2.0.3",
-        "split-string": "^3.0.1"
+        "extend-shallow": "2.0.1",
+        "is-extendable": "0.1.1",
+        "is-plain-object": "2.0.4",
+        "split-string": "3.1.0"
       },
       "dependencies": {
         "extend-shallow": {
@@ -2887,7 +2890,7 @@
           "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
           "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
           "requires": {
-            "is-extendable": "^0.1.0"
+            "is-extendable": "0.1.1"
           }
         }
       }
@@ -2903,14 +2906,14 @@
       "resolved": "https://registry.npmjs.org/snapdragon/-/snapdragon-0.8.2.tgz",
       "integrity": "sha512-FtyOnWN/wCHTVXOMwvSv26d+ko5vWlIDD6zoUJ7LW8vh+ZBC8QdljveRP+crNrtBwioEUWy/4dMtbBjA4ioNlg==",
       "requires": {
-        "base": "^0.11.1",
-        "debug": "^2.2.0",
-        "define-property": "^0.2.5",
-        "extend-shallow": "^2.0.1",
-        "map-cache": "^0.2.2",
-        "source-map": "^0.5.6",
-        "source-map-resolve": "^0.5.0",
-        "use": "^3.1.0"
+        "base": "0.11.2",
+        "debug": "2.6.9",
+        "define-property": "0.2.5",
+        "extend-shallow": "2.0.1",
+        "map-cache": "0.2.2",
+        "source-map": "0.5.7",
+        "source-map-resolve": "0.5.2",
+        "use": "3.1.1"
       },
       "dependencies": {
         "debug": {
@@ -2926,7 +2929,7 @@
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
           "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
           "requires": {
-            "is-descriptor": "^0.1.0"
+            "is-descriptor": "0.1.6"
           }
         },
         "extend-shallow": {
@@ -2934,7 +2937,7 @@
           "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
           "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
           "requires": {
-            "is-extendable": "^0.1.0"
+            "is-extendable": "0.1.1"
           }
         },
         "source-map": {
@@ -2949,9 +2952,9 @@
       "resolved": "https://registry.npmjs.org/snapdragon-node/-/snapdragon-node-2.1.1.tgz",
       "integrity": "sha512-O27l4xaMYt/RSQ5TR3vpWCAB5Kb/czIcqUFOM/C4fYcLnbZUc1PkjTAMjof2pBWaSTwOUd6qUHcFGVGj7aIwnw==",
       "requires": {
-        "define-property": "^1.0.0",
-        "isobject": "^3.0.0",
-        "snapdragon-util": "^3.0.1"
+        "define-property": "1.0.0",
+        "isobject": "3.0.1",
+        "snapdragon-util": "3.0.1"
       },
       "dependencies": {
         "define-property": {
@@ -2959,7 +2962,7 @@
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-1.0.0.tgz",
           "integrity": "sha1-dp66rz9KY6rTr56NMEybvnm/sOY=",
           "requires": {
-            "is-descriptor": "^1.0.0"
+            "is-descriptor": "1.0.2"
           }
         },
         "is-accessor-descriptor": {
@@ -2967,7 +2970,7 @@
           "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-1.0.0.tgz",
           "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
           "requires": {
-            "kind-of": "^6.0.0"
+            "kind-of": "6.0.2"
           }
         },
         "is-data-descriptor": {
@@ -2975,7 +2978,7 @@
           "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-1.0.0.tgz",
           "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
           "requires": {
-            "kind-of": "^6.0.0"
+            "kind-of": "6.0.2"
           }
         },
         "is-descriptor": {
@@ -2983,9 +2986,9 @@
           "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz",
           "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
           "requires": {
-            "is-accessor-descriptor": "^1.0.0",
-            "is-data-descriptor": "^1.0.0",
-            "kind-of": "^6.0.2"
+            "is-accessor-descriptor": "1.0.0",
+            "is-data-descriptor": "1.0.0",
+            "kind-of": "6.0.2"
           }
         }
       }
@@ -2995,7 +2998,7 @@
       "resolved": "https://registry.npmjs.org/snapdragon-util/-/snapdragon-util-3.0.1.tgz",
       "integrity": "sha512-mbKkMdQKsjX4BAL4bRYTj21edOf8cN7XHdYUJEe+Zn99hVEYcMvKPct1IqNe7+AZPirn8BCDOQBHQZknqmKlZQ==",
       "requires": {
-        "kind-of": "^3.2.0"
+        "kind-of": "3.2.2"
       },
       "dependencies": {
         "kind-of": {
@@ -3003,7 +3006,7 @@
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
           "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
           "requires": {
-            "is-buffer": "^1.1.5"
+            "is-buffer": "1.1.6"
           }
         }
       }
@@ -3019,11 +3022,11 @@
       "resolved": "https://registry.npmjs.org/source-map-resolve/-/source-map-resolve-0.5.2.tgz",
       "integrity": "sha512-MjqsvNwyz1s0k81Goz/9vRBe9SZdB09Bdw+/zYyO+3CuPk6fouTaxscHkgtE8jKvf01kVfl8riHzERQ/kefaSA==",
       "requires": {
-        "atob": "^2.1.1",
-        "decode-uri-component": "^0.2.0",
-        "resolve-url": "^0.2.1",
-        "source-map-url": "^0.4.0",
-        "urix": "^0.1.0"
+        "atob": "2.1.2",
+        "decode-uri-component": "0.2.0",
+        "resolve-url": "0.2.1",
+        "source-map-url": "0.4.0",
+        "urix": "0.1.0"
       }
     },
     "source-map-support": {
@@ -3032,8 +3035,8 @@
       "integrity": "sha512-gR6Rw4MvUlYy83vP0vxoVNzM6t8MUXqNuRsuBmBHQDu1Fh6X015FrLdgoDKcNdkwGubozq0P4N0Q37UyFVr1EA==",
       "dev": true,
       "requires": {
-        "buffer-from": "^1.0.0",
-        "source-map": "^0.6.0"
+        "buffer-from": "1.1.1",
+        "source-map": "0.6.1"
       }
     },
     "source-map-url": {
@@ -3046,7 +3049,7 @@
       "resolved": "https://registry.npmjs.org/split-string/-/split-string-3.1.0.tgz",
       "integrity": "sha512-NzNVhJDYpwceVVii8/Hu6DKfD2G+NrQHlS/V/qgv763EYudVwEcMQNxd2lh+0VrUByXN/oJkl5grOhYWvQUYiw==",
       "requires": {
-        "extend-shallow": "^3.0.0"
+        "extend-shallow": "3.0.2"
       }
     },
     "sprintf-js": {
@@ -3060,8 +3063,8 @@
       "resolved": "https://registry.npmjs.org/static-extend/-/static-extend-0.1.2.tgz",
       "integrity": "sha1-YICcOcv/VTNyJv1eC1IPNB8ftcY=",
       "requires": {
-        "define-property": "^0.2.5",
-        "object-copy": "^0.1.0"
+        "define-property": "0.2.5",
+        "object-copy": "0.1.0"
       },
       "dependencies": {
         "define-property": {
@@ -3069,7 +3072,7 @@
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
           "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
           "requires": {
-            "is-descriptor": "^0.1.0"
+            "is-descriptor": "0.1.6"
           }
         }
       }
@@ -3086,13 +3089,13 @@
       "integrity": "sha512-b1LccxXhMlOQQrzSqapQHyZ3UI00QTAv+8VecFgsJz//sGB5LFl/+mkFeWBVVI2/E4DlCT4sGgvLExB/VTVFfA==",
       "dev": true,
       "requires": {
-        "JSONStream": "^1.3.1",
-        "ansi-escape-sequences": "^3.0.0",
-        "byte-size": "^3.0.0",
-        "common-log-format": "~0.1.3",
-        "lodash.throttle": "^4.1.1",
-        "stream-via": "^1.0.3",
-        "table-layout": "~0.4.0"
+        "JSONStream": "1.3.5",
+        "ansi-escape-sequences": "3.0.0",
+        "byte-size": "3.0.0",
+        "common-log-format": "0.1.4",
+        "lodash.throttle": "4.1.1",
+        "stream-via": "1.0.4",
+        "table-layout": "0.4.4"
       },
       "dependencies": {
         "ansi-escape-sequences": {
@@ -3101,7 +3104,7 @@
           "integrity": "sha1-HBg5S2r5t2/5pjUJ+kl2af0s5T4=",
           "dev": true,
           "requires": {
-            "array-back": "^1.0.3"
+            "array-back": "1.0.4"
           }
         },
         "array-back": {
@@ -3110,7 +3113,7 @@
           "integrity": "sha1-ZEun8JX3/898Q7Xw3DnTwfA8Bjs=",
           "dev": true,
           "requires": {
-            "typical": "^2.6.0"
+            "typical": "2.6.1"
           }
         },
         "byte-size": {
@@ -3151,8 +3154,8 @@
       "integrity": "sha1-gCAEN6mTzDnE/gAmO3s7kDrIevU=",
       "dev": true,
       "requires": {
-        "json-stringify-safe": "5",
-        "readable-stream": "2"
+        "json-stringify-safe": "5.0.1",
+        "readable-stream": "2.3.6"
       }
     },
     "string_decoder": {
@@ -3161,7 +3164,7 @@
       "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
       "dev": true,
       "requires": {
-        "safe-buffer": "~5.1.0"
+        "safe-buffer": "5.1.2"
       }
     },
     "strip-ansi": {
@@ -3170,7 +3173,7 @@
       "integrity": "sha1-ajhfuIU9lS1f8F0Oiq+UJ43GPc8=",
       "dev": true,
       "requires": {
-        "ansi-regex": "^2.0.0"
+        "ansi-regex": "2.1.1"
       }
     },
     "strip-bom": {
@@ -3186,7 +3189,7 @@
       "integrity": "sha512-zjaXglF5nnWpsq470jSv6P9DwPvgLkuapYmfDm3JWOm0vkNTVF2tI4UrN2r6jH1qM/uc/WtxYY1hYoA2dOKj5w==",
       "dev": true,
       "requires": {
-        "has-flag": "^3.0.0"
+        "has-flag": "3.0.0"
       }
     },
     "table-layout": {
@@ -3195,11 +3198,11 @@
       "integrity": "sha512-uNaR3SRMJwfdp9OUr36eyEi6LLsbcTqTO/hfTsNviKsNeyMBPICJCC7QXRF3+07bAP6FRwA8rczJPBqXDc0CkQ==",
       "dev": true,
       "requires": {
-        "array-back": "^2.0.0",
-        "deep-extend": "~0.6.0",
-        "lodash.padend": "^4.6.1",
-        "typical": "^2.6.1",
-        "wordwrapjs": "^3.0.0"
+        "array-back": "2.0.0",
+        "deep-extend": "0.6.0",
+        "lodash.padend": "4.6.1",
+        "typical": "2.6.1",
+        "wordwrapjs": "3.0.0"
       },
       "dependencies": {
         "typical": {
@@ -3216,8 +3219,8 @@
       "integrity": "sha512-sVACdAWcZkSU9x7AOmJo5TqE+GyNJknHaHsMrR6ZnhjVlVN9Yx6FjHrsKZ3BjIpPCT68zYesPWkakrNupwfOTQ==",
       "dev": true,
       "requires": {
-        "array-back": "^2.0.0",
-        "typical": "^2.6.1"
+        "array-back": "2.0.0",
+        "typical": "2.6.1"
       },
       "dependencies": {
         "typical": {
@@ -3234,7 +3237,7 @@
       "integrity": "sha1-5p44obq+lpsBCCB5eLn2K4hgSDk=",
       "dev": true,
       "requires": {
-        "any-promise": "^1.0.0"
+        "any-promise": "1.3.0"
       }
     },
     "thenify-all": {
@@ -3243,7 +3246,7 @@
       "integrity": "sha1-GhkY1ALY/D+Y+/I02wvMjMEOlyY=",
       "dev": true,
       "requires": {
-        "thenify": ">= 3.1.0 < 4"
+        "thenify": "3.3.0"
       }
     },
     "through": {
@@ -3257,7 +3260,7 @@
       "resolved": "https://registry.npmjs.org/to-object-path/-/to-object-path-0.3.0.tgz",
       "integrity": "sha1-KXWIt7Dn4KwI4E5nL4XB9JmeF68=",
       "requires": {
-        "kind-of": "^3.0.2"
+        "kind-of": "3.2.2"
       },
       "dependencies": {
         "kind-of": {
@@ -3265,7 +3268,7 @@
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
           "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
           "requires": {
-            "is-buffer": "^1.1.5"
+            "is-buffer": "1.1.6"
           }
         }
       }
@@ -3275,10 +3278,10 @@
       "resolved": "https://registry.npmjs.org/to-regex/-/to-regex-3.0.2.tgz",
       "integrity": "sha512-FWtleNAtZ/Ki2qtqej2CXTOayOH9bHDQF+Q48VpWyDXjbYxA4Yz8iDB31zXOBUlOHHKidDbqGVrTUvQMPmBGBw==",
       "requires": {
-        "define-property": "^2.0.2",
-        "extend-shallow": "^3.0.2",
-        "regex-not": "^1.0.2",
-        "safe-regex": "^1.1.0"
+        "define-property": "2.0.2",
+        "extend-shallow": "3.0.2",
+        "regex-not": "1.0.2",
+        "safe-regex": "1.1.0"
       }
     },
     "to-regex-range": {
@@ -3286,8 +3289,8 @@
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-2.1.1.tgz",
       "integrity": "sha1-fIDBe53+vlmeJzZ+DU3VWQFB2zg=",
       "requires": {
-        "is-number": "^3.0.0",
-        "repeat-string": "^1.6.1"
+        "is-number": "3.0.0",
+        "repeat-string": "1.6.1"
       }
     },
     "toidentifier": {
@@ -3303,7 +3306,7 @@
       "dev": true,
       "requires": {
         "ts-node": "7.0.0",
-        "tsconfig-paths": "^3.5.0"
+        "tsconfig-paths": "3.6.0"
       }
     },
     "ts-node": {
@@ -3312,14 +3315,14 @@
       "integrity": "sha512-klJsfswHP0FuOLsvBZ/zzCfUvakOSSxds78mVeK7I+qP76YWtxf16hEZsp3U+b0kIo82R5UatGFeblYMqabb2Q==",
       "dev": true,
       "requires": {
-        "arrify": "^1.0.0",
-        "buffer-from": "^1.1.0",
-        "diff": "^3.1.0",
-        "make-error": "^1.1.1",
-        "minimist": "^1.2.0",
-        "mkdirp": "^0.5.1",
-        "source-map-support": "^0.5.6",
-        "yn": "^2.0.0"
+        "arrify": "1.0.1",
+        "buffer-from": "1.1.1",
+        "diff": "3.5.0",
+        "make-error": "1.3.5",
+        "minimist": "1.2.0",
+        "mkdirp": "0.5.1",
+        "source-map-support": "0.5.9",
+        "yn": "2.0.0"
       }
     },
     "tsconfig-paths": {
@@ -3329,11 +3332,11 @@
       "dev": true,
       "optional": true,
       "requires": {
-        "@types/json5": "^0.0.29",
-        "deepmerge": "^2.0.1",
-        "json5": "^1.0.1",
-        "minimist": "^1.2.0",
-        "strip-bom": "^3.0.0"
+        "@types/json5": "0.0.29",
+        "deepmerge": "2.2.1",
+        "json5": "1.0.1",
+        "minimist": "1.2.0",
+        "strip-bom": "3.0.0"
       }
     },
     "tslib": {
@@ -3347,18 +3350,18 @@
       "integrity": "sha512-CKEcH1MHUBhoV43SA/Jmy1l24HJJgI0eyLbBNSRyFlsQvb9v6Zdq+Nz2vEOH00nC5SUx4SneJ59PZUS/ARcokQ==",
       "dev": true,
       "requires": {
-        "babel-code-frame": "^6.22.0",
-        "builtin-modules": "^1.1.1",
-        "chalk": "^2.3.0",
-        "commander": "^2.12.1",
-        "diff": "^3.2.0",
-        "glob": "^7.1.1",
-        "js-yaml": "^3.7.0",
-        "minimatch": "^3.0.4",
-        "resolve": "^1.3.2",
-        "semver": "^5.3.0",
-        "tslib": "^1.8.0",
-        "tsutils": "^2.27.2"
+        "babel-code-frame": "6.26.0",
+        "builtin-modules": "1.1.1",
+        "chalk": "2.4.1",
+        "commander": "2.15.1",
+        "diff": "3.5.0",
+        "glob": "7.1.2",
+        "js-yaml": "3.13.1",
+        "minimatch": "3.0.4",
+        "resolve": "1.8.1",
+        "semver": "5.5.0",
+        "tslib": "1.9.3",
+        "tsutils": "2.29.0"
       },
       "dependencies": {
         "builtin-modules": {
@@ -3375,7 +3378,7 @@
       "integrity": "sha512-g5JVHCIJwzfISaXpXE1qvNalca5Jwob6FjI4AoPlqMusJ6ftFE7IkkFoMhVLRgK+4Kx3gkzb8UZK5t5yTTvEmA==",
       "dev": true,
       "requires": {
-        "tslib": "^1.8.1"
+        "tslib": "1.9.3"
       }
     },
     "type-detect": {
@@ -3391,7 +3394,7 @@
       "dev": true,
       "requires": {
         "media-typer": "0.3.0",
-        "mime-types": "~2.1.18"
+        "mime-types": "2.1.21"
       }
     },
     "typescript": {
@@ -3411,10 +3414,10 @@
       "resolved": "https://registry.npmjs.org/union-value/-/union-value-1.0.1.tgz",
       "integrity": "sha512-tJfXmxMeWYnczCVs7XAEvIV7ieppALdyepWMkHkwciRpZraG/xwT+s2JN8+pr1+8jCRf80FFzvr+MpQeeoF4Xg==",
       "requires": {
-        "arr-union": "^3.1.0",
-        "get-value": "^2.0.6",
-        "is-extendable": "^0.1.1",
-        "set-value": "^2.0.1"
+        "arr-union": "3.1.0",
+        "get-value": "2.0.6",
+        "is-extendable": "0.1.1",
+        "set-value": "2.0.1"
       }
     },
     "universalify": {
@@ -3433,8 +3436,8 @@
       "resolved": "https://registry.npmjs.org/unset-value/-/unset-value-1.0.0.tgz",
       "integrity": "sha1-g3aHP30jNRef+x5vw6jtDfyKtVk=",
       "requires": {
-        "has-value": "^0.3.1",
-        "isobject": "^3.0.0"
+        "has-value": "0.3.1",
+        "isobject": "3.0.1"
       },
       "dependencies": {
         "has-value": {
@@ -3442,9 +3445,9 @@
           "resolved": "https://registry.npmjs.org/has-value/-/has-value-0.3.1.tgz",
           "integrity": "sha1-ex9YutpiyoJ+wKIHgCVlSEWZXh8=",
           "requires": {
-            "get-value": "^2.0.3",
-            "has-values": "^0.1.4",
-            "isobject": "^2.0.0"
+            "get-value": "2.0.6",
+            "has-values": "0.1.4",
+            "isobject": "2.1.0"
           },
           "dependencies": {
             "isobject": {
@@ -3498,8 +3501,8 @@
       "integrity": "sha512-mO8XtqyPvykVCsrwj5MlOVWvSnCdT+C+QVbm6blradR7JExAhbkZ7hZ9A+9NUtwzSqrlUo9a67ws0EiILrvRpw==",
       "dev": true,
       "requires": {
-        "reduce-flatten": "^1.0.1",
-        "typical": "^2.6.1"
+        "reduce-flatten": "1.0.1",
+        "typical": "2.6.1"
       },
       "dependencies": {
         "reduce-flatten": {
@@ -3528,7 +3531,7 @@
       "integrity": "sha512-jaHFD6PFv6UgoIVda6qZllptQsMlDEJkTQcybzzXDYM1XO9Y8em691FGMPmM46WGyLU4z9KMgQN+qrux/nhlHA==",
       "dev": true,
       "requires": {
-        "async-limiter": "~1.0.0"
+        "async-limiter": "1.0.0"
       }
     },
     "ylru": {
diff --git a/deps/v8/tools/turbolizer/package.json b/deps/v8/tools/turbolizer/package.json
index 2213fe3f6ad74c..dee28358d4b487 100644
--- a/deps/v8/tools/turbolizer/package.json
+++ b/deps/v8/tools/turbolizer/package.json
@@ -13,9 +13,8 @@
   "author": "The V8 team",
   "license": "MIT",
   "dependencies": {
-    "@types/d3": "^5.5.0",
+    "@types/d3": "^5.7.2",
     "d3": "^5.7.0",
-    "rollup": "^0.68.2",
     "rollup-plugin-node-resolve": "^4.0.0",
     "rollup-plugin-typescript2": "^0.20.1"
   },
@@ -27,8 +26,9 @@
     "chai": "^4.2.0",
     "local-web-server": "^2.6.0",
     "mocha": "^5.2.0",
+    "rollup": "^0.68.2",
     "ts-mocha": "^2.0.0",
-    "typescript": "^3.2.2",
-    "tslint": "^5.12.0"
+    "tslint": "^5.12.0",
+    "typescript": "^3.2.2"
   }
 }
diff --git a/deps/v8/tools/turbolizer/src/code-view.ts b/deps/v8/tools/turbolizer/src/code-view.ts
index 298f08b01d711f..ab0af14e060fb1 100644
--- a/deps/v8/tools/turbolizer/src/code-view.ts
+++ b/deps/v8/tools/turbolizer/src/code-view.ts
@@ -2,6 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+interface PR {
+  prettyPrint(_: unknown, el: HTMLElement): void;
+}
+
+declare global {
+  const PR: PR;
+}
+
 import { Source, SourceResolver, sourcePositionToStringKey } from "../src/source-resolver";
 import { SelectionBroker } from "../src/selection-broker";
 import { View } from "../src/view";
diff --git a/deps/v8/tools/turbolizer/src/constants.ts b/deps/v8/tools/turbolizer/src/constants.ts
index 1551d486eb6f06..ada39ae6b3b203 100644
--- a/deps/v8/tools/turbolizer/src/constants.ts
+++ b/deps/v8/tools/turbolizer/src/constants.ts
@@ -14,8 +14,6 @@ export const GENERATED_PANE_ID = 'right';
 export const DISASSEMBLY_PANE_ID = 'disassembly';
 export const DISASSEMBLY_COLLAPSE_ID = 'disassembly-shrink';
 export const DISASSEMBLY_EXPAND_ID = 'disassembly-expand';
-export const COLLAPSE_PANE_BUTTON_VISIBLE = 'button-input';
-export const COLLAPSE_PANE_BUTTON_INVISIBLE = 'button-input-invisible';
 export const UNICODE_BLOCK = '&#9611;';
 export const PROF_COLS = [
   { perc: 0, col: { r: 255, g: 255, b: 255 } },
diff --git a/deps/v8/tools/turbolizer/src/graph-view.ts b/deps/v8/tools/turbolizer/src/graph-view.ts
index 07e0d7f1eb3da8..3cb5e6fbc22259 100644
--- a/deps/v8/tools/turbolizer/src/graph-view.ts
+++ b/deps/v8/tools/turbolizer/src/graph-view.ts
@@ -71,7 +71,6 @@ export class GraphView extends PhaseView {
     // Listen for key events. Note that the focus handler seems
     // to be important even if it does nothing.
     svg
-      .attr("focusable", false)
       .on("focus", e => { })
       .on("keydown", e => { view.svgKeyDown(); });
 
@@ -385,6 +384,7 @@ export class GraphView extends PhaseView {
     graph.layoutGraph();
     graph.updateGraphVisibility();
     graph.viewWholeGraph();
+    graph.focusOnSvg();
   }
 
   showAllAction(view: GraphView) {
@@ -396,6 +396,7 @@ export class GraphView extends PhaseView {
     });
     view.updateGraphVisibility();
     view.viewWholeGraph();
+    view.focusOnSvg();
   }
 
   showControlAction(view: GraphView) {
@@ -407,6 +408,7 @@ export class GraphView extends PhaseView {
     });
     view.updateGraphVisibility();
     view.viewWholeGraph();
+    view.focusOnSvg();
   }
 
   toggleHideDead(view: GraphView) {
@@ -418,6 +420,7 @@ export class GraphView extends PhaseView {
     }
     const element = document.getElementById('toggle-hide-dead');
     element.classList.toggle('button-input-toggled', view.state.hideDead);
+    view.focusOnSvg();
   }
 
   hideDead() {
@@ -446,6 +449,7 @@ export class GraphView extends PhaseView {
       }
     }
     view.updateGraphVisibility();
+    view.focusOnSvg();
   }
 
   hideSelectedAction(view: GraphView) {
@@ -455,14 +459,17 @@ export class GraphView extends PhaseView {
       }
     }
     view.selectionHandler.clear();
+    view.focusOnSvg();
   }
 
   zoomSelectionAction(view: GraphView) {
     view.viewSelection();
+    view.focusOnSvg();
   }
 
   toggleTypesAction(view: GraphView) {
     view.toggleTypes();
+    view.focusOnSvg();
   }
 
   searchInputAction(searchBar: HTMLInputElement, e: KeyboardEvent, onlyVisible: boolean) {
@@ -493,10 +500,15 @@ export class GraphView extends PhaseView {
       this.updateGraphVisibility();
       searchBar.blur();
       this.viewSelection();
+      this.focusOnSvg();
     }
     e.stopPropagation();
   }
 
+  focusOnSvg() {
+    (document.getElementById("graph").childNodes[0] as HTMLElement).focus();
+  }
+
   svgKeyDown() {
     const view = this;
     const state = this.state;
@@ -587,13 +599,29 @@ export class GraphView extends PhaseView {
           eventHandled = false;
         }
         break;
-      case 83:
-        // 's'
+      case 80:
+        // 'p'
         view.selectOrigins();
         break;
       default:
         eventHandled = false;
         break;
+      case 83:
+        // 's'
+        if (!d3.event.ctrlKey && !d3.event.shiftKey) {
+          this.hideSelectedAction(this);
+        } else {
+          eventHandled = false;
+        }
+        break;
+      case 85:
+        // 'u'
+        if (!d3.event.ctrlKey && !d3.event.shiftKey) {
+          this.hideUnselectedAction(this);
+        } else {
+          eventHandled = false;
+        }
+        break;
     }
     if (eventHandled) {
       d3.event.preventDefault();
@@ -915,11 +943,10 @@ export class GraphView extends PhaseView {
     const dy = maxY - minY;
     const x = (minX + maxX) / 2;
     const y = (minY + maxY) / 2;
-    const scale = Math.min(width / (1.1 * dx), height / (1.1 * dy));
+    const scale = Math.min(width / dx, height / dy) * 0.9;
     this.svg
-      .transition().duration(300).call(this.panZoom.translateTo, x, y)
-      .transition().duration(300).call(this.panZoom.scaleTo, scale)
-      .transition().duration(300).call(this.panZoom.translateTo, x, y);
+      .transition().duration(120).call(this.panZoom.scaleTo, scale)
+      .transition().duration(120).call(this.panZoom.translateTo, x, y);
   }
 
   viewWholeGraph() {
diff --git a/deps/v8/tools/turbolizer/src/graphmultiview.ts b/deps/v8/tools/turbolizer/src/graphmultiview.ts
index 43ec418ee0ad6a..380f7df77db0a2 100644
--- a/deps/v8/tools/turbolizer/src/graphmultiview.ts
+++ b/deps/v8/tools/turbolizer/src/graphmultiview.ts
@@ -33,6 +33,7 @@ export class GraphMultiView extends View {
   createViewElement() {
     const pane = document.createElement("div");
     pane.setAttribute("id", multiviewID);
+    pane.setAttribute("tabindex", "1");
     pane.className = "viewpane";
     return pane;
   }
@@ -106,7 +107,6 @@ export class GraphMultiView extends View {
   displayPhaseView(view: PhaseView, data, selection?: Set<any>) {
     const rememberedSelection = selection ? selection : this.hideCurrentPhase();
     view.initializeContent(data, rememberedSelection);
-    this.divNode.classList.toggle("scrollable", view.isScrollable());
     this.currentPhaseView = view;
   }
 
diff --git a/deps/v8/tools/turbolizer/src/resizer.ts b/deps/v8/tools/turbolizer/src/resizer.ts
index ec2d68c0e2ccbe..4bd771f73136a1 100644
--- a/deps/v8/tools/turbolizer/src/resizer.ts
+++ b/deps/v8/tools/turbolizer/src/resizer.ts
@@ -19,19 +19,23 @@ class Snapper {
     this.disassemblyExpand = document.getElementById(C.DISASSEMBLY_EXPAND_ID);
     this.disassemblyCollapse = document.getElementById(C.DISASSEMBLY_COLLAPSE_ID);
 
-    document.getElementById("source-collapse").addEventListener("click", () => {
+    document.getElementById("show-hide-source").addEventListener("click", () => {
+      this.resizer.resizerLeft.classed("snapped", !this.resizer.resizerLeft.classed("snapped"));
       this.setSourceExpanded(!this.sourceExpand.classList.contains("invisible"));
       this.resizer.updatePanes();
     });
-    document.getElementById("disassembly-collapse").addEventListener("click", () => {
+    document.getElementById("show-hide-disassembly").addEventListener("click", () => {
+      this.resizer.resizerRight.classed("snapped", !this.resizer.resizerRight.classed("snapped"));
       this.setDisassemblyExpanded(!this.disassemblyExpand.classList.contains("invisible"));
       this.resizer.updatePanes();
     });
   }
 
   restoreExpandedState(): void {
+    this.resizer.resizerLeft.classed("snapped", window.sessionStorage.getItem("expandedState-source") == "false");
+    this.resizer.resizerRight.classed("snapped", window.sessionStorage.getItem("expandedState-disassembly") == "false");
     this.setSourceExpanded(this.getLastExpandedState("source", true));
-    this.setDisassemblyExpanded(this.getLastExpandedState("disassembly", false));
+    this.setDisassemblyExpanded(this.getLastExpandedState("disassembly", true));
   }
 
   getLastExpandedState(type: string, defaultState: boolean): boolean {
@@ -40,99 +44,83 @@ class Snapper {
     return state === 'true';
   }
 
-  sourceExpandUpdate(newState: boolean): void {
-    window.sessionStorage.setItem("expandedState-source", `${newState}`);
-    this.sourceExpand.classList.toggle("invisible", newState);
-    this.sourceCollapse.classList.toggle("invisible", !newState);
+  sourceUpdate(isSourceExpanded: boolean): void {
+    window.sessionStorage.setItem("expandedState-source", `${isSourceExpanded}`);
+    this.sourceExpand.classList.toggle("invisible", isSourceExpanded);
+    this.sourceCollapse.classList.toggle("invisible", !isSourceExpanded);
   }
 
-  setSourceExpanded(newState: boolean): void {
-    if (this.sourceExpand.classList.contains("invisible") === newState) return;
-    const resizer = this.resizer;
-    this.sourceExpandUpdate(newState);
-    if (newState) {
-      resizer.sepLeft = resizer.sepLeftSnap;
-      resizer.sepLeftSnap = 0;
-    } else {
-      resizer.sepLeftSnap = resizer.sepLeft;
-      resizer.sepLeft = 0;
-    }
+  setSourceExpanded(isSourceExpanded: boolean): void {
+    this.sourceUpdate(isSourceExpanded);
+    this.resizer.updateLeftWidth();
   }
 
-  disassemblyExpandUpdate(newState: boolean): void {
-    window.sessionStorage.setItem("expandedState-disassembly", `${newState}`);
-    this.disassemblyExpand.classList.toggle("invisible", newState);
-    this.disassemblyCollapse.classList.toggle("invisible", !newState);
+  disassemblyUpdate(isDisassemblyExpanded: boolean): void {
+    window.sessionStorage.setItem("expandedState-disassembly", `${isDisassemblyExpanded}`);
+    this.disassemblyExpand.classList.toggle("invisible", isDisassemblyExpanded);
+    this.disassemblyCollapse.classList.toggle("invisible", !isDisassemblyExpanded);
   }
 
-  setDisassemblyExpanded(newState: boolean): void {
-    if (this.disassemblyExpand.classList.contains("invisible") === newState) return;
-    const resizer = this.resizer;
-    this.disassemblyExpandUpdate(newState);
-    if (newState) {
-      resizer.sepRight = resizer.sepRightSnap;
-      resizer.sepRightSnap = resizer.clientWidth;
-    } else {
-      resizer.sepRightSnap = resizer.sepRight;
-      resizer.sepRight = resizer.clientWidth;
-    }
-  }
-
-  panesUpdated(): void {
-    this.sourceExpandUpdate(this.resizer.sepLeft > this.resizer.deadWidth);
-    this.disassemblyExpandUpdate(this.resizer.sepRight <
-      (this.resizer.clientWidth - this.resizer.deadWidth));
+  setDisassemblyExpanded(isDisassemblyExpanded: boolean): void {
+    this.disassemblyUpdate(isDisassemblyExpanded);
+    this.resizer.updateRightWidth();
   }
 }
 
 export class Resizer {
   snapper: Snapper;
   deadWidth: number;
-  clientWidth: number;
   left: HTMLElement;
   right: HTMLElement;
-  middle: HTMLElement;
   sepLeft: number;
   sepRight: number;
-  sepLeftSnap: number;
-  sepRightSnap: number;
-  sepWidthOffset: number;
   panesUpdatedCallback: () => void;
   resizerRight: d3.Selection<HTMLDivElement, any, any, any>;
   resizerLeft: d3.Selection<HTMLDivElement, any, any, any>;
 
+  private readonly SOURCE_PANE_DEFAULT_PERCENT = 1 / 4;
+  private readonly DISASSEMBLY_PANE_DEFAULT_PERCENT = 3 / 4;
+
   constructor(panesUpdatedCallback: () => void, deadWidth: number) {
     const resizer = this;
     resizer.panesUpdatedCallback = panesUpdatedCallback;
     resizer.deadWidth = deadWidth;
     resizer.left = document.getElementById(C.SOURCE_PANE_ID);
-    resizer.middle = document.getElementById(C.INTERMEDIATE_PANE_ID);
     resizer.right = document.getElementById(C.GENERATED_PANE_ID);
     resizer.resizerLeft = d3.select('#resizer-left');
     resizer.resizerRight = d3.select('#resizer-right');
-    resizer.sepLeftSnap = 0;
-    resizer.sepRightSnap = 0;
-    // Offset to prevent resizers from sliding slightly over one another.
-    resizer.sepWidthOffset = 7;
+    // Set default sizes, if they weren't set.
+    if (window.sessionStorage.getItem("source-pane-percent") === null) {
+      window.sessionStorage.setItem("source-pane-percent", `${this.SOURCE_PANE_DEFAULT_PERCENT}`);
+    }
+    if (window.sessionStorage.getItem("disassembly-pane-percent") === null) {
+      window.sessionStorage.setItem("disassembly-pane-percent", `${this.DISASSEMBLY_PANE_DEFAULT_PERCENT}`);
+    }
+
     this.updateWidths();
 
     const dragResizeLeft = d3.drag()
       .on('drag', function () {
         const x = d3.mouse(this.parentElement)[0];
-        resizer.sepLeft = Math.min(Math.max(0, x), resizer.sepRight - resizer.sepWidthOffset);
+        resizer.sepLeft = Math.min(Math.max(0, x), resizer.sepRight);
         resizer.updatePanes();
       })
       .on('start', function () {
         resizer.resizerLeft.classed("dragged", true);
-        const x = d3.mouse(this.parentElement)[0];
-        if (x > deadWidth) {
-          resizer.sepLeftSnap = resizer.sepLeft;
-        }
       })
       .on('end', function () {
-        if (!resizer.isRightSnapped()) {
-          window.sessionStorage.setItem("source-pane-width", `${resizer.sepLeft / resizer.clientWidth}`);
+        // If the panel is close enough to the left, treat it as if it was pulled all the way to the lefg.
+        const x = d3.mouse(this.parentElement)[0];
+        if (x <= deadWidth) {
+          resizer.sepLeft = 0;
+          resizer.updatePanes();
         }
+        // Snap if dragged all the way to the left.
+        resizer.resizerLeft.classed("snapped", resizer.sepLeft === 0);
+        if (!resizer.isLeftSnapped()) {
+          window.sessionStorage.setItem("source-pane-percent", `${resizer.sepLeft / document.body.getBoundingClientRect().width}`);
+        }
+        resizer.snapper.setSourceExpanded(!resizer.isLeftSnapped());
         resizer.resizerLeft.classed("dragged", false);
       });
     resizer.resizerLeft.call(dragResizeLeft);
@@ -140,21 +128,26 @@ export class Resizer {
     const dragResizeRight = d3.drag()
       .on('drag', function () {
         const x = d3.mouse(this.parentElement)[0];
-        resizer.sepRight = Math.max(resizer.sepLeft + resizer.sepWidthOffset, Math.min(x, resizer.clientWidth));
+        resizer.sepRight = Math.max(resizer.sepLeft, Math.min(x, document.body.getBoundingClientRect().width));
         resizer.updatePanes();
       })
       .on('start', function () {
         resizer.resizerRight.classed("dragged", true);
-        const x = d3.mouse(this.parentElement)[0];
-        if (x < (resizer.clientWidth - deadWidth)) {
-          resizer.sepRightSnap = resizer.sepRight;
-        }
       })
       .on('end', function () {
+        // If the panel is close enough to the right, treat it as if it was pulled all the way to the right.
+        const x = d3.mouse(this.parentElement)[0];
+        const clientWidth = document.body.getBoundingClientRect().width;
+        if (x >= (clientWidth - deadWidth)) {
+          resizer.sepRight = clientWidth - 1;
+          resizer.updatePanes();
+        }
+        // Snap if dragged all the way to the right.
+        resizer.resizerRight.classed("snapped", resizer.sepRight >= clientWidth - 1);
         if (!resizer.isRightSnapped()) {
-          console.log(`disassembly-pane-width ${resizer.sepRight}`);
-          window.sessionStorage.setItem("disassembly-pane-width", `${resizer.sepRight / resizer.clientWidth}`);
+          window.sessionStorage.setItem("disassembly-pane-percent", `${resizer.sepRight / clientWidth}`);
         }
+        resizer.snapper.setDisassemblyExpanded(!resizer.isRightSnapped());
         resizer.resizerRight.classed("dragged", false);
       });
     resizer.resizerRight.call(dragResizeRight);
@@ -167,33 +160,42 @@ export class Resizer {
   }
 
   isLeftSnapped() {
-    return this.sepLeft === 0;
+    return this.resizerLeft.classed("snapped");
   }
 
   isRightSnapped() {
-    return this.sepRight >= this.clientWidth - 1;
+    return this.resizerRight.classed("snapped");
   }
 
   updatePanes() {
-    const leftSnapped = this.isLeftSnapped();
-    const rightSnapped = this.isRightSnapped();
-    this.resizerLeft.classed("snapped", leftSnapped);
-    this.resizerRight.classed("snapped", rightSnapped);
     this.left.style.width = this.sepLeft + 'px';
-    this.middle.style.width = (this.sepRight - this.sepLeft) + 'px';
-    this.right.style.width = (this.clientWidth - this.sepRight) + 'px';
     this.resizerLeft.style('left', this.sepLeft + 'px');
-    this.resizerRight.style('right', (this.clientWidth - this.sepRight - 1) + 'px');
+    this.right.style.width = (document.body.getBoundingClientRect().width - this.sepRight) + 'px';
+    this.resizerRight.style('right', (document.body.getBoundingClientRect().width - this.sepRight - 1) + 'px');
 
-    this.snapper.panesUpdated();
     this.panesUpdatedCallback();
   }
 
+  updateLeftWidth() {
+    if (this.isLeftSnapped()) {
+      this.sepLeft = 0;
+    } else {
+      const sepLeft = window.sessionStorage.getItem("source-pane-percent");
+      this.sepLeft = document.body.getBoundingClientRect().width * Number.parseFloat(sepLeft);
+    }
+  }
+
+  updateRightWidth() {
+    if (this.isRightSnapped()) {
+      this.sepRight = document.body.getBoundingClientRect().width;
+    } else {
+      const sepRight = window.sessionStorage.getItem("disassembly-pane-percent");
+      this.sepRight = document.body.getBoundingClientRect().width * Number.parseFloat(sepRight);
+    }
+  }
+
   updateWidths() {
-    this.clientWidth = document.body.getBoundingClientRect().width;
-    const sepLeft = window.sessionStorage.getItem("source-pane-width");
-    this.sepLeft = this.clientWidth * (sepLeft ? Number.parseFloat(sepLeft) : (1 / 3));
-    const sepRight = window.sessionStorage.getItem("disassembly-pane-width");
-    this.sepRight = this.clientWidth * (sepRight ? Number.parseFloat(sepRight) : (2 / 3));
+    this.updateLeftWidth();
+    this.updateRightWidth();
   }
 }
diff --git a/deps/v8/tools/turbolizer/src/schedule-view.ts b/deps/v8/tools/turbolizer/src/schedule-view.ts
index 3da62ecf137b7c..339787425a6f05 100644
--- a/deps/v8/tools/turbolizer/src/schedule-view.ts
+++ b/deps/v8/tools/turbolizer/src/schedule-view.ts
@@ -12,6 +12,8 @@ export class ScheduleView extends TextView {
   createViewElement() {
     const pane = document.createElement('div');
     pane.setAttribute('id', "schedule");
+    pane.classList.add("scrollable");
+    pane.setAttribute("tabindex", "0");
     return pane;
   }
 
diff --git a/deps/v8/tools/turbolizer/src/sequence-view.ts b/deps/v8/tools/turbolizer/src/sequence-view.ts
index 1319f3ae1e2dc5..49b7e9f7b2af01 100644
--- a/deps/v8/tools/turbolizer/src/sequence-view.ts
+++ b/deps/v8/tools/turbolizer/src/sequence-view.ts
@@ -13,6 +13,8 @@ export class SequenceView extends TextView {
   createViewElement() {
     const pane = document.createElement('div');
     pane.setAttribute('id', "sequence");
+    pane.classList.add("scrollable");
+    pane.setAttribute("tabindex", "0");
     return pane;
   }
 
@@ -101,7 +103,9 @@ export class SequenceView extends TextView {
       const offsets = view.sourceResolver.instructionToPcOffsets(instruction.id);
       instId.classList.add("clickable");
       instId.dataset.instructionId = instruction.id;
-      instId.setAttribute("title", `This instruction generated gap code at pc-offset 0x${offsets.gap.toString(16)}, code at pc-offset 0x${offsets.arch.toString(16)}, condition handling at pc-offset 0x${offsets.condition.toString(16)}.`);
+      if (offsets) {
+        instId.setAttribute("title", `This instruction generated gap code at pc-offset 0x${offsets.gap.toString(16)}, code at pc-offset 0x${offsets.arch.toString(16)}, condition handling at pc-offset 0x${offsets.condition.toString(16)}.`);
+      }
       instNodeEl.appendChild(instId);
 
       const instContentsEl = createElement("div", "instruction-contents");
diff --git a/deps/v8/tools/turbolizer/src/text-view.ts b/deps/v8/tools/turbolizer/src/text-view.ts
index 761a16bff41a3f..d13c070cd35633 100644
--- a/deps/v8/tools/turbolizer/src/text-view.ts
+++ b/deps/v8/tools/turbolizer/src/text-view.ts
@@ -247,8 +247,4 @@ export abstract class TextView extends PhaseView {
   }
 
   public onresize(): void {}
-
-  isScrollable() {
-    return true;
-  }
 }
diff --git a/deps/v8/tools/turbolizer/src/turbo-visualizer.ts b/deps/v8/tools/turbolizer/src/turbo-visualizer.ts
index 87924b7b96cac5..22753cdda50d4b 100644
--- a/deps/v8/tools/turbolizer/src/turbo-visualizer.ts
+++ b/deps/v8/tools/turbolizer/src/turbo-visualizer.ts
@@ -18,7 +18,7 @@ window.onload = function () {
   let sourceViews: Array<CodeView> = [];
   let selectionBroker: SelectionBroker = null;
   let sourceResolver: SourceResolver = null;
-  const resizer = new Resizer(panesUpdatedCallback, 100);
+  const resizer = new Resizer(panesUpdatedCallback, 75);
   const sourceTabsContainer = document.getElementById(C.SOURCE_PANE_ID);
   const sourceTabs = new Tabs(sourceTabsContainer);
   sourceTabs.addTab("&#x2b;").classList.add("last-tab", "persistent-tab");
diff --git a/deps/v8/tools/turbolizer/src/view.ts b/deps/v8/tools/turbolizer/src/view.ts
index a8bb125fc49bed..d93eeeda8f6522 100644
--- a/deps/v8/tools/turbolizer/src/view.ts
+++ b/deps/v8/tools/turbolizer/src/view.ts
@@ -30,8 +30,4 @@ export abstract class PhaseView extends View {
   constructor(idOrContainer: string | HTMLElement) {
     super(idOrContainer);
   }
-
-  public isScrollable(): boolean {
-    return false;
-  }
 }
diff --git a/deps/v8/tools/turbolizer/tabs.css b/deps/v8/tools/turbolizer/tabs.css
index 54dba72b7052d1..b3958bfc1fe458 100644
--- a/deps/v8/tools/turbolizer/tabs.css
+++ b/deps/v8/tools/turbolizer/tabs.css
@@ -1,6 +1,8 @@
 .content {
     display: grid;
-    grid-template-areas: "tabs" "window";
+    grid-template-areas:
+        "tabs"
+        "window";
     grid-template-columns: 1fr;
     grid-template-rows: auto 1fr;
     min-height: calc(100vh);
diff --git a/deps/v8/tools/turbolizer/turbo-visualizer.css b/deps/v8/tools/turbolizer/turbo-visualizer.css
index f89e716ce9f16b..6fb6da3b79432c 100644
--- a/deps/v8/tools/turbolizer/turbo-visualizer.css
+++ b/deps/v8/tools/turbolizer/turbo-visualizer.css
@@ -5,7 +5,7 @@
   transition-timing-function: ease;
 }
 
-.collapse-pane {
+.show-hide-pane {
   background: #A0A0A0;
   bottom: 0;
   position: absolute;
@@ -155,9 +155,10 @@ html,
 body {
   margin: 0;
   padding: 0;
-  /*height: 99vh;
-    width: 99vw;*/
   overflow: hidden;
+  display: flex;
+  flex-direction: row;
+  width: 100vw;
 }
 
 p {
@@ -318,7 +319,7 @@ ul.noindent {
 }
 
 input:hover,
-.collapse-pane:hover input {
+.show-hide-pane:hover input {
   opacity: 1;
   cursor: pointer;
 }
@@ -334,23 +335,20 @@ input:hover,
 
 
 #left {
-  float: left;
   user-select: none;
 }
 
 #middle {
-  float: left;
   background-color: #F8F8F8;
   user-select: none;
-}
-
-#right {
-  float: right;
+  flex: 1;
 }
 
 .viewpane {
   height: 100vh;
   background-color: #FFFFFF;
+  display: flex;
+  flex-direction: column;
 }
 
 .multiview {
@@ -358,11 +356,11 @@ input:hover,
 }
 
 
-#disassembly-collapse {
+#show-hide-disassembly {
   right: 0;
 }
 
-#source-collapse {
+#show-hide-source {
   left: 0;
 }
 
@@ -371,19 +369,14 @@ input:hover,
   height: 100%;
 }
 
-.toolbox-anchor {
-  height: 0px;
-}
-
 .graph-toolbox {
   position: relative;
   border-bottom: 2px solid #eee8d5;
   z-index: 5;
-  background: rgba(100%, 100%, 100%, 0.7);
+  background: rgba(100%, 100%, 100%);
   box-sizing: border-box;
   padding: 3px;
-  margin-left: 4px;
-  margin-right: 4px;
+  overflow-x: hidden;
 }
 
 .disassembly-toolbox {
@@ -431,27 +424,15 @@ text {
 }
 
 .resizer {
-  position: absolute;
   z-index: 10;
-  width: 4px;
-  height: 100%;
+  width: 10px;
+  height: 100vh;
   background: #a0a0a0;
   cursor: pointer;
 }
 
-.resizer.snapped {
-  width: 12px;
-}
-
-.resizer.snapped:hover {
-  width: 12px;
-  margin-left: 0px;
-}
-
 .resizer:hover,
 .resizer.dragged {
-  width: 10px;
-  margin-left: -4px;
   background: orange;
 }
 
@@ -511,12 +492,10 @@ text {
 
 #sequence {
   font-family: monospace;
-  margin-top: 50px;
 }
 
 #schedule {
   font-family: monospace;
-  margin-top: 50px;
 }
 
 .schedule-block {
@@ -697,6 +676,10 @@ text {
   outline: 1px dotted grey;
 }
 
+.last-tab {
+  display: none !important;
+}
+
 ul.disassembly-list .block-id {
   width: 4ex;
   display: block;
diff --git a/deps/v8/tools/unittests/compare_torque_output_test.py b/deps/v8/tools/unittests/compare_torque_output_test.py
new file mode 100644
index 00000000000000..a6086d96c9a8d7
--- /dev/null
+++ b/deps/v8/tools/unittests/compare_torque_output_test.py
@@ -0,0 +1,55 @@
+#!/usr/bin/env python
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import os
+import re
+import subprocess
+import sys
+import tempfile
+import unittest
+
+TOOLS_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+COMPARE_SCRIPT = os.path.join(TOOLS_DIR, 'compare_torque_output.py')
+TEST_DATA = os.path.join(TOOLS_DIR, 'unittests', 'testdata', 'compare_torque')
+
+
+class PredictableTest(unittest.TestCase):
+  def setUp(self):
+    fd, self.tmp_file  = tempfile.mkstemp()
+    os.close(fd)
+
+  def _compare_from(self, test_folder):
+    file1 = os.path.join(TEST_DATA, test_folder, 'f1')
+    file2 = os.path.join(TEST_DATA, test_folder, 'f2')
+    proc = subprocess.Popen([
+          'python', '-u',
+          COMPARE_SCRIPT, file1, file2, self.tmp_file
+        ], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    _, err = proc.communicate()
+    return proc.returncode, err
+
+  def test_content_diff(self):
+    exitcode, output = self._compare_from('test1')
+    self.assertEqual(1, exitcode)
+    full_match = r'^Found.*-line 2\+line 2 with diff.*\+line 3\n\n$'
+    self.assertRegexpMatches(output, re.compile(full_match, re.M | re.S))
+
+  def test_no_diff(self):
+    exitcode, output = self._compare_from('test2')
+    self.assertEqual(0, exitcode)
+    self.assertFalse(output)
+
+  def test_right_only(self):
+    exitcode, output = self._compare_from('test3')
+    self.assertEqual(1, exitcode)
+    self.assertRegexpMatches(output, r'Some files exist only in.*f2\nfile3')
+
+  def test_left_only(self):
+    exitcode, output = self._compare_from('test4')
+    self.assertEqual(1, exitcode)
+    self.assertRegexpMatches(output, r'Some files exist only in.*f1\nfile4')
+
+  def tearDown(self):
+    os.unlink(self.tmp_file)
diff --git a/deps/v8/tools/unittests/run_perf_test.py b/deps/v8/tools/unittests/run_perf_test.py
index 083d224b2db9b5..6cd63ac2b66798 100755
--- a/deps/v8/tools/unittests/run_perf_test.py
+++ b/deps/v8/tools/unittests/run_perf_test.py
@@ -191,7 +191,8 @@ def _VerifyMock(self, binary, *args, **kwargs):
         cmd_prefix=[],
         shell=shell,
         args=list(args),
-        timeout=kwargs.get('timeout', 60))
+        timeout=kwargs.get('timeout', 60),
+        handle_sigterm=True)
 
   def _VerifyMockMultiple(self, *args, **kwargs):
     self.assertEqual(len(args), len(command.Command.call_args_list))
@@ -200,7 +201,8 @@ def _VerifyMockMultiple(self, *args, **kwargs):
         'cmd_prefix': [],
         'shell': os.path.join(os.path.dirname(BASE_DIR), arg[0]),
         'args': list(arg[1:]),
-        'timeout': kwargs.get('timeout', 60)
+        'timeout': kwargs.get('timeout', 60),
+        'handle_sigterm': True,
       }
       self.assertTupleEqual((expected, ), actual)
 
diff --git a/deps/v8/tools/unittests/run_tests_test.py b/deps/v8/tools/unittests/run_tests_test.py
index a40bb6756defae..116266ca42220b 100755
--- a/deps/v8/tools/unittests/run_tests_test.py
+++ b/deps/v8/tools/unittests/run_tests_test.py
@@ -338,7 +338,6 @@ def testAutoDetect(self):
           basedir, dcheck_always_on=True, is_asan=True, is_cfi=True,
           is_msan=True, is_tsan=True, is_ubsan_vptr=True, target_cpu='x86',
           v8_enable_i18n_support=False, v8_target_cpu='x86',
-          v8_enable_embedded_builtins=False,
           v8_enable_verify_csa=False, v8_enable_lite_mode=False,
           v8_enable_pointer_compression=False)
       result = run_tests(
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test1/f1/file1 b/deps/v8/tools/unittests/testdata/compare_torque/test1/f1/file1
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test1/f1/file1
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test1/f1/file2 b/deps/v8/tools/unittests/testdata/compare_torque/test1/f1/file2
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test1/f1/file2
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test1/f2/file1 b/deps/v8/tools/unittests/testdata/compare_torque/test1/f2/file1
new file mode 100644
index 00000000000000..e8e11f1743928e
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test1/f2/file1
@@ -0,0 +1,3 @@
+line 1
+line 2 with diff
+line 3
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test1/f2/file2 b/deps/v8/tools/unittests/testdata/compare_torque/test1/f2/file2
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test1/f2/file2
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test2/f1/file1 b/deps/v8/tools/unittests/testdata/compare_torque/test2/f1/file1
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test2/f1/file1
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test2/f1/file2 b/deps/v8/tools/unittests/testdata/compare_torque/test2/f1/file2
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test2/f1/file2
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test2/f2/file1 b/deps/v8/tools/unittests/testdata/compare_torque/test2/f2/file1
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test2/f2/file1
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test2/f2/file2 b/deps/v8/tools/unittests/testdata/compare_torque/test2/f2/file2
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test2/f2/file2
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test3/f1/file1 b/deps/v8/tools/unittests/testdata/compare_torque/test3/f1/file1
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test3/f1/file1
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test3/f1/file2 b/deps/v8/tools/unittests/testdata/compare_torque/test3/f1/file2
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test3/f1/file2
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test3/f2/file1 b/deps/v8/tools/unittests/testdata/compare_torque/test3/f2/file1
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test3/f2/file1
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test3/f2/file2 b/deps/v8/tools/unittests/testdata/compare_torque/test3/f2/file2
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test3/f2/file2
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test3/f2/file3 b/deps/v8/tools/unittests/testdata/compare_torque/test3/f2/file3
new file mode 100644
index 00000000000000..f88e4404f9d42d
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test3/f2/file3
@@ -0,0 +1 @@
+Line
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test4/f1/file1 b/deps/v8/tools/unittests/testdata/compare_torque/test4/f1/file1
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test4/f1/file1
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test4/f1/file2 b/deps/v8/tools/unittests/testdata/compare_torque/test4/f1/file2
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test4/f1/file2
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test4/f1/file4 b/deps/v8/tools/unittests/testdata/compare_torque/test4/f1/file4
new file mode 100644
index 00000000000000..f88e4404f9d42d
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test4/f1/file4
@@ -0,0 +1 @@
+Line
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test4/f2/file1 b/deps/v8/tools/unittests/testdata/compare_torque/test4/f2/file1
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test4/f2/file1
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/compare_torque/test4/f2/file2 b/deps/v8/tools/unittests/testdata/compare_torque/test4/f2/file2
new file mode 100644
index 00000000000000..0839846ee3a3ce
--- /dev/null
+++ b/deps/v8/tools/unittests/testdata/compare_torque/test4/f2/file2
@@ -0,0 +1,2 @@
+line 1
+line 2
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/testroot1/v8_build_config.json b/deps/v8/tools/unittests/testdata/testroot1/v8_build_config.json
index 0d2148bc21de12..8b294d9d520155 100644
--- a/deps/v8/tools/unittests/testdata/testroot1/v8_build_config.json
+++ b/deps/v8/tools/unittests/testdata/testroot1/v8_build_config.json
@@ -17,7 +17,6 @@
   "v8_enable_i18n_support": true,
   "v8_enable_verify_predictable": false,
   "v8_target_cpu": "x64",
-  "v8_enable_embedded_builtins": false,
   "v8_enable_verify_csa": false,
   "v8_enable_lite_mode": false,
   "v8_enable_pointer_compression": true
diff --git a/deps/v8/tools/unittests/testdata/testroot2/v8_build_config.json b/deps/v8/tools/unittests/testdata/testroot2/v8_build_config.json
index 8066096781a643..c375b30f794e6a 100644
--- a/deps/v8/tools/unittests/testdata/testroot2/v8_build_config.json
+++ b/deps/v8/tools/unittests/testdata/testroot2/v8_build_config.json
@@ -17,7 +17,6 @@
   "v8_enable_i18n_support": true,
   "v8_enable_verify_predictable": false,
   "v8_target_cpu": "x64",
-  "v8_enable_embedded_builtins": false,
   "v8_enable_verify_csa": false,
   "v8_enable_lite_mode": false,
   "v8_enable_pointer_compression": false
diff --git a/deps/v8/tools/v8_presubmit.py b/deps/v8/tools/v8_presubmit.py
index 346fc9aad57bf9..f2f9546bdba35e 100755
--- a/deps/v8/tools/v8_presubmit.py
+++ b/deps/v8/tools/v8_presubmit.py
@@ -382,7 +382,7 @@ def GetProcessorScript(self):
     return None, arguments
 
 COPYRIGHT_HEADER_PATTERN = re.compile(
-    r'Copyright [\d-]*20[0-1][0-9] the V8 project authors. All rights reserved.')
+    r'Copyright [\d-]*20[0-2][0-9] the V8 project authors. All rights reserved.')
 
 class SourceProcessor(SourceFileProcessor):
   """
diff --git a/deps/v8/tools/v8heapconst.py b/deps/v8/tools/v8heapconst.py
index 102f5a075364df..ccd02e67bf706d 100644
--- a/deps/v8/tools/v8heapconst.py
+++ b/deps/v8/tools/v8heapconst.py
@@ -41,100 +41,102 @@
   77: "STORE_HANDLER_TYPE",
   78: "FUNCTION_TEMPLATE_INFO_TYPE",
   79: "OBJECT_TEMPLATE_INFO_TYPE",
-  80: "TUPLE2_TYPE",
-  81: "TUPLE3_TYPE",
-  82: "ACCESS_CHECK_INFO_TYPE",
-  83: "ACCESSOR_INFO_TYPE",
-  84: "ACCESSOR_PAIR_TYPE",
-  85: "ALIASED_ARGUMENTS_ENTRY_TYPE",
-  86: "ALLOCATION_MEMENTO_TYPE",
-  87: "ALLOCATION_SITE_TYPE",
-  88: "ARRAY_BOILERPLATE_DESCRIPTION_TYPE",
-  89: "ASM_WASM_DATA_TYPE",
-  90: "ASYNC_GENERATOR_REQUEST_TYPE",
-  91: "CALL_HANDLER_INFO_TYPE",
-  92: "CLASS_POSITIONS_TYPE",
-  93: "DEBUG_INFO_TYPE",
-  94: "ENUM_CACHE_TYPE",
-  95: "FEEDBACK_CELL_TYPE",
-  96: "FUNCTION_TEMPLATE_RARE_DATA_TYPE",
-  97: "INTERCEPTOR_INFO_TYPE",
-  98: "INTERNAL_CLASS_TYPE",
-  99: "INTERPRETER_DATA_TYPE",
-  100: "PROMISE_CAPABILITY_TYPE",
-  101: "PROMISE_REACTION_TYPE",
-  102: "PROTOTYPE_INFO_TYPE",
-  103: "SCRIPT_TYPE",
-  104: "SMI_BOX_TYPE",
-  105: "SMI_PAIR_TYPE",
-  106: "SORT_STATE_TYPE",
-  107: "SOURCE_POSITION_TABLE_WITH_FRAME_CACHE_TYPE",
-  108: "SOURCE_TEXT_MODULE_INFO_ENTRY_TYPE",
-  109: "STACK_FRAME_INFO_TYPE",
-  110: "STACK_TRACE_FRAME_TYPE",
-  111: "TEMPLATE_OBJECT_DESCRIPTION_TYPE",
-  112: "WASM_CAPI_FUNCTION_DATA_TYPE",
-  113: "WASM_DEBUG_INFO_TYPE",
-  114: "WASM_EXCEPTION_TAG_TYPE",
-  115: "WASM_EXPORTED_FUNCTION_DATA_TYPE",
-  116: "WASM_INDIRECT_FUNCTION_TABLE_TYPE",
-  117: "WASM_JS_FUNCTION_DATA_TYPE",
-  118: "FIXED_ARRAY_TYPE",
-  119: "HASH_TABLE_TYPE",
-  120: "EPHEMERON_HASH_TABLE_TYPE",
-  121: "GLOBAL_DICTIONARY_TYPE",
-  122: "NAME_DICTIONARY_TYPE",
-  123: "NUMBER_DICTIONARY_TYPE",
-  124: "ORDERED_HASH_MAP_TYPE",
-  125: "ORDERED_HASH_SET_TYPE",
-  126: "ORDERED_NAME_DICTIONARY_TYPE",
-  127: "SIMPLE_NUMBER_DICTIONARY_TYPE",
-  128: "STRING_TABLE_TYPE",
-  129: "CLOSURE_FEEDBACK_CELL_ARRAY_TYPE",
-  130: "OBJECT_BOILERPLATE_DESCRIPTION_TYPE",
-  131: "SCOPE_INFO_TYPE",
-  132: "SCRIPT_CONTEXT_TABLE_TYPE",
-  133: "BYTE_ARRAY_TYPE",
-  134: "BYTECODE_ARRAY_TYPE",
-  135: "FIXED_DOUBLE_ARRAY_TYPE",
-  136: "AWAIT_CONTEXT_TYPE",
-  137: "BLOCK_CONTEXT_TYPE",
-  138: "CATCH_CONTEXT_TYPE",
-  139: "DEBUG_EVALUATE_CONTEXT_TYPE",
-  140: "EVAL_CONTEXT_TYPE",
-  141: "FUNCTION_CONTEXT_TYPE",
-  142: "MODULE_CONTEXT_TYPE",
-  143: "NATIVE_CONTEXT_TYPE",
-  144: "SCRIPT_CONTEXT_TYPE",
-  145: "WITH_CONTEXT_TYPE",
-  146: "SMALL_ORDERED_HASH_MAP_TYPE",
-  147: "SMALL_ORDERED_HASH_SET_TYPE",
-  148: "SMALL_ORDERED_NAME_DICTIONARY_TYPE",
-  149: "UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE",
-  150: "UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE",
-  151: "WEAK_FIXED_ARRAY_TYPE",
-  152: "TRANSITION_ARRAY_TYPE",
-  153: "CELL_TYPE",
-  154: "CODE_TYPE",
-  155: "CODE_DATA_CONTAINER_TYPE",
-  156: "DESCRIPTOR_ARRAY_TYPE",
-  157: "EMBEDDER_DATA_ARRAY_TYPE",
-  158: "FEEDBACK_METADATA_TYPE",
-  159: "FEEDBACK_VECTOR_TYPE",
-  160: "FILLER_TYPE",
-  161: "FREE_SPACE_TYPE",
-  162: "MAP_TYPE",
-  163: "PREPARSE_DATA_TYPE",
-  164: "PROPERTY_ARRAY_TYPE",
-  165: "PROPERTY_CELL_TYPE",
-  166: "SHARED_FUNCTION_INFO_TYPE",
-  167: "WEAK_ARRAY_LIST_TYPE",
-  168: "WEAK_CELL_TYPE",
-  169: "JS_PROXY_TYPE",
+  80: "ACCESS_CHECK_INFO_TYPE",
+  81: "ACCESSOR_INFO_TYPE",
+  82: "ACCESSOR_PAIR_TYPE",
+  83: "ALIASED_ARGUMENTS_ENTRY_TYPE",
+  84: "ALLOCATION_MEMENTO_TYPE",
+  85: "ALLOCATION_SITE_TYPE",
+  86: "ARRAY_BOILERPLATE_DESCRIPTION_TYPE",
+  87: "ASM_WASM_DATA_TYPE",
+  88: "ASYNC_GENERATOR_REQUEST_TYPE",
+  89: "BREAK_POINT_TYPE",
+  90: "BREAK_POINT_INFO_TYPE",
+  91: "CACHED_TEMPLATE_OBJECT_TYPE",
+  92: "CALL_HANDLER_INFO_TYPE",
+  93: "CLASS_POSITIONS_TYPE",
+  94: "DEBUG_INFO_TYPE",
+  95: "ENUM_CACHE_TYPE",
+  96: "FEEDBACK_CELL_TYPE",
+  97: "FUNCTION_TEMPLATE_RARE_DATA_TYPE",
+  98: "INTERCEPTOR_INFO_TYPE",
+  99: "INTERNAL_CLASS_TYPE",
+  100: "INTERPRETER_DATA_TYPE",
+  101: "PROMISE_CAPABILITY_TYPE",
+  102: "PROMISE_REACTION_TYPE",
+  103: "PROPERTY_DESCRIPTOR_OBJECT_TYPE",
+  104: "PROTOTYPE_INFO_TYPE",
+  105: "SCRIPT_TYPE",
+  106: "SMI_BOX_TYPE",
+  107: "SMI_PAIR_TYPE",
+  108: "SORT_STATE_TYPE",
+  109: "SOURCE_TEXT_MODULE_INFO_ENTRY_TYPE",
+  110: "STACK_FRAME_INFO_TYPE",
+  111: "STACK_TRACE_FRAME_TYPE",
+  112: "TEMPLATE_OBJECT_DESCRIPTION_TYPE",
+  113: "TUPLE2_TYPE",
+  114: "WASM_CAPI_FUNCTION_DATA_TYPE",
+  115: "WASM_DEBUG_INFO_TYPE",
+  116: "WASM_EXCEPTION_TAG_TYPE",
+  117: "WASM_EXPORTED_FUNCTION_DATA_TYPE",
+  118: "WASM_INDIRECT_FUNCTION_TABLE_TYPE",
+  119: "WASM_JS_FUNCTION_DATA_TYPE",
+  120: "FIXED_ARRAY_TYPE",
+  121: "HASH_TABLE_TYPE",
+  122: "EPHEMERON_HASH_TABLE_TYPE",
+  123: "GLOBAL_DICTIONARY_TYPE",
+  124: "NAME_DICTIONARY_TYPE",
+  125: "NUMBER_DICTIONARY_TYPE",
+  126: "ORDERED_HASH_MAP_TYPE",
+  127: "ORDERED_HASH_SET_TYPE",
+  128: "ORDERED_NAME_DICTIONARY_TYPE",
+  129: "SIMPLE_NUMBER_DICTIONARY_TYPE",
+  130: "STRING_TABLE_TYPE",
+  131: "CLOSURE_FEEDBACK_CELL_ARRAY_TYPE",
+  132: "OBJECT_BOILERPLATE_DESCRIPTION_TYPE",
+  133: "SCOPE_INFO_TYPE",
+  134: "SCRIPT_CONTEXT_TABLE_TYPE",
+  135: "BYTE_ARRAY_TYPE",
+  136: "BYTECODE_ARRAY_TYPE",
+  137: "FIXED_DOUBLE_ARRAY_TYPE",
+  138: "AWAIT_CONTEXT_TYPE",
+  139: "BLOCK_CONTEXT_TYPE",
+  140: "CATCH_CONTEXT_TYPE",
+  141: "DEBUG_EVALUATE_CONTEXT_TYPE",
+  142: "EVAL_CONTEXT_TYPE",
+  143: "FUNCTION_CONTEXT_TYPE",
+  144: "MODULE_CONTEXT_TYPE",
+  145: "NATIVE_CONTEXT_TYPE",
+  146: "SCRIPT_CONTEXT_TYPE",
+  147: "WITH_CONTEXT_TYPE",
+  148: "SMALL_ORDERED_HASH_MAP_TYPE",
+  149: "SMALL_ORDERED_HASH_SET_TYPE",
+  150: "SMALL_ORDERED_NAME_DICTIONARY_TYPE",
+  151: "UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE",
+  152: "UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE",
+  153: "WEAK_FIXED_ARRAY_TYPE",
+  154: "TRANSITION_ARRAY_TYPE",
+  155: "CELL_TYPE",
+  156: "CODE_TYPE",
+  157: "CODE_DATA_CONTAINER_TYPE",
+  158: "DESCRIPTOR_ARRAY_TYPE",
+  159: "EMBEDDER_DATA_ARRAY_TYPE",
+  160: "FEEDBACK_METADATA_TYPE",
+  161: "FEEDBACK_VECTOR_TYPE",
+  162: "FILLER_TYPE",
+  163: "FREE_SPACE_TYPE",
+  164: "MAP_TYPE",
+  165: "PREPARSE_DATA_TYPE",
+  166: "PROPERTY_ARRAY_TYPE",
+  167: "PROPERTY_CELL_TYPE",
+  168: "SHARED_FUNCTION_INFO_TYPE",
+  169: "WEAK_ARRAY_LIST_TYPE",
+  170: "WEAK_CELL_TYPE",
+  171: "JS_PROXY_TYPE",
   1057: "JS_OBJECT_TYPE",
-  170: "JS_GLOBAL_OBJECT_TYPE",
-  171: "JS_GLOBAL_PROXY_TYPE",
-  172: "JS_MODULE_NAMESPACE_TYPE",
+  172: "JS_GLOBAL_OBJECT_TYPE",
+  173: "JS_GLOBAL_PROXY_TYPE",
+  174: "JS_MODULE_NAMESPACE_TYPE",
   1040: "JS_SPECIAL_API_OBJECT_TYPE",
   1041: "JS_PRIMITIVE_WRAPPER_TYPE",
   1042: "JS_MAP_KEY_ITERATOR_TYPE",
@@ -161,267 +163,267 @@
   1064: "JS_CONTEXT_EXTENSION_OBJECT_TYPE",
   1065: "JS_DATE_TYPE",
   1066: "JS_DATE_TIME_FORMAT_TYPE",
-  1067: "JS_ERROR_TYPE",
-  1068: "JS_FINALIZATION_GROUP_TYPE",
-  1069: "JS_FINALIZATION_GROUP_CLEANUP_ITERATOR_TYPE",
-  1070: "JS_LIST_FORMAT_TYPE",
-  1071: "JS_LOCALE_TYPE",
-  1072: "JS_MESSAGE_OBJECT_TYPE",
-  1073: "JS_NUMBER_FORMAT_TYPE",
-  1074: "JS_PLURAL_RULES_TYPE",
-  1075: "JS_PROMISE_TYPE",
-  1076: "JS_REG_EXP_TYPE",
-  1077: "JS_REG_EXP_STRING_ITERATOR_TYPE",
-  1078: "JS_RELATIVE_TIME_FORMAT_TYPE",
-  1079: "JS_SEGMENT_ITERATOR_TYPE",
-  1080: "JS_SEGMENTER_TYPE",
-  1081: "JS_STRING_ITERATOR_TYPE",
-  1082: "JS_V8_BREAK_ITERATOR_TYPE",
-  1083: "JS_WEAK_REF_TYPE",
-  1084: "WASM_EXCEPTION_OBJECT_TYPE",
-  1085: "WASM_GLOBAL_OBJECT_TYPE",
-  1086: "WASM_INSTANCE_OBJECT_TYPE",
-  1087: "WASM_MEMORY_OBJECT_TYPE",
-  1088: "WASM_MODULE_OBJECT_TYPE",
-  1089: "WASM_TABLE_OBJECT_TYPE",
-  1090: "JS_BOUND_FUNCTION_TYPE",
-  1091: "JS_FUNCTION_TYPE",
+  1067: "JS_DISPLAY_NAMES_TYPE",
+  1068: "JS_ERROR_TYPE",
+  1069: "JS_FINALIZATION_GROUP_TYPE",
+  1070: "JS_FINALIZATION_GROUP_CLEANUP_ITERATOR_TYPE",
+  1071: "JS_LIST_FORMAT_TYPE",
+  1072: "JS_LOCALE_TYPE",
+  1073: "JS_MESSAGE_OBJECT_TYPE",
+  1074: "JS_NUMBER_FORMAT_TYPE",
+  1075: "JS_PLURAL_RULES_TYPE",
+  1076: "JS_PROMISE_TYPE",
+  1077: "JS_REG_EXP_TYPE",
+  1078: "JS_REG_EXP_STRING_ITERATOR_TYPE",
+  1079: "JS_RELATIVE_TIME_FORMAT_TYPE",
+  1080: "JS_SEGMENT_ITERATOR_TYPE",
+  1081: "JS_SEGMENTER_TYPE",
+  1082: "JS_STRING_ITERATOR_TYPE",
+  1083: "JS_V8_BREAK_ITERATOR_TYPE",
+  1084: "JS_WEAK_REF_TYPE",
+  1085: "WASM_EXCEPTION_OBJECT_TYPE",
+  1086: "WASM_GLOBAL_OBJECT_TYPE",
+  1087: "WASM_INSTANCE_OBJECT_TYPE",
+  1088: "WASM_MEMORY_OBJECT_TYPE",
+  1089: "WASM_MODULE_OBJECT_TYPE",
+  1090: "WASM_TABLE_OBJECT_TYPE",
+  1091: "JS_BOUND_FUNCTION_TYPE",
+  1092: "JS_FUNCTION_TYPE",
 }
 
 # List of known V8 maps.
 KNOWN_MAPS = {
-  ("read_only_space", 0x00121): (161, "FreeSpaceMap"),
-  ("read_only_space", 0x00171): (162, "MetaMap"),
-  ("read_only_space", 0x001f1): (67, "NullMap"),
-  ("read_only_space", 0x00259): (156, "DescriptorArrayMap"),
-  ("read_only_space", 0x002b9): (151, "WeakFixedArrayMap"),
-  ("read_only_space", 0x00309): (160, "OnePointerFillerMap"),
-  ("read_only_space", 0x00359): (160, "TwoPointerFillerMap"),
-  ("read_only_space", 0x003d9): (67, "UninitializedMap"),
-  ("read_only_space", 0x00449): (8, "OneByteInternalizedStringMap"),
-  ("read_only_space", 0x004e9): (67, "UndefinedMap"),
-  ("read_only_space", 0x00549): (66, "HeapNumberMap"),
-  ("read_only_space", 0x005c9): (67, "TheHoleMap"),
-  ("read_only_space", 0x00671): (67, "BooleanMap"),
-  ("read_only_space", 0x00749): (133, "ByteArrayMap"),
-  ("read_only_space", 0x00799): (118, "FixedArrayMap"),
-  ("read_only_space", 0x007e9): (118, "FixedCOWArrayMap"),
-  ("read_only_space", 0x00839): (119, "HashTableMap"),
-  ("read_only_space", 0x00889): (64, "SymbolMap"),
-  ("read_only_space", 0x008d9): (40, "OneByteStringMap"),
-  ("read_only_space", 0x00929): (131, "ScopeInfoMap"),
-  ("read_only_space", 0x00979): (166, "SharedFunctionInfoMap"),
-  ("read_only_space", 0x009c9): (154, "CodeMap"),
-  ("read_only_space", 0x00a19): (141, "FunctionContextMap"),
-  ("read_only_space", 0x00a69): (153, "CellMap"),
-  ("read_only_space", 0x00ab9): (165, "GlobalPropertyCellMap"),
-  ("read_only_space", 0x00b09): (70, "ForeignMap"),
-  ("read_only_space", 0x00b59): (152, "TransitionArrayMap"),
-  ("read_only_space", 0x00ba9): (159, "FeedbackVectorMap"),
-  ("read_only_space", 0x00c49): (67, "ArgumentsMarkerMap"),
-  ("read_only_space", 0x00ce9): (67, "ExceptionMap"),
-  ("read_only_space", 0x00d89): (67, "TerminationExceptionMap"),
-  ("read_only_space", 0x00e31): (67, "OptimizedOutMap"),
-  ("read_only_space", 0x00ed1): (67, "StaleRegisterMap"),
-  ("read_only_space", 0x00f41): (143, "NativeContextMap"),
-  ("read_only_space", 0x00f91): (142, "ModuleContextMap"),
-  ("read_only_space", 0x00fe1): (140, "EvalContextMap"),
-  ("read_only_space", 0x01031): (144, "ScriptContextMap"),
-  ("read_only_space", 0x01081): (136, "AwaitContextMap"),
-  ("read_only_space", 0x010d1): (137, "BlockContextMap"),
-  ("read_only_space", 0x01121): (138, "CatchContextMap"),
-  ("read_only_space", 0x01171): (145, "WithContextMap"),
-  ("read_only_space", 0x011c1): (139, "DebugEvaluateContextMap"),
-  ("read_only_space", 0x01211): (132, "ScriptContextTableMap"),
-  ("read_only_space", 0x01261): (129, "ClosureFeedbackCellArrayMap"),
-  ("read_only_space", 0x012b1): (158, "FeedbackMetadataArrayMap"),
-  ("read_only_space", 0x01301): (118, "ArrayListMap"),
-  ("read_only_space", 0x01351): (65, "BigIntMap"),
-  ("read_only_space", 0x013a1): (130, "ObjectBoilerplateDescriptionMap"),
-  ("read_only_space", 0x013f1): (134, "BytecodeArrayMap"),
-  ("read_only_space", 0x01441): (155, "CodeDataContainerMap"),
-  ("read_only_space", 0x01491): (135, "FixedDoubleArrayMap"),
-  ("read_only_space", 0x014e1): (121, "GlobalDictionaryMap"),
-  ("read_only_space", 0x01531): (95, "ManyClosuresCellMap"),
-  ("read_only_space", 0x01581): (118, "ModuleInfoMap"),
-  ("read_only_space", 0x015d1): (122, "NameDictionaryMap"),
-  ("read_only_space", 0x01621): (95, "NoClosuresCellMap"),
-  ("read_only_space", 0x01671): (123, "NumberDictionaryMap"),
-  ("read_only_space", 0x016c1): (95, "OneClosureCellMap"),
-  ("read_only_space", 0x01711): (124, "OrderedHashMapMap"),
-  ("read_only_space", 0x01761): (125, "OrderedHashSetMap"),
-  ("read_only_space", 0x017b1): (126, "OrderedNameDictionaryMap"),
-  ("read_only_space", 0x01801): (163, "PreparseDataMap"),
-  ("read_only_space", 0x01851): (164, "PropertyArrayMap"),
-  ("read_only_space", 0x018a1): (91, "SideEffectCallHandlerInfoMap"),
-  ("read_only_space", 0x018f1): (91, "SideEffectFreeCallHandlerInfoMap"),
-  ("read_only_space", 0x01941): (91, "NextCallSideEffectFreeCallHandlerInfoMap"),
-  ("read_only_space", 0x01991): (127, "SimpleNumberDictionaryMap"),
-  ("read_only_space", 0x019e1): (118, "SloppyArgumentsElementsMap"),
-  ("read_only_space", 0x01a31): (146, "SmallOrderedHashMapMap"),
-  ("read_only_space", 0x01a81): (147, "SmallOrderedHashSetMap"),
-  ("read_only_space", 0x01ad1): (148, "SmallOrderedNameDictionaryMap"),
-  ("read_only_space", 0x01b21): (68, "SourceTextModuleMap"),
-  ("read_only_space", 0x01b71): (128, "StringTableMap"),
-  ("read_only_space", 0x01bc1): (69, "SyntheticModuleMap"),
-  ("read_only_space", 0x01c11): (150, "UncompiledDataWithoutPreparseDataMap"),
-  ("read_only_space", 0x01c61): (149, "UncompiledDataWithPreparseDataMap"),
-  ("read_only_space", 0x01cb1): (167, "WeakArrayListMap"),
-  ("read_only_space", 0x01d01): (120, "EphemeronHashTableMap"),
-  ("read_only_space", 0x01d51): (157, "EmbedderDataArrayMap"),
-  ("read_only_space", 0x01da1): (168, "WeakCellMap"),
-  ("read_only_space", 0x01df1): (58, "NativeSourceStringMap"),
-  ("read_only_space", 0x01e41): (32, "StringMap"),
-  ("read_only_space", 0x01e91): (41, "ConsOneByteStringMap"),
-  ("read_only_space", 0x01ee1): (33, "ConsStringMap"),
-  ("read_only_space", 0x01f31): (45, "ThinOneByteStringMap"),
-  ("read_only_space", 0x01f81): (37, "ThinStringMap"),
-  ("read_only_space", 0x01fd1): (35, "SlicedStringMap"),
-  ("read_only_space", 0x02021): (43, "SlicedOneByteStringMap"),
-  ("read_only_space", 0x02071): (34, "ExternalStringMap"),
-  ("read_only_space", 0x020c1): (42, "ExternalOneByteStringMap"),
-  ("read_only_space", 0x02111): (50, "UncachedExternalStringMap"),
-  ("read_only_space", 0x02161): (0, "InternalizedStringMap"),
-  ("read_only_space", 0x021b1): (2, "ExternalInternalizedStringMap"),
-  ("read_only_space", 0x02201): (10, "ExternalOneByteInternalizedStringMap"),
-  ("read_only_space", 0x02251): (18, "UncachedExternalInternalizedStringMap"),
-  ("read_only_space", 0x022a1): (26, "UncachedExternalOneByteInternalizedStringMap"),
-  ("read_only_space", 0x022f1): (58, "UncachedExternalOneByteStringMap"),
-  ("read_only_space", 0x02341): (67, "SelfReferenceMarkerMap"),
-  ("read_only_space", 0x023a9): (94, "EnumCacheMap"),
-  ("read_only_space", 0x02449): (88, "ArrayBoilerplateDescriptionMap"),
-  ("read_only_space", 0x02639): (97, "InterceptorInfoMap"),
-  ("read_only_space", 0x04f79): (71, "PromiseFulfillReactionJobTaskMap"),
-  ("read_only_space", 0x04fc9): (72, "PromiseRejectReactionJobTaskMap"),
-  ("read_only_space", 0x05019): (73, "CallableTaskMap"),
-  ("read_only_space", 0x05069): (74, "CallbackTaskMap"),
-  ("read_only_space", 0x050b9): (75, "PromiseResolveThenableJobTaskMap"),
-  ("read_only_space", 0x05109): (78, "FunctionTemplateInfoMap"),
-  ("read_only_space", 0x05159): (79, "ObjectTemplateInfoMap"),
-  ("read_only_space", 0x051a9): (80, "Tuple2Map"),
-  ("read_only_space", 0x051f9): (81, "Tuple3Map"),
-  ("read_only_space", 0x05249): (82, "AccessCheckInfoMap"),
-  ("read_only_space", 0x05299): (83, "AccessorInfoMap"),
-  ("read_only_space", 0x052e9): (84, "AccessorPairMap"),
-  ("read_only_space", 0x05339): (85, "AliasedArgumentsEntryMap"),
-  ("read_only_space", 0x05389): (86, "AllocationMementoMap"),
-  ("read_only_space", 0x053d9): (89, "AsmWasmDataMap"),
-  ("read_only_space", 0x05429): (90, "AsyncGeneratorRequestMap"),
-  ("read_only_space", 0x05479): (92, "ClassPositionsMap"),
-  ("read_only_space", 0x054c9): (93, "DebugInfoMap"),
-  ("read_only_space", 0x05519): (96, "FunctionTemplateRareDataMap"),
-  ("read_only_space", 0x05569): (99, "InterpreterDataMap"),
-  ("read_only_space", 0x055b9): (100, "PromiseCapabilityMap"),
-  ("read_only_space", 0x05609): (101, "PromiseReactionMap"),
-  ("read_only_space", 0x05659): (102, "PrototypeInfoMap"),
-  ("read_only_space", 0x056a9): (103, "ScriptMap"),
-  ("read_only_space", 0x056f9): (107, "SourcePositionTableWithFrameCacheMap"),
-  ("read_only_space", 0x05749): (108, "SourceTextModuleInfoEntryMap"),
-  ("read_only_space", 0x05799): (109, "StackFrameInfoMap"),
-  ("read_only_space", 0x057e9): (110, "StackTraceFrameMap"),
-  ("read_only_space", 0x05839): (111, "TemplateObjectDescriptionMap"),
-  ("read_only_space", 0x05889): (112, "WasmCapiFunctionDataMap"),
-  ("read_only_space", 0x058d9): (113, "WasmDebugInfoMap"),
-  ("read_only_space", 0x05929): (114, "WasmExceptionTagMap"),
-  ("read_only_space", 0x05979): (115, "WasmExportedFunctionDataMap"),
-  ("read_only_space", 0x059c9): (116, "WasmIndirectFunctionTableMap"),
-  ("read_only_space", 0x05a19): (117, "WasmJSFunctionDataMap"),
-  ("read_only_space", 0x05a69): (98, "InternalClassMap"),
-  ("read_only_space", 0x05ab9): (105, "SmiPairMap"),
-  ("read_only_space", 0x05b09): (104, "SmiBoxMap"),
-  ("read_only_space", 0x05b59): (106, "SortStateMap"),
-  ("read_only_space", 0x05ba9): (87, "AllocationSiteWithWeakNextMap"),
-  ("read_only_space", 0x05bf9): (87, "AllocationSiteWithoutWeakNextMap"),
-  ("read_only_space", 0x05c49): (76, "LoadHandler1Map"),
-  ("read_only_space", 0x05c99): (76, "LoadHandler2Map"),
-  ("read_only_space", 0x05ce9): (76, "LoadHandler3Map"),
-  ("read_only_space", 0x05d39): (77, "StoreHandler0Map"),
-  ("read_only_space", 0x05d89): (77, "StoreHandler1Map"),
-  ("read_only_space", 0x05dd9): (77, "StoreHandler2Map"),
-  ("read_only_space", 0x05e29): (77, "StoreHandler3Map"),
+  ("read_only_space", 0x00121): (163, "FreeSpaceMap"),
+  ("read_only_space", 0x00149): (164, "MetaMap"),
+  ("read_only_space", 0x0018d): (67, "NullMap"),
+  ("read_only_space", 0x001c5): (158, "DescriptorArrayMap"),
+  ("read_only_space", 0x001f5): (153, "WeakFixedArrayMap"),
+  ("read_only_space", 0x0021d): (162, "OnePointerFillerMap"),
+  ("read_only_space", 0x00245): (162, "TwoPointerFillerMap"),
+  ("read_only_space", 0x00289): (67, "UninitializedMap"),
+  ("read_only_space", 0x002cd): (8, "OneByteInternalizedStringMap"),
+  ("read_only_space", 0x00329): (67, "UndefinedMap"),
+  ("read_only_space", 0x0035d): (66, "HeapNumberMap"),
+  ("read_only_space", 0x003a1): (67, "TheHoleMap"),
+  ("read_only_space", 0x00401): (67, "BooleanMap"),
+  ("read_only_space", 0x00489): (135, "ByteArrayMap"),
+  ("read_only_space", 0x004b1): (120, "FixedArrayMap"),
+  ("read_only_space", 0x004d9): (120, "FixedCOWArrayMap"),
+  ("read_only_space", 0x00501): (121, "HashTableMap"),
+  ("read_only_space", 0x00529): (64, "SymbolMap"),
+  ("read_only_space", 0x00551): (40, "OneByteStringMap"),
+  ("read_only_space", 0x00579): (133, "ScopeInfoMap"),
+  ("read_only_space", 0x005a1): (168, "SharedFunctionInfoMap"),
+  ("read_only_space", 0x005c9): (156, "CodeMap"),
+  ("read_only_space", 0x005f1): (155, "CellMap"),
+  ("read_only_space", 0x00619): (167, "GlobalPropertyCellMap"),
+  ("read_only_space", 0x00641): (70, "ForeignMap"),
+  ("read_only_space", 0x00669): (154, "TransitionArrayMap"),
+  ("read_only_space", 0x00691): (45, "ThinOneByteStringMap"),
+  ("read_only_space", 0x006b9): (161, "FeedbackVectorMap"),
+  ("read_only_space", 0x0070d): (67, "ArgumentsMarkerMap"),
+  ("read_only_space", 0x0076d): (67, "ExceptionMap"),
+  ("read_only_space", 0x007c9): (67, "TerminationExceptionMap"),
+  ("read_only_space", 0x00831): (67, "OptimizedOutMap"),
+  ("read_only_space", 0x00891): (67, "StaleRegisterMap"),
+  ("read_only_space", 0x008d5): (134, "ScriptContextTableMap"),
+  ("read_only_space", 0x008fd): (131, "ClosureFeedbackCellArrayMap"),
+  ("read_only_space", 0x00925): (160, "FeedbackMetadataArrayMap"),
+  ("read_only_space", 0x0094d): (120, "ArrayListMap"),
+  ("read_only_space", 0x00975): (65, "BigIntMap"),
+  ("read_only_space", 0x0099d): (132, "ObjectBoilerplateDescriptionMap"),
+  ("read_only_space", 0x009c5): (136, "BytecodeArrayMap"),
+  ("read_only_space", 0x009ed): (157, "CodeDataContainerMap"),
+  ("read_only_space", 0x00a15): (137, "FixedDoubleArrayMap"),
+  ("read_only_space", 0x00a3d): (123, "GlobalDictionaryMap"),
+  ("read_only_space", 0x00a65): (96, "ManyClosuresCellMap"),
+  ("read_only_space", 0x00a8d): (120, "ModuleInfoMap"),
+  ("read_only_space", 0x00ab5): (124, "NameDictionaryMap"),
+  ("read_only_space", 0x00add): (96, "NoClosuresCellMap"),
+  ("read_only_space", 0x00b05): (125, "NumberDictionaryMap"),
+  ("read_only_space", 0x00b2d): (96, "OneClosureCellMap"),
+  ("read_only_space", 0x00b55): (126, "OrderedHashMapMap"),
+  ("read_only_space", 0x00b7d): (127, "OrderedHashSetMap"),
+  ("read_only_space", 0x00ba5): (128, "OrderedNameDictionaryMap"),
+  ("read_only_space", 0x00bcd): (165, "PreparseDataMap"),
+  ("read_only_space", 0x00bf5): (166, "PropertyArrayMap"),
+  ("read_only_space", 0x00c1d): (92, "SideEffectCallHandlerInfoMap"),
+  ("read_only_space", 0x00c45): (92, "SideEffectFreeCallHandlerInfoMap"),
+  ("read_only_space", 0x00c6d): (92, "NextCallSideEffectFreeCallHandlerInfoMap"),
+  ("read_only_space", 0x00c95): (129, "SimpleNumberDictionaryMap"),
+  ("read_only_space", 0x00cbd): (120, "SloppyArgumentsElementsMap"),
+  ("read_only_space", 0x00ce5): (148, "SmallOrderedHashMapMap"),
+  ("read_only_space", 0x00d0d): (149, "SmallOrderedHashSetMap"),
+  ("read_only_space", 0x00d35): (150, "SmallOrderedNameDictionaryMap"),
+  ("read_only_space", 0x00d5d): (68, "SourceTextModuleMap"),
+  ("read_only_space", 0x00d85): (130, "StringTableMap"),
+  ("read_only_space", 0x00dad): (69, "SyntheticModuleMap"),
+  ("read_only_space", 0x00dd5): (152, "UncompiledDataWithoutPreparseDataMap"),
+  ("read_only_space", 0x00dfd): (151, "UncompiledDataWithPreparseDataMap"),
+  ("read_only_space", 0x00e25): (169, "WeakArrayListMap"),
+  ("read_only_space", 0x00e4d): (122, "EphemeronHashTableMap"),
+  ("read_only_space", 0x00e75): (159, "EmbedderDataArrayMap"),
+  ("read_only_space", 0x00e9d): (170, "WeakCellMap"),
+  ("read_only_space", 0x00ec5): (32, "StringMap"),
+  ("read_only_space", 0x00eed): (41, "ConsOneByteStringMap"),
+  ("read_only_space", 0x00f15): (33, "ConsStringMap"),
+  ("read_only_space", 0x00f3d): (37, "ThinStringMap"),
+  ("read_only_space", 0x00f65): (35, "SlicedStringMap"),
+  ("read_only_space", 0x00f8d): (43, "SlicedOneByteStringMap"),
+  ("read_only_space", 0x00fb5): (34, "ExternalStringMap"),
+  ("read_only_space", 0x00fdd): (42, "ExternalOneByteStringMap"),
+  ("read_only_space", 0x01005): (50, "UncachedExternalStringMap"),
+  ("read_only_space", 0x0102d): (0, "InternalizedStringMap"),
+  ("read_only_space", 0x01055): (2, "ExternalInternalizedStringMap"),
+  ("read_only_space", 0x0107d): (10, "ExternalOneByteInternalizedStringMap"),
+  ("read_only_space", 0x010a5): (18, "UncachedExternalInternalizedStringMap"),
+  ("read_only_space", 0x010cd): (26, "UncachedExternalOneByteInternalizedStringMap"),
+  ("read_only_space", 0x010f5): (58, "UncachedExternalOneByteStringMap"),
+  ("read_only_space", 0x0111d): (67, "SelfReferenceMarkerMap"),
+  ("read_only_space", 0x01151): (95, "EnumCacheMap"),
+  ("read_only_space", 0x011a1): (86, "ArrayBoilerplateDescriptionMap"),
+  ("read_only_space", 0x0129d): (98, "InterceptorInfoMap"),
+  ("read_only_space", 0x032ad): (71, "PromiseFulfillReactionJobTaskMap"),
+  ("read_only_space", 0x032d5): (72, "PromiseRejectReactionJobTaskMap"),
+  ("read_only_space", 0x032fd): (73, "CallableTaskMap"),
+  ("read_only_space", 0x03325): (74, "CallbackTaskMap"),
+  ("read_only_space", 0x0334d): (75, "PromiseResolveThenableJobTaskMap"),
+  ("read_only_space", 0x03375): (78, "FunctionTemplateInfoMap"),
+  ("read_only_space", 0x0339d): (79, "ObjectTemplateInfoMap"),
+  ("read_only_space", 0x033c5): (80, "AccessCheckInfoMap"),
+  ("read_only_space", 0x033ed): (81, "AccessorInfoMap"),
+  ("read_only_space", 0x03415): (82, "AccessorPairMap"),
+  ("read_only_space", 0x0343d): (83, "AliasedArgumentsEntryMap"),
+  ("read_only_space", 0x03465): (84, "AllocationMementoMap"),
+  ("read_only_space", 0x0348d): (87, "AsmWasmDataMap"),
+  ("read_only_space", 0x034b5): (88, "AsyncGeneratorRequestMap"),
+  ("read_only_space", 0x034dd): (89, "BreakPointMap"),
+  ("read_only_space", 0x03505): (90, "BreakPointInfoMap"),
+  ("read_only_space", 0x0352d): (91, "CachedTemplateObjectMap"),
+  ("read_only_space", 0x03555): (93, "ClassPositionsMap"),
+  ("read_only_space", 0x0357d): (94, "DebugInfoMap"),
+  ("read_only_space", 0x035a5): (97, "FunctionTemplateRareDataMap"),
+  ("read_only_space", 0x035cd): (100, "InterpreterDataMap"),
+  ("read_only_space", 0x035f5): (101, "PromiseCapabilityMap"),
+  ("read_only_space", 0x0361d): (102, "PromiseReactionMap"),
+  ("read_only_space", 0x03645): (103, "PropertyDescriptorObjectMap"),
+  ("read_only_space", 0x0366d): (104, "PrototypeInfoMap"),
+  ("read_only_space", 0x03695): (105, "ScriptMap"),
+  ("read_only_space", 0x036bd): (109, "SourceTextModuleInfoEntryMap"),
+  ("read_only_space", 0x036e5): (110, "StackFrameInfoMap"),
+  ("read_only_space", 0x0370d): (111, "StackTraceFrameMap"),
+  ("read_only_space", 0x03735): (112, "TemplateObjectDescriptionMap"),
+  ("read_only_space", 0x0375d): (113, "Tuple2Map"),
+  ("read_only_space", 0x03785): (114, "WasmCapiFunctionDataMap"),
+  ("read_only_space", 0x037ad): (115, "WasmDebugInfoMap"),
+  ("read_only_space", 0x037d5): (116, "WasmExceptionTagMap"),
+  ("read_only_space", 0x037fd): (117, "WasmExportedFunctionDataMap"),
+  ("read_only_space", 0x03825): (118, "WasmIndirectFunctionTableMap"),
+  ("read_only_space", 0x0384d): (119, "WasmJSFunctionDataMap"),
+  ("read_only_space", 0x03875): (99, "InternalClassMap"),
+  ("read_only_space", 0x0389d): (107, "SmiPairMap"),
+  ("read_only_space", 0x038c5): (106, "SmiBoxMap"),
+  ("read_only_space", 0x038ed): (108, "SortStateMap"),
+  ("read_only_space", 0x03915): (85, "AllocationSiteWithWeakNextMap"),
+  ("read_only_space", 0x0393d): (85, "AllocationSiteWithoutWeakNextMap"),
+  ("read_only_space", 0x03965): (76, "LoadHandler1Map"),
+  ("read_only_space", 0x0398d): (76, "LoadHandler2Map"),
+  ("read_only_space", 0x039b5): (76, "LoadHandler3Map"),
+  ("read_only_space", 0x039dd): (77, "StoreHandler0Map"),
+  ("read_only_space", 0x03a05): (77, "StoreHandler1Map"),
+  ("read_only_space", 0x03a2d): (77, "StoreHandler2Map"),
+  ("read_only_space", 0x03a55): (77, "StoreHandler3Map"),
   ("map_space", 0x00121): (1057, "ExternalMap"),
-  ("map_space", 0x00171): (1072, "JSMessageObjectMap"),
+  ("map_space", 0x00149): (1073, "JSMessageObjectMap"),
 }
 
 # List of known V8 objects.
 KNOWN_OBJECTS = {
-  ("read_only_space", 0x001c1): "NullValue",
-  ("read_only_space", 0x00241): "EmptyDescriptorArray",
-  ("read_only_space", 0x002a9): "EmptyWeakFixedArray",
-  ("read_only_space", 0x003a9): "UninitializedValue",
-  ("read_only_space", 0x004b9): "UndefinedValue",
-  ("read_only_space", 0x00539): "NanValue",
-  ("read_only_space", 0x00599): "TheHoleValue",
-  ("read_only_space", 0x00631): "HoleNanValue",
-  ("read_only_space", 0x00641): "TrueValue",
-  ("read_only_space", 0x006f1): "FalseValue",
-  ("read_only_space", 0x00739): "empty_string",
-  ("read_only_space", 0x00bf9): "EmptyScopeInfo",
-  ("read_only_space", 0x00c09): "EmptyFixedArray",
-  ("read_only_space", 0x00c19): "ArgumentsMarker",
-  ("read_only_space", 0x00cb9): "Exception",
-  ("read_only_space", 0x00d59): "TerminationException",
-  ("read_only_space", 0x00e01): "OptimizedOut",
-  ("read_only_space", 0x00ea1): "StaleRegister",
-  ("read_only_space", 0x02391): "EmptyEnumCache",
-  ("read_only_space", 0x023f9): "EmptyPropertyArray",
-  ("read_only_space", 0x02409): "EmptyByteArray",
-  ("read_only_space", 0x02419): "EmptyObjectBoilerplateDescription",
-  ("read_only_space", 0x02431): "EmptyArrayBoilerplateDescription",
-  ("read_only_space", 0x02499): "EmptyClosureFeedbackCellArray",
-  ("read_only_space", 0x024a9): "EmptySloppyArgumentsElements",
-  ("read_only_space", 0x024c9): "EmptySlowElementDictionary",
-  ("read_only_space", 0x02511): "EmptyOrderedHashMap",
-  ("read_only_space", 0x02539): "EmptyOrderedHashSet",
-  ("read_only_space", 0x02561): "EmptyFeedbackMetadata",
-  ("read_only_space", 0x02571): "EmptyPropertyCell",
-  ("read_only_space", 0x02599): "EmptyPropertyDictionary",
-  ("read_only_space", 0x025e9): "NoOpInterceptorInfo",
-  ("read_only_space", 0x02689): "EmptyWeakArrayList",
-  ("read_only_space", 0x026a1): "InfinityValue",
-  ("read_only_space", 0x026b1): "MinusZeroValue",
-  ("read_only_space", 0x026c1): "MinusInfinityValue",
-  ("read_only_space", 0x026d1): "SelfReferenceMarker",
-  ("read_only_space", 0x02729): "OffHeapTrampolineRelocationInfo",
-  ("read_only_space", 0x02741): "TrampolineTrivialCodeDataContainer",
-  ("read_only_space", 0x02759): "TrampolinePromiseRejectionCodeDataContainer",
-  ("read_only_space", 0x02771): "GlobalThisBindingScopeInfo",
-  ("read_only_space", 0x027d9): "EmptyFunctionScopeInfo",
-  ("read_only_space", 0x02829): "HashSeed",
+  ("read_only_space", 0x00171): "NullValue",
+  ("read_only_space", 0x001b5): "EmptyDescriptorArray",
+  ("read_only_space", 0x001ed): "EmptyWeakFixedArray",
+  ("read_only_space", 0x0026d): "UninitializedValue",
+  ("read_only_space", 0x0030d): "UndefinedValue",
+  ("read_only_space", 0x00351): "NanValue",
+  ("read_only_space", 0x00385): "TheHoleValue",
+  ("read_only_space", 0x003d9): "HoleNanValue",
+  ("read_only_space", 0x003e5): "TrueValue",
+  ("read_only_space", 0x0044d): "FalseValue",
+  ("read_only_space", 0x0047d): "empty_string",
+  ("read_only_space", 0x006e1): "EmptyScopeInfo",
+  ("read_only_space", 0x006e9): "EmptyFixedArray",
+  ("read_only_space", 0x006f1): "ArgumentsMarker",
+  ("read_only_space", 0x00751): "Exception",
+  ("read_only_space", 0x007ad): "TerminationException",
+  ("read_only_space", 0x00815): "OptimizedOut",
+  ("read_only_space", 0x00875): "StaleRegister",
+  ("read_only_space", 0x01145): "EmptyEnumCache",
+  ("read_only_space", 0x01179): "EmptyPropertyArray",
+  ("read_only_space", 0x01181): "EmptyByteArray",
+  ("read_only_space", 0x01189): "EmptyObjectBoilerplateDescription",
+  ("read_only_space", 0x01195): "EmptyArrayBoilerplateDescription",
+  ("read_only_space", 0x011c9): "EmptyClosureFeedbackCellArray",
+  ("read_only_space", 0x011d1): "EmptySloppyArgumentsElements",
+  ("read_only_space", 0x011e1): "EmptySlowElementDictionary",
+  ("read_only_space", 0x01205): "EmptyOrderedHashMap",
+  ("read_only_space", 0x01219): "EmptyOrderedHashSet",
+  ("read_only_space", 0x0122d): "EmptyFeedbackMetadata",
+  ("read_only_space", 0x01239): "EmptyPropertyCell",
+  ("read_only_space", 0x0124d): "EmptyPropertyDictionary",
+  ("read_only_space", 0x01275): "NoOpInterceptorInfo",
+  ("read_only_space", 0x012c5): "EmptyWeakArrayList",
+  ("read_only_space", 0x012d1): "InfinityValue",
+  ("read_only_space", 0x012dd): "MinusZeroValue",
+  ("read_only_space", 0x012e9): "MinusInfinityValue",
+  ("read_only_space", 0x012f5): "SelfReferenceMarker",
+  ("read_only_space", 0x01335): "OffHeapTrampolineRelocationInfo",
+  ("read_only_space", 0x01341): "TrampolineTrivialCodeDataContainer",
+  ("read_only_space", 0x0134d): "TrampolinePromiseRejectionCodeDataContainer",
+  ("read_only_space", 0x01359): "GlobalThisBindingScopeInfo",
+  ("read_only_space", 0x01391): "EmptyFunctionScopeInfo",
+  ("read_only_space", 0x013b9): "NativeScopeInfo",
+  ("read_only_space", 0x013d5): "HashSeed",
   ("old_space", 0x00121): "ArgumentsIteratorAccessor",
-  ("old_space", 0x00191): "ArrayLengthAccessor",
-  ("old_space", 0x00201): "BoundFunctionLengthAccessor",
-  ("old_space", 0x00271): "BoundFunctionNameAccessor",
-  ("old_space", 0x002e1): "ErrorStackAccessor",
-  ("old_space", 0x00351): "FunctionArgumentsAccessor",
-  ("old_space", 0x003c1): "FunctionCallerAccessor",
-  ("old_space", 0x00431): "FunctionNameAccessor",
-  ("old_space", 0x004a1): "FunctionLengthAccessor",
-  ("old_space", 0x00511): "FunctionPrototypeAccessor",
-  ("old_space", 0x00581): "RegExpResultIndicesAccessor",
-  ("old_space", 0x005f1): "StringLengthAccessor",
-  ("old_space", 0x00661): "InvalidPrototypeValidityCell",
-  ("old_space", 0x00671): "EmptyScript",
-  ("old_space", 0x006f1): "ManyClosuresCell",
-  ("old_space", 0x00709): "ArrayConstructorProtector",
-  ("old_space", 0x00731): "NoElementsProtector",
-  ("old_space", 0x00759): "IsConcatSpreadableProtector",
-  ("old_space", 0x00781): "ArraySpeciesProtector",
-  ("old_space", 0x007a9): "TypedArraySpeciesProtector",
-  ("old_space", 0x007d1): "PromiseSpeciesProtector",
-  ("old_space", 0x007f9): "StringLengthProtector",
-  ("old_space", 0x00821): "ArrayIteratorProtector",
-  ("old_space", 0x00849): "ArrayBufferDetachingProtector",
-  ("old_space", 0x00871): "PromiseHookProtector",
-  ("old_space", 0x00899): "PromiseResolveProtector",
-  ("old_space", 0x008c1): "MapIteratorProtector",
-  ("old_space", 0x008e9): "PromiseThenProtector",
-  ("old_space", 0x00911): "SetIteratorProtector",
-  ("old_space", 0x00939): "StringIteratorProtector",
-  ("old_space", 0x00961): "SingleCharacterStringCache",
-  ("old_space", 0x01171): "StringSplitCache",
-  ("old_space", 0x01981): "RegExpMultipleCache",
-  ("old_space", 0x02191): "BuiltinsConstantsTable",
+  ("old_space", 0x00165): "ArrayLengthAccessor",
+  ("old_space", 0x001a9): "BoundFunctionLengthAccessor",
+  ("old_space", 0x001ed): "BoundFunctionNameAccessor",
+  ("old_space", 0x00231): "ErrorStackAccessor",
+  ("old_space", 0x00275): "FunctionArgumentsAccessor",
+  ("old_space", 0x002b9): "FunctionCallerAccessor",
+  ("old_space", 0x002fd): "FunctionNameAccessor",
+  ("old_space", 0x00341): "FunctionLengthAccessor",
+  ("old_space", 0x00385): "FunctionPrototypeAccessor",
+  ("old_space", 0x003c9): "RegExpResultIndicesAccessor",
+  ("old_space", 0x0040d): "StringLengthAccessor",
+  ("old_space", 0x00451): "InvalidPrototypeValidityCell",
+  ("old_space", 0x00459): "EmptyScript",
+  ("old_space", 0x00499): "ManyClosuresCell",
+  ("old_space", 0x004a5): "ArrayConstructorProtector",
+  ("old_space", 0x004b9): "NoElementsProtector",
+  ("old_space", 0x004cd): "IsConcatSpreadableProtector",
+  ("old_space", 0x004e1): "ArraySpeciesProtector",
+  ("old_space", 0x004f5): "TypedArraySpeciesProtector",
+  ("old_space", 0x00509): "PromiseSpeciesProtector",
+  ("old_space", 0x0051d): "StringLengthProtector",
+  ("old_space", 0x00531): "ArrayIteratorProtector",
+  ("old_space", 0x00545): "ArrayBufferDetachingProtector",
+  ("old_space", 0x00559): "PromiseHookProtector",
+  ("old_space", 0x0056d): "PromiseResolveProtector",
+  ("old_space", 0x00581): "MapIteratorProtector",
+  ("old_space", 0x00595): "PromiseThenProtector",
+  ("old_space", 0x005a9): "SetIteratorProtector",
+  ("old_space", 0x005bd): "StringIteratorProtector",
+  ("old_space", 0x005d1): "SingleCharacterStringCache",
+  ("old_space", 0x009d9): "StringSplitCache",
+  ("old_space", 0x00de1): "RegExpMultipleCache",
+  ("old_space", 0x011e9): "BuiltinsConstantsTable",
+}
+
+# Lower 32 bits of first page addresses for various heap spaces.
+HEAP_FIRST_PAGES = {
+  0x08100000: "old_space",
+  0x08140000: "map_space",
+  0x08040000: "read_only_space",
 }
 
 # List of known V8 Frame Markers.
diff --git a/deps/v8/tools/wasm-compilation-hints/OWNERS b/deps/v8/tools/wasm-compilation-hints/OWNERS
index 89abec33f34ce2..32941e6257c7d1 100644
--- a/deps/v8/tools/wasm-compilation-hints/OWNERS
+++ b/deps/v8/tools/wasm-compilation-hints/OWNERS
@@ -1,2 +1 @@
-clemensb@chromium.org
-mstarzinger@chromium.org
+file:../../src/wasm/OWNERS
diff --git a/deps/v8/tools/wasm-compilation-hints/wasm-objdump-compilation-hints.py b/deps/v8/tools/wasm-compilation-hints/wasm-objdump-compilation-hints.py
index a762bd78a61bec..9077f97f70f229 100755
--- a/deps/v8/tools/wasm-compilation-hints/wasm-objdump-compilation-hints.py
+++ b/deps/v8/tools/wasm-compilation-hints/wasm-objdump-compilation-hints.py
@@ -4,6 +4,7 @@
 # Use of this source code is governed by a BSD-style license that can be found
 # in the LICENSE file.
 
+from __future__ import print_function
 import argparse
 import io
 import sys
@@ -34,10 +35,10 @@ def parse_args():
         section_name_bs = fin.read(section_name_length)
         if section_name_bs == "compilationHints":
           num_hints, bs = read_varuintN(fin)
-          print "Custom section compilationHints with", num_hints, "hints:"
+          print("Custom section compilationHints with ", num_hints, "hints:")
           for i in range(num_hints):
             hint, bs = read_uint8(fin)
-            print i, hex(hint)
+            print(i, " ", hex(hint))
         else:
           remaining_length = payload_length \
               - len(section_name_length_bs) \
diff --git a/deps/v8/tools/wasm/update-wasm-spec-tests.sh b/deps/v8/tools/wasm/update-wasm-spec-tests.sh
index b3e9185c4dfaa8..0b8eb6790d8e39 100755
--- a/deps/v8/tools/wasm/update-wasm-spec-tests.sh
+++ b/deps/v8/tools/wasm/update-wasm-spec-tests.sh
@@ -71,7 +71,7 @@ log_and_run cp -r ${TMP_DIR}/spec/test/js-api/* ${JS_API_TEST_DIR}/tests
 # Generate the proposal tests.
 ###############################################################################
 
-repos='bulk-memory-operations reference-types js-types JS-BigInt-integration'
+repos='bulk-memory-operations reference-types js-types JS-BigInt-integration multi-value'
 
 for repo in ${repos}; do
   echo "Process ${repo}"
diff --git a/deps/v8/tools/whitespace.txt b/deps/v8/tools/whitespace.txt
index c9a3400c497498..e55c9c427dce04 100644
--- a/deps/v8/tools/whitespace.txt
+++ b/deps/v8/tools/whitespace.txt
@@ -7,6 +7,10 @@ A Smi balks into a war and says:
 The doubles heard this and started to unbox.
 The Smi looked at them when a crazy v8-autoroll account showed up...
 The autoroller bought a round of Himbeerbrause. Suddenly.....
-The bartender starts to shake the bottles..................
-I can't add trailing whitespaces, so I'm adding this line.
+The bartender starts to shake the bottles.....................
+I can't add trailing whitespaces, so I'm adding this line...
 I'm starting to think that just adding trailing whitespaces might not be bad.
+
+Because whitespaces are not that funny.....
+Today's answer to life the universe and everything is 12950!
+Today's answer to life the universe and everything is 6727!
diff --git a/deps/v8/tools/windbg.js b/deps/v8/tools/windbg.js
index bcf45a496b45ad..3fbc588ea1cf77 100644
--- a/deps/v8/tools/windbg.js
+++ b/deps/v8/tools/windbg.js
@@ -647,7 +647,7 @@ function print_memory(space = "all") {
       h.code_space_.allocation_info_.top_);
   }
   if (st.includes("all") || st.includes("large") || st.includes("lo")) {
-    print_memory_chunk_list("LargeObjectSpace",
+    print_memory_chunk_list("OldLargeObjectSpace",
       h.lo_space_.memory_chunk_list_.front_);
   }
   if (st.includes("all") || st.includes("newlarge") || st.includes("nlo")) {